@lapxo/head 0.0.0-stage → 0.1.3

package/dist/src/flows/device.js

@@ -0,0 +1,32 @@
+import { placeNameOf } from "../core/answer.js";
+import { canonical, parse } from '@lapxo/topos/wire';
+import { deviceOf, idIn, uncoveredIn } from "../core/device.js";
+import { members, valueOf } from "../core/lock.js";
+import { fill, sayIn } from "../core/surface.js";
+import { adoptsIn } from "../adopt/adopt.js";
+/** A key of this device by its role: read from the keychain, or made there once; only its public half is ever handed on. */
+export const deviceKey = (context, role) => context.keys.made?.(deviceOf(context.lock, role).account);
+/** The keychain account of a place's root, when this keychain holds it — who configures the place is here; else what head says of that. */
+export const rootIn = (context, place) => ((account) => (context.keys.read(account) === undefined ? { said: [sayIn(context.lock)('no-root', { place })] } : { account }))(fill(valueOf(context.lock, 'founding/root-account'), { place: placeNameOf(place) }));
+export const widening = (context, place, lines, lot) => {
+    const parent = adoptsIn(context.lock, lines);
+    if (parent !== undefined)
+        return { said: [sayIn(context.lock)('parent-lock', { place, parent })] };
+    const [root, witness, field] = [rootIn(context, place), idIn(lines, context.device('person')), valueOf(context.lock, 'widening/witness')];
+    const wire = lines.filter((l) => l.scope === 'wire/fields');
+    const witnessed = (signed) => signed.map((line) => ((got) => (got.kind === 'fact' ? canonical({ ...got.value.fields, [field]: witness }) : line))(parse(line)));
+    if ('account' in root && witness !== undefined) {
+        if (wire.some((l) => members(l.value ?? '').includes(field)))
+            return { sign: (signed) => context.signRoot(place, witnessed(signed), root.account), land: (signed) => context.landRoot(place, witnessed(signed), root.account) };
+        if (lot.every((line) => / scope=wire\/fields /.test(line)))
+            return { sign: (signed) => context.signRoot(place, signed, root.account), land: (signed) => context.landRoot(place, signed, root.account) };
+        const [named, bare] = [[...new Set([...wire.flatMap((l) => members(l.value ?? '')), field])].join('|'), (l) => Object.fromEntries(Object.entries(l).filter(([k]) => !['sig', 'epoch'].includes(k)))];
+        return { said: [sayIn(context.lock)('unwitnessed', { place }), ...wire.map((l) => canonical({ ...bare(l), by: 'target', value: 'withdraw' })),
+                canonical({ at: `policy:head/wire/${new Date(context.now()).toISOString()}`, by: 'target', form: 'alphabet', measure: 'id', role: 'reads', scope: 'wire/fields', value: named })] };
+    }
+    const stopped = uncoveredIn(context.lock, lines, context.device('person'), place, lot);
+    if (stopped)
+        return { said: stopped };
+    const again = lot.flatMap((line) => ((got) => (got.kind === 'fact' && lines.some((l) => l.scope === got.value.fields.scope && l.measure === got.value.fields.measure) ? [got.value.fields.scope ?? ''] : []))(parse(line)))[0];
+    return again !== undefined ? { said: [sayIn(context.lock)('attested-again', { place, scope: again })] } : { sign: (signed) => context.signAs(place, signed, 'person', lines), land: (signed) => context.landAs(place, signed, 'person', lines) };
+};

package/dist/src/flows/plan.d.ts

@@ -0,0 +1,8 @@
+import type { Asked, Context } from '../core/answer.ts';
+/**
+ * A proposal the person signs: drafted lines shown to the person with the place and the base they are made against; on
+ * their yes to exactly those, signed by their key; what bound prints folding it as if landed comes back as it printed it. Nothing lands; the lot is kept by its digest.
+ */
+export declare const planLot: (asked: Asked, context: Context) => Promise<readonly string[]>;
+/** A planned lot landed by its digest, only while the place stands on the base it was planned against. */
+export declare const landLot: (asked: Asked, context: Context) => Promise<readonly string[]>;

package/dist/src/flows/plan.js

@@ -0,0 +1,51 @@
+import { baseOf, inPlace, standingOr } from "../core/answer.js";
+import { sayIn } from "../core/surface.js";
+import { widening } from "./device.js";
+import { parse } from '@lapxo/topos/wire';
+/**
+ * A proposal the person signs: drafted lines shown to the person with the place and the base they are made against; on
+ * their yes to exactly those, signed by their key; what bound prints folding it as if landed comes back as it printed it. Nothing lands; the lot is kept by its digest.
+ */
+export const planLot = (asked, context) => inPlace(asked, context, async (place) => {
+    const say = sayIn(context.lock);
+    const lot = (asked['lines'] ?? '').split('\n').filter(Boolean);
+    if (!lot.length || lot.some((line) => ((got) => got.kind !== 'fact' || got.value.fields['sig'] !== undefined || got.value.fields['by'] !== 'target')(parse(line))))
+        return [say('bad-lot')];
+    const held = await standingOr(context, place);
+    if ('said' in held)
+        return held.said;
+    const base = baseOf(held.lines);
+    const by = widening(context, place, held.lines, lot);
+    if ('said' in by)
+        return by.said;
+    const consent = await context.elicit(say('elicit', { count: String(lot.length), place, base, lines: lot.join('\n') }));
+    if (consent === 'none')
+        return [say('sign-yourself', { place }), ...lot];
+    if (consent === 'no')
+        return [say('no-yes')];
+    const signed = await by.sign(lot);
+    if ('refused' in signed)
+        return [signed.refused];
+    const now = await standingOr(context, place);
+    if ('said' in now)
+        return now.said;
+    if (baseOf(now.lines) !== base)
+        return [say('base-moved', { base })];
+    const kept = context.cache.keep(Buffer.from(JSON.stringify({ place, base, signed: signed.lines })));
+    return [say('planned', { lot: kept, base }), ...(await context.told(place, signed.lines))];
+});
+/** A planned lot landed by its digest, only while the place stands on the base it was planned against. */
+export const landLot = async (asked, context) => {
+    const say = sayIn(context.lock);
+    const bytes = context.cache.held(asked['lot'] ?? '');
+    if (bytes === undefined)
+        return [say('no-lot', { lot: asked['lot'] ?? '' })];
+    const kept = JSON.parse(Buffer.from(bytes).toString('utf8'));
+    const now = await standingOr(context, kept.place);
+    if ('said' in now)
+        return now.said;
+    if (baseOf(now.lines) !== kept.base)
+        return [say('base-moved', { base: kept.base })];
+    const landed = await context.land(kept.place, kept.signed);
+    return 'refused' in landed ? [landed.refused] : [say('landed', { count: String(landed.lines.length) }), ...landed.lines];
+};

package/dist/src/flows/read.d.ts

@@ -0,0 +1,9 @@
+import type { Asked, Context } from '../core/answer.ts';
+/**
+ * A read of one offer the place declares of the class head reads: the response comes back once, typed by the world,
+ * and both are kept — the body's digest and the typed answer's, receipts the device key signs. Asked again as the same
+ * principal, while the place stands on what typed it, the person's grant holds now and the newest read is younger than
+ * the reuse the place allows, it answers from what was kept: nothing called. Asked for history, it shows what was kept
+ * of that request as of when it was read — evidence of that read, never a current answer — where the place allows it.
+ */
+export declare const readSource: (asked: Asked, context: Context) => Promise<readonly string[]>;

package/dist/src/flows/read.js

@@ -0,0 +1,95 @@
+import { under } from "../core/lock.js";
+import { observedAt, planRead } from "../core/read.js";
+import { basisOf, draftOf, receiptsOf, scopeOf, spentOf } from "../core/receipt.js";
+import { redIn, sayIn } from "../core/surface.js";
+import { grantedOf, isOpen, untilOf } from "../core/act.js";
+import { canonical } from '@lapxo/topos/wire';
+import { called } from "./call.js";
+import { principalOf } from "../access/obtain.js";
+import { jsonOf } from "../access/contract.js";
+/** An intent an earlier act left open, closed by the read that looked at what it would have changed: a line naming that read-s digest, signed by head. */
+const closeWith = async (intent, source, digest, { word, lines, lands }, context) => {
+    const say = sayIn(context.lock);
+    if (!intent)
+        return [];
+    if (!intent.startsWith(`${word('act/family')}/${source}/`) || !isOpen(lines, intent, [word('act/done'), word('act/closed')]))
+        return [say('nothing-open', { intent })];
+    const landed = await lands(draftOf('', word('receipt/at'), `${intent}/${word('act/closed')}`, digest, new Date(context.now()).toISOString()));
+    return 'refused' in landed ? [say('not-landed', { why: landed.refused })] : [...landed.lines, say('closed', { intent, digest })];
+};
+/**
+ * A read of one offer the place declares of the class head reads: the response comes back once, typed by the world,
+ * and both are kept — the body's digest and the typed answer's, receipts the device key signs. Asked again as the same
+ * principal, while the place stands on what typed it, the person's grant holds now and the newest read is younger than
+ * the reuse the place allows, it answers from what was kept: nothing called. Asked for history, it shows what was kept
+ * of that request as of when it was read — evidence of that read, never a current answer — where the place allows it.
+ */
+export const readSource = (asked, context) => ((started) => called(asked, context, planRead, async ({ word, say, place, lines, source, operation, plan, prepared, most, typed, attach, send, lands, widen, uncovered }) => {
+    const [family, at, when] = [word('receipt/family'), word('receipt/at'), new Date(context.now()).toISOString()];
+    const closing = (digest) => closeWith(asked['closes'], source, digest, { word, lines, lands }, context);
+    const scopes = (principal) => [scopeOf(family, source, operation, prepared.key, principal), `${scopeOf(word('receipt/kept'), source, operation, prepared.key, principal)}/${basisOf(lines, word, source)}`];
+    const held = (digest) => ((bytes) => (bytes === undefined || digest === undefined ? undefined : { digest, bytes }))(digest === undefined ? undefined : context.cache.held(digest));
+    const keeping = (kept, answer) => (answer.length > 1 ? [draftOf(word('receipt/kept'), at, kept, context.cache.keep(Buffer.from(answer.join('\n'))), when)] : []);
+    const allowed = (key, measure) => (lines.find((l) => l.scope === `${word(key)}/${source}` && l.measure === measure) ?? lines.find((l) => l.scope === word(key) && l.measure === measure))?.value;
+    if (asked['why'] === 'true') {
+        const asOf = principalOf(context, plan, false), [newest] = asOf === undefined ? [] : receiptsOf(lines, at, scopes(asOf)[0]), pin = lines.find((l) => l.scope === `uses/${source}`);
+        const signed = newest && lines.find((l) => l.scope === newest.scope && l.value === newest.digest && l.at === `${at}:${newest.at}`), worlds = lines.filter((l) => l.scope?.startsWith('uses/') && (!l.needs || under(context.lock, 'place/worlds', l.needs))).map((l) => `${l.scope.slice('uses/'.length)} ${l.value}`);
+        return newest === undefined ? say('why-none', { source, operation }) : say('why', { source, operation, origin: plan.origin, at: newest.at, by: signed?.by ?? '', epoch: signed?.epoch ?? '', digest: newest.digest, pin: pin?.value ?? '', pinned: pin?.epoch ?? '', worlds: worlds.join(', ') });
+    }
+    if (asked['history'] === 'true') {
+        const asOf = principalOf(context, plan, false);
+        if (allowed('history/family', 'status') !== 'present')
+            return [...say('history-undeclared', { place, source }), canonical({ at: 'policy:person/history', by: 'target', form: 'alphabet', measure: 'status', role: 'writes', scope: `${word('history/family')}/${source}`, value: 'present' })];
+        const [newest, ...earlier] = asOf === undefined ? [] : receiptsOf(lines, at, scopes(asOf)[0]);
+        if (newest === undefined)
+            return say('history-none', { source, operation });
+        const keptThen = receiptsOf(lines, at, scopeOf(word('receipt/kept'), source, operation, prepared.key, asOf), true).find((k) => k.at === newest.at);
+        const typedThen = held(keptThen?.digest);
+        return [...say('history', { source, operation, at: newest.at, digest: newest.digest }), ...(typedThen ? new TextDecoder().decode(typedThen.bytes).split('\n') : say(keptThen ? 'history-gone' : 'history-untyped')),
+            ...earlier.flatMap((r) => say('history-earlier', { source, at: r.at, digest: r.digest }))];
+    }
+    const principal = principalOf(context, plan);
+    const stopped = uncovered('head', scopes(principal ?? ''));
+    if (stopped)
+        return stopped;
+    if (!grantedOf(lines, word('grant/family'), source, context.now())) {
+        const sources = [...new Set(lines.filter((l) => l.scope?.startsWith(`${word('vocab/region')}/`) && l.measure === word('vocab/origins')).map((l) => l.scope.split('/')[1]))].sort();
+        const until = untilOf(word('access/period'), context.now());
+        const line = (measure, value) => canonical({ at: 'policy:person/grants', by: 'target', form: 'alphabet', measure, role: 'writes', scope: word('grant/family'), value });
+        const granted = await widen(say('grant', { sources: sources.join(', '), place, until })[0], [line('sources', sources.join('|')), line('until', until)]);
+        if ('said' in granted)
+            return granted.said;
+    }
+    const reuse = Number(/^\d+\.\.(\d+)$/.exec(allowed('reuse/family', 'seconds') ?? '')?.[1] ?? Number.NaN);
+    const [newest] = principal === undefined ? [] : receiptsOf(lines, at, scopes(principal)[0]), stood = ((b) => b !== undefined && Number(Buffer.from(b.bytes.subarray(0, b.bytes.indexOf(10))).toString('utf8')) < 300)(held(newest?.digest));
+    if (principal !== undefined && newest !== undefined && stood && context.now() - Date.parse(newest.at) <= reuse * 1000) {
+        const [scope, kept] = scopes(principal);
+        const answered = held(receiptsOf(lines, at, kept).find((k) => k.at >= newest.at)?.digest);
+        if (answered !== undefined)
+            return [...new TextDecoder().decode(answered.bytes).split('\n'), ...say('reused', { scope: kept, digest: answered.digest, at: newest.at }), ...(await closing(newest.digest)), ...redIn(context.lock)('answer/kept', `answer/${source}/${operation}@${word('look/call')}`, started, context.machine())];
+        const body = held(newest.digest);
+        if (body !== undefined) {
+            const cut = body.bytes.indexOf(10);
+            const answer = await typed(Buffer.from(body.bytes.subarray(0, cut)).toString('utf8'), body.bytes.subarray(cut + 1));
+            const keptLines = keeping(kept, answer);
+            const landed = keptLines.length ? await lands(...keptLines) : { lines: [] };
+            return [...answer, ...say('reread', { scope, digest: body.digest, at: newest.at }), ...('lines' in landed ? landed.lines : []), ...(await closing(body.digest))];
+        }
+    }
+    if (spentOf(lines, family, at, source, context.now()) >= most('read/rate'))
+        return say('rate', { source });
+    const attached = await attach();
+    if ('said' in attached)
+        return attached.said;
+    const [scope, kept] = scopes(attached.principal ?? '');
+    const got = await send(attached.attachment);
+    if (got.kind !== 'got')
+        return say(got.kind === 'over' ? 'too-large' : 'unreachable-source', { source });
+    const digest = context.cache.keep(Buffer.concat([Buffer.from(`${got.status}\n`), got.bytes]));
+    const answer = await typed(String(got.status), got.bytes);
+    const observed = plan.access.probe && got.status < 300 ? [canonical({ at: `${at}:${when}`, by: 'target', form: 'alphabet', measure: word('vocab/access'), role: 'writes', scope: observedAt(context.lock, source, operation), value: word('vocab/anonymous') })] : [];
+    const found = plan.access.probe && got.status === 401 && got.authenticate ? await (await context.access(word('access/adapter')))?.discover?.(plan.origin, got.authenticate, async (url) => jsonOf((await context.files.read.documentOf(context, place, url))?.bytes ?? new Uint8Array())) : undefined;
+    const by = `${word('access/family')}/${source}/${word('access/authorizer')}`, authorizer = Object.entries(found ?? {}).flatMap(([k, f]) => Object.entries(f).map(([measure, all]) => canonical({ at: `${at}:${when}`, by: 'target', form: 'alphabet', measure, role: 'writes', scope: k ? `${by}/${k}` : by, value: all.join('|') })));
+    const landed = await lands(draftOf(family, at, scope, digest, when), ...(attached.principal === undefined ? [] : keeping(kept, answer)), ...observed, ...authorizer);
+    return [...answer, ...('lines' in landed ? [...landed.lines, ...(await closing(digest))] : say('not-landed', { why: landed.refused })), ...(found?.['']?.['issuer'] && 'lines' in landed ? say('authorizer-observed', { source, issuer: found['']['issuer'][0] }) : [])];
+}))(context.machine());

package/dist/src/flows/world.d.ts

@@ -0,0 +1,12 @@
+import type { Context } from '../core/answer.ts';
+import type { Said } from '../core/lock.ts';
+/**
+ * The lines a place stands on with what its sources compile to. A source the place pins is read from the standing it
+ * pins, checked by hashing the bytes it holds — compiled once, never folded again; a file that no longer hashes to its pin
+ * is no standing. A place that pins a lock as its parent stands on nothing head may read: composing the two is bound's, never head's. A place that pins none and names a view has bound compile it, asked once; a fold bound refused is no standing either.
+ */
+export declare const standingFor: (context: Context, place: string) => Promise<{
+    readonly lines: readonly Said[];
+} | {
+    readonly unsettled: string;
+}>;

package/dist/src/flows/world.js

@@ -0,0 +1,29 @@
+import { join } from 'node:path';
+import { under, valueOf } from "../core/lock.js";
+import { sayIn } from "../core/surface.js";
+import { pinnedOf } from "../core/worlds.js";
+import { adoptsIn } from "../adopt/adopt.js";
+/**
+ * The lines a place stands on with what its sources compile to. A source the place pins is read from the standing it
+ * pins, checked by hashing the bytes it holds — compiled once, never folded again; a file that no longer hashes to its pin
+ * is no standing. A place that pins a lock as its parent stands on nothing head may read: composing the two is bound's, never head's. A place that pins none and names a view has bound compile it, asked once; a fold bound refused is no standing either.
+ */
+export const standingFor = async (context, place) => {
+    const [held, view] = [await context.standing(place), valueOf(context.lock, 'place/view')];
+    if ('refused' in held)
+        return { unsettled: held.refused };
+    const own = held.lines;
+    const parent = adoptsIn(context.lock, own);
+    if (parent !== undefined)
+        return { unsettled: sayIn(context.lock)('parent-lock', { place, parent }) };
+    const pins = own.filter((l) => l.scope?.startsWith('uses/') && under(context.lock, 'place/compiled', l.needs)).map((l) => [l, pinnedOf(context.lock, context.files.take(join(place, l.needs)))]);
+    const moved = pins.find(([l, p]) => p?.pin !== l.value);
+    if (moved)
+        return { unsettled: sayIn(context.lock)('compiled-moved', { file: moved[0].needs }) };
+    if (pins.length)
+        return { lines: [...own, ...pins.flatMap(([, p]) => p.lines)] };
+    if (!own.some((line) => line.scope === `view/${view}`))
+        return { lines: own };
+    const world = await context.world(place, view);
+    return 'refused' in world ? { unsettled: world.refused } : { lines: [...own, ...world.lines] };
+};

package/dist/src/index.d.ts

@@ -0,0 +1,2 @@
+#!/usr/bin/env node
+export {};

package/dist/src/index.js

@@ -0,0 +1,138 @@
+#!/usr/bin/env node
+var __rewriteRelativeImportExtension = (this && this.__rewriteRelativeImportExtension) || function (path, preserveJsx) {
+    if (typeof path === "string" && /^\.\.?\//.test(path)) {
+        return path.replace(/\.(tsx)$|((?:\.d)?)((?:\.[^./]+?)?)\.([cm]?)ts$/i, function (m, tsx, d, ext, cm) {
+            return tsx ? preserveJsx ? ".jsx" : ".js" : d && (!ext || !cm) ? m : (d + ext + "." + cm.toLowerCase() + "js");
+        });
+    }
+    return path;
+};
+import { basename, join } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { Server } from '@modelcontextprotocol/sdk/server/index.js';
+import { StdioServerTransport } from '@modelcontextprotocol/sdk/server/stdio.js';
+import { CallToolRequestSchema, GetPromptRequestSchema, ListPromptsRequestSchema, ListResourcesRequestSchema, ListResourceTemplatesRequestSchema, ListToolsRequestSchema, ReadResourceRequestSchema } from '@modelcontextprotocol/sdk/types.js';
+import { answerOf } from "./core/answer.js";
+import { valueOf } from "./core/lock.js";
+import { fill, sayIn } from "./core/surface.js";
+import { matchTemplate, refusedOn, shapeOf, shapeSchema, surfaceOf } from "./ports/surface.js";
+import { closing, cooled, founded, land, landAct, limits, pinnedAt, policyAt, run, settledView, sign, standingAt, told, warm, words } from "./ports/bound.js";
+import { warmth } from "./ports/warm.js";
+import { held, keep } from "./ports/cache.js";
+import { registryFor } from "./ports/signers.js";
+import { dropAt, folderOf, hasAt, layAt, listAt, lockAt, takeAt } from "./ports/place.js";
+import * as documents from "./ports/documents.js";
+import { keychain } from "./ports/keychain.js";
+import { algorithmOf, deviceOf, idIn } from "./core/device.js";
+import { publicOf } from "./ports/keys.js";
+import { personOf } from "./ports/access/person.js";
+import { inTurn } from "./flows/call.js";
+const [ext, root] = ((self) => [self.slice(self.lastIndexOf('.')), fileURLToPath(new URL(self.endsWith('.ts') ? '..' : '../..', self))])(import.meta.url);
+const lock = lockAt(root);
+const surface = surfaceOf(lock);
+const runs = valueOf(lock, 'runs');
+Object.assign(words, Object.fromEntries(['read', 'view', 'sign', 'land', 'key', 'signer', 'pin', 'topos', 'standing', 'evidence', 'act', 'profile', 'receipts', 'refusal'].map((w) => [w, valueOf(lock, `bound/${w}`)])));
+Object.assign(limits, { wait: Number(valueOf(lock, 'bound/wait').split('..')[1]), most: Number(valueOf(lock, 'bound/printed').split('..')[1]) });
+Object.assign(warmth, { spares: Number(valueOf(lock, 'bound/spares').split('..')[1]), boot: valueOf(lock, 'bound/spare-env').split('|') });
+/** One call at a time, with bound started ahead for it and nothing of it kept once it is answered. */
+const turn = (act) => inTurn('', () => { void warm(runs); return act().finally(cooled); });
+const offered = (n) => (n ? { listChanged: false } : undefined);
+const server = new Server({ name: surface.name, version: surface.version }, { capabilities: { tools: offered(surface.tools.length), resources: offered(surface.resources.length), prompts: offered(surface.prompts.length) } });
+/** The person, asked as the client lets head ask; every wait on them is counted, so a time ceiling measures head's work and never the person's. */
+let waited = 0;
+const timed = (ask) => async (...args) => { const t = Date.now(); try {
+    return await ask(...args);
+}
+finally {
+    waited += Date.now() - t;
+} };
+const asked = personOf(lock, { can: () => ((e) => ({ url: Boolean(e?.url), form: e !== undefined && (e.form !== undefined || Object.keys(e).length === 0) }))(server.getClientCapabilities()?.elicitation), elicit: (params) => server.elicitInput(params, { timeout: Number(valueOf(lock, 'access/wait').split('..')[1]) }) });
+const person = { consent: timed(asked.consent), enter: timed(asked.enter), choose: timed(asked.choose), visit: timed(asked.visit) };
+/** head is its home: the folder of its index of places, and the keychain service its keys live under, one per home, so two heads on one keychain never share a key. A place's root is told to bound by the key id its lock names, its secret kept there under the place's account. */
+const home = process.env[valueOf(lock, 'home/env')] || join(process.env[valueOf(lock, `platform/${process.platform}/home`)] ?? '', valueOf(lock, 'home/folder'));
+const service = `${deviceOf(lock).service}/${basename(home).replace(/[^\w.-]+/g, '-')}`;
+const store = valueOf(lock, `platform/${process.platform}/store`);
+const keys = keychain(service, store);
+const devices = new Map();
+const device = (role) => devices.get(role) ?? ((secret) => (secret === undefined ? undefined : ((key) => { devices.set(role, key); return key; })(publicOf(secret))))(keys.read(deviceOf(lock, role).account));
+const asRoot = (account) => ((device, key) => [key, device.signer, { BOUND_SIGNERS: registryFor(device.signer, service, account, key, valueOf(lock, 'founding/algorithm'), store) }])(deviceOf(lock), valueOf(lock, 'founding/root').split('/')[1]);
+/** What a call is answered with, one call at a time as when bound blocked head: every bound process it starts is stopped when the client cancels it, and a call cancelled while it waits its turn is never begun. */
+const contextOf = (signal) => {
+    /** One call's folds of a place, kept until something lands in it or is laid there; and the places its root acted in, whose receipts close once, when the call ends. */
+    const [folds, touched] = [new Map(), new Set()], forget = (place) => { for (const k of [...folds.keys()])
+        if (k.endsWith(`\0${place}`))
+            folds.delete(k); };
+    const once = (key, place, fold) => (folds.get(`${key}\0${place}`) ?? ((p) => (folds.set(`${key}\0${place}`, p), p))(fold()));
+    const acted = (place, root, done) => done.finally(() => { forget(place); if (root)
+        touched.add(place); });
+    const signRoot = (place, lot, account) => sign(runs, place, lot, ...asRoot(account), signal);
+    const signAs = (place, lot, role, lines) => ((one, id) => sign(runs, place, lot, id, one.signer, { BOUND_SIGNERS: registryFor(one.signer, service, one.account, id, algorithmOf(lines), store) }, signal))(deviceOf(lock, role), idIn(lines, device(role)) ?? deviceOf(lock, role).account);
+    return {
+        lock,
+        bound: (cwd, args) => run(runs, cwd, args, {}, signal),
+        standing: (place) => once('standing', place, () => standingAt(runs, place, (lines) => ['head', 'person'].flatMap((role) => ((id) => (id === undefined ? [] : [id]))(idIn(lines, device(role)))), (line) => line.at?.startsWith(`${valueOf(lock, 'receipt/at')}:`) === true, signal)),
+        policy: (place) => once('policy', place, () => policyAt(runs, place, signal)),
+        world: (place, view) => once(`world/${view}`, place, () => settledView(runs, place, view, signal)),
+        adapter: async (origin) => ((name) => (!/^[a-z-]+$/.test(name) ? undefined : import(__rewriteRelativeImportExtension(new URL(`./ports/adapters/${name}${ext}`, import.meta.url).href))))(URL.canParse(origin) ? valueOf(lock, `adapter/${new URL(origin).protocol.slice(0, -1)}`) : ''),
+        files: { lay: (place, rel, bytes) => { forget(place); layAt(place, rel, bytes); }, drop: (place, rel) => { forget(place); dropAt(place, rel); }, has: hasAt, list: listAt, read: documents, take: takeAt, own: (rel) => takeAt(join(root, rel)) },
+        home: () => home,
+        personal: () => process.env[valueOf(lock, `platform/${process.platform}/home`)] ?? '',
+        found: (place, account) => acted(place, true, founded(runs, place, ...asRoot(account), signal)),
+        signRoot,
+        landRoot: (place, lot, account) => acted(place, true, landAct(runs, place, lot, ...asRoot(account), signal)),
+        settle: async () => { const red = []; for (const place of touched) {
+            const why = await closing(runs, place, signal);
+            if (why !== undefined)
+                red.push(sayIn(lock)('receipts-open', { place, why }));
+        } touched.clear(); return red; },
+        pinned: (place, file) => pinnedAt(runs, place, file, signal),
+        access: async (kind) => (kind !== valueOf(lock, 'access/adapter') || !/^[a-z0-9-]+$/.test(kind) ? undefined : import(__rewriteRelativeImportExtension(new URL(`./ports/access/${kind}${ext}`, import.meta.url).href)).then((m) => m.adapter)),
+        person,
+        cache: { keep, held },
+        signAs,
+        landAs: (place, lot, role, lines) => acted(place, false, ((one, id) => landAct(runs, place, lot, id, one.signer, { BOUND_SIGNERS: registryFor(one.signer, service, one.account, id, algorithmOf(lines), store) }, signal))(deviceOf(lock, role), idIn(lines, device(role)) ?? deviceOf(lock, role).account)),
+        land: (place, signed) => acted(place, true, land(runs, place, signed, signal)),
+        told: (place, signed) => told(runs, place, signed, words.standing, signal),
+        elicit: (message) => person.consent(message, valueOf(lock, 'said/elicit/yes')),
+        now: () => Date.now(),
+        machine: () => Date.now() - waited,
+        keys,
+        device,
+        roots: async () => (server.getClientCapabilities()?.roots ? (await server.listRoots()).roots.flatMap((root) => folderOf(root.uri) ?? []) : []),
+    };
+};
+const askedOf = (raw) => Object.fromEntries(Object.entries(raw ?? {}).map(([k, v]) => [k, v === undefined ? undefined : typeof v === 'object' ? JSON.stringify(v) : String(v)]));
+const schemaOf = (fields) => ({ type: 'object',
+    properties: Object.fromEntries(fields.map((f) => [f.name, { type: f.type, description: f.about }])), required: fields.filter((f) => f.required).map((f) => f.name) });
+if (surface.tools.length)
+    server.setRequestHandler(ListToolsRequestSchema, () => ({ tools: surface.tools.map((tool) => ({ name: tool.name, description: tool.about,
+            inputSchema: schemaOf([...tool.fields]), outputSchema: shapeSchema(lock), annotations: Object.fromEntries(tool.hints.map((hint) => [`${hint}Hint`, true])) })) }));
+if (surface.tools.length)
+    server.setRequestHandler(CallToolRequestSchema, async (request, extra) => turn(async () => {
+        const tool = surface.tools.find((one) => one.name === request.params.name);
+        if (tool === undefined)
+            return { isError: true, content: [] };
+        const refused = refusedOn(lock, process.platform);
+        const context = contextOf(extra.signal), answer = refused !== undefined ? [refused] : extra.signal.aborted ? [] : [...await (await answerOf('tools', tool.name))(askedOf(request.params.arguments), context), ...await context.settle()];
+        return { content: [{ type: 'text', text: answer.join('\n') }], structuredContent: shapeOf(answer) };
+    }));
+if (surface.resources.length)
+    server.setRequestHandler(ListResourcesRequestSchema, () => ({ resources: [] }));
+if (surface.resources.length)
+    server.setRequestHandler(ListResourceTemplatesRequestSchema, () => ({ resourceTemplates: surface.resources.map((r) => ({ name: r.name, uriTemplate: r.template, description: r.about, mimeType: r.mime })) }));
+if (surface.resources.length)
+    server.setRequestHandler(ReadResourceRequestSchema, async (request, extra) => turn(async () => {
+        const found = surface.resources.flatMap((r) => ((vars) => (vars === undefined ? [] : [{ r, vars }]))(matchTemplate(r.template, request.params.uri)))[0];
+        if (found === undefined)
+            return { contents: [] };
+        const refused = refusedOn(lock, process.platform);
+        if (refused !== undefined)
+            return { contents: [{ uri: request.params.uri, mimeType: found.r.mime, text: refused }] };
+        const lines = await (await answerOf('resources', found.r.name))(askedOf(found.vars), contextOf(extra.signal));
+        return { contents: [{ uri: request.params.uri, mimeType: found.r.mime, text: lines.join('\n') }] };
+    }));
+if (surface.prompts.length)
+    server.setRequestHandler(ListPromptsRequestSchema, () => ({ prompts: surface.prompts.map((p) => ({ name: p.name, description: p.about, arguments: p.fields.map((f) => ({ name: f.name, description: f.about, required: f.required })) })) }));
+if (surface.prompts.length)
+    server.setRequestHandler(GetPromptRequestSchema, (request) => ((p) => ({ messages: p === undefined ? [] : [{ role: 'user', content: { type: 'text', text: [p.text, p.line].filter(Boolean).map((t) => fill(t, askedOf(request.params.arguments))).join('\n') } }] }))(surface.prompts.find((one) => one.name === request.params.name)));
+await server.connect(new StdioServerTransport());

package/dist/src/onboard/first.d.ts

@@ -0,0 +1,7 @@
+import { type Asked, type Context } from '../core/answer.ts';
+/**
+ * The first source a person connects with no place named and none to read from: their place is founded in the folder
+ * the lock names under their own home, and the source connected to it, on one yes for both. A folder that already holds
+ * a place is used as it stands, never founded again, and its connect asks its own yes.
+ */
+export declare const firstRun: (asked: Asked, context: Context, then: (place: string, covered: boolean) => Promise<readonly string[]>) => Promise<readonly string[]>;

package/dist/src/onboard/first.js

@@ -0,0 +1,21 @@
+import { basename, join } from 'node:path';
+import { LOCK } from '@lapxo/topos/wire';
+import { unless } from "../core/answer.js";
+import { valueOf } from "../core/lock.js";
+import { sayIn } from "../core/surface.js";
+import { bornAt } from "../places/found.js";
+/**
+ * The first source a person connects with no place named and none to read from: their place is founded in the folder
+ * the lock names under their own home, and the source connected to it, on one yes for both. A folder that already holds
+ * a place is used as it stands, never founded again, and its connect asks its own yes.
+ */
+export const firstRun = async (asked, context, then) => {
+    const say = sayIn(context.lock), dir = join(context.personal(), valueOf(context.lock, 'first-run/folder')), name = basename(dir);
+    if (context.files.has(dir, LOCK))
+        return then(dir, false);
+    const refused = await unless(context, say('elicit-first-run', { dir, source: asked['source'] ?? '', document: asked['document'] ?? '' }));
+    if (refused)
+        return refused;
+    const born = await bornAt(context, dir, name);
+    return born[0] === say('born', { name, dir }) ? [...born, ...(await then(dir, true))] : born;
+};

package/dist/src/places/admit.d.ts

@@ -0,0 +1,7 @@
+import type { Asked, Context } from '../core/answer.ts';
+/**
+ * Another device admitted into a place by whoever holds its root, once they said yes: the public key its own lines hand
+ * over — what those lines claim it may sign is not read — admitted under the name given here, covering what is given here
+ * or, without it, what a member is covered for: it asks, keeps what it read and proves access, and widens nothing.
+ */
+export declare const admitted: (asked: Asked, context: Context) => Promise<readonly string[]>;

package/dist/src/places/admit.js

@@ -0,0 +1,32 @@
+import { parse } from '@lapxo/topos/wire';
+import { inPlace, standingOr, unless } from "../core/answer.js";
+import { admissionOf, idIn } from "../core/device.js";
+import { valueOf } from "../core/lock.js";
+import { sayIn } from "../core/surface.js";
+import { rootIn } from "../flows/device.js";
+/**
+ * Another device admitted into a place by whoever holds its root, once they said yes: the public key its own lines hand
+ * over — what those lines claim it may sign is not read — admitted under the name given here, covering what is given here
+ * or, without it, what a member is covered for: it asks, keeps what it read and proves access, and widens nothing.
+ */
+export const admitted = (asked, context) => inPlace(asked, context, async (place) => {
+    const say = sayIn(context.lock), word = (k) => valueOf(context.lock, k);
+    const name = (asked['name'] ?? '').toLowerCase().replace(/[^a-z0-9-]+/g, '-');
+    const key = (asked['key'] ?? '').split('\n').map((line) => parse(line.trim())).flatMap((got) => (got.kind === 'fact' && got.value.fields['measure'] === 'public-key' ? [got.value.fields['value'] ?? ''] : []))[0];
+    if (!name || !key)
+        return [say('no-key')];
+    const [root, held] = [rootIn(context, place), await standingOr(context, place, context.policy)];
+    if ('said' in root)
+        return root.said;
+    if ('said' in held)
+        return held.said;
+    if (held.lines.some((l) => l.scope === `keys/${name}`) || idIn(held.lines, key) !== undefined)
+        return [say('key-taken', { name, place })];
+    const coverage = asked['coverage'] || word('member/coverage');
+    const refused = await unless(context, say('elicit-admit', { name, place, coverage }));
+    if (refused)
+        return refused;
+    const lot = admissionOf(context.lock, key, 'head', { id: name, coverage, at: `policy:head/admit/${new Date(context.now()).toISOString()}` });
+    const landed = await context.landRoot(place, lot, root.account);
+    return 'refused' in landed ? [say('not-landed', { why: landed.refused })] : [say('admitted', { name, place, coverage }), ...landed.lines];
+});

package/dist/src/places/found.d.ts

@@ -0,0 +1,7 @@
+import type { Asked, Context } from '../core/answer.ts';
+/**
+ * A place born where the person names, once they said yes: founded with its own root and the prelude head declares,
+ * and named in head's own index of places — itself a place, founded the first time — by a line its root signs.
+ */
+export declare const bornPlace: (asked: Asked, context: Context) => Promise<readonly string[]>;
+export declare const bornAt: (context: Context, dir: string, name: string) => Promise<readonly string[]>;

package/dist/src/places/found.js

@@ -0,0 +1,60 @@
+import { isAbsolute, basename } from 'node:path';
+import { canonical, LOCK } from '@lapxo/topos/wire';
+import { unless } from "../core/answer.js";
+import { admissionOf } from "../core/device.js";
+import { valueOf } from "../core/lock.js";
+import { deviceKey } from "../flows/device.js";
+import { walkable } from "../walk/context.js";
+import { fill, sayIn } from "../core/surface.js";
+/**
+ * The lines a place is born with, every one drafted by target: its root, by the public half of a key kept only in the
+ * keychain and the signer that reaches it; this device's keys admitted; and the prelude head's lock declares under
+ * birth/ — the wire, the regions and views a world is read through, and the lifetime every reader is bounded by.
+ */
+const birthOf = (lock, root, head, person, place) => [
+    ...[['class', 'authorize'], ['coverage', '*'], ['signer', valueOf(lock, 'device/head/signer')], ['public-key', root]].map(([measure, value]) => canonical({ at: 'policy:head/birth', by: 'target', form: 'alphabet', measure: measure, role: 'writes', scope: valueOf(lock, 'founding/root'), value: value })),
+    ...admissionOf(lock, head, 'head'), ...admissionOf(lock, person, 'person'),
+    ...lock.filter((l) => l.scope?.startsWith('birth/')).map(({ about: _about, scope, ...line }) => canonical({ ...line, value: fill(line.value ?? '', { place }), scope: scope.slice('birth/'.length), at: 'policy:head/birth', by: 'target' })),
+];
+/** A place founded in a folder: a root key made in the keychain under the place's name — never a file — the birth lines written, and the first land signed by that root. */
+const founded = async (context, dir, name) => {
+    const account = fill(valueOf(context.lock, 'founding/root-account'), { place: name });
+    const [head, person] = [deviceKey(context, 'head'), deviceKey(context, 'person')];
+    if (head === undefined || person === undefined)
+        return { refused: 'no-keychain' };
+    if (context.keys.read(account) !== undefined)
+        return { refused: 'place-taken' };
+    const root = context.keys.made?.(account);
+    if (root === undefined)
+        return { refused: 'no-keychain' };
+    context.files.lay(dir, LOCK, new TextEncoder().encode(`${birthOf(context.lock, root, head, person, name).join('\n')}\n`));
+    const born = await context.found(dir, account);
+    return ((got) => ('refused' in got ? { refused: 'not-landed', why: got.refused } : got))('refused' in born ? born : await walkable(context, dir, account));
+};
+/**
+ * A place born where the person names, once they said yes: founded with its own root and the prelude head declares,
+ * and named in head's own index of places — itself a place, founded the first time — by a line its root signs.
+ */
+export const bornPlace = async (asked, context) => {
+    const say = sayIn(context.lock);
+    const dir = asked['dir'] ?? '';
+    if (!isAbsolute(dir))
+        return [say('place-absolute')];
+    const name = (asked['name'] || basename(dir)).toLowerCase().replace(/[^a-z0-9-]+/g, '-');
+    if (context.files.has(dir, LOCK))
+        return [say('place-exists', { dir })];
+    const refused = await unless(context, say('elicit-place', { name, dir }));
+    return refused ?? bornAt(context, dir, name);
+};
+export const bornAt = async (context, dir, name) => {
+    const say = sayIn(context.lock), born = await founded(context, dir, name);
+    if ('refused' in born)
+        return [say(born.refused, { name, dir, why: born.why ?? '' })];
+    const home = context.home();
+    const homed = context.files.has(home, LOCK) ? { lines: [] } : await founded(context, home, valueOf(context.lock, 'home/name'));
+    if ('refused' in homed)
+        return [say(homed.refused, { name: valueOf(context.lock, 'home/name'), dir: home, why: homed.why ?? '' })];
+    const line = canonical({ at: 'policy:head/places', by: 'target', form: 'alphabet', measure: 'id', role: 'writes', scope: `${valueOf(context.lock, 'home/family')}/${name}`, value: dir });
+    const indexed = await context.landRoot(home, [line], fill(valueOf(context.lock, 'founding/root-account'), { place: valueOf(context.lock, 'home/name') }));
+    return 'refused' in indexed ? [say('not-landed', { why: indexed.refused })] : [say('born', { name, dir }), ...indexed.lines];
+};

package/dist/src/ports/access/authorizer.d.ts

@@ -0,0 +1,10 @@
+import type { Fields } from '../../access/contract.ts';
+/**
+ * The authorizer a resource names when it refuses a request: its protected resource metadata (RFC 9728) at the address
+ * its challenge gives, which must name the very origin that refused; the authorization server's metadata (RFC 8414),
+ * which must name the issuer the resource named and take S256; and from them the oauth2 authorization-code flow a
+ * document would have declared — the same steps, PKCE through head's page, a client registered (RFC 7591) only where
+ * the server offers registration and the person's own where it does not, the token and its refresh, renewed at the
+ * token endpoint. Every one of these reads goes with nothing attached; what does not hold is no authorizer.
+ */
+export declare const discovered: (resource: string, challenge: string, get: (url: string) => Promise<unknown>) => Promise<Readonly<Record<string, Fields>> | undefined>;

package/dist/src/ports/access/authorizer.js

@@ -0,0 +1,34 @@
+const text = (json, key) => ((v) => (typeof v === 'string' && v ? v : undefined))(json?.[key]);
+const texts = (json, key) => ((v) => (Array.isArray(v) ? v.filter((x) => typeof x === 'string') : []))(json?.[key]);
+const fields = (pairs) => Object.fromEntries(Object.entries(pairs).map(([k, v]) => [k, [v].flat()]));
+/**
+ * The authorizer a resource names when it refuses a request: its protected resource metadata (RFC 9728) at the address
+ * its challenge gives, which must name the very origin that refused; the authorization server's metadata (RFC 8414),
+ * which must name the issuer the resource named and take S256; and from them the oauth2 authorization-code flow a
+ * document would have declared — the same steps, PKCE through head's page, a client registered (RFC 7591) only where
+ * the server offers registration and the person's own where it does not, the token and its refresh, renewed at the
+ * token endpoint. Every one of these reads goes with nothing attached; what does not hold is no authorizer.
+ */
+export const discovered = async (resource, challenge, get) => {
+    const at = /resource_metadata="([^"]+)"/.exec(challenge)?.[1];
+    if (at === undefined || !URL.canParse(at, resource))
+        return undefined;
+    const named = await get(new URL(at, resource).href), [issuer] = texts(named, 'authorization_servers'), own = text(named, 'resource');
+    if (own === undefined || !URL.canParse(own) || new URL(own).origin !== new URL(resource).origin || issuer === undefined || !URL.canParse(issuer))
+        return undefined;
+    const server = await get(`${new URL(issuer).origin}/.well-known/oauth-authorization-server${new URL(issuer).pathname.replace(/\/$/, '')}`);
+    const [authorize, token, register, methods] = [text(server, 'authorization_endpoint'), text(server, 'token_endpoint'), text(server, 'registration_endpoint'), texts(server, 'code_challenge_methods_supported')];
+    if (text(server, 'issuer') !== issuer || authorize === undefined || token === undefined || (methods.length > 0 && !methods.includes('S256')))
+        return undefined;
+    const [client, scopes] = [register ? '$steps.register.outputs.client' : '$client', texts(named, 'scopes_supported').join(' ')];
+    const sent = (step, pairs) => Object.fromEntries(Object.entries(pairs).filter(([, v]) => v).map(([k, v]) => [`${step}/payload/${k}`, fields({ value: v })]));
+    return {
+        '': fields({ type: 'oauth2/authorizationCode', issuer, 'attach-in': 'header', 'attach-name': 'Authorization', 'attach-template': 'Bearer {token}', token: '$steps.exchange.outputs.token', expires: '$steps.exchange.outputs.expires', refresh: '$steps.exchange.outputs.refresh', renew: token }),
+        ...(register ? { 'steps/0': fields({ id: 'register', url: register, encoding: 'json' }), 'steps/0/payload/redirect_uris': fields({ items: '$callback' }), 'steps/0/payload/grant_types': fields({ items: ['authorization_code', 'refresh_token'] }),
+            'steps/0/payload/response_types': fields({ items: 'code' }), ...sent('steps/0', { client_name: 'head', token_endpoint_auth_method: "'none'" }), 'steps/0/outputs/client': fields({ value: '$response.body#/client_id' }) } : {}),
+        'steps/1': fields({ id: 'authorize', page: authorize }), 'steps/1/outputs/code': fields({ value: '$response.body#/code' }),
+        ...sent('steps/1', { client_id: client, redirect_uri: '$callback', response_type: 'code', scope: scopes, state: '$state', code_challenge: 's256($verifier)', code_challenge_method: 'S256', resource: new URL(resource).origin }),
+        'steps/2': fields({ id: 'exchange', url: token, encoding: 'form' }), ...sent('steps/2', { grant_type: 'authorization_code', code: '$steps.authorize.outputs.code', redirect_uri: '$callback', client_id: client, code_verifier: '$verifier', resource: new URL(resource).origin }),
+        'steps/2/outputs/token': fields({ value: '$response.body#/access_token' }), 'steps/2/outputs/expires': fields({ value: '$response.body#/expires_in' }), 'steps/2/outputs/refresh': fields({ value: '$response.body#/refresh_token' }),
+    };
+};

package/dist/src/ports/access/flow.d.ts

@@ -0,0 +1,13 @@
+import type { AccessAdapter } from '../../access/contract.ts';
+/**
+ * Access as its document declares it, one way for every kind: the steps its flow names, in order — an operation of a
+ * source, an address its authorizer names, or a page the person is sent to and comes back from, opened first so every
+ * step before it knows where the person comes back — each sent what its payload says, with the token so far when it
+ * says so, keeping what its outputs point at — whatever its status, since an answer that calls for a next step may come
+ * as an error; a step whose when holds nothing is passed over, one whose answer holds nothing its outputs name stops the
+ * flow by its name, and so does one that answers an error and names nothing to keep. What the person is asked is asked the first time a step needs it, as the
+ * flow says: a form, a one-time code, a choice among what an answer listed, or a secret on head's own page as far as the
+ * place's root allows. What the person gives travels only to the source's origin or one its own document names. Only
+ * the token is kept, and it rides a request as the flow's template says.
+ */
+export declare const adapter: AccessAdapter;