@lapxo/head 0.1.0 → 0.1.3

package/dist/src/access/contract.d.ts

@@ -45,6 +45,7 @@ export interface Want {
     readonly params: Fields;
     readonly scopes: readonly string[];
     readonly now: number;
+    readonly renew?: string;
     readonly declared: Readonly<Record<string, Fields>>;
     readonly origin: string;
     readonly secrets: number;
@@ -65,5 +66,6 @@ export interface AccessAdapter {
         readonly refused: string;
         readonly input?: string;
     }>;
+    readonly discover?: (resource: string, challenge: string, get: (url: string) => Promise<unknown>) => Promise<Readonly<Record<string, Fields>> | undefined>;
 }
 export declare const jsonOf: (body: Uint8Array | string) => unknown;

package/dist/src/access/obtain.js

@@ -47,9 +47,9 @@ export const attachmentFor = async (context, place, lines, plan) => {
         return got?.kind === 'got' ? { status: got.status, json: jsonOf(got.bytes) } : undefined;
     };
     const reads = new Set(lines.filter((l) => l.scope?.startsWith(`${v.offers}/${plan.source}/`) && l.measure === v.class && l.value === v.callable).map((l) => l.scope));
-    const [scheme, root] = [`${v.keys}/${access.flow}`, valueOf(context.lock, 'founding/root').split('/')[1]];
+    const [scheme, root] = [access.from ?? `${v.keys}/${access.flow}`, valueOf(context.lock, 'founding/root').split('/')[1]];
     const want = {
-        place: placeNameOf(place), source: plan.source, scheme: access.scheme, params: access.params, now: context.now(), origin: plan.origin,
+        place: placeNameOf(place), source: plan.source, scheme: access.scheme, params: access.params, now: context.now(), origin: plan.origin, renew: held?.renew,
         declared: Object.fromEntries([...new Set(lines.filter((l) => l.scope === scheme || l.scope?.startsWith(`${scheme}/`)).map((l) => l.scope))].map((at) => [at.slice(scheme.length + 1), fieldsOf(lines, at)])),
         secrets: Number((lines.find((l) => l.scope === valueOf(context.lock, 'access/secrets') && l.by === root)?.value ?? '0..0').split('..')[1]),
         values: members(valueOf(lines, 'wire/access-values') || valueOf(context.lock, 'wire/access-values')),

package/dist/src/adopt/adopt.js

@@ -1,3 +1,4 @@
+import { EXTENSION } from '@lapxo/topos/wire';
 import { members, valueOf } from "../core/lock.js";
 import { linesOf } from "../core/worlds.js";
 /**
@@ -19,7 +20,7 @@ const readersOf = (lock, standing) => {
  * standing cannot be read so is no adoption.
  */
 export const adopted = async (context, place, lands, line) => {
-    const [word, held] = [(k) => valueOf(context.lock, k), await context.standing(place)];
+    const [word, held] = [(k) => valueOf(context.lock, k), await context.policy(place)];
     if ('refused' in held)
         return held;
     const own = held.lines, [wait, most] = ['adapter/request/wait', 'world/standing-bytes'].map((k) => Number(word(k).split('..')[1]));
@@ -29,7 +30,9 @@ export const adopted = async (context, place, lands, line) => {
         const bytes = context.cache.held(standing) ?? ((got) => (got === undefined ? undefined : (context.cache.keep(got), got)))(await (await context.adapter(at))?.published(at, standing, most, wait));
         if (bytes === undefined)
             return { refused: `REFUSE·world ${w}: ${at} answered no bytes that hash to its pin ${standing}` };
-        lot.push(line(`uses/${w}`, 'digest', standing), line(`sources/${w}`, 'id', at), line(`dep/${w}-blob`, 'digest', blob, { shape: word('world/shape') }), line(`sources/${w}-blob`, 'id', blobAt), ...readersOf(context.lock, linesOf(bytes)).map((r) => line(r.scope, r.measure, r.value, { role: 'reads' })));
+        const laid = `${word('place/worlds')}/${w}${EXTENSION}`;
+        context.files.lay(place, laid, bytes);
+        lot.push(line(`uses/${w}`, 'digest', standing, { needs: laid }), line(`sources/${w}`, 'id', at), line(`dep/${w}-blob`, 'digest', blob, { shape: word('world/shape') }), line(`sources/${w}-blob`, 'id', blobAt), ...readersOf(context.lock, linesOf(bytes)).map((r) => line(r.scope, r.measure, r.value, { role: 'reads' })));
     }
     return lot.length ? lands(lot) : { lines: [] };
 };

package/dist/src/compile/pin.js

@@ -1,6 +1,6 @@
 import { basename, join } from 'node:path';
 import { canonical, EXTENSION } from '@lapxo/topos/wire';
-import { valueOf } from "../core/lock.js";
+import { members, under, valueOf } from "../core/lock.js";
 import { fieldsOf, vocabOf } from "../core/read.js";
 import { sayIn } from "../core/surface.js";
 import { digestIn, linesOf, pinnedOf } from "../core/worlds.js";
@@ -42,12 +42,12 @@ const drafted = async (context, place, source, file, lines) => {
  * one's withdraw, said at its own time, since a withdrawn saying stays withdrawn.
  */
 export const pinIn = (context, place, lands, line) => async (source, read) => {
-    const [say, digest, held] = [sayIn(context.lock), digestIn(context.lock), await context.standing(place)];
+    const [say, digest, held] = [sayIn(context.lock), digestIn(context.lock), await context.policy(place)];
     if ('refused' in held)
         return { said: [say('unsettled', { source, why: held.refused })] };
     const own = held.lines;
     const input = digest([...own.filter((l) => l.scope?.startsWith('uses/') && l.scope !== `uses/${source}`).map((l) => `${l.scope} ${l.value}`), ...read].sort().join('\n'));
-    const file = `${valueOf(context.lock, 'place/compiled')}/${source}/${input.split(':')[1].slice(0, 16)}${EXTENSION}`;
+    const file = `${members(valueOf(context.lock, 'place/compiled'))[0]}/${source}/${input.split(':')[1].slice(0, 16)}${EXTENSION}`;
     const old = own.find((l) => l.scope === `uses/${source}`);
     const pinned = ((kept) => (kept !== undefined && kept.pin === old?.value ? kept : undefined))(pinnedOf(context.lock, old?.needs === file ? context.files.take(join(place, file)) : undefined)) ?? await compiledOf(context, place, source, file);
     if ('said' in pinned || (old?.needs === file && old.value === pinned.pin))
@@ -62,10 +62,10 @@ export const pinIn = (context, place, lands, line) => async (source, read) => {
  * never reconnected. What each answers is said by the pin; one still unresolved stays a demand.
  */
 export const paidBy = async (context, place, pin, laid) => {
-    const [v, held] = [vocabOf(context.lock), await context.standing(place)];
+    const [v, held] = [vocabOf(context.lock), await context.policy(place)];
     if ('refused' in held)
         return [];
-    const owed = held.lines.filter((l) => l.scope?.startsWith('uses/') && l.needs?.startsWith(`${valueOf(context.lock, 'place/compiled')}/`)
+    const owed = held.lines.filter((l) => l.scope?.startsWith('uses/') && under(context.lock, 'place/compiled', l.needs)
         && linesOf(context.files.take(join(place, l.needs)) ?? new Uint8Array()).some((r) => r.measure === v.unresolved && basename((r.value ?? '').split('#')[0]) === basename(laid)));
     const paid = [];
     for (const l of owed)

package/dist/src/core/act.d.ts

@@ -3,6 +3,7 @@ import type { Said } from './lock.ts';
 export declare const allowedOf: (lines: readonly Said[], family: string, api: string, operation: string) => number;
 /** Whether the person granted head to read a source, by the one sentence they signed for the place: the sources it names, until the day it names. */
 export declare const grantedOf: (lines: readonly Said[], family: string, source: string, now: number) => boolean;
+export declare const untilOf: (period: string, now: number) => string;
 export declare const cappedOf: (lines: readonly Said[], family: string, source: string, operation: string) => boolean;
 export declare const askedOf: (lines: readonly Said[], family: string, api: string, operation: string) => boolean;
 export declare const isOpen: (lines: readonly Said[], intent: string, ends: readonly string[]) => boolean;

package/dist/src/core/act.js

@@ -3,6 +3,7 @@ const hi = (lines, scope) => ((line) => (line === undefined ? undefined : Number
 export const allowedOf = (lines, family, api, operation) => Math.min(hi(lines, `${family}/${api}/${operation}`) ?? 0, hi(lines, `${family}/${api}`) ?? Infinity);
 /** Whether the person granted head to read a source, by the one sentence they signed for the place: the sources it names, until the day it names. */
 export const grantedOf = (lines, family, source, now) => (lines.find((l) => l.scope === family && l.measure === 'sources')?.value ?? '').split('|').includes(source) && Date.parse(lines.find((l) => l.scope === family && l.measure === 'until')?.value ?? '') > now;
+export const untilOf = (period, now) => new Date(now + Number(period) * 86_400_000).toISOString().slice(0, 10);
 export const cappedOf = (lines, family, source, operation) => hi(lines, `${family}/${source}/${operation}`) !== undefined || hi(lines, `${family}/${source}`) !== undefined;
 export const askedOf = (lines, family, api, operation) => lines.some((l) => l.scope === `${family}/${api}/${operation}` && l.value === 'present');
 export const isOpen = (lines, intent, ends) => lines.filter((l) => l.scope === intent && l.value === 'present').length > lines.filter((l) => ends.some((end) => l.scope === `${intent}/${end}`)).length;

package/dist/src/core/answer.d.ts

@@ -1,4 +1,4 @@
-import type { Said } from './lock.ts';
+import { type Said } from './lock.ts';
 import type { Printed } from '../ports/bound.ts';
 export type Outcome = {
     readonly lines: readonly string[];
@@ -6,9 +6,10 @@ export type Outcome = {
     readonly refused: string;
 };
 import type { KeyStore } from '../ports/keychain.ts';
-import type { Prepared } from '../ports/adapters/request.ts';
+import type { Fetched, Prepared } from '../ports/adapters/request.ts';
+import type * as Documents from '../ports/documents.ts';
 import type { Call } from './read.ts';
-import type { AccessAdapter, Answered, Choice, Field, Held } from '../access/contract.ts';
+import type { AccessAdapter, Answered, Attachment, Choice, Field, Held } from '../access/contract.ts';
 export type Asked = Readonly<Record<string, string | undefined>>;
 export interface Context {
     readonly lock: readonly Said[];
@@ -21,6 +22,11 @@ export interface Context {
     } | {
         readonly refused: string;
     }>;
+    readonly policy: (place: string) => Promise<{
+        readonly lines: readonly Said[];
+    } | {
+        readonly refused: string;
+    }>;
     readonly world: (place: string, view: string) => Promise<{
         readonly lines: readonly Said[];
     } | {
@@ -30,6 +36,7 @@ export interface Context {
         readonly prepare: (call: Call, args: Readonly<Record<string, unknown>>, lock: readonly Said[]) => Prepared;
         readonly post: (url: string, body: Readonly<Record<string, unknown>>, most: number, wait: number, as?: 'form' | 'json') => Promise<Answered>;
         readonly published: (url: string, digest: string, most: number, wait: number) => Promise<Uint8Array | undefined>;
+        readonly fetched: (url: string, attachment: Attachment | undefined, accept: string | undefined, most: number, wait: number) => Promise<Fetched>;
         readonly get: (url: string, wait: number) => Promise<{
             readonly bytes: Uint8Array;
             readonly type: string;
@@ -46,13 +53,17 @@ export interface Context {
         readonly lay: (place: string, rel: string, bytes: Uint8Array) => void;
         readonly drop: (place: string, rel: string) => void;
         readonly has: (place: string, rel: string) => boolean;
+        readonly list: (place: string, rel: string) => readonly string[];
+        readonly read: typeof Documents;
         readonly take: (path: string) => Uint8Array | undefined;
         readonly own: (rel: string) => Uint8Array | undefined;
     };
     readonly home: () => string;
+    readonly personal: () => string;
     readonly found: (place: string, account: string) => Promise<Outcome>;
     readonly signRoot: (place: string, lot: readonly string[], account: string) => Promise<Outcome>;
     readonly landRoot: (place: string, lot: readonly string[], account: string) => Promise<Outcome>;
+    readonly settle: () => Promise<readonly string[]>;
     readonly pinned: (place: string, file: string) => Promise<{
         readonly pin: string;
         readonly bytes: string;
@@ -81,10 +92,11 @@ export declare const inPlace: (asked: Asked, context: Context, then: (place: str
 export declare const unless: (context: Context, message: string) => Promise<readonly string[] | undefined>;
 export declare const printedOr: (context: Context, printed: Printed | undefined) => readonly string[];
 /** The lines a place stands on, or what head says when bound refused to fold them: a refusal is never an empty standing. */
-export declare const standingOr: (context: Context, place: string) => Promise<{
+export declare const standingOr: (context: Context, place: string, of?: Context["standing"]) => Promise<{
     readonly lines: readonly Said[];
 } | {
     readonly said: readonly string[];
 }>;
 export declare const baseOf: (lines: readonly Said[]) => string;
 export declare const placeNameOf: (place: string) => string;
+export declare const within: (context: Context, place: string, at: string) => Promise<boolean>;

package/dist/src/core/answer.js

@@ -7,17 +7,20 @@ var __rewriteRelativeImportExtension = (this && this.__rewriteRelativeImportExte
     return path;
 };
 import { createHash } from 'node:crypto';
-import { canonical } from '@lapxo/topos/wire';
-import { basename } from 'node:path';
+import { canonical, LOCK } from '@lapxo/topos/wire';
+import { valueOf } from "./lock.js";
+import { basename, isAbsolute, resolve, sep } from 'node:path';
 import { sayIn } from "./surface.js";
 /** What answers a line of the surface: the module named as the line, in the folder of its family. */
 export const answerOf = async (family, name) => (await import(__rewriteRelativeImportExtension(new URL(`../${family}/${name}${import.meta.url.slice(import.meta.url.lastIndexOf('.'))}`, import.meta.url).href))).answer;
-export const placeOf = async (asked, context) => asked['place'] || (await context.roots())[0];
+export const placeOf = async (asked, context) => asked['place'] || (await context.roots())[0] || ((held) => ('refused' in held ? undefined
+    : ((named) => (named.length === 1 ? named[0] : undefined))(held.lines.filter((l) => l.scope?.startsWith(`${valueOf(context.lock, 'home/family')}/`) && l.value !== 'withdraw').map((l) => l.value))))(context.files.has(context.home(), LOCK) ? await context.policy(context.home()) : { refused: '' });
 export const inPlace = async (asked, context, then) => ((place) => (place === undefined ? [sayIn(context.lock)('no-place')] : then(place)))(await placeOf(asked, context));
 /** The person's yes to exactly what a message says; anything else is what head says of it, and nothing is done. */
 export const unless = async (context, message) => ((consent) => (consent === 'yes' ? undefined : [sayIn(context.lock)(consent === 'none' ? 'cannot-ask' : 'no-yes')]))(await context.elicit(message));
 export const printedOr = (context, printed) => (printed === undefined ? [sayIn(context.lock)('unreachable')] : [...printed.out, ...printed.err]);
 /** The lines a place stands on, or what head says when bound refused to fold them: a refusal is never an empty standing. */
-export const standingOr = async (context, place) => ((held) => ('refused' in held ? { said: [sayIn(context.lock)('unfolded', { place, why: held.refused })] } : held))(await context.standing(place));
+export const standingOr = async (context, place, of = context.standing) => ((held) => ('refused' in held ? { said: [sayIn(context.lock)('unfolded', { place, why: held.refused })] } : held))(await of(place));
 export const baseOf = (lines) => createHash('sha256').update(lines.map((l) => canonical(l)).sort().join('\n')).digest('hex').slice(0, 16);
 export const placeNameOf = (place) => basename(place);
+export const within = async (context, place, at) => isAbsolute(at) && [place, ...(await context.roots())].some((root) => resolve(at).startsWith(`${resolve(root)}${sep}`));

package/dist/src/core/lock.d.ts

@@ -5,5 +5,7 @@ export declare const said: (lock: readonly Said[], scope: string) => Said | unde
 export declare const valueOf: (lock: readonly Said[], scope: string) => string;
 export declare const aboutOf: (lock: readonly Said[], scope: string) => string;
 export declare const members: (value: string) => readonly string[];
+/** Whether a path a line needs lies under one of the folders a lock word names: a place's own, or one an older head kept. */
+export declare const under: (lock: readonly Said[], scope: string, path: string | undefined) => boolean;
 /** The lines exactly one step below a family: tool/look under tool, never tool/look/place. */
 export declare const below: (lock: readonly Said[], family: string) => readonly Said[];

package/dist/src/core/lock.js

@@ -7,5 +7,7 @@ export const said = (lock, scope) => lock.find((f) => f.scope === scope);
 export const valueOf = (lock, scope) => said(lock, scope)?.value ?? '';
 export const aboutOf = (lock, scope) => said(lock, scope)?.about ?? '';
 export const members = (value) => (value === '' ? [] : alphabet(value).members);
+/** Whether a path a line needs lies under one of the folders a lock word names: a place's own, or one an older head kept. */
+export const under = (lock, scope, path) => members(valueOf(lock, scope)).some((at) => path?.startsWith(`${at}/`) === true);
 /** The lines exactly one step below a family: tool/look under tool, never tool/look/place. */
 export const below = (lock, family) => lock.filter((f) => ((at) => at.length === 2 && at[0] === family)(steps(f.scope ?? '')));

package/dist/src/core/package.d.ts

@@ -0,0 +1,54 @@
+import { type Asked, type Context } from './answer.ts';
+import { type Said } from './lock.ts';
+/** A line no package carries: one that is not a world, or a source's document, overlay or pin, said once by digest — with, beside a digest that names bytes, the encrypted address they are read at. */
+export declare const foreignIn: (lines: readonly Said[]) => Said | undefined;
+/** A place packed as its published lock would name it, into a folder inside it or one the client shares, apart from what head and bound keep: each world its sources were compiled under, and each source — document, overlay, and compiled pin resting on the sources whose issuers it names — by digest, beside the bytes those digests name, and where the person says they are also published, at that encrypted address. No line of access, key or grant: a package grants nothing, and nothing is asked, signed or landed. */
+export declare const shared: (asked: Asked, context: Context) => Promise<readonly string[]>;
+/** What a package names, checked whole before anything is asked: every line a world or a source's document, overlay or pin, by digest; each world the one this head pins; an order its pins rest in. A source whose bytes did not arrive, or did not hash to their line, is open, and so is every source resting on it: absence is not a refusal, and the rest arrives. */
+export declare const unpacked: (context: Context, document: string, bytes: Uint8Array, read: ReadonlyMap<string, Uint8Array | undefined>) => {
+    said: string[];
+    sources?: undefined;
+    open?: undefined;
+} | {
+    sources: ({
+        overlay: {
+            at: string;
+            bytes: Uint8Array<ArrayBufferLike>;
+            kind: string;
+        };
+        source: string;
+        pin: string;
+        document: {
+            at: string;
+            bytes: Uint8Array<ArrayBufferLike>;
+            kind: string;
+        };
+    } | {
+        overlay?: undefined;
+        source: string;
+        pin: string;
+        document: {
+            at: string;
+            bytes: Uint8Array<ArrayBufferLike>;
+            kind: string;
+        };
+    })[];
+    open: {
+        source: string;
+        owed: string;
+        waits: string;
+    }[];
+    said?: undefined;
+};
+/** Whether the person-s yes to a package already covers what arrives now: every source either pinned as the package names it, or owed by a demand that yes to this same package landed. */
+export declare const coveredIn: (context: Context, held: readonly Said[], arrived: readonly {
+    readonly source: string;
+    readonly pin: string;
+}[], named: string) => boolean;
+/** What a received package leaves owed in the place: a demand per open source naming what it waits on, and the withdraw of a demand a source that arrived has paid, or one a new package names otherwise. */
+export declare const owedIn: (context: Context, held: readonly Said[], arrived: readonly {
+    readonly source: string;
+}[], open: readonly {
+    readonly source: string;
+    readonly owed: string;
+}[], named: string) => readonly string[];

package/dist/src/core/package.js

@@ -0,0 +1,65 @@
+import { dirname, extname, join, relative, sep } from 'node:path';
+import { canonical, LOCK, parse } from '@lapxo/topos/wire';
+import { inPlace, standingOr, within } from "./answer.js";
+import { members, under, valueOf } from "./lock.js";
+import { fieldsOf, vocabOf } from "./read.js";
+import { sayIn } from "./surface.js";
+import { digestIn, linesOf } from "./worlds.js";
+/** A line no package carries: one that is not a world, or a source's document, overlay or pin, said once by digest — with, beside a digest that names bytes, the encrypted address they are read at. */
+export const foreignIn = (lines) => lines.find((l) => !/^(sources\/[a-z0-9-]+(\/overlay)?|uses\/[a-z0-9-]+)$/.test(l.scope ?? '') || lines.some((o) => o !== l && o.scope === l.scope && o.measure === l.measure)
+    || (l.measure !== 'digest' && !(l.measure === 'id' && URL.canParse(l.value ?? '') && lines.some((o) => o.scope === l.scope && o.measure === 'digest' && o.needs))));
+const orderOf = (all, out = []) => ((next) => (next === undefined ? (out.length === all.length ? out : undefined) : orderOf(all, [...out, next])))(all.find((s) => !out.includes(s) && s.rests.every((r) => out.some((o) => o.source === r))));
+const packed = (context, place, own, urls) => {
+    const [word, v, digest, held] = [(k) => valueOf(context.lock, k), vocabOf(context.lock), digestIn(context.lock), (rel) => context.files.take(join(place, rel)) ?? new Uint8Array()];
+    const row = (scope, value, more = {}) => [canonical({ at: 'policy:head/share', by: 'target', form: 'alphabet', measure: 'digest', role: 'writes', scope, value, ...more }),
+        ...(more['needs'] && URL.canParse(urls[more['needs']] ?? '') ? [canonical({ at: 'policy:head/share', by: 'target', form: 'alphabet', measure: 'id', role: 'writes', scope, value: urls[more['needs']] })] : [])];
+    const pins = own.filter((l) => l.scope?.startsWith('uses/') && under(context.lock, 'place/compiled', l.needs)).map((l) => ((source) => ({ source, pin: l.value, needs: l.needs, lines: linesOf(held(l.needs)), laid: context.files.read.laidOf(context, place, source) }))(l.scope.slice('uses/'.length)));
+    const declares = new Map(pins.flatMap((p) => (fieldsOf(p.lines, `${v.region}/${p.source}`)[v.issuers] ?? []).map((issuer) => [issuer, p.source])));
+    const rested = pins.map((p) => ({ ...p, rests: [...new Set(p.lines.filter((l) => l.measure === 'issuer').flatMap((l) => declares.get(l.value ?? '') ?? []))].filter((s) => s !== p.source).sort() })), sources = orderOf(rested) ?? rested;
+    return { names: sources.map((s) => s.source), files: sources.flatMap((s) => [...s.laid, [s.needs, held(s.needs)]]), lines: [...own.filter((l) => members(word('world/adopts')).some((w) => l.scope === `uses/${w}`)).flatMap((l) => row(l.scope, l.value)),
+            ...sources.flatMap((s) => [...s.laid.flatMap(([rel, bytes]) => row(/\.overlay\.[^.]+$/.test(rel) ? `sources/${s.source}/overlay` : `sources/${s.source}`, digest(bytes), { needs: rel })),
+                ...row(`uses/${s.source}`, s.pin, { needs: s.needs, ...(s.rests.length ? { restsOn: s.rests.map((r) => `uses/${r}`).join('|') } : {}) })])] };
+};
+/** A place packed as its published lock would name it, into a folder inside it or one the client shares, apart from what head and bound keep: each world its sources were compiled under, and each source — document, overlay, and compiled pin resting on the sources whose issuers it names — by digest, beside the bytes those digests name, and where the person says they are also published, at that encrypted address. No line of access, key or grant: a package grants nothing, and nothing is asked, signed or landed. */
+export const shared = (asked, context) => inPlace(asked, context, async (place) => {
+    const [say, to, held] = [sayIn(context.lock), asked['to'] ?? '', await standingOr(context, place, context.policy)], [rel, there] = [relative(place, to), linesOf(context.files.take(join(to, LOCK)) ?? new Uint8Array())];
+    if (!(await within(context, place, to)) || (!rel.startsWith('..') && (rel === '' || rel.startsWith('.') || [valueOf(context.lock, 'place/connected'), ...members(valueOf(context.lock, 'place/compiled')), valueOf(context.lock, 'walk/context/file'), valueOf(context.lock, 'place/worlds')].some((at) => rel.split(sep)[0] === at.split('/')[0]))) || foreignIn(there))
+        return [say('share-to', { place, to })];
+    if ('said' in held)
+        return held.said;
+    const pack = packed(context, place, held.lines, ((u) => (u && typeof u === 'object' ? u : {}))((() => { try {
+        return JSON.parse(asked['urls'] || '{}');
+    }
+    catch {
+        return {};
+    } })())), bytes = new TextEncoder().encode(`${pack.lines.join('\n')}\n`);
+    return !pack.names.length ? [say('share-none', { place })] : ([...pack.files, [LOCK, bytes]].forEach(([at, laid]) => context.files.lay(to, at, laid)), [say('shared', { place, to, sources: pack.names.join(', '), digest: digestIn(context.lock)(bytes) }), ...pack.lines]);
+});
+/** What a package names, checked whole before anything is asked: every line a world or a source's document, overlay or pin, by digest; each world the one this head pins; an order its pins rest in. A source whose bytes did not arrive, or did not hash to their line, is open, and so is every source resting on it: absence is not a refusal, and the rest arrives. */
+export const unpacked = (context, document, bytes, read) => {
+    const [say, word, digest, lines] = [sayIn(context.lock), (k) => valueOf(context.lock, k), digestIn(context.lock), linesOf(bytes)], said = lines.filter((l) => l.measure === 'digest'), at = (scope) => said.find((l) => l.scope === scope);
+    const unread = new TextDecoder().decode(bytes).split('\n').find((l) => l && parse(l).kind !== 'fact'), name = (l) => l.scope.split('/')[1];
+    const odd = unread === undefined ? foreignIn(lines) ?? said.find((l) => (l.scope.startsWith('uses/') ? (l.needs ? !at(`sources/${name(l)}`)?.needs : !word(`world/${name(l)}/standing`))
+        : !l.needs || !at(`uses/${name(l)}`)?.needs || l.needs.split('/').includes('..') || l.needs.startsWith('/'))) : { scope: unread.slice(0, 80) };
+    if (odd)
+        return { said: [say('package-line', { document, scope: odd.scope ?? '' })] };
+    const world = said.find((l) => !l.needs && l.value !== word(`world/${name(l)}/standing`)), where = (l) => lines.find((o) => o.scope === l.scope && o.measure === 'id')?.value ?? (URL.canParse(document) ? new URL(l.needs, document).href : join(dirname(document), l.needs));
+    if (world)
+        return { said: [say('package-world', { document, world: name(world), pin: world.value, held: word(`world/${name(world)}/standing`) })] };
+    const off = (l) => l.needs !== undefined && digest(read.get(l.needs) ?? '') !== l.value, of = (scope) => ((l) => l && { at: where(l), bytes: read.get(l.needs), kind: extname(l.needs).slice(1) })(at(scope));
+    const order = orderOf(said.filter((l) => l.scope.startsWith('uses/') && l.needs).map((l) => ({ source: name(l), pin: l.value, rests: (l.restsOn ?? '').split('|').filter(Boolean).map((r) => r.slice('uses/'.length)) })));
+    if (order === undefined)
+        return { said: [say('package-line', { document, scope: 'restsOn' })] };
+    const [open, missing] = [order.reduce((o, s) => (said.some((l) => name(l) === s.source && off(l)) || s.rests.some((r) => o.has(r)) ? o.add(s.source) : o), new Set()), (source) => said.filter((l) => name(l) === source && off(l))];
+    return { sources: order.filter((s) => !open.has(s.source)).map((s) => ({ source: s.source, pin: s.pin, document: of(`sources/${s.source}`), ...((o) => (o ? { overlay: o } : {}))(of(`sources/${s.source}/overlay`)) })),
+        open: order.filter((s) => open.has(s.source)).map((s) => ({ source: s.source, owed: missing(s.source).map((l) => l.value).join('|') || s.rests.filter((r) => open.has(r)).map((r) => `uses/${r}`).join('|'), waits: missing(s.source).map((l) => `${l.value} at ${where(l)}`).join(', ') || s.rests.filter((r) => open.has(r)).join(', ') })) };
+};
+/** Whether the person-s yes to a package already covers what arrives now: every source either pinned as the package names it, or owed by a demand that yes to this same package landed. */
+export const coveredIn = (context, held, arrived, named) => arrived.length > 0 && arrived.every((s) => held.some((l) => l.value !== 'withdraw'
+    && ((l.scope === `uses/${s.source}` && l.value === s.pin) || (l.scope === `${valueOf(context.lock, 'place/needs')}/bytes/${s.source}` && l.role === 'demands' && l.at === `policy:head/receive/${named.slice(7, 23)}`))));
+/** What a received package leaves owed in the place: a demand per open source naming what it waits on, and the withdraw of a demand a source that arrived has paid, or one a new package names otherwise. */
+export const owedIn = (context, held, arrived, open, named) => {
+    const scope = (source) => `${valueOf(context.lock, 'place/needs')}/bytes/${source}`, live = (source) => held.find((l) => l.scope === scope(source) && l.role === 'demands' && l.value !== 'withdraw');
+    const withdrawn = [...arrived.map((s) => live(s.source)), ...open.map((o) => ((l) => (l?.value !== o.owed ? l : undefined))(live(o.source)))].flatMap((l) => (l ? [canonical({ ...Object.fromEntries(Object.entries(l).filter(([k]) => !['sig', 'epoch'].includes(k))), by: 'target', value: 'withdraw' })] : []));
+    return [...withdrawn, ...open.filter((o) => live(o.source)?.value !== o.owed).map((o) => canonical({ at: `policy:head/receive/${named.slice(7, 23)}`, by: 'target', form: 'alphabet', measure: 'digest', role: 'demands', scope: scope(o.source), value: o.owed }))];
+};

package/dist/src/core/read.d.ts

@@ -11,6 +11,8 @@ export interface Access {
     readonly params: Fields;
     readonly account: string | undefined;
     readonly flow: string;
+    readonly probe?: true;
+    readonly from?: string;
 }
 export interface Call {
     readonly kind: 'call';
@@ -46,6 +48,7 @@ export declare const vocabOf: (lock: readonly Said[]) => {
     pick: string;
 };
 export type Vocab = ReturnType<typeof vocabOf>;
+export declare const observedAt: (lock: readonly Said[], source: string, operation: string) => string;
 export declare const stepOf: (lines: readonly Said[], lock: readonly Said[], source: string, operation: string) => Call | Plan;
 export declare const planRead: (lines: readonly Said[], lock: readonly Said[], source: string, operation: string, place: string) => Call | Plan;
 export declare const planAct: (lines: readonly Said[], lock: readonly Said[], source: string, operation: string, place: string) => Call | Plan;

package/dist/src/core/read.js

@@ -16,11 +16,15 @@ const originOf = (lines, v, source) => {
     const declared = at[v.origins] ?? [];
     return declared.length === 1 ? declared[0] : said(declared.length ? 'pick-origin' : 'no-origin', { source, origins: declared.join(', ') });
 };
-/** How access is proven for an offer: its first declared alternative that says how what it obtains rides a request — anonymous, or a scheme whose flow the one adapter runs, its own or its issuer's, kept once per issuer; unstated, or none that says, is no call, named. */
+export const observedAt = (lock, source, operation) => `${valueOf(lock, 'access/family')}/${source}/${operation}/${valueOf(lock, 'access/observed')}`;
+/** How access is proven for an offer: its first declared alternative that says how what it obtains rides a request — anonymous, or a scheme whose flow the one adapter runs, its own or its issuer's, kept once per issuer; none that says is no call, named. Unstated, it is a read with nothing attached: probed once, and anonymous once head observed it answer. */
 const accessOf = (lines, lock, v, source, operation, place) => {
     const ways = fieldsOf(lines, `${v.offers}/${source}/${operation}`)[v.access] ?? [v.unstated];
+    const by = `${valueOf(lock, 'access/family')}/${source}/${valueOf(lock, 'access/authorizer')}`, account = (issuer) => valueOf(lock, issuer ? 'access/issuer-account' : 'access/account').split('{place}').join(place).split('{source}').join(source).split('{issuer}').join(issuer ?? '');
+    if (ways.includes(v.unstated) && lines.some((l) => l.scope === by))
+        return { kind: valueOf(lock, 'access/adapter'), scheme: valueOf(lock, 'access/authorizer'), params: fieldsOf(lines, by), flow: `${source}/${valueOf(lock, 'access/authorizer')}`, account: account(), from: by };
     if (ways.includes(v.unstated))
-        return said('access-unstated', { source, operation });
+        return ((seen) => ({ kind: v.anonymous, scheme: '', params: {}, account: undefined, flow: '', ...(seen ? {} : { probe: true }) }))(lines.some((l) => l.scope === observedAt(lock, source, operation) && l.value === v.anonymous));
     const kindOf = (way) => {
         if (way === v.anonymous)
             return [way, v.anonymous, {}, '', undefined];
@@ -34,7 +38,7 @@ const accessOf = (lines, lock, v, source, operation, place) => {
     if (usable === undefined)
         return said('no-adapter', { source, operation, kinds: ways.join(', ') });
     const [scheme, kind, params, flow, issuer] = usable;
-    return { kind, scheme, params, flow, account: kind === v.anonymous ? undefined : valueOf(lock, issuer ? 'access/issuer-account' : 'access/account').split('{place}').join(place).split('{source}').join(source).split('{issuer}').join(issuer ?? '') };
+    return { kind, scheme, params, flow, account: kind === v.anonymous ? undefined : account(issuer) };
 };
 export const stepOf = (lines, lock, source, operation) => {
     const v = vocabOf(lock);
@@ -57,4 +61,4 @@ const callOf = (lines, lock, source, operation, place) => {
 };
 const isCallable = (lock, classes) => classes.length === 1 && classes[0] === vocabOf(lock).callable;
 export const planRead = (lines, lock, source, operation, place) => ((call) => (call.kind === 'call' && !isCallable(lock, call.classes) ? said('not-callable', { source, operation, class: call.classes.join(', ') }) : call))(callOf(lines, lock, source, operation, place));
-export const planAct = (lines, lock, source, operation, place) => ((call) => (call.kind === 'call' && isCallable(lock, call.classes) ? said('is-read', { source, operation }) : call))(callOf(lines, lock, source, operation, place));
+export const planAct = (lines, lock, source, operation, place) => ((call) => (call.kind === 'call' && isCallable(lock, call.classes) ? said('is-read', { source, operation }) : call.kind === 'call' && call.access.probe ? said('access-unstated', { source, operation }) : call))(callOf(lines, lock, source, operation, place));

package/dist/src/core/surface.d.ts

@@ -1,45 +1,6 @@
 import type { Said } from './lock.ts';
-export interface Field {
-    readonly name: string;
-    readonly about: string;
-    readonly type: string;
-    readonly required: boolean;
-}
-export interface Tool {
-    readonly name: string;
-    readonly about: string;
-    readonly fields: readonly Field[];
-    readonly hints: readonly string[];
-}
-export interface Resource {
-    readonly name: string;
-    readonly about: string;
-    readonly template: string;
-    readonly mime: string;
-}
-export interface Prompt {
-    readonly name: string;
-    readonly about: string;
-    readonly text: string;
-    readonly line: string;
-    readonly fields: readonly Field[];
-}
-export interface Surface {
-    readonly name: string;
-    readonly version: string;
-    readonly tools: readonly Tool[];
-    readonly resources: readonly Resource[];
-    readonly prompts: readonly Prompt[];
-}
-/** Everything a client is offered, read off the lock alone: its tools, resources and prompts, each with the words a model sees. */
-export declare const surfaceOf: (lock: readonly Said[]) => Surface;
 export declare const fill: (text: string, asked: Readonly<Record<string, string | undefined>>) => string;
+/** What head says: a cell, its code with its state and next; only a question the person reads is said in its lock words. */
 export declare const sayIn: (lock: readonly Said[]) => (key: string, fields?: Readonly<Record<string, string | undefined>>) => string;
-export declare const refusedOn: (lock: readonly Said[], platform: string) => string | undefined;
 /** A red, when what head measured ran past a ceiling of its lock in whole seconds: said with the coordinate it ran at; within it, nothing. */
 export declare const redIn: (lock: readonly Said[]) => (scope: string, coordinate: string, started: number, now: number) => readonly string[];
-/**
- * The fields a URI gives a resource template, or none when it is not one of its URIs: {name} matches one path step,
- * {?a,b} names query fields any of which may be absent, in any order, each decoded.
- */
-export declare const matchTemplate: (template: string, uri: string) => Readonly<Record<string, string>> | undefined;

package/dist/src/core/surface.js

@@ -1,32 +1,7 @@
-import { aboutOf, below, members, valueOf } from "./lock.js";
-const nameOf = (line) => line.scope.split('/')[1];
-const fieldsOf = (lock, scope) => ((required) => members(valueOf(lock, scope)).map((name) => ({
-    name, about: aboutOf(lock, `${scope}/${name}`), type: valueOf(lock, `${scope}/${name}`), required: required.includes(name)
-})))(members(valueOf(lock, `${scope}/required`)));
-/** Everything a client is offered, read off the lock alone: its tools, resources and prompts, each with the words a model sees. */
-export const surfaceOf = (lock) => ({
-    name: valueOf(lock, 'name'), version: valueOf(lock, 'version'),
-    tools: below(lock, 'tool').map((line) => ({ name: nameOf(line), about: line.about ?? '', fields: fieldsOf(lock, line.scope), hints: members(valueOf(lock, `${line.scope}/hints`)) })),
-    resources: below(lock, 'resource').map((line) => ({ name: nameOf(line), about: line.about ?? '', template: line.value ?? '', mime: valueOf(lock, `${line.scope}/mime`) })),
-    prompts: below(lock, 'prompt').map((line) => ({ name: nameOf(line), about: line.about ?? '', text: aboutOf(lock, `${line.scope}/text`), line: aboutOf(lock, `${line.scope}/line`), fields: fieldsOf(lock, line.scope) })),
-});
+import { aboutOf, valueOf } from "./lock.js";
+import { cellLine, cellOf } from "../ports/surface.js";
 export const fill = (text, asked) => Object.entries(asked).reduce((at, [name, value]) => (value === undefined ? at : at.split(`{${name}}`).join(value)), text);
-export const sayIn = (lock) => (key, fields = {}) => fill(aboutOf(lock, `said/${key}`), fields);
-export const refusedOn = (lock, platform) => ((supported) => (supported.includes(platform) ? undefined : sayIn(lock)('platform', { platform, supported: supported.join('|') })))(members(valueOf(lock, 'platform/supported')));
+/** What head says: a cell, its code with its state and next; only a question the person reads is said in its lock words. */
+export const sayIn = (lock) => (key, fields = {}) => (valueOf(lock, `said/${key}/state`) === 'asked' ? fill(aboutOf(lock, `said/${key}`), fields) : cellLine(cellOf(lock, key, fields)));
 /** A red, when what head measured ran past a ceiling of its lock in whole seconds: said with the coordinate it ran at; within it, nothing. */
 export const redIn = (lock) => (scope, coordinate, started, now) => ((seconds, ceiling) => (seconds > Number(ceiling.split('..')[1]) ? [sayIn(lock)('red', { coordinate, seconds: String(seconds), scope, ceiling })] : []))(Math.floor((now - started) / 1000), valueOf(lock, scope));
-/**
- * The fields a URI gives a resource template, or none when it is not one of its URIs: {name} matches one path step,
- * {?a,b} names query fields any of which may be absent, in any order, each decoded.
- */
-export const matchTemplate = (template, uri) => {
-    const [path = '', query = ''] = template.split('{?');
-    const names = [...path.matchAll(/\{(\w+)\}/g)].map((m) => m[1]);
-    const pattern = new RegExp(`^${path.split(/\{\w+\}/).map((part) => part.replace(/[.*+?^$()|[\]\\]/g, '\\$&')).join('([^/?#]+)')}(?:\\?(.*))?$`);
-    const got = pattern.exec(uri);
-    if (got === null)
-        return undefined;
-    const params = new URLSearchParams(got[names.length + 1] ?? '');
-    return { ...Object.fromEntries(names.map((name, i) => [name, decodeURIComponent(got[i + 1])])),
-        ...Object.fromEntries(query.replace('}', '').split(',').filter(Boolean).flatMap((name) => ((v) => (v === null ? [] : [[name, v]]))(params.get(name)))) };
-};

package/dist/src/core/trust.d.ts

@@ -0,0 +1,7 @@
+import type { Said } from './lock.ts';
+/**
+ * How a source proves access, the most trusted first: each flow by the least trusted kind of input it asks, in the order
+ * head's lock names — a flow that asks none of them asks no secret — and how many secrets the place's root lets a flow
+ * ask on head's page, none unless it signed a ceiling. A source that proves no access says nothing.
+ */
+export declare const trustOf: (lock: readonly Said[], lines: readonly Said[], source: string) => readonly string[];

package/dist/src/core/trust.js

@@ -0,0 +1,19 @@
+import { aboutOf, members, valueOf } from "./lock.js";
+import { vocabOf } from "./read.js";
+import { fill, sayIn } from "./surface.js";
+/**
+ * How a source proves access, the most trusted first: each flow by the least trusted kind of input it asks, in the order
+ * head's lock names — a flow that asks none of them asks no secret — and how many secrets the place's root lets a flow
+ * ask on head's page, none unless it signed a ceiling. A source that proves no access says nothing.
+ */
+export const trustOf = (lock, lines, source) => {
+    const [v, order, asks, root] = [vocabOf(lock), members(valueOf(lock, 'access/trust-order')), valueOf(lock, 'vocab/asks'), valueOf(lock, 'founding/root').split('/')[1]];
+    const flows = [...new Set(lines.flatMap((l) => ((parts) => (l.scope?.startsWith(`${v.keys}/${source}/`) && parts.length === v.keys.split('/').length + 2 ? [parts.at(-1)] : []))(l.scope?.split('/') ?? [])))];
+    if (!flows.length)
+        return [];
+    const kind = (flow) => ((asked) => order.find((k) => asked.includes(k)) ?? 'none')(members(lines.find((l) => l.scope === `${v.keys}/${source}/${flow}` && l.measure === asks)?.value ?? ''));
+    const rank = (k) => (k === 'none' ? 0 : order.length - order.indexOf(k));
+    const ranked = flows.map((flow) => ({ flow, kind: kind(flow) })).sort((a, b) => rank(a.kind) - rank(b.kind) || a.flow.localeCompare(b.flow));
+    const allowed = (lines.find((l) => l.scope === valueOf(lock, 'access/secrets') && l.by === root)?.value ?? '0..0').split('..')[1];
+    return [sayIn(lock)('trust', { source, flows: ranked.map((f) => fill(aboutOf(lock, `said/trust-${f.kind}`), { flow: f.flow })).join('; '), allowed: allowed ?? '0' })];
+};

package/dist/src/flows/device.js

@@ -1,16 +1,11 @@
 import { placeNameOf } from "../core/answer.js";
 import { canonical, parse } from '@lapxo/topos/wire';
 import { deviceOf, idIn, uncoveredIn } from "../core/device.js";
-import { newKey, publicOf } from "../core/keys.js";
 import { members, valueOf } from "../core/lock.js";
 import { fill, sayIn } from "../core/surface.js";
 import { adoptsIn } from "../adopt/adopt.js";
 /** A key of this device by its role: read from the keychain, or made there once; only its public half is ever handed on. */
-export const deviceKey = (context, role) => ((account) => {
-    const held = context.keys.read(account);
-    const secret = held ?? ((made) => { context.keys.write(account, made.secret); return context.keys.read(account) === made.secret ? made.secret : undefined; })(newKey());
-    return secret === undefined ? undefined : publicOf(secret);
-})(deviceOf(context.lock, role).account);
+export const deviceKey = (context, role) => context.keys.made?.(deviceOf(context.lock, role).account);
 /** The keychain account of a place's root, when this keychain holds it — who configures the place is here; else what head says of that. */
 export const rootIn = (context, place) => ((account) => (context.keys.read(account) === undefined ? { said: [sayIn(context.lock)('no-root', { place })] } : { account }))(fill(valueOf(context.lock, 'founding/root-account'), { place: placeNameOf(place) }));
 export const widening = (context, place, lines, lot) => {