@lapxo/head 0.1.0 → 0.1.4

package/dist/src/flows/call.js

@@ -27,18 +27,15 @@ export const pickedOrigin = async (context, place, lines, source, plan) => {
     const landed = await by.land([canonical(line(chosen))]);
     return 'refused' in landed ? { said: [sayIn(context.lock)('not-landed', { why: landed.refused })] } : { lines: [...lines, line(chosen)] };
 };
-const turns = new Map();
-/** Calls of one place take turns, so one asked while another lands sees its receipt; nothing waits on a timer. */
-export const inTurn = (place, act) => { const next = (turns.get(place) ?? Promise.resolve()).then(act, act); turns.set(place, next.catch(() => undefined)); return next; };
 /**
- * The steps a read and an act share: the place, its turn, the lines it stands on once bound settled them, the offer's
+ * The steps a read and an act share: the place, the lines it stands on once bound settled them, the offer's
  * plan, the transport its origin names and the request it prepares; then what is particular, given a frame that says
  * by the lock, attaches access when asked, types what came back and lands a line under head's key.
  */
 export const called = async (asked, context, planOf, then) => {
     const say = (key, fields = {}) => [sayIn(context.lock)(key, fields)];
     const [source, operation] = [asked['source'] ?? '', asked['operation'] ?? ''];
-    return inPlace(asked, context, (place) => inTurn(place, async () => {
+    return inPlace(asked, context, async (place) => {
         const held = await standingFor(context, place);
         if ('unsettled' in held)
             return say('unsettled', { source, why: held.unsettled });
@@ -72,5 +69,5 @@ export const called = async (asked, context, planOf, then) => {
         const attach = async () => ((got) => ('said' in got ? { said: say(got.said, { source, operation, kinds: plan.access.kind, input: got.input }) } : got))(await attachmentFor(context, place, lines, plan));
         const uncovered = (role, scopes) => uncoveredIn(context.lock, lines, context.device(role), place, [], scopes);
         return then({ widen, word: (scope) => valueOf(context.lock, scope), say, place, lines, source, operation, plan, prepared, most, typed, attach, send: (attachment) => prepared.send(attachment, most('read/response-bytes')), lands, uncovered });
-    }));
+    });
 };

package/dist/src/flows/device.js

@@ -1,16 +1,11 @@
 import { placeNameOf } from "../core/answer.js";
 import { canonical, parse } from '@lapxo/topos/wire';
 import { deviceOf, idIn, uncoveredIn } from "../core/device.js";
-import { newKey, publicOf } from "../core/keys.js";
 import { members, valueOf } from "../core/lock.js";
 import { fill, sayIn } from "../core/surface.js";
 import { adoptsIn } from "../adopt/adopt.js";
 /** A key of this device by its role: read from the keychain, or made there once; only its public half is ever handed on. */
-export const deviceKey = (context, role) => ((account) => {
-    const held = context.keys.read(account);
-    const secret = held ?? ((made) => { context.keys.write(account, made.secret); return context.keys.read(account) === made.secret ? made.secret : undefined; })(newKey());
-    return secret === undefined ? undefined : publicOf(secret);
-})(deviceOf(context.lock, role).account);
+export const deviceKey = (context, role) => context.keys.made?.(deviceOf(context.lock, role).account);
 /** The keychain account of a place's root, when this keychain holds it — who configures the place is here; else what head says of that. */
 export const rootIn = (context, place) => ((account) => (context.keys.read(account) === undefined ? { said: [sayIn(context.lock)('no-root', { place })] } : { account }))(fill(valueOf(context.lock, 'founding/root-account'), { place: placeNameOf(place) }));
 export const widening = (context, place, lines, lot) => {

package/dist/src/flows/read.js

@@ -1,10 +1,13 @@
-import { planRead } from "../core/read.js";
+import { under } from "../core/lock.js";
+import { observedAt, planRead } from "../core/read.js";
 import { basisOf, draftOf, receiptsOf, scopeOf, spentOf } from "../core/receipt.js";
 import { redIn, sayIn } from "../core/surface.js";
-import { grantedOf, isOpen } from "../core/act.js";
+import { grantedOf, isOpen, untilOf } from "../core/act.js";
 import { canonical } from '@lapxo/topos/wire';
 import { called } from "./call.js";
 import { principalOf } from "../access/obtain.js";
+import { jsonOf } from "../access/contract.js";
+import { refusedAccess } from "../sources/refused.js";
 /** An intent an earlier act left open, closed by the read that looked at what it would have changed: a line naming that read-s digest, signed by head. */
 const closeWith = async (intent, source, digest, { word, lines, lands }, context) => {
     const say = sayIn(context.lock);
@@ -22,13 +25,18 @@ const closeWith = async (intent, source, digest, { word, lines, lands }, context
  * the reuse the place allows, it answers from what was kept: nothing called. Asked for history, it shows what was kept
  * of that request as of when it was read — evidence of that read, never a current answer — where the place allows it.
  */
-export const readSource = (asked, context) => ((started) => called(asked, context, planRead, async ({ word, say, place, lines, source, operation, plan, prepared, most, typed, attach, send, lands, widen, uncovered }) => {
+export const readSource = (asked, context) => called(asked, context, planRead, async ({ word, say, place, lines, source, operation, plan, prepared, most, typed, attach, send, lands, widen, uncovered }) => {
     const [family, at, when] = [word('receipt/family'), word('receipt/at'), new Date(context.now()).toISOString()];
     const closing = (digest) => closeWith(asked['closes'], source, digest, { word, lines, lands }, context);
     const scopes = (principal) => [scopeOf(family, source, operation, prepared.key, principal), `${scopeOf(word('receipt/kept'), source, operation, prepared.key, principal)}/${basisOf(lines, word, source)}`];
     const held = (digest) => ((bytes) => (bytes === undefined || digest === undefined ? undefined : { digest, bytes }))(digest === undefined ? undefined : context.cache.held(digest));
     const keeping = (kept, answer) => (answer.length > 1 ? [draftOf(word('receipt/kept'), at, kept, context.cache.keep(Buffer.from(answer.join('\n'))), when)] : []);
-    const allowed = (key, measure) => lines.find((l) => l.scope === `${word(key)}/${source}` && l.measure === measure)?.value;
+    const allowed = (key, measure) => (lines.find((l) => l.scope === `${word(key)}/${source}` && l.measure === measure) ?? lines.find((l) => l.scope === word(key) && l.measure === measure))?.value;
+    if (asked['why'] === 'true') {
+        const asOf = principalOf(context, plan, false), [newest] = asOf === undefined ? [] : receiptsOf(lines, at, scopes(asOf)[0]), pin = lines.find((l) => l.scope === `uses/${source}`);
+        const signed = newest && lines.find((l) => l.scope === newest.scope && l.value === newest.digest && l.at === `${at}:${newest.at}`), worlds = lines.filter((l) => l.scope?.startsWith('uses/') && (!l.needs || under(context.lock, 'place/worlds', l.needs))).map((l) => `${l.scope.slice('uses/'.length)} ${l.value}`);
+        return newest === undefined ? say('why-none', { source, operation }) : say('why', { source, operation, origin: plan.origin, at: newest.at, by: signed?.by ?? '', epoch: signed?.epoch ?? '', digest: newest.digest, pin: pin?.value ?? '', pinned: pin?.epoch ?? '', worlds: worlds.join(', ') });
+    }
     if (asked['history'] === 'true') {
         const asOf = principalOf(context, plan, false);
         if (allowed('history/family', 'status') !== 'present')
@@ -47,19 +55,19 @@ export const readSource = (asked, context) => ((started) => called(asked, contex
         return stopped;
     if (!grantedOf(lines, word('grant/family'), source, context.now())) {
         const sources = [...new Set(lines.filter((l) => l.scope?.startsWith(`${word('vocab/region')}/`) && l.measure === word('vocab/origins')).map((l) => l.scope.split('/')[1]))].sort();
-        const until = new Date(context.now() + Number(word('access/period')) * 86_400_000).toISOString().slice(0, 10);
+        const until = untilOf(word('access/period'), context.now());
         const line = (measure, value) => canonical({ at: 'policy:person/grants', by: 'target', form: 'alphabet', measure, role: 'writes', scope: word('grant/family'), value });
         const granted = await widen(say('grant', { sources: sources.join(', '), place, until })[0], [line('sources', sources.join('|')), line('until', until)]);
         if ('said' in granted)
             return granted.said;
     }
     const reuse = Number(/^\d+\.\.(\d+)$/.exec(allowed('reuse/family', 'seconds') ?? '')?.[1] ?? Number.NaN);
-    const [newest] = principal === undefined ? [] : receiptsOf(lines, at, scopes(principal)[0]);
-    if (principal !== undefined && newest !== undefined && context.now() - Date.parse(newest.at) <= reuse * 1000) {
+    const [newest] = principal === undefined ? [] : receiptsOf(lines, at, scopes(principal)[0]), stood = ((b) => b !== undefined && Number(Buffer.from(b.bytes.subarray(0, b.bytes.indexOf(10))).toString('utf8')) < 300)(held(newest?.digest));
+    if (principal !== undefined && newest !== undefined && stood && context.now() - Date.parse(newest.at) <= reuse * 1000) {
         const [scope, kept] = scopes(principal);
         const answered = held(receiptsOf(lines, at, kept).find((k) => k.at >= newest.at)?.digest);
         if (answered !== undefined)
-            return [...new TextDecoder().decode(answered.bytes).split('\n'), ...say('reused', { scope: kept, digest: answered.digest, at: newest.at }), ...(await closing(newest.digest)), ...redIn(context.lock)('answer/kept', `answer/${source}/${operation}@${word('look/call')}`, started, context.machine())];
+            return [...new TextDecoder().decode(answered.bytes).split('\n'), ...say('reused', { scope: kept, digest: answered.digest, at: newest.at }), ...(await closing(newest.digest)), ...redIn(context.lock)('answer/kept', `answer/${source}/${operation}`, context.begun, context.machine())];
         const body = held(newest.digest);
         if (body !== undefined) {
             const cut = body.bytes.indexOf(10);
@@ -78,8 +86,13 @@ export const readSource = (asked, context) => ((started) => called(asked, contex
     const got = await send(attached.attachment);
     if (got.kind !== 'got')
         return say(got.kind === 'over' ? 'too-large' : 'unreachable-source', { source });
+    if (got.status === 401 && attached.principal !== 'anonymous')
+        return refusedAccess(context, place, lines, plan, operation);
     const digest = context.cache.keep(Buffer.concat([Buffer.from(`${got.status}\n`), got.bytes]));
     const answer = await typed(String(got.status), got.bytes);
-    const landed = await lands(draftOf(family, at, scope, digest, when), ...(attached.principal === undefined ? [] : keeping(kept, answer)));
-    return [...answer, ...('lines' in landed ? [...landed.lines, ...(await closing(digest))] : say('not-landed', { why: landed.refused }))];
-}))(context.machine());
+    const observed = plan.access.probe && got.status < 300 ? [canonical({ at: `${at}:${when}`, by: 'target', form: 'alphabet', measure: word('vocab/access'), role: 'writes', scope: observedAt(context.lock, source, operation), value: word('vocab/anonymous') })] : [];
+    const found = plan.access.probe && got.status === 401 && got.authenticate ? await (await context.access(word('access/adapter')))?.discover?.(plan.origin, got.authenticate, async (url) => jsonOf((await context.files.read.documentOf(context, place, url))?.bytes ?? new Uint8Array())) : undefined;
+    const by = `${word('access/family')}/${source}/${word('access/authorizer')}`, authorizer = Object.entries(found ?? {}).flatMap(([k, f]) => Object.entries(f).map(([measure, all]) => canonical({ at: `${at}:${when}`, by: 'target', form: 'alphabet', measure, role: 'writes', scope: k ? `${by}/${k}` : by, value: all.join('|') })));
+    const landed = await lands(draftOf(family, at, scope, digest, when), ...(attached.principal === undefined ? [] : keeping(kept, answer)), ...observed, ...authorizer);
+    return [...answer, ...('lines' in landed ? [...landed.lines, ...(await closing(digest))] : say('not-landed', { why: landed.refused })), ...(found?.['']?.['issuer'] && 'lines' in landed ? say('authorizer-observed', { source, issuer: found['']['issuer'][0] }) : [])];
+});

package/dist/src/flows/world.js

@@ -1,5 +1,5 @@
 import { join } from 'node:path';
-import { valueOf } from "../core/lock.js";
+import { under, valueOf } from "../core/lock.js";
 import { sayIn } from "../core/surface.js";
 import { pinnedOf } from "../core/worlds.js";
 import { adoptsIn } from "../adopt/adopt.js";
@@ -9,14 +9,14 @@ import { adoptsIn } from "../adopt/adopt.js";
  * is no standing. A place that pins a lock as its parent stands on nothing head may read: composing the two is bound's, never head's. A place that pins none and names a view has bound compile it, asked once; a fold bound refused is no standing either.
  */
 export const standingFor = async (context, place) => {
-    const [held, view, compiled] = [await context.standing(place), valueOf(context.lock, 'place/view'), valueOf(context.lock, 'place/compiled')];
+    const [held, view] = [await context.standing(place), valueOf(context.lock, 'place/view')];
     if ('refused' in held)
         return { unsettled: held.refused };
     const own = held.lines;
     const parent = adoptsIn(context.lock, own);
     if (parent !== undefined)
         return { unsettled: sayIn(context.lock)('parent-lock', { place, parent }) };
-    const pins = own.filter((l) => l.scope?.startsWith('uses/') && l.needs?.startsWith(`${compiled}/`)).map((l) => [l, pinnedOf(context.lock, context.files.take(join(place, l.needs)))]);
+    const pins = own.filter((l) => l.scope?.startsWith('uses/') && under(context.lock, 'place/compiled', l.needs)).map((l) => [l, pinnedOf(context.lock, context.files.take(join(place, l.needs)))]);
     const moved = pins.find(([l, p]) => p?.pin !== l.value);
     if (moved)
         return { unsettled: sayIn(context.lock)('compiled-moved', { file: moved[0].needs }) };

package/dist/src/index.js

@@ -13,23 +13,30 @@ import { Server } from '@modelcontextprotocol/sdk/server/index.js';
 import { StdioServerTransport } from '@modelcontextprotocol/sdk/server/stdio.js';
 import { CallToolRequestSchema, GetPromptRequestSchema, ListPromptsRequestSchema, ListResourcesRequestSchema, ListResourceTemplatesRequestSchema, ListToolsRequestSchema, ReadResourceRequestSchema } from '@modelcontextprotocol/sdk/types.js';
 import { answerOf } from "./core/answer.js";
-import { valueOf } from "./core/lock.js";
-import { fill, matchTemplate, refusedOn, surfaceOf } from "./core/surface.js";
-import { founded, land, landAct, limits, pinnedAt, run, settledView, sign, standingAt, told, words } from "./ports/bound.js";
+import { parse } from '@lapxo/topos/wire';
+import { aboutOf, valueOf } from "./core/lock.js";
+import { fill, sayIn } from "./core/surface.js";
+import { matchTemplate, refusedOn, shapeOf, shapeSchema, surfaceOf } from "./ports/surface.js";
+import { closing, cooled, founded, land, landAct, limits, pinnedAt, policyAt, run, settledView, sign, standingAt, told, warm, words } from "./ports/bound.js";
+import { warmth } from "./ports/warm.js";
 import { held, keep } from "./ports/cache.js";
 import { registryFor } from "./ports/signers.js";
-import { dropAt, folderOf, hasAt, layAt, lockAt, takeAt } from "./ports/place.js";
+import { dropAt, folderOf, hasAt, layAt, listAt, lockAt, takeAt } from "./ports/place.js";
+import * as documents from "./ports/documents.js";
 import { keychain } from "./ports/keychain.js";
 import { algorithmOf, deviceOf, idIn } from "./core/device.js";
-import { publicOf } from "./core/keys.js";
+import { publicOf } from "./ports/keys.js";
 import { personOf } from "./ports/access/person.js";
-import { inTurn } from "./flows/call.js";
 const [ext, root] = ((self) => [self.slice(self.lastIndexOf('.')), fileURLToPath(new URL(self.endsWith('.ts') ? '..' : '../..', self))])(import.meta.url);
 const lock = lockAt(root);
 const surface = surfaceOf(lock);
 const runs = valueOf(lock, 'runs');
-Object.assign(words, Object.fromEntries(['read', 'view', 'sign', 'land', 'key', 'signer', 'pin', 'topos', 'standing', 'evidence', 'act', 'profile'].map((w) => [w, valueOf(lock, `bound/${w}`)])));
+Object.assign(words, Object.fromEntries(['read', 'view', 'sign', 'land', 'key', 'signer', 'pin', 'topos', 'standing', 'evidence', 'act', 'profile', 'receipts', 'refusal'].map((w) => [w, valueOf(lock, `bound/${w}`)])));
 Object.assign(limits, { wait: Number(valueOf(lock, 'bound/wait').split('..')[1]), most: Number(valueOf(lock, 'bound/printed').split('..')[1]) });
+Object.assign(warmth, { spares: Number(valueOf(lock, 'bound/spares').split('..')[1]), boot: valueOf(lock, 'bound/spare-env').split('|') });
+/** One call at a time, each after the one before it and never on a timer, so one asked while another lands sees its receipt; bound started ahead for it, and nothing of it kept once it is answered. */
+let last = Promise.resolve();
+const turn = (act) => ((next) => { last = next.catch(() => undefined); return next; })(last.then(() => { void warm(runs); return act().finally(cooled); }));
 const offered = (n) => (n ? { listChanged: false } : undefined);
 const server = new Server({ name: surface.name, version: surface.version }, { capabilities: { tools: offered(surface.tools.length), resources: offered(surface.resources.length), prompts: offered(surface.prompts.length) } });
 /** The person, asked as the client lets head ask; every wait on them is counted, so a time ceiling measures head's work and never the person's. */
@@ -52,30 +59,48 @@ const device = (role) => devices.get(role) ?? ((secret) => (secret === undefined
 const asRoot = (account) => ((device, key) => [key, device.signer, { BOUND_SIGNERS: registryFor(device.signer, service, account, key, valueOf(lock, 'founding/algorithm'), store) }])(deviceOf(lock), valueOf(lock, 'founding/root').split('/')[1]);
 /** What a call is answered with, one call at a time as when bound blocked head: every bound process it starts is stopped when the client cancels it, and a call cancelled while it waits its turn is never begun. */
 const contextOf = (signal) => {
+    /** One call's folds of a place, kept until something lands in it or is laid there; the places its root acted in, whose receipts close once, when the call ends; and those where anything but a read's receipts landed, as bound printed it. */
+    const [folds, touched, moved] = [new Map(), new Set(), new Set()], forget = (place) => { for (const k of [...folds.keys()])
+        if (k.endsWith(`\0${place}`))
+            folds.delete(k); };
+    const read = (at) => at?.startsWith(`${valueOf(lock, 'receipt/at')}:`) === true;
+    const once = (key, place, fold) => (folds.get(`${key}\0${place}`) ?? ((p) => (folds.set(`${key}\0${place}`, p), p))(fold()));
+    const acted = (place, root, done) => done.then((got) => { if ('lines' in got && !got.lines.every((l) => ((f) => f.kind === 'fact' && read(f.value.fields['at']))(parse(l))))
+        moved.add(place); return got; }).finally(() => { forget(place); if (root)
+        touched.add(place); });
     const signRoot = (place, lot, account) => sign(runs, place, lot, ...asRoot(account), signal);
     const signAs = (place, lot, role, lines) => ((one, id) => sign(runs, place, lot, id, one.signer, { BOUND_SIGNERS: registryFor(one.signer, service, one.account, id, algorithmOf(lines), store) }, signal))(deviceOf(lock, role), idIn(lines, device(role)) ?? deviceOf(lock, role).account);
     return {
         lock,
         bound: (cwd, args) => run(runs, cwd, args, {}, signal),
-        standing: (place) => standingAt(runs, place, (lines) => ['head', 'person'].flatMap((role) => ((id) => (id === undefined ? [] : [id]))(idIn(lines, device(role)))), (line) => line.at?.startsWith(`${valueOf(lock, 'receipt/at')}:`) === true, signal),
-        world: (place, view) => settledView(runs, place, view, signal),
+        standing: (place) => once('standing', place, () => standingAt(runs, place, (lines) => ['head', 'person'].flatMap((role) => ((id) => (id === undefined ? [] : [id]))(idIn(lines, device(role)))), (line) => read(line.at), signal)),
+        policy: (place) => once('policy', place, () => policyAt(runs, place, signal)),
+        world: (place, view) => once(`world/${view}`, place, () => settledView(runs, place, view, signal)),
         adapter: async (origin) => ((name) => (!/^[a-z-]+$/.test(name) ? undefined : import(__rewriteRelativeImportExtension(new URL(`./ports/adapters/${name}${ext}`, import.meta.url).href))))(URL.canParse(origin) ? valueOf(lock, `adapter/${new URL(origin).protocol.slice(0, -1)}`) : ''),
-        files: { lay: layAt, drop: dropAt, has: hasAt, take: takeAt, own: (rel) => takeAt(join(root, rel)) },
+        files: { lay: (place, rel, bytes) => { forget(place); layAt(place, rel, bytes); }, drop: (place, rel) => { forget(place); dropAt(place, rel); }, has: hasAt, list: listAt, read: documents, take: takeAt, own: (rel) => takeAt(join(root, rel)) },
         home: () => home,
-        found: (place, account) => founded(runs, place, ...asRoot(account), signal),
+        personal: () => process.env[valueOf(lock, `platform/${process.platform}/home`)] ?? '',
+        found: (place, account) => acted(place, true, founded(runs, place, ...asRoot(account), signal)),
         signRoot,
-        landRoot: (place, lot, account) => landAct(runs, place, lot, ...asRoot(account), signal),
+        landRoot: (place, lot, account) => acted(place, true, landAct(runs, place, lot, ...asRoot(account), signal)),
+        moved: (place) => moved.has(place),
+        settle: async () => { const red = []; for (const place of touched) {
+            const why = await closing(runs, place, signal);
+            if (why !== undefined)
+                red.push(sayIn(lock)('receipts-open', { place, why }));
+        } touched.clear(); return red; },
         pinned: (place, file) => pinnedAt(runs, place, file, signal),
         access: async (kind) => (kind !== valueOf(lock, 'access/adapter') || !/^[a-z0-9-]+$/.test(kind) ? undefined : import(__rewriteRelativeImportExtension(new URL(`./ports/access/${kind}${ext}`, import.meta.url).href)).then((m) => m.adapter)),
         person,
         cache: { keep, held },
         signAs,
-        landAs: (place, lot, role, lines) => ((one, id) => landAct(runs, place, lot, id, one.signer, { BOUND_SIGNERS: registryFor(one.signer, service, one.account, id, algorithmOf(lines), store) }, signal))(deviceOf(lock, role), idIn(lines, device(role)) ?? deviceOf(lock, role).account),
-        land: (place, signed) => land(runs, place, signed, signal),
+        landAs: (place, lot, role, lines) => acted(place, false, ((one, id) => landAct(runs, place, lot, id, one.signer, { BOUND_SIGNERS: registryFor(one.signer, service, one.account, id, algorithmOf(lines), store) }, signal))(deviceOf(lock, role), idIn(lines, device(role)) ?? deviceOf(lock, role).account)),
+        land: (place, signed) => acted(place, true, land(runs, place, signed, signal)),
         told: (place, signed) => told(runs, place, signed, words.standing, signal),
-        elicit: (message) => person.consent(message, valueOf(lock, 'said/elicit/yes')),
+        elicit: (message) => person.consent(message, aboutOf(lock, 'said/elicit/yes')),
         now: () => Date.now(),
         machine: () => Date.now() - waited,
+        begun: Date.now() - waited,
         keys,
         device,
         roots: async () => (server.getClientCapabilities()?.roots ? (await server.listRoots()).roots.flatMap((root) => folderOf(root.uri) ?? []) : []),
@@ -86,23 +111,22 @@ const schemaOf = (fields) => ({ type: 'object',
     properties: Object.fromEntries(fields.map((f) => [f.name, { type: f.type, description: f.about }])), required: fields.filter((f) => f.required).map((f) => f.name) });
 if (surface.tools.length)
     server.setRequestHandler(ListToolsRequestSchema, () => ({ tools: surface.tools.map((tool) => ({ name: tool.name, description: tool.about,
-            inputSchema: schemaOf([...tool.fields]), annotations: Object.fromEntries(tool.hints.map((hint) => [`${hint}Hint`, true])) })) }));
+            inputSchema: schemaOf([...tool.fields]), outputSchema: shapeSchema(lock), annotations: Object.fromEntries(tool.hints.map((hint) => [`${hint}Hint`, true])) })) }));
 if (surface.tools.length)
-    server.setRequestHandler(CallToolRequestSchema, async (request, extra) => inTurn('', async () => {
+    server.setRequestHandler(CallToolRequestSchema, async (request, extra) => turn(async () => {
         const tool = surface.tools.find((one) => one.name === request.params.name);
         if (tool === undefined)
             return { isError: true, content: [] };
         const refused = refusedOn(lock, process.platform);
-        if (refused !== undefined)
-            return { content: [{ type: 'text', text: refused }] };
-        return { content: [{ type: 'text', text: extra.signal.aborted ? '' : (await (await answerOf('tools', tool.name))(askedOf(request.params.arguments), contextOf(extra.signal))).join('\n') }] };
+        const context = contextOf(extra.signal), answer = refused !== undefined ? [refused] : extra.signal.aborted ? [] : [...await (await answerOf('tools', tool.name))(askedOf(request.params.arguments), context), ...await context.settle()];
+        return { content: [{ type: 'text', text: answer.join('\n') }], structuredContent: shapeOf(answer) };
     }));
 if (surface.resources.length)
     server.setRequestHandler(ListResourcesRequestSchema, () => ({ resources: [] }));
 if (surface.resources.length)
     server.setRequestHandler(ListResourceTemplatesRequestSchema, () => ({ resourceTemplates: surface.resources.map((r) => ({ name: r.name, uriTemplate: r.template, description: r.about, mimeType: r.mime })) }));
 if (surface.resources.length)
-    server.setRequestHandler(ReadResourceRequestSchema, async (request, extra) => inTurn('', async () => {
+    server.setRequestHandler(ReadResourceRequestSchema, async (request, extra) => turn(async () => {
         const found = surface.resources.flatMap((r) => ((vars) => (vars === undefined ? [] : [{ r, vars }]))(matchTemplate(r.template, request.params.uri)))[0];
         if (found === undefined)
             return { contents: [] };

package/dist/src/onboard/first.d.ts

@@ -0,0 +1,9 @@
+import { type Asked, type Context } from '../core/answer.ts';
+/**
+ * The first source a person connects with no place named and none to read from, on one yes that says all it grants:
+ * their place founded in the folder the lock names under their own home, the source connected to it, and reads of it
+ * granted until the access period ends. A document that does not arrive is no refusal: the place is founded owing it
+ * by its address. Either way the question asked comes back as what to ask next. A folder that already holds a place is
+ * used as it stands, never founded again, and its connect asks its own yes.
+ */
+export declare const firstRun: (asked: Asked, context: Context, then: (place: string, covered: boolean) => Promise<readonly string[]>) => Promise<readonly string[]>;

package/dist/src/onboard/first.js

@@ -0,0 +1,38 @@
+import { basename, join } from 'node:path';
+import { canonical, LOCK } from '@lapxo/topos/wire';
+import { unless } from "../core/answer.js";
+import { untilOf } from "../core/act.js";
+import { valueOf } from "../core/lock.js";
+import { sayIn } from "../core/surface.js";
+import { rootIn } from "../flows/device.js";
+import { bornAt } from "../places/found.js";
+import { attachedFor } from "../sources/access.js";
+/**
+ * The first source a person connects with no place named and none to read from, on one yes that says all it grants:
+ * their place founded in the folder the lock names under their own home, the source connected to it, and reads of it
+ * granted until the access period ends. A document that does not arrive is no refusal: the place is founded owing it
+ * by its address. Either way the question asked comes back as what to ask next. A folder that already holds a place is
+ * used as it stands, never founded again, and its connect asks its own yes.
+ */
+export const firstRun = async (asked, context, then) => {
+    const say = sayIn(context.lock), word = (k) => valueOf(context.lock, k), dir = join(context.personal(), word('first-run/folder')), name = basename(dir);
+    if (context.files.has(dir, LOCK))
+        return then(dir, false);
+    const [source, document, until] = [(asked['source'] ?? '').toLowerCase().replace(/[^a-z0-9-]+/g, '-'), asked['document'] ?? '', untilOf(word('access/period'), context.now())];
+    const refused = await unless(context, say('elicit-first-run', { dir, source, document, until }));
+    if (refused)
+        return refused;
+    const born = await bornAt(context, dir, name), root = rootIn(context, dir);
+    if (born[0] !== say('born', { name, dir }) || 'said' in root)
+        return 'said' in root ? [...born, ...root.said] : born;
+    const connected = await then(dir, true), unread = connected.some((l) => l.startsWith('said/head/document-unread ')), held = unread ? undefined : await context.policy(dir);
+    if (held !== undefined && ('refused' in held || !held.lines.some((l) => l.scope === `uses/${source}`)))
+        return [...born, ...connected];
+    const line = (scope, measure, value, role = 'writes') => canonical({ at: 'policy:head/first-run', by: 'target', form: 'alphabet', measure, role, scope, value });
+    const owed = unread ? [line(`${word('place/needs')}/bytes/${source}`, 'id', document, 'demands')] : [];
+    const landed = await context.landRoot(dir, [line(word('grant/family'), 'sources', source), line(word('grant/family'), 'until', until), ...owed], root.account);
+    if ('refused' in landed)
+        return [...born, ...connected, say('not-landed', { why: landed.refused })];
+    const access = unread ? undefined : await attachedFor(context, dir, source);
+    return [...born, ...(unread ? [] : connected), ...landed.lines, ...(access !== undefined && 'said' in access ? access.said : []), say(unread ? 'bytes-owed' : 'ready', { source, place: dir, document, operation: asked['operation'], args: asked['args'] })];
+};

package/dist/src/onboard/owed.d.ts

@@ -0,0 +1,10 @@
+import { type Asked, type Context } from '../core/answer.ts';
+/**
+ * What a place founded on a first connect still owes: its source's document, by the address the person gave. Asked again,
+ * it is read there; once it arrives, the source is connected from those bytes and pinned by their digest, the demand is
+ * withdrawn and the question is answered. Until then it is not: what is owed is said, and nothing else is asked.
+ */
+export declare const paidIn: (asked: Asked, context: Context, place: string) => Promise<{
+    readonly said: readonly string[];
+    readonly answer: boolean;
+}>;

package/dist/src/onboard/owed.js

@@ -0,0 +1,28 @@
+import { canonical } from '@lapxo/topos/wire';
+import { standingOr } from "../core/answer.js";
+import { valueOf } from "../core/lock.js";
+import { sayIn } from "../core/surface.js";
+import { rootIn } from "../flows/device.js";
+import { laidIn } from "../sources/connect.js";
+/**
+ * What a place founded on a first connect still owes: its source's document, by the address the person gave. Asked again,
+ * it is read there; once it arrives, the source is connected from those bytes and pinned by their digest, the demand is
+ * withdrawn and the question is answered. Until then it is not: what is owed is said, and nothing else is asked.
+ */
+export const paidIn = async (asked, context, place) => {
+    const say = sayIn(context.lock), word = (k) => valueOf(context.lock, k), source = asked['source'] ?? '';
+    const held = await standingOr(context, place), scope = `${word('place/needs')}/bytes/${source}`;
+    const owed = 'said' in held ? undefined : held.lines.find((l) => l.scope === scope && l.role === 'demands' && l.value !== 'withdraw');
+    if (owed === undefined)
+        return { said: [], answer: true };
+    const document = owed.value ?? '', read = await context.files.read.documentOf(context, place, document), root = rootIn(context, place);
+    if ('said' in root)
+        return { said: root.said, answer: false };
+    if (read === undefined)
+        return { said: [say('bytes-owed', { source, place, document })], answer: false };
+    const laid = await laidIn(context, place, root.account)(source, document, read, undefined, context.machine());
+    if (!laid.connected)
+        return { said: laid.said, answer: false };
+    const landed = await context.landRoot(place, [canonical({ ...Object.fromEntries(Object.entries(owed).filter(([k]) => !['sig', 'epoch'].includes(k))), by: 'target', value: 'withdraw' })], root.account);
+    return 'refused' in landed ? { said: [...laid.said, say('not-landed', { why: landed.refused })], answer: false } : { said: [...laid.said, ...landed.lines], answer: true };
+};

package/dist/src/onboard/site.d.ts

@@ -0,0 +1,12 @@
+import type { Asked, Context } from '../core/answer.ts';
+/**
+ * What a person names as a source's document, made a document head can read, before anything is founded or connected:
+ * an address or a file is as given; a site alone is looked for where it says its documents are (its API catalog) and at
+ * the paths the lock names, the first that reads taken; a folder, at the same names inside it. A source the person names
+ * none for is named after the site or the folder. A site where nothing reads is said, with what was tried.
+ */
+export declare const resolved: (asked: Asked, context: Context) => Promise<{
+    readonly asked: Asked;
+} | {
+    readonly said: readonly string[];
+}>;

package/dist/src/onboard/site.js

@@ -0,0 +1,22 @@
+import { basename, dirname, join } from 'node:path';
+import { EXTENSION } from '@lapxo/topos/wire';
+import { members, valueOf } from "../core/lock.js";
+import { sayIn } from "../core/surface.js";
+/**
+ * What a person names as a source's document, made a document head can read, before anything is founded or connected:
+ * an address or a file is as given; a site alone is looked for where it says its documents are (its API catalog) and at
+ * the paths the lock names, the first that reads taken; a folder, at the same names inside it. A source the person names
+ * none for is named after the site or the folder. A site where nothing reads is said, with what was tried.
+ */
+export const resolved = async (asked, context) => {
+    const [at, word] = [asked['document'] ?? '', (k) => valueOf(context.lock, k)], named = (name) => asked['source'] || name.toLowerCase().replace(/[^a-z0-9-]+/g, '-');
+    if (/^([a-z]+:\/\/)?[^/\s]+\.[^/\s]+\/?$/.test(at) && URL.canParse(/^[a-z]+:\/\//.test(at) ? at : `${word('use/scheme')}//${at}`)) {
+        const site = new URL(/^[a-z]+:\/\//.test(at) ? at : `${word('use/scheme')}//${at}`), tried = await context.files.read.describedAt(context, site.origin);
+        for (const document of tried)
+            if (((read) => read !== undefined && `.${read.kind}` !== EXTENSION)(await context.files.read.documentOf(context, '', document)))
+                return { asked: { ...asked, document, source: named(site.hostname) } };
+        return { said: [sayIn(context.lock)('use-none', { origin: site.origin, tried: tried.join(', ') || '—' })] };
+    }
+    const inside = at.startsWith('/') && context.files.list(dirname(at), basename(at)).length ? members(word('use/documents')).map((p) => basename(p)).find((n) => context.files.has(at, n)) : undefined;
+    return { asked: inside === undefined ? asked : { ...asked, document: join(at, inside), source: named(basename(at)) } };
+};

package/dist/src/places/admit.js

@@ -15,7 +15,7 @@ export const admitted = (asked, context) => inPlace(asked, context, async (place
     const key = (asked['key'] ?? '').split('\n').map((line) => parse(line.trim())).flatMap((got) => (got.kind === 'fact' && got.value.fields['measure'] === 'public-key' ? [got.value.fields['value'] ?? ''] : []))[0];
     if (!name || !key)
         return [say('no-key')];
-    const [root, held] = [rootIn(context, place), await standingOr(context, place)];
+    const [root, held] = [rootIn(context, place), await standingOr(context, place, context.policy)];
     if ('said' in root)
         return root.said;
     if ('said' in held)

package/dist/src/places/found.d.ts

@@ -4,3 +4,4 @@ import type { Asked, Context } from '../core/answer.ts';
  * and named in head's own index of places — itself a place, founded the first time — by a line its root signs.
  */
 export declare const bornPlace: (asked: Asked, context: Context) => Promise<readonly string[]>;
+export declare const bornAt: (context: Context, dir: string, name: string) => Promise<readonly string[]>;

package/dist/src/places/found.js

@@ -2,7 +2,6 @@ import { isAbsolute, basename } from 'node:path';
 import { canonical, LOCK } from '@lapxo/topos/wire';
 import { unless } from "../core/answer.js";
 import { admissionOf } from "../core/device.js";
-import { newKey } from "../core/keys.js";
 import { valueOf } from "../core/lock.js";
 import { deviceKey } from "../flows/device.js";
 import { walkable } from "../walk/context.js";
@@ -25,9 +24,10 @@ const founded = async (context, dir, name) => {
         return { refused: 'no-keychain' };
     if (context.keys.read(account) !== undefined)
         return { refused: 'place-taken' };
-    const root = newKey();
-    context.keys.write(account, root.secret);
-    context.files.lay(dir, LOCK, new TextEncoder().encode(`${birthOf(context.lock, root.publicKey, head, person, name).join('\n')}\n`));
+    const root = context.keys.made?.(account);
+    if (root === undefined)
+        return { refused: 'no-keychain' };
+    context.files.lay(dir, LOCK, new TextEncoder().encode(`${birthOf(context.lock, root, head, person, name).join('\n')}\n`));
     const born = await context.found(dir, account);
     return ((got) => ('refused' in got ? { refused: 'not-landed', why: got.refused } : got))('refused' in born ? born : await walkable(context, dir, account));
 };
@@ -44,9 +44,10 @@ export const bornPlace = async (asked, context) => {
     if (context.files.has(dir, LOCK))
         return [say('place-exists', { dir })];
     const refused = await unless(context, say('elicit-place', { name, dir }));
-    if (refused)
-        return refused;
-    const born = await founded(context, dir, name);
+    return refused ?? bornAt(context, dir, name);
+};
+export const bornAt = async (context, dir, name) => {
+    const say = sayIn(context.lock), born = await founded(context, dir, name);
     if ('refused' in born)
         return [say(born.refused, { name, dir, why: born.why ?? '' })];
     const home = context.home();

package/dist/src/ports/access/authorizer.d.ts

@@ -0,0 +1,10 @@
+import type { Fields } from '../../access/contract.ts';
+/**
+ * The authorizer a resource names when it refuses a request: its protected resource metadata (RFC 9728) at the address
+ * its challenge gives, which must name the very origin that refused; the authorization server's metadata (RFC 8414),
+ * which must name the issuer the resource named and take S256; and from them the oauth2 authorization-code flow a
+ * document would have declared — the same steps, PKCE through head's page, a client registered (RFC 7591) only where
+ * the server offers registration and the person's own where it does not, the token and its refresh, renewed at the
+ * token endpoint. Every one of these reads goes with nothing attached; what does not hold is no authorizer.
+ */
+export declare const discovered: (resource: string, challenge: string, get: (url: string) => Promise<unknown>) => Promise<Readonly<Record<string, Fields>> | undefined>;

package/dist/src/ports/access/authorizer.js

@@ -0,0 +1,34 @@
+const text = (json, key) => ((v) => (typeof v === 'string' && v ? v : undefined))(json?.[key]);
+const texts = (json, key) => ((v) => (Array.isArray(v) ? v.filter((x) => typeof x === 'string') : []))(json?.[key]);
+const fields = (pairs) => Object.fromEntries(Object.entries(pairs).map(([k, v]) => [k, [v].flat()]));
+/**
+ * The authorizer a resource names when it refuses a request: its protected resource metadata (RFC 9728) at the address
+ * its challenge gives, which must name the very origin that refused; the authorization server's metadata (RFC 8414),
+ * which must name the issuer the resource named and take S256; and from them the oauth2 authorization-code flow a
+ * document would have declared — the same steps, PKCE through head's page, a client registered (RFC 7591) only where
+ * the server offers registration and the person's own where it does not, the token and its refresh, renewed at the
+ * token endpoint. Every one of these reads goes with nothing attached; what does not hold is no authorizer.
+ */
+export const discovered = async (resource, challenge, get) => {
+    const at = /resource_metadata="([^"]+)"/.exec(challenge)?.[1];
+    if (at === undefined || !URL.canParse(at, resource))
+        return undefined;
+    const named = await get(new URL(at, resource).href), [issuer] = texts(named, 'authorization_servers'), own = text(named, 'resource');
+    if (own === undefined || !URL.canParse(own) || new URL(own).origin !== new URL(resource).origin || issuer === undefined || !URL.canParse(issuer))
+        return undefined;
+    const server = await get(`${new URL(issuer).origin}/.well-known/oauth-authorization-server${new URL(issuer).pathname.replace(/\/$/, '')}`);
+    const [authorize, token, register, methods] = [text(server, 'authorization_endpoint'), text(server, 'token_endpoint'), text(server, 'registration_endpoint'), texts(server, 'code_challenge_methods_supported')];
+    if (text(server, 'issuer') !== issuer || authorize === undefined || token === undefined || (methods.length > 0 && !methods.includes('S256')))
+        return undefined;
+    const [client, scopes] = [register ? '$steps.register.outputs.client' : '$client', texts(named, 'scopes_supported').join(' ')];
+    const sent = (step, pairs) => Object.fromEntries(Object.entries(pairs).filter(([, v]) => v).map(([k, v]) => [`${step}/payload/${k}`, fields({ value: v })]));
+    return {
+        '': fields({ type: 'oauth2/authorizationCode', issuer, 'attach-in': 'header', 'attach-name': 'Authorization', 'attach-template': 'Bearer {token}', token: '$steps.exchange.outputs.token', expires: '$steps.exchange.outputs.expires', refresh: '$steps.exchange.outputs.refresh', renew: token }),
+        ...(register ? { 'steps/0': fields({ id: 'register', url: register, encoding: 'json' }), 'steps/0/payload/redirect_uris': fields({ items: '$callback' }), 'steps/0/payload/grant_types': fields({ items: ['authorization_code', 'refresh_token'] }),
+            'steps/0/payload/response_types': fields({ items: 'code' }), ...sent('steps/0', { client_name: 'head', token_endpoint_auth_method: "'none'" }), 'steps/0/outputs/client': fields({ value: '$response.body#/client_id' }) } : {}),
+        'steps/1': fields({ id: 'authorize', page: authorize }), 'steps/1/outputs/code': fields({ value: '$response.body#/code' }),
+        ...sent('steps/1', { client_id: client, redirect_uri: '$callback', response_type: 'code', scope: scopes, state: '$state', code_challenge: 's256($verifier)', code_challenge_method: 'S256', resource: new URL(resource).origin }),
+        'steps/2': fields({ id: 'exchange', url: token, encoding: 'form' }), ...sent('steps/2', { grant_type: 'authorization_code', code: '$steps.authorize.outputs.code', redirect_uri: '$callback', client_id: client, code_verifier: '$verifier', resource: new URL(resource).origin }),
+        'steps/2/outputs/token': fields({ value: '$response.body#/access_token' }), 'steps/2/outputs/expires': fields({ value: '$response.body#/expires_in' }), 'steps/2/outputs/refresh': fields({ value: '$response.body#/refresh_token' }),
+    };
+};

package/dist/src/ports/access/flow.js

@@ -1,4 +1,6 @@
 import { createHash, randomBytes } from 'node:crypto';
+import { jsonOf } from "../../access/contract.js";
+import { discovered } from "./authorizer.js";
 const one = (f, measure) => f?.[measure]?.[0];
 const pointed = (json, pointer) => pointer.split('/').slice(1).map((s) => s.replaceAll('~1', '/').replaceAll('~0', '~'))
     .reduce((at, step) => at.flatMap((v) => (v === null || typeof v !== 'object' ? [] : step === '*' ? Object.values(v) : [v[step]])), [json])
@@ -18,9 +20,16 @@ const originOf = (url) => (URL.canParse(url) ? new URL(url).origin : '');
  * the token is kept, and it rides a request as the flow's template says.
  */
 export const adapter = {
+    discover: discovered,
     attach: (secret, params) => ((into, name, value) => (into === 'header' ? { headers: { [name]: value }, query: {} } : into === 'query' ? { headers: {}, query: { [name]: value } } : { headers: {}, query: {} }))(one(params, 'attach-in'), one(params, 'attach-name') ?? '', (one(params, 'attach-template') ?? '{token}').split('{token}').join(secret)),
     obtain: async (want) => {
-        const [d, gen, inputs, outputs] = [want.declared, { state: randomBytes(24).toString('base64url'), verifier: randomBytes(32).toString('base64url') }, new Map(), new Map()];
+        const [d, renewed] = [want.declared, ((r) => (r && typeof r === 'object' ? r : undefined))(jsonOf(want.renew ?? ''))];
+        if (renewed?.refresh && one(d[''], 'renew')) {
+            const got = await want.post(one(d[''], 'renew'), { grant_type: 'refresh_token', refresh_token: renewed.refresh, ...(renewed.client ? { client_id: renewed.client } : {}) }, 'form'), [secret, lasts, refresh] = ['/access_token', '/expires_in', '/refresh_token'].map((at) => pointed(got?.json, at)[0]);
+            if (got !== undefined && got.status < 300 && secret)
+                return { secret, ...(Number.isFinite(Number(lasts)) && lasts ? { expires: want.now + Number(lasts) * 1000 } : {}), renew: JSON.stringify({ ...renewed, refresh: refresh ?? renewed.refresh }) };
+        }
+        const [gen, inputs, outputs] = [{ state: randomBytes(24).toString('base64url'), verifier: randomBytes(32).toString('base64url') }, new Map(), new Map()];
         let [callback, secrets, refused] = ['', 0, undefined];
         const stop = (why) => { refused ??= why; return undefined; };
         const ask = async (name) => {
@@ -110,11 +119,12 @@ export const adapter = {
         for (const k of page >= 0 ? steps.slice(page + 1) : steps)
             if (refused || !(await run(k)))
                 break;
-        const [token, expires] = [(await Promise.all((d['']?.['token'] ?? []).map((e) => resolve(e)))).find((v) => !empty(v)), (await Promise.all((d['']?.['expires'] ?? []).map((e) => resolve(e)))).find((v) => !empty(v))];
+        const [token, expires, refresh] = await Promise.all(['token', 'expires', 'refresh'].map(async (k) => (await Promise.all((d['']?.[k] ?? []).map((e) => resolve(e)))).find((v) => !empty(v))));
         if (refused)
             return refused;
         if (typeof token !== 'string' || !token)
             return { refused: 'login-refused' };
-        return { secret: token, ...(typeof expires === 'string' && Number.isFinite(Number(expires)) ? { expires: want.now + Number(expires) * 1000 } : {}), ...(steps.length ? {} : { manual: true }) };
+        return { secret: token, ...(typeof expires === 'string' && Number.isFinite(Number(expires)) ? { expires: want.now + Number(expires) * 1000 } : {}), ...(steps.length ? {} : { manual: true }),
+            ...(typeof refresh === 'string' && refresh ? { renew: JSON.stringify({ refresh, client: outputs.get('register')?.get('client') ?? one(d[''], 'client') }) } : {}) };
     },
 };

package/dist/src/ports/access/person.d.ts

@@ -14,8 +14,9 @@ export interface Client {
 /**
  * The person at this device, asked through the richest channel the client declares, in the order head's lock lines name:
  * the client's own form; head's one-time page, sent by the client as an address; the same page opened by this device's
- * browser. A secret goes only through the page — never a form the model could see — and a yes only through what the
- * client can ask, else it is the person's to sign. A visit to a provider comes back to such a page.
+ * browser. A secret goes only through the page — never a form the model could see — and a yes is the person's answer on
+ * any of them, never the model's: where none reaches the person, nothing was asked and the lines are theirs to sign.
+ * A visit to a provider comes back to such a page.
  */
 export declare const personOf: (lock: readonly Said[], client: Client) => {
     consent: (message: string, word: string) => Promise<"yes" | "no" | "none">;