@lapxo/head 0.1.3 → 0.1.4

package/dist/src/access/obtain.d.ts

@@ -1,7 +1,12 @@
-import type { Attachment } from './contract.ts';
+import type { Attachment, Obtained } from './contract.ts';
 import type { Context } from '../core/answer.ts';
 import type { Said } from '../core/lock.ts';
 import type { Call } from '../core/read.ts';
+type Kept = Obtained & {
+    readonly at?: string;
+};
+export declare const sealed: (got: Kept) => string;
+export declare const opened: (kept: string | undefined) => Kept | undefined;
 /** Whom a call is made as, never its secret: anonymous, or the access account and when the secret it holds now was obtained — still holding, unless what was made as it is only being looked back on; none while no secret is kept, or one is kept without saying when. */
 export declare const principalOf: (context: Context, plan: Call, current?: boolean) => string | undefined;
 /**
@@ -17,3 +22,4 @@ export declare const attachmentFor: (context: Context, place: string, lines: rea
     readonly said: string;
     readonly input?: string;
 }>;
+export {};

package/dist/src/access/obtain.js

@@ -1,10 +1,10 @@
 import { canonical } from '@lapxo/topos/wire';
 import { jsonOf } from "./contract.js";
 import { placeNameOf } from "../core/answer.js";
-import { members, valueOf } from "../core/lock.js";
+import { aboutOf, members, valueOf } from "../core/lock.js";
 import { fieldsOf, stepOf, vocabOf } from "../core/read.js";
-const sealed = (got) => Buffer.from(JSON.stringify(got)).toString('base64url');
-const opened = (kept) => { try {
+export const sealed = (got) => Buffer.from(JSON.stringify(got)).toString('base64url');
+export const opened = (kept) => { try {
     return kept === undefined ? undefined : JSON.parse(Buffer.from(kept, 'base64url').toString('utf8'));
 }
 catch {
@@ -55,7 +55,7 @@ export const attachmentFor = async (context, place, lines, plan) => {
         values: members(valueOf(lines, 'wire/access-values') || valueOf(context.lock, 'wire/access-values')),
         host: Object.fromEntries(context.lock.filter((l) => l.scope?.startsWith('host/')).map((l) => [l.scope.slice('host/'.length), l.value ?? ''])),
         scopes: [...new Set(lines.filter((l) => reads.has(l.scope) && l.measure === 'scopes').flatMap((l) => (l.value ?? '').split('|')))].sort(),
-        enter: (title, fields) => context.person.enter(title, fields), consent: async (message) => (await context.person.consent(message, valueOf(context.lock, 'said/elicit/yes'))) === 'yes', choose: (message, choices) => context.person.choose(message, choices), visit: (message, to) => context.person.visit(message, to),
+        enter: (title, fields) => context.person.enter(title, fields), consent: async (message) => (await context.person.consent(message, aboutOf(context.lock, 'said/elicit/yes'))) === 'yes', choose: (message, choices) => context.person.choose(message, choices), visit: (message, to) => context.person.visit(message, to),
         form: (source, operation) => fieldsOf(lines, `${v.offers}/${source}/${operation}/${v.form}`), call: step,
         post: async (url, body, as) => ((transport) => (transport === undefined ? undefined : transport.post(url, body, most, Number(valueOf(context.lock, 'adapter/request/wait').split('..')[1]), as)))(await context.adapter(url)),
     };

package/dist/src/core/answer.d.ts

@@ -64,6 +64,7 @@ export interface Context {
     readonly signRoot: (place: string, lot: readonly string[], account: string) => Promise<Outcome>;
     readonly landRoot: (place: string, lot: readonly string[], account: string) => Promise<Outcome>;
     readonly settle: () => Promise<readonly string[]>;
+    readonly moved: (place: string) => boolean;
     readonly pinned: (place: string, file: string) => Promise<{
         readonly pin: string;
         readonly bytes: string;
@@ -82,6 +83,7 @@ export interface Context {
     readonly elicit: (message: string) => Promise<'yes' | 'no' | 'none'>;
     readonly now: () => number;
     readonly machine: () => number;
+    readonly begun: number;
 }
 export type Answer = (asked: Asked, context: Context) => Promise<readonly string[]>;
 /** What answers a line of the surface: the module named as the line, in the folder of its family. */

package/dist/src/core/read.js

@@ -61,4 +61,4 @@ const callOf = (lines, lock, source, operation, place) => {
 };
 const isCallable = (lock, classes) => classes.length === 1 && classes[0] === vocabOf(lock).callable;
 export const planRead = (lines, lock, source, operation, place) => ((call) => (call.kind === 'call' && !isCallable(lock, call.classes) ? said('not-callable', { source, operation, class: call.classes.join(', ') }) : call))(callOf(lines, lock, source, operation, place));
-export const planAct = (lines, lock, source, operation, place) => ((call) => (call.kind === 'call' && isCallable(lock, call.classes) ? said('is-read', { source, operation }) : call.kind === 'call' && call.access.probe ? said('access-unstated', { source, operation }) : call))(callOf(lines, lock, source, operation, place));
+export const planAct = (lines, lock, source, operation, place) => ((call) => (call.kind === 'call' && isCallable(lock, call.classes) ? said('is-read', { source, operation }) : call.kind === 'call' && call.access.probe ? said('access-unstated', { source, operation, method: call.carry['method']?.[0], path: call.carry['path']?.[0] }) : call))(callOf(lines, lock, source, operation, place));

package/dist/src/flows/call.d.ts

@@ -12,8 +12,6 @@ export declare const pickedOrigin: (context: Context, place: string, lines: read
 } | {
     readonly said: readonly string[];
 }>;
-/** Calls of one place take turns, so one asked while another lands sees its receipt; nothing waits on a timer. */
-export declare const inTurn: <T>(place: string, act: () => Promise<T>) => Promise<T>;
 export interface Frame {
     readonly say: (key: string, fields?: Readonly<Record<string, string | undefined>>) => readonly string[];
     readonly lands: (...lot: readonly string[]) => Promise<Outcome>;
@@ -43,7 +41,7 @@ export interface Frame {
     readonly uncovered: (role: string, scopes: readonly string[]) => readonly string[] | undefined;
 }
 /**
- * The steps a read and an act share: the place, its turn, the lines it stands on once bound settled them, the offer's
+ * The steps a read and an act share: the place, the lines it stands on once bound settled them, the offer's
  * plan, the transport its origin names and the request it prepares; then what is particular, given a frame that says
  * by the lock, attaches access when asked, types what came back and lands a line under head's key.
  */

package/dist/src/flows/call.js

@@ -27,18 +27,15 @@ export const pickedOrigin = async (context, place, lines, source, plan) => {
     const landed = await by.land([canonical(line(chosen))]);
     return 'refused' in landed ? { said: [sayIn(context.lock)('not-landed', { why: landed.refused })] } : { lines: [...lines, line(chosen)] };
 };
-const turns = new Map();
-/** Calls of one place take turns, so one asked while another lands sees its receipt; nothing waits on a timer. */
-export const inTurn = (place, act) => { const next = (turns.get(place) ?? Promise.resolve()).then(act, act); turns.set(place, next.catch(() => undefined)); return next; };
 /**
- * The steps a read and an act share: the place, its turn, the lines it stands on once bound settled them, the offer's
+ * The steps a read and an act share: the place, the lines it stands on once bound settled them, the offer's
  * plan, the transport its origin names and the request it prepares; then what is particular, given a frame that says
  * by the lock, attaches access when asked, types what came back and lands a line under head's key.
  */
 export const called = async (asked, context, planOf, then) => {
     const say = (key, fields = {}) => [sayIn(context.lock)(key, fields)];
     const [source, operation] = [asked['source'] ?? '', asked['operation'] ?? ''];
-    return inPlace(asked, context, (place) => inTurn(place, async () => {
+    return inPlace(asked, context, async (place) => {
         const held = await standingFor(context, place);
         if ('unsettled' in held)
             return say('unsettled', { source, why: held.unsettled });
@@ -72,5 +69,5 @@ export const called = async (asked, context, planOf, then) => {
         const attach = async () => ((got) => ('said' in got ? { said: say(got.said, { source, operation, kinds: plan.access.kind, input: got.input }) } : got))(await attachmentFor(context, place, lines, plan));
         const uncovered = (role, scopes) => uncoveredIn(context.lock, lines, context.device(role), place, [], scopes);
         return then({ widen, word: (scope) => valueOf(context.lock, scope), say, place, lines, source, operation, plan, prepared, most, typed, attach, send: (attachment) => prepared.send(attachment, most('read/response-bytes')), lands, uncovered });
-    }));
+    });
 };

package/dist/src/flows/read.js

@@ -7,6 +7,7 @@ import { canonical } from '@lapxo/topos/wire';
 import { called } from "./call.js";
 import { principalOf } from "../access/obtain.js";
 import { jsonOf } from "../access/contract.js";
+import { refusedAccess } from "../sources/refused.js";
 /** An intent an earlier act left open, closed by the read that looked at what it would have changed: a line naming that read-s digest, signed by head. */
 const closeWith = async (intent, source, digest, { word, lines, lands }, context) => {
     const say = sayIn(context.lock);
@@ -24,7 +25,7 @@ const closeWith = async (intent, source, digest, { word, lines, lands }, context
  * the reuse the place allows, it answers from what was kept: nothing called. Asked for history, it shows what was kept
  * of that request as of when it was read — evidence of that read, never a current answer — where the place allows it.
  */
-export const readSource = (asked, context) => ((started) => called(asked, context, planRead, async ({ word, say, place, lines, source, operation, plan, prepared, most, typed, attach, send, lands, widen, uncovered }) => {
+export const readSource = (asked, context) => called(asked, context, planRead, async ({ word, say, place, lines, source, operation, plan, prepared, most, typed, attach, send, lands, widen, uncovered }) => {
     const [family, at, when] = [word('receipt/family'), word('receipt/at'), new Date(context.now()).toISOString()];
     const closing = (digest) => closeWith(asked['closes'], source, digest, { word, lines, lands }, context);
     const scopes = (principal) => [scopeOf(family, source, operation, prepared.key, principal), `${scopeOf(word('receipt/kept'), source, operation, prepared.key, principal)}/${basisOf(lines, word, source)}`];
@@ -66,7 +67,7 @@ export const readSource = (asked, context) => ((started) => called(asked, contex
         const [scope, kept] = scopes(principal);
         const answered = held(receiptsOf(lines, at, kept).find((k) => k.at >= newest.at)?.digest);
         if (answered !== undefined)
-            return [...new TextDecoder().decode(answered.bytes).split('\n'), ...say('reused', { scope: kept, digest: answered.digest, at: newest.at }), ...(await closing(newest.digest)), ...redIn(context.lock)('answer/kept', `answer/${source}/${operation}@${word('look/call')}`, started, context.machine())];
+            return [...new TextDecoder().decode(answered.bytes).split('\n'), ...say('reused', { scope: kept, digest: answered.digest, at: newest.at }), ...(await closing(newest.digest)), ...redIn(context.lock)('answer/kept', `answer/${source}/${operation}`, context.begun, context.machine())];
         const body = held(newest.digest);
         if (body !== undefined) {
             const cut = body.bytes.indexOf(10);
@@ -85,6 +86,8 @@ export const readSource = (asked, context) => ((started) => called(asked, contex
     const got = await send(attached.attachment);
     if (got.kind !== 'got')
         return say(got.kind === 'over' ? 'too-large' : 'unreachable-source', { source });
+    if (got.status === 401 && attached.principal !== 'anonymous')
+        return refusedAccess(context, place, lines, plan, operation);
     const digest = context.cache.keep(Buffer.concat([Buffer.from(`${got.status}\n`), got.bytes]));
     const answer = await typed(String(got.status), got.bytes);
     const observed = plan.access.probe && got.status < 300 ? [canonical({ at: `${at}:${when}`, by: 'target', form: 'alphabet', measure: word('vocab/access'), role: 'writes', scope: observedAt(context.lock, source, operation), value: word('vocab/anonymous') })] : [];
@@ -92,4 +95,4 @@ export const readSource = (asked, context) => ((started) => called(asked, contex
     const by = `${word('access/family')}/${source}/${word('access/authorizer')}`, authorizer = Object.entries(found ?? {}).flatMap(([k, f]) => Object.entries(f).map(([measure, all]) => canonical({ at: `${at}:${when}`, by: 'target', form: 'alphabet', measure, role: 'writes', scope: k ? `${by}/${k}` : by, value: all.join('|') })));
     const landed = await lands(draftOf(family, at, scope, digest, when), ...(attached.principal === undefined ? [] : keeping(kept, answer)), ...observed, ...authorizer);
     return [...answer, ...('lines' in landed ? [...landed.lines, ...(await closing(digest))] : say('not-landed', { why: landed.refused })), ...(found?.['']?.['issuer'] && 'lines' in landed ? say('authorizer-observed', { source, issuer: found['']['issuer'][0] }) : [])];
-}))(context.machine());
+});

package/dist/src/index.js

@@ -13,7 +13,8 @@ import { Server } from '@modelcontextprotocol/sdk/server/index.js';
 import { StdioServerTransport } from '@modelcontextprotocol/sdk/server/stdio.js';
 import { CallToolRequestSchema, GetPromptRequestSchema, ListPromptsRequestSchema, ListResourcesRequestSchema, ListResourceTemplatesRequestSchema, ListToolsRequestSchema, ReadResourceRequestSchema } from '@modelcontextprotocol/sdk/types.js';
 import { answerOf } from "./core/answer.js";
-import { valueOf } from "./core/lock.js";
+import { parse } from '@lapxo/topos/wire';
+import { aboutOf, valueOf } from "./core/lock.js";
 import { fill, sayIn } from "./core/surface.js";
 import { matchTemplate, refusedOn, shapeOf, shapeSchema, surfaceOf } from "./ports/surface.js";
 import { closing, cooled, founded, land, landAct, limits, pinnedAt, policyAt, run, settledView, sign, standingAt, told, warm, words } from "./ports/bound.js";
@@ -26,7 +27,6 @@ import { keychain } from "./ports/keychain.js";
 import { algorithmOf, deviceOf, idIn } from "./core/device.js";
 import { publicOf } from "./ports/keys.js";
 import { personOf } from "./ports/access/person.js";
-import { inTurn } from "./flows/call.js";
 const [ext, root] = ((self) => [self.slice(self.lastIndexOf('.')), fileURLToPath(new URL(self.endsWith('.ts') ? '..' : '../..', self))])(import.meta.url);
 const lock = lockAt(root);
 const surface = surfaceOf(lock);
@@ -34,8 +34,9 @@ const runs = valueOf(lock, 'runs');
 Object.assign(words, Object.fromEntries(['read', 'view', 'sign', 'land', 'key', 'signer', 'pin', 'topos', 'standing', 'evidence', 'act', 'profile', 'receipts', 'refusal'].map((w) => [w, valueOf(lock, `bound/${w}`)])));
 Object.assign(limits, { wait: Number(valueOf(lock, 'bound/wait').split('..')[1]), most: Number(valueOf(lock, 'bound/printed').split('..')[1]) });
 Object.assign(warmth, { spares: Number(valueOf(lock, 'bound/spares').split('..')[1]), boot: valueOf(lock, 'bound/spare-env').split('|') });
-/** One call at a time, with bound started ahead for it and nothing of it kept once it is answered. */
-const turn = (act) => inTurn('', () => { void warm(runs); return act().finally(cooled); });
+/** One call at a time, each after the one before it and never on a timer, so one asked while another lands sees its receipt; bound started ahead for it, and nothing of it kept once it is answered. */
+let last = Promise.resolve();
+const turn = (act) => ((next) => { last = next.catch(() => undefined); return next; })(last.then(() => { void warm(runs); return act().finally(cooled); }));
 const offered = (n) => (n ? { listChanged: false } : undefined);
 const server = new Server({ name: surface.name, version: surface.version }, { capabilities: { tools: offered(surface.tools.length), resources: offered(surface.resources.length), prompts: offered(surface.prompts.length) } });
 /** The person, asked as the client lets head ask; every wait on them is counted, so a time ceiling measures head's work and never the person's. */
@@ -58,19 +59,21 @@ const device = (role) => devices.get(role) ?? ((secret) => (secret === undefined
 const asRoot = (account) => ((device, key) => [key, device.signer, { BOUND_SIGNERS: registryFor(device.signer, service, account, key, valueOf(lock, 'founding/algorithm'), store) }])(deviceOf(lock), valueOf(lock, 'founding/root').split('/')[1]);
 /** What a call is answered with, one call at a time as when bound blocked head: every bound process it starts is stopped when the client cancels it, and a call cancelled while it waits its turn is never begun. */
 const contextOf = (signal) => {
-    /** One call's folds of a place, kept until something lands in it or is laid there; and the places its root acted in, whose receipts close once, when the call ends. */
-    const [folds, touched] = [new Map(), new Set()], forget = (place) => { for (const k of [...folds.keys()])
+    /** One call's folds of a place, kept until something lands in it or is laid there; the places its root acted in, whose receipts close once, when the call ends; and those where anything but a read's receipts landed, as bound printed it. */
+    const [folds, touched, moved] = [new Map(), new Set(), new Set()], forget = (place) => { for (const k of [...folds.keys()])
         if (k.endsWith(`\0${place}`))
             folds.delete(k); };
+    const read = (at) => at?.startsWith(`${valueOf(lock, 'receipt/at')}:`) === true;
     const once = (key, place, fold) => (folds.get(`${key}\0${place}`) ?? ((p) => (folds.set(`${key}\0${place}`, p), p))(fold()));
-    const acted = (place, root, done) => done.finally(() => { forget(place); if (root)
+    const acted = (place, root, done) => done.then((got) => { if ('lines' in got && !got.lines.every((l) => ((f) => f.kind === 'fact' && read(f.value.fields['at']))(parse(l))))
+        moved.add(place); return got; }).finally(() => { forget(place); if (root)
         touched.add(place); });
     const signRoot = (place, lot, account) => sign(runs, place, lot, ...asRoot(account), signal);
     const signAs = (place, lot, role, lines) => ((one, id) => sign(runs, place, lot, id, one.signer, { BOUND_SIGNERS: registryFor(one.signer, service, one.account, id, algorithmOf(lines), store) }, signal))(deviceOf(lock, role), idIn(lines, device(role)) ?? deviceOf(lock, role).account);
     return {
         lock,
         bound: (cwd, args) => run(runs, cwd, args, {}, signal),
-        standing: (place) => once('standing', place, () => standingAt(runs, place, (lines) => ['head', 'person'].flatMap((role) => ((id) => (id === undefined ? [] : [id]))(idIn(lines, device(role)))), (line) => line.at?.startsWith(`${valueOf(lock, 'receipt/at')}:`) === true, signal)),
+        standing: (place) => once('standing', place, () => standingAt(runs, place, (lines) => ['head', 'person'].flatMap((role) => ((id) => (id === undefined ? [] : [id]))(idIn(lines, device(role)))), (line) => read(line.at), signal)),
         policy: (place) => once('policy', place, () => policyAt(runs, place, signal)),
         world: (place, view) => once(`world/${view}`, place, () => settledView(runs, place, view, signal)),
         adapter: async (origin) => ((name) => (!/^[a-z-]+$/.test(name) ? undefined : import(__rewriteRelativeImportExtension(new URL(`./ports/adapters/${name}${ext}`, import.meta.url).href))))(URL.canParse(origin) ? valueOf(lock, `adapter/${new URL(origin).protocol.slice(0, -1)}`) : ''),
@@ -80,6 +83,7 @@ const contextOf = (signal) => {
         found: (place, account) => acted(place, true, founded(runs, place, ...asRoot(account), signal)),
         signRoot,
         landRoot: (place, lot, account) => acted(place, true, landAct(runs, place, lot, ...asRoot(account), signal)),
+        moved: (place) => moved.has(place),
         settle: async () => { const red = []; for (const place of touched) {
             const why = await closing(runs, place, signal);
             if (why !== undefined)
@@ -93,9 +97,10 @@ const contextOf = (signal) => {
         landAs: (place, lot, role, lines) => acted(place, false, ((one, id) => landAct(runs, place, lot, id, one.signer, { BOUND_SIGNERS: registryFor(one.signer, service, one.account, id, algorithmOf(lines), store) }, signal))(deviceOf(lock, role), idIn(lines, device(role)) ?? deviceOf(lock, role).account)),
         land: (place, signed) => acted(place, true, land(runs, place, signed, signal)),
         told: (place, signed) => told(runs, place, signed, words.standing, signal),
-        elicit: (message) => person.consent(message, valueOf(lock, 'said/elicit/yes')),
+        elicit: (message) => person.consent(message, aboutOf(lock, 'said/elicit/yes')),
         now: () => Date.now(),
         machine: () => Date.now() - waited,
+        begun: Date.now() - waited,
         keys,
         device,
         roots: async () => (server.getClientCapabilities()?.roots ? (await server.listRoots()).roots.flatMap((root) => folderOf(root.uri) ?? []) : []),

package/dist/src/onboard/first.d.ts

@@ -1,7 +1,9 @@
 import { type Asked, type Context } from '../core/answer.ts';
 /**
- * The first source a person connects with no place named and none to read from: their place is founded in the folder
- * the lock names under their own home, and the source connected to it, on one yes for both. A folder that already holds
- * a place is used as it stands, never founded again, and its connect asks its own yes.
+ * The first source a person connects with no place named and none to read from, on one yes that says all it grants:
+ * their place founded in the folder the lock names under their own home, the source connected to it, and reads of it
+ * granted until the access period ends. A document that does not arrive is no refusal: the place is founded owing it
+ * by its address. Either way the question asked comes back as what to ask next. A folder that already holds a place is
+ * used as it stands, never founded again, and its connect asks its own yes.
  */
 export declare const firstRun: (asked: Asked, context: Context, then: (place: string, covered: boolean) => Promise<readonly string[]>) => Promise<readonly string[]>;

package/dist/src/onboard/first.js

@@ -1,21 +1,38 @@
 import { basename, join } from 'node:path';
-import { LOCK } from '@lapxo/topos/wire';
+import { canonical, LOCK } from '@lapxo/topos/wire';
 import { unless } from "../core/answer.js";
+import { untilOf } from "../core/act.js";
 import { valueOf } from "../core/lock.js";
 import { sayIn } from "../core/surface.js";
+import { rootIn } from "../flows/device.js";
 import { bornAt } from "../places/found.js";
+import { attachedFor } from "../sources/access.js";
 /**
- * The first source a person connects with no place named and none to read from: their place is founded in the folder
- * the lock names under their own home, and the source connected to it, on one yes for both. A folder that already holds
- * a place is used as it stands, never founded again, and its connect asks its own yes.
+ * The first source a person connects with no place named and none to read from, on one yes that says all it grants:
+ * their place founded in the folder the lock names under their own home, the source connected to it, and reads of it
+ * granted until the access period ends. A document that does not arrive is no refusal: the place is founded owing it
+ * by its address. Either way the question asked comes back as what to ask next. A folder that already holds a place is
+ * used as it stands, never founded again, and its connect asks its own yes.
  */
 export const firstRun = async (asked, context, then) => {
-    const say = sayIn(context.lock), dir = join(context.personal(), valueOf(context.lock, 'first-run/folder')), name = basename(dir);
+    const say = sayIn(context.lock), word = (k) => valueOf(context.lock, k), dir = join(context.personal(), word('first-run/folder')), name = basename(dir);
     if (context.files.has(dir, LOCK))
         return then(dir, false);
-    const refused = await unless(context, say('elicit-first-run', { dir, source: asked['source'] ?? '', document: asked['document'] ?? '' }));
+    const [source, document, until] = [(asked['source'] ?? '').toLowerCase().replace(/[^a-z0-9-]+/g, '-'), asked['document'] ?? '', untilOf(word('access/period'), context.now())];
+    const refused = await unless(context, say('elicit-first-run', { dir, source, document, until }));
     if (refused)
         return refused;
-    const born = await bornAt(context, dir, name);
-    return born[0] === say('born', { name, dir }) ? [...born, ...(await then(dir, true))] : born;
+    const born = await bornAt(context, dir, name), root = rootIn(context, dir);
+    if (born[0] !== say('born', { name, dir }) || 'said' in root)
+        return 'said' in root ? [...born, ...root.said] : born;
+    const connected = await then(dir, true), unread = connected.some((l) => l.startsWith('said/head/document-unread ')), held = unread ? undefined : await context.policy(dir);
+    if (held !== undefined && ('refused' in held || !held.lines.some((l) => l.scope === `uses/${source}`)))
+        return [...born, ...connected];
+    const line = (scope, measure, value, role = 'writes') => canonical({ at: 'policy:head/first-run', by: 'target', form: 'alphabet', measure, role, scope, value });
+    const owed = unread ? [line(`${word('place/needs')}/bytes/${source}`, 'id', document, 'demands')] : [];
+    const landed = await context.landRoot(dir, [line(word('grant/family'), 'sources', source), line(word('grant/family'), 'until', until), ...owed], root.account);
+    if ('refused' in landed)
+        return [...born, ...connected, say('not-landed', { why: landed.refused })];
+    const access = unread ? undefined : await attachedFor(context, dir, source);
+    return [...born, ...(unread ? [] : connected), ...landed.lines, ...(access !== undefined && 'said' in access ? access.said : []), say(unread ? 'bytes-owed' : 'ready', { source, place: dir, document, operation: asked['operation'], args: asked['args'] })];
 };

package/dist/src/onboard/owed.d.ts

@@ -0,0 +1,10 @@
+import { type Asked, type Context } from '../core/answer.ts';
+/**
+ * What a place founded on a first connect still owes: its source's document, by the address the person gave. Asked again,
+ * it is read there; once it arrives, the source is connected from those bytes and pinned by their digest, the demand is
+ * withdrawn and the question is answered. Until then it is not: what is owed is said, and nothing else is asked.
+ */
+export declare const paidIn: (asked: Asked, context: Context, place: string) => Promise<{
+    readonly said: readonly string[];
+    readonly answer: boolean;
+}>;

package/dist/src/onboard/owed.js

@@ -0,0 +1,28 @@
+import { canonical } from '@lapxo/topos/wire';
+import { standingOr } from "../core/answer.js";
+import { valueOf } from "../core/lock.js";
+import { sayIn } from "../core/surface.js";
+import { rootIn } from "../flows/device.js";
+import { laidIn } from "../sources/connect.js";
+/**
+ * What a place founded on a first connect still owes: its source's document, by the address the person gave. Asked again,
+ * it is read there; once it arrives, the source is connected from those bytes and pinned by their digest, the demand is
+ * withdrawn and the question is answered. Until then it is not: what is owed is said, and nothing else is asked.
+ */
+export const paidIn = async (asked, context, place) => {
+    const say = sayIn(context.lock), word = (k) => valueOf(context.lock, k), source = asked['source'] ?? '';
+    const held = await standingOr(context, place), scope = `${word('place/needs')}/bytes/${source}`;
+    const owed = 'said' in held ? undefined : held.lines.find((l) => l.scope === scope && l.role === 'demands' && l.value !== 'withdraw');
+    if (owed === undefined)
+        return { said: [], answer: true };
+    const document = owed.value ?? '', read = await context.files.read.documentOf(context, place, document), root = rootIn(context, place);
+    if ('said' in root)
+        return { said: root.said, answer: false };
+    if (read === undefined)
+        return { said: [say('bytes-owed', { source, place, document })], answer: false };
+    const laid = await laidIn(context, place, root.account)(source, document, read, undefined, context.machine());
+    if (!laid.connected)
+        return { said: laid.said, answer: false };
+    const landed = await context.landRoot(place, [canonical({ ...Object.fromEntries(Object.entries(owed).filter(([k]) => !['sig', 'epoch'].includes(k))), by: 'target', value: 'withdraw' })], root.account);
+    return 'refused' in landed ? { said: [...laid.said, say('not-landed', { why: landed.refused })], answer: false } : { said: [...laid.said, ...landed.lines], answer: true };
+};

package/dist/src/onboard/site.d.ts

@@ -0,0 +1,12 @@
+import type { Asked, Context } from '../core/answer.ts';
+/**
+ * What a person names as a source's document, made a document head can read, before anything is founded or connected:
+ * an address or a file is as given; a site alone is looked for where it says its documents are (its API catalog) and at
+ * the paths the lock names, the first that reads taken; a folder, at the same names inside it. A source the person names
+ * none for is named after the site or the folder. A site where nothing reads is said, with what was tried.
+ */
+export declare const resolved: (asked: Asked, context: Context) => Promise<{
+    readonly asked: Asked;
+} | {
+    readonly said: readonly string[];
+}>;

package/dist/src/onboard/site.js

@@ -0,0 +1,22 @@
+import { basename, dirname, join } from 'node:path';
+import { EXTENSION } from '@lapxo/topos/wire';
+import { members, valueOf } from "../core/lock.js";
+import { sayIn } from "../core/surface.js";
+/**
+ * What a person names as a source's document, made a document head can read, before anything is founded or connected:
+ * an address or a file is as given; a site alone is looked for where it says its documents are (its API catalog) and at
+ * the paths the lock names, the first that reads taken; a folder, at the same names inside it. A source the person names
+ * none for is named after the site or the folder. A site where nothing reads is said, with what was tried.
+ */
+export const resolved = async (asked, context) => {
+    const [at, word] = [asked['document'] ?? '', (k) => valueOf(context.lock, k)], named = (name) => asked['source'] || name.toLowerCase().replace(/[^a-z0-9-]+/g, '-');
+    if (/^([a-z]+:\/\/)?[^/\s]+\.[^/\s]+\/?$/.test(at) && URL.canParse(/^[a-z]+:\/\//.test(at) ? at : `${word('use/scheme')}//${at}`)) {
+        const site = new URL(/^[a-z]+:\/\//.test(at) ? at : `${word('use/scheme')}//${at}`), tried = await context.files.read.describedAt(context, site.origin);
+        for (const document of tried)
+            if (((read) => read !== undefined && `.${read.kind}` !== EXTENSION)(await context.files.read.documentOf(context, '', document)))
+                return { asked: { ...asked, document, source: named(site.hostname) } };
+        return { said: [sayIn(context.lock)('use-none', { origin: site.origin, tried: tried.join(', ') || '—' })] };
+    }
+    const inside = at.startsWith('/') && context.files.list(dirname(at), basename(at)).length ? members(word('use/documents')).map((p) => basename(p)).find((n) => context.files.has(at, n)) : undefined;
+    return { asked: inside === undefined ? asked : { ...asked, document: join(at, inside), source: named(basename(at)) } };
+};

package/dist/src/ports/surface.d.ts

@@ -28,10 +28,14 @@ export interface Surface {
     readonly name: string;
     readonly version: string;
     readonly tools: readonly Tool[];
+    readonly catalogue: readonly Tool[];
     readonly resources: readonly Resource[];
     readonly prompts: readonly Prompt[];
 }
-/** Everything a client is offered, read off the lock alone: its tools, resources and prompts, each with the words a model sees. */
+/**
+ * Everything a client is offered, read off the lock alone, each with the words a model sees: the tools surface/tools
+ * names, out of the catalogue the tool lines are (every one of them where it names none), its resources and prompts.
+ */
 export declare const surfaceOf: (lock: readonly Said[]) => Surface;
 export declare const refusedOn: (lock: readonly Said[], platform: string) => string | undefined;
 /**

package/dist/src/ports/surface.js

@@ -4,13 +4,15 @@ const nameOf = (line) => line.scope.split('/')[1];
 const fieldsOf = (lock, scope) => ((required) => members(valueOf(lock, scope)).map((name) => ({
     name, about: aboutOf(lock, `${scope}/${name}`), type: valueOf(lock, `${scope}/${name}`), required: required.includes(name)
 })))(members(valueOf(lock, `${scope}/required`)));
-/** Everything a client is offered, read off the lock alone: its tools, resources and prompts, each with the words a model sees. */
-export const surfaceOf = (lock) => ({
-    name: valueOf(lock, 'name'), version: valueOf(lock, 'version'),
-    tools: below(lock, 'tool').map((line) => ({ name: nameOf(line), about: line.about ?? '', fields: fieldsOf(lock, line.scope), hints: members(valueOf(lock, `${line.scope}/hints`)) })),
+/**
+ * Everything a client is offered, read off the lock alone, each with the words a model sees: the tools surface/tools
+ * names, out of the catalogue the tool lines are (every one of them where it names none), its resources and prompts.
+ */
+export const surfaceOf = (lock) => ((catalogue, offered) => ({
+    name: valueOf(lock, 'name'), version: valueOf(lock, 'version'), catalogue, tools: offered.length ? catalogue.filter((t) => offered.includes(t.name)) : catalogue,
     resources: below(lock, 'resource').map((line) => ({ name: nameOf(line), about: line.about ?? '', template: line.value ?? '', mime: valueOf(lock, `${line.scope}/mime`) })),
     prompts: below(lock, 'prompt').map((line) => ({ name: nameOf(line), about: line.about ?? '', text: aboutOf(lock, `${line.scope}/text`), line: aboutOf(lock, `${line.scope}/line`), fields: fieldsOf(lock, line.scope) })),
-});
+}))(below(lock, 'tool').map((line) => ({ name: nameOf(line), about: line.about ?? '', fields: fieldsOf(lock, line.scope), hints: members(valueOf(lock, `${line.scope}/hints`)) })), members(valueOf(lock, 'surface/tools')));
 export const refusedOn = (lock, platform) => ((supported) => (supported.includes(platform) ? undefined : sayIn(lock)('platform', { platform, supported: supported.join('|') })))(members(valueOf(lock, 'platform/supported')));
 /**
  * The fields a URI gives a resource template, or none when it is not one of its URIs: {name} matches one path step,

package/dist/src/sources/connect.d.ts

@@ -1,4 +1,5 @@
 import type { Asked, Context } from '../core/answer.ts';
+import type { Read } from '../ports/documents.ts';
 /**
  * A source connected to a place, once the person said yes; a lock is no source, and adopting one as a parent is refused
  * by name, since composing two places' policies is bound's. A document — and an overlay beside it — is laid whatever its
@@ -11,3 +12,10 @@ import type { Asked, Context } from '../core/answer.ts';
  * compiled. Nothing the sharing place was granted comes with it: access is asked here, issuer by issuer.
  */
 export declare const connected: (asked: Asked, context: Context, covered?: boolean) => Promise<readonly string[]>;
+type Connection = {
+    readonly said: readonly string[];
+    readonly connected: boolean;
+};
+type Laid = (source: string, document: string, doc: Read, overlay: Read | undefined, started: number) => Promise<Connection>;
+export declare const laidIn: (context: Context, place: string, account: string) => Laid;
+export {};

package/dist/src/sources/connect.js

@@ -1,17 +1,15 @@
-import { join } from 'node:path';
-import { canonical, EXTENSION, LOCK } from '@lapxo/topos/wire';
+import { canonical, EXTENSION } from '@lapxo/topos/wire';
 import { inPlace, placeOf, unless } from "../core/answer.js";
 import { valueOf } from "../core/lock.js";
 import { fieldsOf, vocabOf } from "../core/read.js";
-import { fill, redIn, sayIn } from "../core/surface.js";
+import { redIn, sayIn } from "../core/surface.js";
 import { digestIn, linesOf } from "../core/worlds.js";
 import { coveredIn, owedIn, unpacked } from "../core/package.js";
 import { paidBy, pinIn } from "../compile/pin.js";
 import { adopted } from "../adopt/adopt.js";
 import { firstRun } from "../onboard/first.js";
+import { resolved } from "../onboard/site.js";
 import { rootIn } from "../flows/device.js";
-import { bornAt } from "../places/found.js";
-import { untilOf } from "../core/act.js";
 import { attachedFor } from "./access.js";
 /**
  * A source connected to a place, once the person said yes; a lock is no source, and adopting one as a parent is refused
@@ -24,8 +22,9 @@ import { attachedFor } from "./access.js";
  * its pins rest in, its pin held to the package's; one that differs is refused by name, and the place holds what it
  * compiled. Nothing the sharing place was granted comes with it: access is asked here, issuer by issuer.
  */
-export const connected = async (asked, context, covered = false) => (asked['source'] && !(await placeOf(asked, context)) ? firstRun(asked, context, (dir, covered) => connected({ ...asked, place: dir }, context, covered))
-    : !asked['source'] && /^([a-z]+:\/\/)?[^/\s]+\/?$/.test(asked['document'] ?? '') ? used(asked, context) : ((started) => inPlace(asked, context, async (place) => {
+export const connected = async (asked, context, covered = false) => ((got) => ('said' in got ? got.said : connectedAs(got.asked, context, covered)))(await resolved(asked, context));
+const connectedAs = async (asked, context, covered = false) => (asked['source'] && !(await placeOf(asked, context)) ? firstRun(asked, context, (dir, covered) => connected({ ...asked, place: dir }, context, covered))
+    : ((started) => inPlace(asked, context, async (place) => {
         const say = sayIn(context.lock), digest = digestIn(context.lock), { documentOf, fetchedAs, kindOf } = context.files.read;
         const [source, document] = [(asked['source'] ?? '').toLowerCase().replace(/[^a-z0-9-]+/g, '-'), asked['document'] ?? ''];
         const [via, named, accept, lock] = [asked['via'] ?? '', asked['digest'] ?? '', /^[\w.+-]+\/[\w.+-]+$/.test(asked['accept'] ?? '') ? asked['accept'] : undefined, `.${kindOf(document)}` === EXTENSION];
@@ -54,38 +53,8 @@ export const connected = async (asked, context, covered = false) => (asked['sour
             return [say('document-unread', { document })];
         if (named && digest(read.bytes) !== named)
             return [say('document-digest', { document, digest: named, got: digest(read.bytes) })];
-        return `.${read.kind}` === EXTENSION ? [say('parent-lock', { place, parent: source })] : laidIn(context, place, root.account)(source, document, read, overlay, started);
+        return `.${read.kind}` === EXTENSION ? [say('parent-lock', { place, parent: source })] : (await laidIn(context, place, root.account)(source, document, read, overlay, started)).said;
     }))(context.machine()));
-const used = async (asked, context) => {
-    const [say, word, until] = [sayIn(context.lock), (k) => valueOf(context.lock, k), untilOf(valueOf(context.lock, 'access/period'), context.now())], at = /^[a-z]+:\/\//.test(asked['document'] ?? '') ? asked['document'] : `${word('use/scheme')}//${asked['document'] ?? ''}`;
-    if (!URL.canParse(at))
-        return [say('document-unread', { document: asked['document'] ?? '' })];
-    const [origin, source] = [new URL(at).origin, new URL(at).hostname.replace(/[^a-z0-9-]+/g, '-')], dir = join(fill(word('use/folder'), { home: context.home() }), source);
-    if (context.files.has(dir, LOCK))
-        return [say('use-held', { origin, dir })];
-    const refused = await unless(context, say('elicit-use', { origin, dir, until }));
-    if (refused)
-        return refused;
-    const born = await bornAt(context, dir, source), root = rootIn(context, dir), tried = [];
-    if (born[0] !== say('born', { name: source, dir }) || 'said' in root)
-        return 'said' in root ? [...born, ...root.said] : born;
-    for (const document of await context.files.read.describedAt(context, origin)) {
-        const read = await context.files.read.documentOf(context, dir, document);
-        if (read === undefined || `.${read.kind}` === EXTENSION) {
-            tried.push(document);
-            continue;
-        }
-        const said = await laidIn(context, dir, root.account)(source, document, read, undefined, context.machine()), held = await context.policy(dir);
-        if ('refused' in held || !held.lines.some((l) => l.scope === `uses/${source}`)) {
-            tried.push(document);
-            continue;
-        }
-        const line = (scope, measure, value, form = 'alphabet') => canonical({ at: 'policy:head/use', by: 'target', form, measure, role: 'writes', scope, value });
-        const landed = await context.landRoot(dir, [line(`${word('allow/family')}/${source}`, 'calls', '0..0', 'interval'), line(word('grant/family'), 'sources', source), line(word('grant/family'), 'until', until)], root.account);
-        return [say('used', { origin, dir, source, until }), ...said, ...('refused' in landed ? [say('not-landed', { why: landed.refused })] : landed.lines)];
-    }
-    return [...born, say('use-none', { origin, tried: tried.join(', ') || '—' })];
-};
 const received = async (context, place, document, bytes, named, laid, account) => {
     const [say, got] = [sayIn(context.lock), unpacked(context, document, bytes, await context.files.read.besideOf(context, document, linesOf(bytes)))];
     if (!got.sources)
@@ -95,20 +64,20 @@ const received = async (context, place, document, bytes, named, laid, account) =
     if (refused)
         return refused;
     for (const s of got.sources)
-        said.push(...(await laid(s.source, s.document.at, s.document, s.overlay, context.machine())));
+        said.push(...(await laid(s.source, s.document.at, s.document, s.overlay, context.machine())).said);
     const held = await context.policy(place), [pinOf, owed] = [(source) => ('refused' in held ? '' : held.lines.find((l) => l.scope === `uses/${source}`)?.value ?? ''), owedIn(context, 'refused' in held ? [] : held.lines, got.sources, got.open ?? [], named)];
     const [off, landed] = [got.sources.filter((s) => pinOf(s.source) !== s.pin), owed.length ? await context.landRoot(place, owed, account) : undefined];
     return [...said, ...(off.length ? off.map((s) => say('package-pin', { source: s.source, pin: s.pin, got: pinOf(s.source) || 'none' })) : names ? [say('received', { place, package: named, sources: names })] : []),
         ...(got.open ?? []).map((o) => say('received-open', { source: o.source, waits: o.waits })), ...(landed && 'refused' in landed ? [say('not-landed', { why: landed.refused })] : [])];
 };
-const laidIn = (context, place, account) => (source, document, doc, overlay, started) => (async () => {
+export const laidIn = (context, place, account) => (source, document, doc, overlay, started) => (async () => {
     const say = sayIn(context.lock), v = vocabOf(context.lock), word = (k) => valueOf(context.lock, k), digest = digestIn(context.lock);
     const lands = (lot) => context.landRoot(place, lot, account);
     const line = (scope, measure, value, more = {}) => canonical({ at: 'policy:head/connect', by: 'target', form: 'alphabet', measure, role: 'writes', scope, value, ...more });
     const pin = pinIn(context, place, lands, line);
     const worlds = await adopted(context, place, lands, line);
     if ('refused' in worlds)
-        return [say('not-landed', { why: worlds.refused })];
+        return { said: [say('not-landed', { why: worlds.refused })], connected: false };
     const laid = [[`${word('place/connected')}/${source}.${doc.kind}`, doc.bytes], ...(overlay ? [[`${word('place/connected')}/${source}.overlay.${overlay.kind}`, overlay.bytes]] : [])];
     for (const [at, bytes] of laid)
         context.files.lay(place, at, bytes);
@@ -117,14 +86,14 @@ const laidIn = (context, place, account) => (source, document, doc, overlay, sta
         if (pinned.open || pinned.dropped)
             for (const [at] of laid)
                 context.files.drop(place, at);
-        return pinned.open ? [say('no-world', { kind: doc.kind, document }), line(`${word('place/needs')}/${doc.kind}`, 'id', valueOf(context.lock, 'birth/view/place'), { role: 'demands' })] : pinned.said;
+        return { said: pinned.open ? [say('no-world', { kind: doc.kind, document }), line(`${word('place/needs')}/${doc.kind}`, 'id', valueOf(context.lock, 'birth/view/place'), { role: 'demands' })] : pinned.said, connected: false };
     }
     const declared = fieldsOf(pinned.lines, `${v.region}/${source}`)[v.origins] ?? [], fetched = URL.canParse(document) && !declared.some((o) => URL.canParse(o)) && ((held) => 'lines' in held && !held.lines.some((l) => l.scope === `${v.pick}/${source}`))(await context.policy(place));
     const picked = fetched ? await lands([line(`${v.pick}/${source}`, 'id', new URL(declared[0] ?? '/', document).href.replace(/\/$/, ''))]) : undefined;
     const [owed, paid] = [pinned.lines.filter((l) => l.measure === v.unresolved).map((l) => l.value ?? ''), await paidBy(context, place, pin, laid[0][0])];
     const classes = pinned.lines.filter((l) => l.measure === v.class && l.scope?.startsWith(`${v.offers}/${source}/`) && l.scope.split('/').length === 3);
-    return [say('connected', { source, place, offers: String(classes.length), reads: String(classes.filter((l) => l.value === v.callable).length), pin: pinned.pin }),
-        ...(owed.length ? [say('unresolved', { source, refs: owed.join(', ') })] : []), ...paid.flatMap((p) => ('said' in p.pinned ? p.pinned.said : [say('resolved', { source: p.source, by: source, pin: p.pinned.pin })])),
-        ...pinned.lines.filter((l) => l.scope === `${v.region}/${source}` || (l.scope?.startsWith(`${v.keys}/${source}/`) && l.measure === v.scheme)).map((l) => canonical(l)),
-        ...(picked === undefined ? [] : 'refused' in picked ? [say('not-landed', { why: picked.refused })] : picked.lines)];
-})().then((lines) => [...lines, ...redIn(context.lock)('connect/seconds', `connect/${source}`, started, context.machine())]);
+    return { connected: picked === undefined || !('refused' in picked), said: [say('connected', { source, place, offers: String(classes.length), reads: String(classes.filter((l) => l.value === v.callable).length), pin: pinned.pin }),
+            ...(owed.length ? [say('unresolved', { source, refs: owed.join(', ') })] : []), ...paid.flatMap((p) => ('said' in p.pinned ? p.pinned.said : [say('resolved', { source: p.source, by: source, pin: p.pinned.pin })])),
+            ...pinned.lines.filter((l) => l.scope === `${v.region}/${source}` || (l.scope?.startsWith(`${v.keys}/${source}/`) && l.measure === v.scheme)).map((l) => canonical(l)),
+            ...(picked === undefined ? [] : 'refused' in picked ? [say('not-landed', { why: picked.refused })] : picked.lines)] };
+})().then((result) => ({ ...result, said: [...result.said, ...redIn(context.lock)('connect/seconds', `connect/${source}`, started, context.machine())] }));

package/dist/src/sources/refused.d.ts

@@ -0,0 +1,7 @@
+import { type Context } from '../core/answer.ts';
+import { type Said } from '../core/lock.ts';
+import type { Call } from '../core/read.ts';
+/** A read refused with the access head attached: its secret kept marked spent, never in a line, so the next call obtains it once; the refusal lands as a receipt without it. */
+export declare const refusedAccess: (context: Context, place: string, lines: readonly Said[], plan: Call, operation: string) => Promise<readonly string[]>;
+/** The access a place was refused and has not obtained since, by its newest receipt: what its card shows as open. */
+export declare const pendingIn: (context: Context, place: string) => Promise<readonly string[]>;

package/dist/src/sources/refused.js

@@ -0,0 +1,16 @@
+import { canonical } from '@lapxo/topos/wire';
+import { standingOr } from "../core/answer.js";
+import { valueOf } from "../core/lock.js";
+import { sayIn } from "../core/surface.js";
+import { opened, sealed } from "../access/obtain.js";
+/** A read refused with the access head attached: its secret kept marked spent, never in a line, so the next call obtains it once; the refusal lands as a receipt without it. */
+export const refusedAccess = async (context, place, lines, plan, operation) => {
+    const [account, word] = [plan.access.account ?? '', (k) => valueOf(context.lock, k)], kept = opened(context.keys.read(account));
+    if (kept !== undefined)
+        context.keys.write(account, sealed({ ...kept, expires: 0 }));
+    const landed = await context.landAs(place, [canonical({ at: `${word('receipt/at')}:${new Date(context.now()).toISOString()}`, by: 'target', form: 'alphabet', measure: 'status', role: 'writes', scope: `${word('access/family')}/${plan.access.flow}/refused`, value: 'present' })], 'head', lines);
+    return [sayIn(context.lock)('access-refused', { source: plan.source, operation, place }), ...('lines' in landed ? landed.lines : [])];
+};
+/** The access a place was refused and has not obtained since, by its newest receipt: what its card shows as open. */
+export const pendingIn = async (context, place) => ((held, family) => [...new Map(('said' in held ? [] : held.lines).filter((l) => l.scope?.startsWith(family) && /\/(refused|obtained|renewed|entered)$/.test(l.scope)).sort((a, b) => ((a.at ?? '') < (b.at ?? '') ? -1 : 1))
+        .map((l) => [l.scope.slice(family.length).replace(/\/[^/]+$/, ''), l.scope.endsWith('/refused')]))].filter(([, refused]) => refused).map(([flow]) => sayIn(context.lock)('access-pending', { source: flow.split('/')[0], flow, place })))(await standingOr(context, place), `${valueOf(context.lock, 'access/family')}/`);

package/dist/src/tools/ask.d.ts

@@ -0,0 +1 @@
+export { asked as answer } from '../verbs/ask.ts';