@lapxo/head 0.1.5 → 0.1.7

package/dist/src/doors/head.js

@@ -0,0 +1,136 @@
+var __rewriteRelativeImportExtension = (this && this.__rewriteRelativeImportExtension) || function (path, preserveJsx) {
+    if (typeof path === "string" && /^\.\.?\//.test(path)) {
+        return path.replace(/\.(tsx)$|((?:\.d)?)((?:\.[^./]+?)?)\.([cm]?)ts$/i, function (m, tsx, d, ext, cm) {
+            return tsx ? preserveJsx ? ".jsx" : ".js" : d && (!ext || !cm) ? m : (d + ext + "." + cm.toLowerCase() + "js");
+        });
+    }
+    return path;
+};
+import { basename, join } from 'node:path';
+import { answerOf, placeOf } from "../core/answer.js";
+import { LOCK, parse } from '@lapxo/topos/wire';
+import { aboutOf, members, valueOf } from "../core/lock.js";
+import { sayIn } from "../core/surface.js";
+import { matchTemplate, refusedOn, shapeOf, surfaceOf } from "../ports/surface.js";
+import { birth, closing, founded, land, landAct, limits, pinnedAt, policyAt, run, settledView, sign, standingAt, told, words } from "../ports/bound.js";
+import { configureHost } from "../ports/host.js";
+import { held, keep } from "../ports/cache.js";
+import { dropAt, hasAt, layAt, listAt, takeAt } from "../ports/place.js";
+import * as documents from "../ports/documents.js";
+import { keychain, portOf } from "../ports/keychain.js";
+import { deviceOf, idIn, signingOf } from "../core/device.js";
+import { personOf } from "../ports/access/person.js";
+import { readAhead } from "../ahead/read.js";
+import { cardAt } from "../verbs/card.js";
+import { digestOf, guardOf, refusalsOf } from "./guard.js";
+export const askedOf = (raw) => Object.fromEntries(Object.entries(raw ?? {}).map(([k, v]) => [k, v === undefined ? undefined : typeof v === 'object' ? JSON.stringify(v) : String(v)]));
+/** head behind a door: its lock read, every call answered one at a time and each answer's next read ahead, the same for every door. */
+export const headOf = (lock, root, ext, door) => {
+    const surface = surfaceOf(lock), runs = valueOf(lock, 'runs'), refused = refusedOn(lock, process.platform);
+    Object.assign(words, Object.fromEntries(['read', 'view', 'sign', 'land', 'key', 'signer', 'pin', 'topos', 'standing', 'evidence', 'act', 'profile', 'receipts', 'refusal', 'identity'].map((w) => [w, valueOf(lock, `bound/${w}`)])));
+    Object.assign(limits, { wait: Number(valueOf(lock, 'bound/wait').split('..')[1]), most: Number(valueOf(lock, 'bound/printed').split('..')[1]) });
+    Object.assign(birth, { at: valueOf(lock, 'founding/person-at'), file: valueOf(lock, 'founding/birth-file') });
+    configureHost(lock, limits);
+    /** One call at a time, each after the one before it and never on a timer, so one asked while another lands sees its receipt; a place's reads go to its fold host, which outlives the call and never holds a signer. */
+    let [last, ahead] = [Promise.resolve(), new AbortController()];
+    const turn = (act) => ((next) => { last = next.catch(() => undefined); return next; })(last.then(act));
+    /** What head refuses through this door, written as every door writes it; a door that reaches for a signing key is one such refusal, named by the lock's line for that key and never by what the door asked. */
+    const [refusals, keyRefused] = [refusalsOf(lock, { write: (place, lot) => write(place, lot), now: () => Date.now() }, door.name), shapeOf([sayIn(lock)('signing-key-refused', {})]).cells[0].code];
+    for (const end of ['SIGTERM', 'SIGINT'])
+        process.once(end, () => void last.then(refusals.settle).finally(() => process.exit(0)));
+    /** The person, asked as the client lets head ask; every wait on them is counted, so a time ceiling measures head's work and never the person's. */
+    let waited = 0;
+    const timed = (ask) => async (...args) => { const t = Date.now(); try {
+        return await ask(...args);
+    }
+    finally {
+        waited += Date.now() - t;
+    } };
+    const asked = personOf(lock, door);
+    const person = { consent: timed(asked.consent), enter: timed(asked.enter), choose: timed(asked.choose), visit: timed(asked.visit) };
+    /** head is its home: the folder of its index of places, and the keychain service its keys live under, one per home, so two heads on one keychain never share a key. A place's root is told to bound by the key id its lock names, its secret kept there under the place's account. */
+    const home = process.env[valueOf(lock, 'home/env')] || join(process.env[valueOf(lock, `platform/${process.platform}/home`)] ?? '', valueOf(lock, 'home/folder'));
+    const service = `${deviceOf(lock).service}/${basename(home).replace(/[^\w.-]+/g, '-')}`;
+    const store = valueOf(lock, `platform/${process.platform}/store`);
+    const keys = keychain(service, store, signingOf(lock));
+    const devices = new Map();
+    const device = (role) => devices.get(role) ?? ((key) => (key === undefined ? undefined : (devices.set(role, key), key)))(keys.held?.(deviceOf(lock, role).account));
+    const asRoot = (account) => ((device, key) => [key, device.signer, portOf(service, account, store, limits.wait)])(deviceOf(lock), valueOf(lock, 'founding/root').split('/')[1]);
+    const asRole = (role, lines) => ((one, id) => [id, one.signer, portOf(service, one.account, store, limits.wait)])(deviceOf(lock, role), idIn(lines, device(role)) ?? deviceOf(lock, role).account);
+    /** What a call is answered with, one call at a time as when bound blocked head: every bound process it starts is stopped when the client cancels it, and a call cancelled while it waits its turn is never begun. */
+    const contextOf = (signal) => {
+        /** One call's folds of a place, kept until something lands in it or is laid there; the places its root acted in, whose receipts close once, when the call ends; and those where anything but a read's receipts landed, as bound printed it. */
+        const [folds, touched, moved] = [new Map(), new Set(), new Set()], forget = (place) => { for (const k of [...folds.keys()])
+            if (k.endsWith(`\0${place}`))
+                folds.delete(k); };
+        const read = (at) => at?.startsWith(`${valueOf(lock, 'receipt/at')}:`) === true;
+        const once = (key, place, fold) => (folds.get(`${key}\0${place}`) ?? ((p) => (folds.set(`${key}\0${place}`, p), p))(fold()));
+        const acted = (place, root, done) => done.then((got) => { if ('lines' in got && !got.lines.every((l) => ((f) => f.kind === 'fact' && read(f.value.fields['at']))(parse(l))))
+            moved.add(place); return got; }).finally(() => { forget(place); if (root)
+            touched.add(place); });
+        return {
+            lock,
+            bound: (cwd, args) => run(runs, cwd, args, {}, signal),
+            standing: (place) => once('standing', place, () => standingAt(runs, place, (lines) => ['head', 'person'].flatMap((role) => ((id) => (id === undefined ? [] : [id]))(idIn(lines, device(role)))), (line) => read(line.at), signal)),
+            policy: (place) => once('policy', place, () => policyAt(runs, place, signal)),
+            world: (place, view) => once(`world/${view}`, place, () => settledView(runs, place, view, signal)),
+            adapter: async (origin) => ((name) => (!/^[a-z-]+$/.test(name) ? undefined : import(__rewriteRelativeImportExtension(new URL(`../ports/adapters/${name}${ext}`, import.meta.url).href))))(URL.canParse(origin) ? valueOf(lock, `adapter/${new URL(origin).protocol.slice(0, -1)}`) : ''),
+            files: { lay: (place, rel, bytes) => { forget(place); layAt(place, rel, bytes); }, drop: (place, rel) => { forget(place); dropAt(place, rel); }, has: hasAt, list: listAt, read: documents, take: takeAt, own: (rel) => takeAt(join(root, rel)) },
+            home: () => home,
+            personal: () => process.env[valueOf(lock, `platform/${process.platform}/home`)] ?? '',
+            found: (place, account) => acted(place, true, founded(runs, place, ...asRoot(account), signal)),
+            signRoot: (place, lot, account) => sign(runs, place, lot, ...asRoot(account), signal),
+            landRoot: (place, lot, account) => acted(place, true, landAct(runs, place, lot, ...asRoot(account), signal)),
+            moved: (place) => moved.has(place),
+            settle: async () => { const red = []; for (const place of touched) {
+                const why = await closing(runs, place, signal);
+                if (why !== undefined)
+                    red.push(sayIn(lock)('receipts-open', { place, why }));
+            } touched.clear(); return red; },
+            pinned: (place, file) => pinnedAt(runs, place, file, signal),
+            access: async (kind) => (kind !== valueOf(lock, 'access/adapter') || !/^[a-z0-9-]+$/.test(kind) ? undefined : import(__rewriteRelativeImportExtension(new URL(`../ports/access/${kind}${ext}`, import.meta.url).href)).then((m) => m.adapter)),
+            person,
+            cache: { keep, held },
+            signAs: (place, lot, role, lines) => sign(runs, place, lot, ...asRole(role, lines), signal),
+            landAs: (place, lot, role, lines) => acted(place, false, landAct(runs, place, lot, ...asRole(role, lines), signal)),
+            land: (place, signed) => acted(place, true, land(runs, place, signed, signal)),
+            told: (place, signed) => told(runs, place, signed, words.standing, signal),
+            elicit: (message) => person.consent(message, aboutOf(lock, 'said/elicit/yes')),
+            now: () => Date.now(),
+            machine: () => Date.now() - waited,
+            begun: Date.now() - waited,
+            keys,
+            device,
+            roots: door.roots, client: door.client,
+        };
+    };
+    const call = (name, args, signal) => (ahead.abort(), turn(async () => {
+        const tool = surface.tools.find((one) => one.name === name), place = typeof args?.['place'] === 'string' ? args['place'] : '', keyed = (e) => ((key) => { if (key === undefined || !lock.some((l) => l.scope === key))
+            throw e; return [sayIn(lock)('signing-key-refused', { key, place })]; })(/^REFUSE·keychain (\S+) names a signing key/.exec(e.message)?.[1]);
+        if (tool === undefined)
+            return undefined;
+        const context = contextOf(signal), answer = refused !== undefined ? [refused] : signal.aborted ? [] : [...await (await answerOf('tools', tool.name))(askedOf(args), context).catch(keyed), ...await context.settle()];
+        void ((early) => turn(() => readAhead(shapeOf(answer).cells, contextOf(), early.signal)))(ahead = new AbortController());
+        return answer;
+    }).then(async (answer) => { if (answer !== undefined && shapeOf(answer).cells.some((c) => c.code === keyRefused))
+        await refusals.write(typeof args?.['place'] === 'string' ? args['place'] : await placed(), name, digestOf(name, args ?? {}), keyRefused); return answer; }));
+    const resource = (uri, signal) => turn(async () => {
+        const found = surface.resources.flatMap((r) => ((vars) => (vars === undefined ? [] : [{ r, vars }]))(matchTemplate(r.template, uri)))[0];
+        if (found === undefined)
+            return undefined;
+        if (refused !== undefined)
+            return { mime: found.r.mime, lines: [refused] };
+        return { mime: found.r.mime, lines: await (await answerOf('resources', found.r.name))(askedOf(found.vars), contextOf(signal)) };
+    });
+    /** A place's card now, as do reads it; whether head's index names a place yet, and the one it names; lines head's own key lands in a place, on its standing. */
+    const [cardOf, placed] = [(place) => turn(() => cardAt(contextOf(), place)), () => turn(() => placeOf({}, contextOf()))];
+    const hasPlace = () => turn(async () => ((c) => (!c.files.has(home, LOCK) ? false : c.policy(home).then((held) => !('refused' in held) && held.lines.some((l) => l.scope?.startsWith(`${valueOf(lock, 'home/family')}/`) && l.value !== 'withdraw'))))(contextOf()));
+    const write = (place, lot) => turn(async () => ((c) => c.standing(place).then((held) => ('refused' in held ? held : c.landAs(place, lot, 'head', held.lines))))(contextOf()));
+    return { surface, call, resource, idle: () => last, cardOf, placed, hasPlace, write, refusals, now: () => contextOf().now() };
+};
+/** A door that shows no form: its verbs, each answered by its tool through the guard every such door asks, a verb that is no tool carried as its carrier's action; undefined for a verb it lacks. */
+export const plainOf = (lock, root, ext, name) => {
+    const [head, verbs, carrier] = [headOf(lock, root, ext, { can: () => ({ url: false, form: false }), elicit: async () => ({ action: 'decline' }), roots: async () => [], client: () => undefined, name }), members(valueOf(lock, 'doors/verbs')), valueOf(lock, 'doors/carrier')];
+    const guard = guardOf(lock, head, (verb, args) => ((tool) => head.call(tool ? verb : carrier, tool ? args : { ...args, action: verb }, new AbortController().signal))(head.surface.tools.some((t) => t.name === verb)));
+    return { head, verbs, settle: guard.settle, asked: async (verb, args) => (verbs.includes(verb) ? guard.call(verb, args) : undefined) };
+};

package/dist/src/doors/http.d.ts

@@ -0,0 +1,3 @@
+import { type Said } from '../core/lock.ts';
+/** The http door, on this device's loopback alone: one POST a verb, its body the args, its answer the cells every door gives; a Host not its own, or any Origin, is refused by name. It ends when its input does. */
+export declare const open: (lock: readonly Said[], root: string, ext: string, name: string) => Promise<void>;

package/dist/src/doors/http.js

@@ -0,0 +1,34 @@
+import { createServer } from 'node:http';
+import { valueOf } from "../core/lock.js";
+import { sayIn } from "../core/surface.js";
+import { shapeOf } from "../ports/surface.js";
+import { plainOf } from "./head.js";
+/** The http door, on this device's loopback alone: one POST a verb, its body the args, its answer the cells every door gives; a Host not its own, or any Origin, is refused by name. It ends when its input does. */
+export const open = (lock, root, ext, name) => new Promise((done) => {
+    const [loopback, asked, say] = [valueOf(lock, 'doors/loopback'), process.argv[4] ?? '0', sayIn(lock)];
+    if (!/^\d+$/.test(asked)) {
+        process.stdout.write(`${JSON.stringify(shapeOf([say('door-bind', { asked, loopback })]))}\n`);
+        process.exitCode = 1;
+        done();
+        return;
+    }
+    const door = plainOf(lock, root, ext, name);
+    const server = createServer((request, out) => {
+        const [own, answer] = [`${loopback}:${server.address().port}`, (status, lines) => out.writeHead(status, { 'content-type': 'application/json' }).end(JSON.stringify(shapeOf(lines)))];
+        if (request.headers.origin !== undefined || request.headers.host !== own)
+            return void answer(403, [say(request.headers.origin !== undefined ? 'door-origin' : 'door-host', { origin: request.headers.origin ?? '', host: request.headers.host ?? '', own })]);
+        let body = '';
+        request.on('data', (chunk) => { body += chunk; }).on('end', async () => {
+            const args = ((t) => { try {
+                return JSON.parse(t || '{}');
+            }
+            catch {
+                return undefined;
+            } })(body);
+            const lines = request.method === 'POST' && args !== null && typeof args === 'object' && !Array.isArray(args) ? await door.asked((request.url ?? '').slice(1), args) : undefined;
+            answer(lines === undefined ? 400 : 200, lines ?? [say('door-unasked', { verbs: door.verbs.join(', ') })]);
+        });
+    });
+    server.listen(Number(asked), loopback, () => process.stdout.write(`${JSON.stringify({ port: server.address().port })}\n`));
+    process.stdin.on('end', () => server.close(() => void door.settle().then(door.head.idle).then(() => done()))).resume();
+});

package/dist/src/doors/lines.d.ts

@@ -0,0 +1,3 @@
+import type { Said } from '../core/lock.ts';
+/** The lines door: one JSON request a line in, its answer one JSON line out, the cells as every door gives them. */
+export declare const open: (lock: readonly Said[], root: string, ext: string, name: string) => Promise<void>;

package/dist/src/doors/lines.js

@@ -0,0 +1,21 @@
+import { createInterface } from 'node:readline';
+import { sayIn } from "../core/surface.js";
+import { shapeOf } from "../ports/surface.js";
+import { plainOf } from "./head.js";
+/** The lines door: one JSON request a line in, its answer one JSON line out, the cells as every door gives them. */
+export const open = (lock, root, ext, name) => new Promise((done) => {
+    const [door, say] = [plainOf(lock, root, ext, name), sayIn(lock)];
+    const answered = (id, answer) => process.stdout.write(`${JSON.stringify({ id, ...shapeOf(answer ?? [say('door-unread', { verbs: door.verbs.join(', ') })]) })}\n`);
+    let pending = Promise.resolve();
+    createInterface({ input: process.stdin }).on('line', (text) => {
+        pending = pending.then(async () => {
+            const asked = ((t) => { try {
+                return JSON.parse(t);
+            }
+            catch {
+                return {};
+            } })(text);
+            answered(asked.id, await door.asked(asked.verb ?? '', asked.args));
+        });
+    }).on('close', () => void pending.then(door.settle).then(door.head.idle).then(() => done()));
+});

package/dist/src/flows/act.d.ts

@@ -1,7 +1,3 @@
 import type { Asked, Context } from '../core/answer.ts';
-/**
- * One offer that is not of the class head reads: within a cap the person signed it is called as far as the cap goes;
- * without one, each call asks the person once, and their yes is signed for exactly that request. The intent lands before
- * the call, the receipt after; a call that never answered stays open until a look of what it would have changed closes it.
- */
+/** Run one action within its declared authority, with the person's approval when required. */
 export declare const act: (asked: Asked, context: Context) => Promise<readonly string[]>;

package/dist/src/flows/act.js

@@ -4,11 +4,7 @@ import { draftOf } from "../core/receipt.js";
 import { sayIn } from "../core/surface.js";
 import { canonical } from '@lapxo/topos/wire';
 import { called } from "./call.js";
-/**
- * One offer that is not of the class head reads: within a cap the person signed it is called as far as the cap goes;
- * without one, each call asks the person once, and their yes is signed for exactly that request. The intent lands before
- * the call, the receipt after; a call that never answered stays open until a look of what it would have changed closes it.
- */
+/** Run one action within its declared authority, with the person's approval when required. */
 export const act = (asked, context) => called(asked, context, planAct, async ({ word, say, lines, source, operation, prepared, typed, attach, send, lands, widen, uncovered }) => {
     const [family, done] = [word('act/family'), word('act/done')];
     const allowed = allowedOf(lines, word('allow/family'), source, operation);

package/dist/src/flows/call.d.ts

@@ -3,10 +3,7 @@ import type { Said } from '../core/lock.ts';
 import type { Call, Plan } from '../core/read.ts';
 import type { Attachment } from '../access/contract.ts';
 import type { Fetched, Prepared } from '../ports/adapters/request.ts';
-/**
- * The origin of a source a person picks once for a place, when its document declares several: offered as a choice among
- * them, none a default, and kept as the person's line; the lines a call stands on, with it.
- */
+/** Ask for one declared origin when the source offers several. */
 export declare const pickedOrigin: (context: Context, place: string, lines: readonly Said[], source: string, plan: Call | Plan) => Promise<{
     readonly lines: readonly Said[];
 } | {
@@ -40,9 +37,5 @@ export interface Frame {
     readonly send: (attachment: Attachment | undefined) => Promise<Fetched>;
     readonly uncovered: (role: string, scopes: readonly string[]) => readonly string[] | undefined;
 }
-/**
- * The steps a read and an act share: the place, the lines it stands on once bound settled them, the offer's
- * plan, the transport its origin names and the request it prepares; then what is particular, given a frame that says
- * by the lock, attaches access when asked, types what came back and lands a line under head's key.
- */
+/** Prepare one call, authorize its access and pass its frame to the read or action flow. */
 export declare const called: (asked: Asked, context: Context, planOf: (lines: readonly Said[], lock: readonly Said[], source: string, operation: string, place: string) => Call | Plan, then: (frame: Frame) => Promise<readonly string[]>) => Promise<readonly string[]>;

package/dist/src/flows/call.js

@@ -5,13 +5,12 @@ import { sayIn } from "../core/surface.js";
 import { valueOf } from "../core/lock.js";
 import { uncoveredIn } from "../core/device.js";
 import { widening } from "./device.js";
+import { namedIn } from "../use/named.js";
+import { answering } from "../answers/answered.js";
 import { attachmentFor } from "../access/obtain.js";
 import { typedAnswer } from "./answer.js";
 import { standingFor } from "./world.js";
-/**
- * The origin of a source a person picks once for a place, when its document declares several: offered as a choice among
- * them, none a default, and kept as the person's line; the lines a call stands on, with it.
- */
+/** Ask for one declared origin when the source offers several. */
 export const pickedOrigin = async (context, place, lines, source, plan) => {
     if (plan.kind !== 'said' || plan.key !== 'pick-origin')
         return { lines };
@@ -27,18 +26,18 @@ export const pickedOrigin = async (context, place, lines, source, plan) => {
     const landed = await by.land([canonical(line(chosen))]);
     return 'refused' in landed ? { said: [sayIn(context.lock)('not-landed', { why: landed.refused })] } : { lines: [...lines, line(chosen)] };
 };
-/**
- * The steps a read and an act share: the place, the lines it stands on once bound settled them, the offer's
- * plan, the transport its origin names and the request it prepares; then what is particular, given a frame that says
- * by the lock, attaches access when asked, types what came back and lands a line under head's key.
- */
+/** Prepare one call, authorize its access and pass its frame to the read or action flow. */
 export const called = async (asked, context, planOf, then) => {
     const say = (key, fields = {}) => [sayIn(context.lock)(key, fields)];
-    const [source, operation] = [asked['source'] ?? '', asked['operation'] ?? ''];
+    const source = asked['source'] ?? '';
     return inPlace(asked, context, async (place) => {
         const held = await standingFor(context, place);
         if ('unsettled' in held)
             return say('unsettled', { source, why: held.unsettled });
+        const named = await namedIn(context, held.lines, source, asked['operation'] ?? '', asked['ahead'] === 'true');
+        if ('said' in named)
+            return named.said;
+        const operation = named.operation;
         const widen = async (message, lot) => {
             const by = widening(context, place, held.lines, lot);
             if ('said' in by)
@@ -65,9 +64,10 @@ export const called = async (asked, context, planOf, then) => {
             return say(prepared.refused, { source, origin: plan.origin });
         const most = (scope) => Number((lines.find((l) => l.scope === scope)?.value ?? '0..0').split('..')[1]);
         const typed = async (status, bytes) => ((got, at) => ['lines' in got ? say('answered', { source, operation, status, at })[0] : say('untyped', { source, operation, status, at, why: got.untyped })[0], ...('lines' in got ? got.lines : [])])(await typedAnswer(context, place, lines, source, operation, prepared.key, bytes), new Date(context.now()).toISOString());
-        const lands = (...lot) => context.landAs(place, lot, 'head', lines);
         const attach = async () => ((got) => ('said' in got ? { said: say(got.said, { source, operation, kinds: plan.access.kind, input: got.input }) } : got))(await attachmentFor(context, place, lines, plan));
         const uncovered = (role, scopes) => uncoveredIn(context.lock, lines, context.device(role), place, [], scopes);
-        return then({ widen, word: (scope) => valueOf(context.lock, scope), say, place, lines, source, operation, plan, prepared, most, typed, attach, send: (attachment) => prepared.send(attachment, most('read/response-bytes')), lands, uncovered });
+        let use = named.use !== undefined && uncovered('head', [named.scope]) === undefined ? [named.use] : [];
+        const lands = (...lot) => { const once = use; use = []; return context.landAs(place, [...once, ...lot], 'head', lines).then((out) => ('lines' in out ? { lines: out.lines.filter((l) => !l.includes(` scope=${valueOf(context.lock, 'use/family')}/`)) } : out)); };
+        return then(answering(context, place, asked, { widen, word: (scope) => valueOf(context.lock, scope), say, place, lines, source, operation, plan, prepared, most, typed, attach, send: (attachment) => prepared.send(attachment, most('read/response-bytes')), lands, uncovered }));
     });
 };

package/dist/src/flows/device.js

@@ -7,19 +7,17 @@ import { adoptsIn } from "../adopt/adopt.js";
 /** A key of this device by its role: read from the keychain, or made there once; only its public half is ever handed on. */
 export const deviceKey = (context, role) => context.keys.made?.(deviceOf(context.lock, role).account);
 /** The keychain account of a place's root, when this keychain holds it — who configures the place is here; else what head says of that. */
-export const rootIn = (context, place) => ((account) => (context.keys.read(account) === undefined ? { said: [sayIn(context.lock)('no-root', { place })] } : { account }))(fill(valueOf(context.lock, 'founding/root-account'), { place: placeNameOf(place) }));
+export const rootIn = (context, place) => ((account) => (context.keys.held?.(account) === undefined ? { said: [sayIn(context.lock)('no-root', { place })] } : { account }))(fill(valueOf(context.lock, 'founding/root-account'), { place: placeNameOf(place) }));
 export const widening = (context, place, lines, lot) => {
     const parent = adoptsIn(context.lock, lines);
     if (parent !== undefined)
         return { said: [sayIn(context.lock)('parent-lock', { place, parent })] };
     const [root, witness, field] = [rootIn(context, place), idIn(lines, context.device('person')), valueOf(context.lock, 'widening/witness')];
-    const wire = lines.filter((l) => l.scope === 'wire/fields');
+    const wire = lines.filter((l) => l.scope === 'wire/fields'), admits = wire.some((l) => members(l.value ?? '').includes(field));
     const witnessed = (signed) => signed.map((line) => ((got) => (got.kind === 'fact' ? canonical({ ...got.value.fields, [field]: witness }) : line))(parse(line)));
     if ('account' in root && witness !== undefined) {
-        if (wire.some((l) => members(l.value ?? '').includes(field)))
-            return { sign: (signed) => context.signRoot(place, witnessed(signed), root.account), land: (signed) => context.landRoot(place, witnessed(signed), root.account) };
-        if (lot.every((line) => / scope=wire\/fields /.test(line)))
-            return { sign: (signed) => context.signRoot(place, signed, root.account), land: (signed) => context.landRoot(place, signed, root.account) };
+        if (admits || lot.every((line) => / scope=wire\/fields /.test(line)))
+            return { sign: (signed) => context.signRoot(place, admits ? witnessed(signed) : signed, root.account), land: (signed) => context.landRoot(place, admits ? witnessed(signed) : signed, root.account) };
         const [named, bare] = [[...new Set([...wire.flatMap((l) => members(l.value ?? '')), field])].join('|'), (l) => Object.fromEntries(Object.entries(l).filter(([k]) => !['sig', 'epoch'].includes(k)))];
         return { said: [sayIn(context.lock)('unwitnessed', { place }), ...wire.map((l) => canonical({ ...bare(l), by: 'target', value: 'withdraw' })),
                 canonical({ at: `policy:head/wire/${new Date(context.now()).toISOString()}`, by: 'target', form: 'alphabet', measure: 'id', role: 'reads', scope: 'wire/fields', value: named })] };

package/dist/src/flows/plan.js

@@ -2,6 +2,7 @@ import { baseOf, inPlace, standingOr } from "../core/answer.js";
 import { sayIn } from "../core/surface.js";
 import { widening } from "./device.js";
 import { parse } from '@lapxo/topos/wire';
+const moved = async (context, place, base) => ((now) => ('said' in now ? now.said : baseOf(now.lines) !== base ? [sayIn(context.lock)('base-moved', { base })] : undefined))(await standingOr(context, place));
 /**
  * A proposal the person signs: drafted lines shown to the person with the place and the base they are made against; on
  * their yes to exactly those, signed by their key; what bound prints folding it as if landed comes back as it printed it. Nothing lands; the lot is kept by its digest.
@@ -26,11 +27,9 @@ export const planLot = (asked, context) => inPlace(asked, context, async (place)
     const signed = await by.sign(lot);
     if ('refused' in signed)
         return [signed.refused];
-    const now = await standingOr(context, place);
-    if ('said' in now)
-        return now.said;
-    if (baseOf(now.lines) !== base)
-        return [say('base-moved', { base })];
+    const stale = await moved(context, place, base);
+    if (stale)
+        return stale;
     const kept = context.cache.keep(Buffer.from(JSON.stringify({ place, base, signed: signed.lines })));
     return [say('planned', { lot: kept, base }), ...(await context.told(place, signed.lines))];
 });
@@ -41,11 +40,9 @@ export const landLot = async (asked, context) => {
     if (bytes === undefined)
         return [say('no-lot', { lot: asked['lot'] ?? '' })];
     const kept = JSON.parse(Buffer.from(bytes).toString('utf8'));
-    const now = await standingOr(context, kept.place);
-    if ('said' in now)
-        return now.said;
-    if (baseOf(now.lines) !== kept.base)
-        return [say('base-moved', { base: kept.base })];
+    const stale = await moved(context, kept.place, kept.base);
+    if (stale)
+        return stale;
     const landed = await context.land(kept.place, kept.signed);
     return 'refused' in landed ? [landed.refused] : [say('landed', { count: String(landed.lines.length) }), ...landed.lines];
 };

package/dist/src/flows/read.d.ts

@@ -1,9 +1,3 @@
 import type { Asked, Context } from '../core/answer.ts';
-/**
- * A read of one offer the place declares of the class head reads: the response comes back once, typed by the world,
- * and both are kept — the body's digest and the typed answer's, receipts the device key signs. Asked again as the same
- * principal, while the place stands on what typed it, the person's grant holds now and the newest read is younger than
- * the reuse the place allows, it answers from what was kept: nothing called. Asked for history, it shows what was kept
- * of that request as of when it was read — evidence of that read, never a current answer — where the place allows it.
- */
+/** Read one permitted offer, reuse only under its policy and land the signed receipt. */
 export declare const readSource: (asked: Asked, context: Context) => Promise<readonly string[]>;

package/dist/src/flows/read.js

@@ -9,7 +9,7 @@ import { principalOf } from "../access/obtain.js";
 import { jsonOf } from "../access/contract.js";
 import { refusedAccess } from "../sources/refused.js";
 import { hand, keptOf } from "../kept/kept.js";
-import { markOf, overOf } from "../ahead/budget.js";
+import { calledIn, markOf, overOf } from "../ahead/budget.js";
 /** An intent an earlier act left open, closed by the read that looked at what it would have changed: a line naming that read-s digest, signed by head. */
 const closeWith = async (intent, source, digest, { word, lines, lands }, context) => {
     const say = sayIn(context.lock);
@@ -20,13 +20,7 @@ const closeWith = async (intent, source, digest, { word, lines, lands }, context
     const landed = await lands(draftOf('', word('receipt/at'), `${intent}/${word('act/closed')}`, digest, new Date(context.now()).toISOString()));
     return 'refused' in landed ? [say('not-landed', { why: landed.refused })] : [...landed.lines, say('closed', { intent, digest })];
 };
-/**
- * A read of one offer the place declares of the class head reads: the response comes back once, typed by the world,
- * and both are kept — the body's digest and the typed answer's, receipts the device key signs. Asked again as the same
- * principal, while the place stands on what typed it, the person's grant holds now and the newest read is younger than
- * the reuse the place allows, it answers from what was kept: nothing called. Asked for history, it shows what was kept
- * of that request as of when it was read — evidence of that read, never a current answer — where the place allows it.
- */
+/** Read one permitted offer, reuse only under its policy and land the signed receipt. */
 export const readSource = (asked, context) => called(asked, context, planRead, async ({ word, say, place, lines, source, operation, plan, prepared, most, typed, attach, send, lands, widen, uncovered }) => {
     const [family, at, when] = [word('receipt/family'), word('receipt/at'), new Date(context.now()).toISOString()];
     const closing = (digest) => closeWith(asked['closes'], source, digest, { word, lines, lands }, context);
@@ -78,6 +72,9 @@ export const readSource = (asked, context) => called(asked, context, planRead, a
     const again = was?.kind === 'again' ? say(`kept-${was.why}`, { source, operation, at: was.at }) : [];
     if (overOf(lines, [family, at, word('ahead/mark')], source, context.now(), most('read/rate'), Number(word('ahead/share').split('..')[1]), asked))
         return asked['ahead'] === 'true' ? [] : say('rate', { source });
+    const calls = lines.find((l) => l.scope === `${word('calls/family')}/${source}`), made = calls && calledIn(lines, [family, at, word('ahead/mark')], source, calls.measure ?? '', context.now());
+    if (calls && (made === undefined || made >= most(calls.scope)))
+        return asked['ahead'] === 'true' ? [] : say(made === undefined ? 'calls-unwindowed' : 'calls-owed', { source, calls: String(most(calls.scope)), window: calls.measure });
     const attached = await attach();
     if ('said' in attached)
         return attached.said;
@@ -86,7 +83,7 @@ export const readSource = (asked, context) => called(asked, context, planRead, a
     if (asked['ahead'] === 'true' && (got.kind !== 'got' || got.status >= 300))
         return [];
     if (got.kind !== 'got')
-        return say(got.kind === 'over' ? 'too-large' : 'unreachable-source', { source });
+        return say(got.kind === 'over' ? 'too-large' : 'unreachable-source', { source, why: got.kind === 'failed' ? got.why : '' });
     if (got.status === 401 && attached.principal !== 'anonymous')
         return refusedAccess(context, place, lines, plan, operation);
     const digest = context.cache.keep(Buffer.concat([Buffer.from(`${got.status}\n`), got.bytes]));

package/dist/src/index.js

@@ -7,139 +7,45 @@ var __rewriteRelativeImportExtension = (this && this.__rewriteRelativeImportExte
     }
     return path;
 };
-import { basename, join } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { Server } from '@modelcontextprotocol/sdk/server/index.js';
 import { StdioServerTransport } from '@modelcontextprotocol/sdk/server/stdio.js';
 import { CallToolRequestSchema, GetPromptRequestSchema, ListPromptsRequestSchema, ListResourcesRequestSchema, ListResourceTemplatesRequestSchema, ListToolsRequestSchema, ReadResourceRequestSchema } from '@modelcontextprotocol/sdk/types.js';
-import { answerOf } from "./core/answer.js";
-import { parse } from '@lapxo/topos/wire';
-import { aboutOf, valueOf } from "./core/lock.js";
-import { fill, sayIn } from "./core/surface.js";
-import { matchTemplate, refusedOn, shapeOf, shapeSchema, surfaceOf } from "./ports/surface.js";
-import { closing, cooled, founded, land, landAct, limits, pinnedAt, policyAt, run, settledView, sign, standingAt, told, warm, words } from "./ports/bound.js";
-import { warmth } from "./ports/warm.js";
-import { held, keep } from "./ports/cache.js";
-import { registryFor } from "./ports/signers.js";
-import { dropAt, folderOf, hasAt, layAt, listAt, lockAt, takeAt } from "./ports/place.js";
-import * as documents from "./ports/documents.js";
-import { keychain } from "./ports/keychain.js";
-import { algorithmOf, deviceOf, idIn } from "./core/device.js";
-import { publicOf } from "./ports/keys.js";
-import { personOf } from "./ports/access/person.js";
-import { readAhead } from "./ahead/read.js";
+import { aboutOf, members, valueOf } from "./core/lock.js";
+import { fill } from "./core/surface.js";
+import { shapeOf, shapeSchema } from "./ports/surface.js";
+import { folderOf, lockAt } from "./ports/place.js";
+import { askedOf, headOf } from "./doors/head.js";
 const [ext, root] = ((self) => [self.slice(self.lastIndexOf('.')), fileURLToPath(new URL(self.endsWith('.ts') ? '..' : '../..', self))])(import.meta.url);
 const lock = lockAt(root);
-const surface = surfaceOf(lock);
-const runs = valueOf(lock, 'runs');
-Object.assign(words, Object.fromEntries(['read', 'view', 'sign', 'land', 'key', 'signer', 'pin', 'topos', 'standing', 'evidence', 'act', 'profile', 'receipts', 'refusal', 'identity'].map((w) => [w, valueOf(lock, `bound/${w}`)])));
-Object.assign(limits, { wait: Number(valueOf(lock, 'bound/wait').split('..')[1]), most: Number(valueOf(lock, 'bound/printed').split('..')[1]) });
-Object.assign(warmth, { spares: Number(valueOf(lock, 'bound/spares').split('..')[1]), boot: valueOf(lock, 'bound/spare-env').split('|') });
-/** One call at a time, each after the one before it and never on a timer, so one asked while another lands sees its receipt; bound started ahead for it, and nothing of it kept once it is answered. */
-let [last, ahead] = [Promise.resolve(), new AbortController()];
-const turn = (act) => ((next) => { last = next.catch(() => undefined); return next; })(last.then(() => { void warm(runs); return act().finally(cooled); }));
-for (const end of ['SIGTERM', 'SIGINT'])
-    process.once(end, () => void last.finally(() => process.exit(0)));
+const [door, doors] = [process.argv[3], members(valueOf(lock, 'cli/run/doors'))];
+if (process.argv[2] !== valueOf(lock, 'cli/run') || (door !== undefined && !doors.includes(door))) {
+    process.stdout.write(`${aboutOf(lock, 'cli/help')}\n`);
+    process.exit(0);
+}
+if (door !== undefined && door !== doors[0]) {
+    await (await import(__rewriteRelativeImportExtension(new URL(`./doors/${door}${ext}`, import.meta.url).href))).open(lock, root, ext, door);
+    process.exit();
+}
 const offered = (n) => (n ? { listChanged: false } : undefined);
+const head = headOf(lock, root, ext, {
+    can: () => ((e) => ({ url: Boolean(e?.url), form: e !== undefined && (e.form !== undefined || Object.keys(e).length === 0) }))(server.getClientCapabilities()?.elicitation), elicit: (params) => server.elicitInput(params, { timeout: Number(valueOf(lock, 'access/wait').split('..')[1]) }),
+    roots: async () => (server.getClientCapabilities()?.roots ? (await server.listRoots()).roots.flatMap((root) => folderOf(root.uri) ?? []) : []), client: () => ((c) => (c ? `${c.name}@${c.version}` : undefined))(server.getClientVersion()), name: doors[0],
+}), surface = head.surface;
 const server = new Server({ name: surface.name, version: surface.version }, { capabilities: { tools: offered(surface.tools.length), resources: offered(surface.resources.length), prompts: offered(surface.prompts.length) }, instructions: aboutOf(lock, 'prose/en/instructions') });
-/** The person, asked as the client lets head ask; every wait on them is counted, so a time ceiling measures head's work and never the person's. */
-let waited = 0;
-const timed = (ask) => async (...args) => { const t = Date.now(); try {
-    return await ask(...args);
-}
-finally {
-    waited += Date.now() - t;
-} };
-const asked = personOf(lock, { can: () => ((e) => ({ url: Boolean(e?.url), form: e !== undefined && (e.form !== undefined || Object.keys(e).length === 0) }))(server.getClientCapabilities()?.elicitation), elicit: (params) => server.elicitInput(params, { timeout: Number(valueOf(lock, 'access/wait').split('..')[1]) }) });
-const person = { consent: timed(asked.consent), enter: timed(asked.enter), choose: timed(asked.choose), visit: timed(asked.visit) };
-/** head is its home: the folder of its index of places, and the keychain service its keys live under, one per home, so two heads on one keychain never share a key. A place's root is told to bound by the key id its lock names, its secret kept there under the place's account. */
-const home = process.env[valueOf(lock, 'home/env')] || join(process.env[valueOf(lock, `platform/${process.platform}/home`)] ?? '', valueOf(lock, 'home/folder'));
-const service = `${deviceOf(lock).service}/${basename(home).replace(/[^\w.-]+/g, '-')}`;
-const store = valueOf(lock, `platform/${process.platform}/store`);
-const keys = keychain(service, store);
-const devices = new Map();
-const device = (role) => devices.get(role) ?? ((secret) => (secret === undefined ? undefined : ((key) => { devices.set(role, key); return key; })(publicOf(secret))))(keys.read(deviceOf(lock, role).account));
-const asRoot = (account) => ((device, key) => [key, device.signer, { BOUND_SIGNERS: registryFor(device.signer, service, account, key, valueOf(lock, 'founding/algorithm'), store) }])(deviceOf(lock), valueOf(lock, 'founding/root').split('/')[1]);
-/** What a call is answered with, one call at a time as when bound blocked head: every bound process it starts is stopped when the client cancels it, and a call cancelled while it waits its turn is never begun. */
-const contextOf = (signal) => {
-    /** One call's folds of a place, kept until something lands in it or is laid there; the places its root acted in, whose receipts close once, when the call ends; and those where anything but a read's receipts landed, as bound printed it. */
-    const [folds, touched, moved] = [new Map(), new Set(), new Set()], forget = (place) => { for (const k of [...folds.keys()])
-        if (k.endsWith(`\0${place}`))
-            folds.delete(k); };
-    const read = (at) => at?.startsWith(`${valueOf(lock, 'receipt/at')}:`) === true;
-    const once = (key, place, fold) => (folds.get(`${key}\0${place}`) ?? ((p) => (folds.set(`${key}\0${place}`, p), p))(fold()));
-    const acted = (place, root, done) => done.then((got) => { if ('lines' in got && !got.lines.every((l) => ((f) => f.kind === 'fact' && read(f.value.fields['at']))(parse(l))))
-        moved.add(place); return got; }).finally(() => { forget(place); if (root)
-        touched.add(place); });
-    const signRoot = (place, lot, account) => sign(runs, place, lot, ...asRoot(account), signal);
-    const signAs = (place, lot, role, lines) => ((one, id) => sign(runs, place, lot, id, one.signer, { BOUND_SIGNERS: registryFor(one.signer, service, one.account, id, algorithmOf(lines), store) }, signal))(deviceOf(lock, role), idIn(lines, device(role)) ?? deviceOf(lock, role).account);
-    return {
-        lock,
-        bound: (cwd, args) => run(runs, cwd, args, {}, signal),
-        standing: (place) => once('standing', place, () => standingAt(runs, place, (lines) => ['head', 'person'].flatMap((role) => ((id) => (id === undefined ? [] : [id]))(idIn(lines, device(role)))), (line) => read(line.at), signal)),
-        policy: (place) => once('policy', place, () => policyAt(runs, place, signal)),
-        world: (place, view) => once(`world/${view}`, place, () => settledView(runs, place, view, signal)),
-        adapter: async (origin) => ((name) => (!/^[a-z-]+$/.test(name) ? undefined : import(__rewriteRelativeImportExtension(new URL(`./ports/adapters/${name}${ext}`, import.meta.url).href))))(URL.canParse(origin) ? valueOf(lock, `adapter/${new URL(origin).protocol.slice(0, -1)}`) : ''),
-        files: { lay: (place, rel, bytes) => { forget(place); layAt(place, rel, bytes); }, drop: (place, rel) => { forget(place); dropAt(place, rel); }, has: hasAt, list: listAt, read: documents, take: takeAt, own: (rel) => takeAt(join(root, rel)) },
-        home: () => home,
-        personal: () => process.env[valueOf(lock, `platform/${process.platform}/home`)] ?? '',
-        found: (place, account) => acted(place, true, founded(runs, place, ...asRoot(account), signal)),
-        signRoot,
-        landRoot: (place, lot, account) => acted(place, true, landAct(runs, place, lot, ...asRoot(account), signal)),
-        moved: (place) => moved.has(place),
-        settle: async () => { const red = []; for (const place of touched) {
-            const why = await closing(runs, place, signal);
-            if (why !== undefined)
-                red.push(sayIn(lock)('receipts-open', { place, why }));
-        } touched.clear(); return red; },
-        pinned: (place, file) => pinnedAt(runs, place, file, signal),
-        access: async (kind) => (kind !== valueOf(lock, 'access/adapter') || !/^[a-z0-9-]+$/.test(kind) ? undefined : import(__rewriteRelativeImportExtension(new URL(`./ports/access/${kind}${ext}`, import.meta.url).href)).then((m) => m.adapter)),
-        person,
-        cache: { keep, held },
-        signAs,
-        landAs: (place, lot, role, lines) => acted(place, false, ((one, id) => landAct(runs, place, lot, id, one.signer, { BOUND_SIGNERS: registryFor(one.signer, service, one.account, id, algorithmOf(lines), store) }, signal))(deviceOf(lock, role), idIn(lines, device(role)) ?? deviceOf(lock, role).account)),
-        land: (place, signed) => acted(place, true, land(runs, place, signed, signal)),
-        told: (place, signed) => told(runs, place, signed, words.standing, signal),
-        elicit: (message) => person.consent(message, aboutOf(lock, 'said/elicit/yes')),
-        now: () => Date.now(),
-        machine: () => Date.now() - waited,
-        begun: Date.now() - waited,
-        keys,
-        device,
-        roots: async () => (server.getClientCapabilities()?.roots ? (await server.listRoots()).roots.flatMap((root) => folderOf(root.uri) ?? []) : []), client: () => ((c) => (c ? `${c.name}@${c.version}` : undefined))(server.getClientVersion()),
-    };
-};
-const askedOf = (raw) => Object.fromEntries(Object.entries(raw ?? {}).map(([k, v]) => [k, v === undefined ? undefined : typeof v === 'object' ? JSON.stringify(v) : String(v)]));
 const schemaOf = (fields) => ({ type: 'object',
     properties: Object.fromEntries(fields.map((f) => [f.name, { type: f.type, description: f.about }])), required: fields.filter((f) => f.required).map((f) => f.name) });
 if (surface.tools.length)
     server.setRequestHandler(ListToolsRequestSchema, () => ({ tools: surface.tools.map((tool) => ({ name: tool.name, description: tool.about,
             inputSchema: schemaOf([...tool.fields]), outputSchema: shapeSchema(lock), annotations: Object.fromEntries(tool.hints.map((hint) => [`${hint}Hint`, true])) })) }));
 if (surface.tools.length)
-    server.setRequestHandler(CallToolRequestSchema, async (request, extra) => (ahead.abort(), turn(async () => {
-        const tool = surface.tools.find((one) => one.name === request.params.name);
-        if (tool === undefined)
-            return { isError: true, content: [] };
-        const refused = refusedOn(lock, process.platform);
-        const context = contextOf(extra.signal), answer = refused !== undefined ? [refused] : extra.signal.aborted ? [] : [...await (await answerOf('tools', tool.name))(askedOf(request.params.arguments), context), ...await context.settle()];
-        void ((early) => turn(() => readAhead(shapeOf(answer).cells, contextOf(), early.signal)))(ahead = new AbortController());
-        return { content: [{ type: 'text', text: answer.join('\n') }], structuredContent: shapeOf(answer) };
-    })));
+    server.setRequestHandler(CallToolRequestSchema, async (request, extra) => ((answer) => (answer === undefined ? { isError: true, content: [] } : { content: [{ type: 'text', text: answer.join('\n') }], structuredContent: shapeOf(answer) }))(await head.call(request.params.name, request.params.arguments, extra.signal)));
 if (surface.resources.length)
     server.setRequestHandler(ListResourcesRequestSchema, () => ({ resources: [] }));
 if (surface.resources.length)
     server.setRequestHandler(ListResourceTemplatesRequestSchema, () => ({ resourceTemplates: surface.resources.map((r) => ({ name: r.name, uriTemplate: r.template, description: r.about, mimeType: r.mime })) }));
 if (surface.resources.length)
-    server.setRequestHandler(ReadResourceRequestSchema, async (request, extra) => turn(async () => {
-        const found = surface.resources.flatMap((r) => ((vars) => (vars === undefined ? [] : [{ r, vars }]))(matchTemplate(r.template, request.params.uri)))[0];
-        if (found === undefined)
-            return { contents: [] };
-        const refused = refusedOn(lock, process.platform);
-        if (refused !== undefined)
-            return { contents: [{ uri: request.params.uri, mimeType: found.r.mime, text: refused }] };
-        const lines = await (await answerOf('resources', found.r.name))(askedOf(found.vars), contextOf(extra.signal));
-        return { contents: [{ uri: request.params.uri, mimeType: found.r.mime, text: lines.join('\n') }] };
-    }));
+    server.setRequestHandler(ReadResourceRequestSchema, async (request, extra) => ((got) => ({ contents: got === undefined ? [] : [{ uri: request.params.uri, mimeType: got.mime, text: got.lines.join('\n') }] }))(await head.resource(request.params.uri, extra.signal)));
 if (surface.prompts.length)
     server.setRequestHandler(ListPromptsRequestSchema, () => ({ prompts: surface.prompts.map((p) => ({ name: p.name, description: p.about, arguments: p.fields.map((f) => ({ name: f.name, description: f.about, required: f.required })) })) }));
 if (surface.prompts.length)