@lapxo/head 0.1.5 → 0.1.7

package/dist/src/links/inspect.d.ts

@@ -4,5 +4,6 @@ import { type Asked, type Context } from '../core/answer.ts';
  * link's, and nothing shows who shared it — and what it names is shown; nothing is connected or granted, since a package
  * is received by the digest its sharer sent apart. A place that admits no content transport is handed the lines that admit
  * one, to sign; bytes that do not arrive are owed by the link until they do; bytes that are not what it names are refused.
+ * Asked why, it shows the transport it reads by: the profile's lines, laid at the place's birth by head, never the person's.
  */
 export declare const linked: (asked: Asked, context: Context) => Promise<readonly string[]>;

package/dist/src/links/inspect.js

@@ -1,6 +1,6 @@
 import { decodeReference } from '@lapxo/bound/reference';
 import { canonical } from '@lapxo/topos/wire';
-import { inPlace, standingOr } from "../core/answer.js";
+import { inStanding } from "../core/answer.js";
 import { members, valueOf } from "../core/lock.js";
 import { sayIn } from "../core/surface.js";
 import { linesOf } from "../core/worlds.js";
@@ -10,11 +10,12 @@ import { rootIn } from "../flows/device.js";
  * link's, and nothing shows who shared it — and what it names is shown; nothing is connected or granted, since a package
  * is received by the digest its sharer sent apart. A place that admits no content transport is handed the lines that admit
  * one, to sign; bytes that do not arrive are owed by the link until they do; bytes that are not what it names are refused.
+ * Asked why, it shows the transport it reads by: the profile's lines, laid at the place's birth by head, never the person's.
  */
-export const linked = (asked, context) => inPlace(asked, context, async (place) => {
-    const [say, word, link] = [sayIn(context.lock), (k) => valueOf(context.lock, k), asked['document'] ?? ''], [held, admits] = [await standingOr(context, place, context.policy), members(valueOf(context.lock, 'link/transport'))];
-    if ('said' in held)
-        return held.said;
+export const linked = (asked, context) => inStanding(asked, context, async (place, standing) => {
+    const [say, word, link] = [sayIn(context.lock), (k) => valueOf(context.lock, k), asked['document'] ?? ''], admits = members(valueOf(context.lock, 'link/transport'));
+    if (asked['why'] === 'true')
+        return [...standing.filter((l) => admits.includes(l.scope ?? '') || l.scope?.startsWith('transport/')).map((l) => canonical(l)), say('why-transport', { place })];
     const lines = context.lock.filter((l) => admits.some((s) => l.scope === `birth/${s}`)).map(({ about: _about, scope, ...l }) => canonical({ ...l, scope: scope.slice('birth/'.length), at: 'policy:person/transport', by: 'target' }));
     let reference;
     try {
@@ -23,10 +24,10 @@ export const linked = (asked, context) => inPlace(asked, context, async (place)
     catch (refused) {
         return [say('link-refused', { link, why: refused instanceof Error ? refused.message : String(refused) })];
     }
-    if (![admits[0], `transport/${new URL(reference.source).protocol.slice(0, -1)}`].every((s) => held.lines.some((l) => l.scope === s)))
+    if (![admits[0], `transport/${new URL(reference.source).protocol.slice(0, -1)}`].every((s) => standing.some((l) => l.scope === s)))
         return [say('transport-missing', { place, lines: lines.join('\n') })];
     const [printed, scope] = [await context.bound(place, [word('bound/read'), link]), `${word('place/needs')}/bytes/${reference.blob.slice(reference.algorithm.length + 1, reference.algorithm.length + 17)}`];
-    const [owed, root, why] = [held.lines.find((l) => l.scope === scope && l.role === 'demands' && l.value === link), rootIn(context, place), printed?.err.filter((l) => !l.startsWith('{')).at(-1) ?? ''];
+    const [owed, root, why] = [standing.find((l) => l.scope === scope && l.role === 'demands' && l.value === link), rootIn(context, place), printed?.err.filter((l) => !l.startsWith('{')).at(-1) ?? ''];
     if ('said' in root)
         return root.said;
     if (printed?.code !== 0 && !why.includes(word('link/unarrived')))
@@ -38,4 +39,4 @@ export const linked = (asked, context) => inPlace(asked, context, async (place)
     const named = linesOf(new TextEncoder().encode(printed.out.filter((l) => l.startsWith('TOPOS ')).map((l) => l.slice('TOPOS '.length)).join('\n')));
     const sources = named.filter((l) => /^sources\/[^/]+$/.test(l.scope ?? '')).map((l) => l.scope.split('/')[1]);
     return [say('inspected', { source: reference.source, sources: sources.join(', ') || '—', digest: reference.digest }), say('sharer-unverified', {}), ...await settled(owed ? [canonical({ ...due, value: 'withdraw' })] : [])];
-});
+}, context.policy);

package/dist/src/onboard/first.js

@@ -28,7 +28,7 @@ export const firstRun = async (asked, context, then) => {
     const connected = await then(dir, true), unread = connected.some((l) => l.startsWith('said/head/document-unread ')), held = unread ? undefined : await context.policy(dir);
     if (held !== undefined && ('refused' in held || !held.lines.some((l) => l.scope === `uses/${source}`)))
         return [...born, ...connected];
-    const line = (scope, measure, value, role = 'writes') => canonical({ at: 'policy:head/first-run', by: 'target', form: 'alphabet', measure, role, scope, value });
+    const line = (scope, measure, value, role = 'writes') => canonical({ at: 'policy:person/grant', by: 'target', form: 'alphabet', measure, role, scope, value });
     const owed = unread ? [line(`${word('place/needs')}/bytes/${source}`, 'id', document, 'demands')] : [];
     const landed = await context.landRoot(dir, [line(word('grant/family'), 'sources', source), line(word('grant/family'), 'until', until), ...owed], root.account);
     if ('refused' in landed)

package/dist/src/places/admit.js

@@ -26,7 +26,7 @@ export const admitted = (asked, context) => inPlace(asked, context, async (place
     const refused = await unless(context, say('elicit-admit', { name, place, coverage }));
     if (refused)
         return refused;
-    const lot = admissionOf(context.lock, key, 'head', { id: name, coverage, at: `policy:head/admit/${new Date(context.now()).toISOString()}` });
+    const lot = admissionOf(context.lock, key, 'head', { id: name, coverage, at: `policy:person/admit/${new Date(context.now()).toISOString()}` });
     const landed = await context.landRoot(place, lot, root.account);
     return 'refused' in landed ? [say('not-landed', { why: landed.refused })] : [say('admitted', { name, place, coverage }), ...landed.lines];
 });

package/dist/src/places/found.js

@@ -2,19 +2,15 @@ import { isAbsolute, basename } from 'node:path';
 import { canonical, LOCK } from '@lapxo/topos/wire';
 import { unless } from "../core/answer.js";
 import { admissionOf } from "../core/device.js";
-import { valueOf } from "../core/lock.js";
+import { members, valueOf } from "../core/lock.js";
 import { deviceKey } from "../flows/device.js";
 import { walkable } from "../walk/context.js";
 import { fill, sayIn } from "../core/surface.js";
-/**
- * The lines a place is born with, every one drafted by target: its root, by the public half of a key kept only in the
- * keychain and the signer that reaches it; this device's keys admitted; and the prelude head's lock declares under
- * birth/ — the wire, the regions and views a world is read through, and the lifetime every reader is bounded by.
- */
-const birthOf = (lock, root, head, person, place) => [
-    ...[['class', 'authorize'], ['coverage', '*'], ['signer', valueOf(lock, 'device/head/signer')], ['public-key', root]].map(([measure, value]) => canonical({ at: 'policy:head/birth', by: 'target', form: 'alphabet', measure: measure, role: 'writes', scope: valueOf(lock, 'founding/root'), value: value })),
+/** Found the place from the declared prelude; personal lines retain the person's provenance. */
+const birthOf = (lock, root, head, person, place, mine = `${valueOf(lock, 'founding/person-at')}birth`) => [
+    ...[['class', 'authorize'], ['coverage', '*'], ['signer', valueOf(lock, 'device/head/signer')], ['public-key', root]].map(([measure, value]) => canonical({ at: mine, by: 'target', form: 'alphabet', measure: measure, role: 'writes', scope: valueOf(lock, 'founding/root'), value: value })),
     ...admissionOf(lock, head, 'head'), ...admissionOf(lock, person, 'person'),
-    ...lock.filter((l) => l.scope?.startsWith('birth/')).map(({ about: _about, scope, ...line }) => canonical({ ...line, value: fill(line.value ?? '', { place }), scope: scope.slice('birth/'.length), at: 'policy:head/birth', by: 'target' })),
+    ...lock.filter((l) => l.scope?.startsWith('birth/')).map(({ about: _about, scope, ...line }) => ((s) => canonical({ ...line, value: fill(line.value ?? '', { place }), scope: s, at: members(valueOf(lock, 'founding/person')).includes(s) ? mine : 'policy:head/birth', by: 'target' }))(scope.slice('birth/'.length))),
 ];
 /** A place founded in a folder: a root key made in the keychain under the place's name — never a file — the birth lines written, and the first land signed by that root. */
 const founded = async (context, dir, name) => {
@@ -22,7 +18,7 @@ const founded = async (context, dir, name) => {
     const [head, person] = [deviceKey(context, 'head'), deviceKey(context, 'person')];
     if (head === undefined || person === undefined)
         return { refused: 'no-keychain' };
-    if (context.keys.read(account) !== undefined)
+    if (context.keys.held?.(account) !== undefined)
         return { refused: 'place-taken' };
     const root = context.keys.made?.(account);
     if (root === undefined)

package/dist/src/ports/adapters/request.d.ts

@@ -12,6 +12,7 @@ export type Fetched = {
     readonly kind: 'over';
 } | {
     readonly kind: 'failed';
+    readonly why?: string;
 };
 export type Prepared = {
     readonly key: string;

package/dist/src/ports/adapters/request.js

@@ -19,8 +19,8 @@ const requestCapped = async (method, url, headers, body, most, wait, redirect =
         }
         return size > most ? { kind: 'over' } : { kind: 'got', status: response.status, bytes: Buffer.concat(chunks), type: response.headers.get('content-type') ?? '', ...((at) => (at ? { location: at } : {}))(response.headers.get('location')), ...((asks) => (asks ? { authenticate: asks } : {}))(response.headers.get('www-authenticate')) };
     }
-    catch {
-        return { kind: 'failed' };
+    catch (error) {
+        return { kind: 'failed', why: String(error?.cause?.code ?? error?.name ?? '') };
     }
 };
 const loopback = new Set(['127.0.0.1', 'localhost', '[::1]']);

package/dist/src/ports/bound.d.ts

@@ -1,38 +1,35 @@
-import type { Said } from '../core/lock.ts';
+import { type Said } from '../core/lock.ts';
 import type { Outcome } from '../core/answer.ts';
-import { cooled } from './warm.ts';
+import type { portOf } from './keychain.ts';
 import type { Printed } from './process.ts';
 export type { Printed };
 export declare const limits: {
     wait: number;
     most: number;
 };
-/** bound run as a process in a folder, beside head and never blocking it, within the wait and the bytes head's lock gives it and stopped when the asker cancels: one started ahead when head holds one, else one started now. */
+/** bound asked in a folder, beside head and never blocking it, within the wait and the bytes head's lock gives it and stopped when the asker cancels: a place or one of its views read through the place's fold host, else a process started now, as for a document, a lot told or a sign: a host is always handed its place first, and bound folds a document only when it is named first; what it read from the temporary folder is removed once it ends, however it ends. */
 export declare const run: (name: string, cwd: string, args: readonly string[], env?: Readonly<Record<string, string>>, signal?: AbortSignal) => Promise<Printed | undefined>;
-/** bound started ahead of the first ask of a call, as many times as head's lock keeps it started; resolved once each is ready. */
-export declare const warm: (name: string) => Promise<unknown>;
-export { cooled };
 export type Folded = {
     readonly lines: readonly Said[];
 } | {
     readonly refused: string;
 };
-/**
- * The lines a place stands on, from bound's public views alone: its folded normative standing (the lines view) — its
- * policy, all that a reader of its pins, keys and views needs, read alone where nothing else is — and from
- * its authenticated evidence what this device's own keys signed. Receipts are history, each kept as it was made; any other
- * line of a device key, the person's own attestation, stands only while it is the one line of its scope and measure,
- * unwithdrawn and beside no line of the place's own: anything else needs a fold bound does not publish, and is refused by
- * name. A place whose land prints no act result is refused before anything lands in it. Any refusal of bound is no standing.
- */
+/** Read normative standing plus authenticated device evidence; ambiguous device history refuses. */
 export declare const policyAt: (name: string, place: string, signal?: AbortSignal) => Promise<Folded>;
 export declare const standingAt: (name: string, place: string, devicesOf: (lines: readonly Said[]) => readonly string[], isHistory: (line: Said) => boolean, signal?: AbortSignal) => Promise<Folded>;
-export declare const sign: (name: string, place: string, lot: readonly string[], key: string, signer: string, env: Readonly<Record<string, string>>, signal?: AbortSignal) => Promise<Outcome>;
+/** A sign or a land: in a host of its own for this one call, signed by head's signer through the port of the key it names, the lot handed in as the host's input. */
+type Port = ReturnType<typeof portOf>;
+export declare const sign: (_name: string, place: string, lot: readonly string[], key: string, signer: string, port: Port, signal?: AbortSignal) => Promise<Outcome>;
 /** A lot signed and landed in one process, its result read from what bound printed of the committed act: the records it admitted, never the receipt beside them; a place that declares no act result is refused by name. */
 /** A place's receipts rendered beside its lock, so bound alone checks the place: nothing when they closed, else why they did not. */
 export declare const closing: (name: string, place: string, signal?: AbortSignal) => Promise<string | undefined>;
-export declare const landAct: (name: string, place: string, lot: readonly string[], key: string, signer: string, env: Readonly<Record<string, string>>, signal?: AbortSignal) => Promise<Outcome>;
-export declare const land: (name: string, place: string, signed: readonly string[], signal?: AbortSignal) => Promise<Outcome>;
+/** A place's own lines in the person's words, beside its lock, the text they read and share: each line head lands at the person's at, drafted with no signature, gone with its withdraw. Bound reads the file as it reads the place, so it is written with the land, never while a fold runs. Set from head's lock. */
+export declare const birth: {
+    at: string;
+    file: string;
+}, birthed: (place: string, lot: readonly string[]) => void;
+export declare const landAct: (_name: string, place: string, lot: readonly string[], key: string, signer: string, port: Port, signal?: AbortSignal) => Promise<Outcome>;
+export declare const land: (_name: string, place: string, signed: readonly string[], signal?: AbortSignal) => Promise<Outcome>;
 export declare const told: (name: string, place: string, signed: readonly string[], view: string, signal?: AbortSignal) => Promise<readonly string[]>;
 export declare const pinnedAt: (name: string, place: string, file: string, signal?: AbortSignal) => Promise<{
     readonly pin: string;
@@ -41,7 +38,7 @@ export declare const pinnedAt: (name: string, place: string, file: string, signa
 } | {
     readonly refused: string;
 } | undefined>;
-export declare const founded: (name: string, place: string, key: string, signer: string, env: Readonly<Record<string, string>>, signal?: AbortSignal) => Promise<Outcome>;
+export declare const founded: (_name: string, place: string, key: string, signer: string, port: Port, signal?: AbortSignal) => Promise<Outcome>;
 export declare const words: {
     read: string;
     view: string;

package/dist/src/ports/bound.js

@@ -1,10 +1,11 @@
-import { mkdtempSync, readFileSync, writeFileSync } from 'node:fs';
+import { existsSync, readFileSync, writeFileSync } from 'node:fs';
 import { createRequire } from 'node:module';
-import { tmpdir } from 'node:os';
 import { dirname, join } from 'node:path';
-import { parse } from '@lapxo/topos/wire';
+import { canonical, LOCK, parse } from '@lapxo/topos/wire';
+import { factsOf } from "../core/lock.js";
 import { spawned } from "./process.js";
-import { cooled, kept, warmed } from "./warm.js";
+import { hosted, hosting, signedIn } from "./host.js";
+import { cleared, scratchOf } from "./scratch.js";
 import { folded } from "../ahead/fold.js";
 import { readingOf } from "./reading.js";
 const binOf = (name) => {
@@ -18,9 +19,16 @@ const binOf = (name) => {
     }
 };
 export const limits = { wait: 0, most: 0 };
-/** bound run as a process in a folder, beside head and never blocking it, within the wait and the bytes head's lock gives it and stopped when the asker cancels: one started ahead when head holds one, else one started now. */
-export const run = async (name, cwd, args, env = {}, signal) => ((bin, at, bounds) => (bin === undefined ? undefined
-    : (warmed(bin, args, at, bounds) ?? spawned(process.execPath, [bin, ...args], at, bounds)).then(apart)))(binOf(name), { cwd, env: { ...process.env, ...env } }, { wait: limits.wait, most: limits.most || Number.MAX_SAFE_INTEGER, ...(signal ? { signal } : {}) });
+/** bound asked in a folder, beside head and never blocking it, within the wait and the bytes head's lock gives it and stopped when the asker cancels: a place or one of its views read through the place's fold host, else a process started now, as for a document, a lot told or a sign: a host is always handed its place first, and bound folds a document only when it is named first; what it read from the temporary folder is removed once it ends, however it ends. */
+export const run = async (name, cwd, args, env = {}, signal) => {
+    try {
+        return await ((bin, at, bounds) => (bin === undefined ? undefined
+            : (args[0] === words.read && (args.length === 1 || (args.length === 3 && args[1] === words.view)) && hosting.installed && !Object.keys(env).length ? hosted(cwd, args, signal) : spawned(process.execPath, [bin, ...args], at, bounds)).then(apart)))(binOf(name), { cwd, env: { ...process.env, ...env } }, { wait: limits.wait, most: limits.most || Number.MAX_SAFE_INTEGER, ...(signal ? { signal } : {}) });
+    }
+    finally {
+        cleared([...args, ...Object.values(env)]);
+    }
+};
 /** The record bound prints after a refusal's diagnostic, read apart from it: what bound printed is kept whole, the record beside it, and why bound refused is the diagnostic's last line, never the record. */
 const recordOf = (line) => { try {
     return ((got) => (got?.profile === words.refusal ? got : undefined))(JSON.parse(line));
@@ -31,36 +39,24 @@ catch {
 const isRecord = (line) => line.startsWith('{') && recordOf(line) !== undefined;
 const apart = (printed) => ((record) => (record === undefined ? printed : { ...printed, refusal: recordOf(record) }))([...printed.err].reverse().find(isRecord));
 const why = (printed) => printed?.err.filter((line) => !isRecord(line)).at(-1);
-/** bound started ahead of the first ask of a call, as many times as head's lock keeps it started; resolved once each is ready. */
-export const warm = (name) => ((bin) => (bin === undefined ? Promise.resolve() : kept(bin)))(binOf(name));
-export { cooled };
-const facts = (out) => out.flatMap((line) => ((got) => (got.kind === 'fact' ? [got.value.fields] : []))(parse(line)));
-const readOf = (printed) => (printed === undefined || printed.code !== 0 ? { refused: why(printed) ?? '' } : { lines: facts(printed.out) });
+const readOf = (printed) => (printed === undefined || printed.code !== 0 ? { refused: why(printed) ?? '' } : { lines: factsOf(printed.out) });
 /** Native identities and expected-identity results come from the same public CLI contract. Without it, read fresh. */
 const nativeView = (name, place, view, signal) => {
     const read = async (expected) => {
         if (expected === undefined)
             return readOf(await run(name, place, [words.read, words.view, view], {}, signal));
         const result = readingOf(await run(name, place, [words.read, words.view, `${words.identity}@${view}@${expected}`], {}, signal), view, expected);
-        return 'refused' in result ? result : { lines: facts(result.text.split('\n')) };
+        return 'refused' in result ? result : { lines: factsOf(result.text.split('\n')) };
     };
     return !words.identity ? read() : folded(`${name}/${view}`, place, async () => { const result = readingOf(await run(name, place, [words.read, words.view, `${words.identity}@${view}`], {}, signal), view); return 'refused' in result ? undefined : result.identity; }, read);
 };
-/**
- * The lines a place stands on, from bound's public views alone: its folded normative standing (the lines view) — its
- * policy, all that a reader of its pins, keys and views needs, read alone where nothing else is — and from
- * its authenticated evidence what this device's own keys signed. Receipts are history, each kept as it was made; any other
- * line of a device key, the person's own attestation, stands only while it is the one line of its scope and measure,
- * unwithdrawn and beside no line of the place's own: anything else needs a fold bound does not publish, and is refused by
- * name. A place whose land prints no act result is refused before anything lands in it. Any refusal of bound is no standing.
- */
+/** Read normative standing plus authenticated device evidence; ambiguous device history refuses. */
 export const policyAt = async (name, place, signal) => ((folded) => ('refused' in folded || folded.lines.some((line) => line.scope === words.profile) ? folded
     : { refused: `REFUSE·act the place declares no ${words.profile}: land would print nothing of what it admits, so head lands nothing there; its root can land the local-act@1 profile and view/act` }))(await nativeView(name, place, words.standing, signal));
 export const standingAt = async (name, place, devicesOf, isHistory, signal) => {
-    const folded = await policyAt(name, place, signal);
+    const [folded, evidence] = await Promise.all([policyAt(name, place, signal), nativeView(name, place, words.evidence, signal)]);
     if ('refused' in folded)
         return folded;
-    const evidence = await nativeView(name, place, words.evidence, signal);
     if ('refused' in evidence)
         return evidence;
     const ids = new Set(devicesOf(folded.lines)), own = evidence.lines.filter((line) => ids.has(line.by ?? ''));
@@ -69,19 +65,26 @@ export const standingAt = async (name, place, devicesOf, isHistory, signal) => {
     return unfolded === undefined ? { lines: [...folded.lines, ...own] }
         : { refused: `REFUSE·standing ${unfolded.by} attests ${key(unfolded)} more than once, withdrawn, or beside the place's own line: folding a device key's lines is bound's, and bound publishes no view of it` };
 };
-const lotFile = (lines) => ((at) => { writeFileSync(at, `${lines.join('\n')}\n`); return at; })(join(mkdtempSync(join(tmpdir(), 'head-lot-')), 'lot.bound'));
-export const sign = async (name, place, lot, key, signer, env, signal) => ((got) => (got !== undefined && got.code === 0 ? { lines: got.out.filter((line) => parse(line).kind === 'fact') } : { refused: why(got) ?? '' }))(await run(name, place, [words.sign, lotFile(lot), words.key, key, words.signer, signer], env, signal));
+const lotFile = (lines) => scratchOf('head-lot-', 'lot.bound', `${lines.join('\n')}\n`);
+const through = (place, verb, lot, key, signer, port, signal) => signedIn(place, [verb, ...(key ? [words.key, key, words.signer, signer] : [])], lot, new Map(key && port ? [[key, { name: signer, sign: port }]] : []), key, signal).then(apart);
+export const sign = async (_name, place, lot, key, signer, port, signal) => ((got) => (got !== undefined && got.code === 0 ? { lines: got.out.filter((line) => parse(line).kind === 'fact') } : { refused: why(got) ?? '' }))(await through(place, words.sign, lot, key, signer, port, signal));
 /** A lot signed and landed in one process, its result read from what bound printed of the committed act: the records it admitted, never the receipt beside them; a place that declares no act result is refused by name. */
 /** A place's receipts rendered beside its lock, so bound alone checks the place: nothing when they closed, else why they did not. */
 export const closing = async (name, place, signal) => ((got) => (got !== undefined && got.code === 0 ? undefined : why(got) ?? 'nothing printed'))(await run(name, place, [words.read, words.view, words.receipts], {}, signal));
-export const landAct = async (name, place, lot, key, signer, env, signal) => ((got) => {
+/** A place's own lines in the person's words, beside its lock, the text they read and share: each line head lands at the person's at, drafted with no signature, gone with its withdraw. Bound reads the file as it reads the place, so it is written with the land, never while a fold runs. Set from head's lock. */
+export const birth = { at: '', file: '' }, birthed = (place, lot) => {
+    const [file, mine] = [join(place, birth.file), factsOf(lot).filter((l) => birth.file && l['at']?.startsWith(birth.at))], bare = (l) => JSON.stringify(Object.entries(l).filter(([k]) => !['about', 'value', 'sig', 'epoch', 'by'].includes(k)).sort());
+    if (mine.length)
+        writeFileSync(file, [...(existsSync(file) ? factsOf(readFileSync(file, 'utf8').split('\n')) : []).filter((k) => !mine.some((m) => bare(m) === bare(k))), ...mine.filter((m) => m['value'] !== 'withdraw')].map(({ sig: _sig, epoch: _epoch, ...l }) => `${canonical({ ...l, by: 'target' })}\n`).join(''));
+};
+export const landAct = async (_name, place, lot, key, signer, port, signal) => ((got) => {
     if (got === undefined || got.code !== 0)
         return { refused: why(got) ?? '' };
     const at = got.out.findIndex((line) => line.startsWith(words.act));
     return at < 0 ? { refused: `REFUSE·act bound printed no act result, and the place declares ${words.profile}: what was admitted is bound's to say` }
-        : { lines: got.out.slice(at + 1).filter((line) => parse(line).kind === 'fact').slice(0, -1) };
-})(await run(name, place, [words.land, lotFile(lot), words.key, key, words.signer, signer], env, signal));
-export const land = async (name, place, signed, signal) => ((got) => (got !== undefined && got.code === 0 ? { lines: signed } : { refused: why(got) ?? '' }))(await run(name, place, [words.land, lotFile(signed)], {}, signal));
+        : (birthed(place, lot), { lines: got.out.slice(at + 1).filter((line) => parse(line).kind === 'fact').slice(0, -1) });
+})(await through(place, words.land, lot, key, signer, port, signal));
+export const land = async (_name, place, signed, signal) => ((got) => (got !== undefined && got.code === 0 ? (birthed(place, signed), { lines: signed }) : { refused: why(got) ?? '' }))(await through(place, words.land, signed, undefined, undefined, undefined, signal));
 export const told = async (name, place, signed, view, signal) => ((got) => [...(got?.out ?? []), ...(got?.err ?? [])])(await run(name, place, [words.read, words.view, view, lotFile(signed)], {}, signal));
 export const pinnedAt = async (name, place, file, signal) => {
     const printed = await run(name, place, [words.read, file], {}, signal);
@@ -92,6 +95,6 @@ export const pinnedAt = async (name, place, file, signal) => {
     const bytes = printed.out.filter((line) => line.startsWith(words.topos)).map((line) => `${line.slice(words.topos.length)}\n`).join('');
     return pin === undefined || !bytes ? undefined : { pin, bytes, lines: read.lines };
 };
-export const founded = async (name, place, key, signer, env, signal) => ((got) => (got !== undefined && got.code === 0 ? { lines: got.out } : { refused: why(got) ?? '' }))(await run(name, place, [words.land, words.key, key, words.signer, signer], env, signal));
+export const founded = async (_name, place, key, signer, port, signal) => ((got) => (got !== undefined && got.code === 0 ? (birthed(place, readFileSync(join(place, LOCK), 'utf8').split('\n')), { lines: got.out }) : { refused: why(got) ?? '' }))(await through(place, words.land, undefined, key, signer, port, signal));
 export const words = { read: '', view: '', sign: '', land: '', key: '', signer: '', pin: '', topos: '', standing: '', evidence: '', act: '', profile: '', receipts: '', refusal: '', identity: '' };
 export const settledView = async (name, place, view, signal) => readOf(await run(name, place, [words.read, words.view, view], {}, signal));

package/dist/src/ports/host.d.ts

@@ -0,0 +1,35 @@
+import type { NativeHostOptions } from '@lapxo/bound/host';
+import type { Printed } from './process.ts';
+import { type Said } from '../core/lock.ts';
+/** What a place's fold host is held to, from head's lock: the installed instrument it must be, how long it stays idle and lives, and its limits. */
+export declare const hosting: {
+    installed: string;
+    idle: number;
+    life: number;
+    wait: number;
+    bytes: number;
+    heap: number;
+    queued: number;
+    http: NativeHostOptions["http"];
+};
+/** Receiver permissions and work budgets are declared by head's own lock, never inferred from a redirect. */
+export declare const configureHost: (lock: readonly Said[], bounds: {
+    readonly wait: number;
+    readonly most: number;
+}) => void;
+/** Every host closed, its scratch removed with it: whenever a caller asks, and when head ends, its scratch then removed at once, whatever its host is still doing. */
+export declare const cooled: () => void;
+/** The process a place's fold host runs as, while one is held for it. */
+export declare const hostOf: (place: string) => number | undefined;
+/**
+ * A read of a place's view through the place's own fold host, which only folds and never holds a signer: started on the first
+ * read, kept while it is asked within its idle and its life, the installed bound checked file by file before every call.
+ * A refusal, an error or a changed instrument closes it, and the next read starts another.
+ */
+export declare const hosted: (place: string, args: readonly string[], signal?: AbortSignal, from?: string) => Promise<Printed>;
+/**
+ * A sign or a land in a host of its own, started for this one call with the signers the lock names and closed once it
+ * answers: the signer never outlives the call it signed for. The place's fold host is closed first, a place having one
+ * host at a time; the lot goes in as the host's input, never a file of head's.
+ */
+export declare const signedIn: (place: string, args: readonly string[], lot: readonly string[] | undefined, signers: NonNullable<NativeHostOptions["signers"]>, keyId?: string, signal?: AbortSignal, from?: string) => Promise<Printed>;

package/dist/src/ports/host.js

@@ -0,0 +1,108 @@
+import { createHash } from 'node:crypto';
+import { mkdtempSync, readdirSync, readFileSync, realpathSync, rmSync, statSync } from 'node:fs';
+import { createRequire } from 'node:module';
+import { tmpdir } from 'node:os';
+import { dirname, join, relative, sep } from 'node:path';
+import { installedHostInstrument, nativeHostEnvironment, startNativeHost } from '@lapxo/bound/host';
+import { members, valueOf } from "../core/lock.js";
+/** What a place's fold host is held to, from head's lock: the installed instrument it must be, how long it stays idle and lives, and its limits. */
+export const hosting = { installed: '', idle: 0, life: 0, wait: 0, bytes: 0, heap: 0, queued: 0, http: undefined };
+/** Receiver permissions and work budgets are declared by head's own lock, never inferred from a redirect. */
+export const configureHost = (lock, bounds) => { Object.assign(hosting, { installed: valueOf(lock, 'dep/bound/installed'), wait: bounds.wait, bytes: bounds.most, ...Object.fromEntries(['idle', 'life', 'heap', 'queued'].map((k) => [k, Number(valueOf(lock, `bound/host/${k}`).split('..')[1])])), http: { origins: members(valueOf(lock, 'bound/receiver/origins')), redirects: { maxRedirects: Number(valueOf(lock, 'bound/receiver/redirects').split('..')[1]), headerBytes: Number(valueOf(lock, 'bound/receiver/header-bytes').split('..')[1]) } } }); };
+const root = dirname(createRequire(import.meta.url).resolve('@lapxo/bound/package.json'));
+const walk = (at) => (statSync(at).isDirectory() ? readdirSync(at).flatMap((e) => walk(join(at, e))) : [at]);
+/** Every file of the installed bound by its coordinate and digest: what its identity is computed from, and what is checked again before each call. */
+const inventory = (at) => walk(at).map((f) => ({ coordinate: relative(at, f).split(sep).join('/'), digest: `sha256:${createHash('sha256').update(readFileSync(f)).digest('hex')}` })).sort((a, b) => (a.coordinate < b.coordinate ? -1 : 1));
+/** The hosts held, those starting, those closing — a place gets its next host once its last one is gone — and the folders head made for their scratch, each removed once its host is. */
+const [live, starting, closing, scratches] = [new Map(), new Map(), new Map(), new Set()];
+const cleared = (dir) => { rmSync(dir, { recursive: true, force: true }); scratches.delete(dir); };
+const shut = (at) => { const one = live.get(at); live.delete(at); if (one) {
+    clearTimeout(one.idle);
+    closing.set(at, one.host.close().catch(() => undefined).finally(() => { cleared(one.scratch); closing.delete(at); }));
+} };
+/** Every host closed, its scratch removed with it: whenever a caller asks, and when head ends, its scratch then removed at once, whatever its host is still doing. */
+export const cooled = () => { for (const at of [...live.keys()])
+    shut(at); };
+/** The process a place's fold host runs as, while one is held for it. */
+export const hostOf = (place) => live.get(realpathSync(place))?.host.pid;
+process.once('exit', () => { cooled(); for (const dir of [...scratches])
+    cleared(dir); });
+/** A host started on a place, on the installed instrument the lock pins and in a scratch folder of head's own; with signers only for one call's sign or land. */
+const opened = async (at, from, signers) => {
+    const members = inventory(from), instrument = installedHostInstrument({ directory: from, shape: 'package', members, exports: [['exports', './engine', 'default']], pins: [], limits: { members: 4096, bytes: 1 << 27, responseBytes: 1 << 22 } }, join(from, 'dist/cli/verb.js'));
+    const scratch = mkdtempSync(join(tmpdir(), 'head-host-'));
+    scratches.add(scratch);
+    const host = await startNativeHost({ place: at, instrument, expectedInstrument: hosting.installed, environment: nativeHostEnvironment({ ...process.env }), scratchParent: scratch, ...(hosting.http ? { http: hosting.http } : {}), ...(signers ? { signers } : {}), limits: { requestBytes: hosting.bytes, responseBytes: hosting.bytes, timeoutMs: hosting.wait, heapMiB: hosting.heap, queuedRequests: hosting.queued } }).catch((e) => { cleared(scratch); throw e; });
+    return { host, members: JSON.stringify(members), born: Date.now(), scratch, busy: 0 };
+};
+const started = async (at, from) => ((one) => (live.set(at, one), one))(await opened(at, from));
+const lines = (text) => text.split('\n').filter(Boolean), refused = (why) => ({ code: -1, out: [], err: [why] });
+/**
+ * A read of a place's view through the place's own fold host, which only folds and never holds a signer: started on the first
+ * read, kept while it is asked within its idle and its life, the installed bound checked file by file before every call.
+ * A refusal, an error or a changed instrument closes it, and the next read starts another.
+ */
+export const hosted = async (place, args, signal, from = root) => {
+    if (args[0] !== 'fold')
+        return refused(`REFUSE·host a place's fold host only folds, and never holds a signer: ${args[0]} goes to a process of its own`);
+    const at = realpathSync(place), was = live.get(at);
+    if (was !== undefined && Date.now() - was.born > hosting.life * 1000)
+        shut(at);
+    let one;
+    try {
+        await closing.get(at);
+        one = live.get(at) ?? await (starting.get(at) ?? ((p) => (starting.set(at, p), p))(started(at, from).finally(() => starting.delete(at))));
+    }
+    catch (e) {
+        return refused(e.message);
+    }
+    if (JSON.stringify(inventory(from)) !== one.members) {
+        shut(at);
+        return refused(`REFUSE·host the installed bound changed after its host started, so it is no longer ${hosting.installed}: the host is closed, and nothing was read`);
+    }
+    clearTimeout(one.idle);
+    one.busy += 1;
+    try {
+        const got = await one.host.request({ verb: 'fold', args: args.slice(1) }, signal);
+        if (got.status !== 0)
+            shut(at);
+        return { code: got.status, out: lines(got.stdout), err: lines(got.stderr) };
+    }
+    catch (e) {
+        shut(at);
+        return refused(e.message);
+    }
+    finally {
+        one.busy -= 1;
+        if (one.busy === 0 && live.get(at) === one)
+            one.idle = setTimeout(() => shut(at), hosting.idle * 1000).unref();
+    }
+};
+/**
+ * A sign or a land in a host of its own, started for this one call with the signers the lock names and closed once it
+ * answers: the signer never outlives the call it signed for. The place's fold host is closed first, a place having one
+ * host at a time; the lot goes in as the host's input, never a file of head's.
+ */
+export const signedIn = async (place, args, lot, signers, keyId, signal, from = root) => {
+    const at = realpathSync(place);
+    shut(at);
+    await closing.get(at);
+    let one;
+    try {
+        one = await opened(at, from, signers);
+    }
+    catch (e) {
+        return refused(e.message);
+    }
+    try {
+        const got = await one.host.request({ verb: args[0], args: [...(lot ? ['@input/lot.bound'] : []), ...args.slice(1)], ...(lot ? { inputs: [{ name: 'lot.bound', text: `${lot.join('\n')}\n` }] } : {}), ...(keyId ? { signer: keyId } : {}) }, signal);
+        return { code: got.status, out: lines(got.stdout), err: lines(got.stderr) };
+    }
+    catch (e) {
+        return refused(e.message);
+    }
+    finally {
+        await one.host.close().catch(() => undefined);
+        cleared(one.scratch);
+    }
+};

package/dist/src/ports/keychain.d.ts

@@ -2,7 +2,19 @@ export interface KeyStore {
     readonly read: (account: string) => string | undefined;
     readonly write: (account: string, secret: string) => void;
     readonly made?: (account: string) => string | undefined;
+    readonly held?: (account: string) => string | undefined;
 }
 export declare const plain: (word: string) => string;
-/** The secret store this host keeps head's keys in, by the name its lock gives the platform's: one adapter each, every secret crossing a command's stdin and stdout only; a key it is asked for by its account is made there once, and only its public half handed on. */
-export declare const keychain: (service: string, kind: string) => KeyStore;
+/** The secret store this host keeps head's keys in, by the name its lock gives the platform's: one adapter each, every secret crossing a command's stdin and stdout only. Only head's signer opens it for a signing key. */
+export declare const secretsOf: (service: string, kind: string) => KeyStore;
+/** The store head's long process is handed: a signing account is refused by name before any command starts, and its key is made, or its public half read, in head's signer, never here; the secrets of access stay this process's, since it calls their APIs. */
+export declare const keychain: (service: string, kind: string, signing: (account: string) => string | undefined) => KeyStore;
+/** The signing port a host calls for one lot: head's signer started with the key's names alone and the lot on its stdin, within the wait the lock gives bound; what it prints are the signatures, read as the signing-lot contract reads them. */
+export declare const portOf: (service: string, account: string, kind: string, wait: number) => (lot: {
+    readonly bytes: readonly string[];
+    readonly keyId: string;
+    readonly algorithm: string;
+}, signal: AbortSignal) => Promise<readonly {
+    readonly keyId: string;
+    readonly signature: string;
+}[]>;

package/dist/src/ports/keychain.js

@@ -1,12 +1,24 @@
+import { execFileSync } from 'node:child_process';
+import { fileURLToPath } from 'node:url';
+import { signerResponseOf } from '@lapxo/topos/wire';
+import { spawned } from "./process.js";
 import { store as credentialManager } from "./stores/credential-manager.js";
 import { store as keychainOfMac } from "./stores/keychain.js";
 import { store as secretTool } from "./stores/secret-tool.js";
-import { newKey, publicOf } from "./keys.js";
 export const plain = (word) => { if (!/^[\w.@/+=-]+$/.test(word))
     throw Error('REFUSE·keychain a name holds more than word characters'); return word; };
-/** The secret store this host keeps head's keys in, by the name its lock gives the platform's: one adapter each, every secret crossing a command's stdin and stdout only; a key it is asked for by its account is made there once, and only its public half handed on. */
-export const keychain = (service, kind) => ((made) => {
-    if (made === undefined)
-        throw Error(`REFUSE·keychain ${kind} is no store head carries`);
-    return ((store) => ({ ...store, made: (account) => ((secret) => secret && publicOf(secret))(store.read(account) ?? ((key) => { store.write(account, key.secret); return store.read(account) === key.secret ? key.secret : undefined; })(newKey())) }))(made(service));
-})({ keychain: keychainOfMac, 'secret-tool': secretTool, 'credential-manager': credentialManager }[kind]);
+/** The secret store this host keeps head's keys in, by the name its lock gives the platform's: one adapter each, every secret crossing a command's stdin and stdout only. Only head's signer opens it for a signing key. */
+export const secretsOf = (service, kind) => ((made) => { if (made === undefined)
+    throw Error(`REFUSE·keychain ${kind} is no store head carries`); return made(service); })({ keychain: keychainOfMac, 'secret-tool': secretTool, 'credential-manager': credentialManager }[kind]);
+const signer = fileURLToPath(new URL(`../signer${import.meta.url.slice(import.meta.url.lastIndexOf('.'))}`, import.meta.url)), half = (mode, service, account, kind) => { try {
+    return execFileSync(process.execPath, [signer, mode, service, plain(account), kind], { encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'] }) || undefined;
+}
+catch {
+    return undefined;
+} };
+/** The store head's long process is handed: a signing account is refused by name before any command starts, and its key is made, or its public half read, in head's signer, never here; the secrets of access stay this process's, since it calls their APIs. */
+export const keychain = (service, kind, signing) => ((keys, guard) => ({ read: (account) => keys.read(guard(account)), write: (account, secret) => keys.write(guard(account), secret), made: (account) => half('make', service, account, kind), held: (account) => half('exists', service, account, kind) }))(secretsOf(service, kind), (account) => ((key) => { if (key !== undefined)
+    throw Error(`REFUSE·keychain ${key} names a signing key: only head's signer reads it`); return account; })(signing(account)));
+/** The signing port a host calls for one lot: head's signer started with the key's names alone and the lot on its stdin, within the wait the lock gives bound; what it prints are the signatures, read as the signing-lot contract reads them. */
+export const portOf = (service, account, kind, wait) => async (lot, signal) => ((got) => { if (got.code !== 0)
+    throw Error(`REFUSE·signer head's signer did not sign for ${lot.keyId}`); return signerResponseOf(`${got.out.join('\n')}\n`, lot); })(await spawned(process.execPath, [signer, service, plain(account), lot.keyId, lot.algorithm, kind], { input: `${lot.bytes.join('\n')}\n` }, { wait, most: 1 << 20, signal }));

package/dist/src/ports/scratch.d.ts

@@ -0,0 +1,4 @@
+/** A file one bound run reads, in a folder of its own under this device's temporary folder, kept only until that run ends. */
+export declare const scratchOf: (prefix: string, name: string, text: string) => string;
+/** The folders made for what a run read, removed once it ended, however it ended; any other path is left as it is. */
+export declare const cleared: (paths: readonly string[]) => void;

package/dist/src/ports/scratch.js

@@ -0,0 +1,10 @@
+import { mkdtempSync, rmSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { dirname, join } from 'node:path';
+const made = new Set();
+/** A file one bound run reads, in a folder of its own under this device's temporary folder, kept only until that run ends. */
+export const scratchOf = (prefix, name, text) => ((dir) => { made.add(dir); writeFileSync(join(dir, name), text); return join(dir, name); })(mkdtempSync(join(tmpdir(), prefix)));
+/** The folders made for what a run read, removed once it ended, however it ended; any other path is left as it is. */
+export const cleared = (paths) => { for (const at of paths)
+    if (made.delete(dirname(at)))
+        rmSync(dirname(at), { recursive: true, force: true }); };

package/dist/src/signer.js

@@ -1,13 +1,14 @@
 #!/usr/bin/env node
 import { readFileSync } from 'node:fs';
-import { signLot } from "./ports/keys.js";
-import { keychain } from "./ports/keychain.js";
-const [service = '', account = '', key = '', algorithm = '', store = 'keychain'] = process.argv.slice(2);
-const secret = keychain(service, store).read(account);
-if (secret === undefined)
-    process.exit(1);
+import { newKey, publicOf, signLot } from "./ports/keys.js";
+import { secretsOf } from "./ports/keychain.js";
+/** The one process that reads a signing secret, and it prints a public half at most: `make` keeps a key made once, `exists` says whether one is kept, else it signs the lot on stdin. */
+const [first = '', ...rest] = process.argv.slice(2), half = first === 'make' || first === 'exists', [service = '', account = '', key = '', algorithm = '', store = 'keychain'] = half ? [rest[0], rest[1], '', '', rest[2]] : [first, ...rest], keys = secretsOf(service, store);
+const kept = keys.read(account) ?? (first === 'make' ? ((made) => { keys.write(account, made.secret); return keys.read(account) === made.secret ? made.secret : undefined; })(newKey()) : undefined);
+if (kept === undefined)
+    process.exit(half ? 3 : 1);
 try {
-    process.stdout.write(signLot(readFileSync(0, 'utf8'), secret, key, algorithm));
+    process.stdout.write(half ? publicOf(kept) : signLot(readFileSync(0, 'utf8'), kept, key, algorithm));
 }
 catch {
     process.exit(1);

package/dist/src/tools/card.js

@@ -1,13 +1,10 @@
-import { inPlace, printedOr, standingOr } from "../core/answer.js";
+import { inStanding, printedOr } from "../core/answer.js";
 import { members, valueOf } from "../core/lock.js";
 import { sayIn } from "../core/surface.js";
 /** What is open for a key: the cells view the place's standing declares, as bound folded it at the resolution asked, narrowed to the key; a refused fold is said, never read as no view. The standing is the one the card was read off, folded once a call. */
-export const answer = (asked, context) => inPlace(asked, context, async (place) => {
+export const answer = (asked, context) => inStanding(asked, context, async (place, lines) => {
     const word = (scope) => valueOf(context.lock, `bound/${scope}`);
-    const held = await standingOr(context, place);
-    if ('said' in held)
-        return held.said;
-    const view = held.lines.find((f) => f.scope?.startsWith('view/') && !f.shape && members(f.value ?? '').includes(word('cells')));
+    const view = lines.find((f) => f.scope?.startsWith('view/') && !f.shape && members(f.value ?? '').includes(word('cells')));
     if (view === undefined)
         return [sayIn(context.lock)('no-cells', { place })];
     return printedOr(context, await context.bound(place, [word('read'), word('view'), `${view.scope.split('/')[1]}${asked['at'] ? `${word('at')}${asked['at']}` : ''}`, ...(asked['key'] ? [word('key'), asked['key']] : [])]));