@lapxo/head 0.1.6 → 0.1.7

package/dist/src/access/contract.d.ts

@@ -52,10 +52,8 @@ export interface Want {
     readonly values: readonly string[];
     readonly host: Readonly<Record<string, string>>;
     readonly enter: (title: string, fields: readonly Field[]) => Promise<Held | undefined>;
-    readonly consent: (message: string) => Promise<boolean>;
     readonly choose: (message: string, choices: readonly Choice[]) => Promise<Held | undefined>;
     readonly visit: (message: string, to: (back: string) => string | undefined | Promise<string | undefined>) => Promise<Held | undefined>;
-    readonly form: (source: string, operation: string) => Fields;
     readonly call: (source: string, operation: string, body: unknown, attachment?: Attachment) => Promise<Answered>;
     readonly post: (url: string, body: Readonly<Record<string, unknown>>, as?: 'form' | 'json') => Promise<Answered>;
 }

package/dist/src/access/obtain.js

@@ -1,7 +1,7 @@
 import { canonical } from '@lapxo/topos/wire';
 import { jsonOf } from "./contract.js";
 import { placeNameOf } from "../core/answer.js";
-import { aboutOf, members, valueOf } from "../core/lock.js";
+import { members, valueOf } from "../core/lock.js";
 import { fieldsOf, stepOf, vocabOf } from "../core/read.js";
 export const sealed = (got) => Buffer.from(JSON.stringify(got)).toString('base64url');
 export const opened = (kept) => { try {
@@ -55,8 +55,8 @@ export const attachmentFor = async (context, place, lines, plan) => {
         values: members(valueOf(lines, 'wire/access-values') || valueOf(context.lock, 'wire/access-values')),
         host: Object.fromEntries(context.lock.filter((l) => l.scope?.startsWith('host/')).map((l) => [l.scope.slice('host/'.length), l.value ?? ''])),
         scopes: [...new Set(lines.filter((l) => reads.has(l.scope) && l.measure === 'scopes').flatMap((l) => (l.value ?? '').split('|')))].sort(),
-        enter: (title, fields) => context.person.enter(title, fields), consent: async (message) => (await context.person.consent(message, aboutOf(context.lock, 'said/elicit/yes'))) === 'yes', choose: (message, choices) => context.person.choose(message, choices), visit: (message, to) => context.person.visit(message, to),
-        form: (source, operation) => fieldsOf(lines, `${v.offers}/${source}/${operation}/${v.form}`), call: step,
+        enter: (title, fields) => context.person.enter(title, fields), choose: (message, choices) => context.person.choose(message, choices), visit: (message, to) => context.person.visit(message, to),
+        call: step,
         post: async (url, body, as) => ((transport) => (transport === undefined ? undefined : transport.post(url, body, most, Number(valueOf(context.lock, 'adapter/request/wait').split('..')[1]), as)))(await context.adapter(url)),
     };
     const got = await adapter.obtain(want);

package/dist/src/ahead/budget.d.ts

@@ -4,3 +4,7 @@ import type { Said } from '../core/lock.ts';
 export declare const overOf: (lines: readonly Said[], [family, at, mark]: readonly [string, string, string], source: string, now: number, rate: number, share: number, asked: Asked) => boolean;
 /** The mark a read made ahead lands beside its receipt, under the receipt's own at, so what reads ahead spent is counted apart from what questions spent. */
 export declare const markOf: (asked: Asked, [at, mark]: readonly [string, string], scope: string, digest: string, when: string) => readonly string[];
+/** When the window a ceiling's own measure names, `<unit>/R/<start>/P<n>D` or `…/PT<n>H` (ISO 8601), began around an instant handed in; undefined where the measure names no window. */
+export declare const windowOf: (window: string, now: number) => number | undefined;
+/** The calls a ceiling's window holds at an instant: its receipts since that window began, a read ahead's mark apart; undefined where the measure names no window. */
+export declare const calledIn: (lines: readonly Said[], [family, at, mark]: readonly [string, string, string], source: string, window: string, now: number) => number | undefined;

package/dist/src/ahead/budget.js

@@ -9,3 +9,11 @@ export const overOf = (lines, [family, at, mark], source, now, rate, share, aske
 };
 /** The mark a read made ahead lands beside its receipt, under the receipt's own at, so what reads ahead spent is counted apart from what questions spent. */
 export const markOf = (asked, [at, mark], scope, digest, when) => early(asked) ? [canonical({ at: `${at}:${when}`, by: 'target', form: 'alphabet', measure: 'digest', role: 'writes', scope: `${scope}/${mark}`, value: digest })] : [];
+/** When the window a ceiling's own measure names, `<unit>/R/<start>/P<n>D` or `…/PT<n>H` (ISO 8601), began around an instant handed in; undefined where the measure names no window. */
+export const windowOf = (window, now) => {
+    const [, start, days, hours] = /^[^/]+\/R\/([^/]+)\/P(?:(\d+)D|T(\d+)H)$/.exec(window) ?? [], [from, period] = [Date.parse(start ?? ''), (Number(days ?? 0) * 24 + Number(hours ?? 0)) * 3_600_000];
+    return Number.isNaN(from) || !period ? undefined : from + Math.floor((now - from) / period) * period;
+};
+/** The calls a ceiling's window holds at an instant: its receipts since that window began, a read ahead's mark apart; undefined where the measure names no window. */
+export const calledIn = (lines, [family, at, mark], source, window, now) => ((since) => (since === undefined ? undefined
+    : lines.filter((l) => l.scope?.startsWith(`${family}/${source}/`) && !l.scope.endsWith(`/${mark}`) && l.at?.startsWith(`${at}:`) && Date.parse(l.at.slice(at.length + 1)) >= since).length))(windowOf(window, now));

package/dist/src/claims/claim.d.ts

@@ -5,5 +5,6 @@ import { type Asked, type Context } from '../core/answer.ts';
  * it, with who carried it here as the client says it is. Taken back by the same words: what a person attests is evidence, and
  * stands for good, so taking it back is attesting that, beside it. A place whose lines admit no carrier is handed the line that does.
  * Only this action keeps one, never a cell, an answer or a read ahead, so nothing the model concluded becomes the person's.
+ * What an agent states is kept as an agent's, never asked as the person's: head's key signs it, at an agent's origin, where the root admitted one.
  */
 export declare const claimed: (asked: Asked, context: Context) => Promise<readonly string[]>;

package/dist/src/claims/claim.js

@@ -1,7 +1,7 @@
 import { createHash } from 'node:crypto';
 import { canonical } from '@lapxo/topos/wire';
-import { inPlace, standingOr, unless } from "../core/answer.js";
-import { uncoveredIn } from "../core/device.js";
+import { inStanding, unless } from "../core/answer.js";
+import { idIn, uncoveredIn } from "../core/device.js";
 import { aboutOf, members, valueOf } from "../core/lock.js";
 import { fill, sayIn } from "../core/surface.js";
 /** Whether the person said, in this conversation, that what they state in a place is kept as theirs: asked once a place, a no kept as a yes is. */
@@ -12,29 +12,29 @@ const answered = new Map();
  * it, with who carried it here as the client says it is. Taken back by the same words: what a person attests is evidence, and
  * stands for good, so taking it back is attesting that, beside it. A place whose lines admit no carrier is handed the line that does.
  * Only this action keeps one, never a cell, an answer or a read ahead, so nothing the model concluded becomes the person's.
+ * What an agent states is kept as an agent's, never asked as the person's: head's key signs it, at an agent's origin, where the root admitted one.
  */
-export const claimed = (asked, context) => inPlace(asked, context, async (place) => {
-    const [say, word, said, held] = [sayIn(context.lock), (k) => valueOf(context.lock, k), (asked['said'] ?? '').trim(), await standingOr(context, place)];
-    if ('said' in held)
-        return held.said;
+export const claimed = (asked, context) => inStanding(asked, context, async (place, lines) => {
+    const [say, word, said] = [sayIn(context.lock), (k) => valueOf(context.lock, k), (asked['said'] ?? '').trim()];
     if (!said)
         return [say('missing-param', { operation: 'claim', param: 'said' })];
     const [family, withdraw, back] = [`${word('claim/family')}/${createHash('sha256').update(said).digest('hex').slice(0, 16)}`, asked['withdraw'] === 'true', word('claim/withdrawn')];
-    const standing = held.lines.filter((l) => l.scope?.startsWith(`${family}/`) && !l.scope.endsWith(`/${back}`) && !held.lines.some((w) => w.scope === `${l.scope}/${back}`)).map((l) => l.scope);
+    const [agent, at, role] = asked['origin'] === word('claim/agent') ? [true, word('claim/agent/at'), 'head'] : [false, word('claim/at'), 'person'];
+    const standing = lines.filter((l) => l.at === at && l.scope?.startsWith(`${family}/`) && !l.scope.endsWith(`/${back}`) && !lines.some((w) => w.scope === `${l.scope}/${back}`)).map((l) => l.scope);
     if (withdraw && !standing.length)
         return [say('claim-none', { place, said })];
-    const wire = held.lines.find((l) => l.scope === 'wire/fields'), via = word('claim/via');
+    const wire = lines.find((l) => l.scope === 'wire/fields'), via = word('claim/via');
     const bare = wire && Object.fromEntries(Object.entries(wire).filter(([k]) => !['sig', 'epoch', 'about'].includes(k)));
     if (bare && !members(wire.value ?? '').includes(via))
         return [say('claims-unadmitted', { place, lines: [canonical({ ...bare, by: 'target', value: 'withdraw' }), canonical({ ...bare, by: 'target', at: `policy:head/wire/${new Date(context.now()).toISOString()}`, value: `${wire.value}|${via}` })].join('\n') })];
-    const line = (scope) => canonical({ about: said, at: word('claim/at'), by: 'target', form: 'alphabet', measure: 'text', role: 'writes', scope, value: 'lock', [via]: context.client() ?? word('claim/via-unknown') });
-    const lot = withdraw ? standing.map((scope) => line(`${scope}/${back}`)) : [line(`${family}/${new Date(context.now()).toISOString().replace(/\D/g, '')}`)], outside = uncoveredIn(context.lock, held.lines, context.device('person'), place, lot);
+    const line = (scope) => canonical({ about: said, at, by: 'target', form: 'alphabet', measure: 'text', role: 'writes', scope, value: 'lock', [via]: context.client() ?? word('claim/via-unknown') });
+    const lot = withdraw ? standing.map((scope) => line(`${scope}/${back}`)) : [line(`${family}/${new Date(context.now()).toISOString().replace(/\D/g, '')}`)], outside = uncoveredIn(context.lock, lines, context.device(role), place, lot);
     if (outside)
-        return outside;
-    if (!withdraw && !answered.has(place))
+        return agent ? [say('agent-unadmitted', { place, lines: canonical({ at: word('claim/agent/admit'), by: 'target', form: 'alphabet', measure: 'coverage', role: 'writes', scope: `keys/${idIn(lines, context.device(role))}`, value: `${word('claim/family')}/**` }) })] : outside;
+    if (!agent && !withdraw && !answered.has(place))
         answered.set(place, (await unless(context, fill(aboutOf(context.lock, 'said/elicit-claims'), { place }))) === undefined);
-    if (!withdraw && !answered.get(place))
+    if (!agent && !withdraw && !answered.get(place))
         return [say('claims-declined', { place, said })];
-    const landed = await context.landAs(place, lot, 'person', held.lines);
-    return 'refused' in landed ? [say('not-landed', { why: landed.refused })] : [say(withdraw ? 'unclaimed' : 'claimed', { place, said }), ...landed.lines];
+    const landed = await context.landAs(place, lot, role, lines);
+    return 'refused' in landed ? [say('not-landed', { why: landed.refused })] : [say(withdraw ? 'unclaimed' : agent ? 'agent-claimed' : 'claimed', { place, said }), ...landed.lines];
 });

package/dist/src/claims/view.d.ts

@@ -0,0 +1,3 @@
+import { type Asked, type Context } from '../core/answer.ts';
+/** What a place keeps of what was stated, each standing statement with its origin and who else stated the same words: nobody, where only the one who carried it did. */
+export declare const viewed: (asked: Asked, context: Context) => Promise<readonly string[]>;

package/dist/src/claims/view.js

@@ -0,0 +1,11 @@
+import { inStanding } from "../core/answer.js";
+import { valueOf } from "../core/lock.js";
+import { sayIn } from "../core/surface.js";
+/** What a place keeps of what was stated, each standing statement with its origin and who else stated the same words: nobody, where only the one who carried it did. */
+export const viewed = (asked, context) => inStanding(asked, context, async (place, lines) => {
+    const [say, word] = [sayIn(context.lock), (k) => valueOf(context.lock, k)], [family, back, via] = [word('claim/family'), word('claim/withdrawn'), word('claim/via')];
+    const origin = (l) => (l.at === word('claim/agent/at') ? word('claim/agent') : l.at === word('claim/at') ? word('claim/person') : undefined), words = (l) => l.scope.split('/')[1];
+    const kept = lines.filter((l) => origin(l) !== undefined && l.scope?.startsWith(`${family}/`) && !l.scope.endsWith(`/${back}`) && !lines.some((w) => w.scope === `${l.scope}/${back}`));
+    const by = (l) => [...new Set(kept.filter((o) => words(o) === words(l) && origin(o) !== origin(l)).map(origin))].join(', ');
+    return kept.length ? kept.map((l) => say(by(l) ? 'claim-backed' : 'claim-alone', { origin: origin(l), said: l.about, carrier: l[via] ?? word('claim/via-unknown'), backers: by(l) })) : [say('claims-none', { place })];
+});

package/dist/src/compile/pin.d.ts

@@ -9,6 +9,13 @@ export type Pinned = {
     readonly open?: true;
     readonly dropped?: true;
 };
+export declare const pinnedAs: (context: Context, place: string, file: string, lines: readonly string[]) => Promise<{
+    readonly pin: string;
+    readonly bytes: string;
+    readonly lines: readonly Said[];
+} | {
+    readonly refused: string;
+} | undefined>;
 /**
  * A source pinned in a place: compiled once per digest of what it read — the place's other pins and what was laid for it
  * — so the same input finds its compiled standing by name, and pinned from the place's store: a new pin lands with the old

package/dist/src/compile/pin.js

@@ -20,17 +20,16 @@ const compiledOf = async (context, place, source, file) => {
         return { said: [say(`document-${refused}`, { source, why: fieldsOf(compiled.lines, `${v.region}/${source}`)[v[refused]].join('; ') })], dropped: true };
     if (!mine.some((l) => l.measure === v.class && l.scope?.split('/').length === 3))
         return { said: [say('nothing-offered', { source })] };
-    return drafted(context, place, source, file, [...mine.map((l) => canonical(l)), canonical({ at: 'policy:head/connect', by: 'target', form: 'alphabet', measure: 'reads', role: 'render', scope: `${v.region}/${source}`, value: [`${v.keys}/${source}/**`, ...issued.flatMap((at) => [at, `${at}/**`]), `${v.offers}/${source}/**|read/**|${v.region}/${source}|write/**`].join('|') })]);
+    return ((pinned) => (pinned === undefined || 'refused' in pinned ? { said: [pinned === undefined ? say('nothing-offered', { source }) : say('unsettled', { source, why: pinned.refused })] } : { pin: pinned.pin, lines: pinned.lines }))(await pinnedAs(context, place, file, [...mine.map((l) => canonical(l)), canonical({ at: 'policy:head/connect', by: 'target', form: 'alphabet', measure: 'reads', role: 'render', scope: `${v.region}/${source}`, value: [`${v.keys}/${source}/**`, ...issued.flatMap((at) => [at, `${at}/**`]), `${v.offers}/${source}/**|read/**|${v.region}/${source}|write/**`].join('|') })]));
 };
-const drafted = async (context, place, source, file, lines) => {
-    const say = sayIn(context.lock), draft = file.replace(new RegExp(`${EXTENSION.replace('.', '\\.')}$`), `.draft${EXTENSION}`);
+export const pinnedAs = async (context, place, file, lines) => {
+    const draft = file.replace(new RegExp(`${EXTENSION.replace('.', '\\.')}$`), `.draft${EXTENSION}`);
     context.files.lay(place, draft, new TextEncoder().encode(`${lines.join('\n')}\n`));
     const pinned = await context.pinned(place, draft);
     context.files.drop(place, draft);
-    if (pinned === undefined || 'refused' in pinned)
-        return { said: [pinned === undefined ? say('nothing-offered', { source }) : say('unsettled', { source, why: pinned.refused })] };
-    context.files.lay(place, file, new TextEncoder().encode(pinned.bytes));
-    return { pin: pinned.pin, lines: pinned.lines };
+    if (pinned !== undefined && !('refused' in pinned))
+        context.files.lay(place, file, new TextEncoder().encode(pinned.bytes));
+    return pinned;
 };
 /**
  * A source pinned in a place: compiled once per digest of what it read — the place's other pins and what was laid for it

package/dist/src/core/answer.d.ts

@@ -100,6 +100,7 @@ export declare const standingOr: (context: Context, place: string, of?: Context[
 } | {
     readonly said: readonly string[];
 }>;
+export declare const inStanding: (asked: Asked, context: Context, then: (place: string, lines: readonly Said[]) => Promise<readonly string[]>, of?: Context["standing"]) => Promise<readonly string[]>;
 export declare const baseOf: (lines: readonly Said[]) => string;
 export declare const placeNameOf: (place: string) => string;
 export declare const within: (context: Context, place: string, at: string) => Promise<boolean>;

package/dist/src/core/answer.js

@@ -21,6 +21,7 @@ export const unless = async (context, message) => ((consent) => (consent === 'ye
 export const printedOr = (context, printed) => (printed === undefined ? [sayIn(context.lock)('unreachable')] : [...printed.out, ...printed.err]);
 /** The lines a place stands on, or what head says when bound refused to fold them: a refusal is never an empty standing. */
 export const standingOr = async (context, place, of = context.standing) => ((held) => ('refused' in held ? { said: [sayIn(context.lock)('unfolded', { place, why: held.refused })] } : held))(await of(place));
+export const inStanding = (asked, context, then, of = context.standing) => inPlace(asked, context, async (place) => ((held) => ('said' in held ? held.said : then(place, held.lines)))(await standingOr(context, place, of)));
 export const baseOf = (lines) => createHash('sha256').update(lines.map((l) => canonical(l)).sort().join('\n')).digest('hex').slice(0, 16);
 export const placeNameOf = (place) => basename(place);
 export const within = async (context, place, at) => isAbsolute(at) && [place, ...(await context.roots())].some((root) => resolve(at).startsWith(`${resolve(root)}${sep}`));

package/dist/src/core/device.d.ts

@@ -5,17 +5,17 @@ export interface Device {
     readonly signer: string;
 }
 export declare const deviceOf: (lock: readonly Said[], role?: string) => Device;
+/** The line of the lock that names a keychain account's signing key, if it keeps one: a device's by its role, or a place's root by its template. */
+export declare const signingOf: (lock: readonly Said[]) => (account: string) => string | undefined;
 /** Derive device authority from the admitted lock. */
 export declare const admissionOf: (lock: readonly Said[], publicKey: string, role?: string, as?: {
     readonly id?: string;
     readonly coverage?: string;
     readonly at?: string;
 }) => readonly string[];
-export declare const algorithmOf: (lines: readonly Said[]) => string;
 /** The id a place admits a public key under, as its own lines say: a key is who the place says it is, and a key it never admitted is no one there. */
 export declare const idIn: (lines: readonly Said[], publicKey: string | undefined) => string | undefined;
 export declare const coverageOf: (lines: readonly Said[], id: string | undefined) => readonly string[];
-export declare const covers: (lines: readonly Said[], id: string | undefined, scope: string) => boolean;
 /**
  * What head says instead of asking, when this device's key may not sign every line it would ask for in a place: what the
  * place admits it for and the first scope outside that, then the lines whoever configures the place can sign themselves.

package/dist/src/core/device.js

@@ -3,22 +3,22 @@ import { members, said, valueOf } from "./lock.js";
 import { sayIn } from "./surface.js";
 const HEAD = 'head';
 export const deviceOf = (lock, role = HEAD) => ({ account: valueOf(lock, `device/${role}/account`), service: valueOf(lock, 'device/service'), signer: valueOf(lock, `device/${role}/signer`) });
+/** The line of the lock that names a keychain account's signing key, if it keeps one: a device's by its role, or a place's root by its template. */
+export const signingOf = (lock) => ((devices, [pre = '', post = ''] = valueOf(lock, 'founding/root-account').split('{place}')) => (account) => devices.find((l) => l.value === account)?.scope ?? (account.startsWith(pre) && account.endsWith(post) && !account.slice(pre.length, account.length - post.length).includes('/') ? 'founding/root-account' : undefined))(lock.filter((l) => /^device\/[^/]+\/account$/.test(l.scope ?? '')));
 /** Derive device authority from the admitted lock. */
 export const admissionOf = (lock, publicKey, role = HEAD, as = {}) => ((id, at) => [
     ...['class', 'coverage', 'resolution', 'signer'].flatMap((measure) => ((line) => (line === undefined ? [] : [canonical({ at, by: 'target', form: line.form ?? 'alphabet', measure, role: 'writes', scope: `keys/${id}`, value: measure === 'coverage' && as.coverage ? as.coverage : line.value ?? '' })]))(said(lock, `device/${role}/${measure}`))),
     canonical({ at, by: 'target', form: 'alphabet', measure: 'public-key', role: 'writes', scope: `keys/${id}`, value: publicKey }),
 ])(as.id ?? valueOf(lock, `device/${role}/account`), as.at ?? 'policy:person/device');
-export const algorithmOf = (lines) => ((era) => (lines.find((l) => l.scope === 'wire/signature-algorithms')?.value ?? '').split('|').find((one) => one.endsWith(`:${era}`)) ?? '')(valueOf(lines, 'wire/era'));
 /** The id a place admits a public key under, as its own lines say: a key is who the place says it is, and a key it never admitted is no one there. */
 export const idIn = (lines, publicKey) => publicKey === undefined ? undefined : lines.find((l) => l.scope?.startsWith('keys/') && l.measure === 'public-key' && l.value === publicKey)?.scope.slice('keys/'.length);
 export const coverageOf = (lines, id) => id === undefined ? [] : lines.filter((l) => l.scope === `keys/${id}` && l.measure === 'coverage').flatMap((l) => members(l.value ?? ''));
-export const covers = (lines, id, scope) => coverageOf(lines, id).some((glob) => matches(glob, scope));
 /**
  * What head says instead of asking, when this device's key may not sign every line it would ask for in a place: what the
  * place admits it for and the first scope outside that, then the lines whoever configures the place can sign themselves.
  */
 export const uncoveredIn = (lock, lines, publicKey, place, lot, scopes = []) => {
-    const id = idIn(lines, publicKey);
-    const outside = [...scopes, ...lot.map((line) => ((got) => (got.kind === 'fact' ? got.value.fields['scope'] ?? '' : ''))(parse(line)))].find((scope) => !covers(lines, id, scope));
-    return outside === undefined ? undefined : [sayIn(lock)('not-covered', { place, coverage: coverageOf(lines, id).join('|') || 'nothing', scope: outside }), ...lot];
+    const coverage = coverageOf(lines, idIn(lines, publicKey));
+    const outside = [...scopes, ...lot.map((line) => ((got) => (got.kind === 'fact' ? got.value.fields['scope'] ?? '' : ''))(parse(line)))].find((scope) => !coverage.some((glob) => matches(glob, scope)));
+    return outside === undefined ? undefined : [sayIn(lock)('not-covered', { place, coverage: coverage.join('|') || 'nothing', scope: outside }), ...lot];
 };

package/dist/src/core/lock.d.ts

@@ -1,5 +1,6 @@
 export type Said = Readonly<Record<string, string>>;
 /** The lines head's own lock declares, decoded and nothing more: a withdraw has no place in it, and one there is refused, never folded here. */
+export declare const factsOf: (lines: readonly string[]) => readonly Said[];
 export declare const declaredOf: (text: string) => readonly Said[];
 export declare const said: (lock: readonly Said[], scope: string) => Said | undefined;
 export declare const valueOf: (lock: readonly Said[], scope: string) => string;

package/dist/src/core/lock.js

@@ -1,6 +1,7 @@
 import { alphabet, parse, steps } from '@lapxo/topos/wire';
 /** The lines head's own lock declares, decoded and nothing more: a withdraw has no place in it, and one there is refused, never folded here. */
-export const declaredOf = (text) => text.split('\n').flatMap((line) => ((got) => (got.kind === 'fact' ? [got.value.fields] : []))(parse(line)))
+export const factsOf = (lines) => lines.flatMap((line) => ((got) => (got.kind === 'fact' ? [got.value.fields] : []))(parse(line)));
+export const declaredOf = (text) => factsOf(text.split('\n'))
     .map((f) => { if (f.value === 'withdraw')
     throw Error(`REFUSE·lock head's own lock withdraws ${f.scope}: its lines are declared, never folded by head`); return f; });
 export const said = (lock, scope) => lock.find((f) => f.scope === scope);

package/dist/src/core/read.js

@@ -1,8 +1,7 @@
 import { alphabet } from '@lapxo/topos/wire';
 import { valueOf } from "./lock.js";
 const said = (key, fields = {}) => ({ kind: 'said', key, fields });
-const membersOf = (line) => (line === undefined ? undefined : alphabet(line.value ?? '').members);
-export const fieldsOf = (lines, scope) => Object.fromEntries(lines.filter((l) => l.scope === scope && l.measure).map((l) => [l.measure, membersOf(l) ?? []]));
+export const fieldsOf = (lines, scope) => Object.fromEntries(lines.filter((l) => l.scope === scope && l.measure).map((l) => [l.measure, alphabet(l.value ?? '').members]));
 export const vocabOf = (lock) => ((w) => ({
     offers: w('offers'), keys: w('keys'), region: w('region'), class: w('class'), access: w('access'), origin: w('origin'), origins: w('origins'), issuers: w('issuers'), unresolved: w('unresolved'), unparsed: w('unparsed'), unsupported: w('unsupported'), collision: w('collision'),
     scheme: w('scheme'), form: w('form'), carry: w('carry'), anonymous: w('anonymous'), unstated: w('unstated'), callable: w('callable'), split: w('split'), pick: w('pick'),

package/dist/src/core/worlds.js

@@ -1,8 +1,7 @@
 import { createHash } from 'node:crypto';
-import { parse } from '@lapxo/topos/wire';
-import { valueOf } from "./lock.js";
+import { factsOf, valueOf } from "./lock.js";
 /** The facts bytes hold, in their order. */
-export const linesOf = (bytes) => new TextDecoder().decode(bytes).split('\n').flatMap((line) => ((got) => (got.kind === 'fact' ? [got.value.fields] : []))(parse(line)));
+export const linesOf = (bytes) => factsOf(new TextDecoder().decode(bytes).split('\n'));
 /** Bytes named by their digest, under the algorithm the wire names: a pinned standing is exactly the bytes its pin hashes. */
 export const digestIn = (lock) => (bytes) => ((algorithm) => `${algorithm}:${createHash(algorithm).update(bytes).digest('hex')}`)(valueOf(lock, 'wire/digest-algorithms'));
 /** A compiled standing as a place holds it: its pin, the digest of its bytes, and its lines; none when the place holds no such file. */

package/dist/src/doors/guard.d.ts

@@ -0,0 +1,18 @@
+import { type Said } from '../core/lock.ts';
+import type { headOf } from './head.ts';
+type Asked = (verb: string, args: Record<string, unknown>) => Promise<readonly string[] | undefined>;
+export declare const digestOf: (verb: string, args: unknown) => string;
+/** Whatever head refuses through a door is written in the place's evidence by head's key, by the request's digest (digestOf) and never its body, once a request a window, its count when the door closes, and no more than the door's own line allows in that window, at the instant head's clock hands in. */
+export declare const refusalsOf: (lock: readonly Said[], head: {
+    readonly write: (place: string, lot: readonly string[]) => Promise<unknown>;
+    readonly now: () => number;
+}, door: string) => {
+    write: (place: string | undefined, verb: string, digest: string, code: string) => Promise<void>;
+    settle: () => Promise<void>;
+};
+/** What a door that shows no form asks first: a call carries its place's card, but the ask for that card, which only reads it, and the connect that founds head's first place; what head refuses is written by head's own refusals, and a refusal head wrote already is not written again. */
+export declare const guardOf: (lock: readonly Said[], head: ReturnType<typeof headOf>, asked: Asked) => {
+    call: (verb: string, args: Readonly<Record<string, unknown>> | undefined) => Promise<readonly string[] | undefined>;
+    settle: () => Promise<void>;
+};
+export {};

package/dist/src/doors/guard.js

@@ -0,0 +1,63 @@
+import { createHash } from 'node:crypto';
+import { canonical } from '@lapxo/topos/wire';
+import { members, valueOf } from "../core/lock.js";
+import { sayIn } from "../core/surface.js";
+import { shapeOf } from "../ports/surface.js";
+import { windowOf } from "../ahead/budget.js";
+export const digestOf = (verb, args) => createHash('sha256').update(JSON.stringify([verb, args])).digest('hex').slice(0, 16);
+/** Whatever head refuses through a door is written in the place's evidence by head's key, by the request's digest (digestOf) and never its body, once a request a window, its count when the door closes, and no more than the door's own line allows in that window, at the instant head's clock hands in. */
+export const refusalsOf = (lock, head, door) => {
+    const word = (k) => valueOf(lock, k), [family, at, ceiling] = [word('doors/refused/family'), word('doors/refused/at'), lock.find((l) => l.scope === `${word('refusals/family')}/${door}`)], most = Number(ceiling?.value?.split('..')[1] ?? 0);
+    const seen = new Map(), windows = new Map();
+    const write = async (place, verb, digest, code) => {
+        const instant = head.now(), since = windowOf(ceiling?.measure ?? '', instant), now = new Date(instant).toISOString(), known = seen.get(`${digest}\0${since}`), window = `${place}\0${since}`, n = (windows.get(window) ?? 0) + 1;
+        if (known !== undefined) {
+            known.count += 1;
+            return;
+        }
+        if (place === undefined || since === undefined || n > most + 1)
+            return;
+        windows.set(window, n);
+        const line = { at: `${at}:${now}`, by: 'target', form: 'alphabet', measure: 'count', role: 'writes', value: '1', ...(n > most ? { about: `ceiling of ${most} reached at ${now.slice(11, 16)}`, scope: `${family}/ceiling/${new Date(since).toISOString().replace(/\D/g, '')}` } : { about: `${verb} ${code}`, scope: `${family}/${digest}` }) };
+        if (n <= most)
+            seen.set(`${digest}\0${since}`, { place, line, count: 1 });
+        await head.write(place, [canonical(line)]);
+    };
+    const settle = async () => { for (const [key, { place, line, count }] of seen)
+        if (count > 1) {
+            seen.delete(key);
+            await head.write(place, [canonical({ ...((({ about: _about, ...bare }) => bare)(line)), value: 'withdraw' }), canonical({ ...line, at: `${at}:${new Date(head.now()).toISOString()}`, value: String(count) })]);
+        } };
+    return { write, settle };
+};
+/** What a door that shows no form asks first: a call carries its place's card, but the ask for that card, which only reads it, and the connect that founds head's first place; what head refuses is written by head's own refusals, and a refusal head wrote already is not written again. */
+export const guardOf = (lock, head, asked) => {
+    const [say, word, { write, settle }] = [sayIn(lock), (k) => valueOf(lock, k), head.refusals], [no, written] = [word('said/door-uncarded/state'), shapeOf([say('signing-key-refused', {})]).cells[0].code];
+    const call = async (verb, args) => {
+        const a = { ...args }, place = typeof a['place'] === 'string' ? a['place'] : undefined, digest = digestOf(verb, a);
+        const refuse = async (cell, into = place) => (await write(into ?? await head.placed(), verb, digest, shapeOf([cell]).cells[0].code), [cell]);
+        if (verb === word('doors/first') && place === undefined) {
+            if (await head.hasPlace())
+                return refuse(say('door-founded', {}));
+            const [lines, founded] = [await asked(verb, a), await head.placed()], card = founded === undefined ? undefined : await head.cardOf(founded);
+            return [...(lines ?? []), ...(card !== undefined && 'card' in card ? [say('card', { place: founded, card: card.card, from: verb })] : [])];
+        }
+        if (verb === word('doors/card') && String(a['card']) === 'true')
+            return asked(verb, a);
+        if (typeof a['card'] !== 'string' || place === undefined)
+            return refuse(say('door-uncarded', { place: place ?? '' }));
+        if (!members(word('doors/checks')).includes(verb)) {
+            const now = await head.cardOf(place);
+            if (!('card' in now) || now.card !== a['card'])
+                return refuse(say('card-stale', { action: verb, place, card: a['card'] }));
+            delete a['card'];
+        }
+        if (verb === word('doors/carrier') && a['action'] === word('doors/claim') && a['origin'] !== word('claim/agent'))
+            return refuse(say('door-unoriginated', { place }));
+        const lines = await asked(verb, a), refused = lines === undefined ? undefined : shapeOf(lines).cells.find((c) => c.state === no && c.code !== written);
+        if (refused !== undefined)
+            await write(place, verb, digest, refused.code);
+        return lines;
+    };
+    return { call, settle };
+};

package/dist/src/doors/head.d.ts

@@ -0,0 +1,60 @@
+import type { Asked, Outcome } from '../core/answer.ts';
+import { type Said } from '../core/lock.ts';
+import { type Client } from '../ports/access/person.ts';
+export interface Door extends Client {
+    readonly roots: () => Promise<readonly string[]>;
+    readonly client: () => string | undefined;
+    readonly name: string;
+}
+export declare const askedOf: (raw: Readonly<Record<string, unknown>> | undefined) => Asked;
+/** head behind a door: its lock read, every call answered one at a time and each answer's next read ahead, the same for every door. */
+export declare const headOf: (lock: readonly Said[], root: string, ext: string, door: Door) => {
+    surface: import("../ports/surface.ts").Surface;
+    call: (name: string, args: Readonly<Record<string, unknown>> | undefined, signal: AbortSignal) => Promise<readonly string[] | undefined>;
+    resource: (uri: string, signal: AbortSignal) => Promise<{
+        readonly mime: string;
+        readonly lines: readonly string[];
+    } | undefined>;
+    idle: () => Promise<unknown>;
+    cardOf: (place: string) => Promise<{
+        readonly card: string;
+    } | {
+        readonly said: readonly string[];
+    }>;
+    placed: () => Promise<string | undefined>;
+    hasPlace: () => Promise<boolean>;
+    write: (place: string, lot: readonly string[]) => Promise<Outcome>;
+    refusals: {
+        write: (place: string | undefined, verb: string, digest: string, code: string) => Promise<void>;
+        settle: () => Promise<void>;
+    };
+    now: () => number;
+};
+/** A door that shows no form: its verbs, each answered by its tool through the guard every such door asks, a verb that is no tool carried as its carrier's action; undefined for a verb it lacks. */
+export declare const plainOf: (lock: readonly Said[], root: string, ext: string, name: string) => {
+    head: {
+        surface: import("../ports/surface.ts").Surface;
+        call: (name: string, args: Readonly<Record<string, unknown>> | undefined, signal: AbortSignal) => Promise<readonly string[] | undefined>;
+        resource: (uri: string, signal: AbortSignal) => Promise<{
+            readonly mime: string;
+            readonly lines: readonly string[];
+        } | undefined>;
+        idle: () => Promise<unknown>;
+        cardOf: (place: string) => Promise<{
+            readonly card: string;
+        } | {
+            readonly said: readonly string[];
+        }>;
+        placed: () => Promise<string | undefined>;
+        hasPlace: () => Promise<boolean>;
+        write: (place: string, lot: readonly string[]) => Promise<Outcome>;
+        refusals: {
+            write: (place: string | undefined, verb: string, digest: string, code: string) => Promise<void>;
+            settle: () => Promise<void>;
+        };
+        now: () => number;
+    };
+    verbs: readonly string[];
+    settle: () => Promise<void>;
+    asked: (verb: string, args: Readonly<Record<string, unknown>> | undefined) => Promise<readonly string[] | undefined>;
+};

package/dist/src/doors/head.js

@@ -0,0 +1,136 @@
+var __rewriteRelativeImportExtension = (this && this.__rewriteRelativeImportExtension) || function (path, preserveJsx) {
+    if (typeof path === "string" && /^\.\.?\//.test(path)) {
+        return path.replace(/\.(tsx)$|((?:\.d)?)((?:\.[^./]+?)?)\.([cm]?)ts$/i, function (m, tsx, d, ext, cm) {
+            return tsx ? preserveJsx ? ".jsx" : ".js" : d && (!ext || !cm) ? m : (d + ext + "." + cm.toLowerCase() + "js");
+        });
+    }
+    return path;
+};
+import { basename, join } from 'node:path';
+import { answerOf, placeOf } from "../core/answer.js";
+import { LOCK, parse } from '@lapxo/topos/wire';
+import { aboutOf, members, valueOf } from "../core/lock.js";
+import { sayIn } from "../core/surface.js";
+import { matchTemplate, refusedOn, shapeOf, surfaceOf } from "../ports/surface.js";
+import { birth, closing, founded, land, landAct, limits, pinnedAt, policyAt, run, settledView, sign, standingAt, told, words } from "../ports/bound.js";
+import { configureHost } from "../ports/host.js";
+import { held, keep } from "../ports/cache.js";
+import { dropAt, hasAt, layAt, listAt, takeAt } from "../ports/place.js";
+import * as documents from "../ports/documents.js";
+import { keychain, portOf } from "../ports/keychain.js";
+import { deviceOf, idIn, signingOf } from "../core/device.js";
+import { personOf } from "../ports/access/person.js";
+import { readAhead } from "../ahead/read.js";
+import { cardAt } from "../verbs/card.js";
+import { digestOf, guardOf, refusalsOf } from "./guard.js";
+export const askedOf = (raw) => Object.fromEntries(Object.entries(raw ?? {}).map(([k, v]) => [k, v === undefined ? undefined : typeof v === 'object' ? JSON.stringify(v) : String(v)]));
+/** head behind a door: its lock read, every call answered one at a time and each answer's next read ahead, the same for every door. */
+export const headOf = (lock, root, ext, door) => {
+    const surface = surfaceOf(lock), runs = valueOf(lock, 'runs'), refused = refusedOn(lock, process.platform);
+    Object.assign(words, Object.fromEntries(['read', 'view', 'sign', 'land', 'key', 'signer', 'pin', 'topos', 'standing', 'evidence', 'act', 'profile', 'receipts', 'refusal', 'identity'].map((w) => [w, valueOf(lock, `bound/${w}`)])));
+    Object.assign(limits, { wait: Number(valueOf(lock, 'bound/wait').split('..')[1]), most: Number(valueOf(lock, 'bound/printed').split('..')[1]) });
+    Object.assign(birth, { at: valueOf(lock, 'founding/person-at'), file: valueOf(lock, 'founding/birth-file') });
+    configureHost(lock, limits);
+    /** One call at a time, each after the one before it and never on a timer, so one asked while another lands sees its receipt; a place's reads go to its fold host, which outlives the call and never holds a signer. */
+    let [last, ahead] = [Promise.resolve(), new AbortController()];
+    const turn = (act) => ((next) => { last = next.catch(() => undefined); return next; })(last.then(act));
+    /** What head refuses through this door, written as every door writes it; a door that reaches for a signing key is one such refusal, named by the lock's line for that key and never by what the door asked. */
+    const [refusals, keyRefused] = [refusalsOf(lock, { write: (place, lot) => write(place, lot), now: () => Date.now() }, door.name), shapeOf([sayIn(lock)('signing-key-refused', {})]).cells[0].code];
+    for (const end of ['SIGTERM', 'SIGINT'])
+        process.once(end, () => void last.then(refusals.settle).finally(() => process.exit(0)));
+    /** The person, asked as the client lets head ask; every wait on them is counted, so a time ceiling measures head's work and never the person's. */
+    let waited = 0;
+    const timed = (ask) => async (...args) => { const t = Date.now(); try {
+        return await ask(...args);
+    }
+    finally {
+        waited += Date.now() - t;
+    } };
+    const asked = personOf(lock, door);
+    const person = { consent: timed(asked.consent), enter: timed(asked.enter), choose: timed(asked.choose), visit: timed(asked.visit) };
+    /** head is its home: the folder of its index of places, and the keychain service its keys live under, one per home, so two heads on one keychain never share a key. A place's root is told to bound by the key id its lock names, its secret kept there under the place's account. */
+    const home = process.env[valueOf(lock, 'home/env')] || join(process.env[valueOf(lock, `platform/${process.platform}/home`)] ?? '', valueOf(lock, 'home/folder'));
+    const service = `${deviceOf(lock).service}/${basename(home).replace(/[^\w.-]+/g, '-')}`;
+    const store = valueOf(lock, `platform/${process.platform}/store`);
+    const keys = keychain(service, store, signingOf(lock));
+    const devices = new Map();
+    const device = (role) => devices.get(role) ?? ((key) => (key === undefined ? undefined : (devices.set(role, key), key)))(keys.held?.(deviceOf(lock, role).account));
+    const asRoot = (account) => ((device, key) => [key, device.signer, portOf(service, account, store, limits.wait)])(deviceOf(lock), valueOf(lock, 'founding/root').split('/')[1]);
+    const asRole = (role, lines) => ((one, id) => [id, one.signer, portOf(service, one.account, store, limits.wait)])(deviceOf(lock, role), idIn(lines, device(role)) ?? deviceOf(lock, role).account);
+    /** What a call is answered with, one call at a time as when bound blocked head: every bound process it starts is stopped when the client cancels it, and a call cancelled while it waits its turn is never begun. */
+    const contextOf = (signal) => {
+        /** One call's folds of a place, kept until something lands in it or is laid there; the places its root acted in, whose receipts close once, when the call ends; and those where anything but a read's receipts landed, as bound printed it. */
+        const [folds, touched, moved] = [new Map(), new Set(), new Set()], forget = (place) => { for (const k of [...folds.keys()])
+            if (k.endsWith(`\0${place}`))
+                folds.delete(k); };
+        const read = (at) => at?.startsWith(`${valueOf(lock, 'receipt/at')}:`) === true;
+        const once = (key, place, fold) => (folds.get(`${key}\0${place}`) ?? ((p) => (folds.set(`${key}\0${place}`, p), p))(fold()));
+        const acted = (place, root, done) => done.then((got) => { if ('lines' in got && !got.lines.every((l) => ((f) => f.kind === 'fact' && read(f.value.fields['at']))(parse(l))))
+            moved.add(place); return got; }).finally(() => { forget(place); if (root)
+            touched.add(place); });
+        return {
+            lock,
+            bound: (cwd, args) => run(runs, cwd, args, {}, signal),
+            standing: (place) => once('standing', place, () => standingAt(runs, place, (lines) => ['head', 'person'].flatMap((role) => ((id) => (id === undefined ? [] : [id]))(idIn(lines, device(role)))), (line) => read(line.at), signal)),
+            policy: (place) => once('policy', place, () => policyAt(runs, place, signal)),
+            world: (place, view) => once(`world/${view}`, place, () => settledView(runs, place, view, signal)),
+            adapter: async (origin) => ((name) => (!/^[a-z-]+$/.test(name) ? undefined : import(__rewriteRelativeImportExtension(new URL(`../ports/adapters/${name}${ext}`, import.meta.url).href))))(URL.canParse(origin) ? valueOf(lock, `adapter/${new URL(origin).protocol.slice(0, -1)}`) : ''),
+            files: { lay: (place, rel, bytes) => { forget(place); layAt(place, rel, bytes); }, drop: (place, rel) => { forget(place); dropAt(place, rel); }, has: hasAt, list: listAt, read: documents, take: takeAt, own: (rel) => takeAt(join(root, rel)) },
+            home: () => home,
+            personal: () => process.env[valueOf(lock, `platform/${process.platform}/home`)] ?? '',
+            found: (place, account) => acted(place, true, founded(runs, place, ...asRoot(account), signal)),
+            signRoot: (place, lot, account) => sign(runs, place, lot, ...asRoot(account), signal),
+            landRoot: (place, lot, account) => acted(place, true, landAct(runs, place, lot, ...asRoot(account), signal)),
+            moved: (place) => moved.has(place),
+            settle: async () => { const red = []; for (const place of touched) {
+                const why = await closing(runs, place, signal);
+                if (why !== undefined)
+                    red.push(sayIn(lock)('receipts-open', { place, why }));
+            } touched.clear(); return red; },
+            pinned: (place, file) => pinnedAt(runs, place, file, signal),
+            access: async (kind) => (kind !== valueOf(lock, 'access/adapter') || !/^[a-z0-9-]+$/.test(kind) ? undefined : import(__rewriteRelativeImportExtension(new URL(`../ports/access/${kind}${ext}`, import.meta.url).href)).then((m) => m.adapter)),
+            person,
+            cache: { keep, held },
+            signAs: (place, lot, role, lines) => sign(runs, place, lot, ...asRole(role, lines), signal),
+            landAs: (place, lot, role, lines) => acted(place, false, landAct(runs, place, lot, ...asRole(role, lines), signal)),
+            land: (place, signed) => acted(place, true, land(runs, place, signed, signal)),
+            told: (place, signed) => told(runs, place, signed, words.standing, signal),
+            elicit: (message) => person.consent(message, aboutOf(lock, 'said/elicit/yes')),
+            now: () => Date.now(),
+            machine: () => Date.now() - waited,
+            begun: Date.now() - waited,
+            keys,
+            device,
+            roots: door.roots, client: door.client,
+        };
+    };
+    const call = (name, args, signal) => (ahead.abort(), turn(async () => {
+        const tool = surface.tools.find((one) => one.name === name), place = typeof args?.['place'] === 'string' ? args['place'] : '', keyed = (e) => ((key) => { if (key === undefined || !lock.some((l) => l.scope === key))
+            throw e; return [sayIn(lock)('signing-key-refused', { key, place })]; })(/^REFUSE·keychain (\S+) names a signing key/.exec(e.message)?.[1]);
+        if (tool === undefined)
+            return undefined;
+        const context = contextOf(signal), answer = refused !== undefined ? [refused] : signal.aborted ? [] : [...await (await answerOf('tools', tool.name))(askedOf(args), context).catch(keyed), ...await context.settle()];
+        void ((early) => turn(() => readAhead(shapeOf(answer).cells, contextOf(), early.signal)))(ahead = new AbortController());
+        return answer;
+    }).then(async (answer) => { if (answer !== undefined && shapeOf(answer).cells.some((c) => c.code === keyRefused))
+        await refusals.write(typeof args?.['place'] === 'string' ? args['place'] : await placed(), name, digestOf(name, args ?? {}), keyRefused); return answer; }));
+    const resource = (uri, signal) => turn(async () => {
+        const found = surface.resources.flatMap((r) => ((vars) => (vars === undefined ? [] : [{ r, vars }]))(matchTemplate(r.template, uri)))[0];
+        if (found === undefined)
+            return undefined;
+        if (refused !== undefined)
+            return { mime: found.r.mime, lines: [refused] };
+        return { mime: found.r.mime, lines: await (await answerOf('resources', found.r.name))(askedOf(found.vars), contextOf(signal)) };
+    });
+    /** A place's card now, as do reads it; whether head's index names a place yet, and the one it names; lines head's own key lands in a place, on its standing. */
+    const [cardOf, placed] = [(place) => turn(() => cardAt(contextOf(), place)), () => turn(() => placeOf({}, contextOf()))];
+    const hasPlace = () => turn(async () => ((c) => (!c.files.has(home, LOCK) ? false : c.policy(home).then((held) => !('refused' in held) && held.lines.some((l) => l.scope?.startsWith(`${valueOf(lock, 'home/family')}/`) && l.value !== 'withdraw'))))(contextOf()));
+    const write = (place, lot) => turn(async () => ((c) => c.standing(place).then((held) => ('refused' in held ? held : c.landAs(place, lot, 'head', held.lines))))(contextOf()));
+    return { surface, call, resource, idle: () => last, cardOf, placed, hasPlace, write, refusals, now: () => contextOf().now() };
+};
+/** A door that shows no form: its verbs, each answered by its tool through the guard every such door asks, a verb that is no tool carried as its carrier's action; undefined for a verb it lacks. */
+export const plainOf = (lock, root, ext, name) => {
+    const [head, verbs, carrier] = [headOf(lock, root, ext, { can: () => ({ url: false, form: false }), elicit: async () => ({ action: 'decline' }), roots: async () => [], client: () => undefined, name }), members(valueOf(lock, 'doors/verbs')), valueOf(lock, 'doors/carrier')];
+    const guard = guardOf(lock, head, (verb, args) => ((tool) => head.call(tool ? verb : carrier, tool ? args : { ...args, action: verb }, new AbortController().signal))(head.surface.tools.some((t) => t.name === verb)));
+    return { head, verbs, settle: guard.settle, asked: async (verb, args) => (verbs.includes(verb) ? guard.call(verb, args) : undefined) };
+};

package/dist/src/doors/http.d.ts

@@ -0,0 +1,3 @@
+import { type Said } from '../core/lock.ts';
+/** The http door, on this device's loopback alone: one POST a verb, its body the args, its answer the cells every door gives; a Host not its own, or any Origin, is refused by name. It ends when its input does. */
+export declare const open: (lock: readonly Said[], root: string, ext: string, name: string) => Promise<void>;