@lapxo/head 0.1.6 → 0.1.7

package/dist/src/doors/http.js

@@ -0,0 +1,34 @@
+import { createServer } from 'node:http';
+import { valueOf } from "../core/lock.js";
+import { sayIn } from "../core/surface.js";
+import { shapeOf } from "../ports/surface.js";
+import { plainOf } from "./head.js";
+/** The http door, on this device's loopback alone: one POST a verb, its body the args, its answer the cells every door gives; a Host not its own, or any Origin, is refused by name. It ends when its input does. */
+export const open = (lock, root, ext, name) => new Promise((done) => {
+    const [loopback, asked, say] = [valueOf(lock, 'doors/loopback'), process.argv[4] ?? '0', sayIn(lock)];
+    if (!/^\d+$/.test(asked)) {
+        process.stdout.write(`${JSON.stringify(shapeOf([say('door-bind', { asked, loopback })]))}\n`);
+        process.exitCode = 1;
+        done();
+        return;
+    }
+    const door = plainOf(lock, root, ext, name);
+    const server = createServer((request, out) => {
+        const [own, answer] = [`${loopback}:${server.address().port}`, (status, lines) => out.writeHead(status, { 'content-type': 'application/json' }).end(JSON.stringify(shapeOf(lines)))];
+        if (request.headers.origin !== undefined || request.headers.host !== own)
+            return void answer(403, [say(request.headers.origin !== undefined ? 'door-origin' : 'door-host', { origin: request.headers.origin ?? '', host: request.headers.host ?? '', own })]);
+        let body = '';
+        request.on('data', (chunk) => { body += chunk; }).on('end', async () => {
+            const args = ((t) => { try {
+                return JSON.parse(t || '{}');
+            }
+            catch {
+                return undefined;
+            } })(body);
+            const lines = request.method === 'POST' && args !== null && typeof args === 'object' && !Array.isArray(args) ? await door.asked((request.url ?? '').slice(1), args) : undefined;
+            answer(lines === undefined ? 400 : 200, lines ?? [say('door-unasked', { verbs: door.verbs.join(', ') })]);
+        });
+    });
+    server.listen(Number(asked), loopback, () => process.stdout.write(`${JSON.stringify({ port: server.address().port })}\n`));
+    process.stdin.on('end', () => server.close(() => void door.settle().then(door.head.idle).then(() => done()))).resume();
+});

package/dist/src/doors/lines.d.ts

@@ -0,0 +1,3 @@
+import type { Said } from '../core/lock.ts';
+/** The lines door: one JSON request a line in, its answer one JSON line out, the cells as every door gives them. */
+export declare const open: (lock: readonly Said[], root: string, ext: string, name: string) => Promise<void>;

package/dist/src/doors/lines.js

@@ -0,0 +1,21 @@
+import { createInterface } from 'node:readline';
+import { sayIn } from "../core/surface.js";
+import { shapeOf } from "../ports/surface.js";
+import { plainOf } from "./head.js";
+/** The lines door: one JSON request a line in, its answer one JSON line out, the cells as every door gives them. */
+export const open = (lock, root, ext, name) => new Promise((done) => {
+    const [door, say] = [plainOf(lock, root, ext, name), sayIn(lock)];
+    const answered = (id, answer) => process.stdout.write(`${JSON.stringify({ id, ...shapeOf(answer ?? [say('door-unread', { verbs: door.verbs.join(', ') })]) })}\n`);
+    let pending = Promise.resolve();
+    createInterface({ input: process.stdin }).on('line', (text) => {
+        pending = pending.then(async () => {
+            const asked = ((t) => { try {
+                return JSON.parse(t);
+            }
+            catch {
+                return {};
+            } })(text);
+            answered(asked.id, await door.asked(asked.verb ?? '', asked.args));
+        });
+    }).on('close', () => void pending.then(door.settle).then(door.head.idle).then(() => done()));
+});

package/dist/src/flows/device.js

@@ -7,19 +7,17 @@ import { adoptsIn } from "../adopt/adopt.js";
 /** A key of this device by its role: read from the keychain, or made there once; only its public half is ever handed on. */
 export const deviceKey = (context, role) => context.keys.made?.(deviceOf(context.lock, role).account);
 /** The keychain account of a place's root, when this keychain holds it — who configures the place is here; else what head says of that. */
-export const rootIn = (context, place) => ((account) => (context.keys.read(account) === undefined ? { said: [sayIn(context.lock)('no-root', { place })] } : { account }))(fill(valueOf(context.lock, 'founding/root-account'), { place: placeNameOf(place) }));
+export const rootIn = (context, place) => ((account) => (context.keys.held?.(account) === undefined ? { said: [sayIn(context.lock)('no-root', { place })] } : { account }))(fill(valueOf(context.lock, 'founding/root-account'), { place: placeNameOf(place) }));
 export const widening = (context, place, lines, lot) => {
     const parent = adoptsIn(context.lock, lines);
     if (parent !== undefined)
         return { said: [sayIn(context.lock)('parent-lock', { place, parent })] };
     const [root, witness, field] = [rootIn(context, place), idIn(lines, context.device('person')), valueOf(context.lock, 'widening/witness')];
-    const wire = lines.filter((l) => l.scope === 'wire/fields');
+    const wire = lines.filter((l) => l.scope === 'wire/fields'), admits = wire.some((l) => members(l.value ?? '').includes(field));
     const witnessed = (signed) => signed.map((line) => ((got) => (got.kind === 'fact' ? canonical({ ...got.value.fields, [field]: witness }) : line))(parse(line)));
     if ('account' in root && witness !== undefined) {
-        if (wire.some((l) => members(l.value ?? '').includes(field)))
-            return { sign: (signed) => context.signRoot(place, witnessed(signed), root.account), land: (signed) => context.landRoot(place, witnessed(signed), root.account) };
-        if (lot.every((line) => / scope=wire\/fields /.test(line)))
-            return { sign: (signed) => context.signRoot(place, signed, root.account), land: (signed) => context.landRoot(place, signed, root.account) };
+        if (admits || lot.every((line) => / scope=wire\/fields /.test(line)))
+            return { sign: (signed) => context.signRoot(place, admits ? witnessed(signed) : signed, root.account), land: (signed) => context.landRoot(place, admits ? witnessed(signed) : signed, root.account) };
         const [named, bare] = [[...new Set([...wire.flatMap((l) => members(l.value ?? '')), field])].join('|'), (l) => Object.fromEntries(Object.entries(l).filter(([k]) => !['sig', 'epoch'].includes(k)))];
         return { said: [sayIn(context.lock)('unwitnessed', { place }), ...wire.map((l) => canonical({ ...bare(l), by: 'target', value: 'withdraw' })),
                 canonical({ at: `policy:head/wire/${new Date(context.now()).toISOString()}`, by: 'target', form: 'alphabet', measure: 'id', role: 'reads', scope: 'wire/fields', value: named })] };

package/dist/src/flows/plan.js

@@ -2,6 +2,7 @@ import { baseOf, inPlace, standingOr } from "../core/answer.js";
 import { sayIn } from "../core/surface.js";
 import { widening } from "./device.js";
 import { parse } from '@lapxo/topos/wire';
+const moved = async (context, place, base) => ((now) => ('said' in now ? now.said : baseOf(now.lines) !== base ? [sayIn(context.lock)('base-moved', { base })] : undefined))(await standingOr(context, place));
 /**
  * A proposal the person signs: drafted lines shown to the person with the place and the base they are made against; on
  * their yes to exactly those, signed by their key; what bound prints folding it as if landed comes back as it printed it. Nothing lands; the lot is kept by its digest.
@@ -26,11 +27,9 @@ export const planLot = (asked, context) => inPlace(asked, context, async (place)
     const signed = await by.sign(lot);
     if ('refused' in signed)
         return [signed.refused];
-    const now = await standingOr(context, place);
-    if ('said' in now)
-        return now.said;
-    if (baseOf(now.lines) !== base)
-        return [say('base-moved', { base })];
+    const stale = await moved(context, place, base);
+    if (stale)
+        return stale;
     const kept = context.cache.keep(Buffer.from(JSON.stringify({ place, base, signed: signed.lines })));
     return [say('planned', { lot: kept, base }), ...(await context.told(place, signed.lines))];
 });
@@ -41,11 +40,9 @@ export const landLot = async (asked, context) => {
     if (bytes === undefined)
         return [say('no-lot', { lot: asked['lot'] ?? '' })];
     const kept = JSON.parse(Buffer.from(bytes).toString('utf8'));
-    const now = await standingOr(context, kept.place);
-    if ('said' in now)
-        return now.said;
-    if (baseOf(now.lines) !== kept.base)
-        return [say('base-moved', { base: kept.base })];
+    const stale = await moved(context, kept.place, kept.base);
+    if (stale)
+        return stale;
     const landed = await context.land(kept.place, kept.signed);
     return 'refused' in landed ? [landed.refused] : [say('landed', { count: String(landed.lines.length) }), ...landed.lines];
 };

package/dist/src/flows/read.js

@@ -9,7 +9,7 @@ import { principalOf } from "../access/obtain.js";
 import { jsonOf } from "../access/contract.js";
 import { refusedAccess } from "../sources/refused.js";
 import { hand, keptOf } from "../kept/kept.js";
-import { markOf, overOf } from "../ahead/budget.js";
+import { calledIn, markOf, overOf } from "../ahead/budget.js";
 /** An intent an earlier act left open, closed by the read that looked at what it would have changed: a line naming that read-s digest, signed by head. */
 const closeWith = async (intent, source, digest, { word, lines, lands }, context) => {
     const say = sayIn(context.lock);
@@ -72,6 +72,9 @@ export const readSource = (asked, context) => called(asked, context, planRead, a
     const again = was?.kind === 'again' ? say(`kept-${was.why}`, { source, operation, at: was.at }) : [];
     if (overOf(lines, [family, at, word('ahead/mark')], source, context.now(), most('read/rate'), Number(word('ahead/share').split('..')[1]), asked))
         return asked['ahead'] === 'true' ? [] : say('rate', { source });
+    const calls = lines.find((l) => l.scope === `${word('calls/family')}/${source}`), made = calls && calledIn(lines, [family, at, word('ahead/mark')], source, calls.measure ?? '', context.now());
+    if (calls && (made === undefined || made >= most(calls.scope)))
+        return asked['ahead'] === 'true' ? [] : say(made === undefined ? 'calls-unwindowed' : 'calls-owed', { source, calls: String(most(calls.scope)), window: calls.measure });
     const attached = await attach();
     if ('said' in attached)
         return attached.said;

package/dist/src/index.js

@@ -7,144 +7,45 @@ var __rewriteRelativeImportExtension = (this && this.__rewriteRelativeImportExte
     }
     return path;
 };
-import { basename, join } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { Server } from '@modelcontextprotocol/sdk/server/index.js';
 import { StdioServerTransport } from '@modelcontextprotocol/sdk/server/stdio.js';
 import { CallToolRequestSchema, GetPromptRequestSchema, ListPromptsRequestSchema, ListResourcesRequestSchema, ListResourceTemplatesRequestSchema, ListToolsRequestSchema, ReadResourceRequestSchema } from '@modelcontextprotocol/sdk/types.js';
-import { answerOf } from "./core/answer.js";
-import { parse } from '@lapxo/topos/wire';
-import { aboutOf, valueOf } from "./core/lock.js";
-import { fill, sayIn } from "./core/surface.js";
-import { matchTemplate, refusedOn, shapeOf, shapeSchema, surfaceOf } from "./ports/surface.js";
-import { birth, closing, cooled, founded, land, landAct, limits, pinnedAt, policyAt, run, settledView, sign, standingAt, told, warm, words } from "./ports/bound.js";
-import { warmth } from "./ports/warm.js";
-import { held, keep } from "./ports/cache.js";
-import { registryFor } from "./ports/signers.js";
-import { dropAt, folderOf, hasAt, layAt, listAt, lockAt, takeAt } from "./ports/place.js";
-import * as documents from "./ports/documents.js";
-import { keychain } from "./ports/keychain.js";
-import { algorithmOf, deviceOf, idIn } from "./core/device.js";
-import { publicOf } from "./ports/keys.js";
-import { personOf } from "./ports/access/person.js";
-import { readAhead } from "./ahead/read.js";
+import { aboutOf, members, valueOf } from "./core/lock.js";
+import { fill } from "./core/surface.js";
+import { shapeOf, shapeSchema } from "./ports/surface.js";
+import { folderOf, lockAt } from "./ports/place.js";
+import { askedOf, headOf } from "./doors/head.js";
 const [ext, root] = ((self) => [self.slice(self.lastIndexOf('.')), fileURLToPath(new URL(self.endsWith('.ts') ? '..' : '../..', self))])(import.meta.url);
 const lock = lockAt(root);
-if (process.argv[2] !== valueOf(lock, 'cli/run')) {
+const [door, doors] = [process.argv[3], members(valueOf(lock, 'cli/run/doors'))];
+if (process.argv[2] !== valueOf(lock, 'cli/run') || (door !== undefined && !doors.includes(door))) {
     process.stdout.write(`${aboutOf(lock, 'cli/help')}\n`);
     process.exit(0);
 }
-const surface = surfaceOf(lock);
-const runs = valueOf(lock, 'runs');
-Object.assign(words, Object.fromEntries(['read', 'view', 'sign', 'land', 'key', 'signer', 'pin', 'topos', 'standing', 'evidence', 'act', 'profile', 'receipts', 'refusal', 'identity'].map((w) => [w, valueOf(lock, `bound/${w}`)])));
-Object.assign(limits, { wait: Number(valueOf(lock, 'bound/wait').split('..')[1]), most: Number(valueOf(lock, 'bound/printed').split('..')[1]) });
-Object.assign(birth, { at: valueOf(lock, 'founding/person-at'), file: valueOf(lock, 'founding/birth-file') });
-Object.assign(warmth, { spares: Number(valueOf(lock, 'bound/spares').split('..')[1]), boot: valueOf(lock, 'bound/spare-env').split('|') });
-/** One call at a time, each after the one before it and never on a timer, so one asked while another lands sees its receipt; bound started ahead for it, and nothing of it kept once it is answered. */
-let [last, ahead] = [Promise.resolve(), new AbortController()];
-const turn = (act) => ((next) => { last = next.catch(() => undefined); return next; })(last.then(() => { void warm(runs); return act().finally(cooled); }));
-for (const end of ['SIGTERM', 'SIGINT'])
-    process.once(end, () => void last.finally(() => process.exit(0)));
+if (door !== undefined && door !== doors[0]) {
+    await (await import(__rewriteRelativeImportExtension(new URL(`./doors/${door}${ext}`, import.meta.url).href))).open(lock, root, ext, door);
+    process.exit();
+}
 const offered = (n) => (n ? { listChanged: false } : undefined);
+const head = headOf(lock, root, ext, {
+    can: () => ((e) => ({ url: Boolean(e?.url), form: e !== undefined && (e.form !== undefined || Object.keys(e).length === 0) }))(server.getClientCapabilities()?.elicitation), elicit: (params) => server.elicitInput(params, { timeout: Number(valueOf(lock, 'access/wait').split('..')[1]) }),
+    roots: async () => (server.getClientCapabilities()?.roots ? (await server.listRoots()).roots.flatMap((root) => folderOf(root.uri) ?? []) : []), client: () => ((c) => (c ? `${c.name}@${c.version}` : undefined))(server.getClientVersion()), name: doors[0],
+}), surface = head.surface;
 const server = new Server({ name: surface.name, version: surface.version }, { capabilities: { tools: offered(surface.tools.length), resources: offered(surface.resources.length), prompts: offered(surface.prompts.length) }, instructions: aboutOf(lock, 'prose/en/instructions') });
-/** The person, asked as the client lets head ask; every wait on them is counted, so a time ceiling measures head's work and never the person's. */
-let waited = 0;
-const timed = (ask) => async (...args) => { const t = Date.now(); try {
-    return await ask(...args);
-}
-finally {
-    waited += Date.now() - t;
-} };
-const asked = personOf(lock, { can: () => ((e) => ({ url: Boolean(e?.url), form: e !== undefined && (e.form !== undefined || Object.keys(e).length === 0) }))(server.getClientCapabilities()?.elicitation), elicit: (params) => server.elicitInput(params, { timeout: Number(valueOf(lock, 'access/wait').split('..')[1]) }) });
-const person = { consent: timed(asked.consent), enter: timed(asked.enter), choose: timed(asked.choose), visit: timed(asked.visit) };
-/** head is its home: the folder of its index of places, and the keychain service its keys live under, one per home, so two heads on one keychain never share a key. A place's root is told to bound by the key id its lock names, its secret kept there under the place's account. */
-const home = process.env[valueOf(lock, 'home/env')] || join(process.env[valueOf(lock, `platform/${process.platform}/home`)] ?? '', valueOf(lock, 'home/folder'));
-const service = `${deviceOf(lock).service}/${basename(home).replace(/[^\w.-]+/g, '-')}`;
-const store = valueOf(lock, `platform/${process.platform}/store`);
-const keys = keychain(service, store);
-const devices = new Map();
-const device = (role) => devices.get(role) ?? ((secret) => (secret === undefined ? undefined : ((key) => { devices.set(role, key); return key; })(publicOf(secret))))(keys.read(deviceOf(lock, role).account));
-const asRoot = (account) => ((device, key) => [key, device.signer, { BOUND_SIGNERS: registryFor(device.signer, service, account, key, valueOf(lock, 'founding/algorithm'), store) }])(deviceOf(lock), valueOf(lock, 'founding/root').split('/')[1]);
-/** What a call is answered with, one call at a time as when bound blocked head: every bound process it starts is stopped when the client cancels it, and a call cancelled while it waits its turn is never begun. */
-const contextOf = (signal) => {
-    /** One call's folds of a place, kept until something lands in it or is laid there; the places its root acted in, whose receipts close once, when the call ends; and those where anything but a read's receipts landed, as bound printed it. */
-    const [folds, touched, moved] = [new Map(), new Set(), new Set()], forget = (place) => { for (const k of [...folds.keys()])
-        if (k.endsWith(`\0${place}`))
-            folds.delete(k); };
-    const read = (at) => at?.startsWith(`${valueOf(lock, 'receipt/at')}:`) === true;
-    const once = (key, place, fold) => (folds.get(`${key}\0${place}`) ?? ((p) => (folds.set(`${key}\0${place}`, p), p))(fold()));
-    const acted = (place, root, done) => done.then((got) => { if ('lines' in got && !got.lines.every((l) => ((f) => f.kind === 'fact' && read(f.value.fields['at']))(parse(l))))
-        moved.add(place); return got; }).finally(() => { forget(place); if (root)
-        touched.add(place); });
-    const signRoot = (place, lot, account) => sign(runs, place, lot, ...asRoot(account), signal);
-    const signAs = (place, lot, role, lines) => ((one, id) => sign(runs, place, lot, id, one.signer, { BOUND_SIGNERS: registryFor(one.signer, service, one.account, id, algorithmOf(lines), store) }, signal))(deviceOf(lock, role), idIn(lines, device(role)) ?? deviceOf(lock, role).account);
-    return {
-        lock,
-        bound: (cwd, args) => run(runs, cwd, args, {}, signal),
-        standing: (place) => once('standing', place, () => standingAt(runs, place, (lines) => ['head', 'person'].flatMap((role) => ((id) => (id === undefined ? [] : [id]))(idIn(lines, device(role)))), (line) => read(line.at), signal)),
-        policy: (place) => once('policy', place, () => policyAt(runs, place, signal)),
-        world: (place, view) => once(`world/${view}`, place, () => settledView(runs, place, view, signal)),
-        adapter: async (origin) => ((name) => (!/^[a-z-]+$/.test(name) ? undefined : import(__rewriteRelativeImportExtension(new URL(`./ports/adapters/${name}${ext}`, import.meta.url).href))))(URL.canParse(origin) ? valueOf(lock, `adapter/${new URL(origin).protocol.slice(0, -1)}`) : ''),
-        files: { lay: (place, rel, bytes) => { forget(place); layAt(place, rel, bytes); }, drop: (place, rel) => { forget(place); dropAt(place, rel); }, has: hasAt, list: listAt, read: documents, take: takeAt, own: (rel) => takeAt(join(root, rel)) },
-        home: () => home,
-        personal: () => process.env[valueOf(lock, `platform/${process.platform}/home`)] ?? '',
-        found: (place, account) => acted(place, true, founded(runs, place, ...asRoot(account), signal)),
-        signRoot,
-        landRoot: (place, lot, account) => acted(place, true, landAct(runs, place, lot, ...asRoot(account), signal)),
-        moved: (place) => moved.has(place),
-        settle: async () => { const red = []; for (const place of touched) {
-            const why = await closing(runs, place, signal);
-            if (why !== undefined)
-                red.push(sayIn(lock)('receipts-open', { place, why }));
-        } touched.clear(); return red; },
-        pinned: (place, file) => pinnedAt(runs, place, file, signal),
-        access: async (kind) => (kind !== valueOf(lock, 'access/adapter') || !/^[a-z0-9-]+$/.test(kind) ? undefined : import(__rewriteRelativeImportExtension(new URL(`./ports/access/${kind}${ext}`, import.meta.url).href)).then((m) => m.adapter)),
-        person,
-        cache: { keep, held },
-        signAs,
-        landAs: (place, lot, role, lines) => acted(place, false, ((one, id) => landAct(runs, place, lot, id, one.signer, { BOUND_SIGNERS: registryFor(one.signer, service, one.account, id, algorithmOf(lines), store) }, signal))(deviceOf(lock, role), idIn(lines, device(role)) ?? deviceOf(lock, role).account)),
-        land: (place, signed) => acted(place, true, land(runs, place, signed, signal)),
-        told: (place, signed) => told(runs, place, signed, words.standing, signal),
-        elicit: (message) => person.consent(message, aboutOf(lock, 'said/elicit/yes')),
-        now: () => Date.now(),
-        machine: () => Date.now() - waited,
-        begun: Date.now() - waited,
-        keys,
-        device,
-        roots: async () => (server.getClientCapabilities()?.roots ? (await server.listRoots()).roots.flatMap((root) => folderOf(root.uri) ?? []) : []), client: () => ((c) => (c ? `${c.name}@${c.version}` : undefined))(server.getClientVersion()),
-    };
-};
-const askedOf = (raw) => Object.fromEntries(Object.entries(raw ?? {}).map(([k, v]) => [k, v === undefined ? undefined : typeof v === 'object' ? JSON.stringify(v) : String(v)]));
 const schemaOf = (fields) => ({ type: 'object',
     properties: Object.fromEntries(fields.map((f) => [f.name, { type: f.type, description: f.about }])), required: fields.filter((f) => f.required).map((f) => f.name) });
 if (surface.tools.length)
     server.setRequestHandler(ListToolsRequestSchema, () => ({ tools: surface.tools.map((tool) => ({ name: tool.name, description: tool.about,
             inputSchema: schemaOf([...tool.fields]), outputSchema: shapeSchema(lock), annotations: Object.fromEntries(tool.hints.map((hint) => [`${hint}Hint`, true])) })) }));
 if (surface.tools.length)
-    server.setRequestHandler(CallToolRequestSchema, async (request, extra) => (ahead.abort(), turn(async () => {
-        const tool = surface.tools.find((one) => one.name === request.params.name);
-        if (tool === undefined)
-            return { isError: true, content: [] };
-        const refused = refusedOn(lock, process.platform);
-        const context = contextOf(extra.signal), answer = refused !== undefined ? [refused] : extra.signal.aborted ? [] : [...await (await answerOf('tools', tool.name))(askedOf(request.params.arguments), context), ...await context.settle()];
-        void ((early) => turn(() => readAhead(shapeOf(answer).cells, contextOf(), early.signal)))(ahead = new AbortController());
-        return { content: [{ type: 'text', text: answer.join('\n') }], structuredContent: shapeOf(answer) };
-    })));
+    server.setRequestHandler(CallToolRequestSchema, async (request, extra) => ((answer) => (answer === undefined ? { isError: true, content: [] } : { content: [{ type: 'text', text: answer.join('\n') }], structuredContent: shapeOf(answer) }))(await head.call(request.params.name, request.params.arguments, extra.signal)));
 if (surface.resources.length)
     server.setRequestHandler(ListResourcesRequestSchema, () => ({ resources: [] }));
 if (surface.resources.length)
     server.setRequestHandler(ListResourceTemplatesRequestSchema, () => ({ resourceTemplates: surface.resources.map((r) => ({ name: r.name, uriTemplate: r.template, description: r.about, mimeType: r.mime })) }));
 if (surface.resources.length)
-    server.setRequestHandler(ReadResourceRequestSchema, async (request, extra) => turn(async () => {
-        const found = surface.resources.flatMap((r) => ((vars) => (vars === undefined ? [] : [{ r, vars }]))(matchTemplate(r.template, request.params.uri)))[0];
-        if (found === undefined)
-            return { contents: [] };
-        const refused = refusedOn(lock, process.platform);
-        if (refused !== undefined)
-            return { contents: [{ uri: request.params.uri, mimeType: found.r.mime, text: refused }] };
-        const lines = await (await answerOf('resources', found.r.name))(askedOf(found.vars), contextOf(extra.signal));
-        return { contents: [{ uri: request.params.uri, mimeType: found.r.mime, text: lines.join('\n') }] };
-    }));
+    server.setRequestHandler(ReadResourceRequestSchema, async (request, extra) => ((got) => ({ contents: got === undefined ? [] : [{ uri: request.params.uri, mimeType: got.mime, text: got.lines.join('\n') }] }))(await head.resource(request.params.uri, extra.signal)));
 if (surface.prompts.length)
     server.setRequestHandler(ListPromptsRequestSchema, () => ({ prompts: surface.prompts.map((p) => ({ name: p.name, description: p.about, arguments: p.fields.map((f) => ({ name: f.name, description: f.about, required: f.required })) })) }));
 if (surface.prompts.length)

package/dist/src/links/inspect.js

@@ -1,6 +1,6 @@
 import { decodeReference } from '@lapxo/bound/reference';
 import { canonical } from '@lapxo/topos/wire';
-import { inPlace, standingOr } from "../core/answer.js";
+import { inStanding } from "../core/answer.js";
 import { members, valueOf } from "../core/lock.js";
 import { sayIn } from "../core/surface.js";
 import { linesOf } from "../core/worlds.js";
@@ -12,12 +12,10 @@ import { rootIn } from "../flows/device.js";
  * one, to sign; bytes that do not arrive are owed by the link until they do; bytes that are not what it names are refused.
  * Asked why, it shows the transport it reads by: the profile's lines, laid at the place's birth by head, never the person's.
  */
-export const linked = (asked, context) => inPlace(asked, context, async (place) => {
-    const [say, word, link] = [sayIn(context.lock), (k) => valueOf(context.lock, k), asked['document'] ?? ''], [held, admits] = [await standingOr(context, place, context.policy), members(valueOf(context.lock, 'link/transport'))];
-    if ('said' in held)
-        return held.said;
+export const linked = (asked, context) => inStanding(asked, context, async (place, standing) => {
+    const [say, word, link] = [sayIn(context.lock), (k) => valueOf(context.lock, k), asked['document'] ?? ''], admits = members(valueOf(context.lock, 'link/transport'));
     if (asked['why'] === 'true')
-        return [...held.lines.filter((l) => admits.includes(l.scope ?? '') || l.scope?.startsWith('transport/')).map((l) => canonical(l)), say('why-transport', { place })];
+        return [...standing.filter((l) => admits.includes(l.scope ?? '') || l.scope?.startsWith('transport/')).map((l) => canonical(l)), say('why-transport', { place })];
     const lines = context.lock.filter((l) => admits.some((s) => l.scope === `birth/${s}`)).map(({ about: _about, scope, ...l }) => canonical({ ...l, scope: scope.slice('birth/'.length), at: 'policy:person/transport', by: 'target' }));
     let reference;
     try {
@@ -26,10 +24,10 @@ export const linked = (asked, context) => inPlace(asked, context, async (place)
     catch (refused) {
         return [say('link-refused', { link, why: refused instanceof Error ? refused.message : String(refused) })];
     }
-    if (![admits[0], `transport/${new URL(reference.source).protocol.slice(0, -1)}`].every((s) => held.lines.some((l) => l.scope === s)))
+    if (![admits[0], `transport/${new URL(reference.source).protocol.slice(0, -1)}`].every((s) => standing.some((l) => l.scope === s)))
         return [say('transport-missing', { place, lines: lines.join('\n') })];
     const [printed, scope] = [await context.bound(place, [word('bound/read'), link]), `${word('place/needs')}/bytes/${reference.blob.slice(reference.algorithm.length + 1, reference.algorithm.length + 17)}`];
-    const [owed, root, why] = [held.lines.find((l) => l.scope === scope && l.role === 'demands' && l.value === link), rootIn(context, place), printed?.err.filter((l) => !l.startsWith('{')).at(-1) ?? ''];
+    const [owed, root, why] = [standing.find((l) => l.scope === scope && l.role === 'demands' && l.value === link), rootIn(context, place), printed?.err.filter((l) => !l.startsWith('{')).at(-1) ?? ''];
     if ('said' in root)
         return root.said;
     if (printed?.code !== 0 && !why.includes(word('link/unarrived')))
@@ -41,4 +39,4 @@ export const linked = (asked, context) => inPlace(asked, context, async (place)
     const named = linesOf(new TextEncoder().encode(printed.out.filter((l) => l.startsWith('TOPOS ')).map((l) => l.slice('TOPOS '.length)).join('\n')));
     const sources = named.filter((l) => /^sources\/[^/]+$/.test(l.scope ?? '')).map((l) => l.scope.split('/')[1]);
     return [say('inspected', { source: reference.source, sources: sources.join(', ') || '—', digest: reference.digest }), say('sharer-unverified', {}), ...await settled(owed ? [canonical({ ...due, value: 'withdraw' })] : [])];
-});
+}, context.policy);

package/dist/src/places/found.js

@@ -18,7 +18,7 @@ const founded = async (context, dir, name) => {
     const [head, person] = [deviceKey(context, 'head'), deviceKey(context, 'person')];
     if (head === undefined || person === undefined)
         return { refused: 'no-keychain' };
-    if (context.keys.read(account) !== undefined)
+    if (context.keys.held?.(account) !== undefined)
         return { refused: 'place-taken' };
     const root = context.keys.made?.(account);
     if (root === undefined)

package/dist/src/ports/bound.d.ts

@@ -1,17 +1,14 @@
-import type { Said } from '../core/lock.ts';
+import { type Said } from '../core/lock.ts';
 import type { Outcome } from '../core/answer.ts';
-import { cooled } from './warm.ts';
+import type { portOf } from './keychain.ts';
 import type { Printed } from './process.ts';
 export type { Printed };
 export declare const limits: {
     wait: number;
     most: number;
 };
-/** bound run as a process in a folder, beside head and never blocking it, within the wait and the bytes head's lock gives it and stopped when the asker cancels: one started ahead when head holds one, else one started now. */
+/** bound asked in a folder, beside head and never blocking it, within the wait and the bytes head's lock gives it and stopped when the asker cancels: a place or one of its views read through the place's fold host, else a process started now, as for a document, a lot told or a sign: a host is always handed its place first, and bound folds a document only when it is named first; what it read from the temporary folder is removed once it ends, however it ends. */
 export declare const run: (name: string, cwd: string, args: readonly string[], env?: Readonly<Record<string, string>>, signal?: AbortSignal) => Promise<Printed | undefined>;
-/** bound started ahead of the first ask of a call, as many times as head's lock keeps it started; resolved once each is ready. */
-export declare const warm: (name: string) => Promise<unknown>;
-export { cooled };
 export type Folded = {
     readonly lines: readonly Said[];
 } | {
@@ -20,7 +17,9 @@ export type Folded = {
 /** Read normative standing plus authenticated device evidence; ambiguous device history refuses. */
 export declare const policyAt: (name: string, place: string, signal?: AbortSignal) => Promise<Folded>;
 export declare const standingAt: (name: string, place: string, devicesOf: (lines: readonly Said[]) => readonly string[], isHistory: (line: Said) => boolean, signal?: AbortSignal) => Promise<Folded>;
-export declare const sign: (name: string, place: string, lot: readonly string[], key: string, signer: string, env: Readonly<Record<string, string>>, signal?: AbortSignal) => Promise<Outcome>;
+/** A sign or a land: in a host of its own for this one call, signed by head's signer through the port of the key it names, the lot handed in as the host's input. */
+type Port = ReturnType<typeof portOf>;
+export declare const sign: (_name: string, place: string, lot: readonly string[], key: string, signer: string, port: Port, signal?: AbortSignal) => Promise<Outcome>;
 /** A lot signed and landed in one process, its result read from what bound printed of the committed act: the records it admitted, never the receipt beside them; a place that declares no act result is refused by name. */
 /** A place's receipts rendered beside its lock, so bound alone checks the place: nothing when they closed, else why they did not. */
 export declare const closing: (name: string, place: string, signal?: AbortSignal) => Promise<string | undefined>;
@@ -29,8 +28,8 @@ export declare const birth: {
     at: string;
     file: string;
 }, birthed: (place: string, lot: readonly string[]) => void;
-export declare const landAct: (name: string, place: string, lot: readonly string[], key: string, signer: string, env: Readonly<Record<string, string>>, signal?: AbortSignal) => Promise<Outcome>;
-export declare const land: (name: string, place: string, signed: readonly string[], signal?: AbortSignal) => Promise<Outcome>;
+export declare const landAct: (_name: string, place: string, lot: readonly string[], key: string, signer: string, port: Port, signal?: AbortSignal) => Promise<Outcome>;
+export declare const land: (_name: string, place: string, signed: readonly string[], signal?: AbortSignal) => Promise<Outcome>;
 export declare const told: (name: string, place: string, signed: readonly string[], view: string, signal?: AbortSignal) => Promise<readonly string[]>;
 export declare const pinnedAt: (name: string, place: string, file: string, signal?: AbortSignal) => Promise<{
     readonly pin: string;
@@ -39,7 +38,7 @@ export declare const pinnedAt: (name: string, place: string, file: string, signa
 } | {
     readonly refused: string;
 } | undefined>;
-export declare const founded: (name: string, place: string, key: string, signer: string, env: Readonly<Record<string, string>>, signal?: AbortSignal) => Promise<Outcome>;
+export declare const founded: (_name: string, place: string, key: string, signer: string, port: Port, signal?: AbortSignal) => Promise<Outcome>;
 export declare const words: {
     read: string;
     view: string;

package/dist/src/ports/bound.js

@@ -1,10 +1,11 @@
-import { existsSync, mkdtempSync, readFileSync, writeFileSync } from 'node:fs';
+import { existsSync, readFileSync, writeFileSync } from 'node:fs';
 import { createRequire } from 'node:module';
-import { tmpdir } from 'node:os';
 import { dirname, join } from 'node:path';
 import { canonical, LOCK, parse } from '@lapxo/topos/wire';
+import { factsOf } from "../core/lock.js";
 import { spawned } from "./process.js";
-import { cooled, kept, warmed } from "./warm.js";
+import { hosted, hosting, signedIn } from "./host.js";
+import { cleared, scratchOf } from "./scratch.js";
 import { folded } from "../ahead/fold.js";
 import { readingOf } from "./reading.js";
 const binOf = (name) => {
@@ -18,9 +19,16 @@ const binOf = (name) => {
     }
 };
 export const limits = { wait: 0, most: 0 };
-/** bound run as a process in a folder, beside head and never blocking it, within the wait and the bytes head's lock gives it and stopped when the asker cancels: one started ahead when head holds one, else one started now. */
-export const run = async (name, cwd, args, env = {}, signal) => ((bin, at, bounds) => (bin === undefined ? undefined
-    : (warmed(bin, args, at, bounds) ?? spawned(process.execPath, [bin, ...args], at, bounds)).then(apart)))(binOf(name), { cwd, env: { ...process.env, ...env } }, { wait: limits.wait, most: limits.most || Number.MAX_SAFE_INTEGER, ...(signal ? { signal } : {}) });
+/** bound asked in a folder, beside head and never blocking it, within the wait and the bytes head's lock gives it and stopped when the asker cancels: a place or one of its views read through the place's fold host, else a process started now, as for a document, a lot told or a sign: a host is always handed its place first, and bound folds a document only when it is named first; what it read from the temporary folder is removed once it ends, however it ends. */
+export const run = async (name, cwd, args, env = {}, signal) => {
+    try {
+        return await ((bin, at, bounds) => (bin === undefined ? undefined
+            : (args[0] === words.read && (args.length === 1 || (args.length === 3 && args[1] === words.view)) && hosting.installed && !Object.keys(env).length ? hosted(cwd, args, signal) : spawned(process.execPath, [bin, ...args], at, bounds)).then(apart)))(binOf(name), { cwd, env: { ...process.env, ...env } }, { wait: limits.wait, most: limits.most || Number.MAX_SAFE_INTEGER, ...(signal ? { signal } : {}) });
+    }
+    finally {
+        cleared([...args, ...Object.values(env)]);
+    }
+};
 /** The record bound prints after a refusal's diagnostic, read apart from it: what bound printed is kept whole, the record beside it, and why bound refused is the diagnostic's last line, never the record. */
 const recordOf = (line) => { try {
     return ((got) => (got?.profile === words.refusal ? got : undefined))(JSON.parse(line));
@@ -31,18 +39,14 @@ catch {
 const isRecord = (line) => line.startsWith('{') && recordOf(line) !== undefined;
 const apart = (printed) => ((record) => (record === undefined ? printed : { ...printed, refusal: recordOf(record) }))([...printed.err].reverse().find(isRecord));
 const why = (printed) => printed?.err.filter((line) => !isRecord(line)).at(-1);
-/** bound started ahead of the first ask of a call, as many times as head's lock keeps it started; resolved once each is ready. */
-export const warm = (name) => ((bin) => (bin === undefined ? Promise.resolve() : kept(bin)))(binOf(name));
-export { cooled };
-const facts = (out) => out.flatMap((line) => ((got) => (got.kind === 'fact' ? [got.value.fields] : []))(parse(line)));
-const readOf = (printed) => (printed === undefined || printed.code !== 0 ? { refused: why(printed) ?? '' } : { lines: facts(printed.out) });
+const readOf = (printed) => (printed === undefined || printed.code !== 0 ? { refused: why(printed) ?? '' } : { lines: factsOf(printed.out) });
 /** Native identities and expected-identity results come from the same public CLI contract. Without it, read fresh. */
 const nativeView = (name, place, view, signal) => {
     const read = async (expected) => {
         if (expected === undefined)
             return readOf(await run(name, place, [words.read, words.view, view], {}, signal));
         const result = readingOf(await run(name, place, [words.read, words.view, `${words.identity}@${view}@${expected}`], {}, signal), view, expected);
-        return 'refused' in result ? result : { lines: facts(result.text.split('\n')) };
+        return 'refused' in result ? result : { lines: factsOf(result.text.split('\n')) };
     };
     return !words.identity ? read() : folded(`${name}/${view}`, place, async () => { const result = readingOf(await run(name, place, [words.read, words.view, `${words.identity}@${view}`], {}, signal), view); return 'refused' in result ? undefined : result.identity; }, read);
 };
@@ -61,25 +65,26 @@ export const standingAt = async (name, place, devicesOf, isHistory, signal) => {
     return unfolded === undefined ? { lines: [...folded.lines, ...own] }
         : { refused: `REFUSE·standing ${unfolded.by} attests ${key(unfolded)} more than once, withdrawn, or beside the place's own line: folding a device key's lines is bound's, and bound publishes no view of it` };
 };
-const lotFile = (lines) => ((at) => { writeFileSync(at, `${lines.join('\n')}\n`); return at; })(join(mkdtempSync(join(tmpdir(), 'head-lot-')), 'lot.bound'));
-export const sign = async (name, place, lot, key, signer, env, signal) => ((got) => (got !== undefined && got.code === 0 ? { lines: got.out.filter((line) => parse(line).kind === 'fact') } : { refused: why(got) ?? '' }))(await run(name, place, [words.sign, lotFile(lot), words.key, key, words.signer, signer], env, signal));
+const lotFile = (lines) => scratchOf('head-lot-', 'lot.bound', `${lines.join('\n')}\n`);
+const through = (place, verb, lot, key, signer, port, signal) => signedIn(place, [verb, ...(key ? [words.key, key, words.signer, signer] : [])], lot, new Map(key && port ? [[key, { name: signer, sign: port }]] : []), key, signal).then(apart);
+export const sign = async (_name, place, lot, key, signer, port, signal) => ((got) => (got !== undefined && got.code === 0 ? { lines: got.out.filter((line) => parse(line).kind === 'fact') } : { refused: why(got) ?? '' }))(await through(place, words.sign, lot, key, signer, port, signal));
 /** A lot signed and landed in one process, its result read from what bound printed of the committed act: the records it admitted, never the receipt beside them; a place that declares no act result is refused by name. */
 /** A place's receipts rendered beside its lock, so bound alone checks the place: nothing when they closed, else why they did not. */
 export const closing = async (name, place, signal) => ((got) => (got !== undefined && got.code === 0 ? undefined : why(got) ?? 'nothing printed'))(await run(name, place, [words.read, words.view, words.receipts], {}, signal));
 /** A place's own lines in the person's words, beside its lock, the text they read and share: each line head lands at the person's at, drafted with no signature, gone with its withdraw. Bound reads the file as it reads the place, so it is written with the land, never while a fold runs. Set from head's lock. */
 export const birth = { at: '', file: '' }, birthed = (place, lot) => {
-    const [file, mine] = [join(place, birth.file), facts(lot).filter((l) => birth.file && l['at']?.startsWith(birth.at))], bare = (l) => JSON.stringify(Object.entries(l).filter(([k]) => !['about', 'value', 'sig', 'epoch', 'by'].includes(k)).sort());
+    const [file, mine] = [join(place, birth.file), factsOf(lot).filter((l) => birth.file && l['at']?.startsWith(birth.at))], bare = (l) => JSON.stringify(Object.entries(l).filter(([k]) => !['about', 'value', 'sig', 'epoch', 'by'].includes(k)).sort());
     if (mine.length)
-        writeFileSync(file, [...(existsSync(file) ? facts(readFileSync(file, 'utf8').split('\n')) : []).filter((k) => !mine.some((m) => bare(m) === bare(k))), ...mine.filter((m) => m['value'] !== 'withdraw')].map(({ sig: _sig, epoch: _epoch, ...l }) => `${canonical({ ...l, by: 'target' })}\n`).join(''));
+        writeFileSync(file, [...(existsSync(file) ? factsOf(readFileSync(file, 'utf8').split('\n')) : []).filter((k) => !mine.some((m) => bare(m) === bare(k))), ...mine.filter((m) => m['value'] !== 'withdraw')].map(({ sig: _sig, epoch: _epoch, ...l }) => `${canonical({ ...l, by: 'target' })}\n`).join(''));
 };
-export const landAct = async (name, place, lot, key, signer, env, signal) => ((got) => {
+export const landAct = async (_name, place, lot, key, signer, port, signal) => ((got) => {
     if (got === undefined || got.code !== 0)
         return { refused: why(got) ?? '' };
     const at = got.out.findIndex((line) => line.startsWith(words.act));
     return at < 0 ? { refused: `REFUSE·act bound printed no act result, and the place declares ${words.profile}: what was admitted is bound's to say` }
         : (birthed(place, lot), { lines: got.out.slice(at + 1).filter((line) => parse(line).kind === 'fact').slice(0, -1) });
-})(await run(name, place, [words.land, lotFile(lot), words.key, key, words.signer, signer], env, signal));
-export const land = async (name, place, signed, signal) => ((got) => (got !== undefined && got.code === 0 ? (birthed(place, signed), { lines: signed }) : { refused: why(got) ?? '' }))(await run(name, place, [words.land, lotFile(signed)], {}, signal));
+})(await through(place, words.land, lot, key, signer, port, signal));
+export const land = async (_name, place, signed, signal) => ((got) => (got !== undefined && got.code === 0 ? (birthed(place, signed), { lines: signed }) : { refused: why(got) ?? '' }))(await through(place, words.land, signed, undefined, undefined, undefined, signal));
 export const told = async (name, place, signed, view, signal) => ((got) => [...(got?.out ?? []), ...(got?.err ?? [])])(await run(name, place, [words.read, words.view, view, lotFile(signed)], {}, signal));
 export const pinnedAt = async (name, place, file, signal) => {
     const printed = await run(name, place, [words.read, file], {}, signal);
@@ -90,6 +95,6 @@ export const pinnedAt = async (name, place, file, signal) => {
     const bytes = printed.out.filter((line) => line.startsWith(words.topos)).map((line) => `${line.slice(words.topos.length)}\n`).join('');
     return pin === undefined || !bytes ? undefined : { pin, bytes, lines: read.lines };
 };
-export const founded = async (name, place, key, signer, env, signal) => ((got) => (got !== undefined && got.code === 0 ? (birthed(place, readFileSync(join(place, LOCK), 'utf8').split('\n')), { lines: got.out }) : { refused: why(got) ?? '' }))(await run(name, place, [words.land, words.key, key, words.signer, signer], env, signal));
+export const founded = async (_name, place, key, signer, port, signal) => ((got) => (got !== undefined && got.code === 0 ? (birthed(place, readFileSync(join(place, LOCK), 'utf8').split('\n')), { lines: got.out }) : { refused: why(got) ?? '' }))(await through(place, words.land, undefined, key, signer, port, signal));
 export const words = { read: '', view: '', sign: '', land: '', key: '', signer: '', pin: '', topos: '', standing: '', evidence: '', act: '', profile: '', receipts: '', refusal: '', identity: '' };
 export const settledView = async (name, place, view, signal) => readOf(await run(name, place, [words.read, words.view, view], {}, signal));

package/dist/src/ports/host.d.ts

@@ -0,0 +1,35 @@
+import type { NativeHostOptions } from '@lapxo/bound/host';
+import type { Printed } from './process.ts';
+import { type Said } from '../core/lock.ts';
+/** What a place's fold host is held to, from head's lock: the installed instrument it must be, how long it stays idle and lives, and its limits. */
+export declare const hosting: {
+    installed: string;
+    idle: number;
+    life: number;
+    wait: number;
+    bytes: number;
+    heap: number;
+    queued: number;
+    http: NativeHostOptions["http"];
+};
+/** Receiver permissions and work budgets are declared by head's own lock, never inferred from a redirect. */
+export declare const configureHost: (lock: readonly Said[], bounds: {
+    readonly wait: number;
+    readonly most: number;
+}) => void;
+/** Every host closed, its scratch removed with it: whenever a caller asks, and when head ends, its scratch then removed at once, whatever its host is still doing. */
+export declare const cooled: () => void;
+/** The process a place's fold host runs as, while one is held for it. */
+export declare const hostOf: (place: string) => number | undefined;
+/**
+ * A read of a place's view through the place's own fold host, which only folds and never holds a signer: started on the first
+ * read, kept while it is asked within its idle and its life, the installed bound checked file by file before every call.
+ * A refusal, an error or a changed instrument closes it, and the next read starts another.
+ */
+export declare const hosted: (place: string, args: readonly string[], signal?: AbortSignal, from?: string) => Promise<Printed>;
+/**
+ * A sign or a land in a host of its own, started for this one call with the signers the lock names and closed once it
+ * answers: the signer never outlives the call it signed for. The place's fold host is closed first, a place having one
+ * host at a time; the lot goes in as the host's input, never a file of head's.
+ */
+export declare const signedIn: (place: string, args: readonly string[], lot: readonly string[] | undefined, signers: NonNullable<NativeHostOptions["signers"]>, keyId?: string, signal?: AbortSignal, from?: string) => Promise<Printed>;