@lapxo/head 0.1.6 → 0.1.7

package/dist/src/ports/host.js

@@ -0,0 +1,108 @@
+import { createHash } from 'node:crypto';
+import { mkdtempSync, readdirSync, readFileSync, realpathSync, rmSync, statSync } from 'node:fs';
+import { createRequire } from 'node:module';
+import { tmpdir } from 'node:os';
+import { dirname, join, relative, sep } from 'node:path';
+import { installedHostInstrument, nativeHostEnvironment, startNativeHost } from '@lapxo/bound/host';
+import { members, valueOf } from "../core/lock.js";
+/** What a place's fold host is held to, from head's lock: the installed instrument it must be, how long it stays idle and lives, and its limits. */
+export const hosting = { installed: '', idle: 0, life: 0, wait: 0, bytes: 0, heap: 0, queued: 0, http: undefined };
+/** Receiver permissions and work budgets are declared by head's own lock, never inferred from a redirect. */
+export const configureHost = (lock, bounds) => { Object.assign(hosting, { installed: valueOf(lock, 'dep/bound/installed'), wait: bounds.wait, bytes: bounds.most, ...Object.fromEntries(['idle', 'life', 'heap', 'queued'].map((k) => [k, Number(valueOf(lock, `bound/host/${k}`).split('..')[1])])), http: { origins: members(valueOf(lock, 'bound/receiver/origins')), redirects: { maxRedirects: Number(valueOf(lock, 'bound/receiver/redirects').split('..')[1]), headerBytes: Number(valueOf(lock, 'bound/receiver/header-bytes').split('..')[1]) } } }); };
+const root = dirname(createRequire(import.meta.url).resolve('@lapxo/bound/package.json'));
+const walk = (at) => (statSync(at).isDirectory() ? readdirSync(at).flatMap((e) => walk(join(at, e))) : [at]);
+/** Every file of the installed bound by its coordinate and digest: what its identity is computed from, and what is checked again before each call. */
+const inventory = (at) => walk(at).map((f) => ({ coordinate: relative(at, f).split(sep).join('/'), digest: `sha256:${createHash('sha256').update(readFileSync(f)).digest('hex')}` })).sort((a, b) => (a.coordinate < b.coordinate ? -1 : 1));
+/** The hosts held, those starting, those closing — a place gets its next host once its last one is gone — and the folders head made for their scratch, each removed once its host is. */
+const [live, starting, closing, scratches] = [new Map(), new Map(), new Map(), new Set()];
+const cleared = (dir) => { rmSync(dir, { recursive: true, force: true }); scratches.delete(dir); };
+const shut = (at) => { const one = live.get(at); live.delete(at); if (one) {
+    clearTimeout(one.idle);
+    closing.set(at, one.host.close().catch(() => undefined).finally(() => { cleared(one.scratch); closing.delete(at); }));
+} };
+/** Every host closed, its scratch removed with it: whenever a caller asks, and when head ends, its scratch then removed at once, whatever its host is still doing. */
+export const cooled = () => { for (const at of [...live.keys()])
+    shut(at); };
+/** The process a place's fold host runs as, while one is held for it. */
+export const hostOf = (place) => live.get(realpathSync(place))?.host.pid;
+process.once('exit', () => { cooled(); for (const dir of [...scratches])
+    cleared(dir); });
+/** A host started on a place, on the installed instrument the lock pins and in a scratch folder of head's own; with signers only for one call's sign or land. */
+const opened = async (at, from, signers) => {
+    const members = inventory(from), instrument = installedHostInstrument({ directory: from, shape: 'package', members, exports: [['exports', './engine', 'default']], pins: [], limits: { members: 4096, bytes: 1 << 27, responseBytes: 1 << 22 } }, join(from, 'dist/cli/verb.js'));
+    const scratch = mkdtempSync(join(tmpdir(), 'head-host-'));
+    scratches.add(scratch);
+    const host = await startNativeHost({ place: at, instrument, expectedInstrument: hosting.installed, environment: nativeHostEnvironment({ ...process.env }), scratchParent: scratch, ...(hosting.http ? { http: hosting.http } : {}), ...(signers ? { signers } : {}), limits: { requestBytes: hosting.bytes, responseBytes: hosting.bytes, timeoutMs: hosting.wait, heapMiB: hosting.heap, queuedRequests: hosting.queued } }).catch((e) => { cleared(scratch); throw e; });
+    return { host, members: JSON.stringify(members), born: Date.now(), scratch, busy: 0 };
+};
+const started = async (at, from) => ((one) => (live.set(at, one), one))(await opened(at, from));
+const lines = (text) => text.split('\n').filter(Boolean), refused = (why) => ({ code: -1, out: [], err: [why] });
+/**
+ * A read of a place's view through the place's own fold host, which only folds and never holds a signer: started on the first
+ * read, kept while it is asked within its idle and its life, the installed bound checked file by file before every call.
+ * A refusal, an error or a changed instrument closes it, and the next read starts another.
+ */
+export const hosted = async (place, args, signal, from = root) => {
+    if (args[0] !== 'fold')
+        return refused(`REFUSE·host a place's fold host only folds, and never holds a signer: ${args[0]} goes to a process of its own`);
+    const at = realpathSync(place), was = live.get(at);
+    if (was !== undefined && Date.now() - was.born > hosting.life * 1000)
+        shut(at);
+    let one;
+    try {
+        await closing.get(at);
+        one = live.get(at) ?? await (starting.get(at) ?? ((p) => (starting.set(at, p), p))(started(at, from).finally(() => starting.delete(at))));
+    }
+    catch (e) {
+        return refused(e.message);
+    }
+    if (JSON.stringify(inventory(from)) !== one.members) {
+        shut(at);
+        return refused(`REFUSE·host the installed bound changed after its host started, so it is no longer ${hosting.installed}: the host is closed, and nothing was read`);
+    }
+    clearTimeout(one.idle);
+    one.busy += 1;
+    try {
+        const got = await one.host.request({ verb: 'fold', args: args.slice(1) }, signal);
+        if (got.status !== 0)
+            shut(at);
+        return { code: got.status, out: lines(got.stdout), err: lines(got.stderr) };
+    }
+    catch (e) {
+        shut(at);
+        return refused(e.message);
+    }
+    finally {
+        one.busy -= 1;
+        if (one.busy === 0 && live.get(at) === one)
+            one.idle = setTimeout(() => shut(at), hosting.idle * 1000).unref();
+    }
+};
+/**
+ * A sign or a land in a host of its own, started for this one call with the signers the lock names and closed once it
+ * answers: the signer never outlives the call it signed for. The place's fold host is closed first, a place having one
+ * host at a time; the lot goes in as the host's input, never a file of head's.
+ */
+export const signedIn = async (place, args, lot, signers, keyId, signal, from = root) => {
+    const at = realpathSync(place);
+    shut(at);
+    await closing.get(at);
+    let one;
+    try {
+        one = await opened(at, from, signers);
+    }
+    catch (e) {
+        return refused(e.message);
+    }
+    try {
+        const got = await one.host.request({ verb: args[0], args: [...(lot ? ['@input/lot.bound'] : []), ...args.slice(1)], ...(lot ? { inputs: [{ name: 'lot.bound', text: `${lot.join('\n')}\n` }] } : {}), ...(keyId ? { signer: keyId } : {}) }, signal);
+        return { code: got.status, out: lines(got.stdout), err: lines(got.stderr) };
+    }
+    catch (e) {
+        return refused(e.message);
+    }
+    finally {
+        await one.host.close().catch(() => undefined);
+        cleared(one.scratch);
+    }
+};

package/dist/src/ports/keychain.d.ts

@@ -2,7 +2,19 @@ export interface KeyStore {
     readonly read: (account: string) => string | undefined;
     readonly write: (account: string, secret: string) => void;
     readonly made?: (account: string) => string | undefined;
+    readonly held?: (account: string) => string | undefined;
 }
 export declare const plain: (word: string) => string;
-/** The secret store this host keeps head's keys in, by the name its lock gives the platform's: one adapter each, every secret crossing a command's stdin and stdout only; a key it is asked for by its account is made there once, and only its public half handed on. */
-export declare const keychain: (service: string, kind: string) => KeyStore;
+/** The secret store this host keeps head's keys in, by the name its lock gives the platform's: one adapter each, every secret crossing a command's stdin and stdout only. Only head's signer opens it for a signing key. */
+export declare const secretsOf: (service: string, kind: string) => KeyStore;
+/** The store head's long process is handed: a signing account is refused by name before any command starts, and its key is made, or its public half read, in head's signer, never here; the secrets of access stay this process's, since it calls their APIs. */
+export declare const keychain: (service: string, kind: string, signing: (account: string) => string | undefined) => KeyStore;
+/** The signing port a host calls for one lot: head's signer started with the key's names alone and the lot on its stdin, within the wait the lock gives bound; what it prints are the signatures, read as the signing-lot contract reads them. */
+export declare const portOf: (service: string, account: string, kind: string, wait: number) => (lot: {
+    readonly bytes: readonly string[];
+    readonly keyId: string;
+    readonly algorithm: string;
+}, signal: AbortSignal) => Promise<readonly {
+    readonly keyId: string;
+    readonly signature: string;
+}[]>;

package/dist/src/ports/keychain.js

@@ -1,12 +1,24 @@
+import { execFileSync } from 'node:child_process';
+import { fileURLToPath } from 'node:url';
+import { signerResponseOf } from '@lapxo/topos/wire';
+import { spawned } from "./process.js";
 import { store as credentialManager } from "./stores/credential-manager.js";
 import { store as keychainOfMac } from "./stores/keychain.js";
 import { store as secretTool } from "./stores/secret-tool.js";
-import { newKey, publicOf } from "./keys.js";
 export const plain = (word) => { if (!/^[\w.@/+=-]+$/.test(word))
     throw Error('REFUSE·keychain a name holds more than word characters'); return word; };
-/** The secret store this host keeps head's keys in, by the name its lock gives the platform's: one adapter each, every secret crossing a command's stdin and stdout only; a key it is asked for by its account is made there once, and only its public half handed on. */
-export const keychain = (service, kind) => ((made) => {
-    if (made === undefined)
-        throw Error(`REFUSE·keychain ${kind} is no store head carries`);
-    return ((store) => ({ ...store, made: (account) => ((secret) => secret && publicOf(secret))(store.read(account) ?? ((key) => { store.write(account, key.secret); return store.read(account) === key.secret ? key.secret : undefined; })(newKey())) }))(made(service));
-})({ keychain: keychainOfMac, 'secret-tool': secretTool, 'credential-manager': credentialManager }[kind]);
+/** The secret store this host keeps head's keys in, by the name its lock gives the platform's: one adapter each, every secret crossing a command's stdin and stdout only. Only head's signer opens it for a signing key. */
+export const secretsOf = (service, kind) => ((made) => { if (made === undefined)
+    throw Error(`REFUSE·keychain ${kind} is no store head carries`); return made(service); })({ keychain: keychainOfMac, 'secret-tool': secretTool, 'credential-manager': credentialManager }[kind]);
+const signer = fileURLToPath(new URL(`../signer${import.meta.url.slice(import.meta.url.lastIndexOf('.'))}`, import.meta.url)), half = (mode, service, account, kind) => { try {
+    return execFileSync(process.execPath, [signer, mode, service, plain(account), kind], { encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'] }) || undefined;
+}
+catch {
+    return undefined;
+} };
+/** The store head's long process is handed: a signing account is refused by name before any command starts, and its key is made, or its public half read, in head's signer, never here; the secrets of access stay this process's, since it calls their APIs. */
+export const keychain = (service, kind, signing) => ((keys, guard) => ({ read: (account) => keys.read(guard(account)), write: (account, secret) => keys.write(guard(account), secret), made: (account) => half('make', service, account, kind), held: (account) => half('exists', service, account, kind) }))(secretsOf(service, kind), (account) => ((key) => { if (key !== undefined)
+    throw Error(`REFUSE·keychain ${key} names a signing key: only head's signer reads it`); return account; })(signing(account)));
+/** The signing port a host calls for one lot: head's signer started with the key's names alone and the lot on its stdin, within the wait the lock gives bound; what it prints are the signatures, read as the signing-lot contract reads them. */
+export const portOf = (service, account, kind, wait) => async (lot, signal) => ((got) => { if (got.code !== 0)
+    throw Error(`REFUSE·signer head's signer did not sign for ${lot.keyId}`); return signerResponseOf(`${got.out.join('\n')}\n`, lot); })(await spawned(process.execPath, [signer, service, plain(account), lot.keyId, lot.algorithm, kind], { input: `${lot.bytes.join('\n')}\n` }, { wait, most: 1 << 20, signal }));

package/dist/src/ports/scratch.d.ts

@@ -0,0 +1,4 @@
+/** A file one bound run reads, in a folder of its own under this device's temporary folder, kept only until that run ends. */
+export declare const scratchOf: (prefix: string, name: string, text: string) => string;
+/** The folders made for what a run read, removed once it ended, however it ended; any other path is left as it is. */
+export declare const cleared: (paths: readonly string[]) => void;

package/dist/src/ports/scratch.js

@@ -0,0 +1,10 @@
+import { mkdtempSync, rmSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { dirname, join } from 'node:path';
+const made = new Set();
+/** A file one bound run reads, in a folder of its own under this device's temporary folder, kept only until that run ends. */
+export const scratchOf = (prefix, name, text) => ((dir) => { made.add(dir); writeFileSync(join(dir, name), text); return join(dir, name); })(mkdtempSync(join(tmpdir(), prefix)));
+/** The folders made for what a run read, removed once it ended, however it ended; any other path is left as it is. */
+export const cleared = (paths) => { for (const at of paths)
+    if (made.delete(dirname(at)))
+        rmSync(dirname(at), { recursive: true, force: true }); };

package/dist/src/signer.js

@@ -1,13 +1,14 @@
 #!/usr/bin/env node
 import { readFileSync } from 'node:fs';
-import { signLot } from "./ports/keys.js";
-import { keychain } from "./ports/keychain.js";
-const [service = '', account = '', key = '', algorithm = '', store = 'keychain'] = process.argv.slice(2);
-const secret = keychain(service, store).read(account);
-if (secret === undefined)
-    process.exit(1);
+import { newKey, publicOf, signLot } from "./ports/keys.js";
+import { secretsOf } from "./ports/keychain.js";
+/** The one process that reads a signing secret, and it prints a public half at most: `make` keeps a key made once, `exists` says whether one is kept, else it signs the lot on stdin. */
+const [first = '', ...rest] = process.argv.slice(2), half = first === 'make' || first === 'exists', [service = '', account = '', key = '', algorithm = '', store = 'keychain'] = half ? [rest[0], rest[1], '', '', rest[2]] : [first, ...rest], keys = secretsOf(service, store);
+const kept = keys.read(account) ?? (first === 'make' ? ((made) => { keys.write(account, made.secret); return keys.read(account) === made.secret ? made.secret : undefined; })(newKey()) : undefined);
+if (kept === undefined)
+    process.exit(half ? 3 : 1);
 try {
-    process.stdout.write(signLot(readFileSync(0, 'utf8'), secret, key, algorithm));
+    process.stdout.write(half ? publicOf(kept) : signLot(readFileSync(0, 'utf8'), kept, key, algorithm));
 }
 catch {
     process.exit(1);

package/dist/src/tools/card.js

@@ -1,13 +1,10 @@
-import { inPlace, printedOr, standingOr } from "../core/answer.js";
+import { inStanding, printedOr } from "../core/answer.js";
 import { members, valueOf } from "../core/lock.js";
 import { sayIn } from "../core/surface.js";
 /** What is open for a key: the cells view the place's standing declares, as bound folded it at the resolution asked, narrowed to the key; a refused fold is said, never read as no view. The standing is the one the card was read off, folded once a call. */
-export const answer = (asked, context) => inPlace(asked, context, async (place) => {
+export const answer = (asked, context) => inStanding(asked, context, async (place, lines) => {
     const word = (scope) => valueOf(context.lock, `bound/${scope}`);
-    const held = await standingOr(context, place);
-    if ('said' in held)
-        return held.said;
-    const view = held.lines.find((f) => f.scope?.startsWith('view/') && !f.shape && members(f.value ?? '').includes(word('cells')));
+    const view = lines.find((f) => f.scope?.startsWith('view/') && !f.shape && members(f.value ?? '').includes(word('cells')));
     if (view === undefined)
         return [sayIn(context.lock)('no-cells', { place })];
     return printedOr(context, await context.bound(place, [word('read'), word('view'), `${view.scope.split('/')[1]}${asked['at'] ? `${word('at')}${asked['at']}` : ''}`, ...(asked['key'] ? [word('key'), asked['key']] : [])]));

package/dist/src/verbs/ask.js

@@ -6,6 +6,7 @@ import { sayIn } from "../core/surface.js";
 import { paidIn } from "../onboard/owed.js";
 import { pendingIn } from "../sources/refused.js";
 import { compared } from "../marks/compare.js";
+import { viewed } from "../claims/view.js";
 import { cardAt } from "./card.js";
 /** Route a question at the declared resolution, then attach the card of the place it read. */
 export const asked = async (asked, context) => {
@@ -21,7 +22,7 @@ export const asked = async (asked, context) => {
     const owed = asked['source'] && founded ? await paidIn(asked, context, place) : undefined;
     if (owed !== undefined && !owed.answer)
         return owed.said;
-    const answer = asked['sources'] && founded ? await compared(asked, context, place) : asked['lines'] ? await read('plan', 'plan') : asked['view'] ? await read('view', 'look') : asked['source'] ? await read('offers', 'look')
+    const answer = asked['sources'] && founded ? await compared(asked, context, place) : asked['lines'] ? await read('plan', 'plan') : founded && asked['view'] === valueOf(context.lock, 'claim/view') ? await viewed(asked, context) : asked['view'] ? await read('view', 'look') : asked['source'] ? await read('offers', 'look')
         : !carded ? await read('places', 'places') : founded ? [...await read('card', 'card', { place }), ...await pendingIn(context, place)] : [];
     const after = held === undefined || 'said' in held || place === undefined || !context.moved(place) ? held : await cardAt(context, place);
     return [...(owed?.said ?? []), ...answer, ...(after === undefined || 'said' in after ? [] : [sayIn(context.lock)('card', { place: place ?? '', card: after.card, from: 'ask' })])];

package/dist/src/walk/context.js

@@ -2,6 +2,7 @@ import { join } from 'node:path';
 import { canonical, LOCK } from '@lapxo/topos/wire';
 import { members, valueOf } from "../core/lock.js";
 import { linesOf } from "../core/worlds.js";
+import { pinnedAs } from "../compile/pin.js";
 /**
  * A place made walkable once it is founded: the context another place authenticates it by — its wire, its keys and its
  * origin, read off the lines it was born with — folded by bound into a standing, laid beside its lock and pinned by its
@@ -11,13 +12,9 @@ export const walkable = async (context, dir, account) => {
     const [word, at] = [(k) => valueOf(context.lock, k), valueOf(context.lock, 'walk/context/file')];
     const reads = members(word('walk/context/reads'));
     const born = linesOf(context.files.take(join(dir, LOCK)) ?? new Uint8Array()).filter((l) => reads.some((r) => (r.endsWith('/**') ? l.scope?.startsWith(r.slice(0, -2)) : l.scope === r)) && l.value !== 'withdraw');
-    const draft = at.replace(/\.bound$/, '.draft.bound');
-    context.files.lay(dir, draft, new TextEncoder().encode(`${[...born.map(({ sig: _s, epoch: _e, ...l }) => canonical({ ...l, by: 'target' })),
-        canonical({ at: 'policy:head/walk', by: 'target', form: 'alphabet', measure: 'reads', role: 'writes', scope: word('walk/context/region'), value: reads.join('|') })].join('\n')}\n`));
-    const pinned = await context.pinned(dir, draft);
-    context.files.drop(dir, draft);
+    const pinned = await pinnedAs(context, dir, at, [...born.map(({ sig: _s, epoch: _e, ...l }) => canonical({ ...l, by: 'target' })),
+        canonical({ at: 'policy:head/walk', by: 'target', form: 'alphabet', measure: 'reads', role: 'writes', scope: word('walk/context/region'), value: reads.join('|') })]);
     if (pinned === undefined || 'refused' in pinned)
         return { refused: pinned === undefined ? 'walk context folded nothing' : pinned.refused };
-    context.files.lay(dir, at, new TextEncoder().encode(pinned.bytes));
     return context.landRoot(dir, [canonical({ at: 'policy:head/walk', by: 'target', form: 'alphabet', measure: 'digest', needs: at, role: 'writes', scope: 'walk/context', value: pinned.pin })], account);
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lapxo/head",
-  "version": "0.1.6",
+  "version": "0.1.7",
   "type": "module",
   "description": "An MCP server that folds: it runs bound as a process, hands a model what bound printed, and lands what it read as receipts.",
   "license": "MIT",
@@ -26,8 +26,8 @@
     "test": "node --test test/*.test.ts && node --test --test-concurrency=1 test/time/*.test.ts"
   },
   "dependencies": {
-    "@lapxo/bound": "0.2.5",
-    "@lapxo/topos": "0.2.1",
+    "@lapxo/bound": "0.2.7",
+    "@lapxo/topos": "0.2.4",
     "@modelcontextprotocol/sdk": "1.32.1"
   },
   "devDependencies": {

package/dist/src/ports/signers.d.ts

@@ -1,6 +0,0 @@
-/**
- * The host's registry bound reads to bind a declared signer name to a program: head's own signer, started by this node,
- * told the keychain service, the account its secret is kept under, the key it signs as, the algorithm and the store this
- * host keeps secrets in. It holds no secret; it lives beside nothing a repository ships.
- */
-export declare const registryFor: (name: string, service: string, account: string, key: string, algorithm: string, store?: string) => string;

package/dist/src/ports/signers.js

@@ -1,14 +0,0 @@
-import { writeFileSync, mkdtempSync } from 'node:fs';
-import { tmpdir } from 'node:os';
-import { join } from 'node:path';
-import { fileURLToPath } from 'node:url';
-/**
- * The host's registry bound reads to bind a declared signer name to a program: head's own signer, started by this node,
- * told the keychain service, the account its secret is kept under, the key it signs as, the algorithm and the store this
- * host keeps secrets in. It holds no secret; it lives beside nothing a repository ships.
- */
-export const registryFor = (name, service, account, key, algorithm, store = 'keychain') => {
-    const at = join(mkdtempSync(join(tmpdir(), 'head-signers-')), 'signers.json');
-    writeFileSync(at, JSON.stringify({ [name]: { kind: 'command', executable: process.execPath, args: [fileURLToPath(new URL(`../signer${import.meta.url.slice(import.meta.url.lastIndexOf('.'))}`, import.meta.url)), service, account, key, algorithm, store] } }));
-    return at;
-};

package/dist/src/ports/spare.d.ts

@@ -1 +0,0 @@
-export {};

package/dist/src/ports/spare.js

@@ -1,33 +0,0 @@
-var __rewriteRelativeImportExtension = (this && this.__rewriteRelativeImportExtension) || function (path, preserveJsx) {
-    if (typeof path === "string" && /^\.\.?\//.test(path)) {
-        return path.replace(/\.(tsx)$|((?:\.d)?)((?:\.[^./]+?)?)\.([cm]?)ts$/i, function (m, tsx, d, ext, cm) {
-            return tsx ? preserveJsx ? ".jsx" : ".js" : d && (!ext || !cm) ? m : (d + ext + "." + cm.toLowerCase() + "js");
-        });
-    }
-    return path;
-};
-import { readFileSync } from 'node:fs';
-import { Socket } from 'node:net';
-import { pathToFileURL } from 'node:url';
-/**
- * A process started before it is asked: it loads what the program it will run imports, says it is ready on its fourth
- * pipe, and waits there for one ask, the folder, the arguments and the variables a process started then would have been
- * given. It takes them as its own, closes that pipe and runs the program once, as that process would have. An ask that
- * never comes ends it.
- */
-const [program] = process.argv.slice(2);
-const url = pathToFileURL(program), pipe = new Socket({ fd: 3, readable: true, writable: true });
-const asked = new Promise((resolve) => { let text = ''; pipe.setEncoding('utf8').on('data', (chunk) => { text += chunk; }).on('error', () => undefined).on('close', () => resolve(text)); });
-await Promise.all([...readFileSync(program, 'utf8').matchAll(/(?:^|[;\n])\s*import\s*(?:(?:[^'";]*?)\s*from\s*)?['"](\.{1,2}\/[^'"]+)['"]/g)].map(([, path]) => import(__rewriteRelativeImportExtension(new URL(path, url).href)).catch(() => undefined)));
-pipe.write('ready\n');
-const text = await asked;
-if (!text)
-    process.exit(0);
-const { cwd, args, env } = JSON.parse(text);
-for (const name of Object.keys(process.env))
-    if (!(name in env))
-        delete process.env[name];
-Object.assign(process.env, env);
-process.chdir(cwd);
-process.argv = [process.argv[0], program, ...args];
-await import(__rewriteRelativeImportExtension(url.href));

package/dist/src/ports/warm.d.ts

@@ -1,19 +0,0 @@
-import type { Bounds, Printed } from './process.ts';
-/** How many processes head keeps started ahead of each program while it answers a call, and the variables node reads as it starts: a process started under other values of them is never asked. */
-export declare const warmth: {
-    spares: number;
-    boot: readonly string[];
-};
-/** Keeps as many processes started ahead of a program as head's lock says; resolved when each has loaded what it runs. */
-export declare const kept: (program: string) => Promise<unknown>;
-/** Every process still waiting to be asked is stopped: head keeps none past the call it started them for. */
-export declare const cooled: () => void;
-/**
- * A program run in a process started ahead under the same starting variables, handed the folder, arguments and
- * variables a process started now would get, and watched within the same bounds; undefined when none is held ready,
- * so the caller starts one as before and never waits on one still loading. Each process answers one ask and ends.
- */
-export declare const warmed: (program: string, args: readonly string[], at: {
-    readonly cwd: string;
-    readonly env: NodeJS.ProcessEnv;
-}, bounds: Bounds) => Promise<Printed> | undefined;

package/dist/src/ports/warm.js

@@ -1,45 +0,0 @@
-import { fileURLToPath } from 'node:url';
-import { grouped, watched } from "./process.js";
-/** How many processes head keeps started ahead of each program while it answers a call, and the variables node reads as it starts: a process started under other values of them is never asked. */
-export const warmth = { spares: 0, boot: [] };
-const spares = new Map();
-const alive = (one) => one.child.exitCode === null && one.child.signalCode === null;
-const entry = fileURLToPath(new URL(`./spare${import.meta.url.slice(import.meta.url.lastIndexOf('.'))}`, import.meta.url));
-const bootOf = (env) => JSON.stringify(Object.entries(env).filter(([name]) => warmth.boot.some((p) => name.startsWith(p))).sort(([a], [b]) => (a < b ? -1 : 1)));
-const stop = (one) => { try {
-    process.kill(-one.child.pid, 'SIGKILL');
-}
-catch {
-    one.child.kill('SIGKILL');
-} };
-const started = (program) => {
-    const env = { ...process.env }, child = grouped(process.execPath, [entry, program], { env }, 4);
-    child.stdin.on('error', () => undefined).end('');
-    const spare = { child, boot: bootOf(env), ready: new Promise((resolve) => { child.stdio[3].on('error', () => undefined).once('data', () => { spare.loaded = true; resolve(); }); child.once('close', () => resolve()); }), loaded: false };
-    return spare;
-};
-/** Keeps as many processes started ahead of a program as head's lock says; resolved when each has loaded what it runs. */
-export const kept = (program) => {
-    const live = (spares.get(program) ?? []).filter(alive);
-    while (live.length < warmth.spares)
-        live.push(started(program));
-    spares.set(program, live);
-    return Promise.all(live.map((one) => one.ready));
-};
-/** Every process still waiting to be asked is stopped: head keeps none past the call it started them for. */
-export const cooled = () => { for (const one of [...spares.values()].flat())
-    stop(one); spares.clear(); };
-process.once('exit', cooled);
-/**
- * A program run in a process started ahead under the same starting variables, handed the folder, arguments and
- * variables a process started now would get, and watched within the same bounds; undefined when none is held ready,
- * so the caller starts one as before and never waits on one still loading. Each process answers one ask and ends.
- */
-export const warmed = (program, args, at, bounds) => {
-    const live = spares.get(program) ?? [], index = live.findIndex((one) => one.loaded && alive(one) && one.boot === bootOf(at.env));
-    const spare = index < 0 ? undefined : live.splice(index, 1)[0];
-    if (spare === undefined)
-        return undefined;
-    spare.child.stdio[3].end(`${JSON.stringify({ cwd: at.cwd, args, env: at.env })}\n`);
-    return watched(spare.child, bounds).finally(() => { void kept(program); });
-};