@lapxo/head 0.1.6 → 0.2.0

package/dist/src/doors/head.js

@@ -0,0 +1,141 @@
+var __rewriteRelativeImportExtension = (this && this.__rewriteRelativeImportExtension) || function (path, preserveJsx) {
+    if (typeof path === "string" && /^\.\.?\//.test(path)) {
+        return path.replace(/\.(tsx)$|((?:\.d)?)((?:\.[^./]+?)?)\.([cm]?)ts$/i, function (m, tsx, d, ext, cm) {
+            return tsx ? preserveJsx ? ".jsx" : ".js" : d && (!ext || !cm) ? m : (d + ext + "." + cm.toLowerCase() + "js");
+        });
+    }
+    return path;
+};
+import { basename, join } from 'node:path';
+import { answerOf, placeOf } from "../core/answer.js";
+import { LOCK, parse } from '@lapxo/topos/wire';
+import { aboutOf, members, valueOf } from "../core/lock.js";
+import { sayIn } from "../core/surface.js";
+import { matchTemplate, refusedOn, shapeOf, surfaceOf } from "../ports/surface.js";
+import { birth, closing, founded, land, landAct, limits, pinnedAt, policyAt, run, settledView, sign, standingAt, told, words } from "../ports/bound.js";
+import { configureHost, authorityAt } from "../ports/host.js";
+import { held, keep } from "../ports/cache.js";
+import { dropAt, hasAt, layAt, listAt, takeAt } from "../ports/place.js";
+import * as documents from "../ports/documents.js";
+import { keychain, portOf } from "../ports/keychain.js";
+import { deviceOf, idIn, signingOf } from "../core/device.js";
+import { personOf } from "../ports/access/person.js";
+import { readAhead } from "../ahead/read.js";
+import { cardAt } from "../verbs/card.js";
+import { digestOf, guardOf, refusalsOf } from "./guard.js";
+export const askedOf = (raw) => Object.fromEntries(Object.entries(raw ?? {}).map(([k, v]) => [k, v === undefined ? undefined : typeof v === 'object' ? JSON.stringify(v) : String(v)]));
+/** head behind a door: its lock read, every call answered one at a time and each answer's next read ahead, the same for every door. */
+export const headOf = (lock, root, ext, door) => {
+    const surface = surfaceOf(lock), runs = valueOf(lock, 'runs'), refused = refusedOn(lock, process.platform);
+    Object.assign(words, Object.fromEntries(['read', 'view', 'sign', 'land', 'key', 'signer', 'pin', 'topos', 'standing', 'evidence', 'act', 'profile', 'receipts', 'refusal', 'identity'].map((w) => [w, valueOf(lock, `bound/${w}`)])));
+    Object.assign(limits, { wait: Number(valueOf(lock, 'bound/wait').split('..')[1]), most: Number(valueOf(lock, 'bound/printed').split('..')[1]) });
+    Object.assign(birth, { at: valueOf(lock, 'founding/person-at'), file: valueOf(lock, 'founding/birth-file') });
+    configureHost(lock, limits);
+    /** One call at a time, each after the one before it and never on a timer, so one asked while another lands sees its receipt; a place's reads go to its fold host, which outlives the call and never holds a signer. */
+    let [last, ahead] = [Promise.resolve(), new AbortController()];
+    const turn = (act) => ((next) => { last = next.catch(() => undefined); return next; })(last.then(act));
+    /** What head refuses through this door, written as every door writes it; a door that reaches for a signing key is one such refusal, named by the lock's line for that key and never by what the door asked. */
+    const [refusals, keyRefused] = [refusalsOf(lock, { write: (place, lot) => write(place, lot), now: () => Date.now() }, door.name), shapeOf([sayIn(lock)('signing-key-refused', {})]).cells[0].code];
+    for (const end of ['SIGTERM', 'SIGINT'])
+        process.once(end, () => void last.then(refusals.settle).finally(() => process.exit(0)));
+    /** The person, asked as the client lets head ask; every wait on them is counted, so a time ceiling measures head's work and never the person's. */
+    let waited = 0;
+    const timed = (ask) => async (...args) => { const t = Date.now(); try {
+        return await ask(...args);
+    }
+    finally {
+        waited += Date.now() - t;
+    } };
+    const asked = personOf(lock, door);
+    const person = { consent: timed(asked.consent), enter: timed(asked.enter), choose: timed(asked.choose), visit: timed(asked.visit) };
+    /** head is its home: the folder of its index of places, and the keychain service its keys live under, one per home, so two heads on one keychain never share a key. A place's root is told to bound by the key id its lock names, its secret kept there under the place's account. */
+    const home = process.env[valueOf(lock, 'home/env')] || join(process.env[valueOf(lock, `platform/${process.platform}/home`)] ?? '', valueOf(lock, 'home/folder'));
+    const service = `${deviceOf(lock).service}/${basename(home).replace(/[^\w.-]+/g, '-')}`;
+    const store = valueOf(lock, `platform/${process.platform}/store`);
+    const keys = keychain(service, store, signingOf(lock));
+    const devices = new Map();
+    const device = (role) => devices.get(role) ?? ((key) => (key === undefined ? undefined : (devices.set(role, key), key)))(keys.held?.(deviceOf(lock, role).account));
+    const asRoot = (account) => ((device, key) => [key, device.signer, portOf(service, account, store, limits.wait)])(deviceOf(lock), valueOf(lock, 'founding/root').split('/')[1]);
+    const asRole = (role, lines) => ((one, id) => [id, one.signer, portOf(service, one.account, store, limits.wait)])(deviceOf(lock, role), idIn(lines, device(role)) ?? deviceOf(lock, role).account);
+    /** What a call is answered with, one call at a time as when bound blocked head: every bound process it starts is stopped when the client cancels it, and a call cancelled while it waits its turn is never begun. */
+    const contextOf = (signal) => {
+        /** One call's folds of a place, kept until something lands in it or is laid there; the places its root acted in, whose receipts close once, when the call ends; and those where anything but a read's receipts landed, as bound printed it. */
+        const [folds, touched, moved] = [new Map(), new Set(), new Set()], forget = (place) => { for (const k of [...folds.keys()])
+            if (k.endsWith(`\0${place}`))
+                folds.delete(k); };
+        const read = (at) => at?.startsWith(`${valueOf(lock, 'receipt/at')}:`) === true;
+        const once = (key, place, fold) => (folds.get(`${key}\0${place}`) ?? ((p) => (folds.set(`${key}\0${place}`, p), p))(fold()));
+        const acted = (place, root, done) => done.then((got) => { if ('lines' in got && !got.lines.every((l) => ((f) => f.kind === 'fact' && read(f.value.fields['at']))(parse(l))))
+            moved.add(place); return got; }).finally(() => { forget(place); if (root)
+            touched.add(place); });
+        const covered = async (place, lot, then) => {
+            const checked = await authorityAt(place, valueOf(lock, 'founding/root').split('/')[1], 'record-coverage', lot, Date.now(), signal);
+            return 'refused' in checked ? { refused: checked.refused } : checked.decision !== 'allow' ? { refused: `REFUSE·authority-preflight/${checked.decision} ${checked.needs.join('|')}` } : then();
+        };
+        return {
+            lock,
+            bound: (cwd, args) => run(runs, cwd, args, {}, signal),
+            standing: (place) => once('standing', place, () => standingAt(runs, place, (lines) => ['head', 'person'].flatMap((role) => ((id) => (id === undefined ? [] : [id]))(idIn(lines, device(role)))), (line) => read(line.at), signal)),
+            authority: (place, key, kind, records, presented) => authorityAt(place, key, kind, records, Date.now(), signal, presented),
+            policy: (place) => once('policy', place, () => policyAt(runs, place, signal)),
+            world: (place, view) => once(`world/${view}`, place, () => settledView(runs, place, view, signal)),
+            adapter: async (origin) => ((name) => (!/^[a-z-]+$/.test(name) ? undefined : import(__rewriteRelativeImportExtension(new URL(`../ports/adapters/${name}${ext}`, import.meta.url).href))))(URL.canParse(origin) ? valueOf(lock, `adapter/${new URL(origin).protocol.slice(0, -1)}`) : ''),
+            files: { lay: (place, rel, bytes) => { forget(place); layAt(place, rel, bytes); }, drop: (place, rel) => { forget(place); dropAt(place, rel); }, has: hasAt, list: listAt, read: documents, take: takeAt, own: (rel) => takeAt(join(root, rel)) },
+            home: () => home,
+            personal: () => process.env[valueOf(lock, `platform/${process.platform}/home`)] ?? '',
+            found: (place, account) => acted(place, true, founded(runs, place, ...asRoot(account), signal)),
+            signRoot: (place, lot, account) => covered(place, lot, () => sign(runs, place, lot, ...asRoot(account), signal)),
+            landRoot: (place, lot, account) => acted(place, true, covered(place, lot, () => landAct(runs, place, lot, ...asRoot(account), signal))),
+            moved: (place) => moved.has(place),
+            settle: async () => { const red = []; for (const place of touched) {
+                const why = await closing(runs, place, signal);
+                if (why !== undefined)
+                    red.push(sayIn(lock)('receipts-open', { place, why }));
+            } touched.clear(); return red; },
+            pinned: (place, file) => pinnedAt(runs, place, file, signal),
+            access: async (kind) => (kind !== valueOf(lock, 'access/adapter') || !/^[a-z0-9-]+$/.test(kind) ? undefined : import(__rewriteRelativeImportExtension(new URL(`../ports/access/${kind}${ext}`, import.meta.url).href)).then((m) => m.adapter)),
+            person,
+            cache: { keep, held },
+            signAs: (place, lot, role, lines) => sign(runs, place, lot, ...asRole(role, lines), signal),
+            landAs: (place, lot, role, lines) => acted(place, false, landAct(runs, place, lot, ...asRole(role, lines), signal)),
+            land: (place, signed) => acted(place, true, land(runs, place, signed, signal)),
+            told: (place, signed) => told(runs, place, signed, words.standing, signal),
+            elicit: (message) => person.consent(message, aboutOf(lock, 'said/elicit/yes')),
+            now: () => Date.now(),
+            machine: () => Date.now() - waited,
+            begun: Date.now() - waited,
+            keys,
+            device,
+            roots: door.roots, client: door.client,
+        };
+    };
+    const call = (name, args, signal) => (ahead.abort(), turn(async () => {
+        const tool = surface.tools.find((one) => one.name === name), place = typeof args?.['place'] === 'string' ? args['place'] : '', keyed = (e) => ((key) => { if (key === undefined || !lock.some((l) => l.scope === key))
+            throw e; return [sayIn(lock)('signing-key-refused', { key, place })]; })(/^REFUSE·keychain (\S+) names a signing key/.exec(e.message)?.[1]);
+        if (tool === undefined)
+            return undefined;
+        const context = contextOf(signal), answer = refused !== undefined ? [refused] : signal.aborted ? [] : [...await (await answerOf('tools', tool.name))(askedOf(args), context).catch(keyed), ...await context.settle()];
+        void ((early) => turn(() => readAhead(shapeOf(answer).cells, contextOf(), early.signal)))(ahead = new AbortController());
+        return answer;
+    }).then(async (answer) => { if (answer !== undefined && shapeOf(answer).cells.some((c) => c.code === keyRefused))
+        await refusals.write(typeof args?.['place'] === 'string' ? args['place'] : await placed(), name, digestOf(name, args ?? {}), keyRefused); return answer; }));
+    const resource = (uri, signal) => turn(async () => {
+        const found = surface.resources.flatMap((r) => ((vars) => (vars === undefined ? [] : [{ r, vars }]))(matchTemplate(r.template, uri)))[0];
+        if (found === undefined)
+            return undefined;
+        if (refused !== undefined)
+            return { mime: found.r.mime, lines: [refused] };
+        return { mime: found.r.mime, lines: await (await answerOf('resources', found.r.name))(askedOf(found.vars), contextOf(signal)) };
+    });
+    /** A place's card now, as do reads it; whether head's index names a place yet, and the one it names; lines head's own key lands in a place, on its standing. */
+    const [cardOf, placed] = [(place) => turn(() => cardAt(contextOf(), place)), () => turn(() => placeOf({}, contextOf()))];
+    const hasPlace = () => turn(async () => ((c) => (!c.files.has(home, LOCK) ? false : c.policy(home).then((held) => !('refused' in held) && held.lines.some((l) => l.scope?.startsWith(`${valueOf(lock, 'home/family')}/`) && l.value !== 'withdraw'))))(contextOf()));
+    const write = (place, lot) => turn(async () => ((c) => c.standing(place).then((held) => ('refused' in held ? held : c.landAs(place, lot, 'head', held.lines))))(contextOf()));
+    return { surface, call, resource, idle: () => last, cardOf, placed, hasPlace, write, refusals, now: () => contextOf().now() };
+};
+/** A door that shows no form: its verbs, each answered by its tool through the guard every such door asks, a verb that is no tool carried as its carrier's action; undefined for a verb it lacks. */
+export const plainOf = (lock, root, ext, name) => {
+    const [head, verbs, carrier] = [headOf(lock, root, ext, { can: () => ({ url: false, form: false }), elicit: async () => ({ action: 'decline' }), roots: async () => [], client: () => undefined, name }), members(valueOf(lock, 'doors/verbs')), valueOf(lock, 'doors/carrier')];
+    const guard = guardOf(lock, head, (verb, args) => ((tool) => head.call(tool ? verb : carrier, tool ? args : { ...args, action: verb }, new AbortController().signal))(head.surface.tools.some((t) => t.name === verb)));
+    return { head, verbs, settle: guard.settle, asked: async (verb, args) => (verbs.includes(verb) ? guard.call(verb, args) : undefined) };
+};

package/dist/src/doors/http.d.ts

@@ -0,0 +1,3 @@
+import { type Said } from '../core/lock.ts';
+/** The http door, on this device's loopback alone: one POST a verb, its body the args, its answer the cells every door gives; a Host not its own, or any Origin, is refused by name. It ends when its input does. */
+export declare const open: (lock: readonly Said[], root: string, ext: string, name: string) => Promise<void>;

package/dist/src/doors/http.js

@@ -0,0 +1,34 @@
+import { createServer } from 'node:http';
+import { valueOf } from "../core/lock.js";
+import { sayIn } from "../core/surface.js";
+import { shapeOf } from "../ports/surface.js";
+import { plainOf } from "./head.js";
+/** The http door, on this device's loopback alone: one POST a verb, its body the args, its answer the cells every door gives; a Host not its own, or any Origin, is refused by name. It ends when its input does. */
+export const open = (lock, root, ext, name) => new Promise((done) => {
+    const [loopback, asked, say] = [valueOf(lock, 'doors/loopback'), process.argv[4] ?? '0', sayIn(lock)];
+    if (!/^\d+$/.test(asked)) {
+        process.stdout.write(`${JSON.stringify(shapeOf([say('door-bind', { asked, loopback })]))}\n`);
+        process.exitCode = 1;
+        done();
+        return;
+    }
+    const door = plainOf(lock, root, ext, name);
+    const server = createServer((request, out) => {
+        const [own, answer] = [`${loopback}:${server.address().port}`, (status, lines) => out.writeHead(status, { 'content-type': 'application/json' }).end(JSON.stringify(shapeOf(lines)))];
+        if (request.headers.origin !== undefined || request.headers.host !== own)
+            return void answer(403, [say(request.headers.origin !== undefined ? 'door-origin' : 'door-host', { origin: request.headers.origin ?? '', host: request.headers.host ?? '', own })]);
+        let body = '';
+        request.on('data', (chunk) => { body += chunk; }).on('end', async () => {
+            const args = ((t) => { try {
+                return JSON.parse(t || '{}');
+            }
+            catch {
+                return undefined;
+            } })(body);
+            const lines = request.method === 'POST' && args !== null && typeof args === 'object' && !Array.isArray(args) ? await door.asked((request.url ?? '').slice(1), args) : undefined;
+            answer(lines === undefined ? 400 : 200, lines ?? [say('door-unasked', { verbs: door.verbs.join(', ') })]);
+        });
+    });
+    server.listen(Number(asked), loopback, () => process.stdout.write(`${JSON.stringify({ port: server.address().port })}\n`));
+    process.stdin.on('end', () => server.close(() => void door.settle().then(door.head.idle).then(() => done()))).resume();
+});

package/dist/src/doors/lines.d.ts

@@ -0,0 +1,3 @@
+import type { Said } from '../core/lock.ts';
+/** The lines door: one JSON request a line in, its answer one JSON line out, the cells as every door gives them. */
+export declare const open: (lock: readonly Said[], root: string, ext: string, name: string) => Promise<void>;

package/dist/src/doors/lines.js

@@ -0,0 +1,21 @@
+import { createInterface } from 'node:readline';
+import { sayIn } from "../core/surface.js";
+import { shapeOf } from "../ports/surface.js";
+import { plainOf } from "./head.js";
+/** The lines door: one JSON request a line in, its answer one JSON line out, the cells as every door gives them. */
+export const open = (lock, root, ext, name) => new Promise((done) => {
+    const [door, say] = [plainOf(lock, root, ext, name), sayIn(lock)];
+    const answered = (id, answer) => process.stdout.write(`${JSON.stringify({ id, ...shapeOf(answer ?? [say('door-unread', { verbs: door.verbs.join(', ') })]) })}\n`);
+    let pending = Promise.resolve();
+    createInterface({ input: process.stdin }).on('line', (text) => {
+        pending = pending.then(async () => {
+            const asked = ((t) => { try {
+                return JSON.parse(t);
+            }
+            catch {
+                return {};
+            } })(text);
+            answered(asked.id, await door.asked(asked.verb ?? '', asked.args));
+        });
+    }).on('close', () => void pending.then(door.settle).then(door.head.idle).then(() => done()));
+});

package/dist/src/flows/device.d.ts

@@ -17,6 +17,9 @@ export declare const rootIn: (context: Context, place: string) => {
  * lock as its parent has nothing signed here: what the parent would cut is bound's to judge.
  */
 type By = {
+    readonly key: string;
+    readonly root: boolean;
+    readonly records: (lot: readonly string[]) => readonly string[];
     readonly sign: (lot: readonly string[]) => Promise<Outcome>;
     readonly land: (lot: readonly string[]) => Promise<Outcome>;
 };

package/dist/src/flows/device.js

@@ -7,19 +7,17 @@ import { adoptsIn } from "../adopt/adopt.js";
 /** A key of this device by its role: read from the keychain, or made there once; only its public half is ever handed on. */
 export const deviceKey = (context, role) => context.keys.made?.(deviceOf(context.lock, role).account);
 /** The keychain account of a place's root, when this keychain holds it — who configures the place is here; else what head says of that. */
-export const rootIn = (context, place) => ((account) => (context.keys.read(account) === undefined ? { said: [sayIn(context.lock)('no-root', { place })] } : { account }))(fill(valueOf(context.lock, 'founding/root-account'), { place: placeNameOf(place) }));
+export const rootIn = (context, place) => ((account) => (context.keys.held?.(account) === undefined ? { said: [sayIn(context.lock)('no-root', { place })] } : { account }))(fill(valueOf(context.lock, 'founding/root-account'), { place: placeNameOf(place) }));
 export const widening = (context, place, lines, lot) => {
     const parent = adoptsIn(context.lock, lines);
     if (parent !== undefined)
         return { said: [sayIn(context.lock)('parent-lock', { place, parent })] };
     const [root, witness, field] = [rootIn(context, place), idIn(lines, context.device('person')), valueOf(context.lock, 'widening/witness')];
-    const wire = lines.filter((l) => l.scope === 'wire/fields');
+    const wire = lines.filter((l) => l.scope === 'wire/fields'), admits = wire.some((l) => members(l.value ?? '').includes(field));
     const witnessed = (signed) => signed.map((line) => ((got) => (got.kind === 'fact' ? canonical({ ...got.value.fields, [field]: witness }) : line))(parse(line)));
     if ('account' in root && witness !== undefined) {
-        if (wire.some((l) => members(l.value ?? '').includes(field)))
-            return { sign: (signed) => context.signRoot(place, witnessed(signed), root.account), land: (signed) => context.landRoot(place, witnessed(signed), root.account) };
-        if (lot.every((line) => / scope=wire\/fields /.test(line)))
-            return { sign: (signed) => context.signRoot(place, signed, root.account), land: (signed) => context.landRoot(place, signed, root.account) };
+        if (admits || lot.every((line) => / scope=wire\/fields /.test(line)))
+            return { key: valueOf(context.lock, 'founding/root').split('/')[1], root: true, records: (signed) => admits ? witnessed(signed) : signed, sign: (signed) => context.signRoot(place, admits ? witnessed(signed) : signed, root.account), land: (signed) => context.landRoot(place, admits ? witnessed(signed) : signed, root.account) };
         const [named, bare] = [[...new Set([...wire.flatMap((l) => members(l.value ?? '')), field])].join('|'), (l) => Object.fromEntries(Object.entries(l).filter(([k]) => !['sig', 'epoch'].includes(k)))];
         return { said: [sayIn(context.lock)('unwitnessed', { place }), ...wire.map((l) => canonical({ ...bare(l), by: 'target', value: 'withdraw' })),
                 canonical({ at: `policy:head/wire/${new Date(context.now()).toISOString()}`, by: 'target', form: 'alphabet', measure: 'id', role: 'reads', scope: 'wire/fields', value: named })] };
@@ -28,5 +26,5 @@ export const widening = (context, place, lines, lot) => {
     if (stopped)
         return { said: stopped };
     const again = lot.flatMap((line) => ((got) => (got.kind === 'fact' && lines.some((l) => l.scope === got.value.fields.scope && l.measure === got.value.fields.measure) ? [got.value.fields.scope ?? ''] : []))(parse(line)))[0];
-    return again !== undefined ? { said: [sayIn(context.lock)('attested-again', { place, scope: again })] } : { sign: (signed) => context.signAs(place, signed, 'person', lines), land: (signed) => context.landAs(place, signed, 'person', lines) };
+    return again !== undefined ? { said: [sayIn(context.lock)('attested-again', { place, scope: again })] } : { key: witness, root: false, records: (signed) => signed, sign: (signed) => context.signAs(place, signed, 'person', lines), land: (signed) => context.landAs(place, signed, 'person', lines) };
 };

package/dist/src/flows/plan.d.ts

@@ -1,4 +1,6 @@
 import type { Asked, Context } from '../core/answer.ts';
+/** Bound observes exact configuration records; Q4 domain checks remain in Head's existing card. */
+export declare const authorityFor: (context: Context, place: string, key: string, kind: string, records: readonly string[], observe?: boolean, presented?: string) => Promise<readonly string[] | undefined>;
 /**
  * A proposal the person signs: drafted lines shown to the person with the place and the base they are made against; on
  * their yes to exactly those, signed by their key; what bound prints folding it as if landed comes back as it printed it. Nothing lands; the lot is kept by its digest.

package/dist/src/flows/plan.js

@@ -2,6 +2,14 @@ import { baseOf, inPlace, standingOr } from "../core/answer.js";
 import { sayIn } from "../core/surface.js";
 import { widening } from "./device.js";
 import { parse } from '@lapxo/topos/wire';
+const moved = async (context, place, base) => ((now) => ('said' in now ? now.said : baseOf(now.lines) !== base ? [sayIn(context.lock)('base-moved', { base })] : undefined))(await standingOr(context, place));
+/** Bound observes exact configuration records; Q4 domain checks remain in Head's existing card. */
+export const authorityFor = async (context, place, key, kind, records, observe = false, presented) => {
+    const result = await context.authority(place, key, kind, records, presented), say = sayIn(context.lock);
+    if ('refused' in result)
+        return [say('authority-refused', { place, key, kind, why: result.refused, code: result.code })];
+    return observe || result.decision !== 'allow' ? [say(observe ? 'authority-card' : result.decision === 'deny' ? 'authority-refused' : 'authority-needed', { place, key, kind, decision: result.decision, authority: result.authority, request: result.request, needs: result.needs.join('|'), why: result.decision })] : undefined;
+};
 /**
  * A proposal the person signs: drafted lines shown to the person with the place and the base they are made against; on
  * their yes to exactly those, signed by their key; what bound prints folding it as if landed comes back as it printed it. Nothing lands; the lot is kept by its digest.
@@ -18,6 +26,9 @@ export const planLot = (asked, context) => inPlace(asked, context, async (place)
     const by = widening(context, place, held.lines, lot);
     if ('said' in by)
         return by.said;
+    const initial = by.root ? await authorityFor(context, place, by.key, 'record-coverage', by.records(lot)) : undefined;
+    if (initial)
+        return initial;
     const consent = await context.elicit(say('elicit', { count: String(lot.length), place, base, lines: lot.join('\n') }));
     if (consent === 'none')
         return [say('sign-yourself', { place }), ...lot];
@@ -26,12 +37,10 @@ export const planLot = (asked, context) => inPlace(asked, context, async (place)
     const signed = await by.sign(lot);
     if ('refused' in signed)
         return [signed.refused];
-    const now = await standingOr(context, place);
-    if ('said' in now)
-        return now.said;
-    if (baseOf(now.lines) !== base)
-        return [say('base-moved', { base })];
-    const kept = context.cache.keep(Buffer.from(JSON.stringify({ place, base, signed: signed.lines })));
+    const stale = await moved(context, place, base);
+    if (stale)
+        return stale;
+    const kept = context.cache.keep(Buffer.from(JSON.stringify({ place, base, signed: signed.lines, root: by.root })));
     return [say('planned', { lot: kept, base }), ...(await context.told(place, signed.lines))];
 });
 /** A planned lot landed by its digest, only while the place stands on the base it was planned against. */
@@ -41,11 +50,13 @@ export const landLot = async (asked, context) => {
     if (bytes === undefined)
         return [say('no-lot', { lot: asked['lot'] ?? '' })];
     const kept = JSON.parse(Buffer.from(bytes).toString('utf8'));
-    const now = await standingOr(context, kept.place);
-    if ('said' in now)
-        return now.said;
-    if (baseOf(now.lines) !== kept.base)
-        return [say('base-moved', { base: kept.base })];
+    const stale = await moved(context, kept.place, kept.base);
+    if (stale)
+        return stale;
+    const author = parse(kept.signed[0] ?? '');
+    const checked = kept.root ? await authorityFor(context, kept.place, author.kind === 'fact' ? author.value.fields.by ?? '' : '', 'admission', kept.signed) : undefined;
+    if (checked)
+        return checked;
     const landed = await context.land(kept.place, kept.signed);
     return 'refused' in landed ? [landed.refused] : [say('landed', { count: String(landed.lines.length) }), ...landed.lines];
 };

package/dist/src/flows/read.js

@@ -9,7 +9,7 @@ import { principalOf } from "../access/obtain.js";
 import { jsonOf } from "../access/contract.js";
 import { refusedAccess } from "../sources/refused.js";
 import { hand, keptOf } from "../kept/kept.js";
-import { markOf, overOf } from "../ahead/budget.js";
+import { calledIn, markOf, overOf } from "../ahead/budget.js";
 /** An intent an earlier act left open, closed by the read that looked at what it would have changed: a line naming that read-s digest, signed by head. */
 const closeWith = async (intent, source, digest, { word, lines, lands }, context) => {
     const say = sayIn(context.lock);
@@ -72,6 +72,9 @@ export const readSource = (asked, context) => called(asked, context, planRead, a
     const again = was?.kind === 'again' ? say(`kept-${was.why}`, { source, operation, at: was.at }) : [];
     if (overOf(lines, [family, at, word('ahead/mark')], source, context.now(), most('read/rate'), Number(word('ahead/share').split('..')[1]), asked))
         return asked['ahead'] === 'true' ? [] : say('rate', { source });
+    const calls = lines.find((l) => l.scope === `${word('calls/family')}/${source}`), made = calls && calledIn(lines, [family, at, word('ahead/mark')], source, calls.measure ?? '', context.now());
+    if (calls && (made === undefined || made >= most(calls.scope)))
+        return asked['ahead'] === 'true' ? [] : say(made === undefined ? 'calls-unwindowed' : 'calls-owed', { source, calls: String(most(calls.scope)), window: calls.measure });
     const attached = await attach();
     if ('said' in attached)
         return attached.said;

package/dist/src/index.js

@@ -7,144 +7,45 @@ var __rewriteRelativeImportExtension = (this && this.__rewriteRelativeImportExte
     }
     return path;
 };
-import { basename, join } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { Server } from '@modelcontextprotocol/sdk/server/index.js';
 import { StdioServerTransport } from '@modelcontextprotocol/sdk/server/stdio.js';
 import { CallToolRequestSchema, GetPromptRequestSchema, ListPromptsRequestSchema, ListResourcesRequestSchema, ListResourceTemplatesRequestSchema, ListToolsRequestSchema, ReadResourceRequestSchema } from '@modelcontextprotocol/sdk/types.js';
-import { answerOf } from "./core/answer.js";
-import { parse } from '@lapxo/topos/wire';
-import { aboutOf, valueOf } from "./core/lock.js";
-import { fill, sayIn } from "./core/surface.js";
-import { matchTemplate, refusedOn, shapeOf, shapeSchema, surfaceOf } from "./ports/surface.js";
-import { birth, closing, cooled, founded, land, landAct, limits, pinnedAt, policyAt, run, settledView, sign, standingAt, told, warm, words } from "./ports/bound.js";
-import { warmth } from "./ports/warm.js";
-import { held, keep } from "./ports/cache.js";
-import { registryFor } from "./ports/signers.js";
-import { dropAt, folderOf, hasAt, layAt, listAt, lockAt, takeAt } from "./ports/place.js";
-import * as documents from "./ports/documents.js";
-import { keychain } from "./ports/keychain.js";
-import { algorithmOf, deviceOf, idIn } from "./core/device.js";
-import { publicOf } from "./ports/keys.js";
-import { personOf } from "./ports/access/person.js";
-import { readAhead } from "./ahead/read.js";
+import { aboutOf, members, valueOf } from "./core/lock.js";
+import { fill } from "./core/surface.js";
+import { shapeOf, shapeSchema } from "./ports/surface.js";
+import { folderOf, lockAt } from "./ports/place.js";
+import { askedOf, headOf } from "./doors/head.js";
 const [ext, root] = ((self) => [self.slice(self.lastIndexOf('.')), fileURLToPath(new URL(self.endsWith('.ts') ? '..' : '../..', self))])(import.meta.url);
 const lock = lockAt(root);
-if (process.argv[2] !== valueOf(lock, 'cli/run')) {
+const [door, doors] = [process.argv[3], members(valueOf(lock, 'cli/run/doors'))];
+if (process.argv[2] !== valueOf(lock, 'cli/run') || (door !== undefined && !doors.includes(door))) {
     process.stdout.write(`${aboutOf(lock, 'cli/help')}\n`);
     process.exit(0);
 }
-const surface = surfaceOf(lock);
-const runs = valueOf(lock, 'runs');
-Object.assign(words, Object.fromEntries(['read', 'view', 'sign', 'land', 'key', 'signer', 'pin', 'topos', 'standing', 'evidence', 'act', 'profile', 'receipts', 'refusal', 'identity'].map((w) => [w, valueOf(lock, `bound/${w}`)])));
-Object.assign(limits, { wait: Number(valueOf(lock, 'bound/wait').split('..')[1]), most: Number(valueOf(lock, 'bound/printed').split('..')[1]) });
-Object.assign(birth, { at: valueOf(lock, 'founding/person-at'), file: valueOf(lock, 'founding/birth-file') });
-Object.assign(warmth, { spares: Number(valueOf(lock, 'bound/spares').split('..')[1]), boot: valueOf(lock, 'bound/spare-env').split('|') });
-/** One call at a time, each after the one before it and never on a timer, so one asked while another lands sees its receipt; bound started ahead for it, and nothing of it kept once it is answered. */
-let [last, ahead] = [Promise.resolve(), new AbortController()];
-const turn = (act) => ((next) => { last = next.catch(() => undefined); return next; })(last.then(() => { void warm(runs); return act().finally(cooled); }));
-for (const end of ['SIGTERM', 'SIGINT'])
-    process.once(end, () => void last.finally(() => process.exit(0)));
+if (door !== undefined && door !== doors[0]) {
+    await (await import(__rewriteRelativeImportExtension(new URL(`./doors/${door}${ext}`, import.meta.url).href))).open(lock, root, ext, door);
+    process.exit();
+}
 const offered = (n) => (n ? { listChanged: false } : undefined);
+const head = headOf(lock, root, ext, {
+    can: () => ((e) => ({ url: Boolean(e?.url), form: e !== undefined && (e.form !== undefined || Object.keys(e).length === 0) }))(server.getClientCapabilities()?.elicitation), elicit: (params) => server.elicitInput(params, { timeout: Number(valueOf(lock, 'access/wait').split('..')[1]) }),
+    roots: async () => (server.getClientCapabilities()?.roots ? (await server.listRoots()).roots.flatMap((root) => folderOf(root.uri) ?? []) : []), client: () => ((c) => (c ? `${c.name}@${c.version}` : undefined))(server.getClientVersion()), name: doors[0],
+}), surface = head.surface;
 const server = new Server({ name: surface.name, version: surface.version }, { capabilities: { tools: offered(surface.tools.length), resources: offered(surface.resources.length), prompts: offered(surface.prompts.length) }, instructions: aboutOf(lock, 'prose/en/instructions') });
-/** The person, asked as the client lets head ask; every wait on them is counted, so a time ceiling measures head's work and never the person's. */
-let waited = 0;
-const timed = (ask) => async (...args) => { const t = Date.now(); try {
-    return await ask(...args);
-}
-finally {
-    waited += Date.now() - t;
-} };
-const asked = personOf(lock, { can: () => ((e) => ({ url: Boolean(e?.url), form: e !== undefined && (e.form !== undefined || Object.keys(e).length === 0) }))(server.getClientCapabilities()?.elicitation), elicit: (params) => server.elicitInput(params, { timeout: Number(valueOf(lock, 'access/wait').split('..')[1]) }) });
-const person = { consent: timed(asked.consent), enter: timed(asked.enter), choose: timed(asked.choose), visit: timed(asked.visit) };
-/** head is its home: the folder of its index of places, and the keychain service its keys live under, one per home, so two heads on one keychain never share a key. A place's root is told to bound by the key id its lock names, its secret kept there under the place's account. */
-const home = process.env[valueOf(lock, 'home/env')] || join(process.env[valueOf(lock, `platform/${process.platform}/home`)] ?? '', valueOf(lock, 'home/folder'));
-const service = `${deviceOf(lock).service}/${basename(home).replace(/[^\w.-]+/g, '-')}`;
-const store = valueOf(lock, `platform/${process.platform}/store`);
-const keys = keychain(service, store);
-const devices = new Map();
-const device = (role) => devices.get(role) ?? ((secret) => (secret === undefined ? undefined : ((key) => { devices.set(role, key); return key; })(publicOf(secret))))(keys.read(deviceOf(lock, role).account));
-const asRoot = (account) => ((device, key) => [key, device.signer, { BOUND_SIGNERS: registryFor(device.signer, service, account, key, valueOf(lock, 'founding/algorithm'), store) }])(deviceOf(lock), valueOf(lock, 'founding/root').split('/')[1]);
-/** What a call is answered with, one call at a time as when bound blocked head: every bound process it starts is stopped when the client cancels it, and a call cancelled while it waits its turn is never begun. */
-const contextOf = (signal) => {
-    /** One call's folds of a place, kept until something lands in it or is laid there; the places its root acted in, whose receipts close once, when the call ends; and those where anything but a read's receipts landed, as bound printed it. */
-    const [folds, touched, moved] = [new Map(), new Set(), new Set()], forget = (place) => { for (const k of [...folds.keys()])
-        if (k.endsWith(`\0${place}`))
-            folds.delete(k); };
-    const read = (at) => at?.startsWith(`${valueOf(lock, 'receipt/at')}:`) === true;
-    const once = (key, place, fold) => (folds.get(`${key}\0${place}`) ?? ((p) => (folds.set(`${key}\0${place}`, p), p))(fold()));
-    const acted = (place, root, done) => done.then((got) => { if ('lines' in got && !got.lines.every((l) => ((f) => f.kind === 'fact' && read(f.value.fields['at']))(parse(l))))
-        moved.add(place); return got; }).finally(() => { forget(place); if (root)
-        touched.add(place); });
-    const signRoot = (place, lot, account) => sign(runs, place, lot, ...asRoot(account), signal);
-    const signAs = (place, lot, role, lines) => ((one, id) => sign(runs, place, lot, id, one.signer, { BOUND_SIGNERS: registryFor(one.signer, service, one.account, id, algorithmOf(lines), store) }, signal))(deviceOf(lock, role), idIn(lines, device(role)) ?? deviceOf(lock, role).account);
-    return {
-        lock,
-        bound: (cwd, args) => run(runs, cwd, args, {}, signal),
-        standing: (place) => once('standing', place, () => standingAt(runs, place, (lines) => ['head', 'person'].flatMap((role) => ((id) => (id === undefined ? [] : [id]))(idIn(lines, device(role)))), (line) => read(line.at), signal)),
-        policy: (place) => once('policy', place, () => policyAt(runs, place, signal)),
-        world: (place, view) => once(`world/${view}`, place, () => settledView(runs, place, view, signal)),
-        adapter: async (origin) => ((name) => (!/^[a-z-]+$/.test(name) ? undefined : import(__rewriteRelativeImportExtension(new URL(`./ports/adapters/${name}${ext}`, import.meta.url).href))))(URL.canParse(origin) ? valueOf(lock, `adapter/${new URL(origin).protocol.slice(0, -1)}`) : ''),
-        files: { lay: (place, rel, bytes) => { forget(place); layAt(place, rel, bytes); }, drop: (place, rel) => { forget(place); dropAt(place, rel); }, has: hasAt, list: listAt, read: documents, take: takeAt, own: (rel) => takeAt(join(root, rel)) },
-        home: () => home,
-        personal: () => process.env[valueOf(lock, `platform/${process.platform}/home`)] ?? '',
-        found: (place, account) => acted(place, true, founded(runs, place, ...asRoot(account), signal)),
-        signRoot,
-        landRoot: (place, lot, account) => acted(place, true, landAct(runs, place, lot, ...asRoot(account), signal)),
-        moved: (place) => moved.has(place),
-        settle: async () => { const red = []; for (const place of touched) {
-            const why = await closing(runs, place, signal);
-            if (why !== undefined)
-                red.push(sayIn(lock)('receipts-open', { place, why }));
-        } touched.clear(); return red; },
-        pinned: (place, file) => pinnedAt(runs, place, file, signal),
-        access: async (kind) => (kind !== valueOf(lock, 'access/adapter') || !/^[a-z0-9-]+$/.test(kind) ? undefined : import(__rewriteRelativeImportExtension(new URL(`./ports/access/${kind}${ext}`, import.meta.url).href)).then((m) => m.adapter)),
-        person,
-        cache: { keep, held },
-        signAs,
-        landAs: (place, lot, role, lines) => acted(place, false, ((one, id) => landAct(runs, place, lot, id, one.signer, { BOUND_SIGNERS: registryFor(one.signer, service, one.account, id, algorithmOf(lines), store) }, signal))(deviceOf(lock, role), idIn(lines, device(role)) ?? deviceOf(lock, role).account)),
-        land: (place, signed) => acted(place, true, land(runs, place, signed, signal)),
-        told: (place, signed) => told(runs, place, signed, words.standing, signal),
-        elicit: (message) => person.consent(message, aboutOf(lock, 'said/elicit/yes')),
-        now: () => Date.now(),
-        machine: () => Date.now() - waited,
-        begun: Date.now() - waited,
-        keys,
-        device,
-        roots: async () => (server.getClientCapabilities()?.roots ? (await server.listRoots()).roots.flatMap((root) => folderOf(root.uri) ?? []) : []), client: () => ((c) => (c ? `${c.name}@${c.version}` : undefined))(server.getClientVersion()),
-    };
-};
-const askedOf = (raw) => Object.fromEntries(Object.entries(raw ?? {}).map(([k, v]) => [k, v === undefined ? undefined : typeof v === 'object' ? JSON.stringify(v) : String(v)]));
 const schemaOf = (fields) => ({ type: 'object',
     properties: Object.fromEntries(fields.map((f) => [f.name, { type: f.type, description: f.about }])), required: fields.filter((f) => f.required).map((f) => f.name) });
 if (surface.tools.length)
     server.setRequestHandler(ListToolsRequestSchema, () => ({ tools: surface.tools.map((tool) => ({ name: tool.name, description: tool.about,
             inputSchema: schemaOf([...tool.fields]), outputSchema: shapeSchema(lock), annotations: Object.fromEntries(tool.hints.map((hint) => [`${hint}Hint`, true])) })) }));
 if (surface.tools.length)
-    server.setRequestHandler(CallToolRequestSchema, async (request, extra) => (ahead.abort(), turn(async () => {
-        const tool = surface.tools.find((one) => one.name === request.params.name);
-        if (tool === undefined)
-            return { isError: true, content: [] };
-        const refused = refusedOn(lock, process.platform);
-        const context = contextOf(extra.signal), answer = refused !== undefined ? [refused] : extra.signal.aborted ? [] : [...await (await answerOf('tools', tool.name))(askedOf(request.params.arguments), context), ...await context.settle()];
-        void ((early) => turn(() => readAhead(shapeOf(answer).cells, contextOf(), early.signal)))(ahead = new AbortController());
-        return { content: [{ type: 'text', text: answer.join('\n') }], structuredContent: shapeOf(answer) };
-    })));
+    server.setRequestHandler(CallToolRequestSchema, async (request, extra) => ((answer) => (answer === undefined ? { isError: true, content: [] } : { content: [{ type: 'text', text: answer.join('\n') }], structuredContent: shapeOf(answer) }))(await head.call(request.params.name, request.params.arguments, extra.signal)));
 if (surface.resources.length)
     server.setRequestHandler(ListResourcesRequestSchema, () => ({ resources: [] }));
 if (surface.resources.length)
     server.setRequestHandler(ListResourceTemplatesRequestSchema, () => ({ resourceTemplates: surface.resources.map((r) => ({ name: r.name, uriTemplate: r.template, description: r.about, mimeType: r.mime })) }));
 if (surface.resources.length)
-    server.setRequestHandler(ReadResourceRequestSchema, async (request, extra) => turn(async () => {
-        const found = surface.resources.flatMap((r) => ((vars) => (vars === undefined ? [] : [{ r, vars }]))(matchTemplate(r.template, request.params.uri)))[0];
-        if (found === undefined)
-            return { contents: [] };
-        const refused = refusedOn(lock, process.platform);
-        if (refused !== undefined)
-            return { contents: [{ uri: request.params.uri, mimeType: found.r.mime, text: refused }] };
-        const lines = await (await answerOf('resources', found.r.name))(askedOf(found.vars), contextOf(extra.signal));
-        return { contents: [{ uri: request.params.uri, mimeType: found.r.mime, text: lines.join('\n') }] };
-    }));
+    server.setRequestHandler(ReadResourceRequestSchema, async (request, extra) => ((got) => ({ contents: got === undefined ? [] : [{ uri: request.params.uri, mimeType: got.mime, text: got.lines.join('\n') }] }))(await head.resource(request.params.uri, extra.signal)));
 if (surface.prompts.length)
     server.setRequestHandler(ListPromptsRequestSchema, () => ({ prompts: surface.prompts.map((p) => ({ name: p.name, description: p.about, arguments: p.fields.map((f) => ({ name: f.name, description: f.about, required: f.required })) })) }));
 if (surface.prompts.length)

package/dist/src/links/birth.d.ts

@@ -0,0 +1,6 @@
+import { type Asked, type Context } from '../core/answer.ts';
+import { type Said } from '../core/lock.ts';
+/** A separate public birth artifact. The source package, authority and personal birth journal are not its payload. */
+export declare const sharedBirth: (context: Context, to: string, standing: readonly Said[]) => readonly string[];
+/** Inline or client-shared local birth bytes are inspected only; no transport, signer, file write or admission is acquired. */
+export declare const receivedBirth: (asked: Asked, context: Context) => Promise<readonly string[] | undefined>;

package/dist/src/links/birth.js

@@ -0,0 +1,48 @@
+import { basename, join } from 'node:path';
+import { canonical, parse } from '@lapxo/topos/wire';
+import { PORTABLE_BIRTH_PROFILE, decodePortableBirth, encodePortableBirth, inspectPortableBirth } from '@lapxo/topos/contract';
+import { semanticStandingBytes } from '@lapxo/topos/standing';
+import { inStanding } from "../core/answer.js";
+import { members, valueOf } from "../core/lock.js";
+import { sayIn } from "../core/surface.js";
+import { digestIn } from "../core/worlds.js";
+const budget = (context) => ({ bytes: Number(valueOf(context.lock, 'bound/printed').split('..')[1]), items: Number(valueOf(context.lock, 'share/birth-items').split('..')[1]) });
+const refused = (context, error) => [sayIn(context.lock)('birth-refused', { why: error instanceof Error ? error.message : String(error) })];
+/** A separate public birth artifact. The source package, authority and personal birth journal are not its payload. */
+export const sharedBirth = (context, to, standing) => {
+    const say = sayIn(context.lock), scopes = members(valueOf(context.lock, 'share/birth-scopes')), file = valueOf(context.lock, 'share/birth-file');
+    const declarations = standing.filter(line => scopes.includes(line.scope ?? '')).map(({ by: _by, sig: _sig, epoch: _epoch, ...line }) => canonical(line));
+    if (!declarations.length)
+        return [say('birth-empty')];
+    try {
+        const record = encodePortableBirth({ origin: digestIn(context.lock)(semanticStandingBytes(standing.map(line => canonical(line)))), declarations }, budget(context)), bytes = new TextEncoder().encode(record);
+        context.files.lay(to, file, bytes);
+        return [say('birth-shared', { document: join(to, file), digest: digestIn(context.lock)(bytes), record })];
+    }
+    catch (error) {
+        return refused(context, error);
+    }
+};
+/** Inline or client-shared local birth bytes are inspected only; no transport, signer, file write or admission is acquired. */
+export const receivedBirth = async (asked, context) => {
+    const document = asked['document'] ?? '', inline = document.startsWith(PORTABLE_BIRTH_PROFILE.split('/')[0] + '/');
+    if (!inline && !(document.startsWith('/') && basename(document) === valueOf(context.lock, 'share/birth-file')))
+        return undefined;
+    return inStanding(asked, context, async (place, standing) => {
+        const say = sayIn(context.lock), bytes = inline ? new TextEncoder().encode(document) : (await context.files.read.documentOf(context, place, document))?.bytes;
+        if (!bytes)
+            return [say('birth-needs', { document })];
+        if (asked['digest'] && digestIn(context.lock)(bytes) !== asked['digest'])
+            return [say('document-digest', { document: inline ? PORTABLE_BIRTH_PROFILE : document, digest: asked['digest'], got: digestIn(context.lock)(bytes) })];
+        try {
+            const pack = decodePortableBirth(new TextDecoder().decode(bytes), budget(context)), allowed = members(valueOf(context.lock, 'share/birth-scopes'));
+            if (pack.declarations.some(line => ((p) => p.kind !== 'fact' || !allowed.includes(p.value.fields.scope ?? ''))(parse(line))))
+                return [say('birth-refused', { why: 'declaration outside the public birth selection' })];
+            const inspected = inspectPortableBirth(pack, [...new Set(standing.flatMap(line => line.scope ?? []))], budget(context));
+            return [say('birth-inspected', { inspection: inspected.status, collisions: inspected.collisions.join(', ') || 'none', origin: pack.origin, declarations: pack.declarations.join('\n') })];
+        }
+        catch (error) {
+            return refused(context, error);
+        }
+    }, context.policy);
+};

package/dist/src/links/inspect.d.ts

@@ -1,6 +1,6 @@
 import { type Asked, type Context } from '../core/answer.ts';
 /**
- * A #bound: link connected: inspected by the instrument in the person's place, never authenticated — its bytes are the
+ * A legacy or located reference connected: inspected by the instrument in the person's place, never authenticated — its bytes are the
  * link's, and nothing shows who shared it — and what it names is shown; nothing is connected or granted, since a package
  * is received by the digest its sharer sent apart. A place that admits no content transport is handed the lines that admit
  * one, to sign; bytes that do not arrive are owed by the link until they do; bytes that are not what it names are refused.