@lapxo/head 0.1.6 → 0.2.0

package/dist/src/links/inspect.js

@@ -1,44 +1,53 @@
 import { decodeReference } from '@lapxo/bound/reference';
+import { decodeLocatedReference, locatedReferenceIdentity } from '@lapxo/topos/contract';
 import { canonical } from '@lapxo/topos/wire';
-import { inPlace, standingOr } from "../core/answer.js";
+import { inStanding } from "../core/answer.js";
 import { members, valueOf } from "../core/lock.js";
 import { sayIn } from "../core/surface.js";
 import { linesOf } from "../core/worlds.js";
 import { rootIn } from "../flows/device.js";
 /**
- * A #bound: link connected: inspected by the instrument in the person's place, never authenticated — its bytes are the
+ * A legacy or located reference connected: inspected by the instrument in the person's place, never authenticated — its bytes are the
  * link's, and nothing shows who shared it — and what it names is shown; nothing is connected or granted, since a package
  * is received by the digest its sharer sent apart. A place that admits no content transport is handed the lines that admit
  * one, to sign; bytes that do not arrive are owed by the link until they do; bytes that are not what it names are refused.
  * Asked why, it shows the transport it reads by: the profile's lines, laid at the place's birth by head, never the person's.
  */
-export const linked = (asked, context) => inPlace(asked, context, async (place) => {
-    const [say, word, link] = [sayIn(context.lock), (k) => valueOf(context.lock, k), asked['document'] ?? ''], [held, admits] = [await standingOr(context, place, context.policy), members(valueOf(context.lock, 'link/transport'))];
-    if ('said' in held)
-        return held.said;
+export const linked = (asked, context) => inStanding(asked, context, async (place, standing) => {
+    const [say, word, link] = [sayIn(context.lock), (k) => valueOf(context.lock, k), asked['document'] ?? ''], admits = members(valueOf(context.lock, 'link/transport'));
     if (asked['why'] === 'true')
-        return [...held.lines.filter((l) => admits.includes(l.scope ?? '') || l.scope?.startsWith('transport/')).map((l) => canonical(l)), say('why-transport', { place })];
+        return [...standing.filter((l) => admits.includes(l.scope ?? '') || l.scope?.startsWith('transport/')).map((l) => canonical(l)), say('why-transport', { place })];
     const lines = context.lock.filter((l) => admits.some((s) => l.scope === `birth/${s}`)).map(({ about: _about, scope, ...l }) => canonical({ ...l, scope: scope.slice('birth/'.length), at: 'policy:person/transport', by: 'target' }));
     let reference;
+    const legacy = link.startsWith(word('link/prefix'));
     try {
-        reference = decodeReference(link);
+        reference = legacy ? (({ source, ...held }) => ({ ...held, location: source, 'location-class': 'holder' }))(decodeReference(link)) : decodeLocatedReference(link);
     }
     catch (refused) {
         return [say('link-refused', { link, why: refused instanceof Error ? refused.message : String(refused) })];
     }
-    if (![admits[0], `transport/${new URL(reference.source).protocol.slice(0, -1)}`].every((s) => held.lines.some((l) => l.scope === s)))
+    const identity = legacy ? link : locatedReferenceIdentity(reference), source = reference.location;
+    if (!source || reference['location-class'] === 'viewer')
+        return [say('reference-needs', { identity, needs: 'bytes/holder-location' })];
+    if (![admits[0], `transport/${new URL(source).protocol.slice(0, -1)}`].every((s) => standing.some((l) => l.scope === s)))
         return [say('transport-missing', { place, lines: lines.join('\n') })];
-    const [printed, scope] = [await context.bound(place, [word('bound/read'), link]), `${word('place/needs')}/bytes/${reference.blob.slice(reference.algorithm.length + 1, reference.algorithm.length + 17)}`];
-    const [owed, root, why] = [held.lines.find((l) => l.scope === scope && l.role === 'demands' && l.value === link), rootIn(context, place), printed?.err.filter((l) => !l.startsWith('{')).at(-1) ?? ''];
-    if ('said' in root)
-        return root.said;
+    const [printed, scope] = [await context.bound(place, [word('bound/read'), link]), `${word('place/needs')}/bytes/${reference.blob.slice(reference.algorithm.length + 1, legacy ? reference.algorithm.length + 17 : undefined)}`];
+    const [owed, why, absent] = [standing.find((l) => l.scope === scope && l.role === 'demands' && l.value === identity), printed?.err.filter((l) => !l.startsWith('{')).at(-1) ?? '', printed?.out.some((line) => line.startsWith('NEEDS '))];
     if (printed?.code !== 0 && !why.includes(word('link/unarrived')))
         return [say('link-refused', { link, why })];
-    const settled = (lot) => (lot.length ? context.landRoot(place, lot, root.account).then((got) => ('refused' in got ? say('not-landed', { why: got.refused }) : got.lines)) : Promise.resolve([]));
-    const due = { at: 'policy:head/link', by: 'target', form: 'alphabet', measure: 'id', role: 'demands', scope, value: link };
-    if (printed?.code !== 0)
-        return [say('link-owed', { place, source: reference.source }), ...await settled(owed ? [] : [canonical(due)])];
+    const settled = async (lot) => {
+        if (!lot.length)
+            return [];
+        const root = rootIn(context, place);
+        if ('said' in root)
+            return root.said;
+        const got = await context.landRoot(place, lot, root.account);
+        return 'refused' in got ? [say('not-landed', { why: got.refused })] : got.lines;
+    };
+    const due = { at: 'policy:head/link', by: 'target', form: 'alphabet', measure: 'id', role: 'demands', scope, value: identity };
+    if (printed?.code !== 0 || absent)
+        return [say('link-owed', { place, source }), ...await settled(owed ? [] : [canonical(due)])];
     const named = linesOf(new TextEncoder().encode(printed.out.filter((l) => l.startsWith('TOPOS ')).map((l) => l.slice('TOPOS '.length)).join('\n')));
     const sources = named.filter((l) => /^sources\/[^/]+$/.test(l.scope ?? '')).map((l) => l.scope.split('/')[1]);
-    return [say('inspected', { source: reference.source, sources: sources.join(', ') || '—', digest: reference.digest }), say('sharer-unverified', {}), ...await settled(owed ? [canonical({ ...due, value: 'withdraw' })] : [])];
-});
+    return [say('inspected', { source, sources: sources.join(', ') || '—', digest: reference.digest }), say('sharer-unverified', {}), ...await settled(owed ? [canonical({ ...due, value: 'withdraw' })] : [])];
+}, context.policy);

package/dist/src/links/link.d.ts

@@ -1,7 +1,7 @@
 import type { Context } from '../core/answer.ts';
 /**
  * A package's link: its lines as one standing document, laid in its folder as it is to be published — the link names that
- * document's bytes, never the package's files — and the #bound: link to it at the address the person publishes it at.
- * With no address there is no link, said so: a link needs where its bytes are published, and the digest still goes apart.
+ * document's bytes, never the package's files. The separate located profile keeps retrieval apart from content identity.
+ * Without a location the reference still names its content; it does not invent a holder or transfer authority.
  */
 export declare const linkOf: (context: Context, to: string, lines: readonly string[], urls: Readonly<Record<string, string>>) => readonly string[];

package/dist/src/links/link.js

@@ -1,25 +1,22 @@
-import { createHash } from 'node:crypto';
 import { join } from 'node:path';
-import { encodeReference } from '@lapxo/bound/reference';
+import { encodeLocatedReference } from '@lapxo/topos/contract';
 import { semanticStandingBytes } from '@lapxo/topos/standing';
 import { members, valueOf } from "../core/lock.js";
 import { sayIn } from "../core/surface.js";
-const sha = (bytes) => createHash('sha256').update(bytes).digest('hex');
+import { digestIn } from "../core/worlds.js";
 /**
  * A package's link: its lines as one standing document, laid in its folder as it is to be published — the link names that
- * document's bytes, never the package's files — and the #bound: link to it at the address the person publishes it at.
- * With no address there is no link, said so: a link needs where its bytes are published, and the digest still goes apart.
+ * document's bytes, never the package's files. The separate located profile keeps retrieval apart from content identity.
+ * Without a location the reference still names its content; it does not invent a holder or transfer authority.
  */
 export const linkOf = (context, to, lines, urls) => {
-    const say = sayIn(context.lock), [name, profile, [kind, algorithm]] = [valueOf(context.lock, 'link/document'), valueOf(context.lock, 'link/profile'), members(valueOf(context.lock, 'link/reference'))];
+    const say = sayIn(context.lock), digest = digestIn(context.lock), [name, profile, [kind, algorithm]] = [valueOf(context.lock, 'link/document'), valueOf(context.lock, 'link/profile'), members(valueOf(context.lock, 'link/reference'))];
     const standing = semanticStandingBytes(lines), bytes = new TextEncoder().encode(JSON.stringify({ profile, standing })), at = urls[name], document = join(to, name);
     context.files.lay(to, name, bytes);
-    if (at === undefined || !URL.canParse(at))
-        return [say('shared-unlinked', { document })];
     try {
-        return [say('shared-link', { document, at, link: encodeReference({ class: kind, algorithm, digest: sha(standing), blob: `${algorithm}:${sha(bytes)}`, source: new URL(at).href }) })];
+        return [say(at === undefined ? 'shared-unlinked' : 'shared-link', { document, at: at ?? '', link: encodeLocatedReference({ class: kind, algorithm, digest: digest(standing).slice(7), blob: digest(bytes), ...(at === undefined ? {} : { location: new URL(at).href, 'location-class': 'holder' }) }) })];
     }
     catch (refused) {
-        return [say('link-refused', { link: at, why: refused instanceof Error ? refused.message : String(refused) })];
+        return [say('link-refused', { link: name, why: refused instanceof Error ? refused.message : String(refused) })];
     }
 };

package/dist/src/places/found.js

@@ -18,7 +18,7 @@ const founded = async (context, dir, name) => {
     const [head, person] = [deviceKey(context, 'head'), deviceKey(context, 'person')];
     if (head === undefined || person === undefined)
         return { refused: 'no-keychain' };
-    if (context.keys.read(account) !== undefined)
+    if (context.keys.held?.(account) !== undefined)
         return { refused: 'place-taken' };
     const root = context.keys.made?.(account);
     if (root === undefined)

package/dist/src/ports/bound.d.ts

@@ -1,26 +1,24 @@
-import type { Said } from '../core/lock.ts';
+import { type Said } from '../core/lock.ts';
 import type { Outcome } from '../core/answer.ts';
-import { cooled } from './warm.ts';
+import type { portOf } from './keychain.ts';
 import type { Printed } from './process.ts';
 export type { Printed };
 export declare const limits: {
     wait: number;
     most: number;
 };
-/** bound run as a process in a folder, beside head and never blocking it, within the wait and the bytes head's lock gives it and stopped when the asker cancels: one started ahead when head holds one, else one started now. */
+/** bound asked in a folder, beside head and never blocking it, within the wait and the bytes head's lock gives it and stopped when the asker cancels: a place or one of its views read through the place's fold host, else a process started now, as for a document, a lot told or a sign: a host is always handed its place first, and bound folds a document only when it is named first; what it read from the temporary folder is removed once it ends, however it ends. */
 export declare const run: (name: string, cwd: string, args: readonly string[], env?: Readonly<Record<string, string>>, signal?: AbortSignal) => Promise<Printed | undefined>;
-/** bound started ahead of the first ask of a call, as many times as head's lock keeps it started; resolved once each is ready. */
-export declare const warm: (name: string) => Promise<unknown>;
-export { cooled };
 export type Folded = {
     readonly lines: readonly Said[];
 } | {
     readonly refused: string;
 };
-/** Read normative standing plus authenticated device evidence; ambiguous device history refuses. */
 export declare const policyAt: (name: string, place: string, signal?: AbortSignal) => Promise<Folded>;
 export declare const standingAt: (name: string, place: string, devicesOf: (lines: readonly Said[]) => readonly string[], isHistory: (line: Said) => boolean, signal?: AbortSignal) => Promise<Folded>;
-export declare const sign: (name: string, place: string, lot: readonly string[], key: string, signer: string, env: Readonly<Record<string, string>>, signal?: AbortSignal) => Promise<Outcome>;
+/** A sign or a land: in a host of its own for this one call, signed by head's signer through the port of the key it names, the lot handed in as the host's input. */
+type Port = ReturnType<typeof portOf>;
+export declare const sign: (_name: string, place: string, lot: readonly string[], key: string, signer: string, port: Port, signal?: AbortSignal) => Promise<Outcome>;
 /** A lot signed and landed in one process, its result read from what bound printed of the committed act: the records it admitted, never the receipt beside them; a place that declares no act result is refused by name. */
 /** A place's receipts rendered beside its lock, so bound alone checks the place: nothing when they closed, else why they did not. */
 export declare const closing: (name: string, place: string, signal?: AbortSignal) => Promise<string | undefined>;
@@ -29,8 +27,8 @@ export declare const birth: {
     at: string;
     file: string;
 }, birthed: (place: string, lot: readonly string[]) => void;
-export declare const landAct: (name: string, place: string, lot: readonly string[], key: string, signer: string, env: Readonly<Record<string, string>>, signal?: AbortSignal) => Promise<Outcome>;
-export declare const land: (name: string, place: string, signed: readonly string[], signal?: AbortSignal) => Promise<Outcome>;
+export declare const landAct: (_name: string, place: string, lot: readonly string[], key: string, signer: string, port: Port, signal?: AbortSignal) => Promise<Outcome>;
+export declare const land: (_name: string, place: string, signed: readonly string[], signal?: AbortSignal) => Promise<Outcome>;
 export declare const told: (name: string, place: string, signed: readonly string[], view: string, signal?: AbortSignal) => Promise<readonly string[]>;
 export declare const pinnedAt: (name: string, place: string, file: string, signal?: AbortSignal) => Promise<{
     readonly pin: string;
@@ -39,7 +37,7 @@ export declare const pinnedAt: (name: string, place: string, file: string, signa
 } | {
     readonly refused: string;
 } | undefined>;
-export declare const founded: (name: string, place: string, key: string, signer: string, env: Readonly<Record<string, string>>, signal?: AbortSignal) => Promise<Outcome>;
+export declare const founded: (_name: string, place: string, key: string, signer: string, port: Port, signal?: AbortSignal) => Promise<Outcome>;
 export declare const words: {
     read: string;
     view: string;

package/dist/src/ports/bound.js

@@ -1,12 +1,12 @@
-import { existsSync, mkdtempSync, readFileSync, writeFileSync } from 'node:fs';
+import { existsSync, readFileSync, writeFileSync } from 'node:fs';
 import { createRequire } from 'node:module';
-import { tmpdir } from 'node:os';
 import { dirname, join } from 'node:path';
 import { canonical, LOCK, parse } from '@lapxo/topos/wire';
+import { factsOf } from "../core/lock.js";
 import { spawned } from "./process.js";
-import { cooled, kept, warmed } from "./warm.js";
+import { capturedViews, hosted, hosting, signedIn } from "./host.js";
+import { cleared, scratchOf } from "./scratch.js";
 import { folded } from "../ahead/fold.js";
-import { readingOf } from "./reading.js";
 const binOf = (name) => {
     try {
         const manifest = createRequire(import.meta.url).resolve(join(name, 'package.json'));
@@ -18,9 +18,16 @@ const binOf = (name) => {
     }
 };
 export const limits = { wait: 0, most: 0 };
-/** bound run as a process in a folder, beside head and never blocking it, within the wait and the bytes head's lock gives it and stopped when the asker cancels: one started ahead when head holds one, else one started now. */
-export const run = async (name, cwd, args, env = {}, signal) => ((bin, at, bounds) => (bin === undefined ? undefined
-    : (warmed(bin, args, at, bounds) ?? spawned(process.execPath, [bin, ...args], at, bounds)).then(apart)))(binOf(name), { cwd, env: { ...process.env, ...env } }, { wait: limits.wait, most: limits.most || Number.MAX_SAFE_INTEGER, ...(signal ? { signal } : {}) });
+/** bound asked in a folder, beside head and never blocking it, within the wait and the bytes head's lock gives it and stopped when the asker cancels: a place or one of its views read through the place's fold host, else a process started now, as for a document, a lot told or a sign: a host is always handed its place first, and bound folds a document only when it is named first; what it read from the temporary folder is removed once it ends, however it ends. */
+export const run = async (name, cwd, args, env = {}, signal) => {
+    try {
+        return await ((bin, at, bounds) => (bin === undefined ? undefined
+            : (args[0] === words.read && (args.length === 1 || (args.length === 3 && args[1] === words.view)) && hosting.installed && !Object.keys(env).length ? hosted(cwd, args, signal) : spawned(process.execPath, [bin, ...args], at, bounds)).then(apart)))(binOf(name), { cwd, env: { ...process.env, ...env } }, { wait: limits.wait, most: limits.most || Number.MAX_SAFE_INTEGER, ...(signal ? { signal } : {}) });
+    }
+    finally {
+        cleared([...args, ...Object.values(env)]);
+    }
+};
 /** The record bound prints after a refusal's diagnostic, read apart from it: what bound printed is kept whole, the record beside it, and why bound refused is the diagnostic's last line, never the record. */
 const recordOf = (line) => { try {
     return ((got) => (got?.profile === words.refusal ? got : undefined))(JSON.parse(line));
@@ -31,26 +38,22 @@ catch {
 const isRecord = (line) => line.startsWith('{') && recordOf(line) !== undefined;
 const apart = (printed) => ((record) => (record === undefined ? printed : { ...printed, refusal: recordOf(record) }))([...printed.err].reverse().find(isRecord));
 const why = (printed) => printed?.err.filter((line) => !isRecord(line)).at(-1);
-/** bound started ahead of the first ask of a call, as many times as head's lock keeps it started; resolved once each is ready. */
-export const warm = (name) => ((bin) => (bin === undefined ? Promise.resolve() : kept(bin)))(binOf(name));
-export { cooled };
-const facts = (out) => out.flatMap((line) => ((got) => (got.kind === 'fact' ? [got.value.fields] : []))(parse(line)));
-const readOf = (printed) => (printed === undefined || printed.code !== 0 ? { refused: why(printed) ?? '' } : { lines: facts(printed.out) });
-/** Native identities and expected-identity results come from the same public CLI contract. Without it, read fresh. */
-const nativeView = (name, place, view, signal) => {
-    const read = async (expected) => {
-        if (expected === undefined)
-            return readOf(await run(name, place, [words.read, words.view, view], {}, signal));
-        const result = readingOf(await run(name, place, [words.read, words.view, `${words.identity}@${view}@${expected}`], {}, signal), view, expected);
-        return 'refused' in result ? result : { lines: facts(result.text.split('\n')) };
-    };
-    return !words.identity ? read() : folded(`${name}/${view}`, place, async () => { const result = readingOf(await run(name, place, [words.read, words.view, `${words.identity}@${view}`], {}, signal), view); return 'refused' in result ? undefined : result.identity; }, read);
+const readOf = (printed) => (printed === undefined || printed.code !== 0 ? { refused: why(printed) ?? '' } : { lines: factsOf(printed.out) });
+/** Only the requested views are captured by Bound; every result binds its text to the actual current native identity. */
+const nativeViews = async (name, place, views, signal) => {
+    const captured = capturedViews(place, views, signal);
+    if (captured?.kind === 'refuse' && captured.code === 'host/instrument-pin')
+        return views.map(() => ({ refused: captured.diagnostic }));
+    return Promise.all(views.map(async (view) => {
+        const result = captured?.kind === 'fact' ? captured.views.find((one) => one.view === view) : undefined;
+        const read = result ? await folded(`${name}/${view}`, place, async () => result.identity, async () => ({ lines: factsOf(result.text.split('\n')) })) : readOf(await run(name, place, [words.read, words.view, view], {}, signal));
+        return 'refused' in read || view !== words.standing || read.lines.some((line) => line.scope === words.profile) ? read
+            : { refused: `REFUSE·act the place declares no ${words.profile}: land would print nothing of what it admits, so head lands nothing there; its root can land the local-act@1 profile and view/act` };
+    }));
 };
-/** Read normative standing plus authenticated device evidence; ambiguous device history refuses. */
-export const policyAt = async (name, place, signal) => ((folded) => ('refused' in folded || folded.lines.some((line) => line.scope === words.profile) ? folded
-    : { refused: `REFUSE·act the place declares no ${words.profile}: land would print nothing of what it admits, so head lands nothing there; its root can land the local-act@1 profile and view/act` }))(await nativeView(name, place, words.standing, signal));
+export const policyAt = async (name, place, signal) => (await nativeViews(name, place, [words.standing], signal))[0];
 export const standingAt = async (name, place, devicesOf, isHistory, signal) => {
-    const [folded, evidence] = await Promise.all([policyAt(name, place, signal), nativeView(name, place, words.evidence, signal)]);
+    const [folded, evidence] = await nativeViews(name, place, [words.standing, words.evidence], signal);
     if ('refused' in folded)
         return folded;
     if ('refused' in evidence)
@@ -61,25 +64,26 @@ export const standingAt = async (name, place, devicesOf, isHistory, signal) => {
     return unfolded === undefined ? { lines: [...folded.lines, ...own] }
         : { refused: `REFUSE·standing ${unfolded.by} attests ${key(unfolded)} more than once, withdrawn, or beside the place's own line: folding a device key's lines is bound's, and bound publishes no view of it` };
 };
-const lotFile = (lines) => ((at) => { writeFileSync(at, `${lines.join('\n')}\n`); return at; })(join(mkdtempSync(join(tmpdir(), 'head-lot-')), 'lot.bound'));
-export const sign = async (name, place, lot, key, signer, env, signal) => ((got) => (got !== undefined && got.code === 0 ? { lines: got.out.filter((line) => parse(line).kind === 'fact') } : { refused: why(got) ?? '' }))(await run(name, place, [words.sign, lotFile(lot), words.key, key, words.signer, signer], env, signal));
+const lotFile = (lines) => scratchOf('head-lot-', 'lot.bound', `${lines.join('\n')}\n`);
+const through = (place, verb, lot, key, signer, port, signal) => signedIn(place, [verb, ...(key ? [words.key, key, words.signer, signer] : [])], lot, new Map(key && port ? [[key, { name: signer, sign: port }]] : []), key, signal).then(apart);
+export const sign = async (_name, place, lot, key, signer, port, signal) => ((got) => (got !== undefined && got.code === 0 ? { lines: got.out.filter((line) => parse(line).kind === 'fact') } : { refused: why(got) ?? '' }))(await through(place, words.sign, lot, key, signer, port, signal));
 /** A lot signed and landed in one process, its result read from what bound printed of the committed act: the records it admitted, never the receipt beside them; a place that declares no act result is refused by name. */
 /** A place's receipts rendered beside its lock, so bound alone checks the place: nothing when they closed, else why they did not. */
 export const closing = async (name, place, signal) => ((got) => (got !== undefined && got.code === 0 ? undefined : why(got) ?? 'nothing printed'))(await run(name, place, [words.read, words.view, words.receipts], {}, signal));
 /** A place's own lines in the person's words, beside its lock, the text they read and share: each line head lands at the person's at, drafted with no signature, gone with its withdraw. Bound reads the file as it reads the place, so it is written with the land, never while a fold runs. Set from head's lock. */
 export const birth = { at: '', file: '' }, birthed = (place, lot) => {
-    const [file, mine] = [join(place, birth.file), facts(lot).filter((l) => birth.file && l['at']?.startsWith(birth.at))], bare = (l) => JSON.stringify(Object.entries(l).filter(([k]) => !['about', 'value', 'sig', 'epoch', 'by'].includes(k)).sort());
+    const [file, mine] = [join(place, birth.file), factsOf(lot).filter((l) => birth.file && l['at']?.startsWith(birth.at))], bare = (l) => JSON.stringify(Object.entries(l).filter(([k]) => !['about', 'value', 'sig', 'epoch', 'by'].includes(k)).sort());
     if (mine.length)
-        writeFileSync(file, [...(existsSync(file) ? facts(readFileSync(file, 'utf8').split('\n')) : []).filter((k) => !mine.some((m) => bare(m) === bare(k))), ...mine.filter((m) => m['value'] !== 'withdraw')].map(({ sig: _sig, epoch: _epoch, ...l }) => `${canonical({ ...l, by: 'target' })}\n`).join(''));
+        writeFileSync(file, [...(existsSync(file) ? factsOf(readFileSync(file, 'utf8').split('\n')) : []).filter((k) => !mine.some((m) => bare(m) === bare(k))), ...mine.filter((m) => m['value'] !== 'withdraw')].map(({ sig: _sig, epoch: _epoch, ...l }) => `${canonical({ ...l, by: 'target' })}\n`).join(''));
 };
-export const landAct = async (name, place, lot, key, signer, env, signal) => ((got) => {
+export const landAct = async (_name, place, lot, key, signer, port, signal) => ((got) => {
     if (got === undefined || got.code !== 0)
         return { refused: why(got) ?? '' };
     const at = got.out.findIndex((line) => line.startsWith(words.act));
     return at < 0 ? { refused: `REFUSE·act bound printed no act result, and the place declares ${words.profile}: what was admitted is bound's to say` }
         : (birthed(place, lot), { lines: got.out.slice(at + 1).filter((line) => parse(line).kind === 'fact').slice(0, -1) });
-})(await run(name, place, [words.land, lotFile(lot), words.key, key, words.signer, signer], env, signal));
-export const land = async (name, place, signed, signal) => ((got) => (got !== undefined && got.code === 0 ? (birthed(place, signed), { lines: signed }) : { refused: why(got) ?? '' }))(await run(name, place, [words.land, lotFile(signed)], {}, signal));
+})(await through(place, words.land, lot, key, signer, port, signal));
+export const land = async (_name, place, signed, signal) => ((got) => (got !== undefined && got.code === 0 ? (birthed(place, signed), { lines: signed }) : { refused: why(got) ?? '' }))(await through(place, words.land, signed, undefined, undefined, undefined, signal));
 export const told = async (name, place, signed, view, signal) => ((got) => [...(got?.out ?? []), ...(got?.err ?? [])])(await run(name, place, [words.read, words.view, view, lotFile(signed)], {}, signal));
 export const pinnedAt = async (name, place, file, signal) => {
     const printed = await run(name, place, [words.read, file], {}, signal);
@@ -90,6 +94,6 @@ export const pinnedAt = async (name, place, file, signal) => {
     const bytes = printed.out.filter((line) => line.startsWith(words.topos)).map((line) => `${line.slice(words.topos.length)}\n`).join('');
     return pin === undefined || !bytes ? undefined : { pin, bytes, lines: read.lines };
 };
-export const founded = async (name, place, key, signer, env, signal) => ((got) => (got !== undefined && got.code === 0 ? (birthed(place, readFileSync(join(place, LOCK), 'utf8').split('\n')), { lines: got.out }) : { refused: why(got) ?? '' }))(await run(name, place, [words.land, words.key, key, words.signer, signer], env, signal));
+export const founded = async (_name, place, key, signer, port, signal) => ((got) => (got !== undefined && got.code === 0 ? (birthed(place, readFileSync(join(place, LOCK), 'utf8').split('\n')), { lines: got.out }) : { refused: why(got) ?? '' }))(await through(place, words.land, undefined, key, signer, port, signal));
 export const words = { read: '', view: '', sign: '', land: '', key: '', signer: '', pin: '', topos: '', standing: '', evidence: '', act: '', profile: '', receipts: '', refusal: '', identity: '' };
 export const settledView = async (name, place, view, signal) => readOf(await run(name, place, [words.read, words.view, view], {}, signal));

package/dist/src/ports/host.d.ts

@@ -0,0 +1,53 @@
+import type { NativeHostOptions } from '@lapxo/bound/host';
+import type { Printed } from './process.ts';
+import { type Said } from '../core/lock.ts';
+/** What a place's fold host is held to, from head's lock: the installed instrument it must be, how long it stays idle and lives, and its limits. */
+export declare const hosting: {
+    installed: string;
+    idle: number;
+    life: number;
+    wait: number;
+    bytes: number;
+    heap: number;
+    queued: number;
+    authority: {
+        clock: string;
+        unit: string;
+        items: number;
+    };
+    http: NativeHostOptions["http"];
+};
+/** Receiver permissions and work budgets are declared by head's own lock, never inferred from a redirect. */
+export declare const configureHost: (lock: readonly Said[], bounds: {
+    readonly wait: number;
+    readonly most: number;
+}) => void;
+/** Every host closed, its scratch removed with it: whenever a caller asks, and when head ends, its scratch then removed at once, whatever its host is still doing. */
+export declare const cooled: () => void;
+/** The process a place's fold host runs as, while one is held for it. */
+export declare const hostOf: (place: string) => number | undefined;
+/** Native read-only snapshots use Bound's actual caller environment; their identities are not borrowed from a different CLI context. */
+export declare const capturedViews: (place: string, views: readonly string[], signal?: AbortSignal, from?: string) => import("@lapxo/bound/host").NativeViewIdentitiesResult | undefined;
+/**
+ * A read of a place's view through the place's own fold host, which only folds and never holds a signer: started on the first
+ * read, kept while it is asked within its idle and its life, the installed bound checked file by file before every call.
+ * A refusal, an error or a changed instrument closes it, and the next read starts another.
+ */
+export declare const hosted: (place: string, args: readonly string[], signal?: AbortSignal, from?: string) => Promise<Printed>;
+/**
+ * A sign or a land in a host of its own, started for this one call with the signers the lock names and closed once it
+ * answers: the signer never outlives the call it signed for. The place's fold host is closed first, a place having one
+ * host at a time; the lot goes in as the host's input, never a file of head's.
+ */
+export declare const signedIn: (place: string, args: readonly string[], lot: readonly string[] | undefined, signers: NonNullable<NativeHostOptions["signers"]>, keyId?: string, signal?: AbortSignal, from?: string) => Promise<Printed>;
+export type AuthorityObservation = {
+    readonly refused: string;
+    readonly code: string;
+} | {
+    readonly authority: string;
+    readonly request: string;
+    readonly decision: 'allow' | 'ask' | 'deny' | 'open';
+    readonly needs: readonly string[];
+};
+/** Configuration-only observations at an explicit receiver clock; no signing, admission or API execution occurs here. */
+export declare const authorityAt: (place: string, key: string, kind: string, records: readonly string[], now: number, signal?: AbortSignal, presented?: string) => Promise<AuthorityObservation>;

package/dist/src/ports/host.js

@@ -0,0 +1,157 @@
+import { createHash } from 'node:crypto';
+import { mkdtempSync, readdirSync, readFileSync, realpathSync, rmSync } from 'node:fs';
+import { createRequire } from 'node:module';
+import { tmpdir } from 'node:os';
+import { dirname, join, relative, sep } from 'node:path';
+import { installedHostInstrument, nativeHostEnvironment, prepareNativeViewIdentities, prepareNativeAuthorityCard, answerNativeAuthorityCard, nativeAuthorityRequestIdentity, startNativeHost } from '@lapxo/bound/host';
+import { decodeAuthorityCard } from '@lapxo/topos/contract';
+import { members, valueOf } from "../core/lock.js";
+/** What a place's fold host is held to, from head's lock: the installed instrument it must be, how long it stays idle and lives, and its limits. */
+export const hosting = { installed: '', idle: 0, life: 0, wait: 0, bytes: 0, heap: 0, queued: 0, authority: { clock: '', unit: '', items: 0 }, http: undefined };
+/** Receiver permissions and work budgets are declared by head's own lock, never inferred from a redirect. */
+export const configureHost = (lock, bounds) => { Object.assign(hosting, { installed: valueOf(lock, 'dep/bound/installed'), wait: bounds.wait, bytes: bounds.most, ...Object.fromEntries(['idle', 'life', 'heap', 'queued'].map((k) => [k, Number(valueOf(lock, `bound/host/${k}`).split('..')[1])])), authority: { clock: valueOf(lock, 'bound/authority/clock'), unit: valueOf(lock, 'bound/authority/unit'), items: Number(valueOf(lock, 'bound/authority/items').split('..')[1]) }, http: { origins: members(valueOf(lock, 'bound/receiver/origins')), redirects: { maxRedirects: Number(valueOf(lock, 'bound/receiver/redirects').split('..')[1]), headerBytes: Number(valueOf(lock, 'bound/receiver/header-bytes').split('..')[1]) } } }); };
+const root = dirname(createRequire(import.meta.url).resolve('@lapxo/bound/package.json'));
+const walk = (at) => readdirSync(at, { withFileTypes: true }).flatMap((e) => e.isDirectory() ? walk(join(at, e.name)) : [join(at, e.name)]);
+/** Every file of the installed bound by its coordinate and digest: what its identity is computed from, and what is checked again before each call. */
+const inventory = (at) => walk(at).map((f) => ({ coordinate: relative(at, f).split(sep).join('/'), digest: `sha256:${createHash('sha256').update(readFileSync(f)).digest('hex')}` })).sort((a, b) => (a.coordinate < b.coordinate ? -1 : 1));
+/** Held, starting and closing hosts, their owned scratch, and one instrument descriptor reused only after its complete current byte inventory matches. */
+const [live, starting, closing, scratches, selected] = [new Map(), new Map(), new Map(), new Set(), { root: '', members: '', instrument: undefined }];
+const cleared = (dir) => { rmSync(dir, { recursive: true, force: true }); scratches.delete(dir); };
+const shut = (at) => { const one = live.get(at); live.delete(at); if (one) {
+    clearTimeout(one.idle);
+    closing.set(at, one.host.close().catch(() => undefined).finally(() => { cleared(one.scratch); closing.delete(at); }));
+} };
+/** Every host closed, its scratch removed with it: whenever a caller asks, and when head ends, its scratch then removed at once, whatever its host is still doing. */
+export const cooled = () => { for (const at of [...live.keys()])
+    shut(at); };
+/** The process a place's fold host runs as, while one is held for it. */
+export const hostOf = (place) => live.get(realpathSync(place))?.host.pid;
+process.once('exit', () => { cooled(); for (const dir of [...scratches])
+    cleared(dir); });
+/** One verified installed descriptor, reused only after hashing every current installed member. */
+const instrumentAt = (from) => {
+    const members = inventory(from), current = JSON.stringify(members);
+    const instrument = selected.root === from && selected.members === current ? selected.instrument : Object.assign(selected, { root: from, members: current, instrument: installedHostInstrument({ directory: from, shape: 'package', members, exports: [['exports', './engine', 'default']], pins: [], limits: { members: 4096, bytes: 1 << 27, responseBytes: 1 << 22 } }, join(from, 'dist/cli/verb.js')) }).instrument;
+    return { members: current, instrument };
+};
+const pinnedInstrument = (from) => { const { instrument } = instrumentAt(from); if (instrument.installed?.digest !== hosting.installed)
+    throw Error('REFUSE·host/instrument-pin'); return instrument; };
+/** Native read-only snapshots use Bound's actual caller environment; their identities are not borrowed from a different CLI context. */
+export const capturedViews = (place, views, signal, from = root) => {
+    try {
+        if (signal?.aborted)
+            return undefined;
+        const instrument = pinnedInstrument(from);
+        return prepareNativeViewIdentities({ place, views, instrument });
+    }
+    catch (error) {
+        cooled();
+        return { kind: 'refuse', code: 'host/instrument-pin', diagnostic: error.message };
+    }
+};
+/** A host started on a place, on the installed instrument the lock pins and in a scratch folder of head's own; with signers only for one call's sign or land. */
+const opened = async (at, from, signers) => {
+    const { members, instrument } = instrumentAt(from);
+    const scratch = mkdtempSync(join(tmpdir(), 'head-host-'));
+    scratches.add(scratch);
+    const host = await startNativeHost({ place: at, instrument, expectedInstrument: hosting.installed, environment: nativeHostEnvironment({ ...process.env }), scratchParent: scratch, ...(hosting.http ? { http: hosting.http } : {}), ...(signers ? { signers } : {}), limits: { requestBytes: hosting.bytes, responseBytes: hosting.bytes, timeoutMs: hosting.wait, heapMiB: hosting.heap, queuedRequests: hosting.queued } }).catch((e) => { cleared(scratch); throw e; });
+    return { host, members, born: Date.now(), scratch, busy: 0 };
+};
+const started = async (at, from) => ((one) => (live.set(at, one), one))(await opened(at, from));
+const lines = (text) => text.split('\n').filter(Boolean), refused = (why) => ({ code: -1, out: [], err: [why] });
+/**
+ * A read of a place's view through the place's own fold host, which only folds and never holds a signer: started on the first
+ * read, kept while it is asked within its idle and its life, the installed bound checked file by file before every call.
+ * A refusal, an error or a changed instrument closes it, and the next read starts another.
+ */
+export const hosted = async (place, args, signal, from = root) => {
+    if (args[0] !== 'fold')
+        return refused(`REFUSE·host a place's fold host only folds, and never holds a signer: ${args[0]} goes to a process of its own`);
+    const at = realpathSync(place), was = live.get(at);
+    if (was !== undefined && Date.now() - was.born > hosting.life * 1000)
+        shut(at);
+    let one;
+    try {
+        await closing.get(at);
+        one = live.get(at) ?? await (starting.get(at) ?? ((p) => (starting.set(at, p), p))(started(at, from).finally(() => starting.delete(at))));
+    }
+    catch (e) {
+        return refused(e.message);
+    }
+    if (JSON.stringify(inventory(from)) !== one.members) {
+        shut(at);
+        return refused(`REFUSE·host the installed bound changed after its host started, so it is no longer ${hosting.installed}: the host is closed, and nothing was read`);
+    }
+    clearTimeout(one.idle);
+    one.busy += 1;
+    try {
+        const got = await one.host.request({ verb: 'fold', args: args.slice(1) }, signal);
+        if (got.status !== 0)
+            shut(at);
+        return { code: got.status, out: lines(got.stdout), err: lines(got.stderr) };
+    }
+    catch (e) {
+        shut(at);
+        return refused(e.message);
+    }
+    finally {
+        one.busy -= 1;
+        if (one.busy === 0 && live.get(at) === one)
+            one.idle = setTimeout(() => shut(at), hosting.idle * 1000).unref();
+    }
+};
+/**
+ * A sign or a land in a host of its own, started for this one call with the signers the lock names and closed once it
+ * answers: the signer never outlives the call it signed for. The place's fold host is closed first, a place having one
+ * host at a time; the lot goes in as the host's input, never a file of head's.
+ */
+export const signedIn = async (place, args, lot, signers, keyId, signal, from = root) => {
+    const at = realpathSync(place);
+    shut(at);
+    await closing.get(at);
+    let one;
+    try {
+        one = await opened(at, from, signers);
+    }
+    catch (e) {
+        return refused(e.message);
+    }
+    try {
+        const got = await one.host.request({ verb: args[0], args: [...(lot ? ['@input/lot.bound'] : []), ...args.slice(1)], ...(lot ? { inputs: [{ name: 'lot.bound', text: `${lot.join('\n')}\n` }] } : {}), ...(keyId ? { signer: keyId } : {}) }, signal);
+        return { code: got.status, out: lines(got.stdout), err: lines(got.stderr) };
+    }
+    catch (e) {
+        return refused(e.message);
+    }
+    finally {
+        await one.host.close().catch(() => undefined);
+        cleared(one.scratch);
+    }
+};
+/** Configuration-only observations at an explicit receiver clock; no signing, admission or API execution occurs here. */
+export const authorityAt = async (place, key, kind, records, now, signal, presented) => {
+    const current = () => { if (signal?.aborted)
+        throw Error('REFUSE·authority-preflight/cancelled'); };
+    try {
+        current();
+        const instrument = pinnedInstrument(root);
+        const action = { kind, records }, clock = { name: hosting.authority.clock, unit: hosting.authority.unit, now };
+        const context = { root: realpathSync(place), place: '.', key, instrument, clock, horizon: { clock: clock.name, unit: clock.unit, from: now, through: now }, limits: { bytes: hosting.bytes, items: hosting.authority.items }, actions: ['record-coverage', 'admission'].includes(kind) ? [action] : [] };
+        if (!clock.name || !clock.unit || !Number.isSafeInteger(now) || hosting.authority.items < 1)
+            throw Error('REFUSE·authority-preflight/context');
+        const prepared = await prepareNativeAuthorityCard(context);
+        if (prepared.kind !== 'fact')
+            return { refused: prepared.diagnostic, code: prepared.code };
+        const request = nativeAuthorityRequestIdentity(action), card = presented ? decodeAuthorityCard(presented, context.limits) : prepared.value.card;
+        const answer = await answerNativeAuthorityCard(card, request, context);
+        current();
+        if ('kind' in answer)
+            return { refused: answer.diagnostic, code: answer.code };
+        if (answer.status === 'refused')
+            return { refused: `REFUSE·${answer.code}`, code: answer.code };
+        return { authority: prepared.value.line, request, decision: answer.status === 'observed' ? answer.decision : 'open', needs: answer.status === 'open' ? answer.needs : prepared.value.needs };
+    }
+    catch (error) {
+        return { refused: error instanceof Error ? error.message : String(error), code: 'authority-preflight/context' };
+    }
+};

package/dist/src/ports/keychain.d.ts

@@ -2,7 +2,19 @@ export interface KeyStore {
     readonly read: (account: string) => string | undefined;
     readonly write: (account: string, secret: string) => void;
     readonly made?: (account: string) => string | undefined;
+    readonly held?: (account: string) => string | undefined;
 }
 export declare const plain: (word: string) => string;
-/** The secret store this host keeps head's keys in, by the name its lock gives the platform's: one adapter each, every secret crossing a command's stdin and stdout only; a key it is asked for by its account is made there once, and only its public half handed on. */
-export declare const keychain: (service: string, kind: string) => KeyStore;
+/** The secret store this host keeps head's keys in, by the name its lock gives the platform's: one adapter each, every secret crossing a command's stdin and stdout only. Only head's signer opens it for a signing key. */
+export declare const secretsOf: (service: string, kind: string) => KeyStore;
+/** The store head's long process is handed: a signing account is refused by name before any command starts, and its key is made, or its public half read, in head's signer, never here; the secrets of access stay this process's, since it calls their APIs. */
+export declare const keychain: (service: string, kind: string, signing: (account: string) => string | undefined) => KeyStore;
+/** The signing port a host calls for one lot: head's signer started with the key's names alone and the lot on its stdin, within the wait the lock gives bound; what it prints are the signatures, read as the signing-lot contract reads them. */
+export declare const portOf: (service: string, account: string, kind: string, wait: number) => (lot: {
+    readonly bytes: readonly string[];
+    readonly keyId: string;
+    readonly algorithm: string;
+}, signal: AbortSignal) => Promise<readonly {
+    readonly keyId: string;
+    readonly signature: string;
+}[]>;

package/dist/src/ports/keychain.js

@@ -1,12 +1,24 @@
+import { execFileSync } from 'node:child_process';
+import { fileURLToPath } from 'node:url';
+import { signerResponseOf } from '@lapxo/topos/wire';
+import { spawned } from "./process.js";
 import { store as credentialManager } from "./stores/credential-manager.js";
 import { store as keychainOfMac } from "./stores/keychain.js";
 import { store as secretTool } from "./stores/secret-tool.js";
-import { newKey, publicOf } from "./keys.js";
 export const plain = (word) => { if (!/^[\w.@/+=-]+$/.test(word))
     throw Error('REFUSE·keychain a name holds more than word characters'); return word; };
-/** The secret store this host keeps head's keys in, by the name its lock gives the platform's: one adapter each, every secret crossing a command's stdin and stdout only; a key it is asked for by its account is made there once, and only its public half handed on. */
-export const keychain = (service, kind) => ((made) => {
-    if (made === undefined)
-        throw Error(`REFUSE·keychain ${kind} is no store head carries`);
-    return ((store) => ({ ...store, made: (account) => ((secret) => secret && publicOf(secret))(store.read(account) ?? ((key) => { store.write(account, key.secret); return store.read(account) === key.secret ? key.secret : undefined; })(newKey())) }))(made(service));
-})({ keychain: keychainOfMac, 'secret-tool': secretTool, 'credential-manager': credentialManager }[kind]);
+/** The secret store this host keeps head's keys in, by the name its lock gives the platform's: one adapter each, every secret crossing a command's stdin and stdout only. Only head's signer opens it for a signing key. */
+export const secretsOf = (service, kind) => ((made) => { if (made === undefined)
+    throw Error(`REFUSE·keychain ${kind} is no store head carries`); return made(service); })({ keychain: keychainOfMac, 'secret-tool': secretTool, 'credential-manager': credentialManager }[kind]);
+const signer = fileURLToPath(new URL(`../signer${import.meta.url.slice(import.meta.url.lastIndexOf('.'))}`, import.meta.url)), half = (mode, service, account, kind) => { try {
+    return execFileSync(process.execPath, [signer, mode, service, plain(account), kind], { encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'] }) || undefined;
+}
+catch {
+    return undefined;
+} };
+/** The store head's long process is handed: a signing account is refused by name before any command starts, and its key is made, or its public half read, in head's signer, never here; the secrets of access stay this process's, since it calls their APIs. */
+export const keychain = (service, kind, signing) => ((keys, guard) => ({ read: (account) => keys.read(guard(account)), write: (account, secret) => keys.write(guard(account), secret), made: (account) => half('make', service, account, kind), held: (account) => half('exists', service, account, kind) }))(secretsOf(service, kind), (account) => ((key) => { if (key !== undefined)
+    throw Error(`REFUSE·keychain ${key} names a signing key: only head's signer reads it`); return account; })(signing(account)));
+/** The signing port a host calls for one lot: head's signer started with the key's names alone and the lot on its stdin, within the wait the lock gives bound; what it prints are the signatures, read as the signing-lot contract reads them. */
+export const portOf = (service, account, kind, wait) => async (lot, signal) => ((got) => { if (got.code !== 0)
+    throw Error(`REFUSE·signer head's signer did not sign for ${lot.keyId}`); return signerResponseOf(`${got.out.join('\n')}\n`, lot); })(await spawned(process.execPath, [signer, service, plain(account), lot.keyId, lot.algorithm, kind], { input: `${lot.bytes.join('\n')}\n` }, { wait, most: 1 << 20, signal }));

package/dist/src/ports/scratch.d.ts

@@ -0,0 +1,4 @@
+/** A file one bound run reads, in a folder of its own under this device's temporary folder, kept only until that run ends. */
+export declare const scratchOf: (prefix: string, name: string, text: string) => string;
+/** The folders made for what a run read, removed once it ended, however it ended; any other path is left as it is. */
+export declare const cleared: (paths: readonly string[]) => void;