@lapxo/head 0.1.7 → 0.2.1

package/dist/src/adopt/adopt.d.ts

@@ -2,11 +2,11 @@ import type { Context, Outcome } from '../core/answer.ts';
 import type { Said } from '../core/lock.ts';
 import type { Line } from '../compile/pin.ts';
 /**
- * Every world head adopts, once per place: its standing and blob pinned where they are published, for bound to
+ * Only the requested worlds, or the default for an unspecified protocol, adopted once per place: its standing and blob pinned where they are published, for bound to
  * fetch and verify, and each of its readers told where head lays what it reads — read off the standing head reads from
  * the same address once per device, kept by its digest and answered only when it hashes to the pin. A world whose
  * standing cannot be read so is no adoption.
  */
-export declare const adopted: (context: Context, place: string, lands: (lot: readonly string[]) => Promise<Outcome>, line: Line) => Promise<Outcome>;
+export declare const adopted: (context: Context, place: string, lands: (lot: readonly string[]) => Promise<Outcome>, line: Line, additional?: readonly string[]) => Promise<Outcome>;
 /** The name of a lock the place pins as its parent, when it pins one: composing a parent's policy with a child's is bound's, so head reads nothing of such a place and signs nothing for it. */
 export declare const adoptsIn: (lock: readonly Said[], lines: readonly Said[]) => string | undefined;

package/dist/src/adopt/adopt.js

@@ -9,27 +9,41 @@ import { linesOf } from "../core/worlds.js";
 const readersOf = (lock, standing) => {
     const region = valueOf(lock, 'vocab/region');
     const reads = (view) => members(standing.find((l) => l.scope === `${region}/${valueOf(lock, view)}` && l.measure === 'reads')?.value ?? '');
-    const [connected, answered] = [reads('place/view'), reads('place/answer')];
+    const answer = valueOf(standing, 'capsule/answer-region');
+    const [connected, answered] = [reads('place/view'), [...reads('place/answer'), ...members(standing.find(l => l.scope === `${region}/${answer}` && l.measure === 'reads')?.value ?? '')]];
     return standing.filter((l) => l.scope?.startsWith(`${region}/`) && l.measure === 'writes' && l.role === 'writes').flatMap((l) => ((coordinates) => (coordinates
-        ? [{ scope: l.scope, measure: 'coordinates', value: coordinates }, { scope: l.scope, measure: 'receipts', value: l.value }] : []))(connected.includes(l.scope) ? valueOf(lock, 'place/connected/coordinates') : answered.includes(l.scope) ? valueOf(lock, 'place/answers/coordinates') : ''));
+        ? [{ scope: l.scope, measure: 'coordinates', value: coordinates }, { scope: l.scope, measure: 'receipts', value: l.value }] : []))(connected.includes(l.scope) || standing.some(input => input.scope === l.scope && input.measure === 'reads' && input.role === 'receipt') && members(l.value ?? '').some(output => connected.includes(output)) ? valueOf(lock, 'place/connected/coordinates') : answered.includes(l.scope) || standing.some(input => input.scope === l.scope && input.measure === 'reads' && input.role === 'receipt') && members(l.value ?? '').some(output => answered.includes(output)) ? valueOf(lock, 'place/answers/coordinates') : ''));
 };
 /**
- * Every world head adopts, once per place: its standing and blob pinned where they are published, for bound to
+ * Only the requested worlds, or the default for an unspecified protocol, adopted once per place: its standing and blob pinned where they are published, for bound to
  * fetch and verify, and each of its readers told where head lays what it reads — read off the standing head reads from
  * the same address once per device, kept by its digest and answered only when it hashes to the pin. A world whose
  * standing cannot be read so is no adoption.
  */
-export const adopted = async (context, place, lands, line) => {
+export const adopted = async (context, place, lands, line, additional = []) => {
     const [word, held] = [(k) => valueOf(context.lock, k), await context.policy(place)];
     if ('refused' in held)
         return held;
     const own = held.lines, [wait, most] = ['adapter/request/wait', 'world/standing-bytes'].map((k) => Number(word(k).split('..')[1]));
-    const lot = [];
-    for (const w of members(word('world/adopts')).filter((w) => !own.some((l) => l.scope === `uses/${w}`))) {
+    const lot = [], worlds = [...new Set(additional.length ? additional : members(word('world/adopts')))];
+    for (const w of worlds) {
+        const existing = own.filter(l => l.scope === `uses/${w}`);
+        if (existing.length > 1 || existing.some(l => l.value !== word(`world/${w}/standing`)))
+            return { refused: `REFUSE·world/pin-mismatch ${w}` };
+    }
+    for (const w of worlds.filter((w) => !own.some((l) => l.scope === `uses/${w}`))) {
         const [standing, blob, at, blobAt] = [word(`world/${w}/standing`), word(`world/${w}/blob`), word(`sources/${w}`), word(`sources/${w}-blob`)];
         const bytes = context.cache.held(standing) ?? ((got) => (got === undefined ? undefined : (context.cache.keep(got), got)))(await (await context.adapter(at))?.published(at, standing, most, wait));
         if (bytes === undefined)
             return { refused: `REFUSE·world ${w}: ${at} answered no bytes that hash to its pin ${standing}` };
+        const provider = linesOf(bytes), answers = provider.filter(l => l.scope === 'capsule/answer-region').map(l => l.value);
+        if (answers.length > 1 || answers.some(name => !/^[a-z][a-z0-9-]*$/.test(name)))
+            return { refused: 'REFUSE·world/answer-view' };
+        const answer = answers[0], selected = answer && word('birth/view/answer').replace(/^[^@]+/, answer);
+        if (answer && own.some(l => l.scope === `view/${answer}` && (l.value !== selected || l.role !== 'demands')))
+            return { refused: 'REFUSE·world/answer-view' };
+        if (answer && !own.some(l => l.scope === `view/${answer}`))
+            lot.push(line(`view/${answer}`, 'id', selected, { role: 'demands' }));
         const laid = `${word('place/worlds')}/${w}${EXTENSION}`;
         context.files.lay(place, laid, bytes);
         lot.push(line(`uses/${w}`, 'digest', standing, { needs: laid }), line(`sources/${w}`, 'id', at), line(`dep/${w}-blob`, 'digest', blob, { shape: word('world/shape') }), line(`sources/${w}-blob`, 'id', blobAt), ...readersOf(context.lock, linesOf(bytes)).map((r) => line(r.scope, r.measure, r.value, { role: 'reads' })));

package/dist/src/ahead/read.d.ts

@@ -4,7 +4,7 @@ import type { Cell } from '../ports/surface.ts';
  * What an answer leaves to do before the next call, done after it is answered; another call coming gives up what is not
  * begun, never what is, so no land is cut halfway:
  * the reads a known next asks for, read in a context that asks the person nothing — a read only, never an act, nothing it
- * would need a yes or a secret for — and then every place the answer names folded again where it moved, so the next
- * question finds it folded. A fold calls no source, so it spends nothing of a place's rate.
+ * would need a yes or a secret for. Each question obtains a fresh native snapshot; speculative recapture cannot validate it.
+ * Reading ahead spends only the source-call budget the place declares.
  */
 export declare const readAhead: (cells: readonly Cell[], context: Context, signal: AbortSignal) => Promise<void>;

package/dist/src/ahead/read.js

@@ -4,8 +4,8 @@ const none = async () => 'none', nothing = async () => undefined;
  * What an answer leaves to do before the next call, done after it is answered; another call coming gives up what is not
  * begun, never what is, so no land is cut halfway:
  * the reads a known next asks for, read in a context that asks the person nothing — a read only, never an act, nothing it
- * would need a yes or a secret for — and then every place the answer names folded again where it moved, so the next
- * question finds it folded. A fold calls no source, so it spends nothing of a place's rate.
+ * would need a yes or a secret for. Each question obtains a fresh native snapshot; speculative recapture cannot validate it.
+ * Reading ahead spends only the source-call budget the place declares.
  */
 export const readAhead = async (cells, context, signal) => {
     const quiet = { ...context, elicit: none, person: { consent: none, enter: nothing, choose: nothing, visit: nothing } };
@@ -13,6 +13,4 @@ export const readAhead = async (cells, context, signal) => {
         if (!signal.aborted && 'tool' in next && next.tool === 'ask' && next.args['source'] && next.args['operation'] && !next.args['why'] && !next.args['history'])
             await readSource({ ...next.args, ahead: 'true' }, quiet);
     await quiet.settle();
-    for (const place of new Set(cells.flatMap((c) => [c.fields['place'] ?? '', 'tool' in c.next ? c.next.args['place'] ?? '' : '']).filter((p) => p && !signal.aborted)))
-        await Promise.all([context.standing(place), context.policy(place)]).catch(() => undefined);
 };

package/dist/src/answers/answered.js

@@ -6,7 +6,7 @@ const nothing = (bytes) => ((text) => text === '' || /^\[\s*\]$/.test(text))(new
 /** Distinguish an empty response from missing transport bytes; only the latter leaves a named need. */
 export const answering = (context, place, asked, frame) => {
     const need = `${valueOf(context.lock, 'place/needs')}/bytes/${frame.source}/${frame.operation}`, held = frame.lines.find((l) => l.scope === need && l.role === 'demands' && l.value !== 'withdraw');
-    const owe = (line) => ((root) => ('said' in root ? undefined : context.landRoot(place, [line], root.account)))(rootIn(context, place));
+    const owe = async (line) => ((root) => ('said' in root ? undefined : context.landRoot(place, [line], root.account)))(await rootIn(context, place));
     const withdrawn = ({ about: _about, sig: _sig, epoch: _epoch, ...l }) => canonical({ ...l, by: 'target', value: 'withdraw' });
     return { ...frame,
         typed: (status, bytes) => (nothing(bytes) ? Promise.resolve(frame.say('answered-nothing', { source: frame.source, operation: frame.operation, status, at: new Date(context.now()).toISOString() })) : frame.typed(status, bytes)),

package/dist/src/compile/pin.d.ts

@@ -21,7 +21,7 @@ export declare const pinnedAs: (context: Context, place: string, file: string, l
  * — so the same input finds its compiled standing by name, and pinned from the place's store: a new pin lands with the old
  * one's withdraw, said at its own time, since a withdrawn saying stays withdrawn.
  */
-export declare const pinIn: (context: Context, place: string, lands: (lot: readonly string[]) => Promise<Outcome>, line: Line) => (source: string, read: readonly string[]) => Promise<Pinned>;
+export declare const pinIn: (context: Context, place: string, lands: (lot: readonly string[]) => Promise<Outcome>, line: Line, validate?: (lines: readonly Said[]) => void) => (source: string, read: readonly string[]) => Promise<Pinned>;
 /**
  * The demands a document laid in a place pays: every other pin whose compile named a reference to it unresolved, as it
  * was not there yet, recompiled now that it is — the input its old pin read and the place's pins as they now stand — and

package/dist/src/compile/pin.js

@@ -4,14 +4,14 @@ import { members, under, valueOf } from "../core/lock.js";
 import { fieldsOf, vocabOf } from "../core/read.js";
 import { sayIn } from "../core/surface.js";
 import { digestIn, linesOf, pinnedOf } from "../core/worlds.js";
-/** Pin the compiled source and adopt only the declared outputs. */
+/** Pin source declarations and read/write bounds; host output-presence facts are not source policy. */
 const compiledOf = async (context, place, source, file) => {
     const say = sayIn(context.lock), v = vocabOf(context.lock);
     const compiled = await context.world(place, valueOf(context.lock, 'place/view'));
     if ('refused' in compiled)
         return { said: [say('unsettled', { source, why: compiled.refused })] };
     const issued = (fieldsOf(compiled.lines, `${v.region}/${source}`)[v.issuers] ?? []).map((issuer) => `${v.keys}/${issuer}`);
-    const mine = compiled.lines.filter((l) => l.scope === `${v.region}/${source}` || l.scope?.startsWith(`${v.keys}/${source}/`) || l.scope?.startsWith(`${v.offers}/${source}/`) || /^(read|write)\//.test(l.scope ?? '')
+    const mine = compiled.lines.filter((l) => l.scope === `${v.region}/${source}` || l.scope?.startsWith(`${v.keys}/${source}/`) || l.scope?.startsWith(`${v.offers}/${source}/`) || (l.form === 'interval' && /^(read|write)\//.test(l.scope ?? ''))
         || issued.some((at) => l.scope === at || l.scope?.startsWith(`${at}/`)));
     if (!mine.some((l) => !/^(read|write)\//.test(l.scope ?? '')))
         return { said: [], open: true };
@@ -36,7 +36,7 @@ export const pinnedAs = async (context, place, file, lines) => {
  * — so the same input finds its compiled standing by name, and pinned from the place's store: a new pin lands with the old
  * one's withdraw, said at its own time, since a withdrawn saying stays withdrawn.
  */
-export const pinIn = (context, place, lands, line) => async (source, read) => {
+export const pinIn = (context, place, lands, line, validate) => async (source, read) => {
     const [say, digest, held] = [sayIn(context.lock), digestIn(context.lock), await context.policy(place)];
     if ('refused' in held)
         return { said: [say('unsettled', { source, why: held.refused })] };
@@ -45,6 +45,8 @@ export const pinIn = (context, place, lands, line) => async (source, read) => {
     const file = `${members(valueOf(context.lock, 'place/compiled'))[0]}/${source}/${input.split(':')[1].slice(0, 16)}${EXTENSION}`;
     const old = own.find((l) => l.scope === `uses/${source}`);
     const pinned = ((kept) => (kept !== undefined && kept.pin === old?.value ? kept : undefined))(pinnedOf(context.lock, old?.needs === file ? context.files.take(join(place, file)) : undefined)) ?? await compiledOf(context, place, source, file);
+    if (!('said' in pinned))
+        validate?.(pinned.lines);
     if ('said' in pinned || (old?.needs === file && old.value === pinned.pin))
         return pinned;
     const withdraw = old === undefined ? [] : [canonical({ ...Object.fromEntries(Object.entries(old).filter(([k]) => !['sig', 'epoch'].includes(k))), by: 'target', value: 'withdraw' })];

package/dist/src/core/answer.d.ts

@@ -1,4 +1,5 @@
 import { type Said } from './lock.ts';
+import type { authorityAt } from '../ports/host.ts';
 import type { Printed } from '../ports/bound.ts';
 export type Outcome = {
     readonly lines: readonly string[];
@@ -12,6 +13,16 @@ import type { Call } from './read.ts';
 import type { AccessAdapter, Answered, Attachment, Choice, Field, Held } from '../access/contract.ts';
 export type Asked = Readonly<Record<string, string | undefined>>;
 export interface Context {
+    readonly remote?: () => Promise<import('../ports/adapters/remote.ts').RemotePort>;
+    readonly packaged?: () => Promise<{
+        readonly root: string;
+        readonly read: (path: string) => Uint8Array | undefined;
+    }>;
+    readonly bundle?: (payload: import('../ports/adapters/bundle.ts').Payload | undefined) => Promise<{
+        readonly bytes: Uint8Array;
+        readonly digest: string;
+        readonly sources: readonly string[];
+    }>;
     readonly lock: readonly Said[];
     readonly bound: (cwd: string, args: readonly string[]) => Promise<Printed | undefined>;
     readonly roots: () => Promise<readonly string[]>;
@@ -23,6 +34,7 @@ export interface Context {
     } | {
         readonly refused: string;
     }>;
+    readonly authority: (place: string, key: string, kind: string, records: readonly string[], presented?: string) => ReturnType<typeof authorityAt>;
     readonly policy: (place: string) => Promise<{
         readonly lines: readonly Said[];
     } | {

package/dist/src/core/answer.js

@@ -13,7 +13,7 @@ import { basename, isAbsolute, resolve, sep } from 'node:path';
 import { sayIn } from "./surface.js";
 /** What answers a line of the surface: the module named as the line, in the folder of its family. */
 export const answerOf = async (family, name) => (await import(__rewriteRelativeImportExtension(new URL(`../${family}/${name}${import.meta.url.slice(import.meta.url.lastIndexOf('.'))}`, import.meta.url).href))).answer;
-export const placeOf = async (asked, context) => asked['place'] || (await context.roots())[0] || ((held) => ('refused' in held ? undefined
+export const placeOf = async (asked, context) => asked['place'] || (await context.roots()).find((root) => context.files.has(root, LOCK) || context.files.has(root, '.bound')) || ((held) => ('refused' in held ? undefined
     : ((named) => (named.length === 1 ? named[0] : undefined))(held.lines.filter((l) => l.scope?.startsWith(`${valueOf(context.lock, 'home/family')}/`) && l.value !== 'withdraw').map((l) => l.value))))(context.files.has(context.home(), LOCK) ? await context.policy(context.home()) : { refused: '' });
 export const inPlace = async (asked, context, then) => ((place) => (place === undefined ? [sayIn(context.lock)('no-place')] : then(place)))(await placeOf(asked, context));
 /** The person's yes to exactly what a message says; anything else is what head says of it, and nothing is done. */

package/dist/src/core/association.d.ts

@@ -0,0 +1,16 @@
+import type { Said } from './lock.ts';
+export interface PackageIdentity {
+    readonly id: string;
+    readonly revision: string;
+    readonly digest: string;
+}
+/** Receiver-local records only: no grants, source pins or sender keys. Use the existing wire fields and forms. */
+export declare function associationFor(prefix: string, incoming: PackageIdentity, authenticated: readonly Said[]): {
+    readonly state: "collision" | "new" | "same" | "revision";
+    readonly previous: Readonly<Record<string, string>>[];
+    readonly incoming: PackageIdentity;
+    readonly scope: string;
+    readonly place: string | undefined;
+};
+/** Ordinary recipient import must succeed before approval. Bound admits all exact withdrawals and records in one lot. */
+export declare function associationLines(plan: ReturnType<typeof associationFor>, place: string, approved: boolean, act: string): readonly string[];

package/dist/src/core/association.js

@@ -0,0 +1,34 @@
+import { canonical } from '@lapxo/topos/wire';
+/** Receiver-local records only: no grants, source pins or sender keys. Use the existing wire fields and forms. */
+export function associationFor(prefix, incoming, authenticated) {
+    if (!/^[a-z][a-z0-9/-]*$/.test(prefix) || !/^[a-z][a-z0-9-]*$/.test(incoming.id) || !/^\d+\.\d+\.\d+$/.test(incoming.revision) || !/^sha256:[a-f0-9]{64}$/.test(incoming.digest))
+        throw Error('package/identity');
+    const scope = `${prefix}/${incoming.id}`, names = [scope, `${scope}/revision`, `${scope}/place`];
+    const previous = authenticated.filter(line => names.includes(line.scope ?? '') && line.value !== 'withdraw');
+    if (names.some(name => previous.filter(line => line.scope === name).length > 1))
+        throw Error('package/association-ambiguous');
+    if (previous.length && previous.length !== 3)
+        throw Error('package/association-incomplete');
+    const held = (at) => previous.find(line => line.scope === at)?.value;
+    const state = !previous.length ? 'new' : held(scope) === incoming.digest && held(`${scope}/revision`) === incoming.revision ? 'same'
+        : held(`${scope}/revision`) === incoming.revision ? 'collision' : 'revision';
+    return { state, previous, incoming, scope, place: held(`${scope}/place`) };
+}
+/** Ordinary recipient import must succeed before approval. Bound admits all exact withdrawals and records in one lot. */
+export function associationLines(plan, place, approved, act) {
+    if (!approved)
+        return [];
+    if (plan.state === 'collision' || !place || !/^policy:[A-Za-z0-9/._:-]+$/.test(act))
+        throw Error('package/association-collision');
+    if (plan.state === 'same' && plan.place === place)
+        return [];
+    const base = { at: act, by: 'target', role: 'writes', form: 'alphabet' };
+    return [[plan.scope, 'digest', plan.incoming.digest], [`${plan.scope}/revision`, 'id', plan.incoming.revision], [`${plan.scope}/place`, 'id', place]].flatMap(([scope, measure, value]) => {
+        const old = plan.previous.find(line => line.scope === scope);
+        if (old?.measure === measure && old.value === value)
+            return [];
+        if (old?.at === act)
+            throw Error('package/association-stale-act');
+        return [...(old ? [canonical({ ...Object.fromEntries(Object.entries(old).filter(([key]) => !['sig', 'epoch'].includes(key))), by: 'target', value: 'withdraw' })] : []), canonical({ ...base, scope, measure, value })];
+    });
+}

package/dist/src/core/composition.d.ts

@@ -0,0 +1,32 @@
+export type Source = {
+    readonly name: string;
+    readonly kind: string;
+    readonly document: string;
+    readonly pin: string;
+    readonly offers: readonly string[];
+};
+export type Selection = {
+    readonly source: string;
+    readonly namespace: string;
+    readonly offers: readonly string[];
+};
+export type Recipe = {
+    readonly id: string;
+    readonly revision: string;
+    readonly title: string;
+    readonly description: string;
+    readonly sources: readonly Selection[];
+};
+/** A selection of already interpreted, authenticated sources. It neither interprets a document nor grants an action. */
+export declare function compose(recipe: Recipe, sources: readonly Source[], most: number): {
+    bytes: Buffer<ArrayBuffer>;
+    digest: string;
+    entries: {
+        source: string;
+        namespace: string;
+        kind: string;
+        document: string;
+        pin: string;
+        offers: string[];
+    }[];
+};

package/dist/src/core/composition.js

@@ -0,0 +1,28 @@
+import { createHash } from 'node:crypto';
+const name = /^[a-z][a-z0-9-]*$/;
+const digest = /^sha256:[a-f0-9]{64}$/;
+/** A selection of already interpreted, authenticated sources. It neither interprets a document nor grants an action. */
+export function compose(recipe, sources, most) {
+    if (!Number.isSafeInteger(most) || most < 1 || !name.test(recipe.id) || !/^\d+\.\d+\.\d+$/.test(recipe.revision) || !recipe.title.trim() || !recipe.description.trim()
+        || recipe.sources.length < 1 || recipe.sources.length > most)
+        throw Error('composition/recipe');
+    const namespaces = new Set(), selected = new Set();
+    const entries = recipe.sources.map(choice => {
+        if (!name.test(choice.namespace) || namespaces.has(choice.namespace) || selected.has(choice.source))
+            throw Error('composition/collision');
+        namespaces.add(choice.namespace);
+        selected.add(choice.source);
+        const found = sources.filter(source => source.name === choice.source);
+        if (found.length !== 1)
+            throw Error('composition/source');
+        const source = found[0];
+        if (!digest.test(source.pin) || !digest.test(source.document) || !source.kind.trim())
+            throw Error('composition/pin');
+        if (!choice.offers.length || choice.offers.length > most || new Set(choice.offers).size !== choice.offers.length
+            || choice.offers.some(offer => !source.offers.includes(offer)))
+            throw Error('composition/offer');
+        return { source: source.name, namespace: choice.namespace, kind: source.kind, document: source.document, pin: source.pin, offers: [...choice.offers].sort() };
+    }).sort((a, b) => a.namespace < b.namespace ? -1 : a.namespace > b.namespace ? 1 : 0);
+    const bytes = Buffer.from(JSON.stringify({ protocol: 'head-composition@1', id: recipe.id, revision: recipe.revision, title: recipe.title, description: recipe.description, sources: entries }) + '\n');
+    return { bytes, digest: `sha256:${createHash('sha256').update(bytes).digest('hex')}`, entries };
+}

package/dist/src/core/package.d.ts

@@ -2,6 +2,7 @@ import { type Asked, type Context } from './answer.ts';
 import { type Said } from './lock.ts';
 /** A line no package carries: one that is not a world, or a source's document, overlay or pin, said once by digest — with, beside a digest that names bytes, the encrypted address they are read at. */
 export declare const foreignIn: (lines: readonly Said[]) => Said | undefined;
+export declare const sharePath: (context: Context, place: string, to: string) => Promise<boolean>;
 /** A place packed as its published lock would name it, into a folder inside it or one the client shares, apart from what head and bound keep: each world its sources were compiled under, and each source — document, overlay, and compiled pin resting on the sources whose issuers it names — by digest, beside the bytes those digests name, and where the person says they are also published, at that encrypted address. No line of access, key or grant: a package grants nothing, and nothing is asked, signed or landed. */
 export declare const shared: (asked: Asked, context: Context) => Promise<readonly string[]>;
 /** What a package names, checked whole before anything is asked: every line a world or a source's document, overlay or pin, by digest; each world the one this head pins; an order its pins rest in. A source whose bytes did not arrive, or did not hash to their line, is open, and so is every source resting on it: absence is not a refusal, and the rest arrives. */

package/dist/src/core/package.js

@@ -5,10 +5,13 @@ import { members, under, valueOf } from "./lock.js";
 import { fieldsOf, vocabOf } from "./read.js";
 import { sayIn } from "./surface.js";
 import { digestIn, linesOf } from "./worlds.js";
+import { sharedBirth } from "../links/birth.js";
+import { shareBundle } from "./share-bundle.js";
 import { linkOf } from "../links/link.js";
 /** A line no package carries: one that is not a world, or a source's document, overlay or pin, said once by digest — with, beside a digest that names bytes, the encrypted address they are read at. */
 export const foreignIn = (lines) => lines.find((l) => !/^(sources\/[a-z0-9-]+(\/overlay)?|uses\/[a-z0-9-]+)$/.test(l.scope ?? '') || lines.some((o) => o !== l && o.scope === l.scope && o.measure === l.measure)
     || (l.measure !== 'digest' && !(l.measure === 'id' && URL.canParse(l.value ?? '') && lines.some((o) => o.scope === l.scope && o.measure === 'digest' && o.needs))));
+export const sharePath = async (context, place, to) => await within(context, place, to) && ((rel) => rel.startsWith('..') || (rel !== '' && !rel.startsWith('.') && ![valueOf(context.lock, 'place/connected'), ...members(valueOf(context.lock, 'place/compiled')), valueOf(context.lock, 'walk/context/file'), valueOf(context.lock, 'place/worlds')].some(at => rel.split(sep)[0] === at.split('/')[0])))(relative(place, to));
 const orderOf = (all, out = []) => ((next) => (next === undefined ? (out.length === all.length ? out : undefined) : orderOf(all, [...out, next])))(all.find((s) => !out.includes(s) && s.rests.every((r) => out.some((o) => o.source === r))));
 const packed = (context, place, own, urls) => {
     const [word, v, digest, held] = [(k) => valueOf(context.lock, k), vocabOf(context.lock), digestIn(context.lock), (rel) => context.files.take(join(place, rel)) ?? new Uint8Array()];
@@ -17,14 +20,23 @@ const packed = (context, place, own, urls) => {
     const pins = own.filter((l) => l.scope?.startsWith('uses/') && under(context.lock, 'place/compiled', l.needs)).map((l) => ((source) => ({ source, pin: l.value, needs: l.needs, lines: linesOf(held(l.needs)), laid: context.files.read.laidOf(context, place, source) }))(l.scope.slice('uses/'.length)));
     const declares = new Map(pins.flatMap((p) => (fieldsOf(p.lines, `${v.region}/${p.source}`)[v.issuers] ?? []).map((issuer) => [issuer, p.source])));
     const rested = pins.map((p) => ({ ...p, rests: [...new Set(p.lines.filter((l) => l.measure === 'issuer').flatMap((l) => declares.get(l.value ?? '') ?? []))].filter((s) => s !== p.source).sort() })), sources = orderOf(rested) ?? rested;
-    return { names: sources.map((s) => s.source), files: sources.flatMap((s) => [...s.laid, [s.needs, held(s.needs)]]), lines: [...own.filter((l) => members(word('world/adopts')).some((w) => l.scope === `uses/${w}`)).flatMap((l) => row(l.scope, l.value)),
+    return { names: sources.map((s) => s.source), files: sources.flatMap((s) => [...s.laid, [s.needs, held(s.needs)]]), lines: [...own.filter((l) => l.scope?.startsWith('uses/') && l.value === word(`world/${l.scope.slice(5)}/standing`)).flatMap((l) => row(l.scope, l.value)),
             ...sources.flatMap((s) => [...s.laid.flatMap(([rel, bytes]) => row(/\.overlay\.[^.]+$/.test(rel) ? `sources/${s.source}/overlay` : `sources/${s.source}`, digest(bytes), { needs: rel })),
                 ...row(`uses/${s.source}`, s.pin, { needs: s.needs, ...(s.rests.length ? { restsOn: s.rests.map((r) => `uses/${r}`).join('|') } : {}) })])] };
 };
 /** A place packed as its published lock would name it, into a folder inside it or one the client shares, apart from what head and bound keep: each world its sources were compiled under, and each source — document, overlay, and compiled pin resting on the sources whose issuers it names — by digest, beside the bytes those digests name, and where the person says they are also published, at that encrypted address. No line of access, key or grant: a package grants nothing, and nothing is asked, signed or landed. */
 export const shared = (asked, context) => inPlace(asked, context, async (place) => {
-    const [say, to, held] = [sayIn(context.lock), asked['to'] ?? '', await standingOr(context, place, context.policy)], [rel, there] = [relative(place, to), linesOf(context.files.take(join(to, LOCK)) ?? new Uint8Array())];
-    if (!(await within(context, place, to)) || (!rel.startsWith('..') && (rel === '' || rel.startsWith('.') || [valueOf(context.lock, 'place/connected'), ...members(valueOf(context.lock, 'place/compiled')), valueOf(context.lock, 'walk/context/file'), valueOf(context.lock, 'place/worlds')].some((at) => rel.split(sep)[0] === at.split('/')[0]))) || foreignIn(there))
+    const bundled = await shareBundle({ ...asked, place }, context, async () => {
+        const own = await standingOr(context, place, context.policy);
+        if ('said' in own)
+            throw Error('bundle/standing');
+        const pack = packed(context, place, own.lines, {}), v = vocabOf(context.lock);
+        return { files: new Map([...pack.files, [LOCK, Buffer.from(pack.lines.join('\n') + '\n')]]), sources: pack.names.map(name => { const pin = own.lines.find(line => line.scope === `uses/${name}`); const doc = linesOf(Buffer.from(pack.lines.join('\n'))).find(line => line.scope === `sources/${name}` && line.measure === 'digest'); return { name, kind: 'compiled', document: doc.value, pin: pin.value, offers: [...new Set(linesOf(context.files.take(join(place, pin.needs))).filter(line => line.scope?.startsWith(`${v.offers}/${name}/`)).map(line => line.scope.split('/')[2]))] }; }) };
+    });
+    if (bundled !== undefined)
+        return bundled;
+    const [say, to, held] = [sayIn(context.lock), asked['to'] ?? '', await standingOr(context, place, context.policy)], there = linesOf(context.files.take(join(to, LOCK)) ?? new Uint8Array());
+    if (!await sharePath(context, place, to) || foreignIn(there))
         return [say('share-to', { place, to })];
     if ('said' in held)
         return held.said;
@@ -34,7 +46,8 @@ export const shared = (asked, context) => inPlace(asked, context, async (place)
     catch {
         return {};
     } })()), pack = packed(context, place, held.lines, urls), bytes = new TextEncoder().encode(`${pack.lines.join('\n')}\n`);
-    return !pack.names.length ? [say('share-none', { place })] : ([...pack.files, [LOCK, bytes]].forEach(([at, laid]) => context.files.lay(to, at, laid)), [say('shared', { place, to, sources: pack.names.join(', '), digest: digestIn(context.lock)(bytes) }), ...linkOf(context, to, pack.lines, urls), ...pack.lines]);
+    const birth = sharedBirth(context, to, held.lines);
+    return !pack.names.length ? [say('share-none', { place }), ...birth] : ([...pack.files, [LOCK, bytes]].forEach(([at, laid]) => context.files.lay(to, at, laid)), [say('shared', { place, to, sources: pack.names.join(', '), digest: digestIn(context.lock)(bytes) }), ...linkOf(context, to, pack.lines, urls), ...birth, ...pack.lines]);
 });
 /** What a package names, checked whole before anything is asked: every line a world or a source's document, overlay or pin, by digest; each world the one this head pins; an order its pins rest in. A source whose bytes did not arrive, or did not hash to their line, is open, and so is every source resting on it: absence is not a refusal, and the rest arrives. */
 export const unpacked = (context, document, bytes, read) => {

package/dist/src/core/read.d.ts

@@ -51,4 +51,5 @@ export type Vocab = ReturnType<typeof vocabOf>;
 export declare const observedAt: (lock: readonly Said[], source: string, operation: string) => string;
 export declare const stepOf: (lines: readonly Said[], lock: readonly Said[], source: string, operation: string) => Call | Plan;
 export declare const planRead: (lines: readonly Said[], lock: readonly Said[], source: string, operation: string, place: string) => Call | Plan;
-export declare const planAct: (lines: readonly Said[], lock: readonly Said[], source: string, operation: string, place: string) => Call | Plan;
+/** An explicit configured invocation may attempt anonymous access, still under the action flow and separate per-call consent. This is not an authentication claim. */
+export declare const planAct: (lines: readonly Said[], lock: readonly Said[], source: string, operation: string, place: string, explicitInvocation?: boolean) => Call | Plan;

package/dist/src/core/read.js

@@ -60,4 +60,5 @@ const callOf = (lines, lock, source, operation, place) => {
 };
 const isCallable = (lock, classes) => classes.length === 1 && classes[0] === vocabOf(lock).callable;
 export const planRead = (lines, lock, source, operation, place) => ((call) => (call.kind === 'call' && !isCallable(lock, call.classes) ? said('not-callable', { source, operation, class: call.classes.join(', ') }) : call))(callOf(lines, lock, source, operation, place));
-export const planAct = (lines, lock, source, operation, place) => ((call) => (call.kind === 'call' && isCallable(lock, call.classes) ? said('is-read', { source, operation }) : call.kind === 'call' && call.access.probe ? said('access-unstated', { source, operation, method: call.carry['method']?.[0], path: call.carry['path']?.[0] }) : call))(callOf(lines, lock, source, operation, place));
+/** An explicit configured invocation may attempt anonymous access, still under the action flow and separate per-call consent. This is not an authentication claim. */
+export const planAct = (lines, lock, source, operation, place, explicitInvocation = false) => ((call) => (call.kind === 'call' && isCallable(lock, call.classes) ? said('is-read', { source, operation }) : call.kind === 'call' && call.access.probe && !explicitInvocation ? said('access-unstated', { source, operation, method: call.carry['method']?.[0], path: call.carry['path']?.[0] }) : call))(callOf(lines, lock, source, operation, place));

package/dist/src/core/receiver.d.ts

@@ -0,0 +1,11 @@
+import type { Asked, Context } from './answer.ts';
+/** Questions only describe the required connect, or route an already associated package; they never import or grant. */
+export declare function receiverQuestion(asked: Asked, context: Context): Promise<{
+    place: string;
+} | {
+    said: readonly string[];
+} | undefined>;
+/** Existing connect does the import; only its successful exact pins allow the receiver-owned association. */
+export declare function receiverConnect(asked: Asked, context: Context): Promise<readonly string[] | undefined>;
+/** Selection narrows this packaged surface; it never grants a call or replaces Bound's authority checks. */
+export declare function receiverAllows(context: Context, place: string, source: string, operation: string): Promise<boolean>;

package/dist/src/core/receiver.js

@@ -0,0 +1,122 @@
+import { configuredPackage } from "../ports/adapters/configured.js";
+import { join } from 'node:path';
+import { LOCK } from '@lapxo/topos/wire';
+import { baseOf, unless } from "./answer.js";
+import { valueOf } from "./lock.js";
+import { shapeOf } from "../ports/surface.js";
+import { sayIn } from "./surface.js";
+import { compose } from "./composition.js";
+import { digestIn, linesOf } from "./worlds.js";
+import { unpacked } from "./package.js";
+import { associationFor, associationLines } from "./association.js";
+import { received, laidIn } from "../sources/connect.js";
+import { rootIn, homeIndex } from "../flows/device.js";
+import { bundleRefusal } from "./share-bundle.js";
+import { bornAt } from "../places/found.js";
+/** Inspect only public installed data. Identity is integrity, never sender authentication or permission. */
+async function material(context) {
+    const port = await context.packaged?.(), selection = port?.read('composition/selection.json');
+    if (!port || !selection)
+        return undefined;
+    const selected = JSON.parse(Buffer.from(selection).toString()), manifest = JSON.parse(Buffer.from(port.read('manifest.json') ?? []).toString());
+    if (selected.protocol !== 'head-composition@1' || !Array.isArray(selected.sources) || manifest.name !== selected.id || manifest.version !== selected.revision)
+        throw Error('bundle/identity');
+    const recipe = { id: selected.id, revision: selected.revision, title: selected.title, description: selected.description, sources: selected.sources.map((s) => ({ source: s.source, namespace: s.namespace, offers: s.offers })) };
+    const sources = selected.sources.map((s) => ({ name: s.source, kind: s.kind, document: s.document, pin: s.pin, offers: s.offers }));
+    const made = compose(recipe, sources, Number(valueOf(context.lock, 'share/bundle-selections').split('..')[1]));
+    if (!Buffer.from(made.bytes).equals(Buffer.from(selection)))
+        throw Error('bundle/selection');
+    const bytes = port.read(`composition/${LOCK}`);
+    if (!bytes)
+        throw Error('bundle/public-lock');
+    const files = new Map();
+    for (const line of linesOf(bytes))
+        if (line.needs)
+            files.set(line.needs, port.read(`composition/${line.needs}`));
+    const documents = configuredPackage(context, files);
+    const document = join(port.root, 'composition', LOCK), got = unpacked(context, document, bytes, files), digest = digestIn(context.lock);
+    if (!got.sources || got.open.length || got.sources.length !== sources.length || sources.some(s => s.kind !== 'compiled' || !got.sources.some(g => g.source === s.name && g.pin === s.pin && digest(g.document.bytes) === s.document)))
+        throw Error('bundle/public-package');
+    const identity = { id: recipe.id, revision: recipe.revision, digest: digest(Buffer.from(JSON.stringify([digest(selection), digest(bytes)]))) };
+    return { identity, document, lockDigest: digest(bytes), bytes, files, documents, sources, selection: made.entries };
+}
+async function associated(context, payload) {
+    const index = await homeIndex(context);
+    if ('refused' in index)
+        throw Error('bundle/index-unread');
+    return { index: index.lines, plan: associationFor(valueOf(context.lock, 'bundle/association-family'), payload.identity, index.lines) };
+}
+const validPins = async (context, place, sources) => {
+    if (!context.files.has(place, LOCK))
+        return false;
+    const held = await context.policy(place);
+    return !('refused' in held) && sources.every(s => held.lines.some(l => l.scope === `uses/${s.name}` && l.value === s.pin));
+};
+/** Questions only describe the required connect, or route an already associated package; they never import or grant. */
+export async function receiverQuestion(asked, context) {
+    try {
+        const payload = await material(context);
+        if (!payload || asked['place'])
+            return undefined;
+        const { plan } = await associated(context, payload);
+        if (plan.state === 'collision')
+            throw Error('bundle/revision-collision');
+        if (plan.state === 'same' && plan.place && await validPins(context, plan.place, payload.sources))
+            return { place: plan.place };
+        return { said: [sayIn(context.lock)('bundle-receiver-ready', { document: payload.document, digest: payload.lockDigest, name: payload.identity.id, revision: payload.identity.revision, place: plan.place })] };
+    }
+    catch (error) {
+        return { said: bundleRefusal(context, error) };
+    }
+}
+/** Existing connect does the import; only its successful exact pins allow the receiver-owned association. */
+export async function receiverConnect(asked, context) {
+    const say = sayIn(context.lock);
+    try {
+        const payload = await material(context);
+        if (!payload || asked['document'] !== payload.document)
+            return undefined;
+        if (asked['digest'] !== payload.lockDigest)
+            throw Error('bundle/document-digest');
+        const { plan } = await associated(context, payload);
+        if (plan.state === 'collision')
+            throw Error('bundle/revision-collision');
+        const place = asked['place'] || plan.place || join(context.personal(), valueOf(context.lock, 'bundle/receiver-folder'), payload.identity.id);
+        if (plan.state === 'same' && plan.place === place && await validPins(context, place, payload.sources))
+            return [say('bundle-associated', { place, name: payload.identity.id, revision: payload.identity.revision })];
+        const refused = await unless(context, say('elicit-bundle-receive', { name: payload.identity.id, revision: payload.identity.revision, place, sources: payload.sources.map(s => { const doc = payload.documents.find(doc => doc.configuration.name === s.name); return doc ? `${s.name} (${doc.configuration.endpoint})` : s.name; }).join(', ') }));
+        if (refused)
+            return refused;
+        if (!context.files.has(place, LOCK)) {
+            const born = await bornAt(context, place, `bundle-${payload.identity.id}`);
+            if (!context.files.has(place, LOCK))
+                return born;
+        }
+        const root = await rootIn(context, place);
+        if ('said' in root)
+            return root.said;
+        const imported = await received(context, place, payload.document, payload.bytes, payload.lockDigest, laidIn(context, place, root.account), root.account, payload.files);
+        if (shapeOf(imported).cells.some(cell => ['refused', 'open'].includes(cell.state)) || !await validPins(context, place, payload.sources))
+            return imported;
+        const home = await rootIn(context, context.home());
+        if ('said' in home)
+            return [...imported, ...home.said];
+        const current = await context.policy(context.home());
+        if ('refused' in current)
+            throw Error('bundle/index-unread');
+        const fresh = associationFor(valueOf(context.lock, 'bundle/association-family'), payload.identity, current.lines);
+        const lot = associationLines(fresh, place, true, `policy:head/bundle/${payload.identity.id}/${baseOf(current.lines)}`), landed = lot.length ? await context.landRoot(context.home(), lot, home.account) : undefined;
+        return landed && 'refused' in landed ? [...imported, say('not-landed', { why: landed.refused })] : [...imported, say('bundle-associated', { place, name: payload.identity.id, revision: payload.identity.revision })];
+    }
+    catch (error) {
+        return bundleRefusal(context, error);
+    }
+}
+/** Selection narrows this packaged surface; it never grants a call or replaces Bound's authority checks. */
+export async function receiverAllows(context, place, source, operation) {
+    const payload = await material(context);
+    if (!payload)
+        return true;
+    const { plan } = await associated(context, payload);
+    return plan.state === 'same' && plan.place === place && await validPins(context, place, payload.sources) && payload.selection.some(s => s.source === source && s.offers.includes(operation));
+}

package/dist/src/core/share-bundle.d.ts

@@ -0,0 +1,9 @@
+import type { Asked, Context } from './answer.ts';
+import { type Source } from './composition.ts';
+/** Refusals expose only declared public bundle codes, never host paths or parsed payloads. */
+export declare const bundleRefusal: (context: Context, error: unknown) => string[];
+/** Export only the existing public package. Connecting a document remains the consented connect action; it is never hidden in export. */
+export declare function shareBundle(asked: Asked, context: Context, read: () => Promise<{
+    readonly files: ReadonlyMap<string, Uint8Array>;
+    readonly sources: readonly Source[];
+}>): Promise<string[] | undefined>;