@lapxo/head 0.1.7 → 0.2.1

package/dist/src/core/share-bundle.js

@@ -0,0 +1,56 @@
+import { configuredProtocol } from "../ports/adapters/configured.js";
+import { dirname, basename } from 'node:path';
+import { canonical, parse } from '@lapxo/topos/wire';
+import { compose } from "./composition.js";
+import { sayIn } from "./surface.js";
+import { digestIn, linesOf } from "./worlds.js";
+import { foreignIn, sharePath } from "./package.js";
+import { valueOf } from "./lock.js";
+/** Refusals expose only declared public bundle codes, never host paths or parsed payloads. */
+export const bundleRefusal = (context, error) => [sayIn(context.lock)('bundle-refused', { why: error instanceof Error && /^bundle\/[a-z-]+$/.test(error.message) ? error.message : 'bundle/invalid' })];
+/** Export only the existing public package. Connecting a document remains the consented connect action; it is never hidden in export. */
+export async function shareBundle(asked, context, read) {
+    const to = asked['to'] ?? '', say = sayIn(context.lock), suffix = valueOf(context.lock, 'share/bundle-suffix');
+    if (!suffix || !to.endsWith(suffix))
+        return undefined;
+    if (!context.bundle || !await sharePath(context, asked['place'] ?? '', to) || context.files.has(dirname(to), basename(to)))
+        return [say('bundle-refused', { why: 'bundle/unavailable-or-destination' })];
+    try {
+        const payload = asked['args'] ? JSON.parse(asked['args']) : undefined;
+        let material = payload ? await read() : undefined;
+        if (material) {
+            for (const choice of payload.sources)
+                if (!material.sources.some(source => source.name === choice.source)) {
+                    const url = choice.document && URL.canParse(choice.document) ? new URL(choice.document) : undefined;
+                    if (!url || url.protocol !== valueOf(context.lock, 'use/scheme') || url.href !== url.origin + url.pathname)
+                        throw Error('bundle/source-document');
+                    return [say(choice.protocol === configuredProtocol.id ? configuredProtocol.sourceNeeded : 'bundle-source-needed', { source: choice.source, document: url.href })];
+                }
+            const lock = material.files.get('TARGET.bound');
+            if (!lock || new TextDecoder().decode(lock).split('\n').filter(Boolean).some(line => parse(line).kind !== 'fact') || foreignIn(linesOf(lock)))
+                throw Error('bundle/public-lock');
+            const declared = linesOf(lock);
+            for (const source of material.sources)
+                if (!declared.some(line => line.scope === `uses/${source.name}` && line.value === source.pin) || !declared.some(line => line.scope === `sources/${source.name}` && line.value === source.document))
+                    throw Error('bundle/source-pin');
+            const made = compose(payload, material.sources, Number(valueOf(context.lock, 'share/bundle-selections').split('..')[1])), selected = new Set(made.entries.map(entry => entry.source));
+            const lines = linesOf(lock).filter(line => !line.needs || selected.has(line.scope.split('/')[1]));
+            if (lines.some(line => line.restsOn?.split('|').some(parent => !selected.has(parent.split('/')[1]))))
+                throw Error('bundle/unselected-parent');
+            const retained = new Map(lines.filter(line => line.needs).map(line => [line.needs, material.files.get(line.needs)]));
+            retained.set('TARGET.bound', Buffer.from(lines.map(line => canonical(line)).join('\n') + '\n'));
+            material = { sources: material.sources.filter(source => selected.has(source.name)), files: retained };
+            for (const line of lines.filter(line => line.needs && line.measure === 'digest')) {
+                const bytes = material.files.get(line.needs);
+                if (!bytes || digestIn(context.lock)(bytes) !== line.value)
+                    throw Error('bundle/public-digest');
+            }
+        }
+        const got = await context.bundle(material && payload ? { recipe: payload, ...material } : undefined);
+        context.files.lay(dirname(to), basename(to), got.bytes);
+        return [say('bundle-shared', { document: to, digest: got.digest, sources: got.sources.join(', ') })];
+    }
+    catch (error) {
+        return bundleRefusal(context, error);
+    }
+}

package/dist/src/doors/head.d.ts

@@ -5,6 +5,7 @@ export interface Door extends Client {
     readonly roots: () => Promise<readonly string[]>;
     readonly client: () => string | undefined;
     readonly name: string;
+    readonly network?: Parameters<typeof import('../ports/adapters/remote.ts').remoteAt>[2];
 }
 export declare const askedOf: (raw: Readonly<Record<string, unknown>> | undefined) => Asked;
 /** head behind a door: its lock read, every call answered one at a time and each answer's next read ahead, the same for every door. */

package/dist/src/doors/head.js

@@ -13,7 +13,7 @@ import { aboutOf, members, valueOf } from "../core/lock.js";
 import { sayIn } from "../core/surface.js";
 import { matchTemplate, refusedOn, shapeOf, surfaceOf } from "../ports/surface.js";
 import { birth, closing, founded, land, landAct, limits, pinnedAt, policyAt, run, settledView, sign, standingAt, told, words } from "../ports/bound.js";
-import { configureHost } from "../ports/host.js";
+import { configureHost, authorityAt } from "../ports/host.js";
 import { held, keep } from "../ports/cache.js";
 import { dropAt, hasAt, layAt, listAt, takeAt } from "../ports/place.js";
 import * as documents from "../ports/documents.js";
@@ -68,10 +68,18 @@ export const headOf = (lock, root, ext, door) => {
         const acted = (place, root, done) => done.then((got) => { if ('lines' in got && !got.lines.every((l) => ((f) => f.kind === 'fact' && read(f.value.fields['at']))(parse(l))))
             moved.add(place); return got; }).finally(() => { forget(place); if (root)
             touched.add(place); });
+        const covered = async (place, lot, then) => {
+            const checked = await authorityAt(place, valueOf(lock, 'founding/root').split('/')[1], 'record-coverage', lot, Date.now(), signal);
+            return 'refused' in checked ? { refused: checked.refused } : checked.decision !== 'allow' ? { refused: `REFUSE·authority-preflight/${checked.decision} ${checked.needs.join('|')}` } : then();
+        };
         return {
             lock,
+            remote: async () => (await import(__rewriteRelativeImportExtension(new URL(`../ports/adapters/remote${ext}`, import.meta.url).href))).remoteAt({ pages: Number(valueOf(lock, 'share/bundle-selections').split('..')[1]), tools: Number(valueOf(lock, 'share/bundle-selections').split('..')[1]), bytes: Number(valueOf(lock, 'share/bundle-bytes').split('..')[1]), wireBytes: Number(valueOf(lock, 'share/bundle-bytes').split('..')[1]), milliseconds: limits.wait }, signal, door.network),
+            packaged: async () => (await import(__rewriteRelativeImportExtension(new URL(`../ports/adapters/bundle${ext}`, import.meta.url).href))).publicAt(root, Number(valueOf(lock, 'share/bundle-bytes').split('..')[1])),
+            bundle: async (payload) => (await import(__rewriteRelativeImportExtension(new URL(`../ports/adapters/bundle${ext}`, import.meta.url).href))).bundleAt(root, lock, payload, signal),
             bound: (cwd, args) => run(runs, cwd, args, {}, signal),
             standing: (place) => once('standing', place, () => standingAt(runs, place, (lines) => ['head', 'person'].flatMap((role) => ((id) => (id === undefined ? [] : [id]))(idIn(lines, device(role)))), (line) => read(line.at), signal)),
+            authority: (place, key, kind, records, presented) => authorityAt(place, key, kind, records, Date.now(), signal, presented),
             policy: (place) => once('policy', place, () => policyAt(runs, place, signal)),
             world: (place, view) => once(`world/${view}`, place, () => settledView(runs, place, view, signal)),
             adapter: async (origin) => ((name) => (!/^[a-z-]+$/.test(name) ? undefined : import(__rewriteRelativeImportExtension(new URL(`../ports/adapters/${name}${ext}`, import.meta.url).href))))(URL.canParse(origin) ? valueOf(lock, `adapter/${new URL(origin).protocol.slice(0, -1)}`) : ''),
@@ -79,8 +87,8 @@ export const headOf = (lock, root, ext, door) => {
             home: () => home,
             personal: () => process.env[valueOf(lock, `platform/${process.platform}/home`)] ?? '',
             found: (place, account) => acted(place, true, founded(runs, place, ...asRoot(account), signal)),
-            signRoot: (place, lot, account) => sign(runs, place, lot, ...asRoot(account), signal),
-            landRoot: (place, lot, account) => acted(place, true, landAct(runs, place, lot, ...asRoot(account), signal)),
+            signRoot: (place, lot, account) => covered(place, lot, () => sign(runs, place, lot, ...asRoot(account), signal)),
+            landRoot: (place, lot, account) => acted(place, true, covered(place, lot, () => landAct(runs, place, lot, ...asRoot(account), signal))),
             moved: (place) => moved.has(place),
             settle: async () => { const red = []; for (const place of touched) {
                 const why = await closing(runs, place, signal);

package/dist/src/flows/answer.js

@@ -1,14 +1,18 @@
 import { canonical } from '@lapxo/topos/wire';
 import { valueOf } from "../core/lock.js";
+import { fieldsOf, vocabOf } from "../core/read.js";
 /**
  * What a source answered, as the world types it: the body is laid in the place's answers for as long as bound reads it,
  * then taken away, and only the lines the world answers for this request come back — a value of each declared field, the
  * counts, what it held back. A place that names no view to type it gets no answer at all, never the body.
  */
 export const typedAnswer = async (context, place, lines, source, operation, key, body) => {
-    const view = valueOf(context.lock, 'place/answer');
-    if (!lines.some((line) => line.scope === `view/${view}`))
-        return { untyped: '' };
+    const v = vocabOf(context.lock), models = fieldsOf(lines, `${v.offers}/${source}/${operation}/${v.form}`)['answer-view'] ?? [];
+    if (models.length > 1 || models.some(model => !/^[a-z][a-z0-9-]*$/.test(model)))
+        return { untyped: 'answer/model-ambiguous' };
+    const view = models[0] ?? valueOf(context.lock, 'place/answer');
+    if (!lines.some((line) => line.scope === `view/${view}` && line.role === 'demands'))
+        return { untyped: 'answer/model-not-admitted' };
     const [request, family] = [key.slice(0, 16), valueOf(context.lock, 'vocab/answer')];
     const at = `${valueOf(context.lock, 'place/answers')}/${source}/${encodeURIComponent(operation).replaceAll('.', '%2E')}/${request}.json`;
     context.files.lay(place, at, body);

package/dist/src/flows/call.d.ts

@@ -38,4 +38,4 @@ export interface Frame {
     readonly uncovered: (role: string, scopes: readonly string[]) => readonly string[] | undefined;
 }
 /** Prepare one call, authorize its access and pass its frame to the read or action flow. */
-export declare const called: (asked: Asked, context: Context, planOf: (lines: readonly Said[], lock: readonly Said[], source: string, operation: string, place: string) => Call | Plan, then: (frame: Frame) => Promise<readonly string[]>) => Promise<readonly string[]>;
+export declare const called: (asked: Asked, context: Context, planOf: (lines: readonly Said[], lock: readonly Said[], source: string, operation: string, place: string, explicitInvocation?: boolean) => Call | Plan, then: (frame: Frame) => Promise<readonly string[]>) => Promise<readonly string[]>;

package/dist/src/flows/call.js

@@ -1,3 +1,5 @@
+import { configuredAt, configuredRefusal, configuredProtocol } from "../ports/adapters/configured.js";
+import { receiverAllows } from "../core/receiver.js";
 import { inPlace, placeNameOf, unless } from "../core/answer.js";
 import { fieldsOf, vocabOf } from "../core/read.js";
 import { canonical } from '@lapxo/topos/wire';
@@ -17,7 +19,7 @@ export const pickedOrigin = async (context, place, lines, source, plan) => {
     const v = vocabOf(context.lock);
     const origins = fieldsOf(lines, `${v.region}/${source}`)[v.origins] ?? [];
     const line = (value) => ({ at: 'policy:person/picks', by: 'target', form: 'alphabet', measure: 'id', role: 'writes', scope: `${v.pick}/${source}`, value });
-    const by = widening(context, place, lines, origins.map((o) => canonical(line(o))));
+    const by = await widening(context, place, lines, origins.map((o) => canonical(line(o))));
     if ('said' in by)
         return { said: by.said };
     const chosen = (await context.person.choose(sayIn(context.lock)('pick', { source }), [{ name: v.origin, options: origins.map((o) => ({ value: o, label: o })) }]))?.[v.origin];
@@ -38,8 +40,15 @@ export const called = async (asked, context, planOf, then) => {
         if ('said' in named)
             return named.said;
         const operation = named.operation;
+        try {
+            if (!await receiverAllows(context, place, source, operation))
+                return say('bundle-not-selected', { place, source, operation });
+        }
+        catch {
+            return say('bundle-refused', { why: 'bundle/invalid' });
+        }
         const widen = async (message, lot) => {
-            const by = widening(context, place, held.lines, lot);
+            const by = await widening(context, place, held.lines, lot);
             if ('said' in by)
                 return { said: by.said };
             const refused = await unless(context, message);
@@ -52,16 +61,31 @@ export const called = async (asked, context, planOf, then) => {
         if ('said' in picked)
             return picked.said;
         const lines = picked.lines;
-        const plan = planOf(lines, context.lock, source, operation, placeNameOf(place));
+        let remote;
+        try {
+            remote = configuredAt(context, place, source, lines);
+        }
+        catch (error) {
+            return configuredRefusal(context, error);
+        }
+        const plan = planOf(lines, context.lock, source, operation, placeNameOf(place), remote !== undefined);
         if (plan.kind === 'said')
             return say(plan.key, plan.fields);
-        const prepared = ((transport) => transport?.prepare(plan, JSON.parse(asked['args'] || '{}'), context.lock))(await context.adapter(plan.origin));
+        if (remote && asked['ahead'] === 'true')
+            return [];
+        if (remote && (!remote.offers.includes(operation) || new URL(remote.endpoint).origin !== new URL(plan.origin).origin))
+            return configuredRefusal(context, Error(configuredProtocol.toolFailure));
+        const args = JSON.parse(asked['args'] || '{}');
+        let request = '';
+        const prepared = remote ? (await context.remote?.())?.prepare(remote, operation, args, async () => await context.elicit(sayIn(context.lock)(configuredProtocol.invoke, { source, operation, endpoint: remote.endpoint, request })) === 'yes')
+            : ((transport) => transport?.prepare(plan, args, context.lock))(await context.adapter(plan.origin));
         if (prepared === undefined)
             return say('no-transport', { source, origin: plan.origin });
         if ('missing' in prepared)
             return say('missing-param', { operation, param: prepared.missing });
         if ('refused' in prepared)
             return say(prepared.refused, { source, origin: plan.origin });
+        request = prepared.key;
         const most = (scope) => Number((lines.find((l) => l.scope === scope)?.value ?? '0..0').split('..')[1]);
         const typed = async (status, bytes) => ((got, at) => ['lines' in got ? say('answered', { source, operation, status, at })[0] : say('untyped', { source, operation, status, at, why: got.untyped })[0], ...('lines' in got ? got.lines : [])])(await typedAnswer(context, place, lines, source, operation, prepared.key, bytes), new Date(context.now()).toISOString());
         const attach = async () => ((got) => ('said' in got ? { said: say(got.said, { source, operation, kinds: plan.access.kind, input: got.input }) } : got))(await attachmentFor(context, place, lines, plan));

package/dist/src/flows/device.d.ts

@@ -2,12 +2,18 @@ import type { Context, Outcome } from '../core/answer.ts';
 import type { Said } from '../core/lock.ts';
 /** A key of this device by its role: read from the keychain, or made there once; only its public half is ever handed on. */
 export declare const deviceKey: (context: Context, role?: string) => string | undefined;
-/** The keychain account of a place's root, when this keychain holds it — who configures the place is here; else what head says of that. */
-export declare const rootIn: (context: Context, place: string) => {
+/** Read the receiver index through its authenticated policy, or an empty index before its birth. */
+export declare const homeIndex: (context: Context) => Promise<{
+    readonly lines: readonly Said[];
+} | {
+    readonly refused: string;
+}>;
+/** Resolve the account through the authenticated index; a legacy folder name only locates a key whose public half must match the authenticated root. */
+export declare const rootIn: (context: Context, place: string) => Promise<{
     readonly account: string;
 } | {
     readonly said: readonly string[];
-};
+}>;
 /**
  * Who signs a widening of a place: its root, when this keychain holds it and the place admits this device's person to
  * witness it — the line is then the place's own policy, in its lock, binding every device it admits, and names as its
@@ -17,10 +23,13 @@ export declare const rootIn: (context: Context, place: string) => {
  * lock as its parent has nothing signed here: what the parent would cut is bound's to judge.
  */
 type By = {
+    readonly key: string;
+    readonly root: boolean;
+    readonly records: (lot: readonly string[]) => readonly string[];
     readonly sign: (lot: readonly string[]) => Promise<Outcome>;
     readonly land: (lot: readonly string[]) => Promise<Outcome>;
 };
-export declare const widening: (context: Context, place: string, lines: readonly Said[], lot: readonly string[]) => By | {
+export declare const widening: (context: Context, place: string, lines: readonly Said[], lot: readonly string[]) => Promise<By | {
     readonly said: readonly string[];
-};
+}>;
 export {};

package/dist/src/flows/device.js

@@ -1,23 +1,31 @@
 import { placeNameOf } from "../core/answer.js";
-import { canonical, parse } from '@lapxo/topos/wire';
+import { canonical, parse, LOCK } from '@lapxo/topos/wire';
 import { deviceOf, idIn, uncoveredIn } from "../core/device.js";
 import { members, valueOf } from "../core/lock.js";
 import { fill, sayIn } from "../core/surface.js";
 import { adoptsIn } from "../adopt/adopt.js";
 /** A key of this device by its role: read from the keychain, or made there once; only its public half is ever handed on. */
 export const deviceKey = (context, role) => context.keys.made?.(deviceOf(context.lock, role).account);
-/** The keychain account of a place's root, when this keychain holds it — who configures the place is here; else what head says of that. */
-export const rootIn = (context, place) => ((account) => (context.keys.held?.(account) === undefined ? { said: [sayIn(context.lock)('no-root', { place })] } : { account }))(fill(valueOf(context.lock, 'founding/root-account'), { place: placeNameOf(place) }));
-export const widening = (context, place, lines, lot) => {
+/** Read the receiver index through its authenticated policy, or an empty index before its birth. */
+export const homeIndex = (context) => context.files.has(context.home(), LOCK) ? context.policy(context.home()) : Promise.resolve({ lines: [] });
+/** Resolve the account through the authenticated index; a legacy folder name only locates a key whose public half must match the authenticated root. */
+export const rootIn = async (context, place) => {
+    const home = context.home(), index = await homeIndex(context);
+    const names = 'refused' in index ? [] : [...new Set(index.lines.filter((l) => l.scope?.startsWith(`${valueOf(context.lock, 'home/family')}/`) && l.value === place).map((l) => l.scope.slice(valueOf(context.lock, 'home/family').length + 1)))];
+    const name = place === home ? valueOf(context.lock, 'home/name') : names[0] ?? placeNameOf(place), account = fill(valueOf(context.lock, 'founding/root-account'), { place: name });
+    const held = await context.policy(place), key = 'refused' in held ? undefined : held.lines.find((l) => l.scope === valueOf(context.lock, 'founding/root') && l.measure === 'public-key')?.value;
+    return 'refused' in index || names.length > 1 || key === undefined || context.keys.held?.(account) !== key ? { said: [sayIn(context.lock)('no-root', { place })] } : { account };
+};
+export const widening = async (context, place, lines, lot) => {
     const parent = adoptsIn(context.lock, lines);
     if (parent !== undefined)
         return { said: [sayIn(context.lock)('parent-lock', { place, parent })] };
-    const [root, witness, field] = [rootIn(context, place), idIn(lines, context.device('person')), valueOf(context.lock, 'widening/witness')];
+    const [root, witness, field] = [await rootIn(context, place), idIn(lines, context.device('person')), valueOf(context.lock, 'widening/witness')];
     const wire = lines.filter((l) => l.scope === 'wire/fields'), admits = wire.some((l) => members(l.value ?? '').includes(field));
     const witnessed = (signed) => signed.map((line) => ((got) => (got.kind === 'fact' ? canonical({ ...got.value.fields, [field]: witness }) : line))(parse(line)));
     if ('account' in root && witness !== undefined) {
         if (admits || lot.every((line) => / scope=wire\/fields /.test(line)))
-            return { sign: (signed) => context.signRoot(place, admits ? witnessed(signed) : signed, root.account), land: (signed) => context.landRoot(place, admits ? witnessed(signed) : signed, root.account) };
+            return { key: valueOf(context.lock, 'founding/root').split('/')[1], root: true, records: (signed) => admits ? witnessed(signed) : signed, sign: (signed) => context.signRoot(place, admits ? witnessed(signed) : signed, root.account), land: (signed) => context.landRoot(place, admits ? witnessed(signed) : signed, root.account) };
         const [named, bare] = [[...new Set([...wire.flatMap((l) => members(l.value ?? '')), field])].join('|'), (l) => Object.fromEntries(Object.entries(l).filter(([k]) => !['sig', 'epoch'].includes(k)))];
         return { said: [sayIn(context.lock)('unwitnessed', { place }), ...wire.map((l) => canonical({ ...bare(l), by: 'target', value: 'withdraw' })),
                 canonical({ at: `policy:head/wire/${new Date(context.now()).toISOString()}`, by: 'target', form: 'alphabet', measure: 'id', role: 'reads', scope: 'wire/fields', value: named })] };
@@ -26,5 +34,5 @@ export const widening = (context, place, lines, lot) => {
     if (stopped)
         return { said: stopped };
     const again = lot.flatMap((line) => ((got) => (got.kind === 'fact' && lines.some((l) => l.scope === got.value.fields.scope && l.measure === got.value.fields.measure) ? [got.value.fields.scope ?? ''] : []))(parse(line)))[0];
-    return again !== undefined ? { said: [sayIn(context.lock)('attested-again', { place, scope: again })] } : { sign: (signed) => context.signAs(place, signed, 'person', lines), land: (signed) => context.landAs(place, signed, 'person', lines) };
+    return again !== undefined ? { said: [sayIn(context.lock)('attested-again', { place, scope: again })] } : { key: witness, root: false, records: (signed) => signed, sign: (signed) => context.signAs(place, signed, 'person', lines), land: (signed) => context.landAs(place, signed, 'person', lines) };
 };

package/dist/src/flows/plan.d.ts

@@ -1,4 +1,6 @@
 import type { Asked, Context } from '../core/answer.ts';
+/** Bound observes exact configuration records; Q4 domain checks remain in Head's existing card. */
+export declare const authorityFor: (context: Context, place: string, key: string, kind: string, records: readonly string[], observe?: boolean, presented?: string) => Promise<readonly string[] | undefined>;
 /**
  * A proposal the person signs: drafted lines shown to the person with the place and the base they are made against; on
  * their yes to exactly those, signed by their key; what bound prints folding it as if landed comes back as it printed it. Nothing lands; the lot is kept by its digest.

package/dist/src/flows/plan.js

@@ -3,6 +3,13 @@ import { sayIn } from "../core/surface.js";
 import { widening } from "./device.js";
 import { parse } from '@lapxo/topos/wire';
 const moved = async (context, place, base) => ((now) => ('said' in now ? now.said : baseOf(now.lines) !== base ? [sayIn(context.lock)('base-moved', { base })] : undefined))(await standingOr(context, place));
+/** Bound observes exact configuration records; Q4 domain checks remain in Head's existing card. */
+export const authorityFor = async (context, place, key, kind, records, observe = false, presented) => {
+    const result = await context.authority(place, key, kind, records, presented), say = sayIn(context.lock);
+    if ('refused' in result)
+        return [say('authority-refused', { place, key, kind, why: result.refused, code: result.code })];
+    return observe || result.decision !== 'allow' ? [say(observe ? 'authority-card' : result.decision === 'deny' ? 'authority-refused' : 'authority-needed', { place, key, kind, decision: result.decision, authority: result.authority, request: result.request, needs: result.needs.join('|'), why: result.decision })] : undefined;
+};
 /**
  * A proposal the person signs: drafted lines shown to the person with the place and the base they are made against; on
  * their yes to exactly those, signed by their key; what bound prints folding it as if landed comes back as it printed it. Nothing lands; the lot is kept by its digest.
@@ -16,9 +23,12 @@ export const planLot = (asked, context) => inPlace(asked, context, async (place)
     if ('said' in held)
         return held.said;
     const base = baseOf(held.lines);
-    const by = widening(context, place, held.lines, lot);
+    const by = await widening(context, place, held.lines, lot);
     if ('said' in by)
         return by.said;
+    const initial = by.root ? await authorityFor(context, place, by.key, 'record-coverage', by.records(lot)) : undefined;
+    if (initial)
+        return initial;
     const consent = await context.elicit(say('elicit', { count: String(lot.length), place, base, lines: lot.join('\n') }));
     if (consent === 'none')
         return [say('sign-yourself', { place }), ...lot];
@@ -30,7 +40,7 @@ export const planLot = (asked, context) => inPlace(asked, context, async (place)
     const stale = await moved(context, place, base);
     if (stale)
         return stale;
-    const kept = context.cache.keep(Buffer.from(JSON.stringify({ place, base, signed: signed.lines })));
+    const kept = context.cache.keep(Buffer.from(JSON.stringify({ place, base, signed: signed.lines, root: by.root })));
     return [say('planned', { lot: kept, base }), ...(await context.told(place, signed.lines))];
 });
 /** A planned lot landed by its digest, only while the place stands on the base it was planned against. */
@@ -43,6 +53,10 @@ export const landLot = async (asked, context) => {
     const stale = await moved(context, kept.place, kept.base);
     if (stale)
         return stale;
+    const author = parse(kept.signed[0] ?? '');
+    const checked = kept.root ? await authorityFor(context, kept.place, author.kind === 'fact' ? author.value.fields.by ?? '' : '', 'admission', kept.signed) : undefined;
+    if (checked)
+        return checked;
     const landed = await context.land(kept.place, kept.signed);
     return 'refused' in landed ? [landed.refused] : [say('landed', { count: String(landed.lines.length) }), ...landed.lines];
 };

package/dist/src/index.js

@@ -8,14 +8,9 @@ var __rewriteRelativeImportExtension = (this && this.__rewriteRelativeImportExte
     return path;
 };
 import { fileURLToPath } from 'node:url';
-import { Server } from '@modelcontextprotocol/sdk/server/index.js';
-import { StdioServerTransport } from '@modelcontextprotocol/sdk/server/stdio.js';
-import { CallToolRequestSchema, GetPromptRequestSchema, ListPromptsRequestSchema, ListResourcesRequestSchema, ListResourceTemplatesRequestSchema, ListToolsRequestSchema, ReadResourceRequestSchema } from '@modelcontextprotocol/sdk/types.js';
 import { aboutOf, members, valueOf } from "./core/lock.js";
-import { fill } from "./core/surface.js";
-import { shapeOf, shapeSchema } from "./ports/surface.js";
-import { folderOf, lockAt } from "./ports/place.js";
-import { askedOf, headOf } from "./doors/head.js";
+import { lockAt } from "./ports/place.js";
+import { serve } from "./ports/adapters/protocol.js";
 const [ext, root] = ((self) => [self.slice(self.lastIndexOf('.')), fileURLToPath(new URL(self.endsWith('.ts') ? '..' : '../..', self))])(import.meta.url);
 const lock = lockAt(root);
 const [door, doors] = [process.argv[3], members(valueOf(lock, 'cli/run/doors'))];
@@ -27,27 +22,4 @@ if (door !== undefined && door !== doors[0]) {
     await (await import(__rewriteRelativeImportExtension(new URL(`./doors/${door}${ext}`, import.meta.url).href))).open(lock, root, ext, door);
     process.exit();
 }
-const offered = (n) => (n ? { listChanged: false } : undefined);
-const head = headOf(lock, root, ext, {
-    can: () => ((e) => ({ url: Boolean(e?.url), form: e !== undefined && (e.form !== undefined || Object.keys(e).length === 0) }))(server.getClientCapabilities()?.elicitation), elicit: (params) => server.elicitInput(params, { timeout: Number(valueOf(lock, 'access/wait').split('..')[1]) }),
-    roots: async () => (server.getClientCapabilities()?.roots ? (await server.listRoots()).roots.flatMap((root) => folderOf(root.uri) ?? []) : []), client: () => ((c) => (c ? `${c.name}@${c.version}` : undefined))(server.getClientVersion()), name: doors[0],
-}), surface = head.surface;
-const server = new Server({ name: surface.name, version: surface.version }, { capabilities: { tools: offered(surface.tools.length), resources: offered(surface.resources.length), prompts: offered(surface.prompts.length) }, instructions: aboutOf(lock, 'prose/en/instructions') });
-const schemaOf = (fields) => ({ type: 'object',
-    properties: Object.fromEntries(fields.map((f) => [f.name, { type: f.type, description: f.about }])), required: fields.filter((f) => f.required).map((f) => f.name) });
-if (surface.tools.length)
-    server.setRequestHandler(ListToolsRequestSchema, () => ({ tools: surface.tools.map((tool) => ({ name: tool.name, description: tool.about,
-            inputSchema: schemaOf([...tool.fields]), outputSchema: shapeSchema(lock), annotations: Object.fromEntries(tool.hints.map((hint) => [`${hint}Hint`, true])) })) }));
-if (surface.tools.length)
-    server.setRequestHandler(CallToolRequestSchema, async (request, extra) => ((answer) => (answer === undefined ? { isError: true, content: [] } : { content: [{ type: 'text', text: answer.join('\n') }], structuredContent: shapeOf(answer) }))(await head.call(request.params.name, request.params.arguments, extra.signal)));
-if (surface.resources.length)
-    server.setRequestHandler(ListResourcesRequestSchema, () => ({ resources: [] }));
-if (surface.resources.length)
-    server.setRequestHandler(ListResourceTemplatesRequestSchema, () => ({ resourceTemplates: surface.resources.map((r) => ({ name: r.name, uriTemplate: r.template, description: r.about, mimeType: r.mime })) }));
-if (surface.resources.length)
-    server.setRequestHandler(ReadResourceRequestSchema, async (request, extra) => ((got) => ({ contents: got === undefined ? [] : [{ uri: request.params.uri, mimeType: got.mime, text: got.lines.join('\n') }] }))(await head.resource(request.params.uri, extra.signal)));
-if (surface.prompts.length)
-    server.setRequestHandler(ListPromptsRequestSchema, () => ({ prompts: surface.prompts.map((p) => ({ name: p.name, description: p.about, arguments: p.fields.map((f) => ({ name: f.name, description: f.about, required: f.required })) })) }));
-if (surface.prompts.length)
-    server.setRequestHandler(GetPromptRequestSchema, (request) => ((p) => ({ messages: p === undefined ? [] : [{ role: 'user', content: { type: 'text', text: [p.text, p.line].filter(Boolean).map((t) => fill(t, askedOf(request.params.arguments))).join('\n') } }] }))(surface.prompts.find((one) => one.name === request.params.name)));
-await server.connect(new StdioServerTransport());
+await serve(lock, root, ext, doors[0]);

package/dist/src/links/birth.d.ts

@@ -0,0 +1,6 @@
+import { type Asked, type Context } from '../core/answer.ts';
+import { type Said } from '../core/lock.ts';
+/** A separate public birth artifact. The source package, authority and personal birth journal are not its payload. */
+export declare const sharedBirth: (context: Context, to: string, standing: readonly Said[]) => readonly string[];
+/** Inline or client-shared local birth bytes are inspected only; no transport, signer, file write or admission is acquired. */
+export declare const receivedBirth: (asked: Asked, context: Context) => Promise<readonly string[] | undefined>;

package/dist/src/links/birth.js

@@ -0,0 +1,48 @@
+import { basename, join } from 'node:path';
+import { canonical, parse } from '@lapxo/topos/wire';
+import { PORTABLE_BIRTH_PROFILE, decodePortableBirth, encodePortableBirth, inspectPortableBirth } from '@lapxo/topos/contract';
+import { semanticStandingBytes } from '@lapxo/topos/standing';
+import { inStanding } from "../core/answer.js";
+import { members, valueOf } from "../core/lock.js";
+import { sayIn } from "../core/surface.js";
+import { digestIn } from "../core/worlds.js";
+const budget = (context) => ({ bytes: Number(valueOf(context.lock, 'bound/printed').split('..')[1]), items: Number(valueOf(context.lock, 'share/birth-items').split('..')[1]) });
+const refused = (context, error) => [sayIn(context.lock)('birth-refused', { why: error instanceof Error ? error.message : String(error) })];
+/** A separate public birth artifact. The source package, authority and personal birth journal are not its payload. */
+export const sharedBirth = (context, to, standing) => {
+    const say = sayIn(context.lock), scopes = members(valueOf(context.lock, 'share/birth-scopes')), file = valueOf(context.lock, 'share/birth-file');
+    const declarations = standing.filter(line => scopes.includes(line.scope ?? '')).map(({ by: _by, sig: _sig, epoch: _epoch, ...line }) => canonical(line));
+    if (!declarations.length)
+        return [say('birth-empty')];
+    try {
+        const record = encodePortableBirth({ origin: digestIn(context.lock)(semanticStandingBytes(standing.map(line => canonical(line)))), declarations }, budget(context)), bytes = new TextEncoder().encode(record);
+        context.files.lay(to, file, bytes);
+        return [say('birth-shared', { document: join(to, file), digest: digestIn(context.lock)(bytes), record })];
+    }
+    catch (error) {
+        return refused(context, error);
+    }
+};
+/** Inline or client-shared local birth bytes are inspected only; no transport, signer, file write or admission is acquired. */
+export const receivedBirth = async (asked, context) => {
+    const document = asked['document'] ?? '', inline = document.startsWith(PORTABLE_BIRTH_PROFILE.split('/')[0] + '/');
+    if (!inline && !(document.startsWith('/') && basename(document) === valueOf(context.lock, 'share/birth-file')))
+        return undefined;
+    return inStanding(asked, context, async (place, standing) => {
+        const say = sayIn(context.lock), bytes = inline ? new TextEncoder().encode(document) : (await context.files.read.documentOf(context, place, document))?.bytes;
+        if (!bytes)
+            return [say('birth-needs', { document })];
+        if (asked['digest'] && digestIn(context.lock)(bytes) !== asked['digest'])
+            return [say('document-digest', { document: inline ? PORTABLE_BIRTH_PROFILE : document, digest: asked['digest'], got: digestIn(context.lock)(bytes) })];
+        try {
+            const pack = decodePortableBirth(new TextDecoder().decode(bytes), budget(context)), allowed = members(valueOf(context.lock, 'share/birth-scopes'));
+            if (pack.declarations.some(line => ((p) => p.kind !== 'fact' || !allowed.includes(p.value.fields.scope ?? ''))(parse(line))))
+                return [say('birth-refused', { why: 'declaration outside the public birth selection' })];
+            const inspected = inspectPortableBirth(pack, [...new Set(standing.flatMap(line => line.scope ?? []))], budget(context));
+            return [say('birth-inspected', { inspection: inspected.status, collisions: inspected.collisions.join(', ') || 'none', origin: pack.origin, declarations: pack.declarations.join('\n') })];
+        }
+        catch (error) {
+            return refused(context, error);
+        }
+    }, context.policy);
+};

package/dist/src/links/inspect.d.ts

@@ -1,6 +1,6 @@
 import { type Asked, type Context } from '../core/answer.ts';
 /**
- * A #bound: link connected: inspected by the instrument in the person's place, never authenticated — its bytes are the
+ * A legacy or located reference connected: inspected by the instrument in the person's place, never authenticated — its bytes are the
  * link's, and nothing shows who shared it — and what it names is shown; nothing is connected or granted, since a package
  * is received by the digest its sharer sent apart. A place that admits no content transport is handed the lines that admit
  * one, to sign; bytes that do not arrive are owed by the link until they do; bytes that are not what it names are refused.

package/dist/src/links/inspect.js

@@ -1,4 +1,5 @@
 import { decodeReference } from '@lapxo/bound/reference';
+import { decodeLocatedReference, locatedReferenceIdentity } from '@lapxo/topos/contract';
 import { canonical } from '@lapxo/topos/wire';
 import { inStanding } from "../core/answer.js";
 import { members, valueOf } from "../core/lock.js";
@@ -6,7 +7,7 @@ import { sayIn } from "../core/surface.js";
 import { linesOf } from "../core/worlds.js";
 import { rootIn } from "../flows/device.js";
 /**
- * A #bound: link connected: inspected by the instrument in the person's place, never authenticated — its bytes are the
+ * A legacy or located reference connected: inspected by the instrument in the person's place, never authenticated — its bytes are the
  * link's, and nothing shows who shared it — and what it names is shown; nothing is connected or granted, since a package
  * is received by the digest its sharer sent apart. A place that admits no content transport is handed the lines that admit
  * one, to sign; bytes that do not arrive are owed by the link until they do; bytes that are not what it names are refused.
@@ -18,25 +19,35 @@ export const linked = (asked, context) => inStanding(asked, context, async (plac
         return [...standing.filter((l) => admits.includes(l.scope ?? '') || l.scope?.startsWith('transport/')).map((l) => canonical(l)), say('why-transport', { place })];
     const lines = context.lock.filter((l) => admits.some((s) => l.scope === `birth/${s}`)).map(({ about: _about, scope, ...l }) => canonical({ ...l, scope: scope.slice('birth/'.length), at: 'policy:person/transport', by: 'target' }));
     let reference;
+    const legacy = link.startsWith(word('link/prefix'));
     try {
-        reference = decodeReference(link);
+        reference = legacy ? (({ source, ...held }) => ({ ...held, location: source, 'location-class': 'holder' }))(decodeReference(link)) : decodeLocatedReference(link);
     }
     catch (refused) {
         return [say('link-refused', { link, why: refused instanceof Error ? refused.message : String(refused) })];
     }
-    if (![admits[0], `transport/${new URL(reference.source).protocol.slice(0, -1)}`].every((s) => standing.some((l) => l.scope === s)))
+    const identity = legacy ? link : locatedReferenceIdentity(reference), source = reference.location;
+    if (!source || reference['location-class'] === 'viewer')
+        return [say('reference-needs', { identity, needs: 'bytes/holder-location' })];
+    if (![admits[0], `transport/${new URL(source).protocol.slice(0, -1)}`].every((s) => standing.some((l) => l.scope === s)))
         return [say('transport-missing', { place, lines: lines.join('\n') })];
-    const [printed, scope] = [await context.bound(place, [word('bound/read'), link]), `${word('place/needs')}/bytes/${reference.blob.slice(reference.algorithm.length + 1, reference.algorithm.length + 17)}`];
-    const [owed, root, why] = [standing.find((l) => l.scope === scope && l.role === 'demands' && l.value === link), rootIn(context, place), printed?.err.filter((l) => !l.startsWith('{')).at(-1) ?? ''];
-    if ('said' in root)
-        return root.said;
+    const [printed, scope] = [await context.bound(place, [word('bound/read'), link]), `${word('place/needs')}/bytes/${reference.blob.slice(reference.algorithm.length + 1, legacy ? reference.algorithm.length + 17 : undefined)}`];
+    const [owed, why, absent] = [standing.find((l) => l.scope === scope && l.role === 'demands' && l.value === identity), printed?.err.filter((l) => !l.startsWith('{')).at(-1) ?? '', printed?.out.some((line) => line.startsWith('NEEDS '))];
     if (printed?.code !== 0 && !why.includes(word('link/unarrived')))
         return [say('link-refused', { link, why })];
-    const settled = (lot) => (lot.length ? context.landRoot(place, lot, root.account).then((got) => ('refused' in got ? say('not-landed', { why: got.refused }) : got.lines)) : Promise.resolve([]));
-    const due = { at: 'policy:head/link', by: 'target', form: 'alphabet', measure: 'id', role: 'demands', scope, value: link };
-    if (printed?.code !== 0)
-        return [say('link-owed', { place, source: reference.source }), ...await settled(owed ? [] : [canonical(due)])];
+    const settled = async (lot) => {
+        if (!lot.length)
+            return [];
+        const root = await rootIn(context, place);
+        if ('said' in root)
+            return root.said;
+        const got = await context.landRoot(place, lot, root.account);
+        return 'refused' in got ? [say('not-landed', { why: got.refused })] : got.lines;
+    };
+    const due = { at: 'policy:head/link', by: 'target', form: 'alphabet', measure: 'id', role: 'demands', scope, value: identity };
+    if (printed?.code !== 0 || absent)
+        return [say('link-owed', { place, source }), ...await settled(owed ? [] : [canonical(due)])];
     const named = linesOf(new TextEncoder().encode(printed.out.filter((l) => l.startsWith('TOPOS ')).map((l) => l.slice('TOPOS '.length)).join('\n')));
     const sources = named.filter((l) => /^sources\/[^/]+$/.test(l.scope ?? '')).map((l) => l.scope.split('/')[1]);
-    return [say('inspected', { source: reference.source, sources: sources.join(', ') || '—', digest: reference.digest }), say('sharer-unverified', {}), ...await settled(owed ? [canonical({ ...due, value: 'withdraw' })] : [])];
+    return [say('inspected', { source, sources: sources.join(', ') || '—', digest: reference.digest }), say('sharer-unverified', {}), ...await settled(owed ? [canonical({ ...due, value: 'withdraw' })] : [])];
 }, context.policy);

package/dist/src/links/link.d.ts

@@ -1,7 +1,7 @@
 import type { Context } from '../core/answer.ts';
 /**
  * A package's link: its lines as one standing document, laid in its folder as it is to be published — the link names that
- * document's bytes, never the package's files — and the #bound: link to it at the address the person publishes it at.
- * With no address there is no link, said so: a link needs where its bytes are published, and the digest still goes apart.
+ * document's bytes, never the package's files. The separate located profile keeps retrieval apart from content identity.
+ * Without a location the reference still names its content; it does not invent a holder or transfer authority.
  */
 export declare const linkOf: (context: Context, to: string, lines: readonly string[], urls: Readonly<Record<string, string>>) => readonly string[];

package/dist/src/links/link.js

@@ -1,25 +1,22 @@
-import { createHash } from 'node:crypto';
 import { join } from 'node:path';
-import { encodeReference } from '@lapxo/bound/reference';
+import { encodeLocatedReference } from '@lapxo/topos/contract';
 import { semanticStandingBytes } from '@lapxo/topos/standing';
 import { members, valueOf } from "../core/lock.js";
 import { sayIn } from "../core/surface.js";
-const sha = (bytes) => createHash('sha256').update(bytes).digest('hex');
+import { digestIn } from "../core/worlds.js";
 /**
  * A package's link: its lines as one standing document, laid in its folder as it is to be published — the link names that
- * document's bytes, never the package's files — and the #bound: link to it at the address the person publishes it at.
- * With no address there is no link, said so: a link needs where its bytes are published, and the digest still goes apart.
+ * document's bytes, never the package's files. The separate located profile keeps retrieval apart from content identity.
+ * Without a location the reference still names its content; it does not invent a holder or transfer authority.
  */
 export const linkOf = (context, to, lines, urls) => {
-    const say = sayIn(context.lock), [name, profile, [kind, algorithm]] = [valueOf(context.lock, 'link/document'), valueOf(context.lock, 'link/profile'), members(valueOf(context.lock, 'link/reference'))];
+    const say = sayIn(context.lock), digest = digestIn(context.lock), [name, profile, [kind, algorithm]] = [valueOf(context.lock, 'link/document'), valueOf(context.lock, 'link/profile'), members(valueOf(context.lock, 'link/reference'))];
     const standing = semanticStandingBytes(lines), bytes = new TextEncoder().encode(JSON.stringify({ profile, standing })), at = urls[name], document = join(to, name);
     context.files.lay(to, name, bytes);
-    if (at === undefined || !URL.canParse(at))
-        return [say('shared-unlinked', { document })];
     try {
-        return [say('shared-link', { document, at, link: encodeReference({ class: kind, algorithm, digest: sha(standing), blob: `${algorithm}:${sha(bytes)}`, source: new URL(at).href }) })];
+        return [say(at === undefined ? 'shared-unlinked' : 'shared-link', { document, at: at ?? '', link: encodeLocatedReference({ class: kind, algorithm, digest: digest(standing).slice(7), blob: digest(bytes), ...(at === undefined ? {} : { location: new URL(at).href, 'location-class': 'holder' }) }) })];
     }
     catch (refused) {
-        return [say('link-refused', { link: at, why: refused instanceof Error ? refused.message : String(refused) })];
+        return [say('link-refused', { link: name, why: refused instanceof Error ? refused.message : String(refused) })];
     }
 };

package/dist/src/onboard/first.js

@@ -22,7 +22,7 @@ export const firstRun = async (asked, context, then) => {
     const refused = await unless(context, say('elicit-first-run', { dir, source, document, until }));
     if (refused)
         return refused;
-    const born = await bornAt(context, dir, name), root = rootIn(context, dir);
+    const born = await bornAt(context, dir, name), root = await rootIn(context, dir);
     if (born[0] !== say('born', { name, dir }) || 'said' in root)
         return 'said' in root ? [...born, ...root.said] : born;
     const connected = await then(dir, true), unread = connected.some((l) => l.startsWith('said/head/document-unread ')), held = unread ? undefined : await context.policy(dir);

package/dist/src/onboard/owed.js

@@ -15,7 +15,7 @@ export const paidIn = async (asked, context, place) => {
     const owed = 'said' in held ? undefined : held.lines.find((l) => l.scope === scope && l.role === 'demands' && l.value !== 'withdraw');
     if (owed === undefined)
         return { said: [], answer: true };
-    const document = owed.value ?? '', read = await context.files.read.documentOf(context, place, document), root = rootIn(context, place);
+    const document = owed.value ?? '', read = await context.files.read.documentOf(context, place, document), root = await rootIn(context, place);
     if ('said' in root)
         return { said: root.said, answer: false };
     if (read === undefined)