@lapxo/head 0.2.0 → 0.2.1

package/dist/src/flows/call.js

@@ -1,3 +1,5 @@
+import { configuredAt, configuredRefusal, configuredProtocol } from "../ports/adapters/configured.js";
+import { receiverAllows } from "../core/receiver.js";
 import { inPlace, placeNameOf, unless } from "../core/answer.js";
 import { fieldsOf, vocabOf } from "../core/read.js";
 import { canonical } from '@lapxo/topos/wire';
@@ -17,7 +19,7 @@ export const pickedOrigin = async (context, place, lines, source, plan) => {
     const v = vocabOf(context.lock);
     const origins = fieldsOf(lines, `${v.region}/${source}`)[v.origins] ?? [];
     const line = (value) => ({ at: 'policy:person/picks', by: 'target', form: 'alphabet', measure: 'id', role: 'writes', scope: `${v.pick}/${source}`, value });
-    const by = widening(context, place, lines, origins.map((o) => canonical(line(o))));
+    const by = await widening(context, place, lines, origins.map((o) => canonical(line(o))));
     if ('said' in by)
         return { said: by.said };
     const chosen = (await context.person.choose(sayIn(context.lock)('pick', { source }), [{ name: v.origin, options: origins.map((o) => ({ value: o, label: o })) }]))?.[v.origin];
@@ -38,8 +40,15 @@ export const called = async (asked, context, planOf, then) => {
         if ('said' in named)
             return named.said;
         const operation = named.operation;
+        try {
+            if (!await receiverAllows(context, place, source, operation))
+                return say('bundle-not-selected', { place, source, operation });
+        }
+        catch {
+            return say('bundle-refused', { why: 'bundle/invalid' });
+        }
         const widen = async (message, lot) => {
-            const by = widening(context, place, held.lines, lot);
+            const by = await widening(context, place, held.lines, lot);
             if ('said' in by)
                 return { said: by.said };
             const refused = await unless(context, message);
@@ -52,16 +61,31 @@ export const called = async (asked, context, planOf, then) => {
         if ('said' in picked)
             return picked.said;
         const lines = picked.lines;
-        const plan = planOf(lines, context.lock, source, operation, placeNameOf(place));
+        let remote;
+        try {
+            remote = configuredAt(context, place, source, lines);
+        }
+        catch (error) {
+            return configuredRefusal(context, error);
+        }
+        const plan = planOf(lines, context.lock, source, operation, placeNameOf(place), remote !== undefined);
         if (plan.kind === 'said')
             return say(plan.key, plan.fields);
-        const prepared = ((transport) => transport?.prepare(plan, JSON.parse(asked['args'] || '{}'), context.lock))(await context.adapter(plan.origin));
+        if (remote && asked['ahead'] === 'true')
+            return [];
+        if (remote && (!remote.offers.includes(operation) || new URL(remote.endpoint).origin !== new URL(plan.origin).origin))
+            return configuredRefusal(context, Error(configuredProtocol.toolFailure));
+        const args = JSON.parse(asked['args'] || '{}');
+        let request = '';
+        const prepared = remote ? (await context.remote?.())?.prepare(remote, operation, args, async () => await context.elicit(sayIn(context.lock)(configuredProtocol.invoke, { source, operation, endpoint: remote.endpoint, request })) === 'yes')
+            : ((transport) => transport?.prepare(plan, args, context.lock))(await context.adapter(plan.origin));
         if (prepared === undefined)
             return say('no-transport', { source, origin: plan.origin });
         if ('missing' in prepared)
             return say('missing-param', { operation, param: prepared.missing });
         if ('refused' in prepared)
             return say(prepared.refused, { source, origin: plan.origin });
+        request = prepared.key;
         const most = (scope) => Number((lines.find((l) => l.scope === scope)?.value ?? '0..0').split('..')[1]);
         const typed = async (status, bytes) => ((got, at) => ['lines' in got ? say('answered', { source, operation, status, at })[0] : say('untyped', { source, operation, status, at, why: got.untyped })[0], ...('lines' in got ? got.lines : [])])(await typedAnswer(context, place, lines, source, operation, prepared.key, bytes), new Date(context.now()).toISOString());
         const attach = async () => ((got) => ('said' in got ? { said: say(got.said, { source, operation, kinds: plan.access.kind, input: got.input }) } : got))(await attachmentFor(context, place, lines, plan));

package/dist/src/flows/device.d.ts

@@ -2,12 +2,18 @@ import type { Context, Outcome } from '../core/answer.ts';
 import type { Said } from '../core/lock.ts';
 /** A key of this device by its role: read from the keychain, or made there once; only its public half is ever handed on. */
 export declare const deviceKey: (context: Context, role?: string) => string | undefined;
-/** The keychain account of a place's root, when this keychain holds it — who configures the place is here; else what head says of that. */
-export declare const rootIn: (context: Context, place: string) => {
+/** Read the receiver index through its authenticated policy, or an empty index before its birth. */
+export declare const homeIndex: (context: Context) => Promise<{
+    readonly lines: readonly Said[];
+} | {
+    readonly refused: string;
+}>;
+/** Resolve the account through the authenticated index; a legacy folder name only locates a key whose public half must match the authenticated root. */
+export declare const rootIn: (context: Context, place: string) => Promise<{
     readonly account: string;
 } | {
     readonly said: readonly string[];
-};
+}>;
 /**
  * Who signs a widening of a place: its root, when this keychain holds it and the place admits this device's person to
  * witness it — the line is then the place's own policy, in its lock, binding every device it admits, and names as its
@@ -23,7 +29,7 @@ type By = {
     readonly sign: (lot: readonly string[]) => Promise<Outcome>;
     readonly land: (lot: readonly string[]) => Promise<Outcome>;
 };
-export declare const widening: (context: Context, place: string, lines: readonly Said[], lot: readonly string[]) => By | {
+export declare const widening: (context: Context, place: string, lines: readonly Said[], lot: readonly string[]) => Promise<By | {
     readonly said: readonly string[];
-};
+}>;
 export {};

package/dist/src/flows/device.js

@@ -1,18 +1,26 @@
 import { placeNameOf } from "../core/answer.js";
-import { canonical, parse } from '@lapxo/topos/wire';
+import { canonical, parse, LOCK } from '@lapxo/topos/wire';
 import { deviceOf, idIn, uncoveredIn } from "../core/device.js";
 import { members, valueOf } from "../core/lock.js";
 import { fill, sayIn } from "../core/surface.js";
 import { adoptsIn } from "../adopt/adopt.js";
 /** A key of this device by its role: read from the keychain, or made there once; only its public half is ever handed on. */
 export const deviceKey = (context, role) => context.keys.made?.(deviceOf(context.lock, role).account);
-/** The keychain account of a place's root, when this keychain holds it — who configures the place is here; else what head says of that. */
-export const rootIn = (context, place) => ((account) => (context.keys.held?.(account) === undefined ? { said: [sayIn(context.lock)('no-root', { place })] } : { account }))(fill(valueOf(context.lock, 'founding/root-account'), { place: placeNameOf(place) }));
-export const widening = (context, place, lines, lot) => {
+/** Read the receiver index through its authenticated policy, or an empty index before its birth. */
+export const homeIndex = (context) => context.files.has(context.home(), LOCK) ? context.policy(context.home()) : Promise.resolve({ lines: [] });
+/** Resolve the account through the authenticated index; a legacy folder name only locates a key whose public half must match the authenticated root. */
+export const rootIn = async (context, place) => {
+    const home = context.home(), index = await homeIndex(context);
+    const names = 'refused' in index ? [] : [...new Set(index.lines.filter((l) => l.scope?.startsWith(`${valueOf(context.lock, 'home/family')}/`) && l.value === place).map((l) => l.scope.slice(valueOf(context.lock, 'home/family').length + 1)))];
+    const name = place === home ? valueOf(context.lock, 'home/name') : names[0] ?? placeNameOf(place), account = fill(valueOf(context.lock, 'founding/root-account'), { place: name });
+    const held = await context.policy(place), key = 'refused' in held ? undefined : held.lines.find((l) => l.scope === valueOf(context.lock, 'founding/root') && l.measure === 'public-key')?.value;
+    return 'refused' in index || names.length > 1 || key === undefined || context.keys.held?.(account) !== key ? { said: [sayIn(context.lock)('no-root', { place })] } : { account };
+};
+export const widening = async (context, place, lines, lot) => {
     const parent = adoptsIn(context.lock, lines);
     if (parent !== undefined)
         return { said: [sayIn(context.lock)('parent-lock', { place, parent })] };
-    const [root, witness, field] = [rootIn(context, place), idIn(lines, context.device('person')), valueOf(context.lock, 'widening/witness')];
+    const [root, witness, field] = [await rootIn(context, place), idIn(lines, context.device('person')), valueOf(context.lock, 'widening/witness')];
     const wire = lines.filter((l) => l.scope === 'wire/fields'), admits = wire.some((l) => members(l.value ?? '').includes(field));
     const witnessed = (signed) => signed.map((line) => ((got) => (got.kind === 'fact' ? canonical({ ...got.value.fields, [field]: witness }) : line))(parse(line)));
     if ('account' in root && witness !== undefined) {

package/dist/src/flows/plan.js

@@ -23,7 +23,7 @@ export const planLot = (asked, context) => inPlace(asked, context, async (place)
     if ('said' in held)
         return held.said;
     const base = baseOf(held.lines);
-    const by = widening(context, place, held.lines, lot);
+    const by = await widening(context, place, held.lines, lot);
     if ('said' in by)
         return by.said;
     const initial = by.root ? await authorityFor(context, place, by.key, 'record-coverage', by.records(lot)) : undefined;

package/dist/src/index.js

@@ -8,14 +8,9 @@ var __rewriteRelativeImportExtension = (this && this.__rewriteRelativeImportExte
     return path;
 };
 import { fileURLToPath } from 'node:url';
-import { Server } from '@modelcontextprotocol/sdk/server/index.js';
-import { StdioServerTransport } from '@modelcontextprotocol/sdk/server/stdio.js';
-import { CallToolRequestSchema, GetPromptRequestSchema, ListPromptsRequestSchema, ListResourcesRequestSchema, ListResourceTemplatesRequestSchema, ListToolsRequestSchema, ReadResourceRequestSchema } from '@modelcontextprotocol/sdk/types.js';
 import { aboutOf, members, valueOf } from "./core/lock.js";
-import { fill } from "./core/surface.js";
-import { shapeOf, shapeSchema } from "./ports/surface.js";
-import { folderOf, lockAt } from "./ports/place.js";
-import { askedOf, headOf } from "./doors/head.js";
+import { lockAt } from "./ports/place.js";
+import { serve } from "./ports/adapters/protocol.js";
 const [ext, root] = ((self) => [self.slice(self.lastIndexOf('.')), fileURLToPath(new URL(self.endsWith('.ts') ? '..' : '../..', self))])(import.meta.url);
 const lock = lockAt(root);
 const [door, doors] = [process.argv[3], members(valueOf(lock, 'cli/run/doors'))];
@@ -27,27 +22,4 @@ if (door !== undefined && door !== doors[0]) {
     await (await import(__rewriteRelativeImportExtension(new URL(`./doors/${door}${ext}`, import.meta.url).href))).open(lock, root, ext, door);
     process.exit();
 }
-const offered = (n) => (n ? { listChanged: false } : undefined);
-const head = headOf(lock, root, ext, {
-    can: () => ((e) => ({ url: Boolean(e?.url), form: e !== undefined && (e.form !== undefined || Object.keys(e).length === 0) }))(server.getClientCapabilities()?.elicitation), elicit: (params) => server.elicitInput(params, { timeout: Number(valueOf(lock, 'access/wait').split('..')[1]) }),
-    roots: async () => (server.getClientCapabilities()?.roots ? (await server.listRoots()).roots.flatMap((root) => folderOf(root.uri) ?? []) : []), client: () => ((c) => (c ? `${c.name}@${c.version}` : undefined))(server.getClientVersion()), name: doors[0],
-}), surface = head.surface;
-const server = new Server({ name: surface.name, version: surface.version }, { capabilities: { tools: offered(surface.tools.length), resources: offered(surface.resources.length), prompts: offered(surface.prompts.length) }, instructions: aboutOf(lock, 'prose/en/instructions') });
-const schemaOf = (fields) => ({ type: 'object',
-    properties: Object.fromEntries(fields.map((f) => [f.name, { type: f.type, description: f.about }])), required: fields.filter((f) => f.required).map((f) => f.name) });
-if (surface.tools.length)
-    server.setRequestHandler(ListToolsRequestSchema, () => ({ tools: surface.tools.map((tool) => ({ name: tool.name, description: tool.about,
-            inputSchema: schemaOf([...tool.fields]), outputSchema: shapeSchema(lock), annotations: Object.fromEntries(tool.hints.map((hint) => [`${hint}Hint`, true])) })) }));
-if (surface.tools.length)
-    server.setRequestHandler(CallToolRequestSchema, async (request, extra) => ((answer) => (answer === undefined ? { isError: true, content: [] } : { content: [{ type: 'text', text: answer.join('\n') }], structuredContent: shapeOf(answer) }))(await head.call(request.params.name, request.params.arguments, extra.signal)));
-if (surface.resources.length)
-    server.setRequestHandler(ListResourcesRequestSchema, () => ({ resources: [] }));
-if (surface.resources.length)
-    server.setRequestHandler(ListResourceTemplatesRequestSchema, () => ({ resourceTemplates: surface.resources.map((r) => ({ name: r.name, uriTemplate: r.template, description: r.about, mimeType: r.mime })) }));
-if (surface.resources.length)
-    server.setRequestHandler(ReadResourceRequestSchema, async (request, extra) => ((got) => ({ contents: got === undefined ? [] : [{ uri: request.params.uri, mimeType: got.mime, text: got.lines.join('\n') }] }))(await head.resource(request.params.uri, extra.signal)));
-if (surface.prompts.length)
-    server.setRequestHandler(ListPromptsRequestSchema, () => ({ prompts: surface.prompts.map((p) => ({ name: p.name, description: p.about, arguments: p.fields.map((f) => ({ name: f.name, description: f.about, required: f.required })) })) }));
-if (surface.prompts.length)
-    server.setRequestHandler(GetPromptRequestSchema, (request) => ((p) => ({ messages: p === undefined ? [] : [{ role: 'user', content: { type: 'text', text: [p.text, p.line].filter(Boolean).map((t) => fill(t, askedOf(request.params.arguments))).join('\n') } }] }))(surface.prompts.find((one) => one.name === request.params.name)));
-await server.connect(new StdioServerTransport());
+await serve(lock, root, ext, doors[0]);

package/dist/src/links/inspect.js

@@ -38,7 +38,7 @@ export const linked = (asked, context) => inStanding(asked, context, async (plac
     const settled = async (lot) => {
         if (!lot.length)
             return [];
-        const root = rootIn(context, place);
+        const root = await rootIn(context, place);
         if ('said' in root)
             return root.said;
         const got = await context.landRoot(place, lot, root.account);

package/dist/src/onboard/first.js

@@ -22,7 +22,7 @@ export const firstRun = async (asked, context, then) => {
     const refused = await unless(context, say('elicit-first-run', { dir, source, document, until }));
     if (refused)
         return refused;
-    const born = await bornAt(context, dir, name), root = rootIn(context, dir);
+    const born = await bornAt(context, dir, name), root = await rootIn(context, dir);
     if (born[0] !== say('born', { name, dir }) || 'said' in root)
         return 'said' in root ? [...born, ...root.said] : born;
     const connected = await then(dir, true), unread = connected.some((l) => l.startsWith('said/head/document-unread ')), held = unread ? undefined : await context.policy(dir);

package/dist/src/onboard/owed.js

@@ -15,7 +15,7 @@ export const paidIn = async (asked, context, place) => {
     const owed = 'said' in held ? undefined : held.lines.find((l) => l.scope === scope && l.role === 'demands' && l.value !== 'withdraw');
     if (owed === undefined)
         return { said: [], answer: true };
-    const document = owed.value ?? '', read = await context.files.read.documentOf(context, place, document), root = rootIn(context, place);
+    const document = owed.value ?? '', read = await context.files.read.documentOf(context, place, document), root = await rootIn(context, place);
     if ('said' in root)
         return { said: root.said, answer: false };
     if (read === undefined)

package/dist/src/places/admit.js

@@ -15,7 +15,7 @@ export const admitted = (asked, context) => inPlace(asked, context, async (place
     const key = (asked['key'] ?? '').split('\n').map((line) => parse(line.trim())).flatMap((got) => (got.kind === 'fact' && got.value.fields['measure'] === 'public-key' ? [got.value.fields['value'] ?? ''] : []))[0];
     if (!name || !key)
         return [say('no-key')];
-    const [root, held] = [rootIn(context, place), await standingOr(context, place, context.policy)];
+    const [root, held] = [await rootIn(context, place), await standingOr(context, place, context.policy)];
     if ('said' in root)
         return root.said;
     if ('said' in held)

package/dist/src/places/found.js

@@ -14,6 +14,8 @@ const birthOf = (lock, root, head, person, place, mine = `${valueOf(lock, 'found
 ];
 /** A place founded in a folder: a root key made in the keychain under the place's name — never a file — the birth lines written, and the first land signed by that root. */
 const founded = async (context, dir, name) => {
+    if (context.files.has(dir, LOCK) || context.files.has(dir, '.bound'))
+        return { refused: 'place-exists' };
     const account = fill(valueOf(context.lock, 'founding/root-account'), { place: name });
     const [head, person] = [deviceKey(context, 'head'), deviceKey(context, 'person')];
     if (head === undefined || person === undefined)
@@ -37,7 +39,7 @@ export const bornPlace = async (asked, context) => {
     if (!isAbsolute(dir))
         return [say('place-absolute')];
     const name = (asked['name'] || basename(dir)).toLowerCase().replace(/[^a-z0-9-]+/g, '-');
-    if (context.files.has(dir, LOCK))
+    if (context.files.has(dir, LOCK) || context.files.has(dir, '.bound'))
         return [say('place-exists', { dir })];
     const refused = await unless(context, say('elicit-place', { name, dir }));
     return refused ?? bornAt(context, dir, name);

package/dist/src/ports/adapters/bundle.d.ts

@@ -0,0 +1,44 @@
+import { type Recipe, type Source } from '../../core/composition.ts';
+export interface Member {
+    readonly path: string;
+    readonly bytes: number;
+    readonly digest: string;
+}
+export interface Runtime {
+    readonly protocol: 'head-runtime-closure@1';
+    readonly files: readonly Member[];
+    readonly bytes: number;
+}
+export interface BundlePort {
+    readonly runtime: Uint8Array;
+    readonly expected: string;
+    readonly take: (path: string) => Uint8Array | undefined;
+    readonly profile: Uint8Array;
+}
+export interface Payload {
+    readonly recipe: Recipe;
+    readonly sources: readonly Source[];
+    readonly files: ReadonlyMap<string, Uint8Array>;
+}
+/** Only the host's pinned public runtime closure is copied. A recipe never supplies executable paths, environment or grants. */
+export declare function bundle(port: BundlePort, payload: Payload | undefined, budget: {
+    readonly bytes: number;
+    readonly selections: number;
+    readonly milliseconds: number;
+    readonly printed: number;
+}, signal?: AbortSignal): Promise<{
+    bytes: NonSharedBuffer;
+    digest: string;
+    sources: string[];
+}>;
+/** A host provisioned closure, pinned by Head's own profile. Never discover an arbitrary node_modules tree or fetch code here. */
+export declare function bundleAt(root: string, lock: readonly import('../../core/lock.ts').Said[], payload: Payload | undefined, signal?: AbortSignal): Promise<{
+    bytes: NonSharedBuffer;
+    digest: string;
+    sources: string[];
+}>;
+/** A bounded snapshot of installed public members, never arbitrary files or symlink targets. */
+export declare function publicAt(root: string, budget: number): {
+    root: string;
+    read: (path: string) => Uint8Array | undefined;
+};

package/dist/src/ports/adapters/bundle.js

@@ -0,0 +1,173 @@
+import { createHash } from 'node:crypto';
+import { mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync, lstatSync, realpathSync, openSync, closeSync, fstatSync, readSync, constants } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { dirname, join } from 'node:path';
+import { VERSIONED_MANIFEST_SCHEMAS } from '@anthropic-ai/mcpb';
+import { createRequire } from 'node:module';
+import { spawned } from "../process.js";
+import { compose } from "../../core/composition.js";
+const digest = (bytes) => `sha256:${createHash('sha256').update(bytes).digest('hex')}`;
+const safe = (path) => /^[A-Za-z0-9_@.+/-]+$/.test(path) && path.split('/').every(part => part !== '' && part !== '.' && part !== '..');
+/** Only the host's pinned public runtime closure is copied. A recipe never supplies executable paths, environment or grants. */
+export async function bundle(port, payload, budget, signal) {
+    signal?.throwIfAborted();
+    if (Object.values(budget).some(n => !Number.isSafeInteger(n) || n < 1))
+        throw Error('bundle/budget');
+    if (digest(port.runtime) !== port.expected)
+        throw Error('bundle/runtime-digest');
+    const runtime = JSON.parse(new TextDecoder().decode(port.runtime));
+    if (runtime.protocol !== 'head-runtime-closure@1' || !Array.isArray(runtime.files) || !runtime.files.length || !Number.isSafeInteger(runtime.bytes) || runtime.bytes < 1)
+        throw Error('bundle/runtime');
+    const files = new Map();
+    let size = 0;
+    for (const member of runtime.files) {
+        if (!safe(member.path) || !/^(dist\/src\/|node_modules\/|package\.json$|LICENSE$)/.test(member.path) || files.has(member.path))
+            throw Error('bundle/runtime-path');
+        const bytes = port.take(member.path);
+        if (!bytes || bytes.byteLength !== member.bytes || digest(bytes) !== member.digest)
+            throw Error('bundle/runtime-member');
+        files.set(member.path, bytes);
+        size += bytes.byteLength;
+    }
+    if (size !== runtime.bytes || !files.has('dist/src/index.js') || !files.has('package.json') || !files.has('LICENSE'))
+        throw Error('bundle/runtime-closure');
+    files.set('runtime.bundle.json', port.runtime).set('TARGET.bound', port.profile).set('.mcpbignore', Buffer.from('!**\n*.mts\n*changelog*\n.env*\n.git/\n.bound/\nbirth.bound\n'));
+    let manifest = { manifest_version: '0.3', name: 'head', version: JSON.parse(new TextDecoder().decode(files.get('package.json'))).version, description: 'Head without connected sources', author: { name: 'Package author' } };
+    if (payload) {
+        const made = compose(payload.recipe, payload.sources, budget.selections);
+        let publicBytes = made.bytes.byteLength;
+        for (const [path, bytes] of payload.files) {
+            if (!safe(path) || /(^|\/)(\.bound|\.git|birth\.bound|node_modules)(\/|$)/.test(path))
+                throw Error('bundle/public-path');
+            publicBytes += bytes.byteLength;
+            if (publicBytes > budget.bytes)
+                throw Error('bundle/public-budget');
+            files.set(`composition/${path}`, bytes);
+        }
+        if (!payload.files.has('TARGET.bound'))
+            throw Error('bundle/public-lock');
+        files.set('composition/selection.json', made.bytes);
+        manifest = { ...manifest, name: payload.recipe.id, version: payload.recipe.revision, display_name: payload.recipe.title, description: payload.recipe.description };
+    }
+    manifest = { ...manifest, server: { type: 'node', entry_point: 'dist/src/index.js', mcp_config: { command: 'node', args: ['${__dirname}/dist/src/index.js', 'run'] } }, compatibility: { platforms: ['darwin'], runtimes: { node: '>=22.18' } } };
+    VERSIONED_MANIFEST_SCHEMAS['0.3'].parse(manifest);
+    files.set('manifest.json', Buffer.from(JSON.stringify(manifest, null, 2) + '\n'));
+    const temporary = mkdtempSync(join(tmpdir(), 'head-export-'));
+    try {
+        const stage = join(temporary, 'package'), output = join(temporary, 'package.mcpb');
+        for (const [path, bytes] of files) {
+            signal?.throwIfAborted();
+            const at = join(stage, path);
+            mkdirSync(dirname(at), { recursive: true });
+            writeFileSync(at, bytes);
+        }
+        const cli = join(dirname(createRequire(import.meta.url).resolve('@anthropic-ai/mcpb')), 'cli/cli.js');
+        const result = await spawned(process.execPath, [cli, 'pack', stage, output], { cwd: temporary, env: { PATH: dirname(process.execPath), HOME: temporary, TMPDIR: temporary } }, { wait: budget.milliseconds, most: budget.printed, ...(signal ? { signal } : {}) });
+        if (result.code !== 0)
+            throw Error('bundle/pack');
+        signal?.throwIfAborted();
+        const bytes = readFileSync(output);
+        return { bytes, digest: digest(bytes), sources: payload?.recipe.sources.map(source => source.source) ?? [] };
+    }
+    finally {
+        rmSync(temporary, { recursive: true, force: true });
+    }
+}
+/** A host provisioned closure, pinned by Head's own profile. Never discover an arbitrary node_modules tree or fetch code here. */
+export async function bundleAt(root, lock, payload, signal) {
+    const { valueOf } = await import("../../core/lock.js");
+    const expected = valueOf(lock, 'dep/runtime-bundle');
+    if (!/^sha256:[a-f0-9]{64}$/.test(expected))
+        throw Error('bundle/runtime-unavailable');
+    const packages = new Map();
+    const take = (path) => {
+        try {
+            return readFileSync(join(root, path));
+        }
+        catch { /* Resolve only the package paths selected by the pinned inventory. */ }
+        try {
+            let rest = path, from = createRequire(join(root, 'package.json')), at = root;
+            while (rest.startsWith('node_modules/')) {
+                const parts = rest.slice(13).split('/'), count = parts[0].startsWith('@') ? 2 : 1, name = parts.slice(0, count).join('/');
+                const key = at + '\0' + name, cached = packages.get(key);
+                if (cached)
+                    at = cached;
+                else {
+                    try {
+                        at = dirname(from.resolve(name + '/package.json'));
+                    }
+                    catch {
+                        at = dirname(from.resolve(name));
+                        while (true) {
+                            try {
+                                if (JSON.parse(readFileSync(join(at, 'package.json'), 'utf8')).name === name)
+                                    break;
+                            }
+                            catch { }
+                            const parent = dirname(at);
+                            if (parent === at)
+                                throw Error('bundle/runtime-member');
+                            at = parent;
+                        }
+                    }
+                    packages.set(key, at);
+                }
+                from = createRequire(join(at, 'package.json'));
+                rest = parts.slice(count).join('/');
+            }
+            return path.startsWith('node_modules/') ? readFileSync(join(at, rest)) : undefined;
+        }
+        catch {
+            return undefined;
+        }
+    };
+    return bundle({ runtime: readFileSync(join(root, 'runtime.bundle.json')), expected, take, profile: readFileSync(join(root, 'TARGET.bound')) }, payload, { bytes: Number(valueOf(lock, 'share/bundle-bytes').split('..')[1]), selections: Number(valueOf(lock, 'share/bundle-selections').split('..')[1]), milliseconds: Number(valueOf(lock, 'bound/wait').split('..')[1]), printed: Number(valueOf(lock, 'bound/printed').split('..')[1]) }, signal);
+}
+/** A bounded snapshot of installed public members, never arbitrary files or symlink targets. */
+export function publicAt(root, budget) {
+    if (!Number.isSafeInteger(budget) || budget < 1)
+        throw Error('bundle/budget');
+    const base = realpathSync(root), held = new Map();
+    let consumed = 0;
+    return { root: base, read: (path) => {
+            if (!safe(path) || !(path === 'manifest.json' || path.startsWith('composition/')))
+                throw Error('bundle/public-path');
+            if (held.has(path))
+                return held.get(path);
+            try {
+                let at = base;
+                for (const part of path.split('/')) {
+                    at = join(at, part);
+                    if (lstatSync(at).isSymbolicLink())
+                        throw Error('bundle/public-path');
+                }
+                const fd = openSync(at, constants.O_RDONLY | constants.O_NOFOLLOW);
+                try {
+                    const stat = fstatSync(fd);
+                    if (!stat.isFile() || stat.size > budget - consumed)
+                        throw Error('bundle/public-budget');
+                    const bytes = Buffer.alloc(stat.size);
+                    let offset = 0;
+                    while (offset < bytes.length) {
+                        const count = readSync(fd, bytes, offset, bytes.length - offset, null);
+                        if (!count)
+                            throw Error('bundle/public-member');
+                        offset += count;
+                    }
+                    if (readSync(fd, Buffer.alloc(1), 0, 1, null))
+                        throw Error('bundle/public-budget');
+                    consumed += bytes.length;
+                    held.set(path, bytes);
+                    return bytes;
+                }
+                finally {
+                    closeSync(fd);
+                }
+            }
+            catch (error) {
+                if (error.code === 'ENOENT')
+                    return undefined;
+                throw error;
+            }
+        } };
+}

package/dist/src/ports/adapters/configured.d.ts

@@ -0,0 +1,35 @@
+import { type ConfiguredSource, type Tool } from './mcp.ts';
+import type { Asked, Context } from '../../core/answer.ts';
+import type { Said } from '../../core/lock.ts';
+import { vocabOf } from '../../core/read.ts';
+export declare const configuredProtocol: Readonly<{
+    id: "mcp";
+    sourceNeeded: "bundle-mcp-needed";
+    invoke: "elicit-mcp-call";
+    failurePrefix: "mcp/";
+    toolFailure: "mcp/tool";
+    connection: (bytes: Uint8Array, source: string, overlay: boolean, v: Pick<ReturnType<typeof vocabOf>, "offers" | "class">) => {
+        worlds: string[];
+        verify: (lines: readonly Said[]) => void;
+    } | undefined;
+}>;
+export interface ConfiguredDocument {
+    readonly protocol: 'head-configured-mcp-document@1';
+    readonly configuration: ConfiguredSource;
+    readonly tools: readonly Tool[];
+    readonly resource: string;
+}
+/** The public document remains input to the published MCP interpreter. Host metadata supplies transport, never an offer class. */
+export declare function configuredDocument(bytes: Uint8Array): ConfiguredDocument | undefined;
+export declare const configuredBytes: (configuration: ConfiguredSource, tools: readonly Tool[]) => Uint8Array;
+/** Fresh source bytes must be covered by the compiled reading before retained results or a network request can be used. */
+export declare function configuredAt(context: Context, place: string, source: string, lines: readonly Said[]): ConfiguredSource | undefined;
+/** Discovery is explicitly selected by the consumer; there is no automatic protocol guessing or network on package inspection. */
+export declare function discoverConfigured(context: Context, asked: Asked, source: string): Promise<{
+    bytes: Uint8Array<ArrayBufferLike>;
+    kind: string;
+}>;
+/** The same safe, named refusal is used at connect and call, without printing transport exceptions or credentials. */
+export declare const configuredRefusal: (context: Context, error: unknown) => string[];
+/** Verify public configured inputs at inspection, and require an exact compiled operation mapping; never guess tool names. */
+export declare const configuredPackage: (_context: Context, files: ReadonlyMap<string, Uint8Array | undefined>) => ConfiguredDocument[];

package/dist/src/ports/adapters/configured.js

@@ -0,0 +1,67 @@
+import { configuredSource, fingerprint } from "./mcp.js";
+import { valueOf } from "../../core/lock.js";
+import { fieldsOf, vocabOf } from "../../core/read.js";
+import { digestIn } from "../../core/worlds.js";
+import { sayIn } from "../../core/surface.js";
+export const configuredProtocol = Object.freeze({ id: 'mcp', sourceNeeded: 'bundle-mcp-needed', invoke: 'elicit-mcp-call', failurePrefix: 'mcp/', toolFailure: 'mcp/tool',
+    connection: (bytes, source, overlay, v) => { const doc = configuredDocument(bytes); if (!doc)
+        return undefined; if (doc.configuration.name !== source || overlay)
+        throw Error('mcp/document'); return { worlds: ['topos-mcp'], verify: (lines) => { if (doc.configuration.offers.some(name => !lines.some(l => l.scope === `${v.offers}/${source}/${name}` && l.measure === v.class)))
+            throw Error('mcp/tool-mapping'); } }; }
+});
+/** The public document remains input to the published MCP interpreter. Host metadata supplies transport, never an offer class. */
+export function configuredDocument(bytes) {
+    let doc;
+    try {
+        doc = JSON.parse(Buffer.from(bytes).toString());
+    }
+    catch {
+        return undefined;
+    }
+    if (doc?.protocol !== 'head-configured-mcp-document@1')
+        return undefined;
+    if (Object.keys(doc).sort().join('|') !== 'configuration|protocol|resource|tools' || !Array.isArray(doc.tools))
+        throw Error('mcp/document');
+    const configuration = configuredSource(doc.configuration);
+    if (doc.resource !== configuration.endpoint || doc.tools.some((t) => !t || typeof t.name !== 'string' || t.inputSchema?.type !== 'object')
+        || new Set(doc.tools.map((t) => t.name)).size !== doc.tools.length || fingerprint(doc.tools).digest !== configuration.catalogue
+        || configuration.offers.some(name => !doc.tools.some((t) => t.name === name)))
+        throw Error('mcp/document');
+    return { protocol: doc.protocol, configuration, tools: doc.tools, resource: doc.resource };
+}
+export const configuredBytes = (configuration, tools) => {
+    const bytes = Buffer.from(JSON.stringify({ protocol: 'head-configured-mcp-document@1', configuration, tools, resource: configuration.endpoint }) + '\n');
+    configuredDocument(bytes);
+    return bytes;
+};
+/** Fresh source bytes must be covered by the compiled reading before retained results or a network request can be used. */
+export function configuredAt(context, place, source, lines) {
+    const laid = context.files.read.laidOf(context, place, source).filter(([path]) => !path.includes('.overlay.'));
+    const docs = laid.map(([path, bytes]) => ({ path, bytes, doc: configuredDocument(bytes) })).filter(one => one.doc);
+    if (!docs.length) {
+        if (lines.some(l => l.scope?.startsWith(`offers/${source}/`) && l.measure === 'declares' && ['read-only', 'unhinted', 'destructive'].includes(l.value ?? '')))
+            throw Error('mcp/document-pin');
+        return undefined;
+    }
+    const v = vocabOf(context.lock);
+    if (docs.length !== 1 || docs[0].doc.configuration.name !== source || !(fieldsOf(lines, `${v.region}/${source}`)[valueOf(context.lock, 'vocab/documents')] ?? []).includes(digestIn(context.lock)(docs[0].bytes)))
+        throw Error('mcp/document-pin');
+    return docs[0].doc.configuration;
+}
+/** Discovery is explicitly selected by the consumer; there is no automatic protocol guessing or network on package inspection. */
+export async function discoverConfigured(context, asked, source) {
+    if (!context.remote || !source || !/^[a-z][a-z0-9-]*$/.test(source))
+        throw Error('mcp/unavailable');
+    const endpoint = asked['document'] ?? '', url = new URL(endpoint);
+    if (url.protocol !== 'https:' || url.username || url.password || url.search || url.hash || url.href !== endpoint)
+        throw Error('mcp/endpoint');
+    if (asked['via'])
+        throw Error('mcp/discovery-access-unsupported');
+    const read = await (await context.remote()).discover(endpoint);
+    const configuration = configuredSource({ protocol: 'head-configured-mcp@1', name: source, endpoint, catalogue: read.digest, offers: read.tools.map(tool => tool.name) });
+    return { bytes: configuredBytes(configuration, read.tools), kind: 'json' };
+}
+/** The same safe, named refusal is used at connect and call, without printing transport exceptions or credentials. */
+export const configuredRefusal = (context, error) => [sayIn(context.lock)('mcp-refused', { why: error instanceof Error && /^mcp\/[a-z-]+$/.test(error.message) ? error.message : 'mcp/transport' })];
+/** Verify public configured inputs at inspection, and require an exact compiled operation mapping; never guess tool names. */
+export const configuredPackage = (_context, files) => [...files].flatMap(([path, bytes]) => { const doc = bytes && path.endsWith('.json') ? configuredDocument(bytes) : undefined; return doc ? [doc] : []; });