aontu 0.63.0 → 0.65.0

package/src/cli.ts

@@ -17,25 +17,35 @@ import {
   hcanon, canonHash,
   get, why, patch, agentsMd,
   allow,
-  render,
-  renderProfile,
+  loadProfile,
 } from './aontu'
 import type { AllowDecision, AllowReport, AllowVerdict } from './allow'
-import type { RenderCoverage, RenderReport } from './render'
+import { traceRun } from './trace'
 import {
   desugarTemplate, resugarTemplate, templateOutputs, markerFor,
   markerFromProfiles,
 } from './template'
-import { outsideRoot } from './mcp'
 import { sarifReport } from './report-sarif'
 import { main as lspMain } from './lsp-server'
 import { main as mcpMain } from './mcp-server'
 import { jsonSchema } from './jsonschema'
-import { modTidy, modVerify, modVendor, modManifest } from './mod-tool'
+import {
+  pkgTidy, pkgVerify, pkgVendor, pkgManifest, pkgRefreeze, pkgTree,
+  versionCompare,
+} from './pkg'
+import {
+  pkgSync, pkgGet, pkgRemove, pkgWhy, pkgPublish, pkgOutdated, startServe,
+  defaultHttp, keygen, PUBLISH_PATH,
+} from './pkg-net'
 import type {
-  ModTidyReport, ModVerifyReport, ModVendorReport, ModManifestReport,
-} from './mod-tool'
-import { modCacheDir } from './mod'
+  PkgSyncReport, PkgChangeReport, PkgWhyReport, PkgPublishReport,
+  PkgOutdatedReport, Served, PkgHttp,
+} from './pkg-net'
+import type {
+  PkgTidyReport, PkgVerifyReport, PkgVendorReport, PkgManifestReport,
+  PkgRefreezeReport, PkgTreeReport, PkgToolOptions,
+} from './pkg'
+import { modCacheDir, PKG_FILE, LOCK_FILE, META_DIR } from './mod'
 import { VET_MAX_ERRORS } from './vet'
 import type {
   VetReport, VetFinding, VetVerdict, VetCoverage,
@@ -83,16 +93,23 @@ const HELP = `Usage: aontu [options] [file]
        aontu view <kind> [options] <file>...
        aontu view --views <path> [--check] [options] <file>
        aontu jsonschema [--at <path>] [--strict] [options] <file>
-       aontu render [--at <path>] [--profile <file>]... [--unit <path>]
-                    [--stdout | --out <dir> | --check <dir> | --coverage]
-                    [--coverage-at <path>] [--strict] <file>
        aontu template [--resugar] [--check] [--marker <token>]
                       [--profile <file>] <file>
+       aontu trace [--at <path>] [--format json] [--marker <token>]
+                   [--profile <file>] <file>
        aontu hash [options] <file>
-       aontu mod tidy|verify|vendor|manifest [options] [dir]
-       aontu get <path> [options] <file>
-       aontu why <path> [options] <file>
-       aontu set <path>=<value>... --entry <file> --overlay <file>
+       aontu sync [--frozen] [options] [dir]
+       aontu add <pkg>[@<version>] [options] [dir]
+       aontu get <pkg>[@<version>] [options] [dir]
+       aontu remove <pkg> [options] [dir]
+       aontu why <pkg> [options] [dir]
+       aontu publish [--yes] [--to <dir>] [options] [dir]
+       aontu pkg tidy|verify|vendor|manifest|refreeze|tree|outdated|serve
+                 [options] [dir]
+       aontu pkg keygen <file>
+       aontu model get <path> [options] <file>
+       aontu model why <path> [options] <file>
+       aontu model set <path>=<value>... --entry <file> --overlay <file>
        aontu allow --role <role> [--at <path>] <roles-file> <path>...
        aontu agentsmd [--write <AGENTS.md>] [--depth <n>] <file>
        aontu fmt [-w|-l|--check|-d|--lint] [--marker <token>]
@@ -161,18 +178,57 @@ Options:
                   named format keeps its meaning, and .js stays
                   refused. Every verb takes it
 
-Mod options:
+Package verbs (a module is imported; a package is published):
+  sync      Make the project correct: resolve by minimum version
+            selection, fetch what is missing, write aontu_meta/pkg-lock.aon,
+            vendor, verify. --frozen refuses to change the lockfile
+  add       Take on a dependency the project does not have, then sync;
+            refuses one it has and names get
+  get       Add a dependency or raise its minimum, then sync. Without a
+            version, the newest version outside the cooldown
+  remove    Drop a dependency, then sync
+  why       Why is this package in the closure: every path of
+            requirements that reaches it
+  publish   Publish this package. A dry run without --yes; --to <dir>
+            writes the repository layout into a directory instead
+
+Package options:
   --format <f>    text (default) or json
-  --against <dir> manifest: a prior version's module tree, to gate on
-
-Mod subcommands:
-  tidy      Resolve the module closure by minimum version selection and
-            rewrite aontu_meta/mod-lock.aon in canonical form
-  verify    Check every locked module still means what the lockfile
-            pins, and change nothing (the CI gate; tidy rewrites)
+  --frozen        sync: fail if the lockfile would change (the CI mode)
+  --yes           publish: send it (the default is a dry run)
+  --to <dir>      publish: write the read-path layout into a directory
+  --key <file>    publish: the Ed25519 private key (PKCS#8 PEM) that
+                  signs the manifest, for the key provider
+  --token <file>  publish: the forge's OIDC token, read from a file
+  --base <url>    the repository to read from (repeatable; overrides
+                  pkg.aon repo.base)
+  --write <url>   publish: the write path (overrides pkg.aon repo.write)
+  --against <dir> manifest: a prior version's tree, to gate on
+  --upstream <u>  serve: fetch on miss from this repository (repeatable)
+  --listen <a>    serve: the address to listen on (default 127.0.0.1:8017)
+
+pkg subcommands (the rest of the package operations):
+  tidy      Resolve the closure by minimum version selection and
+            rewrite aontu_meta/pkg-lock.aon in canonical form
+  verify    Check every locked package still is and still means what
+            the lockfile pins, bytes before meaning, and change nothing
+            (the CI gate; tidy rewrites)
   vendor    Materialise the locked closure into aontu_meta/vendor/
-  manifest  Print the OCI artifact a publish would push, gated on the
-            breaking check against --against
+  manifest  Print the manifest a publish would send, gated on the
+            compatibility check against --against
+  refreeze  Recompute every canon pin and nothing else, after a
+            canonical-form change in the engine
+  tree      The locked closure as a graph
+  outdated  What could move, and what would move with it
+  serve     Serve a repository directory; with --upstream, a caching
+            proxy in front of another repository
+  keygen    Write a new Ed25519 signing key (PKCS#8 PEM) to a file,
+            once, and print the signer id a consumer names
+
+model subcommands (one document, interrogated or edited):
+  get       What the document says at a path
+  why       Every contribution to the value at a path
+  set       Append a path-flattened conjunct to an overlay
 
 Vet options:
   --at <path>       Validate against this path of the schema ($.a.b)
@@ -251,21 +307,21 @@ Hash options:
 Hash exit codes: 0 hashed, 2 usage, 4 the document does not stand up
 on its own.
 
-Get options:
+Model get options:
   -c, --canon     Canonical-form fragment (default: generated JSON)
   --keys          Keys at the node, one per line
   --types         Shape view: concrete leaves lifted to their kinds
   --depth <n>     Structure to depth n; deeper nodes render as top
   --format <f>    text (default) or json
 
-Get exit codes: 0 rendered, 1 the path names nothing, 2 usage, 4 the
-document does not stand up on its own.
+Model get exit codes: 0 rendered, 1 the path names nothing, 2 usage, 4
+the document does not stand up on its own.
 
-Why options:
+Model why options:
   --format <f>    text (default) or json
 
-Why exit codes mirror get's: 0 explained, 1 the path names nothing,
-2 usage, 4 the document does not stand up on its own.
+Model why exit codes mirror get's: 0 explained, 1 the path names
+nothing, 2 usage, 4 the document does not stand up on its own.
 
 View kinds: doc, lattice, tree, matrix, graph, layer, sets, layers,
 ladder, poset (the poset takes several files). The figure goes to stdout, the loss
@@ -333,37 +389,11 @@ View exit codes: 0 rendered, 1 --check mismatch or lossy under
 --strict, 2 usage or --max-rows exceeded, 4 the document does not stand
 up on its own, or a relation, root or path that names nothing.
 
-Render options:
-  --at <path>       Render the value at this path ($.a.b); the root by
-                    default
-  --profile <file>  A profile document, aontu: render: Lang: {lang,
-                    ...}, vetted against aontu:render; repeatable,
-                    one per language
-  --unit <path>     Render only the unit with this path
-  --stdout          One unit's bytes and nothing else (with --unit when
-                    the instance has several)
-  --out <dir>       Write every unit below dir, or nothing; never deletes
-  --check <dir>     Compare every unit with dir/<path>; drift is listed
-  --coverage        Report what the render read and what it did not:
-                    model paths no output consumed, and rendered
-                    declarations no rule produced. Writes nothing
-  --coverage-at <p> Measure coverage under this path only, instead of
-                    the document root
-  --strict          Refuse the opaque escapes (a text declaration, a raw
-                    block)
-  --format <f>      text (default) or json, the whole report; json
-                    carries the dispatch trace, one entry per emitted
-                    piece
-
-Render exit codes: 0 rendered, 1 lossy under --strict or drift under
---check, 2 usage or I/O (a refused unit path included), 4 the document
-does not stand up or the instance is not aontu:code.
-
-A render entry file whose extension is not .aon is a TEMPLATE: a
-generator in the target's own syntax, whose marker lines carry aontu
-and whose other lines are output. It is desugared before it is
-evaluated, and a language the table does not know names its marker with
---marker, or declares it once in a profile file that --profile reads.
+A template entry file whose extension is not .aon is a GENERATOR: a
+document in the target's own syntax, whose marker lines carry aontu and
+whose other lines are output. It is desugared before it is evaluated,
+and a language the table does not know names its marker with --marker,
+or declares it once in a profile file that --profile reads.
 
 Template options:
   --resugar       The file is the canonical aontu; print the template
@@ -381,7 +411,7 @@ every other line is a line of output.
 
 Template exit codes: 0 written, 1 --check drift, 2 usage or I/O.
 
-Set options:
+Model set options:
   --entry <file>    The document the change is checked against
   --overlay <file>  The file the change is appended to (created if
                     absent; not written when the change does not hold)
@@ -397,7 +427,7 @@ Set options:
   --format <f>      text (default) or json
 
 Set exit codes are vet's verdict classes: 0 valid, 1 invalid (the
-change contradicts a pinned value -- aontu why locates it, and
+change contradicts a pinned value -- aontu model why locates it, and
 --in-place rewrites it), 2 usage, 3 incomplete, 4 the entry does not
 stand up on its own.
 
@@ -473,11 +503,11 @@ Fmt options:
 The fmt verb prints one document in the agreed form; with no file it
 reads standard input. Several files need one of the options above.
 
-A file whose extension is not .aon is a GENERATOR, as it is for render:
-the aontu its marker lines carry is formatted, the marker stands at the
-left margin with the aontu indented after it, and every line of output
-is held on a line of its own. A file with no marker line in it is
-another language's, and is refused.
+A file whose extension is not .aon is a GENERATOR, as it is for
+template: the aontu its marker lines carry is formatted, the marker
+stands at the left margin with the aontu indented after it, and every
+line of output is held on a line of its own. A file with no marker line
+in it is another language's, and is refused.
 
 Fmt exit codes: 0 formatted or clean, 1 a --check file would change or
 a --strict finding, 2 usage, 4 a document does not parse.
@@ -630,7 +660,7 @@ function trustOpts(trust: TrustArg, entryRoot: string): any {
 }
 
 
-function takeTrust(argv: string[]):
+function takeTrust(argv: string[], io: Io = PROCESS_IO):
   { argv: string[], trust: TrustArg } | undefined {
   const rest: string[] = []
   let trust: TrustArg = { kind: 'system-warn', textExt: [] }
@@ -640,7 +670,7 @@ function takeTrust(argv: string[]):
     if ('--trust' === arg) {
       const parsed = null == argv[i + 1] ? undefined : parseTrustArg(argv[++i])
       if (null == parsed) {
-        process.stderr.write(
+        io.err(
           'aontu: --trust needs system, none, or root[:dir]\n')
         return undefined
       }
@@ -649,7 +679,7 @@ function takeTrust(argv: string[]):
     else if ('--include-root' === arg) {
       const dir = argv[++i]
       if (null == dir) {
-        process.stderr.write('aontu: --include-root needs a directory\n')
+        io.err('aontu: --include-root needs a directory\n')
         return undefined
       }
       trust = { kind: 'root', dir, textExt }
@@ -657,7 +687,7 @@ function takeTrust(argv: string[]):
     else if ('--text-ext' === arg) {
       const list = null == argv[i + 1] ? undefined : parseTextExt(argv[++i])
       if (null == list) {
-        process.stderr.write(
+        io.err(
           'aontu: --text-ext needs extensions, without dots' +
           ' (--text-ext md,sql)\n')
         return undefined
@@ -673,7 +703,7 @@ function takeTrust(argv: string[]):
 
 
 // `md,sql` or `.md,.sql` -- the dot is accepted and dropped, because a
-// reader who has just written `@"notes.txt"` reaches for one. An empty
+// reader who has just written `@"./notes.txt"` reaches for one. An empty
 // element, or anything that is not an extension, is a usage error
 // rather than a silently ignored word: a flag that quietly does
 // nothing is how a document ends up refused with no reason visible.
@@ -2077,102 +2107,186 @@ const VIEW_USAGE_CODES = [
   'view_document_shape', 'view_style_profile', 'view_style_unknown',
 ]
 
-const MOD_HELP = 'aontu mod tidy|verify|vendor|manifest [dir] (try --help)'
+const PKG_HELP =
+  'aontu pkg tidy|verify|vendor|manifest|refreeze|tree|outdated|serve [dir] | keygen <file> (try --help)'
 
-function runMod(argv: string[]): number {
-  const rest: string[] = []
-  let format: SubsumeFormat = 'text'
-  let against: string | undefined
+const PKG_SUBS = [
+  'tidy', 'verify', 'vendor', 'manifest', 'refreeze', 'tree', 'outdated',
+  'serve', 'keygen',
+]
 
+// The options every package verb parses, so `sync`, `get`, `publish`
+// and the `pkg` subcommands read one table.
+type PkgArgs = {
+  rest: string[]
+  format: SubsumeFormat
+  against?: string
+  frozen: boolean
+  yes: boolean
+  to?: string
+  key?: string
+  token?: string
+  base: string[]
+  write?: string
+  upstream: string[]
+  listen?: string
+}
+
+function parsePkgArgs(argv: string[], verb: string, io: Io): PkgArgs | undefined {
+  const out: PkgArgs = {
+    rest: [], format: 'text', frozen: false, yes: false, base: [], upstream: [],
+  }
+  const value = (name: string, i: number): string | undefined => {
+    const v = argv[i]
+    if (null == v) {
+      io.err(`aontu: ${name} needs a value\n`)
+    }
+    return v
+  }
   for (let i = 0; i < argv.length; i++) {
     const arg = argv[i]
     if ('-h' === arg || '--help' === arg) {
-      process.stdout.write(HELP)
-      return 0
+      io.out(HELP)
+      return undefined
     }
     if ('--format' === arg) {
       const f = argv[++i]
       if ('text' !== f && 'json' !== f) {
-        process.stderr.write('aontu: --format needs text or json\n')
-        return 2
+        io.err('aontu: --format needs text or json\n')
+        return undefined
       }
-      format = f
+      out.format = f
     }
-    else if ('--against' === arg) {
-      const a = argv[++i]
-      if (null == a) {
-        process.stderr.write('aontu: --against needs a module directory\n')
-        return 2
+    else if ('--frozen' === arg) {
+      out.frozen = true
+    }
+    else if ('--yes' === arg) {
+      out.yes = true
+    }
+    else if ('--against' === arg || '--to' === arg || '--key' === arg ||
+      '--token' === arg || '--write' === arg || '--listen' === arg) {
+      const v = value(arg, ++i)
+      if (null == v) {
+        return undefined
+      }
+      out['--against' === arg ? 'against' : '--to' === arg ? 'to' :
+        '--key' === arg ? 'key' : '--token' === arg ? 'token' :
+          '--write' === arg ? 'write' : 'listen'] = v
+    }
+    else if ('--base' === arg || '--upstream' === arg) {
+      const v = value(arg, ++i)
+      if (null == v) {
+        return undefined
       }
-      against = a
+      out['--base' === arg ? 'base' : 'upstream'].push(v)
     }
     else if (arg.startsWith('-')) {
-      process.stderr.write(`aontu: unknown mod option ${arg} (try --help)\n`)
-      return 2
+      io.err(`aontu: unknown ${verb} option ${arg} (try --help)\n`)
+      return undefined
     }
     else {
-      rest.push(arg)
+      out.rest.push(arg)
     }
   }
+  return out
+}
 
-  const sub = rest[0]
-  const dir = rest[1] ?? '.'
 
-  if ('get' === sub || 'publish' === sub) {
-    process.stderr.write(
-      'aontu: mod ' + sub + ' needs a registry client, which this build ' +
-      'does not ship; vendor the module by hand and run ' +
-      "'aontu mod tidy'\n")
+// A verb that finds the older layout names the current one, once, and
+// reads nothing from it.
+function nameOldLayout(dir: string, io: Io): void {
+  const old = ['aon_vendor', 'mod-lock.aon', 'mod.aon',
+    join(META_DIR, 'mod-lock.aon')].filter((f) => existsSync(join(dir, f)))
+  if (0 < old.length) {
+    io.err(
+      'aontu: ' + old.join(', ') + ' belong to an older layout: the package ' +
+      'file is ' + PKG_FILE + ', the lockfile ' + join(META_DIR, LOCK_FILE) +
+      ' and the vendor tree ' + join(META_DIR, 'vendor') + '; rename ' +
+      PKG_FILE + '\'s `mod` block to `pkg`, then run aontu sync\n')
+  }
+}
+
+
+function runPkg(argv: string[], servers: Servers): number | Promise<number> {
+  const io = servers.io ?? PROCESS_IO
+  const trusted = takeTrust(argv, io)
+  if (null == trusted) {
     return 2
   }
+  const args = parsePkgArgs(trusted.argv, 'pkg', io)
+  if (null == args) {
+    return '-h' === trusted.argv[0] || trusted.argv.includes('--help') ? 0 : 2
+  }
+  const trust = trusted.trust
+  const sub = args.rest[0]
+  const dir = args.rest[1] ?? '.'
 
-  if (!MOD_SUBS.includes(sub) || 2 < rest.length) {
-    process.stderr.write(
-      `aontu: mod needs tidy, verify, vendor or manifest\n${MOD_HELP}\n`)
+  if (!PKG_SUBS.includes(sub) || 2 < args.rest.length) {
+    io.err(
+      `aontu: pkg needs one of ${PKG_SUBS.join(', ')}\n${PKG_HELP}\n`)
     return 2
   }
 
-  if (existsSync(join(dir, 'aon_vendor')) || existsSync(join(dir, 'mod-lock.aon'))) {
-    process.stderr.write(
-      'aontu: aon_vendor/ and mod-lock.aon now live under aontu_meta/: ' +
-      'move them, or run aontu mod tidy and aontu mod vendor\n')
+  if ('keygen' === sub) {
+    if (2 !== args.rest.length) {
+      io.err('aontu: pkg keygen needs the file to write\naontu pkg keygen <file>\n')
+      return 2
+    }
+    const made = keygen(args.rest[1])
+    if (null != made.refused) {
+      io.err('aontu: ' + made.refused + '\n')
+      return 2
+    }
+    io.out('signer: ' + made.signer + '\n')
+    return 0
   }
 
-  // `--against` gates a manifest and means nothing to the other two;
+  nameOldLayout(dir, io)
+
+  // `--against` gates a manifest and means nothing to the others;
   // accepting it there would say it had been honoured.
-  if (null != against && 'manifest' !== sub) {
-    process.stderr.write('aontu: --against is a manifest option\n')
+  if (null != args.against && 'manifest' !== sub) {
+    io.err('aontu: --against is a manifest option\n')
     return 2
   }
 
-  const report =
-    'tidy' === sub ? modTidy(dir, modToolOptions()) :
-      'verify' === sub ? modVerify(dir, modToolOptions()) :
-        'vendor' === sub ? modVendor(dir, modToolOptions()) :
-          modManifest(dir, modToolOptions(), against)
+  const opts = pkgToolOptions(trust, resolve(dir))
+
+  if ('outdated' === sub || 'serve' === sub) {
+    return runPkgNet(sub, dir, args, opts, servers, io)
+  }
 
-  process.stdout.write(('json' === format ?
-    exactJSON({ aontu: { version: version(), verb: 'mod ' + sub }, ...report },
+  const report =
+    'tidy' === sub ? pkgTidy(dir, opts) :
+      'verify' === sub ? pkgVerify(dir, opts) :
+        'vendor' === sub ? pkgVendor(dir, opts) :
+          'refreeze' === sub ? pkgRefreeze(dir, opts) :
+            'tree' === sub ? pkgTree(dir, opts) :
+              pkgManifest(dir, opts, args.against)
+
+  io.out(('json' === args.format ?
+    exactJSON({ aontu: { version: version(), verb: 'pkg ' + sub }, ...report },
       2) :
-    modText(sub, report)) + '\n')
+    pkgText(sub, report)) + '\n')
 
-  return MOD_EXIT[report.verdict]
+  return PKG_EXIT[report.verdict]
 }
 
 
-const MOD_SUBS = ['tidy', 'verify', 'vendor', 'manifest']
-
 // The verdict classes: `ok` 0, a refused gate 1, an open question 3, a
 // document that does not stand up 4 -- `subsume`'s classes, because a
 // manifest gate IS a subsumption check and a caller reading exit codes
 // should not have to learn a second table.
-type ModVerdict =
-  ModTidyReport['verdict'] |
-  ModVerifyReport['verdict'] |
-  ModVendorReport['verdict'] |
-  ModManifestReport['verdict']
-
-const MOD_EXIT: Record<ModVerdict, number> = {
+type PkgVerdict =
+  PkgTidyReport['verdict'] |
+  PkgVerifyReport['verdict'] |
+  PkgVendorReport['verdict'] |
+  PkgManifestReport['verdict'] |
+  PkgRefreezeReport['verdict'] |
+  PkgTreeReport['verdict'] |
+  'frozen' | 'refused' | 'sent' | 'dry-run' | 'outdated' | 'current'
+
+const PKG_EXIT: Record<PkgVerdict, number> = {
   ok: 0,
   missing: 1,
   mismatch: 1,
@@ -2180,6 +2294,12 @@ const MOD_EXIT: Record<ModVerdict, number> = {
   // nothing to check, which is a refusal and not a pass.
   unlocked: 1,
   breaking: 1,
+  frozen: 1,
+  refused: 1,
+  outdated: 1,
+  sent: 0,
+  'dry-run': 0,
+  current: 0,
   undecided: 3,
   error: 4,
 }
@@ -2188,11 +2308,16 @@ const MOD_EXIT: Record<ModVerdict, number> = {
 // The tooling's evaluator: the same standalone evaluation the module
 // resolver verifies with (ts/src/mod.ts), and for the same reason —
 // only the engine can say what a module MEANS.
-function modToolOptions() {
+function pkgToolOptions(trust: TrustArg, entryRoot: string): PkgToolOptions {
+  const opts = verbOpts(trust, entryRoot)
+  // The user cache lives outside any confinement root, so a confined
+  // run reads the vendor tree only -- as the evaluator's own module
+  // leg already does when a root is set.
+  const rooted = null != (opts.trust as any)?.include?.root
   return {
-    cache: modCacheDir(),
+    ...(rooted ? {} : { cache: modCacheDir() }),
     eval: (src: string, path: string) => {
-      const a0 = new Aontu()
+      const a0 = new Aontu(opts)
       const ctx = a0.ctx({ collect: true })
       const val: any = a0.unify(src, { path }, ctx)
       return {
@@ -2200,7 +2325,7 @@ function modToolOptions() {
         hash: canonHash(val),
         canon: val.canon,
         // The same question `aontu hash` asks before it will answer:
-        // did this document stand up ON ITS OWN? See ModToolEval.
+        // did this document stand up ON ITS OWN? See PkgToolEval.
         ok: 0 === ctx.err.length && true !== val.isNil,
       }
     },
@@ -2208,19 +2333,54 @@ function modToolOptions() {
 }
 
 
-function modText(sub: string, report: any): string {
+function pkgLockLines(entries: any[]): string[] {
+  return entries.map((e) => e.key + ' ' + e.v + ' ' + e.canon)
+}
+
+// The renderers verify, tidy and sync share, as the Go port's do.
+function pkgMismatchLines(mismatched: any[]): string[] {
+  return mismatched.map((m) => 'canon' === m.pin ?
+    m.key + ': pinned ' + m.want + ' but the store means ' +
+    ('' === m.got ? 'nothing (it does not evaluate)' : m.got) :
+    m.key + ': pinned ' + m.pin + ' ' + m.want + ' but the store holds ' + m.got)
+}
+
+// NOT a fetch: the package may well be sitting in the store. What is
+// absent is the PIN, and only a sync writes one.
+function pkgUnlockedLines(unlocked: string[]): string[] {
+  return unlocked.map((key) => key + ': not in the lockfile (run: aontu sync)')
+}
+
+function pkgForbiddenLines(forbidden: string[]): string[] {
+  return forbidden.map((f) => f + ': not admitted in a package')
+}
+
+
+function pkgText(sub: string, report: any): string {
   const lines = ['verdict: ' + report.verdict]
 
   if ('manifest' === sub) {
-    if ('' !== report.mod) {
-      lines.push(report.mod + ' ' + report.version)
-      lines.push('config: ' + report.config)
-    }
-    for (const key of Object.keys(report.annotations).sort()) {
-      lines.push(key + ': ' + report.annotations[key])
-    }
-    for (const file of report.files) {
-      lines.push('layer: ' + file)
+    const m = report.manifest
+    if (null != m) {
+      lines.push(m.package + ' ' + m.version + ' ' + m.publish)
+      lines.push('archive: ' + m.archive.digest + ' (' + m.archive.files.length +
+        ' files, ' + m.archive.size + ' bytes)')
+      for (const mod of m.modules) {
+        lines.push('module: ' + mod.path + ' ' + mod.main + ' ' + mod.canon)
+      }
+      for (const key of Object.keys(m.deps).sort(cmpCodePoint)) {
+        lines.push('dep: ' + key + ' ' + m.deps[key].v +
+          (null == m.deps[key].pkg ? '' : ' (' + m.deps[key].pkg + ')'))
+      }
+      for (const v of m.retract ?? []) {
+        lines.push('retract: ' + v)
+      }
+      if (null != m.moved) {
+        lines.push('moved: ' + m.moved)
+      }
+      for (const f of m.archive.files) {
+        lines.push('file: ' + f.path + ' ' + f.digest + ' ' + f.size)
+      }
     }
     for (const f of report.findings) {
       lines.push(f.path + ': ' + f.message)
@@ -2228,48 +2388,313 @@ function modText(sub: string, report: any): string {
     for (const miss of report.missing) {
       lines.push(miss + ': missing')
     }
+    lines.push(...pkgForbiddenLines(report.forbidden))
     return lines.join('\n')
   }
 
   if ('verify' === sub) {
-    for (const mod of report.verified) {
-      lines.push(mod + ': verified')
+    for (const key of report.verified) {
+      lines.push(key + ': verified')
+    }
+    lines.push(...pkgMismatchLines(report.mismatched), ...pkgUnlockedLines(report.unlocked))
+    for (const miss of report.missing) {
+      lines.push(miss + ': not fetched (run: aontu sync)')
     }
-    for (const m of report.mismatched) {
-      lines.push(m.mod + ': pinned ' + m.want + ' but the store means ' +
-        ('' === m.got ? 'nothing (it does not evaluate)' : m.got))
+    return lines.join('\n')
+  }
+
+  if ('refreeze' === sub) {
+    for (const r of report.repinned) {
+      lines.push(r.key + ': ' + r.from + ' -> ' + r.to)
     }
-    // NOT a fetch: the module may well be sitting in the store. What
-    // is absent is the PIN, and only a tidy writes one.
-    for (const mod of report.unlocked) {
-      lines.push(mod + ': not in the lockfile (run: aontu mod tidy)')
+    for (const key of report.unchanged) {
+      lines.push(key + ': unchanged')
+    }
+    for (const bad of report.unevaluable) {
+      lines.push(bad + ': does not evaluate on its own; nothing to pin')
     }
     for (const miss of report.missing) {
-      lines.push(miss + ': not fetched (run: aontu mod get)')
+      lines.push(miss + ': not fetched (run: aontu sync)')
     }
     return lines.join('\n')
   }
 
-  const done: any[] = 'tidy' === sub ? report.lock : report.vendored
-  for (const item of done) {
-    lines.push('tidy' === sub ?
-      item.mod + ' ' + item.v + ' ' + item.canon : '' + item)
+  if ('tree' === sub) {
+    const byKey = new Map(report.nodes.map((n: any) => [n.key, n]))
+    const seen = new Set<string>()
+    const walk = (key: string, depth: number): void => {
+      const node: any = byKey.get(key)
+      const again = seen.has(key)
+      seen.add(key)
+      lines.push('  '.repeat(depth) + key +
+        (null == node || '' === node.v ? '' : ' ' + node.v) +
+        (again ? ' (above)' : null == node ? ' (not locked)' : ''))
+      if (again || null == node) {
+        return
+      }
+      for (const dep of node.deps) {
+        walk(dep, depth + 1)
+      }
+    }
+    walk(report.root, 0)
+    for (const miss of report.missing) {
+      lines.push(miss + ': not fetched (run: aontu sync)')
+    }
+    return lines.join('\n')
   }
-  // A module that is PRESENT but does not stand up. Named separately
+
+  const done: any[] = 'tidy' === sub ? pkgLockLines(report.lock) : report.vendored
+  lines.push(...done)
+  // A package that is PRESENT but does not stand up. Named separately
   // from a missing one because the repair is different: a fetch cannot
-  // help, the module itself has to be fixed (or its own dependencies
+  // help, the package itself has to be fixed (or its own dependencies
   // vendored beside it). Before the missing tail, as the Go port's
   // shared renderer orders them.
   for (const bad of report.unevaluable ?? []) {
     lines.push(bad + ': does not evaluate on its own; nothing to pin')
   }
+  lines.push(...pkgForbiddenLines(report.forbidden ?? []))
   for (const miss of report.missing) {
-    lines.push(miss + ': not fetched (run: aontu mod get)')
+    lines.push(miss + ': not fetched (run: aontu sync)')
   }
   return lines.join('\n')
 }
 
 
+// The two `pkg` subcommands that reach a repository.
+async function runPkgNet(sub: string, dir: string, args: PkgArgs,
+  opts: PkgToolOptions, servers: Servers, io: Io): Promise<number> {
+  if ('serve' === sub) {
+    const served = await startServe({
+      dir: resolve(dir), upstream: args.upstream,
+      listen: args.listen ?? '127.0.0.1:8017', http: servers.http(),
+    })
+    io.out('serving ' + resolve(dir) + ' at ' + served.url + '\n' +
+      args.upstream.map((u) => 'upstream: ' + u + '\n').join(''))
+    await servers.serve(served)
+    await served.close()
+    return 0
+  }
+  if (null == opts.cache) {
+    io.err(NO_CACHE)
+    return 2
+  }
+  const report = await pkgOutdated(dir, opts, servers.http(), { base: netBase(args) })
+  io.out(pkgReportText('pkg outdated', args.format, report) + '\n')
+  return PKG_EXIT[report.verdict]
+}
+
+const NO_CACHE = 'aontu: this verb reads and writes the user cache, which a ' +
+  'confined run (--trust root) does not reach and this host does not name ' +
+  '(set XDG_CACHE_HOME or HOME)\n'
+
+function netBase(args: PkgArgs): string[] | undefined {
+  return 0 === args.base.length ? undefined : args.base
+}
+
+const PACKAGE_VERBS = ['sync', 'add', 'get', 'remove', 'why', 'publish']
+
+const PACKAGE_HELP: Record<string, string> = {
+  sync: 'aontu sync [--frozen] [dir] (try --help)',
+  add: 'aontu add <pkg> [dir] (try --help)',
+  get: 'aontu get <pkg>[@<version>] [dir] (try --help)',
+  remove: 'aontu remove <pkg> [dir] (try --help)',
+  why: 'aontu why <pkg> [dir] (try --help)',
+  publish: 'aontu publish [--yes] [--to <dir>] [--key <file>] [dir] (try --help)',
+}
+
+// The top-level package verbs (ADR-039 part 5). Every one but `why`
+// reaches a repository, so every one runs behind the seam.
+async function runPackageVerb(verb: string, argv: string[], servers: Servers):
+  Promise<number> {
+  const io = servers.io ?? PROCESS_IO
+  const trusted = takeTrust(argv, io)
+  if (null == trusted) {
+    return 2
+  }
+  const args = parsePkgArgs(trusted.argv, verb, io)
+  if (null == args) {
+    return '-h' === trusted.argv[0] || trusted.argv.includes('--help') ? 0 : 2
+  }
+  const wantsPkg = 'sync' !== verb && 'publish' !== verb
+  const dir = args.rest[wantsPkg ? 1 : 0] ?? '.'
+  if (args.rest.length > (wantsPkg ? 2 : 1) || (wantsPkg && 0 === args.rest.length)) {
+    io.err('aontu: ' + verb + (wantsPkg ? ' needs a package' : ' takes a directory') +
+      '\n' + PACKAGE_HELP[verb] + '\n')
+    return 2
+  }
+  nameOldLayout(dir, io)
+  const opts = pkgToolOptions(trusted.trust, resolve(dir))
+  const http = servers.http()
+
+  if ('why' === verb) {
+    const report = pkgWhy(dir, opts, args.rest[0])
+    io.out(pkgReportText('why', args.format, report) + '\n')
+    return PKG_EXIT[report.verdict]
+  }
+
+  if ('publish' === verb) {
+    for (const f of [args.key, args.token]) {
+      if (null != f && !existsSync(f)) {
+        io.err('aontu: cannot read ' + f + '\n')
+        return 2
+      }
+    }
+    if (true === args.yes && null == args.key) {
+      io.err('aontu: publish --yes needs --key <file>, the Ed25519 key that signs\n')
+      return 2
+    }
+    const report = await pkgPublish(dir, opts, http, {
+      yes: args.yes, to: null == args.to ? undefined : resolve(args.to), key: args.key,
+      token: args.token, against: args.against, base: netBase(args), write: args.write,
+    })
+    io.out(pkgReportText('publish', args.format, report) + '\n')
+    return PKG_EXIT[report.verdict]
+  }
+
+  if (null == opts.cache) {
+    io.err(NO_CACHE)
+    return 2
+  }
+  const net = { base: netBase(args) }
+  const report: PkgSyncReport | PkgChangeReport | string =
+    'sync' === verb ? await pkgSync(dir, opts, http, { ...net, frozen: args.frozen }) :
+      'remove' === verb ? await pkgRemove(dir, opts, http, args.rest[0], net) :
+        await pkgGet(dir, opts, http, args.rest[0], { ...net, mode: verb as 'add' | 'get' })
+  if ('string' === typeof report) {
+    io.err('aontu: ' + report + '\n')
+    return 2
+  }
+  io.out(pkgReportText(verb, args.format, report) + '\n')
+  return PKG_EXIT[report.verdict]
+}
+
+
+function pkgReportText(verb: string, fmt: SubsumeFormat, report: any): string {
+  return 'json' === fmt ?
+    exactJSON({ aontu: { version: version(), verb }, ...report }, 2) :
+    pkgNetText(verb, report)
+}
+
+
+function pkgNetText(verb: string, report: any): string {
+  const lines = ['verdict: ' + report.verdict]
+  const tail = (): void => {
+    for (const e of report.events ?? []) {
+      lines.push(e.code + ': ' + e.message)
+    }
+    if (null != report.refusal) {
+      lines.push('refused: ' + report.refusal.code + ': ' + report.refusal.message)
+    }
+  }
+
+  if ('why' === verb) {
+    const why = report as PkgWhyReport
+    for (const p of why.paths) {
+      lines.push(p.join(' -> '))
+    }
+    if ('missing' === why.verdict) {
+      lines.push(why.pkg + ': not in the closure')
+    }
+    return lines.join('\n')
+  }
+
+  if ('publish' === verb) {
+    const pub = report as PkgPublishReport
+    lines.push(...pkgText('manifest', pub).split('\n').slice(1))
+    if (null != pub.digest) {
+      lines.push('digest: ' + pub.digest)
+    }
+    if (null != pub.signer) {
+      lines.push('signer: ' + pub.signer)
+    }
+    if (null != pub.against) {
+      lines.push('against: ' + pub.against)
+    }
+    if (null != pub.to) {
+      lines.push('to: ' + pub.to)
+    }
+    if (null != pub.write) {
+      lines.push('write: ' + pub.write + PUBLISH_PATH)
+    }
+    if ('dry-run' === pub.verdict) {
+      lines.push('dry run: nothing sent (add --yes)')
+    }
+    if ('sent' === pub.verdict) {
+      lines.push('sent')
+    }
+    tail()
+    return lines.join('\n')
+  }
+
+  if ('pkg outdated' === verb) {
+    const out = report as PkgOutdatedReport
+    for (const e of out.locked) {
+      if (0 < versionCompare(e.newest, e.v)) {
+        lines.push(e.key + ' ' + e.v + ' -> ' + e.newest)
+        for (const m of e.moves) {
+          lines.push('  ' + m)
+        }
+      }
+      else {
+        lines.push(e.key + ' ' + e.v + ': current')
+      }
+      if (null != e.retracted) {
+        lines.push(e.key + ' ' + e.v + ': retracted by ' + e.retracted)
+      }
+    }
+    tail()
+    return lines.join('\n')
+  }
+
+  const sync = report as PkgChangeReport
+  if (null != sync.change) {
+    lines.push('change: ' + sync.change)
+  }
+  for (const f of sync.fetched) {
+    lines.push('fetched: ' + f)
+  }
+  lines.push(...pkgLockLines(sync.lock))
+  for (const bad of sync.unevaluable) {
+    lines.push(bad + ': does not evaluate on its own; nothing to pin')
+  }
+  lines.push(...pkgForbiddenLines(sync.forbidden), ...pkgMismatchLines(sync.mismatched),
+    ...pkgUnlockedLines(sync.unlocked))
+  for (const miss of sync.missing) {
+    lines.push(miss + ': not fetched (run: aontu sync)')
+  }
+  for (const c of sync.changes) {
+    lines.push('lockfile would change: ' + c)
+  }
+  tail()
+  return lines.join('\n')
+}
+
+
+const MODEL_HELP = 'aontu model get|why|set ... (try --help)'
+
+// One document, interrogated or edited (ADR-039 part 5).
+function runModel(argv: string[]): number {
+  const sub = argv[0]
+  if ('-h' === sub || '--help' === sub) {
+    process.stdout.write(HELP)
+    return 0
+  }
+  if ('get' === sub) {
+    return runGet(argv.slice(1))
+  }
+  if ('why' === sub) {
+    return runWhy(argv.slice(1))
+  }
+  if ('set' === sub) {
+    return runSet(argv.slice(1))
+  }
+  process.stderr.write(`aontu: model needs get, why or set\n${MODEL_HELP}\n`)
+  return 2
+}
+
+
+
 function vacuous(what: string, why: string): void {
   process.stderr.write(`aontu: ${what}: ${why}\n`)
 }
@@ -2341,6 +2766,120 @@ function runRelations(argv: string[]): number {
   return RELATIONS_EXIT[report.verdict]
 }
 
+const TRACE_HELP =
+  'aontu trace [--at <path>] [--format json] [--marker <token>] ' +
+  '[--profile <file>] <file>'
+
+
+// WHAT WROTE THIS LINE. Every piece a rule stamped, under the
+// component tree, with the file it reached, the rule set that wrote it
+// and the model node the dispatch matched.
+function runTrace(argv: string[]): number {
+  const trusted = takeTrust(argv)
+  if (null == trusted) {
+    return 2
+  }
+  argv = trusted.argv
+  const trust = trusted.trust
+  const rest: string[] = []
+  const profileFiles: string[] = []
+  let format: 'text' | 'json' = 'text'
+  let at: string | undefined = undefined
+  let marker: string | undefined = undefined
+
+  for (let i = 0; i < argv.length; i++) {
+    const arg = argv[i]
+    if ('-h' === arg || '--help' === arg) {
+      process.stdout.write(HELP)
+      return 0
+    }
+    if ('--format' === arg) {
+      const f = argv[++i]
+      if ('text' !== f && 'json' !== f) {
+        process.stderr.write('aontu: --format needs text or json\n')
+        return 2
+      }
+      format = f
+    }
+    else if ('--at' === arg) {
+      at = argv[++i]
+      if (null == at) {
+        process.stderr.write('aontu: --at needs a path\n')
+        return 2
+      }
+    }
+    else if ('--marker' === arg) {
+      marker = argv[++i]
+      if (null == marker) {
+        process.stderr.write('aontu: --marker needs a token\n')
+        return 2
+      }
+    }
+    else if ('--profile' === arg) {
+      const pf = argv[++i]
+      if (null == pf) {
+        process.stderr.write('aontu: --profile needs a file\n')
+        return 2
+      }
+      profileFiles.push(pf)
+    }
+    else if (arg.startsWith('-')) {
+      process.stderr.write(`aontu: unknown trace option ${arg} (try --help)\n`)
+      return 2
+    }
+    else {
+      rest.push(arg)
+    }
+  }
+
+  if (1 !== rest.length) {
+    process.stderr.write(`aontu: trace needs one file\n${TRACE_HELP}\n`)
+    return 2
+  }
+
+  let src: string
+  try {
+    src = readFileSync(rest[0], 'utf8')
+  }
+  catch (err: any) {
+    process.stderr.write(`aontu: cannot read ${err.path}: ${err.message}\n`)
+    return 2
+  }
+
+  const declared = loadProfiles(profileFiles, trust)
+  if ('number' === typeof declared) {
+    return declared
+  }
+
+  // A GENERATOR IS AN ENTRY, not a preprocessing step: the file whose
+  // provenance is asked for is the one the author edits.
+  if (!rest[0].endsWith('.aon')) {
+    src = desugarTemplate(src, marker ??
+      markerFromProfiles(declared, rest[0]) ?? markerFor(rest[0]))
+  }
+
+  const report = traceRun(src, {
+    path: rest[0], at,
+    ...verbOpts(trust, entryRootOf(rest[0])),
+  })
+  if ('error' === report.verdict) {
+    // An error report always carries its findings.
+    const errors = report.errors as VetFinding[]
+    process.stderr.write(errors.map(renderFinding).join('\n') + '\n')
+    return 4
+  }
+  if ('json' === format) {
+    process.stdout.write(JSON.stringify({ trace: report.trace }) + '\n')
+    return 0
+  }
+  for (const e of report.trace) {
+    process.stdout.write(
+      [e.file, e.at, e.node, e.rule].join('\t') + '\n')
+  }
+  return 0
+}
+
+
 function runReaches(argv: string[]): number {
   const trusted = takeTrust(argv)
   if (null == trusted) {
@@ -2955,302 +3494,6 @@ function runJsonSchema(argv: string[]): number {
 }
 
 
-const RENDER_HELP =
-  'aontu render [--at <path>] [--profile <file>]... [--unit <path>] ' +
-  '[--stdout | --out <dir> | --check <dir> | --coverage] ' +
-  '[--coverage-at <path>] [--strict] [--marker <token>] <file> (try --help)'
-
-function runRender(argv: string[]): number {
-  const trusted = takeTrust(argv)
-  if (null == trusted) {
-    return 2
-  }
-  argv = trusted.argv
-  const trust = trusted.trust
-  const files: string[] = []
-  const profileFiles: string[] = []
-  let format: SubsumeFormat = 'text'
-  let at: string | undefined = undefined
-  let unit: string | undefined = undefined
-  let out: string | undefined = undefined
-  let check: string | undefined = undefined
-  let toStdout = false
-  let strict = false
-  let coverage = false
-  let coverageAt: string | undefined = undefined
-  let marker: string | undefined = undefined
-
-  for (let i = 0; i < argv.length; i++) {
-    const arg = argv[i]
-    if ('-h' === arg || '--help' === arg) {
-      process.stdout.write(HELP)
-      return 0
-    }
-    if ('--format' === arg) {
-      const f = argv[++i]
-      if ('text' !== f && 'json' !== f) {
-        process.stderr.write('aontu: --format needs text or json\n')
-        return 2
-      }
-      format = f
-    }
-    else if ('--at' === arg) {
-      at = argv[++i]
-      if (null == at) {
-        process.stderr.write('aontu: --at needs a path\n')
-        return 2
-      }
-    }
-    else if ('--unit' === arg) {
-      unit = argv[++i]
-      if (null == unit) {
-        process.stderr.write('aontu: --unit needs a unit path\n')
-        return 2
-      }
-    }
-    else if ('--profile' === arg) {
-      const pf = argv[++i]
-      if (null == pf) {
-        process.stderr.write('aontu: --profile needs a file\n')
-        return 2
-      }
-      profileFiles.push(pf)
-    }
-    else if ('--out' === arg) {
-      out = argv[++i]
-      if (null == out) {
-        process.stderr.write('aontu: --out needs a directory\n')
-        return 2
-      }
-    }
-    else if ('--check' === arg) {
-      check = argv[++i]
-      if (null == check) {
-        process.stderr.write('aontu: --check needs a directory\n')
-        return 2
-      }
-    }
-    else if ('--stdout' === arg) {
-      toStdout = true
-    }
-    else if ('--coverage' === arg) {
-      coverage = true
-    }
-    else if ('--marker' === arg) {
-      marker = argv[++i]
-      if (null == marker) {
-        process.stderr.write('aontu: --marker needs a token\n')
-        return 2
-      }
-    }
-    else if ('--coverage-at' === arg) {
-      coverageAt = argv[++i]
-      if (null == coverageAt) {
-        process.stderr.write('aontu: --coverage-at needs a path\n')
-        return 2
-      }
-    }
-    else if ('--strict' === arg) {
-      strict = true
-    }
-    else if (arg.startsWith('-')) {
-      process.stderr.write(
-        `aontu: unknown render option ${arg} (try --help)\n`)
-      return 2
-    }
-    else {
-      files.push(arg)
-    }
-  }
-
-  if (1 !== files.length) {
-    process.stderr.write(`aontu: render needs one file\n${RENDER_HELP}\n`)
-    return 2
-  }
-  const modes = [toStdout, undefined !== out, undefined !== check, coverage]
-    .filter((on) => on).length
-  if (1 < modes) {
-    process.stderr.write(
-      'aontu: render takes one of --stdout, --out, --check or --coverage\n')
-    return 2
-  }
-  // A NARROWER MEASURE NEEDS SOMETHING TO NARROW. `--coverage-at`
-  // without `--coverage` asks for a report the run does not compute,
-  // and answering silently would be the wrong half of the request.
-  if (undefined !== coverageAt && !coverage) {
-    process.stderr.write('aontu: --coverage-at needs --coverage\n')
-    return 2
-  }
-
-  let src: string
-  try {
-    src = readFileSync(files[0], 'utf8')
-  }
-  catch (err: any) {
-    process.stderr.write(`aontu: cannot read ${err.path}: ${err.message}\n`)
-    return 2
-  }
-
-  const loadedProfiles = loadProfiles(profileFiles, trust)
-  if ('number' === typeof loadedProfiles) {
-    return loadedProfiles
-  }
-  const profiles = loadedProfiles
-
-  if (!files[0].endsWith('.aon')) {
-    src = desugarTemplate(src, marker ??
-      markerFromProfiles(profiles, files[0]) ?? markerFor(files[0]))
-  }
-
-  // A RENDER WITH NO PROFILE PRODUCES NO UNITS, and said so with zero
-  // bytes and exit 0. The profile is what maps a model onto a
-  // language, so without one there is nothing for the renderer to
-  // write -- which is a usable answer only if the caller is told.
-  const noProfiles = 0 === profiles.length
-  const report = render(src, {
-    at, unit, strict, profiles, path: files[0],
-    coverage, coverageAt,
-    // THE JSON REPORT CARRIES THE TRACE (D9), which is what the shape
-    // there has always said; a text run computes it only when the
-    // coverage report needs it.
-    trace: 'json' === format,
-    ...verbOpts(trust, entryRootOf(files[0])),
-  })
-
-  // Said once, whatever the format: stdout stays the report.
-  if ('error' !== report.verdict && 0 === report.units.length) {
-    vacuous('nothing was rendered',
-      noProfiles
-        ? 'no profile was given, and the document declares none' +
-        ' (see aontu help tasks)'
-        : 'the document produced no units under this profile')
-  }
-
-  if ('json' === format) {
-    process.stdout.write(exactJSON({
-      aontu: { version: version(), verb: 'render' },
-      verdict: report.verdict,
-      units: report.units,
-      lossy: report.lossy,
-      ...(null == report.errors ? {} : { errors: report.errors }),
-      ...(null == report.trace ? {} : { trace: report.trace }),
-      ...(null == report.coverage ? {} : { coverage: report.coverage }),
-    }, 2) + '\n')
-    return renderExit(report, 0)
-  }
-  if ('error' === report.verdict) {
-    process.stderr.write(
-      (report.errors as VetFinding[]).map(renderFinding).join('\n') + '\n')
-    return renderExit(report, 0)
-  }
-
-  let drift = 0
-  if (toStdout) {
-    // ONE UNIT'S BYTES AND NOTHING ELSE, so the output can be piped
-    // into a formatter or a file.
-    if (1 !== report.units.length) {
-      process.stderr.write(
-        'aontu: --stdout needs exactly one unit, and the instance has ' +
-        `${report.units.length}; --unit names one\n`)
-      return 2
-    }
-    process.stdout.write(report.units[0].text)
-  }
-  else if (undefined !== out) {
-    // EVERY UNIT BELOW <dir>, OR NOTHING: every unit rendered first
-    // (the report above), and no file touched unless all did. The
-    // directory is realpath-confined; a unit path is already a relative
-    // descent (render_path refuses the rest), and the check here is
-    // against the symlink inside it. render never deletes.
-    for (const u of report.units) {
-      if (outsideRoot(out, resolve(out, u.path))) {
-        process.stderr.write(`aontu: ${u.path} escapes ${out}\n`)
-        return 2
-      }
-    }
-    for (const u of report.units) {
-      const full = resolve(out, u.path)
-      try {
-        mkdirSync(dirname(full), { recursive: true })
-        writeFileSync(full, u.text, 'utf8')
-      }
-      catch (err: any) {
-        process.stderr.write(`aontu: cannot write ${u.path}: ${err.message}\n`)
-        return 2
-      }
-      process.stderr.write(`wrote ${u.path}\n`)
-    }
-  }
-  else if (undefined !== check) {
-    // RENDER AND COMPARE: a unit whose bytes differ from the file at
-    // <dir>/<path>, or whose file is absent, is drift, listed by path.
-    // The CI form.
-    for (const u of report.units) {
-      let have: string | undefined = undefined
-      try {
-        have = readFileSync(resolve(check, u.path), 'utf8')
-      }
-      catch {
-        // Absent is drift, reported below.
-      }
-      if (undefined === have) {
-        drift++
-        process.stderr.write(`aontu: ${u.path} is missing from ${check}\n`)
-      }
-      else if (have !== u.text) {
-        drift++
-        process.stderr.write(`aontu: ${u.path} differs from the rendered unit\n`)
-      }
-    }
-  }
-  else if (coverage) {
-    // THE COVERAGE REPORT (P7), one line per finding and a count at
-    // the end: dead model first, then the declarations no rule
-    // produced. A clean report is the count line alone.
-    const cov = report.coverage as RenderCoverage
-    for (const d of cov.dead) {
-      process.stdout.write(`dead: ${d}\n`)
-    }
-    for (const u of cov.unruled) {
-      process.stdout.write(`unruled: ${u.unit} ${u.path}\n`)
-    }
-    process.stdout.write(
-      `coverage: ${cov.read.length} path(s) read, ${cov.dead.length} ` +
-      `no output consumed, ${cov.unruled.length} declaration(s) ` +
-      'no rule produced\n')
-  }
-  else {
-    // THE SUMMARY: one line per unit -- its path, its language and its
-    // size -- since several units have no one text to print.
-    for (const u of report.units) {
-      process.stdout.write(`${u.path}\t${u.lang}\t${u.text.length} bytes\n`)
-    }
-  }
-  for (const l of report.lossy) {
-    process.stderr.write(
-      `lossy: ${l.unit} ${l.path} tier ${l.tier} ${l.construct}: ${l.reason}\n`)
-  }
-  return renderExit(report, drift)
-}
-
-// D8's exit table over a report: a refused unit path is usage (2), a
-// strict refusal is lossy (1), any other error is the document's (4);
-// drift under --check is 1.
-function renderExit(report: RenderReport, drift: number): number {
-  if ('error' === report.verdict) {
-    const errors = report.errors as VetFinding[]
-    if (errors.every((f) => 'render_path' === f.code)) {
-      return 2
-    }
-    if (errors.every((f) => 'render_strict' === f.code)) {
-      return 1
-    }
-    return 4
-  }
-  return 0 < drift ? 1 : 0
-}
-
-
 const TEMPLATE_HELP =
   'aontu template [--resugar] [--check] [--marker <token>] <file> (try --help)'
 
@@ -3356,9 +3599,9 @@ function runTemplate(argv: string[]): number {
 
 
 // The profiles named by --profile, vetted, or the exit code that says
-// why not. A profile is a language declared as data: `render` matches
-// one to a unit by `lang`, and `template` and `fmt` match one to a file
-// by the extensions its `template.ext` names.
+// why not. A profile is a language declared as data: `template` and
+// `fmt` match one to a file by the extensions its `template.ext`
+// names.
 function loadProfiles(
   profileFiles: string[], trust: TrustArg
 ): any[] | number {
@@ -3373,7 +3616,7 @@ function loadProfiles(
       process.stderr.write(`aontu: cannot read ${err.path}: ${err.message}\n`)
       return 2
     }
-    const loaded = renderProfile(text,
+    const loaded = loadProfile(text,
       { path: resolve(pf), ...verbOpts(trust, entryRootOf(pf)) })
     if (undefined !== loaded.errors) {
       process.stderr.write(loaded.errors.map(renderFinding).join('\n') + '\n')
@@ -3470,7 +3713,7 @@ function runHash(argv: string[]): number {
 }
 
 
-const GET_HELP = 'aontu get <path> <file> (try --help)'
+const GET_HELP = 'aontu model get <path> <file> (try --help)'
 
 function runGet(argv: string[]): number {
   const trusted = takeTrust(argv)
@@ -3516,7 +3759,7 @@ function runGet(argv: string[]): number {
       format = f
     }
     else if (arg.startsWith('-')) {
-      process.stderr.write(`aontu: unknown get option ${arg} (try --help)\n`)
+      process.stderr.write(`aontu: unknown model get option ${arg} (try --help)\n`)
       return 2
     }
     else {
@@ -3525,7 +3768,7 @@ function runGet(argv: string[]): number {
   }
 
   if (2 !== rest.length) {
-    process.stderr.write(`aontu: get needs a path and one file\n${GET_HELP}\n`)
+    process.stderr.write(`aontu: model get needs a path and one file\n${GET_HELP}\n`)
     return 2
   }
   const [path, file] = rest
@@ -3553,7 +3796,7 @@ function runGet(argv: string[]): number {
   })
   if ('json' === format) {
     process.stdout.write(exactJSON({
-      aontu: { version: version(), verb: 'get' },
+      aontu: { version: version(), verb: 'model get' },
       findings: report.findings,
       ok: report.ok,
       out: report.out,
@@ -3582,7 +3825,7 @@ function runGet(argv: string[]): number {
 // The positive twin of the vet report: errors explain what failed to
 // unify, this explains what did.
 
-const WHY_HELP = 'aontu why <path> <file> (try --help)'
+const WHY_HELP = 'aontu model why <path> <file> (try --help)'
 
 function runWhy(argv: string[]): number {
   const trusted = takeTrust(argv)
@@ -3609,7 +3852,7 @@ function runWhy(argv: string[]): number {
       format = f
     }
     else if (arg.startsWith('-')) {
-      process.stderr.write(`aontu: unknown why option ${arg} (try --help)\n`)
+      process.stderr.write(`aontu: unknown model why option ${arg} (try --help)\n`)
       return 2
     }
     else {
@@ -3618,7 +3861,7 @@ function runWhy(argv: string[]): number {
   }
 
   if (2 !== rest.length) {
-    process.stderr.write(`aontu: why needs a path and one file\n${WHY_HELP}\n`)
+    process.stderr.write(`aontu: model why needs a path and one file\n${WHY_HELP}\n`)
     return 2
   }
   const [path, file] = rest
@@ -3637,7 +3880,7 @@ function runWhy(argv: string[]): number {
   })
   if ('json' === format) {
     process.stdout.write(exactJSON({
-      aontu: { version: version(), verb: 'why' },
+      aontu: { version: version(), verb: 'model why' },
       findings: report.findings,
       ok: report.ok,
       ...(null == report.record ? {} : { record: report.record }),
@@ -3675,7 +3918,7 @@ function renderWhyText(record: WhyRecord): string {
 
 
 const SET_HELP =
-  'aontu set <path>=<value> --entry <file> --overlay <file> (try --help)'
+  'aontu model set <path>=<value> --entry <file> --overlay <file> (try --help)'
 
 function runSet(argv: string[]): number {
   const trusted = takeTrust(argv)
@@ -3718,7 +3961,7 @@ function runSet(argv: string[]): number {
       format = f
     }
     else if (arg.startsWith('-')) {
-      process.stderr.write(`aontu: unknown set option ${arg} (try --help)\n`)
+      process.stderr.write(`aontu: unknown model set option ${arg} (try --help)\n`)
       return 2
     }
     else {
@@ -3728,7 +3971,7 @@ function runSet(argv: string[]): number {
 
   if (0 === assignments.length || null == entry || null == overlayFile) {
     process.stderr.write(
-      `aontu: set needs assignments, --entry and --overlay\n${SET_HELP}\n`)
+      `aontu: model set needs assignments, --entry and --overlay\n${SET_HELP}\n`)
     return 2
   }
 
@@ -3780,7 +4023,7 @@ function runSet(argv: string[]): number {
 
   if ('json' === format) {
     process.stdout.write(exactJSON({
-      aontu: { version: version(), verb: 'set' },
+      aontu: { version: version(), verb: 'model set' },
       appended: report.appended,
       findings: report.findings,
       overlay: report.overlay,
@@ -4138,8 +4381,8 @@ function runFmt(argv: string[]): number | Promise<number> {
     }
     else if ('--marker' === arg) {
       // THE MARKER SAYS THE FILE IS A GENERATOR, whatever its
-      // extension: `render` and `template` take the same option for
-      // the same reason, a language the table has never seen.
+      // extension: `fmt` and `template` take the same option for the
+      // same reason, a language the table has never seen.
       marker = argv[++i]
       if (null == marker) {
         process.stderr.write('aontu: --marker needs a token\n')
@@ -4280,17 +4523,38 @@ function fmtOne(
 }
 
 
+// Where a verb writes. The package verbs are asynchronous, so a test
+// cannot capture the process streams around them; it hands these in.
+type Io = { out: (s: string) => void, err: (s: string) => void }
+
+const PROCESS_IO: Io = {
+  out: (s) => void process.stdout.write(s),
+  err: (s) => void process.stderr.write(s),
+}
+
 type Servers = {
   lsp: () => void
   mcp: (argv: string[]) => void
+  // `pkg serve` runs until this settles: the process's SIGINT, or a
+  // test's say-so.
+  serve: (served: Served) => Promise<void>
+  http: () => PkgHttp
+  io?: Io
+}
+
+// `pkg serve` runs until the process is interrupted.
+function serveUntilInterrupted(): Promise<void> {
+  return new Promise((done) => process.once('SIGINT', () => done()))
 }
 
 // Excluded: the real pair takes the process stdio, so ts/test/cli.test.ts
 // drives each server through a child process instead.
-/* node:coverage ignore next 4 */
+/* node:coverage ignore next 6 */
 const SERVERS: Servers = {
   lsp: () => void lspMain(),
   mcp: (argv) => void mcpMain(undefined, undefined, undefined, undefined, argv),
+  serve: serveUntilInterrupted,
+  http: defaultHttp,
 }
 
 // undefined: the server took the process; a number: an answer the CLI
@@ -4614,10 +4878,10 @@ function runInit(argv: string[]): number {
 
 
 const KNOWN_VERBS = [
-  'agentsmd', 'allow', 'breaking', 'explain', 'fmt', 'get', 'hash',
-  'help', 'init', 'jsonschema', 'lsp', 'mcp', 'mod', 'reaches',
-  'relations', 'render', 'set', 'subsume', 'template', 'trim', 'vet',
-  'view', 'why',
+  'add', 'agentsmd', 'allow', 'breaking', 'explain', 'fmt', 'get', 'hash',
+  'help', 'init', 'jsonschema', 'lsp', 'mcp', 'model', 'pkg', 'publish',
+  'reaches', 'relations', 'remove', 'subsume', 'sync', 'template', 'trace',
+  'trim', 'vet', 'view', 'why',
 ]
 
 
@@ -4712,20 +4976,22 @@ function main(argv: string[], servers: Servers = SERVERS): void {
     return servers.mcp(argv.slice(3))
   }
 
-  if ('set' === argv[2]) {
-    return finish(runSet(argv.slice(3)))
-  }
 
   if ('allow' === argv[2]) {
     return finish(runAllow(argv.slice(3)))
   }
 
-  if ('why' === argv[2]) {
-    return finish(runWhy(argv.slice(3)))
+  if ('model' === argv[2]) {
+    return finish(runModel(argv.slice(3)))
   }
 
-  if ('get' === argv[2]) {
-    return finish(runGet(argv.slice(3)))
+  if ('pkg' === argv[2]) {
+    const r = runPkg(argv.slice(3), servers)
+    return 'number' === typeof r ? finish(r) : void r.then(finish)
+  }
+
+  if (PACKAGE_VERBS.includes(argv[2])) {
+    return void runPackageVerb(argv[2], argv.slice(3), servers).then(finish)
   }
 
   if ('hash' === argv[2]) {
@@ -4746,10 +5012,6 @@ function main(argv: string[], servers: Servers = SERVERS): void {
     return finish(runInit(argv.slice(3)))
   }
 
-  if ('mod' === argv[2]) {
-    return finish(runMod(argv.slice(3)))
-  }
-
   if ('relations' === argv[2]) {
     return finish(runRelations(argv.slice(3)))
   }
@@ -4758,14 +5020,15 @@ function main(argv: string[], servers: Servers = SERVERS): void {
     return finish(runJsonSchema(argv.slice(3)))
   }
 
-  if ('render' === argv[2]) {
-    return finish(runRender(argv.slice(3)))
-  }
 
   if ('template' === argv[2]) {
     return finish(runTemplate(argv.slice(3)))
   }
 
+  if ('trace' === argv[2]) {
+    return finish(runTrace(argv.slice(3)))
+  }
+
   if ('reaches' === argv[2]) {
     return finish(runReaches(argv.slice(3)))
   }
@@ -4869,7 +5132,7 @@ function main(argv: string[], servers: Servers = SERVERS): void {
   else {
     runStdin(mode, format, trust).then((code) => finish(code))
   }
-} /* node:coverage ignore next 20 */
+} /* node:coverage ignore next 21 */
 
 
 // No require.main guard here: bin/aontu.js is the executable entry and
@@ -4881,9 +5144,9 @@ export {
   runReaches,
   runView,
   runJsonSchema,
-  runRender,
   runTemplate,
-  runMod,
+  runTrace,
+  runPkg, runModel, runPackageVerb, pkgToolOptions, serveUntilInterrupted,
   runHash, runGet, runHelp, runExplain, runInit, nearestVerb,
   looksLikeVerb,
   KNOWN_VERBS,