Add a library: fetch the namespace `what` names on `source` (a release, or a namespace hash), or the release `source` names as announced (`@alice.dev/geo@1.2.0`), with everything it names, and mount it read-only at `at` (default defaultMount), recorded beside it. It's called `name`, else after its package (libraryName): a library by hash has no package to be called after.
Find `what` (a release, or a namespace hash) on the first of `sources` that has it, then fetch its namespace from whichever has that, trying each in turn: what arrives is checked by hash, so it's no matter which answers. Each that doesn't is said, and the next tried. `open` opens a source (default `openRemote`: a remote's name, a URL, a directory; a hub gives `publicRemote`).
Where a library's code reaches outside itself, worked out from the code, not from what anyone says of it: by effect, the definitions whose own code does, or which use a package's export that does (`fetchTiles (node-fetch)`). `unknown`: packages whose code couldn't all be followed (a computed import, `eval`), so may reach more. Its tests aren't counted; `rows` are named as in the library.
`tcm lib`: the libraries this branch holds, each with what it is, where it comes from, and what its author and the people the codebase trusts say of it (yanks, advisories, reviews).
`tcm lib search <query> [--hub <url>]`: ask a hub what its libraries hold that matches `query` (a name, words in docs, or `:a type`), and say each library with what matched and its `tcm lib add` line: the hub `hubToAsk` says.
Move a library to another version (`what`: a release or a namespace hash; default its package's newest release, from its sources, `source` first if given): its API's changes said first, then, unless `check`, its names replaced by the new version's in one update, each definition patched to the one replacing it, so code using it follows (what doesn't typecheck against it goes to todo). Refused while code uses something the new version doesn't have.
What `tcm lib add <source> [what]` names as announced: `@<handle or DID>/<package>[@<version>]`, or `@<handle or DID>` with the release as `what`. Undefined for any other source.
Where a library is mounted unless it's said: `lib.<name>` in the project's root namespace (`tcmts.lib.geo`). The libraries mounted already (`mounts`), their record and the trust list (`lib.trust`) aren't the project's code: a codebase holding only `lib.react` mounts the next at `lib.server`.
Fetch a release `who` announced (`what`: `geo@1.2.0`, or `geo` for its highest version): found among their `codes.tcm.release` records, its namespace fetched by hash from the record's sources (`first` ahead of them, `also` after), and checked by re-hashing as it arrives.
The hub `tcm lib search` asks: the one given (kept for next time, a codebase setting), else the one kept, else tcm's own (`DEFAULT_HUB`, which isn't kept: a codebase that never chose one follows tcm's).
The namespace hash a release names: its package's namespace in the history entry it was made at. `from` is a remote, or a store (this codebase), which has the same two lookups.
What `what` names on a remote: a release (`geo@1.2.0`, or `geo` for its newest), or a namespace by its whole hash (`#…`). A release is its package's namespace in the history entry it names.
What an upgrade from one version of a library to another does to its names: each definition of the old one that the new one has another at the same name (and in the same space) is replaced by it; the rest of the old one that the new one doesn't have at all is gone.