@agentorg/cli 0.0.5 → 0.0.6

package/dist/node_modules/@agentorg/hub/dist/src/state.js

@@ -1,21 +1,15 @@
 import { createHash, randomBytes, timingSafeEqual } from "node:crypto";
 import { chmodSync, closeSync, fsyncSync, mkdirSync, openSync, readFileSync, renameSync, rmSync, writeFileSync, writeSync, } from "node:fs";
-import { basename, dirname, join, relative, resolve, sep } from "node:path";
+import { join } from "node:path";
 import { DatabaseSync } from "node:sqlite";
-import { httpEgress, hubActors, hubAudit, hubBindings, hubExports, hubGrants, hubPackages, kv, storageAdmin, } from "@agentorg/interfaces";
+import { hubActors, hubAudit, hubBindings, hubExports, hubGrants } from "@agentorg/interfaces";
 import { compareInterfaces, describeInterface, hashInterface, Refused, } from "@agentorg/sdk";
-import { readTar, treeHash, verifyArchive } from "@agentorg/sdk/manifest";
 /** The built-in Actor that exports management. */
 export const HUB = "hub";
-/** The built-in Actor that keeps state: `kv@1`, one store per consumer slot. */
-export const STORAGE = "storage";
-/** The built-in Actor that reaches the public internet: `http.egress@1`, over HTTPS only. */
-export const NET = "net";
 /** The person's Actor, created at first start with every `hub.*` binding. */
 export const PERSON = "person";
 /** The hub's exports, each the authority for its own part of management. */
 const HUB_EXPORTS = {
-    packages: hubPackages,
     actors: hubActors,
     bindings: hubBindings,
     grants: hubGrants,
@@ -25,10 +19,6 @@ const HUB_EXPORTS = {
 const NAME = /^[a-z][A-Za-z0-9_]*$/;
 /** The longest name of a slot made at run time, so a tool named `<slot>__<method>` fits. */
 const EXPOSED_MAX = 48;
-/** Exposure requests one Actor may have open toward one other at a time. */
-const MAX_OPEN_EXPOSURES = 32;
-/** The Actors that are the Hub itself: they take no slots. */
-const BUILTIN = new Set(["hub", "storage", "net"]);
 /**
  * The default name of a slot exposing `exportName` of the Actor named `providerName`: the name's
  * ASCII words camelCased, `_`, and the export's last part; the export's part alone when the name
@@ -44,7 +34,6 @@ export function exposedName(providerName, exportName) {
     const part = exportName.slice(exportName.lastIndexOf(".") + 1);
     return (camel ? `${camel}_${part}` : part).slice(0, EXPOSED_MAX);
 }
-const MEMBER = /^[a-z][A-Za-z0-9_]*(\.[a-z][A-Za-z0-9_]*)?$/;
 const now = () => new Date().toISOString();
 const digest = (secret) => createHash("sha256").update(secret).digest();
 /** Each entry moves the home's database up one version; `user_version` records where it is. */
@@ -76,6 +65,14 @@ const MIGRATIONS = [
     // Exposure: an Actor made for another (provenance only), and requests to expose.
     `ALTER TABLE actors ADD COLUMN installed_for TEXT;
    ALTER TABLE requests ADD COLUMN exposed INTEGER NOT NULL DEFAULT 0;`,
+    // The built-in storage and network and the package store are gone; an earlier home's records
+    // of them go too. The packages table stays, unread.
+    `DELETE FROM bindings WHERE provider IN ('storage', 'net');
+   DELETE FROM bindings WHERE provider = 'hub' AND export = 'packages';
+   DELETE FROM declarations WHERE actor = 'hub' AND side = 'export' AND name = 'packages';
+   DELETE FROM declarations WHERE actor = 'person' AND side = 'slot' AND name = 'packages';
+   DELETE FROM declarations WHERE actor IN ('storage', 'net');
+   UPDATE actors SET state = 'closed' WHERE id IN ('storage', 'net');`,
 ];
 /** Whether a process with this pid runs now. */
 function alive(pid) {
@@ -130,33 +127,8 @@ const bindingOf = (row) => ({
 /** A binding's columns, with whether its slot was made at run time. */
 const BINDING = `b.*, (SELECT d.dynamic FROM declarations d
   WHERE d.actor = b.consumer AND d.side = 'slot' AND d.name = b.slot) AS exposed`;
-const requestOf = (row) => ({
-    requestId: String(row.id),
-    consumer: String(row.consumer),
-    slot: String(row.slot),
-    provider: String(row.provider),
-    export: String(row.export),
-    reason: String(row.reason),
-    requestedBy: String(row.requested_by),
-    at: String(row.at),
-    needs: row.needs === "slot" ? "slot" : "export",
-    ...(row.exposed ? { exposed: true } : {}),
-});
-const other = (side) => (side === "export" ? "slot" : "export");
-/** What a package's Actor declares: each module's slots and exports, by `module.name`. */
-function packageDeclarations(manifest) {
-    return Object.entries(manifest.modules).flatMap(([module, m]) => [
-        ["slot", m.slots],
-        ["export", m.exports],
-    ].flatMap(([side, members]) => Object.entries(members).map(([member, id]) => {
-        const entry = manifest.interfaces[id];
-        if (!entry)
-            throw new Refused("invalid", `The package doesn't record ${id}.`);
-        return { side, name: `${module}.${member}`, iface: { id, ...entry } };
-    })));
-}
 /**
- * The core's state in its home folder: Actors, packages, declarations, bindings, binding requests
+ * The core's state in its home folder: Actors, declarations, bindings
  * and the audit trail, in `node:sqlite`. Every method that changes something takes its caller, and
  * each is checked against bindings: there is no other authority.
  */
@@ -169,7 +141,6 @@ export class HubState {
     constructor(home, events) {
         this.home = home;
         this.#events = events;
-        mkdirSync(join(home, "packages"), { recursive: true, mode: 0o700 });
         chmodSync(home, 0o700);
         const file = join(home, "hub.db");
         this.#db = new DatabaseSync(file);
@@ -246,17 +217,6 @@ export class HubState {
                 }
                 this.#audit(HUB, "bootstrap", { person: PERSON });
             }
-            if (!this.#actor(STORAGE))
-                this.#db
-                    .prepare("INSERT INTO actors (id, name, package, state, credential, created_at) VALUES (?, 'storage', 'builtin', 'running', NULL, ?)")
-                    .run(STORAGE, now());
-            this.#declare(STORAGE, "export", "kv", describeInterface(kv), false);
-            this.#declare(STORAGE, "export", "admin", describeInterface(storageAdmin), false);
-            if (!this.#actor(NET))
-                this.#db
-                    .prepare("INSERT INTO actors (id, name, package, state, credential, created_at) VALUES (?, 'net', 'builtin', 'running', NULL, ?)")
-                    .run(NET, now());
-            this.#declare(NET, "export", "egress", describeInterface(httpEgress), false);
             for (const [name, iface] of Object.entries(HUB_EXPORTS)) {
                 const described = describeInterface(iface);
                 this.#declare(HUB, "export", name, described, false);
@@ -323,17 +283,6 @@ export class HubState {
         const entry = { seq: Number(lastInsertRowid), at, actor, kind, details };
         this.#emit(() => this.#events.audited?.(entry));
     }
-    /** Record something the Hub itself saw happen, such as the host sandbox's status changing. */
-    auditHub(kind, details, actor = HUB) {
-        this.#transaction(() => this.#audit(actor, kind, details));
-    }
-    /** A package Actor's process exited: kept as its `lastExit`, and counted when it is restarted. */
-    recordExit(actorId, exit, restarted) {
-        this.#db
-            .prepare("UPDATE actors SET last_exit = ?, restarts = restarts + ? WHERE id = ? AND package NOT IN ('external', 'builtin')")
-            .run(JSON.stringify(exit), restarted ? 1 : 0, actorId);
-        this.#emit(() => this.#events.actorChanged?.(actorId));
-    }
     /** Record a call's metadata: who, through which binding, which method, and how it ended. */
     auditCall(caller, 
     /** The binding the call went through; an unbound slot has only its consumer and slot. */
@@ -343,16 +292,13 @@ export class HubState {
     // ── Actors ──────────────────────────────────────────────────────────────────
     #actor(actorId) {
         const row = this.#db
-            .prepare("SELECT id, name, package, state, restarts, last_exit, installed_for FROM actors WHERE id = ?")
+            .prepare("SELECT id, name, package, state FROM actors WHERE id = ?")
             .get(actorId);
         return (row && {
             actorId: String(row.id),
             name: String(row.name),
             package: String(row.package),
             state: row.state,
-            restarts: Number(row.restarts),
-            ...(row.last_exit ? { lastExit: JSON.parse(String(row.last_exit)) } : {}),
-            ...(row.installed_for ? { installedFor: String(row.installed_for) } : {}),
         });
     }
     /** An Actor as a refusal names it: "Name (id)", or the id alone when there's no such Actor. */
@@ -366,12 +312,6 @@ export class HubState {
             throw new Refused("unknown", `No Actor ${actorId}; hub.actors.list lists them.`);
         return actor;
     }
-    /** The host sandbox's status changed: every package Actor's record (its `host`) differs. */
-    hostChanged() {
-        for (const actor of this.actors())
-            if (actor.package !== "external" && actor.package !== "builtin")
-                this.#emit(() => this.#events.actorChanged?.(actor.actorId));
-    }
     actors() {
         const rows = this.#db.prepare("SELECT id FROM actors ORDER BY created_at, id").all();
         return rows.map((row) => this.actor(String(row.id)));
@@ -386,42 +326,24 @@ export class HubState {
         if (!this.holds(caller, hubExport))
             throw new Refused("forbidden", `${this.named(caller)} isn't bound to hub.${hubExport}@1; a manager (the person) can bind it, or do this for it.`);
     }
-    /** Create an Actor: one that runs a package, or an external one, whose credential comes back once. */
+    /** Create an Actor: a program that connects itself, with a credential that comes back once. */
     createActor(caller, input) {
         this.#require(caller, "actors");
-        if (input.for !== undefined) {
-            if (!this.isManager(caller))
-                throw new Refused("forbidden", `Only a manager says whom an Actor is made for; ${this.named(caller)} isn't one. Create it without for.`);
-            this.#open(input.for);
-        }
         const actorId = `act_${randomBytes(8).toString("hex")}`;
-        const credential = input.package ? undefined : randomBytes(32).toString("base64url");
-        const insert = this.#db.prepare("INSERT INTO actors (id, name, package, state, credential, created_at, installed_for) VALUES (?, ?, ?, 'created', ?, ?, ?)");
-        const madeFor = input.for ?? null;
+        const credential = randomBytes(32).toString("base64url");
+        const insert = this.#db.prepare("INSERT INTO actors (id, name, package, state, credential, created_at) VALUES (?, ?, 'external', 'created', ?, ?)");
         this.#transaction(() => {
-            if (input.package) {
-                const { manifest } = this.package(input.package);
-                insert.run(actorId, input.name, input.package, null, now(), madeFor);
-                for (const { side, name, iface } of packageDeclarations(manifest))
-                    this.#declare(actorId, side, name, iface, false);
-                // A package's own wiring is applied as it is installed.
-                for (const [slot, exported] of manifest.connections)
-                    this.#insertBinding({ consumer: actorId, slot, provider: actorId, export: exported }, HUB);
-            }
-            else
-                insert.run(actorId, input.name, "external", digest(credential), now(), madeFor);
+            insert.run(actorId, input.name, digest(credential), now());
             this.#audit(caller, "actor.create", {
                 actorId,
                 name: input.name,
-                package: input.package ?? "external",
-                ...(input.for === undefined ? {} : { for: input.for }),
             });
             this.#emit(() => this.#events.actorChanged?.(actorId));
             for (const initial of input.bindings ?? []) {
                 const wiring = { consumer: actorId, ...initial };
                 if (!this.sides(caller, wiring).export)
-                    throw new Refused("forbidden", `${this.named(caller)} can't grant ${this.named(initial.provider)}'s ${initial.export}. Create it without that binding, then it can ask for it with hub.grants.request, or the provider or a manager can bind it.`);
-                if (!input.package && !this.declaration(actorId, "slot", initial.slot)) {
+                    throw new Refused("forbidden", `${this.named(caller)} can't grant ${this.named(initial.provider)}'s ${initial.export}: only a manager, the provider or an Actor bound to that export can.`);
+                if (!this.declaration(actorId, "slot", initial.slot)) {
                     if (!NAME.test(initial.slot))
                         throw new Refused("invalid", `${JSON.stringify(initial.slot)} isn't a valid slot name.`);
                     const offered = this.declaration(initial.provider, "export", initial.export);
@@ -432,7 +354,7 @@ export class HubState {
                 this.#insertBinding(wiring, caller);
             }
         });
-        return credential ? { actorId, credential } : { actorId };
+        return { actorId, credential };
     }
     /** Whether an external Actor's credential is right, compared in constant time. */
     authenticate(actorId, credential) {
@@ -444,53 +366,18 @@ export class HubState {
         // Both sides are SHA-256 digests, so the lengths always match.
         return timingSafeEqual(Buffer.from(row.credential), digest(credential));
     }
-    #packageActor(caller, actorId) {
-        this.#require(caller, "actors");
-        const actor = this.actor(actorId);
-        if (actor.package === "external" || actor.package === "builtin")
-            throw new Refused("state", `${this.named(actorId)} isn't a package Actor, so the Hub doesn't run its process.`);
-        return actor;
-    }
-    /** Refused unless the caller may start the Actor and it can be started now; changes nothing. */
-    checkStart(caller, actorId) {
-        const actor = this.#packageActor(caller, actorId);
-        if (actor.state !== "created" && actor.state !== "stopped")
-            throw new Refused("state", `${this.named(actorId)} is ${actor.state === "running" ? "already running" : "closed and can't start again; make another"}.`);
-    }
-    /** Start a package Actor: recorded as running; the Hub spawns its process. */
-    start(caller, actorId) {
-        this.checkStart(caller, actorId);
-        this.#transaction(() => {
-            this.#db.prepare("UPDATE actors SET state = 'running' WHERE id = ?").run(actorId);
-            this.#audit(caller, "actor.start", { actorId });
-            this.#emit(() => this.#events.actorChanged?.(actorId));
-        });
-    }
-    stop(caller, actorId) {
-        const actor = this.#packageActor(caller, actorId);
-        if (actor.state !== "running")
-            throw new Refused("state", `${this.named(actorId)} is ${actor.state}, not running.`);
-        this.#transaction(() => {
-            this.#db.prepare("UPDATE actors SET state = 'stopped' WHERE id = ?").run(actorId);
-            this.#audit(caller, "actor.stop", { actorId });
-            this.#emit(() => this.#events.actorChanged?.(actorId));
-        });
-    }
-    /** Close an Actor for good: its bindings both ways, its declarations and its open requests go. */
+    /** Close an Actor for good: its bindings both ways and its declarations go. */
     closeActor(caller, actorId) {
         this.#require(caller, "actors");
         const actor = this.actor(actorId);
-        if (actorId === HUB || actorId === PERSON || actorId === STORAGE || actorId === NET)
+        if (actorId === HUB || actorId === PERSON)
             throw new Refused("forbidden", `${this.named(actorId)} is built in and can't be closed.`);
         if (actor.state === "closed")
             return;
         this.#transaction(() => {
-            const pending = this.#pending("consumer = ? OR provider = ? OR requested_by = ?", actorId, actorId, actorId);
             this.#db.prepare("UPDATE actors SET state = 'closed' WHERE id = ?").run(actorId);
             this.#removeBindings("consumer = ? OR provider = ?", actorId, actorId);
             this.#db.prepare("DELETE FROM declarations WHERE actor = ?").run(actorId);
-            for (const open of pending)
-                this.#decide(open, "closed");
             this.#audit(caller, "actor.close", { actorId });
             this.#emit(() => this.#events.exportsChanged?.(actorId));
             this.#emit(() => this.#events.actorChanged?.(actorId));
@@ -518,160 +405,6 @@ export class HubState {
             this.#audit(by, "binding.drop", { ...wiring, why: "its interface changed" });
         return wirings;
     }
-    /** Close the open requests to bind through one of an Actor's slots or exports. */
-    #closeRequestsThrough(actorId, side, name) {
-        const where = side === "slot" ? "consumer = ? AND slot = ?" : "provider = ? AND export = ?";
-        for (const open of this.#pending(where, actorId, name))
-            this.#decide(open, "closed");
-    }
-    /** Refused unless the caller may upgrade the Actor to the package now; changes nothing. */
-    checkUpgrade(caller, actorId, hash) {
-        this.#require(caller, "actors");
-        // An upgrade runs new code as an Actor that keeps its bindings and its store: whatever it was
-        // granted, the new code holds. Only a manager, who could grant all of it anyway, may.
-        if (!this.isManager(caller))
-            throw new Refused("forbidden", `Only a manager may upgrade an Actor, since the new package keeps its bindings and its store; ${this.named(caller)} isn't one.`);
-        const actor = this.actor(actorId);
-        if (actorId === HUB || actorId === PERSON || actorId === STORAGE || actorId === NET)
-            throw new Refused("forbidden", `${this.named(actorId)} is built in and can't be upgraded.`);
-        if (actor.package === "external")
-            throw new Refused("state", `${this.named(actorId)} isn't a package Actor; it declares what it takes when it connects.`);
-        if (actor.state === "closed")
-            throw new Refused("state", `${this.named(actorId)} is closed for good; make another.`);
-        packageDeclarations(this.package(hash).manifest);
-        return actor;
-    }
-    /**
-     * Run another package as the same Actor: its id, its stores and every binding whose interfaces
-     * still match stay; a binding through a slot or export the new package drops or declares as
-     * another interface is dropped, audited and returned. The new package's own wiring is applied
-     * where its slot is unbound. The process isn't touched here: a running Actor is stopped first
-     * and started after, by whoever runs processes.
-     */
-    upgrade(caller, actorId, hash) {
-        const actor = this.checkUpgrade(caller, actorId, hash);
-        if (actor.package === hash)
-            return [];
-        const { manifest } = this.package(hash);
-        const next = packageDeclarations(manifest);
-        const declared = (side, name) => next.find((n) => n.side === side && n.name === name)?.iface;
-        const dropped = [];
-        this.#transaction(() => {
-            // What it offered at run time was its process's, which this restarts: it goes, with the
-            // bindings to it, which are returned with the rest.
-            for (const row of this.#db
-                .prepare("SELECT name FROM declarations WHERE actor = ? AND side = 'export' AND dynamic = 1")
-                .all(actorId)) {
-                dropped.push(...this.#dropBindingsOf(actorId, "export", String(row.name), caller));
-                this.#drop(actorId, "export", String(row.name));
-            }
-            // A binding stays while its two ends declare the same interface: this Actor's end as the
-            // new package declares it, the other end as it is declared now.
-            const keeps = (b) => {
-                const slot = b.consumer === actorId
-                    ? declared("slot", b.slot)
-                    : this.declaration(b.consumer, "slot", b.slot)?.iface;
-                const exported = b.provider === actorId
-                    ? declared("export", b.export)
-                    : this.declaration(b.provider, "export", b.export)?.iface;
-                return !!slot && !!exported && compareInterfaces(slot, exported) === "same";
-            };
-            const old = this.#db
-                .prepare("SELECT side, name, iface FROM declarations WHERE actor = ? AND dynamic = 0")
-                .all(actorId).map((row) => ({
-                side: row.side,
-                name: String(row.name),
-                iface: JSON.parse(String(row.iface)),
-            }));
-            for (const was of old) {
-                dropped.push(...this.#dropBindingsOf(actorId, was.side, was.name, caller, keeps));
-                // A request through a name the package no longer declares as it was can't be made.
-                const fresh = declared(was.side, was.name);
-                if (!fresh || compareInterfaces(was.iface, fresh) !== "same")
-                    this.#closeRequestsThrough(actorId, was.side, was.name);
-            }
-            this.#db.prepare("DELETE FROM declarations WHERE actor = ? AND dynamic = 0").run(actorId);
-            for (const { side, name, iface } of next)
-                this.#declare(actorId, side, name, iface, false);
-            this.#db.prepare("UPDATE actors SET package = ? WHERE id = ?").run(hash, actorId);
-            for (const [slot, exported] of manifest.connections)
-                if (!this.binding(actorId, slot))
-                    this.#insertBinding({ consumer: actorId, slot, provider: actorId, export: exported }, HUB);
-            this.#audit(caller, "actor.upgrade", { actorId, from: actor.package, to: hash, dropped });
-            this.#emit(() => this.#events.exportsChanged?.(actorId));
-            this.#emit(() => this.#events.actorChanged?.(actorId));
-        });
-        return dropped;
-    }
-    // ── Packages ────────────────────────────────────────────────────────────────
-    /** Add a `.agentorg` archive from a path on this machine, verified; adding it again is a no-op. */
-    addPackage(caller, path) {
-        this.#require(caller, "packages");
-        let bytes;
-        try {
-            bytes = new Uint8Array(readFileSync(path));
-        }
-        catch {
-            throw new Refused("unknown", `No package file at ${path}.`);
-        }
-        let expected = /^(sha256-[0-9a-f]{64})\.agentorg$/.exec(basename(path))?.[1];
-        if (!expected)
-            try {
-                expected = treeHash(readTar(bytes));
-            }
-            catch (error) {
-                throw new Refused("invalid", error instanceof Error ? error.message : String(error));
-            }
-        const verified = verifyArchive(bytes, expected);
-        if (!verified.ok)
-            throw new Refused("invalid", verified.problems.join("\n"));
-        const { hash, manifest, files } = verified;
-        if (this.#db.prepare("SELECT 1 FROM packages WHERE hash = ?").get(hash))
-            return { hash, manifest };
-        const dir = join(this.home, "packages", hash);
-        for (const [file, data] of files) {
-            const target = resolve(dir, file);
-            // verifyArchive allows only agentorg.json and dist/<module>.js; this keeps it so.
-            if (relative(dir, target).startsWith(`..${sep}`))
-                throw new Refused("invalid", `Unsafe path ${file}.`);
-            mkdirSync(dirname(target), { recursive: true, mode: 0o700 });
-            writeFileSync(target, data, { mode: 0o600 });
-        }
-        this.#transaction(() => {
-            this.#db
-                .prepare("INSERT INTO packages (hash, name, version, manifest, added_by, added_at) VALUES (?, ?, ?, ?, ?, ?)")
-                .run(hash, manifest.name, manifest.version, JSON.stringify(manifest), caller, now());
-            this.#audit(caller, "package.add", { hash, name: manifest.name, version: manifest.version });
-        });
-        return { hash, manifest };
-    }
-    packages() {
-        const rows = this.#db
-            .prepare("SELECT hash, name, version FROM packages ORDER BY added_at, hash")
-            .all();
-        return rows.map((row) => ({
-            hash: String(row.hash),
-            name: String(row.name),
-            version: String(row.version),
-        }));
-    }
-    package(hash) {
-        const row = this.#db.prepare("SELECT manifest FROM packages WHERE hash = ?").get(hash);
-        if (!row)
-            throw new Refused("unknown", `No package ${hash}.`);
-        return { hash, manifest: JSON.parse(String(row.manifest)) };
-    }
-    /** Remove a package no live Actor runs. Its files stay until a later clean-up. */
-    removePackage(caller, hash) {
-        this.#require(caller, "packages");
-        this.package(hash);
-        if (this.#db.prepare("SELECT 1 FROM actors WHERE package = ? AND state != 'closed'").get(hash))
-            throw new Refused("in_use", `An Actor runs ${hash}.`);
-        this.#transaction(() => {
-            this.#db.prepare("DELETE FROM packages WHERE hash = ?").run(hash);
-            this.#audit(caller, "package.remove", { hash });
-        });
-    }
     // ── Declarations: what each Actor takes and offers ──────────────────────────
     #declare(actor, side, name, iface, dynamic) {
         this.#db
@@ -718,9 +451,7 @@ export class HubState {
      * A name it no longer declares is dropped, with its bindings.
      */
     declareExternal(actorId, declares) {
-        const actor = this.#open(actorId);
-        if (actor.package !== "external")
-            throw new Refused("forbidden", `${this.named(actorId)} declares through its package; an Actor of another package declares otherwise.`);
+        this.#open(actorId);
         this.#transaction(() => {
             for (const [side, members] of [
                 ["slot", declares.slots],
@@ -732,15 +463,12 @@ export class HubState {
                     this.#checked(iface);
                     if (side === "slot") {
                         // The Actor's own slots are its to name: an exposure under the same name yields,
-                        // with its binding, and requests to make one under it close.
+                        // with its binding.
                         if (this.declaration(actorId, side, name)?.dynamic)
                             this.#drop(actorId, side, name);
-                        for (const open of this.#pending("consumer = ? AND slot = ? AND exposed = 1", actorId, name))
-                            this.#decide(open, "closed");
                     }
                     // A binding holds while both ends declare the same interface: redeclared as another,
-                    // the name's bindings whose other end doesn't declare it are dropped, and its requests
-                    // close.
+                    // the name's bindings whose other end doesn't declare it are dropped.
                     const known = this.declaration(actorId, side, name);
                     if (known && compareInterfaces(known.iface, iface) !== "same") {
                         this.#dropBindingsOf(actorId, side, name, actorId, (b) => {
@@ -749,7 +477,6 @@ export class HubState {
                                 : this.declaration(b.consumer, "slot", b.slot)?.iface;
                             return !!other && compareInterfaces(iface, other) === "same";
                         });
-                        this.#closeRequestsThrough(actorId, side, name);
                     }
                     this.#declare(actorId, side, name, iface, false);
                 }
@@ -772,51 +499,11 @@ export class HubState {
             .prepare("DELETE FROM declarations WHERE actor = ? AND side = ? AND name = ?")
             .run(actor, side, name);
         const where = side === "slot" ? "consumer = ? AND slot = ?" : "provider = ? AND export = ?";
-        const pending = this.#pending(where, actor, name);
         this.#removeBindings(where, actor, name);
-        for (const open of pending)
-            this.#decide(open, "closed");
-    }
-    /** Offer an export at run time; it lasts until withdrawn or until the Actor disconnects. */
-    offer(actorId, name, iface) {
-        this.#open(actorId);
-        if (!MEMBER.test(name))
-            throw new Refused("invalid", `${JSON.stringify(name)} isn't a valid export name.`);
-        if (this.declaration(actorId, "export", name))
-            throw new Refused("conflict", `${this.named(actorId)} already offers ${name}; offer it under another name${this.declaration(actorId, "export", name)?.dynamic ? ", or withdraw it first" : ""}.`);
-        this.#checked(iface);
-        this.#transaction(() => {
-            this.#declare(actorId, "export", name, iface, true);
-            this.#audit(actorId, "export.offer", { export: name, interface: iface.id });
-            this.#emit(() => this.#events.exportsChanged?.(actorId));
-        });
-    }
-    /** Withdraw an export offered at run time: the bindings to it end. */
-    withdraw(actorId, name) {
-        const declared = this.declaration(actorId, "export", name);
-        if (!declared?.dynamic)
-            throw new Refused("unknown", `${this.named(actorId)} offers no ${name} at run time to withdraw; only exports offered at run time can be.`);
-        this.#transaction(() => {
-            this.#drop(actorId, "export", name);
-            this.#audit(actorId, "export.withdraw", { export: name });
-            this.#emit(() => this.#events.exportsChanged?.(actorId));
-        });
-    }
-    /** An Actor's connection ended: what it offered at run time goes, with the bindings to it. */
-    disconnected(actorId) {
-        this.#transaction(() => {
-            const dynamic = this.#db
-                .prepare("SELECT name FROM declarations WHERE actor = ? AND side = 'export' AND dynamic = 1")
-                .all(actorId);
-            for (const row of dynamic)
-                this.#drop(actorId, "export", String(row.name));
-            if (dynamic.length)
-                this.#emit(() => this.#events.exportsChanged?.(actorId));
-        });
     }
     exports(actor) {
         const rows = this.#db
-            .prepare(`SELECT d.actor, d.name, d.iface, d.dynamic FROM declarations d JOIN actors a ON a.id = d.actor
+            .prepare(`SELECT d.actor, d.name, d.iface FROM declarations d JOIN actors a ON a.id = d.actor
          WHERE d.side = 'export' AND a.state != 'closed' ${actor ? "AND d.actor = ?" : ""}
          ORDER BY d.actor, d.name`)
             .all(...(actor ? [actor] : []));
@@ -827,7 +514,6 @@ export class HubState {
                 export: String(row.name),
                 interface: iface.id,
                 hash: iface.hash,
-                dynamic: !!row.dynamic,
             };
         });
     }
@@ -877,21 +563,6 @@ export class HubState {
             slot: manager || caller === wiring.consumer,
         };
     }
-    /** Who can give the side a request needs: exactly the Actors `sides` grants it to. */
-    approvers(request) {
-        const managers = this.#db
-            .prepare("SELECT DISTINCT consumer FROM bindings WHERE provider = ? AND export = 'bindings'")
-            .all(HUB).map((m) => String(m.consumer));
-        const own = request.needs === "slot"
-            ? [request.consumer]
-            : [
-                request.provider,
-                ...this.#db
-                    .prepare("SELECT DISTINCT consumer FROM bindings WHERE provider = ? AND export = ?")
-                    .all(request.provider, request.export).map((h) => String(h.consumer)),
-            ];
-        return [...new Set([...own, ...managers])];
-    }
     /** The two ends exist, are live, and take and offer the same interface. */
     #ends(wiring) {
         this.#open(wiring.consumer);
@@ -927,8 +598,6 @@ export class HubState {
             return;
         if (removed.some((b) => b.consumer === PERSON && b.provider === HUB && !b.exposed))
             throw new Refused("forbidden", "The person's hub bindings stay, so someone can always manage the Hub.");
-        // Requests whose requester held its end through these bindings can't be approved any more.
-        const open = this.#pending("1 = 1");
         this.#db.prepare(`DELETE FROM bindings WHERE ${where}`).run(...params);
         // A slot made at run time goes with its binding.
         const dropExposed = this.#db.prepare("DELETE FROM declarations WHERE actor = ? AND side = 'slot' AND name = ? AND dynamic = 1");
@@ -936,35 +605,13 @@ export class HubState {
             if (binding.exposed)
                 dropExposed.run(binding.consumer, binding.slot);
         this.#emit(() => this.#events.unbound?.(removed));
-        for (const pending of open)
-            if (!this.#standing(pending.request))
-                this.#decide(pending, "closed");
     }
-    /**
-     * Bind a slot to an export. A caller with both ends binds. A caller with one end approves an
-     * open request for this binding from the other end, if its requester still holds that end;
-     * otherwise its call becomes a request to the other end's approvers. A caller with neither end
-     * is refused.
-     */
+    /** Bind a slot to an export: the caller must hold both ends. */
     bind(caller, wiring) {
         const sides = this.sides(caller, wiring);
-        if (!sides.export && !sides.slot)
-            throw new Refused("forbidden", `${this.named(caller)} holds neither end of this binding: the export side is ${this.named(wiring.provider)}, an Actor bound to that export, or a manager; the slot side is ${this.named(wiring.consumer)} or a manager. Ask one of them.`);
-        if (!(sides.export && sides.slot)) {
-            const has = sides.export ? "export" : "slot";
-            if (!this.#asked(wiring, has))
-                return { bound: false, requestId: this.#ask(caller, wiring, "", other(has)).requestId };
-        }
-        this.#transaction(() => {
-            // Every open request for this slot is settled: the ones for this binding are approved, and
-            // the rest can't be made any more.
-            const pending = this.#pending("consumer = ? AND slot = ?", wiring.consumer, wiring.slot);
-            this.#insertBinding(wiring, caller);
-            for (const open of pending)
-                this.#decide(open, open.request.provider === wiring.provider && open.request.export === wiring.export
-                    ? "approved"
-                    : "closed");
-        });
+        if (!(sides.export && sides.slot))
+            throw new Refused("forbidden", `${this.named(caller)} doesn't hold both ends of this binding: the export side is ${this.named(wiring.provider)}, the slot side ${this.named(wiring.consumer)}. A manager can bind it.`);
+        this.#transaction(() => this.#insertBinding(wiring, caller));
         return { bound: true };
     }
     /** Unbind a slot: its consumer, its provider or a manager may. */
@@ -986,68 +633,44 @@ export class HubState {
     }
     /**
      * Expose an export to one Actor: a slot made on `to` at run time, typed by the export's
-     * interface and bound to it, in one step. The authority is a binding's, with `to` as the
-     * consumer: with both ends it is made (approving any open request for it); with one, it is a
-     * request to the other end's approvers, who approve by exposing the same; with neither, it is
-     * refused. The same export already exposed to `to` gives that slot back.
+     * interface and bound to it, in one step. The caller must hold both ends, with `to` as the
+     * consumer. The same export already exposed to `to` gives that slot back.
      */
     expose(caller, input) {
         const to = this.#open(input.to);
         const provider = this.#open(input.provider);
-        // Authority first, as bind's: a caller with neither end learns nothing more.
+        // Authority first: a caller without it learns nothing more.
         const ends = { consumer: to.actorId, provider: provider.actorId, export: input.export };
         const sides = this.sides(caller, { ...ends, slot: "" });
-        if (!sides.export && !sides.slot)
-            throw new Refused("forbidden", `${this.named(caller)} can't expose ${input.export} of ${this.named(provider.actorId)} to ${this.named(to.actorId)}: that takes the provider's side (it, an Actor bound to that export, or a manager) or ${this.named(to.actorId)}'s (it, or a manager). Ask one of them to expose it.`);
-        if (BUILTIN.has(to.actorId))
+        if (!(sides.export && sides.slot))
+            throw new Refused("forbidden", `${this.named(caller)} can't expose ${input.export} of ${this.named(provider.actorId)} to ${this.named(to.actorId)}: a manager can.`);
+        if (to.actorId === HUB)
             throw new Refused("forbidden", `${this.named(to.actorId)} is the Hub itself and takes no slots.`);
         const offered = this.declaration(provider.actorId, "export", input.export);
         if (!offered)
             throw new Refused("unknown", `${this.named(provider.actorId)} offers no ${input.export}.`);
-        if (offered.iface.kind !== "rpc")
-            throw new Refused("unsupported", `Only an rpc export can be exposed; ${input.export} is ${offered.iface.kind}.`);
-        const same = (row) => row.provider === provider.actorId && row.export === input.export;
-        const already = this.bindings(to.actorId).find((b) => b.consumer === to.actorId && b.exposed && same(b));
+        const already = this.bindings(to.actorId).find((b) => b.consumer === to.actorId &&
+            b.exposed &&
+            b.provider === provider.actorId &&
+            b.export === input.export);
         if (already && (input.as === undefined || input.as === already.slot))
             return { exposed: true, slot: already.slot };
-        const requested = this.#db
-            .prepare("SELECT * FROM requests WHERE status = 'open' AND exposed = 1 AND consumer = ?")
-            .all(to.actorId).map(requestOf);
-        // An open request's name for this export is taken again, so approving needs no `as`.
-        const slot = input.as ??
-            requested.find(same)?.slot ??
-            this.#freeName(to.actorId, exposedName(provider.name, input.export), requested);
+        const slot = input.as ?? this.#freeName(to.actorId, exposedName(provider.name, input.export));
         if (!NAME.test(slot) || slot.length > EXPOSED_MAX)
             throw new Refused("invalid", `${JSON.stringify(slot)} isn't a slot name: one word of letters, digits and _, at most ${EXPOSED_MAX}.`);
-        // A request reserves no name: the first exposure made under it has it, and the rest close.
         if (this.declaration(to.actorId, "slot", slot))
             throw new Refused("conflict", `${this.named(to.actorId)} already has a slot ${slot}; name another with as.`);
         const wiring = { ...ends, slot };
-        if (!(sides.export && sides.slot)) {
-            const has = sides.export ? "export" : "slot";
-            if (!this.#asked(wiring, has)) {
-                const mine = requested.filter((r) => r.requestedBy === caller && !(same(r) && r.slot === slot));
-                if (mine.length >= MAX_OPEN_EXPOSURES)
-                    throw new Refused("limit", `${this.named(caller)} has ${MAX_OPEN_EXPOSURES} exposures to ${this.named(to.actorId)} waiting; wait for them to be decided, or withdraw one by exposing it.`);
-                const request = this.#ask(caller, wiring, "", other(has), true);
-                return { exposed: false, slot, requestId: request.requestId };
-            }
-        }
         this.#transaction(() => {
-            // Settled: this slot's requests (approved if for this export), and this export's requests
-            // to `to` under other names, which can't be made any more.
-            const pending = this.#pending("consumer = ? AND (slot = ? OR (exposed = 1 AND provider = ? AND export = ?))", wiring.consumer, wiring.slot, wiring.provider, wiring.export);
             this.#declare(to.actorId, "slot", slot, offered.iface, true);
             this.#insertBinding(wiring, caller);
-            for (const open of pending)
-                this.#decide(open, same(open.request) && open.request.slot === slot ? "approved" : "closed");
             this.#audit(caller, "expose", { ...wiring });
         });
         return { exposed: true, slot };
     }
     /** A name free on `to`: `base`, else `base_2`, `base_3`…, each within the longest name. */
-    #freeName(to, base, requested) {
-        const taken = (name) => !!this.declaration(to, "slot", name) || requested.some((r) => r.slot === name);
+    #freeName(to, base) {
+        const taken = (name) => !!this.declaration(to, "slot", name);
         for (let n = 1;; n++) {
             const suffix = n === 1 ? "" : `_${n}`;
             const name = base.slice(0, EXPOSED_MAX - suffix.length) + suffix;
@@ -1062,123 +685,6 @@ export class HubState {
             throw new Refused("unknown", `${this.named(to)} has no slot ${slot} made by expose; unbind a declared slot instead.`);
         this.unbind(caller, to, slot);
     }
-    /**
-     * Ask for a binding the caller holds one end of; it goes to the other end's approvers. Asking
-     * again for the same wiring while a request is open returns that request.
-     */
-    request(caller, wiring, reason) {
-        const sides = this.sides(caller, wiring);
-        if (!sides.export && !sides.slot)
-            throw new Refused("forbidden", `${this.named(caller)} holds neither end of this binding: the export side is ${this.named(wiring.provider)}, an Actor bound to that export, or a manager; the slot side is ${this.named(wiring.consumer)} or a manager. Ask one of them.`);
-        if (sides.export && sides.slot)
-            throw new Refused("state", `${this.named(caller)} holds both ends: bind it instead.`);
-        const has = sides.export ? "export" : "slot";
-        if (this.#asked(wiring, has))
-            throw new Refused("state", "The other end has asked already: bind to approve.");
-        return this.#ask(caller, wiring, reason, other(has));
-    }
-    /** Whether the other end has an open request for this binding that `has` would complete. */
-    #asked(wiring, has) {
-        return this.#db
-            .prepare("SELECT * FROM requests WHERE status = 'open' AND needs = ? AND consumer = ? AND slot = ? AND provider = ? AND export = ?")
-            .all(has, wiring.consumer, wiring.slot, wiring.provider, wiring.export)
-            .map(requestOf)
-            .some((request) => this.#standing(request));
-    }
-    #ask(caller, wiring, reason, needs, exposed = false) {
-        // An exposure's slot doesn't exist until it is approved; `expose` checked its ends.
-        if (!exposed)
-            this.#ends(wiring);
-        if (this.binding(wiring.consumer, wiring.slot))
-            throw new Refused("bound", `${this.named(wiring.consumer)}'s ${wiring.slot} is already bound; unbind it first.`);
-        const open = this.#db
-            .prepare("SELECT * FROM requests WHERE status = 'open' AND requested_by = ? AND consumer = ? AND slot = ? AND provider = ? AND export = ?")
-            .get(caller, wiring.consumer, wiring.slot, wiring.provider, wiring.export);
-        if (open)
-            return requestOf(open);
-        const request = {
-            requestId: `req_${randomBytes(8).toString("hex")}`,
-            ...wiring,
-            needs,
-            reason,
-            requestedBy: caller,
-            at: now(),
-            ...(exposed ? { exposed: true } : {}),
-        };
-        this.#transaction(() => {
-            this.#db
-                .prepare("INSERT INTO requests (id, consumer, slot, provider, export, reason, requested_by, at, status, needs, exposed) VALUES (?, ?, ?, ?, ?, ?, ?, ?, 'open', ?, ?)")
-                .run(request.requestId, wiring.consumer, wiring.slot, wiring.provider, wiring.export, reason, caller, request.at, needs, exposed ? 1 : 0);
-            this.#audit(caller, "request", {
-                ...wiring,
-                needs,
-                requestId: request.requestId,
-                ...(exposed ? { exposed: true } : {}),
-            });
-            const approvers = this.approvers(request).filter((a) => a !== caller);
-            this.#emit(() => this.#events.requested?.(request, approvers));
-        });
-        return request;
-    }
-    /** The open requests the caller could approve. */
-    requests(caller) {
-        const rows = this.#db
-            .prepare("SELECT * FROM requests WHERE status = 'open' ORDER BY at")
-            .all();
-        return rows
-            .map(requestOf)
-            .filter((request) => request.requestedBy !== caller &&
-            this.#standing(request) &&
-            this.approvers(request).includes(caller));
-    }
-    /** The caller's own requests with how each stands, newest first. */
-    mine(caller, limit = 100) {
-        const rows = this.#db
-            .prepare("SELECT * FROM requests WHERE requested_by = ? ORDER BY at DESC, rowid DESC LIMIT ?")
-            .all(caller, limit);
-        return rows.map((row) => ({ ...requestOf(row), status: row.status }));
-    }
-    /** A request can still be approved only while its requester holds the end it brought. */
-    #standing(request) {
-        return this.sides(request.requestedBy, request)[other(request.needs)];
-    }
-    /**
-     * Open requests matching a condition, each with the approvers it went to. Taken before bindings
-     * change, so the decision reaches the same Actors as the request.
-     */
-    #pending(where, ...params) {
-        return this.#db
-            .prepare(`SELECT * FROM requests WHERE status = 'open' AND (${where})`)
-            .all(...params).map((row) => {
-            const request = requestOf(row);
-            return {
-                request,
-                approvers: this.approvers(request).filter((a) => a !== request.requestedBy),
-            };
-        });
-    }
-    #decide({ request, approvers }, status) {
-        // A request is decided once; a later path that finds it again leaves it be.
-        const { changes } = this.#db
-            .prepare("UPDATE requests SET status = ? WHERE id = ? AND status = 'open'")
-            .run(status, request.requestId);
-        if (!changes)
-            return;
-        // The requester hears too; events are at most once, so it can also read the outcome in `mine`.
-        const to = [...new Set([...approvers, request.requestedBy])];
-        this.#emit(() => this.#events.decided?.(request, status, to));
-    }
-    decline(caller, requestId) {
-        const request = this.requests(caller).find((r) => r.requestId === requestId);
-        if (!request)
-            throw new Refused("unknown", `No open request ${requestId} for ${this.named(caller)} to decide; hub.grants.requests lists those it can.`);
-        this.#transaction(() => {
-            const [pending] = this.#pending("id = ?", requestId);
-            if (pending)
-                this.#decide(pending, "declined");
-            this.#audit(caller, "decline", { requestId });
-        });
-    }
     // ── Audit ───────────────────────────────────────────────────────────────────
     audit(since = 0, limit = 100) {
         const rows = this.#db