@agoric/zone 0.2.3-dev-8358d20.0 → 0.2.3-dev-8baf0aa.0

package/package.json

@@ -1,14 +1,14 @@
 {
   "name": "@agoric/zone",
-  "version": "0.2.3-dev-8358d20.0+8358d20",
+  "version": "0.2.3-dev-8baf0aa.0+8baf0aa",
   "description": "Allocation zone abstraction for objects on the heap, persistent stores, etc.",
   "type": "module",
   "repository": "https://github.com/Agoric/agoric-sdk",
   "main": "./src/index.js",
   "scripts": {
     "build": "exit 0",
-    "test": "true || ava",
-    "test:c8": "true || c8 $C8_OPTIONS ava --config=ava-nesm.config.js",
+    "test": "ava",
+    "test:c8": "c8 $C8_OPTIONS ava --config=ava-nesm.config.js",
     "test:xs": "exit 0",
     "lint-fix": "yarn lint:eslint --fix",
     "lint": "run-s --continue-on-error lint:*",
@@ -25,9 +25,15 @@
   "author": "Agoric",
   "license": "Apache-2.0",
   "dependencies": {
-    "@agoric/store": "0.9.3-dev-8358d20.0+8358d20",
-    "@agoric/vat-data": "0.5.3-dev-8358d20.0+8358d20",
-    "@endo/far": "^0.2.19"
+    "@agoric/store": "0.9.3-dev-8baf0aa.0+8baf0aa",
+    "@agoric/vat-data": "0.5.3-dev-8baf0aa.0+8baf0aa",
+    "@endo/exo": "^0.2.3",
+    "@endo/far": "^0.2.19",
+    "@endo/pass-style": "^0.1.4"
+  },
+  "devDependencies": {
+    "@agoric/swingset-vat": "0.32.3-dev-8baf0aa.0+8baf0aa",
+    "ava": "^5.3.0"
   },
   "publishConfig": {
     "access": "public"
@@ -42,5 +48,5 @@
     "timeout": "20m",
     "workerThreads": false
   },
-  "gitHead": "8358d208a105af24bc267ba4ef928ca7ecf6a4e3"
+  "gitHead": "8baf0aabe3cadeb1cd07fd30641d11baf3e68eaf"
 }

package/src/durable.js

@@ -1,5 +1,7 @@
+// @ts-check
 // @jessie-check
 
+import { Far } from '@endo/far';
 import {
   canBeDurable,
   makeScalarMapStore,
@@ -10,20 +12,33 @@ import {
   provideDurableSetStore,
   provideDurableWeakMapStore,
   provideDurableWeakSetStore,
-  M,
 } from '@agoric/vat-data';
 
-import { Far } from '@endo/far';
+import { makeOnceKit } from './make-once.js';
+import { agoricVatDataKeys as keys } from './keys.js';
+import { isPassable } from './is-passable.js';
 
 const { Fail } = assert;
 
+/**
+ * A variant of `canBeDurable` that returns `false` instead of ever throwing.
+ *
+ * @param {unknown} specimen
+ * @returns {boolean}
+ */
+const isStorable = specimen => isPassable(specimen) && canBeDurable(specimen);
+harden(isStorable);
+
 /**
  * @param {() => import('@agoric/vat-data').Baggage} getBaggage
  */
 const attachDurableStores = getBaggage => {
   /** @type {import('.').Zone['mapStore']} */
-  const mapStore = (label, options) =>
-    provideDurableMapStore(getBaggage(), label, options);
+  const mapStore = (label, options) => {
+    const baggage = getBaggage();
+    const ret = provideDurableMapStore(baggage, label, options);
+    return ret;
+  };
   /** @type {import('.').Zone['setStore']} */
   const setStore = (label, options) =>
     provideDurableSetStore(getBaggage(), label, options);
@@ -38,7 +53,7 @@ const attachDurableStores = getBaggage => {
   return Far('durableStores', {
     // eslint-disable-next-line no-use-before-define
     detached: () => detachedDurableStores,
-    isStorable: canBeDurable,
+    isStorable,
     mapStore,
     setStore,
     weakMapStore,
@@ -47,7 +62,7 @@ const attachDurableStores = getBaggage => {
 };
 
 /** @type {import('.').Stores} */
-export const detachedDurableStores = attachDurableStores(() =>
+const detachedDurableStores = attachDurableStores(() =>
   makeScalarMapStore('detached'),
 );
 
@@ -55,10 +70,20 @@ export const detachedDurableStores = attachDurableStores(() =>
  * Create a zone whose objects persist between Agoric vat upgrades.
  *
  * @param {import('@agoric/vat-data').Baggage} baggage
+ * @param {string} [baseLabel]
  * @returns {import('.').Zone}
  */
-export const makeDurableZone = baggage => {
+export const makeDurableZone = (baggage, baseLabel = 'durableZone') => {
   baggage || Fail`baggage required`;
+
+  const attachedStores = attachDurableStores(() => baggage);
+
+  const { makeOnce, wrapProvider } = makeOnceKit(
+    baseLabel,
+    attachedStores,
+    baggage,
+  );
+
   /** @type {import('.').Zone['exoClass']} */
   const exoClass = (...args) => prepareExoClass(baggage, ...args);
   /** @type {import('.').Zone['exoClassKit']} */
@@ -66,22 +91,28 @@ export const makeDurableZone = baggage => {
   /** @type {import('.').Zone['exo']} */
   const exo = (...args) => prepareExo(baggage, ...args);
 
-  const attachedStores = attachDurableStores(() => baggage);
+  const subZoneStore = wrapProvider(attachedStores.mapStore, keys.zone);
 
   /** @type {import('.').Zone['subZone']} */
   const subZone = (label, options = {}) => {
-    const subBaggage = provideDurableMapStore(baggage, label, options);
-    return makeDurableZone(subBaggage);
+    const subBaggage = subZoneStore(label, options);
+    return makeDurableZone(subBaggage, `${baseLabel}.${label}`);
   };
 
   return Far('durableZone', {
-    exo,
-    exoClass,
-    exoClassKit,
+    exo: wrapProvider(exo, keys.exo),
+    exoClass: wrapProvider(exoClass, keys.exoClass),
+    exoClassKit: wrapProvider(exoClassKit, keys.exoClassKit),
     subZone,
-    ...attachedStores,
+
+    makeOnce,
+    detached: attachedStores.detached,
+    isStorable: attachedStores.isStorable,
+
+    mapStore: wrapProvider(attachedStores.mapStore, keys.store),
+    setStore: wrapProvider(attachedStores.setStore, keys.store),
+    weakMapStore: wrapProvider(attachedStores.weakMapStore, keys.store),
+    weakSetStore: wrapProvider(attachedStores.weakSetStore, keys.store),
   });
 };
 harden(makeDurableZone);
-
-export { M };

package/src/heap.js

@@ -1,24 +1,25 @@
+// @ts-check
 // @jessie-check
 
+import { Far } from '@endo/far';
+import { makeExo, defineExoClass, defineExoClassKit } from '@endo/exo';
 import {
-  makeExo,
-  defineExoClass,
-  defineExoClassKit,
   makeScalarMapStore,
   makeScalarSetStore,
   makeScalarWeakMapStore,
   makeScalarWeakSetStore,
-  M,
 } from '@agoric/store';
 
-import { Far } from '@endo/far';
+import { makeOnceKit } from './make-once.js';
+import { agoricVatDataKeys as keys } from './keys.js';
+import { isPassable } from './is-passable.js';
 
 /**
  * @type {import('.').Stores}
  */
-const heapStores = Far('heapStores', {
-  detached: () => heapStores,
-  isStorable: _specimen => true,
+const detachedHeapStores = Far('heapStores', {
+  detached: () => detachedHeapStores,
+  isStorable: isPassable,
 
   setStore: makeScalarSetStore,
   mapStore: makeScalarMapStore,
@@ -27,16 +28,35 @@ const heapStores = Far('heapStores', {
 });
 
 /**
- * A heap (in-memory) zone that uses the default exo and store implementations.
+ * Create a heap (in-memory) zone that uses the default exo and store implementations.
  *
- * @type {import('.').Zone}
+ * @param {string} [baseLabel]
+ * @returns {import('.').Zone}
  */
-export const heapZone = Far('heapZone', {
-  exoClass: defineExoClass,
-  exoClassKit: defineExoClassKit,
-  exo: makeExo,
-  subZone: (_label, _options) => heapZone,
-  ...heapStores,
-});
+export const makeHeapZone = (baseLabel = 'heapZone') => {
+  const { makeOnce, wrapProvider } = makeOnceKit(baseLabel, detachedHeapStores);
+
+  /**
+   * @param {string} label
+   * @param {any} _options
+   */
+  const makeSubZone = (label, _options) =>
+    makeHeapZone(`${baseLabel}.${label}`);
+
+  return Far('heapZone', {
+    exo: wrapProvider(makeExo, keys.exo),
+    exoClass: wrapProvider(defineExoClass, keys.exoClass),
+    exoClassKit: wrapProvider(defineExoClassKit, keys.exoClassKit),
+    subZone: wrapProvider(makeSubZone),
+
+    makeOnce,
+    detached: detachedHeapStores.detached,
+    isStorable: detachedHeapStores.isStorable,
 
-export { M };
+    mapStore: wrapProvider(detachedHeapStores.mapStore),
+    setStore: wrapProvider(detachedHeapStores.setStore),
+    weakMapStore: wrapProvider(detachedHeapStores.weakMapStore),
+    weakSetStore: wrapProvider(detachedHeapStores.weakSetStore),
+  });
+};
+harden(makeHeapZone);

package/src/index.js

@@ -19,6 +19,7 @@ defineExoClassKit;
  * @property {typeof makeExo} exo create a singleton exo-object instance bound to this zone
  * @property {typeof defineExoClass} exoClass create a maker function that can be used to create exo-objects bound to this zone
  * @property {typeof defineExoClassKit} exoClassKit create a "kit" maker function that can be used to create a record of exo-objects sharing the same state
+ * @property {<T>(key: string, maker: (key: string) => T) => T} makeOnce create or retrieve a singleton object bound to this zone
  * @property {(label: string, options?: StoreOptions) => Zone} subZone create a new Zone that can be passed to untrusted consumers without exposing the storage of the parent zone
  */
 

package/src/is-passable.js

@@ -0,0 +1,23 @@
+import { passStyleOf } from '@endo/pass-style';
+
+/**
+ * Is `specimen` Passable? This returns true iff `passStyleOf(specimen)`
+ * returns a string. This returns `false` iff `passStyleOf(specimen)` throws.
+ * Under no normal circumstance should `isPassable(specimen)` throw.
+ *
+ * TODO implement an isPassable that does not rely on try/catch, and
+ * move it to @endo/pass-style.
+ * This implementation is just a standin until then
+ *
+ * @param {any} specimen
+ * @returns {specimen is Passable}
+ */
+export const isPassable = specimen => {
+  try {
+    // In fact, it never returns undefined. It either returns a
+    // string or throws.
+    return passStyleOf(specimen) !== undefined;
+  } catch (_) {
+    return false;
+  }
+};

package/src/keys.js

@@ -0,0 +1,14 @@
+/** @param {string} label */
+const kind = label => `${label}_kindHandle`;
+/** @param {string} label */
+const singleton = label => `${label}_singleton`;
+
+/** @type {Record<'exoClass' | 'exoClassKit' | 'exo' | 'store' | 'zone', (label: string) => string[]>} */
+export const agoricVatDataKeys = {
+  exoClass: label => harden([kind(label)]),
+  exoClassKit: label => harden([kind(label)]),
+  exo: label => harden([kind(label), singleton(label)]),
+  store: label => harden([label]),
+  zone: label => harden([label]),
+};
+harden(agoricVatDataKeys);

package/src/make-once.js

@@ -0,0 +1,86 @@
+// @ts-check
+const { Fail } = assert;
+
+/** @param {string} label */
+const defaultLabelToKeys = label => harden([label]);
+harden(defaultLabelToKeys);
+
+/**
+ * @param {string} debugName Only used internally for diagnostics, not available to user code
+ * @param {import('.').Stores} stores
+ * @param {MapStore<string, any>} [backingStore]
+ */
+export const makeOnceKit = (debugName, stores, backingStore = undefined) => {
+  // We need a detached setStore so that it isn't persisted as part of the zone.
+  // That way, our usedKeys are only tracked for the current incarnation, which
+  // is what we want.  Using `debugName` in the label is good for diagnostics,
+  // and since it is only for a detached store, it should not be visible to the
+  // backing store.
+  const usedKeys = stores.detached().setStore(`${debugName} used keys`);
+
+  /**
+   * @param {string} key
+   */
+  const assertOnlyOnce = key => {
+    typeof key === 'string' || Fail`key ${key} must be a string`;
+    !usedKeys.has(key) ||
+      Fail`key ${key} has already been used in this zone and incarnation`;
+
+    // Mark this key as used.  We make no attempt to recover from invalid makers
+    // or backingStores.
+    usedKeys.add(key);
+  };
+
+  /**
+   * Ensure the wrapped function is only called once per incarnation.  It is
+   * expected to update the backing store directly.
+   *
+   * @template {(key: string, ...rest: unknown[]) => any} T
+   * @param {T} provider
+   * @param {(label: string) => string[]} [labelToKeys]
+   * @returns {T}
+   */
+  const wrapProvider = (provider, labelToKeys = defaultLabelToKeys) => {
+    /** @type {(...args: Parameters<T>) => ReturnType<T>} */
+    const wrapper = (label, ...rest) => {
+      for (const key of labelToKeys(label)) {
+        assertOnlyOnce(key);
+      }
+      return provider(label, ...rest);
+    };
+    return /** @type {T} */ (wrapper);
+  };
+
+  /**
+   * The best way to understand the purpose of `makeOnce` is to first understand
+   * what `makeOnce` does on a durable zone. Used correctly, `makeOnce` should only
+   * be called at most once on any zone,key pair during any vat incarnation.
+   * Given that constraint, if there is already a value bound to that
+   * zone,key pair, it must have been left there by a previous incarnation and
+   * `makeOnce` will simply return it. If not, then `maker(key)` is called to
+   * determine the initial value of that slot, which will normally be preserved
+   * by similar calls to `makeOnce` in future incarnations --- though that will be
+   * up to them.
+   *
+   * Also ensures the maker returns a storable value.
+   *
+   * @template V
+   * @param {string} key The string name of the Zone slot to provide.
+   * @param {(key: string) => V} maker Called to create a fresh value to fill an empty slot.
+   * @returns {V} The value of the key's slot.
+   */
+  const makeOnce = (key, maker) => {
+    assertOnlyOnce(key);
+    if (backingStore && backingStore.has(key)) {
+      return backingStore.get(key);
+    }
+    const value = maker(key);
+    stores.isStorable(value) ||
+      Fail`maker return value ${value} is not storable`;
+    backingStore && backingStore.init(key, value);
+    return value;
+  };
+
+  return harden({ makeOnce, wrapProvider });
+};
+harden(makeOnceKit);

package/src/virtual.js

@@ -1,17 +1,19 @@
+// @ts-check
 // @jessie-check
 
+import { Far } from '@endo/far';
 import {
-  canBeDurable,
   defineVirtualExoClass,
   defineVirtualExoClassKit,
   makeScalarBigMapStore,
   makeScalarBigSetStore,
   makeScalarBigWeakMapStore,
   makeScalarBigWeakSetStore,
-  M,
 } from '@agoric/vat-data';
 
-import { Far } from '@endo/far';
+import { makeOnceKit } from './make-once.js';
+import { agoricVatDataKeys as keys } from './keys.js';
+import { isPassable } from './is-passable.js';
 
 const emptyRecord = harden({});
 const initEmpty = harden(() => emptyRecord);
@@ -22,7 +24,7 @@ const initEmpty = harden(() => emptyRecord);
  *
  * @type {import('.').Zone['exo']}
  */
-const defineVirtualExo = (
+const makeVirtualExo = (
   label,
   interfaceGuard,
   methods,
@@ -43,9 +45,9 @@ const defineVirtualExo = (
 };
 
 /** @type {import('.').Stores} */
-export const detachedVirtualStores = Far('virtualStores', {
+const detachedVirtualStores = Far('virtualStores', {
   detached: () => detachedVirtualStores,
-  isStorable: canBeDurable,
+  isStorable: isPassable,
   mapStore: makeScalarBigMapStore,
   setStore: makeScalarBigSetStore,
   weakMapStore: makeScalarBigWeakMapStore,
@@ -56,15 +58,35 @@ export const detachedVirtualStores = Far('virtualStores', {
  * A zone that utilizes external storage to reduce the memory footprint of the
  * current vat.
  *
- * @type {import('.').Zone}
+ * @param {string} [baseLabel]
+ * @returns {import('.').Zone}
  */
-export const virtualZone = Far('virtualZone', {
-  exo: defineVirtualExo,
-  exoClass: defineVirtualExoClass,
-  exoClassKit: defineVirtualExoClassKit,
-  subZone: (_label, _options = {}) => virtualZone,
+export const makeVirtualZone = (baseLabel = 'virtualZone') => {
+  const { makeOnce, wrapProvider } = makeOnceKit(
+    baseLabel,
+    detachedVirtualStores,
+  );
 
-  ...detachedVirtualStores,
-});
+  /**
+   * @param {string} label
+   * @param {any} _options
+   */
+  const makeSubZone = (label, _options) =>
+    makeVirtualZone(`${baseLabel}.${label}`);
 
-export { M };
+  return Far('virtualZone', {
+    exo: wrapProvider(makeVirtualExo, keys.exo),
+    exoClass: wrapProvider(defineVirtualExoClass, keys.exoClass),
+    exoClassKit: wrapProvider(defineVirtualExoClassKit, keys.exoClassKit),
+    subZone: wrapProvider(makeSubZone),
+
+    makeOnce,
+    detached: detachedVirtualStores.detached,
+    isStorable: detachedVirtualStores.isStorable,
+
+    mapStore: wrapProvider(detachedVirtualStores.mapStore),
+    setStore: wrapProvider(detachedVirtualStores.setStore),
+    weakMapStore: wrapProvider(detachedVirtualStores.weakMapStore),
+    weakSetStore: wrapProvider(detachedVirtualStores.weakSetStore),
+  });
+};

package/test/prepare-test-env-ava.js

@@ -0,0 +1,19 @@
+import '@agoric/swingset-vat/tools/prepare-test-env-ava.js';
+import { reincarnate } from '@agoric/swingset-vat/tools/setup-vat-data.js';
+
+export { test } from '@agoric/swingset-vat/tools/prepare-test-env-ava.js';
+
+/** @type {ReturnType<typeof reincarnate>} */
+let incarnation;
+
+export const annihilate = () => {
+  incarnation = reincarnate({ relaxDurabilityRules: false });
+};
+
+export const getBaggage = () => {
+  return incarnation.fakeVomKit.cm.provideBaggage();
+};
+
+export const nextLife = () => {
+  incarnation = reincarnate(incarnation);
+};

package/test/test-exos.js

@@ -0,0 +1,268 @@
+// eslint-disable-next-line import/order
+import {
+  annihilate,
+  getBaggage,
+  nextLife,
+  test,
+} from './prepare-test-env-ava.js';
+
+import { M } from '@agoric/store';
+import * as vatData from '@agoric/vat-data';
+
+import { makeDurableZone } from '../durable.js';
+import { makeHeapZone } from '../heap.js';
+import { makeVirtualZone } from '../virtual.js';
+import { agoricVatDataKeys as keys } from '../src/keys.js';
+
+/** @typedef {import('../src/index.js').Zone} Zone */
+
+// CAUTION: Do not modify this list; it exists to ensure that future versions
+// of @agoric/zone are compatible with the baggage created by older versions,
+// including the legacy implementation of @agoric/vat-data.
+const agoricVatDataCompatibleKeys = [
+  'Greeter_kindHandle',
+  'GreeterKit_kindHandle',
+  'a_kindHandle',
+  'a_singleton',
+  'mappish',
+  'subsub',
+].sort();
+
+const bindAllMethodsTo = (obj, that = obj) =>
+  Object.fromEntries(
+    Object.entries(obj).map(([name, fn]) => [name, fn.bind(that)]),
+  );
+
+const greetGuard = M.interface('Greeter', {
+  greet: M.call().optional(M.string()).returns(M.string()),
+});
+const greetFacet = {
+  greet(greeting = 'Hello') {
+    return `${greeting}, ${this.state.nick}`;
+  },
+};
+
+const adminGuard = M.interface('GreeterAdmin', {
+  setNick: M.call(M.string()).returns(),
+});
+const adminFacet = {
+  setNick(nick) {
+    this.state.nick = nick;
+  },
+};
+
+const combinedGuard = M.interface('GreeterWithAdmin', {
+  ...greetGuard.methodGuards,
+  ...adminGuard.methodGuards,
+});
+
+const alreadyExceptionSpec = {
+  message: /has already been used/,
+};
+
+const prepareGreeterSingleton = (zone, label, nick) => {
+  const myThis = Object.freeze({ state: { nick } });
+  return zone.exo(label, combinedGuard, {
+    ...bindAllMethodsTo(greetFacet, myThis),
+    ...bindAllMethodsTo(adminFacet, myThis),
+  });
+};
+
+const prepareGreeter = zone =>
+  zone.exoClass('Greeter', combinedGuard, nick => ({ nick }), {
+    ...greetFacet,
+    ...adminFacet,
+  });
+
+const prepareGreeterKit = zone =>
+  zone.exoClassKit(
+    'GreeterKit',
+    { greeter: greetGuard, admin: adminGuard },
+    nick => ({ nick }),
+    {
+      greeter: greetFacet,
+      admin: adminFacet,
+    },
+  );
+
+const testGreeter = (t, nick, obj, adminObj = obj) => {
+  t.is(obj.greet('Greetings'), `Greetings, ${nick}`);
+  t.is(obj.greet(), `Hello, ${nick}`);
+  adminObj.setNick(`${nick}2`);
+  t.is(obj.greet('Greetings'), `Greetings, ${nick}2`);
+  t.is(obj.greet(), `Hello, ${nick}2`);
+  adminObj.setNick(nick);
+};
+
+/**
+ * @template T
+ * @param {import('ava').Assertions} t
+ * @param {() => T} fn
+ * @param {*} spec
+ * @returns {T}
+ */
+const secondThrows = (t, fn, spec = alreadyExceptionSpec) => {
+  const ret = fn();
+  t.throws(fn, spec);
+  return ret;
+};
+
+/**
+ * @param {import('ava').Assertions} t
+ * @param {MapStore} baggage
+ */
+const testFirstVatDataIncarnation = (t, baggage) => {
+  const subBaggage = vatData.provideDurableMapStore(baggage, 'sub');
+
+  const myThis = Object.freeze({ state: { nick: 'Singly' } });
+  const singly = vatData.prepareExo(subBaggage, 'a', combinedGuard, {
+    ...bindAllMethodsTo(greetFacet, myThis),
+    ...bindAllMethodsTo(adminFacet, myThis),
+  });
+  testGreeter(t, 'Singly', singly);
+
+  const makeGreeter = vatData.prepareExoClass(
+    subBaggage,
+    'Greeter',
+    combinedGuard,
+    nick => ({ nick }),
+    {
+      ...greetFacet,
+      ...adminFacet,
+    },
+  );
+  const classy = makeGreeter('Classy');
+  testGreeter(t, 'Classy', classy);
+
+  const makeGreeterKit = vatData.prepareExoClassKit(
+    subBaggage,
+    'GreeterKit',
+    { greeter: greetGuard, admin: adminGuard },
+    nick => ({ nick }),
+    {
+      greeter: greetFacet,
+      admin: adminFacet,
+    },
+  );
+  const { greeter: kitty, admin: kittyAdmin } = makeGreeterKit('Kitty');
+  testGreeter(t, 'Kitty', kitty, kittyAdmin);
+
+  const mappish = vatData.provideDurableMapStore(subBaggage, 'mappish');
+  mappish.init('singly', singly);
+  mappish.init('classy', classy);
+  mappish.init('kitty', kitty);
+  mappish.init('kittyAdmin', kittyAdmin);
+
+  vatData.provideDurableMapStore(subBaggage, 'subsub');
+};
+
+/**
+ * @param {import('ava').Assertions} t
+ * @param {Zone} rootZone
+ */
+const testFirstZoneIncarnation = (t, rootZone) => {
+  const subZone = secondThrows(t, () => rootZone.subZone('sub'));
+  const singly = secondThrows(t, () =>
+    prepareGreeterSingleton(subZone, 'a', 'Singly'),
+  );
+  testGreeter(t, 'Singly', singly);
+
+  const makeGreeter = secondThrows(t, () => prepareGreeter(subZone));
+  const classy = makeGreeter('Classy');
+  testGreeter(t, 'Classy', classy);
+
+  const makeGreeterKit = secondThrows(t, () => prepareGreeterKit(subZone));
+
+  const { greeter: kitty, admin: kittyAdmin } = makeGreeterKit('Kitty');
+  testGreeter(t, 'Kitty', kitty, kittyAdmin);
+
+  const mappish = secondThrows(t, () => subZone.mapStore('mappish'));
+  mappish.init('singly', singly);
+  mappish.init('classy', classy);
+  mappish.init('kitty', kitty);
+  mappish.init('kittyAdmin', kittyAdmin);
+
+  secondThrows(t, () => subZone.subZone('subsub'));
+};
+
+/**
+ * @param {import('ava').Assertions} t
+ * @param {Zone} rootZone
+ */
+const testSecondZoneIncarnation = (t, rootZone) => {
+  const subZone = secondThrows(t, () => rootZone.subZone('sub'));
+  const mappish = secondThrows(t, () => subZone.mapStore('mappish'));
+
+  const singlyReload = secondThrows(t, () =>
+    prepareGreeterSingleton(subZone, 'a', 'Singly'),
+  );
+  const makeGreeter = secondThrows(t, () => prepareGreeter(subZone));
+  const makeGreeterKit = secondThrows(t, () => prepareGreeterKit(subZone));
+
+  const singly = mappish.get('singly');
+  t.is(singlyReload, singly);
+  testGreeter(t, 'Singly', singly);
+  testGreeter(t, 'Classy', mappish.get('classy'));
+  testGreeter(t, 'Kitty', mappish.get('kitty'), mappish.get('kittyAdmin'));
+
+  const classy2 = makeGreeter('Classy2');
+  testGreeter(t, 'Classy2', classy2);
+
+  const { greeter: kitty2, admin: kittyAdmin2 } = makeGreeterKit('Kitty2');
+  testGreeter(t, 'Kitty2', kitty2, kittyAdmin2);
+};
+
+test('heapZone', t => {
+  const zone = makeHeapZone();
+  testFirstZoneIncarnation(t, zone);
+});
+
+test.serial('virtualZone', t => {
+  annihilate();
+  const zone = makeVirtualZone();
+  testFirstZoneIncarnation(t, zone);
+});
+
+test.serial('durableZone', t => {
+  annihilate();
+
+  const expectedKeys = [
+    ...keys.exo('a'),
+    ...keys.exoClass('Greeter'),
+    ...keys.exoClassKit('GreeterKit'),
+    ...keys.store('mappish'),
+    ...keys.zone('subsub'),
+  ].sort();
+  t.deepEqual(agoricVatDataCompatibleKeys, expectedKeys);
+
+  nextLife();
+  const baggage1 = getBaggage();
+  testFirstZoneIncarnation(t, makeDurableZone(baggage1));
+  t.deepEqual(
+    [...baggage1.get('sub').keys()].sort(),
+    agoricVatDataCompatibleKeys,
+  );
+
+  nextLife();
+  const baggage2 = getBaggage();
+  t.deepEqual(
+    [...baggage2.get('sub').keys()].sort(),
+    agoricVatDataCompatibleKeys,
+  );
+  testSecondZoneIncarnation(t, makeDurableZone(baggage2));
+});
+
+test.serial('vatData migrate to durableZone', t => {
+  annihilate();
+
+  const baggage1 = getBaggage();
+  testFirstVatDataIncarnation(t, baggage1);
+  t.deepEqual(
+    [...baggage1.get('sub').keys()].sort(),
+    agoricVatDataCompatibleKeys,
+  );
+
+  nextLife();
+  const baggage2 = getBaggage();
+  testSecondZoneIncarnation(t, makeDurableZone(baggage2));
+});

package/test/test-make-once.js

@@ -0,0 +1,66 @@
+import {
+  annihilate,
+  getBaggage,
+  nextLife,
+  test,
+} from './prepare-test-env-ava.js';
+
+import { makeDurableZone } from '../durable.js';
+import { makeHeapZone } from '../heap.js';
+import { makeVirtualZone } from '../virtual.js';
+
+/** @typedef {import('../src/index.js').Zone} Zone */
+
+/**
+ * @param {import('ava').Assertions} t
+ * @param {Zone} rootZone
+ */
+const testOnce = (t, rootZone) => {
+  const subZone = rootZone.subZone('sub');
+  const a = subZone.makeOnce('a', () => 'A');
+  t.is(a, 'A');
+  t.throws(() => subZone.makeOnce('a', () => 'A'), {
+    message: /has already been used/,
+  });
+  const nonPassable = harden({
+    hello() {
+      return 'world';
+    },
+  });
+  t.is(rootZone.isStorable(nonPassable), false);
+  t.is(subZone.isStorable(123), true);
+  t.throws(() => rootZone.makeOnce('nonPassable', () => nonPassable), {
+    message: /is not storable/,
+  });
+};
+
+test('heapZone', t => {
+  testOnce(t, makeHeapZone());
+});
+
+test.serial('virtualZone', t => {
+  testOnce(t, makeVirtualZone());
+});
+
+test.serial('durableZone', t => {
+  annihilate();
+  const rootBaggage = getBaggage();
+  const rootDurableZone = makeDurableZone(rootBaggage);
+  testOnce(t, rootDurableZone);
+
+  // Do we actually want to refuse to use the same baggage twice?
+  const secondDurableZone = makeDurableZone(rootBaggage);
+  testOnce(t, secondDurableZone);
+  const subDurableZone = makeDurableZone(rootBaggage).subZone('sub');
+  t.is(
+    subDurableZone.makeOnce('a', () => 'B'),
+    'A',
+  );
+  t.throws(() => subDurableZone.makeOnce('a', () => 'B'), {
+    message: /has already been used/,
+  });
+
+  nextLife();
+  const thirdDurableZone = makeDurableZone(getBaggage());
+  testOnce(t, thirdDurableZone);
+});