@nervur-org/dock 0.3.0

package/dist/human/worker.bundle.txt

@@ -0,0 +1,3868 @@
+var __defProp = Object.defineProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+
+// ../quo/dist/being/being.js
+var RESERVED = /* @__PURE__ */ new Set(["answer", "describe", "stance", "cells", "standings", "occupants", "occupant", "invite", "knock", "take", "boot", "lend", "constructor"]);
+var wrote = (self, name) => {
+  for (let p = Object.getPrototypeOf(self); p !== null && p !== Object.prototype; p = Object.getPrototypeOf(p)) {
+    if (Object.hasOwn(p, name))
+      return typeof p[name] === "function";
+  }
+  return false;
+};
+var Being = class {
+  // Her cells' defaults. Merged in at birth, only where a key is missing, so
+  // a restart keeps what she wrote.
+  static cells = {};
+  // What she can be asked. Declaration order is blueprint order, except a
+  // name that reads as an array index, which the language lists first.
+  static asks = {};
+  stance;
+  constructor(stance) {
+    this.stance = stance;
+    const C = this.constructor;
+    for (const name of Object.keys(C.asks)) {
+      if (RESERVED.has(name))
+        throw new Error(`ask '${name}' is a reserved name`);
+      if (!wrote(this, name))
+        throw new Error(`ask '${name}' has no method on the prototype`);
+    }
+    for (const [k, v] of Object.entries(C.cells))
+      if (!Object.hasOwn(stance.cells, k))
+        stance.cells[k] = structuredClone(v);
+  }
+  get cells() {
+    return this.stance.cells;
+  }
+  get standings() {
+    return this.stance.standings;
+  }
+  get occupants() {
+    return this.stance.occupants;
+  }
+  // A standing at one of the things this device can do, under an id of hers.
+  // The ward knocks and takes it for her; the invitation never reaches her.
+  lend(name, id) {
+    return this.stance.lend(name, id);
+  }
+  invite(id, notes) {
+    return this.stance.occupants.invite(id, notes);
+  }
+  knock(invitation, method, args, wanted) {
+    return this.stance.standings.knock(invitation, method, args, wanted);
+  }
+  take(id, invitation) {
+    return this.stance.standings.take(id, invitation);
+  }
+  // A new being of her ward, by class name, under a key she chooses. With an
+  // id, she holds a standing to the being she made, who knows her by her key.
+  boot(className, key, id) {
+    return this.stance.boot(className, key, id);
+  }
+  // The occupant record for whoever is at the door. Undefined at a public being.
+  occupant(asker) {
+    return asker.id !== void 0 && Object.hasOwn(this.cells.occupants, asker.id) ? this.cells.occupants[asker.id] : void 0;
+  }
+  // Her blueprint for this asker. Override to shape it by hand.
+  describe(asker) {
+    const C = this.constructor;
+    const rec = this.occupant(asker);
+    const asks = [];
+    for (const [name, spec] of Object.entries(C.asks)) {
+      if (spec.for && !spec.for(rec, asker))
+        continue;
+      const ask = { name, input: spec.input ?? { type: "object" } };
+      if (spec.description !== void 0)
+        ask.description = spec.description;
+      if (spec.output !== void 0)
+        ask.output = spec.output;
+      asks.push(ask);
+    }
+    return { asks, notes: {} };
+  }
+  // The one function. Override to wrap it; call super to keep the dispatch.
+  async answer(asker, method, args = {}) {
+    if (method === void 0)
+      return this.describe(asker);
+    const C = this.constructor;
+    const spec = Object.hasOwn(C.asks, method) ? C.asks[method] : void 0;
+    if (!spec || spec.for && !spec.for(this.occupant(asker), asker))
+      return { error: "unknown ask" };
+    const fn = this[method];
+    return fn.call(this, args ?? {}, asker);
+  }
+};
+
+// ../quo/dist/being/types.js
+var OWNER = "OWNER";
+var PUBLIC = "PUBLIC";
+var RESERVED_IDS = [OWNER, PUBLIC];
+var isInvitation = (v) => {
+  if (v === null || typeof v !== "object" || Array.isArray(v))
+    return false;
+  const o = v;
+  if (typeof o.ward !== "string" || !/^[0-9a-f]{128}$/.test(o.ward))
+    return false;
+  const heir = typeof o.heir === "string", secret = typeof o.secret === "string";
+  return heir && secret || !heir && !secret && !("heir" in o) && !("secret" in o);
+};
+var isBlueprint = (v) => {
+  if (v === null || typeof v !== "object" || Array.isArray(v))
+    return false;
+  const { asks, notes } = v;
+  if (!Array.isArray(asks) || notes === void 0)
+    return false;
+  return asks.every((a) => a !== null && typeof a === "object" && !Array.isArray(a) && typeof a.name === "string" && a.input !== null && typeof a.input === "object" && !Array.isArray(a.input));
+};
+var WORD_KEY = /* @__PURE__ */ Symbol.for("quo.word");
+
+// ../quo/dist/being/silence.js
+var silence = /* @__PURE__ */ Symbol.for("quo.silence");
+var isSilence = (x) => x === silence;
+var DOOR_WORDS = ["removed", "absent", "unannounced", "repeated", "threw"];
+var isDoorWord = (s) => typeof s === "string" && DOOR_WORDS.includes(s);
+var WORDS = /* @__PURE__ */ new Map();
+var word = (name) => {
+  let w = WORDS.get(name);
+  if (!w)
+    WORDS.set(name, w = Object.freeze({ [WORD_KEY]: name }));
+  return w;
+};
+var isWord = (x) => x !== null && typeof x === "object" && typeof x[WORD_KEY] === "string";
+var wordOf = (x) => x[WORD_KEY];
+var unreached = () => word("unreached");
+
+// ../quo/dist/being/digest.js
+var absent = (v) => v === void 0 || typeof v === "function" || typeof v === "symbol";
+var canonical = (v) => {
+  if (Array.isArray(v))
+    return `[${Array.from(v, (slot) => absent(slot) ? "null" : canonical(slot)).join(",")}]`;
+  if (v !== null && typeof v === "object") {
+    return `{${Object.keys(v).filter((k) => !absent(v[k])).sort().map((k) => `${JSON.stringify(k)}:${canonical(v[k])}`).join(",")}}`;
+  }
+  return JSON.stringify(v);
+};
+var hex = (bytes) => Array.from(new Uint8Array(bytes), (b) => b.toString(16).padStart(2, "0")).join("");
+var subtle = () => {
+  const s = globalThis.crypto?.subtle;
+  if (!s)
+    throw new Error("this terrain has no crypto.subtle: a being needs a secure context to be described");
+  return s;
+};
+var digest = async (blueprint) => hex(await subtle().digest("SHA-256", new TextEncoder().encode(canonical(blueprint))));
+
+// beings/look.ts
+var COLOUR = /^#[0-9a-fA-F]{3,8}$/;
+var FONT = /^[\w\s,'"-]{1,80}$/;
+var LOGO = /^data:image\/(svg\+xml|png|jpeg|webp);base64,[A-Za-z0-9+/=]{1,40000}$/;
+var NAME = /^[^<>&]{1,60}$/;
+var ICON = /^[^<>&"']{1,8}$/;
+var STANDS = 8;
+var ORIGIN = 200;
+var str = (v, re) => typeof v === "string" && re.test(v) ? v : void 0;
+function sanitise(v) {
+  if (v === null || v === void 0 || typeof v !== "object" || Array.isArray(v)) return {};
+  const l = {};
+  const name = str(v.name, NAME);
+  if (name !== void 0) l.name = name;
+  const logo = str(v.logo, LOGO);
+  if (logo !== void 0) l.logo = logo;
+  for (const k of ["accent", "background", "foreground"]) {
+    const c = str(v[k], COLOUR);
+    if (c !== void 0) l[k] = c;
+  }
+  const font = str(v.font, FONT);
+  if (font !== void 0) l.font = font;
+  if (typeof v.radius === "number" && Number.isFinite(v.radius) && v.radius >= 0 && v.radius <= 40) l.radius = Math.round(v.radius);
+  if (Array.isArray(v.order)) l.order = v.order.filter((x) => typeof x === "string");
+  if (Array.isArray(v.stands)) {
+    const stands = [];
+    for (const x of v.stands.slice(0, STANDS)) {
+      if (typeof x !== "string" || x.length > ORIGIN) continue;
+      try {
+        const u = new URL(x);
+        if ((u.protocol === "https:" || u.protocol === "http:") && !stands.includes(u.origin)) stands.push(u.origin);
+      } catch {
+      }
+    }
+    if (stands.length) l.stands = stands;
+  }
+  if (v.asks !== null && typeof v.asks === "object" && !Array.isArray(v.asks)) {
+    const asks = {};
+    for (const [ask, h] of Object.entries(v.asks)) {
+      if (h === null || typeof h !== "object" || Array.isArray(h)) continue;
+      const hint2 = {};
+      const title = str(h.title, NAME);
+      if (title !== void 0) hint2.title = title;
+      const icon = str(h.icon, ICON);
+      if (icon !== void 0) hint2.icon = icon;
+      for (const k of ["readOnly", "destructive", "idempotent"]) if (typeof h[k] === "boolean") hint2[k] = h[k];
+      if (Object.keys(hint2).length) asks[ask] = hint2;
+    }
+    if (Object.keys(asks).length) l.asks = asks;
+  }
+  return l;
+}
+
+// beings/carry.ts
+function carriedBy(bp) {
+  const out = /* @__PURE__ */ new Set();
+  const notes = bp.notes;
+  const groups2 = notes !== null && typeof notes === "object" && !Array.isArray(notes) ? notes.standings : void 0;
+  if (!groups2 || typeof groups2 !== "object" || Array.isArray(groups2)) return out;
+  for (const g of Object.values(groups2)) {
+    if (Array.isArray(g?.asks)) {
+      for (const n of g.asks) if (typeof n === "string") out.add(n);
+    }
+    if (typeof g?.page === "string") out.add(g.page);
+  }
+  return out;
+}
+var Carrier = class extends Being {
+  // Who sees what she carries. Nobody, until a subclass says who.
+  static carries(_occupant, _asker) {
+    return false;
+  }
+  // Standings that are plumbing: their own asks are never carried, and
+  // what they carry is. A way back to a device is one, by the dock's own
+  // convention, so a bare avatar's inbox never shows on her and a presence
+  // being's faculties do, under `to:<id>-<name>`, which is how home carries
+  // her phone. A subclass may name more.
+  static hidden(id) {
+    return id.startsWith("to:");
+  }
+  // Standings she never reads for carrying at all: a presence being's
+  // standing at her own user being is one, since carrying it would carry
+  // the user being's carrying of her, and round. None, until a subclass
+  // says which.
+  static skips(_id) {
+    return false;
+  }
+  // Which of the standings she carries this asker may see. Every one,
+  // until a subclass keeps some for fewer: a user being shows her own door
+  // to a device that may mint and to nobody else.
+  static shows(_id, _occupant, _asker) {
+    return true;
+  }
+  get carried() {
+    return this.cells.carried ??= {};
+  }
+  get looks() {
+    return this.cells.looks ??= {};
+  }
+  // Her describe with her standings carried into it, for an asker who may
+  // see them. Every other asker gets her describe alone.
+  async blueprint(asker) {
+    const C = this.constructor;
+    const bp = this.describe(asker);
+    if (!C.carries(this.occupant(asker), asker)) return bp;
+    const own = new Set(bp.asks.map((a) => a.name));
+    const carried2 = {};
+    const groups2 = {};
+    const occ = this.occupant(asker);
+    for (const [id, rec] of [...Object.entries(this.cells.standings)].sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0)) {
+      if (C.skips(id)) continue;
+      const st = this.standings[id];
+      if (!st) continue;
+      if (!rec.blueprint || rec.seen !== rec.digest) await st.ask();
+      if (!rec.blueprint) continue;
+      const through = C.hidden(id) ? carriedBy(rec.blueprint) : null;
+      if (through && through.size === 0) continue;
+      const shown = C.shows(id, occ, asker);
+      const names = [];
+      const group = { asks: names };
+      for (const a of rec.blueprint.asks) {
+        if (a.name === "look") continue;
+        if (through && !through.has(a.name)) continue;
+        const name = `${id}-${a.name}`;
+        if (own.has(name)) continue;
+        carried2[name] = { id, ask: a.name };
+        if (!shown) continue;
+        bp.asks.push({ ...a, name });
+        if (a.name === "page") group.page = name;
+        else names.push(name);
+      }
+      if (!shown) continue;
+      if (rec.blueprint.asks.some((a) => a.name === "look")) {
+        const kept = this.looks[id];
+        if (!kept || kept.digest !== rec.digest) {
+          const l = await st.ask("look");
+          this.looks[id] = { digest: rec.digest, look: isSilence(l) || isWord(l) ? {} : sanitise(l) };
+        }
+        group.look = this.looks[id].look;
+      }
+      groups2[id] = group;
+    }
+    for (const id of Object.keys(this.looks)) if (!(id in groups2)) delete this.looks[id];
+    this.cells.carried = carried2;
+    const notes = bp.notes !== null && typeof bp.notes === "object" && !Array.isArray(bp.notes) ? bp.notes : {};
+    return { asks: bp.asks, notes: { ...notes, standings: groups2 } };
+  }
+  async answer(asker, method, args = {}) {
+    if (method === void 0) return this.blueprint(asker);
+    const C = this.constructor;
+    const to = Object.hasOwn(this.carried, method) ? this.carried[method] : void 0;
+    const occ = this.occupant(asker);
+    if (to && C.carries(occ, asker) && C.shows(to.id, occ, asker)) {
+      const st = this.standings[to.id];
+      if (!st) return { error: "unknown ask" };
+      const out = await st.ask(to.ask, args);
+      if (isSilence(out)) return out;
+      if (isWord(out)) return { error: wordOf(out) };
+      return out;
+    }
+    return super.answer(asker, method, args);
+  }
+};
+
+// dock/faculty.ts
+var Faculty = class extends Being {
+  static cells = { watched: {}, minted: 0 };
+  // Someone wants waking. She hands the invitation she minted and says what
+  // to ask her; this knocks it, takes it under an id of this being's own,
+  // and files it. The id never crosses: it is this side's name for the
+  // relation, and the caller's name for the same relation is her own.
+  //
+  // The empty ask is the knock, because every being answers one and asking
+  // for a named ask would make every subscriber owe a method she does not
+  // otherwise need.
+  async watch(args, asker) {
+    const inv = args.invitation;
+    if (!isInvitation(inv) || typeof args.method !== "string") return { error: "an invitation and a method" };
+    const extra = args.args;
+    if (extra !== void 0 && (extra === null || typeof extra !== "object" || Array.isArray(extra))) return { error: "args is one object" };
+    const out = await this.knock(inv);
+    if (isSilence(out) || isWord(out)) return { error: "no way back" };
+    const cells = this.cells;
+    const id = await this.take(`wake:${cells.minted += 1}`, inv);
+    if (id === null) return { error: "not taken" };
+    cells.watched[id] = { by: asker.id ?? "", method: args.method, args: extra ?? {} };
+    await this.welcomed(id);
+    return { watching: id };
+  }
+  // Somebody new is filed, and the answer to her `watch` waits for this. A
+  // faculty that owes a new subscriber something at once says it here: the
+  // timer wakes her, learns when she is next due and arms the box for it, so
+  // a being born long after the box was up is not waiting for a round nobody
+  // scheduled. Most faculties owe nothing, and this is why they say nothing.
+  async welcomed(_id) {
+  }
+  // One round of waking. Each subscriber is asked what she asked to be
+  // asked, with whatever this round adds. A subscriber who removed the
+  // occupant says `removed` once, and her row goes with the standing; there
+  // is nothing to retry and nothing to remember.
+  //
+  // `only` is one subscriber of the round's own choosing, named by this
+  // being's own id for the relation, and it is the same round down to one
+  // row: a faculty that wakes somebody just filed learns exactly what a full
+  // round would have learned about her.
+  //
+  // `dropped` is this being herself: her ward took her out, so the standings
+  // she holds reach nobody. Null says so, and whoever holds the interval puts
+  // it down rather than waking an empty room for as long as the box is up.
+  async woke(round = (w) => w.args, only) {
+    const cells = this.cells;
+    const out = [];
+    for (const [id, w] of Object.entries(cells.watched)) {
+      if (only !== void 0 && id !== only) continue;
+      const said2 = await this.standings[id]?.ask(w.method, round(w));
+      if (said2 === void 0 || isWord(said2) && wordOf(said2) === "dropped") return null;
+      if (isWord(said2) && wordOf(said2) === "removed") {
+        this.standings.remove(id);
+        delete cells.watched[id];
+        continue;
+      }
+      out.push({ id, by: w.by, out: said2 });
+    }
+    return out;
+  }
+  // Who is waiting, by this being's own id for the relation. For a device's
+  // own code and for a suite; it crosses no door.
+  get watching() {
+    return this.cells.watched;
+  }
+};
+var flight = /* @__PURE__ */ new Set();
+var settled = async () => {
+  while (flight.size) {
+    const now = [...flight];
+    await Promise.allSettled(now);
+    for (const p of now) flight.delete(p);
+  }
+};
+function join(b, name, watch, id = name) {
+  const p = joining(b, name, watch, id);
+  flight.add(p);
+  void p.catch(() => {
+  });
+  return p;
+}
+async function joining(b, name, watch, id) {
+  await Promise.resolve();
+  b.standings.remove(id);
+  b.occupants.remove(`${id}:wake`);
+  const got = await b.lend(name, id);
+  if (got === null) return null;
+  if (!watch) return got;
+  const back = await b.invite(`${id}:wake`);
+  if (!back) return got;
+  await b.standings[id]?.ask("watch", { invitation: back, method: watch.method, ...watch.args ? { args: watch.args } : {} });
+  return got;
+}
+
+// dock/console.ts
+var CONSOLE = "console";
+var Console = class extends Carrier {
+  static carries(occupant2, _asker) {
+    return occupant2 !== void 0;
+  }
+};
+
+// beings/way.ts
+var WAY = (kind) => `way:${kind}`;
+var kindOf = (id) => id.startsWith("way:") ? id.slice(4) : null;
+var VERIFY = { description: "who this proof is for", input: { type: "object", properties: { proof: { type: "object" } }, required: ["proof"] } };
+function verified(out) {
+  if (out === null || typeof out !== "object" || Array.isArray(out)) return null;
+  const v = out;
+  if (typeof v.user !== "string" || typeof v.client !== "string") return null;
+  const make = v.make;
+  return {
+    user: v.user,
+    client: v.client,
+    ...v.wake === true ? { wake: true } : {},
+    ...v.reach === true ? { reach: true } : {},
+    ...v.mint === true ? { mint: true } : {},
+    ...v.revoke === true ? { revoke: true } : {},
+    ...make === true || typeof make === "string" ? { make } : {}
+  };
+}
+
+// dock/local.ts
+var LOCAL = "local";
+var Local = class extends Faculty {
+  static asks = { verify: VERIFY };
+  #nonces = /* @__PURE__ */ new Map();
+  // A nonce for one client this box saw itself, spent by the first proof
+  // that names it. The caller drops it when the admit is over: a nonce that
+  // was never spent is not a way in that stays open.
+  mint(nonce, who) {
+    this.#nonces.set(nonce, who);
+  }
+  drop(nonce) {
+    this.#nonces.delete(nonce);
+  }
+  verify(args) {
+    const proof = args.proof;
+    if (!proof || typeof proof !== "object" || Array.isArray(proof)) return null;
+    const nonce = proof.nonce;
+    const who = typeof nonce === "string" ? this.#nonces.get(nonce) : void 0;
+    if (!who) return null;
+    this.#nonces.delete(nonce);
+    return who;
+  }
+};
+
+// dock/location.ts
+var Location = class extends Faculty {
+  static asks = {
+    where: { description: "where this box is", input: { type: "object" } }
+  };
+  // The platform's own permission prompt is the first ask's, and a refusal is
+  // the error object every ask after it answers.
+  where() {
+    return Promise.resolve({ error: "this box cannot say where it is" });
+  }
+};
+
+// ../quo/dist/ward/cells.js
+var DEPTH = 64;
+var BREADTH = 1 << 20;
+var WELL_FORMED = /^(?:[^\uD800-\uDFFF]|[\uD800-\uDBFF][\uDC00-\uDFFF])*$/;
+function walk(v, path, seen2, sized, depth) {
+  if (v === null || typeof v === "boolean")
+    return 1;
+  if (typeof v === "string")
+    return WELL_FORMED.test(v) ? 1 : `${path} carries a lone surrogate, which is no text a harbor can write down`;
+  if (typeof v === "number") {
+    if (!Number.isFinite(v))
+      return `${path} is ${String(v)}, which no harbor can write down`;
+    return Object.is(v, -0) ? `${path} is minus zero, which comes back as zero from every harbor that writes JSON` : 1;
+  }
+  if (typeof v !== "object")
+    return `${path} is a ${typeof v}, which is not a value`;
+  if (seen2.has(v))
+    return `${path} refers back to itself`;
+  const counted = sized.get(v);
+  if (counted !== void 0)
+    return counted;
+  if (depth >= DEPTH)
+    return `${path} is nested past ${DEPTH} levels, which no harbor can keep`;
+  seen2.add(v);
+  try {
+    let size = 1;
+    const under2 = (where, x) => {
+      const r = walk(x, where, seen2, sized, depth + 1);
+      if (typeof r === "string")
+        return r;
+      size += r;
+      return size > BREADTH ? `${path} writes out to more than ${BREADTH} values, which no harbor can keep` : null;
+    };
+    if (Array.isArray(v)) {
+      for (let i = 0; i < v.length; i += 1) {
+        if (!(i in v))
+          return `${path}[${i}] is a hole, which no harbor can write down`;
+        const f = under2(`${path}[${i}]`, v[i]);
+        if (f)
+          return f;
+      }
+      sized.set(v, size);
+      return size;
+    }
+    const proto = Object.getPrototypeOf(v);
+    if (proto !== Object.prototype && proto !== null)
+      return `${path} is a ${v.constructor?.name ?? "object"}, which is not a value`;
+    for (const k of Object.keys(v)) {
+      if (k === "__proto__")
+        return `${path}.__proto__ is a key no harbor can keep`;
+      const f = under2(`${path}.${k}`, v[k]);
+      if (f)
+        return f;
+    }
+    sized.set(v, size);
+    return size;
+  } finally {
+    seen2.delete(v);
+  }
+}
+var cellFault = (v, path) => {
+  const out = walk(v, path, /* @__PURE__ */ new Set(), /* @__PURE__ */ new Map(), 0);
+  return typeof out === "string" ? out : null;
+};
+var WARDS = /* @__PURE__ */ new Set(["standings", "occupants", "class"]);
+var wrapped = /* @__PURE__ */ new WeakMap();
+var targets = /* @__PURE__ */ new WeakMap();
+var guards = /* @__PURE__ */ new WeakSet();
+var unkeepable = (k) => k === "__proto__";
+var refuse = (why) => {
+  throw new TypeError(`cells hold values: ${why}`);
+};
+function keyFault(t, k, v, path, root2) {
+  if (typeof k !== "string")
+    refuse(`${path} takes no symbol key`);
+  if (unkeepable(k))
+    refuse(`${path}.__proto__ is a key no harbor can keep`);
+  if (root2 && WARDS.has(k))
+    refuse(`${path}.${k} is the ward's to write`);
+  if (Array.isArray(t)) {
+    if (k === "length") {
+      if (typeof v !== "number" || v > t.length)
+        refuse(`${path}.length set past what she wrote would leave holes`);
+      return;
+    }
+    const i = Number(k);
+    if (Number.isInteger(i) && i > t.length)
+      refuse(`${path}[${i}] would leave a hole`);
+  }
+}
+function guard(target, path, wrote2, root2 = false) {
+  if (guards.has(target))
+    return target;
+  const had = wrapped.get(target);
+  if (had)
+    return had;
+  const p = new Proxy(target, {
+    get(t, k, r) {
+      const v = Reflect.get(t, k, r);
+      return v !== null && typeof v === "object" && !ArrayBuffer.isView(v) ? guard(v, `${path}.${String(k)}`, wrote2) : v;
+    },
+    set(t, k, v, r) {
+      keyFault(t, k, v, path, root2);
+      const f = cellFault(v, `${path}.${String(k)}`);
+      if (f)
+        refuse(f);
+      const ok = Reflect.set(t, k, v, r);
+      wrote2();
+      return ok;
+    },
+    defineProperty(t, k, d) {
+      if (!("value" in d))
+        refuse(`${path}.${String(k)} is an accessor, which no harbor can keep`);
+      keyFault(t, k, d.value, path, root2);
+      const f = cellFault(d.value, `${path}.${String(k)}`);
+      if (f)
+        refuse(f);
+      const ok = Reflect.defineProperty(t, k, d);
+      wrote2();
+      return ok;
+    },
+    deleteProperty(t, k) {
+      if (root2 && typeof k === "string" && WARDS.has(k))
+        refuse(`${path}.${k} is the ward's to keep`);
+      const ok = Reflect.deleteProperty(t, k);
+      wrote2();
+      return ok;
+    }
+  });
+  wrapped.set(target, p);
+  targets.set(p, target);
+  guards.add(p);
+  return p;
+}
+var guardCells = (cells, wrote2 = () => {
+}) => guard(cells, "cells", wrote2, true);
+var unguarded = (cells) => targets.get(cells) ?? cells;
+
+// ../quo/dist/ward/partition.js
+var VERSION = "pre-1.0.0";
+var READS = [VERSION];
+function upgrade(p) {
+  return p;
+}
+var GONE = 256;
+var MINTED = 8;
+var KNOCKS = 64;
+var prune = (knocks, answered4) => {
+  const names = Object.keys(knocks);
+  if (names.length <= KNOCKS)
+    return;
+  const order = [...names.filter((n) => !answered4[n]), ...names.filter((n) => answered4[n])];
+  for (const old of order.slice(0, names.length - KNOCKS)) {
+    delete knocks[old];
+    delete answered4[old];
+  }
+};
+var fault = (path, want) => {
+  throw new Error(`partition ${path} is not ${want}`);
+};
+var table = (v, path) => typeof v === "object" && v !== null && !Array.isArray(v) ? v : fault(path, "an object");
+var list = (v, path) => Array.isArray(v) ? v : fault(path, "an array");
+var text = (v, path) => void (typeof v === "string" || fault(path, "a string"));
+var orNull = (v, path) => void (v === null || typeof v === "string" || fault(path, "a string or null"));
+var whole = (v, path) => void (Number.isSafeInteger(v) || fault(path, "a whole number"));
+var flag = (v, path) => void (typeof v === "boolean" || fault(path, "true or false"));
+function read(p) {
+  for (const [key, cells] of Object.entries(table(p.beings, "beings"))) {
+    const c = table(cells, `beings.${key}`);
+    table(c.standings, `beings.${key}.standings`);
+    table(c.occupants, `beings.${key}.occupants`);
+    if (c.class !== void 0)
+      text(c.class, `beings.${key}.class`);
+  }
+  for (const [key, bind] of Object.entries(table(p.bind, "bind"))) {
+    const b = table(bind, `bind.${key}`);
+    for (const [id, keys] of Object.entries(table(b.standings, `bind.${key}.standings`))) {
+      const w = `bind.${key}.standings.${id}`;
+      const s = table(keys, w);
+      text(s.ward, `${w}.ward`);
+      orNull(s.heir, `${w}.heir`);
+      text(s.current, `${w}.current`);
+      orNull(s.next, `${w}.next`);
+      whole(s.seq, `${w}.seq`);
+    }
+    for (const [id, pk] of Object.entries(table(b.occupants, `bind.${key}.occupants`)))
+      text(pk, `bind.${key}.occupants.${id}`);
+    for (const [name, keys] of Object.entries(table(b.knocks, `bind.${key}.knocks`))) {
+      const w = `bind.${key}.knocks.${name}`;
+      const k = table(keys, w);
+      text(k.current, `${w}.current`);
+      orNull(k.next, `${w}.next`);
+      flag(k.spoke, `${w}.spoke`);
+      flag(k.sent, `${w}.sent`);
+      whole(k.seq, `${w}.seq`);
+    }
+    table(b.answered, `bind.${key}.answered`);
+    for (const [i, pk] of list(b.minted, `bind.${key}.minted`).entries())
+      text(pk, `bind.${key}.minted[${i}]`);
+  }
+  for (const [pk, heir] of Object.entries(table(p.heirs, "heirs"))) {
+    const h = table(heir, `heirs.${pk}`);
+    text(h.being, `heirs.${pk}.being`);
+    text(h.id, `heirs.${pk}.id`);
+    text(h.current, `heirs.${pk}.current`);
+    orNull(h.announced, `heirs.${pk}.announced`);
+    flag(h.fresh, `heirs.${pk}.fresh`);
+    whole(h.mark, `heirs.${pk}.mark`);
+    for (const [i, n] of list(h.spent, `heirs.${pk}.spent`).entries())
+      whole(n, `heirs.${pk}.spent[${i}]`);
+  }
+  for (const [pk, gone] of Object.entries(table(p.gone, "gone"))) {
+    const g = table(gone, `gone.${pk}`);
+    text(g.current, `gone.${pk}.current`);
+    orNull(g.announced, `gone.${pk}.announced`);
+  }
+  orNull(p.public, "public");
+  return p;
+}
+function open(memory) {
+  const p = memory;
+  if (Object.keys(memory).length > 0 && p.version !== VERSION) {
+    if (!READS.includes(p.version))
+      throw new Error(`partition is version ${p.version}, this ward reads ${READS.join(", ")}`);
+    upgrade(p).version = VERSION;
+  }
+  p.version ??= VERSION;
+  p.beings ??= {};
+  p.bind ??= {};
+  p.heirs ??= {};
+  p.gone ??= {};
+  p.public ??= null;
+  return read(p);
+}
+var at = (rec, key) => Object.hasOwn(rec, key) ? rec[key] : void 0;
+var put = (rec, key, value) => {
+  Object.defineProperty(rec, key, { value, writable: true, enumerable: true, configurable: true });
+  return value;
+};
+var drop = (rec, key) => {
+  if (Object.hasOwn(rec, key))
+    delete rec[key];
+};
+var emptyCells = () => ({ standings: {}, occupants: {} });
+var emptyBind = () => ({ standings: {}, occupants: {}, knocks: {}, answered: {}, minted: [] });
+var HEAD = "";
+var STANDING = /* @__PURE__ */ new Set(["beings", "bind", "heirs", "gone"]);
+var rowOf = (p, row) => {
+  const all = p;
+  if (row === HEAD)
+    return Object.fromEntries(Object.entries(all).filter(([k]) => k !== "beings" && k !== "bind"));
+  const cells = at(p.beings ?? {}, row);
+  return cells === void 0 ? void 0 : { cells, bind: at(p.bind ?? {}, row) ?? emptyBind() };
+};
+var rowsIn = (p) => [HEAD, ...Object.keys(p.beings ?? {})];
+var restoreRow = (p, row, value) => {
+  const all = p;
+  if (row === HEAD) {
+    for (const k of Object.keys(all))
+      if (!STANDING.has(k))
+        drop(all, k);
+    for (const [k, v] of Object.entries(value ?? {}))
+      if (!STANDING.has(k))
+        put(all, k, v);
+    return;
+  }
+  if (value === void 0) {
+    drop(p.beings ?? {}, row);
+    drop(p.bind ?? {}, row);
+    return;
+  }
+  const into = (rows, kept) => {
+    const guarded = at(rows, row);
+    if (guarded === void 0)
+      return void put(rows, row, kept);
+    const held2 = unguarded(guarded);
+    for (const k of Object.keys(held2))
+      drop(held2, k);
+    for (const [k, v] of Object.entries(kept))
+      put(held2, k, v);
+  };
+  into(p.beings ?? {}, value.cells ?? emptyCells());
+};
+var fromRows = (rows) => {
+  const out = { ...rows[HEAD] ?? {} };
+  const beings = {};
+  const bind = {};
+  let any = Object.keys(out).length > 0;
+  for (const [row, value] of Object.entries(rows)) {
+    if (row === HEAD)
+      continue;
+    put(beings, row, value.cells);
+    put(bind, row, value.bind);
+    any = true;
+  }
+  if (!any)
+    return {};
+  out.beings = beings;
+  out.bind = bind;
+  return out;
+};
+
+// ../quo/dist/ward/heirs.js
+var SPAN = 64;
+var Heirs = class {
+  #p;
+  #wrote;
+  constructor(p, wrote2 = () => {
+  }) {
+    this.#p = p;
+    this.#wrote = wrote2;
+  }
+  open(heir, being, id) {
+    this.#p.heirs[heir] = { being, id, current: heir, announced: null, fresh: true, mark: 0, spent: [] };
+    this.#wrote();
+  }
+  // The id was removed. The heir is forgotten, and its last keys are kept
+  // apart, bounded, so that whoever still holds them hears `removed` at the
+  // door, once they have signed as themselves, and nobody else hears a thing.
+  close(heir) {
+    const h = this.#p.heirs[heir];
+    if (!h)
+      return;
+    delete this.#p.heirs[heir];
+    this.#p.gone[heir] = { current: h.current, announced: h.announced };
+    const keys = Object.keys(this.#p.gone);
+    for (const old of keys.slice(0, Math.max(0, keys.length - GONE)))
+      delete this.#p.gone[old];
+    this.#wrote();
+  }
+  // May `by` speak for a relation she removed? True only for the keys the
+  // door held when the id went, which nobody but their holder has.
+  gone(heir, by) {
+    const g = this.#p.gone[heir];
+    return !!g && (by === g.current || by === g.announced);
+  }
+  // May `by` speak for this heir? Returns the record if so, null if not.
+  // Does not write: the caller verifies the signature first, then settles.
+  admits(heir, by) {
+    const h = this.#p.heirs[heir];
+    if (!h)
+      return null;
+    if (h.fresh)
+      return by === h.current ? h : null;
+    return by === h.current || by === h.announced ? h : null;
+  }
+  // Once only. A number above the mark is honoured and moves it; a number
+  // inside the span is honoured once and never again; a number at or below
+  // the span is refused, because a door that remembered every number ever
+  // seen would be a door with unbounded memory. Counting starts where
+  // strangers must agree: the first legal number is one.
+  //
+  // The number rides inside the signed body, so bytes caught on the road
+  // carry the number they were sent under and are refused as themselves. A
+  // caller who means to ask again asks again, under the next number, and is
+  // heard: retry and fire-and-forget stay hers to build. Only the accident
+  // and the interception are refused.
+  //
+  // Writes, so the caller settles it only once the signature has checked out.
+  // The same bytes twice are one honoured call and one silence.
+  spend(h, seq) {
+    if (!Number.isSafeInteger(seq) || seq < 1)
+      return false;
+    if (seq > h.mark) {
+      if (h.mark > 0)
+        h.spent.push(h.mark);
+      h.mark = seq;
+      h.spent = h.spent.filter((past) => past > seq - SPAN);
+      return true;
+    }
+    if (seq === h.mark || seq <= h.mark - SPAN || h.spent.includes(seq))
+      return false;
+    h.spent.push(seq);
+    return true;
+  }
+  // The signature checked out. Spend the number and settle the keys, or do
+  // neither: a call that binds nothing must not burn a number on its way to
+  // being refused, or a stranger who cannot be heard would still leave a mark
+  // behind her. Every write below this line is one that is going to hold.
+  // This is where a knock is judged and where `unannounced` is said. settle
+  // below is the writing alone, and it judges nothing: one owner for the
+  // question, one for the answer.
+  honour(h, by, next, seq) {
+    if (h.fresh && (next === null || next === h.current))
+      return "unannounced";
+    if (!this.spend(h, seq))
+      return "repeated";
+    this.settle(h, by, next);
+    this.#wrote();
+    return true;
+  }
+  // The signature checked out and honour has judged. Settle the keys: a fresh
+  // heir rotates at once to what it announced, which honour has already held
+  // to being something other than itself, so that the heir dies as it speaks;
+  // a current key replaces its announcement; an announced key becomes current.
+  settle(h, by, next) {
+    if (h.fresh) {
+      if (next === null)
+        return;
+      h.current = next;
+      h.announced = null;
+      h.fresh = false;
+      return;
+    }
+    if (by === h.announced)
+      h.current = by;
+    if (next !== null)
+      h.announced = next;
+  }
+};
+
+// ../quo/dist/ward/arithmetic.js
+var arithmetic_exports = {};
+__export(arithmetic_exports, {
+  KEY: () => KEY,
+  NONCE: () => NONCE,
+  SIGNATURE: () => SIGNATURE,
+  TAG: () => TAG,
+  agree: () => agree,
+  box: () => box,
+  concat: () => concat,
+  decrypt: () => decrypt,
+  derive: () => derive,
+  encrypt: () => encrypt,
+  heldKeys: () => heldKeys,
+  hex: () => hex2,
+  sameBytes: () => sameBytes,
+  sealingPair: () => sealingPair,
+  sha256: () => sha256,
+  sign: () => sign,
+  signingPair: () => signingPair,
+  smallOrder: () => smallOrder,
+  unbox: () => unbox,
+  unhex: () => unhex,
+  verify: () => verify
+});
+var subtle2 = () => {
+  const s = globalThis.crypto?.subtle;
+  if (!s)
+    throw new Error("this terrain has no crypto.subtle: a ward needs a secure context");
+  return s;
+};
+var KEY = 32;
+var SIGNATURE = 64;
+var NONCE = 12;
+var TAG = 16;
+var SEAL_INFO = new TextEncoder().encode("quo-seal");
+var SALT = new Uint8Array(0);
+var ED_SECRET = unhex("302e020100300506032b657004220420");
+var X_SECRET = unhex("302e020100300506032b656e04220420");
+var ED = { name: "Ed25519" };
+var X = { name: "X25519" };
+var HEX = Array.from({ length: 256 }, (_, at3) => at3.toString(16).padStart(2, "0"));
+function hex2(bytes) {
+  let out = "";
+  for (const byte of new Uint8Array(bytes))
+    out += HEX[byte];
+  return out;
+}
+function unhex(text3) {
+  const out = new Uint8Array(text3.length / 2);
+  for (let at3 = 0; at3 < out.length; at3 += 1)
+    out[at3] = parseInt(text3.slice(at3 * 2, at3 * 2 + 2), 16);
+  return out;
+}
+function concat(parts) {
+  const out = new Uint8Array(parts.reduce((n, p) => n + p.length, 0));
+  let at3 = 0;
+  for (const part of parts) {
+    out.set(part, at3);
+    at3 += part.length;
+  }
+  return out;
+}
+function sameBytes(a, b) {
+  if (a.length !== b.length)
+    return false;
+  let diff = 0;
+  for (let at3 = 0; at3 < a.length; at3 += 1)
+    diff |= a[at3] ^ b[at3];
+  return diff === 0;
+}
+var SMALL_ORDER = [
+  "0100000000000000000000000000000000000000000000000000000000000000",
+  "ecffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff7f",
+  "0000000000000000000000000000000000000000000000000000000000000000",
+  "0000000000000000000000000000000000000000000000000000000000000080",
+  "26e8958fc2b227b045c3f489f2ef98f0d5dfac05d3c63339b13802886d53fc05",
+  "c7176a703d4dd84fba3c0b760d10670f2a2053fa2c39ccc64ec7fd7792ac037a",
+  "26e8958fc2b227b045c3f489f2ef98f0d5dfac05d3c63339b13802886d53fc85",
+  "c7176a703d4dd84fba3c0b760d10670f2a2053fa2c39ccc64ec7fd7792ac03fa"
+].map(unhex);
+var unreduced = (pk) => (pk[31] & 127) === 127 && pk[0] >= 237 && pk.subarray(1, 31).every((b) => b === 255);
+var smallOrder = (pk) => unreduced(pk) || SMALL_ORDER.some((p) => sameBytes(p, pk));
+var key32 = (value, what) => {
+  if (!(value instanceof Uint8Array) || value.length !== KEY)
+    throw new Error(`${what} is not a 32-byte key`);
+  return value;
+};
+var pkcs8 = (prefix, value, what) => concat([prefix, key32(value, what)]);
+var KEYS = 512;
+var imported = /* @__PURE__ */ new Map();
+var keep = (id, make) => {
+  const had = imported.get(id);
+  if (had !== void 0) {
+    imported.delete(id);
+    imported.set(id, had);
+    return had;
+  }
+  const made = make();
+  made.catch(() => imported.delete(id));
+  imported.set(id, made);
+  if (imported.size > KEYS)
+    imported.delete(imported.keys().next().value);
+  return made;
+};
+var heldKeys = () => ({ held: imported.size, bound: KEYS });
+var secretKey = (alg, prefix, value, what, uses) => {
+  const bytes = pkcs8(prefix, value, what);
+  return keep(`${alg.name}|${uses.join("+")}|${hex2(bytes)}`, () => subtle2().importKey("pkcs8", bytes, alg, true, uses));
+};
+var publicKey = (alg, value, what, uses) => {
+  const bytes = key32(value, what);
+  return keep(`${alg.name}|${uses.join("+")}|pk|${hex2(bytes)}`, () => subtle2().importKey("raw", bytes, alg, true, uses));
+};
+var publics = /* @__PURE__ */ new WeakMap();
+function rawPublic(secret) {
+  const had = publics.get(secret);
+  if (had !== void 0)
+    return had;
+  const read2 = (async () => {
+    const jwk = await subtle2().exportKey("jwk", secret);
+    const binary = atob(jwk.x.replaceAll("-", "+").replaceAll("_", "/"));
+    const out = new Uint8Array(binary.length);
+    for (let at3 = 0; at3 < binary.length; at3 += 1)
+      out[at3] = binary.charCodeAt(at3);
+    return out;
+  })();
+  publics.set(secret, read2);
+  return read2;
+}
+async function sha256(...parts) {
+  return new Uint8Array(await subtle2().digest("SHA-256", concat(parts)));
+}
+async function signingPair(seed2) {
+  const secret = await secretKey(ED, ED_SECRET, seed2, "seed", ["sign"]);
+  return { secret: Uint8Array.from(seed2), pk: Uint8Array.from(await rawPublic(secret)) };
+}
+async function sealingPair(seed2) {
+  const secret = await secretKey(X, X_SECRET, seed2, "seed", ["deriveBits"]);
+  return { secret: Uint8Array.from(seed2), pk: Uint8Array.from(await rawPublic(secret)) };
+}
+async function sign(message, secret) {
+  const key = await secretKey(ED, ED_SECRET, secret, "secret", ["sign"]);
+  return new Uint8Array(await subtle2().sign(ED, key, message));
+}
+async function verify(message, signature, pk) {
+  if (!(signature instanceof Uint8Array) || signature.length !== SIGNATURE)
+    return false;
+  if (!(pk instanceof Uint8Array) || pk.length !== KEY || smallOrder(pk))
+    return false;
+  try {
+    return await subtle2().verify(ED, await publicKey(ED, pk, "pk", ["verify"]), signature, message);
+  } catch {
+    return false;
+  }
+}
+async function agree(secret, peerPk) {
+  const key = await secretKey(X, X_SECRET, secret, "secret", ["deriveBits"]);
+  const peer = await publicKey(X, peerPk, "padlock", []);
+  const shared = new Uint8Array(await subtle2().deriveBits({ name: X.name, public: peer }, key, KEY * 8));
+  if (shared.every((b) => b === 0))
+    throw new Error("dead agreement");
+  return shared;
+}
+async function derive(secret, label, bytes) {
+  const material = await subtle2().importKey("raw", secret, "HKDF", false, ["deriveBits"]);
+  return new Uint8Array(await subtle2().deriveBits({ name: "HKDF", hash: "SHA-256", salt: SALT, info: label }, material, bytes * 8));
+}
+async function cipherKey(shared, use) {
+  const out = await derive(shared, SEAL_INFO, KEY + NONCE);
+  return { key: await subtle2().importKey("raw", out.subarray(0, KEY), "AES-GCM", false, [use]), nonce: out.subarray(KEY) };
+}
+async function encrypt(shared, plaintext, aad) {
+  const { key, nonce } = await cipherKey(shared, "encrypt");
+  return new Uint8Array(await subtle2().encrypt({ name: "AES-GCM", iv: nonce, additionalData: key32(aad, "aad"), tagLength: TAG * 8 }, key, plaintext));
+}
+async function decrypt(shared, ciphertext, aad) {
+  if (ciphertext.length < TAG)
+    throw new Error("short input");
+  const { key, nonce } = await cipherKey(shared, "decrypt");
+  return new Uint8Array(await subtle2().decrypt({ name: "AES-GCM", iv: nonce, additionalData: key32(aad, "aad"), tagLength: TAG * 8 }, key, ciphertext));
+}
+async function box(inside, padlock, seed2) {
+  const ephemeral = await sealingPair(seed2);
+  const shared = await agree(ephemeral.secret, padlock);
+  return { bytes: concat([ephemeral.pk, await encrypt(shared, inside, ephemeral.pk)]), ephemeral };
+}
+async function unbox(bytes, padlockSecret) {
+  if (bytes.length <= KEY)
+    throw new Error("short input");
+  const ephemeralPk = bytes.subarray(0, KEY);
+  const shared = await agree(padlockSecret, ephemeralPk);
+  return decrypt(shared, bytes.subarray(KEY), ephemeralPk);
+}
+
+// ../quo/dist/ward/seal.js
+var utf8 = new TextEncoder();
+var text2 = new TextDecoder();
+var WARD_SIGN = new TextEncoder().encode("quo-ward-sign");
+var WARD_SEAL = new TextEncoder().encode("quo-ward-seal");
+var SIZE = 1024 * 1024;
+async function wardKey(seed2) {
+  const seed32 = typeof seed2 === "string" ? await sha256(utf8.encode(seed2)) : seed2.length === KEY ? seed2 : await sha256(seed2);
+  const s = await signingPair(await derive(seed32, WARD_SIGN, KEY));
+  const p = await sealingPair(await derive(seed32, WARD_SEAL, KEY));
+  return { sign: s.secret, padlock: p.secret, signPk: s.pk, padlockPk: p.pk, pk: hex2(s.pk) + hex2(p.pk) };
+}
+var wardSignPk = (pk) => unhex(pk.slice(0, KEY * 2));
+var wardPadlock = (pk) => unhex(pk.slice(KEY * 2));
+var isWardPk = (pk) => typeof pk === "string" && /^[0-9a-f]{128}$/.test(pk);
+var isHex = (v) => typeof v === "string" && /^[0-9a-f]{64}$/.test(v);
+async function beingKey(seed2) {
+  return { seed: hex2(seed2), pk: hex2((await signingPair(seed2)).pk) };
+}
+async function sealAsk(to, payload, signer, padlock, seed2) {
+  const body = utf8.encode(JSON.stringify({ to, ...payload }));
+  const inside = concat([body, await sign(body, signer)]);
+  const { bytes, ephemeral } = await box(inside, padlock, seed2);
+  return { bytes, ephemeral: ephemeral.secret };
+}
+async function openAsk(bytes, padlockSecret) {
+  try {
+    if (!(bytes instanceof Uint8Array) || bytes.length < 1 || bytes.length > SIZE)
+      return null;
+    const inside = await unbox(bytes, padlockSecret);
+    if (inside.length <= SIGNATURE)
+      return null;
+    const body = inside.subarray(0, inside.length - SIGNATURE);
+    const signature = inside.subarray(inside.length - SIGNATURE);
+    const payload = JSON.parse(text2.decode(body));
+    const to = payload.to;
+    if (to !== null && !isHex(to))
+      return null;
+    if (!isHex(payload.by))
+      return null;
+    if (payload.next !== null && !isHex(payload.next))
+      return null;
+    if (payload.method !== void 0 && typeof payload.method !== "string")
+      return null;
+    if (payload.args !== void 0 && (payload.args === null || typeof payload.args !== "object" || Array.isArray(payload.args)))
+      return null;
+    if (payload.args !== void 0 && cellFault(payload.args, "args") !== null)
+      return null;
+    if (!Number.isSafeInteger(payload.seq) || payload.seq < 1)
+      return null;
+    if (payload.hops !== void 0 && (!Number.isSafeInteger(payload.hops) || payload.hops < 0))
+      return null;
+    return { to, payload, body, signature, ephemeralPk: bytes.subarray(0, KEY) };
+  } catch {
+    return null;
+  }
+}
+var verifyAsk = (a, pk) => verify(a.body, a.signature, unhex(pk));
+async function sealReply(reply, ephemeralPk, wardSign, seed2) {
+  const body = utf8.encode(JSON.stringify(reply));
+  return (await box(concat([body, await sign(body, wardSign)]), ephemeralPk, seed2)).bytes;
+}
+async function openReply(bytes, ephemeralSecret, signPk) {
+  try {
+    if (!(bytes instanceof Uint8Array) || bytes.length > SIZE)
+      return null;
+    const inside = await unbox(bytes, ephemeralSecret);
+    if (inside.length <= SIGNATURE)
+      return null;
+    const body = inside.subarray(0, inside.length - SIGNATURE);
+    if (!await verify(body, inside.subarray(inside.length - SIGNATURE), signPk))
+      return null;
+    const reply = JSON.parse(text2.decode(body));
+    if (reply === null || typeof reply !== "object" || Array.isArray(reply))
+      return null;
+    const r = reply;
+    if (r.silence === true)
+      return { silence: true };
+    if (Object.hasOwn(r, "quo"))
+      return isDoorWord(r.quo) ? { quo: r.quo } : null;
+    if (!Object.hasOwn(r, "object") || r.object === void 0)
+      return null;
+    if (r.seen !== null && !isHex(r.seen))
+      return null;
+    return { object: r.object, seen: r.seen };
+  } catch {
+    return null;
+  }
+}
+
+// ../quo/dist/ward/allowance.js
+var DEFAULT = { time: 3e4 };
+var CEILING = { time: 3e5 };
+function allow(wanted, ceiling = CEILING, base = DEFAULT) {
+  const whole2 = (n, fallback) => {
+    const w = typeof n === "number" ? Math.floor(n) : NaN;
+    return Number.isFinite(w) && w > 0 ? w : fallback;
+  };
+  return { time: Math.min(whole2(wanted?.time, base.time), ceiling.time) };
+}
+var spent = (a) => !(Number.isSafeInteger(a.time) && a.time > 0);
+var LATE = /* @__PURE__ */ Symbol("late");
+async function within(ms, work, rang2) {
+  let timer;
+  const bell = new Promise((ring) => {
+    timer = setTimeout(() => {
+      rang2?.();
+      ring(LATE);
+    }, ms);
+  });
+  try {
+    return await Promise.race([work, bell]);
+  } finally {
+    clearTimeout(timer);
+    void work.then(() => {
+    }, () => {
+    });
+  }
+}
+
+// ../quo/dist/ward/door.js
+var SILENCE = { silence: true };
+var said = (quo) => ({ quo });
+async function answered2(door, asker, method, args, bound) {
+  const threw = bound ? said("threw") : SILENCE;
+  let out;
+  try {
+    out = await door.being.answer(asker, method, args);
+  } catch {
+    return threw;
+  }
+  if (out === void 0 || isSilence(out))
+    return SILENCE;
+  if (isWord(out))
+    return threw;
+  if (cellFault(out, "answer") !== null)
+    return threw;
+  return { object: out, seen: null };
+}
+async function arrive(door, asker, method, args, bound) {
+  const reply = await answered2(door, asker, method, args, bound);
+  if (method === void 0 || !("object" in reply))
+    return reply;
+  return { object: reply.object, seen: await seen(door, asker) };
+}
+async function seen(door, asker) {
+  try {
+    const bp = await door.being.answer(asker);
+    if (isSilence(bp) || isWord(bp))
+      return null;
+    if (cellFault(bp, "blueprint") !== null)
+      return null;
+    return await digest(bp);
+  } catch {
+    return null;
+  }
+}
+function makeDoor(key, heirs, doors, publicKey2, random, keep2) {
+  const judge = async (bytes) => {
+    const a = await openAsk(bytes, key.padlock);
+    if (!a)
+      return null;
+    const { to, payload, ephemeralPk } = a;
+    const refuse2 = () => ({ reply: SILENCE, ephemeralPk, heard: false });
+    if (spent({ time: payload.time }) || payload.hops === 0)
+      return refuse2();
+    const args = payload.args ?? {};
+    if (to === null) {
+      const pk = publicKey2();
+      const pub = pk !== null ? doors.get(pk) : void 0;
+      if (!pub || !await verifyAsk(a, payload.by))
+        return refuse2();
+      return { reply: await arrive(pub, {}, payload.method, args, false), ephemeralPk, heard: false };
+    }
+    const h = heirs.admits(to, payload.by);
+    if (!h) {
+      if (!heirs.gone(to, payload.by) || !await verifyAsk(a, payload.by))
+        return refuse2();
+      return { reply: said("removed"), ephemeralPk, heard: true };
+    }
+    if (!await verifyAsk(a, payload.by))
+      return refuse2();
+    if (!heirs.admits(to, payload.by))
+      return heirs.gone(to, payload.by) ? { reply: said("removed"), ephemeralPk, heard: true } : refuse2();
+    const door = doors.get(h.being);
+    if (!door)
+      return { reply: said("absent"), ephemeralPk, heard: true };
+    if (!at(door.cells.occupants, h.id))
+      return { reply: said("removed"), ephemeralPk, heard: true };
+    const honoured = heirs.honour(h, payload.by, payload.next, payload.seq);
+    if (honoured !== true)
+      return { reply: said(honoured), ephemeralPk, heard: true };
+    return { reply: await arrive(door, { id: h.id }, payload.method, args, true), ephemeralPk, heard: true };
+  };
+  return async function door(bytes) {
+    const out = await judge(bytes).catch(() => null);
+    let reply = out?.reply ?? SILENCE;
+    const heard = out?.heard ?? false;
+    if (!await keep2().catch(() => false))
+      reply = heard ? said("threw") : SILENCE;
+    try {
+      return { bytes: await sealReply(reply, out?.ephemeralPk ?? lid(bytes, random), key.sign, random(32)), heard };
+    } catch {
+      return { bytes: await sealReply(SILENCE, (await sealingPair(random(32))).pk, key.sign, random(32)), heard };
+    }
+  };
+}
+function lid(bytes, random) {
+  if (bytes instanceof Uint8Array && bytes.length >= KEY)
+    return bytes.subarray(0, KEY);
+  return random(KEY);
+}
+
+// ../quo/dist/ward/stance.js
+var CALLS = ["knock", "take", "remove"];
+function buildStance(inside, key, cells, bind) {
+  const named = (method) => method === void 0 || typeof method === "string";
+  const reserved = (id) => RESERVED_IDS.includes(id) || CALLS.includes(id) || unkeepable(id);
+  const nameOf = (inv) => inv.heir === void 0 ? `public:${inv.ward}` : `${inv.ward}:${inv.heir}`;
+  const valid = (inv) => {
+    const i = inv;
+    if (!i || typeof i !== "object" || !isWardPk(i.ward))
+      return false;
+    if (i.heir === void 0)
+      return i.secret === void 0;
+    return isHex(i.heir) && isHex(i.secret);
+  };
+  const lanes = /* @__PURE__ */ new Map();
+  const lane = (name, run) => {
+    const mine = (lanes.get(name) ?? Promise.resolve()).then(run, run);
+    const quiet = mine.then(() => {
+    }, () => {
+    });
+    lanes.set(name, quiet);
+    void quiet.then(() => {
+      if (lanes.get(name) === quiet)
+        lanes.delete(name);
+    });
+    return mine;
+  };
+  const bounded = async (wanted, work) => {
+    let late = false;
+    const out = await within(allow(wanted).time, work(() => !late), () => {
+      late = true;
+    });
+    return out === LATE ? word("late") : out;
+  };
+  const read2 = (r) => {
+    if (isSilence(r) || isWord(r))
+      return { answer: r, door: false, seen: null };
+    if ("silence" in r)
+      return { answer: silence, door: true, seen: null };
+    if ("quo" in r)
+      return { answer: word(r.quo), door: true, seen: null };
+    return { answer: r.object, door: true, seen: r.seen };
+  };
+  const honoured = (r) => r.door && !(isWord(r.answer) && wordOf(r.answer) !== "threw");
+  const answered4 = (r) => r.door && !isSilence(r.answer) && !isWord(r.answer);
+  const send = async (keys, method, args, wanted, rec, live = () => true) => {
+    const r = read2(await inside.send(bind, keys, method, args, wanted));
+    if (rec && method !== void 0 && r.seen !== null && live())
+      rec.seen = r.seen;
+    return r.answer;
+  };
+  const knocking = async (inv, method, args, wanted, live = () => true) => {
+    const name = nameOf(inv);
+    const taken = takenAs(name);
+    if (taken !== void 0) {
+      const keys2 = at(bind.standings, taken);
+      if (!keys2)
+        return word("dropped");
+      return lane(`ask:${taken}`, () => asking(taken, keys2, at(cells.standings, taken), method, args, wanted, live));
+    }
+    const k = bind.knocks[name] ??= { current: (await inside.mintKey(bind)).seed, next: null, spoke: false, sent: false, seq: 0 };
+    prune(bind.knocks, bind.answered);
+    if (inv.heir !== void 0 && !k.spoke && k.sent) {
+      const own = { ward: inv.ward, heir: inv.heir, current: k.current, next: k.next, seq: k.seq };
+      const r2 = read2(await inside.send(bind, own, method, args, wanted));
+      k.seq = own.seq;
+      k.current = own.current;
+      k.next = own.next;
+      inside.wrote();
+      if (!r2.door) {
+        if (!isSilence(r2.answer))
+          return r2.answer;
+      } else if (!isSilence(r2.answer)) {
+        k.spoke = true;
+        if (answered4(r2))
+          bind.answered[name] = true;
+        return r2.answer;
+      }
+    }
+    const first = inv.heir !== void 0 && !k.spoke;
+    const keys = first ? { ward: inv.ward, heir: inv.heir, current: inv.secret, next: k.current, seq: k.seq } : { ward: inv.ward, heir: inv.heir ?? null, current: k.current, next: k.next, seq: k.seq };
+    const r = read2(await inside.send(bind, keys, method, args, wanted));
+    k.sent = true;
+    k.seq = keys.seq;
+    if (!first) {
+      k.current = keys.current;
+      k.next = keys.next;
+    }
+    if (honoured(r))
+      k.spoke = true;
+    if (answered4(r))
+      bind.answered[name] = true;
+    inside.wrote();
+    return r.answer;
+  };
+  const keyName = (k) => k.heir === null ? `public:${k.ward}` : `${k.ward}:${k.heir}`;
+  const takenAs = (name) => Object.keys(bind.standings).find((id) => keyName(bind.standings[id]) === name);
+  const gone = () => !inside.live();
+  const calls = {
+    knock: async (inv, method, args = {}, wanted) => {
+      if (gone())
+        return word("dropped");
+      if (!named(method))
+        return unreached();
+      if (!valid(inv))
+        return word("invitation");
+      const id = takenAs(nameOf(inv));
+      if (id !== void 0)
+        return standingAt(id).ask(method, args, wanted);
+      return bounded(wanted, (live) => lane(`knock:${nameOf(inv)}`, () => live() ? knocking(inv, method, args, wanted, live) : Promise.resolve(word("late"))));
+    },
+    // Take consumes. Until now the relation lived in the knock record, under
+    // the ward and the heir; from now it lives in the standing, under her id.
+    // It never lives in both: two records seeded from one relation are two
+    // lanes speaking for one line of keys and one count, and whichever spoke
+    // last holds it while the other is refused. She would read that refusal as
+    // the far being falling quiet, which is a thing a sovereign being may do,
+    // so the loss would look exactly like an answer she is owed nothing of.
+    // One relation, one home, and the invitation is spent: knocking it again
+    // is another consumed it, and taking it again births nothing.
+    //
+    // So it is spoken on the relation's lane, like every other word spoken
+    // for it. A take reads the count and the keys a knock writes, and copies
+    // them into the standing. Off the lane it reads them between a knock's
+    // send and its answer: the standing is born holding a number the far door
+    // is about to honour and a key it is about to rotate past, and her first
+    // ask on it is refused. The relation she took correctly would be dead
+    // because a second knock on the same invitation was careless.
+    take: async (id, inv) => {
+      if (gone() || !valid(inv))
+        return null;
+      const name = nameOf(inv);
+      return lane(`knock:${name}`, () => {
+        if (!bind.answered[name])
+          return Promise.resolve(null);
+        if (reserved(id) || at(cells.standings, id) || at(cells.occupants, id))
+          return Promise.resolve(null);
+        const k = bind.knocks[name];
+        put(bind.standings, id, { ward: inv.ward, heir: inv.heir ?? null, current: k.current, next: k.next, seq: k.seq });
+        put(cells.standings, id, { id, digest: null, blueprint: null, seen: null });
+        delete bind.knocks[name];
+        delete bind.answered[name];
+        inside.wrote();
+        return Promise.resolve(id);
+      });
+    },
+    remove: (id) => {
+      if (gone())
+        return;
+      drop(cells.standings, id);
+      drop(bind.standings, id);
+      inside.wrote();
+    }
+  };
+  const standingAt = (id) => ({
+    id,
+    // The keys are read now, not when the lane reaches this ask: an ask
+    // issued while the standing stood is answered even if she drops it in
+    // the next line. Waiting for the lane is not a reason to lose it.
+    ask: (method, args = {}, wanted) => {
+      if (gone())
+        return Promise.resolve(word("dropped"));
+      if (!named(method))
+        return Promise.resolve(unreached());
+      const keys = at(bind.standings, id);
+      if (!keys)
+        return Promise.resolve(word("dropped"));
+      const rec = at(cells.standings, id);
+      return bounded(wanted, (live) => lane(`ask:${id}`, () => live() ? asking(id, keys, rec, method, args, wanted, live) : Promise.resolve(word("late"))));
+    }
+  });
+  const asking = async (id, keys, rec, method, args, wanted, live = () => true) => {
+    const out = await send(keys, method, args, wanted, rec, live);
+    if (method === void 0 && !isSilence(out) && !isWord(out)) {
+      if (cellFault(out, "blueprint") !== null)
+        return silence;
+      if (rec && live() && at(cells.standings, id) === rec) {
+        rec.blueprint = isBlueprint(out) ? out : null;
+        rec.digest = rec.seen = await digest(out);
+      }
+    }
+    return out;
+  };
+  const standings = new Proxy(calls, {
+    // Own keys only: `in` would also find every name on Object's prototype,
+    // and a standing she took as `constructor` or `toString` would answer with
+    // Object's, not hers.
+    get: (t, id) => typeof id === "string" && Object.hasOwn(t, id) ? t[id] : typeof id === "string" && at(cells.standings, id) ? standingAt(id) : void 0
+  });
+  return {
+    cells,
+    // A being may make. The ward refuses what it refuses the owner: a key
+    // already booted, a class the harbor does not hold, and a throw at birth
+    // leaves the partition as it was. Reaching into another is still the
+    // owner's alone: what a maker may have is a relation to what she made,
+    // by naming an id, and it is made the way every relation is. The being
+    // made mints an occupant for her maker under the maker's own key, so she
+    // knows who made her by that name and by nothing else; her maker knocks,
+    // takes it under the id she gave, and holds one standing like any other.
+    // Nothing half-lives: a relation that could not be made unmakes the
+    // being, who is a moment old and known to nobody.
+    boot: async (className, made, id) => {
+      if (gone())
+        return null;
+      if (id !== void 0 && (reserved(id) || at(cells.standings, id) || at(cells.occupants, id)))
+        return null;
+      const born = inside.instantiate(className, made);
+      if (born === null || id === void 0)
+        return born;
+      const inv = await inside.relate(born, key);
+      if (inv) {
+        const out = await calls.knock(inv);
+        if (!isSilence(out) && !isWord(out) && await calls.take(id, inv) === id)
+          return born;
+      }
+      inside.unmake(born);
+      return null;
+    },
+    occupants: {
+      // rotation one: the ward mints the occupant's first key and gives the secret away.
+      // it keeps the pk beside the id and nothing else. the invitation IS the key.
+      invite: async (id, notes) => {
+        if (gone() || reserved(id) || at(cells.occupants, id) || at(cells.standings, id))
+          return null;
+        if (notes !== void 0 && cellFault(notes, "notes") !== null)
+          return null;
+        const k = await inside.mintKey(bind);
+        if (reserved(id) || at(cells.occupants, id) || at(cells.standings, id))
+          return null;
+        put(cells.occupants, id, { id, notes: notes ? JSON.parse(JSON.stringify(notes)) : {} });
+        inside.openHeir(k.pk, key, id);
+        put(bind.occupants, id, k.pk);
+        inside.wrote();
+        return { ward: inside.pk, heir: k.pk, secret: k.seed };
+      },
+      remove: (id) => {
+        if (gone())
+          return;
+        drop(cells.occupants, id);
+        const heir = at(bind.occupants, id);
+        drop(bind.occupants, id);
+        if (heir)
+          inside.closeHeir(heir);
+        inside.wrote();
+      }
+    },
+    standings,
+    // A standing at one of the things this device can do. The same three
+    // moves her boot makes, with the harbor's root doing the inviting instead
+    // of a being of this ward: ask the ground for the name, knock with what
+    // comes back, take it under the id she gave. She is handed the id.
+    //
+    // The invitation never reaches her, and that is the difference between
+    // this relation and every other she holds. Her own invitations are hers
+    // to give away, because giving one away is giving away her own relation.
+    // This one is the device's, minted for this ward alone, and a value she
+    // could copy is a capability she could hand to anyone. A being who wants
+    // to lend her device access to another does it in the open, by an ask of
+    // her own that forwards to this standing, where her gate reads who is
+    // asking and she can stop.
+    lend: async (name, id) => {
+      if (gone() || typeof name !== "string" || typeof id !== "string")
+        return null;
+      if (reserved(id) || at(cells.standings, id) || at(cells.occupants, id))
+        return null;
+      const took = await inside.lend(name, async (inv) => {
+        if (gone() || reserved(id) || at(cells.standings, id) || at(cells.occupants, id))
+          return false;
+        const out = await calls.knock(inv);
+        if (isSilence(out) || isWord(out))
+          return false;
+        return await calls.take(id, inv) === id;
+      });
+      return took ? id : null;
+    }
+  };
+}
+
+// ../quo/dist/ward/owner.js
+var str2 = { type: "string" };
+var OWNER_ASKS = [
+  { name: "boot", description: "boot a being by class name, under a key the owner chooses", input: { type: "object", properties: { key: str2, class: str2 }, required: ["key", "class"] } },
+  { name: "public", description: "mark a booted being as the one public being of the ward, reached by anyone at the bare pk; null takes the mark off and leaves her booted", input: { type: "object", properties: { key: str2 }, required: ["key"] } },
+  { name: "invite", description: "mint an invitation on a being of the ward, under the id she will know the occupant by, with the notes she will read on it; on the ward pk it mints an owner, and only the root may", input: { type: "object", properties: { being: str2, id: str2, notes: { type: "object" } }, required: ["being", "id"] } },
+  {
+    name: "knock",
+    description: "knock for a being of the ward with an invitation, and take the standing under id if answered; being is a key booted, or { boot: class, key } to boot her first",
+    input: { type: "object", properties: { being: { description: "a key, or { boot, key }" }, id: str2, invitation: { type: "object" }, method: str2, args: { type: "object" }, wanted: { type: "object", properties: { time: { type: "number" } } } }, required: ["being", "id", "invitation"] }
+  },
+  { name: "remove", description: "take a relation out of a being of the ward by id, occupant or standing; on the ward pk it unseats an owner, and only the root may", input: { type: "object", properties: { being: str2, id: str2 }, required: ["being", "id"] } },
+  { name: "unboot", description: "take a being out of the ward, with every relation she holds; her occupants hear removed, and the ward itself is refused", input: { type: "object", properties: { being: str2 }, required: ["being"] } },
+  {
+    name: "ask",
+    description: "ask a being of the ward, as the owner; with no being it is the public being asked as nobody, which is what a stranger would hear",
+    input: { type: "object", properties: { being: str2, method: str2, args: { type: "object" }, wanted: { type: "object", properties: { time: { type: "number" } } } } }
+  }
+];
+async function ownerAnswer(w, asker, method, args) {
+  const named = (v) => typeof v === "string" ? v : null;
+  if (method === void 0)
+    return describe(w);
+  if (method === "boot") {
+    const key = named(args.key), className = named(args.class);
+    if (key === null || className === null)
+      return { error: "no such class, or key taken" };
+    const door = w.instantiate(className, key);
+    if (door === "threw")
+      return { error: "threw at birth" };
+    return door ? { booted: door.key } : { error: "no such class, or key taken" };
+  }
+  if (method === "public") {
+    if (args.key === null) {
+      w.setPublic(null);
+      return { public: null };
+    }
+    const key = named(args.key);
+    if (key === null || key === w.pk || !w.doors.has(key))
+      return { error: "no such being" };
+    const standing = w.publicKey();
+    if (standing !== null && standing !== key && w.doors.has(standing))
+      return { error: "a ward has one public being" };
+    w.setPublic(key);
+    return { public: key };
+  }
+  if (method === "invite") {
+    const being = named(args.being), id = named(args.id);
+    if (being === null || id === null)
+      return { error: "no such being" };
+    if (being === w.pk && asker.id !== OWNER)
+      return { error: "no such being" };
+    const notes = args.notes;
+    const door = w.doors.get(being);
+    if (!door)
+      return { error: "no such being" };
+    return await door.stance.occupants.invite(id, notes !== null && typeof notes === "object" && !Array.isArray(notes) ? notes : void 0);
+  }
+  if (method === "knock") {
+    const b = args.being;
+    let door = typeof b === "string" ? w.doors.get(b) : void 0;
+    if (!door && b && typeof b === "object") {
+      const key = named(b.key), className = named(b.boot);
+      if (key === null || className === null)
+        return { error: "no such being" };
+      const made = w.instantiate(className, key);
+      if (made === "threw")
+        return { error: "threw at birth" };
+      door = w.doors.get(key);
+    }
+    const id = named(args.id);
+    if (!door || id === null || door.key === w.pk)
+      return { error: "no such being" };
+    const inv = args.invitation;
+    const out = await door.stance.standings.knock(inv, args.method, args.args ?? {}, args.wanted);
+    if (isSilence(out))
+      return { error: "silence" };
+    if (isWord(out))
+      return { error: wordOf(out) };
+    return { taken: await door.stance.standings.take(id, inv), answer: out };
+  }
+  if (method === "remove") {
+    const being = named(args.being), id = named(args.id);
+    if (being === null || id === null)
+      return { error: "no such being" };
+    if (being === w.pk && asker.id !== OWNER)
+      return { error: "no such being" };
+    const door = w.doors.get(being);
+    if (!door)
+      return { error: "no such being" };
+    if (Object.hasOwn(door.cells.occupants, id))
+      door.stance.occupants.remove(id);
+    else if (Object.hasOwn(door.cells.standings, id))
+      door.stance.standings.remove(id);
+    else
+      return { error: "nothing to remove" };
+    return { removed: id };
+  }
+  if (method === "unboot") {
+    const being = named(args.being);
+    if (being === null || being === w.pk)
+      return { error: "no such being" };
+    const removed = w.unboot(being);
+    return removed === null ? { error: "no such being" } : { unbooted: being, removed };
+  }
+  if (method === "ask") {
+    const being = args.being === void 0 ? null : named(args.being);
+    if (args.being !== void 0 && being === null)
+      return { error: "no such being" };
+    if (args.method !== void 0 && typeof args.method !== "string")
+      return { error: "an ask is named by a word" };
+    const key = being ?? w.publicKey();
+    const door = key === null ? void 0 : w.doors.get(key);
+    if (!door || door.key === w.pk)
+      return { error: "no such being" };
+    const bound = being !== null;
+    const out = await within(allow(args.wanted).time, answered2(door, bound ? { id: OWNER } : {}, args.method, args.args ?? {}, bound));
+    if (out === LATE)
+      return { error: "late" };
+    if ("quo" in out)
+      return { error: out.quo };
+    if (!("object" in out))
+      return { error: "silence" };
+    return out.object;
+  }
+  return { error: "unknown ask" };
+}
+async function describe(w) {
+  const beings = {};
+  const asked = [...w.doors].filter(([key]) => key !== w.pk);
+  const digests = await Promise.all(asked.map(async ([, door]) => await within(DEFAULT.time, seen(door, { id: OWNER }))));
+  for (const [i, [key, door]] of asked.entries()) {
+    const d = digests[i];
+    put(beings, key, { class: door.cells.class ?? null, public: w.publicKey() === key, digest: d === LATE ? null : d });
+  }
+  for (const [key, cls] of Object.entries(w.absent()))
+    put(beings, key, { class: cls, public: w.publicKey() === key, digest: null, absent: true });
+  return {
+    asks: OWNER_ASKS,
+    notes: { pk: w.pk, beings }
+  };
+}
+
+// ../quo/dist/ward/ward.js
+async function Ward(ground) {
+  const w = await Self.boot(ground);
+  return { door: w.door, ask: w.ask };
+}
+var Self = class _Self {
+  key;
+  pk;
+  g;
+  p;
+  heirs;
+  doors = /* @__PURE__ */ new Map();
+  #birthing = /* @__PURE__ */ new Set();
+  // keys whose constructor is running: taken, though no door and no row say so yet
+  door;
+  ask;
+  static async boot(ground) {
+    return new _Self(ground, await wardKey(ground.seed));
+  }
+  constructor(ground, key) {
+    this.g = ground;
+    this.key = key;
+    this.pk = key.pk;
+    this.p = open(ground.memory);
+    this.#wrote(HEAD);
+    this.heirs = new Heirs(this.p, () => this.#wrote(HEAD));
+    this.door = makeDoor(key, this.heirs, this.doors, () => this.p.public, (n) => ground.random(n), () => this.#keep());
+    this.#boot(this.pk, () => this);
+    for (const [k, c] of Object.entries(this.p.beings)) {
+      const className = c.class;
+      if (k === this.pk || !className)
+        continue;
+      try {
+        this.#boot(k, (stance) => this.g.instantiate(className, stance));
+      } catch {
+      }
+    }
+    this.ask = async (method, args = {}) => {
+      try {
+        const out = await this.answer({ id: OWNER }, method, args);
+        if (!await this.#keep().catch(() => false))
+          return silence;
+        return isSilence(out) || isWord(out) ? silence : out;
+      } catch {
+        return silence;
+      }
+    };
+  }
+  // ---- the ward as a being. asked only by its owners: the root, through
+  // the ask pointer, and its occupants, through the door, whom only the root
+  // can invite. A stranger cannot be a named asker here, because the door
+  // names nobody the ward did not bind.
+  async answer(asker, method, args = {}) {
+    if (asker.id === void 0)
+      return silence;
+    return ownerAnswer({
+      pk: this.pk,
+      doors: this.doors,
+      absent: () => this.#absent(),
+      publicKey: () => this.p.public,
+      instantiate: (className, key) => this.#instantiate(className, key),
+      unboot: (key) => this.#unboot(key),
+      setPublic: (key) => {
+        this.p.public = key;
+        this.#wrote(HEAD);
+      }
+    }, asker, method, args);
+  }
+  // ---- ward functions. on the object. no stance reaches them.
+  // The partition was written, and which row of it: a being by her key, or
+  // the head. The harbor is told, and nothing more: what it does with the
+  // word is its own, and the ward never learns. Every write says its row,
+  // because a harbor told only that something moved must keep all of it, and
+  // a being's row is the one part of a partition that grows without limit.
+  #wrote(row) {
+    this.g.wrote?.(row);
+  }
+  // Whether what was written is kept, asked once at the end of an arrival
+  // and never during one. A harbor that keeps nothing was never going to
+  // refuse anything, so its silence here is yes: a ward driven with no store
+  // under it answers exactly as it did before a harbor could say no.
+  async #keep() {
+    return this.g.keep ? await this.g.keep() : true;
+  }
+  // The rows no door holds this run: beings whose class threw at birth or
+  // is not the harbor's to give. Key to class.
+  #absent() {
+    const out = {};
+    for (const [k, c] of Object.entries(this.p.beings))
+      if (k !== this.pk && !this.doors.has(k))
+        put(out, k, c.class ?? null);
+    return out;
+  }
+  // A new being under a key nobody holds. A key with a row in the partition
+  // is booted, whether a door holds it this run or not: an absent being's
+  // row is hers, with every relation in it, and no class is booted over it.
+  // A throw at birth is that boot's refusal and nothing half-lives; the
+  // ward says which, since the owner hears objects.
+  #instantiate(className, key) {
+    if (typeof key !== "string" || typeof className !== "string" || !key || this.doors.has(key) || at(this.p.beings, key) || this.#birthing.has(key))
+      return null;
+    let door;
+    this.#birthing.add(key);
+    try {
+      door = this.#boot(key, (stance) => this.g.instantiate(className, stance));
+    } catch {
+      return "threw";
+    } finally {
+      this.#birthing.delete(key);
+    }
+    if (!door)
+      return null;
+    unguarded(door.cells).class = className;
+    this.#wrote(key);
+    return door;
+  }
+  // The inverse of boot, and the only way a being leaves a ward. Her
+  // relations go first and by the same calls she would have used herself,
+  // so every occupant hears `removed` at the door from the keys it kept,
+  // rather than meeting a being who is simply not there any more. What is
+  // left after that is her cells and her bind table, and they go with her:
+  // a row naming a being no door holds would be read on the next restart
+  // and boot her again. An absent being leaves the same way: she has no
+  // stance to speak for her, so the ward closes her heirs itself.
+  #unboot(key) {
+    if (key === this.pk)
+      return null;
+    const door = this.doors.get(key);
+    const cells = door?.cells ?? at(this.p.beings, key);
+    if (!cells)
+      return null;
+    const ids = (r) => r !== null && typeof r === "object" ? Object.keys(r) : [];
+    const occupants = ids(cells.occupants), standings = ids(cells.standings);
+    if (door) {
+      for (const id of occupants)
+        door.stance.occupants.remove(id);
+      for (const id of standings)
+        door.stance.standings.remove(id);
+    } else {
+      const bind = at(this.p.bind, key);
+      for (const heir of Object.values(bind?.occupants ?? {}))
+        this.heirs.close(heir);
+    }
+    if (this.p.public === key)
+      this.p.public = null;
+    drop(this.p.beings, key);
+    drop(this.p.bind, key);
+    this.doors.delete(key);
+    this.#wrote(key);
+    this.#wrote(HEAD);
+    return [...occupants, ...standings];
+  }
+  // Nothing is written until there is somebody to write it for: a class the
+  // harbor does not know makes no being, and a boot that made nobody must
+  // leave the partition as it found it.
+  //
+  // `make` is who to build with the stance this raises. Two callers and two
+  // makers: the ground's `instantiate` for a being of the ward, and the ward
+  // itself, which is the first being in its own map and is already made.
+  #boot(key, make) {
+    const cells = guardCells(at(this.p.beings, key) ?? emptyCells(), () => this.#wrote(key));
+    const bind = at(this.p.bind, key) ?? emptyBind();
+    const stance = buildStance({
+      pk: this.pk,
+      // This stance, not merely this key: unboot and boot again under the
+      // same key makes a new being, and the old stance is not hers.
+      live: () => this.doors.get(key)?.stance === stance,
+      mintKey: (b) => this.#mintKey(b, key),
+      openHeir: (heir, being2, id) => this.heirs.open(heir, being2, id),
+      closeHeir: (heir) => this.heirs.close(heir),
+      send: (b, keys, method, args, wanted) => this.#send(b, keys, method, args, wanted, key),
+      // A throw at birth is null to her, not a throw in her method: she asked
+      // for a being and got none, and her own answer is still hers to give.
+      instantiate: (className, k) => {
+        const made = this.#instantiate(className, k);
+        return made && made !== "threw" ? made.key : null;
+      },
+      // The two halves of a maker's way back, each the ward's own call: the
+      // being made mints an occupant for her maker, and a relation that
+      // never came about takes her out again.
+      relate: async (k, id) => await this.doors.get(k)?.stance.occupants.invite(id) ?? null,
+      unmake: (k) => void this.#unboot(k),
+      // What this device lends this ward's beings. The ward knocks and takes
+      // inside the harbor's own call and reads nothing in the value: which
+      // names there are, which ward may ask for one, and what becomes of one
+      // she did not take, is the harbor's and no word of the ward.
+      lend: async (name, take) => await this.g.lend?.(name, take) ?? false,
+      wrote: () => this.#wrote(key)
+    }, key, cells, bind);
+    const being = make(stance);
+    if (!being || typeof being.answer !== "function")
+      return null;
+    put(this.p.beings, key, cells);
+    put(this.p.bind, key, bind);
+    const door = { key, cells, bind, stance, being };
+    this.doors.set(key, door);
+    this.#wrote(key);
+    return door;
+  }
+  async #mintKey(bind, row) {
+    const k = await beingKey(this.g.random(32));
+    bind.minted.push(k.pk);
+    if (bind.minted.length > MINTED)
+      bind.minted.splice(0, bind.minted.length - MINTED);
+    this.#wrote(row);
+    return k;
+  }
+  // One send for every door, the ward's own included. Mine: never leaves.
+  // Not mine: carry. Signs as the standing's current key, announces its
+  // next, seals to the far ward, opens the reply with the ephemeral secret,
+  // and rotates to the announced key once the far door has answered under
+  // the current one.
+  async #send(bind, keys, method, args, wanted, row) {
+    const lower = this.g.calling?.();
+    try {
+      return await this.#sent(bind, keys, method, args, wanted, row);
+    } finally {
+      lower?.();
+    }
+  }
+  async #sent(bind, keys, method, args, wanted, row) {
+    const budget = allow(wanted);
+    const by = (await beingKey(unhex(keys.current))).pk;
+    if (keys.next === null && keys.heir !== null)
+      keys.next = (await this.#mintKey(bind, row)).seed;
+    const next = keys.next === null ? null : (await beingKey(unhex(keys.next))).pk;
+    const seq = keys.seq += 1;
+    this.#wrote(row);
+    if (args === null || typeof args !== "object" || Array.isArray(args) || cellFault(args, "args") !== null)
+      return unreached();
+    let sealed;
+    try {
+      sealed = await sealAsk(keys.heir, { by, next, seq, time: budget.time, method, args }, unhex(keys.current), wardPadlock(keys.ward), this.g.random(32));
+    } catch {
+      return unreached();
+    }
+    const { bytes, ephemeral } = sealed;
+    const carried2 = (keys.ward === this.pk ? this.door(new Uint8Array(bytes)).then((r) => r.bytes) : this.g.carry(keys.ward, bytes)).then((b) => b, () => void 0);
+    const out = await within(budget.time, carried2);
+    if (out === LATE)
+      return word("late");
+    if (out === void 0)
+      return unreached();
+    const reply = await openReply(out, ephemeral, wardSignPk(keys.ward));
+    if (!reply)
+      return silence;
+    if ("object" in reply && keys.next !== null) {
+      keys.current = keys.next;
+      keys.next = null;
+    }
+    this.#wrote(row);
+    return reply;
+  }
+};
+
+// dock/notifications.ts
+var seed = () => globalThis.crypto.getRandomValues(new Uint8Array(32));
+var Notifications = class extends Faculty {
+  // The banner key, as hex: the seed it was made from, kept so the pair can
+  // be made again, and the public half a device hands out.
+  static cells = { watched: {}, minted: 0, banner: null };
+  static asks = {
+    notify: { description: "show the human a line", input: { type: "object", properties: { title: { type: "string" }, body: { type: "string" } }, required: ["title"] } },
+    banner: { description: "this device's banner key, the public half, which a world seals a notification to", input: { type: "object" } }
+  };
+  notify(_args) {
+    return Promise.resolve({ error: "this box shows no notifications" });
+  }
+  // The pair, minted once and kept. Every call after the first is the same
+  // key, because a device that minted a new one on every ask would be a
+  // device whose worlds all seal to a key it has forgotten.
+  async key() {
+    if (typeof this.cells.banner !== "string") {
+      this.cells.banner = arithmetic_exports.hex(seed());
+      await this.plant(await arithmetic_exports.sealingPair(arithmetic_exports.unhex(this.cells.banner)));
+    }
+    return arithmetic_exports.sealingPair(arithmetic_exports.unhex(this.cells.banner));
+  }
+  async banner(_args) {
+    return { banner: arithmetic_exports.hex((await this.key()).pk) };
+  }
+  // Where this terrain's notification process reads the secret half. The
+  // base plants nothing, which is right for a terrain that draws its own
+  // banners in the same process; a phone overrides it and writes into the
+  // keychain group its extension shares with the app.
+  plant(_pair) {
+    return Promise.resolve();
+  }
+};
+
+// dock/webpush.ts
+var subtle3 = () => globalThis.crypto.subtle;
+var ES256 = { name: "ECDSA", namedCurve: "P-256" };
+var b64url = (bytes) => {
+  let binary = "";
+  for (const b of bytes) binary += String.fromCharCode(b);
+  return btoa(binary).replaceAll("+", "-").replaceAll("/", "_").replaceAll("=", "");
+};
+var unb64url = (v) => {
+  const binary = atob(v.replaceAll("-", "+").replaceAll("_", "/"));
+  const out = new Uint8Array(binary.length);
+  for (let at3 = 0; at3 < binary.length; at3 += 1) out[at3] = binary.charCodeAt(at3);
+  return out;
+};
+function publicOf(key) {
+  if (typeof key.x !== "string" || typeof key.y !== "string") throw new Error("a vapid key is a P-256 JWK");
+  const x = unb64url(key.x), y = unb64url(key.y);
+  const raw = new Uint8Array(65);
+  raw[0] = 4;
+  raw.set(x, 1);
+  raw.set(y, 33);
+  return b64url(raw);
+}
+async function mintVapid() {
+  const pair = await subtle3().generateKey(ES256, true, ["sign", "verify"]);
+  const key = await subtle3().exportKey("jwk", pair.privateKey);
+  return { key, publicKey: publicOf(key) };
+}
+var OVERHEAD = 16 + 4 + 1 + 65 + 1 + 16;
+
+// dock/push.ts
+var isToken = (v) => v !== null && typeof v === "object" && !Array.isArray(v) && typeof v.kind === "string";
+var SEAL = 4096;
+function banner(o) {
+  const text3 = (v) => typeof v === "string" && v.trim() ? v.trim() : "";
+  const title = text3(o.title) || text3(o.from) || "quo";
+  const body = text3(o.body) || text3(o.said) || Object.entries(o).filter(([k]) => k !== "title" && k !== "from").map(([k, v]) => `${k}: ${typeof v === "string" ? v : JSON.stringify(v)}`).join(", ");
+  return { title, body };
+}
+async function sealBanner(line, key) {
+  if (!/^[0-9a-f]{64}$/.test(key)) return null;
+  try {
+    const boxed = await arithmetic_exports.box(new TextEncoder().encode(JSON.stringify(line)), arithmetic_exports.unhex(key), globalThis.crypto.getRandomValues(new Uint8Array(32)));
+    const wire = arithmetic_exports.hex(boxed.bytes);
+    return wire.length > SEAL ? null : wire;
+  } catch {
+    return null;
+  }
+}
+var root = (_occ, asker) => asker.id === OWNER;
+var Push = class extends Faculty {
+  // What she keeps, beside every faculty's: the world's doorbell key, a P-256
+  // JWK she mints herself the first time a terrain asks for one, so a Web
+  // Push is signed under a key that lives with the wards and in no file; and
+  // the bell service a phone's ring is handed to when its token names none,
+  // a row the root keeps, since whose service it is belongs to an estate.
+  static cells = { watched: {}, minted: 0, key: null, service: null };
+  static asks = {
+    ring: { description: "wake a device: its token, the banner sealed to it, or the line itself where the ground encrypts it", input: { type: "object", properties: { token: { type: "object" }, sealed: { type: "string" }, line: { type: "object", properties: { title: { type: "string" }, body: { type: "string" } }, required: ["title", "body"] } }, required: ["token"] } },
+    kinds: { description: "which kinds this box can ring", input: { type: "object" } },
+    keep: { description: "the bell service a phone is rung through when its token names none; null forgets it", input: { type: "object", properties: { service: { type: ["string", "null"] } }, required: ["service"] }, for: root }
+  };
+  // The doorbell key, minted once and kept. A terrain asks for it when it
+  // serves a web route; a box that never does holds none and rings no tabs.
+  async mint() {
+    if (this.cells.key === null) this.cells.key = (await mintVapid()).key;
+    return this.cells.key;
+  }
+  get key() {
+    return this.cells.key;
+  }
+  get service() {
+    return typeof this.cells.service === "string" ? this.cells.service : void 0;
+  }
+  keep(args) {
+    const service = args.service;
+    if (service !== null && (typeof service !== "string" || !/^https?:\/\/\S+$/.test(service))) return { error: "a bell service is a URL over http or https, or null" };
+    this.cells.service = service === null ? null : service.replace(/\/$/, "");
+    return { service: this.cells.service };
+  }
+  // What this box can ring. A terrain overrides it and builds its rings from
+  // its environment and this being's cells; the base rings nothing.
+  get rings() {
+    return {};
+  }
+  kinds() {
+    return { kinds: Object.keys(this.rings) };
+  }
+  async ring(args) {
+    const token = args.token;
+    if (!isToken(token)) return { error: "a token names its kind" };
+    const sealed = args.sealed;
+    if (sealed !== void 0 && typeof sealed !== "string") return { error: "a seal is text" };
+    if (typeof sealed === "string" && sealed.length > SEAL) return { error: `a seal is at most ${SEAL} bytes` };
+    const said2 = args.line;
+    if (said2 !== void 0 && (said2 === null || typeof said2 !== "object" || Array.isArray(said2) || typeof said2.title !== "string" || typeof said2.body !== "string")) return { error: "a line is a title and a body" };
+    const line = said2;
+    const r = Object.hasOwn(this.rings, token.kind) ? this.rings[token.kind] : void 0;
+    if (!r) return { error: `this box cannot ring a ${token.kind}` };
+    try {
+      await r.ring(token, sealed, line);
+      return { rang: token.kind };
+    } catch (e) {
+      return { error: e instanceof Error ? e.message : "the ring threw" };
+    }
+  }
+};
+
+// dock/timer.ts
+var MINUTE = 6e4;
+var DAY = 864e5;
+var Timer = class extends Faculty {
+  static asks = {
+    watch: { description: "wake me when I say I am next due", input: { type: "object", properties: { invitation: { type: "object" }, method: { type: "string" }, args: { type: "object" } }, required: ["invitation", "method"] } },
+    due: { description: "bring my next round forward to this moment", input: { type: "object", properties: { at: { type: "number" } }, required: ["at"] } },
+    now: { description: "this box\u2019s moment", input: { type: "object" } }
+  };
+  #timeout;
+  #stopped = false;
+  #armed = null;
+  #round = null;
+  // The moment she is armed for, or null while she is asleep. For the
+  // device's own code and for a suite; it crosses no door.
+  get armed() {
+    return this.#armed;
+  }
+  // A watcher says she is due sooner than the box knew. It only ever brings
+  // the round forward: what fires is decided at the tick, in the watcher's
+  // own cells, so an arming that moved later on somebody's word would be a
+  // schedule somebody else held silenced. The door is the whole gate here:
+  // a standing at a faculty comes from `lend` alone, and this adds no second
+  // one.
+  due(args) {
+    const at3 = args.at;
+    if (typeof at3 !== "number" || !Number.isFinite(at3)) return { error: "a due carries the moment: { at }" };
+    const when = moment(at3);
+    if (this.#armed === null || when < this.#armed) this.#arm(when);
+    return { armed: this.#armed };
+  }
+  // Whoever was just filed is ticked at once, and what she answers is what
+  // the box arms for. One move covers a box booting, a home moving in and a
+  // watcher born long after the box was up: she is never waiting for a round
+  // nobody scheduled.
+  async welcomed(id) {
+    await this.round(Date.now(), id);
+  }
+  // The arming went off. A moment still well ahead is the day's cap this
+  // class put on its own timeout, so it is armed again rather than fired: a
+  // terrain calls this and never has to know how far out the arming was.
+  async rang() {
+    if (this.#stopped) return [];
+    if (this.#armed !== null && this.#armed - Date.now() > 1e3) {
+      this.arm(this.#armed);
+      return [];
+    }
+    return this.fire(Date.now());
+  }
+  // The moment, read here and handed on. A device's own code may call it at a
+  // moment it names, which is how a suite proves a wake without waiting for
+  // one and how an operator makes a round happen now.
+  fire(now) {
+    return this.round(now);
+  }
+  // One round, and never two: a second while one is in flight is handed the
+  // one already running. What every watcher answered decides the next
+  // arming, and a `due` that landed while the round ran is not lost.
+  round(now, only) {
+    if (this.#round) return this.#round;
+    const mine = this.#run(now, only);
+    this.#round = mine;
+    return mine.finally(() => {
+      if (this.#round === mine) this.#round = null;
+    });
+  }
+  async #run(now, only) {
+    if (only === void 0) this.#arm(null);
+    const woke = await this.woke((w) => ({ ...w.args, now }), only);
+    if (woke === null) {
+      this.stop();
+      return [];
+    }
+    const named = soonest(woke);
+    const said2 = named !== null && named > Date.now() ? named : null;
+    const held2 = this.#armed;
+    const at3 = said2 === null ? held2 : held2 === null ? moment(said2) : Math.min(held2, moment(said2));
+    if (at3 !== null && at3 !== this.#armed) this.#arm(at3);
+    else if (at3 === null && this.#armed !== null) this.#arm(null);
+    return woke;
+  }
+  #arm(when) {
+    if (this.#stopped) return;
+    this.#armed = when;
+    this.arm(when);
+  }
+  // The one thing a terrain says about itself: be woken at this moment, or at
+  // no moment at all. A subclass replaces this and nothing else of her.
+  //
+  // Here it is a timeout, capped at a day and armed again when the cap goes
+  // off. The box stays up for its work and never for this, so the handle is
+  // unreferenced.
+  arm(when) {
+    clearTimeout(this.#timeout);
+    this.#timeout = void 0;
+    if (when === null) return;
+    this.#timeout = setTimeout(() => void this.rang(), Math.min(Math.max(when - Date.now(), 0), DAY));
+    this.#timeout.unref?.();
+  }
+  // A being her ward took out reaches nobody, so nothing is left to wake. The
+  // device calls this when it puts the box down.
+  stop() {
+    this.#stopped = true;
+    this.#armed = null;
+    this.arm(null);
+  }
+  now() {
+    return { now: Date.now() };
+  }
+};
+var moment = (at3) => Math.max(at3, Math.floor(at3 / MINUTE) * MINUTE + 500);
+function soonest(woke) {
+  let at3 = null;
+  for (const w of woke) {
+    if (w.out === null || typeof w.out !== "object") continue;
+    const next = w.out.next;
+    if (typeof next !== "number" || !Number.isFinite(next)) continue;
+    if (at3 === null || next < at3) at3 = next;
+  }
+  return at3;
+}
+
+// dock/apns.ts
+var LIFE = 45 * 60 * 1e3;
+
+// dock/fcm.ts
+var LIFE2 = 59 * 60 * 1e3;
+
+// dock/index.ts
+var LOCATION = "location";
+var NOTIFICATIONS = "notifications";
+var PUSH = "push";
+var TIMER = "timer";
+var FACULTIES = { [LOCATION]: "Location", [NOTIFICATIONS]: "Notifications", [PUSH]: "Push", [TIMER]: "Timer" };
+var FACULTY_CLASSES = { Console, Local, Location, Notifications, Push, Timer };
+var DOCK = "dock";
+async function stand(harbor, lent = FACULTIES) {
+  const kept = await harbor.store.load(DOCK);
+  const ward = harbor.wards.get(DOCK) ?? (kept ? await harbor.host(DOCK, kept) : await harbor.create(DOCK, CONSOLE));
+  return standOn(ward, lent);
+}
+async function standOn(ward, lent = FACULTIES) {
+  for (const [name, className] of Object.entries(lent)) await ward.ask("boot", { key: name, class: className });
+  await ward.ask("boot", { key: CONSOLE, class: "Console" });
+  for (const name of Object.keys(lent)) {
+    const inv = await ward.ask("invite", { being: name, id: `${CONSOLE}:${name}` });
+    if (!isInvitation(inv)) continue;
+    await ward.ask("knock", { being: CONSOLE, id: name, invitation: inv });
+  }
+  await ward.save?.();
+  return lending(ward);
+}
+function lending(ward) {
+  return async (name, take) => {
+    const id = `lent:${fresh()}`;
+    const out = await ward.ask("invite", { being: name, id });
+    if (!isInvitation(out)) return false;
+    const took = await take(out);
+    if (!took) await ward.ask("remove", { being: name, id });
+    await ward.save?.();
+    return took;
+  };
+}
+var fresh = () => Array.from(globalThis.crypto.getRandomValues(new Uint8Array(8))).map((b) => b.toString(16).padStart(2, "0")).join("");
+
+// beings/user.ts
+var DESK = "desk";
+var BELL = "bell";
+var HOME = "home";
+var isDesk = (occ) => occ?.id === DESK;
+var isDevice = (occ) => occ !== void 0 && occ.id !== DESK;
+var rootMinted = (occ) => isDevice(occ) && occ?.notes.client === void 0;
+var client = (occ) => typeof occ?.notes.client === "string" ? occ.notes.client : rootMinted(occ) ? occ.id : null;
+var MINTINGS = ["wake", "reach", "mint", "revoke"];
+var OUTBOX = 32;
+var rang = (out) => !isSilence(out) && !isWord(out) && out !== null && typeof out === "object" && !Array.isArray(out) && out.rang !== void 0 && out.rang !== false;
+var held = (occ) => isDesk(occ) ? { wake: true, reach: true, mint: true, revoke: true } : { wake: occ?.notes.wake === true || rootMinted(occ), reach: occ?.notes.reach === true || rootMinted(occ), mint: occ?.notes.mint === true, revoke: occ?.notes.revoke === true };
+var mayWake = (occ) => held(occ).wake;
+var mayMint = (occ) => isDesk(occ) || isDevice(occ) && held(occ).mint;
+var mayRevoke = (occ) => isDesk(occ) || isDevice(occ) && held(occ).revoke;
+var User = class extends Carrier {
+  static carries(occ) {
+    return isDevice(occ) && held(occ).reach;
+  }
+  // `ways` holds a device's way back that could not be taken when it was
+  // handed over: the knock was unreached, a tab whose pk the far harbor had
+  // not bound yet, a phone in a tunnel. Nothing delivered spends nothing,
+  // so the invitation is tried again at the next push.
+  // The bell standing is plumbing and carries nothing: a device that may
+  // reach what she holds sees acme and the house, and never the envoy that
+  // wakes it. Her ways back are plumbing too, and a way back to a presence
+  // being carries that device's faculties, `to:phone-location-where`, which
+  // is how a model at home learns where the human is.
+  static hidden(id) {
+    return super.hidden(id) || id === PUSH || id.startsWith(`${BELL}:`);
+  }
+  // Her own door is carried to a device that may mint, and to nobody else:
+  // `mint` is the word for a device trusted to change who is in her world,
+  // and owning the world from that device is that trust said in full. A
+  // device that reaches sees acme and the house, and no `home-boot`.
+  static shows(id, occ) {
+    return id !== HOME || held(occ).mint;
+  }
+  static cells = { name: "", reports: [], ways: {}, outbox: {} };
+  // Her standing at the box's push faculty, taken again at every birth: a
+  // standing points at a being and not at a box, and a ward that moved is
+  // handed the new harbor's ground. It is how she rings a browser endpoint,
+  // which is the one kind of doorbell a world holds itself, since an
+  // endpoint answers only to the VAPID secret this world minted. Birth is
+  // synchronous and taking a standing is not, so the promise is kept and
+  // the ring waits on it.
+  //
+  // A box that lends no push rings no tabs, which is what a world with no
+  // web route behind it is.
+  #push;
+  constructor(stance) {
+    super(stance);
+    this.#push = join(this, PUSH);
+  }
+  // A world whose own being she is, is a home: a device reaching her holds
+  // a standing at home and not a membership, and she says so in her notes,
+  // since nothing else in a describe tells a shell which of its worlds is
+  // the human's own. She knows it by the door she holds: the being setup
+  // knocked on the ward's own door as its owner is home's, and a member of
+  // the same class the desk made in an org's ward holds no door and says
+  // nothing.
+  describe(asker) {
+    const bp = super.describe(asker);
+    if (!this.standings[HOME]) return bp;
+    const notes = bp.notes !== null && typeof bp.notes === "object" && !Array.isArray(bp.notes) ? bp.notes : {};
+    return { ...bp, notes: { ...notes, home: true } };
+  }
+  static asks = {
+    hello: { description: "say hello, and hand back an invitation so she can reach you", input: { type: "object", properties: { invitation: { type: "object" } } } },
+    whoami: { description: "who she thinks you are", input: { type: "object" }, for: isDevice },
+    device: { description: "mint an invitation for another device", input: { type: "object", properties: { client: { type: "string" }, wake: { type: "boolean" }, reach: { type: "boolean" }, mint: { type: "boolean" }, revoke: { type: "boolean" } }, required: ["client"] }, for: mayMint },
+    push: { description: "push an object to a device: wake it with an event", input: { type: "object", properties: { client: { type: "string" }, object: { type: "object" } }, required: ["client", "object"] }, for: mayWake },
+    chores: { description: "what the agent may run", input: { type: "object" }, for: (occ) => client(occ) === "agent" },
+    look: { description: "how she is shown", input: { type: "object" }, for: isDevice },
+    page: { description: "her page, as a tree of values", input: { type: "object" }, for: isDevice },
+    name: { description: "what she is called", input: { type: "object", properties: { name: { type: "string" } }, required: ["name"] }, for: rootMinted },
+    devices: { description: "the devices in this world, and which one you are", input: { type: "object" }, for: isDevice },
+    join: { description: "join a world with an invitation: she knocks, hands back a way to reach her, and keeps the standing", input: { type: "object", properties: { invitation: { type: "object", description: "the invitation that world minted" }, name: { type: "string", description: "what to call it here" } }, required: ["invitation", "name"] }, for: mayMint },
+    forget: { description: "revoke a device: drop its way in and her way back to it, in one act", input: { type: "object", properties: { client: { type: "string" } }, required: ["client"] }, for: mayRevoke },
+    report: { description: "what a run of yours found", input: { type: "object", properties: { event: { type: "object" }, result: {} }, required: ["event", "result"] }, for: isDevice },
+    bell: { description: "how to wake this device: a standing at its own doorbell and the banner key it seals to, or a browser push endpoint", input: { type: "object", properties: { invitation: { type: "object" }, banner: { type: "string" }, token: { type: "object" } } }, for: isDevice },
+    missed: { description: "what this device missed while it was unreachable", input: { type: "object" }, for: isDevice }
+  };
+  // Anyone may say hello. A device that hands her an invitation in the args
+  // is taken as a standing under its own id, so she can push to it later;
+  // if it cannot be taken now, it is kept and tried at the next push. The
+  // desk's first hello names her: a being does not know her own key, and the
+  // root's setup knocks with the name it booted her under. Once named, she
+  // keeps it.
+  async hello(args, asker) {
+    if (asker.id !== void 0 && args.invitation && typeof args.invitation === "object" && !Array.isArray(args.invitation)) {
+      await this.wayBack(asker.id, args.invitation);
+    }
+    if (asker.id === DESK && !this.cells.name && typeof args.name === "string" && /^[\w.-]{1,80}$/.test(args.name)) this.cells.name = args.name;
+    return { welcome: asker.id ?? null, name: this.cells.name };
+  }
+  // Take a device's way back, or keep it for later when the knock did not
+  // reach. A refusal spends the heir and is final; the way is dropped.
+  async wayBack(id, inv) {
+    const ways = this.cells.ways;
+    const back = await this.knock(inv);
+    if (!isSilence(back) && !isWord(back)) {
+      await this.take(`to:${id}`, inv);
+      delete ways[id];
+      return true;
+    }
+    if (isWord(back) && wordOf(back) !== "unreached") delete ways[id];
+    else ways[id] = inv;
+    return false;
+  }
+  whoami(_args, asker) {
+    return { id: asker.id ?? null, client: client(this.occupant(asker)) };
+  }
+  // The front desk asks, or a device of hers that may mint; she mints. The
+  // client identity goes into the occupant's notes, and that is what every
+  // gate reads. The three words travel with it, each asked for and each
+  // written only if the asker holds it: devices beget devices, and a device
+  // hands on no more than it was given.
+  async device(args, asker) {
+    const c = typeof args.client === "string" ? args.client : null;
+    if (c === null) return { error: "client is a string" };
+    const mine = held(this.occupant(asker));
+    const inv = await this.invite(c);
+    if (inv === null) return { error: "id taken" };
+    const rec = this.cells.occupants[c];
+    if (rec) {
+      rec.notes.client = c;
+      for (const w of MINTINGS) if (args[w] === true && mine[w]) rec.notes[w] = true;
+    }
+    return inv;
+  }
+  // Her way out and the device's way in are two relations, and Quo keeps
+  // them apart. She joins them herself, here, as her own rule: she does
+  // not reach a device she no longer admits. Without it a revoked device
+  // stops being able to ask her and keeps receiving everything she pushes.
+  async push(args) {
+    const c = typeof args.client === "string" ? args.client : null;
+    if (c === null || !this.cells.occupants[c]) return { error: "no such device, or it gave no way back" };
+    const ways = this.cells.ways;
+    const object = args.object ?? {};
+    if (!this.standings[`to:${c}`] && ways[c]) await this.wayBack(c, ways[c]);
+    const st = this.standings[`to:${c}`];
+    if (!st) return ways[c] ? this.unreached(c, object) : { error: "no such device, or it gave no way back" };
+    const out = await st.ask("notify", object);
+    if (isWord(out) && wordOf(out) === "unreached") return this.unreached(c, object);
+    return isSilence(out) ? { error: "silence" } : isWord(out) ? { error: wordOf(out) } : { pushed: out };
+  }
+  // Nothing was delivered, so the device is asleep, closed or in a tunnel.
+  // The object waits in her outbox under that device, bounded and oldest
+  // out, since a device gone for a month must not grow without end; then
+  // she rings, and the pusher hears both facts. What the ring carries is
+  // the device's token and nothing of the object: the device wakes, dials,
+  // and drains it over its own standing, sealed.
+  async unreached(id, object) {
+    const box2 = this.cells.outbox[id] ??= [];
+    box2.push(object);
+    while (box2.length > OUTBOX) box2.shift();
+    return { unreached: true, rang: await this.ring(id, object) };
+  }
+  // A phone is rung on the standing it handed her, with the line sealed to
+  // the banner key it handed her beside it. Who is ringing is the standing
+  // the ring arrives on, so the ask carries no world, no pk and no token,
+  // and there is nothing in it to forge. A browser is rung on its endpoint
+  // through this box's own push faculty, because an endpoint answers only
+  // to the key this world minted, and the line goes with it unsealed:
+  // Web Push encrypts a body to the subscription's own keys, so a second
+  // seal would hide it from nobody it is not already hidden from.
+  async ring(id, object) {
+    const rec = this.cells.occupants[id];
+    const at3 = this.standings[`${BELL}:${id}`];
+    const key = rec?.notes.banner;
+    if (at3 && typeof key === "string") {
+      const sealed = await sealBanner(banner(object), key);
+      return sealed === null ? false : rang(await at3.ask("ring", { sealed }));
+    }
+    const token = rec?.notes.bell;
+    if (!isToken(token)) return false;
+    await this.#push;
+    const st = this.standings[PUSH];
+    if (!st) return false;
+    return rang(await st.ask("ring", { token, line: banner(object) }));
+  }
+  // A device says how it is woken, and what it says is kept on its own
+  // occupant, so forgetting the device forgets the way to wake it in the
+  // same act.
+  //
+  // A phone or a desk hands a standing at a doorbell of its own, and the
+  // banner key that doorbell never learns. This world holds a way to wake
+  // that one device and nothing it could hand on: no other world rings on
+  // this standing, the device cuts it by itself at the doorbell, and the
+  // platform's token rotating is one write there that no world is told of.
+  //
+  // A browser hands its endpoint instead and needs no doorbell: an endpoint
+  // is rung only by whoever holds the VAPID secret the subscription was
+  // made under, and that secret is this world's own.
+  //
+  // A store's token never arrives here. The same token at every world is
+  // the bearer credential the doorbell exists to take away, so one is
+  // refused where a human can read why.
+  async bell(args, asker) {
+    const c = client(this.occupant(asker));
+    const rec = c === null ? void 0 : this.cells.occupants[c];
+    if (c === null || !rec) return { error: "no client" };
+    if (args.invitation === void 0 && args.token === void 0) {
+      const at3 = this.standings[`${BELL}:${c}`];
+      return { kept: at3 && typeof rec.notes.banner === "string" ? "doorbell" : isToken(rec.notes.bell) ? "web" : null };
+    }
+    if (isInvitation(args.invitation)) {
+      const key = args.banner;
+      if (typeof key !== "string" || !/^[0-9a-f]{64}$/.test(key)) return { error: "a banner key is thirty two bytes as hex" };
+      const id = `${BELL}:${c}`;
+      this.standings.remove(id);
+      const out = await this.knock(args.invitation);
+      if (isSilence(out) || isWord(out)) return { error: isSilence(out) ? "silence" : wordOf(out) };
+      if (await this.take(id, args.invitation) === null) return { error: "that invitation was refused" };
+      rec.notes.banner = key;
+      delete rec.notes.bell;
+      return { kept: "doorbell" };
+    }
+    if (!isToken(args.token)) return { error: "a token names its kind" };
+    if (args.token.kind !== "web") return { error: "a device hands a standing at its own doorbell, never a store token" };
+    rec.notes.bell = args.token;
+    return { kept: "web" };
+  }
+  // The device is back. It drains what it missed and composes what the
+  // human sees from these objects, which crossed sealed and were never on
+  // a push service. Emptied as it is handed over: an ask that answered is
+  // an ask that arrived, and a device that lost the answer has lost one
+  // notification, not its relation.
+  missed(_args, asker) {
+    const c = client(this.occupant(asker));
+    if (c === null) return { error: "no client" };
+    const box2 = this.cells.outbox;
+    const out = box2[c] ?? [];
+    delete box2[c];
+    return { missed: out };
+  }
+  // She joins a world. This is the day a homeless org gains a home: an org
+  // whose whole existence was standings in other orgs' worlds boots a home
+  // on a box it trusts, and that home joins each of those from there.
+  // Nothing is converted and no id changes, because from the far world's
+  // side this home is one more thing of hers holding a standing, exactly as
+  // her phone is: her device there minted the invitation with `device`, and
+  // this is the other half, the knock.
+  //
+  // It is a device that may mint who asks it, and that needs no word of its
+  // own: `mint` is what shows her own door to a device, so one that holds
+  // it can boot and invite in her world already, and adding one standing to
+  // what she carries is less than that. In practice such a device holds
+  // `reach` as well, since a device that joined a world it could not then
+  // see would be a device doing something for somebody else. She hands back a way for the far being
+  // to reach her, as a device does at hello, and a far being who refuses it
+  // is joined all the same.
+  async join(args) {
+    const inv = args.invitation;
+    if (!isInvitation(inv)) return { error: "that is not an invitation" };
+    const name = typeof args.name === "string" ? args.name.trim() : "";
+    if (!/^[\w.-]{1,80}$/.test(name) || name === HOME || name === PUSH) return { error: "a name is a word, and not home or the push" };
+    if (this.standings[name]) return { error: "name taken" };
+    const back = `from:${name}`;
+    const mine = await this.invite(back);
+    if (mine === null) return { error: "name taken" };
+    const out = await this.knock(inv, "hello", { invitation: mine });
+    if (isSilence(out) || isWord(out)) {
+      this.occupants.remove(back);
+      return { error: isSilence(out) ? "silence" : wordOf(out) };
+    }
+    if (out !== null && typeof out === "object" && !Array.isArray(out) && "error" in out) this.occupants.remove(back);
+    const took = await this.take(name, inv);
+    if (took === null) {
+      this.occupants.remove(back);
+      return { error: "that invitation was refused" };
+    }
+    return { joined: name };
+  }
+  // Her devices, by the names they were given, with what each was granted
+  // and which of them is asking. Without this a human cannot use `forget`
+  // or `push` at all: both name a device, and nobody who has just lost a
+  // phone remembers what it was called. It is read-only and says nothing
+  // secret; a device is a name and three words, and the keys are in the
+  // relations rather than here.
+  // People-shaped rows, since a page says devices are people: a name, and
+  // a line that says what each may do and which one is asking.
+  devices(_args, asker) {
+    const me = client(this.occupant(asker));
+    return Object.entries(this.cells.occupants).filter(([id]) => id !== DESK).map(([id, rec]) => {
+      const notes = rec.notes;
+      const name = typeof notes.client === "string" ? notes.client : id;
+      const has = MINTINGS.filter((w) => held(rec)[w]);
+      const line = [...name === me ? ["this one"] : [], ...has.length ? [`may ${has.join(", ")}`] : []].join(" \xB7 ");
+      return { name, line, client: name, ...name === me ? { you: true } : {}, ...has.length ? { may: has } : {} };
+    });
+  }
+  // Revocation is one act at her, because only she knows both ids. A side
+  // that had to remove two relations by hand could leave half of one
+  // standing, and every side would have to remember which half.
+  forget(args) {
+    const c = typeof args.client === "string" ? args.client : null;
+    if (c === null) return { error: "client is a string" };
+    this.occupants.remove(c);
+    this.standings.remove(`to:${c}`);
+    this.standings.remove(`${BELL}:${c}`);
+    delete this.cells.ways[c];
+    delete this.cells.outbox[c];
+    return { forgot: c };
+  }
+  chores() {
+    return { chores: ["census", "report"] };
+  }
+  // How a device shows her: her name as the title, and what each ask is
+  // called. Values only; the screen and the model side each read their part.
+  look() {
+    return {
+      name: this.cells.name || "you",
+      order: ["whoami", "devices", "device", "join", "push", "forget", "name"],
+      asks: { whoami: { title: "who am I", readOnly: true }, devices: { title: "your devices", readOnly: true }, device: { title: "invite a device" }, join: { title: "join a world" }, push: { title: "wake a device" }, forget: { title: "take a device out of your world", destructive: true }, name: { title: "call her" } }
+    };
+  }
+  // Her page for a device: her name, who this device is, the worlds she
+  // holds as sections, and the three things a human does here by hand,
+  // bringing her next device in, waking one and naming her. The invitation
+  // `device` answers is a way in, and the side paints it as the link it is,
+  // since a being does not know where her page lives. `hello` and `report` are wiring, a
+  // device's first word and an agent's callback; they stay in her describe
+  // under the gate and off her page, since a page is presentation and the
+  // gate is permission. A device that may not do a thing sees no form for
+  // it, however the page names it.
+  page(_args, asker) {
+    return {
+      kind: "stack",
+      of: [
+        { kind: "text", text: this.cells.name || "you", role: "title" },
+        { kind: "text", text: `on ${client(this.occupant(asker)) ?? "a device"}`, role: "quiet" },
+        { kind: "text", text: "your devices", role: "label" },
+        { kind: "answer", ask: "devices", as: "people" },
+        // every standing she carries as its section, and the door of her
+        // own world as a door: seven owner asks are a page of their own
+        ...Object.keys(this.cells.standings).sort((a, b) => a === HOME ? 1 : b === HOME ? -1 : a.localeCompare(b)).map((id) => id === HOME ? { kind: "standing", id, as: "door" } : { kind: "standing", id }),
+        { kind: "form", ask: "device" },
+        { kind: "form", ask: "join" },
+        { kind: "form", ask: "push" },
+        { kind: "form", ask: "forget" },
+        { kind: "form", ask: "name" }
+      ]
+    };
+  }
+  // A device the root minted may say what she is called: the root trusts
+  // it with its id and its reach already, and a being does not know her own
+  // key. A name is a word; she keeps the last one given.
+  name(args) {
+    const name = typeof args.name === "string" ? args.name.trim() : "";
+    if (!/^[\w.-]{1,80}$/.test(name)) return { error: "a name is a word" };
+    this.cells.name = name;
+    return { named: name };
+  }
+  // A device that ran something for her says what it found. Kept, so that
+  // whoever renders her can show it; the ask itself is the callback.
+  report(args, asker) {
+    this.cells.reports.push({ from: asker.id ?? null, event: args.event ?? null, result: args.result ?? null });
+    return { reported: true };
+  }
+};
+
+// beings/desk.ts
+var Desk = class extends Being {
+  static asks = {
+    hello: { description: "how to get in", input: { type: "object" } },
+    send: { description: "send a way in to an address of yours", input: { type: "object", properties: { kind: { type: "string" }, to: { type: "string" } }, required: ["kind", "to"] } },
+    device: { description: "trade a proof for a device invitation", input: { type: "object", properties: { proof: { type: "object" } }, required: ["proof"] } }
+  };
+  // The box's way in, taken at every birth as any being takes what her box
+  // lends. A box that lends none, a tab or the edge, leaves her holding
+  // nothing under that id and the kind is not offered.
+  constructor(stance) {
+    super(stance);
+    void join(this, LOCAL, void 0, WAY(LOCAL));
+  }
+  // The ids of the ways in she holds, in the order they were placed.
+  get ways() {
+    const out = [];
+    for (const id of Object.keys(this.cells.standings)) {
+      const kind = kindOf(id);
+      if (kind !== null && this.standings[id]) out.push({ id, kind });
+    }
+    return out;
+  }
+  // Before she is described, she learns what her ways in can be asked. A
+  // standing's blueprint is filled by an empty ask and by nothing else, and
+  // a way in placed on her a moment ago has none yet; each is asked once,
+  // and a way in that will not describe stays a kind she can only verify.
+  async answer(asker, method, args = {}) {
+    if (method === void 0) {
+      for (const w of this.ways) if (this.cells.standings[w.id]?.blueprint === null) await this.standings[w.id]?.ask();
+    }
+    return await super.answer(asker, method, args);
+  }
+  // The kinds are the ways in she holds and change with them, so the form a
+  // stranger sees is shaped now rather than declared once: `send` is there
+  // only where a way in says it can be asked to send, and it names the kinds
+  // that can. A world with none shows no such form, and a link is the only
+  // way in, as it always was.
+  describe(asker) {
+    const bp = super.describe(asker);
+    const kinds = this.ways.filter((w) => this.cells.standings[w.id]?.blueprint?.asks.some((a) => a.name === "send")).map((w) => w.kind);
+    const asks = bp.asks.flatMap((a) => {
+      if (a.name !== "send") return [a];
+      if (kinds.length === 0) return [];
+      return [{ ...a, input: { type: "object", properties: { kind: { type: "string", enum: kinds, default: kinds[0] }, to: { type: "string" } }, required: ["kind", "to"] } }];
+    });
+    return { ...bp, asks };
+  }
+  // A stranger learns the proof kinds and nothing else. Who lives on this
+  // world is not the caller's to know: the way in names the user, so
+  // nobody at the door ever has to, and a world with a thousand of them
+  // would otherwise hand the whole list to anyone who knocked.
+  hello(_args, asker) {
+    return { desk: true, asker: asker.id ?? null, kinds: this.ways.map((w) => w.kind) };
+  }
+  // A stranger asks for a way in to an address that is hers. Nothing of this
+  // world changes here and nothing is minted: the way in sends, and the
+  // proof that comes back is what admits her.
+  async send(args) {
+    const { kind, to } = args;
+    if (typeof kind !== "string" || typeof to !== "string") return { error: "kind and to are words" };
+    const way = this.standings[WAY(kind)];
+    if (!way) return { error: "no such way in" };
+    const out = await way.ask("send", { to });
+    if (isSilence(out) || isWord(out)) return { error: "no such way in" };
+    return out;
+  }
+  async device(args) {
+    const proof = args.proof;
+    if (!proof || typeof proof !== "object" || Array.isArray(proof) || typeof proof.kind !== "string") return { error: "proof has a kind" };
+    const way = this.standings[WAY(proof.kind)];
+    const said2 = way ? await way.ask("verify", { proof }) : null;
+    const who = said2 === null || isSilence(said2) || isWord(said2) ? null : verified(said2);
+    if (!who) return { error: "refused" };
+    const id = `user:${who.user}`;
+    if (!this.standings[id] && (who.make === true || typeof who.make === "string")) {
+      if (!/^[\w.-]{1,80}$/.test(who.user) || who.user === "desk") return { error: "a user is a word, and not desk" };
+      if (await this.boot(typeof who.make === "string" ? who.make : "User", who.user, id) === null) return { error: "no such user" };
+      await this.standings[id].ask("hello", { name: who.user });
+    }
+    const user = this.standings[id];
+    if (!user) return { error: "no such user" };
+    const inv = await user.ask("device", { client: who.client, ...who.wake === true ? { wake: true } : {}, ...who.reach === true ? { reach: true } : {}, ...who.mint === true ? { mint: true } : {}, ...who.revoke === true ? { revoke: true } : {} });
+    if (isSilence(inv)) return { error: "silence" };
+    if (isWord(inv)) return { error: wordOf(inv) };
+    return inv;
+  }
+};
+
+// beings/avatar.ts
+var USER = "user";
+var PUSHER = "user:push";
+var Avatar = class extends Carrier {
+  static cells = { inbox: [] };
+  static asks = {
+    notify: { description: "a push from the user being", input: { type: "object" }, for: (occ) => occ?.id === PUSHER }
+  };
+  // Her sides' ears. One identity is one avatar for life, and two sessions
+  // of that identity are two sides on her at once, so a push goes to every
+  // ear present; each side adds its own on open and removes it on close.
+  // Dropped if there is none.
+  ears = /* @__PURE__ */ new Set();
+  // ---- what the user being may ask her
+  notify(args) {
+    this.cells.inbox.push(args);
+    for (const ear of this.ears) ear(args);
+    return { notified: true };
+  }
+  // ---- what her side calls. Not asks: nobody reaches these through a door.
+  // The credential exchange's last step. `desk` is the desk's public
+  // invitation, `proof` is what the route produced. She knocks the desk as a
+  // stranger, gets an invitation the user being minted, and joins with it. A
+  // knock on a public invitation births nothing, so she holds no standing at
+  // the desk afterwards. If she already holds `user`, this is a reconnect and
+  // nothing is minted.
+  async enter(desk, proof) {
+    if (this.standings[USER]) return this.tools();
+    const inv = await this.knock(desk, "device", { proof });
+    if (isSilence(inv)) return { error: "silence" };
+    if (isWord(inv)) return { error: wordOf(inv) };
+    if (!inv || typeof inv !== "object" || Array.isArray(inv) || "error" in inv) return inv ?? { error: "no invitation" };
+    return this.join(inv);
+  }
+  // Knock with an invitation, hand the far being one back so she can push,
+  // and take her as `user`. The only moment a standing is born here. A being
+  // who answers the hello with an error object is a being who answered: she
+  // is taken all the same, and the way back she did not take is dropped, so
+  // any world's public being may admit a guest, hello or not.
+  async join(invitation) {
+    if (this.standings[USER]) {
+      const had = await this.tools();
+      if (!("error" in had) || had.error !== "removed") return had;
+      this.standings.remove(USER);
+      this.occupants.remove(PUSHER);
+    }
+    const mine = await this.invite(PUSHER);
+    if (mine === null) return { error: "user is taken" };
+    const out = await this.knock(invitation, "hello", { invitation: mine });
+    if (isSilence(out) || isWord(out)) {
+      this.occupants.remove(PUSHER);
+      return { error: isSilence(out) ? "silence" : wordOf(out) };
+    }
+    if (out !== null && typeof out === "object" && !Array.isArray(out) && "error" in out) this.occupants.remove(PUSHER);
+    await this.take(USER, invitation);
+    return this.tools();
+  }
+  // Her describe, as the user being shows it to her. This is the tool list.
+  async tools() {
+    const st = this.standings[USER];
+    if (!st) return { error: "not joined" };
+    const bp = await st.ask();
+    if (isSilence(bp) || isWord(bp)) return { error: isSilence(bp) ? "silence" : wordOf(bp) };
+    return bp;
+  }
+  // One call from the side, one ask on the standing. The three words pass
+  // through untouched; the side renders them.
+  call(name, args = {}, wanted) {
+    const st = this.standings[USER];
+    return st ? st.ask(name, args, wanted) : Promise.resolve({ error: "not joined" });
+  }
+};
+
+// beings/presence.ts
+var Presence = class extends Avatar {
+  // Her world's user being sees the box, and nobody else: the way back she
+  // handed over at the join is the one occupant who may ask through her.
+  static carries(occupant2, _asker) {
+    return occupant2?.id === PUSHER;
+  }
+  // Her standing at the user being is hers to speak through and never to
+  // carry: the user being carries her, so carrying it back would be a
+  // loop, and it is the one standing that is not a faculty.
+  static skips(id) {
+    return id === USER;
+  }
+  // Which names the box lent her, by name, settled after birth.
+  lent;
+  constructor(stance) {
+    super(stance);
+    this.lent = Promise.all(Object.keys(FACULTIES).map(async (name) => [name, await join(this, name)])).then((all) => Object.fromEntries(all));
+  }
+};
+
+// beings/courier.ts
+var MOVER = "mover";
+var HEX2 = /^(?:[0-9a-f]{2})+$/;
+var PK = /^[0-9a-f]{128}$/;
+var invited = (occ) => occ !== void 0;
+function isMoving(v) {
+  if (v === null || typeof v !== "object" || Array.isArray(v)) return false;
+  const m = v;
+  const object = (x) => x !== null && typeof x === "object" && !Array.isArray(x);
+  return typeof m.world === "string" && PK.test(m.world) && typeof m.at === "string" && typeof m.name === "string" && typeof m.seed === "string" && HEX2.test(m.seed) && object(m.partition) && object(m.record);
+}
+var answered3 = (out) => {
+  if (isSilence(out)) return { error: "silence" };
+  if (isWord(out)) return { error: wordOf(out) };
+  if (out === null || typeof out !== "object" || Array.isArray(out)) return { error: "the other device answered nothing" };
+  return out;
+};
+var Courier = class extends Being {
+  static asks = {
+    hand: { description: "the ward this device is giving away: its world, where that world lives, and the ward itself", input: { type: "object" }, for: invited },
+    done: { description: "the ward arrived on the other device: delete the copy here", input: { type: "object" }, for: invited }
+  };
+  // The shell holding the device that gives: what to hand over, and what to
+  // do when the other end says it landed. Set while a move is offered and
+  // gone after, so a courier nobody is holding gives nothing.
+  giving;
+  gone;
+  // ---- what the device taking asks
+  async hand() {
+    if (!this.giving) return { error: "this device is giving nothing away" };
+    return await this.giving();
+  }
+  async done() {
+    if (!this.gone) return { error: "this device is giving nothing away" };
+    return await this.gone();
+  }
+  // ---- what the shell taking calls. Not asks: nobody reaches these through a door.
+  // Knock the far courier, take the ward she answers with, and hold her:
+  // the standing is what the second ask goes through, and a knock is spent
+  // the moment it is answered.
+  async fetch(invitation) {
+    const out = answered3(await this.knock(invitation, "hand", {}));
+    if ("error" in out && typeof out.error === "string") return { error: out.error };
+    if (!isMoving(out)) return { error: "the other device answered with something that is not a ward" };
+    if (await this.take(MOVER, invitation) === null) return { error: "this device could not hold the other one" };
+    return out;
+  }
+  // It is here: the other device may delete its copy.
+  async landed() {
+    const standing = this.standings[MOVER];
+    if (!standing) return { error: "this device is not holding the other one" };
+    const out = answered3(await standing.ask("done", {}));
+    if (typeof out.deleted === "string") return { deleted: out.deleted };
+    return { error: typeof out.error === "string" ? out.error : "the other device would not let go" };
+  }
+};
+
+// beings/envoy.ts
+var FRESH = 5 * 6e4;
+
+// beings/clock.ts
+var WOKE = `${TIMER}:wake`;
+var MINUTE2 = 6e4;
+var HOUR = 36e5;
+var SPAN2 = 23 * HOUR + 59 * MINUTE2;
+
+// ../quo/dist/ward/ground.js
+var maker = (objects, ...registries) => (className, stance) => {
+  const r = registries.find((reg) => reg !== void 0 && Object.hasOwn(reg, className));
+  const C = r?.[className];
+  if (!C)
+    return null;
+  const obj = new C(stance);
+  objects.set(stance.cells, obj);
+  return obj;
+};
+var entropy = (n) => globalThis.crypto.getRandomValues(new Uint8Array(n));
+async function learnPk(w) {
+  const notes = await w.ask();
+  const pk = notes?.notes?.pk;
+  if (typeof pk !== "string")
+    throw new Error("the ward did not say its pk");
+  return pk;
+}
+
+// ../quo/dist/harbor/reach.js
+var never = () => new Promise(() => {
+});
+function request(url) {
+  const base = url.replace(/\/$/, "");
+  return {
+    close: () => {
+    },
+    carry: async (pk, bytes) => {
+      let res;
+      const body = new Uint8Array(bytes.length);
+      body.set(bytes);
+      try {
+        res = await fetch(`${base}/${pk}`, { method: "POST", headers: { "content-type": "application/octet-stream", "quo-suite": String(SUITE) }, body });
+      } catch {
+        return void 0;
+      }
+      if (res.status === 404 || res.status >= 400 && res.status < 500 || res.status === 502 || res.status === 503 || res.status === 504)
+        return void 0;
+      if (!res.ok)
+        return never();
+      return new Uint8Array(await res.arrayBuffer());
+    }
+  };
+}
+var ASK = 0;
+var REPLY = 1;
+var NONE = 2;
+var SUITE = 1;
+var REFUSED = 4001;
+var OPEN = 1;
+var PENDING = 4096;
+var Socket = class {
+  line;
+  pending = /* @__PURE__ */ new Map();
+  far = [];
+  // the pks the far side announced
+  #id = 1;
+  #open;
+  constructor(line, deliver, onAnnounce, onClose) {
+    this.line = line;
+    line.binaryType = "arraybuffer";
+    this.#open = line.readyState === OPEN ? Promise.resolve() : new Promise((ok, no) => {
+      line.addEventListener("open", ok);
+      line.addEventListener("error", no);
+      line.addEventListener("close", () => no(new Error("closed before it opened")));
+    });
+    this.#open.catch(() => {
+    });
+    line.addEventListener("message", (e) => {
+      if (typeof e.data === "string") {
+        try {
+          const m = JSON.parse(e.data);
+          if (m.suite !== void 0 && m.suite !== SUITE) {
+            this.far = [];
+            line.close(REFUSED, "suite");
+            return;
+          }
+          if (Array.isArray(m.announce)) {
+            this.far = m.announce.filter((x) => typeof x === "string");
+            onAnnounce(this.far);
+          }
+        } catch {
+        }
+        return;
+      }
+      const buf = e.data instanceof ArrayBuffer ? new Uint8Array(e.data) : ArrayBuffer.isView(e.data) ? new Uint8Array(e.data.buffer, e.data.byteOffset, e.data.byteLength) : void 0;
+      if (!buf || buf.length < 5)
+        return;
+      const kind = buf[0], id = new DataView(buf.buffer, buf.byteOffset, buf.byteLength).getUint32(1);
+      if (kind === ASK) {
+        const pk = hex2(buf.subarray(5, 69));
+        void deliver(pk, new Uint8Array(buf.subarray(69))).then((back) => back, () => void 0).then((back) => {
+          const head = new Uint8Array(5);
+          head[0] = back === void 0 ? NONE : REPLY;
+          new DataView(head.buffer).setUint32(1, id);
+          if (line.readyState === OPEN)
+            line.send(back === void 0 ? head : concat([head, back]));
+        });
+        return;
+      }
+      const waiting = this.pending.get(id);
+      if (!waiting)
+        return;
+      this.pending.delete(id);
+      waiting(kind === REPLY ? new Uint8Array(buf.subarray(5)) : void 0);
+    });
+    line.addEventListener("error", () => {
+    });
+    line.addEventListener("close", (e) => {
+      this.pending.clear();
+      onClose({ code: e?.code, reason: e?.reason });
+    });
+  }
+  // Say which ward pks this side holds.
+  announce(pks) {
+    if (this.line.readyState === OPEN)
+      this.line.send(JSON.stringify({ announce: pks, suite: SUITE }));
+  }
+  async carry(pk, bytes) {
+    try {
+      await this.#open;
+    } catch {
+      return void 0;
+    }
+    if (this.line.readyState !== OPEN)
+      return void 0;
+    const id = this.#id++;
+    const head = new Uint8Array(69);
+    head[0] = ASK;
+    new DataView(head.buffer).setUint32(1, id);
+    head.set(unhex(pk), 5);
+    return new Promise((ok) => {
+      if (this.pending.size >= PENDING)
+        this.pending.delete(this.pending.keys().next().value);
+      this.pending.set(id, ok);
+      this.line.send(concat([head, bytes]));
+    });
+  }
+  close() {
+    this.line.close();
+  }
+};
+
+// ../quo/dist/harbor/store.js
+var values = (p) => JSON.parse(JSON.stringify(p));
+var rowsOf = (partition, rows) => rows.map((row) => {
+  const value = rowOf(partition, row);
+  return [row, value === void 0 ? void 0 : values(value)];
+});
+
+// ../quo/dist/harbor/core.js
+var DEFAULT_CODE = "classes/index.ts";
+var PROBE = 1e4;
+var ANNOUNCE = 64;
+var PROVING = 8;
+var announces = /* @__PURE__ */ new WeakMap();
+var Harbor = class {
+  store;
+  loader;
+  wards = /* @__PURE__ */ new Map();
+  // name -> pointers
+  doors = /* @__PURE__ */ new Map();
+  // ward pk -> door
+  reaches = /* @__PURE__ */ new Map();
+  // the directory: foreign ward pk -> reach
+  down = /* @__PURE__ */ new Set();
+  // pks this harbor will not reach right now: weather, for a test
+  refused = /* @__PURE__ */ new Map();
+  // own ward pk -> arrivals its door would not admit. what a terrain does with it is its own
+  faults = /* @__PURE__ */ new Map();
+  // ward name -> saves the store refused. what a terrain does with it is its own
+  // Told every time a save is refused, with the ward's name and how many of
+  // its saves the store has now refused. The refusal is already the answer of
+  // the ask that caused it, so nobody is waiting on this; it is for the box's
+  // own record, a journal line or a counter, and a terrain that keeps none
+  // leaves it alone.
+  onFault = () => {
+  };
+  unbooted = [];
+  // the wards the store keeps that would not host this run, by name
+  classes = {};
+  // classes handed in-process, beside the loader's
+  #saving = /* @__PURE__ */ new Map();
+  // The dialers' sockets, in the order they were dialed: where a pk nobody
+  // here knows is sent, because the listener a harbor dialed is a rendezvous
+  // and may hold that pk for someone else. It is a list because a harbor may
+  // dial more than one, and a rendezvous is a listener and nothing more, so
+  // there is never only one of them. A pk is tried down the list until one
+  // carries it: with a single slot, a harbor holding two lines answered
+  // unreached for a pk the other line could have reached.
+  fallbacks = [];
+  // How a dialer says what this harbor holds now. An announce is a claim and
+  // a claim is worth nothing until the door behind it answers a probe, so
+  // saying it again costs a proof and buys nothing to an impostor. What is
+  // not free is never saying it again: a ward booted, adopted or dropped
+  // after a line opened would be announced only by the next line, and a line
+  // that does not drop never opens again, so it would be unreachable through
+  // that listener for as long as the socket stayed healthy.
+  announcers = /* @__PURE__ */ new Set();
+  #announce() {
+    for (const say of this.announcers)
+      say();
+  }
+  // What this device lends the beings of the wards it hosts, by name. One
+  // for the harbor, and `lendFor` says which ward may ask it: every ward,
+  // unless a terrain says a stranger's ward is lent nothing.
+  // Set at birth or once the harbor's own ward is standing, which is the
+  // usual order: a terrain puts that ward up first, then boots the rest on a
+  // ground that can reach it.
+  lend;
+  constructor(store, loader = async () => ({}), lend) {
+    this.store = store;
+    this.loader = loader;
+    this.lend = lend;
+  }
+  lendFor(_name, _record) {
+    return this.lend;
+  }
+  // Boot every ward the store keeps, and learn the hints. One ward that will
+  // not host, a partition this kit cannot read or a loader that throws, is
+  // named in `unbooted` and takes nobody else down with it.
+  async boot() {
+    for (const name of await this.store.list()) {
+      if (this.wards.has(name))
+        continue;
+      try {
+        const kept = await this.store.load(name);
+        if (kept)
+          await this.host(name, kept);
+      } catch {
+        this.unbooted.push(name);
+      }
+    }
+    for (const [pk, url] of Object.entries(await this.store.hints()))
+      this.hint(pk, url);
+  }
+  // The object a ward writes into, by the name it is kept under: the
+  // partition the harbor was handed at boot and keeps so it can save it.
+  // Nothing in the harbor reads it, and it is not on `Hosted`, because a
+  // side that holds a ward would then hold every seed in it and reach any
+  // being past every door. It is here for one reader, the conformance
+  // suite, whose census is ward state read straight and whose forgeries are
+  // ward state written straight, the way `MemoryHarbor.partitions` is. A
+  // side asks the ward.
+  partitionOf(name) {
+    return this.#saving.get(name)?.memory;
+  }
+  // ---- saving
+  // The ward wrote one row. Its partition is saved once the line is free, and
+  // once for every burst of writes, with every row named in that burst.
+  #wrote(name, row) {
+    const s = this.#saving.get(name);
+    if (!s || s.gone)
+      return;
+    s.dirty.add(row);
+    if (s.timer === void 0)
+      s.timer = setTimeout(() => void this.#flush(name), 0);
+  }
+  // The rows a store refused, put back in the ward's memory to what the
+  // store holds for them. A being whose row was refused would otherwise go
+  // on answering out of a memory that runs ahead of the device: her next
+  // write is a row past the same ceiling, refused again, and everything she
+  // was told between now and the reload is gone with it. Standing her at
+  // what is kept costs her the writes that were never kept, which is what
+  // the asker was told, and leaves a small write after it one the store
+  // takes.
+  //
+  // The shape is read where the shape lives. The harbor hands each row and
+  // the copy it kept to the partition, which knows which part of itself a row
+  // is; nothing here reads a being, a bind table or a head. And nothing here
+  // asks the store: what it took is what this harbor handed it, which is
+  // `kept`, and a row nobody has handed it since this ward was hosted is a
+  // row the ward has not moved, so there is nothing to put back.
+  // Every row together, and never the refused ones alone. A relation's state
+  // is spread over rows, the head for the door's heirs and a being's own row
+  // for the keys she speaks under: put one back and the door stands ahead of
+  // the knocker and the relation never speaks again. So the ward is put back
+  // to the whole point, which is what the store held at the last save taken
+  // while no call was in flight. A row that point never knew is left where it
+  // is and stays named: no save has ever taken it, so there is nothing to put
+  // it back to. The rows that moved come back, so the store is put back with
+  // them and a reload finds no half-done row.
+  #standAtKept(s) {
+    if (s.gone)
+      return [];
+    const moved = [];
+    for (const row of s.kept.keys()) {
+      const was = s.kept.get(row);
+      const now = rowsOf(s.memory, [row])[0][1];
+      if (JSON.stringify(was) === JSON.stringify(now))
+        continue;
+      restoreRow(s.memory, row, was);
+      moved.push(row);
+    }
+    for (const row of moved)
+      s.dirty.delete(row);
+    return moved;
+  }
+  // The ward back to the point, and the store with it. The store is written
+  // because a reload reads it and not the memory: a refusal that put only the
+  // memory back would leave the rows the store did take standing ahead of the
+  // ward until the next restart, and one half of a relation ahead of the
+  // other. What goes out is what the store already took once, so it is a
+  // write the store has no reason to refuse; one that refuses it anyway is
+  // counted like any other, and there is nothing further to put back to.
+  async #putBack(name, s) {
+    const under2 = [...s.under.keys()];
+    s.under.clear();
+    const moved = this.#standAtKept(s);
+    const rows = [.../* @__PURE__ */ new Set([...moved, ...under2])];
+    if (rows.length === 0 || s.gone)
+      return;
+    try {
+      await this.store.save(name, s.memory, rows);
+      for (const row of rows)
+        s.dirty.delete(row);
+    } catch {
+      this.#fault(name);
+    }
+  }
+  // The call ended and the ward is whole, so the point catches up with it. A
+  // row the store took under the call and nobody has touched since is where
+  // the ward stands, so it joins the point as it is; a row that moved after
+  // that save is named for one more, and that save is quiet and moves the
+  // point itself. Nothing is written twice for a ward whose call left its
+  // rows where the store already has them.
+  #settle(name, s) {
+    for (const [row, value] of s.under) {
+      const now = rowsOf(s.memory, [row])[0][1];
+      if (JSON.stringify(value) === JSON.stringify(now))
+        s.kept.set(row, value);
+      else
+        s.dirty.add(row);
+    }
+    s.under.clear();
+    if (s.dirty.size > 0)
+      void this.#flush(name);
+  }
+  // One refusal, counted and told. What a terrain does with the count is its
+  // own; the arrival that caused it is told by the answer, not by this.
+  #fault(name) {
+    const faults = (this.faults.get(name) ?? 0) + 1;
+    this.faults.set(name, faults);
+    try {
+      this.onFault(name, faults);
+    } catch {
+    }
+  }
+  // Answers whether everything it wrote was kept. False is a store that
+  // refused, and it is the ward's answer to the arrival that caused it, not
+  // a number in a map nobody reads. A flush that had nothing to write kept
+  // everything it was given, which is true and is why a read is never
+  // refused.
+  async #flush(name) {
+    const s = this.#saving.get(name);
+    if (!s)
+      return true;
+    if (s.timer !== void 0) {
+      clearTimeout(s.timer);
+      s.timer = void 0;
+    }
+    if (s.running)
+      return s.running;
+    s.running = (async () => {
+      if (s.back) {
+        if (s.calls > 0)
+          return false;
+        s.back = false;
+        await this.#putBack(name, s);
+        return false;
+      }
+      while (s.dirty.size > 0 && !s.gone) {
+        const rows = [...s.dirty];
+        s.dirty.clear();
+        const writing = rowsOf(s.memory, rows);
+        try {
+          const quiet = s.calls === 0;
+          await this.store.save(name, s.memory, rows);
+          for (const [row, value] of writing)
+            (quiet ? s.kept : s.under).set(row, value);
+        } catch {
+          this.#fault(name);
+          for (const row of rows)
+            s.dirty.add(row);
+          s.fault = true;
+          if (s.calls > 0) {
+            s.back = true;
+            return false;
+          }
+          await this.#putBack(name, s);
+          return false;
+        }
+      }
+      return true;
+    })();
+    try {
+      return await s.running;
+    } finally {
+      s.running = null;
+    }
+  }
+  // ---- the directory
+  // Bytes to one of this harbor's own doors, and the one bit the door says
+  // beside its reply, counted.
+  async #own(pk, door, bytes) {
+    const r = await door(bytes);
+    if (!r.heard)
+      this.refused.set(pk, (this.refused.get(pk) ?? 0) + 1);
+    return new Uint8Array(r.bytes);
+  }
+  async carry(pk, bytes) {
+    if (this.down.has(pk))
+      return void 0;
+    const door = this.doors.get(pk);
+    if (door)
+      return this.#own(pk, door, bytes);
+    const bound = this.reaches.get(pk);
+    if (bound)
+      return bound.reach.carry(pk, bytes);
+    for (const reach of this.fallbacks) {
+      const back = await reach.carry(pk, bytes);
+      if (back !== void 0)
+        return back;
+    }
+    return void 0;
+  }
+  async deliver(pk, bytes) {
+    if (this.down.has(pk))
+      return void 0;
+    const door = this.doors.get(pk);
+    if (door)
+      return this.#own(pk, door, bytes);
+    const bound = this.reaches.get(pk);
+    return bound?.held ? bound.reach.carry(pk, bytes) : void 0;
+  }
+  hint(pk, url) {
+    if (this.reaches.has(pk))
+      return;
+    this.reaches.set(pk, { reach: request(url), held: false });
+  }
+  async remember(pk, url) {
+    this.hint(pk, url);
+    await this.store.hint(pk, url);
+  }
+  // An announce is a claim, and a claim binds nothing until proven: anyone
+  // who can reach a listener could otherwise name a pk that is not theirs and
+  // take its reachability. The proof is the door itself, as it already is. A
+  // lid this harbor minted and noise after it is a box that does not open,
+  // and the door answers one such box with silence sealed to the lid and
+  // signed by the ward key. Only the holder of that ward's seed can write
+  // that reply, the lid is fresh so nothing replays, and a box that does not
+  // open writes nothing at the ward. This is the one box a harbor ever opens,
+  // the one it sealed itself, and it reads nothing from it but that it is
+  // the silence a door owes such a box, signed by the claimed key.
+  async prove(pk, reach) {
+    if (!isWardPk(pk))
+      return false;
+    try {
+      const lid2 = await sealingPair(entropy(KEY));
+      const back = await within(PROBE, reach.carry(pk, concat([lid2.pk, entropy(KEY)])));
+      if (back === LATE || back === void 0)
+        return false;
+      const reply = await openReply(back, lid2.secret, wardSignPk(pk));
+      return reply !== null && "silence" in reply;
+    } catch {
+      return false;
+    }
+  }
+  // Bind what the far side claims, each pk proven at its door first. Both
+  // sides bind this way: the listener the dialer's claims, the dialer the
+  // listener's, since a claim is a claim whichever end made it. An announce
+  // names at most this many pks, and they are proven a few at a time: a
+  // side that announced a thousand would otherwise cost a thousand keys, a
+  // thousand frames and a thousand waits at once, on its word alone.
+  async bind(pks, reach, held2) {
+    const said2 = (announces.get(reach) ?? 0) + 1;
+    announces.set(reach, said2);
+    for (const [pk, b] of this.reaches)
+      if (b.reach === reach && !pks.includes(pk))
+        this.reaches.delete(pk);
+    const claimed = [...new Set(pks)].slice(0, ANNOUNCE);
+    const prove = async (pk) => {
+      if (this.doors.has(pk))
+        return;
+      const standing = this.reaches.get(pk);
+      if (standing?.held && standing.reach !== reach)
+        return;
+      if (!await this.prove(pk, reach))
+        return;
+      if (announces.get(reach) !== said2)
+        return;
+      if (this.reaches.get(pk)?.held && this.reaches.get(pk).reach !== reach)
+        return;
+      this.reaches.set(pk, { reach, held: held2 });
+    };
+    for (let i = 0; i < claimed.length; i += PROVING)
+      await Promise.all(claimed.slice(i, i + PROVING).map(prove));
+  }
+  unbind(reach) {
+    for (const [pk, b] of this.reaches)
+      if (b.reach === reach)
+        this.reaches.delete(pk);
+  }
+  // ---- wards
+  // Mint a seed and boot an empty ward under a name: a world born here.
+  async create(name, user = "", code = DEFAULT_CODE) {
+    const kept = { seed: entropy(KEY), partition: {}, record: { pk: "", code, user } };
+    await this.store.put(name, kept);
+    const hosted = await this.host(name, kept);
+    await this.store.record(name, hosted.record);
+    return hosted;
+  }
+  // Stop serving a ward and take it out of the store: what was kept comes
+  // back, for another harbor to put. The partition is written first, and
+  // never again under this name: whoever still holds the old pointers holds
+  // a ward that saves nothing and answers its owner silence.
+  async drop(name) {
+    const h = this.wards.get(name);
+    if (h) {
+      await h.save();
+      const s = this.#saving.get(name);
+      if (s)
+        s.gone = true;
+      this.#saving.delete(name);
+      this.wards.delete(name);
+      this.doors.delete(h.pk);
+      this.#announce();
+    }
+    return this.store.take(name);
+  }
+  // Put what another harbor dropped, and boot it: same seed, same pk. A ward
+  // that will not boot is not adopted. This is the one path where a partition
+  // written somewhere else arrives, so it is the one place the ward's own
+  // shape check is met, and the name is refused for as long as it is kept:
+  // a partition put and left would hold the name against every later try,
+  // with a copy of it in a store that can never serve it. It goes back out,
+  // and the only copy is the one the caller is still holding.
+  async adopt(name, kept) {
+    await this.store.put(name, kept);
+    try {
+      return await this.host(name, kept);
+    } catch (e) {
+      await this.store.take(name);
+      throw e;
+    }
+  }
+  // A ward from what the store keeps: the ground, once, and two pointers.
+  async host(name, kept) {
+    const { seed: seed2, partition: memory } = kept;
+    const classes = await this.loader(kept.record);
+    const objects = /* @__PURE__ */ new WeakMap();
+    const ground = {
+      seed: seed2,
+      memory,
+      // This ward's own classes first, then the harbor's: a ward that names a
+      // class of its own is answered with hers.
+      instantiate: maker(objects, classes, this.classes),
+      carry: (pk2, bytes) => this.carry(pk2, new Uint8Array(bytes)),
+      random: entropy,
+      wrote: (row) => this.#wrote(name, row),
+      // What the ward wrote is in the store when this resolves, and it says
+      // whether the store took it. The ward calls it at the end of every
+      // arrival, before it seals, so a call through a pointer has already
+      // waited for the store when it comes back: a restart right after one
+      // finds everything, and a refusal is that arrival's own answer rather
+      // than a number counted behind it. A ward that wrote nothing has
+      // nothing to save, so asking it what it holds is free, which is what
+      // makes the ask pointer the way to find out rather than an expensive
+      // one.
+      //
+      // A ward on its way out keeps nothing and refuses nothing: an arrival
+      // racing an unhost is not a store saying no, and saying so would be a
+      // lie in the one direction that matters.
+      keep: async () => {
+        const s = this.#saving.get(name);
+        if (!s || s.gone)
+          return true;
+        const ok = await this.#flush(name);
+        const no = !ok || s.fault;
+        s.fault = false;
+        return !no;
+      },
+      // The ward says a call is in flight, and says when it ends. The harbor
+      // goes on writing under it; what it does not do is take a save made
+      // there as the point a refused ward is put back to, and a refusal that
+      // lands under a call waits here for the call to end before it puts the
+      // ward back. The ward is the one that knows, because a being reaching
+      // another being of her own ward goes to that ward's door directly and
+      // the harbor never sees that call at all.
+      calling: () => {
+        const s = this.#saving.get(name);
+        if (!s)
+          return () => {
+          };
+        s.calls += 1;
+        let lowered = false;
+        return () => {
+          if (lowered)
+            return;
+          lowered = true;
+          s.calls -= 1;
+          if (s.calls > 0 || s.gone)
+            return;
+          if (s.back)
+            void this.#flush(name);
+          else
+            this.#settle(name, s);
+        };
+      }
+    };
+    const lend = this.lendFor(name, kept.record);
+    if (lend)
+      ground.lend = lend;
+    const saving = { memory, dirty: /* @__PURE__ */ new Set(), kept: new Map(rowsOf(memory, rowsIn(memory))), running: null, timer: void 0, gone: false, calls: 0, fault: false, back: false, under: /* @__PURE__ */ new Map() };
+    this.#saving.set(name, saving);
+    let w, pk;
+    try {
+      w = await Ward(ground);
+      pk = await learnPk(w);
+    } catch (e) {
+      saving.gone = true;
+      this.#saving.delete(name);
+      throw e;
+    }
+    const save = async () => void await ground.keep?.();
+    const door = (bytes) => w.door(bytes);
+    const ask = async (method, args) => {
+      if (saving.gone)
+        return silence;
+      return w.ask(method, args);
+    };
+    const beings = memory.beings;
+    const being = (key) => {
+      const cells = beings && Object.hasOwn(beings, key) ? beings[key] : void 0;
+      return cells ? objects.get(cells) : void 0;
+    };
+    const keys = () => Object.keys(beings ?? {}).filter((k) => being(k) !== void 0);
+    const hosted = { door, ask, pk, name, record: { ...kept.record, pk }, being, keys, save };
+    this.wards.set(name, hosted);
+    this.doors.set(hosted.pk, door);
+    await save();
+    this.#announce();
+    return hosted;
+  }
+};
+
+// ../quo/dist/harbor/dial.js
+function dial(harbor, url) {
+  const d = { url, socket: null, wake: () => {
+  }, close: () => {
+  } };
+  let stopped = false, wait = 1e3, timer, line, held2;
+  const connect = () => {
+    timer = void 0;
+    if (stopped)
+      return;
+    line = new WebSocket(url.replace(/\/$/, "").replace(/^http/, "ws"));
+    const s = new Socket(line, (pk, bytes) => harbor.deliver(pk, bytes), (far) => {
+      wait = 1e3;
+      void harbor.bind(far, s, false);
+    }, (why) => {
+      shed();
+      if (held2?.socket !== s)
+        return;
+      held2 = void 0;
+      if (why.code === REFUSED)
+        wait = 3e4;
+      if (!stopped)
+        timer = setTimeout(connect, wait);
+      wait = Math.min(wait * 2, 3e4);
+    });
+    const shed = () => {
+      harbor.announcers.delete(say);
+      harbor.unbind(s);
+      if (d.socket === s)
+        d.socket = null;
+      const at3 = harbor.fallbacks.indexOf(s);
+      if (at3 !== -1)
+        harbor.fallbacks.splice(at3, 1);
+    };
+    held2 = { socket: s, shed };
+    harbor.fallbacks.push(s);
+    const say = () => s.announce([...harbor.doors.keys()]);
+    line.addEventListener("open", () => {
+      if (stopped)
+        return s.close();
+      d.socket = s;
+      harbor.announcers.add(say);
+      say();
+    });
+  };
+  d.wake = () => {
+    if (stopped)
+      return;
+    clearTimeout(timer);
+    timer = void 0;
+    wait = 1e3;
+    const old = held2;
+    held2 = void 0;
+    old?.shed();
+    old?.socket.close();
+    connect();
+  };
+  d.close = () => {
+    stopped = true;
+    clearTimeout(timer);
+    line?.close();
+  };
+  connect();
+  return d;
+}
+
+// harbor/idb.ts
+var WARDS2 = "wards";
+var ROWS = "rows";
+var HINTS = "hints";
+var at2 = (name, row) => `${name}\0${row}`;
+var under = (name) => IDBKeyRange.bound(at2(name, ""), at2(name, "\uFFFF"));
+function open2(name) {
+  return new Promise((ok, no) => {
+    const req = indexedDB.open(name, 2);
+    req.onupgradeneeded = () => {
+      const db = req.result;
+      if (!db.objectStoreNames.contains(WARDS2)) db.createObjectStore(WARDS2);
+      if (!db.objectStoreNames.contains(ROWS)) db.createObjectStore(ROWS);
+      if (!db.objectStoreNames.contains(HINTS)) db.createObjectStore(HINTS);
+    };
+    req.onsuccess = () => ok(req.result);
+    req.onerror = () => no(req.error ?? new Error("indexedDB would not open"));
+  });
+}
+function done(req) {
+  return new Promise((ok, no) => {
+    req.onsuccess = () => ok(req.result);
+    req.onerror = () => no(req.error ?? new Error("indexedDB request failed"));
+  });
+}
+var Idb = class {
+  name;
+  #db;
+  constructor(name = "quo") {
+    this.name = name;
+  }
+  #open() {
+    return this.#db ??= open2(this.name);
+  }
+  async #tx(store, mode) {
+    return (await this.#open()).transaction(store, mode).objectStore(store);
+  }
+  async list() {
+    return (await done((await this.#tx(WARDS2, "readonly")).getAllKeys())).map(String);
+  }
+  async load(name) {
+    const row = await done((await this.#tx(WARDS2, "readonly")).get(name));
+    if (!row) return void 0;
+    const st = await this.#tx(ROWS, "readonly");
+    const keys = (await done(st.getAllKeys(under(name)))).map(String);
+    const vals = await done(st.getAll(under(name)));
+    return { seed: new Uint8Array(row.seed), partition: fromRows(Object.fromEntries(keys.map((k, i) => [k.slice(name.length + 1), vals[i]]))), record: row.record };
+  }
+  async put(name, kept) {
+    const st = await this.#tx(WARDS2, "readwrite");
+    if (await done(st.getKey(name)) !== void 0) throw new Error(`ward ${name} already exists in ${this.name}`);
+    await done(st.put({ seed: kept.seed, record: kept.record }, name));
+    await this.#keep(name, kept.partition, rowsIn(kept.partition));
+  }
+  async save(name, partition, rows) {
+    if (await done((await this.#tx(WARDS2, "readonly")).getKey(name)) === void 0) return;
+    await this.#keep(name, partition, rows);
+  }
+  // The rows named, written or deleted. A row whose being has left comes back
+  // undefined and her record goes with her.
+  async #keep(name, partition, rows) {
+    const st = await this.#tx(ROWS, "readwrite");
+    for (const [row, value] of rowsOf(partition, rows)) {
+      if (value === void 0) await done(st.delete(at2(name, row)));
+      else await done(st.put(value, at2(name, row)));
+    }
+  }
+  async record(name, record) {
+    const st = await this.#tx(WARDS2, "readwrite");
+    const row = await done(st.get(name));
+    if (!row) return;
+    await done(st.put({ ...row, record }, name));
+  }
+  async take(name) {
+    const kept = await this.load(name);
+    if (!kept) return void 0;
+    await done((await this.#tx(ROWS, "readwrite")).delete(under(name)));
+    await done((await this.#tx(WARDS2, "readwrite")).delete(name));
+    return kept;
+  }
+  async hints() {
+    const st = await this.#tx(HINTS, "readonly");
+    const keys = (await done(st.getAllKeys())).map(String);
+    const vals = await done(st.getAll());
+    return Object.fromEntries(keys.map((k, i) => [k, vals[i]]));
+  }
+  async hint(pk, url) {
+    await done((await this.#tx(HINTS, "readwrite")).put(url, pk));
+  }
+  close() {
+    void this.#db?.then((db) => db.close());
+    this.#db = void 0;
+  }
+};
+
+// harbor/browser.ts
+var BUILT_IN = { User, Desk, Avatar, Presence, Courier, ...FACULTY_CLASSES };
+var BrowserHarbor = class extends Harbor {
+  name;
+  dialers = [];
+  #locked;
+  #release;
+  // `lend` is what this box lends the beings of the wards it hosts: a name
+  // to an invitation on a being of its own ward. `stand` builds one; a bare
+  // tab hands none and every name answers null.
+  constructor(store = "quo", classes = {}, lend) {
+    const s = typeof store === "string" ? new Idb(store) : store;
+    super(s, async () => ({ ...BUILT_IN, ...classes }), lend);
+    this.name = typeof store === "string" ? store : "quo";
+    this.#locked = typeof store === "string";
+  }
+  // What this box lends, by name. A bare tab says nothing, stands no ward of
+  // its own and lends nothing.
+  lent;
+  // What this box lends is said before it boots, and standing the ward is
+  // part of booting: a being born in any other ward lends from her first
+  // line, and a ground that could not reach it yet would leave her holding
+  // nothing until her next birth.
+  async stand(lent) {
+    this.lent = lent;
+    if (this.wards.size > 0) this.lend = await stand(this, lent);
+  }
+  // Take the lock and boot every ward kept here. A lock already held is
+  // another tab's harbor over this seed, and this one refuses to boot.
+  async boot() {
+    if (this.#locked) await this.#lease();
+    if (this.lent) this.lend = await stand(this, this.lent);
+    await super.boot();
+    await settled();
+  }
+  // Hold one socket to a world's quo. route.
+  dial(url) {
+    const d = dial(this, url);
+    this.dialers.push(d);
+    return d;
+  }
+  // The device is back: a phone out of a pocket, an app to the foreground.
+  // Every socket is told, and one that died silently is dialed again.
+  wake() {
+    for (const d of this.dialers) d.wake();
+  }
+  async close() {
+    for (const d of this.dialers.splice(0)) d.close();
+    this.store.close?.();
+    this.#release?.();
+    this.#release = void 0;
+  }
+  async #lease() {
+    const locks = globalThis.navigator?.locks;
+    if (!locks) return;
+    const granted = await new Promise((ok) => {
+      void locks.request(`quo:${this.name}`, { ifAvailable: true }, (lock) => {
+        if (!lock) {
+          ok(false);
+          return;
+        }
+        ok(true);
+        return new Promise((release) => this.#release = release);
+      });
+    });
+    if (!granted) throw new Error(`harbor ${this.name} is held by another tab`);
+  }
+};
+
+// human/worlds.ts
+var localName = (pk) => `w-${pk.slice(0, 16)}`;
+function relations(ward) {
+  const out = [];
+  for (const key of ward.keys()) {
+    const a = ward.being(key);
+    if (a instanceof Avatar && a.standings[USER]) out.push({ key, avatar: a });
+  }
+  return out;
+}
+
+// human/wake.ts
+async function drained(harbor, pks) {
+  const out = [];
+  for (const pk of pks) {
+    const ward = harbor.wards.get(localName(pk));
+    if (!ward) continue;
+    for (const rel of relations(ward)) {
+      const got = await rel.avatar.call("missed");
+      const objects = got.missed;
+      if (!Array.isArray(objects)) continue;
+      for (const o of objects) {
+        if (o === null || typeof o !== "object" || Array.isArray(o)) continue;
+        rel.avatar.notify(o);
+        out.push(o);
+      }
+    }
+    await ward.save();
+  }
+  return out;
+}
+function notice(objects) {
+  const line = banner(objects[objects.length - 1] ?? {});
+  return { ...line, body: objects.length > 1 ? `${line.body} (and ${objects.length - 1} more)` : line.body };
+}
+
+// human/worker.ts
+var carried = (event) => {
+  try {
+    const said2 = event.data?.json();
+    if (!said2 || typeof said2.title !== "string") return null;
+    return { title: said2.title, body: typeof said2.body === "string" ? said2.body : "" };
+  } catch {
+    return null;
+  }
+};
+var sw = globalThis;
+var within2 = (ms, work, floor) => Promise.race([work, new Promise((ok) => setTimeout(() => ok(floor), ms))]);
+async function fromPage() {
+  const pages = await sw.clients.matchAll({ type: "window", includeUncontrolled: true });
+  if (pages.length === 0) return null;
+  return within2(
+    5e3,
+    new Promise((ok) => {
+      for (const page of pages) {
+        const channel = new MessageChannel();
+        channel.port1.onmessage = (e) => {
+          const said2 = e.data ?? {};
+          if (Array.isArray(said2.missed)) ok(said2.missed);
+        };
+        page.postMessage({ quo: "wake" }, [channel.port2]);
+      }
+    }),
+    null
+  );
+}
+async function here(cfg2) {
+  const harbor = new BrowserHarbor("quo");
+  try {
+    await harbor.boot();
+  } catch {
+    return [];
+  }
+  try {
+    harbor.dial(cfg2.quo);
+    return await within2(
+      2e4,
+      drained(
+        harbor,
+        Object.values(cfg2.wards).map((w) => w.pk)
+      ),
+      []
+    );
+  } finally {
+    await harbor.close();
+  }
+}
+async function woken(cfg2, said2) {
+  const objects = await fromPage() ?? await here(cfg2);
+  if (!said2 && objects.length === 0) return;
+  const { title, body } = said2 ?? notice(objects);
+  await within2(5e3, sw.registration.showNotification(title, { body, tag: "quo" }), void 0);
+}
+var cfg = sw.quo;
+sw.addEventListener("install", () => void sw.skipWaiting());
+sw.addEventListener("activate", (e) => e.waitUntil(sw.clients.claim()));
+if (cfg) sw.addEventListener("push", (e) => e.waitUntil(woken(cfg, carried(e))));