@quo-systems/quo 0.1.0 → 0.2.0

package/dist/harbor/store.js

@@ -0,0 +1,41 @@
+// The partition is values only, and the ward hands it out through a guard,
+// so a store takes a copy of the values the way a file would: through JSON.
+export const values = (p) => JSON.parse(JSON.stringify(p));
+// The store as a map, one process, nothing kept past it.
+export class MemoryStore {
+    rows = new Map();
+    reach = new Map();
+    async list() {
+        return [...this.rows.keys()];
+    }
+    async load(name) {
+        const row = this.rows.get(name);
+        return row && { seed: new Uint8Array(row.seed), partition: values(row.partition), record: { ...row.record } };
+    }
+    async put(name, kept) {
+        if (this.rows.has(name))
+            throw new Error(`ward ${name} already exists here`);
+        this.rows.set(name, { seed: new Uint8Array(kept.seed), partition: values(kept.partition), record: { ...kept.record } });
+    }
+    async save(name, partition) {
+        const row = this.rows.get(name);
+        if (row)
+            row.partition = values(partition);
+    }
+    async record(name, record) {
+        const row = this.rows.get(name);
+        if (row)
+            row.record = { ...record };
+    }
+    async take(name) {
+        const kept = await this.load(name);
+        this.rows.delete(name);
+        return kept;
+    }
+    async hints() {
+        return Object.fromEntries(this.reach);
+    }
+    async hint(pk, url) {
+        this.reach.set(pk, url);
+    }
+}

package/dist/ward/allowance.d.ts

@@ -0,0 +1,10 @@
+import type { Wanted } from '../being/types.ts';
+export type Allowance = {
+    time: number;
+};
+export declare const DEFAULT: Allowance;
+export declare const CEILING: Allowance;
+export declare function allow(wanted: Wanted | undefined, ceiling?: Allowance, base?: Allowance): Allowance;
+export declare const spent: (a: Allowance) => boolean;
+export declare const LATE: unique symbol;
+export declare function within<T>(ms: number, work: Promise<T>, rang?: () => void): Promise<T | typeof LATE>;

package/dist/ward/allowance.js

@@ -0,0 +1,60 @@
+// SPDX-License-Identifier: Apache-2.0
+// The allowance. Every ask carries, in its signed body, the time it may still
+// spend, in milliseconds. A being who says nothing gets her ward's default and
+// never thinks about it; one who wants to say so passes a third argument, and
+// is held to the ward's ceiling. The door reads it before anything is done
+// under it and refuses a budget already gone, as one silence like every other
+// refusal there. The sender bounds the whole of her ask to the same number,
+// and a wait that ran out is silence, never unreached.
+//
+// Each ask is bounded on its own. The time an arriving call has left does not
+// bound the asks a being makes while answering it: attributing her onward ask
+// to the arrival that caused it needs a context the ward cannot get without
+// naming a runtime, and the ward names none. Every wait still ends.
+// How wide the default is, and how wide she may ask for, are the ward's own —
+// wider is more patient, and no peer can tell the difference except by being
+// refused. A being who never learns the third parameter exists writes correct
+// code forever under these. They are two numbers because the third argument
+// goes both ways: less for the ask she wants back quickly, more for the one
+// she knows is slow.
+export const DEFAULT = { time: 30_000 };
+export const CEILING = { time: 300_000 };
+// What she asked for, held to what her ward allows. A being cannot mint budget
+// nobody granted her: asking for a minute where the ward gives thirty seconds
+// is thirty seconds, silently, because the ceiling is not hers to know.
+// Asking for nothing at all is the default, which is the whole point.
+export function allow(wanted, ceiling = CEILING, base = DEFAULT) {
+    const whole = (n, fallback) => (typeof n === 'number' && Number.isFinite(n) && n > 0 ? Math.floor(n) : fallback);
+    return { time: Math.min(whole(wanted?.time, base.time), ceiling.time) };
+}
+// Whether a budget has anything left to spend. A door reads this on arrival.
+export const spent = (a) => !(a.time > 0);
+// What a wait that ran out comes back as. Its own value, held by nobody
+// outside the ward, so no answer from any door can be mistaken for it.
+export const LATE = Symbol('late');
+// A wait with an end. This is the one thing the ward times, and it covers the
+// whole of an ask, not only the wire: a relation that comes back round is
+// stopped at its own lane, before a single byte is sealed, and a bound that
+// only watched the wire would never see it. A timer is the only way to stop
+// waiting and every language that runs Quo has one; no runtime is named here.
+//
+// `rang` is called the moment the bell rings, before anyone waiting on the
+// wait is told: whoever holds work that has not started yet reads it and does
+// not start it. What comes back late is not read, and what has not left yet
+// does not leave.
+export async function within(ms, work, rang) {
+    let timer;
+    const bell = new Promise((ring) => {
+        timer = setTimeout(() => {
+            rang?.();
+            ring(LATE);
+        }, ms);
+    });
+    try {
+        return await Promise.race([work, bell]);
+    }
+    finally {
+        clearTimeout(timer);
+        void work.then(() => { }, () => { }); // whatever it was, it is nobody's answer now
+    }
+}

package/dist/ward/arithmetic.d.ts

@@ -0,0 +1,26 @@
+export declare const KEY = 32;
+export declare const SIGNATURE = 64;
+export declare const NONCE = 12;
+export declare const TAG = 16;
+export declare function hex(bytes: Uint8Array | ArrayBuffer): string;
+export declare function unhex(text: string): Uint8Array;
+export declare function concat(parts: Uint8Array[]): Uint8Array;
+export declare function sameBytes(a: Uint8Array, b: Uint8Array): boolean;
+export declare const smallOrder: (pk: Uint8Array) => boolean;
+export declare function sha256(...parts: Uint8Array[]): Promise<Uint8Array>;
+export type Pair = {
+    secret: Uint8Array;
+    pk: Uint8Array;
+};
+export declare function signingPair(seed: Uint8Array): Promise<Pair>;
+export declare function sealingPair(seed: Uint8Array): Promise<Pair>;
+export declare function sign(message: Uint8Array, secret: Uint8Array): Promise<Uint8Array>;
+export declare function verify(message: Uint8Array, signature: Uint8Array, pk: Uint8Array): Promise<boolean>;
+export declare function agree(secret: Uint8Array, peerPk: Uint8Array): Promise<Uint8Array>;
+export declare function encrypt(shared: Uint8Array, plaintext: Uint8Array, aad: Uint8Array): Promise<Uint8Array>;
+export declare function decrypt(shared: Uint8Array, ciphertext: Uint8Array, aad: Uint8Array): Promise<Uint8Array>;
+export declare function box(inside: Uint8Array, padlock: Uint8Array, seed: Uint8Array): Promise<{
+    bytes: Uint8Array;
+    ephemeral: Pair;
+}>;
+export declare function unbox(bytes: Uint8Array, padlockSecret: Uint8Array): Promise<Uint8Array>;

package/dist/ward/arithmetic.js

@@ -0,0 +1,159 @@
+// SPDX-License-Identifier: Apache-2.0
+// Four algorithms, named once and never negotiated: Ed25519 signs, X25519
+// agrees, SHA-256 hashes, AES-256-GCM encrypts with the key derived through
+// HKDF-SHA-256 under a fixed label. All four live in `crypto.subtle`, so this
+// takes no package and runs the same in a browser tab as on a server -- on
+// any terrain that carries them. SHA-256, AES-GCM and HKDF are everywhere;
+// the two curves are recent, and a terrain without them is a terrain no ward
+// runs on. `test/floor.test.ts` names the floor and probes for it. Subtle is
+// asynchronous, so everything here is.
+//
+// Ported from an earlier kit's arithmetic. Same bytes, same vectors.
+// `crypto.subtle` is read at every use and never captured at load. A browser
+// on a plain http:// origin has `crypto` without `subtle`, and a terrain may
+// install one after this module is first imported; a reference taken here
+// would turn either into an unreadable failure deep inside a key import.
+const subtle = () => {
+    const s = globalThis.crypto?.subtle;
+    if (!s)
+        throw new Error('this terrain has no crypto.subtle: a ward needs a secure context');
+    return s;
+};
+export const KEY = 32;
+export const SIGNATURE = 64;
+export const NONCE = 12;
+export const TAG = 16;
+const SEAL_INFO = new TextEncoder().encode('quo-seal');
+const SEAL_SALT = new Uint8Array(0);
+// A 32-byte secret plus a fixed prefix is the whole PKCS#8 wrapping for both curves.
+const ED_SECRET = unhex('302e020100300506032b657004220420');
+const X_SECRET = unhex('302e020100300506032b656e04220420');
+const ED = { name: 'Ed25519' };
+const X = { name: 'X25519' };
+const HEX = Array.from({ length: 256 }, (_, at) => at.toString(16).padStart(2, '0'));
+export function hex(bytes) {
+    let out = '';
+    for (const byte of new Uint8Array(bytes))
+        out += HEX[byte];
+    return out;
+}
+export function unhex(text) {
+    const out = new Uint8Array(text.length / 2);
+    for (let at = 0; at < out.length; at += 1)
+        out[at] = parseInt(text.slice(at * 2, at * 2 + 2), 16);
+    return out;
+}
+export function concat(parts) {
+    const out = new Uint8Array(parts.reduce((n, p) => n + p.length, 0));
+    let at = 0;
+    for (const part of parts) {
+        out.set(part, at);
+        at += part.length;
+    }
+    return out;
+}
+export function sameBytes(a, b) {
+    if (a.length !== b.length)
+        return false;
+    let diff = 0;
+    for (let at = 0; at < a.length; at += 1)
+        diff |= a[at] ^ b[at];
+    return diff === 0;
+}
+// The eight small-order points. A public key among them verifies nothing.
+const SMALL_ORDER = [
+    '0100000000000000000000000000000000000000000000000000000000000000',
+    'ecffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff7f',
+    '0000000000000000000000000000000000000000000000000000000000000000',
+    '0000000000000000000000000000000000000000000000000000000000000080',
+    '26e8958fc2b227b045c3f489f2ef98f0d5dfac05d3c63339b13802886d53fc05',
+    'c7176a703d4dd84fba3c0b760d10670f2a2053fa2c39ccc64ec7fd7792ac037a',
+    '26e8958fc2b227b045c3f489f2ef98f0d5dfac05d3c63339b13802886d53fc85',
+    'c7176a703d4dd84fba3c0b760d10670f2a2053fa2c39ccc64ec7fd7792ac03fa',
+].map(unhex);
+export const smallOrder = (pk) => SMALL_ORDER.some((p) => sameBytes(p, pk));
+const key32 = (value, what) => {
+    if (!(value instanceof Uint8Array) || value.length !== KEY)
+        throw new Error(`${what} is not a 32-byte key`);
+    return value;
+};
+const pkcs8 = (prefix, value, what) => concat([prefix, key32(value, what)]);
+const secretKey = (alg, prefix, value, what, uses) => subtle().importKey('pkcs8', pkcs8(prefix, value, what), alg, true, uses);
+const publicKey = (alg, value, what, uses) => subtle().importKey('raw', key32(value, what), alg, true, uses);
+// Subtle exports the public half of a private key only through a JWK, where `x` is the 32 raw bytes in base64url.
+async function rawPublic(secret) {
+    const jwk = await subtle().exportKey('jwk', secret);
+    const binary = atob(jwk.x.replaceAll('-', '+').replaceAll('_', '/'));
+    const out = new Uint8Array(binary.length);
+    for (let at = 0; at < binary.length; at += 1)
+        out[at] = binary.charCodeAt(at);
+    return out;
+}
+export async function sha256(...parts) {
+    return new Uint8Array(await subtle().digest('SHA-256', concat(parts)));
+}
+export async function signingPair(seed) {
+    const secret = await secretKey(ED, ED_SECRET, seed, 'seed', ['sign']);
+    return { secret: Uint8Array.from(seed), pk: await rawPublic(secret) };
+}
+export async function sealingPair(seed) {
+    const secret = await secretKey(X, X_SECRET, seed, 'seed', ['deriveBits']);
+    return { secret: Uint8Array.from(seed), pk: await rawPublic(secret) };
+}
+export async function sign(message, secret) {
+    const key = await secretKey(ED, ED_SECRET, secret, 'secret', ['sign']);
+    return new Uint8Array(await subtle().sign(ED, key, message));
+}
+export async function verify(message, signature, pk) {
+    if (!(signature instanceof Uint8Array) || signature.length !== SIGNATURE)
+        return false;
+    if (!(pk instanceof Uint8Array) || pk.length !== KEY || smallOrder(pk))
+        return false;
+    try {
+        return await subtle().verify(ED, await publicKey(ED, pk, 'pk', ['verify']), signature, message);
+    }
+    catch {
+        return false;
+    }
+}
+export async function agree(secret, peerPk) {
+    const key = await secretKey(X, X_SECRET, secret, 'secret', ['deriveBits']);
+    const peer = await publicKey(X, peerPk, 'padlock', []);
+    const shared = new Uint8Array(await subtle().deriveBits({ name: X.name, public: peer }, key, KEY * 8));
+    if (shared.every((b) => b === 0))
+        throw new Error('dead agreement'); // a padlock that was not a real key
+    return shared;
+}
+// One HKDF-SHA-256 yields the AES key and the nonce together. The nonce needs
+// no randomness of its own: the key it pairs with is fresh on every message.
+async function cipherKey(shared, use) {
+    const material = await subtle().importKey('raw', shared, 'HKDF', false, ['deriveBits']);
+    const out = new Uint8Array(await subtle().deriveBits({ name: 'HKDF', hash: 'SHA-256', salt: SEAL_SALT, info: SEAL_INFO }, material, (KEY + NONCE) * 8));
+    return { key: await subtle().importKey('raw', out.subarray(0, KEY), 'AES-GCM', false, [use]), nonce: out.subarray(KEY) };
+}
+// The additional authenticated data is the ephemeral public key: the one thing outside the seal, bound to it.
+export async function encrypt(shared, plaintext, aad) {
+    const { key, nonce } = await cipherKey(shared, 'encrypt');
+    return new Uint8Array(await subtle().encrypt({ name: 'AES-GCM', iv: nonce, additionalData: key32(aad, 'aad'), tagLength: TAG * 8 }, key, plaintext));
+}
+export async function decrypt(shared, ciphertext, aad) {
+    if (ciphertext.length < TAG)
+        throw new Error('short input');
+    const { key, nonce } = await cipherKey(shared, 'decrypt');
+    return new Uint8Array(await subtle().decrypt({ name: 'AES-GCM', iv: nonce, additionalData: key32(aad, 'aad'), tagLength: TAG * 8 }, key, ciphertext));
+}
+// A box: an ephemeral X25519 pk outside, one ciphertext sealed to the
+// padlock. The answer to a box is a box sealed to that ephemeral pk, so the
+// sender keeps the ephemeral secret until the answer comes.
+export async function box(inside, padlock, seed) {
+    const ephemeral = await sealingPair(seed);
+    const shared = await agree(ephemeral.secret, padlock);
+    return { bytes: concat([ephemeral.pk, await encrypt(shared, inside, ephemeral.pk)]), ephemeral };
+}
+export async function unbox(bytes, padlockSecret) {
+    if (bytes.length <= KEY)
+        throw new Error('short input');
+    const ephemeralPk = bytes.subarray(0, KEY);
+    const shared = await agree(padlockSecret, ephemeralPk);
+    return decrypt(shared, bytes.subarray(KEY), ephemeralPk);
+}

package/dist/ward/cells.d.ts

@@ -0,0 +1,3 @@
+import type { Cells } from '../being/types.ts';
+export declare const cellFault: (v: unknown, path: string) => string | null;
+export declare const guardCells: (cells: Cells) => Cells;

package/dist/ward/cells.js

@@ -0,0 +1,79 @@
+// I-JSON, all the way down. A number that JSON cannot write is not a number
+// a harbor can keep, and a key on the prototype is not a key she wrote.
+function fault(v, path, seen) {
+    if (v === null || typeof v === 'boolean' || typeof v === 'string')
+        return null;
+    if (typeof v === 'number')
+        return Number.isFinite(v) ? null : `${path} is ${String(v)}, which no harbor can write down`;
+    if (typeof v !== 'object')
+        return `${path} is a ${typeof v}, which is not a value`;
+    if (seen.has(v))
+        return `${path} refers back to itself`;
+    seen.add(v);
+    try {
+        if (Array.isArray(v)) {
+            for (let i = 0; i < v.length; i += 1) {
+                const f = fault(v[i], `${path}[${i}]`, seen);
+                if (f)
+                    return f;
+            }
+            return null;
+        }
+        const proto = Object.getPrototypeOf(v);
+        if (proto !== Object.prototype && proto !== null)
+            return `${path} is a ${(v).constructor?.name ?? 'object'}, which is not a value`;
+        for (const k of Object.keys(v)) {
+            const f = fault(v[k], `${path}.${k}`, seen);
+            if (f)
+                return f;
+        }
+        return null;
+    }
+    finally {
+        seen.delete(v);
+    }
+}
+export const cellFault = (v, path) => fault(v, path, new Set());
+// The guard is one proxy at the root and one for every container read through
+// it, so a write nested three deep is refused the same way a write at the top
+// is. Wrappers are remembered, so reading the same array twice is the same
+// object twice and a being may still compare what she holds.
+const wrapped = new WeakMap();
+const guards = new WeakSet();
+function guard(target, path) {
+    if (guards.has(target))
+        return target;
+    const had = wrapped.get(target);
+    if (had)
+        return had;
+    const p = new Proxy(target, {
+        get(t, k, r) {
+            const v = Reflect.get(t, k, r);
+            // A container reached through her cells is part of her cells.
+            return v !== null && typeof v === 'object' && !ArrayBuffer.isView(v) ? guard(v, `${path}.${String(k)}`) : v;
+        },
+        set(t, k, v, r) {
+            if (typeof k === 'string') {
+                const f = cellFault(v, `${path}.${k}`);
+                if (f)
+                    throw new TypeError(`cells hold values: ${f}`);
+            }
+            return Reflect.set(t, k, v, r);
+        },
+        defineProperty(t, k, d) {
+            if (typeof k === 'string' && 'value' in d) {
+                const f = cellFault(d.value, `${path}.${k}`);
+                if (f)
+                    throw new TypeError(`cells hold values: ${f}`);
+            }
+            return Reflect.defineProperty(t, k, d);
+        },
+    });
+    wrapped.set(target, p);
+    guards.add(p);
+    return p;
+}
+// Her cells, guarded. Called once per being at boot; the guarded object is
+// what goes into the partition and what the stance hands her, so there is no
+// second door onto the same cells.
+export const guardCells = (cells) => guard(cells, 'cells');

package/dist/ward/door.d.ts

@@ -0,0 +1,16 @@
+import type { Asker, BeingLike, JsonObject } from '../being/types.ts';
+import type { Heirs } from './heirs.ts';
+import { type ReplyPayload, type WardKey } from './seal.ts';
+export type Door = {
+    key: string;
+    being: BeingLike;
+    cells: {
+        occupants: Record<string, unknown>;
+    };
+};
+export type Judged = {
+    bytes: Uint8Array;
+    heard: boolean;
+};
+export declare function arrive(door: Door, asker: Asker, method: string | undefined, args: JsonObject, bound: boolean): Promise<ReplyPayload>;
+export declare function makeDoor(key: WardKey, heirs: Heirs, doors: Map<string, Door>, publicKey: () => string | null, random: (n: number) => Uint8Array): (bytes: Uint8Array) => Promise<Judged>;

package/dist/ward/door.js

@@ -0,0 +1,127 @@
+// SPDX-License-Identifier: Apache-2.0
+// Judgment at the door. Sealed bytes in, sealed bytes out, and one bit for
+// the harbor: whether a key this door holds spoke. A stranger, bytes the
+// door cannot admit, meets one silence whatever the case, so that it learns
+// nothing, not even which case it hit. A key the door has bound hears the
+// ward's word for what happened, sealed to its own lid, because it has
+// already proven who it is and a reason to it is an oracle to nobody. What
+// passes is named and dispatched to her answer, and her digest for that
+// asker rides back with the object.
+import { isSilence, isWord } from '../being/silence.js';
+import { digest } from '../being/digest.js';
+import { at } from './partition.js';
+import { openAsk, sealReply, verifyAsk } from './seal.js';
+import { spent } from './allowance.js';
+import { KEY, sealingPair } from './arithmetic.js';
+const SILENCE = { silence: true };
+const said = (quo) => ({ quo });
+// One arrival at one being, already named. Catches every throw. `bound` says
+// whether the asker is a key this door holds: she hears `threw`; a stranger
+// at the public being hears silence, because her insides are hers.
+export async function arrive(door, asker, method, args, bound) {
+    const threw = bound ? said('threw') : SILENCE;
+    let out;
+    try {
+        out = await door.being.answer(asker, method, args);
+    }
+    catch {
+        return threw; // she threw where she was asked. there is no answer.
+    }
+    // Nothing at all is not an answer either: a method that forgot to return
+    // has said nothing, and nothing is silence, never a value that JSON drops
+    // on the way out and the far side reads back as a fourth word.
+    if (out === undefined || isSilence(out))
+        return SILENCE;
+    if (isWord(out))
+        return threw; // a word is the ward's to say, never hers
+    if (method === undefined)
+        return { object: out, seen: null };
+    // The digest rides along, it is not the answer. She has already answered:
+    // a describe that will not run costs the digest, and nothing else.
+    return { object: out, seen: await seen(door, asker) };
+}
+async function seen(door, asker) {
+    try {
+        const bp = await door.being.answer(asker);
+        return isSilence(bp) || isWord(bp) ? null : await digest(bp);
+    }
+    catch {
+        return null;
+    }
+}
+export function makeDoor(key, heirs, doors, publicKey, random) {
+    const judge = async (bytes) => {
+        const a = await openAsk(bytes, key.padlock);
+        if (!a)
+            return null; // D1. it did not open. there is nobody to answer.
+        const { to, payload, ephemeralPk } = a;
+        const refuse = () => ({ reply: SILENCE, ephemeralPk, heard: false });
+        // D2, the rest of it. The allowance is read before anything is done under
+        // it, and hops at zero is refused so that a relay chain invented later
+        // meets doors that already stop it. Nothing sets hops.
+        if (spent({ time: payload.time }) || payload.hops === 0)
+            return refuse();
+        const args = payload.args ?? {};
+        if (to === null) {
+            // For nobody: the public being, or D3 nobody home; D4 the signature
+            // fails under the key the payload names. She is asked by strangers,
+            // and a stranger hears silence for whatever she then does.
+            const pk = publicKey();
+            const pub = pk !== null ? doors.get(pk) : undefined;
+            if (!pub || !(await verifyAsk(a, payload.by)))
+                return refuse();
+            return { reply: await arrive(pub, {}, payload.method, args, false), ephemeralPk, heard: true };
+        }
+        const h = heirs.admits(to, payload.by);
+        if (!h) {
+            // D5 a heir not held, D6 a key not admitted. One more case: the heir
+            // was held and the id removed. Its last keys are kept so that their
+            // holder, and only their holder, D7 checked, hears that she is gone.
+            if (!heirs.gone(to, payload.by) || !(await verifyAsk(a, payload.by)))
+                return refuse();
+            return { reply: said('removed'), ephemeralPk, heard: true };
+        }
+        if (!(await verifyAsk(a, payload.by)))
+            return refuse(); // D7, under an admitted key
+        // From here the door has heard a key it holds. Every answer below is
+        // sealed to that key's lid; nothing below is a stranger's.
+        const door = doors.get(h.being);
+        if (!door)
+            return { reply: said('absent'), ephemeralPk, heard: true }; // D8. she did not come back this run
+        if (!at(door.cells.occupants, h.id))
+            return { reply: said('removed'), ephemeralPk, heard: true }; // D8. the record is gone
+        // Once only, and only now: the number is spent after the signature, so a
+        // stranger cannot burn a number she could not sign for, and together with
+        // the keys, so the same bytes twice rotate nothing and refusal writes nothing.
+        const honoured = heirs.honour(h, payload.by, payload.next, payload.seq); // D9, D10
+        if (honoured !== true)
+            return { reply: said(honoured), ephemeralPk, heard: true };
+        return { reply: await arrive(door, { id: h.id }, payload.method, args, true), ephemeralPk, heard: true };
+    };
+    // The door itself. Always answers bytes. When the ask did not open, the
+    // reply is sealed to the ephemeral pk on its lid, which is all a stranger
+    // holds, and says silence.
+    //
+    // A lid that is not a key -- a small-order point, of which the two curves
+    // have several each -- makes a dead agreement, and the seal refuses it. The
+    // door never throws: that reply is noise, sealed to a key nobody holds.
+    return async function door(bytes) {
+        const out = await judge(bytes);
+        const reply = out?.reply ?? SILENCE;
+        const heard = out?.heard ?? false;
+        try {
+            return { bytes: await sealReply(reply, out?.ephemeralPk ?? lid(bytes, random), key.sign, random(32)), heard };
+        }
+        catch {
+            return { bytes: await sealReply(reply, (await sealingPair(random(32))).pk, key.sign, random(32)), heard };
+        }
+    };
+}
+// The ephemeral pk on an ask that would not open, if the bytes are long
+// enough to carry one. Otherwise a fresh key nobody holds: the reply is
+// bytes, and it is noise.
+function lid(bytes, random) {
+    if (bytes instanceof Uint8Array && bytes.length >= KEY)
+        return bytes.subarray(0, KEY);
+    return random(KEY);
+}

package/dist/ward/ground.d.ts

@@ -0,0 +1,15 @@
+import type { Stance, BeingLike } from '../being/types.ts';
+export type Ground = {
+    seed: string | Uint8Array;
+    memory: Record<string, unknown>;
+    instantiate(className: string, stance: Stance): BeingLike | null;
+    carry(pk: string, bytes: Uint8Array): Promise<Uint8Array | undefined>;
+    random(n: number): Uint8Array;
+};
+export type WardPointers = {
+    door(bytes: Uint8Array): Promise<{
+        bytes: Uint8Array;
+        heard: boolean;
+    }>;
+    ask(method?: string, args?: Record<string, unknown>): Promise<unknown>;
+};

package/dist/ward/ground.js

@@ -0,0 +1 @@
+export {};

package/dist/ward/heirs.d.ts

@@ -0,0 +1,14 @@
+import type { DoorWord } from '../being/types.ts';
+import { type Heir, type Partition } from './partition.ts';
+export declare class Heirs {
+    #private;
+    constructor(p: Partition);
+    open(heir: string, being: string, id: string): void;
+    close(heir: string): void;
+    gone(heir: string, by: string): boolean;
+    get(heir: string): Heir | undefined;
+    admits(heir: string, by: string): Heir | null;
+    spend(h: Heir, seq: number): boolean;
+    honour(h: Heir, by: string, next: string | null, seq: number): true | DoorWord;
+    settle(h: Heir, by: string, next: string | null): boolean;
+}

package/dist/ward/heirs.js

@@ -0,0 +1,102 @@
+import { GONE } from './partition.js';
+// How wide the span is, is the ward's own — wider is more forgiving of a
+// rough road, and no peer can tell the difference except by being refused.
+const SPAN = 64;
+export class Heirs {
+    #p;
+    constructor(p) {
+        this.#p = p;
+    }
+    open(heir, being, id) {
+        this.#p.heirs[heir] = { being, id, current: heir, announced: null, fresh: true, mark: 0, spent: [] };
+    }
+    // The id was removed. The heir is forgotten, and its last keys are kept
+    // apart, bounded, so that whoever still holds them hears `removed` at the
+    // door, once they have signed as themselves, and nobody else hears a thing.
+    close(heir) {
+        const h = this.#p.heirs[heir];
+        if (!h)
+            return;
+        delete this.#p.heirs[heir];
+        this.#p.gone[heir] = { current: h.current, announced: h.announced };
+        const keys = Object.keys(this.#p.gone);
+        for (const old of keys.slice(0, Math.max(0, keys.length - GONE)))
+            delete this.#p.gone[old];
+    }
+    // May `by` speak for a relation she removed? True only for the keys the
+    // door held when the id went, which nobody but their holder has.
+    gone(heir, by) {
+        const g = this.#p.gone[heir];
+        return !!g && (by === g.current || by === g.announced);
+    }
+    get(heir) {
+        return this.#p.heirs[heir];
+    }
+    // May `by` speak for this heir? Returns the record if so, null if not.
+    // Does not write: the caller verifies the signature first, then settles.
+    admits(heir, by) {
+        const h = this.#p.heirs[heir];
+        if (!h)
+            return null;
+        if (h.fresh)
+            return by === h.current ? h : null;
+        return by === h.current || by === h.announced ? h : null;
+    }
+    // Once only. A number above the mark is honoured and moves it; a number
+    // inside the span is honoured once and never again; a number at or below
+    // the span is refused, because a door that remembered every number ever
+    // seen would be a door with unbounded memory. Counting starts where
+    // strangers must agree: the first legal number is one.
+    //
+    // The number rides inside the signed body, so bytes caught on the road
+    // carry the number they were sent under and are refused as themselves. A
+    // caller who means to ask again asks again, under the next number, and is
+    // heard: retry and fire-and-forget stay hers to build. Only the accident
+    // and the interception are refused.
+    //
+    // Writes, so the caller settles it only once the signature has checked out.
+    // The same bytes twice are one honoured call and one silence.
+    spend(h, seq) {
+        if (!Number.isSafeInteger(seq) || seq < 1)
+            return false;
+        if (seq > h.mark) {
+            if (h.mark > 0)
+                h.spent.push(h.mark);
+            h.mark = seq;
+            h.spent = h.spent.filter((past) => past > seq - SPAN);
+            return true;
+        }
+        if (seq === h.mark || seq <= h.mark - SPAN || h.spent.includes(seq))
+            return false;
+        h.spent.push(seq);
+        return true;
+    }
+    // The signature checked out. Spend the number and settle the keys, or do
+    // neither: a call that binds nothing must not burn a number on its way to
+    // being refused, or a stranger who cannot be heard would still leave a mark
+    // behind her. Every write below this line is one that is going to hold.
+    honour(h, by, next, seq) {
+        if (h.fresh && next === null)
+            return 'unannounced'; // a knock without a key of her own binds nothing
+        if (!this.spend(h, seq))
+            return 'repeated';
+        return this.settle(h, by, next) ? true : 'unannounced';
+    }
+    // The signature checked out. Settle the keys: a fresh heir rotates at once
+    // to what it announced and must announce something; a current key replaces
+    // its announcement; an announced key becomes current.
+    settle(h, by, next) {
+        if (h.fresh) {
+            if (next === null)
+                return false; // a knock without a key of her own binds nothing
+            h.current = next;
+            h.announced = null;
+            h.fresh = false;
+            return true;
+        }
+        if (by === h.announced)
+            h.current = by;
+        h.announced = next;
+        return true;
+    }
+}