@quo-systems/quo 0.2.10 → 0.2.11

package/SPEC.md

@@ -93,7 +93,13 @@ ground
 
 Nothing else is ever passed. A harbor that needs a seventh thing has found a
 gap in Quo or a leak into the ward. The shape is `Ground` in
-`src/ward/ground.ts`.
+`src/ward/ground.ts`, and beside it are the three pieces every harbor in this
+kit builds one out of: `maker`, the code half, which finds a class by own key
+in the first registry that holds it and remembers the object by the cells;
+`entropy`, the one line every terrain has; and `learnPk`, the empty ask, since
+a harbor learns its ward's pk the way anyone learns anything and has no second
+derivation to keep in step. They are convenience and never contract: a kit
+writes its own harbor, and may write these again.
 
 Returned:
 
@@ -104,7 +110,9 @@ Returned:
   harbor learns from an arrival, never a reason: a pk that only ever brings
   strangers' bytes is the harbor's to rate or refuse, and what a bound key
   hears is sealed to its own lid.
-- **The ask.** One call: method and args in, object or silence out.
+- **The ask.** One call: method and args in, a value or silence out. A value,
+  not an object: what a being answers is held to the value rule and nothing
+  narrower, so a string, a number and an array are all answers.
   In-process and unsealed. This is the one unsealed ask in Quo, and the only
   way a ward is piloted. Judgment, catching, and the return table are not
   skipped: a throw inside is silence, and an unreached shape is silence.
@@ -327,7 +335,8 @@ D7   signature fails                 under an admitted key, or under the key hel
 refusals to a bound key: a word, nothing written, heard true
 D8   she is not there                `removed`: the occupant record is gone, and this is the key it was
                                      bound to when it went. `absent`: the being did not come back this run.
-D9   a knock announces nothing       `unannounced`: the heir is fresh and next is null. it binds nothing.
+D9   a knock announces nothing       `unannounced`: the heir is fresh and next is null, or is the heir
+                                     itself, which is no key of her own. it binds nothing.
 D10  the number is refused           `repeated`: already honoured, or at or below the span.
 choices: the number spent, the keys rotated, heard true
 D11  she threw                       `threw`
@@ -413,7 +422,10 @@ None is an object, and none carries anything but its name. In this kit
 silence is the symbol `quo.silence` and a word is a frozen object under the
 symbol key `quo.word` holding its name, both from `src/being/silence.ts`;
 `isWord` and `wordOf` read them, and `isUnreached` is the one word a being
-asks about most.
+asks about most. `told` names a word and leaves everything else exactly as it
+came, so asking which word arrived is one comparison rather than two joined by
+an and: `told(out) === 'late'`. A kit in another language spells it however
+that language spells one value standing for either, and owes nothing here.
 
 ### Blueprint, schema, digest
 
@@ -439,6 +451,16 @@ holding what is not a value is dropped before hashing and an array slot
 holding one is null, which is what crossing an edge does to them anyway. The
 reference is `src/being/digest.ts`.
 
+Two places in RFC 8785 are where languages part, and a kit is held to both by
+`vectors/framing.json`. Keys sort by **UTF-16 code unit**, not by code point
+and not by byte, so an astral character sorts before one in the surrogate
+range: `U+1F600` comes before `U+FB33`, which is the reverse of what a
+language sorting code points gives. Numbers are written as ECMAScript writes
+them, `1e+21` and `1e-7` and `0.3333333333333333`, with a negative zero
+written `0`. A kit that reproduces every ASCII vector and neither of these
+hashes one blueprint to two digests, and every standing between the two wards
+refreshes on every ask.
+
 Capability and state are two axes, never mixed.
 
 ```
@@ -498,7 +520,13 @@ cells
 ```
 
 - `digest` is the hash of the blueprint she last fetched by the empty ask.
-- `blueprint` is that blueprint.
+  It is over what came back, whatever that was.
+- `blueprint` is that blueprint, and only if it is one. A far describe is
+  somebody else's code and may answer any value at all; the ward reads it as
+  a blueprint before writing it as one, a list of asks with a name and an
+  input each, and writes `null` when it is not. A side walks `asks` by name,
+  and a side that broke on a far ward's answer would be one kit made wrong
+  by another. The answer itself still goes to whoever asked, unread.
 - `seen` is the digest her ward last saw arrive with an answer. A silent
   refresh leaves it untouched.
 - `notes` is hers. Quo never reads it. Tier, expiry, kinship between an
@@ -585,8 +613,22 @@ An invitation to her is `{ ward }` alone. One with a secret and no heir is
 not an invitation. She may be taken as a standing on that invitation, and
 such a standing has no heir and never rotates.
 
+The signature is checked here for no property, and the check is kept anyway.
+Whoever asks chose that key a moment ago, the box is already authenticated to
+the ward's padlock, and the door binds nothing, so nothing is proven by it and
+nothing would be lost by dropping it. It stays because the payload has one
+shape and the door has one path: `by`, `next` and `seq` are required of her
+ask as of every other, and honoured by nobody. A kit author who goes looking
+for the property behind this signature will not find one, and is not missing
+anything.
+
 She is reached without a heir, so the door keeps nothing for whoever asked:
-no key it vouched for, and no count. The signature is still checked, under
+no key it vouched for, and no count. The bit beside her reply is `heard`
+false, as it is for every stranger: no key this door holds spoke. She is the
+one place a stranger is answered by design, so she is the one place the
+harbor's rating must still see a stranger arrive. A harbor that saves before
+its reply goes out follows the ward writing, never the bit, since a public
+being writes in her cells like anyone. The signature is still checked, under
 whatever key signed. Once-only delivery does not reach her: the same sealed
 bytes presented twice are delivered twice, and the number the payload carries
 is required and honoured by nobody. A count per voice would be memory a
@@ -638,7 +680,17 @@ key does both: an Ed25519 pair to sign replies, an X25519 padlock every ask
 is sealed to. Beings never own a padlock.
 
 - **The ward key** comes from the seed. Its pk on the wire is the signing pk
-  then the padlock, 128 hex, and it routes.
+  then the padlock, 128 hex, and it routes. Two curves, and each secret is
+  HKDF-SHA-256 of the seed under its own label, `quo-ward-sign` and
+  `quo-ward-seal`, empty salt, 32 bytes out. Fed the seed straight the two
+  scalars would still differ, because Ed25519 hashes what it is given and
+  X25519 clamps it raw, but that is an accident of the two designs and no
+  separation: one secret would be doing two jobs with nothing said about it,
+  and a second kit would have to reproduce a construction nobody named. A
+  seed handed in as bytes of the key length is the seed; anything else, text
+  or bytes of another length, is SHA-256 first, so a thirty-two character
+  name is a name and not a key for being the right size.
+  `vectors/framing.json` pins it.
 - **The heir** is the key the inviting ward mints at invite, for one id. It
   keeps the heir's pk beside the id and gives the secret away. The
   invitation IS the heir: ward pk, heir pk, heir secret. Rotation one: the
@@ -810,7 +862,11 @@ share no key learn nothing from each other.
 
 Four algorithms, named once and never negotiated: Ed25519 signs, X25519
 agrees, SHA-256 hashes, AES-256-GCM encrypts with key and nonce derived
-together by HKDF-SHA-256 under an empty salt and the label `quo-seal`. The
+together by HKDF-SHA-256 under an empty salt and the label `quo-seal`. That
+label is the message cipher's and no other: HKDF appears twice in this kit,
+here from an agreement and again at the ward key from a seed, and the three
+labels, `quo-seal`, `quo-ward-sign`, `quo-ward-seal`, are three so that two
+derivations never answer to one name. The
 ephemeral pk is the additional authenticated data of every box. A small-order
 public key verifies nothing; an all-zero agreement is refused. All four are
 in WebCrypto, which is why the ward names no package -- on any terrain that
@@ -943,8 +999,10 @@ partition
               occupants   id -> heir pk
               knocks      <ward>:<heir> | public:<ward> -> { current, next, spoke, sent, seq }   before take
                           spoke: bytes came back once. sent: bytes went out once, answered or not
+                          bounded, oldest out, and one that answered outlives one that never did
               answered    <ward>:<heir> | public:<ward> -> true                            knocked and answered
-              minted      the last eight pks her side minted
+              minted      the last eight pks her side minted. nothing in the ward reads it: it is there to
+                          be looked at, and a kit that keeps the list empty holds the same ward
   heirs     heir pk -> { being, id, current, announced, fresh, mark, spent }   the door's view of every occupant
   gone      heir pk -> { current, announced }   the keys held when an id was removed, bounded, so their
                                                 holder hears `removed` and nobody else hears a thing
@@ -956,6 +1014,12 @@ alone: an invitation carries the heir to whoever it is for, and anyone
 holding one could quote that heir back inside an invitation naming a ward of
 their own.
 
+Only take ends a knock record, so the list is bounded like `gone`: past the
+count the oldest go, and one that was answered outlives one that never was,
+since an answered knock is a relation she may still take. A being who knocks
+without ever taking keeps a fixed number of keys behind her, not one per
+invitation she ever met.
+
 The version is one value and it does not move until 1.0.0. There is nobody
 holding a partition of another shape to tell apart: if the shape changes, a
 partition is thrown away, not migrated and not counted. A ward opening a
@@ -963,6 +1027,17 @@ version it cannot read throws at birth and does not boot. Birth is where a
 ward is allowed to be loud; silence is the door's word, for asks that were
 made, and no ask has been made yet.
 
+The version says which shape, and the ward reads the shape as well, once, at
+birth: every field above that the ward, the door or the heirs later act on
+without looking again. A partition this ward wrote is that shape by
+construction. One adopted from elsewhere was written by a hand, another kit,
+or a file that was cut short, and a `spent` that is not a list or a `mark`
+that is not a number is a door that honours every number, or one that
+rejects where it promised a word. A ward that meets one throws at birth with
+the path that failed, which names what is wrong to whoever is holding the
+file. A being's own cells are read no further than the two records the ward
+keeps in them: what she puts in her own is hers, of any shape JSON carries.
+
 What a ward can read is a list, `READS`, and today it has one member. The
 list and the step that carries an older partition forward exist before
 1.0.0 because after it there is nowhere to put them. A partition holds every
@@ -1054,7 +1129,11 @@ anything else                            -> { error: 'unknown ask' }
   every relation she had, reachable by nobody at the bare pk and told by
   nobody she was replaced. Marking the one already public again is
   answered, and changes nothing. A public being absent this run is
-  reachable by nobody already, so the mark may move to another.
+  reachable by nobody already, so the mark may move to another. A null key
+  takes the mark off: the being stays booted with every relation she holds,
+  and the ward answers arrivals for no heir with silence as one that never
+  had a public being does. Retiring her is not destroying her, and the mark
+  is free for another.
 - Invite on the ward's own pk mints an owner, and only the root may ask it:
   from the door it is answered as an invite on nobody. The ward has
   occupants, its owners, and no standings: a knock for the ward itself is a
@@ -1142,8 +1221,15 @@ Not stressed with:
 
 A harbor is what a device already has, offered to Quo: processes, storage, a
 network, entropy, a clock. It fits into a device carved up by its owner,
-users, containers, mounts, profiles, and asks for none of them. It knows no
-being, holds no id, reads no partition, and is nobody outside its device.
+users, containers, mounts, profiles, and asks for none of them. It judges
+nothing, holds no id, chooses no class, and is nobody outside its device.
+
+It makes every being of every ward it serves, because `instantiate` is in
+the ground and the ward calls it, and it keeps what it made. That is not
+knowing a being. It has her object and knows nothing about her: not what she
+answers, not who her occupants are, not which of her cells is a secret. It
+never reads a partition to decide anything, and it never hands one out
+except as the values a store keeps.
 
 The harbor:
 
@@ -1163,6 +1249,16 @@ The harbor:
 - Passes every ward the ground, once, at birth. Receives a door and an ask.
   Hands the ask to exactly one holder, by the device's own rules. That
   holder is the ward's owner.
+- Hands its own device's code the beings it made for a ward, by key, and the
+  keys it has. This is not a path around a door. The object is already in
+  that process, made there a moment ago by the harbor itself, and reaching
+  it is the device's own code calling its own object, the same reach a being
+  has on one she booted herself. Nothing of it crosses an edge, so there is
+  no door it could have passed instead. A key with no object is a being who
+  is not here this run. What the device does not get is the partition: it
+  holds every seed the ward has, and a side that wants to know which beings
+  there are, or which one is public, asks the ward through the ask pointer,
+  which is the only thing that answers for a ward anyway.
 - Keeps the map of ward pk to door for its own wards, and ward pk to reach
   for foreign ones. Learns its own wards' pks by asking them. Learns foreign
   pks however it likes.
@@ -1189,8 +1285,8 @@ Not stressed with:
   silence, and it never answers on a ward's behalf.
 - Fanning out, broadcasting, or forwarding to a pk other than the one it was
   given. One pk is one ward is one door.
-- Beings, ids, keys inside a relation, classes as things to choose,
-  invitations, or what any partition contains.
+- Choosing a class, deciding an id, reading the keys inside a relation,
+  minting an invitation, or acting on anything a partition contains.
 - Judging anything. A ward judges its door. The harbor delivers to it.
 - Speaking Quo. It is nobody's occupant and holds no standing anywhere. The
   harbor is not a ward and is nobody's.
@@ -1207,7 +1303,9 @@ the harbor core then passes the same suite over memory stores.
 
 What a harbor on a device keeps is a ward's three parts under one name: the
 seed, the partition, and a **ward record**, which says where the class
-bodies come from and which being is the user's. That is the **store**,
+bodies come from and which being is the user's. `user` is a key and nothing
+else: a label the device's own code hands back to get the being it made,
+never read to route a byte or judge an ask. That is the **store**,
 `src/harbor/store.ts`: list, load, put, save the partition when the ward wrote,
 save the record after a boot learned the pk, take a ward out as the first
 move of a migration, and keep the directory's hints, a pk to a URL, across
@@ -1311,18 +1409,28 @@ with a wait that doubles from a second to thirty when the line drops, and
 while it is dialed it is one of the harbor's fallbacks, where a pk nobody
 here knows is sent. A device that slept, a phone in a pocket, comes back
 with that wait frozen and, often, its socket closed under it by the system
-without a word, so the dialer takes one call from the device, `wake`: a
-line in hand is made to announce, and a dead one closes under the word and
-is dialed again; a line that is down is dialed now, the wait called off; a
-dial in flight is left alone. Fallbacks are a list and a pk is tried down it in
+without a word, so the dialer takes one call from the device, `wake`:
+whatever line it holds, open or still opening, is put down and a new one is
+dialed now, the frozen wait called off. Nothing can tell a line the system
+dropped from a live one, and asking would cost a round trip the four words
+do not have; an announce written into a dead line is taken into the send
+buffer and errors only when TCP gives up, minutes later, and for all of it
+every ask to a pk bound behind that line hears `late`. Dialing costs one
+handshake when the line was fine, and an ask made meanwhile waits on the new
+socket. A line put down this way closes when the system gets round to it,
+gives back what it took, and dials nothing: only the line the dialer still
+holds dials again. Fallbacks are a list and a pk is tried down it in
 order: a harbor may dial more than one listener, and a rendezvous is a
 listener and nothing more, so a ward is never reachable through one place
 by anything but its own choice. A line that drops takes only its own place
 out of the list. A ward is born on the core by minting a seed under a name,
 leaves it by being dropped, the partition written first, and arrives by
-being adopted, same seed, same pk. What a terrain adds is a store of its
-own, a loader for the class bodies, and the lease its device offers; what
-it never touches is a ward.
+being adopted, same seed, same pk. Adopting is the one path a partition
+written elsewhere takes, so it is where the ward's shape check is met: one
+that will not boot is not adopted, it goes back out of the store, and the
+only copy is the one the caller is still holding. What a terrain adds is a
+store of its own, a loader for the class bodies, and the lease its device
+offers; what it never touches is a ward.
 
 ## The being
 
@@ -1391,6 +1499,17 @@ The raw shape needs no import from the kit. The kit also offers a base class,
   `for(occupant, asker)` decides whether this asker sees the ask, and so
   whether this asker may call it: what she shows is what she can be asked,
   one gate for describe and for dispatch.
+- Both statics are read off the class the object was made from, and a
+  subclass that declares either **replaces** its parent's rather than adding
+  to it. That is the rule and not an oversight: a being's blueprint is
+  exactly what the class in front of you declares, in the order she chose,
+  and a merge would hand her asks she may mean to drop and an order she did
+  not write. A subclass that means to extend says so, in one spelling,
+  `static override asks = { ...Parent.asks, mine: {} }`, and the same for
+  cells. A parent that means to be subclassed at all annotates rather than
+  infers, `static override cells: JsonObject = { ... }`, since this language
+  holds a subclass's static side to its parent's and would otherwise refuse a
+  subclass declaring fewer keys than the parent happened to write.
 - `answer` is written for her. The empty ask is `describe(asker)`, which she
   may override by hand. A named ask calls the method of that name with
   `(args, asker)`. Anything not declared, hidden from this asker, or

package/dist/being/being.js

@@ -12,6 +12,12 @@ const method = (self, name) => {
     }
     return false;
 };
+// Both statics below are read off the class the object was made from, so a
+// subclass declaring either replaces its parent's rather than adding to it.
+// That is the rule: her blueprint is exactly what the class in front of you
+// declares, in the order she chose, and merging down a chain would hand her
+// asks she may mean to drop and an order she did not write. A subclass that
+// means to extend says so, `static override asks = { ...Parent.asks, mine: {} }`.
 export class Being {
     // Her cells' defaults. Merged in at birth, only where a key is missing, so
     // a restart keeps what she wrote.
@@ -89,7 +95,7 @@ export class Being {
         // would answer with her stance, `toString` with a string, and neither is
         // an ask she wrote. Only her own keys are asks, which is what describe
         // shows. What she shows is what she can be asked.
-        const spec = typeof method === 'string' && Object.hasOwn(C.asks, method) ? C.asks[method] : undefined;
+        const spec = Object.hasOwn(C.asks, method) ? C.asks[method] : undefined;
         if (!spec || (spec.for && !spec.for(this.occupant(asker), asker)))
             return { error: 'unknown ask' };
         const fn = this[method];

package/dist/being/digest.js

@@ -19,5 +19,19 @@ export const canonical = (v) => {
     }
     return JSON.stringify(v);
 };
+// Hex and the guard are spelled here and again in `src/ward/arithmetic.ts`,
+// which is the price of the boundary: nothing under `src/being` imports
+// anything above it, because this is the whole world a being's own code sees
+// and a being reaching the ward is the thing the shape is against.
 const hex = (bytes) => Array.from(new Uint8Array(bytes), (b) => b.toString(16).padStart(2, '0')).join('');
-export const digest = async (blueprint) => hex(await globalThis.crypto.subtle.digest('SHA-256', new TextEncoder().encode(canonical(blueprint))));
+// `crypto.subtle` is read at the call and never captured at load. A browser
+// on a plain http:// origin has `crypto` without `subtle`, and a terrain may
+// install one after this module is first imported; either way the failure is
+// one sentence and not a TypeError from inside a digest nobody can read.
+const subtle = () => {
+    const s = globalThis.crypto?.subtle;
+    if (!s)
+        throw new Error('this terrain has no crypto.subtle: a being needs a secure context to be described');
+    return s;
+};
+export const digest = async (blueprint) => hex(await subtle().digest('SHA-256', new TextEncoder().encode(canonical(blueprint))));

package/dist/being/index.d.ts

@@ -1,5 +1,5 @@
 export { Being, type AskSpec } from './being.ts';
-export { silence, isSilence, unreached, isUnreached, word, isWord, wordOf, DOOR_WORDS, isDoorWord } from './silence.ts';
+export { silence, isSilence, answered, unreached, isUnreached, word, isWord, wordOf, told, DOOR_WORDS, isDoorWord } from './silence.ts';
 export { digest, canonical } from './digest.ts';
-export { OWNER, PUBLIC, RESERVED_IDS } from './types.ts';
+export { OWNER, PUBLIC, RESERVED_IDS, isBlueprint, invitationArgs } from './types.ts';
 export type * from './types.ts';

package/dist/being/index.js

@@ -1,6 +1,6 @@
 // SPDX-License-Identifier: Apache-2.0
 // @quo-systems/quo — the Being side. What a being author imports, if anything.
 export { Being } from './being.js';
-export { silence, isSilence, unreached, isUnreached, word, isWord, wordOf, DOOR_WORDS, isDoorWord } from './silence.js';
+export { silence, isSilence, answered, unreached, isUnreached, word, isWord, wordOf, told, DOOR_WORDS, isDoorWord } from './silence.js';
 export { digest, canonical } from './digest.js';
-export { OWNER, PUBLIC, RESERVED_IDS } from './types.js';
+export { OWNER, PUBLIC, RESERVED_IDS, isBlueprint, invitationArgs } from './types.js';

package/dist/being/silence.d.ts

@@ -6,5 +6,7 @@ export declare const isDoorWord: (s: unknown) => s is DoorWord;
 export declare const word: <W extends WordName>(name: W) => Word<W>;
 export declare const isWord: (x: unknown) => x is Word;
 export declare const wordOf: (x: Word) => WordName;
+export declare const answered: <T>(x: T) => x is Exclude<T, typeof silence | Word>;
+export declare const told: (x: unknown) => unknown;
 export declare const unreached: () => Unreached;
 export declare const isUnreached: (x: unknown) => x is Unreached;

package/dist/being/silence.js

@@ -22,6 +22,18 @@ export const word = (name) => {
 };
 export const isWord = (x) => x !== null && typeof x === 'object' && typeof x[WORD_KEY] === 'string';
 export const wordOf = (x) => x[WORD_KEY];
+// What came back is an answer and not one of the two things that are not
+// answers. A being who only wants the object writes one test instead of
+// three, and the three shapes stay three shapes: silence is no answer, a word
+// is her ward telling her why there is none.
+export const answered = (x) => !isSilence(x) && !isWord(x);
+// What she was told, with a word given its name and everything else left
+// exactly as it came. One value to compare against, so asking which word came
+// back is one test and not two joined by an and: `told(out) === 'late'` says
+// what `isWord(out) && wordOf(out) === 'late'` says, and says which answer
+// arrived instead when it is wrong, where the pair collapses to false and
+// names nothing. Silence stays the symbol it is, and an object stays itself.
+export const told = (x) => (isWord(x) ? wordOf(x) : x);
 // Unreached: no far door was reached. Nothing is known to have been
 // delivered, so asking again is safe. A being cannot produce it: a ward that
 // sees a word come out of a being reads it as her having thrown.

package/dist/being/types.d.ts

@@ -18,6 +18,7 @@ export type Invitation = {
     heir?: string;
     secret?: string;
 };
+export declare const invitationArgs: (inv: Invitation) => JsonObject;
 export type Schema = JsonObject;
 export type Ask = {
     name: string;
@@ -29,6 +30,7 @@ export type Blueprint = {
     asks: Ask[];
     notes: Json;
 };
+export declare const isBlueprint: (v: unknown) => v is Blueprint;
 export type StandingRecord = {
     id: string;
     digest: string | null;

package/dist/being/types.js

@@ -13,4 +13,29 @@
 export const OWNER = 'OWNER';
 export const PUBLIC = 'PUBLIC';
 export const RESERVED_IDS = [OWNER, PUBLIC];
+// An invitation as one object of values, which is what it already is. A being
+// who hands one on sends it as args, and args are values; this is the one
+// place that is spelled, so nobody spells it with a cast. Absent stays absent:
+// an invitation to a public being carries no heir and no secret, and a key
+// present and undefined is not the same object once JSON has been through it.
+export const invitationArgs = (inv) => ({
+    ward: inv.ward,
+    ...(inv.heir !== undefined ? { heir: inv.heir } : {}),
+    ...(inv.secret !== undefined ? { secret: inv.secret } : {}),
+});
+// Whether what came back from an empty ask is a blueprint. Every describe on
+// the far side of a door is somebody else's code, so nothing may be written
+// into a standing's record as a blueprint without being read as one first: a
+// side walks `asks` by name, and a list of anything else, or no list at all,
+// is a side that breaks on a far ward's answer. The asks are checked to the
+// depth a side reads them, a name and an input each, and no further: what a
+// far being puts beside those is hers.
+export const isBlueprint = (v) => {
+    if (v === null || typeof v !== 'object' || Array.isArray(v))
+        return false;
+    const { asks, notes } = v;
+    if (!Array.isArray(asks) || notes === undefined)
+        return false;
+    return asks.every((a) => a !== null && typeof a === 'object' && !Array.isArray(a) && typeof a.name === 'string' && a.input !== null && typeof a.input === 'object' && !Array.isArray(a.input));
+};
 export const WORD_KEY = Symbol.for('quo.word');

package/dist/conformance/assert.js

@@ -15,6 +15,15 @@ const show = (v) => {
         return 'undefined';
     if (typeof v === 'function')
         return `[function ${v.name}]`;
+    // A ward's word is a frozen object under one symbol key, and JSON shows it
+    // as `{}`. A red estate chapter saying `{} is not {}` names nothing, so a
+    // value whose own keys are all symbols is shown by its keys.
+    if (v !== null && typeof v === 'object') {
+        const keys = Object.keys(v);
+        const syms = Object.getOwnPropertySymbols(v).filter((s) => Object.getOwnPropertyDescriptor(v, s).enumerable);
+        if (keys.length === 0 && syms.length > 0)
+            return `{ ${syms.map((s) => `${s.toString()}: ${show(v[s])}`).join(', ')} }`;
+    }
     try {
         return JSON.stringify(v) ?? Object.prototype.toString.call(v);
     }
@@ -28,22 +37,47 @@ const fail = (why, message) => {
 // Structural, and strict about shape the way `node:assert/strict` is: a value
 // is not equal to one of another kind, and an array is not equal to an object
 // that happens to hold the same keys.
+// The four kinds this compares, and every other object is refused rather than
+// guessed at. A Date, a RegExp, a boxed primitive and a class instance each
+// carry state no key walk can see, so two of them with the same keys are
+// equal here and unequal in node, which is a wrong yes: the one answer a
+// suite must never give. A refusal is a red test that says so.
+const KNOWN = [Object.prototype, null, Array.prototype, Uint8Array.prototype];
+// What node compares: own enumerable keys, strings then enumerable symbols.
+// Not `Reflect.ownKeys`, which also lists what a definition hid.
+const keysOf = (v) => [...Object.keys(v), ...Object.getOwnPropertySymbols(v).filter((s) => Object.getOwnPropertyDescriptor(v, s).enumerable)];
 export function same(a, b) {
     if (Object.is(a, b))
         return true;
     if (typeof a !== 'object' || typeof b !== 'object' || a === null || b === null)
         return false;
-    if (Object.getPrototypeOf(a) !== Object.getPrototypeOf(b))
+    const proto = Object.getPrototypeOf(a);
+    if (proto !== Object.getPrototypeOf(b))
         return false;
+    if (!KNOWN.includes(proto))
+        return false; // a Date, a RegExp, a boxed number, a class of hers
     if (Array.isArray(a) !== Array.isArray(b))
         return false;
-    if (Array.isArray(a) && Array.isArray(b))
-        return a.length === b.length && a.every((x, i) => same(x, b[i]));
     if (a instanceof Uint8Array && b instanceof Uint8Array)
         return a.length === b.length && a.every((x, i) => x === b[i]);
-    if (a instanceof Map || b instanceof Map || a instanceof Set || b instanceof Set)
-        return false; // the suite has none, and a wrong yes is worse than a refusal
-    const ka = Reflect.ownKeys(a), kb = Reflect.ownKeys(b);
+    // An array is its indices and whatever else was hung on it, and a hole is
+    // not a present undefined: `[, 1]` and `[undefined, 1]` differ in node and
+    // must differ here. `every` skips holes, so the loop is written out.
+    if (Array.isArray(a) && Array.isArray(b)) {
+        if (a.length !== b.length)
+            return false;
+        for (let i = 0; i < a.length; i += 1) {
+            if (i in a !== i in b)
+                return false;
+            if (i in a && !same(a[i], b[i]))
+                return false;
+        }
+        const extra = (v) => keysOf(v).filter((k) => typeof k !== 'string' || !/^(?:0|[1-9]\d*)$/.test(k));
+        const xa = extra(a), xb = extra(b);
+        const at = (v, k) => v[k];
+        return xa.length === xb.length && xa.every((k) => xb.includes(k) && same(at(a, k), at(b, k)));
+    }
+    const ka = keysOf(a), kb = keysOf(b);
     if (ka.length !== kb.length)
         return false;
     return ka.every((k) => kb.includes(k) && same(a[k], b[k]));

package/dist/conformance/beings.d.ts

@@ -1,5 +1,5 @@
 import { Being } from '../being/being.ts';
-import type { Asker, Blueprint, Invitation, JsonObject, OccupantRecord, Reply, Stance } from '../being/types.ts';
+import type { Asker, Blueprint, Invitation, Json, JsonObject, OccupantRecord, Reply, Stance } from '../being/types.ts';
 export declare class Printer extends Being {
     static cells: {
         jobs: JsonObject[];
@@ -14,8 +14,8 @@ export declare class Printer extends Being {
     };
     describe(): Blueprint;
     print({ doc }: JsonObject, asker: Asker): {
-        printed: string | number | boolean | import("../being/types.ts").Json[] | {
-            [key: string]: import("../being/types.ts").Json;
+        printed: string | number | boolean | Json[] | {
+            [key: string]: Json;
         } | null;
     };
 }
@@ -68,7 +68,7 @@ export declare class Shop extends Being {
         error?: undefined;
         retry?: undefined;
         ok: boolean;
-        receipt: import("../being/types.ts").Json;
+        receipt: Json;
     }>;
     refund(): {
         ok: boolean;
@@ -85,7 +85,9 @@ export declare class Customer extends Being {
             };
         };
     };
-    join(invitation: Invitation): Promise<typeof import("../being/silence.ts").silence | import("../being/types.ts").Word | import("../being/types.ts").Json>;
+    join(invitation: Invitation): Promise<string | number | boolean | typeof import("../being/silence.ts").silence | Json[] | import("../being/types.ts").Word<import("../being/types.ts").WordName> | {
+        [key: string]: Json;
+    } | null>;
     buy(item: string): Promise<import("../being/types.ts").Answer>;
     learn(): Promise<import("../being/types.ts").Answer>;
     hi(_args: JsonObject, asker: Asker): {
@@ -97,6 +99,47 @@ export declare class Echo {
     constructor(stance: Stance);
     answer(asker: Asker, method?: string, args?: JsonObject): Reply;
 }
+export declare class Maker extends Being {
+    static cells: {
+        made: string[];
+    };
+    static asks: {
+        open: {
+            input: {
+                type: string;
+                properties: {
+                    class: {
+                        type: string;
+                    };
+                    key: {
+                        type: string;
+                    };
+                    id: {
+                        type: string;
+                    };
+                };
+                required: string[];
+            };
+        };
+        say: {
+            input: {
+                type: string;
+                properties: {
+                    id: {
+                        type: string;
+                    };
+                };
+                required: string[];
+            };
+        };
+    };
+    open({ class: className, key, id }: JsonObject): Promise<{
+        made: string | null;
+    }>;
+    say({ id }: JsonObject): Promise<{
+        said: Json;
+    }>;
+}
 export declare class Member extends Being {
     static cells: {
         heard: JsonObject[];