@quo-systems/quo 0.2.13 → 0.2.15

package/dist/ward/cells.js

@@ -2,32 +2,71 @@
 // and a peer chooses the depth of what she answers; a bound keeps a hostile
 // reply from ending a walk in a stack overflow instead of a refusal.
 export const DEPTH = 64;
+// How many values one written out may come to. Depth alone does not bound
+// what a value costs to keep: one subvalue may sit under two keys, and
+// nesting that forty levels deep is inside the depth bound and is a trillion
+// values once written down. What is walked here is the object graph, which is
+// small; what a harbor keeps is the tree it expands to, which is not. So the
+// walk counts the tree while it proves the graph, and refuses a value nobody
+// could write down. This is a bound on what a being holds, so it is this
+// kit's number and no word of the spec.
+export const BREADTH = 1 << 20;
+// Text a harbor can write down: every surrogate in a pair. A lone one is a
+// code unit with no character, which JSON escapes and UTF-8 cannot encode at
+// all, so a harbor that keeps strings as bytes loses it and one that keeps
+// the object does not. I-JSON says a string is text, and this is that rule
+// where the value is written rather than where it is read.
+const WELL_FORMED = /^(?:[^\uD800-\uDFFF]|[\uD800-\uDBFF][\uDC00-\uDFFF])*$/;
 // I-JSON, all the way down. A number that JSON cannot write is not a number
 // a harbor can keep, a key on the prototype is not a key she wrote, and a
 // hole in a list, or a key named `__proto__`, is a thing JSON writes one way
 // and a runtime reads another.
-function fault(v, path, seen, depth) {
-    if (v === null || typeof v === 'boolean' || typeof v === 'string')
-        return null;
-    if (typeof v === 'number')
-        return Number.isFinite(v) ? null : `${path} is ${String(v)}, which no harbor can write down`;
+//
+// A fault is a sentence; anything else is the count of values under this one,
+// itself included. A value already counted is a value already proven, so a
+// graph that shares is walked once per node rather than once per path.
+function walk(v, path, seen, sized, depth) {
+    if (v === null || typeof v === 'boolean')
+        return 1;
+    if (typeof v === 'string')
+        return WELL_FORMED.test(v) ? 1 : `${path} carries a lone surrogate, which is no text a harbor can write down`;
+    if (typeof v === 'number') {
+        if (!Number.isFinite(v))
+            return `${path} is ${String(v)}, which no harbor can write down`;
+        // Minus zero is a number JSON writes as `0` and reads back as `0`. A
+        // harbor that keeps values would hand her the sign she wrote and one that
+        // writes JSON would not, and she is never told which she is standing in.
+        return Object.is(v, -0) ? `${path} is minus zero, which comes back as zero from every harbor that writes JSON` : 1;
+    }
     if (typeof v !== 'object')
         return `${path} is a ${typeof v}, which is not a value`;
     if (seen.has(v))
         return `${path} refers back to itself`;
+    const counted = sized.get(v);
+    if (counted !== undefined)
+        return counted;
     if (depth >= DEPTH)
         return `${path} is nested past ${DEPTH} levels, which no harbor can keep`;
     seen.add(v);
     try {
+        let size = 1;
+        const under = (where, x) => {
+            const r = walk(x, where, seen, sized, depth + 1);
+            if (typeof r === 'string')
+                return r;
+            size += r;
+            return size > BREADTH ? `${path} writes out to more than ${BREADTH} values, which no harbor can keep` : null;
+        };
         if (Array.isArray(v)) {
             for (let i = 0; i < v.length; i += 1) {
                 if (!(i in v))
                     return `${path}[${i}] is a hole, which no harbor can write down`;
-                const f = fault(v[i], `${path}[${i}]`, seen, depth + 1);
+                const f = under(`${path}[${i}]`, v[i]);
                 if (f)
                     return f;
             }
-            return null;
+            sized.set(v, size);
+            return size;
         }
         const proto = Object.getPrototypeOf(v);
         if (proto !== Object.prototype && proto !== null)
@@ -35,17 +74,21 @@ function fault(v, path, seen, depth) {
         for (const k of Object.keys(v)) {
             if (k === '__proto__')
                 return `${path}.__proto__ is a key no harbor can keep`;
-            const f = fault(v[k], `${path}.${k}`, seen, depth + 1);
+            const f = under(`${path}.${k}`, v[k]);
             if (f)
                 return f;
         }
-        return null;
+        sized.set(v, size);
+        return size;
     }
     finally {
         seen.delete(v);
     }
 }
-export const cellFault = (v, path) => fault(v, path, new Set(), 0);
+export const cellFault = (v, path) => {
+    const out = walk(v, path, new Set(), new Map(), 0);
+    return typeof out === 'string' ? out : null;
+};
 // The three keys at the root of her cells that are the ward's: it writes
 // them, she reads them, and a write of hers there is refused like a non-value.
 const WARDS = new Set(['standings', 'occupants', 'class']);
@@ -56,6 +99,12 @@ const WARDS = new Set(['standings', 'occupants', 'class']);
 const wrapped = new WeakMap();
 const targets = new WeakMap();
 const guards = new WeakSet();
+// A name no partition can hold, wherever it appears. It is here beside the
+// guard that refuses it, because the ward refuses it too: a relation named
+// this one would be written into the bind table and then throw on her cells,
+// which is half a relation and a throw where a null is promised. One rule,
+// one place, read by the guard and by the stance.
+export const unkeepable = (k) => k === '__proto__';
 // A key a write may land on: a string that is not `__proto__`, and not one
 // of the ward's at the root. A symbol key is a thing JSON never writes.
 const refuse = (why) => {
@@ -64,7 +113,7 @@ const refuse = (why) => {
 function keyFault(t, k, v, path, root) {
     if (typeof k !== 'string')
         refuse(`${path} takes no symbol key`);
-    if (k === '__proto__')
+    if (unkeepable(k))
         refuse(`${path}.__proto__ is a key no harbor can keep`);
     if (root && WARDS.has(k))
         refuse(`${path}.${k} is the ward's to write`);

package/dist/ward/door.d.ts

@@ -12,6 +12,7 @@ export type Judged = {
     bytes: Uint8Array;
     heard: boolean;
 };
+export declare function answered(door: Door, asker: Asker, method: string | undefined, args: JsonObject, bound: boolean): Promise<ReplyPayload>;
 export declare function arrive(door: Door, asker: Asker, method: string | undefined, args: JsonObject, bound: boolean): Promise<ReplyPayload>;
 export declare function seen(door: Door, asker: Asker): Promise<string | null>;
 export declare function makeDoor(key: WardKey, heirs: Heirs, doors: Map<string, Door>, publicKey: () => string | null, random: (n: number) => Uint8Array): (bytes: Uint8Array) => Promise<Judged>;

package/dist/ward/door.js

@@ -16,10 +16,13 @@ import { KEY, sealingPair } from './arithmetic.js';
 import { cellFault } from './cells.js';
 const SILENCE = { silence: true };
 const said = (quo) => ({ quo });
-// One arrival at one being, already named. Catches every throw. `bound` says
-// whether the asker is a key this door holds: she hears `threw`; a stranger
-// at the public being hears silence, because her insides are hers.
-export async function arrive(door, asker, method, args, bound) {
+// One arrival at one being, already named: the three choices, D11, D12 and
+// D13, and nothing else. Catches every throw. `bound` says whether the asker
+// is a key this door holds, or the ward's own owner: she hears `threw`; a
+// stranger at the public being hears silence, because her insides are hers.
+// Every caller that reaches a being's answer goes through here, the owner's
+// `ask` included, so the three choices are written once.
+export async function answered(door, asker, method, args, bound) {
     const threw = bound ? said('threw') : SILENCE;
     let out;
     try {
@@ -42,18 +45,34 @@ export async function arrive(door, asker, method, args, bound) {
     // was spent. It is threw, like a word out of her.
     if (cellFault(out, 'answer') !== null)
         return threw;
-    if (method === undefined)
-        return { object: out, seen: null };
-    // The digest rides along, it is not the answer. She has already answered:
-    // a describe that will not run costs the digest, and nothing else.
-    return { object: out, seen: await seen(door, asker) };
+    return { object: out, seen: null };
+}
+// What crosses the wire: her answer, with her digest for this asker beside
+// it. The digest rides along, it is not the answer. She has already
+// answered: a describe that will not run costs the digest, and nothing else.
+// The owner does not take one, because the owner asks for a describe when it
+// wants one and nothing is sealed on its behalf.
+export async function arrive(door, asker, method, args, bound) {
+    const reply = await answered(door, asker, method, args, bound);
+    if (method === undefined || !('object' in reply))
+        return reply;
+    return { object: reply.object, seen: await seen(door, asker) };
 }
 // Her digest for this asker, or null when her describe threw or fell silent.
 // The owner's describe reads it the same way for every being of the ward.
 export async function seen(door, asker) {
     try {
         const bp = await door.being.answer(asker);
-        return isSilence(bp) || isWord(bp) ? null : await digest(bp);
+        if (isSilence(bp) || isWord(bp))
+            return null;
+        // Held to the same rule as her answer, and for the same reason plus one:
+        // the digest is a walk, and a walk over a graph that shares or turns back
+        // on itself is not a digest but a hang or a throw. A blueprint that could
+        // not cross is a blueprint with no digest, which is what she has when her
+        // describe says nothing.
+        if (cellFault(bp, 'blueprint') !== null)
+            return null;
+        return await digest(bp);
     }
     catch {
         return null;

package/dist/ward/ground.d.ts

@@ -1,4 +1,5 @@
-import type { Stance, BeingLike, BeingClass } from '../being/types.ts';
+import type { Stance, BeingLike, BeingClass, Invitation } from '../being/types.ts';
+export type Lend = (name: string, take: (invitation: Invitation) => Promise<boolean>) => Promise<boolean>;
 export type Ground = {
     seed: string | Uint8Array;
     memory: Record<string, unknown>;
@@ -6,6 +7,7 @@ export type Ground = {
     wrote?: () => void;
     carry(pk: string, bytes: Uint8Array): Promise<Uint8Array | undefined>;
     random(n: number): Uint8Array;
+    lend?: Lend;
 };
 export type WardPointers = {
     door(bytes: Uint8Array): Promise<{

package/dist/ward/ground.js

@@ -1,5 +1,5 @@
 // ---- what every harbor builds a ground out of. Three pieces, because every
-// harbor in this tree writes the same three and the spec keeps the harbors
+// harbor in this tree writes the same three and the protocol keeps the harbors
 // themselves apart: what a memory harbor and a real one differ on is the
 // route and the store, and nothing here. A second kit writes its own harbor
 // and may write these again; they are convenience, never contract.

package/dist/ward/heirs.js

@@ -103,6 +103,13 @@ export class Heirs {
         }
         if (by === h.announced)
             h.current = by;
-        h.announced = next;
+        // A send that announced nothing leaves the spare standing. This kit
+        // announces on every send but a public one, which holds no heir and
+        // reaches none of this; a kit that skips one is a kit whose own next is
+        // still the key it announced last time, and forgetting it here would meet
+        // that key with silence and kill a healthy relation. Nothing is dropped
+        // that was vouched for until something replaces it.
+        if (next !== null)
+            h.announced = next;
     }
 }

package/dist/ward/index.d.ts

@@ -1,7 +1,7 @@
 export { Ward } from './ward.ts';
-export type { Ground, WardPointers } from './ground.ts';
+export type { Ground, WardPointers, Lend } from './ground.ts';
 export type { Partition, Heir, Bind, StandingKeys } from './partition.ts';
-export { GONE, MINTED } from './partition.ts';
+export { GONE, MINTED, KNOCKS } from './partition.ts';
 export type { AskPayload, ReplyPayload } from './seal.ts';
 export * as seal from './seal.ts';
 export * as arithmetic from './arithmetic.ts';

package/dist/ward/index.js

@@ -1,9 +1,9 @@
 // SPDX-License-Identifier: Apache-2.0
 // @quo-systems/quo/ward — one function. Every ward is the same ward.
 export { Ward } from './ward.js';
-// The two bounds on what a partition may hold, for a kit that must keep the
-// same ones and for a test that pins them.
-export { GONE, MINTED } from './partition.js';
+// The three bounds on what a partition may hold, for a kit that must keep
+// the same ones and for a test that pins them.
+export { GONE, MINTED, KNOCKS } from './partition.js';
 // The seal and the arithmetic, for a kit in another language to check its
 // bytes against, and for tests that speak to a door directly.
 export * as seal from './seal.js';

package/dist/ward/owner.js

@@ -3,16 +3,16 @@
 // is an occupant of the ward itself, invited by the root. The ward is a
 // being to her owner: the empty ask is her describe, and it carries her asks
 // with a description and an input each, so a side renders them as it
-// renders any being's. Six asks: boot, public, invite, knock, remove and
-// unboot, which is boot's inverse and takes her relations with her. The
-// knock is a being's knock made for her, and the standing is written into
-// her cells under the id the owner gave; remove takes a relation out of her
-// by id, the mirror of it.
+// renders any being's. Seven asks: boot, public, invite, knock, remove and
+// unboot, which is boot's inverse and takes her relations with her, and ask,
+// which reaches into a being and asks her. The knock is a being's knock made
+// for her, and the standing is written into her cells under the id the owner
+// gave; remove takes a relation out of her by id, the mirror of it.
 import { isSilence, isWord, wordOf } from '../being/silence.js';
 import { OWNER } from '../being/types.js';
 import { put } from './partition.js';
-import { seen } from './door.js';
-import { within, DEFAULT, LATE } from './allowance.js';
+import { seen, answered } from './door.js';
+import { within, allow, DEFAULT, LATE } from './allowance.js';
 const str = { type: 'string' };
 export const OWNER_ASKS = [
     { name: 'boot', description: 'boot a being by class name, under a key the owner chooses', input: { type: 'object', properties: { key: str, class: str }, required: ['key', 'class'] } },
@@ -25,6 +25,11 @@ export const OWNER_ASKS = [
     },
     { name: 'remove', description: 'take a relation out of a being of the ward by id, occupant or standing; on the ward pk it unseats an owner, and only the root may', input: { type: 'object', properties: { being: str, id: str }, required: ['being', 'id'] } },
     { name: 'unboot', description: 'take a being out of the ward, with every relation she holds; her occupants hear removed, and the ward itself is refused', input: { type: 'object', properties: { being: str }, required: ['being'] } },
+    {
+        name: 'ask',
+        description: 'ask a being of the ward, as the owner; with no being it is the public being asked as nobody, which is what a stranger would hear',
+        input: { type: 'object', properties: { being: str, method: str, args: { type: 'object' }, wanted: { type: 'object', properties: { time: { type: 'number' } } } } },
+    },
 ];
 export async function ownerAnswer(w, asker, method, args) {
     // Every name the owner gives is a string, or it is nothing. Coerced instead
@@ -82,7 +87,7 @@ export async function ownerAnswer(w, asker, method, args) {
         const door = w.doors.get(being);
         if (!door)
             return { error: 'no such being' };
-        return await door.stance.occupants.invite(id, notes !== null && typeof notes === 'object' && !Array.isArray(notes) ? notes : undefined);
+        return await door.stance.occupants.invite(id, notes !== null && typeof notes === 'object' && !Array.isArray(notes) ? (notes) : undefined);
     }
     if (method === 'knock') {
         const b = args.being;
@@ -152,6 +157,42 @@ export async function ownerAnswer(w, asker, method, args) {
         const removed = w.unboot(being);
         return removed === null ? { error: 'no such being' } : { unbooted: being, removed };
     }
+    if (method === 'ask') {
+        // The owner's other power: to reach into a being and ask her. It is
+        // strictly less than unboot, which takes her out with every relation she
+        // holds, and it is the third asker of the ward-to-being edge finally
+        // filled in by the ward rather than minted by whoever holds the pointer.
+        // Bounded, judged and named here, so no side outside the ward ever holds
+        // a being's answer and writes the door's discipline again beside it.
+        const being = args.being === undefined ? null : named(args.being);
+        if (args.being !== undefined && being === null)
+            return { error: 'no such being' };
+        // A method is a name or it is the empty ask. Coerced instead of checked,
+        // a shape passed where a name belongs becomes a string she never declared,
+        // and she would answer `unknown ask` to something nobody asked.
+        if (args.method !== undefined && typeof args.method !== 'string')
+            return { error: 'an ask is named by a word' };
+        // No being named is the in-process twin of bytes for nobody: the public
+        // being, asked as nobody, unbound, so a throw of hers is silence. Her
+        // insides are not a stranger's to read, and a device serving her to
+        // strangers must hear what a stranger hears and not one word more.
+        const key = being ?? w.publicKey();
+        const door = key === null ? undefined : w.doors.get(key);
+        if (!door || door.key === w.pk)
+            return { error: 'no such being' };
+        const bound = being !== null;
+        // The owner is a caller like any other: wanted says what this ask may
+        // spend, and saying nothing is the ward's default. A wait that ran out is
+        // late, the same word a being would hear, said as the object an owner hears.
+        const out = await within(allow(args.wanted).time, answered(door, bound ? { id: OWNER } : {}, args.method, args.args ?? {}, bound));
+        if (out === LATE)
+            return { error: 'late' };
+        if ('quo' in out)
+            return { error: out.quo };
+        if (!('object' in out))
+            return { error: 'silence' };
+        return out.object;
+    }
     return { error: 'unknown ask' };
 }
 // The ward's describe for its owner: its beings, their classes, a digest each,

package/dist/ward/seal.d.ts

@@ -6,6 +6,7 @@ export type WardKey = {
     padlockPk: Uint8Array;
     pk: string;
 };
+export declare const SIZE: number;
 export declare function wardKey(seed: string | Uint8Array): Promise<WardKey>;
 export declare const wardSignPk: (pk: string) => Uint8Array;
 export declare const wardPadlock: (pk: string) => Uint8Array;

package/dist/ward/seal.js

@@ -10,6 +10,14 @@ const text = new TextDecoder();
 // answering to one name is how a kit is read wrong.
 const WARD_SIGN = new TextEncoder().encode('quo-ward-sign');
 const WARD_SEAL = new TextEncoder().encode('quo-ward-seal');
+// The one size in Quo: one mebibyte of bytes each way. It is read before
+// anything is opened, so bytes above it are never decrypted, never parsed and
+// never allocated against. Refusing them is bytes that said nothing, which is
+// already silence, so there is no tenth word and no new door case. Breadth
+// costs bytes, so this one number bounds every other breadth on the wire, and
+// what a being holds is not the protocol's business. An ask is a message and
+// not a file; what is larger is asked for in pieces.
+export const SIZE = 1024 * 1024;
 // The ward's key from its seed. Its pk on the wire is the signing pk then the padlock, 128 hex.
 //
 // One seed, two curves, and each secret derived from it under its own label.
@@ -55,7 +63,7 @@ export async function sealAsk(to, payload, signer, padlock, seed) {
 // Verification is the door's own step, because only the door knows which key may speak.
 export async function openAsk(bytes, padlockSecret) {
     try {
-        if (!(bytes instanceof Uint8Array) || bytes.length < 1)
+        if (!(bytes instanceof Uint8Array) || bytes.length < 1 || bytes.length > SIZE)
             return null;
         const inside = await unbox(bytes, padlockSecret);
         if (inside.length <= SIGNATURE)
@@ -109,7 +117,7 @@ export async function sealReply(reply, ephemeralPk, wardSign, seed) {
 // throw or an absent value for what a stranger wrote.
 export async function openReply(bytes, ephemeralSecret, signPk) {
     try {
-        if (!(bytes instanceof Uint8Array))
+        if (!(bytes instanceof Uint8Array) || bytes.length > SIZE)
             return null;
         const inside = await unbox(bytes, ephemeralSecret);
         if (inside.length <= SIGNATURE)

package/dist/ward/stance.d.ts

@@ -13,6 +13,7 @@ export type Inside = {
     send(bind: Bind, keys: StandingKeys, method: string | undefined, args: JsonObject, wanted: Wanted | undefined): Promise<ReplyPayload | Silence | Word>;
     instantiate(className: string, key: string): string | null;
     relate(key: string, id: string): Promise<Invitation | null>;
+    lend(name: string, take: (invitation: Invitation) => Promise<boolean>): Promise<boolean>;
     unmake(key: string): void;
     wrote(): void;
 };

package/dist/ward/stance.js

@@ -1,20 +1,33 @@
 // SPDX-License-Identifier: Apache-2.0
 // The one stance builder. Used for every being the ward boots. Nothing
 // outer is in what she holds: ids in, values out, keys in the bind table.
-import { silence, isSilence, isWord, word, wordOf } from '../being/silence.js';
+import { silence, isSilence, isWord, unreached, word, wordOf } from '../being/silence.js';
 import { digest } from '../being/digest.js';
 import { RESERVED_IDS, isBlueprint } from '../being/types.js';
 import { at, put, drop, prune } from './partition.js';
 import { allow, within, LATE } from './allowance.js';
 import { isHex, isWardPk } from './seal.js';
-import { cellFault } from './cells.js';
+import { cellFault, unkeepable } from './cells.js';
 // The three calls on `standings` share the object with the ids she takes, so
 // a standing named after one of them would be unreachable: `standings.knock`
 // is the call, whatever record sits under that name. One namespace means one
 // list: these are refused at invite and at take, beside the ward's own words.
 const CALLS = ['knock', 'take', 'remove'];
-const reserved = (id) => RESERVED_IDS.includes(id) || CALLS.includes(id);
 export function buildStance(inside, key, cells, bind) {
+    // A word the ward refuses at every mint and every take. The two the
+    // protocol names, and the ones this kit adds because its own spelling took
+    // them: the calls a standing already answers to, and a name no partition
+    // can hold. That last one is refused here rather than by the cells guard,
+    // because the guard throws and this table promises a null.
+    // A method is a word or it is nothing at all. The seal writes a payload as
+    // JSON, which drops a key whose value it cannot write, so a symbol or a
+    // function here would leave as an ask with no method: the empty ask. She
+    // would have asked for work, been handed a blueprint, and spent a number on
+    // it. Nothing that cannot be sent is sent, and what never left is unreached,
+    // which is the one answer that says asking again is safe. This is the same
+    // rule args are already held to.
+    const named = (method) => method === undefined || typeof method === 'string';
+    const reserved = (id) => RESERVED_IDS.includes(id) || CALLS.includes(id) || unkeepable(id);
     // The name of one relation, as her side files it. A relation is a ward and
     // a heir, never a heir alone: the heir pk is outer, it rides in the clear on
     // every lid, and anyone who reads one can quote it back inside an invitation
@@ -189,6 +202,8 @@ export function buildStance(inside, key, cells, bind) {
         knock: async (inv, method, args = {}, wanted) => {
             if (gone())
                 return word('dropped');
+            if (!named(method))
+                return unreached();
             if (!valid(inv))
                 return word('invitation'); // S1. nothing is sent
             // She may knock again, and after take that knock is an ask: the relation
@@ -254,6 +269,8 @@ export function buildStance(inside, key, cells, bind) {
         ask: (method, args = {}, wanted) => {
             if (gone())
                 return Promise.resolve(word('dropped'));
+            if (!named(method))
+                return Promise.resolve(unreached());
             const keys = at(bind.standings, id);
             if (!keys)
                 return Promise.resolve(word('dropped')); // S2. she dropped it between one line and the next
@@ -324,6 +341,13 @@ export function buildStance(inside, key, cells, bind) {
             invite: async (id, notes) => {
                 if (gone() || reserved(id) || at(cells.occupants, id) || at(cells.standings, id))
                     return null;
+                // Notes are values, like everything else the partition keeps, and a
+                // spread copies one level: an object inside them would stay the
+                // caller's, a handle into her cells that writes past the guard and
+                // never says `wrote`, so what a restart brought back would not be
+                // what she read. Held to the rule and copied whole, or no invitation.
+                if (notes !== undefined && cellFault(notes, 'notes') !== null)
+                    return null;
                 // The key first, and nothing written until it exists: a record put
                 // before the mint would be a record a remove in the meantime drops
                 // with no heir to close, and the heir opened after it would name an
@@ -333,7 +357,7 @@ export function buildStance(inside, key, cells, bind) {
                     return null; // taken while the key was minted
                 // The notes are the terms the inviter minted under, hers to read on her
                 // gate. She may write more later; nobody outside ever writes them.
-                put(cells.occupants, id, { id, notes: notes ? { ...notes } : {} });
+                put(cells.occupants, id, { id, notes: notes ? JSON.parse(JSON.stringify(notes)) : {} });
                 inside.openHeir(k.pk, key, id);
                 put(bind.occupants, id, k.pk);
                 inside.wrote();
@@ -351,5 +375,39 @@ export function buildStance(inside, key, cells, bind) {
             },
         },
         standings,
+        // A standing at one of the things this device can do. The same three
+        // moves her boot makes, with the harbor's root doing the inviting instead
+        // of a being of this ward: ask the ground for the name, knock with what
+        // comes back, take it under the id she gave. She is handed the id.
+        //
+        // The invitation never reaches her, and that is the difference between
+        // this relation and every other she holds. Her own invitations are hers
+        // to give away, because giving one away is giving away her own relation.
+        // This one is the device's, minted for this ward alone, and a value she
+        // could copy is a capability she could hand to anyone. A being who wants
+        // to lend her device access to another does it in the open, by an ask of
+        // her own that forwards to this standing, where her gate reads who is
+        // asking and she can stop.
+        lend: async (name, id) => {
+            if (gone() || typeof name !== 'string' || typeof id !== 'string')
+                return null;
+            if (reserved(id) || at(cells.standings, id) || at(cells.occupants, id))
+                return null;
+            // Her half runs inside the harbor's call, so a knock that was refused
+            // and a take that lost the id both end with the harbor removing what it
+            // minted. Nothing half-lives here either.
+            const took = await inside.lend(name, async (inv) => {
+                // Read again: the ground was awaited, and a line of hers in between
+                // may have taken the id. Nothing is written for a relation she cannot
+                // hold, and the invitation goes back unspent.
+                if (gone() || reserved(id) || at(cells.standings, id) || at(cells.occupants, id))
+                    return false;
+                const out = await calls.knock(inv);
+                if (isSilence(out) || isWord(out))
+                    return false;
+                return (await calls.take(id, inv)) === id;
+            });
+            return took ? id : null;
+        },
     };
 }

package/dist/ward/ward.js

@@ -210,6 +210,11 @@ class Self {
             // never came about takes her out again.
             relate: async (k, id) => (await this.doors.get(k)?.stance.occupants.invite(id)) ?? null,
             unmake: (k) => void this.#unboot(k),
+            // What this device lends this ward's beings. The ward knocks and takes
+            // inside the harbor's own call and reads nothing in the value: which
+            // names there are, which ward may ask for one, and what becomes of one
+            // she did not take, is the harbor's and no word of the ward.
+            lend: async (name, take) => (await this.g.lend?.(name, take)) ?? false,
             wrote: () => this.#wrote(),
         }, key, cells, bind);
         const being = make(stance);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@quo-systems/quo",
-  "version": "0.2.13",
+  "version": "0.2.15",
   "description": "Quo: an object asks another object and gets an answer, without knowing where it is. Being, Ward, Harbor.",
   "keywords": [
     "quo",
@@ -13,6 +13,7 @@
   ],
   "author": "Razvan Gherghina",
   "license": "Apache-2.0",
+  "homepage": "https://quo.systems",
   "type": "module",
   "engines": {
     "node": ">=22.18"
@@ -38,10 +39,10 @@
     "./package.json": "./package.json"
   },
   "scripts": {
-    "build": "rm -rf dist && tsc -p tsconfig.build.json && cp ../../papers/SPEC.md SPEC.md",
+    "build": "rm -rf dist && tsc -p tsconfig.build.json && cp ../../papers/SPEC.md SPEC.md && cp ../../papers/quo-kit.md quo-kit.md",
     "test": "node --test \"test/*.test.ts\"",
     "check:terrain": "node --test \"test/terrain/*.test.ts\"",
-    "prepublishOnly": "test \"$QUO_GATED\" = 1 || { echo 'publish from the root, gated once: npm run release' >&2; exit 1; }"
+    "prepublishOnly": "test \"$QUO_GATED\" = 1 || { echo 'publish from the root, gated once: npm run release:quo' >&2; exit 1; }"
   },
   "publishConfig": {
     "access": "public"
@@ -51,6 +52,7 @@
     "src",
     "vectors",
     "SPEC.md",
+    "quo-kit.md",
     "README.md",
     "LICENSE",
     "NOTICE"