@quo-systems/quo 0.2.14 → 0.2.16

package/dist/harbor/core.js

@@ -8,10 +8,12 @@
 // edge harbor is this over an object's storage. None of them is in this
 // tree, and every one of them passes the conformance suite untouched.
 //
-// The directory is filled three ways, in this order: the harbor's own
+// The directory is filled four ways, in this order: the harbor's own
 // doors; a socket a dialer holds to it, bound once the door behind the
-// dialer's claim has proved it holds the key, and unbound at close; a hint
-// from a link. And one fallback: a dialer with nothing in its
+// dialer's claim has proved it holds the key, and unbound at close; the
+// claims of a listener this harbor dialed, proved the same way and reached
+// through that line; and a hint, a pk at a URL, kept in the store. A hint
+// never displaces a reach proved at a door. And one fallback: a dialer with nothing in its
 // directory for a pk sends down the socket it holds, because the listener
 // it dialed is the rendezvous and may hold that pk on another socket. Bytes
 // that arrive from the wire go to an own door or a held socket and never
@@ -68,15 +70,31 @@ export class Harbor {
         for (const say of this.announcers)
             say();
     }
-    constructor(store, loader = async () => ({})) {
+    // What this device lends the beings of the wards it hosts, by name. One
+    // for the harbor, and `lendFor` says which ward may ask it: every ward,
+    // unless a terrain says a stranger's ward is lent nothing.
+    // Set at birth or once the harbor's own ward is standing, which is the
+    // usual order: a terrain puts that ward up first, then boots the rest on a
+    // ground that can reach it.
+    lend;
+    constructor(store, loader = async () => ({}), lend) {
         this.store = store;
         this.loader = loader;
+        this.lend = lend;
+    }
+    lendFor(_name, _record) {
+        return this.lend;
     }
     // Boot every ward the store keeps, and learn the hints. One ward that will
     // not host, a partition this kit cannot read or a loader that throws, is
     // named in `unbooted` and takes nobody else down with it.
     async boot() {
         for (const name of await this.store.list()) {
+            // A ward this harbor already hosts is not booted twice. A terrain that
+            // keeps a ward of its own puts it up before this runs, so that a being
+            // born in any other ward can lend from her first line.
+            if (this.wards.has(name))
+                continue;
             try {
                 const kept = await this.store.load(name);
                 if (kept)
@@ -316,6 +334,9 @@ export class Harbor {
             random,
             wrote: () => this.#wrote(name),
         };
+        const lend = this.lendFor(name, kept.record);
+        if (lend)
+            ground.lend = lend;
         const saving = { memory, dirty: false, running: null, timer: undefined, gone: false };
         this.#saving.set(name, saving);
         // A ward that will not be born leaves nothing behind: a partition of a

package/dist/harbor/index.d.ts

@@ -3,5 +3,5 @@ export { Harbor, DEFAULT_CODE, type Hosted, type Bound, type Loader } from './co
 export { dial, type Dialer } from './dial.ts';
 export { MemoryStore, values, type Store, type Kept, type WardRecord } from './store.ts';
 export { request, Socket, SUITE, REFUSED, type Reach, type Carry, type Line, type Announce } from './reach.ts';
-export type { Ground, WardPointers } from '../ward/ground.ts';
+export type { Ground, WardPointers, Lend } from '../ward/ground.ts';
 export { maker, entropy, learnPk } from '../ward/ground.ts';

package/dist/harbor/memory.d.ts

@@ -1,5 +1,5 @@
 import type { BeingClass, BeingLike } from '../being/types.ts';
-import { type Ground, type WardPointers } from '../ward/ground.ts';
+import { type Ground, type WardPointers, type Lend } from '../ward/ground.ts';
 export type Booted = WardPointers & {
     pk: string;
 };
@@ -17,8 +17,9 @@ export declare class MemoryHarbor {
     readonly partitions: Map<string, Record<string, unknown>>;
     readonly wards: Map<string, Booted>;
     readonly objects: WeakMap<object, BeingLike>;
+    random: Ground['random'];
     route(farPk: string, bytes: Uint8Array): Promise<Uint8Array | undefined>;
     link(harbor: MemoryHarbor): void;
-    boot(seed: string, Ward: WardFactory, classes: Record<string, BeingClass>): Promise<Booted>;
-    reboot(seed: string, Ward: WardFactory, classes: Record<string, BeingClass>): Promise<Booted>;
+    boot(seed: string, Ward: WardFactory, classes: Record<string, BeingClass>, lend?: Lend): Promise<Booted>;
+    reboot(seed: string, Ward: WardFactory, classes: Record<string, BeingClass>, lend?: Lend): Promise<Booted>;
 }

package/dist/harbor/memory.js

@@ -10,6 +10,12 @@ export class MemoryHarbor {
     partitions = new Map(); // seed -> memory. the harbor keeps it and reads nothing
     wards = new Map(); // seed -> pointers
     objects = new WeakMap(); // cells -> being object. what instantiate constructed. a hand for tests, never the ward's; it follows the cells out when she is unbooted
+    // Where the wards this harbor boots draw their entropy. The device's own
+    // by default. A harbor may hand a fixed stream instead, which is what pins
+    // bytes: every key a ward mints and every nonce it seals under comes from
+    // here, so a ward on a known seed with a known stream answers the same
+    // bytes every run, and a corpus of them is a corpus and not a sample.
+    random = entropy;
     // the directory: its own doors, else a peer it is linked to. Quo says nothing about how.
     async route(farPk, bytes) {
         if (this.down.has(farPk))
@@ -31,18 +37,21 @@ export class MemoryHarbor {
         harbor.peers.add(this);
     }
     // boot by seed. the harbor gets a door and an ask, and learns the pk by asking.
-    async boot(seed, Ward, classes) {
+    // `lend` is what this device lends the ward's beings, and a test's stand-in
+    // for a real terrain's: left out, every name answers null.
+    async boot(seed, Ward, classes, lend) {
         this.partitions.set(seed, {});
-        return this.reboot(seed, Ward, classes);
+        return this.reboot(seed, Ward, classes, lend);
     }
     // a restart: same seed, same partition, fresh ward. the ward's files are the harbor's to keep.
-    async reboot(seed, Ward, classes) {
+    async reboot(seed, Ward, classes, lend) {
         const memory = this.partitions.get(seed);
         if (!memory)
             throw new Error(`no partition for ${seed}`);
         const ground = {
             seed,
             memory,
+            ...(lend ? { lend } : {}),
             // One objects map for the whole harbor, not one per ward: every ward
             // here is in this process and a test reaches any being of any of them.
             instantiate: maker(this.objects, classes),
@@ -52,7 +61,7 @@ export class MemoryHarbor {
                 const back = await this.route(farPk, new Uint8Array(bytes));
                 return back === undefined ? undefined : new Uint8Array(back);
             },
-            random: entropy,
+            random: (n) => this.random(n),
         };
         const w = await Ward(ground);
         const booted = { ...w, pk: await learnPk(w) };

package/dist/harbor/reach.js

@@ -60,7 +60,7 @@ export function request(url) {
 // side holds and the wire suite it speaks, sent when the socket opens and
 // whenever the pks change.
 const ASK = 0, REPLY = 1, NONE = 2;
-// The wire suite: which frames these are and which four algorithms seal what
+// The wire suite: which frames these are and which five algorithms seal what
 // they carry. One value, and it is not negotiated. It rides in the handshake
 // and never on an ask, so an ask stays bytes nobody can tell from noise, and
 // a line still learns before it carries anything whether the far side speaks

package/dist/ward/arithmetic.d.ts

@@ -7,6 +7,10 @@ export declare function unhex(text: string): Uint8Array;
 export declare function concat(parts: Uint8Array[]): Uint8Array;
 export declare function sameBytes(a: Uint8Array, b: Uint8Array): boolean;
 export declare const smallOrder: (pk: Uint8Array) => boolean;
+export declare const heldKeys: () => {
+    held: number;
+    bound: number;
+};
 export declare function sha256(...parts: Uint8Array[]): Promise<Uint8Array>;
 export type Pair = {
     secret: Uint8Array;

package/dist/ward/arithmetic.js

@@ -86,27 +86,97 @@ const key32 = (value, what) => {
     return value;
 };
 const pkcs8 = (prefix, value, what) => concat([prefix, key32(value, what)]);
-const secretKey = (alg, prefix, value, what, uses) => subtle().importKey('pkcs8', pkcs8(prefix, value, what), alg, true, uses);
-const publicKey = (alg, value, what, uses) => subtle().importKey('raw', key32(value, what), alg, true, uses);
-// Subtle exports the public half of a private key only through a JWK, where `x` is the 32 raw bytes in base64url.
-async function rawPublic(secret) {
-    const jwk = await subtle().exportKey('jwk', secret);
-    const binary = atob(jwk.x.replaceAll('-', '+').replaceAll('_', '/'));
-    const out = new Uint8Array(binary.length);
-    for (let at = 0; at < binary.length; at += 1)
-        out[at] = binary.charCodeAt(at);
-    return out;
+// Importing a key is the most expensive thing on the path of an ask, and most
+// of the imports are the same key again: a ward signs every reply with the one
+// key, opens every ask with the one padlock, and verifies a relation under the
+// key it verified it under last time. Measured over a round trip, fifteen of
+// the twenty-five imports were bytes already imported once.
+//
+// So an imported key is kept, by the bytes it was imported from. A CryptoKey
+// cannot be changed once it exists, so handing the same one out twice is
+// handing out what a second import would have built. Nothing here is a
+// decision a peer can see: two wards that cache differently, or not at all,
+// speak the same bytes.
+//
+// It is bounded, and that is not a detail. A relation mints a fresh key on
+// every ask, so a ward that talked all day would otherwise hold a key for
+// every ask it ever made. Past the bound the least recently used goes, which
+// is the key of a relation that has fallen quiet, and importing it again
+// costs what it cost the first time.
+//
+// The secret keys in here are the ones the partition already holds in this
+// process, as seeds. The cache is another shape of what the ward is already
+// standing on, and never a second place a secret comes from.
+const KEYS = 512;
+const imported = new Map();
+const keep = (id, make) => {
+    const had = imported.get(id);
+    if (had !== undefined) {
+        imported.delete(id); // and set again below: the most recently used goes last
+        imported.set(id, had);
+        return had;
+    }
+    const made = make();
+    // A key that would not import is not kept: the next call asks subtle again
+    // and hears the same refusal, rather than reading one this cache remembered.
+    // Node takes any thirty-two bytes as a public key and finds out at verify,
+    // so nothing here reaches this line; a terrain that checks the point at the
+    // import does, and a refusal it remembered would be a relation killed for
+    // good by one bad arrival.
+    made.catch(() => imported.delete(id));
+    imported.set(id, made);
+    // One in, at most one out: a map keeps what was put in the order it was put,
+    // so the first key it names is the one used longest ago.
+    if (imported.size > KEYS)
+        imported.delete(imported.keys().next().value);
+    return made;
+};
+// How many imported keys are held, and the bound they are held under. Nothing
+// in the ward reads either: they are here to be looked at, and for the suite
+// that holds the bound to what it says.
+export const heldKeys = () => ({ held: imported.size, bound: KEYS });
+const secretKey = (alg, prefix, value, what, uses) => {
+    const bytes = pkcs8(prefix, value, what);
+    return keep(`${alg.name}|${uses.join('+')}|${hex(bytes)}`, () => subtle().importKey('pkcs8', bytes, alg, true, uses));
+};
+const publicKey = (alg, value, what, uses) => {
+    const bytes = key32(value, what);
+    return keep(`${alg.name}|${uses.join('+')}|pk|${hex(bytes)}`, () => subtle().importKey('raw', bytes, alg, true, uses));
+};
+// Subtle exports the public half of a private key only through a JWK, where
+// `x` is the 32 raw bytes in base64url. The answer is a fact about the key and
+// never changes, so it is kept beside the key it was read from and goes when
+// the key does.
+const publics = new WeakMap();
+function rawPublic(secret) {
+    const had = publics.get(secret);
+    if (had !== undefined)
+        return had;
+    const read = (async () => {
+        const jwk = await subtle().exportKey('jwk', secret);
+        const binary = atob(jwk.x.replaceAll('-', '+').replaceAll('_', '/'));
+        const out = new Uint8Array(binary.length);
+        for (let at = 0; at < binary.length; at += 1)
+            out[at] = binary.charCodeAt(at);
+        return out;
+    })();
+    publics.set(secret, read);
+    return read;
 }
 export async function sha256(...parts) {
     return new Uint8Array(await subtle().digest('SHA-256', concat(parts)));
 }
+// Both halves are copies. The seed and the public key are kept behind the two
+// caches above, and a pair is handed to whoever asked for it: what she does
+// with the bytes in her hand is hers, and must not reach what the next caller
+// is given.
 export async function signingPair(seed) {
     const secret = await secretKey(ED, ED_SECRET, seed, 'seed', ['sign']);
-    return { secret: Uint8Array.from(seed), pk: await rawPublic(secret) };
+    return { secret: Uint8Array.from(seed), pk: Uint8Array.from(await rawPublic(secret)) };
 }
 export async function sealingPair(seed) {
     const secret = await secretKey(X, X_SECRET, seed, 'seed', ['deriveBits']);
-    return { secret: Uint8Array.from(seed), pk: await rawPublic(secret) };
+    return { secret: Uint8Array.from(seed), pk: Uint8Array.from(await rawPublic(secret)) };
 }
 export async function sign(message, secret) {
     const key = await secretKey(ED, ED_SECRET, secret, 'secret', ['sign']);

package/dist/ward/cells.d.ts

@@ -1,5 +1,7 @@
 import type { Cells } from '../being/types.ts';
 export declare const DEPTH = 64;
+export declare const BREADTH: number;
 export declare const cellFault: (v: unknown, path: string) => string | null;
+export declare const unkeepable: (k: string) => boolean;
 export declare const guardCells: (cells: Cells, wrote?: () => void) => Cells;
 export declare const unguarded: (cells: Cells) => Cells;

package/dist/ward/cells.js

@@ -2,32 +2,71 @@
 // and a peer chooses the depth of what she answers; a bound keeps a hostile
 // reply from ending a walk in a stack overflow instead of a refusal.
 export const DEPTH = 64;
+// How many values one written out may come to. Depth alone does not bound
+// what a value costs to keep: one subvalue may sit under two keys, and
+// nesting that forty levels deep is inside the depth bound and is a trillion
+// values once written down. What is walked here is the object graph, which is
+// small; what a harbor keeps is the tree it expands to, which is not. So the
+// walk counts the tree while it proves the graph, and refuses a value nobody
+// could write down. This is a bound on what a being holds, so it is this
+// kit's number and no word of the spec.
+export const BREADTH = 1 << 20;
+// Text a harbor can write down: every surrogate in a pair. A lone one is a
+// code unit with no character, which JSON escapes and UTF-8 cannot encode at
+// all, so a harbor that keeps strings as bytes loses it and one that keeps
+// the object does not. I-JSON says a string is text, and this is that rule
+// where the value is written rather than where it is read.
+const WELL_FORMED = /^(?:[^\uD800-\uDFFF]|[\uD800-\uDBFF][\uDC00-\uDFFF])*$/;
 // I-JSON, all the way down. A number that JSON cannot write is not a number
 // a harbor can keep, a key on the prototype is not a key she wrote, and a
 // hole in a list, or a key named `__proto__`, is a thing JSON writes one way
 // and a runtime reads another.
-function fault(v, path, seen, depth) {
-    if (v === null || typeof v === 'boolean' || typeof v === 'string')
-        return null;
-    if (typeof v === 'number')
-        return Number.isFinite(v) ? null : `${path} is ${String(v)}, which no harbor can write down`;
+//
+// A fault is a sentence; anything else is the count of values under this one,
+// itself included. A value already counted is a value already proven, so a
+// graph that shares is walked once per node rather than once per path.
+function walk(v, path, seen, sized, depth) {
+    if (v === null || typeof v === 'boolean')
+        return 1;
+    if (typeof v === 'string')
+        return WELL_FORMED.test(v) ? 1 : `${path} carries a lone surrogate, which is no text a harbor can write down`;
+    if (typeof v === 'number') {
+        if (!Number.isFinite(v))
+            return `${path} is ${String(v)}, which no harbor can write down`;
+        // Minus zero is a number JSON writes as `0` and reads back as `0`. A
+        // harbor that keeps values would hand her the sign she wrote and one that
+        // writes JSON would not, and she is never told which she is standing in.
+        return Object.is(v, -0) ? `${path} is minus zero, which comes back as zero from every harbor that writes JSON` : 1;
+    }
     if (typeof v !== 'object')
         return `${path} is a ${typeof v}, which is not a value`;
     if (seen.has(v))
         return `${path} refers back to itself`;
+    const counted = sized.get(v);
+    if (counted !== undefined)
+        return counted;
     if (depth >= DEPTH)
         return `${path} is nested past ${DEPTH} levels, which no harbor can keep`;
     seen.add(v);
     try {
+        let size = 1;
+        const under = (where, x) => {
+            const r = walk(x, where, seen, sized, depth + 1);
+            if (typeof r === 'string')
+                return r;
+            size += r;
+            return size > BREADTH ? `${path} writes out to more than ${BREADTH} values, which no harbor can keep` : null;
+        };
         if (Array.isArray(v)) {
             for (let i = 0; i < v.length; i += 1) {
                 if (!(i in v))
                     return `${path}[${i}] is a hole, which no harbor can write down`;
-                const f = fault(v[i], `${path}[${i}]`, seen, depth + 1);
+                const f = under(`${path}[${i}]`, v[i]);
                 if (f)
                     return f;
             }
-            return null;
+            sized.set(v, size);
+            return size;
         }
         const proto = Object.getPrototypeOf(v);
         if (proto !== Object.prototype && proto !== null)
@@ -35,17 +74,21 @@ function fault(v, path, seen, depth) {
         for (const k of Object.keys(v)) {
             if (k === '__proto__')
                 return `${path}.__proto__ is a key no harbor can keep`;
-            const f = fault(v[k], `${path}.${k}`, seen, depth + 1);
+            const f = under(`${path}.${k}`, v[k]);
             if (f)
                 return f;
         }
-        return null;
+        sized.set(v, size);
+        return size;
     }
     finally {
         seen.delete(v);
     }
 }
-export const cellFault = (v, path) => fault(v, path, new Set(), 0);
+export const cellFault = (v, path) => {
+    const out = walk(v, path, new Set(), new Map(), 0);
+    return typeof out === 'string' ? out : null;
+};
 // The three keys at the root of her cells that are the ward's: it writes
 // them, she reads them, and a write of hers there is refused like a non-value.
 const WARDS = new Set(['standings', 'occupants', 'class']);
@@ -56,6 +99,12 @@ const WARDS = new Set(['standings', 'occupants', 'class']);
 const wrapped = new WeakMap();
 const targets = new WeakMap();
 const guards = new WeakSet();
+// A name no partition can hold, wherever it appears. It is here beside the
+// guard that refuses it, because the ward refuses it too: a relation named
+// this one would be written into the bind table and then throw on her cells,
+// which is half a relation and a throw where a null is promised. One rule,
+// one place, read by the guard and by the stance.
+export const unkeepable = (k) => k === '__proto__';
 // A key a write may land on: a string that is not `__proto__`, and not one
 // of the ward's at the root. A symbol key is a thing JSON never writes.
 const refuse = (why) => {
@@ -64,7 +113,7 @@ const refuse = (why) => {
 function keyFault(t, k, v, path, root) {
     if (typeof k !== 'string')
         refuse(`${path} takes no symbol key`);
-    if (k === '__proto__')
+    if (unkeepable(k))
         refuse(`${path}.__proto__ is a key no harbor can keep`);
     if (root && WARDS.has(k))
         refuse(`${path}.${k} is the ward's to write`);

package/dist/ward/door.d.ts

@@ -12,6 +12,7 @@ export type Judged = {
     bytes: Uint8Array;
     heard: boolean;
 };
+export declare function answered(door: Door, asker: Asker, method: string | undefined, args: JsonObject, bound: boolean): Promise<ReplyPayload>;
 export declare function arrive(door: Door, asker: Asker, method: string | undefined, args: JsonObject, bound: boolean): Promise<ReplyPayload>;
 export declare function seen(door: Door, asker: Asker): Promise<string | null>;
 export declare function makeDoor(key: WardKey, heirs: Heirs, doors: Map<string, Door>, publicKey: () => string | null, random: (n: number) => Uint8Array): (bytes: Uint8Array) => Promise<Judged>;

package/dist/ward/door.js

@@ -16,10 +16,13 @@ import { KEY, sealingPair } from './arithmetic.js';
 import { cellFault } from './cells.js';
 const SILENCE = { silence: true };
 const said = (quo) => ({ quo });
-// One arrival at one being, already named. Catches every throw. `bound` says
-// whether the asker is a key this door holds: she hears `threw`; a stranger
-// at the public being hears silence, because her insides are hers.
-export async function arrive(door, asker, method, args, bound) {
+// One arrival at one being, already named: the three choices, D11, D12 and
+// D13, and nothing else. Catches every throw. `bound` says whether the asker
+// is a key this door holds, or the ward's own owner: she hears `threw`; a
+// stranger at the public being hears silence, because her insides are hers.
+// Every caller that reaches a being's answer goes through here, the owner's
+// `ask` included, so the three choices are written once.
+export async function answered(door, asker, method, args, bound) {
     const threw = bound ? said('threw') : SILENCE;
     let out;
     try {
@@ -42,18 +45,34 @@ export async function arrive(door, asker, method, args, bound) {
     // was spent. It is threw, like a word out of her.
     if (cellFault(out, 'answer') !== null)
         return threw;
-    if (method === undefined)
-        return { object: out, seen: null };
-    // The digest rides along, it is not the answer. She has already answered:
-    // a describe that will not run costs the digest, and nothing else.
-    return { object: out, seen: await seen(door, asker) };
+    return { object: out, seen: null };
+}
+// What crosses the wire: her answer, with her digest for this asker beside
+// it. The digest rides along, it is not the answer. She has already
+// answered: a describe that will not run costs the digest, and nothing else.
+// The owner does not take one, because the owner asks for a describe when it
+// wants one and nothing is sealed on its behalf.
+export async function arrive(door, asker, method, args, bound) {
+    const reply = await answered(door, asker, method, args, bound);
+    if (method === undefined || !('object' in reply))
+        return reply;
+    return { object: reply.object, seen: await seen(door, asker) };
 }
 // Her digest for this asker, or null when her describe threw or fell silent.
 // The owner's describe reads it the same way for every being of the ward.
 export async function seen(door, asker) {
     try {
         const bp = await door.being.answer(asker);
-        return isSilence(bp) || isWord(bp) ? null : await digest(bp);
+        if (isSilence(bp) || isWord(bp))
+            return null;
+        // Held to the same rule as her answer, and for the same reason plus one:
+        // the digest is a walk, and a walk over a graph that shares or turns back
+        // on itself is not a digest but a hang or a throw. A blueprint that could
+        // not cross is a blueprint with no digest, which is what she has when her
+        // describe says nothing.
+        if (cellFault(bp, 'blueprint') !== null)
+            return null;
+        return await digest(bp);
     }
     catch {
         return null;

package/dist/ward/ground.d.ts

@@ -1,4 +1,5 @@
-import type { Stance, BeingLike, BeingClass } from '../being/types.ts';
+import type { Stance, BeingLike, BeingClass, Invitation } from '../being/types.ts';
+export type Lend = (name: string, take: (invitation: Invitation) => Promise<boolean>) => Promise<boolean>;
 export type Ground = {
     seed: string | Uint8Array;
     memory: Record<string, unknown>;
@@ -6,6 +7,7 @@ export type Ground = {
     wrote?: () => void;
     carry(pk: string, bytes: Uint8Array): Promise<Uint8Array | undefined>;
     random(n: number): Uint8Array;
+    lend?: Lend;
 };
 export type WardPointers = {
     door(bytes: Uint8Array): Promise<{

package/dist/ward/ground.js

@@ -1,5 +1,5 @@
 // ---- what every harbor builds a ground out of. Three pieces, because every
-// harbor in this tree writes the same three and the spec keeps the harbors
+// harbor in this tree writes the same three and the protocol keeps the harbors
 // themselves apart: what a memory harbor and a real one differ on is the
 // route and the store, and nothing here. A second kit writes its own harbor
 // and may write these again; they are convenience, never contract.

package/dist/ward/heirs.js

@@ -103,6 +103,13 @@ export class Heirs {
         }
         if (by === h.announced)
             h.current = by;
-        h.announced = next;
+        // A send that announced nothing leaves the spare standing. This kit
+        // announces on every send but a public one, which holds no heir and
+        // reaches none of this; a kit that skips one is a kit whose own next is
+        // still the key it announced last time, and forgetting it here would meet
+        // that key with silence and kill a healthy relation. Nothing is dropped
+        // that was vouched for until something replaces it.
+        if (next !== null)
+            h.announced = next;
     }
 }

package/dist/ward/index.d.ts

@@ -1,7 +1,7 @@
 export { Ward } from './ward.ts';
-export type { Ground, WardPointers } from './ground.ts';
+export type { Ground, WardPointers, Lend } from './ground.ts';
 export type { Partition, Heir, Bind, StandingKeys } from './partition.ts';
-export { GONE, MINTED } from './partition.ts';
+export { GONE, MINTED, KNOCKS } from './partition.ts';
 export type { AskPayload, ReplyPayload } from './seal.ts';
 export * as seal from './seal.ts';
 export * as arithmetic from './arithmetic.ts';

package/dist/ward/index.js

@@ -1,9 +1,9 @@
 // SPDX-License-Identifier: Apache-2.0
 // @quo-systems/quo/ward — one function. Every ward is the same ward.
 export { Ward } from './ward.js';
-// The two bounds on what a partition may hold, for a kit that must keep the
-// same ones and for a test that pins them.
-export { GONE, MINTED } from './partition.js';
+// The three bounds on what a partition may hold, for a kit that must keep
+// the same ones and for a test that pins them.
+export { GONE, MINTED, KNOCKS } from './partition.js';
 // The seal and the arithmetic, for a kit in another language to check its
 // bytes against, and for tests that speak to a door directly.
 export * as seal from './seal.js';

package/dist/ward/owner.js

@@ -3,16 +3,16 @@
 // is an occupant of the ward itself, invited by the root. The ward is a
 // being to her owner: the empty ask is her describe, and it carries her asks
 // with a description and an input each, so a side renders them as it
-// renders any being's. Six asks: boot, public, invite, knock, remove and
-// unboot, which is boot's inverse and takes her relations with her. The
-// knock is a being's knock made for her, and the standing is written into
-// her cells under the id the owner gave; remove takes a relation out of her
-// by id, the mirror of it.
+// renders any being's. Seven asks: boot, public, invite, knock, remove and
+// unboot, which is boot's inverse and takes her relations with her, and ask,
+// which reaches into a being and asks her. The knock is a being's knock made
+// for her, and the standing is written into her cells under the id the owner
+// gave; remove takes a relation out of her by id, the mirror of it.
 import { isSilence, isWord, wordOf } from '../being/silence.js';
 import { OWNER } from '../being/types.js';
 import { put } from './partition.js';
-import { seen } from './door.js';
-import { within, DEFAULT, LATE } from './allowance.js';
+import { seen, answered } from './door.js';
+import { within, allow, DEFAULT, LATE } from './allowance.js';
 const str = { type: 'string' };
 export const OWNER_ASKS = [
     { name: 'boot', description: 'boot a being by class name, under a key the owner chooses', input: { type: 'object', properties: { key: str, class: str }, required: ['key', 'class'] } },
@@ -25,6 +25,11 @@ export const OWNER_ASKS = [
     },
     { name: 'remove', description: 'take a relation out of a being of the ward by id, occupant or standing; on the ward pk it unseats an owner, and only the root may', input: { type: 'object', properties: { being: str, id: str }, required: ['being', 'id'] } },
     { name: 'unboot', description: 'take a being out of the ward, with every relation she holds; her occupants hear removed, and the ward itself is refused', input: { type: 'object', properties: { being: str }, required: ['being'] } },
+    {
+        name: 'ask',
+        description: 'ask a being of the ward, as the owner; with no being it is the public being asked as nobody, which is what a stranger would hear',
+        input: { type: 'object', properties: { being: str, method: str, args: { type: 'object' }, wanted: { type: 'object', properties: { time: { type: 'number' } } } } },
+    },
 ];
 export async function ownerAnswer(w, asker, method, args) {
     // Every name the owner gives is a string, or it is nothing. Coerced instead
@@ -82,7 +87,7 @@ export async function ownerAnswer(w, asker, method, args) {
         const door = w.doors.get(being);
         if (!door)
             return { error: 'no such being' };
-        return await door.stance.occupants.invite(id, notes !== null && typeof notes === 'object' && !Array.isArray(notes) ? notes : undefined);
+        return await door.stance.occupants.invite(id, notes !== null && typeof notes === 'object' && !Array.isArray(notes) ? (notes) : undefined);
     }
     if (method === 'knock') {
         const b = args.being;
@@ -152,6 +157,42 @@ export async function ownerAnswer(w, asker, method, args) {
         const removed = w.unboot(being);
         return removed === null ? { error: 'no such being' } : { unbooted: being, removed };
     }
+    if (method === 'ask') {
+        // The owner's other power: to reach into a being and ask her. It is
+        // strictly less than unboot, which takes her out with every relation she
+        // holds, and it is the third asker of the ward-to-being edge finally
+        // filled in by the ward rather than minted by whoever holds the pointer.
+        // Bounded, judged and named here, so no side outside the ward ever holds
+        // a being's answer and writes the door's discipline again beside it.
+        const being = args.being === undefined ? null : named(args.being);
+        if (args.being !== undefined && being === null)
+            return { error: 'no such being' };
+        // A method is a name or it is the empty ask. Coerced instead of checked,
+        // a shape passed where a name belongs becomes a string she never declared,
+        // and she would answer `unknown ask` to something nobody asked.
+        if (args.method !== undefined && typeof args.method !== 'string')
+            return { error: 'an ask is named by a word' };
+        // No being named is the in-process twin of bytes for nobody: the public
+        // being, asked as nobody, unbound, so a throw of hers is silence. Her
+        // insides are not a stranger's to read, and a device serving her to
+        // strangers must hear what a stranger hears and not one word more.
+        const key = being ?? w.publicKey();
+        const door = key === null ? undefined : w.doors.get(key);
+        if (!door || door.key === w.pk)
+            return { error: 'no such being' };
+        const bound = being !== null;
+        // The owner is a caller like any other: wanted says what this ask may
+        // spend, and saying nothing is the ward's default. A wait that ran out is
+        // late, the same word a being would hear, said as the object an owner hears.
+        const out = await within(allow(args.wanted).time, answered(door, bound ? { id: OWNER } : {}, args.method, args.args ?? {}, bound));
+        if (out === LATE)
+            return { error: 'late' };
+        if ('quo' in out)
+            return { error: out.quo };
+        if (!('object' in out))
+            return { error: 'silence' };
+        return out.object;
+    }
     return { error: 'unknown ask' };
 }
 // The ward's describe for its owner: its beings, their classes, a digest each,

package/dist/ward/seal.d.ts

@@ -6,6 +6,7 @@ export type WardKey = {
     padlockPk: Uint8Array;
     pk: string;
 };
+export declare const SIZE: number;
 export declare function wardKey(seed: string | Uint8Array): Promise<WardKey>;
 export declare const wardSignPk: (pk: string) => Uint8Array;
 export declare const wardPadlock: (pk: string) => Uint8Array;