@quo-systems/quo 0.2.14 → 0.2.16

package/src/ward/arithmetic.ts

@@ -85,18 +85,83 @@ const key32 = (value: Uint8Array, what: string): Uint8Array => {
   return value;
 };
 const pkcs8 = (prefix: Uint8Array, value: Uint8Array, what: string) => concat([prefix, key32(value, what)]);
-const secretKey = (alg: { name: string }, prefix: Uint8Array, value: Uint8Array, what: string, uses: KeyUsage[]) =>
-  subtle().importKey('pkcs8', pkcs8(prefix, value, what) as BufferSource, alg, true, uses);
-const publicKey = (alg: { name: string }, value: Uint8Array, what: string, uses: KeyUsage[]) =>
-  subtle().importKey('raw', key32(value, what) as BufferSource, alg, true, uses);
-
-// Subtle exports the public half of a private key only through a JWK, where `x` is the 32 raw bytes in base64url.
-async function rawPublic(secret: CryptoKey): Promise<Uint8Array> {
-  const jwk = await subtle().exportKey('jwk', secret);
-  const binary = atob(jwk.x!.replaceAll('-', '+').replaceAll('_', '/'));
-  const out = new Uint8Array(binary.length);
-  for (let at = 0; at < binary.length; at += 1) out[at] = binary.charCodeAt(at);
-  return out;
+
+// Importing a key is the most expensive thing on the path of an ask, and most
+// of the imports are the same key again: a ward signs every reply with the one
+// key, opens every ask with the one padlock, and verifies a relation under the
+// key it verified it under last time. Measured over a round trip, fifteen of
+// the twenty-five imports were bytes already imported once.
+//
+// So an imported key is kept, by the bytes it was imported from. A CryptoKey
+// cannot be changed once it exists, so handing the same one out twice is
+// handing out what a second import would have built. Nothing here is a
+// decision a peer can see: two wards that cache differently, or not at all,
+// speak the same bytes.
+//
+// It is bounded, and that is not a detail. A relation mints a fresh key on
+// every ask, so a ward that talked all day would otherwise hold a key for
+// every ask it ever made. Past the bound the least recently used goes, which
+// is the key of a relation that has fallen quiet, and importing it again
+// costs what it cost the first time.
+//
+// The secret keys in here are the ones the partition already holds in this
+// process, as seeds. The cache is another shape of what the ward is already
+// standing on, and never a second place a secret comes from.
+const KEYS = 512;
+const imported = new Map<string, Promise<CryptoKey>>();
+const keep = (id: string, make: () => Promise<CryptoKey>): Promise<CryptoKey> => {
+  const had = imported.get(id);
+  if (had !== undefined) {
+    imported.delete(id); // and set again below: the most recently used goes last
+    imported.set(id, had);
+    return had;
+  }
+  const made = make();
+  // A key that would not import is not kept: the next call asks subtle again
+  // and hears the same refusal, rather than reading one this cache remembered.
+  // Node takes any thirty-two bytes as a public key and finds out at verify,
+  // so nothing here reaches this line; a terrain that checks the point at the
+  // import does, and a refusal it remembered would be a relation killed for
+  // good by one bad arrival.
+  made.catch(() => imported.delete(id));
+  imported.set(id, made);
+  // One in, at most one out: a map keeps what was put in the order it was put,
+  // so the first key it names is the one used longest ago.
+  if (imported.size > KEYS) imported.delete(imported.keys().next().value!);
+  return made;
+};
+
+// How many imported keys are held, and the bound they are held under. Nothing
+// in the ward reads either: they are here to be looked at, and for the suite
+// that holds the bound to what it says.
+export const heldKeys = (): { held: number; bound: number } => ({ held: imported.size, bound: KEYS });
+
+const secretKey = (alg: { name: string }, prefix: Uint8Array, value: Uint8Array, what: string, uses: KeyUsage[]) => {
+  const bytes = pkcs8(prefix, value, what);
+  return keep(`${alg.name}|${uses.join('+')}|${hex(bytes)}`, () => subtle().importKey('pkcs8', bytes as BufferSource, alg, true, uses));
+};
+const publicKey = (alg: { name: string }, value: Uint8Array, what: string, uses: KeyUsage[]) => {
+  const bytes = key32(value, what);
+  return keep(`${alg.name}|${uses.join('+')}|pk|${hex(bytes)}`, () => subtle().importKey('raw', bytes as BufferSource, alg, true, uses));
+};
+
+// Subtle exports the public half of a private key only through a JWK, where
+// `x` is the 32 raw bytes in base64url. The answer is a fact about the key and
+// never changes, so it is kept beside the key it was read from and goes when
+// the key does.
+const publics = new WeakMap<CryptoKey, Promise<Uint8Array>>();
+function rawPublic(secret: CryptoKey): Promise<Uint8Array> {
+  const had = publics.get(secret);
+  if (had !== undefined) return had;
+  const read = (async () => {
+    const jwk = await subtle().exportKey('jwk', secret);
+    const binary = atob(jwk.x!.replaceAll('-', '+').replaceAll('_', '/'));
+    const out = new Uint8Array(binary.length);
+    for (let at = 0; at < binary.length; at += 1) out[at] = binary.charCodeAt(at);
+    return out;
+  })();
+  publics.set(secret, read);
+  return read;
 }
 
 export async function sha256(...parts: Uint8Array[]): Promise<Uint8Array> {
@@ -104,13 +169,17 @@ export async function sha256(...parts: Uint8Array[]): Promise<Uint8Array> {
 }
 
 export type Pair = { secret: Uint8Array; pk: Uint8Array };
+// Both halves are copies. The seed and the public key are kept behind the two
+// caches above, and a pair is handed to whoever asked for it: what she does
+// with the bytes in her hand is hers, and must not reach what the next caller
+// is given.
 export async function signingPair(seed: Uint8Array): Promise<Pair> {
   const secret = await secretKey(ED, ED_SECRET, seed, 'seed', ['sign']);
-  return { secret: Uint8Array.from(seed), pk: await rawPublic(secret) };
+  return { secret: Uint8Array.from(seed), pk: Uint8Array.from(await rawPublic(secret)) };
 }
 export async function sealingPair(seed: Uint8Array): Promise<Pair> {
   const secret = await secretKey(X, X_SECRET, seed, 'seed', ['deriveBits']);
-  return { secret: Uint8Array.from(seed), pk: await rawPublic(secret) };
+  return { secret: Uint8Array.from(seed), pk: Uint8Array.from(await rawPublic(secret)) };
 }
 
 export async function sign(message: Uint8Array, secret: Uint8Array): Promise<Uint8Array> {

package/src/ward/cells.ts

@@ -22,40 +22,82 @@ import type { Cells, Json } from '../being/types.ts';
 // reply from ending a walk in a stack overflow instead of a refusal.
 export const DEPTH = 64;
 
+// How many values one written out may come to. Depth alone does not bound
+// what a value costs to keep: one subvalue may sit under two keys, and
+// nesting that forty levels deep is inside the depth bound and is a trillion
+// values once written down. What is walked here is the object graph, which is
+// small; what a harbor keeps is the tree it expands to, which is not. So the
+// walk counts the tree while it proves the graph, and refuses a value nobody
+// could write down. This is a bound on what a being holds, so it is this
+// kit's number and no word of the spec.
+export const BREADTH = 1 << 20;
+
+// Text a harbor can write down: every surrogate in a pair. A lone one is a
+// code unit with no character, which JSON escapes and UTF-8 cannot encode at
+// all, so a harbor that keeps strings as bytes loses it and one that keeps
+// the object does not. I-JSON says a string is text, and this is that rule
+// where the value is written rather than where it is read.
+const WELL_FORMED = /^(?:[^\uD800-\uDFFF]|[\uD800-\uDBFF][\uDC00-\uDFFF])*$/;
+
 // I-JSON, all the way down. A number that JSON cannot write is not a number
 // a harbor can keep, a key on the prototype is not a key she wrote, and a
 // hole in a list, or a key named `__proto__`, is a thing JSON writes one way
 // and a runtime reads another.
-function fault(v: unknown, path: string, seen: Set<object>, depth: number): string | null {
-  if (v === null || typeof v === 'boolean' || typeof v === 'string') return null;
-  if (typeof v === 'number') return Number.isFinite(v) ? null : `${path} is ${String(v)}, which no harbor can write down`;
+//
+// A fault is a sentence; anything else is the count of values under this one,
+// itself included. A value already counted is a value already proven, so a
+// graph that shares is walked once per node rather than once per path.
+function walk(v: unknown, path: string, seen: Set<object>, sized: Map<object, number>, depth: number): string | number {
+  if (v === null || typeof v === 'boolean') return 1;
+  if (typeof v === 'string') return WELL_FORMED.test(v) ? 1 : `${path} carries a lone surrogate, which is no text a harbor can write down`;
+  if (typeof v === 'number') {
+    if (!Number.isFinite(v)) return `${path} is ${String(v)}, which no harbor can write down`;
+    // Minus zero is a number JSON writes as `0` and reads back as `0`. A
+    // harbor that keeps values would hand her the sign she wrote and one that
+    // writes JSON would not, and she is never told which she is standing in.
+    return Object.is(v, -0) ? `${path} is minus zero, which comes back as zero from every harbor that writes JSON` : 1;
+  }
   if (typeof v !== 'object') return `${path} is a ${typeof v}, which is not a value`;
   if (seen.has(v)) return `${path} refers back to itself`;
+  const counted = sized.get(v);
+  if (counted !== undefined) return counted;
   if (depth >= DEPTH) return `${path} is nested past ${DEPTH} levels, which no harbor can keep`;
   seen.add(v);
   try {
+    let size = 1;
+    const under = (where: string, x: unknown): string | null => {
+      const r = walk(x, where, seen, sized, depth + 1);
+      if (typeof r === 'string') return r;
+      size += r;
+      return size > BREADTH ? `${path} writes out to more than ${BREADTH} values, which no harbor can keep` : null;
+    };
     if (Array.isArray(v)) {
       for (let i = 0; i < v.length; i += 1) {
         if (!(i in v)) return `${path}[${i}] is a hole, which no harbor can write down`;
-        const f = fault(v[i], `${path}[${i}]`, seen, depth + 1);
+        const f = under(`${path}[${i}]`, v[i]);
         if (f) return f;
       }
-      return null;
+      sized.set(v, size);
+      return size;
     }
     const proto = Object.getPrototypeOf(v);
     if (proto !== Object.prototype && proto !== null) return `${path} is a ${(v).constructor?.name ?? 'object'}, which is not a value`;
     for (const k of Object.keys(v)) {
       if (k === '__proto__') return `${path}.__proto__ is a key no harbor can keep`;
-      const f = fault((v as Record<string, unknown>)[k], `${path}.${k}`, seen, depth + 1);
+      const f = under(`${path}.${k}`, (v as Record<string, unknown>)[k]);
       if (f) return f;
     }
-    return null;
+    sized.set(v, size);
+    return size;
   } finally {
     seen.delete(v);
   }
 }
 
-export const cellFault = (v: unknown, path: string): string | null => fault(v, path, new Set(), 0);
+export const cellFault = (v: unknown, path: string): string | null => {
+  const out = walk(v, path, new Set(), new Map(), 0);
+  return typeof out === 'string' ? out : null;
+};
 
 // The three keys at the root of her cells that are the ward's: it writes
 // them, she reads them, and a write of hers there is refused like a non-value.
@@ -69,6 +111,13 @@ const wrapped = new WeakMap<object, object>();
 const targets = new WeakMap<object, object>();
 const guards = new WeakSet();
 
+// A name no partition can hold, wherever it appears. It is here beside the
+// guard that refuses it, because the ward refuses it too: a relation named
+// this one would be written into the bind table and then throw on her cells,
+// which is half a relation and a throw where a null is promised. One rule,
+// one place, read by the guard and by the stance.
+export const unkeepable = (k: string): boolean => k === '__proto__';
+
 // A key a write may land on: a string that is not `__proto__`, and not one
 // of the ward's at the root. A symbol key is a thing JSON never writes.
 const refuse: (why: string) => never = (why) => {
@@ -76,7 +125,7 @@ const refuse: (why: string) => never = (why) => {
 };
 function keyFault(t: object, k: string | symbol, v: unknown, path: string, root: boolean): void {
   if (typeof k !== 'string') refuse(`${path} takes no symbol key`);
-  if (k === '__proto__') refuse(`${path}.__proto__ is a key no harbor can keep`);
+  if (unkeepable(k)) refuse(`${path}.__proto__ is a key no harbor can keep`);
   if (root && WARDS.has(k)) refuse(`${path}.${k} is the ward's to write`);
   // A list grows by one at its end, or it has holes JSON cannot write. A
   // push sets the slot at its length and then the length: both pass. A
@@ -138,4 +187,4 @@ function guard<T extends object>(target: T, path: string, wrote: () => void, roo
 export const guardCells = (cells: Cells, wrote: () => void = () => {}): Cells => guard(cells as unknown as Record<string, Json>, 'cells', wrote, true) as unknown as Cells;
 // The cells behind the guard, for the ward alone: the one writer of the
 // three keys that are its own.
-export const unguarded = (cells: Cells): Cells => (targets.get(cells as unknown as object) ?? cells) as Cells;
+export const unguarded = (cells: Cells): Cells => (targets.get(cells) ?? cells) as Cells;

package/src/ward/door.ts

@@ -22,10 +22,13 @@ export type Judged = { bytes: Uint8Array; heard: boolean };
 const SILENCE: ReplyPayload = { silence: true };
 const said = (quo: DoorWord): ReplyPayload => ({ quo });
 
-// One arrival at one being, already named. Catches every throw. `bound` says
-// whether the asker is a key this door holds: she hears `threw`; a stranger
-// at the public being hears silence, because her insides are hers.
-export async function arrive(door: Door, asker: Asker, method: string | undefined, args: JsonObject, bound: boolean): Promise<ReplyPayload> {
+// One arrival at one being, already named: the three choices, D11, D12 and
+// D13, and nothing else. Catches every throw. `bound` says whether the asker
+// is a key this door holds, or the ward's own owner: she hears `threw`; a
+// stranger at the public being hears silence, because her insides are hers.
+// Every caller that reaches a being's answer goes through here, the owner's
+// `ask` included, so the three choices are written once.
+export async function answered(door: Door, asker: Asker, method: string | undefined, args: JsonObject, bound: boolean): Promise<ReplyPayload> {
   const threw = bound ? said('threw') : SILENCE;
   let out: Awaited<ReturnType<BeingLike['answer']>>;
   try {
@@ -44,10 +47,18 @@ export async function arrive(door: Door, asker: Asker, method: string | undefine
   // said, or the door itself would fail to write her reply after the number
   // was spent. It is threw, like a word out of her.
   if (cellFault(out, 'answer') !== null) return threw;
-  if (method === undefined) return { object: out, seen: null };
-  // The digest rides along, it is not the answer. She has already answered:
-  // a describe that will not run costs the digest, and nothing else.
-  return { object: out, seen: await seen(door, asker) };
+  return { object: out, seen: null };
+}
+
+// What crosses the wire: her answer, with her digest for this asker beside
+// it. The digest rides along, it is not the answer. She has already
+// answered: a describe that will not run costs the digest, and nothing else.
+// The owner does not take one, because the owner asks for a describe when it
+// wants one and nothing is sealed on its behalf.
+export async function arrive(door: Door, asker: Asker, method: string | undefined, args: JsonObject, bound: boolean): Promise<ReplyPayload> {
+  const reply = await answered(door, asker, method, args, bound);
+  if (method === undefined || !('object' in reply)) return reply;
+  return { object: reply.object, seen: await seen(door, asker) };
 }
 
 // Her digest for this asker, or null when her describe threw or fell silent.
@@ -55,7 +66,14 @@ export async function arrive(door: Door, asker: Asker, method: string | undefine
 export async function seen(door: Door, asker: Asker): Promise<string | null> {
   try {
     const bp = await door.being.answer(asker);
-    return isSilence(bp) || isWord(bp) ? null : await digest(bp);
+    if (isSilence(bp) || isWord(bp)) return null;
+    // Held to the same rule as her answer, and for the same reason plus one:
+    // the digest is a walk, and a walk over a graph that shares or turns back
+    // on itself is not a digest but a hang or a throw. A blueprint that could
+    // not cross is a blueprint with no digest, which is what she has when her
+    // describe says nothing.
+    if (cellFault(bp, 'blueprint') !== null) return null;
+    return await digest(bp);
   } catch {
     return null;
   }

package/src/ward/ground.ts

@@ -1,8 +1,31 @@
 // SPDX-License-Identifier: Apache-2.0
-// The ground. The one object a harbor passes a ward at birth. Six things,
-// never a seventh. Everything a runtime differs on arrives here, which is
-// why the ward itself knows no runtime.
-import type { Stance, BeingLike, BeingClass } from '../being/types.ts';
+// The ground. The one object a harbor passes a ward at birth: seven things
+// the ward uses. Everything a runtime differs on arrives here, which is why
+// the ward itself knows no runtime.
+import type { Stance, BeingLike, BeingClass, Invitation } from '../being/types.ts';
+
+// What the device lends this ward's beings, by name. What a box can do is
+// beings, in a ward its harbor booted and roots, and this is how a being of
+// another ward comes to hold a standing at one: the harbor asks its own root
+// to invite on that being, and hands the invitation to the taker.
+//
+// The taker is the ward's half, and it is inside this call rather than after
+// it so that nothing half-lives. The harbor minted, so the harbor is the only
+// one who can unmint: a ward that could not knock, or could not take, says so
+// by answering false, and the root that minted removes the occupant it made.
+// A lend that failed leaves no heir open at that being and no relation bound
+// to a ward that does not hold it, which is the promise `boot` keeps with
+// `unmake` and the same promise here.
+//
+// False is every kind of no, and they are one answer because a being would do
+// nothing different for any of them: this harbor lends nothing, or nothing of
+// that name, or nothing of that name to this ward, or the ward did not take
+// what was minted.
+//
+// The invitation never reaches the being. It is the device's capability, and
+// a value she could copy is one she could hand to anyone, so it lives in this
+// call and nowhere else.
+export type Lend = (name: string, take: (invitation: Invitation) => Promise<boolean>) => Promise<boolean>;
 
 export type Ground = {
   seed: string | Uint8Array; // the ward derives its pk from it and nothing else
@@ -20,19 +43,24 @@ export type Ground = {
   // undefined is a promise, not a shrug: no door was reached, and nothing was
   // delivered. The ward hands it to a being as unreached, which is the one
   // answer that says asking again is safe, so a harbor may only return it
-  // when it knows the bytes never arrived — no reach for that pk, a socket
+  // when it knows the bytes never arrived: no reach for that pk, a socket
   // that would not open, a link that is down.
   //
   // A harbor that sent the bytes and then gave up waiting knows no such
   // thing: the far door may have heard and be working still. It must not
   // answer at all in that case. The ward bounds every ask itself, and an
-  // answer that never comes is silence, which promises nothing. So a harbor
-  // may hold a shorter patience than the ward's for its own reasons — a
-  // socket it wants back, a queue it will not grow — and the two bounds never
-  // need to read each other: whichever ends first ends the ask, and each says
-  // only what it can honestly say.
+  // answer that never comes inside that bound is `late`, which promises
+  // nothing either way. So a harbor may hold a shorter patience than the
+  // ward's for its own reasons, a socket it wants back or a queue it will
+  // not grow, and the two bounds never need to read each other: whichever
+  // ends first ends the ask, and each says only what it can honestly say.
   carry(pk: string, bytes: Uint8Array): Promise<Uint8Array | undefined>;
   random(n: number): Uint8Array; // entropy. every key a ward mints is drawn from it
+  // A standing at one of the harbor's own beings, by the name that harbor
+  // knows it under. Built per ward, so which ward may ask for which name is
+  // the harbor's own decision and a stranger's ward is lent nothing. A harbor
+  // with nothing to lend leaves it out, and every name answers false.
+  lend?: Lend;
 };
 
 // What a ward hands back. Two pointers. The door answers bytes, always, and
@@ -46,7 +74,7 @@ export type WardPointers = {
 };
 
 // ---- what every harbor builds a ground out of. Three pieces, because every
-// harbor in this tree writes the same three and the spec keeps the harbors
+// harbor in this tree writes the same three and the protocol keeps the harbors
 // themselves apart: what a memory harbor and a real one differ on is the
 // route and the store, and nothing here. A second kit writes its own harbor
 // and may write these again; they are convenience, never contract.

package/src/ward/heirs.ts

@@ -103,6 +103,12 @@ export class Heirs {
       return;
     }
     if (by === h.announced) h.current = by;
-    h.announced = next;
+    // A send that announced nothing leaves the spare standing. This kit
+    // announces on every send but a public one, which holds no heir and
+    // reaches none of this; a kit that skips one is a kit whose own next is
+    // still the key it announced last time, and forgetting it here would meet
+    // that key with silence and kill a healthy relation. Nothing is dropped
+    // that was vouched for until something replaces it.
+    if (next !== null) h.announced = next;
   }
 }

package/src/ward/index.ts

@@ -1,11 +1,11 @@
 // SPDX-License-Identifier: Apache-2.0
 // @quo-systems/quo/ward — one function. Every ward is the same ward.
 export { Ward } from './ward.ts';
-export type { Ground, WardPointers } from './ground.ts';
+export type { Ground, WardPointers, Lend } from './ground.ts';
 export type { Partition, Heir, Bind, StandingKeys } from './partition.ts';
-// The two bounds on what a partition may hold, for a kit that must keep the
-// same ones and for a test that pins them.
-export { GONE, MINTED } from './partition.ts';
+// The three bounds on what a partition may hold, for a kit that must keep
+// the same ones and for a test that pins them.
+export { GONE, MINTED, KNOCKS } from './partition.ts';
 export type { AskPayload, ReplyPayload } from './seal.ts';
 // The seal and the arithmetic, for a kit in another language to check its
 // bytes against, and for tests that speak to a door directly.

package/src/ward/owner.ts

@@ -3,17 +3,17 @@
 // is an occupant of the ward itself, invited by the root. The ward is a
 // being to her owner: the empty ask is her describe, and it carries her asks
 // with a description and an input each, so a side renders them as it
-// renders any being's. Six asks: boot, public, invite, knock, remove and
-// unboot, which is boot's inverse and takes her relations with her. The
-// knock is a being's knock made for her, and the standing is written into
-// her cells under the id the owner gave; remove takes a relation out of her
-// by id, the mirror of it.
+// renders any being's. Seven asks: boot, public, invite, knock, remove and
+// unboot, which is boot's inverse and takes her relations with her, and ask,
+// which reaches into a being and asks her. The knock is a being's knock made
+// for her, and the standing is written into her cells under the id the owner
+// gave; remove takes a relation out of her by id, the mirror of it.
 import { isSilence, isWord, wordOf } from '../being/silence.ts';
 import { OWNER } from '../being/types.ts';
 import type { Ask, Asker, Invitation, Json, JsonObject, Wanted } from '../being/types.ts';
 import { put } from './partition.ts';
-import { seen } from './door.ts';
-import { within, DEFAULT, LATE } from './allowance.ts';
+import { seen, answered } from './door.ts';
+import { within, allow, DEFAULT, LATE } from './allowance.ts';
 import type { Resident } from './ward.ts';
 
 export type OwnerSide = {
@@ -39,6 +39,11 @@ export const OWNER_ASKS: Ask[] = [
   },
   { name: 'remove', description: 'take a relation out of a being of the ward by id, occupant or standing; on the ward pk it unseats an owner, and only the root may', input: { type: 'object', properties: { being: str, id: str }, required: ['being', 'id'] } },
   { name: 'unboot', description: 'take a being out of the ward, with every relation she holds; her occupants hear removed, and the ward itself is refused', input: { type: 'object', properties: { being: str }, required: ['being'] } },
+  {
+    name: 'ask',
+    description: 'ask a being of the ward, as the owner; with no being it is the public being asked as nobody, which is what a stranger would hear',
+    input: { type: 'object', properties: { being: str, method: str, args: { type: 'object' }, wanted: { type: 'object', properties: { time: { type: 'number' } } } } },
+  },
 ];
 
 export async function ownerAnswer(w: OwnerSide, asker: Asker, method: string | undefined, args: JsonObject): Promise<Json> {
@@ -92,7 +97,7 @@ export async function ownerAnswer(w: OwnerSide, asker: Asker, method: string | u
     const notes = args.notes;
     const door = w.doors.get(being);
     if (!door) return { error: 'no such being' };
-    return await door.stance.occupants.invite(id, notes !== null && typeof notes === 'object' && !Array.isArray(notes) ? (notes as JsonObject) : undefined);
+    return await door.stance.occupants.invite(id, notes !== null && typeof notes === 'object' && !Array.isArray(notes) ? (notes) : undefined);
   }
   if (method === 'knock') {
     const b = args.being as string | { boot: unknown; key: unknown };
@@ -121,7 +126,7 @@ export async function ownerAnswer(w: OwnerSide, asker: Asker, method: string | u
     const out = await door.stance.standings.knock(inv, args.method as string | undefined, (args.args as JsonObject) ?? {}, args.wanted as Wanted | undefined);
     if (isSilence(out)) return { error: 'silence' };
     if (isWord(out)) return { error: wordOf(out) }; // the owner hears objects: the word is the error's name
-    return { taken: await door.stance.standings.take(id, inv), answer: out as Json };
+    return { taken: await door.stance.standings.take(id, inv), answer: out };
   }
   if (method === 'remove') {
     // The mirror of knock: a relation out of a being, by id, occupant or
@@ -152,6 +157,36 @@ export async function ownerAnswer(w: OwnerSide, asker: Asker, method: string | u
     const removed = w.unboot(being);
     return removed === null ? { error: 'no such being' } : { unbooted: being, removed };
   }
+  if (method === 'ask') {
+    // The owner's other power: to reach into a being and ask her. It is
+    // strictly less than unboot, which takes her out with every relation she
+    // holds, and it is the third asker of the ward-to-being edge finally
+    // filled in by the ward rather than minted by whoever holds the pointer.
+    // Bounded, judged and named here, so no side outside the ward ever holds
+    // a being's answer and writes the door's discipline again beside it.
+    const being = args.being === undefined ? null : named(args.being);
+    if (args.being !== undefined && being === null) return { error: 'no such being' };
+    // A method is a name or it is the empty ask. Coerced instead of checked,
+    // a shape passed where a name belongs becomes a string she never declared,
+    // and she would answer `unknown ask` to something nobody asked.
+    if (args.method !== undefined && typeof args.method !== 'string') return { error: 'an ask is named by a word' };
+    // No being named is the in-process twin of bytes for nobody: the public
+    // being, asked as nobody, unbound, so a throw of hers is silence. Her
+    // insides are not a stranger's to read, and a device serving her to
+    // strangers must hear what a stranger hears and not one word more.
+    const key = being ?? w.publicKey();
+    const door = key === null ? undefined : w.doors.get(key);
+    if (!door || door.key === w.pk) return { error: 'no such being' };
+    const bound = being !== null;
+    // The owner is a caller like any other: wanted says what this ask may
+    // spend, and saying nothing is the ward's default. A wait that ran out is
+    // late, the same word a being would hear, said as the object an owner hears.
+    const out = await within(allow(args.wanted as Wanted | undefined).time, answered(door, bound ? { id: OWNER } : {}, args.method, (args.args as JsonObject) ?? {}, bound));
+    if (out === LATE) return { error: 'late' };
+    if ('quo' in out) return { error: out.quo };
+    if (!('object' in out)) return { error: 'silence' };
+    return out.object;
+  }
   return { error: 'unknown ask' };
 }
 
@@ -166,7 +201,7 @@ async function describe(w: OwnerSide): Promise<Json> {
   // answers its owner: the harbor learns the pk by this very ask at boot, so
   // an unbounded wait here is a ward no restart can bring back.
   const asked = [...w.doors].filter(([key]) => key !== w.pk);
-  const digests = await Promise.all(asked.map(async ([, door]) => (await within(DEFAULT.time, seen(door, { id: OWNER }))) as string | null | typeof LATE));
+  const digests = await Promise.all(asked.map(async ([, door]) => (await within(DEFAULT.time, seen(door, { id: OWNER })))));
   for (const [i, [key, door]] of asked.entries()) {
     const d = digests[i];
     put(beings, key, { class: door.cells.class ?? null, public: w.publicKey() === key, digest: d === LATE ? null : d });

package/src/ward/seal.ts

@@ -37,6 +37,15 @@ export type WardKey = { sign: Uint8Array; padlock: Uint8Array; signPk: Uint8Arra
 const WARD_SIGN = new TextEncoder().encode('quo-ward-sign');
 const WARD_SEAL = new TextEncoder().encode('quo-ward-seal');
 
+// The one size in Quo: one mebibyte of bytes each way. It is read before
+// anything is opened, so bytes above it are never decrypted, never parsed and
+// never allocated against. Refusing them is bytes that said nothing, which is
+// already silence, so there is no tenth word and no new door case. Breadth
+// costs bytes, so this one number bounds every other breadth on the wire, and
+// what a being holds is not the protocol's business. An ask is a message and
+// not a file; what is larger is asked for in pieces.
+export const SIZE = 1024 * 1024;
+
 // The ward's key from its seed. Its pk on the wire is the signing pk then the padlock, 128 hex.
 //
 // One seed, two curves, and each secret derived from it under its own label.
@@ -45,7 +54,7 @@ const WARD_SEAL = new TextEncoder().encode('quo-ward-seal');
 // designs and no separation at all: one secret would be doing two jobs with
 // nothing said about it, and a second kit would have to reproduce a
 // construction nobody named. HKDF-SHA-256 under a label is the separation
-// said out loud, and it is what `vectors/framing.json` pins.
+// said out loud, and it is what `protocol/vectors/framing.json` pins.
 //
 // Bytes are key material and text is not. A seed handed in as bytes of the
 // key length is taken as it stands, which is what a harbor mints; anything
@@ -101,7 +110,7 @@ export async function sealAsk(to: string | null, payload: AskPayload, signer: Ui
 // Verification is the door's own step, because only the door knows which key may speak.
 export async function openAsk(bytes: Uint8Array, padlockSecret: Uint8Array): Promise<{ to: string | null; payload: AskPayload; body: Uint8Array; signature: Uint8Array; ephemeralPk: Uint8Array } | null> {
   try {
-    if (!(bytes instanceof Uint8Array) || bytes.length < 1) return null;
+    if (!(bytes instanceof Uint8Array) || bytes.length < 1 || bytes.length > SIZE) return null;
     const inside = await unbox(bytes, padlockSecret);
     if (inside.length <= SIGNATURE) return null;
     const body = inside.subarray(0, inside.length - SIGNATURE);
@@ -146,7 +155,7 @@ export async function sealReply(reply: ReplyPayload, ephemeralPk: Uint8Array, wa
 // throw or an absent value for what a stranger wrote.
 export async function openReply(bytes: unknown, ephemeralSecret: Uint8Array, signPk: Uint8Array): Promise<ReplyPayload | null> {
   try {
-    if (!(bytes instanceof Uint8Array)) return null;
+    if (!(bytes instanceof Uint8Array) || bytes.length > SIZE) return null;
     const inside = await unbox(bytes, ephemeralSecret);
     if (inside.length <= SIGNATURE) return null;
     const body = inside.subarray(0, inside.length - SIGNATURE);