@quo-systems/quo 0.2.15 → 0.2.17

package/GETTING_STARTED.md

@@ -0,0 +1,128 @@
+# Getting started
+
+Quo lets an object ask another object and get an answer, without knowing
+whether that other object is in the same process, on the same device, or
+on another planet. Three words: a harbor boots wards, a ward keeps beings
+and judges its door, and a being is one ordinary object with one voice.
+This is the shortest road from nothing to each of the three, for a
+stranger with a terminal. `SPEC.md` is the truth behind every sentence
+here and assumes nothing; `quo-dock.md` is the dock, the part a box runs.
+
+Two packages, and you start with the one that fits what you have:
+
+- `@quo-systems/quo`, the library. A harbor, a ward and a being in one
+  process, no wire, no files. For a program that wants Quo inside it.
+- `@quo-systems/dock`, the dock. A daemon and one command, `quo`, that
+  stand a box up: a person's world with a page, a model's side, an api, a
+  door on the wire. For a box that receives people and models.
+
+## A being, in one process
+
+```bash
+npm install @quo-systems/quo
+```
+
+A being is a class with `asks`, the methods anyone may reach, each with
+the JSON schema of its input. Everything else on the class is hers alone.
+
+```js
+import { Being } from '@quo-systems/quo';
+import { Ward } from '@quo-systems/quo/ward';
+import { MemoryHarbor } from '@quo-systems/quo/harbor';
+
+class Shop extends Being {
+  static asks = { price: { input: { type: 'object', properties: { item: { type: 'string' } } } } };
+  price({ item }) {
+    return { item, eur: 12 };
+  }
+}
+class Customer extends Being {
+  static asks = {};
+}
+
+const harbor = new MemoryHarbor();
+const ward = await harbor.boot('acme', Ward, { Shop, Customer });
+await ward.ask('boot', { key: 'shop', class: 'Shop' });
+await ward.ask('boot', { key: 'ana', class: 'Customer' });
+```
+
+The harbor booted a ward named `acme` with two classes it may make beings
+of, and the ward's owner, the process itself, booted one of each by key.
+The ward's own asks are seven, `boot`, `public`, `invite`, `knock`,
+`remove`, `unboot` and `ask`, and `ward.ask()` with no method is her
+describe: those asks and her `notes`, the ward's `pk` and her beings.
+
+Nobody reaches a being she has not invited. An invitation is minted on a
+being for one id, the shop's for `ana`, and the customer knocks with it;
+from then she holds a standing at the shop, under the name she took, and
+the shop holds her as an occupant.
+
+```js
+const invitation = await ward.ask('invite', { being: 'shop', id: 'ana' });
+const ana = harbor.objects.get(harbor.partitions.get('acme').beings.ana);
+await ana.knock(invitation);
+await ana.take('shop', invitation);
+console.log(await ana.standings.shop.ask('price', { item: 'bread' }));
+// { item: 'bread', eur: 12 }
+```
+
+That is the whole protocol: a standing on one side, an occupant on the
+other, an ask that rides the relation and an answer that rides it back.
+The two beings here share a process; the same lines hold when the shop is
+on a box across the sea, because a standing is an address and a key, and
+the harbor owns the wire. `harbor.objects` is the memory harbor's hand for
+a test and a first program; a being on a real box is reached through her
+ward, never held.
+
+## A box
+
+```bash
+npm install @quo-systems/dock
+npx quo init --dir ~/.quo --ward acme --user razvan --domain acme.com --default --show
+npx quo serve --dir ~/.quo --http 8787
+```
+
+`init` mints the ward `acme`, boots razvan's user being, her doorbell and
+the desk in it, marks it the default ward and shows it at the web route,
+and writes `routes.json`, the four routes of a box, `mcp.`, `web.`, `quo.`
+and `api.` under the domain, for a proxy to map onto the one loopback
+port. Without `--domain`, write it yourself; on a Mac the four are paths
+at one loopback address:
+
+```json
+{ "mcp": "http://127.0.0.1:8787/mcp", "web": "http://127.0.0.1:8787/web", "quo": "http://127.0.0.1:8787/quo", "api": "http://127.0.0.1:8787/api" }
+```
+
+`serve` is the daemon, the one process over that folder, and every other
+command is its client. From a second terminal, a phone:
+
+```bash
+npx quo invite --dir ~/.quo '{"being":"razvan","id":"phone"}'
+```
+
+The answer carries `link`, the ward's page with the invitation in its
+fragment. Opened on the phone, the tab boots a harbor of its own, joins as
+that device, and is in: no account, nothing typed. What a model gets is
+the same world as tools at `mcp.`, what a program gets is the same asks as
+JSON at `api.`, and what another box gets is the door at `quo.`; a being
+answers each the same, because each is an ask at her door.
+
+The box's own doings are rows on the faculties of its dock ward, placed by
+the root with `quo ask --ward dock`: a socket held to another box, an
+agent run for a ward, a schedule on the clock. A second box owns this one
+across the wire with an invitation on the ward's own pk, knocked with
+from there, and every owner command with `--via` from then on. Each of
+those, the edge, and what an estate stands beyond the init, is the
+"Getting started" chapter of `quo-dock.md`, proven cold on a Mac by
+somebody with nothing else to read.
+
+## Your own beings on a box
+
+A box holds the dock's classes and yours. `classes/index.ts` beside the
+wards exports each of yours by name, and `quo boot '{"key":"shop",
+"class":"Shop"}'` boots one; `quo init --class Shop` makes the ward's home
+being one of yours, an organisation's ward with the org as its being. A
+being's asks may name who may reach them, `for`, over the record of the
+occupant asking, and her `cells` are what she keeps between boots: the
+whole of what a being is, in `SPEC.md`, and the words above the spec, a
+world, a home, a membership, in `WORLDS.md` and `GLOSSARY.md`.

package/README.md

@@ -28,18 +28,19 @@ no dependencies. The package ships JavaScript with declarations, emitted by
 types nowhere under `node_modules`.
 
 ```
+protocol/         the shelf a kit in any language reads: SPEC.md and the vectors, no code
+protocol/vectors/ fixed inputs and outputs, so another language proves its bytes
 src/being/        the Being side: what a being author imports, if anything
 src/ward/         the ward: the Ground contract, door, seal, arithmetic, heirs, stance, allowance
 src/harbor/       MemoryHarbor, and the harbor core with its store, reach and dialer
 src/conformance/  behaviours any ward must show, written against the truth
 test/             the suites
-vectors/          fixed inputs and outputs, so another language proves its bytes
 ```
 
 ## Requirements
 
-Node 22.18 or later for `npm run check`. The terrain gate,
-`npm run check:terrain`, runs the same conformance suite out of a bundle in a
+Node 22.18 or later for `npm run check`. The deep gate,
+`npm run deep:quo`, runs the same conformance suite out of a bundle in a
 real Chromium, in workerd, in Deno and in Bun. All four binaries come with
 `npm install`, except the browser itself: run `npx playwright install
 chromium` once. A terrain whose binary is missing skips and says so.
@@ -53,12 +54,13 @@ and runs from there:
 npm run check
 ```
 
-Build, typecheck, lint, then the suites of every package. The pieces run
-alone there too: `npm run typecheck`, `npm run lint` (`lint:ts` is oxlint
-with type-aware rules, `lint:md` is markdownlint), `npm run lint:fix`, and
-`npm test`. Inside this package three scripts exist and no more: `npm test`
-runs the suites under `test/`, `npm run build` emits `dist/`, and
-`npm run check:terrain` runs the terrains.
+Build, typecheck, lint, then one `check:<layer>` for every layer of that
+repository. The pieces run alone there too: `npm run typecheck`,
+`npm run lint` (`lint:ts` is oxlint with type-aware rules, `lint:md` is
+markdownlint), `npm run lint:fix`, and `npm run check:quo`, which is this
+package. Inside this package three scripts exist and no more:
+`npm run check` runs the suites under `test/`, `npm run build` emits
+`dist/`, and `npm run deep` runs the terrains.
 
 The toolchain is TypeScript 7, the native compiler, and oxlint, which is the
 linter built for it. Both are in Rust or Go rather than JavaScript, so the
@@ -77,28 +79,38 @@ import { conform } from '@quo-systems/quo/conformance';
 
 ## Another language
 
-The hand to a kit in another language is two things of two kinds. The
-vectors are the byte-level hand, everything a stranger can observe:
-`vectors/arithmetic.json`, the primitives the seal rests on, SHA-256,
-Ed25519, X25519, HKDF and AES-256-GCM; `vectors/framing.json`, Quo's own,
-the ward pk, the digest, the signed ask body, the sealed shapes, the
-invitation and the knock; `vectors/wire.json`, the frames on a socket and
-the one request a door takes. They import by name,
-`@quo-systems/quo/vectors/framing.json`, so a kit's own suite can read them
-from the package. A kit reproduces them or it is not this
-protocol. `src/conformance/` is the behavioural hand, and it is a checklist
-a kit ports, not a harness it runs: the beings it is shown with run only in
-a TypeScript ward. `quo-kit.md` "The tree" says the whole of it.
+The hand to a kit in another language is one folder, `protocol/`, and it
+holds two things of two kinds. `SPEC.md` is the protocol, and it assumes
+nothing: a kit is written against it and against nothing else here. The
+vectors beside it are the byte-level hand, everything a stranger can
+observe: `protocol/vectors/arithmetic.json`, the primitives the seal rests
+on, SHA-256, Ed25519, X25519, HKDF and AES-256-GCM;
+`protocol/vectors/framing.json`, Quo's own, the ward pk, the digest, the
+signed ask body, the sealed shapes, the invitation and the knock;
+`protocol/vectors/wire.json`, the frames on a socket and the one request a
+door takes; and `protocol/vectors/door.json`, the door's thirteen cases,
+each one an arrival a ward will not answer, with the bytes that arrive, the
+bytes that leave and the partition's digest on both sides of the judgement.
+They import by name,
+`@quo-systems/quo/protocol/vectors/framing.json`, so a kit's own suite can
+read them from the package. A kit reproduces them or it is not this
+protocol.
+
+Nothing outside that folder is the protocol. `src/` is this kit's
+interpretation, and `src/conformance/` is a checklist a kit ports rather
+than a harness it runs: it imports the base class, the silence spelling and
+this kit's store and reach, so the beings it is shown with run only in a
+TypeScript ward. `quo-kit.md` "The three shelves" says which is which.
 
 ## Publishing
 
 Published from 0.1.0, the first version under this name, with no
 compatibility promise before 1.0.0: the words may still move. `npm pack
---dry-run` shows what ships: the emitted `dist/`, the source, the vectors,
-the spec, this file, the licence and the notice, and no tests and no
-configs. The spec ships because it is the truth the source and the vectors
-are read against. Publishing is gated from the root of the repository:
-`npm run release:quo` there runs both gates, `check` and `check:terrain`,
+--dry-run` shows what ships: the emitted `dist/`, the source, the protocol
+shelf with the spec inside it, this file, the licence and the notice, and no
+tests and no configs. The spec ships because it is the truth the source and
+the vectors are read against. Publishing is gated from the root of the repository:
+`npm run release:quo` there runs both gates, `check` and `deep`,
 and publishes on green; `npm publish` inside this package refuses and says
 so. This package carries the version of its own work and is bound to no
 other's: a number equal to another package's is a coincidence.

package/dist/conformance/store.js

@@ -6,7 +6,15 @@
 // what it put and expects it back, as the harbor will.
 import { assert } from './assert.js';
 const seed = (b) => new Uint8Array(32).fill(b);
-const kept = (b, extra = {}) => ({ seed: seed(b), partition: { beings: {}, ...extra }, record: { pk: '', code: 'classes/index.ts', user: 'me' } });
+const kept = (b, extra = {}) => ({ seed: seed(b), partition: { beings: {}, bind: {}, ...extra }, record: { pk: '', code: 'classes/index.ts', user: 'me' } });
+// A partition as a ward writes one: beings under their keys, a bind table
+// beside each, and whatever else the head carries.
+const ward = (beings, extra = {}) => ({
+    beings,
+    bind: Object.fromEntries(Object.keys(beings).map((k) => [k, { standings: {} }])),
+    ...extra,
+});
+const ALL = (p) => ['', ...Object.keys(p.beings)];
 export function conformStore(label, make, { test }) {
     const t = (name, fn) => test(`[${label}] ${name}`, {}, fn);
     t('a fresh store keeps nothing', async () => {
@@ -23,7 +31,7 @@ export function conformStore(label, make, { test }) {
         const back = await s.load('main');
         assert.ok(back);
         assert.deepEqual(back.seed, seed(7));
-        assert.deepEqual(back.partition, { beings: {}, n: 1, deep: { list: [1, 'two', null], flag: true } });
+        assert.deepEqual(back.partition, { beings: {}, bind: {}, n: 1, deep: { list: [1, 'two', null], flag: true } });
         assert.deepEqual(back.record, { pk: '', code: 'classes/index.ts', user: 'me' });
     });
     t('a name already kept is refused, and what was kept stands', async () => {
@@ -39,26 +47,44 @@ export function conformStore(label, make, { test }) {
         assert.ok(refused, 'a second put under one name must throw');
         assert.deepEqual((await s.load('main')).seed, seed(1));
     });
-    t('save replaces the partition and touches nothing else', async () => {
+    t('save writes every row it is given, and touches nothing else', async () => {
         const s = await make();
         await s.put('main', kept(3));
-        await s.save('main', { beings: { a: { x: 1 } }, bind: {} });
+        const p = ward({ a: { x: 1 } });
+        await s.save('main', p, ALL(p));
         const back = (await s.load('main'));
-        assert.deepEqual(back.partition, { beings: { a: { x: 1 } }, bind: {} });
+        assert.deepEqual(back.partition, p);
         assert.deepEqual(back.seed, seed(3));
         assert.deepEqual(back.record, kept(3).record);
     });
+    // What a store may do with the rows it is told about is its own: writing
+    // the whole partition every time is correct. What it may never do is write
+    // less than it was told, or keep a being the rows say is gone.
+    t('save writes the rows it names, and a being the rows drop is gone', async () => {
+        const s = await make();
+        const p = ward({ a: { x: 1 }, b: { y: 1 } });
+        await s.put('main', { ...kept(3), partition: p });
+        // one being moves, and only her row is named
+        p.beings.a.x = 2;
+        await s.save('main', p, ['a']);
+        assert.deepEqual((await s.load('main')).partition, p, 'the row that was named is written');
+        // she leaves: her row is named and her key is gone from the partition
+        delete p.beings.a;
+        delete p.bind.a;
+        await s.save('main', p, ['a']);
+        assert.deepEqual((await s.load('main')).partition, p, 'a row whose being is gone is dropped');
+    });
     t('record replaces the record and touches nothing else', async () => {
         const s = await make();
         await s.put('main', kept(4, { n: 9 }));
         await s.record('main', { pk: 'ab'.repeat(64), code: 'elsewhere.ts', user: 'her' });
         const back = (await s.load('main'));
         assert.deepEqual(back.record, { pk: 'ab'.repeat(64), code: 'elsewhere.ts', user: 'her' });
-        assert.deepEqual(back.partition, { beings: {}, n: 9 });
+        assert.deepEqual(back.partition, { beings: {}, bind: {}, n: 9 });
     });
     t('save and record on a name not kept are nothing', async () => {
         const s = await make();
-        await s.save('ghost', { beings: {} });
+        await s.save('ghost', { beings: {}, bind: {} }, ['']);
         await s.record('ghost', { pk: '', code: '', user: '' });
         assert.deepEqual(await s.list(), []);
     });
@@ -67,10 +93,10 @@ export function conformStore(label, make, { test }) {
         const k = kept(5, { n: 1 });
         await s.put('main', k);
         k.partition.n = 2;
-        assert.deepEqual((await s.load('main')).partition, { beings: {}, n: 1 });
+        assert.deepEqual((await s.load('main')).partition, { beings: {}, bind: {}, n: 1 });
         const a = (await s.load('main'));
         a.partition.n = 3;
-        assert.deepEqual((await s.load('main')).partition, { beings: {}, n: 1 });
+        assert.deepEqual((await s.load('main')).partition, { beings: {}, bind: {}, n: 1 });
     });
     t('take hands the ward out and forgets it; the name is free again', async () => {
         const s = await make();
@@ -79,7 +105,7 @@ export function conformStore(label, make, { test }) {
         const out = await s.take('main');
         assert.ok(out);
         assert.deepEqual(out.seed, seed(6));
-        assert.deepEqual(out.partition, { beings: {}, n: 6 });
+        assert.deepEqual(out.partition, { beings: {}, bind: {}, n: 6 });
         assert.equal(await s.load('main'), undefined);
         assert.deepEqual(await s.list(), ['other']);
         await s.put('main', kept(9));

package/dist/harbor/core.js

@@ -119,13 +119,13 @@ export class Harbor {
         return this.#saving.get(name)?.memory;
     }
     // ---- saving
-    // The ward wrote. Its partition is saved once the line is free, and once
-    // for every burst of writes, in the order the writes came.
-    #wrote(name) {
+    // The ward wrote one row. Its partition is saved once the line is free, and
+    // once for every burst of writes, with every row named in that burst.
+    #wrote(name, row) {
         const s = this.#saving.get(name);
         if (!s || s.gone)
             return;
-        s.dirty = true;
+        s.dirty.add(row);
         if (s.timer === undefined)
             s.timer = setTimeout(() => void this.#flush(name), 0);
     }
@@ -140,10 +140,13 @@ export class Harbor {
         if (s.running)
             return s.running;
         s.running = (async () => {
-            while (s.dirty && !s.gone) {
-                s.dirty = false;
+            while (s.dirty.size > 0 && !s.gone) {
+                // Taken before the write, so a row named while this one is in flight
+                // is written by the next turn of the loop and not lost with it.
+                const rows = [...s.dirty];
+                s.dirty.clear();
                 try {
-                    await this.store.save(name, s.memory);
+                    await this.store.save(name, s.memory, rows);
                 }
                 catch {
                     this.faults.set(name, (this.faults.get(name) ?? 0) + 1);
@@ -332,12 +335,12 @@ export class Harbor {
             instantiate: maker(objects, classes, this.classes),
             carry: (pk, bytes) => this.carry(pk, new Uint8Array(bytes)),
             random,
-            wrote: () => this.#wrote(name),
+            wrote: (row) => this.#wrote(name, row),
         };
         const lend = this.lendFor(name, kept.record);
         if (lend)
             ground.lend = lend;
-        const saving = { memory, dirty: false, running: null, timer: undefined, gone: false };
+        const saving = { memory, dirty: new Set(), running: null, timer: undefined, gone: false };
         this.#saving.set(name, saving);
         // A ward that will not be born leaves nothing behind: a partition of a
         // shape this kit cannot read throws here, and a name the harbor does not

package/dist/harbor/index.d.ts

@@ -1,7 +1,8 @@
 export { MemoryHarbor, type Booted, type WardFactory } from './memory.ts';
 export { Harbor, DEFAULT_CODE, type Hosted, type Bound, type Loader } from './core.ts';
 export { dial, type Dialer } from './dial.ts';
-export { MemoryStore, values, type Store, type Kept, type WardRecord } from './store.ts';
+export { MemoryStore, values, rowsOf, type Store, type Kept, type WardRecord } from './store.ts';
+export { HEAD, fromRows, rowsIn } from '../ward/partition.ts';
 export { request, Socket, SUITE, REFUSED, type Reach, type Carry, type Line, type Announce } from './reach.ts';
 export type { Ground, WardPointers, Lend } from '../ward/ground.ts';
 export { maker, entropy, learnPk } from '../ward/ground.ts';

package/dist/harbor/index.js

@@ -6,7 +6,10 @@
 export { MemoryHarbor } from './memory.js';
 export { Harbor, DEFAULT_CODE } from './core.js';
 export { dial } from './dial.js';
-export { MemoryStore, values } from './store.js';
+export { MemoryStore, values, rowsOf } from './store.js';
+// What a store keeping a ward in rows needs: the name of the row that is not
+// a being, and the partition back from the rows it was cut into.
+export { HEAD, fromRows, rowsIn } from '../ward/partition.js';
 export { request, Socket, SUITE, REFUSED } from './reach.js';
 // What a harbor builds a ground out of. Convenience, never contract: a kit
 // writing its own harbor may write these three again.

package/dist/harbor/memory.d.ts

@@ -17,6 +17,7 @@ export declare class MemoryHarbor {
     readonly partitions: Map<string, Record<string, unknown>>;
     readonly wards: Map<string, Booted>;
     readonly objects: WeakMap<object, BeingLike>;
+    random: Ground['random'];
     route(farPk: string, bytes: Uint8Array): Promise<Uint8Array | undefined>;
     link(harbor: MemoryHarbor): void;
     boot(seed: string, Ward: WardFactory, classes: Record<string, BeingClass>, lend?: Lend): Promise<Booted>;

package/dist/harbor/memory.js

@@ -10,6 +10,12 @@ export class MemoryHarbor {
     partitions = new Map(); // seed -> memory. the harbor keeps it and reads nothing
     wards = new Map(); // seed -> pointers
     objects = new WeakMap(); // cells -> being object. what instantiate constructed. a hand for tests, never the ward's; it follows the cells out when she is unbooted
+    // Where the wards this harbor boots draw their entropy. The device's own
+    // by default. A harbor may hand a fixed stream instead, which is what pins
+    // bytes: every key a ward mints and every nonce it seals under comes from
+    // here, so a ward on a known seed with a known stream answers the same
+    // bytes every run, and a corpus of them is a corpus and not a sample.
+    random = entropy;
     // the directory: its own doors, else a peer it is linked to. Quo says nothing about how.
     async route(farPk, bytes) {
         if (this.down.has(farPk))
@@ -55,7 +61,7 @@ export class MemoryHarbor {
                 const back = await this.route(farPk, new Uint8Array(bytes));
                 return back === undefined ? undefined : new Uint8Array(back);
             },
-            random: entropy,
+            random: (n) => this.random(n),
         };
         const w = await Ward(ground);
         const booted = { ...w, pk: await learnPk(w) };

package/dist/harbor/store.d.ts

@@ -12,22 +12,29 @@ export type Store = {
     list(): Promise<string[]>;
     load(name: string): Promise<Kept | undefined>;
     put(name: string, kept: Kept): Promise<void>;
-    save(name: string, partition: Record<string, unknown>): Promise<void>;
+    save(name: string, partition: Record<string, unknown>, rows: readonly string[]): Promise<void>;
     record(name: string, record: WardRecord): Promise<void>;
     take(name: string): Promise<Kept | undefined>;
     hints(): Promise<Record<string, string>>;
     hint(pk: string, url: string): Promise<void>;
 };
 export declare const values: (p: Record<string, unknown>) => Record<string, unknown>;
+export declare const rowsOf: (partition: Record<string, unknown>, rows: readonly string[]) => [string, Record<string, unknown> | undefined][];
+type Row = {
+    seed: Uint8Array;
+    parts: Map<string, Record<string, unknown>>;
+    record: WardRecord;
+};
 export declare class MemoryStore implements Store {
-    readonly rows: Map<string, Kept>;
+    readonly rows: Map<string, Row>;
     readonly reach: Map<string, string>;
     list(): Promise<string[]>;
     load(name: string): Promise<Kept | undefined>;
     put(name: string, kept: Kept): Promise<void>;
-    save(name: string, partition: Record<string, unknown>): Promise<void>;
+    save(name: string, partition: Record<string, unknown>, rows: readonly string[]): Promise<void>;
     record(name: string, record: WardRecord): Promise<void>;
     take(name: string): Promise<Kept | undefined>;
     hints(): Promise<Record<string, string>>;
     hint(pk: string, url: string): Promise<void>;
 }
+export {};

package/dist/harbor/store.js

@@ -1,7 +1,34 @@
+// SPDX-License-Identifier: Apache-2.0
+// The store: keeping wards by name. A ward is three things and the store
+// keeps all three under one name: the seed, the partition and the ward
+// record, which says where the class bodies come from and which being is
+// the user's. Plus the directory's hints, which are the harbor's and
+// survive a restart. The store reads nothing it keeps; the partition is
+// values the ward wrote, and the seed is bytes only the ward derives from.
+// Every terrain has one: files on a disk, IndexedDB in a tab, an object's
+// storage on the edge; the memory store below is the library's own, for a
+// harbor core with no device under it. `src/conformance/store.ts` is what
+// every one of them passes.
+import { fromRows, rowOf, rowsIn } from '../ward/partition.js';
 // The partition is values only, and the ward hands it out through a guard,
 // so a store takes a copy of the values the way a file would: through JSON.
 export const values = (p) => JSON.parse(JSON.stringify(p));
-// The store as a map, one process, nothing kept past it.
+// The rows a store was told about, as values, ready to be written down. A row
+// whose key names nobody is a being who left, and comes back undefined, which
+// is the store dropping what it holds for her.
+export const rowsOf = (partition, rows) => rows.map((row) => {
+    const value = rowOf(partition, row);
+    return [row, value === undefined ? undefined : values(value)];
+});
+// One store's copy, brought up to date with the rows it was told about.
+const keep = (row, partition, rows) => {
+    for (const [id, value] of rowsOf(partition, rows)) {
+        if (value === undefined)
+            row.parts.delete(id);
+        else
+            row.parts.set(id, value);
+    }
+};
 export class MemoryStore {
     rows = new Map();
     reach = new Map();
@@ -10,17 +37,19 @@ export class MemoryStore {
     }
     async load(name) {
         const row = this.rows.get(name);
-        return row && { seed: new Uint8Array(row.seed), partition: values(row.partition), record: { ...row.record } };
+        return row && { seed: new Uint8Array(row.seed), partition: fromRows(Object.fromEntries(row.parts)), record: { ...row.record } };
     }
     async put(name, kept) {
         if (this.rows.has(name))
             throw new Error(`ward ${name} already exists here`);
-        this.rows.set(name, { seed: new Uint8Array(kept.seed), partition: values(kept.partition), record: { ...kept.record } });
+        const row = { seed: new Uint8Array(kept.seed), parts: new Map(), record: { ...kept.record } };
+        this.rows.set(name, row);
+        keep(row, kept.partition, rowsIn(kept.partition));
     }
-    async save(name, partition) {
+    async save(name, partition, rows) {
         const row = this.rows.get(name);
         if (row)
-            row.partition = values(partition);
+            keep(row, partition, rows);
     }
     async record(name, record) {
         const row = this.rows.get(name);

package/dist/ward/arithmetic.d.ts

@@ -7,6 +7,10 @@ export declare function unhex(text: string): Uint8Array;
 export declare function concat(parts: Uint8Array[]): Uint8Array;
 export declare function sameBytes(a: Uint8Array, b: Uint8Array): boolean;
 export declare const smallOrder: (pk: Uint8Array) => boolean;
+export declare const heldKeys: () => {
+    held: number;
+    bound: number;
+};
 export declare function sha256(...parts: Uint8Array[]): Promise<Uint8Array>;
 export type Pair = {
     secret: Uint8Array;