@quo-systems/quo 0.2.15 → 0.2.17

package/src/conformance/store.ts

@@ -9,7 +9,15 @@ import type { Kept, Store } from '../harbor/store.ts';
 import type { Runner } from './index.ts';
 
 const seed = (b: number) => new Uint8Array(32).fill(b);
-const kept = (b: number, extra: Record<string, unknown> = {}): Kept => ({ seed: seed(b), partition: { beings: {}, ...extra }, record: { pk: '', code: 'classes/index.ts', user: 'me' } });
+const kept = (b: number, extra: Record<string, unknown> = {}): Kept => ({ seed: seed(b), partition: { beings: {}, bind: {}, ...extra }, record: { pk: '', code: 'classes/index.ts', user: 'me' } });
+// A partition as a ward writes one: beings under their keys, a bind table
+// beside each, and whatever else the head carries.
+const ward = (beings: Record<string, unknown>, extra: Record<string, unknown> = {}): Record<string, unknown> => ({
+  beings,
+  bind: Object.fromEntries(Object.keys(beings).map((k) => [k, { standings: {} }])),
+  ...extra,
+});
+const ALL = (p: Record<string, unknown>): string[] => ['', ...Object.keys(p.beings as object)];
 
 export function conformStore(label: string, make: () => Promise<Store>, { test }: { test: Runner }) {
   const t = (name: string, fn: () => Promise<void>) => test(`[${label}] ${name}`, {}, fn);
@@ -29,7 +37,7 @@ export function conformStore(label: string, make: () => Promise<Store>, { test }
     const back = await s.load('main');
     assert.ok(back);
     assert.deepEqual(back.seed, seed(7));
-    assert.deepEqual(back.partition, { beings: {}, n: 1, deep: { list: [1, 'two', null], flag: true } });
+    assert.deepEqual(back.partition, { beings: {}, bind: {}, n: 1, deep: { list: [1, 'two', null], flag: true } });
     assert.deepEqual(back.record, { pk: '', code: 'classes/index.ts', user: 'me' });
   });
 
@@ -46,28 +54,47 @@ export function conformStore(label: string, make: () => Promise<Store>, { test }
     assert.deepEqual((await s.load('main'))!.seed, seed(1));
   });
 
-  t('save replaces the partition and touches nothing else', async () => {
+  t('save writes every row it is given, and touches nothing else', async () => {
     const s = await make();
     await s.put('main', kept(3));
-    await s.save('main', { beings: { a: { x: 1 } }, bind: {} });
+    const p = ward({ a: { x: 1 } });
+    await s.save('main', p, ALL(p));
     const back = (await s.load('main'))!;
-    assert.deepEqual(back.partition, { beings: { a: { x: 1 } }, bind: {} });
+    assert.deepEqual(back.partition, p);
     assert.deepEqual(back.seed, seed(3));
     assert.deepEqual(back.record, kept(3).record);
   });
 
+  // What a store may do with the rows it is told about is its own: writing
+  // the whole partition every time is correct. What it may never do is write
+  // less than it was told, or keep a being the rows say is gone.
+  t('save writes the rows it names, and a being the rows drop is gone', async () => {
+    const s = await make();
+    const p = ward({ a: { x: 1 }, b: { y: 1 } });
+    await s.put('main', { ...kept(3), partition: p });
+    // one being moves, and only her row is named
+    (p.beings as Record<string, { x: number }>).a.x = 2;
+    await s.save('main', p, ['a']);
+    assert.deepEqual((await s.load('main'))!.partition, p, 'the row that was named is written');
+    // she leaves: her row is named and her key is gone from the partition
+    delete (p.beings as Record<string, unknown>).a;
+    delete (p.bind as Record<string, unknown>).a;
+    await s.save('main', p, ['a']);
+    assert.deepEqual((await s.load('main'))!.partition, p, 'a row whose being is gone is dropped');
+  });
+
   t('record replaces the record and touches nothing else', async () => {
     const s = await make();
     await s.put('main', kept(4, { n: 9 }));
     await s.record('main', { pk: 'ab'.repeat(64), code: 'elsewhere.ts', user: 'her' });
     const back = (await s.load('main'))!;
     assert.deepEqual(back.record, { pk: 'ab'.repeat(64), code: 'elsewhere.ts', user: 'her' });
-    assert.deepEqual(back.partition, { beings: {}, n: 9 });
+    assert.deepEqual(back.partition, { beings: {}, bind: {}, n: 9 });
   });
 
   t('save and record on a name not kept are nothing', async () => {
     const s = await make();
-    await s.save('ghost', { beings: {} });
+    await s.save('ghost', { beings: {}, bind: {} }, ['']);
     await s.record('ghost', { pk: '', code: '', user: '' });
     assert.deepEqual(await s.list(), []);
   });
@@ -77,10 +104,10 @@ export function conformStore(label: string, make: () => Promise<Store>, { test }
     const k = kept(5, { n: 1 });
     await s.put('main', k);
     (k.partition as { n: number }).n = 2;
-    assert.deepEqual((await s.load('main'))!.partition, { beings: {}, n: 1 });
+    assert.deepEqual((await s.load('main'))!.partition, { beings: {}, bind: {}, n: 1 });
     const a = (await s.load('main'))!;
     (a.partition as { n: number }).n = 3;
-    assert.deepEqual((await s.load('main'))!.partition, { beings: {}, n: 1 });
+    assert.deepEqual((await s.load('main'))!.partition, { beings: {}, bind: {}, n: 1 });
   });
 
   t('take hands the ward out and forgets it; the name is free again', async () => {
@@ -90,7 +117,7 @@ export function conformStore(label: string, make: () => Promise<Store>, { test }
     const out = await s.take('main');
     assert.ok(out);
     assert.deepEqual(out.seed, seed(6));
-    assert.deepEqual(out.partition, { beings: {}, n: 6 });
+    assert.deepEqual(out.partition, { beings: {}, bind: {}, n: 6 });
     assert.equal(await s.load('main'), undefined);
     assert.deepEqual(await s.list(), ['other']);
     await s.put('main', kept(9));

package/src/harbor/core.ts

@@ -50,7 +50,11 @@ export type Hosted = WardPointers & { pk: string; name: string; record: WardReco
 // snapshot cannot land after a newer one. A save that fails is the harbor's
 // to count and never a door's to answer: the door answered bytes, and a
 // disk that is full is not a reason the far side may hear.
-type Saving = { memory: Record<string, unknown>; dirty: boolean; running: Promise<void> | null; timer: ReturnType<typeof setTimeout> | undefined; gone: boolean };
+// `dirty` holds the rows the ward has named since the last write, and never
+// what changed in them: the harbor keeps the partition and reads none of it,
+// so what a row is worth is the store's to read off the object when it
+// writes. Empty is nothing to do.
+type Saving = { memory: Record<string, unknown>; dirty: Set<string>; running: Promise<void> | null; timer: ReturnType<typeof setTimeout> | undefined; gone: boolean };
 // A reach in the directory, and whether this harbor holds it as a socket a
 // dialer opened: only those, and its own doors, take bytes from the wire.
 export type Bound = { reach: Reach; held: boolean };
@@ -155,12 +159,12 @@ export class Harbor {
 
   // ---- saving
 
-  // The ward wrote. Its partition is saved once the line is free, and once
-  // for every burst of writes, in the order the writes came.
-  #wrote(name: string): void {
+  // The ward wrote one row. Its partition is saved once the line is free, and
+  // once for every burst of writes, with every row named in that burst.
+  #wrote(name: string, row: string): void {
     const s = this.#saving.get(name);
     if (!s || s.gone) return;
-    s.dirty = true;
+    s.dirty.add(row);
     if (s.timer === undefined) s.timer = setTimeout(() => void this.#flush(name), 0);
   }
   async #flush(name: string): Promise<void> {
@@ -172,10 +176,13 @@ export class Harbor {
     }
     if (s.running) return s.running;
     s.running = (async () => {
-      while (s.dirty && !s.gone) {
-        s.dirty = false;
+      while (s.dirty.size > 0 && !s.gone) {
+        // Taken before the write, so a row named while this one is in flight
+        // is written by the next turn of the loop and not lost with it.
+        const rows = [...s.dirty];
+        s.dirty.clear();
         try {
-          await this.store.save(name, s.memory);
+          await this.store.save(name, s.memory, rows);
         } catch {
           this.faults.set(name, (this.faults.get(name) ?? 0) + 1);
         }
@@ -352,11 +359,11 @@ export class Harbor {
       instantiate: maker(objects, classes, this.classes),
       carry: (pk, bytes) => this.carry(pk, new Uint8Array(bytes)),
       random,
-      wrote: () => this.#wrote(name),
+      wrote: (row) => this.#wrote(name, row),
     };
     const lend = this.lendFor(name, kept.record);
     if (lend) ground.lend = lend;
-    const saving: Saving = { memory, dirty: false, running: null, timer: undefined, gone: false };
+    const saving: Saving = { memory, dirty: new Set(), running: null, timer: undefined, gone: false };
     this.#saving.set(name, saving);
     // A ward that will not be born leaves nothing behind: a partition of a
     // shape this kit cannot read throws here, and a name the harbor does not

package/src/harbor/index.ts

@@ -6,7 +6,10 @@
 export { MemoryHarbor, type Booted, type WardFactory } from './memory.ts';
 export { Harbor, DEFAULT_CODE, type Hosted, type Bound, type Loader } from './core.ts';
 export { dial, type Dialer } from './dial.ts';
-export { MemoryStore, values, type Store, type Kept, type WardRecord } from './store.ts';
+export { MemoryStore, values, rowsOf, type Store, type Kept, type WardRecord } from './store.ts';
+// What a store keeping a ward in rows needs: the name of the row that is not
+// a being, and the partition back from the rows it was cut into.
+export { HEAD, fromRows, rowsIn } from '../ward/partition.ts';
 export { request, Socket, SUITE, REFUSED, type Reach, type Carry, type Line, type Announce } from './reach.ts';
 export type { Ground, WardPointers, Lend } from '../ward/ground.ts';
 // What a harbor builds a ground out of. Convenience, never contract: a kit

package/src/harbor/memory.ts

@@ -21,6 +21,12 @@ export class MemoryHarbor {
   readonly partitions = new Map<string, Record<string, unknown>>(); // seed -> memory. the harbor keeps it and reads nothing
   readonly wards = new Map<string, Booted>(); // seed -> pointers
   readonly objects = new WeakMap<object, BeingLike>(); // cells -> being object. what instantiate constructed. a hand for tests, never the ward's; it follows the cells out when she is unbooted
+  // Where the wards this harbor boots draw their entropy. The device's own
+  // by default. A harbor may hand a fixed stream instead, which is what pins
+  // bytes: every key a ward mints and every nonce it seals under comes from
+  // here, so a ward on a known seed with a known stream answers the same
+  // bytes every run, and a corpus of them is a corpus and not a sample.
+  random: Ground['random'] = entropy;
 
   // the directory: its own doors, else a peer it is linked to. Quo says nothing about how.
   async route(farPk: string, bytes: Uint8Array): Promise<Uint8Array | undefined> {
@@ -66,7 +72,7 @@ export class MemoryHarbor {
         const back = await this.route(farPk, new Uint8Array(bytes));
         return back === undefined ? undefined : new Uint8Array(back);
       },
-      random: entropy,
+      random: (n) => this.random(n),
     };
     const w = await Ward(ground);
     const booted: Booted = { ...w, pk: await learnPk(w) };

package/src/harbor/store.ts

@@ -9,6 +9,8 @@
 // storage on the edge; the memory store below is the library's own, for a
 // harbor core with no device under it. `src/conformance/store.ts` is what
 // every one of them passes.
+import { fromRows, rowOf, rowsIn, type Partition } from '../ward/partition.ts';
+
 export type WardRecord = { pk: string; code: string; user: string };
 export type Kept = { seed: Uint8Array; partition: Record<string, unknown>; record: WardRecord };
 
@@ -19,7 +21,14 @@ export type Store = {
   put(name: string, kept: Kept): Promise<void>;
   // The partition back, after a call; the record back, after a boot learned
   // the pk. A name not kept is nothing, on both.
-  save(name: string, partition: Record<string, unknown>): Promise<void>;
+  //
+  // `rows` names what the ward wrote since the last save: a being by her key,
+  // or `HEAD`. A store may write only those, which is what `rowsOf` is for,
+  // and a store that writes the whole partition every time is correct and
+  // slower. A being's cells are the one part of a partition that grows
+  // without limit, so a store that keeps her apart lets her neighbour be
+  // asked without her being written down again.
+  save(name: string, partition: Record<string, unknown>, rows: readonly string[]): Promise<void>;
   record(name: string, record: WardRecord): Promise<void>;
   // Take a ward out: the first move of a migration. What was kept comes back.
   take(name: string): Promise<Kept | undefined>;
@@ -31,9 +40,30 @@ export type Store = {
 // so a store takes a copy of the values the way a file would: through JSON.
 export const values = (p: Record<string, unknown>): Record<string, unknown> => JSON.parse(JSON.stringify(p)) as Record<string, unknown>;
 
-// The store as a map, one process, nothing kept past it.
+// The rows a store was told about, as values, ready to be written down. A row
+// whose key names nobody is a being who left, and comes back undefined, which
+// is the store dropping what it holds for her.
+export const rowsOf = (partition: Record<string, unknown>, rows: readonly string[]): [string, Record<string, unknown> | undefined][] =>
+  rows.map((row) => {
+    const value = rowOf(partition as unknown as Partition, row);
+    return [row, value === undefined ? undefined : (values(value) as Record<string, unknown>)];
+  });
+
+// One store's copy, brought up to date with the rows it was told about.
+const keep = (row: Row, partition: Record<string, unknown>, rows: readonly string[]): void => {
+  for (const [id, value] of rowsOf(partition, rows)) {
+    if (value === undefined) row.parts.delete(id);
+    else row.parts.set(id, value);
+  }
+};
+
+// The store as a map, one process, nothing kept past it. It keeps a ward as
+// rows, the way a store on a device does, so what it costs to save is what a
+// device pays and the library's own measurements mean something.
+type Row = { seed: Uint8Array; parts: Map<string, Record<string, unknown>>; record: WardRecord };
+
 export class MemoryStore implements Store {
-  readonly rows = new Map<string, Kept>();
+  readonly rows = new Map<string, Row>();
   readonly reach = new Map<string, string>();
 
   async list(): Promise<string[]> {
@@ -41,15 +71,17 @@ export class MemoryStore implements Store {
   }
   async load(name: string): Promise<Kept | undefined> {
     const row = this.rows.get(name);
-    return row && { seed: new Uint8Array(row.seed), partition: values(row.partition), record: { ...row.record } };
+    return row && { seed: new Uint8Array(row.seed), partition: fromRows(Object.fromEntries(row.parts)), record: { ...row.record } };
   }
   async put(name: string, kept: Kept): Promise<void> {
     if (this.rows.has(name)) throw new Error(`ward ${name} already exists here`);
-    this.rows.set(name, { seed: new Uint8Array(kept.seed), partition: values(kept.partition), record: { ...kept.record } });
+    const row: Row = { seed: new Uint8Array(kept.seed), parts: new Map(), record: { ...kept.record } };
+    this.rows.set(name, row);
+    keep(row, kept.partition, rowsIn(kept.partition));
   }
-  async save(name: string, partition: Record<string, unknown>): Promise<void> {
+  async save(name: string, partition: Record<string, unknown>, rows: readonly string[]): Promise<void> {
     const row = this.rows.get(name);
-    if (row) row.partition = values(partition);
+    if (row) keep(row, partition, rows);
   }
   async record(name: string, record: WardRecord): Promise<void> {
     const row = this.rows.get(name);

package/src/ward/arithmetic.ts

@@ -85,18 +85,83 @@ const key32 = (value: Uint8Array, what: string): Uint8Array => {
   return value;
 };
 const pkcs8 = (prefix: Uint8Array, value: Uint8Array, what: string) => concat([prefix, key32(value, what)]);
-const secretKey = (alg: { name: string }, prefix: Uint8Array, value: Uint8Array, what: string, uses: KeyUsage[]) =>
-  subtle().importKey('pkcs8', pkcs8(prefix, value, what) as BufferSource, alg, true, uses);
-const publicKey = (alg: { name: string }, value: Uint8Array, what: string, uses: KeyUsage[]) =>
-  subtle().importKey('raw', key32(value, what) as BufferSource, alg, true, uses);
-
-// Subtle exports the public half of a private key only through a JWK, where `x` is the 32 raw bytes in base64url.
-async function rawPublic(secret: CryptoKey): Promise<Uint8Array> {
-  const jwk = await subtle().exportKey('jwk', secret);
-  const binary = atob(jwk.x!.replaceAll('-', '+').replaceAll('_', '/'));
-  const out = new Uint8Array(binary.length);
-  for (let at = 0; at < binary.length; at += 1) out[at] = binary.charCodeAt(at);
-  return out;
+
+// Importing a key is the most expensive thing on the path of an ask, and most
+// of the imports are the same key again: a ward signs every reply with the one
+// key, opens every ask with the one padlock, and verifies a relation under the
+// key it verified it under last time. Measured over a round trip, fifteen of
+// the twenty-five imports were bytes already imported once.
+//
+// So an imported key is kept, by the bytes it was imported from. A CryptoKey
+// cannot be changed once it exists, so handing the same one out twice is
+// handing out what a second import would have built. Nothing here is a
+// decision a peer can see: two wards that cache differently, or not at all,
+// speak the same bytes.
+//
+// It is bounded, and that is not a detail. A relation mints a fresh key on
+// every ask, so a ward that talked all day would otherwise hold a key for
+// every ask it ever made. Past the bound the least recently used goes, which
+// is the key of a relation that has fallen quiet, and importing it again
+// costs what it cost the first time.
+//
+// The secret keys in here are the ones the partition already holds in this
+// process, as seeds. The cache is another shape of what the ward is already
+// standing on, and never a second place a secret comes from.
+const KEYS = 512;
+const imported = new Map<string, Promise<CryptoKey>>();
+const keep = (id: string, make: () => Promise<CryptoKey>): Promise<CryptoKey> => {
+  const had = imported.get(id);
+  if (had !== undefined) {
+    imported.delete(id); // and set again below: the most recently used goes last
+    imported.set(id, had);
+    return had;
+  }
+  const made = make();
+  // A key that would not import is not kept: the next call asks subtle again
+  // and hears the same refusal, rather than reading one this cache remembered.
+  // Node takes any thirty-two bytes as a public key and finds out at verify,
+  // so nothing here reaches this line; a terrain that checks the point at the
+  // import does, and a refusal it remembered would be a relation killed for
+  // good by one bad arrival.
+  made.catch(() => imported.delete(id));
+  imported.set(id, made);
+  // One in, at most one out: a map keeps what was put in the order it was put,
+  // so the first key it names is the one used longest ago.
+  if (imported.size > KEYS) imported.delete(imported.keys().next().value!);
+  return made;
+};
+
+// How many imported keys are held, and the bound they are held under. Nothing
+// in the ward reads either: they are here to be looked at, and for the suite
+// that holds the bound to what it says.
+export const heldKeys = (): { held: number; bound: number } => ({ held: imported.size, bound: KEYS });
+
+const secretKey = (alg: { name: string }, prefix: Uint8Array, value: Uint8Array, what: string, uses: KeyUsage[]) => {
+  const bytes = pkcs8(prefix, value, what);
+  return keep(`${alg.name}|${uses.join('+')}|${hex(bytes)}`, () => subtle().importKey('pkcs8', bytes as BufferSource, alg, true, uses));
+};
+const publicKey = (alg: { name: string }, value: Uint8Array, what: string, uses: KeyUsage[]) => {
+  const bytes = key32(value, what);
+  return keep(`${alg.name}|${uses.join('+')}|pk|${hex(bytes)}`, () => subtle().importKey('raw', bytes as BufferSource, alg, true, uses));
+};
+
+// Subtle exports the public half of a private key only through a JWK, where
+// `x` is the 32 raw bytes in base64url. The answer is a fact about the key and
+// never changes, so it is kept beside the key it was read from and goes when
+// the key does.
+const publics = new WeakMap<CryptoKey, Promise<Uint8Array>>();
+function rawPublic(secret: CryptoKey): Promise<Uint8Array> {
+  const had = publics.get(secret);
+  if (had !== undefined) return had;
+  const read = (async () => {
+    const jwk = await subtle().exportKey('jwk', secret);
+    const binary = atob(jwk.x!.replaceAll('-', '+').replaceAll('_', '/'));
+    const out = new Uint8Array(binary.length);
+    for (let at = 0; at < binary.length; at += 1) out[at] = binary.charCodeAt(at);
+    return out;
+  })();
+  publics.set(secret, read);
+  return read;
 }
 
 export async function sha256(...parts: Uint8Array[]): Promise<Uint8Array> {
@@ -104,13 +169,17 @@ export async function sha256(...parts: Uint8Array[]): Promise<Uint8Array> {
 }
 
 export type Pair = { secret: Uint8Array; pk: Uint8Array };
+// Both halves are copies. The seed and the public key are kept behind the two
+// caches above, and a pair is handed to whoever asked for it: what she does
+// with the bytes in her hand is hers, and must not reach what the next caller
+// is given.
 export async function signingPair(seed: Uint8Array): Promise<Pair> {
   const secret = await secretKey(ED, ED_SECRET, seed, 'seed', ['sign']);
-  return { secret: Uint8Array.from(seed), pk: await rawPublic(secret) };
+  return { secret: Uint8Array.from(seed), pk: Uint8Array.from(await rawPublic(secret)) };
 }
 export async function sealingPair(seed: Uint8Array): Promise<Pair> {
   const secret = await secretKey(X, X_SECRET, seed, 'seed', ['deriveBits']);
-  return { secret: Uint8Array.from(seed), pk: await rawPublic(secret) };
+  return { secret: Uint8Array.from(seed), pk: Uint8Array.from(await rawPublic(secret)) };
 }
 
 export async function sign(message: Uint8Array, secret: Uint8Array): Promise<Uint8Array> {

package/src/ward/ground.ts

@@ -31,13 +31,20 @@ export type Ground = {
   seed: string | Uint8Array; // the ward derives its pk from it and nothing else
   memory: Record<string, unknown>; // the partition. the ward's files. opaque to the harbor
   instantiate(className: string, stance: Stance): BeingLike | null; // the code half
-  // The ward wrote its partition. It says so after every write, a key
-  // rotated, a relation taken, a cell she set, and says nothing else: it
-  // never learns whether anything was kept. A harbor that keeps the
+  // The ward wrote its partition, and which row of it: a being by her key,
+  // or `HEAD` for everything that is not one being's. It says so after every
+  // write, a key rotated, a relation taken, a cell she set, and says nothing
+  // else: it never learns whether anything was kept. A harbor that keeps the
   // partition saves after this, when it likes and in the order it was told,
   // so a being driven in process is kept the way one reached through a door
   // is. A harbor that keeps nothing leaves it out.
-  wrote?: () => void;
+  //
+  // The row is named because a being's cells are the one part of a partition
+  // that grows without limit, and a harbor told only that something moved has
+  // to write down every being in the ward to be sure of one. What a harbor
+  // does with the name is its own: writing the whole partition on every word
+  // is correct, and slower.
+  wrote?: (row: string) => void;
   // Sealed bytes to a ward pk. What comes back, or undefined.
   //
   // undefined is a promise, not a shrug: no door was reached, and nothing was

package/src/ward/partition.ts

@@ -235,3 +235,56 @@ export const drop = (rec: Record<string, unknown>, key: string): void => {
 
 export const emptyCells = (): Cells => ({ standings: {}, occupants: {} });
 export const emptyBind = (): Bind => ({ standings: {}, occupants: {}, knocks: {}, answered: {}, minted: [] });
+
+// ---- the partition in rows, for a store that keeps it
+//
+// A ward hands a harbor one object, so a being who writes one cell has every
+// other being in her ward written down beside her. What a being holds is the
+// one thing here that grows without limit, so she is a row: her cells and her
+// bind table, under her key. Everything else is one head row, and every part
+// of it is bounded already, one record per occupant and two lists that drop
+// their oldest.
+//
+// The split is here, where the shape is, and not in the harbor, which keeps
+// what it is given and reads none of it. A store is handed the rows that
+// moved; what it does with that is its own, and one that writes every row is
+// as correct as one that writes the few.
+export const HEAD = ''; // the row that is not a being: no being's key is empty
+
+// One row's value: a being, or the head, which is everything the partition
+// holds that is not filed under a being. The head is read as what is left
+// rather than as a list of names, so a store keeps whatever it was handed and
+// hands the same thing back, and a field this file grows later needs no line
+// in a store to survive a round trip.
+//
+// Undefined where the key names nobody, which is a row the store drops.
+export const rowOf = (p: Partition, row: string): Record<string, unknown> | undefined => {
+  const all = p as unknown as Record<string, unknown>;
+  if (row === HEAD) return Object.fromEntries(Object.entries(all).filter(([k]) => k !== 'beings' && k !== 'bind'));
+  const cells = at(p.beings ?? {}, row);
+  return cells === undefined ? undefined : { cells, bind: at(p.bind ?? {}, row) ?? emptyBind() };
+};
+export const rowsIn = (p: Record<string, unknown>): string[] => [HEAD, ...Object.keys((p.beings as Record<string, unknown>) ?? {})];
+
+// The partition back from its rows. A head that is absent is a partition
+// nobody has written, and `open` makes an empty one of it.
+export const fromRows = (rows: Record<string, Record<string, unknown>>): Record<string, unknown> => {
+  const out: Record<string, unknown> = { ...(rows[HEAD] ?? {}) };
+  const beings: Record<string, unknown> = {};
+  const bind: Record<string, unknown> = {};
+  let any = Object.keys(out).length > 0;
+  for (const [row, value] of Object.entries(rows)) {
+    if (row === HEAD) continue;
+    put(beings, row, value.cells);
+    put(bind, row, value.bind);
+    any = true;
+  }
+  // Nothing kept is nothing handed back. Rows that say only that there are no
+  // rows must come back as the empty memory they are, because `open` reads an
+  // empty one as a ward's first breath and anything else as a partition
+  // somebody wrote, which must then say which version wrote it.
+  if (!any) return {};
+  out.beings = beings;
+  out.bind = bind;
+  return out;
+};

package/src/ward/seal.ts

@@ -54,7 +54,7 @@ export const SIZE = 1024 * 1024;
 // designs and no separation at all: one secret would be doing two jobs with
 // nothing said about it, and a second kit would have to reproduce a
 // construction nobody named. HKDF-SHA-256 under a label is the separation
-// said out loud, and it is what `vectors/framing.json` pins.
+// said out loud, and it is what `protocol/vectors/framing.json` pins.
 //
 // Bytes are key material and text is not. A seed handed in as bytes of the
 // key length is taken as it stands, which is what a harbor mints; anything