@quo-systems/quo 0.2.8 → 0.2.10

package/src/being/types.ts

@@ -79,7 +79,9 @@ export type Standings = {
 } & { readonly [id: string]: Standing | undefined };
 
 export type Occupants = {
-  invite(id: string): Promise<Invitation | null>; // awaitable: a key is minted
+  // awaitable: a key is minted. The notes are the terms it is minted under,
+  // written on the occupant for her gate to read, and hers alone after that.
+  invite(id: string, notes?: JsonObject): Promise<Invitation | null>;
 
   remove(id: string): void;
 };
@@ -90,9 +92,13 @@ export type Stance = {
   readonly occupants: Occupants;
   readonly standings: Standings;
   // A new being of her ward, by class name, under a key she chooses. The key
-  // back, or null: the key is taken or the harbor holds no such class. A
-  // being may make; only the owner reaches into another.
-  boot(className: string, key: string): string | null;
+  // back, or null: the key is taken, the harbor holds no such class, or the
+  // class threw at birth. A being may make; only the owner reaches into
+  // another. Naming an id asks for a way back too: the being made holds an
+  // occupant for her maker under the maker's own key, and the maker holds
+  // the standing under that id. A relation that could not be made is a boot
+  // that made nobody, and the being made goes with it.
+  boot(className: string, key: string, id?: string): Promise<string | null>;
 };
 
 // The raw shape of a being. Anything with these two is a being.

package/src/conformance/estate.ts

@@ -22,7 +22,7 @@
 // harbors, and that is where the promise of Quo is held: a being never learns
 // where the other one is, so every answer, after every move, under every
 // topology, is the answer the model wrote without knowing the topology
-// either. Held forty times a run, it is the promise at a scale a scene
+// either. Held after every one of sixty moves, it is the promise at a scale a scene
 // cannot reach, and it is what makes a migration honest: if no answer can
 // tell the topology apart, moving a ward between harbors cannot be felt.
 // The model itself is the script's own bookkeeping and takes nothing from a
@@ -267,8 +267,6 @@ export function estate(label: string, make: () => Promise<World>, { canDown, tes
           return `${who}'s ward moves harbor`;
         });
 
-        // weather: the host's door is gone. unreached, never silence, and the
-        // relation is exactly where it was when it comes back.
         // weather: the host's door is gone. unreached, never silence, and the
         // relation is exactly where it was when it comes back. The move is on
         // the list under every topology even where there is nothing to cut,

package/src/conformance/index.ts

@@ -12,7 +12,7 @@
 //   handle.being                                  the object, as the test drives it
 //   handle.cells                                  her cells, as the ward keeps them
 //   handle.down = true | false                    her door is unreachable (needs canDown)
-//   handle.minted.has(pk)                         every pk her side ever minted
+//   handle.minted.has(pk)                         the last eight pks her side minted
 //   handle.forgeKnock(invitation)                 make her side knock with a key of its own, unannounced
 //   world.census()                                every partition in the world, as values
 //   world.migrate(key)                            her ward moves to another harbor, same seed, same pk

package/src/harbor/core.ts

@@ -19,6 +19,7 @@
 import { Ward } from '../ward/ward.ts';
 import type { Ground, WardPointers } from '../ward/ground.ts';
 import type { BeingClass, BeingLike } from '../being/types.ts';
+import { silence } from '../being/silence.ts';
 import { request, type Reach } from './reach.ts';
 import { openReply, wardSignPk } from '../ward/seal.ts';
 import { concat, sealingPair, KEY } from '../ward/arithmetic.ts';
@@ -26,6 +27,13 @@ import { within, LATE } from '../ward/allowance.ts';
 import type { Kept, Store, WardRecord } from './store.ts';
 
 export type Hosted = WardPointers & { pk: string; name: string; record: WardRecord; partition: Record<string, unknown>; being(key: string): BeingLike | undefined; save(): Promise<void> };
+
+// One ward's saves, in a line: the ward says it wrote, the harbor writes the
+// partition once the line is free, and never twice at once, so an older
+// snapshot cannot land after a newer one. A save that fails is the harbor's
+// to count and never a door's to answer: the door answered bytes, and a
+// disk that is full is not a reason the far side may hear.
+type Saving = { memory: Record<string, unknown>; dirty: boolean; running: Promise<void> | null; timer: ReturnType<typeof setTimeout> | undefined; gone: boolean };
 // A reach in the directory, and whether this harbor holds it as a socket a
 // dialer opened: only those, and its own doors, take bytes from the wire.
 export type Bound = { reach: Reach; held: boolean };
@@ -37,6 +45,12 @@ export const DEFAULT_CODE = 'classes/index.ts';
 // How long a probe waits for the door behind a claim. A claim that answers
 // nothing in this time is not bound; the next announce is another chance.
 const PROBE = 10_000;
+// How many pks one announce may claim, and how many are proven at once.
+const ANNOUNCE = 64;
+const PROVING = 8;
+// How many times each reach has announced: a proof from an older announce
+// binds nothing when it lands.
+const announces = new WeakMap<Reach, number>();
 
 export class Harbor {
   readonly store: Store;
@@ -46,7 +60,10 @@ export class Harbor {
   readonly reaches = new Map<string, Bound>(); // the directory: foreign ward pk -> reach
   readonly down = new Set<string>(); // pks this harbor will not reach right now: weather, for a test
   readonly refused = new Map<string, number>(); // own ward pk -> arrivals its door would not admit. what a terrain does with it is its own
+  readonly faults = new Map<string, number>(); // ward name -> saves the store refused. what a terrain does with it is its own
+  readonly unbooted: string[] = []; // the wards the store keeps that would not host this run, by name
   readonly classes: Record<string, BeingClass> = {}; // classes handed in-process, beside the loader's
+  readonly #saving = new Map<string, Saving>();
   // The dialers' sockets, in the order they were dialed: where a pk nobody
   // here knows is sent, because the listener a harbor dialed is a rendezvous
   // and may hold that pk for someone else. It is a list because a harbor may
@@ -72,15 +89,56 @@ export class Harbor {
     this.loader = loader;
   }
 
-  // Boot every ward the store keeps, and learn the hints.
+  // Boot every ward the store keeps, and learn the hints. One ward that will
+  // not host, a partition this kit cannot read or a loader that throws, is
+  // named in `unbooted` and takes nobody else down with it.
   async boot(): Promise<void> {
     for (const name of await this.store.list()) {
-      const kept = await this.store.load(name);
-      if (kept) await this.host(name, kept);
+      try {
+        const kept = await this.store.load(name);
+        if (kept) await this.host(name, kept);
+      } catch {
+        this.unbooted.push(name);
+      }
     }
     for (const [pk, url] of Object.entries(await this.store.hints())) this.hint(pk, url);
   }
 
+  // ---- saving
+
+  // The ward wrote. Its partition is saved once the line is free, and once
+  // for every burst of writes, in the order the writes came.
+  #wrote(name: string): void {
+    const s = this.#saving.get(name);
+    if (!s || s.gone) return;
+    s.dirty = true;
+    if (s.timer === undefined) s.timer = setTimeout(() => void this.#flush(name), 0);
+  }
+  async #flush(name: string): Promise<void> {
+    const s = this.#saving.get(name);
+    if (!s) return;
+    if (s.timer !== undefined) {
+      clearTimeout(s.timer);
+      s.timer = undefined;
+    }
+    if (s.running) return s.running;
+    s.running = (async () => {
+      while (s.dirty && !s.gone) {
+        s.dirty = false;
+        try {
+          await this.store.save(name, s.memory);
+        } catch {
+          this.faults.set(name, (this.faults.get(name) ?? 0) + 1);
+        }
+      }
+    })();
+    try {
+      await s.running;
+    } finally {
+      s.running = null;
+    }
+  }
+
   // ---- the directory
 
   // Bytes to one of this harbor's own doors, and the one bit the door says
@@ -113,7 +171,7 @@ export class Harbor {
   }
 
   hint(pk: string, url: string): void {
-    if (this.reaches.get(pk)?.held) return; // a socket in hand beats a hint
+    if (this.reaches.has(pk)) return; // a reach proven at a door beats a hint, held or reached through a dialed line
     this.reaches.set(pk, { reach: request(url), held: false });
   }
 
@@ -130,8 +188,8 @@ export class Harbor {
   // signed by the ward key. Only the holder of that ward's seed can write
   // that reply, the lid is fresh so nothing replays, and a box that does not
   // open writes nothing at the ward. This is the one box a harbor ever opens,
-  // the one it sealed itself, and it reads nothing from it but that the
-  // signature is the claimed key's.
+  // the one it sealed itself, and it reads nothing from it but that it is
+  // the silence a door owes such a box, signed by the claimed key.
   async prove(pk: string, reach: Reach): Promise<boolean> {
     if (!/^[0-9a-f]{128}$/.test(pk)) return false;
     try {
@@ -148,16 +206,27 @@ export class Harbor {
 
   // Bind what the far side claims, each pk proven at its door first. Both
   // sides bind this way: the listener the dialer's claims, the dialer the
-  // listener's, since a claim is a claim whichever end made it.
+  // listener's, since a claim is a claim whichever end made it. An announce
+  // names at most this many pks, and they are proven a few at a time: a
+  // side that announced a thousand would otherwise cost a thousand keys, a
+  // thousand frames and a thousand waits at once, on its word alone.
   async bind(pks: string[], reach: Reach, held: boolean): Promise<void> {
     // An announce is the whole of what that side holds now, so a pk this
-    // reach was bound for and no longer claims is unbound at once: a ward
+    // reach was bound for and does not claim now is unbound at once: a ward
     // that left a dialer is not reachable through it, proof or no proof.
+    // And it is the newest word: a proof still in flight from an earlier
+    // announce on this reach binds nothing when it lands, since the side
+    // has spoken again since.
+    const said = (announces.get(reach) ?? 0) + 1;
+    announces.set(reach, said);
     for (const [pk, b] of this.reaches) if (b.reach === reach && !pks.includes(pk)) this.reaches.delete(pk);
-    await Promise.all(pks.map(async (pk) => {
+    const claimed = [...new Set(pks)].slice(0, ANNOUNCE);
+    const prove = async (pk: string) => {
       if (this.doors.has(pk) || !(await this.prove(pk, reach))) return;
+      if (announces.get(reach) !== said) return; // a newer announce has spoken since
       this.reaches.set(pk, { reach, held });
-    }));
+    };
+    for (let i = 0; i < claimed.length; i += PROVING) await Promise.all(claimed.slice(i, i + PROVING).map(prove));
   }
   unbind(reach: Reach): void {
     for (const [pk, b] of this.reaches) if (b.reach === reach) this.reaches.delete(pk);
@@ -175,12 +244,15 @@ export class Harbor {
   }
 
   // Stop serving a ward and take it out of the store: what was kept comes
-  // back, for another harbor to put. The partition is written first, because
-  // a being driven in-process changes it without passing a door.
+  // back, for another harbor to put. The partition is written first, and
+  // never again under this name: whoever still holds the old pointers holds
+  // a ward that saves nothing and answers its owner silence.
   async drop(name: string): Promise<Kept | undefined> {
     const h = this.wards.get(name);
     if (h) {
       await h.save();
+      const s = this.#saving.get(name);
+      if (s) s.gone = true;
       this.wards.delete(name);
       this.doors.delete(h.pk);
       this.#announce(); // this harbor no longer claims it: a listener unbinds a pk an announce stops naming
@@ -198,12 +270,13 @@ export class Harbor {
   async host(name: string, kept: Kept): Promise<Hosted> {
     const { seed, partition: memory } = kept;
     const classes = await this.loader(kept.record);
-    const objects = new Map<object, BeingLike>(); // cells -> the object instantiate made. a side's hand, never the ward's
+    const objects = new WeakMap<object, BeingLike>(); // cells -> the object instantiate made. a side's hand, never the ward's; it follows the cells out when she is unbooted
     const ground: Ground = {
       seed,
       memory,
       instantiate: (className, stance) => {
-        const C = classes[className] ?? this.classes[className];
+        // Own keys only: `constructor` is a name Object lends every registry.
+        const C = Object.hasOwn(classes, className) ? classes[className] : Object.hasOwn(this.classes, className) ? this.classes[className] : undefined;
         if (!C) return null;
         const obj = new C(stance);
         objects.set(stance.cells, obj);
@@ -211,20 +284,31 @@ export class Harbor {
       },
       carry: (pk, bytes) => this.carry(pk, new Uint8Array(bytes)),
       random: (n) => globalThis.crypto.getRandomValues(new Uint8Array(n)),
+      wrote: () => this.#wrote(name),
     };
+    const saving: Saving = { memory, dirty: false, running: null, timer: undefined, gone: false };
+    this.#saving.set(name, saving);
     const w = await Ward(ground);
-    const save = () => this.store.save(name, memory);
-    const after =
-      <A extends unknown[], R>(f: (...a: A) => Promise<R>) =>
-      async (...a: A): Promise<R> => {
-        try {
-          return await f(...a);
-        } finally {
-          await save();
-        }
-      };
-    const door = after(w.door);
-    const ask = after(w.ask);
+    // A save the caller may wait for: what the ward wrote so far is in the
+    // store when this resolves, or the fault is counted. After a call through
+    // a pointer the store is current, so a restart right after it finds
+    // everything; a refusal at the door wrote nothing and saves nothing.
+    const save = async () => {
+      if (saving.gone) return;
+      saving.dirty = true;
+      await this.#flush(name);
+    };
+    const door = async (bytes: Uint8Array) => {
+      const r = await w.door(bytes);
+      if (r.heard) await save();
+      return r;
+    };
+    const ask = async (method?: string, args?: Record<string, unknown>) => {
+      if (saving.gone) return silence;
+      const out = await w.ask(method, args);
+      await save();
+      return out;
+    };
     const bp = (await w.ask()) as { notes: { pk: string } }; // learned by asking, as anyone learns anything
     const beings = memory.beings as Record<string, object> | undefined;
     const being = (key: string) => {

package/src/harbor/dial.ts

@@ -1,5 +1,5 @@
 // SPDX-License-Identifier: Apache-2.0
-// A harbor as a dialer: one held socket to a listener's quo. route, its own
+// A harbor as a dialer: one held socket to a listener's URL, its own
 // pks announced, the listener's bound, and a reconnect with backoff from a
 // second to thirty when the line drops. Seed, partition and keys are here;
 // only the reach comes and goes. While the socket is open it is also the
@@ -23,11 +23,12 @@ export function dial(harbor: Harbor, url: string): Dialer {
   const d: Dialer = { url, socket: null, wake: () => {}, close: () => {} };
   let stopped = false,
     wait = 1000,
-    timer: ReturnType<typeof setTimeout> | undefined;
+    timer: ReturnType<typeof setTimeout> | undefined,
+    line: Line | undefined; // the line in hand, open or still opening: close() closes it either way
   const connect = () => {
     timer = undefined; // no wait pending: this is the dial it was waiting for
     if (stopped) return;
-    const line = new WebSocket(url.replace(/\/$/, '').replace(/^http/, 'ws')) as unknown as Line;
+    line = new WebSocket(url.replace(/\/$/, '').replace(/^http/, 'ws')) as unknown as Line;
     const s: Socket = new Socket(
       line,
       (pk, bytes) => harbor.deliver(pk, bytes),
@@ -59,6 +60,7 @@ export function dial(harbor: Harbor, url: string): Dialer {
     // the line already in hand, and a dropped one stops being claimed at once.
     const say = () => s.announce([...harbor.doors.keys()]);
     line.addEventListener('open', () => {
+      if (stopped) return s.close(); // closed while it was opening: it opens into nothing
       d.socket = s;
       harbor.announcers.add(say);
       say();
@@ -76,7 +78,7 @@ export function dial(harbor: Harbor, url: string): Dialer {
   d.close = () => {
     stopped = true;
     clearTimeout(timer);
-    d.socket?.close();
+    line?.close(); // open or opening: a line closed while connecting fires close and never open
   };
   connect();
   return d;

package/src/harbor/memory.ts

@@ -20,7 +20,7 @@ export class MemoryHarbor {
   cut = false;
   readonly partitions = new Map<string, Record<string, unknown>>(); // seed -> memory. the harbor keeps it and reads nothing
   readonly wards = new Map<string, Booted>(); // seed -> pointers
-  readonly objects = new Map<object, unknown>(); // cells -> being object. what instantiate constructed. a hand for tests, never the ward's
+  readonly objects = new WeakMap<object, unknown>(); // cells -> being object. what instantiate constructed. a hand for tests, never the ward's; it follows the cells out when she is unbooted
 
   // the directory: its own doors, else a peer it is linked to. Quo says nothing about how.
   async route(farPk: string, bytes: Uint8Array): Promise<Uint8Array | undefined> {
@@ -55,7 +55,8 @@ export class MemoryHarbor {
       seed,
       memory,
       instantiate: (name: string, stance: Stance) => {
-        const C = classes[name];
+        // Own keys only: `constructor` is a name Object lends every registry.
+        const C = Object.hasOwn(classes, name) ? classes[name] : undefined;
         if (!C) return null;
         const obj = new C(stance);
         this.objects.set(stance.cells, obj);

package/src/harbor/reach.ts

@@ -1,9 +1,9 @@
 // SPDX-License-Identifier: Apache-2.0
 // Reach: carrying bytes to a pk off the device. One interface, two
-// implementations, as quo-harbor.md names them:
+// implementations:
 //
-//   request   a URL, the quo. route of a world. POST the bytes to
-//             `<url>/<pk>`, get bytes back. Listener to listener.
+//   request   a URL. POST the bytes to `<url>/<pk>`, get bytes back.
+//             Listener to listener.
 //   socket    a held WebSocket at `<url>`, opened by whichever side can
 //             dial, used in both directions with a frame id. Each side
 //             announces the ward pks it holds when the socket opens, and the
@@ -38,7 +38,11 @@ export function request(url: string): Reach {
       } catch {
         return undefined; // the connection never opened: nothing was delivered
       }
-      if (res.status === 404) return undefined; // the listener holds no reach for that pk
+      // A status that says the listener did not take the bytes is nothing
+      // delivered: no reach for that pk, a request it refused on its face, a
+      // gateway with nobody behind it. Any other failure is a listener that
+      // took them and failed after, which is sent and no word since.
+      if (res.status === 404 || (res.status >= 400 && res.status < 500) || res.status === 502 || res.status === 503 || res.status === 504) return undefined;
       if (!res.ok) return never();
       return new Uint8Array(await res.arrayBuffer());
     },
@@ -75,6 +79,11 @@ export const SUITE = 1;
 // the refusal names itself on the way out, and the far side may read it.
 export const REFUSED = 4001;
 const OPEN = 1; // WebSocket.OPEN, on every terrain
+// How many asks a socket keeps a resolver for. An ask the far side never
+// answers is ended by the ward's bound, and its resolver stays until the
+// line closes; a far side that answers nothing for long enough would grow
+// the map for as long as this side asks, so the oldest goes when it is full.
+const PENDING = 4096;
 
 // The standard surface, and no more of it: what a browser WebSocket, Node's
 // WebSocket and a `ws` server socket all have.
@@ -106,7 +115,17 @@ export class Socket implements Reach {
   constructor(line: Line, deliver: Carry, onAnnounce: Announce, onClose: (why: { code?: number; reason?: string }) => void) {
     this.line = line;
     line.binaryType = 'arraybuffer';
-    this.#open = line.readyState === OPEN ? Promise.resolve() : new Promise((ok, no) => (line.addEventListener('open', ok), line.addEventListener('error', no)));
+    // A line that opens is a reach; one that errors, or closes before it
+    // opened, is a reach that failed, and an ask waiting on the handshake is
+    // nothing delivered.
+    this.#open =
+      line.readyState === OPEN
+        ? Promise.resolve()
+        : new Promise((ok, no) => {
+            line.addEventListener('open', ok);
+            line.addEventListener('error', no);
+            line.addEventListener('close', () => no(new Error('closed before it opened')));
+          });
     this.#open.catch(() => {}); // a handshake refused is a reach that failed, not a process that dies
     line.addEventListener('message', (e) => {
       if (typeof e.data === 'string') {
@@ -133,12 +152,19 @@ export class Socket implements Reach {
         id = new DataView(buf.buffer, buf.byteOffset, buf.byteLength).getUint32(1);
       if (kind === ASK) {
         const pk = hex(buf.subarray(5, 69));
-        void deliver(pk, new Uint8Array(buf.subarray(69))).then((back) => {
-          const head = new Uint8Array(5);
-          head[0] = back === undefined ? NONE : REPLY;
-          new DataView(head.buffer).setUint32(1, id);
-          if (line.readyState === OPEN) line.send(back === undefined ? head : concat(head, back));
-        });
+        // A deliver that rejects has delivered nothing this side can vouch
+        // for, and a listener does not die of it: the far side hears none.
+        void deliver(pk, new Uint8Array(buf.subarray(69)))
+          .then(
+            (back) => back,
+            () => undefined,
+          )
+          .then((back) => {
+            const head = new Uint8Array(5);
+            head[0] = back === undefined ? NONE : REPLY;
+            new DataView(head.buffer).setUint32(1, id);
+            if (line.readyState === OPEN) line.send(back === undefined ? head : concat(head, back));
+          });
         return;
       }
       const waiting = this.pending.get(id);
@@ -171,6 +197,7 @@ export class Socket implements Reach {
     new DataView(head.buffer).setUint32(1, id);
     head.set(unhex(pk), 5);
     return new Promise((ok) => {
+      if (this.pending.size >= PENDING) this.pending.delete(this.pending.keys().next().value!); // the oldest, which the ward's bound ended long ago
       this.pending.set(id, ok);
       this.line.send(concat(head, bytes));
     });

package/src/ward/allowance.ts

@@ -5,7 +5,7 @@
 // is held to the ward's ceiling. The door reads it before anything is done
 // under it and refuses a budget already gone, as one silence like every other
 // refusal there. The sender bounds the whole of her ask to the same number,
-// and a wait that ran out is silence, never unreached.
+// and a wait that ran out is the word late, never silence and never unreached.
 //
 // Each ask is bounded on its own. The time an arriving call has left does not
 // bound the asks a being makes while answering it: attributing her onward ask
@@ -33,7 +33,13 @@ export const CEILING: Allowance = { time: 300_000 };
 // is thirty seconds, silently, because the ceiling is not hers to know.
 // Asking for nothing at all is the default, which is the whole point.
 export function allow(wanted: Wanted | undefined, ceiling: Allowance = CEILING, base: Allowance = DEFAULT): Allowance {
-  const whole = (n: unknown, fallback: number) => (typeof n === 'number' && Number.isFinite(n) && n > 0 ? Math.floor(n) : fallback);
+  // Floored first, then tested: a fraction of a millisecond is not a budget,
+  // and falls to the default like every other number that is not a positive
+  // whole one.
+  const whole = (n: unknown, fallback: number) => {
+    const w = typeof n === 'number' ? Math.floor(n) : NaN;
+    return Number.isFinite(w) && w > 0 ? w : fallback;
+  };
   return { time: Math.min(whole(wanted?.time, base.time), ceiling.time) };
 }
 

package/src/ward/arithmetic.ts

@@ -8,7 +8,6 @@
 // runs on. `test/floor.test.ts` names the floor and probes for it. Subtle is
 // asynchronous, so everything here is.
 //
-// Ported from an earlier kit's arithmetic. Same bytes, same vectors.
 // `crypto.subtle` is read at every use and never captured at load. A browser
 // on a plain http:// origin has `crypto` without `subtle`, and a terrain may
 // install one after this module is first imported; a reference taken here
@@ -59,7 +58,12 @@ export function sameBytes(a: Uint8Array, b: Uint8Array): boolean {
   return diff === 0;
 }
 
-// The eight small-order points. A public key among them verifies nothing.
+// The eight small-order points of Ed25519, in their canonical encoding. A
+// public key among them verifies nothing. An encoding whose y coordinate is
+// not reduced, y at or above the field's prime p, names one of the same
+// points under another spelling, and a terrain's verify may accept a zero
+// signature under it; the field has room for the spelling, so it is refused
+// before the list is read.
 const SMALL_ORDER = [
   '0100000000000000000000000000000000000000000000000000000000000000',
   'ecffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff7f',
@@ -70,7 +74,11 @@ const SMALL_ORDER = [
   '26e8958fc2b227b045c3f489f2ef98f0d5dfac05d3c63339b13802886d53fc85',
   'c7176a703d4dd84fba3c0b760d10670f2a2053fa2c39ccc64ec7fd7792ac03fa',
 ].map(unhex);
-export const smallOrder = (pk: Uint8Array): boolean => SMALL_ORDER.some((p) => sameBytes(p, pk));
+// y >= p, read little-endian with the sign bit masked off: the top byte is
+// 0x7f under the mask, every middle byte is 0xff, and the low byte is at
+// least 0xed, which is p's.
+const unreduced = (pk: Uint8Array): boolean => (pk[31] & 0x7f) === 0x7f && pk[0] >= 0xed && pk.subarray(1, 31).every((b) => b === 0xff);
+export const smallOrder = (pk: Uint8Array): boolean => unreduced(pk) || SMALL_ORDER.some((p) => sameBytes(p, pk));
 
 const key32 = (value: Uint8Array, what: string): Uint8Array => {
   if (!(value instanceof Uint8Array) || value.length !== KEY) throw new Error(`${what} is not a 32-byte key`);