nervur 0.13.0 → 0.15.0

package/package.json

@@ -1,25 +1,24 @@
 {
   "name": "nervur",
-  "version": "0.13.0",
-  "description": "A distributed system of sovereign beings — one door, one question: by whose authority.",
+  "version": "0.15.0",
+  "description": "Nervur grown on the Quo kit: the graph, the organs and the floor, with @quo-systems/js as the whole of the protocol",
   "license": "Apache-2.0",
   "author": "Razvan Gherghina",
-  "homepage": "https://nervur.org",
   "type": "module",
+  "sideEffects": false,
   "exports": {
-    ".": "./index.mjs"
+    ".": "./src/index.js"
   },
-  "files": [
-    "*.mjs",
-    "GETTING-STARTED.md",
-    "NOTICE",
-    "SECURITY.md"
-  ],
   "engines": {
     "node": ">=22"
   },
   "dependencies": {
-    "@noble/curves": "2.3.0",
-    "graphql": "^17.0.2"
-  }
+    "@quo-systems/js": "0.0.3",
+    "graphql": "17.0.2"
+  },
+  "files": [
+    "src",
+    "LICENSE",
+    "README.md"
+  ]
 }

package/src/being.js

@@ -0,0 +1,125 @@
+import { Refusal, parse, recordsOf, encode, decodeAll } from '@quo-systems/js';
+import { contract as read } from './contract.js';
+import { program } from './program.js';
+import { project } from './projection.js';
+
+const refuse = (code, detail) => {
+  throw new Refusal(code, detail);
+};
+
+// A being is a contract and its resolvers, and nothing else. The contract is a
+// GraphQL schema — authoring, and authoring only — projected to a Quo blueprint
+// before anything holds it, so the warden gets the notation it has always got
+// and a stranger implementing Quo elsewhere reads a blueprint like any other.
+//
+// A being is compiled by `program`, which compiles organs too and cannot tell
+// which it is holding. What this file adds is the wire skin the kit leaves
+// open: bytes in and bytes out, and the object the warden dispatches from.
+//
+// Two things are Nervur's to keep, and the law is what asks for them. "What a
+// blueprint does not declare does not exist," and "granting a being is granting
+// every field it declares" — together they make the declared set the scope of a
+// grant. A held object with a method the blueprint never named would answer
+// callers anyway, which is a grant that grants more than its digest says.
+//
+// A being is raised rather than built: the organs it declared with
+// `schema @needs(organs: [...])` are supplied by the ground at `hold`, and the
+// resolvers are closed over them. Reach is a fact about a being, not about a
+// call, so it arrives once — and that is what makes the refusal structural. An
+// organ the being did not declare is not absent from a check; it is absent from
+// the object, and there is nothing to police.
+//
+// `contacts` arrives the same way, as the resolver factory's second argument.
+// What is closed over is a **reader**, not a value: reach is fixed at raise and
+// contacts are not, so `list()` goes to the warden's record at the moment it is
+// called and there is nothing here to go stale.
+export function being(sdl, resolvers) {
+  const held = read(sdl);
+  const text = project(held);
+  const blueprint = parse(text);
+  const records = recordsOf(blueprint);
+
+  const raise = (supplied = {}, contacts = null) =>
+    object(held, blueprint, records, resolvers, supplied, contacts);
+  // A being that cannot stand should say so at once rather than at a hold. But
+  // only where saying so costs nothing: a resolver factory may allocate, or
+  // register itself somewhere, and running it speculatively would do that twice
+  // for a being with no organs and once for a being with them. So a plain set
+  // of resolvers is checked here, and a factory is run exactly once, at hold.
+  if (held.needs.length === 0 && typeof resolvers !== 'function') raise();
+
+  return Object.freeze({
+    contract: text,
+    organs: Object.freeze([...held.needs]),
+    raise,
+    schema: sdl,
+  });
+}
+
+function object(held, blueprint, records, resolvers, supplied, contacts) {
+  // The ground offers; the being takes what its schema declared. Two
+  // narrowings, and an organ offered but not needed is simply not taken — a
+  // ground handing the same tray to every being it holds is the ordinary case.
+  const reach = {};
+  for (const alias of held.needs) {
+    if (!supplied[alias]) refuse('ORGAN_MISSING', alias);
+    reach[alias] = supplied[alias];
+  }
+  const organs = Object.freeze(reach);
+
+  const built = typeof resolvers === 'function' ? resolvers(organs, contacts) : resolvers;
+
+  // Both halves of the mismatch are refused, and refused here rather than at a
+  // call: a being that stands and then falls over on one field is a being whose
+  // digest lied to everyone who read it. `hasOwn`, not a bare lookup — a
+  // contract declaring `toString` would otherwise be satisfied by
+  // `Object.prototype`'s, and a resolver is a thing an author wrote, not a
+  // thing a prototype happens to supply.
+  for (const field of Object.keys(held.fields)) {
+    if (!Object.hasOwn(built, field) || typeof built[field] !== 'function') {
+      refuse('NO_RESOLVER', field);
+    }
+  }
+  // A resolver the contract does not declare is unreachable by design. Silence
+  // would hide the likelier cause — a name that does not match — so it is an
+  // error instead.
+  for (const name of Object.keys(built)) {
+    if (!Object.hasOwn(held.fields, name)) refuse('UNDECLARED_RESOLVER', name);
+  }
+
+  const one = program(held, built);
+
+  // No prototype, and this is the gate rather than a tidiness. The kit
+  // dispatches with `object[name]` and `typeof === 'function'`, and an
+  // inherited method passes both — a plain object here answers a sealed ask for
+  // `constructor`, because `Object` is a function and hands back the very bytes
+  // it was called with, which is exactly what the warden accepts as an answer.
+  // Freezing does not help: freezing does not remove a prototype.
+  const table = Object.create(null);
+  for (const field of blueprint.fields) {
+    const types = field.args.map((argument) => argument.type);
+    const names = field.args.map((argument) => argument.name);
+
+    // The kit's signature: bytes in, bytes or nothing out. A resolver sees
+    // neither. It sees its arguments by the names its contract gave them, and
+    // its leash — never a caller, never an address, because a being learns
+    // neither and Nervur does not soften it.
+    table[field.name] = async (bytes, leash) => {
+      const values = decodeAll(types, bytes, records);
+      const answered = await one.answer(
+        field.name,
+        Object.fromEntries(names.map((name, at) => [name, values[at]])),
+        leash,
+      );
+      // A field declaring no answer answers nothing, and that is an answer: the
+      // door sends an envelope with no data in it.
+      if (!field.answer) return undefined;
+      // An answer that does not fit its declared type never leaves. `encode`
+      // refuses it, the warden's global catch turns that into silence, and
+      // silence is the only refusal a door can express.
+      return encode(field.answer, answered, records);
+    };
+  }
+
+  return Object.freeze(table);
+}

package/src/contract.js

@@ -0,0 +1,161 @@
+import { parse as parseGraphQL } from 'graphql';
+import { Refusal } from '@quo-systems/js';
+
+// What a thing answers, read once from its own text. A being's contract and an
+// organ's contract are the same file under the same name, because they are one
+// kind of code — so there is one reader here and no second one anywhere.
+//
+// The contract is a GraphQL schema. That is authoring and nothing else: it
+// never reaches the wire, is never an answer, and is never a describe. Every
+// implementer of Quo speaks the notation and has never heard of Nervur, so a
+// contract is projected to a Quo blueprint at the ground's edge and that
+// projection is the only boundary.
+//
+// A contract carries no identity of its own. The being's name is the digest of
+// its projected blueprint, which the warden takes, and a second identity taken
+// over the GraphQL bytes would be a second truth about the same thing.
+
+const refuse = (code, detail) => {
+  throw new Refusal(code, detail);
+};
+
+const OPERATIONS = Object.freeze(['query', 'mutation', 'subscription']);
+
+const named = (node) => node.name.value;
+
+// A field's type, flattened to the name it ends at, whether it is a list, and
+// whether the caller must give it. GraphQL is nullable by default and says so
+// by omission; the projection is where that becomes `?`, not here.
+const inner = (node) => (node.kind === 'NamedType' ? named(node) : inner(node.type));
+
+const typed = (node) =>
+  node.kind === 'NonNullType'
+    ? { ...typed(node.type), required: true }
+    : node.kind === 'ListType'
+      ? { list: true, of: inner(node.type), required: false, element: typed(node.type) }
+      : { of: named(node), required: false };
+
+// What a contract says it needs to work, written in the schema itself:
+//
+//   schema @needs(organs: ["book", "far"]) { query: Clerk }
+//
+// It is a need and never a binding. A contract is written to stand on any
+// ground, so it names what it must reach and says nothing about whose
+// implementation answers.
+//
+// Undeclared is unreachable, and never by a check: a contract that never asked
+// for an organ does not have it and cannot learn that it exists, because the
+// object it is handed has no such key.
+const needed = (definition) => {
+  for (const directive of definition?.directives ?? []) {
+    if (directive.name.value !== 'needs') continue;
+    const organs = (directive.arguments ?? []).find((one) => one.name.value === 'organs');
+    if (organs?.value?.kind !== 'ListValue') refuse('BAD_NEEDS', 'organs must be a list of names');
+    return organs.value.values.map((one) => {
+      if (one.kind !== 'StringValue') refuse('BAD_NEEDS', 'an organ is named by a string');
+      return one.value;
+    });
+  }
+  return [];
+};
+
+// Which type is the root of each operation. GraphQL's own `schema` block names
+// them, and that is where the being's name comes from — `schema { query: Clerk }`
+// makes a class block called `Clerk`. With no `schema` block the conventional
+// type names stand in, which is the plain form every engineer already writes.
+const rooted = (definition) => {
+  const roots = { query: 'Query', mutation: 'Mutation', subscription: 'Subscription' };
+  for (const operation of definition?.operationTypes ?? []) {
+    roots[operation.operation] = named(operation.type);
+  }
+  return roots;
+};
+
+const fieldsOf = (definition) =>
+  Object.fromEntries(
+    (definition.fields ?? []).map((field) => [
+      named(field),
+      Object.freeze({
+        args: Object.freeze(
+          Object.fromEntries(
+            (field.arguments ?? []).map((one) => [named(one), Object.freeze(typed(one.type))]),
+          ),
+        ),
+        answers: Object.freeze(typed(field.type)),
+      }),
+    ]),
+  );
+
+export function contract(sdl) {
+  if (typeof sdl !== 'string') refuse('NOT_A_SCHEMA', typeof sdl);
+  let document;
+  try {
+    document = parseGraphQL(sdl);
+  } catch (error) {
+    refuse('UNREADABLE_SCHEMA', error.message);
+  }
+
+  const schema = document.definitions.find(
+    (one) => one.kind === 'SchemaDefinition' || one.kind === 'SchemaExtension',
+  );
+  const roots = rooted(schema);
+  const rootNames = new Set(Object.values(roots));
+
+  const objects = new Map();
+  const inputs = new Map();
+  for (const definition of document.definitions) {
+    if (definition.kind === 'ObjectTypeDefinition') {
+      if (objects.has(named(definition))) refuse('DUPLICATE_TYPE', named(definition));
+      objects.set(named(definition), definition);
+      continue;
+    }
+    if (definition.kind === 'InputObjectTypeDefinition') {
+      if (inputs.has(named(definition))) refuse('DUPLICATE_TYPE', named(definition));
+      inputs.set(named(definition), definition);
+      continue;
+    }
+    if (definition.kind === 'SchemaDefinition' || definition.kind === 'SchemaExtension') continue;
+    // Everything else — interfaces, unions, enums, fragments, an operation —
+    // is a thing the notation has no word for, and a contract carrying one is
+    // refused where it is read rather than guessed at where it is projected.
+    refuse('NO_WORD', definition.kind);
+  }
+
+  // Every root field, flat, with the operation it stands under. This is what a
+  // caller may ask, and there is no register of fields anywhere else.
+  // Resolvers are flat under the contract, not nested under a root: one
+  // contract is one class block in the notation, so a field name is unique
+  // across the whole contract and a second layer would name nothing.
+  const fields = {};
+  for (const operation of OPERATIONS) {
+    const definition = objects.get(roots[operation]);
+    if (!definition) continue;
+    for (const [name, one] of Object.entries(fieldsOf(definition))) {
+      if (Object.hasOwn(fields, name)) refuse('DUPLICATE_FIELD', name);
+      fields[name] = Object.freeze({ ...one, operation });
+    }
+  }
+  if (Object.keys(fields).length === 0) refuse('NO_FIELDS', 'a contract that answers nothing');
+
+  // The name a being wears: the query root's, or the mutation root's where a
+  // contract only writes. One contract is one class block, so one name.
+  const name = objects.has(roots.query)
+    ? roots.query
+    : objects.has(roots.mutation)
+      ? roots.mutation
+      : roots.subscription;
+
+  const records = {};
+  for (const [typeName, definition] of [...objects, ...inputs]) {
+    if (rootNames.has(typeName)) continue;
+    records[typeName] = Object.freeze(fieldsOf(definition));
+  }
+
+  return Object.freeze({
+    fields: Object.freeze(fields),
+    name,
+    needs: Object.freeze([...new Set(needed(schema))]),
+    records: Object.freeze(records),
+    sdl,
+  });
+}

package/src/ground.js

@@ -0,0 +1,273 @@
+import { Warden, commitment, readAnswer, reach, signingPair } from '@quo-systems/js';
+import { serve } from '@quo-systems/js/door';
+
+const same = (a, b) => a.length === b.length && a.every((byte, at) => byte === b[at]);
+
+// The kit keys both of its records by a pk's hex, and does not export the
+// spelling. Zero dependencies and no host API: this is the whole of it.
+const hex = (bytes) => [...bytes].map((byte) => byte.toString(16).padStart(2, '0')).join('');
+
+// One process, many beings, exactly one door. The kit's `Warden` is the door
+// and everything behind it, so a ground is a closure over one warden and
+// nothing else — Nervur adds no protocol of its own, ever.
+//
+// The instance is closed over rather than returned. Nervur is written
+// Crockford: factory functions, no `this` at a call site, frozen surfaces. A
+// warden handed to a caller is a warden whose methods must be called bound,
+// which puts the kit's class idiom in Nervur's hands. It stops here.
+//
+// Every seed and every draw of randomness arrives as an argument, the way the
+// kit takes them. A ground that reached for entropy would be a ground the
+// bench cannot replay.
+export async function ground({ nameSeed, padlockSeed, heirSeed, hints = [], limit = 0n }) {
+  const warden = await Warden.open({ nameSeed, padlockSeed, heirSeed, hints, limit });
+
+  // The half of an invitation the kit's record has nowhere to keep: the heir
+  // this ground rotates to the first time it spends the relation. An
+  // invitation hands over the heir keys and nothing else, so the holder's
+  // first ask must arrive as a rotation carrying a commitment to a successor
+  // the granting house has never seen. Meeting that once is a trap; meeting it
+  // at every call site is the trap kept. So `remember` derives the successor
+  // and `ask` spends it, and a caller never learns the difference.
+  const rotations = new Map();
+
+  // A relation is named by the being that spends it and the house it stands
+  // at, never by a handle: a handle passed around is a relation one being can
+  // spend on another's behalf, and the whole point of the outbound record is
+  // that it cannot.
+  const relationFor = (from, at) => {
+    for (const row of warden.relationsOf(from)) if (same(row.warden, at)) return row;
+    return null;
+  };
+
+  // Contacts: who reaches this being, and the two acts that change it. Quo
+  // keeps the record and refuses to have an opinion about it — it has no word
+  // for member, owner or guest and must not, because a protocol a stranger
+  // implements in another language cannot carry meanings. The opinion is
+  // Nervur's, and this is where it lives. Nothing is copied: `list` walks the
+  // warden's own inbound record at the moment it is asked, `admit` is the
+  // warden's `grant`, `remove` is the warden's `amend`.
+  //
+  // The warden holds the record the other way round — voice to beings — so the
+  // inverse is derived here rather than kept, because a second index is a
+  // second truth and the first one moves without telling it.
+  //
+  // The scoping is the design, and it is structural rather than a check that
+  // refuses: `beingPk` is shut inside this closure at mint, so a being's
+  // context has no address it could name to reach another's row. The same
+  // shape `errand` uses for a relation.
+  const contacts = (beingPk) => {
+    const at = hex(beingPk);
+    const reaches = (row) => row.beings.has(at);
+    return Object.freeze({
+      // The voices that reach this being, read live.
+      list: () => [...warden.inbound.values()].filter(reaches).map((row) => row.voice),
+
+      // Mint a voice against this being and hand back the invitation. A being
+      // still cannot mint standing — it has no warden — and this does not give
+      // it one: what it has is a reach the ground minted for it, at one being.
+      admit: (keys) => warden.grant(beingPk, keys),
+
+      // Take this being out of that voice's row, and nothing else. A voice that
+      // does not reach this being is not amended at all — the warden would
+      // answer true to a removal that removed nothing, and a being told its act
+      // succeeded when it touched no record has been told a lie.
+      remove: (voicePk) => {
+        const row = warden.standing(voicePk);
+        if (!row || !reaches(row)) return false;
+        return warden.amend(voicePk, { remove: [beingPk] });
+      },
+    });
+  };
+
+  // The one act of spending a relation, written once. `ask` below is a caller
+  // of it and so is every organ minted by `errand`, because they are the same
+  // act: seal down a relation, move it, read what came back. A second copy of
+  // this would be a second place the first-ask rotation could be forgotten.
+  // `leash`, where there is one, is the call this ask is made in the course of.
+  // It is handed to the kit rather than read here: what may go onward is the
+  // difference between when the message arrived and this moment, and only the
+  // kit can take the second reading at the moment of sealing. A being holding a
+  // leash therefore cannot widen an allowance even by mistake, which is the
+  // whole reason the remainder never passes through the being as a number.
+  const spend = async ({ from, at, being, method, allowance, leash = null, random }) => {
+    const row = relationFor(from, at);
+    if (!row) throw new Error('no relation');
+    const rotation = rotations.get(row) ?? null;
+    // Spent whether or not an answer comes back: the far door rotates the
+    // standing at step three, long before it decides whether to speak.
+    rotations.delete(row);
+    const envelope = await warden.ask(row, {
+      seq: row.seq + 1n,
+      commitment: rotation,
+      allowance,
+      leash,
+      being,
+      method,
+      random,
+    });
+    // An ask that could not be judged is not made, and the kit says so by
+    // handing back nothing to send.
+    if (!envelope) return null;
+    const answer = await reach(row.hints, envelope);
+    if (answer === null) return null;
+    return readAnswer({
+      envelope: answer,
+      padlockSecret: warden.padlock.secret,
+      wardenPk: row.warden,
+    });
+  };
+
+  return Object.freeze({
+    // What a stranger holds: the door's name, its commitment, its padlock and
+    // where to reach it. No voice, so it opens nothing.
+    card: () => warden.card(),
+
+    // The door's own being — the one every voice reaches, holders included.
+    publicBeing: () => warden.publicBeing(),
+
+    // Hold a being: what is held is a contract and its resolvers together,
+    // never an object and a blueprint that happen to have been handed in at
+    // the same moment. Those two can disagree, and the whole meaning of a
+    // digest rests on their not disagreeing.
+    //
+    // The organs are supplied here, which is what "scoped by the ground"
+    // means: the ground decides what is on the tray, and the being takes only
+    // what it declared. A being cannot reach for one that was never offered,
+    // and cannot be given one it never asked for.
+    // The contacts context is minted here, per hold, over this being's own
+    // name — derived from the seed the way the kit derives it, because the
+    // being must be shut inside its own context and the hold that names it has
+    // not happened yet.
+    hold: async (one, { seed, heirSeed, cells, organs }) => {
+      const pk = (await signingPair(seed)).pk;
+      return warden.hold(one.raise(organs, contacts(pk)), {
+        seed,
+        heirSeed,
+        cells,
+        blueprint: one.contract,
+      });
+    },
+
+    // Mint a voice and write the standing that lets it reach one being.
+    grant: (being, keys) => warden.grant(being, keys),
+
+    // The other direction: record an invitation this ground was handed, and say
+    // which of its beings spends it. A relation nobody here owns belongs to the
+    // ground itself and travels nowhere, which is a different thing and not
+    // this; a being is named, always.
+    //
+    // What comes back reads the relation and cannot move it. `seq` is the count
+    // kept against that far door, which is the one fact a caller has any
+    // business watching.
+    remember: async (invitation, { being, heirSeed }) => {
+      const row = warden.remember(invitation, { being });
+      const next = await signingPair(heirSeed);
+      rotations.set(row, await commitment(invitation.warden, next.pk));
+      return Object.freeze({
+        warden: invitation.warden,
+        being,
+        hints: () => [...row.hints],
+        seq: () => row.seq,
+      });
+    },
+
+    // Spend a relation: seal the ask down it, post it at the hints the
+    // invitation carried, and read the answer back. All four acts are the
+    // kit's — `ask`, `carry` under it, `reach`, `readAnswer` — and what is
+    // Nervur's is only which relation, which number, and the padlock secret
+    // staying inside this closure.
+    //
+    // The number is this ground's to pick, not a caller's: a relation that
+    // repeats one is a relation the far door refuses, and a caller counting by
+    // hand is a caller that will eventually get it wrong.
+    //
+    // `random` is the **drawn bytes** for this one seal, as at `judge` and
+    // unlike `listen`, because here the ground has one message and not a
+    // stream of them.
+    //
+    // Silence and unreachable are told apart, and they must be: silence is
+    // `null`, the far house having judged and said nothing, while a road that
+    // does not answer throws out of the carriage. Only one of the two means the
+    // far house said no. A being spending a relation it does not hold is
+    // neither — it is a fault at home, and it throws before a byte moves.
+    ask: ({ from, at, being = null, method = null, allowance, random }) =>
+      spend({ from, at, being, method, allowance, random }),
+
+    // The organ that crosses. Everything above is the ground talking to another
+    // house; this is how a being does it, and a being may do it no other way.
+    //
+    // What is minted is a reach and nothing more. The being does not hold the
+    // warden, does not hold the relation, and cannot name a house: `from` and
+    // `at` are shut inside this closure at mint, so an organ is one road to one
+    // house on behalf of one being. That is what keeps it unspendable twice —
+    // there is nothing here to copy and point elsewhere.
+    //
+    // Which being at the far house is still the caller's to name, because the
+    // standing the invitation carries is what decides that, and it is judged
+    // over there. An organ that filtered it here would be this house guessing
+    // at the far house's answer.
+    //
+    // The leash is handed in rather than chosen, and it is the one the door
+    // gave the resolver. The being passes it on whole and never a number read
+    // off it: what may go onward is this door's dwell subtracted at the moment
+    // of sealing, which is later than any moment the being could have read. So
+    // the remainder reaches the far house without the being having chosen it,
+    // and a being cannot hand its organ a wider allowance than it received. The
+    // ground adds no arithmetic of its own — a leash that has run out is
+    // refused by the kit at the moment of carrying, and shows up here as
+    // silence.
+    //
+    // `random` is a **function** the organ draws from per message, as at
+    // `listen` and unlike `judge`: an organ has a stream of messages ahead of
+    // it and not one, and a seal that reused its bytes would be a seal.
+    errand: ({ from, at, random }) =>
+      Object.freeze({
+        ask: (leash, { being = null, method = null } = {}) =>
+          spend({ from, at, being, method, leash, random: random() }),
+      }),
+
+    // The whole of the door: bytes in, bytes or silence out.
+    //
+    // `random` here is the **drawn bytes** for this one judgment. At `listen`
+    // below it is a **function** the host draws from, once per message. The
+    // two differ because the drawing belongs to whoever has messages to count,
+    // and that is the host — so a ground handed a function here would meet
+    // every ask with silence, the warden's global catch turning the fault into
+    // the same refusal as everything else.
+    judge: (envelope, terrain) => warden.judge(envelope, terrain),
+
+    // Listen. This is the one place the warden is handed anywhere, and it goes
+    // to the kit's own host adapter rather than out of this closure — the door
+    // is the half of the carriage that cannot be portable, so a ground that
+    // only calls out never reaches this and never imports a host's API.
+    //
+    // The hint that comes back is the whole address: Quo posts to it exactly
+    // as given. `close` drops the listening socket and the keep-alive
+    // connections with it, because a door that waits for the last idle caller
+    // to time out is a door that never shuts.
+    // A door holds callers to the limit its warden publishes, because a
+    // published limit nobody enforces is worse than none — a caller can
+    // compute it before sending and would be told the truth about a door that
+    // then reads anything. A warden that publishes zero has stated no limit,
+    // so nothing is enforced; the kit's door spells that `null`.
+    //
+    // A ground that declared no hints publishes the one it just got: an
+    // ephemeral port is not knowable before the socket is open, so a ground
+    // could otherwise only ever grant invitations with no road in them. A
+    // ground that declared its own hints keeps them — it knows where it is
+    // reachable from and a loopback address appended to that would be a road
+    // no stranger can take.
+    listen: async ({ clock, random, host, port, limit } = {}) => {
+      const door = await serve(warden, {
+        clock,
+        random,
+        host,
+        port,
+        limit: limit ?? (warden.limit > 0n ? warden.limit : null),
+      });
+      if (warden.hints.length === 0) warden.hints = [door.hint];
+      return door;
+    },
+  });
+}

package/src/index.js

@@ -0,0 +1,5 @@
+export { ground } from './ground.js';
+export { being } from './being.js';
+export { contract } from './contract.js';
+export { program } from './program.js';
+export { project } from './projection.js';