nervur 0.15.0 → 0.16.0

package/LICENSE

@@ -1,3 +1,4 @@
+
                                  Apache License
                            Version 2.0, January 2004
                         http://www.apache.org/licenses/
@@ -178,7 +179,7 @@
    APPENDIX: How to apply the Apache License to your work.
 
       To apply the Apache License to your work, attach the following
-      boilerplate notice, with the fields enclosed by brackets "{}"
+      boilerplate notice, with the fields enclosed by brackets "[]"
       replaced with your own identifying information. (Don't include
       the brackets!)  The text should be enclosed in the appropriate
       comment syntax for the file format. We also recommend that a

package/NOTICE

@@ -0,0 +1,6 @@
+Quo
+Copyright 2026 Razvan Gherghina
+
+This product includes software developed by Razvan Gherghina.
+
+Licensed under the Apache License, Version 2.0. See LICENSE for the terms.

package/README.md

@@ -1,152 +1,32 @@
 # nervur
 
-Nervur grown on the working Quo kit. It imports `@quo-systems/js` and adds no
-protocol
-of its own — no wire, no envelope, no judgment, no arithmetic, ever. What
-Nervur is for begins where the constitution stops: the graph, the organs, the
-floor, and the projection from an authored contract into Quo blueprints.
+Quo is a protocol that lets an object ask another object and get an answer,
+without knowing whether that other object is in the same process, on the
+same device, or on another planet. Nervur's kit is its first implementation,
+open source, three packages under the `@nervur-org` scope.
 
-## The rules of this build
+This package is the unscoped twin of that scope. `import` from it and you
+have the library; run it and you have the dock's command:
 
-1. **`@quo-systems/js` is the whole of the protocol.** It is crossed by its
-   specifier,
-   never by a path. A gap the kit shows is reported to the quo table, never
-   patched here.
-2. **nervur-dream is parked beside this, as reference.** Its mechanics may be
-   lifted — the compiler, the contract reader, the `@needs` directive. Its
-   judgement may not: what a thing enforces, refuses or means is authored fresh
-   against the constitution as it stands today, because dream was built against
-   a protocol that no longer exists.
-3. **Crockford.** Factory functions, closures for privacy, no `this`, frozen
-   surfaces. The kit's class idiom stops at its specifier: the ground factory
-   is the one place a `Warden` instance lives, closed over and never returned.
-4. **One played bench question at a time.** Doubt is settled on the bench, not
-   argued. Nothing lands without an assert that would fail if it broke.
-5. **A being never learns who is calling, but it knows who may reach it.** The
-   first half is the kit's doing: the warden places a voice at step three and
-   hands the field its arguments and its leash, never the caller. Which being
-   was reached already says who called. The second half is Nervur's: the warden
-   keeps the record of which voices reach which beings, and a being is handed
-   its own row to read and to change. No rights and no roles — those are
-   meanings, and the record holds none.
-
-## What stands
-
-**`ground()`** — one closure over one warden, holding beings and judging what
-arrives. `bench/ground.test.js` walks it end to end: a real sealed ask, a real
-answer, and silence where a standing does not reach.
-
-**The outbound relation** — `remember` records an invitation this ground was
-handed and names which of its beings spends it; `ask` seals down that relation,
-posts it at the hints the invitation carried, and reads the answer back. Every
-one of those acts is the kit's. What is Nervur's is the ergonomics: a relation
-is found by whose it is, so one being cannot spend another's; the number is the
-ground's to pick, so no caller counts by hand; and the first ask carries the
-rotation an invitation's heir keys oblige, so nobody meets that trap twice.
-`bench/estate.test.js` stands two houses on two real loopback doors and crosses
-between them.
-
-Silence, unreachable and a relation that is not yours are three different
-things and stay three: silence is `null`, a road that does not answer throws
-out of the carriage, and spending what a being does not hold throws before a
-byte moves.
-
-**`contract(sdl)` and `program(contract, resolvers)`** — the compiler, and
-there is exactly one of it. A being and an organ are both a contract plus
-resolvers, and `program` cannot tell which it is holding; that is not a
-convenience, it is the architecture. A field is read with `hasOwn` and never
-through the prototype chain, exactly the declared arguments reach a resolver
-and no others, a resolver short of a required argument is not called at all,
-and a resolver that throws is answered as silence — nothing here promises that
-an ask is fulfilled, so a refusal a caller must tell apart is carried in the
-answer type instead. `bench/program.test.js` asserts every one of those, and
-asserts the first on a being and an organ side by side.
-
-**The contract is a GraphQL schema** — schema, resolvers and a context, the
-shape every engineer already knows. It is authoring and nothing else: never at
-the wire, never an answer, never a describe. The organs a being reaches outward
-with are declared in the schema itself, with `schema @needs(organs: [...])`,
-and the being's own name is the root type's — `schema { query: Clerk }`.
-
-**`project(contract)`** — the boundary, and there must be exactly one of it.
-Every implementer of Quo speaks the notation and has never heard of Nervur, so
-a contract becomes a Quo blueprint in the kit's own notation before anything
-holds it, and what a stranger verifies is that blueprint's digest. GraphQL is
-nullable by default and the notation is required by default, so `String!`
-becomes `text` and `String` becomes `text?`; the schema's other object and
-input types become record blocks, and their ordering is the notation's own law
-and therefore the kit's `print` to judge. Where GraphQL says something the
-notation has no word for — `Float`, `ID`, an enum, a union, an interface, a
-record field that takes arguments — the contract is refused at build rather
-than guessed at. One word runs the other way: the notation has a field that
-answers nothing and GraphQL insists every field has a type, so `Nothing` in
-answer position is that field's spelling. `bench/projection.test.js` holds it.
-
-**`being(sdl, resolvers)`** — a schema and ordinary functions under it. It is
-compiled by `program` like anything else; what it adds is the wire skin the kit
-leaves open, and the two promises the kit leaves to Nervur: a resolver meets
-its arguments as named values and never bytes, and a being answers **exactly**
-the fields its contract declares. That second one is the gate the digest's
-meaning rests on — the law says what a blueprint does not declare does not
-exist, and the kit dispatches on whatever methods the held object happens to
-have.
-
-**Organs** — the only way a being _acts_ outward. That is not a style choice:
-a being has no warden and no caller, so it cannot mint standing and a field
-answering another being's name hands over a label rather than reach. What it
-can still do is pass on standing it was already given — the constitution says
-data can carry an `invitation`, and an invitation carries the heir keys — so
-"a being cannot hand over reach" is false as a general claim and only the
-minting half is true. A being names the organ aliases it needs in its own
-schema, the ground supplies them at `hold`, and the resolvers are closed over
-exactly those. An organ the schema never asked for is not absent from a check —
-it is absent from the object.
-
-**The organ that crosses** — `errand` mints the reach a being uses to speak to
-another house. It is shut over which being spends the relation and which house
-it stands at, so a being holds one road on its own behalf and nothing it could
-point elsewhere; it never holds the warden and never holds the relation. Which
-being at the far house is still the caller's to name, because the standing
-decides that and the standing is judged over there. The **leash** is handed in
-rather than chosen — the resolver passes on the one the door gave it, whole and
-never a number read off it, because what may go onward is this door's dwell
-subtracted at the moment of sealing, which is later than any moment the being
-could have read. So the remainder reaches the far house without the being
-having chosen it, and a being cannot hand its organ more than it received.
-`bench/errand.test.js` serves one sealed ask at the near house by crossing to
-the far one and answering with what came back.
-
-**Contacts** — who reaches this being, and the two acts that change it:
-`list()`, `admit(keys)` and `remove(voicePk)`. Every one of them goes to the
-warden's own inbound record — `grant`, `amend`, `standing` — read live at the
-moment it is called and never snapshotted, so a being that admitted someone a
-moment ago sees them. Quo keeps that record and refuses to have an opinion
-about it, having no word for member, owner or guest; the opinion is Nervur's,
-and this is the whole of it. The inverse — voices by being, where the warden
-keeps beings by voice — is derived rather than indexed, because a second index
-is a second truth.
-
-The scoping is structural, the same shape `errand` uses: the context is minted
-per `hold` with the being shut inside the closure, so there is no address it
-could name to reach another being's row. It reaches a resolver as the resolver
-factory's second argument, closed over at raise beside the organs, rather than
-as a third argument to every resolver. `bench/contacts.test.js` proves the
-admission and the removal at the door — a real sealed ask that gets in, and
-then meets silence.
+```bash
+npm install nervur
+npx nervur init
+```
 
-Organs are declared inside the contract, with `schema @needs(organs: [...])`.
-That directive is authoring and never reaches the wire: the projection drops
-it, so the blueprint a stranger reads carries no trace of what a being reaches
-outward with, which is inside-the-ground business the wire never sees.
+| Package | What it is |
+| --- | --- |
+| [`@nervur-org/nervur`](https://www.npmjs.com/package/@nervur-org/nervur) | the library: harbor, ward and being, the protocol itself, with the spec inside |
+| [`@nervur-org/dock`](https://www.npmjs.com/package/@nervur-org/dock) | what every estate on Quo needs and nobody writes twice: the daemon, the command, the model sides and the screen |
+| [`@nervur-org/ui`](https://www.npmjs.com/package/@nervur-org/ui) | the kit: one token contract, one baseline, and the primitives a screen and a website both need. Knows nothing of Quo |
 
-## What is not here yet
+It pins the library and the dock exactly, so that the name stands for one
+kit. Its own number counts up on its own, because a name and what it
+stands for are two things. An estate that wants the pieces apart installs
+them apart.
 
-`own` and the floor, memory, standings and the graph walked across them, the
-per-call caller, ground-as-a-folder, persistence, register-and-invoke,
-collections-as-beings, per-caller beings.
+<https://nervur.org> is the kit. <https://quo.systems> is the protocol.
 
-## The bench
+## License
 
-```bash
-npm run gate-nervur
-```
+Apache-2.0. Copyright 2026 Razvan Gherghina. See [LICENSE](LICENSE) and
+[NOTICE](NOTICE).

package/index.js

@@ -0,0 +1,17 @@
+// SPDX-License-Identifier: Apache-2.0
+// The name, and what stands under it. This package is the unscoped twin of
+// the `@nervur-org` scope: `import ... from 'nervur'` is the library, and
+// `npx nervur` is the dock's command. It pins the two exactly, because a
+// name that stands for the kit stands for one version of it.
+
+export * from '@nervur-org/nervur';
+
+/** The published packages, and what each one is. */
+export const PACKAGES = Object.freeze({
+  '@nervur-org/nervur': 'the library: harbor, ward and being, the first kit of Quo',
+  '@nervur-org/dock': 'what every estate on Quo needs and nobody writes twice',
+  '@nervur-org/ui': 'the kit: one token contract, one baseline, the primitives',
+});
+
+/** Where to read what the kit is. */
+export const HOMEPAGE = 'https://nervur.org';

package/nervur.js

@@ -0,0 +1,5 @@
+#!/usr/bin/env node
+// SPDX-License-Identifier: Apache-2.0
+// `nervur`: the dock's command under the kit's name. Every subcommand is the
+// dock's; this file only finds it.
+import '@nervur-org/dock/cli';

package/package.json

@@ -1,24 +1,42 @@
 {
   "name": "nervur",
-  "version": "0.15.0",
-  "description": "Nervur grown on the Quo kit: the graph, the organs and the floor, with @quo-systems/js as the whole of the protocol",
-  "license": "Apache-2.0",
+  "version": "0.16.0",
+  "description": "Nervur's kit of Quo, under one name: the library re-exported, and the dock's command as nervur. The packages are @nervur-org/nervur, @nervur-org/dock and @nervur-org/ui.",
+  "keywords": [
+    "quo",
+    "nervur",
+    "protocol",
+    "capability",
+    "object-capability"
+  ],
   "author": "Razvan Gherghina",
+  "license": "Apache-2.0",
+  "homepage": "https://nervur.org",
   "type": "module",
-  "sideEffects": false,
+  "engines": {
+    "node": ">=22.18"
+  },
+  "bin": {
+    "nervur": "./nervur.js"
+  },
   "exports": {
-    ".": "./src/index.js"
+    ".": "./index.js"
   },
-  "engines": {
-    "node": ">=22"
+  "scripts": {
+    "prepublishOnly": "test \"$QUO_GATED\" = 1 || { echo 'publish from the root, gated once: npm run release:nervur' >&2; exit 1; }"
   },
   "dependencies": {
-    "@quo-systems/js": "0.0.3",
-    "graphql": "17.0.2"
+    "@nervur-org/dock": "0.3.0",
+    "@nervur-org/nervur": "0.3.0"
+  },
+  "publishConfig": {
+    "access": "public"
   },
   "files": [
-    "src",
+    "index.js",
+    "nervur.js",
+    "README.md",
     "LICENSE",
-    "README.md"
+    "NOTICE"
   ]
 }

package/src/being.js

@@ -1,125 +0,0 @@
-import { Refusal, parse, recordsOf, encode, decodeAll } from '@quo-systems/js';
-import { contract as read } from './contract.js';
-import { program } from './program.js';
-import { project } from './projection.js';
-
-const refuse = (code, detail) => {
-  throw new Refusal(code, detail);
-};
-
-// A being is a contract and its resolvers, and nothing else. The contract is a
-// GraphQL schema — authoring, and authoring only — projected to a Quo blueprint
-// before anything holds it, so the warden gets the notation it has always got
-// and a stranger implementing Quo elsewhere reads a blueprint like any other.
-//
-// A being is compiled by `program`, which compiles organs too and cannot tell
-// which it is holding. What this file adds is the wire skin the kit leaves
-// open: bytes in and bytes out, and the object the warden dispatches from.
-//
-// Two things are Nervur's to keep, and the law is what asks for them. "What a
-// blueprint does not declare does not exist," and "granting a being is granting
-// every field it declares" — together they make the declared set the scope of a
-// grant. A held object with a method the blueprint never named would answer
-// callers anyway, which is a grant that grants more than its digest says.
-//
-// A being is raised rather than built: the organs it declared with
-// `schema @needs(organs: [...])` are supplied by the ground at `hold`, and the
-// resolvers are closed over them. Reach is a fact about a being, not about a
-// call, so it arrives once — and that is what makes the refusal structural. An
-// organ the being did not declare is not absent from a check; it is absent from
-// the object, and there is nothing to police.
-//
-// `contacts` arrives the same way, as the resolver factory's second argument.
-// What is closed over is a **reader**, not a value: reach is fixed at raise and
-// contacts are not, so `list()` goes to the warden's record at the moment it is
-// called and there is nothing here to go stale.
-export function being(sdl, resolvers) {
-  const held = read(sdl);
-  const text = project(held);
-  const blueprint = parse(text);
-  const records = recordsOf(blueprint);
-
-  const raise = (supplied = {}, contacts = null) =>
-    object(held, blueprint, records, resolvers, supplied, contacts);
-  // A being that cannot stand should say so at once rather than at a hold. But
-  // only where saying so costs nothing: a resolver factory may allocate, or
-  // register itself somewhere, and running it speculatively would do that twice
-  // for a being with no organs and once for a being with them. So a plain set
-  // of resolvers is checked here, and a factory is run exactly once, at hold.
-  if (held.needs.length === 0 && typeof resolvers !== 'function') raise();
-
-  return Object.freeze({
-    contract: text,
-    organs: Object.freeze([...held.needs]),
-    raise,
-    schema: sdl,
-  });
-}
-
-function object(held, blueprint, records, resolvers, supplied, contacts) {
-  // The ground offers; the being takes what its schema declared. Two
-  // narrowings, and an organ offered but not needed is simply not taken — a
-  // ground handing the same tray to every being it holds is the ordinary case.
-  const reach = {};
-  for (const alias of held.needs) {
-    if (!supplied[alias]) refuse('ORGAN_MISSING', alias);
-    reach[alias] = supplied[alias];
-  }
-  const organs = Object.freeze(reach);
-
-  const built = typeof resolvers === 'function' ? resolvers(organs, contacts) : resolvers;
-
-  // Both halves of the mismatch are refused, and refused here rather than at a
-  // call: a being that stands and then falls over on one field is a being whose
-  // digest lied to everyone who read it. `hasOwn`, not a bare lookup — a
-  // contract declaring `toString` would otherwise be satisfied by
-  // `Object.prototype`'s, and a resolver is a thing an author wrote, not a
-  // thing a prototype happens to supply.
-  for (const field of Object.keys(held.fields)) {
-    if (!Object.hasOwn(built, field) || typeof built[field] !== 'function') {
-      refuse('NO_RESOLVER', field);
-    }
-  }
-  // A resolver the contract does not declare is unreachable by design. Silence
-  // would hide the likelier cause — a name that does not match — so it is an
-  // error instead.
-  for (const name of Object.keys(built)) {
-    if (!Object.hasOwn(held.fields, name)) refuse('UNDECLARED_RESOLVER', name);
-  }
-
-  const one = program(held, built);
-
-  // No prototype, and this is the gate rather than a tidiness. The kit
-  // dispatches with `object[name]` and `typeof === 'function'`, and an
-  // inherited method passes both — a plain object here answers a sealed ask for
-  // `constructor`, because `Object` is a function and hands back the very bytes
-  // it was called with, which is exactly what the warden accepts as an answer.
-  // Freezing does not help: freezing does not remove a prototype.
-  const table = Object.create(null);
-  for (const field of blueprint.fields) {
-    const types = field.args.map((argument) => argument.type);
-    const names = field.args.map((argument) => argument.name);
-
-    // The kit's signature: bytes in, bytes or nothing out. A resolver sees
-    // neither. It sees its arguments by the names its contract gave them, and
-    // its leash — never a caller, never an address, because a being learns
-    // neither and Nervur does not soften it.
-    table[field.name] = async (bytes, leash) => {
-      const values = decodeAll(types, bytes, records);
-      const answered = await one.answer(
-        field.name,
-        Object.fromEntries(names.map((name, at) => [name, values[at]])),
-        leash,
-      );
-      // A field declaring no answer answers nothing, and that is an answer: the
-      // door sends an envelope with no data in it.
-      if (!field.answer) return undefined;
-      // An answer that does not fit its declared type never leaves. `encode`
-      // refuses it, the warden's global catch turns that into silence, and
-      // silence is the only refusal a door can express.
-      return encode(field.answer, answered, records);
-    };
-  }
-
-  return Object.freeze(table);
-}

package/src/contract.js

@@ -1,161 +0,0 @@
-import { parse as parseGraphQL } from 'graphql';
-import { Refusal } from '@quo-systems/js';
-
-// What a thing answers, read once from its own text. A being's contract and an
-// organ's contract are the same file under the same name, because they are one
-// kind of code — so there is one reader here and no second one anywhere.
-//
-// The contract is a GraphQL schema. That is authoring and nothing else: it
-// never reaches the wire, is never an answer, and is never a describe. Every
-// implementer of Quo speaks the notation and has never heard of Nervur, so a
-// contract is projected to a Quo blueprint at the ground's edge and that
-// projection is the only boundary.
-//
-// A contract carries no identity of its own. The being's name is the digest of
-// its projected blueprint, which the warden takes, and a second identity taken
-// over the GraphQL bytes would be a second truth about the same thing.
-
-const refuse = (code, detail) => {
-  throw new Refusal(code, detail);
-};
-
-const OPERATIONS = Object.freeze(['query', 'mutation', 'subscription']);
-
-const named = (node) => node.name.value;
-
-// A field's type, flattened to the name it ends at, whether it is a list, and
-// whether the caller must give it. GraphQL is nullable by default and says so
-// by omission; the projection is where that becomes `?`, not here.
-const inner = (node) => (node.kind === 'NamedType' ? named(node) : inner(node.type));
-
-const typed = (node) =>
-  node.kind === 'NonNullType'
-    ? { ...typed(node.type), required: true }
-    : node.kind === 'ListType'
-      ? { list: true, of: inner(node.type), required: false, element: typed(node.type) }
-      : { of: named(node), required: false };
-
-// What a contract says it needs to work, written in the schema itself:
-//
-//   schema @needs(organs: ["book", "far"]) { query: Clerk }
-//
-// It is a need and never a binding. A contract is written to stand on any
-// ground, so it names what it must reach and says nothing about whose
-// implementation answers.
-//
-// Undeclared is unreachable, and never by a check: a contract that never asked
-// for an organ does not have it and cannot learn that it exists, because the
-// object it is handed has no such key.
-const needed = (definition) => {
-  for (const directive of definition?.directives ?? []) {
-    if (directive.name.value !== 'needs') continue;
-    const organs = (directive.arguments ?? []).find((one) => one.name.value === 'organs');
-    if (organs?.value?.kind !== 'ListValue') refuse('BAD_NEEDS', 'organs must be a list of names');
-    return organs.value.values.map((one) => {
-      if (one.kind !== 'StringValue') refuse('BAD_NEEDS', 'an organ is named by a string');
-      return one.value;
-    });
-  }
-  return [];
-};
-
-// Which type is the root of each operation. GraphQL's own `schema` block names
-// them, and that is where the being's name comes from — `schema { query: Clerk }`
-// makes a class block called `Clerk`. With no `schema` block the conventional
-// type names stand in, which is the plain form every engineer already writes.
-const rooted = (definition) => {
-  const roots = { query: 'Query', mutation: 'Mutation', subscription: 'Subscription' };
-  for (const operation of definition?.operationTypes ?? []) {
-    roots[operation.operation] = named(operation.type);
-  }
-  return roots;
-};
-
-const fieldsOf = (definition) =>
-  Object.fromEntries(
-    (definition.fields ?? []).map((field) => [
-      named(field),
-      Object.freeze({
-        args: Object.freeze(
-          Object.fromEntries(
-            (field.arguments ?? []).map((one) => [named(one), Object.freeze(typed(one.type))]),
-          ),
-        ),
-        answers: Object.freeze(typed(field.type)),
-      }),
-    ]),
-  );
-
-export function contract(sdl) {
-  if (typeof sdl !== 'string') refuse('NOT_A_SCHEMA', typeof sdl);
-  let document;
-  try {
-    document = parseGraphQL(sdl);
-  } catch (error) {
-    refuse('UNREADABLE_SCHEMA', error.message);
-  }
-
-  const schema = document.definitions.find(
-    (one) => one.kind === 'SchemaDefinition' || one.kind === 'SchemaExtension',
-  );
-  const roots = rooted(schema);
-  const rootNames = new Set(Object.values(roots));
-
-  const objects = new Map();
-  const inputs = new Map();
-  for (const definition of document.definitions) {
-    if (definition.kind === 'ObjectTypeDefinition') {
-      if (objects.has(named(definition))) refuse('DUPLICATE_TYPE', named(definition));
-      objects.set(named(definition), definition);
-      continue;
-    }
-    if (definition.kind === 'InputObjectTypeDefinition') {
-      if (inputs.has(named(definition))) refuse('DUPLICATE_TYPE', named(definition));
-      inputs.set(named(definition), definition);
-      continue;
-    }
-    if (definition.kind === 'SchemaDefinition' || definition.kind === 'SchemaExtension') continue;
-    // Everything else — interfaces, unions, enums, fragments, an operation —
-    // is a thing the notation has no word for, and a contract carrying one is
-    // refused where it is read rather than guessed at where it is projected.
-    refuse('NO_WORD', definition.kind);
-  }
-
-  // Every root field, flat, with the operation it stands under. This is what a
-  // caller may ask, and there is no register of fields anywhere else.
-  // Resolvers are flat under the contract, not nested under a root: one
-  // contract is one class block in the notation, so a field name is unique
-  // across the whole contract and a second layer would name nothing.
-  const fields = {};
-  for (const operation of OPERATIONS) {
-    const definition = objects.get(roots[operation]);
-    if (!definition) continue;
-    for (const [name, one] of Object.entries(fieldsOf(definition))) {
-      if (Object.hasOwn(fields, name)) refuse('DUPLICATE_FIELD', name);
-      fields[name] = Object.freeze({ ...one, operation });
-    }
-  }
-  if (Object.keys(fields).length === 0) refuse('NO_FIELDS', 'a contract that answers nothing');
-
-  // The name a being wears: the query root's, or the mutation root's where a
-  // contract only writes. One contract is one class block, so one name.
-  const name = objects.has(roots.query)
-    ? roots.query
-    : objects.has(roots.mutation)
-      ? roots.mutation
-      : roots.subscription;
-
-  const records = {};
-  for (const [typeName, definition] of [...objects, ...inputs]) {
-    if (rootNames.has(typeName)) continue;
-    records[typeName] = Object.freeze(fieldsOf(definition));
-  }
-
-  return Object.freeze({
-    fields: Object.freeze(fields),
-    name,
-    needs: Object.freeze([...new Set(needed(schema))]),
-    records: Object.freeze(records),
-    sdl,
-  });
-}

package/src/ground.js

@@ -1,273 +0,0 @@
-import { Warden, commitment, readAnswer, reach, signingPair } from '@quo-systems/js';
-import { serve } from '@quo-systems/js/door';
-
-const same = (a, b) => a.length === b.length && a.every((byte, at) => byte === b[at]);
-
-// The kit keys both of its records by a pk's hex, and does not export the
-// spelling. Zero dependencies and no host API: this is the whole of it.
-const hex = (bytes) => [...bytes].map((byte) => byte.toString(16).padStart(2, '0')).join('');
-
-// One process, many beings, exactly one door. The kit's `Warden` is the door
-// and everything behind it, so a ground is a closure over one warden and
-// nothing else — Nervur adds no protocol of its own, ever.
-//
-// The instance is closed over rather than returned. Nervur is written
-// Crockford: factory functions, no `this` at a call site, frozen surfaces. A
-// warden handed to a caller is a warden whose methods must be called bound,
-// which puts the kit's class idiom in Nervur's hands. It stops here.
-//
-// Every seed and every draw of randomness arrives as an argument, the way the
-// kit takes them. A ground that reached for entropy would be a ground the
-// bench cannot replay.
-export async function ground({ nameSeed, padlockSeed, heirSeed, hints = [], limit = 0n }) {
-  const warden = await Warden.open({ nameSeed, padlockSeed, heirSeed, hints, limit });
-
-  // The half of an invitation the kit's record has nowhere to keep: the heir
-  // this ground rotates to the first time it spends the relation. An
-  // invitation hands over the heir keys and nothing else, so the holder's
-  // first ask must arrive as a rotation carrying a commitment to a successor
-  // the granting house has never seen. Meeting that once is a trap; meeting it
-  // at every call site is the trap kept. So `remember` derives the successor
-  // and `ask` spends it, and a caller never learns the difference.
-  const rotations = new Map();
-
-  // A relation is named by the being that spends it and the house it stands
-  // at, never by a handle: a handle passed around is a relation one being can
-  // spend on another's behalf, and the whole point of the outbound record is
-  // that it cannot.
-  const relationFor = (from, at) => {
-    for (const row of warden.relationsOf(from)) if (same(row.warden, at)) return row;
-    return null;
-  };
-
-  // Contacts: who reaches this being, and the two acts that change it. Quo
-  // keeps the record and refuses to have an opinion about it — it has no word
-  // for member, owner or guest and must not, because a protocol a stranger
-  // implements in another language cannot carry meanings. The opinion is
-  // Nervur's, and this is where it lives. Nothing is copied: `list` walks the
-  // warden's own inbound record at the moment it is asked, `admit` is the
-  // warden's `grant`, `remove` is the warden's `amend`.
-  //
-  // The warden holds the record the other way round — voice to beings — so the
-  // inverse is derived here rather than kept, because a second index is a
-  // second truth and the first one moves without telling it.
-  //
-  // The scoping is the design, and it is structural rather than a check that
-  // refuses: `beingPk` is shut inside this closure at mint, so a being's
-  // context has no address it could name to reach another's row. The same
-  // shape `errand` uses for a relation.
-  const contacts = (beingPk) => {
-    const at = hex(beingPk);
-    const reaches = (row) => row.beings.has(at);
-    return Object.freeze({
-      // The voices that reach this being, read live.
-      list: () => [...warden.inbound.values()].filter(reaches).map((row) => row.voice),
-
-      // Mint a voice against this being and hand back the invitation. A being
-      // still cannot mint standing — it has no warden — and this does not give
-      // it one: what it has is a reach the ground minted for it, at one being.
-      admit: (keys) => warden.grant(beingPk, keys),
-
-      // Take this being out of that voice's row, and nothing else. A voice that
-      // does not reach this being is not amended at all — the warden would
-      // answer true to a removal that removed nothing, and a being told its act
-      // succeeded when it touched no record has been told a lie.
-      remove: (voicePk) => {
-        const row = warden.standing(voicePk);
-        if (!row || !reaches(row)) return false;
-        return warden.amend(voicePk, { remove: [beingPk] });
-      },
-    });
-  };
-
-  // The one act of spending a relation, written once. `ask` below is a caller
-  // of it and so is every organ minted by `errand`, because they are the same
-  // act: seal down a relation, move it, read what came back. A second copy of
-  // this would be a second place the first-ask rotation could be forgotten.
-  // `leash`, where there is one, is the call this ask is made in the course of.
-  // It is handed to the kit rather than read here: what may go onward is the
-  // difference between when the message arrived and this moment, and only the
-  // kit can take the second reading at the moment of sealing. A being holding a
-  // leash therefore cannot widen an allowance even by mistake, which is the
-  // whole reason the remainder never passes through the being as a number.
-  const spend = async ({ from, at, being, method, allowance, leash = null, random }) => {
-    const row = relationFor(from, at);
-    if (!row) throw new Error('no relation');
-    const rotation = rotations.get(row) ?? null;
-    // Spent whether or not an answer comes back: the far door rotates the
-    // standing at step three, long before it decides whether to speak.
-    rotations.delete(row);
-    const envelope = await warden.ask(row, {
-      seq: row.seq + 1n,
-      commitment: rotation,
-      allowance,
-      leash,
-      being,
-      method,
-      random,
-    });
-    // An ask that could not be judged is not made, and the kit says so by
-    // handing back nothing to send.
-    if (!envelope) return null;
-    const answer = await reach(row.hints, envelope);
-    if (answer === null) return null;
-    return readAnswer({
-      envelope: answer,
-      padlockSecret: warden.padlock.secret,
-      wardenPk: row.warden,
-    });
-  };
-
-  return Object.freeze({
-    // What a stranger holds: the door's name, its commitment, its padlock and
-    // where to reach it. No voice, so it opens nothing.
-    card: () => warden.card(),
-
-    // The door's own being — the one every voice reaches, holders included.
-    publicBeing: () => warden.publicBeing(),
-
-    // Hold a being: what is held is a contract and its resolvers together,
-    // never an object and a blueprint that happen to have been handed in at
-    // the same moment. Those two can disagree, and the whole meaning of a
-    // digest rests on their not disagreeing.
-    //
-    // The organs are supplied here, which is what "scoped by the ground"
-    // means: the ground decides what is on the tray, and the being takes only
-    // what it declared. A being cannot reach for one that was never offered,
-    // and cannot be given one it never asked for.
-    // The contacts context is minted here, per hold, over this being's own
-    // name — derived from the seed the way the kit derives it, because the
-    // being must be shut inside its own context and the hold that names it has
-    // not happened yet.
-    hold: async (one, { seed, heirSeed, cells, organs }) => {
-      const pk = (await signingPair(seed)).pk;
-      return warden.hold(one.raise(organs, contacts(pk)), {
-        seed,
-        heirSeed,
-        cells,
-        blueprint: one.contract,
-      });
-    },
-
-    // Mint a voice and write the standing that lets it reach one being.
-    grant: (being, keys) => warden.grant(being, keys),
-
-    // The other direction: record an invitation this ground was handed, and say
-    // which of its beings spends it. A relation nobody here owns belongs to the
-    // ground itself and travels nowhere, which is a different thing and not
-    // this; a being is named, always.
-    //
-    // What comes back reads the relation and cannot move it. `seq` is the count
-    // kept against that far door, which is the one fact a caller has any
-    // business watching.
-    remember: async (invitation, { being, heirSeed }) => {
-      const row = warden.remember(invitation, { being });
-      const next = await signingPair(heirSeed);
-      rotations.set(row, await commitment(invitation.warden, next.pk));
-      return Object.freeze({
-        warden: invitation.warden,
-        being,
-        hints: () => [...row.hints],
-        seq: () => row.seq,
-      });
-    },
-
-    // Spend a relation: seal the ask down it, post it at the hints the
-    // invitation carried, and read the answer back. All four acts are the
-    // kit's — `ask`, `carry` under it, `reach`, `readAnswer` — and what is
-    // Nervur's is only which relation, which number, and the padlock secret
-    // staying inside this closure.
-    //
-    // The number is this ground's to pick, not a caller's: a relation that
-    // repeats one is a relation the far door refuses, and a caller counting by
-    // hand is a caller that will eventually get it wrong.
-    //
-    // `random` is the **drawn bytes** for this one seal, as at `judge` and
-    // unlike `listen`, because here the ground has one message and not a
-    // stream of them.
-    //
-    // Silence and unreachable are told apart, and they must be: silence is
-    // `null`, the far house having judged and said nothing, while a road that
-    // does not answer throws out of the carriage. Only one of the two means the
-    // far house said no. A being spending a relation it does not hold is
-    // neither — it is a fault at home, and it throws before a byte moves.
-    ask: ({ from, at, being = null, method = null, allowance, random }) =>
-      spend({ from, at, being, method, allowance, random }),
-
-    // The organ that crosses. Everything above is the ground talking to another
-    // house; this is how a being does it, and a being may do it no other way.
-    //
-    // What is minted is a reach and nothing more. The being does not hold the
-    // warden, does not hold the relation, and cannot name a house: `from` and
-    // `at` are shut inside this closure at mint, so an organ is one road to one
-    // house on behalf of one being. That is what keeps it unspendable twice —
-    // there is nothing here to copy and point elsewhere.
-    //
-    // Which being at the far house is still the caller's to name, because the
-    // standing the invitation carries is what decides that, and it is judged
-    // over there. An organ that filtered it here would be this house guessing
-    // at the far house's answer.
-    //
-    // The leash is handed in rather than chosen, and it is the one the door
-    // gave the resolver. The being passes it on whole and never a number read
-    // off it: what may go onward is this door's dwell subtracted at the moment
-    // of sealing, which is later than any moment the being could have read. So
-    // the remainder reaches the far house without the being having chosen it,
-    // and a being cannot hand its organ a wider allowance than it received. The
-    // ground adds no arithmetic of its own — a leash that has run out is
-    // refused by the kit at the moment of carrying, and shows up here as
-    // silence.
-    //
-    // `random` is a **function** the organ draws from per message, as at
-    // `listen` and unlike `judge`: an organ has a stream of messages ahead of
-    // it and not one, and a seal that reused its bytes would be a seal.
-    errand: ({ from, at, random }) =>
-      Object.freeze({
-        ask: (leash, { being = null, method = null } = {}) =>
-          spend({ from, at, being, method, leash, random: random() }),
-      }),
-
-    // The whole of the door: bytes in, bytes or silence out.
-    //
-    // `random` here is the **drawn bytes** for this one judgment. At `listen`
-    // below it is a **function** the host draws from, once per message. The
-    // two differ because the drawing belongs to whoever has messages to count,
-    // and that is the host — so a ground handed a function here would meet
-    // every ask with silence, the warden's global catch turning the fault into
-    // the same refusal as everything else.
-    judge: (envelope, terrain) => warden.judge(envelope, terrain),
-
-    // Listen. This is the one place the warden is handed anywhere, and it goes
-    // to the kit's own host adapter rather than out of this closure — the door
-    // is the half of the carriage that cannot be portable, so a ground that
-    // only calls out never reaches this and never imports a host's API.
-    //
-    // The hint that comes back is the whole address: Quo posts to it exactly
-    // as given. `close` drops the listening socket and the keep-alive
-    // connections with it, because a door that waits for the last idle caller
-    // to time out is a door that never shuts.
-    // A door holds callers to the limit its warden publishes, because a
-    // published limit nobody enforces is worse than none — a caller can
-    // compute it before sending and would be told the truth about a door that
-    // then reads anything. A warden that publishes zero has stated no limit,
-    // so nothing is enforced; the kit's door spells that `null`.
-    //
-    // A ground that declared no hints publishes the one it just got: an
-    // ephemeral port is not knowable before the socket is open, so a ground
-    // could otherwise only ever grant invitations with no road in them. A
-    // ground that declared its own hints keeps them — it knows where it is
-    // reachable from and a loopback address appended to that would be a road
-    // no stranger can take.
-    listen: async ({ clock, random, host, port, limit } = {}) => {
-      const door = await serve(warden, {
-        clock,
-        random,
-        host,
-        port,
-        limit: limit ?? (warden.limit > 0n ? warden.limit : null),
-      });
-      if (warden.hints.length === 0) warden.hints = [door.hint];
-      return door;
-    },
-  });
-}

package/src/index.js

@@ -1,5 +0,0 @@
-export { ground } from './ground.js';
-export { being } from './being.js';
-export { contract } from './contract.js';
-export { program } from './program.js';
-export { project } from './projection.js';

package/src/program.js

@@ -1,74 +0,0 @@
-import { contract as read } from './contract.js';
-
-// A contract and its resolvers, made callable. This is the whole compiler, and
-// beings and organs both come out of it, because they are one kind of code: a
-// field of an organ is a resolver exactly as a field of a being is, and nothing
-// here can tell which it is holding. There is no second compiler anywhere, and
-// a design that wants one is wrong.
-//
-// A resolver is sovereign. It sees its arguments by the names its own contract
-// gave them, it reaches the world only through the context it was handed, and
-// it never throws — a resolver that raises is answered as silence, because
-// nothing in this system promises that an ask is fulfilled. A refusal a caller
-// must tell apart from silence is carried in the answer type instead.
-
-// Exactly the arguments the contract declares, and nothing else. What a caller
-// may ask is what the contract already showed it, so a parameter nobody
-// declared cannot ride in beside one that was.
-const given = (args, params) =>
-  Object.freeze(
-    Object.fromEntries(
-      Object.keys(args)
-        .filter(
-          (name) =>
-            params !== null &&
-            typeof params === 'object' &&
-            Object.hasOwn(params, name) &&
-            params[name] !== undefined,
-        )
-        .map((name) => [name, params[name]]),
-    ),
-  );
-
-const complete = (args, only) =>
-  Object.entries(args).every(([name, one]) => !one.required || only[name] !== undefined);
-
-export function program(one, resolvers) {
-  const held = typeof one === 'string' ? read(one) : one;
-
-  return Object.freeze({
-    // What may be asked here, which is the only place to find out. A field this
-    // does not name does not exist for a caller.
-    contract: held,
-
-    answer: async (field, params, context) => {
-      // Read as an own property, never through the prototype chain. Without
-      // this, `__proto__`, `constructor` and `toString` all name a field nobody
-      // declared, and a caller reaches something the contract never showed it.
-      const declared = Object.hasOwn(held.fields, field) ? held.fields[field] : undefined;
-      if (declared === undefined) return undefined;
-
-      const only = given(declared.args, params);
-      // A field short of an argument its contract made mandatory is not called
-      // at all. A resolver written against its own contract may read that
-      // argument without checking, and calling it anyway would make every
-      // resolver defensive about a promise the contract already made.
-      if (!complete(declared.args, only)) return undefined;
-
-      const resolver =
-        resolvers !== null &&
-        typeof resolvers === 'object' &&
-        Object.hasOwn(resolvers, field) &&
-        typeof resolvers[field] === 'function'
-          ? resolvers[field]
-          : undefined;
-      if (resolver === undefined) return undefined;
-
-      try {
-        return await resolver(only, context);
-      } catch {
-        return undefined;
-      }
-    },
-  });
-}

package/src/projection.js

@@ -1,102 +0,0 @@
-import { Refusal, print } from '@quo-systems/js';
-
-// The boundary, and there is exactly one of it. Inside a ground a contract is
-// GraphQL; on the wire there is Quo and only Quo. A stranger implementing the
-// protocol in another language has never heard of Nervur and must still read
-// the blueprint a being stands on, so a contract is projected into the kit's
-// own notation here and nowhere else.
-//
-// The projection never guesses. Where GraphQL says something the notation has
-// no word for, the contract is refused at build — a being that stood on a
-// blueprint that quietly dropped half its schema would have a digest that lied
-// to everyone who read it.
-
-const refuse = (code, detail) => {
-  throw new Refusal(code, detail);
-};
-
-// The closed set of scalars is the law's, so this table is closed too. A name
-// missing from it is not a scalar Nervur may invent — it is a word Quo does
-// not have.
-const SCALARS = Object.freeze({
-  Boolean: 'bool',
-  Int: 'int',
-  String: 'text',
-  Bytes: 'bytes',
-  B32: 'b32',
-  Being: 'being',
-  Invitation: 'invitation',
-  Card: 'card',
-});
-
-// The one word the notation has and GraphQL does not: a field that answers
-// nothing, which rides as zero bytes and is a real answer. GraphQL insists
-// every field has a type, so a contract spells it with this name in answer
-// position. It is not a type and may not be asked for or carried.
-const NOTHING = 'Nothing';
-
-// GraphQL is nullable by default and says so by omission; the notation is
-// required by default and says the other thing with `?`. This is the whole of
-// the difference and it is spelled out rather than inferred.
-function projectType(node, where, records) {
-  if (node.list) {
-    return node.required
-      ? { list: projectType(node.element, where, records) }
-      : { optional: { list: projectType(node.element, where, records) } };
-  }
-  const base = SCALARS[node.of] ?? (records.has(node.of) ? node.of : undefined);
-  if (base === undefined) {
-    refuse(
-      'NO_WORD',
-      node.of === NOTHING
-        ? `${NOTHING} at ${where}, which is not a type`
-        : `${node.of} at ${where}`,
-    );
-  }
-  return node.required ? { base } : { optional: { base } };
-}
-
-const projectArgs = (args, where, records) =>
-  Object.entries(args).map(([name, one]) => ({
-    name,
-    type: projectType(one, `${where}(${name})`, records),
-  }));
-
-// A record block holds plain fields: a name and a type, and nothing else. A
-// GraphQL object type whose fields take arguments is a type with behaviour,
-// which the notation has no word for at all.
-const projectRecord = (name, fields, records) =>
-  Object.freeze({
-    name,
-    fields: Object.entries(fields).map(([field, one]) => {
-      if (Object.keys(one.args).length > 0) refuse('NO_WORD', `arguments on ${name}.${field}`);
-      if (one.answers.of === NOTHING) refuse('NO_WORD', `${NOTHING} at ${name}.${field}`);
-      return { name: field, type: projectType(one.answers, `${name}.${field}`, records) };
-    }),
-  });
-
-// The blueprint a being actually stands on: one class block named for the
-// contract's root type, its declared fields flat, and every other type of the
-// schema behind it as a record. Ordering, canonical spelling, unused records
-// and recursion are the notation's own law, so they are the kit's `print` to
-// judge and never this file's.
-export function project(one) {
-  const records = new Set(Object.keys(one.records));
-  const blueprint = {
-    name: one.name,
-    fields: Object.entries(one.fields).map(([name, field]) => ({
-      name,
-      args: projectArgs(field.args, name, records),
-      answer:
-        field.answers.of === NOTHING && !field.answers.list
-          ? null
-          : projectType(field.answers, name, records),
-    })),
-    records: [...Object.entries(one.records)].map(([name, fields]) =>
-      projectRecord(name, fields, records),
-    ),
-  };
-  return print(blueprint);
-}
-
-export { NOTHING, SCALARS };