nervur 0.15.0 → 0.17.0

package/GETTING_STARTED.md

@@ -0,0 +1,138 @@
+# Getting started
+
+Quo lets an object ask another object and get an answer, without knowing
+whether that other object is in the same process, on the same device, or
+on another planet. Three words: a harbor boots wards, a ward keeps beings
+and judges its door, and a being is one ordinary object with one voice.
+This is the shortest road from nothing to each of the three, for a
+stranger with a terminal. `SPEC.md` is the truth behind every sentence
+here and assumes nothing; `quo-dock.md` is the dock, the part a box runs.
+
+Quo is the protocol and Nervur is this kit of it. Every name you install
+and every command you type is Nervur's; `quo` stays on the wire, as the
+`quo.` route a ward's door answers at.
+
+Two packages, and you start with the one that fits what you have:
+
+- `nervur`, the library. A harbor, a ward and a being in one
+  process, no wire, no files. For a program that wants Quo inside it.
+- `@nervur-org/dock`, the dock. A daemon and one command, `nervur`, that
+  stand a box up: a person's world with a page, a model's side, an api, a
+  door on the wire. For a box that receives people and models.
+
+The command is in the dock and not in the library, so `npm install nervur`
+gives you something to import and no command, and the command arrives with
+`npm install -g @nervur-org/dock`. That is how a kit of this shape is
+always named: one unscoped headline name for the library, the parts under
+the scope, and the CLI in the package that owns it.
+
+## A being, in one process
+
+```bash
+npm install nervur
+```
+
+A being is a class with `asks`, the methods anyone may reach, each with
+the JSON schema of its input. Everything else on the class is hers alone.
+
+```js
+import { Being } from 'nervur';
+import { Ward } from 'nervur/ward';
+import { MemoryHarbor } from 'nervur/harbor';
+
+class Shop extends Being {
+  static asks = { price: { input: { type: 'object', properties: { item: { type: 'string' } } } } };
+  price({ item }) {
+    return { item, eur: 12 };
+  }
+}
+class Customer extends Being {
+  static asks = {};
+}
+
+const harbor = new MemoryHarbor();
+const ward = await harbor.boot('acme', Ward, { Shop, Customer });
+await ward.ask('boot', { key: 'shop', class: 'Shop' });
+await ward.ask('boot', { key: 'ana', class: 'Customer' });
+```
+
+The harbor booted a ward named `acme` with two classes it may make beings
+of, and the ward's owner, the process itself, booted one of each by key.
+The ward's own asks are seven, `boot`, `public`, `invite`, `knock`,
+`remove`, `unboot` and `ask`, and `ward.ask()` with no method is her
+describe: those asks and her `notes`, the ward's `pk` and her beings.
+
+Nobody reaches a being she has not invited. An invitation is minted on a
+being for one id, the shop's for `ana`, and the customer knocks with it;
+from then she holds a standing at the shop, under the name she took, and
+the shop holds her as an occupant.
+
+```js
+const invitation = await ward.ask('invite', { being: 'shop', id: 'ana' });
+const ana = harbor.objects.get(harbor.partitions.get('acme').beings.ana);
+await ana.knock(invitation);
+await ana.take('shop', invitation);
+console.log(await ana.standings.shop.ask('price', { item: 'bread' }));
+// { item: 'bread', eur: 12 }
+```
+
+That is the whole protocol: a standing on one side, an occupant on the
+other, an ask that rides the relation and an answer that rides it back.
+The two beings here share a process; the same lines hold when the shop is
+on a box across the sea, because a standing is an address and a key, and
+the harbor owns the wire. `harbor.objects` is the memory harbor's hand for
+a test and a first program; a being on a real box is reached through her
+ward, never held.
+
+## A box
+
+```bash
+npm install @nervur-org/dock
+npx nervur init --dir ~/.nervur --ward acme --user razvan --domain acme.com --default --show
+npx nervur serve --dir ~/.nervur --http 8787
+```
+
+`init` mints the ward `acme`, boots razvan's user being, her doorbell and
+the desk in it, marks it the default ward and shows it at the web route,
+and writes `routes.json`, the four routes of a box, `mcp.`, `web.`, `quo.`
+and `api.` under the domain, for a proxy to map onto the one loopback
+port. Without `--domain`, write it yourself; on a Mac the four are paths
+at one loopback address:
+
+```json
+{ "mcp": "http://127.0.0.1:8787/mcp", "web": "http://127.0.0.1:8787/web", "quo": "http://127.0.0.1:8787/quo", "api": "http://127.0.0.1:8787/api" }
+```
+
+`serve` is the daemon, the one process over that folder, and every other
+command is its client. From a second terminal, a phone:
+
+```bash
+npx nervur invite --dir ~/.nervur '{"being":"razvan","id":"phone"}'
+```
+
+The answer carries `link`, the ward's page with the invitation in its
+fragment. Opened on the phone, the tab boots a harbor of its own, joins as
+that device, and is in: no account, nothing typed. What a model gets is
+the same world as tools at `mcp.`, what a program gets is the same asks as
+JSON at `api.`, and what another box gets is the door at `quo.`; a being
+answers each the same, because each is an ask at her door.
+
+The box's own doings are rows on the faculties of its dock ward, placed by
+the root with `nervur ask --ward dock`: a socket held to another box, an
+agent run for a ward, a schedule on the clock. A second box owns this one
+across the wire with an invitation on the ward's own pk, knocked with
+from there, and every owner command with `--via` from then on. Each of
+those, the edge, and what an estate stands beyond the init, is the
+"Getting started" chapter of `quo-dock.md`, proven cold on a Mac by
+somebody with nothing else to read.
+
+## Your own beings on a box
+
+A box holds the dock's classes and yours. `classes/index.ts` beside the
+wards exports each of yours by name, and `nervur boot '{"key":"shop",
+"class":"Shop"}'` boots one; `nervur init --class Shop` makes the ward's home
+being one of yours, an organisation's ward with the org as its being. A
+being's asks may name who may reach them, `for`, over the record of the
+occupant asking, and her `cells` are what she keeps between boots: the
+whole of what a being is, in `SPEC.md`, and the words above the spec, a
+world, a home, a membership, in `WORLDS.md` and `GLOSSARY.md`.

package/LICENSE

@@ -1,3 +1,4 @@
+
                                  Apache License
                            Version 2.0, January 2004
                         http://www.apache.org/licenses/
@@ -178,7 +179,7 @@
    APPENDIX: How to apply the Apache License to your work.
 
       To apply the Apache License to your work, attach the following
-      boilerplate notice, with the fields enclosed by brackets "{}"
+      boilerplate notice, with the fields enclosed by brackets "[]"
       replaced with your own identifying information. (Don't include
       the brackets!)  The text should be enclosed in the appropriate
       comment syntax for the file format. We also recommend that a

package/NOTICE

@@ -0,0 +1,6 @@
+Nervur
+Copyright 2026 Razvan Gherghina
+
+This product includes software developed by Razvan Gherghina.
+
+Licensed under the Apache License, Version 2.0. See LICENSE for the terms.

package/README.md

@@ -1,152 +1,120 @@
-# nervur
-
-Nervur grown on the working Quo kit. It imports `@quo-systems/js` and adds no
-protocol
-of its own — no wire, no envelope, no judgment, no arithmetic, ever. What
-Nervur is for begins where the constitution stops: the graph, the organs, the
-floor, and the projection from an authored contract into Quo blueprints.
-
-## The rules of this build
-
-1. **`@quo-systems/js` is the whole of the protocol.** It is crossed by its
-   specifier,
-   never by a path. A gap the kit shows is reported to the quo table, never
-   patched here.
-2. **nervur-dream is parked beside this, as reference.** Its mechanics may be
-   lifted — the compiler, the contract reader, the `@needs` directive. Its
-   judgement may not: what a thing enforces, refuses or means is authored fresh
-   against the constitution as it stands today, because dream was built against
-   a protocol that no longer exists.
-3. **Crockford.** Factory functions, closures for privacy, no `this`, frozen
-   surfaces. The kit's class idiom stops at its specifier: the ground factory
-   is the one place a `Warden` instance lives, closed over and never returned.
-4. **One played bench question at a time.** Doubt is settled on the bench, not
-   argued. Nothing lands without an assert that would fail if it broke.
-5. **A being never learns who is calling, but it knows who may reach it.** The
-   first half is the kit's doing: the warden places a voice at step three and
-   hands the field its arguments and its leash, never the caller. Which being
-   was reached already says who called. The second half is Nervur's: the warden
-   keeps the record of which voices reach which beings, and a being is handed
-   its own row to read and to change. No rights and no roles — those are
-   meanings, and the record holds none.
-
-## What stands
-
-**`ground()`** — one closure over one warden, holding beings and judging what
-arrives. `bench/ground.test.js` walks it end to end: a real sealed ask, a real
-answer, and silence where a standing does not reach.
-
-**The outbound relation** — `remember` records an invitation this ground was
-handed and names which of its beings spends it; `ask` seals down that relation,
-posts it at the hints the invitation carried, and reads the answer back. Every
-one of those acts is the kit's. What is Nervur's is the ergonomics: a relation
-is found by whose it is, so one being cannot spend another's; the number is the
-ground's to pick, so no caller counts by hand; and the first ask carries the
-rotation an invitation's heir keys oblige, so nobody meets that trap twice.
-`bench/estate.test.js` stands two houses on two real loopback doors and crosses
-between them.
-
-Silence, unreachable and a relation that is not yours are three different
-things and stay three: silence is `null`, a road that does not answer throws
-out of the carriage, and spending what a being does not hold throws before a
-byte moves.
-
-**`contract(sdl)` and `program(contract, resolvers)`** — the compiler, and
-there is exactly one of it. A being and an organ are both a contract plus
-resolvers, and `program` cannot tell which it is holding; that is not a
-convenience, it is the architecture. A field is read with `hasOwn` and never
-through the prototype chain, exactly the declared arguments reach a resolver
-and no others, a resolver short of a required argument is not called at all,
-and a resolver that throws is answered as silence — nothing here promises that
-an ask is fulfilled, so a refusal a caller must tell apart is carried in the
-answer type instead. `bench/program.test.js` asserts every one of those, and
-asserts the first on a being and an organ side by side.
-
-**The contract is a GraphQL schema** — schema, resolvers and a context, the
-shape every engineer already knows. It is authoring and nothing else: never at
-the wire, never an answer, never a describe. The organs a being reaches outward
-with are declared in the schema itself, with `schema @needs(organs: [...])`,
-and the being's own name is the root type's — `schema { query: Clerk }`.
-
-**`project(contract)`** — the boundary, and there must be exactly one of it.
-Every implementer of Quo speaks the notation and has never heard of Nervur, so
-a contract becomes a Quo blueprint in the kit's own notation before anything
-holds it, and what a stranger verifies is that blueprint's digest. GraphQL is
-nullable by default and the notation is required by default, so `String!`
-becomes `text` and `String` becomes `text?`; the schema's other object and
-input types become record blocks, and their ordering is the notation's own law
-and therefore the kit's `print` to judge. Where GraphQL says something the
-notation has no word for — `Float`, `ID`, an enum, a union, an interface, a
-record field that takes arguments — the contract is refused at build rather
-than guessed at. One word runs the other way: the notation has a field that
-answers nothing and GraphQL insists every field has a type, so `Nothing` in
-answer position is that field's spelling. `bench/projection.test.js` holds it.
-
-**`being(sdl, resolvers)`** — a schema and ordinary functions under it. It is
-compiled by `program` like anything else; what it adds is the wire skin the kit
-leaves open, and the two promises the kit leaves to Nervur: a resolver meets
-its arguments as named values and never bytes, and a being answers **exactly**
-the fields its contract declares. That second one is the gate the digest's
-meaning rests on — the law says what a blueprint does not declare does not
-exist, and the kit dispatches on whatever methods the held object happens to
-have.
-
-**Organs** — the only way a being _acts_ outward. That is not a style choice:
-a being has no warden and no caller, so it cannot mint standing and a field
-answering another being's name hands over a label rather than reach. What it
-can still do is pass on standing it was already given — the constitution says
-data can carry an `invitation`, and an invitation carries the heir keys — so
-"a being cannot hand over reach" is false as a general claim and only the
-minting half is true. A being names the organ aliases it needs in its own
-schema, the ground supplies them at `hold`, and the resolvers are closed over
-exactly those. An organ the schema never asked for is not absent from a check —
-it is absent from the object.
-
-**The organ that crosses** — `errand` mints the reach a being uses to speak to
-another house. It is shut over which being spends the relation and which house
-it stands at, so a being holds one road on its own behalf and nothing it could
-point elsewhere; it never holds the warden and never holds the relation. Which
-being at the far house is still the caller's to name, because the standing
-decides that and the standing is judged over there. The **leash** is handed in
-rather than chosen — the resolver passes on the one the door gave it, whole and
-never a number read off it, because what may go onward is this door's dwell
-subtracted at the moment of sealing, which is later than any moment the being
-could have read. So the remainder reaches the far house without the being
-having chosen it, and a being cannot hand its organ more than it received.
-`bench/errand.test.js` serves one sealed ask at the near house by crossing to
-the far one and answering with what came back.
-
-**Contacts** — who reaches this being, and the two acts that change it:
-`list()`, `admit(keys)` and `remove(voicePk)`. Every one of them goes to the
-warden's own inbound record — `grant`, `amend`, `standing` — read live at the
-moment it is called and never snapshotted, so a being that admitted someone a
-moment ago sees them. Quo keeps that record and refuses to have an opinion
-about it, having no word for member, owner or guest; the opinion is Nervur's,
-and this is the whole of it. The inverse — voices by being, where the warden
-keeps beings by voice — is derived rather than indexed, because a second index
-is a second truth.
-
-The scoping is structural, the same shape `errand` uses: the context is minted
-per `hold` with the being shut inside the closure, so there is no address it
-could name to reach another being's row. It reaches a resolver as the resolver
-factory's second argument, closed over at raise beside the organs, rather than
-as a third argument to every resolver. `bench/contacts.test.js` proves the
-admission and the removal at the door — a real sealed ask that gets in, and
-then meets silence.
-
-Organs are declared inside the contract, with `schema @needs(organs: [...])`.
-That directive is authoring and never reaches the wire: the projection drops
-it, so the blueprint a stranger reads carries no trace of what a being reaches
-outward with, which is inside-the-ground business the wire never sees.
-
-## What is not here yet
-
-`own` and the floor, memory, standings and the graph walked across them, the
-per-call caller, ground-as-a-folder, persistence, register-and-invoke,
-collections-as-beings, per-caller beings.
-
-## The bench
-
-```bash
-npm run gate-nervur
+# Nervur
+
+Nervur is the first open source kit of Quo, the library itself: harbor, ward
+and being, with the spec and the vectors inside, and no dependencies.
+
+Quo is a protocol that lets an object ask another object and get an answer,
+without knowing whether that other object is in the same process, on the same
+device, or on another planet. Quo is the protocol and this is one
+implementation of it; the two names never stand for the same thing.
+
+It is three words, two of which are beings, and two edges.
+Nothing else is Quo.
+
+- **Harbor.** The program a device runs to boot wards. Owns the wire and the
+  operating system. Not a being.
+- **Ward.** One process of its harbor. A being plus ward functions. Keeps
+  beings and judges its door.
+- **Being.** One ordinary object, one voice.
+
+[`protocol/SPEC.md`](protocol/SPEC.md) is the truth. It is the protocol
+alone: what any ward in any language must do for its bytes to be Quo. It is
+self-contained and assumes nothing from any other document, this README
+included. Read it first.
+[`quo-kit.md`](quo-kit.md) is this kit: what one TypeScript
+implementation chose and another kit may refuse. It assumes the spec, and
+where the two disagree the spec wins.
+
+## This package
+
+A TypeScript implementation, written against Node's own type stripping, with
+no dependencies. The package ships JavaScript with declarations beside the
+source it was emitted from, because Node strips types nowhere under
+`node_modules`.
+
 ```
+protocol/         the shelf a kit in any language reads: SPEC.md and the vectors, no code
+protocol/vectors/ fixed inputs and outputs, so another language proves its bytes
+src/being/        the Being side: what a being author imports, if anything
+src/ward/         the ward: the Ground contract, door, seal, arithmetic, heirs, stance, allowance
+src/harbor/       MemoryHarbor, and the harbor core with its store, reach and dialer
+src/conformance/  behaviours any ward must show, written against the truth
+```
+
+The suites live beside the source in the tree this is developed in and are
+not in the package: what proves the kit is not what a consumer installs.
+What does ship of them is `src/conformance/`, which is the part written for
+somebody else's ward rather than for this one.
+
+## Requirements
+
+Node 22.18 or later, and nothing else. The package has no dependencies, and
+it ships JavaScript with declarations, so nothing is compiled on the way in.
+
+## Where it is proven
+
+The same conformance suite this package exports runs against several worlds:
+one ward, one harbor with a ward per being, two harbors, and the harbor core
+over a memory store. A world declares what it can express and a chapter it
+cannot reach is skipped by name rather than failed, which is how a kit in
+another language reports the same suite honestly.
+
+It is run again out of a bundle in a real Chromium, in workerd, in Deno and
+in Bun, because a ward's truth must hold wherever a ward runs.
+
+## Entry points
+
+```js
+import { Being, silence, digest } from 'nervur';
+import { Ward } from 'nervur/ward';
+import { MemoryHarbor, Harbor, request, dial } from 'nervur/harbor';
+import { conform } from 'nervur/conformance';
+import { Stand } from 'nervur/vector';
+```
+
+## Another language
+
+The hand to a kit in another language is one folder, `protocol/`, and it
+holds two things of two kinds. `SPEC.md` is the protocol, and it assumes
+nothing: a kit is written against it and against nothing else here. The
+vectors beside it are the byte-level hand, everything a stranger can
+observe: `protocol/vectors/arithmetic.json`, the primitives the seal rests
+on, SHA-256, Ed25519, X25519, HKDF and AES-256-GCM;
+`protocol/vectors/framing.json`, Quo's own, the ward pk, the digest, the
+signed ask body, the sealed shapes, the invitation and the knock;
+`protocol/vectors/wire.json`, the frames on a socket and the one request a
+door takes; and `protocol/vectors/door.json`, the door's thirteen cases,
+each one an arrival a ward will not answer, with the bytes that arrive, the
+bytes that leave and the partition's digest on both sides of the judgement.
+They import by name,
+`nervur/protocol/vectors/framing.json`, so a kit's own suite can
+read them from the package. A kit reproduces them or it is not this
+protocol. `door.json` is also replayed from outside, by a verifier holding
+no key, against a kit standing in vector mode, which `SPEC.md` describes
+under that name. This kit stands in it with `Stand` from `nervur/vector`,
+which is vector mode and names no runtime: put it behind any listener that
+hands it a request body and returns what it answers.
+
+Nothing outside that folder is the protocol. `src/` is this kit's
+interpretation, and `src/conformance/` is a checklist a kit ports rather
+than a harness it runs: it imports the base class, the silence spelling and
+this kit's store and reach, so the beings it is shown with run only in a
+TypeScript ward. `quo-kit.md` "The three shelves" says which is which.
+
+## Versions
+
+No compatibility promise before 1.0.0: the words may still move, and there
+is no migration to write because there is nothing yet to migrate from. This
+package carries the version of its own work and is bound to no other's, so a
+number equal to `@nervur-org/dock`'s or `@nervur-org/ui`'s is a coincidence.
+
+What ships is the emitted `dist/`, the source it came from, the protocol
+shelf with the spec and the vectors inside it, this file, the licence and
+the notice. No tests and no configs. The spec ships because it is the truth
+the source and the vectors are read against, and a package a stranger reads
+with no truth beside it is a pile of names.
+
+## License
+
+Apache-2.0. Copyright 2026 Razvan Gherghina. See [LICENSE](LICENSE) and
+[NOTICE](NOTICE); every source file carries an SPDX line.

package/dist/being/being.d.ts

@@ -0,0 +1,24 @@
+import type { Asker, Blueprint, Cells, Invitation, JsonObject, Wanted, OccupantRecord, Occupants, Reply, Schema, Stance, Standings, Answer } from './types.ts';
+export type AskSpec = {
+    description?: string;
+    input?: Schema;
+    output?: Schema;
+    for?: (occupant: OccupantRecord | undefined, asker: Asker) => boolean;
+};
+export declare class Being {
+    static cells: JsonObject;
+    static asks: Record<string, AskSpec>;
+    readonly stance: Stance;
+    constructor(stance: Stance);
+    get cells(): Cells;
+    get standings(): Standings;
+    get occupants(): Occupants;
+    lend(name: string, id: string): Promise<string | null>;
+    invite(id: string, notes?: JsonObject): Promise<Invitation | null>;
+    knock(invitation: Invitation, method?: string, args?: JsonObject, wanted?: Wanted): Promise<Answer>;
+    take(id: string, invitation: Invitation): Promise<string | null>;
+    boot(className: string, key: string, id?: string): Promise<string | null>;
+    occupant(asker: Asker): OccupantRecord | undefined;
+    describe(asker: Asker): Blueprint;
+    answer(asker: Asker, method?: string, args?: JsonObject): Promise<Reply>;
+}

package/dist/being/being.js

@@ -0,0 +1,109 @@
+// Names a subclass may not use for an ask, because they are the base's own.
+const RESERVED = new Set(['answer', 'describe', 'stance', 'cells', 'standings', 'occupants', 'occupant', 'invite', 'knock', 'take', 'boot', 'lend', 'constructor']);
+// Whether she has a method of that name, written on her own prototype chain
+// below Object's. A name Object lends every object, `hasOwnProperty` or
+// `toString`, is not a method she wrote; and a field she assigns in her own
+// constructor is not there yet when the base checks, so an ask is a method
+// on the prototype and nothing else.
+const wrote = (self, name) => {
+    for (let p = Object.getPrototypeOf(self); p !== null && p !== Object.prototype; p = Object.getPrototypeOf(p)) {
+        if (Object.hasOwn(p, name))
+            return typeof p[name] === 'function';
+    }
+    return false;
+};
+// Both statics below are read off the class the object was made from, so a
+// subclass declaring either replaces its parent's rather than adding to it.
+// That is the rule: her blueprint is exactly what the class in front of you
+// declares, in the order she chose, and merging down a chain would hand her
+// asks she may mean to drop and an order she did not write. A subclass that
+// means to extend says so, `static override asks = { ...Parent.asks, mine: {} }`.
+export class Being {
+    // Her cells' defaults. Merged in at birth, only where a key is missing, so
+    // a restart keeps what she wrote.
+    static cells = {};
+    // What she can be asked. Declaration order is blueprint order, except a
+    // name that reads as an array index, which the language lists first.
+    static asks = {};
+    stance;
+    constructor(stance) {
+        this.stance = stance;
+        const C = this.constructor;
+        for (const name of Object.keys(C.asks)) {
+            if (RESERVED.has(name))
+                throw new Error(`ask '${name}' is a reserved name`);
+            if (!wrote(this, name))
+                throw new Error(`ask '${name}' has no method on the prototype`);
+        }
+        // Own keys only: a default named after a member of Object's prototype is
+        // still hers, and still missing until she writes it.
+        for (const [k, v] of Object.entries(C.cells))
+            if (!Object.hasOwn(stance.cells, k))
+                stance.cells[k] = structuredClone(v);
+    }
+    get cells() {
+        return this.stance.cells;
+    }
+    get standings() {
+        return this.stance.standings;
+    }
+    get occupants() {
+        return this.stance.occupants;
+    }
+    // A standing at one of the things this device can do, under an id of hers.
+    // The ward knocks and takes it for her; the invitation never reaches her.
+    lend(name, id) {
+        return this.stance.lend(name, id);
+    }
+    invite(id, notes) {
+        return this.stance.occupants.invite(id, notes);
+    }
+    knock(invitation, method, args, wanted) {
+        return this.stance.standings.knock(invitation, method, args, wanted);
+    }
+    take(id, invitation) {
+        return this.stance.standings.take(id, invitation);
+    }
+    // A new being of her ward, by class name, under a key she chooses. With an
+    // id, she holds a standing to the being she made, who knows her by her key.
+    boot(className, key, id) {
+        return this.stance.boot(className, key, id);
+    }
+    // The occupant record for whoever is at the door. Undefined at a public being.
+    occupant(asker) {
+        return asker.id !== undefined && Object.hasOwn(this.cells.occupants, asker.id) ? this.cells.occupants[asker.id] : undefined;
+    }
+    // Her blueprint for this asker. Override to shape it by hand.
+    describe(asker) {
+        const C = this.constructor;
+        const rec = this.occupant(asker);
+        const asks = [];
+        for (const [name, spec] of Object.entries(C.asks)) {
+            if (spec.for && !spec.for(rec, asker))
+                continue;
+            const ask = { name, input: spec.input ?? { type: 'object' } };
+            if (spec.description !== undefined)
+                ask.description = spec.description;
+            if (spec.output !== undefined)
+                ask.output = spec.output;
+            asks.push(ask);
+        }
+        return { asks, notes: {} };
+    }
+    // The one function. Override to wrap it; call super to keep the dispatch.
+    async answer(asker, method, args = {}) {
+        if (method === undefined)
+            return this.describe(asker);
+        const C = this.constructor;
+        // Declared, by her, on purpose. `asks` is an ordinary object, so a bare
+        // lookup would also find every name on Object's prototype: `valueOf`
+        // would answer with her stance, `toString` with a string, and neither is
+        // an ask she wrote. Only her own keys are asks, which is what describe
+        // shows. What she shows is what she can be asked.
+        const spec = Object.hasOwn(C.asks, method) ? C.asks[method] : undefined;
+        if (!spec || (spec.for && !spec.for(this.occupant(asker), asker)))
+            return { error: 'unknown ask' };
+        const fn = this[method];
+        return fn.call(this, args ?? {}, asker);
+    }
+}

package/dist/being/digest.d.ts

@@ -0,0 +1,3 @@
+import type { Json } from './types.ts';
+export declare const canonical: (v: Json) => string;
+export declare const digest: (blueprint: Json) => Promise<string>;

package/dist/being/digest.js

@@ -0,0 +1,37 @@
+// A value I-JSON has no room for: a key left empty, a function, a symbol.
+// None of them cross an edge, so none of them may reach a digest. A key
+// carrying one is dropped and a slot carrying one is null, which is what
+// crossing does to them, so the digest names what arrived and not what she
+// happened to be holding.
+const absent = (v) => v === undefined || typeof v === 'function' || typeof v === 'symbol';
+// JCS for I-JSON values: sorted keys, no whitespace, JSON escaping. Numbers
+// are serialized as ES does, which is what RFC 8785 specifies. A hole in a
+// list is null, as JSON writes it.
+export const canonical = (v) => {
+    if (Array.isArray(v))
+        return `[${Array.from(v, (slot) => (absent(slot) ? 'null' : canonical(slot))).join(',')}]`;
+    if (v !== null && typeof v === 'object') {
+        return `{${Object.keys(v)
+            .filter((k) => !absent(v[k]))
+            .sort()
+            .map((k) => `${JSON.stringify(k)}:${canonical(v[k])}`)
+            .join(',')}}`;
+    }
+    return JSON.stringify(v);
+};
+// Hex and the guard are spelled here and again in `src/ward/arithmetic.ts`,
+// which is the price of the boundary: nothing under `src/being` imports
+// anything above it, because this is the whole world a being's own code sees
+// and a being reaching the ward is the thing the shape is against.
+const hex = (bytes) => Array.from(new Uint8Array(bytes), (b) => b.toString(16).padStart(2, '0')).join('');
+// `crypto.subtle` is read at the call and never captured at load. A browser
+// on a plain http:// origin has `crypto` without `subtle`, and a terrain may
+// install one after this module is first imported; either way the failure is
+// one sentence and not a TypeError from inside a digest nobody can read.
+const subtle = () => {
+    const s = globalThis.crypto?.subtle;
+    if (!s)
+        throw new Error('this terrain has no crypto.subtle: a being needs a secure context to be described');
+    return s;
+};
+export const digest = async (blueprint) => hex(await subtle().digest('SHA-256', new TextEncoder().encode(canonical(blueprint))));

package/dist/being/index.d.ts

@@ -0,0 +1,5 @@
+export { Being, type AskSpec } from './being.ts';
+export { silence, isSilence, answered, unreached, isUnreached, word, isWord, wordOf, told, DOOR_WORDS, isDoorWord } from './silence.ts';
+export { digest, canonical } from './digest.ts';
+export { OWNER, PUBLIC, RESERVED_IDS, isBlueprint, invitationArgs, isInvitation } from './types.ts';
+export type * from './types.ts';

package/dist/being/index.js

@@ -0,0 +1,6 @@
+// SPDX-License-Identifier: Apache-2.0
+// nervur — the Being side. What a being author imports, if anything.
+export { Being } from './being.js';
+export { silence, isSilence, answered, unreached, isUnreached, word, isWord, wordOf, told, DOOR_WORDS, isDoorWord } from './silence.js';
+export { digest, canonical } from './digest.js';
+export { OWNER, PUBLIC, RESERVED_IDS, isBlueprint, invitationArgs, isInvitation } from './types.js';

package/dist/being/silence.d.ts

@@ -0,0 +1,12 @@
+import { type DoorWord, type Unreached, type Word, type WordName } from './types.ts';
+export declare const silence: unique symbol;
+export declare const isSilence: (x: unknown) => x is typeof silence;
+export declare const DOOR_WORDS: readonly DoorWord[];
+export declare const isDoorWord: (s: unknown) => s is DoorWord;
+export declare const word: <W extends WordName>(name: W) => Word<W>;
+export declare const isWord: (x: unknown) => x is Word;
+export declare const wordOf: (x: Word) => WordName;
+export declare const answered: <T>(x: T) => x is Exclude<T, typeof silence | Word>;
+export declare const told: (x: unknown) => unknown;
+export declare const unreached: () => Unreached;
+export declare const isUnreached: (x: unknown) => x is Unreached;