nervur 0.16.0 → 0.17.0

package/dist/ward/allowance.js

@@ -0,0 +1,71 @@
+// SPDX-License-Identifier: Apache-2.0
+// The allowance. Every ask carries, in its signed body, the time it may still
+// spend, in milliseconds. A being who says nothing gets her ward's default and
+// never thinks about it; one who wants to say so passes a third argument, and
+// is held to the ward's ceiling. The door reads it before anything is done
+// under it and refuses a budget already gone, as one silence like every other
+// refusal there. The sender bounds the whole of her ask to the same number,
+// and a wait that ran out is the word late, never silence and never unreached.
+//
+// Each ask is bounded on its own. The time an arriving call has left does not
+// bound the asks a being makes while answering it: attributing her onward ask
+// to the arrival that caused it needs a context the ward cannot get without
+// naming a runtime, and the ward names none. Every wait still ends.
+// How wide the default is, and how wide she may ask for, are the ward's own —
+// wider is more patient, and no peer can tell the difference except by being
+// refused. A being who never learns the third parameter exists writes correct
+// code forever under these. They are two numbers because the third argument
+// goes both ways: less for the ask she wants back quickly, more for the one
+// she knows is slow.
+export const DEFAULT = { time: 30_000 };
+export const CEILING = { time: 300_000 };
+// What she asked for, held to what her ward allows. A being cannot mint budget
+// nobody granted her: asking for a minute where the ward gives thirty seconds
+// is thirty seconds, silently, because the ceiling is not hers to know.
+// Asking for nothing at all is the default, which is the whole point.
+export function allow(wanted, ceiling = CEILING, base = DEFAULT) {
+    // Floored first, then tested: a fraction of a millisecond is not a budget,
+    // and falls to the default like every other number that is not a positive
+    // whole one.
+    const whole = (n, fallback) => {
+        const w = typeof n === 'number' ? Math.floor(n) : NaN;
+        return Number.isFinite(w) && w > 0 ? w : fallback;
+    };
+    return { time: Math.min(whole(wanted?.time, base.time), ceiling.time) };
+}
+// Whether a budget has anything left to spend, and the one reader of it: the
+// door calls this on arrival and nothing else asks the question anywhere. A
+// time that is not a whole number above zero is not a budget that ran out, it
+// is no budget at all, and the door refuses both the same way, since a peer
+// learns nothing from the difference. `allow` never makes one, so only bytes
+// off the road ever carry one.
+export const spent = (a) => !(Number.isSafeInteger(a.time) && a.time > 0);
+// What a wait that ran out comes back as. Its own value, held by nobody
+// outside the ward, so no answer from any door can be mistaken for it.
+export const LATE = Symbol('late');
+// A wait with an end. This is the one thing the ward times, and it covers the
+// whole of an ask, not only the wire: a relation that comes back round is
+// stopped at its own lane, before a single byte is sealed, and a bound that
+// only watched the wire would never see it. A timer is the only way to stop
+// waiting and every language that runs Quo has one; no runtime is named here.
+//
+// `rang` is called the moment the bell rings, before anyone waiting on the
+// wait is told: whoever holds work that has not started yet reads it and does
+// not start it. What comes back late is not read, and what has not left yet
+// does not leave.
+export async function within(ms, work, rang) {
+    let timer;
+    const bell = new Promise((ring) => {
+        timer = setTimeout(() => {
+            rang?.();
+            ring(LATE);
+        }, ms);
+    });
+    try {
+        return await Promise.race([work, bell]);
+    }
+    finally {
+        clearTimeout(timer);
+        void work.then(() => { }, () => { }); // whatever it was, it is nobody's answer now
+    }
+}

package/dist/ward/arithmetic.d.ts

@@ -0,0 +1,31 @@
+export declare const KEY = 32;
+export declare const SIGNATURE = 64;
+export declare const NONCE = 12;
+export declare const TAG = 16;
+export declare function hex(bytes: Uint8Array | ArrayBuffer): string;
+export declare function unhex(text: string): Uint8Array;
+export declare function concat(parts: Uint8Array[]): Uint8Array;
+export declare function sameBytes(a: Uint8Array, b: Uint8Array): boolean;
+export declare const smallOrder: (pk: Uint8Array) => boolean;
+export declare const heldKeys: () => {
+    held: number;
+    bound: number;
+};
+export declare function sha256(...parts: Uint8Array[]): Promise<Uint8Array>;
+export type Pair = {
+    secret: Uint8Array;
+    pk: Uint8Array;
+};
+export declare function signingPair(seed: Uint8Array): Promise<Pair>;
+export declare function sealingPair(seed: Uint8Array): Promise<Pair>;
+export declare function sign(message: Uint8Array, secret: Uint8Array): Promise<Uint8Array>;
+export declare function verify(message: Uint8Array, signature: Uint8Array, pk: Uint8Array): Promise<boolean>;
+export declare function agree(secret: Uint8Array, peerPk: Uint8Array): Promise<Uint8Array>;
+export declare function derive(secret: Uint8Array, label: Uint8Array, bytes: number): Promise<Uint8Array>;
+export declare function encrypt(shared: Uint8Array, plaintext: Uint8Array, aad: Uint8Array): Promise<Uint8Array>;
+export declare function decrypt(shared: Uint8Array, ciphertext: Uint8Array, aad: Uint8Array): Promise<Uint8Array>;
+export declare function box(inside: Uint8Array, padlock: Uint8Array, seed: Uint8Array): Promise<{
+    bytes: Uint8Array;
+    ephemeral: Pair;
+}>;
+export declare function unbox(bytes: Uint8Array, padlockSecret: Uint8Array): Promise<Uint8Array>;

package/dist/ward/arithmetic.js

@@ -0,0 +1,245 @@
+// SPDX-License-Identifier: Apache-2.0
+// Four algorithms, named once and never negotiated: Ed25519 signs, X25519
+// agrees, SHA-256 hashes, AES-256-GCM encrypts with the key derived through
+// HKDF-SHA-256 under a fixed label. All four live in `crypto.subtle`, so this
+// takes no package and runs the same in a browser tab as on a server -- on
+// any terrain that carries them. SHA-256, AES-GCM and HKDF are everywhere;
+// the two curves are recent, and a terrain without them is a terrain no ward
+// runs on. `test/floor.test.ts` names the floor and probes for it. Subtle is
+// asynchronous, so everything here is.
+//
+// `crypto.subtle` is read at every use and never captured at load. A browser
+// on a plain http:// origin has `crypto` without `subtle`, and a terrain may
+// install one after this module is first imported; a reference taken here
+// would turn either into an unreadable failure deep inside a key import.
+const subtle = () => {
+    const s = globalThis.crypto?.subtle;
+    if (!s)
+        throw new Error('this terrain has no crypto.subtle: a ward needs a secure context');
+    return s;
+};
+export const KEY = 32;
+export const SIGNATURE = 64;
+export const NONCE = 12;
+export const TAG = 16;
+const SEAL_INFO = new TextEncoder().encode('quo-seal');
+const SALT = new Uint8Array(0);
+// A 32-byte secret plus a fixed prefix is the whole PKCS#8 wrapping for both curves.
+const ED_SECRET = unhex('302e020100300506032b657004220420');
+const X_SECRET = unhex('302e020100300506032b656e04220420');
+const ED = { name: 'Ed25519' };
+const X = { name: 'X25519' };
+const HEX = Array.from({ length: 256 }, (_, at) => at.toString(16).padStart(2, '0'));
+export function hex(bytes) {
+    let out = '';
+    for (const byte of new Uint8Array(bytes))
+        out += HEX[byte];
+    return out;
+}
+export function unhex(text) {
+    const out = new Uint8Array(text.length / 2);
+    for (let at = 0; at < out.length; at += 1)
+        out[at] = parseInt(text.slice(at * 2, at * 2 + 2), 16);
+    return out;
+}
+export function concat(parts) {
+    const out = new Uint8Array(parts.reduce((n, p) => n + p.length, 0));
+    let at = 0;
+    for (const part of parts) {
+        out.set(part, at);
+        at += part.length;
+    }
+    return out;
+}
+export function sameBytes(a, b) {
+    if (a.length !== b.length)
+        return false;
+    let diff = 0;
+    for (let at = 0; at < a.length; at += 1)
+        diff |= a[at] ^ b[at];
+    return diff === 0;
+}
+// The eight small-order points of Ed25519, in their canonical encoding. A
+// public key among them verifies nothing. An encoding whose y coordinate is
+// not reduced, y at or above the field's prime p, names one of the same
+// points under another spelling, and a terrain's verify may accept a zero
+// signature under it; the field has room for the spelling, so it is refused
+// before the list is read.
+const SMALL_ORDER = [
+    '0100000000000000000000000000000000000000000000000000000000000000',
+    'ecffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff7f',
+    '0000000000000000000000000000000000000000000000000000000000000000',
+    '0000000000000000000000000000000000000000000000000000000000000080',
+    '26e8958fc2b227b045c3f489f2ef98f0d5dfac05d3c63339b13802886d53fc05',
+    'c7176a703d4dd84fba3c0b760d10670f2a2053fa2c39ccc64ec7fd7792ac037a',
+    '26e8958fc2b227b045c3f489f2ef98f0d5dfac05d3c63339b13802886d53fc85',
+    'c7176a703d4dd84fba3c0b760d10670f2a2053fa2c39ccc64ec7fd7792ac03fa',
+].map(unhex);
+// y >= p, read little-endian with the sign bit masked off: the top byte is
+// 0x7f under the mask, every middle byte is 0xff, and the low byte is at
+// least 0xed, which is p's.
+const unreduced = (pk) => (pk[31] & 0x7f) === 0x7f && pk[0] >= 0xed && pk.subarray(1, 31).every((b) => b === 0xff);
+export const smallOrder = (pk) => unreduced(pk) || SMALL_ORDER.some((p) => sameBytes(p, pk));
+const key32 = (value, what) => {
+    if (!(value instanceof Uint8Array) || value.length !== KEY)
+        throw new Error(`${what} is not a 32-byte key`);
+    return value;
+};
+const pkcs8 = (prefix, value, what) => concat([prefix, key32(value, what)]);
+// Importing a key is the most expensive thing on the path of an ask, and most
+// of the imports are the same key again: a ward signs every reply with the one
+// key, opens every ask with the one padlock, and verifies a relation under the
+// key it verified it under last time. Measured over a round trip, fifteen of
+// the twenty-five imports were bytes already imported once.
+//
+// So an imported key is kept, by the bytes it was imported from. A CryptoKey
+// cannot be changed once it exists, so handing the same one out twice is
+// handing out what a second import would have built. Nothing here is a
+// decision a peer can see: two wards that cache differently, or not at all,
+// speak the same bytes.
+//
+// It is bounded, and that is not a detail. A relation mints a fresh key on
+// every ask, so a ward that talked all day would otherwise hold a key for
+// every ask it ever made. Past the bound the least recently used goes, which
+// is the key of a relation that has fallen quiet, and importing it again
+// costs what it cost the first time.
+//
+// The secret keys in here are the ones the partition already holds in this
+// process, as seeds. The cache is another shape of what the ward is already
+// standing on, and never a second place a secret comes from.
+const KEYS = 512;
+const imported = new Map();
+const keep = (id, make) => {
+    const had = imported.get(id);
+    if (had !== undefined) {
+        imported.delete(id); // and set again below: the most recently used goes last
+        imported.set(id, had);
+        return had;
+    }
+    const made = make();
+    // A key that would not import is not kept: the next call asks subtle again
+    // and hears the same refusal, rather than reading one this cache remembered.
+    // Node takes any thirty-two bytes as a public key and finds out at verify,
+    // so nothing here reaches this line; a terrain that checks the point at the
+    // import does, and a refusal it remembered would be a relation killed for
+    // good by one bad arrival.
+    made.catch(() => imported.delete(id));
+    imported.set(id, made);
+    // One in, at most one out: a map keeps what was put in the order it was put,
+    // so the first key it names is the one used longest ago.
+    if (imported.size > KEYS)
+        imported.delete(imported.keys().next().value);
+    return made;
+};
+// How many imported keys are held, and the bound they are held under. Nothing
+// in the ward reads either: they are here to be looked at, and for the suite
+// that holds the bound to what it says.
+export const heldKeys = () => ({ held: imported.size, bound: KEYS });
+const secretKey = (alg, prefix, value, what, uses) => {
+    const bytes = pkcs8(prefix, value, what);
+    return keep(`${alg.name}|${uses.join('+')}|${hex(bytes)}`, () => subtle().importKey('pkcs8', bytes, alg, true, uses));
+};
+const publicKey = (alg, value, what, uses) => {
+    const bytes = key32(value, what);
+    return keep(`${alg.name}|${uses.join('+')}|pk|${hex(bytes)}`, () => subtle().importKey('raw', bytes, alg, true, uses));
+};
+// Subtle exports the public half of a private key only through a JWK, where
+// `x` is the 32 raw bytes in base64url. The answer is a fact about the key and
+// never changes, so it is kept beside the key it was read from and goes when
+// the key does.
+const publics = new WeakMap();
+function rawPublic(secret) {
+    const had = publics.get(secret);
+    if (had !== undefined)
+        return had;
+    const read = (async () => {
+        const jwk = await subtle().exportKey('jwk', secret);
+        const binary = atob(jwk.x.replaceAll('-', '+').replaceAll('_', '/'));
+        const out = new Uint8Array(binary.length);
+        for (let at = 0; at < binary.length; at += 1)
+            out[at] = binary.charCodeAt(at);
+        return out;
+    })();
+    publics.set(secret, read);
+    return read;
+}
+export async function sha256(...parts) {
+    return new Uint8Array(await subtle().digest('SHA-256', concat(parts)));
+}
+// Both halves are copies. The seed and the public key are kept behind the two
+// caches above, and a pair is handed to whoever asked for it: what she does
+// with the bytes in her hand is hers, and must not reach what the next caller
+// is given.
+export async function signingPair(seed) {
+    const secret = await secretKey(ED, ED_SECRET, seed, 'seed', ['sign']);
+    return { secret: Uint8Array.from(seed), pk: Uint8Array.from(await rawPublic(secret)) };
+}
+export async function sealingPair(seed) {
+    const secret = await secretKey(X, X_SECRET, seed, 'seed', ['deriveBits']);
+    return { secret: Uint8Array.from(seed), pk: Uint8Array.from(await rawPublic(secret)) };
+}
+export async function sign(message, secret) {
+    const key = await secretKey(ED, ED_SECRET, secret, 'secret', ['sign']);
+    return new Uint8Array(await subtle().sign(ED, key, message));
+}
+export async function verify(message, signature, pk) {
+    if (!(signature instanceof Uint8Array) || signature.length !== SIGNATURE)
+        return false;
+    if (!(pk instanceof Uint8Array) || pk.length !== KEY || smallOrder(pk))
+        return false;
+    try {
+        return await subtle().verify(ED, await publicKey(ED, pk, 'pk', ['verify']), signature, message);
+    }
+    catch {
+        return false;
+    }
+}
+export async function agree(secret, peerPk) {
+    const key = await secretKey(X, X_SECRET, secret, 'secret', ['deriveBits']);
+    const peer = await publicKey(X, peerPk, 'padlock', []);
+    const shared = new Uint8Array(await subtle().deriveBits({ name: X.name, public: peer }, key, KEY * 8));
+    if (shared.every((b) => b === 0))
+        throw new Error('dead agreement'); // a padlock that was not a real key
+    return shared;
+}
+// HKDF-SHA-256: bytes from a secret, under a label that says what they are
+// for. No salt, because the secret handed in is already a secret of full
+// strength and the label is what keeps one use apart from another. Every
+// label in this kit is spelled where it is used, never here: this is
+// arithmetic and a label is a decision.
+export async function derive(secret, label, bytes) {
+    const material = await subtle().importKey('raw', secret, 'HKDF', false, ['deriveBits']);
+    return new Uint8Array(await subtle().deriveBits({ name: 'HKDF', hash: 'SHA-256', salt: SALT, info: label }, material, bytes * 8));
+}
+// One HKDF-SHA-256 yields the AES key and the nonce together. The nonce needs
+// no randomness of its own: the key it pairs with is fresh on every message.
+async function cipherKey(shared, use) {
+    const out = await derive(shared, SEAL_INFO, KEY + NONCE);
+    return { key: await subtle().importKey('raw', out.subarray(0, KEY), 'AES-GCM', false, [use]), nonce: out.subarray(KEY) };
+}
+// The additional authenticated data is the ephemeral public key: the one thing outside the seal, bound to it.
+export async function encrypt(shared, plaintext, aad) {
+    const { key, nonce } = await cipherKey(shared, 'encrypt');
+    return new Uint8Array(await subtle().encrypt({ name: 'AES-GCM', iv: nonce, additionalData: key32(aad, 'aad'), tagLength: TAG * 8 }, key, plaintext));
+}
+export async function decrypt(shared, ciphertext, aad) {
+    if (ciphertext.length < TAG)
+        throw new Error('short input');
+    const { key, nonce } = await cipherKey(shared, 'decrypt');
+    return new Uint8Array(await subtle().decrypt({ name: 'AES-GCM', iv: nonce, additionalData: key32(aad, 'aad'), tagLength: TAG * 8 }, key, ciphertext));
+}
+// A box: an ephemeral X25519 pk outside, one ciphertext sealed to the
+// padlock. The answer to a box is a box sealed to that ephemeral pk, so the
+// sender keeps the ephemeral secret until the answer comes.
+export async function box(inside, padlock, seed) {
+    const ephemeral = await sealingPair(seed);
+    const shared = await agree(ephemeral.secret, padlock);
+    return { bytes: concat([ephemeral.pk, await encrypt(shared, inside, ephemeral.pk)]), ephemeral };
+}
+export async function unbox(bytes, padlockSecret) {
+    if (bytes.length <= KEY)
+        throw new Error('short input');
+    const ephemeralPk = bytes.subarray(0, KEY);
+    const shared = await agree(padlockSecret, ephemeralPk);
+    return decrypt(shared, bytes.subarray(KEY), ephemeralPk);
+}

package/dist/ward/cells.d.ts

@@ -0,0 +1,7 @@
+import type { Cells } from '../being/types.ts';
+export declare const DEPTH = 64;
+export declare const BREADTH: number;
+export declare const cellFault: (v: unknown, path: string) => string | null;
+export declare const unkeepable: (k: string) => boolean;
+export declare const guardCells: (cells: Cells, wrote?: () => void) => Cells;
+export declare const unguarded: (cells: Cells) => Cells;

package/dist/ward/cells.js

@@ -0,0 +1,186 @@
+// How deep a value may nest. Every walk over a value in the kit recurses,
+// and a peer chooses the depth of what she answers; a bound keeps a hostile
+// reply from ending a walk in a stack overflow instead of a refusal.
+export const DEPTH = 64;
+// How many values one written out may come to. Depth alone does not bound
+// what a value costs to keep: one subvalue may sit under two keys, and
+// nesting that forty levels deep is inside the depth bound and is a trillion
+// values once written down. What is walked here is the object graph, which is
+// small; what a harbor keeps is the tree it expands to, which is not. So the
+// walk counts the tree while it proves the graph, and refuses a value nobody
+// could write down. This is a bound on what a being holds, so it is this
+// kit's number and no word of the spec.
+export const BREADTH = 1 << 20;
+// Text a harbor can write down: every surrogate in a pair. A lone one is a
+// code unit with no character, which JSON escapes and UTF-8 cannot encode at
+// all, so a harbor that keeps strings as bytes loses it and one that keeps
+// the object does not. I-JSON says a string is text, and this is that rule
+// where the value is written rather than where it is read.
+const WELL_FORMED = /^(?:[^\uD800-\uDFFF]|[\uD800-\uDBFF][\uDC00-\uDFFF])*$/;
+// I-JSON, all the way down. A number that JSON cannot write is not a number
+// a harbor can keep, a key on the prototype is not a key she wrote, and a
+// hole in a list, or a key named `__proto__`, is a thing JSON writes one way
+// and a runtime reads another.
+//
+// A fault is a sentence; anything else is the count of values under this one,
+// itself included. A value already counted is a value already proven, so a
+// graph that shares is walked once per node rather than once per path.
+function walk(v, path, seen, sized, depth) {
+    if (v === null || typeof v === 'boolean')
+        return 1;
+    if (typeof v === 'string')
+        return WELL_FORMED.test(v) ? 1 : `${path} carries a lone surrogate, which is no text a harbor can write down`;
+    if (typeof v === 'number') {
+        if (!Number.isFinite(v))
+            return `${path} is ${String(v)}, which no harbor can write down`;
+        // Minus zero is a number JSON writes as `0` and reads back as `0`. A
+        // harbor that keeps values would hand her the sign she wrote and one that
+        // writes JSON would not, and she is never told which she is standing in.
+        return Object.is(v, -0) ? `${path} is minus zero, which comes back as zero from every harbor that writes JSON` : 1;
+    }
+    if (typeof v !== 'object')
+        return `${path} is a ${typeof v}, which is not a value`;
+    if (seen.has(v))
+        return `${path} refers back to itself`;
+    const counted = sized.get(v);
+    if (counted !== undefined)
+        return counted;
+    if (depth >= DEPTH)
+        return `${path} is nested past ${DEPTH} levels, which no harbor can keep`;
+    seen.add(v);
+    try {
+        let size = 1;
+        const under = (where, x) => {
+            const r = walk(x, where, seen, sized, depth + 1);
+            if (typeof r === 'string')
+                return r;
+            size += r;
+            return size > BREADTH ? `${path} writes out to more than ${BREADTH} values, which no harbor can keep` : null;
+        };
+        if (Array.isArray(v)) {
+            for (let i = 0; i < v.length; i += 1) {
+                if (!(i in v))
+                    return `${path}[${i}] is a hole, which no harbor can write down`;
+                const f = under(`${path}[${i}]`, v[i]);
+                if (f)
+                    return f;
+            }
+            sized.set(v, size);
+            return size;
+        }
+        const proto = Object.getPrototypeOf(v);
+        if (proto !== Object.prototype && proto !== null)
+            return `${path} is a ${(v).constructor?.name ?? 'object'}, which is not a value`;
+        for (const k of Object.keys(v)) {
+            if (k === '__proto__')
+                return `${path}.__proto__ is a key no harbor can keep`;
+            const f = under(`${path}.${k}`, v[k]);
+            if (f)
+                return f;
+        }
+        sized.set(v, size);
+        return size;
+    }
+    finally {
+        seen.delete(v);
+    }
+}
+export const cellFault = (v, path) => {
+    const out = walk(v, path, new Set(), new Map(), 0);
+    return typeof out === 'string' ? out : null;
+};
+// The three keys at the root of her cells that are the ward's: it writes
+// them, she reads them, and a write of hers there is refused like a non-value.
+const WARDS = new Set(['standings', 'occupants', 'class']);
+// The guard is one proxy at the root and one for every container read through
+// it, so a write nested three deep is refused the same way a write at the top
+// is. Wrappers are remembered, so reading the same array twice is the same
+// object twice and a being may still compare what she holds.
+const wrapped = new WeakMap();
+const targets = new WeakMap();
+const guards = new WeakSet();
+// A name no partition can hold, wherever it appears. It is here beside the
+// guard that refuses it, because the ward refuses it too: a relation named
+// this one would be written into the bind table and then throw on her cells,
+// which is half a relation and a throw where a null is promised. One rule,
+// one place, read by the guard and by the stance.
+export const unkeepable = (k) => k === '__proto__';
+// A key a write may land on: a string that is not `__proto__`, and not one
+// of the ward's at the root. A symbol key is a thing JSON never writes.
+const refuse = (why) => {
+    throw new TypeError(`cells hold values: ${why}`);
+};
+function keyFault(t, k, v, path, root) {
+    if (typeof k !== 'string')
+        refuse(`${path} takes no symbol key`);
+    if (unkeepable(k))
+        refuse(`${path}.__proto__ is a key no harbor can keep`);
+    if (root && WARDS.has(k))
+        refuse(`${path}.${k} is the ward's to write`);
+    // A list grows by one at its end, or it has holes JSON cannot write. A
+    // push sets the slot at its length and then the length: both pass. A
+    // length set past what she wrote, or a slot beyond it, would leave holes.
+    if (Array.isArray(t)) {
+        if (k === 'length') {
+            if (typeof v !== 'number' || v > t.length)
+                refuse(`${path}.length set past what she wrote would leave holes`);
+            return;
+        }
+        const i = Number(k);
+        if (Number.isInteger(i) && i > t.length)
+            refuse(`${path}[${i}] would leave a hole`);
+    }
+}
+function guard(target, path, wrote, root = false) {
+    if (guards.has(target))
+        return target;
+    const had = wrapped.get(target);
+    if (had)
+        return had;
+    const p = new Proxy(target, {
+        get(t, k, r) {
+            const v = Reflect.get(t, k, r);
+            // A container reached through her cells is part of her cells.
+            return v !== null && typeof v === 'object' && !ArrayBuffer.isView(v) ? guard(v, `${path}.${String(k)}`, wrote) : v;
+        },
+        set(t, k, v, r) {
+            keyFault(t, k, v, path, root);
+            const f = cellFault(v, `${path}.${String(k)}`);
+            if (f)
+                refuse(f);
+            const ok = Reflect.set(t, k, v, r);
+            wrote();
+            return ok;
+        },
+        defineProperty(t, k, d) {
+            if (!('value' in d))
+                refuse(`${path}.${String(k)} is an accessor, which no harbor can keep`);
+            keyFault(t, k, d.value, path, root);
+            const f = cellFault(d.value, `${path}.${String(k)}`);
+            if (f)
+                refuse(f);
+            const ok = Reflect.defineProperty(t, k, d);
+            wrote();
+            return ok;
+        },
+        deleteProperty(t, k) {
+            if (root && typeof k === 'string' && WARDS.has(k))
+                refuse(`${path}.${k} is the ward's to keep`);
+            const ok = Reflect.deleteProperty(t, k);
+            wrote();
+            return ok;
+        },
+    });
+    wrapped.set(target, p);
+    targets.set(p, target);
+    guards.add(p);
+    return p;
+}
+// Her cells, guarded. Called once per being at boot; the guarded object is
+// what goes into the partition and what the stance hands her, so there is no
+// second door onto the same cells. Every write that passes says so to the
+// ward, which says so to its harbor.
+export const guardCells = (cells, wrote = () => { }) => guard(cells, 'cells', wrote, true);
+// The cells behind the guard, for the ward alone: the one writer of the
+// three keys that are its own.
+export const unguarded = (cells) => (targets.get(cells) ?? cells);

package/dist/ward/door.d.ts

@@ -0,0 +1,18 @@
+import type { Asker, BeingLike, JsonObject, OccupantRecord } from '../being/types.ts';
+import type { Heirs } from './heirs.ts';
+import { type ReplyPayload, type WardKey } from './seal.ts';
+export type Door = {
+    key: string;
+    being: BeingLike;
+    cells: {
+        occupants: Record<string, OccupantRecord>;
+    };
+};
+export type Judged = {
+    bytes: Uint8Array;
+    heard: boolean;
+};
+export declare function answered(door: Door, asker: Asker, method: string | undefined, args: JsonObject, bound: boolean): Promise<ReplyPayload>;
+export declare function arrive(door: Door, asker: Asker, method: string | undefined, args: JsonObject, bound: boolean): Promise<ReplyPayload>;
+export declare function seen(door: Door, asker: Asker): Promise<string | null>;
+export declare function makeDoor(key: WardKey, heirs: Heirs, doors: Map<string, Door>, publicKey: () => string | null, random: (n: number) => Uint8Array, keep: () => Promise<boolean>): (bytes: Uint8Array) => Promise<Judged>;