nervur 0.18.0 → 0.19.1

package/dist/ward/ground.js

@@ -1,8 +1,30 @@
-// ---- what every harbor builds a ground out of. Three pieces, because every
-// harbor in this tree writes the same three and the protocol keeps the harbors
-// themselves apart: what a memory harbor and a real one differ on is the
-// route and the store, and nothing here. A second kit writes its own harbor
-// and may write these again; they are convenience, never contract.
+// The body that keeps nothing: the process is the memory.
+export const volatile = (rows = {}) => ({ rows, told: () => { }, kept: () => Promise.resolve(true), during: () => () => { } });
+// The device is one standing. What a box can do is beings, in a ward its
+// harbor booted and roots, and one being there, the box's own, holds a
+// standing at each of them under the name it is lent as. The ground carries
+// one invitation on her, minted for this ward alone; the ward takes it at
+// boot under `BOX`, as its own first being, and from then on the device is
+// reached the way anything is reached: what it offers is her describe, and a
+// lend is the ask `OFFER` on that standing, naming what a being wants.
+//
+// She answers the lent being's own invitation, minted by that being on herself,
+// and the ward knocks and takes it in the being's name. No root mints for a
+// lend, and the invitation never reaches the being: it is the device's, a
+// value she could copy is one she could hand to anyone, so the ward holds
+// it and hands her the id. Which ward may have which name is the box's own
+// gate, reading who asks, and a stranger's ward holds no standing at her.
+//
+// A harbor with no box leaves it out, and every lend is null. A ward that
+// could not take it at boot, the box down or the invitation spent, boots all
+// the same, lends nothing this run, and tries again at the next.
+export { BOX } from '../being/lent.js';
+export const OFFER = 'offer';
+// A lend that was offered and not taken leaves nothing: the ward says so to
+// the box, naming the heir, and the lent being removes what she minted.
+export const RETRACT = 'retract';
+// ---- what every harbor builds a ground out of. Convenience, never contract:
+// a second kit writes its own harbor and may write these again.
 // The code half of a ground, and the map back to what it made. A class is
 // found by own key only, since `constructor` is a name Object lends every
 // registry, and the first registry holding the name wins, so a ward's own
@@ -18,17 +40,13 @@ export const maker = (objects, ...registries) => (className, stance) => {
     objects.set(stance.cells, obj);
     return obj;
 };
-// Entropy, from the one place every terrain that runs Quo has it. Every key a
-// ward mints is drawn from this, so a harbor that wants another source hands
-// its own and nothing here has to know.
+// Entropy, from the one place every terrain that runs Quo has it.
 export const entropy = (n) => globalThis.crypto.getRandomValues(new Uint8Array(n));
 // A ward's pk, learned the way anyone learns anything: by asking. The empty
 // ask on the ask pointer is the ward's own describe and its notes carry the
 // pk. A harbor has no other way to it and wants none: the ward mints it from
 // the seed, and a harbor that read it off the seed itself would be a second
-// derivation to keep in step with the first. A ward that answers anything
-// else is not one this harbor can route to, and says so here rather than
-// leaving an undefined pk in a directory.
+// derivation to keep in step with the first.
 export async function learnPk(w) {
     const notes = (await w.ask());
     const pk = notes?.notes?.pk;

package/dist/ward/heirs.js

@@ -1,6 +1,8 @@
 import { GONE } from './partition.js';
-// How wide the span is, is the ward's own — wider is more forgiving of a
-// rough road, and no peer can tell the difference except by being refused.
+// How wide the span is, is the spec's and never a ward's. Wider is more
+// forgiving of a rough road, and that is exactly why it is not a ward's to
+// choose: a peer tells two doors apart by being refused at one and answered
+// at the other, which is one relation dying over one number.
 const SPAN = 64;
 export class Heirs {
     #p;

package/dist/ward/index.d.ts

@@ -1,5 +1,6 @@
 export { Ward } from './ward.ts';
-export type { Ground, WardPointers, Lend } from './ground.ts';
+export type { Ground, WardPointers, Memory } from './ground.ts';
+export { BOX, OFFER, RETRACT, volatile } from './ground.ts';
 export type { Partition, Heir, Bind, StandingKeys } from './partition.ts';
 export { GONE, MINTED, KNOCKS } from './partition.ts';
 export type { AskPayload, ReplyPayload } from './seal.ts';

package/dist/ward/index.js

@@ -1,6 +1,7 @@
 // SPDX-License-Identifier: Apache-2.0
 // nervur/ward — one function. Every ward is the same ward.
 export { Ward } from './ward.js';
+export { BOX, OFFER, RETRACT, volatile } from './ground.js';
 // The three bounds on what a partition may hold, for a kit that must keep
 // the same ones and for a test that pins them.
 export { GONE, MINTED, KNOCKS } from './partition.js';

package/dist/ward/json.d.ts

@@ -0,0 +1,2 @@
+export declare function numberFault(literal: string): string | null;
+export declare function readJson(input: Uint8Array | string): unknown;

package/dist/ward/json.js

@@ -0,0 +1,163 @@
+// SPDX-License-Identifier: Apache-2.0
+// The one reader of JSON that crossed an edge. A runtime's own parser is
+// where two kits stop agreeing: it keeps the last of two keys of one name,
+// rounds a whole number no double holds, reads a number past the doubles as
+// infinity, and mends bytes that are not UTF-8 into a replacement character.
+// Each of those is text two kits read two ways, so each is refused here, where
+// it is read, with a throw the caller already turns into what bytes that said
+// nothing are.
+//
+// What a value is beyond its text, a lone surrogate, a key named `__proto__`,
+// a nesting past the bound, is the value rule's, and `cellFault` in cells.ts
+// is its one reader. This file holds the rules that live only in the text.
+const utf8 = new TextDecoder('utf-8', { fatal: true, ignoreBOM: true });
+const fail = (at, why) => {
+    throw new Error(`JSON at ${at}: ${why}`);
+};
+// A number text, held to the Values chapter. A text naming a whole number
+// stands only if that number is exactly a double, or if the text is how
+// ECMAScript writes the double it reads as. A text past the largest double,
+// or naming a value other than zero that rounds to zero, is refused, and so
+// is minus zero in any spelling.
+export function numberFault(literal) {
+    const m = /^(-?)(0|[1-9]\d*)(?:\.(\d+))?(?:[eE]([+-]?\d+))?$/.exec(literal);
+    if (!m)
+        return 'not a number';
+    const [, sign, whole, frac = '', exp = '0'] = m;
+    const v = Number(literal);
+    if (!Number.isFinite(v))
+        return 'past the largest double';
+    let digits = (whole + frac).replace(/^0+/, '');
+    if (v === 0) {
+        if (digits !== '')
+            return 'a value other than zero that rounds to zero';
+        return sign ? 'minus zero' : null;
+    }
+    // The exact value is digits times ten to e. A finite double bounds e from
+    // above, so the power below is never larger than the double's own width.
+    let e = BigInt(exp) - BigInt(frac.length);
+    const trimmed = digits.replace(/0+$/, '');
+    e += BigInt(digits.length - trimmed.length);
+    digits = trimmed;
+    if (e < 0n)
+        return null; // a fraction: the double nearest it, as every reader takes it
+    const exact = BigInt(digits) * 10n ** e;
+    if (exact === (v < 0 ? -BigInt(v) : BigInt(v)))
+        return null;
+    return literal === String(v) ? null : 'a whole number that is not exactly a double';
+}
+// Bytes to a value, or a throw.
+export function readJson(input) {
+    const s = typeof input === 'string' ? input : utf8.decode(input);
+    let at = 0;
+    const space = () => {
+        for (;;) {
+            const c = s.charCodeAt(at);
+            if (c === 0x20 || c === 0x09 || c === 0x0a || c === 0x0d)
+                at += 1;
+            else
+                return;
+        }
+    };
+    const string = () => {
+        const start = at;
+        at += 1;
+        for (;;) {
+            const c = s.charCodeAt(at);
+            if (Number.isNaN(c))
+                fail(start, 'an unterminated string');
+            if (c === 0x22)
+                break;
+            if (c < 0x20)
+                fail(at, 'a control character in a string');
+            at += c === 0x5c ? 2 : 1;
+        }
+        at += 1;
+        // The escapes are JSON's own, and the runtime reads them the one way.
+        return JSON.parse(s.slice(start, at));
+    };
+    const value = () => {
+        space();
+        const c = s[at];
+        if (c === '{') {
+            at += 1;
+            const out = {};
+            const keys = new Set();
+            space();
+            if (s[at] === '}') {
+                at += 1;
+                return out;
+            }
+            for (;;) {
+                space();
+                if (s[at] !== '"')
+                    fail(at, 'a key that is not a string');
+                const where = at;
+                const k = string();
+                if (keys.has(k))
+                    fail(where, `two keys named ${JSON.stringify(k)}`);
+                keys.add(k);
+                space();
+                if (s[at] !== ':')
+                    fail(at, 'a key with no colon');
+                at += 1;
+                // Defined, never assigned: a key named `__proto__` is an own key here
+                // as it is in JSON.parse, and the value rule refuses it after.
+                Object.defineProperty(out, k, { value: value(), enumerable: true, writable: true, configurable: true });
+                space();
+                if (s[at] === ',')
+                    at += 1;
+                else if (s[at] === '}') {
+                    at += 1;
+                    return out;
+                }
+                else
+                    fail(at, 'an object not closed');
+            }
+        }
+        if (c === '[') {
+            at += 1;
+            const out = [];
+            space();
+            if (s[at] === ']') {
+                at += 1;
+                return out;
+            }
+            for (;;) {
+                out.push(value());
+                space();
+                if (s[at] === ',')
+                    at += 1;
+                else if (s[at] === ']') {
+                    at += 1;
+                    return out;
+                }
+                else
+                    fail(at, 'a list not closed');
+            }
+        }
+        if (c === '"')
+            return string();
+        for (const [word, v] of [['true', true], ['false', false], ['null', null]]) {
+            if (s.startsWith(word, at)) {
+                at += word.length;
+                return v;
+            }
+        }
+        const m = /-?\d+(?:\.\d+)?(?:[eE][+-]?\d+)?/y;
+        m.lastIndex = at;
+        const hit = m.exec(s);
+        if (!hit)
+            return fail(at, 'no value');
+        const why = numberFault(hit[0]);
+        if (why !== null)
+            fail(at, `${hit[0]} is ${why}`);
+        at += hit[0].length;
+        return Number(hit[0]);
+    };
+    const out = value();
+    space();
+    if (at !== s.length)
+        fail(at, 'text after the value');
+    return out;
+}

package/dist/ward/partition.js

@@ -250,7 +250,7 @@ export const restoreRow = (p, row, value) => {
         drop(p.beings ?? {}, row);
         // Her bind goes with her: a being the store never kept has no relation
         // anybody is standing on, so there is nothing to leave forward.
-        drop((p.bind ?? {}), row);
+        drop(p.bind ?? {}, row);
         return;
     }
     // Behind the guard and never through it: a being's cells in a partition
@@ -267,7 +267,7 @@ export const restoreRow = (p, row, value) => {
         for (const [k, v] of Object.entries(kept))
             put(held, k, v);
     };
-    into((p.beings ?? {}), (value.cells ?? emptyCells()));
+    into(p.beings ?? {}, (value.cells ?? emptyCells()));
 };
 // The partition back from its rows. A head that is absent is a partition
 // nobody has written, and `open` makes an empty one of it.

package/dist/ward/seal.js

@@ -1,8 +1,8 @@
 import { isDoorWord } from '../being/silence.js';
 import { KEY, SIGNATURE, box, concat, derive, hex, sha256, sign, signingPair, sealingPair, unbox, unhex, verify } from './arithmetic.js';
 import { cellFault } from './cells.js';
+import { readJson } from './json.js';
 const utf8 = new TextEncoder();
-const text = new TextDecoder();
 // The two labels a ward's keys are derived under. They are here and not in
 // arithmetic.ts because a label is a decision and that file is arithmetic.
 // `quo-seal` is taken: it is the label the message cipher derives its key and
@@ -26,7 +26,7 @@ export const SIZE = 1024 * 1024;
 // designs and no separation at all: one secret would be doing two jobs with
 // nothing said about it, and a second kit would have to reproduce a
 // construction nobody named. HKDF-SHA-256 under a label is the separation
-// said out loud, and it is what `protocol/vectors/framing.json` pins.
+// said out loud, and it is what `quo/vectors/framing.json` pins.
 //
 // Bytes are key material and text is not. A seed handed in as bytes of the
 // key length is taken as it stands, which is what a harbor mints; anything
@@ -70,7 +70,7 @@ export async function openAsk(bytes, padlockSecret) {
             return null;
         const body = inside.subarray(0, inside.length - SIGNATURE);
         const signature = inside.subarray(inside.length - SIGNATURE);
-        const payload = JSON.parse(text.decode(body));
+        const payload = readJson(body);
         // The heir, or null for the public being. Absent is not null: a payload
         // that never named one is malformed, like any other missing field.
         const to = payload.to;
@@ -112,7 +112,9 @@ export async function sealReply(reply, ephemeralPk, wardSign, seed) {
 // lied, or it is not a reply. Every ward on the wire is somebody else's code,
 // so the shape is checked here and nowhere later: a reply is `{ silence }`,
 // `{ quo: word }` with a word the door may say, or `{ object, seen }` with an
-// object present and seen a digest or null.
+// object that is a value and seen a digest or null. A field beside a shape's
+// own makes it none of the three, since a kit that dropped the field would
+// hand her an answer where this one hands her silence.
 // Anything else is bytes that said nothing, and her ward never hands her a
 // throw or an absent value for what a stranger wrote.
 export async function openReply(bytes, ephemeralSecret, signPk) {
@@ -125,18 +127,21 @@ export async function openReply(bytes, ephemeralSecret, signPk) {
         const body = inside.subarray(0, inside.length - SIGNATURE);
         if (!(await verify(body, inside.subarray(inside.length - SIGNATURE), signPk)))
             return null;
-        const reply = JSON.parse(text.decode(body));
+        const reply = readJson(body);
         if (reply === null || typeof reply !== 'object' || Array.isArray(reply))
             return null;
         const r = reply;
-        if (r.silence === true)
-            return { silence: true };
-        if (Object.hasOwn(r, 'quo'))
+        const keys = Object.keys(r).sort().join(',');
+        if (keys === 'silence')
+            return r.silence === true ? { silence: true } : null;
+        if (keys === 'quo')
             return isDoorWord(r.quo) ? { quo: r.quo } : null;
-        if (!Object.hasOwn(r, 'object') || r.object === undefined)
+        if (keys !== 'object,seen')
             return null;
         if (r.seen !== null && !isHex(r.seen))
             return null;
+        if (cellFault(r.object, 'object') !== null)
+            return null; // values in both directions: nested past the bound is none of the shapes
         return { object: r.object, seen: r.seen };
     }
     catch {

package/dist/ward/stance.d.ts

@@ -17,9 +17,4 @@ export type Inside = {
     unmake(key: string): void;
     wrote(): void;
 };
-export type SealedInvitation = {
-    ward: string;
-    heir?: string;
-    secret?: string;
-};
 export declare function buildStance(inside: Inside, key: string, cells: Cells, bind: Bind): Stance;

package/dist/ward/ward.d.ts

@@ -1,5 +1,5 @@
 import type { Cells, Stance } from '../being/types.ts';
-import type { Ground, WardPointers } from './ground.ts';
+import { type Ground, type WardPointers } from './ground.ts';
 import { type Bind } from './partition.ts';
 import { type Door } from './door.ts';
 export type Resident = Door & {

package/dist/ward/ward.js

@@ -5,7 +5,8 @@
 // a stance built by the same code. Mints every key, seals every ask that
 // leaves, opens every one that arrives.
 import { silence, isSilence, unreached, isWord, word } from '../being/silence.js';
-import { OWNER } from '../being/types.js';
+import { OWNER, isInvitation } from '../being/types.js';
+import { BOX, OFFER, RETRACT } from './ground.js';
 import { at, drop, open, put, emptyBind, emptyCells, HEAD, MINTED } from './partition.js';
 import { Heirs } from './heirs.js';
 import { makeDoor } from './door.js';
@@ -30,14 +31,50 @@ class Self {
     #birthing = new Set(); // keys whose constructor is running: taken, though no door and no row say so yet
     door;
     ask;
+    // Birth, in order: the ward as its own first being, the box taken, and
+    // only then every being the partition names constructed again. A being
+    // who takes what her box lends does it at her birth, so the box must be
+    // hers to ask before she is born, or a restart would be the one birth at
+    // which the device lends nothing.
     static async boot(ground) {
-        return new Self(ground, await wardKey(ground.seed));
+        const w = new Self(ground, await wardKey(ground.seed));
+        await w.#takeBox();
+        w.#reborn();
+        return w;
+    }
+    // The device, taken as one standing under `BOX` by the ward's own being,
+    // once: a ward woken from its partition already holds it. A knock that is
+    // not answered leaves the ward up and lending nothing this run.
+    async #takeBox() {
+        const inv = this.g.box;
+        const mine = this.doors.get(this.pk)?.stance;
+        if (!inv || !mine || mine.standings[BOX])
+            return;
+        const out = await mine.standings.knock(inv);
+        if (isSilence(out) || isWord(out))
+            return;
+        await mine.standings.take(BOX, inv);
+    }
+    // What this device lends this ward's beings: the box's being, asked to
+    // offer a name, answers the lent being's own invitation, and the taker knocks
+    // and takes it. The ward reads nothing in the value but that it is one.
+    async #lend(name, take) {
+        const box = this.doors.get(this.pk)?.stance.standings[BOX];
+        if (!box)
+            return false;
+        const inv = await box.ask(OFFER, { name });
+        if (!isInvitation(inv))
+            return false;
+        const took = await take(inv);
+        if (!took)
+            await box.ask(RETRACT, { name, heir: inv.heir ?? null });
+        return took;
     }
     constructor(ground, key) {
         this.g = ground;
         this.key = key;
         this.pk = key.pk;
-        this.p = open(ground.memory); // the partition: the ward's own state, and every being's row
+        this.p = open(ground.memory.rows); // the partition: the ward's own state, and every being's row
         // Opening is itself a write: a memory nobody has written comes back with
         // a version stamped on it and the ward's own tables under it. A ward that
         // said nothing here would have every being of it kept and the head that
@@ -47,6 +84,24 @@ class Self {
         this.heirs = new Heirs(this.p, () => this.#wrote(HEAD));
         this.door = makeDoor(key, this.heirs, this.doors, () => this.p.public, (n) => ground.random(n), () => this.#keep()); // pointer one
         this.#boot(this.pk, () => this); // the ward's ward is itself
+        // pointer two. the owner. the same answer every named asker gets, asker filled in as owner.
+        this.ask = async (method, args = {}) => {
+            try {
+                const out = await this.answer({ id: OWNER }, method, args);
+                // The same question the door asks, in the same place: after she has
+                // answered and before the owner holds the answer. Silence is what a
+                // failed ask says here, so a store that refused is silence, and the
+                // owner reads it as it reads every other ask that did not take.
+                if (!(await this.#keep().catch(() => false)))
+                    return silence;
+                return isSilence(out) || isWord(out) ? silence : out;
+            }
+            catch {
+                return silence;
+            }
+        };
+    }
+    #reborn() {
         // a restart is silent: every being in the cells is constructed again, unasked.
         // A throw on a boot the owner asked for is that boot's error, and nothing
         // half-lives. This boot nobody asked for, and there is nobody to hand an
@@ -68,22 +123,6 @@ class Self {
                 /* she is not here this run. the ward is, and so is everyone else. */
             }
         }
-        // pointer two. the owner. the same answer every named asker gets, asker filled in as owner.
-        this.ask = async (method, args = {}) => {
-            try {
-                const out = await this.answer({ id: OWNER }, method, args);
-                // The same question the door asks, in the same place: after she has
-                // answered and before the owner holds the answer. Silence is what a
-                // failed ask says here, so a store that refused is silence, and the
-                // owner reads it as it reads every other ask that did not take.
-                if (!(await this.#keep().catch(() => false)))
-                    return silence;
-                return isSilence(out) || isWord(out) ? silence : out;
-            }
-            catch {
-                return silence;
-            }
-        };
     }
     // ---- the ward as a being. asked only by its owners: the root, through
     // the ask pointer, and its occupants, through the door, whom only the root
@@ -116,14 +155,14 @@ class Self {
     // because a harbor told only that something moved must keep all of it, and
     // a being's row is the one part of a partition that grows without limit.
     #wrote(row) {
-        this.g.wrote?.(row);
+        this.g.memory.told(row);
     }
     // Whether what was written is kept, asked once at the end of an arrival
     // and never during one. A harbor that keeps nothing was never going to
     // refuse anything, so its silence here is yes: a ward driven with no store
     // under it answers exactly as it did before a harbor could say no.
     async #keep() {
-        return this.g.keep ? await this.g.keep() : true;
+        return this.g.memory.kept();
     }
     // The rows no door holds this run: beings whose class threw at birth or
     // is not the harbor's to give. Key to class.
@@ -233,11 +272,7 @@ class Self {
             // never came about takes her out again.
             relate: async (k, id) => (await this.doors.get(k)?.stance.occupants.invite(id)) ?? null,
             unmake: (k) => void this.#unboot(k),
-            // What this device lends this ward's beings. The ward knocks and takes
-            // inside the harbor's own call and reads nothing in the value: which
-            // names there are, which ward may ask for one, and what becomes of one
-            // she did not take, is the harbor's and no word of the ward.
-            lend: async (name, take) => (await this.g.lend?.(name, take)) ?? false,
+            lend: (name, take) => this.#lend(name, take),
             wrote: () => this.#wrote(key),
         }, key, cells, bind);
         const being = make(stance);
@@ -274,7 +309,7 @@ class Self {
         // the reply opens, and whatever the being writes on either side of her
         // own ask. A harbor may write those rows down; what it may not do is put
         // the ward back to them.
-        const lower = this.g.calling?.();
+        const lower = this.g.memory.during();
         try {
             return await this.#sent(bind, keys, method, args, wanted, row);
         }

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "nervur",
-  "version": "0.18.0",
-  "description": "Nervur's kit of Quo: an object asks another object and gets an answer, without knowing where it is. Being, Ward, Harbor, with the spec inside.",
+  "version": "0.19.1",
+  "description": "Nervur's kit of Quo: an object asks another object and gets an answer, without knowing where it is. Being, Ward, Harbor.",
   "keywords": [
     "quo",
     "protocol",
@@ -43,9 +43,11 @@
   },
   "scripts": {
     "build": "rm -rf dist && tsc -p tsconfig.build.json",
-    "check": "node --test \"test/*.test.ts\"",
-    "deep": "node --test \"test/terrain/*.test.ts\"",
-    "prepublishOnly": "test \"$NERVUR_GATED\" = 1 || { echo 'publish from the root, gated once: npm run release:nervur' >&2; exit 1; }"
+    "check": "node ../../test.mjs \"test/*.test.ts\"",
+    "experimental": "node ../../test.mjs \"experimental/*.test.ts\"",
+    "deep": "node --test --test-timeout=300000 \"test/terrain/*.test.ts\"",
+    "cover": "node --test --test-timeout=60000 --experimental-test-coverage --test-coverage-exclude=\"**/dist/**\" --test-coverage-exclude=\"**/test/**\" --test-coverage-lines=99 --test-coverage-branches=93 --test-coverage-functions=95 \"test/*.test.ts\"",
+    "prepublishOnly": "test \"$NERVUR_GATED\" = 1 || { echo 'a publish is /release, from the root, on the human'\"'\"'s word' >&2; exit 1; }"
   },
   "publishConfig": {
     "access": "public"

package/src/being/index.ts

@@ -1,6 +1,7 @@
 // SPDX-License-Identifier: Apache-2.0
 // nervur — the Being side. What a being author imports, if anything.
 export { Being, type AskSpec } from './being.ts';
+export { Lent, BOX, LENT_ASKS } from './lent.ts';
 export { silence, isSilence, answered, unreached, isUnreached, word, isWord, wordOf, told, DOOR_WORDS, isDoorWord } from './silence.ts';
 export { digest, canonical } from './digest.ts';
 export { OWNER, PUBLIC, RESERVED_IDS, isBlueprint, invitationArgs, isInvitation } from './types.ts';

package/src/being/lent.ts

@@ -0,0 +1,66 @@
+// SPDX-License-Identifier: Apache-2.0
+// A lent being: a being of the box's own ward, standing for one thing the
+// device can do. What makes her one is two asks the box's being alone may
+// make, whom she knows as the occupant `box`. `offer`: she mints an
+// invitation on herself and answers it, so that a ward the box vouches for
+// may knock and take a standing at her. `retract`: an offer that was not
+// taken, named by its heir, is removed, so a refused lend leaves nothing.
+//
+// The two are the base's and never a subclass's to declare: a class says
+// her own asks and nothing of the seam she is lent through, so they are
+// answered here before her asks are read, and shown to the box alone. No
+// root mints for her, and nothing else about her is decided here.
+//
+// A convenience, not a contract: a being that answers the two the same way
+// to `box` is lendable, whatever she extends.
+import { Being } from './being.ts';
+import type { Asker, Blueprint, JsonObject, Reply } from './types.ts';
+
+// The one word for the box's being: her key in the box's ward, the id every
+// lent being knows her by, and the standing every hosted ward takes at
+// birth.
+export const BOX = 'box';
+
+export const LENT_ASKS = {
+  offer: { name: 'offer', description: 'an invitation on me, for a ward the box vouches for', input: { type: 'object' } },
+  retract: { name: 'retract', description: 'an offer that was not taken, by its heir', input: { type: 'object', properties: { heir: { type: 'string' } }, required: ['heir'] } },
+};
+
+export class Lent extends Being {
+  // The offers she has open, heir to the id she minted under.
+  #open(): Record<string, string> {
+    return ((this.cells.open as Record<string, string> | undefined) ??= {});
+  }
+
+  async offer(): Promise<JsonObject> {
+    const n = ((this.cells.lent as number | undefined) ?? 0) + 1;
+    this.cells.lent = n;
+    const id = `lent:${n}`;
+    const inv = await this.invite(id);
+    if (inv === null) return { error: 'could not mint' };
+    this.#open()[inv.heir!] = id;
+    return inv;
+  }
+
+  retract(args: JsonObject): JsonObject {
+    const open = this.#open();
+    const heir = typeof args.heir === 'string' ? args.heir : '';
+    const id = Object.hasOwn(open, heir) ? open[heir] : undefined;
+    if (id === undefined) return { retracted: null };
+    this.occupants.remove(id);
+    delete open[heir];
+    return { retracted: id };
+  }
+
+  override describe(asker: Asker): Blueprint {
+    const bp = super.describe(asker);
+    if (asker.id !== BOX) return bp;
+    return { ...bp, asks: [...bp.asks, LENT_ASKS.offer, LENT_ASKS.retract] };
+  }
+
+  override async answer(asker: Asker, method?: string, args: JsonObject = {}): Promise<Reply> {
+    if (asker.id === BOX && method === 'offer') return this.offer();
+    if (asker.id === BOX && method === 'retract') return this.retract(args);
+    return super.answer(asker, method, args);
+  }
+}

package/src/being/types.ts

@@ -43,7 +43,7 @@ export const invitationArgs = (inv: Invitation): JsonObject => ({
 
 // Whether a value that arrived is an invitation. The shape is the spec's, so
 // the reading of it is too, and it is one reading: a form that
-// asks a guest for one, a faculty handed one to wake her maker by, and a
+// asks a guest for one, a lent being handed one to wake her maker by, and a
 // shell that finds one in a link all ask the same question, and a kinder
 // answer in one of them is a value that fails at a door instead of at the
 // edge it came in by. A ward pk is a hundred and twenty-eight lowercase hex,

package/src/conformance/beings.ts

@@ -3,6 +3,7 @@
 // shop, a customer on the base class, a maker, a member, and one raw being
 // with no base at all.
 import { Being } from '../being/being.ts';
+import { Lent } from '../being/lent.ts';
 import { answered, isSilence, isUnreached, isWord, wordOf } from '../being/silence.ts';
 import { invitationArgs } from '../being/types.ts';
 import type { Ask, Asker, Blueprint, Invitation, Json, JsonObject, OccupantRecord, Reply, Stance } from '../being/types.ts';
@@ -156,9 +157,13 @@ export class Maker extends Being {
   }
 }
 
-export class Member extends Being {
-  static override cells = { heard: [] as JsonObject[] };
+// A member is also lendable: lent by a box that stands her in its own ward,
+// she offers an invitation on herself when the box's being asks, and is an
+// ordinary being to everyone else.
+export class Member extends Lent {
+  static override cells = { ...Lent.cells, heard: [] as JsonObject[] };
   static override asks = {
+    ...Lent.asks,
     ping: { input: { type: 'object' } },
     relay: { input: { type: 'object', properties: { id: { type: 'string' }, method: { type: 'string' }, time: { type: 'number' } }, required: ['id'] } },
   };
@@ -178,6 +183,6 @@ export class Member extends Being {
     const out = await standing.ask(method as string | undefined, (args ?? {}) as JsonObject, time === undefined ? undefined : { time: time as number });
     if (isSilence(out)) return { said: 'silence', out: null };
     if (isWord(out)) return { said: wordOf(out), out: null };
-    return { said: null, out: out as Json };
+    return { said: null, out: out };
   }
 }