nervur 0.18.0 → 0.19.1

package/src/vector/world.ts

@@ -8,7 +8,7 @@
 // Nothing here draws from the device. A door's reply is sealed under a fresh
 // ephemeral key and a fresh nonce, so the bytes are fixed only where the
 // entropy is, and every draw in this file comes from one written-down stream.
-// That is what lets `protocol/vectors/door.json` be a corpus and not a
+// That is what lets `quo/vectors/door.json` be a corpus and not a
 // sample, and what lets a kit stand in vector mode for a verifier that holds
 // no key: the spec's chapter of that name is the contract this file keeps.
 import { MemoryHarbor } from '../harbor/memory.ts';
@@ -23,10 +23,10 @@ import type { Answer, Asker, BeingClass, Blueprint, Invitation, Json, JsonObject
 
 // ---- the stream
 //
-// SplitMix64. Sixteen lines a kit in any language writes from this comment
-// alone: the state starts at the seed, every draw adds the golden gamma
-// 0x9e3779b97f4a7c15, mixes with two xor-shift-multiplies, and the sixty-four
-// bit result is spent eight bytes at a time, least significant first. It is
+// SplitMix64, written out in the spec's vector-mode chapter with both
+// multipliers and all three shifts, because a kit that reproduces it by
+// recognising it is a kit that guessed. This is that, and it moves only
+// when that does. It is
 // not a cipher and is not meant to be one. Its whole job is that the bytes
 // this file produces are the same bytes twice.
 const GAMMA = 0x9e3779b97f4a7c15n;
@@ -50,12 +50,23 @@ export function splitmix64(seed: bigint): () => Uint8Array {
 export const STREAM_SEED = 20250901n;
 
 let draw = splitmix64(STREAM_SEED);
+// How many sixty-four bit words have been spent since the stream was reset.
+// A record carries this number at the moment of its arrival, so a kit that
+// built the door's state its own way sets its stream here and draws what
+// this one would have drawn. It is the whole of what the setup's history is
+// worth to a stranger: not how the world was made, but where the stream
+// stands when the door is about to answer.
+let spent = 0;
+export const drawn = (): number => spent;
 // Entropy, from the stream and never from the device. Every signer secret,
 // every ephemeral seed, every byte of noise and every key a ward in this
 // world mints comes through here, in the order the code asks for it.
 export const rnd = (n = 32): Uint8Array => {
   const out = new Uint8Array(n);
-  for (let i = 0; i < n; i += 8) out.set(draw().subarray(0, Math.min(8, n - i)), i);
+  for (let i = 0; i < n; i += 8) {
+    out.set(draw().subarray(0, Math.min(8, n - i)), i);
+    spent += 1;
+  }
   return out;
 };
 
@@ -154,6 +165,7 @@ let counted = 1000;
 
 export async function world() {
   draw = splitmix64(STREAM_SEED); // a fresh world is a fresh stream: two runs, one corpus
+  spent = 0;
   counted = 1000;
   const a = new MemoryHarbor(),
     b = new MemoryHarbor();

package/src/ward/arithmetic.ts

@@ -58,8 +58,10 @@ export function sameBytes(a: Uint8Array, b: Uint8Array): boolean {
   return diff === 0;
 }
 
-// The eight small-order points of Ed25519, in their canonical encoding. A
-// public key among them verifies nothing. An encoding whose y coordinate is
+// The eight small-order points of Ed25519, in their canonical encoding, and
+// the two points with x = 0 spelled with the sign bit set, which a decoder
+// that ignores the bit reads as the same point. A public key among them
+// verifies nothing. An encoding whose y coordinate is
 // not reduced, y at or above the field's prime p, names one of the same
 // points under another spelling, and a terrain's verify may accept a zero
 // signature under it; the field has room for the spelling, so it is refused
@@ -73,6 +75,8 @@ const SMALL_ORDER = [
   'c7176a703d4dd84fba3c0b760d10670f2a2053fa2c39ccc64ec7fd7792ac037a',
   '26e8958fc2b227b045c3f489f2ef98f0d5dfac05d3c63339b13802886d53fc85',
   'c7176a703d4dd84fba3c0b760d10670f2a2053fa2c39ccc64ec7fd7792ac03fa',
+  '0100000000000000000000000000000000000000000000000000000000000080',
+  'ecffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff',
 ].map(unhex);
 // y >= p, read little-endian with the sign bit masked off: the top byte is
 // 0x7f under the mask, every middle byte is 0xff, and the low byte is at

package/src/ward/ground.ts

@@ -1,110 +1,99 @@
 // SPDX-License-Identifier: Apache-2.0
-// The ground. The one object a harbor passes a ward at birth: nine things
-// the ward uses. Everything a runtime differs on arrives here, which is why
-// the ward itself knows no runtime.
+// The ground. The one object a harbor passes a ward at birth, and the whole
+// of the device to it: six things, and everything a runtime differs on
+// arrives in one of them, which is why the ward itself knows no runtime.
+//
+//   seed         who the ward is. the pk derives from it and from nothing else
+//   random       entropy. every key the ward mints is drawn from it
+//   memory       what the ward remembers: one interface, a body per terrain
+//   instantiate  the dna: a class name and a stance in, a being or nothing out
+//   carry        the wire: a ward pk and sealed bytes in, sealed bytes or nothing out
+//   box          the device, as one invitation on the box's own being
+//
+// The spec lists nine things and says a kit gathers them however its
+// language gathers things. This kit gathers the partition, wrote, keep and
+// calling into memory, because they are one concern with four moments, and
+// a ward is handed one body and told how to use it rather than four calls
+// it must keep in step.
 import type { Stance, BeingLike, BeingClass, Invitation } from '../being/types.ts';
 
-// What the device lends this ward's beings, by name. What a box can do is
-// beings, in a ward its harbor booted and roots, and this is how a being of
-// another ward comes to hold a standing at one: the harbor asks its own root
-// to invite on that being, and hands the invitation to the taker.
+// Memory. Four moments, and they are the promise a body keeps:
+//
+//   rows    the values the ward holds and writes into directly. synchronous,
+//           always, because the door judges an arrival in one pass and a
+//           disk in the middle of it would be a door that waits on a device
+//   told    the ward says it after every write, naming the row: a being by
+//           her key, or `HEAD` for everything that is not one being's.
+//           nothing comes back. a body that keeps the rows saves in the
+//           order it was told, so a being driven in process is kept the way
+//           one reached through a door is
+//   kept    keep what has been written, now, and say whether it was. the
+//           ward asks it once at the end of an arrival, after the being has
+//           answered and before the answer is sealed, the last moment
+//           anything can still be said about it. false is a store that
+//           refused, and the ward says so with the word a failed ask already
+//           has: `threw` to an asker the door holds, silence to the ask
+//           pointer. never a reason
+//   during  a call of this ward's has begun, and what comes back lowers it.
+//           the ward raises it before it reaches out and lowers it in a
+//           finally, so a call that threw lowers too, and lowering twice is
+//           lowering once. calls nest. a body may go on writing while it is
+//           raised; what it may not do is take a save made there as the
+//           point it puts a refused ward back to
 //
-// The taker is the ward's half, and it is inside this call rather than after
-// it so that nothing half-lives. The harbor minted, so the harbor is the only
-// one who can unmint: a ward that could not knock, or could not take, says so
-// by answering false, and the root that minted removes the occupant it made.
-// A lend that failed leaves no heir open at that being and no relation bound
-// to a ward that does not hold it, which is the promise `boot` keeps with
-// `unmake` and the same promise here.
+// A body that keeps nothing has rows, is told and does nothing, answers yes,
+// and raises nothing: `volatile` below. The ward has one path either way.
+export type Memory = {
+  readonly rows: Record<string, unknown>;
+  told(row: string): void;
+  kept(): Promise<boolean>;
+  during(): () => void;
+};
+
+// The body that keeps nothing: the process is the memory.
+export const volatile = (rows: Record<string, unknown> = {}): Memory => ({ rows, told: () => {}, kept: () => Promise.resolve(true), during: () => () => {} });
+
+// The device is one standing. What a box can do is beings, in a ward its
+// harbor booted and roots, and one being there, the box's own, holds a
+// standing at each of them under the name it is lent as. The ground carries
+// one invitation on her, minted for this ward alone; the ward takes it at
+// boot under `BOX`, as its own first being, and from then on the device is
+// reached the way anything is reached: what it offers is her describe, and a
+// lend is the ask `OFFER` on that standing, naming what a being wants.
 //
-// False is every kind of no, and they are one answer because a being would do
-// nothing different for any of them: this harbor lends nothing, or nothing of
-// that name, or nothing of that name to this ward, or the ward did not take
-// what was minted.
+// She answers the lent being's own invitation, minted by that being on herself,
+// and the ward knocks and takes it in the being's name. No root mints for a
+// lend, and the invitation never reaches the being: it is the device's, a
+// value she could copy is one she could hand to anyone, so the ward holds
+// it and hands her the id. Which ward may have which name is the box's own
+// gate, reading who asks, and a stranger's ward holds no standing at her.
 //
-// The invitation never reaches the being. It is the device's capability, and
-// a value she could copy is one she could hand to anyone, so it lives in this
-// call and nowhere else.
-export type Lend = (name: string, take: (invitation: Invitation) => Promise<boolean>) => Promise<boolean>;
+// A harbor with no box leaves it out, and every lend is null. A ward that
+// could not take it at boot, the box down or the invitation spent, boots all
+// the same, lends nothing this run, and tries again at the next.
+export { BOX } from '../being/lent.ts';
+export const OFFER = 'offer';
+// A lend that was offered and not taken leaves nothing: the ward says so to
+// the box, naming the heir, and the lent being removes what she minted.
+export const RETRACT = 'retract';
 
 export type Ground = {
-  seed: string | Uint8Array; // the ward derives its pk from it and nothing else
-  memory: Record<string, unknown>; // the partition. the ward's files. opaque to the harbor
-  instantiate(className: string, stance: Stance): BeingLike | null; // the code half
-  // The ward wrote its partition, and which row of it: a being by her key,
-  // or `HEAD` for everything that is not one being's. It says so after every
-  // write, a key rotated, a relation taken, a cell she set, and says nothing
-  // else: this word is told, never asked, and nothing comes back from it. A
-  // harbor that keeps the partition saves in the order it was told, so a
-  // being driven in process is kept the way one reached through a door is.
-  // Whether any of it was kept is one question asked once, at the end of an
-  // arrival, and `keep` is where. A harbor that keeps nothing leaves both
-  // out.
-  //
-  // The row is named because a being's cells are the one part of a partition
-  // that grows without limit, and a harbor told only that something moved has
-  // to write down every being in the ward to be sure of one. What a harbor
-  // does with the name is its own: writing the whole partition on every word
-  // is correct, and slower.
-  wrote?: (row: string) => void;
-  // Keep what has been written, now, and say whether it was kept. The ward
-  // calls it once at the end of an arrival, after the being has answered and
-  // before the answer is sealed, which is the last moment anything can still
-  // be said about it: a reply sealed to an asker's lid cannot be unsaid, and
-  // only the ward can seal.
-  //
-  // False is a store that refused, and the ward says so with the word a
-  // failed ask already has: `threw` to an asker the door holds, silence to
-  // the ask pointer and to a stranger. It is never a reason; a full disk is
-  // no more the far side's business than any other insides of this device.
-  //
-  // A harbor that keeps nothing leaves it out, and so does one that would
-  // rather count a refusal than answer it: absent means the ward asks
-  // nothing and seals what the being said, which is what every harbor did
-  // before this existed. A harbor that writes it saves here and nowhere
-  // else for this arrival, since `wrote` has already named every row.
-  keep?: () => Promise<boolean>;
-  // A call of this ward's has begun, and what comes back says it has ended.
-  // The ward alone knows where a call begins: a being reaching another being,
-  // in this process or over the wire, is one relation and two halves, and she
-  // writes her side of it before the bytes go out and again when they come
-  // back. Between those two writes her rows are half done, and a harbor that
-  // wrote them and then had to put them back would stand the ward at a point
-  // no call ever stood at.
-  //
-  // It is told, and the one thing that comes back is how to lower it. The
-  // ward raises it before it reaches out and lowers it in a finally, so a
-  // call that threw lowers too, and lowering twice is lowering once. Calls
-  // nest: a ward is in flight while any of its beings is.
-  //
-  // A harbor is free to keep writing while it is raised, because the store is
-  // what survives a restart. What it may not do is take a save made there as
-  // the point it puts a refused ward back to. A harbor that keeps nothing
-  // leaves it out.
-  calling?: () => () => void;
+  seed: string | Uint8Array;
+  random(n: number): Uint8Array;
+  memory: Memory;
+  instantiate(className: string, stance: Stance): BeingLike | null;
   // Sealed bytes to a ward pk. What comes back, or undefined.
   //
   // undefined is a promise, not a shrug: no door was reached, and nothing was
   // delivered. The ward hands it to a being as unreached, which is the one
   // answer that says asking again is safe, so a harbor may only return it
   // when it knows the bytes never arrived: no reach for that pk, a socket
-  // that would not open, a link that is down.
-  //
-  // A harbor that sent the bytes and then gave up waiting knows no such
-  // thing: the far door may have heard and be working still. It must not
-  // answer at all in that case. The ward bounds every ask itself, and an
-  // answer that never comes inside that bound is `late`, which promises
-  // nothing either way. So a harbor may hold a shorter patience than the
-  // ward's for its own reasons, a socket it wants back or a queue it will
-  // not grow, and the two bounds never need to read each other: whichever
-  // ends first ends the ask, and each says only what it can honestly say.
+  // that would not open, a link that is down. A harbor that sent the bytes
+  // and then gave up waiting knows no such thing and must not answer at all:
+  // the ward bounds every ask itself, and an answer that never comes inside
+  // that bound is `late`, which promises nothing either way.
   carry(pk: string, bytes: Uint8Array): Promise<Uint8Array | undefined>;
-  random(n: number): Uint8Array; // entropy. every key a ward mints is drawn from it
-  // A standing at one of the harbor's own beings, by the name that harbor
-  // knows it under. Built per ward, so which ward may ask for which name is
-  // the harbor's own decision and a stranger's ward is lent nothing. A harbor
-  // with nothing to lend leaves it out, and every name answers false.
-  lend?: Lend;
+  box?: Invitation;
 };
 
 // What a ward hands back. Two pointers. The door answers bytes, always, and
@@ -117,11 +106,8 @@ export type WardPointers = {
   ask(method?: string, args?: Record<string, unknown>): Promise<unknown>;
 };
 
-// ---- what every harbor builds a ground out of. Three pieces, because every
-// harbor in this tree writes the same three and the protocol keeps the harbors
-// themselves apart: what a memory harbor and a real one differ on is the
-// route and the store, and nothing here. A second kit writes its own harbor
-// and may write these again; they are convenience, never contract.
+// ---- what every harbor builds a ground out of. Convenience, never contract:
+// a second kit writes its own harbor and may write these again.
 
 // The code half of a ground, and the map back to what it made. A class is
 // found by own key only, since `constructor` is a name Object lends every
@@ -140,18 +126,14 @@ export const maker =
     return obj;
   };
 
-// Entropy, from the one place every terrain that runs Quo has it. Every key a
-// ward mints is drawn from this, so a harbor that wants another source hands
-// its own and nothing here has to know.
+// Entropy, from the one place every terrain that runs Quo has it.
 export const entropy = (n: number): Uint8Array => globalThis.crypto.getRandomValues(new Uint8Array(n));
 
 // A ward's pk, learned the way anyone learns anything: by asking. The empty
 // ask on the ask pointer is the ward's own describe and its notes carry the
 // pk. A harbor has no other way to it and wants none: the ward mints it from
 // the seed, and a harbor that read it off the seed itself would be a second
-// derivation to keep in step with the first. A ward that answers anything
-// else is not one this harbor can route to, and says so here rather than
-// leaving an undefined pk in a directory.
+// derivation to keep in step with the first.
 export async function learnPk(w: WardPointers): Promise<string> {
   const notes = (await w.ask()) as { notes?: { pk?: unknown } } | null;
   const pk = notes?.notes?.pk;

package/src/ward/heirs.ts

@@ -7,8 +7,10 @@
 import type { DoorWord } from '../being/types.ts';
 import { GONE, type Heir, type Partition } from './partition.ts';
 
-// How wide the span is, is the ward's own — wider is more forgiving of a
-// rough road, and no peer can tell the difference except by being refused.
+// How wide the span is, is the spec's and never a ward's. Wider is more
+// forgiving of a rough road, and that is exactly why it is not a ward's to
+// choose: a peer tells two doors apart by being refused at one and answered
+// at the other, which is one relation dying over one number.
 const SPAN = 64;
 
 export class Heirs {

package/src/ward/index.ts

@@ -1,7 +1,8 @@
 // SPDX-License-Identifier: Apache-2.0
 // nervur/ward — one function. Every ward is the same ward.
 export { Ward } from './ward.ts';
-export type { Ground, WardPointers, Lend } from './ground.ts';
+export type { Ground, WardPointers, Memory } from './ground.ts';
+export { BOX, OFFER, RETRACT, volatile } from './ground.ts';
 export type { Partition, Heir, Bind, StandingKeys } from './partition.ts';
 // The three bounds on what a partition may hold, for a kit that must keep
 // the same ones and for a test that pins them.

package/src/ward/json.ts

@@ -0,0 +1,144 @@
+// SPDX-License-Identifier: Apache-2.0
+// The one reader of JSON that crossed an edge. A runtime's own parser is
+// where two kits stop agreeing: it keeps the last of two keys of one name,
+// rounds a whole number no double holds, reads a number past the doubles as
+// infinity, and mends bytes that are not UTF-8 into a replacement character.
+// Each of those is text two kits read two ways, so each is refused here, where
+// it is read, with a throw the caller already turns into what bytes that said
+// nothing are.
+//
+// What a value is beyond its text, a lone surrogate, a key named `__proto__`,
+// a nesting past the bound, is the value rule's, and `cellFault` in cells.ts
+// is its one reader. This file holds the rules that live only in the text.
+
+const utf8 = new TextDecoder('utf-8', { fatal: true, ignoreBOM: true });
+
+const fail = (at: number, why: string): never => {
+  throw new Error(`JSON at ${at}: ${why}`);
+};
+
+// A number text, held to the Values chapter. A text naming a whole number
+// stands only if that number is exactly a double, or if the text is how
+// ECMAScript writes the double it reads as. A text past the largest double,
+// or naming a value other than zero that rounds to zero, is refused, and so
+// is minus zero in any spelling.
+export function numberFault(literal: string): string | null {
+  const m = /^(-?)(0|[1-9]\d*)(?:\.(\d+))?(?:[eE]([+-]?\d+))?$/.exec(literal);
+  if (!m) return 'not a number';
+  const [, sign, whole, frac = '', exp = '0'] = m;
+  const v = Number(literal);
+  if (!Number.isFinite(v)) return 'past the largest double';
+  let digits = (whole + frac).replace(/^0+/, '');
+  if (v === 0) {
+    if (digits !== '') return 'a value other than zero that rounds to zero';
+    return sign ? 'minus zero' : null;
+  }
+  // The exact value is digits times ten to e. A finite double bounds e from
+  // above, so the power below is never larger than the double's own width.
+  let e = BigInt(exp) - BigInt(frac.length);
+  const trimmed = digits.replace(/0+$/, '');
+  e += BigInt(digits.length - trimmed.length);
+  digits = trimmed;
+  if (e < 0n) return null; // a fraction: the double nearest it, as every reader takes it
+  const exact = BigInt(digits) * 10n ** e;
+  if (exact === (v < 0 ? -BigInt(v) : BigInt(v))) return null;
+  return literal === String(v) ? null : 'a whole number that is not exactly a double';
+}
+
+// Bytes to a value, or a throw.
+export function readJson(input: Uint8Array | string): unknown {
+  const s = typeof input === 'string' ? input : utf8.decode(input);
+  let at = 0;
+  const space = () => {
+    for (;;) {
+      const c = s.charCodeAt(at);
+      if (c === 0x20 || c === 0x09 || c === 0x0a || c === 0x0d) at += 1;
+      else return;
+    }
+  };
+  const string = (): string => {
+    const start = at;
+    at += 1;
+    for (;;) {
+      const c = s.charCodeAt(at);
+      if (Number.isNaN(c)) fail(start, 'an unterminated string');
+      if (c === 0x22) break;
+      if (c < 0x20) fail(at, 'a control character in a string');
+      at += c === 0x5c ? 2 : 1;
+    }
+    at += 1;
+    // The escapes are JSON's own, and the runtime reads them the one way.
+    return JSON.parse(s.slice(start, at)) as string;
+  };
+  const value = (): unknown => {
+    space();
+    const c = s[at];
+    if (c === '{') {
+      at += 1;
+      const out: Record<string, unknown> = {};
+      const keys = new Set<string>();
+      space();
+      if (s[at] === '}') {
+        at += 1;
+        return out;
+      }
+      for (;;) {
+        space();
+        if (s[at] !== '"') fail(at, 'a key that is not a string');
+        const where = at;
+        const k = string();
+        if (keys.has(k)) fail(where, `two keys named ${JSON.stringify(k)}`);
+        keys.add(k);
+        space();
+        if (s[at] !== ':') fail(at, 'a key with no colon');
+        at += 1;
+        // Defined, never assigned: a key named `__proto__` is an own key here
+        // as it is in JSON.parse, and the value rule refuses it after.
+        Object.defineProperty(out, k, { value: value(), enumerable: true, writable: true, configurable: true });
+        space();
+        if (s[at] === ',') at += 1;
+        else if (s[at] === '}') {
+          at += 1;
+          return out;
+        } else fail(at, 'an object not closed');
+      }
+    }
+    if (c === '[') {
+      at += 1;
+      const out: unknown[] = [];
+      space();
+      if (s[at] === ']') {
+        at += 1;
+        return out;
+      }
+      for (;;) {
+        out.push(value());
+        space();
+        if (s[at] === ',') at += 1;
+        else if (s[at] === ']') {
+          at += 1;
+          return out;
+        } else fail(at, 'a list not closed');
+      }
+    }
+    if (c === '"') return string();
+    for (const [word, v] of [['true', true], ['false', false], ['null', null]] as const) {
+      if (s.startsWith(word, at)) {
+        at += word.length;
+        return v;
+      }
+    }
+    const m = /-?\d+(?:\.\d+)?(?:[eE][+-]?\d+)?/y;
+    m.lastIndex = at;
+    const hit = m.exec(s);
+    if (!hit) return fail(at, 'no value');
+    const why = numberFault(hit[0]);
+    if (why !== null) fail(at, `${hit[0]} is ${why}`);
+    at += hit[0].length;
+    return Number(hit[0]);
+  };
+  const out = value();
+  space();
+  if (at !== s.length) fail(at, 'text after the value');
+  return out;
+}

package/src/ward/partition.ts

@@ -312,7 +312,7 @@ export const restoreRow = (p: Partition, row: string, value: Record<string, unkn
     drop(p.beings ?? {}, row);
     // Her bind goes with her: a being the store never kept has no relation
     // anybody is standing on, so there is nothing to leave forward.
-    drop((p.bind ?? {}) as unknown as Record<string, unknown>, row);
+    drop(p.bind ?? {}, row);
     return;
   }
   // Behind the guard and never through it: a being's cells in a partition
@@ -326,7 +326,7 @@ export const restoreRow = (p: Partition, row: string, value: Record<string, unkn
     for (const k of Object.keys(held)) drop(held, k);
     for (const [k, v] of Object.entries(kept)) put(held, k, v);
   };
-  into((p.beings ?? {}) as unknown as Record<string, unknown>, (value.cells ?? emptyCells()) as unknown as Record<string, unknown>);
+  into(p.beings ?? {}, (value.cells ?? emptyCells()) as unknown as Record<string, unknown>);
 };
 
 // The partition back from its rows. A head that is absent is a partition

package/src/ward/seal.ts

@@ -23,9 +23,9 @@ import type { DoorWord, Json, JsonObject } from '../being/types.ts';
 import { isDoorWord } from '../being/silence.ts';
 import { KEY, SIGNATURE, box, concat, derive, hex, sha256, sign, signingPair, sealingPair, unbox, unhex, verify } from './arithmetic.ts';
 import { cellFault } from './cells.ts';
+import { readJson } from './json.ts';
 
 const utf8 = new TextEncoder();
-const text = new TextDecoder();
 
 export type WardKey = { sign: Uint8Array; padlock: Uint8Array; signPk: Uint8Array; padlockPk: Uint8Array; pk: string };
 
@@ -54,7 +54,7 @@ export const SIZE = 1024 * 1024;
 // designs and no separation at all: one secret would be doing two jobs with
 // nothing said about it, and a second kit would have to reproduce a
 // construction nobody named. HKDF-SHA-256 under a label is the separation
-// said out loud, and it is what `protocol/vectors/framing.json` pins.
+// said out loud, and it is what `quo/vectors/framing.json` pins.
 //
 // Bytes are key material and text is not. A seed handed in as bytes of the
 // key length is taken as it stands, which is what a harbor mints; anything
@@ -115,7 +115,7 @@ export async function openAsk(bytes: Uint8Array, padlockSecret: Uint8Array): Pro
     if (inside.length <= SIGNATURE) return null;
     const body = inside.subarray(0, inside.length - SIGNATURE);
     const signature = inside.subarray(inside.length - SIGNATURE);
-    const payload = JSON.parse(text.decode(body)) as Sealed;
+    const payload = readJson(body) as Sealed;
     // The heir, or null for the public being. Absent is not null: a payload
     // that never named one is malformed, like any other missing field.
     const to = payload.to;
@@ -150,7 +150,9 @@ export async function sealReply(reply: ReplyPayload, ephemeralPk: Uint8Array, wa
 // lied, or it is not a reply. Every ward on the wire is somebody else's code,
 // so the shape is checked here and nowhere later: a reply is `{ silence }`,
 // `{ quo: word }` with a word the door may say, or `{ object, seen }` with an
-// object present and seen a digest or null.
+// object that is a value and seen a digest or null. A field beside a shape's
+// own makes it none of the three, since a kit that dropped the field would
+// hand her an answer where this one hands her silence.
 // Anything else is bytes that said nothing, and her ward never hands her a
 // throw or an absent value for what a stranger wrote.
 export async function openReply(bytes: unknown, ephemeralSecret: Uint8Array, signPk: Uint8Array): Promise<ReplyPayload | null> {
@@ -160,13 +162,15 @@ export async function openReply(bytes: unknown, ephemeralSecret: Uint8Array, sig
     if (inside.length <= SIGNATURE) return null;
     const body = inside.subarray(0, inside.length - SIGNATURE);
     if (!(await verify(body, inside.subarray(inside.length - SIGNATURE), signPk))) return null;
-    const reply = JSON.parse(text.decode(body)) as unknown;
+    const reply = readJson(body);
     if (reply === null || typeof reply !== 'object' || Array.isArray(reply)) return null;
     const r = reply as Record<string, unknown>;
-    if (r.silence === true) return { silence: true };
-    if (Object.hasOwn(r, 'quo')) return isDoorWord(r.quo) ? { quo: r.quo } : null;
-    if (!Object.hasOwn(r, 'object') || r.object === undefined) return null;
+    const keys = Object.keys(r).sort().join(',');
+    if (keys === 'silence') return r.silence === true ? { silence: true } : null;
+    if (keys === 'quo') return isDoorWord(r.quo) ? { quo: r.quo } : null;
+    if (keys !== 'object,seen') return null;
     if (r.seen !== null && !isHex(r.seen)) return null;
+    if (cellFault(r.object, 'object') !== null) return null; // values in both directions: nested past the bound is none of the shapes
     return { object: r.object as Json, seen: r.seen };
   } catch {
     return null;

package/src/ward/stance.ts

@@ -41,7 +41,7 @@ export type Inside = {
 };
 
 // An invitation as it travels: the far ward's pk, the heir pk, the heir's secret seed. Or just the ward, for its public being.
-export type SealedInvitation = { ward: string; heir?: string; secret?: string };
+type SealedInvitation ={ ward: string; heir?: string; secret?: string };
 
 // The three calls on `standings` share the object with the ids she takes, so
 // a standing named after one of them would be unreachable: `standings.knock`