nervur 0.19.2 → 0.20.0

package/dist/being/types.js

@@ -1,58 +1,4 @@
-// The ids the ward speaks under, and no being may mint. An asker id is hers:
-// she chooses the strings, and the ward has no business in her namespace. But
-// the ward must sometimes stand at her door itself — its describe asks every
-// being under OWNER — and an id it shares with one of her occupants is two
-// different parties wearing one name. She could not tell them apart, and the
-// ward would shape its describe through an occupant's gate.
-//
-// So the ward's words are shouted, and refused at the mint. A word can only
-// be reserved before anyone has used it: a partition already holding an
-// occupant of that name could never have it taken back. PUBLIC guards nothing
-// today — a public asker is {} and carries no id at all — and that is exactly
-// why it is claimed now, while claiming it is free.
 export const OWNER = 'OWNER';
-export const PUBLIC = 'PUBLIC';
-export const RESERVED_IDS = [OWNER, PUBLIC];
-// An invitation as one object of values, which is what it already is. A being
-// who hands one on sends it as args, and args are values; this is the one
-// place that is spelled, so nobody spells it with a cast. Absent stays absent:
-// an invitation to a public being carries no heir and no secret, and a key
-// present and undefined is not the same object once JSON has been through it.
-export const invitationArgs = (inv) => ({
-    ward: inv.ward,
-    ...(inv.heir !== undefined ? { heir: inv.heir } : {}),
-    ...(inv.secret !== undefined ? { secret: inv.secret } : {}),
-});
-// Whether a value that arrived is an invitation. The shape is the spec's, so
-// the reading of it is too, and it is one reading: a form that
-// asks a guest for one, a lent being handed one to wake her maker by, and a
-// shell that finds one in a link all ask the same question, and a kinder
-// answer in one of them is a value that fails at a door instead of at the
-// edge it came in by. A ward pk is a hundred and twenty-eight lowercase hex,
-// and a heir comes with its secret or neither comes: an invitation to a
-// public being carries no heir, and a heir with no secret opens nothing.
-export const isInvitation = (v) => {
-    if (v === null || typeof v !== 'object' || Array.isArray(v))
-        return false;
-    const o = v;
-    if (typeof o.ward !== 'string' || !/^[0-9a-f]{128}$/.test(o.ward))
-        return false;
-    const heir = typeof o.heir === 'string', secret = typeof o.secret === 'string';
-    return (heir && secret) || (!heir && !secret && !('heir' in o) && !('secret' in o));
-};
-// Whether what came back from an empty ask is a blueprint. Every describe on
-// the far side of a door is somebody else's code, so nothing may be written
-// into a standing's record as a blueprint without being read as one first: a
-// side walks `asks` by name, and a list of anything else, or no list at all,
-// is a side that breaks on a far ward's answer. The asks are checked to the
-// depth a side reads them, a name and an input each, and no further: what a
-// far being puts beside those is hers.
-export const isBlueprint = (v) => {
-    if (v === null || typeof v !== 'object' || Array.isArray(v))
-        return false;
-    const { asks, notes } = v;
-    if (!Array.isArray(asks) || notes === undefined)
-        return false;
-    return asks.every((a) => a !== null && typeof a === 'object' && !Array.isArray(a) && typeof a.name === 'string' && a.input !== null && typeof a.input === 'object' && !Array.isArray(a.input));
-};
-export const WORD_KEY = Symbol.for('quo.word');
+// The ward-being's key in her ward, and so the id every being she makes
+// knows her by.
+export const WARD = 'ward';

package/dist/being/words.d.ts

@@ -0,0 +1,13 @@
+import type { Word as DoorWord } from '../quo/index.ts';
+export declare const silence: unique symbol;
+export type Silence = typeof silence;
+export declare const isSilence: (x: unknown) => x is Silence;
+export type WordName = DoorWord | 'unreached' | 'late' | 'dropped' | 'invitation';
+declare const KEY: unique symbol;
+export type Word<W extends WordName = WordName> = {
+    readonly [KEY]: W;
+};
+export declare const word: <W extends WordName>(name: W) => Word<W>;
+export declare const isWord: (x: unknown) => x is Word;
+export declare const told: (x: unknown) => unknown;
+export {};

package/dist/being/words.js

@@ -0,0 +1,14 @@
+export const silence = Symbol.for('nervur.silence');
+export const isSilence = (x) => x === silence;
+const KEY = Symbol.for('nervur.word');
+const made = new Map();
+export const word = (name) => {
+    let w = made.get(name);
+    if (!w)
+        made.set(name, (w = Object.freeze({ [KEY]: name })));
+    return w;
+};
+export const isWord = (x) => typeof x === 'object' && x !== null && typeof x[KEY] === 'string';
+// A word by its name, and anything else as it is, so one comparison says
+// which answer came back.
+export const told = (x) => (isWord(x) ? x[KEY] : x);

package/dist/contract/index.d.ts

@@ -0,0 +1,26 @@
+import type { Draw } from '../quo/index.ts';
+export declare abstract class Entropy {
+    abstract draw(length: number): Uint8Array;
+    get drawer(): Draw;
+}
+export declare abstract class Clock {
+    abstract now(): number;
+    abstract wait(ms: number): {
+        done: Promise<void>;
+        cancel(): void;
+    };
+}
+export interface Rows {
+    readonly rows: Record<string, unknown>;
+    told(row: string): void;
+    kept(): Promise<boolean>;
+}
+export declare abstract class Memory {
+    abstract open(name: string): Promise<Rows>;
+}
+export declare abstract class Custody {
+    abstract seed(name: string): Promise<Uint8Array>;
+}
+export declare abstract class Carrier {
+    abstract carry(pk: string, bytes: Uint8Array): Promise<Uint8Array | null>;
+}

package/dist/contract/index.js

@@ -0,0 +1,19 @@
+// Drawn bytes.
+export class Entropy {
+    // The same source, as the function `quo/` takes.
+    get drawer() {
+        return (length) => this.draw(length);
+    }
+}
+// The moment, and a wait that ends.
+export class Clock {
+}
+export class Memory {
+}
+// A ward's seed by the harbor's name for it: thirty-two bytes, the same
+// every time that name is asked.
+export class Custody {
+}
+// Bytes to a ward pk in; bytes, or null for nothing, out.
+export class Carrier {
+}

package/dist/crypto/aes.d.ts

@@ -0,0 +1,3 @@
+export declare const TAG = 16;
+export declare const encrypt: (key: Uint8Array, nonce: Uint8Array, additional: Uint8Array, plaintext: Uint8Array) => Promise<Uint8Array>;
+export declare const decrypt: (key: Uint8Array, nonce: Uint8Array, additional: Uint8Array, ciphertext: Uint8Array) => Promise<Uint8Array | null>;

package/dist/crypto/aes.js

@@ -0,0 +1,24 @@
+// SPDX-License-Identifier: Apache-2.0
+// AES-256-GCM with a sixteen-byte tag at the end of the ciphertext.
+import { own, subtle } from './subtle.js';
+export const TAG = 16;
+const cipher = (key, nonce, additional) => ({
+    params: { name: 'AES-GCM', iv: own(nonce), additionalData: own(additional), tagLength: TAG * 8 },
+    key: subtle().importKey('raw', own(key), 'AES-GCM', false, ['encrypt', 'decrypt']),
+});
+export const encrypt = async (key, nonce, additional, plaintext) => {
+    const c = cipher(key, nonce, additional);
+    return new Uint8Array(await subtle().encrypt(c.params, await c.key, own(plaintext)));
+};
+// The plaintext, or null when the ciphertext does not open.
+export const decrypt = async (key, nonce, additional, ciphertext) => {
+    if (ciphertext.length < TAG)
+        return null;
+    const c = cipher(key, nonce, additional);
+    try {
+        return new Uint8Array(await subtle().decrypt(c.params, await c.key, own(ciphertext)));
+    }
+    catch {
+        return null;
+    }
+};

package/dist/crypto/bytes.d.ts

@@ -0,0 +1,6 @@
+export declare const hex: (bytes: Uint8Array) => string;
+export declare const isHex: (text: unknown, length?: number) => text is string;
+export declare const unhex: (text: string) => Uint8Array;
+export declare const concat: (...parts: Uint8Array[]) => Uint8Array;
+export declare const zero: (bytes: Uint8Array) => boolean;
+export declare const utf8: (text: string) => Uint8Array;

package/dist/crypto/bytes.js

@@ -0,0 +1,33 @@
+// SPDX-License-Identifier: Apache-2.0
+// Bytes and the one text spelling Quo gives them: hex, two lowercase digits
+// a byte.
+const DIGITS = Array.from({ length: 256 }, (_, at) => at.toString(16).padStart(2, '0'));
+const HEX = /^(?:[0-9a-f]{2})*$/;
+export const hex = (bytes) => {
+    let out = '';
+    for (const byte of bytes)
+        out += DIGITS[byte];
+    return out;
+};
+// Hex of `length` bytes, or any length when none is named.
+export const isHex = (text, length) => typeof text === 'string' && HEX.test(text) && (length === undefined || text.length === length * 2);
+export const unhex = (text) => {
+    if (!isHex(text))
+        throw new TypeError('not hex');
+    const out = new Uint8Array(text.length / 2);
+    for (let at = 0; at < out.length; at += 1)
+        out[at] = parseInt(text.slice(at * 2, at * 2 + 2), 16);
+    return out;
+};
+export const concat = (...parts) => {
+    const out = new Uint8Array(parts.reduce((n, p) => n + p.length, 0));
+    let at = 0;
+    for (const part of parts) {
+        out.set(part, at);
+        at += part.length;
+    }
+    return out;
+};
+export const zero = (bytes) => bytes.every((b) => b === 0);
+const encoder = new TextEncoder();
+export const utf8 = (text) => encoder.encode(text);

package/dist/crypto/ed25519.d.ts

@@ -0,0 +1,3 @@
+export declare const ed25519Public: (secret: Uint8Array) => Promise<Uint8Array>;
+export declare const sign: (secret: Uint8Array, message: Uint8Array) => Promise<Uint8Array>;
+export declare const verify: (pk: Uint8Array, message: Uint8Array, signature: Uint8Array) => Promise<boolean>;

package/dist/crypto/ed25519.js

@@ -0,0 +1,85 @@
+// SPDX-License-Identifier: Apache-2.0
+// Ed25519 signs, as RFC 8032 defines it, and verifies with the cofactorless
+// check. The spec names exactly where a check fails, and Web Crypto promises
+// none of the decoding rules, so they are held here before Web Crypto runs:
+//
+//   a signature of any length but sixty-four
+//   an `s` at or above the group order
+//   an `R` that does not decode, or whose bytes are not its point's encoding
+//   a public key that does not decode, or whose y is at or above the prime
+//   a public key of small order, in any spelling
+import { importSecret, own, publicOf, subtle } from './subtle.js';
+const P = 2n ** 255n - 19n;
+const L = 2n ** 252n + 27742317777372353535851937790883648493n;
+const mod = (a) => ((a % P) + P) % P;
+const power = (base, exponent) => {
+    let out = 1n;
+    let b = mod(base);
+    for (let e = exponent; e > 0n; e >>= 1n) {
+        if (e & 1n)
+            out = (out * b) % P;
+        b = (b * b) % P;
+    }
+    return out;
+};
+const D = mod(-121665n * power(121666n, P - 2n));
+const ROOT_MINUS_ONE = power(2n, (P - 1n) / 4n);
+const little = (bytes) => bytes.reduceRight((n, b) => (n << 8n) | BigInt(b), 0n);
+// A point from its thirty-two bytes, or null where RFC 8032 section 5.1.3
+// refuses it, the sign bit set on x = 0 included.
+const decode = (bytes) => {
+    if (bytes.length !== 32)
+        return null;
+    const sign = (bytes[31] & 0x80) !== 0;
+    const y = little(bytes) & ((1n << 255n) - 1n);
+    if (y >= P)
+        return null;
+    const u = mod(y * y - 1n);
+    const v = mod(D * y * y + 1n);
+    let x = mod(u * power(v, 3n) * power(u * power(v, 7n), (P - 5n) / 8n));
+    const check = mod(v * x * x);
+    if (check === mod(-u))
+        x = mod(x * ROOT_MINUS_ONE);
+    else if (check !== u)
+        return null;
+    if (x === 0n && sign)
+        return null;
+    if ((x & 1n) !== (sign ? 1n : 0n))
+        x = mod(-x);
+    return { x, y, z: 1n, t: mod(x * y) };
+};
+const add = (a, b) => {
+    const A = mod((a.y - a.x) * (b.y - b.x));
+    const B = mod((a.y + a.x) * (b.y + b.x));
+    const C = mod(2n * D * a.t * b.t);
+    const E = mod(2n * a.z * b.z);
+    const [e, f, g, h] = [B - A, E - C, E + C, B + A];
+    return { x: mod(e * f), y: mod(g * h), z: mod(f * g), t: mod(e * h) };
+};
+// Small order: eight times the point is the identity.
+const smallOrder = (p) => {
+    let q = p;
+    for (let i = 0; i < 3; i += 1)
+        q = add(q, q);
+    return q.x === 0n && q.y === q.z;
+};
+export const ed25519Public = async (secret) => publicOf(await importSecret('Ed25519', secret, ['sign']));
+export const sign = async (secret, message) => new Uint8Array(await subtle().sign('Ed25519', await importSecret('Ed25519', secret, ['sign']), own(message)));
+export const verify = async (pk, message, signature) => {
+    if (signature.length !== 64)
+        return false;
+    const key = decode(pk);
+    if (key === null || smallOrder(key))
+        return false;
+    if (decode(signature.subarray(0, 32)) === null)
+        return false;
+    if (little(signature.subarray(32)) >= L)
+        return false;
+    try {
+        const imported = await subtle().importKey('raw', own(pk), { name: 'Ed25519' }, false, ['verify']);
+        return await subtle().verify('Ed25519', imported, own(signature), own(message));
+    }
+    catch {
+        return false;
+    }
+};

package/dist/crypto/hash.d.ts

@@ -0,0 +1,2 @@
+export declare const sha256: (bytes: Uint8Array) => Promise<Uint8Array>;
+export declare const hkdf: (ikm: Uint8Array, info: Uint8Array, length: number) => Promise<Uint8Array>;

package/dist/crypto/hash.js

@@ -0,0 +1,11 @@
+// SPDX-License-Identifier: Apache-2.0
+// SHA-256 hashes, and HKDF-SHA-256 derives under the zero-length salt, with
+// the label's ASCII bytes as `info`.
+import { own, subtle } from './subtle.js';
+const SALT = new Uint8Array(0);
+export const sha256 = async (bytes) => new Uint8Array(await subtle().digest('SHA-256', own(bytes)));
+export const hkdf = async (ikm, info, length) => {
+    const material = await subtle().importKey('raw', own(ikm), 'HKDF', false, ['deriveBits']);
+    const bits = await subtle().deriveBits({ name: 'HKDF', hash: 'SHA-256', salt: SALT, info: own(info) }, material, length * 8);
+    return new Uint8Array(bits);
+};

package/dist/crypto/index.d.ts

@@ -0,0 +1,7 @@
+export { concat, hex, isHex, unhex, utf8, zero } from './bytes.ts';
+export { hkdf, sha256 } from './hash.ts';
+export { isCount, readObject, readValue, writeValue, type Fields, type Json } from './json.ts';
+export { decrypt, encrypt, TAG } from './aes.ts';
+export { agree, x25519Public } from './x25519.ts';
+export { ed25519Public, sign, verify } from './ed25519.ts';
+export { CIPHERTEXT, decapsulate, EK, encapsulate, lockFrom, type Lock } from './mlkem.ts';

package/dist/crypto/index.js

@@ -0,0 +1,10 @@
+// SPDX-License-Identifier: Apache-2.0
+// The six algorithms Quo names, and bytes. Arithmetic only: no label, no
+// key of Quo's, no decision.
+export { concat, hex, isHex, unhex, utf8, zero } from './bytes.js';
+export { hkdf, sha256 } from './hash.js';
+export { isCount, readObject, readValue, writeValue } from './json.js';
+export { decrypt, encrypt, TAG } from './aes.js';
+export { agree, x25519Public } from './x25519.js';
+export { ed25519Public, sign, verify } from './ed25519.js';
+export { CIPHERTEXT, decapsulate, EK, encapsulate, lockFrom } from './mlkem.js';

package/dist/crypto/json.d.ts

@@ -0,0 +1,8 @@
+export type Json = null | boolean | number | string | Json[] | {
+    [key: string]: Json;
+};
+export type Fields = ReadonlyMap<string, string>;
+export declare const readObject: (input: Uint8Array | string) => Fields | null;
+export declare const readValue: (input: Uint8Array | string, depth: number) => Json | undefined;
+export declare const writeValue: (value: unknown, depth: number) => string | undefined;
+export declare const isCount: (literal: string) => boolean;

package/dist/crypto/json.js

@@ -0,0 +1,250 @@
+const decoder = new TextDecoder('utf-8', { fatal: true, ignoreBOM: true });
+const NUMBER = /-?(?:0|[1-9]\d*)(?:\.\d+)?(?:[eE][+-]?\d+)?/y;
+const ESCAPE = /\\(?:["\\/bfnrt]|u[0-9a-fA-F]{4})/y;
+const LONE = /[\uD800-\uDBFF](?![\uDC00-\uDFFF])|(?<![\uD800-\uDBFF])[\uDC00-\uDFFF]/;
+const LITERALS = ['true', 'false', 'null'];
+const skip = (s, at) => {
+    while (at < s.length && ' \t\n\r'.includes(s[at]))
+        at += 1;
+    return at;
+};
+// The end of the string opening at `at`, or -1.
+const stringEnd = (s, at) => {
+    if (s[at] !== '"')
+        return -1;
+    for (at += 1; at < s.length;) {
+        const c = s.charCodeAt(at);
+        if (c === 0x22)
+            return at + 1;
+        if (c < 0x20)
+            return -1;
+        if (c !== 0x5c) {
+            at += 1;
+            continue;
+        }
+        ESCAPE.lastIndex = at;
+        if (!ESCAPE.test(s))
+            return -1;
+        at = ESCAPE.lastIndex;
+    }
+    return -1;
+};
+const scalarEnd = (s, at) => {
+    if (s[at] === '"')
+        return stringEnd(s, at);
+    const literal = LITERALS.find((word) => s.startsWith(word, at));
+    if (literal)
+        return at + literal.length;
+    NUMBER.lastIndex = at;
+    return NUMBER.test(s) ? NUMBER.lastIndex : -1;
+};
+// A key, its colon and the space after it: the start of the key's value, or -1.
+const keyEnd = (s, at) => {
+    const end = stringEnd(s, at);
+    if (end < 0)
+        return -1;
+    const colon = skip(s, end);
+    return s[colon] === ':' ? skip(s, colon + 1) : -1;
+};
+// The end of the value starting at `at`, held to the grammar at any depth
+// without recursion, or -1.
+const valueEnd = (s, at) => {
+    const open = [];
+    for (;;) {
+        const c = s[at];
+        if (c === '{' || c === '[') {
+            at = skip(s, at + 1);
+            if (s[at] === (c === '{' ? '}' : ']'))
+                at += 1;
+            else {
+                open.push(c);
+                if (c === '{' && (at = keyEnd(s, at)) < 0)
+                    return -1;
+                continue;
+            }
+        }
+        else if ((at = scalarEnd(s, at)) < 0)
+            return -1;
+        for (;;) {
+            if (open.length === 0)
+                return at;
+            at = skip(s, at);
+            const top = open.at(-1);
+            if (s[at] === ',') {
+                at = skip(s, at + 1);
+                if (top === '{' && (at = keyEnd(s, at)) < 0)
+                    return -1;
+                break;
+            }
+            if (s[at] !== (top === '{' ? '}' : ']'))
+                return -1;
+            open.pop();
+            at += 1;
+        }
+    }
+};
+const text = (input) => {
+    if (typeof input === 'string')
+        return input;
+    try {
+        return decoder.decode(input);
+    }
+    catch {
+        return null;
+    }
+};
+export const readObject = (input) => {
+    const s = text(input);
+    if (s === null)
+        return null;
+    const fields = new Map();
+    let at = skip(s, 0);
+    if (s[at] !== '{')
+        return null;
+    at = skip(s, at + 1);
+    if (s[at] === '}')
+        return skip(s, at + 1) === s.length ? fields : null;
+    for (;;) {
+        const keyStart = at;
+        const valueStart = keyEnd(s, at);
+        if (valueStart < 0)
+            return null;
+        const key = JSON.parse(s.slice(keyStart, stringEnd(s, keyStart)));
+        if (fields.has(key))
+            return null;
+        const end = valueEnd(s, valueStart);
+        if (end < 0)
+            return null;
+        fields.set(key, s.slice(valueStart, end));
+        at = skip(s, end);
+        if (s[at] === '}')
+            return skip(s, at + 1) === s.length ? fields : null;
+        if (s[at] !== ',')
+            return null;
+        at = skip(s, at + 1);
+    }
+};
+// A number text a double holds as written: a fraction, or a whole number
+// the double it reads as is exactly, never past the largest double, never
+// a value that rounds to zero, never minus zero.
+const exactNumber = (literal) => {
+    const [, sign, whole, frac = '', exp = '0'] = /^(-?)(0|[1-9]\d*)(?:\.(\d+))?(?:[eE]([+-]?\d+))?$/.exec(literal);
+    const v = Number(literal);
+    if (!Number.isFinite(v))
+        return false;
+    const digits = (whole + frac).replace(/^0+/, '');
+    if (v === 0)
+        return digits === '' && sign === '';
+    const trimmed = digits.replace(/0+$/, '');
+    const e = BigInt(exp) - BigInt(frac.length) + BigInt(digits.length - trimmed.length);
+    if (e < 0n)
+        return true;
+    return BigInt(trimmed) * 10n ** e === (v < 0 ? -BigInt(v) : BigInt(v)) || literal === String(v);
+};
+const depthOf = (s) => {
+    let depth = 0;
+    let deepest = 0;
+    for (let at = 0; at < s.length; at += 1) {
+        const c = s[at];
+        if (c === '"')
+            at = stringEnd(s, at) - 1;
+        else if (c === '{' || c === '[')
+            deepest = Math.max(deepest, (depth += 1));
+        else if (c === '}' || c === ']')
+            depth -= 1;
+    }
+    return deepest;
+};
+// Parses a text already held to the grammar and to the depth bound.
+const parse = (s) => {
+    let at = 0;
+    const value = () => {
+        at = skip(s, at);
+        const c = s[at];
+        if (c === '{' || c === '[') {
+            const object = c === '{';
+            const out = object ? {} : [];
+            at = skip(s, at + 1);
+            if (s[at] === (object ? '}' : ']')) {
+                at += 1;
+                return out;
+            }
+            for (;;) {
+                if (object) {
+                    const key = str();
+                    if (Object.hasOwn(out, key))
+                        throw new Error('two keys of one name');
+                    at = skip(s, at) + 1;
+                    Object.defineProperty(out, key, { value: value(), enumerable: true, writable: true, configurable: true });
+                }
+                else
+                    out.push(value());
+                at = skip(s, at);
+                if (s[at++] !== ',')
+                    return out;
+            }
+        }
+        if (c === '"')
+            return str();
+        const end = scalarEnd(s, at);
+        const literal = s.slice(at, end);
+        at = end;
+        if (LITERALS.includes(literal))
+            return JSON.parse(literal);
+        if (!exactNumber(literal))
+            throw new Error('a number no double holds as written');
+        return Number(literal);
+    };
+    const str = () => {
+        at = skip(s, at);
+        const end = stringEnd(s, at);
+        const out = JSON.parse(s.slice(at, end));
+        if (LONE.test(out))
+            throw new Error('a lone surrogate');
+        at = end;
+        return out;
+    };
+    return value();
+};
+export const readValue = (input, depth) => {
+    const s = text(input);
+    if (s === null)
+        return undefined;
+    const start = skip(s, 0);
+    const end = valueEnd(s, start);
+    if (end < 0 || skip(s, end) !== s.length || depthOf(s) > depth)
+        return undefined;
+    try {
+        return parse(s);
+    }
+    catch {
+        return undefined;
+    }
+};
+// A value as JSON text, or undefined for one that JSON would drop, rewrite
+// or refuse: anything but null, a boolean, a finite number other than minus
+// zero, well-formed text, a list with no holes, or a plain object of own
+// string keys, nested no deeper than `depth`, with no cycle.
+export const writeValue = (value, depth) => {
+    const fits = (v, room, path) => {
+        if (v === null || typeof v === 'boolean')
+            return true;
+        if (typeof v === 'string')
+            return !LONE.test(v);
+        if (typeof v === 'number')
+            return Number.isFinite(v) && !Object.is(v, -0);
+        if (typeof v !== 'object' || room === 0 || path.has(v))
+            return false;
+        path.add(v);
+        const ok = Array.isArray(v)
+            ? Object.keys(v).length === v.length && v.every((x) => fits(x, room - 1, path))
+            : [Object.prototype, null].includes(Object.getPrototypeOf(v)) &&
+                Object.getOwnPropertySymbols(v).length === 0 &&
+                Object.entries(Object.getOwnPropertyDescriptors(v)).every(([k, d]) => !LONE.test(k) && d.enumerable === true && 'value' in d && fits(d.value, room - 1, path));
+        path.delete(v);
+        return ok;
+    };
+    return fits(value, depth, new Set()) ? JSON.stringify(value) : undefined;
+};
+// A count number: no sign, no fraction, no exponent, from 1 to 2^53 - 1.
+export const isCount = (literal) => /^[1-9]\d{0,15}$/.test(literal) && Number(literal) <= Number.MAX_SAFE_INTEGER;

package/dist/crypto/mlkem.d.ts

@@ -0,0 +1,12 @@
+export declare const EK = 1184;
+export declare const CIPHERTEXT = 1088;
+export type Lock = {
+    ek: Uint8Array;
+    dk: Uint8Array;
+};
+export declare const lockFrom: (d: Uint8Array, z: Uint8Array) => Lock;
+export declare const encapsulate: (ek: Uint8Array, m: Uint8Array) => {
+    ciphertext: Uint8Array;
+    shared: Uint8Array;
+} | null;
+export declare const decapsulate: (dk: Uint8Array, ciphertext: Uint8Array) => Uint8Array | null;

package/dist/crypto/mlkem.js

@@ -0,0 +1,36 @@
+// SPDX-License-Identifier: Apache-2.0
+// ML-KEM-768 of FIPS 203 encapsulates. Web Crypto has none on every terrain,
+// so it comes from `@noble/post-quantum`.
+import { ml_kem768 } from '@noble/post-quantum/ml-kem.js';
+export const EK = 1184;
+export const CIPHERTEXT = 1088;
+// KeyGen_internal(d, z): the lock from sixty-four drawn bytes, d then z.
+export const lockFrom = (d, z) => {
+    const { publicKey, secretKey } = ml_kem768.keygen(Uint8Array.from([...d, ...z]));
+    return { ek: publicKey, dk: secretKey };
+};
+// Encaps_internal(ek, m), or null for an encapsulation key the modulus check
+// of FIPS 203 section 7.2 refuses.
+export const encapsulate = (ek, m) => {
+    if (ek.length !== EK)
+        return null;
+    try {
+        const { cipherText, sharedSecret } = ml_kem768.encapsulate(ek, m);
+        return { ciphertext: cipherText, shared: sharedSecret };
+    }
+    catch {
+        return null;
+    }
+};
+// Decapsulation is implicit rejection: a ciphertext for another lock gives a
+// shared secret that opens nothing.
+export const decapsulate = (dk, ciphertext) => {
+    if (ciphertext.length !== CIPHERTEXT)
+        return null;
+    try {
+        return ml_kem768.decapsulate(ciphertext, dk);
+    }
+    catch {
+        return null;
+    }
+};

package/dist/crypto/subtle.d.ts

@@ -0,0 +1,10 @@
+export declare const subtle: () => SubtleCrypto;
+export type Bytes = Uint8Array<ArrayBuffer>;
+export declare const own: (bytes: Uint8Array) => Bytes;
+declare const PKCS8: {
+    readonly Ed25519: '302e020100300506032b657004220420';
+    readonly X25519: '302e020100300506032b656e04220420';
+};
+export declare const importSecret: (curve: keyof typeof PKCS8, secret: Uint8Array, uses: KeyUsage[]) => Promise<CryptoKey>;
+export declare const publicOf: (key: CryptoKey) => Promise<Uint8Array>;
+export {};