nervur 0.19.2 → 0.20.0

package/dist/ward/seal.js

@@ -1,150 +0,0 @@
-import { isDoorWord } from '../being/silence.js';
-import { KEY, SIGNATURE, box, concat, derive, hex, sha256, sign, signingPair, sealingPair, unbox, unhex, verify } from './arithmetic.js';
-import { cellFault } from './cells.js';
-import { readJson } from './json.js';
-const utf8 = new TextEncoder();
-// The two labels a ward's keys are derived under. They are here and not in
-// arithmetic.ts because a label is a decision and that file is arithmetic.
-// `quo-seal` is taken: it is the label the message cipher derives its key and
-// nonce under, from an agreement rather than from a seed, and two derivations
-// answering to one name is how a kit is read wrong.
-const WARD_SIGN = new TextEncoder().encode('quo-ward-sign');
-const WARD_SEAL = new TextEncoder().encode('quo-ward-seal');
-// The one size in Quo: one mebibyte of bytes each way. It is read before
-// anything is opened, so bytes above it are never decrypted, never parsed and
-// never allocated against. Refusing them is bytes that said nothing, which is
-// already silence, so there is no tenth word and no new door case. Breadth
-// costs bytes, so this one number bounds every other breadth on the wire, and
-// what a being holds is not the protocol's business. An ask is a message and
-// not a file; what is larger is asked for in pieces.
-export const SIZE = 1024 * 1024;
-// The ward's key from its seed. Its pk on the wire is the signing pk then the padlock, 128 hex.
-//
-// One seed, two curves, and each secret derived from it under its own label.
-// Fed the seed straight, the two scalars differ only because Ed25519 hashes
-// what it is given and X25519 clamps it raw, which is an accident of the two
-// designs and no separation at all: one secret would be doing two jobs with
-// nothing said about it, and a second kit would have to reproduce a
-// construction nobody named. HKDF-SHA-256 under a label is the separation
-// said out loud, and it is what `quo/vectors/framing.json` pins.
-//
-// Bytes are key material and text is not. A seed handed in as bytes of the
-// key length is taken as it stands, which is what a harbor mints; anything
-// else, of any length, is hashed to that length first. So a thirty-two
-// character name is a name like any other, and not a key because it happened
-// to be the right size.
-export async function wardKey(seed) {
-    const seed32 = typeof seed === 'string' ? await sha256(utf8.encode(seed)) : seed.length === KEY ? seed : await sha256(seed);
-    const s = await signingPair(await derive(seed32, WARD_SIGN, KEY));
-    const p = await sealingPair(await derive(seed32, WARD_SEAL, KEY));
-    return { sign: s.secret, padlock: p.secret, signPk: s.pk, padlockPk: p.pk, pk: hex(s.pk) + hex(p.pk) };
-}
-export const wardSignPk = (pk) => unhex(pk.slice(0, KEY * 2));
-export const wardPadlock = (pk) => unhex(pk.slice(KEY * 2));
-export const isWardPk = (pk) => typeof pk === 'string' && /^[0-9a-f]{128}$/.test(pk);
-// Thirty-two bytes as hex, which is how this kit writes every single key: a
-// heir pk, a heir secret, a being's own key, and a digest, which is the same
-// thirty-two bytes of SHA-256. A ward pk is two of these and has its own
-// shape above. The two are spelled here and nowhere else, so a door, a
-// stance, a harbor and a conformance suite all refuse the same string.
-export const isHex = (v) => typeof v === 'string' && /^[0-9a-f]{64}$/.test(v);
-// A being's relation key: a seed, and the pk it signs as.
-export async function beingKey(seed) {
-    return { seed: hex(seed), pk: hex((await signingPair(seed)).pk) };
-}
-// Seal an ask. Returns the bytes and the ephemeral secret the reply will be sealed to.
-export async function sealAsk(to, payload, signer, padlock, seed) {
-    const body = utf8.encode(JSON.stringify({ to, ...payload }));
-    const inside = concat([body, await sign(body, signer)]);
-    const { bytes, ephemeral } = await box(inside, padlock, seed);
-    return { bytes, ephemeral: ephemeral.secret };
-}
-// Open an ask at the door. Null when it does not open or does not parse.
-// Verification is the door's own step, because only the door knows which key may speak.
-export async function openAsk(bytes, padlockSecret) {
-    try {
-        if (!(bytes instanceof Uint8Array) || bytes.length < 1 || bytes.length > SIZE)
-            return null;
-        const inside = await unbox(bytes, padlockSecret);
-        if (inside.length <= SIGNATURE)
-            return null;
-        const body = inside.subarray(0, inside.length - SIGNATURE);
-        const signature = inside.subarray(inside.length - SIGNATURE);
-        const payload = readJson(body);
-        // The heir, or null for the public being. Absent is not null: a payload
-        // that never named one is malformed, like any other missing field.
-        const to = payload.to;
-        if (to !== null && !isHex(to))
-            return null;
-        if (!isHex(payload.by))
-            return null;
-        if (payload.next !== null && !isHex(payload.next))
-            return null;
-        if (payload.method !== undefined && typeof payload.method !== 'string')
-            return null; // a name, or the empty ask. never a number, never an object.
-        if (payload.args !== undefined && (payload.args === null || typeof payload.args !== 'object' || Array.isArray(payload.args)))
-            return null; // args are one object, or absent. a string or a list is not an ask.
-        if (payload.args !== undefined && cellFault(payload.args, 'args') !== null)
-            return null; // and values all the way down: no key named __proto__, no nesting past the bound
-        if (!Number.isSafeInteger(payload.seq) || payload.seq < 1)
-            return null; // her count for this relation. one and up, and a whole number.
-        // The allowance is not read here. It is the door's, D2, and the door is
-        // its one reader: `spent` in allowance.ts says what a budget is and what
-        // is left of it, in one sentence, for a payload that opened like any other.
-        // The hop count, if this ask carries one: a whole number, never below
-        // zero. Absent is the ordinary ask and always will be.
-        if (payload.hops !== undefined && (!Number.isSafeInteger(payload.hops) || payload.hops < 0))
-            return null;
-        return { to, payload, body, signature, ephemeralPk: bytes.subarray(0, KEY) };
-    }
-    catch {
-        return null;
-    }
-}
-export const verifyAsk = (a, pk) => verify(a.body, a.signature, unhex(pk));
-// Seal a reply to the ephemeral pk of the ask it answers, signed by the ward.
-export async function sealReply(reply, ephemeralPk, wardSign, seed) {
-    const body = utf8.encode(JSON.stringify(reply));
-    return (await box(concat([body, await sign(body, wardSign)]), ephemeralPk, seed)).bytes;
-}
-// Open a reply with the ephemeral secret kept from the ask, and verify it
-// came from the ward it was sent to. Null is silence: it did not open, it
-// lied, or it is not a reply. Every ward on the wire is somebody else's code,
-// so the shape is checked here and nowhere later: a reply is `{ silence }`,
-// `{ quo: word }` with a word the door may say, or `{ object, seen }` with an
-// object that is a value and seen a digest or null. A field beside a shape's
-// own makes it none of the three, since a kit that dropped the field would
-// hand her an answer where this one hands her silence.
-// Anything else is bytes that said nothing, and her ward never hands her a
-// throw or an absent value for what a stranger wrote.
-export async function openReply(bytes, ephemeralSecret, signPk) {
-    try {
-        if (!(bytes instanceof Uint8Array) || bytes.length > SIZE)
-            return null;
-        const inside = await unbox(bytes, ephemeralSecret);
-        if (inside.length <= SIGNATURE)
-            return null;
-        const body = inside.subarray(0, inside.length - SIGNATURE);
-        if (!(await verify(body, inside.subarray(inside.length - SIGNATURE), signPk)))
-            return null;
-        const reply = readJson(body);
-        if (reply === null || typeof reply !== 'object' || Array.isArray(reply))
-            return null;
-        const r = reply;
-        const keys = Object.keys(r).sort().join(',');
-        if (keys === 'silence')
-            return r.silence === true ? { silence: true } : null;
-        if (keys === 'quo')
-            return isDoorWord(r.quo) ? { quo: r.quo } : null;
-        if (keys !== 'object,seen')
-            return null;
-        if (r.seen !== null && !isHex(r.seen))
-            return null;
-        if (cellFault(r.object, 'object') !== null)
-            return null; // values in both directions: nested past the bound is none of the shapes
-        return { object: r.object, seen: r.seen };
-    }
-    catch {
-        return null;
-    }
-}

package/src/being/lent.ts

@@ -1,72 +0,0 @@
-// SPDX-License-Identifier: Apache-2.0
-// A lent being: a being of the box's own ward, standing for one thing the
-// device can do. What makes her one is two asks the box's being alone may
-// make, whom she knows as the occupant `box`. `offer`: she mints an
-// invitation on herself and answers it, so that a ward the box vouches for
-// may knock and take a standing at her. `retract`: an offer that was not
-// taken, named by its heir, is removed, so a refused lend leaves nothing.
-//
-// The two are the base's and never a subclass's to declare: a class says
-// her own asks and nothing of the seam she is lent through, so they are
-// answered here before her asks are read, and shown to the box alone. No
-// root mints for her, and nothing else about her is decided here.
-//
-// A convenience, not a contract: a being that answers the two the same way
-// to `box` is lendable, whatever she extends.
-import { Being } from './being.ts';
-import type { Asker, Blueprint, JsonObject, Reply } from './types.ts';
-
-// The one word for the box's being: her key in the box's ward, the id every
-// lent being knows her by, and the standing every hosted ward takes at
-// birth.
-export const BOX = 'box';
-
-export const LENT_ASKS = {
-  offer: { name: 'offer', description: 'an invitation on me, for a ward the box vouches for', input: { type: 'object' } },
-  retract: { name: 'retract', description: 'an offer that was not taken, by its heir', input: { type: 'object', properties: { heir: { type: 'string' } }, required: ['heir'] } },
-};
-
-export class Lent extends Being {
-  // The offers she has open, heir to the id she minted under.
-  #open(): Record<string, string> {
-    return ((this.cells.open as Record<string, string> | undefined) ??= {});
-  }
-
-  async offer(): Promise<JsonObject> {
-    const n = ((this.cells.lent as number | undefined) ?? 0) + 1;
-    this.cells.lent = n;
-    const id = `lent:${n}`;
-    const inv = await this.invite(id);
-    if (inv === null) return { error: 'could not mint' };
-    this.#open()[inv.heir!] = id;
-    return inv;
-  }
-
-  retract(args: JsonObject): JsonObject {
-    const open = this.#open();
-    const heir = typeof args.heir === 'string' ? args.heir : '';
-    const id = Object.hasOwn(open, heir) ? open[heir] : undefined;
-    if (id === undefined) return { retracted: null };
-    this.occupants.remove(id);
-    delete open[heir];
-    return { retracted: id };
-  }
-
-  override describe(asker: Asker): Blueprint {
-    const bp = super.describe(asker);
-    if (asker.id !== BOX) return bp;
-    return { ...bp, asks: [...bp.asks, LENT_ASKS.offer, LENT_ASKS.retract] };
-  }
-
-  // An offer is open until it is taken or retracted. The taker's knock is the
-  // first word she hears from the occupant she minted for it, so hearing
-  // from that id closes the offer, and `open` holds only offers still
-  // waiting and not every lend she ever made.
-  override async answer(asker: Asker, method?: string, args: JsonObject = {}): Promise<Reply> {
-    const open = this.cells.open as Record<string, string> | undefined;
-    if (open && asker.id !== undefined && asker.id !== BOX) for (const [heir, id] of Object.entries(open)) if (id === asker.id) delete open[heir];
-    if (asker.id === BOX && method === 'offer') return this.offer();
-    if (asker.id === BOX && method === 'retract') return this.retract(args);
-    return super.answer(asker, method, args);
-  }
-}

package/src/being/silence.ts

@@ -1,46 +0,0 @@
-// SPDX-License-Identifier: Apache-2.0
-// Silence is one distinguished value. Null is an answer. Silence is no answer.
-//
-// The ward's words are the other distinguished values: what her ward tells
-// her when no object came back and it knows why. Each is one frozen object
-// under one symbol key, so a being cannot make one by accident, none of them
-// crosses an edge as a value, and a being who compares against them needs
-// no fourth shape. `unreached` is one of them.
-import { WORD_KEY, type DoorWord, type Unreached, type Word, type WordName } from './types.ts';
-
-export const silence: unique symbol = Symbol.for('quo.silence');
-export const isSilence = (x: unknown): x is typeof silence => x === silence;
-
-// The words a door says to a key it has bound, and no other. They ride on
-// the wire as `{ quo: word }`, so a reply is checked against this list.
-export const DOOR_WORDS: readonly DoorWord[] = ['removed', 'absent', 'unannounced', 'repeated', 'threw'];
-export const isDoorWord = (s: unknown): s is DoorWord => typeof s === 'string' && (DOOR_WORDS as readonly string[]).includes(s);
-
-const WORDS = new Map<WordName, Word>();
-export const word = <W extends WordName>(name: W): Word<W> => {
-  let w = WORDS.get(name);
-  if (!w) WORDS.set(name, (w = Object.freeze({ [WORD_KEY]: name })));
-  return w as Word<W>;
-};
-export const isWord = (x: unknown): x is Word => x !== null && typeof x === 'object' && typeof (x as Record<symbol, unknown>)[WORD_KEY] === 'string';
-export const wordOf = (x: Word): WordName => x[WORD_KEY];
-
-// What came back is an answer and not one of the two things that are not
-// answers. A being who only wants the object writes one test instead of
-// three, and the three shapes stay three shapes: silence is no answer, a word
-// is her ward telling her why there is none.
-export const answered = <T>(x: T): x is Exclude<T, typeof silence | Word> => !isSilence(x) && !isWord(x);
-
-// What she was told, with a word given its name and everything else left
-// exactly as it came. One value to compare against, so asking which word came
-// back is one test and not two joined by an and: `told(out) === 'late'` says
-// what `isWord(out) && wordOf(out) === 'late'` says, and says which answer
-// arrived instead when it is wrong, where the pair collapses to false and
-// names nothing. Silence stays the symbol it is, and an object stays itself.
-export const told = (x: unknown): unknown => (isWord(x) ? wordOf(x) : x);
-
-// Unreached: no far door was reached. Nothing is known to have been
-// delivered, so asking again is safe. A being cannot produce it: a ward that
-// sees a word come out of a being reads it as her having thrown.
-export const unreached = (): Unreached => word('unreached');
-export const isUnreached = (x: unknown): x is Unreached => isWord(x) && wordOf(x) === 'unreached';

package/src/conformance/assert.ts

@@ -1,100 +0,0 @@
-// SPDX-License-Identifier: Apache-2.0
-// The five assertions the conformance suite makes, and no more. Node has all
-// five in `node:assert/strict`, and naming that module would tie the suite to
-// one terrain -- the suite is the ward's truth, and the ward's truth has to be
-// checkable wherever a ward runs. So they are written here, in the language
-// alone, and `test/assert.test.ts` holds them to Node's own behaviour.
-export class Failed extends Error {}
-
-const show = (v: unknown): string => {
-  if (typeof v === 'symbol') return v.toString();
-  if (typeof v === 'bigint') return `${v}n`;
-  if (v === undefined) return 'undefined';
-  if (typeof v === 'function') return `[function ${v.name}]`;
-  // A ward's word is a frozen object under one symbol key, and JSON shows it
-  // as `{}`. A red estate chapter saying `{} is not {}` names nothing, so a
-  // value whose own keys are all symbols is shown by its keys.
-  if (v !== null && typeof v === 'object') {
-    const keys = Object.keys(v);
-    const syms = Object.getOwnPropertySymbols(v).filter((s) => Object.getOwnPropertyDescriptor(v, s)!.enumerable);
-    if (keys.length === 0 && syms.length > 0) return `{ ${syms.map((s) => `${s.toString()}: ${show((v as Record<symbol, unknown>)[s])}`).join(', ')} }`;
-  }
-  try {
-    return JSON.stringify(v) ?? Object.prototype.toString.call(v);
-  } catch {
-    return Object.prototype.toString.call(v); // a cycle, or a null prototype
-  }
-};
-const fail = (why: string, message?: string): never => {
-  throw new Failed(message ? `${message}: ${why}` : why);
-};
-
-// Structural, and strict about shape the way `node:assert/strict` is: a value
-// is not equal to one of another kind, and an array is not equal to an object
-// that happens to hold the same keys.
-// The four kinds this compares, and every other object is refused rather than
-// guessed at. A Date, a RegExp, a boxed primitive and a class instance each
-// carry state no key walk can see, so two of them with the same keys are
-// equal here and unequal in node, which is a wrong yes: the one answer a
-// suite must never give. A refusal is a red test that says so.
-const KNOWN: readonly (object | null)[] = [Object.prototype, null, Array.prototype, Uint8Array.prototype];
-
-// What node compares: own enumerable keys, strings then enumerable symbols.
-// Not `Reflect.ownKeys`, which also lists what a definition hid.
-const keysOf = (v: object): PropertyKey[] => [...Object.keys(v), ...Object.getOwnPropertySymbols(v).filter((s) => Object.getOwnPropertyDescriptor(v, s)!.enumerable)];
-
-export function same(a: unknown, b: unknown): boolean {
-  if (Object.is(a, b)) return true;
-  if (typeof a !== 'object' || typeof b !== 'object' || a === null || b === null) return false;
-  const proto = Object.getPrototypeOf(a) as object | null;
-  if (proto !== (Object.getPrototypeOf(b) as object | null)) return false;
-  if (!KNOWN.includes(proto)) return false; // a Date, a RegExp, a boxed number, a class of hers
-  if (Array.isArray(a) !== Array.isArray(b)) return false;
-  if (a instanceof Uint8Array && b instanceof Uint8Array) return a.length === b.length && a.every((x, i) => x === b[i]);
-  // An array is its indices and whatever else was hung on it, and a hole is
-  // not a present undefined: `[, 1]` and `[undefined, 1]` differ in node and
-  // must differ here. `every` skips holes, so the loop is written out.
-  if (Array.isArray(a) && Array.isArray(b)) {
-    if (a.length !== b.length) return false;
-    for (let i = 0; i < a.length; i += 1) {
-      if (i in a !== i in b) return false;
-      if (i in a && !same(a[i], b[i])) return false;
-    }
-    const extra = (v: unknown[]) => keysOf(v).filter((k) => typeof k !== 'string' || !/^(?:0|[1-9]\d*)$/.test(k));
-    const xa = extra(a), xb = extra(b);
-    const at = (v: unknown[], k: PropertyKey) => (v as unknown as Record<PropertyKey, unknown>)[k];
-    return xa.length === xb.length && xa.every((k) => xb.includes(k) && same(at(a, k), at(b, k)));
-  }
-  const ka = keysOf(a), kb = keysOf(b);
-  if (ka.length !== kb.length) return false;
-  return ka.every((k) => kb.includes(k) && same((a as Record<PropertyKey, unknown>)[k], (b as Record<PropertyKey, unknown>)[k]));
-}
-
-// `ok` narrows, the way `node:assert/strict`'s does: the suite leans on it to
-// turn a `string | null` into a `string`. That needs the explicit type below,
-// so the interface is written out rather than inferred.
-export type Assert = {
-  ok(value: unknown, message?: string): asserts value;
-  equal(actual: unknown, expected: unknown, message?: string): void;
-  notEqual(actual: unknown, expected: unknown, message?: string): void;
-  deepEqual(actual: unknown, expected: unknown, message?: string): void;
-  match(actual: string, re: RegExp, message?: string): void;
-};
-
-export const assert: Assert = {
-  ok(value: unknown, message?: string): asserts value {
-    if (!value) fail(`${show(value)} is not truthy`, message);
-  },
-  equal(actual: unknown, expected: unknown, message?: string): void {
-    if (!Object.is(actual, expected)) fail(`${show(actual)} !== ${show(expected)}`, message);
-  },
-  notEqual(actual: unknown, expected: unknown, message?: string): void {
-    if (Object.is(actual, expected)) fail(`${show(actual)} === ${show(expected)}`, message);
-  },
-  deepEqual(actual: unknown, expected: unknown, message?: string): void {
-    if (!same(actual, expected)) fail(`${show(actual)} is not ${show(expected)}`, message);
-  },
-  match(actual: string, re: RegExp, message?: string): void {
-    if (typeof actual !== 'string' || !re.test(actual)) fail(`${show(actual)} does not match ${String(re)}`, message);
-  },
-};

package/src/conformance/beings.ts

@@ -1,188 +0,0 @@
-// SPDX-License-Identifier: Apache-2.0
-// The fixture beings. Fixed, so that the ward is what varies. A printer, a
-// shop, a customer on the base class, a maker, a member, and one raw being
-// with no base at all.
-import { Being } from '../being/being.ts';
-import { Lent } from '../being/lent.ts';
-import { answered, isSilence, isUnreached, isWord, wordOf } from '../being/silence.ts';
-import { invitationArgs } from '../being/types.ts';
-import type { Ask, Asker, Blueprint, Invitation, Json, JsonObject, OccupantRecord, Reply, Stance } from '../being/types.ts';
-
-// A printer. Invites whom she is told to, prints for her occupants. Her
-// blueprint lives in her cells so a test can change her shape.
-export class Printer extends Being {
-  static override cells = { jobs: [] as JsonObject[], asks: [{ name: 'print', input: { type: 'object' } }] as JsonObject[] };
-  static override asks = { print: { input: { type: 'object' } } };
-  override describe(): Blueprint {
-    // Her own cells, which a test writes to change her shape. Cells are Json
-    // to the ward, so the asks are named for what she keeps in them.
-    return { asks: this.cells.asks as Ask[], notes: { model: 'LX-2' } };
-  }
-  print({ doc }: JsonObject, asker: Asker) {
-    (this.cells.jobs as JsonObject[]).push({ by: asker.id ?? null, doc: doc ?? null });
-    return { printed: doc ?? null };
-  }
-}
-
-// A shop. Invites customers in her own time. Keeps a printer as a standing.
-// Takes a gold customer back if the customer offers a way. Counts every ask
-// per occupant, by wrapping answer.
-export class Shop extends Being {
-  static override cells = { printerId: null as string | null, sales: [] as JsonObject[], minted: 0 };
-  static override asks = {
-    hello: { input: { type: 'object' } },
-    buy: { input: { type: 'object', properties: { item: { type: 'string' } } } },
-    refund: { input: { type: 'object' }, for: (rec: OccupantRecord | undefined) => rec?.notes.tier === 'gold' },
-  };
-
-  override async answer(asker: Asker, method?: string, args?: JsonObject): Promise<Reply> {
-    const rec = this.occupant(asker);
-    if (rec && method !== undefined) rec.notes.asks = (Number(rec.notes.asks) || 0) + 1;
-    return super.answer(asker, method, args);
-  }
-
-  // Outside any ask. She mints, her ward seals, she hands it out by mail.
-  async invite(tier = 'plain'): Promise<Invitation> {
-    const id = `cust${++(this.cells.minted as number)}`;
-    const inv = (await super.invite(id))!;
-    this.cells.occupants[id].notes.tier = tier;
-    return inv;
-  }
-
-  async keepPrinter(invitation: Invitation): Promise<boolean> {
-    const bp = await this.knock(invitation);
-    if (!answered(bp)) return false;
-    this.cells.printerId = await this.take('prn', invitation);
-    return true;
-  }
-
-  async hello({ invitation }: JsonObject, asker: Asker) {
-    const rec = this.occupant(asker);
-    if (rec?.notes.tier === 'gold' && invitation) {
-      const back = await this.knock(invitation as Invitation, 'hi');
-      if (answered(back)) await this.take(`vip-${asker.id}`, invitation as Invitation);
-    }
-    return { welcome: true };
-  }
-
-  async buy({ item }: JsonObject, asker: Asker) {
-    if (typeof item !== 'string') return { error: 'no such item' }; // args are hers to check
-    const id = this.cells.printerId as string | null;
-    const printer = id ? this.standings[id] : undefined;
-    if (!printer) return { error: 'no printer' };
-    const out = await printer.ask('print', { doc: `receipt for ${item}` });
-    if (isUnreached(out)) return { error: 'printer unreachable', retry: true };
-    if (!answered(out)) return { error: 'printer refused' };
-    const st = this.cells.standings[id!];
-    if (st.seen !== st.digest) this.occupant(asker)!.notes.printerChanged = true;
-    (this.cells.sales as JsonObject[]).push({ item: item ?? null, by: asker.id ?? null });
-    return { ok: true, receipt: (out as JsonObject).printed };
-  }
-
-  refund() {
-    return { ok: true };
-  }
-}
-
-// A customer. Consumes an invitation, and only then decides to keep the
-// shop. Offers the shop a way back so the shop can reach her.
-export class Customer extends Being {
-  static override cells = { heard: [] as JsonObject[] };
-  static override asks = { hi: { input: { type: 'object' } } };
-
-  async join(invitation: Invitation) {
-    // A way back for the shop, if she can mint one. She may not: two joins on
-    // one invitation race, and the second finds the id taken. Then she offers
-    // nothing and knocks all the same, which is what the shop is asked to
-    // survive. The old shape said `!` here and was wrong about it.
-    const mine = await this.invite('shop-back');
-    const out = await this.knock(invitation, 'hello', { invitation: mine === null ? null : invitationArgs(mine) });
-    if (!answered(out)) return out; // nothing was born
-    await this.take('shop', invitation); // now, and only now
-    return out;
-  }
-  buy(item: string) {
-    return this.standings.shop!.ask('buy', { item });
-  }
-  learn() {
-    return this.standings.shop!.ask();
-  }
-  hi(_args: JsonObject, asker: Asker) {
-    (this.cells.heard as JsonObject[]).push({ from: asker.id ?? null, method: 'hi' });
-    return { heard: 'hi' };
-  }
-}
-
-// The raw shape. No base class, no import from the kit. A being all the same.
-export class Echo {
-  s: Stance;
-  constructor(stance: Stance) {
-    this.s = stance;
-  }
-  answer(asker: Asker, method?: string, args: JsonObject = {}): Reply {
-    if (method === undefined) return { asks: [{ name: 'echo', input: {} }], notes: {} };
-    return { from: asker.id ?? null, ...args };
-  }
-}
-
-// A member of an estate. Nothing scripted: she invites whom she is told to,
-// knocks where she is told to, and answers `ping` with the asker's own name.
-// The estate chapter drives her, and what it drives is the graph, not her.
-// A being who makes beings. `boot` is on every stance, so it is the ward's
-// promise and not this kit's, and a second kit that never wired it hands its
-// beings a call that answers null for ever. She says what came of it: the key
-// back, or null for a key already taken, a class the harbor does not hold, or
-// a constructor that threw. With an id she also asks for a way back, and then
-// she holds a standing to what she made like any other.
-export class Maker extends Being {
-  static override cells = { made: [] as string[] };
-  static override asks = {
-    open: { input: { type: 'object', properties: { class: { type: 'string' }, key: { type: 'string' }, id: { type: 'string' } }, required: ['class', 'key'] } },
-    say: { input: { type: 'object', properties: { id: { type: 'string' } }, required: ['id'] } },
-    borrow: { input: { type: 'object', properties: { name: { type: 'string' }, id: { type: 'string' } }, required: ['name', 'id'] } },
-  };
-  async open({ class: className, key, id }: JsonObject) {
-    const made = await this.boot(className as string, key as string, id as string | undefined);
-    if (made !== null) (this.cells.made as string[]).push(made);
-    return { made };
-  }
-  async say({ id }: JsonObject) {
-    const standing = this.standings[id as string];
-    return { said: standing === undefined ? null : ((await standing.ask('ping')) as Json) };
-  }
-  // Making's other half: a standing at something the box already has, by the
-  // name the box knows it under. She is handed the id and never the value.
-  async borrow({ name, id }: JsonObject) {
-    return { lent: await this.lend(name as string, id as string) };
-  }
-}
-
-// A member is also lendable: lent by a box that stands her in its own ward,
-// she offers an invitation on herself when the box's being asks, and is an
-// ordinary being to everyone else.
-export class Member extends Lent {
-  static override cells = { ...Lent.cells, heard: [] as JsonObject[] };
-  static override asks = {
-    ...Lent.asks,
-    ping: { input: { type: 'object' } },
-    relay: { input: { type: 'object', properties: { id: { type: 'string' }, method: { type: 'string' }, time: { type: 'number' } }, required: ['id'] } },
-  };
-  ping(_args: JsonObject, asker: Asker) {
-    (this.cells.heard as JsonObject[]).push({ from: asker.id ?? null });
-    return { pong: asker.id ?? null };
-  }
-  // She asks on one of her standings from inside her own answer, and says
-  // what came back as a word rather than as the word itself, since a word is
-  // her ward's value and never a thing that crosses. `time` is what she is
-  // willing to wait, which is the whole of what the third argument is for.
-  // Two members holding each other and relaying make a cycle, and a cycle is
-  // how a suite that owns no clock can see a wait end.
-  async relay({ id, method, args, time }: JsonObject) {
-    const standing = this.standings[id as string];
-    if (standing === undefined) return { said: 'no standing', out: null };
-    const out = await standing.ask(method as string | undefined, (args ?? {}) as JsonObject, time === undefined ? undefined : { time: time as number });
-    if (isSilence(out)) return { said: 'silence', out: null };
-    if (isWord(out)) return { said: wordOf(out), out: null };
-    return { said: null, out: out };
-  }
-}