nervur 0.19.2 → 0.20.0

package/src/ward/arithmetic.ts

@@ -1,251 +0,0 @@
-// SPDX-License-Identifier: Apache-2.0
-// Four algorithms, named once and never negotiated: Ed25519 signs, X25519
-// agrees, SHA-256 hashes, AES-256-GCM encrypts with the key derived through
-// HKDF-SHA-256 under a fixed label. All four live in `crypto.subtle`, so this
-// takes no package and runs the same in a browser tab as on a server -- on
-// any terrain that carries them. SHA-256, AES-GCM and HKDF are everywhere;
-// the two curves are recent, and a terrain without them is a terrain no ward
-// runs on. `test/floor.test.ts` names the floor and probes for it. Subtle is
-// asynchronous, so everything here is.
-//
-// `crypto.subtle` is read at every use and never captured at load. A browser
-// on a plain http:// origin has `crypto` without `subtle`, and a terrain may
-// install one after this module is first imported; a reference taken here
-// would turn either into an unreadable failure deep inside a key import.
-const subtle = (): SubtleCrypto => {
-  const s = globalThis.crypto?.subtle;
-  if (!s) throw new Error('this terrain has no crypto.subtle: a ward needs a secure context');
-  return s;
-};
-
-export const KEY = 32;
-export const SIGNATURE = 64;
-export const NONCE = 12;
-export const TAG = 16;
-const SEAL_INFO = new TextEncoder().encode('quo-seal');
-const SALT = new Uint8Array(0);
-
-// A 32-byte secret plus a fixed prefix is the whole PKCS#8 wrapping for both curves.
-const ED_SECRET = unhex('302e020100300506032b657004220420');
-const X_SECRET = unhex('302e020100300506032b656e04220420');
-const ED = { name: 'Ed25519' };
-const X = { name: 'X25519' };
-
-const HEX = Array.from({ length: 256 }, (_, at) => at.toString(16).padStart(2, '0'));
-export function hex(bytes: Uint8Array | ArrayBuffer): string {
-  let out = '';
-  for (const byte of new Uint8Array(bytes)) out += HEX[byte];
-  return out;
-}
-export function unhex(text: string): Uint8Array {
-  const out = new Uint8Array(text.length / 2);
-  for (let at = 0; at < out.length; at += 1) out[at] = parseInt(text.slice(at * 2, at * 2 + 2), 16);
-  return out;
-}
-export function concat(parts: Uint8Array[]): Uint8Array {
-  const out = new Uint8Array(parts.reduce((n, p) => n + p.length, 0));
-  let at = 0;
-  for (const part of parts) {
-    out.set(part, at);
-    at += part.length;
-  }
-  return out;
-}
-export function sameBytes(a: Uint8Array, b: Uint8Array): boolean {
-  if (a.length !== b.length) return false;
-  let diff = 0;
-  for (let at = 0; at < a.length; at += 1) diff |= a[at] ^ b[at];
-  return diff === 0;
-}
-
-// The eight small-order points of Ed25519, in their canonical encoding, and
-// the two points with x = 0 spelled with the sign bit set, which a decoder
-// that ignores the bit reads as the same point. A public key among them
-// verifies nothing. An encoding whose y coordinate is
-// not reduced, y at or above the field's prime p, names one of the same
-// points under another spelling, and a terrain's verify may accept a zero
-// signature under it; the field has room for the spelling, so it is refused
-// before the list is read.
-const SMALL_ORDER = [
-  '0100000000000000000000000000000000000000000000000000000000000000',
-  'ecffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff7f',
-  '0000000000000000000000000000000000000000000000000000000000000000',
-  '0000000000000000000000000000000000000000000000000000000000000080',
-  '26e8958fc2b227b045c3f489f2ef98f0d5dfac05d3c63339b13802886d53fc05',
-  'c7176a703d4dd84fba3c0b760d10670f2a2053fa2c39ccc64ec7fd7792ac037a',
-  '26e8958fc2b227b045c3f489f2ef98f0d5dfac05d3c63339b13802886d53fc85',
-  'c7176a703d4dd84fba3c0b760d10670f2a2053fa2c39ccc64ec7fd7792ac03fa',
-  '0100000000000000000000000000000000000000000000000000000000000080',
-  'ecffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff',
-].map(unhex);
-// y >= p, read little-endian with the sign bit masked off: the top byte is
-// 0x7f under the mask, every middle byte is 0xff, and the low byte is at
-// least 0xed, which is p's.
-const unreduced = (pk: Uint8Array): boolean => (pk[31] & 0x7f) === 0x7f && pk[0] >= 0xed && pk.subarray(1, 31).every((b) => b === 0xff);
-export const smallOrder = (pk: Uint8Array): boolean => unreduced(pk) || SMALL_ORDER.some((p) => sameBytes(p, pk));
-
-const key32 = (value: Uint8Array, what: string): Uint8Array => {
-  if (!(value instanceof Uint8Array) || value.length !== KEY) throw new Error(`${what} is not a 32-byte key`);
-  return value;
-};
-const pkcs8 = (prefix: Uint8Array, value: Uint8Array, what: string) => concat([prefix, key32(value, what)]);
-
-// Importing a key is the most expensive thing on the path of an ask, and most
-// of the imports are the same key again: a ward signs every reply with the one
-// key, opens every ask with the one padlock, and verifies a relation under the
-// key it verified it under last time. Measured over a round trip, fifteen of
-// the twenty-five imports were bytes already imported once.
-//
-// So an imported key is kept, by the bytes it was imported from. A CryptoKey
-// cannot be changed once it exists, so handing the same one out twice is
-// handing out what a second import would have built. Nothing here is a
-// decision a peer can see: two wards that cache differently, or not at all,
-// speak the same bytes.
-//
-// It is bounded, and that is not a detail. A relation mints a fresh key on
-// every ask, so a ward that talked all day would otherwise hold a key for
-// every ask it ever made. Past the bound the least recently used goes, which
-// is the key of a relation that has fallen quiet, and importing it again
-// costs what it cost the first time.
-//
-// The secret keys in here are the ones the partition already holds in this
-// process, as seeds. The cache is another shape of what the ward is already
-// standing on, and never a second place a secret comes from.
-const KEYS = 512;
-const imported = new Map<string, Promise<CryptoKey>>();
-const keep = (id: string, make: () => Promise<CryptoKey>): Promise<CryptoKey> => {
-  const had = imported.get(id);
-  if (had !== undefined) {
-    imported.delete(id); // and set again below: the most recently used goes last
-    imported.set(id, had);
-    return had;
-  }
-  const made = make();
-  // A key that would not import is not kept: the next call asks subtle again
-  // and hears the same refusal, rather than reading one this cache remembered.
-  // Node takes any thirty-two bytes as a public key and finds out at verify,
-  // so nothing here reaches this line; a terrain that checks the point at the
-  // import does, and a refusal it remembered would be a relation killed for
-  // good by one bad arrival.
-  made.catch(() => imported.delete(id));
-  imported.set(id, made);
-  // One in, at most one out: a map keeps what was put in the order it was put,
-  // so the first key it names is the one used longest ago.
-  if (imported.size > KEYS) imported.delete(imported.keys().next().value!);
-  return made;
-};
-
-// How many imported keys are held, and the bound they are held under. Nothing
-// in the ward reads either: they are here to be looked at, and for the suite
-// that holds the bound to what it says.
-export const heldKeys = (): { held: number; bound: number } => ({ held: imported.size, bound: KEYS });
-
-const secretKey = (alg: { name: string }, prefix: Uint8Array, value: Uint8Array, what: string, uses: KeyUsage[]) => {
-  const bytes = pkcs8(prefix, value, what);
-  return keep(`${alg.name}|${uses.join('+')}|${hex(bytes)}`, () => subtle().importKey('pkcs8', bytes as BufferSource, alg, true, uses));
-};
-const publicKey = (alg: { name: string }, value: Uint8Array, what: string, uses: KeyUsage[]) => {
-  const bytes = key32(value, what);
-  return keep(`${alg.name}|${uses.join('+')}|pk|${hex(bytes)}`, () => subtle().importKey('raw', bytes as BufferSource, alg, true, uses));
-};
-
-// Subtle exports the public half of a private key only through a JWK, where
-// `x` is the 32 raw bytes in base64url. The answer is a fact about the key and
-// never changes, so it is kept beside the key it was read from and goes when
-// the key does.
-const publics = new WeakMap<CryptoKey, Promise<Uint8Array>>();
-function rawPublic(secret: CryptoKey): Promise<Uint8Array> {
-  const had = publics.get(secret);
-  if (had !== undefined) return had;
-  const read = (async () => {
-    const jwk = await subtle().exportKey('jwk', secret);
-    const binary = atob(jwk.x!.replaceAll('-', '+').replaceAll('_', '/'));
-    const out = new Uint8Array(binary.length);
-    for (let at = 0; at < binary.length; at += 1) out[at] = binary.charCodeAt(at);
-    return out;
-  })();
-  publics.set(secret, read);
-  return read;
-}
-
-export async function sha256(...parts: Uint8Array[]): Promise<Uint8Array> {
-  return new Uint8Array(await subtle().digest('SHA-256', concat(parts) as BufferSource));
-}
-
-export type Pair = { secret: Uint8Array; pk: Uint8Array };
-// Both halves are copies. The seed and the public key are kept behind the two
-// caches above, and a pair is handed to whoever asked for it: what she does
-// with the bytes in her hand is hers, and must not reach what the next caller
-// is given.
-export async function signingPair(seed: Uint8Array): Promise<Pair> {
-  const secret = await secretKey(ED, ED_SECRET, seed, 'seed', ['sign']);
-  return { secret: Uint8Array.from(seed), pk: Uint8Array.from(await rawPublic(secret)) };
-}
-export async function sealingPair(seed: Uint8Array): Promise<Pair> {
-  const secret = await secretKey(X, X_SECRET, seed, 'seed', ['deriveBits']);
-  return { secret: Uint8Array.from(seed), pk: Uint8Array.from(await rawPublic(secret)) };
-}
-
-export async function sign(message: Uint8Array, secret: Uint8Array): Promise<Uint8Array> {
-  const key = await secretKey(ED, ED_SECRET, secret, 'secret', ['sign']);
-  return new Uint8Array(await subtle().sign(ED, key, message as BufferSource));
-}
-export async function verify(message: Uint8Array, signature: Uint8Array, pk: Uint8Array): Promise<boolean> {
-  if (!(signature instanceof Uint8Array) || signature.length !== SIGNATURE) return false;
-  if (!(pk instanceof Uint8Array) || pk.length !== KEY || smallOrder(pk)) return false;
-  try {
-    return await subtle().verify(ED, await publicKey(ED, pk, 'pk', ['verify']), signature as BufferSource, message as BufferSource);
-  } catch {
-    return false;
-  }
-}
-
-export async function agree(secret: Uint8Array, peerPk: Uint8Array): Promise<Uint8Array> {
-  const key = await secretKey(X, X_SECRET, secret, 'secret', ['deriveBits']);
-  const peer = await publicKey(X, peerPk, 'padlock', []);
-  const shared = new Uint8Array(await subtle().deriveBits({ name: X.name, public: peer }, key, KEY * 8));
-  if (shared.every((b) => b === 0)) throw new Error('dead agreement'); // a padlock that was not a real key
-  return shared;
-}
-
-// HKDF-SHA-256: bytes from a secret, under a label that says what they are
-// for. No salt, because the secret handed in is already a secret of full
-// strength and the label is what keeps one use apart from another. Every
-// label in this kit is spelled where it is used, never here: this is
-// arithmetic and a label is a decision.
-export async function derive(secret: Uint8Array, label: Uint8Array, bytes: number): Promise<Uint8Array> {
-  const material = await subtle().importKey('raw', secret as BufferSource, 'HKDF', false, ['deriveBits']);
-  return new Uint8Array(await subtle().deriveBits({ name: 'HKDF', hash: 'SHA-256', salt: SALT, info: label as BufferSource }, material, bytes * 8));
-}
-
-// One HKDF-SHA-256 yields the AES key and the nonce together. The nonce needs
-// no randomness of its own: the key it pairs with is fresh on every message.
-async function cipherKey(shared: Uint8Array, use: KeyUsage) {
-  const out = await derive(shared, SEAL_INFO, KEY + NONCE);
-  return { key: await subtle().importKey('raw', out.subarray(0, KEY) as BufferSource, 'AES-GCM', false, [use]), nonce: out.subarray(KEY) };
-}
-// The additional authenticated data is the ephemeral public key: the one thing outside the seal, bound to it.
-export async function encrypt(shared: Uint8Array, plaintext: Uint8Array, aad: Uint8Array): Promise<Uint8Array> {
-  const { key, nonce } = await cipherKey(shared, 'encrypt');
-  return new Uint8Array(await subtle().encrypt({ name: 'AES-GCM', iv: nonce as BufferSource, additionalData: key32(aad, 'aad') as BufferSource, tagLength: TAG * 8 }, key, plaintext as BufferSource));
-}
-export async function decrypt(shared: Uint8Array, ciphertext: Uint8Array, aad: Uint8Array): Promise<Uint8Array> {
-  if (ciphertext.length < TAG) throw new Error('short input');
-  const { key, nonce } = await cipherKey(shared, 'decrypt');
-  return new Uint8Array(await subtle().decrypt({ name: 'AES-GCM', iv: nonce as BufferSource, additionalData: key32(aad, 'aad') as BufferSource, tagLength: TAG * 8 }, key, ciphertext as BufferSource));
-}
-
-// A box: an ephemeral X25519 pk outside, one ciphertext sealed to the
-// padlock. The answer to a box is a box sealed to that ephemeral pk, so the
-// sender keeps the ephemeral secret until the answer comes.
-export async function box(inside: Uint8Array, padlock: Uint8Array, seed: Uint8Array): Promise<{ bytes: Uint8Array; ephemeral: Pair }> {
-  const ephemeral = await sealingPair(seed);
-  const shared = await agree(ephemeral.secret, padlock);
-  return { bytes: concat([ephemeral.pk, await encrypt(shared, inside, ephemeral.pk)]), ephemeral };
-}
-export async function unbox(bytes: Uint8Array, padlockSecret: Uint8Array): Promise<Uint8Array> {
-  if (bytes.length <= KEY) throw new Error('short input');
-  const ephemeralPk = bytes.subarray(0, KEY);
-  const shared = await agree(padlockSecret, ephemeralPk);
-  return decrypt(shared, bytes.subarray(KEY), ephemeralPk);
-}

package/src/ward/door.ts

@@ -1,186 +0,0 @@
-// SPDX-License-Identifier: Apache-2.0
-// Judgment at the door. Sealed bytes in, sealed bytes out, and one bit for
-// the harbor: whether a key this door holds spoke. A stranger, bytes the
-// door cannot admit, meets one silence whatever the case, so that it learns
-// nothing, not even which case it hit. A key the door has bound hears the
-// ward's word for what happened, sealed to its own lid, because it has
-// already proven who it is and a reason to it is an oracle to nobody. What
-// passes is named and dispatched to her answer, and her digest for that
-// asker rides back with the object.
-import { isSilence, isWord } from '../being/silence.ts';
-import { digest } from '../being/digest.ts';
-import type { Asker, BeingLike, DoorWord, JsonObject, OccupantRecord } from '../being/types.ts';
-import { at } from './partition.ts';
-import type { Heirs } from './heirs.ts';
-import { openAsk, sealReply, verifyAsk, type ReplyPayload, type WardKey } from './seal.ts';
-import { spent } from './allowance.ts';
-import { KEY, sealingPair } from './arithmetic.ts';
-import { cellFault } from './cells.ts';
-
-export type Door = { key: string; being: BeingLike; cells: { occupants: Record<string, OccupantRecord> } };
-export type Judged = { bytes: Uint8Array; heard: boolean };
-const SILENCE: ReplyPayload = { silence: true };
-const said = (quo: DoorWord): ReplyPayload => ({ quo });
-
-// One arrival at one being, already named: the three choices, D11, D12 and
-// D13, and nothing else. Catches every throw. `bound` says whether the asker
-// is a key this door holds, or the ward's own owner: she hears `threw`; a
-// stranger at the public being hears silence, because her insides are hers.
-// Every caller that reaches a being's answer goes through here, the owner's
-// `ask` included, so the three choices are written once.
-export async function answered(door: Door, asker: Asker, method: string | undefined, args: JsonObject, bound: boolean): Promise<ReplyPayload> {
-  const threw = bound ? said('threw') : SILENCE;
-  let out: Awaited<ReturnType<BeingLike['answer']>>;
-  try {
-    out = await door.being.answer(asker, method, args);
-  } catch {
-    return threw; // she threw where she was asked. there is no answer.
-  }
-  // Nothing at all is not an answer either: a method that forgot to return
-  // has said nothing, and nothing is silence, never a value that JSON drops
-  // on the way out and the far side reads back as a fourth word.
-  if (out === undefined || isSilence(out)) return SILENCE;
-  if (isWord(out)) return threw; // a word is the ward's to say, never hers
-  // Her answer is held to the rule her args and her cells are held to. A
-  // shape JSON would drop or rewrite on the way out, a Date, a Map, a NaN, a
-  // cycle, is not hers to make: the far side would read something she never
-  // said, or the door itself would fail to write her reply after the number
-  // was spent. It is threw, like a word out of her.
-  if (cellFault(out, 'answer') !== null) return threw;
-  return { object: out, seen: null };
-}
-
-// What crosses the wire: her answer, with her digest for this asker beside
-// it. The digest rides along, it is not the answer. She has already
-// answered: a describe that will not run costs the digest, and nothing else.
-// The owner does not take one, because the owner asks for a describe when it
-// wants one and nothing is sealed on its behalf.
-export async function arrive(door: Door, asker: Asker, method: string | undefined, args: JsonObject, bound: boolean): Promise<ReplyPayload> {
-  const reply = await answered(door, asker, method, args, bound);
-  if (method === undefined || !('object' in reply)) return reply;
-  return { object: reply.object, seen: await seen(door, asker) };
-}
-
-// Her digest for this asker, or null when her describe threw or fell silent.
-// The owner's describe reads it the same way for every being of the ward.
-export async function seen(door: Door, asker: Asker): Promise<string | null> {
-  try {
-    const bp = await door.being.answer(asker);
-    if (isSilence(bp) || isWord(bp)) return null;
-    // Held to the same rule as her answer, and for the same reason plus one:
-    // the digest is a walk, and a walk over a graph that shares or turns back
-    // on itself is not a digest but a hang or a throw. A blueprint that could
-    // not cross is a blueprint with no digest, which is what she has when her
-    // describe says nothing.
-    if (cellFault(bp, 'blueprint') !== null) return null;
-    return await digest(bp);
-  } catch {
-    return null;
-  }
-}
-
-type Verdict = { reply: ReplyPayload; ephemeralPk: Uint8Array; heard: boolean };
-
-export function makeDoor(
-  key: WardKey,
-  heirs: Heirs,
-  doors: Map<string, Door>,
-  publicKey: () => string | null,
-  random: (n: number) => Uint8Array,
-  keep: () => Promise<boolean>,
-) {
-  const judge = async (bytes: Uint8Array): Promise<Verdict | null> => {
-    const a = await openAsk(bytes, key.padlock);
-    if (!a) return null; // D1. it did not open. there is nobody to answer.
-    const { to, payload, ephemeralPk } = a;
-    const refuse = (): Verdict => ({ reply: SILENCE, ephemeralPk, heard: false });
-    // D2. The allowance is read here, before anything is done under it, and
-    // here only: a time that is not a whole number above zero is malformed and
-    // is refused as one. Hops at zero is refused beside it, so that a relay
-    // chain invented later meets doors that already stop it. Nothing sets hops.
-    if (spent({ time: payload.time }) || payload.hops === 0) return refuse();
-    const args = payload.args ?? {};
-    if (to === null) {
-      // For nobody: the public being, or D3 nobody home; D4 the signature
-      // fails under the key the payload names. She is asked by strangers,
-      // and a stranger hears silence for whatever she then does.
-      const pk = publicKey();
-      const pub = pk !== null ? doors.get(pk) : undefined;
-      if (!pub || !(await verifyAsk(a, payload.by))) return refuse();
-      // She answers, and the bit stays false: no key this door holds spoke.
-      // The public being is the one place a stranger is answered by design,
-      // so it is the one place a harbor must still be able to rate her.
-      return { reply: await arrive(pub, {}, payload.method, args, false), ephemeralPk, heard: false };
-    }
-    const h = heirs.admits(to, payload.by);
-    if (!h) {
-      // D5 a heir not held, D6 a key not admitted. One more case: the heir
-      // was held and the id removed. Its last keys are kept so that their
-      // holder, and only their holder, D7 checked, hears that she is gone.
-      if (!heirs.gone(to, payload.by) || !(await verifyAsk(a, payload.by))) return refuse();
-      return { reply: said('removed'), ephemeralPk, heard: true };
-    }
-    if (!(await verifyAsk(a, payload.by))) return refuse(); // D7, under an admitted key
-    // The signature took time, and another arrival on this heir may have been
-    // honoured meanwhile: a knock that raced this one and won spent the heir,
-    // and the key this ask speaks under may not be admitted any more. The
-    // door judges concurrently, so admission is read again now that writing
-    // is next, and what changed under the await is judged as it stands.
-    if (!heirs.admits(to, payload.by)) return heirs.gone(to, payload.by) ? { reply: said('removed'), ephemeralPk, heard: true } : refuse();
-    // From here the door has heard a key it holds. Every answer below is
-    // sealed to that key's lid; nothing below is a stranger's.
-    const door = doors.get(h.being);
-    if (!door) return { reply: said('absent'), ephemeralPk, heard: true }; // D8. she did not come back this run
-    if (!at(door.cells.occupants, h.id)) return { reply: said('removed'), ephemeralPk, heard: true }; // D8. the record is gone
-    // Once only, and only now: the number is spent after the signature, so a
-    // stranger cannot burn a number she could not sign for, and together with
-    // the keys, so the same bytes twice rotate nothing and refusal writes nothing.
-    const honoured = heirs.honour(h, payload.by, payload.next, payload.seq); // D9, D10
-    if (honoured !== true) return { reply: said(honoured), ephemeralPk, heard: true };
-    return { reply: await arrive(door, { id: h.id }, payload.method, args, true), ephemeralPk, heard: true };
-  };
-
-  // The door itself. Always answers bytes. When the ask did not open, the
-  // reply is sealed to the ephemeral pk on its lid, which is all a stranger
-  // holds, and says silence.
-  //
-  // A lid that is not a key, a small-order point, of which the two curves
-  // have several each, makes a dead agreement, and the seal refuses it. The
-  // door never throws: that reply is noise, a plain silence sealed to a key
-  // nobody holds, and the same is written for anything else the seal will
-  // not take.
-  // `judge` reads rows it does not check: open() reads the partition's shape
-  // at birth, so a row it acts on is the shape it expects. That is the first
-  // line and this is the second, because "the door never throws" is a promise
-  // to the harbor, which has nobody to hand a rejection to and would count it
-  // as no answer at all. Anything unforeseen is the silence a stranger hears.
-  return async function door(bytes: Uint8Array): Promise<Judged> {
-    const out = await judge(bytes).catch(() => null);
-    let reply = out?.reply ?? SILENCE;
-    const heard = out?.heard ?? false;
-    // The last moment anything can still be said. She has answered and the
-    // rows she wrote are named, so the harbor is asked to keep them before
-    // the reply is sealed: after the seal there is no taking it back, and
-    // the lid is the asker's. A store that refused makes this arrival a
-    // failed ask, which is `threw` to a key this door holds and silence to
-    // anyone else, the same two words a being who threw would have got. The
-    // asker learns that nothing took effect, and never that a disk is full.
-    //
-    // A keep that throws is a refusal: a harbor whose store is unreachable
-    // has kept nothing, and the door that never throws does not start here.
-    if (!(await keep().catch(() => false))) reply = heard ? said('threw') : SILENCE;
-    try {
-      return { bytes: await sealReply(reply, out?.ephemeralPk ?? lid(bytes, random), key.sign, random(32)), heard };
-    } catch {
-      return { bytes: await sealReply(SILENCE, (await sealingPair(random(32))).pk, key.sign, random(32)), heard };
-    }
-  };
-}
-
-// The ephemeral pk on an ask that would not open, if the bytes are long
-// enough to carry one. Otherwise a fresh key nobody holds: the reply is
-// bytes, and it is noise.
-function lid(bytes: Uint8Array, random: (n: number) => Uint8Array): Uint8Array {
-  if (bytes instanceof Uint8Array && bytes.length >= KEY) return bytes.subarray(0, KEY);
-  return random(KEY);
-}

package/src/ward/ground.ts

@@ -1,142 +0,0 @@
-// SPDX-License-Identifier: Apache-2.0
-// The ground. The one object a harbor passes a ward at birth, and the whole
-// of the device to it: six things, and everything a runtime differs on
-// arrives in one of them, which is why the ward itself knows no runtime.
-//
-//   seed         who the ward is. the pk derives from it and from nothing else
-//   random       entropy. every key the ward mints is drawn from it
-//   memory       what the ward remembers: one interface, a body per terrain
-//   instantiate  the dna: a class name and a stance in, a being or nothing out
-//   carry        the wire: a ward pk and sealed bytes in, sealed bytes or nothing out
-//   box          the device, as one invitation on the box's own being
-//
-// The spec lists nine things and says a kit gathers them however its
-// language gathers things. This kit gathers the partition, wrote, keep and
-// calling into memory, because they are one concern with four moments, and
-// a ward is handed one body and told how to use it rather than four calls
-// it must keep in step.
-import type { Stance, BeingLike, BeingClass, Invitation } from '../being/types.ts';
-
-// Memory. Four moments, and they are the promise a body keeps:
-//
-//   rows    the values the ward holds and writes into directly. synchronous,
-//           always, because the door judges an arrival in one pass and a
-//           disk in the middle of it would be a door that waits on a device
-//   told    the ward says it after every write, naming the row: a being by
-//           her key, or `HEAD` for everything that is not one being's.
-//           nothing comes back. a body that keeps the rows saves in the
-//           order it was told, so a being driven in process is kept the way
-//           one reached through a door is
-//   kept    keep what has been written, now, and say whether it was. the
-//           ward asks it once at the end of an arrival, after the being has
-//           answered and before the answer is sealed, the last moment
-//           anything can still be said about it. false is a store that
-//           refused, and the ward says so with the word a failed ask already
-//           has: `threw` to an asker the door holds, silence to the ask
-//           pointer. never a reason
-//   during  a call of this ward's has begun, and what comes back lowers it.
-//           the ward raises it before it reaches out and lowers it in a
-//           finally, so a call that threw lowers too, and lowering twice is
-//           lowering once. calls nest. a body may go on writing while it is
-//           raised; what it may not do is take a save made there as the
-//           point it puts a refused ward back to
-//
-// A body that keeps nothing has rows, is told and does nothing, answers yes,
-// and raises nothing: `volatile` below. The ward has one path either way.
-export type Memory = {
-  readonly rows: Record<string, unknown>;
-  told(row: string): void;
-  kept(): Promise<boolean>;
-  during(): () => void;
-};
-
-// The body that keeps nothing: the process is the memory.
-export const volatile = (rows: Record<string, unknown> = {}): Memory => ({ rows, told: () => {}, kept: () => Promise.resolve(true), during: () => () => {} });
-
-// The device is one standing. What a box can do is beings, in a ward its
-// harbor booted and roots, and one being there, the box's own, holds a
-// standing at each of them under the name it is lent as. The ground carries
-// one invitation on her, minted for this ward alone; the ward takes it at
-// boot under `BOX`, as its own first being, and from then on the device is
-// reached the way anything is reached: what it offers is her describe, and a
-// lend is the ask `OFFER` on that standing, naming what a being wants.
-//
-// She answers the lent being's own invitation, minted by that being on herself,
-// and the ward knocks and takes it in the being's name. No root mints for a
-// lend, and the invitation never reaches the being: it is the device's, a
-// value she could copy is one she could hand to anyone, so the ward holds
-// it and hands her the id. Which ward may have which name is the box's own
-// gate, reading who asks, and a stranger's ward holds no standing at her.
-//
-// A harbor with no box leaves it out, and every lend is null. A ward that
-// could not take it at boot, the box down or the invitation spent, boots all
-// the same, lends nothing this run, and tries again at the next.
-export { BOX } from '../being/lent.ts';
-export const OFFER = 'offer';
-// A lend that was offered and not taken leaves nothing: the ward says so to
-// the box, naming the heir, and the lent being removes what she minted.
-export const RETRACT = 'retract';
-
-export type Ground = {
-  seed: string | Uint8Array;
-  random(n: number): Uint8Array;
-  memory: Memory;
-  instantiate(className: string, stance: Stance): BeingLike | null;
-  // Sealed bytes to a ward pk. What comes back, or undefined.
-  //
-  // undefined is a promise, not a shrug: no door was reached, and nothing was
-  // delivered. The ward hands it to a being as unreached, which is the one
-  // answer that says asking again is safe, so a harbor may only return it
-  // when it knows the bytes never arrived: no reach for that pk, a socket
-  // that would not open, a link that is down. A harbor that sent the bytes
-  // and then gave up waiting knows no such thing and must not answer at all:
-  // the ward bounds every ask itself, and an answer that never comes inside
-  // that bound is `late`, which promises nothing either way.
-  carry(pk: string, bytes: Uint8Array): Promise<Uint8Array | undefined>;
-  box?: Invitation;
-};
-
-// What a ward hands back. Two pointers. The door answers bytes, always, and
-// one bit beside them: whether a key it holds spoke. That is all a harbor
-// learns from an arrival, and it is what a harbor can act on -- a pk that
-// only ever brings strangers' bytes is the harbor's to rate or refuse. Never
-// a reason: the reason is sealed to the asker's lid, and is theirs.
-export type WardPointers = {
-  door(bytes: Uint8Array): Promise<{ bytes: Uint8Array; heard: boolean }>;
-  ask(method?: string, args?: Record<string, unknown>): Promise<unknown>;
-};
-
-// ---- what every harbor builds a ground out of. Convenience, never contract:
-// a second kit writes its own harbor and may write these again.
-
-// The code half of a ground, and the map back to what it made. A class is
-// found by own key only, since `constructor` is a name Object lends every
-// registry, and the first registry holding the name wins, so a ward's own
-// classes stand in front of the harbor's. The object is remembered by the
-// cells the ward handed in, which is how a side reaches a being it made and
-// how that hand follows her out when she is unbooted.
-export const maker =
-  (objects: WeakMap<object, BeingLike>, ...registries: (Record<string, BeingClass> | undefined)[]): Ground['instantiate'] =>
-  (className: string, stance: Stance) => {
-    const r = registries.find((reg) => reg !== undefined && Object.hasOwn(reg, className));
-    const C = r?.[className];
-    if (!C) return null;
-    const obj = new C(stance);
-    objects.set(stance.cells, obj);
-    return obj;
-  };
-
-// Entropy, from the one place every terrain that runs Quo has it.
-export const entropy = (n: number): Uint8Array => globalThis.crypto.getRandomValues(new Uint8Array(n));
-
-// A ward's pk, learned the way anyone learns anything: by asking. The empty
-// ask on the ask pointer is the ward's own describe and its notes carry the
-// pk. A harbor has no other way to it and wants none: the ward mints it from
-// the seed, and a harbor that read it off the seed itself would be a second
-// derivation to keep in step with the first.
-export async function learnPk(w: WardPointers): Promise<string> {
-  const notes = (await w.ask()) as { notes?: { pk?: unknown } } | null;
-  const pk = notes?.notes?.pk;
-  if (typeof pk !== 'string') throw new Error('the ward did not say its pk');
-  return pk;
-}