nervur 0.19.2 → 0.20.0

package/dist/quo/seal.d.ts

@@ -0,0 +1,42 @@
+import { Ephemeral, type Draw, type SigningKey } from './keys.ts';
+export declare const SIZE = 1048576;
+export declare const HEAD = 32;
+export declare const SIGNATURE = 64;
+export declare const SEALED_HEAD: number;
+export declare const ZERO_EDGE: Uint8Array<ArrayBuffer>;
+export declare const ZERO_HEAD: Uint8Array<ArrayBuffer>;
+export declare const knockEdge: (shared: Uint8Array) => Promise<Uint8Array>;
+export declare const follow: (edge: Uint8Array, agreement: Uint8Array) => Promise<Uint8Array>;
+export declare const signBody: (text: Uint8Array, key: SigningKey) => Promise<Uint8Array>;
+export declare const splitBody: (body: Uint8Array) => {
+    text: Uint8Array;
+    signature: Uint8Array;
+} | null;
+export declare const checkBody: (pk: Uint8Array, body: {
+    text: Uint8Array;
+    signature: Uint8Array;
+}) => Promise<boolean>;
+export declare const sealAsk: (lid: Ephemeral, padlock: Uint8Array, head: Uint8Array, edge: Uint8Array, body: Uint8Array, ciphertext?: Uint8Array) => Promise<Uint8Array | null>;
+export type OpenedHead = {
+    lid: Uint8Array;
+    agreement: Uint8Array;
+    head: Uint8Array;
+    rest: Uint8Array;
+};
+export declare const openHead: (bytes: Uint8Array, agreement: Uint8Array) => Promise<OpenedHead | null>;
+export declare const splitKnock: (rest: Uint8Array) => {
+    ciphertext: Uint8Array;
+    sealedBody: Uint8Array;
+} | null;
+export declare const openBody: (opened: OpenedHead, edge: Uint8Array, sealedBody: Uint8Array) => Promise<Uint8Array | null>;
+export type SealedReply = {
+    bytes: Uint8Array;
+    agreement: Uint8Array;
+};
+export type ReplyKey = {
+    ephemeral: Ephemeral;
+    agreement: Uint8Array;
+};
+export declare const replyKey: (draw: Draw, lid: Uint8Array) => Promise<ReplyKey | null>;
+export declare const sealReply: (key: ReplyKey, body: Uint8Array) => Promise<Uint8Array>;
+export declare const openReply: (bytes: Uint8Array, lid: Ephemeral) => Promise<SealedReply | null>;

package/dist/quo/seal.js

@@ -0,0 +1,78 @@
+// SPDX-License-Identifier: Apache-2.0
+// The three boxes and the keys between them.
+//
+//   ask box    lid (32) || AES( head ) || AES( body )
+//   knock box  lid (32) || AES( head ) || ML-KEM ciphertext (1088) || AES( body )
+//   reply box  ephemeral pk (32) || AES( body )
+//   body       JSON text || signature (64)
+//
+// The head of an ask and the body of a reply are sealed under `quo-seal`
+// over the agreement. The body of an ask is sealed under `quo-edge-seal`
+// over the agreement and then the edge key. Every ciphertext's additional
+// data is its own box's ephemeral pk.
+import { CIPHERTEXT, concat, decrypt, encrypt, hkdf, sign, TAG, verify } from '../crypto/index.js';
+import { Ephemeral, LABEL } from './keys.js';
+export const SIZE = 1_048_576;
+export const HEAD = 32;
+export const SIGNATURE = 64;
+export const SEALED_HEAD = HEAD + TAG;
+export const ZERO_EDGE = new Uint8Array(32);
+export const ZERO_HEAD = new Uint8Array(HEAD);
+const cipher = async (label, ...material) => {
+    const out = await hkdf(concat(...material), label, 44);
+    return { key: out.subarray(0, 32), nonce: out.subarray(32) };
+};
+const seal = async (label, material, lid, plaintext) => {
+    const { key, nonce } = await cipher(label, ...material);
+    return encrypt(key, nonce, lid, plaintext);
+};
+const open = async (label, material, lid, ciphertext) => {
+    const { key, nonce } = await cipher(label, ...material);
+    return decrypt(key, nonce, lid, ciphertext);
+};
+// A knock's edge key, from the shared secret the lock decapsulates.
+export const knockEdge = (shared) => hkdf(shared, LABEL.lock, 32);
+// The edge key that follows `edge` after a reply of this agreement.
+export const follow = (edge, agreement) => hkdf(concat(edge, agreement), LABEL.edge, 32);
+export const signBody = async (text, key) => concat(text, await sign(key.secret, text));
+// The text and signature of a body, or null for a body of sixty-four bytes
+// or fewer.
+export const splitBody = (body) => body.length <= SIGNATURE ? null : { text: body.subarray(0, -SIGNATURE), signature: body.subarray(-SIGNATURE) };
+export const checkBody = (pk, body) => verify(pk, body.text, body.signature);
+// An ask box sealed under `lid` to a padlock, or null for a padlock that
+// takes no seal. `ciphertext` makes it a knock box.
+export const sealAsk = async (lid, padlock, head, edge, body, ciphertext) => {
+    const agreement = await lid.agree(padlock);
+    if (agreement === null)
+        return null;
+    const sealedHead = await seal(LABEL.seal, [agreement], lid.pk, head);
+    const sealedBody = await seal(LABEL.edgeSeal, [agreement, edge], lid.pk, body);
+    return concat(lid.pk, sealedHead, ciphertext ?? new Uint8Array(0), sealedBody);
+};
+export const openHead = async (bytes, agreement) => {
+    if (bytes.length < HEAD + SEALED_HEAD)
+        return null;
+    const lid = bytes.subarray(0, HEAD);
+    const head = await open(LABEL.seal, [agreement], lid, bytes.subarray(HEAD, HEAD + SEALED_HEAD));
+    return head === null ? null : { lid, agreement, head, rest: bytes.subarray(HEAD + SEALED_HEAD) };
+};
+// A knock's rest split into its ciphertext and sealed body.
+export const splitKnock = (rest) => rest.length < CIPHERTEXT ? null : { ciphertext: rest.subarray(0, CIPHERTEXT), sealedBody: rest.subarray(CIPHERTEXT) };
+export const openBody = (opened, edge, sealedBody) => open(LABEL.edgeSeal, [opened.agreement, edge], opened.lid, sealedBody);
+export const replyKey = async (draw, lid) => {
+    const ephemeral = await Ephemeral.draw(draw);
+    const agreement = await ephemeral.agree(lid);
+    return agreement === null ? null : { ephemeral, agreement };
+};
+export const sealReply = async (key, body) => concat(key.ephemeral.pk, await seal(LABEL.seal, [key.agreement], key.ephemeral.pk, body));
+// A reply's body and agreement, opened with the lid's secret, or null.
+export const openReply = async (bytes, lid) => {
+    if (bytes.length > SIZE || bytes.length < HEAD + TAG)
+        return null;
+    const pk = bytes.subarray(0, HEAD);
+    const agreement = await lid.agree(pk);
+    if (agreement === null)
+        return null;
+    const body = await open(LABEL.seal, [agreement], pk, bytes.subarray(HEAD));
+    return body === null ? null : { bytes: body, agreement };
+};

package/dist/quo/standing.d.ts

@@ -0,0 +1,39 @@
+import type { Invitation } from './invitation.ts';
+import { Ephemeral, type Draw } from './keys.ts';
+import { type Reply } from './reply.ts';
+export type Read = Reply | {
+    readonly nothing: true;
+};
+type Knock = {
+    readonly bytes: string;
+    readonly lid: string;
+    readonly next: string;
+    readonly edge: string;
+    readonly seq: number;
+};
+export type StandingState = {
+    readonly key: string | null;
+    readonly edge: string | null;
+    readonly sent: number;
+    readonly moved: number;
+    readonly knock: Knock | null;
+    readonly probed: boolean;
+};
+export declare const freshStanding: () => StandingState;
+export type Sent = {
+    readonly bytes: Uint8Array;
+    readonly lid: Ephemeral;
+    readonly next: string;
+    readonly edge: string;
+    readonly seq: number;
+};
+export declare class Standing {
+    #private;
+    readonly invitation: Invitation;
+    state: StandingState;
+    readonly draw: Draw;
+    constructor(invitation: Invitation, state: StandingState, draw: Draw);
+    ask(method?: string, args?: string): Promise<Sent | null>;
+    read(sent: Sent, bytes: Uint8Array | null): Promise<Read>;
+}
+export {};

package/dist/quo/standing.js

@@ -0,0 +1,90 @@
+// SPDX-License-Identifier: Apache-2.0
+// The standing's side of a relation: it seals asks and reads replies, and
+// moves to its announced key and the following edge key when an object
+// comes back to an ask above every ask it has moved on, and on nothing else.
+//
+// Its state is a value, so a ward keeps it in its partition.
+import { encapsulate, hex, unhex } from '../crypto/index.js';
+import { Ephemeral, SigningKey, wardHalves } from './keys.js';
+import { writePayload } from './payload.js';
+import { readReply } from './reply.js';
+import { checkBody, follow, knockEdge, openReply, sealAsk, signBody, splitBody } from './seal.js';
+export const freshStanding = () => ({ key: null, edge: null, sent: 0, moved: 0, knock: null, probed: false });
+export class Standing {
+    invitation;
+    state;
+    draw;
+    constructor(invitation, state, draw) {
+        this.invitation = invitation;
+        this.state = state;
+        this.draw = draw;
+    }
+    async ask(method, args) {
+        const s = this.state;
+        if (s.key !== null)
+            return this.#ask(unhex(s.key), unhex(s.edge), method, args);
+        if (s.knock === null)
+            return this.#knock(method, args);
+        if (!s.probed) {
+            this.state = { ...s, probed: true };
+            return this.#ask(unhex(s.knock.next), unhex(s.knock.edge), method, args);
+        }
+        this.state = { ...s, probed: false };
+        // The same bytes again: a new lid would be a new box.
+        return { bytes: unhex(s.knock.bytes), lid: await Ephemeral.from(unhex(s.knock.lid)), next: s.knock.next, edge: s.knock.edge, seq: s.knock.seq };
+    }
+    async read(sent, bytes) {
+        if (bytes === null)
+            return { nothing: true };
+        const reply = await this.#open(sent, bytes);
+        if (reply === null)
+            return { silence: true };
+        if ('object' in reply.text && sent.seq > this.state.moved) {
+            const edge = await follow(unhex(sent.edge), reply.agreement);
+            this.state = { ...this.state, key: sent.next, edge: hex(edge), moved: sent.seq, knock: null, probed: false };
+        }
+        return reply.text;
+    }
+    async #knock(method, args) {
+        const heir = await SigningKey.from(unhex(this.invitation.secret));
+        const next = await SigningKey.draw(this.draw);
+        const lid = await Ephemeral.draw(this.draw);
+        const sent = encapsulate(unhex(this.invitation.lock), this.draw(32));
+        if (sent === null)
+            return null;
+        const edge = await knockEdge(sent.shared);
+        const seq = this.state.sent + 1;
+        const body = await this.#body(heir, next, seq, method, args);
+        const bytes = await sealAsk(lid, unhex(wardHalves(this.invitation.ward).padlock), unhex(this.invitation.heir), edge, body, sent.ciphertext);
+        if (bytes === null)
+            return null;
+        this.state = { ...this.state, sent: seq, knock: { bytes: hex(bytes), lid: hex(lid.secret), next: hex(next.secret), edge: hex(edge), seq } };
+        return { bytes, lid, next: hex(next.secret), edge: hex(edge), seq };
+    }
+    async #ask(secret, edge, method, args) {
+        const by = await SigningKey.from(secret);
+        const next = await SigningKey.draw(this.draw);
+        const lid = await Ephemeral.draw(this.draw);
+        const seq = this.state.sent + 1;
+        const body = await this.#body(by, next, seq, method, args);
+        const bytes = await sealAsk(lid, unhex(wardHalves(this.invitation.ward).padlock), unhex(this.invitation.heir), edge, body);
+        if (bytes === null)
+            return null;
+        this.state = { ...this.state, sent: seq };
+        return { bytes, lid, next: hex(next.secret), edge: hex(edge), seq };
+    }
+    #body(by, next, seq, method, args) {
+        const text = writePayload({ to: this.invitation.heir, by: by.id, next: next.id, seq, ...(method === undefined ? {} : { method }), ...(args === undefined ? {} : { args }) });
+        return signBody(new TextEncoder().encode(text), by);
+    }
+    async #open(sent, bytes) {
+        const opened = await openReply(bytes, sent.lid);
+        const body = opened && splitBody(opened.bytes);
+        if (!opened || !body)
+            return null;
+        if (!(await checkBody(unhex(wardHalves(this.invitation.ward).signing), body)))
+            return null;
+        const text = readReply(body.text);
+        return text && { text, agreement: opened.agreement };
+    }
+}

package/dist/ward/allowance.d.ts

@@ -1,10 +1,14 @@
-import type { Wanted } from '../being/types.ts';
-export type Allowance = {
-    time: number;
-};
-export declare const DEFAULT: Allowance;
-export declare const CEILING: Allowance;
-export declare function allow(wanted: Wanted | undefined, ceiling?: Allowance, base?: Allowance): Allowance;
-export declare const spent: (a: Allowance) => boolean;
+import type { Clock } from '../contract/index.ts';
+import type { Wanted } from '../being/index.ts';
+export declare const DEFAULT = 30000;
+export declare const CEILING = 300000;
+export declare const allow: (wanted: Wanted | undefined) => number;
 export declare const LATE: unique symbol;
-export declare function within<T>(ms: number, work: Promise<T>, rang?: () => void): Promise<T | typeof LATE>;
+export type Late = typeof LATE;
+export declare class Bell {
+    #private;
+    constructor(clock: Clock, ms: number);
+    get rang(): boolean;
+    race<T>(work: Promise<T>): Promise<T | Late>;
+    cancel(): void;
+}

package/dist/ward/allowance.js

@@ -1,71 +1,32 @@
-// SPDX-License-Identifier: Apache-2.0
-// The allowance. Every ask carries, in its signed body, the time it may still
-// spend, in milliseconds. A being who says nothing gets her ward's default and
-// never thinks about it; one who wants to say so passes a third argument, and
-// is held to the ward's ceiling. The door reads it before anything is done
-// under it and refuses a budget already gone, as one silence like every other
-// refusal there. The sender bounds the whole of her ask to the same number,
-// and a wait that ran out is the word late, never silence and never unreached.
-//
-// Each ask is bounded on its own. The time an arriving call has left does not
-// bound the asks a being makes while answering it: attributing her onward ask
-// to the arrival that caused it needs a context the ward cannot get without
-// naming a runtime, and the ward names none. Every wait still ends.
-// How wide the default is, and how wide she may ask for, are the ward's own —
-// wider is more patient, and no peer can tell the difference except by being
-// refused. A being who never learns the third parameter exists writes correct
-// code forever under these. They are two numbers because the third argument
-// goes both ways: less for the ask she wants back quickly, more for the one
-// she knows is slow.
-export const DEFAULT = { time: 30_000 };
-export const CEILING = { time: 300_000 };
-// What she asked for, held to what her ward allows. A being cannot mint budget
-// nobody granted her: asking for a minute where the ward gives thirty seconds
-// is thirty seconds, silently, because the ceiling is not hers to know.
-// Asking for nothing at all is the default, which is the whole point.
-export function allow(wanted, ceiling = CEILING, base = DEFAULT) {
-    // Floored first, then tested: a fraction of a millisecond is not a budget,
-    // and falls to the default like every other number that is not a positive
-    // whole one.
-    const whole = (n, fallback) => {
-        const w = typeof n === 'number' ? Math.floor(n) : NaN;
-        return Number.isFinite(w) && w > 0 ? w : fallback;
-    };
-    return { time: Math.min(whole(wanted?.time, base.time), ceiling.time) };
-}
-// Whether a budget has anything left to spend, and the one reader of it: the
-// door calls this on arrival and nothing else asks the question anywhere. A
-// time that is not a whole number above zero is not a budget that ran out, it
-// is no budget at all, and the door refuses both the same way, since a peer
-// learns nothing from the difference. `allow` never makes one, so only bytes
-// off the road ever carry one.
-export const spent = (a) => !(Number.isSafeInteger(a.time) && a.time > 0);
-// What a wait that ran out comes back as. Its own value, held by nobody
-// outside the ward, so no answer from any door can be mistaken for it.
+export const DEFAULT = 30_000;
+export const CEILING = 300_000;
+export const allow = (wanted) => {
+    const whole = typeof wanted?.time === 'number' ? Math.floor(wanted.time) : NaN;
+    return Math.min(Number.isFinite(whole) && whole > 0 ? whole : DEFAULT, CEILING);
+};
 export const LATE = Symbol('late');
-// A wait with an end. This is the one thing the ward times, and it covers the
-// whole of an ask, not only the wire: a relation that comes back round is
-// stopped at its own lane, before a single byte is sealed, and a bound that
-// only watched the wire would never see it. A timer is the only way to stop
-// waiting and every language that runs Quo has one; no runtime is named here.
-//
-// `rang` is called the moment the bell rings, before anyone waiting on the
-// wait is told: whoever holds work that has not started yet reads it and does
-// not start it. What comes back late is not read, and what has not left yet
-// does not leave.
-export async function within(ms, work, rang) {
-    let timer;
-    const bell = new Promise((ring) => {
-        timer = setTimeout(() => {
-            rang?.();
-            ring(LATE);
-        }, ms);
-    });
-    try {
-        return await Promise.race([work, bell]);
+// One ask's bell. It bounds the wait of the being who asked and the send
+// that holds the relation's line, so a far side that never answers holds
+// neither for longer than the allowance.
+export class Bell {
+    #wait;
+    #late;
+    #rang = false;
+    constructor(clock, ms) {
+        this.#wait = clock.wait(ms);
+        this.#late = this.#wait.done.then(() => {
+            this.#rang = true;
+            return LATE;
+        });
+    }
+    get rang() {
+        return this.#rang;
+    }
+    race(work) {
+        work.catch(() => { });
+        return Promise.race([work, this.#late]);
     }
-    finally {
-        clearTimeout(timer);
-        void work.then(() => { }, () => { }); // whatever it was, it is nobody's answer now
+    cancel() {
+        this.#wait.cancel();
     }
 }

package/dist/ward/cells.d.ts

@@ -1,7 +1,7 @@
-import type { Cells } from '../being/types.ts';
+import type { JsonObject } from '../being/index.ts';
 export declare const DEPTH = 64;
-export declare const BREADTH: number;
-export declare const cellFault: (v: unknown, path: string) => string | null;
-export declare const unkeepable: (k: string) => boolean;
-export declare const guardCells: (cells: Cells, wrote?: () => void) => Cells;
-export declare const unguarded: (cells: Cells) => Cells;
+export declare class Cells {
+    #private;
+    constructor(wrote: () => void);
+    guard(cells: JsonObject): JsonObject;
+}

package/dist/ward/cells.js

@@ -1,186 +1,74 @@
-// How deep a value may nest. Every walk over a value in the kit recurses,
-// and a peer chooses the depth of what she answers; a bound keeps a hostile
-// reply from ending a walk in a stack overflow instead of a refusal.
-export const DEPTH = 64;
-// How many values one written out may come to. Depth alone does not bound
-// what a value costs to keep: one subvalue may sit under two keys, and
-// nesting that forty levels deep is inside the depth bound and is a trillion
-// values once written down. What is walked here is the object graph, which is
-// small; what a harbor keeps is the tree it expands to, which is not. So the
-// walk counts the tree while it proves the graph, and refuses a value nobody
-// could write down. This is a bound on what a being holds, so it is this
-// kit's number and no word of the spec.
-export const BREADTH = 1 << 20;
-// Text a harbor can write down: every surrogate in a pair. A lone one is a
-// code unit with no character, which JSON escapes and UTF-8 cannot encode at
-// all, so a harbor that keeps strings as bytes loses it and one that keeps
-// the object does not. I-JSON says a string is text, and this is that rule
-// where the value is written rather than where it is read.
-const WELL_FORMED = /^(?:[^\uD800-\uDFFF]|[\uD800-\uDBFF][\uDC00-\uDFFF])*$/;
-// I-JSON, all the way down. A number that JSON cannot write is not a number
-// a harbor can keep, a key on the prototype is not a key she wrote, and a
-// hole in a list, or a key named `__proto__`, is a thing JSON writes one way
-// and a runtime reads another.
+// SPDX-License-Identifier: Apache-2.0
+// A being's cells, guarded. Her cells are kept by whatever memory her
+// terrain gives, and a memory that writes JSON would hand back something
+// other than what she wrote if she wrote anything JSON cannot hold. So a
+// write that is not a value throws where she wrote it, in her own frame,
+// and her answer becomes silence like any throw.
 //
-// A fault is a sentence; anything else is the count of values under this one,
-// itself included. A value already counted is a value already proven, so a
-// graph that shares is walked once per node rather than once per path.
-function walk(v, path, seen, sized, depth) {
-    if (v === null || typeof v === 'boolean')
-        return 1;
-    if (typeof v === 'string')
-        return WELL_FORMED.test(v) ? 1 : `${path} carries a lone surrogate, which is no text a harbor can write down`;
-    if (typeof v === 'number') {
-        if (!Number.isFinite(v))
-            return `${path} is ${String(v)}, which no harbor can write down`;
-        // Minus zero is a number JSON writes as `0` and reads back as `0`. A
-        // harbor that keeps values would hand her the sign she wrote and one that
-        // writes JSON would not, and she is never told which she is standing in.
-        return Object.is(v, -0) ? `${path} is minus zero, which comes back as zero from every harbor that writes JSON` : 1;
-    }
-    if (typeof v !== 'object')
-        return `${path} is a ${typeof v}, which is not a value`;
-    if (seen.has(v))
-        return `${path} refers back to itself`;
-    const counted = sized.get(v);
-    if (counted !== undefined)
-        return counted;
-    if (depth >= DEPTH)
-        return `${path} is nested past ${DEPTH} levels, which no harbor can keep`;
-    seen.add(v);
-    try {
-        let size = 1;
-        const under = (where, x) => {
-            const r = walk(x, where, seen, sized, depth + 1);
-            if (typeof r === 'string')
-                return r;
-            size += r;
-            return size > BREADTH ? `${path} writes out to more than ${BREADTH} values, which no harbor can keep` : null;
-        };
-        if (Array.isArray(v)) {
-            for (let i = 0; i < v.length; i += 1) {
-                if (!(i in v))
-                    return `${path}[${i}] is a hole, which no harbor can write down`;
-                const f = under(`${path}[${i}]`, v[i]);
-                if (f)
-                    return f;
-            }
-            sized.set(v, size);
-            return size;
-        }
-        const proto = Object.getPrototypeOf(v);
-        if (proto !== Object.prototype && proto !== null)
-            return `${path} is a ${(v).constructor?.name ?? 'object'}, which is not a value`;
-        for (const k of Object.keys(v)) {
-            if (k === '__proto__')
-                return `${path}.__proto__ is a key no harbor can keep`;
-            const f = under(`${path}.${k}`, v[k]);
-            if (f)
-                return f;
-        }
-        sized.set(v, size);
-        return size;
-    }
-    finally {
-        seen.delete(v);
-    }
-}
-export const cellFault = (v, path) => {
-    const out = walk(v, path, new Set(), new Map(), 0);
-    return typeof out === 'string' ? out : null;
-};
-// The three keys at the root of her cells that are the ward's: it writes
-// them, she reads them, and a write of hers there is refused like a non-value.
-const WARDS = new Set(['standings', 'occupants', 'class']);
-// The guard is one proxy at the root and one for every container read through
-// it, so a write nested three deep is refused the same way a write at the top
-// is. Wrappers are remembered, so reading the same array twice is the same
-// object twice and a being may still compare what she holds.
-const wrapped = new WeakMap();
-const targets = new WeakMap();
-const guards = new WeakSet();
-// A name no partition can hold, wherever it appears. It is here beside the
-// guard that refuses it, because the ward refuses it too: a relation named
-// this one would be written into the bind table and then throw on her cells,
-// which is half a relation and a throw where a null is promised. One rule,
-// one place, read by the guard and by the stance.
-export const unkeepable = (k) => k === '__proto__';
-// A key a write may land on: a string that is not `__proto__`, and not one
-// of the ward's at the root. A symbol key is a thing JSON never writes.
+// What passes is stored as a fresh copy of its JSON text, so a reference
+// she kept to what she wrote is not a way around the guard. Every key lands
+// as an own key, `__proto__` included. A list grows at its end: a slot or a
+// length past it would leave a hole.
+import { writeValue } from '../crypto/index.js';
+export const DEPTH = 64;
 const refuse = (why) => {
     throw new TypeError(`cells hold values: ${why}`);
 };
-function keyFault(t, k, v, path, root) {
-    if (typeof k !== 'string')
-        refuse(`${path} takes no symbol key`);
-    if (unkeepable(k))
-        refuse(`${path}.__proto__ is a key no harbor can keep`);
-    if (root && WARDS.has(k))
-        refuse(`${path}.${k} is the ward's to write`);
-    // A list grows by one at its end, or it has holes JSON cannot write. A
-    // push sets the slot at its length and then the length: both pass. A
-    // length set past what she wrote, or a slot beyond it, would leave holes.
-    if (Array.isArray(t)) {
-        if (k === 'length') {
-            if (typeof v !== 'number' || v > t.length)
-                refuse(`${path}.length set past what she wrote would leave holes`);
-            return;
-        }
-        const i = Number(k);
-        if (Number.isInteger(i) && i > t.length)
-            refuse(`${path}[${i}] would leave a hole`);
+const copy = (value, room, where) => {
+    const text = writeValue(value, room);
+    return text === undefined ? refuse(`${where} is not a value JSON keeps, within ${room} levels`) : JSON.parse(text);
+};
+export class Cells {
+    #guards = new WeakMap();
+    #wrote;
+    constructor(wrote) {
+        this.#wrote = wrote;
     }
-}
-function guard(target, path, wrote, root = false) {
-    if (guards.has(target))
-        return target;
-    const had = wrapped.get(target);
-    if (had)
-        return had;
-    const p = new Proxy(target, {
-        get(t, k, r) {
-            const v = Reflect.get(t, k, r);
-            // A container reached through her cells is part of her cells.
-            return v !== null && typeof v === 'object' && !ArrayBuffer.isView(v) ? guard(v, `${path}.${String(k)}`, wrote) : v;
-        },
-        set(t, k, v, r) {
-            keyFault(t, k, v, path, root);
-            const f = cellFault(v, `${path}.${String(k)}`);
-            if (f)
-                refuse(f);
-            const ok = Reflect.set(t, k, v, r);
-            wrote();
-            return ok;
-        },
-        defineProperty(t, k, d) {
-            if (!('value' in d))
-                refuse(`${path}.${String(k)} is an accessor, which no harbor can keep`);
-            keyFault(t, k, d.value, path, root);
-            const f = cellFault(d.value, `${path}.${String(k)}`);
-            if (f)
-                refuse(f);
-            const ok = Reflect.defineProperty(t, k, d);
-            wrote();
-            return ok;
-        },
-        deleteProperty(t, k) {
-            if (root && typeof k === 'string' && WARDS.has(k))
-                refuse(`${path}.${k} is the ward's to keep`);
-            const ok = Reflect.deleteProperty(t, k);
-            wrote();
+    // The guarded view of a being's cells.
+    guard(cells) {
+        return this.#guard(cells, 'cells', 1);
+    }
+    #guard(target, path, level) {
+        const had = this.#guards.get(target);
+        if (had)
+            return had;
+        const room = DEPTH - level;
+        const place = (t, k, value) => {
+            if (typeof k !== 'string')
+                return refuse(`${path} takes no symbol key`);
+            const where = `${path}.${k}`;
+            if (Array.isArray(t)) {
+                if (k === 'length') {
+                    if (typeof value !== 'number' || value > t.length)
+                        refuse(`${where} past its end would leave a hole`);
+                    t.length = value;
+                    this.#wrote();
+                    return true;
+                }
+                if (!/^(0|[1-9]\d*)$/.test(k))
+                    refuse(`${where} is not a slot of a list`);
+                if (Number(k) > t.length)
+                    refuse(`${where} would leave a hole`);
+            }
+            const ok = Reflect.defineProperty(t, k, { value: copy(value, room, where), enumerable: true, writable: true, configurable: true });
+            this.#wrote();
             return ok;
-        },
-    });
-    wrapped.set(target, p);
-    targets.set(p, target);
-    guards.add(p);
-    return p;
+        };
+        const proxy = new Proxy(target, {
+            get: (t, k, r) => {
+                const v = Reflect.get(t, k, r);
+                return typeof k === 'string' && Object.hasOwn(t, k) && typeof v === 'object' && v !== null ? this.#guard(v, `${path}.${k}`, level + 1) : v;
+            },
+            set: (t, k, v) => place(t, k, v),
+            defineProperty: (t, k, d) => ('value' in d ? place(t, k, d.value) : refuse(`${path}.${String(k)} is an accessor`)),
+            deleteProperty: (t, k) => {
+                const ok = Reflect.deleteProperty(t, k);
+                this.#wrote();
+                return ok;
+            },
+            setPrototypeOf: () => refuse(`${path} keeps its prototype`),
+        });
+        this.#guards.set(target, proxy);
+        return proxy;
+    }
 }
-// Her cells, guarded. Called once per being at boot; the guarded object is
-// what goes into the partition and what the stance hands her, so there is no
-// second door onto the same cells. Every write that passes says so to the
-// ward, which says so to its harbor.
-export const guardCells = (cells, wrote = () => { }) => guard(cells, 'cells', wrote, true);
-// The cells behind the guard, for the ward alone: the one writer of the
-// three keys that are its own.
-export const unguarded = (cells) => (targets.get(cells) ?? cells);