nervur 0.19.2 → 0.20.0

package/dist/ward/stance.js

@@ -1,413 +1,180 @@
 // SPDX-License-Identifier: Apache-2.0
-// The one stance builder. Used for every being the ward boots. Nothing
-// outer is in what she holds: ids in, values out, keys in the bind table.
-import { silence, isSilence, isWord, unreached, word, wordOf } from '../being/silence.js';
-import { digest } from '../being/digest.js';
-import { RESERVED_IDS, isBlueprint } from '../being/types.js';
-import { at, put, drop, prune } from './partition.js';
-import { allow, within, LATE } from './allowance.js';
-import { isHex, isWardPk } from './seal.js';
-import { cellFault, unkeepable } from './cells.js';
-// The three calls on `standings` share the object with the ids she takes, so
-// a standing named after one of them would be unreachable: `standings.knock`
-// is the call, whatever record sits under that name. One namespace means one
-// list: these are refused at invite and at take, beside the ward's own words.
-const CALLS = ['knock', 'take', 'remove'];
-export function buildStance(inside, key, cells, bind) {
-    // A word the ward refuses at every mint and every take. The two the
-    // protocol names, and the ones this kit adds because its own spelling took
-    // them: the calls a standing already answers to, and a name no partition
-    // can hold. That last one is refused here rather than by the cells guard,
-    // because the guard throws and this table promises a null.
-    // A method is a word or it is nothing at all. The seal writes a payload as
-    // JSON, which drops a key whose value it cannot write, so a symbol or a
-    // function here would leave as an ask with no method: the empty ask. She
-    // would have asked for work, been handed a blueprint, and spent a number on
-    // it. Nothing that cannot be sent is sent, and what never left is unreached,
-    // which is the one answer that says asking again is safe. This is the same
-    // rule args are already held to.
-    const named = (method) => method === undefined || typeof method === 'string';
-    const reserved = (id) => RESERVED_IDS.includes(id) || CALLS.includes(id) || unkeepable(id);
-    // The name of one relation, as her side files it. A relation is a ward and
-    // a heir, never a heir alone: the heir pk is outer, it rides in the clear on
-    // every lid, and anyone who reads one can quote it back inside an invitation
-    // naming a ward of their own. Filed under the heir alone, that invitation
-    // would share her knock record with the relation the heir really belongs to:
-    // it would sign with that relation's key, and an answer to it would set the
-    // answered flag the other relation is taken on. Both halves, always.
-    const nameOf = (inv) => (inv.heir === undefined ? `public:${inv.ward}` : `${inv.ward}:${inv.heir}`);
-    const valid = (inv) => {
-        const i = inv;
-        if (!i || typeof i !== 'object' || !isWardPk(i.ward))
-            return false;
-        if (i.heir === undefined)
-            return i.secret === undefined;
-        return isHex(i.heir) && isHex(i.secret);
-    };
-    // One relation, one ask at a time. The rotation is a conversation: a send
-    // reads the key that speaks now, announces the next, and moves to it once
-    // the far door has answered. Two sends interleaving on one relation read
-    // each other's half-written keys and the two sides diverge, which no later
-    // ask can repair. So each relation has a lane, and a send waits for the one
-    // before it. Beings may still ask concurrently: the lanes are per relation,
-    // and a slow relation never holds up another.
-    const lanes = new Map();
-    const lane = (name, run) => {
-        const mine = (lanes.get(name) ?? Promise.resolve()).then(run, run);
-        const quiet = mine.then(() => { }, () => { });
-        lanes.set(name, quiet);
-        void quiet.then(() => {
-            if (lanes.get(name) === quiet)
-                lanes.delete(name); // the lane is idle. nothing to remember.
+// One being's stance: her cells, the ids she invited, the relations she
+// holds, and boot. Every relation she holds speaks through `quo/`'s
+// standing, one send at a time, inside her allowance.
+import { readValue, writeValue } from '../crypto/index.js';
+import { readInvitation, Standing as Wire, freshStanding } from '../quo/index.js';
+import { OWNER, silence, word } from '../being/index.js';
+import { allow, Bell, LATE } from './allowance.js';
+import { Cells, DEPTH } from './cells.js';
+export { DEPTH };
+const RESERVED = new Set([OWNER]);
+// How many times a take asks again after its knock brought no object.
+const TAKES = 2;
+// One relation, one send at a time.
+class Lanes {
+    #tails = new Map();
+    run(name, work) {
+        const mine = (this.#tails.get(name) ?? Promise.resolve()).then(work, work);
+        const tail = mine.catch(() => { });
+        this.#tails.set(name, tail);
+        void tail.then(() => {
+            if (this.#tails.get(name) === tail)
+                this.#tails.delete(name);
         });
         return mine;
-    };
-    // Every ask a being makes, bounded. The bound is outside the lane on
-    // purpose: an ask that waits its turn behind a relation that comes back
-    // round never reaches a send, and a bound that only watched the wire would
-    // never see it hang. A bound that ran out is the word late, never
-    // unreached: unreached promises nothing was delivered and is safe to ask
-    // again, and a wait that gave up knows no such thing.
-    //
-    // The bell rings before the work is reached, too: an ask that was still
-    // waiting its turn when the wait ran out is never sent. Sent then, it would
-    // be a fresh ask nobody is waiting on, the far being would do the work, and
-    // what came back would be read into her cells behind a silence she was
-    // already handed. So the work is given the bell, and reads it at the lane.
-    const bounded = async (wanted, work) => {
-        let late = false;
-        const out = await within(allow(wanted).time, work(() => !late), () => {
-            late = true;
-        });
-        return out === LATE ? word('late') : out;
-    };
-    const read = (r) => {
-        if (isSilence(r) || isWord(r))
-            return { answer: r, door: false, seen: null };
-        if ('silence' in r)
-            return { answer: silence, door: true, seen: null };
-        if ('quo' in r)
-            return { answer: word(r.quo), door: true, seen: null }; // the far door's word for her, sealed to her lid
-        return { answer: r.object, door: true, seen: r.seen };
-    };
-    // Whether the door spent the heir this send spoke under. An object, the
-    // door's silence and threw all mean it was honoured. A refusal word wrote
-    // nothing and says so. Anything that is not the door speaking says nothing.
-    const honoured = (r) => r.door && !(isWord(r.answer) && wordOf(r.answer) !== 'threw');
-    const answered = (r) => r.door && !isSilence(r.answer) && !isWord(r.answer);
-    // The ask is bounded twice with one budget, once around the lane and once
-    // around the wire, and the two bells are microseconds apart. A reply that
-    // lands between them is a reply she was already told was late: its keys are
-    // rotated, since the far door rotated too and nothing may un-rotate that,
-    // but nothing of it is written into her cells. What she was handed is the
-    // last word on what she saw.
-    const send = async (keys, method, args, wanted, rec, live = () => true) => {
-        const r = read(await inside.send(bind, keys, method, args, wanted));
-        if (rec && method !== undefined && r.seen !== null && live())
-            rec.seen = r.seen; // the digest rode along
-        return r.answer;
-    };
-    const knocking = async (inv, method, args, wanted, live = () => true) => {
-        const name = nameOf(inv);
-        // Taken while this knock waited its turn: the relation lives in the
-        // standing now and speaks on its lane, under its keys and its count.
-        const taken = takenAs(name);
-        if (taken !== undefined) {
-            const keys = at(bind.standings, taken);
-            if (!keys)
-                return word('dropped');
-            return lane(`ask:${taken}`, () => asking(taken, keys, at(cells.standings, taken), method, args, wanted, live));
-        }
-        // her own key for this relation, minted once: rotation two. reused if she knocks again.
-        const k = (bind.knocks[name] ??= { current: (await inside.mintKey(bind)).seed, next: null, spoke: false, sent: false, seq: 0 });
-        prune(bind.knocks, bind.answered); // this one is the newest, so it stays and the oldest never answered goes
-        // The first knock on a heir speaks as the heir, the key the inviter
-        // handed out, and announces her own. Once the door has honoured it the
-        // heir is spent, whatever she then said, and her own key speaks; a heir
-        // spent once stays spent.
-        //
-        // She sent once as the heir and the door did not speak: nothing came
-        // back, or bytes that were not Quo's, or the wait ran out. Either the
-        // door heard, spent the heir and rotated to the key she announced, or
-        // nothing arrived and the heir still stands. Only the far door knows,
-        // and it will not say.
-        //
-        // So she asks, and the asking tells her. Under her own key: if the door
-        // heard, that key is the one it admits, and she is answered, or told the
-        // door's word. If it did not, the key means nothing there, the ask is
-        // refused, and a refusal at that door writes nothing: the heir is
-        // untouched and still speaks. Then she knocks as the heir, as she would
-        // have. One extra round trip in the one case where a reply was lost, and
-        // the relation is not stranded.
-        //
-        // No stranger gains anything by it: whoever holds the invitation could
-        // always knock as the heir, and her own key is admitted only where the
-        // door already bound it to her.
-        if (inv.heir !== undefined && !k.spoke && k.sent) {
-            const own = { ward: inv.ward, heir: inv.heir, current: k.current, next: k.next, seq: k.seq };
-            const r = read(await inside.send(bind, own, method, args, wanted));
-            k.seq = own.seq;
-            k.current = own.current;
-            k.next = own.next;
-            inside.wrote();
-            if (!r.door) {
-                // Nothing the door said. Unreached and late are hers to hear now; bytes
-                // that were not Quo's leave her where she was, and the heir is tried.
-                if (!isSilence(r.answer))
-                    return r.answer;
-            }
-            else if (!isSilence(r.answer)) {
-                // The door spoke to her own key, so it heard the first knock: this is
-                // the answer, or the door's word for her. Its silence alone cannot be
-                // told from a refusal, so silence is followed by the knock as the heir,
-                // which the door then refuses if it had heard, and she hears silence.
-                k.spoke = true;
-                if (answered(r))
-                    bind.answered[name] = true;
-                return r.answer;
-            }
+    }
+}
+const answerOf = (read) => {
+    if ('nothing' in read)
+        return word('unreached');
+    if ('silence' in read)
+        return silence;
+    if ('quo' in read)
+        return word(read.quo);
+    return readValue(read.object, DEPTH) ?? silence;
+};
+export class WardStance {
+    key;
+    occupants;
+    standings;
+    #inside;
+    #row;
+    #lanes = new Lanes();
+    #cells = new Cells(() => this.#told());
+    constructor(inside, key, row) {
+        this.key = key;
+        this.#inside = inside;
+        this.#row = row;
+        this.occupants = {
+            invite: (id, notes) => this.#invite(id, notes),
+            notes: (id) => (Object.hasOwn(row.occupants, id) ? row.occupants[id].notes : undefined),
+            ids: () => Object.keys(row.occupants),
+            remove: (id) => this.#removeOccupant(id),
+        };
+        this.standings = {
+            take: (id, invitation) => this.#take(id, invitation),
+            get: (id) => this.#standing(id),
+            ids: () => Object.keys(row.standings),
+            remove: (id) => this.#removeStanding(id),
+        };
+    }
+    get cells() {
+        return this.#cells.guard(this.#row.cells);
+    }
+    get #live() {
+        return this.#inside.live(this.key, this.#row);
+    }
+    boot(className, key, id) {
+        return this.#live ? this.#inside.boot(this.key, className, key, id) : Promise.resolve(null);
+    }
+    async lend(contract, id) {
+        if (!this.#free(id, this.#row.standings))
+            return null;
+        const invitation = await this.#inside.offer(contract.name);
+        if (invitation === null)
+            return null;
+        const taken = await this.#take(id, invitation);
+        if (taken === null)
+            await this.#inside.retract(contract.name, invitation.heir);
+        return taken;
+    }
+    #free(id, of) {
+        return this.#live && typeof id === 'string' && !RESERVED.has(id) && !Object.hasOwn(of, id);
+    }
+    async #invite(id, notes = {}) {
+        const kept = writeValue(notes, DEPTH);
+        if (!this.#free(id, this.#row.occupants) || kept === undefined)
+            return null;
+        const { heir, invitation } = await this.#inside.door.invite();
+        if (!this.#free(id, this.#row.occupants)) {
+            this.#inside.door.remove(heir);
+            return null;
         }
-        const first = inv.heir !== undefined && !k.spoke;
-        const keys = first ? { ward: inv.ward, heir: inv.heir, current: inv.secret, next: k.current, seq: k.seq } : { ward: inv.ward, heir: inv.heir ?? null, current: k.current, next: k.next, seq: k.seq };
-        const r = read(await inside.send(bind, keys, method, args, wanted));
-        k.sent = true; // bytes went out. whether they arrived is the far door's to know.
-        // The number she spoke under, and the key she announced, kept whoever
-        // answered and kept when nobody did. A reply lost on the way back is a
-        // door that has already honoured the number: she must not offer it twice,
-        // or a road that drops one reply silences the relation for good.
-        k.seq = keys.seq;
-        if (!first) {
-            k.current = keys.current;
-            k.next = keys.next;
+        this.#row.occupants[id] = { heir, notes: JSON.parse(kept) };
+        this.#inside.partition.head.bind[heir] = { being: this.key, id };
+        this.#told();
+        this.#inside.partition.toldHead();
+        return invitation;
+    }
+    #removeOccupant(id) {
+        if (!this.#live || !Object.hasOwn(this.#row.occupants, id))
+            return false;
+        const { heir } = this.#row.occupants[id];
+        this.#inside.door.remove(heir);
+        delete this.#row.occupants[id];
+        delete this.#inside.partition.head.bind[heir];
+        this.#told();
+        this.#inside.partition.toldHead();
+        return true;
+    }
+    async #take(id, value) {
+        const invitation = readInvitation(value);
+        if (!invitation || !this.#free(id, this.#row.standings))
+            return null;
+        const wire = new Wire(invitation, freshStanding(), this.#inside.draw);
+        const read = await this.#lanes.run(`take:${id}`, async () => {
+            // A knock that brought nothing back may have bound: the standing asks
+            // under its own key, then knocks again as the same bytes.
+            let out = await this.#send(wire);
+            for (let tries = 0; tries < TAKES && ('nothing' in out || 'silence' in out); tries += 1)
+                out = await this.#send(wire);
+            return out;
+        });
+        if (!('object' in read) || !this.#free(id, this.#row.standings))
+            return null;
+        this.#row.standings[id] = { invitation, state: wire.state, seen: read.seen };
+        this.#told();
+        return id;
+    }
+    #removeStanding(id) {
+        if (!this.#live || !Object.hasOwn(this.#row.standings, id))
+            return false;
+        delete this.#row.standings[id];
+        this.#told();
+        return true;
+    }
+    #standing(id) {
+        if (!Object.hasOwn(this.#row.standings, id))
+            return undefined;
+        return { id, ask: (method, args, wanted) => this.#ask(id, method, args, wanted) };
+    }
+    async #ask(id, method, args = {}, wanted) {
+        const text = writeValue(args, DEPTH + 1);
+        if ((method !== undefined && typeof method !== 'string') || text === undefined || Array.isArray(args))
+            return word('unreached');
+        const bell = new Bell(this.#inside.clock, allow(wanted));
+        try {
+            const out = await bell.race(this.#lanes.run(`ask:${id}`, async () => {
+                const row = Object.hasOwn(this.#row.standings, id) ? this.#row.standings[id] : undefined;
+                if (!this.#live || row === undefined)
+                    return word('dropped');
+                if (bell.rang)
+                    return word('late');
+                const wire = new Wire(row.invitation, row.state, this.#inside.draw);
+                const read = await bell.race(this.#send(wire, method, text));
+                row.state = wire.state;
+                if (read === LATE)
+                    return word('late');
+                if ('object' in read)
+                    row.seen = read.seen;
+                this.#told();
+                await this.#inside.partition.kept();
+                return answerOf(read);
+            }));
+            return out === LATE ? word('late') : out;
         }
-        if (honoured(r))
-            k.spoke = true;
-        if (answered(r))
-            bind.answered[name] = true;
-        inside.wrote();
-        return r.answer;
-    };
-    // The id she took this relation under, if she took it. One relation is one
-    // ward and one heir whichever door it is reached by, so the standing and the
-    // invitation answer to the same name.
-    const keyName = (k) => (k.heir === null ? `public:${k.ward}` : `${k.ward}:${k.heir}`);
-    const takenAs = (name) => Object.keys(bind.standings).find((id) => keyName(bind.standings[id]) === name);
-    // A being the ward has taken out reaches nothing through the stance she
-    // still holds. Her relations went with her, so every one of them reads as
-    // dropped, and nothing she asks for is made: a heir written here would name
-    // a being no door holds, and an id minted here would be handed to whoever
-    // is booted under her key next.
-    const gone = () => !inside.live();
-    const calls = {
-        knock: async (inv, method, args = {}, wanted) => {
-            if (gone())
-                return word('dropped');
-            if (!named(method))
-                return unreached();
-            if (!valid(inv))
-                return word('invitation'); // S1. nothing is sent
-            // She may knock again, and after take that knock is an ask: the relation
-            // has one home, so it answers on the standing's lane, under the
-            // standing's keys and its count. A second lane here would speak for the
-            // same relation, and the two would refuse each other.
-            const id = takenAs(nameOf(inv));
-            if (id !== undefined)
-                return standingAt(id).ask(method, args, wanted);
-            return bounded(wanted, (live) => lane(`knock:${nameOf(inv)}`, () => (live() ? knocking(inv, method, args, wanted, live) : Promise.resolve(word('late')))));
-        },
-        // Take consumes. Until now the relation lived in the knock record, under
-        // the ward and the heir; from now it lives in the standing, under her id.
-        // It never lives in both: two records seeded from one relation are two
-        // lanes speaking for one line of keys and one count, and whichever spoke
-        // last holds it while the other is refused. She would read that refusal as
-        // the far being falling quiet, which is a thing a sovereign being may do,
-        // so the loss would look exactly like an answer she is owed nothing of.
-        // One relation, one home, and the invitation is spent: knocking it again
-        // is another consumed it, and taking it again births nothing.
-        //
-        // So it is spoken on the relation's lane, like every other word spoken
-        // for it. A take reads the count and the keys a knock writes, and copies
-        // them into the standing. Off the lane it reads them between a knock's
-        // send and its answer: the standing is born holding a number the far door
-        // is about to honour and a key it is about to rotate past, and her first
-        // ask on it is refused. The relation she took correctly would be dead
-        // because a second knock on the same invitation was careless.
-        take: async (id, inv) => {
-            if (gone() || !valid(inv))
-                return null;
-            const name = nameOf(inv);
-            return lane(`knock:${name}`, () => {
-                if (!bind.answered[name])
-                    return Promise.resolve(null);
-                // Standings and occupants are one namespace — invite and take each
-                // refuse a name the other holds — so a word reserved in one is
-                // reserved in both.
-                if (reserved(id) || at(cells.standings, id) || at(cells.occupants, id))
-                    return Promise.resolve(null);
-                const k = bind.knocks[name];
-                put(bind.standings, id, { ward: inv.ward, heir: inv.heir ?? null, current: k.current, next: k.next, seq: k.seq }); // the count carries over: the standing goes on where the knock left off
-                put(cells.standings, id, { id, digest: null, blueprint: null, seen: null });
-                delete bind.knocks[name];
-                delete bind.answered[name];
-                inside.wrote();
-                return Promise.resolve(id);
-            });
-        },
-        remove: (id) => {
-            if (gone())
-                return;
-            drop(cells.standings, id);
-            drop(bind.standings, id);
-            inside.wrote();
-        },
-    };
-    const standingAt = (id) => ({
-        id,
-        // The keys are read now, not when the lane reaches this ask: an ask
-        // issued while the standing stood is answered even if she drops it in
-        // the next line. Waiting for the lane is not a reason to lose it.
-        ask: (method, args = {}, wanted) => {
-            if (gone())
-                return Promise.resolve(word('dropped'));
-            if (!named(method))
-                return Promise.resolve(unreached());
-            const keys = at(bind.standings, id);
-            if (!keys)
-                return Promise.resolve(word('dropped')); // S2. she dropped it between one line and the next
-            const rec = at(cells.standings, id);
-            return bounded(wanted, (live) => lane(`ask:${id}`, () => (live() ? asking(id, keys, rec, method, args, wanted, live) : Promise.resolve(word('late')))));
-        },
-    });
-    // The record an ask writes into is the one it was issued on. A standing
-    // dropped and re-taken under the same id while the ask was in flight is
-    // another relation, and the blueprint that came back is not hers.
-    const asking = async (id, keys, rec, method, args, wanted, live = () => true) => {
-        const out = await send(keys, method, args, wanted, rec, live);
-        if (method === undefined && !isSilence(out) && !isWord(out)) {
-            // A blueprint her cells cannot keep, nested past the bound or carrying
-            // a key no harbor writes, is not Quo's bytes: silence, and nothing written.
-            if (cellFault(out, 'blueprint') !== null)
-                return silence;
-            if (rec && live() && at(cells.standings, id) === rec) {
-                // Read as a blueprint before it is kept as one. A far describe is
-                // somebody else's code and may answer anything; what is not a
-                // blueprint is not written as one, and she holds no blueprint for
-                // that relation rather than one a side would walk and break on. The
-                // answer itself is hers either way: it is returned below, unread.
-                rec.blueprint = isBlueprint(out) ? out : null;
-                rec.digest = rec.seen = await digest(out);
-            }
+        finally {
+            bell.cancel();
         }
-        return out;
-    };
-    const standings = new Proxy(calls, {
-        // Own keys only: `in` would also find every name on Object's prototype,
-        // and a standing she took as `constructor` or `toString` would answer with
-        // Object's, not hers.
-        get: (t, id) => (typeof id === 'string' && Object.hasOwn(t, id) ? t[id] : typeof id === 'string' && at(cells.standings, id) ? standingAt(id) : undefined),
-    });
-    return {
-        cells,
-        // A being may make. The ward refuses what it refuses the owner: a key
-        // already booted, a class the harbor does not hold, and a throw at birth
-        // leaves the partition as it was. Reaching into another is still the
-        // owner's alone: what a maker may have is a relation to what she made,
-        // by naming an id, and it is made the way every relation is. The being
-        // made mints an occupant for her maker under the maker's own key, so she
-        // knows who made her by that name and by nothing else; her maker knocks,
-        // takes it under the id she gave, and holds one standing like any other.
-        // Nothing half-lives: a relation that could not be made unmakes the
-        // being, who is a moment old and known to nobody.
-        boot: async (className, made, id) => {
-            if (gone())
-                return null;
-            if (id !== undefined && (reserved(id) || at(cells.standings, id) || at(cells.occupants, id)))
-                return null;
-            const born = inside.instantiate(className, made);
-            if (born === null || id === undefined)
-                return born;
-            const inv = await inside.relate(born, key);
-            if (inv) {
-                const out = await calls.knock(inv);
-                if (!isSilence(out) && !isWord(out) && (await calls.take(id, inv)) === id)
-                    return born;
-            }
-            inside.unmake(born);
-            return null;
-        },
-        occupants: {
-            // rotation one: the ward mints the occupant's first key and gives the secret away.
-            // it keeps the pk beside the id and nothing else. the invitation IS the key.
-            invite: async (id, notes) => {
-                if (gone() || reserved(id) || at(cells.occupants, id) || at(cells.standings, id))
-                    return null;
-                // Notes are values, like everything else the partition keeps, and a
-                // spread copies one level: an object inside them would stay the
-                // caller's, a handle into her cells that writes past the guard and
-                // never says `wrote`, so what a restart brought back would not be
-                // what she read. Held to the rule and copied whole, or no invitation.
-                if (notes !== undefined && cellFault(notes, 'notes') !== null)
-                    return null;
-                // The key first, and nothing written until it exists: a record put
-                // before the mint would be a record a remove in the meantime drops
-                // with no heir to close, and the heir opened after it would name an
-                // id nobody holds, for a later invite under that id to resurrect.
-                const k = await inside.mintKey(bind);
-                if (reserved(id) || at(cells.occupants, id) || at(cells.standings, id))
-                    return null; // taken while the key was minted
-                // The notes are the terms the inviter minted under, hers to read on her
-                // gate. She may write more later; nobody outside ever writes them.
-                put(cells.occupants, id, { id, notes: notes ? JSON.parse(JSON.stringify(notes)) : {} });
-                inside.openHeir(k.pk, key, id);
-                put(bind.occupants, id, k.pk);
-                inside.wrote();
-                return { ward: inside.pk, heir: k.pk, secret: k.seed };
-            },
-            remove: (id) => {
-                if (gone())
-                    return;
-                drop(cells.occupants, id);
-                const heir = at(bind.occupants, id);
-                drop(bind.occupants, id);
-                if (heir)
-                    inside.closeHeir(heir); // the heir dies with the id
-                inside.wrote();
-            },
-        },
-        standings,
-        // A standing at one of the things this device can do. The same three
-        // moves her boot makes, with the harbor's root doing the inviting instead
-        // of a being of this ward: ask the ground for the name, knock with what
-        // comes back, take it under the id she gave. She is handed the id.
-        //
-        // The invitation never reaches her, and that is the difference between
-        // this relation and every other she holds. Her own invitations are hers
-        // to give away, because giving one away is giving away her own relation.
-        // This one is the device's, minted for this ward alone, and a value she
-        // could copy is a capability she could hand to anyone. A being who wants
-        // to lend her device access to another does it in the open, by an ask of
-        // her own that forwards to this standing, where her gate reads who is
-        // asking and she can stop.
-        lend: async (name, id) => {
-            if (gone() || typeof name !== 'string' || typeof id !== 'string')
-                return null;
-            if (reserved(id) || at(cells.standings, id) || at(cells.occupants, id))
-                return null;
-            // Her half runs inside the harbor's call, so a knock that was refused
-            // and a take that lost the id both end with the harbor removing what it
-            // minted. Nothing half-lives here either.
-            const took = await inside.lend(name, async (inv) => {
-                // Read again: the ground was awaited, and a line of hers in between
-                // may have taken the id. Nothing is written for a relation she cannot
-                // hold, and the invitation goes back unspent.
-                if (gone() || reserved(id) || at(cells.standings, id) || at(cells.occupants, id))
-                    return false;
-                const out = await calls.knock(inv);
-                if (isSilence(out) || isWord(out))
-                    return false;
-                return (await calls.take(id, inv)) === id;
-            });
-            return took ? id : null;
-        },
-    };
+    }
+    async #send(wire, method, args) {
+        const sent = await wire.ask(method, args);
+        if (!sent)
+            return { nothing: true };
+        return wire.read(sent, await this.#inside.send(wire.invitation.ward, sent.bytes));
+    }
+    #told() {
+        this.#inside.partition.told(this.key);
+    }
 }

package/dist/ward/ward-being.d.ts

@@ -0,0 +1,33 @@
+import { Being, type Answer, type Asker, type AskSpec, type BeingClass, type Blueprint, type Invitation, type JsonObject, type Stance } from '../being/index.ts';
+export interface Steward {
+    pk(): string;
+    classOf(name: string): BeingClass | undefined;
+    beings(): Record<string, {
+        class: string;
+        public: boolean;
+        absent: boolean;
+    }>;
+    boot(key: string, className: string): Promise<'booted' | 'key taken' | 'no such class' | 'threw at birth'>;
+    unboot(key: string): boolean;
+    publish(key: string | null): boolean;
+    invite(being: string, id: string, notes: JsonObject): Promise<Invitation | null>;
+    ask(being: string | null, method: string | undefined, args: JsonObject): Promise<Answer>;
+}
+export type WardBeingStance = Stance & {
+    readonly steward: Steward;
+};
+export declare const pilots: (asker: Asker, notes: JsonObject | undefined) => boolean;
+export declare const ownerAsk: (description: string, input?: JsonObject) => AskSpec;
+export declare class WardBeing extends Being {
+    static asks: Record<string, AskSpec>;
+    readonly steward: Steward;
+    constructor(stance: WardBeingStance);
+    describe(asker: Asker): Blueprint;
+    own(args: JsonObject): Promise<JsonObject>;
+    disown(args: JsonObject): JsonObject;
+    boot(args: JsonObject): Promise<JsonObject>;
+    unboot(args: JsonObject): JsonObject;
+    public(args: JsonObject): JsonObject;
+    invite(args: JsonObject): Promise<JsonObject>;
+    ask(args: JsonObject): Promise<JsonObject>;
+}