nervur 0.19.2 → 0.20.1

package/README.md

@@ -1,119 +1,171 @@
-# Nervur
+# nervur
 
-Nervur is the first open source kit of Quo, the library itself: harbor, ward
-and being, with no dependencies.
+Nervur's kit of [Quo](https://quo.systems). Quo is a protocol: an object
+asks another object and gets an answer, without knowing where it is. This
+package is one implementation of it, and the two names never stand for
+the same thing. Where they disagree, Quo's spec wins.
 
-Quo is a protocol that lets an object ask another object and get an answer,
-without knowing whether that other object is in the same process, on the same
-device, or on another planet. Quo is the protocol and this is one
-implementation of it; the two names never stand for the same thing.
+You write classes, beings and faculties, and nothing else. A harbor
+unpacks a whole world from them.
 
-It is three words, two of which are beings, and two edges.
-Nothing else is Quo.
+## Install
 
-- **Harbor.** The program a device runs to boot wards. Owns the wire and the
-  operating system. Not a being.
-- **Ward.** One process of its harbor. A being plus ward functions. Keeps
-  beings and judges its door.
-- **Being.** One ordinary object, one voice.
-
-The truth is the spec, at <https://quo.systems/spec>, with the vectors it
-is proved by at <https://quo.systems/vectors>. It is the protocol alone:
-what any ward in any language must do for its bytes to be Quo. It is
-self-contained and assumes nothing from any other document, this README
-included. Read it first, at the source, which is Quo's and not this
-package's to carry.
-
-What this one kit chose, and another kit may refuse, is documented at
-<https://nervur.org/docs>. It assumes the spec, and where the two disagree
-the spec wins.
-
-## This package
-
-A TypeScript implementation, written against Node's own type stripping, with
-no dependencies. The package ships JavaScript with declarations beside the
-source it was emitted from, because Node strips types nowhere under
-`node_modules`.
-
-```
-src/being/        the Being side: what a being author imports, if anything
-src/ward/         the ward: the Ground contract, door, seal, arithmetic, heirs, stance, allowance
-src/harbor/       MemoryHarbor, the box's being, and the harbor core with its store, reach and dialer
-src/conformance/  behaviours any ward must show, written against the truth
-src/vector/       vector mode, and the world the door's cases are taken in
+```sh
+npm install nervur
 ```
 
-The suites live beside the source in the tree this is developed in and are
-not in the package: what proves the kit is not what a consumer installs.
-What does ship of them is `src/conformance/`, which is the part written for
-somebody else's ward rather than for this one.
-
-## Requirements
+Node 22.18 or later. The main entry imports no platform, so it runs in a
+browser, Deno, Bun and workerd as well. `nervur/folder` keeps a harbor on
+a disk and needs Node's file system.
 
-Node 22.18 or later, and nothing else. The package has no dependencies, and
-it ships JavaScript with declarations, so nothing is compiled on the way in.
+## A world in one process
 
-## Where it is proven
-
-The same conformance suite this package exports runs against several worlds:
-one ward, one harbor with a ward per being, two harbors, and the harbor core
-over a memory store. A world declares what it can express and a chapter it
-cannot reach is skipped by name rather than failed, which is how a kit in
-another language reports the same suite honestly.
-
-It is run again out of a bundle in a real Chromium, in workerd, in Deno and
-in Bun, because a ward's truth must hold wherever a ward runs.
+```js
+import { Being, Faculty, World } from 'nervur';
+
+// A contract, and a faculty that fulfils it. Every class names its kind.
+class Clock extends Faculty {
+  static kind = 'org.example.clock';
+}
+class SystemTime extends Clock {
+  static kind = 'org.example.system-time';
+  static asks = { now: {} };
+  now() {
+    return { now: Date.now() };
+  }
+}
+
+// A being, who lends a clock by its contract.
+class Greeter extends Being {
+  static kind = 'org.example.greeter';
+  static asks = { hello: {} };
+  async hello(args, asker) {
+    if (!this.stance.standings.get('clock')) await this.stance.lend(Clock, 'clock');
+    const time = await this.stance.standings.get('clock')?.ask('now');
+    return { hello: asker.id ?? 'stranger', time };
+  }
+}
+
+// The module these classes are: its name, its version, its classes.
+const greetings = { module: 'org.example.greetings', version: '1.0.0', classes: [SystemTime, Greeter] };
+
+// A harbor whose terrain can load that module, and whose catalogue runs it.
+const world = new World();
+const harbor = await world.harbor('home', [greetings]);
+await harbor.root('ask', { being: 'catalogue', method: 'add', args: { from: 'org.example.greetings' } });
+await harbor.root('open', { key: 'clock', class: 'org.example.system-time' });
+await harbor.root('host', { ward: 'alice' });
+await harbor.ward('alice').root('boot', { key: 'greeter', class: 'org.example.greeter' });
+```
 
-## Entry points
+A second harbor in the same world takes an invitation on the greeter and
+asks it through the world, sealed as Quo's bytes. `world.restart('home')`
+opens the harbor again from what its memory kept.
+
+## Kinds
+
+A row keeps the kind of the class a being is born of, and a being lends
+by a contract's kind. A kind is declared on the class, because a bundler
+renames classes. It is a domain you own, reversed, then a name, as Apple
+and Matrix name things: `com.acme.shop`. Every segment is lowercase
+letters, digits and `-`, and there are three at least. Each class
+declares its own: a subclass that stands, and every contract between a
+faculty and `Faculty`. `org.nervur.` is the kit's, and `org.example.` is
+for examples like the one above. A module's classes stand under its own
+domain: `com.acme.shop` stands `com.acme.*` kinds. A harbor refuses a
+module in which one kind names two classes or two contracts, or names a
+class and a contract.
+
+## Modules
+
+Your classes come in modules: `{ module, version, classes }`, a module
+named as a kind is. A harbor's catalogue is a faculty of its own, and her
+cells name the modules the harbor runs. `add { from }` runs the module
+the terrain's loader finds there, and `remove { module }` stops one no
+being stands on. A restart loads every module she names and refuses to
+stand when one is missing. A module found at a new version wakes, and
+`modules` shows the version kept and the version running.
+
+## The onion
+
+A harbor is one package. Only the seed and the terrain's bodies, its
+loader among them, stand outside it.
+
+1. The terrain gives the harbor's seed, which opens its memory. The
+   terrain keeps that memory as sealed bytes and reads none of it.
+2. The box ward unpacks under the seed, its ward-being the dock.
+3. The catalogue wakes, and loads every module she names.
+4. The other faculties are born from their rows.
+5. The routes the dock keeps are handed to the carrier.
+6. Every ward the dock hosts unpacks, under the seed the dock keeps for it.
+7. In every ward, the ward-being first, then each being from her row.
+
+Cells decide what stands. The modules only resolve a kind a row keeps.
+Opening a harbor on empty memory is its genesis: the dock stands the
+catalogue, and the root's asks write the rest: `add` on the catalogue,
+`open`, `host`, `route`, and `boot` on a ward. `host { ward, seed? }`
+stands a ward under a seed you name, or a drawn one.
+
+## What it holds
+
+- **Being, Faculty.** What you extend. A faculty's contract is its class
+  and every class between it and `Faculty`.
+- **Entropy, Clock, Custody, Memory, Carrier, Loader.** The contracts a
+  terrain fulfils. Each has one suite, and every body that fulfils it
+  passes it.
+- **Harbor, Terrain, Dock, Catalogue, Registry, WardBeing.** The onion.
+- **World, PointerTerrain** and the pointer bodies, `HeldLoader` among
+  them. A whole world with this package alone.
+- **FolderMemory, FolderCustody**, from `nervur/folder`.
+- **TcpCarrier, TcpListener**, from `nervur/tcp`: Quo over TCP. Route a
+  ward pk to `host:port` on the carrier, hand the listener your harbor,
+  and harbors in two processes, or a harbor and another kit, speak.
+
+Other carriers, storage beyond a folder, key custody, and every screen
+are `@nervur-org/dock`'s, as classes fulfilling these contracts.
+
+## The command
+
+`nervur` stands a harbor on this machine: its seed and sealed memory in a
+folder, Quo over TCP as its carrier. A module is a file that exports
+`module`, `version` and `classes`.
+
+```sh
+nervur init  --dir ./harbor
+nervur module add ./greetings.js --dir ./harbor
+nervur serve --dir ./harbor --port 7000
+nervur host alice --dir ./harbor
+nervur boot --ward alice greeter org.example.greeter --dir ./harbor
+nervur route <ward pk> host:port --dir ./harbor
+nervur ask --ward alice greeter hello --dir ./harbor
+```
 
-```js
-import { Being, silence, digest } from 'nervur';
-import { Ward } from 'nervur/ward';
-import { MemoryHarbor, Harbor, request, dial } from 'nervur/harbor';
-import { conform } from 'nervur/conformance';
-import { Stand } from 'nervur/vector';
+`init` makes the harbor and prints its pk and an owner invitation. `serve`
+listens for Quo on TCP and for the root's asks on a local socket, open to
+you alone. Every other command is one root ask, sent to the served
+harbor, or answered from the folder when none is served. Each prints one
+JSON line. `--dir` defaults to `$NERVUR_DIR`, then `~/.nervur`. The
+catalogue keeps a module by its file's absolute path, and routes live in
+the harbor like everything else, so a restart finds both. `nervur
+modules` shows what runs, and `nervur module remove <module>` stops one.
+
+A harbor elsewhere is piloted with the owner invitation its `init`
+printed, from a harbor of your own:
+
+```sh
+nervur pilot far '<owner invitation>' host:port --dir ./mine
+nervur host shop --via far --dir ./mine
 ```
 
-## Another language
-
-The hand to a kit in another language is Quo's own and not this package's.
-The spec is the protocol and assumes nothing: a kit is written against it
-and against nothing else. The vectors beside it are the byte-level hand,
-everything a stranger can observe: `arithmetic.json`, the primitives the
-seal rests on, SHA-256, Ed25519, X25519, HKDF and AES-256-GCM;
-`framing.json`, Quo's own, the ward pk, the digest, the signed ask body,
-the sealed shapes, the invitation and the knock; `wire.json`, the frames on
-a socket and the one request a door takes; and `door.json`, the door's
-thirteen cases, each one an arrival a ward will not answer, with the bytes
-that arrive, the bytes that leave and the partition's digest on both sides
-of the judgement. All of it is at <https://quo.systems>, downloadable and
-versionless, and a kit reproduces the bytes or it is not this protocol.
-
-`door.json` is also replayed from outside, by a verifier holding no key,
-against a kit standing in vector mode, which the spec describes under that
-name. This kit stands in it with `Stand` from `nervur/vector`, which is
-vector mode and names no runtime: put it behind any listener that hands it
-a request body and returns what it answers.
-
-Nothing in this package is the protocol. `src/` is this kit's
-interpretation, and `src/conformance/` is a checklist a kit ports rather
-than a harness it runs: it imports the base class, the silence spelling and
-this kit's store and reach, so the beings it is shown with run only in a
-TypeScript ward.
-
-## Versions
-
-No compatibility promise before 1.0.0: the words may still move, and there
-is no migration to write because there is nothing yet to migrate from. This
-package carries the version of its own work and is bound to no other's, so a
-number equal to `@nervur-org/dock`'s or `@nervur-org/ui`'s is a coincidence.
-
-What ships is the emitted `dist/`, the source it came from, this file, the
-licence and the notice. No tests and no configs. The spec and the vectors
-are not in the tarball: they are Quo's and not this package's to carry, and
-they stand at <https://quo.systems>, which is where this file points.
+`pilot` boots an `org.nervur.pilot` being in your harbor that holds the
+invitation as an ordinary Quo relation, kept in your harbor's memory. With
+`--via far`, any command is asked of the far harbor as its owner, sealed
+over TCP, except `own` and `disown`, which stay the far root's.
+`nervur unboot far` lets it go.
+
+`rootLine(harbor, request)` is the same request in code, for any other
+front: `{ ward?, method?, args? }` in, one JSON answer out.
 
 ## License
 
-Apache-2.0. Copyright 2026 Razvan Gherghina. See [LICENSE](LICENSE) and
-[NOTICE](NOTICE); every source file carries an SPDX line.
+Apache-2.0.

package/dist/being/being.d.ts

@@ -1,24 +1,17 @@
-import type { Asker, Blueprint, Cells, Invitation, JsonObject, Wanted, OccupantRecord, Occupants, Reply, Schema, Stance, Standings, Answer } from './types.ts';
+import type { Asker, Blueprint, JsonObject, Reply, Schema, Stance } from './types.ts';
 export type AskSpec = {
-    description?: string;
-    input?: Schema;
-    output?: Schema;
-    for?: (occupant: OccupantRecord | undefined, asker: Asker) => boolean;
+    readonly description?: string;
+    readonly input?: Schema;
+    readonly for?: (asker: Asker, notes: JsonObject | undefined) => boolean;
 };
 export declare class Being {
+    static readonly kind: string;
     static cells: JsonObject;
     static asks: Record<string, AskSpec>;
     readonly stance: Stance;
     constructor(stance: Stance);
-    get cells(): Cells;
-    get standings(): Standings;
-    get occupants(): Occupants;
-    lend(name: string, id: string): Promise<string | null>;
-    invite(id: string, notes?: JsonObject): Promise<Invitation | null>;
-    knock(invitation: Invitation, method?: string, args?: JsonObject, wanted?: Wanted): Promise<Answer>;
-    take(id: string, invitation: Invitation): Promise<string | null>;
-    boot(className: string, key: string, id?: string): Promise<string | null>;
-    occupant(asker: Asker): OccupantRecord | undefined;
+    get cells(): JsonObject;
+    notes(asker: Asker): JsonObject | undefined;
     describe(asker: Asker): Blueprint;
-    answer(asker: Asker, method?: string, args?: JsonObject): Promise<Reply>;
+    answer(asker: Asker, method: string | undefined, args: JsonObject): Promise<Reply>;
 }

package/dist/being/being.js

@@ -1,10 +1,6 @@
-// Names a subclass may not use for an ask, because they are the base's own.
-const RESERVED = new Set(['answer', 'describe', 'stance', 'cells', 'standings', 'occupants', 'occupant', 'invite', 'knock', 'take', 'boot', 'lend', 'constructor']);
-// Whether she has a method of that name, written on her own prototype chain
-// below Object's. A name Object lends every object, `hasOwnProperty` or
-// `toString`, is not a method she wrote; and a field she assigns in her own
-// constructor is not there yet when the base checks, so an ask is a method
-// on the prototype and nothing else.
+// Names a subclass may not declare as an ask, because they are the base's.
+const RESERVED = new Set(['answer', 'describe', 'stance', 'cells', 'notes', 'constructor']);
+// Whether she wrote a method of that name, below Object's prototype.
 const wrote = (self, name) => {
     for (let p = Object.getPrototypeOf(self); p !== null && p !== Object.prototype; p = Object.getPrototypeOf(p)) {
         if (Object.hasOwn(p, name))
@@ -12,18 +8,15 @@ const wrote = (self, name) => {
     }
     return false;
 };
-// Both statics below are read off the class the object was made from, so a
-// subclass declaring either replaces its parent's rather than adding to it.
-// That is the rule: her blueprint is exactly what the class in front of you
-// declares, in the order she chose, and merging down a chain would hand her
-// asks she may mean to drop and an order she did not write. A subclass that
-// means to extend says so, `static override asks = { ...Parent.asks, mine: {} }`.
+// A subclass's statics replace its parent's and never merge: her blueprint
+// is what the class in front of you declares, in its order. Her kind is
+// never inherited: see `kind.ts`.
 export class Being {
-    // Her cells' defaults. Merged in at birth, only where a key is missing, so
-    // a restart keeps what she wrote.
+    // The name her row keeps for this class. Every class that stands declares
+    // its own.
+    static kind = 'org.nervur.being';
+    // Her cells' defaults, written at birth only where a key is missing.
     static cells = {};
-    // What she can be asked. Declaration order is blueprint order, except a
-    // name that reads as an array index, which the language lists first.
     static asks = {};
     stance;
     constructor(stance) {
@@ -33,10 +26,8 @@ export class Being {
             if (RESERVED.has(name))
                 throw new Error(`ask '${name}' is a reserved name`);
             if (!wrote(this, name))
-                throw new Error(`ask '${name}' has no method on the prototype`);
+                throw new Error(`ask '${name}' has no method`);
         }
-        // Own keys only: a default named after a member of Object's prototype is
-        // still hers, and still missing until she writes it.
         for (const [k, v] of Object.entries(C.cells))
             if (!Object.hasOwn(stance.cells, k))
                 stance.cells[k] = structuredClone(v);
@@ -44,66 +35,28 @@ export class Being {
     get cells() {
         return this.stance.cells;
     }
-    get standings() {
-        return this.stance.standings;
+    // The notes she invited this asker under.
+    notes(asker) {
+        return asker.id === undefined ? undefined : this.stance.occupants.notes(asker.id);
     }
-    get occupants() {
-        return this.stance.occupants;
-    }
-    // A standing at one of the things this device can do, under an id of hers.
-    // The ward knocks and takes it for her; the invitation never reaches her.
-    lend(name, id) {
-        return this.stance.lend(name, id);
-    }
-    invite(id, notes) {
-        return this.stance.occupants.invite(id, notes);
-    }
-    knock(invitation, method, args, wanted) {
-        return this.stance.standings.knock(invitation, method, args, wanted);
-    }
-    take(id, invitation) {
-        return this.stance.standings.take(id, invitation);
-    }
-    // A new being of her ward, by class name, under a key she chooses. With an
-    // id, she holds a standing to the being she made, who knows her by her key.
-    boot(className, key, id) {
-        return this.stance.boot(className, key, id);
-    }
-    // The occupant record for whoever is at the door. Undefined at a public being.
-    occupant(asker) {
-        return asker.id !== undefined && Object.hasOwn(this.cells.occupants, asker.id) ? this.cells.occupants[asker.id] : undefined;
-    }
-    // Her blueprint for this asker. Override to shape it by hand.
     describe(asker) {
         const C = this.constructor;
-        const rec = this.occupant(asker);
+        const notes = this.notes(asker);
         const asks = [];
         for (const [name, spec] of Object.entries(C.asks)) {
-            if (spec.for && !spec.for(rec, asker))
+            if (spec.for && !spec.for(asker, notes))
                 continue;
-            const ask = { name, input: spec.input ?? { type: 'object' } };
-            if (spec.description !== undefined)
-                ask.description = spec.description;
-            if (spec.output !== undefined)
-                ask.output = spec.output;
-            asks.push(ask);
+            asks.push({ name, ...(spec.description === undefined ? {} : { description: spec.description }), input: spec.input ?? { type: 'object' } });
         }
         return { asks, notes: {} };
     }
-    // The one function. Override to wrap it; call super to keep the dispatch.
-    async answer(asker, method, args = {}) {
+    async answer(asker, method, args) {
         if (method === undefined)
             return this.describe(asker);
         const C = this.constructor;
-        // Declared, by her, on purpose. `asks` is an ordinary object, so a bare
-        // lookup would also find every name on Object's prototype: `valueOf`
-        // would answer with her stance, `toString` with a string, and neither is
-        // an ask she wrote. Only her own keys are asks, which is what describe
-        // shows. What she shows is what she can be asked.
         const spec = Object.hasOwn(C.asks, method) ? C.asks[method] : undefined;
-        if (!spec || (spec.for && !spec.for(this.occupant(asker), asker)))
+        if (!spec || (spec.for && !spec.for(asker, this.notes(asker))))
             return { error: 'unknown ask' };
-        const fn = this[method];
-        return fn.call(this, args ?? {}, asker);
+        return this[method].call(this, args, asker);
     }
 }

package/dist/being/digest.d.ts

@@ -1,3 +1,3 @@
-import type { Json } from './types.ts';
+import { type Json } from '../crypto/index.ts';
 export declare const canonical: (v: Json) => string;
 export declare const digest: (blueprint: Json) => Promise<string>;

package/dist/being/digest.js

@@ -1,37 +1,17 @@
-// A value I-JSON has no room for: a key left empty, a function, a symbol.
-// None of them cross an edge, so none of them may reach a digest. A key
-// carrying one is dropped and a slot carrying one is null, which is what
-// crossing does to them, so the digest names what arrived and not what she
-// happened to be holding.
-const absent = (v) => v === undefined || typeof v === 'function' || typeof v === 'symbol';
-// JCS for I-JSON values: sorted keys, no whitespace, JSON escaping. Numbers
-// are serialized as ES does, which is what RFC 8785 specifies. A hole in a
-// list is null, as JSON writes it.
+// SPDX-License-Identifier: Apache-2.0
+// A being's `seen`: SHA-256, lowercase hex, over the canonical form of her
+// blueprint for one asker. Keys sorted by UTF-16 code units, numbers as
+// ECMAScript writes them, no whitespace.
+import { hex, sha256, utf8 } from '../crypto/index.js';
 export const canonical = (v) => {
     if (Array.isArray(v))
-        return `[${Array.from(v, (slot) => (absent(slot) ? 'null' : canonical(slot))).join(',')}]`;
+        return `[${v.map(canonical).join(',')}]`;
     if (v !== null && typeof v === 'object') {
         return `{${Object.keys(v)
-            .filter((k) => !absent(v[k]))
             .sort()
             .map((k) => `${JSON.stringify(k)}:${canonical(v[k])}`)
             .join(',')}}`;
     }
     return JSON.stringify(v);
 };
-// Hex and the guard are spelled here and again in `src/ward/arithmetic.ts`,
-// which is the price of the boundary: nothing under `src/being` imports
-// anything above it, because this is the whole world a being's own code sees
-// and a being reaching the ward is the thing the shape is against.
-const hex = (bytes) => Array.from(new Uint8Array(bytes), (b) => b.toString(16).padStart(2, '0')).join('');
-// `crypto.subtle` is read at the call and never captured at load. A browser
-// on a plain http:// origin has `crypto` without `subtle`, and a terrain may
-// install one after this module is first imported; either way the failure is
-// one sentence and not a TypeError from inside a digest nobody can read.
-const subtle = () => {
-    const s = globalThis.crypto?.subtle;
-    if (!s)
-        throw new Error('this terrain has no crypto.subtle: a being needs a secure context to be described');
-    return s;
-};
-export const digest = async (blueprint) => hex(await subtle().digest('SHA-256', new TextEncoder().encode(canonical(blueprint))));
+export const digest = async (blueprint) => hex(await sha256(utf8(canonical(blueprint))));

package/dist/being/faculty.d.ts

@@ -0,0 +1,10 @@
+import { Being } from './being.ts';
+import { type Asker, type Blueprint, type JsonObject, type Reply } from './types.ts';
+export declare class Faculty extends Being {
+    #private;
+    static readonly kind: string;
+    static contracts(C: abstract new (...args: never[]) => unknown): string[];
+    static fulfils(C: unknown): C is typeof Faculty;
+    describe(asker: Asker): Blueprint;
+    answer(asker: Asker, method: string | undefined, args: JsonObject): Promise<Reply>;
+}

package/dist/being/faculty.js

@@ -0,0 +1,74 @@
+// SPDX-License-Identifier: Apache-2.0
+// A faculty: a being of the box ward that fulfils a contract. A contract is
+// a class between `Faculty` and the class that stands, usually abstract:
+//
+//   abstract class Timer extends Faculty {           the contract
+//     static override kind = 'com.acme.timer' }
+//   class IntervalTimer extends Timer {              one class that fulfils it
+//     static override kind = 'com.acme.interval-timer' }
+//
+// A being lends by the contract's kind and never learns the class. Every
+// class between the faculty and `Faculty` is a contract and declares its
+// own kind, and a faculty fulfils each of them and her own. Two asks are the
+// faculty's own and answered to the ward-being that opened her alone:
+// `offer`, an invitation on herself for a ward the dock vouches for, and
+// `retract`, an offer that was not taken.
+import { Being } from './being.js';
+import { kindOf } from './kind.js';
+import { WARD } from './types.js';
+export class Faculty extends Being {
+    static kind = 'org.nervur.faculty';
+    // The contracts a class fulfils: itself and every class between it and
+    // `Faculty`, by kind. A class among them with no kind of its own throws.
+    static contracts(C) {
+        const kinds = [];
+        for (let c = C; typeof c === 'function' && c !== Faculty; c = Object.getPrototypeOf(c))
+            kinds.push(kindOf(c));
+        return kinds;
+    }
+    static fulfils(C) {
+        return typeof C === 'function' && C.prototype instanceof Faculty;
+    }
+    #open() {
+        if (this.cells.offers === undefined)
+            this.cells.offers = {};
+        return this.cells.offers;
+    }
+    async #offer() {
+        const n = (this.cells.offered ?? 0) + 1;
+        this.cells.offered = n;
+        const id = `lent:${n}`;
+        const invitation = await this.stance.occupants.invite(id);
+        if (invitation === null)
+            return { error: 'not invited' };
+        this.#open()[invitation.heir] = id;
+        return { invitation };
+    }
+    #retract(args) {
+        const open = this.#open();
+        const id = typeof args.heir === 'string' && Object.hasOwn(open, args.heir) ? open[args.heir] : undefined;
+        if (id === undefined)
+            return { retracted: null };
+        this.stance.occupants.remove(id);
+        delete open[args.heir];
+        return { retracted: id };
+    }
+    describe(asker) {
+        const blueprint = super.describe(asker);
+        if (asker.id !== WARD)
+            return blueprint;
+        return { ...blueprint, asks: [...blueprint.asks, { name: 'offer', input: { type: 'object' } }, { name: 'retract', input: { type: 'object', required: ['heir'] } }] };
+    }
+    // An offer is closed by the first word from the occupant it was made for.
+    answer(asker, method, args) {
+        if (asker.id === WARD && method === 'offer')
+            return this.#offer();
+        if (asker.id === WARD && method === 'retract')
+            return Promise.resolve(this.#retract(args));
+        const open = this.#open();
+        for (const [heir, id] of Object.entries(open))
+            if (id === asker.id)
+                delete open[heir];
+        return super.answer(asker, method, args);
+    }
+}

package/dist/being/index.d.ts

@@ -1,6 +1,6 @@
 export { Being, type AskSpec } from './being.ts';
-export { Lent, BOX, LENT_ASKS } from './lent.ts';
-export { silence, isSilence, answered, unreached, isUnreached, word, isWord, wordOf, told, DOOR_WORDS, isDoorWord } from './silence.ts';
-export { digest, canonical } from './digest.ts';
-export { OWNER, PUBLIC, RESERVED_IDS, isBlueprint, invitationArgs, isInvitation } from './types.ts';
-export type * from './types.ts';
+export { canonical, digest } from './digest.ts';
+export { Faculty } from './faculty.ts';
+export { isKind, KIT, kindOf, ownKind } from './kind.ts';
+export { OWNER, WARD, type Answer, type Ask, type Asker, type BeingClass, type BeingLike, type Blueprint, type Invitation, type Json, type JsonObject, type Occupants, type Reply, type Schema, type Stance, type Standing, type Standings, type Wanted } from './types.ts';
+export { isSilence, isWord, silence, told, word, type Silence, type Word, type WordName } from './words.ts';

package/dist/being/index.js

@@ -1,7 +1,8 @@
 // SPDX-License-Identifier: Apache-2.0
-// nervur — the Being side. What a being author imports, if anything.
+// What a being author imports.
 export { Being } from './being.js';
-export { Lent, BOX, LENT_ASKS } from './lent.js';
-export { silence, isSilence, answered, unreached, isUnreached, word, isWord, wordOf, told, DOOR_WORDS, isDoorWord } from './silence.js';
-export { digest, canonical } from './digest.js';
-export { OWNER, PUBLIC, RESERVED_IDS, isBlueprint, invitationArgs, isInvitation } from './types.js';
+export { canonical, digest } from './digest.js';
+export { Faculty } from './faculty.js';
+export { isKind, KIT, kindOf, ownKind } from './kind.js';
+export { OWNER, WARD } from './types.js';
+export { isSilence, isWord, silence, told, word } from './words.js';

package/dist/being/kind.d.ts

@@ -0,0 +1,4 @@
+export declare const KIT = "org.nervur.";
+export declare const isKind: (text: unknown) => text is string;
+export declare const ownKind: (C: unknown) => string | undefined;
+export declare const kindOf: (C: unknown) => string;

package/dist/being/kind.js

@@ -0,0 +1,28 @@
+// SPDX-License-Identifier: Apache-2.0
+// A kind: the name a row keeps for the class a being is born of, and the
+// name a contract is lent by. It is declared on the class, never taken from
+// the name the language gives it, because a bundler renames classes.
+//
+//   static kind = 'com.acme.shop'
+//
+// A kind is a reversed domain its author owns, then a name: at least three
+// segments joined by `.`, each lowercase letters, digits and `-`, starting
+// with a letter or digit. `org.nervur.` is the kit's own. A class declares
+// its own kind: one it inherits names its parent, so it is none.
+export const KIT = 'org.nervur.';
+const KIND = /^[a-z0-9][a-z0-9-]*(?:\.[a-z0-9][a-z0-9-]*){2,}$/;
+export const isKind = (text) => typeof text === 'string' && KIND.test(text);
+// The kind a class declares on itself, or undefined.
+export const ownKind = (C) => {
+    if (typeof C !== 'function' || !Object.hasOwn(C, 'kind'))
+        return undefined;
+    const kind = C.kind;
+    return isKind(kind) ? kind : undefined;
+};
+// The kind a class declares on itself, or a throw naming the class.
+export const kindOf = (C) => {
+    const kind = ownKind(C);
+    if (kind === undefined)
+        throw new Error(`class ${typeof C === 'function' ? C.name : String(C)} declares no kind of its own`);
+    return kind;
+};