nervur 0.19.2 → 0.20.1

package/src/tcp/index.ts

@@ -0,0 +1,173 @@
+// SPDX-License-Identifier: Apache-2.0
+// Quo over TCP: `nervur/tcp`, an entry that names a platform, Node's
+// sockets.
+//
+//   TcpCarrier    a Carrier that dials: bytes to a ward pk go in an ask
+//                 frame to the address its book holds for that pk
+//   TcpListener   answers ask frames for the doors it is handed, a harbor
+//                 among them
+//
+// Where a ward is reached is the carrier's own, and never on the wire. A
+// connection is opened per address, carries many asks at once, and is
+// dropped when either side closes it; the next ask dials again.
+import { connect, createServer, type Server, type Socket } from 'node:net';
+import { hex, isHex, unhex } from '../crypto/index.ts';
+import { Carrier } from '../contract/index.ts';
+import { askFrame, FrameReader, nothingFrame, parseAt, replyFrame } from './frame.ts';
+
+export { parseAt } from './frame.ts';
+
+// What a listener hands an ask to: bytes for a ward pk, or nothing.
+export interface Doors {
+  arrive(pk: string, bytes: Uint8Array): Promise<Uint8Array | null>;
+}
+
+const MAX_ID = 0xffff_ffff;
+
+class Dialed {
+  readonly #socket: Socket;
+  readonly #reader = new FrameReader();
+  readonly #waiting = new Map<number, (box: Uint8Array | null) => void>();
+  #next = 1;
+  closed = false;
+
+  constructor(socket: Socket, onClose: () => void) {
+    this.#socket = socket;
+    socket.on('data', (chunk: Buffer) => {
+      for (const f of this.#reader.push(new Uint8Array(chunk))) {
+        if (f.kind === 'ask') continue;
+        const resolve = this.#waiting.get(f.id);
+        this.#waiting.delete(f.id);
+        resolve?.(f.kind === 'reply' ? f.box : null);
+      }
+      if (this.#reader.bad) socket.destroy();
+    });
+    socket.on('error', () => socket.destroy());
+    socket.on('close', () => {
+      this.closed = true;
+      onClose();
+      for (const resolve of this.#waiting.values()) resolve(null);
+      this.#waiting.clear();
+    });
+  }
+
+  static open(host: string, port: number, onClose: () => void): Promise<Dialed | null> {
+    return new Promise((resolve) => {
+      const socket = connect({ host, port });
+      socket.once('connect', () => resolve(new Dialed(socket, onClose)));
+      socket.once('error', () => {
+        socket.destroy();
+        resolve(null);
+      });
+    });
+  }
+
+  ask(pk: Uint8Array, box: Uint8Array): Promise<Uint8Array | null> {
+    if (this.closed) return Promise.resolve(null);
+    const id = this.#next;
+    this.#next = this.#next === MAX_ID ? 1 : this.#next + 1;
+    return new Promise((resolve) => {
+      this.#waiting.set(id, resolve);
+      this.#socket.write(askFrame(id, pk, box));
+    });
+  }
+
+  close(): void {
+    this.#socket.destroy();
+  }
+}
+
+export class TcpCarrier extends Carrier {
+  readonly #routes = new Map<string, string>();
+  readonly #lines = new Map<string, Promise<Dialed | null>>();
+
+  // The address a ward pk is reached at, replacing any before, or null to
+  // forget it.
+  override route(pk: string, at: string | null): boolean {
+    if (!isHex(pk, 64) || (at !== null && parseAt(at) === null)) return false;
+    if (at === null) this.#routes.delete(pk);
+    else this.#routes.set(pk, at);
+    return true;
+  }
+
+  // Nothing where the pk has no route, the address is not reached, or the
+  // connection closed before an answer.
+  async carry(pk: string, bytes: Uint8Array): Promise<Uint8Array | null> {
+    const at = this.#routes.get(pk);
+    if (at === undefined) return null;
+    const line = await this.#line(at);
+    return line ? line.ask(unhex(pk), bytes) : null;
+  }
+
+  #line(at: string): Promise<Dialed | null> {
+    let line = this.#lines.get(at);
+    if (!line) {
+      const { host, port } = parseAt(at)!;
+      line = Dialed.open(host, port, () => this.#lines.delete(at)).then((dialed) => {
+        if (!dialed) this.#lines.delete(at);
+        return dialed;
+      });
+      this.#lines.set(at, line);
+    }
+    return line;
+  }
+
+  async close(): Promise<void> {
+    const lines = [...this.#lines.values()];
+    this.#lines.clear();
+    for (const line of await Promise.all(lines)) line?.close();
+  }
+}
+
+export class TcpListener {
+  readonly #server: Server;
+  readonly #doors: Doors;
+  readonly #sockets = new Set<Socket>();
+
+  private constructor(doors: Doors) {
+    this.#doors = doors;
+    this.#server = createServer((socket) => this.#serve(socket));
+  }
+
+  // A listener on `host` and `port`, 127.0.0.1 and a free port unless named.
+  static listen(doors: Doors, host = '127.0.0.1', port = 0): Promise<TcpListener> {
+    const listener = new TcpListener(doors);
+    return new Promise((resolve, reject) => {
+      listener.#server.once('error', reject);
+      listener.#server.listen(port, host, () => resolve(listener));
+    });
+  }
+
+  get at(): string {
+    const address = this.#server.address() as { address: string; port: number; family: string };
+    return address.family === 'IPv6' ? `[${address.address}]:${address.port}` : `${address.address}:${address.port}`;
+  }
+
+  #serve(socket: Socket): void {
+    this.#sockets.add(socket);
+    const reader = new FrameReader();
+    socket.on('data', (chunk: Buffer) => {
+      for (const f of reader.push(new Uint8Array(chunk))) {
+        if (f.kind === 'ask') void this.#answer(socket, f.id, f.pk, f.box);
+      }
+      if (reader.bad) socket.destroy();
+    });
+    socket.on('error', () => socket.destroy());
+    socket.on('close', () => this.#sockets.delete(socket));
+  }
+
+  async #answer(socket: Socket, id: number, pk: Uint8Array, box: Uint8Array): Promise<void> {
+    let reply: Uint8Array | null = null;
+    try {
+      reply = await this.#doors.arrive(hex(pk), box);
+    } catch {
+      reply = null;
+    }
+    if (!socket.destroyed) socket.write(reply === null ? nothingFrame(id) : replyFrame(id, reply));
+  }
+
+  close(): Promise<void> {
+    for (const socket of this.#sockets) socket.destroy();
+    return new Promise((resolve) => this.#server.close(() => resolve()));
+  }
+}

package/src/ward/allowance.ts

@@ -1,85 +1,47 @@
 // SPDX-License-Identifier: Apache-2.0
-// The allowance. Every ask carries, in its signed body, the time it may still
-// spend, in milliseconds. A being who says nothing gets her ward's default and
-// never thinks about it; one who wants to say so passes a third argument, and
-// is held to the ward's ceiling. The door reads it before anything is done
-// under it and refuses a budget already gone, as one silence like every other
-// refusal there. The sender bounds the whole of her ask to the same number,
-// and a wait that ran out is the word late, never silence and never unreached.
-//
-// Each ask is bounded on its own. The time an arriving call has left does not
-// bound the asks a being makes while answering it: attributing her onward ask
-// to the arrival that caused it needs a context the ward cannot get without
-// naming a runtime, and the ward names none. Every wait still ends.
+// The allowance: how long a being waits on one ask. It is on no wire. A
+// being who says nothing gets the default, and nobody gets past the
+// ceiling.
+import type { Clock } from '../contract/index.ts';
+import type { Wanted } from '../being/index.ts';
 
-// What a being may ask for is Wanted, and it belongs to the stance, where she
-// reads it. This file holds only what the ward does with it.
-import type { Wanted } from '../being/types.ts';
+export const DEFAULT = 30_000;
+export const CEILING = 300_000;
 
-// A budget, as it crosses a door. Time in milliseconds.
-export type Allowance = { time: number };
+export const allow = (wanted: Wanted | undefined): number => {
+  const whole = typeof wanted?.time === 'number' ? Math.floor(wanted.time) : NaN;
+  return Math.min(Number.isFinite(whole) && whole > 0 ? whole : DEFAULT, CEILING);
+};
 
-// How wide the default is, and how wide she may ask for, are the ward's own —
-// wider is more patient, and no peer can tell the difference except by being
-// refused. A being who never learns the third parameter exists writes correct
-// code forever under these. They are two numbers because the third argument
-// goes both ways: less for the ask she wants back quickly, more for the one
-// she knows is slow.
-export const DEFAULT: Allowance = { time: 30_000 };
-export const CEILING: Allowance = { time: 300_000 };
+export const LATE: unique symbol = Symbol('late');
+export type Late = typeof LATE;
 
-// What she asked for, held to what her ward allows. A being cannot mint budget
-// nobody granted her: asking for a minute where the ward gives thirty seconds
-// is thirty seconds, silently, because the ceiling is not hers to know.
-// Asking for nothing at all is the default, which is the whole point.
-export function allow(wanted: Wanted | undefined, ceiling: Allowance = CEILING, base: Allowance = DEFAULT): Allowance {
-  // Floored first, then tested: a fraction of a millisecond is not a budget,
-  // and falls to the default like every other number that is not a positive
-  // whole one.
-  const whole = (n: unknown, fallback: number) => {
-    const w = typeof n === 'number' ? Math.floor(n) : NaN;
-    return Number.isFinite(w) && w > 0 ? w : fallback;
-  };
-  return { time: Math.min(whole(wanted?.time, base.time), ceiling.time) };
-}
+// One ask's bell. It bounds the wait of the being who asked and the send
+// that holds the relation's line, so a far side that never answers holds
+// neither for longer than the allowance.
+export class Bell {
+  readonly #wait: { done: Promise<void>; cancel(): void };
+  readonly #late: Promise<Late>;
+  #rang = false;
 
-// Whether a budget has anything left to spend, and the one reader of it: the
-// door calls this on arrival and nothing else asks the question anywhere. A
-// time that is not a whole number above zero is not a budget that ran out, it
-// is no budget at all, and the door refuses both the same way, since a peer
-// learns nothing from the difference. `allow` never makes one, so only bytes
-// off the road ever carry one.
-export const spent = (a: Allowance): boolean => !(Number.isSafeInteger(a.time) && a.time > 0);
+  constructor(clock: Clock, ms: number) {
+    this.#wait = clock.wait(ms);
+    this.#late = this.#wait.done.then((): Late => {
+      this.#rang = true;
+      return LATE;
+    });
+  }
 
-// What a wait that ran out comes back as. Its own value, held by nobody
-// outside the ward, so no answer from any door can be mistaken for it.
-export const LATE = Symbol('late');
+  get rang(): boolean {
+    return this.#rang;
+  }
+
+  race<T>(work: Promise<T>): Promise<T | Late> {
+    work.catch(() => {});
+    return Promise.race([work, this.#late]);
+  }
 
-// A wait with an end. This is the one thing the ward times, and it covers the
-// whole of an ask, not only the wire: a relation that comes back round is
-// stopped at its own lane, before a single byte is sealed, and a bound that
-// only watched the wire would never see it. A timer is the only way to stop
-// waiting and every language that runs Quo has one; no runtime is named here.
-//
-// `rang` is called the moment the bell rings, before anyone waiting on the
-// wait is told: whoever holds work that has not started yet reads it and does
-// not start it. What comes back late is not read, and what has not left yet
-// does not leave.
-export async function within<T>(ms: number, work: Promise<T>, rang?: () => void): Promise<T | typeof LATE> {
-  let timer: ReturnType<typeof setTimeout> | undefined;
-  const bell = new Promise<typeof LATE>((ring) => {
-    timer = setTimeout(() => {
-      rang?.();
-      ring(LATE);
-    }, ms);
-  });
-  try {
-    return await Promise.race([work, bell]);
-  } finally {
-    clearTimeout(timer);
-    void work.then(
-      () => {},
-      () => {},
-    ); // whatever it was, it is nobody's answer now
+  cancel(): void {
+    this.#wait.cancel();
   }
 }

package/src/ward/cells.ts

@@ -1,190 +1,77 @@
 // SPDX-License-Identifier: Apache-2.0
-// Cells hold values, and nothing else. The partition promises a harbor it may
-// persist a being's cells as it likes: as this process's objects, as a row, as
-// a line of JSON on a disk. That promise is only worth what the cells honour.
+// A being's cells, guarded. Her cells are kept by whatever memory her
+// terrain gives, and a memory that writes JSON would hand back something
+// other than what she wrote if she wrote anything JSON cannot hold. So a
+// write that is not a value throws where she wrote it, in her own frame,
+// and her answer becomes silence like any throw.
 //
-// Unchecked, a being could write a Map, a Date, an undefined, a NaN. In a
-// memory harbor the object would survive, because there is nowhere for it to
-// go and come back from. Through any harbor that keeps values it would
-// silently become {}, or a string, or absent, or null, and she is never told
-// which harbor she is standing in. That would be the memory harbor lying to
-// her, which is the one thing it must never do.
-//
-// So the cells refuse the write. Loud, where she wrote it, in her own frame:
-// a being holds three answers and a throw is not one of them, so this throw
-// lands inside her method and the door turns it into the silence it already
-// turns every throw into. She has not answered, and nothing was written down
-// that a harbor would have to lie about later.
-import type { Cells, Json } from '../being/types.ts';
+// What passes is stored as a fresh copy of its JSON text, so a reference
+// she kept to what she wrote is not a way around the guard. Every key lands
+// as an own key, `__proto__` included. A list grows at its end: a slot or a
+// length past it would leave a hole.
+import { writeValue, type Json } from '../crypto/index.ts';
+import type { JsonObject } from '../being/index.ts';
 
-// How deep a value may nest. Every walk over a value in the kit recurses,
-// and a peer chooses the depth of what she answers; a bound keeps a hostile
-// reply from ending a walk in a stack overflow instead of a refusal.
 export const DEPTH = 64;
 
-// How many values one written out may come to. Depth alone does not bound
-// what a value costs to keep: one subvalue may sit under two keys, and
-// nesting that forty levels deep is inside the depth bound and is a trillion
-// values once written down. What is walked here is the object graph, which is
-// small; what a harbor keeps is the tree it expands to, which is not. So the
-// walk counts the tree while it proves the graph, and refuses a value nobody
-// could write down. This is a bound on what a being holds, so it is this
-// kit's number and no word of the spec.
-export const BREADTH = 1 << 20;
-
-// Text a harbor can write down: every surrogate in a pair. A lone one is a
-// code unit with no character, which JSON escapes and UTF-8 cannot encode at
-// all, so a harbor that keeps strings as bytes loses it and one that keeps
-// the object does not. I-JSON says a string is text, and this is that rule
-// where the value is written rather than where it is read.
-const WELL_FORMED = /^(?:[^\uD800-\uDFFF]|[\uD800-\uDBFF][\uDC00-\uDFFF])*$/;
-
-// I-JSON, all the way down. A number that JSON cannot write is not a number
-// a harbor can keep, a key on the prototype is not a key she wrote, and a
-// hole in a list, or a key named `__proto__`, is a thing JSON writes one way
-// and a runtime reads another.
-//
-// A fault is a sentence; anything else is the count of values under this one,
-// itself included. A value already counted is a value already proven, so a
-// graph that shares is walked once per node rather than once per path.
-function walk(v: unknown, path: string, seen: Set<object>, sized: Map<object, number>, depth: number): string | number {
-  if (v === null || typeof v === 'boolean') return 1;
-  if (typeof v === 'string') return WELL_FORMED.test(v) ? 1 : `${path} carries a lone surrogate, which is no text a harbor can write down`;
-  if (typeof v === 'number') {
-    if (!Number.isFinite(v)) return `${path} is ${String(v)}, which no harbor can write down`;
-    // Minus zero is a number JSON writes as `0` and reads back as `0`. A
-    // harbor that keeps values would hand her the sign she wrote and one that
-    // writes JSON would not, and she is never told which she is standing in.
-    return Object.is(v, -0) ? `${path} is minus zero, which comes back as zero from every harbor that writes JSON` : 1;
-  }
-  if (typeof v !== 'object') return `${path} is a ${typeof v}, which is not a value`;
-  if (seen.has(v)) return `${path} refers back to itself`;
-  const counted = sized.get(v);
-  if (counted !== undefined) return counted;
-  if (depth >= DEPTH) return `${path} is nested past ${DEPTH} levels, which no harbor can keep`;
-  seen.add(v);
-  try {
-    let size = 1;
-    const under = (where: string, x: unknown): string | null => {
-      const r = walk(x, where, seen, sized, depth + 1);
-      if (typeof r === 'string') return r;
-      size += r;
-      return size > BREADTH ? `${path} writes out to more than ${BREADTH} values, which no harbor can keep` : null;
-    };
-    if (Array.isArray(v)) {
-      for (let i = 0; i < v.length; i += 1) {
-        if (!(i in v)) return `${path}[${i}] is a hole, which no harbor can write down`;
-        const f = under(`${path}[${i}]`, v[i]);
-        if (f) return f;
-      }
-      sized.set(v, size);
-      return size;
-    }
-    const proto = Object.getPrototypeOf(v);
-    if (proto !== Object.prototype && proto !== null) return `${path} is a ${(v).constructor?.name ?? 'object'}, which is not a value`;
-    for (const k of Object.keys(v)) {
-      if (k === '__proto__') return `${path}.__proto__ is a key no harbor can keep`;
-      const f = under(`${path}.${k}`, (v as Record<string, unknown>)[k]);
-      if (f) return f;
-    }
-    sized.set(v, size);
-    return size;
-  } finally {
-    seen.delete(v);
-  }
-}
-
-export const cellFault = (v: unknown, path: string): string | null => {
-  const out = walk(v, path, new Set(), new Map(), 0);
-  return typeof out === 'string' ? out : null;
+const refuse = (why: string): never => {
+  throw new TypeError(`cells hold values: ${why}`);
 };
 
-// The three keys at the root of her cells that are the ward's: it writes
-// them, she reads them, and a write of hers there is refused like a non-value.
-const WARDS = new Set(['standings', 'occupants', 'class']);
+const copy = (value: unknown, room: number, where: string): Json => {
+  const text = writeValue(value, room);
+  return text === undefined ? refuse(`${where} is not a value JSON keeps, within ${room} levels`) : (JSON.parse(text) as Json);
+};
 
-// The guard is one proxy at the root and one for every container read through
-// it, so a write nested three deep is refused the same way a write at the top
-// is. Wrappers are remembered, so reading the same array twice is the same
-// object twice and a being may still compare what she holds.
-const wrapped = new WeakMap<object, object>();
-const targets = new WeakMap<object, object>();
-const guards = new WeakSet();
+export class Cells {
+  readonly #guards = new WeakMap<object, object>();
+  readonly #wrote: () => void;
 
-// A name no partition can hold, wherever it appears. It is here beside the
-// guard that refuses it, because the ward refuses it too: a relation named
-// this one would be written into the bind table and then throw on her cells,
-// which is half a relation and a throw where a null is promised. One rule,
-// one place, read by the guard and by the stance.
-export const unkeepable = (k: string): boolean => k === '__proto__';
+  constructor(wrote: () => void) {
+    this.#wrote = wrote;
+  }
 
-// A key a write may land on: a string that is not `__proto__`, and not one
-// of the ward's at the root. A symbol key is a thing JSON never writes.
-const refuse: (why: string) => never = (why) => {
-  throw new TypeError(`cells hold values: ${why}`);
-};
-function keyFault(t: object, k: string | symbol, v: unknown, path: string, root: boolean): void {
-  if (typeof k !== 'string') refuse(`${path} takes no symbol key`);
-  if (unkeepable(k)) refuse(`${path}.__proto__ is a key no harbor can keep`);
-  if (root && WARDS.has(k)) refuse(`${path}.${k} is the ward's to write`);
-  // A list grows by one at its end, or it has holes JSON cannot write. A
-  // push sets the slot at its length and then the length: both pass. A
-  // length set past what she wrote, or a slot beyond it, would leave holes.
-  if (Array.isArray(t)) {
-    if (k === 'length') {
-      if (typeof v !== 'number' || v > t.length) refuse(`${path}.length set past what she wrote would leave holes`);
-      return;
-    }
-    const i = Number(k);
-    if (Number.isInteger(i) && i > t.length) refuse(`${path}[${i}] would leave a hole`);
+  // The guarded view of a being's cells.
+  guard(cells: JsonObject): JsonObject {
+    return this.#guard(cells, 'cells', 1);
   }
-}
 
-function guard<T extends object>(target: T, path: string, wrote: () => void, root = false): T {
-  if (guards.has(target)) return target;
-  const had = wrapped.get(target);
-  if (had) return had as T;
-  const p = new Proxy(target, {
-    get(t, k, r) {
-      const v = Reflect.get(t, k, r);
-      // A container reached through her cells is part of her cells.
-      return v !== null && typeof v === 'object' && !ArrayBuffer.isView(v) ? guard(v as object, `${path}.${String(k)}`, wrote) : v;
-    },
-    set(t, k, v, r) {
-      keyFault(t, k, v, path, root);
-      const f = cellFault(v, `${path}.${String(k)}`);
-      if (f) refuse(f);
-      const ok = Reflect.set(t, k, v, r);
-      wrote();
-      return ok;
-    },
-    defineProperty(t, k, d) {
-      if (!('value' in d)) refuse(`${path}.${String(k)} is an accessor, which no harbor can keep`);
-      keyFault(t, k, d.value, path, root);
-      const f = cellFault(d.value, `${path}.${String(k)}`);
-      if (f) refuse(f);
-      const ok = Reflect.defineProperty(t, k, d);
-      wrote();
-      return ok;
-    },
-    deleteProperty(t, k) {
-      if (root && typeof k === 'string' && WARDS.has(k)) refuse(`${path}.${k} is the ward's to keep`);
-      const ok = Reflect.deleteProperty(t, k);
-      wrote();
+  #guard<T extends object>(target: T, path: string, level: number): T {
+    const had = this.#guards.get(target);
+    if (had) return had as T;
+    const room = DEPTH - level;
+    const place = (t: T, k: string | symbol, value: unknown): boolean => {
+      if (typeof k !== 'string') return refuse(`${path} takes no symbol key`);
+      const where = `${path}.${k}`;
+      if (Array.isArray(t)) {
+        if (k === 'length') {
+          if (typeof value !== 'number' || value > t.length) refuse(`${where} past its end would leave a hole`);
+          t.length = value as number;
+          this.#wrote();
+          return true;
+        }
+        if (!/^(0|[1-9]\d*)$/.test(k)) refuse(`${where} is not a slot of a list`);
+        if (Number(k) > t.length) refuse(`${where} would leave a hole`);
+      }
+      const ok = Reflect.defineProperty(t, k, { value: copy(value, room, where), enumerable: true, writable: true, configurable: true });
+      this.#wrote();
       return ok;
-    },
-  });
-  wrapped.set(target, p);
-  targets.set(p, target);
-  guards.add(p);
-  return p;
+    };
+    const proxy = new Proxy(target, {
+      get: (t, k, r) => {
+        const v: unknown = Reflect.get(t, k, r);
+        return typeof k === 'string' && Object.hasOwn(t, k) && typeof v === 'object' && v !== null ? this.#guard(v, `${path}.${k}`, level + 1) : v;
+      },
+      set: (t, k, v) => place(t, k, v),
+      defineProperty: (t, k, d) => ('value' in d ? place(t, k, d.value) : refuse(`${path}.${String(k)} is an accessor`)),
+      deleteProperty: (t, k) => {
+        const ok = Reflect.deleteProperty(t, k);
+        this.#wrote();
+        return ok;
+      },
+      setPrototypeOf: () => refuse(`${path} keeps its prototype`),
+    });
+    this.#guards.set(target, proxy);
+    return proxy;
+  }
 }
-
-// Her cells, guarded. Called once per being at boot; the guarded object is
-// what goes into the partition and what the stance hands her, so there is no
-// second door onto the same cells. Every write that passes says so to the
-// ward, which says so to its harbor.
-export const guardCells = (cells: Cells, wrote: () => void = () => {}): Cells => guard(cells as unknown as Record<string, Json>, 'cells', wrote, true) as unknown as Cells;
-// The cells behind the guard, for the ward alone: the one writer of the
-// three keys that are its own.
-export const unguarded = (cells: Cells): Cells => (targets.get(cells) ?? cells) as Cells;

package/src/ward/index.ts

@@ -1,18 +1,8 @@
 // SPDX-License-Identifier: Apache-2.0
-// nervur/ward — one function. Every ward is the same ward.
-export { Ward } from './ward.ts';
-export type { Ground, WardPointers, Memory } from './ground.ts';
-export { BOX, OFFER, RETRACT, volatile } from './ground.ts';
-export type { Partition, Heir, Bind, StandingKeys } from './partition.ts';
-// The three bounds on what a partition may hold, for a kit that must keep
-// the same ones and for a test that pins them.
-export { GONE, MINTED, KNOCKS } from './partition.ts';
-export type { AskPayload, ReplyPayload } from './seal.ts';
-// The seal and the arithmetic, for a kit in another language to check its
-// bytes against, and for tests that speak to a door directly.
-export * as seal from './seal.ts';
-export * as arithmetic from './arithmetic.ts';
-// The allowance every ask carries, for a kit in another language and for
-// tests that speak to a door directly.
-export { allow, spent, DEFAULT, CEILING } from './allowance.ts';
-export type { Allowance } from './allowance.ts';
+// The ward: its partition, its stances, its ward-being, and the ward.
+export { allow, CEILING, DEFAULT } from './allowance.ts';
+export { HEAD_ROW, Partition, type BeingRow, type Head, type StandingRow } from './partition.ts';
+export { DEPTH } from './stance.ts';
+export { DOCK, Ward, type Catalogue, type Lender, type WardParts } from './ward.ts';
+export { ownerAsk, pilots, WardBeing, type Steward, type WardBeingStance } from './ward-being.ts';
+export { Pilot } from './pilot.ts';