nervur 0.19.2 → 0.20.1

package/dist/contract/index.js

@@ -0,0 +1,33 @@
+// Drawn bytes.
+export class Entropy {
+    // The same source, as the function `quo/` takes.
+    get drawer() {
+        return (length) => this.draw(length);
+    }
+}
+// The moment, and a wait that ends.
+export class Clock {
+}
+// A harbor's memory as a terrain keeps it: sealed entries it cannot read,
+// in places, each entry by name. Every name is lowercase hex the kit
+// chose, so a body may use it as a file name as it stands.
+export class Memory {
+}
+// The harbor's seed: thirty-two bytes, the same every time. It is the one
+// secret a terrain holds.
+export class Custody {
+}
+// Code, by the name a harbor keeps for it, or null where this loader has
+// none. Code never crosses a door and never lives in a cell, so it is the
+// one thing beside the seed a terrain hands in: a map, an import, a bundle.
+export class Loader {
+}
+// Bytes to a ward pk in; bytes, or null for nothing, out.
+export class Carrier {
+    // Where a ward pk is reached, or null to forget it: true when this
+    // carrier dials by address and took it. The addresses live in the dock's
+    // cells, and the harbor hands them here as it unpacks.
+    route(_pk, _at) {
+        return false;
+    }
+}

package/dist/crypto/aes.d.ts

@@ -0,0 +1,3 @@
+export declare const TAG = 16;
+export declare const encrypt: (key: Uint8Array, nonce: Uint8Array, additional: Uint8Array, plaintext: Uint8Array) => Promise<Uint8Array>;
+export declare const decrypt: (key: Uint8Array, nonce: Uint8Array, additional: Uint8Array, ciphertext: Uint8Array) => Promise<Uint8Array | null>;

package/dist/crypto/aes.js

@@ -0,0 +1,24 @@
+// SPDX-License-Identifier: Apache-2.0
+// AES-256-GCM with a sixteen-byte tag at the end of the ciphertext.
+import { own, subtle } from './subtle.js';
+export const TAG = 16;
+const cipher = (key, nonce, additional) => ({
+    params: { name: 'AES-GCM', iv: own(nonce), additionalData: own(additional), tagLength: TAG * 8 },
+    key: subtle().importKey('raw', own(key), 'AES-GCM', false, ['encrypt', 'decrypt']),
+});
+export const encrypt = async (key, nonce, additional, plaintext) => {
+    const c = cipher(key, nonce, additional);
+    return new Uint8Array(await subtle().encrypt(c.params, await c.key, own(plaintext)));
+};
+// The plaintext, or null when the ciphertext does not open.
+export const decrypt = async (key, nonce, additional, ciphertext) => {
+    if (ciphertext.length < TAG)
+        return null;
+    const c = cipher(key, nonce, additional);
+    try {
+        return new Uint8Array(await subtle().decrypt(c.params, await c.key, own(ciphertext)));
+    }
+    catch {
+        return null;
+    }
+};

package/dist/crypto/bytes.d.ts

@@ -0,0 +1,6 @@
+export declare const hex: (bytes: Uint8Array) => string;
+export declare const isHex: (text: unknown, length?: number) => text is string;
+export declare const unhex: (text: string) => Uint8Array;
+export declare const concat: (...parts: Uint8Array[]) => Uint8Array;
+export declare const zero: (bytes: Uint8Array) => boolean;
+export declare const utf8: (text: string) => Uint8Array;

package/dist/crypto/bytes.js

@@ -0,0 +1,33 @@
+// SPDX-License-Identifier: Apache-2.0
+// Bytes and the one text spelling Quo gives them: hex, two lowercase digits
+// a byte.
+const DIGITS = Array.from({ length: 256 }, (_, at) => at.toString(16).padStart(2, '0'));
+const HEX = /^(?:[0-9a-f]{2})*$/;
+export const hex = (bytes) => {
+    let out = '';
+    for (const byte of bytes)
+        out += DIGITS[byte];
+    return out;
+};
+// Hex of `length` bytes, or any length when none is named.
+export const isHex = (text, length) => typeof text === 'string' && HEX.test(text) && (length === undefined || text.length === length * 2);
+export const unhex = (text) => {
+    if (!isHex(text))
+        throw new TypeError('not hex');
+    const out = new Uint8Array(text.length / 2);
+    for (let at = 0; at < out.length; at += 1)
+        out[at] = parseInt(text.slice(at * 2, at * 2 + 2), 16);
+    return out;
+};
+export const concat = (...parts) => {
+    const out = new Uint8Array(parts.reduce((n, p) => n + p.length, 0));
+    let at = 0;
+    for (const part of parts) {
+        out.set(part, at);
+        at += part.length;
+    }
+    return out;
+};
+export const zero = (bytes) => bytes.every((b) => b === 0);
+const encoder = new TextEncoder();
+export const utf8 = (text) => encoder.encode(text);

package/dist/crypto/ed25519.d.ts

@@ -0,0 +1,3 @@
+export declare const ed25519Public: (secret: Uint8Array) => Promise<Uint8Array>;
+export declare const sign: (secret: Uint8Array, message: Uint8Array) => Promise<Uint8Array>;
+export declare const verify: (pk: Uint8Array, message: Uint8Array, signature: Uint8Array) => Promise<boolean>;

package/dist/crypto/ed25519.js

@@ -0,0 +1,85 @@
+// SPDX-License-Identifier: Apache-2.0
+// Ed25519 signs, as RFC 8032 defines it, and verifies with the cofactorless
+// check. The spec names exactly where a check fails, and Web Crypto promises
+// none of the decoding rules, so they are held here before Web Crypto runs:
+//
+//   a signature of any length but sixty-four
+//   an `s` at or above the group order
+//   an `R` that does not decode, or whose bytes are not its point's encoding
+//   a public key that does not decode, or whose y is at or above the prime
+//   a public key of small order, in any spelling
+import { importSecret, own, publicOf, subtle } from './subtle.js';
+const P = 2n ** 255n - 19n;
+const L = 2n ** 252n + 27742317777372353535851937790883648493n;
+const mod = (a) => ((a % P) + P) % P;
+const power = (base, exponent) => {
+    let out = 1n;
+    let b = mod(base);
+    for (let e = exponent; e > 0n; e >>= 1n) {
+        if (e & 1n)
+            out = (out * b) % P;
+        b = (b * b) % P;
+    }
+    return out;
+};
+const D = mod(-121665n * power(121666n, P - 2n));
+const ROOT_MINUS_ONE = power(2n, (P - 1n) / 4n);
+const little = (bytes) => bytes.reduceRight((n, b) => (n << 8n) | BigInt(b), 0n);
+// A point from its thirty-two bytes, or null where RFC 8032 section 5.1.3
+// refuses it, the sign bit set on x = 0 included.
+const decode = (bytes) => {
+    if (bytes.length !== 32)
+        return null;
+    const sign = (bytes[31] & 0x80) !== 0;
+    const y = little(bytes) & ((1n << 255n) - 1n);
+    if (y >= P)
+        return null;
+    const u = mod(y * y - 1n);
+    const v = mod(D * y * y + 1n);
+    let x = mod(u * power(v, 3n) * power(u * power(v, 7n), (P - 5n) / 8n));
+    const check = mod(v * x * x);
+    if (check === mod(-u))
+        x = mod(x * ROOT_MINUS_ONE);
+    else if (check !== u)
+        return null;
+    if (x === 0n && sign)
+        return null;
+    if ((x & 1n) !== (sign ? 1n : 0n))
+        x = mod(-x);
+    return { x, y, z: 1n, t: mod(x * y) };
+};
+const add = (a, b) => {
+    const A = mod((a.y - a.x) * (b.y - b.x));
+    const B = mod((a.y + a.x) * (b.y + b.x));
+    const C = mod(2n * D * a.t * b.t);
+    const E = mod(2n * a.z * b.z);
+    const [e, f, g, h] = [B - A, E - C, E + C, B + A];
+    return { x: mod(e * f), y: mod(g * h), z: mod(f * g), t: mod(e * h) };
+};
+// Small order: eight times the point is the identity.
+const smallOrder = (p) => {
+    let q = p;
+    for (let i = 0; i < 3; i += 1)
+        q = add(q, q);
+    return q.x === 0n && q.y === q.z;
+};
+export const ed25519Public = async (secret) => publicOf(await importSecret('Ed25519', secret, ['sign']));
+export const sign = async (secret, message) => new Uint8Array(await subtle().sign('Ed25519', await importSecret('Ed25519', secret, ['sign']), own(message)));
+export const verify = async (pk, message, signature) => {
+    if (signature.length !== 64)
+        return false;
+    const key = decode(pk);
+    if (key === null || smallOrder(key))
+        return false;
+    if (decode(signature.subarray(0, 32)) === null)
+        return false;
+    if (little(signature.subarray(32)) >= L)
+        return false;
+    try {
+        const imported = await subtle().importKey('raw', own(pk), { name: 'Ed25519' }, false, ['verify']);
+        return await subtle().verify('Ed25519', imported, own(signature), own(message));
+    }
+    catch {
+        return false;
+    }
+};

package/dist/crypto/hash.d.ts

@@ -0,0 +1,2 @@
+export declare const sha256: (bytes: Uint8Array) => Promise<Uint8Array>;
+export declare const hkdf: (ikm: Uint8Array, info: Uint8Array, length: number) => Promise<Uint8Array>;

package/dist/crypto/hash.js

@@ -0,0 +1,11 @@
+// SPDX-License-Identifier: Apache-2.0
+// SHA-256 hashes, and HKDF-SHA-256 derives under the zero-length salt, with
+// the label's ASCII bytes as `info`.
+import { own, subtle } from './subtle.js';
+const SALT = new Uint8Array(0);
+export const sha256 = async (bytes) => new Uint8Array(await subtle().digest('SHA-256', own(bytes)));
+export const hkdf = async (ikm, info, length) => {
+    const material = await subtle().importKey('raw', own(ikm), 'HKDF', false, ['deriveBits']);
+    const bits = await subtle().deriveBits({ name: 'HKDF', hash: 'SHA-256', salt: SALT, info: own(info) }, material, length * 8);
+    return new Uint8Array(bits);
+};

package/dist/crypto/index.d.ts

@@ -0,0 +1,7 @@
+export { concat, hex, isHex, unhex, utf8, zero } from './bytes.ts';
+export { hkdf, sha256 } from './hash.ts';
+export { isCount, readObject, readValue, writeValue, type Fields, type Json } from './json.ts';
+export { decrypt, encrypt, TAG } from './aes.ts';
+export { agree, x25519Public } from './x25519.ts';
+export { ed25519Public, sign, verify } from './ed25519.ts';
+export { CIPHERTEXT, decapsulate, EK, encapsulate, lockFrom, type Lock } from './mlkem.ts';

package/dist/crypto/index.js

@@ -0,0 +1,10 @@
+// SPDX-License-Identifier: Apache-2.0
+// The six algorithms Quo names, and bytes. Arithmetic only: no label, no
+// key of Quo's, no decision.
+export { concat, hex, isHex, unhex, utf8, zero } from './bytes.js';
+export { hkdf, sha256 } from './hash.js';
+export { isCount, readObject, readValue, writeValue } from './json.js';
+export { decrypt, encrypt, TAG } from './aes.js';
+export { agree, x25519Public } from './x25519.js';
+export { ed25519Public, sign, verify } from './ed25519.js';
+export { CIPHERTEXT, decapsulate, EK, encapsulate, lockFrom } from './mlkem.js';

package/dist/crypto/json.d.ts

@@ -0,0 +1,8 @@
+export type Json = null | boolean | number | string | Json[] | {
+    [key: string]: Json;
+};
+export type Fields = ReadonlyMap<string, string>;
+export declare const readObject: (input: Uint8Array | string) => Fields | null;
+export declare const readValue: (input: Uint8Array | string, depth: number) => Json | undefined;
+export declare const writeValue: (value: unknown, depth: number) => string | undefined;
+export declare const isCount: (literal: string) => boolean;

package/dist/crypto/json.js

@@ -0,0 +1,250 @@
+const decoder = new TextDecoder('utf-8', { fatal: true, ignoreBOM: true });
+const NUMBER = /-?(?:0|[1-9]\d*)(?:\.\d+)?(?:[eE][+-]?\d+)?/y;
+const ESCAPE = /\\(?:["\\/bfnrt]|u[0-9a-fA-F]{4})/y;
+const LONE = /[\uD800-\uDBFF](?![\uDC00-\uDFFF])|(?<![\uD800-\uDBFF])[\uDC00-\uDFFF]/;
+const LITERALS = ['true', 'false', 'null'];
+const skip = (s, at) => {
+    while (at < s.length && ' \t\n\r'.includes(s[at]))
+        at += 1;
+    return at;
+};
+// The end of the string opening at `at`, or -1.
+const stringEnd = (s, at) => {
+    if (s[at] !== '"')
+        return -1;
+    for (at += 1; at < s.length;) {
+        const c = s.charCodeAt(at);
+        if (c === 0x22)
+            return at + 1;
+        if (c < 0x20)
+            return -1;
+        if (c !== 0x5c) {
+            at += 1;
+            continue;
+        }
+        ESCAPE.lastIndex = at;
+        if (!ESCAPE.test(s))
+            return -1;
+        at = ESCAPE.lastIndex;
+    }
+    return -1;
+};
+const scalarEnd = (s, at) => {
+    if (s[at] === '"')
+        return stringEnd(s, at);
+    const literal = LITERALS.find((word) => s.startsWith(word, at));
+    if (literal)
+        return at + literal.length;
+    NUMBER.lastIndex = at;
+    return NUMBER.test(s) ? NUMBER.lastIndex : -1;
+};
+// A key, its colon and the space after it: the start of the key's value, or -1.
+const keyEnd = (s, at) => {
+    const end = stringEnd(s, at);
+    if (end < 0)
+        return -1;
+    const colon = skip(s, end);
+    return s[colon] === ':' ? skip(s, colon + 1) : -1;
+};
+// The end of the value starting at `at`, held to the grammar at any depth
+// without recursion, or -1.
+const valueEnd = (s, at) => {
+    const open = [];
+    for (;;) {
+        const c = s[at];
+        if (c === '{' || c === '[') {
+            at = skip(s, at + 1);
+            if (s[at] === (c === '{' ? '}' : ']'))
+                at += 1;
+            else {
+                open.push(c);
+                if (c === '{' && (at = keyEnd(s, at)) < 0)
+                    return -1;
+                continue;
+            }
+        }
+        else if ((at = scalarEnd(s, at)) < 0)
+            return -1;
+        for (;;) {
+            if (open.length === 0)
+                return at;
+            at = skip(s, at);
+            const top = open.at(-1);
+            if (s[at] === ',') {
+                at = skip(s, at + 1);
+                if (top === '{' && (at = keyEnd(s, at)) < 0)
+                    return -1;
+                break;
+            }
+            if (s[at] !== (top === '{' ? '}' : ']'))
+                return -1;
+            open.pop();
+            at += 1;
+        }
+    }
+};
+const text = (input) => {
+    if (typeof input === 'string')
+        return input;
+    try {
+        return decoder.decode(input);
+    }
+    catch {
+        return null;
+    }
+};
+export const readObject = (input) => {
+    const s = text(input);
+    if (s === null)
+        return null;
+    const fields = new Map();
+    let at = skip(s, 0);
+    if (s[at] !== '{')
+        return null;
+    at = skip(s, at + 1);
+    if (s[at] === '}')
+        return skip(s, at + 1) === s.length ? fields : null;
+    for (;;) {
+        const keyStart = at;
+        const valueStart = keyEnd(s, at);
+        if (valueStart < 0)
+            return null;
+        const key = JSON.parse(s.slice(keyStart, stringEnd(s, keyStart)));
+        if (fields.has(key))
+            return null;
+        const end = valueEnd(s, valueStart);
+        if (end < 0)
+            return null;
+        fields.set(key, s.slice(valueStart, end));
+        at = skip(s, end);
+        if (s[at] === '}')
+            return skip(s, at + 1) === s.length ? fields : null;
+        if (s[at] !== ',')
+            return null;
+        at = skip(s, at + 1);
+    }
+};
+// A number text a double holds as written: a fraction, or a whole number
+// the double it reads as is exactly, never past the largest double, never
+// a value that rounds to zero, never minus zero.
+const exactNumber = (literal) => {
+    const [, sign, whole, frac = '', exp = '0'] = /^(-?)(0|[1-9]\d*)(?:\.(\d+))?(?:[eE]([+-]?\d+))?$/.exec(literal);
+    const v = Number(literal);
+    if (!Number.isFinite(v))
+        return false;
+    const digits = (whole + frac).replace(/^0+/, '');
+    if (v === 0)
+        return digits === '' && sign === '';
+    const trimmed = digits.replace(/0+$/, '');
+    const e = BigInt(exp) - BigInt(frac.length) + BigInt(digits.length - trimmed.length);
+    if (e < 0n)
+        return true;
+    return BigInt(trimmed) * 10n ** e === (v < 0 ? -BigInt(v) : BigInt(v)) || literal === String(v);
+};
+const depthOf = (s) => {
+    let depth = 0;
+    let deepest = 0;
+    for (let at = 0; at < s.length; at += 1) {
+        const c = s[at];
+        if (c === '"')
+            at = stringEnd(s, at) - 1;
+        else if (c === '{' || c === '[')
+            deepest = Math.max(deepest, (depth += 1));
+        else if (c === '}' || c === ']')
+            depth -= 1;
+    }
+    return deepest;
+};
+// Parses a text already held to the grammar and to the depth bound.
+const parse = (s) => {
+    let at = 0;
+    const value = () => {
+        at = skip(s, at);
+        const c = s[at];
+        if (c === '{' || c === '[') {
+            const object = c === '{';
+            const out = object ? {} : [];
+            at = skip(s, at + 1);
+            if (s[at] === (object ? '}' : ']')) {
+                at += 1;
+                return out;
+            }
+            for (;;) {
+                if (object) {
+                    const key = str();
+                    if (Object.hasOwn(out, key))
+                        throw new Error('two keys of one name');
+                    at = skip(s, at) + 1;
+                    Object.defineProperty(out, key, { value: value(), enumerable: true, writable: true, configurable: true });
+                }
+                else
+                    out.push(value());
+                at = skip(s, at);
+                if (s[at++] !== ',')
+                    return out;
+            }
+        }
+        if (c === '"')
+            return str();
+        const end = scalarEnd(s, at);
+        const literal = s.slice(at, end);
+        at = end;
+        if (LITERALS.includes(literal))
+            return JSON.parse(literal);
+        if (!exactNumber(literal))
+            throw new Error('a number no double holds as written');
+        return Number(literal);
+    };
+    const str = () => {
+        at = skip(s, at);
+        const end = stringEnd(s, at);
+        const out = JSON.parse(s.slice(at, end));
+        if (LONE.test(out))
+            throw new Error('a lone surrogate');
+        at = end;
+        return out;
+    };
+    return value();
+};
+export const readValue = (input, depth) => {
+    const s = text(input);
+    if (s === null)
+        return undefined;
+    const start = skip(s, 0);
+    const end = valueEnd(s, start);
+    if (end < 0 || skip(s, end) !== s.length || depthOf(s) > depth)
+        return undefined;
+    try {
+        return parse(s);
+    }
+    catch {
+        return undefined;
+    }
+};
+// A value as JSON text, or undefined for one that JSON would drop, rewrite
+// or refuse: anything but null, a boolean, a finite number other than minus
+// zero, well-formed text, a list with no holes, or a plain object of own
+// string keys, nested no deeper than `depth`, with no cycle.
+export const writeValue = (value, depth) => {
+    const fits = (v, room, path) => {
+        if (v === null || typeof v === 'boolean')
+            return true;
+        if (typeof v === 'string')
+            return !LONE.test(v);
+        if (typeof v === 'number')
+            return Number.isFinite(v) && !Object.is(v, -0);
+        if (typeof v !== 'object' || room === 0 || path.has(v))
+            return false;
+        path.add(v);
+        const ok = Array.isArray(v)
+            ? Object.keys(v).length === v.length && v.every((x) => fits(x, room - 1, path))
+            : [Object.prototype, null].includes(Object.getPrototypeOf(v)) &&
+                Object.getOwnPropertySymbols(v).length === 0 &&
+                Object.entries(Object.getOwnPropertyDescriptors(v)).every(([k, d]) => !LONE.test(k) && d.enumerable === true && 'value' in d && fits(d.value, room - 1, path));
+        path.delete(v);
+        return ok;
+    };
+    return fits(value, depth, new Set()) ? JSON.stringify(value) : undefined;
+};
+// A count number: no sign, no fraction, no exponent, from 1 to 2^53 - 1.
+export const isCount = (literal) => /^[1-9]\d{0,15}$/.test(literal) && Number(literal) <= Number.MAX_SAFE_INTEGER;

package/dist/crypto/mlkem.d.ts

@@ -0,0 +1,12 @@
+export declare const EK = 1184;
+export declare const CIPHERTEXT = 1088;
+export type Lock = {
+    ek: Uint8Array;
+    dk: Uint8Array;
+};
+export declare const lockFrom: (d: Uint8Array, z: Uint8Array) => Lock;
+export declare const encapsulate: (ek: Uint8Array, m: Uint8Array) => {
+    ciphertext: Uint8Array;
+    shared: Uint8Array;
+} | null;
+export declare const decapsulate: (dk: Uint8Array, ciphertext: Uint8Array) => Uint8Array | null;

package/dist/crypto/mlkem.js

@@ -0,0 +1,36 @@
+// SPDX-License-Identifier: Apache-2.0
+// ML-KEM-768 of FIPS 203 encapsulates. Web Crypto has none on every terrain,
+// so it comes from `@noble/post-quantum`.
+import { ml_kem768 } from '@noble/post-quantum/ml-kem.js';
+export const EK = 1184;
+export const CIPHERTEXT = 1088;
+// KeyGen_internal(d, z): the lock from sixty-four drawn bytes, d then z.
+export const lockFrom = (d, z) => {
+    const { publicKey, secretKey } = ml_kem768.keygen(Uint8Array.from([...d, ...z]));
+    return { ek: publicKey, dk: secretKey };
+};
+// Encaps_internal(ek, m), or null for an encapsulation key the modulus check
+// of FIPS 203 section 7.2 refuses.
+export const encapsulate = (ek, m) => {
+    if (ek.length !== EK)
+        return null;
+    try {
+        const { cipherText, sharedSecret } = ml_kem768.encapsulate(ek, m);
+        return { ciphertext: cipherText, shared: sharedSecret };
+    }
+    catch {
+        return null;
+    }
+};
+// Decapsulation is implicit rejection: a ciphertext for another lock gives a
+// shared secret that opens nothing.
+export const decapsulate = (dk, ciphertext) => {
+    if (ciphertext.length !== CIPHERTEXT)
+        return null;
+    try {
+        return ml_kem768.decapsulate(ciphertext, dk);
+    }
+    catch {
+        return null;
+    }
+};

package/dist/crypto/subtle.d.ts

@@ -0,0 +1,10 @@
+export declare const subtle: () => SubtleCrypto;
+export type Bytes = Uint8Array<ArrayBuffer>;
+export declare const own: (bytes: Uint8Array) => Bytes;
+declare const PKCS8: {
+    readonly Ed25519: '302e020100300506032b657004220420';
+    readonly X25519: '302e020100300506032b656e04220420';
+};
+export declare const importSecret: (curve: keyof typeof PKCS8, secret: Uint8Array, uses: KeyUsage[]) => Promise<CryptoKey>;
+export declare const publicOf: (key: CryptoKey) => Promise<Uint8Array>;
+export {};

package/dist/crypto/subtle.js

@@ -0,0 +1,29 @@
+// SPDX-License-Identifier: Apache-2.0
+// Web Crypto, read at every use. A page on a plain http origin has `crypto`
+// without `subtle`, and a terrain may install it after this module loads.
+export const subtle = () => {
+    const found = globalThis.crypto?.subtle;
+    if (!found)
+        throw new Error('this terrain has no crypto.subtle: a ward needs a secure context');
+    return found;
+};
+// Web Crypto takes a buffer it owns, so every input is copied into one.
+export const own = (bytes) => Uint8Array.from(bytes);
+// The PKCS#8 wrapping of a thirty-two byte secret, which is the whole of it
+// for both curves.
+const PKCS8 = { Ed25519: '302e020100300506032b657004220420', X25519: '302e020100300506032b656e04220420' };
+export const importSecret = (curve, secret, uses) => {
+    if (secret.length !== 32)
+        throw new TypeError('a secret is thirty-two bytes');
+    const prefix = Uint8Array.from(PKCS8[curve].match(/../g), (b) => parseInt(b, 16));
+    const wrapped = new Uint8Array(48);
+    wrapped.set(prefix);
+    wrapped.set(secret, 16);
+    return subtle().importKey('pkcs8', wrapped, { name: curve }, true, uses);
+};
+// Web Crypto gives a private key's public half only through a JWK.
+export const publicOf = async (key) => {
+    const { x } = await subtle().exportKey('jwk', key);
+    const binary = atob(x.replaceAll('-', '+').replaceAll('_', '/'));
+    return Uint8Array.from(binary, (c) => c.charCodeAt(0));
+};

package/dist/crypto/x25519.d.ts

@@ -0,0 +1,2 @@
+export declare const x25519Public: (secret: Uint8Array) => Promise<Uint8Array>;
+export declare const agree: (secret: Uint8Array, pk: Uint8Array) => Promise<Uint8Array | null>;

package/dist/crypto/x25519.js

@@ -0,0 +1,21 @@
+// SPDX-License-Identifier: Apache-2.0
+// X25519 agrees. A secret is thirty-two bytes, clamped by the function and
+// never before.
+import { zero } from './bytes.js';
+import { importSecret, own, publicOf, subtle } from './subtle.js';
+export const x25519Public = async (secret) => publicOf(await importSecret('X25519', secret, ['deriveBits']));
+// The agreement, or null for a public key that takes no seal: one whose
+// agreement is thirty-two zero bytes, or one the terrain refuses to read.
+export const agree = async (secret, pk) => {
+    if (pk.length !== 32)
+        return null;
+    try {
+        const mine = await importSecret('X25519', secret, ['deriveBits']);
+        const theirs = await subtle().importKey('raw', own(pk), { name: 'X25519' }, false, []);
+        const shared = new Uint8Array(await subtle().deriveBits({ name: 'X25519', public: theirs }, mine, 256));
+        return zero(shared) ? null : shared;
+    }
+    catch {
+        return null;
+    }
+};

package/dist/folder/index.d.ts

@@ -0,0 +1,14 @@
+import { Custody, Memory, type Entropy } from '../contract/index.ts';
+export declare class FolderMemory extends Memory {
+    #private;
+    readonly root: string;
+    constructor(root: string);
+    read(place: string): Promise<Map<string, Uint8Array>>;
+    write(place: string, entries: ReadonlyMap<string, Uint8Array | null>): Promise<void>;
+}
+export declare class FolderCustody extends Custody {
+    #private;
+    readonly root: string;
+    constructor(root: string, entropy: Entropy);
+    seed(): Promise<Uint8Array>;
+}