nervur 0.20.1 → 0.20.2

package/dist/line/web.js

@@ -0,0 +1,181 @@
+import { concat, hex, isHex, unhex } from '../crypto/index.js';
+import { CarrierFaculty, UNDIALED } from '../harbor/index.js';
+import { webAddress } from '../quo/index.js';
+import { ownerAsk } from '../ward/index.js';
+import { askBody, readBody } from './frame.js';
+export const MIN_POST = 65;
+export const MAX_POST = 64 + 1_048_576;
+const MAX_ID = 0xffff_ffff;
+// Bytes on a buffer of their own, as a body and a message take them.
+const own = (bytes) => new Uint8Array(bytes);
+// One held line to one address.
+class HeldLine {
+    #socket;
+    #waiting = new Map();
+    #next = 1;
+    constructor(socket) {
+        this.#socket = socket;
+        socket.binaryType = 'arraybuffer';
+        socket.addEventListener('message', (e) => {
+            const frame = typeof e.data === 'string' ? null : readBody(new Uint8Array(e.data));
+            if (frame === null)
+                return this.close();
+            if (frame.kind === 'ask')
+                return;
+            const done = this.#waiting.get(frame.id);
+            this.#waiting.delete(frame.id);
+            done?.(frame.kind === 'reply' ? frame.box : null);
+        });
+        socket.addEventListener('close', () => {
+            for (const done of this.#waiting.values())
+                done(null);
+            this.#waiting.clear();
+        });
+    }
+    // A line that opened with the subprotocol `quo`, or null.
+    static open(href, onClose) {
+        return new Promise((resolve) => {
+            let socket;
+            try {
+                socket = new WebSocket(href, 'quo');
+            }
+            catch {
+                resolve(null);
+                return;
+            }
+            const line = new HeldLine(socket);
+            socket.addEventListener('open', () => (socket.protocol === 'quo' ? resolve(line) : (socket.close(), resolve(null))));
+            socket.addEventListener('close', () => {
+                onClose();
+                resolve(null);
+            });
+            socket.addEventListener('error', () => resolve(null));
+        });
+    }
+    ask(pk, box) {
+        if (this.#socket.readyState !== WebSocket.OPEN)
+            return Promise.resolve(null);
+        const id = this.#next;
+        this.#next = this.#next === MAX_ID ? 1 : this.#next + 1;
+        return new Promise((resolve) => {
+            this.#waiting.set(id, resolve);
+            this.#socket.send(own(askBody(id, pk, box)));
+        });
+    }
+    close() {
+        this.#socket.close();
+    }
+}
+export class WebDialer {
+    #lines = new Map();
+    dial(at, pk, bytes) {
+        const address = webAddress(at);
+        if (address === null || !isHex(pk, 64))
+            return Promise.resolve(UNDIALED);
+        return address.held ? this.#held(address, pk, bytes) : this.#post(address, pk, bytes);
+    }
+    async #post(address, pk, bytes) {
+        let response;
+        try {
+            response = await fetch(address.href, { method: 'POST', body: own(concat(unhex(pk), bytes)) });
+        }
+        catch {
+            return UNDIALED;
+        }
+        const body = new Uint8Array(await response.arrayBuffer().catch(() => new ArrayBuffer(0)));
+        return response.status === 200 && body.length > 0 ? body : null;
+    }
+    async #held(address, pk, bytes) {
+        let line = this.#lines.get(address.href);
+        if (!line) {
+            line = HeldLine.open(address.href, () => this.#lines.delete(address.href));
+            this.#lines.set(address.href, line);
+            void line.then((held) => held ?? this.#lines.delete(address.href));
+        }
+        const held = await line;
+        return held ? held.ask(unhex(pk), bytes) : UNDIALED;
+    }
+    async close() {
+        const lines = [...this.#lines.values()];
+        this.#lines.clear();
+        for (const line of await Promise.all(lines))
+            line?.close();
+    }
+}
+export const WEB = 'org.nervur.web';
+export const WEB_OPENING = { key: 'web', kind: WEB };
+const listenOf = (value) => {
+    if (typeof value !== 'object' || value === null)
+        return null;
+    const { host, port, path, origins } = value;
+    const fine = typeof host === 'string' &&
+        Number.isInteger(port) &&
+        port >= 0 &&
+        port <= 65_535 &&
+        typeof path === 'string' &&
+        path.startsWith('/') &&
+        Array.isArray(origins) &&
+        origins.every((o) => typeof o === 'string');
+    return fine ? { host, port: port, path, origins: origins } : null;
+};
+// Quo over the web as a carrier faculty of one harbor, listening through
+// `serve` where the ground has one:
+//
+//   listen  { host?, port?, path?, origins? }
+//                  listen there from now on, 127.0.0.1, a free port, `/`
+//                  and every origin unless named, and on every wake at the
+//                  port it bound
+//   deaf           listen nowhere from now on
+export const webFaculty = (serve) => (ground) => class WebFaculty extends CarrierFaculty {
+    static kind = WEB;
+    static asks = {
+        listen: ownerAsk('listen for Quo over the web, and on every wake'),
+        deaf: ownerAsk('listen nowhere'),
+    };
+    #dialer = new WebDialer();
+    #listener;
+    accepts(address) {
+        return webAddress(address) !== null;
+    }
+    dial(address, pk, bytes) {
+        return this.#dialer.dial(address, pk, bytes);
+    }
+    listening() {
+        return this.#listener ? [...this.#listener.at] : [];
+    }
+    async awake() {
+        const at = listenOf(this.cells.listen);
+        if (at && serve && !this.#listener)
+            this.#listener = await serve(ground, at);
+    }
+    async sleep() {
+        await this.#dialer.close();
+        await this.#listener?.close();
+        this.#listener = undefined;
+    }
+    async listen(args) {
+        if (!serve)
+            return { error: 'this ground listens nowhere on the web' };
+        const at = listenOf({ host: args.host ?? '127.0.0.1', port: args.port ?? 0, path: args.path ?? '/', origins: args.origins ?? ['*'] });
+        if (at === null)
+            return { error: 'host is text, port a port, path a path and origins a list' };
+        await this.#listener?.close();
+        this.#listener = undefined;
+        try {
+            this.#listener = await serve(ground, at);
+        }
+        catch (e) {
+            return { error: e.message };
+        }
+        this.cells.listen = { ...at, port: this.#listener.port };
+        return { at: [...this.#listener.at] };
+    }
+    async deaf() {
+        await this.#listener?.close();
+        this.#listener = undefined;
+        delete this.cells.listen;
+        return { deaf: true };
+    }
+};
+// The ward pk and box a post carries, or null for a body that is no ask.
+export const readPost = (body) => body.length < MIN_POST || body.length > MAX_POST ? null : { pk: hex(body.subarray(0, 64)), box: body.slice(64) };

package/dist/node/index.d.ts

@@ -0,0 +1,32 @@
+import type { JsonObject } from '../being/index.ts';
+import { Loader, type Loaded, type Module } from '../contract/index.ts';
+import { type GroundProbe, type Harbor, type RootRequest } from '../harbor/index.ts';
+import { PointerTerrain } from '../pointer/index.ts';
+export declare const NODE = "node";
+export declare const harborDir: (env?: Record<string, string | undefined>) => string;
+export declare const socketOf: (dir: string) => string;
+export declare class ImportLoader extends Loader {
+    load(from: string): Promise<Loaded | null>;
+}
+export declare class NodeLoader extends ImportLoader {
+    #private;
+    constructor(modules?: readonly Module[]);
+    load(from: string): Promise<Loaded | null>;
+}
+export declare const askServed: (dir: string, request: RootRequest) => Promise<JsonObject | undefined>;
+export type NodeParts = {
+    readonly dir: string;
+    readonly modules?: readonly Module[];
+    readonly wakes?: boolean;
+    readonly serves?: boolean;
+};
+export declare class NodeTerrain extends PointerTerrain {
+    #private;
+    readonly dir: string;
+    readonly serves: boolean;
+    constructor(parts: NodeParts);
+    claim(): Promise<void>;
+    stand(harbor: Harbor): Promise<void>;
+    release(): Promise<void>;
+}
+export declare const nodeGround: GroundProbe;

package/dist/node/index.js

@@ -0,0 +1,164 @@
+var __rewriteRelativeImportExtension = (this && this.__rewriteRelativeImportExtension) || function (path, preserveJsx) {
+    if (typeof path === "string" && /^\.\.?\//.test(path)) {
+        return path.replace(/\.(tsx)$|((?:\.d)?)((?:\.[^./]+?)?)\.([cm]?)ts$/i, function (m, tsx, d, ext, cm) {
+            return tsx ? preserveJsx ? ".jsx" : ".js" : d && (!ext || !cm) ? m : (d + ext + "." + cm.toLowerCase() + "js");
+        });
+    }
+    return path;
+};
+// SPDX-License-Identifier: Apache-2.0
+// `nervur/node`: the Node ground. A harbor keeps its seed and sealed
+// memory in a folder, finds its code among the modules it is handed and
+// then in files, speaks TCP from genesis and the web and Web Push where
+// the root opens them, and serves the root line on a local socket, so the
+// `nervur` command reaches it while it stands.
+//
+//   <dir>/seed        the harbor's seed
+//   <dir>/<place>/    its sealed memory
+//   <dir>/root.sock   the root line while the harbor is served, open to
+//                     this user alone, or in the temporary folder for a
+//                     folder too deep for a socket path
+//
+// One run holds a folder: a terrain refuses a folder another run serves.
+import { createHash } from 'node:crypto';
+import { chmod, rm } from 'node:fs/promises';
+import { connect, createServer } from 'node:net';
+import { homedir, tmpdir } from 'node:os';
+import { join, resolve } from 'node:path';
+import { pathToFileURL } from 'node:url';
+import { Loader } from '../contract/index.js';
+import { FolderCustody, FolderMemory } from '../folder/index.js';
+import { rootLine } from '../harbor/index.js';
+import { webGround } from '../http/index.js';
+import { webPush } from '../line/index.js';
+import { CryptoEntropy, HeldLoader, PointerTerrain } from '../pointer/index.js';
+import { TCP_OPENING, tcpFaculty } from '../tcp/index.js';
+export const NODE = 'node';
+// Where a harbor of this user lives unless named: $NERVUR_DIR, then
+// ~/.nervur.
+export const harborDir = (env = process.env) => env.NERVUR_DIR ?? join(homedir(), '.nervur');
+// A socket path has a hundred bytes or so on every system, so a folder too
+// deep for one puts its socket in this user's temporary folder, under a
+// name drawn from the folder's own path.
+const SOCKET_PATH = 100;
+export const socketOf = (dir) => {
+    const beside = join(resolve(dir), 'root.sock');
+    if (Buffer.byteLength(beside) <= SOCKET_PATH)
+        return beside;
+    return join(tmpdir(), `nervur-${createHash('sha256').update(resolve(dir)).digest('hex').slice(0, 32)}.sock`);
+};
+// Code from a file: a module that exports `module`, `version` and
+// `classes`, found again by its absolute path. A file that cannot be
+// imported, or exports no module, is none.
+export class ImportLoader extends Loader {
+    async load(from) {
+        const path = resolve(from);
+        let exported;
+        try {
+            exported = (await import(__rewriteRelativeImportExtension(pathToFileURL(path).href)));
+        }
+        catch {
+            return null;
+        }
+        const { module, version, classes } = exported;
+        if (typeof module !== 'string' || typeof version !== 'string' || !Array.isArray(classes))
+            return null;
+        return { module, version, classes, from: path };
+    }
+}
+// The modules a harbor is handed, by name, and then files.
+export class NodeLoader extends ImportLoader {
+    #held;
+    constructor(modules = []) {
+        super();
+        this.#held = new HeldLoader(modules);
+    }
+    async load(from) {
+        return (await this.#held.load(from)) ?? super.load(from);
+    }
+}
+// One root request over a served harbor's socket, or undefined where none
+// is served.
+export const askServed = (dir, request) => new Promise((done, fail) => {
+    const socket = connect(socketOf(dir));
+    let text = '';
+    socket.once('connect', () => socket.write(`${JSON.stringify(request)}\n`));
+    socket.on('data', (chunk) => {
+        text += chunk.toString('utf8');
+        const end = text.indexOf('\n');
+        if (end < 0)
+            return;
+        socket.end();
+        done(JSON.parse(text.slice(0, end)));
+    });
+    socket.once('error', (e) => (e.code === 'ENOENT' || e.code === 'ECONNREFUSED' ? done(undefined) : fail(e)));
+});
+export class NodeTerrain extends PointerTerrain {
+    dir;
+    serves;
+    #server;
+    constructor(parts) {
+        const entropy = new CryptoEntropy();
+        super({
+            entropy,
+            loader: new NodeLoader(parts.modules),
+            custody: new FolderCustody(parts.dir, entropy),
+            memory: new FolderMemory(parts.dir),
+            faculties: [tcpFaculty, webGround, webPush],
+            opens: [TCP_OPENING],
+            wakes: parts.wakes ?? true,
+        });
+        this.dir = parts.dir;
+        this.serves = parts.serves ?? true;
+    }
+    async claim() {
+        if ((await askServed(this.dir, {})) !== undefined)
+            throw new Error(`a harbor is already served from ${this.dir}`);
+    }
+    // The root line on the socket. A socket file nobody answers on is a
+    // stale one, and is replaced.
+    async stand(harbor) {
+        if (!this.serves)
+            return;
+        const root = socketOf(this.dir);
+        await rm(root, { force: true });
+        const server = createServer((socket) => {
+            let text = '';
+            socket.on('data', (chunk) => {
+                text += chunk.toString('utf8');
+                for (let end = text.indexOf('\n'); end >= 0; end = text.indexOf('\n')) {
+                    const line = text.slice(0, end);
+                    text = text.slice(end + 1);
+                    let value;
+                    try {
+                        value = JSON.parse(line);
+                    }
+                    catch {
+                        value = undefined;
+                    }
+                    void rootLine(harbor, value)
+                        .catch(() => ({ error: 'the harbor threw' }))
+                        .then((answer) => socket.write(`${JSON.stringify(answer)}\n`));
+                }
+            });
+            socket.on('error', () => socket.destroy());
+        });
+        await new Promise((done) => server.listen(root, done));
+        await chmod(root, 0o600);
+        this.#server = server;
+    }
+    async release() {
+        const server = this.#server;
+        if (!server)
+            return;
+        this.#server = undefined;
+        await new Promise((done) => server.close(done));
+        await rm(socketOf(this.dir), { force: true });
+    }
+}
+// Node, and the engines that answer as Node does.
+export const nodeGround = {
+    name: NODE,
+    fits: () => typeof process !== 'undefined' && typeof process.versions?.node === 'string',
+    terrain: ({ modules, where }) => new NodeTerrain({ dir: where ?? harborDir(), ...(modules ? { modules } : {}) }),
+};

package/dist/node.d.ts

@@ -0,0 +1 @@
+export * from './index.ts';

package/dist/node.js

@@ -0,0 +1,7 @@
+// SPDX-License-Identifier: Apache-2.0
+// `nervur` as Node reads it: the main entry, with the Node ground added, so
+// `Harbor.open()` keeps a harbor in a folder and serves its root line.
+import { addGround } from './harbor/index.js';
+import { nodeGround } from './node/index.js';
+export * from './index.js';
+addGround(nodeGround);

package/dist/pointer/bodies.d.ts

@@ -23,4 +23,6 @@ export declare class VolatileMemory extends Memory {
     #private;
     read(place: string): Promise<Map<string, Uint8Array>>;
     write(place: string, entries: ReadonlyMap<string, Uint8Array | null>): Promise<void>;
+    places(): Promise<string[]>;
+    forget(place: string): Promise<void>;
 }

package/dist/pointer/bodies.js

@@ -49,6 +49,7 @@ export class VolatileMemory extends Memory {
         const entries = this.#places.get(place) ?? new Map();
         return Promise.resolve(new Map([...entries].map(([name, bytes]) => [name, bytes.slice()])));
     }
+    // One object holds it, so a keep is whole by the run of one turn.
     write(place, entries) {
         let kept = this.#places.get(place);
         if (!kept)
@@ -59,6 +60,15 @@ export class VolatileMemory extends Memory {
             else
                 kept.set(name, bytes.slice());
         }
+        if (kept.size === 0)
+            this.#places.delete(place);
+        return Promise.resolve();
+    }
+    places() {
+        return Promise.resolve([...this.#places.keys()]);
+    }
+    forget(place) {
+        this.#places.delete(place);
         return Promise.resolve();
     }
 }

package/dist/pointer/world.d.ts

@@ -1,5 +1,5 @@
 import { Carrier, type Clock, type Custody, type Entropy, type Loader, type Memory, type Module } from '../contract/index.ts';
-import { Harbor, Terrain } from '../harbor/index.ts';
+import { Harbor, Terrain, type GroundFaculty, type Opening } from '../harbor/index.ts';
 export declare class NoCarrier extends Carrier {
     carry(): Promise<Uint8Array | null>;
 }
@@ -15,6 +15,9 @@ export type PointerParts = {
     memory?: Memory;
     carrier?: Carrier;
     loader?: Loader;
+    faculties?: readonly GroundFaculty[];
+    opens?: readonly Opening[];
+    wakes?: boolean;
 };
 export declare class PointerTerrain extends Terrain {
     readonly entropy: Entropy;
@@ -23,6 +26,9 @@ export declare class PointerTerrain extends Terrain {
     readonly memory: Memory;
     readonly carrier: Carrier;
     readonly loader: Loader;
+    readonly faculties: readonly GroundFaculty[];
+    readonly opens: readonly Opening[];
+    readonly wakes: boolean;
     constructor(parts?: PointerParts);
 }
 export declare class World {

package/dist/pointer/world.js

@@ -30,6 +30,9 @@ export class PointerTerrain extends Terrain {
     memory;
     carrier;
     loader;
+    faculties;
+    opens;
+    wakes;
     constructor(parts = {}) {
         super();
         this.entropy = parts.entropy ?? new CryptoEntropy();
@@ -38,6 +41,9 @@ export class PointerTerrain extends Terrain {
         this.memory = parts.memory ?? new VolatileMemory();
         this.carrier = parts.carrier ?? new NoCarrier();
         this.loader = parts.loader ?? new HeldLoader();
+        this.faculties = parts.faculties ?? [];
+        this.opens = parts.opens ?? [];
+        this.wakes = parts.wakes ?? true;
     }
 }
 export class World {

package/dist/quo/address.d.ts

@@ -0,0 +1,19 @@
+export declare const schemeOf: (s: unknown) => string | null;
+export type TcpAddress = {
+    host: string;
+    port: number;
+};
+export declare const tcpAddress: (s: unknown) => TcpAddress | null;
+export declare const tcpAt: (host: string, port: number) => string;
+export type WebAddress = {
+    scheme: 'http' | 'https' | 'ws' | 'wss';
+    secure: boolean;
+    held: boolean;
+    host: string;
+    port: number;
+    path: string;
+    href: string;
+};
+export declare const webAddress: (s: unknown) => WebAddress | null;
+export declare const unspecified: (s: unknown) => boolean;
+export declare const readAt: (value: unknown) => string[];

package/dist/quo/address.js

@@ -0,0 +1,84 @@
+// SPDX-License-Identifier: Apache-2.0
+// Addresses, as `SPEC.md` names them in an invitation's `at`: a URI of
+// RFC 3986 whose scheme, read in any case, names a carrier.
+// `CARRIER-TCP.md` writes `tcp://host:port`, and `CARRIER-WEB.md` writes
+// `http` and `https` for the post and `ws` and `wss` for the held line.
+// RFC 3986 appendix B, with the characters a URI may hold checked apart.
+const SPLIT = /^(?:([^:/?#]+):)?(?:\/\/([^/?#]*))?([^?#]*)(?:\?([^#]*))?(?:#(.*))?$/;
+const URI_CHARS = /^(?:[A-Za-z0-9\-._~:/?#[\]@!$&'()*+,;=]|%[0-9A-Fa-f]{2})*$/;
+const SCHEME = /^[A-Za-z][A-Za-z0-9+.-]*$/;
+const REG_NAME = /^(?:[A-Za-z0-9\-._~!$&'()*+,;=]|%[0-9A-Fa-f]{2})*$/;
+const IP_LITERAL = /^\[(?:[0-9A-Fa-f:.]+|v[0-9A-Fa-f]+\.[A-Za-z0-9\-._~!$&'()*+,;=:]+)\]$/;
+// A URI with a scheme, taken apart, or null. `host` is as written,
+// brackets included, and `port` the digits as written.
+const parse = (s) => {
+    if (typeof s !== 'string' || !URI_CHARS.test(s))
+        return null;
+    const m = SPLIT.exec(s);
+    if (!m || m[1] === undefined || !SCHEME.test(m[1]))
+        return null;
+    const out = { scheme: m[1].toLowerCase(), authority: m[2] ?? null, userinfo: null, host: null, port: null, path: m[3] ?? '', query: m[4] ?? null, fragment: m[5] ?? null };
+    if (out.authority === null)
+        return out;
+    let rest = out.authority;
+    const at = rest.lastIndexOf('@');
+    if (at >= 0) {
+        out.userinfo = rest.slice(0, at);
+        rest = rest.slice(at + 1);
+    }
+    const hp = /^(\[[^\]]*\]|[^:[\]]*)(?::([0-9]*))?$/.exec(rest);
+    if (!hp)
+        return null;
+    const host = hp[1];
+    if (host.startsWith('[') ? !IP_LITERAL.test(host) : !REG_NAME.test(host))
+        return null;
+    out.host = host;
+    out.port = hp[2] ?? null;
+    return out;
+};
+// The host as a socket takes it: an IPv6 literal without its brackets.
+const bare = (host) => (host.startsWith('[') ? host.slice(1, -1) : host);
+// The scheme an address names, lowercase, or null for what is no URI.
+export const schemeOf = (s) => parse(s)?.scheme ?? null;
+// A `tcp` address as `CARRIER-TCP.md` writes one, or null.
+export const tcpAddress = (s) => {
+    const a = parse(s);
+    if (!a || a.scheme !== 'tcp' || a.authority === null)
+        return null;
+    if (a.userinfo !== null || a.path !== '' || a.query !== null || a.fragment !== null)
+        return null;
+    if (!a.host || a.port === null || !/^[0-9]+$/.test(a.port))
+        return null;
+    const port = Number(a.port);
+    if (port < 1 || port > 65_535)
+        return null;
+    return { host: bare(a.host), port };
+};
+// The `tcp` address of a host and port.
+export const tcpAt = (host, port) => `tcp://${host.includes(':') ? `[${host}]` : host}:${port}`;
+const WEB = new Set(['http', 'https', 'ws', 'wss']);
+// An address of `CARRIER-WEB.md`, or null. `path` is the path and query
+// a request names, `/` when both are empty.
+export const webAddress = (s) => {
+    const a = parse(s);
+    if (!a || !WEB.has(a.scheme) || a.authority === null)
+        return null;
+    if (a.userinfo !== null || a.fragment !== null || !a.host)
+        return null;
+    if (a.port !== null && a.port !== '' && (!/^[0-9]+$/.test(a.port) || Number(a.port) > 65_535))
+        return null;
+    const scheme = a.scheme;
+    const secure = scheme === 'https' || scheme === 'wss';
+    const port = a.port ? Number(a.port) : secure ? 443 : 80;
+    const path = `${a.path || '/'}${a.query !== null ? `?${a.query}` : ''}`;
+    return { scheme, secure, held: scheme === 'ws' || scheme === 'wss', host: bare(a.host), port, path, href: s };
+};
+// Whether a tcp or web address names the unspecified host, where a
+// listener binds every interface and no caller can dial.
+export const unspecified = (s) => {
+    const host = (tcpAddress(s) ?? webAddress(s))?.host;
+    return host === '0.0.0.0' || host === '::';
+};
+// An invitation's `at` as `SPEC.md` reads it: the strings that are URIs
+// with a scheme, in their order. A value that is no array is absent.
+export const readAt = (value) => (Array.isArray(value) ? value.filter((s) => parse(s) !== null) : []);

package/dist/quo/door.d.ts

@@ -25,7 +25,7 @@ export declare class Door {
     readonly behind: Behind;
     readonly draw: Draw;
     constructor(key: WardKey, relations: Relations, behind: Behind, draw: Draw);
-    invite(): Promise<{
+    invite(at?: readonly string[]): Promise<{
         heir: string;
         invitation: Invitation;
     }>;

package/dist/quo/door.js

@@ -24,13 +24,15 @@ export class Door {
     }
     // A new heir, held fresh, and its invitation. The lock is drawn at the
     // first invitation that names an heir, before the heir's secret.
-    async invite() {
+    // A new heir, and its invitation, naming in `at` the addresses given.
+    async invite(at = []) {
         let lock = this.relations.lock();
         if (!lock)
             this.relations.setLock((lock = drawLock(this.draw)));
         const heir = await SigningKey.draw(this.draw);
         this.relations.set(heir.id, { state: 'fresh' });
-        return { heir: heir.id, invitation: { ward: this.key.pk, heir: heir.id, secret: hex(heir.secret), lock: hex(lock.ek) } };
+        const invitation = { ward: this.key.pk, heir: heir.id, secret: hex(heir.secret), lock: hex(lock.ek), ...(at.length > 0 ? { at: [...at] } : {}) };
+        return { heir: heir.id, invitation };
     }
     // The door stops holding an heir. A fresh one leaves nothing, a spent one
     // leaves the keys kept at removal.

package/dist/quo/index.d.ts

@@ -1,3 +1,4 @@
+export { readAt, schemeOf, tcpAddress, tcpAt, unspecified, webAddress, type TcpAddress, type WebAddress } from './address.ts';
 export { Door, SPAN, type Behind, type Choice, type Judged } from './door.ts';
 export { readInvitation, type Invitation } from './invitation.ts';
 export { Ephemeral, SigningKey, WardKey, type Draw } from './keys.ts';

package/dist/quo/index.js

@@ -1,6 +1,7 @@
 // SPDX-License-Identifier: Apache-2.0
 // Quo's wire: keys, the invitation, the payload, the reply, the boxes, the
 // door and the standing. It knows no being, no ward and no terrain.
+export { readAt, schemeOf, tcpAddress, tcpAt, unspecified, webAddress } from './address.js';
 export { Door, SPAN } from './door.js';
 export { readInvitation } from './invitation.js';
 export { Ephemeral, SigningKey, WardKey } from './keys.js';

package/dist/quo/invitation.d.ts

@@ -3,5 +3,6 @@ export type Invitation = {
     readonly heir: string;
     readonly secret: string;
     readonly lock: string;
+    readonly at?: string[];
 };
 export declare const readInvitation: (value: unknown) => Invitation | null;

package/dist/quo/invitation.js

@@ -1,15 +1,19 @@
 // SPDX-License-Identifier: Apache-2.0
-// The invitation: `{ ward, heir, secret, lock }`, a value with no route.
+// The invitation: `{ ward, heir, secret, lock, at? }`. A door reads no
+// route from it; `at`, when present, names where the ward is reached.
 import { EK, encapsulate, isHex, unhex } from '../crypto/index.js';
-// An invitation, or null for any other shape. A field beside the four is
-// ignored, and the lock is held to the modulus check.
+import { readAt } from './address.js';
+// An invitation, or null for any other shape. A field beside the five is
+// ignored, the lock is held to the modulus check, and `at` keeps the
+// addresses it holds, an `at` with none or of another shape being absent.
 export const readInvitation = (value) => {
     if (typeof value !== 'object' || value === null || Array.isArray(value))
         return null;
-    const { ward, heir, secret, lock } = value;
+    const { ward, heir, secret, lock, at } = value;
     if (!isHex(ward, 64) || !isHex(heir, 32) || !isHex(secret, 32) || !isHex(lock, EK))
         return null;
     if (encapsulate(unhex(lock), new Uint8Array(32)) === null)
         return null;
-    return { ward, heir, secret, lock };
+    const addresses = readAt(at);
+    return { ward, heir, secret, lock, ...(addresses.length > 0 ? { at: addresses } : {}) };
 };

package/dist/tcp/frame.d.ts

@@ -23,7 +23,3 @@ export declare class FrameReader {
     get bad(): boolean;
     push(chunk: Uint8Array): Frame[];
 }
-export declare const parseAt: (at: unknown) => {
-    host: string;
-    port: number;
-} | null;