nervur 0.20.1 → 0.20.3

package/dist/edge/index.js

@@ -0,0 +1,334 @@
+var __rewriteRelativeImportExtension = (this && this.__rewriteRelativeImportExtension) || function (path, preserveJsx) {
+    if (typeof path === "string" && /^\.\.?\//.test(path)) {
+        return path.replace(/\.(tsx)$|((?:\.d)?)((?:\.[^./]+?)?)\.([cm]?)ts$/i, function (m, tsx, d, ext, cm) {
+            return tsx ? preserveJsx ? ".jsx" : ".js" : d && (!ext || !cm) ? m : (d + ext + "." + cm.toLowerCase() + "js");
+        });
+    }
+    return path;
+};
+import { Custody, Memory } from '../contract/index.js';
+import { decrypt, encrypt, hkdf, isHex, unhex, utf8 } from '../crypto/index.js';
+import { addGround, CarrierFaculty, Harbor, landPlaces, UNDIALED } from '../harbor/index.js';
+import { answerHeld, answerPost, askFrame, FrameReader, TCP, TCP_OPENING, WEB_OPENING, webFaculty, webPush } from '../line/index.js';
+import { CryptoEntropy, HeldLoader, PointerTerrain } from '../pointer/index.js';
+import { tcpAddress, tcpAt } from '../quo/index.js';
+import { ownerAsk } from '../ward/index.js';
+export const EDGE = 'edge';
+const ENTRY = 'm/';
+const SEED = 'c/seed';
+// The most keys one storage call takes.
+const BATCH = 128;
+const SEAL_INFO = utf8('nervur edge custody');
+const MAX_ID = 0xffff_ffff;
+const chunks = (items) => Array.from({ length: Math.ceil(items.length / BATCH) }, (_, i) => items.slice(i * BATCH, (i + 1) * BATCH));
+const bytesOf = (value) => new Uint8Array(value instanceof ArrayBuffer ? value : value);
+// A body keeps its keys under `root`, so one object may hold more than one
+// keeping.
+export class EdgeMemory extends Memory {
+    #storage;
+    #entry;
+    constructor(storage, root = '') {
+        super();
+        this.#storage = storage;
+        this.#entry = `${root}${ENTRY}`;
+    }
+    async read(place) {
+        const prefix = `${this.#entry}${place}/`;
+        const listed = await this.#storage.list({ prefix });
+        return new Map([...listed].map(([key, value]) => [key.slice(prefix.length), bytesOf(value).slice()]));
+    }
+    write(place, entries) {
+        const put = [];
+        const gone = [];
+        for (const [name, bytes] of entries) {
+            if (bytes === null)
+                gone.push(`${this.#entry}${place}/${name}`);
+            else
+                put.push([`${this.#entry}${place}/${name}`, bytes.slice()]);
+        }
+        return this.#storage.transaction(async (txn) => {
+            for (const batch of chunks(put))
+                await txn.put(Object.fromEntries(batch));
+            for (const batch of chunks(gone))
+                await txn.delete(batch);
+        });
+    }
+    async places() {
+        const entry = this.#entry;
+        const keys = [...(await this.#storage.list({ prefix: entry })).keys()];
+        return [...new Set(keys.map((key) => key.slice(entry.length, key.indexOf('/', entry.length))))];
+    }
+    async forget(place) {
+        const keys = [...(await this.#storage.list({ prefix: `${this.#entry}${place}/` })).keys()];
+        await this.#storage.transaction(async (txn) => {
+            for (const batch of chunks(keys))
+                await txn.delete(batch);
+        });
+    }
+}
+export class EdgeCustody extends Custody {
+    #storage;
+    #keys;
+    #entropy;
+    #key;
+    constructor(storage, keys, entropy = new CryptoEntropy(), root = '') {
+        super();
+        this.#storage = storage;
+        this.#keys = keys;
+        this.#entropy = entropy;
+        this.#key = `${root}${SEED}`;
+    }
+    async seed() {
+        const { seed: named, secret } = this.#keys;
+        if (named !== undefined) {
+            if (!isHex(named.trim(), 32))
+                throw new Error('NERVUR_SEED is not 64 hex');
+            return unhex(named.trim());
+        }
+        if (!secret)
+            throw new Error('the worker holds no NERVUR_SECRET');
+        const key = await hkdf(utf8(secret), SEAL_INFO, 32);
+        return this.#storage.transaction(async (txn) => {
+            const kept = (await txn.get(this.#key));
+            if (kept) {
+                const seed = await decrypt(key, bytesOf(kept.nonce), new Uint8Array(0), bytesOf(kept.sealed));
+                if (seed === null)
+                    throw new Error('the seed does not open under this NERVUR_SECRET');
+                return seed;
+            }
+            const seed = this.#entropy.draw(32);
+            const nonce = this.#entropy.draw(12);
+            await txn.put({ [this.#key]: { nonce, sealed: await encrypt(key, nonce, new Uint8Array(0), seed) } });
+            return seed.slice();
+        });
+    }
+}
+class EdgeLine {
+    #socket;
+    #writer;
+    #waiting = new Map();
+    #next = 1;
+    #closed = false;
+    constructor(socket, onClose) {
+        this.#socket = socket;
+        this.#writer = socket.writable.getWriter();
+        const reader = new FrameReader();
+        void (async () => {
+            try {
+                for await (const chunk of socket.readable) {
+                    for (const frame of reader.push(new Uint8Array(chunk))) {
+                        if (frame.kind === 'ask')
+                            continue;
+                        const done = this.#waiting.get(frame.id);
+                        this.#waiting.delete(frame.id);
+                        done?.(frame.kind === 'reply' ? frame.box : null);
+                    }
+                    if (reader.bad)
+                        break;
+                }
+            }
+            catch {
+                // A line that broke answers nothing more.
+            }
+            this.#closed = true;
+            onClose();
+            for (const done of this.#waiting.values())
+                done(null);
+            this.#waiting.clear();
+            await socket.close().catch(() => undefined);
+        })();
+    }
+    ask(pk, box) {
+        if (this.#closed)
+            return Promise.resolve(null);
+        const id = this.#next;
+        this.#next = this.#next === MAX_ID ? 1 : this.#next + 1;
+        return new Promise((resolve) => {
+            this.#waiting.set(id, resolve);
+            this.#writer.write(askFrame(id, pk, box)).catch(() => resolve(null));
+        });
+    }
+    close() {
+        this.#closed = true;
+        return this.#socket.close().catch(() => undefined);
+    }
+}
+const sockets = 'cloudflare:sockets';
+const connector = async () => {
+    try {
+        return (await import(__rewriteRelativeImportExtension(/* @vite-ignore */ sockets))).connect;
+    }
+    catch {
+        return null;
+    }
+};
+// Quo over TCP from a worker: it dials, and takes no inbound TCP.
+export const edgeTcp = () => class EdgeTcp extends CarrierFaculty {
+    static kind = TCP;
+    static asks = {
+        listen: ownerAsk('an edge takes no inbound TCP'),
+        deaf: ownerAsk('listen nowhere'),
+    };
+    #lines = new Map();
+    accepts(address) {
+        return tcpAddress(address) !== null;
+    }
+    async dial(address, pk, bytes) {
+        const at = tcpAddress(address);
+        if (at === null || !isHex(pk, 64))
+            return UNDIALED;
+        const line = await this.#line(at);
+        return line ? line.ask(unhex(pk), bytes) : UNDIALED;
+    }
+    #line({ host, port }) {
+        const at = tcpAt(host, port);
+        let line = this.#lines.get(at);
+        if (!line) {
+            line = (async () => {
+                const connect = await connector();
+                if (!connect)
+                    return null;
+                try {
+                    const socket = connect({ hostname: host, port });
+                    await socket.opened;
+                    return new EdgeLine(socket, () => this.#lines.delete(at));
+                }
+                catch {
+                    return null;
+                }
+            })();
+            this.#lines.set(at, line);
+            void line.then((open) => open ?? this.#lines.delete(at));
+        }
+        return line;
+    }
+    async sleep() {
+        const lines = [...this.#lines.values()];
+        this.#lines.clear();
+        for (const line of await Promise.all(lines))
+            await line?.close();
+    }
+    listen() {
+        return { error: 'an edge takes no inbound TCP' };
+    }
+    deaf() {
+        return { deaf: true };
+    }
+};
+// Where the edge's web carrier listens: the object's own requests, at the
+// host and path its cells name. A port of 0 is the edge's own https.
+const edgeServe = (ground, listen) => {
+    const terrain = ground.terrain;
+    if (!(terrain instanceof EdgeTerrain))
+        return Promise.reject(new Error('this harbor stands on no edge'));
+    terrain.listening = listen;
+    const authority = listen.port === 0 ? listen.host : `${tcpAt(listen.host, listen.port).slice('tcp://'.length)}`;
+    const [post, held] = listen.port === 0 ? ['https', 'wss'] : ['http', 'ws'];
+    return Promise.resolve({
+        port: listen.port,
+        at: [`${post}://${authority}${listen.path}`, `${held}://${authority}${listen.path}`],
+        close: () => {
+            if (terrain.listening === listen)
+                terrain.listening = undefined;
+            return Promise.resolve();
+        },
+    });
+};
+export class EdgeTerrain extends PointerTerrain {
+    given;
+    // Where the web carrier listens now, as the object answers requests.
+    listening;
+    #harbor;
+    constructor(parts) {
+        const entropy = new CryptoEntropy();
+        const { storage } = parts.given.state;
+        super({
+            entropy,
+            loader: new HeldLoader(parts.modules ?? []),
+            // Only a harbor carried here takes the worker's NERVUR_SEED; every
+            // other object of the worker draws its own.
+            custody: new EdgeCustody(storage, { seed: parts.given.package ? parts.given.env.NERVUR_SEED : undefined, secret: parts.given.env.NERVUR_SECRET }, entropy),
+            memory: new EdgeMemory(storage),
+            faculties: [edgeTcp, webFaculty(edgeServe), webPush],
+            opens: [TCP_OPENING, WEB_OPENING],
+        });
+        this.given = parts.given;
+    }
+    // A carried package lands where the object keeps nothing yet, and only
+    // under the seed it was sealed with, the worker's `NERVUR_SEED`.
+    async claim() {
+        const { package: carried, env } = this.given;
+        if (!carried || (await this.memory.places()).length > 0)
+            return;
+        if (env.NERVUR_SEED === undefined)
+            throw new Error('a carried package opens only under NERVUR_SEED');
+        await landPlaces(this.memory, carried);
+    }
+    stand(harbor) {
+        this.#harbor = harbor;
+        return Promise.resolve();
+    }
+    // One request to the object: a post, or a held line opened, where the
+    // web carrier listens.
+    answer(request) {
+        const listen = this.listening;
+        const harbor = this.#harbor;
+        if (!listen || !harbor)
+            return Promise.resolve(new Response(null, { status: 404 }));
+        if (request.headers.get('upgrade')?.toLowerCase() !== 'websocket')
+            return answerPost(harbor, listen, request);
+        const offered = (request.headers.get('sec-websocket-protocol') ?? '').split(',').map((p) => p.trim());
+        if (new URL(request.url).pathname !== listen.path || !offered.includes('quo'))
+            return Promise.resolve(new Response(null, { status: 400 }));
+        const Pair = globalThis.WebSocketPair;
+        const pair = new Pair();
+        const [client, server] = [pair[0], pair[1]];
+        server.accept();
+        const side = { send: (body) => server.send(new Uint8Array(body)), close: () => server.close() };
+        server.addEventListener('message', (event) => answerHeld(harbor, side, typeof event.data === 'string' ? event.data : new Uint8Array(event.data)));
+        return Promise.resolve(new Response(null, { status: 101, webSocket: client, headers: { 'sec-websocket-protocol': 'quo' } }));
+    }
+}
+const isGiven = (value) => {
+    const given = value;
+    return typeof given?.state?.storage?.transaction === 'function' && typeof given.env === 'object';
+};
+// A harbor handed a Durable Object's state and environment.
+export const edgeGround = {
+    name: EDGE,
+    fits: ({ given }) => isGiven(given),
+    terrain: ({ given, modules }) => new EdgeTerrain({ given: given, ...(modules ? { modules } : {}) }),
+};
+// A Durable Object class whose every instance is one harbor: opened once
+// per object, its web carrier opened, and every request it receives
+// answered by that carrier at `path`.
+export const harborObject = ({ modules, package: carried, path = '/quo', stood }) => class HarborObject {
+    #opening;
+    // The object's harbor, once it stands.
+    get harbor() {
+        return this.#opening;
+    }
+    constructor(state, env) {
+        addGround(edgeGround);
+        const held = typeof carried === 'function' ? carried(env) : carried;
+        const given = { state, env, ...(held ? { package: held } : {}) };
+        // Opened inside the object's block, so no request reaches it half
+        // open and its storage answers the opening.
+        this.#opening = state.blockConcurrencyWhile(async () => {
+            const harbor = await Harbor.open({ modules, given });
+            if (!harbor.box.being(WEB_OPENING.key))
+                await harbor.root('open', { key: WEB_OPENING.key, class: WEB_OPENING.kind });
+            await stood?.(harbor);
+            return harbor;
+        });
+    }
+    async fetch(request) {
+        const harbor = await this.#opening;
+        const terrain = harbor.terrain;
+        if (terrain.listening?.path !== path) {
+            const url = new URL(request.url);
+            await harbor.root('ask', { being: WEB_OPENING.key, method: 'listen', args: { host: url.hostname, port: url.port === '' ? 0 : Number(url.port), path } });
+        }
+        return terrain.answer(request);
+    }
+};

package/dist/edge.d.ts

@@ -0,0 +1 @@
+export * from './index.ts';

package/dist/edge.js

@@ -0,0 +1,8 @@
+// SPDX-License-Identifier: Apache-2.0
+// `nervur` as a Workers bundle reads it: the main entry, with the edge
+// ground added, so `Harbor.open({ given: { state, env } })` in a Durable
+// Object keeps a harbor in its storage.
+import { edgeGround } from './edge/index.js';
+import { addGround } from './harbor/index.js';
+export * from './index.js';
+addGround(edgeGround);

package/dist/folder/index.d.ts

@@ -1,10 +1,14 @@
 import { Custody, Memory, type Entropy } from '../contract/index.ts';
+export type Keep = Record<string, string | null>;
 export declare class FolderMemory extends Memory {
     #private;
     readonly root: string;
     constructor(root: string);
     read(place: string): Promise<Map<string, Uint8Array>>;
     write(place: string, entries: ReadonlyMap<string, Uint8Array | null>): Promise<void>;
+    places(): Promise<string[]>;
+    forget(place: string): Promise<void>;
+    protected apply(dir: string, keep?: Keep): Promise<void>;
 }
 export declare class FolderCustody extends Custody {
     #private;

package/dist/folder/index.js

@@ -4,17 +4,26 @@
 //
 //   <root>/seed              the harbor's seed, as hex
 //   <root>/<place>/<entry>   one sealed entry of the harbor's memory
+//   <root>/<place>/keep      a keep of that place, until it is applied
 //
 // Places and entries are the hex names the kit chose, so no name reaches
 // outside its folder, and the disk shows no ward's name. A file is written
-// whole, beside itself and then renamed over, so a crash leaves the last
-// kept copy. The seed is a plain file: custody that seals it is a
-// terrain's, in the dock.
+// whole, beside itself and then renamed over.
+//
+// A keep is whole, by its own file: the whole keep is written under `keep`
+// and renamed over, then its entries are written and removed one by one,
+// then `keep` goes. A read applies a `keep` it finds first, and the same
+// bytes written twice leave the same place, so a keep that a crash cut
+// short finishes at the next read. A place read before its `keep` landed
+// has none of it. `keep` is no hex name, so it is never an entry.
+//
+// The seed is a plain file: custody that seals it is a terrain's.
 import { mkdir, readdir, readFile, rename, rm, writeFile } from 'node:fs/promises';
 import { join } from 'node:path';
 import { hex, isHex, unhex } from '../crypto/index.js';
 import { Custody, Memory } from '../contract/index.js';
 const missing = (e) => e.code === 'ENOENT';
+const KEEP = 'keep';
 const named = (name) => {
     if (!isHex(name) || name === '')
         throw new Error(`${name} is not a name the kit chose`);
@@ -31,10 +40,12 @@ export class FolderMemory extends Memory {
         super();
         this.root = root;
     }
-    // The entries as the disk holds them now. A file that is not an entry,
-    // one still being written among them, is not read.
+    // The entries as the disk holds them now, a keep left unapplied first.
+    // A file that is not an entry, one still being written among them, is
+    // not read.
     async read(place) {
         const dir = join(this.root, named(place));
+        await this.apply(dir);
         const out = new Map();
         const files = await readdir(dir, { withFileTypes: true }).catch((e) => (missing(e) ? [] : Promise.reject(e)));
         for (const file of files) {
@@ -44,22 +55,46 @@ export class FolderMemory extends Memory {
         }
         return out;
     }
-    // One keep at a time, each entry in the order given.
+    // One keep at a time, written whole under `keep` before any entry moves.
     async write(place, entries) {
         const dir = join(this.root, named(place));
+        const keep = {};
+        for (const [name, bytes] of entries)
+            keep[named(name)] = bytes === null ? null : hex(bytes);
         const kept = this.#line.then(async () => {
             await mkdir(dir, { recursive: true, mode: 0o700 });
-            for (const [name, bytes] of entries) {
-                const path = join(dir, named(name));
-                if (bytes === null)
-                    await rm(path, { force: true });
-                else
-                    await writeWhole(path, bytes);
-            }
+            await writeWhole(join(dir, KEEP), JSON.stringify(keep));
+            await this.apply(dir, keep);
         });
         this.#line = kept.catch(() => undefined);
         await kept;
     }
+    // Every folder of the root that is a place.
+    async places() {
+        const files = await readdir(this.root, { withFileTypes: true }).catch((e) => (missing(e) ? [] : Promise.reject(e)));
+        return files.filter((f) => f.isDirectory() && isHex(f.name) && f.name !== '').map((f) => f.name);
+    }
+    forget(place) {
+        return rm(join(this.root, named(place)), { recursive: true, force: true });
+    }
+    // The keep a folder holds, applied and then gone. Writing the same bytes
+    // again leaves the same place, so applying twice is applying once.
+    async apply(dir, keep) {
+        const found = keep ?? (await readFile(join(dir, KEEP), 'utf8').then((text) => JSON.parse(text), () => null));
+        if (found === null)
+            return;
+        for (const [name, written] of Object.entries(found)) {
+            const path = join(dir, named(name));
+            if (written === null)
+                await rm(path, { force: true });
+            else
+                await writeWhole(path, unhex(written));
+        }
+        await rm(join(dir, KEEP), { force: true });
+        const left = await readdir(dir).catch((e) => (missing(e) ? [] : Promise.reject(e)));
+        if (left.length === 0)
+            await rm(dir, { recursive: true, force: true });
+    }
 }
 export class FolderCustody extends Custody {
     root;
@@ -70,6 +105,7 @@ export class FolderCustody extends Custody {
         this.#entropy = entropy;
     }
     // The seed the folder holds, or a drawn one written there the first time.
+    // Two first asks at once keep the one written first.
     async seed() {
         const path = join(this.root, 'seed');
         const kept = await readFile(path, 'utf8').catch((e) => (missing(e) ? undefined : Promise.reject(e)));
@@ -81,7 +117,14 @@ export class FolderCustody extends Custody {
         }
         const seed = this.#entropy.draw(32);
         await mkdir(this.root, { recursive: true, mode: 0o700 });
-        await writeFile(path, `${hex(seed)}\n`, { mode: 0o600, flag: 'wx' });
+        try {
+            await writeFile(path, `${hex(seed)}\n`, { mode: 0o600, flag: 'wx' });
+        }
+        catch (e) {
+            if (e.code === 'EEXIST')
+                return this.seed();
+            throw e;
+        }
         return seed;
     }
 }

package/dist/harbor/carrying.d.ts

@@ -0,0 +1,17 @@
+import { Faculty, type BeingClass } from '../being/index.ts';
+export interface Ground {
+    arrive(pk: string, bytes: Uint8Array): Promise<Uint8Array | null>;
+}
+export type GroundFaculty = (ground: Ground) => BeingClass;
+export declare const UNDIALED: unique symbol;
+export type Dialed = Uint8Array | null | typeof UNDIALED;
+export declare abstract class CarrierFaculty extends Faculty {
+    static readonly kind: string;
+    abstract accepts(address: string): boolean;
+    abstract dial(address: string, pk: string, bytes: Uint8Array): Promise<Dialed>;
+    listening(): string[];
+    relays(_pk: string): boolean;
+    relay(_pk: string, _bytes: Uint8Array): Promise<Uint8Array | null>;
+    awake(): Promise<void>;
+    sleep(): Promise<void>;
+}

package/dist/harbor/carrying.js

@@ -0,0 +1,38 @@
+// SPDX-License-Identifier: Apache-2.0
+// A carrier is a faculty. It speaks the schemes of the addresses it dials,
+// dials an address when the harbor carries a box there, and listens where
+// its cells say, handing each box it hears to the harbor. The harbor keeps
+// every route and walks it in order, handing each address to the carrier
+// that speaks its scheme.
+//
+// A ground ships its carriers as classes the terrain names, each made for
+// one harbor, so the class holds the harbor it hands boxes to. They are
+// the kit's, of kinds under `org.nervur.`, and the dock opens them as
+// faculties, at genesis where the terrain says, and on the root's `open`.
+import { Faculty } from '../being/index.js';
+// Beside a reply and nothing, a dial answers `undialed` when the address
+// could not be reached at all, so the harbor tries the next one. A box a
+// line took may have been heard, so after it no other address is tried.
+export const UNDIALED = Symbol('undialed');
+export class CarrierFaculty extends Faculty {
+    static kind = 'org.nervur.carrier';
+    // The addresses it listens at now.
+    listening() {
+        return [];
+    }
+    // Whether it answers for a ward pk no door of this harbor holds, as a
+    // relay does, and its answer.
+    relays(_pk) {
+        return false;
+    }
+    relay(_pk, _bytes) {
+        return Promise.resolve(null);
+    }
+    // Once the harbor has unpacked, and once before it closes.
+    awake() {
+        return Promise.resolve();
+    }
+    sleep() {
+        return Promise.resolve();
+    }
+}

package/dist/harbor/catalogue.d.ts

@@ -4,9 +4,11 @@ export declare const CATALOGUE = "catalogue";
 export type ModuleRow = {
     version: string;
     from: string;
+    kinds: string[];
 };
 export interface Cataloguing {
     load(from: string): Promise<Loaded | null>;
+    check(modules: readonly Loaded[]): string | null;
     run(modules: readonly Loaded[]): string | null;
     stands(kinds: readonly string[]): boolean;
     kindsOf(module: string): string[];

package/dist/harbor/catalogue.js

@@ -2,13 +2,16 @@
 // The catalogue: the dock's first faculty, the code a harbor runs. Her
 // cells name each module by the name it declares, its version, and where
 // the terrain's loader finds it. The harbor wakes her before any other
-// faculty, loads every module she names, and refuses to stand when one is
-// missing.
+// faculty, and she runs every module she names that is found and splits
+// no kind. One that is not stays out alone, with its reason, and the
+// beings of its kinds stand absent.
 //
 //   add     { from }      the module the loader finds there, run from now
 //                         on; the same module again takes its new version
-//   remove  { module }    a module no being stands on, run no more
-//   modules               what she names, each with the version running
+//   remove  { module }    a module no being stands on, by the kinds kept
+//                         for it, run no more
+//   modules               what she names, each with the version running,
+//                         and why one does not run
 //
 // She is the kit's, of kind `org.nervur.catalogue`, and answers the root
 // and an owner alone.
@@ -26,6 +29,7 @@ export class Catalogue extends Faculty {
     };
     #harbor;
     #running = new Map();
+    #failed = new Map();
     constructor(stance, harbor) {
         super(stance);
         this.#harbor = harbor;
@@ -33,20 +37,19 @@ export class Catalogue extends Faculty {
     get #rows() {
         return this.cells.modules;
     }
-    // Every module her cells name, loaded and run, or a throw naming the one
-    // that cannot be.
+    // Every module her cells name, in their order, loaded and run where it
+    // is found, is the module named, and splits no kind with those before
+    // it. The rest stay out, each with its reason.
     async wake() {
         for (const [module, row] of Object.entries(this.#rows)) {
-            const loaded = await this.#harbor.load(row.from);
-            if (loaded === null)
-                throw new Error(`module ${module} is not found at ${row.from}`);
-            if (loaded.module !== module)
-                throw new Error(`${row.from} is module ${loaded.module}, not ${module}`);
-            this.#running.set(module, loaded);
+            const loaded = await this.#harbor.load(row.from).catch(() => null);
+            const refused = loaded === null ? `not found at ${row.from}` : loaded.module !== module ? `${row.from} is module ${loaded.module}` : this.#harbor.check([...this.#running.values(), loaded]);
+            if (refused === null)
+                this.#running.set(module, loaded);
+            else
+                this.#failed.set(module, refused);
         }
-        const refused = this.#harbor.run([...this.#running.values()]);
-        if (refused !== null)
-            throw new Error(refused);
+        this.#harbor.run([...this.#running.values()]);
     }
     async add(args) {
         if (!text(args.from))
@@ -60,26 +63,31 @@ export class Catalogue extends Faculty {
         if (refused !== null)
             return { error: refused };
         this.#running.set(loaded.module, loaded);
-        this.#rows[loaded.module] = { version: loaded.version, from: loaded.from };
+        this.#failed.delete(loaded.module);
+        this.#rows[loaded.module] = { version: loaded.version, from: loaded.from, kinds: this.#harbor.kindsOf(loaded.module) };
         return { added: loaded.module, version: loaded.version };
     }
     remove(args) {
         const module = args.module;
-        if (!text(module) || !this.#running.has(module))
+        if (!text(module) || !Object.hasOwn(this.#rows, module))
             return { error: 'no such module' };
-        if (this.#harbor.stands(this.#harbor.kindsOf(module)))
+        const kinds = new Set([...this.#rows[module].kinds, ...this.#harbor.kindsOf(module)]);
+        if (this.#harbor.stands([...kinds]))
             return { error: 'a being stands on this module' };
         const running = new Map(this.#running);
         running.delete(module);
         this.#harbor.run([...running.values()]);
         this.#running.delete(module);
+        this.#failed.delete(module);
         delete this.#rows[module];
         return { removed: module };
     }
     modules() {
         const out = {};
-        for (const [module, row] of Object.entries(this.#rows))
-            out[module] = { version: row.version, running: this.#running.get(module)?.version ?? null, from: row.from };
+        for (const [module, row] of Object.entries(this.#rows)) {
+            const failed = this.#failed.get(module);
+            out[module] = { version: row.version, running: this.#running.get(module)?.version ?? null, from: row.from, ...(failed === undefined ? {} : { failed }) };
+        }
         return out;
     }
 }