nervur 0.8.2 → 0.10.0

package/README.md

@@ -49,13 +49,20 @@ const DIARY = `({
 })`;
 
 const secret = Buffer.from(process.env.NERVUR_SECRET, 'base64'); // 32 bytes, minted once with Tools.secret()
-const ground = Ground({ cells: Cells({ file: 'ground.json' }), keychain: Keychain(secret) });
+const shelf = { cells: Cells({ file: 'ground.json' }), keychain: Keychain(secret) };
 
+const heir = Voice(); // keep this one somewhere the machine is not
+const self = Voice(Tools.digest(heir.pk)); // and hand the ground only this
+Ground(shelf).init(self.hand()); // once, ever — a fresh ground offers nothing else
+
+const ground = Ground(shelf); // now it stands, and answers
 const me = Voice(); // keep it: writeFileSync of me.pack(), or it dies with the process
-const serve = ground.serve(me);
-const stranger = await serve.pointer('Ground');
-await stranger.init({ address: Tools.address(me.pk) }); // first boot only — once, ever
+await ground
+  .serve(self)
+  .pointer('Ground')
+  .then((it) => it.invite({ address: Tools.address(me.pk) }));
 
+const serve = ground.serve(me);
 const admin = await serve.pointer('Ground'); // a pointer is your rights at mint — re-mint after they change
 const diary = await admin.create({
   program: DIARY,
@@ -68,8 +75,8 @@ console.log(await mine.pages()); // [ 'first entry' ]
 
 The rights enum here is the default (`SELF MEMBER STRANGER`); declare your
 own `enum Rights` in the interface to replace it. Reboot: construct the
-same `Ground` from the same two arguments — it wakes remembering; `init`
-refuses, because the ref survived in the cells.
+same `Ground` from the same two arguments — it wakes remembering, and
+offers no `init`, because the identity survived in the cells.
 
 **The wire, when a caller is remote.** An envelope is plain JSON:
 
@@ -118,11 +125,14 @@ three things while hiding everything it is made of:
   nothing else — the library never opens a socket.
 - `serve(voice)` — authority established once, and every face inherits it.
 
-A fresh ground holds no reference, so whoever reaches it first takes the
-first one: `pointer('Ground').init({ address })` writes the first MEMBER ref
-on the admin being — the same ref row as any other — exactly once, refusing
-everyone after. That window is what running-is-custody looks like from the
-outside, and it is stated rather than hidden.
+A fresh ground has no identity, and no door for anyone to reach first: it
+offers `init(hand)` and nothing else — no `address`, no `receive`, no
+`serve`. Custody mints the voice off the machine, keeps the heir, and hands
+over `hand()` alone; a pack carrying its own successor is refused. The act
+is spent the moment it lands, and only `rotate(hand)` moves that voice
+after. Both are custody's own calls on the shelf, never doors — which is
+what running-is-custody looks like from the outside, stated rather than
+hidden.
 
 **`serve` is the client, and it has four faces of one door.** `pointer(at)`
 is a plain object with one function per field, generated from the schema that
@@ -194,18 +204,25 @@ silence, and silence is something local delivery never answers with.
 - [pointer.mjs](pointer.mjs) — `Pointer` and `Mcp`, both read off an SDL, so
   no client is ever written by hand for a program.
 - [client.mjs](client.mjs) — the bare envelope client, usable on its own.
-  Signs as its voice and verifies every reply against `pkOf(to)`.
+  Signs as its voice, and verifies every reply from the address alone:
+  `pkOf(to)` is the key the being was born with, and each handover the reply
+  carries in `succession` is checked against the key before it, so a being
+  that has rotated is still provably itself to a caller that has never met
+  it. A chain that breaks anywhere is a dropped answer.
 - [being.mjs](being.mjs) — the being. `Compartment` seals a cell by its
   class, `Port` carries authority both ways, `Being` is the door — prove,
   read rights, execute, sign — and `Registry` creates, takes custody of,
   activates and destroys, reachable only through the admin being.
 - [admin.mjs](admin.mjs) — the administrative program every ground installs
   for itself, aliased `Ground`: census, create, activate, destroy, upgrade,
-  alias, attest. Upgrade is custody moving the one cell that was always the
-  core's to move: the program is replaced in place — address, cells, refs
-  and chain surviving — refused whole when a cell the being holds would go
-  undeclared, and visible to every peer because `describe` answers the
-  program's digest.
+  alias, attest, and behind `SELF` alone invite, drop and extend. Upgrade is
+  custody moving the one cell that was always the core's to move: the
+  program is replaced in place — address, cells, refs and chain surviving —
+  refused whole when a cell the being holds would go undeclared, and visible
+  to every peer because `describe` answers the program's digest. It refuses
+  the ground's own address; that program moves only through `extend`, which
+  takes the custom part alone and lets the core compose it with the fixed
+  administration.
 - [ground.mjs](ground.mjs) — the sovereign ground, its one handler and
   `serve`.
 - [index.mjs](index.mjs) — the surface an adopter imports.
@@ -293,9 +310,10 @@ other name passes through untouched as a module for programs.
   by address, so that `memory` offers the same interface under the same
   digest on every ground and a pretender is refused. A digest pins shape;
   what the words mean is the contract author's prose to state.
-- **`blueprints` — optional.** `blueprints.ground()` replaces the default
-  admin blueprint, which is how a host customises what administering this
-  ground even means.
+- **`blueprints` — optional.** `blueprints.ground()` seeds the
+  administration's custom part at install. After that the part moves only
+  through the `extend` door, so a host that keeps its blueprint in a file
+  and hands it over with the CLI never needs this slot at all.
 - **`watch` — optional.** The custodian's eye: a function called at every
   door decision with one frozen fact, `{ to, from, kind, outcome }`, and
   the outcomes are a closed set — `no-door`, `unproven`, `replayed`,
@@ -305,13 +323,14 @@ other name passes through untouched as a module for programs.
   costs nothing. Tracing, metrics and logs are a host package built on
   this, never the library's.
 
-Boot, in order: on first boot the ground installs itself — mints its admin
-voice, writes the admin being, hands the packed voice to the keychain to
-seal into one cell. Every boot after: the keychain unseals, the voice
-revives, every being in custody is announced, the ground answers. The first voice to call `init` names the first
-MEMBER — once, and never again. `Clock` and `Entropy` are not floor: they
-are ordinary modules a program declares, pinnable so a program never
-reaches for the wall.
+Boot, in order: a ground over an empty shelf offers `init(hand)` alone.
+Given the hand, it writes the admin being and seals that voice into one cell
+under the keychain. Every boot after: the keychain unseals, the voice
+revives, every being in custody is announced, the ground answers.
+`rotate(hand)` is the only thing that moves that voice, and it certifies the
+handover so every caller follows the ground from its address. `Clock` and
+`Entropy` are not floor: they are ordinary modules a program declares,
+pinnable so a program never reaches for the wall.
 
 ## Extending the administration
 
@@ -320,9 +339,11 @@ context holds the registry — so a door that must create, upgrade or destroy
 beings belongs on it and nowhere else. Adopters extend it; nobody replaces
 it.
 
-Pass an extension through the `blueprints` module and the ground composes it
-with the standard administration. Write it as an ordinary blueprint whose
-schema **extends** the roots:
+Hand the custom part to the `extend` door — `SELF`'s alone — and the core
+composes it with the standard administration. What you supply is the part by
+itself, never the whole program, so the acts this ground owes can never go
+missing. The same door replaces the part and removes it. Write it as an
+ordinary blueprint whose schema **extends** the roots:
 
 ```js
 const cases = `({
@@ -345,18 +366,22 @@ const cases = `({
   },
 })`;
 
-const ground = Ground({ cells, keychain, blueprints: { ground: () => cases } });
+await ground
+  .serve(self)
+  .pointer('Ground')
+  .then((it) => it.extend({ program: cases }));
 ```
 
 The composed program is one blueprint with one digest, so `describe` answers
 what this ground's administration actually is, and an outsider can pin it.
 
-Three rules hold, and each refuses the whole ground rather than bending:
+Three rules hold, and each refuses the whole extension rather than bending:
 
 1. **Standard door names are reserved.** Declare `create`, `census`,
-   `upgrade`, `destroy`, `alias`, `attest`, `opened` or `init` and no ground
-   rises. You cannot change what a standard door means — which is why a
-   stranger may trust that if `create` answers, it created.
+   `upgrade`, `destroy`, `alias`, `attest`, `opened`, `invite`, `drop` or
+   `extend` and the part is refused. You cannot change what a standard door
+   means — which is why a stranger may trust that if `create` answers, it
+   created.
 2. **Add only.** Use `extend type Query` / `extend type Mutation`; cell
    names, module slots and `needs.config` may not collide with the
    administration's own.

package/admin.mjs

@@ -13,7 +13,9 @@ const ADMIN = `({
       opened: Boolean                  @rights(is: [SELF, MEMBER, STRANGER])
     }
     type Mutation {
-      init(address: String!, nextPkHash: String): Boolean @rights(is: [SELF, MEMBER, STRANGER])
+      invite(address: String!, nextPkHash: String, rights: String): Boolean @rights(is: [SELF, MEMBER])
+      drop(address: String!): Boolean                       @rights(is: [SELF, MEMBER])
+      extend(program: String): Boolean                      @rights(is: [SELF])
       create(program: String!, refs: [RefInput!], data: String, config: String): String
         @rights(is: [SELF, MEMBER])
       activate(address: String!): String                   @rights(is: [SELF, MEMBER])
@@ -37,13 +39,19 @@ const ADMIN = `({
       opened: (_, __, { modules }) => modules.memory.list('refs/').length > 0,
     },
     Mutation: {
-      init: (_, { address, nextPkHash }, { modules }) =>
-        modules.memory.list('refs/').length > 0
-          ? false
-          : modules.memory.write('refs/' + address, {
-              nextPkHash: nextPkHash ?? null,
-              rights: 'MEMBER',
-            }) !== undefined,
+      invite: (_, { address, nextPkHash, rights }, { modules }) =>
+        modules.memory.write('refs/' + address, {
+          nextPkHash: nextPkHash ?? null,
+          rights: rights ?? 'MEMBER',
+        }) !== undefined,
+      drop: (_, { address }, { modules }) => {
+        if (modules.memory.read('refs/' + address) === undefined) {
+          return false;
+        }
+        modules.memory.write('refs/' + address, undefined);
+        return modules.memory.read('refs/' + address) === undefined;
+      },
+      extend: (_, { program }, { registry }) => registry.extend(program) !== undefined,
       create: (_, { program, refs, data, config }, { registry }) =>
         registry.create({
           config: config === undefined ? undefined : JSON.parse(config),

package/being.mjs

@@ -1,4 +1,5 @@
-import { OPEN, STRUCTURAL, coreClass } from './blueprint.mjs';
+import { ADMIN } from './admin.mjs';
+import { OPEN, STRUCTURAL, composed, coreClass } from './blueprint.mjs';
 import { Program } from './program.mjs';
 import { MEASURE, Stamp, Tools } from './tools.mjs';
 import { Voice } from './voice.mjs';
@@ -150,6 +151,15 @@ const rotates = ({ mine }, from, nextPkHash) => {
   return from;
 };
 
+const SUCCESSION = 'chain/succession/';
+
+const successionOf = (memory, address) =>
+  memory
+    .list(address, SUCCESSION)
+    .map((key) => memory.read(address, key)?.value)
+    .filter((one) => one !== undefined)
+    .sort((one, other) => one.v - other.v);
+
 const Being = ({ voice, address, deliver, modules, registry, vouched, watch }) => {
   const memory = modules.memory;
   const root = rootFor({ memory, voice, address });
@@ -162,9 +172,14 @@ const Being = ({ voice, address, deliver, modules, registry, vouched, watch }) =
     root,
     classOf: (key) => program?.classOf(key) ?? coreClass(key),
   });
+  const succession = successionOf(memory, address);
   const answer = (spoken) => {
     const body = Tools.canon(spoken);
-    return body.length > MEASURE ? undefined : { body: spoken, sig: voice.sign(body) };
+    if (body.length > MEASURE) {
+      return undefined;
+    }
+    const signed = { body: spoken, sig: voice.sign(body) };
+    return succession.length === 0 ? signed : { ...signed, succession };
   };
   const note = (envelope, outcome) => {
     try {
@@ -307,6 +322,11 @@ const Registry = ({
   watch,
 }) => {
   const live = new Map();
+  const orphans = (at, written) =>
+    memory
+      .list(at, '')
+      .filter((key) => memory.read(at, key)?.value !== null)
+      .filter((key) => written.classOf(key) === undefined);
   const activate = (at) => {
     if (live.has(at)) {
       return live.get(at);
@@ -316,10 +336,13 @@ const Registry = ({
     if (voice === undefined) {
       return undefined;
     }
+    const declared = (Program(memory.read(at, 'program')?.value)?.modules ?? []).map(
+      (one) => one.module,
+    );
     const door = Being({
       address: at,
       deliver,
-      modules: modulesFor(voice),
+      modules: modulesFor(voice, declared),
       vouched,
       voice,
       watch,
@@ -335,7 +358,7 @@ const Registry = ({
       if (program !== undefined && written === undefined) {
         return undefined;
       }
-      const missing = (written?.modules ?? []).filter((one) => modules[one.module] === undefined);
+      const missing = (written?.modules ?? []).filter((one) => !modules.has(one.module));
       if (missing.length > 0) {
         return undefined;
       }
@@ -377,20 +400,30 @@ const Registry = ({
       return address;
     },
     deactivate: (at) => live.delete(at),
-    upgrade: ({ address: target, program }) => {
+    extend: (source) => {
+      const program = source === undefined || source === null ? ADMIN : composed(ADMIN, source);
       const written = program === undefined ? undefined : Program(program);
       if (written === undefined) {
         return undefined;
       }
-      const orphaned = memory
-        .list(target, '')
-        .filter((key) => memory.read(target, key)?.value !== null)
-        .filter((key) => written.classOf(key) === undefined);
-      if (orphaned.length > 0) {
+      if (written.modules.some((one) => !modules.has(one.module))) {
+        return undefined;
+      }
+      if (orphans(address, written).length > 0) {
         return undefined;
       }
+      return adminMine.write('program', program) === undefined ? undefined : address;
+    },
+    upgrade: ({ address: target, program }) => {
       if (target === address) {
-        return adminMine.write('program', program) === undefined ? undefined : target;
+        return undefined;
+      }
+      const written = program === undefined ? undefined : Program(program);
+      if (written === undefined) {
+        return undefined;
+      }
+      if (orphans(target, written).length > 0) {
+        return undefined;
       }
       const held = adminMine.read(`identity/custody/${target}`);
       const voice = held === undefined ? undefined : Voice.revive(held);
@@ -440,4 +473,4 @@ const Registry = ({
   });
 };
 
-export { Being, Compartment, Registry, make, rootFor };
+export { Being, Compartment, Registry, SUCCESSION, make, rootFor };

package/client.mjs

@@ -1,17 +1,41 @@
 import { Stamp, Tools } from './tools.mjs';
 
+const KEY = /^[0-9a-f]{64}$/;
+
+const speaking = (born, at, succession) => {
+  if (succession === undefined) {
+    return born;
+  }
+  if (!Array.isArray(succession)) {
+    return undefined;
+  }
+  let pk = born;
+  for (const step of succession) {
+    if (!KEY.test(step?.next ?? '')) {
+      return undefined;
+    }
+    if (!Tools.verifies(pk, Tools.canon({ at, next: step.next, v: step.v }), step.sig)) {
+      return undefined;
+    }
+    pk = Buffer.from(step.next, 'hex');
+  }
+  return pk;
+};
+
 const Client = ({ voice, deliver, resolve = (one) => one }) => {
   const stamp = Stamp();
   const lanes = new Map();
   const send = async (to, op) => {
     const at = resolve(to);
-    const answering = at === undefined ? null : Tools.pkOf(at);
-    if (answering === null) {
+    const born = at === undefined ? null : Tools.pkOf(at);
+    if (born === null) {
       return undefined;
     }
     const turn = (lanes.get(at) ?? Promise.resolve()).then(async () => {
       const reply = await deliver(Tools.envelope(voice, at, op, stamp()));
+      const answering = speaking(born, at, reply?.succession);
       return reply?.body === undefined ||
+        answering === undefined ||
         !Tools.verifies(answering, Tools.canon(reply.body), reply.sig)
         ? undefined
         : reply;

package/ground.mjs

@@ -1,5 +1,5 @@
 import { ADMIN } from './admin.mjs';
-import { Being, Compartment, Registry, make, rootFor } from './being.mjs';
+import { Being, Compartment, Registry, SUCCESSION, make, rootFor } from './being.mjs';
 import { Blueprint, composed, coreClass } from './blueprint.mjs';
 import { Client } from './client.mjs';
 import { Contracts } from './contract.mjs';
@@ -13,16 +13,66 @@ const GROUND = 'Ground';
 
 const FLOOR = ['blueprints', 'cells', 'contracts', 'keychain', 'paths', 'watch', 'wire'];
 
-const install = ({ cells, keychain, program }) => {
+const install = ({ cells, keychain, program, bundle }) => {
+  if (bundle?.next !== undefined) {
+    return undefined;
+  }
+  const voice = Voice.revive(bundle ?? {});
+  if (voice === undefined) {
+    return undefined;
+  }
   const memory = Memory(cells);
-  const voice = Voice();
   const address = Tools.address(voice.pk);
   const sealed = keychain.seal(voice.pack());
   if (sealed === undefined) {
-    return;
+    return undefined;
   }
   make({ memory, voice, address, program });
   cells.put('ground/admin', { address, sealed });
+  return address;
+};
+
+const succeeds = ({ adminMine, adminVoice, address, bundle, cells, keychain, memory }) => {
+  if (bundle?.next !== undefined) {
+    return undefined;
+  }
+  const heir = Voice.revive(bundle ?? {});
+  const committed = memory.read(address, 'chain/nextPkHash');
+  if (heir === undefined || committed?.value !== Tools.digest(heir.pk)) {
+    return undefined;
+  }
+  const root = rootFor({ memory, voice: adminVoice, address });
+  const sealed = root === undefined ? undefined : keychain.seal(heir.pack());
+  if (sealed === undefined) {
+    return undefined;
+  }
+  const rewrapped = adminMine.write(`keyring/${Tools.address(heir.pk)}`, {
+    boxPk: Buffer.from(heir.boxPk).toString('base64'),
+    wrapped: Voice.sealTo(heir.boxPk, root.toString('base64')),
+  });
+  if (rewrapped === undefined) {
+    return undefined;
+  }
+  const version = committed.version + 1;
+  const handover = { at: address, next: Buffer.from(heir.pk).toString('hex'), v: version };
+  const certified = adminMine.write(`${SUCCESSION}${version}`, {
+    ...handover,
+    sig: adminVoice.sign(Tools.canon(handover)),
+  });
+  if (certified === undefined) {
+    return undefined;
+  }
+  const claim = {
+    address,
+    nextPkHash: heir.nextPkHash,
+    pk: Buffer.from(heir.pk).toString('hex'),
+    version,
+  };
+  if (memory.replace({ ...claim, sig: heir.sign(Tools.canon(claim)) }) === undefined) {
+    return undefined;
+  }
+  cells.put('ground/admin', { address, sealed });
+  return Tools.address(heir.pk);
 };
 
 const Ground = (modules = {}) => {
@@ -43,15 +93,15 @@ const Ground = (modules = {}) => {
 
   const extension = modules.blueprints?.ground();
   const program = extension === undefined ? ADMIN : composed(ADMIN, extension);
-  if (program === undefined || Blueprint(program)?.digest === undefined) {
+  const blueprint = program === undefined ? undefined : Blueprint(program);
+  if (blueprint?.digest === undefined) {
     return undefined;
   }
-  if (cells.peek('ground/admin') === undefined) {
-    install({ cells, keychain, program });
-  }
   const installed = cells.peek('ground/admin');
   if (installed === undefined) {
-    return undefined;
+    return Object.freeze({
+      init: (bundle) => install({ cells, keychain, program, bundle }),
+    });
   }
   const bundle = keychain.unseal(installed.sealed);
   const adminVoice = bundle === undefined ? undefined : Voice.revive(bundle);
@@ -92,18 +142,24 @@ const Ground = (modules = {}) => {
         typeof one?.scope === 'function' ? one.scope(address) : one,
       ]),
     );
-  const modulesFor = (voice) =>
+  const declaredOnly = (obj, declared) =>
+    Object.fromEntries(Object.entries(obj).filter(([name]) => declared.includes(name)));
+  const modulesFor = (voice, declared = []) =>
     Object.freeze(
       introduced(
         {
-          ...extra,
-          ...boundFor(voice),
+          ...declaredOnly(extra, declared),
+          ...declaredOnly(boundFor(voice), declared),
           memory,
         },
         Tools.address(voice.pk),
       ),
     );
-  const adminModules = modulesFor(adminVoice);
+  const offeredNames = new Set([...Object.keys(extra), ...bound.map(([name]) => name), 'memory']);
+  const adminDeclared = () =>
+    (Program(memory.read(address, 'program')?.value)?.modules ?? blueprint.modules).map(
+      (one) => one.module,
+    );
 
   const adminMine = Compartment({
     memory,
@@ -136,8 +192,11 @@ const Ground = (modules = {}) => {
 
   const attest = async (name) => {
     const one = extra[name];
-    if (one?.at === undefined) {
-      return adminModules[name] !== undefined;
+    if (one === undefined) {
+      return false;
+    }
+    if (one.at === undefined) {
+      return null;
     }
     const seen = await deliver(Tools.envelope(adminVoice, one.at, { describe: {} }, stamp()));
     return seen?.body?.sdl === undefined
@@ -150,7 +209,7 @@ const Ground = (modules = {}) => {
     adminMine,
     address,
     deliver: (envelope) => deliver(envelope),
-    modules: adminModules,
+    modules: offeredNames,
     modulesFor,
     announce,
     forget,
@@ -162,7 +221,7 @@ const Ground = (modules = {}) => {
     Being({
       address,
       deliver: (envelope) => deliver(envelope),
-      modules: adminModules,
+      modules: modulesFor(adminVoice, adminDeclared()),
       registry,
       vouched,
       voice: adminVoice,
@@ -184,6 +243,8 @@ const Ground = (modules = {}) => {
   return Object.freeze({
     address,
     receive,
+    rotate: (bundle) =>
+      succeeds({ adminMine, adminVoice, address, bundle, cells, keychain, memory }),
     serve: (voice) => {
       const client = Client({ voice, deliver, resolve });
       const sdlOf = async (at) => (await client.describe(at))?.body?.sdl;

package/index.mjs

@@ -2,7 +2,7 @@ export { ADMIN } from './admin.mjs';
 export { Blueprint, CLASSES, CORE_ONLY, OPEN, STRUCTURAL, coreClass, reads } from './blueprint.mjs';
 export { Client } from './client.mjs';
 export { Contract, Contracts } from './contract.mjs';
-export { GROUND, Ground } from './ground.mjs';
+export { FLOOR, GROUND, Ground } from './ground.mjs';
 export { Cells, Clock, Dns, Entropy, Keychain, Memory, Paths, Wire } from './modules.mjs';
 export { Mcp, Pointer } from './pointer.mjs';
 export { Program } from './program.mjs';

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "nervur",
-  "version": "0.8.2",
-  "description": "A distributed system of sovereign beings \u2014 one door, one question: by whose authority.",
+  "version": "0.10.0",
+  "description": "A distributed system of sovereign beings — one door, one question: by whose authority.",
   "license": "Apache-2.0",
   "author": "Razvan Gherghina",
   "homepage": "https://nervur.org",

package/voice.mjs

@@ -33,10 +33,12 @@ const agreed = (privateKey, rawPub) =>
     )
     .digest();
 
-const voiced = ({ present, next, box }) =>
+const committed = /^[0-9a-f]{64}$/;
+
+const voiced = ({ present, next, box, nextPkHash }) =>
   Object.freeze({
     boxPk: rawPk(box),
-    nextPkHash: Tools.digest(rawPk(next)),
+    nextPkHash: next === undefined ? nextPkHash : Tools.digest(rawPk(next)),
     open: (wrapped) => {
       try {
         const [ephemeral, sealed] = wrapped.split('.');
@@ -45,28 +47,57 @@ const voiced = ({ present, next, box }) =>
         return undefined;
       }
     },
-    pack: () => ({ box: packed(box), next: packed(next), present: packed(present) }),
+    hand: () => ({
+      box: packed(box),
+      nextPkHash: next === undefined ? nextPkHash : Tools.digest(rawPk(next)),
+      present: packed(present),
+    }),
+    pack: () =>
+      next === undefined
+        ? { box: packed(box), nextPkHash, present: packed(present) }
+        : { box: packed(box), next: packed(next), present: packed(present) },
     pk: rawPk(present),
     sign: (bytes) => sign(null, bytes, present).toString('base64'),
     succeed: () =>
-      voiced({
-        box: generateKeyPairSync('x25519').privateKey,
-        next: generateKeyPairSync('ed25519').privateKey,
-        present: next,
-      }),
+      next === undefined
+        ? undefined
+        : voiced({
+            box: generateKeyPairSync('x25519').privateKey,
+            next: generateKeyPairSync('ed25519').privateKey,
+            present: next,
+          }),
   });
 
 const Voice = Object.freeze(
   Object.assign(
-    () =>
-      voiced({
-        box: generateKeyPairSync('x25519').privateKey,
-        next: generateKeyPairSync('ed25519').privateKey,
-        present: generateKeyPairSync('ed25519').privateKey,
-      }),
+    (nextPkHash) => {
+      if (nextPkHash === undefined) {
+        return voiced({
+          box: generateKeyPairSync('x25519').privateKey,
+          next: generateKeyPairSync('ed25519').privateKey,
+          present: generateKeyPairSync('ed25519').privateKey,
+        });
+      }
+      return committed.test(nextPkHash)
+        ? voiced({
+            box: generateKeyPairSync('x25519').privateKey,
+            nextPkHash,
+            present: generateKeyPairSync('ed25519').privateKey,
+          })
+        : undefined;
+    },
     {
       revive: (bundle) => {
         try {
+          if (bundle.next === undefined) {
+            return committed.test(bundle.nextPkHash)
+              ? voiced({
+                  box: unpacked(bundle.box),
+                  nextPkHash: bundle.nextPkHash,
+                  present: unpacked(bundle.present),
+                })
+              : undefined;
+          }
           return voiced({
             box: unpacked(bundle.box),
             next: unpacked(bundle.next),