@nervur-org/dock 0.3.0

package/dock/service.ts

@@ -0,0 +1,100 @@
+// SPDX-License-Identifier: Apache-2.0
+// The bell service, from both ends: the ground a world rings through when
+// it does not hold the platform's key, and the door that holds the key and
+// rings.
+//
+// Why there is one at all. Apple and Google accept a push only when it is
+// signed with the key of the team that published the app, so a world's
+// droplet cannot ring the Quo app however much its human wants it to: the
+// key belongs to whoever publishes the app and to nobody else. So a world's
+// world hands the ring on, a token and a sealed banner, to a service the
+// publisher runs. It is the one server the app has. An estate that ships
+// its own app under its own name holds its own keys and runs its own, or
+// puts these two rings straight into its push faculty and runs none.
+//
+// What it sees is a token, a ring, and ciphertext. Not a world, not an
+// occupant, not a pk, and not a word of what was pushed: the banner is
+// sealed to the device's banner key by the world that rang, and this
+// service holds no key that opens it and never will. It keeps nothing
+// either: no log of who rang, no list of tokens, no state at all, which is
+// the only honest way to run a server every world's traffic passes through.
+//
+// Who may ring it is the token itself, and that is deliberate. A device
+// token exists only because a device installed this app and handed it to a
+// world it joined; it is per app and per device; a ring wakes a phone and
+// says nothing to it; and the platforms throttle a background push on their
+// own. An account here would be a registry of worlds, which is the one
+// thing the app is built not to have. The day this is abused it wants a
+// rate limit at the edge, which is the terrain's and not a word of Quo.
+import { bellOf, type Ring, type Token } from './push.ts';
+
+// The ring a world holds for a store's kind: the token names its bell and
+// the ring goes there, so a phone running an app this world never shipped
+// is rung through that app's own service; a token naming none goes to the
+// service the world was told of, and a world told of none rings nothing.
+export function routed(fallback?: string): Ring {
+  return {
+    async ring(token: Token, sealed?: string) {
+      const at = bellOf(token) ?? fallback;
+      if (!at) throw new Error(`no bell service rings a ${token.kind} from this box`);
+      return handedTo(at).ring(token, sealed);
+    },
+  };
+}
+
+// The ring a world holds: hand the token to the service and take its word
+// for it. A ring either left or threw, as every ring does.
+export function handedTo(at: string): Ring {
+  return {
+    async ring(token: Token, sealed?: string) {
+      const res = await fetch(`${at.replace(/\/$/, '')}/ring`, {
+        method: 'POST',
+        headers: { 'content-type': 'application/json' },
+        body: JSON.stringify(sealed === undefined ? { token } : { token, sealed }),
+      });
+      const said = (await res.text()).slice(0, 200);
+      if (!res.ok) throw new Error(`the bell service answered ${res.status} ${said}`);
+    },
+  };
+}
+
+// The other end, as a plain request in and a response out, so that the
+// terrain it runs on is the terrain's business and this is the whole of the
+// service. `rings` is one per kind, exactly as the push faculty's map is: a
+// service with no key for a kind answers that it has none, which is what a
+// publisher who rings no Android phones says to one. `apps` is which apps
+// this service holds keys for, and a token naming another is refused,
+// since a key signs for one app and a ring for another would be a lie the
+// platform catches later and nobody reads.
+export function ringing(rings: Record<string, Ring>, apps?: readonly string[]): (request: Request) => Promise<Response> {
+  const answer = (status: number, body: Record<string, unknown>) => new Response(JSON.stringify(body), { status, headers: { 'content-type': 'application/json; charset=utf-8', 'cache-control': 'no-store' } });
+  return async (request: Request) => {
+    if (new URL(request.url).pathname !== '/ring') return answer(404, { error: 'the bell service has one door, /ring' });
+    if (request.method !== 'POST') return answer(405, { error: 'a ring is a POST' });
+    let token: unknown;
+    let sealed: unknown;
+    try {
+      const body = (await request.json()) as { token?: unknown; sealed?: unknown };
+      token = body.token;
+      sealed = body.sealed;
+    } catch {
+      return answer(400, { error: 'a ring is one JSON object naming a token' });
+    }
+    if (sealed !== undefined && typeof sealed !== 'string') return answer(400, { error: 'a seal is text' });
+    const kind = (token as { kind?: unknown } | null)?.kind;
+    if (typeof kind !== 'string') return answer(400, { error: 'a token names its kind' });
+    const g = rings[kind];
+    if (!g) return answer(400, { error: `this service holds no key to ring a ${kind}` });
+    const app = (token as { app?: unknown }).app;
+    if (apps && (typeof app !== 'string' || !apps.includes(app))) return answer(400, { error: `this service holds no key for ${typeof app === 'string' ? app : 'an app the token does not name'}` });
+    try {
+      await g.ring(token as Token, sealed as string | undefined);
+      return answer(200, { rang: kind });
+    } catch (e) {
+      // The platform's own refusal, passed back as it came. A world reads
+      // it in the error object its Bell answers with, which is where a
+      // human eventually reads it too.
+      return answer(502, { error: e instanceof Error ? e.message : String(e) });
+    }
+  };
+}

package/dock/timer.ts

@@ -0,0 +1,174 @@
+// SPDX-License-Identifier: Apache-2.0
+// The box's clock, and the one being on a device that reads one. A being who
+// could read a clock could not be moved, since the moment she read would be
+// her box's and no other, so the moment reaches every other being the one way
+// anything reaches a being: as an ask at her door, from this faculty, as the
+// occupant she named when she asked to be woken.
+//
+// She arms for the next due moment and for nothing else. Every watcher
+// answers a round with when she is next due, this arms for the earliest of
+// them, and a box whose watchers all say null arms nothing and sleeps until
+// somebody keeps something. So a box with no schedules never ticks, and a
+// home on the edge with a sweep at three in the morning wakes once a night.
+//
+// A round is armed for one moment at a time and never overlaps the one
+// before, and the moment is floored to the minute with half a second after
+// it, since a watcher floors the moment she is handed and a round that fired
+// a hair early would floor to the minute before.
+//
+// One method knows a terrain, `arm`, and a subclass replaces it: a
+// `setTimeout` here, the object's storage alarm on a worker. Nothing else in
+// her reads a platform.
+import type { JsonObject } from '@nervur-org/nervur';
+import { Faculty, type Woke } from './faculty.ts';
+
+const MINUTE = 60_000;
+// A timeout further out than this is not trusted, so the arming is capped and
+// made again when it goes off. It is the base class's own bound and no rule
+// of the faculty: a terrain whose alarm holds a month arms for the month.
+const DAY = 86_400_000;
+
+export class Timer extends Faculty {
+  static override asks = {
+    watch: { description: 'wake me when I say I am next due', input: { type: 'object', properties: { invitation: { type: 'object' }, method: { type: 'string' }, args: { type: 'object' } }, required: ['invitation', 'method'] } },
+    due: { description: 'bring my next round forward to this moment', input: { type: 'object', properties: { at: { type: 'number' } }, required: ['at'] } },
+    now: { description: 'this box’s moment', input: { type: 'object' } },
+  };
+
+  #timeout: ReturnType<typeof setTimeout> | undefined;
+  #stopped = false;
+  #armed: number | null = null;
+  #round: Promise<Woke[]> | null = null;
+
+  // The moment she is armed for, or null while she is asleep. For the
+  // device's own code and for a suite; it crosses no door.
+  get armed(): number | null {
+    return this.#armed;
+  }
+
+  // A watcher says she is due sooner than the box knew. It only ever brings
+  // the round forward: what fires is decided at the tick, in the watcher's
+  // own cells, so an arming that moved later on somebody's word would be a
+  // schedule somebody else held silenced. The door is the whole gate here:
+  // a standing at a faculty comes from `lend` alone, and this adds no second
+  // one.
+  due(args: JsonObject): JsonObject {
+    const at = args.at;
+    if (typeof at !== 'number' || !Number.isFinite(at)) return { error: 'a due carries the moment: { at }' };
+    const when = moment(at);
+    if (this.#armed === null || when < this.#armed) this.#arm(when);
+    return { armed: this.#armed };
+  }
+
+  // Whoever was just filed is ticked at once, and what she answers is what
+  // the box arms for. One move covers a box booting, a home moving in and a
+  // watcher born long after the box was up: she is never waiting for a round
+  // nobody scheduled.
+  protected override async welcomed(id: string): Promise<void> {
+    await this.round(Date.now(), id);
+  }
+
+  // The arming went off. A moment still well ahead is the day's cap this
+  // class put on its own timeout, so it is armed again rather than fired: a
+  // terrain calls this and never has to know how far out the arming was.
+  async rang(): Promise<Woke[]> {
+    if (this.#stopped) return [];
+    if (this.#armed !== null && this.#armed - Date.now() > 1_000) {
+      this.arm(this.#armed);
+      return [];
+    }
+    return this.fire(Date.now());
+  }
+
+  // The moment, read here and handed on. A device's own code may call it at a
+  // moment it names, which is how a suite proves a wake without waiting for
+  // one and how an operator makes a round happen now.
+  fire(now: number): Promise<Woke[]> {
+    return this.round(now);
+  }
+
+  // One round, and never two: a second while one is in flight is handed the
+  // one already running. What every watcher answered decides the next
+  // arming, and a `due` that landed while the round ran is not lost.
+  protected round(now: number, only?: string): Promise<Woke[]> {
+    if (this.#round) return this.#round;
+    const mine = this.#run(now, only);
+    this.#round = mine;
+    return mine.finally(() => {
+      if (this.#round === mine) this.#round = null;
+    });
+  }
+
+  async #run(now: number, only?: string): Promise<Woke[]> {
+    if (only === undefined) this.#arm(null); // the arming is spent, whether it went off or the device called this by hand
+    const woke = await this.woke((w) => ({ ...w.args, now }), only);
+    if (woke === null) {
+      this.stop(); // her ward took her out; there is nobody left to wake
+      return [];
+    }
+    // A moment already gone is no arming. Every watcher works out when she is
+    // next due from the moment she was handed, so a round fired by hand at a
+    // moment that is not this box's answers one that is not this box's
+    // either, and a box that armed for it would run a round for a minute long
+    // past. A round at the box's own moment always names one still ahead.
+    const named = soonest(woke);
+    const said = named !== null && named > Date.now() ? named : null;
+    const held = this.#armed;
+    const at = said === null ? held : held === null ? moment(said) : Math.min(held, moment(said));
+    if (at !== null && at !== this.#armed) this.#arm(at);
+    else if (at === null && this.#armed !== null) this.#arm(null);
+    return woke;
+  }
+
+  #arm(when: number | null): void {
+    if (this.#stopped) return;
+    this.#armed = when;
+    this.arm(when);
+  }
+
+  // The one thing a terrain says about itself: be woken at this moment, or at
+  // no moment at all. A subclass replaces this and nothing else of her.
+  //
+  // Here it is a timeout, capped at a day and armed again when the cap goes
+  // off. The box stays up for its work and never for this, so the handle is
+  // unreferenced.
+  protected arm(when: number | null): void {
+    clearTimeout(this.#timeout);
+    this.#timeout = undefined;
+    if (when === null) return;
+    this.#timeout = setTimeout(() => void this.rang(), Math.min(Math.max(when - Date.now(), 0), DAY));
+    this.#timeout.unref?.();
+  }
+
+  // A being her ward took out reaches nobody, so nothing is left to wake. The
+  // device calls this when it puts the box down.
+  stop(): void {
+    this.#stopped = true;
+    this.#armed = null;
+    this.arm(null);
+  }
+
+  now(): JsonObject {
+    return { now: Date.now() };
+  }
+}
+
+// Half a second past the minute a moment falls in, and never before the
+// moment itself: a watcher floors what she is handed, so a round that fired a
+// hair early would floor to the minute before and fire nothing.
+const moment = (at: number): number => Math.max(at, Math.floor(at / MINUTE) * MINUTE + 500);
+
+// What one round learned. Every watcher says when she is next due, and the
+// box arms for the earliest of them. A watcher who named no moment has
+// nothing to be woken for, and so has one who answered something that is no
+// tally at all.
+function soonest(woke: Woke[]): number | null {
+  let at: number | null = null;
+  for (const w of woke) {
+    if (w.out === null || typeof w.out !== 'object') continue;
+    const next = (w.out as { next?: unknown }).next;
+    if (typeof next !== 'number' || !Number.isFinite(next)) continue;
+    if (at === null || next < at) at = next;
+  }
+  return at;
+}

package/dock/webpush.ts

@@ -0,0 +1,182 @@
+// SPDX-License-Identifier: Apache-2.0
+// Web Push as a bell ground: the one platform whose keys we mint ourselves.
+// A browser hands a page an endpoint at whichever push service that browser
+// keeps, and anyone holding the endpoint may ring it; what makes the ring
+// this world's is VAPID, RFC 8292, a P-256 keypair the world owns and a
+// signed token naming the push service it is speaking to. No account, no
+// registration and no platform key: `mintVapid` is where a world's keypair
+// comes from, and the public half is what a page subscribes with.
+//
+// The ring carries the line itself, and no second seal. RFC 8291 encrypts
+// a Web Push body to keys only that browser holds, the `p256dh` and the
+// `auth` of the subscription it made, so the one party a banner key would
+// hide the line from on this path is the push service, which that
+// encryption already excludes. A second seal would buy nothing and would
+// make every tab stand a dock ward to keep a banner key in. So the world
+// encrypts here, the browser decrypts, and the service worker shows what it
+// was handed rather than a line it guessed at.
+//
+// A ring with no line is still a ring: the body is left off and the device
+// wakes, dials and drains what it missed over Quo, which is what a world
+// with nothing to show sends.
+//
+// This is one ground of the three the bell has. APNs and FCM are the
+// stores' own and want a platform key; this one stands where nothing is in
+// the way, a keypair the world mints itself.
+import type { Line, Ring, Token } from './push.ts';
+
+const subtle = () => globalThis.crypto.subtle;
+const ES256 = { name: 'ECDSA', namedCurve: 'P-256' } as const;
+
+const b64url = (bytes: Uint8Array): string => {
+  let binary = '';
+  for (const b of bytes) binary += String.fromCharCode(b);
+  return btoa(binary).replaceAll('+', '-').replaceAll('/', '_').replaceAll('=', '');
+};
+const unb64url = (v: string): Uint8Array => {
+  const binary = atob(v.replaceAll('-', '+').replaceAll('_', '/'));
+  const out = new Uint8Array(binary.length);
+  for (let at = 0; at < binary.length; at += 1) out[at] = binary.charCodeAt(at);
+  return out;
+};
+const utf8 = (v: string) => new TextEncoder().encode(v);
+
+// What a world holds: the private key as a JWK, and the address a push
+// service may complain to, which VAPID wants as `mailto:` or `https:`.
+export type Vapid = { key: JsonWebKey; subject: string };
+
+// The key a page subscribes with, `applicationServerKey`: the public half
+// as the 65 uncompressed bytes, base64url. It is public by definition and
+// travels in the world's config beside its routes.
+export function publicOf(key: JsonWebKey): string {
+  if (typeof key.x !== 'string' || typeof key.y !== 'string') throw new Error('a vapid key is a P-256 JWK');
+  const x = unb64url(key.x),
+    y = unb64url(key.y);
+  const raw = new Uint8Array(65);
+  raw[0] = 4;
+  raw.set(x, 1);
+  raw.set(y, 33);
+  return b64url(raw);
+}
+
+// A world's own keypair, minted once and kept as its secret. The private
+// half is the JWK; the public half is what a page subscribes with.
+export async function mintVapid(): Promise<{ key: JsonWebKey; publicKey: string }> {
+  const pair = await subtle().generateKey(ES256, true, ['sign', 'verify']);
+  const key = await subtle().exportKey('jwk', pair.privateKey);
+  return { key, publicKey: publicOf(key) };
+}
+
+// The signed token one push service is handed, good for twelve hours. The
+// audience is that service's origin and nothing finer: a token minted for
+// one service says nothing to another, and it names no endpoint, so it
+// cannot be read back into which device was rung.
+async function vapidToken(v: Vapid, endpoint: string): Promise<string> {
+  const key = await subtle().importKey('jwk', v.key, ES256, false, ['sign']);
+  const head = b64url(utf8(JSON.stringify({ typ: 'JWT', alg: 'ES256' })));
+  const claims = b64url(utf8(JSON.stringify({ aud: new URL(endpoint).origin, exp: Math.floor(Date.now() / 1000) + 12 * 3600, sub: v.subject })));
+  const signed = await subtle().sign({ name: 'ECDSA', hash: 'SHA-256' }, key, utf8(`${head}.${claims}`));
+  return `${head}.${claims}.${b64url(new Uint8Array(signed))}`;
+}
+
+// What a push service will carry, RFC 8291's own ceiling, and what the
+// record costs before a byte of the line: the salt, the record size, the
+// length of the key, the key itself, the padding delimiter and the GCM tag.
+const RECORD = 4096;
+const OVERHEAD = 16 + 4 + 1 + 65 + 1 + 16;
+
+const hmac = async (key: Uint8Array, data: Uint8Array): Promise<Uint8Array> => {
+  const k = await subtle().importKey('raw', key as BufferSource, { name: 'HMAC', hash: 'SHA-256' }, false, ['sign']);
+  return new Uint8Array(await subtle().sign('HMAC', k, data as BufferSource));
+};
+const joined = (...parts: Uint8Array[]): Uint8Array => {
+  const out = new Uint8Array(parts.reduce((n, p) => n + p.length, 0));
+  let at = 0;
+  for (const p of parts) {
+    out.set(p, at);
+    at += p.length;
+  }
+  return out;
+};
+
+// The keys a subscription hands a world, which RFC 8291 encrypts to: the
+// browser's own P-256 public point and the sixteen bytes of authentication
+// secret it minted with it. A token without them is a subscription made
+// before this or one a browser gave no keys for, and it is rung with no
+// body rather than refused.
+function keysOf(token: Token): { ua: Uint8Array; auth: Uint8Array } | null {
+  if (typeof token.p256dh !== 'string' || typeof token.auth !== 'string') return null;
+  try {
+    const ua = unb64url(token.p256dh),
+      auth = unb64url(token.auth);
+    return ua.length === 65 && ua[0] === 4 && auth.length === 16 ? { ua, auth } : null;
+  } catch {
+    return null;
+  }
+}
+
+// One record, `aes128gcm`, RFC 8188 with the key derivation of RFC 8291.
+// The world mints a keypair for this ring alone, agrees with the browser's,
+// and salts each record freshly, so two rings to one device share no key
+// and no nonce.
+export async function encrypt(line: Line, ua: Uint8Array, auth: Uint8Array): Promise<Uint8Array> {
+  const pair = await subtle().generateKey({ name: 'ECDH', namedCurve: 'P-256' }, true, ['deriveBits']);
+  const as = new Uint8Array(await subtle().exportKey('raw', pair.publicKey));
+  const theirs = await subtle().importKey('raw', ua as BufferSource, { name: 'ECDH', namedCurve: 'P-256' }, false, []);
+  const shared = new Uint8Array(await subtle().deriveBits({ name: 'ECDH', public: theirs }, pair.privateKey, 256));
+
+  // The input keying material is the agreement, stretched under the
+  // subscription's auth secret and bound to both public keys, so a record
+  // cannot be replayed at a device it was not encrypted for.
+  const ikm = await hmac(await hmac(auth, shared), joined(utf8('WebPush: info\0'), ua, as, Uint8Array.of(1)));
+  const salt = globalThis.crypto.getRandomValues(new Uint8Array(16));
+  const prk = await hmac(salt, ikm);
+  const cek = (await hmac(prk, joined(utf8('Content-Encoding: aes128gcm\0'), Uint8Array.of(1)))).slice(0, 16);
+  const nonce = (await hmac(prk, joined(utf8('Content-Encoding: nonce\0'), Uint8Array.of(1)))).slice(0, 12);
+
+  // One record, so the padding delimiter is 2 and there is nothing after
+  // it. A line too long for what a push service carries is cut at the body,
+  // which is where a lock screen cuts it anyway.
+  let text = utf8(JSON.stringify(line));
+  if (text.length > RECORD - OVERHEAD) {
+    const room = RECORD - OVERHEAD - utf8(JSON.stringify({ ...line, body: '' })).length;
+    text = utf8(JSON.stringify({ ...line, body: new TextDecoder().decode(utf8(line.body).slice(0, Math.max(0, room))) }));
+  }
+  const key = await subtle().importKey('raw', cek as BufferSource, 'AES-GCM', false, ['encrypt']);
+  const sealed = new Uint8Array(await subtle().encrypt({ name: 'AES-GCM', iv: nonce as BufferSource }, key, joined(text, Uint8Array.of(2)) as BufferSource));
+
+  const head = new Uint8Array(21);
+  head.set(salt, 0);
+  new DataView(head.buffer).setUint32(16, RECORD);
+  head[20] = as.length;
+  return joined(head, as, sealed);
+}
+
+// The ground. A `web` token is an endpoint and, when the browser gave them,
+// the two keys of its own subscription, which is what a line is encrypted
+// to. A token with no keys is rung with no body.
+export function webPush(v: Vapid): Ring {
+  const publicKey = publicOf(v.key);
+  return {
+    async ring(token: Token, _sealed?: string, line?: Line) {
+      const endpoint = token.endpoint;
+      if (typeof endpoint !== 'string' || !/^https?:\/\//.test(endpoint)) throw new Error('a web token is an endpoint');
+      const keys = line ? keysOf(token) : null;
+      const body = keys && line ? await encrypt(line, keys.ua, keys.auth) : undefined;
+      const res = await fetch(endpoint, {
+        method: 'POST',
+        headers: {
+          authorization: `vapid t=${await vapidToken(v, endpoint)}, k=${publicKey}`,
+          ttl: '60',
+          ...(body ? { 'content-encoding': 'aes128gcm', 'content-type': 'application/octet-stream' } : {}),
+        },
+        ...(body ? { body: body as BodyInit } : {}),
+      });
+      // 404 and 410 are the push service saying this endpoint is gone. The
+      // device sends a fresh one when it next comes up, so nothing here
+      // forgets a token: a world that dropped one would stop ringing a
+      // device that is merely off.
+      if (!res.ok) throw new Error(`the push service answered ${res.status}`);
+    },
+  };
+}

package/harbor/browser.ts

@@ -0,0 +1,97 @@
+// SPDX-License-Identifier: Apache-2.0
+// The browser harbor: the core over a store, in a webview. A dialer and
+// never a listener: it holds one socket per world it is connected to, and
+// every ask to a pk it does not hold goes down a socket to the listener,
+// which is the rendezvous. In a tab the store is IndexedDB under a name,
+// and the lease is a web lock on that name, held for the life of the tab:
+// a second tab on one origin meets the lock and is a screen, not a harbor.
+// In an app the store is handed in, and the process that holds it is the
+// lease: an app has one harbor and nothing else can open its files. The
+// classes are the estate's beings, handed in with the bundle, plus whatever
+// a page hands in beside them.
+import type { BeingClass } from '@nervur-org/nervur';
+import { User, Desk, Avatar, Presence, Courier } from '../beings/index.ts';
+import { Harbor, dial, type Dialer, type Lend, type Store } from '@nervur-org/nervur/harbor';
+import { FACULTY_CLASSES, settled, stand } from '../dock/index.ts';
+import { Idb } from './idb.ts';
+
+export const BUILT_IN: Record<string, BeingClass> = { User, Desk, Avatar, Presence, Courier, ...FACULTY_CLASSES };
+
+export class BrowserHarbor extends Harbor {
+  readonly name: string;
+  readonly dialers: Dialer[] = [];
+  readonly #locked: boolean;
+  #release: (() => void) | undefined;
+
+  // `lend` is what this box lends the beings of the wards it hosts: a name
+  // to an invitation on a being of its own ward. `stand` builds one; a bare
+  // tab hands none and every name answers null.
+  constructor(store: string | Store = 'quo', classes: Record<string, BeingClass> = {}, lend?: Lend) {
+    const s = typeof store === 'string' ? new Idb(store) : store;
+    super(s, async () => ({ ...BUILT_IN, ...classes }), lend);
+    this.name = typeof store === 'string' ? store : 'quo';
+    this.#locked = typeof store === 'string';
+  }
+
+  // What this box lends, by name. A bare tab says nothing, stands no ward of
+  // its own and lends nothing.
+  lent: Record<string, string> | undefined;
+
+  // What this box lends is said before it boots, and standing the ward is
+  // part of booting: a being born in any other ward lends from her first
+  // line, and a ground that could not reach it yet would leave her holding
+  // nothing until her next birth.
+  async stand(lent: Record<string, string>): Promise<void> {
+    this.lent = lent;
+    if (this.wards.size > 0) this.lend = await stand(this, lent);
+  }
+
+  // Take the lock and boot every ward kept here. A lock already held is
+  // another tab's harbor over this seed, and this one refuses to boot.
+  override async boot(): Promise<void> {
+    if (this.#locked) await this.#lease();
+    if (this.lent) this.lend = await stand(this, this.lent);
+    await super.boot();
+    // Every being who takes what this box lends does it at her birth, and
+    // birth is synchronous while taking a standing is not. A box is up when
+    // they have landed, not before, here as on a daemon: a page painted
+    // ahead of them shows a device that can do nothing.
+    await settled();
+  }
+
+  // Hold one socket to a world's quo. route.
+  dial(url: string): Dialer {
+    const d = dial(this, url);
+    this.dialers.push(d);
+    return d;
+  }
+
+  // The device is back: a phone out of a pocket, an app to the foreground.
+  // Every socket is told, and one that died silently is dialed again.
+  wake(): void {
+    for (const d of this.dialers) d.wake();
+  }
+
+  async close(): Promise<void> {
+    for (const d of this.dialers.splice(0)) d.close();
+    (this.store as { close?(): void }).close?.();
+    this.#release?.();
+    this.#release = undefined;
+  }
+
+  async #lease(): Promise<void> {
+    const locks = (globalThis.navigator as Navigator | undefined)?.locks;
+    if (!locks) return; // no web locks on this terrain: nothing vouches, as in the memory harbor
+    const granted = await new Promise<boolean>((ok) => {
+      void locks.request(`quo:${this.name}`, { ifAvailable: true }, (lock) => {
+        if (!lock) {
+          ok(false);
+          return;
+        }
+        ok(true);
+        return new Promise<void>((release) => (this.#release = release)); // held until close
+      });
+    });
+    if (!granted) throw new Error(`harbor ${this.name} is held by another tab`);
+  }
+}