@nervur-org/dock 0.4.1 → 0.6.0

package/README.md

@@ -14,21 +14,23 @@ npx nervur serve --dir my-estate/droplet
 ```
 
 `nervur estate` writes an estate folder: one folder per harbor, the first a
-droplet's harbor directory with its routes under your domain, its unit and
-its Caddyfile, and a package file that depends on the dock and nothing
-else. Add your beings to `droplet/classes/`, and your placement to the
-routes and agents files.
-
-[`quo-dock.md`](quo-dock.md) is the truth of this package and the trunk of
-its documents; read it first. It knows nothing the spec of Quo does not say,
-and adds no word to harbor, ward or being. Beside it are the sides,
-[`quo-human.md`](quo-human.md), [`quo-mcp.md`](quo-mcp.md),
-[`quo-api.md`](quo-api.md) and [`quo-harbor.md`](quo-harbor.md), and the
-bells, [`quo-app-bells.md`](quo-app-bells.md);
-[`WORLDS.md`](WORLDS.md) is what home, presence and membership mean, and
-[`GLOSSARY.md`](GLOSSARY.md) is every word above the spec. Each stands once,
-at the root of the package, the way `nervur` and `@nervur-org/ui` carry
-theirs.
+droplet's, with its stand script, its classes folder, its systemd unit and
+a Caddyfile mapping the four routes under your domain, beside a Mac's
+launchd agent, a package file that depends on the dock and nothing else,
+and one document to fill in. Add your beings to `droplet/classes/` and your
+placement to `droplet/stand.ts`. What the box does on its own, the routes
+it answers under, the agents it runs and the lines it holds, is placed with
+`nervur` and kept in the box's own cells, never in a file.
+
+The documentation is at <https://nervur.org/docs>: the trunk of this
+package, the human, model, api and harbor sides, the bells, what home,
+presence and membership mean, and every word above the spec. This package
+carries its code and this file, and nothing written for a reader lives
+inside it, because a document and a release move at different speeds.
+
+Quo itself is at <https://quo.systems>: the spec, the vectors a kit is
+checked against, and the verifier that replays them. This package
+implements it and never restates it.
 
 ## Versions
 

package/api/route.ts

@@ -37,9 +37,8 @@ import { readText } from '../harbor/http.ts';
 import type { Hosted } from 'nervur/harbor';
 import type { Avatar } from '../beings/avatar.ts';
 import { invitationOf } from '../beings/link.ts';
-import { landed, POLICY } from '../human/door.ts';
-import { CSS } from '../human/style.ts';
-import type { Grants } from '../dock/grants.ts';
+import { isIdentity } from '../beings/join.ts';
+import type { Bearers as Grants } from '../box/grants.ts';
 import { isInvitation, isSilence, isWord, wordOf, type Invitation, type JsonObject } from 'nervur';
 
 const open = { 'access-control-allow-origin': '*', 'access-control-allow-methods': 'GET, POST, OPTIONS', 'access-control-allow-headers': 'content-type, authorization' };
@@ -58,10 +57,6 @@ export type Options = {
   resolve: (identity: string, ward: string) => Promise<{ avatar?: Avatar; error?: string }>;
   // Boot or find the avatar for this identity in that world, and knock.
   join: (identity: string, invitation: Invitation, ward: string) => Promise<{ error?: string }>;
-  // Where the worlds' pages are, for the one arrival here that is a human:
-  // a redirect from somewhere a world sent her. Without it she still gets a
-  // page, with no way back offered on it.
-  web?: string;
 };
 
 const word = (s: unknown) => (typeof s === 'string' && /^[\w.-]{1,40}$/.test(s) ? s : null);
@@ -69,28 +64,6 @@ const word = (s: unknown) => (typeof s === 'string' && /^[\w.-]{1,40}$/.test(s)
 export function apiRoute(harbor: Held, o: Options): Handler {
   return async (req, rest) => {
     const json = (status: number, body: unknown) => Response.json(body, { status, headers: open });
-    // The one page this road serves, and it wears the one stylesheet every
-    // screen wears. No cross-origin header on it: a page is for the browser
-    // that was sent here and never for a script somewhere else. Its policy
-    // is the allow page's, and for the same reason: a page that runs no
-    // script of its own should be allowed none.
-    const page = (status: number, body: string) =>
-      new Response(`<!doctype html><html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><title>nervur</title>\n<style>${CSS}</style>\n</head><body>${body}</body></html>`, {
-        status,
-        headers: { 'content-type': 'text/html; charset=utf-8', 'cache-control': 'no-store', 'content-security-policy': POLICY, 'referrer-policy': 'no-referrer' },
-      });
-    // Where this world lives, as the daemon was told and not as the request
-    // said: a Host header is the caller's to write, and a page that printed
-    // one would print whatever a caller wanted a human to read. Falling back
-    // to it is for a box configured with no web address at all, where the
-    // request is the only thing that knows.
-    const hostOf = (r: Request) => {
-      try {
-        return o.web === undefined ? (r.headers.get('host') ?? '') : new URL(o.web).host;
-      } catch {
-        return r.headers.get('host') ?? '';
-      }
-    };
     if (req.method === 'OPTIONS') return new Response(null, { status: 204, headers: open });
     if (req.method !== 'GET' && req.method !== 'POST') return json(405, { error: 'GET or POST' });
     const body = async (): Promise<JsonObject | null> => {
@@ -119,7 +92,7 @@ export function apiRoute(harbor: Held, o: Options): Handler {
       if (!world) return json(400, { error: 'that invitation is for a world that does not live here' });
       const [ward, hosted] = world;
       const identity = word(b.identity);
-      if (identity === null || identity === hosted.record.user || identity === 'desk') return json(400, { error: 'an identity is one word, and not the user or the desk' });
+      if (!isIdentity(hosted, identity)) return json(400, { error: 'an identity is one word, and not a being of the ward' });
       // Nobody at a page vouches for a program, so a trade is a knock that
       // spends: an identity already in refreshes, or is removed at the user
       // being and invited again, and never re-enters on a spent invitation.
@@ -135,48 +108,7 @@ export function apiRoute(harbor: Held, o: Options): Handler {
     const [, named = '', ask = '', ...more] = rest.split('/');
     const ward = named === '' ? harbor.here() : named;
 
-    // The delivery: a vendor's webhook to an envoy, `/api/<ward>/<being>/deliver`.
-    // Not a stranger's ask and not an occupant's: the owner asking her
-    // `deliver` with the raw bytes and the headers, and nothing else. The
-    // body is read as a string and never parsed here, since the vendor
-    // signed the bytes and a reparsed body fails her check; no bearer is
-    // read, since the rung is not the caller's to prove. She answers `{ ok }`
-    // or her error object, and the route carries it.
-    // A GET on the same path is the same ask with an empty body: where an
-    // OAuth redirect lands, the code in the query. The query crosses inside
-    // the headers under `:query`, a name no header on the wire can have, so
-    // her one ask in stays one.
-    if (more.length === 1 && more[0] === 'deliver') {
-      if (req.method !== 'POST' && req.method !== 'GET') return json(405, { error: 'POST, or GET for a redirect' });
-      const hosted = harbor.wards.get(ward);
-      if (!hosted || !/^[\w-]+$/.test(ask)) return json(404, { error: 'no such world' });
-      const raw = req.method === 'GET' ? '' : await readText(req);
-      if (raw === undefined) return json(413, { error: 'too big' });
-      const headers: Record<string, string> = {};
-      req.headers.forEach((v, k) => (headers[k] = v));
-      const query = new URL(req.url).search.slice(1);
-      if (query) headers[':query'] = query;
-      const out = await hosted.ask('ask', { being: ask, method: 'deliver', args: { body: raw, headers } });
-      await hosted.save();
-      // A GET here is a browser and a browser is a human: a vendor a world
-      // sent her to has opened this URL in her tab, so what she is looking
-      // at is whatever the envoy answered a machine. She gets a page
-      // instead, and only she does; a vendor asking for JSON is answered in
-      // JSON as it always was, and so is a GET that says nothing about what
-      // it wants.
-      const wants = req.method === 'GET' && (req.headers.get('accept') ?? '').includes('text/html');
-      if (wants) {
-        const ok = out !== null && typeof out === 'object' && !Array.isArray(out) && typeof (out as { error?: unknown }).error !== 'string';
-        return page(ok ? 200 : 400, landed({ world: ward, host: hostOf(req), ...(o.web ? { at: `${o.web.replace(/\/$/, '')}/${encodeURIComponent(ward)}` } : {}), ok }));
-      }
-      if (isSilence(out) || out === null || typeof out !== 'object' || Array.isArray(out)) return json(503, { error: 'silence' });
-      const said = (out as { error?: unknown }).error;
-      if (said === 'no such being' || said === 'unknown ask') return json(404, { error: 'no such envoy' });
-      if (said === 'silence' || said === 'threw' || said === 'late') return json(503, { error: 'silence' });
-      if (typeof said === 'string') return json(400, out);
-      return json(200, out);
-    }
-    if (!/^[\w.-]+$/.test(ward) || more.length > 0 || (ask !== '' && !/^[\w-]+$/.test(ask))) return json(404, { error: 'GET /api for the device’s ward, GET /api/<ward> for the describe, GET or POST /api/<ward>/<ask> for one ask, POST /api/<ward>/<being>/deliver for a delivery' });
+    if (!/^[\w.-]+$/.test(ward) || more.length > 0 || (ask !== '' && !/^[\w-]+$/.test(ask))) return json(404, { error: 'GET /api for the device’s ward, GET /api/<ward> for the describe, GET or POST /api/<ward>/<ask> for one ask' });
     const hosted = harbor.wards.get(ward);
     if (!hosted) return json(404, { error: 'no such world' });
     let args: JsonObject;

package/beings/avatar.ts

@@ -7,9 +7,9 @@
 // calls the four methods below: one of the two ways in, `enter` behind a
 // route's proof or `join` with an invitation, then `tools` and `call`.
 // Nothing of a side is in her cells.
-import { isSilence, isWord, wordOf } from 'nervur';
-import type { Answer, Blueprint, Invitation, JsonObject, OccupantRecord, Wanted } from 'nervur';
-import { Carrier } from './carry.ts';
+import { Being, isSilence, isWord, wordOf } from 'nervur';
+import type { Answer, Asker, Blueprint, Invitation, JsonObject, OccupantRecord, Reply, Wanted } from 'nervur';
+import { carry } from './carry.ts';
 
 // Her one standing, and the id under which the user being pushes to her.
 // Two ids for one far being, because standings and occupants share one
@@ -17,15 +17,19 @@ import { Carrier } from './carry.ts';
 export const USER = 'user';
 export const PUSHER = 'user:push';
 
-// A carrier who carries for nobody, until a subclass says who: the presence
-// being carries the box's faculties to her user being, and a bare avatar
-// holds one standing and shows nothing of it.
-export class Avatar extends Carrier {
+// She carries for nobody, until a subclass says who: the presence being
+// carries the box's faculties to her user being, and a bare avatar holds
+// one standing and shows nothing of it.
+export class Avatar extends Being {
   static override cells = { inbox: [] as JsonObject[] };
   static override asks = {
     notify: { description: 'a push from the user being', input: { type: 'object' }, for: (occ: OccupantRecord | undefined) => occ?.id === PUSHER },
   };
 
+  override answer(asker: Asker, method?: string, args: JsonObject = {}): Promise<Reply> {
+    return carry(this, asker, method, args, (a, m, g) => super.answer(a, m, g));
+  }
+
   // Her sides' ears. One identity is one avatar for life, and two sessions
   // of that identity are two sides on her at once, so a push goes to every
   // ear present; each side adds its own on open and removes it on close.

package/beings/carry.ts

@@ -1,11 +1,18 @@
 // SPDX-License-Identifier: Apache-2.0
-// A carrier: a being who shows the asks of the standings she holds as asks
-// of her own, and forwards. Whoever she carries for sees, in one describe,
+// Carrying: a being shows the asks of the standings she holds as asks of
+// her own, and forwards. Whoever she carries for sees, in one describe,
 // what she can be asked and what every being she holds can be asked, each
 // under that standing's name; asking one is an ask on that standing, in her
 // name, so the far being sees her and never who is behind her. A user being
-// carries acme for the human's devices; a house being could carry its
-// rooms; nothing here knows what she is.
+// carries her org for the human's devices; a presence being carries her
+// device's faculties to her world; the Dock carries the box's faculties to
+// a screen. Nothing here knows what she is.
+//
+// It is composed and never extended: carrying is something a being does,
+// not what she is, so a being on any rung of the kit's ladder carries by
+// answering through `carry` and saying her rules as statics of her class.
+// The four rules have a default each, and a class says only the ones she
+// means to change.
 //
 // A carried ask is `<id>-<name>`, and the mapping back is kept in her cells
 // and never parsed from the name, so an id with a dash in it is no trouble.
@@ -18,13 +25,49 @@
 // `look` once per digest, and keeps both in her cells. So a describe of
 // hers may cost one ask per stale standing, which is the price of a page
 // that is never more than one ask behind.
-import { Being, isSilence, isWord, wordOf } from 'nervur';
-import type { Asker, Blueprint, JsonObject, OccupantRecord, Reply } from 'nervur';
+import { isSilence, isWord, wordOf } from 'nervur';
+import type { Asker, Being, Blueprint, JsonObject, OccupantRecord, Reply } from 'nervur';
 import { sanitise, type Look } from './look.ts';
 
 type Carried = Record<string, { id: string; ask: string }>;
 type Looks = Record<string, { digest: string | null; look: Look }>;
 
+// The rules a carrying class declares as statics.
+export type Carrying = {
+  // Who sees what she carries. Nobody, until the class says who.
+  carries(occupant: OccupantRecord | undefined, asker: Asker): boolean;
+  // Standings that are plumbing: their own asks are never carried, and
+  // what they carry is. A way back to a device is one, by the dock's own
+  // convention, so a bare avatar's inbox never shows on her and a presence
+  // being's faculties do, under `to:<id>-<name>`, which is how home carries
+  // her phone. A class may name more.
+  hidden(id: string): boolean;
+  // Standings she never reads for carrying at all: a presence being's
+  // standing at her own user being is one, since carrying it would carry
+  // the user being's carrying of her, and round.
+  skips(id: string): boolean;
+  // Which of the standings she carries this asker may see. Every one,
+  // until the class keeps some for fewer: a user being shows her own door
+  // to a device that may mint and to nobody else.
+  shows(id: string, occupant: OccupantRecord | undefined, asker: Asker): boolean;
+};
+
+export const CARRIES: Carrying = {
+  carries: () => false,
+  hidden: (id) => id.startsWith('to:'),
+  skips: () => false,
+  shows: () => true,
+};
+
+// Her rules, read off her class; one she left unsaid is the default.
+function rulesOf(self: Being): Carrying {
+  const C = self.constructor as Partial<Carrying>;
+  return { carries: C.carries ?? CARRIES.carries, hidden: C.hidden ?? CARRIES.hidden, skips: C.skips ?? CARRIES.skips, shows: C.shows ?? CARRIES.shows };
+}
+
+const carriedOf = (self: Being): Carried => ((self.cells.carried as Carried | undefined) ??= {});
+const looksOf = (self: Being): Looks => ((self.cells.looks as Looks | undefined) ??= {});
+
 // The names a far being carries, read off her notes: every ask her
 // `standings` groups name, and each group's page. Empty when she carries
 // nothing, which a bare avatar does not.
@@ -40,120 +83,90 @@ function carriedBy(bp: Blueprint): Set<string> {
   return out;
 }
 
-export class Carrier extends Being {
-  // Who sees what she carries. Nobody, until a subclass says who.
-  static carries(_occupant: OccupantRecord | undefined, _asker: Asker): boolean {
-    return false;
-  }
-  // Standings that are plumbing: their own asks are never carried, and
-  // what they carry is. A way back to a device is one, by the dock's own
-  // convention, so a bare avatar's inbox never shows on her and a presence
-  // being's faculties do, under `to:<id>-<name>`, which is how home carries
-  // her phone. A subclass may name more.
-  static hidden(id: string): boolean {
-    return id.startsWith('to:');
-  }
-  // Standings she never reads for carrying at all: a presence being's
-  // standing at her own user being is one, since carrying it would carry
-  // the user being's carrying of her, and round. None, until a subclass
-  // says which.
-  static skips(_id: string): boolean {
-    return false;
-  }
-  // Which of the standings she carries this asker may see. Every one,
-  // until a subclass keeps some for fewer: a user being shows her own door
-  // to a device that may mint and to nobody else.
-  static shows(_id: string, _occupant: OccupantRecord | undefined, _asker: Asker): boolean {
-    return true;
-  }
-
-  private get carried(): Carried {
-    return ((this.cells.carried as Carried | undefined) ??= {});
-  }
-  private get looks(): Looks {
-    return ((this.cells.looks as Looks | undefined) ??= {});
-  }
-
-  // Her describe with her standings carried into it, for an asker who may
-  // see them. Every other asker gets her describe alone.
-  async blueprint(asker: Asker): Promise<Blueprint> {
-    const C = this.constructor as typeof Carrier;
-    const bp = this.describe(asker);
-    if (!C.carries(this.occupant(asker), asker)) return bp;
-    const own = new Set(bp.asks.map((a) => a.name));
-    const carried: Carried = {};
-    const groups: Record<string, { asks: string[]; look?: Look }> = {};
-    const occ = this.occupant(asker);
-    // By id, and never in the order she happened to take them. Her cells keep
-    // standings in the order they were taken, which is the order a lend
-    // answered, a device came back or a relation was dropped and taken again:
-    // history, and no fact about her. Carried into her blueprint in that
-    // order, her shape would come out differently on two runs that made her
-    // the same way, and her digest with it. The digest is how everyone
-    // holding a standing on her learns she changed, so a shape that follows
-    // history says she changed when nothing about her did, and a watcher
-    // refreshes or walks away over the order two lends came back in.
-    for (const [id, rec] of [...Object.entries(this.cells.standings)].sort(([a], [b]) => (a < b ? -1 : a > b ? 1 : 0))) {
-      if (C.skips(id)) continue;
-      const st = this.standings[id];
-      if (!st) continue;
-      if (!rec.blueprint || rec.seen !== rec.digest) await st.ask(); // her ward writes the record
-      if (!rec.blueprint) continue;
-      // plumbing carries what it carries and nothing of its own: the names
-      // the far being's notes group under her standings, or none
-      const through = C.hidden(id) ? carriedBy(rec.blueprint) : null;
-      if (through && through.size === 0) continue;
-      // The mapping is written for every standing she carries, whoever is
-      // asking: it is one map in her cells, and the last describe must not
-      // decide what the next asker may call. Who sees a standing is decided
-      // here and again at answer, by `shows`.
-      const shown = C.shows(id, occ, asker);
-      // her look is kept here once per digest and never carried as an ask;
-      // her page follows every call, so it is carried as one and named in
-      // the notes, where every side finds it and none takes it for a form
-      const names: string[] = [];
-      const group: { asks: string[]; look?: Look; page?: string } = { asks: names };
-      for (const a of rec.blueprint.asks) {
-        if (a.name === 'look') continue;
-        if (through && !through.has(a.name)) continue;
-        const name = `${id}-${a.name}`;
-        if (own.has(name)) continue;
-        carried[name] = { id, ask: a.name };
-        if (!shown) continue;
-        bp.asks.push({ ...a, name });
-        if (a.name === 'page') group.page = name;
-        else names.push(name);
-      }
+// Her describe with her standings carried into it, for an asker who may
+// see them. Every other asker gets her describe alone.
+export async function blueprint(self: Being, asker: Asker): Promise<Blueprint> {
+  const rules = rulesOf(self);
+  const bp = self.describe(asker);
+  const occ = self.occupant(asker);
+  if (!rules.carries(occ, asker)) return bp;
+  const own = new Set(bp.asks.map((a) => a.name));
+  const carried: Carried = {};
+  const groups: Record<string, { asks: string[]; look?: Look }> = {};
+  const looks = looksOf(self);
+  // By id, and never in the order she happened to take them. Her cells keep
+  // standings in the order they were taken, which is the order a lend
+  // answered, a device came back or a relation was dropped and taken again:
+  // history, and no fact about her. Carried into her blueprint in that
+  // order, her shape would come out differently on two runs that made her
+  // the same way, and her digest with it. The digest is how everyone
+  // holding a standing on her learns she changed, so a shape that follows
+  // history says she changed when nothing about her did, and a watcher
+  // refreshes or walks away over the order two lends came back in.
+  for (const [id, rec] of [...Object.entries(self.cells.standings)].sort(([a], [b]) => (a < b ? -1 : a > b ? 1 : 0))) {
+    if (rules.skips(id)) continue;
+    const st = self.standings[id];
+    if (!st) continue;
+    if (!rec.blueprint || rec.seen !== rec.digest) await st.ask(); // her ward writes the record
+    if (!rec.blueprint) continue;
+    // plumbing carries what it carries and nothing of its own: the names
+    // the far being's notes group under her standings, or none
+    const through = rules.hidden(id) ? carriedBy(rec.blueprint) : null;
+    if (through && through.size === 0) continue;
+    // The mapping is written for every standing she carries, whoever is
+    // asking: it is one map in her cells, and the last describe must not
+    // decide what the next asker may call. Who sees a standing is decided
+    // here and again at answer, by `shows`.
+    const shown = rules.shows(id, occ, asker);
+    // her look is kept here once per digest and never carried as an ask;
+    // her page follows every call, so it is carried as one and named in
+    // the notes, where every side finds it and none takes it for a form
+    const names: string[] = [];
+    const group: { asks: string[]; look?: Look; page?: string } = { asks: names };
+    for (const a of rec.blueprint.asks) {
+      if (a.name === 'look') continue;
+      if (through && !through.has(a.name)) continue;
+      const name = `${id}-${a.name}`;
+      if (own.has(name)) continue;
+      carried[name] = { id, ask: a.name };
       if (!shown) continue;
-      if (rec.blueprint.asks.some((a) => a.name === 'look')) {
-        const kept = this.looks[id];
-        if (!kept || kept.digest !== rec.digest) {
-          const l = await st.ask('look');
-          this.looks[id] = { digest: rec.digest, look: isSilence(l) || isWord(l) ? {} : sanitise(l) };
-        }
-        group.look = this.looks[id].look;
+      bp.asks.push({ ...a, name });
+      if (a.name === 'page') group.page = name;
+      else names.push(name);
+    }
+    if (!shown) continue;
+    if (rec.blueprint.asks.some((a) => a.name === 'look')) {
+      const kept = looks[id];
+      if (!kept || kept.digest !== rec.digest) {
+        const l = await st.ask('look');
+        looks[id] = { digest: rec.digest, look: isSilence(l) || isWord(l) ? {} : sanitise(l) };
       }
-      groups[id] = group;
+      group.look = looks[id].look;
     }
-    for (const id of Object.keys(this.looks)) if (!(id in groups)) delete this.looks[id];
-    this.cells.carried = carried;
-    const notes = bp.notes !== null && typeof bp.notes === 'object' && !Array.isArray(bp.notes) ? bp.notes : {};
-    return { asks: bp.asks, notes: { ...notes, standings: groups as unknown as JsonObject } };
+    groups[id] = group;
   }
+  for (const id of Object.keys(looks)) if (!(id in groups)) delete looks[id];
+  self.cells.carried = carried;
+  const notes = bp.notes !== null && typeof bp.notes === 'object' && !Array.isArray(bp.notes) ? bp.notes : {};
+  return { asks: bp.asks, notes: { ...notes, standings: groups as unknown as JsonObject } };
+}
 
-  override async answer(asker: Asker, method?: string, args: JsonObject = {}): Promise<Reply> {
-    if (method === undefined) return this.blueprint(asker);
-    const C = this.constructor as typeof Carrier;
-    const to = Object.hasOwn(this.carried, method) ? this.carried[method] : undefined;
-    const occ = this.occupant(asker);
-    if (to && C.carries(occ, asker) && C.shows(to.id, occ, asker)) {
-      const st = this.standings[to.id];
-      if (!st) return { error: 'unknown ask' };
-      const out = await st.ask(to.ask, args);
-      if (isSilence(out)) return out;
-      if (isWord(out)) return { error: wordOf(out) };
-      return out;
-    }
-    return super.answer(asker, method, args);
+// Her answer, carrying: the empty ask is her carried blueprint, a carried
+// name is an ask on that standing in her name, and everything else is her
+// own, which the class hands in as `own`.
+export async function carry(self: Being, asker: Asker, method: string | undefined, args: JsonObject, own: (asker: Asker, method: string, args: JsonObject) => Promise<Reply>): Promise<Reply> {
+  if (method === undefined) return blueprint(self, asker);
+  const rules = rulesOf(self);
+  const carried = carriedOf(self);
+  const to = Object.hasOwn(carried, method) ? carried[method] : undefined;
+  const occ = self.occupant(asker);
+  if (to && rules.carries(occ, asker) && rules.shows(to.id, occ, asker)) {
+    const st = self.standings[to.id];
+    if (!st) return { error: 'unknown ask' };
+    const out = await st.ask(to.ask, args);
+    if (isSilence(out)) return out;
+    if (isWord(out)) return { error: wordOf(out) };
+    return out;
   }
+  return own(asker, method, args);
 }

package/beings/clock.ts

@@ -31,7 +31,11 @@
 // process the way every cell does, and is gone when it is dropped.
 import { Being, isSilence, isWord, wordOf, OWNER } from 'nervur';
 import type { Asker, Invitation, Json, JsonObject, OccupantRecord, Stance } from 'nervur';
-import { TIMER, join } from '../dock/index.ts';
+import { TIMER as TIMING } from '../box/timer.ts';
+import { join } from '../box/join.ts';
+
+// Her standing at the box's timer, under an id of her own.
+const TIMER = 'timer';
 
 // The root and nobody else. `OWNER` is one of the ward's own words, refused at
 // every mint, so no occupant can ever wear it: an ask gated this way is the
@@ -311,7 +315,7 @@ export class Clock extends Being {
   readonly joined: Promise<string | null>;
   constructor(stance: Stance) {
     super(stance);
-    this.joined = join(this, TIMER, { method: 'tick' });
+    this.joined = join(this, TIMING, TIMER, { method: 'tick' });
   }
 
   static override asks = {
@@ -377,15 +381,15 @@ export class Clock extends Being {
   // it keeps them, for the same reason the base does.
   protected async told(): Promise<void> {
     if (!Object.hasOwn(this.cells.standings, TIMER)) return;
-    const timer = this.standings[TIMER];
-    const said = await timer?.ask('now', {});
-    const now = said !== null && typeof said === 'object' ? (said as { now?: unknown }).now : undefined;
+    const hers = this.standings[TIMER];
+    const heard = await hers?.ask('now', {});
+    const now = heard !== null && typeof heard === 'object' ? (heard as { now?: unknown }).now : undefined;
     if (typeof now !== 'number' || !Number.isFinite(now)) return;
     // A schedule due at this very moment is a round now, not a round at the
     // next moment after it: what she was handed is a minute already begun,
     // and the schedule kept inside it names it.
     const at = this.schedules().some((s) => this.#ready(s, now)) ? now : this.#soonest(floor(now));
-    if (at !== null) await timer?.ask('due', { at });
+    if (at !== null) await hers?.ask('due', { at });
   }
 
   // One list, her own cell and nothing else.
@@ -536,7 +540,7 @@ export const CLOCK = 'clock';
 // because it is the same act: the owner creates and places, and the work is
 // hers from then on.
 export async function setupClock(hosted: Owner, wakes: string[] = []): Promise<void> {
-  const out = (await hosted.ask('boot', { key: CLOCK, class: 'Clock' })) as { error?: string };
+  const out = (await hosted.ask('boot', { key: CLOCK, class: 'beings/Clock' })) as { error?: string };
   if (out.error) throw new Error(`clock: ${out.error}`);
   for (const being of wakes) await placeClock(hosted, being);
 }

package/beings/desk.ts

@@ -8,7 +8,7 @@
 // way in turns a proof of one kind into who it is for: which user, which
 // client identity. The ways in are beings, and the desk reaches each of
 // them as she reaches anything, at a standing under `way:<kind>`: the
-// world's own, placed by the root, and the box's, lent by the dock ward and
+// world's own, placed by the root, and the box's, lent by the box ward and
 // taken at her birth, so a box with no local side offers no such kind.
 //
 // A kind whose proof the world has to hand out first answers `send` beside
@@ -18,8 +18,8 @@
 // place, so a side that renders her renders every way into this world.
 import { Being, isSilence, isWord, wordOf } from 'nervur';
 import type { Asker, Blueprint, JsonObject, Reply, Stance } from 'nervur';
-import { join } from '../dock/faculty.ts';
-import { LOCAL } from '../dock/local.ts';
+import { join } from '../box/join.ts';
+import { LOCAL } from '../box/local.ts';
 import { WAY, kindOf, verified } from './way.ts';
 
 export class Desk extends Being {
@@ -34,7 +34,7 @@ export class Desk extends Being {
   // nothing under that id and the kind is not offered.
   constructor(stance: Stance) {
     super(stance);
-    void join(this, LOCAL, undefined, WAY(LOCAL));
+    void join(this, LOCAL, WAY('local'));
   }
 
   // The ids of the ways in she holds, in the order they were placed.
@@ -114,8 +114,9 @@ export class Desk extends Being {
     // key. A way in that does not say `make` reaches an existing household
     // and nothing else, which is what the local kind on a device does.
     if (!this.standings[id] && (who.make === true || typeof who.make === 'string')) {
-      if (!/^[\w.-]{1,80}$/.test(who.user) || who.user === 'desk') return { error: 'a user is a word, and not desk' };
-      if ((await this.boot(typeof who.make === 'string' ? who.make : 'User', who.user, id)) === null) return { error: 'no such user' };
+      // a key the ward already holds, her own included, is refused by the boot
+      if (!/^[\w.-]{1,80}$/.test(who.user)) return { error: 'a user is a word' };
+      if ((await this.boot(typeof who.make === 'string' ? who.make : 'beings/User', who.user, id)) === null) return { error: 'no such user' };
       await this.standings[id]!.ask('hello', { name: who.user });
     }
     const user = this.standings[id];