@nervur-org/dock 0.4.1 → 0.6.0

package/dist/cli/daemon.js

@@ -32,11 +32,11 @@
 //               <- { ok: as } | { error }, then one line per final text
 //
 // The proof for a local side is that it reached side.sock: the daemon mints
-// a nonce for the connection on the `local` faculty of its dock ward, the
+// a nonce for the connection on the `local` faculty of its box ward, the
 // box's own way in, and the desk trades it at a standing there, once. A
 // `local` proof arriving any other way names no nonce and is refused.
 //
-// Agents have no door: the `agents` faculty of the dock ward holds each
+// Agents have no door: the `agents` faculty of the box ward holds each
 // agent's identity, her ward, her command and her folder, placed by the
 // root with `keep` as a schedule is placed on the clock, and the daemon
 // admits her on the local proof and runs the agent side beside her avatar
@@ -79,8 +79,7 @@
 // wards, and reconnects with backoff, so a Mac behind NAT is reached
 // through the droplet it dialed.
 import { createServer } from 'node:net';
-import { unlink, chmod, mkdir, readFile, writeFile } from 'node:fs/promises';
-import { existsSync } from 'node:fs';
+import { unlink, chmod } from 'node:fs/promises';
 import { createHash, randomBytes } from 'node:crypto';
 import { tmpdir } from 'node:os';
 import { join, resolve } from 'node:path';
@@ -89,12 +88,10 @@ import { isSilence, isWord, wordOf } from 'nervur';
 import { DiskHarbor, defaultWard } from '../harbor/disk.js';
 // an identity in a world: the three asks any terrain's routes make at a ward
 export { avatarOf, letIn, find } from '../beings/join.js';
-import { avatarOf, letIn, find } from '../beings/join.js';
-import { DOCK, FACULTIES, LOCAL, PUSH, TIMER, Local, Push, Timer, facultyOf, publicOf, routed, settled, webPush } from '../dock/index.js';
-import { apnsHttp2, apnsOf } from '../dock/http2.js';
-import { GRANTS, Grants } from '../dock/grants.js';
-import { AGENTS, Agents, isProcess } from '../dock/agents.js';
-import { DIALERS, Dialers } from '../dock/dialers.js';
+import { avatarOf, isIdentity, letIn, find } from '../beings/join.js';
+import { Http as Wire, routed, webPush } from '../box/index.js';
+import { apnsHttp2, apnsOf } from '../box/http2.js';
+import { AGENTS, Agents, BOX, BOX_SEED, DIALERS, Dialers, GRANTS, Grants, LOCAL, Local, PUSH, Push, TIMER, Timer, WIRE, boxOf, isProcess, keyLent, lent, settled } from '../box/index.js';
 import { mcpSide } from '../mcp/server.js';
 import { runnerSide } from '../mcp/runner.js';
 import { agentSide, processRun } from '../mcp/agent.js';
@@ -126,11 +123,11 @@ export const sidePath = (dir) => socketPath(dir, 'side');
 // the first time only; to change one, remove the occupant and admit again.
 // The one path for a side on the device: agents, and sides on side.sock.
 //
-// The nonce is minted on the `local` faculty of this box's dock ward, in
+// The nonce is minted on the `local` faculty of this box's box ward, in
 // this process, as a device fires its own timer. A box that lends no such
 // name has no local way in, and nothing here can make one up.
 export async function admit(harbor, hosted, identity, wake = false, reach = false) {
-    const local = facultyOf(harbor, LOCAL);
+    const local = await lent(harbor, LOCAL);
     if (!local)
         return { error: 'this box has no local way in' };
     const found = await avatarOf(hosted, identity);
@@ -138,7 +135,7 @@ export async function admit(harbor, hosted, identity, wake = false, reach = fals
         return found;
     const nonce = randomBytes(16).toString('hex');
     local.mint(nonce, { user: hosted.record.user, client: identity, ...(wake ? { wake: true } : {}), ...(reach ? { reach: true } : {}) });
-    const entered = await found.avatar.enter({ ward: hosted.pk }, { kind: LOCAL, nonce });
+    const entered = await found.avatar.enter({ ward: hosted.pk }, { kind: 'local', nonce });
     local.drop(nonce);
     await hosted.save(); // the knock went through the ward's own door, which the harbor never sees
     if ('error' in entered && !('asks' in entered))
@@ -158,8 +155,8 @@ async function tick(harbor, now) {
     // booted a moment ago is still taking one, and a round that ran past her
     // would be a schedule placed and a minute missed for no reason a reader
     // could see.
-    await settled();
-    const timer = facultyOf(harbor, TIMER);
+    await settled(harbor);
+    const timer = await lent(harbor, TIMER);
     if (!timer)
         return;
     try {
@@ -194,17 +191,58 @@ export async function serve(dir, options = {}) {
     // world's own web origin; the push faculty reads the map at each ring, so
     // it is this daemon's `Push` body and no static set on a class.
     const rings = { ...options.rings };
+    // The web ring is hers alone: Web Push signed under the doorbell key she
+    // minted at the root's first ask, with this world's web origin as the
+    // subject a push service may complain to, known once the routes are.
+    let subject;
     class DaemonPush extends Push {
+        static stands() {
+            return true;
+        }
+        #web;
         get rings() {
-            return rings;
+            const key = this.key;
+            if (rings.web || !key || !subject)
+                return rings;
+            return { ...rings, web: (this.#web ??= webPush({ key, subject })) };
+        }
+    }
+    const harbor = new DiskHarbor(dir);
+    // The lines this box holds open are dialed for its own harbor, and an
+    // agent runs as an identity admitted on the local proof with a side over
+    // her avatar: the two live things only this process has, handed in the
+    // class bodies it brings.
+    class DaemonDialers extends Dialers {
+        static stands() {
+            return true;
+        }
+        constructor(stance, box) {
+            super(stance, box, harbor);
+        }
+    }
+    class DaemonAgents extends Agents {
+        static stands() {
+            return true;
+        }
+        constructor(stance, box) {
+            super(stance, box, async (row) => {
+                const hosted = harbor.wards.get(row.ward);
+                if (!hosted)
+                    throw new Error(`agent ${row.id}: this device hosts no ward ${row.ward}`);
+                const admitted = await admit(harbor, hosted, row.id);
+                if (!admitted.avatar)
+                    throw new Error(`agent ${row.id}: ${admitted.error}`);
+                // a process is the agent side, a model is the runner: both take a push as the event
+                return isProcess(row) ? agentSide(admitted.avatar, processRun(row.command, row.args, row.dir), () => hosted.save()) : runnerSide(admitted.avatar, row, () => { }, () => hosted.save());
+            });
         }
     }
-    const harbor = new DiskHarbor(dir, undefined, { Push: DaemonPush, Grants, Agents, Dialers });
-    // What a daemon lends beyond every box's faculties: `local`, the way in
-    // for a process it saw on its own socket, and `grants`, the bearers its
-    // routes honour. A device with no daemon has neither name, and the desk
-    // there is a world nobody walks into locally.
-    harbor.lent = { ...FACULTIES, [LOCAL]: 'Local', [GRANTS]: 'Grants', [AGENTS]: 'Agents', [DIALERS]: 'Dialers' };
+    // What a daemon brings to its own ward: the timer, `local`, the way in for
+    // a process it saw on its own socket, the grants its routes honour, and
+    // the ring, the lines and the agents it builds here. A device with no
+    // daemon brings none of the last five, and the desk there is a world
+    // nobody walks into locally.
+    harbor.faculties = { box: { Timer, Local, Grants, Http: Wire }, cli: { DaemonPush, DaemonDialers, DaemonAgents } };
     // A store that refused a save, once per ward. Every asker whose write was
     // refused has already been told, at the door that caused it, and none of
     // them is this operator: a disk that has stopped taking one world's writes
@@ -215,6 +253,15 @@ export async function serve(dir, options = {}) {
             console.log(JSON.stringify({ at: new Date().toISOString(), refused: name }));
     };
     await harbor.boot();
+    // A contract two classes clashed under is lent to nobody, and the Dock
+    // keeps which; an operator reads it here, once, at boot, and the box is
+    // up either way.
+    const stood = (await harbor.wards.get(BOX_SEED)?.ask('ask', { being: BOX, method: 'lends' }));
+    for (const [word, keys] of Object.entries(stood?.clashes ?? {}))
+        console.log(JSON.stringify({ at: new Date().toISOString(), clash: word, between: keys }));
+    // What the box is, asked of the Dock and read from no file: its routes,
+    // its apps and its default ward, each placed by the root through her asks.
+    const box = await boxOf(harbor);
     // A ward the folder keeps and the harbor could not open stops this daemon
     // here. The core is right to carry on without it, since a device with many
     // worlds must not lose them all to one, but a daemon's folder is an
@@ -239,7 +286,7 @@ export async function serve(dir, options = {}) {
     let mcp = null;
     let agents = null;
     // the dialers faculty holds the lines; the route's view of them is hers
-    const dialers = facultyOf(harbor, DIALERS);
+    const dialers = await lent(harbor, DIALERS);
     if (!dialers)
         throw new Error('this box has no dialers faculty');
     const quo = {
@@ -266,40 +313,41 @@ export async function serve(dir, options = {}) {
             // The box's grants, one faculty for every route: a bearer names an
             // identity in a world, the identity names her avatar there, and the
             // route only says the grammar. Nothing is minted for a bearer. Her
-            // cells are the dock ward's to keep, so a token issued saves it.
-            grants = facultyOf(harbor, GRANTS) ?? null;
+            // cells are the box ward's to keep, so a token issued saves it.
+            grants = (await lent(harbor, GRANTS)) ?? null;
             if (!grants)
                 throw new Error('this box has no grants');
-            grants.persist = () => harbor.wards.get(DOCK)?.save() ?? Promise.resolve();
-            const resolve = async (identity, ward) => {
+            const findIn = async (identity, ward) => {
                 const hosted = harbor.wards.get(ward);
                 return hosted ? find(hosted, identity) : { error: 'no such world' };
             };
-            const join = async (identity, invitation, ward) => {
+            const joinIn = async (identity, invitation, ward) => {
                 const hosted = harbor.wards.get(ward);
                 if (!hosted)
                     return { error: 'no such world' };
                 const r = await letIn(hosted, identity, invitation);
                 return r.error ? { error: r.error } : {};
             };
-            const routes = options.routes ?? (await readRoutes(harbor.dir));
+            const routes = options.routes ?? box.routes;
             const here = `http://${http.host}:${http.port}`;
             const at = { quo: routes?.quo ?? `${here}/quo`, web: routes?.web ?? `${here}/web` };
+            subject = new URL(at.web).origin;
             // a stranger's public being as {}, or an occupant's avatar under a
             // bearer; `web` is for its one human arrival, a redirect landing back
             // which ward a caller who names none is at is the terrain's word, and
             // on a disk it is the mark an operator wrote, read below at `defaultWard`
-            http.mount('/api', apiRoute({ wards: harbor.wards, here: () => harbor.defaultWard }, { grants, resolve, join, web: at.web }));
+            http.mount('/api', apiRoute({ wards: harbor.wards, here: () => harbor.defaultWard }, { grants, resolve: findIn, join: joinIn }));
             // The web ring, under the world's own doorbell key: the push faculty
             // mints it the first time this box serves a web route and keeps it in
             // her cells, so it lives with the wards and in no file. The ring is
             // Web Push signed under it, and the subject a push service may
             // complain to is this world's own web route, which every world has.
-            const push = facultyOf(harbor, PUSH);
+            const push = await lent(harbor, PUSH);
             if (!push)
                 throw new Error('this box has no push faculty');
-            const key = await push.mint();
-            rings.web ??= webPush({ key, subject: new URL(at.web).origin });
+            const bell = (await harbor.wards.get(BOX_SEED)?.ask('ask', { being: await keyLent(harbor, PUSH), method: 'bell' }));
+            if (typeof bell?.bell !== 'string')
+                throw new Error('this box minted no doorbell key');
             // The two rings the stores own. A world holds no platform key and
             // never will, because Apple and Google sign a push only for the team
             // that published the app, so a ring to a phone is handed to a bell
@@ -322,16 +370,16 @@ export async function serve(dir, options = {}) {
             // the worlds' pages: always, on the daemon's own door when no route names a public one
             // the bundles the dock's build emitted: read here, because reading a
             // file is the terrain's and a route is handed the code
-            const web = webRoute(harbor, { at, code: await bundles(), folder: diskFolder(harbor.dir), apps: options.apps ?? (await readApps(harbor.dir)), bell: publicOf(key), shown: (n) => DiskHarbor.isShown(harbor.dir, n) });
+            const web = webRoute(harbor, { at, code: await bundles(), folder: diskFolder(harbor.dir), apps: options.apps ?? box.apps, bell: bell.bell, shown: (n) => DiskHarbor.isShown(harbor.dir, n) });
             if (routes) {
                 // the worlds a client may be allowed into: every ward here but the
                 // dock, which is the box's and nobody's world, by name and pk, the device's own first
                 const worlds = () => [...harbor.wards]
-                    .filter(([ward]) => ward !== DOCK)
+                    .filter(([ward]) => ward !== BOX_SEED)
                     .sort(([a], [b]) => (a === harbor.defaultWard ? -1 : b === harbor.defaultWard ? 1 : a.localeCompare(b)))
                     .map(([ward, h]) => ({ ward, pk: h.pk, user: h.record.user }));
                 // the MCP endpoint: a bearer names an identity in a world, the identity names her avatar there, the side runs beside her
-                mcp = new McpHttp(resolve, async () => {
+                mcp = new McpHttp(findIn, async () => {
                     for (const h of harbor.wards.values())
                         await h.save();
                 });
@@ -341,7 +389,7 @@ export async function serve(dir, options = {}) {
                 http.mount('/.well-known', route.wellKnown); // the same discovery at the origin's root, where a client looks for an issuer that has a path
                 const g = grants;
                 mcp.gone = (identity, ward) => g.revoke(identity, ward); // removal at the ward ends the grant at the box
-                exchange = new Exchange({ oauth, worlds, join });
+                exchange = new Exchange({ oauth, worlds, join: joinIn });
             }
             const ex = exchange;
             http.mount('/web', async (req, rest) => 
@@ -351,35 +399,28 @@ export async function serve(dir, options = {}) {
             (await web(req, rest)) ??
                 (ex && (await ex.handle(req, rest))) ??
                 new Response('no such page', { status: 404, headers: { 'content-type': 'text/plain' } }));
+            // Every other path is the box's wire: a faculty that claims it answers.
+            // Mounted last, so every route above is tried first.
+            const wire = await lent(harbor, WIRE);
+            if (wire)
+                http.mount('/', (req) => wire.handle(req));
         }
         // the routes this box holds a socket to are rows on the dialers faculty,
         // dialed from her cells at every boot; `dial` is a suite's way of placing one
         for (const url of options.dial ?? []) {
             const kept = dialers.keep({ url });
             if ('error' in kept)
-                throw new Error(String(kept.error));
+                throw new Error(JSON.stringify(kept.error));
         }
-        dialers.start(harbor);
-        // Which of its wards is the default: the agents and the ward the door
-        // answers for hang off it, and a guess failing in silence is not a way
-        // to find out.
-        harbor.defaultWard = defaultWard(await DiskHarbor.marked(harbor.dir), [...harbor.wards.keys()]);
-        // The agents faculty holds the table; this daemon is what runs a row:
-        // the identity admitted into her ward on the local proof, and the agent
-        // side over her avatar for as long as the daemon serves.
-        agents = facultyOf(harbor, AGENTS) ?? null;
+        // Which of its wards is the default: the ward the door answers for hangs
+        // off it, and a guess failing in silence is not a way to find out.
+        harbor.defaultWard = defaultWard(box.default === null ? [] : [box.default], [...harbor.wards.keys()]);
+        agents = (await lent(harbor, AGENTS)) ?? null;
         if (!agents)
             throw new Error('this box has no agents faculty');
-        await agents.start(async (row) => {
-            const hosted = harbor.wards.get(row.ward);
-            if (!hosted)
-                throw new Error(`agent ${row.id}: this device hosts no ward ${row.ward}`);
-            const admitted = await admit(harbor, hosted, row.id);
-            if (!admitted.avatar)
-                throw new Error(`agent ${row.id}: ${admitted.error}`);
-            // a process is the agent side, a model is the runner: both take a push as the event
-            return isProcess(row) ? agentSide(admitted.avatar, processRun(row.command, row.args, row.dir), () => hosted.save()) : runnerSide(admitted.avatar, row, () => { }, () => hosted.save());
-        });
+        // The box is up: the lines are dialed and the agents run, and the daemon
+        // serves once they have.
+        await harbor.box.raise();
     }
     catch (e) {
         for (const s of servers)
@@ -405,7 +446,7 @@ export async function serve(dir, options = {}) {
         // daemon fire what is due right now.
         tick: (now) => tick(harbor, now),
         close: async () => {
-            facultyOf(harbor, TIMER)?.stop();
+            (await lent(harbor, TIMER))?.stop();
             await mcp?.close();
             await agents?.close();
             dialers.close();
@@ -431,7 +472,7 @@ async function sideConnection(harbor, c) {
         hosted = harbor.wards.get(req.ward ?? harbor.defaultWard);
         if (!hosted)
             throw new Error('no such ward');
-        if (typeof req.as !== 'string' || !/^[\w.-]+$/.test(req.as) || req.as === hosted.record.user || req.as === 'desk')
+        if (!isIdentity(hosted, req.as))
             throw new Error('as is a word, and not a being of the ward');
         as = req.as;
         if (req.run !== undefined) {
@@ -529,56 +570,10 @@ async function handle(harbor, line) {
             }
         }
         const out = await hosted.ask(req.method, req.args ?? {});
-        return JSON.stringify({ id, result: isSilence(out) ? { silence: true } : out });
+        // the ward it landed on, named back, since a request naming none is on the default and the caller may need its name
+        return JSON.stringify({ id, ward: hosted.name, result: isSilence(out) ? { silence: true } : out });
     }
     catch (e) {
         return JSON.stringify({ id, error: e instanceof Error ? e.message : String(e) });
     }
 }
-// The four routes by the one convention: `mcp.`, `web.`, `quo.` and `api.`
-// under one domain, over https. A domain is said once and the names follow;
-// an estate whose names break the convention edits the file it wrote.
-export const DOMAIN = /^[a-z0-9.-]+\.[a-z]{2,}$/i;
-export function routesFor(domain) {
-    if (!DOMAIN.test(domain))
-        throw new Error(`${domain} is not a domain`);
-    return { mcp: `https://mcp.${domain}`, web: `https://web.${domain}`, quo: `https://quo.${domain}`, api: `https://api.${domain}` };
-}
-export async function writeRoutes(dir, domain) {
-    const routes = routesFor(domain);
-    await mkdir(dir, { recursive: true });
-    await writeFile(join(dir, 'routes.json'), JSON.stringify(routes) + '\n');
-    return routes;
-}
-// `<dir>/routes.json`: { mcp, web, quo?, api? }, the public origins the proxy serves.
-export async function readRoutes(dir) {
-    const p = join(dir, 'routes.json');
-    if (!existsSync(p))
-        return null;
-    const r = JSON.parse(await readFile(p, 'utf8'));
-    if (typeof r.mcp !== 'string' || typeof r.web !== 'string')
-        return null;
-    const out = { mcp: r.mcp.replace(/\/$/, ''), web: r.web.replace(/\/$/, '') };
-    if (typeof r.quo === 'string')
-        out.quo = r.quo.replace(/\/$/, '');
-    if (typeof r.api === 'string')
-        out.api = r.api.replace(/\/$/, '');
-    return out;
-}
-// `<dir>/app.json`: { apple: [...], android: [{ package, fingerprints }] }, the
-// apps whose links this world's hostname opens, as the two platforms want
-// them named. An estate that ships no app of its own writes no such file,
-// serves no association file, and its links open the tab.
-export async function readApps(dir) {
-    const p = join(dir, 'app.json');
-    if (!existsSync(p))
-        return null;
-    const r = JSON.parse(await readFile(p, 'utf8'));
-    const apple = Array.isArray(r.apple) ? r.apple.filter((x) => typeof x === 'string') : [];
-    const android = Array.isArray(r.android)
-        ? r.android
-            .filter((a) => typeof a?.package === 'string' && Array.isArray(a.fingerprints))
-            .map((a) => ({ package: a.package, fingerprints: a.fingerprints.filter((f) => typeof f === 'string') }))
-        : [];
-    return apple.length === 0 && android.length === 0 ? null : { apple, android };
-}

package/dist/cli/estate.js

@@ -4,7 +4,7 @@
 // that device runs minus what it mints, its routes under the domain, no
 // agents, no schedules, no classes of its own, and that device's unit and
 // Caddyfile; and `mac/`, the launchd agent that runs the daemon on an
-// operator's Mac as a dialer, with the dial list it holds. A package file
+// operator's Mac as a dialer. A package file
 // that depends on this dock and nothing else, and one document to fill in.
 // An estate needs nothing the dock does not give it, and this is the dock
 // giving it.
@@ -12,7 +12,7 @@ import { existsSync } from 'node:fs';
 import { mkdir, readFile, writeFile } from 'node:fs/promises';
 import { basename, join } from 'node:path';
 import { fileURLToPath } from 'node:url';
-import { DOMAIN, routesFor } from './daemon.js';
+import { DOMAIN } from '../box/index.js';
 // This package's own version, read beside the emitted or the source tree.
 async function version() {
     for (const rel of ['../package.json', '../../package.json']) {
@@ -35,7 +35,6 @@ export async function estate(dir, domain) {
     const files = {
         'package.json': JSON.stringify({ name, private: true, description: `The ${name} estate: one owner's harbors, built on the dock and nothing else.`, type: 'module', dependencies: { '@nervur-org/dock': `^${await version()}` } }, null, 2) + '\n',
         [`${name}.md`]: `# ${name}\n\nAn estate: all of one owner's harbors. One folder per harbor, each the harbor\ndirectory that device runs minus what it mints, plus that device's unit.\n\`droplet/\` is the first: its routes under \`${domain}\`, its agents, its\nclasses, its systemd unit and its Caddyfile. This folder depends on the\ndock and nothing else.\n\n## The droplet\n\nWhere it is, how it is reached, and what was done to stand it up: yours\nto write.\n`,
-        'droplet/routes.json': JSON.stringify(routesFor(domain)) + '\n',
         'droplet/stand.ts': `// SPDX-License-Identifier: Apache-2.0\n// What the root stands up on this harbor, once, after the inits and with no\n// daemon over the folder: the beings the estate boots for its own working\n// and the relations between them, placed on real invitations. Run as\n// \`node droplet/stand.ts <dir>\`; twice is once.\nimport { stand } from '@nervur-org/dock/stand';\n\nconsole.log(await stand(process.argv[2] ?? process.env.NERVUR_DIR ?? '', { boot: [], wire: [] }));\n`,
         'droplet/classes/index.ts': '// The classes this harbor holds beside the dock\'s built-in ones, exported\n// by name.\nexport {};\n',
         'droplet/nervur.service': (await template('nervur.service')).replaceAll('ESTATE', name),

package/dist/cli/nervur.js

@@ -10,14 +10,15 @@
 // device holds for the daemon is either: the unit, the unix user, the home
 // and the environment file all say nervur.
 //
-//   nervur init   [--dir D] [--ward W] [--user U] [--class C] [--default] [--show] [--domain DOM]  mint a seed, boot a ward over a disk store, write both; C is the class of the ward's home being, User unless said; --default marks it the default ward; --show shows it at the web route; --domain writes the four routes under DOM
+//   nervur init   [--dir D] [--ward W] [--user U] [--class C] [--default] [--show] [--domain DOM]  mint a seed, boot a ward over a disk store, write both; C is the class of the ward's home being, beings/User unless said; --default marks it the default ward; --show shows it at the web route; --domain writes the four routes under DOM
 //   nervur default [--dir D] <ward>             mark one ward the default, the one a caller means when naming none; the one ward hosted is the default unmarked
 //   nervur show|hide [--dir D] <ward>           show a ward at the web route, listed at its root and its public being's page painted for a stranger; hidden at init, and a hidden ward's page is the plain door
-//   nervur domain [--dir D] <domain>            write routes.json by the convention: mcp., web., quo. and api. under the domain, over https
-//   nervur serve  [--dir D] [--http PORT]      the daemon: harbor from disk, the two sockets, the HTTP door on loopback, a socket held to every route the dialers faculty keeps
+//   nervur domain [--dir D] <domain>            say the four routes by the convention, mcp., web., quo. and api. under the domain over https, a cell of the Dock
+//   nervur apps   [--dir D] <json>              say the apps this box's links open, { apple, android }, a cell of the Dock; {} forgets them
+//   nervur serve  [--dir D] [--http PORT] [--host ADDR]  the daemon: harbor from disk, the two sockets, the HTTP door on ADDR, 127.0.0.1 unless said, a socket held to every route the dialers faculty keeps
 //   nervur census [--dir D] [--ward W] [--via S]        the empty ask: pk and every being
 //   nervur boot   [--dir D] [--ward W] [--via S] <json> { key, class, public? }
-//   nervur invite [--dir D] [--ward W] [--via S] <json> { being, id }; with routes.json naming web., the answer carries the link
+//   nervur invite [--dir D] [--ward W] [--via S] <json> { being, id }; with the box's routes naming web., the answer carries the link
 //   nervur knock  [--dir D] [--ward W] [--via S] <json> { being | { boot, key }, id, invitation, method?, args?, wanted? }
 //   nervur remove [--dir D] [--ward W] [--via S] <json> { being, id }: a relation out of a being; on the ward pk, an owner
 //   nervur unboot [--dir D] [--ward W] [--via S] <json> { being }: a being out of the ward, with every relation she holds
@@ -29,7 +30,9 @@
 //   nervur estate <dir> --domain D              an estate folder of the shape every estate has: a droplet's harbor directory, unit and Caddyfile, a Mac's launchd agent, on this dock
 //
 // D defaults to $NERVUR_DIR, then ~/.nervur. W defaults to the default ward, and
-// init names a new ward main when none is given. init takes
+// init names a new ward main when none is given. serve takes the HTTP port
+// as --http or $NERVUR_HTTP and the address it binds as --host or
+// $NERVUR_HOST, 127.0.0.1 when neither says one. init takes
 // --user NAME for the user being, defaulting to the device's user. run
 // takes the model's base URL as --url or $NERVUR_MODEL_URL, its name as
 // --model or $NERVUR_MODEL, a bearer from $NERVUR_MODEL_KEY, read here and never
@@ -42,7 +45,8 @@ import { join } from 'node:path';
 import { StdioServerTransport } from '@modelcontextprotocol/sdk/server/stdio.js';
 import { isInvitation } from 'nervur';
 import { DiskHarbor } from '../harbor/disk.js';
-import { serve, readRoutes, writeRoutes } from './daemon.js';
+import { serve } from './daemon.js';
+import { BOX, BOX_SEED } from '../box/index.js';
 import { ask, askBeing, side, reach } from './client.js';
 import { link } from '../beings/link.js';
 import { pilotSide } from './pilot.js';
@@ -67,8 +71,11 @@ const print = (v) => console.log(JSON.stringify(v, null, 2));
 async function main(argv) {
     const { cmd, json, more, third, flags, dir, via } = parse(argv);
     if (cmd === 'init') {
-        const made = await DiskHarbor.init(dir, flags.ward, flags.user ?? userInfo().username, flags.class, 'default' in flags, 'show' in flags);
-        print(flags.domain ? { ...made, routes: await writeRoutes(dir, flags.domain) } : made);
+        const made = await DiskHarbor.init(dir, flags.ward, flags.user ?? userInfo().username, flags.class, 'show' in flags);
+        // the box's own cells, said to the Dock with no daemon over the folder
+        if ('default' in flags)
+            await DiskHarbor.say(dir, 'default', { ward: made.name });
+        print(flags.domain ? { ...made, ...(await DiskHarbor.say(dir, 'domain', { domain: flags.domain })) } : made);
         return 0;
     }
     if (cmd === 'default') {
@@ -76,8 +83,15 @@ async function main(argv) {
             console.error('nervur default <ward>');
             return 2;
         }
-        await DiskHarbor.setDefault(dir, json);
-        print({ default: json });
+        print(await DiskHarbor.say(dir, 'default', { ward: json }));
+        return 0;
+    }
+    if (cmd === 'apps') {
+        if (!json) {
+            console.error('nervur apps <json>  { apple: [...], android: [{ package, fingerprints }] }; {} forgets them');
+            return 2;
+        }
+        print(await DiskHarbor.say(dir, 'apps', JSON.parse(json)));
         return 0;
     }
     if (cmd === 'show' || cmd === 'hide') {
@@ -94,13 +108,12 @@ async function main(argv) {
             console.error('nervur domain <domain>');
             return 2;
         }
-        print({ routes: await writeRoutes(dir, json) });
+        print(await DiskHarbor.say(dir, 'domain', { domain: json }));
         return 0;
     }
     // Every command that reaches a ward is on one: the one named, or the
-    // default, read from the folder the way the daemon reads it, and only once
-    // the command is held right.
-    const wardOf = async () => flags.ward ?? (await DiskHarbor.defaultOf(dir));
+    // default, which the daemon resolves for a request naming none.
+    const wardOf = () => flags.ward;
     if (cmd === 'side' || cmd === 'run') {
         if (!flags.as) {
             console.error(`nervur ${cmd} needs --as NAME`);
@@ -122,11 +135,11 @@ async function main(argv) {
             }
             run = { url, model, ...(key ? { key } : {}), ...(turns !== undefined ? { turns } : {}) };
         }
-        await side(dir, flags.as, await wardOf(), run); // stdio to the daemon, until one end closes
+        await side(dir, flags.as, wardOf(), run); // stdio to the daemon, until one end closes
         return -1;
     }
     if (cmd === 'pilot') {
-        const ward = await wardOf();
+        const ward = wardOf();
         await ask(dir, undefined, {}, ward); // no daemon is a clear word now, not at the first tool call
         const serving = await pilotSide(dir, ward, new StdioServerTransport(), via);
         process.stdin.once('end', () => void serving.close().then(() => process.exit(0)));
@@ -134,7 +147,11 @@ async function main(argv) {
     }
     if (cmd === 'serve') {
         const port = flags.http ?? process.env.NERVUR_HTTP;
-        const s = await serve(dir, port !== undefined ? { http: { port: Number(port) } } : {});
+        // Loopback unless an address is said. A daemon reachable from the
+        // network is the operator's own word and never a default, so the flag
+        // exists and is never filled in for him.
+        const host = flags.host || process.env.NERVUR_HOST;
+        const s = await serve(dir, port !== undefined ? { http: { port: Number(port), ...(host ? { host } : {}) } } : {});
         print({ dir: s.harbor.dir, sock: s.sock, side: s.side, http: s.http ? `http://${s.http.host}:${s.http.port}` : null, dial: s.quo.dialers.map((d) => d.url), wards: Object.fromEntries([...s.harbor.wards].map(([n, h]) => [n, h.pk])) });
         const stop = () => void s.close().then(() => process.exit(0));
         process.once('SIGINT', stop);
@@ -158,7 +175,7 @@ async function main(argv) {
             console.error('nervur ask needs <being> [method] [json]');
             return 2;
         }
-        const out = await askBeing(dir, json, more, third ? JSON.parse(third) : {}, await wardOf());
+        const out = await askBeing(dir, json, more, third ? JSON.parse(third) : {}, wardOf());
         print('error' in out ? { error: out.error } : out.result);
         const failed = 'error' in out || (typeof out.result === 'object' && out.result !== null && 'error' in out.result);
         return failed ? 1 : 0;
@@ -174,20 +191,23 @@ async function main(argv) {
     }
     if (cmd === 'census' || (cmd !== undefined && OWNER_ASKS.has(cmd))) {
         const args = json ? JSON.parse(json) : {};
-        const ward = await wardOf();
+        const ward = wardOf();
         let out = await ask(dir, cmd === 'census' ? undefined : cmd, args, ward, via);
-        // an invitation minted here is handed on as a link when the harbor's
+        // an invitation minted here is handed on as a link when the box's
         // routes name a web. origin: the world's page with the invitation in
-        // the fragment, one string to send to the person it is for
+        // the fragment, one string to send to the person it is for. The routes
+        // are the Dock's cells, asked of her through the daemon.
         const minted = cmd === 'invite' && !via && 'result' in out && isInvitation(out.result) ? out.result : null;
-        const routes = minted ? await readRoutes(dir) : null;
+        const box = minted ? await askBeing(dir, BOX, 'box', {}, BOX_SEED) : null;
+        const routes = box && 'result' in box ? (box.result.routes ?? null) : null;
+        const on = ('ward' in out ? out.ward : undefined) ?? ward ?? '';
         // the ward answers null to an invite on an id already held, standing or
         // occupant, and null on a terminal is nothing to read: it is a refusal
         // here, in words, and an exit code a script can tell apart
         if (cmd === 'invite' && 'result' in out && out.result === null)
             out = { result: { error: 'id taken' } };
         if (minted && routes)
-            print({ ...minted, link: link(`${routes.web}/${encodeURIComponent(ward)}`, minted) });
+            print({ ...minted, link: link(`${routes.web}/${encodeURIComponent(on)}`, minted) });
         else
             print('error' in out ? { error: out.error } : out.result);
         // an error object the ward answered is an ordinary answer, and still a
@@ -195,7 +215,7 @@ async function main(argv) {
         const failed = 'error' in out || (typeof out.result === 'object' && out.result !== null && 'error' in out.result);
         return failed ? 1 : 0;
     }
-    console.error('usage: nervur init|default|show|hide|domain|serve|census|boot|public|invite|knock|remove|unboot|ask|side|run|pilot|reach|estate [--dir D] [--ward W] [--via S] [--as NAME] [--url URL --model NAME] [json]');
+    console.error('usage: nervur init|default|show|hide|domain|apps|serve|census|boot|public|invite|knock|remove|unboot|ask|side|run|pilot|reach|estate [--dir D] [--ward W] [--via S] [--as NAME] [--http PORT] [--host ADDR] [--url URL --model NAME] [json]');
     return 2;
 }
 main(process.argv.slice(2)).then((code) => {

package/dist/cli/stand.d.ts

@@ -1,5 +1,4 @@
 import type { JsonObject } from 'nervur';
-import type { Harbor } from 'nervur/harbor';
 export type Boot = {
     ward: string;
     key: string;
@@ -17,21 +16,8 @@ export type Stand = {
     boot?: Boot[];
     wire?: Wire[];
 };
-type Wards = {
-    wards: Map<string, {
-        being(key: string): unknown;
-        ask(method: string, args: JsonObject): Promise<unknown>;
-    }>;
-    partitionOf(name: string): Record<string, unknown> | undefined;
-};
-export declare function standUp(harbor: Harbor | Wards, decl: Stand): Promise<{
-    booted: string[];
-    wired: string[];
-    already: string[];
-}>;
 export declare function stand(dir: string, decl: Stand): Promise<{
     booted: string[];
     wired: string[];
     already: string[];
 }>;
-export {};

package/dist/cli/stand.js

@@ -31,7 +31,7 @@ const ward = (h, name, why) => h.wards.get(name) ?? fail(`${why}: this device ho
 // for exactly one reason once the reader has held the id to a word the ward
 // does not reserve, which is that the id is taken, and an id taken is this
 // wire, placed the last time the script ran.
-export async function standUp(harbor, decl) {
+async function standUp(harbor, decl) {
     const h = harbor;
     const booted = [];
     for (const b of decl.boot ?? []) {

package/dist/harbor/browser.d.ts

@@ -1,13 +1,16 @@
 import type { BeingClass } from 'nervur';
-import { Harbor, type Dialer, type Lend, type Store } from 'nervur/harbor';
-export declare const BUILT_IN: Record<string, BeingClass>;
+import { Harbor, type Dialer, type Store } from 'nervur/harbor';
+import { type Tree } from '../box/index.ts';
 export declare class BrowserHarbor extends Harbor {
     #private;
     readonly name: string;
     readonly dialers: Dialer[];
-    constructor(store?: string | Store, classes?: Record<string, BeingClass>, lend?: Lend);
-    lent: Record<string, string> | undefined;
-    stand(lent: Record<string, string>): Promise<void>;
+    constructor(store?: string | Store, classes?: Record<string, BeingClass>);
+    faculties: Tree | undefined;
+    readonly box: import("../box/box.ts").Harborage & {
+        raise(): Promise<void>;
+    };
+    stand(faculties: Tree): Promise<void>;
     boot(): Promise<void>;
     dial(url: string): Dialer;
     wake(): void;