@nervur-org/dock 0.4.1 → 0.6.0

package/dist/dock/timer.js

@@ -1,149 +0,0 @@
-import { Faculty } from './faculty.js';
-const MINUTE = 60_000;
-// A timeout further out than this is not trusted, so the arming is capped and
-// made again when it goes off. It is the base class's own bound and no rule
-// of the faculty: a terrain whose alarm holds a month arms for the month.
-const DAY = 86_400_000;
-export class Timer extends Faculty {
-    static asks = {
-        watch: { description: 'wake me when I say I am next due', input: { type: 'object', properties: { invitation: { type: 'object' }, method: { type: 'string' }, args: { type: 'object' } }, required: ['invitation', 'method'] } },
-        due: { description: 'bring my next round forward to this moment', input: { type: 'object', properties: { at: { type: 'number' } }, required: ['at'] } },
-        now: { description: 'this box’s moment', input: { type: 'object' } },
-    };
-    #timeout;
-    #stopped = false;
-    #armed = null;
-    #round = null;
-    // The moment she is armed for, or null while she is asleep. For the
-    // device's own code and for a suite; it crosses no door.
-    get armed() {
-        return this.#armed;
-    }
-    // A watcher says she is due sooner than the box knew. It only ever brings
-    // the round forward: what fires is decided at the tick, in the watcher's
-    // own cells, so an arming that moved later on somebody's word would be a
-    // schedule somebody else held silenced. The door is the whole gate here:
-    // a standing at a faculty comes from `lend` alone, and this adds no second
-    // one.
-    due(args) {
-        const at = args.at;
-        if (typeof at !== 'number' || !Number.isFinite(at))
-            return { error: 'a due carries the moment: { at }' };
-        const when = moment(at);
-        if (this.#armed === null || when < this.#armed)
-            this.#arm(when);
-        return { armed: this.#armed };
-    }
-    // Whoever was just filed is ticked at once, and what she answers is what
-    // the box arms for. One move covers a box booting, a home moving in and a
-    // watcher born long after the box was up: she is never waiting for a round
-    // nobody scheduled.
-    async welcomed(id) {
-        await this.round(Date.now(), id);
-    }
-    // The arming went off. A moment still well ahead is the day's cap this
-    // class put on its own timeout, so it is armed again rather than fired: a
-    // terrain calls this and never has to know how far out the arming was.
-    async rang() {
-        if (this.#stopped)
-            return [];
-        if (this.#armed !== null && this.#armed - Date.now() > 1_000) {
-            this.arm(this.#armed);
-            return [];
-        }
-        return this.fire(Date.now());
-    }
-    // The moment, read here and handed on. A device's own code may call it at a
-    // moment it names, which is how a suite proves a wake without waiting for
-    // one and how an operator makes a round happen now.
-    fire(now) {
-        return this.round(now);
-    }
-    // One round, and never two: a second while one is in flight is handed the
-    // one already running. What every watcher answered decides the next
-    // arming, and a `due` that landed while the round ran is not lost.
-    round(now, only) {
-        if (this.#round)
-            return this.#round;
-        const mine = this.#run(now, only);
-        this.#round = mine;
-        return mine.finally(() => {
-            if (this.#round === mine)
-                this.#round = null;
-        });
-    }
-    async #run(now, only) {
-        if (only === undefined)
-            this.#arm(null); // the arming is spent, whether it went off or the device called this by hand
-        const woke = await this.woke((w) => ({ ...w.args, now }), only);
-        if (woke === null) {
-            this.stop(); // her ward took her out; there is nobody left to wake
-            return [];
-        }
-        // A moment already gone is no arming. Every watcher works out when she is
-        // next due from the moment she was handed, so a round fired by hand at a
-        // moment that is not this box's answers one that is not this box's
-        // either, and a box that armed for it would run a round for a minute long
-        // past. A round at the box's own moment always names one still ahead.
-        const named = soonest(woke);
-        const said = named !== null && named > Date.now() ? named : null;
-        const held = this.#armed;
-        const at = said === null ? held : held === null ? moment(said) : Math.min(held, moment(said));
-        if (at !== null && at !== this.#armed)
-            this.#arm(at);
-        else if (at === null && this.#armed !== null)
-            this.#arm(null);
-        return woke;
-    }
-    #arm(when) {
-        if (this.#stopped)
-            return;
-        this.#armed = when;
-        this.arm(when);
-    }
-    // The one thing a terrain says about itself: be woken at this moment, or at
-    // no moment at all. A subclass replaces this and nothing else of her.
-    //
-    // Here it is a timeout, capped at a day and armed again when the cap goes
-    // off. The box stays up for its work and never for this, so the handle is
-    // unreferenced.
-    arm(when) {
-        clearTimeout(this.#timeout);
-        this.#timeout = undefined;
-        if (when === null)
-            return;
-        this.#timeout = setTimeout(() => void this.rang(), Math.min(Math.max(when - Date.now(), 0), DAY));
-        this.#timeout.unref?.();
-    }
-    // A being her ward took out reaches nobody, so nothing is left to wake. The
-    // device calls this when it puts the box down.
-    stop() {
-        this.#stopped = true;
-        this.#armed = null;
-        this.arm(null);
-    }
-    now() {
-        return { now: Date.now() };
-    }
-}
-// Half a second past the minute a moment falls in, and never before the
-// moment itself: a watcher floors what she is handed, so a round that fired a
-// hair early would floor to the minute before and fire nothing.
-const moment = (at) => Math.max(at, Math.floor(at / MINUTE) * MINUTE + 500);
-// What one round learned. Every watcher says when she is next due, and the
-// box arms for the earliest of them. A watcher who named no moment has
-// nothing to be woken for, and so has one who answered something that is no
-// tally at all.
-function soonest(woke) {
-    let at = null;
-    for (const w of woke) {
-        if (w.out === null || typeof w.out !== 'object')
-            continue;
-        const next = w.out.next;
-        if (typeof next !== 'number' || !Number.isFinite(next))
-            continue;
-        if (at === null || next < at)
-            at = next;
-    }
-    return at;
-}

package/dock/console.ts

@@ -1,23 +0,0 @@
-// SPDX-License-Identifier: Apache-2.0
-// The box, as one being. A device has no surface of its own, so a box that
-// has joined no world has nothing to draw: the Console is that page and only
-// that. She carries the faculties her harbor stood, showing each one's asks
-// as her own, and the ordinary screen draws her exactly as it draws a
-// world's user being, through one avatar holding one standing.
-//
-// She exists because a fresh install otherwise asks for location and
-// notifications in its manifest and shows nothing that ever asks for them,
-// which is a store reviewer's first question and a human's second.
-//
-// She carries for whoever the harbor's root let in, and for nobody else: the
-// root is the box, and it invites the one avatar its own screen runs.
-import { Carrier } from '../beings/carry.ts';
-import type { Asker, OccupantRecord } from 'nervur';
-
-export const CONSOLE = 'console';
-
-export class Console extends Carrier {
-  static override carries(occupant: OccupantRecord | undefined, _asker: Asker): boolean {
-    return occupant !== undefined;
-  }
-}

package/dock/dialers.ts

@@ -1,85 +0,0 @@
-// SPDX-License-Identifier: Apache-2.0
-// The box's dialers: `dialers`, one faculty of the dock ward, standing for
-// the sockets this box holds open to other harbors' `quo.` routes. A Mac
-// behind NAT, a phone on the mobile network, a droplet dialing home: each
-// is a dialer, and what it dials is a row in her cells, placed once by the
-// root with `keep` the way a schedule is placed on the clock and an agent
-// on the agents faculty, in no file.
-//
-// A row is one URL, the `quo.` route of the harbor dialed. She holds the
-// socket from her birth on, as every faculty holds what the box holds: one
-// line per row, announcing this harbor's wards on open, binding the far
-// side's pks, reconnecting with backoff when the line drops, and closed
-// when the row is dropped or the box goes down. The dialer itself is the
-// library's, written on the standard socket surface, so this faculty holds
-// on every terrain that has a socket; the daemon hands her the harbor to
-// dial for, as it hands the agents faculty how to run a row.
-import { OWNER } from 'nervur';
-import type { Asker, JsonObject, OccupantRecord } from 'nervur';
-import { dial, type Dialer, type Harbor } from 'nervur/harbor';
-import { Faculty } from './faculty.ts';
-
-// The name the dock ward holds her under.
-export const DIALERS = 'dialers';
-
-export type Row = { url: string };
-
-// The root and nobody else: a line held open is the device's own to place.
-const root = (_occ: OccupantRecord | undefined, asker: Asker) => asker.id === OWNER;
-
-const URL_ = { type: 'object', properties: { url: { type: 'string' } }, required: ['url'] };
-
-export class Dialers extends Faculty {
-  static override cells: JsonObject = { watched: {}, minted: 0, dialers: {} };
-  static override asks = {
-    keep: { description: 'hold a socket to that quo. route, from now and from every boot, until it is dropped', input: URL_, for: root },
-    drop: { description: 'close the socket to that route and forget it', input: URL_, for: root },
-    list: { description: 'every route she dials, and whether the line is open now', input: { type: 'object' }, for: root },
-  };
-
-  harbor: Harbor | undefined;
-  readonly open = new Map<string, Dialer>();
-
-  private get rows(): Record<string, Row> {
-    return this.cells.dialers as unknown as Record<string, Row>;
-  }
-
-  // Every row dialed, once the daemon has handed the harbor to dial for.
-  start(harbor: Harbor): void {
-    this.harbor = harbor;
-    for (const row of Object.values(this.rows)) this.#dial(row.url);
-  }
-
-  #dial(url: string): void {
-    if (!this.harbor || this.open.has(url)) return;
-    this.open.set(url, dial(this.harbor, url));
-  }
-
-  keep(args: JsonObject): JsonObject {
-    const url = args.url;
-    if (typeof url !== 'string' || !/^https?:\/\/\S+$/.test(url)) return { error: 'url is the quo. route of the harbor dialed, over http or https' };
-    const clean = url.replace(/\/$/, '');
-    this.rows[clean] = { url: clean };
-    this.#dial(clean);
-    return { kept: clean };
-  }
-
-  drop(args: JsonObject): JsonObject {
-    const url = typeof args.url === 'string' ? args.url.replace(/\/$/, '') : '';
-    if (!this.rows[url]) return { error: 'no such route' };
-    this.open.get(url)?.close();
-    this.open.delete(url);
-    delete this.rows[url];
-    return { dropped: url };
-  }
-
-  list(): JsonObject {
-    return { dialers: Object.keys(this.rows).map((url) => ({ url, open: this.open.get(url)?.socket !== null && this.open.has(url) })) };
-  }
-
-  // The device puts the box down: every line closes, the rows stay.
-  close(): void {
-    for (const d of this.open.values()) d.close();
-    this.open.clear();
-  }
-}

package/dock/faculty.ts

@@ -1,148 +0,0 @@
-// SPDX-License-Identifier: Apache-2.0
-// A faculty: one being of the dock ward, standing for one thing the box can
-// do. She is a being and nothing else, so what is here is not a second kind
-// of object but the two moves every faculty shares.
-//
-// Out: whoever holds a standing at her asks her methods, and the occupant's
-// notes say what that caller is, a prefix on a store, an account at a
-// vendor. Her own cells say what the thing is.
-//
-// Back: `watch` is the one subscribe verb every faculty has. A being who
-// wants waking mints an invitation and hands it over, this takes it as a
-// standing, and from then on she is asked at her own door as the occupant
-// she named. `occupants.remove` on her side is the whole of unsubscribe: the
-// next wake hears `removed` and the row goes.
-//
-// She holds what the box holds and begins holding it at birth: the
-// connection, the interval, the worker, the route are opened in her
-// constructor, and she is born whether or not the thing is reachable,
-// answering an error object while it is not.
-import { Being, isInvitation, isSilence, isWord, wordOf } from 'nervur';
-import type { Asker, JsonObject } from 'nervur';
-
-// One subscription, as she files it: her own id for the relation, who asked
-// for it, and what to ask them.
-export type Watched = { by: string; method: string; args: JsonObject };
-
-// What one round of waking did, per subscription.
-export type Woke = { id: string; by: string; out: unknown };
-
-export class Faculty extends Being {
-  static override cells: JsonObject = { watched: {}, minted: 0 };
-
-  // Someone wants waking. She hands the invitation she minted and says what
-  // to ask her; this knocks it, takes it under an id of this being's own,
-  // and files it. The id never crosses: it is this side's name for the
-  // relation, and the caller's name for the same relation is her own.
-  //
-  // The empty ask is the knock, because every being answers one and asking
-  // for a named ask would make every subscriber owe a method she does not
-  // otherwise need.
-  async watch(args: JsonObject, asker: Asker): Promise<JsonObject> {
-    const inv = args.invitation;
-    if (!isInvitation(inv) || typeof args.method !== 'string') return { error: 'an invitation and a method' };
-    const extra = args.args;
-    if (extra !== undefined && (extra === null || typeof extra !== 'object' || Array.isArray(extra))) return { error: 'args is one object' };
-    const out = await this.knock(inv);
-    if (isSilence(out) || isWord(out)) return { error: 'no way back' };
-    const cells = this.cells as unknown as { watched: Record<string, Watched>; minted: number };
-    const id = await this.take(`wake:${(cells.minted += 1)}`, inv);
-    if (id === null) return { error: 'not taken' };
-    cells.watched[id] = { by: asker.id ?? '', method: args.method, args: extra ?? {} };
-    await this.welcomed(id);
-    return { watching: id };
-  }
-
-  // Somebody new is filed, and the answer to her `watch` waits for this. A
-  // faculty that owes a new subscriber something at once says it here: the
-  // timer wakes her, learns when she is next due and arms the box for it, so
-  // a being born long after the box was up is not waiting for a round nobody
-  // scheduled. Most faculties owe nothing, and this is why they say nothing.
-  protected async welcomed(_id: string): Promise<void> {}
-
-  // One round of waking. Each subscriber is asked what she asked to be
-  // asked, with whatever this round adds. A subscriber who removed the
-  // occupant says `removed` once, and her row goes with the standing; there
-  // is nothing to retry and nothing to remember.
-  //
-  // `only` is one subscriber of the round's own choosing, named by this
-  // being's own id for the relation, and it is the same round down to one
-  // row: a faculty that wakes somebody just filed learns exactly what a full
-  // round would have learned about her.
-  //
-  // `dropped` is this being herself: her ward took her out, so the standings
-  // she holds reach nobody. Null says so, and whoever holds the interval puts
-  // it down rather than waking an empty room for as long as the box is up.
-  protected async woke(round: (w: Watched) => JsonObject = (w) => w.args, only?: string): Promise<Woke[] | null> {
-    const cells = this.cells as unknown as { watched: Record<string, Watched> };
-    const out: Woke[] = [];
-    for (const [id, w] of Object.entries(cells.watched)) {
-      if (only !== undefined && id !== only) continue;
-      const said = await this.standings[id]?.ask(w.method, round(w));
-      if (said === undefined || (isWord(said) && wordOf(said) === 'dropped')) return null;
-      if (isWord(said) && wordOf(said) === 'removed') {
-        this.standings.remove(id);
-        delete cells.watched[id];
-        continue;
-      }
-      out.push({ id, by: w.by, out: said });
-    }
-    return out;
-  }
-
-  // Who is waiting, by this being's own id for the relation. For a device's
-  // own code and for a suite; it crosses no door.
-  get watching(): Record<string, Watched> {
-    return this.cells.watched as unknown as Record<string, Watched>;
-  }
-}
-
-// The three moves a being makes at every birth to hold what her box lends.
-// A standing points at a being and not at a box, so one she wakes up holding
-// names a being on the box she was on when it was made; a restart and a
-// migration are the same silent event to her, so she does these again every
-// time she is constructed and is always pointed at the box she is on.
-//
-// `watch` says she wants waking too: her ward mints the occupant, the
-// faculty takes the standing it makes, and from then on the wake arrives at
-// her door under the id she chose.
-// Every join in flight on this box. A being takes what her box lends at her
-// birth, and birth is synchronous while taking a standing is not, so a
-// harbor that answered "up" before they landed would be a box whose first
-// tick woke nobody and whose first ring reached no platform. The terrain
-// waits on this once, after its wards are hosted; nothing else reads it, and
-// a join that fails leaves nothing behind but a being who asks again.
-const flight = new Set<Promise<unknown>>();
-export const settled = async (): Promise<void> => {
-  while (flight.size) {
-    const now = [...flight];
-    await Promise.allSettled(now);
-    for (const p of now) flight.delete(p);
-  }
-};
-
-export function join(b: Being, name: string, watch?: { method: string; args?: JsonObject }, id = name): Promise<string | null> {
-  const p = joining(b, name, watch, id);
-  flight.add(p);
-  void p.catch(() => {});
-  return p;
-}
-
-async function joining(b: Being, name: string, watch: { method: string; args?: JsonObject } | undefined, id: string): Promise<string | null> {
-  // One turn, before anything is asked. A being is called at her door and
-  // holds her stance from her first line, but her ward sets that door after
-  // her constructor returns, so a stance call made inside it reaches a being
-  // her ward does not hold yet and is answered as one taken out. Every
-  // faculty relation is made at birth, so the wait belongs here rather than
-  // in each of them.
-  await Promise.resolve();
-  b.standings.remove(id);
-  b.occupants.remove(`${id}:wake`);
-  const got = await b.lend(name, id);
-  if (got === null) return null;
-  if (!watch) return got;
-  const back = await b.invite(`${id}:wake`);
-  if (!back) return got;
-  await b.standings[id]?.ask('watch', { invitation: back, method: watch.method, ...(watch.args ? { args: watch.args } : {}) });
-  return got;
-}

package/dock/grants.ts

@@ -1,111 +0,0 @@
-// SPDX-License-Identifier: Apache-2.0
-// The box's grants: `grants`, one faculty of the dock ward. A bearer to an
-// identity in a world, honoured on every route alike. A route says the
-// grammar a caller speaks, forms, tools or JSON, and a grant says who the
-// caller is; no route holds a table of its own. She spans every world the
-// box hosts, and a grant maps a token to an identity and nothing else: the
-// credential is the invitation the avatar knocked with, spent once, and a
-// grant only remembers which avatar a client speaks through. No secret of
-// Quo's is ever here.
-//
-// Her tokens are her cells, kept by the dock ward's partition like every
-// faculty's and by no file of her own, so a box has one place its state is
-// and the harbor's one secret wraps them. Issuing, refreshing and revoking
-// are the routes' to call on her in this process, as the daemon mints a
-// nonce on `local`: none is an ask, none crosses a door, and she answers
-// nothing at hers.
-//
-// A grant is issued by whoever finished a way in: the OAuth exchange on the
-// model side, or the api route trading an invitation straight for tokens.
-// An access token lives an hour and a refresh token thirty days, and
-// refresh rotates. Revocation is the user being removing the occupant,
-// and the route that hears `removed` asks for the grants to go with it.
-import { Faculty } from './faculty.ts';
-
-// The name the dock ward holds her under.
-export const GRANTS = 'grants';
-
-export const ACCESS_TTL = 60 * 60 * 1000; // an access token, one hour
-export const REFRESH_TTL = 30 * 24 * 60 * 60 * 1000; // a refresh token, thirty days
-
-// A token is a string the far side offers, and a bare lookup would find
-// `__proto__` and hand back an object with no identity. Own keys only.
-const own = <T>(rec: Record<string, T>, key: string): T | undefined => (Object.hasOwn(rec, key) ? rec[key] : undefined);
-// Thirty-two random bytes as base64url, from the web crypto and the base64
-// every runtime has, so nothing of node stands in a file a tab bundles or a
-// worker imports. `Buffer` is not among those: a worker has one only when a
-// deploy asks for node's shims, and the box's grants are the same code on
-// every terrain.
-const token = () => {
-  const bytes = globalThis.crypto.getRandomValues(new Uint8Array(32));
-  let binary = '';
-  for (const b of bytes) binary += String.fromCharCode(b);
-  return btoa(binary).replaceAll('+', '-').replaceAll('/', '_').replaceAll('=', '');
-};
-
-// A grant names the world the identity was let into, since one harbor holds
-// many, and the client it was issued to: an OAuth client id, or the route
-// that traded for it.
-export type Grant = { identity: string; ward: string; client: string; exp: number };
-type Kept = { access: Record<string, Grant>; refresh: Record<string, Grant> };
-export type Tokens = { access_token: string; token_type: 'Bearer'; expires_in: number; refresh_token: string; scope: 'nervur' };
-
-export class Grants extends Faculty {
-  static override cells = { ...Faculty.cells, access: {}, refresh: {} };
-  static override asks = {};
-
-  // The ward's save, set by whoever holds her ward: a token issued is a
-  // cell written, and the routes answer with a token the partition keeps.
-  persist: () => Promise<void> = async () => {};
-  // The clock, a suite's to move.
-  now: () => number = () => Date.now();
-
-  get kept(): Kept {
-    return this.cells as unknown as Kept;
-  }
-
-  async issue(identity: string, ward: string, client: string): Promise<Tokens> {
-    const access_token = token(),
-      refresh_token = token();
-    this.kept.access[access_token] = { identity, ward, client, exp: this.now() + ACCESS_TTL };
-    this.kept.refresh[refresh_token] = { identity, ward, client, exp: this.now() + REFRESH_TTL };
-    this.sweep();
-    await this.persist();
-    return { access_token, token_type: 'Bearer', expires_in: ACCESS_TTL / 1000, refresh_token, scope: 'nervur' };
-  }
-
-  // Rotated: the old one is gone with the new one's birth. Null is a token
-  // nobody issued, or one that died.
-  async refresh(refresh_token: string): Promise<Tokens | null> {
-    const r = own(this.kept.refresh, refresh_token);
-    if (!r || r.exp < this.now()) return null;
-    delete this.kept.refresh[refresh_token];
-    return this.issue(r.identity, r.ward, r.client);
-  }
-
-  // The bearer on a request, to an identity in a world. Null is a stranger,
-  // or a token that died; a route tells the two apart by whether the
-  // request offered one at all.
-  bearer(req: Request): { identity: string; ward: string } | null {
-    const g = own(this.kept.access, offered(req));
-    return g && g.exp >= this.now() && typeof g.identity === 'string' ? { identity: g.identity, ward: g.ward } : null;
-  }
-
-  // Every grant an identity holds in a world, gone: the box's half of
-  // revocation. The other half is the user being removing the occupant.
-  async revoke(identity: string, ward: string): Promise<void> {
-    for (const k of ['access', 'refresh'] as const) for (const [t, g] of Object.entries(this.kept[k])) if (g.identity === identity && g.ward === ward) delete this.kept[k][t];
-    await this.persist();
-  }
-
-  sweep(): void {
-    const now = this.now();
-    for (const k of ['access', 'refresh'] as const) for (const [t, g] of Object.entries(this.kept[k])) if (!(g.exp >= now)) delete this.kept[k][t];
-  }
-}
-
-// What a request offered as its bearer, or nothing.
-export const offered = (req: Request): string => {
-  const h = req.headers.get('authorization') ?? '';
-  return h.startsWith('Bearer ') ? h.slice(7) : '';
-};

package/dock/index.ts

@@ -1,133 +0,0 @@
-// SPDX-License-Identifier: Apache-2.0
-// The dock ward: the ward a harbor boots and roots for itself, holding what
-// the box can do. `stand` puts it up and answers the `lend` a harbor hands
-// its other wards, which is the whole of what a terrain says about itself.
-//
-// Which names a box lends is the terrain's word; which ward may ask for one
-// is the harbor's, decided in `lendFor`, and a ward whose code came from a
-// stranger is lent nothing.
-import type { Harbor, Lend } from 'nervur/harbor';
-import type { JsonObject } from 'nervur';
-import { isInvitation } from 'nervur';
-import { Faculty } from './faculty.ts';
-import { Console, CONSOLE } from './console.ts';
-import { Local } from './local.ts';
-import { Location } from './location.ts';
-import { Notifications } from './notifications.ts';
-import { Push } from './push.ts';
-import { Timer } from './timer.ts';
-
-export { Console, CONSOLE } from './console.ts';
-export { Faculty, join, settled, type Watched, type Woke } from './faculty.ts';
-export { Local, LOCAL } from './local.ts';
-export { Location, type Where } from './location.ts';
-export { Notifications } from './notifications.ts';
-export { Push, isToken, bellOf, banner, sealBanner, SEAL, type Token, type Ring, type Line } from './push.ts';
-export { Timer } from './timer.ts';
-// The three grounds the push faculty rings through, and the bell service
-// that holds a publisher's keys: what the box can do, beside the faculty.
-export { webPush, mintVapid, publicOf, type Vapid } from './webpush.ts';
-export { apnsPush, pkcs8, HOSTS, type Apns } from './apns.ts';
-export { fcmPush, isAccount, DOORS, type Account, type Doors } from './fcm.ts';
-export { handedTo, ringing, routed } from './service.ts';
-
-// The names this package lends under. They are conventions of the dock and
-// nothing of Quo's: a name is the harbor's namespace, and a being holds each
-// one under an id of her own choosing.
-export const LOCATION = 'location';
-export const NOTIFICATIONS = 'notifications';
-export const PUSH = 'push';
-export const TIMER = 'timer';
-
-// The classes every dock ward may hold, by class name. A terrain hands its
-// own subclasses under the same names and the harbor holds those instead.
-// `local` and `grants` are not among them: the box's way in and the box's
-// grants stand only where a terrain serves routes, and that terrain adds
-// them to what it lends. `Grants` is not in this file at all, so that a tab
-// bundling this index carries no route's notion: the terrain that serves
-// routes hands her class to its harbor, as the daemon hands its own push.
-export const FACULTIES: Record<string, string> = { [LOCATION]: 'Location', [NOTIFICATIONS]: 'Notifications', [PUSH]: 'Push', [TIMER]: 'Timer' };
-export const FACULTY_CLASSES = { Console, Local, Location, Notifications, Push, Timer };
-
-// The name a harbor keeps its own ward under. It is a ward in every other
-// respect, and this one is never adopted or dropped as a migration: its
-// beings are the box's and die with it.
-export const DOCK = 'dock';
-
-// Put the dock ward up and answer the `lend` this harbor hands its wards.
-// `lent` says which names this box offers and which class stands for each;
-// a name it does not hold is null, and so is every other kind of no.
-//
-// The harbor keeps this ward's ask pointer rather than handing it out, so it
-// is the root here, and the root may invite on any being of its ward. That
-// is the whole of what `lend` does: it never mints, it asks its own root to.
-export async function stand(harbor: Harbor, lent: Record<string, string> = FACULTIES): Promise<Lend> {
-  const kept = await harbor.store.load(DOCK);
-  const ward = harbor.wards.get(DOCK) ?? (kept ? await harbor.host(DOCK, kept) : await harbor.create(DOCK, CONSOLE));
-  return standOn(ward, lent);
-}
-
-// A ward as its root holds it: the ask pointer, and a save where the terrain
-// keeps one. Every harbor here has both; a memory harbor has the first.
-export type Rooted = { ask(method?: string, args?: Record<string, unknown>): Promise<unknown>; save?(): Promise<void> };
-
-// The faculties up in a ward already made, and the `lend` that reaches them.
-// Apart from `stand` so a suite can put its own stubs in its own ward and
-// get the same thing a box gets. It is run again at every boot and says the
-// same thing twice without harm: a key already booted is refused, and an
-// invitation on an id already held is null.
-export async function standOn(ward: Rooted, lent: Record<string, string> = FACULTIES): Promise<Lend> {
-  for (const [name, className] of Object.entries(lent)) await ward.ask('boot', { key: name, class: className });
-  // The box as one being, carrying what it stood. She is the page a device
-  // that has joined no world shows, and she is placed by the root because
-  // the root is the box: a standing at every faculty, minted and knocked in
-  // one move, as an owner places any relation into a being of its ward.
-  await ward.ask('boot', { key: CONSOLE, class: 'Console' });
-  for (const name of Object.keys(lent)) {
-    const inv = await ward.ask('invite', { being: name, id: `${CONSOLE}:${name}` });
-    if (!isInvitation(inv)) continue;
-    await ward.ask('knock', { being: CONSOLE, id: name, invitation: inv as unknown as JsonObject });
-  }
-  await ward.save?.();
-  return lending(ward);
-}
-
-// The root's half alone: a name and a taker in, whether the ward took it out.
-// It never mints; it asks the root of the ward it holds to, which is what a
-// root may do on any being of its ward. And it unmints: a taker that would
-// not take leaves an occupant on that faculty which nobody holds, so the root
-// removes it before answering, and a refused lend costs the box nothing.
-//
-// Any being of the dock ward is lent by her key, not only the ones a terrain
-// stood: the faculties the dock ships are examples, and an estate boots its
-// own into the dock ward, of a class in its own `classes/`, and lends it the
-// same way. A name nobody there answers to is refused at the invite.
-//
-// The id is drawn and never counted. A faculty's occupants are in her cells
-// and outlive the process, so a count that started again at every boot would
-// name, on the first lend after a restart, an id she already holds, and the
-// invite would be refused for the rest of the box's life.
-export function lending(ward: Rooted): Lend {
-  return async (name, take) => {
-    const id = `lent:${fresh()}`;
-    const out = await ward.ask('invite', { being: name, id });
-    if (!isInvitation(out)) return false;
-    const took = await take(out);
-    if (!took) await ward.ask('remove', { being: name, id });
-    await ward.save?.();
-    return took;
-  };
-}
-
-const fresh = (): string =>
-  Array.from(globalThis.crypto.getRandomValues(new Uint8Array(8)))
-    .map((b) => b.toString(16).padStart(2, '0'))
-    .join('');
-
-// One faculty of this box, as the device's own code holds it: the object the
-// harbor made, in this process. Not a path around a door, and nothing of it
-// crosses an edge; it is how a device fires its own timer at a moment it
-// names and how a suite reads what a stub recorded.
-export function facultyOf<F extends Faculty>(harbor: Harbor, name: string): F | undefined {
-  return harbor.wards.get(DOCK)?.being(name) as F | undefined;
-}