@nervur-org/dock 0.5.0 → 0.6.0

package/human/worlds.ts

@@ -11,7 +11,7 @@
 // `tab.ts` is the shell over this, and this is what the memory harbor proves.
 import type { Harbor, Hosted } from 'nervur/harbor';
 import { Avatar, USER } from '../beings/avatar.ts';
-import { settled } from '../dock/faculty.ts';
+import { settled } from '../box/join.ts';
 
 // Which worlds a device has joined, and where each one lives. A tab learns
 // this from the page it is on, one world per origin, and needs it only to
@@ -113,14 +113,14 @@ export async function fresh(ward: Hosted): Promise<Relation> {
   // is a tab that hangs.
   for (let n = 1; n <= 64; n++) {
     const key = `r${n}`;
-    const out = (await ward.ask('boot', { key, class: 'Presence' })) as { error?: string };
+    const out = (await ward.ask('boot', { key, class: 'beings/Presence' })) as { error?: string };
     if (out.error) continue;
     // She takes what the box lends at her birth, and birth is synchronous
     // while taking a standing is not. She is handed back when they have
     // landed, not before: a screen painted from her describe a moment early
     // is a page missing every faculty of the box, and nothing paints it
     // again until the person navigates.
-    await settled();
+    await settled(ward);
     return { key, avatar: ward.being(key) as Avatar };
   }
   throw new Error('the tab could not boot an avatar: every key it tries is taken');

package/mcp/agent.ts

@@ -21,7 +21,7 @@ export type Run = (event: JsonObject) => Promise<Json>;
 
 // The ask on the user being that takes the result. Gated to devices; the
 // agent's client identity is what the gate reads.
-export const REPORT = 'report';
+const REPORT = 'report';
 
 // `claude -p` or any CLI agent: the command runs in the agent's folder with
 // the event, as JSON, as its last argument. The result is what it printed.

package/mcp/allow.ts

@@ -92,7 +92,8 @@ export class Exchange {
       const world = worlds.find((w) => w.pk === inv.ward);
       if (!world) return again('That invitation is for a world that does not live here.');
       const identity = word(f.get('identity'));
-      if (identity === null || identity === world.user || identity === 'desk') return again('An identity is one word, and not the user or the desk.');
+      // the ward judges the rest: an identity that is one of its beings is refused at the join
+      if (identity === null) return again('An identity is one word.');
       const joined = await this.o.join(identity, inv, world.ward);
       if (joined.error) return again(`Not in: ${joined.error}.`);
       const out = await this.o.oauth.complete(request, identity, world.ward);

package/mcp/http.ts

@@ -14,7 +14,7 @@ import type { Serving } from '../beings/side.ts';
 import { mcpSide } from './server.ts';
 
 export type Session = { identity: string; ward: string; transport: StreamableHTTPServerTransport; serving: Serving; touched: number };
-export const SESSION_IDLE = 60 * 60 * 1000;
+const SESSION_IDLE =60 * 60 * 1000;
 // An identity in a world: one harbor holds many, and the grant names which.
 export type Resolve = (identity: string, ward: string) => Promise<{ avatar?: Avatar; error?: string }>;
 

package/mcp/oauth.ts

@@ -5,7 +5,7 @@
 // S256, the code grant, refresh, opaque tokens. It is a route, not Quo. Its
 // one job is to end with a client identity, which the front desk trades for
 // an invitation and the avatar knocks with; the grant it issues is the
-// box's, `dock/grants.ts`, honoured on every route, and what this file
+// box's, `box/grants.ts`, honoured on every route, and what this file
 // keeps for itself is only the dance: clients, pending requests and codes.
 // No secret of Quo's is ever here.
 //
@@ -18,9 +18,9 @@
 // The web route finishes a request by calling `complete(request, identity)`
 // after its allow page, where the human hands the invitation the root minted;
 // that returns the redirect that carries the code back to the client.
-import { REFRESH_TTL, type Grants } from '../dock/grants.ts';
+import { REFRESH_TTL, type Bearers as Grants } from '../box/grants.ts';
 
-export { ACCESS_TTL, REFRESH_TTL } from '../dock/grants.ts';
+export { ACCESS_TTL, REFRESH_TTL } from '../box/grants.ts';
 
 // A code, a client id: every key here is a string the far side chose, and a
 // bare lookup would find `__proto__` and hand back an object with no
@@ -244,7 +244,7 @@ function withQuery(base: string, params: Record<string, string | null>): string
   return u.toString();
 }
 
-export async function readBody(req: Request, limit = 64 * 1024): Promise<string> {
+async function readBody(req: Request, limit = 64 * 1024): Promise<string> {
   const s = await req.text();
   if (s.length > limit) throw new Error('too large');
   return s;

package/mcp/route.ts

@@ -9,7 +9,7 @@
 import { OAuth, type Store } from './oauth.ts';
 import type { McpHttp } from './http.ts';
 import type { Handler } from '../harbor/http.ts';
-import type { Grants } from '../dock/grants.ts';
+import type { Bearers as Grants } from '../box/grants.ts';
 
 // The routes' public faces, as the exchange and the metadata name them.
 export type Routes = { mcp: string; web: string; quo?: string; api?: string };

package/mcp/runner.ts

@@ -19,7 +19,7 @@ import { presentation } from '../beings/look.ts';
 // from the device and never from cells. `turns` is the ceiling of model
 // calls in one turn of the conversation; ten by default.
 export type Model = { url: string; model: string; key?: string; turns?: number };
-export const TURNS = 10;
+const TURNS = 10;
 
 // The wire shapes, only as much as the loop reads and writes.
 export type Tool = { type: 'function'; function: { name: string; description?: string; parameters: JsonObject } };

package/mcp/server.ts

@@ -22,7 +22,7 @@ export const VERSION = '0.0.0';
 export type { Subject } from '../beings/side.ts';
 
 // The empty ask as a tool: her describe whole, asks and notes.
-export const DESCRIBE: Tool = { name: 'describe', description: 'the empty ask: her describe, the asks and the notes', inputSchema: { type: 'object' } };
+const DESCRIBE: Tool ={ name: 'describe', description: 'the empty ask: her describe, the asks and the notes', inputSchema: { type: 'object' } };
 
 // Her describe, spoken as tools, the empty ask first. Name, description and
 // input are verbatim; an output schema crosses when she declared one. Her

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nervur-org/dock",
-  "version": "0.5.0",
+  "version": "0.6.0",
   "description": "The dock: what every estate on Quo needs and nobody writes twice. A daemon and the nervur command, the front desk, the user being and the avatar, harbors on disk, in a tab and on the edge, the model sides and the screen.",
   "keywords": [
     "quo",
@@ -28,7 +28,6 @@
       "types": "./dist/harbor/disk.d.ts",
       "default": "./dist/harbor/disk.js"
     },
-    "./cli": "./dist/cli/nervur.js",
     "./stand": {
       "types": "./dist/cli/stand.d.ts",
       "default": "./dist/cli/stand.js"
@@ -80,9 +79,10 @@
   },
   "scripts": {
     "build": "rm -rf dist && tsc -p tsconfig.build.json && node build/bundle.ts && chmod +x dist/cli/nervur.js && cp harbor/edge/platform.d.ts dist/harbor/edge/ && cp -R cli/estate dist/cli/",
-    "check": "node --test \"test/*.test.ts\"",
-    "deep": "node --test \"test/terrain/*.test.ts\"",
-    "prepublishOnly": "test \"$NERVUR_GATED\" = 1 || { echo 'publish from the root, gated once: npm run release:dock' >&2; exit 1; }"
+    "check": "node ../../test.mjs \"test/*.test.ts\"",
+    "deep": "node --test --test-timeout=900000 --test-concurrency=1 \"test/terrain/*.test.ts\"",
+    "cover": "node --test --test-timeout=300000 --test-concurrency=1 --experimental-test-coverage --test-coverage-exclude=\"**/dist/**\" --test-coverage-exclude=\"**/test/**\" --test-coverage-exclude=\"**/harbor/idb.ts\" --test-coverage-lines=97 --test-coverage-branches=85 --test-coverage-functions=91 \"test/*.test.ts\"",
+    "prepublishOnly": "test \"$NERVUR_GATED\" = 1 || { echo 'a publish is /release, from the root, on the human'\"'\"'s word' >&2; exit 1; }"
   },
   "dependencies": {
     "@aparajita/capacitor-secure-storage": "^8.0.0",
@@ -91,9 +91,10 @@
     "@capacitor/filesystem": "^8.1.3",
     "@capacitor/geolocation": "^8.2.2",
     "@capacitor/local-notifications": "^8.3.1",
+    "@capacitor/push-notifications": "^8.1.2",
     "@modelcontextprotocol/sdk": "^1.30.0",
-    "nervur": "^0.18.0",
-    "@nervur-org/ui": "^0.4.0",
+    "nervur": "^0.19.0",
+    "@nervur-org/ui": "^0.5.0",
     "ws": "^8.21.3"
   },
   "devDependencies": {
@@ -107,7 +108,7 @@
   "files": [
     "dist",
     "beings",
-    "dock",
+    "box",
     "cli",
     "harbor",
     "mcp",

package/beings/envoy.ts

@@ -1,218 +0,0 @@
-// SPDX-License-Identifier: Apache-2.0
-// The envoy base: what every envoy is and no envoy has alone. An envoy is
-// a being of the org's standing in for a ward she does not run, an account
-// at a thing that speaks no Quo, and the trunk's envoy chapter says the
-// seven things she is. This is those seven as one class an author extends,
-// so that a vendor's envoy is her asks out, her signature and her decoding,
-// and nothing else.
-//
-// Two gates, one credential, one way out, one way in, one memory, one way
-// back. `credential` and `forget` are the owner's; `deliver`, for an envoy
-// that is called in, is the owner's too, and the daemon asks it with the
-// vendor's raw bytes and headers. What an occupant may ask is the class's
-// asks out, gated by `occupant` or by her own reading of the notes.
-//
-// Nothing here knows a vendor's name. The signature is `verify`, the
-// vocabulary is `decode`, and what a delivery wakes is `wake`, each a
-// method the class fills; the base keeps the discipline around them: the
-// bytes checked before anything is parsed, the id kept bounded so a retry
-// lands once, `{ ok }` answered before the wake goes out, a wake that meets
-// silence written down and never retried.
-import { Being, isSilence, isWord, wordOf } from 'nervur';
-import type { Asker, AskSpec, JsonObject, OccupantRecord } from 'nervur';
-
-// The two gates. The owner is the ward's ask pointer, `{ id: 'OWNER' }`,
-// which is how the daemon asks `deliver` and how the root places a
-// credential; an occupant is anyone holding a standing at her.
-export const owner = (_rec: OccupantRecord | undefined, asker: Asker): boolean => asker.id === 'OWNER';
-export const occupant = (rec: OccupantRecord | undefined): boolean => rec !== undefined;
-
-// The third gate: who may place what the vendor gave this account. WORLDS
-// has placing an envoy as an ask on home, shown by the gate to the org's
-// presences and to its model, with the box never logged into for it, so
-// this cannot be the owner alone. It is the owner or an occupant whose
-// note says she may, placed with her standing the way every other note is,
-// and it is never a default: an org that marked nobody has the root's
-// shell and nothing else, which is where this began.
-export const places = (rec: OccupantRecord | undefined, asker: Asker): boolean => asker.id === 'OWNER' || rec?.notes.credential === true;
-
-// A credential as a form, for a class that wants one. `at` is never among
-// the fields and cannot be: it is where this box sends the org's key, so a
-// form that set it would be a form that points the box at anywhere and
-// makes it fetch there with the account's own secret. Where a vendor
-// answers is the class's, since the class is the thing that speaks that
-// vendor, and only the owner may name another.
-export const CREDENTIAL = (properties: Record<string, JsonObject>, required: string[]): AskSpec => ({
-  description: 'what the vendor gave this account: kept in her cells, and never shown again',
-  input: { type: 'object', properties, required },
-  for: places,
-});
-
-// One delivery, decoded by the class into what the base needs: the
-// vendor's id for it, its kind in the vendor's words, which vendor id it
-// is about, and the values the class read off it.
-export type Delivery = { id: string; kind: string; about: string | null; data: JsonObject };
-// What a delivery wakes: one ask on the way back to whoever the vendor id
-// was remembered for, or nothing.
-export type Wake = { method: string; args: JsonObject };
-// What a way out heard: the status, and the body as an object, `{}` when
-// there was none or it was not JSON.
-export type Heard = { ok: boolean; status: number; body: JsonObject };
-
-const SEEN = 200;
-const FRESH = 5 * 60_000;
-
-export class Envoy extends Being {
-  static override cells: JsonObject = { credential: null, about: {}, seen: [], unwoken: [] };
-  static override asks: Record<string, AskSpec> = {
-    credential: { description: 'what the vendor gave the account: kept in her cells, never shown', input: { type: 'object' }, for: places },
-    forget: { description: 'forget the credential', input: { type: 'object' }, for: places },
-  };
-  // The one ask in, for an envoy the vendor calls: a class that is called
-  // in spreads it into her asks, `{ ...Envoy.asks, ...Envoy.IN, ...hers }`,
-  // and a one-way envoy shows no deliver at all.
-  static IN: Record<string, AskSpec> = {
-    deliver: { description: 'the vendor delivers: its raw bytes and headers, from the daemon as the owner', input: { type: 'object', properties: { body: { type: 'string' }, headers: { type: 'object' } }, required: ['body', 'headers'] }, for: owner },
-  };
-
-  // 1. Her credential is in her cells, and she gets it herself. The owner
-  // places what the vendor gave, values only; `check` is the class's word
-  // on what it must hold, a reason or null.
-  protected check(c: JsonObject): string | null {
-    for (const [k, v] of Object.entries(c)) if (typeof v !== 'string' || v === '') return `${k} is a non-empty string`;
-    return Object.keys(c).length ? null : 'a credential has at least one field';
-  }
-  // Where the vendor answers, as the class that speaks that vendor knows
-  // it. A class that leaves it null has an owner who must name one once.
-  static at: string | null = null;
-
-  credential(args: JsonObject, asker: Asker): JsonObject {
-    // `at` is the one field a form may not carry. From anyone but the
-    // owner it is dropped rather than refused, since a human pasting a key
-    // has said nothing about it either way, and what stands is the one
-    // already placed or the class's own.
-    const { at: named, ...rest } = args;
-    const at = asker.id === 'OWNER' && typeof named === 'string' ? named : ((this.held?.at as string | undefined) ?? (this.constructor as typeof Envoy).at);
-    const c: JsonObject = { ...rest, ...(typeof at === 'string' ? { at } : {}) };
-    const why = this.check(c);
-    if (why) return { error: why };
-    this.cells.credential = c;
-    return { kept: true };
-  }
-  forget(): JsonObject {
-    this.cells.credential = null;
-    return { kept: false };
-  }
-  protected get held(): JsonObject | null {
-    return (this.cells.credential as JsonObject | null) ?? null;
-  }
-
-  // 2. Her asks out are the vendor's surface, narrowed: one fetch, from
-  // `at` in her credential with `key` as the bearer, the answer as values.
-  // The class reshapes what it heard and passes nothing through raw.
-  protected async out(path: string, init: { method?: string; body?: JsonObject; headers?: Record<string, string> } = {}): Promise<Heard> {
-    const c = this.held;
-    if (!c || typeof c.at !== 'string') return { ok: false, status: 0, body: { error: 'no credential: the owner has not placed one' } };
-    let r: Response;
-    try {
-      r = await fetch(`${c.at}${path}`, {
-        method: init.method ?? (init.body ? 'POST' : 'GET'),
-        headers: { ...(typeof c.key === 'string' ? { authorization: `Bearer ${c.key}` } : {}), ...(init.body ? { 'content-type': 'application/json' } : {}), ...(init.headers ?? {}) },
-        ...(init.body ? { body: JSON.stringify(init.body) } : {}),
-      });
-    } catch {
-      return { ok: false, status: 0, body: { error: 'the vendor is unreachable' } };
-    }
-    const v = (await r.json().catch(() => ({}))) as unknown;
-    const body = v !== null && typeof v === 'object' && !Array.isArray(v) ? (v as JsonObject) : {};
-    return { ok: r.ok, status: r.status, body };
-  }
-  // The vendor's no, as an error object in her own words.
-  protected refused(h: Heard): JsonObject {
-    return h.status === 0 ? h.body : { error: `the vendor refused: ${h.status}${typeof h.body.message === 'string' ? ` ${h.body.message}` : ''}` };
-  }
-
-  // 4. Her cells are what the vendor told her: the map from the vendor's id
-  // to whom it is about, written when she asked out, read when called in.
-  protected remember(vendorId: string, by: string, more: JsonObject = {}): void {
-    (this.cells.about as Record<string, JsonObject>)[vendorId] = { by, ...more };
-  }
-  protected recall(vendorId: string): (JsonObject & { by: string }) | undefined {
-    const m = this.cells.about as Record<string, JsonObject>;
-    return Object.hasOwn(m, vendorId) ? (m[vendorId] as JsonObject & { by: string }) : undefined;
-  }
-
-  // 3. `deliver` is her one ask in. The daemon asks it as the owner with
-  // the raw body and the headers; an empty body is a redirect landing,
-  // the query in the headers under `:query`. The signature is checked
-  // before anything is parsed; a delivery she has seen is `{ ok }` at once
-  // and wakes nobody twice; and 6, `{ ok }` goes back before the wake.
-  async deliver(args: JsonObject): Promise<JsonObject> {
-    const body = typeof args.body === 'string' ? args.body : '';
-    const headers = (args.headers && typeof args.headers === 'object' && !Array.isArray(args.headers) ? args.headers : {}) as Record<string, string>;
-    if (body === '') return this.landed(headers[':query'] ?? '', headers);
-    if (!(await this.verify(body, headers))) return { error: 'bad signature' };
-    const d = this.decode(body, headers);
-    if ('error' in d) return d as JsonObject;
-    const seen = this.cells.seen as string[];
-    const mark = `${d.kind}:${d.id}`;
-    if (seen.includes(mark)) return { ok: true };
-    seen.push(mark);
-    while (seen.length > SEEN) seen.shift();
-    void this.#wake(d);
-    return { ok: true };
-  }
-  // The class's word on the vendor's signature, over the bytes as sent.
-  protected verify(_body: string, _headers: Record<string, string>): Promise<boolean> | boolean {
-    return false;
-  }
-  // The class's reading of the vendor's vocabulary.
-  protected decode(_body: string, _headers: Record<string, string>): Delivery | { error: string } {
-    return { error: 'not called in' };
-  }
-  // Where a redirect lands: an OAuth code in the query, for a class that
-  // begins its account that way. The base takes nothing from it.
-  protected landed(_query: string, _headers: Record<string, string>): JsonObject | Promise<JsonObject> {
-    return { ok: true };
-  }
-  // A signature over text with a shared secret, hex, the shape most
-  // vendors sign in: here once so a class writes the vendor's framing only.
-  protected async hmac(secret: string, text: string): Promise<string> {
-    const key = await crypto.subtle.importKey('raw', new TextEncoder().encode(secret), { name: 'HMAC', hash: 'SHA-256' }, false, ['sign']);
-    return [...new Uint8Array(await crypto.subtle.sign('HMAC', key, new TextEncoder().encode(text)))].map((x) => x.toString(16).padStart(2, '0')).join('');
-  }
-  // Whether a vendor's timestamp is within five minutes of now, in seconds
-  // or in milliseconds, since vendors sign in either and a class should
-  // not have to know which.
-  protected fresh(ts: string | number): boolean {
-    const t = Number(ts);
-    if (!Number.isFinite(t)) return false;
-    const ms = t < 1e11 ? t * 1000 : t;
-    return Math.abs(Date.now() - ms) <= FRESH;
-  }
-
-  // 5. Her way back is a standing placed like any other, `to:<id>` for the
-  // occupant a vendor id was remembered for, handed to her at the knock.
-  // A delivery is one ask on it, in her own words, said by `wake`; the
-  // being woken cannot tell it from a clock.
-  protected wake(_d: Delivery, _about: (JsonObject & { by: string }) | undefined): Wake | null {
-    return null;
-  }
-  async #wake(d: Delivery): Promise<void> {
-    const about = d.about === null ? undefined : this.recall(d.about);
-    const w = this.wake(d, about);
-    if (!w) return;
-    const unwoken = this.cells.unwoken as JsonObject[];
-    // a wake the class shaped wrong is written down, never dropped on the floor
-    if (typeof w.method !== 'string' || !w.method || w.args === null || typeof w.args !== 'object') return void unwoken.push({ id: d.id, kind: d.kind, why: 'a wake is { method, args }' });
-    const back = about ? this.standings[`to:${about.by}`] : undefined;
-    if (!back) return void unwoken.push({ id: d.id, kind: d.kind, why: about ? `no way back to ${about.by}` : 'about nobody she remembers' });
-    const out = await back.ask(w.method, w.args);
-    if (isSilence(out) || out === undefined) unwoken.push({ id: d.id, kind: d.kind, why: 'silence' });
-    else if (isWord(out)) unwoken.push({ id: d.id, kind: d.kind, why: wordOf(out) });
-  }
-  // What she could not wake, for the device's own code and a suite.
-  get unwoken(): JsonObject[] {
-    return this.cells.unwoken as JsonObject[];
-  }
-}

package/dist/beings/envoy.d.ts

@@ -1,54 +0,0 @@
-import { Being } from 'nervur';
-import type { Asker, AskSpec, JsonObject, OccupantRecord } from 'nervur';
-export declare const owner: (_rec: OccupantRecord | undefined, asker: Asker) => boolean;
-export declare const occupant: (rec: OccupantRecord | undefined) => boolean;
-export declare const places: (rec: OccupantRecord | undefined, asker: Asker) => boolean;
-export declare const CREDENTIAL: (properties: Record<string, JsonObject>, required: string[]) => AskSpec;
-export type Delivery = {
-    id: string;
-    kind: string;
-    about: string | null;
-    data: JsonObject;
-};
-export type Wake = {
-    method: string;
-    args: JsonObject;
-};
-export type Heard = {
-    ok: boolean;
-    status: number;
-    body: JsonObject;
-};
-export declare class Envoy extends Being {
-    #private;
-    static cells: JsonObject;
-    static asks: Record<string, AskSpec>;
-    static IN: Record<string, AskSpec>;
-    protected check(c: JsonObject): string | null;
-    static at: string | null;
-    credential(args: JsonObject, asker: Asker): JsonObject;
-    forget(): JsonObject;
-    protected get held(): JsonObject | null;
-    protected out(path: string, init?: {
-        method?: string;
-        body?: JsonObject;
-        headers?: Record<string, string>;
-    }): Promise<Heard>;
-    protected refused(h: Heard): JsonObject;
-    protected remember(vendorId: string, by: string, more?: JsonObject): void;
-    protected recall(vendorId: string): (JsonObject & {
-        by: string;
-    }) | undefined;
-    deliver(args: JsonObject): Promise<JsonObject>;
-    protected verify(_body: string, _headers: Record<string, string>): Promise<boolean> | boolean;
-    protected decode(_body: string, _headers: Record<string, string>): Delivery | {
-        error: string;
-    };
-    protected landed(_query: string, _headers: Record<string, string>): JsonObject | Promise<JsonObject>;
-    protected hmac(secret: string, text: string): Promise<string>;
-    protected fresh(ts: string | number): boolean;
-    protected wake(_d: Delivery, _about: (JsonObject & {
-        by: string;
-    }) | undefined): Wake | null;
-    get unwoken(): JsonObject[];
-}