@quo-systems/dock 0.1.0 → 0.2.1

package/dist/cli/quo.js

@@ -11,10 +11,12 @@
 //   quo invite [--dir D] [--ward W] [--via S] <json> { being, id }
 //   quo knock  [--dir D] [--ward W] [--via S] <json> { being | { boot, key }, id, invitation, method?, args?, wanted? }
 //   quo remove [--dir D] [--ward W] [--via S] <json> { being, id }: a relation out of a being; on the ward pk, an owner
+//   quo unboot [--dir D] [--ward W] [--via S] <json> { being }: a being out of the ward, with every relation she holds
 //   quo side   [--dir D] [--ward W] --as NAME  an avatar over stdio for a local MCP client; NAME is the client identity
 //   quo run    [--dir D] [--ward W] --as NAME --url URL --model NAME [--turns N]  a human at a terminal talking to a model through an avatar: a line in, the model's final text out
 //   quo pilot  [--dir D] [--ward W] [--via S]        the owner pilot over stdio: census, boot, invite, knock, remove
 //   quo reach  [--dir D] <pk> <url>          a hint for the harbor's directory: that ward pk lives at that quo. route
+//   quo estate <dir> --domain D              an estate folder of the shape every estate has: a droplet's quo directory, unit and Caddyfile, on this dock
 //
 // D defaults to $QUO_DIR, then ~/.quo. W defaults to main. init takes
 // --user NAME for the user being, defaulting to the device's user. run
@@ -31,7 +33,8 @@ import { DiskHarbor } from '../harbor/disk.js';
 import { serve } from './daemon.js';
 import { ask, side, reach } from './client.js';
 import { pilotSide } from '../mcp/pilot.js';
-const OWNER_ASKS = new Set(['boot', 'invite', 'knock', 'remove']);
+import { estate } from './estate.js';
+const OWNER_ASKS = new Set(['boot', 'public', 'invite', 'knock', 'remove', 'unboot']);
 function parse(argv) {
     const flags = {};
     const rest = [];
@@ -78,7 +81,7 @@ async function main(argv) {
     }
     if (cmd === 'pilot') {
         await ask(dir, undefined, {}, ward); // no daemon is a clear word now, not at the first tool call
-        const serving = await pilotSide(dir, ward, new StdioServerTransport(), (line) => console.error(`pilot ${line}`), via);
+        const serving = await pilotSide(dir, ward, new StdioServerTransport(), via);
         process.stdin.once('end', () => void serving.close().then(() => process.exit(0)));
         return -1;
     }
@@ -91,6 +94,14 @@ async function main(argv) {
         process.once('SIGTERM', stop);
         return -1; // stays up
     }
+    if (cmd === 'estate') {
+        if (!json || !flags.domain) {
+            console.error('quo estate needs <dir> --domain D');
+            return 2;
+        }
+        print(await estate(json, flags.domain));
+        return 0;
+    }
     if (cmd === 'reach') {
         if (!json || !more) {
             console.error('quo reach needs <pk> <url>');
@@ -109,7 +120,7 @@ async function main(argv) {
         const failed = 'error' in out || (typeof out.result === 'object' && out.result !== null && 'error' in out.result);
         return failed ? 1 : 0;
     }
-    console.error('usage: quo init|serve|census|boot|invite|knock|remove|side|run|pilot|reach [--dir D] [--ward W] [--via S] [--as NAME] [--url URL --model NAME] [--dial URL] [json]');
+    console.error('usage: quo init|serve|census|boot|public|invite|knock|remove|unboot|side|run|pilot|reach|estate [--dir D] [--ward W] [--via S] [--as NAME] [--url URL --model NAME] [--dial URL] [json]');
     return 2;
 }
 main(process.argv.slice(2)).then((code) => {

package/dist/harbor/edge/exercise.js

@@ -63,7 +63,9 @@ function probe(base, state, env) {
                     learn(i, w);
                 }
                 wardOf.set(key, name);
-                assert.deepEqual(await w.ask('boot', { key, class: Class.name, public: isPublic }), { booted: key });
+                assert.deepEqual(await w.ask('boot', { key, class: Class.name }), { booted: key });
+                if (isPublic)
+                    assert.deepEqual(await w.ask('public', { key }), { public: key });
                 if (Object.keys(cells).length)
                     Object.assign(at(name).p.beings[key], cells);
                 return {

package/dist/harbor/edge/platform.d.ts

@@ -0,0 +1,28 @@
+// SPDX-License-Identifier: Apache-2.0
+// The edge platform, as much of it as the harbor touches and no more. The
+// vendor's own type package declares every global a worker has, and it
+// collides with the DOM library this tree compiles against; these few
+// lines are what the edge harbor and worker actually call.
+export type Storage = {
+  get<T = unknown>(key: string): Promise<T | undefined>;
+  get<T = unknown>(keys: string[]): Promise<Map<string, T>>;
+  put(key: string, value: unknown): Promise<void>;
+  delete(key: string): Promise<boolean>;
+  list<T = unknown>(options?: { prefix?: string }): Promise<Map<string, T>>;
+};
+export type State = { id: { toString(): string; name?: string }; storage: Storage };
+export type Stub = { fetch(input: string | Request, init?: RequestInit): Promise<Response> };
+export type Namespace = { idFromName(name: string): unknown; get(id: unknown): Stub };
+export type Env = { HARBOR: Namespace; QUO_SEED_KEY?: string; QUO_ROOT?: string; QUO_EXERCISE?: string };
+// The server end of a WebSocketPair: the standard surface plus accept.
+export type ServerSocket = { accept(): void; readyState: number; binaryType: string; send(data: string | Uint8Array): void; close(): void; addEventListener(type: string, fn: (e: never) => void): void };
+declare global {
+  // eslint-disable-next-line no-var
+  var WebSocketPair: new () => { 0: ServerSocket; 1: ServerSocket };
+  interface ResponseInit {
+    webSocket?: unknown;
+  }
+  interface Response {
+    readonly webSocket?: unknown;
+  }
+}

package/dist/human/guest.d.ts

@@ -0,0 +1,3 @@
+import type { Avatar } from '../beings/avatar.ts';
+import type { Subject } from '../beings/side.ts';
+export declare function guest(avatar: Avatar, ward: string): Subject;

package/dist/human/guest.js

@@ -0,0 +1,25 @@
+// SPDX-License-Identifier: Apache-2.0
+// A guest at a world's door: the world's public being, whatever class she
+// is, as a subject the screen can render. Her describe for a stranger is the
+// guest page; a form on it is a knock on the public invitation; and an
+// answer that is an invitation is the way in, which the tab takes by
+// joining. Nothing here knows the desk: the desk's `device` is one ask
+// that answers an invitation, and any being may write another.
+import { isSilence, isWord, wordOf } from '@quo-systems/quo';
+export function guest(avatar, ward) {
+    const at = { ward };
+    return {
+        tools: async () => {
+            const bp = await avatar.knock(at);
+            if (isSilence(bp))
+                return { error: 'silence' };
+            if (isWord(bp))
+                return { error: wordOf(bp) };
+            if (bp === null || typeof bp !== 'object' || Array.isArray(bp) || !Array.isArray(bp.asks))
+                return { error: 'nobody is home' };
+            return bp;
+        },
+        call: (name, args = {}, wanted) => avatar.knock(at, name, args, wanted),
+        ears: new Set(),
+    };
+}

package/dist/human/html.d.ts

@@ -1,5 +1,6 @@
 import type { Ask, Blueprint, Json, JsonObject } from '@quo-systems/quo';
 import { type Word } from '../beings/side.ts';
+import { hintFor, type Look, type Hint } from '../beings/look.ts';
 export type Property = {
     type?: string;
     description?: string;
@@ -13,7 +14,7 @@ export type Schema = {
 };
 export declare const escape: (s: string) => string;
 export declare function field(name: string, p: Property, must: boolean): string;
-export declare function form(ask: Ask): string;
+export declare function form(ask: Ask, h?: Hint): string;
 export type Raw = Record<string, string>;
 export declare function values(ask: Ask, raw: Raw): {
     args: JsonObject;
@@ -24,9 +25,16 @@ export declare function view(value: Json, schema?: JsonObject): string;
 export declare function face(w: Word, schema?: JsonObject): string;
 export type Model = {
     blueprint: Blueprint | null;
+    look: Look;
     notice: string;
     answers: Record<string, Word>;
     pushes: JsonObject[];
 };
-export declare function title(bp: Blueprint | null): string;
+export declare function title(bp: Blueprint | null, l?: Look): string;
+export declare function look(l: Look | undefined): {
+    style: string;
+    head: string;
+};
+export declare function ordered(asks: Ask[], l: Look | undefined): Ask[];
+export { hintFor };
 export declare function page(m: Model): string;

package/dist/human/html.js

@@ -1,4 +1,5 @@
 import { SILENCE_TEXT, UNREACHED_TEXT, wordText } from '../beings/side.js';
+import { hint, hintFor, sanitise, groups as grouped } from '../beings/look.js';
 export const escape = (s) => s.replace(/[&<>"']/g, (c) => ({ '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;', "'": '&#39;' })[c] ?? c);
 const props = (schema) => Object.entries((schema?.properties ?? {}));
 const required = (schema) => new Set((schema?.required ?? []));
@@ -28,12 +29,14 @@ export function field(name, p, must) {
 }
 // The ask as a form: its name is the button, its description the legend's
 // small print, and `data-ask` is how the surface says which ask was sent.
-export function form(ask) {
+export function form(ask, h = {}) {
     const must = required(ask.input);
     const fields = props(ask.input)
         .map(([name, p]) => field(name, p, must.has(name)))
         .join('');
-    return `<form data-ask="${escape(ask.name)}"><fieldset><legend>${escape(ask.name)}${ask.description ? ` <small>${escape(ask.description)}</small>` : ''}</legend>${fields}<p><button>${escape(ask.name)}</button></p></fieldset></form>`;
+    const label = `${h.icon ? `${escape(h.icon)} ` : ''}${escape(h.title ?? ask.name)}`;
+    const care = h.destructive ? ' data-confirm="true"' : '';
+    return `<form data-ask="${escape(ask.name)}"${care}><fieldset><legend>${label}${ask.description ? ` <small>${escape(ask.description)}</small>` : ''}</legend>${fields}<p><button>${label}</button></p></fieldset></form>`;
 }
 // The strings typed by the schema. An empty field that is not required is
 // left out, so the being sees what the human said and nothing else; an
@@ -116,21 +119,69 @@ export function face(w, schema) {
 }
 // The title is the one hint the notes may carry: a string named `name`.
 // The rest of the notes is shown as a view and read as nothing else.
-export function title(bp) {
+export function title(bp, l = {}) {
+    if (l.name)
+        return l.name;
     const n = bp?.notes;
     return n !== null && typeof n === 'object' && !Array.isArray(n) && typeof n.name === 'string' && n.name ? n.name : 'quo';
 }
+// ---- a look
+// A look as the page paints it: the tokens become CSS variables on one
+// section, and the name and the logo its heading. The shape of every token
+// is the dock's, `beings/look.ts`; this only writes what survived it.
+export function look(l) {
+    if (!l)
+        return { style: '', head: '' };
+    const vars = [];
+    if (l.accent)
+        vars.push(`--accent:${l.accent}`);
+    if (l.background)
+        vars.push(`--bg:${l.background}`);
+    if (l.foreground)
+        vars.push(`--fg:${l.foreground}`);
+    if (l.font)
+        vars.push(`--font:${l.font}`);
+    if (l.radius !== undefined)
+        vars.push(`--radius:${l.radius}px`);
+    const logo = l.logo ? `<img class="logo" alt="" src="${l.logo}">` : '';
+    const name = l.name ? escape(l.name) : '';
+    return { style: vars.length ? ` style="${vars.join(';')}"` : '', head: logo || name ? `<h2>${logo}${name}</h2>` : '' };
+}
+// Her asks in the order her look asks for, the rest after in her own order.
+export function ordered(asks, l) {
+    const want = l?.order ?? [];
+    return [...want.map((n) => asks.find((a) => a.name === n)).filter((a) => a !== undefined), ...asks.filter((a) => !want.includes(a.name))];
+}
+export { hintFor };
 export function page(m) {
     const bp = m.blueprint;
-    const asks = bp
-        ? bp.asks
-            .map((a) => {
-            const w = m.answers[a.name];
-            return `<section>${form(a)}${w ? face(w, a.output) : ''}</section>`;
+    const one = (l, prefix = '') => (a) => {
+        const w = m.answers[a.name];
+        const h = hint(l, a.name.startsWith(prefix) ? a.name.slice(prefix.length) : a.name);
+        return `<section>${form(a, h)}${w ? face(w, a.output) : ''}</section>`;
+    };
+    const groups = grouped(bp);
+    const taken = new Set(Object.values(groups).flatMap((g) => g.asks ?? []));
+    const own = bp ? ordered(bp.asks.filter((a) => !taken.has(a.name) && a.name !== 'look'), m.look).map(one(m.look)).join('') : '';
+    const far = bp
+        ? Object.entries(groups)
+            .map(([id, g]) => {
+            const asks = bp.asks.filter((a) => g.asks?.includes(a.name));
+            if (!asks.length)
+                return '';
+            const kept = sanitise(g.look);
+            const l = look(kept);
+            const prefix = `${id}-`;
+            const want = (kept.order ?? []).map((n) => prefix + n);
+            const inOrder = ordered(asks, { order: want });
+            return `<section class="standing" data-standing="${escape(id)}"${l.style}>${l.head || `<h2>${escape(id)}</h2>`}${inOrder.map(one(kept, prefix)).join('')}</section>`;
         })
             .join('')
         : '';
-    const notes = bp && bp.notes !== null && !(typeof bp.notes === 'object' && !Array.isArray(bp.notes) && !Object.keys(bp.notes).length) ? `<aside class="notes">${view(bp.notes)}</aside>` : '';
+    const asks = own + far;
+    const shown = bp && bp.notes !== null && typeof bp.notes === 'object' && !Array.isArray(bp.notes) ? Object.fromEntries(Object.entries(bp.notes).filter(([k]) => k !== 'standings' && k !== 'name')) : bp?.notes;
+    const notes = bp && shown !== null && shown !== undefined && !(typeof shown === 'object' && !Array.isArray(shown) && !Object.keys(shown).length) ? `<aside class="notes">${view(shown)}</aside>` : '';
     const pushes = m.pushes.length ? `<section class="pushes"><h2>pushes</h2><ol>${m.pushes.map((p) => `<li>${view(p)}</li>`).join('')}</ol></section>` : '';
-    return `<header><h1>${escape(title(bp))}</h1><p class="notice">${escape(m.notice)}</p></header>${notes}<main>${asks}</main>${pushes}`;
+    const mine = look(m.look);
+    return `<header${mine.style}>${m.look.logo ? `<img class="logo" alt="" src="${m.look.logo}">` : ''}<h1>${escape(title(bp, m.look))}</h1><p class="notice">${escape(m.notice)}</p></header>${notes}<main${mine.style}>${asks}</main>${pushes}`;
 }

package/dist/human/screen.d.ts

@@ -1,11 +1,16 @@
-import type { Avatar } from '../beings/avatar.ts';
-import { type Serving } from '../beings/side.ts';
+import { type Serving, type Subject } from '../beings/side.ts';
+import type { Invitation } from '@quo-systems/quo';
 import { type Model, type Raw } from './html.ts';
 export type Surface = {
     show(html: string): void;
     onSubmit: ((ask: string, raw: Raw) => void) | undefined;
 };
-export declare function screenSide(avatar: Avatar, surface: Surface, after?: () => Promise<void>, notice?: string): Promise<Serving & {
+export type Options = {
+    after?: () => Promise<void>;
+    notice?: string;
+    admit?: (invitation: Invitation) => Promise<void>;
+};
+export declare function screenSide(avatar: Subject, surface: Surface, options?: Options): Promise<Serving & {
     model: Model;
     refresh(): Promise<void>;
 }>;

package/dist/human/screen.js

@@ -8,11 +8,14 @@
 // moved. A push is appended and shown the moment it lands.
 import { digest } from '@quo-systems/quo';
 import { word } from '../beings/side.js';
-import { page, values } from './html.js';
-// `after` runs when a call is done, as it does for the model side: a harbor
-// that must write what the ward changed hooks it.
-export async function screenSide(avatar, surface, after = async () => { }, notice = '') {
-    const model = { blueprint: null, notice, answers: {}, pushes: [] };
+import { isInvitation } from '../beings/link.js';
+import { page, values, hintFor } from './html.js';
+import { sanitise } from '../beings/look.js';
+import { isSilence, isWord } from '@quo-systems/quo';
+export async function screenSide(avatar, surface, options = {}) {
+    const after = options.after ?? (async () => { });
+    const notice = options.notice ?? '';
+    const model = { blueprint: null, look: {}, notice, answers: {}, pushes: [] };
     let seen = null;
     const show = () => surface.show(page(model));
     // Her describe, again: the page follows the digest.
@@ -31,6 +34,19 @@ export async function screenSide(avatar, surface, after = async () => { }, notic
                 for (const k of Object.keys(model.answers))
                     if (!bp.asks.some((a) => a.name === k))
                         delete model.answers[k];
+                // her look, once per digest: how she wants her page painted, and what each ask is
+                if (bp.asks.some((a) => a.name === 'look')) {
+                    const l = await avatar.call('look');
+                    model.look = isSilence(l) || isWord(l) ? {} : sanitise(l);
+                }
+                else
+                    model.look = {};
+                // a read-only ask that needs nothing typed is run on her behalf, so the page opens with what it shows
+                for (const a of bp.asks) {
+                    const needs = (a.input.required ?? []).length > 0;
+                    if (hintFor(bp, model.look, a.name).readOnly && !needs && !(a.name in model.answers))
+                        model.answers[a.name] = word(await avatar.call(a.name, {}));
+                }
             }
         }
         show();
@@ -45,8 +61,11 @@ export async function screenSide(avatar, surface, after = async () => { }, notic
             model.answers[name] = { word: 'error', value: { error: v.error } };
             return show();
         }
-        model.answers[name] = word(await avatar.call(name, v.args));
+        const out = await avatar.call(name, v.args);
         await after();
+        if (options.admit && isInvitation(out))
+            return options.admit(out);
+        model.answers[name] = word(out);
         await refresh();
     };
     const ear = (object) => {

package/dist/human/tab.d.ts

@@ -2,6 +2,8 @@ import { USER } from '../beings/avatar.ts';
 export type Config = {
     quo: string;
     web: string;
+    ward: string;
+    pk: string;
 };
 export declare function start(cfg: Config, root?: HTMLElement): Promise<void>;
 export { USER };

package/dist/human/tab.js

@@ -1,7 +1,27 @@
 import { BrowserHarbor } from '../harbor/browser.js';
 import { Avatar, USER } from '../beings/avatar.js';
+import { parse, strip, isInvitation } from '../beings/link.js';
 import { screenSide } from './screen.js';
 import { domSurface } from './dom.js';
+import { guest } from './guest.js';
+import { escape } from './html.js';
+const WORLDS = 'quo-worlds';
+const worlds = () => {
+    try {
+        return JSON.parse(localStorage.getItem(WORLDS) ?? '{}');
+    }
+    catch {
+        return {};
+    }
+};
+const remember = (pk, url, name) => {
+    try {
+        localStorage.setItem(WORLDS, JSON.stringify({ ...worlds(), [pk]: { url, name } }));
+    }
+    catch {
+        /* a tab with no storage still works, and forgets */
+    }
+};
 const el = (tag, text = '', attrs = {}) => {
     const e = document.createElement(tag);
     if (text)
@@ -11,58 +31,123 @@ const el = (tag, text = '', attrs = {}) => {
     return e;
 };
 export async function start(cfg, root = document.body) {
+    // The link, first and once: the invitation leaves the address bar before
+    // any other code sees it.
+    const linked = parse(location.hash);
+    if (linked)
+        history.replaceState(null, '', location.pathname + location.search + strip(location.hash));
+    const nav = el('nav', '', { class: 'worlds' });
     const status = el('p', 'booting');
     const screen = el('div');
-    root.append(status, screen);
+    root.append(nav, status, screen);
     const say = (s) => (status.textContent = s);
-    // The harbor in the tab: one database, one ward, one avatar, for good.
+    // The harbor in the tab: one database per origin, one ward per world.
     const harbor = new BrowserHarbor('quo');
     await harbor.boot();
-    const main = harbor.wards.get('main') ?? (await harbor.create('main', 'me'));
-    if (!main.being('me'))
-        await main.ask('boot', { key: 'me', class: 'Avatar' });
-    const me = main.being('me');
+    const name = `w-${cfg.pk.slice(0, 16)}`;
+    const ward = harbor.wards.get(name) ?? (await harbor.create(name, 'me'));
+    if (!ward.being('me'))
+        await ward.ask('boot', { key: 'me', class: 'Avatar' });
+    const me = ward.being('me');
     harbor.dial(cfg.quo);
-    // The screen: every call rotates her keys and a same-ward ask never
+    const switcher = () => {
+        nav.replaceChildren();
+        const known = worlds();
+        for (const [pk, w] of Object.entries(known)) {
+            const a = el('a', w.name || pk.slice(0, 8), { href: w.url });
+            if (pk === cfg.pk)
+                a.setAttribute('aria-current', 'page');
+            nav.append(a);
+        }
+        const here = worlds()[cfg.pk];
+        if (!here)
+            nav.append(el('span', `${cfg.ward} at ${new URL(cfg.web).host}`));
+    };
+    switcher();
+    // Joined: her page. Every call rotates her keys and a same-ward ask never
     // crosses the harbor, so the side saves after each one.
-    const show = async (notice) => {
+    const inside = async (notice) => {
         status.remove();
-        await screenSide(me, domSurface(screen), () => main.save(), notice);
+        screen.replaceChildren();
+        const side = await screenSide(me, domSurface(screen), { after: () => ward.save(), notice });
+        remember(cfg.pk, location.origin + location.pathname, side.model.look.name || (typeof side.model.blueprint?.notes?.name === 'string' ? side.model.blueprint.notes.name : cfg.ward));
+        switcher();
     };
-    // Already in: reconnect, nothing minted.
-    const had = await me.tools();
-    if ('asks' in had)
-        return show('in, as before');
-    // The exchange, once: the owner password for a nonce, the nonce for an
-    // invitation the user being mints, the invitation for a standing.
-    const form = el('form');
-    const identity = el('input', '', { name: 'identity', value: 'tab', placeholder: 'identity' });
-    const password = el('input', '', { name: 'password', type: 'password', placeholder: 'owner password' });
-    const go = el('button', 'enter');
-    form.append(identity, password, go);
-    root.insertBefore(form, screen);
-    say(`not in (${had.error}): the owner password opens the world`);
-    form.onsubmit = async (ev) => {
-        ev.preventDefault();
-        say('asking the world');
-        let res;
-        try {
-            res = await fetch(`${cfg.web}/tab/login`, { method: 'POST', headers: { 'content-type': 'application/json' }, body: JSON.stringify({ password: password.value, identity: identity.value }) });
-        }
-        catch (e) {
-            return say(`the world did not answer: ${e.message}`);
-        }
-        if (!res.ok)
-            return say(`refused: ${(await res.json().catch(() => ({ error: res.status }))).error ?? res.status}`);
-        const { nonce, ward } = (await res.json());
-        password.value = '';
+    // The way in, from any of the three: join, save, and be inside.
+    const admit = async (inv, notice) => {
         say('knocking');
-        const got = await me.enter({ ward }, { kind: 'tab', nonce });
-        await main.save(); // the knock went through her own door, which the harbor never sees
-        if (!('asks' in got))
-            return say(`not in: ${got.error}`);
-        form.remove();
-        await show(`in, as ${identity.value}`);
+        const got = await me.join(inv);
+        await ward.save(); // the knock went through her own door, which the harbor never sees
+        if (!('asks' in got)) {
+            say(`not in: ${got.error}`);
+            return;
+        }
+        await inside(notice);
     };
+    // Already in: reconnect, nothing minted.
+    if (me.standings[USER]) {
+        const had = await me.tools();
+        if ('asks' in had)
+            return inside('in, as before');
+        say(`not in (${had.error})`);
+    }
+    if (linked)
+        return admit(linked, 'in, by the link');
+    // A guest: the public being's describe as a page; a form whose answer is
+    // an invitation lets the guest in.
+    say(`at the door of ${cfg.ward}`);
+    const door = guest(me, cfg.pk);
+    const side = await screenSide(door, domSurface(screen), {
+        after: () => ward.save(),
+        notice: `a guest at ${cfg.ward}: what she shows strangers`,
+        admit: async (inv) => {
+            await side.close();
+            await admit(inv, `in, as a guest of ${cfg.ward}`);
+        },
+    });
+    // The dock's own way in, when the desk is at the door: the owner password
+    // for a nonce, and the desk's `device` form submitted with it.
+    if (side.model.blueprint?.asks.some((a) => a.name === 'device')) {
+        const form = el('form', '', { class: 'password' });
+        const identity = el('input', '', { name: 'identity', value: 'tab', placeholder: 'identity' });
+        const password = el('input', '', { name: 'password', type: 'password', placeholder: 'owner password' });
+        const go = el('button', 'enter as the owner');
+        form.append(identity, password, go);
+        root.insertBefore(form, screen);
+        form.onsubmit = (ev) => {
+            ev.preventDefault();
+            void (async () => {
+                say('asking the world');
+                let res;
+                try {
+                    res = await fetch(`${cfg.web}/${encodeURIComponent(cfg.ward)}/login`, { method: 'POST', headers: { 'content-type': 'application/json' }, body: JSON.stringify({ password: password.value, identity: identity.value }) });
+                }
+                catch (e) {
+                    say(`the world did not answer: ${e.message}`);
+                    return;
+                }
+                password.value = '';
+                if (!res.ok) {
+                    say(`refused: ${(await res.json().catch(() => ({ error: res.status }))).error ?? res.status}`);
+                    return;
+                }
+                const { nonce } = (await res.json());
+                const inv = await door.call('device', { proof: { kind: 'tab', nonce } });
+                await ward.save();
+                if (!isInvitation(inv)) {
+                    say(`not in: ${escape(JSON.stringify(inv))}`);
+                    return;
+                }
+                form.remove();
+                await side.close();
+                await admit(inv, `in, as ${identity.value}`);
+            })();
+        };
+    }
 }
+// The page hands the config in a JSON script, which a content security
+// policy allows where an inline script is not.
+const config = document.getElementById('quo');
+if (config?.textContent)
+    void start(JSON.parse(config.textContent));
 export { USER };

package/dist/mcp/http.d.ts

@@ -4,12 +4,13 @@ import type { Avatar } from '../beings/avatar.ts';
 import type { Serving } from '../beings/side.ts';
 export type Session = {
     identity: string;
+    ward: string;
     transport: StreamableHTTPServerTransport;
     serving: Serving;
     touched: number;
 };
 export declare const SESSION_IDLE: number;
-export type Resolve = (identity: string) => Promise<{
+export type Resolve = (identity: string, ward: string) => Promise<{
     avatar?: Avatar;
     error?: string;
 }>;
@@ -18,9 +19,9 @@ export declare class McpHttp {
     readonly resolve: Resolve;
     readonly after: () => Promise<void>;
     now: () => number;
-    gone: (identity: string) => Promise<void>;
+    gone: (identity: string, ward: string) => Promise<void>;
     constructor(resolve: Resolve, after?: () => Promise<void>);
-    handle(req: IncomingMessage, res: ServerResponse, identity: string): Promise<void>;
+    handle(req: IncomingMessage, res: ServerResponse, identity: string, ward?: string): Promise<void>;
     sweep(): void;
     drop(sid: string): void;
     close(): Promise<void>;

package/dist/mcp/http.js

@@ -28,7 +28,7 @@ export class McpHttp {
     // `identity` is what the bearer named; the caller has already turned a
     // stranger away. A request on a known session goes to it. A request with
     // no session opens one, if it is an initialize; anything else is 400.
-    async handle(req, res, identity) {
+    async handle(req, res, identity, ward = 'main') {
         const id = req.headers['mcp-session-id'];
         const sid = Array.isArray(id) ? id[0] : id;
         const json = (status, body) => {
@@ -40,7 +40,7 @@ export class McpHttp {
             const s = this.sessions.get(sid);
             if (!s)
                 return json(404, { jsonrpc: '2.0', error: { code: -32001, message: 'no such session' }, id: null });
-            if (s.identity !== identity)
+            if (s.identity !== identity || s.ward !== ward)
                 return json(403, { jsonrpc: '2.0', error: { code: -32003, message: 'not your session' }, id: null });
             s.touched = this.now();
             await s.transport.handleRequest(req, res);
@@ -50,16 +50,16 @@ export class McpHttp {
         }
         if (req.method !== 'POST')
             return json(400, { jsonrpc: '2.0', error: { code: -32000, message: 'no session' }, id: null });
-        const found = await this.resolve(identity);
+        const found = await this.resolve(identity, ward);
         // A session opens on her describe, and admit already asked it. The one
         // word the door says for an identity the user being removed is
         // `removed`, under the key it bound for her avatar: in MCP's vocabulary
         // that is 401, the client drops its token and starts the exchange again,
         // and the route forgets the grant.
         if (found.error === 'removed') {
-            await this.gone(identity);
+            await this.gone(identity, ward);
             for (const [sid, s] of this.sessions)
-                if (s.identity === identity)
+                if (s.identity === identity && s.ward === ward)
                     this.drop(sid);
             res.writeHead(401, { 'content-type': 'application/json' });
             return void res.end(JSON.stringify({ jsonrpc: '2.0', error: { code: -32001, message: 'removed: the user being removed this identity' }, id: null }));
@@ -69,7 +69,7 @@ export class McpHttp {
         const transport = new StreamableHTTPServerTransport({
             sessionIdGenerator: () => randomUUID(),
             onsessioninitialized: (s) => {
-                this.sessions.set(s, { identity, transport, serving, touched: this.now() });
+                this.sessions.set(s, { identity, ward, transport, serving, touched: this.now() });
             },
             onsessionclosed: (s) => this.drop(s),
         });