@quo-systems/dock 0.2.0 → 0.2.1

package/dist/human/html.js

@@ -1,4 +1,5 @@
 import { SILENCE_TEXT, UNREACHED_TEXT, wordText } from '../beings/side.js';
+import { hint, hintFor, sanitise, groups as grouped } from '../beings/look.js';
 export const escape = (s) => s.replace(/[&<>"']/g, (c) => ({ '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;', "'": '&#39;' })[c] ?? c);
 const props = (schema) => Object.entries((schema?.properties ?? {}));
 const required = (schema) => new Set((schema?.required ?? []));
@@ -28,12 +29,14 @@ export function field(name, p, must) {
 }
 // The ask as a form: its name is the button, its description the legend's
 // small print, and `data-ask` is how the surface says which ask was sent.
-export function form(ask) {
+export function form(ask, h = {}) {
     const must = required(ask.input);
     const fields = props(ask.input)
         .map(([name, p]) => field(name, p, must.has(name)))
         .join('');
-    return `<form data-ask="${escape(ask.name)}"><fieldset><legend>${escape(ask.name)}${ask.description ? ` <small>${escape(ask.description)}</small>` : ''}</legend>${fields}<p><button>${escape(ask.name)}</button></p></fieldset></form>`;
+    const label = `${h.icon ? `${escape(h.icon)} ` : ''}${escape(h.title ?? ask.name)}`;
+    const care = h.destructive ? ' data-confirm="true"' : '';
+    return `<form data-ask="${escape(ask.name)}"${care}><fieldset><legend>${label}${ask.description ? ` <small>${escape(ask.description)}</small>` : ''}</legend>${fields}<p><button>${label}</button></p></fieldset></form>`;
 }
 // The strings typed by the schema. An empty field that is not required is
 // left out, so the being sees what the human said and nothing else; an
@@ -116,21 +119,69 @@ export function face(w, schema) {
 }
 // The title is the one hint the notes may carry: a string named `name`.
 // The rest of the notes is shown as a view and read as nothing else.
-export function title(bp) {
+export function title(bp, l = {}) {
+    if (l.name)
+        return l.name;
     const n = bp?.notes;
     return n !== null && typeof n === 'object' && !Array.isArray(n) && typeof n.name === 'string' && n.name ? n.name : 'quo';
 }
+// ---- a look
+// A look as the page paints it: the tokens become CSS variables on one
+// section, and the name and the logo its heading. The shape of every token
+// is the dock's, `beings/look.ts`; this only writes what survived it.
+export function look(l) {
+    if (!l)
+        return { style: '', head: '' };
+    const vars = [];
+    if (l.accent)
+        vars.push(`--accent:${l.accent}`);
+    if (l.background)
+        vars.push(`--bg:${l.background}`);
+    if (l.foreground)
+        vars.push(`--fg:${l.foreground}`);
+    if (l.font)
+        vars.push(`--font:${l.font}`);
+    if (l.radius !== undefined)
+        vars.push(`--radius:${l.radius}px`);
+    const logo = l.logo ? `<img class="logo" alt="" src="${l.logo}">` : '';
+    const name = l.name ? escape(l.name) : '';
+    return { style: vars.length ? ` style="${vars.join(';')}"` : '', head: logo || name ? `<h2>${logo}${name}</h2>` : '' };
+}
+// Her asks in the order her look asks for, the rest after in her own order.
+export function ordered(asks, l) {
+    const want = l?.order ?? [];
+    return [...want.map((n) => asks.find((a) => a.name === n)).filter((a) => a !== undefined), ...asks.filter((a) => !want.includes(a.name))];
+}
+export { hintFor };
 export function page(m) {
     const bp = m.blueprint;
-    const asks = bp
-        ? bp.asks
-            .map((a) => {
-            const w = m.answers[a.name];
-            return `<section>${form(a)}${w ? face(w, a.output) : ''}</section>`;
+    const one = (l, prefix = '') => (a) => {
+        const w = m.answers[a.name];
+        const h = hint(l, a.name.startsWith(prefix) ? a.name.slice(prefix.length) : a.name);
+        return `<section>${form(a, h)}${w ? face(w, a.output) : ''}</section>`;
+    };
+    const groups = grouped(bp);
+    const taken = new Set(Object.values(groups).flatMap((g) => g.asks ?? []));
+    const own = bp ? ordered(bp.asks.filter((a) => !taken.has(a.name) && a.name !== 'look'), m.look).map(one(m.look)).join('') : '';
+    const far = bp
+        ? Object.entries(groups)
+            .map(([id, g]) => {
+            const asks = bp.asks.filter((a) => g.asks?.includes(a.name));
+            if (!asks.length)
+                return '';
+            const kept = sanitise(g.look);
+            const l = look(kept);
+            const prefix = `${id}-`;
+            const want = (kept.order ?? []).map((n) => prefix + n);
+            const inOrder = ordered(asks, { order: want });
+            return `<section class="standing" data-standing="${escape(id)}"${l.style}>${l.head || `<h2>${escape(id)}</h2>`}${inOrder.map(one(kept, prefix)).join('')}</section>`;
         })
             .join('')
         : '';
-    const notes = bp && bp.notes !== null && !(typeof bp.notes === 'object' && !Array.isArray(bp.notes) && !Object.keys(bp.notes).length) ? `<aside class="notes">${view(bp.notes)}</aside>` : '';
+    const asks = own + far;
+    const shown = bp && bp.notes !== null && typeof bp.notes === 'object' && !Array.isArray(bp.notes) ? Object.fromEntries(Object.entries(bp.notes).filter(([k]) => k !== 'standings' && k !== 'name')) : bp?.notes;
+    const notes = bp && shown !== null && shown !== undefined && !(typeof shown === 'object' && !Array.isArray(shown) && !Object.keys(shown).length) ? `<aside class="notes">${view(shown)}</aside>` : '';
     const pushes = m.pushes.length ? `<section class="pushes"><h2>pushes</h2><ol>${m.pushes.map((p) => `<li>${view(p)}</li>`).join('')}</ol></section>` : '';
-    return `<header><h1>${escape(title(bp))}</h1><p class="notice">${escape(m.notice)}</p></header>${notes}<main>${asks}</main>${pushes}`;
+    const mine = look(m.look);
+    return `<header${mine.style}>${m.look.logo ? `<img class="logo" alt="" src="${m.look.logo}">` : ''}<h1>${escape(title(bp, m.look))}</h1><p class="notice">${escape(m.notice)}</p></header>${notes}<main${mine.style}>${asks}</main>${pushes}`;
 }

package/dist/human/screen.d.ts

@@ -1,11 +1,16 @@
-import type { Avatar } from '../beings/avatar.ts';
-import { type Serving } from '../beings/side.ts';
+import { type Serving, type Subject } from '../beings/side.ts';
+import type { Invitation } from '@quo-systems/quo';
 import { type Model, type Raw } from './html.ts';
 export type Surface = {
     show(html: string): void;
     onSubmit: ((ask: string, raw: Raw) => void) | undefined;
 };
-export declare function screenSide(avatar: Avatar, surface: Surface, after?: () => Promise<void>, notice?: string): Promise<Serving & {
+export type Options = {
+    after?: () => Promise<void>;
+    notice?: string;
+    admit?: (invitation: Invitation) => Promise<void>;
+};
+export declare function screenSide(avatar: Subject, surface: Surface, options?: Options): Promise<Serving & {
     model: Model;
     refresh(): Promise<void>;
 }>;

package/dist/human/screen.js

@@ -8,11 +8,14 @@
 // moved. A push is appended and shown the moment it lands.
 import { digest } from '@quo-systems/quo';
 import { word } from '../beings/side.js';
-import { page, values } from './html.js';
-// `after` runs when a call is done, as it does for the model side: a harbor
-// that must write what the ward changed hooks it.
-export async function screenSide(avatar, surface, after = async () => { }, notice = '') {
-    const model = { blueprint: null, notice, answers: {}, pushes: [] };
+import { isInvitation } from '../beings/link.js';
+import { page, values, hintFor } from './html.js';
+import { sanitise } from '../beings/look.js';
+import { isSilence, isWord } from '@quo-systems/quo';
+export async function screenSide(avatar, surface, options = {}) {
+    const after = options.after ?? (async () => { });
+    const notice = options.notice ?? '';
+    const model = { blueprint: null, look: {}, notice, answers: {}, pushes: [] };
     let seen = null;
     const show = () => surface.show(page(model));
     // Her describe, again: the page follows the digest.
@@ -31,6 +34,19 @@ export async function screenSide(avatar, surface, after = async () => { }, notic
                 for (const k of Object.keys(model.answers))
                     if (!bp.asks.some((a) => a.name === k))
                         delete model.answers[k];
+                // her look, once per digest: how she wants her page painted, and what each ask is
+                if (bp.asks.some((a) => a.name === 'look')) {
+                    const l = await avatar.call('look');
+                    model.look = isSilence(l) || isWord(l) ? {} : sanitise(l);
+                }
+                else
+                    model.look = {};
+                // a read-only ask that needs nothing typed is run on her behalf, so the page opens with what it shows
+                for (const a of bp.asks) {
+                    const needs = (a.input.required ?? []).length > 0;
+                    if (hintFor(bp, model.look, a.name).readOnly && !needs && !(a.name in model.answers))
+                        model.answers[a.name] = word(await avatar.call(a.name, {}));
+                }
             }
         }
         show();
@@ -45,8 +61,11 @@ export async function screenSide(avatar, surface, after = async () => { }, notic
             model.answers[name] = { word: 'error', value: { error: v.error } };
             return show();
         }
-        model.answers[name] = word(await avatar.call(name, v.args));
+        const out = await avatar.call(name, v.args);
         await after();
+        if (options.admit && isInvitation(out))
+            return options.admit(out);
+        model.answers[name] = word(out);
         await refresh();
     };
     const ear = (object) => {

package/dist/human/tab.d.ts

@@ -2,6 +2,8 @@ import { USER } from '../beings/avatar.ts';
 export type Config = {
     quo: string;
     web: string;
+    ward: string;
+    pk: string;
 };
 export declare function start(cfg: Config, root?: HTMLElement): Promise<void>;
 export { USER };

package/dist/human/tab.js

@@ -1,7 +1,27 @@
 import { BrowserHarbor } from '../harbor/browser.js';
 import { Avatar, USER } from '../beings/avatar.js';
+import { parse, strip, isInvitation } from '../beings/link.js';
 import { screenSide } from './screen.js';
 import { domSurface } from './dom.js';
+import { guest } from './guest.js';
+import { escape } from './html.js';
+const WORLDS = 'quo-worlds';
+const worlds = () => {
+    try {
+        return JSON.parse(localStorage.getItem(WORLDS) ?? '{}');
+    }
+    catch {
+        return {};
+    }
+};
+const remember = (pk, url, name) => {
+    try {
+        localStorage.setItem(WORLDS, JSON.stringify({ ...worlds(), [pk]: { url, name } }));
+    }
+    catch {
+        /* a tab with no storage still works, and forgets */
+    }
+};
 const el = (tag, text = '', attrs = {}) => {
     const e = document.createElement(tag);
     if (text)
@@ -11,58 +31,123 @@ const el = (tag, text = '', attrs = {}) => {
     return e;
 };
 export async function start(cfg, root = document.body) {
+    // The link, first and once: the invitation leaves the address bar before
+    // any other code sees it.
+    const linked = parse(location.hash);
+    if (linked)
+        history.replaceState(null, '', location.pathname + location.search + strip(location.hash));
+    const nav = el('nav', '', { class: 'worlds' });
     const status = el('p', 'booting');
     const screen = el('div');
-    root.append(status, screen);
+    root.append(nav, status, screen);
     const say = (s) => (status.textContent = s);
-    // The harbor in the tab: one database, one ward, one avatar, for good.
+    // The harbor in the tab: one database per origin, one ward per world.
     const harbor = new BrowserHarbor('quo');
     await harbor.boot();
-    const main = harbor.wards.get('main') ?? (await harbor.create('main', 'me'));
-    if (!main.being('me'))
-        await main.ask('boot', { key: 'me', class: 'Avatar' });
-    const me = main.being('me');
+    const name = `w-${cfg.pk.slice(0, 16)}`;
+    const ward = harbor.wards.get(name) ?? (await harbor.create(name, 'me'));
+    if (!ward.being('me'))
+        await ward.ask('boot', { key: 'me', class: 'Avatar' });
+    const me = ward.being('me');
     harbor.dial(cfg.quo);
-    // The screen: every call rotates her keys and a same-ward ask never
+    const switcher = () => {
+        nav.replaceChildren();
+        const known = worlds();
+        for (const [pk, w] of Object.entries(known)) {
+            const a = el('a', w.name || pk.slice(0, 8), { href: w.url });
+            if (pk === cfg.pk)
+                a.setAttribute('aria-current', 'page');
+            nav.append(a);
+        }
+        const here = worlds()[cfg.pk];
+        if (!here)
+            nav.append(el('span', `${cfg.ward} at ${new URL(cfg.web).host}`));
+    };
+    switcher();
+    // Joined: her page. Every call rotates her keys and a same-ward ask never
     // crosses the harbor, so the side saves after each one.
-    const show = async (notice) => {
+    const inside = async (notice) => {
         status.remove();
-        await screenSide(me, domSurface(screen), () => main.save(), notice);
+        screen.replaceChildren();
+        const side = await screenSide(me, domSurface(screen), { after: () => ward.save(), notice });
+        remember(cfg.pk, location.origin + location.pathname, side.model.look.name || (typeof side.model.blueprint?.notes?.name === 'string' ? side.model.blueprint.notes.name : cfg.ward));
+        switcher();
     };
-    // Already in: reconnect, nothing minted.
-    const had = await me.tools();
-    if ('asks' in had)
-        return show('in, as before');
-    // The exchange, once: the owner password for a nonce, the nonce for an
-    // invitation the user being mints, the invitation for a standing.
-    const form = el('form');
-    const identity = el('input', '', { name: 'identity', value: 'tab', placeholder: 'identity' });
-    const password = el('input', '', { name: 'password', type: 'password', placeholder: 'owner password' });
-    const go = el('button', 'enter');
-    form.append(identity, password, go);
-    root.insertBefore(form, screen);
-    say(`not in (${had.error}): the owner password opens the world`);
-    form.onsubmit = async (ev) => {
-        ev.preventDefault();
-        say('asking the world');
-        let res;
-        try {
-            res = await fetch(`${cfg.web}/tab/login`, { method: 'POST', headers: { 'content-type': 'application/json' }, body: JSON.stringify({ password: password.value, identity: identity.value }) });
-        }
-        catch (e) {
-            return say(`the world did not answer: ${e.message}`);
-        }
-        if (!res.ok)
-            return say(`refused: ${(await res.json().catch(() => ({ error: res.status }))).error ?? res.status}`);
-        const { nonce, ward } = (await res.json());
-        password.value = '';
+    // The way in, from any of the three: join, save, and be inside.
+    const admit = async (inv, notice) => {
         say('knocking');
-        const got = await me.enter({ ward }, { kind: 'tab', nonce });
-        await main.save(); // the knock went through her own door, which the harbor never sees
-        if (!('asks' in got))
-            return say(`not in: ${got.error}`);
-        form.remove();
-        await show(`in, as ${identity.value}`);
+        const got = await me.join(inv);
+        await ward.save(); // the knock went through her own door, which the harbor never sees
+        if (!('asks' in got)) {
+            say(`not in: ${got.error}`);
+            return;
+        }
+        await inside(notice);
     };
+    // Already in: reconnect, nothing minted.
+    if (me.standings[USER]) {
+        const had = await me.tools();
+        if ('asks' in had)
+            return inside('in, as before');
+        say(`not in (${had.error})`);
+    }
+    if (linked)
+        return admit(linked, 'in, by the link');
+    // A guest: the public being's describe as a page; a form whose answer is
+    // an invitation lets the guest in.
+    say(`at the door of ${cfg.ward}`);
+    const door = guest(me, cfg.pk);
+    const side = await screenSide(door, domSurface(screen), {
+        after: () => ward.save(),
+        notice: `a guest at ${cfg.ward}: what she shows strangers`,
+        admit: async (inv) => {
+            await side.close();
+            await admit(inv, `in, as a guest of ${cfg.ward}`);
+        },
+    });
+    // The dock's own way in, when the desk is at the door: the owner password
+    // for a nonce, and the desk's `device` form submitted with it.
+    if (side.model.blueprint?.asks.some((a) => a.name === 'device')) {
+        const form = el('form', '', { class: 'password' });
+        const identity = el('input', '', { name: 'identity', value: 'tab', placeholder: 'identity' });
+        const password = el('input', '', { name: 'password', type: 'password', placeholder: 'owner password' });
+        const go = el('button', 'enter as the owner');
+        form.append(identity, password, go);
+        root.insertBefore(form, screen);
+        form.onsubmit = (ev) => {
+            ev.preventDefault();
+            void (async () => {
+                say('asking the world');
+                let res;
+                try {
+                    res = await fetch(`${cfg.web}/${encodeURIComponent(cfg.ward)}/login`, { method: 'POST', headers: { 'content-type': 'application/json' }, body: JSON.stringify({ password: password.value, identity: identity.value }) });
+                }
+                catch (e) {
+                    say(`the world did not answer: ${e.message}`);
+                    return;
+                }
+                password.value = '';
+                if (!res.ok) {
+                    say(`refused: ${(await res.json().catch(() => ({ error: res.status }))).error ?? res.status}`);
+                    return;
+                }
+                const { nonce } = (await res.json());
+                const inv = await door.call('device', { proof: { kind: 'tab', nonce } });
+                await ward.save();
+                if (!isInvitation(inv)) {
+                    say(`not in: ${escape(JSON.stringify(inv))}`);
+                    return;
+                }
+                form.remove();
+                await side.close();
+                await admit(inv, `in, as ${identity.value}`);
+            })();
+        };
+    }
 }
+// The page hands the config in a JSON script, which a content security
+// policy allows where an inline script is not.
+const config = document.getElementById('quo');
+if (config?.textContent)
+    void start(JSON.parse(config.textContent));
 export { USER };

package/dist/mcp/http.d.ts

@@ -4,12 +4,13 @@ import type { Avatar } from '../beings/avatar.ts';
 import type { Serving } from '../beings/side.ts';
 export type Session = {
     identity: string;
+    ward: string;
     transport: StreamableHTTPServerTransport;
     serving: Serving;
     touched: number;
 };
 export declare const SESSION_IDLE: number;
-export type Resolve = (identity: string) => Promise<{
+export type Resolve = (identity: string, ward: string) => Promise<{
     avatar?: Avatar;
     error?: string;
 }>;
@@ -18,9 +19,9 @@ export declare class McpHttp {
     readonly resolve: Resolve;
     readonly after: () => Promise<void>;
     now: () => number;
-    gone: (identity: string) => Promise<void>;
+    gone: (identity: string, ward: string) => Promise<void>;
     constructor(resolve: Resolve, after?: () => Promise<void>);
-    handle(req: IncomingMessage, res: ServerResponse, identity: string): Promise<void>;
+    handle(req: IncomingMessage, res: ServerResponse, identity: string, ward?: string): Promise<void>;
     sweep(): void;
     drop(sid: string): void;
     close(): Promise<void>;

package/dist/mcp/http.js

@@ -28,7 +28,7 @@ export class McpHttp {
     // `identity` is what the bearer named; the caller has already turned a
     // stranger away. A request on a known session goes to it. A request with
     // no session opens one, if it is an initialize; anything else is 400.
-    async handle(req, res, identity) {
+    async handle(req, res, identity, ward = 'main') {
         const id = req.headers['mcp-session-id'];
         const sid = Array.isArray(id) ? id[0] : id;
         const json = (status, body) => {
@@ -40,7 +40,7 @@ export class McpHttp {
             const s = this.sessions.get(sid);
             if (!s)
                 return json(404, { jsonrpc: '2.0', error: { code: -32001, message: 'no such session' }, id: null });
-            if (s.identity !== identity)
+            if (s.identity !== identity || s.ward !== ward)
                 return json(403, { jsonrpc: '2.0', error: { code: -32003, message: 'not your session' }, id: null });
             s.touched = this.now();
             await s.transport.handleRequest(req, res);
@@ -50,16 +50,16 @@ export class McpHttp {
         }
         if (req.method !== 'POST')
             return json(400, { jsonrpc: '2.0', error: { code: -32000, message: 'no session' }, id: null });
-        const found = await this.resolve(identity);
+        const found = await this.resolve(identity, ward);
         // A session opens on her describe, and admit already asked it. The one
         // word the door says for an identity the user being removed is
         // `removed`, under the key it bound for her avatar: in MCP's vocabulary
         // that is 401, the client drops its token and starts the exchange again,
         // and the route forgets the grant.
         if (found.error === 'removed') {
-            await this.gone(identity);
+            await this.gone(identity, ward);
             for (const [sid, s] of this.sessions)
-                if (s.identity === identity)
+                if (s.identity === identity && s.ward === ward)
                     this.drop(sid);
             res.writeHead(401, { 'content-type': 'application/json' });
             return void res.end(JSON.stringify({ jsonrpc: '2.0', error: { code: -32001, message: 'removed: the user being removed this identity' }, id: null }));
@@ -69,7 +69,7 @@ export class McpHttp {
         const transport = new StreamableHTTPServerTransport({
             sessionIdGenerator: () => randomUUID(),
             onsessioninitialized: (s) => {
-                this.sessions.set(s, { identity, transport, serving, touched: this.now() });
+                this.sessions.set(s, { identity, ward, transport, serving, touched: this.now() });
             },
             onsessionclosed: (s) => this.drop(s),
         });

package/dist/mcp/oauth.d.ts

@@ -18,6 +18,7 @@ export type Pending = {
 };
 export type Grant = {
     identity: string;
+    ward: string;
     client_id: string;
     exp: number;
 };
@@ -26,6 +27,7 @@ export type Store = {
     pending: Record<string, Pending>;
     codes: Record<string, Pending & {
         identity: string;
+        ward: string;
     }>;
     access: Record<string, Grant>;
     refresh: Record<string, Grant>;
@@ -72,7 +74,7 @@ export declare class OAuth {
     pending(id: string): (Pending & {
         client: Client;
     }) | null;
-    complete(id: string, identity: string): Promise<{
+    complete(id: string, identity: string, ward?: string): Promise<{
         redirect: string;
     } | {
         error: string;
@@ -83,15 +85,18 @@ export declare class OAuth {
         error: string;
     }>;
     token(body: URLSearchParams): Promise<Record<string, unknown>>;
-    issue(identity: string, client_id: string): Promise<{
+    issue(identity: string, ward: string, client_id: string): Promise<{
         access_token: string;
         token_type: string;
         expires_in: number;
         refresh_token: string;
         scope: string;
     }>;
-    bearer(req: IncomingMessage): string | null;
-    revoke(identity: string): Promise<void>;
+    bearer(req: IncomingMessage): {
+        identity: string;
+        ward: string;
+    } | null;
+    revoke(identity: string, ward?: string): Promise<void>;
     sweep(): void;
     handle(req: IncomingMessage, res: ServerResponse, rest: string): Promise<boolean>;
     challenge(res: ServerResponse): void;

package/dist/mcp/oauth.js

@@ -99,14 +99,15 @@ export class OAuth {
         const client = this.client(p.client_id);
         return client ? { ...p, client } : null;
     }
-    // The web route's last step: the human allowed this client as this identity.
-    async complete(id, identity) {
+    // The web route's last step: the human allowed this client as this
+    // identity, into this world.
+    async complete(id, identity, ward = 'main') {
         const p = this.pending(id);
         if (!p)
             return { error: 'expired' };
         delete this.store.pending[id];
         const code = token();
-        this.store.codes[code] = { ...p, identity, exp: this.now() + CODE_TTL };
+        this.store.codes[code] = { ...p, identity, ward, exp: this.now() + CODE_TTL };
         await this.o.persist(this.store);
         return { redirect: withQuery(p.redirect_uri, { code, state: p.state }) };
     }
@@ -131,7 +132,7 @@ export class OAuth {
                 await this.o.persist(this.store);
                 return { error: 'invalid_grant' };
             }
-            return this.issue(c.identity, c.client_id);
+            return this.issue(c.identity, c.ward ?? 'main', c.client_id);
         }
         if (grant === 'refresh_token') {
             const rt = body.get('refresh_token') ?? '';
@@ -139,14 +140,14 @@ export class OAuth {
             if (!r || r.exp < this.now())
                 return { error: 'invalid_grant' };
             delete this.store.refresh[rt]; // rotated: the old one is gone with the new one's birth
-            return this.issue(r.identity, r.client_id);
+            return this.issue(r.identity, r.ward ?? 'main', r.client_id);
         }
         return { error: 'unsupported_grant_type' };
     }
-    async issue(identity, client_id) {
+    async issue(identity, ward, client_id) {
         const access_token = token(), refresh_token = token();
-        this.store.access[access_token] = { identity, client_id, exp: this.now() + ACCESS_TTL };
-        this.store.refresh[refresh_token] = { identity, client_id, exp: this.now() + REFRESH_TTL };
+        this.store.access[access_token] = { identity, ward, client_id, exp: this.now() + ACCESS_TTL };
+        this.store.refresh[refresh_token] = { identity, ward, client_id, exp: this.now() + REFRESH_TTL };
         const c = own(this.store.clients, client_id);
         if (c)
             c.exp = this.now() + REFRESH_TTL; // allowed: the client lives as long as what it was granted
@@ -154,19 +155,19 @@ export class OAuth {
         await this.o.persist(this.store);
         return { access_token, token_type: 'Bearer', expires_in: ACCESS_TTL / 1000, refresh_token, scope: 'quo' };
     }
-    // The bearer on an MCP request, to a client identity. Null is 401.
+    // The bearer on an MCP request, to a client identity in a world. Null is 401.
     bearer(req) {
         const h = req.headers.authorization ?? '';
         const t = h.startsWith('Bearer ') ? h.slice(7) : '';
         const g = own(this.store.access, t);
-        return g && g.exp >= this.now() && typeof g.identity === 'string' ? g.identity : null;
+        return g && g.exp >= this.now() && typeof g.identity === 'string' ? { identity: g.identity, ward: g.ward ?? 'main' } : null;
     }
-    // Every grant an identity holds, gone: the route's half of revocation.
-    // The other half is the user being removing the occupant.
-    async revoke(identity) {
+    // Every grant an identity holds in a world, gone: the route's half of
+    // revocation. The other half is the user being removing the occupant.
+    async revoke(identity, ward = 'main') {
         for (const k of ['access', 'refresh'])
             for (const [t, g] of Object.entries(this.store[k]))
-                if (g.identity === identity)
+                if (g.identity === identity && (g.ward ?? 'main') === ward)
                     delete this.store[k][t];
         await this.o.persist(this.store);
     }

package/dist/mcp/pilot.js

@@ -15,7 +15,7 @@ export function owner(dir, ward, via) {
             return { error: r.word };
         return r;
     };
-    return { tools: () => one(undefined, {}), call: (name, args) => one(name, args), ears: new Set() };
+    return { tools: () => one(undefined, {}), call: (name, args) => one(name, args ?? {}), ears: new Set() };
 }
 export function pilotSide(dir, ward, transport, via) {
     return mcpSide(owner(dir, ward, via), transport);

package/dist/mcp/server.d.ts

@@ -1,16 +1,11 @@
 import type { Transport } from '@modelcontextprotocol/sdk/shared/transport.js';
 import { type Tool } from '@modelcontextprotocol/sdk/types.js';
-import type { Answer, Blueprint, JsonObject } from '@quo-systems/quo';
-import { type Serving } from '../beings/side.ts';
+import type { Blueprint } from '@quo-systems/quo';
+import { type Serving, type Subject } from '../beings/side.ts';
+import { type Look } from '../beings/look.ts';
 export declare const NAME = "quo";
 export declare const VERSION = "0.0.0";
-export type Subject = {
-    tools(): Promise<Blueprint | {
-        error: string;
-    }>;
-    call(name: string, args: JsonObject): Promise<Answer>;
-    ears: Set<(object: JsonObject) => void>;
-};
+export type { Subject } from '../beings/side.ts';
 export declare const DESCRIBE: Tool;
-export declare function tools(bp: Blueprint): Tool[];
+export declare function tools(bp: Blueprint, look?: Look): Tool[];
 export declare function mcpSide(avatar: Subject, transport: Transport, after?: () => Promise<void>): Promise<Serving>;