@quo-systems/dock 0.2.1 → 0.2.2

package/harbor/quo.ts

@@ -0,0 +1,67 @@
+// SPDX-License-Identifier: Apache-2.0
+// The quo. route: the socket door, served by the daemon under `/quo` and
+// mapped by the proxy from the quo. hostname, so a URL of that route is the
+// base of every reach. POST `/quo/<pk>` carries one ask to a pk this harbor
+// holds or holds a socket for; an upgrade at `/quo` is a dialer's held
+// socket, announcing its pks to be bound. Bytes from here go to an own door
+// or a held socket, never onward. The listener half of the socket reach is
+// the terrain's own, `ws` on Node, and lives here with it.
+import type { IncomingMessage, Server as HttpServer } from 'node:http';
+import { WebSocketServer } from 'ws';
+import { Socket as Held, SUITE, type Line } from '@quo-systems/quo/harbor';
+import type { DiskHarbor } from './disk.ts';
+import { readAll, type Handler, type Quo } from '../cli/http.ts';
+
+export function quoRoute(harbor: DiskHarbor, server: HttpServer, quo: Quo): Handler {
+  const pks = () => [...harbor.doors.keys()];
+  const wss = new WebSocketServer({ noServer: true });
+  server.on('upgrade', (req: IncomingMessage, socket, head) => {
+    const url = new URL(req.url ?? '/', 'http://localhost');
+    if (url.pathname.replace(/\/$/, '') !== '/quo') return void socket.destroy(); // the proxy rewrites the route root to /quo/
+    wss.handleUpgrade(req, socket, head, (ws) => {
+      const s: Held = new Held(
+        ws as unknown as Line,
+        (pk, bytes) => harbor.deliver(pk, bytes),
+        (far) => void harbor.bind(far, s, true), // a dialer's claims, each proven at its door: held here, reachable through this socket
+        () => {
+          harbor.unbind(s);
+          quo.sockets.delete(s);
+        },
+      );
+      quo.sockets.add(s);
+      s.announce(pks());
+    });
+  });
+  // The route is public and carries sealed bytes, so any origin may POST
+  // to it: a tab on a world's web. reaching another world's quo. is the
+  // ordinary case, and a binary POST needs the preflight answered.
+  const open = { 'access-control-allow-origin': '*', 'access-control-allow-methods': 'POST, OPTIONS', 'access-control-allow-headers': 'content-type, quo-suite' };
+  return async (req, res, rest) => {
+    if (req.method === 'OPTIONS') {
+      res.writeHead(204, open);
+      return void res.end();
+    }
+    // The wire suite the caller speaks. Absent is this one, because a caller
+    // older than the header is this one. Anything else this door cannot open
+    // and says so as nothing delivered, rather than taking bytes that will
+    // never open and answering a silence that names no reason.
+    const suite = req.headers['quo-suite'];
+    if (suite !== undefined && suite !== String(SUITE)) {
+      res.writeHead(404, { 'content-type': 'application/json', ...open });
+      return void res.end(JSON.stringify({ error: `this door speaks wire suite ${SUITE}` }));
+    }
+    const pk = rest.slice(1);
+    if (req.method !== 'POST' || !/^[0-9a-f]{128}$/.test(pk)) {
+      res.writeHead(404, { 'content-type': 'application/json', ...open });
+      return void res.end(JSON.stringify({ error: 'POST /quo/<pk>' }));
+    }
+    const raw = await readAll(req as AsyncIterable<Buffer>);
+    const back = raw === undefined ? undefined : await harbor.deliver(pk, new Uint8Array(raw));
+    if (back === undefined) {
+      res.writeHead(404, { 'content-type': 'application/json', ...open });
+      return void res.end(JSON.stringify({ error: 'no reach for that pk' }));
+    }
+    res.writeHead(200, { 'content-type': 'application/octet-stream', ...open });
+    res.end(Buffer.from(back));
+  };
+}

package/human/door.ts

@@ -0,0 +1,26 @@
+// SPDX-License-Identifier: Apache-2.0
+// The door page: what a stranger sees where nothing lets them in. No
+// invitation in the fragment, no relation in this tab's harbor, and nobody
+// at the ward's door; or a harbor's root with no world to list. It is
+// Quo's page and not the estate's: it says what this is and that a world
+// here is entered by a link someone sends you, and it asks for nothing,
+// since there is nothing a stranger could type that would let them in. A
+// world that wants a face of its own has a public being with a look, or
+// its own page on its own origin; this is the default and nothing more.
+// Pure, strings in and strings out, under the tab's policy: no script, no
+// image that is not a data URI, styles from the one stylesheet.
+import { escape } from './html.ts';
+
+// The mark: a ring with a gap, one being's voice reaching another's door.
+const MARK =
+  'data:image/svg+xml;base64,' +
+  btoa(
+    `<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 64 64" fill="none" stroke="currentColor" stroke-width="4" stroke-linecap="round"><circle cx="32" cy="32" r="22" stroke-dasharray="110 30" transform="rotate(-60 32 32)"/><circle cx="32" cy="32" r="5" fill="currentColor" stroke="none"/></svg>`,
+  );
+
+export type Door = { world?: string; host: string };
+
+export function door(at: Door): string {
+  const where = at.world ? `<p class="where">${escape(at.world)} <span>at ${escape(at.host)}</span></p>` : `<p class="where">${escape(at.host)}</p>`;
+  return `<main class="door"><img class="mark" alt="" src="${MARK}"><h1>quo</h1>${where}<p class="lead">${at.world ? 'This world is entered by invitation.' : 'The worlds here are entered by invitation.'}</p><p>An invitation is a link someone sends you. Open it here, and you are in: no account, no password, nothing to type. What you can do inside is what the world shows you, and it is yours to keep on this device.</p><p class="quiet">Nothing on this page asks anything of you. If you were sent here without a link, ask the person who sent you for one.</p></main>`;
+}

package/human/quo-human.md

@@ -24,9 +24,9 @@ that wants a page of its own writes any HTML, CSS and JavaScript it likes on
 its own origin, against the avatar's handles and nothing else; a world that
 writes none gets this screen.
 
-## What the twelfth sitting decided
+## How a screen is made
 
-Read with the trunk's "Carrying" and "The look", which it applies.
+Read with the trunk's "Carrying" and "The look", which this applies.
 
 - **A form from a schema, without a designer.** An input schema is a form
   with one field per property by type: a string is a text input, and
@@ -49,7 +49,10 @@ Read with the trunk's "Carrying" and "The look", which it applies.
 - **The page follows the digest.** The side asks the describe again after
   every call and asks `look` once per digest; a digest that moved is a page
   that moved. A read-only ask with nothing to type is run on open, so a page
-  can open with what it shows and not only with buttons.
+  can open with what it shows and not only with buttons. Every one of those
+  asks rotates her keys, so the side saves after each, not only after a
+  form: a relation brought back from a reload with a stale count is refused
+  at the far door and hears silence.
 - **What a look may carry, and never.** The trunk's table is the whole
   list: a name, a logo as a data URI, three colours, a font, a radius, an
   order, a hint per ask. No CSS, no URL, no script, ever. A token that fails
@@ -75,10 +78,24 @@ Read with the trunk's "Carrying" and "The look", which it applies.
   referer. The tab reads it, strips it from the address bar before anything
   else runs, and joins. A page's own routing keeps the query, the path and
   the rest of the fragment; only `quo` is taken. `beings/link.ts`.
-- **The tab is a browser of worlds.** One harbor per origin, one ward per
-  world joined, each on the tab's seed with one avatar, and a switcher over
-  them. A world on another origin is another page, and the switcher links
-  there.
+- **An invitation is self-addressing.** It names its ward by pk, so the
+  path of the page it was opened on is a hint for humans and nothing more:
+  the tab joins in the local ward of the ward the invitation names, and
+  the address follows. `web./#quo=...` is a complete way in for anyone
+  holding an invitation to any ward the harbor hosts, and every ward has a
+  page, whether or not anyone is at its door, so that a link into one has
+  somewhere to land; a ward with no public being says it admits by
+  invitation only.
+- **The tab is a browser of worlds, and of the relations in each.** One
+  harbor per origin, one local ward per world joined, and inside it one
+  avatar per relation, since an avatar is one standing: a fresh invitation
+  is always a fresh avatar, never a join on one that already holds hers. A
+  link opened while in is one more relation; two humans on one family
+  tablet are two relations in one world; a switcher over worlds and
+  another over relations, and a switch is a switch of avatar and nothing
+  more. A world on another origin is another page, and the switcher links
+  there. `worlds.ts` is this without a document, and the memory harbor
+  proves it.
 - **The policy.** The page carries a content security policy: scripts from
   its origin only and never inline, connections to its origin and the `quo.`
   route it dials, images from data URIs and its origin, no frames, no base.
@@ -87,7 +104,7 @@ Read with the trunk's "Carrying" and "The look", which it applies.
 
 ## The pieces
 
-Three files under `packages/dock/human/`, and the tab that holds them:
+Eight files under `packages/dock/human/`:
 
 - `html.ts` is pure, strings in and strings out, and is the screen's whole
   vocabulary: `form`, `values`, `view`, `face`, `look`, `page`. It reads the
@@ -102,15 +119,31 @@ Three files under `packages/dock/human/`, and the tab that holds them:
 - `dom.ts` is the surface on an element, the one file that touches one.
 - `guest.ts` is a world's public being as a subject the screen renders:
   her describe for a stranger, a form as a knock on the public invitation.
-- `tab.ts` is the harbor in the tab, the worlds and the three ways in, and
-  hands the avatar to the side.
+- `worlds.ts` is the tab's worlds and relations with no document in
+  sight: the local ward for a far pk, the relations in it, and a fresh
+  avatar for the next way in.
+- `door.ts` is the door page, pure: what a stranger sees where nothing
+  lets them in, Quo's page and not the estate's, asking for nothing.
+- `tab.ts` is the shell: the harbor in the tab, the config, the two
+  switchers and the two ways in, and hands one avatar at a time to the
+  side.
+- `web.ts` is the web route the daemon mounts under `/web`: the list of
+  worlds or the door page at the root, a world's page with its config, the
+  bundle built from `tab.ts`, the policy header and the stylesheet. It
+  authenticates nothing and admits nobody; the knock is the tab's. Paths
+  it does not take fall through to the exchange pages.
 
 Proven in `packages/dock/test/human.test.ts` on the memory harbor with a fake
 surface and no browser: the user being carrying a shop with a look, a guest
-at a door that is not a desk let in by a form, and the link read, stripped
-and refused; and in `packages/dock/test/terrain/browser.test.ts` in a real
-Chromium against a daemon on loopback, behind `npm run check:terrain`: the
-guest page, the password way in, a push, a reload, and the policy header.
+at a door that is not a desk let in by a form, the link read, stripped and
+refused, and the worlds and relations on a harbor core over the memory
+store, two invitations into one world being two avatars; and in
+`packages/dock/test/terrain/browser.test.ts` in a real Chromium against a
+daemon on loopback, behind `npm run check:terrain`: the guest page, the
+way in by a link the root minted, a push, a reload, the policy header, a
+link while in as a second relation and the switch back, a link into another
+ward landing on that ward's page, the door page where nobody is at the
+door, and a link at the root.
 
 ## Security, by structure
 
@@ -131,13 +164,14 @@ guest page, the password way in, a push, a reload, and the policy header.
 ## The tab
 
 The tab is a device. The page at `web./<ward>` boots a browser harbor on a
-seed minted into the tab's store the first time, one ward for this world
-with one avatar in it, and dials the world's `quo.` route. Three ways in,
-one act: a link's invitation, joined at once; a guest form on the public
-being's page whose answer is an invitation; and, when the desk is at the
-door, the dock's own way, the owner password to `web./<ward>/login` for a
-nonce, and the desk's `device` form submitted with it under the `tab` proof
-kind. A tab opened with the owner password reaches what she holds, since the
-owner opened it. From then on there is no cookie and no token anywhere, and
-a reload asks nothing: the seed and the standing are in the tab's store.
-Live on the lab at `web.lab.quo.systems/main`.
+seed minted into the tab's store the first time, one local ward for this
+world with an avatar per relation in it, and dials the world's `quo.`
+route. Two ways in, one act, each a fresh avatar: a link's invitation,
+joined at once in the ward it names; and a guest form on the public being's
+page whose answer is an invitation. Nothing is typed to get in, no password
+and no account, the root included: the root mints its own first invitation
+on the box and opens the link. A ward with nobody at its door shows the
+door page, `door.ts`, and a link is the only way. From then on there is no
+cookie and no token anywhere, and a reload asks nothing: the seed and the
+standings are in the tab's store, and the relation last on screen is the
+one shown.

package/human/screen.ts

@@ -23,8 +23,12 @@ export type Surface = {
   onSubmit: ((ask: string, raw: Raw) => void) | undefined;
 };
 
-// `after` runs when a call is done, as it does for the model side: a harbor
-// that must write what the ward changed hooks it. `admit` is what to do
+// `after` runs after every ask the side makes, a submitted form, her
+// describe, her look and the read-only asks run on open alike, as it does
+// for the model side: every ask rotates her keys, and a harbor that must
+// write what the ward changed hooks it. A side that saved only after a form
+// would bring her back from a reload with a stale count, and the far door
+// would refuse her. `admit` is what to do
 // with an answer that is an invitation: a guest at a world's door is let in
 // by it, and a side with no `admit` shows it as any answer.
 export type Options = { after?: () => Promise<void>; notice?: string; admit?: (invitation: Invitation) => Promise<void> };
@@ -60,6 +64,7 @@ export async function screenSide(avatar: Subject, surface: Surface, options: Opt
         }
       }
     }
+    await after();
     show();
   };
 

package/human/tab.ts

@@ -1,58 +1,68 @@
 // SPDX-License-Identifier: Apache-2.0
 // The tab: a page on a world's web. that is a device of its own. The tab
 // boots a browser harbor on a seed minted into IndexedDB the first time,
-// and keeps one ward per world it has joined, each with one avatar, so the
-// tab is a browser of worlds: a switcher between them is a switch of ward
-// and nothing more. It dials the world's quo. route.
+// and is a browser of worlds and of the relations in them, `worlds.ts`: one
+// local ward per far world, one avatar per relation, a switcher over both.
+// A switch is a switch of avatar and nothing more.
 //
-// Three ways in, all the same act, a knock that ends in a standing:
+// Two ways in, the same act, a knock that ends in a standing, and each one
+// a fresh avatar:
 //
 //   a link      the page with the invitation in its fragment, `#quo=...`,
 //               read and stripped before anything else runs, then joined.
+//               The invitation names its ward, so it is joined in that
+//               world's local ward whatever page it was opened on, and a
+//               link opened while already in is one more relation.
 //   a guest     the world's public being, whatever class she is, rendered
 //               as a page by the same screen; a form on it whose answer is
 //               an invitation is the way in.
-//   a password  the dock's own way, when the public being shows `device`:
-//               the owner password goes to the web route for a nonce the
-//               front desk honours under the `tab` proof kind, and the
-//               guest form `device({ proof })` is submitted for the human.
 //
-// From then on there is no cookie and no token anywhere; the seed and the
-// standing are in the tab's store, and a reload asks nothing. The screen
+// Nothing is typed to get in, ever: no password, no account. A ward with
+// nobody at its door shows the door page, `door.ts`, and a link is the only
+// way. From then on there is no cookie and no token anywhere; the seed and
+// the standings are in the tab's store, and a reload asks nothing. The screen
 // is the human side in `screen.ts` over the DOM surface in `dom.ts`. This
-// file is the harbor, the worlds and the ways in, and hands the avatar over.
+// file is the shell: the harbor, the config, the switcher and the ways in,
+// and it hands one avatar at a time to the side.
 import type { Invitation, JsonObject } from '@quo-systems/quo';
 import { BrowserHarbor } from '../harbor/browser.ts';
-import { Avatar, USER } from '../beings/avatar.ts';
-import { parse, strip, isInvitation } from '../beings/link.ts';
+import { USER } from '../beings/avatar.ts';
+import { parse, strip } from '../beings/link.ts';
 import { screenSide } from './screen.ts';
 import { domSurface } from './dom.ts';
 import { guest } from './guest.ts';
-import { escape } from './html.ts';
+import { door } from './door.ts';
+import { world, relations, fresh, type Relation } from './worlds.ts';
 
 // What the page is told by the daemon that served it: the world's routes,
-// this ward's name on that harbor, and its pk.
-export type Config = { quo: string; web: string; ward: string; pk: string };
+// every ward on that harbor by name, its pk and whether a public being is
+// at its door, and which of them this page is, if it is one's.
+export type Config = { quo: string; web: string; wards: Record<string, { pk: string; public: boolean }>; ward?: string };
 
-// The worlds this tab has joined, by pk: where each lives and what it is
-// called, kept beside the harbor so the switcher can list them. A world on
-// another origin is another page, and the switcher links to it.
+// What the tab remembers between pages, beside the harbor: the worlds it
+// has joined, by pk, where each lives and what it is called; which relation
+// is on screen in each; and what each relation is called. A tab with no
+// storage still works, and forgets.
 type Worlds = Record<string, { url: string; name: string }>;
-const WORLDS = 'quo-worlds';
-const worlds = (): Worlds => {
+const kept = <T>(key: string, fallback: T): T => {
   try {
-    return JSON.parse(localStorage.getItem(WORLDS) ?? '{}') as Worlds;
+    return (JSON.parse(localStorage.getItem(key) ?? 'null') as T | null) ?? fallback;
   } catch {
-    return {};
+    return fallback;
   }
 };
-const remember = (pk: string, url: string, name: string) => {
+const keep = (key: string, value: unknown) => {
   try {
-    localStorage.setItem(WORLDS, JSON.stringify({ ...worlds(), [pk]: { url, name } }));
+    localStorage.setItem(key, JSON.stringify(value));
   } catch {
-    /* a tab with no storage still works, and forgets */
+    /* forgets */
   }
 };
+const WORLDS = 'quo-worlds';
+const worlds = (): Worlds => kept(WORLDS, {});
+const remember = (pk: string, url: string, name: string) => keep(WORLDS, { ...worlds(), [pk]: { url, name } });
+const AT = (pk: string) => `quo-at:${pk}`;
+const NAMES = (pk: string) => `quo-names:${pk}`;
 
 const el = <K extends keyof HTMLElementTagNameMap>(tag: K, text = '', attrs: Record<string, string> = {}): HTMLElementTagNameMap[K] => {
   const e = document.createElement(tag);
@@ -68,114 +78,142 @@ export async function start(cfg: Config, root: HTMLElement = document.body): Pro
   if (linked) history.replaceState(null, '', location.pathname + location.search + strip(location.hash));
 
   const nav = el('nav', '', { class: 'worlds' });
+  const who = el('nav', '', { class: 'relations' });
   const status = el('p', 'booting');
   const screen = el('div');
-  root.append(nav, status, screen);
+  root.append(nav, who, status, screen);
   const say = (s: string) => (status.textContent = s);
 
   // The harbor in the tab: one database per origin, one ward per world.
   const harbor = new BrowserHarbor('quo');
   await harbor.boot();
-  const name = `w-${cfg.pk.slice(0, 16)}`;
-  const ward = harbor.wards.get(name) ?? (await harbor.create(name, 'me'));
-  if (!ward.being('me')) await ward.ask('boot', { key: 'me', class: 'Avatar' });
-  const me = ward.being('me') as Avatar;
   harbor.dial(cfg.quo);
 
+  // The world this page is about: the link's, since an invitation names
+  // its ward, or the page's own. A link for a world not on this harbor is
+  // a link to the wrong page, and says so.
+  const nameOf = (pk: string) => Object.keys(cfg.wards).find((n) => cfg.wards[n]!.pk === pk);
+  const pk = linked?.ward ?? (cfg.ward ? cfg.wards[cfg.ward]?.pk : undefined);
+  const wardName = pk ? nameOf(pk) : undefined;
+  const pageOf = (name: string) => `${new URL(cfg.web).pathname.replace(/\/$/, '')}/${encodeURIComponent(name)}`;
+
   const switcher = () => {
     nav.replaceChildren();
     const known = worlds();
-    for (const [pk, w] of Object.entries(known)) {
-      const a = el('a', w.name || pk.slice(0, 8), { href: w.url });
-      if (pk === cfg.pk) a.setAttribute('aria-current', 'page');
+    for (const [k, w] of Object.entries(known)) {
+      const a = el('a', w.name || k.slice(0, 8), { href: w.url });
+      if (k === pk) a.setAttribute('aria-current', 'page');
       nav.append(a);
     }
-    const here = worlds()[cfg.pk];
-    if (!here) nav.append(el('span', `${cfg.ward} at ${new URL(cfg.web).host}`));
+    if (pk && !known[pk] && wardName) nav.append(el('span', `${wardName} at ${new URL(cfg.web).host}`));
   };
   switcher();
 
-  // Joined: her page. Every call rotates her keys and a same-ward ask never
-  // crosses the harbor, so the side saves after each one.
-  const inside = async (notice: string) => {
+  if (!pk || !wardName) {
+    say(linked ? 'this link is for a world that does not live here' : 'choose a world');
+    return;
+  }
+  if (linked && location.pathname !== pageOf(wardName)) history.replaceState(null, '', pageOf(wardName) + location.search + location.hash);
+  const ward = await world(harbor, pk);
+  const at = { name: wardName, pk, public: cfg.wards[wardName]!.public };
+
+  // The relations in this world, and which one is on screen.
+  let side: { close(): Promise<void> } | null = null;
+  let current: Relation | null = null;
+  const names = () => kept<Record<string, string>>(NAMES(pk), {});
+  const people = () => {
+    who.replaceChildren();
+    const rels = relations(ward);
+    const called = names();
+    for (const r of rels) {
+      const b = el('button', called[r.key] ?? r.key, { type: 'button' });
+      if (r.key === current?.key) b.setAttribute('aria-current', 'true');
+      b.onclick = () => void inside(r, `in, as ${called[r.key] ?? r.key}`, called[r.key] ?? r.key);
+      who.append(b);
+    }
+    if (rels.length) {
+      const more = el('button', 'another way in', { type: 'button', class: 'another' });
+      more.onclick = () => void atDoor();
+      who.append(more);
+    }
+  };
+
+  // In, as one relation: her page. Every call rotates her keys and a
+  // same-ward ask never crosses the harbor, so the side saves after each.
+  const inside = async (rel: Relation, notice: string, called: string) => {
+    await side?.close();
     status.remove();
+    root.querySelector('form.password')?.remove();
     screen.replaceChildren();
-    const side = await screenSide(me, domSurface(screen), { after: () => ward.save(), notice });
-    remember(cfg.pk, location.origin + location.pathname, side.model.look.name || (typeof (side.model.blueprint?.notes as JsonObject | null)?.name === 'string' ? ((side.model.blueprint!.notes as JsonObject).name as string) : cfg.ward));
+    current = rel;
+    keep(AT(pk), rel.key);
+    const s = await screenSide(rel.avatar, domSurface(screen), { after: () => ward.save(), notice });
+    side = s;
+    const bp = s.model.blueprint;
+    const notesName = typeof (bp?.notes as JsonObject | null)?.name === 'string' ? ((bp!.notes as JsonObject).name as string) : '';
+    remember(pk, location.origin + pageOf(at.name), s.model.look.name || notesName || at.name);
+    if (!names()[rel.key]) keep(NAMES(pk), { ...names(), [rel.key]: called });
     switcher();
+    people();
   };
 
-  // The way in, from any of the three: join, save, and be inside.
-  const admit = async (inv: Invitation, notice: string) => {
+  // The way in, from any of the three: a fresh avatar joins, the ward is
+  // saved, and she is the one on screen.
+  const admit = async (inv: Invitation, notice: string, called: string) => {
     say('knocking');
-    const got = await me.join(inv);
+    const rel = await fresh(ward);
+    const got = await rel.avatar.join(inv);
     await ward.save(); // the knock went through her own door, which the harbor never sees
     if (!('asks' in got)) {
       say(`not in: ${got.error}`);
+      return false;
+    }
+    await inside(rel, notice, called);
+    return true;
+  };
+
+  // At the door. With a public being there, her describe as a page, and a
+  // form whose answer is an invitation lets the guest in. With nobody
+  // there, the door page: a link is the only way in, and nothing to type.
+  const atDoor = async () => {
+    await side?.close();
+    side = null;
+    current = null;
+    screen.replaceChildren();
+    if (!status.isConnected) root.insertBefore(status, screen);
+    people();
+    if (!at.public) {
+      status.remove();
+      screen.innerHTML = door({ world: at.name, host: new URL(cfg.web).host });
       return;
     }
-    await inside(notice);
+    say(`at the door of ${at.name}`);
+    const rel = await fresh(ward);
+    const gate = guest(rel.avatar, pk);
+    const s = await screenSide(gate, domSurface(screen), {
+      after: () => ward.save(),
+      notice: `a guest at ${at.name}: what she shows strangers`,
+      admit: async (inv) => {
+        await s.close();
+        await admit(inv, `in, as a guest of ${at.name}`, 'guest');
+      },
+    });
+    side = s;
   };
 
-  // Already in: reconnect, nothing minted.
-  if (me.standings[USER]) {
-    const had = await me.tools();
-    if ('asks' in had) return inside('in, as before');
+  // A link: one more relation, whoever else is in. Then whoever was on
+  // screen last, or the door.
+  if (linked && (await admit(linked, 'in, by the link', 'link'))) return;
+  const rels = relations(ward);
+  const last = kept<string | null>(AT(pk), null);
+  const back = rels.find((r) => r.key === last) ?? rels[rels.length - 1];
+  if (back) {
+    const had = await back.avatar.tools();
+    await ward.save(); // her keys rotated on that ask, whatever it answered
+    if ('asks' in had) return inside(back, linked ? `not in by the link; in, as before` : 'in, as before', names()[back.key] ?? back.key);
     say(`not in (${had.error})`);
   }
-  if (linked) return admit(linked, 'in, by the link');
-
-  // A guest: the public being's describe as a page; a form whose answer is
-  // an invitation lets the guest in.
-  say(`at the door of ${cfg.ward}`);
-  const door = guest(me, cfg.pk);
-  const side = await screenSide(door, domSurface(screen), {
-    after: () => ward.save(),
-    notice: `a guest at ${cfg.ward}: what she shows strangers`,
-    admit: async (inv) => {
-      await side.close();
-      await admit(inv, `in, as a guest of ${cfg.ward}`);
-    },
-  });
-
-  // The dock's own way in, when the desk is at the door: the owner password
-  // for a nonce, and the desk's `device` form submitted with it.
-  if (side.model.blueprint?.asks.some((a) => a.name === 'device')) {
-    const form = el('form', '', { class: 'password' });
-    const identity = el('input', '', { name: 'identity', value: 'tab', placeholder: 'identity' });
-    const password = el('input', '', { name: 'password', type: 'password', placeholder: 'owner password' });
-    const go = el('button', 'enter as the owner');
-    form.append(identity, password, go);
-    root.insertBefore(form, screen);
-    form.onsubmit = (ev) => {
-      ev.preventDefault();
-      void (async () => {
-        say('asking the world');
-        let res: Response;
-        try {
-          res = await fetch(`${cfg.web}/${encodeURIComponent(cfg.ward)}/login`, { method: 'POST', headers: { 'content-type': 'application/json' }, body: JSON.stringify({ password: password.value, identity: identity.value }) });
-        } catch (e) {
-          say(`the world did not answer: ${(e as Error).message}`);
-          return;
-        }
-        password.value = '';
-        if (!res.ok) {
-          say(`refused: ${((await res.json().catch(() => ({ error: res.status }))) as { error?: string }).error ?? res.status}`);
-          return;
-        }
-        const { nonce } = (await res.json()) as { nonce: string };
-        const inv = await door.call('device', { proof: { kind: 'tab', nonce } });
-        await ward.save();
-        if (!isInvitation(inv)) {
-          say(`not in: ${escape(JSON.stringify(inv))}`);
-          return;
-        }
-        form.remove();
-        await side.close();
-        await admit(inv, `in, as ${identity.value}`);
-      })();
-    };
-  }
+  await atDoor();
 }
 
 // The page hands the config in a JSON script, which a content security