@quo-systems/dock 0.2.6 → 0.2.8

package/README.md

@@ -19,7 +19,7 @@ its Caddyfile, and a package file that depends on the dock and nothing
 else. Add your beings to `droplet/classes/`, and your placement to the
 routes and agents files.
 
-`beings/quo-dock.md` is the truth of this package and the trunk of its four
+`beings/quo-dock.md` is the truth of this package and the trunk of its five
 documents; read it first. It knows nothing the spec of Quo does not say,
 and adds no word to harbor, ward or being.
 

package/api/quo-api.md

@@ -0,0 +1,74 @@
+# The api route
+
+This is the fourth rendering of one describe. The screen speaks a being's
+describe as forms, the model side speaks it as tools, the CLI speaks it as
+lines, and this route speaks it as plain HTTP and JSON to anyone at all. It
+is one route of the daemon described in `packages/dock/beings/quo-dock.md`,
+which owns the routes, the askers and the shared invariants; this document
+assumes all of that and adds only what the route does.
+
+## What it is for
+
+Everything a device hears is one of three askers, mapped once, at the
+edge, and the route is that edge for what arrives as HTTP. An anonymous
+request that is safe to repeat, a page rendering server side, a crawler, a
+tab on another origin, is an ask at a ward's public being as `{}`, which
+is what every stranger is at every door. The route judges nothing and
+names nobody: the public being answers as she answers any stranger, by her
+own gate, and her obligation that the answer be safe to repeat is the same
+here as at her sealed door. Nothing is admitted on this side and no
+occupant is made here.
+
+A world is a ward, so the route names one. `main` holds the desk, who is
+public for the first hello and answers a stranger nothing else, so a
+world's public reads live in a ward of their own, and the route is what
+makes a second ward reachable by name from outside: the corpus of a court
+watcher, a catalogue, a board.
+
+## The mapping
+
+`packages/dock/api/route.ts` is the route the daemon mounts under `/api`,
+and the proxy maps it from the api. hostname.
+
+| request                            | Quo                                                          |
+| ---------------------------------- | ------------------------------------------------------------ |
+| `GET /api/<ward>`                  | the empty ask at the public being as `{}`: her describe      |
+| `GET /api/<ward>/<ask>?k=v`        | that ask as `{}`, the query as args, every value a string    |
+| `POST /api/<ward>/<ask>` JSON body | that ask as `{}`, the object as args                         |
+| `OPTIONS`                          | the preflight, any origin                                    |
+
+What she says crosses as the model side crosses it:
+
+| she answered                   | the client gets                                        |
+| ------------------------------ | ------------------------------------------------------ |
+| an object                      | 200 with that JSON                                     |
+| `{ error }`                    | 400 with that JSON                                     |
+| silence, a throw, a wait spent | 503 `{ error: 'silence' }`: the work may have happened |
+| an ask not hers for a stranger | 400 `{ error: 'unknown ask' }`, her own answer         |
+
+And what the route says on its own: 404 for a ward not here, for a ward
+with nobody at the door and for a path that is not one of the three
+shapes, 400 for a body that is not a JSON object, 413 for a body past a
+megabyte, 405 for any other method. Every answer is JSON and open to any
+origin: the route carries nothing a stranger can use that she did not
+choose to say.
+
+The ask is bounded to the ward's default allowance, thirty seconds, and a
+wait past it is silence, as a sealed ask of hers would be. The ward is saved
+after every ask, as the daemon saves after any ask it drives in process:
+a public being may write while answering, a tally, a board, and what she
+wrote is hers to keep.
+
+## What is not here
+
+A delivery that must be named and once-only, a vendor's webhook, is not a
+stranger's ask and does not land as `{}`: it is a sealed ask from a
+standing the root minted for that source, its keys the route's own on the
+device, the way `oauth.json` is the mcp route's. That half stands when its
+first user does.
+
+## The proof
+
+`packages/dock/test/api.test.ts`, over a real daemon on loopback: a world
+with a public board described and asked by anyone, args by query and by
+body, what she wrote kept across a reboot, and every refusal.

package/api/route.ts

@@ -0,0 +1,87 @@
+// SPDX-License-Identifier: Apache-2.0
+// The api. route: HTTP as the fourth rendering of one describe, served by
+// the daemon under `/api` and mapped by the proxy from the api. hostname.
+// Beside forms, tools and the CLI, it speaks a public being's describe and
+// asks as plain JSON to anyone at all, and it is the one place a device
+// maps an anonymous source, a browser fetch, a crawler, a page rendering
+// server side, onto the asker every stranger is: `{}` at the named ward's
+// public being. A world is a ward, so `/api/<ward>` is her describe for
+// nobody and `/api/<ward>/<ask>` is one ask, args from the query on a GET
+// or a JSON object on a POST. The route judges nothing and names nobody:
+// the public being's answer must be safe to repeat, which is her
+// obligation at every door, and what she writes while answering is saved
+// as the daemon saves after any ask it drives in process.
+//
+// What she says crosses as the model side crosses it: an object is 200
+// with that JSON, an error object she answered is 400 with that JSON, and
+// silence, a throw, a wait that ran out, is 503 `{ error: 'silence' }`,
+// which is the ward's own answer for a throw at a public being. A world
+// that is not here or has nobody at the door is 404.
+import type { Handler } from '../cli/http.ts';
+import { readAll } from '../cli/http.ts';
+import type { DiskHarbor, Hosted } from '../harbor/disk.ts';
+import { isSilence, isWord, type BeingLike, type JsonObject } from '@quo-systems/quo';
+
+// The ward's own default allowance for an ask, which is what a sealed ask
+// of hers would have carried: a wait past it is silence.
+export const ALLOWANCE = 30_000;
+
+const open = { 'access-control-allow-origin': '*', 'access-control-allow-methods': 'GET, POST, OPTIONS', 'access-control-allow-headers': 'content-type' };
+
+export function apiRoute(harbor: DiskHarbor): Handler {
+  const publicOf = (h: Hosted): BeingLike | undefined => {
+    const key = (h.partition as { public?: string | null }).public ?? null;
+    return key === null ? undefined : h.being(key);
+  };
+  return async (req, res, rest) => {
+    const json = (status: number, body: unknown) => {
+      res.writeHead(status, { 'content-type': 'application/json', ...open });
+      res.end(JSON.stringify(body));
+    };
+    if (req.method === 'OPTIONS') {
+      res.writeHead(204, open);
+      return void res.end();
+    }
+    const [, ward = '', ask = '', ...more] = rest.split('/');
+    if (req.method !== 'GET' && req.method !== 'POST') return json(405, { error: 'GET or POST' });
+    if (!/^[\w.-]+$/.test(ward) || more.length > 0 || (ask !== '' && !/^[\w-]+$/.test(ask))) return json(404, { error: 'GET /api/<ward> for the describe, GET or POST /api/<ward>/<ask> for one ask' });
+    const hosted = harbor.wards.get(ward);
+    if (!hosted) return json(404, { error: 'no such world' });
+    const being = publicOf(hosted);
+    if (!being) return json(404, { error: 'nobody is home' });
+    let args: JsonObject;
+    if (req.method === 'POST') {
+      const raw = await readAll(req as AsyncIterable<Buffer>);
+      if (raw === undefined) return json(413, { error: 'too much' });
+      let parsed: unknown = {};
+      try {
+        parsed = raw.length === 0 ? {} : JSON.parse(raw.toString('utf8'));
+      } catch {
+        return json(400, { error: 'the body is a JSON object' });
+      }
+      if (parsed === null || typeof parsed !== 'object' || Array.isArray(parsed)) return json(400, { error: 'the body is a JSON object' });
+      args = parsed as JsonObject;
+    } else {
+      const url = new URL(req.url ?? '/', 'http://localhost');
+      args = Object.fromEntries(url.searchParams.entries());
+    }
+    // Asked as `{}`, bounded as her door would bound it, and every throw or
+    // word is what the door says of one: silence.
+    let timer: ReturnType<typeof setTimeout> | undefined;
+    const late = new Promise<typeof silent>((ok) => (timer = setTimeout(() => ok(silent), ALLOWANCE)));
+    let out: unknown;
+    try {
+      out = await Promise.race([Promise.resolve(ask === '' ? being.answer({}) : being.answer({}, ask, args)), late]);
+    } catch {
+      out = silent;
+    } finally {
+      clearTimeout(timer);
+      await hosted.save();
+    }
+    if (out === silent || isSilence(out) || isWord(out) || out === null || typeof out !== 'object') return json(503, { error: 'silence' });
+    if (typeof (out as { error?: unknown }).error === 'string') return json(400, out);
+    return json(200, out);
+  };
+}
+
+const silent = Symbol('silence');

package/beings/quo-dock.md

@@ -2,7 +2,7 @@
 
 This is the trunk of the dock: what every estate on Quo needs and nobody writes
 twice. `packages/quo/SPEC.md` is the truth of `packages/quo/src` and knows
-nothing of this folder; the four documents under `packages/dock/` are the truth
+nothing of this folder; the five documents under `packages/dock/` are the truth
 of their folders in the same way, and where any of them disagrees with
 `packages/quo/SPEC.md`, the spec wins and the document is rewritten. Nothing
 here adds a word to harbor, ward or being.
@@ -34,13 +34,14 @@ avatar, the harbors on real terrains, the model sides and the screen, the
 credential exchange. It is general by two rules, under "Generality", and it
 is published so an adopter installs it once and writes only their estate.
 
-The four documents of the dock:
+The five documents of the dock:
 
 | document               | owns                                             |
 | ---------------------- | ------------------------------------------------ |
 | `beings/quo-dock.md`   | this: the beings and rules every side shares     |
 | `human/quo-human.md`   | the human side: a blueprint spoken as HTML       |
 | `mcp/quo-mcp.md`       | the model side: a blueprint spoken as tools      |
+| `api/quo-api.md`       | the api route: a public being spoken as HTTP     |
 | `harbor/quo-harbor.md` | transports: harbor core, reach, store, directory |
 
 Each names only its folder. The human document never says WebSocket or
@@ -83,7 +84,7 @@ Three roles exist, and they are held by where a thing runs, not by config:
 | role      | what it can do                              | who can hold it                                     |
 | --------- | ------------------------------------------- | --------------------------------------------------- |
 | occupant  | ask a being what her gate shows this asker  | anyone, local or remote                             |
-| owner     | boot a being, invite for her, knock for her | the root, on the device; or a ward the root invited |
+| owner     | reach into a being; boot is every being's   | the root, on the device; or a ward the root invited |
 | developer | write a being class the harbor will hold    | only a process on the device                        |
 
 Whoever holds all three keeps them apart: the owner creates and places, and
@@ -124,7 +125,7 @@ that every arrival is named and judged.
   second optional ask, `page`, answers her page as a tree of values in the
   screen's closed grammar; only a screen reads it.
 - **Route.** A hostname a reverse proxy sends to one process: `web.`, `quo.`,
-  `mcp.`. Routes are deployment, never boundaries.
+  `mcp.`, `api.`. Routes are deployment, never boundaries.
 
 ## The ids
 
@@ -159,7 +160,7 @@ she keeps the last one. A name is a word, held to the same shape as a key.
 
 ## Architecture
 
-One droplet, one harbor, three routes. Every other placement is a subset.
+One droplet, one harbor, four routes. Every other placement is a subset.
 
 ```
 acme.com, or razvan.com: the dialable part of an estate
@@ -167,6 +168,7 @@ acme.com, or razvan.com: the dialable part of an estate
     web.   one page per world, /<ward>, the credential exchange, ends with an invitation
     quo.   the harbor's socket door: the rendezvous for every dialer
     mcp.   the model side over HTTP, a credential exchange in front
+    api.   a world's public being as plain JSON, asked by anyone as {}
   quo serve: one process, one harbor, the ask pointer
     unix socket     owner asks, local only, never behind the proxy
     localhost ports the routes above
@@ -426,8 +428,8 @@ and nothing else, holds no class body, and never speaks to a ward except
 through the ask pointer or an avatar, the two doors everyone has. The
 daemon's folder holds the process and its doors, the two sockets and the
 HTTP listener; each route on that listener lives in the folder whose truth
-it is, `human/web.ts`, `mcp/route.ts`, `harbor/quo.ts`, and the daemon only
-mounts them.
+it is, `human/web.ts`, `mcp/route.ts`, `harbor/quo.ts`, `api/route.ts`, and
+the daemon only mounts them.
 
 ```
 quo init [--dir D]        mint a seed, boot a harbor and one ward over a disk store, write both

package/cli/daemon.ts

@@ -41,7 +41,8 @@
 // path, and each lives in the folder whose truth it is: `/web`, the worlds'
 // pages and the exchange, in `human/web.ts` and `mcp/web/`; `/mcp`, the
 // model side behind its credential exchange, in `mcp/route.ts`; `/quo`, the
-// socket door, in `harbor/quo.ts`. It listens only when asked, and only on
+// socket door, in `harbor/quo.ts`; `/api`, a public being's describe and
+// asks as plain JSON for anyone, in `api/route.ts`. It listens only when asked, and only on
 // loopback: the proxy is what faces the world, and the daemon never does.
 // With `--dial URL`, or `<dir>/dial.json`, this daemon is itself a dialer:
 // it holds one socket to each URL, announces its wards, and reconnects with
@@ -69,6 +70,7 @@ import { McpHttp } from '../mcp/http.ts';
 import { mcpRoute, type Routes } from '../mcp/route.ts';
 import { webRoute } from '../human/web.ts';
 import { quoRoute } from '../harbor/quo.ts';
+import { apiRoute } from '../api/route.ts';
 import { listenHttp, type Http, type Quo } from './http.ts';
 
 export type { Handler, Http, Quo } from './http.ts';
@@ -201,6 +203,7 @@ export async function serve(dir: string, options: Options = {}): Promise<Serving
       servers.push(server);
       http = door;
       http.mount('/quo', quoRoute(harbor, server as HttpServer, quo));
+      http.mount('/api', apiRoute(harbor)); // anyone's: a public being asked as {}
       const routes = options.routes ?? (await readRoutes(harbor.dir));
       const here = `http://${http.host}:${http.port}`;
       // the worlds' pages: always, on the daemon's own door when no route names a public one
@@ -383,7 +386,7 @@ async function handle(harbor: DiskHarbor, line: string): Promise<string> {
   }
 }
 
-// `<dir>/routes.json`: { mcp, web, quo? }, the public origins the proxy serves.
+// `<dir>/routes.json`: { mcp, web, quo?, api? }, the public origins the proxy serves.
 export async function readRoutes(dir: string): Promise<Routes | null> {
   const p = join(dir, 'routes.json');
   if (!existsSync(p)) return null;
@@ -391,6 +394,7 @@ export async function readRoutes(dir: string): Promise<Routes | null> {
   if (typeof r.mcp !== 'string' || typeof r.web !== 'string') return null;
   const out: Routes = { mcp: r.mcp.replace(/\/$/, ''), web: r.web.replace(/\/$/, '') };
   if (typeof r.quo === 'string') out.quo = r.quo.replace(/\/$/, '');
+  if (typeof r.api === 'string') out.api = r.api.replace(/\/$/, '');
   return out;
 }
 

package/dist/api/route.d.ts

@@ -0,0 +1,4 @@
+import type { Handler } from '../cli/http.ts';
+import type { DiskHarbor } from '../harbor/disk.ts';
+export declare const ALLOWANCE = 30000;
+export declare function apiRoute(harbor: DiskHarbor): Handler;

package/dist/api/route.js

@@ -0,0 +1,74 @@
+import { readAll } from '../cli/http.js';
+import { isSilence, isWord } from '@quo-systems/quo';
+// The ward's own default allowance for an ask, which is what a sealed ask
+// of hers would have carried: a wait past it is silence.
+export const ALLOWANCE = 30_000;
+const open = { 'access-control-allow-origin': '*', 'access-control-allow-methods': 'GET, POST, OPTIONS', 'access-control-allow-headers': 'content-type' };
+export function apiRoute(harbor) {
+    const publicOf = (h) => {
+        const key = h.partition.public ?? null;
+        return key === null ? undefined : h.being(key);
+    };
+    return async (req, res, rest) => {
+        const json = (status, body) => {
+            res.writeHead(status, { 'content-type': 'application/json', ...open });
+            res.end(JSON.stringify(body));
+        };
+        if (req.method === 'OPTIONS') {
+            res.writeHead(204, open);
+            return void res.end();
+        }
+        const [, ward = '', ask = '', ...more] = rest.split('/');
+        if (req.method !== 'GET' && req.method !== 'POST')
+            return json(405, { error: 'GET or POST' });
+        if (!/^[\w.-]+$/.test(ward) || more.length > 0 || (ask !== '' && !/^[\w-]+$/.test(ask)))
+            return json(404, { error: 'GET /api/<ward> for the describe, GET or POST /api/<ward>/<ask> for one ask' });
+        const hosted = harbor.wards.get(ward);
+        if (!hosted)
+            return json(404, { error: 'no such world' });
+        const being = publicOf(hosted);
+        if (!being)
+            return json(404, { error: 'nobody is home' });
+        let args;
+        if (req.method === 'POST') {
+            const raw = await readAll(req);
+            if (raw === undefined)
+                return json(413, { error: 'too much' });
+            let parsed = {};
+            try {
+                parsed = raw.length === 0 ? {} : JSON.parse(raw.toString('utf8'));
+            }
+            catch {
+                return json(400, { error: 'the body is a JSON object' });
+            }
+            if (parsed === null || typeof parsed !== 'object' || Array.isArray(parsed))
+                return json(400, { error: 'the body is a JSON object' });
+            args = parsed;
+        }
+        else {
+            const url = new URL(req.url ?? '/', 'http://localhost');
+            args = Object.fromEntries(url.searchParams.entries());
+        }
+        // Asked as `{}`, bounded as her door would bound it, and every throw or
+        // word is what the door says of one: silence.
+        let timer;
+        const late = new Promise((ok) => (timer = setTimeout(() => ok(silent), ALLOWANCE)));
+        let out;
+        try {
+            out = await Promise.race([Promise.resolve(ask === '' ? being.answer({}) : being.answer({}, ask, args)), late]);
+        }
+        catch {
+            out = silent;
+        }
+        finally {
+            clearTimeout(timer);
+            await hosted.save();
+        }
+        if (out === silent || isSilence(out) || isWord(out) || out === null || typeof out !== 'object')
+            return json(503, { error: 'silence' });
+        if (typeof out.error === 'string')
+            return json(400, out);
+        return json(200, out);
+    };
+}
+const silent = Symbol('silence');

package/dist/cli/daemon.js

@@ -41,7 +41,8 @@
 // path, and each lives in the folder whose truth it is: `/web`, the worlds'
 // pages and the exchange, in `human/web.ts` and `mcp/web/`; `/mcp`, the
 // model side behind its credential exchange, in `mcp/route.ts`; `/quo`, the
-// socket door, in `harbor/quo.ts`. It listens only when asked, and only on
+// socket door, in `harbor/quo.ts`; `/api`, a public being's describe and
+// asks as plain JSON for anyone, in `api/route.ts`. It listens only when asked, and only on
 // loopback: the proxy is what faces the world, and the daemon never does.
 // With `--dial URL`, or `<dir>/dial.json`, this daemon is itself a dialer:
 // it holds one socket to each URL, announces its wards, and reconnects with
@@ -65,6 +66,7 @@ import { McpHttp } from '../mcp/http.js';
 import { mcpRoute } from '../mcp/route.js';
 import { webRoute } from '../human/web.js';
 import { quoRoute } from '../harbor/quo.js';
+import { apiRoute } from '../api/route.js';
 import { listenHttp } from './http.js';
 // The sockets live in the harbor's folder, where the folder's own permissions
 // guard them. A unix socket path is short by law, about a hundred bytes on
@@ -187,6 +189,7 @@ export async function serve(dir, options = {}) {
             servers.push(server);
             http = door;
             http.mount('/quo', quoRoute(harbor, server, quo));
+            http.mount('/api', apiRoute(harbor)); // anyone's: a public being asked as {}
             const routes = options.routes ?? (await readRoutes(harbor.dir));
             const here = `http://${http.host}:${http.port}`;
             // the worlds' pages: always, on the daemon's own door when no route names a public one
@@ -384,7 +387,7 @@ async function handle(harbor, line) {
         return JSON.stringify({ id, error: e instanceof Error ? e.message : String(e) });
     }
 }
-// `<dir>/routes.json`: { mcp, web, quo? }, the public origins the proxy serves.
+// `<dir>/routes.json`: { mcp, web, quo?, api? }, the public origins the proxy serves.
 export async function readRoutes(dir) {
     const p = join(dir, 'routes.json');
     if (!existsSync(p))
@@ -395,6 +398,8 @@ export async function readRoutes(dir) {
     const out = { mcp: r.mcp.replace(/\/$/, ''), web: r.web.replace(/\/$/, '') };
     if (typeof r.quo === 'string')
         out.quo = r.quo.replace(/\/$/, '');
+    if (typeof r.api === 'string')
+        out.api = r.api.replace(/\/$/, '');
     return out;
 }
 // `<dir>/dial.json`: [url, ...], the quo. routes this daemon holds a socket to.

package/dist/harbor/capacitor.d.ts

@@ -1,7 +1,9 @@
+import { Directory } from '@capacitor/filesystem';
 import type { BeingClass } from '@quo-systems/quo';
 import type { Kept, Store, WardRecord } from '@quo-systems/quo/harbor';
 import { BrowserHarbor } from './browser.ts';
 export declare function nativeHarbor(name?: string, classes?: Record<string, BeingClass>): Promise<BrowserHarbor>;
+export declare const directory: Directory;
 export declare class Native implements Store {
     #private;
     readonly harbor: string;

package/dist/harbor/capacitor.js

@@ -36,7 +36,7 @@ export async function nativeHarbor(name = 'quo', classes = {}) {
 const { hex, unhex } = arithmetic;
 // Where the files live: the folder iCloud does not copy on iOS, the app's
 // own files on Android, whose manifest says no backup.
-const directory = Capacitor.getPlatform() === 'ios' ? Directory.LibraryNoCloud : Directory.Data;
+export const directory = Capacitor.getPlatform() === 'ios' ? Directory.LibraryNoCloud : Directory.Data;
 async function exists(path) {
     try {
         await Filesystem.stat({ path, directory });

package/dist/harbor/disk.js

@@ -45,6 +45,10 @@ function hook() {
         return;
     hooked = true;
     const self = import.meta.url;
+    // bundled into one script, as the desk's sidecar is, the dock has no URL and no folder of
+    // packages beside it to resolve to: a class file there imports nothing bare
+    if (!self)
+        return;
     register(new URL(self.endsWith('.ts') ? './resolve.ts' : './resolve.js', self), { parentURL: self, data: { parent: self } });
 }
 // The class source is a module. Every export that is a class is a class the

package/dist/human/html.d.ts

@@ -29,6 +29,8 @@ export type Model = {
     look: Look;
     tree: Node | null;
     pages: Record<string, Node | null>;
+    focus?: string;
+    at?: string;
     notice: string;
     answers: Record<string, Word>;
     pushes: JsonObject[];

package/dist/human/html.js

@@ -192,6 +192,8 @@ export function page(m) {
         const l = look(kept);
         const prefix = `${id}-`;
         const tree = m.pages[id];
+        // where her own page is, when the world's page is known and this is not it already
+        const own = m.at !== undefined && m.focus !== id ? `<a class="open" href="${escape(`${m.at}/${encodeURIComponent(id)}`)}">open</a>` : '';
         if (tree) {
             const hers = {
                 form: (name) => {
@@ -202,11 +204,11 @@ export function page(m) {
                 standing: () => '',
                 standings: () => '',
             };
-            return `<section class="standing" data-standing="${escape(id)}"${l.style}><div class="page">${paint(tree, hers)}</div></section>`;
+            return `<section class="standing" data-standing="${escape(id)}"${l.style}><div class="page">${paint(tree, hers)}</div>${own}</section>`;
         }
         const want = (kept.order ?? []).map((n) => prefix + n);
         const inOrder = ordered(asks, { order: want });
-        return `<section class="standing" data-standing="${escape(id)}"${l.style}>${l.head || `<h2>${escape(id)}</h2>`}${inOrder.map(one(kept, prefix)).join('')}</section>`;
+        return `<section class="standing" data-standing="${escape(id)}"${l.style}>${l.head || `<h2>${escape(id)}</h2>`}${inOrder.map(one(kept, prefix)).join('')}${own}</section>`;
     };
     const far = Object.keys(groups).map(section).join('');
     // Her page, when she answered one: painted from her tree, each name it
@@ -220,13 +222,17 @@ export function page(m) {
         standing: section,
         standings: () => far,
     };
-    const own = bp ? ordered(bp.asks.filter((a) => !taken.has(a.name) && !pres.has(a.name)), m.look).map(one(m.look)).join('') : '';
-    const asks = m.tree ? `<div class="page">${paint(m.tree, painter)}</div>` : own + far;
+    const mineAsks = bp ? ordered(bp.asks.filter((a) => !taken.has(a.name) && !pres.has(a.name)), m.look).map(one(m.look)).join('') : '';
+    // A being's page: one standing she carries as the whole page, and nothing of hers around it. A key her
+    // describe does not carry paints as nothing, the way a name on a page does: the address adds no right.
+    const focused = m.focus !== undefined;
+    const asks = focused ? section(m.focus) : m.tree ? `<div class="page">${paint(m.tree, painter)}</div>` : mineAsks + far;
     const shown = bp && bp.notes !== null && typeof bp.notes === 'object' && !Array.isArray(bp.notes) ? Object.fromEntries(Object.entries(bp.notes).filter(([k]) => k !== 'standings' && k !== 'name')) : bp?.notes;
     const notes = bp && shown !== null && shown !== undefined && !(typeof shown === 'object' && !Array.isArray(shown) && !Object.keys(shown).length) ? `<aside class="notes">${view(shown)}</aside>` : '';
     const pushes = m.pushes.length ? `<section class="pushes"><h2>pushes</h2><ol>${m.pushes.map((p) => `<li>${view(p)}</li>`).join('')}</ol></section>` : '';
     const mine = look(m.look);
     // a page carries its own title, so the header keeps only the notice; a being painted as forms is headed by her name
-    const head = m.tree ? '' : `${m.look.logo ? `<img class="logo" alt="" src="${m.look.logo}">` : ''}<h1>${escape(title(bp, m.look))}</h1>`;
-    return `<header${mine.style}>${head}<p class="notice">${escape(m.notice)}</p></header>${notes}<main${mine.style}>${asks}</main>${pushes}`;
+    const back = focused && m.at !== undefined ? `<a class="back" href="${escape(m.at)}">${escape(title(bp, m.look))}</a>` : '';
+    const head = focused ? back : m.tree ? '' : `${m.look.logo ? `<img class="logo" alt="" src="${m.look.logo}">` : ''}<h1>${escape(title(bp, m.look))}</h1>`;
+    return `<header${mine.style}>${head}<p class="notice">${escape(m.notice)}</p></header>${focused ? '' : notes}<main${focused ? ' class="focus"' : ''}${mine.style}>${asks}</main>${pushes}`;
 }

package/dist/human/screen.d.ts

@@ -9,6 +9,8 @@ export type Options = {
     after?: () => Promise<void>;
     notice?: string;
     admit?: (invitation: Invitation) => Promise<void>;
+    focus?: string;
+    at?: string;
 };
 export declare function screenSide(avatar: Subject, surface: Surface, options?: Options): Promise<Serving & {
     model: Model;

package/dist/human/screen.js

@@ -16,7 +16,7 @@ import { isSilence, isWord } from '@quo-systems/quo';
 export async function screenSide(avatar, surface, options = {}) {
     const after = options.after ?? (async () => { });
     const notice = options.notice ?? '';
-    const model = { blueprint: null, look: {}, tree: null, pages: {}, notice, answers: {}, pushes: [] };
+    const model = { blueprint: null, look: {}, tree: null, pages: {}, notice, answers: {}, pushes: [], ...(options.focus !== undefined ? { focus: options.focus } : {}), ...(options.at !== undefined ? { at: options.at } : {}) };
     let seen = null;
     const show = () => surface.show(page(model));
     // Her describe, again: the page follows the digest.

package/dist/human/tab.d.ts

@@ -7,6 +7,7 @@ export type Config = {
         public: boolean;
     }>;
     ward?: string;
+    being?: string;
     beings?: boolean;
 };
 export declare function start(cfg: Config, root?: HTMLElement): Promise<void>;

package/dist/human/tab.js

@@ -162,7 +162,8 @@ export async function start(cfg, root = document.body) {
         keep(AT(pk), rel.key);
         const mine = el('div', '', { class: 'far' });
         screen.append(mine);
-        const s = await screenSide(rel.avatar, domSurface(mine), { after: () => ward.save(), notice });
+        // the page's address: the world's page, or one being she carries as the whole page
+        const s = await screenSide(rel.avatar, domSurface(mine), { after: () => ward.save(), notice, at: pageOf(at.name), ...(cfg.being ? { focus: cfg.being } : {}) });
         side = s;
         const bp = s.model.blueprint;
         const notesName = typeof bp?.notes?.name === 'string' ? bp.notes.name : '';
@@ -171,7 +172,8 @@ export async function start(cfg, root = document.body) {
             keep(NAMES(pk), { ...names(), [rel.key]: called });
         switcher();
         people();
-        await boot(rel);
+        if (!cfg.being)
+            await boot(rel); // a being's page is hers alone: the world's tab beings stay on the world's page
     };
     // The way in, from any of the three: a fresh avatar joins, the ward is
     // saved, and she is the one on screen.

package/dist/human/web.js

@@ -54,8 +54,8 @@ export function webRoute(harbor, o) {
         return true;
     };
     const wards = () => Object.fromEntries([...harbor.wards].map(([n, h]) => [n, { pk: h.pk, public: publicOf(h) !== null }]));
-    const tab = (ward) => {
-        const cfg = { quo: o.at.quo, web: o.at.web, wards: wards(), beings: existsSync(beingsEntry), ...(ward ? { ward } : {}) };
+    const tab = (ward, being) => {
+        const cfg = { quo: o.at.quo, web: o.at.web, wards: wards(), beings: existsSync(beingsEntry), ...(ward ? { ward } : {}), ...(being ? { being } : {}) };
         return `<script id="quo" type="application/json">${JSON.stringify(cfg).replace(/</g, '\\u003c')}</script><script type="module" src="${o.at.web}/tab.js"></script>`;
     };
     return async (req, res, rest) => {
@@ -88,6 +88,10 @@ export function webRoute(harbor, o) {
             return html(404, res, `<h1>no such world</h1><p>no ward named ${esc(wardName)} on this harbor.</p>`);
         if (parts.length === 1 && req.method === 'GET')
             return html(200, res, tab(wardName));
+        // a being's page: one standing the user being carries, by its id, as the whole page. No router:
+        // the path is a key, and the tab paints nothing for a key her describe does not carry
+        if (parts.length === 2 && req.method === 'GET' && /^[\w.-]{1,80}$/.test(parts[1]))
+            return html(200, res, tab(wardName, parts[1]));
         return false;
     };
 }
@@ -116,8 +120,11 @@ const CSS = [
     '.page .picture{max-height:6rem}.cards{display:flex;flex-wrap:wrap;gap:.75rem}.card{border:1px solid color-mix(in srgb,currentColor 20%,transparent);border-radius:var(--radius);padding:.5rem .75rem}',
     // a row with a picture is a line about someone or something: the picture small and the words beside it, centred
     '.page .row:has(>.picture){align-items:center;flex-wrap:nowrap}.page .row>.picture{max-height:2.75rem;flex:none}.page .row>.stack{gap:0;min-width:0}.page .row>.stack>p{margin:0}',
-    // a far page inside a standing's section: her title is a section's, not the page's
+    // a far page inside a standing's section: her title is a section's, not the page's; a link to her own page
     'section.standing .page{padding:.5rem 0}section.standing .page .t-title{font-size:1.3rem;margin:.25rem 0}',
+    'a.open{display:inline-block;font-size:.85rem;color:var(--mute);margin:.25rem 0 .5rem}a.back{font-size:.9rem;color:var(--mute);text-decoration:none}a.back::before{content:"\\2190  "}',
+    // a being\'s page, the whole page: her section is the page and her title the page\'s
+    'main.focus section.standing{border:0;padding:0;margin:0}main.focus section.standing .page .t-title{font-size:2rem;margin:.5rem 0}',
     // the door page: one column, generous air, the mark, a word, a sentence
     'main.door{min-height:70vh;display:flex;flex-direction:column;justify-content:center;align-items:flex-start;max-width:32rem;margin:0 auto;padding:3rem 0;font-family:ui-serif,Georgia,"Times New Roman",serif}',
     'main.door .picture{width:3.5rem;height:3.5rem;color:var(--ink);opacity:.9;margin-bottom:1.25rem}',

package/dist/mcp/route.d.ts

@@ -5,6 +5,7 @@ export type Routes = {
     mcp: string;
     web: string;
     quo?: string;
+    api?: string;
 };
 export declare function mcpRoute(dir: string, routes: Routes, mcp: McpHttp | null): Promise<{
     oauth: OAuth;

package/harbor/capacitor.ts

@@ -41,7 +41,7 @@ type Blob = { seed: string; partition: Record<string, unknown>; record: WardReco
 
 // Where the files live: the folder iCloud does not copy on iOS, the app's
 // own files on Android, whose manifest says no backup.
-const directory = Capacitor.getPlatform() === 'ios' ? Directory.LibraryNoCloud : Directory.Data;
+export const directory = Capacitor.getPlatform() === 'ios' ? Directory.LibraryNoCloud : Directory.Data;
 
 async function exists(path: string): Promise<boolean> {
   try {

package/harbor/disk.ts

@@ -41,7 +41,10 @@ let hooked = false;
 function hook(): void {
   if (hooked) return;
   hooked = true;
-  const self = import.meta.url;
+  const self = import.meta.url as string | undefined;
+  // bundled into one script, as the desk's sidecar is, the dock has no URL and no folder of
+  // packages beside it to resolve to: a class file there imports nothing bare
+  if (!self) return;
   register(new URL(self.endsWith('.ts') ? './resolve.ts' : './resolve.js', self), { parentURL: self, data: { parent: self } });
 }
 

package/harbor/quo-harbor.md

@@ -435,18 +435,72 @@ the App plugin's foreground event tells it `wake`, which tells every
 dialer, because a phone asleep loses its sockets silently and the wake is
 what dials them back.
 
-The proof is `packages/dock/test/terrain/ios.test.ts`, behind
-`npm run check:terrain`, inside the real app in the iOS Simulator: the
-store suite, untouched, and the custody rule against a real Keychain and
-a real folder; the whole conformance suite over two harbors on native
-stores, both dialing a daemon on the Mac's loopback through the tab's own
-probe; and the wake, the app sent behind another and brought back, its
-dialer told and its socket held again. The app is synced with the test's
-origin as its page, built with xcodebuild, installed fresh and launched
-with simctl; the page loads the bundled exercise, `native.ts`, runs it and
-posts the list back. Two things the plugins taught, held in the store:
-the secure store keeps JSON, so a value is read with the call that
-parses; and mkdir refuses a folder that exists, recursive or not.
+On Android the same store stands on the same two plugins: the key in the
+Keystore-backed secure store, the files in the app's own data folder,
+which the manifest excludes from backup with `allowBackup` false, so a
+restore finds nothing there either.
+
+The proof is two tests behind `npm run check:terrain` on one stage,
+`packages/dock/test/terrain/phone.ts`: `ios.test.ts` inside the real app
+in the iOS Simulator and `android.test.ts` inside it in the Android
+emulator. Each runs the store suite, untouched, and the custody rule
+against a real secret store and a real folder; the whole conformance
+suite over two harbors on native stores, both dialing a daemon on the
+Mac's loopback through the tab's own probe; and the wake, the app sent
+behind Settings and brought back, its dialer told and its socket held
+again. The app is synced with the stage's origin as its page, built with
+xcodebuild or gradle, installed fresh and launched with simctl or adb; the
+page loads the bundled exercise, `native.ts`, runs it and posts the list
+back. The device names the Mac `localhost`, the Simulator because it
+shares the Mac's network and the emulator because adb reverses the
+stage's two ports, and it has to be that name: a webview grants WebCrypto
+to a plain-http page only on `localhost`, the one origin it counts secure
+without TLS. Through adb's reversed port a socket that Node dropped stays
+open on the device's side, so the stage answers every request with the
+connection closed and every fetch the page makes carries a timeout. Two
+things the plugins taught, held in the store: the secure store keeps
+JSON, so a value is read with the call that parses; and mkdir refuses a
+folder that exists, recursive or not.
+
+## The desk, as built
+
+The desk app is a window onto the daemon that already runs, and the daemon
+is the node daemon above, unchanged. `packages/app/tauri/` is the Tauri
+project, and its Rust core does three things at start: it reads or mints
+the one wrap key in the Mac Keychain, under the app's service name, this
+device only; it looks for the lease in the harbor folder, `~/.quo` or
+`QUO_DIR`, and attaches to the daemon behind it when its pid is alive; and
+when nobody holds the lease it spawns the sidecar with the folder and the
+key in its environment, `QUO_DIR` and `QUO_SEED_KEY`. The key is handed
+always. A folder of plain files is refused by the sidecar itself, as the
+files store says, and the window shows the refusal; a daemon already
+running under launchd with plain files is attached to as it is, and the
+key goes unused. The core then opens the side socket to the webview: the
+hello line in and its answer back, every line after out as an event, and a
+line from the window written through. The window is a surface and the
+screen stays in the daemon; its page is a placeholder until the pipe
+surface lands.
+
+The sidecar is the daemon as one binary, `packages/app/sidecar/`: an entry
+that reaches the dock by name, initialises an empty folder for the
+device's user and serves, bundled with the dock and its two dependencies
+into one CommonJS file and sealed into a copy of node as a single
+executable. A single executable runs one CommonJS script and loads a
+folder's class source from disk by dynamic import as the daemon does, so
+nothing of the daemon is lost in the sealing; the web route's bundler is
+inside and never called, since the sidecar opens no HTTP door. The sidecar
+is the app's process: it leaves on the app's exit, asked with a signal so
+that it releases its lease, and when the app is gone without a word it
+notices its parent changed and leaves the same way.
+
+The proof is `packages/app/test/sidecar.test.ts`, behind the app's
+`check:terrain`: the sidecar built, spawned on an empty folder with a key,
+its side socket answering a hello, its one ward kept sealed and nothing
+plain beside it, then spawned again on that folder with no key and
+refused. The Keychain, the lease and the bridge are proven live on the
+operator's Mac: attached to its launchd daemon, the window's avatar shows
+in that daemon's census; on a scratch folder, the spawned sidecar seals the
+ward under the Keychain key and leaves with the app.
 
 ## The link
 
@@ -469,17 +523,19 @@ device
       /mcp                       the model side; mcp/route.ts
       /web                       the worlds' pages and the exchange; human/web.ts, mcp/web/
       /quo                       the socket door: request in, sockets held, the rendezvous; harbor/quo.ts
+      /api                       a world's public being as JSON, for anyone; api/route.ts
   reverse proxy
     mcp.example.com -> 127.0.0.1:8787/mcp
     web.example.com -> 127.0.0.1:8787/web
     quo.example.com -> 127.0.0.1:8787/quo
+    api.example.com -> 127.0.0.1:8787/api
 ```
 
 The daemon listens on loopback only, and only when asked, with `--http PORT`
 or `QUO_HTTP`. The proxy faces the world and terminates TLS; the daemon never
 does. `estates/lab/droplet/` holds a systemd unit that runs the daemon as
 one user forever, a launchd agent that does the same on a Mac, and a
-Caddyfile that maps the three hostnames onto the one port by path.
+Caddyfile that maps the hostnames onto the one port by path.
 Unattended, the daemon is that unit: restarted if it dies, the lease
 released on SIGTERM, and every ward rebooted from its folder on the next
 start with relations intact. A Mac is a dialer and not a listener: its

package/human/html.ts

@@ -143,6 +143,8 @@ export type Model = {
   look: Look; // her own look, from her `look` ask, or nothing
   tree: Node | null; // her page, from her `page` ask, or nothing: then her asks are painted as forms
   pages: Record<string, Node | null>; // the page of each standing she carries, by id, from its carried `page` ask
+  focus?: string; // one standing she carries shown as the whole page, its id: the page at `web./<ward>/<being>`
+  at?: string; // the world's page path, so a section can say where its own page is and a focused page where back is
   notice: string; // one line about where the human stands: in, not in, an error before an ask
   answers: Record<string, Word>; // the last answer per ask, shown under its form
   pushes: JsonObject[]; // every push from the world, newest last
@@ -215,6 +217,8 @@ export function page(m: Model): string {
     const l = look(kept);
     const prefix = `${id}-`;
     const tree = m.pages[id];
+    // where her own page is, when the world's page is known and this is not it already
+    const own = m.at !== undefined && m.focus !== id ? `<a class="open" href="${escape(`${m.at}/${encodeURIComponent(id)}`)}">open</a>` : '';
     if (tree) {
       const hers: Painter = {
         form: (name) => {
@@ -225,11 +229,11 @@ export function page(m: Model): string {
         standing: () => '',
         standings: () => '',
       };
-      return `<section class="standing" data-standing="${escape(id)}"${l.style}><div class="page">${paint(tree, hers)}</div></section>`;
+      return `<section class="standing" data-standing="${escape(id)}"${l.style}><div class="page">${paint(tree, hers)}</div>${own}</section>`;
     }
     const want = (kept.order ?? []).map((n) => prefix + n);
     const inOrder = ordered(asks, { order: want });
-    return `<section class="standing" data-standing="${escape(id)}"${l.style}>${l.head || `<h2>${escape(id)}</h2>`}${inOrder.map(one(kept, prefix)).join('')}</section>`;
+    return `<section class="standing" data-standing="${escape(id)}"${l.style}>${l.head || `<h2>${escape(id)}</h2>`}${inOrder.map(one(kept, prefix)).join('')}${own}</section>`;
   };
   const far = Object.keys(groups).map(section).join('');
   // Her page, when she answered one: painted from her tree, each name it
@@ -243,13 +247,17 @@ export function page(m: Model): string {
     standing: section,
     standings: () => far,
   };
-  const own = bp ? ordered(bp.asks.filter((a) => !taken.has(a.name) && !pres.has(a.name)), m.look).map(one(m.look)).join('') : '';
-  const asks = m.tree ? `<div class="page">${paint(m.tree, painter)}</div>` : own + far;
+  const mineAsks = bp ? ordered(bp.asks.filter((a) => !taken.has(a.name) && !pres.has(a.name)), m.look).map(one(m.look)).join('') : '';
+  // A being's page: one standing she carries as the whole page, and nothing of hers around it. A key her
+  // describe does not carry paints as nothing, the way a name on a page does: the address adds no right.
+  const focused = m.focus !== undefined;
+  const asks = focused ? section(m.focus!) : m.tree ? `<div class="page">${paint(m.tree, painter)}</div>` : mineAsks + far;
   const shown = bp && bp.notes !== null && typeof bp.notes === 'object' && !Array.isArray(bp.notes) ? Object.fromEntries(Object.entries(bp.notes).filter(([k]) => k !== 'standings' && k !== 'name')) : bp?.notes;
   const notes = bp && shown !== null && shown !== undefined && !(typeof shown === 'object' && !Array.isArray(shown) && !Object.keys(shown).length) ? `<aside class="notes">${view(shown as Json)}</aside>` : '';
   const pushes = m.pushes.length ? `<section class="pushes"><h2>pushes</h2><ol>${m.pushes.map((p) => `<li>${view(p)}</li>`).join('')}</ol></section>` : '';
   const mine = look(m.look);
   // a page carries its own title, so the header keeps only the notice; a being painted as forms is headed by her name
-  const head = m.tree ? '' : `${m.look.logo ? `<img class="logo" alt="" src="${m.look.logo}">` : ''}<h1>${escape(title(bp, m.look))}</h1>`;
-  return `<header${mine.style}>${head}<p class="notice">${escape(m.notice)}</p></header>${notes}<main${mine.style}>${asks}</main>${pushes}`;
+  const back = focused && m.at !== undefined ? `<a class="back" href="${escape(m.at)}">${escape(title(bp, m.look))}</a>` : '';
+  const head = focused ? back : m.tree ? '' : `${m.look.logo ? `<img class="logo" alt="" src="${m.look.logo}">` : ''}<h1>${escape(title(bp, m.look))}</h1>`;
+  return `<header${mine.style}>${head}<p class="notice">${escape(m.notice)}</p></header>${focused ? '' : notes}<main${focused ? ' class="focus"' : ''}${mine.style}>${asks}</main>${pushes}`;
 }

package/human/quo-human.md

@@ -159,9 +159,17 @@ Read with the trunk's "Carrying" and "The look", which this applies.
   page is a knock on the public invitation, and an answer that is an
   invitation is the way in: the side hands it to `admit`, the avatar joins,
   and the page becomes hers. Nothing in the screen knows the word desk.
-- **Worlds have addresses.** `web./<ward>` is that world's page, `web./`
-  lists the worlds, and a hostname per world is one proxy line, the
-  estate's choice. `quo.` stays one per harbor, since bytes route by pk.
+- **Worlds have addresses, and so do the beings one holds.** `web./<ward>`
+  is that world's page, `web./` lists the worlds, and a hostname per world
+  is one proxy line, the estate's choice. `quo.` stays one per harbor,
+  since bytes route by pk. `web./<ward>/<being>` is the page of one
+  standing the user being carries, by its id, as the whole page: her
+  section is the page, her title the page's, the shell's own asks and the
+  world's tab beings stay on the world's page, and a line at the top leads
+  back. No router: the path is a key, the server hands it to the tab as it
+  hands the ward's name, and a key her describe does not carry for this
+  device paints as nothing, since an address adds no right. Every section
+  on the world's page says where its own page is.
 - **A link is the page with the invitation in the fragment**, under the one
   reserved key `quo`, the invitation compact as `ward.heir.secret` or
   `ward` alone: `web.acme.com/shop#quo=...`. The fragment never leaves the

package/human/screen.ts

@@ -31,12 +31,15 @@ export type Surface = {
 // would bring her back from a reload with a stale count, and the far door
 // would refuse her. `admit` is what to do
 // with an answer that is an invitation: a guest at a world's door is let in
-// by it, and a side with no `admit` shows it as any answer.
-export type Options = { after?: () => Promise<void>; notice?: string; admit?: (invitation: Invitation) => Promise<void> };
+// by it, and a side with no `admit` shows it as any answer. `focus` is one
+// standing she carries shown as the whole page, the page at
+// `web./<ward>/<being>`, and `at` the world's page path the sections and a
+// focused page link to.
+export type Options = { after?: () => Promise<void>; notice?: string; admit?: (invitation: Invitation) => Promise<void>; focus?: string; at?: string };
 export async function screenSide(avatar: Subject, surface: Surface, options: Options = {}): Promise<Serving & { model: Model; refresh(): Promise<void> }> {
   const after = options.after ?? (async () => {});
   const notice = options.notice ?? '';
-  const model: Model = { blueprint: null, look: {}, tree: null, pages: {}, notice, answers: {}, pushes: [] };
+  const model: Model = { blueprint: null, look: {}, tree: null, pages: {}, notice, answers: {}, pushes: [], ...(options.focus !== undefined ? { focus: options.focus } : {}), ...(options.at !== undefined ? { at: options.at } : {}) };
   let seen: string | null = null;
   const show = () => surface.show(page(model));
 

package/human/tab.ts

@@ -40,7 +40,7 @@ import type { BeingClass } from '@quo-systems/quo';
 // every ward on that harbor by name, its pk and whether a public being is
 // at its door, which of them this page is, if it is one's, and whether the
 // world serves code for the tab.
-export type Config = { quo: string; web: string; wards: Record<string, { pk: string; public: boolean }>; ward?: string; beings?: boolean };
+export type Config = { quo: string; web: string; wards: Record<string, { pk: string; public: boolean }>; ward?: string; being?: string; beings?: boolean };
 
 // What the tab remembers between pages, beside the harbor: the worlds it
 // has joined, by pk, where each lives and what it is called; which relation
@@ -190,7 +190,8 @@ export async function start(cfg: Config, root: HTMLElement = document.body): Pro
     keep(AT(pk), rel.key);
     const mine = el('div', '', { class: 'far' });
     screen.append(mine);
-    const s = await screenSide(rel.avatar, domSurface(mine), { after: () => ward.save(), notice });
+    // the page's address: the world's page, or one being she carries as the whole page
+    const s = await screenSide(rel.avatar, domSurface(mine), { after: () => ward.save(), notice, at: pageOf(at.name), ...(cfg.being ? { focus: cfg.being } : {}) });
     side = s;
     const bp = s.model.blueprint;
     const notesName = typeof (bp?.notes as JsonObject | null)?.name === 'string' ? ((bp!.notes as JsonObject).name as string) : '';
@@ -198,7 +199,7 @@ export async function start(cfg: Config, root: HTMLElement = document.body): Pro
     if (!names()[rel.key]) keep(NAMES(pk), { ...names(), [rel.key]: called });
     switcher();
     people();
-    await boot(rel);
+    if (!cfg.being) await boot(rel); // a being's page is hers alone: the world's tab beings stay on the world's page
   };
 
   // The way in, from any of the three: a fresh avatar joins, the ward is

package/human/web.ts

@@ -84,8 +84,8 @@ export function webRoute(harbor: DiskHarbor, o: WebOptions): (req: IncomingMessa
     return true;
   };
   const wards = () => Object.fromEntries([...harbor.wards].map(([n, h]) => [n, { pk: h.pk, public: publicOf(h) !== null }]));
-  const tab = (ward?: string) => {
-    const cfg = { quo: o.at.quo, web: o.at.web, wards: wards(), beings: existsSync(beingsEntry), ...(ward ? { ward } : {}) };
+  const tab = (ward?: string, being?: string) => {
+    const cfg = { quo: o.at.quo, web: o.at.web, wards: wards(), beings: existsSync(beingsEntry), ...(ward ? { ward } : {}), ...(being ? { being } : {}) };
     return `<script id="quo" type="application/json">${JSON.stringify(cfg).replace(/</g, '\\u003c')}</script><script type="module" src="${o.at.web}/tab.js"></script>`;
   };
   return async (req, res, rest) => {
@@ -114,6 +114,9 @@ export function webRoute(harbor: DiskHarbor, o: WebOptions): (req: IncomingMessa
     const hosted = harbor.wards.get(wardName);
     if (!hosted) return html(404, res, `<h1>no such world</h1><p>no ward named ${esc(wardName)} on this harbor.</p>`);
     if (parts.length === 1 && req.method === 'GET') return html(200, res, tab(wardName));
+    // a being's page: one standing the user being carries, by its id, as the whole page. No router:
+    // the path is a key, and the tab paints nothing for a key her describe does not carry
+    if (parts.length === 2 && req.method === 'GET' && /^[\w.-]{1,80}$/.test(parts[1]!)) return html(200, res, tab(wardName, parts[1]!));
     return false;
   };
 }
@@ -143,8 +146,11 @@ const CSS = [
   '.page .picture{max-height:6rem}.cards{display:flex;flex-wrap:wrap;gap:.75rem}.card{border:1px solid color-mix(in srgb,currentColor 20%,transparent);border-radius:var(--radius);padding:.5rem .75rem}',
   // a row with a picture is a line about someone or something: the picture small and the words beside it, centred
   '.page .row:has(>.picture){align-items:center;flex-wrap:nowrap}.page .row>.picture{max-height:2.75rem;flex:none}.page .row>.stack{gap:0;min-width:0}.page .row>.stack>p{margin:0}',
-  // a far page inside a standing's section: her title is a section's, not the page's
+  // a far page inside a standing's section: her title is a section's, not the page's; a link to her own page
   'section.standing .page{padding:.5rem 0}section.standing .page .t-title{font-size:1.3rem;margin:.25rem 0}',
+  'a.open{display:inline-block;font-size:.85rem;color:var(--mute);margin:.25rem 0 .5rem}a.back{font-size:.9rem;color:var(--mute);text-decoration:none}a.back::before{content:"\\2190  "}',
+  // a being\'s page, the whole page: her section is the page and her title the page\'s
+  'main.focus section.standing{border:0;padding:0;margin:0}main.focus section.standing .page .t-title{font-size:2rem;margin:.5rem 0}',
   // the door page: one column, generous air, the mark, a word, a sentence
   'main.door{min-height:70vh;display:flex;flex-direction:column;justify-content:center;align-items:flex-start;max-width:32rem;margin:0 auto;padding:3rem 0;font-family:ui-serif,Georgia,"Times New Roman",serif}',
   'main.door .picture{width:3.5rem;height:3.5rem;color:var(--ink);opacity:.9;margin-bottom:1.25rem}',

package/mcp/route.ts

@@ -13,7 +13,7 @@ import type { McpHttp } from './http.ts';
 import type { Handler } from '../cli/http.ts';
 
 // The routes' public faces, as the exchange and the metadata name them.
-export type Routes = { mcp: string; web: string; quo?: string };
+export type Routes = { mcp: string; web: string; quo?: string; api?: string };
 
 export async function mcpRoute(dir: string, routes: Routes, mcp: McpHttp | null): Promise<{ oauth: OAuth; handler: Handler }> {
   const file = join(dir, 'oauth.json');

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@quo-systems/dock",
-  "version": "0.2.6",
+  "version": "0.2.8",
   "description": "The dock: what every estate on Quo needs and nobody writes twice. A daemon and the quo command, the front desk, the user being and the avatar, harbors on disk, in a tab and on the edge, the model sides and the screen.",
   "keywords": [
     "quo",
@@ -80,7 +80,7 @@
     "@capacitor/core": "^8.5.1",
     "@capacitor/filesystem": "^8.1.3",
     "@modelcontextprotocol/sdk": "^1.30.0",
-    "@quo-systems/quo": "^0.2.6",
+    "@quo-systems/quo": "^0.2.8",
     "esbuild": "^0.28.2",
     "ws": "^8.21.3"
   },
@@ -98,6 +98,7 @@
     "harbor",
     "mcp",
     "human",
+    "api",
     "README.md",
     "LICENSE",
     "NOTICE"