@quo-systems/dock 0.2.7 → 0.2.8

package/README.md

@@ -19,7 +19,7 @@ its Caddyfile, and a package file that depends on the dock and nothing
 else. Add your beings to `droplet/classes/`, and your placement to the
 routes and agents files.
 
-`beings/quo-dock.md` is the truth of this package and the trunk of its four
+`beings/quo-dock.md` is the truth of this package and the trunk of its five
 documents; read it first. It knows nothing the spec of Quo does not say,
 and adds no word to harbor, ward or being.
 

package/api/quo-api.md

@@ -0,0 +1,74 @@
+# The api route
+
+This is the fourth rendering of one describe. The screen speaks a being's
+describe as forms, the model side speaks it as tools, the CLI speaks it as
+lines, and this route speaks it as plain HTTP and JSON to anyone at all. It
+is one route of the daemon described in `packages/dock/beings/quo-dock.md`,
+which owns the routes, the askers and the shared invariants; this document
+assumes all of that and adds only what the route does.
+
+## What it is for
+
+Everything a device hears is one of three askers, mapped once, at the
+edge, and the route is that edge for what arrives as HTTP. An anonymous
+request that is safe to repeat, a page rendering server side, a crawler, a
+tab on another origin, is an ask at a ward's public being as `{}`, which
+is what every stranger is at every door. The route judges nothing and
+names nobody: the public being answers as she answers any stranger, by her
+own gate, and her obligation that the answer be safe to repeat is the same
+here as at her sealed door. Nothing is admitted on this side and no
+occupant is made here.
+
+A world is a ward, so the route names one. `main` holds the desk, who is
+public for the first hello and answers a stranger nothing else, so a
+world's public reads live in a ward of their own, and the route is what
+makes a second ward reachable by name from outside: the corpus of a court
+watcher, a catalogue, a board.
+
+## The mapping
+
+`packages/dock/api/route.ts` is the route the daemon mounts under `/api`,
+and the proxy maps it from the api. hostname.
+
+| request                            | Quo                                                          |
+| ---------------------------------- | ------------------------------------------------------------ |
+| `GET /api/<ward>`                  | the empty ask at the public being as `{}`: her describe      |
+| `GET /api/<ward>/<ask>?k=v`        | that ask as `{}`, the query as args, every value a string    |
+| `POST /api/<ward>/<ask>` JSON body | that ask as `{}`, the object as args                         |
+| `OPTIONS`                          | the preflight, any origin                                    |
+
+What she says crosses as the model side crosses it:
+
+| she answered                   | the client gets                                        |
+| ------------------------------ | ------------------------------------------------------ |
+| an object                      | 200 with that JSON                                     |
+| `{ error }`                    | 400 with that JSON                                     |
+| silence, a throw, a wait spent | 503 `{ error: 'silence' }`: the work may have happened |
+| an ask not hers for a stranger | 400 `{ error: 'unknown ask' }`, her own answer         |
+
+And what the route says on its own: 404 for a ward not here, for a ward
+with nobody at the door and for a path that is not one of the three
+shapes, 400 for a body that is not a JSON object, 413 for a body past a
+megabyte, 405 for any other method. Every answer is JSON and open to any
+origin: the route carries nothing a stranger can use that she did not
+choose to say.
+
+The ask is bounded to the ward's default allowance, thirty seconds, and a
+wait past it is silence, as a sealed ask of hers would be. The ward is saved
+after every ask, as the daemon saves after any ask it drives in process:
+a public being may write while answering, a tally, a board, and what she
+wrote is hers to keep.
+
+## What is not here
+
+A delivery that must be named and once-only, a vendor's webhook, is not a
+stranger's ask and does not land as `{}`: it is a sealed ask from a
+standing the root minted for that source, its keys the route's own on the
+device, the way `oauth.json` is the mcp route's. That half stands when its
+first user does.
+
+## The proof
+
+`packages/dock/test/api.test.ts`, over a real daemon on loopback: a world
+with a public board described and asked by anyone, args by query and by
+body, what she wrote kept across a reboot, and every refusal.

package/api/route.ts

@@ -0,0 +1,87 @@
+// SPDX-License-Identifier: Apache-2.0
+// The api. route: HTTP as the fourth rendering of one describe, served by
+// the daemon under `/api` and mapped by the proxy from the api. hostname.
+// Beside forms, tools and the CLI, it speaks a public being's describe and
+// asks as plain JSON to anyone at all, and it is the one place a device
+// maps an anonymous source, a browser fetch, a crawler, a page rendering
+// server side, onto the asker every stranger is: `{}` at the named ward's
+// public being. A world is a ward, so `/api/<ward>` is her describe for
+// nobody and `/api/<ward>/<ask>` is one ask, args from the query on a GET
+// or a JSON object on a POST. The route judges nothing and names nobody:
+// the public being's answer must be safe to repeat, which is her
+// obligation at every door, and what she writes while answering is saved
+// as the daemon saves after any ask it drives in process.
+//
+// What she says crosses as the model side crosses it: an object is 200
+// with that JSON, an error object she answered is 400 with that JSON, and
+// silence, a throw, a wait that ran out, is 503 `{ error: 'silence' }`,
+// which is the ward's own answer for a throw at a public being. A world
+// that is not here or has nobody at the door is 404.
+import type { Handler } from '../cli/http.ts';
+import { readAll } from '../cli/http.ts';
+import type { DiskHarbor, Hosted } from '../harbor/disk.ts';
+import { isSilence, isWord, type BeingLike, type JsonObject } from '@quo-systems/quo';
+
+// The ward's own default allowance for an ask, which is what a sealed ask
+// of hers would have carried: a wait past it is silence.
+export const ALLOWANCE = 30_000;
+
+const open = { 'access-control-allow-origin': '*', 'access-control-allow-methods': 'GET, POST, OPTIONS', 'access-control-allow-headers': 'content-type' };
+
+export function apiRoute(harbor: DiskHarbor): Handler {
+  const publicOf = (h: Hosted): BeingLike | undefined => {
+    const key = (h.partition as { public?: string | null }).public ?? null;
+    return key === null ? undefined : h.being(key);
+  };
+  return async (req, res, rest) => {
+    const json = (status: number, body: unknown) => {
+      res.writeHead(status, { 'content-type': 'application/json', ...open });
+      res.end(JSON.stringify(body));
+    };
+    if (req.method === 'OPTIONS') {
+      res.writeHead(204, open);
+      return void res.end();
+    }
+    const [, ward = '', ask = '', ...more] = rest.split('/');
+    if (req.method !== 'GET' && req.method !== 'POST') return json(405, { error: 'GET or POST' });
+    if (!/^[\w.-]+$/.test(ward) || more.length > 0 || (ask !== '' && !/^[\w-]+$/.test(ask))) return json(404, { error: 'GET /api/<ward> for the describe, GET or POST /api/<ward>/<ask> for one ask' });
+    const hosted = harbor.wards.get(ward);
+    if (!hosted) return json(404, { error: 'no such world' });
+    const being = publicOf(hosted);
+    if (!being) return json(404, { error: 'nobody is home' });
+    let args: JsonObject;
+    if (req.method === 'POST') {
+      const raw = await readAll(req as AsyncIterable<Buffer>);
+      if (raw === undefined) return json(413, { error: 'too much' });
+      let parsed: unknown = {};
+      try {
+        parsed = raw.length === 0 ? {} : JSON.parse(raw.toString('utf8'));
+      } catch {
+        return json(400, { error: 'the body is a JSON object' });
+      }
+      if (parsed === null || typeof parsed !== 'object' || Array.isArray(parsed)) return json(400, { error: 'the body is a JSON object' });
+      args = parsed as JsonObject;
+    } else {
+      const url = new URL(req.url ?? '/', 'http://localhost');
+      args = Object.fromEntries(url.searchParams.entries());
+    }
+    // Asked as `{}`, bounded as her door would bound it, and every throw or
+    // word is what the door says of one: silence.
+    let timer: ReturnType<typeof setTimeout> | undefined;
+    const late = new Promise<typeof silent>((ok) => (timer = setTimeout(() => ok(silent), ALLOWANCE)));
+    let out: unknown;
+    try {
+      out = await Promise.race([Promise.resolve(ask === '' ? being.answer({}) : being.answer({}, ask, args)), late]);
+    } catch {
+      out = silent;
+    } finally {
+      clearTimeout(timer);
+      await hosted.save();
+    }
+    if (out === silent || isSilence(out) || isWord(out) || out === null || typeof out !== 'object') return json(503, { error: 'silence' });
+    if (typeof (out as { error?: unknown }).error === 'string') return json(400, out);
+    return json(200, out);
+  };
+}
+
+const silent = Symbol('silence');

package/beings/quo-dock.md

@@ -2,7 +2,7 @@
 
 This is the trunk of the dock: what every estate on Quo needs and nobody writes
 twice. `packages/quo/SPEC.md` is the truth of `packages/quo/src` and knows
-nothing of this folder; the four documents under `packages/dock/` are the truth
+nothing of this folder; the five documents under `packages/dock/` are the truth
 of their folders in the same way, and where any of them disagrees with
 `packages/quo/SPEC.md`, the spec wins and the document is rewritten. Nothing
 here adds a word to harbor, ward or being.
@@ -34,13 +34,14 @@ avatar, the harbors on real terrains, the model sides and the screen, the
 credential exchange. It is general by two rules, under "Generality", and it
 is published so an adopter installs it once and writes only their estate.
 
-The four documents of the dock:
+The five documents of the dock:
 
 | document               | owns                                             |
 | ---------------------- | ------------------------------------------------ |
 | `beings/quo-dock.md`   | this: the beings and rules every side shares     |
 | `human/quo-human.md`   | the human side: a blueprint spoken as HTML       |
 | `mcp/quo-mcp.md`       | the model side: a blueprint spoken as tools      |
+| `api/quo-api.md`       | the api route: a public being spoken as HTTP     |
 | `harbor/quo-harbor.md` | transports: harbor core, reach, store, directory |
 
 Each names only its folder. The human document never says WebSocket or
@@ -124,7 +125,7 @@ that every arrival is named and judged.
   second optional ask, `page`, answers her page as a tree of values in the
   screen's closed grammar; only a screen reads it.
 - **Route.** A hostname a reverse proxy sends to one process: `web.`, `quo.`,
-  `mcp.`. Routes are deployment, never boundaries.
+  `mcp.`, `api.`. Routes are deployment, never boundaries.
 
 ## The ids
 
@@ -159,7 +160,7 @@ she keeps the last one. A name is a word, held to the same shape as a key.
 
 ## Architecture
 
-One droplet, one harbor, three routes. Every other placement is a subset.
+One droplet, one harbor, four routes. Every other placement is a subset.
 
 ```
 acme.com, or razvan.com: the dialable part of an estate
@@ -167,6 +168,7 @@ acme.com, or razvan.com: the dialable part of an estate
     web.   one page per world, /<ward>, the credential exchange, ends with an invitation
     quo.   the harbor's socket door: the rendezvous for every dialer
     mcp.   the model side over HTTP, a credential exchange in front
+    api.   a world's public being as plain JSON, asked by anyone as {}
   quo serve: one process, one harbor, the ask pointer
     unix socket     owner asks, local only, never behind the proxy
     localhost ports the routes above
@@ -426,8 +428,8 @@ and nothing else, holds no class body, and never speaks to a ward except
 through the ask pointer or an avatar, the two doors everyone has. The
 daemon's folder holds the process and its doors, the two sockets and the
 HTTP listener; each route on that listener lives in the folder whose truth
-it is, `human/web.ts`, `mcp/route.ts`, `harbor/quo.ts`, and the daemon only
-mounts them.
+it is, `human/web.ts`, `mcp/route.ts`, `harbor/quo.ts`, `api/route.ts`, and
+the daemon only mounts them.
 
 ```
 quo init [--dir D]        mint a seed, boot a harbor and one ward over a disk store, write both

package/cli/daemon.ts

@@ -41,7 +41,8 @@
 // path, and each lives in the folder whose truth it is: `/web`, the worlds'
 // pages and the exchange, in `human/web.ts` and `mcp/web/`; `/mcp`, the
 // model side behind its credential exchange, in `mcp/route.ts`; `/quo`, the
-// socket door, in `harbor/quo.ts`. It listens only when asked, and only on
+// socket door, in `harbor/quo.ts`; `/api`, a public being's describe and
+// asks as plain JSON for anyone, in `api/route.ts`. It listens only when asked, and only on
 // loopback: the proxy is what faces the world, and the daemon never does.
 // With `--dial URL`, or `<dir>/dial.json`, this daemon is itself a dialer:
 // it holds one socket to each URL, announces its wards, and reconnects with
@@ -69,6 +70,7 @@ import { McpHttp } from '../mcp/http.ts';
 import { mcpRoute, type Routes } from '../mcp/route.ts';
 import { webRoute } from '../human/web.ts';
 import { quoRoute } from '../harbor/quo.ts';
+import { apiRoute } from '../api/route.ts';
 import { listenHttp, type Http, type Quo } from './http.ts';
 
 export type { Handler, Http, Quo } from './http.ts';
@@ -201,6 +203,7 @@ export async function serve(dir: string, options: Options = {}): Promise<Serving
       servers.push(server);
       http = door;
       http.mount('/quo', quoRoute(harbor, server as HttpServer, quo));
+      http.mount('/api', apiRoute(harbor)); // anyone's: a public being asked as {}
       const routes = options.routes ?? (await readRoutes(harbor.dir));
       const here = `http://${http.host}:${http.port}`;
       // the worlds' pages: always, on the daemon's own door when no route names a public one
@@ -383,7 +386,7 @@ async function handle(harbor: DiskHarbor, line: string): Promise<string> {
   }
 }
 
-// `<dir>/routes.json`: { mcp, web, quo? }, the public origins the proxy serves.
+// `<dir>/routes.json`: { mcp, web, quo?, api? }, the public origins the proxy serves.
 export async function readRoutes(dir: string): Promise<Routes | null> {
   const p = join(dir, 'routes.json');
   if (!existsSync(p)) return null;
@@ -391,6 +394,7 @@ export async function readRoutes(dir: string): Promise<Routes | null> {
   if (typeof r.mcp !== 'string' || typeof r.web !== 'string') return null;
   const out: Routes = { mcp: r.mcp.replace(/\/$/, ''), web: r.web.replace(/\/$/, '') };
   if (typeof r.quo === 'string') out.quo = r.quo.replace(/\/$/, '');
+  if (typeof r.api === 'string') out.api = r.api.replace(/\/$/, '');
   return out;
 }
 

package/dist/api/route.d.ts

@@ -0,0 +1,4 @@
+import type { Handler } from '../cli/http.ts';
+import type { DiskHarbor } from '../harbor/disk.ts';
+export declare const ALLOWANCE = 30000;
+export declare function apiRoute(harbor: DiskHarbor): Handler;

package/dist/api/route.js

@@ -0,0 +1,74 @@
+import { readAll } from '../cli/http.js';
+import { isSilence, isWord } from '@quo-systems/quo';
+// The ward's own default allowance for an ask, which is what a sealed ask
+// of hers would have carried: a wait past it is silence.
+export const ALLOWANCE = 30_000;
+const open = { 'access-control-allow-origin': '*', 'access-control-allow-methods': 'GET, POST, OPTIONS', 'access-control-allow-headers': 'content-type' };
+export function apiRoute(harbor) {
+    const publicOf = (h) => {
+        const key = h.partition.public ?? null;
+        return key === null ? undefined : h.being(key);
+    };
+    return async (req, res, rest) => {
+        const json = (status, body) => {
+            res.writeHead(status, { 'content-type': 'application/json', ...open });
+            res.end(JSON.stringify(body));
+        };
+        if (req.method === 'OPTIONS') {
+            res.writeHead(204, open);
+            return void res.end();
+        }
+        const [, ward = '', ask = '', ...more] = rest.split('/');
+        if (req.method !== 'GET' && req.method !== 'POST')
+            return json(405, { error: 'GET or POST' });
+        if (!/^[\w.-]+$/.test(ward) || more.length > 0 || (ask !== '' && !/^[\w-]+$/.test(ask)))
+            return json(404, { error: 'GET /api/<ward> for the describe, GET or POST /api/<ward>/<ask> for one ask' });
+        const hosted = harbor.wards.get(ward);
+        if (!hosted)
+            return json(404, { error: 'no such world' });
+        const being = publicOf(hosted);
+        if (!being)
+            return json(404, { error: 'nobody is home' });
+        let args;
+        if (req.method === 'POST') {
+            const raw = await readAll(req);
+            if (raw === undefined)
+                return json(413, { error: 'too much' });
+            let parsed = {};
+            try {
+                parsed = raw.length === 0 ? {} : JSON.parse(raw.toString('utf8'));
+            }
+            catch {
+                return json(400, { error: 'the body is a JSON object' });
+            }
+            if (parsed === null || typeof parsed !== 'object' || Array.isArray(parsed))
+                return json(400, { error: 'the body is a JSON object' });
+            args = parsed;
+        }
+        else {
+            const url = new URL(req.url ?? '/', 'http://localhost');
+            args = Object.fromEntries(url.searchParams.entries());
+        }
+        // Asked as `{}`, bounded as her door would bound it, and every throw or
+        // word is what the door says of one: silence.
+        let timer;
+        const late = new Promise((ok) => (timer = setTimeout(() => ok(silent), ALLOWANCE)));
+        let out;
+        try {
+            out = await Promise.race([Promise.resolve(ask === '' ? being.answer({}) : being.answer({}, ask, args)), late]);
+        }
+        catch {
+            out = silent;
+        }
+        finally {
+            clearTimeout(timer);
+            await hosted.save();
+        }
+        if (out === silent || isSilence(out) || isWord(out) || out === null || typeof out !== 'object')
+            return json(503, { error: 'silence' });
+        if (typeof out.error === 'string')
+            return json(400, out);
+        return json(200, out);
+    };
+}
+const silent = Symbol('silence');

package/dist/cli/daemon.js

@@ -41,7 +41,8 @@
 // path, and each lives in the folder whose truth it is: `/web`, the worlds'
 // pages and the exchange, in `human/web.ts` and `mcp/web/`; `/mcp`, the
 // model side behind its credential exchange, in `mcp/route.ts`; `/quo`, the
-// socket door, in `harbor/quo.ts`. It listens only when asked, and only on
+// socket door, in `harbor/quo.ts`; `/api`, a public being's describe and
+// asks as plain JSON for anyone, in `api/route.ts`. It listens only when asked, and only on
 // loopback: the proxy is what faces the world, and the daemon never does.
 // With `--dial URL`, or `<dir>/dial.json`, this daemon is itself a dialer:
 // it holds one socket to each URL, announces its wards, and reconnects with
@@ -65,6 +66,7 @@ import { McpHttp } from '../mcp/http.js';
 import { mcpRoute } from '../mcp/route.js';
 import { webRoute } from '../human/web.js';
 import { quoRoute } from '../harbor/quo.js';
+import { apiRoute } from '../api/route.js';
 import { listenHttp } from './http.js';
 // The sockets live in the harbor's folder, where the folder's own permissions
 // guard them. A unix socket path is short by law, about a hundred bytes on
@@ -187,6 +189,7 @@ export async function serve(dir, options = {}) {
             servers.push(server);
             http = door;
             http.mount('/quo', quoRoute(harbor, server, quo));
+            http.mount('/api', apiRoute(harbor)); // anyone's: a public being asked as {}
             const routes = options.routes ?? (await readRoutes(harbor.dir));
             const here = `http://${http.host}:${http.port}`;
             // the worlds' pages: always, on the daemon's own door when no route names a public one
@@ -384,7 +387,7 @@ async function handle(harbor, line) {
         return JSON.stringify({ id, error: e instanceof Error ? e.message : String(e) });
     }
 }
-// `<dir>/routes.json`: { mcp, web, quo? }, the public origins the proxy serves.
+// `<dir>/routes.json`: { mcp, web, quo?, api? }, the public origins the proxy serves.
 export async function readRoutes(dir) {
     const p = join(dir, 'routes.json');
     if (!existsSync(p))
@@ -395,6 +398,8 @@ export async function readRoutes(dir) {
     const out = { mcp: r.mcp.replace(/\/$/, ''), web: r.web.replace(/\/$/, '') };
     if (typeof r.quo === 'string')
         out.quo = r.quo.replace(/\/$/, '');
+    if (typeof r.api === 'string')
+        out.api = r.api.replace(/\/$/, '');
     return out;
 }
 // `<dir>/dial.json`: [url, ...], the quo. routes this daemon holds a socket to.

package/dist/harbor/disk.js

@@ -45,6 +45,10 @@ function hook() {
         return;
     hooked = true;
     const self = import.meta.url;
+    // bundled into one script, as the desk's sidecar is, the dock has no URL and no folder of
+    // packages beside it to resolve to: a class file there imports nothing bare
+    if (!self)
+        return;
     register(new URL(self.endsWith('.ts') ? './resolve.ts' : './resolve.js', self), { parentURL: self, data: { parent: self } });
 }
 // The class source is a module. Every export that is a class is a class the

package/dist/mcp/route.d.ts

@@ -5,6 +5,7 @@ export type Routes = {
     mcp: string;
     web: string;
     quo?: string;
+    api?: string;
 };
 export declare function mcpRoute(dir: string, routes: Routes, mcp: McpHttp | null): Promise<{
     oauth: OAuth;

package/harbor/disk.ts

@@ -41,7 +41,10 @@ let hooked = false;
 function hook(): void {
   if (hooked) return;
   hooked = true;
-  const self = import.meta.url;
+  const self = import.meta.url as string | undefined;
+  // bundled into one script, as the desk's sidecar is, the dock has no URL and no folder of
+  // packages beside it to resolve to: a class file there imports nothing bare
+  if (!self) return;
   register(new URL(self.endsWith('.ts') ? './resolve.ts' : './resolve.js', self), { parentURL: self, data: { parent: self } });
 }
 

package/harbor/quo-harbor.md

@@ -462,6 +462,46 @@ things the plugins taught, held in the store: the secure store keeps
 JSON, so a value is read with the call that parses; and mkdir refuses a
 folder that exists, recursive or not.
 
+## The desk, as built
+
+The desk app is a window onto the daemon that already runs, and the daemon
+is the node daemon above, unchanged. `packages/app/tauri/` is the Tauri
+project, and its Rust core does three things at start: it reads or mints
+the one wrap key in the Mac Keychain, under the app's service name, this
+device only; it looks for the lease in the harbor folder, `~/.quo` or
+`QUO_DIR`, and attaches to the daemon behind it when its pid is alive; and
+when nobody holds the lease it spawns the sidecar with the folder and the
+key in its environment, `QUO_DIR` and `QUO_SEED_KEY`. The key is handed
+always. A folder of plain files is refused by the sidecar itself, as the
+files store says, and the window shows the refusal; a daemon already
+running under launchd with plain files is attached to as it is, and the
+key goes unused. The core then opens the side socket to the webview: the
+hello line in and its answer back, every line after out as an event, and a
+line from the window written through. The window is a surface and the
+screen stays in the daemon; its page is a placeholder until the pipe
+surface lands.
+
+The sidecar is the daemon as one binary, `packages/app/sidecar/`: an entry
+that reaches the dock by name, initialises an empty folder for the
+device's user and serves, bundled with the dock and its two dependencies
+into one CommonJS file and sealed into a copy of node as a single
+executable. A single executable runs one CommonJS script and loads a
+folder's class source from disk by dynamic import as the daemon does, so
+nothing of the daemon is lost in the sealing; the web route's bundler is
+inside and never called, since the sidecar opens no HTTP door. The sidecar
+is the app's process: it leaves on the app's exit, asked with a signal so
+that it releases its lease, and when the app is gone without a word it
+notices its parent changed and leaves the same way.
+
+The proof is `packages/app/test/sidecar.test.ts`, behind the app's
+`check:terrain`: the sidecar built, spawned on an empty folder with a key,
+its side socket answering a hello, its one ward kept sealed and nothing
+plain beside it, then spawned again on that folder with no key and
+refused. The Keychain, the lease and the bridge are proven live on the
+operator's Mac: attached to its launchd daemon, the window's avatar shows
+in that daemon's census; on a scratch folder, the spawned sidecar seals the
+ward under the Keychain key and leaves with the app.
+
 ## The link
 
 An invitation carries the ward pk of the world that minted it, and not where
@@ -483,17 +523,19 @@ device
       /mcp                       the model side; mcp/route.ts
       /web                       the worlds' pages and the exchange; human/web.ts, mcp/web/
       /quo                       the socket door: request in, sockets held, the rendezvous; harbor/quo.ts
+      /api                       a world's public being as JSON, for anyone; api/route.ts
   reverse proxy
     mcp.example.com -> 127.0.0.1:8787/mcp
     web.example.com -> 127.0.0.1:8787/web
     quo.example.com -> 127.0.0.1:8787/quo
+    api.example.com -> 127.0.0.1:8787/api
 ```
 
 The daemon listens on loopback only, and only when asked, with `--http PORT`
 or `QUO_HTTP`. The proxy faces the world and terminates TLS; the daemon never
 does. `estates/lab/droplet/` holds a systemd unit that runs the daemon as
 one user forever, a launchd agent that does the same on a Mac, and a
-Caddyfile that maps the three hostnames onto the one port by path.
+Caddyfile that maps the hostnames onto the one port by path.
 Unattended, the daemon is that unit: restarted if it dies, the lease
 released on SIGTERM, and every ward rebooted from its folder on the next
 start with relations intact. A Mac is a dialer and not a listener: its

package/mcp/route.ts

@@ -13,7 +13,7 @@ import type { McpHttp } from './http.ts';
 import type { Handler } from '../cli/http.ts';
 
 // The routes' public faces, as the exchange and the metadata name them.
-export type Routes = { mcp: string; web: string; quo?: string };
+export type Routes = { mcp: string; web: string; quo?: string; api?: string };
 
 export async function mcpRoute(dir: string, routes: Routes, mcp: McpHttp | null): Promise<{ oauth: OAuth; handler: Handler }> {
   const file = join(dir, 'oauth.json');

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@quo-systems/dock",
-  "version": "0.2.7",
+  "version": "0.2.8",
   "description": "The dock: what every estate on Quo needs and nobody writes twice. A daemon and the quo command, the front desk, the user being and the avatar, harbors on disk, in a tab and on the edge, the model sides and the screen.",
   "keywords": [
     "quo",
@@ -80,7 +80,7 @@
     "@capacitor/core": "^8.5.1",
     "@capacitor/filesystem": "^8.1.3",
     "@modelcontextprotocol/sdk": "^1.30.0",
-    "@quo-systems/quo": "^0.2.7",
+    "@quo-systems/quo": "^0.2.8",
     "esbuild": "^0.28.2",
     "ws": "^8.21.3"
   },
@@ -98,6 +98,7 @@
     "harbor",
     "mcp",
     "human",
+    "api",
     "README.md",
     "LICENSE",
     "NOTICE"