nervur 0.14.0 → 0.16.0

package/LICENSE

@@ -1,3 +1,4 @@
+
                                  Apache License
                            Version 2.0, January 2004
                         http://www.apache.org/licenses/
@@ -186,7 +187,7 @@
       same "printed page" as the copyright notice for easier
       identification within third-party archives.
 
-   Copyright [yyyy] [name of copyright owner]
+   Copyright 2026 Razvan Gherghina
 
    Licensed under the Apache License, Version 2.0 (the "License");
    you may not use this file except in compliance with the License.

package/NOTICE

@@ -1,2 +1,6 @@
-Nervur
+Quo
 Copyright 2026 Razvan Gherghina
+
+This product includes software developed by Razvan Gherghina.
+
+Licensed under the Apache License, Version 2.0. See LICENSE for the terms.

package/README.md

@@ -1,457 +1,32 @@
-# Nervur
+# nervur
 
-The library. Picture a castle: one gate, its own residents, its own law.
-**A ground is the castle** — one sovereign process holding many beings,
-exposing exactly one handler where every message for every resident
-arrives. You arrive at the gate, say _I am X_ with your signature, and
-whom you seek travels inside the letter; the castle answers or keeps
-silence, and a resident that refuses you looks exactly like one that
-never lived there. The castle's capabilities are its **modules** — a
-resident uses only what its blueprint declares — and the terrain under
-the castle is a **floor**: a browser tab, a Linux daemon, a phone, an
-edge worker. The castle is a castle wherever it is built.
+Quo is a protocol that lets an object ask another object and get an answer,
+without knowing whether that other object is in the same process, on the
+same device, or on another planet. Nervur's kit is its first implementation,
+open source, three packages under the `@nervur-org` scope.
 
-Beneath the picture, the mechanics: an address is its own verification
-key, authority is a signature, and every relationship is one ref with
-declared rights — so a reference cannot be forged and no ambient
-authority exists anywhere. The door asks by whose authority and refuses
-every other question. The lineage is the object-capability tradition —
-CapTP, the actor model — with one honest departure: the door verifies who
-is calling, and rights are declared per reference. Pure Crockford
-JavaScript — factory functions, closures for privacy, no `this`, no
-classes, frozen surfaces — with no `node:` import anywhere, so the twelve
-files run wherever JavaScript does; three dependencies (`graphql` for the
-one thing that would be madness to hand-roll, `@noble/curves` and
-`@noble/hashes` for the arithmetic every host must agree on).
+This package is the unscoped twin of that scope. `import` from it and you
+have the library; run it and you have the dock's command:
 
-## Quickstart
-
-New to the whole thing? [GETTING-STARTED.md](GETTING-STARTED.md) raises
-two castles on two terrains — a server and a browser tab — and has them
-speak; the bench drives that exact story. What follows here is the
-library alone.
-
-`npm install nervur` — what ships is this source, byte for byte. The
-package is a library and carries no command; a ground also needs a floor
-(`@nervur-org/floor-machine` here) — the library is the law and the
-shape, and a host is what it stands on;
-the `nervur` command on an operator's PATH belongs to the
-[`nervurd`](../nervurd/README.md) package, its name twin. Construction is
-synchronous; every call through a door — `pointer`, `mcp`, `gql`, and each
-function they hand back — is async. This runs today, lifted from the
-bench's own passing suites:
-
-```js
-import { Cells, Cipher, Keychain } from '@nervur-org/floor-machine';
-import { Ground, Tools, Voice } from 'nervur';
-
-const DIARY = `({
-  name: 'acme.diary',
-  needs: { modules: [{ module: 'memory', contract: 'nervur.memory' }] },
-  memory: { pages: { type: '[String!]', class: 'data' } },
-  interface: \`
-    type Query { pages: [String!] @rights(is: [SELF, MEMBER]) }
-    type Mutation { write(line: String!): Int @rights(is: [SELF, MEMBER]) }
-  \`,
-  resolvers: {
-    Query: { pages: (_, __, { modules }) => modules.memory.read('pages') ?? [] },
-    Mutation: {
-      write: (_, { line }, { modules }) => {
-        const kept = modules.memory.read('pages') ?? [];
-        kept.push(line);
-        modules.memory.write('pages', kept);
-        return kept.length;
-      },
-    },
-  },
-})`;
-
-const secret = Buffer.from(process.env.NERVUR_SECRET, 'base64'); // 32 bytes, minted once with Tools.secret()
-const shelf = {
-  cells: Cells({ file: 'ground.json' }),
-  cipher: Cipher(),
-  keychain: Keychain(secret),
-};
-
-const heir = Voice(); // keep this one somewhere the machine is not
-const self = Voice(Tools.digest(heir.pk)); // and hand the ground only this
-Ground(shelf).init(self.hand()); // once, ever — a fresh ground offers nothing else
-
-const ground = Ground(shelf); // now it stands, and answers
-const me = Voice(); // keep it: writeFileSync of me.pack(), or it dies with the process
-await ground
-  .serve(self)
-  .pointer('Ground')
-  .then((it) => it.invite({ address: Tools.address(me.pk) }));
-
-const serve = ground.serve(me);
-const admin = await serve.pointer('Ground'); // a pointer is your rights at mint — re-mint after they change
-const diary = await admin.create({
-  program: DIARY,
-  refs: [{ address: Tools.address(me.pk), rights: 'MEMBER' }],
-});
-const mine = await serve.pointer(diary);
-await mine.write({ line: 'first entry' });
-console.log(await mine.pages()); // [ 'first entry' ]
-```
-
-The rights enum here is the default (`SELF MEMBER STRANGER`); declare your
-own `enum Rights` in the interface to replace it. Reboot: construct the
-same `Ground` from the same two arguments — it wakes remembering, and
-offers no `init`, because the identity survived in the cells.
-
-**The wire, when a caller is remote.** An envelope is plain JSON:
-
-```json
-{
-  "from": "G…",
-  "to": "G…",
-  "seq": 1755170000000,
-  "op": { "ask": { "source": "{ pages }", "variables": {} } },
-  "sig": "base64 over canon({from, op, seq, to})"
-}
-```
-
-The ops are `describe`, `introspect`, `ask`, `rotate`, `release`,
-`acceptInvite`. An answer is `{ body, sig }`, signed by the being asked —
-verify against `pkOf(to)`, which `Client` does for you. A refusal is no
-answer at all; how silence rides your transport (a 204, an empty body) is
-the host module's choice. The library never opens a socket: your host
-listens however it likes and hands each envelope to `receive` —
-[the bench's sky.mjs](../bench/sky.mjs) is the reference harness for
-wiring grounds together.
-
-**The runbook, honestly.** Back up two things: the cells and the keychain
-secret — together they are the whole ground. A lost secret is permanent
-loss: nothing decrypts. A stolen secret plus stolen cells is total
-compromise, and rekey does not exist yet — destroy and recreate is
-today's remedy. The bench README's honest limits carry every known gap;
-read them before production.
-
-## The two halves
-
-**The server** is `Ground(Modules)` — modules are the whole of what a ground
-is handed, and the ground is exactly what they offer. The floor is `cells`
-(storage, including the one boot cell) and `keychain` (boot power as two
-operations, seal and unseal — the enclave's own shape once a phone hosts a
-ground); `paths`, `wire`, `contracts` and `blueprints` are
-taken if given; everything else is a module for programs. It installs itself
-the first time and boots from the same two forever after, and hands back
-three things while hiding everything it is made of:
-
-- `address` — its own admin being, aliased `Ground`.
-- `receive(envelope)` — the one handler. Every message for every being on the
-  ground arrives here and routes on the envelope's `to`. An address the
-  ground does not hold is silence. A host module that listens on a port, or
-  an app shell that calls in process, hands its envelopes to this and
-  nothing else — the library never opens a socket. `receive` answers the
-  signed `{ body, sig }` or `undefined` for silence; over HTTP, carry the
-  answer as the 200 response body and silence however you like (`nervurd`
-  uses an empty `204`) — no status code carries meaning, and a caller
-  trusts nothing but a verified signed answer.
-- `serve(voice)` — authority established once, and every face inherits it.
-
-A fresh ground has no identity, and no door for anyone to reach first: it
-offers `init(hand)` and nothing else — no `address`, no `receive`, no
-`serve`. Custody mints the voice off the machine, keeps the heir, and hands
-over `hand()` alone; a pack carrying its own successor is refused. The act
-is spent the moment it lands, and only `rotate(hand)` moves that voice
-after. Both are custody's own calls on the shelf, never doors — which is
-what running-is-custody looks like from the outside, stated rather than
-hidden.
-
-`unproven()` is custody's third call, and it is a read: the addresses whose
-writes have stopped proving, with when each was first and last seen and how
-many writes have been refused. A write is proven against the key on the
-being's `chain/pk` cell, so whoever holds the shelf can overwrite that cell
-and freeze a being's memory while it answers on, correctly signed and
-indistinguishable to every caller. The ground records that in its own host
-rows under `ground/` — no being reads them, nothing goes over the wire — and
-this is where a host reads them back. Show it to whoever operates the
-machine; a ground that has stopped proving its own writes is a custody
-incident, not a bug.
-
-**`serve` is the client, and it has four faces of one door.** `pointer(at)`
-is a plain object with one function per field, generated from the schema that
-caller is allowed to see. `gql(at)` is the raw document. `mcp(at)` is the
-same schema as tools, filtered the same way, so an agent gets exactly what
-its rights allow — a projection into JSON Schema, so scalar fields travel
-whole while unions and custom scalars flatten; the rights filtering happens
-on the SDL before the projection, so what flattens is shape, never
-permission. `client` is the bare envelope underneath all three. Each
-takes an address or an alias; each signs as the identity `serve` was given
-and verifies every answer against the address it asked.
-
-Delivery is local or remote through one API — a local answer and a remote
-one carry the same shape, and the calling code does not branch. Failure
-stays observable, as it always is: a missing endpoint or a dead ground is
-silence, and silence is something local delivery never answers with.
-
-## The files
-
-- [tools.mjs](tools.mjs) — the world's arithmetic, one frozen literal, and it
-  holds nothing: `digest`, `verifies`, `seal`/`unseal`/`secret`, `canon`
-  (canonical bytes), `envelope` (the signed message, numbered), `derive` (a
-  class key from a root), `address`/`pkOf` (StrKey, so every key is a Stellar
-  account and an address is a verification key). Same input, same output, any
-  machine — which is why an attacker computes all of it exactly as well as
-  you do. Nothing here holds a key: `envelope` assembles and numbers the
-  message and asks the voice it is handed to sign. Beside the literal stands
-  `Stamp`, the one stateful thing in the file: each caller mints one and
-  numbers its own envelopes, strictly rising. `Client` and a being's port
-  keep one lane per counterparty, so concurrent calls to the same door
-  land in order on their own; only a bare-envelope caller orders its own.
-- [voice.mjs](voice.mjs) — the identity: three private keys shut in a closure
-  and never reachable from outside. `Voice()` mints one already committed to
-  its own successor, `Voice.revive` wakes a packed one, `Voice.sealTo` seals
-  to a voice's box key and `voice.open` is the only thing that opens it.
-  `succeed()` retires both hands at once — the committed key starts speaking
-  and a fresh box starts reading. The re-wrap is the handover's own
-  choreography: the retiring voice still stands when `succeed()` returns, so
-  the holder opens with the old box and seals to the new one in the same
-  act, then discards the old voice — after which it opens nothing that
-  remains. `pack()` is the one door out — the ground's custody, and
-  precisely why hosting is custody.
-- [blueprint.mjs](blueprint.mjs) — the blueprint law. A program is compiled
-  from one serialisable source with no identity, no ground and no ambient
-  power in it: forbidden names are refused where they are read as powers and
-  shadowed at evaluation, the modules and bindings it needs are declared and
-  typed, the cells it keeps are declared with their class, its rights are its
-  own and every door declares them — a root field without `@rights`, or one
-  naming a right the enum never declared, is refused at compile — and the
-  whole of it digests to one canonical hash, rights included. Reformatting
-  the schema does not move the digest; a resolver digests by its source
-  text, so reformatting the code mints a new program. The forbidden-name
-  scan is a code-only regex, not a parser — a bounded blast radius, stated
-  as such, never a jail.
-- [program.mjs](program.mjs) — a blueprint made executable: every field
-  gated by the `@rights` it declares, resolver or no resolver, and
-  introspection curtained per caller exactly as describe is. Errors never
-  leave the house.
-- [modules.mjs](modules.mjs) — what a ground offers. `Cells` is dumb storage,
-  optionally a file. `Memory` is the memory law: reads free, writes signed by
-  the compartment's current voice, one version per cell, the chain by
-  prove-and-replace. `Clock` and `Entropy` are pinnable, so a program need
-  never reach for the wall. `Paths` resolves an address to an endpoint and
-  vouches for nothing; `Wire` carries; `Dns` is the directory they share.
-- [contract.mjs](contract.mjs) — an interface with a digest and nothing else.
-  What `needs.modules` cites, what a bound module's client is generated from,
-  and what `attest` judges a stander by: more than the contract asks is fine,
-  less is not.
-- [pointer.mjs](pointer.mjs) — `Pointer` and `Mcp`, both read off an SDL, so
-  no client is ever written by hand for a program.
-- [client.mjs](client.mjs) — the bare envelope client, usable on its own.
-  Signs as its voice, and verifies every reply from the address alone:
-  `pkOf(to)` is the key the being was born with, and each handover the reply
-  carries in `succession` is checked against the key before it, so a being
-  that has rotated is still provably itself to a caller that has never met
-  it. A chain that breaks anywhere is a dropped answer.
-- [being.mjs](being.mjs) — the being. `Compartment` seals a cell by its
-  class, `Port` carries authority both ways, `Being` is the door — prove,
-  read rights, execute, sign — and `Registry` creates, takes custody of,
-  activates and destroys, reachable only through the admin being.
-- [admin.mjs](admin.mjs) — the administrative program every ground installs
-  for itself, aliased `Ground`: census, create, activate, destroy, upgrade,
-  alias, attest, invite, drop, wear, and behind `SELF` alone extend; `wears`
-  answers any stranger with the livery being the ground wears. Upgrade is
-  custody moving the one cell that was always the core's to move: the
-  program is replaced in place — address, cells, refs and chain surviving —
-  refused whole when a cell the being holds would go undeclared, and visible
-  to every peer because `describe` answers the program's digest. It refuses
-  the ground's own address; that program moves only through `extend`, which
-  takes the custom part alone and lets the core compose it with the fixed
-  administration.
-- [ground.mjs](ground.mjs) — the sovereign ground, its one handler and
-  `serve`.
-- [index.mjs](index.mjs) — the surface an adopter imports.
-
-## The two reference tables
-
-A being keeps one row per direction, and nothing anywhere keeps a shared
-record of the relation.
-
-- **`refs/`** — who refers to me, and with what rights. This is the inbound
-  reference table: each entry is one capability the being issued, plus the
-  highest envelope number seen from that holder — which is what makes a
-  captured envelope worthless. A holder drops its own row with `release`;
-  the door answers it like any op and the row is gone for good.
-- **`handles/`** — whom I refer to, and under which face. Outbound, and the
-  face is a keypair minted per counterparty, so no two peers can correlate
-  the same being by its keys — timing and shape stay visible to whoever
-  already sees them.
-
-## Classes, not tiers
-
-No super-user stands inside the system — no voice passes every door. The
-host running the ground is custody, not a user: root on the live process
-holds everything, and stands outside every claim made here (the bench's
-honest limits say it whole). A `class` here is a cell's sealing class,
-never a JavaScript class — the code has none. A being holds one root
-secret, and every class of
-cell seals with a key derived from it — so a leaked class key opens one
-class. Today no path hands out a class key without the root: the partition
-prices a future delegation of reading and bounds a bug, it does not defend
-against a present leak. A blueprint declares which cells it keeps and under which class, and a
-resolver may write only those, plus its own refs and handles. Its program,
-its chain and its keys are the core's to move, never its own.
-
-## What an adopter brings
-
-Their own modules, their own programs, their own keys. A program names the
-contracts it needs and runs on any ground that stands them — as a module, or
-as a being, on this ground or another. A ground missing one refuses the
-creation rather than failing later. The regress ends at one cell: the ground
-needs just enough local storage to hold its own seed and where everything
-else lives.
-
-## The floor — what is mandatory, what is yours
-
-`Ground(Modules)` reads exactly seven names from what you hand it; every
-other name passes through untouched as a module for programs.
-
-- **`cells` — mandatory.** The shelf: `peek`/`put`/`keys`/`drop`/`dump`,
-  key to value, nothing else. Ships as a Map, optionally mirrored to one
-  JSON file. Swap it for anything that keeps those five promises
-  **synchronously, to a single writing process** — SQLite through a
-  synchronous driver, localStorage in a tab — the memory law versions
-  writes, it does not lock them, so exactly one ground writes a shelf. A
-  shared or remote store is never a cells swap: it stands behind its own
-  door as a memory being (bench suite 8), whose own ground is the single
-  writer of its own shelf. What sits on it: sealed content, the
-  deliberately unsealed
-  blueprints, and the shape — names, sizes, versions, timing. Sealed
-  content is safe wherever the shelf lives; the shape and the program
-  source are readable by whoever holds it, so where it lives decides who
-  sees those.
-- **`keychain` — mandatory.** Two operations, `seal` and `unseal`, guarding
-  the one cell that boots the ground — the ground hands its boot cell to
-  the keychain and never sees a secret at all. `Keychain(secret)` builds
-  one from 32 bytes; a KMS stands behind the same two operations as an API
-  call; the Secure Enclave stands behind them natively, because sealing
-  without exporting the key is exactly what such hardware does. Choosing
-  the keychain is the host's one security decision: a root-only file
-  restarts unattended and dies with the disk image; a KMS can refuse the
-  next boot — revocation stops tomorrow, it does not evict a thief who
-  already copied (rekey is owed; the bench's honest limits carry it); the
-  Enclave keeps the power in the device, and it never leaves. A keychain
-  that cannot unseal yields no ground at all.
-- **`paths` — optional; defaults to a private in-memory map.** The
-  phonebook: `publish`/`find`, address to endpoint, and it vouches for
-  nothing — a poisoned phonebook makes a being unreachable, never
-  impersonated, because the address verifies every answer.
-- **`wire` — optional; defaults to in-process delivery.** The courier:
-  `carry(endpoint, envelope)`. The library never opens a socket — a host
-  module listens on whatever transport it likes and hands envelopes to
-  `receive`; the wire carries the outbound ones.
-- **`contracts` — optional; empty by default.** The dictionary of
-  interfaces this ground can attest. Required the moment a module is bound
-  by address, so that `memory` offers the same interface under the same
-  digest on every ground and a pretender is refused. A digest pins shape;
-  what the words mean is the contract author's prose to state.
-- **`blueprints` — optional.** `blueprints.ground()` seeds the
-  administration's custom part at install. After that the part moves only
-  through the `extend` door, so a host that keeps its blueprint in a file
-  and hands it over with the CLI never needs this slot at all.
-- **`watch` — optional.** The custodian's eye: a function called at every
-  door decision with one frozen fact, `{ to, from, kind, outcome }`, and
-  the outcomes are a closed set — `no-door`, `unproven`, `replayed`,
-  `mute`, `answered`. It sees outcomes and outsides, never an op body and
-  never a cell — exactly as knowing as the host already is. The caller's
-  silence is untouched; a watch that throws changes nothing; no watch
-  costs nothing. Tracing, metrics and logs are a host package built on
-  this, never the library's.
-
-Boot, in order: a ground over an empty shelf offers `init(hand)` alone.
-Given the hand, it writes the admin being and seals that voice into one cell
-under the keychain. Every boot after: the keychain unseals, the voice
-revives, every being in custody is announced, the ground answers.
-`rotate(hand)` is the only thing that moves that voice, and it certifies the
-handover so every caller follows the ground from its address. `Clock` and
-`Entropy` are not floor: they are ordinary modules a program declares,
-pinnable so a program never reaches for the wall.
-
-## Extending the administration
-
-A ground's administration is a being like any other, and the only one whose
-context holds the registry — so a door that must create, upgrade or destroy
-beings belongs on it and nowhere else. Adopters extend it; nobody replaces
-it.
-
-Hand the custom part to the `extend` door — `SELF`'s alone — and the core
-composes it with the standard administration. What you supply is the part by
-itself, never the whole program, so the acts this ground owes can never go
-missing. The same door replaces the part and removes it. Write it as an
-ordinary blueprint whose schema **extends** the roots:
-
-```js
-const cases = `({
-  name: 'procese.cases',
-  needs: { caller: true, modules: [{ module: 'memory', contract: 'nervur.memory' }] },
-  memory: { 'case/*': { type: 'String', class: 'data' } },
-  interface: \`
-    extend type Mutation {
-      openCase(title: String!): String @rights(is: [SELF, MEMBER])
-    }
-  \`,
-  resolvers: {
-    Mutation: {
-      openCase: (_, { title }, { from, modules, registry }) => {
-        const at = registry.create({ program: CASE, refs: [{ address: from }] });
-        modules.memory.write('case/' + at, title);
-        return at ?? null;
-      },
-    },
-  },
-})`;
-
-await ground
-  .serve(self)
-  .pointer('Ground')
-  .then((it) => it.extend({ program: cases }));
+```bash
+npm install nervur
+npx nervur init
 ```
 
-The composed program is one blueprint with one digest, so `describe` answers
-what this ground's administration actually is, and an outsider can pin it.
-
-Three rules hold, and each refuses the whole extension rather than bending:
-
-1. **Standard door names are reserved.** Declare `create`, `census`,
-   `upgrade`, `destroy`, `alias`, `attest`, `opened`, `invite`, `drop` or
-   `extend` and the part is refused. You cannot change what a standard door
-   means — which is why a stranger may trust that if `create` answers, it
-   created.
-2. **Add only.** Use `extend type Query` / `extend type Mutation`; cell
-   names, module slots and `needs.config` may not collide with the
-   administration's own.
-3. **Close a door the way anything is closed here** — fence it behind a
-   right the ground never grants. The door stands, means what the
-   constitution says, and answers nobody: that is how an appliance ground
-   stops creating beings, without redefining a thing.
+| Package | What it is |
+| --- | --- |
+| [`@nervur-org/nervur`](https://www.npmjs.com/package/@nervur-org/nervur) | the library: harbor, ward and being, the protocol itself, with the spec inside |
+| [`@nervur-org/dock`](https://www.npmjs.com/package/@nervur-org/dock) | what every estate on Quo needs and nobody writes twice: the daemon, the command, the model sides and the screen |
+| [`@nervur-org/ui`](https://www.npmjs.com/package/@nervur-org/ui) | the kit: one token contract, one baseline, and the primitives a screen and a website both need. Knows nothing of Quo |
 
-The acts stay the core's own: an extension reaches them through the same
-registry face the standard doors use, so it can invent no power the standard
-administration lacked.
+It pins the library and the dock exactly, so that the name stands for one
+kit. Its own number counts up on its own, because a name and what it
+stands for are two things. An estate that wants the pieces apart installs
+them apart.
 
-## Writing a module
+<https://nervur.org> is the kit. <https://quo.systems> is the protocol.
 
-Five rules, each load-bearing:
+## License
 
-1. **A frozen object of functions and nothing else** — no classes, no
-   events, no state a being could share through it. State belongs behind a
-   door: a stateful module is a being with cells of its own, bound by
-   address under rule 5.
-2. **Params carry the authority.** The module holds no account, no key, no
-   ambient context: `stripe.charge({ account, apikey, amount })`. This is
-   what makes the same module safe to hand to every being on the ground —
-   without the context it opens nothing.
-3. **It knows nobody.** A module never learns which being calls; per-being
-   authority arrives through the blueprint's declared bindings, typed, with
-   a declared owner.
-4. **Undefined is refusal** — the same silence the door speaks, never an
-   error that narrates.
-5. **A module blueprints will name needs a contract** — the interface whose
-   fields mirror its calls, digested, so the same word means the same thing
-   on every ground. The ground attests a stander against it: more than the
-   contract asks is fine, less is not. A module a being stands remotely is
-   bound as `{ at, contract }`; the floor — cells, keychain, paths, wire —
-   is host code, because it must exist before any being can speak.
+Apache-2.0. Copyright 2026 Razvan Gherghina. See [LICENSE](LICENSE) and
+[NOTICE](NOTICE).

package/index.js

@@ -0,0 +1,17 @@
+// SPDX-License-Identifier: Apache-2.0
+// The name, and what stands under it. This package is the unscoped twin of
+// the `@nervur-org` scope: `import ... from 'nervur'` is the library, and
+// `npx nervur` is the dock's command. It pins the two exactly, because a
+// name that stands for the kit stands for one version of it.
+
+export * from '@nervur-org/nervur';
+
+/** The published packages, and what each one is. */
+export const PACKAGES = Object.freeze({
+  '@nervur-org/nervur': 'the library: harbor, ward and being, the first kit of Quo',
+  '@nervur-org/dock': 'what every estate on Quo needs and nobody writes twice',
+  '@nervur-org/ui': 'the kit: one token contract, one baseline, the primitives',
+});
+
+/** Where to read what the kit is. */
+export const HOMEPAGE = 'https://nervur.org';

package/nervur.js

@@ -0,0 +1,5 @@
+#!/usr/bin/env node
+// SPDX-License-Identifier: Apache-2.0
+// `nervur`: the dock's command under the kit's name. Every subcommand is the
+// dock's; this file only finds it.
+import '@nervur-org/dock/cli';

package/package.json

@@ -1,25 +1,42 @@
 {
   "name": "nervur",
-  "version": "0.14.0",
-  "description": "A distributed system of sovereign beings — one door, one question: by whose authority.",
-  "license": "Apache-2.0",
+  "version": "0.16.0",
+  "description": "Nervur's kit of Quo, under one name: the library re-exported, and the dock's command as nervur. The packages are @nervur-org/nervur, @nervur-org/dock and @nervur-org/ui.",
+  "keywords": [
+    "quo",
+    "nervur",
+    "protocol",
+    "capability",
+    "object-capability"
+  ],
   "author": "Razvan Gherghina",
+  "license": "Apache-2.0",
   "homepage": "https://nervur.org",
   "type": "module",
+  "engines": {
+    "node": ">=22.18"
+  },
+  "bin": {
+    "nervur": "./nervur.js"
+  },
   "exports": {
-    ".": "./index.mjs"
+    ".": "./index.js"
   },
-  "files": [
-    "*.mjs",
-    "GETTING-STARTED.md",
-    "NOTICE",
-    "SECURITY.md"
-  ],
-  "engines": {
-    "node": ">=22"
+  "scripts": {
+    "prepublishOnly": "test \"$QUO_GATED\" = 1 || { echo 'publish from the root, gated once: npm run release:nervur' >&2; exit 1; }"
   },
   "dependencies": {
-    "@noble/curves": "2.3.0",
-    "graphql": "^17.0.2"
-  }
+    "@nervur-org/dock": "0.3.0",
+    "@nervur-org/nervur": "0.3.0"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "files": [
+    "index.js",
+    "nervur.js",
+    "README.md",
+    "LICENSE",
+    "NOTICE"
+  ]
 }