@nervur-org/dock 0.3.0

package/dist/harbor/http.js

@@ -0,0 +1,177 @@
+// SPDX-License-Identifier: Apache-2.0
+// The HTTP door: one listener on loopback that a reverse proxy fronts, and
+// the routes mount on it by path prefix. `/health` is the harbor's own: the
+// wards it hosts, by name and pk, and nothing a stranger can use. Each route
+// lives in its own folder, `human/web.ts`, `harbor/quo.ts`, `mcp/route.ts`,
+// and this file knows none of them: a route is a handler under a prefix.
+//
+// This is the route contract every side is written against, and it stands
+// beside the disk harbor whose door it is. A route is `Request` in and
+// `Response` out, the shapes every runtime speaks, so a side runs on this
+// daemon, on a worker at the edge, in a browser's own service worker, on
+// Deno or on Bun without a line of it changing. A handler answering nothing
+// declines, and the mount tries what comes after it. A folder writing a
+// route takes `Handler`, `readAll` and `Quo` from here and nothing of the
+// daemon that mounts them.
+//
+// `listenHttp` is the one place Node's own objects appear: its door turns an
+// `IncomingMessage` into a `Request` and writes a `Response` back onto a
+// `ServerResponse`, and nothing downstream of it names either. The
+// translation runs that one way only: a `Request` is never dressed up as an
+// `IncomingMessage`, because a route writes headers and there would be
+// nothing to write them onto.
+//
+// The listener half of the socket reach is here too, and for the same reason:
+// holding a socket is the one thing no two runtimes do alike, so it stands
+// with the terrain's own door and never in a route. `ws` is that half on
+// Node; at the edge it is a `WebSocketPair` in the harbor there.
+import { createServer as createHttp } from 'node:http';
+import { Readable } from 'node:stream';
+import { WebSocketServer } from 'ws';
+import { Socket as Held } from '@nervur-org/nervur/harbor';
+// What a request may carry, on the doors that read a body: enough for any ask
+// a ward seals, and not a body chosen by whoever is on the other end.
+// The bytes are a `Uint8Array` and not a `Buffer`: a route runs on every
+// runtime, and node's own type is not one of the shapes they all speak.
+const BODY = 1 << 20;
+export async function readAll(req) {
+    if (!req.body)
+        return new Uint8Array(0);
+    const chunks = [];
+    let size = 0;
+    const reader = req.body.getReader();
+    for (;;) {
+        const { done, value } = await reader.read();
+        if (done)
+            break;
+        size += value.length;
+        if (size > BODY) {
+            await reader.cancel().catch(() => { });
+            return undefined;
+        }
+        chunks.push(value);
+    }
+    const all = new Uint8Array(size);
+    let at = 0;
+    for (const c of chunks) {
+        all.set(c, at);
+        at += c.length;
+    }
+    return all;
+}
+// The same body as text, for the doors that read one: JSON, a form, or a
+// vendor's signed bytes a being reads as a string.
+export async function readText(req) {
+    const raw = await readAll(req);
+    return raw === undefined ? undefined : new TextDecoder().decode(raw);
+}
+export async function listenHttp(harbor, host, port, quo) {
+    const mounts = new Map();
+    const server = createHttp((req, res) => {
+        const url = new URL(req.url ?? '/', `http://${req.headers.host ?? 'localhost'}`);
+        const answer = async () => {
+            if (url.pathname === '/health') {
+                // the wards it hosts, and the directory: pks and whether each is a
+                // socket held here, which is what an operator needs to see a dialer.
+                // Open to any origin: a tab reads it, and it holds nothing a stranger can use.
+                return Response.json({
+                    ok: true,
+                    wards: Object.fromEntries([...harbor.wards].map(([n, h]) => [n, h.pk])),
+                    reaches: Object.fromEntries([...harbor.reaches].map(([pk, b]) => [pk, b.held ? 'held' : 'reach'])),
+                    sockets: quo.sockets.size,
+                    dialers: quo.dialers.map((d) => ({ url: d.url, open: d.socket !== null })),
+                    // How many saves the disk refused, per ward. The asker whose
+                    // write was refused was told at the door; this is the operator's
+                    // half, and a box that says nothing about it looks healthy while
+                    // one world stops keeping anything.
+                    faults: Object.fromEntries([...harbor.faults]),
+                }, { headers: { 'access-control-allow-origin': '*' } });
+            }
+            for (const [prefix, handler] of mounts) {
+                if (url.pathname === prefix || url.pathname.startsWith(prefix + '/')) {
+                    const out = await handler(asRequest(req, url), url.pathname.slice(prefix.length));
+                    if (out)
+                        return out;
+                    break;
+                }
+            }
+            return Response.json({ error: 'no such route' }, { status: 404 });
+        };
+        void answer()
+            .then((out) => writeResponse(out, res))
+            .catch(() => {
+            if (!res.headersSent)
+                res.writeHead(500);
+            res.end();
+        });
+    });
+    await new Promise((ok, no) => {
+        server.once('error', no);
+        server.listen(port, host, () => ok());
+    });
+    hold(server, harbor, quo);
+    const address = server.address();
+    const bound = typeof address === 'object' && address !== null ? address.port : port;
+    return { server, host, port: bound, mount: (prefix, handler) => mounts.set(prefix.replace(/\/$/, ''), handler) };
+}
+// A dialer's held socket, this terrain's way: an upgrade at the quo route on
+// the daemon's own listener, held as the library's `Socket`. Its pks are bound
+// at announce, each proven at its door, and unbound when the line drops. The
+// route itself reads no socket, and every runtime holds one differently.
+function hold(server, harbor, quo) {
+    const wss = new WebSocketServer({ noServer: true });
+    server.on('upgrade', (req, socket, head) => {
+        const url = new URL(req.url ?? '/', 'http://localhost');
+        if (url.pathname.replace(/\/$/, '') !== '/quo')
+            return void socket.destroy(); // the proxy rewrites the route root to /quo/
+        wss.handleUpgrade(req, socket, head, (ws) => {
+            const s = new Held(ws, (pk, bytes) => harbor.deliver(pk, bytes), (far) => void harbor.bind(far, s, true), // a dialer's claims, each proven at its door: held here, reachable through this socket
+            () => {
+                harbor.unbind(s);
+                quo.sockets.delete(s);
+            });
+            quo.sockets.add(s);
+            s.announce([...harbor.doors.keys()]);
+        });
+    });
+}
+// Node's request as a `Request`: the one translation in, at the daemon's own
+// door. A method that carries no body carries none here either, since the
+// web shape refuses one.
+function asRequest(req, url) {
+    const headers = new Headers();
+    for (const [k, v] of Object.entries(req.headers)) {
+        if (v === undefined)
+            continue;
+        if (Array.isArray(v))
+            for (const one of v)
+                headers.append(k, one);
+        else
+            headers.set(k, v);
+    }
+    const method = req.method ?? 'GET';
+    const bodied = method !== 'GET' && method !== 'HEAD';
+    return new Request(url, {
+        method,
+        headers,
+        ...(bodied ? { body: Readable.toWeb(req), duplex: 'half' } : {}),
+    });
+}
+// And the one translation out.
+async function writeResponse(out, res) {
+    const headers = {};
+    out.headers.forEach((v, k) => {
+        headers[k] = k === 'set-cookie' ? [...(Array.isArray(headers[k]) ? headers[k] : []), v] : v;
+    });
+    res.writeHead(out.status, headers);
+    if (!out.body)
+        return void res.end();
+    const reader = out.body.getReader();
+    for (;;) {
+        const { done, value } = await reader.read();
+        if (done)
+            break;
+        res.write(Buffer.from(value));
+    }
+    res.end();
+}

package/dist/harbor/idb.d.ts

@@ -0,0 +1,15 @@
+import { type Kept, type Store, type WardRecord } from '@nervur-org/nervur/harbor';
+export declare class Idb implements Store {
+    #private;
+    readonly name: string;
+    constructor(name?: string);
+    list(): Promise<string[]>;
+    load(name: string): Promise<Kept | undefined>;
+    put(name: string, kept: Kept): Promise<void>;
+    save(name: string, partition: Record<string, unknown>, rows: readonly string[]): Promise<void>;
+    record(name: string, record: WardRecord): Promise<void>;
+    take(name: string): Promise<Kept | undefined>;
+    hints(): Promise<Record<string, string>>;
+    hint(pk: string, url: string): Promise<void>;
+    close(): void;
+}

package/dist/harbor/quo.d.ts

@@ -0,0 +1,10 @@
+import { type Handler } from './http.ts';
+export type Deliver = {
+    deliver(pk: string, bytes: Uint8Array): Promise<Uint8Array | undefined>;
+};
+export declare const OPEN: {
+    'access-control-allow-origin': string;
+    'access-control-allow-methods': string;
+    'access-control-allow-headers': string;
+};
+export declare function quoRoute(harbor: Deliver): Handler;

package/dist/harbor/quo.js

@@ -0,0 +1,42 @@
+// SPDX-License-Identifier: Apache-2.0
+// The quo. route: the door sealed bytes arrive at, the same route on every
+// terrain. POST `/quo/<pk>` carries one ask to a pk this harbor holds or
+// holds a socket for; bytes from here go to an own door or a held socket,
+// never onward. A URL of this route is the base of every reach.
+//
+// It is `Request` in and `Response` out and names no runtime, so the daemon
+// mounts it under `/quo` behind the proxy that maps the quo. hostname and the
+// worker at the edge mounts it under its own prefix.
+//
+// The listener half of the socket reach is not here, because holding a socket
+// is the one thing no two runtimes do alike: `ws` on Node, at the daemon's
+// own door in `http.ts`, and a `WebSocketPair` at the edge, in the harbor
+// there. What a dialer's socket becomes once it is held is the library's
+// `Socket` on both.
+import { SUITE } from '@nervur-org/nervur/harbor';
+import { readAll } from './http.js';
+// The route is public and carries sealed bytes, so any origin may POST
+// to it: a tab on a world's web. reaching another world's quo. is the
+// ordinary case, and a binary POST needs the preflight answered.
+export const OPEN = { 'access-control-allow-origin': '*', 'access-control-allow-methods': 'POST, OPTIONS', 'access-control-allow-headers': 'content-type, quo-suite' };
+export function quoRoute(harbor) {
+    return async (req, rest) => {
+        if (req.method === 'OPTIONS')
+            return new Response(null, { status: 204, headers: OPEN });
+        // The wire suite the caller speaks. Absent is this one, because a caller
+        // older than the header is this one. Anything else this door cannot open
+        // and says so as nothing delivered, rather than taking bytes that will
+        // never open and answering a silence that names no reason.
+        const suite = req.headers.get('quo-suite');
+        if (suite !== null && suite !== String(SUITE))
+            return Response.json({ error: `this door speaks wire suite ${SUITE}` }, { status: 404, headers: OPEN });
+        const pk = rest.replace(/^\//, '');
+        if (req.method !== 'POST' || !/^[0-9a-f]{128}$/.test(pk))
+            return Response.json({ error: 'POST /quo/<pk>' }, { status: 404, headers: OPEN });
+        const raw = await readAll(req);
+        const back = raw === undefined ? undefined : await harbor.deliver(pk, raw);
+        if (back === undefined)
+            return Response.json({ error: 'no reach for that pk' }, { status: 404, headers: OPEN });
+        return new Response(new Uint8Array(back), { headers: { 'content-type': 'application/octet-stream', ...OPEN } });
+    };
+}

package/dist/harbor/resolve.d.ts

@@ -0,0 +1,16 @@
+type Context = {
+    parentURL?: string;
+    conditions: string[];
+    importAttributes: Record<string, string>;
+};
+type Resolved = {
+    url: string;
+    format?: string | null;
+    shortCircuit?: boolean;
+};
+type Next = (specifier: string, context: Context) => Promise<Resolved>;
+export declare function initialize(data: {
+    parent: string;
+}): void;
+export declare function resolve(specifier: string, context: Context, next: Next): Promise<Resolved>;
+export {};

package/dist/harbor/resolve.js

@@ -0,0 +1,17 @@
+let parent = '';
+export function initialize(data) {
+    parent = data.parent;
+}
+const bare = (s) => !s.startsWith('.') && !s.startsWith('/') && !/^[a-z]+:/i.test(s);
+export async function resolve(specifier, context, next) {
+    try {
+        return await next(specifier, context);
+    }
+    catch (e) {
+        const missing = e.code === 'ERR_MODULE_NOT_FOUND';
+        const from = context.parentURL ?? '';
+        if (missing && parent && bare(specifier) && from.startsWith('file:') && !from.includes('/node_modules/'))
+            return next(specifier, { ...context, parentURL: parent });
+        throw e;
+    }
+}

package/dist/harbor/seal.d.ts

@@ -0,0 +1,3 @@
+export declare function sealKey(secret: string): Promise<CryptoKey>;
+export declare function seal(key: CryptoKey, bytes: Uint8Array): Promise<string>;
+export declare function open(key: CryptoKey, sealed: string): Promise<Uint8Array>;

package/dist/harbor/seal.js

@@ -0,0 +1,25 @@
+// SPDX-License-Identifier: Apache-2.0
+// The seal: what a store does to a ward's bytes before they rest on a data
+// store, under one key the secret store holds. One piece with three users,
+// the edge under the platform's secret, the daemon under a key from its
+// environment, the phone under a key from the Keychain. AES-GCM under a
+// 32-byte key, a fresh nonce each time, nonce and ciphertext together as
+// hex. WebCrypto only, so it runs wherever a store does.
+import { arithmetic } from '@nervur-org/nervur/ward';
+const { hex, unhex } = arithmetic;
+// Bytes as the platform's crypto wants them: over a plain ArrayBuffer.
+const plain = (b) => new Uint8Array(b);
+export async function sealKey(secret) {
+    if (!/^[0-9a-f]{64}$/.test(secret))
+        throw new Error('a seal key is 32 bytes as hex');
+    return crypto.subtle.importKey('raw', plain(unhex(secret)), 'AES-GCM', false, ['encrypt', 'decrypt']);
+}
+export async function seal(key, bytes) {
+    const iv = crypto.getRandomValues(new Uint8Array(12));
+    const ct = new Uint8Array(await crypto.subtle.encrypt({ name: 'AES-GCM', iv }, key, plain(bytes)));
+    return hex(iv) + hex(ct);
+}
+export async function open(key, sealed) {
+    const b = plain(unhex(sealed));
+    return new Uint8Array(await crypto.subtle.decrypt({ name: 'AES-GCM', iv: b.subarray(0, 12) }, key, b.subarray(12)));
+}

package/dist/harbor/sealed.d.ts

@@ -0,0 +1,35 @@
+import type { Kept, Store, WardRecord } from '@nervur-org/nervur/harbor';
+export type Files = {
+    exists(path: string): Promise<boolean>;
+    read(path: string): Promise<string>;
+    write(path: string, text: string): Promise<void>;
+    remove(path: string): Promise<void>;
+    mkdir(path: string): Promise<void>;
+    rmdir(path: string): Promise<void>;
+    list(path: string): Promise<string[]>;
+};
+export type Secrets = {
+    get(item: string): Promise<string | undefined>;
+    set(item: string, value: string): Promise<void>;
+    remove(item: string): Promise<void>;
+};
+export declare class Sealed implements Store {
+    #private;
+    readonly harbor: string;
+    private constructor();
+    static open(harbor: string, files: Files, secrets: Secrets): Promise<Sealed>;
+    static wipe(harbor: string, files: Files, secrets: Secrets): Promise<void>;
+    list(): Promise<string[]>;
+    load(name: string): Promise<Kept | undefined>;
+    put(name: string, kept: Kept): Promise<void>;
+    save(name: string, partition: Record<string, unknown>): Promise<void>;
+    record(name: string, record: WardRecord): Promise<void>;
+    take(name: string): Promise<Kept | undefined>;
+    hints(): Promise<Record<string, string>>;
+    hint(pk: string, url: string): Promise<void>;
+}
+export declare function inMemory(): {
+    files: Files;
+    secrets: Secrets;
+    disk: Map<string, string>;
+};

package/dist/harbor/sealed.js

@@ -0,0 +1,162 @@
+// SPDX-License-Identifier: Apache-2.0
+// The sealed store: the store an app holds on a device in a hand, the phone
+// and the desk alike. One key per harbor in the platform's secret store,
+// this device only, so it never travels in a backup; one sealed file per
+// ward, seed, partition and record as one blob, in a folder no backup
+// copies. The seal is `seal.ts`, the same piece the daemon and the edge use.
+//
+//   <files>/<harbor>/wards/<name>.sealed
+//   <files>/<harbor>/reach.json
+//   <secrets>: quo-<harbor>                32 bytes as hex
+//
+// Custody is the backup question, and opening the store answers it: a key
+// with no folder is a reinstall, and the stale key is deleted; a folder
+// with no key is a restore to another device, and the unreadable files are
+// deleted. Either way the harbor starts fresh and there is never a twin.
+//
+// What a platform gives is two small things, files and secrets, and the
+// rest is here once: the phone hands its plugins, the desk hands its core,
+// and the memory harbor hands a map, which is where the rule is proven.
+import { arithmetic } from '@nervur-org/nervur/ward';
+import { sealKey, seal, open } from './seal.js';
+const { hex, unhex } = arithmetic;
+export class Sealed {
+    harbor;
+    #files;
+    #key;
+    #queues = new Map();
+    constructor(harbor, files, key) {
+        this.harbor = harbor;
+        this.#files = files;
+        this.#key = key;
+    }
+    // Open one harbor's store, applying the custody rule, minting the key and
+    // the folder when this is a fresh install.
+    static async open(harbor, files, secrets) {
+        const item = `quo-${harbor}`;
+        const root = `quo/${harbor}`;
+        let secret = await secrets.get(item);
+        const folder = await files.exists(root);
+        if (secret && !folder) {
+            await secrets.remove(item);
+            secret = undefined;
+        }
+        if (!secret && folder)
+            await files.rmdir(root);
+        if (!secret) {
+            secret = hex(crypto.getRandomValues(new Uint8Array(32)));
+            await secrets.set(item, secret);
+        }
+        if (!(await files.exists(`${root}/wards`)))
+            await files.mkdir(`${root}/wards`);
+        return new Sealed(harbor, files, await sealKey(secret));
+    }
+    // Everything this harbor has, key and files: what a person does by hand
+    // to leave a device, and what a test does between two openings.
+    static async wipe(harbor, files, secrets) {
+        await secrets.remove(`quo-${harbor}`);
+        if (await files.exists(`quo/${harbor}`))
+            await files.rmdir(`quo/${harbor}`);
+    }
+    #path(name) {
+        return `quo/${this.harbor}/wards/${name}.sealed`;
+    }
+    async #read(name) {
+        const data = await this.#files.read(this.#path(name));
+        return JSON.parse(new TextDecoder().decode(await open(this.#key, data.trim())));
+    }
+    // A sealed ward is rewritten whole, so the read sits inside the queue
+    // with the write: two changes to one ward never lose each other's part.
+    #keep(name, change) {
+        const next = (this.#queues.get(name) ?? Promise.resolve()).then(async () => {
+            const blob = change((await this.#files.exists(this.#path(name))) ? await this.#read(name) : undefined);
+            const sealed = await seal(this.#key, new TextEncoder().encode(JSON.stringify(blob)));
+            await this.#files.write(this.#path(name), sealed + '\n');
+        });
+        this.#queues.set(name, next.catch(() => { }));
+        return next;
+    }
+    async list() {
+        const files = await this.#files.list(`quo/${this.harbor}/wards`);
+        return files.filter((f) => f.endsWith('.sealed')).map((f) => f.slice(0, -'.sealed'.length));
+    }
+    async load(name) {
+        if (!(await this.#files.exists(this.#path(name))))
+            return undefined;
+        const b = await this.#read(name);
+        return { seed: unhex(b.seed), partition: b.partition, record: b.record };
+    }
+    async put(name, kept) {
+        if (await this.#files.exists(this.#path(name)))
+            throw new Error(`ward ${name} already exists on this device`);
+        return this.#keep(name, () => ({ seed: hex(kept.seed), partition: kept.partition, record: kept.record }));
+    }
+    async save(name, partition) {
+        if (!(await this.#files.exists(this.#path(name))))
+            return; // a name not kept is nothing
+        return this.#keep(name, (b) => ({ ...b, partition }));
+    }
+    async record(name, record) {
+        if (!(await this.#files.exists(this.#path(name))))
+            return;
+        return this.#keep(name, (b) => ({ ...b, record }));
+    }
+    async take(name) {
+        const kept = await this.load(name);
+        if (!kept)
+            return undefined;
+        await this.#queues.get(name);
+        await this.#files.remove(this.#path(name));
+        return kept;
+    }
+    async hints() {
+        const p = `quo/${this.harbor}/reach.json`;
+        if (!(await this.#files.exists(p)))
+            return {};
+        return JSON.parse(await this.#files.read(p));
+    }
+    async hint(pk, url) {
+        const all = await this.hints();
+        all[pk] = url;
+        await this.#files.write(`quo/${this.harbor}/reach.json`, JSON.stringify(all) + '\n');
+    }
+}
+// Files and secrets in memory, for a suite and for a box that keeps
+// nothing: the custody rule is proven here once and holds on every
+// platform that hands the two.
+export function inMemory() {
+    const disk = new Map();
+    const dirs = new Set();
+    const vault = new Map();
+    const under = (dir) => [...disk.keys()].filter((k) => k.startsWith(`${dir}/`));
+    const files = {
+        exists: async (p) => disk.has(p) || dirs.has(p),
+        read: async (p) => {
+            const v = disk.get(p);
+            if (v === undefined)
+                throw new Error(`no such file: ${p}`);
+            return v;
+        },
+        write: async (p, text) => void disk.set(p, text),
+        remove: async (p) => void disk.delete(p),
+        mkdir: async (p) => {
+            const parts = p.split('/');
+            for (let i = 1; i <= parts.length; i += 1)
+                dirs.add(parts.slice(0, i).join('/'));
+        },
+        rmdir: async (p) => {
+            for (const k of under(p))
+                disk.delete(k);
+            for (const d of [...dirs])
+                if (d === p || d.startsWith(`${p}/`))
+                    dirs.delete(d);
+        },
+        list: async (p) => under(p).map((k) => k.slice(p.length + 1)).filter((k) => !k.includes('/')),
+    };
+    const secrets = {
+        get: async (i) => vault.get(i),
+        set: async (i, v) => void vault.set(i, v),
+        remove: async (i) => void vault.delete(i),
+    };
+    return { files, secrets, disk };
+}

package/dist/harbor/tauri.d.ts

@@ -0,0 +1,16 @@
+import type { BeingClass, JsonObject } from '@nervur-org/nervur';
+import { Notifications } from '../dock/index.ts';
+import { BrowserHarbor } from './browser.ts';
+import { type Files, type Secrets } from './sealed.ts';
+export type Core = {
+    invoke(cmd: string, args?: Record<string, unknown>): Promise<unknown>;
+};
+export declare class DeskNotifications extends Notifications {
+    #private;
+    constructor(stance: ConstructorParameters<typeof Notifications>[0], core: Core);
+    notify(args: JsonObject): Promise<JsonObject>;
+}
+export declare const deskLent: Record<string, string>;
+export declare function deskFiles(core: Core): Files;
+export declare function deskSecrets(core: Core): Secrets;
+export declare function deskHarbor(core: Core, name?: string, classes?: Record<string, BeingClass>): Promise<BrowserHarbor>;

package/dist/harbor/tauri.js

@@ -0,0 +1,59 @@
+import { NOTIFICATIONS, Notifications } from '../dock/index.js';
+import { BrowserHarbor } from './browser.js';
+import { Sealed } from './sealed.js';
+export class DeskNotifications extends Notifications {
+    #core;
+    constructor(stance, core) {
+        super(stance);
+        this.#core = core;
+    }
+    async notify(args) {
+        const title = typeof args.title === 'string' ? args.title : '';
+        const body = typeof args.body === 'string' ? args.body : '';
+        await this.#core.invoke('notify', { title, body });
+        return { shown: true };
+    }
+}
+// What a desk lends: its notification center, under the name every box
+// lends it under. Location is what the platform gives, which on a desk is
+// nothing, so it is not lent rather than lent and dumb. No timer either: a
+// desk holds presences and no home, so no Clock lives on it and a Timer
+// there would arm for nobody. A Timer stands only on a box that hosts a
+// home.
+export const deskLent = { [NOTIFICATIONS]: 'Notifications' };
+// The two seams over the core's commands. Paths are relative to the app's
+// data folder, and the core refuses one that climbs out of it.
+export function deskFiles(core) {
+    return {
+        exists: (path) => core.invoke('file_exists', { path }),
+        read: (path) => core.invoke('file_read', { path }),
+        write: async (path, text) => void (await core.invoke('file_write', { path, text })),
+        remove: async (path) => void (await core.invoke('file_remove', { path })),
+        mkdir: async (path) => void (await core.invoke('dir_make', { path })),
+        rmdir: async (path) => void (await core.invoke('dir_remove', { path })),
+        list: (path) => core.invoke('dir_list', { path }),
+    };
+}
+export function deskSecrets(core) {
+    return {
+        get: async (item) => (await core.invoke('secret_get', { item })) ?? undefined,
+        set: async (item, value) => void (await core.invoke('secret_set', { item, value })),
+        remove: async (item) => void (await core.invoke('secret_remove', { item })),
+    };
+}
+// The desk app's one harbor, booted, lending what the desk has to its
+// wards. The core hands the faculty its notification center by being in
+// the class body the harbor holds, which is the one place a terrain's
+// body may hold a live object.
+export async function deskHarbor(core, name = 'quo', classes = {}) {
+    class Center extends DeskNotifications {
+        constructor(stance) {
+            super(stance, core);
+        }
+    }
+    const store = await Sealed.open(name, deskFiles(core), deskSecrets(core));
+    const h = new BrowserHarbor(store, { Notifications: Center, ...classes });
+    await h.stand(deskLent);
+    await h.boot();
+    return h;
+}

package/dist/harbor/ward.d.ts

@@ -0,0 +1,9 @@
+import type { Hosted } from '@nervur-org/nervur/harbor';
+export type Row = {
+    class: string | null;
+    public: boolean;
+    digest: string | null;
+    absent?: boolean;
+};
+export declare function beingsOf(h: Hosted): Promise<Record<string, Row>>;
+export declare function publicKey(h: Hosted): Promise<string | null>;

package/dist/harbor/ward.js

@@ -0,0 +1,15 @@
+// Every being of the ward, by key: the ones a door holds this run and the
+// ones whose class did not construct, which are hers all the same.
+export async function beingsOf(h) {
+    const bp = (await h.ask());
+    return bp.notes?.beings ?? {};
+}
+// The key of the one public being, or null. The ward marks her and the ward
+// is asked, because no harbor reads that mark and none should: which being
+// answers strangers is a decision, and a harbor decides nothing.
+export async function publicKey(h) {
+    for (const [key, row] of Object.entries(await beingsOf(h)))
+        if (row.public)
+            return key;
+    return null;
+}

package/dist/human/app.d.ts

@@ -0,0 +1,32 @@
+import type { Harbor } from '@nervur-org/nervur/harbor';
+import type { Invitation, JsonObject } from '@nervur-org/nervur';
+import { type Joined, type World } from './worlds.ts';
+import { type Bell } from './wake.ts';
+import type { Token } from '../dock/index.ts';
+import type { Config } from './tab.ts';
+export type Learn = (at: string) => Promise<Config>;
+export declare const learn: Learn;
+export type Dialing = Harbor & {
+    dial(url: string): unknown;
+};
+export type Ear = () => Promise<Token | null>;
+export type AppOptions = {
+    harbor: Dialing;
+    kept: Joined;
+    root: HTMLElement;
+    learn?: Learn;
+    opened?: {
+        at: string;
+        invitation?: Invitation;
+    };
+    ear?: Ear;
+    bell?: Bell;
+};
+export type Running = {
+    show(pk: string): Promise<void>;
+    open(at: string, invitation?: Invitation): Promise<void>;
+    woken(): Promise<JsonObject[]>;
+    worlds(): World[];
+    close(): Promise<void>;
+};
+export declare function app(o: AppOptions): Promise<Running>;