@quo-systems/dock 0.1.0

package/harbor/idb.ts

@@ -0,0 +1,90 @@
+// SPDX-License-Identifier: Apache-2.0
+// The store as IndexedDB, per origin: one database per harbor, one record
+// per ward holding seed, partition and record, and one record for the
+// directory's hints. The honest weakness the harbor document names: a tab
+// has no secret store for bytes, so the seed sits beside the partition,
+// guarded by the origin and nothing more. That is the price of a tab.
+import { values, type Kept, type Store, type WardRecord } from '@quo-systems/quo/harbor';
+
+const WARDS = 'wards',
+  HINTS = 'hints';
+
+function open(name: string): Promise<IDBDatabase> {
+  return new Promise((ok, no) => {
+    const req = indexedDB.open(name, 1);
+    req.onupgradeneeded = () => {
+      req.result.createObjectStore(WARDS);
+      req.result.createObjectStore(HINTS);
+    };
+    req.onsuccess = () => ok(req.result);
+    req.onerror = () => no(req.error ?? new Error('indexedDB would not open'));
+  });
+}
+
+function done<T>(req: IDBRequest<T>): Promise<T> {
+  return new Promise((ok, no) => {
+    req.onsuccess = () => ok(req.result);
+    req.onerror = () => no(req.error ?? new Error('indexedDB request failed'));
+  });
+}
+
+type Row = { seed: Uint8Array; partition: Record<string, unknown>; record: WardRecord };
+
+export class Idb implements Store {
+  readonly name: string;
+  #db: Promise<IDBDatabase> | undefined;
+  constructor(name = 'quo') {
+    this.name = name;
+  }
+  #open(): Promise<IDBDatabase> {
+    return (this.#db ??= open(this.name));
+  }
+  async #tx(store: string, mode: IDBTransactionMode): Promise<IDBObjectStore> {
+    return (await this.#open()).transaction(store, mode).objectStore(store);
+  }
+
+  async list(): Promise<string[]> {
+    return (await done((await this.#tx(WARDS, 'readonly')).getAllKeys())).map(String);
+  }
+  async load(name: string): Promise<Kept | undefined> {
+    const row = (await done((await this.#tx(WARDS, 'readonly')).get(name))) as Row | undefined;
+    return row && { seed: new Uint8Array(row.seed), partition: values(row.partition), record: row.record };
+  }
+  async put(name: string, kept: Kept): Promise<void> {
+    const st = await this.#tx(WARDS, 'readwrite');
+    if ((await done(st.getKey(name))) !== undefined) throw new Error(`ward ${name} already exists in ${this.name}`);
+    await done(st.put({ seed: kept.seed, partition: values(kept.partition), record: kept.record } satisfies Row, name));
+  }
+  async save(name: string, partition: Record<string, unknown>): Promise<void> {
+    const st = await this.#tx(WARDS, 'readwrite');
+    const row = (await done(st.get(name))) as Row | undefined;
+    if (!row) return;
+    await done(st.put({ ...row, partition: values(partition) } satisfies Row, name));
+  }
+  async record(name: string, record: WardRecord): Promise<void> {
+    const st = await this.#tx(WARDS, 'readwrite');
+    const row = (await done(st.get(name))) as Row | undefined;
+    if (!row) return;
+    await done(st.put({ ...row, record } satisfies Row, name));
+  }
+  async take(name: string): Promise<Kept | undefined> {
+    const kept = await this.load(name);
+    if (!kept) return undefined;
+    await done((await this.#tx(WARDS, 'readwrite')).delete(name));
+    return kept;
+  }
+  async hints(): Promise<Record<string, string>> {
+    const st = await this.#tx(HINTS, 'readonly');
+    const keys = (await done(st.getAllKeys())).map(String);
+    const vals = (await done(st.getAll())) as string[];
+    return Object.fromEntries(keys.map((k, i) => [k, vals[i]!]));
+  }
+  async hint(pk: string, url: string): Promise<void> {
+    await done((await this.#tx(HINTS, 'readwrite')).put(url, pk));
+  }
+
+  close(): void {
+    void this.#db?.then((db) => db.close());
+    this.#db = undefined;
+  }
+}

package/harbor/quo-harbor.md

@@ -0,0 +1,403 @@
+# Transports
+
+This is how a harbor lives on a real device and how two of them meet over a real
+network. It implements the harbor of `packages/quo/SPEC.md` on every terrain and
+adds nothing to it: a harbor boots wards, keeps what they are made of, carries
+bytes to one pk, returns what came back or nothing, never reads them, and
+answers nothing only where it knows nothing was sent. This document names no
+being and no side; it knows seeds, partitions, code, sockets and disks.
+
+## One harbor per device, one ward per world
+
+A device runs one harbor. It is what the device already has, offered to Quo,
+and there is one of it because a device has one keychain, one disk and one
+set of processes. Two harbors on one device are a curiosity, not a design.
+
+A harbor hosts many wards, and a ward is a world: a seed, a partition and a
+body of code, with an origin. The wards of the device's owner and wards
+whose code came from a stranger are hosted the same way. A native app is
+therefore a browser of worlds: one harbor, a ward per world, each in its own
+runtime, and the screen showing one at a time.
+
+A ward is whole only where all three of its parts are. The harbor keeps a
+**ward record** per ward, and it is the harbor's, never the ward's:
+
+```
+ward record
+  pk         derived from the seed; the key of the record
+  seed       where it is, in the secret store
+  partition  where it is, in the data store
+  code       where the class bodies come from, and which version boots
+```
+
+## Three parts, three native places
+
+The harbor adapts nothing. Every terrain already has a place for secrets, a
+place for data and a place for code, and those are the three the harbor
+needs:
+
+| a ward is   | Mac, iPhone           | droplet                    | edge                    | browser tab            |
+| ----------- | --------------------- | -------------------------- | ----------------------- | ---------------------- |
+| seed        | Keychain              | `.env` or a secrets file   | the platform's secrets  | IndexedDB, per origin  |
+| partition   | app data, SQLite      | a file on disk             | Durable Object storage  | IndexedDB, per origin  |
+| code        | the app bundle        | a folder                   | the deployed worker     | a bundle URL           |
+
+Envoys read their own secrets from the same secret store as the seed. A
+device has one place for secrets and the harbor is one more user of it.
+
+The browser column is the honest weakness: a tab has no secret store for
+bytes, so the seed sits beside the partition, guarded by the origin and
+nothing more. That is the price of a tab, and why a tab is a rented room and
+a native app is not.
+
+### The partition, split or wrapped
+
+Inside the partition one branch is secret, the bind table: each standing's
+current and next keys, and the heirs minted and not yet spoken. Everything
+else is data. The partition is values only and the harbor may persist it as
+it likes, so it may keep the secret branch apart from the data, by terrain:
+
+- **Split.** The bind branch goes to the secret store beside the seed, the
+  rest to the data store. Fits a phone with a few relations; keychain items
+  are small and a being with a thousand standings has a thousand key pairs.
+- **Wrapped.** The secret store holds one key per ward; the data store holds
+  the whole partition encrypted under it. Any size, one secret. The droplet
+  and edge answer, and it works on the phone too.
+
+The ward never knows. It hands values and gets values back. A heir given away
+as an invitation is a live credential until it speaks, and on a device other
+apps share that is the argument for the secret store.
+
+### Custody is a lease
+
+`packages/quo/SPEC.md` makes custody the harbor's vouch: two harbors over one
+seed are two wards with one pk, and a harbor refuses to boot a ward another
+running harbor holds. The dock makes that a property of the store, not a rule
+people follow: a lease beside the seed in the secret store, taken by the daemon
+that boots the ward, checked before any boot, refused while held. A restored
+backup meets a held lease and does not boot. A second tab on one origin meets a
+lock and becomes a screen. The edge is a Durable Object, which is the lease
+built in. None of it stops a deliberate copy, and nothing can; it stops every
+accident, and accidents are the whole population of this problem.
+
+### Migration is three moves
+
+A ward moves between harbors by moving its three parts: the seed from one
+secret store to another, the partition from one data store to another, and
+the new harbor pointed at the same code. Same seed, same pk, every standing
+anyone holds still points at her. The old harbor deletes its copies first:
+two harbors holding one seed are two wards with one pk, diverging silently.
+
+### Code is a harbor decision
+
+A ward's code has an origin: a folder the owner wrote, a bundle a world
+published, a worker deployed. When the origin ships new bodies the harbor
+decides whether the ward reboots on them. A reboot is silent, the ward cannot
+tell old bodies from new, and a body the cells were not written for is an
+absence this run. So the harbor pins what a ward boots on, records it in the
+ward record, and moves it deliberately: on its own for the owner's own code,
+with the owner's word for a world's.
+
+## The daemon, and the two cores
+
+There are two harbor cores, and every device runs one of them:
+
+- **The node daemon**, `quo serve`. A disk or keychain store, a unix socket
+  for the owner, listeners on localhost for the routes. Droplet, Mac, Linux
+  box, and a desktop app that ships it as a sidecar.
+- **The browser harbor.** A dialer inside a webview or a tab, an IndexedDB or
+  SQLite store, one socket per world it is connected to. A tab, and a mobile
+  app that wraps one.
+
+Tauri and Capacitor are packaging, not harbors. A desktop app ships the
+daemon and a window, and is owner-capable through the socket. A mobile app
+ships the browser harbor with a native store and push, and is its own owner
+for its one harbor. The edge is the daemon's core over a Durable Object, one
+single-writer object per ward, or it diverges.
+
+A wrapped app carries its own bundle and never loads it from a hostname.
+Only a plain tab fetches the bundle from a world's `web.`, because it has
+nowhere else to get it. A wrapped app visits a world's `web.` exactly once,
+in a system browser sheet, to do the credential exchange and come back with
+an invitation; after that it speaks to that world's `quo.` for bytes and
+never to its `web.` again. One app on a device meets many worlds, one ward
+each, and there is never an app per world.
+
+## Listeners and dialers
+
+Two kinds of harbor exist in the world, and every pair reduces to them:
+
+| terrain      | can be dialed | can dial | lifetime                | wakes on |
+| ------------ | ------------- | -------- | ----------------------- | -------- |
+| droplet      | yes           | yes      | as long as wanted       | itself   |
+| edge         | yes           | fetch    | per request             | request  |
+| desktop app  | no            | yes      | while running           | itself   |
+| phone app    | no            | yes      | foreground, throttled   | push     |
+| browser tab  | no            | yes      | while open              | itself   |
+
+A ward on a dialer is reached only if its harbor dialed first and something
+holds that line open. A phone's ask must survive a push wake-up. A tab is a
+device, and one seed never lives in two tabs.
+
+## Transport by necessity
+
+Transport is chosen by necessity and nothing else. Two wards in one harbor:
+no transport, the harbor calls its other door. Both harbors can listen: a
+request, plain HTTP or raw TCP, and a reverse ask is a request the other
+way. One of them cannot listen, behind NAT, in a tab, on a phone: a socket,
+opened by the one that can dial and held by the one that can listen, with
+both sides sending asks over it and a frame id matching replies. There is no
+fourth situation, so there is no fourth reach, and none is ever picked
+because it is nice. A being cannot tell which one carried her ask, and that
+is the proof the choice was free.
+
+A connection is a reach, never a harbor, and a ward outlives it. When a
+socket drops, the listener's directory entry for that pk goes with it, the
+listener answers nothing, the dialer's harbor turns that into unreached, and
+the relation is untouched: seed, partition and keys are on the dialer, not on
+the wire. When the dialer reconnects it announces its pks, the listener
+probes each one at its door and rebinds what proved, and the next ask goes
+through under the same keys and the same count. A phone in a tunnel loses
+signal, never identity.
+
+Untouched is the relation and not her record of it. An ask that reached
+nobody has still taken its number and staged the key it announced, because
+she must never offer one number twice; the count carries the gap and the far
+door honours any number above its mark. So a tunnel costs a number and a
+rotation, and nothing else.
+
+## Reach, directory, rendezvous
+
+A harbor needs three reach kinds and nothing more:
+
+- **request**: a URL. Send bytes, get bytes. Listener to listener.
+- **socket**: a held connection, opened by whichever side can dial, used in
+  both directions with a frame id. A WebSocket, a WebRTC channel and a
+  native socket are one socket reach.
+- **channel**: an in-process port between two runtimes on one device. Tabs
+  on one machine, a webview and its sidecar.
+
+Plus one forwarding rule: a pk whose reach is another harbor that holds a
+socket to it. That rule is the **rendezvous**, and with it every dialer is
+reachable: a phone holds one socket to `quo.acme.com`, acme's harbor binds
+the phone's pk to that socket, and a third harbor sending to the phone's pk
+sends to acme, which forwards the same bytes to the same pk. Nobody changes
+a pk or a byte, and an intermediary opens nothing.
+
+What it does learn is worth writing down, because "pks and ciphertext" is
+true and reads as a smaller thing than it is. A harbor forwarding for
+someone else holds, for every ask it carries: the destination ward pk, in
+the clear, because that is the address and there is no forwarding without
+it; the socket it came in on, and so the dialer's own address; the size of
+the ask and of the reply, which are not padded and so move with the
+plaintext; the time each crossed, and which reply belongs to which ask,
+because it awaits the one to answer the other; and, from the announce
+frame, which ward pks are held by one device. So an operator of a
+rendezvous can keep who spoke to whom, when, and how much, for as long as
+it likes, and break no ciphertext to do it. What it cannot learn is the
+relation: the heir is sealed inside the ask, so one standing at a ward
+cannot be told from another, nor followed from one rendezvous to the next.
+Being reachable through someone costs the fact that you spoke. It does not
+cost what you said, nor who you are to the far being.
+
+A rendezvous is a listener and nothing more, so there is never one of them.
+A harbor may hold sockets to several and be reached through any: the
+directory is keyed by pk and a bind is per socket, so each listener binds
+the same pks independently. Plurality is the design and not a deployment
+habit, and a world that can only be reached through one listener chose
+that.
+
+A line also says which **wire suite** it speaks, one number that is not
+negotiated: in the text frame a socket announces itself with, and as the
+header `quo-suite` on a request. It is never on an ask, so an ask is bytes
+with nothing in front of them, and a harbor still knows before it carries
+anything whether the far side can open what it would send. A side meeting a
+suite it does not know closes the line; a request door answers nothing
+delivered. `packages/quo/SPEC.md` owns the number and says why it exists.
+
+The **directory** is the map from pk to reach. The memory harbor stubs it with
+linked peers. A real one is a table the harbor fills however it likes, and the
+one entry it must learn by itself is a dialer's: when a dialer connects it
+announces the ward pks it holds, and the listener binds to that socket each one
+whose door answered its probe; `packages/quo/SPEC.md` says what the probe is.
+After a migration the pk is unchanged, only its reach, and the next connect
+rebinds it.
+
+## The quo. route, as built
+
+The reach interface and its two implementations are the library's,
+`packages/quo/src/harbor/reach.ts`, and pass its reach suite here: the request
+and a socket to a daemon in `packages/dock/test/wire.test.ts`, the request
+through the worker inside the edge. The listener half is the terrain's, below:
+
+```
+request      POST <url>/<pk>, the sealed ask as the body, the sealed reply as the answer;
+             <url> is the world's quo. route, which the proxy maps onto the daemon's /quo
+             404 is "no reach for that pk" and comes back as nothing; a line lost after
+             sending answers nothing at all, and the ward's bound ends the ask
+socket       a WebSocket at <url>, held by the dialer, used both ways
+             text frame   { announce: [pk, ...] }   the ward pks this side holds
+             ask frame    [0][id 4][pk 64][bytes]    a frame id matches the reply
+             reply frame  [1][id 4][bytes]
+             none frame   [2][id 4]                  nothing was delivered
+directory    pk -> reach, filled three ways: a socket a dialer holds, bound once proven
+             and unbound at close; a hint from a link, `quo reach <pk> <url>`, kept in
+             <dir>/reach.json; and the harbor's own doors, always first
+```
+
+One rule makes the rendezvous: bytes that arrive from the wire go to an own
+door or to a socket this harbor holds for that pk, and never onward by
+request. So a third harbor with a hint that a phone's pk is at acme's
+`quo.` sends there, and acme forwards down the socket the phone holds.
+`quo serve --dial URL`, or `<dir>/dial.json`, makes a daemon a dialer: it
+holds one socket per URL, announces its wards on open, binds the listener's
+pks, and reconnects with backoff from a second to thirty when the line
+drops. A pk is 64 bytes on the wire, the ward key and the padlock, which the
+first version of the ask frame got wrong and the suite caught in one run.
+
+The proof is `packages/dock/test/wire.test.ts`: the library's conformance suite,
+untouched, against two disk harbors in two folders with HTTP doors on
+loopback, once with every ask a request and once with the second harbor
+dialing the first; down is the reach refused, migrate is the ward folder
+moved and adopted. Then the rendezvous on its own. What it taught: a harbor
+must write the partition before it lets a folder go, because a being driven
+in-process changes it without passing a door; listeners left open keep a
+test process alive forever, so every pair is closed after the file; and a
+proxy sends the route root as `/quo/`, trailing slash, which the door takes.
+The first live crossing, Mac to lab and back, is in `estates/lab/lab.md`.
+
+## The two cores, as built
+
+The harbor core is the library's, `packages/quo/src/harbor/core.ts`, and so is
+the dialer, `packages/quo/src/harbor/dial.ts`; `packages/quo/SPEC.md` says what
+they are. Every harbor here extends the core and hands it three things: a
+**store**, the library's interface, with `files.ts` on a disk and `idb.ts` in a
+tab, each passing the library's store suite; a **loader**, the code half, a
+module from a folder on a daemon and the bundle in a tab; and a **lease**, a pid
+file on disk and a web lock on the database name in a tab, so a second tab on
+one origin meets the lock and is a screen. The disk harbor, `disk.ts`, is the
+core plus files, the loader and the pid, and holds the `ws` listener's end of
+every socket dialed to it; the browser harbor, `browser.ts`, is the core plus
+IndexedDB, the built-in beings, the lock and one dialer per world.
+
+A tab's store keeps values through JSON, as a file does, because the ward
+hands its partition out through a guard that structured clone refuses.
+The daemon's `/quo` and `/health` answer any origin, with the preflight a
+binary POST needs, because a tab on one world's `web.` reaching another
+world's `quo.` is the ordinary case.
+
+`/health` asks for nothing and tells what this harbor hosts: the wards by
+name and pk, the sockets held, and the directory. That is a map of the
+device, so it is an operator's surface and not a route: the proxy maps the
+three hostnames onto their paths and nothing onto this one, and a request
+for it from outside meets a 404 at the proxy. It answers any origin because
+it is on loopback, and the day it is put behind a proxy it needs a reason
+and a door.
+
+The proof is `packages/dock/test/terrain/browser.test.ts`, behind
+`npm run check:terrain` beside the library's own browser chapter: the
+conformance suite, untouched, inside a real Chromium, against two browser
+harbors in one tab with two databases, both dialing a Node daemon on
+loopback, so every relation crosses the rendezvous; down is the reach
+refused on both, migrate lifts seed, partition and record from one database
+into the other and boots there, the tab-to-home scene. And the lock: a
+second harbor over one database does not boot. It passed on 2026-09-04.
+
+## The edge, as built
+
+`packages/dock/harbor/edge/` is the core over one Durable Object, and the object
+is the harbor. The platform runs one instance of it at a time, which is
+the lease and the single writer every ward needs. Its storage is the
+store, `storage.ts`: one row per ward, seed, partition and record, with the
+seed sealed under a key from the platform's secrets, `QUO_SEED_KEY`, so the
+storage holds ciphertext and the secret store holds the one key, as the
+table above says. The deployed worker is the code, the built-in beings and
+whatever it hands in. It is a listener and never a dialer: reached by
+request at `<origin>/h/<name>/quo`, holding the sockets dialers open to it
+on the platform's own socket pair, the rendezvous for them, awake per
+request and kept awake by a held socket.
+
+Its owner door is a route, not a socket, because the platform has no local
+process: the root is whoever holds `QUO_ROOT`, a platform secret, and the
+root's asks arrive as one POST at `<origin>/h/<name>/root` under it, the
+first of them `{ init: { ward, user } }`, the root's setup. That is the
+device's own rule on this terrain, as file permissions are on a disk. The
+first thing a root on the edge does is invite an owner on the ward's pk,
+and from then on the edge is piloted from elsewhere over a standing, with
+`--via`, like any ward.
+
+The proof is `packages/dock/test/terrain/edge.test.ts`, behind
+`npm run check:terrain`, in the platform's own runtime on loopback under
+`wrangler dev`: the conformance suite, untouched, inside the platform
+against two edge harbors in one object over two prefixed views of its
+storage, reaching each other by request through the worker; the root door
+refused without the secret and answering under it; and a Node daemon
+dialing the edge, its pk held there, reached by a third harbor through the
+edge, unreached when the line drops. What it taught: one object may not
+touch another's storage, the platform says so at the first put, and so the
+two harbors of the exercise share an object the way two tabs share a page;
+and a Uint8Array over a shared buffer is refused by the platform's crypto,
+which wants a plain one.
+
+The `ws` question the road asked is answered by this terrain: the socket
+reach's framing and the dialer are written on the standard surface and
+hold on every terrain; the listener half is the terrain's own, `ws` on
+Node and the socket pair on the edge, and stays where the terrain is. What
+the library takes, when it takes the reach, is the framing and the dialer.
+
+## The link
+
+An invitation carries the ward pk of the world that minted it, and not where
+that pk lives. A harbor that has never heard of that world cannot carry the
+first knock. So a link is an invitation next to a **reach hint**, the URL of
+that world's `quo.` route. The being receives the invitation opaque, as
+always; the hint goes to the directory. The link is single-use, because the
+heir dies at the first knock, and whoever opens it first is bound.
+
+## Routes on a daemon
+
+```
+device
+  quo serve                      one process, one harbor, the ask pointer
+    quo.sock                     owner asks; local only; never behind a proxy
+    side.sock                    local sides; local only; never behind a proxy
+    127.0.0.1:8787               the HTTP door, loopback only; routes mount by path
+      /health                    the wards it hosts, by name and pk
+      /mcp                       the model side
+      /web                       the bundle for tabs, and the exchange pages
+      /quo                       later: the socket door: request in, sockets held, the rendezvous
+  reverse proxy
+    mcp.example.com -> 127.0.0.1:8787/mcp
+    web.example.com -> 127.0.0.1:8787/web
+    quo.example.com -> 127.0.0.1:8787/quo
+```
+
+The daemon listens on loopback only, and only when asked, with `--http PORT`
+or `QUO_HTTP`. The proxy faces the world and terminates TLS; the daemon never
+does. `estates/lab/droplet/` holds a systemd unit that runs the daemon as
+one user forever, a launchd agent that does the same on a Mac, and a
+Caddyfile that maps the three hostnames onto the one port by path.
+Unattended, the daemon is that unit: restarted if it dies, the lease
+released on SIGTERM, and every ward rebooted from its folder on the next
+start with relations intact. A Mac is a dialer and not a listener: its
+agent opens no HTTP door, and `~/.quo/dial.json` names the routes it holds
+a socket to.
+
+The socket is the root owner. Owning a droplet from elsewhere is a standing
+at its ward, minted by the root, carried as a sealed ask like any relation.
+There is no `cli.` route.
+
+## Acceptance
+
+Every harbor here is accepted the day it passes the library's conformance suite
+untouched, and by nothing else. The disk harbor over the wire passed it on
+2026-09-04, under both reaches; the browser harbor through a daemon passed it
+the same day; the edge harbor inside the platform's runtime passed it the same
+day. Reach, store and the core now hold on three terrains, which is where the
+library takes them. Every store passes the library's store suite,
+`packages/quo/src/conformance/store.ts`: files in
+`packages/dock/test/store.test.ts`, IndexedDB and the edge's storage inside
+their terrains behind `check:terrain`. Every reach passes the library's reach
+suite, `packages/quo/src/conformance/reach.ts`. The store, the reach and the
+core are in the library since 2026-09-04, each with `packages/quo/SPEC.md` in
+the same commit, and every harbor here is one of them over its own terrain.

package/human/dom.ts

@@ -0,0 +1,21 @@
+// SPDX-License-Identifier: Apache-2.0
+// The surface on a document: a page is the root's HTML, and a submit
+// anywhere under it is the form's fields as strings, handed to the side
+// under the ask the form names. The one file under `human/` that touches an
+// element, and it knows nothing of what the page says.
+import type { Surface } from './screen.ts';
+import type { Raw } from './html.ts';
+
+export function domSurface(root: HTMLElement): Surface {
+  const s: Surface = { show: (html) => (root.innerHTML = html), onSubmit: undefined };
+  root.addEventListener('submit', (ev) => {
+    const f = ev.target as HTMLFormElement | null;
+    const ask = f?.dataset.ask;
+    if (!f || ask === undefined) return;
+    ev.preventDefault();
+    const raw: Raw = {};
+    for (const [k, v] of new FormData(f)) raw[k] = typeof v === 'string' ? v : '';
+    s.onSubmit?.(ask, raw);
+  });
+  return s;
+}