@quo-systems/dock 0.2.2 → 0.2.4

package/dist/beings/user.js

@@ -38,16 +38,24 @@ export class User extends Carrier {
         device: { description: 'mint an invitation for a device', input: { type: 'object', properties: { client: { type: 'string' }, wake: { type: 'boolean' }, reach: { type: 'boolean' } }, required: ['client'] }, for: isDesk },
         push: { description: 'push an object to a device: wake it with an event', input: { type: 'object', properties: { client: { type: 'string' }, object: { type: 'object' } }, required: ['client', 'object'] }, for: mayWake },
         chores: { description: 'what the agent may run', input: { type: 'object' }, for: (occ) => client(occ) === 'agent' },
+        look: { description: 'how she is shown', input: { type: 'object' }, for: isDevice },
+        page: { description: 'her page, as a tree of values', input: { type: 'object' }, for: isDevice },
+        name: { description: 'what she is called', input: { type: 'object', properties: { name: { type: 'string' } }, required: ['name'] }, for: rootMinted },
         forget: { description: 'revoke a device: drop its way in and her way back to it, in one act', input: { type: 'object', properties: { client: { type: 'string' } }, required: ['client'] }, for: isDesk },
         report: { description: 'what a run of yours found', input: { type: 'object', properties: { event: { type: 'object' }, result: {} }, required: ['event', 'result'] }, for: isDevice },
     };
     // Anyone may say hello. A device that hands her an invitation in the args
     // is taken as a standing under its own id, so she can push to it later;
-    // if it cannot be taken now, it is kept and tried at the next push.
+    // if it cannot be taken now, it is kept and tried at the next push. The
+    // desk's first hello names her: a being does not know her own key, and the
+    // root's setup knocks with the name it booted her under. Once named, she
+    // keeps it.
     async hello(args, asker) {
         if (asker.id !== undefined && args.invitation && typeof args.invitation === 'object' && !Array.isArray(args.invitation)) {
             await this.wayBack(asker.id, args.invitation);
         }
+        if (asker.id === DESK && !this.cells.name && typeof args.name === 'string' && /^[\w.-]{1,80}$/.test(args.name))
+            this.cells.name = args.name;
         return { welcome: asker.id ?? null, name: this.cells.name };
     }
     // Take a device's way back, or keep it for later when the knock did not
@@ -122,6 +130,44 @@ export class User extends Carrier {
     chores() {
         return { chores: ['census', 'report'] };
     }
+    // How a device shows her: her name as the title, and what each ask is
+    // called. Values only; the screen and the model side each read their part.
+    look() {
+        return {
+            name: this.cells.name || 'you',
+            order: ['whoami', 'push', 'name'],
+            asks: { whoami: { title: 'who am I', readOnly: true }, push: { title: 'wake a device' }, name: { title: 'call her' } },
+        };
+    }
+    // Her page for a device: her name, who this device is, the worlds she
+    // holds as sections, and the two things a human does here by hand, waking
+    // another device and naming her. `hello` and `report` are wiring, a
+    // device's first word and an agent's callback; they stay in her describe
+    // under the gate and off her page, since a page is presentation and the
+    // gate is permission. A device that may not do a thing sees no form for
+    // it, however the page names it.
+    page() {
+        return {
+            kind: 'stack',
+            of: [
+                { kind: 'text', text: this.cells.name || 'you', role: 'title' },
+                { kind: 'row', of: [{ kind: 'text', text: 'this device', role: 'label' }, { kind: 'answer', ask: 'whoami' }] },
+                { kind: 'standings' },
+                { kind: 'form', ask: 'push' },
+                { kind: 'form', ask: 'name' },
+            ],
+        };
+    }
+    // A device the root minted may say what she is called: the root trusts
+    // it with its id and its reach already, and a being does not know her own
+    // key. A name is a word; she keeps the last one given.
+    name(args) {
+        const name = typeof args.name === 'string' ? args.name.trim() : '';
+        if (!/^[\w.-]{1,80}$/.test(name))
+            return { error: 'a name is a word' };
+        this.cells.name = name;
+        return { named: name };
+    }
     // A device that ran something for her says what it found. Kept, so that
     // whoever renders her can show it; the ask itself is the callback.
     report(args, asker) {

package/dist/cli/daemon.d.ts

@@ -1,3 +1,4 @@
+import { type Invitation } from '@quo-systems/quo';
 import { DiskHarbor, type Hosted } from '../harbor/disk.ts';
 import { type Avatar } from '../beings/index.ts';
 import { type Agent } from '../mcp/agent.ts';
@@ -33,11 +34,18 @@ export type Options = {
     routes?: Routes;
     agents?: Agents;
     dial?: string[];
-    password?: () => string | undefined;
 };
 export declare const sockPath: (dir: string) => string;
 export declare const sidePath: (dir: string) => string;
-export declare function admit(hosted: Hosted, identity: string, kind: 'local' | 'web', wake?: boolean, reach?: boolean): Promise<{
+export declare function admit(hosted: Hosted, identity: string, kind: 'local', wake?: boolean, reach?: boolean): Promise<{
+    avatar?: Avatar;
+    error?: string;
+}>;
+export declare function letIn(hosted: Hosted, identity: string, invitation: Invitation): Promise<{
+    avatar?: Avatar;
+    error?: string;
+}>;
+export declare function find(hosted: Hosted, identity: string): Promise<{
     avatar?: Avatar;
     error?: string;
 }>;

package/dist/cli/daemon.js

@@ -78,14 +78,11 @@ const socketPath = (dir, name) => {
 };
 export const sockPath = (dir) => socketPath(dir, 'quo');
 export const sidePath = (dir) => socketPath(dir, 'side');
-// The nonces this daemon minted, honoured once each. Two proof kinds share
-// them: `local`, for a side that reached side.sock, and `web`, for a human
-// who passed the exchange pages. Both are the daemon vouching for someone it
-// saw itself; a proof of either kind arriving any other way names no nonce.
+// The nonces this daemon minted, honoured once each, for the one proof kind
+// there is: `local`, a side that reached side.sock. That is the daemon
+// vouching for a process it saw itself, by the device's own rule, file
+// permissions on the socket; a proof arriving any other way names no nonce.
 const NONCES = new Map();
-// A nonce is minted for one kind and honoured under that kind alone: a tab's
-// nonce offered as a `local` proof names no nonce, so a proof of a kind still
-// arrives only the one way that kind is made.
 const honour = (kind) => (proof) => {
     const who = typeof proof.nonce === 'string' ? NONCES.get(proof.nonce) : undefined;
     if (!who || who.kind !== kind)
@@ -95,13 +92,9 @@ const honour = (kind) => (proof) => {
     return rest;
 };
 Desk.verifiers.local = honour('local');
-Desk.verifiers.web = honour('web');
-// Admit a client identity into a ward: find or boot her avatar, and enter
-// her with a nonce the desk honours once. On a reconnect she already holds
-// `user` and nothing is minted, so `wake`, the human's word that this
-// device may wake her others, is read the first time only; to change it,
-// remove the occupant and allow again. The one path for every side.
-export async function admit(hosted, identity, kind, wake = false, reach = false) {
+// Her avatar in a ward, found or booted under the identity's key. An
+// identity is a word, and never a being of the ward.
+async function avatarOf(hosted, identity) {
     if (!/^[\w.-]+$/.test(identity) || identity === hosted.record.user || identity === 'desk')
         return { error: 'an identity is a word, and not a being of the ward' };
     const key = `avatar:${identity}`;
@@ -112,13 +105,51 @@ export async function admit(hosted, identity, kind, wake = false, reach = false)
             return { error: out.error };
         avatar = hosted.being(key);
     }
+    return { avatar };
+}
+// Admit a local client identity into a ward: find or boot her avatar, and
+// enter her with a nonce the desk honours once. On a reconnect she already
+// holds `user` and nothing is minted, so `wake` and `reach` are read the
+// first time only; to change one, remove the occupant and admit again. The
+// one path for a side on the device: agents, and sides on side.sock.
+export async function admit(hosted, identity, kind, wake = false, reach = false) {
+    const found = await avatarOf(hosted, identity);
+    if (!found.avatar)
+        return found;
     const nonce = randomBytes(16).toString('hex');
     NONCES.set(nonce, { kind, user: hosted.record.user, client: identity, ...(wake ? { wake: true } : {}), ...(reach ? { reach: true } : {}) });
-    const entered = await avatar.enter({ ward: hosted.pk }, { kind, nonce });
+    const entered = await found.avatar.enter({ ward: hosted.pk }, { kind, nonce });
     NONCES.delete(nonce);
     await hosted.save(); // the knock went through the ward's own door, which the harbor never sees
     if ('error' in entered && !('asks' in entered))
         return { error: entered.error };
+    return { avatar: found.avatar };
+}
+// Join a client identity to a ward with an invitation the root minted for
+// it: find or boot her avatar, and she knocks. The one path for an identity
+// from elsewhere, the exchange page. Nothing is typed to get in but the
+// invitation, and the knock spends it.
+export async function letIn(hosted, identity, invitation) {
+    const found = await avatarOf(hosted, identity);
+    if (!found.avatar)
+        return found;
+    const joined = await found.avatar.join(invitation);
+    await hosted.save();
+    if ('error' in joined && !('asks' in joined))
+        return { error: joined.error };
+    return { avatar: found.avatar };
+}
+// Her avatar as she stands, for a session opening under a grant: she is in
+// or she is not, and nothing is minted here. An identity the user being
+// removed hears `removed` on her describe, which the endpoint speaks as 401.
+export async function find(hosted, identity) {
+    const avatar = hosted.being(`avatar:${identity}`);
+    if (!avatar)
+        return { error: 'not joined' };
+    const bp = await avatar.tools();
+    await hosted.save();
+    if ('error' in bp && !('asks' in bp))
+        return { error: bp.error };
     return { avatar };
 }
 async function listen(path, onConnection) {
@@ -157,20 +188,18 @@ export async function serve(dir, options = {}) {
             http = door;
             http.mount('/quo', quoRoute(harbor, server, quo));
             const routes = options.routes ?? (await readRoutes(harbor.dir));
-            const password = options.password ?? (() => process.env.QUO_OWNER_PASSWORD);
             const here = `http://${http.host}:${http.port}`;
             // the worlds' pages: always, on the daemon's own door when no route names a public one
             const web = webRoute(harbor, { at: { quo: routes?.quo ?? `${here}/quo`, web: routes?.web ?? `${here}/web` } });
             if (routes) {
-                // the worlds a client may be allowed into: every ward with a public being, main first
+                // the worlds a client may be allowed into: every ward here, by name and pk, main first
                 const worlds = () => [...harbor.wards]
-                    .filter(([, h]) => h.partition.public !== null)
                     .sort(([a], [b]) => (a === 'main' ? -1 : b === 'main' ? 1 : a.localeCompare(b)))
-                    .map(([ward, h]) => ({ ward, user: h.record.user }));
+                    .map(([ward, h]) => ({ ward, pk: h.pk, user: h.record.user }));
                 // the MCP endpoint: a bearer names an identity in a world, the identity names her avatar there, the side runs beside her
                 mcp = new McpHttp(async (identity, ward) => {
                     const hosted = harbor.wards.get(ward);
-                    return hosted ? admit(hosted, identity, 'web') : { error: 'no such world' };
+                    return hosted ? find(hosted, identity) : { error: 'no such world' };
                 }, async () => {
                     for (const h of harbor.wards.values())
                         await h.save();
@@ -181,13 +210,12 @@ export async function serve(dir, options = {}) {
                 mcp.gone = (identity, ward) => oauth.revoke(identity, ward); // removal at the ward ends the grant at the route
                 exchange = new Exchange({
                     oauth,
-                    password,
                     worlds,
-                    admit: async (identity, wake, reach, ward) => {
+                    join: async (identity, invitation, ward) => {
                         const hosted = harbor.wards.get(ward);
                         if (!hosted)
                             return { error: 'no such world' };
-                        const r = await admit(hosted, identity, 'web', wake, reach);
+                        const r = await letIn(hosted, identity, invitation);
                         return r.error ? { error: r.error } : {};
                     },
                 });

package/dist/cli/estate/quo.service

@@ -14,7 +14,6 @@ User=quo
 Group=quo
 Environment=QUO_DIR=/home/quo/.quo
 Environment=QUO_HTTP=8787
-# QUO_OWNER_PASSWORD, root-only. Without it the exchange pages are closed.
 # CLAUDE_CODE_OAUTH_TOKEN, when an agent folder runs `claude -p`: the agent
 # reads its credential from the device, never from cells.
 EnvironmentFile=-/etc/quo/env

package/dist/harbor/capacitor.d.ts

@@ -0,0 +1,16 @@
+import type { Kept, Store, WardRecord } from '@quo-systems/quo/harbor';
+export declare class Native implements Store {
+    #private;
+    readonly harbor: string;
+    private constructor();
+    static open(harbor: string): Promise<Native>;
+    static wipe(harbor: string): Promise<void>;
+    list(): Promise<string[]>;
+    load(name: string): Promise<Kept | undefined>;
+    put(name: string, kept: Kept): Promise<void>;
+    save(name: string, partition: Record<string, unknown>): Promise<void>;
+    record(name: string, record: WardRecord): Promise<void>;
+    take(name: string): Promise<Kept | undefined>;
+    hints(): Promise<Record<string, string>>;
+    hint(pk: string, url: string): Promise<void>;
+}

package/dist/harbor/capacitor.js

@@ -0,0 +1,135 @@
+// SPDX-License-Identifier: Apache-2.0
+// The store on a phone: the wrapped form over Capacitor's Filesystem and
+// a secure-storage plugin. One key per harbor in the Keychain, this device
+// only, so it never travels in a backup; one sealed file per ward, seed,
+// partition and record as one blob, in the folder iCloud does not copy.
+//
+//   <Library/NoCloud>/quo/<harbor>/wards/<name>.sealed
+//   <Library/NoCloud>/quo/<harbor>/reach.json
+//   Keychain: quo-<harbor>                32 bytes as hex
+//
+// Custody is the backup question, and opening the store answers it: a key
+// with no folder is a reinstall, and the stale key is deleted; a folder
+// with no key is a restore to another device, and the unreadable files are
+// deleted. Either way the harbor starts fresh and there is never a twin.
+import { Capacitor } from '@capacitor/core';
+import { Filesystem, Directory, Encoding } from '@capacitor/filesystem';
+import { SecureStorage, KeychainAccess } from '@aparajita/capacitor-secure-storage';
+import { arithmetic } from '@quo-systems/quo/ward';
+import { sealKey, seal, open } from './seal.js';
+const { hex, unhex } = arithmetic;
+// Where the files live: the folder iCloud does not copy on iOS, the app's
+// own files on Android, whose manifest says no backup.
+const directory = Capacitor.getPlatform() === 'ios' ? Directory.LibraryNoCloud : Directory.Data;
+async function exists(path) {
+    try {
+        await Filesystem.stat({ path, directory });
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+export class Native {
+    harbor;
+    #key;
+    #queues = new Map();
+    constructor(harbor, key) {
+        this.harbor = harbor;
+        this.#key = key;
+    }
+    // Open one harbor's store, applying the custody rule, minting the key and
+    // the folder when this is a fresh install.
+    static async open(harbor) {
+        const item = `quo-${harbor}`;
+        const root = `quo/${harbor}`;
+        // `set` keeps JSON, so `get` parses it back; `getItem` would hand back the quotes.
+        const got = await SecureStorage.get(item, false, false);
+        let secret = typeof got === 'string' ? got : undefined;
+        const folder = await exists(root);
+        if (secret && !folder) {
+            await SecureStorage.remove(item);
+            secret = undefined;
+        }
+        if (!secret && folder)
+            await Filesystem.rmdir({ path: root, directory, recursive: true });
+        if (!secret) {
+            secret = hex(crypto.getRandomValues(new Uint8Array(32)));
+            await SecureStorage.set(item, secret, false, false, KeychainAccess.afterFirstUnlockThisDeviceOnly);
+        }
+        // mkdir refuses a folder that exists, recursive or not.
+        if (!(await exists(`${root}/wards`)))
+            await Filesystem.mkdir({ path: `${root}/wards`, directory, recursive: true });
+        return new Native(harbor, await sealKey(secret));
+    }
+    // Everything this harbor has, key and files: what a person does by hand
+    // to leave a device, and what a test does between two openings.
+    static async wipe(harbor) {
+        await SecureStorage.remove(`quo-${harbor}`);
+        if (await exists(`quo/${harbor}`))
+            await Filesystem.rmdir({ path: `quo/${harbor}`, directory, recursive: true });
+    }
+    #path(name) {
+        return `quo/${this.harbor}/wards/${name}.sealed`;
+    }
+    async #read(name) {
+        const { data } = await Filesystem.readFile({ path: this.#path(name), directory, encoding: Encoding.UTF8 });
+        return JSON.parse(new TextDecoder().decode(await open(this.#key, data.trim())));
+    }
+    // A sealed ward is rewritten whole, so the read sits inside the queue
+    // with the write: two changes to one ward never lose each other's part.
+    #keep(name, change) {
+        const next = (this.#queues.get(name) ?? Promise.resolve()).then(async () => {
+            const blob = change((await exists(this.#path(name))) ? await this.#read(name) : undefined);
+            const sealed = await seal(this.#key, new TextEncoder().encode(JSON.stringify(blob)));
+            await Filesystem.writeFile({ path: this.#path(name), directory, data: sealed + '\n', encoding: Encoding.UTF8 });
+        });
+        this.#queues.set(name, next.catch(() => { }));
+        return next;
+    }
+    async list() {
+        const { files } = await Filesystem.readdir({ path: `quo/${this.harbor}/wards`, directory });
+        return files.filter((f) => f.name.endsWith('.sealed')).map((f) => f.name.slice(0, -'.sealed'.length));
+    }
+    async load(name) {
+        if (!(await exists(this.#path(name))))
+            return undefined;
+        const b = await this.#read(name);
+        return { seed: unhex(b.seed), partition: b.partition, record: b.record };
+    }
+    async put(name, kept) {
+        if (await exists(this.#path(name)))
+            throw new Error(`ward ${name} already exists on this device`);
+        return this.#keep(name, () => ({ seed: hex(kept.seed), partition: kept.partition, record: kept.record }));
+    }
+    async save(name, partition) {
+        if (!(await exists(this.#path(name))))
+            return; // a name not kept is nothing
+        return this.#keep(name, (b) => ({ ...b, partition }));
+    }
+    async record(name, record) {
+        if (!(await exists(this.#path(name))))
+            return;
+        return this.#keep(name, (b) => ({ ...b, record }));
+    }
+    async take(name) {
+        const kept = await this.load(name);
+        if (!kept)
+            return undefined;
+        await this.#queues.get(name);
+        await Filesystem.deleteFile({ path: this.#path(name), directory });
+        return kept;
+    }
+    async hints() {
+        const p = `quo/${this.harbor}/reach.json`;
+        if (!(await exists(p)))
+            return {};
+        const { data } = await Filesystem.readFile({ path: p, directory, encoding: Encoding.UTF8 });
+        return JSON.parse(data);
+    }
+    async hint(pk, url) {
+        const all = await this.hints();
+        all[pk] = url;
+        await Filesystem.writeFile({ path: `quo/${this.harbor}/reach.json`, directory, data: JSON.stringify(all) + '\n', encoding: Encoding.UTF8 });
+    }
+}

package/dist/harbor/disk.js

@@ -17,7 +17,9 @@ var __rewriteRelativeImportExtension = (this && this.__rewriteRelativeImportExte
 //   <dir>/
 //     lease                 pid of the one process that holds this harbor
 //     classes/index.ts      the default class source, a module exporting classes
-//     wards/<name>/         seed, partition.json, ward.json: see files.ts
+//     tab/index.ts          the classes for the tab, served bundled by the web route: human/web.ts
+//     wards/<name>/         seed, partition.json, ward.json, or one sealed
+//                           blob when the daemon holds QUO_SEED_KEY: see files.ts
 //     reach.json            the directory's hints
 import { mkdir, readFile, writeFile, unlink, stat } from 'node:fs/promises';
 import { existsSync } from 'node:fs';
@@ -54,7 +56,10 @@ export class DiskHarbor extends Harbor {
     #held = false;
     constructor(dir) {
         const abs = resolve(dir);
-        super(new Files(abs), async (rec) => ({ ...BUILT_IN, ...(await loadClasses(isAbsolute(rec.code) ? rec.code : join(abs, rec.code))) }));
+        // The key the environment gives, the edge's name for it: from the
+        // Keychain through the app that spawned this daemon, or nothing on a
+        // droplet, whose folder stays plain under its file modes.
+        super(new Files(abs, process.env.QUO_SEED_KEY), async (rec) => ({ ...BUILT_IN, ...(await loadClasses(isAbsolute(rec.code) ? rec.code : join(abs, rec.code))) }));
         this.dir = abs;
     }
     // Create a harbor folder with one ward, and the root's setup in it: the
@@ -64,7 +69,7 @@ export class DiskHarbor extends Harbor {
     // has one.
     static async init(dir, name = 'main', user = 'me') {
         const h = new DiskHarbor(dir);
-        if (existsSync(join(h.dir, 'wards', name, 'seed')))
+        if ((await h.store.list()).includes(name))
             throw new Error(`ward ${name} already exists in ${h.dir}`);
         await mkdir(join(h.dir, 'classes'), { recursive: true });
         const classes = join(h.dir, DEFAULT_CODE);

package/dist/harbor/edge/edge.js

@@ -2,7 +2,8 @@ import { isSilence } from '@quo-systems/quo';
 import { User, Desk, Avatar } from '../../beings/index.js';
 import { setup } from '../../beings/setup.js';
 import { Harbor, Socket as Held, SUITE } from '@quo-systems/quo/harbor';
-import { DurableStorage, sealKey } from './storage.js';
+import { DurableStorage } from './storage.js';
+import { sealKey } from '../seal.js';
 export const BUILT_IN = { User, Desk, Avatar };
 const json = (status, v, headers = {}) => new Response(JSON.stringify(v), { status, headers: { 'content-type': 'application/json', ...headers } });
 const open = { 'access-control-allow-origin': '*', 'access-control-allow-methods': 'POST, OPTIONS', 'access-control-allow-headers': 'content-type, quo-suite' };

package/dist/harbor/edge/exercise.js

@@ -11,7 +11,8 @@ import { conform, conformStore, conformReach } from '@quo-systems/quo/conformanc
 import { request as byRequest } from '@quo-systems/quo/harbor';
 import { Printer, Shop, Customer, Echo, Member } from '@quo-systems/quo/conformance';
 import { EdgeHarbor } from './edge.js';
-import { DurableStorage, sealKey } from './storage.js';
+import { DurableStorage } from './storage.js';
+import { sealKey } from '../seal.js';
 const assert = {
     equal(a, b, m) {
         if (a !== b)

package/dist/harbor/edge/storage.d.ts

@@ -1,8 +1,5 @@
 import { type Kept, type Store, type WardRecord } from '@quo-systems/quo/harbor';
 import type { Storage } from './platform.d.ts';
-export declare function sealKey(secret: string): Promise<CryptoKey>;
-export declare function seal(key: CryptoKey, seed: Uint8Array): Promise<string>;
-export declare function open(key: CryptoKey, sealed: string): Promise<Uint8Array>;
 export declare class DurableStorage implements Store {
     #private;
     readonly storage: Storage;

package/dist/harbor/edge/storage.js

@@ -2,32 +2,13 @@
 // The store as Durable Object storage: one object per harbor, its storage
 // holding one row per ward under `ward:<name>`, seed, partition and record,
 // and one row per hint under `hint:<pk>`. The seed is kept sealed under a
-// key from the platform's secrets, `QUO_SEED_KEY`, so the storage holds
-// ciphertext and the secret store holds the one key, which is what the
-// harbor document's table says the edge does. Values cross as JSON, as
-// they do into a file, because the ward hands the partition out through a
-// guard that structured clone refuses.
-import { arithmetic } from '@quo-systems/quo/ward';
+// key from the platform's secrets, `QUO_SEED_KEY`, with the seal in
+// `../seal.ts`, so the storage holds ciphertext and the secret store holds
+// the one key, which is what the harbor document's table says the edge
+// does. Values cross as JSON, as they do into a file, because the ward
+// hands the partition out through a guard that structured clone refuses.
 import { values } from '@quo-systems/quo/harbor';
-// Bytes as the platform's crypto wants them: over a plain ArrayBuffer.
-const plain = (b) => new Uint8Array(b);
-const { hex, unhex } = arithmetic;
-// The seal on a seed: AES-GCM under the platform key, a fresh nonce each
-// time, nonce and ciphertext together as hex.
-export async function sealKey(secret) {
-    if (!/^[0-9a-f]{64}$/.test(secret))
-        throw new Error('QUO_SEED_KEY is 32 bytes as hex');
-    return crypto.subtle.importKey('raw', plain(unhex(secret)), 'AES-GCM', false, ['encrypt', 'decrypt']);
-}
-export async function seal(key, seed) {
-    const iv = crypto.getRandomValues(new Uint8Array(12));
-    const ct = new Uint8Array(await crypto.subtle.encrypt({ name: 'AES-GCM', iv }, key, plain(seed)));
-    return hex(iv) + hex(ct);
-}
-export async function open(key, sealed) {
-    const b = plain(unhex(sealed));
-    return new Uint8Array(await crypto.subtle.decrypt({ name: 'AES-GCM', iv: b.subarray(0, 12) }, key, b.subarray(12)));
-}
+import { seal, open } from '../seal.js';
 // `prefix` keeps more than one harbor apart in one object's storage: the
 // exercise does that, a deployment never does.
 export class DurableStorage {

package/dist/harbor/files.d.ts

@@ -2,7 +2,8 @@ import type { Kept, Store, WardRecord } from '@quo-systems/quo/harbor';
 export declare class Files implements Store {
     #private;
     readonly dir: string;
-    constructor(dir: string);
+    constructor(dir: string, key?: string);
+    get sealed(): boolean;
     list(): Promise<string[]>;
     load(name: string): Promise<Kept | undefined>;
     put(name: string, kept: Kept): Promise<void>;