@quo-systems/dock 0.2.3 → 0.2.4

package/dist/human/local.d.ts

@@ -0,0 +1,10 @@
+import type { JsonObject } from '@quo-systems/quo';
+import type { Subject } from '../beings/side.ts';
+export declare const TAB = "tab";
+type Door = {
+    answer(asker: {
+        id: string;
+    }, method?: string, args?: JsonObject): Promise<unknown>;
+};
+export declare function local(being: Door): Subject;
+export {};

package/dist/human/local.js

@@ -0,0 +1,10 @@
+// The asker the tab speaks under to its own beings.
+export const TAB = 'tab';
+export function local(being) {
+    const me = { id: TAB };
+    return {
+        tools: async () => (await being.answer(me)),
+        call: (name, args = {}) => being.answer(me, name, args),
+        ears: new Set(),
+    };
+}

package/dist/human/screen.js

@@ -29,7 +29,8 @@ export async function screenSide(avatar, surface, options = {}) {
         }
         else {
             const d = await digest(bp);
-            if (d !== seen) {
+            const moved = d !== seen;
+            if (moved) {
                 seen = d;
                 model.blueprint = bp;
                 for (const k of Object.keys(model.answers))
@@ -42,21 +43,28 @@ export async function screenSide(avatar, surface, options = {}) {
                 }
                 else
                     model.look = {};
-                // her page, once per digest: a tree of values, or nothing and her asks are forms
-                if (bp.asks.some((a) => a.name === 'page')) {
-                    const t = await avatar.call('page');
-                    model.tree = isSilence(t) || isWord(t) ? null : sanitiseTree(t);
-                }
-                else
-                    model.tree = null;
-                // a read-only ask that needs nothing typed, or one her page shows the answer of, is run on
-                // her behalf, so the page opens with what it shows
-                const wanted = new Set(model.tree ? answersIn(model.tree) : []);
-                for (const a of bp.asks) {
-                    const needs = (a.input.required ?? []).length > 0;
-                    if ((hintFor(bp, model.look, a.name).readOnly || wanted.has(a.name)) && !needs && !(a.name in model.answers))
-                        model.answers[a.name] = word(await avatar.call(a.name, {}));
-                }
+            }
+            // her page, after every ask: a tree of values from what she holds now, or nothing and her asks
+            // are forms. A cell moved is a page moved, and her describe need not have; so the answers the
+            // page shows are run again with it, and the page never stands more than one ask behind her
+            const shows = new Set(model.tree ? answersIn(model.tree) : []);
+            if (bp.asks.some((a) => a.name === 'page')) {
+                const t = await avatar.call('page');
+                model.tree = isSilence(t) || isWord(t) ? null : sanitiseTree(t);
+            }
+            else
+                model.tree = null;
+            const wanted = new Set(model.tree ? answersIn(model.tree) : []);
+            for (const n of shows)
+                if (wanted.has(n))
+                    delete model.answers[n];
+            // a read-only ask that needs nothing typed is run on her behalf once per digest, and one her page
+            // shows the answer of after every ask, so the page opens and stays with what it shows
+            for (const a of bp.asks) {
+                const needs = (a.input.required ?? []).length > 0;
+                const run = wanted.has(a.name) || (moved && hintFor(bp, model.look, a.name).readOnly);
+                if (run && !needs && !(a.name in model.answers))
+                    model.answers[a.name] = word(await avatar.call(a.name, {}));
             }
         }
         await after();

package/dist/human/tab.d.ts

@@ -7,6 +7,7 @@ export type Config = {
         public: boolean;
     }>;
     ward?: string;
+    beings?: boolean;
 };
 export declare function start(cfg: Config, root?: HTMLElement): Promise<void>;
 export { USER };

package/dist/human/tab.js

@@ -1,3 +1,11 @@
+var __rewriteRelativeImportExtension = (this && this.__rewriteRelativeImportExtension) || function (path, preserveJsx) {
+    if (typeof path === "string" && /^\.\.?\//.test(path)) {
+        return path.replace(/\.(tsx)$|((?:\.d)?)((?:\.[^./]+?)?)\.([cm]?)ts$/i, function (m, tsx, d, ext, cm) {
+            return tsx ? preserveJsx ? ".jsx" : ".js" : d && (!ext || !cm) ? m : (d + ext + "." + cm.toLowerCase() + "js");
+        });
+    }
+    return path;
+};
 import { BrowserHarbor } from '../harbor/browser.js';
 import { USER } from '../beings/avatar.js';
 import { parse, strip } from '../beings/link.js';
@@ -6,6 +14,7 @@ import { domSurface } from './dom.js';
 import { guest } from './guest.js';
 import { door } from './door.js';
 import { world, relations, fresh } from './worlds.js';
+import { local } from './local.js';
 const kept = (key, fallback) => {
     try {
         return JSON.parse(localStorage.getItem(key) ?? 'null') ?? fallback;
@@ -48,7 +57,22 @@ export async function start(cfg, root = document.body) {
     root.append(nav, who, status, screen);
     const say = (s) => (status.textContent = s);
     // The harbor in the tab: one database per origin, one ward per world.
+    // The world's code first, when its origin serves any: the classes for
+    // the tab, handed to the harbor beside the built-in ones before any ward
+    // boots, since a being kept from the last visit is booted by class name.
+    // A world that serves none has no beings in the tab, and the page is the
+    // far being's alone.
     const harbor = new BrowserHarbor('quo');
+    const classes = cfg.beings
+        ? await import(__rewriteRelativeImportExtension(`${cfg.web}/beings.js`)).then((mod) => {
+            const out = {};
+            for (const [name, v] of Object.entries(mod))
+                if (typeof v === 'function' && 'prototype' in v)
+                    out[name] = v;
+            return out;
+        })
+        : {};
+    Object.assign(harbor.classes, classes);
     await harbor.boot();
     harbor.dial(cfg.quo);
     // The world this page is about: the link's, since an invitation names
@@ -100,16 +124,45 @@ export async function start(cfg, root = document.body) {
             who.append(more);
         }
     };
-    // In, as one relation: her page. Every call rotates her keys and a
-    // same-ward ask never crosses the harbor, so the side saves after each.
+    // The world's beings in the tab, for one relation: one of each class,
+    // booted under her key the first time and found there after, since their
+    // cells are in the ward and come back with it. Each is a subject of her
+    // own with her own side in her own section, so a note she keeps and a
+    // form she shows are hers, painted by the same painter as the far page.
+    const locals = [];
+    const boot = async (rel) => {
+        const beings = ward.partition.beings ?? {};
+        for (const name of Object.keys(classes)) {
+            const key = `${rel.key}-${name}`;
+            if (!beings[key]) {
+                const out = (await ward.ask('boot', { key, class: name }));
+                if (out.error)
+                    continue;
+                await ward.save();
+            }
+            const being = ward.being(key);
+            if (!being)
+                continue;
+            const section = el('section', '', { class: 'local', 'data-being': key });
+            screen.append(section);
+            locals.push(await screenSide(local(being), domSurface(section), { after: () => ward.save() }));
+        }
+    };
+    // In, as one relation: her page, then the world's beings for her. Every
+    // call rotates her keys and a same-ward ask never crosses the harbor, so
+    // the side saves after each.
     const inside = async (rel, notice, called) => {
         await side?.close();
+        for (const l of locals.splice(0))
+            await l.close();
         status.remove();
         root.querySelector('form.password')?.remove();
         screen.replaceChildren();
         current = rel;
         keep(AT(pk), rel.key);
-        const s = await screenSide(rel.avatar, domSurface(screen), { after: () => ward.save(), notice });
+        const mine = el('div', '', { class: 'far' });
+        screen.append(mine);
+        const s = await screenSide(rel.avatar, domSurface(mine), { after: () => ward.save(), notice });
         side = s;
         const bp = s.model.blueprint;
         const notesName = typeof bp?.notes?.name === 'string' ? bp.notes.name : '';
@@ -118,6 +171,7 @@ export async function start(cfg, root = document.body) {
             keep(NAMES(pk), { ...names(), [rel.key]: called });
         switcher();
         people();
+        await boot(rel);
     };
     // The way in, from any of the three: a fresh avatar joins, the ward is
     // saved, and she is the one on screen.
@@ -138,6 +192,8 @@ export async function start(cfg, root = document.body) {
     // there, the door page: a link is the only way in, and nothing to type.
     const atDoor = async () => {
         await side?.close();
+        for (const l of locals.splice(0))
+            await l.close();
         side = null;
         current = null;
         screen.replaceChildren();

package/dist/human/web.d.ts

@@ -6,4 +6,5 @@ export type WebOptions = {
         web: string;
     };
 };
+export declare const TAB_CODE = "tab/index.ts";
 export declare function webRoute(harbor: DiskHarbor, o: WebOptions): (req: IncomingMessage, res: ServerResponse, rest: string) => Promise<boolean>;

package/dist/human/web.js

@@ -1,16 +1,30 @@
 import { existsSync } from 'node:fs';
 import { fileURLToPath } from 'node:url';
+import { join } from 'node:path';
+import process from 'node:process';
 import { build } from 'esbuild';
 import { door } from './door.js';
 // The paths under `/web` that are the exchange's, never a ward's name.
-const RESERVED_PATHS = new Set(['allow', 'tab.js']);
+const RESERVED_PATHS = new Set(['allow', 'tab.js', 'beings.js']);
+// The world's code for the tab: a module in the harbor folder, the twin of
+// `classes/index.ts`, exporting by name the classes the tab boots into its
+// local ward for a world of this harbor. Served bundled as `beings.js` on
+// this origin, and one origin is one world's code.
+export const TAB_CODE = 'tab/index.ts';
 export function webRoute(harbor, o) {
     const tabEntry = () => {
         const js = fileURLToPath(new URL('./tab.js', import.meta.url));
         return existsSync(js) ? js : fileURLToPath(new URL('./tab.ts', import.meta.url));
     };
+    const beingsEntry = join(harbor.dir, TAB_CODE);
+    const bundled = (entry) => 
+    // the entry may sit in a harbor folder with no node_modules of its own, as on a droplet whose
+    // estate folder is the working directory: what it imports is resolved from there too
+    build({ entryPoints: [entry], bundle: true, format: 'esm', platform: 'browser', target: 'es2023', write: false, nodePaths: [join(process.cwd(), 'node_modules')] }).then((out) => out.outputFiles[0].text);
     let bundle;
-    const built = () => (bundle ??= build({ entryPoints: [tabEntry()], bundle: true, format: 'esm', platform: 'browser', target: 'es2023', write: false }).then((out) => out.outputFiles[0].text));
+    const built = () => (bundle ??= bundled(tabEntry()));
+    let beings;
+    const builtBeings = () => (beings ??= bundled(beingsEntry));
     const quoOrigin = (() => {
         try {
             const u = new URL(o.at.quo);
@@ -41,7 +55,7 @@ export function webRoute(harbor, o) {
     };
     const wards = () => Object.fromEntries([...harbor.wards].map(([n, h]) => [n, { pk: h.pk, public: publicOf(h) !== null }]));
     const tab = (ward) => {
-        const cfg = { quo: o.at.quo, web: o.at.web, wards: wards(), ...(ward ? { ward } : {}) };
+        const cfg = { quo: o.at.quo, web: o.at.web, wards: wards(), beings: existsSync(beingsEntry), ...(ward ? { ward } : {}) };
         return `<script id="quo" type="application/json">${JSON.stringify(cfg).replace(/</g, '\\u003c')}</script><script type="module" src="${o.at.web}/tab.js"></script>`;
     };
     return async (req, res, rest) => {
@@ -58,6 +72,14 @@ export function webRoute(harbor, o) {
             res.end(await built());
             return true;
         }
+        // the world's code for the tab, when the harbor folder holds any; a harbor with none has no such path
+        if (rest === '/beings.js' && req.method === 'GET') {
+            if (!existsSync(beingsEntry))
+                return false;
+            res.writeHead(200, { 'content-type': 'text/javascript; charset=utf-8', 'cache-control': 'no-store' });
+            res.end(await builtBeings());
+            return true;
+        }
         const wardName = parts[0] ?? '';
         if (!wardName || RESERVED_PATHS.has(wardName))
             return false;
@@ -82,6 +104,8 @@ const CSS = [
     'header,main{background:var(--bg);color:var(--fg);font-family:var(--font)}header{display:flex;flex-wrap:wrap;align-items:center;gap:.5rem 1rem}header .notice{width:100%;margin:0}',
     'input,select,textarea,button{font:inherit;padding:.4rem;margin:.2rem;border-radius:var(--radius)}button{background:var(--accent);color:#fff;border:0;padding:.4rem .9rem}',
     'fieldset{border:1px solid color-mix(in srgb,currentColor 20%,transparent);border-radius:var(--radius);margin:.5rem 0}',
+    // a being of the world running in the tab: her own section under the far page
+    'section.local{border-top:1px solid color-mix(in srgb,currentColor 15%,transparent);margin:1.5rem 0;padding-top:.5rem}section.local header:empty{display:none}',
     'section.standing{background:var(--bg);color:var(--fg);font-family:var(--font);border-left:4px solid var(--accent);border-radius:var(--radius);padding:.25rem 1rem;margin:1.5rem 0}section.standing h2{display:flex;align-items:center;gap:.5rem;font-size:1.1rem}img.logo{height:1.6rem}',
     'table{border-collapse:collapse}td,th{padding:.15rem .5rem;text-align:left}.answer{margin:.5rem 0 1rem;padding:.5rem;border-left:3px solid var(--accent)}.answer.error{border-color:#c33}.answer.silence,.answer.word,.answer.unreached{border-color:#c93}pre{padding:.75rem;overflow:auto}',
     // a page in the grammar: regions, roles, cards

package/harbor/capacitor.ts

@@ -0,0 +1,142 @@
+// SPDX-License-Identifier: Apache-2.0
+// The store on a phone: the wrapped form over Capacitor's Filesystem and
+// a secure-storage plugin. One key per harbor in the Keychain, this device
+// only, so it never travels in a backup; one sealed file per ward, seed,
+// partition and record as one blob, in the folder iCloud does not copy.
+//
+//   <Library/NoCloud>/quo/<harbor>/wards/<name>.sealed
+//   <Library/NoCloud>/quo/<harbor>/reach.json
+//   Keychain: quo-<harbor>                32 bytes as hex
+//
+// Custody is the backup question, and opening the store answers it: a key
+// with no folder is a reinstall, and the stale key is deleted; a folder
+// with no key is a restore to another device, and the unreadable files are
+// deleted. Either way the harbor starts fresh and there is never a twin.
+import { Capacitor } from '@capacitor/core';
+import { Filesystem, Directory, Encoding } from '@capacitor/filesystem';
+import { SecureStorage, KeychainAccess } from '@aparajita/capacitor-secure-storage';
+import { arithmetic } from '@quo-systems/quo/ward';
+import type { Kept, Store, WardRecord } from '@quo-systems/quo/harbor';
+import { sealKey, seal, open } from './seal.ts';
+
+const { hex, unhex } = arithmetic;
+type Blob = { seed: string; partition: Record<string, unknown>; record: WardRecord };
+
+// Where the files live: the folder iCloud does not copy on iOS, the app's
+// own files on Android, whose manifest says no backup.
+const directory = Capacitor.getPlatform() === 'ios' ? Directory.LibraryNoCloud : Directory.Data;
+
+async function exists(path: string): Promise<boolean> {
+  try {
+    await Filesystem.stat({ path, directory });
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+export class Native implements Store {
+  readonly harbor: string;
+  readonly #key: CryptoKey;
+  readonly #queues = new Map<string, Promise<void>>();
+  private constructor(harbor: string, key: CryptoKey) {
+    this.harbor = harbor;
+    this.#key = key;
+  }
+
+  // Open one harbor's store, applying the custody rule, minting the key and
+  // the folder when this is a fresh install.
+  static async open(harbor: string): Promise<Native> {
+    const item = `quo-${harbor}`;
+    const root = `quo/${harbor}`;
+    // `set` keeps JSON, so `get` parses it back; `getItem` would hand back the quotes.
+    const got = await SecureStorage.get(item, false, false);
+    let secret = typeof got === 'string' ? got : undefined;
+    const folder = await exists(root);
+    if (secret && !folder) {
+      await SecureStorage.remove(item);
+      secret = undefined;
+    }
+    if (!secret && folder) await Filesystem.rmdir({ path: root, directory, recursive: true });
+    if (!secret) {
+      secret = hex(crypto.getRandomValues(new Uint8Array(32)));
+      await SecureStorage.set(item, secret, false, false, KeychainAccess.afterFirstUnlockThisDeviceOnly);
+    }
+    // mkdir refuses a folder that exists, recursive or not.
+    if (!(await exists(`${root}/wards`))) await Filesystem.mkdir({ path: `${root}/wards`, directory, recursive: true });
+    return new Native(harbor, await sealKey(secret));
+  }
+
+  // Everything this harbor has, key and files: what a person does by hand
+  // to leave a device, and what a test does between two openings.
+  static async wipe(harbor: string): Promise<void> {
+    await SecureStorage.remove(`quo-${harbor}`);
+    if (await exists(`quo/${harbor}`)) await Filesystem.rmdir({ path: `quo/${harbor}`, directory, recursive: true });
+  }
+
+  #path(name: string) {
+    return `quo/${this.harbor}/wards/${name}.sealed`;
+  }
+  async #read(name: string): Promise<Blob> {
+    const { data } = await Filesystem.readFile({ path: this.#path(name), directory, encoding: Encoding.UTF8 });
+    return JSON.parse(new TextDecoder().decode(await open(this.#key, (data as string).trim()))) as Blob;
+  }
+  // A sealed ward is rewritten whole, so the read sits inside the queue
+  // with the write: two changes to one ward never lose each other's part.
+  #keep(name: string, change: (b: Blob | undefined) => Blob): Promise<void> {
+    const next = (this.#queues.get(name) ?? Promise.resolve()).then(async () => {
+      const blob = change((await exists(this.#path(name))) ? await this.#read(name) : undefined);
+      const sealed = await seal(this.#key, new TextEncoder().encode(JSON.stringify(blob)));
+      await Filesystem.writeFile({ path: this.#path(name), directory, data: sealed + '\n', encoding: Encoding.UTF8 });
+    });
+    this.#queues.set(name, next.catch(() => {}));
+    return next;
+  }
+
+  async list(): Promise<string[]> {
+    const { files } = await Filesystem.readdir({ path: `quo/${this.harbor}/wards`, directory });
+    return files.filter((f) => f.name.endsWith('.sealed')).map((f) => f.name.slice(0, -'.sealed'.length));
+  }
+
+  async load(name: string): Promise<Kept | undefined> {
+    if (!(await exists(this.#path(name)))) return undefined;
+    const b = await this.#read(name);
+    return { seed: unhex(b.seed), partition: b.partition, record: b.record };
+  }
+
+  async put(name: string, kept: Kept): Promise<void> {
+    if (await exists(this.#path(name))) throw new Error(`ward ${name} already exists on this device`);
+    return this.#keep(name, () => ({ seed: hex(kept.seed), partition: kept.partition, record: kept.record }));
+  }
+
+  async save(name: string, partition: Record<string, unknown>): Promise<void> {
+    if (!(await exists(this.#path(name)))) return; // a name not kept is nothing
+    return this.#keep(name, (b) => ({ ...b!, partition }));
+  }
+
+  async record(name: string, record: WardRecord): Promise<void> {
+    if (!(await exists(this.#path(name)))) return;
+    return this.#keep(name, (b) => ({ ...b!, record }));
+  }
+
+  async take(name: string): Promise<Kept | undefined> {
+    const kept = await this.load(name);
+    if (!kept) return undefined;
+    await this.#queues.get(name);
+    await Filesystem.deleteFile({ path: this.#path(name), directory });
+    return kept;
+  }
+
+  async hints(): Promise<Record<string, string>> {
+    const p = `quo/${this.harbor}/reach.json`;
+    if (!(await exists(p))) return {};
+    const { data } = await Filesystem.readFile({ path: p, directory, encoding: Encoding.UTF8 });
+    return JSON.parse(data as string) as Record<string, string>;
+  }
+
+  async hint(pk: string, url: string): Promise<void> {
+    const all = await this.hints();
+    all[pk] = url;
+    await Filesystem.writeFile({ path: `quo/${this.harbor}/reach.json`, directory, data: JSON.stringify(all) + '\n', encoding: Encoding.UTF8 });
+  }
+}

package/harbor/disk.ts

@@ -9,7 +9,9 @@
 //   <dir>/
 //     lease                 pid of the one process that holds this harbor
 //     classes/index.ts      the default class source, a module exporting classes
-//     wards/<name>/         seed, partition.json, ward.json: see files.ts
+//     tab/index.ts          the classes for the tab, served bundled by the web route: human/web.ts
+//     wards/<name>/         seed, partition.json, ward.json, or one sealed
+//                           blob when the daemon holds QUO_SEED_KEY: see files.ts
 //     reach.json            the directory's hints
 import { mkdir, readFile, writeFile, unlink, stat } from 'node:fs/promises';
 import { existsSync } from 'node:fs';
@@ -51,7 +53,10 @@ export class DiskHarbor extends Harbor {
 
   constructor(dir: string) {
     const abs = resolve(dir);
-    super(new Files(abs), async (rec) => ({ ...BUILT_IN, ...(await loadClasses(isAbsolute(rec.code) ? rec.code : join(abs, rec.code))) }));
+    // The key the environment gives, the edge's name for it: from the
+    // Keychain through the app that spawned this daemon, or nothing on a
+    // droplet, whose folder stays plain under its file modes.
+    super(new Files(abs, process.env.QUO_SEED_KEY), async (rec) => ({ ...BUILT_IN, ...(await loadClasses(isAbsolute(rec.code) ? rec.code : join(abs, rec.code))) }));
     this.dir = abs;
   }
 
@@ -62,7 +67,7 @@ export class DiskHarbor extends Harbor {
   // has one.
   static async init(dir: string, name = 'main', user = 'me'): Promise<{ dir: string; name: string; pk: string; user: string }> {
     const h = new DiskHarbor(dir);
-    if (existsSync(join(h.dir, 'wards', name, 'seed'))) throw new Error(`ward ${name} already exists in ${h.dir}`);
+    if ((await h.store.list()).includes(name)) throw new Error(`ward ${name} already exists in ${h.dir}`);
     await mkdir(join(h.dir, 'classes'), { recursive: true });
     const classes = join(h.dir, DEFAULT_CODE);
     if (!existsSync(classes)) await writeFile(classes, '// The classes this harbor holds beside the built-in ones. Export each one by name.\nexport {};\n');

package/harbor/edge/edge.ts

@@ -24,7 +24,8 @@ import { isSilence } from '@quo-systems/quo';
 import { User, Desk, Avatar } from '../../beings/index.ts';
 import { setup } from '../../beings/setup.ts';
 import { Harbor, Socket as Held, SUITE, type Line } from '@quo-systems/quo/harbor';
-import { DurableStorage, sealKey } from './storage.ts';
+import { DurableStorage } from './storage.ts';
+import { sealKey } from '../seal.ts';
 import type { State, Env } from './platform.d.ts';
 
 export const BUILT_IN: Record<string, BeingClass> = { User, Desk, Avatar };

package/harbor/edge/exercise.ts

@@ -13,7 +13,8 @@ import type { World, Handle, Census } from '@quo-systems/quo/conformance';
 import { Printer, Shop, Customer, Echo, Member } from '@quo-systems/quo/conformance';
 import type { BeingClass, Cells, Invitation, JsonObject } from '@quo-systems/quo';
 import { EdgeHarbor } from './edge.ts';
-import { DurableStorage, sealKey } from './storage.ts';
+import { DurableStorage } from './storage.ts';
+import { sealKey } from '../seal.ts';
 import type { Hosted } from '@quo-systems/quo/harbor';
 import type { State, Env } from './platform.d.ts';
 

package/harbor/edge/storage.ts

@@ -2,35 +2,16 @@
 // The store as Durable Object storage: one object per harbor, its storage
 // holding one row per ward under `ward:<name>`, seed, partition and record,
 // and one row per hint under `hint:<pk>`. The seed is kept sealed under a
-// key from the platform's secrets, `QUO_SEED_KEY`, so the storage holds
-// ciphertext and the secret store holds the one key, which is what the
-// harbor document's table says the edge does. Values cross as JSON, as
-// they do into a file, because the ward hands the partition out through a
-// guard that structured clone refuses.
-import { arithmetic } from '@quo-systems/quo/ward';
+// key from the platform's secrets, `QUO_SEED_KEY`, with the seal in
+// `../seal.ts`, so the storage holds ciphertext and the secret store holds
+// the one key, which is what the harbor document's table says the edge
+// does. Values cross as JSON, as they do into a file, because the ward
+// hands the partition out through a guard that structured clone refuses.
 import { values, type Kept, type Store, type WardRecord } from '@quo-systems/quo/harbor';
+import { seal, open } from '../seal.ts';
 import type { Storage } from './platform.d.ts';
 
 type Row = { seed: string; partition: Record<string, unknown>; record: WardRecord };
-// Bytes as the platform's crypto wants them: over a plain ArrayBuffer.
-const plain = (b: Uint8Array): Uint8Array<ArrayBuffer> => new Uint8Array(b);
-const { hex, unhex } = arithmetic;
-
-// The seal on a seed: AES-GCM under the platform key, a fresh nonce each
-// time, nonce and ciphertext together as hex.
-export async function sealKey(secret: string): Promise<CryptoKey> {
-  if (!/^[0-9a-f]{64}$/.test(secret)) throw new Error('QUO_SEED_KEY is 32 bytes as hex');
-  return crypto.subtle.importKey('raw', plain(unhex(secret)), 'AES-GCM', false, ['encrypt', 'decrypt']);
-}
-export async function seal(key: CryptoKey, seed: Uint8Array): Promise<string> {
-  const iv = crypto.getRandomValues(new Uint8Array(12));
-  const ct = new Uint8Array(await crypto.subtle.encrypt({ name: 'AES-GCM', iv }, key, plain(seed)));
-  return hex(iv) + hex(ct);
-}
-export async function open(key: CryptoKey, sealed: string): Promise<Uint8Array> {
-  const b = plain(unhex(sealed));
-  return new Uint8Array(await crypto.subtle.decrypt({ name: 'AES-GCM', iv: b.subarray(0, 12) }, key, b.subarray(12)));
-}
 
 // `prefix` keeps more than one harbor apart in one object's storage: the
 // exercise does that, a deployment never does.