nervur 0.21.1 → 0.21.3

package/README.md

@@ -35,31 +35,29 @@ while it stands. A folder opens in one run at a time. Bundled for a
 browser, in a page or a worker, it keeps itself in the IndexedDB
 database `where` names, else `nervur`, its seed sealed under a key the
 browser never hands out, speaks the web, and opens in one run at a time.
-On Cloudflare Workers it is one Durable Object, answering Quo at `/quo`
-on whatever host reaches it, and asking over TCP and the web. Anywhere
+On Cloudflare Workers it is one Durable Object of many a worker carries,
+answering Quo at `/<name>/quo` on whatever host reaches it, and asking
+over TCP and the web. Anywhere
 else it lives as long as its process and speaks the web. Hand in a
 terrain, as below, and that one is used.
 
 ## A harbor on the edge
 
 An edge harbor is born on your machine and carried there, so you pilot it
-from your own harbor, as you pilot one on a server. The worker is a
-folder of its own, an ES module project (`"type": "module"` in its
-`package.json`), holding the worker and its `wrangler.toml`:
+from your own harbor, as you pilot one on a server. One worker carries as
+many harbors as you pack into it, each a Durable Object by its name,
+answering at `/<name>/quo`. The worker is a folder of its own, an ES
+module project (`"type": "module"` in its `package.json`), holding the
+worker and its `wrangler.toml`:
 
 ```js
 // worker.js
-import { harborObject } from 'nervur/edge';
-import carried from './package.edge.json';
+import { harborObject, harborWorker } from 'nervur/edge';
+import pack from './pack.edge.json';
 import * as greetings from './greetings.js';
 
-export const Harbor = harborObject({ modules: [greetings], package: carried });
-
-export default {
-  fetch(request, env) {
-    return env.HARBOR.get(env.HARBOR.idFromName('main')).fetch(request);
-  },
-};
+export const Harbor = harborObject({ modules: [greetings], pack });
+export default harborWorker();
 ```
 
 ```toml
@@ -83,7 +81,7 @@ where the edge will reach it:
 ```sh
 nervur init --dir ./harbor
 nervur module add ./greetings.js --dir ./harbor
-nervur reach http://127.0.0.1:8787/quo --dir ./harbor
+nervur reach http://127.0.0.1:8787/main/quo --dir ./harbor
 nervur own me --dir ./harbor
 ```
 
@@ -91,34 +89,41 @@ nervur own me --dir ./harbor
 it on this machine first:
 
 ```sh
-nervur edge dev ./package.edge.json --dir ./harbor
+nervur edge dev ./pack.edge.json main --dir ./harbor
 ```
 
-`edge dev` packs the harbor into `package.edge.json` and runs your
-`wrangler dev` with its seed, keeping the object's storage in
-`.nervur-edge`, so the harbor stands again each time you run it. The
-first time the object starts, the package lands in its storage and the
-harbor opens under that seed; after that the storage is the harbor, and
-a new deploy leaves it be. Then, from your own harbor:
+`edge dev` packs the harbor as `main` into `pack.edge.json`, beside any
+harbor packed there before, and runs your `wrangler dev`, keeping the
+objects' storage and a secret of its own in `.nervur-edge`, so the
+harbor stands again each time you run it. The first time its object
+starts, the harbor lands in its storage; after that the storage is the
+harbor, and a new deploy leaves it be. Then, from your own harbor:
 
 ```sh
 nervur pilot edge '<the owner invitation>' --dir ./mine
 nervur host shop --via edge --dir ./mine
 ```
 
-For Cloudflare, name the address it will answer at with `reach`, then
-`nervur edge pack ./package.edge.json --dir ./harbor` prints the seed and
-writes the package. Keep the seed as the worker's secret,
-`wrangler secret put NERVUR_SEED`, and `wrangler deploy`.
+For Cloudflare, keep one secret for the worker, `wrangler secret put
+NERVUR_SECRET`, and hold the same one as `NERVUR_SECRET` in your shell.
+Name each harbor's address with `reach`, pack each with
+`nervur edge pack ./pack.edge.json <name> --dir <its folder>`, and
+`wrangler deploy`. A pack holds every seed sealed under that secret, so
+it ships in the bundle and opens nowhere else, and a new harbor is a new
+deploy, never a new secret.
 
 `pilot` opens the web carrier where the invitation names a web address.
-An object with no package draws its own seed, sealed under the worker's
-`NERVUR_SECRET`, and `stood` runs the worker's own code on it as root:
+A harbor may also be born on the edge, under a name `born` allows, with
+a seed of its own sealed the same way, and `stood` runs the worker's own
+code on it as root. A name the pack does not hold and `born` does not
+allow answers 404, so a stranger's request mints nothing:
 
 ```js
-export const Shop = harborObject({
+export const Harbor = harborObject({
   modules: [greetings],
-  stood: async (harbor) => {
+  pack,
+  born: (name) => name === 'shop',
+  stood: async (harbor, name) => {
     // runs once the harbor stands
   },
 });
@@ -212,6 +217,13 @@ catalogue, and the root's asks write the rest: `add` on the catalogue,
 `open`, `host`, `route`, and `boot` on a ward. `host { ward, seed? }`
 stands a ward under a seed you name, or a drawn one.
 
+A ward's place is kept by the root memory unless you name a store.
+`open { key: 'vault', class: 'org.nervur.ground-store' }` opens the
+store every ground ships, and `host { ward, store: 'vault' }` keeps the
+ward there. A class of yours extending `Store` keeps a ward in a bucket
+or a database the same way, and `move { ward, store }` carries a ward
+between keepers whole.
+
 ## What it holds
 
 - **Being, Faculty.** What you extend. A faculty's contract is its class

package/dist/cli/command.js

@@ -19,16 +19,19 @@
 //                                                   --with-seed the seed goes too
 //   nervur import <file>                            a carried harbor into an empty
 //                                                   folder, `-` being this input
-//   nervur edge pack <file>                         the harbor for an edge: its seed
-//                                                   printed, for the worker's
-//                                                   NERVUR_SEED, and its sealed
-//                                                   package written to the file
-//   nervur edge dev <file> [--port P]               the harbor packed to the file and
+//   nervur edge pack <file> <name>                  the harbor for an edge, under its
+//                                                   name, in the pack the file holds:
+//                                                   its seed sealed under
+//                                                   $NERVUR_SECRET, and its places
+//   nervur edge dev <file> <name> [--port P]        the harbor packed so, and the pack
 //                                                   run by the worker's own wrangler
 //                                                   dev, from this folder, at
-//                                                   http://127.0.0.1:P/quo
+//                                                   http://127.0.0.1:P/<name>/quo
 //   nervur open   <key> <kind>                      a faculty stands in the box ward
-//   nervur host   <ward> [--seed S]                 a hosted ward stands
+//   nervur host   <ward> [--seed S] [--store K]     a hosted ward stands, kept by the
+//                                                   root memory or the store K
+//   nervur move   <ward> <store | root>             a hosted ward carried to a store,
+//                                                   or back to the root memory
 //   nervur route  <ward pk> <address... | none>     where a ward is reached, in order
 //   nervur reach  <address...>                      where this harbor is reached, as
 //                                                   every invitation it gives says
@@ -59,8 +62,8 @@ import { edgeDev } from './edge.js';
 import { carry, isServed, land, open, pack, request, serve } from './harbor.js';
 // Where `edge dev` answers unless --port names another, wrangler's own.
 const EDGE_PORT = 8787;
-const USAGE = 'usage: nervur <init|serve|module|modules|census|sweep|open|host|route|reach|boot|unboot|public|invite|ask|own|disown|pilot|export|import|edge> [args] [--dir D] [--ward W] [--via V] [--seed S] [--with-seed] [--host H] [--port P]';
-const FLAGS = new Set(['dir', 'ward', 'via', 'seed', 'host', 'port']);
+const USAGE = 'usage: nervur <init|serve|module|modules|census|sweep|open|host|move|route|reach|boot|unboot|public|invite|ask|own|disown|pilot|export|import|edge> [args] [--dir D] [--ward W] [--via V] [--seed S] [--store K] [--with-seed] [--host H] [--port P]';
+const FLAGS = new Set(['dir', 'ward', 'via', 'seed', 'store', 'host', 'port']);
 // The one flag that stands alone, since what it names is a yes.
 const ALONE = 'with-seed';
 export const parse = (argv) => {
@@ -120,7 +123,11 @@ export const requestOf = (command, words, flags) => {
         }
         case 'host': {
             const [ward] = need(1);
-            return { method: 'host', args: { ward: ward, ...(flags.seed === undefined ? {} : { seed: flags.seed }) } };
+            return { method: 'host', args: { ward: ward, ...(flags.seed === undefined ? {} : { seed: flags.seed }), ...(flags.store === undefined ? {} : { store: flags.store }) } };
+        }
+        case 'move': {
+            const [ward, store] = need(2);
+            return { method: 'move', args: { ward: ward, store: store === 'root' ? null : store } };
         }
         case 'route': {
             const [ward, ...where] = words;
@@ -200,15 +207,15 @@ export const main = async (argv, env, print) => {
         return out({ landed: await land(dir, JSON.parse(text)) });
     }
     if (command === 'edge') {
-        if ((words[0] !== 'pack' && words[0] !== 'dev') || words.length !== 2)
-            throw new Error('edge takes pack or dev, and a file');
+        if ((words[0] !== 'pack' && words[0] !== 'dev') || words.length !== 3)
+            throw new Error('edge takes pack or dev, a file, and the harbor name');
         if (flags.via !== undefined)
             throw new Error(`edge ${words[0]} reads this folder, so it takes no --via`);
         if (await isServed(dir))
             throw new Error(`a harbor is served from ${dir}: stop it first`);
         if (words[0] === 'pack')
-            return out(await pack(dir, words[1]));
-        const dev = await edgeDev(dir, words[1], process.cwd(), flags.port === undefined ? EDGE_PORT : Number(flags.port));
+            return out(await pack(dir, words[1], words[2], env.NERVUR_SECRET));
+        const dev = await edgeDev(dir, words[1], words[2], process.cwd(), flags.port === undefined ? EDGE_PORT : Number(flags.port), env.NERVUR_SECRET);
         const stop = () => void dev.close().then(() => process.exit(0));
         process.once('SIGINT', stop);
         process.once('SIGTERM', stop);
@@ -231,7 +238,8 @@ export const main = async (argv, env, print) => {
         const [name, invitation, at] = words;
         const held = JSON.parse(invitation);
         const census = (await request(dir, {}));
-        const web = census.answer?.beings !== undefined && Object.hasOwn(census.answer.beings, WEB_OPENING.key);
+        const beings = census.answer?.notes?.beings;
+        const web = beings !== undefined && Object.hasOwn(beings, WEB_OPENING.key);
         for (const req of pilotRequests(name, held, at, web)) {
             const answer = await request(dir, req);
             if (!failed(answer))

package/dist/cli/edge.d.ts

@@ -4,4 +4,4 @@ export type EdgeDev = {
     readonly places: number;
     close(): Promise<void>;
 };
-export declare const edgeDev: (dir: string, file: string, cwd: string, port: number) => Promise<EdgeDev>;
+export declare const edgeDev: (dir: string, file: string, name: string, cwd: string, port: number, named?: string) => Promise<EdgeDev>;

package/dist/cli/edge.js

@@ -1,16 +1,22 @@
 // SPDX-License-Identifier: Apache-2.0
 // `nervur edge dev`: an edge harbor on this machine, as it will stand on
-// Cloudflare. The harbor of a folder is packed into the file the worker
-// imports, and the worker's own `wrangler dev` runs it, in the folder the
-// command runs from, with the seed handed as `NERVUR_SEED` through the
-// environment so no listing of processes shows it. The object's storage is
-// kept under `.nervur-edge` there, so a harbor landed once stands again
-// across restarts, as it does on Cloudflare.
+// Cloudflare. The harbor of a folder is packed under its name into the
+// pack the worker imports, beside the harbors the pack holds already, and
+// the worker's own `wrangler dev` runs them all, in the folder the command
+// runs from, with the secret handed as `NERVUR_SECRET` through the
+// environment so no listing of processes shows it. The secret is the one
+// the command's environment names, or one drawn once and kept under
+// `.nervur-edge`, beside the objects' storage, so a harbor landed once
+// stands again across restarts, as it does on Cloudflare.
 //
 // wrangler is the worker's tool and never the kit's: the one who deploys
 // an edge has it already, and `edge dev` finds it where npm put it.
 import { spawn } from 'node:child_process';
+import { existsSync } from 'node:fs';
+import { mkdir, readFile, writeFile } from 'node:fs/promises';
 import { join } from 'node:path';
+import { hex } from '../crypto/index.js';
+import { CryptoEntropy } from '../pointer/index.js';
 import { pack } from './harbor.js';
 export const EDGE_STATE = '.nervur-edge';
 const READY_TRIES = 240;
@@ -30,17 +36,30 @@ const ready = async (child, url, said) => {
     }
     throw new Error(`wrangler dev never answered at ${url}: ${said()}`);
 };
-export const edgeDev = async (dir, file, cwd, port) => {
-    const { seed, places } = (await pack(dir, file));
-    const child = spawn('npx', ['--no-install', 'wrangler', 'dev', '--ip', '127.0.0.1', '--port', String(port), '--persist-to', join(cwd, EDGE_STATE), '--log-level', 'warn'], {
+// The secret `edge dev` runs under: the one named, or the one kept here.
+const devSecret = async (state, named) => {
+    if (named)
+        return named;
+    const file = join(state, 'secret');
+    if (!existsSync(file)) {
+        await mkdir(state, { recursive: true, mode: 0o700 });
+        await writeFile(file, `${hex(new CryptoEntropy().draw(32))}\n`, { mode: 0o600, flag: 'wx' });
+    }
+    return (await readFile(file, 'utf8')).trim();
+};
+export const edgeDev = async (dir, file, name, cwd, port, named) => {
+    const state = join(cwd, EDGE_STATE);
+    const secret = await devSecret(state, named);
+    const { places } = (await pack(dir, file, name, secret));
+    const child = spawn('npx', ['--no-install', 'wrangler', 'dev', '--ip', '127.0.0.1', '--port', String(port), '--persist-to', state, '--log-level', 'warn'], {
         cwd,
-        env: { ...process.env, NERVUR_SEED: seed, CLOUDFLARE_INCLUDE_PROCESS_ENV: 'true' },
+        env: { ...process.env, NERVUR_SECRET: secret, CLOUDFLARE_INCLUDE_PROCESS_ENV: 'true' },
         stdio: ['ignore', 'ignore', 'pipe'],
         detached: true,
     });
     let err = '';
     child.stderr.on('data', (chunk) => (err = `${err}${chunk.toString('utf8')}`.slice(-4000)));
-    const at = `http://127.0.0.1:${String(port)}/quo`;
+    const at = `http://127.0.0.1:${String(port)}/${name}/quo`;
     const close = () => new Promise((done) => {
         if (child.exitCode !== null)
             return done();

package/dist/cli/harbor.d.ts

@@ -4,7 +4,7 @@ export declare const open: (dir: string) => Promise<Harbor>;
 export declare const isServed: (dir: string) => Promise<boolean>;
 export declare const request: (dir: string, req: RootRequest) => Promise<JsonObject>;
 export declare const carry: (dir: string, seed: boolean) => Promise<Carried>;
-export declare const pack: (dir: string, file: string) => Promise<JsonObject>;
+export declare const pack: (dir: string, file: string, name: string, secret: string | undefined) => Promise<JsonObject>;
 export declare const land: (dir: string, value: unknown) => Promise<string[]>;
 export type Served = {
     pk: string;

package/dist/cli/harbor.js

@@ -9,7 +9,8 @@
 import { existsSync } from 'node:fs';
 import { mkdir, readFile, writeFile } from 'node:fs/promises';
 import { join } from 'node:path';
-import { hex } from '../crypto/index.js';
+import { hex, unhex } from '../crypto/index.js';
+import { isHarborName, readPack, sealSeed } from '../edge/index.js';
 import { FolderCustody, FolderMemory } from '../folder/index.js';
 import { carryPlaces, Harbor, landPlaces, readCarried, rootLine } from '../harbor/index.js';
 import { askServed, MODULES, NodeTerrain, socketOf } from '../node/index.js';
@@ -45,14 +46,25 @@ export const carry = async (dir, seed) => {
         ...(modules ? { modules } : {}),
     };
 };
-// What `nervur edge pack` hands a deploy: the seed, for the worker's
-// `NERVUR_SEED`, and the sealed package without it, for the bundle.
-export const pack = async (dir, file) => {
+// What `nervur edge pack` hands a deploy: the harbor of a folder, under
+// its name, in the pack the worker bundles, its seed sealed under the
+// worker's `NERVUR_SECRET` beside its sealed places. Every other harbor
+// the pack holds stays, so one worker carries them all, and nothing in the
+// pack opens without the secret.
+export const pack = async (dir, file, name, secret) => {
+    if (!isHarborName(name))
+        throw new Error(`${name} is no harbor name: lowercase letters, digits and -`);
+    if (!secret)
+        throw new Error('edge pack seals the seed under NERVUR_SECRET, and none is set');
     if (!existsSync(join(dir, 'seed')))
         throw new Error(`no harbor stands at ${dir}`);
     const { seed, places } = await carry(dir, true);
-    await writeFile(file, `${JSON.stringify({ places })}\n`, { mode: 0o600 });
-    return { seed: seed, package: file, places: Object.keys(places).length };
+    const held = existsSync(file) ? readPack(JSON.parse(await readFile(file, 'utf8'))) : {};
+    if (held === null)
+        throw new Error(`${file} is no pack`);
+    const packed = { ...held, [name]: { sealed: await sealSeed(secret, unhex(seed)), places } };
+    await writeFile(file, `${JSON.stringify(packed)}\n`, { mode: 0o600 });
+    return { packed: name, package: file, harbors: Object.keys(packed).sort(), places: Object.keys(places).length };
 };
 // A carried harbor into an empty folder. A folder holding a seed or a
 // place is left as it stands, and a package with no seed needs one there

package/dist/edge/index.d.ts

@@ -18,14 +18,21 @@ export interface EdgeState {
     blockConcurrencyWhile<T>(work: () => Promise<T>): Promise<T>;
 }
 export type EdgeEnv = {
-    readonly NERVUR_SEED?: string;
     readonly NERVUR_SECRET?: string;
 };
 export type EdgeGiven = {
     readonly state: EdgeState;
     readonly env: EdgeEnv;
-    readonly package?: Carried;
+    readonly package?: Packed;
 };
+export type Packed = {
+    readonly sealed: string;
+    readonly places: Carried['places'];
+};
+export type Pack = Record<string, Packed>;
+export declare const isHarborName: (name: unknown) => name is string;
+export declare const readPack: (value: unknown) => Pack | null;
+export declare const sealSeed: (secret: string, seed: Uint8Array, entropy?: Entropy) => Promise<string>;
 export declare class EdgeMemory extends Memory {
     #private;
     constructor(storage: EdgeStorage, root?: string);
@@ -34,13 +41,11 @@ export declare class EdgeMemory extends Memory {
     places(): Promise<string[]>;
     forget(place: string): Promise<void>;
 }
-export type EdgeKeys = {
-    readonly seed?: string | undefined;
-    readonly secret?: string | undefined;
-};
 export declare class EdgeCustody extends Custody {
     #private;
-    constructor(storage: EdgeStorage, keys: EdgeKeys, entropy?: Entropy, root?: string);
+    constructor(storage: EdgeStorage, secret: string | undefined, entropy?: Entropy, root?: string);
+    kept(): Promise<boolean>;
+    land(sealed: string, txn?: EdgeStorage): Promise<void>;
     seed(): Promise<Uint8Array>;
 }
 export declare const edgeTcp: GroundFaculty;
@@ -58,14 +63,19 @@ export declare class EdgeTerrain extends PointerTerrain {
     answer(request: Request): Promise<Response>;
 }
 export declare const edgeGround: GroundProbe;
+export declare const harborNameOf: (request: Request) => string | null;
 export type HarborObjectParts = {
     readonly modules: readonly Module[];
-    readonly package?: Carried | ((env: EdgeEnv) => Carried | undefined);
-    readonly path?: string;
-    readonly stood?: (harbor: Harbor) => Promise<void>;
+    readonly pack?: Pack | ((env: EdgeEnv) => Pack | undefined);
+    readonly born?: (name: string) => boolean;
+    readonly stood?: (harbor: Harbor, name: string) => Promise<void>;
 };
-export type HarborObjectClass = new (state: EdgeState, env: EdgeEnv) => {
-    readonly harbor: Promise<Harbor>;
+export type HarborObject = {
+    harborFor(request: Request): Promise<Harbor | null>;
     fetch(request: Request): Promise<Response>;
 };
-export declare const harborObject: ({ modules, package: carried, path, stood }: HarborObjectParts) => HarborObjectClass;
+export type HarborObjectClass = new (state: EdgeState, env: EdgeEnv) => HarborObject;
+export declare const harborObject: ({ modules, pack, born, stood }: HarborObjectParts) => HarborObjectClass;
+export declare const harborWorker: (binding?: string) => {
+    fetch(request: Request, env: Record<string, unknown>): Promise<Response>;
+};

package/dist/edge/index.js

@@ -7,8 +7,8 @@ var __rewriteRelativeImportExtension = (this && this.__rewriteRelativeImportExte
     return path;
 };
 import { Custody, Memory } from '../contract/index.js';
-import { decrypt, encrypt, hkdf, isHex, unhex, utf8 } from '../crypto/index.js';
-import { addGround, CarrierFaculty, Harbor, landPlaces, UNDIALED } from '../harbor/index.js';
+import { concat, decrypt, encrypt, hex, hkdf, isHex, unhex, utf8 } from '../crypto/index.js';
+import { addGround, CarrierFaculty, Harbor, landPlaces, readCarried, UNDIALED } from '../harbor/index.js';
 import { answerHeld, answerPost, askFrame, FrameReader, TCP, TCP_OPENING, WEB_OPENING, webFaculty, webPush } from '../line/index.js';
 import { CryptoEntropy, HeldLoader, PointerTerrain } from '../pointer/index.js';
 import { tcpAddress, tcpAt } from '../quo/index.js';
@@ -20,6 +20,30 @@ const SEED = 'c/seed';
 const BATCH = 128;
 const SEAL_INFO = utf8('nervur edge custody');
 const MAX_ID = 0xffff_ffff;
+// A harbor's name on the edge: one path segment, so it is where the
+// harbor answers, `/<name>/quo`.
+export const isHarborName = (name) => typeof name === 'string' && /^[a-z0-9][a-z0-9-]{0,62}$/.test(name);
+const NONCE = 12;
+// A pack as JSON reads, or null for anything else.
+export const readPack = (value) => {
+    if (typeof value !== 'object' || value === null || Array.isArray(value))
+        return null;
+    const pack = {};
+    for (const [name, entry] of Object.entries(value)) {
+        const { sealed, places } = (entry ?? {});
+        const carried = readCarried({ places });
+        if (!isHarborName(name) || !isHex(sealed) || sealed.length <= NONCE * 2 || carried === null)
+            return null;
+        pack[name] = { sealed: sealed, places: carried.places };
+    }
+    return pack;
+};
+const sealKey = (secret) => hkdf(utf8(secret), SEAL_INFO, 32);
+// A seed sealed under a worker's secret, as a pack keeps it.
+export const sealSeed = async (secret, seed, entropy = new CryptoEntropy()) => {
+    const nonce = entropy.draw(NONCE);
+    return hex(concat(nonce, await encrypt(await sealKey(secret), nonce, new Uint8Array(0), seed)));
+};
 const chunks = (items) => Array.from({ length: Math.ceil(items.length / BATCH) }, (_, i) => items.slice(i * BATCH, (i + 1) * BATCH));
 const bytesOf = (value) => new Uint8Array(value instanceof ArrayBuffer ? value : value);
 // A body keeps its keys under `root`, so one object may hold more than one
@@ -66,28 +90,34 @@ export class EdgeMemory extends Memory {
         });
     }
 }
+// The seed, kept sealed under a key the worker's secret gives, so the
+// storage alone opens nothing: the one a pack landed, or one drawn the
+// first time it is asked for. A worker with no secret stands no harbor.
 export class EdgeCustody extends Custody {
     #storage;
-    #keys;
+    #secret;
     #entropy;
     #key;
-    constructor(storage, keys, entropy = new CryptoEntropy(), root = '') {
+    constructor(storage, secret, entropy = new CryptoEntropy(), root = '') {
         super();
         this.#storage = storage;
-        this.#keys = keys;
+        this.#secret = secret;
         this.#entropy = entropy;
         this.#key = `${root}${SEED}`;
     }
+    // Whether a seed is kept, so a pack lands only where none is.
+    async kept() {
+        return (await this.#storage.get(this.#key)) !== undefined;
+    }
+    // A packed seed, sealed as `sealSeed` sealed it, kept as it came.
+    async land(sealed, txn = this.#storage) {
+        const bytes = unhex(sealed);
+        await txn.put({ [this.#key]: { nonce: bytes.slice(0, NONCE), sealed: bytes.slice(NONCE) } });
+    }
     async seed() {
-        const { seed: named, secret } = this.#keys;
-        if (named !== undefined) {
-            if (!isHex(named.trim(), 32))
-                throw new Error('NERVUR_SEED is not 64 hex');
-            return unhex(named.trim());
-        }
-        if (!secret)
+        if (!this.#secret)
             throw new Error('the worker holds no NERVUR_SECRET');
-        const key = await hkdf(utf8(secret), SEAL_INFO, 32);
+        const key = await sealKey(this.#secret);
         return this.#storage.transaction(async (txn) => {
             const kept = (await txn.get(this.#key));
             if (kept) {
@@ -97,7 +127,7 @@ export class EdgeCustody extends Custody {
                 return seed;
             }
             const seed = this.#entropy.draw(32);
-            const nonce = this.#entropy.draw(12);
+            const nonce = this.#entropy.draw(NONCE);
             await txn.put({ [this.#key]: { nonce, sealed: await encrypt(key, nonce, new Uint8Array(0), seed) } });
             return seed.slice();
         });
@@ -245,24 +275,24 @@ export class EdgeTerrain extends PointerTerrain {
         super({
             entropy,
             loader: new HeldLoader(parts.modules ?? []),
-            // Only a harbor carried here takes the worker's NERVUR_SEED; every
-            // other object of the worker draws its own.
-            custody: new EdgeCustody(storage, { seed: parts.given.package ? parts.given.env.NERVUR_SEED : undefined, secret: parts.given.env.NERVUR_SECRET }, entropy),
+            custody: new EdgeCustody(storage, parts.given.env.NERVUR_SECRET, entropy),
             memory: new EdgeMemory(storage),
             faculties: [edgeTcp, webFaculty(edgeServe), webPush],
             opens: [TCP_OPENING, WEB_OPENING],
         });
         this.given = parts.given;
     }
-    // A carried package lands where the object keeps nothing yet, and only
-    // under the seed it was sealed with, the worker's `NERVUR_SEED`.
+    // A packed harbor lands where the object keeps no seed yet: its places
+    // first and its seed last, so a start cut short lands it whole again,
+    // and once the seed is kept the storage is the harbor and a new deploy
+    // leaves it be. A seed sealed under another secret does not open.
     async claim() {
-        const { package: carried, env } = this.given;
-        if (!carried || (await this.memory.places()).length > 0)
+        const packed = this.given.package;
+        const custody = this.custody;
+        if (!packed || (await custody.kept()))
             return;
-        if (env.NERVUR_SEED === undefined)
-            throw new Error('a carried package opens only under NERVUR_SEED');
-        await landPlaces(this.memory, carried);
+        await landPlaces(this.memory, { places: packed.places });
+        await custody.land(packed.sealed);
     }
     stand(harbor) {
         this.#harbor = harbor;
@@ -299,32 +329,56 @@ export const edgeGround = {
     fits: ({ given }) => isGiven(given),
     terrain: ({ given, modules }) => new EdgeTerrain({ given: given, ...(modules ? { modules } : {}) }),
 };
-// A Durable Object class whose every instance is one harbor: opened once
-// per object, its web carrier opened, and every request it receives
-// answered by that carrier at `path`.
-export const harborObject = ({ modules, package: carried, path = '/quo', stood }) => class HarborObject {
+// The harbor a request is for: the first segment of its path.
+export const harborNameOf = (request) => {
+    const name = new URL(request.url).pathname.split('/')[1];
+    return isHarborName(name) ? name : null;
+};
+// A Durable Object class whose every instance is one harbor, by the name
+// the worker reached it under: opened at its first request, the one its
+// pack holds under that name or one `born` allows, its web carrier opened,
+// and every request it receives answered by that carrier at
+// `/<name>/quo`. An object answers the one name it opened under, and a
+// name it may not open is 404, with nothing written.
+export const harborObject = ({ modules, pack, born, stood }) => class {
+    #state;
+    #env;
+    #name;
     #opening;
-    // The object's harbor, once it stands.
-    get harbor() {
-        return this.#opening;
-    }
     constructor(state, env) {
         addGround(edgeGround);
-        const held = typeof carried === 'function' ? carried(env) : carried;
-        const given = { state, env, ...(held ? { package: held } : {}) };
+        this.#state = state;
+        this.#env = env;
+    }
+    // The harbor a request names, opened once, or null where it names
+    // another harbor or none.
+    harborFor(request) {
+        const name = harborNameOf(request);
+        if (name === null || (this.#name !== undefined && this.#name !== name))
+            return Promise.resolve(null);
+        const packed = typeof pack === 'function' ? pack(this.#env) : pack;
+        const held = packed && Object.hasOwn(packed, name) ? packed[name] : undefined;
+        if (this.#name === undefined && !held && !born?.(name))
+            return Promise.resolve(null);
+        this.#name = name;
         // Opened inside the object's block, so no request reaches it half
         // open and its storage answers the opening.
-        this.#opening = state.blockConcurrencyWhile(async () => {
+        this.#opening ??= this.#state.blockConcurrencyWhile(async () => {
+            const given = { state: this.#state, env: this.#env, ...(held ? { package: held } : {}) };
             const harbor = await Harbor.open({ modules, given });
             if (!harbor.box.being(WEB_OPENING.key))
                 await harbor.root('open', { key: WEB_OPENING.key, class: WEB_OPENING.kind });
-            await stood?.(harbor);
+            await stood?.(harbor, name);
             return harbor;
         });
+        return this.#opening;
     }
     async fetch(request) {
-        const harbor = await this.#opening;
+        const harbor = await this.harborFor(request);
+        if (!harbor)
+            return new Response(null, { status: 404 });
         const terrain = harbor.terrain;
+        const path = `/${this.#name}/quo`;
         if (terrain.listening?.path !== path) {
             const url = new URL(request.url);
             await harbor.root('ask', { being: WEB_OPENING.key, method: 'listen', args: { host: url.hostname, port: url.port === '' ? 0 : Number(url.port), path } });
@@ -332,3 +386,15 @@ export const harborObject = ({ modules, package: carried, path = '/quo', stood }
         return terrain.answer(request);
     }
 };
+// A worker of many harbors: each request goes to the object of the
+// harbor its path names, in the Durable Object namespace bound as
+// `binding`, and a path naming none is 404.
+export const harborWorker = (binding = 'HARBOR') => ({
+    fetch(request, env) {
+        const name = harborNameOf(request);
+        const objects = env[binding];
+        if (name === null || !objects)
+            return Promise.resolve(new Response(null, { status: 404 }));
+        return objects.get(objects.idFromName(name)).fetch(request);
+    },
+});