Function files_key 

pub fn files_key(secret: &str, id: &str, hash: &str) -> String

The files URL’s unguessable part: HMAC(instance secret, id, hash), so a web page outside AgentMux can’t name a package’s files (they aren’t secret, but nothing else needs them).