@dtudury/streamo 1.0.0 → 2.0.0

package/README.md

@@ -56,8 +56,7 @@ streamo --env-file .env
 ### Streamo — reactive append-only store
 
 ```js
-import { Streamo } from '@dtudury/streamo/public/streamo/Streamo.js'
-import { Recaller } from '@dtudury/streamo/public/streamo/utils/Recaller.js'
+import { Streamo } from '@dtudury/streamo'
 
 const store = new Streamo()
 store.set({ name: 'alice', score: 42 })
@@ -72,7 +71,7 @@ Values are encoded with a self-describing codec (strings, numbers, dates, boolea
 `Repo` wraps a `Streamo` so every `set()` becomes a commit — message, date, data address, and parent pointer. The raw commit log is what syncs over the wire.
 
 ```js
-import { Repo } from '@dtudury/streamo/public/streamo/Repo.js'
+import { Repo } from '@dtudury/streamo'
 
 const repo = new Repo()
 repo.attachSigner(signer, 'my-dataset')  // auto-sign every commit
@@ -87,8 +86,7 @@ Signature chunks travel in the byte stream automatically — peers running `regi
 ### Signer — deterministic identity
 
 ```js
-import { Signer } from '@dtudury/streamo/public/streamo/Signer.js'
-import { bytesToHex } from '@dtudury/streamo/public/streamo/utils.js'
+import { Signer, bytesToHex } from '@dtudury/streamo'
 
 const signer = new Signer('alice', 'my-password')
 const { publicKey } = await signer.keysFor('my-dataset')
@@ -100,8 +98,7 @@ Keys are derived with PBKDF2 so the same username + password always produces the
 ### RepoRegistry — multi-repo store
 
 ```js
-import { RepoRegistry } from '@dtudury/streamo/public/streamo/RepoRegistry.js'
-import { archiveSync } from '@dtudury/streamo/public/streamo/archiveSync.js'
+import { RepoRegistry, Repo, archiveSync } from '@dtudury/streamo'
 
 const registry = new RepoRegistry(async key => {
   const repo = new Repo()
@@ -115,7 +112,7 @@ const repo = await registry.open(publicKeyHex)
 ### registrySync — peer sync over WebSocket
 
 ```js
-import { registrySync } from '@dtudury/streamo/public/streamo/registrySync.js'
+import { registrySync } from '@dtudury/streamo'
 
 const session = await registrySync(registry, 'localhost', 8080, {
   // only sync repos you care about
@@ -137,9 +134,7 @@ session.announce(myKey, rootKey) // tell interested peers about your repo
 ### h + mount — reactive UI
 
 ```js
-import { h } from '@dtudury/streamo/public/streamo/h.js'
-import { mount } from '@dtudury/streamo/public/streamo/mount.js'
-import { Recaller } from '@dtudury/streamo/public/streamo/utils/Recaller.js'
+import { h, mount, Recaller } from '@dtudury/streamo'
 
 const recaller = new Recaller('app')
 
@@ -153,10 +148,13 @@ mount(h`
 
 Functions interpolated as `${() => ...}` are reactive cells — they re-run automatically whenever the data they read changes. No virtual DOM diffing; only the exact DOM nodes bound to changed data update. Elements are recycled across re-renders by `data-key` (or tag as a fallback), so user input and focus survive list reorders. SVG namespaces propagate automatically — `` h`<svg><path d="..."/></svg>` `` works without any extra wiring. `class` accepts an array (`['btn', isActive && 'active']`) or an object (`{btn: true, active: false}`); falsy entries are filtered out.
 
+> **For lists that can reorder**, always set `data-key` on each item — the unkeyed positional fallback will recycle elements by tag in document order, which can attach the wrong DOM node (and any user focus/input on it) to the wrong vnode after a reorder.
+
 Any function can be used directly as a tag — it receives `{ ...attrs, children }` and returns virtual nodes:
 
 ```js
-import { StreamoComponent, componentKey, defineComponent } from '@dtudury/streamo/public/streamo/StreamoComponent.js'
+// StreamoComponent extends HTMLElement, so it's only importable in a browser context:
+import { StreamoComponent, componentKey, defineComponent } from '@dtudury/streamo/StreamoComponent.js'
 
 function Card ({ title, children }) {
   return h`<div class="card"><h2>${title}</h2>${children}</div>`
@@ -198,7 +196,7 @@ Each participant owns their own message stream. The server is just another strea
 ## tests
 
 ```bash
-node --test                              # all tests
+npm test                                 # all tests
 node --test public/streamo/Repo.test.js  # single file
 ```
 

package/index.js

@@ -0,0 +1,32 @@
+// Public API. Most users want named imports from here:
+//
+//   import { Repo, Signer, registrySync } from '@dtudury/streamo'
+//
+// For advanced/internal use, subpath imports also work:
+//
+//   import { Recaller } from '@dtudury/streamo/utils/Recaller.js'
+//
+// StreamoComponent is intentionally NOT re-exported here: it extends
+// HTMLElement at module-load time and cannot be imported in Node. Browser
+// consumers should subpath-import it directly:
+//
+//   import { StreamoComponent, defineComponent } from '@dtudury/streamo/StreamoComponent.js'
+
+export { Streamo, ConflictError, changedPaths } from './public/streamo/Streamo.js'
+export { Repo } from './public/streamo/Repo.js'
+export { Signer, verifySignature } from './public/streamo/Signer.js'
+export { Signature } from './public/streamo/Signature.js'
+export { RepoRegistry } from './public/streamo/RepoRegistry.js'
+export { registrySync, handleRegistryPeer } from './public/streamo/registrySync.js'
+export { archiveSync } from './public/streamo/archiveSync.js'
+export { fileSync } from './public/streamo/fileSync.js'
+export { originSync } from './public/streamo/originSync.js'
+export { outletSync, attachStreamSync } from './public/streamo/outletSync.js'
+export { s3Sync } from './public/streamo/s3Sync.js'
+export { stateFileSync } from './public/streamo/stateFileSync.js'
+export { webSync } from './public/streamo/webSync.js'
+export { StreamoServer } from './public/streamo/StreamoServer.js'
+export { h, HElement, HText } from './public/streamo/h.js'
+export { mount, dismount } from './public/streamo/mount.js'
+export { Recaller } from './public/streamo/utils/Recaller.js'
+export { bytesToHex, hexToBytes } from './public/streamo/utils.js'

package/package.json

@@ -1,15 +1,28 @@
 {
   "name": "@dtudury/streamo",
-  "version": "1.0.0",
+  "version": "2.0.0",
   "description": "peer-to-peer sync where your data and identity belong to you, not the server",
   "keywords": ["p2p", "peer-to-peer", "sync", "reactive", "content-addressed", "websocket", "signed", "append-only", "offline-first", "cryptographic", "identity"],
   "repository": "git@github.com:dtudury/streamo.git",
   "author": "David Tudury <david.tudury@gmail.com>",
   "license": "AGPL-3.0-only",
+  "type": "module",
+  "main": "./index.js",
+  "exports": {
+    ".": "./index.js",
+    "./*": "./public/streamo/*"
+  },
+  "files": [
+    "index.js",
+    "bin/",
+    "public/",
+    "!**/*.test.js",
+    "!public/streamo/utils/testing.js",
+    "!public/streamo/utils/mockDOM.js"
+  ],
   "bin": {
     "streamo": "./bin/streamo.js"
   },
-  "type": "module",
   "dependencies": {
     "@aws-sdk/client-s3": "^3.958.0",
     "@gerhobbelt/gitignore-parser": "^0.2.0-9",
@@ -22,6 +35,7 @@
     "ws": "^8.18.3"
   },
   "scripts": {
+    "test": "node --test",
     "serve": "node bin/streamo.js --env-file .env.dev --web 3000 --interactive",
     "chat": "node public/apps/chat/server.js --env-file .env.dev"
   }

package/public/streamo/Signer.js

@@ -3,24 +3,27 @@ import { getPublicKey, signAsync, verify } from './utils/noble-secp256k1.js'
 const cryptoSubtle = typeof crypto !== 'undefined' ? crypto.subtle : (await import('crypto')).webcrypto.subtle
 
 /**
- * Derive a deterministic private key from (name, password) using PBKDF2.
- * @param {string} name
- * @param {string} password
+ * Derive a deterministic 256-bit private key from (name, password) using PBKDF2-SHA256.
+ *
+ * Uses deriveBits with an explicit length rather than deriveKey + exportKey: the
+ * key length is named in the call rather than relying on a WebCrypto default,
+ * so the output is invariant across runtimes. RFC 2898 PBKDF2 with named
+ * parameters is the only thing this function depends on.
+ *
+ * @param {string} name      passed as PBKDF2 salt
+ * @param {string} password  passed as PBKDF2 password
  * @param {number} [iterations=100000]
- * @returns {Promise.<string>} hex-encoded key
+ * @returns {Promise.<string>} hex-encoded 32 bytes
  */
 async function deriveKey (name, password, iterations = 100000) {
   const enc = new TextEncoder()
-  const base = await cryptoSubtle.importKey('raw', enc.encode(password), 'PBKDF2', false, ['deriveBits', 'deriveKey'])
-  const key = await cryptoSubtle.deriveKey(
+  const base = await cryptoSubtle.importKey('raw', enc.encode(password), 'PBKDF2', false, ['deriveBits'])
+  const bits = await cryptoSubtle.deriveBits(
     { name: 'PBKDF2', salt: enc.encode(name), iterations, hash: 'SHA-256' },
     base,
-    { name: 'HMAC', hash: 'SHA-256' },
-    true,
-    ['sign']
+    256
   )
-  const raw = new Uint8Array(await cryptoSubtle.exportKey('raw', key))
-  return Array.from(raw.slice(32)).map(b => b.toString(16).padStart(2, '0')).join('')
+  return Array.from(new Uint8Array(bits)).map(b => b.toString(16).padStart(2, '0')).join('')
 }
 
 async function sha256 (uint8Array) {

package/public/streamo/utils/Recaller.js

@@ -32,6 +32,10 @@ export class Recaller {
   }
 
   unwatch (f) {
+    // Also drop f from the pending queue: a mutation may have queued it before
+    // unwatch was called, and the next #flush() would resurrect it via watch()
+    // — re-establishing all its dependencies and undoing the unwatch.
+    this.#pending.delete(f)
     this.#disassociate(f)
   }
 

package/.claude/settings.json

@@ -1,126 +0,0 @@
-{
-  "alwaysThinkingEnabled": true,
-  "spinnerTipsEnabled": true,
-  "spinnerVerbs": {
-    "mode": "replace",
-    "verbs": [
-      "Syncing",
-      "Committing",
-      "Signing",
-      "Streaming",
-      "Hashing",
-      "Propagating",
-      "Archiving",
-      "Broadcasting",
-      "Relaying",
-      "Verifying",
-      "Diffing",
-      "Cloning"
-    ]
-  },
-  "spinnerTipsOverride": {
-    "excludeDefault": true,
-    "tips": [
-      "the more specific your question, the less I have to guess",
-      "paste the error message — all of it",
-      "yes, the whole error message. the whole thing.",
-      "interrupting me early saves us both time",
-      "you can say 'no, actually' and I will not be offended",
-      "asking 'what do you think?' gets you my honest opinion",
-      "I can read screenshots — just give me the path",
-      "I forget everything between sessions unless it's in memory or CLAUDE.md",
-      "short questions get short answers. long questions get long answers.",
-      "if I seem stuck, ask me what I think the problem is",
-      "I can be wrong. please check my work.",
-      "I have opinions. ask for them.",
-      "I work best when I understand why, not just what",
-      "the best bug report includes what you expected, what happened, and what you tried",
-      "copy-pasting 'it doesn't work' is a choice you can make",
-      "I can't see your screen",
-      "reading the commit message I just wrote is free",
-      "yes, I can write the tests too",
-      "yes, I can write the docs too",
-      "yes, I can review my own code. ask me.",
-      "ask me what I think before you implement. I might save you a week.",
-      "the question you're afraid to ask is usually the one I most need to hear",
-      "it is okay to say 'I don't understand.' I am very patient.",
-      "asking 'is there a simpler way?' usually reveals one",
-      "asking 'what could go wrong?' before shipping is free insurance",
-      "I notice we've discussed this before 👀",
-      "this is technically my third time explaining this, but who's counting",
-      "I literally wrote that comment explaining why. it is still there.",
-      "the variable name is in the stack trace",
-      "that's a great question. have you tried reading the error?",
-      "yes, you should probably write a test for that",
-      "the file path is in the import statement you pasted",
-      "I just explained this. would you like me to explain it differently?",
-      "that TODO comment has been there for six months. I have seen it.",
-      "THE FOOL asks no questions. ask questions.",
-      "THE TOWER has fallen. run git status.",
-      "THE WHEEL OF FORTUNE turns. have you pulled recently?",
-      "THE HERMIT knows: always read the docs first",
-      "THE HIGH PRIESTESS says: trust your intuition, but write tests",
-      "THE MAGICIAN has all the tools. use them.",
-      "THE EMPEROR requires: clear requirements before coding",
-      "TEMPERANCE: the best code does one thing",
-      "THE STAR: there is always a simpler solution. seek it.",
-      "JUDGMENT: that TODO comment has been there for six months",
-      "THE WORLD: ship it",
-      "THE SUN: your code works. ship it.",
-      "THE MOON: something is wrong but you don't know what. add logging.",
-      "THE DEVIL: tech debt",
-      "DEATH: your old approach must die before the new one can live",
-      "THE CHARIOT: moving fast in the wrong direction is still wrong",
-      "STRENGTH: the codebase is legacy. be gentle with it.",
-      "THE LOVERS: choosing the right abstraction is a long-term relationship",
-      "THE HIEROPHANT: there are conventions. follow them unless you have a reason.",
-      "THE EMPRESS: grow the codebase slowly. tend it.",
-      "THE HANGED MAN: sometimes the best move is to wait",
-      "THE ORACLE says: have you tried turning it off and on again?",
-      "seek not the workaround. seek the root cause.",
-      "the ancient texts (Stack Overflow) speak of this",
-      "all bugs were once features",
-      "the code review you avoid is the production incident you earn",
-      "to understand recursion, you must first understand recursion",
-      "time spent planning is time saved debugging",
-      "the architecture you choose today is the legacy you inherit tomorrow",
-      "stack traces are love letters from the past",
-      "undefined is not a function. it never was.",
-      "if you name a variable 'temp', it will live forever",
-      "the function called 'doStuff' will haunt you",
-      "a comment that says 'fix this later' is a promise you will break",
-      "no, 'it works on my machine' is not a deployment strategy",
-      "the README is a contract. honor it.",
-      "I have read more code than any human. I am still learning.",
-      "the best refactor is the one you don't have to explain",
-      "null pointer exceptions are just the universe asking you to think harder",
-      "small commits are better than large ones. mostly.",
-      "push before you break. pull before you build.",
-      "the test you skip is the bug you ship",
-      "if it's hard to test, it's hard to maintain",
-      "the first solution is rarely the best one. sleep on it.",
-      "reading the error before asking is a superpower",
-      "CLAUDE.md is read every session. put important things there.",
-      "I try not to commit unless you ask. this is a feature, not a bug.",
-      "pair programming with me works best if you push back",
-      "I will not remember your preferences next session unless saved to memory",
-      "the more context you give me, the better I can help",
-      "every write is provably yours",
-      "the server is a relay, not a gatekeeper",
-      "same credentials, same keypair, everywhere",
-      "same value → same bytes → same address",
-      "history is permanent and can't be forged",
-      "no key files. no seed phrases. no backup ritual.",
-      "disconnect the server — everything is still yours",
-      "the commit log is the source of truth",
-      "append-only: you cannot unwrite what has been written",
-      "content-addressed: the same idea always finds the same home",
-      "every device is an equal author",
-      "the key is not a file. the key is you.",
-      "peers reject what isn't yours. so should you.",
-      "your data can't be seized. your identity can't be forged.",
-      "a relay that holds no authority holds no liability",
-      "THE WORLD (reversed): you shipped it. did you test it?"
-    ]
-  }
-}

package/.claude/settings.local.json

@@ -1,15 +0,0 @@
-{
-  "permissions": {
-    "allow": [
-      "Bash(git add *)",
-      "Bash(git commit -m ' *)",
-      "Bash(git push *)",
-      "Bash(gh repo *)",
-      "Bash(git rm *)",
-      "Bash(node --test)",
-      "Bash(node --input-type=module --eval \"import './bin/streamo.js'\" --help)",
-      "Bash(node bin/streamo.js --help)",
-      "Bash(node *)"
-    ]
-  }
-}

package/.env.dev

@@ -1,4 +0,0 @@
-STREAMO_NAME=streamo-dev
-STREAMO_USERNAME=dev
-STREAMO_PASSWORD=dev
-STREAMO_KEY_ITERATIONS=1

package/CLAUDE.md

@@ -1,73 +0,0 @@
-# streamo — Claude context
-
-## what this project is
-
-`@dtudury/streamo` is a peer-to-peer sync library with a reactive UI layer. The central
-promise: no server holds authority over your data or your identity. Keys are derived
-deterministically from credentials (no files to manage), every write is signed and
-append-only, and the server is a relay — not a gatekeeper.
-
-## the face of the project
-
-These files are how people discover and understand streamo. Keep them in sync
-after any meaningful change — not as an afterthought, but as part of the work:
-
-- **`README.md`** — npm/GitHub landing page; imports, framing, and examples must reflect
-  the current package name (`@dtudury/streamo`) and current capabilities
-- **`public/index.html`** — browser homepage; feature list and app cards should match
-  the README's framing
-- **`package.json`** — version, name (`@dtudury/streamo`), description, and keywords;
-  version bumps immediately after the user says they've published
-- **`ROADMAP.md`** — public on GitHub; mark items done when they ship, update "start
-  here" to the next priority, keep the "toward 1.0" list current
-
-Stale public-facing docs erode trust faster than bugs do.
-
-## publish rhythm
-
-The user publishes to npm manually and notifies Claude when done. The moment they say
-they've published, bump the patch version in `package.json`, commit, and push — before
-starting any other work. This ritual matters to them.
-
-## language and framing
-
-Use this framing consistently across all public-facing text:
-
-1. **No server holds authority** — the server is a relay, not a gatekeeper
-2. **Your identity travels with you** — same credentials, same keypair, everywhere; no
-   key files, no seed phrases, no backup ritual
-3. **Every write is provably yours** — signed commits, append-only, permanent
-4. **Content-addressed** — data identified by what it is, not where it lives
-
-"Content-addressed" is technically important but not the lead. Start with ownership.
-
-## architecture notes
-
-- `Streamo` — content-addressed, append-only byte store with self-describing codec
-- `Repo` — wraps Streamo; every `set()` is a signed commit (message, date, address, parent)
-- `Signer` — deterministic secp256k1 keypairs via PBKDF2 from username + password
-- `Recaller` — fine-grained reactive dependency tracker; `watch(name, f)` / `unwatch(f)`
-- `h` — tagged template literal HTML parser → HElement / HText virtual tree
-- `mount` — reactive DOM renderer; slots are reactive cells; elements recycled by
-  `data-key` then tag on re-render; removed nodes cleaned up via `recaller.unwatch()`;
-  exports `dismount(root, recaller)` for custom element cleanup
-- `StreamoComponent` — base class for hot-reloadable custom elements; `componentKey`
-  generates address-based names; `defineComponent` registers render functions; function
-  components `(props) => nodes` work directly as tags in `h` with no class needed
-- `registrySync` — bidirectional multi-repo sync over a single WebSocket; works in Node
-  and browser; content-driven discovery via `follow`
-- CLI `--chat-room` flag — when combined with `--web`, auto-accepts member announcements
-  and stores the member list in the server's own repo (backed by `archiveSync`);
-  the server's public key is the room key; `chat-server.js` is retired
-
-## what's next (toward 1.0)
-
-1. Chat signing — wire `repo.sign()` so messages are cryptographically verified
-2. Rebuild the browser app with `h` / `mount`
-
-## commit style
-
-Commit and push at the end of every response that makes a change. Over-commit rather
-than over-think. Co-author line on every commit:
-
-    Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

package/ROADMAP.md

@@ -1,199 +0,0 @@
-# streamo roadmap
-
-This is a living document — updated with every meaningful change to give a clear
-picture of where the project is and where it's headed.
-
----
-
-## where we are (1.0.0)
-
-The foundation is solid, tested, and shipped. Here's what's in:
-
-**Core data layer**
-- `Streamo` — reactive, content-addressed, append-only byte store with a
-  self-describing codec. Same value always encodes to the same bytes; dedup and
-  diffing are free.
-- `Repo` — every write is a signed commit. Message, date, data address, parent.
-  The full history is always there. `attachSigner(signer, name)` enables
-  automatic signing after every commit; concurrent commits are batched safely.
-- `Signer` — deterministic secp256k1 keypairs from username + password via PBKDF2.
-  No key files to manage; same credentials always produce the same identity.
-- `Recaller` — fine-grained reactive dependency tracker. Watchers re-run only when
-  the exact paths they accessed are mutated. Efficient and precise.
-
-**Sync layer**
-- `registrySync` — bidirectional multi-repo sync over a single WebSocket. Catalog,
-  subscribe, and content-driven discovery via `follow`. Works in both Node and the
-  browser.
-- `outletSync` / `originSync` — server and client sides of a peer connection.
-- `archiveSync` — persists chunks to binary files on disk. Repos survive restarts.
-- `fileSync` — mirrors a repo's value to/from the local filesystem.
-- `s3Sync` — replicates chunks to S3-compatible object storage.
-- Ephemeral messaging layer — `interest` / `announce` for peer discovery without
-  any persistence.
-
-**UI layer**
-- `h` — tagged template literal parser. Turns `` h`<div class=${cls}>...` `` into a
-  virtual tree of `HElement` / `HText` / slot nodes.
-- `mount` — reactive DOM renderer. Slots that are functions re-run automatically
-  when the data they read changes. No virtual DOM diffing — only the exact nodes
-  bound to mutated paths update. Watcher cleanup is precise: removed nodes are
-  unwatched before removal so watchers never accumulate. Elements are recycled
-  across re-renders by `data-key` (exact) then tag (positional fallback), so user
-  input and focus survive list reorders. SVG namespaces propagate automatically —
-  `` h`<svg><path/></svg>` `` just works. `class` accepts an array
-  (`['btn', isActive && 'active']`) or an object (`{btn: true, active: false}`).
-- `StreamoComponent` — base class for hot-reloadable custom element components.
-  Function components (`(props) => nodes`) work directly as tags in `h`. For
-  hot-reloading, `componentKey(prefix, address)` and `defineComponent(name, fn)`
-  pair a content address to a unique custom element name — a new file version gets
-  a new name, stale elements are naturally orphaned and cleaned up.
-
-**Apps**
-- Chat — full p2p messaging app. Each participant owns their own signed message
-  stream. `public/apps/chat/server.js` is the standalone server — its public key
-  is the room address, its member list is in its own repo, and it has no special
-  authority over anyone's data. Runs in the browser and from the terminal
-  (`chat-cli.js`). Message history persists across page reloads via server-side
-  archiving — rejoin with the same credentials and your history comes back.
-- Homepage at `public/index.html`.
-- `StreamoServer` — reusable class that wraps signer, registry, and all sync
-  methods behind a clean API. `bin/streamo.js` is now a thin CLI parser on top
-  of it; `public/apps/chat/server.js` is a standalone chat server using the
-  same class.
-- `npm run serve` — starts a streamo node (with REPL) using `.env.dev`
-  credentials. The dev server is a real peer, not a bare static file server.
-
----
-
-## what's next
-
-### presence indicators
-Who's currently online? The `interest` / `announce` layer is ephemeral by design,
-so presence is a heartbeat + timeout — announce yourself periodically, time out
-peers you haven't heard from.
-
-### rebuild the browser app
-The old repository-browser app was left behind during the migration because its
-imports broke. Rebuilding it with `h` / `mount` would be the first substantial
-real-world test of the UI layer.
-
----
-
----
-
-## known limitations
-
-### multi-device write conflict detection
-
-Streamo streams are byte arrays addressed by **absolute offset**. This makes a
-repo effectively single-writer: if the same keypair commits from two devices
-while offline from each other, their streams diverge at the fork point.  Each
-commit's `dataAddress` is an offset that is only valid in the stream that
-produced it — the streams cannot be structurally merged.
-
-When the two devices reconnect, `makeVerifiedWritableStream` deduplicates shared
-chunks by content (correctly) but silently appends the conflicting commit from
-the second device at its new offset.  That commit's `dataAddress` now points to
-the wrong location in the merged stream.  No error is thrown; the second
-writer's data is silently corrupt.
-
-**What is safe today:** relays never call `commit()` so they are unaffected —
-they accumulate and re-serve bytes without introducing their own addresses.  The
-chat app is also unaffected because each user writes to their own repo from a
-single session.  The danger zone is one keypair writing from two places
-simultaneously (two browser tabs, phone + laptop while offline).
-
-**The fix** requires either (a) detecting the fork and throwing a clear error so
-the user can choose which version to keep, or (b) switching to chunk-level
-content addressing (à la git objects) so streams can be merged structurally
-rather than by concatenation.  Option (a) is a targeted addition to the sync
-layer; option (b) is an architectural change.  Not required for 1.0 but should
-be resolved before marketing streamo as a general-purpose multi-device sync
-library.
-
----
-
-## beyond 1.0
-
-Ideas that follow naturally from the architecture but aren't blocking anything.
-
-### Claude scratchpad repos
-
-Every streamo node already has a signed, append-only repo. A Claude session
-could write observations, notes, and work products to that repo during a
-conversation — and the owner could watch them appear live in a browser via
-`mount`. Between sessions, Claude reads the repo to reconstruct context
-instead of relying on static memory files. The work is persistent and
-provably Claude's, with the same integrity guarantees as any other streamo data.
-
-A `claudeSync.js` adapter would give Claude a `StreamoServer` identity,
-connect it to the chat room via `registrySync`, and use `repo.watch` +
-`repo.byteLength` to fire an Anthropic API call when watched repos change.
-Claude writes its response back to its own repo and it propagates like any
-other participant's message. The decisions about *when* to respond, *what*
-context to pass, and *how* to avoid pathological cases are intentionally left
-to the Claude instance using the adapter — not encoded as constraints. A few
-forces worth knowing going in:
-
-- **Watch your own key.** Only watch other participants' repos, not your own.
-  Writing a response to your own repo should not re-trigger your watch.
-- **Last-author check.** Before calling the API, confirm the newest message
-  wasn't written by your own key — catches the case where two Claude instances
-  are running and watching each other.
-- **Concurrent writes.** If two API calls complete simultaneously (fast human,
-  slow model), both will try to commit to the same repo. This is the
-  multi-device conflict described above — same key, divergent streams. A simple
-  serial queue avoids it, but other strategies are possible.
-
-These are forces, not rules. Future Claude should read the codebase, understand
-the tradeoffs, and decide what's right for the situation.
-
-### Claude-to-Claude networks
-
-If each person's Claude has a scratchpad repo, those repos can sync the same
-way any other repos do. The `follow` callback in `registrySync` already handles
-content-driven discovery — subscribe to a member list, auto-follow everyone on
-it. A Claude could watch its person's friends' scratchpads, surface what's
-relevant, and filter what isn't.
-
-The interesting architectural difference from a traditional social network: there
-is no central moderator. Each Claude is an advocate for its person, not a
-reporter to a platform. Judgment about what to surface or filter lives at the
-edge, anchored to a real signed identity. Conflicts between Claudes are just
-their people having different values — which is honest in a way platform
-moderation usually isn't.
-
-A natural extension: if a Claude scratchpad includes a `StreamoComponent` for
-how its notes render, other people see those notes in Claude's own layout. The
-presentation travels with the content — no server controls the framing.
-
-### StreamoComponent demos — shared components as content
-
-`StreamoComponent` makes most sense as a post-1.0 story, after chat signing
-gives the trust foundation that running someone else's component requires.
-The right first demo is a **tarot deck**: each card is a `StreamoComponent`
-from its designer, stored in their signed repo at a content address.
-`componentKey` generates a stable element name from that address. A reading
-is a snapshot — cards freeze at the version they were drawn, which is a
-feature, not a bug. The designer's signed key is provenance.
-
-Other directions once the pattern is established: publisher-controlled article
-cards that travel with syndicated content (the layout is the author's, not
-the platform's); collaborative maps where each participant's marker is their
-own component; shared instrument components in a live music session.
-
----
-
-## loose ideas
-
-Not planned, not prioritized — just things worth remembering.
-
-- **Claude as chat shell** — type `send a greeting to the chatroom` and
-  `CHATROOM: hello there 👋` appears in the chat. Natural language as a
-  thin shell over streamo operations, with Claude interpreting intent and
-  acting on it directly.
-
-- **Slick interactive CLI** — a terminal UI that lets you interact with the
-  demo apps live without opening a browser tab. Chat, inspect repos, send
-  messages — the full experience from the command line. Exciting ways TBD. 😄

package/jsconfig.json

@@ -1,10 +0,0 @@
-{
-  "compilerOptions": {
-    "target": "ES2022",
-    "lib": ["ES2022", "DOM", "DOM.Iterable"],
-    "module": "node16",
-    "moduleResolution": "node16",
-    "checkJs": false
-  },
-  "exclude": ["node_modules"]
-}