@fairfox/polly 0.23.0 → 0.25.0

package/dist/src/mesh.js

@@ -1,3 +1,5 @@
+var __create = Object.create;
+var __getProtoOf = Object.getPrototypeOf;
 var __defProp = Object.defineProperty;
 var __getOwnPropNames = Object.getOwnPropertyNames;
 var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
@@ -5,6 +7,28 @@ var __hasOwnProp = Object.prototype.hasOwnProperty;
 function __accessProp(key) {
   return this[key];
 }
+var __toESMCache_node;
+var __toESMCache_esm;
+var __toESM = (mod, isNodeMode, target) => {
+  var canCache = mod != null && typeof mod === "object";
+  if (canCache) {
+    var cache = isNodeMode ? __toESMCache_node ??= new WeakMap : __toESMCache_esm ??= new WeakMap;
+    var cached = cache.get(mod);
+    if (cached)
+      return cached;
+  }
+  target = mod != null ? __create(__getProtoOf(mod)) : {};
+  const to = isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target;
+  for (let key of __getOwnPropNames(mod))
+    if (!__hasOwnProp.call(to, key))
+      __defProp(to, key, {
+        get: __accessProp.bind(mod, key),
+        enumerable: true
+      });
+  if (canCache)
+    cache.set(mod, to);
+  return to;
+};
 var __toCommonJS = (from) => {
   var entry = (__moduleCache ??= new WeakMap).get(from), desc;
   if (entry)
@@ -22,6 +46,7 @@ var __toCommonJS = (from) => {
   return entry;
 };
 var __moduleCache;
+var __commonJS = (cb, mod) => () => (mod || cb((mod = { exports: {} }).exports, mod), mod.exports);
 var __returnValue = (v) => v;
 function __exportSetter(name, newValue) {
   this[name] = __returnValue.bind(null, newValue);
@@ -45,19 +70,22 @@ var __require = /* @__PURE__ */ ((x) => typeof require !== "undefined" ? require
 });
 
 // src/shared/lib/encryption.ts
+var exports_encryption = {};
+__export(exports_encryption, {
+  sealEnvelope: () => sealEnvelope,
+  openEnvelope: () => openEnvelope,
+  generateDocumentKey: () => generateDocumentKey,
+  encrypt: () => encrypt,
+  encodeEncryptedEnvelope: () => encodeEncryptedEnvelope,
+  decryptOrThrow: () => decryptOrThrow,
+  decrypt: () => decrypt,
+  decodeEncryptedEnvelope: () => decodeEncryptedEnvelope,
+  TAG_BYTES: () => TAG_BYTES,
+  NONCE_BYTES: () => NONCE_BYTES,
+  KEY_BYTES: () => KEY_BYTES,
+  EncryptionError: () => EncryptionError
+});
 import nacl from "tweetnacl";
-var KEY_BYTES = 32;
-var NONCE_BYTES = 24;
-var TAG_BYTES = 16;
-
-class EncryptionError extends Error {
-  code;
-  constructor(message, code) {
-    super(message);
-    this.name = "EncryptionError";
-    this.code = code;
-  }
-}
 function generateDocumentKey() {
   return nacl.randomBytes(KEY_BYTES);
 }
@@ -122,10 +150,786 @@ function decodeEncryptedEnvelope(bytes) {
   const sealed = bytes.slice(4 + idLen);
   return { documentId, sealed };
 }
+var KEY_BYTES = 32, NONCE_BYTES = 24, TAG_BYTES = 16, EncryptionError;
+var init_encryption = __esm(() => {
+  EncryptionError = class EncryptionError extends Error {
+    code;
+    constructor(message, code) {
+      super(message);
+      this.name = "EncryptionError";
+      this.code = code;
+    }
+  };
+});
+
+// src/shared/lib/wasm-init.ts
+import wasmPath from "@automerge/automerge/automerge.wasm";
+import { initializeWasm } from "@automerge/automerge-repo/slim";
+var wasmUrl = new URL(wasmPath, import.meta.url).href;
+await initializeWasm(wasmUrl);
+
+// src/shared/lib/blob-cache.ts
+class MemoryBlobCache {
+  store = new Map;
+  pinned = new Set;
+  urls = new Map;
+  async get(hash) {
+    const entry = this.store.get(hash);
+    if (!entry)
+      return;
+    entry.accessedAt = Date.now();
+    return entry.bytes;
+  }
+  async put(hash, bytes) {
+    this.store.set(hash, { bytes, accessedAt: Date.now() });
+  }
+  async has(hash) {
+    return this.store.has(hash);
+  }
+  async delete(hash) {
+    this.store.delete(hash);
+    this.pinned.delete(hash);
+    const url = this.urls.get(hash);
+    if (url) {
+      URL.revokeObjectURL(url);
+      this.urls.delete(hash);
+    }
+  }
+  async pin(hash) {
+    this.pinned.add(hash);
+  }
+  async unpin(hash) {
+    this.pinned.delete(hash);
+  }
+  async size() {
+    let total = 0;
+    for (const entry of this.store.values()) {
+      total += entry.bytes.byteLength;
+    }
+    return total;
+  }
+  async evict(maxBytes) {
+    let currentSize = await this.size();
+    if (currentSize <= maxBytes)
+      return 0;
+    const freed = currentSize;
+    const candidates = [];
+    for (const [hash, entry] of this.store) {
+      if (!this.pinned.has(hash)) {
+        candidates.push({ hash, accessedAt: entry.accessedAt, size: entry.bytes.byteLength });
+      }
+    }
+    candidates.sort((a, b) => a.accessedAt - b.accessedAt);
+    for (const c of candidates) {
+      if (currentSize <= maxBytes)
+        break;
+      await this.delete(c.hash);
+      currentSize -= c.size;
+    }
+    return freed - currentSize;
+  }
+  async url(hash) {
+    const cached = this.urls.get(hash);
+    if (cached)
+      return cached;
+    const entry = this.store.get(hash);
+    if (!entry)
+      return;
+    const buffer = new ArrayBuffer(entry.bytes.byteLength);
+    new Uint8Array(buffer).set(entry.bytes);
+    const objectUrl = URL.createObjectURL(new Blob([buffer]));
+    this.urls.set(hash, objectUrl);
+    return objectUrl;
+  }
+  dispose() {
+    for (const objectUrl of this.urls.values()) {
+      URL.revokeObjectURL(objectUrl);
+    }
+    this.urls.clear();
+    this.store.clear();
+    this.pinned.clear();
+  }
+}
+
+class IndexedDBBlobCache {
+  static DB_NAME = "polly-blobs";
+  static DB_VERSION = 1;
+  static STORE_NAME = "blobs";
+  dbPromise = null;
+  urls = new Map;
+  openDB() {
+    if (this.dbPromise)
+      return this.dbPromise;
+    this.dbPromise = new Promise((resolve, reject) => {
+      const request = indexedDB.open(IndexedDBBlobCache.DB_NAME, IndexedDBBlobCache.DB_VERSION);
+      request.onerror = () => reject(request.error);
+      request.onsuccess = () => resolve(request.result);
+      request.onupgradeneeded = (event) => {
+        const db = event.target.result;
+        if (!db.objectStoreNames.contains(IndexedDBBlobCache.STORE_NAME)) {
+          db.createObjectStore(IndexedDBBlobCache.STORE_NAME);
+        }
+      };
+    });
+    return this.dbPromise;
+  }
+  async getRecord(hash) {
+    const db = await this.openDB();
+    return new Promise((resolve, reject) => {
+      const tx = db.transaction(IndexedDBBlobCache.STORE_NAME, "readonly");
+      const store = tx.objectStore(IndexedDBBlobCache.STORE_NAME);
+      const request = store.get(hash);
+      request.onsuccess = () => resolve(request.result);
+      request.onerror = () => reject(request.error);
+    });
+  }
+  async putRecord(hash, record) {
+    const db = await this.openDB();
+    return new Promise((resolve, reject) => {
+      const tx = db.transaction(IndexedDBBlobCache.STORE_NAME, "readwrite");
+      const store = tx.objectStore(IndexedDBBlobCache.STORE_NAME);
+      store.put(record, hash);
+      tx.oncomplete = () => resolve();
+      tx.onerror = () => reject(tx.error);
+    });
+  }
+  async get(hash) {
+    const record = await this.getRecord(hash);
+    if (!record)
+      return;
+    this.putRecord(hash, { ...record, accessedAt: Date.now() });
+    return record.bytes;
+  }
+  async put(hash, bytes) {
+    const existing = await this.getRecord(hash);
+    await this.putRecord(hash, {
+      bytes,
+      size: bytes.byteLength,
+      accessedAt: Date.now(),
+      pinned: existing?.pinned ?? false
+    });
+  }
+  async has(hash) {
+    const db = await this.openDB();
+    return new Promise((resolve, reject) => {
+      const tx = db.transaction(IndexedDBBlobCache.STORE_NAME, "readonly");
+      const store = tx.objectStore(IndexedDBBlobCache.STORE_NAME);
+      const request = store.count(hash);
+      request.onsuccess = () => resolve(request.result > 0);
+      request.onerror = () => reject(request.error);
+    });
+  }
+  async delete(hash) {
+    const url = this.urls.get(hash);
+    if (url) {
+      URL.revokeObjectURL(url);
+      this.urls.delete(hash);
+    }
+    const db = await this.openDB();
+    return new Promise((resolve, reject) => {
+      const tx = db.transaction(IndexedDBBlobCache.STORE_NAME, "readwrite");
+      const store = tx.objectStore(IndexedDBBlobCache.STORE_NAME);
+      store.delete(hash);
+      tx.oncomplete = () => resolve();
+      tx.onerror = () => reject(tx.error);
+    });
+  }
+  async pin(hash) {
+    const record = await this.getRecord(hash);
+    if (!record)
+      return;
+    await this.putRecord(hash, { ...record, pinned: true });
+  }
+  async unpin(hash) {
+    const record = await this.getRecord(hash);
+    if (!record)
+      return;
+    await this.putRecord(hash, { ...record, pinned: false });
+  }
+  async size() {
+    const db = await this.openDB();
+    return new Promise((resolve, reject) => {
+      const tx = db.transaction(IndexedDBBlobCache.STORE_NAME, "readonly");
+      const store = tx.objectStore(IndexedDBBlobCache.STORE_NAME);
+      const request = store.openCursor();
+      let total = 0;
+      request.onsuccess = () => {
+        const cursor = request.result;
+        if (cursor) {
+          const value = cursor.value;
+          total += value.size;
+          cursor.continue();
+        } else {
+          resolve(total);
+        }
+      };
+      request.onerror = () => reject(request.error);
+    });
+  }
+  async evict(maxBytes) {
+    const db = await this.openDB();
+    const candidates = [];
+    let totalSize = 0;
+    await new Promise((resolve, reject) => {
+      const tx = db.transaction(IndexedDBBlobCache.STORE_NAME, "readonly");
+      const store = tx.objectStore(IndexedDBBlobCache.STORE_NAME);
+      const request = store.openCursor();
+      request.onsuccess = () => {
+        const cursor = request.result;
+        if (cursor) {
+          const value = cursor.value;
+          totalSize += value.size;
+          if (!value.pinned) {
+            candidates.push({
+              hash: cursor.key,
+              accessedAt: value.accessedAt,
+              size: value.size
+            });
+          }
+          cursor.continue();
+        } else {
+          resolve();
+        }
+      };
+      request.onerror = () => reject(request.error);
+    });
+    if (totalSize <= maxBytes)
+      return 0;
+    candidates.sort((a, b) => a.accessedAt - b.accessedAt);
+    let freed = 0;
+    for (const c of candidates) {
+      if (totalSize <= maxBytes)
+        break;
+      await this.delete(c.hash);
+      totalSize -= c.size;
+      freed += c.size;
+    }
+    return freed;
+  }
+  async url(hash) {
+    const cached = this.urls.get(hash);
+    if (cached)
+      return cached;
+    const bytes = await this.get(hash);
+    if (!bytes)
+      return;
+    const buffer = new ArrayBuffer(bytes.byteLength);
+    new Uint8Array(buffer).set(bytes);
+    const objectUrl = URL.createObjectURL(new Blob([buffer]));
+    this.urls.set(hash, objectUrl);
+    return objectUrl;
+  }
+  dispose() {
+    for (const objectUrl of this.urls.values()) {
+      URL.revokeObjectURL(objectUrl);
+    }
+    this.urls.clear();
+  }
+}
+// src/shared/lib/blob-ref.ts
+function isBlobRef(value) {
+  if (typeof value !== "object" || value === null)
+    return false;
+  const v = value;
+  return typeof v["hash"] === "string" && /^[0-9a-f]{64}$/.test(v["hash"]) && typeof v["size"] === "number" && Number.isInteger(v["size"]) && v["size"] >= 0 && typeof v["filename"] === "string" && typeof v["mimeType"] === "string";
+}
+async function computeBlobHash(bytes) {
+  const buffer = new ArrayBuffer(bytes.byteLength);
+  const copy = new Uint8Array(buffer);
+  copy.set(bytes);
+  const digest = await crypto.subtle.digest("SHA-256", buffer);
+  const view = new Uint8Array(digest);
+  let hex = "";
+  for (const byte of view) {
+    hex += byte.toString(16).padStart(2, "0");
+  }
+  return hex;
+}
+async function createBlobRef({
+  bytes,
+  filename,
+  mimeType
+}) {
+  const hash = await computeBlobHash(bytes);
+  return {
+    hash,
+    size: bytes.byteLength,
+    filename,
+    mimeType
+  };
+}
+// src/shared/lib/blob-transfer.ts
+var BLOB_CHUNK_SIZE = 65536;
+var BLOB_BUFFER_HIGH_WATER = 256 * 1024;
+function chunkBlob(bytes, chunkSize = BLOB_CHUNK_SIZE) {
+  const chunks = [];
+  for (let offset = 0;offset < bytes.length; offset += chunkSize) {
+    chunks.push(bytes.subarray(offset, Math.min(offset + chunkSize, bytes.length)));
+  }
+  if (chunks.length === 0) {
+    chunks.push(new Uint8Array(0));
+  }
+  return chunks;
+}
+function reassembleChunks(chunks, total) {
+  let totalBytes = 0;
+  for (let i = 0;i < total; i++) {
+    const chunk = chunks.get(i);
+    if (!chunk) {
+      throw new Error(`reassembleChunks: missing chunk ${i} of ${total}`);
+    }
+    totalBytes += chunk.length;
+  }
+  const out = new Uint8Array(totalBytes);
+  let offset = 0;
+  for (let i = 0;i < total; i++) {
+    const chunk = chunks.get(i);
+    out.set(chunk, offset);
+    offset += chunk.length;
+  }
+  return out;
+}
+function missingChunkIndices(chunks, total) {
+  const missing = [];
+  for (let i = 0;i < total; i++) {
+    if (!chunks.has(i)) {
+      missing.push(i);
+    }
+  }
+  return missing;
+}
+function serialiseBlobMessage(header, data = new Uint8Array(0)) {
+  const headerBytes = new TextEncoder().encode(JSON.stringify(header));
+  const size = 4 + headerBytes.length + data.length;
+  const buffer = new ArrayBuffer(size);
+  const out = new Uint8Array(buffer);
+  const view = new DataView(buffer);
+  view.setUint32(0, headerBytes.length, false);
+  out.set(headerBytes, 4);
+  out.set(data, 4 + headerBytes.length);
+  return out;
+}
+function isBlobMessageType(bytes) {
+  if (bytes.length < 4)
+    return false;
+  const view = new DataView(bytes.buffer, bytes.byteOffset, bytes.byteLength);
+  const headerLen = view.getUint32(0, false);
+  if (bytes.length < 4 + headerLen)
+    return false;
+  const headerSlice = bytes.subarray(4, 4 + headerLen);
+  const needle = new TextEncoder().encode('"type":"blob-');
+  return findSubarray(headerSlice, needle) !== -1;
+}
+function findSubarray(haystack, needle) {
+  if (needle.length === 0)
+    return 0;
+  outer:
+    for (let i = 0;i <= haystack.length - needle.length; i++) {
+      for (let j = 0;j < needle.length; j++) {
+        if (haystack[i + j] !== needle[j])
+          continue outer;
+      }
+      return i;
+    }
+  return -1;
+}
+
+// src/shared/lib/blob-store-impl.ts
+var DEFAULT_MAX_BLOB_SIZE = 100 * 1024 * 1024;
+var DOWNLOAD_TIMEOUT_MS = 60000;
+var RE_REQUEST_DELAY_MS = 5000;
+function createBlobStore(adapter, options) {
+  const maxBlobSize = options?.maxBlobSize ?? DEFAULT_MAX_BLOB_SIZE;
+  const defaultKey = options?.encrypt?.key;
+  const cache = options?.cache ?? new MemoryBlobCache;
+  const keysByHash = new Map;
+  const peerBlobs = new Map;
+  const downloads = new Map;
+  const localHashes = new Set;
+  const urlCache = new Map;
+  let disposed = false;
+  adapter.onBlobMessage = (peerId, header, data) => {
+    if (disposed)
+      return;
+    const type = header["type"];
+    switch (type) {
+      case "blob-chunk":
+        handleChunk(peerId, header, data);
+        break;
+      case "blob-request":
+        handleRequest(peerId, header);
+        break;
+      case "blob-have":
+        handleHave(peerId, header);
+        break;
+    }
+  };
+  const peerCandidateHandler = (event) => {
+    if (disposed)
+      return;
+    const newPeerId = event.peerId;
+    for (const hash of localHashes) {
+      const msg = serialiseBlobMessage({ type: "blob-have", hash });
+      adapter.sendBlobMessage(newPeerId, msg);
+    }
+  };
+  adapter.on("peer-candidate", peerCandidateHandler);
+  async function encryptChunk(plaintext, key) {
+    const { encrypt: encrypt2 } = await Promise.resolve().then(() => (init_encryption(), exports_encryption));
+    return encrypt2(plaintext, key);
+  }
+  async function decryptChunk(sealed, key) {
+    const { decrypt: decrypt2 } = await Promise.resolve().then(() => (init_encryption(), exports_encryption));
+    return decrypt2(sealed, key);
+  }
+  async function handleChunk(peerId, header, data) {
+    const download = downloads.get(header.hash);
+    if (!download)
+      return;
+    download.total = header.total;
+    if (!download.peersAttempted.includes(peerId)) {
+      download.peersAttempted.push(peerId);
+    }
+    let chunkBytes;
+    if (download.key) {
+      const plaintext = await decryptChunk(data, download.key);
+      if (!plaintext) {
+        return;
+      }
+      chunkBytes = plaintext;
+    } else {
+      chunkBytes = data.slice();
+    }
+    download.chunks.set(header.index, chunkBytes);
+    reportChunkProgress(download);
+    resetReRequestTimer(download);
+    if (download.chunks.size >= header.total) {
+      finishDownload(header.hash, download);
+    } else {
+      scheduleReRequest(header.hash, download);
+    }
+  }
+  function reportChunkProgress(download) {
+    if (!download.onProgress || download.total <= 0)
+      return;
+    let loaded = 0;
+    for (const chunk of download.chunks.values()) {
+      loaded += chunk.length;
+    }
+    download.onProgress({ loaded, total: undefined, phase: "downloading" });
+  }
+  function resetReRequestTimer(download) {
+    if (download.reRequestId) {
+      clearTimeout(download.reRequestId);
+      download.reRequestId = undefined;
+    }
+  }
+  function finishDownload(hash, download) {
+    clearDownloadTimers(download);
+    try {
+      const assembled = reassembleChunks(download.chunks, download.total);
+      downloads.delete(hash);
+      download.resolve(assembled);
+    } catch (err) {
+      downloads.delete(hash);
+      download.reject(err instanceof Error ? err : new Error(String(err)));
+    }
+  }
+  async function handleRequest(peerId, header) {
+    const plaintext = await cache.get(header.hash);
+    if (!plaintext)
+      return;
+    const plaintextChunks = chunkBlob(plaintext);
+    const requested = header.missing ?? plaintextChunks.map((_, i) => i);
+    const chunkKey = keysByHash.get(header.hash);
+    for (const index of requested) {
+      await sendChunkAtIndex(peerId, header.hash, plaintextChunks, index, chunkKey);
+    }
+  }
+  async function sendChunkAtIndex(peerId, hash, plaintextChunks, index, chunkKey) {
+    if (index < 0 || index >= plaintextChunks.length)
+      return;
+    const plainChunk = plaintextChunks[index];
+    if (!plainChunk)
+      return;
+    const payload = chunkKey ? await encryptChunk(plainChunk, chunkKey) : plainChunk;
+    const chunkHeader = {
+      type: "blob-chunk",
+      hash,
+      index,
+      total: plaintextChunks.length
+    };
+    const msg = serialiseBlobMessage(chunkHeader, payload);
+    if (!adapter.sendBlobMessage(peerId, msg)) {
+      await waitForBufferDrain();
+      adapter.sendBlobMessage(peerId, msg);
+    }
+  }
+  function handleHave(peerId, header) {
+    let peers = peerBlobs.get(header.hash);
+    if (!peers) {
+      peers = new Set;
+      peerBlobs.set(header.hash, peers);
+    }
+    peers.add(peerId);
+  }
+  function announceHave(hash) {
+    const msg = serialiseBlobMessage({ type: "blob-have", hash });
+    for (const peerId of adapter.connectedPeerIds) {
+      adapter.sendBlobMessage(peerId, msg);
+    }
+  }
+  function clearDownloadTimers(download) {
+    if (download.timeoutId)
+      clearTimeout(download.timeoutId);
+    if (download.reRequestId)
+      clearTimeout(download.reRequestId);
+  }
+  function scheduleReRequest(hash, download) {
+    download.reRequestId = setTimeout(() => fireReRequest(hash, download), RE_REQUEST_DELAY_MS);
+  }
+  function fireReRequest(hash, download) {
+    if (!downloads.has(hash))
+      return;
+    const missing = missingChunkIndices(download.chunks, download.total);
+    if (missing.length === 0)
+      return;
+    const peers = peerBlobs.get(hash);
+    const pool = peers && peers.size > 0 ? Array.from(peers) : Array.from(adapter.connectedPeerIds);
+    if (pool.length === 0)
+      return;
+    const target = pool[download.peerRotationIndex % pool.length];
+    download.peerRotationIndex++;
+    if (!target)
+      return;
+    const reqHeader = { type: "blob-request", hash, missing };
+    const msg = serialiseBlobMessage(reqHeader);
+    adapter.sendBlobMessage(target, msg);
+    scheduleReRequest(hash, download);
+  }
+  function waitForBufferDrain() {
+    return new Promise((resolve) => setTimeout(resolve, 50));
+  }
+  const store = {
+    async put(ref, bytes, options2) {
+      if (disposed)
+        throw new Error("BlobStore is disposed");
+      options2?.signal?.throwIfAborted();
+      if (bytes.length > maxBlobSize) {
+        throw new Error(`Blob exceeds maximum size (${bytes.length} > ${maxBlobSize})`);
+      }
+      const hash = await computeBlobHash(bytes);
+      if (hash !== ref.hash) {
+        throw new Error(`Hash mismatch: expected ${ref.hash}, got ${hash}`);
+      }
+      options2?.signal?.throwIfAborted();
+      const key = options2?.key ?? defaultKey;
+      if (key) {
+        keysByHash.set(ref.hash, key);
+      }
+      options2?.onProgress?.({ loaded: bytes.length, total: bytes.length, phase: "uploading" });
+      await cache.put(ref.hash, bytes);
+      localHashes.add(ref.hash);
+      announceHave(ref.hash);
+    },
+    async get(hash, options2) {
+      if (disposed)
+        throw new Error("BlobStore is disposed");
+      options2?.signal?.throwIfAborted();
+      const cached = await cache.get(hash);
+      if (cached)
+        return cached;
+      const key = options2?.key ?? defaultKey;
+      const peers = peerBlobs.get(hash);
+      const candidates = peers && peers.size > 0 ? Array.from(peers) : Array.from(adapter.connectedPeerIds);
+      const targetPeer = candidates[0];
+      if (!targetPeer)
+        return;
+      const requestHeader = { type: "blob-request", hash };
+      const msg = serialiseBlobMessage(requestHeader);
+      adapter.sendBlobMessage(targetPeer, msg);
+      const plaintext = await new Promise((resolve, reject) => {
+        const download = {
+          total: 0,
+          chunks: new Map,
+          resolve,
+          reject,
+          onProgress: options2?.onProgress,
+          key,
+          peersAttempted: [targetPeer],
+          peerRotationIndex: 1
+        };
+        downloads.set(hash, download);
+        options2?.signal?.addEventListener("abort", () => {
+          if (downloads.has(hash)) {
+            clearDownloadTimers(download);
+            downloads.delete(hash);
+            reject(new Error("Blob download aborted"));
+          }
+        }, { once: true });
+        download.timeoutId = setTimeout(() => {
+          if (downloads.has(hash)) {
+            clearDownloadTimers(download);
+            downloads.delete(hash);
+            reject(new Error("Blob download timed out"));
+          }
+        }, DOWNLOAD_TIMEOUT_MS);
+      });
+      const actualHash = await computeBlobHash(plaintext);
+      if (actualHash !== hash) {
+        throw new Error(`Blob hash mismatch after download: expected ${hash}, got ${actualHash}`);
+      }
+      await cache.put(hash, plaintext);
+      if (key)
+        keysByHash.set(hash, key);
+      localHashes.add(hash);
+      return plaintext;
+    },
+    async url(hash) {
+      if (disposed)
+        return;
+      const cached = urlCache.get(hash);
+      if (cached)
+        return cached;
+      const bytes = await cache.get(hash);
+      if (!bytes)
+        return;
+      const buffer = new ArrayBuffer(bytes.byteLength);
+      new Uint8Array(buffer).set(bytes);
+      const objectUrl = URL.createObjectURL(new Blob([buffer]));
+      urlCache.set(hash, objectUrl);
+      return objectUrl;
+    },
+    async pin(hash) {
+      await cache.pin(hash);
+    },
+    async unpin(hash) {
+      await cache.unpin(hash);
+    },
+    async size() {
+      return cache.size();
+    },
+    async evict(maxBytes) {
+      return cache.evict(maxBytes);
+    },
+    dispose() {
+      disposed = true;
+      adapter.onBlobMessage = undefined;
+      adapter.off("peer-candidate", peerCandidateHandler);
+      for (const [hash, download] of downloads) {
+        clearDownloadTimers(download);
+        download.reject(new Error("BlobStore disposed"));
+        downloads.delete(hash);
+      }
+      for (const objectUrl of urlCache.values()) {
+        URL.revokeObjectURL(objectUrl);
+      }
+      urlCache.clear();
+      keysByHash.clear();
+      cache.dispose();
+    }
+  };
+  return store;
+}
+
+// src/mesh.ts
+init_encryption();
+
+// src/shared/lib/keyring-storage.ts
+function memoryKeyringStorage() {
+  let stored = null;
+  return {
+    load: async () => stored,
+    save: async (keyring) => {
+      stored = keyring;
+    }
+  };
+}
+function serialiseKeyring(keyring) {
+  const payload = {
+    version: 1,
+    identity: {
+      publicKey: bytesToBase64(keyring.identity.publicKey),
+      secretKey: bytesToBase64(keyring.identity.secretKey)
+    },
+    knownPeers: mapToBase64Record(keyring.knownPeers),
+    documentKeys: mapToBase64Record(keyring.documentKeys),
+    revokedPeers: [...keyring.revokedPeers]
+  };
+  if (keyring.revocationAuthority && keyring.revocationAuthority.size > 0) {
+    payload.revocationAuthority = [...keyring.revocationAuthority];
+  }
+  return JSON.stringify(payload, null, 2);
+}
+function deserialiseKeyring(text) {
+  let raw;
+  try {
+    raw = JSON.parse(text);
+  } catch (err) {
+    throw new Error(`KeyringStorage: keyring payload is not valid JSON: ${err.message}`);
+  }
+  if (!raw || typeof raw !== "object") {
+    throw new Error("KeyringStorage: keyring payload is not an object");
+  }
+  const r = raw;
+  if (r.version !== 1) {
+    throw new Error(`KeyringStorage: unsupported keyring version: ${String(r.version)}`);
+  }
+  if (!r.identity || typeof r.identity !== "object") {
+    throw new Error("KeyringStorage: keyring payload is missing identity");
+  }
+  const identity = {
+    publicKey: base64ToBytes(r.identity.publicKey),
+    secretKey: base64ToBytes(r.identity.secretKey)
+  };
+  const keyring = {
+    identity,
+    knownPeers: base64RecordToMap(r.knownPeers ?? {}),
+    documentKeys: base64RecordToMap(r.documentKeys ?? {}),
+    revokedPeers: new Set(r.revokedPeers ?? [])
+  };
+  if (r.revocationAuthority && r.revocationAuthority.length > 0) {
+    keyring.revocationAuthority = new Set(r.revocationAuthority);
+  }
+  return keyring;
+}
+function mapToBase64Record(map) {
+  const out = {};
+  for (const [key, value] of map) {
+    out[key] = bytesToBase64(value);
+  }
+  return out;
+}
+function base64RecordToMap(record) {
+  const out = new Map;
+  for (const [key, value] of Object.entries(record)) {
+    out.set(key, base64ToBytes(value));
+  }
+  return out;
+}
+function bytesToBase64(bytes) {
+  let binary = "";
+  for (const byte of bytes) {
+    binary += String.fromCharCode(byte);
+  }
+  return btoa(binary);
+}
+function base64ToBytes(b64) {
+  const binary = atob(b64);
+  const bytes = new Uint8Array(binary.length);
+  for (let i = 0;i < binary.length; i++) {
+    bytes[i] = binary.charCodeAt(i);
+  }
+  return bytes;
+}
+// src/shared/lib/mesh-client.ts
+import { Repo } from "@automerge/automerge-repo/slim";
+
 // src/shared/lib/mesh-network-adapter.ts
+init_encryption();
 import {
   NetworkAdapter
-} from "@automerge/automerge-repo";
+} from "@automerge/automerge-repo/slim";
 
 // src/shared/lib/signing.ts
 import nacl2 from "tweetnacl";
@@ -355,6 +1159,7 @@ function deserialiseMessage(bytes) {
   const data = bytes.slice(4 + headerLen);
   return { ...header, data };
 }
+
 // src/shared/lib/mesh-signaling-client.ts
 class MeshSignalingClient {
   url;
@@ -365,6 +1170,7 @@ class MeshSignalingClient {
   onClose;
   socket;
   joined = false;
+  WebSocketCtor;
   constructor(options) {
     this.url = options.url;
     this.peerId = options.peerId;
@@ -375,10 +1181,15 @@ class MeshSignalingClient {
       this.onOpen = options.onOpen;
     if (options.onClose !== undefined)
       this.onClose = options.onClose;
+    const WS = options.WebSocket ?? globalThis.WebSocket;
+    if (typeof WS !== "function") {
+      throw new Error("MeshSignalingClient: no WebSocket implementation found. Pass one via options.WebSocket, or run in an environment where `globalThis.WebSocket` exists (Node 21+, Bun, browsers).");
+    }
+    this.WebSocketCtor = WS;
   }
   async connect() {
     return new Promise((resolve, reject) => {
-      const ws = new WebSocket(this.url);
+      const ws = new this.WebSocketCtor(this.url);
       this.socket = ws;
       ws.addEventListener("open", () => {
         ws.send(JSON.stringify({ type: "join", peerId: this.peerId }));
@@ -411,7 +1222,7 @@ class MeshSignalingClient {
     });
   }
   sendSignal(targetPeerId, payload) {
-    if (!this.socket || this.socket.readyState !== WebSocket.OPEN || !this.joined) {
+    if (!this.socket || this.socket.readyState !== this.WebSocketCtor.OPEN || !this.joined) {
       return false;
     }
     const msg = {
@@ -429,11 +1240,12 @@ class MeshSignalingClient {
     this.joined = false;
   }
   get isConnected() {
-    return this.joined && this.socket?.readyState === WebSocket.OPEN;
+    return this.joined && this.socket?.readyState === this.WebSocketCtor.OPEN;
   }
 }
+
 // src/shared/lib/crdt-specialised.ts
-import { Counter, updateText } from "@automerge/automerge-repo";
+import { Counter, updateText } from "@automerge/automerge-repo/slim";
 import { effect, signal } from "@preact/signals";
 
 // src/shared/lib/migrate-primitive.ts
@@ -886,10 +1698,11 @@ function $meshList(key, initialValue, options = {}) {
     access: options.access
   });
 }
+
 // src/shared/lib/mesh-webrtc-adapter.ts
 import {
   NetworkAdapter as NetworkAdapter2
-} from "@automerge/automerge-repo";
+} from "@automerge/automerge-repo/slim";
 var DEFAULT_ICE_SERVERS = [
   { urls: "stun:stun.l.google.com:19302" },
   { urls: "stun:stun1.l.google.com:19302" }
@@ -900,15 +1713,22 @@ class MeshWebRTCAdapter extends NetworkAdapter2 {
   iceServers;
   dataChannelLabel;
   knownPeerIds;
+  RTCPeerConnectionCtor;
   slots = new Map;
   ready = false;
   readyResolver;
+  onBlobMessage;
   constructor(options) {
     super();
     this.signaling = options.signaling;
     this.iceServers = options.iceServers ?? DEFAULT_ICE_SERVERS;
     this.dataChannelLabel = options.dataChannelLabel ?? "polly-mesh";
     this.knownPeerIds = options.knownPeerIds ?? [];
+    const PC = options.RTCPeerConnection ?? globalThis.RTCPeerConnection;
+    if (typeof PC !== "function") {
+      throw new Error("MeshWebRTCAdapter: no RTCPeerConnection implementation found. Pass one via options.RTCPeerConnection (e.g. from `werift` or `@roamhq/wrtc`), or run in a browser where `globalThis.RTCPeerConnection` exists.");
+    }
+    this.RTCPeerConnectionCtor = PC;
   }
   isReady() {
     return this.ready;
@@ -974,7 +1794,7 @@ class MeshWebRTCAdapter extends NetworkAdapter2 {
     }
   }
   createInitiatingSlot(targetId) {
-    const connection = new RTCPeerConnection({ iceServers: this.iceServers });
+    const connection = new this.RTCPeerConnectionCtor({ iceServers: this.iceServers });
     const channel = connection.createDataChannel(this.dataChannelLabel, { ordered: true });
     const slot = { connection, channel, pendingSends: [] };
     this.slots.set(targetId, slot);
@@ -999,7 +1819,7 @@ class MeshWebRTCAdapter extends NetworkAdapter2 {
       existing.connection.close();
       this.slots.delete(fromPeerId);
     }
-    const connection = new RTCPeerConnection({ iceServers: this.iceServers });
+    const connection = new this.RTCPeerConnectionCtor({ iceServers: this.iceServers });
     const slot = { connection, channel: undefined, pendingSends: [] };
     this.slots.set(fromPeerId, slot);
     this.wireConnection(fromPeerId, connection);
@@ -1064,9 +1884,9 @@ class MeshWebRTCAdapter extends NetworkAdapter2 {
     channel.onmessage = (event) => {
       const data = event.data;
       if (data instanceof ArrayBuffer) {
-        this.dispatchMessage(new Uint8Array(data));
+        this.dispatchMessage(peerId, new Uint8Array(data));
       } else if (data instanceof Uint8Array) {
-        this.dispatchMessage(data);
+        this.dispatchMessage(peerId, data);
       }
     };
     channel.onclose = () => {
@@ -1076,12 +1896,41 @@ class MeshWebRTCAdapter extends NetworkAdapter2 {
       }
     };
   }
-  dispatchMessage(bytes) {
+  dispatchMessage(fromPeerId, bytes) {
     try {
+      if (this.onBlobMessage && isBlobMessageType(bytes)) {
+        const view = new DataView(bytes.buffer, bytes.byteOffset, bytes.byteLength);
+        const headerLen = view.getUint32(0, false);
+        const header = JSON.parse(new TextDecoder().decode(bytes.subarray(4, 4 + headerLen)));
+        const data = bytes.subarray(4 + headerLen);
+        this.onBlobMessage(fromPeerId, header, data);
+        return;
+      }
       const message = this.deserialiseMessage(bytes);
       this.emit("message", message);
     } catch {}
   }
+  get connectedPeerIds() {
+    const ids = [];
+    for (const [peerId, slot] of this.slots) {
+      if (slot.channel && slot.channel.readyState === "open") {
+        ids.push(peerId);
+      }
+    }
+    return ids;
+  }
+  sendBlobMessage(peerId, bytes) {
+    const slot = this.slots.get(peerId);
+    if (!slot?.channel || slot.channel.readyState !== "open")
+      return false;
+    return this.trySendOnChannel(slot.channel, bytes);
+  }
+  trySendOnChannel(channel, bytes) {
+    if (channel.bufferedAmount > 256 * 1024)
+      return false;
+    channel.send(bytes);
+    return true;
+  }
   serialiseMessage(message) {
     const headerObj = {
       type: message.type,
@@ -1116,7 +1965,75 @@ class MeshWebRTCAdapter extends NetworkAdapter2 {
     return { ...header, data };
   }
 }
+
+// src/shared/lib/mesh-client.ts
+async function createMeshClient(options) {
+  const keyring = await resolveKeyring(options.keyring);
+  const encryptionEnabled = options.encryptionEnabled ?? true;
+  if (encryptionEnabled && !keyring.documentKeys.has(DEFAULT_MESH_KEY_ID)) {
+    throw new Error(`createMeshClient: encryption is enabled but the keyring has no document key for "${DEFAULT_MESH_KEY_ID}". Bootstrap or apply a pairing token that carries the document key before connecting.`);
+  }
+  const knownPeerIds = [...keyring.knownPeers.keys()].filter((id) => id !== options.signaling.peerId);
+  const webrtcAdapterOptions = {
+    signaling: undefined,
+    peerId: options.signaling.peerId,
+    knownPeerIds,
+    ...options.rtc?.iceServers !== undefined && { iceServers: options.rtc.iceServers },
+    ...options.rtc?.dataChannelLabel !== undefined && {
+      dataChannelLabel: options.rtc.dataChannelLabel
+    },
+    ...options.rtc?.RTCPeerConnection !== undefined && {
+      RTCPeerConnection: options.rtc.RTCPeerConnection
+    }
+  };
+  let webrtcAdapter;
+  const signaling = new MeshSignalingClient({
+    url: options.signaling.url,
+    peerId: options.signaling.peerId,
+    ...options.signaling.WebSocket !== undefined && { WebSocket: options.signaling.WebSocket },
+    ...options.signaling.onError !== undefined && { onError: options.signaling.onError },
+    onSignal: (fromPeerId, payload) => {
+      webrtcAdapter?.handleSignal(fromPeerId, payload);
+    }
+  });
+  webrtcAdapterOptions.signaling = signaling;
+  webrtcAdapter = new MeshWebRTCAdapter(webrtcAdapterOptions);
+  const networkAdapter = new MeshNetworkAdapter({
+    base: webrtcAdapter,
+    keyring,
+    encryptionEnabled
+  });
+  const repo = new Repo({
+    network: [networkAdapter],
+    ...options.repoStorage !== undefined && { storage: options.repoStorage }
+  });
+  configureMeshState(repo);
+  await signaling.connect();
+  return {
+    repo,
+    keyring,
+    signaling,
+    networkAdapter,
+    webrtcAdapter,
+    close: async () => {
+      signaling.close();
+      webrtcAdapter?.disconnect();
+      await repo.shutdown();
+    }
+  };
+}
+async function resolveKeyring(source) {
+  if ("storage" in source) {
+    const loaded = await source.storage.load();
+    if (loaded === null) {
+      throw new Error("createMeshClient: keyring storage returned null (no saved keyring). In a Node CLI, bootstrap with `bootstrapCliKeyring` from `@fairfox/polly/mesh/node`; in a browser, run your pairing flow first and save the keyring through the storage adapter before constructing the client.");
+    }
+    return loaded;
+  }
+  return source;
+}
 // src/shared/lib/pairing.ts
+init_encryption();
 var PAIRING_TOKEN_VERSION = 1;
 var PAIRING_TOKEN_MAGIC = new Uint8Array([80, 80, 84, 49]);
 var PAIRING_NONCE_BYTES = 16;
@@ -1454,15 +2371,19 @@ export {
   signingKeyPairFromSecret,
   sign,
   serialisePairingToken,
+  serialiseKeyring,
   revokePeerLocally,
   resetMeshState,
   parsePairingToken,
+  memoryKeyringStorage,
   isPairingTokenExpired,
+  isBlobRef,
   generateSigningKeyPair,
   generateDocumentKey,
   encrypt,
   encodeRevocation,
   encodePairingToken,
+  deserialiseKeyring,
   decryptOrThrow,
   decrypt,
   decodeRevocation,
@@ -1470,7 +2391,11 @@ export {
   createRevocation,
   createPairingTokenWithFreshIdentity,
   createPairingToken,
+  createMeshClient,
+  createBlobStore,
+  createBlobRef,
   configureMeshState,
+  computeBlobHash,
   applyRevocation,
   applyPairingToken,
   SigningError,
@@ -1486,6 +2411,8 @@ export {
   MeshWebRTCAdapter,
   MeshSignalingClient,
   MeshNetworkAdapter,
+  MemoryBlobCache,
+  IndexedDBBlobCache,
   EncryptionError,
   TAG_BYTES as ENCRYPTION_TAG_BYTES,
   NONCE_BYTES as ENCRYPTION_NONCE_BYTES,
@@ -1499,4 +2426,4 @@ export {
   $meshCounter
 };
 
-//# debugId=D8E43AFC4B30DF7364756E2164756E21
+//# debugId=6CA75FA83D35A2A964756E2164756E21