@graffiti-garden/implementation-decentralized 0.1.3 → 0.1.4

package/dist/esm/index.spec.js

@@ -13,7 +13,7 @@ import { decode as dagCborDecode, encode as dagCborEncode } from "@ipld/dag-cbor
 import { Handles } from "./3-protocol/2-handles";
 import { didTests } from "./1-services/2-dids-tests";
 import { storageBucketTests } from "./1-services/3-storage-buckets-tests";
-import { inboxTests } from "./1-services/4-inboxes-tests";
+import { inboxTests, inboxUnitTests } from "./1-services/4-inboxes-tests";
 import { stringEncodingTests } from "./2-primitives/1-string-encoding-tests";
 import { contentAddressesTests } from "./2-primitives/2-content-addresses-tests";
 import { channelAttestationTests } from "./2-primitives/3-channel-attestations-tests";
@@ -236,4 +236,5 @@ describe("GraffitiDecentralized Tests", () => {
     });
   }
 });
+inboxUnitTests();
 //# sourceMappingURL=index.spec.js.map

package/dist/esm/index.spec.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../src/index.spec.ts"],
-  "sourcesContent": ["import type {\n  GraffitiLoginEvent,\n  GraffitiLogoutEvent,\n  GraffitiSession,\n} from \"@graffiti-garden/api\";\nimport {\n  graffitiCRUDTests,\n  graffitiDiscoverTests,\n  graffitiMediaTests,\n} from \"@graffiti-garden/api/tests\";\nimport { DecentralizedIdentifiers } from \"./1-services/2-dids\";\nimport { Authorization } from \"./1-services/1-authorization\";\nimport { StorageBuckets } from \"./1-services/3-storage-buckets\";\nimport { Inboxes } from \"./1-services/4-inboxes\";\nimport { Sessions } from \"./3-protocol/1-sessions\";\nimport { afterAll, beforeAll, describe, expect, test } from \"vitest\";\nimport { decode as dagCborDecode, encode as dagCborEncode } from \"@ipld/dag-cbor\";\nimport { Handles } from \"./3-protocol/2-handles\";\nimport { didTests } from \"./1-services/2-dids-tests\";\nimport { storageBucketTests } from \"./1-services/3-storage-buckets-tests\";\nimport { inboxTests } from \"./1-services/4-inboxes-tests\";\nimport { stringEncodingTests } from \"./2-primitives/1-string-encoding-tests\";\nimport { contentAddressesTests } from \"./2-primitives/2-content-addresses-tests\";\nimport { channelAttestationTests } from \"./2-primitives/3-channel-attestations-tests\";\nimport { allowedAttestationTests } from \"./2-primitives/4-allowed-attestations-tests\";\nimport { handleTests } from \"./3-protocol/2-handles-tests\";\nimport { objectEncodingTests } from \"./3-protocol/3-object-encoding-tests\";\nimport { GraffitiDecentralized } from \"./3-protocol/4-graffiti\";\nimport {\n  DecentralizedTestEnvironment,\n  decentralizedSharedInbox,\n  decentralizedTestUsers,\n} from \"../test/environment\";\n\ndescribe(\"GraffitiDecentralized Tests\", () => {\n  const environment = new DecentralizedTestEnvironment();\n  const handles = decentralizedTestUsers.map((user) => user.handle);\n  let sessions: GraffitiSession[] = [];\n  let sessionMethods: Sessions;\n  let handleMethods: Handles;\n\n  beforeAll(async () => {\n    await environment.start();\n\n    const dids = new DecentralizedIdentifiers();\n    sessionMethods = new Sessions({\n      dids,\n      authorization: new Authorization(),\n      inboxes: new Inboxes(),\n      storageBuckets: new StorageBuckets(),\n    });\n    handleMethods = new Handles({ dids });\n\n    for (const handle of handles) {\n      sessions.push(await login(handle));\n    }\n  });\n\n  afterAll(async () => {\n    try {\n      for (const session of sessions) {\n        await logout(session.actor);\n      }\n    } finally {\n      await environment.stop();\n    }\n  });\n\n  // Service tests\n  didTests();\n  storageBucketTests(\n    decentralizedTestUsers[0].bucketEndpoint,\n    decentralizedTestUsers[0].token,\n  );\n  inboxTests(\n    decentralizedTestUsers[0].inboxEndpoint,\n    decentralizedTestUsers[0].token,\n  );\n\n  // Primitive tests\n  stringEncodingTests();\n  contentAddressesTests();\n  channelAttestationTests();\n  allowedAttestationTests();\n\n  // Protocol tests\n  handleTests(handles[0]);\n  objectEncodingTests();\n\n  const useGraffiti = () =>\n    new GraffitiDecentralized({\n      defaultInboxEndpoints: [decentralizedSharedInbox],\n    });\n  graffitiCRUDTests(\n    useGraffiti,\n    () => sessions[0],\n    () => sessions[1],\n  );\n  graffitiMediaTests(\n    useGraffiti,\n    () => sessions[0],\n    () => sessions[1],\n  );\n  graffitiDiscoverTests(\n    useGraffiti,\n    () => sessions[0],\n    () => sessions[1],\n  );\n\n  test(\"OAuth codes require approval from the selected account\", async () => {\n    const account = decentralizedTestUsers[0];\n    const redirectUri = \"https://client.example/callback\";\n    const endpoint = \"https://localhost:5173/app/oauth/authorize\";\n    const cookie = `account_${account.accountId}=${account.token}`;\n    const headers = {\n      Cookie: cookie,\n      \"X-Graffiti-Account\": String(account.accountId),\n      \"Content-Type\": \"application/json\",\n      Origin: \"https://localhost:5173\",\n    };\n    const request = (scope: string[], requestHeaders: HeadersInit = headers) =>\n      fetch(endpoint, {\n        method: \"POST\",\n        headers: requestHeaders,\n        body: JSON.stringify({ redirect_uri: redirectUri, state: \"test-state\", scope }),\n      });\n\n    const navigation = await fetch(\n      `${endpoint}?account=${account.accountId}&redirect_uri=${encodeURIComponent(redirectUri)}`,\n      { headers: { Cookie: cookie } },\n    );\n    expect(navigation.status).toBe(404);\n\n    expect((await request([account.bucketEndpoint], { Cookie: cookie })).status).toBe(401);\n    expect((await request([account.bucketEndpoint], {\n      ...headers,\n      Origin: \"https://attacker.example\",\n    })).status).toBe(403);\n    expect((await request([decentralizedTestUsers[1].bucketEndpoint])).status).toBe(403);\n\n    const approval = await request([account.bucketEndpoint]);\n    expect(approval.status).toBe(200);\n    const { redirectUri: callback } = await approval.json() as { redirectUri: string };\n    const code = new URL(callback).searchParams.get(\"code\");\n    expect(code).toBeTruthy();\n    expect(new URL(callback).searchParams.get(\"state\")).toBe(\"test-state\");\n\n    const exchange = await fetch(\"https://localhost:5173/app/oauth/token\", {\n      method: \"POST\",\n      body: new URLSearchParams({ code: code!, redirect_uri: redirectUri }),\n    });\n    expect(exchange.status).toBe(200);\n    expect((await exchange.json()).access_token).toBeTypeOf(\"string\");\n  });\n\n  test(\"deleting a bucket removes its values and rejects requests to its old URL\", async () => {\n    const account = decentralizedTestUsers[0];\n    const smallKey = crypto.randomUUID();\n    const largeKey = crypto.randomUUID();\n    const largeValue = new Uint8Array(32 * 1024 + 1).fill(7);\n    const authorization = { Authorization: `Bearer ${account.token}` };\n\n    for (const [key, value] of [\n      [smallKey, new Uint8Array([1, 2, 3])],\n      [largeKey, largeValue],\n    ] as const) {\n      const response = await fetch(`${account.bucketEndpoint}/value/${key}`, {\n        method: \"PUT\",\n        headers: authorization,\n        body: value,\n      });\n      expect(response.status).toBe(201);\n    }\n\n    const r2Key = `${account.bucketId}/${largeKey}`;\n    expect(await environment.storedR2ObjectExists(r2Key)).toBe(true);\n\n    const deletion = await fetch(\n      `https://localhost:5173/app/service-instances/bucket/service/${account.bucketId}`,\n      {\n        method: \"DELETE\",\n        headers: {\n          Cookie: `account_${account.accountId}=${account.token}`,\n          \"X-Graffiti-Account\": String(account.accountId),\n        },\n      },\n    );\n    expect(deletion.status).toBe(200);\n\n    expect(await environment.storedR2ObjectExists(r2Key)).toBe(false);\n    for (const key of [smallKey, largeKey]) {\n      const response = await fetch(`${account.bucketEndpoint}/value/${key}`);\n      expect(response.status).toBe(404);\n    }\n    const batch = await fetch(`${account.bucketEndpoint}/values`, {\n      method: \"POST\",\n      headers: { \"Content-Type\": \"application/cbor\" },\n      body: dagCborEncode({ keys: [smallKey, largeKey], maxValueBytes: largeValue.length }).slice(),\n    });\n    expect((dagCborDecode(await batch.arrayBuffer()) as { results: { status: number }[] }).results)\n      .toEqual([{ status: 404 }, { status: 404 }]);\n\n    const putAfterDeletion = await fetch(`${account.bucketEndpoint}/value/${smallKey}`, {\n      method: \"PUT\",\n      headers: authorization,\n      body: new Uint8Array([4]),\n    });\n    expect(putAfterDeletion.status).toBe(404);\n  });\n\n  // How to log in/out vvv\n  async function login(handle: string) {\n    const actor = await handleMethods.handleToActor(handle);\n\n    return await new Promise<GraffitiSession>((resolve, reject) => {\n      let timeout: ReturnType<typeof setTimeout>;\n      const cleanup = () => {\n        clearTimeout(timeout);\n        sessionMethods.sessionEvents.removeEventListener(\"login\", listener);\n      };\n      const listener = (e: unknown) => {\n        if (!(e instanceof CustomEvent)) return;\n        const detail = e.detail as GraffitiLoginEvent[\"detail\"];\n        if (detail.session?.actor !== actor) return;\n        cleanup();\n        if (detail.error) {\n          reject(detail.error);\n        } else {\n          resolve(detail.session);\n        }\n      };\n      sessionMethods.sessionEvents.addEventListener(\"login\", listener);\n\n      timeout = setTimeout(\n        () => {\n          cleanup();\n          reject(new Error(\"Authorization timed out\"));\n        },\n        30 * 1000,\n      );\n\n      void sessionMethods.login(actor);\n    });\n  }\n\n  async function logout(actor: string) {\n    return await new Promise<void>((resolve, reject) => {\n      let timeout: ReturnType<typeof setTimeout>;\n      const cleanup = () => {\n        clearTimeout(timeout);\n        sessionMethods.sessionEvents.removeEventListener(\"logout\", listener);\n      };\n      const listener = (e: unknown) => {\n        if (!(e instanceof CustomEvent)) return;\n        const detail = e.detail as GraffitiLogoutEvent[\"detail\"];\n        if (detail.actor !== actor) return;\n        cleanup();\n\n        if (detail.error) {\n          reject(detail.error);\n        } else {\n          resolve();\n        }\n      };\n      sessionMethods.sessionEvents.addEventListener(\"logout\", listener);\n\n      timeout = setTimeout(\n        () => {\n          cleanup();\n          reject(new Error(\"Logout timed out\"));\n        },\n        30 * 1000,\n      );\n\n      void sessionMethods.logout(actor);\n    });\n  }\n});\n"],
-  "mappings": "AAKA;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,gCAAgC;AACzC,SAAS,qBAAqB;AAC9B,SAAS,sBAAsB;AAC/B,SAAS,eAAe;AACxB,SAAS,gBAAgB;AACzB,SAAS,UAAU,WAAW,UAAU,QAAQ,YAAY;AAC5D,SAAS,UAAU,eAAe,UAAU,qBAAqB;AACjE,SAAS,eAAe;AACxB,SAAS,gBAAgB;AACzB,SAAS,0BAA0B;AACnC,SAAS,kBAAkB;AAC3B,SAAS,2BAA2B;AACpC,SAAS,6BAA6B;AACtC,SAAS,+BAA+B;AACxC,SAAS,+BAA+B;AACxC,SAAS,mBAAmB;AAC5B,SAAS,2BAA2B;AACpC,SAAS,6BAA6B;AACtC;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAEP,SAAS,+BAA+B,MAAM;AAC5C,QAAM,cAAc,IAAI,6BAA6B;AACrD,QAAM,UAAU,uBAAuB,IAAI,CAAC,SAAS,KAAK,MAAM;AAChE,MAAI,WAA8B,CAAC;AACnC,MAAI;AACJ,MAAI;AAEJ,YAAU,YAAY;AACpB,UAAM,YAAY,MAAM;AAExB,UAAM,OAAO,IAAI,yBAAyB;AAC1C,qBAAiB,IAAI,SAAS;AAAA,MAC5B;AAAA,MACA,eAAe,IAAI,cAAc;AAAA,MACjC,SAAS,IAAI,QAAQ;AAAA,MACrB,gBAAgB,IAAI,eAAe;AAAA,IACrC,CAAC;AACD,oBAAgB,IAAI,QAAQ,EAAE,KAAK,CAAC;AAEpC,eAAW,UAAU,SAAS;AAC5B,eAAS,KAAK,MAAM,MAAM,MAAM,CAAC;AAAA,IACnC;AAAA,EACF,CAAC;AAED,WAAS,YAAY;AACnB,QAAI;AACF,iBAAW,WAAW,UAAU;AAC9B,cAAM,OAAO,QAAQ,KAAK;AAAA,MAC5B;AAAA,IACF,UAAE;AACA,YAAM,YAAY,KAAK;AAAA,IACzB;AAAA,EACF,CAAC;AAGD,WAAS;AACT;AAAA,IACE,uBAAuB,CAAC,EAAE;AAAA,IAC1B,uBAAuB,CAAC,EAAE;AAAA,EAC5B;AACA;AAAA,IACE,uBAAuB,CAAC,EAAE;AAAA,IAC1B,uBAAuB,CAAC,EAAE;AAAA,EAC5B;AAGA,sBAAoB;AACpB,wBAAsB;AACtB,0BAAwB;AACxB,0BAAwB;AAGxB,cAAY,QAAQ,CAAC,CAAC;AACtB,sBAAoB;AAEpB,QAAM,cAAc,MAClB,IAAI,sBAAsB;AAAA,IACxB,uBAAuB,CAAC,wBAAwB;AAAA,EAClD,CAAC;AACH;AAAA,IACE;AAAA,IACA,MAAM,SAAS,CAAC;AAAA,IAChB,MAAM,SAAS,CAAC;AAAA,EAClB;AACA;AAAA,IACE;AAAA,IACA,MAAM,SAAS,CAAC;AAAA,IAChB,MAAM,SAAS,CAAC;AAAA,EAClB;AACA;AAAA,IACE;AAAA,IACA,MAAM,SAAS,CAAC;AAAA,IAChB,MAAM,SAAS,CAAC;AAAA,EAClB;AAEA,OAAK,0DAA0D,YAAY;AACzE,UAAM,UAAU,uBAAuB,CAAC;AACxC,UAAM,cAAc;AACpB,UAAM,WAAW;AACjB,UAAM,SAAS,WAAW,QAAQ,SAAS,IAAI,QAAQ,KAAK;AAC5D,UAAM,UAAU;AAAA,MACd,QAAQ;AAAA,MACR,sBAAsB,OAAO,QAAQ,SAAS;AAAA,MAC9C,gBAAgB;AAAA,MAChB,QAAQ;AAAA,IACV;AACA,UAAM,UAAU,CAAC,OAAiB,iBAA8B,YAC9D,MAAM,UAAU;AAAA,MACd,QAAQ;AAAA,MACR,SAAS;AAAA,MACT,MAAM,KAAK,UAAU,EAAE,cAAc,aAAa,OAAO,cAAc,MAAM,CAAC;AAAA,IAChF,CAAC;AAEH,UAAM,aAAa,MAAM;AAAA,MACvB,GAAG,QAAQ,YAAY,QAAQ,SAAS,iBAAiB,mBAAmB,WAAW,CAAC;AAAA,MACxF,EAAE,SAAS,EAAE,QAAQ,OAAO,EAAE;AAAA,IAChC;AACA,WAAO,WAAW,MAAM,EAAE,KAAK,GAAG;AAElC,YAAQ,MAAM,QAAQ,CAAC,QAAQ,cAAc,GAAG,EAAE,QAAQ,OAAO,CAAC,GAAG,MAAM,EAAE,KAAK,GAAG;AACrF,YAAQ,MAAM,QAAQ,CAAC,QAAQ,cAAc,GAAG;AAAA,MAC9C,GAAG;AAAA,MACH,QAAQ;AAAA,IACV,CAAC,GAAG,MAAM,EAAE,KAAK,GAAG;AACpB,YAAQ,MAAM,QAAQ,CAAC,uBAAuB,CAAC,EAAE,cAAc,CAAC,GAAG,MAAM,EAAE,KAAK,GAAG;AAEnF,UAAM,WAAW,MAAM,QAAQ,CAAC,QAAQ,cAAc,CAAC;AACvD,WAAO,SAAS,MAAM,EAAE,KAAK,GAAG;AAChC,UAAM,EAAE,aAAa,SAAS,IAAI,MAAM,SAAS,KAAK;AACtD,UAAM,OAAO,IAAI,IAAI,QAAQ,EAAE,aAAa,IAAI,MAAM;AACtD,WAAO,IAAI,EAAE,WAAW;AACxB,WAAO,IAAI,IAAI,QAAQ,EAAE,aAAa,IAAI,OAAO,CAAC,EAAE,KAAK,YAAY;AAErE,UAAM,WAAW,MAAM,MAAM,0CAA0C;AAAA,MACrE,QAAQ;AAAA,MACR,MAAM,IAAI,gBAAgB,EAAE,MAAa,cAAc,YAAY,CAAC;AAAA,IACtE,CAAC;AACD,WAAO,SAAS,MAAM,EAAE,KAAK,GAAG;AAChC,YAAQ,MAAM,SAAS,KAAK,GAAG,YAAY,EAAE,WAAW,QAAQ;AAAA,EAClE,CAAC;AAED,OAAK,4EAA4E,YAAY;AAC3F,UAAM,UAAU,uBAAuB,CAAC;AACxC,UAAM,WAAW,OAAO,WAAW;AACnC,UAAM,WAAW,OAAO,WAAW;AACnC,UAAM,aAAa,IAAI,WAAW,KAAK,OAAO,CAAC,EAAE,KAAK,CAAC;AACvD,UAAM,gBAAgB,EAAE,eAAe,UAAU,QAAQ,KAAK,GAAG;AAEjE,eAAW,CAAC,KAAK,KAAK,KAAK;AAAA,MACzB,CAAC,UAAU,IAAI,WAAW,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC;AAAA,MACpC,CAAC,UAAU,UAAU;AAAA,IACvB,GAAY;AACV,YAAM,WAAW,MAAM,MAAM,GAAG,QAAQ,cAAc,UAAU,GAAG,IAAI;AAAA,QACrE,QAAQ;AAAA,QACR,SAAS;AAAA,QACT,MAAM;AAAA,MACR,CAAC;AACD,aAAO,SAAS,MAAM,EAAE,KAAK,GAAG;AAAA,IAClC;AAEA,UAAM,QAAQ,GAAG,QAAQ,QAAQ,IAAI,QAAQ;AAC7C,WAAO,MAAM,YAAY,qBAAqB,KAAK,CAAC,EAAE,KAAK,IAAI;AAE/D,UAAM,WAAW,MAAM;AAAA,MACrB,+DAA+D,QAAQ,QAAQ;AAAA,MAC/E;AAAA,QACE,QAAQ;AAAA,QACR,SAAS;AAAA,UACP,QAAQ,WAAW,QAAQ,SAAS,IAAI,QAAQ,KAAK;AAAA,UACrD,sBAAsB,OAAO,QAAQ,SAAS;AAAA,QAChD;AAAA,MACF;AAAA,IACF;AACA,WAAO,SAAS,MAAM,EAAE,KAAK,GAAG;AAEhC,WAAO,MAAM,YAAY,qBAAqB,KAAK,CAAC,EAAE,KAAK,KAAK;AAChE,eAAW,OAAO,CAAC,UAAU,QAAQ,GAAG;AACtC,YAAM,WAAW,MAAM,MAAM,GAAG,QAAQ,cAAc,UAAU,GAAG,EAAE;AACrE,aAAO,SAAS,MAAM,EAAE,KAAK,GAAG;AAAA,IAClC;AACA,UAAM,QAAQ,MAAM,MAAM,GAAG,QAAQ,cAAc,WAAW;AAAA,MAC5D,QAAQ;AAAA,MACR,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,MAC9C,MAAM,cAAc,EAAE,MAAM,CAAC,UAAU,QAAQ,GAAG,eAAe,WAAW,OAAO,CAAC,EAAE,MAAM;AAAA,IAC9F,CAAC;AACD,WAAQ,cAAc,MAAM,MAAM,YAAY,CAAC,EAAwC,OAAO,EAC3F,QAAQ,CAAC,EAAE,QAAQ,IAAI,GAAG,EAAE,QAAQ,IAAI,CAAC,CAAC;AAE7C,UAAM,mBAAmB,MAAM,MAAM,GAAG,QAAQ,cAAc,UAAU,QAAQ,IAAI;AAAA,MAClF,QAAQ;AAAA,MACR,SAAS;AAAA,MACT,MAAM,IAAI,WAAW,CAAC,CAAC,CAAC;AAAA,IAC1B,CAAC;AACD,WAAO,iBAAiB,MAAM,EAAE,KAAK,GAAG;AAAA,EAC1C,CAAC;AAGD,iBAAe,MAAM,QAAgB;AACnC,UAAM,QAAQ,MAAM,cAAc,cAAc,MAAM;AAEtD,WAAO,MAAM,IAAI,QAAyB,CAAC,SAAS,WAAW;AAC7D,UAAI;AACJ,YAAM,UAAU,MAAM;AACpB,qBAAa,OAAO;AACpB,uBAAe,cAAc,oBAAoB,SAAS,QAAQ;AAAA,MACpE;AACA,YAAM,WAAW,CAAC,MAAe;AAC/B,YAAI,EAAE,aAAa,aAAc;AACjC,cAAM,SAAS,EAAE;AACjB,YAAI,OAAO,SAAS,UAAU,MAAO;AACrC,gBAAQ;AACR,YAAI,OAAO,OAAO;AAChB,iBAAO,OAAO,KAAK;AAAA,QACrB,OAAO;AACL,kBAAQ,OAAO,OAAO;AAAA,QACxB;AAAA,MACF;AACA,qBAAe,cAAc,iBAAiB,SAAS,QAAQ;AAE/D,gBAAU;AAAA,QACR,MAAM;AACJ,kBAAQ;AACR,iBAAO,IAAI,MAAM,yBAAyB,CAAC;AAAA,QAC7C;AAAA,QACA,KAAK;AAAA,MACP;AAEA,WAAK,eAAe,MAAM,KAAK;AAAA,IACjC,CAAC;AAAA,EACH;AAEA,iBAAe,OAAO,OAAe;AACnC,WAAO,MAAM,IAAI,QAAc,CAAC,SAAS,WAAW;AAClD,UAAI;AACJ,YAAM,UAAU,MAAM;AACpB,qBAAa,OAAO;AACpB,uBAAe,cAAc,oBAAoB,UAAU,QAAQ;AAAA,MACrE;AACA,YAAM,WAAW,CAAC,MAAe;AAC/B,YAAI,EAAE,aAAa,aAAc;AACjC,cAAM,SAAS,EAAE;AACjB,YAAI,OAAO,UAAU,MAAO;AAC5B,gBAAQ;AAER,YAAI,OAAO,OAAO;AAChB,iBAAO,OAAO,KAAK;AAAA,QACrB,OAAO;AACL,kBAAQ;AAAA,QACV;AAAA,MACF;AACA,qBAAe,cAAc,iBAAiB,UAAU,QAAQ;AAEhE,gBAAU;AAAA,QACR,MAAM;AACJ,kBAAQ;AACR,iBAAO,IAAI,MAAM,kBAAkB,CAAC;AAAA,QACtC;AAAA,QACA,KAAK;AAAA,MACP;AAEA,WAAK,eAAe,OAAO,KAAK;AAAA,IAClC,CAAC;AAAA,EACH;AACF,CAAC;",
+  "sourcesContent": ["import type {\n  GraffitiLoginEvent,\n  GraffitiLogoutEvent,\n  GraffitiSession,\n} from \"@graffiti-garden/api\";\nimport {\n  graffitiCRUDTests,\n  graffitiDiscoverTests,\n  graffitiMediaTests,\n} from \"@graffiti-garden/api/tests\";\nimport { DecentralizedIdentifiers } from \"./1-services/2-dids\";\nimport { Authorization } from \"./1-services/1-authorization\";\nimport { StorageBuckets } from \"./1-services/3-storage-buckets\";\nimport { Inboxes } from \"./1-services/4-inboxes\";\nimport { Sessions } from \"./3-protocol/1-sessions\";\nimport { afterAll, beforeAll, describe, expect, test } from \"vitest\";\nimport { decode as dagCborDecode, encode as dagCborEncode } from \"@ipld/dag-cbor\";\nimport { Handles } from \"./3-protocol/2-handles\";\nimport { didTests } from \"./1-services/2-dids-tests\";\nimport { storageBucketTests } from \"./1-services/3-storage-buckets-tests\";\nimport { inboxTests, inboxUnitTests } from \"./1-services/4-inboxes-tests\";\nimport { stringEncodingTests } from \"./2-primitives/1-string-encoding-tests\";\nimport { contentAddressesTests } from \"./2-primitives/2-content-addresses-tests\";\nimport { channelAttestationTests } from \"./2-primitives/3-channel-attestations-tests\";\nimport { allowedAttestationTests } from \"./2-primitives/4-allowed-attestations-tests\";\nimport { handleTests } from \"./3-protocol/2-handles-tests\";\nimport { objectEncodingTests } from \"./3-protocol/3-object-encoding-tests\";\nimport { GraffitiDecentralized } from \"./3-protocol/4-graffiti\";\nimport {\n  DecentralizedTestEnvironment,\n  decentralizedSharedInbox,\n  decentralizedTestUsers,\n} from \"../test/environment\";\n\ndescribe(\"GraffitiDecentralized Tests\", () => {\n  const environment = new DecentralizedTestEnvironment();\n  const handles = decentralizedTestUsers.map((user) => user.handle);\n  let sessions: GraffitiSession[] = [];\n  let sessionMethods: Sessions;\n  let handleMethods: Handles;\n\n  beforeAll(async () => {\n    await environment.start();\n\n    const dids = new DecentralizedIdentifiers();\n    sessionMethods = new Sessions({\n      dids,\n      authorization: new Authorization(),\n      inboxes: new Inboxes(),\n      storageBuckets: new StorageBuckets(),\n    });\n    handleMethods = new Handles({ dids });\n\n    for (const handle of handles) {\n      sessions.push(await login(handle));\n    }\n  });\n\n  afterAll(async () => {\n    try {\n      for (const session of sessions) {\n        await logout(session.actor);\n      }\n    } finally {\n      await environment.stop();\n    }\n  });\n\n  // Service tests\n  didTests();\n  storageBucketTests(\n    decentralizedTestUsers[0].bucketEndpoint,\n    decentralizedTestUsers[0].token,\n  );\n  inboxTests(\n    decentralizedTestUsers[0].inboxEndpoint,\n    decentralizedTestUsers[0].token,\n  );\n\n  // Primitive tests\n  stringEncodingTests();\n  contentAddressesTests();\n  channelAttestationTests();\n  allowedAttestationTests();\n\n  // Protocol tests\n  handleTests(handles[0]);\n  objectEncodingTests();\n\n  const useGraffiti = () =>\n    new GraffitiDecentralized({\n      defaultInboxEndpoints: [decentralizedSharedInbox],\n    });\n  graffitiCRUDTests(\n    useGraffiti,\n    () => sessions[0],\n    () => sessions[1],\n  );\n  graffitiMediaTests(\n    useGraffiti,\n    () => sessions[0],\n    () => sessions[1],\n  );\n  graffitiDiscoverTests(\n    useGraffiti,\n    () => sessions[0],\n    () => sessions[1],\n  );\n\n  test(\"OAuth codes require approval from the selected account\", async () => {\n    const account = decentralizedTestUsers[0];\n    const redirectUri = \"https://client.example/callback\";\n    const endpoint = \"https://localhost:5173/app/oauth/authorize\";\n    const cookie = `account_${account.accountId}=${account.token}`;\n    const headers = {\n      Cookie: cookie,\n      \"X-Graffiti-Account\": String(account.accountId),\n      \"Content-Type\": \"application/json\",\n      Origin: \"https://localhost:5173\",\n    };\n    const request = (scope: string[], requestHeaders: HeadersInit = headers) =>\n      fetch(endpoint, {\n        method: \"POST\",\n        headers: requestHeaders,\n        body: JSON.stringify({ redirect_uri: redirectUri, state: \"test-state\", scope }),\n      });\n\n    const navigation = await fetch(\n      `${endpoint}?account=${account.accountId}&redirect_uri=${encodeURIComponent(redirectUri)}`,\n      { headers: { Cookie: cookie } },\n    );\n    expect(navigation.status).toBe(404);\n\n    expect((await request([account.bucketEndpoint], { Cookie: cookie })).status).toBe(401);\n    expect((await request([account.bucketEndpoint], {\n      ...headers,\n      Origin: \"https://attacker.example\",\n    })).status).toBe(403);\n    expect((await request([decentralizedTestUsers[1].bucketEndpoint])).status).toBe(403);\n\n    const approval = await request([account.bucketEndpoint]);\n    expect(approval.status).toBe(200);\n    const { redirectUri: callback } = await approval.json() as { redirectUri: string };\n    const code = new URL(callback).searchParams.get(\"code\");\n    expect(code).toBeTruthy();\n    expect(new URL(callback).searchParams.get(\"state\")).toBe(\"test-state\");\n\n    const exchange = await fetch(\"https://localhost:5173/app/oauth/token\", {\n      method: \"POST\",\n      body: new URLSearchParams({ code: code!, redirect_uri: redirectUri }),\n    });\n    expect(exchange.status).toBe(200);\n    expect((await exchange.json()).access_token).toBeTypeOf(\"string\");\n  });\n\n  test(\"deleting a bucket removes its values and rejects requests to its old URL\", async () => {\n    const account = decentralizedTestUsers[0];\n    const smallKey = crypto.randomUUID();\n    const largeKey = crypto.randomUUID();\n    const largeValue = new Uint8Array(32 * 1024 + 1).fill(7);\n    const authorization = { Authorization: `Bearer ${account.token}` };\n\n    for (const [key, value] of [\n      [smallKey, new Uint8Array([1, 2, 3])],\n      [largeKey, largeValue],\n    ] as const) {\n      const response = await fetch(`${account.bucketEndpoint}/value/${key}`, {\n        method: \"PUT\",\n        headers: authorization,\n        body: value,\n      });\n      expect(response.status).toBe(201);\n    }\n\n    const r2Key = `${account.bucketId}/${largeKey}`;\n    expect(await environment.storedR2ObjectExists(r2Key)).toBe(true);\n\n    const deletion = await fetch(\n      `https://localhost:5173/app/service-instances/bucket/service/${account.bucketId}`,\n      {\n        method: \"DELETE\",\n        headers: {\n          Cookie: `account_${account.accountId}=${account.token}`,\n          \"X-Graffiti-Account\": String(account.accountId),\n        },\n      },\n    );\n    expect(deletion.status).toBe(200);\n\n    expect(await environment.storedR2ObjectExists(r2Key)).toBe(false);\n    for (const key of [smallKey, largeKey]) {\n      const response = await fetch(`${account.bucketEndpoint}/value/${key}`);\n      expect(response.status).toBe(404);\n    }\n    const batch = await fetch(`${account.bucketEndpoint}/values`, {\n      method: \"POST\",\n      headers: { \"Content-Type\": \"application/cbor\" },\n      body: dagCborEncode({ keys: [smallKey, largeKey], maxValueBytes: largeValue.length }).slice(),\n    });\n    expect((dagCborDecode(await batch.arrayBuffer()) as { results: { status: number }[] }).results)\n      .toEqual([{ status: 404 }, { status: 404 }]);\n\n    const putAfterDeletion = await fetch(`${account.bucketEndpoint}/value/${smallKey}`, {\n      method: \"PUT\",\n      headers: authorization,\n      body: new Uint8Array([4]),\n    });\n    expect(putAfterDeletion.status).toBe(404);\n  });\n\n  // How to log in/out vvv\n  async function login(handle: string) {\n    const actor = await handleMethods.handleToActor(handle);\n\n    return await new Promise<GraffitiSession>((resolve, reject) => {\n      let timeout: ReturnType<typeof setTimeout>;\n      const cleanup = () => {\n        clearTimeout(timeout);\n        sessionMethods.sessionEvents.removeEventListener(\"login\", listener);\n      };\n      const listener = (e: unknown) => {\n        if (!(e instanceof CustomEvent)) return;\n        const detail = e.detail as GraffitiLoginEvent[\"detail\"];\n        if (detail.session?.actor !== actor) return;\n        cleanup();\n        if (detail.error) {\n          reject(detail.error);\n        } else {\n          resolve(detail.session);\n        }\n      };\n      sessionMethods.sessionEvents.addEventListener(\"login\", listener);\n\n      timeout = setTimeout(\n        () => {\n          cleanup();\n          reject(new Error(\"Authorization timed out\"));\n        },\n        30 * 1000,\n      );\n\n      void sessionMethods.login(actor);\n    });\n  }\n\n  async function logout(actor: string) {\n    return await new Promise<void>((resolve, reject) => {\n      let timeout: ReturnType<typeof setTimeout>;\n      const cleanup = () => {\n        clearTimeout(timeout);\n        sessionMethods.sessionEvents.removeEventListener(\"logout\", listener);\n      };\n      const listener = (e: unknown) => {\n        if (!(e instanceof CustomEvent)) return;\n        const detail = e.detail as GraffitiLogoutEvent[\"detail\"];\n        if (detail.actor !== actor) return;\n        cleanup();\n\n        if (detail.error) {\n          reject(detail.error);\n        } else {\n          resolve();\n        }\n      };\n      sessionMethods.sessionEvents.addEventListener(\"logout\", listener);\n\n      timeout = setTimeout(\n        () => {\n          cleanup();\n          reject(new Error(\"Logout timed out\"));\n        },\n        30 * 1000,\n      );\n\n      void sessionMethods.logout(actor);\n    });\n  }\n});\n\ninboxUnitTests();\n"],
+  "mappings": "AAKA;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,gCAAgC;AACzC,SAAS,qBAAqB;AAC9B,SAAS,sBAAsB;AAC/B,SAAS,eAAe;AACxB,SAAS,gBAAgB;AACzB,SAAS,UAAU,WAAW,UAAU,QAAQ,YAAY;AAC5D,SAAS,UAAU,eAAe,UAAU,qBAAqB;AACjE,SAAS,eAAe;AACxB,SAAS,gBAAgB;AACzB,SAAS,0BAA0B;AACnC,SAAS,YAAY,sBAAsB;AAC3C,SAAS,2BAA2B;AACpC,SAAS,6BAA6B;AACtC,SAAS,+BAA+B;AACxC,SAAS,+BAA+B;AACxC,SAAS,mBAAmB;AAC5B,SAAS,2BAA2B;AACpC,SAAS,6BAA6B;AACtC;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAEP,SAAS,+BAA+B,MAAM;AAC5C,QAAM,cAAc,IAAI,6BAA6B;AACrD,QAAM,UAAU,uBAAuB,IAAI,CAAC,SAAS,KAAK,MAAM;AAChE,MAAI,WAA8B,CAAC;AACnC,MAAI;AACJ,MAAI;AAEJ,YAAU,YAAY;AACpB,UAAM,YAAY,MAAM;AAExB,UAAM,OAAO,IAAI,yBAAyB;AAC1C,qBAAiB,IAAI,SAAS;AAAA,MAC5B;AAAA,MACA,eAAe,IAAI,cAAc;AAAA,MACjC,SAAS,IAAI,QAAQ;AAAA,MACrB,gBAAgB,IAAI,eAAe;AAAA,IACrC,CAAC;AACD,oBAAgB,IAAI,QAAQ,EAAE,KAAK,CAAC;AAEpC,eAAW,UAAU,SAAS;AAC5B,eAAS,KAAK,MAAM,MAAM,MAAM,CAAC;AAAA,IACnC;AAAA,EACF,CAAC;AAED,WAAS,YAAY;AACnB,QAAI;AACF,iBAAW,WAAW,UAAU;AAC9B,cAAM,OAAO,QAAQ,KAAK;AAAA,MAC5B;AAAA,IACF,UAAE;AACA,YAAM,YAAY,KAAK;AAAA,IACzB;AAAA,EACF,CAAC;AAGD,WAAS;AACT;AAAA,IACE,uBAAuB,CAAC,EAAE;AAAA,IAC1B,uBAAuB,CAAC,EAAE;AAAA,EAC5B;AACA;AAAA,IACE,uBAAuB,CAAC,EAAE;AAAA,IAC1B,uBAAuB,CAAC,EAAE;AAAA,EAC5B;AAGA,sBAAoB;AACpB,wBAAsB;AACtB,0BAAwB;AACxB,0BAAwB;AAGxB,cAAY,QAAQ,CAAC,CAAC;AACtB,sBAAoB;AAEpB,QAAM,cAAc,MAClB,IAAI,sBAAsB;AAAA,IACxB,uBAAuB,CAAC,wBAAwB;AAAA,EAClD,CAAC;AACH;AAAA,IACE;AAAA,IACA,MAAM,SAAS,CAAC;AAAA,IAChB,MAAM,SAAS,CAAC;AAAA,EAClB;AACA;AAAA,IACE;AAAA,IACA,MAAM,SAAS,CAAC;AAAA,IAChB,MAAM,SAAS,CAAC;AAAA,EAClB;AACA;AAAA,IACE;AAAA,IACA,MAAM,SAAS,CAAC;AAAA,IAChB,MAAM,SAAS,CAAC;AAAA,EAClB;AAEA,OAAK,0DAA0D,YAAY;AACzE,UAAM,UAAU,uBAAuB,CAAC;AACxC,UAAM,cAAc;AACpB,UAAM,WAAW;AACjB,UAAM,SAAS,WAAW,QAAQ,SAAS,IAAI,QAAQ,KAAK;AAC5D,UAAM,UAAU;AAAA,MACd,QAAQ;AAAA,MACR,sBAAsB,OAAO,QAAQ,SAAS;AAAA,MAC9C,gBAAgB;AAAA,MAChB,QAAQ;AAAA,IACV;AACA,UAAM,UAAU,CAAC,OAAiB,iBAA8B,YAC9D,MAAM,UAAU;AAAA,MACd,QAAQ;AAAA,MACR,SAAS;AAAA,MACT,MAAM,KAAK,UAAU,EAAE,cAAc,aAAa,OAAO,cAAc,MAAM,CAAC;AAAA,IAChF,CAAC;AAEH,UAAM,aAAa,MAAM;AAAA,MACvB,GAAG,QAAQ,YAAY,QAAQ,SAAS,iBAAiB,mBAAmB,WAAW,CAAC;AAAA,MACxF,EAAE,SAAS,EAAE,QAAQ,OAAO,EAAE;AAAA,IAChC;AACA,WAAO,WAAW,MAAM,EAAE,KAAK,GAAG;AAElC,YAAQ,MAAM,QAAQ,CAAC,QAAQ,cAAc,GAAG,EAAE,QAAQ,OAAO,CAAC,GAAG,MAAM,EAAE,KAAK,GAAG;AACrF,YAAQ,MAAM,QAAQ,CAAC,QAAQ,cAAc,GAAG;AAAA,MAC9C,GAAG;AAAA,MACH,QAAQ;AAAA,IACV,CAAC,GAAG,MAAM,EAAE,KAAK,GAAG;AACpB,YAAQ,MAAM,QAAQ,CAAC,uBAAuB,CAAC,EAAE,cAAc,CAAC,GAAG,MAAM,EAAE,KAAK,GAAG;AAEnF,UAAM,WAAW,MAAM,QAAQ,CAAC,QAAQ,cAAc,CAAC;AACvD,WAAO,SAAS,MAAM,EAAE,KAAK,GAAG;AAChC,UAAM,EAAE,aAAa,SAAS,IAAI,MAAM,SAAS,KAAK;AACtD,UAAM,OAAO,IAAI,IAAI,QAAQ,EAAE,aAAa,IAAI,MAAM;AACtD,WAAO,IAAI,EAAE,WAAW;AACxB,WAAO,IAAI,IAAI,QAAQ,EAAE,aAAa,IAAI,OAAO,CAAC,EAAE,KAAK,YAAY;AAErE,UAAM,WAAW,MAAM,MAAM,0CAA0C;AAAA,MACrE,QAAQ;AAAA,MACR,MAAM,IAAI,gBAAgB,EAAE,MAAa,cAAc,YAAY,CAAC;AAAA,IACtE,CAAC;AACD,WAAO,SAAS,MAAM,EAAE,KAAK,GAAG;AAChC,YAAQ,MAAM,SAAS,KAAK,GAAG,YAAY,EAAE,WAAW,QAAQ;AAAA,EAClE,CAAC;AAED,OAAK,4EAA4E,YAAY;AAC3F,UAAM,UAAU,uBAAuB,CAAC;AACxC,UAAM,WAAW,OAAO,WAAW;AACnC,UAAM,WAAW,OAAO,WAAW;AACnC,UAAM,aAAa,IAAI,WAAW,KAAK,OAAO,CAAC,EAAE,KAAK,CAAC;AACvD,UAAM,gBAAgB,EAAE,eAAe,UAAU,QAAQ,KAAK,GAAG;AAEjE,eAAW,CAAC,KAAK,KAAK,KAAK;AAAA,MACzB,CAAC,UAAU,IAAI,WAAW,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC;AAAA,MACpC,CAAC,UAAU,UAAU;AAAA,IACvB,GAAY;AACV,YAAM,WAAW,MAAM,MAAM,GAAG,QAAQ,cAAc,UAAU,GAAG,IAAI;AAAA,QACrE,QAAQ;AAAA,QACR,SAAS;AAAA,QACT,MAAM;AAAA,MACR,CAAC;AACD,aAAO,SAAS,MAAM,EAAE,KAAK,GAAG;AAAA,IAClC;AAEA,UAAM,QAAQ,GAAG,QAAQ,QAAQ,IAAI,QAAQ;AAC7C,WAAO,MAAM,YAAY,qBAAqB,KAAK,CAAC,EAAE,KAAK,IAAI;AAE/D,UAAM,WAAW,MAAM;AAAA,MACrB,+DAA+D,QAAQ,QAAQ;AAAA,MAC/E;AAAA,QACE,QAAQ;AAAA,QACR,SAAS;AAAA,UACP,QAAQ,WAAW,QAAQ,SAAS,IAAI,QAAQ,KAAK;AAAA,UACrD,sBAAsB,OAAO,QAAQ,SAAS;AAAA,QAChD;AAAA,MACF;AAAA,IACF;AACA,WAAO,SAAS,MAAM,EAAE,KAAK,GAAG;AAEhC,WAAO,MAAM,YAAY,qBAAqB,KAAK,CAAC,EAAE,KAAK,KAAK;AAChE,eAAW,OAAO,CAAC,UAAU,QAAQ,GAAG;AACtC,YAAM,WAAW,MAAM,MAAM,GAAG,QAAQ,cAAc,UAAU,GAAG,EAAE;AACrE,aAAO,SAAS,MAAM,EAAE,KAAK,GAAG;AAAA,IAClC;AACA,UAAM,QAAQ,MAAM,MAAM,GAAG,QAAQ,cAAc,WAAW;AAAA,MAC5D,QAAQ;AAAA,MACR,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,MAC9C,MAAM,cAAc,EAAE,MAAM,CAAC,UAAU,QAAQ,GAAG,eAAe,WAAW,OAAO,CAAC,EAAE,MAAM;AAAA,IAC9F,CAAC;AACD,WAAQ,cAAc,MAAM,MAAM,YAAY,CAAC,EAAwC,OAAO,EAC3F,QAAQ,CAAC,EAAE,QAAQ,IAAI,GAAG,EAAE,QAAQ,IAAI,CAAC,CAAC;AAE7C,UAAM,mBAAmB,MAAM,MAAM,GAAG,QAAQ,cAAc,UAAU,QAAQ,IAAI;AAAA,MAClF,QAAQ;AAAA,MACR,SAAS;AAAA,MACT,MAAM,IAAI,WAAW,CAAC,CAAC,CAAC;AAAA,IAC1B,CAAC;AACD,WAAO,iBAAiB,MAAM,EAAE,KAAK,GAAG;AAAA,EAC1C,CAAC;AAGD,iBAAe,MAAM,QAAgB;AACnC,UAAM,QAAQ,MAAM,cAAc,cAAc,MAAM;AAEtD,WAAO,MAAM,IAAI,QAAyB,CAAC,SAAS,WAAW;AAC7D,UAAI;AACJ,YAAM,UAAU,MAAM;AACpB,qBAAa,OAAO;AACpB,uBAAe,cAAc,oBAAoB,SAAS,QAAQ;AAAA,MACpE;AACA,YAAM,WAAW,CAAC,MAAe;AAC/B,YAAI,EAAE,aAAa,aAAc;AACjC,cAAM,SAAS,EAAE;AACjB,YAAI,OAAO,SAAS,UAAU,MAAO;AACrC,gBAAQ;AACR,YAAI,OAAO,OAAO;AAChB,iBAAO,OAAO,KAAK;AAAA,QACrB,OAAO;AACL,kBAAQ,OAAO,OAAO;AAAA,QACxB;AAAA,MACF;AACA,qBAAe,cAAc,iBAAiB,SAAS,QAAQ;AAE/D,gBAAU;AAAA,QACR,MAAM;AACJ,kBAAQ;AACR,iBAAO,IAAI,MAAM,yBAAyB,CAAC;AAAA,QAC7C;AAAA,QACA,KAAK;AAAA,MACP;AAEA,WAAK,eAAe,MAAM,KAAK;AAAA,IACjC,CAAC;AAAA,EACH;AAEA,iBAAe,OAAO,OAAe;AACnC,WAAO,MAAM,IAAI,QAAc,CAAC,SAAS,WAAW;AAClD,UAAI;AACJ,YAAM,UAAU,MAAM;AACpB,qBAAa,OAAO;AACpB,uBAAe,cAAc,oBAAoB,UAAU,QAAQ;AAAA,MACrE;AACA,YAAM,WAAW,CAAC,MAAe;AAC/B,YAAI,EAAE,aAAa,aAAc;AACjC,cAAM,SAAS,EAAE;AACjB,YAAI,OAAO,UAAU,MAAO;AAC5B,gBAAQ;AAER,YAAI,OAAO,OAAO;AAChB,iBAAO,OAAO,KAAK;AAAA,QACrB,OAAO;AACL,kBAAQ;AAAA,QACV;AAAA,MACF;AACA,qBAAe,cAAc,iBAAiB,UAAU,QAAQ;AAEhE,gBAAU;AAAA,QACR,MAAM;AACJ,kBAAQ;AACR,iBAAO,IAAI,MAAM,kBAAkB,CAAC;AAAA,QACtC;AAAA,QACA,KAAK;AAAA,MACP;AAEA,WAAK,eAAe,OAAO,KAAK;AAAA,IAClC,CAAC;AAAA,EACH;AACF,CAAC;AAED,eAAe;",
   "names": []
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@graffiti-garden/implementation-decentralized",
-  "version": "0.1.3",
+  "version": "0.1.4",
   "description": "A client for a decentralized implementation of the Graffiti API",
   "types": "./dist/index.d.ts",
   "module": "./dist/esm/index.js",

package/src/1-services/4-inboxes/cache.ts

@@ -0,0 +1,227 @@
+import { encode as dagCborEncode } from "@ipld/dag-cbor";
+import { LABELED_MESSAGE_ID_KEY, type LabeledMessageBase } from "./messages";
+
+// One record per inbox query. Messages live in the separate message cache;
+// this record tracks their IDs and where to continue fetching from the server.
+export type CacheQueryValue = {
+  // Server continuation state for the next page.
+  cursor: string;
+  // Identifies this local query history, not a server version. It stays the
+  // same as pages arrive; a reset creates a new one so old caller cursors expire.
+  version: string;
+  // All message IDs fetched for this query so far, in order. A caller's
+  // numSeen cursor indexes into this list to replay only unseen messages.
+  messageIds: string[];
+  waitTil?: number;
+  // Changes on every cached page write, even if the page is empty and neither
+  // messageIds nor cursor changes. A tab waiting on the query lock can use this
+  // to detect and reuse a page fetched by another tab. Older entries lack it.
+  generation?: string;
+  // Whether the server has another page; needed when reusing another tab's
+  // cached page. Older cache entries lack this and are refreshed on next query.
+  hasMore?: boolean;
+};
+
+export async function canUseIDB(): Promise<boolean> {
+  try {
+    if (!globalThis.indexedDB) return false;
+
+    // Small probe database
+    await new Promise<void>((resolve, reject) => {
+      const req = indexedDB.open("__idb_probe__", 1);
+      req.onupgradeneeded = () => req.result.createObjectStore("k");
+      req.onsuccess = () => {
+        req.result.close();
+        resolve();
+      };
+      req.onerror = () => reject(req.error);
+    });
+
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+export type Cache = {
+  messages: {
+    get(k: string): Promise<LabeledMessageBase | null | undefined>;
+    set(k: string, value: LabeledMessageBase | null): Promise<void>;
+    setMany(entries: [string, LabeledMessageBase][]): Promise<void>;
+    del(k: string): Promise<void>;
+  };
+  messageIds: {
+    get(k: string): Promise<CacheQueryValue | undefined>;
+    set(k: string, value: CacheQueryValue): Promise<void>;
+    del(k: string): Promise<void>;
+  };
+};
+
+export function getMessageCacheKey(inboxUrl: string, messageId: string) {
+  return `${encodeURIComponent(inboxUrl)}:${encodeURIComponent(messageId)}`;
+}
+
+export async function replayQuery(
+  cache: Cache,
+  inboxUrl: string,
+  messageIdsCacheKey: string,
+  query: CacheQueryValue,
+  numSeen = 0,
+): Promise<LabeledMessageBase[]> {
+  // Filter out all messageIds before
+  // the number already seen
+  const messageIds = query.messageIds.slice(numSeen);
+
+  // Get all the messages pointed to in the cache
+  return Promise.all(
+    messageIds.map(async (id) => {
+      const message = await cache.messages.get(getMessageCacheKey(inboxUrl, id));
+      if (!message) {
+        // Something is very wrong with the cache,
+        // it refers to message IDs that are not cached
+        try {
+          await cache.messageIds.del(messageIdsCacheKey);
+        } catch {}
+        throw new Error("Cache out of sync - perhaps clear browser storage");
+      }
+      return message;
+    }),
+  );
+}
+
+export async function storeQueryPage(
+  cache: Cache,
+  inboxUrl: string,
+  messageIdsCacheKey: string,
+  previous: CacheQueryValue | undefined,
+  page: {
+    messages: LabeledMessageBase[];
+    cursor: string;
+    hasMore: boolean;
+    waitTil?: number;
+  },
+): Promise<CacheQueryValue> {
+  // First cache the messages with their labels
+  await cache.messages.setMany(
+    page.messages.map((message) => [
+      getMessageCacheKey(inboxUrl, message[LABELED_MESSAGE_ID_KEY]),
+      message,
+    ]),
+  );
+  // Then store all the messageids
+  const query = {
+    cursor: page.cursor,
+    version: previous?.version ?? crypto.randomUUID(),
+    messageIds: [
+      ...(previous?.messageIds ?? []),
+      ...page.messages.map((message) => message[LABELED_MESSAGE_ID_KEY]),
+    ],
+    generation: crypto.randomUUID(),
+    hasMore: page.hasMore,
+    waitTil: page.waitTil,
+  };
+  await cache.messageIds.set(messageIdsCacheKey, query);
+  return query;
+}
+
+export async function getMessageIdsCacheKey(
+  inboxUrl: string,
+  type: "query" | "export",
+  body?: Uint8Array,
+): Promise<string> {
+  const cacheIdData = dagCborEncode({
+    inboxUrl,
+    type,
+    body: body ?? null,
+  });
+  return crypto.subtle
+    .digest("SHA-256", new Uint8Array(cacheIdData))
+    .then((bytes) =>
+      Array.from(new Uint8Array(bytes))
+        .map((byte) => byte.toString(16).padStart(2, "0"))
+        .join(""),
+    );
+}
+
+async function resetCacheDB() {
+  await new Promise<void>((resolve) => {
+    const req = indexedDB.deleteDatabase("graffiti-inbox-cache");
+    req.onsuccess = () => resolve();
+    req.onerror = () => resolve(); // best effort
+    req.onblocked = () => resolve(); // best effort
+  });
+}
+
+export async function createCache(): Promise<Cache> {
+  if (await canUseIDB()) {
+    const { openDB } = await import("idb");
+    const db = await openDB("graffiti-inbox-cache", 1, {
+      upgrade(db) {
+        if (!db.objectStoreNames.contains("m")) db.createObjectStore("m");
+        if (!db.objectStoreNames.contains("q")) db.createObjectStore("q");
+      },
+    });
+
+    return {
+      messages: {
+        get: async (k) => {
+          try {
+            return db.get("m", k);
+          } catch (error) {
+            console.error("Error getting message from cache:", error);
+            console.error("resetting cache...");
+            await resetCacheDB();
+            return undefined;
+          }
+        },
+        set: async (k, v) => {
+          await db.put("m", v, k);
+        },
+        setMany: async (entries) => {
+          if (entries.length === 0) return;
+          const tx = db.transaction("m", "readwrite");
+          await Promise.all([
+            ...entries.map(([k, v]) => tx.store.put(v, k)),
+            tx.done,
+          ]);
+        },
+        del: (k) => db.delete("m", k),
+      },
+      messageIds: {
+        get: async (k) => {
+          try {
+            return await db.get("q", k);
+          } catch (error) {
+            console.error("Error getting message IDs from cache:", error);
+            console.error("resetting cache...");
+            await resetCacheDB();
+            return undefined;
+          }
+        },
+        set: async (k, v) => {
+          await db.put("q", v, k);
+        },
+        del: (k) => db.delete("q", k),
+      },
+    };
+  }
+
+  const m = new Map<string, LabeledMessageBase | null>();
+  const q = new Map<string, CacheQueryValue>();
+
+  return {
+    messages: {
+      get: async (k) => m.get(k),
+      set: async (k, v) => void m.set(k, v),
+      setMany: async (entries) => {
+        for (const [k, v] of entries) m.set(k, v);
+      },
+      del: async (k) => void m.delete(k),
+    },
+    messageIds: {
+      get: async (k) => q.get(k),
+      set: async (k, v) => void q.set(k, v),
+      del: async (k) => void q.delete(k),
+    },
+  };
+}

package/src/1-services/4-inboxes/messages.ts

@@ -0,0 +1,63 @@
+import type { JSONSchema, GraffitiObject } from "@graffiti-garden/api";
+import {
+  type infer as infer_,
+  string,
+  url,
+  array,
+  optional,
+  nullable,
+  strictObject,
+  looseObject,
+  custom,
+  number,
+  boolean,
+} from "zod/mini";
+
+const GraffitiObjectSchema = strictObject({
+  value: looseObject({}),
+  channels: array(string()),
+  allowed: optional(nullable(array(url()))),
+  url: url(),
+  actor: url(),
+});
+export const Uint8ArraySchema = custom<Uint8Array>(
+  (v): v is Uint8Array => v instanceof Uint8Array,
+);
+export const TagsSchema = array(Uint8ArraySchema);
+
+export const MESSAGE_TAGS_KEY = "t";
+export const MESSAGE_OBJECT_KEY = "o";
+export const MESSAGE_METADATA_KEY = "m";
+export const MessageBaseSchema = strictObject({
+  [MESSAGE_TAGS_KEY]: TagsSchema,
+  [MESSAGE_OBJECT_KEY]: GraffitiObjectSchema,
+  [MESSAGE_METADATA_KEY]: Uint8ArraySchema,
+});
+type MessageBase = infer_<typeof MessageBaseSchema>;
+
+export const LABELED_MESSAGE_ID_KEY = "id";
+export const LABELED_MESSAGE_MESSAGE_KEY = "m";
+export const LABELED_MESSAGE_LABEL_KEY = "l";
+export const LabeledMessageBaseSchema = strictObject({
+  [LABELED_MESSAGE_ID_KEY]: string(),
+  [LABELED_MESSAGE_MESSAGE_KEY]: MessageBaseSchema,
+  [LABELED_MESSAGE_LABEL_KEY]: number(),
+});
+export type LabeledMessageBase = infer_<typeof LabeledMessageBaseSchema>;
+
+export type Message<Schema extends JSONSchema> = MessageBase & {
+  [MESSAGE_OBJECT_KEY]: GraffitiObject<Schema>;
+};
+export type LabeledMessage<Schema extends JSONSchema> = LabeledMessageBase & {
+  [LABELED_MESSAGE_MESSAGE_KEY]: {
+    [MESSAGE_OBJECT_KEY]: GraffitiObject<Schema>;
+  };
+};
+
+export const SendResponseSchema = strictObject({ id: string() });
+
+export const MessageResultSchema = strictObject({
+  results: array(LabeledMessageBaseSchema),
+  hasMore: boolean(),
+  cursor: string(),
+});