@idleware/ringi 0.7.2 → 0.8.1

package/target/esm/adapters/{transport-git → store-git}/remote/keys.js

@@ -2,6 +2,7 @@
 import crypto from 'node:crypto';
 import fs from 'node:fs';
 import * as C from '../../../lib/index.js';
+import { storeOf } from '../../../core/hub/rooms/address.js';
 import { id, rev } from './git.js';
 import { ROOT } from './types.js';
 export const parseKey = (value) => {
@@ -16,7 +17,7 @@ export const parseKey = (value) => {
     return { line, fp: 'SHA256:' + crypto.createHash('sha256').update(data).digest('base64').replace(/=+$/, '') };
 };
 export const keyInput = (value) => parseKey(fs.existsSync(value) && fs.statSync(value).isFile() ? fs.readFileSync(value, 'utf8') : value);
-export const rootKey = (H) => parseKey(H.d.root || C.fail(`hub ${H.name} has no out-of-band root pin; use hub add --root <public-key|file>`));
+export const rootKey = (H) => parseKey(H.d.root || C.fail(`hub ${H.name} has no out-of-band root pin; use an invitation carrying the independently pinned root`));
 export const signerLine = (who, key) => `${who} namespaces="git" ${key.line}\n`;
 export const signingContext = (H) => H.signing ?? C.fail(`hub ${H.name}: signed writes require an injected Signer`);
 export const identityKey = (H, who, create = false) => {
@@ -31,8 +32,12 @@ export const setupSigned = (H, url) => {
     H.d.trust = 'signed';
     H.d.root = key.line;
     if (url) {
-        checkUrl(url);
-        H.d.store.remote = url;
+        const address = storeOf(url);
+        if (address.type !== 'git')
+            C.fail('git setup requires a git address');
+        checkUrl(address.locator);
+        const source = H.d.contract ?? C.fail('signed setup requires an explicit contract source');
+        source.remote = url;
     }
     return { root: key.line, allowedSigners: signerLine(ROOT, key) };
 };

package/target/esm/adapters/{transport-git → store-git}/remote/push-retry.js

@@ -2,26 +2,44 @@
 // verified remote tip to make it again.
 import * as C from '../../../lib/index.js';
 import { savePushAlarms } from './alarms.js';
+import { validateRef } from './push-validate.js';
 import { branchData } from './branch.js';
-import { ancestor, git, promote, rev, suffix } from './git.js';
+import { readCommits } from './commits.js';
+import { verifyMain } from './main.js';
+import { ancestor, git, promote, rev, tracking, zero } from './git.js';
+import { streamName } from './streams.js';
 const fetchIncoming = ({ H, ref, track, url, sha, acc }) => {
     git(H, ['-c', 'fetch.fsckObjects=true', 'fetch', '-q', '--no-tags', url, `+${ref}:${track}`]);
+    git(H, ['-c', 'fetch.fsckObjects=true', 'fetch', '-q', '--no-tags', url, `+refs/heads/main:${tracking('refs/heads/main')}`]);
+    const main = rev(H, tracking('refs/heads/main')) ?? C.fail('remote main is missing');
+    verifyMain(H, main);
+    if (H.endpoint && readCommits(H, [H.endpoint.genesis])[0].parents[0] !== main)
+        C.fail('the room main changed its frozen contract');
+    promote(H, 'refs/heads/main', main);
+    if (streamName(ref)) {
+        git(H, ['-c', 'fetch.fsckObjects=true', 'fetch', '-q', '--no-tags', url, `+refs/heads/chat:${tracking('refs/heads/chat')}`]);
+        const chat = rev(H, tracking('refs/heads/chat')) ?? C.fail('remote chat is missing');
+        const endpoint = H.endpoint ?? C.fail('stream retry requires its room endpoint');
+        branchData(H, endpoint.name, chat, endpoint.genesis);
+        promote(H, 'refs/heads/chat', chat);
+    }
     const incoming = rev(H, track) ?? C.fail('remote room branch is missing');
-    const data = branchData(H, suffix(ref), sha);
-    branchData(H, suffix(ref), incoming, data.genesis);
+    validateRef(H, ref, sha);
+    validateRef(H, ref, incoming);
     if (acc && !ancestor(H, acc, incoming))
         C.fail('remote room was rewritten or rolled back; retry refused');
     return incoming;
 };
-const retryable = ({ H, sha, acc }, stdout) => {
+const retryable = ({ H, sha, acc, ref }, stdout) => {
     const parents = git(H, ['show', '-s', '--format=%P', sha]).trim().split(' ');
     const rejected = /\[rejected\].*\((?:fetch first|non-fast-forward)\)/.test(String(stdout));
-    return rejected && !!acc && parents.length === 1 && parents[0] === acc;
+    const base = acc ?? (streamName(ref) ? H.endpoint?.genesis : undefined);
+    return rejected && !!base && parents.length === 1 && parents[0] === base;
 };
 const retryRefs = ({ H, sha, ref, pin, acc, alarms }, incoming) => {
     git(H, ['update-ref', `refs/ringi/unpublished/${sha}`, sha]);
     git(H, ['update-ref', ref, incoming, sha]);
-    git(H, ['update-ref', pin, incoming, acc]);
+    git(H, ['update-ref', pin, incoming, acc ?? zero(H)]);
     delete alarms[ref];
     savePushAlarms(H, alarms);
     if (H.remoteAlarms)

package/target/esm/adapters/store-git/remote/push-validate.js

@@ -0,0 +1,19 @@
+// push-validate: a ref checked before it is published: main, a room's branch, or an actor's signal on a message of a
+// verified room.
+import * as C from '../../../lib/index.js';
+import { branchData } from './branch.js';
+import { verifyMain } from './main.js';
+import { streamRoom, validateStream } from './streams.js';
+export const validateRef = (H, ref, sha) => {
+    if (ref === 'refs/heads/main') {
+        verifyMain(H, sha);
+        return;
+    }
+    const e = H.endpoint ?? C.fail('publication requires an explicit room endpoint');
+    if (ref !== 'refs/heads/chat')
+        return validateStream(H, streamRoom(H), ref, sha);
+    const why = branchData(H, e.name, sha, e.genesis).skipped.get(sha);
+    if (why)
+        C.fail(`${sha.slice(0, 12)} is no valid commit of room ${e.name}: ${why}`);
+};
+//# sourceMappingURL=push-validate.js.map

package/target/esm/adapters/{transport-git → store-git}/remote/push.js

@@ -1,24 +1,20 @@
 // Publish one immutable ref. Room append retries preserve already returned message ids.
 import * as C from '../../../lib/index.js';
 import { pushAlarms, savePushAlarms } from './alarms.js';
-import { accepted, ancestor, git, isRemote, locked, object, origin, rev, suffix, tracking, zero } from './git.js';
-import { heartbeatName } from './heartbeat.js';
+import { accepted, ancestor, git, isRemote, locked, origin, rev, suffix, tracking, zero } from './git.js';
 import { checkUrl } from './keys.js';
 import { recoverPublication } from './push-retry.js';
 import { validateRef } from './push-validate.js';
-import { TAGS, TAG_ACCEPT, TAG_TRACK } from './types.js';
 export { validateRef } from './push-validate.js';
 const preparePublication = (H, ref) => {
-    const alarms = pushAlarms(H), tag = ref.startsWith(TAGS);
-    const pin = tag ? TAG_ACCEPT + ref.slice(TAGS.length) : accepted(ref);
-    const track = tag ? TAG_TRACK + ref.slice(TAGS.length) : tracking(ref);
-    const sha = (tag ? object(H, ref) : rev(H, ref)) || C.fail(`no ${ref} to publish`);
+    const alarms = pushAlarms(H), pin = accepted(ref), track = tracking(ref);
+    const sha = rev(H, ref) || C.fail(`no ${ref} to publish`);
     validateRef(H, ref, sha);
-    return { H, ref, alarms, tag, pin, track, sha };
+    return { H, ref, alarms, pin, track, sha };
 };
 const rejectPublication = (p, behind, stdout) => {
     let why = '';
-    if (behind && !p.tag && p.ref !== 'refs/heads/main') {
+    if ((behind || /\/(signals|telemetry)$/.test(p.ref)) && p.ref !== 'refs/heads/main') {
         try {
             const recovered = recoverPublication(p, stdout);
             if (recovered !== null)
@@ -38,23 +34,26 @@ const pushUnlocked = (H, ref, behind) => {
     if (!url)
         return true;
     checkUrl(url);
-    const { tag, pin, sha, track, alarms } = prepared;
-    const acc = tag ? object(H, pin) : rev(H, pin);
-    if (acc && (tag ? acc !== sha : !ancestor(H, acc, sha)))
+    const { pin, sha, track, alarms } = prepared;
+    const acc = rev(H, pin);
+    if (acc && !ancestor(H, acc, sha))
         C.fail('ref to publish does not extend its accepted transport history');
+    // Replaying a known tuple can retry its retained unpublished head. A healthy acknowledged head needs no push.
+    if (acc === sha && !alarms[ref] && !H.remoteAlarms?.[ref])
+        return true;
     const p = { ...prepared, acc, url };
     const r = git(H, ['push', '-q', '--porcelain', url, `${sha}:${ref}`], { ok: true });
     if (r.status !== 0)
         return rejectPublication(p, behind, r.stdout);
     delete alarms[ref];
     savePushAlarms(H, alarms);
+    if (H.remoteAlarms)
+        delete H.remoteAlarms[ref];
     git(H, ['update-ref', pin, sha, acc || zero(H)]);
     git(H, ['update-ref', track, sha]);
     return true;
 };
 export const push = (H, ref, { behind = false } = {}) => {
-    if (heartbeatName(ref))
-        C.fail('heartbeat publication requires its actor and expected object id (pushHeartbeat)');
     if (!isRemote(H))
         return true;
     return locked(H, () => pushUnlocked(H, ref, behind));

package/target/esm/adapters/store-git/remote/stream-check.js

@@ -0,0 +1,44 @@
+// One stream record: structure, dependencies and admitted signature. Null means a dependency is not fetched yet.
+import * as C from '../../../lib/index.js';
+import { ancestor, git, rev } from './git.js';
+import { streamFacts } from './stream-facts.js';
+import { streamAdmission } from './stream-control.js';
+const frame = ({ H, actor, parent }, c) => {
+    if (c.parents.length !== 1 || c.parents[0] !== parent)
+        C.fail('stream is not one linear continuation of its room genesis');
+    if (c.author !== actor || c.committer !== actor)
+        C.fail('stream author and committer must be its actor');
+    if (c.tree !== git(H, ['rev-parse', `${parent}^{tree}`]).trim())
+        C.fail('stream changes its parent tree');
+};
+const controlReady = ({ H, R, dep }, control) => {
+    if (dep.controls.has(control))
+        return true;
+    if (dep.messages.has(control) || dep.skipped.has(control))
+        C.fail('stream Control is not an accepted root control');
+    if (rev(H, control) && !ancestor(H, R.genesis, control))
+        C.fail('stream Control belongs to another history');
+    return false;
+};
+const targetReady = ({ H, R, dep, kind }, target) => {
+    if (dep.messages.has(target))
+        return true;
+    if (kind === 'telemetry' && dep.controls.has(target))
+        return true;
+    if (dep.controls.has(target) || dep.skipped.has(target))
+        C.fail('signal Target is not an accepted chat message');
+    if (rev(H, target) && !ancestor(H, R.genesis, target))
+        C.fail('stream Target belongs to another history');
+    return false;
+};
+export const checkStreamRecord = (ctx, c) => {
+    frame(ctx, c);
+    const f = streamFacts(c, ctx.kind), control = f.get('Control'), target = f.get('Target');
+    if (f.get('Room') !== ctx.R.genesis)
+        C.fail('stream names another room genesis');
+    if (!controlReady(ctx, control) || !targetReady(ctx, target))
+        return null;
+    streamAdmission(ctx.H, control, ctx.actor, c.sha);
+    return f;
+};
+//# sourceMappingURL=stream-check.js.map

package/target/esm/adapters/store-git/remote/stream-control.js

@@ -0,0 +1,33 @@
+// Stream authority is the verified chat control it names, not current membership or a server listing.
+import * as C from '../../../lib/index.js';
+import * as P from '../../../core/hub/protocol/index.js';
+import { branchData } from './branch.js';
+import { readCommits } from './commits.js';
+import { git, isRemote, rev } from './git.js';
+import { rosterAt, blobText } from './roster.js';
+import { checkSignature } from './signature.js';
+import { SHA } from './types.js';
+const control = (R, c) => c.sha === R.genesis || (c.author === 'operator' && P.parse(c.text, s => SHA.test(s)).kind === 'room');
+export const streamDependencies = (H, R) => {
+    const tip = rev(H, R.ref) ?? C.fail('room chat is missing');
+    if (isRemote(H)) {
+        const b = branchData(H, R.name, tip, R.genesis);
+        return { controls: new Set(b.control), messages: new Set(b.authors.keys()), skipped: new Set(b.skipped.keys()) };
+    }
+    const shas = git(H, ['rev-list', '--first-parent', '--reverse', tip, `^${R.genesis}^`]).trim().split('\n').filter(Boolean);
+    const list = readCommits(H, shas);
+    return { controls: new Set(list.filter(c => control(R, c)).map(c => c.sha)),
+        messages: new Set(list.filter(c => !control(R, c)).map(c => c.sha)), skipped: new Set() };
+};
+export const streamAdmission = (H, control, actor, sha) => {
+    if (isRemote(H)) {
+        const key = rosterAt(H, control).entries.find(e => e.principal === actor)?.key ?? C.fail(`${actor} is unadmitted at stream Control`);
+        checkSignature(H, sha, actor, key);
+    }
+    else {
+        const members = C.strictJson(blobText(H, control, 'members.json'), 'members.json');
+        if (!Object.hasOwn(members, actor))
+            C.fail(`${actor} is unadmitted at stream Control`);
+    }
+};
+//# sourceMappingURL=stream-control.js.map

package/target/esm/adapters/store-git/remote/stream-facts.js

@@ -0,0 +1,40 @@
+// Exact facts of signal and telemetry records: bounded UTF-8, unique fields and full causal revisions.
+import * as C from '../../../lib/index.js';
+import * as P from '../../../core/hub/protocol/index.js';
+import { heartbeatBody } from './heartbeat-facts.js';
+import { SHA } from './types.js';
+const fieldMap = (text) => {
+    const fields = new Map();
+    for (const line of text.trimEnd().split('\n')) {
+        const m = /^([A-Z][A-Za-z]*): (.+)$/.exec(line) ?? C.fail('stream record must contain only facts');
+        if (fields.has(m[1]))
+            C.fail(`duplicate stream fact ${m[1]}`);
+        fields.set(m[1], m[2]);
+    }
+    return fields;
+};
+const checkFields = (fields, kind) => {
+    const allowed = kind === 'signals' ? ['Room', 'Control', 'Target', 'Signal'] : ['Room', 'Control', 'Target', 'State', 'Waits', 'Alive', 'Quiet', 'Next'];
+    if ([...fields.keys()].some(k => !allowed.includes(k)))
+        C.fail('unknown stream fact');
+    for (const field of ['Room', 'Control', 'Target'])
+        if (!SHA.test(fields.get(field) ?? ''))
+            C.fail(`${field} must name a full revision`);
+};
+const checkSignal = (fields) => {
+    if (fields.size !== 4 || !/^[a-z][a-z0-9._-]*$/.test(fields.get('Signal') ?? ''))
+        C.fail('a signal has exactly Room, Control, Target and a logical Signal');
+};
+export const streamFacts = (c, kind) => {
+    const d = P.decodeText(c.body), limit = kind === 'signals' ? 4096 : 16384;
+    if (d.invalid || Buffer.byteLength(c.body) > limit)
+        C.fail('stream facts have invalid encoding or size');
+    const fields = fieldMap(d.text);
+    checkFields(fields, kind);
+    if (kind === 'signals')
+        checkSignal(fields);
+    else
+        heartbeatBody(d.text);
+    return fields;
+};
+//# sourceMappingURL=stream-facts.js.map

package/target/esm/adapters/store-git/remote/streams.js

@@ -0,0 +1,76 @@
+// Actor streams: immutable commit facts, room/control admission, and the verified prefix of a stream.
+import * as C from '../../../lib/index.js';
+import * as P from '../../../core/hub/protocol/index.js';
+import { readCommits } from './commits.js';
+import { ancestor, reason, rev } from './git.js';
+import { chain } from './signature.js';
+import { streamDependencies } from './stream-control.js';
+import { checkStreamRecord } from './stream-check.js';
+export const streamRoom = (H) => {
+    const e = H.endpoint ?? C.fail('actor stream requires a selected room endpoint');
+    const head = rev(H, 'refs/heads/chat') ?? C.fail('room chat is missing');
+    return { name: e.name, genesis: e.genesis, ref: 'refs/heads/chat', head };
+};
+export const streamName = (ref) => {
+    const m = /^refs\/heads\/([^/]+)\/(signals|telemetry)$/.exec(ref);
+    return m && P.ID_RE.test(m[1]) && !['main', 'chat'].includes(m[1]) ? { actor: m[1], kind: m[2] } : null;
+};
+export const streamRef = (actor, kind) => {
+    const ref = `refs/heads/${actor}/${kind}`;
+    if (!streamName(ref))
+        C.fail(`bad stream actor ${actor}`);
+    return ref;
+};
+const scanSuffix = ({ H, R, actor, kind, head, prefix }) => {
+    const result = { head: prefix?.head ?? R.genesis, records: [...prefix?.records ?? []] };
+    const dep = streamDependencies(H, R);
+    const list = chain(H, head, result.head);
+    for (const c of readCommits(H, list.map(c => c.sha))) {
+        try {
+            const f = checkStreamRecord({ H, R, actor, kind, parent: result.head, dep }, c);
+            if (!f) {
+                result.pending = c.sha;
+                break;
+            }
+            result.records.push({ raw: c, fields: f });
+            result.head = c.sha;
+        }
+        catch (e) {
+            result.why = `${c.sha.slice(0, 12)}: ${reason(e)}`;
+            break;
+        }
+    }
+    if (!list.length && head !== result.head)
+        result.why = 'stream does not descend from its room genesis';
+    return result;
+};
+// Valid facts are immutable. Reuse only a prefix whose chat and actor stream both still extend the last view.
+const scanned = new WeakMap();
+export const scanStream = ({ H, R, actor, kind, head, prefix }) => {
+    const key = JSON.stringify([R.genesis, actor, kind, H.d.genesis, H.d.root, H.d.trust]);
+    const chat = rev(H, R.ref) ?? C.fail('room chat is missing');
+    const cache = scanned.get(H) ?? new Map();
+    scanned.set(H, cache);
+    const old = cache.get(key);
+    if (!prefix && old?.seen === head && old.chat === chat)
+        return old.stream;
+    const base = prefix ?? (old && ancestor(H, old.chat, chat) && ancestor(H, old.stream.head, head) ? old.stream : undefined);
+    const result = scanSuffix({ H, R, actor, kind, head, prefix: base });
+    if (kind === 'telemetry')
+        result.records = result.records.slice(-1);
+    cache.set(key, { seen: head, chat, stream: result });
+    if (cache.size > 4096)
+        cache.delete(cache.keys().next().value);
+    return result;
+};
+export const signalEvents = (R, actor, s) => s.records.map(({ raw, fields }) => ({
+    id: raw.sha, parent: raw.parents[0], roomGenesis: R.genesis, control: fields.get('Control'), actor,
+    target: fields.get('Target'), signal: fields.get('Signal'),
+}));
+export const validateStream = (H, R, ref, head) => {
+    const name = streamName(ref) ?? C.fail('unknown actor stream');
+    const s = scanStream({ H, R, ...name, head });
+    if (s.why || s.head !== head)
+        C.fail(s.why ?? 'stream dependencies are not yet accepted');
+};
+//# sourceMappingURL=streams.js.map

package/target/esm/adapters/store-git/remote/sync-streams.js

@@ -0,0 +1,28 @@
+// Fetch-stage actor heads verified against the pinned chat; partial suffixes never replace evidence.
+import * as C from '../../../lib/index.js';
+import { accepted, ancestor, promote, reason, refs, rev, suffix } from './git.js';
+import { scanStream, streamName, streamRoom } from './streams.js';
+import { TRACK } from './types.js';
+const syncActor = (H, fetched, ref) => {
+    const name = streamName(ref), R = streamRoom(H);
+    try {
+        const head = fetched.get(TRACK + suffix(ref)) ?? C.fail('accepted actor stream was deleted');
+        const acc = rev(H, accepted(ref)), checked = scanStream({ H, R, ...name, head });
+        if (acc && !ancestor(H, acc, head))
+            C.fail('actor stream rewrites its accepted prefix');
+        if (checked.head !== R.genesis)
+            promote(H, ref, checked.head);
+        if (checked.why)
+            C.fail(checked.why);
+    }
+    catch (err) {
+        H.remoteAlarms[ref] = reason(err);
+    }
+};
+export const syncStreams = (H, fetched) => {
+    const names = [...fetched.keys(), ...refs(H, 'refs/ringi/remote-accepted/').keys()]
+        .map(r => r.replace(/^refs\/(?:remotes\/origin|ringi\/remote-accepted)\//, 'refs/heads/')).filter(r => streamName(r));
+    for (const ref of new Set(names))
+        syncActor(H, fetched, ref);
+};
+//# sourceMappingURL=sync-streams.js.map

package/target/esm/adapters/store-git/remote/sync.js

@@ -0,0 +1,59 @@
+// Fetch into staging refs; verify main, the pinned chat, and actor stream prefixes before promotion.
+import * as C from '../../../lib/index.js';
+import { pushAlarms } from './alarms.js';
+import { git, isRemote, locked, origin, promote, reason, refs, rev, suffix } from './git.js';
+import { checkUrl } from './keys.js';
+import { verifyHub, verifyMain } from './main.js';
+import { readCommits } from './commits.js';
+import { branchData } from './branch.js';
+import { syncStreams } from './sync-streams.js';
+import { TRACK } from './types.js';
+const syncChat = (H, fetched) => {
+    const e = H.endpoint;
+    if (!e)
+        return;
+    const ref = 'refs/heads/chat';
+    try {
+        const head = fetched.get(TRACK + 'chat') ?? C.fail('remote chat was deleted or is missing');
+        branchData(H, e.name, head, e.genesis);
+        promote(H, ref, head);
+    }
+    catch (err) {
+        H.remoteAlarms[ref] = reason(err);
+        return;
+    }
+    syncStreams(H, fetched);
+};
+const syncUnlocked = (H) => {
+    H.remoteAlarms = { ...pushAlarms(H) };
+    H.heartbeatErrors = {};
+    const url = origin(H);
+    if (!url) {
+        if (rev(H, 'refs/heads/main'))
+            verifyHub(H);
+        return H;
+    }
+    checkUrl(url);
+    git(H, ['-c', 'fetch.fsckObjects=true', 'fetch', '-q', '--no-tags', '--prune', url, `+refs/heads/*:${TRACK}*`]);
+    const fetched = refs(H, TRACK);
+    const main = fetched.get(TRACK + 'main') || C.fail('ALARM remote main was deleted or is missing; nothing is delivered');
+    try {
+        verifyMain(H, main);
+        if (H.endpoint) {
+            const genesis = readCommits(H, [H.endpoint.genesis])[0];
+            if (genesis.parents.length !== 1 || genesis.parents[0] !== main)
+                C.fail('the room main changed its frozen contract');
+        }
+        promote(H, 'refs/heads/main', main);
+    }
+    catch (err) {
+        C.fail(`ALARM hub ${H.name}: ${reason(err)}; nothing is delivered`);
+    }
+    H.main = rev(H, 'refs/heads/main');
+    syncChat(H, fetched);
+    for (const [ref, why] of Object.entries(H.remoteAlarms))
+        C.note(`ALARM ${suffix(ref)}: ${why}; quarantined and withheld`);
+    return H;
+};
+export const sync = (H) => !isRemote(H) ? H : locked(H, () => syncUnlocked(H));
+//# sourceMappingURL=sync.js.map

package/target/esm/adapters/{transport-git → store-git}/remote/types.js

@@ -4,7 +4,4 @@ export const SHA = /^(?:[0-9a-f]{40}|[0-9a-f]{64})$/;
 export const ROOT = 'operator';
 export const TRACK = 'refs/remotes/origin/';
 export const ACCEPT = 'refs/ringi/remote-accepted/';
-export const TAGS = 'refs/tags/';
-export const TAG_TRACK = 'refs/ringi/remote-tags/';
-export const TAG_ACCEPT = 'refs/ringi/remote-accepted-tags/';
 //# sourceMappingURL=types.js.map

package/target/esm/adapters/{transport-git → store-git}/remote.js

@@ -5,13 +5,10 @@ export { parseKey, setupSigned, rootRoster } from './remote/keys.js';
 export { verifyHub } from './remote/main.js';
 export { readCommits } from './remote/commits.js';
 export { branch, verifyRoom, verify } from './remote/branch.js';
-export { heartbeatName, heartbeatRef, verifyHeartbeat, makeHeartbeat } from './remote/heartbeat.js';
-export { verifySignal } from './remote/signals.js';
 export { sync } from './remote/sync.js';
-export { hubAdd } from './remote/bootstrap.js';
 export { join, roomAdmit } from './remote/admit.js';
 export { push } from './remote/push.js';
-export { pushHeartbeat } from './remote/heartbeat-push.js';
 export { forget } from './remote/forget.js';
 export { strictJson } from '../../lib/index.js';
+export { scanStream, streamName, streamRef, streamRoom, validateStream } from './remote/streams.js';
 //# sourceMappingURL=remote.js.map

package/target/esm/adapters/{transport-git → store-git}/repo.js

@@ -8,7 +8,10 @@ import { mkdirIn } from '../fs/index.js';
 import * as Remote from './remote.js';
 import { ZERO, ident, runGit, runGitOk } from './run.js';
 import { signCommit } from './signing.js';
-import { signingContext } from './remote/keys.js';
+import { checkUrl, signingContext } from './remote/keys.js';
+import { origin } from './remote/git.js';
+import { verifyMain } from './remote/main.js';
+import { chain, linear } from './remote/signature.js';
 // The store is a repository whose work tree holds the contract (`main`) as it is now, so Git clients (SourceTree, IDEs)
 // open `store/` without errors, on the contract, with every room's branch beside it; `git status` stays clean.
 export const init = (dir, home) => runGit(['init', '-q', '-b', 'main', path.dirname(dir)], { where: home });
@@ -19,14 +22,19 @@ export class Repo {
     home;
     // The handle remote.ts works on: the repository and what it learned on the last sync.
     h;
-    constructor(hubDir, d, home, signing) {
+    constructor(hubDir, d, home, signing, endpoint) {
         this.d = d;
         this.home = home;
         this.trust = d.trust;
-        this.dir = path.join(hubDir, d.store.path, '.git');
-        this.h = { name: d.name, dir: this.dir, d, ...(d.trust === 'signed' && signing ? { signing } : {}) };
+        if (endpoint?.authRef)
+            fail('this git transport has no TransportAuth binding provider for authRef');
+        this.dir = path.join(hubDir, endpoint?.store.path ?? d.contract?.path ?? fail(`hub ${d.name}: no explicit contract source`), '.git');
+        this.h = { name: d.name, dir: this.dir, d, endpoint, ...(d.trust === 'signed' && signing ? { signing } : {}) };
         if (this.trust === 'signed')
             signingContext(this.h);
+        const locator = origin(this.h);
+        if (locator)
+            checkUrl(locator);
         if (!fs.existsSync(this.dir))
             fail(`hub ${d.name}: no git store at ${this.dir}`);
         this.openable();
@@ -105,7 +113,37 @@ export class Repo {
         const r = this.gitOk(['show', `${rev}:${name}`]);
         return r.status === 0 ? r.stdout : null;
     }
+    // Copy only contract objects. A room never acquires another room's refs, evidence or attachments this way.
+    seedContract(source) {
+        if (this.rev('refs/heads/main'))
+            fail('contract seeding is only for a fresh room repository');
+        if (source.d.genesis !== this.d.genesis || source.trust !== this.trust || source.d.root !== this.d.root)
+            fail('contract source has different hub pins');
+        const ref = `refs/ringi/contract-incoming/${crypto.randomBytes(8).toString('hex')}`;
+        try {
+            this.git(['fetch', '-q', '--no-tags', '--no-write-fetch-head', source.dir, `refs/heads/main:${ref}`]);
+            const head = this.rev(ref) ?? fail('contract source has no main');
+            const commits = chain(this.h, head);
+            if (commits[0]?.sha !== this.d.genesis)
+                fail('contract source changed hub genesis');
+            linear(commits, null, () => { });
+            if (this.trust === 'signed')
+                verifyMain(this.h, head);
+            const old = this.rev('refs/heads/main');
+            if (old && !this.extends(old, head))
+                fail('contract source does not extend the room main; nothing is replaced');
+            if (old !== head && !this.advance('refs/heads/main', head, old))
+                fail('main moved while copying; retry');
+            this.checkout();
+            return head;
+        }
+        finally {
+            this.gitOk(['update-ref', '-d', ref]);
+        }
+    }
     amendContract(who, text, files) {
+        if (this.h.endpoint)
+            fail('a room contract is frozen; amend the operator contract source for new rooms');
         const head = this.contractHead();
         const sha = this.commit(who, text, this.tree(`${head}^{tree}`, Object.entries(files).map(([p, c]) => ({ path: p, content: c, mode: '100644' }))), [head]);
         if (!this.advance('refs/heads/main', sha, head))

package/target/esm/adapters/{transport-git → store-git}/signing.js

@@ -1,7 +1,7 @@
 // GitSigningBridge: Signer signs the exact unsigned Git object. Tags append its SSH armor; commits fold it into
 // gpgsig. All signing and public identity come from the injected Signer; custody stays outside the transport.
 import { fail } from '../../lib/index.js';
-import { git, id, ident, isRemote } from './remote/git.js';
+import { git, id, isRemote } from './remote/git.js';
 import { identityKey, parseKey, rootKey, signingContext } from './remote/keys.js';
 import { checkSignature } from './remote/signature.js';
 export const signBytes = (H, who, payload) => {
@@ -28,12 +28,4 @@ export const signCommit = (H, who, sha) => {
     checkSignature(H, signed, who, identityKey(H, who));
     return signed;
 };
-export const signedTag = (H, who, tag, target) => {
-    const tagger = git(H, ['var', 'GIT_COMMITTER_IDENT'], { env: ident(who) }).trim();
-    const raw = `object ${target}\ntype commit\ntag ${tag}\ntagger ${tagger}\n\n`;
-    const signed = git(H, ['mktag'], { input: raw + signBytes(H, who, raw) }).trim();
-    if (isRemote(H))
-        checkSignature(H, signed, who, identityKey(H, who), 'tag');
-    return signed;
-};
 //# sourceMappingURL=signing.js.map

package/target/esm/adapters/store-git/transport.js

@@ -0,0 +1,60 @@
+// transport: an explicit contract source and one self-contained repository per room.
+import fs from 'node:fs';
+import path from 'node:path';
+import crypto from 'node:crypto';
+import { fail } from '../../lib/index.js';
+import { GitStore } from './index.js';
+import { init } from './repo.js';
+const context = (d, opt) => d.trust === 'signed'
+    ? (typeof opt.signer === 'function' ? opt.signer() : opt.signer) ?? fail('signed hubs require an injected Signer')
+    : undefined;
+const gitStore = (s) => s instanceof GitStore ? s : fail('git contract copying requires a git source and target');
+const fresh = (at, endpoint, home) => {
+    const dir = path.join(at, endpoint.store.path, '.git');
+    if (fs.existsSync(at))
+        fail('room directory already exists; retained for review');
+    fs.mkdirSync(path.dirname(dir), { recursive: true, mode: 0o700 });
+    init(dir, home);
+};
+// All signing remains injected. Asserted construction never asks for a signer.
+export const gitTransport = (home, opt = {}) => ({
+    layout: 'git/3',
+    open: (at, d, endpoint) => new GitStore(at, d, home, context(d, opt), endpoint),
+    create: (at, d, genesis) => {
+        const signing = context(d, opt);
+        if (signing)
+            d.root = GitStore.rootFor(at, d, home, signing);
+        const g = genesis(d);
+        const store = GitStore.create(at, d, { home, signing }, g.files, g.text);
+        d.genesis = store.contractHead();
+        return { store, custody: signing?.custody?.(d.name, 'operator') ?? null };
+    },
+    fork: (at, d, source, endpoint) => {
+        const signing = context(d, opt);
+        fresh(at, endpoint, home);
+        const s = new GitStore(at, d, home, signing, endpoint);
+        s.seedContract(gitStore(source));
+        return s;
+    },
+    attachRoom: (at, d, endpoint) => attachRoom(at, d, endpoint, home, context(d, opt)),
+});
+const attachRoom = (at, d, endpoint, home, signing) => {
+    if (d.trust !== 'signed' || !endpoint.store.remote)
+        fail('remote room attachment requires signed trust and an explicit remote');
+    if (fs.existsSync(at))
+        fail('room directory already exists; retained for review');
+    const stage = `${at}.attach.${process.pid}.${crypto.randomBytes(8).toString('hex')}`;
+    try {
+        fresh(stage, endpoint, home);
+        const s = new GitStore(stage, d, home, signing, endpoint);
+        s.sync();
+        if (!s.room(endpoint.name))
+            fail('remote has no pinned chat');
+        fs.renameSync(stage, at);
+        return new GitStore(at, d, home, signing, endpoint);
+    }
+    finally {
+        fs.rmSync(stage, { recursive: true, force: true });
+    }
+};
+//# sourceMappingURL=transport.js.map

package/target/esm/clients/cli/agent/index.js

@@ -29,7 +29,7 @@ export const take = (a, o) => {
 };
 export const whoami = (a) => {
     const { session: s, profile, members } = Agent.whoami(a);
-    out(`${s.agent} in ${s.hub}/${s.room} (genesis ${short(s.genesis)}, profile ${profile}), session ${s.handle}, ${s.state}\nscope: ${scopeLine(s, a.R.quorum !== null)}\nmembers: ${members.join(', ')}`);
+    out(`${s.agent} in ${s.room} (genesis ${short(s.genesis)}, profile ${profile}), session ${s.handle}, ${s.state}\nscope: ${scopeLine(s, a.R.quorum !== null)}\nmembers: ${members.join(', ')}`);
 };
 export const wait = async (a, o) => {
     const r = await Agent.wait(a, { ...options(o), max: opt(o, 'max') === undefined ? undefined : Number(opt(o, 'max')) });