@inkandswitch/patchwork-bootloader 0.2.5 → 0.2.6

package/CHANGELOG.md

@@ -1,5 +1,13 @@
 # @inkandswitch/patchwork-bootloader
 
+## 0.2.6
+
+### Patch Changes
+
+- Updated dependencies [db46689]
+  - @inkandswitch/patchwork-providers@0.2.0
+  - @inkandswitch/patchwork-elements@1.0.0
+
 ## 0.2.5
 
 ### Patch Changes

package/dist/service-worker.js

@@ -16,7 +16,7 @@ import { resolvePath } from "@inkandswitch/patchwork-filesystem";
 // Small adapters — bundled directly into the SW
 import { IndexedDBStorageAdapter } from "@automerge/automerge-repo-storage-indexeddb";
 import { MessageChannelNetworkAdapter } from "@automerge/automerge-repo-network-messagechannel";
-import { WebSocketClientAdapter } from "@automerge/automerge-repo-network-websocket";
+import { initializeAutomergeRepoKeyhiveRust, initKeyhiveWasm, } from "@automerge/automerge-repo-keyhive";
 // TEMPORARY: enable debug npm module in SW context (no localStorage available)
 let cachename = "default";
 let debugging = false;
@@ -48,6 +48,7 @@ const slog = SwLogger.open().then((logger) => {
     logger.info("sw-logger initialized");
     return logger;
 });
+const siteName = typeof __SITE_NAME__ !== "undefined" ? __SITE_NAME__ : "tiny-patchwork";
 const cacheableStatuses = [200, 203, 204, 206];
 function log(...args) {
     if (!debugging)
@@ -69,10 +70,11 @@ self.addEventListener("activate", async () => {
     await clearOldCaches();
     clients.claim();
 });
-let repoPromise = null;
-function getRepo() {
-    if (!repoPromise) {
-        const p = (async () => {
+let repoHivePromise = null;
+const useKeyhive = typeof __KEYHIVE__ !== "undefined" && __KEYHIVE__;
+function getRepoHive() {
+    if (!repoHivePromise) {
+        repoHivePromise = (async () => {
             const logger = await slog;
             logger.info("getRepo: starting");
             logger.info("fetching wasm modules");
@@ -83,45 +85,106 @@ function getRepo() {
             initSubductionSync(new Uint8Array(sdnWasmBuf));
             await initializeWasm(new Uint8Array(amWasmBuf));
             logger.info("wasm initialized");
-            const signer = await WebCryptoSigner.setup();
+            if (!useKeyhive) {
+                const signer = await WebCryptoSigner.setup();
+                const repo = new Repo({
+                    storage: new IndexedDBStorageAdapter(),
+                    signer,
+                    peerId: ("service-worker-" +
+                        Math.random().toString(36).slice(2)),
+                    async sharePolicy(peerId) {
+                        return peerId.includes("storage-server");
+                    },
+                    enableRemoteHeadsGossiping: true,
+                    subductionWebsocketEndpoints: SUBDUCTION_ENDPOINTS,
+                });
+                self.repo = repo;
+                logger.info("repo constructed (no keyhive), waiting for network subsystem");
+                repo.networkSubsystem.whenReady().then(() => {
+                    logger.info("repo network subsystem ready");
+                });
+                return { repo };
+            }
+            initKeyhiveWasm();
+            const keyhiveStorage = new IndexedDBStorageAdapter(`${siteName}-keyhive`);
+            // Keyhive bootstrap needs to run before Repo creation but
+            // the adapter needs the subduction instance from the Repo.
+            // A deferred promise breaks the cycle.
+            let resolveRepoSubduction;
+            const repoSubductionPromise = new Promise((resolve) => {
+                resolveRepoSubduction = resolve;
+            });
+            // We use the Rust variant of Keyhive initialization to talk
+            // to the Rust keyhive-enabled subduction sync server.
+            const hive = await initializeAutomergeRepoKeyhiveRust({
+                storage: keyhiveStorage,
+                peerIdSuffix: `${siteName}-worker` + Math.random().toString(36).slice(2),
+                subduction: repoSubductionPromise,
+                automaticArchiveIngestion: true,
+                cachingMode: "periodic",
+            });
+            const signer = await hive.constructSubductionSigner();
             const repo = new Repo({
                 storage: new IndexedDBStorageAdapter(),
                 signer,
-                peerId: ("service-worker-" +
-                    (Math.random() * 10000).toString(36).slice(2)),
-                async sharePolicy(peerId) {
-                    return peerId.includes("storage-server");
-                },
-                enableRemoteHeadsGossiping: true,
                 subductionWebsocketEndpoints: SUBDUCTION_ENDPOINTS,
-                network: [new WebSocketClientAdapter("wss://sync3.automerge.org")],
+                peerId: hive.peerId,
+                enableRemoteHeadsGossiping: true,
+                idFactory: hive.idFactory,
+                //network: [new WebSocketClientAdapter("wss://sync3.automerge.org")],
             });
+            repo.subduction.then(resolveRepoSubduction);
+            hive.linkRepo(repo);
             self.repo = repo;
+            self.hive = hive;
             logger.info("repo constructed, waiting for network subsystem");
-            // Don't block getRepo() on whenReady() — the network subsystem starts
+            // Don't block getRepoHive() on whenReady() — the network subsystem starts
             // with only the subduction adapter, and the MessageChannel adapter is
-            // added later via connectPort (which awaits getRepo). Blocking here
+            // added later via connectPort (which awaits getRepoHive). Blocking here
             // would deadlock that path and starve the fetch handler.
             repo.networkSubsystem.whenReady().then(() => {
                 logger.info("repo network subsystem ready");
             });
-            return repo;
+            hive.networkAdapter.whenReady().then(() => {
+                hive.networkAdapter.syncKeyhive();
+            });
+            return { hive, repo };
         })();
         // If construction fails (e.g. wasm fetch errors out because the SW was
         // terminated mid-flight), don't permanently cache the rejection — clear
         // the slot so the next caller can retry from scratch.
-        p.catch(() => {
-            if (repoPromise === p)
-                repoPromise = null;
+        repoHivePromise.catch(() => {
+            repoHivePromise = null;
         });
-        repoPromise = p;
     }
-    return repoPromise;
+    return repoHivePromise;
 }
 // Connect client MessagePorts to the repo for sync
 async function connectPort(port) {
-    const repo = await getRepo();
-    repo.networkSubsystem.addNetworkAdapter(new MessageChannelNetworkAdapter(port, { useWeakRef: true }));
+    const { hive, repo } = await getRepoHive();
+    const networkAdapter = new MessageChannelNetworkAdapter(port, { useWeakRef: true });
+    if (!hive) {
+        repo.networkSubsystem.addNetworkAdapter(networkAdapter);
+        return;
+    }
+    const onlyShareWithHardcodedServerPeerId = false;
+    const periodicallyRequestKeyhiveSync = false;
+    const keyhiveNetworkAdapter = hive.createKeyhiveNetworkAdapter(networkAdapter, onlyShareWithHardcodedServerPeerId, periodicallyRequestKeyhiveSync, 2000);
+    keyhiveNetworkAdapter.on("message", async (msg) => {
+        if ((msg.type === "sync" || msg.type === "request") && msg.documentId) {
+            const handle = repo.handles[msg.documentId];
+            if (!handle || handle.state === "unavailable") {
+                const url = `automerge:${msg.documentId}`;
+                repo.findWithProgress(url);
+                repo.shareConfigChanged();
+            }
+        }
+    });
+    keyhiveNetworkAdapter.on("ingest-remote", () => {
+        hive.networkAdapter.syncKeyhive?.();
+        repo.shareConfigChanged();
+    });
+    repo.networkSubsystem.addNetworkAdapter(keyhiveNetworkAdapter);
 }
 self.addEventListener("message", async (event) => {
     if (event.data.type == "ping") {
@@ -178,7 +241,7 @@ self.addEventListener("message", async (event) => {
 });
 // ── Automerge URL resolution ───────────────────────────────────────────
 async function resolveAutomergeUrl(automergeURL) {
-    const repo = await getRepo();
+    const { repo } = await getRepoHive();
     const href = automergeURL.href;
     const [maybeAutomergeUrl, ...path] = href.split("/");
     if (!isValidAutomergeUrl(maybeAutomergeUrl)) {
@@ -286,7 +349,11 @@ self.addEventListener("fetch", (fetchEvent) => {
             const message = error instanceof Error
                 ? `${error.message}\n\n${error.stack}`
                 : String(error);
-            console.error(`service worker error resolving ${request.url}${specialURL ? ` (for: ${specialURL})` : ""}.\n${message}`);
+            const logger = await slog;
+            logger.error(`service worker error resolving ${request.url}${specialURL ? ` (for: ${specialURL})` : ""}`, {
+                message: error instanceof Error ? error.message : String(error),
+                stack: error instanceof Error ? error.stack : undefined,
+            });
             if (match)
                 return match;
             return new Response(message, {

package/dist/site.d.ts

@@ -12,6 +12,7 @@
  * only does SW registration and port handoff).
  */
 import { type DocHandle, Repo, type AutomergeUrl, type StorageId } from "@automerge/vanillajs/slim";
+import { type AutomergeRepoKeyhive } from "@automerge/automerge-repo-keyhive";
 import { ModuleWatcher } from "@inkandswitch/patchwork-filesystem";
 import { type AccountDoc } from "@inkandswitch/patchwork-plugins";
 import * as plugins from "@inkandswitch/patchwork-plugins";
@@ -23,6 +24,8 @@ declare global {
         Automerge: typeof import("@automerge/automerge");
         AutomergeRepo: typeof import("@automerge/automerge-repo");
         repo: Repo;
+        hive?: AutomergeRepoKeyhive;
+        getRepoChannel: () => MessagePort;
         patchwork: {
             repo: Repo;
             packages: ModuleWatcher;
@@ -72,6 +75,12 @@ export interface SiteConfig {
      * Ink & Switch's production Subduction storage.
      */
     remoteStorageIds?: StorageId[];
+    /**
+     * When true, initialize keyhive for access control.
+     * The Repo will use keyhive's network adapter, peerId, and idFactory
+     * instead of a sharePolicy.
+     */
+    keyhive?: boolean;
 }
 export interface BootResult {
     repo: Repo;

package/dist/site.js

@@ -14,12 +14,14 @@
 import { IndexedDBStorageAdapter, initializeWasm, isValidAutomergeUrl, isValidDocumentId, MessageChannelNetworkAdapter, parseAutomergeUrl, Repo, stringifyAutomergeUrl, } from "@automerge/vanillajs/slim";
 import * as Automerge from "@automerge/automerge/slim";
 import * as AutomergeRepo from "@automerge/automerge-repo/slim";
+import { initKeyhiveWasm, initializeAutomergeRepoKeyhive, } from "@automerge/automerge-repo-keyhive";
 // eslint-disable-next-line
 // @ts-ignore — initSync is a wasm-bindgen runtime helper not in the .d.ts
 import { initSync as initSubductionSync } from "@automerge/automerge-subduction/slim";
+const siteName = typeof __SITE_NAME__ !== "undefined" ? __SITE_NAME__ : "tiny-patchwork";
 import { ModuleWatcher } from "@inkandswitch/patchwork-filesystem";
 import { openDocument, registerPatchworkViewElement, } from "@inkandswitch/patchwork-elements";
-import { registerFallbackProviderElement, registerRepoProviderElement, } from "@inkandswitch/patchwork-providers";
+import { registerRepoProviderElement } from "@inkandswitch/patchwork-providers";
 import { getRegistry, registerPlugins, resolveAccountHandle, unregisterPlugins, } from "@inkandswitch/patchwork-plugins";
 import * as plugins from "@inkandswitch/patchwork-plugins";
 import setupServiceWorker from "./setup.js";
@@ -48,43 +50,71 @@ export async function bootPatchworkSite(config) {
     log(`booting`, config);
     await initializeWasm(automergeWasm);
     initSubductionSync(subductionWasm);
-    const repo = new Repo({
-        storage: new IndexedDBStorageAdapter(),
-        async sharePolicy(peerId) {
-            return peerId.includes("service-worker");
-        },
-        enableRemoteHeadsGossiping: true,
-        peerId: `${config.titleSuffix}-tab-${crypto.randomUUID()}`,
-    });
-    repo.subscribeToRemotes(config.remoteStorageIds ?? [DEFAULT_REMOTE_STORAGE_ID]);
     const sw = await setupServiceWorker();
     if (!sw)
         throw new Error("Failed to set up service worker");
-    let activeServiceWorkerPort;
-    const connectServiceWorkerPort = async (port) => {
-        const previousPort = activeServiceWorkerPort;
-        activeServiceWorkerPort = port;
-        const net = new MessageChannelNetworkAdapter(port);
-        repo.networkSubsystem.addNetworkAdapter(net);
-        await net.whenReady();
-        previousPort?.close();
-    };
-    await sw.subscribeToRepoChannel(connectServiceWorkerPort);
-    installDevConsoleGlobals(repo);
+    let hive;
+    if (config.keyhive) {
+        initKeyhiveWasm();
+        // Get the initial SW port via subscribeToRepoChannel, then pass it
+        // to keyhive init which wraps it in its own network adapter.
+        let resolvePort;
+        const portPromise = new Promise((r) => { resolvePort = r; });
+        sw.subscribeToRepoChannel((port) => { resolvePort(port); });
+        const swPort = await portPromise;
+        hive = await initializeAutomergeRepoKeyhive({
+            storage: new IndexedDBStorageAdapter(`${siteName}-keyhive`),
+            peerIdSuffix: siteName +
+                Math.random().toString(36).slice(2),
+            networkAdapter: new MessageChannelNetworkAdapter(swPort),
+            automaticArchiveIngestion: true,
+            cachingMode: "periodic",
+            onlyShareWithHardcodedServerPeerId: false,
+        });
+    }
+    const repo = hive
+        ? new Repo({
+            storage: new IndexedDBStorageAdapter(),
+            enableRemoteHeadsGossiping: true,
+            network: [hive.networkAdapter],
+            peerId: hive.peerId,
+            idFactory: hive.idFactory,
+        })
+        : new Repo({
+            storage: new IndexedDBStorageAdapter(),
+            async sharePolicy(peerId) {
+                return peerId.includes("service-worker");
+            },
+            enableRemoteHeadsGossiping: true,
+            peerId: `${config.titleSuffix}-tab-${crypto.randomUUID()}`,
+        });
+    repo.subscribeToRemotes(config.remoteStorageIds ?? [DEFAULT_REMOTE_STORAGE_ID]);
+    if (hive) {
+        await repo.networkSubsystem.whenReady();
+        hive.networkAdapter.syncKeyhive?.();
+    }
+    else {
+        let activeServiceWorkerPort;
+        const connectServiceWorkerPort = async (port) => {
+            const previousPort = activeServiceWorkerPort;
+            activeServiceWorkerPort = port;
+            const net = new MessageChannelNetworkAdapter(port);
+            repo.networkSubsystem.addNetworkAdapter(net);
+            await net.whenReady();
+            previousPort?.close();
+        };
+        await sw.subscribeToRepoChannel(connectServiceWorkerPort);
+    }
+    installDevConsoleGlobals(repo, hive);
     registerRepoProviderElement(repo);
-    registerFallbackProviderElement();
     const rootElement = document.getElementById(config.rootElementId ?? "root");
     if (!rootElement) {
         throw new Error(`bootPatchworkSite: no element with id="${config.rootElementId ?? "root"}"`);
     }
     const repoProvider = document.createElement("repo-provider");
-    const fallbackProvider = document.createElement("fallback-provider");
-    rootElement.parentElement.insertBefore(fallbackProvider, rootElement);
-    fallbackProvider.appendChild(repoProvider);
+    rootElement.parentElement.insertBefore(repoProvider, rootElement);
     repoProvider.appendChild(rootElement);
-    // Registers `<patchwork-view>` and the `<patchwork-view-legacy>` it
-    // delegates to in one go.
-    registerPatchworkViewElement();
+    registerPatchworkViewElement(hive ? { hive } : {});
     // The watcher is started with the site's default-tools bundle alone so that
     // `resolveAccountHandle` below has something to await on (the `account`
     // datatype lives in that bundle today). The user's own module-settings URL
@@ -92,6 +122,7 @@ export async function bootPatchworkSite(config) {
     const moduleWatcher = new ModuleWatcher(repo, { system: defaultModulesUrl }, onModuleLoaded, unregisterPlugins);
     const accountDocHandle = await resolveAccountHandle(repo, {
         storageKey: config.accountStorageKey,
+        hive,
     });
     window.accountDocHandle = accountDocHandle;
     wireModuleSettingsWhenReady(accountDocHandle, moduleWatcher);
@@ -131,10 +162,18 @@ function resolveDefaultModulesUrl(builtin) {
     console.warn(`ignoring invalid defaultToolsUrl in localStorage: ${override}; using built-in default`);
     return builtin;
 }
-function installDevConsoleGlobals(repo) {
+function installDevConsoleGlobals(repo, hive) {
     window.repo = repo;
     window.Automerge = Automerge;
     window.AutomergeRepo = AutomergeRepo;
+    if (hive) {
+        window.hive = hive;
+    }
+    window.getRepoChannel = () => {
+        const { port1, port2 } = new MessageChannel();
+        navigator.serviceWorker.controller.postMessage({ type: "port" }, [port2]);
+        return port1;
+    };
 }
 function onModuleLoaded(name, mod) {
     if (Array.isArray(mod.plugins)) {

package/dist/vite/importmap-plugin.js

@@ -30,12 +30,18 @@ export function importmap(options) {
                     preserveSignature: "strict",
                 });
             }
-            // Emit automerge wasm so the service worker can fetch it
-            const wasmPath = require.resolve("@automerge/automerge/automerge.wasm");
+            // Emit automerge, keyhive, and subduction wasm so the service worker can fetch them
+            const automergeWasmPath = require.resolve("@automerge/automerge/automerge.wasm");
             this.emitFile({
                 type: "asset",
                 fileName: "automerge.wasm",
-                source: readFileSync(wasmPath),
+                source: readFileSync(automergeWasmPath),
+            });
+            const keyhiveWasmPath = require.resolve("@keyhive/keyhive/keyhive_wasm.wasm");
+            this.emitFile({
+                type: "asset",
+                fileName: "keyhive_wasm.wasm",
+                source: readFileSync(keyhiveWasmPath),
             });
             // Emit subduction wasm so the service worker can fetch it
             const subdWasmPath = require.resolve("@automerge/automerge-subduction/wasm");

package/package.json

@@ -1,11 +1,11 @@
 {
   "name": "@inkandswitch/patchwork-bootloader",
-  "version": "0.2.5",
+  "version": "0.2.6",
   "author": "chee",
   "type": "module",
   "license": "MIT",
   "devDependencies": {
-    "@automerge/automerge-repo-keyhive": "0.2.0-alpha.1d",
+    "@automerge/automerge-repo-keyhive": "0.3.0-alpha.sub.1",
     "esbuild": "^0.23.1",
     "rollup": "^4.53.3"
   },
@@ -42,25 +42,26 @@
   "dependencies": {
     "@automerge/automerge": "3.3.0-fragments.1",
     "@automerge/automerge-repo": "2.6.0-subduction.23",
-    "@automerge/automerge-subduction": "0.12.1",
+    "@automerge/automerge-subduction": "0.13.0",
     "@automerge/automerge-repo-network-messagechannel": "2.6.0-subduction.23",
     "@automerge/automerge-repo-network-websocket": "2.6.0-subduction.23",
     "@automerge/automerge-repo-storage-indexeddb": "2.6.0-subduction.23",
     "@automerge/vanillajs": "2.6.0-subduction.23",
+    "@keyhive/keyhive": "0.0.0-alpha.56",
     "@types/debug": "^4.1.12",
     "debug": "^4.4.3",
     "resolve.exports": "^2.0.3",
     "service-worker-types": "npm:@types/serviceworker@^0.0.153",
     "tinyargs": "^0.1.4",
-    "@inkandswitch/patchwork-elements": "^0.2.0",
+    "@inkandswitch/patchwork-elements": "^1.0.0",
     "@inkandswitch/patchwork-filesystem": "^0.0.8",
     "@inkandswitch/patchwork-plugins": "^0.0.11",
-    "@inkandswitch/patchwork-providers": "^0.1.2"
+    "@inkandswitch/patchwork-providers": "^0.2.0"
   },
   "peerDependencies": {
     "@automerge/automerge": "3.3.0-fragments.1",
     "@automerge/automerge-repo": "2.6.0-subduction.23",
-    "@automerge/automerge-repo-keyhive": "0.2.0-alpha.1d",
+    "@automerge/automerge-repo-keyhive": "0.3.0-alpha.sub.1",
     "@automerge/vanillajs": "2.6.0-subduction.23"
   },
   "scripts": {

package/src/service-worker.ts

@@ -19,7 +19,7 @@ import {
   isValidAutomergeUrl,
   parseAutomergeUrl,
   stringifyAutomergeUrl,
-  type PeerId,
+  type AutomergeUrl,
 } from "@automerge/automerge-repo/slim";
 import { resolvePath } from "@inkandswitch/patchwork-filesystem";
 
@@ -27,8 +27,17 @@ import { resolvePath } from "@inkandswitch/patchwork-filesystem";
 import { IndexedDBStorageAdapter } from "@automerge/automerge-repo-storage-indexeddb";
 import { MessageChannelNetworkAdapter } from "@automerge/automerge-repo-network-messagechannel";
 import { WebSocketClientAdapter } from "@automerge/automerge-repo-network-websocket";
+import {
+  initializeAutomergeRepoKeyhiveRust,
+  initKeyhiveWasm,
+  type AutomergeRepoKeyhiveRust,
+} from "@automerge/automerge-repo-keyhive";
+
+declare const __SITE_NAME__: string;
+declare const __KEYHIVE__: boolean;
 
 // TEMPORARY: enable debug npm module in SW context (no localStorage available)
+
 let cachename = "default";
 let debugging = false;
 const workerInstanceId = crypto.randomUUID();
@@ -64,6 +73,8 @@ const slog = SwLogger.open().then((logger) => {
   return logger;
 });
 
+const siteName = typeof __SITE_NAME__ !== "undefined" ? __SITE_NAME__ : "tiny-patchwork";
+
 const cacheableStatuses = [200, 203, 204, 206];
 
 function log(...args: any[]) {
@@ -95,11 +106,16 @@ self.addEventListener("activate", async () => {
   clients.claim();
 });
 
-let repoPromise: Promise<Repo> | null = null;
+let repoHivePromise: Promise<{
+  repo: Repo;
+  hive?: AutomergeRepoKeyhiveRust;
+}> | null = null;
+
+const useKeyhive = typeof __KEYHIVE__ !== "undefined" && __KEYHIVE__;
 
-function getRepo() {
-  if (!repoPromise) {
-    const p: Promise<Repo> = (async () => {
+function getRepoHive() {
+  if (!repoHivePromise) {
+    repoHivePromise = (async () => {
       const logger = await slog;
       logger.info("getRepo: starting");
 
@@ -112,51 +128,130 @@ function getRepo() {
       await initializeWasm(new Uint8Array(amWasmBuf));
       logger.info("wasm initialized");
 
-      const signer = await WebCryptoSigner.setup();
+      if (!useKeyhive) {
+        const signer = await WebCryptoSigner.setup();
+
+        const repo = new Repo({
+          storage: new IndexedDBStorageAdapter(),
+          signer,
+          peerId: ("service-worker-" +
+            Math.random().toString(36).slice(2)) as import("@automerge/automerge-repo/slim").PeerId,
+          async sharePolicy(peerId) {
+            return peerId.includes("storage-server");
+          },
+          enableRemoteHeadsGossiping: true,
+          subductionWebsocketEndpoints: SUBDUCTION_ENDPOINTS,
+        });
+
+        (self as any).repo = repo;
+        logger.info("repo constructed (no keyhive), waiting for network subsystem");
+
+        repo.networkSubsystem.whenReady().then(() => {
+          logger.info("repo network subsystem ready");
+        });
+
+        return { repo };
+      }
+
+      initKeyhiveWasm();
+      const keyhiveStorage = new IndexedDBStorageAdapter(
+        `${siteName}-keyhive`
+      );
+
+      // Keyhive bootstrap needs to run before Repo creation but
+      // the adapter needs the subduction instance from the Repo.
+      // A deferred promise breaks the cycle.
+      let resolveRepoSubduction!: (s: any) => void;
+      const repoSubductionPromise = new Promise((resolve) => {
+        resolveRepoSubduction = resolve;
+      });
+
+      // We use the Rust variant of Keyhive initialization to talk
+      // to the Rust keyhive-enabled subduction sync server.
+      const hive = await initializeAutomergeRepoKeyhiveRust({
+        storage: keyhiveStorage,
+        peerIdSuffix:
+          `${siteName}-worker` + Math.random().toString(36).slice(2),
+        subduction: repoSubductionPromise as any,
+        automaticArchiveIngestion: true,
+        cachingMode: "periodic",
+      });
+
+      const signer = await hive.constructSubductionSigner();
 
       const repo = new Repo({
         storage: new IndexedDBStorageAdapter(),
         signer,
-        peerId: ("service-worker-" +
-          (Math.random() * 10000).toString(36).slice(2)) as PeerId,
-        async sharePolicy(peerId) {
-          return peerId.includes("storage-server");
-        },
-        enableRemoteHeadsGossiping: true,
         subductionWebsocketEndpoints: SUBDUCTION_ENDPOINTS,
-        network: [new WebSocketClientAdapter("wss://sync3.automerge.org")],
+        peerId: hive.peerId,
+        enableRemoteHeadsGossiping: true,
+        idFactory: hive.idFactory,
+        //network: [new WebSocketClientAdapter("wss://sync3.automerge.org")],
       });
 
+      repo.subduction.then(resolveRepoSubduction);
+
+      hive.linkRepo(repo);
+
       (self as any).repo = repo;
+      (self as any).hive = hive;
       logger.info("repo constructed, waiting for network subsystem");
 
-      // Don't block getRepo() on whenReady() — the network subsystem starts
+      // Don't block getRepoHive() on whenReady() — the network subsystem starts
       // with only the subduction adapter, and the MessageChannel adapter is
-      // added later via connectPort (which awaits getRepo). Blocking here
+      // added later via connectPort (which awaits getRepoHive). Blocking here
       // would deadlock that path and starve the fetch handler.
       repo.networkSubsystem.whenReady().then(() => {
         logger.info("repo network subsystem ready");
       });
 
-      return repo;
+      hive.networkAdapter.whenReady().then(() => {
+        (hive.networkAdapter as any).syncKeyhive();
+      });
+
+      return { hive, repo };
     })();
     // If construction fails (e.g. wasm fetch errors out because the SW was
     // terminated mid-flight), don't permanently cache the rejection — clear
     // the slot so the next caller can retry from scratch.
-    p.catch(() => {
-      if (repoPromise === p) repoPromise = null;
+    repoHivePromise.catch(() => {
+      repoHivePromise = null;
     });
-    repoPromise = p;
   }
-  return repoPromise;
+  return repoHivePromise;
 }
 
 // Connect client MessagePorts to the repo for sync
 async function connectPort(port: MessagePort) {
-  const repo = await getRepo();
-  repo.networkSubsystem.addNetworkAdapter(
-    new MessageChannelNetworkAdapter(port, { useWeakRef: true })
-  );
+  const { hive, repo } = await getRepoHive();
+  const networkAdapter = new MessageChannelNetworkAdapter(port, { useWeakRef: true });
+
+  if (!hive) {
+    repo.networkSubsystem.addNetworkAdapter(networkAdapter);
+    return;
+  }
+
+  const onlyShareWithHardcodedServerPeerId = false;
+  const periodicallyRequestKeyhiveSync = false;
+  const keyhiveNetworkAdapter = hive.createKeyhiveNetworkAdapter(networkAdapter, onlyShareWithHardcodedServerPeerId, periodicallyRequestKeyhiveSync, 2000);
+
+  keyhiveNetworkAdapter.on("message", async (msg: any) => {
+    if ((msg.type === "sync" || msg.type === "request") && msg.documentId) {
+      const handle = repo.handles[msg.documentId];
+      if (!handle || handle.state === "unavailable") {
+        const url = `automerge:${msg.documentId}` as AutomergeUrl;
+        repo.findWithProgress(url);
+        repo.shareConfigChanged();
+      }
+    }
+  });
+
+  (keyhiveNetworkAdapter as any).on("ingest-remote", () => {
+    (hive.networkAdapter as any).syncKeyhive?.();
+    repo.shareConfigChanged();
+  });
+
+  repo.networkSubsystem.addNetworkAdapter(keyhiveNetworkAdapter);
 }
 
 self.addEventListener("message", async (event) => {
@@ -219,7 +314,7 @@ self.addEventListener("message", async (event) => {
 // ── Automerge URL resolution ───────────────────────────────────────────
 
 async function resolveAutomergeUrl(automergeURL: URL): Promise<Response> {
-  const repo = await getRepo();
+  const { repo } = await getRepoHive();
   const href = automergeURL.href;
   const [maybeAutomergeUrl, ...path] = href.split("/");
 
@@ -362,8 +457,13 @@ self.addEventListener("fetch", (fetchEvent: FetchEvent) => {
           error instanceof Error
             ? `${error.message}\n\n${error.stack}`
             : String(error);
-        console.error(
-          `service worker error resolving ${request.url}${specialURL ? ` (for: ${specialURL})` : ""}.\n${message}`
+        const logger = await slog;
+        logger.error(
+          `service worker error resolving ${request.url}${specialURL ? ` (for: ${specialURL})` : ""}`,
+          {
+            message: error instanceof Error ? error.message : String(error),
+            stack: error instanceof Error ? error.stack : undefined,
+          }
         );
         if (match) return match;
 

package/src/site.ts

@@ -28,19 +28,25 @@ import {
 } from "@automerge/vanillajs/slim";
 import * as Automerge from "@automerge/automerge/slim";
 import * as AutomergeRepo from "@automerge/automerge-repo/slim";
+import {
+  initKeyhiveWasm,
+  initializeAutomergeRepoKeyhive,
+  type AutomergeRepoKeyhive,
+} from "@automerge/automerge-repo-keyhive";
 // eslint-disable-next-line
 // @ts-ignore — initSync is a wasm-bindgen runtime helper not in the .d.ts
 import { initSync as initSubductionSync } from "@automerge/automerge-subduction/slim";
 
+declare const __SITE_NAME__: string;
+const siteName =
+  typeof __SITE_NAME__ !== "undefined" ? __SITE_NAME__ : "tiny-patchwork";
+
 import { ModuleWatcher } from "@inkandswitch/patchwork-filesystem";
 import {
   openDocument,
   registerPatchworkViewElement,
 } from "@inkandswitch/patchwork-elements";
-import {
-  registerFallbackProviderElement,
-  registerRepoProviderElement,
-} from "@inkandswitch/patchwork-providers";
+import { registerRepoProviderElement } from "@inkandswitch/patchwork-providers";
 import {
   type AccountDoc,
   type DatatypeDescription,
@@ -64,6 +70,8 @@ declare global {
     Automerge: typeof import("@automerge/automerge");
     AutomergeRepo: typeof import("@automerge/automerge-repo");
     repo: Repo;
+    hive?: AutomergeRepoKeyhive;
+    getRepoChannel: () => MessagePort;
     patchwork: {
       repo: Repo;
       packages: ModuleWatcher;
@@ -120,6 +128,13 @@ export interface SiteConfig {
    * Ink & Switch's production Subduction storage.
    */
   remoteStorageIds?: StorageId[];
+
+  /**
+   * When true, initialize keyhive for access control.
+   * The Repo will use keyhive's network adapter, peerId, and idFactory
+   * instead of a sharePolicy.
+   */
+  keyhive?: boolean;
 }
 
 export interface BootResult {
@@ -158,37 +173,74 @@ export async function bootPatchworkSite(
   await initializeWasm(automergeWasm);
   initSubductionSync(subductionWasm);
 
-  const repo = new Repo({
-    storage: new IndexedDBStorageAdapter(),
-    async sharePolicy(peerId) {
-      return peerId.includes("service-worker");
-    },
-    enableRemoteHeadsGossiping: true,
-    peerId:
-      `${config.titleSuffix}-tab-${crypto.randomUUID()}` as AutomergeRepo.PeerId,
-  });
+  const sw = await setupServiceWorker();
+  if (!sw) throw new Error("Failed to set up service worker");
+
+  let hive: AutomergeRepoKeyhive | undefined;
+  if (config.keyhive) {
+    initKeyhiveWasm();
+
+    // Get the initial SW port via subscribeToRepoChannel, then pass it
+    // to keyhive init which wraps it in its own network adapter.
+    let resolvePort!: (port: MessagePort) => void;
+    const portPromise = new Promise<MessagePort>((r) => { resolvePort = r; });
+    sw.subscribeToRepoChannel((port) => { resolvePort(port); });
+    const swPort = await portPromise;
+
+    hive = await initializeAutomergeRepoKeyhive({
+      storage: new IndexedDBStorageAdapter(
+        `${siteName}-keyhive`
+      ),
+      peerIdSuffix:
+        siteName +
+        Math.random().toString(36).slice(2),
+      networkAdapter: new MessageChannelNetworkAdapter(swPort),
+      automaticArchiveIngestion: true,
+      cachingMode: "periodic",
+      onlyShareWithHardcodedServerPeerId: false,
+    });
+  }
 
+  const repo = hive
+    ? new Repo({
+        storage: new IndexedDBStorageAdapter(),
+        enableRemoteHeadsGossiping: true,
+        network: [hive.networkAdapter],
+        peerId: hive.peerId,
+        idFactory: hive.idFactory,
+      })
+    : new Repo({
+        storage: new IndexedDBStorageAdapter(),
+        async sharePolicy(peerId) {
+          return peerId.includes("service-worker");
+        },
+        enableRemoteHeadsGossiping: true,
+        peerId:
+          `${config.titleSuffix}-tab-${crypto.randomUUID()}` as AutomergeRepo.PeerId,
+      });
   repo.subscribeToRemotes(
     config.remoteStorageIds ?? [DEFAULT_REMOTE_STORAGE_ID]
   );
 
-  const sw = await setupServiceWorker();
-  if (!sw) throw new Error("Failed to set up service worker");
-  let activeServiceWorkerPort: MessagePort | undefined;
-  const connectServiceWorkerPort = async (port: MessagePort) => {
-    const previousPort = activeServiceWorkerPort;
-    activeServiceWorkerPort = port;
-    const net = new MessageChannelNetworkAdapter(port);
-    repo.networkSubsystem.addNetworkAdapter(net);
-    await net.whenReady();
-    previousPort?.close();
-  };
-  await sw.subscribeToRepoChannel(connectServiceWorkerPort);
+  if (hive) {
+    await repo.networkSubsystem.whenReady();
+    (hive.networkAdapter as any).syncKeyhive?.();
+  } else {
+    let activeServiceWorkerPort: MessagePort | undefined;
+    const connectServiceWorkerPort = async (port: MessagePort) => {
+      const previousPort = activeServiceWorkerPort;
+      activeServiceWorkerPort = port;
+      const net = new MessageChannelNetworkAdapter(port);
+      repo.networkSubsystem.addNetworkAdapter(net);
+      await net.whenReady();
+      previousPort?.close();
+    };
+    await sw.subscribeToRepoChannel(connectServiceWorkerPort);
+  }
 
-  installDevConsoleGlobals(repo);
+  installDevConsoleGlobals(repo, hive);
 
   registerRepoProviderElement(repo);
-  registerFallbackProviderElement();
 
   const rootElement = document.getElementById(config.rootElementId ?? "root");
   if (!rootElement) {
@@ -197,14 +249,10 @@ export async function bootPatchworkSite(
     );
   }
   const repoProvider = document.createElement("repo-provider");
-  const fallbackProvider = document.createElement("fallback-provider");
-  rootElement.parentElement!.insertBefore(fallbackProvider, rootElement);
-  fallbackProvider.appendChild(repoProvider);
+  rootElement.parentElement!.insertBefore(repoProvider, rootElement);
   repoProvider.appendChild(rootElement);
 
-  // Registers `<patchwork-view>` and the `<patchwork-view-legacy>` it
-  // delegates to in one go.
-  registerPatchworkViewElement();
+  registerPatchworkViewElement(hive ? { hive } : {});
 
   // The watcher is started with the site's default-tools bundle alone so that
   // `resolveAccountHandle` below has something to await on (the `account`
@@ -219,6 +267,7 @@ export async function bootPatchworkSite(
 
   const accountDocHandle = await resolveAccountHandle(repo, {
     storageKey: config.accountStorageKey,
+    hive,
   });
 
   window.accountDocHandle = accountDocHandle;
@@ -270,10 +319,21 @@ function resolveDefaultModulesUrl(builtin: AutomergeUrl): AutomergeUrl {
   return builtin;
 }
 
-function installDevConsoleGlobals(repo: Repo): void {
+function installDevConsoleGlobals(
+  repo: Repo,
+  hive: AutomergeRepoKeyhive | undefined
+): void {
   window.repo = repo;
   window.Automerge = Automerge;
   window.AutomergeRepo = AutomergeRepo;
+  if (hive) {
+    window.hive = hive;
+  }
+  window.getRepoChannel = () => {
+    const { port1, port2 } = new MessageChannel();
+    navigator.serviceWorker.controller!.postMessage({ type: "port" }, [port2]);
+    return port1;
+  };
 }
 
 function onModuleLoaded(name: string, mod: any): void {

package/src/vite/importmap-plugin.ts

@@ -45,12 +45,22 @@ export function importmap(options?: PatchworkVitePluginOptions): Plugin {
         });
       }
 
-      // Emit automerge wasm so the service worker can fetch it
-      const wasmPath = require.resolve("@automerge/automerge/automerge.wasm");
+      // Emit automerge, keyhive, and subduction wasm so the service worker can fetch them
+      const automergeWasmPath = require.resolve(
+        "@automerge/automerge/automerge.wasm"
+      );
       this.emitFile({
         type: "asset",
         fileName: "automerge.wasm",
-        source: readFileSync(wasmPath),
+        source: readFileSync(automergeWasmPath),
+      });
+      const keyhiveWasmPath = require.resolve(
+        "@keyhive/keyhive/keyhive_wasm.wasm"
+      );
+      this.emitFile({
+        type: "asset",
+        fileName: "keyhive_wasm.wasm",
+        source: readFileSync(keyhiveWasmPath),
       });
 
       // Emit subduction wasm so the service worker can fetch it