@le-space/orbitdb-storage-bridge 0.11.0 → 0.13.0

package/README.md

@@ -60,6 +60,18 @@
   - [License](#license)
 
 
+## Does this work from a browser? Measure it
+
+`examples/browser/storage-probe/` is a static page that asks the services this package talks to,
+from a real browser, with no server: do Aleph, Pinata and Lighthouse answer a page at all, does
+their CORS survive a refusal as well as a success, and does anybody on IPFS hold a given CID at an
+address a browser can dial. With your own key it does a real upload and reads it back. The key is
+kept in that browser and sent only to the service it belongs to.
+
+It is published from this repository's Pages, and it opens from a checkout just as well — there is
+no build step, which is the point: what it measures is a browser talking to a service, with
+nothing in between.
+
 ## Status: Storacha sunset (May 2026)
 
 Storacha switched off user writes in **May 2026** and has since decommissioned the service.
@@ -73,6 +85,17 @@ Verified on 2026-09-05:
 | the widget demo CID linked in the roadmap below | `504` on `w3s.link`, `dweb.link`, `ipfs.io` and `trustless-gateway.link` |
 | `@storacha/client` on npm | last release `2.1.4`, 2026-05-15, not marked deprecated |
 
+The gateway those redirects pointed at is gone too. On **2026-09-21** Protocol Labs retired
+`ipfs.io` and `dweb.link`: both answer `429` with an RFC 8594 `Sunset` header and a link to
+[gatewaychanges.ipfs.io](https://gatewaychanges.ipfs.io/), so `storacha.link` and `w3s.link`
+now redirect to a closed door. Retrieval defaults here are `ipfs.aleph.cloud` — the one free
+path gateway measured still serving arbitrary CIDs on 2026-09-23 — with
+`trustless-gateway.link` available for verifiable single-block requests
+(`Accept: application/vnd.ipld.raw`). One host is not a fallback chain, which is why `peer-fetch.js` fetches from the providers that
+hold the blocks instead — bitswap over libp2p, measured from a real page at 0.73 s to dial and
+0.26 s for the block, with no credential in the path. See
+[docs/RECOVERY-ON-A-SECOND-DEVICE.md](docs/RECOVERY-ON-A-SECOND-DEVICE.md).
+
 The shutdown is traceable in the open:
 [`upload-service#708`](https://github.com/storacha/upload-service/pull/708) added a `writesDisabled`
 kill switch that makes the eight user-initiated write capabilities

package/lib/backends/aleph.js

@@ -47,12 +47,16 @@
 import { defineBackend, handleId, BackendError } from "./types.js";
 import { fetchFromGateways } from "../gateway-fetch.js";
 
-/** Aleph's own first: it serves what Aleph ingested without waiting for propagation. */
-export const ALEPH_GATEWAYS = Object.freeze([
-  "https://ipfs.aleph.cloud/ipfs",
-  "https://dweb.link/ipfs",
-  "https://ipfs.io/ipfs",
-]);
+/**
+ * Aleph's own, and only Aleph's own.
+ *
+ * `dweb.link` and `ipfs.io` were the two fallbacks behind it until Protocol
+ * Labs retired them on 2026-09-21; they answer 429 with a `Sunset` header now.
+ * Nothing free was found to replace them that will serve an arbitrary CID, so
+ * this driver's retrieval depends on one host until the peer path in #112
+ * lands. A caller with its own gateway passes `gateways`.
+ */
+export const ALEPH_GATEWAYS = Object.freeze(["https://ipfs.aleph.cloud/ipfs"]);
 
 const ALEPH_INGEST = "https://ipfs.aleph.cloud/api/v0/add";
 const DEFAULT_TIMEOUT_MS = 120_000;

package/lib/backends/choose.js

@@ -21,6 +21,16 @@
  * {@link ../backends/mirror.js createMirrorBackend} over them, so the caller's
  * code is the same whether one service was ticked or three.
  *
+ * ## A gateway belongs to the service it came from
+ *
+ * Since the public path gateways were retired (#111), the gateway a reader can
+ * actually use is usually their own account's — `<name>.mypinata.cloud`,
+ * `<name>.lighthouseweb3.xyz` — and those are not interchangeable: Pinata's
+ * answers 401 for a Lighthouse CID, Lighthouse's answers 402. So `gateway` is
+ * a string only while one service is chosen, and an object keyed by service
+ * once several are. Handing one string to three drivers is refused rather than
+ * half-working.
+ *
  * ## What it refuses
  *
  * A key that is missing is refused here, with the name of the service in the
@@ -36,6 +46,16 @@
 
 import { BackendError } from "./types.js";
 
+/**
+ * Aleph's driver tries a list of `…/ipfs` prefixes, while a reader types a
+ * host. Accept either, and a bare domain as https, like the other drivers do.
+ */
+const alephGateway = (value) => {
+  const withScheme = /^https?:\/\//i.test(value) ? value : `https://${value}`;
+  const trimmed = withScheme.replace(/\/+$/, "");
+  return trimmed.endsWith("/ipfs") ? trimmed : `${trimmed}/ipfs`;
+};
+
 /** The names a caller may ask for. */
 export const BACKEND_KINDS = Object.freeze([
   "aleph",
@@ -55,7 +75,11 @@ export const BACKEND_KINDS = Object.freeze([
  * @param {string} [choice.apiKey] - Lighthouse
  * @param {"shared"|"user"} [choice.keyOwnership] - Lighthouse: whose key it is,
  *   which is what decides `browserSafeAuth`
- * @param {string[]} [choice.gateways] - retrieval gateways, where the driver takes them
+ * @param {string|Record<string, string>} [choice.gateway] - retrieval gateway:
+ *   a string for a single kind, or `{ pinata: "…", lighthouse: "…" }` for several.
+ *   A bare domain is read as https, as each driver already accepts
+ * @param {string[]} [choice.gateways] - retrieval gateways, tried in order; wins
+ *   over `gateway` where a driver takes a list
  * @param {object} [choice.options] - passed through to the driver, for anything
  *   this signature does not name
  * @param {"one"|"all"} [choice.require] - for several kinds: how many must accept a write
@@ -80,6 +104,14 @@ export async function createBackendFromChoice(choice = {}) {
     }
   }
 
+  if (wanted.length > 1 && typeof choice.gateway === "string") {
+    throw new BackendError(
+      "INVALID_BACKEND",
+      `A gateway belongs to one service — with several kinds pass an object: ` +
+        `{ gateway: { ${wanted.map((k) => `${k}: "…"`).join(", ")} } }`,
+    );
+  }
+
   if (wanted.length > 1) {
     const backends = [];
     for (const kind of wanted) {
@@ -90,12 +122,19 @@ export async function createBackendFromChoice(choice = {}) {
   }
 
   const [kind] = wanted;
-  const gateways = choice.gateways ? { gateways: choice.gateways } : {};
   const extra = choice.options ?? {};
+  const gateway =
+    typeof choice.gateway === "string" ? choice.gateway : choice.gateway?.[kind];
+  const gateways = choice.gateways ? { gateways: choice.gateways } : {};
+  // Pinata and Lighthouse take one gateway; Aleph takes the list it tries in
+  // order, so a single choice becomes a list of one.
+  const oneGateway = gateway ? { gateway } : {};
 
   if (kind === "aleph") {
     const { createAlephBackend } = await import("./aleph.js");
-    return createAlephBackend({ ...gateways, ...extra });
+    const fromOne =
+      gateway && !choice.gateways ? { gateways: [alephGateway(gateway)] } : {};
+    return createAlephBackend({ ...gateways, ...fromOne, ...extra });
   }
 
   if (kind === "pinata") {
@@ -114,6 +153,7 @@ export async function createBackendFromChoice(choice = {}) {
     return createPinataBackend({
       ...(choice.jwt ? { jwt: choice.jwt } : {}),
       ...(choice.getUploadUrl ? { getUploadUrl: choice.getUploadUrl } : {}),
+      ...oneGateway,
       ...gateways,
       ...extra,
     });
@@ -128,6 +168,7 @@ export async function createBackendFromChoice(choice = {}) {
       ...(choice.apiKey ? { apiKey: choice.apiKey } : {}),
       // Whose key it is decides browserSafeAuth, and a page should say which it got.
       keyOwnership: choice.keyOwnership ?? "shared",
+      ...oneGateway,
       ...gateways,
       ...extra,
     });

package/lib/backends/encryption.js

@@ -0,0 +1,246 @@
+/**
+ * @fileoverview Encrypting what goes to a storage service, and decrypting what
+ * comes back.
+ *
+ * A backup leaves the browser as two opaque blobs — a CAR and a small metadata
+ * JSON — and the services that hold them neither need nor should have their
+ * contents. This wraps a backend so `putBlob` encrypts and `getBlob` decrypts,
+ * and **nothing above it changes**: `dehydrate`, `restoreFromCID`, the mirror,
+ * the gateway path and the peer path all move opaque bytes either way.
+ *
+ * ## The keys are the caller's
+ *
+ * This package knows nothing about passkeys, and should not: it takes two
+ * functions, exactly as `createBackendFromChoice` takes `normaliseAddress`
+ * rather than importing viem. A browser consumer derives them from the
+ * security key's PRF output — `@le-space/orbitdb-identity-provider-webauthn-did`
+ * ships `getPrfOutput`, `encryptWithAESGCM` and `decryptWithAESGCM` — and
+ * should derive a **separate** key for this, from the same secret with a
+ * different info string, so that a compromised backup key is not a signing key.
+ *
+ * ## The envelope, and why it is not just ciphertext
+ *
+ * Bytes on the way back can be one of three things: this envelope, a plaintext
+ * CAR from before backups were encrypted, or a plaintext CAR written with
+ * `dontEncrypt`. A restore has to tell them apart without being told, because
+ * a pointer does not carry that knowledge. So every ciphertext starts with a
+ * magic number and a version:
+ *
+ * ```
+ * "OSBE" | version | ivLength | iv | ciphertext
+ *   4        1          1       ~12     …
+ * ```
+ *
+ * A CAR begins with a varint length and a dag-cbor header, and JSON with `{`,
+ * so neither collides with the magic. The version is there for the day the
+ * algorithm changes: a backup from before it can then be refused with a
+ * reason rather than decrypted into noise.
+ *
+ * @module backends/encryption
+ */
+
+import { defineBackend, BackendError } from "./types.js";
+
+/** `OSBE` — orbitdb-storage-bridge, encrypted. */
+// Not frozen: freezing a typed array throws, because its elements live in a
+// buffer the engine will not seal.
+export const ENVELOPE_MAGIC = new Uint8Array([0x4f, 0x53, 0x42, 0x45]);
+
+/** Bumped when the envelope or the algorithm changes in a way readers must notice. */
+export const ENVELOPE_VERSION = 1;
+
+const HEADER_LENGTH = ENVELOPE_MAGIC.length + 2;
+
+/** Do these bytes start with an envelope this module wrote? */
+export function isEncrypted(bytes) {
+  if (!(bytes instanceof Uint8Array) || bytes.length < HEADER_LENGTH) return false;
+  return ENVELOPE_MAGIC.every((byte, index) => bytes[index] === byte);
+}
+
+/**
+ * Wrap ciphertext and its IV so a reader can recognise both without being told.
+ *
+ * @param {Uint8Array} ciphertext
+ * @param {Uint8Array} iv
+ * @returns {Uint8Array}
+ */
+export function wrapEnvelope(ciphertext, iv) {
+  if (!(ciphertext instanceof Uint8Array) || !(iv instanceof Uint8Array)) {
+    throw new BackendError("INVALID_BACKEND", "encrypt must return Uint8Array ciphertext and iv");
+  }
+  if (iv.length > 255) {
+    throw new BackendError("INVALID_BACKEND", `An IV of ${iv.length} bytes does not fit the envelope`);
+  }
+  const out = new Uint8Array(HEADER_LENGTH + iv.length + ciphertext.length);
+  out.set(ENVELOPE_MAGIC, 0);
+  out[ENVELOPE_MAGIC.length] = ENVELOPE_VERSION;
+  out[ENVELOPE_MAGIC.length + 1] = iv.length;
+  out.set(iv, HEADER_LENGTH);
+  out.set(ciphertext, HEADER_LENGTH + iv.length);
+  return out;
+}
+
+/**
+ * Read an envelope back, refusing a version this build does not know.
+ *
+ * @param {Uint8Array} bytes
+ * @returns {{ ciphertext: Uint8Array, iv: Uint8Array, version: number }}
+ */
+export function readEnvelope(bytes) {
+  if (!isEncrypted(bytes)) {
+    throw new BackendError("INVALID_BACKEND", "These bytes are not an encrypted backup");
+  }
+  const version = bytes[ENVELOPE_MAGIC.length];
+  if (version !== ENVELOPE_VERSION) {
+    throw new BackendError(
+      "INVALID_BACKEND",
+      `This backup was written with envelope version ${version}, and this build reads ${ENVELOPE_VERSION}. ` +
+        "Upgrade @le-space/orbitdb-storage-bridge to restore it.",
+    );
+  }
+  const ivLength = bytes[ENVELOPE_MAGIC.length + 1];
+  const iv = bytes.subarray(HEADER_LENGTH, HEADER_LENGTH + ivLength);
+  const ciphertext = bytes.subarray(HEADER_LENGTH + ivLength);
+  return { ciphertext, iv, version };
+}
+
+/**
+ * Encrypt on the way out, decrypt on the way back.
+ *
+ * @param {import("./types.js").StorageBackend} backend - the one that stores bytes
+ * @param {object} options
+ * @param {(plaintext: Uint8Array) => Promise<{ciphertext: Uint8Array, iv: Uint8Array}>} options.encrypt
+ * @param {(ciphertext: Uint8Array, iv: Uint8Array) => Promise<Uint8Array>} options.decrypt
+ * @param {boolean} [options.allowPlaintextReads=true] - restore a backup written
+ *   before backups were encrypted, or written with `dontEncrypt`. On by
+ *   default: a pointer does not say which kind it names, and refusing would
+ *   make yesterday's backups unreadable for no gain in secrecy.
+ * @returns {import("./types.js").StorageBackend}
+ */
+export function withEncryption(backend, { encrypt, decrypt, allowPlaintextReads = true } = {}) {
+  if (!backend || typeof backend.putBlob !== "function") {
+    throw new BackendError("INVALID_BACKEND", "withEncryption needs a backend to wrap");
+  }
+  if (typeof encrypt !== "function" || typeof decrypt !== "function") {
+    throw new BackendError(
+      "INVALID_BACKEND",
+      "withEncryption needs encrypt and decrypt functions — this package holds no keys of its own",
+    );
+  }
+
+  const inner = backend;
+
+  return defineBackend({
+    ...inner,
+    name: `encrypted(${inner.name})`,
+    capabilities: {
+      ...inner.capabilities,
+      // The stored bytes are an envelope, not a CAR: nothing downstream may
+      // treat them as one, and there are no inner CIDs to preserve.
+      carImport: false,
+      preservesInnerCids: false,
+    },
+
+    async putBlob(bytes, meta) {
+      const { ciphertext, iv } = (await encrypt(bytes)) ?? {};
+      return inner.putBlob(wrapEnvelope(ciphertext, iv), meta);
+    },
+
+    async getBlob(handle) {
+      const bytes = await inner.getBlob(handle);
+      if (!isEncrypted(bytes)) {
+        if (allowPlaintextReads) return bytes;
+        throw new BackendError(
+          "INVALID_BACKEND",
+          "This backup is not encrypted, and allowPlaintextReads is off",
+        );
+      }
+      const { ciphertext, iv } = readEnvelope(bytes);
+      try {
+        return await decrypt(ciphertext, iv);
+      } catch (error) {
+        // The common cause by far is the wrong key — a different security key,
+        // or a key derived with a different info string. Say that, rather than
+        // letting an unreadable CAR surface three layers down.
+        throw new BackendError(
+          "INVALID_BACKEND",
+          `Could not decrypt this backup: ${error.message}. ` +
+            "It was written with a different key, or by a different derivation.",
+          { cause: error },
+        );
+      }
+    },
+  });
+}
+
+/**
+ * Decrypt on the way back, for the path a restore actually takes.
+ *
+ * `restoreFromCID` does not read through a backend: it takes `fetchBytes(cid)`
+ * and gets the bytes from a gateway or from peers, so `withEncryption`'s
+ * `getBlob` never runs during a restore. This is the other half — wrap the
+ * fetcher, and a backup written through an encrypting backend comes back
+ * readable however it was fetched.
+ *
+ * @param {(cid: string, options?: object) => Promise<Uint8Array>} fetchBytes
+ * @param {object} options
+ * @param {(ciphertext: Uint8Array, iv: Uint8Array) => Promise<Uint8Array>} options.decrypt
+ * @param {boolean} [options.allowPlaintextReads=true]
+ * @returns {(cid: string, options?: object) => Promise<Uint8Array>}
+ */
+export function decryptingFetch(fetchBytes, { decrypt, allowPlaintextReads = true } = {}) {
+  if (typeof fetchBytes !== "function") {
+    throw new BackendError("INVALID_BACKEND", "decryptingFetch needs a fetcher to wrap");
+  }
+  if (typeof decrypt !== "function") {
+    throw new BackendError("INVALID_BACKEND", "decryptingFetch needs a decrypt function");
+  }
+
+  return async function fetchAndDecrypt(cid, options) {
+    const bytes = await fetchBytes(cid, options);
+    if (!isEncrypted(bytes)) {
+      if (allowPlaintextReads) return bytes;
+      throw new BackendError(
+        "INVALID_BACKEND",
+        `The backup at ${cid} is not encrypted, and allowPlaintextReads is off`,
+      );
+    }
+    const { ciphertext, iv } = readEnvelope(bytes);
+    try {
+      return await decrypt(ciphertext, iv);
+    } catch (error) {
+      throw new BackendError(
+        "INVALID_BACKEND",
+        `Could not decrypt the backup at ${cid}: ${error.message}. ` +
+          "It was written with a different key, or by a different derivation.",
+        { cause: error },
+      );
+    }
+  };
+}
+
+/**
+ * Recognise an encrypted backup when there is no key to open it.
+ *
+ * Without this, a restore of an encrypted backup without `decrypt` fails deep
+ * inside the CAR reader — "unexpected end of data", or a block that will not
+ * verify — and the reason has nothing to do with what actually happened.
+ *
+ * @param {(cid: string, options?: object) => Promise<Uint8Array>} fetchBytes
+ * @returns {(cid: string, options?: object) => Promise<Uint8Array>}
+ */
+export function explainIfEncrypted(fetchBytes) {
+  return async function fetchAndCheck(cid, options) {
+    const bytes = await fetchBytes(cid, options);
+    if (isEncrypted(bytes)) {
+      throw new BackendError(
+        "INVALID_BACKEND",
+        `The backup at ${cid} is encrypted, and no way to decrypt it was given. ` +
+          "Pass `decrypt` to hydrate() — a browser derives it from the security key.",
+      );
+    }
+    return bytes;
+  };
+}
+
+export default withEncryption;

package/lib/backends/storacha.js

@@ -7,9 +7,10 @@
  * credentials against a self-hosted w3up deployment can still use it, and it is the
  * reference for what a UCAN-delegated backend looked like when one existed.
  *
- * Retrieval no longer defaults to Storacha's own gateways: `storacha.link` and `w3s.link`
- * answer 301 to `dweb.link` as of 2026-09-05, so the driver goes there directly and lets
- * a caller pass its own list — which is what the in-memory service does.
+ * Retrieval defaults to a gateway belonging to nobody in this story: `storacha.link`
+ * and `w3s.link` answer 301 to `dweb.link`, which Protocol Labs retired on 2026-09-21
+ * along with `ipfs.io`. A caller passes its own list — which is what the in-memory
+ * service does.
  *
  * @author @NiKrause
  * @requires ./types.js - the backend contract
@@ -23,11 +24,15 @@ import * as Proof from "@storacha/client/proof";
 import { CID } from "multiformats/cid";
 import { defineBackend, handleId, BackendError } from "./types.js";
 
-/** Gateways tried in order by `getBlob()`, unless the caller supplies its own. */
-export const DEFAULT_GATEWAYS = Object.freeze([
-  "https://dweb.link",
-  "https://ipfs.io",
-]);
+/**
+ * Gateways tried in order by `getBlob()`, unless the caller supplies its own.
+ *
+ * Storacha's own hosts redirected here, and here was retired on 2026-09-21
+ * together with `ipfs.io`. What is left is a gateway belonging to a different
+ * service, which will serve a Storacha CID only while somebody still provides
+ * those blocks to the network.
+ */
+export const DEFAULT_GATEWAYS = Object.freeze(["https://ipfs.aleph.cloud"]);
 
 /**
  * Build a Storacha client from key and proof, or adopt one that already exists.

package/lib/backup-car.js

@@ -33,13 +33,14 @@ const spaceHelpers = () => import("./orbitdb-storacha-bridge.js");
 import { unixfs } from "@helia/unixfs";
 import logger from "./logger.js";
 import { readBlockBytes } from "./block-bytes.js";
+import { DEFAULT_GATEWAYS, MAX_BACKOFF_MS } from "./gateway-fetch.js";
 
 /**
  * Default configuration options
  */
 const DEFAULT_OPTIONS = {
   timeout: 30000,
-  gateway: "https://w3s.link",
+  gateway: "https://ipfs.aleph.cloud", // w3s.link redirects to a gateway retired on 2026-09-21
   verbose: false,
   // Network download options
   useIPFSNetwork: true, // Enable network downloads by default
@@ -812,12 +813,11 @@ export async function restoreFromSpaceCAR(orbitdb, options = {}) {
 
     // Fallback to gateway if network failed or disabled
     if (!carBytes) {
-      // Try multiple gateways in order
+      // The configured gateway, then whatever the package still trusts.
+      // `storacha.link`, `dweb.link` and `ipfs.io` were all retired on
+      // 2026-09-21 and stood here until then.
       const gateways = [
-        `${config.gateway}/ipfs`,
-        "https://storacha.link/ipfs",
-        "https://dweb.link/ipfs",
-        "https://ipfs.io/ipfs",
+        ...new Set([`${config.gateway}/ipfs`, ...DEFAULT_GATEWAYS]),
       ];
 
       let carResponse;
@@ -943,6 +943,13 @@ export async function restoreFromSpaceCAR(orbitdb, options = {}) {
                 }
               }
 
+              if (waitTime > MAX_BACKOFF_MS) {
+                logger.warn(
+                  `   ⚠️ ${gateway} wants ${Math.round(waitTime / 1000)}s — treating it as closed`,
+                );
+                break; // try the next gateway rather than wait out a retirement
+              }
+
               logger.warn(
                 `   Waiting ${Math.round(waitTime / 1000)}s before retry (attempt ${attempts + 1}/${maxAttempts})...`,
               );

package/lib/dehydrate.js

@@ -61,15 +61,33 @@ export async function dehydrate({
   seed,
   label,
   backend,
+  encrypt,
+  decrypt,
+  dontEncrypt = false,
   endpoints = DEFAULT_ENDPOINTS,
   sequence,
   backup = {},
 }) {
   if (!address) throw new Error("dehydrate needs the database address");
+
+  // Encrypted by default. A caller who wants the backup readable by anyone
+  // holding the CID has to write that down, because it is a decision rather
+  // than an oversight — and an oversight is what this refusal exists to catch.
+  if (!encrypt && !dontEncrypt) {
+    throw new Error(
+      "Backups are encrypted by default. Pass `encrypt` and `decrypt` — a browser " +
+        "derives them from the security key — or `dontEncrypt: true` if this backup " +
+        "is meant to be readable by anyone holding the CID.",
+    );
+  }
+
   const { backupDatabaseCAR } = await import("./backup-car.js");
+  const storeIn = encrypt
+    ? (await import("./backends/encryption.js")).withEncryption(backend, { encrypt, decrypt })
+    : backend;
 
   const result = await backupDatabaseCAR(orbitdb, address, {
-    backend,
+    backend: storeIn,
     ...backup,
   });
   if (!result?.success) {
@@ -118,6 +136,7 @@ export async function hydrate({
   orbitdb,
   seed,
   label,
+  decrypt,
   endpoints = DEFAULT_ENDPOINTS,
   open = {},
   restore = {},
@@ -126,10 +145,22 @@ export async function hydrate({
   const pointer = await resolvePointer({ privateKey, endpoints });
 
   const { restoreFromCID } = await import("./restore-cid.js");
+  const { decryptingFetch, explainIfEncrypted } = await import("./backends/encryption.js");
+  const { fetchFromGateways } = await import("./gateway-fetch.js");
+
+  // A restore does not read through a backend — it fetches from a gateway or
+  // from peers — so decryption belongs here, around the fetcher. Without a
+  // key, an encrypted backup is still recognised, and says so.
+  const fetchBytes = restore.fetchBytes ?? fetchFromGateways;
+  const reader = decrypt
+    ? decryptingFetch(fetchBytes, { decrypt })
+    : explainIfEncrypted(fetchBytes);
+
   const result = await restoreFromCID(orbitdb, {
     metadataCID: pointer.cid,
     open,
     ...restore,
+    fetchBytes: reader,
   });
 
   logger.info(

package/lib/gateway-fetch.js

@@ -12,13 +12,39 @@
  * @module gateway-fetch
  */
 
-/** Tried in order. The first is Storacha's own, the rest are public. */
-export const DEFAULT_GATEWAYS = [
-  "https://w3s.link/ipfs",
-  "https://storacha.link/ipfs",
-  "https://dweb.link/ipfs",
-  "https://ipfs.io/ipfs",
-];
+/**
+ * Tried in order.
+ *
+ * This used to be four entries and is now one, because on 2026-09-21 Protocol
+ * Labs retired `ipfs.io` and `dweb.link` — they answer 429 with an RFC 8594
+ * `Sunset` header — and `w3s.link` and `storacha.link` redirect to `dweb.link`.
+ * All four were dead at once, which is what a list of gateways run by one
+ * organisation is worth.
+ *
+ * Measured 2026-09-23: `ipfs.aleph.cloud` answers in 0.2 s with CORS, and no
+ * other free path gateway found would serve an arbitrary CID —
+ * `gateway.pinata.cloud` answers 403 for content it does not hold,
+ * `4everland.io` redirects after 15 s, the rest do not answer at all.
+ *
+ * One entry is not a fallback chain, and pretending otherwise is how this
+ * rotted unnoticed. The replacement is not a longer list: it is fetching from
+ * the providers that hold the blocks, over libp2p — see issue #112.
+ */
+export const DEFAULT_GATEWAYS = ["https://ipfs.aleph.cloud/ipfs"];
+
+/**
+ * Gateways that serve **verifiable** responses only: a single block, or a CAR.
+ *
+ * `trustless-gateway.link` was still healthy when the path gateways were
+ * retired, and it answers with CORS — but it refuses an ordinary path request
+ * with a 406, so it is only usable with `accept` set, and only for a CID whose
+ * bytes are one block. A UnixFS file split into chunks needs its DAG walked,
+ * which this module deliberately cannot do.
+ */
+export const TRUSTLESS_GATEWAYS = ["https://trustless-gateway.link/ipfs"];
+
+/** `accept` for a single block from a trustless gateway. */
+export const RAW_BLOCK = "application/vnd.ipld.raw";
 
 /**
  * Quiet by default. A restore reports itself through its return value and its
@@ -30,6 +56,15 @@ export const SILENT = { info() {}, warn() {}, debug() {} };
 const DEFAULT_TIMEOUT_MS = 60_000;
 const MAX_ATTEMPTS_PER_GATEWAY = 3;
 
+/**
+ * Longest 429 wait worth honouring.
+ *
+ * A retired gateway asks for 900 s, and three attempts against four of them is
+ * most of an afternoon spent waiting for an answer that will not change. Past
+ * this, the gateway is not rate-limiting us, it is closed.
+ */
+export const MAX_BACKOFF_MS = 30_000;
+
 /**
  * A gateway that cannot serve a CID usually says so in HTML, with a 200.
  *
@@ -73,9 +108,14 @@ const backoffFor = (response, attempt) => {
  * @param {string[]} [options.gateways]
  * @param {number} [options.timeout] per request, in ms
  * @param {AbortSignal} [options.signal]
+ * @param {string} [options.accept] sent as `Accept`; `RAW_BLOCK` for a single
+ *   block from a trustless gateway
+ * @param {number} [options.maxBackoff] longest 429 wait to honour, in ms
+ * @param {(ms: number) => Promise<void>} [options.sleep] injectable for tests
+ * @param {typeof fetch} [options.fetchImpl] injectable for tests
  * @returns {Promise<Uint8Array>}
  */
-export async function fetchFromGateways(cid, { gateways = DEFAULT_GATEWAYS, timeout = DEFAULT_TIMEOUT_MS, signal = null, log = SILENT } = {}) {
+export async function fetchFromGateways(cid, { gateways = DEFAULT_GATEWAYS, timeout = DEFAULT_TIMEOUT_MS, signal = null, log = SILENT, accept = null, maxBackoff = MAX_BACKOFF_MS, sleep = waitFor, fetchImpl = fetch } = {}) {
   let lastError = null;
 
   for (const gateway of gateways) {
@@ -83,12 +123,27 @@ export async function fetchFromGateways(cid, { gateways = DEFAULT_GATEWAYS, time
     for (let attempt = 0; attempt < MAX_ATTEMPTS_PER_GATEWAY; attempt++) {
       const timer = AbortSignal.timeout ? AbortSignal.timeout(timeout) : null;
       try {
-        const response = await fetch(url, { signal: signal ?? timer ?? undefined });
+        const response = await fetchImpl(url, {
+          signal: signal ?? timer ?? undefined,
+          ...(accept ? { headers: { Accept: accept } } : {}),
+        });
+
+        // An RFC 8594 Sunset header means the gateway is going away or already
+        // has. Retrying is pointless, and so is coming back next time.
+        const sunset = response.headers?.get?.("Sunset");
+        if (sunset && !response.ok) {
+          log.warn(`   ⚠️ ${gateway} is retired (Sunset: ${sunset})`);
+          break;
+        }
 
         if (response.status === 429 && attempt < MAX_ATTEMPTS_PER_GATEWAY - 1) {
           const wait = backoffFor(response, attempt);
+          if (wait > maxBackoff) {
+            log.warn(`   ⚠️ ${gateway} wants ${Math.round(wait / 1000)}s — treating it as closed`);
+            break;
+          }
           log.warn(`   ⚠️ ${gateway} rate-limited; waiting ${Math.round(wait / 1000)}s`);
-          await waitFor(wait);
+          await sleep(wait);
           continue;
         }
         if (!response.ok) {

package/lib/orbitdb-storacha-bridge.js

@@ -17,6 +17,7 @@ import { sha256 } from "multiformats/hashes/sha2";
 import { bases } from "multiformats/basics";
 import { EventEmitter } from "events";
 import { createHeliaOrbitDB, cleanupOrbitDBDirectories } from "./utils.js";
+import { DEFAULT_GATEWAYS } from "./gateway-fetch.js";
 import {
   generateBackupPrefix,
   getBackupFilenames,
@@ -47,7 +48,7 @@ function logHeliaActivity(message) {
 const DEFAULT_OPTIONS = {
   // Core configuration
   timeout: 30000, // Timeout in milliseconds
-  gateway: "https://dweb.link", // IPFS gateway URL (w3s.link only redirects here now)
+  gateway: "https://ipfs.aleph.cloud", // dweb.link was retired on 2026-09-21
   verbose: false, // Enable verbose debug logging
 
   // Network download options
@@ -823,14 +824,12 @@ export async function downloadBlock(cid, options = {}) {
     }
   }
 
-  // Fallback to gateway download
-  // storacha.link and w3s.link answer 301 to dweb.link as of 2026-09-05, so going
-  // through them only buys a redirect. Ask the destination directly.
-  const gateways = [
-    `${config.gateway}/ipfs`,
-    "https://dweb.link/ipfs",
-    "https://ipfs.io/ipfs",
-  ];
+  // Fallback to gateway download.
+  // `dweb.link` and `ipfs.io` stood here until Protocol Labs retired them on
+  // 2026-09-21; `storacha.link` and `w3s.link` had already become redirects to
+  // the first of those. What is left is one host, which is not a fallback
+  // chain — see issue #112 for the path that does not depend on one.
+  const gateways = [...new Set([`${config.gateway}/ipfs`, ...DEFAULT_GATEWAYS])];
 
   for (const gateway of gateways) {
     try {

package/lib/peer-fetch.js

@@ -0,0 +1,391 @@
+/**
+ * @fileoverview Fetching bytes by CID from peers, when a gateway will not do.
+ *
+ * `gateway-fetch.js` is the HTTP half of this: ask a host, hope it answers.
+ * That stopped being a plan on 2026-09-21, when the public path gateways were
+ * retired (#111) and every fallback list in this package turned out to be one
+ * live entry and a dead tail. This is the other half — ask the peers that
+ * actually hold the blocks.
+ *
+ * ## Measured before it was written
+ *
+ * From a real page (Chrome, no build step, Helia loaded as ES modules), on
+ * 2026-09-23:
+ *
+ * ```
+ * Pinata      dial 729 ms over wss            bitswap 263 ms
+ * Lighthouse  dial 581 ms over webrtc-direct  bitswap 323 ms
+ * Aleph       dial 450 ms over webrtc-direct  bitswap 345 ms
+ * ```
+ *
+ * No credential in any of it, while both paid providers' HTTP gateways want
+ * that account's key and Lighthouse's shared gateway answers 402 for content
+ * it does not hold. Three services, two transports, about a second each.
+ *
+ * ## The peer list follows the backends, and nothing else
+ *
+ * There is no default provider here, and that is deliberate. Whoever stores
+ * with a service already shares their CIDs with it, so reading from it adds no
+ * new party — but a page that dials Pinata having never uploaded there would
+ * be telling Pinata what its reader is looking for, in exchange for nothing.
+ * The caller names the providers. {@link PINATA_BITSWAP} is a constant because
+ * Pinata publishes it in DNS; everyone else has to be looked up.
+ *
+ * ## What the caller has to bring
+ *
+ * A Helia with bitswap **and identify**. This module has no libp2p of its own —
+ * the page that restores already has a node, and a second one would be a second
+ * identity on the network.
+ *
+ * Two things about that node are easy to get wrong, and both were:
+ *
+ * - **`identify` is not optional.** `withLibp2pLight` does not include it, and
+ *   without it bitswap never learns that the peer it just dialled speaks
+ *   bitswap: no want is sent, and the fetch fails with "Failed to load block"
+ *   after the full timeout. Measured against Aleph: 60 s of nothing without
+ *   identify, 1.6 s for 400 kB with it, over the same dialled connection.
+ * - **Helia's browser defaults try to listen** on `/webrtc` and `/p2p-circuit`
+ *   and **throw on start** when no transport serves them, so a fetch-only node
+ *   wants `addresses: { listen: [] }`.
+ *
+ * ```js
+ * const helia = await withBitswap(withLibp2pLight(createHeliaLight({ … }), {
+ *   addresses: { listen: [] },
+ *   transports: [webSockets(), webRTCDirect()],
+ *   connectionEncrypters: [noise()],
+ *   streamMuxers: [yamux()],
+ *   services: { identify: identify() },   // ← without this, nothing arrives
+ * })).start()
+ * ```
+ *
+ * @module peer-fetch
+ */
+
+/**
+ * Pinata's bitswap endpoint, published in DNS:
+ *
+ * ```
+ * $ dig +short TXT _dnsaddr.bitswap-v3.pinata.cloud
+ * "dnsaddr=/dns4/bitswap-v3.pinata.cloud/tcp/443/wss/p2p/Qmdv6yNikmUWUWXufLJLRNkv6Y9sY5cmgeX5RVWA4WNMz4"
+ * ```
+ *
+ * A DNS name on 443 with a CA certificate is dialable from a page, which is
+ * what makes it worth naming here rather than looking up per CID.
+ */
+export const PINATA_BITSWAP =
+  "/dns4/bitswap-v3.pinata.cloud/tcp/443/wss/p2p/Qmdv6yNikmUWUWXufLJLRNkv6Y9sY5cmgeX5RVWA4WNMz4";
+
+/**
+ * Aleph's own node, which took some finding.
+ *
+ * It publishes no `_dnsaddr` and answers `404` to `/api/v0/id`, so looking for
+ * it the way Pinata is found says it has no peer — which is what an earlier
+ * version of this file claimed. It does: ask a router for the providers of a
+ * CID Aleph holds, and the record is `46.255.204.211`, the address
+ * `ipfs.aleph.cloud` resolves to, with `webrtc-direct` and `webtransport`
+ * among its addresses. A page dialled it in 450 ms and had the block 345 ms
+ * later.
+ *
+ * Two caveats make this a starting point rather than a guarantee:
+ *
+ * - **The certhash rotates.** A `webrtc-direct` address carries the
+ *   certificate's hash, and the node generates a new certificate when it
+ *   restarts. When this address stops working, look the CID up again — the
+ *   peer id is the stable part.
+ * - **Only one router will tell you.** Aleph announces over the DHT rather
+ *   than IPNI, so `cid.contact` — the one router that answers a browser with
+ *   CORS — does not know its CIDs, while `delegated-ipfs.dev` does and sends
+ *   no CORS header for provider lookups. From a page, this constant is the way
+ *   in; from Node, {@link providersFor} with `delegated-ipfs.dev` is better.
+ */
+export const ALEPH_BITSWAP = Object.freeze([
+  "/ip4/46.255.204.211/udp/4001/webrtc-direct/certhash/uEiCbM9yMfnP02vviIL26n8bI0-vU0DGUHx20POBLKGjEmg/p2p/12D3KooWACE5dRw5V9WXuDTcngjE3ZaDSZ4qYJGfuhXZbENnL54y",
+  "/ip4/46.255.204.211/udp/4001/quic-v1/webtransport/certhash/uEiDMxOK9kZFH5SW6zcmNpXU4EGgBgvZYqqlJhw1cci50KA/certhash/uEiCeRpuyQWojWx2cP8guNiY3EDfIF25D2k8CMTZd1qtSfw/p2p/12D3KooWACE5dRw5V9WXuDTcngjE3ZaDSZ4qYJGfuhXZbENnL54y",
+]);
+
+/** Aleph's peer id, which outlives the certificate hashes above. */
+export const ALEPH_PEER_ID = "12D3KooWACE5dRw5V9WXuDTcngjE3ZaDSZ4qYJGfuhXZbENnL54y";
+
+/**
+ * Routers that answer a page.
+ *
+ * Both send `access-control-allow-origin: *` for provider lookups. An earlier
+ * version of this file said `delegated-ipfs.dev` did not, from one request that
+ * came back without the header; repeated from a deployed page it answers with
+ * it, so the restriction was wrong and this list is both.
+ *
+ * What is true, and matters more, is that they know **different things**:
+ * `cid.contact` is an IPNI index and knows what is announced to it — Pinata's
+ * CIDs and Lighthouse's were there — while a CID that Aleph holds appeared only
+ * at `delegated-ipfs.dev`, because Aleph announces over the DHT. Asking one
+ * router is asking half the network.
+ */
+export const DEFAULT_ROUTERS = Object.freeze([
+  "https://cid.contact",
+  "https://delegated-ipfs.dev",
+]);
+
+/** @deprecated Same as {@link DEFAULT_ROUTERS}; kept so an import still works. */
+export const ALL_ROUTERS = DEFAULT_ROUTERS;
+
+/**
+ * Transports a browser can dial.
+ *
+ * `tcp` and plain `quic-v1` are not here: a page has no raw sockets. `tls/ws`
+ * needs a name rather than an IP, since the certificate has to match — an
+ * AutoTLS `libp2p.direct` address qualifies only while that name resolves,
+ * which for one provider it did not on the day this was written.
+ */
+export const BROWSER_TRANSPORTS = Object.freeze([
+  "/wss",
+  "/tls/ws",
+  "/webtransport",
+  "/webrtc-direct",
+]);
+
+const DEFAULT_TIMEOUT_MS = 30_000;
+
+/** Quiet by default, like `gateway-fetch.js`. */
+export const SILENT = { info() {}, warn() {}, debug() {} };
+
+/** Does this multiaddr use a transport a page can open? */
+export function isBrowserDialable(addr) {
+  if (typeof addr !== "string") return false;
+  if (!BROWSER_TRANSPORTS.some((transport) => addr.includes(transport))) return false;
+  // A certificate cannot be issued for a bare IP, so ws/wss on one is not
+  // dialable however well-formed it looks; webtransport and webrtc-direct
+  // carry a certhash instead and are fine.
+  const needsName = addr.includes("/wss") || addr.includes("/tls/ws");
+  return !needsName || addr.includes("/dns");
+}
+
+/**
+ * Who says they hold this CID, and at what address.
+ *
+ * @param {string} cid
+ * @param {Object} [options]
+ * @param {string[]} [options.routers] - delegated routing endpoints
+ * @param {boolean} [options.dialableOnly=true] - keep only what a page can open
+ * @param {AbortSignal} [options.signal]
+ * @param {typeof fetch} [options.fetchImpl]
+ * @returns {Promise<Array<{ id: string, addrs: string[] }>>}
+ */
+export async function providersFor(cid, {
+  routers = DEFAULT_ROUTERS,
+  dialableOnly = true,
+  signal = null,
+  fetchImpl = fetch,
+  log = SILENT,
+} = {}) {
+  const found = new Map();
+
+  for (const router of routers) {
+    try {
+      const response = await fetchImpl(`${router}/routing/v1/providers/${cid}`, {
+        headers: { Accept: "application/json" },
+        signal,
+      });
+      if (!response.ok) {
+        log.debug(`   ⚠️ ${router} answered ${response.status}`);
+        continue;
+      }
+      const body = await response.text();
+      for (const record of parseProviderRecords(body)) {
+        const id = record.ID ?? record.id;
+        if (!id) continue;
+        const addrs = (record.Addrs ?? record.addrs ?? []).filter(
+          (addr) => !dialableOnly || isBrowserDialable(addr),
+        );
+        if (addrs.length === 0) continue;
+        const already = found.get(id);
+        if (already) {
+          for (const addr of addrs) if (!already.addrs.includes(addr)) already.addrs.push(addr);
+        } else {
+          found.set(id, { id, addrs: [...addrs] });
+        }
+      }
+    } catch (error) {
+      log.debug(`   ⚠️ ${router} failed: ${error.message}`);
+    }
+  }
+
+  return [...found.values()];
+}
+
+/**
+ * A routing answer is JSON, or one JSON object per line when the router
+ * streams — both shapes are in the spec, and both are in the wild.
+ */
+function parseProviderRecords(body) {
+  const records = [];
+  const push = (value) => {
+    if (!value) return;
+    if (Array.isArray(value.Providers)) records.push(...value.Providers);
+    else if (Array.isArray(value.providers)) records.push(...value.providers);
+    else records.push(value);
+  };
+  try {
+    push(JSON.parse(body));
+    return records;
+  } catch {
+    // not one document — try it as a stream of them
+  }
+  for (const line of body.split("\n")) {
+    const trimmed = line.trim();
+    if (!trimmed) continue;
+    try {
+      push(JSON.parse(trimmed));
+    } catch {
+      // a partial line at the end of a stream; nothing to do with it
+    }
+  }
+  return records;
+}
+
+/**
+ * Build a `fetchBytes(cid)` that goes over libp2p.
+ *
+ * Fits where `restoreFromCID`'s `fetchBytes` goes, so nothing downstream
+ * changes: the blocks are verified against their CIDs exactly as before, which
+ * is what makes a stranger's bytes as safe as a gateway's.
+ *
+ * @param {Object} options
+ * @param {Object} options.helia - a started Helia **with bitswap**
+ * @param {string[] | ((cid: string) => Promise<string[]>)} options.providers -
+ *   multiaddrs to dial, or a function that finds them for a CID
+ * @param {number} [options.timeout]
+ * @param {(addr: string) => Promise<unknown>} [options.dial] - defaults to the node's
+ * @param {(cid: any, options?: Object) => AsyncIterable<Uint8Array>} [options.cat] -
+ *   defaults to `@helia/unixfs`, which reads a chunked file as well as a single block
+ * @returns {(cid: string, options?: Object) => Promise<Uint8Array>}
+ */
+export function createPeerFetch({
+  helia,
+  providers = [],
+  timeout = DEFAULT_TIMEOUT_MS,
+  dial = null,
+  cat = null,
+  log = SILENT,
+} = {}) {
+  if (!helia && (!dial || !cat)) {
+    throw new Error("createPeerFetch needs a Helia node, or both dial and cat");
+  }
+
+  return async function fetchOverPeers(cid, options = {}) {
+    const signal = options.signal ?? AbortSignal.timeout(options.timeout ?? timeout);
+    const addrs =
+      typeof providers === "function" ? await providers(cid) : [...providers];
+
+    if (addrs.length === 0) {
+      throw new Error(`No provider to dial for ${cid}`);
+    }
+
+    const dialOne = dial ?? (async (addr) => {
+      const { multiaddr } = await import("@multiformats/multiaddr");
+      return helia.libp2p.dial(multiaddr(addr), { signal });
+    });
+
+    // One connection per peer, not one per address. A provider usually
+    // advertises the same peer several times — Aleph offers webrtc-direct and
+    // webtransport — and dialling both gets two connections to one node, which
+    // buys nothing and makes a peer count read double.
+    const reached = new Set();
+    for (const addr of addrs) {
+      const peer = addr.match(/\/p2p\/([^/]+)/)?.[1] ?? addr;
+      if (reached.has(peer)) continue;
+      try {
+        await dialOne(addr);
+        reached.add(peer);
+        log.debug(`   ✅ dialled ${addr}`);
+      } catch (error) {
+        log.debug(`   ⚠️ could not dial ${addr}: ${error.message}`);
+      }
+    }
+    const dialed = reached.size;
+    if (dialed === 0) {
+      throw new Error(`Could not dial any provider for ${cid} (tried ${addrs.length})`);
+    }
+
+    const read = cat ?? (await unixfsCat(helia));
+    const parts = [];
+    let total = 0;
+    for await (const chunk of read(cid, { signal })) {
+      parts.push(chunk);
+      total += chunk.length;
+    }
+    const bytes = new Uint8Array(total);
+    let at = 0;
+    for (const part of parts) {
+      bytes.set(part, at);
+      at += part.length;
+    }
+    log.info(`   ✅ ${bytes.length} bytes over libp2p from ${dialed} peer(s)`);
+    return bytes;
+  };
+}
+
+/**
+ * `@helia/unixfs` rather than the blockstore: a backup large enough to be
+ * chunked is a DAG, and `blockstore.get` would return its root block and call
+ * that the file. Imported here so a caller that supplies `cat` never loads it.
+ */
+async function unixfsCat(helia) {
+  const [{ unixfs }, { CID }] = await Promise.all([
+    import("@helia/unixfs"),
+    import("multiformats/cid"),
+  ]);
+  const fs = unixfs(helia);
+  return (cid, options) => fs.cat(typeof cid === "string" ? CID.parse(cid) : cid, options);
+}
+
+/**
+ * Try HTTP first, then peers — and say which one delivered.
+ *
+ * The order is not a preference for HTTP: a warm gateway answered in 0.23 s
+ * against 0.86–1.9 s over libp2p, and a phone on a rationed connection should
+ * not open a swarm for a file one request would have fetched. But the timeout
+ * is short on purpose, because the other measurement from the same day is a
+ * gateway taking 29 s for a block a peer served in under one.
+ *
+ * @param {Object} options
+ * @param {(cid: string, options?: Object) => Promise<Uint8Array>} options.viaGateway
+ * @param {(cid: string, options?: Object) => Promise<Uint8Array>} options.viaPeers
+ * @param {number} [options.gatewayTimeout=3000] - before the peer path starts
+ * @param {(path: "gateway"|"peers", info: Object) => void} [options.onPath] -
+ *   told which path was taken and how long it took, so a page can show it
+ * @returns {(cid: string, options?: Object) => Promise<Uint8Array>}
+ */
+export function createGatewayFirstFetch({
+  viaGateway,
+  viaPeers,
+  gatewayTimeout = 3000,
+  onPath = () => {},
+  now = () => Date.now(),
+} = {}) {
+  return async function fetchBytes(cid, options = {}) {
+    const started = now();
+    try {
+      const bytes = await viaGateway(cid, { ...options, timeout: gatewayTimeout });
+      onPath("gateway", { cid, ms: now() - started, bytes: bytes.length });
+      return bytes;
+    } catch (error) {
+      const gatewayMs = now() - started;
+      const peersStarted = now();
+      try {
+        const bytes = await viaPeers(cid, options);
+        onPath("peers", {
+          cid,
+          ms: now() - peersStarted,
+          bytes: bytes.length,
+          after: { path: "gateway", ms: gatewayMs, error: error.message },
+        });
+        return bytes;
+      } catch (peerError) {
+        throw new Error(
+          `Could not fetch ${cid}: the gateway said "${error.message}" and the peers said "${peerError.message}"`,
+          { cause: peerError },
+        );
+      }
+    }
+  };
+}

package/lib/ucan-bridge.js

@@ -102,7 +102,7 @@ function findCorrectManifest(analysis) {
  */
 const DEFAULT_UCAN_OPTIONS = {
   timeout: 30000,
-  gateway: "https://w3s.link",
+  gateway: "https://ipfs.aleph.cloud", // w3s.link redirects to a gateway retired on 2026-09-21
   batchSize: 10,
   maxConcurrency: 3,
   // UCAN-specific options

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@le-space/orbitdb-storage-bridge",
-  "version": "0.11.0",
+  "version": "0.13.0",
   "description": "Back up, restore and replicate OrbitDB databases through pluggable storage backends, with hash and identity preservation",
   "main": "lib/orbitdb-storacha-bridge.js",
   "svelte": "dist/components/",
@@ -16,6 +16,7 @@
     "./dehydrate": "./lib/dehydrate.js",
     "./restore-cid": "./lib/restore-cid.js",
     "./gateway-fetch": "./lib/gateway-fetch.js",
+    "./peer-fetch": "./lib/peer-fetch.js",
     "./backends/types": "./lib/backends/types.js",
     "./backends/memory": "./lib/backends/memory.js",
     "./backends/storacha": "./lib/backends/storacha.js",
@@ -24,6 +25,7 @@
     "./backends/pinata": "./lib/backends/pinata.js",
     "./backends/lighthouse": "./lib/backends/lighthouse.js",
     "./backends/mirror": "./lib/backends/mirror.js",
+    "./backends/encryption": "./lib/backends/encryption.js",
     "./backends/choose": "./lib/backends/choose.js",
     "./backends/resolve": "./lib/backends/resolve.js",
     "./memory-courier": "./lib/memory-courier.js",
@@ -86,7 +88,6 @@
   "dependencies": {
     "@chainsafe/libp2p-noise": "^17.0.0",
     "@chainsafe/libp2p-yamux": "^8.0.1",
-    "@helia/block-brokers": "^5.2.4",
     "@helia/routers": "^5.1.1",
     "@helia/unixfs": "^8.0.7",
     "@ipld/car": "^5.4.1",
@@ -108,7 +109,7 @@
     "cbor-web": "^10.0.11",
     "datastore-level": "^13.0.1",
     "dotenv": "^17.2.1",
-    "helia": "^7.1.12",
+    "helia": "^7.1.15",
     "libp2p": "^3.3.6",
     "multiformats": "^14.0.5"
   },