@metalabel/dfos-web-relay 0.4.1 → 0.6.0

package/dist/index.js

@@ -1,23 +1,33 @@
-// src/relay.ts
-import { VC_TYPE_CONTENT_READ, verifyCredential } from "@metalabel/dfos-protocol/credentials";
-import { dagCborCanonicalEncode as dagCborCanonicalEncode2, decodeJwsUnsafe as decodeJwsUnsafe3 } from "@metalabel/dfos-protocol/crypto";
-import { Hono } from "hono";
-import { z } from "zod";
-
-// src/auth.ts
-import { verifyAuthToken } from "@metalabel/dfos-protocol/credentials";
-import { decodeJwsUnsafe as decodeJwsUnsafe2 } from "@metalabel/dfos-protocol/crypto";
+// src/bootstrap.ts
+import {
+  encodeEd25519Multikey,
+  signArtifact,
+  signIdentityOperation
+} from "@metalabel/dfos-protocol/chain";
+import {
+  createNewEd25519Keypair,
+  generateId,
+  signPayloadEd25519
+} from "@metalabel/dfos-protocol/crypto";
 
 // src/ingest.ts
 import {
   decodeMultikey,
+  verifyArtifact,
   verifyBeacon,
-  verifyBeaconCountersignature,
   verifyContentChain,
+  verifyContentExtensionFromTrustedState,
   verifyCountersignature,
-  verifyIdentityChain
+  verifyIdentityChain,
+  verifyIdentityExtensionFromTrustedState
 } from "@metalabel/dfos-protocol/chain";
 import { dagCborCanonicalEncode, decodeJwsUnsafe } from "@metalabel/dfos-protocol/crypto";
+var MAX_FUTURE_TIMESTAMP_MS = 24 * 60 * 60 * 1e3;
+var isFutureTimestamp = (createdAt) => {
+  const ts = new Date(createdAt).getTime();
+  if (isNaN(ts)) return false;
+  return ts > Date.now() + MAX_FUTURE_TIMESTAMP_MS;
+};
 var classify = (jwsToken) => {
   const unknown = {
     jwsToken,
@@ -44,30 +54,10 @@ var classify = (jwsToken) => {
   }
   if (typ === "did:dfos:content-op") {
     const opDID = typeof payload["did"] === "string" ? payload["did"] : null;
-    if (opDID && kidDID && kidDID !== opDID) {
-      return {
-        ...base,
-        kind: "countersig",
-        referencedDID: opDID,
-        signerDID: kidDID,
-        priority: 3,
-        previousCID: null
-      };
-    }
     return { ...base, kind: "content-op", referencedDID: null, signerDID: opDID, priority: 2 };
   }
   if (typ === "did:dfos:beacon") {
     const beaconDID = typeof payload["did"] === "string" ? payload["did"] : null;
-    if (beaconDID && kidDID && kidDID !== beaconDID) {
-      return {
-        ...base,
-        kind: "beacon-countersig",
-        referencedDID: beaconDID,
-        signerDID: kidDID,
-        priority: 3,
-        previousCID: null
-      };
-    }
     return {
       ...base,
       kind: "beacon",
@@ -77,6 +67,30 @@ var classify = (jwsToken) => {
       previousCID: null
     };
   }
+  if (typ === "did:dfos:countersign") {
+    const witnessDID = typeof payload["did"] === "string" ? payload["did"] : null;
+    return {
+      ...base,
+      kind: "countersign",
+      referencedDID: witnessDID,
+      signerDID: null,
+      priority: 3,
+      // processed last — target must already be ingested
+      previousCID: null
+    };
+  }
+  if (typ === "did:dfos:artifact") {
+    const artifactDID = typeof payload["did"] === "string" ? payload["did"] : null;
+    return {
+      ...base,
+      kind: "artifact",
+      referencedDID: artifactDID,
+      signerDID: null,
+      priority: 1,
+      // same as beacons — needs identity keys resolved first
+      previousCID: null
+    };
+  }
   return unknown;
 };
 var createKeyResolver = (store) => async (kid) => {
@@ -128,12 +142,16 @@ var createCurrentKeyResolver = (store) => async (kid) => {
   if (currentKey) return decodeMultikey(currentKey.publicKeyMultibase).keyBytes;
   throw new Error(`unknown key ${keyId} on identity ${did}`);
 };
-var ingestIdentityOp = async (jwsToken, store) => {
+var ingestIdentityOp = async (jwsToken, store, logEnabled) => {
   const decoded = decodeJwsUnsafe(jwsToken);
   if (!decoded) return { cid: "", status: "rejected", error: "failed to decode JWS" };
   const payload = decoded.payload;
   const encoded = await dagCborCanonicalEncode(payload);
   const cid = encoded.cid.toString();
+  const createdAtVal = payload["createdAt"];
+  if (typeof createdAtVal === "string" && isFutureTimestamp(createdAtVal)) {
+    return { cid, status: "rejected", error: "createdAt is too far in the future" };
+  }
   const existing = await store.getOperation(cid);
   if (existing) {
     if (existing.jwsToken !== jwsToken) {
@@ -143,16 +161,26 @@ var ingestIdentityOp = async (jwsToken, store) => {
         error: "operation already exists with a different signature"
       };
     }
-    return { cid, status: "accepted", kind: "identity-op", chainId: existing.chainId };
+    return { cid, status: "duplicate", kind: "identity-op", chainId: existing.chainId };
   }
   const opType = payload["type"];
   const isGenesis = opType === "create";
   if (isGenesis) {
-    const identity2 = await verifyIdentityChain({ didPrefix: "did:dfos", log: [jwsToken] });
-    const chain2 = { did: identity2.did, log: [jwsToken], state: identity2 };
+    const identity = await verifyIdentityChain({ didPrefix: "did:dfos", log: [jwsToken] });
+    const createdAt = payload["createdAt"];
+    const chain2 = {
+      did: identity.did,
+      log: [jwsToken],
+      headCID: cid,
+      lastCreatedAt: createdAt,
+      state: identity
+    };
     await store.putIdentityChain(chain2);
-    await store.putOperation({ cid, jwsToken, chainType: "identity", chainId: identity2.did });
-    return { cid, status: "accepted", kind: "identity-op", chainId: identity2.did };
+    await store.putOperation({ cid, jwsToken, chainType: "identity", chainId: identity.did });
+    if (logEnabled) {
+      await store.appendToLog({ cid, jwsToken, kind: "identity-op", chainId: identity.did });
+    }
+    return { cid, status: "new", kind: "identity-op", chainId: identity.did };
   }
   const kid = decoded.header.kid;
   const hashIdx = kid.indexOf("#");
@@ -160,19 +188,78 @@ var ingestIdentityOp = async (jwsToken, store) => {
   const did = kid.substring(0, hashIdx);
   const chain = await store.getIdentityChain(did);
   if (!chain) return { cid, status: "rejected", error: `unknown identity: ${did}` };
-  const newLog = [...chain.log, jwsToken];
-  const identity = await verifyIdentityChain({ didPrefix: "did:dfos", log: newLog });
-  const updated = { did: identity.did, log: newLog, state: identity };
+  const previousCID = typeof payload["previousOperationCID"] === "string" ? payload["previousOperationCID"] : null;
+  if (previousCID === chain.headCID) {
+    const extResult2 = await verifyIdentityExtensionFromTrustedState({
+      currentState: chain.state,
+      headCID: chain.headCID,
+      lastCreatedAt: chain.lastCreatedAt,
+      newOp: jwsToken
+    });
+    const updated2 = {
+      did: chain.did,
+      log: [...chain.log, jwsToken],
+      headCID: extResult2.operationCID,
+      lastCreatedAt: extResult2.createdAt,
+      state: extResult2.state
+    };
+    await store.putIdentityChain(updated2);
+    await store.putOperation({ cid, jwsToken, chainType: "identity", chainId: did });
+    if (logEnabled) {
+      await store.appendToLog({ cid, jwsToken, kind: "identity-op", chainId: did });
+    }
+    return { cid, status: "new", kind: "identity-op", chainId: did };
+  }
+  if (!previousCID || !chainLogContainsCID(chain.log, previousCID)) {
+    return { cid, status: "rejected", error: "unknown previous operation in identity chain" };
+  }
+  const forkState = await store.getIdentityStateAtCID(did, previousCID);
+  if (!forkState) {
+    return { cid, status: "rejected", error: "failed to compute state at fork point" };
+  }
+  const extResult = await verifyIdentityExtensionFromTrustedState({
+    currentState: forkState.state,
+    headCID: previousCID,
+    lastCreatedAt: forkState.lastCreatedAt,
+    newOp: jwsToken
+  });
+  const updatedLog = [...chain.log, jwsToken];
+  const head = selectDeterministicHead(updatedLog);
+  let headState = chain.state;
+  let headLastCreatedAt = chain.lastCreatedAt;
+  let headCID = chain.headCID;
+  if (head.cid === cid) {
+    headState = extResult.state;
+    headLastCreatedAt = extResult.createdAt;
+    headCID = cid;
+  } else {
+    headCID = head.cid;
+    headLastCreatedAt = head.createdAt;
+  }
+  const updated = {
+    did: chain.did,
+    log: updatedLog,
+    headCID,
+    lastCreatedAt: headLastCreatedAt,
+    state: headState
+  };
   await store.putIdentityChain(updated);
   await store.putOperation({ cid, jwsToken, chainType: "identity", chainId: did });
-  return { cid, status: "accepted", kind: "identity-op", chainId: did };
+  if (logEnabled) {
+    await store.appendToLog({ cid, jwsToken, kind: "identity-op", chainId: did });
+  }
+  return { cid, status: "new", kind: "identity-op", chainId: did };
 };
-var ingestContentOp = async (jwsToken, store) => {
+var ingestContentOp = async (jwsToken, store, logEnabled) => {
   const decoded = decodeJwsUnsafe(jwsToken);
   if (!decoded) return { cid: "", status: "rejected", error: "failed to decode JWS" };
   const payload = decoded.payload;
   const encoded = await dagCborCanonicalEncode(payload);
   const cid = encoded.cid.toString();
+  const createdAtVal = payload["createdAt"];
+  if (typeof createdAtVal === "string" && isFutureTimestamp(createdAtVal)) {
+    return { cid, status: "rejected", error: "createdAt is too far in the future" };
+  }
   const existing = await store.getOperation(cid);
   if (existing) {
     if (existing.jwsToken !== jwsToken) {
@@ -182,7 +269,7 @@ var ingestContentOp = async (jwsToken, store) => {
         error: "operation already exists with a different signature"
       };
     }
-    return { cid, status: "accepted", kind: "content-op", chainId: existing.chainId };
+    return { cid, status: "duplicate", kind: "content-op", chainId: existing.chainId };
   }
   const signerDID = payload["did"];
   if (typeof signerDID === "string") {
@@ -195,20 +282,25 @@ var ingestContentOp = async (jwsToken, store) => {
   const opType = payload["type"];
   const isGenesis = opType === "create";
   if (isGenesis) {
-    const content2 = await verifyContentChain({
+    const content = await verifyContentChain({
       log: [jwsToken],
       resolveKey,
       enforceAuthorization: true
     });
+    const createdAt = payload["createdAt"];
     const chain2 = {
-      contentId: content2.contentId,
-      genesisCID: content2.genesisCID,
+      contentId: content.contentId,
+      genesisCID: content.genesisCID,
       log: [jwsToken],
-      state: content2
+      lastCreatedAt: createdAt,
+      state: content
     };
     await store.putContentChain(chain2);
-    await store.putOperation({ cid, jwsToken, chainType: "content", chainId: content2.contentId });
-    return { cid, status: "accepted", kind: "content-op", chainId: content2.contentId };
+    await store.putOperation({ cid, jwsToken, chainType: "content", chainId: content.contentId });
+    if (logEnabled) {
+      await store.appendToLog({ cid, jwsToken, kind: "content-op", chainId: content.contentId });
+    }
+    return { cid, status: "new", kind: "content-op", chainId: content.contentId };
   }
   const previousCID = payload["previousOperationCID"];
   if (typeof previousCID !== "string") {
@@ -227,26 +319,65 @@ var ingestContentOp = async (jwsToken, store) => {
   if (creatorIdentity?.state.isDeleted) {
     return { cid, status: "rejected", error: "content creator identity is deleted" };
   }
-  if (chain.state.headCID !== previousCID) {
-    return { cid, status: "rejected", error: "chain has diverged (first-seen-wins)" };
+  if (chain.state.headCID === previousCID) {
+    const extResult2 = await verifyContentExtensionFromTrustedState({
+      currentState: chain.state,
+      lastCreatedAt: chain.lastCreatedAt,
+      newOp: jwsToken,
+      resolveKey,
+      enforceAuthorization: true
+    });
+    const updated2 = {
+      contentId: chain.contentId,
+      genesisCID: chain.genesisCID,
+      log: [...chain.log, jwsToken],
+      lastCreatedAt: extResult2.createdAt,
+      state: extResult2.state
+    };
+    await store.putContentChain(updated2);
+    await store.putOperation({ cid, jwsToken, chainType: "content", chainId: chain.contentId });
+    if (logEnabled) {
+      await store.appendToLog({ cid, jwsToken, kind: "content-op", chainId: chain.contentId });
+    }
+    return { cid, status: "new", kind: "content-op", chainId: chain.contentId };
+  }
+  if (!chainLogContainsCID(chain.log, previousCID)) {
+    return { cid, status: "rejected", error: "unknown previous operation in content chain" };
+  }
+  const forkState = await store.getContentStateAtCID(chain.contentId, previousCID);
+  if (!forkState) {
+    return { cid, status: "rejected", error: "failed to compute state at fork point" };
   }
-  const newLog = [...chain.log, jwsToken];
-  const content = await verifyContentChain({
-    log: newLog,
+  const extResult = await verifyContentExtensionFromTrustedState({
+    currentState: forkState.state,
+    lastCreatedAt: forkState.lastCreatedAt,
+    newOp: jwsToken,
     resolveKey,
     enforceAuthorization: true
   });
+  const updatedLog = [...chain.log, jwsToken];
+  const head = selectDeterministicHead(updatedLog);
+  let headState = chain.state;
+  let headLastCreatedAt = chain.lastCreatedAt;
+  if (head.cid === cid) {
+    headState = extResult.state;
+    headLastCreatedAt = extResult.createdAt;
+  }
   const updated = {
-    contentId: content.contentId,
-    genesisCID: content.genesisCID,
-    log: newLog,
-    state: content
+    contentId: chain.contentId,
+    genesisCID: chain.genesisCID,
+    log: updatedLog,
+    lastCreatedAt: headLastCreatedAt,
+    state: headState
   };
   await store.putContentChain(updated);
-  await store.putOperation({ cid, jwsToken, chainType: "content", chainId: content.contentId });
-  return { cid, status: "accepted", kind: "content-op", chainId: content.contentId };
+  await store.putOperation({ cid, jwsToken, chainType: "content", chainId: chain.contentId });
+  if (logEnabled) {
+    await store.appendToLog({ cid, jwsToken, kind: "content-op", chainId: chain.contentId });
+  }
+  return { cid, status: "new", kind: "content-op", chainId: chain.contentId };
 };
-var ingestBeacon = async (jwsToken, store) => {
+var ingestBeacon = async (jwsToken, store, logEnabled) => {
   const resolveKey = createKeyResolver(store);
   let verified;
   try {
@@ -266,76 +397,106 @@ var ingestBeacon = async (jwsToken, store) => {
     const existingTime = new Date(existing.state.payload.createdAt).getTime();
     const newTime = new Date(verified.payload.createdAt).getTime();
     if (newTime <= existingTime) {
-      return { cid, status: "accepted", kind: "beacon", chainId: did };
+      return { cid, status: "duplicate", kind: "beacon", chainId: did };
     }
   }
   await store.putBeacon({ did, jwsToken, beaconCID: cid, state: verified });
-  return { cid, status: "accepted", kind: "beacon", chainId: did };
-};
-var ingestCountersig = async (jwsToken, store) => {
-  const decoded = decodeJwsUnsafe(jwsToken);
-  if (!decoded) return { cid: "", status: "rejected", error: "failed to decode JWS" };
-  const payload = decoded.payload;
-  const encoded = await dagCborCanonicalEncode(payload);
-  const operationCID = encoded.cid.toString();
-  const existingOp = await store.getOperation(operationCID);
-  if (!existingOp) {
-    return { cid: operationCID, status: "rejected", error: `unknown operation: ${operationCID}` };
+  await store.putOperation({ cid, jwsToken, chainType: "beacon", chainId: did });
+  if (logEnabled) {
+    await store.appendToLog({ cid, jwsToken, kind: "beacon", chainId: did });
   }
+  return { cid, status: "new", kind: "beacon", chainId: did };
+};
+var ingestCountersign = async (jwsToken, store, logEnabled) => {
   const resolveKey = createKeyResolver(store);
+  let verified;
   try {
-    await verifyCountersignature({ jwsToken, expectedCID: operationCID, resolveKey });
+    verified = await verifyCountersignature({ jwsToken, resolveKey });
   } catch (err) {
     const message = err instanceof Error ? err.message : "verification failed";
-    return { cid: operationCID, status: "rejected", error: message };
+    return { cid: "", status: "rejected", error: message };
   }
-  await store.addCountersignature(operationCID, jwsToken);
-  return {
-    cid: operationCID,
-    status: "accepted",
-    kind: "countersig",
-    chainId: existingOp.chainId
-  };
-};
-var ingestBeaconCountersig = async (jwsToken, store) => {
-  const decoded = decodeJwsUnsafe(jwsToken);
-  if (!decoded) return { cid: "", status: "rejected", error: "failed to decode JWS" };
-  const payload = decoded.payload;
-  const encoded = await dagCborCanonicalEncode(payload);
-  const beaconCID = encoded.cid.toString();
-  const beaconDID = typeof payload["did"] === "string" ? payload["did"] : null;
-  if (!beaconDID) {
-    return { cid: beaconCID, status: "rejected", error: "missing beacon DID" };
+  const cid = verified.countersignCID;
+  const { witnessDID, targetCID } = verified;
+  const existing = await store.getOperation(cid);
+  if (existing) {
+    if (existing.jwsToken !== jwsToken) {
+      return {
+        cid,
+        status: "rejected",
+        error: "countersign already exists with a different signature"
+      };
+    }
+    return { cid, status: "duplicate", kind: "countersign", chainId: targetCID };
   }
-  const existingBeacon = await store.getBeacon(beaconDID);
-  if (!existingBeacon) {
-    return { cid: beaconCID, status: "rejected", error: `unknown beacon for DID: ${beaconDID}` };
+  const targetOp = await store.getOperation(targetCID);
+  if (!targetOp) {
+    return { cid, status: "rejected", error: `unknown target operation: ${targetCID}` };
   }
-  if (existingBeacon.beaconCID !== beaconCID) {
-    return {
-      cid: beaconCID,
-      status: "rejected",
-      error: "beacon countersignature CID does not match current beacon"
-    };
+  let targetAuthorDID = null;
+  if (targetOp.chainType === "identity") {
+    targetAuthorDID = targetOp.chainId;
+  } else {
+    const targetDecoded = decodeJwsUnsafe(targetOp.jwsToken);
+    if (targetDecoded) {
+      const targetPayload = targetDecoded.payload;
+      targetAuthorDID = typeof targetPayload["did"] === "string" ? targetPayload["did"] : null;
+    }
+  }
+  if (targetAuthorDID && witnessDID === targetAuthorDID) {
+    return { cid, status: "rejected", error: "witness DID must differ from target author DID" };
   }
+  const witnessIdentity = await store.getIdentityChain(witnessDID);
+  if (witnessIdentity?.state.isDeleted) {
+    return { cid, status: "rejected", error: "witness identity is deleted" };
+  }
+  const existingCountersigns = await store.getCountersignatures(targetCID);
+  for (const csJws of existingCountersigns) {
+    const csDecoded = decodeJwsUnsafe(csJws);
+    if (!csDecoded) continue;
+    const csPayload = csDecoded.payload;
+    if (csPayload["did"] === witnessDID) {
+      return { cid, status: "duplicate", kind: "countersign", chainId: targetCID };
+    }
+  }
+  await store.putOperation({ cid, jwsToken, chainType: "countersign", chainId: targetCID });
+  await store.addCountersignature(targetCID, jwsToken);
+  if (logEnabled) {
+    await store.appendToLog({ cid, jwsToken, kind: "countersign", chainId: targetCID });
+  }
+  return { cid, status: "new", kind: "countersign", chainId: targetCID };
+};
+var ingestArtifact = async (jwsToken, store, logEnabled) => {
   const resolveKey = createKeyResolver(store);
+  let verified;
   try {
-    await verifyBeaconCountersignature({
-      jwsToken,
-      expectedCID: beaconCID,
-      resolveKey
-    });
+    verified = await verifyArtifact({ jwsToken, resolveKey });
   } catch (err) {
     const message = err instanceof Error ? err.message : "verification failed";
-    return { cid: beaconCID, status: "rejected", error: message };
+    return { cid: "", status: "rejected", error: message };
   }
-  await store.addCountersignature(beaconCID, jwsToken);
-  return {
-    cid: beaconCID,
-    status: "accepted",
-    kind: "beacon-countersig",
-    chainId: beaconDID
-  };
+  const cid = verified.artifactCID;
+  const did = verified.payload.did;
+  const existing = await store.getOperation(cid);
+  if (existing) {
+    if (existing.jwsToken !== jwsToken) {
+      return {
+        cid,
+        status: "rejected",
+        error: "artifact already exists with a different signature"
+      };
+    }
+    return { cid, status: "duplicate", kind: "artifact", chainId: did };
+  }
+  const identity = await store.getIdentityChain(did);
+  if (identity?.state.isDeleted) {
+    return { cid, status: "rejected", error: "identity is deleted" };
+  }
+  await store.putOperation({ cid, jwsToken, chainType: "artifact", chainId: did });
+  if (logEnabled) {
+    await store.appendToLog({ cid, jwsToken, kind: "artifact", chainId: did });
+  }
+  return { cid, status: "new", kind: "artifact", chainId: did };
 };
 var dependencySort = (ops) => {
   const buckets = /* @__PURE__ */ new Map();
@@ -394,7 +555,36 @@ var topologicalSortBucket = (ops) => {
   }
   return sorted;
 };
-var ingestOperations = async (tokens, store) => {
+var chainLogContainsCID = (log, targetCID) => {
+  for (const jws of log) {
+    const decoded = decodeJwsUnsafe(jws);
+    if (!decoded) continue;
+    if (decoded.header.cid === targetCID) return true;
+  }
+  return false;
+};
+var selectDeterministicHead = (log) => {
+  const ops = [];
+  const hasChild = /* @__PURE__ */ new Set();
+  for (const jws of log) {
+    const decoded = decodeJwsUnsafe(jws);
+    if (!decoded) continue;
+    const payload = decoded.payload;
+    const cid = typeof decoded.header.cid === "string" ? decoded.header.cid : "";
+    const previousCID = typeof payload["previousOperationCID"] === "string" ? payload["previousOperationCID"] : null;
+    const createdAt = typeof payload["createdAt"] === "string" ? payload["createdAt"] : "";
+    ops.push({ cid, previousCID, createdAt });
+    if (previousCID) hasChild.add(previousCID);
+  }
+  const tips = ops.filter((op) => !hasChild.has(op.cid));
+  tips.sort((a, b) => {
+    if (a.createdAt !== b.createdAt) return b.createdAt.localeCompare(a.createdAt);
+    return b.cid.localeCompare(a.cid);
+  });
+  return tips[0] ?? { cid: "", createdAt: "" };
+};
+var ingestOperations = async (tokens, store, options) => {
+  const logEnabled = options?.logEnabled !== false;
   const classified = tokens.map((token, i) => ({ ...classify(token), originalIndex: i }));
   const sorted = dependencySort(classified);
   const indexedResults = [];
@@ -403,19 +593,19 @@ var ingestOperations = async (tokens, store) => {
       let result;
       switch (op.kind) {
         case "identity-op":
-          result = await ingestIdentityOp(op.jwsToken, store);
+          result = await ingestIdentityOp(op.jwsToken, store, logEnabled);
           break;
         case "content-op":
-          result = await ingestContentOp(op.jwsToken, store);
+          result = await ingestContentOp(op.jwsToken, store, logEnabled);
           break;
         case "beacon":
-          result = await ingestBeacon(op.jwsToken, store);
+          result = await ingestBeacon(op.jwsToken, store, logEnabled);
           break;
-        case "countersig":
-          result = await ingestCountersig(op.jwsToken, store);
+        case "countersign":
+          result = await ingestCountersign(op.jwsToken, store, logEnabled);
           break;
-        case "beacon-countersig":
-          result = await ingestBeaconCountersig(op.jwsToken, store);
+        case "artifact":
+          result = await ingestArtifact(op.jwsToken, store, logEnabled);
           break;
         default:
           result = { cid: "", status: "rejected", error: "unrecognized operation type" };
@@ -432,7 +622,114 @@ var ingestOperations = async (tokens, store) => {
   return indexedResults.sort((a, b) => a.index - b.index).map((r) => r.result);
 };
 
+// src/bootstrap.ts
+var bootstrapRelayIdentity = async (store) => {
+  const keypair = createNewEd25519Keypair();
+  const keyId = generateId("key");
+  const multibase = encodeEd25519Multikey(keypair.publicKey);
+  const signer = async (msg) => signPayloadEd25519(msg, keypair.privateKey);
+  const key = { id: keyId, type: "Multikey", publicKeyMultibase: multibase };
+  const identityOp = {
+    version: 1,
+    type: "create",
+    authKeys: [key],
+    assertKeys: [key],
+    controllerKeys: [key],
+    createdAt: (/* @__PURE__ */ new Date()).toISOString()
+  };
+  const { jwsToken: identityJws } = await signIdentityOperation({
+    operation: identityOp,
+    signer,
+    keyId
+  });
+  const [identityResult] = await ingestOperations([identityJws], store);
+  if (!identityResult || identityResult.status === "rejected" || !identityResult.chainId) {
+    throw new Error(`failed to bootstrap relay identity: ${identityResult?.error ?? "unknown"}`);
+  }
+  const did = identityResult.chainId;
+  const profilePayload = {
+    version: 1,
+    type: "artifact",
+    did,
+    content: {
+      $schema: "https://schemas.dfos.com/profile/v1",
+      name: "DFOS Relay"
+    },
+    createdAt: (/* @__PURE__ */ new Date()).toISOString()
+  };
+  const kid = `${did}#${keyId}`;
+  const { jwsToken: profileArtifactJws } = await signArtifact({
+    payload: profilePayload,
+    signer,
+    kid
+  });
+  const [artifactResult] = await ingestOperations([profileArtifactJws], store);
+  if (!artifactResult || artifactResult.status === "rejected") {
+    throw new Error(
+      `failed to ingest relay profile artifact: ${artifactResult?.error ?? "unknown"}`
+    );
+  }
+  return { did, profileArtifactJws };
+};
+
+// src/peer-client.ts
+var createHttpPeerClient = () => {
+  const fetchJSON = async (url) => {
+    try {
+      const res = await fetch(url);
+      if (!res.ok) return null;
+      return await res.json();
+    } catch {
+      return null;
+    }
+  };
+  return {
+    async getIdentityLog(peerUrl, did, params) {
+      const url = new URL(`/identities/${encodeURIComponent(did)}/log`, peerUrl);
+      if (params?.after) url.searchParams.set("after", params.after);
+      if (params?.limit) url.searchParams.set("limit", String(params.limit));
+      const data = await fetchJSON(url.toString());
+      if (!data?.entries) return null;
+      return { entries: data.entries, cursor: data.cursor ?? null };
+    },
+    async getContentLog(peerUrl, contentId, params) {
+      const url = new URL(`/content/${encodeURIComponent(contentId)}/log`, peerUrl);
+      if (params?.after) url.searchParams.set("after", params.after);
+      if (params?.limit) url.searchParams.set("limit", String(params.limit));
+      const data = await fetchJSON(url.toString());
+      if (!data?.entries) return null;
+      return { entries: data.entries, cursor: data.cursor ?? null };
+    },
+    async getOperationLog(peerUrl, params) {
+      const url = new URL("/log", peerUrl);
+      if (params?.after) url.searchParams.set("after", params.after);
+      if (params?.limit) url.searchParams.set("limit", String(params.limit));
+      const data = await fetchJSON(url.toString());
+      if (!data?.entries) return null;
+      return { entries: data.entries, cursor: data.cursor ?? null };
+    },
+    async submitOperations(peerUrl, operations) {
+      try {
+        await fetch(new URL("/operations", peerUrl).toString(), {
+          method: "POST",
+          headers: { "Content-Type": "application/json" },
+          body: JSON.stringify({ operations })
+        });
+      } catch {
+      }
+    }
+  };
+};
+
+// src/relay.ts
+import { VC_TYPE_CONTENT_READ, verifyCredential } from "@metalabel/dfos-protocol/credentials";
+import { dagCborCanonicalEncode as dagCborCanonicalEncode2, decodeJwsUnsafe as decodeJwsUnsafe3 } from "@metalabel/dfos-protocol/crypto";
+import { Hono } from "hono";
+import { z } from "zod";
+
 // src/auth.ts
+import { verifyAuthToken } from "@metalabel/dfos-protocol/credentials";
+import { decodeJwsUnsafe as decodeJwsUnsafe2 } from "@metalabel/dfos-protocol/crypto";
 var authenticateRequest = async (authHeader, relayDID, store) => {
   if (!authHeader) return null;
   if (!authHeader.startsWith("Bearer ")) return null;
@@ -460,14 +757,44 @@ var authenticateRequest = async (authHeader, relayDID, store) => {
 var IngestBody = z.object({
   operations: z.array(z.string()).min(1).max(100)
 });
-var createRelay = (options) => {
-  const { relayDID, store } = options;
+var createRelay = async (options) => {
+  const { store } = options;
+  const contentEnabled = options.content !== false;
+  const logEnabled = options.log !== false;
+  const peers = options.peers ?? [];
+  const peerClient = options.peerClient;
+  const gossipPeers = peers.filter((p) => p.gossip !== false);
+  const readThroughPeers = peers.filter((p) => p.readThrough !== false);
+  const syncPeers = peers.filter((p) => p.sync !== false);
+  const identity = options.identity ?? await bootstrapRelayIdentity(store);
+  const relayDID = identity.did;
+  const profileArtifactJws = identity.profileArtifactJws;
+  const ingestWithGossip = async (tokens) => {
+    const results = await ingestOperations(tokens, store, { logEnabled });
+    if (gossipPeers.length > 0 && peerClient) {
+      const newOps = [];
+      for (let i = 0; i < results.length; i++) {
+        if (results[i].status === "new") newOps.push(tokens[i]);
+      }
+      if (newOps.length > 0) {
+        for (const peer of gossipPeers) {
+          peerClient.submitOperations(peer.url, newOps).catch(() => {
+          });
+        }
+      }
+    }
+    return results;
+  };
   const app = new Hono();
   app.get("/.well-known/dfos-relay", (c) => {
     return c.json({
       did: relayDID,
       protocol: "dfos-web-relay",
-      version: "0.1.0"
+      version: "0.6.0",
+      proof: true,
+      content: contentEnabled,
+      log: logEnabled,
+      profile: profileArtifactJws
     });
   });
   app.post("/operations", async (c) => {
@@ -481,7 +808,7 @@ var createRelay = (options) => {
     if (!parsed.success) {
       return c.json({ error: "invalid request", details: parsed.error.issues }, 400);
     }
-    const results = await ingestOperations(parsed.data.operations, store);
+    const results = await ingestWithGossip(parsed.data.operations);
     return c.json({ results });
   });
   app.get("/operations/:cid", async (c) => {
@@ -495,24 +822,96 @@ var createRelay = (options) => {
       chainId: op.chainId
     });
   });
-  app.get("/identities/:did{.+}", async (c) => {
+  app.get("/identities/:did/log", async (c) => {
     const did = c.req.param("did");
     const chain = await store.getIdentityChain(did);
     if (!chain) return c.json({ error: "not found" }, 404);
+    const after = c.req.query("after");
+    const limit = Math.min(Number(c.req.query("limit") || 100), 1e3);
+    const entries = chain.log.map((jws) => {
+      const decoded = decodeJwsUnsafe3(jws);
+      return { cid: decoded?.header.cid || "", jwsToken: jws };
+    });
+    let startIdx = 0;
+    if (after) {
+      const idx = entries.findIndex((e) => e.cid === after);
+      startIdx = idx >= 0 ? idx + 1 : entries.length;
+    }
+    const page = entries.slice(startIdx, startIdx + limit);
+    const cursor = page.length === limit ? page[page.length - 1].cid : null;
+    return c.json({ entries: page, cursor });
+  });
+  app.get("/identities/:did{.+}", async (c) => {
+    const did = c.req.param("did");
+    let chain = await store.getIdentityChain(did);
+    if (!chain && readThroughPeers.length > 0 && peerClient) {
+      for (const peer of readThroughPeers) {
+        let after;
+        while (true) {
+          const logPage = await peerClient.getIdentityLog(peer.url, did, {
+            ...after ? { after } : {},
+            limit: 1e3
+          });
+          if (!logPage || logPage.entries.length === 0) break;
+          await ingestWithGossip(logPage.entries.map((e) => e.jwsToken));
+          if (!logPage.cursor) break;
+          after = logPage.cursor;
+        }
+        chain = await store.getIdentityChain(did);
+        if (chain) break;
+      }
+    }
+    if (!chain) return c.json({ error: "not found" }, 404);
     return c.json({
       did: chain.did,
-      log: chain.log,
+      headCID: chain.headCID,
       state: chain.state
     });
   });
-  app.get("/content/:contentId", async (c) => {
+  app.get("/content/:contentId/log", async (c) => {
     const contentId = c.req.param("contentId");
     const chain = await store.getContentChain(contentId);
     if (!chain) return c.json({ error: "not found" }, 404);
+    const after = c.req.query("after");
+    const limit = Math.min(Number(c.req.query("limit") || 100), 1e3);
+    const entries = chain.log.map((jws) => {
+      const decoded = decodeJwsUnsafe3(jws);
+      return { cid: decoded?.header.cid || "", jwsToken: jws };
+    });
+    let startIdx = 0;
+    if (after) {
+      const idx = entries.findIndex((e) => e.cid === after);
+      startIdx = idx >= 0 ? idx + 1 : entries.length;
+    }
+    const page = entries.slice(startIdx, startIdx + limit);
+    const cursor = page.length === limit ? page[page.length - 1].cid : null;
+    return c.json({ entries: page, cursor });
+  });
+  app.get("/content/:contentId", async (c) => {
+    const contentId = c.req.param("contentId");
+    let chain = await store.getContentChain(contentId);
+    if (!chain && readThroughPeers.length > 0 && peerClient) {
+      for (const peer of readThroughPeers) {
+        let after;
+        while (true) {
+          const logPage = await peerClient.getContentLog(peer.url, contentId, {
+            ...after ? { after } : {},
+            limit: 1e3
+          });
+          if (!logPage || logPage.entries.length === 0) break;
+          await ingestWithGossip(logPage.entries.map((e) => e.jwsToken));
+          if (!logPage.cursor) break;
+          after = logPage.cursor;
+        }
+        chain = await store.getContentChain(contentId);
+        if (chain) break;
+      }
+    }
+    if (!chain) return c.json({ error: "not found" }, 404);
     return c.json({
       contentId: chain.contentId,
       genesisCID: chain.genesisCID,
-      log: chain.log,
+      headCID: chain.state.headCID,
       state: chain.state
     });
   });
@@ -545,7 +944,15 @@ var createRelay = (options) => {
       payload: beacon.state.payload
     });
   });
+  app.get("/log", async (c) => {
+    if (!logEnabled) return c.json({ error: "global log not available" }, 501);
+    const afterParam = c.req.query("after");
+    const limit = Math.min(Number(c.req.query("limit") || 100), 1e3);
+    const result = await store.readLog(afterParam ? { after: afterParam, limit } : { limit });
+    return c.json(result);
+  });
   app.put("/content/:contentId/blob/:operationCID", async (c) => {
+    if (!contentEnabled) return c.json({ error: "content plane not available" }, 501);
     const contentId = c.req.param("contentId");
     const operationCID = c.req.param("operationCID");
     const auth = await authenticateRequest(c.req.header("authorization"), relayDID, store);
@@ -583,6 +990,7 @@ var createRelay = (options) => {
     return c.json({ status: "stored", contentId, documentCID, operationCID });
   });
   app.get("/content/:contentId/blob", async (c) => {
+    if (!contentEnabled) return c.json({ error: "content plane not available" }, 501);
     return await readBlob({
       contentId: c.req.param("contentId"),
       ref: "head",
@@ -593,6 +1001,7 @@ var createRelay = (options) => {
     });
   });
   app.get("/content/:contentId/blob/:ref", async (c) => {
+    if (!contentEnabled) return c.json({ error: "content plane not available" }, 501);
     return await readBlob({
       contentId: c.req.param("contentId"),
       ref: c.req.param("ref"),
@@ -602,7 +1011,24 @@ var createRelay = (options) => {
       store
     });
   });
-  return app;
+  const syncFromPeers = async () => {
+    if (!peerClient) return;
+    for (const peer of syncPeers) {
+      let cursor = await store.getPeerCursor(peer.url);
+      while (true) {
+        const page = await peerClient.getOperationLog(peer.url, {
+          ...cursor ? { after: cursor } : {},
+          limit: 1e3
+        });
+        if (!page || page.entries.length === 0) break;
+        await ingestWithGossip(page.entries.map((e) => e.jwsToken));
+        cursor = page.cursor ?? page.entries[page.entries.length - 1].cid;
+        await store.setPeerCursor(peer.url, cursor);
+        if (!page.cursor) break;
+      }
+    }
+  };
+  return { app, did: relayDID, syncFromPeers };
 };
 var jsonResponse = (body, status = 200) => new Response(JSON.stringify(body), {
   status,
@@ -685,6 +1111,7 @@ var verifyReadCredential = async (auth, chain, contentId, credHeader, store) =>
 };
 
 // src/store.ts
+import { verifyContentChain as verifyContentChain2, verifyIdentityChain as verifyIdentityChain2 } from "@metalabel/dfos-protocol/chain";
 import { decodeJwsUnsafe as decodeJwsUnsafe4 } from "@metalabel/dfos-protocol/crypto";
 var blobKeyString = (key) => `${key.creatorDID}::${key.documentCID}`;
 var MemoryRelayStore = class {
@@ -694,6 +1121,8 @@ var MemoryRelayStore = class {
   beacons = /* @__PURE__ */ new Map();
   blobs = /* @__PURE__ */ new Map();
   countersignatures = /* @__PURE__ */ new Map();
+  operationLog = [];
+  peerCursors = /* @__PURE__ */ new Map();
   async getOperation(cid) {
     return this.operations.get(cid);
   }
@@ -744,10 +1173,85 @@ var MemoryRelayStore = class {
     existing.push(jwsToken);
     this.countersignatures.set(operationCID, existing);
   }
+  async appendToLog(entry) {
+    this.operationLog.push(entry);
+  }
+  async readLog(params) {
+    let startIdx = 0;
+    if (params.after) {
+      const idx = this.operationLog.findIndex((e) => e.cid === params.after);
+      if (idx >= 0) startIdx = idx + 1;
+      else startIdx = this.operationLog.length;
+    }
+    const entries = this.operationLog.slice(startIdx, startIdx + params.limit);
+    const cursor = entries.length === params.limit ? entries[entries.length - 1].cid : null;
+    return { entries, cursor };
+  }
+  async getIdentityStateAtCID(did, cid) {
+    const chain = this.identityChains.get(did);
+    if (!chain) return null;
+    const opsByCID = /* @__PURE__ */ new Map();
+    for (const jws of chain.log) {
+      const decoded = decodeJwsUnsafe4(jws);
+      if (!decoded) continue;
+      const payload = decoded.payload;
+      const opCID = typeof decoded.header.cid === "string" ? decoded.header.cid : "";
+      const prevCID = typeof payload["previousOperationCID"] === "string" ? payload["previousOperationCID"] : null;
+      opsByCID.set(opCID, { jws, previousCID: prevCID });
+    }
+    if (!opsByCID.has(cid)) return null;
+    const path = [];
+    let currentCID = cid;
+    while (currentCID) {
+      const op = opsByCID.get(currentCID);
+      if (!op) return null;
+      path.unshift(op.jws);
+      currentCID = op.previousCID;
+    }
+    const identity = await verifyIdentityChain2({ didPrefix: "did:dfos", log: path });
+    const targetDecoded = decodeJwsUnsafe4(opsByCID.get(cid).jws);
+    const lastCreatedAt = typeof targetDecoded?.payload?.["createdAt"] === "string" ? (targetDecoded?.payload)["createdAt"] : "";
+    return { state: identity, lastCreatedAt };
+  }
+  async getContentStateAtCID(contentId, cid) {
+    const chain = this.contentChains.get(contentId);
+    if (!chain) return null;
+    const opsByCID = /* @__PURE__ */ new Map();
+    for (const jws of chain.log) {
+      const decoded = decodeJwsUnsafe4(jws);
+      if (!decoded) continue;
+      const payload = decoded.payload;
+      const opCID = typeof decoded.header.cid === "string" ? decoded.header.cid : "";
+      const prevCID = typeof payload["previousOperationCID"] === "string" ? payload["previousOperationCID"] : null;
+      opsByCID.set(opCID, { jws, previousCID: prevCID });
+    }
+    if (!opsByCID.has(cid)) return null;
+    const path = [];
+    let currentCID = cid;
+    while (currentCID) {
+      const op = opsByCID.get(currentCID);
+      if (!op) return null;
+      path.unshift(op.jws);
+      currentCID = op.previousCID;
+    }
+    const resolveKey = createKeyResolver(this);
+    const content = await verifyContentChain2({ log: path, resolveKey, enforceAuthorization: true });
+    const targetDecoded = decodeJwsUnsafe4(opsByCID.get(cid).jws);
+    const lastCreatedAt = typeof targetDecoded?.payload?.["createdAt"] === "string" ? (targetDecoded?.payload)["createdAt"] : "";
+    return { state: content, lastCreatedAt };
+  }
+  async getPeerCursor(peerUrl) {
+    return this.peerCursors.get(peerUrl);
+  }
+  async setPeerCursor(peerUrl, cursor) {
+    this.peerCursors.set(peerUrl, cursor);
+  }
 };
 export {
   MemoryRelayStore,
+  bootstrapRelayIdentity,
   createCurrentKeyResolver,
+  createHttpPeerClient,
   createKeyResolver,
   createRelay,
   ingestOperations