@mmstack/mesh-protocol 0.1.0

package/README.md

@@ -0,0 +1,149 @@
+# @mmstack/mesh-protocol
+
+> **Experimental.** The API may still change and this package is not yet battle-tested in production. Pin a version and expect some churn.
+
+The wire and room layer of the mmstack op protocol: envelope and message types, an `OpPolicy`
+seam with tripwire semantics, and a runtime-agnostic reference relay. Zero dependencies. It
+runs in Node, Bun, Cloudflare Durable Objects, or anywhere else, because it never touches a
+socket or a clock directly. You inject those.
+
+The Angular client that syncs a signal store over this protocol lives in
+[`@mmstack/mesh`](https://www.npmjs.com/package/@mmstack/mesh). This package is the piece a
+server (or a peer) runs.
+
+```bash
+npm install @mmstack/mesh-protocol
+```
+
+## What it is, and is not
+
+The op protocol replicates a store as a stream of small structural operations rather than whole
+snapshots (the same op-log that backs `@mmstack/worker`). A client emits an `OpEnvelope` per
+change; the relay assigns each one a room-scoped sequence number and fans it out. Because the
+relay only orders and stores opaque ops, it needs to understand nothing about your data. That
+is the point: a smart client with a dumb server.
+
+The relay is deliberately small. It sequences, keeps a journal, compacts a snapshot, answers a
+joining client with whatever it is missing, routes presence, and enforces an optional policy.
+It does not merge, validate schemas, or hold application logic. Conflict resolution is the
+client's job, and it happens per path, so two people editing different fields of the same
+record never collide.
+
+## The envelope
+
+```ts
+type OpEnvelope = {
+  proto: number;         // wire format version
+  origin: string;        // the emitting log instance (one per tab or device)
+  writer: string;        // the authenticated principal (a person or an agent)
+  version: number;       // per-origin counter, for gap detection
+  hlc: { p: number; l: number }; // hybrid logical clock, for last-writer-wins ordering
+  policyVersion: number; // the room policy this writer validated against
+  ops: readonly StoreOp[];
+};
+```
+
+`origin` and `writer` are separate on purpose. Two tabs of one signed-in user share a `writer`
+but differ by `origin`. `writer` is a stable, opaque pseudonym: the protocol forbids putting a
+real name in the envelope, so a person's display name lives in a mutable directory outside the
+journal and erasing them is a directory edit, not a history rewrite. The relay never mints
+identity; your adapter supplies `writer` from whatever authenticated the connection.
+
+## The relay
+
+```ts
+import { createRelay } from '@mmstack/mesh-protocol';
+
+const relay = createRelay({
+  policyVersion: 1,
+  policy: myOpPolicy,           // optional, see below
+  limits: { maxOpsPerEnvelope: 1024, maxEnvelopesPerSecond: 50 },
+  journalLimit: 1000,           // ops kept for delta catch-up before folding to a snapshot
+});
+```
+
+`relay.connect(socket, ctx)` attaches one authenticated connection and returns
+`{ receive, disconnect }`. You pump inbound frames into `receive` and call `disconnect` on
+close. The `socket` is anything with `send(msg)` and `close()`, so the same relay drives a
+`ws` server, a Durable Object, or an in-memory pair in a test.
+
+When a client joins, the relay answers with one of three shapes:
+
+- `up-to-date` when the client already has the latest sequence,
+- `delta` with just the envelopes it missed, for a quick reconnect,
+- `snapshot` with the full root, when the client is too far behind for the journal to cover.
+
+Deletes fold correctly into the snapshot, so a late joiner never resurrects a removed key.
+
+## Trust: `OpPolicy` and the tripwire
+
+Validation is a pure, versioned function, run the same way on the client (before it emits) and
+on the relay (before it accepts). Because an honest client never emits an invalid op, any
+invalid op the relay sees is a broken or hostile peer, so the relay ejects that writer for the
+rest of the session rather than trying to repair the stream.
+
+```ts
+import { pathPrefixAcl } from '@mmstack/mesh-protocol';
+
+const policy = pathPrefixAcl([
+  { prefix: ['notes'], allow: () => true },
+  { prefix: ['cases', '*', 'plan'], allow: (ctx) => ctx.kind !== 'agent' },
+]);
+```
+
+`pathPrefixAcl` grants write access by path prefix, and can discriminate by principal, so an
+agent peer can be given a narrower surface than a human. It is deny-by-default once any rule
+matches a path. For richer rules, write your own `OpPolicy` with `canWrite` and `validate`.
+Schema-aware validation (deriving a policy from your data model) composes on top and stays in
+your codebase, not here.
+
+## Adapter recipes
+
+The relay is pure over injected sockets, so an adapter is a few lines of glue.
+
+Node (`ws`):
+
+```ts
+import { WebSocketServer } from 'ws';
+import { createRelay } from '@mmstack/mesh-protocol';
+
+const relay = createRelay({ policyVersion: 1 });
+new WebSocketServer({ port: 8787 }).on('connection', (ws, req) => {
+  const writer = authenticate(req); // your auth (the relay never mints identity)
+  const conn = relay.connect(
+    { send: (m) => ws.send(JSON.stringify(m)), close: () => ws.close() },
+    { writer },
+  );
+  ws.on('message', (data) => conn.receive(JSON.parse(String(data))));
+  ws.on('close', () => conn.disconnect());
+});
+```
+
+Cloudflare Durable Objects (a room maps naturally onto an object):
+
+```ts
+export class MeshRoom {
+  relay = createRelay();
+  async fetch(request: Request) {
+    const { 0: client, 1: server } = new WebSocketPair();
+    server.accept();
+    const writer = await authenticate(request);
+    const conn = this.relay.connect(
+      { send: (m) => server.send(JSON.stringify(m)), close: () => server.close() },
+      { writer },
+    );
+    server.addEventListener('message', (e) => conn.receive(JSON.parse(String(e.data))));
+    server.addEventListener('close', () => conn.disconnect());
+    return new Response(null, { status: 101, webSocket: client });
+  }
+}
+```
+
+Durable storage (journal persistence across restarts) rides the same seam and lands with a
+later release. In-memory rooms cover dev and single-process deployments today.
+
+## WebRTC signaling
+
+The relay also routes opaque `signal` messages between peers by origin, which is all a
+peer-to-peer topology needs from a server. `@mmstack/mesh`'s `webRtcMesh` uses it to negotiate
+data channels; the relay itself carries no media and inspects no payloads.

package/index.d.ts

@@ -0,0 +1,216 @@
+//#region src/lib/wire.d.ts
+/**
+ * Canonical wire types of the mmstack op protocol (op-protocol RFC §3/§6). Structurally
+ * identical to the L0 types in `@mmstack/primitives` — deliberately NOT imported from there,
+ * so this package stays zero-dependency and never drags Angular peers onto a server. The
+ * client package asserts mutual assignability at compile time.
+ */
+type Key = string | number;
+type StoreOp = {
+  kind: 'set';
+  path: readonly Key[];
+  next: unknown;
+  prev?: unknown;
+} | {
+  kind: 'delete';
+  path: readonly Key[];
+  prev: unknown;
+};
+/** Hybrid logical clock stamp: physical epoch ms + logical counter. */
+type Hlc = {
+  readonly p: number;
+  readonly l: number;
+};
+declare const MESH_PROTO_VERSION = 1;
+type OpEnvelope = {
+  readonly proto: number;
+  readonly origin: string;
+  readonly writer: string;
+  readonly version: number;
+  readonly hlc: Hlc;
+  readonly policyVersion: number;
+  readonly ops: readonly StoreOp[];
+};
+/** An envelope the relay has ordered: `seq` is the room-scoped total order. */
+type SeqEnvelope = OpEnvelope & {
+  readonly seq: number;
+};
+type PresenceState = {
+  readonly origin: string;
+  readonly writer: string; /** Consumer-defined activity payload (cursor, section, agent activity descriptor…). */
+  readonly data: unknown;
+};
+type HelloMsg = {
+  readonly t: 'hello';
+  readonly room: string;
+  readonly origin: string;
+  readonly proto: number;
+  readonly policyVersion: number; /** Last room seq this client has applied — enables the delta answer on reconnect. */
+  readonly seq?: number;
+};
+type ClientEnvMsg = {
+  readonly t: 'env';
+  readonly room: string;
+  readonly env: OpEnvelope;
+};
+type ClientPresenceMsg = {
+  readonly t: 'presence';
+  readonly room: string;
+  readonly data: unknown;
+};
+/** Peer-to-peer signaling payload (WebRTC offer/answer/ICE); the relay only routes it. */
+type ClientSignalMsg = {
+  readonly t: 'signal';
+  readonly room: string;
+  readonly to: string;
+  readonly data: unknown;
+};
+type ClientMsg = HelloMsg | ClientEnvMsg | ClientPresenceMsg | ClientSignalMsg;
+/** The tri-state join answer (RFC §6), plus the current presence roster. */
+type WelcomeMsg = {
+  readonly t: 'welcome';
+  readonly room: string;
+  readonly seq: number;
+  /** Room-instance nonce: changes when a room is recreated (relay restart, DO eviction),
+   *  so clients know their seq watermark belongs to a dead seq space. */
+  readonly epoch: string;
+  readonly peers: readonly PresenceState[]; /** Origins currently in the room (membership ≠ presence) — the P2P bootstrap roster. */
+  readonly members: readonly string[];
+} & ({
+  readonly mode: 'up-to-date';
+} | {
+  readonly mode: 'delta';
+  readonly envs: readonly SeqEnvelope[];
+} | {
+  readonly mode: 'snapshot';
+  readonly root: unknown;
+});
+type ServerEnvMsg = {
+  readonly t: 'env';
+  readonly room: string;
+  readonly env: SeqEnvelope;
+};
+type ServerPresenceMsg = {
+  readonly t: 'presence';
+  readonly room: string;
+  readonly peer: PresenceState;
+  readonly gone?: boolean;
+};
+type RejectMsg = {
+  readonly t: 'reject';
+  readonly room: string;
+  readonly reason: 'proto' | 'policy-version' | 'unauthorized';
+  readonly expected?: number;
+};
+type EjectMsg = {
+  readonly t: 'eject';
+  readonly room: string;
+  readonly writer: string;
+  readonly reason: string;
+};
+/** Membership change broadcast (join/leave), independent of presence announcements. */
+type MemberMsg = {
+  readonly t: 'member';
+  readonly room: string;
+  readonly origin: string;
+  readonly gone?: boolean;
+};
+type ServerSignalMsg = {
+  readonly t: 'signal';
+  readonly room: string;
+  readonly from: string;
+  readonly data: unknown;
+};
+type ServerMsg = WelcomeMsg | ServerEnvMsg | ServerPresenceMsg | RejectMsg | EjectMsg | MemberMsg | ServerSignalMsg;
+/**
+ * Minimal pure op application for the relay's snapshot compaction — the same fold the L0
+ * `applyOps` performs, owned here so the protocol package stays dependency-free.
+ */
+declare function applyWireOps<T>(root: T, ops: readonly StoreOp[]): T;
+//#endregion
+//#region src/lib/policy.d.ts
+/**
+ * The principal behind a connection, as authenticated by the adapter (the relay never mints
+ * identity — RFC §3). `kind` distinguishes non-human peers: an agent is a user (§0), just one
+ * whose policy is usually narrower.
+ */
+type PrincipalCtx = {
+  readonly writer: string;
+  readonly kind?: 'human' | 'agent' | (string & {});
+  readonly claims?: Readonly<Record<string, unknown>>;
+};
+/**
+ * Pure, deterministic, versioned validation (RFC §7). Run symmetrically on emit and on
+ * apply: honest peers never emit invalid ops, so any violation observed on the wire is a
+ * buggy or malicious writer — tripwire semantics eject it deterministically. Never skip an
+ * op mid-log.
+ */
+type OpPolicy = {
+  canWrite?(ctx: PrincipalCtx, path: readonly Key[]): boolean;
+  validate?(op: StoreOp, ctx: PrincipalCtx): boolean;
+};
+type PolicyViolation = {
+  readonly writer: string;
+  readonly reason: 'can-write' | 'validate' | 'writer-mismatch' | 'proto' | 'ops-limit' | 'rate';
+  readonly path?: readonly Key[];
+};
+/** Check one envelope against a policy; `null` means clean. */
+declare function checkEnvelope(policy: OpPolicy | undefined, env: OpEnvelope, ctx: PrincipalCtx): PolicyViolation | null;
+/**
+ * S3-key-policy-style path ACL: each rule grants a principal predicate write access to one
+ * path prefix (`'*'` matches a single segment; a rule for `[]` grants the whole store).
+ * Composes into `OpPolicy.canWrite`; deny-by-default once any rule exists for a writer.
+ */
+type PathAclRule = {
+  readonly prefix: readonly (Key | '*')[];
+  readonly allow: (ctx: PrincipalCtx) => boolean;
+};
+declare function pathPrefixAcl(rules: readonly PathAclRule[]): OpPolicy;
+//#endregion
+//#region src/lib/relay.d.ts
+/** What the relay needs from a connection — implement over ws, a DO WebSocket, or a test pair. */
+type RelaySocket = {
+  send(msg: ServerMsg): void;
+  close?(): void;
+};
+type RelayLimits = {
+  /** Ops per envelope; a larger envelope is a violation (default 1024). */readonly maxOpsPerEnvelope?: number; /** Sustained envelopes/second per writer (token bucket, burst = 2×; off by default). */
+  readonly maxEnvelopesPerSecond?: number;
+};
+type RelayOptions = {
+  /** Validation/ACL applied to every envelope; violations eject the writer (tripwire). */readonly policy?: OpPolicy;
+  readonly policyVersion?: number;
+  readonly limits?: RelayLimits; /** Seq-envelopes retained per room for delta answers; older fold into the snapshot (default 1000). */
+  readonly journalLimit?: number;
+  readonly now?: () => number;
+  readonly onViolation?: (room: string, violation: PolicyViolation) => void;
+};
+type RelayConnection = {
+  receive(msg: ClientMsg): void;
+  disconnect(): void;
+};
+type RoomInfo = {
+  readonly seq: number;
+  readonly members: number;
+  readonly journal: number;
+};
+type Relay = {
+  /** Attach an authenticated connection. `ctx.writer` is the trusted principal. */connect(socket: RelaySocket, ctx: PrincipalCtx): RelayConnection;
+  room(name: string): RoomInfo | undefined;
+};
+/**
+ * The reference relay core (op-protocol RFC §6/§7): room-scoped sequencing, journal +
+ * snapshot compaction, the tri-state join answer, presence fan-out, and tripwire policy
+ * enforcement. Pure over injected sockets — runs identically under ws, Bun, a Durable
+ * Object, or an in-memory test pair. The relay never interprets ops beyond folding them
+ * for snapshots, and never mints identity: `writer` comes from the adapter's auth.
+ *
+ * Room-initialization contract: a fresh room (seq 0) answers `up-to-date`; the first client
+ * then SEEDS it with a root-set envelope so the room's snapshot root is complete (deletes
+ * fold correctly, joiners replace-hydrate). Near-simultaneous first-joins of a brand-new
+ * room may last-writer-wins their seeds; rooms created by a single client first (the
+ * overwhelmingly common case) are unaffected.
+ */
+declare function createRelay(opt?: RelayOptions): Relay;
+//#endregion
+export { type ClientEnvMsg, type ClientMsg, type ClientPresenceMsg, type ClientSignalMsg, type EjectMsg, type HelloMsg, type Hlc, type Key, MESH_PROTO_VERSION, type MemberMsg, type OpEnvelope, type OpPolicy, type PathAclRule, type PolicyViolation, type PresenceState, type PrincipalCtx, type RejectMsg, type Relay, type RelayConnection, type RelayLimits, type RelayOptions, type RelaySocket, type RoomInfo, type SeqEnvelope, type ServerEnvMsg, type ServerMsg, type ServerPresenceMsg, type ServerSignalMsg, type StoreOp, type WelcomeMsg, applyWireOps, checkEnvelope, createRelay, pathPrefixAcl };

package/index.js

@@ -0,0 +1,318 @@
+//#region src/lib/policy.ts
+/** Check one envelope against a policy; `null` means clean. */
+function checkEnvelope(policy, env, ctx) {
+	if (env.writer !== ctx.writer) return {
+		writer: ctx.writer,
+		reason: "writer-mismatch"
+	};
+	if (!policy) return null;
+	for (const op of env.ops) {
+		if (policy.canWrite && !policy.canWrite(ctx, op.path)) return {
+			writer: ctx.writer,
+			reason: "can-write",
+			path: op.path
+		};
+		if (policy.validate && !policy.validate(op, ctx)) return {
+			writer: ctx.writer,
+			reason: "validate",
+			path: op.path
+		};
+	}
+	return null;
+}
+function pathPrefixAcl(rules) {
+	return { canWrite: (ctx, path) => rules.some((rule) => {
+		if (rule.prefix.length > path.length) return false;
+		for (let i = 0; i < rule.prefix.length; i++) if (rule.prefix[i] !== "*" && String(rule.prefix[i]) !== String(path[i])) return false;
+		return rule.allow(ctx);
+	}) };
+}
+//#endregion
+//#region src/lib/wire.ts
+const MESH_PROTO_VERSION = 1;
+/**
+* Minimal pure op application for the relay's snapshot compaction — the same fold the L0
+* `applyOps` performs, owned here so the protocol package stays dependency-free.
+*/
+function applyWireOps(root, ops) {
+	let next = root;
+	for (const op of ops) {
+		if (op.path.length === 0) {
+			if (op.kind === "set") next = op.next;
+			continue;
+		}
+		next = applyAt(next, op.path, 0, op);
+	}
+	return next;
+}
+function applyAt(container, path, idx, op) {
+	const seg = path[idx];
+	const base = Array.isArray(container) ? container.slice() : container !== null && typeof container === "object" ? { ...container } : typeof seg === "number" ? [] : {};
+	if (idx === path.length - 1) {
+		if (op.kind === "delete") delete base[seg];
+		else base[seg] = op.next;
+		return base;
+	}
+	base[seg] = applyAt(base[seg], path, idx + 1, op);
+	return base;
+}
+//#endregion
+//#region src/lib/relay.ts
+let epochCounter = 0;
+/**
+* The reference relay core (op-protocol RFC §6/§7): room-scoped sequencing, journal +
+* snapshot compaction, the tri-state join answer, presence fan-out, and tripwire policy
+* enforcement. Pure over injected sockets — runs identically under ws, Bun, a Durable
+* Object, or an in-memory test pair. The relay never interprets ops beyond folding them
+* for snapshots, and never mints identity: `writer` comes from the adapter's auth.
+*
+* Room-initialization contract: a fresh room (seq 0) answers `up-to-date`; the first client
+* then SEEDS it with a root-set envelope so the room's snapshot root is complete (deletes
+* fold correctly, joiners replace-hydrate). Near-simultaneous first-joins of a brand-new
+* room may last-writer-wins their seeds; rooms created by a single client first (the
+* overwhelmingly common case) are unaffected.
+*/
+function createRelay(opt = {}) {
+	const rooms = /* @__PURE__ */ new Map();
+	const policyVersion = opt.policyVersion ?? 0;
+	const journalLimit = opt.journalLimit ?? 1e3;
+	const maxOps = opt.limits?.maxOpsPerEnvelope ?? 1024;
+	const rate = opt.limits?.maxEnvelopesPerSecond;
+	const now = opt.now ?? Date.now;
+	const roomOf = (name) => {
+		let room = rooms.get(name);
+		if (!room) {
+			room = {
+				seq: 0,
+				epoch: `${now().toString(36)}-${(++epochCounter).toString(36)}`,
+				root: void 0,
+				journal: [],
+				members: /* @__PURE__ */ new Set(),
+				presence: /* @__PURE__ */ new Map(),
+				ejected: /* @__PURE__ */ new Set(),
+				buckets: /* @__PURE__ */ new Map()
+			};
+			rooms.set(name, room);
+		}
+		return room;
+	};
+	const broadcast = (room, msg, except) => {
+		for (const member of room.members) if (member !== except) member.socket.send(msg);
+	};
+	const eject = (name, room, writer, violation) => {
+		room.ejected.add(writer);
+		opt.onViolation?.(name, violation);
+		broadcast(room, {
+			t: "eject",
+			room: name,
+			writer,
+			reason: violation.reason
+		});
+		for (const member of [...room.members]) {
+			if (member.ctx.writer !== writer) continue;
+			room.members.delete(member);
+			dropPresence(name, room, member);
+			broadcast(room, {
+				t: "member",
+				room: name,
+				origin: member.origin,
+				gone: true
+			});
+			member.socket.close?.();
+		}
+	};
+	const dropPresence = (name, room, member) => {
+		const entry = room.presence.get(member.origin);
+		if (!entry || entry.by !== member) return;
+		room.presence.delete(member.origin);
+		broadcast(room, {
+			t: "presence",
+			room: name,
+			peer: entry.peer,
+			gone: true
+		});
+	};
+	const overRate = (room, writer) => {
+		if (!rate) return false;
+		const at = now();
+		let bucket = room.buckets.get(writer);
+		if (!bucket) {
+			bucket = {
+				tokens: rate * 2,
+				last: at
+			};
+			room.buckets.set(writer, bucket);
+		}
+		bucket.tokens = Math.min(rate * 2, bucket.tokens + (at - bucket.last) / 1e3 * rate);
+		bucket.last = at;
+		if (bucket.tokens < 1) return true;
+		bucket.tokens -= 1;
+		return false;
+	};
+	return {
+		room: (name) => {
+			const room = rooms.get(name);
+			return room ? {
+				seq: room.seq,
+				members: room.members.size,
+				journal: room.journal.length
+			} : void 0;
+		},
+		connect: (socket, ctx) => {
+			const joined = /* @__PURE__ */ new Map();
+			const disconnect = () => {
+				for (const [name, member] of joined) {
+					const room = rooms.get(name);
+					if (!room || !room.members.has(member)) continue;
+					room.members.delete(member);
+					dropPresence(name, room, member);
+					broadcast(room, {
+						t: "member",
+						room: name,
+						origin: member.origin,
+						gone: true
+					});
+				}
+				joined.clear();
+			};
+			return {
+				disconnect,
+				receive: (msg) => {
+					const room = roomOf(msg.room);
+					if (msg.t === "hello") {
+						if (room.ejected.has(ctx.writer)) {
+							socket.send({
+								t: "reject",
+								room: msg.room,
+								reason: "unauthorized"
+							});
+							return;
+						}
+						if (msg.proto !== 1) {
+							socket.send({
+								t: "reject",
+								room: msg.room,
+								reason: "proto",
+								expected: 1
+							});
+							return;
+						}
+						if (msg.policyVersion !== policyVersion) {
+							socket.send({
+								t: "reject",
+								room: msg.room,
+								reason: "policy-version",
+								expected: policyVersion
+							});
+							return;
+						}
+						for (const prior of [...room.members]) {
+							if (prior.origin !== msg.origin) continue;
+							room.members.delete(prior);
+							dropPresence(msg.room, room, prior);
+							if (prior.socket !== socket) prior.socket.close?.();
+						}
+						const member = {
+							socket,
+							ctx,
+							origin: msg.origin
+						};
+						joined.set(msg.room, member);
+						room.members.add(member);
+						broadcast(room, {
+							t: "member",
+							room: msg.room,
+							origin: msg.origin
+						}, member);
+						const peers = [...room.presence.values()].map((e) => e.peer);
+						const base = {
+							t: "welcome",
+							room: msg.room,
+							seq: room.seq,
+							epoch: room.epoch,
+							peers,
+							members: [...room.members].filter((m) => m !== member).map((m) => m.origin)
+						};
+						if (room.seq === 0 || msg.seq === room.seq) socket.send({
+							...base,
+							mode: "up-to-date"
+						});
+						else if (msg.seq !== void 0 && room.journal.length > 0 && msg.seq >= room.journal[0].seq - 1) {
+							const since = msg.seq;
+							socket.send({
+								...base,
+								mode: "delta",
+								envs: room.journal.filter((e) => e.seq > since)
+							});
+						} else socket.send({
+							...base,
+							mode: "snapshot",
+							root: room.root
+						});
+						return;
+					}
+					const member = joined.get(msg.room);
+					if (!member || room.ejected.has(ctx.writer)) return;
+					if (msg.t === "signal") {
+						for (const target of room.members) if (target.origin === msg.to) {
+							target.socket.send({
+								t: "signal",
+								room: msg.room,
+								from: member.origin,
+								data: msg.data
+							});
+							break;
+						}
+						return;
+					}
+					if (msg.t === "presence") {
+						const peer = {
+							origin: member.origin,
+							writer: ctx.writer,
+							data: msg.data
+						};
+						room.presence.set(member.origin, {
+							peer,
+							by: member
+						});
+						broadcast(room, {
+							t: "presence",
+							room: msg.room,
+							peer
+						}, member);
+						return;
+					}
+					const env = msg.env;
+					const violation = env.policyVersion !== policyVersion || env.proto !== 1 ? {
+						writer: ctx.writer,
+						reason: "proto"
+					} : env.ops.length > maxOps ? {
+						writer: ctx.writer,
+						reason: "ops-limit"
+					} : overRate(room, ctx.writer) ? {
+						writer: ctx.writer,
+						reason: "rate"
+					} : checkEnvelope(opt.policy, env, ctx);
+					if (violation) {
+						eject(msg.room, room, ctx.writer, violation);
+						return;
+					}
+					const seqEnv = {
+						...env,
+						seq: ++room.seq
+					};
+					room.journal.push(seqEnv);
+					room.root = applyWireOps(room.root, env.ops);
+					if (room.journal.length > journalLimit) room.journal.shift();
+					broadcast(room, {
+						t: "env",
+						room: msg.room,
+						env: seqEnv
+					});
+				}
+			};
+		}
+	};
+}
+//#endregion
+export { MESH_PROTO_VERSION, applyWireOps, checkEnvelope, createRelay, pathPrefixAcl };

package/package.json

@@ -0,0 +1,36 @@
+{
+  "name": "@mmstack/mesh-protocol",
+  "version": "0.1.0",
+  "type": "module",
+  "main": "./index.js",
+  "module": "./index.js",
+  "types": "./index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./index.d.ts",
+      "default": "./index.js"
+    }
+  },
+  "files": [
+    "*.js",
+    "*.d.ts",
+    "*.map"
+  ],
+  "keywords": [
+    "mmstack",
+    "mesh",
+    "sync",
+    "multiplayer",
+    "relay",
+    "op-log",
+    "local-first"
+  ],
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/mihajm/mmstack.git",
+    "directory": "packages/mesh/protocol"
+  },
+  "homepage": "https://github.com/mihajm/mmstack/blob/master/packages/mesh/protocol",
+  "sideEffects": false
+}