@weaveprotocol/cli 0.1.0 → 0.1.2

package/README.md

@@ -30,7 +30,7 @@ To have `weave` everywhere:
 npm install -g @weaveprotocol/cli            # or run it without installing: npx @weaveprotocol/cli <command>
 ```
 
-From this repo: `cd cli && npm install && npm run bundle && npm link`, or a
+From this repo: `npm install` at the repo root (the CLI is a workspace), then `cd cli && npm run bundle && npm link`, or a
 binary with no Node at all: `bun build.ts --native`.
 
 ```bash

package/dist/weave.mjs

@@ -6583,6 +6583,19 @@ function createEmitter() {
 
 // ../src/network/signaling.ts
 var SIGNAL_KINDS = /* @__PURE__ */ new Set(["offer", "answer", "candidate"]);
+function iceFrom(payload) {
+  const { servers, expiresAt } = payload ?? {};
+  if (!Array.isArray(servers) || typeof expiresAt !== "number" || !Number.isFinite(expiresAt)) return null;
+  const kept = [];
+  for (const server of servers.slice(0, 4)) {
+    const urls = (Array.isArray(server?.urls) ? server.urls : [server?.urls]).filter(
+      (url) => typeof url === "string" && url.length < 256 && /^turns?:/.test(url)
+    );
+    if (urls.length === 0 || typeof server.username !== "string" || typeof server.credential !== "string") continue;
+    kept.push({ urls, username: server.username, credential: server.credential });
+  }
+  return kept.length > 0 ? { servers: kept, expiresAt } : null;
+}
 function createSignalingClient(url, did) {
   let ws = null;
   let connected = false;
@@ -6619,7 +6632,10 @@ function createSignalingClient(url, did) {
         try {
           const msg = JSON.parse(event.data);
           if (SIGNAL_KINDS.has(msg.type)) emit("signal", msg);
-          else if (typeof msg.room !== "string") return;
+          else if (msg.type === "ice") {
+            const offered2 = iceFrom(msg.payload);
+            if (offered2) emit("ice", offered2.servers, offered2.expiresAt);
+          } else if (typeof msg.room !== "string") return;
           else if (msg.type === "join") emit("peer-joined", msg.from, msg.room);
           else if (msg.type === "leave") emit("peer-left", msg.from, msg.room);
         } catch (err2) {
@@ -6675,6 +6691,7 @@ function createSignalingClient(url, did) {
       if (rooms.delete(room)) sendMessage({ type: "leave", room });
     },
     signal: (kind, targetDid, payload) => sendMessage({ type: kind, to: targetDid, payload }),
+    requestIce: () => sendMessage({ type: "ice" }),
     on,
     off,
     isConnected: () => connected
@@ -6690,6 +6707,7 @@ function createMultiSignalingClient(urls, did) {
   const { on, off, emit } = createEmitter();
   const routes = /* @__PURE__ */ new Map();
   const presence = /* @__PURE__ */ new Map();
+  const turn = /* @__PURE__ */ new Map();
   const connectedCount = () => clients.filter((client) => client.isConnected()).length;
   const remember = (peer, client) => {
     (routes.get(peer) ?? routes.set(peer, /* @__PURE__ */ new Set()).get(peer)).add(client);
@@ -6718,6 +6736,11 @@ function createMultiSignalingClient(urls, did) {
       remember(message.from, client);
       emit("signal", message);
     });
+    client.on("ice", (servers, expiresAt) => {
+      turn.set(client, { servers, expiresAt });
+      const offers = [...turn.values()];
+      emit("ice", offers.flatMap((offer) => offer.servers), Math.min(...offers.map((offer) => offer.expiresAt)));
+    });
     client.on("connected", () => {
       if (connectedCount() === 1) emit("connected");
     });
@@ -6740,6 +6763,7 @@ function createMultiSignalingClient(urls, did) {
       for (const client of clients) client.disconnect();
       routes.clear();
       presence.clear();
+      turn.clear();
     },
     join: (room) => {
       for (const client of clients) client.join(room);
@@ -6751,6 +6775,9 @@ function createMultiSignalingClient(urls, did) {
     signal: (kind, target, payload) => {
       for (const client of routesFor(target)) client.signal(kind, target, payload);
     },
+    requestIce: () => {
+      for (const client of clients) if (client.isConnected()) client.requestIce();
+    },
     on,
     off,
     isConnected: () => connectedCount() > 0
@@ -6806,7 +6833,8 @@ var DEFAULT_ICE_SERVERS = [
   { urls: "stun:stun1.l.google.com:19302" }
 ];
 function createRTCTransport(config) {
-  const iceServers = config?.iceServers ?? DEFAULT_ICE_SERVERS;
+  const configured = config?.iceServers ?? DEFAULT_ICE_SERVERS;
+  const iceServers = () => typeof configured === "function" ? configured() : configured;
   const connections = /* @__PURE__ */ new Map();
   const { on, off, emit } = createEmitter();
   const setupDataChannel = (peerId, channel) => {
@@ -6834,7 +6862,7 @@ function createRTCTransport(config) {
     if (connections.has(peerId)) {
       close(peerId);
     }
-    const connection = new RTCPeerConnection({ iceServers: [...iceServers] });
+    const connection = new RTCPeerConnection({ iceServers: [...iceServers()] });
     connections.set(peerId, { connection, channel: null });
     connection.onicecandidate = (event) => {
       if (event.candidate) onCandidate(event.candidate.toJSON());
@@ -7137,10 +7165,20 @@ function createWebSocketTransport(config) {
 }
 
 // ../src/network/mesh.ts
+var ICE_REFRESH_MS = 10 * 6e4;
+var ICE_WAIT_MS = 1500;
 function createMesh(config) {
   const { did } = config;
-  const transport = config.createTransport?.() ?? createRTCTransport({ iceServers: config.iceServers });
   const signaling = createMultiSignalingClient(config.relays, did);
+  const configuredIce = config.iceServers ?? DEFAULT_ICE_SERVERS;
+  let relayIce = null;
+  let iceAskedAt = 0;
+  signaling.on("ice", (servers, expiresAt) => {
+    relayIce = { servers, expiresAt };
+    iceAskedAt = 0;
+  });
+  const currentIce = () => relayIce && relayIce.expiresAt > Date.now() ? [...configuredIce, ...relayIce.servers] : configuredIce;
+  const transport = config.createTransport?.() ?? createRTCTransport({ iceServers: currentIce });
   const introduce = config.introductions !== false;
   const authTimeoutMs = config.authTimeoutMs ?? 1e4;
   const rooms = /* @__PURE__ */ new Map();
@@ -7341,6 +7379,23 @@ function createMesh(config) {
     return started;
   };
   return {
+    async iceServers() {
+      const stale = !relayIce || relayIce.expiresAt - Date.now() < ICE_REFRESH_MS;
+      if (signaling.isConnected() && stale && Date.now() - iceAskedAt > ICE_REFRESH_MS) {
+        iceAskedAt = Date.now();
+        await new Promise((resolve) => {
+          const done = () => {
+            clearTimeout(timer);
+            signaling.off("ice", done);
+            resolve();
+          };
+          const timer = setTimeout(done, ICE_WAIT_MS);
+          signaling.on("ice", done);
+          signaling.requestIce();
+        });
+      }
+      return currentIce();
+    },
     join(name, auth = null) {
       const room = { auth, peers: /* @__PURE__ */ new Map(), handshakes: /* @__PURE__ */ new Map(), events: createEmitter() };
       const send = (peer, message) => {
@@ -8156,6 +8211,13 @@ var writeCapability = (spaceId) => ({
   can: "expression/write"
 });
 var noteCid = (encoded) => cidFromBytes(utf8Encode(encoded));
+var NO_ACCOUNT = Object.freeze({ account: null, agent: false });
+var WHO_MESSAGE = "who";
+var LIVE_MESSAGE = "live";
+var MAX_LIVE_BYTES = 64 * 1024;
+var MAX_NOTE_LENGTH = 16 * 1024;
+var LIVE_BURST = 60;
+var LIVE_PER_SECOND = 20;
 var STANDS = { ok: true };
 function looksEncrypted(body) {
   const envelope = body;
@@ -8657,11 +8719,45 @@ async function openSpaceRuntime(deps) {
     }
   }
   const connectedPeers = () => [...new Set(networks.flatMap((network) => network.getPeers().map((peer) => peer.did)))];
+  const peerAccounts = /* @__PURE__ */ new Map();
+  const knownAccounts = /* @__PURE__ */ new Map();
+  const liveAllowance = /* @__PURE__ */ new Map();
+  async function accountOf(peer, note) {
+    if (typeof note !== "string" || note.length > MAX_NOTE_LENGTH) return NO_ACCOUNT;
+    const chain = await resolveDelegationRoot(note, () => null, provider).catch(() => null);
+    if (!chain?.valid || chain.audience !== peer || !chain.rootDid) return NO_ACCOUNT;
+    return { account: chain.rootDid, agent: isAgentNote(note) };
+  }
+  function withinAllowance(peer) {
+    const now = Date.now();
+    const held = liveAllowance.get(peer) ?? { tokens: LIVE_BURST, at: now };
+    const tokens = Math.min(LIVE_BURST, held.tokens + (now - held.at) / 1e3 * LIVE_PER_SECOND);
+    liveAllowance.set(peer, { tokens: Math.max(0, tokens - 1), at: now });
+    return tokens >= 1;
+  }
+  async function onLive(peer, payload) {
+    if (!withinAllowance(peer)) return;
+    if ((JSON.stringify(payload ?? null)?.length ?? 0) > MAX_LIVE_BYTES) return;
+    const { account, agent } = await peerAccounts.get(peer) ?? NO_ACCOUNT;
+    if (!routes.has(peer)) return;
+    emit({ type: "message", space: space2.id, from: account, peer, agent, message: payload });
+  }
   for (const network of networks) {
     network.on("message", (message) => {
       if (message.type === "sync") void sync.handleMessage(message.from, message.payload);
+      else if (message.type === WHO_MESSAGE) {
+        const note = message.payload?.note;
+        const checked = accountOf(message.from, note);
+        peerAccounts.set(message.from, checked);
+        void checked.then((known) => {
+          if (peerAccounts.get(message.from) !== checked) return;
+          knownAccounts.set(message.from, known);
+          emit({ type: "status", space: space2.id });
+        });
+      } else if (message.type === LIVE_MESSAGE) void onLive(message.from, message.payload);
     });
     network.on("peer-connected", (info) => {
+      network.send(info.did, { type: WHO_MESSAGE, from: session.did, payload: { note: session.proof() } });
       routes.set(info.did, network);
       sync.addPeer(info.did);
       sync.notifyPeers([info.did]);
@@ -8671,6 +8767,9 @@ async function openSpaceRuntime(deps) {
       if (routes.get(info.did) === network) {
         routes.delete(info.did);
         sync.removePeer(info.did);
+        peerAccounts.delete(info.did);
+        knownAccounts.delete(info.did);
+        liveAllowance.delete(info.did);
       }
       emit({ type: "status", space: space2.id });
     });
@@ -8681,10 +8780,16 @@ async function openSpaceRuntime(deps) {
   }
   if (networks.length > 0) {
     connection = "connecting";
-    void Promise.allSettled(networks.map((network) => network.connect())).then((results) => {
-      connection = results.some((result) => result.status === "fulfilled") ? "connected" : "error";
-      emit({ type: "status", space: space2.id });
-    });
+    void Promise.any(networks.map((network) => network.connect())).then(
+      () => {
+        connection = "connected";
+        emit({ type: "status", space: space2.id });
+      },
+      () => {
+        connection = "error";
+        emit({ type: "status", space: space2.id });
+      }
+    );
     sync.start();
   }
   let watchTimer = null;
@@ -9031,10 +9136,19 @@ async function openSpaceRuntime(deps) {
         space: space2.id,
         connection,
         peers: connectedPeers(),
+        accounts: Object.fromEntries([...knownAccounts].flatMap(([peer, known]) => known.account && routes.has(peer) ? [[peer, known.account]] : [])),
         root: await storage.getRootCid(),
         rejected
       };
     },
+    async send(message, to) {
+      const encoded = JSON.stringify(message ?? null);
+      if (encoded.length > MAX_LIVE_BYTES) throw new Error("A live message can be at most 64 KB");
+      for (const peer of connectedPeers()) {
+        if (to && to !== peer && (await peerAccounts.get(peer))?.account !== to) continue;
+        routes.get(peer)?.send(peer, { type: LIVE_MESSAGE, from: session.did, payload: message ?? null });
+      }
+    },
     async close() {
       if (watchTimer) clearInterval(watchTimer);
       if (announceTimer) clearTimeout(announceTimer);
@@ -9114,6 +9228,7 @@ async function createNode(config) {
   const registryStore = await config.stores("registry", { seal: true });
   const registry = createSpaceManager(registryStore, provider);
   const runtimes = /* @__PURE__ */ new Map();
+  const holds2 = /* @__PURE__ */ new Map();
   const account = config.accountKey ? await deriveAccountRegistry(config.accountKey, config.signer.did, provider) : null;
   const accountSpaceId = account?.space.id ?? null;
   async function findRecord(spaceId) {
@@ -9224,6 +9339,7 @@ async function createNode(config) {
     }
   }
   async function closeRuntime(spaceId) {
+    holds2.delete(spaceId);
     const open2 = runtimes.get(spaceId);
     if (!open2) return;
     runtimes.delete(spaceId);
@@ -9406,10 +9522,28 @@ async function createNode(config) {
       await registry.remove(spaceId);
       emit({ type: "spaces" });
     },
-    async open(spaceId) {
-      await runtime(spaceId);
+    async hold(spaceId) {
+      const held = holds2.get(spaceId) ?? holds2.set(spaceId, { count: 0 }).get(spaceId);
+      held.count += 1;
+      let released = false;
+      const release = async () => {
+        if (released) return;
+        released = true;
+        if (holds2.get(spaceId) !== held) return;
+        held.count -= 1;
+        if (held.count === 0) await closeRuntime(spaceId);
+      };
+      try {
+        await runtime(spaceId);
+      } catch (error) {
+        await release();
+        throw error;
+      }
+      return release;
+    },
+    async send(spaceId, message, to) {
+      await (await runtime(spaceId)).send(message, to);
     },
-    close: closeRuntime,
     async status(spaceId) {
       const status = await (await runtime(spaceId)).status();
       if (!accountSpaceId) return { ...status, own: [], carriers: [] };
@@ -9618,9 +9752,11 @@ async function createNode(config) {
       closeInvite: person("close invites"),
       revoke: person("revoke notes"),
       access: async (spaceId) => (inside(spaceId), spaces.access(spaceId)),
-      open: async (spaceId) => (inside(spaceId), spaces.open(spaceId)),
+      hold: async (spaceId) => (inside(spaceId), spaces.hold(spaceId)),
       status: async (spaceId) => (inside(spaceId), spaces.status(spaceId)),
       profiles: async (spaceId) => (inside(spaceId), spaces.profiles(spaceId)),
+      // It would arrive as the person: a live message carries no note of its own to say "via agent".
+      send: person("send live messages"),
       authenticator: async () => null
     });
     const agentRecords = Object.freeze({
@@ -9670,6 +9806,7 @@ async function createNode(config) {
       account: Object.freeze({ profile: accountApi.profile, setName: person("rename the account"), revoke: person("revoke notes") }),
       carriers: Object.freeze({ list: carriers.list, add: person("add a carrier"), remove: person("remove a carrier") }),
       delegation: () => note,
+      iceServers: node.iceServers,
       delegate: person("pass its access on"),
       asAgent: person("start another agent"),
       subscribe: (listener) => node.subscribe((event) => {
@@ -9690,6 +9827,7 @@ async function createNode(config) {
     carriers,
     asAgent,
     delegation: () => current,
+    iceServers: async () => mesh ? mesh.iceServers() : config.network?.iceServers ?? DEFAULT_ICE_SERVERS,
     async delegate(params) {
       const token = await delegateCapabilities(
         {
@@ -10549,6 +10687,201 @@ async function unlock(home, account, secret) {
 // src/serve.ts
 import { createServer } from "node:http";
 import { WebSocketServer } from "ws";
+
+// ../server/relay.mjs
+import { createHmac } from "node:crypto";
+var MAX_MESSAGE_BYTES = 64 * 1024;
+var MAX_CONNECTIONS = 5e3;
+var MAX_CONNECTIONS_PER_IP = 32;
+var MAX_ROOMS = 1e4;
+var MAX_ROOMS_PER_SOCKET = 256;
+var MAX_PEERS_PER_ROOM = 64;
+var MAX_ROOM_LENGTH = 128;
+var MAX_DID_LENGTH = 256;
+var RATE_PER_SECOND = 50;
+var RATE_BURST = 100;
+var HEARTBEAT_MS = 15e3;
+var MAX_BUFFERED_BYTES = 1024 * 1024;
+var ROUTED = /* @__PURE__ */ new Set(["offer", "answer", "candidate"]);
+var DID_PATTERN = /^did:key:z[1-9A-HJ-NP-Za-km-z]+$/;
+var CLOSE_DID_TAKEN = 4009;
+function turnFromEnv(env) {
+  const secret = env.TURN_SECRET ?? "";
+  const urls = (env.TURN_URLS ?? "").split(",").map((url) => url.trim()).filter(Boolean);
+  if (!secret || urls.length === 0) return void 0;
+  return { secret, urls, ttlSeconds: Number(env.TURN_TTL_SECONDS ?? 4 * 3600) };
+}
+function createRelay(options = {}) {
+  const { turn } = options;
+  const log = options.log ?? (() => {
+  });
+  const rooms = /* @__PURE__ */ new Map();
+  const clients = /* @__PURE__ */ new Set();
+  const perIp = /* @__PURE__ */ new Map();
+  function canEnter(room) {
+    if (typeof room !== "string" || room.length === 0 || room.length > MAX_ROOM_LENGTH) return false;
+    const peers = rooms.get(room);
+    return peers ? peers.size < MAX_PEERS_PER_ROOM : rooms.size < MAX_ROOMS;
+  }
+  function accept(ws, legacyRoom, ip) {
+    const client = { ws, legacyRoom, ip, did: null, rooms: /* @__PURE__ */ new Set(), alive: true, tokens: RATE_BURST, refilled: Date.now() };
+    clients.add(client);
+    perIp.set(ip, (perIp.get(ip) ?? 0) + 1);
+    ws.on("pong", () => client.alive = true);
+    ws.on("message", (data, isBinary) => {
+      if (!withinBudget(client)) {
+        ws.terminate();
+        return;
+      }
+      if (!isBinary) handleMessage(client, data.toString("utf8"));
+    });
+    let dropped = false;
+    const drop = () => {
+      if (dropped) return;
+      dropped = true;
+      clients.delete(client);
+      const left = (perIp.get(ip) ?? 1) - 1;
+      if (left > 0) perIp.set(ip, left);
+      else perIp.delete(ip);
+      for (const room of [...client.rooms]) leave(client, room);
+    };
+    ws.on("close", drop);
+    ws.on("error", () => ws.terminate());
+  }
+  function handleMessage(client, raw) {
+    let message;
+    try {
+      message = JSON.parse(raw);
+    } catch {
+      return;
+    }
+    if (!message || typeof message.type !== "string") return;
+    const room = message.room ?? client.legacyRoom;
+    if (message.type === "join") {
+      if (client.did ? message.from !== client.did : !isDid(message.from)) return;
+      if (client.rooms.has(room) || client.rooms.size >= MAX_ROOMS_PER_SOCKET || !canEnter(room)) return;
+      if (findPeer(room, message.from)) {
+        client.ws.close(CLOSE_DID_TAKEN, "DID already in room");
+        return;
+      }
+      const first = !client.did;
+      client.did = message.from;
+      client.rooms.add(room);
+      if (!rooms.has(room)) rooms.set(room, /* @__PURE__ */ new Set());
+      rooms.get(room).add(client);
+      announce(client, room, "join");
+      if (first) offerTurn(client);
+      log(`peer joined room ${short(room)} (${rooms.get(room).size} present)`);
+      return;
+    }
+    if (message.type === "ice") {
+      if (client.did) offerTurn(client);
+      return;
+    }
+    if (message.type === "leave") {
+      if (client.rooms.has(room)) leave(client, room);
+      return;
+    }
+    if (!client.did || !ROUTED.has(message.type) || typeof message.to !== "string") return;
+    for (const shared of client.rooms) {
+      const target = findPeer(shared, message.to);
+      if (target && target !== client) {
+        send(target, JSON.stringify({ type: message.type, from: client.did, to: message.to, payload: message.payload }));
+        return;
+      }
+    }
+  }
+  function offerTurn(client) {
+    if (!turn) return;
+    const expires = Math.floor(Date.now() / 1e3) + turn.ttlSeconds;
+    const username = String(expires);
+    const credential = createHmac("sha1", turn.secret).update(username).digest("base64");
+    send(client, JSON.stringify({ type: "ice", payload: { servers: [{ urls: turn.urls, username, credential }], expiresAt: expires * 1e3 } }));
+  }
+  function leave(client, room) {
+    client.rooms.delete(room);
+    const peers = rooms.get(room);
+    peers?.delete(client);
+    if (peers?.size === 0) rooms.delete(room);
+    announce(client, room, "leave");
+    log(`peer left room ${short(room)}`);
+  }
+  function announce(sender, room, type) {
+    const payload = JSON.stringify({ type, from: sender.did, room });
+    for (const peer of rooms.get(room) ?? []) {
+      if (peer !== sender) send(peer, payload);
+    }
+  }
+  function send(peer, text) {
+    if (peer.ws.readyState !== peer.ws.OPEN) return;
+    if (peer.ws.bufferedAmount > MAX_BUFFERED_BYTES) {
+      peer.ws.terminate();
+      return;
+    }
+    peer.ws.send(text);
+  }
+  function findPeer(room, did) {
+    for (const peer of rooms.get(room) ?? []) {
+      if (peer.did === did) return peer;
+    }
+    return null;
+  }
+  function withinBudget(client) {
+    const now = Date.now();
+    client.tokens = Math.min(RATE_BURST, client.tokens + (now - client.refilled) / 1e3 * RATE_PER_SECOND);
+    client.refilled = now;
+    if (client.tokens < 1) return false;
+    client.tokens -= 1;
+    return true;
+  }
+  const heartbeat = setInterval(() => {
+    for (const client of clients) {
+      if (!client.alive) {
+        client.ws.terminate();
+        continue;
+      }
+      client.alive = false;
+      client.ws.ping();
+    }
+  }, HEARTBEAT_MS);
+  heartbeat.unref();
+  return {
+    /**
+     * Takes an HTTP upgrade request. Everything that can be refused is refused
+     * here, before a socket is opened.
+     *
+     * @param {import('ws').WebSocketServer} wss A `ws` server made with `noServer: true` and `maxPayload: MAX_MESSAGE_BYTES`
+     */
+    upgrade(wss, req, socket, head) {
+      socket.on("error", () => socket.destroy());
+      const legacyRoom = new URL(req.url ?? "/", "http://relay").searchParams.get("room");
+      const ip = clientIp(req);
+      const refusal2 = legacyRoom !== null && !canEnter(legacyRoom) ? [503, "Room full"] : clients.size >= MAX_CONNECTIONS ? [503, "Relay full"] : (perIp.get(ip) ?? 0) >= MAX_CONNECTIONS_PER_IP ? [429, "Too many connections"] : null;
+      if (refusal2) {
+        socket.end(`HTTP/1.1 ${refusal2[0]} ${refusal2[1]}\r
+Connection: close\r
+Content-Length: 0\r
+\r
+`);
+        return;
+      }
+      wss.handleUpgrade(req, socket, head, (ws) => accept(ws, legacyRoom, ip));
+    },
+    /** Drops every socket and stops the heartbeat */
+    close() {
+      clearInterval(heartbeat);
+      for (const client of clients) client.ws.terminate();
+    }
+  };
+}
+var isDid = (value) => typeof value === "string" && value.length <= MAX_DID_LENGTH && DID_PATTERN.test(value);
+function clientIp(req) {
+  const forwarded = process.env.FLY_APP_NAME ? req.headers["fly-client-ip"] : void 0;
+  return typeof forwarded === "string" && forwarded || req.socket.remoteAddress || "unknown";
+}
+var short = (room) => room.length > 12 ? `${room.slice(0, 12)}\u2026` : room;
+
+// src/serve.ts
 function createSpacePeers() {
   const sockets = /* @__PURE__ */ new Map();
   const listeners = {};
@@ -10613,84 +10946,21 @@ function createInboundPeers() {
     count: () => spaces.size
   };
 }
-var RELAY_MAX_ROOM_LENGTH = 128;
-var RELAY_MAX_PEERS_PER_ROOM = 64;
-var RELAY_MESSAGES_PER_SECOND = 50;
-var RELAY_BURST = 100;
-var DID_PATTERN = /^did:key:z[1-9A-HJ-NP-Za-km-z]{1,250}$/;
-function createRelay() {
-  const rooms = /* @__PURE__ */ new Map();
-  const broadcast = (sender, payload) => {
-    for (const peer of rooms.get(sender.room) ?? []) {
-      if (peer !== sender && peer.did && peer.socket.readyState === peer.socket.OPEN) peer.socket.send(payload);
-    }
-  };
-  return {
-    rooms,
-    accept(socket, room) {
-      if (room.length > RELAY_MAX_ROOM_LENGTH || (rooms.get(room)?.size ?? 0) >= RELAY_MAX_PEERS_PER_ROOM) {
-        socket.close(1008, "room refused");
-        return;
-      }
-      const client = { socket, room, did: null };
-      if (!rooms.has(room)) rooms.set(room, /* @__PURE__ */ new Set());
-      rooms.get(room).add(client);
-      let tokens = RELAY_BURST;
-      let refilled = Date.now();
-      socket.on("message", (data, isBinary) => {
-        const now = Date.now();
-        tokens = Math.min(RELAY_BURST, tokens + (now - refilled) / 1e3 * RELAY_MESSAGES_PER_SECOND);
-        refilled = now;
-        if ((tokens -= 1) < 0) {
-          socket.close(1008, "too many messages");
-          return;
-        }
-        if (isBinary) return;
-        let message;
-        try {
-          message = JSON.parse(String(data));
-        } catch {
-          return;
-        }
-        if (typeof message?.type !== "string") return;
-        if (message.type === "join") {
-          if (client.did || typeof message.from !== "string" || !DID_PATTERN.test(message.from)) return;
-          if ([...rooms.get(room)].some((peer) => peer.did === message.from)) {
-            socket.close(4009, "that DID is already in this room");
-            return;
-          }
-          client.did = message.from;
-          broadcast(client, JSON.stringify({ type: "join", from: client.did }));
-          return;
-        }
-        if (!client.did || !["offer", "answer", "candidate"].includes(message.type) || typeof message.to !== "string") return;
-        const target = [...rooms.get(room) ?? []].find((peer) => peer.did === message.to);
-        const forwarded = { type: message.type, from: client.did, to: message.to, payload: message.payload };
-        if (target && target.socket.readyState === target.socket.OPEN) target.socket.send(JSON.stringify(forwarded));
-      });
-      socket.on("close", () => {
-        const peers = rooms.get(room);
-        if (!peers?.delete(client)) return;
-        if (peers.size === 0) rooms.delete(room);
-        if (client.did) broadcast(client, JSON.stringify({ type: "leave", from: client.did }));
-      });
-    }
-  };
-}
+var DID_PATTERN2 = /^did:key:z[1-9A-HJ-NP-Za-km-z]{1,250}$/;
 function parseHello(data, isBinary) {
   if (isBinary) return null;
   try {
     const hello = JSON.parse(String(data));
-    return hello.type === "hello" && typeof hello.did === "string" && DID_PATTERN.test(hello.did) && typeof hello.nonce === "string" ? { did: hello.did, nonce: hello.nonce, proof: { sig: hello.sig, read: hello.read } } : null;
+    return hello.type === "hello" && typeof hello.did === "string" && DID_PATTERN2.test(hello.did) && typeof hello.nonce === "string" ? { did: hello.did, nonce: hello.nonce, proof: { sig: hello.sig, read: hello.read } } : null;
   } catch {
     return null;
   }
 }
 async function serve(options) {
   const { node, inbound } = options;
-  const relay = createRelay();
+  const relay = createRelay({ turn: turnFromEnv(process.env) });
   const sockets = new WebSocketServer({ noServer: true, maxPayload: 16 * 1024 * 1024 });
-  const relaySockets = new WebSocketServer({ noServer: true, maxPayload: 64 * 1024 });
+  const relaySockets = new WebSocketServer({ noServer: true, maxPayload: MAX_MESSAGE_BYTES, perMessageDeflate: false, clientTracking: false });
   const http = createServer((req, res) => {
     if (req.url === "/health") {
       res.writeHead(200, { "content-type": "application/json" });
@@ -10700,6 +10970,7 @@ async function serve(options) {
     res.writeHead(426, { "content-type": "text/plain" });
     res.end("This endpoint speaks WebSocket only.\n");
   });
+  const served = /* @__PURE__ */ new Set();
   const onPeer = async (socket, url) => {
     const spaceId = url.searchParams.get("space");
     if (!spaceId) {
@@ -10721,7 +10992,10 @@ async function serve(options) {
           socket.close(4003, "not a reader of this space");
           return;
         }
-        await node.spaces.open(spaceId);
+        if (!served.has(spaceId)) {
+          await node.spaces.hold(spaceId);
+          served.add(spaceId);
+        }
         const sig = await authenticator.welcome(node.sessionDid, hello.nonce);
         socket.send(JSON.stringify({ type: "welcome", did: node.sessionDid, sig }));
         inbound.accept(spaceId, socket, hello.did);
@@ -10734,7 +11008,7 @@ async function serve(options) {
     if (url.pathname === "/peer") {
       sockets.handleUpgrade(req, socket, head, (ws) => void onPeer(ws, url).catch(() => ws.close(1011, "internal error")));
     } else {
-      relaySockets.handleUpgrade(req, socket, head, (ws) => relay.accept(ws, url.searchParams.get("room") ?? "default"));
+      relay.upgrade(relaySockets, req, socket, head);
     }
   });
   await new Promise((resolve, reject) => {
@@ -10746,7 +11020,8 @@ async function serve(options) {
   return {
     port,
     async close() {
-      for (const client of [...sockets.clients, ...relaySockets.clients]) client.terminate();
+      for (const client of sockets.clients) client.terminate();
+      relay.close();
       sockets.close();
       relaySockets.close();
       await new Promise((resolve) => http.close(() => resolve()));
@@ -10771,18 +11046,17 @@ async function startDaemon(options) {
       ...options.nodes?.length ? { nodes: options.nodes } : {}
     }
   });
-  const open2 = /* @__PURE__ */ new Set();
+  const open2 = /* @__PURE__ */ new Map();
   const rescan = async () => {
     const held = new Set((await node.spaces.list()).map((space2) => space2.id));
     for (const id of held) {
       if (open2.has(id)) continue;
-      await node.spaces.open(id);
-      open2.add(id);
+      open2.set(id, await node.spaces.hold(id));
       log(`serving space ${id}`);
     }
-    for (const id of [...open2]) {
+    for (const [id, release] of [...open2]) {
       if (held.has(id)) continue;
-      await node.spaces.close(id);
+      await release();
       open2.delete(id);
       log(`stopped serving space ${id}`);
     }
@@ -11145,7 +11419,7 @@ async function startAgentNode(home, options = {}) {
   for (const space2 of grant.spaces) if (!held.has(space2.id)) await base.spaces.join(space2.invite).catch(() => {
   });
   const node = await base.asAgent({ keys: key2.keys, note: grant.token });
-  for (const space2 of await node.spaces.list()) void node.spaces.open(space2.id).catch(() => {
+  for (const space2 of await node.spaces.list()) void node.spaces.hold(space2.id).catch(() => {
   });
   return {
     node,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@weaveprotocol/cli",
-  "version": "0.1.0",
+  "version": "0.1.2",
   "description": "The Weave protocol from a terminal: manage spaces, run an always-on node, serve MCP to agents",
   "type": "module",
   "bin": {