@weaveprotocol/cli 0.2.0 → 0.2.2

package/dist/weave.mjs

@@ -6,7 +6,7 @@ import path6 from "node:path";
 import { createInterface as createInterface2 } from "node:readline";
 import { parseArgs } from "node:util";
 
-// ../src/utils/encoding.ts
+// ../core/src/utils/encoding.ts
 var encoder = new TextEncoder();
 var decoder = new TextDecoder();
 function utf8Encode(str2) {
@@ -46,7 +46,7 @@ function bytesToHex(bytes) {
   return Array.from(bytes, (byte) => byte.toString(16).padStart(2, "0")).join("");
 }
 
-// ../node_modules/@noble/hashes/_u64.js
+// ../../node_modules/@noble/hashes/_u64.js
 var fromNumH = (n) => n / 2 ** 32 | 0;
 var fromNumL = (n) => n >>> 0;
 function setU64FromNum(view, byteOffset, n, isLE) {
@@ -56,7 +56,7 @@ function setU64FromNum(view, byteOffset, n, isLE) {
   view.setUint32(byteOffset + 4, isLE ? h : l, isLE);
 }
 
-// ../node_modules/@noble/hashes/utils.js
+// ../../node_modules/@noble/hashes/utils.js
 function isBytes(a) {
   return a instanceof Uint8Array || ArrayBuffer.isView(a) && a.constructor.name === "Uint8Array" && "BYTES_PER_ELEMENT" in a && a.BYTES_PER_ELEMENT === 1;
 }
@@ -221,7 +221,7 @@ var oidNist = (suffix) => ({
   oid: Uint8Array.from([6, 9, 96, 134, 72, 1, 101, 3, 4, 2, suffix])
 });
 
-// ../node_modules/@noble/hashes/_md.js
+// ../../node_modules/@noble/hashes/_md.js
 function Chi(a, b, c) {
   return a & b ^ ~a & c;
 }
@@ -334,7 +334,7 @@ var SHA256_IV = /* @__PURE__ */ Uint32Array.from([
   1541459225
 ]);
 
-// ../node_modules/@noble/hashes/sha2.js
+// ../../node_modules/@noble/hashes/sha2.js
 var SHA256_K = /* @__PURE__ */ Uint32Array.from([
   1116352408,
   1899447441,
@@ -499,7 +499,7 @@ var sha256 = /* @__PURE__ */ createHasher(
   /* @__PURE__ */ oidNist(1)
 );
 
-// ../node_modules/@noble/curves/utils.js
+// ../../node_modules/@noble/curves/utils.js
 function aarray(item, title, inner = () => {
 }) {
   if (!Array.isArray(item))
@@ -681,7 +681,7 @@ function validateObject(object, fields = {}, optFields = {}, title = "object") {
   iter(optFields, true);
 }
 
-// ../node_modules/@noble/curves/abstract/modular.js
+// ../../node_modules/@noble/curves/abstract/modular.js
 var _0n2 = /* @__PURE__ */ BigInt(0);
 var _1n2 = /* @__PURE__ */ BigInt(1);
 var _2n = /* @__PURE__ */ BigInt(2);
@@ -1131,7 +1131,7 @@ function mapHashToField(key3, fieldOrder, isLE = false) {
   return isLE ? numberToBytesLE(reduced, fieldLen) : numberToBytesBE(reduced, fieldLen);
 }
 
-// ../node_modules/@noble/curves/abstract/curve.js
+// ../../node_modules/@noble/curves/abstract/curve.js
 var _0n3 = /* @__PURE__ */ BigInt(0);
 var _1n3 = /* @__PURE__ */ BigInt(1);
 var _4n2 = /* @__PURE__ */ BigInt(4);
@@ -1518,7 +1518,7 @@ function createKeygen(randomSecretKey, getPublicKey) {
   };
 }
 
-// ../node_modules/@noble/hashes/hmac.js
+// ../../node_modules/@noble/hashes/hmac.js
 var _HMAC = class {
   oHash;
   iHash;
@@ -1595,7 +1595,7 @@ var hmac = /* @__PURE__ */ (() => {
   return hmac_;
 })();
 
-// ../node_modules/@noble/curves/abstract/der.js
+// ../../node_modules/@noble/curves/abstract/der.js
 var _0n4 = /* @__PURE__ */ BigInt(0);
 var DERErr = class extends Error {
   constructor(m = "") {
@@ -1722,7 +1722,7 @@ var DER = /* @__PURE__ */ (() => {
   return Object.freeze(_DER);
 })();
 
-// ../node_modules/@noble/curves/abstract/weierstrass.js
+// ../../node_modules/@noble/curves/abstract/weierstrass.js
 var divNearest = (num, den) => (num + (num >= 0 ? den : -den) / _2n2) / den;
 function _splitEndoScalar(k, basis, n) {
   aInRange("scalar", k, _0n5, n);
@@ -2499,7 +2499,7 @@ function ecdsa(Point, hash2, ecdsaOpts = {}) {
     const sig = drbg(seed, k2sig);
     return sig.toBytes(opts2.format);
   }
-  function verify(signature, message, publicKey, opts2 = {}) {
+  function verify2(signature, message, publicKey, opts2 = {}) {
     const { lowS, prehash, format: format2 } = validateSigOpts(opts2, defaultSigOpts);
     publicKey = abytes2(publicKey, void 0, "publicKey");
     message = validateMsgAndHash(message, prehash);
@@ -2547,14 +2547,14 @@ function ecdsa(Point, hash2, ecdsaOpts = {}) {
     lengths,
     Point,
     sign,
-    verify,
+    verify: verify2,
     recoverPublicKey,
     Signature,
     hash: hash_
   });
 }
 
-// ../node_modules/@noble/curves/nist.js
+// ../../node_modules/@noble/curves/nist.js
 var p256_CURVE = /* @__PURE__ */ (() => ({
   p: BigInt("0xffffffff00000001000000000000000000000000ffffffffffffffffffffffff"),
   n: BigInt("0xffffffff00000000ffffffffffffffffbce6faada7179e84f3b9cac2fc632551"),
@@ -2567,7 +2567,7 @@ var p256_CURVE = /* @__PURE__ */ (() => ({
 var p256_Point = /* @__PURE__ */ weierstrass(p256_CURVE);
 var p256 = /* @__PURE__ */ ecdsa(p256_Point, sha256);
 
-// ../src/identity/crypto-p256.ts
+// ../core/src/identity/crypto-p256.ts
 var P256_SEED_BYTES = 48;
 var P256_KEY_INFO = new TextEncoder().encode("weave/p256-identity-key/v1");
 async function hkdf(ikm, info, length) {
@@ -2679,12 +2679,12 @@ function createP256Provider() {
   });
 }
 
-// ../src/utils/errors.ts
+// ../core/src/utils/errors.ts
 function protocolError(code, message, hint) {
   return Object.assign(new Error(message), { code, ...hint ? { hint } : {} });
 }
 
-// ../src/identity/webauthn.ts
+// ../core/src/identity/webauthn.ts
 var PRF_SALT = new TextEncoder().encode("weave-protocol-key-v1");
 async function registerPasskey(options) {
   if (!globalThis.navigator?.credentials) {
@@ -2780,10 +2780,10 @@ async function authenticatePasskey(credentialId, options) {
   });
 }
 
-// ../src/identity/passkey-diagnostics.ts
+// ../core/src/identity/passkey-diagnostics.ts
 var PRF_SALT2 = new TextEncoder().encode("weave-protocol-key-v1");
 
-// ../src/identity/keys.ts
+// ../core/src/identity/keys.ts
 async function deriveKeyPair(seed, provider) {
   const keyPair = await provider.deriveKeyPairFromSeed(seed);
   const publicKeyBytes = await provider.exportPublicKey(keyPair.publicKey);
@@ -2815,7 +2815,7 @@ async function deriveKeyFromPassword(password, salt, provider) {
   return deriveKeyPair(new Uint8Array(derivedBits), provider);
 }
 
-// ../src/identity/recovery-code.ts
+// ../core/src/identity/recovery-code.ts
 var ALPHABET = "0123456789ABCDEFGHJKMNPQRSTVWXYZ";
 var SUBSTITUTIONS = { O: "0", I: "1", L: "1", U: "V" };
 var SEED_BYTES = 16;
@@ -2876,7 +2876,7 @@ function encodeBase32(bytes) {
   return out;
 }
 
-// ../node_modules/@scure/base/index.js
+// ../../node_modules/@scure/base/index.js
 var freeze = (fn) => Object.freeze(fn());
 function isBytes3(a) {
   return a instanceof Uint8Array || ArrayBuffer.isView(a) && a.constructor.name === "Uint8Array" && "BYTES_PER_ELEMENT" in a && a.BYTES_PER_ELEMENT === 1;
@@ -3082,7 +3082,7 @@ var radix58 = /* @__PURE__ */ radixBaseN(58, B58_GROUP);
 var genBase58 = (abc) => genBaseN(radix58, abc);
 var base58 = /* @__PURE__ */ freeze(() => genBase58("123456789ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz"));
 
-// ../src/identity/did.ts
+// ../core/src/identity/did.ts
 var P256_MULTICODEC = new Uint8Array([128, 36]);
 function publicKeyToDid(publicKeyBytes, multicodecPrefix) {
   const prefixedKey = concatBytes(multicodecPrefix, publicKeyBytes);
@@ -3103,7 +3103,7 @@ function didToPublicKey(did) {
   return { multicodecPrefix, publicKeyBytes };
 }
 
-// ../src/identity/identity-manager.ts
+// ../core/src/identity/identity-manager.ts
 function prfUnsupported() {
   return protocolError(
     "PRF_UNSUPPORTED",
@@ -3194,7 +3194,7 @@ function createIdentityManager(config) {
   });
 }
 
-// ../src/storage/folder-adapter.ts
+// ../core/src/storage/folder-adapter.ts
 var EXPRESSION_SUFFIX = ".json";
 function encodeKey(key3) {
   let out = "";
@@ -3365,7 +3365,7 @@ async function createFolderAdapter(root, path7) {
   });
 }
 
-// ../src/identity/folder-account.ts
+// ../core/src/identity/folder-account.ts
 function createVault(params) {
   return {
     version: 2,
@@ -3376,7 +3376,7 @@ function createVault(params) {
   };
 }
 
-// ../src/identity/account-store.ts
+// ../core/src/identity/account-store.ts
 var LIST_FILE = "accounts.json";
 var ACCOUNTS_DIR = "accounts";
 var VAULT_FILE = "account.json";
@@ -3491,7 +3491,7 @@ function createFolderAccountStore(dir) {
   });
 }
 
-// ../src/identity/account-vault.ts
+// ../core/src/identity/account-vault.ts
 var IV_BYTES = 12;
 var SALT_BYTES = 16;
 var PASSPHRASE_ITERATIONS = 6e5;
@@ -3601,15 +3601,18 @@ async function deriveVaultKey(seed) {
     ["encrypt", "decrypt"]
   );
 }
+var CLI_PASSPHRASE_LABEL = "CLI passphrase";
 function withWrap(vault, wrap) {
   const superseded = (existing) => existing.kind === "device" && wrap.kind === "device" && existing.rpId === wrap.rpId;
   return { ...vault, wraps: [...vault.wraps.filter((existing) => !superseded(existing)), wrap] };
 }
 
-// ../src/identity/contact-key.ts
+// ../core/src/identity/contact-key.ts
 var CONTACT_KEY_INFO = "weave/p256-contact-key/v1";
 var SEAL_INFO = "weave/contact-seal/v1";
 var MEMBER_KEY_INFO = "weave/p256-member-key/v1";
+var DOOR_KEY_INFO = "weave/p256-door-key/v1";
+var DOOR_SIGN_KEY_INFO = "weave/p256-door-sign-key/v1";
 var P256_SEED_BYTES2 = 48;
 var POINT_BYTES = 65;
 var IV_BYTES2 = 12;
@@ -3628,6 +3631,39 @@ async function deriveContactKeyBytes(seed) {
 async function deriveMemberKeyBytes(accountKey, spaceId) {
   return p256.utils.randomSecretKey(await hkdf2(accountKey, `${MEMBER_KEY_INFO}|${spaceId}`, P256_SEED_BYTES2));
 }
+async function deriveDoorKeyBytes(contactKey, doorId) {
+  return p256.utils.randomSecretKey(await hkdf2(contactKey, `${DOOR_KEY_INFO}|${doorId}`, P256_SEED_BYTES2));
+}
+async function deriveDoorSignKeyBytes(contactKey, doorId) {
+  return p256.utils.randomSecretKey(await hkdf2(contactKey, `${DOOR_SIGN_KEY_INFO}|${doorId}`, P256_SEED_BYTES2));
+}
+async function signWithScalar(secret, data) {
+  const point = p256.getPublicKey(secret, false);
+  const key3 = await globalThis.crypto.subtle.importKey(
+    "jwk",
+    {
+      kty: "EC",
+      crv: "P-256",
+      x: base64UrlEncode(point.subarray(1, 33)),
+      y: base64UrlEncode(point.subarray(33, 65)),
+      d: base64UrlEncode(secret),
+      ext: false
+    },
+    { name: "ECDSA", namedCurve: "P-256" },
+    false,
+    ["sign"]
+  );
+  return base64UrlEncode(new Uint8Array(await globalThis.crypto.subtle.sign({ name: "ECDSA", hash: "SHA-256" }, key3, data)));
+}
+async function verifyWithPoint(publicKey, data, signature) {
+  try {
+    const point = p256.Point.fromBytes(base64UrlDecode(publicKey)).toBytes(false);
+    const key3 = await globalThis.crypto.subtle.importKey("raw", point, { name: "ECDSA", namedCurve: "P-256" }, false, ["verify"]);
+    return await globalThis.crypto.subtle.verify({ name: "ECDSA", hash: "SHA-256" }, key3, base64UrlDecode(signature), data);
+  } catch {
+    return false;
+  }
+}
 function contactPublicKey(secret) {
   return base64UrlEncode(p256.getPublicKey(secret, true));
 }
@@ -3714,7 +3750,7 @@ async function openSealed(privateKey, sealed, context) {
   }
 }
 
-// ../src/utils/hash.ts
+// ../core/src/utils/hash.ts
 async function sha2562(data) {
   const buffer = await globalThis.crypto.subtle.digest("SHA-256", data);
   return new Uint8Array(buffer);
@@ -3765,7 +3801,7 @@ async function cidFromBytes(data) {
   return "b" + base32Encode(hashBytes);
 }
 
-// ../src/records/links.ts
+// ../core/src/records/links.ts
 var LINK_REL_PATTERN = /^[a-z][a-zA-Z0-9]{0,63}$/;
 var MAX_LINKS = 32;
 function checkLinks(links2) {
@@ -3783,7 +3819,7 @@ function checkLinks(links2) {
   return null;
 }
 
-// ../src/records/version.ts
+// ../core/src/records/version.ts
 var MAX_SEEN = 64;
 var RECORD_KEY_PATTERN = /^[a-z0-9:._-]{1,128}$/;
 function newRecordKey() {
@@ -3824,7 +3860,7 @@ function checkVersionShape(expression) {
   return null;
 }
 
-// ../src/schema/expression.ts
+// ../core/src/schema/expression.ts
 function canonicalize(obj) {
   if (obj === null || typeof obj !== "object") {
     return JSON.stringify(obj) ?? "null";
@@ -3869,7 +3905,7 @@ async function getExpressionId(expr) {
   return await cidFromBytes(bytes);
 }
 
-// ../src/identity/ucan.ts
+// ../core/src/identity/ucan.ts
 var UCAN_CLOCK_SKEW_SECONDS = 300;
 async function issueUCAN(options, provider) {
   const header = { alg: "ES256", typ: "JWT", ucv: "0.10.0" };
@@ -4060,7 +4096,7 @@ async function resolveDelegationRoot(encoded, resolveProof, provider, options =
   return { valid: false, rootDid: null, capabilities: [], audience: null, reason: `Delegation chain deeper than ${MAX_CHAIN_DEPTH} links` };
 }
 
-// ../src/identity/root-signer.ts
+// ../core/src/identity/root-signer.ts
 function createLocalRootSigner(identity, provider) {
   return Object.freeze({
     did: identity.did,
@@ -4080,7 +4116,7 @@ function createLocalRootSigner(identity, provider) {
   });
 }
 
-// ../src/identity/pairing.ts
+// ../core/src/identity/pairing.ts
 var ROOM_PREFIX = utf8Encode("weave-pairing-room-v1");
 var PAIRING_KEY_INFO = utf8Encode("weave-pairing-key-v1");
 var IV_BYTES3 = 12;
@@ -4112,7 +4148,7 @@ async function openPairingPayload(sealed, key3) {
   }
 }
 
-// ../src/identity/agent-note.ts
+// ../core/src/identity/agent-note.ts
 var AGENT_FACT = Object.freeze({ weave: "agent" });
 function isAgentNote(encoded) {
   if (!encoded) return false;
@@ -4124,7 +4160,7 @@ function isAgentNote(encoded) {
   }
 }
 
-// ../src/schema/schema-engine.ts
+// ../core/src/schema/schema-engine.ts
 function createSchemaEngine() {
   const collections = /* @__PURE__ */ new Map();
   return Object.freeze({
@@ -4157,7 +4193,7 @@ function createSchemaEngine() {
   });
 }
 
-// ../src/schema/signer.ts
+// ../core/src/schema/signer.ts
 function createSigner(provider) {
   return Object.freeze({
     async sign(payload, privateKey) {
@@ -4183,7 +4219,7 @@ function createSigner(provider) {
   });
 }
 
-// ../src/sync/negentropy.ts
+// ../core/src/sync/negentropy.ts
 var NEGENTROPY_VERSION = 97;
 var ID_SIZE = 32;
 var FINGERPRINT_SIZE = 16;
@@ -4473,7 +4509,7 @@ function createReconciler(set, options) {
 }
 var key = (id) => String.fromCharCode(...id);
 
-// ../src/storage/storage-provider.ts
+// ../core/src/storage/storage-provider.ts
 var CURRENT_PREFIX = "r/";
 var GENESIS_PREFIX = "g/";
 var HISTORY_PREFIX = "h/";
@@ -4698,7 +4734,7 @@ function createStorageProvider(adapter) {
   });
 }
 
-// ../src/storage/encrypted-adapter.ts
+// ../core/src/storage/encrypted-adapter.ts
 var MAGIC = new Uint8Array([119, 101, 97, 118, 101, 101, 2, 0]);
 var IV_BYTES4 = 12;
 var DEFAULT_ENCRYPTED_PREFIXES = ["space:", "spacekey:", "spaceinvite:", "spacerole:"];
@@ -4762,7 +4798,7 @@ function createEncryptedAdapter(inner, key3, options) {
   });
 }
 
-// ../src/storage/folder-reconcile.ts
+// ../core/src/storage/folder-reconcile.ts
 async function reconcileFolder(storage, adapter, accept = async () => true) {
   const disk = await adapter.reload();
   if (disk.added.length > 0 || disk.removed.length > 0) storage.invalidate();
@@ -4791,7 +4827,7 @@ async function reconcileFolder(storage, adapter, accept = async () => true) {
   };
 }
 
-// ../src/privacy/space-encryption.ts
+// ../core/src/privacy/space-encryption.ts
 async function generateSpaceKey() {
   const key3 = await globalThis.crypto.subtle.generateKey(
     { name: "AES-GCM", length: 256 },
@@ -4877,7 +4913,7 @@ async function openWith(spaceKey, sealed, context) {
   }
 }
 
-// ../src/space/roles.ts
+// ../core/src/space/roles.ts
 var MANAGE = "manage";
 var INVITE = "invite";
 var DEFINE = "define";
@@ -5296,7 +5332,7 @@ function replayAccess(genesis, events) {
   }
 }
 
-// ../src/space/space-access.ts
+// ../core/src/space/space-access.ts
 var READ_INFO = "weave/space-read/v1";
 var INVITE_INFO = "weave/space-invite/v1";
 function generateInviteSecret() {
@@ -5400,7 +5436,7 @@ async function verifyInvite(spaceId, did, inviteDid, signature, provider) {
   }
 }
 
-// ../src/space/presets.ts
+// ../core/src/space/presets.ts
 var solo = Object.freeze({
   roles: Object.freeze([{ name: "owner", title: "Owner", rank: 100, permissions: ["*"] }]),
   creatorRole: "owner"
@@ -5422,7 +5458,7 @@ var community = Object.freeze({
 });
 var rolePresets = Object.freeze({ solo, team, community });
 
-// ../src/space/space-manager.ts
+// ../core/src/space/space-manager.ts
 var SPACE_PREFIX = "space:";
 var KEY_PREFIX = "spacekey:";
 var INVITE_PREFIX = "spaceinvite:";
@@ -5600,7 +5636,7 @@ function parseSpaceInvite(invite) {
   }
 }
 
-// ../src/space/account-registry.ts
+// ../core/src/space/account-registry.ts
 var MEMBERSHIP_COLLECTION = "sys.joined";
 var PROFILE_COLLECTION = "sys.profile";
 var PROFILE_KEY = "profile";
@@ -5652,7 +5688,7 @@ async function deriveAccountSpace(accountKey, owner, label, name, provider) {
   return { space: space2, key: key3, invite: null, role: solo.creatorRole };
 }
 
-// ../node_modules/@cfworker/json-schema/dist/esm/deep-compare-strict.js
+// ../../node_modules/@cfworker/json-schema/dist/esm/deep-compare-strict.js
 function deepCompareStrict(a, b) {
   const typeofa = typeof a;
   if (typeofa !== typeof b) {
@@ -5693,7 +5729,7 @@ function deepCompareStrict(a, b) {
   return a === b;
 }
 
-// ../node_modules/@cfworker/json-schema/dist/esm/pointer.js
+// ../../node_modules/@cfworker/json-schema/dist/esm/pointer.js
 function encodePointer(p) {
   return encodeURI(escapePointer(p));
 }
@@ -5701,7 +5737,7 @@ function escapePointer(p) {
   return p.replace(/~/g, "~0").replace(/\//g, "~1");
 }
 
-// ../node_modules/@cfworker/json-schema/dist/esm/dereference.js
+// ../../node_modules/@cfworker/json-schema/dist/esm/dereference.js
 var schemaArrayKeyword = {
   prefixItems: true,
   items: true,
@@ -5822,7 +5858,7 @@ function dereference(schema, lookup = /* @__PURE__ */ Object.create(null), baseU
   return lookup;
 }
 
-// ../node_modules/@cfworker/json-schema/dist/esm/format.js
+// ../../node_modules/@cfworker/json-schema/dist/esm/format.js
 var DATE = /^(\d\d\d\d)-(\d\d)-(\d\d)$/;
 var DAYS = [0, 31, 28, 31, 30, 31, 30, 31, 31, 30, 31, 30, 31];
 var TIME = /^(\d\d):(\d\d):(\d\d)(\.\d+)?(z|[+-]\d\d(?::?\d\d)?)?$/i;
@@ -5915,7 +5951,7 @@ function regex(str2) {
   }
 }
 
-// ../node_modules/@cfworker/json-schema/dist/esm/types.js
+// ../../node_modules/@cfworker/json-schema/dist/esm/types.js
 var OutputFormat;
 (function(OutputFormat2) {
   OutputFormat2[OutputFormat2["Flag"] = 1] = "Flag";
@@ -5923,7 +5959,7 @@ var OutputFormat;
   OutputFormat2[OutputFormat2["Detailed"] = 4] = "Detailed";
 })(OutputFormat || (OutputFormat = {}));
 
-// ../node_modules/@cfworker/json-schema/dist/esm/ucs2-length.js
+// ../../node_modules/@cfworker/json-schema/dist/esm/ucs2-length.js
 function ucs2length(s) {
   let result = 0;
   let length = s.length;
@@ -5942,7 +5978,7 @@ function ucs2length(s) {
   return result;
 }
 
-// ../node_modules/@cfworker/json-schema/dist/esm/validate.js
+// ../../node_modules/@cfworker/json-schema/dist/esm/validate.js
 function validate(instance, schema, draft = "2019-09", lookup = dereference(schema), shortCircuit = true, recursiveAnchor = null, instanceLocation = "#", schemaLocation = "#", evaluated = /* @__PURE__ */ Object.create(null)) {
   if (schema === true) {
     return { valid: true, errors: [] };
@@ -6700,7 +6736,7 @@ Known schemas:
   return { valid: errors.length === 0, errors };
 }
 
-// ../node_modules/@cfworker/json-schema/dist/esm/validator.js
+// ../../node_modules/@cfworker/json-schema/dist/esm/validator.js
 var Validator = class {
   schema;
   draft;
@@ -6723,7 +6759,7 @@ var Validator = class {
   }
 };
 
-// ../src/records/rules.ts
+// ../core/src/records/rules.ts
 var PERMISSION_PATTERN = /^[a-z][a-zA-Z0-9]{0,39}$/;
 var permissionName = (collection2, permission) => `${collection2}/${permission}`;
 var isWho = (w) => w === "member" || w === "creator" || typeof w === "string" && w.startsWith("can:") && PERMISSION_PATTERN.test(w.slice(4));
@@ -6793,7 +6829,7 @@ function changedFixedField(fixed, first, next) {
   return null;
 }
 
-// ../src/records/topics.ts
+// ../core/src/records/topics.ts
 var MAX_TOPICS = 8;
 var MAX_TAGS = 64;
 var TAG_BYTES = 16;
@@ -6845,7 +6881,7 @@ function sameTags(a, b) {
   return left.length === right.length && left.every((tag, i) => tag === right[i]);
 }
 
-// ../src/schema/collection-def.ts
+// ../core/src/schema/collection-def.ts
 function toJsonSchema(schema) {
   const standard = schema["~standard"];
   if (!standard) return schema;
@@ -7006,7 +7042,7 @@ function validateJsonSchema(schema, value) {
   }));
 }
 
-// ../src/utils/events.ts
+// ../core/src/utils/events.ts
 function createEmitter() {
   const listeners = /* @__PURE__ */ new Map();
   return {
@@ -7028,7 +7064,7 @@ function createEmitter() {
   };
 }
 
-// ../src/network/signaling.ts
+// ../core/src/network/signaling.ts
 var SIGNAL_KINDS = /* @__PURE__ */ new Set(["offer", "answer", "candidate"]);
 function iceFrom(payload) {
   const { servers, expiresAt } = payload ?? {};
@@ -7145,7 +7181,7 @@ function createSignalingClient(url, did) {
   });
 }
 
-// ../src/network/multi-signaling.ts
+// ../core/src/network/multi-signaling.ts
 function createMultiSignalingClient(urls, did) {
   if (urls.length === 0) {
     throw new Error("At least one relay is needed to introduce peers.");
@@ -7279,7 +7315,7 @@ function createMultiSignalingClient(urls, did) {
   });
 }
 
-// ../src/network/introductions.ts
+// ../core/src/network/introductions.ts
 var PEERS_MESSAGE = "__peers";
 var SIGNAL_MESSAGE = "__signal";
 var AUTH_HELLO_MESSAGE = "__auth-hello";
@@ -7318,7 +7354,7 @@ function signalId() {
   return Array.from(bytes, (byte) => byte.toString(16).padStart(2, "0")).join("");
 }
 
-// ../src/network/rtc-transport.ts
+// ../core/src/network/rtc-transport.ts
 function fingerprintOf2(description) {
   const match = description?.sdp?.match(/^a=fingerprint:\s*(\S+)\s+(\S+)/im);
   return match ? `${match[1].toLowerCase()} ${match[2].toUpperCase()}` : null;
@@ -7454,7 +7490,7 @@ function createRTCTransport(config) {
   });
 }
 
-// ../src/network/peer-auth.ts
+// ../core/src/network/peer-auth.ts
 function readAccessOf(read) {
   if (!read) return null;
   if ("current" in read) return read;
@@ -7540,7 +7576,7 @@ function createMeshAuth(spaceId, session, read, provider) {
   });
 }
 
-// ../src/network/ws-transport.ts
+// ../core/src/network/ws-transport.ts
 function parseFrame(data, type) {
   if (typeof data !== "string") return null;
   try {
@@ -7686,7 +7722,7 @@ function createWebSocketTransport(config) {
   });
 }
 
-// ../src/network/mesh.ts
+// ../core/src/network/mesh.ts
 var ICE_REFRESH_MS = 10 * 6e4;
 var ICE_WAIT_MS = 1500;
 function createMesh(config) {
@@ -7967,7 +8003,7 @@ function createMesh(config) {
   };
 }
 
-// ../src/network/network-manager.ts
+// ../core/src/network/network-manager.ts
 function createNetworkManager(config) {
   const transport = config.createTransport();
   const peers = /* @__PURE__ */ new Map();
@@ -8013,7 +8049,7 @@ function createNetworkManager(config) {
   });
 }
 
-// ../src/sync/sync-messages.ts
+// ../core/src/sync/sync-messages.ts
 var SYNC_PROTOCOL_VERSION = 4;
 function parseSyncMessage(value) {
   const message = value;
@@ -8021,7 +8057,7 @@ function parseSyncMessage(value) {
   return message;
 }
 
-// ../src/sync/sync-engine.ts
+// ../core/src/sync/sync-engine.ts
 var MAX_WAITING = 1e3;
 var MAX_REFUSED = 1e4;
 var holdsCollection = (holds2, collection2) => collection2.startsWith("sys.") || holds2 === "all" || holds2.has(collection2);
@@ -8309,7 +8345,7 @@ ${id}`;
   };
 }
 
-// ../src/validation/crypto-gate.ts
+// ../core/src/validation/crypto-gate.ts
 function createCryptoGate(provider) {
   return {
     async validate(expression, resolvePublicKey) {
@@ -8336,7 +8372,7 @@ function createCryptoGate(provider) {
   };
 }
 
-// ../src/validation/structural-gate.ts
+// ../core/src/validation/structural-gate.ts
 function isEncryptedBody(body) {
   if (!body || typeof body !== "object") return false;
   const envelope = body;
@@ -8370,7 +8406,7 @@ function createStructuralGate(schemaEngine, options = {}) {
   };
 }
 
-// ../src/validation/stateful-gate.ts
+// ../core/src/validation/stateful-gate.ts
 function createStatefulGate() {
   const rules = /* @__PURE__ */ new Map();
   return {
@@ -8416,7 +8452,7 @@ function createStatefulGate() {
   };
 }
 
-// ../src/validation/capability-gate.ts
+// ../core/src/validation/capability-gate.ts
 var fail = (reason) => ({ passed: false, gate: "capability", reason });
 var MAX_CLOCK_SKEW_SECONDS = 300;
 function createCapabilityGate(config) {
@@ -8459,7 +8495,7 @@ function createCapabilityGate(config) {
   };
 }
 
-// ../src/validation/validation-engine.ts
+// ../core/src/validation/validation-engine.ts
 function createValidationEngine(config) {
   const { cryptoGate, structuralGate, statefulGate, capabilityGate, resolvePublicKey, getExpression } = config;
   return {
@@ -8485,7 +8521,7 @@ function createValidationEngine(config) {
   };
 }
 
-// ../src/query/filter.ts
+// ../core/src/query/filter.ts
 var MAX_INCLUDE_DEPTH = 3;
 var META = {
   "@key": (r) => r.key,
@@ -8649,7 +8685,7 @@ function checkQuery(query) {
   return null;
 }
 
-// ../src/query/types.ts
+// ../core/src/query/types.ts
 var nameOf = (ref) => typeof ref === "object" && ref !== null && typeof ref.name === "string" ? ref.name : ref;
 function plainQuery(query) {
   const isObject = (v) => typeof v === "object" && v !== null && !Array.isArray(v);
@@ -8663,7 +8699,7 @@ function plainQuery(query) {
   return { ...query, collection: nameOf(query.collection), ...query.include !== void 0 ? { include: includes(query.include) } : {} };
 }
 
-// ../src/query/engine.ts
+// ../core/src/query/engine.ts
 function compareValues(a, b) {
   if (a === b) return 0;
   if (a === void 0 || a === null) return -1;
@@ -8723,7 +8759,7 @@ async function runQuery(source, given) {
   return { records, cursor: more ? page[page.length - 1].key : null, complete: true };
 }
 
-// ../src/storage/segment.ts
+// ../core/src/storage/segment.ts
 var SEGMENT_SUFFIX = ".seg";
 function packSegment(versions) {
   return utf8Encode(JSON.stringify({ v: 1, versions }));
@@ -8743,7 +8779,7 @@ async function segmentName(counter, bytes) {
 }
 var versionSize = (version) => utf8Encode(JSON.stringify(version)).length;
 
-// ../src/storage/mirror.ts
+// ../core/src/storage/mirror.ts
 var WRITER_KEY = "mirror:writer";
 var COUNTER_KEY = "mirror:counter";
 var readKey = (name) => `mirror:read:${name}`;
@@ -8889,7 +8925,7 @@ async function createMirror(config) {
   });
 }
 
-// ../src/space/pass.ts
+// ../core/src/space/pass.ts
 var PASS_COLLECTION = "sys.pass";
 var CARRY_CLOSED_KEY = "carry:closed";
 async function passKey(spaceId) {
@@ -8920,7 +8956,7 @@ function carriedRecord(pass) {
   return { space: pass.space, key: null, invite: null, role: null, read: pass.read };
 }
 
-// ../src/node/space-runtime.ts
+// ../core/src/node/space-runtime.ts
 var MANAGED = /* @__PURE__ */ new Set([MEMBERSHIP_COLLECTION, PROFILE_COLLECTION, CARRIER_COLLECTION, PASS_COLLECTION, BOX_COLLECTION, MEMBER_KEY_COLLECTION, ...ACCESS_COLLECTIONS]);
 var IN_THE_CLEAR = /* @__PURE__ */ new Set([ROLE_COLLECTION, MEMBER_COLLECTION, INVITE_COLLECTION, REVOKE_COLLECTION, KEY_COLLECTION, BOX_COLLECTION, MEMBER_KEY_COLLECTION, RELAYS_COLLECTION, KEEPERS_COLLECTION]);
 var ACCESS_KEYS = [
@@ -9863,7 +9899,7 @@ async function openSpaceRuntime(deps) {
     channel.unref?.();
   }
   const HOUR = 36e5;
-  const DAY2 = 24 * HOUR;
+  const DAY3 = 24 * HOUR;
   const declared = new Set((cache?.collections ?? []).filter((c) => !c.startsWith("sys.")));
   let cacheTimer = null;
   const saveCache = () => {
@@ -9951,7 +9987,7 @@ async function openSpaceRuntime(deps) {
   });
   async function dropUnused() {
     if (!cache || !partial || closed) return;
-    const cutoff = Date.now() - (cache.unusedAfterDays ?? 30) * DAY2;
+    const cutoff = Date.now() - (cache.unusedAfterDays ?? 30) * DAY3;
     const waiting = /* @__PURE__ */ new Set();
     for (const name of await adapter.list(PENDING_PREFIX)) {
       const bytes = await adapter.get(name);
@@ -10379,7 +10415,7 @@ async function openSpaceRuntime(deps) {
   });
 }
 
-// ../src/schemas/contacts.ts
+// ../core/src/schemas/contacts.ts
 var typed = () => (definition) => definition;
 var contact = typed()({
   name: "std.contact",
@@ -10392,7 +10428,8 @@ var contact = typed()({
       name: { type: "string", maxLength: 200, description: "What you call them" },
       space: { type: "string", maxLength: 256, description: "The id of your space for two" },
       note: { type: "string", maxLength: 2e3 },
-      blocked: { type: "boolean", description: "Their contact requests are hidden, in every space" }
+      blocked: { type: "boolean", description: "Their contact requests are hidden, in every space" },
+      door: { type: "string", maxLength: 64, description: "The door they knocked on, while your answer is still to be written in your space for two" }
     },
     required: ["did", "name"]
   },
@@ -10412,8 +10449,275 @@ var contactRequest = typed()({
   },
   rules: { edit: "creator", delete: "creator" }
 });
+var door = typed()({
+  name: "std.door",
+  title: "Door",
+  description: "A way for people you share no space with to ask to become your contact.",
+  schema: {
+    type: "object",
+    properties: {
+      id: { type: "string", minLength: 16, maxLength: 64, description: "Random; the door key is derived from it" },
+      label: { type: "string", maxLength: 64, description: "What you call this door \u2014 only you see it" },
+      name: { type: "string", maxLength: 64, description: "The name its code gives, shown to whoever knocks" },
+      relays: { type: "array", items: { type: "string", maxLength: 200 }, minItems: 1, maxItems: 3, description: "Whose mailboxes hold its knocks" }
+    },
+    required: ["id", "relays"]
+  },
+  rules: { onePer: ["id"] }
+});
+var knock = typed()({
+  name: "std.knock",
+  title: "Knock",
+  description: "A knock left on a door, waiting for an answer.",
+  schema: {
+    type: "object",
+    properties: {
+      space: { type: "string", maxLength: 256, description: "The space for two it invites them to" },
+      name: { type: "string", maxLength: 64, description: "The name their door code gave" },
+      door: { type: "string", maxLength: 64, description: "The door key knocked on" },
+      sign: { type: "string", maxLength: 64, description: "The door's signing key, which their answer must be signed with" },
+      invite: { type: "string", maxLength: 8e3, description: "The invite sent, to close once they answer" }
+    },
+    required: ["space", "name", "door", "sign", "invite"]
+  },
+  rules: { onePer: ["space"] }
+});
+var knockAnswer = typed()({
+  name: "std.knock-answer",
+  title: "Knock answer",
+  description: "Proof that the account which joined is the one behind the door knocked on.",
+  schema: {
+    type: "object",
+    properties: {
+      sig: { type: "string", maxLength: 200, description: 'The door signing key over "weave/knock-answer/v1|<space>|<account>"' }
+    },
+    required: ["sig"]
+  },
+  rules: { edit: "creator", delete: "creator" }
+});
+
+// ../core/src/doors/doors.ts
+var MAX_DOOR_RELAYS = 3;
+var KNOCK_TTL_SECONDS = 14 * 24 * 3600;
+var KNOCK_DROP_WINDOW_SECONDS = 600;
+var MAX_NAME = 64;
+var MAX_NOTE = 2e3;
+var MAX_INVITE = 6e3;
+var MAX_PROOF = 4096;
+function clip(text, max) {
+  const chars = Array.from(text);
+  return chars.length <= max ? text : chars.slice(0, max).join("");
+}
+function encodeDoorCode(code) {
+  const problem = checkDoorCode({ v: 1, ...code });
+  if (problem) throw new Error(problem);
+  return base64UrlEncode(
+    utf8Encode(canonicalize({ v: 1, key: code.key, sign: code.sign, relays: [...code.relays], ...code.name ? { name: code.name } : {} }))
+  );
+}
+function parseDoorCode(text) {
+  const trimmed = text.trim();
+  const found = /(?:^|[#?&])door=([A-Za-z0-9_-]+)/.exec(trimmed);
+  const raw = found ? found[1] : trimmed;
+  let parsed;
+  try {
+    parsed = JSON.parse(utf8Decode(base64UrlDecode(raw)));
+  } catch {
+    throw new Error("That is not a door code \u2014 it may be cut short.");
+  }
+  const problem = checkDoorCode(parsed);
+  if (problem) throw new Error(`That door code doesn't work: ${problem}`);
+  const code = parsed;
+  return Object.freeze({ v: 1, key: code.key, sign: code.sign, relays: Object.freeze([...code.relays]), ...code.name ? { name: code.name } : {} });
+}
+function checkDoorCode(value) {
+  const code = value;
+  if (!code || typeof code !== "object" || code.v !== 1) return "it is not a version 1 door";
+  if (!isContactPublicKey(code.key)) return "its key is not a P-256 public key";
+  if (!isContactPublicKey(code.sign) || code.sign === code.key) return "its signing key is not a P-256 public key of its own";
+  if (!Array.isArray(code.relays) || code.relays.length === 0 || code.relays.length > MAX_DOOR_RELAYS) {
+    return `it names 1\u2013${MAX_DOOR_RELAYS} relays`;
+  }
+  const relays = checkRelays(code.relays);
+  if (relays) return relays;
+  if (code.name !== void 0 && (typeof code.name !== "string" || Array.from(code.name).length > MAX_NAME)) return `its name is text of at most ${MAX_NAME} characters`;
+  return null;
+}
+async function doorTopic(sign) {
+  return base64UrlEncode(await sha2562(utf8Encode(`weave/door-topic/v1|${sign}`)));
+}
+var purgeMessage = (topic, nonce, ids) => utf8Encode(`weave/door-purge/v1|${topic}|${nonce}|${ids ? [...ids].sort().join(",") : "*"}`);
+function signPurge(signKey, topic, nonce, ids) {
+  return signWithScalar(signKey, purgeMessage(topic, nonce, ids));
+}
+var answerMessage = (pairSpace, did) => utf8Encode(`weave/knock-answer/v1|${pairSpace}|${did}`);
+function signAnswer(signKey, pairSpace, did) {
+  return signWithScalar(signKey, answerMessage(pairSpace, did));
+}
+function checkAnswer(sign, pairSpace, did, signature) {
+  return verifyWithPoint(sign, answerMessage(pairSpace, did), signature);
+}
+async function knockId(blob) {
+  return base64UrlEncode(await sha2562(utf8Encode(blob)));
+}
+var knockContext = (door2) => `weave/knock/v1|${door2}`;
+async function sealKnock(door2, knock2, session, provider) {
+  const note = knock2.note ? clip(knock2.note.trim(), MAX_NOTE) : void 0;
+  const body = {
+    v: 1,
+    door: door2,
+    from: knock2.from,
+    name: clip(knock2.name.trim(), MAX_NAME) || "Someone",
+    invite: knock2.invite,
+    ...note ? { note } : {},
+    at: Math.floor(Date.now() / 1e3),
+    session: session.did,
+    proof: session.proof
+  };
+  const sig = base64UrlEncode(await provider.sign(session.key, utf8Encode(canonicalize(body))));
+  return sealFor(door2, { body, sig }, knockContext(door2));
+}
+async function openKnock(doorKey, blob, receivedAt, provider) {
+  const door2 = contactPublicKey(doorKey);
+  const opened = await openSealed((await contactKeyPair(doorKey)).privateKey, blob, knockContext(door2));
+  const body = opened?.body;
+  if (!body || typeof opened.sig !== "string") return null;
+  if (body.v !== 1 || body.door !== door2) return null;
+  if (typeof body.from !== "string" || typeof body.session !== "string" || typeof body.name !== "string") return null;
+  if (Array.from(body.name).length > MAX_NAME) return null;
+  if (typeof body.invite !== "string" || body.invite.length > MAX_INVITE) return null;
+  if (typeof body.proof !== "string" || body.proof.length > MAX_PROOF) return null;
+  if (body.note !== void 0 && (typeof body.note !== "string" || Array.from(body.note).length > MAX_NOTE)) return null;
+  if (!Number.isSafeInteger(body.at) || !Number.isFinite(receivedAt)) return null;
+  const now = Math.floor(Date.now() / 1e3);
+  if (body.at > now + UCAN_CLOCK_SKEW_SECONDS || body.at < now - KNOCK_TTL_SECONDS) return null;
+  const dropped = Math.floor(receivedAt / 1e3);
+  if (body.at > dropped + UCAN_CLOCK_SKEW_SECONDS || body.at < dropped - KNOCK_DROP_WINDOW_SECONDS) return null;
+  let signed = false;
+  try {
+    const key3 = await provider.importPublicKey(didToPublicKey(body.session).publicKeyBytes);
+    signed = await provider.verify(key3, base64UrlDecode(opened.sig), utf8Encode(canonicalize(body)));
+  } catch {
+    return null;
+  }
+  if (!signed) return null;
+  if (isAgentNote(body.proof)) return null;
+  const chain = await resolveDelegationRoot(body.proof, () => null, provider, { at: body.at }).catch(() => null);
+  if (!chain?.valid || chain.audience !== body.session || chain.rootDid !== body.from) return null;
+  if (!chain.capabilities.some((capability) => capability.with === "*" && (capability.can === "expression/*" || capability.can === "*"))) return null;
+  let invited;
+  try {
+    invited = parseSpaceInvite(body.invite);
+  } catch {
+    return null;
+  }
+  if (invited.space.creator !== body.from || invited.space.visibility !== "private" || !invited.key) return null;
+  if (await checkSpace(invited.space) !== null) return null;
+  return Object.freeze({
+    from: body.from,
+    name: clip(body.name, MAX_NAME) || "Someone",
+    ...body.note ? { note: body.note } : {},
+    invite: body.invite,
+    pairSpace: invited.space.id,
+    at: body.at * 1e3
+  });
+}
 
-// ../src/space/notify.ts
+// ../core/src/network/mailbox.ts
+var MAX_PAGES = 8;
+function createMailboxClient(options = {}) {
+  const timeoutMs = options.timeoutMs ?? 8e3;
+  function ask(relay, message, pick) {
+    return talk(relay, (send2) => send2(message), async (answer) => pick(answer));
+  }
+  function talk(relay, start, hear) {
+    const Socket = options.WebSocket ?? globalThis.WebSocket;
+    if (!Socket) return Promise.reject(new Error("No WebSocket here to reach a relay with"));
+    return new Promise((resolve, reject) => {
+      let settled = false;
+      const ws = new Socket(relay);
+      const finish = (error, value) => {
+        if (settled) return;
+        settled = true;
+        clearTimeout(timer);
+        try {
+          ws.close();
+        } catch {
+        }
+        if (error) reject(error);
+        else resolve(value);
+      };
+      const timer = setTimeout(() => finish(new Error(`${relay} did not answer`)), timeoutMs);
+      const say = (message) => ws.send(JSON.stringify(message));
+      ws.onopen = () => start(say);
+      ws.onerror = () => finish(new Error(`Could not reach ${relay}`));
+      ws.onclose = () => finish(new Error(`${relay} closed the connection`));
+      ws.onmessage = (event) => {
+        let answer;
+        try {
+          answer = JSON.parse(String(event.data));
+        } catch {
+          return;
+        }
+        if (!answer || typeof answer !== "object") return;
+        hear(answer, say).then(
+          (value) => {
+            if (value !== void 0) finish(null, value);
+          },
+          (error) => finish(error instanceof Error ? error : new Error(String(error)))
+        );
+      };
+    });
+  }
+  const client = {
+    drop(relay, topic, blob, ttlSeconds) {
+      return ask(relay, { type: "drop", topic, blob, ...ttlSeconds ? { ttl: ttlSeconds } : {} }, (answer) => {
+        if (answer.topic !== topic) return void 0;
+        if (answer.type === "dropped" && typeof answer.id === "string") return answer.id;
+        if (answer.type === "refused") throw new Error(`${relay} refused the knock: ${String(answer.reason ?? "no reason given")}`);
+        return void 0;
+      });
+    },
+    async fetch(relay, topic, after = 0) {
+      const found = [];
+      let from = after;
+      for (let page = 0; page < MAX_PAGES; page++) {
+        const { items, more } = await ask(
+          relay,
+          { type: "fetch", topic, after: from },
+          (answer) => answer.type === "mail" && answer.topic === topic && Array.isArray(answer.items) ? { items: answer.items.filter(isMailItem), more: answer.more === true } : void 0
+        );
+        found.push(...items);
+        if (!more || items.length === 0) break;
+        from = Math.max(...items.map((item) => item.seq));
+      }
+      return found;
+    },
+    purge(relay, topic, sign, ids, signChallenge) {
+      return talk(
+        relay,
+        (send2) => send2({ type: "challenge" }),
+        async (answer, send2) => {
+          if (answer.type === "challenge" && typeof answer.nonce === "string") {
+            send2({ type: "purge", topic, sign, ...ids ? { ids: [...ids] } : {}, sig: await signChallenge(answer.nonce) });
+            return void 0;
+          }
+          if (answer.topic !== topic) return void 0;
+          if (answer.type === "purged" && typeof answer.count === "number") return answer.count;
+          if (answer.type === "refused") throw new Error(`${relay} refused to clear the door: ${String(answer.reason ?? "no reason given")}`);
+          return void 0;
+        }
+      );
+    }
+  };
+  return Object.freeze(client);
+}
+function isMailItem(value) {
+  const item = value;
+  return !!item && Number.isSafeInteger(item.seq) && typeof item.id === "string" && typeof item.at === "number" && typeof item.blob === "string";
+}
+
+// ../core/src/space/notify.ts
 var NOTIFY_COLLECTION = "sys.notify";
 var SUBSCRIPTION_COLLECTION = "sys.subscription";
 var COLLECTION = /^[a-z][a-z0-9-]*(\.[a-z0-9-]+)+$/;
@@ -10500,7 +10804,7 @@ function matchesSubscription(sub, spaceId, version, account, now = Date.now()) {
   return true;
 }
 
-// ../src/session/hosting.ts
+// ../core/src/session/hosting.ts
 var HOSTING_COLLECTION = "sys.hosting";
 var REQUEST_WINDOW_SECONDS = 300;
 function newSubscriptionSeed() {
@@ -10616,7 +10920,7 @@ function createHostClient(url, host, key3, provider = createP256Provider()) {
   });
 }
 
-// ../src/node/node.ts
+// ../core/src/node/node.ts
 var SESSION_CAPABILITY = { with: "*", can: "expression/*" };
 var DEFAULT_TTL_SECONDS = 3600;
 var FORGET_CARRIER_AFTER_MS = 30 * 24 * 3600 * 1e3;
@@ -11425,11 +11729,13 @@ async function createNode(config) {
       if (!contact2.did.startsWith("did:")) throw new Error("A contact needs their account DID");
       const name = contact2.name.trim().slice(0, 200);
       if (!name) throw new Error("A contact needs a name");
+      const pending = (await contactRecords()).find((record) => record.body.did === contact2.did)?.body?.door;
       return writeContact({
         did: contact2.did,
         name,
         ...contact2.space ? { space: contact2.space } : {},
-        ...contact2.note ? { note: contact2.note.slice(0, 2e3) } : {}
+        ...contact2.note ? { note: contact2.note.slice(0, 2e3) } : {},
+        ...pending ? { door: pending } : {}
       });
     },
     async remove(did) {
@@ -11505,6 +11811,253 @@ async function createNode(config) {
       return [...seen].filter((account2) => account2 !== config.signer.did && account2 !== did).sort();
     }
   });
+  const mailbox = config.mailbox ?? createMailboxClient();
+  const knockCache = /* @__PURE__ */ new Map();
+  const DAY_MS = 24 * 3600 * 1e3;
+  function requireContactKey(what) {
+    if (agentSession) throw new Error(`An agent can't use doors. ${what} is the person's to do.`);
+    if (!config.contactKey) throw new Error(`${what} needs your contact key. Connect to your account home again, and allow contacts.`);
+    return config.contactKey;
+  }
+  async function doorKeys(id) {
+    const contactKey = requireContactKey("A door");
+    const key3 = await deriveDoorKeyBytes(contactKey, id);
+    const sign = await deriveDoorSignKeyBytes(contactKey, id);
+    const signPublic = contactPublicKey(sign);
+    return { key: key3, sign, publicKey: contactPublicKey(key3), signPublic, topic: await doorTopic(signPublic) };
+  }
+  async function doorRecords() {
+    if (!contactsSpaceId) return [];
+    return (await (await contactsRuntime()).list({ collection: door.name })).filter(
+      (record) => record.verified && record.root === config.signer.did && typeof record.body?.id === "string" && Array.isArray(record.body.relays)
+    );
+  }
+  async function doorView(record) {
+    const body = record.body;
+    const keys = await doorKeys(body.id);
+    return Object.freeze({
+      id: body.id,
+      ...body.label ? { label: body.label } : {},
+      ...body.name ? { name: body.name } : {},
+      key: keys.publicKey,
+      sign: keys.signPublic,
+      relays: Object.freeze([...body.relays]),
+      code: encodeDoorCode({ key: keys.publicKey, sign: keys.signPublic, relays: body.relays, ...body.name ? { name: body.name } : {} }),
+      createdAt: record.createdAt
+    });
+  }
+  async function purgeDoor(door2, ids) {
+    const keys = await doorKeys(door2.id);
+    const done = await Promise.allSettled(
+      door2.relays.map((relay) => mailbox.purge(relay, keys.topic, keys.signPublic, ids, (nonce) => signPurge(keys.sign, keys.topic, nonce, ids)))
+    );
+    return done.filter((result) => result.status === "fulfilled").length;
+  }
+  async function sentRecords() {
+    if (!contactsSpaceId) return [];
+    return (await (await contactsRuntime()).list({ collection: knock.name })).filter(
+      (record) => record.verified && record.root === config.signer.did && typeof record.body?.space === "string" && typeof record.body.sign === "string" && typeof record.body.invite === "string"
+    );
+  }
+  async function settleSent() {
+    for (const record of await sentRecords()) {
+      const { space: space2, name, sign, invite } = record.body;
+      if (!await registry.get(space2)) {
+        await (await contactsRuntime()).remove(record.key);
+        continue;
+      }
+      const open2 = await runtime(space2);
+      const { members } = await open2.access();
+      let answered = null;
+      for (const answer of await open2.list({ collection: knockAnswer.name })) {
+        const did = answer.root;
+        if (!answer.verified || !did || did === config.signer.did || answer.createdBy !== did || typeof answer.body?.sig !== "string") continue;
+        if (!members.some((member) => member.did === did)) continue;
+        if (await checkAnswer(sign, space2, did, answer.body.sig)) {
+          answered = did;
+          break;
+        }
+      }
+      if (answered) {
+        await spaces.closeInvite(space2, invite).catch(() => {
+        });
+        const given = (await open2.profiles()).find((profile) => profile.did === answered)?.name;
+        await writeContact({ did: answered, name: given ?? name, space: space2 });
+        await (await contactsRuntime()).remove(record.key);
+      } else if (Date.now() - Date.parse(record.createdAt) > KNOCK_TTL_SECONDS * 1e3 + DAY_MS) {
+        await spaces.leave(space2).catch(() => {
+        });
+        await (await contactsRuntime()).remove(record.key);
+      }
+    }
+  }
+  async function answerAccepted() {
+    for (const record of await contactRecords()) {
+      const { did, space: space2, door: door2 } = record.body;
+      if (typeof door2 !== "string" || typeof space2 !== "string") continue;
+      if (!await registry.get(space2)) continue;
+      const open2 = await runtime(space2);
+      if ((await open2.access()).role === null) continue;
+      const { sign } = await doorKeys(door2);
+      try {
+        await open2.put(knockAnswer.name, { sig: await signAnswer(sign, space2, config.signer.did) });
+      } catch {
+        continue;
+      }
+      const { door: _answered, ...rest } = record.body;
+      await writeContact({ ...rest, did });
+    }
+  }
+  async function readDoors() {
+    const now = Date.now();
+    for (const [id, cached] of knockCache) if (cached.until <= now) knockCache.delete(id);
+    const found = [];
+    for (const record of await doorRecords()) {
+      const { id: doorId, relays } = record.body;
+      const keys = await doorKeys(doorId);
+      const held = /* @__PURE__ */ new Map();
+      for (const result of await Promise.allSettled(relays.map((relay) => mailbox.fetch(relay, keys.topic)))) {
+        if (result.status !== "fulfilled") continue;
+        for (const item of result.value) {
+          const id = await knockId(item.blob);
+          const seen = held.get(id);
+          if (!seen || item.at < seen.at) held.set(id, { blob: item.blob, at: item.at });
+        }
+      }
+      for (const [id, item] of held) {
+        let cached = knockCache.get(id);
+        if (!cached) {
+          cached = { opened: await openKnock(keys.key, item.blob, item.at, provider), door: doorId, until: item.at + KNOCK_TTL_SECONDS * 1e3 };
+          knockCache.set(id, cached);
+        }
+        if (cached.opened) found.push({ id, door: doorId, opened: cached.opened });
+      }
+    }
+    return found;
+  }
+  const doors = Object.freeze({
+    async list() {
+      if (!config.contactKey || agentSession) return [];
+      return Promise.all((await doorRecords()).map(doorView));
+    },
+    async open(options = {}) {
+      requireContactKey("Opening a door");
+      if (!contactsSpaceId) await contactsRuntime();
+      const relays = [...options.relays ?? (config.network?.relays ?? []).filter((url) => checkRelays([url]) === null)].slice(0, MAX_DOOR_RELAYS);
+      if (relays.length === 0) throw new Error("A door needs a relay to hold its knocks, and this node has none.");
+      const name = clip((options.name ?? await ownName() ?? "").trim(), 64);
+      const label = options.label ? clip(options.label.trim(), 64) : "";
+      const id = base64UrlEncode(globalThis.crypto.getRandomValues(new Uint8Array(16)));
+      const keys = await doorKeys(id);
+      encodeDoorCode({ key: keys.publicKey, sign: keys.signPublic, relays, ...name ? { name } : {} });
+      const open2 = await contactsRuntime();
+      await ensureDefined(open2, door);
+      return doorView(await open2.put(door.name, { id, relays, ...name ? { name } : {}, ...label ? { label } : {} }));
+    },
+    async close(id) {
+      const found = (await doorRecords()).find((record) => record.body.id === id);
+      if (found) await (await contactsRuntime()).remove(found.key);
+      for (const [knock2, cached] of knockCache) if (cached.door === id) knockCache.delete(knock2);
+    },
+    async clear(id) {
+      requireContactKey("Clearing a door");
+      const found = (await doorRecords()).find((record) => record.body.id === id);
+      if (!found) throw new Error("There is no such door");
+      if (await purgeDoor(found.body, null) === 0) throw new Error("None of the door's relays could be reached to clear it.");
+      for (const [knock2, cached] of knockCache) if (cached.door === id) knockCache.delete(knock2);
+    },
+    async knock(code, options = {}) {
+      requireContactKey("Knocking on a door");
+      requireEverywhere("Knocking on a door");
+      const door2 = parseDoorCode(code);
+      for (const mine2 of await doors.list()) if (mine2.key === door2.key) throw new Error("That is one of your own doors");
+      if (!contactsSpaceId) await contactsRuntime();
+      const mine = await ownName() ?? "Someone";
+      const theirs = door2.name ?? "Contact";
+      const pair = await spaces.create({ name: `${clip(mine, 64)} & ${theirs}`, visibility: "private", ...team });
+      let invite;
+      try {
+        await ensureDefined(await runtime(pair.id), knockAnswer);
+        invite = await spaces.invite(pair.id, { role: "editor" });
+        const blob = await sealKnock(
+          door2.key,
+          { from: config.signer.did, name: mine, invite, ...options.note ? { note: options.note } : {} },
+          { did: session.did, key: session.key, proof: session.proof() },
+          provider
+        );
+        const topic = await doorTopic(door2.sign);
+        const left = await Promise.allSettled(door2.relays.map((relay) => mailbox.drop(relay, topic, blob, KNOCK_TTL_SECONDS)));
+        if (!left.some((result) => result.status === "fulfilled")) {
+          const reasons = left.map((result) => result.status === "rejected" ? String(result.reason?.message ?? result.reason) : "").filter(Boolean);
+          throw new Error(`None of their door's relays took the knock. ${reasons.join("; ")}`);
+        }
+      } catch (error) {
+        await spaces.leave(pair.id).catch(() => {
+        });
+        throw error;
+      }
+      const open2 = await contactsRuntime();
+      await ensureDefined(open2, knock);
+      await open2.put(knock.name, { space: pair.id, name: theirs, door: door2.key, sign: door2.sign, invite });
+      return { space: pair.id };
+    },
+    async knocks() {
+      requireContactKey("Reading knocks");
+      await settleSent().catch(() => {
+      });
+      await answerAccepted().catch(() => {
+      });
+      const blocked = new Set((await contactRecords()).filter((record) => record.body.blocked === true).map((record) => record.body.did));
+      const found = [];
+      for (const { id, door: door2, opened } of await readDoors()) {
+        if (opened.from === config.signer.did || blocked.has(opened.from)) continue;
+        if (await registry.get(opened.pairSpace)) continue;
+        found.push(
+          Object.freeze({
+            id,
+            door: door2,
+            from: opened.from,
+            name: opened.name,
+            ...opened.note ? { note: opened.note } : {},
+            pairSpace: opened.pairSpace,
+            at: new Date(opened.at).toISOString()
+          })
+        );
+      }
+      return found.sort((a, b) => b.at.localeCompare(a.at));
+    },
+    async sent() {
+      await settleSent().catch(() => {
+      });
+      return (await sentRecords()).map((record) => Object.freeze({ space: record.body.space, name: record.body.name, at: record.createdAt }));
+    },
+    async accept(id) {
+      requireContactKey("Opening the door to someone");
+      requireEverywhere("Opening the door to someone");
+      if (!knockCache.get(id)?.opened) await readDoors();
+      const cached = knockCache.get(id);
+      const knocked = cached?.opened;
+      if (!cached || !knocked) throw new Error("That knock is gone: it expired, or the door was closed or cleared.");
+      await spaces.join(knocked.invite);
+      const known = await contacts.get(knocked.from);
+      const contact2 = await writeContact({ did: knocked.from, name: known?.name ?? knocked.name, space: knocked.pairSpace, door: cached.door });
+      await answerAccepted().catch(() => {
+      });
+      const door2 = (await doorRecords()).find((record) => record.body.id === cached.door);
+      if (door2) await purgeDoor(door2.body, [id]).catch(() => 0);
+      knockCache.delete(id);
+      return contact2;
+    },
+    async dismiss(id) {
+      requireContactKey("Dismissing a knock");
+      if (!knockCache.has(id)) await readDoors();
+      const cached = knockCache.get(id);
+      if (!cached) return;
+      const door2 = (await doorRecords()).find((record) => record.body.id === cached.door);
+      if (door2) await purgeDoor(door2.body, [id]);
+      knockCache.delete(id);
+    }
+  });
   const collections = Object.freeze({
     async list(spaceId) {
       return (await runtime(spaceId)).collections();
@@ -11721,6 +12274,18 @@ async function createNode(config) {
         accept: person("accept contact requests"),
         others: person("look inside a contact's space")
       }),
+      // Doors are the person's: an agent has none and knocks on none.
+      doors: Object.freeze({
+        list: async () => [],
+        open: person("open a door"),
+        close: person("close a door"),
+        knock: person("knock on anyone's door"),
+        clear: person("clear a door"),
+        knocks: person("read knocks"),
+        sent: person("look at knocks"),
+        accept: person("open the door to anyone"),
+        dismiss: person("dismiss a knock")
+      }),
       delegation: () => note,
       iceServers: node.iceServers,
       delegate: person("pass its access on"),
@@ -11744,6 +12309,7 @@ async function createNode(config) {
     hosting,
     notifications,
     contacts,
+    doors,
     asAgent,
     delegation: () => current,
     iceServers: async () => mesh ? mesh.iceServers() : config.network?.iceServers ?? DEFAULT_ICE_SERVERS,
@@ -11779,7 +12345,7 @@ async function createNode(config) {
   return node;
 }
 
-// ../src/node/stores.ts
+// ../core/src/node/stores.ts
 function folderStores(directory2, options = {}) {
   return async (path7, storeOptions) => {
     const full = options.basePath ? `${options.basePath}/${path7}` : path7;
@@ -11788,7 +12354,7 @@ function folderStores(directory2, options = {}) {
   };
 }
 
-// ../src/network/local-transport.ts
+// ../core/src/network/local-transport.ts
 var later = (fn) => void setTimeout(fn, 0);
 function createLocalHub() {
   const connected = /* @__PURE__ */ new Map();
@@ -11834,7 +12400,7 @@ function createLocalHub() {
   };
 }
 
-// ../src/node/carrier.ts
+// ../core/src/node/carrier.ts
 async function createCarryCore(config) {
   const provider = config.provider ?? createP256Provider();
   const signer = createSigner(provider);
@@ -12065,7 +12631,7 @@ async function createCarryCore(config) {
   };
 }
 
-// ../src/node/host.ts
+// ../core/src/node/host.ts
 var SUBSCRIPTION_PREFIX = "subscription:";
 var NotAllowedError = class extends Error {
   constructor() {
@@ -12227,7 +12793,7 @@ async function createHostNode(config) {
   return Object.freeze(host);
 }
 
-// ../src/records/describe.ts
+// ../core/src/records/describe.ts
 var KNOWN_RULES = ["create", "edit", "delete", "onePer", "fixed"];
 var words = (name) => name.replace(/^.*\./, "").replace(/([a-z0-9])([A-Z])/g, "$1 $2").replace(/[_-]+/g, " ").toLowerCase();
 var article = (noun) => /^[aeiou]/.test(noun) ? `an ${noun}` : `a ${noun}`;
@@ -12305,7 +12871,7 @@ function describeCollection(definition) {
   return sentences;
 }
 
-// ../src/schemas/apps.ts
+// ../core/src/schemas/apps.ts
 var MAX_APP_COLLECTIONS = 10;
 var app = {
   name: "std.app",
@@ -12406,7 +12972,7 @@ async function proposeApp(node, spaceId, body) {
   return node.records.put(spaceId, app.name, body);
 }
 
-// ../src/schemas/screens.ts
+// ../core/src/schemas/screens.ts
 var SCREEN_GUIDE = `A screen is one HTML document (scripts and styles inline, at most 48 KB) put on a collection definition as "screen".
 When the app is added, apps in the space can show it instead of plain lists. It runs sealed: no network (no fetch, no
 images from URLs, no fonts from URLs), no storage, no popups, no forms that submit. Keep state in records, never in the page.
@@ -12432,7 +12998,7 @@ Draw everything from weave.list(...) and redraw on weave.onChange \u2014 other p
 Two people can write at once: design collections so that clashes resolve by the rules (onePer, creator-only edits), not by the screen.
 Use plain DOM; no libraries can be loaded. Prefer system fonts and simple, readable styling that works in light and dark.`;
 
-// ../src/node/actions.ts
+// ../core/src/node/actions.ts
 var space = { type: "string", description: "Space id, from spaces_list" };
 var key2 = { type: "string", description: "Record key \u2014 stays the same when the record is edited" };
 var str = (input, key3) => input[key3];
@@ -12873,7 +13439,7 @@ async function runAction(node, name, input = {}) {
   return action.run(node, input);
 }
 
-// ../node_modules/aws4fetch/dist/aws4fetch.esm.mjs
+// ../../node_modules/aws4fetch/dist/aws4fetch.esm.mjs
 var encoder2 = new TextEncoder();
 var HOST_SERVICES = {
   appstream2: "appstream",
@@ -13152,7 +13718,7 @@ function guessServiceRegion(url, headers) {
   return [HOST_SERVICES[service] || service, region || ""];
 }
 
-// ../src/storage/blob/s3.ts
+// ../core/src/storage/blob/s3.ts
 var ATTEMPTS = 5;
 function createS3BlobStore(config) {
   const client = new AwsClient({
@@ -13328,7 +13894,7 @@ async function createAccount(home, options) {
     throw new Error(`This home already has an account for ${did}`);
   }
   let vault = createVault({ did, label: options.name, wraps: [] });
-  if (options.passphrase) vault = withWrap(vault, await wrapSeedWithPassphrase(seed, options.passphrase, "CLI passphrase"));
+  if (options.passphrase) vault = withWrap(vault, await wrapSeedWithPassphrase(seed, options.passphrase, CLI_PASSPHRASE_LABEL));
   const id = newAccountId();
   const account = {
     id,
@@ -13389,8 +13955,8 @@ async function unlock(home, account, secret) {
 import { createServer } from "node:http";
 import { WebSocketServer } from "ws";
 
-// ../server/relay.mjs
-import { createHmac, randomBytes as randomBytes4 } from "node:crypto";
+// ../relay/relay.mjs
+import { createHash, createHmac, createPublicKey, randomBytes as randomBytes4, verify } from "node:crypto";
 var MAX_MESSAGE_BYTES = 64 * 1024;
 var MAX_CONNECTIONS = 5e3;
 var MAX_CONNECTIONS_PER_IP = 32;
@@ -13404,6 +13970,32 @@ var RATE_BURST = 100;
 var HEARTBEAT_MS = 15e3;
 var MAX_BUFFERED_BYTES = 1024 * 1024;
 var MAX_TURN_ADDRESSES = 2e4;
+var MAX_BLOB_LENGTH = 12e3;
+var TOPIC_PATTERN = /^[A-Za-z0-9_-]{43}$/;
+var MAX_MAIL_PER_TOPIC = 64;
+var RESERVED_PER_TOPIC = 2;
+var DROP_WINDOW_MS = 36e5;
+var MAILBOX_LIMITS = Object.freeze({
+  /** Topics held at once */
+  maxTopics: 5e4,
+  /** Everything held at once, in blob characters */
+  maxChars: 64 * 1024 * 1024,
+  /**
+   * Past `maxChars`, a reserve only topics holding fewer than two knocks may
+   * use: a mailbox someone filled still takes a knock or two on every door.
+   */
+  reserveChars: 8 * 1024 * 1024,
+  /** How long a knock is kept. A client may ask for less, never more. */
+  ttlSeconds: 14 * 24 * 3600,
+  /** Drops one address may make into one topic per hour: filling a door takes many addresses */
+  dropsPerNetworkPerTopic: 4,
+  /** Drops one address may make in all, per hour: filling the mailbox takes very many */
+  dropsPerNetwork: 30
+});
+var PURGE_SPKI_PREFIX = Buffer.from("3039301306072a8648ce3d020106082a8648ce3d030107032200", "hex");
+var MAX_WATCHES_PER_SOCKET = 32;
+var MAX_PAGE_ITEMS = 16;
+var MAX_PAGE_CHARS = 48 * 1024;
 var ROUTED = /* @__PURE__ */ new Set(["offer", "answer", "candidate"]);
 var DID_PATTERN = /^did:key:z[1-9A-HJ-NP-Za-km-z]+$/;
 var CLOSE_DID_TAKEN = 4009;
@@ -13415,19 +14007,25 @@ function turnFromEnv(env) {
 }
 function createRelay(options = {}) {
   const { turn } = options;
+  const limits = { ...MAILBOX_LIMITS, ...options.mailbox };
   const log = options.log ?? (() => {
   });
   const rooms = /* @__PURE__ */ new Map();
   const clients = /* @__PURE__ */ new Set();
   const perIp = /* @__PURE__ */ new Map();
   const turnByNetwork = /* @__PURE__ */ new Map();
+  const mailbox = /* @__PURE__ */ new Map();
+  const watchers = /* @__PURE__ */ new Map();
+  const dropsBy = /* @__PURE__ */ new Map();
+  let mailChars = 0;
+  let mailSeq = 0;
   function canEnter(room) {
     if (typeof room !== "string" || room.length === 0 || room.length > MAX_ROOM_LENGTH) return false;
     const peers = rooms.get(room);
     return peers ? peers.size < MAX_PEERS_PER_ROOM : rooms.size < MAX_ROOMS;
   }
   function accept(ws, legacyRoom, ip) {
-    const client = { ws, legacyRoom, ip, did: null, rooms: /* @__PURE__ */ new Set(), alive: true, tokens: RATE_BURST, refilled: Date.now() };
+    const client = { ws, legacyRoom, ip, did: null, rooms: /* @__PURE__ */ new Set(), watching: /* @__PURE__ */ new Set(), nonce: null, alive: true, tokens: RATE_BURST, refilled: Date.now() };
     clients.add(client);
     perIp.set(ip, (perIp.get(ip) ?? 0) + 1);
     ws.on("pong", () => client.alive = true);
@@ -13447,6 +14045,7 @@ function createRelay(options = {}) {
       if (left > 0) perIp.set(ip, left);
       else perIp.delete(ip);
       for (const room of [...client.rooms]) leave(client, room);
+      for (const topic of [...client.watching]) unwatch(client, topic);
     };
     ws.on("close", drop);
     ws.on("error", () => ws.terminate());
@@ -13477,6 +14076,10 @@ function createRelay(options = {}) {
       log(`peer joined room ${short(room)} (${rooms.get(room).size} present)`);
       return;
     }
+    if (message.type === "drop" || message.type === "fetch" || message.type === "unwatch" || message.type === "challenge" || message.type === "purge") {
+      handleMail(client, message);
+      return;
+    }
     if (message.type === "ice") {
       if (client.did) offerTurn(client);
       return;
@@ -13494,6 +14097,137 @@ function createRelay(options = {}) {
       }
     }
   }
+  function handleMail(client, message) {
+    if (message.type === "challenge") {
+      client.nonce = randomBytes4(18).toString("base64url");
+      send2(client, JSON.stringify({ type: "challenge", nonce: client.nonce }));
+      return;
+    }
+    const { topic } = message;
+    if (typeof topic !== "string" || !TOPIC_PATTERN.test(topic)) return;
+    if (message.type === "unwatch") {
+      unwatch(client, topic);
+      return;
+    }
+    if (message.type === "purge") {
+      purge(client, message);
+      return;
+    }
+    if (message.type === "fetch") {
+      const after = Number.isSafeInteger(message.after) ? message.after : 0;
+      if (message.watch === true && !client.watching.has(topic) && client.watching.size < MAX_WATCHES_PER_SOCKET) {
+        client.watching.add(topic);
+        if (!watchers.has(topic)) watchers.set(topic, /* @__PURE__ */ new Set());
+        watchers.get(topic).add(client);
+      }
+      const now2 = Date.now();
+      const items = [];
+      let chars = 0;
+      let more = false;
+      for (const item2 of mailbox.get(topic) ?? []) {
+        if (item2.seq <= after || item2.expires <= now2) continue;
+        if (items.length >= MAX_PAGE_ITEMS || chars + item2.blob.length > MAX_PAGE_CHARS) {
+          more = true;
+          break;
+        }
+        items.push(mailItem(item2));
+        chars += item2.blob.length;
+      }
+      send2(client, JSON.stringify({ type: "mail", topic, items, more }));
+      return;
+    }
+    const refuse = (reason) => send2(client, JSON.stringify({ type: "refused", topic, reason }));
+    const { blob } = message;
+    if (typeof blob !== "string" || blob.length === 0 || blob.length > MAX_BLOB_LENGTH || !/^[A-Za-z0-9_-]+$/.test(blob)) {
+      refuse("A knock is base64url, at most 12000 characters");
+      return;
+    }
+    const id = createHash("sha256").update(blob).digest("base64url");
+    const held = mailbox.get(topic) ?? [];
+    if (held.some((item2) => item2.id === id)) {
+      send2(client, JSON.stringify({ type: "dropped", topic, id }));
+      return;
+    }
+    const now = Date.now();
+    const network = networkOf(client.ip);
+    const here = countOf(`${network}|${topic}`, now);
+    const everywhere = countOf(network, now);
+    if (here >= limits.dropsPerNetworkPerTopic) return refuse("Too many knocks on this door from here; try later");
+    if (everywhere >= limits.dropsPerNetwork) return refuse("Too many knocks from here; try later");
+    if (held.length >= MAX_MAIL_PER_TOPIC) return refuse("This door is full");
+    if (!mailbox.has(topic) && mailbox.size >= limits.maxTopics) return refuse("The mailbox is full");
+    const room = held.length < RESERVED_PER_TOPIC ? limits.maxChars + limits.reserveChars : limits.maxChars;
+    if (mailChars + blob.length > room) return refuse("The mailbox is full");
+    const ttl = Number.isFinite(message.ttl) && message.ttl > 0 ? Math.min(message.ttl, limits.ttlSeconds) : limits.ttlSeconds;
+    const item = { seq: ++mailSeq, id, at: now, expires: now + ttl * 1e3, blob };
+    held.push(item);
+    mailbox.set(topic, held);
+    mailChars += blob.length;
+    counted(`${network}|${topic}`, now);
+    counted(network, now);
+    send2(client, JSON.stringify({ type: "dropped", topic, id }));
+    const news = JSON.stringify({ type: "mail", topic, items: [mailItem(item)], more: false });
+    for (const watcher of watchers.get(topic) ?? []) {
+      if (watcher !== client) send2(watcher, news);
+    }
+  }
+  const mailItem = ({ seq, id, at, blob }) => ({ seq, id, at, blob });
+  function countOf(key3, now) {
+    const recent = dropsBy.get(key3);
+    return recent && now - recent.since < DROP_WINDOW_MS ? recent.count : 0;
+  }
+  function counted(key3, now) {
+    const recent = dropsBy.get(key3);
+    if (recent && now - recent.since < DROP_WINDOW_MS) recent.count += 1;
+    else dropsBy.set(key3, { count: 1, since: now });
+  }
+  function purge(client, message) {
+    const { topic, sign, sig } = message;
+    const refuse = (reason) => send2(client, JSON.stringify({ type: "refused", topic, reason }));
+    const nonce = client.nonce;
+    client.nonce = null;
+    const ids = message.ids === void 0 ? null : message.ids;
+    if (!nonce) return refuse("Ask for a challenge first");
+    if (typeof sign !== "string" || !/^[A-Za-z0-9_-]{44}$/.test(sign) || typeof sig !== "string" || sig.length > 200) return refuse("Not a purge");
+    if (ids !== null && (!Array.isArray(ids) || ids.length > MAX_MAIL_PER_TOPIC || !ids.every((id) => typeof id === "string" && id.length <= 64))) {
+      return refuse("Not a purge");
+    }
+    if (createHash("sha256").update(`weave/door-topic/v1|${sign}`).digest("base64url") !== topic) return refuse("That key is not this door\u2019s");
+    let good = false;
+    try {
+      const key3 = createPublicKey({ key: Buffer.concat([PURGE_SPKI_PREFIX, Buffer.from(sign, "base64url")]), format: "der", type: "spki" });
+      const signed = `weave/door-purge/v1|${topic}|${nonce}|${ids ? [...ids].sort().join(",") : "*"}`;
+      good = verify("sha256", Buffer.from(signed), { key: key3, dsaEncoding: "ieee-p1363" }, Buffer.from(sig, "base64url"));
+    } catch {
+      good = false;
+    }
+    if (!good) return refuse("The signature does not check out");
+    const held = mailbox.get(topic) ?? [];
+    const gone = ids === null ? held : held.filter((item) => ids.includes(item.id));
+    for (const item of gone) mailChars -= item.blob.length;
+    const kept = ids === null ? [] : held.filter((item) => !ids.includes(item.id));
+    if (kept.length === 0) mailbox.delete(topic);
+    else mailbox.set(topic, kept);
+    send2(client, JSON.stringify({ type: "purged", topic, count: gone.length }));
+  }
+  function unwatch(client, topic) {
+    client.watching.delete(topic);
+    const watching = watchers.get(topic);
+    watching?.delete(client);
+    if (watching?.size === 0) watchers.delete(topic);
+  }
+  function sweepMail() {
+    const now = Date.now();
+    for (const [topic, held] of mailbox) {
+      const kept = held.filter((item) => item.expires > now);
+      for (const item of held) if (item.expires <= now) mailChars -= item.blob.length;
+      if (kept.length === 0) mailbox.delete(topic);
+      else if (kept.length !== held.length) mailbox.set(topic, kept);
+    }
+    for (const [key3, recent] of dropsBy) {
+      if (now - recent.since >= DROP_WINDOW_MS) dropsBy.delete(key3);
+    }
+  }
   function offerTurn(client) {
     if (!turn) return;
     const network = networkOf(client.ip);
@@ -13551,6 +14285,7 @@ function createRelay(options = {}) {
     for (const [network, held] of turnByNetwork) {
       if (held.expires <= now) turnByNetwork.delete(network);
     }
+    sweepMail();
     for (const client of clients) {
       if (!client.alive) {
         client.ws.terminate();
@@ -14807,7 +15542,11 @@ import { mkdir as mkdir2, readFile as readFile3, rm, writeFile as writeFile2 } f
 import os3 from "node:os";
 import path4 from "node:path";
 
-// ../src/session/connect.ts
+// ../core/src/session/stay-signed-in.ts
+var DAY2 = 24 * 60 * 60 * 1e3;
+var DURATION2 = { never: 0, "1d": DAY2, "7d": 7 * DAY2, "30d": 30 * DAY2 };
+
+// ../core/src/session/connect.ts
 function grantSigner(grant) {
   let token = null;
   return {
@@ -14823,7 +15562,7 @@ function grantSigner(grant) {
   };
 }
 
-// ../src/session/agent-link.ts
+// ../core/src/session/agent-link.ts
 var SECRET_BYTES = 16;
 var ROOM_PREFIX2 = utf8Encode("weave-agent-link-room-v1");
 var KEY_INFO = utf8Encode("weave-agent-link-key-v1");
@@ -14831,7 +15570,7 @@ var ASK = "agent-link:ask";
 var HEARD = "agent-link:heard";
 var ANSWER = "agent-link:answer";
 var DONE = "agent-link:done";
-var MAX_NAME = 80;
+var MAX_NAME2 = 80;
 function readAgentCode(input) {
   const match = /wv_([A-Za-z0-9_-]{22})(?![A-Za-z0-9_-])/.exec(input);
   const secret = match ? base64UrlDecode(match[1]) : null;
@@ -14898,7 +15637,7 @@ async function acceptAgentLink(params) {
       done();
     };
     net.on("peer-connected", (peer) => {
-      void seal2({ did: params.did, name: params.name.slice(0, MAX_NAME) }, key3).then((payload) => {
+      void seal2({ did: params.did, name: params.name.slice(0, MAX_NAME2) }, key3).then((payload) => {
         net.send(peer.did, { type: ASK, from: params.did, payload });
       });
     });