@weaveprotocol/cli 0.2.1 → 0.2.2

package/README.md

@@ -30,7 +30,7 @@ To have `weave` everywhere:
 npm install -g @weaveprotocol/cli            # or run it without installing: npx @weaveprotocol/cli <command>
 ```
 
-From this repo: `npm install` at the repo root (the CLI is a workspace), then `cd cli && npm run bundle && npm link`, or a
+From this repo: `npm install` at the repo root (the CLI is a workspace), then `cd packages/cli && npm run bundle && npm link`, or a
 binary with no Node at all: `bun build.ts --native`.
 
 ```bash
@@ -230,5 +230,5 @@ space anywhere leaves it everywhere.
   across real networks, behind a strict NAT, in Safari, and on a phone
   switching apps.
 
-What the protocol still has planned is in [the spec](../docs/spec/README.md),
+What the protocol still has planned is in [the spec](../../spec/README.md),
 under **Planned** in each part.

package/dist/weave.mjs

@@ -6,7 +6,7 @@ import path6 from "node:path";
 import { createInterface as createInterface2 } from "node:readline";
 import { parseArgs } from "node:util";
 
-// ../src/utils/encoding.ts
+// ../core/src/utils/encoding.ts
 var encoder = new TextEncoder();
 var decoder = new TextDecoder();
 function utf8Encode(str2) {
@@ -46,7 +46,7 @@ function bytesToHex(bytes) {
   return Array.from(bytes, (byte) => byte.toString(16).padStart(2, "0")).join("");
 }
 
-// ../node_modules/@noble/hashes/_u64.js
+// ../../node_modules/@noble/hashes/_u64.js
 var fromNumH = (n) => n / 2 ** 32 | 0;
 var fromNumL = (n) => n >>> 0;
 function setU64FromNum(view, byteOffset, n, isLE) {
@@ -56,7 +56,7 @@ function setU64FromNum(view, byteOffset, n, isLE) {
   view.setUint32(byteOffset + 4, isLE ? h : l, isLE);
 }
 
-// ../node_modules/@noble/hashes/utils.js
+// ../../node_modules/@noble/hashes/utils.js
 function isBytes(a) {
   return a instanceof Uint8Array || ArrayBuffer.isView(a) && a.constructor.name === "Uint8Array" && "BYTES_PER_ELEMENT" in a && a.BYTES_PER_ELEMENT === 1;
 }
@@ -221,7 +221,7 @@ var oidNist = (suffix) => ({
   oid: Uint8Array.from([6, 9, 96, 134, 72, 1, 101, 3, 4, 2, suffix])
 });
 
-// ../node_modules/@noble/hashes/_md.js
+// ../../node_modules/@noble/hashes/_md.js
 function Chi(a, b, c) {
   return a & b ^ ~a & c;
 }
@@ -334,7 +334,7 @@ var SHA256_IV = /* @__PURE__ */ Uint32Array.from([
   1541459225
 ]);
 
-// ../node_modules/@noble/hashes/sha2.js
+// ../../node_modules/@noble/hashes/sha2.js
 var SHA256_K = /* @__PURE__ */ Uint32Array.from([
   1116352408,
   1899447441,
@@ -499,7 +499,7 @@ var sha256 = /* @__PURE__ */ createHasher(
   /* @__PURE__ */ oidNist(1)
 );
 
-// ../node_modules/@noble/curves/utils.js
+// ../../node_modules/@noble/curves/utils.js
 function aarray(item, title, inner = () => {
 }) {
   if (!Array.isArray(item))
@@ -681,7 +681,7 @@ function validateObject(object, fields = {}, optFields = {}, title = "object") {
   iter(optFields, true);
 }
 
-// ../node_modules/@noble/curves/abstract/modular.js
+// ../../node_modules/@noble/curves/abstract/modular.js
 var _0n2 = /* @__PURE__ */ BigInt(0);
 var _1n2 = /* @__PURE__ */ BigInt(1);
 var _2n = /* @__PURE__ */ BigInt(2);
@@ -1131,7 +1131,7 @@ function mapHashToField(key3, fieldOrder, isLE = false) {
   return isLE ? numberToBytesLE(reduced, fieldLen) : numberToBytesBE(reduced, fieldLen);
 }
 
-// ../node_modules/@noble/curves/abstract/curve.js
+// ../../node_modules/@noble/curves/abstract/curve.js
 var _0n3 = /* @__PURE__ */ BigInt(0);
 var _1n3 = /* @__PURE__ */ BigInt(1);
 var _4n2 = /* @__PURE__ */ BigInt(4);
@@ -1518,7 +1518,7 @@ function createKeygen(randomSecretKey, getPublicKey) {
   };
 }
 
-// ../node_modules/@noble/hashes/hmac.js
+// ../../node_modules/@noble/hashes/hmac.js
 var _HMAC = class {
   oHash;
   iHash;
@@ -1595,7 +1595,7 @@ var hmac = /* @__PURE__ */ (() => {
   return hmac_;
 })();
 
-// ../node_modules/@noble/curves/abstract/der.js
+// ../../node_modules/@noble/curves/abstract/der.js
 var _0n4 = /* @__PURE__ */ BigInt(0);
 var DERErr = class extends Error {
   constructor(m = "") {
@@ -1722,7 +1722,7 @@ var DER = /* @__PURE__ */ (() => {
   return Object.freeze(_DER);
 })();
 
-// ../node_modules/@noble/curves/abstract/weierstrass.js
+// ../../node_modules/@noble/curves/abstract/weierstrass.js
 var divNearest = (num, den) => (num + (num >= 0 ? den : -den) / _2n2) / den;
 function _splitEndoScalar(k, basis, n) {
   aInRange("scalar", k, _0n5, n);
@@ -2554,7 +2554,7 @@ function ecdsa(Point, hash2, ecdsaOpts = {}) {
   });
 }
 
-// ../node_modules/@noble/curves/nist.js
+// ../../node_modules/@noble/curves/nist.js
 var p256_CURVE = /* @__PURE__ */ (() => ({
   p: BigInt("0xffffffff00000001000000000000000000000000ffffffffffffffffffffffff"),
   n: BigInt("0xffffffff00000000ffffffffffffffffbce6faada7179e84f3b9cac2fc632551"),
@@ -2567,7 +2567,7 @@ var p256_CURVE = /* @__PURE__ */ (() => ({
 var p256_Point = /* @__PURE__ */ weierstrass(p256_CURVE);
 var p256 = /* @__PURE__ */ ecdsa(p256_Point, sha256);
 
-// ../src/identity/crypto-p256.ts
+// ../core/src/identity/crypto-p256.ts
 var P256_SEED_BYTES = 48;
 var P256_KEY_INFO = new TextEncoder().encode("weave/p256-identity-key/v1");
 async function hkdf(ikm, info, length) {
@@ -2679,12 +2679,12 @@ function createP256Provider() {
   });
 }
 
-// ../src/utils/errors.ts
+// ../core/src/utils/errors.ts
 function protocolError(code, message, hint) {
   return Object.assign(new Error(message), { code, ...hint ? { hint } : {} });
 }
 
-// ../src/identity/webauthn.ts
+// ../core/src/identity/webauthn.ts
 var PRF_SALT = new TextEncoder().encode("weave-protocol-key-v1");
 async function registerPasskey(options) {
   if (!globalThis.navigator?.credentials) {
@@ -2780,10 +2780,10 @@ async function authenticatePasskey(credentialId, options) {
   });
 }
 
-// ../src/identity/passkey-diagnostics.ts
+// ../core/src/identity/passkey-diagnostics.ts
 var PRF_SALT2 = new TextEncoder().encode("weave-protocol-key-v1");
 
-// ../src/identity/keys.ts
+// ../core/src/identity/keys.ts
 async function deriveKeyPair(seed, provider) {
   const keyPair = await provider.deriveKeyPairFromSeed(seed);
   const publicKeyBytes = await provider.exportPublicKey(keyPair.publicKey);
@@ -2815,7 +2815,7 @@ async function deriveKeyFromPassword(password, salt, provider) {
   return deriveKeyPair(new Uint8Array(derivedBits), provider);
 }
 
-// ../src/identity/recovery-code.ts
+// ../core/src/identity/recovery-code.ts
 var ALPHABET = "0123456789ABCDEFGHJKMNPQRSTVWXYZ";
 var SUBSTITUTIONS = { O: "0", I: "1", L: "1", U: "V" };
 var SEED_BYTES = 16;
@@ -2876,7 +2876,7 @@ function encodeBase32(bytes) {
   return out;
 }
 
-// ../node_modules/@scure/base/index.js
+// ../../node_modules/@scure/base/index.js
 var freeze = (fn) => Object.freeze(fn());
 function isBytes3(a) {
   return a instanceof Uint8Array || ArrayBuffer.isView(a) && a.constructor.name === "Uint8Array" && "BYTES_PER_ELEMENT" in a && a.BYTES_PER_ELEMENT === 1;
@@ -3082,7 +3082,7 @@ var radix58 = /* @__PURE__ */ radixBaseN(58, B58_GROUP);
 var genBase58 = (abc) => genBaseN(radix58, abc);
 var base58 = /* @__PURE__ */ freeze(() => genBase58("123456789ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz"));
 
-// ../src/identity/did.ts
+// ../core/src/identity/did.ts
 var P256_MULTICODEC = new Uint8Array([128, 36]);
 function publicKeyToDid(publicKeyBytes, multicodecPrefix) {
   const prefixedKey = concatBytes(multicodecPrefix, publicKeyBytes);
@@ -3103,7 +3103,7 @@ function didToPublicKey(did) {
   return { multicodecPrefix, publicKeyBytes };
 }
 
-// ../src/identity/identity-manager.ts
+// ../core/src/identity/identity-manager.ts
 function prfUnsupported() {
   return protocolError(
     "PRF_UNSUPPORTED",
@@ -3194,7 +3194,7 @@ function createIdentityManager(config) {
   });
 }
 
-// ../src/storage/folder-adapter.ts
+// ../core/src/storage/folder-adapter.ts
 var EXPRESSION_SUFFIX = ".json";
 function encodeKey(key3) {
   let out = "";
@@ -3365,7 +3365,7 @@ async function createFolderAdapter(root, path7) {
   });
 }
 
-// ../src/identity/folder-account.ts
+// ../core/src/identity/folder-account.ts
 function createVault(params) {
   return {
     version: 2,
@@ -3376,7 +3376,7 @@ function createVault(params) {
   };
 }
 
-// ../src/identity/account-store.ts
+// ../core/src/identity/account-store.ts
 var LIST_FILE = "accounts.json";
 var ACCOUNTS_DIR = "accounts";
 var VAULT_FILE = "account.json";
@@ -3491,7 +3491,7 @@ function createFolderAccountStore(dir) {
   });
 }
 
-// ../src/identity/account-vault.ts
+// ../core/src/identity/account-vault.ts
 var IV_BYTES = 12;
 var SALT_BYTES = 16;
 var PASSPHRASE_ITERATIONS = 6e5;
@@ -3601,12 +3601,13 @@ async function deriveVaultKey(seed) {
     ["encrypt", "decrypt"]
   );
 }
+var CLI_PASSPHRASE_LABEL = "CLI passphrase";
 function withWrap(vault, wrap) {
   const superseded = (existing) => existing.kind === "device" && wrap.kind === "device" && existing.rpId === wrap.rpId;
   return { ...vault, wraps: [...vault.wraps.filter((existing) => !superseded(existing)), wrap] };
 }
 
-// ../src/identity/contact-key.ts
+// ../core/src/identity/contact-key.ts
 var CONTACT_KEY_INFO = "weave/p256-contact-key/v1";
 var SEAL_INFO = "weave/contact-seal/v1";
 var MEMBER_KEY_INFO = "weave/p256-member-key/v1";
@@ -3749,7 +3750,7 @@ async function openSealed(privateKey, sealed, context) {
   }
 }
 
-// ../src/utils/hash.ts
+// ../core/src/utils/hash.ts
 async function sha2562(data) {
   const buffer = await globalThis.crypto.subtle.digest("SHA-256", data);
   return new Uint8Array(buffer);
@@ -3800,7 +3801,7 @@ async function cidFromBytes(data) {
   return "b" + base32Encode(hashBytes);
 }
 
-// ../src/records/links.ts
+// ../core/src/records/links.ts
 var LINK_REL_PATTERN = /^[a-z][a-zA-Z0-9]{0,63}$/;
 var MAX_LINKS = 32;
 function checkLinks(links2) {
@@ -3818,7 +3819,7 @@ function checkLinks(links2) {
   return null;
 }
 
-// ../src/records/version.ts
+// ../core/src/records/version.ts
 var MAX_SEEN = 64;
 var RECORD_KEY_PATTERN = /^[a-z0-9:._-]{1,128}$/;
 function newRecordKey() {
@@ -3859,7 +3860,7 @@ function checkVersionShape(expression) {
   return null;
 }
 
-// ../src/schema/expression.ts
+// ../core/src/schema/expression.ts
 function canonicalize(obj) {
   if (obj === null || typeof obj !== "object") {
     return JSON.stringify(obj) ?? "null";
@@ -3904,7 +3905,7 @@ async function getExpressionId(expr) {
   return await cidFromBytes(bytes);
 }
 
-// ../src/identity/ucan.ts
+// ../core/src/identity/ucan.ts
 var UCAN_CLOCK_SKEW_SECONDS = 300;
 async function issueUCAN(options, provider) {
   const header = { alg: "ES256", typ: "JWT", ucv: "0.10.0" };
@@ -4095,7 +4096,7 @@ async function resolveDelegationRoot(encoded, resolveProof, provider, options =
   return { valid: false, rootDid: null, capabilities: [], audience: null, reason: `Delegation chain deeper than ${MAX_CHAIN_DEPTH} links` };
 }
 
-// ../src/identity/root-signer.ts
+// ../core/src/identity/root-signer.ts
 function createLocalRootSigner(identity, provider) {
   return Object.freeze({
     did: identity.did,
@@ -4115,7 +4116,7 @@ function createLocalRootSigner(identity, provider) {
   });
 }
 
-// ../src/identity/pairing.ts
+// ../core/src/identity/pairing.ts
 var ROOM_PREFIX = utf8Encode("weave-pairing-room-v1");
 var PAIRING_KEY_INFO = utf8Encode("weave-pairing-key-v1");
 var IV_BYTES3 = 12;
@@ -4147,7 +4148,7 @@ async function openPairingPayload(sealed, key3) {
   }
 }
 
-// ../src/identity/agent-note.ts
+// ../core/src/identity/agent-note.ts
 var AGENT_FACT = Object.freeze({ weave: "agent" });
 function isAgentNote(encoded) {
   if (!encoded) return false;
@@ -4159,7 +4160,7 @@ function isAgentNote(encoded) {
   }
 }
 
-// ../src/schema/schema-engine.ts
+// ../core/src/schema/schema-engine.ts
 function createSchemaEngine() {
   const collections = /* @__PURE__ */ new Map();
   return Object.freeze({
@@ -4192,7 +4193,7 @@ function createSchemaEngine() {
   });
 }
 
-// ../src/schema/signer.ts
+// ../core/src/schema/signer.ts
 function createSigner(provider) {
   return Object.freeze({
     async sign(payload, privateKey) {
@@ -4218,7 +4219,7 @@ function createSigner(provider) {
   });
 }
 
-// ../src/sync/negentropy.ts
+// ../core/src/sync/negentropy.ts
 var NEGENTROPY_VERSION = 97;
 var ID_SIZE = 32;
 var FINGERPRINT_SIZE = 16;
@@ -4508,7 +4509,7 @@ function createReconciler(set, options) {
 }
 var key = (id) => String.fromCharCode(...id);
 
-// ../src/storage/storage-provider.ts
+// ../core/src/storage/storage-provider.ts
 var CURRENT_PREFIX = "r/";
 var GENESIS_PREFIX = "g/";
 var HISTORY_PREFIX = "h/";
@@ -4733,7 +4734,7 @@ function createStorageProvider(adapter) {
   });
 }
 
-// ../src/storage/encrypted-adapter.ts
+// ../core/src/storage/encrypted-adapter.ts
 var MAGIC = new Uint8Array([119, 101, 97, 118, 101, 101, 2, 0]);
 var IV_BYTES4 = 12;
 var DEFAULT_ENCRYPTED_PREFIXES = ["space:", "spacekey:", "spaceinvite:", "spacerole:"];
@@ -4797,7 +4798,7 @@ function createEncryptedAdapter(inner, key3, options) {
   });
 }
 
-// ../src/storage/folder-reconcile.ts
+// ../core/src/storage/folder-reconcile.ts
 async function reconcileFolder(storage, adapter, accept = async () => true) {
   const disk = await adapter.reload();
   if (disk.added.length > 0 || disk.removed.length > 0) storage.invalidate();
@@ -4826,7 +4827,7 @@ async function reconcileFolder(storage, adapter, accept = async () => true) {
   };
 }
 
-// ../src/privacy/space-encryption.ts
+// ../core/src/privacy/space-encryption.ts
 async function generateSpaceKey() {
   const key3 = await globalThis.crypto.subtle.generateKey(
     { name: "AES-GCM", length: 256 },
@@ -4912,7 +4913,7 @@ async function openWith(spaceKey, sealed, context) {
   }
 }
 
-// ../src/space/roles.ts
+// ../core/src/space/roles.ts
 var MANAGE = "manage";
 var INVITE = "invite";
 var DEFINE = "define";
@@ -5331,7 +5332,7 @@ function replayAccess(genesis, events) {
   }
 }
 
-// ../src/space/space-access.ts
+// ../core/src/space/space-access.ts
 var READ_INFO = "weave/space-read/v1";
 var INVITE_INFO = "weave/space-invite/v1";
 function generateInviteSecret() {
@@ -5435,7 +5436,7 @@ async function verifyInvite(spaceId, did, inviteDid, signature, provider) {
   }
 }
 
-// ../src/space/presets.ts
+// ../core/src/space/presets.ts
 var solo = Object.freeze({
   roles: Object.freeze([{ name: "owner", title: "Owner", rank: 100, permissions: ["*"] }]),
   creatorRole: "owner"
@@ -5457,7 +5458,7 @@ var community = Object.freeze({
 });
 var rolePresets = Object.freeze({ solo, team, community });
 
-// ../src/space/space-manager.ts
+// ../core/src/space/space-manager.ts
 var SPACE_PREFIX = "space:";
 var KEY_PREFIX = "spacekey:";
 var INVITE_PREFIX = "spaceinvite:";
@@ -5635,7 +5636,7 @@ function parseSpaceInvite(invite) {
   }
 }
 
-// ../src/space/account-registry.ts
+// ../core/src/space/account-registry.ts
 var MEMBERSHIP_COLLECTION = "sys.joined";
 var PROFILE_COLLECTION = "sys.profile";
 var PROFILE_KEY = "profile";
@@ -5687,7 +5688,7 @@ async function deriveAccountSpace(accountKey, owner, label, name, provider) {
   return { space: space2, key: key3, invite: null, role: solo.creatorRole };
 }
 
-// ../node_modules/@cfworker/json-schema/dist/esm/deep-compare-strict.js
+// ../../node_modules/@cfworker/json-schema/dist/esm/deep-compare-strict.js
 function deepCompareStrict(a, b) {
   const typeofa = typeof a;
   if (typeofa !== typeof b) {
@@ -5728,7 +5729,7 @@ function deepCompareStrict(a, b) {
   return a === b;
 }
 
-// ../node_modules/@cfworker/json-schema/dist/esm/pointer.js
+// ../../node_modules/@cfworker/json-schema/dist/esm/pointer.js
 function encodePointer(p) {
   return encodeURI(escapePointer(p));
 }
@@ -5736,7 +5737,7 @@ function escapePointer(p) {
   return p.replace(/~/g, "~0").replace(/\//g, "~1");
 }
 
-// ../node_modules/@cfworker/json-schema/dist/esm/dereference.js
+// ../../node_modules/@cfworker/json-schema/dist/esm/dereference.js
 var schemaArrayKeyword = {
   prefixItems: true,
   items: true,
@@ -5857,7 +5858,7 @@ function dereference(schema, lookup = /* @__PURE__ */ Object.create(null), baseU
   return lookup;
 }
 
-// ../node_modules/@cfworker/json-schema/dist/esm/format.js
+// ../../node_modules/@cfworker/json-schema/dist/esm/format.js
 var DATE = /^(\d\d\d\d)-(\d\d)-(\d\d)$/;
 var DAYS = [0, 31, 28, 31, 30, 31, 30, 31, 31, 30, 31, 30, 31];
 var TIME = /^(\d\d):(\d\d):(\d\d)(\.\d+)?(z|[+-]\d\d(?::?\d\d)?)?$/i;
@@ -5950,7 +5951,7 @@ function regex(str2) {
   }
 }
 
-// ../node_modules/@cfworker/json-schema/dist/esm/types.js
+// ../../node_modules/@cfworker/json-schema/dist/esm/types.js
 var OutputFormat;
 (function(OutputFormat2) {
   OutputFormat2[OutputFormat2["Flag"] = 1] = "Flag";
@@ -5958,7 +5959,7 @@ var OutputFormat;
   OutputFormat2[OutputFormat2["Detailed"] = 4] = "Detailed";
 })(OutputFormat || (OutputFormat = {}));
 
-// ../node_modules/@cfworker/json-schema/dist/esm/ucs2-length.js
+// ../../node_modules/@cfworker/json-schema/dist/esm/ucs2-length.js
 function ucs2length(s) {
   let result = 0;
   let length = s.length;
@@ -5977,7 +5978,7 @@ function ucs2length(s) {
   return result;
 }
 
-// ../node_modules/@cfworker/json-schema/dist/esm/validate.js
+// ../../node_modules/@cfworker/json-schema/dist/esm/validate.js
 function validate(instance, schema, draft = "2019-09", lookup = dereference(schema), shortCircuit = true, recursiveAnchor = null, instanceLocation = "#", schemaLocation = "#", evaluated = /* @__PURE__ */ Object.create(null)) {
   if (schema === true) {
     return { valid: true, errors: [] };
@@ -6735,7 +6736,7 @@ Known schemas:
   return { valid: errors.length === 0, errors };
 }
 
-// ../node_modules/@cfworker/json-schema/dist/esm/validator.js
+// ../../node_modules/@cfworker/json-schema/dist/esm/validator.js
 var Validator = class {
   schema;
   draft;
@@ -6758,7 +6759,7 @@ var Validator = class {
   }
 };
 
-// ../src/records/rules.ts
+// ../core/src/records/rules.ts
 var PERMISSION_PATTERN = /^[a-z][a-zA-Z0-9]{0,39}$/;
 var permissionName = (collection2, permission) => `${collection2}/${permission}`;
 var isWho = (w) => w === "member" || w === "creator" || typeof w === "string" && w.startsWith("can:") && PERMISSION_PATTERN.test(w.slice(4));
@@ -6828,7 +6829,7 @@ function changedFixedField(fixed, first, next) {
   return null;
 }
 
-// ../src/records/topics.ts
+// ../core/src/records/topics.ts
 var MAX_TOPICS = 8;
 var MAX_TAGS = 64;
 var TAG_BYTES = 16;
@@ -6880,7 +6881,7 @@ function sameTags(a, b) {
   return left.length === right.length && left.every((tag, i) => tag === right[i]);
 }
 
-// ../src/schema/collection-def.ts
+// ../core/src/schema/collection-def.ts
 function toJsonSchema(schema) {
   const standard = schema["~standard"];
   if (!standard) return schema;
@@ -7041,7 +7042,7 @@ function validateJsonSchema(schema, value) {
   }));
 }
 
-// ../src/utils/events.ts
+// ../core/src/utils/events.ts
 function createEmitter() {
   const listeners = /* @__PURE__ */ new Map();
   return {
@@ -7063,7 +7064,7 @@ function createEmitter() {
   };
 }
 
-// ../src/network/signaling.ts
+// ../core/src/network/signaling.ts
 var SIGNAL_KINDS = /* @__PURE__ */ new Set(["offer", "answer", "candidate"]);
 function iceFrom(payload) {
   const { servers, expiresAt } = payload ?? {};
@@ -7180,7 +7181,7 @@ function createSignalingClient(url, did) {
   });
 }
 
-// ../src/network/multi-signaling.ts
+// ../core/src/network/multi-signaling.ts
 function createMultiSignalingClient(urls, did) {
   if (urls.length === 0) {
     throw new Error("At least one relay is needed to introduce peers.");
@@ -7314,7 +7315,7 @@ function createMultiSignalingClient(urls, did) {
   });
 }
 
-// ../src/network/introductions.ts
+// ../core/src/network/introductions.ts
 var PEERS_MESSAGE = "__peers";
 var SIGNAL_MESSAGE = "__signal";
 var AUTH_HELLO_MESSAGE = "__auth-hello";
@@ -7353,7 +7354,7 @@ function signalId() {
   return Array.from(bytes, (byte) => byte.toString(16).padStart(2, "0")).join("");
 }
 
-// ../src/network/rtc-transport.ts
+// ../core/src/network/rtc-transport.ts
 function fingerprintOf2(description) {
   const match = description?.sdp?.match(/^a=fingerprint:\s*(\S+)\s+(\S+)/im);
   return match ? `${match[1].toLowerCase()} ${match[2].toUpperCase()}` : null;
@@ -7489,7 +7490,7 @@ function createRTCTransport(config) {
   });
 }
 
-// ../src/network/peer-auth.ts
+// ../core/src/network/peer-auth.ts
 function readAccessOf(read) {
   if (!read) return null;
   if ("current" in read) return read;
@@ -7575,7 +7576,7 @@ function createMeshAuth(spaceId, session, read, provider) {
   });
 }
 
-// ../src/network/ws-transport.ts
+// ../core/src/network/ws-transport.ts
 function parseFrame(data, type) {
   if (typeof data !== "string") return null;
   try {
@@ -7721,7 +7722,7 @@ function createWebSocketTransport(config) {
   });
 }
 
-// ../src/network/mesh.ts
+// ../core/src/network/mesh.ts
 var ICE_REFRESH_MS = 10 * 6e4;
 var ICE_WAIT_MS = 1500;
 function createMesh(config) {
@@ -8002,7 +8003,7 @@ function createMesh(config) {
   };
 }
 
-// ../src/network/network-manager.ts
+// ../core/src/network/network-manager.ts
 function createNetworkManager(config) {
   const transport = config.createTransport();
   const peers = /* @__PURE__ */ new Map();
@@ -8048,7 +8049,7 @@ function createNetworkManager(config) {
   });
 }
 
-// ../src/sync/sync-messages.ts
+// ../core/src/sync/sync-messages.ts
 var SYNC_PROTOCOL_VERSION = 4;
 function parseSyncMessage(value) {
   const message = value;
@@ -8056,7 +8057,7 @@ function parseSyncMessage(value) {
   return message;
 }
 
-// ../src/sync/sync-engine.ts
+// ../core/src/sync/sync-engine.ts
 var MAX_WAITING = 1e3;
 var MAX_REFUSED = 1e4;
 var holdsCollection = (holds2, collection2) => collection2.startsWith("sys.") || holds2 === "all" || holds2.has(collection2);
@@ -8344,7 +8345,7 @@ ${id}`;
   };
 }
 
-// ../src/validation/crypto-gate.ts
+// ../core/src/validation/crypto-gate.ts
 function createCryptoGate(provider) {
   return {
     async validate(expression, resolvePublicKey) {
@@ -8371,7 +8372,7 @@ function createCryptoGate(provider) {
   };
 }
 
-// ../src/validation/structural-gate.ts
+// ../core/src/validation/structural-gate.ts
 function isEncryptedBody(body) {
   if (!body || typeof body !== "object") return false;
   const envelope = body;
@@ -8405,7 +8406,7 @@ function createStructuralGate(schemaEngine, options = {}) {
   };
 }
 
-// ../src/validation/stateful-gate.ts
+// ../core/src/validation/stateful-gate.ts
 function createStatefulGate() {
   const rules = /* @__PURE__ */ new Map();
   return {
@@ -8451,7 +8452,7 @@ function createStatefulGate() {
   };
 }
 
-// ../src/validation/capability-gate.ts
+// ../core/src/validation/capability-gate.ts
 var fail = (reason) => ({ passed: false, gate: "capability", reason });
 var MAX_CLOCK_SKEW_SECONDS = 300;
 function createCapabilityGate(config) {
@@ -8494,7 +8495,7 @@ function createCapabilityGate(config) {
   };
 }
 
-// ../src/validation/validation-engine.ts
+// ../core/src/validation/validation-engine.ts
 function createValidationEngine(config) {
   const { cryptoGate, structuralGate, statefulGate, capabilityGate, resolvePublicKey, getExpression } = config;
   return {
@@ -8520,7 +8521,7 @@ function createValidationEngine(config) {
   };
 }
 
-// ../src/query/filter.ts
+// ../core/src/query/filter.ts
 var MAX_INCLUDE_DEPTH = 3;
 var META = {
   "@key": (r) => r.key,
@@ -8684,7 +8685,7 @@ function checkQuery(query) {
   return null;
 }
 
-// ../src/query/types.ts
+// ../core/src/query/types.ts
 var nameOf = (ref) => typeof ref === "object" && ref !== null && typeof ref.name === "string" ? ref.name : ref;
 function plainQuery(query) {
   const isObject = (v) => typeof v === "object" && v !== null && !Array.isArray(v);
@@ -8698,7 +8699,7 @@ function plainQuery(query) {
   return { ...query, collection: nameOf(query.collection), ...query.include !== void 0 ? { include: includes(query.include) } : {} };
 }
 
-// ../src/query/engine.ts
+// ../core/src/query/engine.ts
 function compareValues(a, b) {
   if (a === b) return 0;
   if (a === void 0 || a === null) return -1;
@@ -8758,7 +8759,7 @@ async function runQuery(source, given) {
   return { records, cursor: more ? page[page.length - 1].key : null, complete: true };
 }
 
-// ../src/storage/segment.ts
+// ../core/src/storage/segment.ts
 var SEGMENT_SUFFIX = ".seg";
 function packSegment(versions) {
   return utf8Encode(JSON.stringify({ v: 1, versions }));
@@ -8778,7 +8779,7 @@ async function segmentName(counter, bytes) {
 }
 var versionSize = (version) => utf8Encode(JSON.stringify(version)).length;
 
-// ../src/storage/mirror.ts
+// ../core/src/storage/mirror.ts
 var WRITER_KEY = "mirror:writer";
 var COUNTER_KEY = "mirror:counter";
 var readKey = (name) => `mirror:read:${name}`;
@@ -8924,7 +8925,7 @@ async function createMirror(config) {
   });
 }
 
-// ../src/space/pass.ts
+// ../core/src/space/pass.ts
 var PASS_COLLECTION = "sys.pass";
 var CARRY_CLOSED_KEY = "carry:closed";
 async function passKey(spaceId) {
@@ -8955,7 +8956,7 @@ function carriedRecord(pass) {
   return { space: pass.space, key: null, invite: null, role: null, read: pass.read };
 }
 
-// ../src/node/space-runtime.ts
+// ../core/src/node/space-runtime.ts
 var MANAGED = /* @__PURE__ */ new Set([MEMBERSHIP_COLLECTION, PROFILE_COLLECTION, CARRIER_COLLECTION, PASS_COLLECTION, BOX_COLLECTION, MEMBER_KEY_COLLECTION, ...ACCESS_COLLECTIONS]);
 var IN_THE_CLEAR = /* @__PURE__ */ new Set([ROLE_COLLECTION, MEMBER_COLLECTION, INVITE_COLLECTION, REVOKE_COLLECTION, KEY_COLLECTION, BOX_COLLECTION, MEMBER_KEY_COLLECTION, RELAYS_COLLECTION, KEEPERS_COLLECTION]);
 var ACCESS_KEYS = [
@@ -9898,7 +9899,7 @@ async function openSpaceRuntime(deps) {
     channel.unref?.();
   }
   const HOUR = 36e5;
-  const DAY2 = 24 * HOUR;
+  const DAY3 = 24 * HOUR;
   const declared = new Set((cache?.collections ?? []).filter((c) => !c.startsWith("sys.")));
   let cacheTimer = null;
   const saveCache = () => {
@@ -9986,7 +9987,7 @@ async function openSpaceRuntime(deps) {
   });
   async function dropUnused() {
     if (!cache || !partial || closed) return;
-    const cutoff = Date.now() - (cache.unusedAfterDays ?? 30) * DAY2;
+    const cutoff = Date.now() - (cache.unusedAfterDays ?? 30) * DAY3;
     const waiting = /* @__PURE__ */ new Set();
     for (const name of await adapter.list(PENDING_PREFIX)) {
       const bytes = await adapter.get(name);
@@ -10414,7 +10415,7 @@ async function openSpaceRuntime(deps) {
   });
 }
 
-// ../src/schemas/contacts.ts
+// ../core/src/schemas/contacts.ts
 var typed = () => (definition) => definition;
 var contact = typed()({
   name: "std.contact",
@@ -10495,7 +10496,7 @@ var knockAnswer = typed()({
   rules: { edit: "creator", delete: "creator" }
 });
 
-// ../src/doors/doors.ts
+// ../core/src/doors/doors.ts
 var MAX_DOOR_RELAYS = 3;
 var KNOCK_TTL_SECONDS = 14 * 24 * 3600;
 var KNOCK_DROP_WINDOW_SECONDS = 600;
@@ -10622,7 +10623,7 @@ async function openKnock(doorKey, blob, receivedAt, provider) {
   });
 }
 
-// ../src/network/mailbox.ts
+// ../core/src/network/mailbox.ts
 var MAX_PAGES = 8;
 function createMailboxClient(options = {}) {
   const timeoutMs = options.timeoutMs ?? 8e3;
@@ -10716,7 +10717,7 @@ function isMailItem(value) {
   return !!item && Number.isSafeInteger(item.seq) && typeof item.id === "string" && typeof item.at === "number" && typeof item.blob === "string";
 }
 
-// ../src/space/notify.ts
+// ../core/src/space/notify.ts
 var NOTIFY_COLLECTION = "sys.notify";
 var SUBSCRIPTION_COLLECTION = "sys.subscription";
 var COLLECTION = /^[a-z][a-z0-9-]*(\.[a-z0-9-]+)+$/;
@@ -10803,7 +10804,7 @@ function matchesSubscription(sub, spaceId, version, account, now = Date.now()) {
   return true;
 }
 
-// ../src/session/hosting.ts
+// ../core/src/session/hosting.ts
 var HOSTING_COLLECTION = "sys.hosting";
 var REQUEST_WINDOW_SECONDS = 300;
 function newSubscriptionSeed() {
@@ -10919,7 +10920,7 @@ function createHostClient(url, host, key3, provider = createP256Provider()) {
   });
 }
 
-// ../src/node/node.ts
+// ../core/src/node/node.ts
 var SESSION_CAPABILITY = { with: "*", can: "expression/*" };
 var DEFAULT_TTL_SECONDS = 3600;
 var FORGET_CARRIER_AFTER_MS = 30 * 24 * 3600 * 1e3;
@@ -12344,7 +12345,7 @@ async function createNode(config) {
   return node;
 }
 
-// ../src/node/stores.ts
+// ../core/src/node/stores.ts
 function folderStores(directory2, options = {}) {
   return async (path7, storeOptions) => {
     const full = options.basePath ? `${options.basePath}/${path7}` : path7;
@@ -12353,7 +12354,7 @@ function folderStores(directory2, options = {}) {
   };
 }
 
-// ../src/network/local-transport.ts
+// ../core/src/network/local-transport.ts
 var later = (fn) => void setTimeout(fn, 0);
 function createLocalHub() {
   const connected = /* @__PURE__ */ new Map();
@@ -12399,7 +12400,7 @@ function createLocalHub() {
   };
 }
 
-// ../src/node/carrier.ts
+// ../core/src/node/carrier.ts
 async function createCarryCore(config) {
   const provider = config.provider ?? createP256Provider();
   const signer = createSigner(provider);
@@ -12630,7 +12631,7 @@ async function createCarryCore(config) {
   };
 }
 
-// ../src/node/host.ts
+// ../core/src/node/host.ts
 var SUBSCRIPTION_PREFIX = "subscription:";
 var NotAllowedError = class extends Error {
   constructor() {
@@ -12792,7 +12793,7 @@ async function createHostNode(config) {
   return Object.freeze(host);
 }
 
-// ../src/records/describe.ts
+// ../core/src/records/describe.ts
 var KNOWN_RULES = ["create", "edit", "delete", "onePer", "fixed"];
 var words = (name) => name.replace(/^.*\./, "").replace(/([a-z0-9])([A-Z])/g, "$1 $2").replace(/[_-]+/g, " ").toLowerCase();
 var article = (noun) => /^[aeiou]/.test(noun) ? `an ${noun}` : `a ${noun}`;
@@ -12870,7 +12871,7 @@ function describeCollection(definition) {
   return sentences;
 }
 
-// ../src/schemas/apps.ts
+// ../core/src/schemas/apps.ts
 var MAX_APP_COLLECTIONS = 10;
 var app = {
   name: "std.app",
@@ -12971,7 +12972,7 @@ async function proposeApp(node, spaceId, body) {
   return node.records.put(spaceId, app.name, body);
 }
 
-// ../src/schemas/screens.ts
+// ../core/src/schemas/screens.ts
 var SCREEN_GUIDE = `A screen is one HTML document (scripts and styles inline, at most 48 KB) put on a collection definition as "screen".
 When the app is added, apps in the space can show it instead of plain lists. It runs sealed: no network (no fetch, no
 images from URLs, no fonts from URLs), no storage, no popups, no forms that submit. Keep state in records, never in the page.
@@ -12997,7 +12998,7 @@ Draw everything from weave.list(...) and redraw on weave.onChange \u2014 other p
 Two people can write at once: design collections so that clashes resolve by the rules (onePer, creator-only edits), not by the screen.
 Use plain DOM; no libraries can be loaded. Prefer system fonts and simple, readable styling that works in light and dark.`;
 
-// ../src/node/actions.ts
+// ../core/src/node/actions.ts
 var space = { type: "string", description: "Space id, from spaces_list" };
 var key2 = { type: "string", description: "Record key \u2014 stays the same when the record is edited" };
 var str = (input, key3) => input[key3];
@@ -13438,7 +13439,7 @@ async function runAction(node, name, input = {}) {
   return action.run(node, input);
 }
 
-// ../node_modules/aws4fetch/dist/aws4fetch.esm.mjs
+// ../../node_modules/aws4fetch/dist/aws4fetch.esm.mjs
 var encoder2 = new TextEncoder();
 var HOST_SERVICES = {
   appstream2: "appstream",
@@ -13717,7 +13718,7 @@ function guessServiceRegion(url, headers) {
   return [HOST_SERVICES[service] || service, region || ""];
 }
 
-// ../src/storage/blob/s3.ts
+// ../core/src/storage/blob/s3.ts
 var ATTEMPTS = 5;
 function createS3BlobStore(config) {
   const client = new AwsClient({
@@ -13893,7 +13894,7 @@ async function createAccount(home, options) {
     throw new Error(`This home already has an account for ${did}`);
   }
   let vault = createVault({ did, label: options.name, wraps: [] });
-  if (options.passphrase) vault = withWrap(vault, await wrapSeedWithPassphrase(seed, options.passphrase, "CLI passphrase"));
+  if (options.passphrase) vault = withWrap(vault, await wrapSeedWithPassphrase(seed, options.passphrase, CLI_PASSPHRASE_LABEL));
   const id = newAccountId();
   const account = {
     id,
@@ -13954,7 +13955,7 @@ async function unlock(home, account, secret) {
 import { createServer } from "node:http";
 import { WebSocketServer } from "ws";
 
-// ../server/relay.mjs
+// ../relay/relay.mjs
 import { createHash, createHmac, createPublicKey, randomBytes as randomBytes4, verify } from "node:crypto";
 var MAX_MESSAGE_BYTES = 64 * 1024;
 var MAX_CONNECTIONS = 5e3;
@@ -15541,7 +15542,11 @@ import { mkdir as mkdir2, readFile as readFile3, rm, writeFile as writeFile2 } f
 import os3 from "node:os";
 import path4 from "node:path";
 
-// ../src/session/connect.ts
+// ../core/src/session/stay-signed-in.ts
+var DAY2 = 24 * 60 * 60 * 1e3;
+var DURATION2 = { never: 0, "1d": DAY2, "7d": 7 * DAY2, "30d": 30 * DAY2 };
+
+// ../core/src/session/connect.ts
 function grantSigner(grant) {
   let token = null;
   return {
@@ -15557,7 +15562,7 @@ function grantSigner(grant) {
   };
 }
 
-// ../src/session/agent-link.ts
+// ../core/src/session/agent-link.ts
 var SECRET_BYTES = 16;
 var ROOM_PREFIX2 = utf8Encode("weave-agent-link-room-v1");
 var KEY_INFO = utf8Encode("weave-agent-link-key-v1");

package/package.json

@@ -1,17 +1,19 @@
 {
   "name": "@weaveprotocol/cli",
-  "version": "0.2.1",
+  "version": "0.2.2",
   "description": "The Weave protocol from a terminal: manage spaces, run an always-on node, serve MCP to agents",
   "type": "module",
   "bin": {
     "weave": "dist/weave.mjs"
   },
   "scripts": {
-    "start": "node --import tsx src/main.ts",
-    "bundle": "esbuild src/main.ts --bundle --platform=node --format=esm --target=node22 --outfile=dist/weave.mjs --external:ws --external:node-datachannel --banner:js='#!/usr/bin/env node'",
+    "start": "node --conditions=@weaveprotocol/source --import tsx src/main.ts",
+    "test": "node --conditions=@weaveprotocol/source --import tsx --test tests/*.test.ts",
+    "typecheck": "tsc --noEmit",
+    "bundle": "esbuild src/main.ts --bundle --platform=node --format=esm --target=node22 --conditions=@weaveprotocol/source --outfile=dist/weave.mjs --external:ws --external:node-datachannel --banner:js='#!/usr/bin/env node'",
+    "bundle:pay": "esbuild pay/walletconnect.ts --bundle --format=esm --minify --platform=browser --target=es2022 --outfile=pay/dist/walletconnect.js --define:process.env.NODE_ENV='\"production\"'",
     "build": "bun build.ts",
-    "prepublishOnly": "npm run bundle && npm run bundle:pay",
-    "bundle:pay": "esbuild pay/walletconnect.ts --bundle --format=esm --minify --platform=browser --target=es2022 --outfile=pay/dist/walletconnect.js --define:process.env.NODE_ENV='\"production\"'"
+    "prepublishOnly": "npm run bundle && npm run bundle:pay"
   },
   "dependencies": {
     "node-datachannel": "^0.33.4",
@@ -24,7 +26,7 @@
   "repository": {
     "type": "git",
     "url": "git+https://github.com/leifriksheim/weave.git",
-    "directory": "cli"
+    "directory": "packages/cli"
   },
   "files": [
     "dist/weave.mjs",
@@ -33,6 +35,9 @@
   ],
   "devDependencies": {
     "@reown/appkit": "^1.8.24",
+    "@types/node": "^26.6.3",
+    "@weaveprotocol/core": "*",
+    "@weaveprotocol/relay": "*",
     "esbuild": "^0.28.0",
     "tsx": "^4.19.0"
   },