@weaveprotocol/cli 0.2.1 → 0.2.3

package/README.md

@@ -30,7 +30,7 @@ To have `weave` everywhere:
 npm install -g @weaveprotocol/cli            # or run it without installing: npx @weaveprotocol/cli <command>
 ```
 
-From this repo: `npm install` at the repo root (the CLI is a workspace), then `cd cli && npm run bundle && npm link`, or a
+From this repo: `npm install` at the repo root (the CLI is a workspace), then `cd packages/cli && npm run bundle && npm link`, or a
 binary with no Node at all: `bun build.ts --native`.
 
 ```bash
@@ -230,5 +230,5 @@ space anywhere leaves it everywhere.
   across real networks, behind a strict NAT, in Safari, and on a phone
   switching apps.
 
-What the protocol still has planned is in [the spec](../docs/spec/README.md),
+What the protocol still has planned is in [the spec](../../spec/README.md),
 under **Planned** in each part.

package/dist/weave.mjs

@@ -6,7 +6,7 @@ import path6 from "node:path";
 import { createInterface as createInterface2 } from "node:readline";
 import { parseArgs } from "node:util";
 
-// ../src/utils/encoding.ts
+// ../core/src/utils/encoding.ts
 var encoder = new TextEncoder();
 var decoder = new TextDecoder();
 function utf8Encode(str2) {
@@ -46,7 +46,7 @@ function bytesToHex(bytes) {
   return Array.from(bytes, (byte) => byte.toString(16).padStart(2, "0")).join("");
 }
 
-// ../node_modules/@noble/hashes/_u64.js
+// ../../node_modules/@noble/hashes/_u64.js
 var fromNumH = (n) => n / 2 ** 32 | 0;
 var fromNumL = (n) => n >>> 0;
 function setU64FromNum(view, byteOffset, n, isLE) {
@@ -56,7 +56,7 @@ function setU64FromNum(view, byteOffset, n, isLE) {
   view.setUint32(byteOffset + 4, isLE ? h : l, isLE);
 }
 
-// ../node_modules/@noble/hashes/utils.js
+// ../../node_modules/@noble/hashes/utils.js
 function isBytes(a) {
   return a instanceof Uint8Array || ArrayBuffer.isView(a) && a.constructor.name === "Uint8Array" && "BYTES_PER_ELEMENT" in a && a.BYTES_PER_ELEMENT === 1;
 }
@@ -221,7 +221,7 @@ var oidNist = (suffix) => ({
   oid: Uint8Array.from([6, 9, 96, 134, 72, 1, 101, 3, 4, 2, suffix])
 });
 
-// ../node_modules/@noble/hashes/_md.js
+// ../../node_modules/@noble/hashes/_md.js
 function Chi(a, b, c) {
   return a & b ^ ~a & c;
 }
@@ -334,7 +334,7 @@ var SHA256_IV = /* @__PURE__ */ Uint32Array.from([
   1541459225
 ]);
 
-// ../node_modules/@noble/hashes/sha2.js
+// ../../node_modules/@noble/hashes/sha2.js
 var SHA256_K = /* @__PURE__ */ Uint32Array.from([
   1116352408,
   1899447441,
@@ -499,7 +499,7 @@ var sha256 = /* @__PURE__ */ createHasher(
   /* @__PURE__ */ oidNist(1)
 );
 
-// ../node_modules/@noble/curves/utils.js
+// ../../node_modules/@noble/curves/utils.js
 function aarray(item, title, inner = () => {
 }) {
   if (!Array.isArray(item))
@@ -681,7 +681,7 @@ function validateObject(object, fields = {}, optFields = {}, title = "object") {
   iter(optFields, true);
 }
 
-// ../node_modules/@noble/curves/abstract/modular.js
+// ../../node_modules/@noble/curves/abstract/modular.js
 var _0n2 = /* @__PURE__ */ BigInt(0);
 var _1n2 = /* @__PURE__ */ BigInt(1);
 var _2n = /* @__PURE__ */ BigInt(2);
@@ -1131,7 +1131,7 @@ function mapHashToField(key3, fieldOrder, isLE = false) {
   return isLE ? numberToBytesLE(reduced, fieldLen) : numberToBytesBE(reduced, fieldLen);
 }
 
-// ../node_modules/@noble/curves/abstract/curve.js
+// ../../node_modules/@noble/curves/abstract/curve.js
 var _0n3 = /* @__PURE__ */ BigInt(0);
 var _1n3 = /* @__PURE__ */ BigInt(1);
 var _4n2 = /* @__PURE__ */ BigInt(4);
@@ -1518,7 +1518,7 @@ function createKeygen(randomSecretKey, getPublicKey) {
   };
 }
 
-// ../node_modules/@noble/hashes/hmac.js
+// ../../node_modules/@noble/hashes/hmac.js
 var _HMAC = class {
   oHash;
   iHash;
@@ -1595,7 +1595,7 @@ var hmac = /* @__PURE__ */ (() => {
   return hmac_;
 })();
 
-// ../node_modules/@noble/curves/abstract/der.js
+// ../../node_modules/@noble/curves/abstract/der.js
 var _0n4 = /* @__PURE__ */ BigInt(0);
 var DERErr = class extends Error {
   constructor(m = "") {
@@ -1722,7 +1722,7 @@ var DER = /* @__PURE__ */ (() => {
   return Object.freeze(_DER);
 })();
 
-// ../node_modules/@noble/curves/abstract/weierstrass.js
+// ../../node_modules/@noble/curves/abstract/weierstrass.js
 var divNearest = (num, den) => (num + (num >= 0 ? den : -den) / _2n2) / den;
 function _splitEndoScalar(k, basis, n) {
   aInRange("scalar", k, _0n5, n);
@@ -2554,7 +2554,7 @@ function ecdsa(Point, hash2, ecdsaOpts = {}) {
   });
 }
 
-// ../node_modules/@noble/curves/nist.js
+// ../../node_modules/@noble/curves/nist.js
 var p256_CURVE = /* @__PURE__ */ (() => ({
   p: BigInt("0xffffffff00000001000000000000000000000000ffffffffffffffffffffffff"),
   n: BigInt("0xffffffff00000000ffffffffffffffffbce6faada7179e84f3b9cac2fc632551"),
@@ -2567,7 +2567,7 @@ var p256_CURVE = /* @__PURE__ */ (() => ({
 var p256_Point = /* @__PURE__ */ weierstrass(p256_CURVE);
 var p256 = /* @__PURE__ */ ecdsa(p256_Point, sha256);
 
-// ../src/identity/crypto-p256.ts
+// ../core/src/identity/crypto-p256.ts
 var P256_SEED_BYTES = 48;
 var P256_KEY_INFO = new TextEncoder().encode("weave/p256-identity-key/v1");
 async function hkdf(ikm, info, length) {
@@ -2679,12 +2679,12 @@ function createP256Provider() {
   });
 }
 
-// ../src/utils/errors.ts
+// ../core/src/utils/errors.ts
 function protocolError(code, message, hint) {
   return Object.assign(new Error(message), { code, ...hint ? { hint } : {} });
 }
 
-// ../src/identity/webauthn.ts
+// ../core/src/identity/webauthn.ts
 var PRF_SALT = new TextEncoder().encode("weave-protocol-key-v1");
 async function registerPasskey(options) {
   if (!globalThis.navigator?.credentials) {
@@ -2780,10 +2780,10 @@ async function authenticatePasskey(credentialId, options) {
   });
 }
 
-// ../src/identity/passkey-diagnostics.ts
+// ../core/src/identity/passkey-diagnostics.ts
 var PRF_SALT2 = new TextEncoder().encode("weave-protocol-key-v1");
 
-// ../src/identity/keys.ts
+// ../core/src/identity/keys.ts
 async function deriveKeyPair(seed, provider) {
   const keyPair = await provider.deriveKeyPairFromSeed(seed);
   const publicKeyBytes = await provider.exportPublicKey(keyPair.publicKey);
@@ -2815,7 +2815,7 @@ async function deriveKeyFromPassword(password, salt, provider) {
   return deriveKeyPair(new Uint8Array(derivedBits), provider);
 }
 
-// ../src/identity/recovery-code.ts
+// ../core/src/identity/recovery-code.ts
 var ALPHABET = "0123456789ABCDEFGHJKMNPQRSTVWXYZ";
 var SUBSTITUTIONS = { O: "0", I: "1", L: "1", U: "V" };
 var SEED_BYTES = 16;
@@ -2876,7 +2876,7 @@ function encodeBase32(bytes) {
   return out;
 }
 
-// ../node_modules/@scure/base/index.js
+// ../../node_modules/@scure/base/index.js
 var freeze = (fn) => Object.freeze(fn());
 function isBytes3(a) {
   return a instanceof Uint8Array || ArrayBuffer.isView(a) && a.constructor.name === "Uint8Array" && "BYTES_PER_ELEMENT" in a && a.BYTES_PER_ELEMENT === 1;
@@ -3082,7 +3082,7 @@ var radix58 = /* @__PURE__ */ radixBaseN(58, B58_GROUP);
 var genBase58 = (abc) => genBaseN(radix58, abc);
 var base58 = /* @__PURE__ */ freeze(() => genBase58("123456789ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz"));
 
-// ../src/identity/did.ts
+// ../core/src/identity/did.ts
 var P256_MULTICODEC = new Uint8Array([128, 36]);
 function publicKeyToDid(publicKeyBytes, multicodecPrefix) {
   const prefixedKey = concatBytes(multicodecPrefix, publicKeyBytes);
@@ -3103,7 +3103,7 @@ function didToPublicKey(did) {
   return { multicodecPrefix, publicKeyBytes };
 }
 
-// ../src/identity/identity-manager.ts
+// ../core/src/identity/identity-manager.ts
 function prfUnsupported() {
   return protocolError(
     "PRF_UNSUPPORTED",
@@ -3194,7 +3194,7 @@ function createIdentityManager(config) {
   });
 }
 
-// ../src/storage/folder-adapter.ts
+// ../core/src/storage/folder-adapter.ts
 var EXPRESSION_SUFFIX = ".json";
 function encodeKey(key3) {
   let out = "";
@@ -3365,7 +3365,7 @@ async function createFolderAdapter(root, path7) {
   });
 }
 
-// ../src/identity/folder-account.ts
+// ../core/src/identity/folder-account.ts
 function createVault(params) {
   return {
     version: 2,
@@ -3376,7 +3376,7 @@ function createVault(params) {
   };
 }
 
-// ../src/identity/account-store.ts
+// ../core/src/identity/account-store.ts
 var LIST_FILE = "accounts.json";
 var ACCOUNTS_DIR = "accounts";
 var VAULT_FILE = "account.json";
@@ -3491,7 +3491,7 @@ function createFolderAccountStore(dir) {
   });
 }
 
-// ../src/identity/account-vault.ts
+// ../core/src/identity/account-vault.ts
 var IV_BYTES = 12;
 var SALT_BYTES = 16;
 var PASSPHRASE_ITERATIONS = 6e5;
@@ -3601,12 +3601,13 @@ async function deriveVaultKey(seed) {
     ["encrypt", "decrypt"]
   );
 }
+var CLI_PASSPHRASE_LABEL = "CLI passphrase";
 function withWrap(vault, wrap) {
   const superseded = (existing) => existing.kind === "device" && wrap.kind === "device" && existing.rpId === wrap.rpId;
   return { ...vault, wraps: [...vault.wraps.filter((existing) => !superseded(existing)), wrap] };
 }
 
-// ../src/identity/contact-key.ts
+// ../core/src/identity/contact-key.ts
 var CONTACT_KEY_INFO = "weave/p256-contact-key/v1";
 var SEAL_INFO = "weave/contact-seal/v1";
 var MEMBER_KEY_INFO = "weave/p256-member-key/v1";
@@ -3749,7 +3750,7 @@ async function openSealed(privateKey, sealed, context) {
   }
 }
 
-// ../src/utils/hash.ts
+// ../core/src/utils/hash.ts
 async function sha2562(data) {
   const buffer = await globalThis.crypto.subtle.digest("SHA-256", data);
   return new Uint8Array(buffer);
@@ -3800,7 +3801,7 @@ async function cidFromBytes(data) {
   return "b" + base32Encode(hashBytes);
 }
 
-// ../src/records/links.ts
+// ../core/src/records/links.ts
 var LINK_REL_PATTERN = /^[a-z][a-zA-Z0-9]{0,63}$/;
 var MAX_LINKS = 32;
 function checkLinks(links2) {
@@ -3818,7 +3819,7 @@ function checkLinks(links2) {
   return null;
 }
 
-// ../src/records/version.ts
+// ../core/src/records/version.ts
 var MAX_SEEN = 64;
 var RECORD_KEY_PATTERN = /^[a-z0-9:._-]{1,128}$/;
 function newRecordKey() {
@@ -3859,7 +3860,7 @@ function checkVersionShape(expression) {
   return null;
 }
 
-// ../src/schema/expression.ts
+// ../core/src/schema/expression.ts
 function canonicalize(obj) {
   if (obj === null || typeof obj !== "object") {
     return JSON.stringify(obj) ?? "null";
@@ -3904,7 +3905,7 @@ async function getExpressionId(expr) {
   return await cidFromBytes(bytes);
 }
 
-// ../src/identity/ucan.ts
+// ../core/src/identity/ucan.ts
 var UCAN_CLOCK_SKEW_SECONDS = 300;
 async function issueUCAN(options, provider) {
   const header = { alg: "ES256", typ: "JWT", ucv: "0.10.0" };
@@ -4095,7 +4096,7 @@ async function resolveDelegationRoot(encoded, resolveProof, provider, options =
   return { valid: false, rootDid: null, capabilities: [], audience: null, reason: `Delegation chain deeper than ${MAX_CHAIN_DEPTH} links` };
 }
 
-// ../src/identity/root-signer.ts
+// ../core/src/identity/root-signer.ts
 function createLocalRootSigner(identity, provider) {
   return Object.freeze({
     did: identity.did,
@@ -4115,7 +4116,7 @@ function createLocalRootSigner(identity, provider) {
   });
 }
 
-// ../src/identity/pairing.ts
+// ../core/src/identity/pairing.ts
 var ROOM_PREFIX = utf8Encode("weave-pairing-room-v1");
 var PAIRING_KEY_INFO = utf8Encode("weave-pairing-key-v1");
 var IV_BYTES3 = 12;
@@ -4147,7 +4148,7 @@ async function openPairingPayload(sealed, key3) {
   }
 }
 
-// ../src/identity/agent-note.ts
+// ../core/src/identity/agent-note.ts
 var AGENT_FACT = Object.freeze({ weave: "agent" });
 function isAgentNote(encoded) {
   if (!encoded) return false;
@@ -4159,7 +4160,7 @@ function isAgentNote(encoded) {
   }
 }
 
-// ../src/schema/schema-engine.ts
+// ../core/src/schema/schema-engine.ts
 function createSchemaEngine() {
   const collections = /* @__PURE__ */ new Map();
   return Object.freeze({
@@ -4192,7 +4193,7 @@ function createSchemaEngine() {
   });
 }
 
-// ../src/schema/signer.ts
+// ../core/src/schema/signer.ts
 function createSigner(provider) {
   return Object.freeze({
     async sign(payload, privateKey) {
@@ -4218,7 +4219,7 @@ function createSigner(provider) {
   });
 }
 
-// ../src/sync/negentropy.ts
+// ../core/src/sync/negentropy.ts
 var NEGENTROPY_VERSION = 97;
 var ID_SIZE = 32;
 var FINGERPRINT_SIZE = 16;
@@ -4508,7 +4509,7 @@ function createReconciler(set, options) {
 }
 var key = (id) => String.fromCharCode(...id);
 
-// ../src/storage/storage-provider.ts
+// ../core/src/storage/storage-provider.ts
 var CURRENT_PREFIX = "r/";
 var GENESIS_PREFIX = "g/";
 var HISTORY_PREFIX = "h/";
@@ -4733,7 +4734,7 @@ function createStorageProvider(adapter) {
   });
 }
 
-// ../src/storage/encrypted-adapter.ts
+// ../core/src/storage/encrypted-adapter.ts
 var MAGIC = new Uint8Array([119, 101, 97, 118, 101, 101, 2, 0]);
 var IV_BYTES4 = 12;
 var DEFAULT_ENCRYPTED_PREFIXES = ["space:", "spacekey:", "spaceinvite:", "spacerole:"];
@@ -4797,7 +4798,7 @@ function createEncryptedAdapter(inner, key3, options) {
   });
 }
 
-// ../src/storage/folder-reconcile.ts
+// ../core/src/storage/folder-reconcile.ts
 async function reconcileFolder(storage, adapter, accept = async () => true) {
   const disk = await adapter.reload();
   if (disk.added.length > 0 || disk.removed.length > 0) storage.invalidate();
@@ -4826,7 +4827,7 @@ async function reconcileFolder(storage, adapter, accept = async () => true) {
   };
 }
 
-// ../src/privacy/space-encryption.ts
+// ../core/src/privacy/space-encryption.ts
 async function generateSpaceKey() {
   const key3 = await globalThis.crypto.subtle.generateKey(
     { name: "AES-GCM", length: 256 },
@@ -4912,7 +4913,7 @@ async function openWith(spaceKey, sealed, context) {
   }
 }
 
-// ../src/space/roles.ts
+// ../core/src/space/roles.ts
 var MANAGE = "manage";
 var INVITE = "invite";
 var DEFINE = "define";
@@ -5331,7 +5332,7 @@ function replayAccess(genesis, events) {
   }
 }
 
-// ../src/space/space-access.ts
+// ../core/src/space/space-access.ts
 var READ_INFO = "weave/space-read/v1";
 var INVITE_INFO = "weave/space-invite/v1";
 function generateInviteSecret() {
@@ -5435,7 +5436,7 @@ async function verifyInvite(spaceId, did, inviteDid, signature, provider) {
   }
 }
 
-// ../src/space/presets.ts
+// ../core/src/space/presets.ts
 var solo = Object.freeze({
   roles: Object.freeze([{ name: "owner", title: "Owner", rank: 100, permissions: ["*"] }]),
   creatorRole: "owner"
@@ -5457,7 +5458,7 @@ var community = Object.freeze({
 });
 var rolePresets = Object.freeze({ solo, team, community });
 
-// ../src/space/space-manager.ts
+// ../core/src/space/space-manager.ts
 var SPACE_PREFIX = "space:";
 var KEY_PREFIX = "spacekey:";
 var INVITE_PREFIX = "spaceinvite:";
@@ -5635,7 +5636,7 @@ function parseSpaceInvite(invite) {
   }
 }
 
-// ../src/space/account-registry.ts
+// ../core/src/space/account-registry.ts
 var MEMBERSHIP_COLLECTION = "sys.joined";
 var PROFILE_COLLECTION = "sys.profile";
 var PROFILE_KEY = "profile";
@@ -5687,7 +5688,7 @@ async function deriveAccountSpace(accountKey, owner, label, name, provider) {
   return { space: space2, key: key3, invite: null, role: solo.creatorRole };
 }
 
-// ../node_modules/@cfworker/json-schema/dist/esm/deep-compare-strict.js
+// ../../node_modules/@cfworker/json-schema/dist/esm/deep-compare-strict.js
 function deepCompareStrict(a, b) {
   const typeofa = typeof a;
   if (typeofa !== typeof b) {
@@ -5728,7 +5729,7 @@ function deepCompareStrict(a, b) {
   return a === b;
 }
 
-// ../node_modules/@cfworker/json-schema/dist/esm/pointer.js
+// ../../node_modules/@cfworker/json-schema/dist/esm/pointer.js
 function encodePointer(p) {
   return encodeURI(escapePointer(p));
 }
@@ -5736,7 +5737,7 @@ function escapePointer(p) {
   return p.replace(/~/g, "~0").replace(/\//g, "~1");
 }
 
-// ../node_modules/@cfworker/json-schema/dist/esm/dereference.js
+// ../../node_modules/@cfworker/json-schema/dist/esm/dereference.js
 var schemaArrayKeyword = {
   prefixItems: true,
   items: true,
@@ -5857,7 +5858,7 @@ function dereference(schema, lookup = /* @__PURE__ */ Object.create(null), baseU
   return lookup;
 }
 
-// ../node_modules/@cfworker/json-schema/dist/esm/format.js
+// ../../node_modules/@cfworker/json-schema/dist/esm/format.js
 var DATE = /^(\d\d\d\d)-(\d\d)-(\d\d)$/;
 var DAYS = [0, 31, 28, 31, 30, 31, 30, 31, 31, 30, 31, 30, 31];
 var TIME = /^(\d\d):(\d\d):(\d\d)(\.\d+)?(z|[+-]\d\d(?::?\d\d)?)?$/i;
@@ -5950,7 +5951,7 @@ function regex(str2) {
   }
 }
 
-// ../node_modules/@cfworker/json-schema/dist/esm/types.js
+// ../../node_modules/@cfworker/json-schema/dist/esm/types.js
 var OutputFormat;
 (function(OutputFormat2) {
   OutputFormat2[OutputFormat2["Flag"] = 1] = "Flag";
@@ -5958,7 +5959,7 @@ var OutputFormat;
   OutputFormat2[OutputFormat2["Detailed"] = 4] = "Detailed";
 })(OutputFormat || (OutputFormat = {}));
 
-// ../node_modules/@cfworker/json-schema/dist/esm/ucs2-length.js
+// ../../node_modules/@cfworker/json-schema/dist/esm/ucs2-length.js
 function ucs2length(s) {
   let result = 0;
   let length = s.length;
@@ -5977,7 +5978,7 @@ function ucs2length(s) {
   return result;
 }
 
-// ../node_modules/@cfworker/json-schema/dist/esm/validate.js
+// ../../node_modules/@cfworker/json-schema/dist/esm/validate.js
 function validate(instance, schema, draft = "2019-09", lookup = dereference(schema), shortCircuit = true, recursiveAnchor = null, instanceLocation = "#", schemaLocation = "#", evaluated = /* @__PURE__ */ Object.create(null)) {
   if (schema === true) {
     return { valid: true, errors: [] };
@@ -6735,7 +6736,7 @@ Known schemas:
   return { valid: errors.length === 0, errors };
 }
 
-// ../node_modules/@cfworker/json-schema/dist/esm/validator.js
+// ../../node_modules/@cfworker/json-schema/dist/esm/validator.js
 var Validator = class {
   schema;
   draft;
@@ -6758,7 +6759,7 @@ var Validator = class {
   }
 };
 
-// ../src/records/rules.ts
+// ../core/src/records/rules.ts
 var PERMISSION_PATTERN = /^[a-z][a-zA-Z0-9]{0,39}$/;
 var permissionName = (collection2, permission) => `${collection2}/${permission}`;
 var isWho = (w) => w === "member" || w === "creator" || typeof w === "string" && w.startsWith("can:") && PERMISSION_PATTERN.test(w.slice(4));
@@ -6828,7 +6829,7 @@ function changedFixedField(fixed, first, next) {
   return null;
 }
 
-// ../src/records/topics.ts
+// ../core/src/records/topics.ts
 var MAX_TOPICS = 8;
 var MAX_TAGS = 64;
 var TAG_BYTES = 16;
@@ -6880,7 +6881,7 @@ function sameTags(a, b) {
   return left.length === right.length && left.every((tag, i) => tag === right[i]);
 }
 
-// ../src/schema/collection-def.ts
+// ../core/src/schema/collection-def.ts
 function toJsonSchema(schema) {
   const standard = schema["~standard"];
   if (!standard) return schema;
@@ -6893,6 +6894,21 @@ function toJsonSchema(schema) {
   return json;
 }
 var MAX_SCREEN_BYTES = 48 * 1024;
+var MAX_SCREEN_ORIGINS = 8;
+var SCREEN_ORIGIN = /^(https|wss):\/\/[a-z0-9]([a-z0-9-]*[a-z0-9])?(\.[a-z0-9]([a-z0-9-]*[a-z0-9])?)+(:[0-9]{1,5})?$/;
+function checkScreenNetwork(network, hasScreen) {
+  if (network === void 0) return null;
+  if (!Array.isArray(network)) return 'network must be a list of origins, like ["https://api.example.com"]';
+  if (!hasScreen && network.length) return "network is where a screen may connect; this definition has no screen";
+  if (network.length > MAX_SCREEN_ORIGINS) return `network may name at most ${MAX_SCREEN_ORIGINS} origins`;
+  for (const origin of network) {
+    if (typeof origin !== "string" || !SCREEN_ORIGIN.test(origin)) {
+      return `"${String(origin)}" is not an origin a screen may reach: give https:// or wss:// and a host, lower case, no path \u2014 like "https://api.example.com"`;
+    }
+  }
+  if (new Set(network).size !== network.length) return "network names an origin twice";
+  return null;
+}
 var CATALOG_COLLECTION = "sys.collection";
 var KEYWORDS = /* @__PURE__ */ new Set([
   "type",
@@ -7029,6 +7045,8 @@ function checkStoredCollection(definition) {
     const bytes = new TextEncoder().encode(d.screen).length;
     if (bytes > MAX_SCREEN_BYTES) return `screen is ${Math.ceil(bytes / 1024)} KB; at most ${MAX_SCREEN_BYTES / 1024} KB`;
   }
+  const network = checkScreenNetwork(d.network, typeof d.screen === "string");
+  if (network) return network;
   return checkPublishableSchema(d.schema);
 }
 function validateJsonSchema(schema, value) {
@@ -7041,7 +7059,7 @@ function validateJsonSchema(schema, value) {
   }));
 }
 
-// ../src/utils/events.ts
+// ../core/src/utils/events.ts
 function createEmitter() {
   const listeners = /* @__PURE__ */ new Map();
   return {
@@ -7063,7 +7081,7 @@ function createEmitter() {
   };
 }
 
-// ../src/network/signaling.ts
+// ../core/src/network/signaling.ts
 var SIGNAL_KINDS = /* @__PURE__ */ new Set(["offer", "answer", "candidate"]);
 function iceFrom(payload) {
   const { servers, expiresAt } = payload ?? {};
@@ -7180,7 +7198,7 @@ function createSignalingClient(url, did) {
   });
 }
 
-// ../src/network/multi-signaling.ts
+// ../core/src/network/multi-signaling.ts
 function createMultiSignalingClient(urls, did) {
   if (urls.length === 0) {
     throw new Error("At least one relay is needed to introduce peers.");
@@ -7314,7 +7332,7 @@ function createMultiSignalingClient(urls, did) {
   });
 }
 
-// ../src/network/introductions.ts
+// ../core/src/network/introductions.ts
 var PEERS_MESSAGE = "__peers";
 var SIGNAL_MESSAGE = "__signal";
 var AUTH_HELLO_MESSAGE = "__auth-hello";
@@ -7353,7 +7371,7 @@ function signalId() {
   return Array.from(bytes, (byte) => byte.toString(16).padStart(2, "0")).join("");
 }
 
-// ../src/network/rtc-transport.ts
+// ../core/src/network/rtc-transport.ts
 function fingerprintOf2(description) {
   const match = description?.sdp?.match(/^a=fingerprint:\s*(\S+)\s+(\S+)/im);
   return match ? `${match[1].toLowerCase()} ${match[2].toUpperCase()}` : null;
@@ -7489,7 +7507,8 @@ function createRTCTransport(config) {
   });
 }
 
-// ../src/network/peer-auth.ts
+// ../core/src/network/peer-auth.ts
+var MAX_EARLIER_READ_KEYS = 4;
 function readAccessOf(read) {
   if (!read) return null;
   if ("current" in read) return read;
@@ -7500,16 +7519,22 @@ async function proveRead(access, label, provider) {
   const key3 = await access.key();
   if (!key3) return null;
   const read = base64UrlEncode(await provider.sign(key3.privateKey, label));
-  if (key3.did === access.current()) return { read };
+  if (!key3.did) return { read };
   const member = await access.membership?.() ?? null;
-  return { read, readKey: key3.did, ...member ? { member } : {} };
+  const older = (await access.earlier?.() ?? []).filter((held) => held.did !== key3.did).slice(0, MAX_EARLIER_READ_KEYS);
+  const earlier = await Promise.all(older.map(async (held) => ({ readKey: held.did, read: base64UrlEncode(await provider.sign(held.privateKey, label)) })));
+  return { read, readKey: key3.did, ...member ? { member } : {}, ...earlier.length ? { earlier } : {} };
 }
 async function checkRead(access, peerDid, label, proof, provider) {
   const current = access.current();
   const claimed = typeof proof.readKey === "string" ? proof.readKey : current;
-  if (!claimed.startsWith("did:key:") || !await verifyBy(provider, claimed, proof.read, label)) return false;
-  if (claimed === current) return true;
-  return access.admits ? access.admits(peerDid, claimed, proof.member) : false;
+  if (claimed.startsWith("did:key:") && await verifyBy(provider, claimed, proof.read, label)) {
+    if (claimed === current) return true;
+    if (access.admits && await access.admits(peerDid, claimed, proof.member)) return true;
+  }
+  const earlier = Array.isArray(proof.earlier) ? proof.earlier.slice(0, MAX_EARLIER_READ_KEYS) : [];
+  const ours = earlier.find((item) => item?.readKey === current);
+  return ours !== void 0 && current.startsWith("did:key:") && verifyBy(provider, current, ours.read, label);
 }
 function peerNonce() {
   return base64UrlEncode(globalThis.crypto.getRandomValues(new Uint8Array(16)));
@@ -7575,7 +7600,7 @@ function createMeshAuth(spaceId, session, read, provider) {
   });
 }
 
-// ../src/network/ws-transport.ts
+// ../core/src/network/ws-transport.ts
 function parseFrame(data, type) {
   if (typeof data !== "string") return null;
   try {
@@ -7721,7 +7746,7 @@ function createWebSocketTransport(config) {
   });
 }
 
-// ../src/network/mesh.ts
+// ../core/src/network/mesh.ts
 var ICE_REFRESH_MS = 10 * 6e4;
 var ICE_WAIT_MS = 1500;
 function createMesh(config) {
@@ -8002,7 +8027,7 @@ function createMesh(config) {
   };
 }
 
-// ../src/network/network-manager.ts
+// ../core/src/network/network-manager.ts
 function createNetworkManager(config) {
   const transport = config.createTransport();
   const peers = /* @__PURE__ */ new Map();
@@ -8048,7 +8073,7 @@ function createNetworkManager(config) {
   });
 }
 
-// ../src/sync/sync-messages.ts
+// ../core/src/sync/sync-messages.ts
 var SYNC_PROTOCOL_VERSION = 4;
 function parseSyncMessage(value) {
   const message = value;
@@ -8056,7 +8081,7 @@ function parseSyncMessage(value) {
   return message;
 }
 
-// ../src/sync/sync-engine.ts
+// ../core/src/sync/sync-engine.ts
 var MAX_WAITING = 1e3;
 var MAX_REFUSED = 1e4;
 var holdsCollection = (holds2, collection2) => collection2.startsWith("sys.") || holds2 === "all" || holds2.has(collection2);
@@ -8344,7 +8369,7 @@ ${id}`;
   };
 }
 
-// ../src/validation/crypto-gate.ts
+// ../core/src/validation/crypto-gate.ts
 function createCryptoGate(provider) {
   return {
     async validate(expression, resolvePublicKey) {
@@ -8371,7 +8396,7 @@ function createCryptoGate(provider) {
   };
 }
 
-// ../src/validation/structural-gate.ts
+// ../core/src/validation/structural-gate.ts
 function isEncryptedBody(body) {
   if (!body || typeof body !== "object") return false;
   const envelope = body;
@@ -8405,7 +8430,7 @@ function createStructuralGate(schemaEngine, options = {}) {
   };
 }
 
-// ../src/validation/stateful-gate.ts
+// ../core/src/validation/stateful-gate.ts
 function createStatefulGate() {
   const rules = /* @__PURE__ */ new Map();
   return {
@@ -8451,7 +8476,7 @@ function createStatefulGate() {
   };
 }
 
-// ../src/validation/capability-gate.ts
+// ../core/src/validation/capability-gate.ts
 var fail = (reason) => ({ passed: false, gate: "capability", reason });
 var MAX_CLOCK_SKEW_SECONDS = 300;
 function createCapabilityGate(config) {
@@ -8494,7 +8519,7 @@ function createCapabilityGate(config) {
   };
 }
 
-// ../src/validation/validation-engine.ts
+// ../core/src/validation/validation-engine.ts
 function createValidationEngine(config) {
   const { cryptoGate, structuralGate, statefulGate, capabilityGate, resolvePublicKey, getExpression } = config;
   return {
@@ -8520,7 +8545,7 @@ function createValidationEngine(config) {
   };
 }
 
-// ../src/query/filter.ts
+// ../core/src/query/filter.ts
 var MAX_INCLUDE_DEPTH = 3;
 var META = {
   "@key": (r) => r.key,
@@ -8684,7 +8709,7 @@ function checkQuery(query) {
   return null;
 }
 
-// ../src/query/types.ts
+// ../core/src/query/types.ts
 var nameOf = (ref) => typeof ref === "object" && ref !== null && typeof ref.name === "string" ? ref.name : ref;
 function plainQuery(query) {
   const isObject = (v) => typeof v === "object" && v !== null && !Array.isArray(v);
@@ -8698,7 +8723,7 @@ function plainQuery(query) {
   return { ...query, collection: nameOf(query.collection), ...query.include !== void 0 ? { include: includes(query.include) } : {} };
 }
 
-// ../src/query/engine.ts
+// ../core/src/query/engine.ts
 function compareValues(a, b) {
   if (a === b) return 0;
   if (a === void 0 || a === null) return -1;
@@ -8758,7 +8783,7 @@ async function runQuery(source, given) {
   return { records, cursor: more ? page[page.length - 1].key : null, complete: true };
 }
 
-// ../src/storage/segment.ts
+// ../core/src/storage/segment.ts
 var SEGMENT_SUFFIX = ".seg";
 function packSegment(versions) {
   return utf8Encode(JSON.stringify({ v: 1, versions }));
@@ -8778,7 +8803,7 @@ async function segmentName(counter, bytes) {
 }
 var versionSize = (version) => utf8Encode(JSON.stringify(version)).length;
 
-// ../src/storage/mirror.ts
+// ../core/src/storage/mirror.ts
 var WRITER_KEY = "mirror:writer";
 var COUNTER_KEY = "mirror:counter";
 var readKey = (name) => `mirror:read:${name}`;
@@ -8924,7 +8949,7 @@ async function createMirror(config) {
   });
 }
 
-// ../src/space/pass.ts
+// ../core/src/space/pass.ts
 var PASS_COLLECTION = "sys.pass";
 var CARRY_CLOSED_KEY = "carry:closed";
 async function passKey(spaceId) {
@@ -8955,7 +8980,7 @@ function carriedRecord(pass) {
   return { space: pass.space, key: null, invite: null, role: null, read: pass.read };
 }
 
-// ../src/node/space-runtime.ts
+// ../core/src/node/space-runtime.ts
 var MANAGED = /* @__PURE__ */ new Set([MEMBERSHIP_COLLECTION, PROFILE_COLLECTION, CARRIER_COLLECTION, PASS_COLLECTION, BOX_COLLECTION, MEMBER_KEY_COLLECTION, ...ACCESS_COLLECTIONS]);
 var IN_THE_CLEAR = /* @__PURE__ */ new Set([ROLE_COLLECTION, MEMBER_COLLECTION, INVITE_COLLECTION, REVOKE_COLLECTION, KEY_COLLECTION, BOX_COLLECTION, MEMBER_KEY_COLLECTION, RELAYS_COLLECTION, KEEPERS_COLLECTION]);
 var ACCESS_KEYS = [
@@ -9462,6 +9487,7 @@ async function openSpaceRuntime(deps) {
       rules: definition?.rules ?? {},
       topics: definition?.topics ?? [],
       ...definition?.screen !== void 0 ? { screen: definition.screen } : {},
+      ...definition?.network?.length ? { network: definition.network } : {},
       records
     });
   }
@@ -9701,6 +9727,12 @@ async function openSpaceRuntime(deps) {
       return held ? deriveReadKey(held, provider) : record.read ?? null;
     },
     current: () => currentReadKey,
+    async earlier() {
+      const { current } = (await access()).history;
+      const newest = newestKey(current);
+      const older = [...current.keys].reverse().map((epoch) => keyring.get(epoch.keyId)).filter((held) => held !== void 0 && held !== newest);
+      return Promise.all(older.slice(0, MAX_EARLIER_READ_KEYS).map((held) => deriveReadKey(held, provider)));
+    },
     async membership() {
       const held = newestKey((await access()).history.current);
       return held ? sealWith(held, session.proof(), membershipContext(space2.id)) : null;
@@ -9898,7 +9930,7 @@ async function openSpaceRuntime(deps) {
     channel.unref?.();
   }
   const HOUR = 36e5;
-  const DAY2 = 24 * HOUR;
+  const DAY3 = 24 * HOUR;
   const declared = new Set((cache?.collections ?? []).filter((c) => !c.startsWith("sys.")));
   let cacheTimer = null;
   const saveCache = () => {
@@ -9986,7 +10018,7 @@ async function openSpaceRuntime(deps) {
   });
   async function dropUnused() {
     if (!cache || !partial || closed) return;
-    const cutoff = Date.now() - (cache.unusedAfterDays ?? 30) * DAY2;
+    const cutoff = Date.now() - (cache.unusedAfterDays ?? 30) * DAY3;
     const waiting = /* @__PURE__ */ new Set();
     for (const name of await adapter.list(PENDING_PREFIX)) {
       const bytes = await adapter.get(name);
@@ -10266,7 +10298,8 @@ async function openSpaceRuntime(deps) {
         ...input.permissions !== void 0 ? { permissions: input.permissions } : {},
         ...input.rules !== void 0 ? { rules: input.rules } : {},
         ...input.topics !== void 0 ? { topics: input.topics } : {},
-        ...input.screen !== void 0 ? { screen: input.screen } : {}
+        ...input.screen !== void 0 ? { screen: input.screen } : {},
+        ...input.network?.length ? { network: input.network } : {}
       };
       const problem = checkStoredCollection(definition);
       if (problem) throw new Error(problem);
@@ -10414,7 +10447,7 @@ async function openSpaceRuntime(deps) {
   });
 }
 
-// ../src/schemas/contacts.ts
+// ../core/src/schemas/contacts.ts
 var typed = () => (definition) => definition;
 var contact = typed()({
   name: "std.contact",
@@ -10495,7 +10528,7 @@ var knockAnswer = typed()({
   rules: { edit: "creator", delete: "creator" }
 });
 
-// ../src/doors/doors.ts
+// ../core/src/doors/doors.ts
 var MAX_DOOR_RELAYS = 3;
 var KNOCK_TTL_SECONDS = 14 * 24 * 3600;
 var KNOCK_DROP_WINDOW_SECONDS = 600;
@@ -10622,7 +10655,7 @@ async function openKnock(doorKey, blob, receivedAt, provider) {
   });
 }
 
-// ../src/network/mailbox.ts
+// ../core/src/network/mailbox.ts
 var MAX_PAGES = 8;
 function createMailboxClient(options = {}) {
   const timeoutMs = options.timeoutMs ?? 8e3;
@@ -10716,7 +10749,7 @@ function isMailItem(value) {
   return !!item && Number.isSafeInteger(item.seq) && typeof item.id === "string" && typeof item.at === "number" && typeof item.blob === "string";
 }
 
-// ../src/space/notify.ts
+// ../core/src/space/notify.ts
 var NOTIFY_COLLECTION = "sys.notify";
 var SUBSCRIPTION_COLLECTION = "sys.subscription";
 var COLLECTION = /^[a-z][a-z0-9-]*(\.[a-z0-9-]+)+$/;
@@ -10744,8 +10777,21 @@ function checkNotify(when) {
     }
   }
   if (typeof w.since !== "string" || !Number.isFinite(Date.parse(w.since))) return "since must be a date";
+  if (w.app !== void 0) {
+    const a = w.app;
+    if (typeof a !== "object" || a === null || typeof a.origin !== "string" || !isOrigin(a.origin)) return "app.origin must be a web origin";
+    if (a.name !== void 0 && (typeof a.name !== "string" || a.name.length > 80)) return "app.name must be text, at most 80 characters";
+  }
   return null;
 }
+function isOrigin(value) {
+  if (/^(chrome|moz|safari-web)-extension:\/\/[a-z0-9-]{1,64}$/i.test(value)) return true;
+  try {
+    return new URL(value).origin === value;
+  } catch {
+    return false;
+  }
+}
 async function carriedFor(when, spaces) {
   let tags;
   if (when.topic) {
@@ -10803,7 +10849,7 @@ function matchesSubscription(sub, spaceId, version, account, now = Date.now()) {
   return true;
 }
 
-// ../src/session/hosting.ts
+// ../core/src/session/hosting.ts
 var HOSTING_COLLECTION = "sys.hosting";
 var REQUEST_WINDOW_SECONDS = 300;
 function newSubscriptionSeed() {
@@ -10919,7 +10965,7 @@ function createHostClient(url, host, key3, provider = createP256Provider()) {
   });
 }
 
-// ../src/node/node.ts
+// ../core/src/node/node.ts
 var SESSION_CAPABILITY = { with: "*", can: "expression/*" };
 var DEFAULT_TTL_SECONDS = 3600;
 var FORGET_CARRIER_AFTER_MS = 30 * 24 * 3600 * 1e3;
@@ -12344,7 +12390,7 @@ async function createNode(config) {
   return node;
 }
 
-// ../src/node/stores.ts
+// ../core/src/node/stores.ts
 function folderStores(directory2, options = {}) {
   return async (path7, storeOptions) => {
     const full = options.basePath ? `${options.basePath}/${path7}` : path7;
@@ -12353,7 +12399,7 @@ function folderStores(directory2, options = {}) {
   };
 }
 
-// ../src/network/local-transport.ts
+// ../core/src/network/local-transport.ts
 var later = (fn) => void setTimeout(fn, 0);
 function createLocalHub() {
   const connected = /* @__PURE__ */ new Map();
@@ -12399,7 +12445,7 @@ function createLocalHub() {
   };
 }
 
-// ../src/node/carrier.ts
+// ../core/src/node/carrier.ts
 async function createCarryCore(config) {
   const provider = config.provider ?? createP256Provider();
   const signer = createSigner(provider);
@@ -12604,6 +12650,16 @@ async function createCarryCore(config) {
       await refreshing;
       return [...carries.values()].flatMap((entry) => [...entry.subscriptions].map(([id, sub]) => view(id, sub)));
     },
+    async collections(spaceId) {
+      const entry = carried.get(spaceId);
+      if (!entry || carries.has(spaceId)) return [];
+      return (await entry.runtime.collections()).map((found) => ({
+        name: found.name,
+        ...found.title ? { title: found.title } : {},
+        topics: found.topics,
+        records: found.records
+      }));
+    },
     async spaces() {
       const found = [];
       for (const [spaceId, entry] of carried) {
@@ -12630,7 +12686,7 @@ async function createCarryCore(config) {
   };
 }
 
-// ../src/node/host.ts
+// ../core/src/node/host.ts
 var SUBSCRIPTION_PREFIX = "subscription:";
 var NotAllowedError = class extends Error {
   constructor() {
@@ -12792,7 +12848,7 @@ async function createHostNode(config) {
   return Object.freeze(host);
 }
 
-// ../src/records/describe.ts
+// ../core/src/records/describe.ts
 var KNOWN_RULES = ["create", "edit", "delete", "onePer", "fixed"];
 var words = (name) => name.replace(/^.*\./, "").replace(/([a-z0-9])([A-Z])/g, "$1 $2").replace(/[_-]+/g, " ").toLowerCase();
 var article = (noun) => /^[aeiou]/.test(noun) ? `an ${noun}` : `a ${noun}`;
@@ -12867,10 +12923,14 @@ function describeCollection(definition) {
     sentences.push(`Roles in the space can be given permission to ${list}.`);
   }
   if (definition.history === "all") sentences.push(`Every earlier version of ${a} is kept.`);
+  if (definition.network?.length) {
+    const hosts = joinAnd(definition.network.map((origin) => origin.replace(/^[a-z]+:\/\//, "")));
+    sentences.push(`Its screen can connect to ${hosts}, and send there anything the person looking can see in it. Each person is asked first.`);
+  }
   return sentences;
 }
 
-// ../src/schemas/apps.ts
+// ../core/src/schemas/apps.ts
 var MAX_APP_COLLECTIONS = 10;
 var app = {
   name: "std.app",
@@ -12926,7 +12986,8 @@ function essence(definition) {
     links: canonicalize(definition.links ?? {}),
     permissions: canonicalize([...definition.permissions ?? []].sort()),
     rules: canonicalize(definition.rules ?? {}),
-    screen: definition.screen ?? ""
+    screen: definition.screen ?? "",
+    network: canonicalize([...definition.network ?? []].sort())
   };
 }
 var fieldNames = (schema) => Object.keys(schema?.properties ?? {});
@@ -12945,12 +13006,17 @@ function differences(held, wanted) {
   if (a.links !== b.links) out.push("changes what it points at");
   if (a.history !== b.history) out.push(b.history === "all" ? "starts keeping every version" : "stops keeping old versions");
   if (a.screen !== b.screen) out.push(!b.screen ? "takes its screen away" : !a.screen ? "gives it a screen" : "changes its screen");
+  if (a.network !== b.network) {
+    const before2 = new Set(held.network ?? []);
+    const reached = (wanted.network ?? []).filter((origin) => !before2.has(origin));
+    out.push(reached.length ? `lets its screen reach ${reached.join(", ")}` : "lets its screen reach fewer places");
+  }
   if (a.title !== b.title || a.description !== b.description) out.push("renames or redescribes it");
   return out;
 }
 function appScreen(body) {
   const found = body.needs.find((need) => typeof need.screen === "string" && need.screen.trim());
-  return found ? { collection: found.name, screen: found.screen } : null;
+  return found ? { collection: found.name, screen: found.screen, network: found.network ?? [] } : null;
 }
 function reviewApp(body, collections) {
   const problem = checkApp(body);
@@ -12971,11 +13037,17 @@ async function proposeApp(node, spaceId, body) {
   return node.records.put(spaceId, app.name, body);
 }
 
-// ../src/schemas/screens.ts
+// ../core/src/schemas/screens.ts
 var SCREEN_GUIDE = `A screen is one HTML document (scripts and styles inline, at most 48 KB) put on a collection definition as "screen".
 When the app is added, apps in the space can show it instead of plain lists. It runs sealed: no network (no fetch, no
 images from URLs, no fonts from URLs), no storage, no popups, no forms that submit. Keep state in records, never in the page.
 
+If it truly needs the network \u2014 weather, a map, a timetable \u2014 give its collection "network": the exact origins it may
+fetch from and load images from, like ["https://api.open-meteo.com"] (https:// or wss://, a host, no path; at most 8).
+Nothing else is reachable, and fonts never are. Each origin is named when people review the app, and each person is asked
+before a screen they open gets it: a person who says no gets the screen sealed, so it must still work without them.
+Ask for no more than it needs.
+
 Inside it, window.weave is:
   weave.me                          { did, name } \u2014 who is looking
   weave.collections                 the collection names this screen may use (its app's)
@@ -12997,7 +13069,7 @@ Draw everything from weave.list(...) and redraw on weave.onChange \u2014 other p
 Two people can write at once: design collections so that clashes resolve by the rules (onePer, creator-only edits), not by the screen.
 Use plain DOM; no libraries can be loaded. Prefer system fonts and simple, readable styling that works in light and dark.`;
 
-// ../src/node/actions.ts
+// ../core/src/node/actions.ts
 var space = { type: "string", description: "Space id, from spaces_list" };
 var key2 = { type: "string", description: "Record key \u2014 stays the same when the record is edited" };
 var str = (input, key3) => input[key3];
@@ -13178,7 +13250,12 @@ var NODE_ACTIONS = Object.freeze([
           type: "object",
           description: 'What its records allow, enforced by every peer: { "create": "member", "edit": "creator", "delete": ["creator", "can:moderate"], "onePer": ["@author", "link:about"], "fixed": ["options"] }. Who is "member" (anyone holding a role here, the default), "creator" (whoever created that record) or "can:<permission>" (anyone whose role holds one of the permissions declared above). onePer makes at most one record per author + linked record (+ body field): writing again changes it. fixed fields keep their first value.'
         },
-        screen: { type: "string", description: "Optional: its own screen, one HTML document \u2014 read apps_screen_guide first" }
+        screen: { type: "string", description: "Optional: its own screen, one HTML document \u2014 read apps_screen_guide first" },
+        network: {
+          type: "array",
+          items: { type: "string" },
+          description: 'Optional, with a screen: the exact origins it may connect to and load images from, like ["https://api.open-meteo.com"]. None keeps it sealed. Each is named when people review the app, and each person is asked before their screen gets them.'
+        }
       },
       required: ["space", "name", "schema"]
     },
@@ -13195,7 +13272,8 @@ var NODE_ACTIONS = Object.freeze([
         ...typeof input.links === "object" && input.links !== null ? { links: input.links } : {},
         ...Array.isArray(input.permissions) ? { permissions: input.permissions.filter((p) => typeof p === "string") } : {},
         ...typeof input.rules === "object" && input.rules !== null ? { rules: input.rules } : {},
-        ...typeof input.screen === "string" ? { screen: input.screen } : {}
+        ...typeof input.screen === "string" ? { screen: input.screen } : {},
+        ...Array.isArray(input.network) ? { network: input.network.filter((o) => typeof o === "string") } : {}
       });
       return { ...defined, summary: describeCollection({ ...defined, schema: defined.schema ?? void 0 }) };
     }
@@ -13228,14 +13306,14 @@ var NODE_ACTIONS = Object.freeze([
   },
   {
     name: "apps_screen_guide",
-    description: `How to write a screen \u2014 an app's own HTML UI, kept on its main collection's definition as "screen" and run sealed in the app: what it can use (window.weave: list, put, update, remove, onChange, me) and what it can't (network, storage).`,
+    description: `How to write a screen \u2014 an app's own HTML UI, kept on its main collection's definition as "screen" and run sealed in the app: what it can use (window.weave: list, put, update, remove, onChange, me) and what it can't (storage, and the network beyond the origins it names).`,
     input: { type: "object", properties: {} },
     readOnly: true,
     run: async () => SCREEN_GUIDE
   },
   {
     name: "apps_propose",
-    description: `Propose an app in a space: a new way for its people to work together \u2014 a carpool, a sign-up sheet, a decision log. Give it a title, a line on what it is for, and the collections it needs, each exactly as collections_define takes it (name, title, description, schema, links, permissions, rules \u2014 no version). Nothing is defined yet: everyone in the space sees the proposal, with what it allows worked out from its rules, and a person who may define collections adds it. Read collections_list first and reuse what the space already has (std.poll, std.task\u2026) rather than inventing a twin. For anything plain lists and forms can't show \u2014 a game board, a calendar, a whiteboard \u2014 give the main collection a "screen": its own HTML UI (one document, inline scripts and styles, no network). Inside it, use exactly: weave.me ({ did, name }), await weave.list("<collection>", { where: { "link:<rel>": key } }), await weave.put("<collection>", body, { links: [{ rel, to: key }] }), await weave.update(key, body), await weave.remove(key), weave.onChange(redraw). Records are { key, body, links, createdBy, mine }. Read apps_screen_guide for the rest. Returns what each collection will allow; tell the person that, not your own description.`,
+    description: `Propose an app in a space: a new way for its people to work together \u2014 a carpool, a sign-up sheet, a decision log. Give it a title, a line on what it is for, and the collections it needs, each exactly as collections_define takes it (name, title, description, schema, links, permissions, rules \u2014 no version). Nothing is defined yet: everyone in the space sees the proposal, with what it allows worked out from its rules, and a person who may define collections adds it. Read collections_list first and reuse what the space already has (std.poll, std.task\u2026) rather than inventing a twin. For anything plain lists and forms can't show \u2014 a game board, a calendar, a whiteboard \u2014 give the main collection a "screen": its own HTML UI (one document, inline scripts and styles, no network unless the collection names exact origins in "network"). Inside it, use exactly: weave.me ({ did, name }), await weave.list("<collection>", { where: { "link:<rel>": key } }), await weave.put("<collection>", body, { links: [{ rel, to: key }] }), await weave.update(key, body), await weave.remove(key), weave.onChange(redraw). Records are { key, body, links, createdBy, mine }. Read apps_screen_guide for the rest. Returns what each collection will allow; tell the person that, not your own description.`,
     input: {
       type: "object",
       properties: {
@@ -13438,7 +13516,7 @@ async function runAction(node, name, input = {}) {
   return action.run(node, input);
 }
 
-// ../node_modules/aws4fetch/dist/aws4fetch.esm.mjs
+// ../../node_modules/aws4fetch/dist/aws4fetch.esm.mjs
 var encoder2 = new TextEncoder();
 var HOST_SERVICES = {
   appstream2: "appstream",
@@ -13717,7 +13795,7 @@ function guessServiceRegion(url, headers) {
   return [HOST_SERVICES[service] || service, region || ""];
 }
 
-// ../src/storage/blob/s3.ts
+// ../core/src/storage/blob/s3.ts
 var ATTEMPTS = 5;
 function createS3BlobStore(config) {
   const client = new AwsClient({
@@ -13893,7 +13971,7 @@ async function createAccount(home, options) {
     throw new Error(`This home already has an account for ${did}`);
   }
   let vault = createVault({ did, label: options.name, wraps: [] });
-  if (options.passphrase) vault = withWrap(vault, await wrapSeedWithPassphrase(seed, options.passphrase, "CLI passphrase"));
+  if (options.passphrase) vault = withWrap(vault, await wrapSeedWithPassphrase(seed, options.passphrase, CLI_PASSPHRASE_LABEL));
   const id = newAccountId();
   const account = {
     id,
@@ -13954,7 +14032,7 @@ async function unlock(home, account, secret) {
 import { createServer } from "node:http";
 import { WebSocketServer } from "ws";
 
-// ../server/relay.mjs
+// ../relay/relay.mjs
 import { createHash, createHmac, createPublicKey, randomBytes as randomBytes4, verify } from "node:crypto";
 var MAX_MESSAGE_BYTES = 64 * 1024;
 var MAX_CONNECTIONS = 5e3;
@@ -15541,7 +15619,11 @@ import { mkdir as mkdir2, readFile as readFile3, rm, writeFile as writeFile2 } f
 import os3 from "node:os";
 import path4 from "node:path";
 
-// ../src/session/connect.ts
+// ../core/src/session/stay-signed-in.ts
+var DAY2 = 24 * 60 * 60 * 1e3;
+var DURATION2 = { never: 0, "1d": DAY2, "7d": 7 * DAY2, "30d": 30 * DAY2 };
+
+// ../core/src/session/connect.ts
 function grantSigner(grant) {
   let token = null;
   return {
@@ -15557,7 +15639,7 @@ function grantSigner(grant) {
   };
 }
 
-// ../src/session/agent-link.ts
+// ../core/src/session/agent-link.ts
 var SECRET_BYTES = 16;
 var ROOM_PREFIX2 = utf8Encode("weave-agent-link-room-v1");
 var KEY_INFO = utf8Encode("weave-agent-link-key-v1");

package/package.json

@@ -1,17 +1,19 @@
 {
   "name": "@weaveprotocol/cli",
-  "version": "0.2.1",
+  "version": "0.2.3",
   "description": "The Weave protocol from a terminal: manage spaces, run an always-on node, serve MCP to agents",
   "type": "module",
   "bin": {
     "weave": "dist/weave.mjs"
   },
   "scripts": {
-    "start": "node --import tsx src/main.ts",
-    "bundle": "esbuild src/main.ts --bundle --platform=node --format=esm --target=node22 --outfile=dist/weave.mjs --external:ws --external:node-datachannel --banner:js='#!/usr/bin/env node'",
+    "start": "node --conditions=@weaveprotocol/source --import tsx src/main.ts",
+    "test": "node --conditions=@weaveprotocol/source --import tsx --test tests/*.test.ts",
+    "typecheck": "tsc --noEmit",
+    "bundle": "esbuild src/main.ts --bundle --platform=node --format=esm --target=node22 --conditions=@weaveprotocol/source --outfile=dist/weave.mjs --external:ws --external:node-datachannel --banner:js='#!/usr/bin/env node'",
+    "bundle:pay": "esbuild pay/walletconnect.ts --bundle --format=esm --minify --platform=browser --target=es2022 --outfile=pay/dist/walletconnect.js --define:process.env.NODE_ENV='\"production\"'",
     "build": "bun build.ts",
-    "prepublishOnly": "npm run bundle && npm run bundle:pay",
-    "bundle:pay": "esbuild pay/walletconnect.ts --bundle --format=esm --minify --platform=browser --target=es2022 --outfile=pay/dist/walletconnect.js --define:process.env.NODE_ENV='\"production\"'"
+    "prepublishOnly": "npm run bundle && npm run bundle:pay"
   },
   "dependencies": {
     "node-datachannel": "^0.33.4",
@@ -24,7 +26,7 @@
   "repository": {
     "type": "git",
     "url": "git+https://github.com/leifriksheim/weave.git",
-    "directory": "cli"
+    "directory": "packages/cli"
   },
   "files": [
     "dist/weave.mjs",
@@ -33,6 +35,9 @@
   ],
   "devDependencies": {
     "@reown/appkit": "^1.8.24",
+    "@types/node": "^26.6.3",
+    "@weaveprotocol/core": "*",
+    "@weaveprotocol/relay": "*",
     "esbuild": "^0.28.0",
     "tsx": "^4.19.0"
   },