@weaveprotocol/cli 0.2.2 → 0.2.3

package/dist/weave.mjs

@@ -6894,6 +6894,21 @@ function toJsonSchema(schema) {
   return json;
 }
 var MAX_SCREEN_BYTES = 48 * 1024;
+var MAX_SCREEN_ORIGINS = 8;
+var SCREEN_ORIGIN = /^(https|wss):\/\/[a-z0-9]([a-z0-9-]*[a-z0-9])?(\.[a-z0-9]([a-z0-9-]*[a-z0-9])?)+(:[0-9]{1,5})?$/;
+function checkScreenNetwork(network, hasScreen) {
+  if (network === void 0) return null;
+  if (!Array.isArray(network)) return 'network must be a list of origins, like ["https://api.example.com"]';
+  if (!hasScreen && network.length) return "network is where a screen may connect; this definition has no screen";
+  if (network.length > MAX_SCREEN_ORIGINS) return `network may name at most ${MAX_SCREEN_ORIGINS} origins`;
+  for (const origin of network) {
+    if (typeof origin !== "string" || !SCREEN_ORIGIN.test(origin)) {
+      return `"${String(origin)}" is not an origin a screen may reach: give https:// or wss:// and a host, lower case, no path \u2014 like "https://api.example.com"`;
+    }
+  }
+  if (new Set(network).size !== network.length) return "network names an origin twice";
+  return null;
+}
 var CATALOG_COLLECTION = "sys.collection";
 var KEYWORDS = /* @__PURE__ */ new Set([
   "type",
@@ -7030,6 +7045,8 @@ function checkStoredCollection(definition) {
     const bytes = new TextEncoder().encode(d.screen).length;
     if (bytes > MAX_SCREEN_BYTES) return `screen is ${Math.ceil(bytes / 1024)} KB; at most ${MAX_SCREEN_BYTES / 1024} KB`;
   }
+  const network = checkScreenNetwork(d.network, typeof d.screen === "string");
+  if (network) return network;
   return checkPublishableSchema(d.schema);
 }
 function validateJsonSchema(schema, value) {
@@ -7491,6 +7508,7 @@ function createRTCTransport(config) {
 }
 
 // ../core/src/network/peer-auth.ts
+var MAX_EARLIER_READ_KEYS = 4;
 function readAccessOf(read) {
   if (!read) return null;
   if ("current" in read) return read;
@@ -7501,16 +7519,22 @@ async function proveRead(access, label, provider) {
   const key3 = await access.key();
   if (!key3) return null;
   const read = base64UrlEncode(await provider.sign(key3.privateKey, label));
-  if (key3.did === access.current()) return { read };
+  if (!key3.did) return { read };
   const member = await access.membership?.() ?? null;
-  return { read, readKey: key3.did, ...member ? { member } : {} };
+  const older = (await access.earlier?.() ?? []).filter((held) => held.did !== key3.did).slice(0, MAX_EARLIER_READ_KEYS);
+  const earlier = await Promise.all(older.map(async (held) => ({ readKey: held.did, read: base64UrlEncode(await provider.sign(held.privateKey, label)) })));
+  return { read, readKey: key3.did, ...member ? { member } : {}, ...earlier.length ? { earlier } : {} };
 }
 async function checkRead(access, peerDid, label, proof, provider) {
   const current = access.current();
   const claimed = typeof proof.readKey === "string" ? proof.readKey : current;
-  if (!claimed.startsWith("did:key:") || !await verifyBy(provider, claimed, proof.read, label)) return false;
-  if (claimed === current) return true;
-  return access.admits ? access.admits(peerDid, claimed, proof.member) : false;
+  if (claimed.startsWith("did:key:") && await verifyBy(provider, claimed, proof.read, label)) {
+    if (claimed === current) return true;
+    if (access.admits && await access.admits(peerDid, claimed, proof.member)) return true;
+  }
+  const earlier = Array.isArray(proof.earlier) ? proof.earlier.slice(0, MAX_EARLIER_READ_KEYS) : [];
+  const ours = earlier.find((item) => item?.readKey === current);
+  return ours !== void 0 && current.startsWith("did:key:") && verifyBy(provider, current, ours.read, label);
 }
 function peerNonce() {
   return base64UrlEncode(globalThis.crypto.getRandomValues(new Uint8Array(16)));
@@ -9463,6 +9487,7 @@ async function openSpaceRuntime(deps) {
       rules: definition?.rules ?? {},
       topics: definition?.topics ?? [],
       ...definition?.screen !== void 0 ? { screen: definition.screen } : {},
+      ...definition?.network?.length ? { network: definition.network } : {},
       records
     });
   }
@@ -9702,6 +9727,12 @@ async function openSpaceRuntime(deps) {
       return held ? deriveReadKey(held, provider) : record.read ?? null;
     },
     current: () => currentReadKey,
+    async earlier() {
+      const { current } = (await access()).history;
+      const newest = newestKey(current);
+      const older = [...current.keys].reverse().map((epoch) => keyring.get(epoch.keyId)).filter((held) => held !== void 0 && held !== newest);
+      return Promise.all(older.slice(0, MAX_EARLIER_READ_KEYS).map((held) => deriveReadKey(held, provider)));
+    },
     async membership() {
       const held = newestKey((await access()).history.current);
       return held ? sealWith(held, session.proof(), membershipContext(space2.id)) : null;
@@ -10267,7 +10298,8 @@ async function openSpaceRuntime(deps) {
         ...input.permissions !== void 0 ? { permissions: input.permissions } : {},
         ...input.rules !== void 0 ? { rules: input.rules } : {},
         ...input.topics !== void 0 ? { topics: input.topics } : {},
-        ...input.screen !== void 0 ? { screen: input.screen } : {}
+        ...input.screen !== void 0 ? { screen: input.screen } : {},
+        ...input.network?.length ? { network: input.network } : {}
       };
       const problem = checkStoredCollection(definition);
       if (problem) throw new Error(problem);
@@ -10745,8 +10777,21 @@ function checkNotify(when) {
     }
   }
   if (typeof w.since !== "string" || !Number.isFinite(Date.parse(w.since))) return "since must be a date";
+  if (w.app !== void 0) {
+    const a = w.app;
+    if (typeof a !== "object" || a === null || typeof a.origin !== "string" || !isOrigin(a.origin)) return "app.origin must be a web origin";
+    if (a.name !== void 0 && (typeof a.name !== "string" || a.name.length > 80)) return "app.name must be text, at most 80 characters";
+  }
   return null;
 }
+function isOrigin(value) {
+  if (/^(chrome|moz|safari-web)-extension:\/\/[a-z0-9-]{1,64}$/i.test(value)) return true;
+  try {
+    return new URL(value).origin === value;
+  } catch {
+    return false;
+  }
+}
 async function carriedFor(when, spaces) {
   let tags;
   if (when.topic) {
@@ -12605,6 +12650,16 @@ async function createCarryCore(config) {
       await refreshing;
       return [...carries.values()].flatMap((entry) => [...entry.subscriptions].map(([id, sub]) => view(id, sub)));
     },
+    async collections(spaceId) {
+      const entry = carried.get(spaceId);
+      if (!entry || carries.has(spaceId)) return [];
+      return (await entry.runtime.collections()).map((found) => ({
+        name: found.name,
+        ...found.title ? { title: found.title } : {},
+        topics: found.topics,
+        records: found.records
+      }));
+    },
     async spaces() {
       const found = [];
       for (const [spaceId, entry] of carried) {
@@ -12868,6 +12923,10 @@ function describeCollection(definition) {
     sentences.push(`Roles in the space can be given permission to ${list}.`);
   }
   if (definition.history === "all") sentences.push(`Every earlier version of ${a} is kept.`);
+  if (definition.network?.length) {
+    const hosts = joinAnd(definition.network.map((origin) => origin.replace(/^[a-z]+:\/\//, "")));
+    sentences.push(`Its screen can connect to ${hosts}, and send there anything the person looking can see in it. Each person is asked first.`);
+  }
   return sentences;
 }
 
@@ -12927,7 +12986,8 @@ function essence(definition) {
     links: canonicalize(definition.links ?? {}),
     permissions: canonicalize([...definition.permissions ?? []].sort()),
     rules: canonicalize(definition.rules ?? {}),
-    screen: definition.screen ?? ""
+    screen: definition.screen ?? "",
+    network: canonicalize([...definition.network ?? []].sort())
   };
 }
 var fieldNames = (schema) => Object.keys(schema?.properties ?? {});
@@ -12946,12 +13006,17 @@ function differences(held, wanted) {
   if (a.links !== b.links) out.push("changes what it points at");
   if (a.history !== b.history) out.push(b.history === "all" ? "starts keeping every version" : "stops keeping old versions");
   if (a.screen !== b.screen) out.push(!b.screen ? "takes its screen away" : !a.screen ? "gives it a screen" : "changes its screen");
+  if (a.network !== b.network) {
+    const before2 = new Set(held.network ?? []);
+    const reached = (wanted.network ?? []).filter((origin) => !before2.has(origin));
+    out.push(reached.length ? `lets its screen reach ${reached.join(", ")}` : "lets its screen reach fewer places");
+  }
   if (a.title !== b.title || a.description !== b.description) out.push("renames or redescribes it");
   return out;
 }
 function appScreen(body) {
   const found = body.needs.find((need) => typeof need.screen === "string" && need.screen.trim());
-  return found ? { collection: found.name, screen: found.screen } : null;
+  return found ? { collection: found.name, screen: found.screen, network: found.network ?? [] } : null;
 }
 function reviewApp(body, collections) {
   const problem = checkApp(body);
@@ -12977,6 +13042,12 @@ var SCREEN_GUIDE = `A screen is one HTML document (scripts and styles inline, at
 When the app is added, apps in the space can show it instead of plain lists. It runs sealed: no network (no fetch, no
 images from URLs, no fonts from URLs), no storage, no popups, no forms that submit. Keep state in records, never in the page.
 
+If it truly needs the network \u2014 weather, a map, a timetable \u2014 give its collection "network": the exact origins it may
+fetch from and load images from, like ["https://api.open-meteo.com"] (https:// or wss://, a host, no path; at most 8).
+Nothing else is reachable, and fonts never are. Each origin is named when people review the app, and each person is asked
+before a screen they open gets it: a person who says no gets the screen sealed, so it must still work without them.
+Ask for no more than it needs.
+
 Inside it, window.weave is:
   weave.me                          { did, name } \u2014 who is looking
   weave.collections                 the collection names this screen may use (its app's)
@@ -13179,7 +13250,12 @@ var NODE_ACTIONS = Object.freeze([
           type: "object",
           description: 'What its records allow, enforced by every peer: { "create": "member", "edit": "creator", "delete": ["creator", "can:moderate"], "onePer": ["@author", "link:about"], "fixed": ["options"] }. Who is "member" (anyone holding a role here, the default), "creator" (whoever created that record) or "can:<permission>" (anyone whose role holds one of the permissions declared above). onePer makes at most one record per author + linked record (+ body field): writing again changes it. fixed fields keep their first value.'
         },
-        screen: { type: "string", description: "Optional: its own screen, one HTML document \u2014 read apps_screen_guide first" }
+        screen: { type: "string", description: "Optional: its own screen, one HTML document \u2014 read apps_screen_guide first" },
+        network: {
+          type: "array",
+          items: { type: "string" },
+          description: 'Optional, with a screen: the exact origins it may connect to and load images from, like ["https://api.open-meteo.com"]. None keeps it sealed. Each is named when people review the app, and each person is asked before their screen gets them.'
+        }
       },
       required: ["space", "name", "schema"]
     },
@@ -13196,7 +13272,8 @@ var NODE_ACTIONS = Object.freeze([
         ...typeof input.links === "object" && input.links !== null ? { links: input.links } : {},
         ...Array.isArray(input.permissions) ? { permissions: input.permissions.filter((p) => typeof p === "string") } : {},
         ...typeof input.rules === "object" && input.rules !== null ? { rules: input.rules } : {},
-        ...typeof input.screen === "string" ? { screen: input.screen } : {}
+        ...typeof input.screen === "string" ? { screen: input.screen } : {},
+        ...Array.isArray(input.network) ? { network: input.network.filter((o) => typeof o === "string") } : {}
       });
       return { ...defined, summary: describeCollection({ ...defined, schema: defined.schema ?? void 0 }) };
     }
@@ -13229,14 +13306,14 @@ var NODE_ACTIONS = Object.freeze([
   },
   {
     name: "apps_screen_guide",
-    description: `How to write a screen \u2014 an app's own HTML UI, kept on its main collection's definition as "screen" and run sealed in the app: what it can use (window.weave: list, put, update, remove, onChange, me) and what it can't (network, storage).`,
+    description: `How to write a screen \u2014 an app's own HTML UI, kept on its main collection's definition as "screen" and run sealed in the app: what it can use (window.weave: list, put, update, remove, onChange, me) and what it can't (storage, and the network beyond the origins it names).`,
     input: { type: "object", properties: {} },
     readOnly: true,
     run: async () => SCREEN_GUIDE
   },
   {
     name: "apps_propose",
-    description: `Propose an app in a space: a new way for its people to work together \u2014 a carpool, a sign-up sheet, a decision log. Give it a title, a line on what it is for, and the collections it needs, each exactly as collections_define takes it (name, title, description, schema, links, permissions, rules \u2014 no version). Nothing is defined yet: everyone in the space sees the proposal, with what it allows worked out from its rules, and a person who may define collections adds it. Read collections_list first and reuse what the space already has (std.poll, std.task\u2026) rather than inventing a twin. For anything plain lists and forms can't show \u2014 a game board, a calendar, a whiteboard \u2014 give the main collection a "screen": its own HTML UI (one document, inline scripts and styles, no network). Inside it, use exactly: weave.me ({ did, name }), await weave.list("<collection>", { where: { "link:<rel>": key } }), await weave.put("<collection>", body, { links: [{ rel, to: key }] }), await weave.update(key, body), await weave.remove(key), weave.onChange(redraw). Records are { key, body, links, createdBy, mine }. Read apps_screen_guide for the rest. Returns what each collection will allow; tell the person that, not your own description.`,
+    description: `Propose an app in a space: a new way for its people to work together \u2014 a carpool, a sign-up sheet, a decision log. Give it a title, a line on what it is for, and the collections it needs, each exactly as collections_define takes it (name, title, description, schema, links, permissions, rules \u2014 no version). Nothing is defined yet: everyone in the space sees the proposal, with what it allows worked out from its rules, and a person who may define collections adds it. Read collections_list first and reuse what the space already has (std.poll, std.task\u2026) rather than inventing a twin. For anything plain lists and forms can't show \u2014 a game board, a calendar, a whiteboard \u2014 give the main collection a "screen": its own HTML UI (one document, inline scripts and styles, no network unless the collection names exact origins in "network"). Inside it, use exactly: weave.me ({ did, name }), await weave.list("<collection>", { where: { "link:<rel>": key } }), await weave.put("<collection>", body, { links: [{ rel, to: key }] }), await weave.update(key, body), await weave.remove(key), weave.onChange(redraw). Records are { key, body, links, createdBy, mine }. Read apps_screen_guide for the rest. Returns what each collection will allow; tell the person that, not your own description.`,
     input: {
       type: "object",
       properties: {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@weaveprotocol/cli",
-  "version": "0.2.2",
+  "version": "0.2.3",
   "description": "The Weave protocol from a terminal: manage spaces, run an always-on node, serve MCP to agents",
   "type": "module",
   "bin": {