@weaveprotocol/cli 0.2.2 → 0.2.4

package/dist/weave.mjs

@@ -6894,6 +6894,21 @@ function toJsonSchema(schema) {
   return json;
 }
 var MAX_SCREEN_BYTES = 48 * 1024;
+var MAX_SCREEN_ORIGINS = 8;
+var SCREEN_ORIGIN = /^(https|wss):\/\/[a-z0-9]([a-z0-9-]*[a-z0-9])?(\.[a-z0-9]([a-z0-9-]*[a-z0-9])?)+(:[0-9]{1,5})?$/;
+function checkScreenNetwork(network, hasScreen) {
+  if (network === void 0) return null;
+  if (!Array.isArray(network)) return 'network must be a list of origins, like ["https://api.example.com"]';
+  if (!hasScreen && network.length) return "network is where a screen may connect; this definition has no screen";
+  if (network.length > MAX_SCREEN_ORIGINS) return `network may name at most ${MAX_SCREEN_ORIGINS} origins`;
+  for (const origin of network) {
+    if (typeof origin !== "string" || !SCREEN_ORIGIN.test(origin)) {
+      return `"${String(origin)}" is not an origin a screen may reach: give https:// or wss:// and a host, lower case, no path \u2014 like "https://api.example.com"`;
+    }
+  }
+  if (new Set(network).size !== network.length) return "network names an origin twice";
+  return null;
+}
 var CATALOG_COLLECTION = "sys.collection";
 var KEYWORDS = /* @__PURE__ */ new Set([
   "type",
@@ -7030,6 +7045,8 @@ function checkStoredCollection(definition) {
     const bytes = new TextEncoder().encode(d.screen).length;
     if (bytes > MAX_SCREEN_BYTES) return `screen is ${Math.ceil(bytes / 1024)} KB; at most ${MAX_SCREEN_BYTES / 1024} KB`;
   }
+  const network = checkScreenNetwork(d.network, typeof d.screen === "string");
+  if (network) return network;
   return checkPublishableSchema(d.schema);
 }
 function validateJsonSchema(schema, value) {
@@ -7491,6 +7508,7 @@ function createRTCTransport(config) {
 }
 
 // ../core/src/network/peer-auth.ts
+var MAX_EARLIER_READ_KEYS = 4;
 function readAccessOf(read) {
   if (!read) return null;
   if ("current" in read) return read;
@@ -7501,16 +7519,22 @@ async function proveRead(access, label, provider) {
   const key3 = await access.key();
   if (!key3) return null;
   const read = base64UrlEncode(await provider.sign(key3.privateKey, label));
-  if (key3.did === access.current()) return { read };
+  if (!key3.did) return { read };
   const member = await access.membership?.() ?? null;
-  return { read, readKey: key3.did, ...member ? { member } : {} };
+  const older = (await access.earlier?.() ?? []).filter((held) => held.did !== key3.did).slice(0, MAX_EARLIER_READ_KEYS);
+  const earlier = await Promise.all(older.map(async (held) => ({ readKey: held.did, read: base64UrlEncode(await provider.sign(held.privateKey, label)) })));
+  return { read, readKey: key3.did, ...member ? { member } : {}, ...earlier.length ? { earlier } : {} };
 }
 async function checkRead(access, peerDid, label, proof, provider) {
   const current = access.current();
   const claimed = typeof proof.readKey === "string" ? proof.readKey : current;
-  if (!claimed.startsWith("did:key:") || !await verifyBy(provider, claimed, proof.read, label)) return false;
-  if (claimed === current) return true;
-  return access.admits ? access.admits(peerDid, claimed, proof.member) : false;
+  if (claimed.startsWith("did:key:") && await verifyBy(provider, claimed, proof.read, label)) {
+    if (claimed === current) return true;
+    if (access.admits && await access.admits(peerDid, claimed, proof.member)) return true;
+  }
+  const earlier = Array.isArray(proof.earlier) ? proof.earlier.slice(0, MAX_EARLIER_READ_KEYS) : [];
+  const ours = earlier.find((item) => item?.readKey === current);
+  return ours !== void 0 && current.startsWith("did:key:") && verifyBy(provider, current, ours.read, label);
 }
 function peerNonce() {
   return base64UrlEncode(globalThis.crypto.getRandomValues(new Uint8Array(16)));
@@ -9463,6 +9487,7 @@ async function openSpaceRuntime(deps) {
       rules: definition?.rules ?? {},
       topics: definition?.topics ?? [],
       ...definition?.screen !== void 0 ? { screen: definition.screen } : {},
+      ...definition?.network?.length ? { network: definition.network } : {},
       records
     });
   }
@@ -9702,6 +9727,12 @@ async function openSpaceRuntime(deps) {
       return held ? deriveReadKey(held, provider) : record.read ?? null;
     },
     current: () => currentReadKey,
+    async earlier() {
+      const { current } = (await access()).history;
+      const newest = newestKey(current);
+      const older = [...current.keys].reverse().map((epoch) => keyring.get(epoch.keyId)).filter((held) => held !== void 0 && held !== newest);
+      return Promise.all(older.slice(0, MAX_EARLIER_READ_KEYS).map((held) => deriveReadKey(held, provider)));
+    },
     async membership() {
       const held = newestKey((await access()).history.current);
       return held ? sealWith(held, session.proof(), membershipContext(space2.id)) : null;
@@ -10267,7 +10298,8 @@ async function openSpaceRuntime(deps) {
         ...input.permissions !== void 0 ? { permissions: input.permissions } : {},
         ...input.rules !== void 0 ? { rules: input.rules } : {},
         ...input.topics !== void 0 ? { topics: input.topics } : {},
-        ...input.screen !== void 0 ? { screen: input.screen } : {}
+        ...input.screen !== void 0 ? { screen: input.screen } : {},
+        ...input.network?.length ? { network: input.network } : {}
       };
       const problem = checkStoredCollection(definition);
       if (problem) throw new Error(problem);
@@ -10745,8 +10777,21 @@ function checkNotify(when) {
     }
   }
   if (typeof w.since !== "string" || !Number.isFinite(Date.parse(w.since))) return "since must be a date";
+  if (w.app !== void 0) {
+    const a = w.app;
+    if (typeof a !== "object" || a === null || typeof a.origin !== "string" || !isOrigin(a.origin)) return "app.origin must be a web origin";
+    if (a.name !== void 0 && (typeof a.name !== "string" || a.name.length > 80)) return "app.name must be text, at most 80 characters";
+  }
   return null;
 }
+function isOrigin(value) {
+  if (/^(chrome|moz|safari-web)-extension:\/\/[a-z0-9-]{1,64}$/i.test(value)) return true;
+  try {
+    return new URL(value).origin === value;
+  } catch {
+    return false;
+  }
+}
 async function carriedFor(when, spaces) {
   let tags;
   if (when.topic) {
@@ -12605,6 +12650,16 @@ async function createCarryCore(config) {
       await refreshing;
       return [...carries.values()].flatMap((entry) => [...entry.subscriptions].map(([id, sub]) => view(id, sub)));
     },
+    async collections(spaceId) {
+      const entry = carried.get(spaceId);
+      if (!entry || carries.has(spaceId)) return [];
+      return (await entry.runtime.collections()).map((found) => ({
+        name: found.name,
+        ...found.title ? { title: found.title } : {},
+        topics: found.topics,
+        records: found.records
+      }));
+    },
     async spaces() {
       const found = [];
       for (const [spaceId, entry] of carried) {
@@ -12868,6 +12923,10 @@ function describeCollection(definition) {
     sentences.push(`Roles in the space can be given permission to ${list}.`);
   }
   if (definition.history === "all") sentences.push(`Every earlier version of ${a} is kept.`);
+  if (definition.network?.length) {
+    const hosts = joinAnd(definition.network.map((origin) => origin.replace(/^[a-z]+:\/\//, "")));
+    sentences.push(`Its screen can connect to ${hosts}, and send there anything the person looking can see in it. Each person is asked first.`);
+  }
   return sentences;
 }
 
@@ -12883,7 +12942,8 @@ var app = {
       title: { type: "string", minLength: 1, maxLength: 100 },
       description: { type: "string", maxLength: 1e3 },
       needs: { type: "array", minItems: 1, maxItems: MAX_APP_COLLECTIONS, items: { type: "object" } },
-      from: { type: "string", maxLength: 300 }
+      from: { type: "string", maxLength: 300 },
+      updates: { type: "string", minLength: 1, maxLength: 100 }
     },
     required: ["title", "needs"]
   },
@@ -12897,6 +12957,9 @@ function checkApp(value) {
   if (body.description !== void 0 && (typeof body.description !== "string" || body.description.length > 1e3)) {
     return "An app's description is at most 1000 characters";
   }
+  if (body.updates !== void 0 && (typeof body.updates !== "string" || !body.updates || body.updates.length > 100)) {
+    return `An app's "updates" is the key of the app it replaces`;
+  }
   if (!Array.isArray(body.needs) || body.needs.length === 0 || body.needs.length > MAX_APP_COLLECTIONS) {
     return `An app needs 1\u2013${MAX_APP_COLLECTIONS} collections`;
   }
@@ -12927,7 +12990,8 @@ function essence(definition) {
     links: canonicalize(definition.links ?? {}),
     permissions: canonicalize([...definition.permissions ?? []].sort()),
     rules: canonicalize(definition.rules ?? {}),
-    screen: definition.screen ?? ""
+    screen: definition.screen ?? "",
+    network: canonicalize([...definition.network ?? []].sort())
   };
 }
 var fieldNames = (schema) => Object.keys(schema?.properties ?? {});
@@ -12946,12 +13010,17 @@ function differences(held, wanted) {
   if (a.links !== b.links) out.push("changes what it points at");
   if (a.history !== b.history) out.push(b.history === "all" ? "starts keeping every version" : "stops keeping old versions");
   if (a.screen !== b.screen) out.push(!b.screen ? "takes its screen away" : !a.screen ? "gives it a screen" : "changes its screen");
+  if (a.network !== b.network) {
+    const before2 = new Set(held.network ?? []);
+    const reached = (wanted.network ?? []).filter((origin) => !before2.has(origin));
+    out.push(reached.length ? `lets its screen reach ${reached.join(", ")}` : "lets its screen reach fewer places");
+  }
   if (a.title !== b.title || a.description !== b.description) out.push("renames or redescribes it");
   return out;
 }
 function appScreen(body) {
   const found = body.needs.find((need) => typeof need.screen === "string" && need.screen.trim());
-  return found ? { collection: found.name, screen: found.screen } : null;
+  return found ? { collection: found.name, screen: found.screen, network: found.network ?? [] } : null;
 }
 function reviewApp(body, collections) {
   const problem = checkApp(body);
@@ -12966,9 +13035,25 @@ function reviewApp(body, collections) {
   });
   return { needs, added: needs.every((need) => need.status === "same"), problem: null };
 }
+function supersededApps(records, collections) {
+  const replaces = /* @__PURE__ */ new Map();
+  for (const record of records) {
+    if (record.body?.updates && record.body.updates !== record.key) replaces.set(record.key, record.body.updates);
+  }
+  const superseded = /* @__PURE__ */ new Set();
+  for (const record of records) {
+    if (!record.body || !reviewApp(record.body, collections).added) continue;
+    for (let key3 = replaces.get(record.key); key3 && !superseded.has(key3) && key3 !== record.key; key3 = replaces.get(key3)) superseded.add(key3);
+  }
+  return superseded;
+}
 async function proposeApp(node, spaceId, body) {
   const problem = checkApp(body);
   if (problem) throw new Error(problem);
+  if (body.updates) {
+    const replaced = await node.records.get(spaceId, body.updates);
+    if (!replaced || replaced.collection !== app.name) throw new Error(`"updates" names no app in this space: ${body.updates}`);
+  }
   return node.records.put(spaceId, app.name, body);
 }
 
@@ -12977,6 +13062,12 @@ var SCREEN_GUIDE = `A screen is one HTML document (scripts and styles inline, at
 When the app is added, apps in the space can show it instead of plain lists. It runs sealed: no network (no fetch, no
 images from URLs, no fonts from URLs), no storage, no popups, no forms that submit. Keep state in records, never in the page.
 
+If it truly needs the network \u2014 weather, a map, a timetable \u2014 give its collection "network": the exact origins it may
+fetch from and load images from, like ["https://api.open-meteo.com"] (https:// or wss://, a host, no path; at most 8).
+Nothing else is reachable, and fonts never are. Each origin is named when people review the app, and each person is asked
+before a screen they open gets it: a person who says no gets the screen sealed, so it must still work without them.
+Ask for no more than it needs.
+
 Inside it, window.weave is:
   weave.me                          { did, name } \u2014 who is looking
   weave.collections                 the collection names this screen may use (its app's)
@@ -13179,7 +13270,12 @@ var NODE_ACTIONS = Object.freeze([
           type: "object",
           description: 'What its records allow, enforced by every peer: { "create": "member", "edit": "creator", "delete": ["creator", "can:moderate"], "onePer": ["@author", "link:about"], "fixed": ["options"] }. Who is "member" (anyone holding a role here, the default), "creator" (whoever created that record) or "can:<permission>" (anyone whose role holds one of the permissions declared above). onePer makes at most one record per author + linked record (+ body field): writing again changes it. fixed fields keep their first value.'
         },
-        screen: { type: "string", description: "Optional: its own screen, one HTML document \u2014 read apps_screen_guide first" }
+        screen: { type: "string", description: "Optional: its own screen, one HTML document \u2014 read apps_screen_guide first" },
+        network: {
+          type: "array",
+          items: { type: "string" },
+          description: 'Optional, with a screen: the exact origins it may connect to and load images from, like ["https://api.open-meteo.com"]. None keeps it sealed. Each is named when people review the app, and each person is asked before their screen gets them.'
+        }
       },
       required: ["space", "name", "schema"]
     },
@@ -13196,14 +13292,15 @@ var NODE_ACTIONS = Object.freeze([
         ...typeof input.links === "object" && input.links !== null ? { links: input.links } : {},
         ...Array.isArray(input.permissions) ? { permissions: input.permissions.filter((p) => typeof p === "string") } : {},
         ...typeof input.rules === "object" && input.rules !== null ? { rules: input.rules } : {},
-        ...typeof input.screen === "string" ? { screen: input.screen } : {}
+        ...typeof input.screen === "string" ? { screen: input.screen } : {},
+        ...Array.isArray(input.network) ? { network: input.network.filter((o) => typeof o === "string") } : {}
       });
       return { ...defined, summary: describeCollection({ ...defined, schema: defined.schema ?? void 0 }) };
     }
   },
   {
     name: "apps_list",
-    description: 'The apps proposed in a space: each with its title, who proposed it (viaAgent when an agent did), and for every collection it needs whether it is new, already there, or would change one \u2014 with what it allows, worked out from its rules. "added" is true once a person has added it.',
+    description: 'The apps proposed in a space: each with its title, who proposed it (viaAgent when an agent did), and for every collection it needs whether it is new, already there, or would change one \u2014 with what it allows, worked out from its rules. "added" is true once a person has added it. "updates" names the app it is a new version of; "superseded" is true once a newer version of it has been added, so it is only history.',
     input: { type: "object", properties: { space }, required: ["space"] },
     readOnly: true,
     peerContent: true,
@@ -13211,6 +13308,7 @@ var NODE_ACTIONS = Object.freeze([
       const spaceId = str(input, "space");
       const collections = await node.collections.list(spaceId);
       const found = await node.records.list(spaceId, { collection: app.name });
+      const superseded = supersededApps(found, collections);
       return found.map((record) => {
         const review = record.body ? reviewApp(record.body, collections) : null;
         return {
@@ -13220,7 +13318,9 @@ var NODE_ACTIONS = Object.freeze([
           proposedBy: record.createdBy,
           ...record.viaAgent ? { viaAgent: true } : {},
           ...record.body && appScreen(record.body) ? { screen: appScreen(record.body).collection } : {},
+          ...record.body?.updates ? { updates: record.body.updates } : {},
           added: review?.added ?? false,
+          superseded: superseded.has(record.key),
           problem: review?.problem ?? (record.body ? null : "It could not be read"),
           needs: review?.needs.map(({ definition, status, summary, changes }) => ({ name: definition.name, status, summary, changes })) ?? []
         };
@@ -13229,20 +13329,21 @@ var NODE_ACTIONS = Object.freeze([
   },
   {
     name: "apps_screen_guide",
-    description: `How to write a screen \u2014 an app's own HTML UI, kept on its main collection's definition as "screen" and run sealed in the app: what it can use (window.weave: list, put, update, remove, onChange, me) and what it can't (network, storage).`,
+    description: `How to write a screen \u2014 an app's own HTML UI, kept on its main collection's definition as "screen" and run sealed in the app: what it can use (window.weave: list, put, update, remove, onChange, me) and what it can't (storage, and the network beyond the origins it names).`,
     input: { type: "object", properties: {} },
     readOnly: true,
     run: async () => SCREEN_GUIDE
   },
   {
     name: "apps_propose",
-    description: `Propose an app in a space: a new way for its people to work together \u2014 a carpool, a sign-up sheet, a decision log. Give it a title, a line on what it is for, and the collections it needs, each exactly as collections_define takes it (name, title, description, schema, links, permissions, rules \u2014 no version). Nothing is defined yet: everyone in the space sees the proposal, with what it allows worked out from its rules, and a person who may define collections adds it. Read collections_list first and reuse what the space already has (std.poll, std.task\u2026) rather than inventing a twin. For anything plain lists and forms can't show \u2014 a game board, a calendar, a whiteboard \u2014 give the main collection a "screen": its own HTML UI (one document, inline scripts and styles, no network). Inside it, use exactly: weave.me ({ did, name }), await weave.list("<collection>", { where: { "link:<rel>": key } }), await weave.put("<collection>", body, { links: [{ rel, to: key }] }), await weave.update(key, body), await weave.remove(key), weave.onChange(redraw). Records are { key, body, links, createdBy, mine }. Read apps_screen_guide for the rest. Returns what each collection will allow; tell the person that, not your own description.`,
+    description: `Propose an app in a space: a new way for its people to work together \u2014 a carpool, a sign-up sheet, a decision log. Give it a title, a line on what it is for, and the collections it needs, each exactly as collections_define takes it (name, title, description, schema, links, permissions, rules \u2014 no version). Nothing is defined yet: everyone in the space sees the proposal, with what it allows worked out from its rules, and a person who may define collections adds it. Read collections_list first and reuse what the space already has (std.poll, std.task\u2026) rather than inventing a twin. To change an app that is already here, read apps_list and pass the key of its newest version, the one not superseded, as "updates": the change then shows as an update to it, and once it is added the old version is not offered again. For anything plain lists and forms can't show \u2014 a game board, a calendar, a whiteboard \u2014 give the main collection a "screen": its own HTML UI (one document, inline scripts and styles, no network unless the collection names exact origins in "network"). Inside it, use exactly: weave.me ({ did, name }), await weave.list("<collection>", { where: { "link:<rel>": key } }), await weave.put("<collection>", body, { links: [{ rel, to: key }] }), await weave.update(key, body), await weave.remove(key), weave.onChange(redraw). Records are { key, body, links, createdBy, mine }. Read apps_screen_guide for the rest. Returns what each collection will allow; tell the person that, not your own description.`,
     input: {
       type: "object",
       properties: {
         space,
         title: { type: "string", description: 'What people will call it, e.g. "Carpool"' },
         description: { type: "string", description: "What it is for, in a sentence" },
+        updates: { type: "string", description: "The key of the app this is a new version of, from apps_list" },
         needs: {
           type: "array",
           description: "Collection definitions, as collections_define takes them \u2014 without version",
@@ -13257,6 +13358,7 @@ var NODE_ACTIONS = Object.freeze([
       const body = {
         title: str(input, "title"),
         ...typeof input.description === "string" ? { description: input.description } : {},
+        ...typeof input.updates === "string" ? { updates: input.updates } : {},
         needs: input.needs
       };
       const problem = checkApp(body);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@weaveprotocol/cli",
-  "version": "0.2.2",
+  "version": "0.2.4",
   "description": "The Weave protocol from a terminal: manage spaces, run an always-on node, serve MCP to agents",
   "type": "module",
   "bin": {