@weaveprotocol/core 0.1.0

package/dist/session/places.d.ts

@@ -0,0 +1,62 @@
+import type { AccountStore, AccountSummary } from '../identity/account-store.js';
+import { type StoreFactory } from '../node/stores.js';
+import type { DirectoryHandleLike } from '../storage/folder-adapter.js';
+/** Where accounts and their data are kept */
+export interface Place {
+    readonly kind: 'folder' | 'browser';
+    readonly store: AccountStore;
+    /** The folder, when there is one — for its name, and for opening stores */
+    readonly directory: DirectoryHandleLike | null;
+}
+/** What a pod holds, for deciding what to do before switching to it */
+export interface PodContents {
+    /** This account's copy in the pod, when it has one */
+    readonly account: AccountSummary | null;
+    /** Other accounts in the pod — never touched by a move */
+    readonly others: number;
+    /** It is the pod already in use */
+    readonly same: boolean;
+}
+/** Accounts kept in this browser. Always available; never shared with another site. */
+export declare function browserPlace(): Promise<Place>;
+/** Wraps a folder as a place. */
+export declare function folderPlace(directory: DirectoryHandleLike): Place;
+/**
+ * Asks for a pod without switching to it — so a signed-in person can be asked
+ * what should happen to their data first. Must be called from a click.
+ */
+export declare function pickPod(): Promise<Place>;
+/** Remembers a pod as the one this site opens next time. */
+export declare function rememberPod(pod: Place): Promise<void>;
+/**
+ * Re-opens the pod this site used last.
+ *
+ * @param request Whether to prompt for permission. Needs a click when true; use
+ *   false on page load to find out whether a button has to be shown.
+ * @returns The pod, or null when there is none or access was declined
+ */
+export declare function recallPod(request: boolean): Promise<Place | null>;
+/** Stops using the pod. Nothing in it is touched. */
+export declare function forgetPod(): Promise<void>;
+/** Every account in a place, most recently used first. */
+export declare function listAccounts(place: Place): Promise<ReadonlyArray<AccountSummary>>;
+/** What a pod holds of this account and others, and whether it is the one in use. */
+export declare function inspectPod(pod: Place, current: Place, did: string): Promise<PodContents>;
+/**
+ * The stores for one account.
+ *
+ * Paths are account-scoped either way, so two accounts in one browser never
+ * share a store, the same way two accounts in one folder never share a subtree.
+ * A pod's registry is sealed under the vault key, so someone who copies the
+ * folder cannot read the private spaces in it.
+ *
+ * @param account Whose data
+ * @param folder The unlocked pod and its vault key, when the account lives in one
+ */
+export declare function storesFor(account: AccountSummary, folder?: {
+    readonly directory: DirectoryHandleLike;
+    readonly vaultKey: CryptoKey;
+}): StoreFactory;
+/** Deletes the IndexedDB databases an account kept in this browser. */
+export declare function deleteBrowserData(account: AccountSummary): Promise<void>;
+//# sourceMappingURL=places.d.ts.map

package/dist/session/places.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"places.d.ts","sourceRoot":"","sources":["../../src/session/places.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAQjF,OAAO,EAAiC,KAAK,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACrF,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,8BAA8B,CAAC;AAExE,6CAA6C;AAC7C,MAAM,WAAW,KAAK;IACpB,QAAQ,CAAC,IAAI,EAAE,QAAQ,GAAG,SAAS,CAAC;IACpC,QAAQ,CAAC,KAAK,EAAE,YAAY,CAAC;IAC7B,2EAA2E;IAC3E,QAAQ,CAAC,SAAS,EAAE,mBAAmB,GAAG,IAAI,CAAC;CAChD;AAED,uEAAuE;AACvE,MAAM,WAAW,WAAW;IAC1B,sDAAsD;IACtD,QAAQ,CAAC,OAAO,EAAE,cAAc,GAAG,IAAI,CAAC;IACxC,0DAA0D;IAC1D,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,mCAAmC;IACnC,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;CACxB;AAED,uFAAuF;AACvF,wBAAsB,YAAY,IAAI,OAAO,CAAC,KAAK,CAAC,CAEnD;AAED,iCAAiC;AACjC,wBAAgB,WAAW,CAAC,SAAS,EAAE,mBAAmB,GAAG,KAAK,CAEjE;AAED;;;GAGG;AACH,wBAAsB,OAAO,IAAI,OAAO,CAAC,KAAK,CAAC,CAE9C;AAED,4DAA4D;AAC5D,wBAAsB,WAAW,CAAC,GAAG,EAAE,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,CAG3D;AAED;;;;;;GAMG;AACH,wBAAsB,SAAS,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,KAAK,GAAG,IAAI,CAAC,CAKvE;AAED,qDAAqD;AACrD,wBAAsB,SAAS,IAAI,OAAO,CAAC,IAAI,CAAC,CAE/C;AAED,0DAA0D;AAC1D,wBAAsB,YAAY,CAAC,KAAK,EAAE,KAAK,GAAG,OAAO,CAAC,aAAa,CAAC,cAAc,CAAC,CAAC,CAEvF;AAED,qFAAqF;AACrF,wBAAsB,UAAU,CAAC,GAAG,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,CAc9F;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,SAAS,CACvB,OAAO,EAAE,cAAc,EACvB,MAAM,CAAC,EAAE;IAAE,QAAQ,CAAC,SAAS,EAAE,mBAAmB,CAAC;IAAC,QAAQ,CAAC,QAAQ,EAAE,SAAS,CAAA;CAAE,GACjF,YAAY,CAId;AAED,uEAAuE;AACvE,wBAAsB,iBAAiB,CAAC,OAAO,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,CAe9E"}

package/dist/session/places.js

@@ -0,0 +1,101 @@
+/**
+ * @module session/places
+ * Where accounts and their data are kept: a pod, or this browser.
+ *
+ * Two questions a sign-in flow keeps apart:
+ *
+ * - **Where does my data live?** A folder you picked (a *pod*), or this
+ *   browser. That is a place.
+ * - **Who am I?** An account in that place. A place can hold several.
+ */
+import { createBrowserAccountStore, createFolderAccountStore, listFolderAccounts } from '../identity/account-store.js';
+import { forgetDataFolder, ensureFolderPermission, pickDataFolder, recallDataFolder, rememberDataFolder, } from '../storage/directory-access.js';
+import { folderStores, indexedDBStores } from '../node/stores.js';
+/** Accounts kept in this browser. Always available; never shared with another site. */
+export async function browserPlace() {
+    return { kind: 'browser', store: await createBrowserAccountStore(), directory: null };
+}
+/** Wraps a folder as a place. */
+export function folderPlace(directory) {
+    return { kind: 'folder', store: createFolderAccountStore(directory), directory };
+}
+/**
+ * Asks for a pod without switching to it — so a signed-in person can be asked
+ * what should happen to their data first. Must be called from a click.
+ */
+export async function pickPod() {
+    return folderPlace(await pickDataFolder({ id: 'weave-pod' }));
+}
+/** Remembers a pod as the one this site opens next time. */
+export async function rememberPod(pod) {
+    if (!pod.directory)
+        throw new Error('That is not a folder.');
+    await rememberDataFolder(pod.directory);
+}
+/**
+ * Re-opens the pod this site used last.
+ *
+ * @param request Whether to prompt for permission. Needs a click when true; use
+ *   false on page load to find out whether a button has to be shown.
+ * @returns The pod, or null when there is none or access was declined
+ */
+export async function recallPod(request) {
+    const directory = await recallDataFolder();
+    if (!directory)
+        return null;
+    if (!(await ensureFolderPermission(directory, { request })))
+        return null;
+    return folderPlace(directory);
+}
+/** Stops using the pod. Nothing in it is touched. */
+export async function forgetPod() {
+    await forgetDataFolder();
+}
+/** Every account in a place, most recently used first. */
+export async function listAccounts(place) {
+    return place.directory ? listFolderAccounts(place.directory, place.store) : place.store.list();
+}
+/** What a pod holds of this account and others, and whether it is the one in use. */
+export async function inspectPod(pod, current, did) {
+    const accounts = await listAccounts(pod);
+    const same = current.kind === 'folder' &&
+        !!current.directory &&
+        !!pod.directory &&
+        (await pod.directory
+            .isSameEntry?.(current.directory)
+            .catch(() => false)) === true;
+    return {
+        account: accounts.find((account) => account.did === did) ?? null,
+        others: accounts.filter((account) => account.did !== did).length,
+        same,
+    };
+}
+/**
+ * The stores for one account.
+ *
+ * Paths are account-scoped either way, so two accounts in one browser never
+ * share a store, the same way two accounts in one folder never share a subtree.
+ * A pod's registry is sealed under the vault key, so someone who copies the
+ * folder cannot read the private spaces in it.
+ *
+ * @param account Whose data
+ * @param folder The unlocked pod and its vault key, when the account lives in one
+ */
+export function storesFor(account, folder) {
+    return folder
+        ? folderStores(folder.directory, { basePath: account.dataPath, vaultKey: folder.vaultKey })
+        : indexedDBStores(`weave:${account.dataPath.replace(/\//g, ':')}`);
+}
+/** Deletes the IndexedDB databases an account kept in this browser. */
+export async function deleteBrowserData(account) {
+    const prefix = `weave:${account.dataPath.replace(/\//g, ':')}`;
+    const databases = (await globalThis.indexedDB.databases?.()) ?? [];
+    await Promise.all(databases
+        .map((db) => db.name)
+        .filter((name) => typeof name === 'string' && name.startsWith(prefix))
+        .map((name) => new Promise((resolve) => {
+        const request = globalThis.indexedDB.deleteDatabase(name);
+        request.onsuccess = request.onerror = request.onblocked = () => resolve();
+    })));
+}
+//# sourceMappingURL=places.js.map

package/dist/session/places.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"places.js","sourceRoot":"","sources":["../../src/session/places.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,EAAE,yBAAyB,EAAE,wBAAwB,EAAE,kBAAkB,EAAE,MAAM,8BAA8B,CAAC;AAEvH,OAAO,EACL,gBAAgB,EAChB,sBAAsB,EACtB,cAAc,EACd,gBAAgB,EAChB,kBAAkB,GACnB,MAAM,gCAAgC,CAAC;AACxC,OAAO,EAAE,YAAY,EAAE,eAAe,EAAqB,MAAM,mBAAmB,CAAC;AAqBrF,uFAAuF;AACvF,MAAM,CAAC,KAAK,UAAU,YAAY;IAChC,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,yBAAyB,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;AACxF,CAAC;AAED,iCAAiC;AACjC,MAAM,UAAU,WAAW,CAAC,SAA8B;IACxD,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,wBAAwB,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,CAAC;AACnF,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,OAAO;IAC3B,OAAO,WAAW,CAAC,MAAM,cAAc,CAAC,EAAE,EAAE,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC;AAChE,CAAC;AAED,4DAA4D;AAC5D,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,GAAU;IAC1C,IAAI,CAAC,GAAG,CAAC,SAAS;QAAE,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;IAC7D,MAAM,kBAAkB,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;AAC1C,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,OAAgB;IAC9C,MAAM,SAAS,GAAG,MAAM,gBAAgB,EAAE,CAAC;IAC3C,IAAI,CAAC,SAAS;QAAE,OAAO,IAAI,CAAC;IAC5B,IAAI,CAAC,CAAC,MAAM,sBAAsB,CAAC,SAAS,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACzE,OAAO,WAAW,CAAC,SAAS,CAAC,CAAC;AAChC,CAAC;AAED,qDAAqD;AACrD,MAAM,CAAC,KAAK,UAAU,SAAS;IAC7B,MAAM,gBAAgB,EAAE,CAAC;AAC3B,CAAC;AAED,0DAA0D;AAC1D,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,KAAY;IAC7C,OAAO,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,kBAAkB,CAAC,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;AACjG,CAAC;AAED,qFAAqF;AACrF,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,GAAU,EAAE,OAAc,EAAE,GAAW;IACtE,MAAM,QAAQ,GAAG,MAAM,YAAY,CAAC,GAAG,CAAC,CAAC;IACzC,MAAM,IAAI,GACR,OAAO,CAAC,IAAI,KAAK,QAAQ;QACzB,CAAC,CAAC,OAAO,CAAC,SAAS;QACnB,CAAC,CAAC,GAAG,CAAC,SAAS;QACf,CAAC,MAAO,GAAG,CAAC,SAAoE;aAC7E,WAAW,EAAE,CAAC,OAAO,CAAC,SAAS,CAAC;aAChC,KAAK,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC,KAAK,IAAI,CAAC;IAClC,OAAO;QACL,OAAO,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,KAAK,GAAG,CAAC,IAAI,IAAI;QAChE,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,KAAK,GAAG,CAAC,CAAC,MAAM;QAChE,IAAI;KACL,CAAC;AACJ,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,SAAS,CACvB,OAAuB,EACvB,MAAkF;IAElF,OAAO,MAAM;QACX,CAAC,CAAC,YAAY,CAAC,MAAM,CAAC,SAAS,EAAE,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC;QAC3F,CAAC,CAAC,eAAe,CAAC,SAAS,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;AACvE,CAAC;AAED,uEAAuE;AACvE,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,OAAuB;IAC7D,MAAM,MAAM,GAAG,SAAS,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,EAAE,CAAC;IAC/D,MAAM,SAAS,GAAG,CAAC,MAAM,UAAU,CAAC,SAAS,CAAC,SAAS,EAAE,EAAE,CAAC,IAAI,EAAE,CAAC;IACnE,MAAM,OAAO,CAAC,GAAG,CACf,SAAS;SACN,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC;SACpB,MAAM,CAAC,CAAC,IAAI,EAAkB,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;SACrF,GAAG,CACF,CAAC,IAAI,EAAE,EAAE,CACP,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE;QAC5B,MAAM,OAAO,GAAG,UAAU,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC;QAC1D,OAAO,CAAC,SAAS,GAAG,OAAO,CAAC,OAAO,GAAG,OAAO,CAAC,SAAS,GAAG,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC;IAC5E,CAAC,CAAC,CACL,CACJ,CAAC;AACJ,CAAC"}

package/dist/session/stay-signed-in.d.ts

@@ -0,0 +1,37 @@
+/** How long an unused device stays signed in */
+export type StaySignedIn = 'never' | '1d' | '7d' | '30d';
+export declare const STAY_SIGNED_IN_CHOICES: ReadonlyArray<{
+    value: StaySignedIn;
+    label: string;
+}>;
+export declare const DEFAULT_STAY_SIGNED_IN: StaySignedIn;
+/** The little of `localStorage` this needs — swappable, for tests and for other hosts */
+export interface KeyValueStore {
+    getItem(key: string): string | null;
+    setItem(key: string, value: string): void;
+    removeItem(key: string): void;
+}
+export interface StaySignedInStore {
+    /** The chosen length */
+    choice(): StaySignedIn;
+    /** Changes it. "Ask every time" forgets the current one straight away; a new length applies from now. */
+    setChoice(choice: StaySignedIn): Promise<void>;
+    /** Keeps the seed on this device after an unlock, when the choice allows it */
+    remember(accountId: string, place: 'browser' | 'folder', seed: Uint8Array): Promise<void>;
+    /** The seed this device kept, if still in date and for the kind of place that is open. Using it pushes the expiry forward. */
+    recall(place: 'browser' | 'folder'): Promise<{
+        accountId: string;
+        seed: Uint8Array;
+    } | null>;
+    /** When the kept sign-in runs out, or null when there is none */
+    until(): Date | null;
+    /** Deletes the kept key: the next visit asks to unlock */
+    forget(): Promise<void>;
+}
+/**
+ * @param storage Where the setting and the wrapped seed are kept
+ * @param rpId The site the device key belongs to
+ * @param prefix Namespaces the keys, so two apps on one origin do not share a sign-in
+ */
+export declare function createStaySignedIn(storage: KeyValueStore | null, rpId: string, prefix?: string): StaySignedInStore;
+//# sourceMappingURL=stay-signed-in.d.ts.map

package/dist/session/stay-signed-in.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"stay-signed-in.d.ts","sourceRoot":"","sources":["../../src/session/stay-signed-in.ts"],"names":[],"mappings":"AAwBA,gDAAgD;AAChD,MAAM,MAAM,YAAY,GAAG,OAAO,GAAG,IAAI,GAAG,IAAI,GAAG,KAAK,CAAC;AAEzD,eAAO,MAAM,sBAAsB,EAAE,aAAa,CAAC;IAAE,KAAK,EAAE,YAAY,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAKxF,CAAC;AAEF,eAAO,MAAM,sBAAsB,EAAE,YAAmB,CAAC;AAKzD,yFAAyF;AACzF,MAAM,WAAW,aAAa;IAC5B,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAC;IACpC,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1C,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;CAC/B;AAWD,MAAM,WAAW,iBAAiB;IAChC,wBAAwB;IACxB,MAAM,IAAI,YAAY,CAAC;IACvB,yGAAyG;IACzG,SAAS,CAAC,MAAM,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/C,+EAA+E;IAC/E,QAAQ,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,GAAG,QAAQ,EAAE,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1F,8HAA8H;IAC9H,MAAM,CAAC,KAAK,EAAE,SAAS,GAAG,QAAQ,GAAG,OAAO,CAAC;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,UAAU,CAAA;KAAE,GAAG,IAAI,CAAC,CAAC;IAC7F,iEAAiE;IACjE,KAAK,IAAI,IAAI,GAAG,IAAI,CAAC;IACrB,0DAA0D;IAC1D,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACzB;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,aAAa,GAAG,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,SAAU,GAAG,iBAAiB,CAiFnH"}

package/dist/session/stay-signed-in.js

@@ -0,0 +1,124 @@
+/**
+ * @module session/stay-signed-in
+ * Staying signed in on this device, so a refresh does not ask to unlock again.
+ *
+ * The seed is encrypted under a device key: a random key the browser keeps in
+ * this site's storage and will use for this page but never hand out as bytes
+ * (it is created non-extractable). The same thing a passkey shortcut does,
+ * minus the fingerprint — which is exactly the convenience asked for, and
+ * exactly the cost:
+ *
+ * - Someone who copies this site's stored data somewhere else gets ciphertext
+ *   and no key to open it.
+ * - Someone at this computer, in this browser profile, is signed in. So is any
+ *   script running in this page. That is what "stay signed in" means anywhere.
+ *
+ * So it expires: after a chosen time without being used, the key is deleted
+ * and the next visit asks to unlock. Signing out deletes it at once.
+ *
+ * Kept in this browser only, never in a pod — a pod is meant to be copied and
+ * synced, and "this device may skip the password" must not travel with it.
+ */
+import { createDeviceKey, deleteDeviceKey, getDeviceKey } from '../identity/device-key.js';
+import { unwrapSeedWithDeviceKey, wrapSeedWithDeviceKey } from '../identity/account-vault.js';
+export const STAY_SIGNED_IN_CHOICES = [
+    { value: 'never', label: 'Ask every time' },
+    { value: '1d', label: '1 day' },
+    { value: '7d', label: '7 days' },
+    { value: '30d', label: '30 days' },
+];
+export const DEFAULT_STAY_SIGNED_IN = '7d';
+const DAY = 24 * 60 * 60 * 1000;
+const DURATION = { never: 0, '1d': DAY, '7d': 7 * DAY, '30d': 30 * DAY };
+/**
+ * @param storage Where the setting and the wrapped seed are kept
+ * @param rpId The site the device key belongs to
+ * @param prefix Namespaces the keys, so two apps on one origin do not share a sign-in
+ */
+export function createStaySignedIn(storage, rpId, prefix = 'weave') {
+    const SETTING = `${prefix}.stay-signed-in`;
+    const RECORD = `${prefix}.remembered-session`;
+    const read = (key) => {
+        try {
+            const raw = storage?.getItem(key);
+            return raw ? JSON.parse(raw) : null;
+        }
+        catch {
+            return null;
+        }
+    };
+    const write = (key, value) => {
+        try {
+            if (value === null)
+                storage?.removeItem(key);
+            else
+                storage?.setItem(key, JSON.stringify(value));
+        }
+        catch {
+            /* private mode: it will ask again next time, which is safe */
+        }
+    };
+    const choice = () => {
+        const chosen = read(SETTING);
+        return chosen && chosen in DURATION ? chosen : DEFAULT_STAY_SIGNED_IN;
+    };
+    const forget = async () => {
+        const current = read(RECORD);
+        write(RECORD, null);
+        if (current)
+            await deleteDeviceKey(current.wrap.deviceKeyId).catch(() => { });
+    };
+    return {
+        choice,
+        forget,
+        async setChoice(next) {
+            write(SETTING, next);
+            const current = read(RECORD);
+            if (!current)
+                return;
+            if (next === 'never')
+                await forget();
+            else
+                write(RECORD, { ...current, expiresAt: Date.now() + DURATION[next] });
+        },
+        async remember(accountId, place, seed) {
+            await forget();
+            const chosen = choice();
+            if (chosen === 'never')
+                return;
+            const deviceKey = await createDeviceKey();
+            const wrap = await wrapSeedWithDeviceKey(seed, deviceKey, { rpId, label: 'stay signed in' });
+            write(RECORD, { accountId, place, wrap, expiresAt: Date.now() + DURATION[chosen] });
+        },
+        async recall(place) {
+            const current = read(RECORD);
+            if (!current)
+                return null;
+            if (current.expiresAt < Date.now()) {
+                await forget();
+                return null;
+            }
+            if (current.place !== place)
+                return null;
+            const key = await getDeviceKey(current.wrap.deviceKeyId);
+            if (!key) {
+                write(RECORD, null);
+                return null;
+            }
+            try {
+                const seed = await unwrapSeedWithDeviceKey(current.wrap, key);
+                write(RECORD, { ...current, expiresAt: Date.now() + DURATION[choice()] });
+                return { accountId: current.accountId, seed };
+            }
+            catch {
+                await forget();
+                return null;
+            }
+        },
+        until() {
+            const current = read(RECORD);
+            return current && current.expiresAt > Date.now() ? new Date(current.expiresAt) : null;
+        },
+    };
+}
+//# sourceMappingURL=stay-signed-in.js.map

package/dist/session/stay-signed-in.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"stay-signed-in.js","sourceRoot":"","sources":["../../src/session/stay-signed-in.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,OAAO,EAAE,eAAe,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AAC3F,OAAO,EAAE,uBAAuB,EAAE,qBAAqB,EAAmB,MAAM,8BAA8B,CAAC;AAK/G,MAAM,CAAC,MAAM,sBAAsB,GAA0D;IAC3F,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,gBAAgB,EAAE;IAC3C,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE;IAC/B,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE;IAChC,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE;CACnC,CAAC;AAEF,MAAM,CAAC,MAAM,sBAAsB,GAAiB,IAAI,CAAC;AAEzD,MAAM,GAAG,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAChC,MAAM,QAAQ,GAAiC,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,GAAG,GAAG,EAAE,KAAK,EAAE,EAAE,GAAG,GAAG,EAAE,CAAC;AAiCvG;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAAC,OAA6B,EAAE,IAAY,EAAE,MAAM,GAAG,OAAO;IAC9F,MAAM,OAAO,GAAG,GAAG,MAAM,iBAAiB,CAAC;IAC3C,MAAM,MAAM,GAAG,GAAG,MAAM,qBAAqB,CAAC;IAE9C,MAAM,IAAI,GAAG,CAAI,GAAW,EAAY,EAAE;QACxC,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC;YAClC,OAAO,GAAG,CAAC,CAAC,CAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAO,CAAC,CAAC,CAAC,IAAI,CAAC;QAC7C,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC,CAAC;IACF,MAAM,KAAK,GAAG,CAAC,GAAW,EAAE,KAAc,EAAQ,EAAE;QAClD,IAAI,CAAC;YACH,IAAI,KAAK,KAAK,IAAI;gBAAE,OAAO,EAAE,UAAU,CAAC,GAAG,CAAC,CAAC;;gBACxC,OAAO,EAAE,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC;QACpD,CAAC;QAAC,MAAM,CAAC;YACP,8DAA8D;QAChE,CAAC;IACH,CAAC,CAAC;IAEF,MAAM,MAAM,GAAG,GAAiB,EAAE;QAChC,MAAM,MAAM,GAAG,IAAI,CAAe,OAAO,CAAC,CAAC;QAC3C,OAAO,MAAM,IAAI,MAAM,IAAI,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,sBAAsB,CAAC;IACxE,CAAC,CAAC;IAEF,MAAM,MAAM,GAAG,KAAK,IAAmB,EAAE;QACvC,MAAM,OAAO,GAAG,IAAI,CAAa,MAAM,CAAC,CAAC;QACzC,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QACpB,IAAI,OAAO;YAAE,MAAM,eAAe,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IAC/E,CAAC,CAAC;IAEF,OAAO;QACL,MAAM;QACN,MAAM;QAEN,KAAK,CAAC,SAAS,CAAC,IAAI;YAClB,KAAK,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;YACrB,MAAM,OAAO,GAAG,IAAI,CAAa,MAAM,CAAC,CAAC;YACzC,IAAI,CAAC,OAAO;gBAAE,OAAO;YACrB,IAAI,IAAI,KAAK,OAAO;gBAAE,MAAM,MAAM,EAAE,CAAC;;gBAChC,KAAK,CAAC,MAAM,EAAE,EAAE,GAAG,OAAO,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC7E,CAAC;QAED,KAAK,CAAC,QAAQ,CAAC,SAAS,EAAE,KAAK,EAAE,IAAI;YACnC,MAAM,MAAM,EAAE,CAAC;YACf,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC;YACxB,IAAI,MAAM,KAAK,OAAO;gBAAE,OAAO;YAC/B,MAAM,SAAS,GAAG,MAAM,eAAe,EAAE,CAAC;YAC1C,MAAM,IAAI,GAAG,MAAM,qBAAqB,CAAC,IAAI,EAAE,SAAS,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC,CAAC;YAC7F,KAAK,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,CAAC,MAAM,CAAC,EAAuB,CAAC,CAAC;QAC3G,CAAC;QAED,KAAK,CAAC,MAAM,CAAC,KAAK;YAChB,MAAM,OAAO,GAAG,IAAI,CAAa,MAAM,CAAC,CAAC;YACzC,IAAI,CAAC,OAAO;gBAAE,OAAO,IAAI,CAAC;YAC1B,IAAI,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;gBACnC,MAAM,MAAM,EAAE,CAAC;gBACf,OAAO,IAAI,CAAC;YACd,CAAC;YACD,IAAI,OAAO,CAAC,KAAK,KAAK,KAAK;gBAAE,OAAO,IAAI,CAAC;YACzC,MAAM,GAAG,GAAG,MAAM,YAAY,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;YACzD,IAAI,CAAC,GAAG,EAAE,CAAC;gBACT,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;gBACpB,OAAO,IAAI,CAAC;YACd,CAAC;YACD,IAAI,CAAC;gBACH,MAAM,IAAI,GAAG,MAAM,uBAAuB,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;gBAC9D,KAAK,CAAC,MAAM,EAAE,EAAE,GAAG,OAAO,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC;gBAC1E,OAAO,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,IAAI,EAAE,CAAC;YAChD,CAAC;YAAC,MAAM,CAAC;gBACP,MAAM,MAAM,EAAE,CAAC;gBACf,OAAO,IAAI,CAAC;YACd,CAAC;QACH,CAAC;QAED,KAAK;YACH,MAAM,OAAO,GAAG,IAAI,CAAa,MAAM,CAAC,CAAC;YACzC,OAAO,OAAO,IAAI,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QACxF,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/space/account-registry.d.ts

@@ -0,0 +1,64 @@
+/**
+ * @module account-registry
+ * The account's own list of spaces, kept in a space.
+ *
+ * Without it, which spaces an account belongs to lives on each device alone: a
+ * new phone, a new app or an always-on node has to be handed every invite. With
+ * it, joining a space on one device writes a membership record into a private
+ * space only the account can find, and every other device and node of the
+ * account syncs that record and joins by itself.
+ *
+ * The registry's key and nonce are derived from the account's vault key, and
+ * its id is the hash of its genesis like any space's — so nothing needs to be
+ * exchanged to find it, and nobody without the account can. The DID alone is
+ * not enough: it appears in everything the account signs, and a room named
+ * after it could be found by anyone who had seen its data.
+ */
+import type { CryptoProvider } from '../types.js';
+import type { SpaceRecord } from './space-manager.js';
+/**
+ * Where the account's list of spaces lives, one record per space it follows.
+ * Not to be confused with `sys.member`, a space's own record of who holds
+ * which role there.
+ */
+export declare const MEMBERSHIP_COLLECTION = "sys.joined";
+/**
+ * The account's profile — what it is called — so a rename on one device or app
+ * reaches the others. The newest record wins.
+ */
+export declare const PROFILE_COLLECTION = "sys.profile";
+/** The profile's record key — there is one profile per account */
+export declare const PROFILE_KEY = "profile";
+export interface AccountProfile {
+    readonly name: string;
+}
+/** A membership record's body. The invite carries a private space's key — the registry is encrypted. */
+export interface Membership {
+    readonly space: string;
+    readonly invite: string;
+}
+/**
+ * Carriers the account uses — a browser extension keeping its spaces online,
+ * say — one record each, key `carrier:<carry space id hash>`. Every device of
+ * the account reads them and keeps each carrier's passes current (`space/pass.ts`).
+ */
+export declare const CARRIER_COLLECTION = "sys.carrier";
+/** A carrier record's body */
+export interface Carrier {
+    /** The carry space shared with it */
+    readonly space: string;
+    /** A view-only invite to the carry space — how other devices of the account open it */
+    readonly invite: string;
+    /** The carrier's own key, as it appears to peers */
+    readonly did: string;
+    /** What it called itself */
+    readonly name: string;
+    readonly since: string;
+}
+/**
+ * The account's registry space, derived — the same on every device.
+ * @param accountKey The account's vault key bytes (`deriveVaultKeyBytes(seed)`)
+ * @param owner The account's DID
+ */
+export declare function deriveAccountRegistry(accountKey: Uint8Array, owner: string, provider?: CryptoProvider): Promise<SpaceRecord>;
+//# sourceMappingURL=account-registry.d.ts.map

package/dist/space/account-registry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"account-registry.d.ts","sourceRoot":"","sources":["../../src/space/account-registry.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,KAAK,EAAE,cAAc,EAAS,MAAM,aAAa,CAAC;AACzD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAQtD;;;;GAIG;AACH,eAAO,MAAM,qBAAqB,eAAe,CAAC;AAElD;;;GAGG;AACH,eAAO,MAAM,kBAAkB,gBAAgB,CAAC;AAEhD,kEAAkE;AAClE,eAAO,MAAM,WAAW,YAAY,CAAC;AAErC,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAED,wGAAwG;AACxG,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED;;;;GAIG;AACH,eAAO,MAAM,kBAAkB,gBAAgB,CAAC;AAEhD,8BAA8B;AAC9B,MAAM,WAAW,OAAO;IACtB,qCAAqC;IACrC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,uFAAuF;IACvF,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,oDAAoD;IACpD,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,4BAA4B;IAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB;AAYD;;;;GAIG;AACH,wBAAsB,qBAAqB,CACzC,UAAU,EAAE,UAAU,EACtB,KAAK,EAAE,MAAM,EACb,QAAQ,GAAE,cAAqC,GAC9C,OAAO,CAAC,WAAW,CAAC,CA8BtB"}

package/dist/space/account-registry.js

@@ -0,0 +1,66 @@
+import { base64UrlEncode, utf8Encode } from '../utils/encoding.js';
+import { sha256 } from '../utils/hash.js';
+import { createP256Provider } from '../identity/crypto-p256.js';
+import { deriveReadKey, spaceGenesis, spaceIdOf } from './space-access.js';
+import { solo } from './presets.js';
+/**
+ * Where the account's list of spaces lives, one record per space it follows.
+ * Not to be confused with `sys.member`, a space's own record of who holds
+ * which role there.
+ */
+export const MEMBERSHIP_COLLECTION = 'sys.joined';
+/**
+ * The account's profile — what it is called — so a rename on one device or app
+ * reaches the others. The newest record wins.
+ */
+export const PROFILE_COLLECTION = 'sys.profile';
+/** The profile's record key — there is one profile per account */
+export const PROFILE_KEY = 'profile';
+/**
+ * Carriers the account uses — a browser extension keeping its spaces online,
+ * say — one record each, key `carrier:<carry space id hash>`. Every device of
+ * the account reads them and keeps each carrier's passes current (`space/pass.ts`).
+ */
+export const CARRIER_COLLECTION = 'sys.carrier';
+async function expand(accountKey, info) {
+    const material = await globalThis.crypto.subtle.importKey('raw', accountKey, 'HKDF', false, ['deriveBits']);
+    const bits = await globalThis.crypto.subtle.deriveBits({ name: 'HKDF', hash: 'SHA-256', salt: new Uint8Array(0), info: utf8Encode(info) }, material, 256);
+    return new Uint8Array(bits);
+}
+/**
+ * The account's registry space, derived — the same on every device.
+ * @param accountKey The account's vault key bytes (`deriveVaultKeyBytes(seed)`)
+ * @param owner The account's DID
+ */
+export async function deriveAccountRegistry(accountKey, owner, provider = createP256Provider()) {
+    const nonce = base64UrlEncode((await expand(accountKey, 'weave/account-registry/nonce/v1')).subarray(0, 12));
+    const keyBytes = await expand(accountKey, 'weave/account-registry/key/v1');
+    const cryptoKey = await globalThis.crypto.subtle.importKey('raw', keyBytes, { name: 'AES-GCM', length: 256 }, true, [
+        'encrypt',
+        'decrypt',
+    ]);
+    const createdAt = new Date(0).toISOString(); // fixed, so every device derives the same record
+    const key = Object.freeze({
+        id: base64UrlEncode(await sha256(keyBytes)),
+        key: cryptoKey,
+        createdAt,
+        version: 1,
+    });
+    const fixed = {
+        visibility: 'private',
+        creator: owner,
+        roles: solo.roles,
+        creatorRole: solo.creatorRole,
+        createdAt,
+        nonce,
+        readKey: (await deriveReadKey(key, provider)).did,
+        encryptionKeyId: key.id,
+    };
+    const space = Object.freeze({
+        id: await spaceIdOf(spaceGenesis(fixed)),
+        ...fixed,
+        name: 'Account registry',
+    });
+    return { space, key, invite: null, role: solo.creatorRole };
+}
+//# sourceMappingURL=account-registry.js.map

package/dist/space/account-registry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"account-registry.js","sourceRoot":"","sources":["../../src/space/account-registry.ts"],"names":[],"mappings":"AAmBA,OAAO,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AACnE,OAAO,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAC1C,OAAO,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAChE,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAC3E,OAAO,EAAE,IAAI,EAAE,MAAM,cAAc,CAAC;AAEpC;;;;GAIG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,YAAY,CAAC;AAElD;;;GAGG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,aAAa,CAAC;AAEhD,kEAAkE;AAClE,MAAM,CAAC,MAAM,WAAW,GAAG,SAAS,CAAC;AAYrC;;;;GAIG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,aAAa,CAAC;AAehD,KAAK,UAAU,MAAM,CAAC,UAAsB,EAAE,IAAY;IACxD,MAAM,QAAQ,GAAG,MAAM,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,UAA0B,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC;IAC5H,MAAM,IAAI,GAAG,MAAM,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,UAAU,CACpD,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,UAAU,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,UAAU,CAAC,IAAI,CAAiB,EAAE,EAClG,QAAQ,EACR,GAAG,CACJ,CAAC;IACF,OAAO,IAAI,UAAU,CAAC,IAAI,CAAC,CAAC;AAC9B,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,UAAsB,EACtB,KAAa,EACb,WAA2B,kBAAkB,EAAE;IAE/C,MAAM,KAAK,GAAG,eAAe,CAAC,CAAC,MAAM,MAAM,CAAC,UAAU,EAAE,iCAAiC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;IAC7G,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,UAAU,EAAE,+BAA+B,CAAC,CAAC;IAC3E,MAAM,SAAS,GAAG,MAAM,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,QAAwB,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE;QAClI,SAAS;QACT,SAAS;KACV,CAAC,CAAC;IACH,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,iDAAiD;IAC9F,MAAM,GAAG,GAAa,MAAM,CAAC,MAAM,CAAC;QAClC,EAAE,EAAE,eAAe,CAAC,MAAM,MAAM,CAAC,QAAQ,CAAC,CAAC;QAC3C,GAAG,EAAE,SAAS;QACd,SAAS;QACT,OAAO,EAAE,CAAC;KACX,CAAC,CAAC;IACH,MAAM,KAAK,GAAG;QACZ,UAAU,EAAE,SAAkB;QAC9B,OAAO,EAAE,KAAK;QACd,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,SAAS;QACT,KAAK;QACL,OAAO,EAAE,CAAC,MAAM,aAAa,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,CAAC,GAAG;QACjD,eAAe,EAAE,GAAG,CAAC,EAAE;KACxB,CAAC;IACF,MAAM,KAAK,GAAU,MAAM,CAAC,MAAM,CAAC;QACjC,EAAE,EAAE,MAAM,SAAS,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC;QACxC,GAAG,KAAK;QACR,IAAI,EAAE,kBAAkB;KACzB,CAAC,CAAC;IACH,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC;AAC9D,CAAC"}

package/dist/space/index.d.ts

@@ -0,0 +1,3 @@
+export * from './space-manager.js';
+export * from './pass.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/space/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/space/index.ts"],"names":[],"mappings":"AAAA,cAAc,oBAAoB,CAAC;AACnC,cAAc,WAAW,CAAC"}

package/dist/space/index.js

@@ -0,0 +1,3 @@
+export * from './space-manager.js';
+export * from './pass.js';
+//# sourceMappingURL=index.js.map

package/dist/space/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/space/index.ts"],"names":[],"mappings":"AAAA,cAAc,oBAAoB,CAAC;AACnC,cAAc,WAAW,CAAC"}

package/dist/space/pass.d.ts

@@ -0,0 +1,63 @@
+/**
+ * @module space/pass
+ * What a node needs to carry a space it cannot read.
+ *
+ * A carrier — a browser extension keeping your spaces online, later a host —
+ * stores a space's records, checks them the way every peer does, and passes
+ * them on. For that it needs two things, and must get nothing more:
+ *
+ * - **the space itself** (its genesis), which hashes to its id, so the carrier
+ *   runs the same gates as any member;
+ * - **in a private space, the read key pair's seed**, because every peer must
+ *   prove it may read before anything moves (`network/peer-auth.ts`). The read
+ *   key only signs that proof. It is derived one way from the space key and
+ *   decrypts nothing.
+ *
+ * No space key, no write secret, no note. A stolen pass lets someone download
+ * the space's encrypted records and their outer details — author, collection,
+ * times — which is what a blind host or a mirror's provider sees anyway.
+ *
+ * Passes travel in a **carry space**: a private space the account shares with
+ * one carrier, holding one pass record per space it should carry. Every node
+ * holding the account key keeps those records in step with the account's
+ * spaces (`node.ts`), so a space made in an app is carried without the home
+ * being opened.
+ */
+import type { CryptoProvider, Space } from '../types.js';
+import type { SpaceRecord } from './space-manager.js';
+import { type SpaceKeyPair } from './space-access.js';
+/** Where passes live in a carry space */
+export declare const PASS_COLLECTION = "sys.pass";
+/**
+ * Written into a carry space when the account stops using the carrier. A
+ * carrier that reads it forgets everything it held.
+ */
+export declare const CARRY_CLOSED_KEY = "carry:closed";
+/** A pass, as stored */
+export interface SpacePass {
+    readonly v: 1;
+    readonly space: Space;
+    /** A private space's read key seed, base64url. Absent for a public space. */
+    readonly read?: string;
+}
+/** A pass, checked and ready to open a space with */
+export interface OpenedPass {
+    readonly space: Space;
+    readonly read: SpaceKeyPair | null;
+}
+/** The record key of a space's pass */
+export declare function passKey(spaceId: string): Promise<string>;
+/**
+ * A pass for a space this node holds with its key.
+ * @throws For a private space held without its key: there is nothing to pass on
+ */
+export declare function makePass(record: SpaceRecord): Promise<SpacePass>;
+/**
+ * Checks a pass someone handed over: the space must hash to its id, and the
+ * read key must be the one the space names.
+ * @returns The space and its read key pair, or null when the pass does not check out
+ */
+export declare function openPass(value: unknown, provider: CryptoProvider): Promise<OpenedPass | null>;
+/** A record for opening a space from a pass: no key, no invite, no role */
+export declare function carriedRecord(pass: OpenedPass): SpaceRecord;
+//# sourceMappingURL=pass.d.ts.map

package/dist/space/pass.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pass.d.ts","sourceRoot":"","sources":["../../src/space/pass.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,OAAO,KAAK,EAAE,cAAc,EAAE,KAAK,EAAE,MAAM,aAAa,CAAC;AACzD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACtD,OAAO,EAA+C,KAAK,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAInG,yCAAyC;AACzC,eAAO,MAAM,eAAe,aAAa,CAAC;AAE1C;;;GAGG;AACH,eAAO,MAAM,gBAAgB,iBAAiB,CAAC;AAE/C,wBAAwB;AACxB,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,CAAC,EAAE,CAAC,CAAC;IACd,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC;IACtB,6EAA6E;IAC7E,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,qDAAqD;AACrD,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,YAAY,GAAG,IAAI,CAAC;CACpC;AAED,uCAAuC;AACvC,wBAAsB,OAAO,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAG9D;AAED;;;GAGG;AACH,wBAAsB,QAAQ,CAAC,MAAM,EAAE,WAAW,GAAG,OAAO,CAAC,SAAS,CAAC,CAItE;AAED;;;;GAIG;AACH,wBAAsB,QAAQ,CAAC,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,cAAc,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CAYnG;AAED,2EAA2E;AAC3E,wBAAgB,aAAa,CAAC,IAAI,EAAE,UAAU,GAAG,WAAW,CAE3D"}

package/dist/space/pass.js

@@ -0,0 +1,54 @@
+import { checkSpace, deriveReadSeed, readKeyFromSeed } from './space-access.js';
+import { base64UrlDecode, base64UrlEncode, utf8Encode } from '../utils/encoding.js';
+import { sha256 } from '../utils/hash.js';
+/** Where passes live in a carry space */
+export const PASS_COLLECTION = 'sys.pass';
+/**
+ * Written into a carry space when the account stops using the carrier. A
+ * carrier that reads it forgets everything it held.
+ */
+export const CARRY_CLOSED_KEY = 'carry:closed';
+/** The record key of a space's pass */
+export async function passKey(spaceId) {
+    const digest = await sha256(utf8Encode(spaceId));
+    return `pass:${Array.from(digest.subarray(0, 20), (b) => b.toString(16).padStart(2, '0')).join('')}`;
+}
+/**
+ * A pass for a space this node holds with its key.
+ * @throws For a private space held without its key: there is nothing to pass on
+ */
+export async function makePass(record) {
+    if (record.space.visibility === 'public')
+        return { v: 1, space: record.space };
+    if (!record.key)
+        throw new Error(`"${record.space.name}" is held here without its key, so it cannot be passed on`);
+    return { v: 1, space: record.space, read: base64UrlEncode(await deriveReadSeed(record.key)) };
+}
+/**
+ * Checks a pass someone handed over: the space must hash to its id, and the
+ * read key must be the one the space names.
+ * @returns The space and its read key pair, or null when the pass does not check out
+ */
+export async function openPass(value, provider) {
+    const pass = value;
+    if (!pass || pass.v !== 1 || !pass.space)
+        return null;
+    if ((await checkSpace(pass.space)) !== null)
+        return null;
+    if (pass.space.visibility === 'public')
+        return { space: pass.space, read: null };
+    if (typeof pass.read !== 'string')
+        return null;
+    try {
+        const read = await readKeyFromSeed(base64UrlDecode(pass.read), provider);
+        return read.did === pass.space.readKey ? { space: pass.space, read } : null;
+    }
+    catch {
+        return null;
+    }
+}
+/** A record for opening a space from a pass: no key, no invite, no role */
+export function carriedRecord(pass) {
+    return { space: pass.space, key: null, invite: null, role: null, read: pass.read };
+}
+//# sourceMappingURL=pass.js.map

package/dist/space/pass.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pass.js","sourceRoot":"","sources":["../../src/space/pass.ts"],"names":[],"mappings":"AA2BA,OAAO,EAAE,UAAU,EAAE,cAAc,EAAE,eAAe,EAAqB,MAAM,mBAAmB,CAAC;AACnG,OAAO,EAAE,eAAe,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AACpF,OAAO,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAE1C,yCAAyC;AACzC,MAAM,CAAC,MAAM,eAAe,GAAG,UAAU,CAAC;AAE1C;;;GAGG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,cAAc,CAAC;AAgB/C,uCAAuC;AACvC,MAAM,CAAC,KAAK,UAAU,OAAO,CAAC,OAAe;IAC3C,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC;IACjD,OAAO,QAAQ,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC;AACvG,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,MAAmB;IAChD,IAAI,MAAM,CAAC,KAAK,CAAC,UAAU,KAAK,QAAQ;QAAE,OAAO,EAAE,CAAC,EAAE,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC;IAC/E,IAAI,CAAC,MAAM,CAAC,GAAG;QAAE,MAAM,IAAI,KAAK,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,2DAA2D,CAAC,CAAC;IACnH,OAAO,EAAE,CAAC,EAAE,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,eAAe,CAAC,MAAM,cAAc,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;AAChG,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,KAAc,EAAE,QAAwB;IACrE,MAAM,IAAI,GAAG,KAAkC,CAAC;IAChD,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACtD,IAAI,CAAC,MAAM,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IACzD,IAAI,IAAI,CAAC,KAAK,CAAC,UAAU,KAAK,QAAQ;QAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IACjF,IAAI,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC/C,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,eAAe,CAAC,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,QAAQ,CAAC,CAAC;QACzE,OAAO,IAAI,CAAC,GAAG,KAAK,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IAC9E,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,2EAA2E;AAC3E,MAAM,UAAU,aAAa,CAAC,IAAgB;IAC5C,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC;AACrF,CAAC"}