@weaveprotocol/core 0.1.0

package/dist/identity/webauthn.js

@@ -0,0 +1,155 @@
+import { base64UrlEncode, base64UrlDecode } from '../utils/encoding.js';
+import { protocolError } from '../utils/errors.js';
+const PRF_SALT = new TextEncoder().encode('weave-protocol-key-v1');
+/**
+ * Whether this device has a built-in authenticator — Touch ID, Windows Hello.
+ *
+ * Worth knowing before asking for one: `attachment: 'platform'` is a filter
+ * rather than a preference, so requesting it on a machine that has none fails
+ * outright instead of falling back.
+ *
+ * @returns Whether a platform authenticator can be used here
+ */
+export async function hasPlatformAuthenticator() {
+    try {
+        return ((await globalThis.PublicKeyCredential?.isUserVerifyingPlatformAuthenticatorAvailable?.()) ??
+            false);
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Registers a new passkey with PRF extension.
+ * @param {PasskeyOptions} options Registration options.
+ * @returns {Promise<PasskeyRegistration>} Registration result.
+ */
+export async function registerPasskey(options) {
+    if (!globalThis.navigator?.credentials) {
+        throw protocolError('WEBAUTHN_UNAVAILABLE', 'WebAuthn is not supported in this environment.');
+    }
+    const userId = options.userId || globalThis.crypto.getRandomValues(new Uint8Array(32));
+    const createOptions = {
+        rp: { id: options.rpId, name: options.rpName },
+        user: {
+            id: userId,
+            name: options.userName,
+            displayName: options.userName,
+        },
+        challenge: globalThis.crypto.getRandomValues(new Uint8Array(32)),
+        pubKeyCredParams: [
+            { type: 'public-key', alg: -7 }, // ES256
+            { type: 'public-key', alg: -257 } // RS256
+        ],
+        authenticatorSelection: {
+            // Discoverable ("resident") so the passkey can be found again on a later
+            // visit without the app having to remember anything about the user.
+            residentKey: 'required',
+            requireResidentKey: true,
+            userVerification: 'required',
+            ...(options.attachment ? { authenticatorAttachment: options.attachment } : {})
+        },
+        ...(options.hints ? { hints: options.hints } : {}),
+        extensions: {
+            prf: {
+                eval: {
+                    first: PRF_SALT
+                }
+            }
+        } // PRF might not be in standard TS types yet
+    };
+    const credential = (await globalThis.navigator.credentials.create({
+        publicKey: createOptions
+    }));
+    if (!credential) {
+        throw new Error('Failed to create passkey.');
+    }
+    const response = credential.response;
+    const extensions = credential.getClientExtensionResults();
+    const prf = extensions.prf;
+    const prfDeclared = prf?.results?.first ? true : prf?.enabled;
+    // Newer authenticators return the PRF output from the creation ceremony itself,
+    // which saves the user a second prompt.
+    const prfOutputBuffer = prf?.results?.first;
+    const rawId = new Uint8Array(credential.rawId);
+    return Object.freeze({
+        credentialId: base64UrlEncode(rawId),
+        userHandle: base64UrlEncode(userId),
+        publicKey: new Uint8Array(response.getPublicKey?.() || new ArrayBuffer(0)),
+        prfDeclared,
+        prfOutput: prfOutputBuffer ? new Uint8Array(prfOutputBuffer) : null
+    });
+}
+/**
+ * Asks the passkey provider to show a passkey under a new name.
+ *
+ * A site cannot edit a password manager, so after an account is renamed its
+ * passkey would keep the old label and look like a different account. The
+ * WebAuthn Signal API lets a site *ask*; the provider decides. Where the
+ * browser does not have it, this does nothing.
+ *
+ * @returns Whether the browser accepted the request — not whether the provider acted on it
+ */
+export async function renamePasskey(params) {
+    const signal = globalThis.PublicKeyCredential?.signalCurrentUserDetails;
+    if (typeof signal !== 'function')
+        return false;
+    try {
+        await signal.call(globalThis.PublicKeyCredential, {
+            rpId: params.rpId,
+            userId: params.userHandle,
+            name: params.name,
+            displayName: params.name,
+        });
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Authenticates using an existing passkey with PRF extension.
+ * @param {string} [credentialId] The credential to use. Omit to let the user pick
+ *   any discoverable passkey for this origin.
+ * @param {AuthOptions} [options] Authentication options.
+ * @returns {Promise<PasskeyAuth>} Authentication result.
+ */
+export async function authenticatePasskey(credentialId, options) {
+    if (!globalThis.navigator?.credentials) {
+        throw protocolError('WEBAUTHN_UNAVAILABLE', 'WebAuthn is not supported in this environment.');
+    }
+    const getOptions = {
+        challenge: globalThis.crypto.getRandomValues(new Uint8Array(32)),
+        rpId: options?.rpId,
+        userVerification: 'required',
+        ...(options?.hints ? { hints: options.hints } : {}),
+        // Narrow the ceremony to the known credential; without this the browser
+        // would prompt for any passkey on the origin.
+        ...(credentialId
+            ? { allowCredentials: [{ type: 'public-key', id: base64UrlDecode(credentialId) }] }
+            : {}),
+        extensions: {
+            prf: {
+                eval: {
+                    first: PRF_SALT
+                }
+            }
+        }
+    };
+    const credential = (await globalThis.navigator.credentials.get({
+        publicKey: getOptions
+    }));
+    if (!credential) {
+        throw new Error('Failed to authenticate passkey.');
+    }
+    const response = credential.response;
+    const extensions = credential.getClientExtensionResults();
+    const prfOutputBuffer = extensions.prf?.results?.first;
+    const prfOutput = prfOutputBuffer ? new Uint8Array(prfOutputBuffer) : null;
+    return Object.freeze({
+        credentialId: base64UrlEncode(new Uint8Array(credential.rawId)),
+        prfOutput,
+        authenticatorData: new Uint8Array(response.authenticatorData)
+    });
+}
+//# sourceMappingURL=webauthn.js.map

package/dist/identity/webauthn.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"webauthn.js","sourceRoot":"","sources":["../../src/identity/webauthn.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AACxE,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAqDnD,MAAM,QAAQ,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,uBAAuB,CAAC,CAAC;AAEnE;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB;IAC5C,IAAI,CAAC;QACH,OAAO,CACL,CAAC,MAAM,UAAU,CAAC,mBAAmB,EAAE,6CAA6C,EAAE,EAAE,CAAC;YACzF,KAAK,CACN,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,OAAuB;IAC3D,IAAI,CAAC,UAAU,CAAC,SAAS,EAAE,WAAW,EAAE,CAAC;QACvC,MAAM,aAAa,CAAC,sBAAsB,EAAE,gDAAgD,CAAC,CAAC;IAChG,CAAC;IAED,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,UAAU,CAAC,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC;IAEvF,MAAM,aAAa,GAA8D;QAC/E,EAAE,EAAE,EAAE,EAAE,EAAE,OAAO,CAAC,IAAI,EAAE,IAAI,EAAE,OAAO,CAAC,MAAM,EAAE;QAC9C,IAAI,EAAE;YACJ,EAAE,EAAE,MAAsB;YAC1B,IAAI,EAAE,OAAO,CAAC,QAAQ;YACtB,WAAW,EAAE,OAAO,CAAC,QAAQ;SAC9B;QACD,SAAS,EAAE,UAAU,CAAC,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC;QAChE,gBAAgB,EAAE;YAChB,EAAE,IAAI,EAAE,YAAY,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,QAAQ;YACzC,EAAE,IAAI,EAAE,YAAY,EAAE,GAAG,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ;SAC3C;QACD,sBAAsB,EAAE;YACtB,yEAAyE;YACzE,oEAAoE;YACpE,WAAW,EAAE,UAAU;YACvB,kBAAkB,EAAE,IAAI;YACxB,gBAAgB,EAAE,UAAU;YAC5B,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,uBAAuB,EAAE,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC/E;QACD,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAiB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9D,UAAU,EAAE;YACV,GAAG,EAAE;gBACH,IAAI,EAAE;oBACJ,KAAK,EAAE,QAAQ;iBAChB;aACF;SACK,CAAC,4CAA4C;KACtD,CAAC;IAEF,MAAM,UAAU,GAAG,CAAC,MAAM,UAAU,CAAC,SAAS,CAAC,WAAW,CAAC,MAAM,CAAC;QAChE,SAAS,EAAE,aAAa;KACzB,CAAC,CAAwB,CAAC;IAE3B,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;IAC/C,CAAC;IAED,MAAM,QAAQ,GAAG,UAAU,CAAC,QAA4C,CAAC;IAEzE,MAAM,UAAU,GAAG,UAAU,CAAC,yBAAyB,EAAE,CAAC;IAC1D,MAAM,GAAG,GAAI,UAAkB,CAAC,GAAG,CAAC;IACpC,MAAM,WAAW,GAAG,GAAG,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAE,GAAG,EAAE,OAA+B,CAAC;IAEvF,gFAAgF;IAChF,wCAAwC;IACxC,MAAM,eAAe,GAAG,GAAG,EAAE,OAAO,EAAE,KAAK,CAAC;IAE5C,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;IAE/C,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,YAAY,EAAE,eAAe,CAAC,KAAK,CAAC;QACpC,UAAU,EAAE,eAAe,CAAC,MAAM,CAAC;QACnC,SAAS,EAAE,IAAI,UAAU,CAAC,QAAQ,CAAC,YAAY,EAAE,EAAE,IAAI,IAAI,WAAW,CAAC,CAAC,CAAC,CAAC;QAC1E,WAAW;QACX,SAAS,EAAE,eAAe,CAAC,CAAC,CAAC,IAAI,UAAU,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,IAAI;KACpE,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,MAA0D;IAC5F,MAAM,MAAM,GAAI,UAAU,CAAC,mBAEb,EAAE,wBAAwB,CAAC;IACzC,IAAI,OAAO,MAAM,KAAK,UAAU;QAAE,OAAO,KAAK,CAAC;IAC/C,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,mBAAmB,EAAE;YAChD,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,MAAM,EAAE,MAAM,CAAC,UAAU;YACzB,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,WAAW,EAAE,MAAM,CAAC,IAAI;SACzB,CAAC,CAAC;QACH,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,YAAqB,EAAE,OAAqB;IACpF,IAAI,CAAC,UAAU,CAAC,SAAS,EAAE,WAAW,EAAE,CAAC;QACvC,MAAM,aAAa,CAAC,sBAAsB,EAAE,gDAAgD,CAAC,CAAC;IAChG,CAAC;IAED,MAAM,UAAU,GAA6D;QAC3E,SAAS,EAAE,UAAU,CAAC,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC;QAChE,IAAI,EAAE,OAAO,EAAE,IAAI;QACnB,gBAAgB,EAAE,UAAU;QAC5B,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAiB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/D,wEAAwE;QACxE,8CAA8C;QAC9C,GAAG,CAAC,YAAY;YACd,CAAC,CAAC,EAAE,gBAAgB,EAAE,CAAC,EAAE,IAAI,EAAE,YAAqB,EAAE,EAAE,EAAE,eAAe,CAAC,YAAY,CAAiB,EAAE,CAAC,EAAE;YAC5G,CAAC,CAAC,EAAE,CAAC;QACP,UAAU,EAAE;YACV,GAAG,EAAE;gBACH,IAAI,EAAE;oBACJ,KAAK,EAAE,QAAQ;iBAChB;aACF;SACK;KACT,CAAC;IAEF,MAAM,UAAU,GAAG,CAAC,MAAM,UAAU,CAAC,SAAS,CAAC,WAAW,CAAC,GAAG,CAAC;QAC7D,SAAS,EAAE,UAAU;KACtB,CAAC,CAAwB,CAAC;IAE3B,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;IACrD,CAAC;IAED,MAAM,QAAQ,GAAG,UAAU,CAAC,QAA0C,CAAC;IACvE,MAAM,UAAU,GAAG,UAAU,CAAC,yBAAyB,EAAE,CAAC;IAE1D,MAAM,eAAe,GAAI,UAAkB,CAAC,GAAG,EAAE,OAAO,EAAE,KAAK,CAAC;IAChE,MAAM,SAAS,GAAG,eAAe,CAAC,CAAC,CAAC,IAAI,UAAU,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAE3E,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,YAAY,EAAE,eAAe,CAAC,IAAI,UAAU,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;QAC/D,SAAS;QACT,iBAAiB,EAAE,IAAI,UAAU,CAAC,QAAQ,CAAC,iBAAiB,CAAC;KAC9D,CAAC,CAAC;AACL,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,116 @@
+/**
+ * @weaveprotocol/core
+ * Self-sovereign, peer-to-peer protocol for the browser.
+ *
+ * Identity via WebAuthn passkeys, data as signed Expressions,
+ * storage in a Merkle Search Tree, sync via anti-entropy gossip,
+ * and end-to-end encryption for private Spaces.
+ *
+ * @module @weaveprotocol/core
+ */
+export type { CryptoProvider, CryptoKeyPairResult, StandardSchemaV1, StandardJSONSchemaV1, StandardSchemaResult, StandardSchemaIssue, Expression, UnsignedExpression, Link, Space, SpaceRole, SpaceVisibility, CollectionDef, PeerInfo, SyncState, StorageAdapter, BatchOp, NetworkMessage, Result, } from './types.js';
+export { ok, err } from './types.js';
+export { createP256Provider, } from './identity/crypto-p256.js';
+export { registerPasskey, authenticatePasskey, renamePasskey, hasPlatformAuthenticator, } from './identity/webauthn.js';
+export type { PasskeyOptions, PasskeyRegistration, PasskeyAuth, AuthOptions } from './identity/webauthn.js';
+export { inspectPasskeyPrf } from './identity/passkey-diagnostics.js';
+export type { PasskeyDiagnostics, DiagnosticsOptions, CeremonyReport } from './identity/passkey-diagnostics.js';
+export { deriveKeyPair, deriveKeyFromPassword, } from './identity/keys.js';
+export type { DerivedKeyPair } from './identity/keys.js';
+export { generateRecoveryCode, generateSeed, seedToRecoveryCode, normalizeRecoveryCode, isValidRecoveryCode, recoveryCodeToSeed, RECOVERY_SEED_BYTES, } from './identity/recovery-code.js';
+export { publicKeyToDid, didToPublicKey, P256_MULTICODEC, } from './identity/did.js';
+export { createIdentityManager, } from './identity/identity-manager.js';
+export { createFolderAccountStore, createBrowserAccountStore, listFolderAccounts, adoptLegacyFolderAccount, accountDataPath, newAccountId, } from './identity/account-store.js';
+export type { AccountStore, AccountSummary } from './identity/account-store.js';
+export { readFolderVault, writeFolderVault, createVault, ACCOUNT_FILE, } from './identity/folder-account.js';
+export type { FolderState } from './identity/folder-account.js';
+export { wrapSeedWithDeviceKey, unwrapSeedWithDeviceKey, wrapSeedWithPassphrase, unwrapSeedWithPassphrase, deriveVaultKey, deriveVaultKeyBytes, deviceWrapsFor, hasPassphraseWrap, withWrap, withoutWrap, PASSPHRASE_ITERATIONS, } from './identity/account-vault.js';
+export type { AccountVault, SeedWrap, DeviceWrap, PassphraseWrap, } from './identity/account-vault.js';
+export type { IdentityManager, Identity, IdentityConfig, CeremonyPreferences } from './identity/identity-manager.js';
+export { createDeviceKey, getDeviceKey, deleteDeviceKey } from './identity/device-key.js';
+export type { DeviceKey } from './identity/device-key.js';
+export { createLocalRootSigner } from './identity/root-signer.js';
+export type { RootSigner } from './identity/root-signer.js';
+export { pairingRoomId, derivePairingKey, encodePairingTicket, decodePairingTicket, sealPairingPayload, openPairingPayload, } from './identity/pairing.js';
+export type { PairingTicket } from './identity/pairing.js';
+export { issueUCAN, parseUCAN, verifyUCAN, isCapabilitySubset, validateDelegationChain, delegateCapabilities, resolveDelegationRoot, } from './identity/ucan.js';
+export { AGENT_FACT, isAgentNote } from './identity/agent-note.js';
+export type { UCANHeader, UCANPayload, UCANToken, Capability, Fact, IssueUCANOptions, UCANValidation, ChainResolution, ProofResolver, DelegateOptions, } from './identity/ucan.js';
+export { createSchemaEngine, } from './schema/schema-engine.js';
+export type { SchemaEngine, ValidationResult } from './schema/schema-engine.js';
+export { createSigner, } from './schema/signer.js';
+export type { Signer } from './schema/signer.js';
+export { createExpression, canonicalize, serializeExpression, deserializeExpression, getExpressionId, signedPart, } from './schema/expression.js';
+export { createIndexedDBAdapter, } from './storage/indexeddb-adapter.js';
+export { createEmptyNode, insertIntoMST, deleteFromMST, lookupInMST, listMSTEntries, collectReachableCids, } from './storage/mst.js';
+export type { MSTNode } from './storage/mst.js';
+export { createStorageProvider, } from './storage/storage-provider.js';
+export type { StorageProvider } from './storage/storage-provider.js';
+export { createFolderAdapter, readFolderFile, writeFolderFile, } from './storage/folder-adapter.js';
+export type { FolderAdapter, FolderReload, DirectoryHandleLike, FileHandleLike, WritableFileLike, } from './storage/folder-adapter.js';
+export { createEncryptedAdapter, DEFAULT_ENCRYPTED_PREFIXES } from './storage/encrypted-adapter.js';
+export type { EncryptedAdapterOptions } from './storage/encrypted-adapter.js';
+export { reconcileFolder } from './storage/folder-reconcile.js';
+export type { FolderReconciliation } from './storage/folder-reconcile.js';
+export { isFolderStorageAvailable, pickDataFolder, queryFolderPermission, ensureFolderPermission, rememberDataFolder, recallDataFolder, forgetDataFolder, } from './storage/directory-access.js';
+export type { FolderAccessMode } from './storage/directory-access.js';
+export { createSpaceManager, parseSpaceInvite } from './space/space-manager.js';
+export { deriveAccountRegistry, MEMBERSHIP_COLLECTION } from './space/account-registry.js';
+export { CATALOG_COLLECTION, checkStoredCollection, checkPublishableSchema, validateJsonSchema, asStandardSchema, toJsonSchema, collection, } from './schema/collection-def.js';
+export type { StoredCollection, JsonSchema, SchemaIssue } from './schema/collection-def.js';
+export type { Membership } from './space/account-registry.js';
+export type { SpaceManager, SpaceRecord, SpaceInvite, InviteOptions, CreateSpaceParams } from './space/space-manager.js';
+export { generateInviteSecret, deriveInviteKey, deriveReadKey, spaceGenesis, spaceIdOf, checkSpace, checkStartingRoles, memberKey, inviteKey, revokeKey, roleKey, signInvite, verifyInvite, } from './space/space-access.js';
+export { replayAccess, permissionMatches, roleHolds, holds, standing, checkRole, MANAGE, INVITE, DEFINE, ROLE_COLLECTION, MEMBER_COLLECTION, INVITE_COLLECTION, REVOKE_COLLECTION, ACCESS_COLLECTIONS, } from './space/roles.js';
+export type { Role, AccessEvent, AccessGenesis, AccessHistory, AccessState, EventStatus, RecordVerdict } from './space/roles.js';
+export { rolePresets, solo, team, community } from './space/presets.js';
+export type { RolePreset } from './space/presets.js';
+export type { SpaceGenesis, SpaceKeyPair } from './space/space-access.js';
+export { createSignalingClient, } from './network/signaling.js';
+export { createMultiSignalingClient, } from './network/multi-signaling.js';
+export { isControlMessage, shouldInitiate, createSeenSignals, signalId, MAX_HOPS, PEERS_MESSAGE, SIGNAL_MESSAGE, } from './network/introductions.js';
+export type { RelayedSignal, SeenSignals } from './network/introductions.js';
+export { createRTCTransport, } from './network/rtc-transport.js';
+export { createWebSocketTransport } from './network/ws-transport.js';
+export type { WebSocketTransportConfig } from './network/ws-transport.js';
+export { createClientAuth, createServerAuth, createMeshAuth, peerNonce } from './network/peer-auth.js';
+export type { ClientAuth, ServerAuth } from './network/peer-auth.js';
+export type { PeerTransport, PeerTransportEvents, SignalledTransport, CandidateSink } from './network/transport.js';
+export { createMesh } from './network/mesh.js';
+export type { Mesh, MeshConfig } from './network/mesh.js';
+export { createNetworkManager, } from './network/network-manager.js';
+export type { NetworkManager, NetworkManagerConfig, NetworkEvents } from './network/network-manager.js';
+export type { SignalingClient, SignalingMessage, SignalKind } from './network/signaling.js';
+export { parseSyncMessage, SYNC_PROTOCOL_VERSION, } from './sync/sync-messages.js';
+export type { SyncMessage } from './sync/sync-messages.js';
+export { verifyNode, unknownChildren, differingEntries, } from './sync/anti-entropy.js';
+export { createSyncEngine, } from './sync/sync-engine.js';
+export type { SyncEngine, SyncEngineConfig, IncomingValidation } from './sync/sync-engine.js';
+export { createCryptoGate, } from './validation/crypto-gate.js';
+export { createStructuralGate, } from './validation/structural-gate.js';
+export { createStatefulGate, } from './validation/stateful-gate.js';
+export { createCapabilityGate, } from './validation/capability-gate.js';
+export type { CapabilityGate, CapabilityGateConfig } from './validation/capability-gate.js';
+export { createValidationEngine, } from './validation/validation-engine.js';
+export type { ValidationEngine, ValidationEngineConfig } from './validation/validation-engine.js';
+export { generateSpaceKey, encryptExpression, decryptExpression, } from './privacy/space-encryption.js';
+export type { SpaceKey, EncryptedExpression, EncryptedExpressionBody } from './privacy/space-encryption.js';
+export { wrapSpaceKey, unwrapSpaceKey, distributeSpaceKey, } from './privacy/key-distribution.js';
+export { createPrivacyGuard, } from './privacy/privacy-guard.js';
+export { base64UrlEncode, base64UrlDecode, utf8Encode, utf8Decode, concatBytes, varintEncode, varintDecode, bytesToHex, hexToBytes, } from './utils/encoding.js';
+export { sha256, cidFromBytes } from './utils/hash.js';
+export { protocolError, isProtocolError } from './utils/errors.js';
+export type { ProtocolError, ProtocolErrorCode } from './utils/errors.js';
+export { createEmitter } from './utils/events.js';
+export type { Emitter } from './utils/events.js';
+export { createNode, SESSION_CAPABILITY, writeCapability, relayRoom, indexedDBStores, folderStores, copyAccountData, NODE_ACTIONS, runAction, checkActionInput, } from './node/index.js';
+export type { StoreFactory, StoreOptions, CopyAccountParams, CopyResult, NodeAction, ActionSchema, P2PNode, NodeConfig, NodeNetworkConfig, NodeSpaces, NodeRecords, NodeRecord, NodeEvent, SpaceSummary, SpaceStatus, CarrierSummary, SpaceProfile, NewSpace, InvitePreview, ListOptions, ConnectionState, DelegateParams, Delegated, NodeCollection, NodeCollections, DefineCollection, NodeAccount, AccountProfileView, } from './node/index.js';
+export { runQuery } from './query/engine.js';
+export type { QuerySource } from './query/engine.js';
+export { matches, checkQuery, fieldValue, MAX_INCLUDE_DEPTH } from './query/filter.js';
+export type { Query, Filter, Operators, Include, SortDirection, QueryRecord, QueryResult, CollectionRef, Typed, BodyOf, IncludedOf, ResultOf } from './query/types.js';
+export { plainQuery } from './query/types.js';
+export { checkRules, onePerKey } from './records/rules.js';
+export { describeCollection } from './records/describe.js';
+export type { CollectionRules, Who } from './records/rules.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAGH,YAAY,EACV,cAAc,EACd,mBAAmB,EACnB,gBAAgB,EAChB,oBAAoB,EACpB,oBAAoB,EACpB,mBAAmB,EACnB,UAAU,EACV,kBAAkB,EAClB,IAAI,EACJ,KAAK,EACL,SAAS,EACT,eAAe,EACf,aAAa,EACb,QAAQ,EACR,SAAS,EACT,cAAc,EACd,OAAO,EACP,cAAc,EACd,MAAM,GACP,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,EAAE,EAAE,GAAG,EAAE,MAAM,YAAY,CAAC;AAGrC,OAAO,EACL,kBAAkB,GACnB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EACL,eAAe,EACf,mBAAmB,EACnB,aAAa,EACb,wBAAwB,GACzB,MAAM,wBAAwB,CAAC;AAChC,YAAY,EAAE,cAAc,EAAE,mBAAmB,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAC5G,OAAO,EAAE,iBAAiB,EAAE,MAAM,mCAAmC,CAAC;AACtE,YAAY,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,cAAc,EAAE,MAAM,mCAAmC,CAAC;AAChH,OAAO,EACL,aAAa,EACb,qBAAqB,GACtB,MAAM,oBAAoB,CAAC;AAC5B,YAAY,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACzD,OAAO,EACL,oBAAoB,EACpB,YAAY,EACZ,kBAAkB,EAClB,qBAAqB,EACrB,mBAAmB,EACnB,kBAAkB,EAClB,mBAAmB,GACpB,MAAM,6BAA6B,CAAC;AACrC,OAAO,EACL,cAAc,EACd,cAAc,EACd,eAAe,GAChB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,qBAAqB,GACtB,MAAM,gCAAgC,CAAC;AACxC,OAAO,EACL,wBAAwB,EACxB,yBAAyB,EACzB,kBAAkB,EAClB,wBAAwB,EACxB,eAAe,EACf,YAAY,GACb,MAAM,6BAA6B,CAAC;AACrC,YAAY,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAChF,OAAO,EACL,eAAe,EACf,gBAAgB,EAChB,WAAW,EACX,YAAY,GACb,MAAM,8BAA8B,CAAC;AACtC,YAAY,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAChE,OAAO,EACL,qBAAqB,EACrB,uBAAuB,EACvB,sBAAsB,EACtB,wBAAwB,EACxB,cAAc,EACd,mBAAmB,EACnB,cAAc,EACd,iBAAiB,EACjB,QAAQ,EACR,WAAW,EACX,qBAAqB,GACtB,MAAM,6BAA6B,CAAC;AACrC,YAAY,EACV,YAAY,EACZ,QAAQ,EACR,UAAU,EACV,cAAc,GACf,MAAM,6BAA6B,CAAC;AACrC,YAAY,EAAE,eAAe,EAAE,QAAQ,EAAE,cAAc,EAAE,mBAAmB,EAAE,MAAM,gCAAgC,CAAC;AACrH,OAAO,EAAE,eAAe,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAC1F,YAAY,EAAE,SAAS,EAAE,MAAM,0BAA0B,CAAC;AAC1D,OAAO,EAAE,qBAAqB,EAAE,MAAM,2BAA2B,CAAC;AAClE,YAAY,EAAE,UAAU,EAAE,MAAM,2BAA2B,CAAC;AAC5D,OAAO,EACL,aAAa,EACb,gBAAgB,EAChB,mBAAmB,EACnB,mBAAmB,EACnB,kBAAkB,EAClB,kBAAkB,GACnB,MAAM,uBAAuB,CAAC;AAC/B,YAAY,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AAC3D,OAAO,EACL,SAAS,EACT,SAAS,EACT,UAAU,EACV,kBAAkB,EAClB,uBAAuB,EACvB,oBAAoB,EACpB,qBAAqB,GACtB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AACnE,YAAY,EACV,UAAU,EACV,WAAW,EACX,SAAS,EACT,UAAU,EACV,IAAI,EACJ,gBAAgB,EAChB,cAAc,EACd,eAAe,EACf,aAAa,EACb,eAAe,GAChB,MAAM,oBAAoB,CAAC;AAG5B,OAAO,EACL,kBAAkB,GACnB,MAAM,2BAA2B,CAAC;AACnC,YAAY,EAAE,YAAY,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAC;AAChF,OAAO,EACL,YAAY,GACb,MAAM,oBAAoB,CAAC;AAC5B,YAAY,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,EACL,gBAAgB,EAChB,YAAY,EACZ,mBAAmB,EACnB,qBAAqB,EACrB,eAAe,EACf,UAAU,GACX,MAAM,wBAAwB,CAAC;AAGhC,OAAO,EACL,sBAAsB,GACvB,MAAM,gCAAgC,CAAC;AACxC,OAAO,EACL,eAAe,EACf,aAAa,EACb,aAAa,EACb,WAAW,EACX,cAAc,EACd,oBAAoB,GACrB,MAAM,kBAAkB,CAAC;AAC1B,YAAY,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAChD,OAAO,EACL,qBAAqB,GACtB,MAAM,+BAA+B,CAAC;AACvC,YAAY,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAC;AAGrE,OAAO,EACL,mBAAmB,EACnB,cAAc,EACd,eAAe,GAChB,MAAM,6BAA6B,CAAC;AACrC,YAAY,EACV,aAAa,EACb,YAAY,EACZ,mBAAmB,EACnB,cAAc,EACd,gBAAgB,GACjB,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAAE,sBAAsB,EAAE,0BAA0B,EAAE,MAAM,gCAAgC,CAAC;AACpG,YAAY,EAAE,uBAAuB,EAAE,MAAM,gCAAgC,CAAC;AAC9E,OAAO,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAC;AAChE,YAAY,EAAE,oBAAoB,EAAE,MAAM,+BAA+B,CAAC;AAC1E,OAAO,EACL,wBAAwB,EACxB,cAAc,EACd,qBAAqB,EACrB,sBAAsB,EACtB,kBAAkB,EAClB,gBAAgB,EAChB,gBAAgB,GACjB,MAAM,+BAA+B,CAAC;AACvC,YAAY,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AAGtE,OAAO,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAChF,OAAO,EAAE,qBAAqB,EAAE,qBAAqB,EAAE,MAAM,6BAA6B,CAAC;AAC3F,OAAO,EACL,kBAAkB,EAClB,qBAAqB,EACrB,sBAAsB,EACtB,kBAAkB,EAClB,gBAAgB,EAChB,YAAY,EACZ,UAAU,GACX,MAAM,4BAA4B,CAAC;AACpC,YAAY,EAAE,gBAAgB,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAC;AAC5F,YAAY,EAAE,UAAU,EAAE,MAAM,6BAA6B,CAAC;AAC9D,YAAY,EAAE,YAAY,EAAE,WAAW,EAAE,WAAW,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AACzH,OAAO,EACL,oBAAoB,EACpB,eAAe,EACf,aAAa,EACb,YAAY,EACZ,SAAS,EACT,UAAU,EACV,kBAAkB,EAClB,SAAS,EACT,SAAS,EACT,SAAS,EACT,OAAO,EACP,UAAU,EACV,YAAY,GACb,MAAM,yBAAyB,CAAC;AACjC,OAAO,EACL,YAAY,EACZ,iBAAiB,EACjB,SAAS,EACT,KAAK,EACL,QAAQ,EACR,SAAS,EACT,MAAM,EACN,MAAM,EACN,MAAM,EACN,eAAe,EACf,iBAAiB,EACjB,iBAAiB,EACjB,iBAAiB,EACjB,kBAAkB,GACnB,MAAM,kBAAkB,CAAC;AAC1B,YAAY,EAAE,IAAI,EAAE,WAAW,EAAE,aAAa,EAAE,aAAa,EAAE,WAAW,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACjI,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AACxE,YAAY,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AACrD,YAAY,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AAG1E,OAAO,EACL,qBAAqB,GACtB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,0BAA0B,GAC3B,MAAM,8BAA8B,CAAC;AACtC,OAAO,EACL,gBAAgB,EAChB,cAAc,EACd,iBAAiB,EACjB,QAAQ,EACR,QAAQ,EACR,aAAa,EACb,cAAc,GACf,MAAM,4BAA4B,CAAC;AACpC,YAAY,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAC;AAC7E,OAAO,EACL,kBAAkB,GACnB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAAE,wBAAwB,EAAE,MAAM,2BAA2B,CAAC;AACrE,YAAY,EAAE,wBAAwB,EAAE,MAAM,2BAA2B,CAAC;AAC1E,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,wBAAwB,CAAC;AACvG,YAAY,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AACrE,YAAY,EAAE,aAAa,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AACpH,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAC/C,YAAY,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAC1D,OAAO,EACL,oBAAoB,GACrB,MAAM,8BAA8B,CAAC;AACtC,YAAY,EAAE,cAAc,EAAE,oBAAoB,EAAE,aAAa,EAAE,MAAM,8BAA8B,CAAC;AACxG,YAAY,EAAE,eAAe,EAAE,gBAAgB,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AAG5F,OAAO,EACL,gBAAgB,EAChB,qBAAqB,GACtB,MAAM,yBAAyB,CAAC;AACjC,YAAY,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAC3D,OAAO,EACL,UAAU,EACV,eAAe,EACf,gBAAgB,GACjB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,gBAAgB,GACjB,MAAM,uBAAuB,CAAC;AAC/B,YAAY,EAAE,UAAU,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAG9F,OAAO,EACL,gBAAgB,GACjB,MAAM,6BAA6B,CAAC;AACrC,OAAO,EACL,oBAAoB,GACrB,MAAM,iCAAiC,CAAC;AACzC,OAAO,EACL,kBAAkB,GACnB,MAAM,+BAA+B,CAAC;AACvC,OAAO,EACL,oBAAoB,GACrB,MAAM,iCAAiC,CAAC;AACzC,YAAY,EAAE,cAAc,EAAE,oBAAoB,EAAE,MAAM,iCAAiC,CAAC;AAC5F,OAAO,EACL,sBAAsB,GACvB,MAAM,mCAAmC,CAAC;AAC3C,YAAY,EAAE,gBAAgB,EAAE,sBAAsB,EAAE,MAAM,mCAAmC,CAAC;AAGlG,OAAO,EACL,gBAAgB,EAChB,iBAAiB,EACjB,iBAAiB,GAClB,MAAM,+BAA+B,CAAC;AACvC,YAAY,EAAE,QAAQ,EAAE,mBAAmB,EAAE,uBAAuB,EAAE,MAAM,+BAA+B,CAAC;AAC5G,OAAO,EACL,YAAY,EACZ,cAAc,EACd,kBAAkB,GACnB,MAAM,+BAA+B,CAAC;AACvC,OAAO,EACL,kBAAkB,GACnB,MAAM,4BAA4B,CAAC;AAGpC,OAAO,EACL,eAAe,EACf,eAAe,EACf,UAAU,EACV,UAAU,EACV,WAAW,EACX,YAAY,EACZ,YAAY,EACZ,UAAU,EACV,UAAU,GACX,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AACvD,OAAO,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACnE,YAAY,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAC1E,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAClD,YAAY,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAC;AAGjD,OAAO,EACL,UAAU,EACV,kBAAkB,EAClB,eAAe,EACf,SAAS,EACT,eAAe,EACf,YAAY,EACZ,eAAe,EACf,YAAY,EACZ,SAAS,EACT,gBAAgB,GACjB,MAAM,iBAAiB,CAAC;AACzB,YAAY,EACV,YAAY,EACZ,YAAY,EACZ,iBAAiB,EACjB,UAAU,EACV,UAAU,EACV,YAAY,EACZ,OAAO,EACP,UAAU,EACV,iBAAiB,EACjB,UAAU,EACV,WAAW,EACX,UAAU,EACV,SAAS,EACT,YAAY,EACZ,WAAW,EACX,cAAc,EACd,YAAY,EACZ,QAAQ,EACR,aAAa,EACb,WAAW,EACX,eAAe,EACf,cAAc,EACd,SAAS,EACT,cAAc,EACd,eAAe,EACf,gBAAgB,EAChB,WAAW,EACX,kBAAkB,GACnB,MAAM,iBAAiB,CAAC;AAGzB,OAAO,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAC7C,YAAY,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AACrD,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AACvF,YAAY,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,aAAa,EAAE,WAAW,EAAE,WAAW,EAAE,aAAa,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AACvK,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAG9C,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAC3D,OAAO,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAC3D,YAAY,EAAE,eAAe,EAAE,GAAG,EAAE,MAAM,oBAAoB,CAAC"}

package/dist/index.js

@@ -0,0 +1,85 @@
+/**
+ * @weaveprotocol/core
+ * Self-sovereign, peer-to-peer protocol for the browser.
+ *
+ * Identity via WebAuthn passkeys, data as signed Expressions,
+ * storage in a Merkle Search Tree, sync via anti-entropy gossip,
+ * and end-to-end encryption for private Spaces.
+ *
+ * @module @weaveprotocol/core
+ */
+export { ok, err } from './types.js';
+// Phase 1: Identity & Key Management
+export { createP256Provider, } from './identity/crypto-p256.js';
+export { registerPasskey, authenticatePasskey, renamePasskey, hasPlatformAuthenticator, } from './identity/webauthn.js';
+export { inspectPasskeyPrf } from './identity/passkey-diagnostics.js';
+export { deriveKeyPair, deriveKeyFromPassword, } from './identity/keys.js';
+export { generateRecoveryCode, generateSeed, seedToRecoveryCode, normalizeRecoveryCode, isValidRecoveryCode, recoveryCodeToSeed, RECOVERY_SEED_BYTES, } from './identity/recovery-code.js';
+export { publicKeyToDid, didToPublicKey, P256_MULTICODEC, } from './identity/did.js';
+export { createIdentityManager, } from './identity/identity-manager.js';
+export { createFolderAccountStore, createBrowserAccountStore, listFolderAccounts, adoptLegacyFolderAccount, accountDataPath, newAccountId, } from './identity/account-store.js';
+export { readFolderVault, writeFolderVault, createVault, ACCOUNT_FILE, } from './identity/folder-account.js';
+export { wrapSeedWithDeviceKey, unwrapSeedWithDeviceKey, wrapSeedWithPassphrase, unwrapSeedWithPassphrase, deriveVaultKey, deriveVaultKeyBytes, deviceWrapsFor, hasPassphraseWrap, withWrap, withoutWrap, PASSPHRASE_ITERATIONS, } from './identity/account-vault.js';
+export { createDeviceKey, getDeviceKey, deleteDeviceKey } from './identity/device-key.js';
+export { createLocalRootSigner } from './identity/root-signer.js';
+export { pairingRoomId, derivePairingKey, encodePairingTicket, decodePairingTicket, sealPairingPayload, openPairingPayload, } from './identity/pairing.js';
+export { issueUCAN, parseUCAN, verifyUCAN, isCapabilitySubset, validateDelegationChain, delegateCapabilities, resolveDelegationRoot, } from './identity/ucan.js';
+export { AGENT_FACT, isAgentNote } from './identity/agent-note.js';
+// Phase 2: Schema & Data Structures
+export { createSchemaEngine, } from './schema/schema-engine.js';
+export { createSigner, } from './schema/signer.js';
+export { createExpression, canonicalize, serializeExpression, deserializeExpression, getExpressionId, signedPart, } from './schema/expression.js';
+// Phase 3: Local Storage & State
+export { createIndexedDBAdapter, } from './storage/indexeddb-adapter.js';
+export { createEmptyNode, insertIntoMST, deleteFromMST, lookupInMST, listMSTEntries, collectReachableCids, } from './storage/mst.js';
+export { createStorageProvider, } from './storage/storage-provider.js';
+// Storage in a folder the user owns — the one store that is not origin-scoped
+export { createFolderAdapter, readFolderFile, writeFolderFile, } from './storage/folder-adapter.js';
+export { createEncryptedAdapter, DEFAULT_ENCRYPTED_PREFIXES } from './storage/encrypted-adapter.js';
+export { reconcileFolder } from './storage/folder-reconcile.js';
+export { isFolderStorageAvailable, pickDataFolder, queryFolderPermission, ensureFolderPermission, rememberDataFolder, recallDataFolder, forgetDataFolder, } from './storage/directory-access.js';
+// Spaces
+export { createSpaceManager, parseSpaceInvite } from './space/space-manager.js';
+export { deriveAccountRegistry, MEMBERSHIP_COLLECTION } from './space/account-registry.js';
+export { CATALOG_COLLECTION, checkStoredCollection, checkPublishableSchema, validateJsonSchema, asStandardSchema, toJsonSchema, collection, } from './schema/collection-def.js';
+export { generateInviteSecret, deriveInviteKey, deriveReadKey, spaceGenesis, spaceIdOf, checkSpace, checkStartingRoles, memberKey, inviteKey, revokeKey, roleKey, signInvite, verifyInvite, } from './space/space-access.js';
+export { replayAccess, permissionMatches, roleHolds, holds, standing, checkRole, MANAGE, INVITE, DEFINE, ROLE_COLLECTION, MEMBER_COLLECTION, INVITE_COLLECTION, REVOKE_COLLECTION, ACCESS_COLLECTIONS, } from './space/roles.js';
+export { rolePresets, solo, team, community } from './space/presets.js';
+// Phase 4: P2P Networking
+export { createSignalingClient, } from './network/signaling.js';
+export { createMultiSignalingClient, } from './network/multi-signaling.js';
+export { isControlMessage, shouldInitiate, createSeenSignals, signalId, MAX_HOPS, PEERS_MESSAGE, SIGNAL_MESSAGE, } from './network/introductions.js';
+export { createRTCTransport, } from './network/rtc-transport.js';
+export { createWebSocketTransport } from './network/ws-transport.js';
+export { createClientAuth, createServerAuth, createMeshAuth, peerNonce } from './network/peer-auth.js';
+export { createMesh } from './network/mesh.js';
+export { createNetworkManager, } from './network/network-manager.js';
+// Phase 5: Gossip/Sync Protocol
+export { parseSyncMessage, SYNC_PROTOCOL_VERSION, } from './sync/sync-messages.js';
+export { verifyNode, unknownChildren, differingEntries, } from './sync/anti-entropy.js';
+export { createSyncEngine, } from './sync/sync-engine.js';
+// Phase 6: Validation Engine
+export { createCryptoGate, } from './validation/crypto-gate.js';
+export { createStructuralGate, } from './validation/structural-gate.js';
+export { createStatefulGate, } from './validation/stateful-gate.js';
+export { createCapabilityGate, } from './validation/capability-gate.js';
+export { createValidationEngine, } from './validation/validation-engine.js';
+// Phase 7: Encryption & Privacy
+export { generateSpaceKey, encryptExpression, decryptExpression, } from './privacy/space-encryption.js';
+export { wrapSpaceKey, unwrapSpaceKey, distributeSpaceKey, } from './privacy/key-distribution.js';
+export { createPrivacyGuard, } from './privacy/privacy-guard.js';
+// Utilities
+export { base64UrlEncode, base64UrlDecode, utf8Encode, utf8Decode, concatBytes, varintEncode, varintDecode, bytesToHex, hexToBytes, } from './utils/encoding.js';
+export { sha256, cidFromBytes } from './utils/hash.js';
+export { protocolError, isProtocolError } from './utils/errors.js';
+export { createEmitter } from './utils/events.js';
+// Node: identity + spaces + sync, behind one API
+export { createNode, SESSION_CAPABILITY, writeCapability, relayRoom, indexedDBStores, folderStores, copyAccountData, NODE_ACTIONS, runAction, checkActionInput, } from './node/index.js';
+// Queries: plain-data filters, sorting, paging and includes over a space
+export { runQuery } from './query/engine.js';
+export { matches, checkQuery, fieldValue, MAX_INCLUDE_DEPTH } from './query/filter.js';
+export { plainQuery } from './query/types.js';
+// Rules: who may create, edit and delete a collection's records, what must be unique
+export { checkRules, onePerKey } from './records/rules.js';
+export { describeCollection } from './records/describe.js';
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAwBH,OAAO,EAAE,EAAE,EAAE,GAAG,EAAE,MAAM,YAAY,CAAC;AAErC,qCAAqC;AACrC,OAAO,EACL,kBAAkB,GACnB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EACL,eAAe,EACf,mBAAmB,EACnB,aAAa,EACb,wBAAwB,GACzB,MAAM,wBAAwB,CAAC;AAEhC,OAAO,EAAE,iBAAiB,EAAE,MAAM,mCAAmC,CAAC;AAEtE,OAAO,EACL,aAAa,EACb,qBAAqB,GACtB,MAAM,oBAAoB,CAAC;AAE5B,OAAO,EACL,oBAAoB,EACpB,YAAY,EACZ,kBAAkB,EAClB,qBAAqB,EACrB,mBAAmB,EACnB,kBAAkB,EAClB,mBAAmB,GACpB,MAAM,6BAA6B,CAAC;AACrC,OAAO,EACL,cAAc,EACd,cAAc,EACd,eAAe,GAChB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,qBAAqB,GACtB,MAAM,gCAAgC,CAAC;AACxC,OAAO,EACL,wBAAwB,EACxB,yBAAyB,EACzB,kBAAkB,EAClB,wBAAwB,EACxB,eAAe,EACf,YAAY,GACb,MAAM,6BAA6B,CAAC;AAErC,OAAO,EACL,eAAe,EACf,gBAAgB,EAChB,WAAW,EACX,YAAY,GACb,MAAM,8BAA8B,CAAC;AAEtC,OAAO,EACL,qBAAqB,EACrB,uBAAuB,EACvB,sBAAsB,EACtB,wBAAwB,EACxB,cAAc,EACd,mBAAmB,EACnB,cAAc,EACd,iBAAiB,EACjB,QAAQ,EACR,WAAW,EACX,qBAAqB,GACtB,MAAM,6BAA6B,CAAC;AAQrC,OAAO,EAAE,eAAe,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAE1F,OAAO,EAAE,qBAAqB,EAAE,MAAM,2BAA2B,CAAC;AAElE,OAAO,EACL,aAAa,EACb,gBAAgB,EAChB,mBAAmB,EACnB,mBAAmB,EACnB,kBAAkB,EAClB,kBAAkB,GACnB,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EACL,SAAS,EACT,SAAS,EACT,UAAU,EACV,kBAAkB,EAClB,uBAAuB,EACvB,oBAAoB,EACpB,qBAAqB,GACtB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAcnE,oCAAoC;AACpC,OAAO,EACL,kBAAkB,GACnB,MAAM,2BAA2B,CAAC;AAEnC,OAAO,EACL,YAAY,GACb,MAAM,oBAAoB,CAAC;AAE5B,OAAO,EACL,gBAAgB,EAChB,YAAY,EACZ,mBAAmB,EACnB,qBAAqB,EACrB,eAAe,EACf,UAAU,GACX,MAAM,wBAAwB,CAAC;AAEhC,iCAAiC;AACjC,OAAO,EACL,sBAAsB,GACvB,MAAM,gCAAgC,CAAC;AACxC,OAAO,EACL,eAAe,EACf,aAAa,EACb,aAAa,EACb,WAAW,EACX,cAAc,EACd,oBAAoB,GACrB,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EACL,qBAAqB,GACtB,MAAM,+BAA+B,CAAC;AAGvC,8EAA8E;AAC9E,OAAO,EACL,mBAAmB,EACnB,cAAc,EACd,eAAe,GAChB,MAAM,6BAA6B,CAAC;AAQrC,OAAO,EAAE,sBAAsB,EAAE,0BAA0B,EAAE,MAAM,gCAAgC,CAAC;AAEpG,OAAO,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAC;AAEhE,OAAO,EACL,wBAAwB,EACxB,cAAc,EACd,qBAAqB,EACrB,sBAAsB,EACtB,kBAAkB,EAClB,gBAAgB,EAChB,gBAAgB,GACjB,MAAM,+BAA+B,CAAC;AAGvC,SAAS;AACT,OAAO,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAChF,OAAO,EAAE,qBAAqB,EAAE,qBAAqB,EAAE,MAAM,6BAA6B,CAAC;AAC3F,OAAO,EACL,kBAAkB,EAClB,qBAAqB,EACrB,sBAAsB,EACtB,kBAAkB,EAClB,gBAAgB,EAChB,YAAY,EACZ,UAAU,GACX,MAAM,4BAA4B,CAAC;AAIpC,OAAO,EACL,oBAAoB,EACpB,eAAe,EACf,aAAa,EACb,YAAY,EACZ,SAAS,EACT,UAAU,EACV,kBAAkB,EAClB,SAAS,EACT,SAAS,EACT,SAAS,EACT,OAAO,EACP,UAAU,EACV,YAAY,GACb,MAAM,yBAAyB,CAAC;AACjC,OAAO,EACL,YAAY,EACZ,iBAAiB,EACjB,SAAS,EACT,KAAK,EACL,QAAQ,EACR,SAAS,EACT,MAAM,EACN,MAAM,EACN,MAAM,EACN,eAAe,EACf,iBAAiB,EACjB,iBAAiB,EACjB,iBAAiB,EACjB,kBAAkB,GACnB,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAIxE,0BAA0B;AAC1B,OAAO,EACL,qBAAqB,GACtB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,0BAA0B,GAC3B,MAAM,8BAA8B,CAAC;AACtC,OAAO,EACL,gBAAgB,EAChB,cAAc,EACd,iBAAiB,EACjB,QAAQ,EACR,QAAQ,EACR,aAAa,EACb,cAAc,GACf,MAAM,4BAA4B,CAAC;AAEpC,OAAO,EACL,kBAAkB,GACnB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAAE,wBAAwB,EAAE,MAAM,2BAA2B,CAAC;AAErE,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,wBAAwB,CAAC;AAGvG,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAE/C,OAAO,EACL,oBAAoB,GACrB,MAAM,8BAA8B,CAAC;AAItC,gCAAgC;AAChC,OAAO,EACL,gBAAgB,EAChB,qBAAqB,GACtB,MAAM,yBAAyB,CAAC;AAEjC,OAAO,EACL,UAAU,EACV,eAAe,EACf,gBAAgB,GACjB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,gBAAgB,GACjB,MAAM,uBAAuB,CAAC;AAG/B,6BAA6B;AAC7B,OAAO,EACL,gBAAgB,GACjB,MAAM,6BAA6B,CAAC;AACrC,OAAO,EACL,oBAAoB,GACrB,MAAM,iCAAiC,CAAC;AACzC,OAAO,EACL,kBAAkB,GACnB,MAAM,+BAA+B,CAAC;AACvC,OAAO,EACL,oBAAoB,GACrB,MAAM,iCAAiC,CAAC;AAEzC,OAAO,EACL,sBAAsB,GACvB,MAAM,mCAAmC,CAAC;AAG3C,gCAAgC;AAChC,OAAO,EACL,gBAAgB,EAChB,iBAAiB,EACjB,iBAAiB,GAClB,MAAM,+BAA+B,CAAC;AAEvC,OAAO,EACL,YAAY,EACZ,cAAc,EACd,kBAAkB,GACnB,MAAM,+BAA+B,CAAC;AACvC,OAAO,EACL,kBAAkB,GACnB,MAAM,4BAA4B,CAAC;AAEpC,YAAY;AACZ,OAAO,EACL,eAAe,EACf,eAAe,EACf,UAAU,EACV,UAAU,EACV,WAAW,EACX,YAAY,EACZ,YAAY,EACZ,UAAU,EACV,UAAU,GACX,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AACvD,OAAO,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAEnE,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAGlD,iDAAiD;AACjD,OAAO,EACL,UAAU,EACV,kBAAkB,EAClB,eAAe,EACf,SAAS,EACT,eAAe,EACf,YAAY,EACZ,eAAe,EACf,YAAY,EACZ,SAAS,EACT,gBAAgB,GACjB,MAAM,iBAAiB,CAAC;AAgCzB,yEAAyE;AACzE,OAAO,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAE7C,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAEvF,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAE9C,qFAAqF;AACrF,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAC3D,OAAO,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC"}

package/dist/network/index.d.ts

@@ -0,0 +1,17 @@
+/**
+ * @fileoverview Network module exports for P2P networking phase 4.
+ */
+export { createSignalingClient } from './signaling.js';
+export type { SignalingClient, SignalingMessage, SignalingEvents } from './signaling.js';
+export type { PeerTransport, PeerTransportEvents, SignalledTransport, CandidateSink } from './transport.js';
+export { createRTCTransport } from './rtc-transport.js';
+export type { RTCTransport, RTCTransportConfig, RTCTransportEvents } from './rtc-transport.js';
+export { createWebSocketTransport } from './ws-transport.js';
+export type { WebSocketTransportConfig } from './ws-transport.js';
+export { createMesh } from './mesh.js';
+export type { Mesh, MeshConfig } from './mesh.js';
+export { createNetworkManager } from './network-manager.js';
+export type { NetworkManager, NetworkManagerConfig, NetworkEvents } from './network-manager.js';
+export { createLocalHub } from './local-transport.js';
+export type { LocalHub } from './local-transport.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/network/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/network/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,qBAAqB,EAAE,MAAM,gBAAgB,CAAC;AACvD,YAAY,EAAE,eAAe,EAAE,gBAAgB,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAEzF,YAAY,EAAE,aAAa,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAE5G,OAAO,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AACxD,YAAY,EAAE,YAAY,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AAE/F,OAAO,EAAE,wBAAwB,EAAE,MAAM,mBAAmB,CAAC;AAC7D,YAAY,EAAE,wBAAwB,EAAE,MAAM,mBAAmB,CAAC;AAElE,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AACvC,YAAY,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAElD,OAAO,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAC5D,YAAY,EAAE,cAAc,EAAE,oBAAoB,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAEhG,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,YAAY,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC"}

package/dist/network/index.js

@@ -0,0 +1,10 @@
+/**
+ * @fileoverview Network module exports for P2P networking phase 4.
+ */
+export { createSignalingClient } from './signaling.js';
+export { createRTCTransport } from './rtc-transport.js';
+export { createWebSocketTransport } from './ws-transport.js';
+export { createMesh } from './mesh.js';
+export { createNetworkManager } from './network-manager.js';
+export { createLocalHub } from './local-transport.js';
+//# sourceMappingURL=index.js.map

package/dist/network/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/network/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,qBAAqB,EAAE,MAAM,gBAAgB,CAAC;AAKvD,OAAO,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AAGxD,OAAO,EAAE,wBAAwB,EAAE,MAAM,mBAAmB,CAAC;AAG7D,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAGvC,OAAO,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAG5D,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC"}

package/dist/network/introductions.d.ts

@@ -0,0 +1,85 @@
+/**
+ * @module introductions
+ * Letting peers introduce each other, so a relay is only needed to meet the
+ * first one.
+ *
+ * Two browsers cannot find each other unaided — neither can accept an incoming
+ * connection — so somebody has to make the introduction. That does not have to
+ * be a relay every time. Once you are connected to one peer, its data channel
+ * is a perfectly good channel for arranging the next connection, and the peers
+ * it already knows are exactly the ones you are looking for.
+ *
+ * So a relay shrinks from permanent infrastructure to a bootstrap hint: the way
+ * into a room you have never been in. After that the mesh introduces itself, and
+ * the relay can go away without anyone noticing.
+ *
+ * Two messages do it. `__peers` says who I can see; `__signal` carries somebody
+ * else's connection offer to somebody I can reach.
+ */
+/** Message types reserved for the mesh itself, never handed to the application */
+export declare const PEERS_MESSAGE = "__peers";
+export declare const SIGNAL_MESSAGE = "__signal";
+/** The peer handshake (`peer-auth.ts`): a nonce each way, then a proof each way */
+export declare const AUTH_HELLO_MESSAGE = "__auth-hello";
+export declare const AUTH_PROOF_MESSAGE = "__auth-proof";
+/** A peer is leaving a room, though the connection may go on for others */
+export declare const LEAVE_MESSAGE = "__leave";
+/** Whether a message belongs to the mesh rather than the application above it */
+export declare function isControlMessage(type: string): boolean;
+/** The most peers one introduction may name — more is someone trying to make us dial the world */
+export declare const MAX_INTRODUCED = 64;
+/** Whether a string could be a peer's name: a did:key of sane length */
+export declare function isPeerDid(value: unknown): value is string;
+/** Somebody else's signaling, travelling over a data channel */
+export interface RelayedSignal {
+    /** Distinguishes this from copies arriving by another route */
+    readonly id: string;
+    /** Who wants to connect */
+    readonly origin: string;
+    /** Who they want to connect to */
+    readonly target: string;
+    readonly kind: 'offer' | 'answer' | 'candidate';
+    readonly data: unknown;
+    /** Forwards left before this is dropped */
+    readonly hops: number;
+}
+/**
+ * How far a relayed signal travels.
+ *
+ * Three is generous for the shape these meshes take — everyone in a room tends
+ * to end up within a hop or two of everyone else — and it bounds the work a
+ * malicious peer can cause by injecting traffic.
+ */
+export declare const MAX_HOPS = 3;
+/**
+ * Decides which side opens the connection when two peers learn of each other
+ * at the same moment.
+ *
+ * Both being told about the other simultaneously is the normal case for an
+ * introduction, and both offering produces two half-open connections that then
+ * have to be unpicked. Comparing identifiers costs nothing and both sides
+ * always agree on the answer.
+ *
+ * @param us This peer
+ * @param them The peer just learned about
+ * @returns Whether this side should send the offer
+ */
+export declare function shouldInitiate(us: string, them: string): boolean;
+/** Remembers recently seen signals, so a flooded message is handled once. */
+export interface SeenSignals {
+    /** Records an id, returning whether it is new */
+    accept(id: string): boolean;
+}
+/**
+ * Creates a bounded record of signal ids.
+ *
+ * Bounded because it is fed by the network: an unbounded set would be a way for
+ * a peer to make this tab run out of memory.
+ *
+ * @param limit How many ids to remember
+ * @returns The record
+ */
+export declare function createSeenSignals(limit?: number): SeenSignals;
+/** A fresh identifier for a relayed signal. */
+export declare function signalId(): string;
+//# sourceMappingURL=introductions.d.ts.map

package/dist/network/introductions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"introductions.d.ts","sourceRoot":"","sources":["../../src/network/introductions.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,kFAAkF;AAClF,eAAO,MAAM,aAAa,YAAY,CAAC;AACvC,eAAO,MAAM,cAAc,aAAa,CAAC;AACzC,mFAAmF;AACnF,eAAO,MAAM,kBAAkB,iBAAiB,CAAC;AACjD,eAAO,MAAM,kBAAkB,iBAAiB,CAAC;AACjD,2EAA2E;AAC3E,eAAO,MAAM,aAAa,YAAY,CAAC;AAIvC,iFAAiF;AACjF,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAEtD;AAED,kGAAkG;AAClG,eAAO,MAAM,cAAc,KAAK,CAAC;AAEjC,wEAAwE;AACxE,wBAAgB,SAAS,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,MAAM,CAEzD;AAED,gEAAgE;AAChE,MAAM,WAAW,aAAa;IAC5B,+DAA+D;IAC/D,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,2BAA2B;IAC3B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,kCAAkC;IAClC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,IAAI,EAAE,OAAO,GAAG,QAAQ,GAAG,WAAW,CAAC;IAChD,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IACvB,2CAA2C;IAC3C,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAED;;;;;;GAMG;AACH,eAAO,MAAM,QAAQ,IAAI,CAAC;AAE1B;;;;;;;;;;;;GAYG;AACH,wBAAgB,cAAc,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAEhE;AAED,6EAA6E;AAC7E,MAAM,WAAW,WAAW;IAC1B,iDAAiD;IACjD,MAAM,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC;CAC7B;AAED;;;;;;;;GAQG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,GAAE,MAAY,GAAG,WAAW,CAiBlE;AAED,+CAA+C;AAC/C,wBAAgB,QAAQ,IAAI,MAAM,CAGjC"}

package/dist/network/introductions.js

@@ -0,0 +1,94 @@
+/**
+ * @module introductions
+ * Letting peers introduce each other, so a relay is only needed to meet the
+ * first one.
+ *
+ * Two browsers cannot find each other unaided — neither can accept an incoming
+ * connection — so somebody has to make the introduction. That does not have to
+ * be a relay every time. Once you are connected to one peer, its data channel
+ * is a perfectly good channel for arranging the next connection, and the peers
+ * it already knows are exactly the ones you are looking for.
+ *
+ * So a relay shrinks from permanent infrastructure to a bootstrap hint: the way
+ * into a room you have never been in. After that the mesh introduces itself, and
+ * the relay can go away without anyone noticing.
+ *
+ * Two messages do it. `__peers` says who I can see; `__signal` carries somebody
+ * else's connection offer to somebody I can reach.
+ */
+/** Message types reserved for the mesh itself, never handed to the application */
+export const PEERS_MESSAGE = '__peers';
+export const SIGNAL_MESSAGE = '__signal';
+/** The peer handshake (`peer-auth.ts`): a nonce each way, then a proof each way */
+export const AUTH_HELLO_MESSAGE = '__auth-hello';
+export const AUTH_PROOF_MESSAGE = '__auth-proof';
+/** A peer is leaving a room, though the connection may go on for others */
+export const LEAVE_MESSAGE = '__leave';
+const CONTROL = new Set([PEERS_MESSAGE, SIGNAL_MESSAGE, AUTH_HELLO_MESSAGE, AUTH_PROOF_MESSAGE, LEAVE_MESSAGE]);
+/** Whether a message belongs to the mesh rather than the application above it */
+export function isControlMessage(type) {
+    return CONTROL.has(type);
+}
+/** The most peers one introduction may name — more is someone trying to make us dial the world */
+export const MAX_INTRODUCED = 64;
+/** Whether a string could be a peer's name: a did:key of sane length */
+export function isPeerDid(value) {
+    return typeof value === 'string' && value.length <= 256 && /^did:key:z[1-9A-HJ-NP-Za-km-z]+$/.test(value);
+}
+/**
+ * How far a relayed signal travels.
+ *
+ * Three is generous for the shape these meshes take — everyone in a room tends
+ * to end up within a hop or two of everyone else — and it bounds the work a
+ * malicious peer can cause by injecting traffic.
+ */
+export const MAX_HOPS = 3;
+/**
+ * Decides which side opens the connection when two peers learn of each other
+ * at the same moment.
+ *
+ * Both being told about the other simultaneously is the normal case for an
+ * introduction, and both offering produces two half-open connections that then
+ * have to be unpicked. Comparing identifiers costs nothing and both sides
+ * always agree on the answer.
+ *
+ * @param us This peer
+ * @param them The peer just learned about
+ * @returns Whether this side should send the offer
+ */
+export function shouldInitiate(us, them) {
+    return us < them;
+}
+/**
+ * Creates a bounded record of signal ids.
+ *
+ * Bounded because it is fed by the network: an unbounded set would be a way for
+ * a peer to make this tab run out of memory.
+ *
+ * @param limit How many ids to remember
+ * @returns The record
+ */
+export function createSeenSignals(limit = 512) {
+    const seen = new Set();
+    const order = [];
+    return {
+        accept(id) {
+            if (seen.has(id))
+                return false;
+            seen.add(id);
+            order.push(id);
+            if (order.length > limit) {
+                const oldest = order.shift();
+                if (oldest !== undefined)
+                    seen.delete(oldest);
+            }
+            return true;
+        },
+    };
+}
+/** A fresh identifier for a relayed signal. */
+export function signalId() {
+    const bytes = globalThis.crypto.getRandomValues(new Uint8Array(8));
+    return Array.from(bytes, (byte) => byte.toString(16).padStart(2, '0')).join('');
+}
+//# sourceMappingURL=introductions.js.map

package/dist/network/introductions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"introductions.js","sourceRoot":"","sources":["../../src/network/introductions.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,kFAAkF;AAClF,MAAM,CAAC,MAAM,aAAa,GAAG,SAAS,CAAC;AACvC,MAAM,CAAC,MAAM,cAAc,GAAG,UAAU,CAAC;AACzC,mFAAmF;AACnF,MAAM,CAAC,MAAM,kBAAkB,GAAG,cAAc,CAAC;AACjD,MAAM,CAAC,MAAM,kBAAkB,GAAG,cAAc,CAAC;AACjD,2EAA2E;AAC3E,MAAM,CAAC,MAAM,aAAa,GAAG,SAAS,CAAC;AAEvC,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,CAAC,aAAa,EAAE,cAAc,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,aAAa,CAAC,CAAC,CAAC;AAEhH,iFAAiF;AACjF,MAAM,UAAU,gBAAgB,CAAC,IAAY;IAC3C,OAAO,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;AAC3B,CAAC;AAED,kGAAkG;AAClG,MAAM,CAAC,MAAM,cAAc,GAAG,EAAE,CAAC;AAEjC,wEAAwE;AACxE,MAAM,UAAU,SAAS,CAAC,KAAc;IACtC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,IAAI,GAAG,IAAI,kCAAkC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AAC5G,CAAC;AAgBD;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,QAAQ,GAAG,CAAC,CAAC;AAE1B;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,cAAc,CAAC,EAAU,EAAE,IAAY;IACrD,OAAO,EAAE,GAAG,IAAI,CAAC;AACnB,CAAC;AAQD;;;;;;;;GAQG;AACH,MAAM,UAAU,iBAAiB,CAAC,QAAgB,GAAG;IACnD,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,MAAM,KAAK,GAAa,EAAE,CAAC;IAE3B,OAAO;QACL,MAAM,CAAC,EAAU;YACf,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;gBAAE,OAAO,KAAK,CAAC;YAE/B,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YACb,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YACf,IAAI,KAAK,CAAC,MAAM,GAAG,KAAK,EAAE,CAAC;gBACzB,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,EAAE,CAAC;gBAC7B,IAAI,MAAM,KAAK,SAAS;oBAAE,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YAChD,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;KACF,CAAC;AACJ,CAAC;AAED,+CAA+C;AAC/C,MAAM,UAAU,QAAQ;IACtB,MAAM,KAAK,GAAG,UAAU,CAAC,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;IACnE,OAAO,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AAClF,CAAC"}