@weaveprotocol/core 0.2.0 → 0.2.1

package/README.md

@@ -4,6 +4,11 @@ A peer-to-peer data protocol for the browser. You own your identity as a
 written-down code, keep your data in signed records that sync directly between
 devices, and every app is a view onto that data rather than its owner.
 
+> **Building a client, or an agent that needs the architecture?** The
+> protocol is specified in [docs/spec](docs/spec/README.md): wire formats,
+> what is signed, and what every peer must check. The tests are its
+> executable half.
+
 ## Architecture
 
 ```
@@ -229,7 +234,7 @@ it must not be enough to reach you. What lets two people reach each other is a
 space they share. So **a contact is a private space for two**: records you
 write there wait for the other person, and live messages reach them when
 they're online. There's no directory to look people up in, and no inbox
-strangers can knock on.
+strangers can knock on — unless you open a door (below).
 
 ```typescript
 // In a space you share with Anna — the book club — ask her to add you.
@@ -277,6 +282,50 @@ contact key, which opens requests sent to you. Asking someone and accepting
 also make or join a space, so those need `scope: 'account'`, which includes
 the contacts. Agents never get them.
 
+### Doors
+
+Someone you share no space with can still ask to become your contact — if you
+give them a **door**. A door is a code you hand out on purpose (a link, a QR
+code, a line in your bio) and can close. It names a key derived from your
+contact key and the relays whose mailboxes hold knocks on it, and nothing
+about who you are.
+
+```typescript
+const door = await anna.doors.open();              // { id, code, relays, … }
+share(`https://chat.example/#door=${door.code}`);
+
+// Leif, who has never shared a space with Anna, pastes the link:
+await leif.doors.knock(link, { note: 'We met at the gig' });   // a space for two, its invite sealed to the door
+
+// Anna, whenever she's next online:
+const [knock] = await anna.doors.knocks();         // { from, name, note, pairSpace, … } — `from` is proven
+await anna.doors.accept(knock.id);                 // joins; Leif is a contact, and she is his once it syncs
+await anna.doors.close(door.id);                   // the code leads nowhere now; contacts stay
+```
+
+- **The relay keeps a mailbox**, the one thing it holds: a sealed blob under a
+  hash of the door's signing key, for up to 14 days. It sees addresses, as it
+  does for any socket, but not whose door it is, which account knocked, or what
+  they said. A door names up to three relays and a knock goes to all of them,
+  so no one relay can shut it.
+- **A knock proves who knocked** before anyone joins anything: it's signed by
+  the knocker's session key under a note for their whole account, like a
+  record, bound to the door it was left at and to when the relay took it.
+- **An answer proves who opened.** Accepting writes an answer in the space for
+  two, signed with the door's key: that, not joining, makes the owner the
+  knocker's contact, and the invite is closed behind them.
+- **The door is not the account.** Its key is not your contact key, so nobody
+  can link a door to your profile in any space. Every device with the contact
+  key opens the same doors.
+- **Spam** is capped at the mailbox (64 knocks a door; 4 a door and 30 in all
+  an hour from one address). `dismiss` lets one knock go without blocking,
+  blocking hides someone's knocks on every door, and a flooded door is cleared
+  by its owner (`clear`), so its code keeps working.
+
+Next: handles that lead to a door, so `@anna.bsky.social` works where a code
+does (planned in [07 — Doors](docs/spec/07-doors.md), Names). The full design is
+[docs/spec/07-doors.md](docs/spec/07-doors.md).
+
 ## Signing in — the element, and React
 
 Getting to a node takes a sign-in flow: where the data lives (a pod or this
@@ -1001,7 +1050,7 @@ interface StorageAdapter {
 - `createIndexedDBAdapter(name)` — works in every browser. Origin-scoped.
 - `createFolderAdapter(directory, namespace)` — a directory the user picked, via the File System Access API. **Not** origin-scoped. Chrome, Edge and Opera on the desktop.
 
-The always-on node (`weave run`) uses the folder adapter on disk, in the same layout. **Planned**: mirrors, which keep a space in storage the user already pays for (a Dropbox app folder, Drive, S3) and sync with it like a peer — see `docs/blocks/BLOCK-03-mirrors.md`. OPFS is not on the list: it is origin-private, so it would inherit exactly the limitation a data folder exists to avoid.
+The always-on node (`weave run`) uses the folder adapter on disk, in the same layout. **Planned**: mirrors, which keep a space in storage the user already pays for (a Dropbox app folder, Drive, S3) and sync with it like a peer — see [05 — Sync and storage](docs/spec/05-sync-and-storage.md). OPFS is not on the list: it is origin-private, so it would inherit exactly the limitation a data folder exists to avoid.
 
 ### Data folders — storage that outlives the origin
 
@@ -1247,7 +1296,7 @@ members pay for it. A subscription is a key the account makes and keeps in its
 registry (`sys.hosting`), so every device signs as it; `node.hosting.use(url)`
 starts one, and whichever device notices it is paid hands the host the carry
 space. Every call to the host is signed over method, path, time and body.
-The home knows nothing about payment (BLOCK-23): a host describes itself at
+The home knows nothing about payment ([06 — Nodes, sessions and apps](docs/spec/06-nodes-and-sessions.md), Hosts): a host describes itself at
 `/.well-known/weave-host` (like a Nostr relay's NIP-11 document), signs every
 status it gives — the home keeps the latest in the registry as the person's
 proof — and takes payments on its own pay page, which `node.hosting.payPage(url)`
@@ -1395,7 +1444,23 @@ the agents it finds, and they start `weave mcp` themselves: a node of its own,
 over WebRTC (`node-datachannel`), that follows the account and keeps working
 with every tab closed. What it writes shows "via agent", and every peer
 ignores an agent changing collections, who may do what, or the account's own
-list of spaces. See BLOCK-20.
+list of spaces. See [06 — Nodes, sessions and apps](docs/spec/06-nodes-and-sessions.md), Agents.
+
+## Still to do in the library
+
+What the protocol still has planned is in [the spec](docs/spec/README.md), under
+**Planned** in each part. Library work that isn't protocol:
+
+- **Typed queries, further.** Typed field paths and operator values in
+  `where`, a misspelled collection name as a compile error, typed link roles,
+  types generated from a space's stored definitions, and a dev-time warning
+  when declared schemas differ from the space's catalogue.
+- **Typed collections.** One TypeScript builder that emits the schema, the
+  rules and the types, and typed handles (`node.use(space, Poll)`).
+- **Definitions that update themselves.** `useSchemas` and `addApp` applying
+  harmless changes, with `differences()` in `src/schemas/apps.ts` replaced by
+  the planned `compare` ([02](docs/spec/02-records.md), compatible definitions).
+- **Web components** for the standard schemas.
 
 ## Releasing
 
@@ -1406,11 +1471,18 @@ workspace) are released together, always with the same version:
 npm run release
 ```
 
-It typechecks and runs the tests, then [bumpp](https://github.com/antfu-collective/bumpp)
+It checks you're logged in to npm first (and runs `npm login` if not),
+typechecks and runs the tests, then [bumpp](https://github.com/antfu-collective/bumpp)
 asks for the next version, writes it to both packages, and commits and tags
-it (`v0.1.2`). Both are published (each builds itself first: `dist/` for the
-core, one bundled file for the CLI), and only then is the commit pushed. The
-settings are in `bump.config.ts`.
+it (`v0.1.2`), locally. Both are published (each builds itself first: `dist/`
+for the core, one bundled file for the CLI), and only then are the commit and
+tag pushed.
+
+If a release stops partway — npm login, a one-time password, the network —
+fix it and run `npm run release` again. It sees the version isn't fully on npm
+yet and publishes what's missing, instead of bumping again. `npm run release
+-- --dry-run` does everything but publish and push. The script is
+`scripts/release.mjs`; bumpp's settings are in `bump.config.ts`.
 
 ## Tests
 

package/dist/doors/doors.d.ts

@@ -0,0 +1,139 @@
+/**
+ * @module doors
+ * Doors: how someone you share no space with can ask to become your contact.
+ *
+ * A DID is a name, not an address — knowing it must not be enough to reach
+ * you. A **door** is an address you hand out on purpose, and can close:
+ *
+ * - a **door key**, derived from your contact key and the door's id
+ *   (`deriveDoorKeyBytes`), which says nothing about the account behind it,
+ *   and a **signing key** beside it (`deriveDoorSignKeyBytes`) that proves
+ *   ownership of the door — to a relay clearing its mailbox, and to a knocker
+ *   when you answer;
+ * - the **relays** whose mailboxes hold knocks on it — two or three, chosen by
+ *   you, so no one relay can shut it.
+ *
+ * Both travel in a **door code** (a link, a QR code, a line in a bio). Someone
+ * with it **knocks**: makes a private space for the two of you, and leaves its
+ * invite, sealed to the door key, in the door's mailboxes. The knock is signed
+ * by the knocker's session key under their account's note, like a record, so
+ * it proves who knocked before anyone joins anything. Opening the door is
+ * joining that space.
+ *
+ * ```
+ * code   = base64url(JSON { v: 1, key, sign, relays, name? })
+ * topic  = base64url(SHA-256("weave/door-topic/v1|" + sign))
+ * knock  = sealFor(key, { body, sig }, "weave/knock/v1|" + key)
+ * body   = { v: 1, door: key, from, name, invite, note?, at, session, proof }
+ * sig    = session key signs canonical(body)
+ * ```
+ *
+ * The relay sees a topic and a sealed blob: not whose door it is, not who
+ * knocked, not what they said. See `docs/spec/07-doors.md`.
+ */
+import type { CryptoProvider } from '../types.js';
+/** A door names at most this many relays: enough that one going away doesn't matter */
+export declare const MAX_DOOR_RELAYS = 3;
+/** How long a knock waits in a mailbox, and so how old one may be when opened */
+export declare const KNOCK_TTL_SECONDS: number;
+/**
+ * How far a knock's own time may be from when the relay took it. A knock is
+ * dropped as soon as it is signed, so its time is checked against the relay's
+ * — which the knocker can't choose — and a note that ran out can't be used by
+ * dating a knock back to when it was good.
+ */
+export declare const KNOCK_DROP_WINDOW_SECONDS = 600;
+/** What a door code says: where to knock, and whose door the owner says it is */
+export interface DoorCode {
+    readonly v: 1;
+    /** The door key's public half: a compressed P-256 point, base64url. Knocks are sealed to it. */
+    readonly key: string;
+    /** The door's signing key's public half, likewise. Its hash is the door's topic. */
+    readonly sign: string;
+    /** Relays whose mailboxes hold knocks on it, 1–3 */
+    readonly relays: ReadonlyArray<string>;
+    /** Who the owner says they are — shown to the knocker, and proves nothing */
+    readonly name?: string;
+}
+/** What a knock carries, signed by the knocker's session key */
+export interface KnockBody {
+    readonly v: 1;
+    /** The door knocked on: its key. Binds the knock to this door. */
+    readonly door: string;
+    /** The knocker's account */
+    readonly from: string;
+    /** The name they give */
+    readonly name: string;
+    /** The invite to the space for two they made */
+    readonly invite: string;
+    readonly note?: string;
+    /** When it was signed, Unix seconds */
+    readonly at: number;
+    /** The session key that signed it */
+    readonly session: string;
+    /** The note from `from` to `session`: a UCAN whose chain ends at `from` */
+    readonly proof: string;
+}
+/** A knock that opened and checked out */
+export interface OpenedKnock {
+    readonly from: string;
+    readonly name: string;
+    readonly note?: string;
+    readonly invite: string;
+    /** The id of the space for two */
+    readonly pairSpace: string;
+    /** When it was signed, ms */
+    readonly at: number;
+}
+/** Cuts text to at most `max` characters without splitting one (a surrogate pair stays whole) */
+export declare function clip(text: string, max: number): string;
+/** Encodes a door code: what goes in a link or a QR code */
+export declare function encodeDoorCode(code: Omit<DoorCode, 'v'>): string;
+/**
+ * Reads a door code, or a link carrying one after `#door=` or `door=`.
+ * @throws When it isn't one, saying why
+ */
+export declare function parseDoorCode(text: string): DoorCode;
+/** Why a value is not a door code, or null */
+export declare function checkDoorCode(value: unknown): string | null;
+/**
+ * The mailbox topic of a door: a hash of its signing key. The relay can't tell
+ * whose door it is, and can check that whoever clears it holds that key.
+ */
+export declare function doorTopic(sign: string): Promise<string>;
+/**
+ * What a door's owner signs to clear knocks from a relay's mailbox: the topic,
+ * the relay's one-time challenge, and which knocks (`*` for all of them).
+ */
+export declare const purgeMessage: (topic: string, nonce: string, ids: ReadonlyArray<string> | null) => Uint8Array<ArrayBufferLike>;
+/** Signs a relay's purge challenge with the door's signing key */
+export declare function signPurge(signKey: Uint8Array, topic: string, nonce: string, ids: ReadonlyArray<string> | null): Promise<string>;
+export declare function signAnswer(signKey: Uint8Array, pairSpace: string, did: string): Promise<string>;
+export declare function checkAnswer(sign: string, pairSpace: string, did: string, signature: string): Promise<boolean>;
+/** A knock's id: the hash of its sealed blob, as relays file it */
+export declare function knockId(blob: string): Promise<string>;
+/**
+ * Makes a knock: the body, signed by the session key, sealed to the door key.
+ * @returns The sealed blob, for relays' mailboxes
+ */
+export declare function sealKnock(door: string, knock: {
+    readonly from: string;
+    readonly name: string;
+    readonly invite: string;
+    readonly note?: string;
+}, session: {
+    readonly did: string;
+    readonly key: CryptoKey;
+    readonly proof: string;
+}, provider: CryptoProvider): Promise<string>;
+/**
+ * Opens a knock left on a door, and checks it through: sealed to this door;
+ * signed by a session key that its account's note vouches for, for the whole
+ * account and not by an agent; signed when the relay took it; recent; and
+ * carrying an invite to a private space that account made.
+ * @param doorKey The door key's private scalar (`deriveDoorKeyBytes`)
+ * @param receivedAt When the relay took it, ms, as `fetch` says
+ * @returns The knock, or null when it is anything less
+ */
+export declare function openKnock(doorKey: Uint8Array, blob: string, receivedAt: number, provider: CryptoProvider): Promise<OpenedKnock | null>;
+//# sourceMappingURL=doors.d.ts.map

package/dist/doors/doors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"doors.d.ts","sourceRoot":"","sources":["../../src/doors/doors.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAYlD,uFAAuF;AACvF,eAAO,MAAM,eAAe,IAAI,CAAC;AACjC,iFAAiF;AACjF,eAAO,MAAM,iBAAiB,QAAiB,CAAC;AAChD;;;;;GAKG;AACH,eAAO,MAAM,yBAAyB,MAAM,CAAC;AAM7C,iFAAiF;AACjF,MAAM,WAAW,QAAQ;IACvB,QAAQ,CAAC,CAAC,EAAE,CAAC,CAAC;IACd,gGAAgG;IAChG,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,oFAAoF;IACpF,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,oDAAoD;IACpD,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IACvC,6EAA6E;IAC7E,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,gEAAgE;AAChE,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,CAAC,EAAE,CAAC,CAAC;IACd,kEAAkE;IAClE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,4BAA4B;IAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,yBAAyB;IACzB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,gDAAgD;IAChD,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,uCAAuC;IACvC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,qCAAqC;IACrC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,2EAA2E;IAC3E,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB;AAED,0CAA0C;AAC1C,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,kCAAkC;IAClC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,6BAA6B;IAC7B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;CACrB;AAED,iGAAiG;AACjG,wBAAgB,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAGtD;AAED,4DAA4D;AAC5D,wBAAgB,cAAc,CAAC,IAAI,EAAE,IAAI,CAAC,QAAQ,EAAE,GAAG,CAAC,GAAG,MAAM,CAMhE;AAED;;;GAGG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,QAAQ,CAcpD;AAED,8CAA8C;AAC9C,wBAAgB,aAAa,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,GAAG,IAAI,CAY3D;AAED;;;GAGG;AACH,wBAAsB,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAE7D;AAED;;;GAGG;AACH,eAAO,MAAM,YAAY,GAAI,OAAO,MAAM,EAAE,OAAO,MAAM,EAAE,KAAK,aAAa,CAAC,MAAM,CAAC,GAAG,IAAI,gCACE,CAAC;AAE/F,kEAAkE;AAClE,wBAAgB,SAAS,CAAC,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,aAAa,CAAC,MAAM,CAAC,GAAG,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,CAE/H;AAUD,wBAAgB,UAAU,CAAC,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAE/F;AAED,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAE7G;AAED,mEAAmE;AACnE,wBAAsB,OAAO,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAE3D;AAID;;;GAGG;AACH,wBAAsB,SAAS,CAC7B,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE,EACxG,OAAO,EAAE;IAAE,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,GAAG,EAAE,SAAS,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;CAAE,EAClF,QAAQ,EAAE,cAAc,GACvB,OAAO,CAAC,MAAM,CAAC,CAejB;AAED;;;;;;;;GAQG;AACH,wBAAsB,SAAS,CAAC,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,cAAc,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAwD5I"}

package/dist/doors/doors.js

@@ -0,0 +1,210 @@
+import { contactKeyPair, contactPublicKey, isContactPublicKey, openSealed, sealFor, signWithScalar, verifyWithPoint } from '../identity/contact-key.js';
+import { didToPublicKey } from '../identity/did.js';
+import { resolveDelegationRoot, UCAN_CLOCK_SKEW_SECONDS } from '../identity/ucan.js';
+import { isAgentNote } from '../identity/agent-note.js';
+import { canonicalize } from '../schema/expression.js';
+import { parseSpaceInvite } from '../space/space-manager.js';
+import { checkSpace } from '../space/space-access.js';
+import { checkRelays } from '../space/roles.js';
+import { sha256 } from '../utils/hash.js';
+import { base64UrlDecode, base64UrlEncode, utf8Decode, utf8Encode } from '../utils/encoding.js';
+/** A door names at most this many relays: enough that one going away doesn't matter */
+export const MAX_DOOR_RELAYS = 3;
+/** How long a knock waits in a mailbox, and so how old one may be when opened */
+export const KNOCK_TTL_SECONDS = 14 * 24 * 3600;
+/**
+ * How far a knock's own time may be from when the relay took it. A knock is
+ * dropped as soon as it is signed, so its time is checked against the relay's
+ * — which the knocker can't choose — and a note that ran out can't be used by
+ * dating a knock back to when it was good.
+ */
+export const KNOCK_DROP_WINDOW_SECONDS = 600;
+const MAX_NAME = 64;
+const MAX_NOTE = 2000;
+const MAX_INVITE = 6000;
+const MAX_PROOF = 4096;
+/** Cuts text to at most `max` characters without splitting one (a surrogate pair stays whole) */
+export function clip(text, max) {
+    const chars = Array.from(text);
+    return chars.length <= max ? text : chars.slice(0, max).join('');
+}
+/** Encodes a door code: what goes in a link or a QR code */
+export function encodeDoorCode(code) {
+    const problem = checkDoorCode({ v: 1, ...code });
+    if (problem)
+        throw new Error(problem);
+    return base64UrlEncode(utf8Encode(canonicalize({ v: 1, key: code.key, sign: code.sign, relays: [...code.relays], ...(code.name ? { name: code.name } : {}) })));
+}
+/**
+ * Reads a door code, or a link carrying one after `#door=` or `door=`.
+ * @throws When it isn't one, saying why
+ */
+export function parseDoorCode(text) {
+    const trimmed = text.trim();
+    const found = /(?:^|[#?&])door=([A-Za-z0-9_-]+)/.exec(trimmed);
+    const raw = found ? found[1] : trimmed;
+    let parsed;
+    try {
+        parsed = JSON.parse(utf8Decode(base64UrlDecode(raw)));
+    }
+    catch {
+        throw new Error('That is not a door code — it may be cut short.');
+    }
+    const problem = checkDoorCode(parsed);
+    if (problem)
+        throw new Error(`That door code doesn't work: ${problem}`);
+    const code = parsed;
+    return Object.freeze({ v: 1, key: code.key, sign: code.sign, relays: Object.freeze([...code.relays]), ...(code.name ? { name: code.name } : {}) });
+}
+/** Why a value is not a door code, or null */
+export function checkDoorCode(value) {
+    const code = value;
+    if (!code || typeof code !== 'object' || code.v !== 1)
+        return 'it is not a version 1 door';
+    if (!isContactPublicKey(code.key))
+        return 'its key is not a P-256 public key';
+    if (!isContactPublicKey(code.sign) || code.sign === code.key)
+        return 'its signing key is not a P-256 public key of its own';
+    if (!Array.isArray(code.relays) || code.relays.length === 0 || code.relays.length > MAX_DOOR_RELAYS) {
+        return `it names 1–${MAX_DOOR_RELAYS} relays`;
+    }
+    const relays = checkRelays(code.relays);
+    if (relays)
+        return relays;
+    if (code.name !== undefined && (typeof code.name !== 'string' || Array.from(code.name).length > MAX_NAME))
+        return `its name is text of at most ${MAX_NAME} characters`;
+    return null;
+}
+/**
+ * The mailbox topic of a door: a hash of its signing key. The relay can't tell
+ * whose door it is, and can check that whoever clears it holds that key.
+ */
+export async function doorTopic(sign) {
+    return base64UrlEncode(await sha256(utf8Encode(`weave/door-topic/v1|${sign}`)));
+}
+/**
+ * What a door's owner signs to clear knocks from a relay's mailbox: the topic,
+ * the relay's one-time challenge, and which knocks (`*` for all of them).
+ */
+export const purgeMessage = (topic, nonce, ids) => utf8Encode(`weave/door-purge/v1|${topic}|${nonce}|${ids ? [...ids].sort().join(',') : '*'}`);
+/** Signs a relay's purge challenge with the door's signing key */
+export function signPurge(signKey, topic, nonce, ids) {
+    return signWithScalar(signKey, purgeMessage(topic, nonce, ids));
+}
+/**
+ * The answer to a knock: the door's owner, signing with the door's signing key
+ * that the account which joined the space for two is theirs. Without it,
+ * whoever joined first — someone the invite was passed on to — would be taken
+ * for the person behind the door.
+ */
+const answerMessage = (pairSpace, did) => utf8Encode(`weave/knock-answer/v1|${pairSpace}|${did}`);
+export function signAnswer(signKey, pairSpace, did) {
+    return signWithScalar(signKey, answerMessage(pairSpace, did));
+}
+export function checkAnswer(sign, pairSpace, did, signature) {
+    return verifyWithPoint(sign, answerMessage(pairSpace, did), signature);
+}
+/** A knock's id: the hash of its sealed blob, as relays file it */
+export async function knockId(blob) {
+    return base64UrlEncode(await sha256(utf8Encode(blob)));
+}
+const knockContext = (door) => `weave/knock/v1|${door}`;
+/**
+ * Makes a knock: the body, signed by the session key, sealed to the door key.
+ * @returns The sealed blob, for relays' mailboxes
+ */
+export async function sealKnock(door, knock, session, provider) {
+    const note = knock.note ? clip(knock.note.trim(), MAX_NOTE) : undefined;
+    const body = {
+        v: 1,
+        door,
+        from: knock.from,
+        name: clip(knock.name.trim(), MAX_NAME) || 'Someone',
+        invite: knock.invite,
+        ...(note ? { note } : {}),
+        at: Math.floor(Date.now() / 1000),
+        session: session.did,
+        proof: session.proof,
+    };
+    const sig = base64UrlEncode(await provider.sign(session.key, utf8Encode(canonicalize(body))));
+    return sealFor(door, { body, sig }, knockContext(door));
+}
+/**
+ * Opens a knock left on a door, and checks it through: sealed to this door;
+ * signed by a session key that its account's note vouches for, for the whole
+ * account and not by an agent; signed when the relay took it; recent; and
+ * carrying an invite to a private space that account made.
+ * @param doorKey The door key's private scalar (`deriveDoorKeyBytes`)
+ * @param receivedAt When the relay took it, ms, as `fetch` says
+ * @returns The knock, or null when it is anything less
+ */
+export async function openKnock(doorKey, blob, receivedAt, provider) {
+    const door = contactPublicKey(doorKey);
+    const opened = (await openSealed((await contactKeyPair(doorKey)).privateKey, blob, knockContext(door)));
+    const body = opened?.body;
+    if (!body || typeof opened.sig !== 'string')
+        return null;
+    if (body.v !== 1 || body.door !== door)
+        return null;
+    if (typeof body.from !== 'string' || typeof body.session !== 'string' || typeof body.name !== 'string')
+        return null;
+    if (Array.from(body.name).length > MAX_NAME)
+        return null;
+    if (typeof body.invite !== 'string' || body.invite.length > MAX_INVITE)
+        return null;
+    if (typeof body.proof !== 'string' || body.proof.length > MAX_PROOF)
+        return null;
+    if (body.note !== undefined && (typeof body.note !== 'string' || Array.from(body.note).length > MAX_NOTE))
+        return null;
+    if (!Number.isSafeInteger(body.at) || !Number.isFinite(receivedAt))
+        return null;
+    const now = Math.floor(Date.now() / 1000);
+    if (body.at > now + UCAN_CLOCK_SKEW_SECONDS || body.at < now - KNOCK_TTL_SECONDS)
+        return null;
+    // Signed when it was dropped, not dated back to when a note was still good.
+    const dropped = Math.floor(receivedAt / 1000);
+    if (body.at > dropped + UCAN_CLOCK_SKEW_SECONDS || body.at < dropped - KNOCK_DROP_WINDOW_SECONDS)
+        return null;
+    // Signed by the session key it names…
+    let signed = false;
+    try {
+        const key = await provider.importPublicKey(didToPublicKey(body.session).publicKeyBytes);
+        signed = await provider.verify(key, base64UrlDecode(opened.sig), utf8Encode(canonicalize(body)));
+    }
+    catch {
+        return null;
+    }
+    if (!signed)
+        return null;
+    // …which the account it claims had delegated to when it signed. Agents never knock.
+    if (isAgentNote(body.proof))
+        return null;
+    const chain = await resolveDelegationRoot(body.proof, () => null, provider, { at: body.at }).catch(() => null);
+    if (!chain?.valid || chain.audience !== body.session || chain.rootDid !== body.from)
+        return null;
+    // Knocking makes a space and hands out its invite: only a note for the whole
+    // account, to write, may. An app given one space, or only to read, may not.
+    if (!chain.capabilities.some((capability) => capability.with === '*' && (capability.can === 'expression/*' || capability.can === '*')))
+        return null;
+    // A private space the knocker made, with its key: anything else isn't a space for two from them.
+    let invited;
+    try {
+        invited = parseSpaceInvite(body.invite);
+    }
+    catch {
+        return null;
+    }
+    if (invited.space.creator !== body.from || invited.space.visibility !== 'private' || !invited.key)
+        return null;
+    if ((await checkSpace(invited.space)) !== null)
+        return null;
+    return Object.freeze({
+        from: body.from,
+        name: clip(body.name, MAX_NAME) || 'Someone',
+        ...(body.note ? { note: body.note } : {}),
+        invite: body.invite,
+        pairSpace: invited.space.id,
+        at: body.at * 1000,
+    });
+}
+//# sourceMappingURL=doors.js.map

package/dist/doors/doors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"doors.js","sourceRoot":"","sources":["../../src/doors/doors.ts"],"names":[],"mappings":"AAkCA,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,UAAU,EAAE,OAAO,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAC;AACxJ,OAAO,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACpD,OAAO,EAAE,qBAAqB,EAAE,uBAAuB,EAAE,MAAM,qBAAqB,CAAC;AACrF,OAAO,EAAE,WAAW,EAAE,MAAM,2BAA2B,CAAC;AACxD,OAAO,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AACvD,OAAO,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAC;AAC7D,OAAO,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAC;AACtD,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAC1C,OAAO,EAAE,eAAe,EAAE,eAAe,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAEhG,uFAAuF;AACvF,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC;AACjC,iFAAiF;AACjF,MAAM,CAAC,MAAM,iBAAiB,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAChD;;;;;GAKG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,GAAG,CAAC;AAC7C,MAAM,QAAQ,GAAG,EAAE,CAAC;AACpB,MAAM,QAAQ,GAAG,IAAI,CAAC;AACtB,MAAM,UAAU,GAAG,IAAI,CAAC;AACxB,MAAM,SAAS,GAAG,IAAI,CAAC;AA+CvB,iGAAiG;AACjG,MAAM,UAAU,IAAI,CAAC,IAAY,EAAE,GAAW;IAC5C,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC/B,OAAO,KAAK,CAAC,MAAM,IAAI,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AACnE,CAAC;AAED,4DAA4D;AAC5D,MAAM,UAAU,cAAc,CAAC,IAAyB;IACtD,MAAM,OAAO,GAAG,aAAa,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,GAAG,IAAI,EAAE,CAAC,CAAC;IACjD,IAAI,OAAO;QAAE,MAAM,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC;IACtC,OAAO,eAAe,CACpB,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,EAAE,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CACxI,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,aAAa,CAAC,IAAY;IACxC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;IAC5B,MAAM,KAAK,GAAG,kCAAkC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC/D,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,CAAC,CAAC,OAAO,CAAC;IACxC,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IACxD,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;IACpE,CAAC;IACD,MAAM,OAAO,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC;IACtC,IAAI,OAAO;QAAE,MAAM,IAAI,KAAK,CAAC,gCAAgC,OAAO,EAAE,CAAC,CAAC;IACxE,MAAM,IAAI,GAAG,MAAkB,CAAC;IAChC,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,EAAE,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;AACrJ,CAAC;AAED,8CAA8C;AAC9C,MAAM,UAAU,aAAa,CAAC,KAAc;IAC1C,MAAM,IAAI,GAAG,KAAiC,CAAC;IAC/C,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,CAAC,KAAK,CAAC;QAAE,OAAO,4BAA4B,CAAC;IAC3F,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,mCAAmC,CAAC;IAC9E,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,KAAK,IAAI,CAAC,GAAG;QAAE,OAAO,sDAAsD,CAAC;IAC5H,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,GAAG,eAAe,EAAE,CAAC;QACpG,OAAO,cAAc,eAAe,SAAS,CAAC;IAChD,CAAC;IACD,MAAM,MAAM,GAAG,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACxC,IAAI,MAAM;QAAE,OAAO,MAAM,CAAC;IAC1B,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,IAAI,CAAC,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,GAAG,QAAQ,CAAC;QAAE,OAAO,+BAA+B,QAAQ,aAAa,CAAC;IACvK,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,IAAY;IAC1C,OAAO,eAAe,CAAC,MAAM,MAAM,CAAC,UAAU,CAAC,uBAAuB,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;AAClF,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,KAAa,EAAE,KAAa,EAAE,GAAiC,EAAE,EAAE,CAC9F,UAAU,CAAC,uBAAuB,KAAK,IAAI,KAAK,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC;AAE/F,kEAAkE;AAClE,MAAM,UAAU,SAAS,CAAC,OAAmB,EAAE,KAAa,EAAE,KAAa,EAAE,GAAiC;IAC5G,OAAO,cAAc,CAAC,OAAO,EAAE,YAAY,CAAC,KAAK,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC;AAClE,CAAC;AAED;;;;;GAKG;AACH,MAAM,aAAa,GAAG,CAAC,SAAiB,EAAE,GAAW,EAAE,EAAE,CAAC,UAAU,CAAC,yBAAyB,SAAS,IAAI,GAAG,EAAE,CAAC,CAAC;AAElH,MAAM,UAAU,UAAU,CAAC,OAAmB,EAAE,SAAiB,EAAE,GAAW;IAC5E,OAAO,cAAc,CAAC,OAAO,EAAE,aAAa,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC,CAAC;AAChE,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,IAAY,EAAE,SAAiB,EAAE,GAAW,EAAE,SAAiB;IACzF,OAAO,eAAe,CAAC,IAAI,EAAE,aAAa,CAAC,SAAS,EAAE,GAAG,CAAC,EAAE,SAAS,CAAC,CAAC;AACzE,CAAC;AAED,mEAAmE;AACnE,MAAM,CAAC,KAAK,UAAU,OAAO,CAAC,IAAY;IACxC,OAAO,eAAe,CAAC,MAAM,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AACzD,CAAC;AAED,MAAM,YAAY,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,kBAAkB,IAAI,EAAE,CAAC;AAEhE;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,IAAY,EACZ,KAAwG,EACxG,OAAkF,EAClF,QAAwB;IAExB,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACxE,MAAM,IAAI,GAAc;QACtB,CAAC,EAAE,CAAC;QACJ,IAAI;QACJ,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,QAAQ,CAAC,IAAI,SAAS;QACpD,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACzB,EAAE,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;QACjC,OAAO,EAAE,OAAO,CAAC,GAAG;QACpB,KAAK,EAAE,OAAO,CAAC,KAAK;KACrB,CAAC;IACF,MAAM,GAAG,GAAG,eAAe,CAAC,MAAM,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,UAAU,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IAC9F,OAAO,OAAO,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC;AAC1D,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,OAAmB,EAAE,IAAY,EAAE,UAAkB,EAAE,QAAwB;IAC7G,MAAM,IAAI,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;IACvC,MAAM,MAAM,GAAG,CAAC,MAAM,UAAU,CAAC,CAAC,MAAM,cAAc,CAAC,OAAO,CAAC,CAAC,CAAC,UAAU,EAAE,IAAI,EAAE,YAAY,CAAC,IAAI,CAAC,CAAC,CAG9F,CAAC;IACT,MAAM,IAAI,GAAG,MAAM,EAAE,IAAI,CAAC;IAC1B,IAAI,CAAC,IAAI,IAAI,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACzD,IAAI,IAAI,CAAC,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,IAAI,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IACpD,IAAI,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,IAAI,OAAO,IAAI,CAAC,OAAO,KAAK,QAAQ,IAAI,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACpH,IAAI,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,GAAG,QAAQ;QAAE,OAAO,IAAI,CAAC;IACzD,IAAI,OAAO,IAAI,CAAC,MAAM,KAAK,QAAQ,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,GAAG,UAAU;QAAE,OAAO,IAAI,CAAC;IACpF,IAAI,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,SAAS;QAAE,OAAO,IAAI,CAAC;IACjF,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,IAAI,CAAC,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,GAAG,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC;IACvH,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC;QAAE,OAAO,IAAI,CAAC;IAChF,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IAC1C,IAAI,IAAI,CAAC,EAAE,GAAG,GAAG,GAAG,uBAAuB,IAAI,IAAI,CAAC,EAAE,GAAG,GAAG,GAAG,iBAAiB;QAAE,OAAO,IAAI,CAAC;IAC9F,4EAA4E;IAC5E,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU,GAAG,IAAI,CAAC,CAAC;IAC9C,IAAI,IAAI,CAAC,EAAE,GAAG,OAAO,GAAG,uBAAuB,IAAI,IAAI,CAAC,EAAE,GAAG,OAAO,GAAG,yBAAyB;QAAE,OAAO,IAAI,CAAC;IAE9G,sCAAsC;IACtC,IAAI,MAAM,GAAG,KAAK,CAAC;IACnB,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,eAAe,CAAC,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,cAAc,CAAC,CAAC;QACxF,MAAM,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAC,GAAG,EAAE,eAAe,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,UAAU,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACnG,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IACzB,oFAAoF;IACpF,IAAI,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACzC,MAAM,KAAK,GAAG,MAAM,qBAAqB,CAAC,IAAI,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;IAC/G,IAAI,CAAC,KAAK,EAAE,KAAK,IAAI,KAAK,CAAC,QAAQ,KAAK,IAAI,CAAC,OAAO,IAAI,KAAK,CAAC,OAAO,KAAK,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IACjG,6EAA6E;IAC7E,4EAA4E;IAC5E,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,KAAK,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,KAAK,cAAc,IAAI,UAAU,CAAC,GAAG,KAAK,GAAG,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAEpJ,iGAAiG;IACjG,IAAI,OAAO,CAAC;IACZ,IAAI,CAAC;QACH,OAAO,GAAG,gBAAgB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC1C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,OAAO,CAAC,KAAK,CAAC,OAAO,KAAK,IAAI,CAAC,IAAI,IAAI,OAAO,CAAC,KAAK,CAAC,UAAU,KAAK,SAAS,IAAI,CAAC,OAAO,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IAC/G,IAAI,CAAC,MAAM,UAAU,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAE5D,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,IAAI,SAAS;QAC5C,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACzC,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,SAAS,EAAE,OAAO,CAAC,KAAK,CAAC,EAAE;QAC3B,EAAE,EAAE,IAAI,CAAC,EAAE,GAAG,IAAI;KACnB,CAAC,CAAC;AACL,CAAC"}

package/dist/doors/index.d.ts

@@ -0,0 +1,9 @@
+/**
+ * @module doors
+ * Doors and knocks — see `doors.ts`, and `node.doors` for the API an app uses.
+ */
+export { encodeDoorCode, parseDoorCode, checkDoorCode, doorTopic, knockId, sealKnock, openKnock, signPurge, purgeMessage, signAnswer, checkAnswer, clip, KNOCK_DROP_WINDOW_SECONDS, MAX_DOOR_RELAYS, KNOCK_TTL_SECONDS, } from './doors.js';
+export type { DoorCode, KnockBody, OpenedKnock } from './doors.js';
+export { createMailboxClient } from '../network/mailbox.js';
+export type { MailboxClient, MailboxOptions, MailItem } from '../network/mailbox.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/doors/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/doors/index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EACL,cAAc,EACd,aAAa,EACb,aAAa,EACb,SAAS,EACT,OAAO,EACP,SAAS,EACT,SAAS,EACT,SAAS,EACT,YAAY,EACZ,UAAU,EACV,WAAW,EACX,IAAI,EACJ,yBAAyB,EACzB,eAAe,EACf,iBAAiB,GAClB,MAAM,YAAY,CAAC;AACpB,YAAY,EAAE,QAAQ,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AACnE,OAAO,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAC5D,YAAY,EAAE,aAAa,EAAE,cAAc,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAC"}

package/dist/doors/index.js

@@ -0,0 +1,7 @@
+/**
+ * @module doors
+ * Doors and knocks — see `doors.ts`, and `node.doors` for the API an app uses.
+ */
+export { encodeDoorCode, parseDoorCode, checkDoorCode, doorTopic, knockId, sealKnock, openKnock, signPurge, purgeMessage, signAnswer, checkAnswer, clip, KNOCK_DROP_WINDOW_SECONDS, MAX_DOOR_RELAYS, KNOCK_TTL_SECONDS, } from './doors.js';
+export { createMailboxClient } from '../network/mailbox.js';
+//# sourceMappingURL=index.js.map

package/dist/doors/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/doors/index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EACL,cAAc,EACd,aAAa,EACb,aAAa,EACb,SAAS,EACT,OAAO,EACP,SAAS,EACT,SAAS,EACT,SAAS,EACT,YAAY,EACZ,UAAU,EACV,WAAW,EACX,IAAI,EACJ,yBAAyB,EACzB,eAAe,EACf,iBAAiB,GAClB,MAAM,YAAY,CAAC;AAEpB,OAAO,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC"}

package/dist/identity/contact-key.d.ts

@@ -20,6 +20,32 @@ export declare function deriveContactKeyBytes(seed: Uint8Array): Promise<Uint8Ar
  * @param accountKey The vault key bytes (`deriveVaultKeyBytes(seed)`)
  */
 export declare function deriveMemberKeyBytes(accountKey: Uint8Array, spaceId: string): Promise<Uint8Array>;
+/**
+ * A **door key**: the key a door's knocks are sealed to (`doors/doors.ts`).
+ * Derived from the contact key and the door's id, so every device and app
+ * holding the contact key opens the same doors, and a new door is a new id.
+ *
+ * Not the contact key itself: that one's public half is on your profile in
+ * every space you write in, and a door is handed to people who may not know
+ * who you are yet. A door key says nothing about the account behind it.
+ * @param contactKey The contact key's private scalar (`deriveContactKeyBytes`)
+ * @param doorId The door's id, as its `std.door` record names it
+ */
+export declare function deriveDoorKeyBytes(contactKey: Uint8Array, doorId: string): Promise<Uint8Array>;
+/**
+ * A door's **signing key**: what proves you own a door, without saying whose
+ * it is — to a relay, when clearing the door's mailbox, and to someone who
+ * knocked, when you answer. Separate from the door key, which only opens
+ * knocks: one key should not both sign and decrypt.
+ */
+export declare function deriveDoorSignKeyBytes(contactKey: Uint8Array, doorId: string): Promise<Uint8Array>;
+/**
+ * Signs with a P-256 private scalar: ECDSA over SHA-256, 64 bytes r ‖ s,
+ * base64url — for door signing keys.
+ */
+export declare function signWithScalar(secret: Uint8Array, data: Uint8Array): Promise<string>;
+/** Checks what `signWithScalar` signed, against a compressed public key (base64url) */
+export declare function verifyWithPoint(publicKey: string, data: Uint8Array, signature: string): Promise<boolean>;
 /** The public half, from the private scalar */
 export declare function contactPublicKey(secret: Uint8Array): string;
 /** Whether a string is a contact key's public half: a point on P-256 */

package/dist/identity/contact-key.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"contact-key.d.ts","sourceRoot":"","sources":["../../src/identity/contact-key.ts"],"names":[],"mappings":"AAkCA,MAAM,WAAW,cAAc;IAC7B,oFAAoF;IACpF,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,wFAAwF;IACxF,QAAQ,CAAC,UAAU,EAAE,SAAS,CAAC;CAChC;AAYD;;;GAGG;AACH,wBAAsB,qBAAqB,CAAC,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC,CAEjF;AAED;;;;;;;;;GASG;AACH,wBAAsB,oBAAoB,CAAC,UAAU,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CAEvG;AAED,+CAA+C;AAC/C,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,UAAU,GAAG,MAAM,CAE3D;AAED,wEAAwE;AACxE,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,MAAM,CAQlE;AAED,sEAAsE;AACtE,wBAAsB,cAAc,CAAC,MAAM,EAAE,UAAU,GAAG,OAAO,CAAC,cAAc,CAAC,CAiBhF;AASD;;;;;;GAMG;AACH,wBAAsB,OAAO,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAqBjG;AAED;;;GAGG;AACH,wBAAsB,UAAU,CAAC,UAAU,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CA2BzG"}
+{"version":3,"file":"contact-key.d.ts","sourceRoot":"","sources":["../../src/identity/contact-key.ts"],"names":[],"mappings":"AAoCA,MAAM,WAAW,cAAc;IAC7B,oFAAoF;IACpF,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,wFAAwF;IACxF,QAAQ,CAAC,UAAU,EAAE,SAAS,CAAC;CAChC;AAYD;;;GAGG;AACH,wBAAsB,qBAAqB,CAAC,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC,CAEjF;AAED;;;;;;;;;GASG;AACH,wBAAsB,oBAAoB,CAAC,UAAU,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CAEvG;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,kBAAkB,CAAC,UAAU,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CAEpG;AAED;;;;;GAKG;AACH,wBAAsB,sBAAsB,CAAC,UAAU,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CAExG;AAED;;;GAGG;AACH,wBAAsB,cAAc,CAAC,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,CAiB1F;AAED,uFAAuF;AACvF,wBAAsB,eAAe,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAQ9G;AAED,+CAA+C;AAC/C,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,UAAU,GAAG,MAAM,CAE3D;AAED,wEAAwE;AACxE,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,MAAM,CAQlE;AAED,sEAAsE;AACtE,wBAAsB,cAAc,CAAC,MAAM,EAAE,UAAU,GAAG,OAAO,CAAC,cAAc,CAAC,CAiBhF;AASD;;;;;;GAMG;AACH,wBAAsB,OAAO,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAqBjG;AAED;;;GAGG;AACH,wBAAsB,UAAU,CAAC,UAAU,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CA2BzG"}

package/dist/identity/contact-key.js

@@ -25,6 +25,8 @@ import { base64UrlDecode, base64UrlEncode, utf8Decode, utf8Encode } from '../uti
 const CONTACT_KEY_INFO = 'weave/p256-contact-key/v1';
 const SEAL_INFO = 'weave/contact-seal/v1';
 const MEMBER_KEY_INFO = 'weave/p256-member-key/v1';
+const DOOR_KEY_INFO = 'weave/p256-door-key/v1';
+const DOOR_SIGN_KEY_INFO = 'weave/p256-door-sign-key/v1';
 /** 48 bytes reduce to a P-256 scalar without bias, as for the root key (`crypto-p256.ts`) */
 const P256_SEED_BYTES = 48;
 const POINT_BYTES = 65;
@@ -54,6 +56,56 @@ export async function deriveContactKeyBytes(seed) {
 export async function deriveMemberKeyBytes(accountKey, spaceId) {
     return p256.utils.randomSecretKey(await hkdf(accountKey, `${MEMBER_KEY_INFO}|${spaceId}`, P256_SEED_BYTES));
 }
+/**
+ * A **door key**: the key a door's knocks are sealed to (`doors/doors.ts`).
+ * Derived from the contact key and the door's id, so every device and app
+ * holding the contact key opens the same doors, and a new door is a new id.
+ *
+ * Not the contact key itself: that one's public half is on your profile in
+ * every space you write in, and a door is handed to people who may not know
+ * who you are yet. A door key says nothing about the account behind it.
+ * @param contactKey The contact key's private scalar (`deriveContactKeyBytes`)
+ * @param doorId The door's id, as its `std.door` record names it
+ */
+export async function deriveDoorKeyBytes(contactKey, doorId) {
+    return p256.utils.randomSecretKey(await hkdf(contactKey, `${DOOR_KEY_INFO}|${doorId}`, P256_SEED_BYTES));
+}
+/**
+ * A door's **signing key**: what proves you own a door, without saying whose
+ * it is — to a relay, when clearing the door's mailbox, and to someone who
+ * knocked, when you answer. Separate from the door key, which only opens
+ * knocks: one key should not both sign and decrypt.
+ */
+export async function deriveDoorSignKeyBytes(contactKey, doorId) {
+    return p256.utils.randomSecretKey(await hkdf(contactKey, `${DOOR_SIGN_KEY_INFO}|${doorId}`, P256_SEED_BYTES));
+}
+/**
+ * Signs with a P-256 private scalar: ECDSA over SHA-256, 64 bytes r ‖ s,
+ * base64url — for door signing keys.
+ */
+export async function signWithScalar(secret, data) {
+    const point = p256.getPublicKey(secret, false);
+    const key = await globalThis.crypto.subtle.importKey('jwk', {
+        kty: 'EC',
+        crv: 'P-256',
+        x: base64UrlEncode(point.subarray(1, 33)),
+        y: base64UrlEncode(point.subarray(33, 65)),
+        d: base64UrlEncode(secret),
+        ext: false,
+    }, { name: 'ECDSA', namedCurve: 'P-256' }, false, ['sign']);
+    return base64UrlEncode(new Uint8Array(await globalThis.crypto.subtle.sign({ name: 'ECDSA', hash: 'SHA-256' }, key, data)));
+}
+/** Checks what `signWithScalar` signed, against a compressed public key (base64url) */
+export async function verifyWithPoint(publicKey, data, signature) {
+    try {
+        const point = p256.Point.fromBytes(base64UrlDecode(publicKey)).toBytes(false);
+        const key = await globalThis.crypto.subtle.importKey('raw', point, { name: 'ECDSA', namedCurve: 'P-256' }, false, ['verify']);
+        return await globalThis.crypto.subtle.verify({ name: 'ECDSA', hash: 'SHA-256' }, key, base64UrlDecode(signature), data);
+    }
+    catch {
+        return false;
+    }
+}
 /** The public half, from the private scalar */
 export function contactPublicKey(secret) {
     return base64UrlEncode(p256.getPublicKey(secret, true));