@weaveprotocol/core 0.2.1 → 0.2.3

package/README.md

@@ -5,7 +5,7 @@ written-down code, keep your data in signed records that sync directly between
 devices, and every app is a view onto that data rather than its owner.
 
 > **Building a client, or an agent that needs the architecture?** The
-> protocol is specified in [docs/spec](docs/spec/README.md): wire formats,
+> protocol is specified in [spec](spec/README.md): wire formats,
 > what is signed, and what every peer must check. The tests are its
 > executable half.
 
@@ -40,7 +40,7 @@ devices, and every app is a view onto that data rather than its owner.
 - **Local-first.** Works offline, syncs when peers are reachable.
 - **Few, boring dependencies.** Native browser APIs first. Where a problem is
   hard and already solved — elliptic-curve arithmetic, for one — a very stable,
-  widely used library instead of our own. See [docs/DEPENDENCIES.md](docs/DEPENDENCIES.md).
+  widely used library instead of our own. See [CLAUDE.md](CLAUDE.md#dependencies).
 - **Isomorphic.** Runs in browsers, Node and Bun via `globalThis`.
 - **Functional.** Plain functions and frozen data, no class hierarchies.
 - **Standard Schema.** Bring your own validator (Zod, Valibot, ArkType, …).
@@ -225,7 +225,7 @@ await calls.answer(ringing.id);  calls.setMuted(true);  await calls.shareScreen(
   servers a relay hands out (see the relay, below), with passwords fresh for
   a while. A call asks for them when it starts.
 
-The messages, and the reasoning, are at the top of `src/calls/calls.ts`.
+The messages, and the reasoning, are at the top of `packages/core/src/calls/calls.ts`.
 
 ### Contacts
 
@@ -323,8 +323,8 @@ await anna.doors.close(door.id);                   // the code leads nowhere now
   by its owner (`clear`), so its code keeps working.
 
 Next: handles that lead to a door, so `@anna.bsky.social` works where a code
-does (planned in [07 — Doors](docs/spec/07-doors.md), Names). The full design is
-[docs/spec/07-doors.md](docs/spec/07-doors.md).
+does (planned in [07 — Doors](spec/07-doors.md), Names). The full design is
+[spec/07-doors.md](spec/07-doors.md).
 
 ## Signing in — the element, and React
 
@@ -347,7 +347,7 @@ The protocol ships it, so an app does not write it:
 The element fits whatever it is put in — a page, a modal, a side panel — by
 sizing to its container, and draws nothing once someone is in. It renders into
 the page rather than a shadow root, because password managers fill forms there
-reliably and the account password living in one is the point. Colours, font and
+reliably and the everyday password living in one is much of the point. Colours, font and
 radius are custom properties (`--weave-accent`, `--weave-font`, …).
 
 Underneath it is `createWeaveAuth` (`@weaveprotocol/core/session`): the same flow as
@@ -403,10 +403,10 @@ An app connected to an account home passes its node instead:
 
 An app does not have to sign anyone in at all. It can ask an **account home** —
 a page, at an address the person chose, that holds their account — for access,
-and never see the seed. `home/` is one, ready to deploy as your own:
+and never see the seed. `apps/home/` is one, ready to deploy as your own:
 
-[![Deploy to Netlify](https://www.netlify.com/img/deploy/button.svg)](https://app.netlify.com/start/deploy?repository=https://github.com/leifriksheim/weave&base=home)
-[![Deploy with Vercel](https://vercel.com/button)](https://vercel.com/new/clone?repository-url=https://github.com/leifriksheim/weave&root-directory=home)
+[![Deploy to Netlify](https://www.netlify.com/img/deploy/button.svg)](https://app.netlify.com/start/deploy?repository=https://github.com/leifriksheim/weave&base=apps/home)
+[![Deploy with Vercel](https://vercel.com/button)](https://vercel.com/new/clone?repository-url=https://github.com/leifriksheim/weave&root-directory=apps/home)
 
 An app connects with `createWeaveConnection` — the twin of `createWeaveAuth`,
 for apps:
@@ -447,8 +447,8 @@ relays still meet. Underneath are
 
 1. The app makes its own key, kept in its own site's storage and never
    exportable (`appKey()`).
-2. The home opens in a popup. The person unlocks there — the account password
-   from their password manager, or a passkey — and picks which spaces the app
+2. The home opens in a popup. The person unlocks there — a passkey, or the
+   password their password manager keeps — and picks which spaces the app
    gets.
 3. The home signs a note from the account to the app's key: these spaces, read
    or change, for seven days. It hands the note back with invites for those
@@ -471,7 +471,7 @@ still never holds the seed: it cannot sign in anywhere as the account, change
 its password or passkeys, or keep access past the note's date.
 
 The home side is `receiveConnectRequest()` and `auth.grant(…)`; see
-[home/README.md](home/README.md).
+[apps/home/README.md](apps/home/README.md).
 
 ### Apps hold what they use — keepers hold the rest
 
@@ -914,8 +914,8 @@ Browser-to-browser communication via WebRTC.
 
 #### Signaling relay
 
-`server/relay.mjs` is a dumb relay in a couple hundred lines of Node with no
-dependencies of its own. It runs on its own as `server/signaling-server.mjs`
+`packages/relay/relay.mjs` is a dumb relay in a couple hundred lines of Node with no
+dependencies of its own. It runs on its own as `packages/relay/signaling-server.mjs`
 (an HTTP server and the `ws` library around it), and inside every always-on
 node (`weave serve`), so the two are the same relay. A peer holds one socket and joins a room on it for
 each space, and the relay passes join notices and WebRTC offers, answers and
@@ -949,8 +949,8 @@ tell a Weave peer from anyone else, so set coturn's own quotas (`user-quota`,
 `total-quota`, `max-bps`). TURN only forwards encrypted packets; it can't
 see or hear a call.
 
-The relay's Docker image (`server/`, deployed to Fly) runs coturn beside it when
-`TURN_SECRET` is set, already capped that way: `server/fly.toml` says how.
+The relay's Docker image (`packages/relay/`, deployed to Fly) runs coturn beside it when
+`TURN_SECRET` is set, already capped that way: `packages/relay/fly.toml` says how.
 
 Only peers already in a room hear about a newcomer, so exactly one side creates
 the offer and the two never collide.
@@ -1050,7 +1050,7 @@ interface StorageAdapter {
 - `createIndexedDBAdapter(name)` — works in every browser. Origin-scoped.
 - `createFolderAdapter(directory, namespace)` — a directory the user picked, via the File System Access API. **Not** origin-scoped. Chrome, Edge and Opera on the desktop.
 
-The always-on node (`weave run`) uses the folder adapter on disk, in the same layout. **Planned**: mirrors, which keep a space in storage the user already pays for (a Dropbox app folder, Drive, S3) and sync with it like a peer — see [05 — Sync and storage](docs/spec/05-sync-and-storage.md). OPFS is not on the list: it is origin-private, so it would inherit exactly the limitation a data folder exists to avoid.
+The always-on node (`weave run`) uses the folder adapter on disk, in the same layout. **Planned**: mirrors, which keep a space in storage the user already pays for (a Dropbox app folder, Drive, S3) and sync with it like a peer — see [05 — Sync and storage](spec/05-sync-and-storage.md). OPFS is not on the list: it is origin-private, so it would inherit exactly the limitation a data folder exists to avoid.
 
 ### Data folders — storage that outlives the origin
 
@@ -1125,7 +1125,7 @@ const wrap = await wrapSeedWithDeviceKey(seed, deviceKey, { rpId, credentialId }
 await accounts.write(account, withWrap(vault, wrap));
 ```
 
-`deviceWrapsFor(vault, rpId)` says which wraps this origin can even attempt; the rest name keys it cannot reach. The gate is enforced in application code rather than by cryptography — see `src/identity/device-key.ts` for what that does and does not protect against. The recovery code needs no wrap, because it *is* the seed in printable form — it opens the folder anywhere, including on a phone or in a browser with no File System Access API, and it is shown once and stored nowhere.
+`deviceWrapsFor(vault, rpId)` says which wraps this origin can even attempt; the rest name keys it cannot reach. The gate is enforced in application code rather than by cryptography — see `packages/core/src/identity/device-key.ts` for what that does and does not protect against. The recovery code needs no wrap, because it *is* the seed in printable form — it opens the folder anywhere, including on a phone or in a browser with no File System Access API, and it is shown once and stored nowhere.
 
 `createEncryptedAdapter` seals `space:`, `spacekey:`, `spaceinvite:` and `spacerole:` values under the vault key, which is what makes a private space genuinely unreadable to someone holding the folder. It is scoped deliberately narrowly: expressions and index entries pass through, so what stays legible is each record's author, timestamp and collection, plus anything in a space its owner made public. Sealing those too would mean an opaque blob store, which would cost the property that makes a folder worth having.
 
@@ -1199,7 +1199,7 @@ Both sides of a new pair learn of each other at once, so the lower identifier
 offers and the other waits — otherwise every introduction would open two
 connections. After that the mesh introduces itself and the relay can go away.
 
-`server/` has a Dockerfile and a `fly.toml` for running one.
+`packages/relay/` has a Dockerfile and a `fly.toml` for running one.
 
 ### Pairing a phone
 
@@ -1283,11 +1283,11 @@ schema.registerCollection({ name: 'app.example.post', schema: PostSchema });
 
 ## Command line, always-on node, and agents
 
-`cli/` is `weave`: every node operation from a terminal, `weave run` to keep an
+`packages/cli/` is `weave`: every node operation from a terminal, `weave run` to keep an
 account's spaces syncing on a server (browsers connect to it over WebSocket, and
 it doubles as a relay), and `weave mcp` to hand the same operations to an agent.
 It reads and writes the same data folder layout a browser does. See
-[cli/README.md](cli/README.md).
+[packages/cli/README.md](packages/cli/README.md).
 
 **Hosting.** `weave host` keeps many accounts' spaces online without being able
 to read them: it is the extension's carrier (`createCarrierNode`) with one carry
@@ -1296,7 +1296,7 @@ members pay for it. A subscription is a key the account makes and keeps in its
 registry (`sys.hosting`), so every device signs as it; `node.hosting.use(url)`
 starts one, and whichever device notices it is paid hands the host the carry
 space. Every call to the host is signed over method, path, time and body.
-The home knows nothing about payment ([06 — Nodes, sessions and apps](docs/spec/06-nodes-and-sessions.md), Hosts): a host describes itself at
+The home knows nothing about payment ([06 — Nodes, sessions and apps](spec/06-nodes-and-sessions.md), Hosts): a host describes itself at
 `/.well-known/weave-host` (like a Nostr relay's NIP-11 document), signs every
 status it gives — the home keeps the latest in the registry as the person's
 proof — and takes payments on its own pay page, which `node.hosting.payPage(url)`
@@ -1312,13 +1312,13 @@ has **Keep my spaces online**.
 
 ## Example app
 
-`example/` is the Weave website — a landing page for developers at `/`, and
-why Weave, for people, at `/why` — and, at `/app`, a general-purpose app for your spaces — Vite + React, consuming
-the protocol straight from `src/`. It knows no kinds of data in advance: every
+`apps/example/` is the Weave website — a front page for communities at `/`, and
+one for developers at `/developers` — and, at `/app`, a general-purpose app for your spaces — Vite + React, consuming
+the protocol straight from `packages/core/src/`. It knows no kinds of data in advance: every
 screen is worked out from what a space says about itself (see *Derived UI* below):
 
 ```bash
-npm install && (cd example && npm install) && (cd home && npm install)   # the CLI is a workspace: the first one installs it
+npm install     # one install for the whole workspace: core, CLI, relay and the apps
 npm run dev
 ```
 
@@ -1328,13 +1328,13 @@ That starts everything, with coloured output per part, and Ctrl-C stops it all:
 |---|---|---|
 | app | http://localhost:5173 | The example app |
 | home | http://localhost:5174 | The account home it connects to |
-| node | port 8787 | An always-on node that is also the relay; a throwaway identity on first run (`cli/.env.dev`, data in `.weave-dev/`) |
-| host | http://localhost:8788 | `weave host`, what "Keep my spaces online" uses, with its pay page at `/pay`; settings in `cli/.env.host.dev` |
+| node | port 8787 | An always-on node that is also the relay; a throwaway identity on first run (`packages/cli/.env.dev`, data in `.weave-dev/`) |
+| host | http://localhost:8788 | `weave host`, what "Keep my spaces online" uses, with its pay page at `/pay`; settings in `packages/cli/.env.host.dev` |
 | stripe | — | Only when you add a Stripe test key (below): forwards Stripe's webhooks to the host |
 
-`example/.env.development` and `home/.env.development` point the app and home
+`apps/example/.env.development` and `apps/home/.env.development` point the app and home
 at the rest. Override any of them in a `.env.local`, and the host in
-`cli/.env.host.local`.
+`packages/cli/.env.host.local`.
 
 **Trying hosting and payments.** In the home: Settings, **Keep my spaces
 online**, **Keep online** (the dev host is filled in), then **Payment**, which
@@ -1346,8 +1346,8 @@ opens the host's pay page in a new tab. What you can pay with there:
   USDC from faucet.circle.com (choose Base Sepolia). Pay, and the pay page
   says "Payment received"; back in the home's tab, the host shows "paid until"
   and takes your spaces. To see payments arrive, set your own address as
-  `WEAVE_WALLET_ADDRESS` in `cli/.env.host.local`.
-- **A card, in Stripe's test mode.** In `cli/.env.host.local`, add
+  `WEAVE_WALLET_ADDRESS` in `packages/cli/.env.host.local`.
+- **A card, in Stripe's test mode.** In `packages/cli/.env.host.local`, add
   `STRIPE_SECRET_KEY=sk_test_…` and the price ids of a monthly and a yearly
   recurring test price (`STRIPE_PRICE_MONTHLY`, `STRIPE_PRICE_YEARLY`, from the Stripe
   dashboard in test mode). With the Stripe CLI installed, `npm run dev`
@@ -1355,7 +1355,7 @@ opens the host's pay page in a new tab. What you can pay with there:
   4242 4242 4242 4242, any future date, any CVC.
 - **Phone wallets, by QR code.** Add `WEAVE_WALLETCONNECT_PROJECT_ID` (free at
   dashboard.reown.com, with localhost allowed in the project) to
-  `cli/.env.host.local`; `npm run dev` builds what the pay page needs. The
+  `packages/cli/.env.host.local`; `npm run dev` builds what the pay page needs. The
   wallet has to be on Base Sepolia too.
 
 `npm test` covers the same paths without any of this: a fake network, fake
@@ -1374,7 +1374,7 @@ npm run weave -- records list --space <id>
 
 Close every browser holding the space, open the link somewhere else, and the
 records come from the node. Or make the node your own account's — see
-[cli/README.md](cli/README.md) — and it serves every space you make, unasked.
+[packages/cli/README.md](packages/cli/README.md) — and it serves every space you make, unasked.
 
 Between them they exercise the stack end to end. At the home: choose where
 your data lives (a pod, or this browser), create an account (a password your
@@ -1402,7 +1402,7 @@ for fixed ones, and `x-choicesFrom: { rel: 'about', field: 'options' }` for a
 field that picks from a list in the linked record — so a vote stored as `1`
 shows as "Lisbon", its form offers the poll's options, and the poll shows a
 tally. The helpers that work this out are pure functions
-(`example/src/derive/schema-ui.ts`), with nothing DOM-specific in them. An
+(`apps/example/src/derive/schema-ui.ts`), with nothing DOM-specific in them. An
 empty space offers a small "define a collection" form; an agent can do the
 same over WebMCP.
 
@@ -1419,7 +1419,7 @@ above everything that changes as you move around.
 
 **Agents in the browser (WebMCP).** When `/app` loads, it registers
 every node operation as a WebMCP tool on `document.modelContext`
-(`example/src/webmcp.ts`, with `@mcp-b/webmcp-polyfill`: Chrome's own WebMCP
+(`apps/example/src/webmcp.ts`, with `@mcp-b/webmcp-polyfill`: Chrome's own WebMCP
 when present, a polyfill otherwise). A browser agent or extension sees the same
 tools as the CLI and `weave mcp` — `spaces_list`, `records_query`,
 `records_put`, `apps_propose`… — and works as the person, with nothing to
@@ -1430,8 +1430,7 @@ them. Anything that changes a space's people, or hands out its key, asks the
 person first. An app may bring its own screen: a collection definition's
 `screen`, one HTML document, which the example runs in a sandboxed frame with
 no network, talking to the space only through a message port
-(`createScreenBridge`, `apps_screen_guide`). `docs/screens/chess.html` is one
-an agent wrote.
+(`createScreenBridge`, `apps_screen_guide`).
 
 **Agents on your computer (Claude Code, Claude Desktop, Cursor).** "Connect an
 agent", in the account menu, shows one command:
@@ -1439,16 +1438,16 @@ agent", in the account menu, shows one command:
 the tab through the relay, and the person allows it at their account home,
 which signs an agent's note for the whole account, for as long as they chose.
 Everything said on the way is sealed with a key from the code, so the relay
-learns nothing (`src/session/agent-link.ts`). The command then adds `weave` to
+learns nothing (`packages/core/src/session/agent-link.ts`). The command then adds `weave` to
 the agents it finds, and they start `weave mcp` themselves: a node of its own,
 over WebRTC (`node-datachannel`), that follows the account and keeps working
 with every tab closed. What it writes shows "via agent", and every peer
 ignores an agent changing collections, who may do what, or the account's own
-list of spaces. See [06 — Nodes, sessions and apps](docs/spec/06-nodes-and-sessions.md), Agents.
+list of spaces. See [06 — Nodes, sessions and apps](spec/06-nodes-and-sessions.md), Agents.
 
 ## Still to do in the library
 
-What the protocol still has planned is in [the spec](docs/spec/README.md), under
+What the protocol still has planned is in [the spec](spec/README.md), under
 **Planned** in each part. Library work that isn't protocol:
 
 - **Typed queries, further.** Typed field paths and operator values in
@@ -1458,14 +1457,35 @@ What the protocol still has planned is in [the spec](docs/spec/README.md), under
 - **Typed collections.** One TypeScript builder that emits the schema, the
   rules and the types, and typed handles (`node.use(space, Poll)`).
 - **Definitions that update themselves.** `useSchemas` and `addApp` applying
-  harmless changes, with `differences()` in `src/schemas/apps.ts` replaced by
-  the planned `compare` ([02](docs/spec/02-records.md), compatible definitions).
+  harmless changes, with `differences()` in `packages/core/src/schemas/apps.ts` replaced by
+  the planned `compare` ([02](spec/02-records.md), compatible definitions).
 - **Web components** for the standard schemas.
 
+## Repository layout
+
+One npm workspace, installed once at the root (`npm install`):
+
+| Folder | Package | |
+|---|---|---|
+| `packages/core` | `@weaveprotocol/core` (published) | The protocol library, and its tests |
+| `packages/cli` | `@weaveprotocol/cli` (published) | `weave`: the always-on node, hosting, agents, MCP |
+| `packages/relay` | `@weaveprotocol/relay` (private) | The signaling relay and its mailbox, run alone on Fly and inside every node |
+| `apps/home` | — | The account home |
+| `apps/example` | — | The website and the example app |
+| `apps/extension` | — | The Chrome extension |
+| `spec` | — | The protocol specification |
+
+Everything imports the protocol by name, `@weaveprotocol/core`, and only
+through what it exports. Inside the workspace, the `@weaveprotocol/source`
+export condition resolves those imports to `packages/core/src`, so the apps,
+the CLI and the tests run on the source with no build step; published copies
+use `dist`. The CLI bundles the protocol and the relay into one file, so
+`npx @weaveprotocol/cli` and the single-file binaries need nothing else.
+
 ## Releasing
 
-`@weaveprotocol/core` (this folder) and `@weaveprotocol/cli` (`cli/`, an npm
-workspace) are released together, always with the same version:
+`@weaveprotocol/core` (`packages/core/`) and `@weaveprotocol/cli`
+(`packages/cli/`) are released together, always with the same version:
 
 ```bash
 npm run release
@@ -1487,7 +1507,8 @@ yet and publishes what's missing, instead of bumping again. `npm run release
 ## Tests
 
 ```bash
-npm test
+npm test        # every workspace: core's tests, then the CLI's
+npm run typecheck
 ```
 
 Covers key derivation — checked against the public keys Web Crypto generates

package/dist/doors/doors.d.ts

@@ -29,7 +29,7 @@
  * ```
  *
  * The relay sees a topic and a sealed blob: not whose door it is, not who
- * knocked, not what they said. See `docs/spec/07-doors.md`.
+ * knocked, not what they said. See `spec/07-doors.md`.
  */
 import type { CryptoProvider } from '../types.js';
 /** A door names at most this many relays: enough that one going away doesn't matter */

package/dist/elements/auth-styles.d.ts

@@ -14,5 +14,5 @@
  * not a media query — so the same element fits a full page, a modal or a side
  * panel without being told which.
  */
-export declare const AUTH_CSS = "\nweave-auth {\n  --weave-ink: #000;\n  --weave-body: #171717;\n  --weave-muted: #666;\n  --weave-faint: #8f8f8f;\n  --weave-surface: #fff;\n  --weave-sunken: #fafafa;\n  --weave-line: #eaeaea;\n  --weave-line-strong: #d4d4d4;\n  --weave-accent: #000;\n  --weave-accent-hover: #383838;\n  --weave-on-accent: #fff;\n  --weave-danger: #e5484d;\n  --weave-danger-soft: #fff0f0;\n  --weave-radius: 6px;\n  --weave-font: \"Geist\", -apple-system, BlinkMacSystemFont, \"Segoe UI\", Roboto, Helvetica, Arial, sans-serif;\n  --weave-mono: \"Geist Mono\", ui-monospace, SFMono-Regular, \"SF Mono\", Menlo, Consolas, monospace;\n\n  display: block;\n  container-type: inline-size;\n  color: var(--weave-body);\n  font-family: var(--weave-font);\n  font-size: 14px;\n  letter-spacing: -0.006em;\n  -webkit-font-smoothing: antialiased;\n}\nweave-auth[hidden] { display: none; }\nweave-auth *, weave-auth *::before, weave-auth *::after { box-sizing: border-box; }\nweave-auth :is(h1, p) { margin: 0; }\n\nweave-auth .wa-card { width: 100%; max-width: 380px; margin: 0 auto; }\nweave-auth .wa-wordmark { display: flex; align-items: center; gap: 8px; margin-bottom: 40px; color: var(--weave-ink); font-weight: 600; font-size: 16px; letter-spacing: -0.03em; }\nweave-auth .wa-title { font-size: 28px; font-weight: 600; letter-spacing: -0.04em; color: var(--weave-ink); margin-bottom: 8px; line-height: 1.2; }\nweave-auth .wa-subtitle { font-size: 15px; color: var(--weave-muted); margin-bottom: 32px; line-height: 1.5; }\nweave-auth .wa-hint { font-size: 14px; color: var(--weave-muted); margin-bottom: 20px; line-height: 1.6; }\nweave-auth .wa-small { font-size: 13px; color: var(--weave-muted); margin-top: 8px; line-height: 1.6; }\nweave-auth .wa-error { color: var(--weave-danger); font-size: 14px; font-weight: 500; }\nweave-auth .wa-error-box { margin-top: 16px; padding: 12px 14px; border-radius: var(--weave-radius); background: var(--weave-danger-soft); }\n\nweave-auth .wa-form { display: flex; flex-direction: column; gap: 8px; }\nweave-auth .wa-form + .wa-form { margin-top: 10px; }\nweave-auth input {\n  width: 100%; height: 40px; padding: 0 12px;\n  border-radius: var(--weave-radius); border: 1px solid var(--weave-line-strong);\n  background: var(--weave-surface); color: var(--weave-ink);\n  font: inherit; font-size: 14px; outline: none;\n  transition: border-color .15s ease, box-shadow .15s ease;\n}\nweave-auth input::placeholder { color: var(--weave-faint); }\nweave-auth input:focus { border-color: var(--weave-muted); box-shadow: 0 0 0 3px rgba(0, 0, 0, .06); }\nweave-auth .wa-offscreen {\n  position: absolute; width: 1px; height: 1px; padding: 0; margin: -1px;\n  overflow: hidden; clip-path: inset(50%); white-space: nowrap; border: 0;\n}\n\nweave-auth button { font: inherit; transition: background-color .15s ease, border-color .15s ease, color .15s ease; }\nweave-auth button:not(:disabled) { cursor: pointer; }\nweave-auth button:disabled { opacity: .5; cursor: not-allowed; }\nweave-auth :focus-visible { outline: 2px solid var(--weave-ink); outline-offset: 2px; }\nweave-auth button:focus:not(:focus-visible) { outline: none; }\n\nweave-auth .wa-button {\n  width: 100%; height: 40px; padding: 0 16px;\n  border-radius: var(--weave-radius); border: 1px solid transparent;\n  background: var(--weave-accent); color: var(--weave-on-accent);\n  font-size: 14px; font-weight: 500;\n}\nweave-auth .wa-button:not(:disabled):hover { background: var(--weave-accent-hover); }\nweave-auth .wa-link {\n  background: none; border: none; padding: 4px 0; margin-right: 12px;\n  color: var(--weave-muted); font-size: 13px; font-weight: 500; text-align: left;\n}\nweave-auth .wa-link:not(:disabled):hover { color: var(--weave-ink); }\nweave-auth .wa-links { display: flex; flex-wrap: wrap; margin-top: 10px; }\n\nweave-auth .wa-options { display: flex; flex-direction: column; gap: 12px; }\nweave-auth .wa-option {\n  display: flex; flex-direction: column; gap: 4px; width: 100%; padding: 16px;\n  text-align: left; border-radius: var(--weave-radius);\n  border: 1px solid var(--weave-line); background: var(--weave-surface); color: var(--weave-body);\n}\nweave-auth .wa-option:not(:disabled):hover { background: var(--weave-sunken); border-color: var(--weave-line-strong); }\nweave-auth .wa-option-title { display: flex; align-items: center; gap: 8px; font-weight: 500; color: var(--weave-ink); }\nweave-auth .wa-option-text { color: var(--weave-muted); font-size: 13px; line-height: 1.5; }\nweave-auth .wa-badge {\n  font-size: 11px; font-weight: 500; padding: 1px 8px; border-radius: 999px;\n  background: var(--weave-sunken); border: 1px solid var(--weave-line); color: var(--weave-muted);\n}\n\nweave-auth .wa-account { padding: 12px 0; border-top: 1px solid var(--weave-line); }\nweave-auth .wa-account:last-of-type { border-bottom: 1px solid var(--weave-line); margin-bottom: 8px; }\nweave-auth .wa-account-row {\n  display: flex; align-items: center; gap: 10px; width: 100%; padding: 6px 8px; margin: 0 -8px;\n  width: calc(100% + 16px); text-align: left;\n  background: none; border: 1px solid transparent; border-radius: var(--weave-radius); color: var(--weave-body);\n}\nweave-auth .wa-account-row:not(:disabled):hover { background: var(--weave-sunken); }\nweave-auth .wa-account-name { display: block; font-weight: 600; color: var(--weave-ink); }\nweave-auth .wa-account-did { display: block; font-size: 12px; color: var(--weave-faint); font-family: var(--weave-mono); overflow: hidden; text-overflow: ellipsis; white-space: nowrap; }\nweave-auth .wa-account-body { margin-top: 10px; }\nweave-auth .wa-avatar { flex-shrink: 0; display: block; border-radius: 8px; }\n\nweave-auth .wa-code {\n  display: block; margin-top: 16px; padding: 12px; border-radius: var(--weave-radius);\n  background: var(--weave-sunken); border: 1px solid var(--weave-line);\n  font-family: var(--weave-mono); font-size: 13px; color: var(--weave-ink);\n  word-break: break-all; user-select: all;\n}\n\nweave-auth .wa-info { position: relative; display: inline; }\nweave-auth .wa-info-button {\n  display: inline-flex; align-items: center; justify-content: center;\n  width: 16px; height: 16px; padding: 0; margin-left: 6px; vertical-align: text-bottom;\n  border-radius: 999px; border: 1px solid var(--weave-line-strong); background: none;\n  color: var(--weave-faint); font-size: 10px; font-weight: 700; line-height: 1;\n}\nweave-auth .wa-popover {\n  position: absolute; z-index: 30; top: 22px; left: 0; width: min(260px, 80cqi);\n  padding: 12px 14px; border-radius: var(--weave-radius);\n  background: var(--weave-surface); border: 1px solid var(--weave-line);\n  box-shadow: 0 12px 28px -12px rgba(15, 17, 21, .22);\n  font-size: 12.5px; line-height: 1.6; color: var(--weave-muted); font-weight: 400;\n}\nweave-auth .wa-popover[hidden] { display: none; }\n\n@container (max-width: 340px) {\n  weave-auth .wa-title { font-size: 24px; }\n  weave-auth .wa-subtitle { margin-bottom: 24px; }\n  weave-auth .wa-wordmark { margin-bottom: 28px; }\n  weave-auth .wa-popover { left: auto; right: -8px; }\n}\n";
+export declare const AUTH_CSS = "\nweave-auth {\n  --weave-ink: #000;\n  --weave-body: #171717;\n  --weave-muted: #666;\n  --weave-faint: #8f8f8f;\n  --weave-surface: #fff;\n  --weave-sunken: #fafafa;\n  --weave-line: #eaeaea;\n  --weave-line-strong: #d4d4d4;\n  --weave-accent: #000;\n  --weave-accent-hover: #383838;\n  --weave-on-accent: #fff;\n  --weave-danger: #e5484d;\n  --weave-danger-soft: #fff0f0;\n  --weave-radius: 6px;\n  --weave-font: \"Geist\", -apple-system, BlinkMacSystemFont, \"Segoe UI\", Roboto, Helvetica, Arial, sans-serif;\n  --weave-mono: \"Geist Mono\", ui-monospace, SFMono-Regular, \"SF Mono\", Menlo, Consolas, monospace;\n\n  display: block;\n  container-type: inline-size;\n  color: var(--weave-body);\n  font-family: var(--weave-font);\n  font-size: 14px;\n  letter-spacing: -0.006em;\n  -webkit-font-smoothing: antialiased;\n}\nweave-auth[hidden] { display: none; }\nweave-auth *, weave-auth *::before, weave-auth *::after { box-sizing: border-box; }\nweave-auth :is(h1, p) { margin: 0; }\n\nweave-auth .wa-card { width: 100%; max-width: 380px; margin: 0 auto; }\nweave-auth .wa-wordmark { display: flex; align-items: center; gap: 8px; margin-bottom: 40px; color: var(--weave-ink); font-weight: 600; font-size: 16px; letter-spacing: -0.03em; }\nweave-auth .wa-title { font-size: 28px; font-weight: 600; letter-spacing: -0.04em; color: var(--weave-ink); margin-bottom: 8px; line-height: 1.2; }\nweave-auth .wa-subtitle { font-size: 15px; color: var(--weave-muted); margin-bottom: 32px; line-height: 1.5; }\nweave-auth .wa-hint { font-size: 14px; color: var(--weave-muted); margin-bottom: 20px; line-height: 1.6; }\nweave-auth .wa-small { font-size: 13px; color: var(--weave-muted); margin-top: 8px; line-height: 1.6; }\nweave-auth .wa-error { color: var(--weave-danger); font-size: 14px; font-weight: 500; }\nweave-auth .wa-error-box { margin-top: 16px; padding: 12px 14px; border-radius: var(--weave-radius); background: var(--weave-danger-soft); }\n\nweave-auth .wa-form { display: flex; flex-direction: column; gap: 8px; }\nweave-auth .wa-form + .wa-form { margin-top: 10px; }\nweave-auth input {\n  width: 100%; height: 40px; padding: 0 12px;\n  border-radius: var(--weave-radius); border: 1px solid var(--weave-line-strong);\n  background: var(--weave-surface); color: var(--weave-ink);\n  font: inherit; font-size: 14px; outline: none;\n  transition: border-color .15s ease, box-shadow .15s ease;\n}\nweave-auth input::placeholder { color: var(--weave-faint); }\nweave-auth input:focus { border-color: var(--weave-muted); box-shadow: 0 0 0 3px rgba(0, 0, 0, .06); }\nweave-auth .wa-offscreen {\n  position: absolute; width: 1px; height: 1px; padding: 0; margin: -1px;\n  overflow: hidden; clip-path: inset(50%); white-space: nowrap; border: 0;\n}\n\nweave-auth button { font: inherit; transition: background-color .15s ease, border-color .15s ease, color .15s ease; }\nweave-auth button:not(:disabled) { cursor: pointer; }\nweave-auth button:disabled { opacity: .5; cursor: not-allowed; }\nweave-auth :focus-visible { outline: 2px solid var(--weave-ink); outline-offset: 2px; }\nweave-auth button:focus:not(:focus-visible) { outline: none; }\n\nweave-auth .wa-button {\n  width: 100%; height: 40px; padding: 0 16px;\n  border-radius: var(--weave-radius); border: 1px solid transparent;\n  background: var(--weave-accent); color: var(--weave-on-accent);\n  font-size: 14px; font-weight: 500;\n}\nweave-auth .wa-button:not(:disabled):hover { background: var(--weave-accent-hover); }\nweave-auth .wa-link {\n  background: none; border: none; padding: 4px 0; margin-right: 12px;\n  color: var(--weave-muted); font-size: 13px; font-weight: 500; text-align: left;\n}\nweave-auth .wa-link:not(:disabled):hover { color: var(--weave-ink); }\nweave-auth .wa-links { display: flex; flex-wrap: wrap; margin-top: 10px; }\n\nweave-auth .wa-options { display: flex; flex-direction: column; gap: 12px; }\nweave-auth .wa-option {\n  display: flex; flex-direction: column; gap: 4px; width: 100%; padding: 16px;\n  text-align: left; border-radius: var(--weave-radius);\n  border: 1px solid var(--weave-line); background: var(--weave-surface); color: var(--weave-body);\n}\nweave-auth .wa-option:not(:disabled):hover { background: var(--weave-sunken); border-color: var(--weave-line-strong); }\nweave-auth .wa-option-title { display: flex; align-items: center; gap: 8px; font-weight: 500; color: var(--weave-ink); }\nweave-auth .wa-option-text { color: var(--weave-muted); font-size: 13px; line-height: 1.5; }\nweave-auth .wa-badge {\n  font-size: 11px; font-weight: 500; padding: 1px 8px; border-radius: 999px;\n  background: var(--weave-sunken); border: 1px solid var(--weave-line); color: var(--weave-muted);\n}\n\nweave-auth .wa-account { padding: 12px 0; border-top: 1px solid var(--weave-line); }\nweave-auth .wa-account:last-of-type { border-bottom: 1px solid var(--weave-line); margin-bottom: 8px; }\nweave-auth .wa-account-row {\n  display: flex; align-items: center; gap: 10px; width: 100%; padding: 6px 8px; margin: 0 -8px;\n  width: calc(100% + 16px); text-align: left;\n  background: none; border: 1px solid transparent; border-radius: var(--weave-radius); color: var(--weave-body);\n}\nweave-auth .wa-account-row:not(:disabled):hover { background: var(--weave-sunken); }\nweave-auth .wa-account-name { display: block; font-weight: 600; color: var(--weave-ink); }\nweave-auth .wa-account-did { display: block; font-size: 12px; color: var(--weave-faint); font-family: var(--weave-mono); overflow: hidden; text-overflow: ellipsis; white-space: nowrap; }\nweave-auth .wa-account-body { margin-top: 10px; }\nweave-auth .wa-avatar { flex-shrink: 0; display: block; border-radius: 8px; }\n\nweave-auth .wa-code {\n  display: block; margin-top: 16px; padding: 12px; border-radius: var(--weave-radius);\n  background: var(--weave-sunken); border: 1px solid var(--weave-line);\n  font-family: var(--weave-mono); font-size: 13px; color: var(--weave-ink);\n  word-break: break-all; user-select: all;\n}\n\nweave-auth .wa-code-large { font-size: 17px; letter-spacing: 0.04em; text-align: center; padding: 16px 12px; margin-top: 0; }\nweave-auth .wa-row { display: flex; gap: 8px; margin-top: 10px; }\nweave-auth .wa-secondary {\n  flex: 1; height: 36px; padding: 0 12px;\n  border-radius: var(--weave-radius); border: 1px solid var(--weave-line-strong);\n  background: var(--weave-surface); color: var(--weave-ink); font-size: 13px; font-weight: 500;\n}\nweave-auth .wa-secondary:not(:disabled):hover { background: var(--weave-sunken); }\nweave-auth .wa-check { display: flex; align-items: flex-start; gap: 10px; margin: 20px 0 16px; font-size: 14px; line-height: 1.5; color: var(--weave-body); cursor: pointer; }\nweave-auth .wa-check input { width: 16px; height: 16px; margin: 3px 0 0; padding: 0; flex-shrink: 0; accent-color: var(--weave-accent); box-shadow: none; }\nweave-auth .wa-label { font-size: 13px; color: var(--weave-muted); }\nweave-auth .wa-steps { margin: 0 0 20px; padding-left: 20px; font-size: 14px; line-height: 1.6; color: var(--weave-body); }\n\nweave-auth .wa-info { position: relative; display: inline; }\nweave-auth .wa-info-button {\n  display: inline-flex; align-items: center; justify-content: center;\n  width: 16px; height: 16px; padding: 0; margin-left: 6px; vertical-align: text-bottom;\n  border-radius: 999px; border: 1px solid var(--weave-line-strong); background: none;\n  color: var(--weave-faint); font-size: 10px; font-weight: 700; line-height: 1;\n}\nweave-auth .wa-popover {\n  position: absolute; z-index: 30; top: 22px; left: 0; width: min(260px, 80cqi);\n  padding: 12px 14px; border-radius: var(--weave-radius);\n  background: var(--weave-surface); border: 1px solid var(--weave-line);\n  box-shadow: 0 12px 28px -12px rgba(15, 17, 21, .22);\n  font-size: 12.5px; line-height: 1.6; color: var(--weave-muted); font-weight: 400;\n}\nweave-auth .wa-popover[hidden] { display: none; }\n\n@container (max-width: 340px) {\n  weave-auth .wa-title { font-size: 24px; }\n  weave-auth .wa-subtitle { margin-bottom: 24px; }\n  weave-auth .wa-wordmark { margin-bottom: 28px; }\n  weave-auth .wa-popover { left: auto; right: -8px; }\n}\n";
 //# sourceMappingURL=auth-styles.d.ts.map

package/dist/elements/auth-styles.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth-styles.d.ts","sourceRoot":"","sources":["../../src/elements/auth-styles.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,QAAQ,27NAoIpB,CAAC"}
+{"version":3,"file":"auth-styles.d.ts","sourceRoot":"","sources":["../../src/elements/auth-styles.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,QAAQ,i+PAiJpB,CAAC"}

package/dist/elements/auth-styles.js

@@ -124,6 +124,19 @@ weave-auth .wa-code {
   word-break: break-all; user-select: all;
 }
 
+weave-auth .wa-code-large { font-size: 17px; letter-spacing: 0.04em; text-align: center; padding: 16px 12px; margin-top: 0; }
+weave-auth .wa-row { display: flex; gap: 8px; margin-top: 10px; }
+weave-auth .wa-secondary {
+  flex: 1; height: 36px; padding: 0 12px;
+  border-radius: var(--weave-radius); border: 1px solid var(--weave-line-strong);
+  background: var(--weave-surface); color: var(--weave-ink); font-size: 13px; font-weight: 500;
+}
+weave-auth .wa-secondary:not(:disabled):hover { background: var(--weave-sunken); }
+weave-auth .wa-check { display: flex; align-items: flex-start; gap: 10px; margin: 20px 0 16px; font-size: 14px; line-height: 1.5; color: var(--weave-body); cursor: pointer; }
+weave-auth .wa-check input { width: 16px; height: 16px; margin: 3px 0 0; padding: 0; flex-shrink: 0; accent-color: var(--weave-accent); box-shadow: none; }
+weave-auth .wa-label { font-size: 13px; color: var(--weave-muted); }
+weave-auth .wa-steps { margin: 0 0 20px; padding-left: 20px; font-size: 14px; line-height: 1.6; color: var(--weave-body); }
+
 weave-auth .wa-info { position: relative; display: inline; }
 weave-auth .wa-info-button {
   display: inline-flex; align-items: center; justify-content: center;

package/dist/elements/auth-styles.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth-styles.js","sourceRoot":"","sources":["../../src/elements/auth-styles.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,MAAM,QAAQ,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAoIvB,CAAC"}
+{"version":3,"file":"auth-styles.js","sourceRoot":"","sources":["../../src/elements/auth-styles.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,MAAM,QAAQ,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAiJvB,CAAC"}

package/dist/elements/weave-auth.d.ts

@@ -18,8 +18,8 @@
  *
  * It draws into its own light DOM, not a shadow root, on purpose: password
  * managers find and fill forms in the page far more reliably than forms inside
- * a shadow root, and the account password living in a password manager is the
- * point of the whole design. Its styles are scoped to the element instead.
+ * a shadow root, and the everyday password living in a password manager is
+ * much of the point. Its styles are scoped to the element instead.
  *
  * It fills whatever box it is put in — a page, a modal, a panel — and draws
  * nothing once signed in; the host decides what happens then.

package/dist/elements/weave-auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"weave-auth.d.ts","sourceRoot":"","sources":["../../src/elements/weave-auth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,OAAO,EAAmD,KAAK,SAAS,EAAE,KAAK,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAOxH,mCAAmC;AACnC,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,OAAO,EAAE,YAAY,GAAG,IAAI,CAAC;CACvC;AAED,QAAA,MAAM,IAAI,EAA2C,OAAO,WAAW,CAAC;AAyGxE,qBAAa,gBAAiB,SAAQ,IAAI;;IAYxC,6HAA6H;IAC7H,IAAI,IAAI,IAAI,SAAS,CASpB;IAED,IAAI,IAAI,CAAC,IAAI,EAAE,SAAS,EAIvB;IAED,iBAAiB,IAAI,IAAI;IAazB,oBAAoB,IAAI,IAAI;CAygB7B;AAED,6EAA6E;AAC7E,wBAAgB,eAAe,CAAC,GAAG,SAAe,GAAG,IAAI,CAGxD;AAID,OAAO,CAAC,MAAM,CAAC;IACb,UAAU,qBAAqB;QAC7B,YAAY,EAAE,gBAAgB,CAAC;KAChC;IACD,UAAU,mBAAmB;QAC3B,eAAe,EAAE,WAAW,CAAC,uBAAuB,CAAC,CAAC;KACvD;CACF"}
+{"version":3,"file":"weave-auth.d.ts","sourceRoot":"","sources":["../../src/elements/weave-auth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,OAAO,EAAwE,KAAK,SAAS,EAAE,KAAK,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAO7I,mCAAmC;AACnC,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,OAAO,EAAE,YAAY,GAAG,IAAI,CAAC;CACvC;AAED,QAAA,MAAM,IAAI,EAA2C,OAAO,WAAW,CAAC;AAmHxE,qBAAa,gBAAiB,SAAQ,IAAI;;IAgBxC,6HAA6H;IAC7H,IAAI,IAAI,IAAI,SAAS,CASpB;IAED,IAAI,IAAI,CAAC,IAAI,EAAE,SAAS,EAIvB;IAED,iBAAiB,IAAI,IAAI;IAazB,oBAAoB,IAAI,IAAI;CAusB7B;AAED,6EAA6E;AAC7E,wBAAgB,eAAe,CAAC,GAAG,SAAe,GAAG,IAAI,CAGxD;AAID,OAAO,CAAC,MAAM,CAAC;IACb,UAAU,qBAAqB;QAC7B,YAAY,EAAE,gBAAgB,CAAC;KAChC;IACD,UAAU,mBAAmB;QAC3B,eAAe,EAAE,WAAW,CAAC,uBAAuB,CAAC,CAAC;KACvD;CACF"}