dignity.js 0.8.0 → 0.8.2

package/README.md

@@ -6,11 +6,11 @@
 [![npm version](https://img.shields.io/npm/v/dignity.js?color=cb3837&label=npm)](https://www.npmjs.com/package/dignity.js)
 [![npm downloads](https://img.shields.io/npm/dm/dignity.js?color=blue)](https://www.npmjs.com/package/dignity.js)
 [![CI](https://github.com/jose-compu/dignity.js/actions/workflows/ci.yml/badge.svg)](https://github.com/jose-compu/dignity.js/actions/workflows/ci.yml)
-![tests](https://img.shields.io/badge/tests-213%2B%20passing-brightgreen)
+![tests](https://img.shields.io/badge/tests-291%2B%20passing-brightgreen)
 ![coverage](https://img.shields.io/badge/coverage-92%25-brightgreen)
 ![license](https://img.shields.io/badge/license-Apache%202.0-black)
 
-REST-like P2P object API for decentralized JavaScript applications.
+The Scalable Data Layer of the Decentralized Browser Application Ecosystem.
 
 `dignity.js` lets many browsers synchronize shared objects with ownership rules and built-in anti-abuse + privacy controls.
 
@@ -33,6 +33,10 @@ REST-like P2P object API for decentralized JavaScript applications.
 - Auto `connectToPeers` on create/update/delete replication (owner + collaborators)
 - Optional IndexedDB persistence for browser reload survival
 - Optional React hooks via `dignity.js/react`
+- **PeerGroup gossip** — scalable PubSub for high-fanout feeds (spectators, timelines); default `maxHops: 64`
+- **CQRS tiers (v0.8+)** — live core (5k cap) + bulk tail per publisher; signed domain events on every write
+- **`DignityQueryReplica`** — read-only materialized views with hash-chain verification
+- Credential-derived keys, identity rotation, and cold-recovery co-sign (v0.7+)
 - Browser-first: published npm package includes IIFE, ESM, and CJS builds
 
 ## Install
@@ -133,13 +137,16 @@ For high-fanout object updates (millions of subscribers per published object), u
 await node.joinPeerGroup('feed:alice', {
   bootstrapPeerIds: ['publisher-peer-id'],
   fanout: 3,
-  maxActivePeers: 8
+  maxActivePeers: 8,
+  maxHops: 64   // default since v0.8.0
 });
 
 await node.publishRecordToPeerGroup('feed:alice', 'posts', 'post-1');
 await node.leavePeerGroup('feed:alice');
 ```
 
+Inner gossip message types: `operation`, `record:snapshot`, `domain:event`, `domain:checkpoint`, and app-defined payloads (via `peergroupmessage` events).
+
 Small collaborations (chess players, document co-editing) should keep using direct `connectToPeers` mesh. Large read-only audiences (chess spectators, public timelines) should use PeerGroup gossip. See the [docs PeerGroup section](https://jose-compu.github.io/dignity.js/#peer-groups).
 
 ### CQRS tiers, domain events, and query replicas (v0.8+)
@@ -174,7 +181,11 @@ replica.read('posts', 'p1');
 replica.verifyChain(); // hash-chain consistency
 ```
 
-Default `maxHops` is **64** (was 6), sufficient for epidemic spread at fanout 3 without per-group tuning.
+Default `maxHops` is **64** (was 6 in v0.7.x), sufficient for epidemic spread at fanout 3 without per-group tuning.
+
+**Publisher options:** `role: 'publisher'`, `tiered: true`, `liveCap` (default 5000), `domainEvents: true`, `peerGroupId` on CRUD to auto-publish events.
+
+**Subscriber / replica options:** `role: 'subscriber'`, `tierMode: 'auto' | 'live' | 'bulk'`, `commandCapable: false` on read-only nodes, `publisherId` to filter events.
 
 ## Room / Team Discovery
 
@@ -508,6 +519,29 @@ npm run docs:dev
 
 If 4173 is busy, `docs:dev` auto-picks the next free port (4174, 4175, …) and prints the URLs.
 
+## Dignity Apps (v0.8.2+)
+
+Self-contained HTML apps in a sandboxed iframe, inspired by [Datasette Apps](https://datasette.io/blog/2026/datasette-apps/). Track: [#100](https://github.com/jose-compu/dignity.js/issues/100).
+
+**Threat boundaries (v0.8.2):**
+
+- Apps run in an iframe with `sandbox` + immutable CSP — no parent DOM, cookies, or `localStorage`.
+- Data access only via a parent **MessageChannel** bridge; no signing keys or mesh credentials in the iframe.
+- **Read:** `dignity.query` backed by `DignityQueryReplica` (collections allowlisted in manifest).
+- **Write:** only **stored commands** pre-declared in the app manifest — no arbitrary CRUD.
+- External `fetch` blocked unless origin is listed in `allowedCspOrigins` (https only; no localhost).
+
+```js
+const { validateDignityAppManifest } = require('dignity.js');
+
+const { ok, manifest } = validateDignityAppManifest({
+  id: 'timeline-demo',
+  title: 'Event timeline',
+  collections: ['posts'],
+  peerGroupId: 'feed:alice'
+});
+```
+
 ## Docs and Examples
 
 - **Documentation:** [jose-compu.github.io/dignity.js](https://jose-compu.github.io/dignity.js/)

package/dist/dignity.cjs.js

@@ -13270,6 +13270,123 @@ var require_query_replica = __commonJS({
   }
 });
 
+// src/apps/manifest.js
+var require_manifest = __commonJS({
+  "src/apps/manifest.js"(exports2, module2) {
+    var MANIFEST_SCHEMA_VERSION = 1;
+    var ID_PATTERN = /^[a-z0-9][a-z0-9._-]{0,63}$/;
+    function isNonEmptyString(value) {
+      return typeof value === "string" && value.trim().length > 0;
+    }
+    function validateStoredCommand(command, index) {
+      const prefix = `storedCommands[${index}]`;
+      if (!command || typeof command !== "object") {
+        return { ok: false, reason: `${prefix} must be an object` };
+      }
+      if (!isNonEmptyString(command.id)) {
+        return { ok: false, reason: `${prefix}.id is required` };
+      }
+      if (!isNonEmptyString(command.collection)) {
+        return { ok: false, reason: `${prefix}.collection is required` };
+      }
+      if (!["create", "update", "delete"].includes(command.kind)) {
+        return { ok: false, reason: `${prefix}.kind must be create, update, or delete` };
+      }
+      if (command.allowedFields !== void 0) {
+        if (!Array.isArray(command.allowedFields) || command.allowedFields.some((f) => !isNonEmptyString(f))) {
+          return { ok: false, reason: `${prefix}.allowedFields must be a string array` };
+        }
+      }
+      return { ok: true };
+    }
+    function validateDignityAppManifest2(raw) {
+      if (!raw || typeof raw !== "object") {
+        return { ok: false, reason: "manifest must be an object" };
+      }
+      if (raw.schemaVersion !== void 0 && raw.schemaVersion !== MANIFEST_SCHEMA_VERSION) {
+        return { ok: false, reason: `unsupported schemaVersion: ${raw.schemaVersion}` };
+      }
+      if (!isNonEmptyString(raw.id) || !ID_PATTERN.test(raw.id)) {
+        return { ok: false, reason: "id must match [a-z0-9][a-z0-9._-]{0,63}" };
+      }
+      if (!isNonEmptyString(raw.title)) {
+        return { ok: false, reason: "title is required" };
+      }
+      if (!Array.isArray(raw.collections) || raw.collections.length === 0) {
+        return { ok: false, reason: "collections must be a non-empty string array" };
+      }
+      const collections = [];
+      for (const name of raw.collections) {
+        if (!isNonEmptyString(name)) {
+          return { ok: false, reason: "collections entries must be non-empty strings" };
+        }
+        if (collections.includes(name)) {
+          return { ok: false, reason: `duplicate collection: ${name}` };
+        }
+        collections.push(name.trim());
+      }
+      const storedCommands = Array.isArray(raw.storedCommands) ? raw.storedCommands : [];
+      for (let index = 0; index < storedCommands.length; index += 1) {
+        const result = validateStoredCommand(storedCommands[index], index);
+        if (!result.ok) {
+          return result;
+        }
+        const collection = storedCommands[index].collection;
+        if (!collections.includes(collection)) {
+          return {
+            ok: false,
+            reason: `storedCommands[${index}] references undeclared collection: ${collection}`
+          };
+        }
+      }
+      const allowedCspOrigins = Array.isArray(raw.allowedCspOrigins) ? raw.allowedCspOrigins : [];
+      for (const origin of allowedCspOrigins) {
+        if (!isNonEmptyString(origin) || !origin.startsWith("https://")) {
+          return { ok: false, reason: "allowedCspOrigins entries must be https:// URLs" };
+        }
+        if (/localhost|127\.0\.0\.1/i.test(origin)) {
+          return { ok: false, reason: "localhost origins are not allowed in allowedCspOrigins" };
+        }
+      }
+      const manifest = {
+        schemaVersion: MANIFEST_SCHEMA_VERSION,
+        id: raw.id.trim(),
+        title: raw.title.trim(),
+        description: isNonEmptyString(raw.description) ? raw.description.trim() : "",
+        collections,
+        peerGroupId: isNonEmptyString(raw.peerGroupId) ? raw.peerGroupId.trim() : null,
+        publisherId: isNonEmptyString(raw.publisherId) ? raw.publisherId.trim() : null,
+        storedCommands: storedCommands.map((cmd) => ({
+          id: cmd.id.trim(),
+          collection: cmd.collection.trim(),
+          kind: cmd.kind,
+          allowedFields: Array.isArray(cmd.allowedFields) ? [...cmd.allowedFields] : null,
+          requiresRole: isNonEmptyString(cmd.requiresRole) ? cmd.requiresRole.trim() : null
+        })),
+        allowedCspOrigins: allowedCspOrigins.map((o) => o.trim()),
+        readOnly: storedCommands.length === 0
+      };
+      return { ok: true, manifest };
+    }
+    function collectionAllowed2(manifest, collectionName) {
+      return manifest && Array.isArray(manifest.collections) && manifest.collections.includes(collectionName);
+    }
+    function getStoredCommand2(manifest, commandId) {
+      if (!manifest || !Array.isArray(manifest.storedCommands)) {
+        return null;
+      }
+      return manifest.storedCommands.find((cmd) => cmd.id === commandId) || null;
+    }
+    module2.exports = {
+      MANIFEST_SCHEMA_VERSION,
+      ID_PATTERN,
+      validateDignityAppManifest: validateDignityAppManifest2,
+      collectionAllowed: collectionAllowed2,
+      getStoredCommand: getStoredCommand2
+    };
+  }
+});
+
 // src/index.js
 var DignityP2P = require_dignity_p2p();
 var createDefaultSignalingPool = require_create_default_signaling_pool();
@@ -13332,6 +13449,12 @@ var {
 } = require_peer_group_tiers();
 var { electBulkRelays, DEFAULT_BULK_RELAY_COUNT } = require_bulk_relay();
 var DignityQueryReplica = require_query_replica();
+var {
+  MANIFEST_SCHEMA_VERSION: DIGNITY_APP_MANIFEST_SCHEMA_VERSION,
+  validateDignityAppManifest,
+  collectionAllowed,
+  getStoredCommand
+} = require_manifest();
 module.exports = {
   DignityP2P,
   createDefaultSignalingPool,
@@ -13380,6 +13503,10 @@ module.exports = {
   filterPeersByTier,
   electBulkRelays,
   DEFAULT_BULK_RELAY_COUNT,
-  DignityQueryReplica
+  DignityQueryReplica,
+  DIGNITY_APP_MANIFEST_SCHEMA_VERSION,
+  validateDignityAppManifest,
+  collectionAllowed,
+  getStoredCommand
 };
 //# sourceMappingURL=dignity.cjs.js.map