reploid 0.0.0-stage → 0.1.1

package/packages/reploid/src/mesh/peer-identity.js

@@ -0,0 +1,87 @@
+/** Fresh proof of a signing identity bound to the current WebRTC certificates. */
+import { createPeerIdFromPublicJwk, importSigningKey, importVerificationKey,
+  getIdentitySignAlgorithm, encodeBytes, fromBase64Url, toBase64Url } from '../artifacts/identity.js';
+import { createRemoteGenerationRequests } from './remote-generation-requests.js';
+import policy from './computer-identity.policy.json' with { type: 'json' };
+
+const challengeType = 'reploid:identity-challenge', proofType = 'reploid:identity-proof';
+const sameBinding = (a, b) => !!a && !!b && a.local === b.local && a.remote === b.remote;
+const signedBytes = (challenge, participantId) => encodeBytes(JSON.stringify([
+  'reploid.mesh-recipient/v1', challenge.roomId, challenge.nonce,
+  challenge.requester, challenge.provider, challenge.local, challenge.remote, participantId
+]));
+
+export function createMeshPeerIdentity({ transport, getIdentity, roomId, timeoutMs, maxPending, onVerified = () => {} }) {
+  let closed = false;
+  const signing = new Set();
+  const verified = new Map();
+  const requests = createRemoteGenerationRequests({ timeoutMs, maxPending, sendCancel() {} });
+  // Label discovery must never consume a foreground generation/recovery proof slot.
+  const observations = createRemoteGenerationRequests({ timeoutMs, maxPending: policy.maxBackgroundProofs, sendCancel() {} });
+  const binding = peerId => transport.getPeerBinding?.(peerId) || null;
+  const attempt = peerId => transport.getPeerStates?.().find(peer => peer.id === peerId)?.attemptId ?? null;
+  const getVerified = peerId => {
+    const record = verified.get(peerId);
+    return !closed && record && sameBinding(record.channel, binding(peerId)) && record.attemptId === attempt(peerId)
+      ? record.participantId : null;
+  };
+  const answer = async (peerId, input) => {
+    if (closed || signing.size >= maxPending + policy.maxBackgroundProofs) return;
+    const channel = binding(peerId), challenge = structuredClone(input);
+    if (!channel || !challenge || challenge.roomId !== roomId || challenge.requester !== peerId
+      || challenge.provider !== transport._getPeerId() || typeof challenge.nonce !== 'string'
+      || !/^[a-f0-9-]{36}$/.test(challenge.nonce)
+      || challenge.local !== channel.remote || challenge.remote !== channel.local) return;
+    // Discovery and generation can verify the same connection concurrently.
+    // Deduplicate the challenge, not the peer; each fresh nonce needs its proof.
+    const requestKey = JSON.stringify([peerId, challenge.nonce]);
+    if (signing.has(requestKey)) return;
+    signing.add(requestKey);
+    try {
+      const identity = getIdentity(), key = await importSigningKey(identity);
+      const signature = await crypto.subtle.sign(getIdentitySignAlgorithm(identity), key, signedBytes(challenge, identity.peerId));
+      if (!closed && sameBinding(channel, binding(peerId))) transport.sendToPeer(peerId, proofType, {
+        nonce: challenge.nonce, participantId: identity.peerId, publicJwk: identity.publicJwk,
+        signature: toBase64Url(signature)
+      });
+    } finally { signing.delete(requestKey); }
+  };
+  const accept = async (peerId, input) => {
+    const owner = requests.get(input?.nonce, peerId) ? requests : observations;
+    const pending = owner.get(input?.nonce, peerId);
+    if (!pending || pending.processing) return;
+    pending.processing = true;
+    try {
+      const proof = structuredClone(input);
+      if (await createPeerIdFromPublicJwk(proof.publicJwk) !== proof.participantId) throw new Error('Recipient signing identity mismatch');
+      const key = await importVerificationKey(proof.publicJwk);
+      if (!await crypto.subtle.verify(getIdentitySignAlgorithm(proof.publicJwk), key,
+        fromBase64Url(proof.signature), signedBytes(pending.challenge, proof.participantId))) throw new Error('Invalid recipient identity proof');
+      if (closed || owner.get(proof.nonce, peerId) !== pending) return;
+      if (!sameBinding(pending.channel, binding(peerId))) throw new Error('Recipient connection changed during verification');
+      if (pending.attemptId !== attempt(peerId)) throw new Error('Recipient connection attempt changed during verification');
+      verified.set(peerId, { participantId: proof.participantId, channel: pending.channel, attemptId: pending.attemptId });
+      owner.settle(pending, { response: proof.participantId });
+      try { onVerified(peerId, proof.participantId); } catch { /* Observers cannot invalidate a proof. */ }
+    } catch (error) { owner.settle(pending, { error }); }
+  };
+  transport.onMessage(challengeType, (peerId, payload) => { answer(peerId, payload).catch(() => {}); });
+  transport.onMessage(proofType, (peerId, payload) => { accept(peerId, payload).catch(() => {}); });
+  const verify = async (owner, peerId, signal) => {
+    const channel = binding(peerId);
+    if (!channel) return null;
+    const challenge = { roomId, nonce: crypto.randomUUID(), requester: transport._getPeerId(), provider: peerId, ...channel };
+    const attemptId = attempt(peerId);
+    const participantId = await owner.start({ requestId: challenge.nonce, providerPeerId: peerId, signal, channel, challenge, attemptId },
+      () => transport.sendToPeer(peerId, challengeType, challenge));
+    if (attemptId && sameBinding(channel, binding(peerId))) transport.observePeerAuthentication?.(peerId, attemptId);
+    return participantId;
+  };
+  return Object.freeze({
+    getVerified,
+    verify: (peerId, signal) => verify(requests, peerId, signal),
+    observe: (peerId, signal) => verify(observations, peerId, signal),
+    retirePeer(peerId) { verified.delete(peerId); requests.retirePeer(peerId); observations.retirePeer(peerId); },
+    close() { closed = true; verified.clear(); requests.close(); observations.close(); }
+  });
+}

package/packages/reploid/src/mesh/placement-beliefs.js

@@ -0,0 +1,107 @@
+import { snapshotJson, freezeJson } from '../config/index.js';
+
+const fail = message => { throw new TypeError(`Placement beliefs: ${message}`); };
+const fields = (value, names) => {
+  if (!value || Array.isArray(value) || typeof value !== 'object'
+    || Object.keys(value).some(key => !names.includes(key))
+    || names.some(key => !Object.hasOwn(value, key))) fail(`expected fields ${names.join(', ')}`);
+};
+const id = value => {
+  if (typeof value !== 'string' || !/^[a-zA-Z0-9._:-]{1,160}$/.test(value)) fail('bounded identifier required');
+};
+const bounded = (value, minimum, maximum) => {
+  if (!Number.isFinite(value) || value < minimum || value > maximum) fail('finite bounded number required');
+};
+const lexical = (a, b) => a < b ? -1 : a > b ? 1 : 0;
+
+/** A categorical likelihood with Dirichlet priors. Outcome costs are host-declared
+ * estimates, not measured hardware facts. The host owns observation admission.
+ * @param {import('./placement-beliefs.js').PlacementBeliefPolicy} input
+ */
+export function resolvePlacementBeliefPolicy(input) {
+  const policy = snapshotJson(input);
+  fields(policy, ['schema', 'id', 'cohortId', 'maxObservations', 'maxAgeMs', 'completionValue',
+    'timeCostPerMs', 'costUnit', 'outcomes']);
+  if (policy.schema !== 'reploid.placement-belief-policy/v1') fail('unsupported policy');
+  id(policy.id); id(policy.cohortId); id(policy.costUnit);
+  bounded(policy.maxObservations, 1, 4096); bounded(policy.maxAgeMs, 1, Number.MAX_SAFE_INTEGER);
+  if (!Number.isSafeInteger(policy.maxObservations) || !Number.isSafeInteger(policy.maxAgeMs)) fail('integer bounds required');
+  bounded(policy.completionValue, 0, 1e9); bounded(policy.timeCostPerMs, 0, 1e6);
+  if (!Array.isArray(policy.outcomes) || policy.outcomes.length < 2 || policy.outcomes.length > 64
+    || new Set(policy.outcomes.map(row => row.id)).size !== policy.outcomes.length) fail('bounded distinct outcomes required');
+  for (const outcome of policy.outcomes) {
+    fields(outcome, ['id', 'prior', 'completed', 'latencyMs', 'totalCost']);
+    id(outcome.id); bounded(outcome.prior, 1e-6, 1e6);
+    if (typeof outcome.completed !== 'boolean') fail('explicit completion outcome required');
+    bounded(outcome.latencyMs, 0, 1e9); bounded(outcome.totalCost, 0, 1e9);
+  }
+  return freezeJson(policy);
+}
+
+/** Pure, replayable projection. No clocks, storage, CI, network or authority grants.
+ * Cancellation is censored (null outcome), never invented as a failed completion.
+ * @param {import('./placement-beliefs.js').PlacementBeliefInput} input
+ * @returns {import('./placement-beliefs.js').PlacementBeliefProjection}
+ */
+export function projectPlacementBeliefs(input) {
+  const { observations, candidates, now } = snapshotJson(input);
+  const policy = resolvePlacementBeliefPolicy(input.policy);
+  if (!Number.isSafeInteger(now) || now < 0) fail('explicit time required');
+  if (!Array.isArray(observations) || observations.length > policy.maxObservations) fail('bounded observations required');
+  if (!Array.isArray(candidates) || candidates.length > 4096
+    || new Set(candidates.map(row => row.providerId)).size !== candidates.length) fail('bounded unique candidates required');
+  for (const candidate of candidates) {
+    fields(candidate, ['providerId', 'contextId']); id(candidate.providerId); id(candidate.contextId);
+  }
+  const outcomes = new Map(policy.outcomes.map((row, i) => [row.id, i]));
+  const evidence = new Map(), dependencies = new Map(), ignored = [];
+  // Sort first so repeated delivery and caller iteration order cannot choose evidence.
+  const sorted = [...observations].sort((a, b) => lexical(a.evidenceId, b.evidenceId));
+  for (const row of sorted) {
+    fields(row, ['evidenceId', 'dependencyId', 'providerId', 'contextId', 'observedAt', 'outcomeId']);
+    for (const key of ['evidenceId', 'dependencyId', 'providerId', 'contextId']) id(row[key]);
+    if (!Number.isSafeInteger(row.observedAt) || row.observedAt < 0 || row.observedAt > now) fail('invalid observation time');
+    if (row.outcomeId !== null && !outcomes.has(row.outcomeId)) fail('unknown outcome');
+    const prior = evidence.get(row.evidenceId);
+    if (prior) {
+      if (['dependencyId', 'providerId', 'contextId', 'observedAt', 'outcomeId'].some(key => prior[key] !== row[key])) fail('conflicting evidence identity');
+      continue;
+    }
+    evidence.set(row.evidenceId, row);
+    const related = dependencies.get(row.dependencyId);
+    if (related && ['providerId', 'contextId', 'outcomeId', 'observedAt'].some(key => related[key] !== row[key])) {
+      fail('dependent observations require a joint model; conflicting reports cannot be independent trials');
+    }
+    if (related) { ignored.push({ evidenceId: row.evidenceId, reason: 'shared-evidence' }); continue; }
+    dependencies.set(row.dependencyId, row);
+  }
+  const counts = new Map(candidates.map(row => [row.providerId, policy.outcomes.map(() => 0)]));
+  const used = new Map(candidates.map(row => [row.providerId, []]));
+  for (const row of dependencies.values()) {
+    const candidate = candidates.find(item => item.providerId === row.providerId);
+    const reason = now - row.observedAt > policy.maxAgeMs ? 'stale'
+      : !candidate || candidate.contextId !== row.contextId ? 'different-context'
+        : row.outcomeId === null ? 'censored' : null;
+    if (reason) { ignored.push({ evidenceId: row.evidenceId, reason }); continue; }
+    counts.get(row.providerId)[outcomes.get(row.outcomeId)] += 1;
+    used.get(row.providerId).push(row.evidenceId);
+  }
+  const rows = [...candidates].sort((a, b) => lexical(a.providerId, b.providerId)).map(candidate => {
+    const alpha = policy.outcomes.map((row, i) => row.prior + counts.get(candidate.providerId)[i]);
+    const concentration = alpha.reduce((sum, value) => sum + value, 0);
+    const probability = alpha.map(value => value / concentration);
+    const mean = values => values.reduce((sum, value, i) => sum + value * probability[i], 0);
+    const utility = policy.outcomes.map(row => (row.completed ? policy.completionValue : 0)
+      - row.totalCost - policy.timeCostPerMs * row.latencyMs);
+    const expectedUtility = mean(utility);
+    return { ...candidate, evidenceIds: used.get(candidate.providerId),
+      posterior: policy.outcomes.map((row, i) => ({ outcomeId: row.id, alpha: alpha[i], probability: probability[i],
+        probabilityVariance: probability[i] * (1 - probability[i]) / (concentration + 1) })),
+      completionProbability: mean(policy.outcomes.map(row => Number(row.completed))),
+      expectedLatencyMs: mean(policy.outcomes.map(row => row.latencyMs)),
+      expectedTotalCost: mean(policy.outcomes.map(row => row.totalCost)), expectedUtility,
+      utilityVariance: mean(utility.map(value => (value - expectedUtility) ** 2)) / (concentration + 1) };
+  });
+  return freezeJson({ schema: 'reploid.placement-beliefs/v1', policy, selectedAt: now, candidates: rows,
+    ignored: ignored.sort((a, b) => lexical(a.evidenceId, b.evidenceId)) });
+}

package/packages/reploid/src/mesh/preparation-progress.js

@@ -0,0 +1,46 @@
+/** Bounded public loading telemetry. Never publish file paths, prompts or raw errors. */
+export function publicPreparationProgress(progress) {
+  if (!progress || typeof progress !== 'object') return null;
+  let kind = progress.kind;
+  if (!['downloading', 'receiving', 'cached', 'pipelines', 'loading'].includes(kind)) {
+    if (progress.stage === 'acquiring') kind = /^Downloading/.test(progress.message) ? 'downloading'
+      : /^Receiving/.test(progress.message) ? 'receiving' : /^Reusing/.test(progress.message) ? 'cached' : 'loading';
+    else kind = progress.phase === 'pipelines' || progress.stage === 'preparing' && Number.isSafeInteger(progress.prepared)
+      ? 'pipelines' : 'loading';
+  }
+  const result = { kind };
+  if (typeof progress.workId === 'string' && progress.workId.length <= 96) result.workId = progress.workId;
+  if (Number.isSafeInteger(progress.sequence) && progress.sequence >= 0) result.sequence = progress.sequence;
+  if (['preparing', 'prepared', 'cancelling', 'cancelled', 'timed-out', 'failed'].includes(progress.status)) result.status = progress.status;
+  if (typeof progress.outstanding === 'boolean') result.outstanding = progress.outstanding;
+  if (Number.isSafeInteger(progress.receivedBytes) && Number.isSafeInteger(progress.totalBytes)
+    && progress.totalBytes > 0 && progress.receivedBytes >= 0 && progress.receivedBytes <= progress.totalBytes) {
+    result.receivedBytes = progress.receivedBytes; result.totalBytes = progress.totalBytes;
+  }
+  if (kind === 'pipelines' && Number.isSafeInteger(progress.prepared) && Number.isSafeInteger(progress.total)
+    && progress.total > 0 && progress.prepared >= 0 && progress.prepared <= progress.total) {
+    result.prepared = progress.prepared; result.total = progress.total;
+  }
+  return result;
+}
+
+
+/** Observation-only high-water counters per preparation and file/pipeline work item.
+ * Paths stay local; opaque work IDs distinguish a new file from regressing progress.
+ */
+export function createPreparationProgressObserver() {
+  const operation = crypto.randomUUID(), work = new Map();
+  let sequence = 0;
+  return value => {
+    const step = publicPreparationProgress(value);
+    if (!step) return value;
+    const key = JSON.stringify([step.kind, value.path || '', step.totalBytes ?? step.total ?? null]);
+    const previous = work.get(key);
+    const next = { ...value, ...step, workId: previous?.workId || `${operation}:${work.size}`, sequence: ++sequence };
+    for (const field of ['receivedBytes', 'prepared']) if (previous?.[field] !== undefined) {
+      next[field] = Math.max(previous[field], next[field] ?? 0);
+    }
+    work.set(key, next);
+    return next;
+  };
+}

package/packages/reploid/src/mesh/provider-hardware.js

@@ -0,0 +1,11 @@
+/** Bounded, self-reported GPU metadata. Never an identity or an admission input. */
+export function publicProviderHardware(value) {
+  if (!value || typeof value !== 'object' || Array.isArray(value)) return null;
+  const result = {};
+  for (const key of ['vendor', 'architecture', 'device', 'description']) {
+    if (typeof value[key] !== 'string') continue;
+    const text = value[key].replace(/[\u0000-\u001f\u007f]/g, '').trim().slice(0, 160);
+    if (text) result[key] = text;
+  }
+  return Object.keys(result).length ? result : null;
+}

package/packages/reploid/src/mesh/remote-generation-requests.js

@@ -0,0 +1,53 @@
+/** Single terminal settlement for bounded, cancellable remote generation requests. */
+export function createRemoteGenerationRequests({ timeoutMs, maxPending, sendCancel }) {
+  const requests = new Map();
+  let closed = false;
+  const settle = (pending, outcome = {}) => {
+    if (!pending || requests.get(pending.requestId) !== pending) return false;
+    requests.delete(pending.requestId);
+    clearTimeout(pending.timer);
+    pending.signal?.removeEventListener('abort', pending.abort);
+    if (outcome.cancel) {
+      // Transport teardown must not prevent local settlement.
+      try { sendCancel(pending.providerPeerId, pending.requestId); } catch { /* Original failure remains authoritative. */ }
+    }
+    if (Object.hasOwn(outcome, 'error')) pending.reject(outcome.error ?? new Error('Remote request cancelled'));
+    else pending.resolve(outcome.response);
+    return true;
+  };
+  const start = (metadata, send) => {
+    if (closed) return Promise.reject(new Error('Mesh is closed'));
+    if (requests.size >= maxPending) return Promise.reject(new Error('Pending remote job limit exceeded'));
+    if (requests.has(metadata.requestId)) return Promise.reject(new Error('Duplicate remote request identity'));
+    metadata.signal?.throwIfAborted();
+    return new Promise((resolve, reject) => {
+      const pending = { ...metadata, resolve, reject, processing: false };
+      pending.abort = () => settle(pending, { error: pending.signal.reason, cancel: true });
+      pending.timer = setTimeout(() => settle(pending, {
+        error: new Error('Timed out waiting for remote host slot response'), cancel: true
+      }), timeoutMs);
+      requests.set(pending.requestId, pending);
+      pending.signal?.addEventListener('abort', pending.abort, { once: true });
+      try {
+        if (!send()) settle(pending, { error: new Error('Failed to send swarm generation request') });
+      } catch (error) { settle(pending, { error, cancel: true }); }
+    });
+  };
+  return Object.freeze({
+    start, settle,
+    get size() { return requests.size; },
+    get(requestId, peerId) {
+      const pending = requests.get(String(requestId || ''));
+      return pending?.providerPeerId === peerId ? pending : null;
+    },
+    retirePeer(peerId) {
+      for (const pending of requests.values()) if (pending.providerPeerId === peerId) {
+        settle(pending, { error: new Error('Execution peer disconnected; retry requires a new attempt') });
+      }
+    },
+    close() {
+      closed = true;
+      for (const pending of requests.values()) settle(pending, { error: new Error('Mesh closed'), cancel: true });
+    }
+  });
+}

package/packages/reploid/src/mesh/swarm-coordination.js

@@ -0,0 +1,140 @@
+/**
+ * @fileoverview Swarm roles, task envelopes, and transport-agnostic coordination.
+ */
+
+import { DEFAULT_REWARD_POLICY, rankProviderPeers } from './contribution.js';
+
+export const SWARM_ROLES = Object.freeze({
+  SOLO: 'solo',
+  PROVIDER: 'provider',
+  CONSUMER: 'consumer',
+  DEAD: 'dead'
+});
+
+export function deriveSwarmRole(options = {}) {
+  const hasInference = !!options.hasInference;
+  const swarmEnabled = !!options.swarmEnabled;
+
+  if (hasInference && !swarmEnabled) return SWARM_ROLES.SOLO;
+  if (hasInference && swarmEnabled) return SWARM_ROLES.PROVIDER;
+  if (!hasInference && swarmEnabled) return SWARM_ROLES.CONSUMER;
+  return SWARM_ROLES.DEAD;
+}
+
+export function createPeerAdvertisement(options = {}) {
+  const peerId = String(options.peerId || 'unknown').trim() || 'unknown';
+  const capabilities = Array.from(new Set(Array.isArray(options.capabilities) ? options.capabilities.filter(Boolean) : []));
+  const swarmEnabled = !!options.swarmEnabled;
+  const hasInference = !!options.hasInference;
+
+  return {
+    kind: 'peer_advertisement',
+    peerId,
+    role: deriveSwarmRole({ hasInference, swarmEnabled }),
+    swarmEnabled,
+    hasInference,
+    capabilities,
+    contribution: options.contribution || null,
+    updatedAt: Number(options.updatedAt || Date.now())
+  };
+}
+
+export function createGenerationRequest(options = {}) {
+  const task = String(options.task || '').trim();
+  if (!task) {
+    throw new Error('Missing task');
+  }
+
+  return {
+    kind: 'generation_request',
+    requestId: String(options.requestId || `req_${Date.now()}`),
+    consumer: String(options.consumer || '').trim() || 'unknown',
+    provider: options.provider ? String(options.provider) : null,
+    model: options.model ? String(options.model) : null,
+    task,
+    context: options.context || null,
+    maxInputTokens: Math.max(0, Number(options.maxInputTokens || 0)),
+    maxOutputTokens: Math.max(0, Number(options.maxOutputTokens || 0)),
+    createdAt: Number(options.createdAt || Date.now())
+  };
+}
+
+export function createGenerationResult(options = {}) {
+  return {
+    kind: 'generation_result',
+    requestId: String(options.requestId || ''),
+    provider: String(options.provider || '').trim() || 'unknown',
+    content: String(options.content || ''),
+    usage: options.usage || null,
+    error: options.error ? String(options.error) : null,
+    completedAt: Number(options.completedAt || Date.now())
+  };
+}
+
+export function buildSwarmState(options = {}) {
+  const peers = Array.isArray(options.peers) ? options.peers : [];
+  const role = deriveSwarmRole({
+    hasInference: !!options.hasInference,
+    swarmEnabled: !!options.swarmEnabled
+  });
+
+  return {
+    enabled: !!options.swarmEnabled,
+    role,
+    peerCount: peers.length,
+    providerCount: peers.filter((peer) => peer?.role === SWARM_ROLES.PROVIDER).length,
+    consumerCount: peers.filter((peer) => peer?.role === SWARM_ROLES.CONSUMER).length,
+    soloCount: peers.filter((peer) => peer?.role === SWARM_ROLES.SOLO).length
+  };
+}
+
+export function chooseProviderPeer(peers = [], options = {}) {
+  const ranked = rankProviderPeers(peers, {
+    now: options.now || Date.now(),
+    policy: options.policy || DEFAULT_REWARD_POLICY
+  });
+  return ranked[0] || null;
+}
+
+export function createSwarmController(options = {}) {
+  const peerMap = new Map();
+  const policy = options.policy || DEFAULT_REWARD_POLICY;
+
+  const listPeers = () => Array.from(peerMap.values());
+
+  return {
+    upsertPeer(peer) {
+      if (!peer?.peerId) return null;
+      const next = createPeerAdvertisement(peer);
+      peerMap.set(next.peerId, next);
+      return next;
+    },
+    removePeer(peerId) {
+      return peerMap.delete(String(peerId || ''));
+    },
+    listPeers,
+    chooseProvider(now = Date.now()) {
+      return chooseProviderPeer(listPeers(), { now, policy });
+    },
+    getState(input = {}) {
+      return buildSwarmState({
+        ...input,
+        peers: listPeers()
+      });
+    },
+    createAdvertisement: createPeerAdvertisement,
+    createRequest: createGenerationRequest,
+    createResult: createGenerationResult
+  };
+}
+
+export default {
+  SWARM_ROLES,
+  buildSwarmState,
+  chooseProviderPeer,
+  createGenerationRequest,
+  createGenerationResult,
+  createPeerAdvertisement,
+  createSwarmController,
+  deriveSwarmRole
+};

package/packages/reploid/src/mesh/web-access-network.js

@@ -0,0 +1,112 @@
+/** Bounded search/extraction jobs on the existing authenticated peer connection.
+ * Hosts provide public-web execution and opt-in. This channel never reads browser tabs,
+ * requests model execution, changes disclosure recipients, or closes its borrowed transport. */
+import policy from './web-access-policy.json' with { type: 'json' };
+import { createRemoteGenerationRequests } from './remote-generation-requests.js';
+
+const OFFER = 'reploid:web-offer', REQUEST = 'reploid:web-request';
+const RESPONSE = 'reploid:web-response', CANCEL = 'reploid:web-cancel';
+const validId = value => typeof value === 'string' && value.length > 0 && value.length <= 256;
+const size = value => new TextEncoder().encode(JSON.stringify(value)).length;
+const fail = message => { throw new Error(message); };
+
+export function createWebAccessNetwork({ transport, verifyPeer, worker = null, enabled = () => false, onChange = () => {} }) {
+  const offers = new Map(), checking = new Map(), epochs = new Map(), inbound = new Map(), seen = new Map();
+  let closed = false;
+  const send = (peer, type, payload) => !closed && size(payload) <= policy.maxMessageBytes && transport.sendToPeer(peer, type, payload);
+  const pending = createRemoteGenerationRequests({ timeoutMs: policy.timeoutMs, maxPending: policy.maxPending,
+    sendCancel: (peer, requestId) => send(peer, CANCEL, { requestId }) });
+  const peers = () => new Set(transport.getConnectedPeers().map(peer => peer.id));
+  const available = () => !closed && worker && enabled() === true;
+  const describe = () => available() && (worker.isAvailable?.() ?? true) ? { service: worker.service, version: worker.version } : null;
+  const publish = peer => send(peer, OFFER, describe());
+  const notify = () => onChange();
+  const retire = peer => {
+    if (offers.delete(peer)) notify();
+    pending.retirePeer(peer);
+    for (const job of inbound.values()) if (job.peer === peer) job.controller.abort(new Error('Search requester disconnected'));
+  };
+  const tick = () => {
+    if (closed) return;
+    const connected = peers();
+    for (const peer of epochs.keys()) if (!connected.has(peer)) { epochs.delete(peer); checking.get(peer)?.abort(); }
+    for (const peer of offers.keys()) if (!connected.has(peer)) retire(peer);
+    for (const job of inbound.values()) if (!connected.has(job.peer) || !available()) job.controller.abort(new Error('Web contribution stopped'));
+    for (const peer of connected) publish(peer);
+    const cutoff = Date.now() - policy.resultTtlMs;
+    for (const [key, at] of seen) if (at < cutoff) seen.delete(key);
+  };
+  transport.onMessage(OFFER, (peer, offer) => {
+    if (closed || !peers().has(peer)) return;
+    if (!offer) { checking.get(peer)?.abort(); epochs.delete(peer); retire(peer); return; }
+    if (!Object.hasOwn(policy.services, offer.service) || offer.version !== policy.services[offer.service] || checking.has(peer) || checking.size >= policy.maxPeers) return;
+    const controller = new AbortController(), timer = setTimeout(() => controller.abort(), policy.timeoutMs);
+    checking.set(peer, controller); epochs.set(peer, controller);
+    Promise.resolve().then(() => verifyPeer(peer, controller.signal)).then(participantId => {
+      if (closed || epochs.get(peer) !== controller || controller.signal.aborted || !peers().has(peer) || !validId(participantId)) return;
+      const prior = offers.get(peer);
+      if (prior?.participantId === participantId && prior.service === offer.service && prior.version === offer.version) return;
+      if (offers.size >= policy.maxPeers) return;
+      offers.set(peer, { peerId: peer, participantId, service: offer.service, version: offer.version }); notify();
+    }).catch(() => {}).finally(() => { clearTimeout(timer); checking.delete(peer); });
+  });
+  transport.onMessage(RESPONSE, (peer, payload) => {
+    if (closed || !payload || size(payload) > policy.maxMessageBytes) return;
+    const job = pending.get(payload.requestId, peer);
+    if (!job) return;
+    if (payload.error) pending.settle(job, { error: new Error(String(payload.error).slice(0, 256)) });
+    else pending.settle(job, { response: payload.result });
+  });
+  transport.onMessage(CANCEL, (peer, payload) => {
+    const job = inbound.get(`${peer}/${payload?.requestId}`);
+    job?.controller.abort(new Error('Web request cancelled'));
+  });
+  transport.onMessage(REQUEST, (peer, input) => {
+    if (closed || !input || !validId(input.requestId) || size(input) > policy.maxMessageBytes) return;
+    const key = `${peer}/${input.requestId}`;
+    const reject = message => send(peer, RESPONSE, { requestId: input.requestId, error: message });
+    if (!available()) return reject('Web contribution is off');
+    if (input.operation === 'search' && worker.isAvailable?.() === false) return reject('Contributor browser is unavailable');
+    if (input.service !== worker.service || input.version !== worker.version) return reject('Search service changed');
+    if (!['search', 'extract'].includes(input.operation) || !input.args || typeof input.args !== 'object') return reject('Invalid web request');
+    if (inbound.has(key) || seen.has(key)) return reject('Duplicate web request');
+    if (inbound.size >= policy.maxInbound || seen.size >= policy.maxSeen) return reject('Web contributor is busy');
+    const controller = new AbortController(), timer = setTimeout(() => controller.abort(new Error('Web request timed out')), policy.timeoutMs);
+    const job = { peer, controller, promise: null }; inbound.set(key, job); seen.set(key, Date.now());
+    job.promise = Promise.resolve().then(async () => {
+      const requester = await verifyPeer(peer, controller.signal);
+      controller.signal.throwIfAborted();
+      if (!validId(requester) || !available() || !peers().has(peer)) fail('Web request is not authorized');
+      const result = await worker[input.operation](input.args, { signal: controller.signal, requester });
+      controller.signal.throwIfAborted();
+      if (!available()) fail('Web contribution stopped');
+      if (size({ requestId: input.requestId, result }) > policy.maxMessageBytes) fail('Web result exceeds the transfer limit');
+      send(peer, RESPONSE, { requestId: input.requestId, result });
+    }).catch(() => reject(controller.signal.aborted ? 'Web request cancelled or timed out' : 'Web request failed'))
+      .finally(() => { clearTimeout(timer); inbound.delete(key); });
+  });
+  const timer = setInterval(tick, policy.pollMs); timer.unref?.(); tick();
+  return Object.freeze({
+    getOffers: () => [...offers.values()].map(offer => ({ ...offer })),
+    refresh: tick,
+    async request(offer, operation, args, signal) {
+      offer = structuredClone(offer); args = structuredClone(args);
+      signal?.throwIfAborted();
+      const current = offers.get(offer?.peerId);
+      if (closed || !current || current.participantId !== offer.participantId || current.service !== offer.service || current.version !== offer.version || !peers().has(offer.peerId)) fail('Search contributor changed; allow a new search');
+      const identity = await verifyPeer(offer.peerId, signal);
+      signal?.throwIfAborted();
+      if (identity !== offer.participantId || offers.get(offer.peerId) !== current) fail('Search contributor changed; allow a new search');
+      const requestId = crypto.randomUUID();
+      return pending.start({ requestId, providerPeerId: offer.peerId, signal }, () => send(offer.peerId, REQUEST,
+        { requestId, service: current.service, version: current.version, operation, args }));
+    },
+    async close() {
+      for (const peer of peers()) send(peer, OFFER, null);
+      for (const controller of checking.values()) controller.abort();
+      pending.close(); closed = true; clearInterval(timer); offers.clear(); notify();
+      for (const job of inbound.values()) job.controller.abort(new Error('Web contributor closed'));
+      await Promise.allSettled([...inbound.values()].map(job => job.promise));
+    }
+  });
+}

package/packages/reploid/src/mesh/web-access-policy.json

@@ -0,0 +1,17 @@
+{
+  "pollMs": 5000,
+  "timeoutMs": 15000,
+  "maxPending": 8,
+  "maxInbound": 8,
+  "maxPeers": 64,
+  "maxMessageBytes": 48000,
+  "maxQueryCharacters": 2000,
+  "maxResults": 5,
+  "maxSourceCharacters": 6000,
+  "maxSeen": 512,
+  "resultTtlMs": 60000,
+  "services": {
+    "google-browser": "1",
+    "bing": "1"
+  }
+}