signalk-p2p-plugin 0.3.0 → 0.4.1

package/dist/policy/policy.js

@@ -0,0 +1,147 @@
+import { verifyDetached } from "../identity.js";
+import { canonicalJson } from "../groups/types.js";
+import { PROTOCOL_VERSION } from "../data/envelope.js";
+import { ALL_VESSELS_TOPIC } from "../live/topic.js";
+export const DEFAULT_POLICY_VERSION = 1;
+export const MAX_POLICY_RATE_HZ = 10;
+export function defaultPolicy(version = DEFAULT_POLICY_VERSION, issuedAt = Math.floor(Date.now() / 1000)) {
+    return {
+        version,
+        topic: ALL_VESSELS_TOPIC,
+        protocol: PROTOCOL_VERSION,
+        issuedAt,
+        sharding: {
+            maxVesselsPerShard: 500,
+            maxVesselsPerInstance: 1000,
+            lookAheadKm: 50,
+            splitSettleMinutes: 10,
+            mergeSettleMinutes: 60,
+            mergeBelowRatio: 0.25,
+            boundaryHysteresisMeters: 1000,
+        },
+        election: {
+            epochMinutes: 10,
+            minUptimeMinutes: 10,
+        },
+        rates: {
+            maxSnapshotHzUnderway: 0.05,
+            maxSnapshotHzMoored: 0.01,
+        },
+        ais: {
+            maxTargets: 100,
+            maxRateHz: 0.02,
+        },
+    };
+}
+export function policyBytes(policy) {
+    return Buffer.from(canonicalJson(policy));
+}
+export function signPolicy(policy, identity) {
+    return {
+        policy,
+        signature: identity.sign(policyBytes(policy)).toString("base64"),
+    };
+}
+export function verifyPolicy(signed, operatorKeys, expectedTopic, now = Math.floor(Date.now() / 1000)) {
+    if (!validPolicy(signed.policy, expectedTopic, now))
+        return false;
+    const bytes = policyBytes(signed.policy);
+    const signature = Buffer.from(signed.signature, "base64");
+    for (const key of operatorKeys) {
+        if (!/^[0-9a-f]{64}$/i.test(key))
+            continue;
+        if (verifyDetached(Buffer.from(key, "hex"), bytes, signature))
+            return true;
+    }
+    return false;
+}
+export function validPolicy(policy, expectedTopic, now = Math.floor(Date.now() / 1000)) {
+    if (!Number.isInteger(policy.version) || policy.version < 1)
+        return false;
+    if (policy.topic !== expectedTopic)
+        return false;
+    if (policy.protocol !== PROTOCOL_VERSION)
+        return false;
+    if (!Number.isInteger(policy.issuedAt) || policy.issuedAt < 0)
+        return false;
+    if (policy.notBefore !== undefined &&
+        (!Number.isInteger(policy.notBefore) || policy.notBefore > now)) {
+        return false;
+    }
+    if (policy.notAfter !== undefined &&
+        policy.notAfter > 0 &&
+        (!Number.isInteger(policy.notAfter) || policy.notAfter < now)) {
+        return false;
+    }
+    const sharding = policy.sharding;
+    if (!sharding || typeof sharding !== "object")
+        return false;
+    if (!positive(sharding.maxVesselsPerShard))
+        return false;
+    if (!positive(sharding.maxVesselsPerInstance))
+        return false;
+    if (!nonNegative(sharding.lookAheadKm))
+        return false;
+    if (!nonNegative(sharding.splitSettleMinutes))
+        return false;
+    if (!nonNegative(sharding.mergeSettleMinutes))
+        return false;
+    if (typeof sharding.mergeBelowRatio !== "number" ||
+        sharding.mergeBelowRatio < 0 ||
+        sharding.mergeBelowRatio > 1) {
+        return false;
+    }
+    if (!nonNegative(sharding.boundaryHysteresisMeters))
+        return false;
+    const election = policy.election;
+    if (!election || typeof election !== "object")
+        return false;
+    if (!positive(election.epochMinutes))
+        return false;
+    if (!nonNegative(election.minUptimeMinutes))
+        return false;
+    const rates = policy.rates;
+    if (!rates || typeof rates !== "object")
+        return false;
+    if (!rate(rates.maxSnapshotHzUnderway))
+        return false;
+    if (!rate(rates.maxSnapshotHzMoored))
+        return false;
+    const ais = policy.ais;
+    if (!ais || typeof ais !== "object")
+        return false;
+    if (!nonNegative(ais.maxTargets))
+        return false;
+    if (!rate(ais.maxRateHz, true))
+        return false;
+    return true;
+}
+export function encodePolicy(signed) {
+    return Buffer.from(JSON.stringify(signed), "utf8");
+}
+export function decodePolicy(data) {
+    const parsed = JSON.parse(data.toString("utf8"));
+    if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) {
+        throw new Error("policy: expected an object");
+    }
+    const signed = parsed;
+    if (signed.policy === null ||
+        typeof signed.policy !== "object" ||
+        typeof signed.signature !== "string") {
+        throw new Error("policy: malformed record");
+    }
+    return signed;
+}
+function positive(value) {
+    return typeof value === "number" && Number.isFinite(value) && value > 0;
+}
+function nonNegative(value) {
+    return typeof value === "number" && Number.isFinite(value) && value >= 0;
+}
+function rate(value, allowZero = false) {
+    return (typeof value === "number" &&
+        Number.isFinite(value) &&
+        (allowZero ? value >= 0 : value > 0) &&
+        value <= MAX_POLICY_RATE_HZ);
+}
+//# sourceMappingURL=policy.js.map

package/dist/policy/policy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy.js","sourceRoot":"","sources":["../../src/policy/policy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAiB,MAAM,gBAAgB,CAAC;AAC/D,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACnD,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AACvD,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AA8CrD,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC;AACxC,MAAM,CAAC,MAAM,kBAAkB,GAAG,EAAE,CAAC;AAErC,MAAM,UAAU,aAAa,CAC3B,OAAO,GAAG,sBAAsB,EAChC,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;IAExC,OAAO;QACL,OAAO;QACP,KAAK,EAAE,iBAAiB;QACxB,QAAQ,EAAE,gBAAgB;QAC1B,QAAQ;QACR,QAAQ,EAAE;YACR,kBAAkB,EAAE,GAAG;YACvB,qBAAqB,EAAE,IAAI;YAC3B,WAAW,EAAE,EAAE;YACf,kBAAkB,EAAE,EAAE;YACtB,kBAAkB,EAAE,EAAE;YACtB,eAAe,EAAE,IAAI;YACrB,wBAAwB,EAAE,IAAI;SAC/B;QACD,QAAQ,EAAE;YACR,YAAY,EAAE,EAAE;YAChB,gBAAgB,EAAE,EAAE;SACrB;QACD,KAAK,EAAE;YACL,qBAAqB,EAAE,IAAI;YAC3B,mBAAmB,EAAE,IAAI;SAC1B;QACD,GAAG,EAAE;YACH,UAAU,EAAE,GAAG;YACf,SAAS,EAAE,IAAI;SAChB;KACF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,MAAqB;IAC/C,OAAO,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC;AAC5C,CAAC;AAED,MAAM,UAAU,UAAU,CACxB,MAAqB,EACrB,QAAkB;IAElB,OAAO;QACL,MAAM;QACN,SAAS,EAAE,QAAQ,CAAC,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC;KACjE,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,YAAY,CAC1B,MAAoB,EACpB,YAAsB,EACtB,aAAqB,EACrB,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;IAEnC,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,MAAM,EAAE,aAAa,EAAE,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IAClE,MAAM,KAAK,GAAG,WAAW,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACzC,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;IAC1D,KAAK,MAAM,GAAG,IAAI,YAAY,EAAE,CAAC;QAC/B,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,GAAG,CAAC;YAAE,SAAS;QAC3C,IAAI,cAAc,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,KAAK,EAAE,SAAS,CAAC;YAAE,OAAO,IAAI,CAAC;IAC7E,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,WAAW,CACzB,MAAqB,EACrB,aAAqB,EACrB,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;IAEnC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IAC1E,IAAI,MAAM,CAAC,KAAK,KAAK,aAAa;QAAE,OAAO,KAAK,CAAC;IACjD,IAAI,MAAM,CAAC,QAAQ,KAAK,gBAAgB;QAAE,OAAO,KAAK,CAAC;IACvD,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,MAAM,CAAC,QAAQ,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IAC5E,IACE,MAAM,CAAC,SAAS,KAAK,SAAS;QAC9B,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,MAAM,CAAC,SAAS,GAAG,GAAG,CAAC,EAC/D,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IACE,MAAM,CAAC,QAAQ,KAAK,SAAS;QAC7B,MAAM,CAAC,QAAQ,GAAG,CAAC;QACnB,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,MAAM,CAAC,QAAQ,GAAG,GAAG,CAAC,EAC7D,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC;IACjC,IAAI,CAAC,QAAQ,IAAI,OAAO,QAAQ,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC5D,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,kBAAkB,CAAC;QAAE,OAAO,KAAK,CAAC;IACzD,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,qBAAqB,CAAC;QAAE,OAAO,KAAK,CAAC;IAC5D,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,WAAW,CAAC;QAAE,OAAO,KAAK,CAAC;IACrD,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,kBAAkB,CAAC;QAAE,OAAO,KAAK,CAAC;IAC5D,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,kBAAkB,CAAC;QAAE,OAAO,KAAK,CAAC;IAC5D,IACE,OAAO,QAAQ,CAAC,eAAe,KAAK,QAAQ;QAC5C,QAAQ,CAAC,eAAe,GAAG,CAAC;QAC5B,QAAQ,CAAC,eAAe,GAAG,CAAC,EAC5B,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,wBAAwB,CAAC;QAAE,OAAO,KAAK,CAAC;IAClE,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC;IACjC,IAAI,CAAC,QAAQ,IAAI,OAAO,QAAQ,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC5D,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,YAAY,CAAC;QAAE,OAAO,KAAK,CAAC;IACnD,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,gBAAgB,CAAC;QAAE,OAAO,KAAK,CAAC;IAC1D,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC;IAC3B,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IACtD,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,qBAAqB,CAAC;QAAE,OAAO,KAAK,CAAC;IACrD,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,mBAAmB,CAAC;QAAE,OAAO,KAAK,CAAC;IACnD,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC;IACvB,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAClD,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,UAAU,CAAC;QAAE,OAAO,KAAK,CAAC;IAC/C,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IAC7C,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,MAAoB;IAC/C,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,CAAC;AACrD,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,IAAY;IACvC,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;IAC1D,IAAI,MAAM,KAAK,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3E,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;IAChD,CAAC;IACD,MAAM,MAAM,GAAG,MAAsB,CAAC;IACtC,IACE,MAAM,CAAC,MAAM,KAAK,IAAI;QACtB,OAAO,MAAM,CAAC,MAAM,KAAK,QAAQ;QACjC,OAAO,MAAM,CAAC,SAAS,KAAK,QAAQ,EACpC,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC;IAC9C,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC,CAAC;AAC1E,CAAC;AAED,SAAS,WAAW,CAAC,KAAc;IACjC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;AAC3E,CAAC;AAED,SAAS,IAAI,CAAC,KAAc,EAAE,SAAS,GAAG,KAAK;IAC7C,OAAO,CACL,OAAO,KAAK,KAAK,QAAQ;QACzB,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC;QACtB,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC;QACpC,KAAK,IAAI,kBAAkB,CAC5B,CAAC;AACJ,CAAC"}

package/docs/plans/README.md

@@ -37,13 +37,13 @@ of private groups.
 | -------------- | ---------------------------------------------------------------------------------------------------------------------------------------- |
 | Stack          | Holepunch: Hyperswarm + `@hyperswarm/secret-stream` + Protomux + Hypercore/Hyperbee + Autobase.                                          |
 | Transport      | Live plane = generation-rotated Hypercore channels; durable plane = Hypercore/Hyperbee/Autobase.                                         |
-| Public network | `all-vessels`, joined and transmitting by default, opt-out, with four consent modes.                                                     |
+| Public network | `all-vessels`, joined by default; transmission is opt-in (`receive-only` default), with four consent modes.                              |
 | Sharding       | Global by default; adaptive geographic shards that subdivide to keep a configured vessel count.                                          |
 | Relays         | No fixed relays; a peer-elected aggregator per shard, gossip fallback, optional standalone bootstrap peer.                               |
 | Identity       | Persistent Ed25519 keypair per instance; groups keyed by identity, not by a shared secret.                                               |
 | Groups         | Arbitrary number; roles, signed roster, simple invite links, re-key and member removal.                                                  |
 | Injection      | Received vessels become real Signal K contexts; local data wins; no bridging between networks.                                           |
-| Shared data    | Per-data-set toggles (public / selected groups / none); curated defaults (no `electrical.*`).                                            |
+| Shared data    | Per-data-set matrix in the webapp (Public + active groups); curated defaults (no `electrical.*`).                                        |
 | Security       | One authorized writer per context; groups approve the member's MMSI; public uses a claim registry + attestors (MMSI ownership unproven). |
 
 ## Still open

package/docs/plans/architecture.md

@@ -13,8 +13,8 @@ of the design must not violate.
 **Goal.** Let Signal K instances form peer-to-peer meshes and share vessel data in
 real time:
 
-- one **global public network** (`all-vessels`), joined and transmitting by
-  default, opt-out;
+- one **global public network** (`all-vessels`), joined with a receive-only
+  default; transmission and consent are per-instance;
 - any number of **private groups**, invite-only and encrypted.
 
 A vessel may participate in both at once, with a different view of its data in

package/docs/plans/networks.md

@@ -4,8 +4,8 @@
 
 Two classes of network, both live at once:
 
-- **`all-vessels`** — one global public network, joined and transmitting by
-  default, opt-out; implemented as adaptive geographic shards.
+- **`all-vessels`** — one global public network, joined with a receive-only
+  default; transmission is opt-in; implemented as adaptive geographic shards.
 - **Groups** — any number of private, encrypted, invite-only networks with roles,
   a signed roster, and key rotation.
 
@@ -39,12 +39,16 @@ according to that network's policy, and ingests what each network carries.
   `H("signalk-p2p/all-vessels/v1")`, so every instance agrees without coordination.
 - **Open join.** No membership, no invite, no encryption. Identity is a
   pseudonymous Ed25519 key.
-- **Default on.** The plugin joins and transmits unless the operator opts out.
+- **Default on, receive-only.** The plugin joins immediately but publishes
+  nothing until the owner chooses a consent mode. `receive-only`,
+  `underway-gated`, `coarse-position` and `opt-out` are available.
 - **Audiences** follow [`shared-data.md`](shared-data.md): each data set is shared
-  publicly, with selected groups, or not at all. Consent (`opt-out` by default,
-  plus `underway-gated`, `receive-only`, `coarse-position`) and rates are per
-  network.
-- **AIS** defaults to send-and-receive publicly, capped and sampled.
+  publicly, with selected groups, or not at all, using the webapp matrix.
+- **AIS** defaults to receive-only/private, capped and sampled by policy.
+- **Topology and rates are centrally controlled.** Shard sizes, look-ahead,
+  split/merge thresholds, election epoch/min-uptime, public snapshot rate caps
+  and AIS caps come from a signed, versioned `NetworkPolicy`; clients cannot
+  override them. See §2.1.
 - **No fixed relays.** The mesh elects a relay/aggregator per shard from
   reachable peers; bootstrap peers are optional and replaceable.
 - **Write authorization** is enforced by a replicated claim registry: each context
@@ -55,6 +59,30 @@ according to that network's policy, and ingests what each network carries.
 The user-visible model is one network. Under the hood it is a set of geographic
 shards (§3), so no instance replicates the whole world.
 
+### 2.1 Network policy
+
+A small signed policy carries the network-wide settings:
+
+```
+NetworkPolicy {
+  version, issuedAt, notBefore?, notAfter?
+  topic, protocol
+  sharding { maxVesselsPerShard, maxVesselsPerInstance, lookAheadKm,
+             splitSettleMinutes, mergeSettleMinutes, mergeBelowRatio,
+             boundaryHysteresisMeters }
+  election { epochMinutes, minUptimeMinutes }
+  rates    { maxSnapshotHzUnderway, maxSnapshotHzMoored }
+  ais      { maxTargets, maxRateHz }
+}
+```
+
+It is signed by the network operator. A signed default ships with the plugin; a
+newer signed policy received over the mesh overrides it and is cached. Clients
+verify the signature against pinned operator keys, reject rollback and invalid
+values, and fall back to the shipped default if no live policy is available.
+The operator's private key never goes to a relay; the standalone peer can
+republish a signed policy file.
+
 Write authorization, group approval and the public claim registry are specified in
 [`security.md`](security.md).
 
@@ -302,7 +330,7 @@ signalk-p2p://join/<base64url>{
 }>
 ```
 
-- Anyone holding it can join until `expiresAt` (default 7 days).
+- Anyone holding it can join until `expiresAt` (default 24 hours).
 - Optionally single-use: the admin records the nonce; a second `join` with the
   same nonce is rejected.
 - It is a bearer token: treat it as a secret. The UI should say so.

package/docs/plans/peer-node.md

@@ -62,7 +62,8 @@ npx signalk-p2p-peer \
   --topic signalk-p2p/all-vessels/v1 \
   --batch-interval 2000 \
   --history 10 \
-  --port 49737
+  --port 49737 \
+  --policy /etc/signalk-p2p/policy.json
 ```
 
 During development:
@@ -81,10 +82,14 @@ npm run peer:start     # compiled dist/peer/cli.js
   "batchIntervalMs": 2000,
   "maxBatchBytes": 65536,
   "historyBatches": 10,
-  "port": 49737
+  "port": 49737,
+  "policyFile": "/etc/signalk-p2p/policy.json"
 }
 ```
 
+`policyFile` is optional. When set, the peer verifies and republishes the signed
+network policy every five minutes; it never needs the operator private key.
+
 ```bash
 npx signalk-p2p-peer --config /etc/signalk-p2p/peer.json
 ```

package/docs/plans/security.md

@@ -329,7 +329,7 @@ context to be dropped. Observations dedupe by MMSI and timestamp.
 
 - An invite is a **bearer token** (`skp2p://join/...`): whoever holds it can
   request to join until it expires. It is not a proof of MMSI ownership.
-- Default expiry: 7 days. Optional single-use via a nonce recorded by the roster.
+- Default expiry: 24 hours. Optional single-use via a nonce recorded by the roster.
 - The admin's approval of the join request is the actual admission; the invite
   only gets the request in the door.
 - Treat invites as secrets; the UI says so and offers revoke/expire controls.

package/docs/plans/shared-data.md

@@ -237,7 +237,8 @@ A group that is removed or left is dropped from every data set's group list.
 
 ## 4. Consent modes (public audience)
 
-The public network is joined and transmitting by default, but "transmitting" is
+The public network is joined by default but **receive-only** until the owner opts
+in; "transmitting" is
 configurable. The mode applies to position-bearing data sets (Position and Depth)
 when they are shared publicly.
 
@@ -248,7 +249,7 @@ when they are shared publicly.
 | `receive-only`      | Join and ingest, but publish nothing of your own.                                                                               | Maximum privacy; no contribution.           |
 | `coarse-position`   | Publish position rounded to a grid (default 5 km) instead of the exact fix.                                                     | Approximate only; not anonymity.            |
 
-The mode is per network. Groups use the same modes and default to `opt-out` (a
+The mode is per network. Groups use the same modes and default to `receive-only` (a
 group is already a trusted audience). A boat can be `opt-out` to its club and
 `underway-gated` to the world.
 
@@ -311,7 +312,7 @@ The AIS data set uses the same three-way control as the others:
 - **Share with groups** — publish into the selected groups;
 - **Don't share** — no AIS over P2P.
 
-Defaults: public **on**, groups **off**.
+Defaults: public **off**, groups **off**; AIS is receive-only/private by default.
 
 ### 6.2 Direction
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "signalk-p2p-plugin",
-  "version": "0.3.0",
+  "version": "0.4.1",
   "description": "Private and public peer-to-peer mesh networks for Signal K vessels.",
   "keywords": [
     "signalk-node-server-plugin",
@@ -46,7 +46,8 @@
     "deploy",
     "public",
     "icon.svg",
-    "CHANGELOG.md"
+    "CHANGELOG.md",
+    "policy"
   ],
   "scripts": {
     "build": "tsc -b",

package/policy/default.json

@@ -0,0 +1,30 @@
+{
+  "policy": {
+    "version": 1,
+    "topic": "signalk-p2p/all-vessels/v1",
+    "protocol": 1,
+    "issuedAt": 1794023095,
+    "sharding": {
+      "maxVesselsPerShard": 500,
+      "maxVesselsPerInstance": 1000,
+      "lookAheadKm": 50,
+      "splitSettleMinutes": 10,
+      "mergeSettleMinutes": 60,
+      "mergeBelowRatio": 0.25,
+      "boundaryHysteresisMeters": 1000
+    },
+    "election": {
+      "epochMinutes": 10,
+      "minUptimeMinutes": 10
+    },
+    "rates": {
+      "maxSnapshotHzUnderway": 0.05,
+      "maxSnapshotHzMoored": 0.01
+    },
+    "ais": {
+      "maxTargets": 100,
+      "maxRateHz": 0.02
+    }
+  },
+  "signature": "bnGdM4p1nOlYh9oudCtSt5dBvhlQFQwkg3gYedh+/SothLJKuhDdy7qoKxLTTYp6RaVp8XTL2Dj4BDcR12l9CA=="
+}

package/policy/operator.pub

@@ -0,0 +1,2 @@
+publicKey: b393c24608f23cdb389cfb0cbc8c9de619345fa110cdddcb14ab6afdb494db09
+fingerprint: 254375e336e45f93bb5691e49fdb4e758fefed7981940d98dc9773b8b23390bf