wireweave 0.1.1 → 0.1.3

package/README.md

@@ -2,57 +2,72 @@
 
 > probably emerging 🌀
 
-nostr + webrtc voice SDK. the networking layer for 247420 projects.
+serverless nostr + webrtc voice SDK. the networking layer for 247420 projects.
 
 ```
 npm i wireweave
 ```
 
-## what it is
+## one-liner setup
 
-serverless nostr relay pool + auth, designed for voice/chat apps that run on public relays with zero backend. extracted from [zellous](https://github.com/AnEntrypoint/zellous). buildless, esm-only, no framework lock-in.
-
-## what's in this release
+```js
+import { createWireweave } from 'wireweave';
+import * as NostrTools from 'nostr-tools';
+import * as XState from 'xstate';
 
-**SDK-shaped (ES modules, zero window.*):**
-- `RelayPool` — multi-relay connect, subscribe, publish, reconnect with backoff, event dedup
-- `NostrAuth` — local-key gen, nsec/hex import, NIP-07 extension login, event signing
+const ww = createWireweave({ nostrTools: NostrTools, xstate: XState });
+ww.pool.connect();
+ww.auth.loadFromStorage() || ww.auth.generateKey();
+ww.servers.init();
+```
 
-**`magicwand/legacy/` — full browser-globals port (17 files, ~94kb):**
-nostr voice (perfect-negotiation, SFU hub election, camera), chat, channels, servers, roles, bans, media (blossom), pages, settings. copied verbatim from zellous. expects `state` + `XState` + `NostrTools` + `ui` on window. load order in `src/legacy/README.md`.
+`ww` exposes: `pool`, `auth`, `fsm`, `message`, `bans`, `roles`, `settings`, `pages`, `media`, `channels`, `servers`, `chat`, `voice` (lazy via `ensureVoice()`), `setCurrentChannel()`.
 
-SDK-shaping the voice/chat/channels/servers into proper ES modules lands in 0.3+. legacy files are the honest "move everything" — they work today exactly as they did in zellous.
+every submodule is an `EventTarget`. subscribe with `addEventListener('event', ...)`.
 
-## usage
+## modules
 
 ```js
-import { RelayPool, NostrAuth } from 'wireweave';
-import * as NostrTools from 'nostr-tools';
+import {
+  RelayPool, NostrAuth, VoiceSession, Chat, Channels, Servers,
+  Bans, Roles, Settings, Media, Pages, MessageBus, createFSM
+} from 'wireweave';
+```
 
-const auth = new NostrAuth({ nostrTools: NostrTools, storage: localStorage });
-auth.generateKey();
+each also exported via subpath: `wireweave/relay-pool`, `wireweave/voice`, `wireweave/chat`, etc.
 
-const pool = new RelayPool({
-  relays: ['wss://relay.damus.io', 'wss://nos.lol'],
-  verifyEvent: NostrTools.verifyEvent
-});
-pool.connect();
+## voice (webrtc mesh + sfu hub election)
 
-pool.subscribe('mysub', [{ kinds: [1], limit: 10 }], (event) => {
-  console.log('got event', event.id);
-});
-
-const signed = await auth.sign({
-  kind: 1, created_at: Math.floor(Date.now()/1000), tags: [], content: 'gm'
+```js
+const voice = ww.ensureVoice({
+  serverId: 'abc:xyz',
+  displayName: 'you',
+  onAudioTrack: ({ peer, stream }) => {
+    const a = new Audio();
+    a.srcObject = stream;
+    a.autoplay = true;
+    document.body.appendChild(a);
+    peer.audioEl = a;
+  },
+  onVideoTrack: ({ peerPubkey, stream }) => { /* attach to <video> */ }
 });
-pool.publish(signed);
+await voice.connect('general-voice', { displayName: 'you' });
+voice.toggleMic();
+voice.toggleDeafen();
+voice.addEventListener('participants', e => console.log(e.detail.list));
 ```
 
-## node usage
+Voice carries every empirically-discovered reliability pattern: perfect negotiation (RFC 8840), ICE restart on disconnect, track-stall detection, SFU hub election (mesh→star at 3+ peers), exponential-backoff reconnect.
+
+## node usage (relay + auth only)
 
 ```js
 import WebSocket from 'ws';
-const pool = new RelayPool({ relays: [...], WebSocketImpl: WebSocket });
+import { RelayPool, NostrAuth } from 'wireweave';
+import * as NostrTools from 'nostr-tools';
+
+const pool = new RelayPool({ relays: ['wss://relay.damus.io'], verifyEvent: NostrTools.verifyEvent, WebSocketImpl: WebSocket });
+const auth = new NostrAuth({ nostrTools: NostrTools });
 ```
 
 ## test
@@ -61,11 +76,7 @@ const pool = new RelayPool({ relays: [...], WebSocketImpl: WebSocket });
 npm test
 ```
 
-hits `wss://relay.damus.io` for a real publish → subscribe round-trip. no mocks.
-
-## peer deps
-
-- `nostr-tools` ^2.7
+hits `wss://relay.damus.io` for a real publish → subscribe round-trip.
 
 ## license
 

package/package.json

@@ -1,17 +1,27 @@
 {
   "name": "wireweave",
-  "version": "0.1.1",
+  "version": "0.1.3",
   "description": "nostr + webrtc voice SDK. networking layer for 247420 projects.",
   "type": "module",
   "main": "./src/index.js",
   "module": "./src/index.js",
   "exports": {
     ".": "./src/index.js",
+    "./wireweave": "./src/wireweave.js",
     "./relay-pool": "./src/relay-pool.js",
     "./auth": "./src/auth.js",
-    "./debug": "./src/debug.js",
-    "./legacy": "./src/legacy/index.js",
-    "./legacy/*": "./src/legacy/*"
+    "./fsm": "./src/fsm.js",
+    "./voice": "./src/voice.js",
+    "./chat": "./src/chat.js",
+    "./channels": "./src/channels.js",
+    "./servers": "./src/servers.js",
+    "./message": "./src/message.js",
+    "./bans": "./src/bans.js",
+    "./roles": "./src/roles.js",
+    "./settings": "./src/settings.js",
+    "./media": "./src/media.js",
+    "./pages": "./src/pages.js",
+    "./debug": "./src/debug.js"
   },
   "files": [
     "src",

package/src/bans.js

@@ -0,0 +1,45 @@
+export class Bans extends EventTarget {
+  constructor({ relayPool }) {
+    super();
+    if (!relayPool) throw new Error('Bans: relayPool required');
+    this.pool = relayPool;
+    this.store = new Map();
+    this.sub = null;
+  }
+
+  isBanned(serverId, pubkey) { return !!(this.store.get(serverId)?.banned || []).includes(pubkey); }
+
+  isTimedOut(serverId, pubkey) {
+    const t = this.store.get(serverId)?.timeouts?.[pubkey];
+    return !!t && t.expiry > Math.floor(Date.now() / 1000);
+  }
+
+  subscribe(serverId) {
+    if (this.sub) { this.pool.unsubscribe(this.sub); this.sub = null; }
+    if (!serverId) return;
+    const creator = serverId.split(':')[0];
+    if (!creator) return;
+    this.sub = 'bans-' + serverId;
+    this.pool.subscribe(this.sub,
+      [{ kinds: [30078], authors: [creator], '#d': ['zellous-ban:' + serverId, 'zellous-timeout:' + serverId] }],
+      (event) => {
+        if (event.pubkey !== creator) return;
+        try {
+          const dTag = event.tags.find(t => t[0] === 'd');
+          if (!dTag?.[1]) return;
+          const [prefix, , pubkey] = dTag[1].split(':');
+          const data = this.store.get(serverId) || { banned: [], timeouts: {} };
+          if (prefix === 'zellous-ban' && pubkey && !data.banned.includes(pubkey)) data.banned.push(pubkey);
+          else if (prefix === 'zellous-timeout' && pubkey) {
+            const parsed = JSON.parse(event.content);
+            if (parsed.expiry > Math.floor(Date.now() / 1000)) (data.timeouts = data.timeouts || {})[pubkey] = { expiry: parsed.expiry };
+            else if (data.timeouts?.[pubkey]) delete data.timeouts[pubkey];
+          }
+          this.store.set(serverId, data);
+          this.dispatchEvent(new CustomEvent('updated', { detail: { serverId, data } }));
+        } catch {}
+      });
+  }
+}
+
+export const createBans = (opts) => new Bans(opts);

package/src/channels.js

@@ -0,0 +1,107 @@
+const DEFAULT_CATEGORIES = [
+  { id: 'general', name: 'TEXT CHANNELS', position: 0 },
+  { id: 'voice', name: 'VOICE CHANNELS', position: 1 }
+];
+
+const DEFAULT_CHANNELS = [
+  { id: 'general', name: 'general', type: 'text', categoryId: 'general', position: 0 },
+  { id: 'announcements', name: 'announcements', type: 'announcement', categoryId: 'general', position: 1 },
+  { id: 'general-voice', name: 'General', type: 'voice', categoryId: 'voice', position: 0 }
+];
+
+export class Channels extends EventTarget {
+  constructor({ relayPool, auth }) {
+    super();
+    if (!relayPool || !auth) throw new Error('Channels: relayPool + auth required');
+    this.pool = relayPool; this.auth = auth;
+    this.serverId = ''; this.channels = []; this.categories = [];
+  }
+
+  isOwner() { return this.auth.pubkey && this.serverId && this.auth.pubkey === this.serverId.split(':')[0]; }
+
+  load(serverId, onReady) {
+    this.serverId = serverId;
+    this.channels = []; this.categories = [];
+    const ownerPubkey = serverId.split(':')[0];
+    const dTag = 'zellous-channels:' + serverId;
+    this.pool.subscribe('channels-' + serverId,
+      [{ kinds: [30078], authors: [ownerPubkey], '#d': [dTag] }],
+      (event) => {
+        const hasTag = event.tags?.some(t => t[0] === 'd' && t[1] === dTag);
+        if (!hasTag) return;
+        try {
+          const data = JSON.parse(event.content);
+          this.channels = data.channels || [];
+          this.categories = data.categories || [];
+          this._emit('updated', { channels: this.channels, categories: this.categories });
+        } catch {}
+      },
+      () => {
+        if (!this.channels.length) this._setDefaults();
+        onReady?.();
+      });
+  }
+
+  _setDefaults() {
+    this.channels = DEFAULT_CHANNELS.map(c => ({ ...c }));
+    this.categories = DEFAULT_CATEGORIES.map(c => ({ ...c }));
+    this._emit('updated', { channels: this.channels, categories: this.categories });
+    if (this.isOwner()) this._publish().catch(() => {});
+  }
+
+  async _publish() {
+    if (!this.isOwner()) return;
+    const signed = await this.auth.sign({
+      kind: 30078, created_at: Math.floor(Date.now() / 1000),
+      tags: [['d', 'zellous-channels:' + this.serverId]],
+      content: JSON.stringify({ channels: this.channels, categories: this.categories })
+    });
+    this.pool.publish(signed);
+  }
+
+  async create(name, type = 'text', categoryId = 'general') {
+    this.channels = [...this.channels, { id: 'ch-' + Date.now(), name, type, categoryId, position: this.channels.length }];
+    await this._publish();
+    this._emit('updated', { channels: this.channels, categories: this.categories });
+  }
+
+  async rename(id, name) {
+    this.channels = this.channels.map(c => c.id === id ? { ...c, name } : c);
+    await this._publish(); this._emit('updated', { channels: this.channels, categories: this.categories });
+  }
+
+  async remove(id) {
+    this.channels = this.channels.filter(c => c.id !== id);
+    await this._publish(); this._emit('updated', { channels: this.channels, categories: this.categories });
+  }
+
+  async createCategory(name) {
+    this.categories = [...this.categories, { id: 'cat-' + Date.now(), name, position: this.categories.length }];
+    await this._publish(); this._emit('updated', { channels: this.channels, categories: this.categories });
+  }
+
+  async renameCategory(id, name) {
+    this.categories = this.categories.map(c => c.id === id ? { ...c, name } : c);
+    await this._publish(); this._emit('updated', { channels: this.channels, categories: this.categories });
+  }
+
+  async deleteCategory(id) {
+    this.categories = this.categories.filter(c => c.id !== id);
+    this.channels = this.channels.map(c => c.categoryId === id ? { ...c, categoryId: null } : c);
+    await this._publish(); this._emit('updated', { channels: this.channels, categories: this.categories });
+  }
+
+  async reorder(catId, ids) {
+    ids.forEach((chId, idx) => { this.channels = this.channels.map(c => c.id === chId ? { ...c, position: idx, categoryId: catId } : c); });
+    await this._publish(); this._emit('updated', { channels: this.channels, categories: this.categories });
+  }
+
+  async reorderCategories(ids) {
+    ids.forEach((catId, idx) => { this.categories = this.categories.map(c => c.id === catId ? { ...c, position: idx } : c); });
+    await this._publish(); this._emit('updated', { channels: this.channels, categories: this.categories });
+  }
+
+  _emit(t, d) { this.dispatchEvent(new CustomEvent(t, { detail: d })); }
+}
+
+export const createChannels = (opts) => new Channels(opts);

package/src/chat.js

@@ -0,0 +1,95 @@
+const hexChannelId = async (channelId, serverId) => {
+  const h = await crypto.subtle.digest('SHA-256', new TextEncoder().encode((serverId || 'default') + ':' + channelId));
+  return Array.from(new Uint8Array(h)).map(b => b.toString(16).padStart(2, '0')).join('');
+};
+
+export class Chat extends EventTarget {
+  constructor({ relayPool, auth, getChannelContext = () => ({ channelId: null, serverId: '' }), isAdmin = () => false }) {
+    super();
+    if (!relayPool || !auth) throw new Error('Chat: relayPool + auth required');
+    this.pool = relayPool; this.auth = auth;
+    this.getChannelContext = getChannelContext; this.isAdmin = isAdmin;
+    this.activeChannelId = null;
+    this.messages = [];
+    this.profiles = new Map(); this.fetching = new Set();
+  }
+
+  async send(content, { announcement = false } = {}) {
+    const { channelId, serverId } = this.getChannelContext();
+    if (!this.auth.isLoggedIn() || !channelId) return;
+    if (announcement && !this.isAdmin(serverId)) return;
+    const trimmed = content.trim(); if (!trimmed) return;
+    const chanHex = await hexChannelId(channelId, serverId);
+    const tags = [['e', chanHex, '', 'root']];
+    if (announcement) tags.push(['t', 'announcement']);
+    const signed = await this.auth.sign({ kind: 42, created_at: Math.floor(Date.now() / 1000), tags, content: trimmed });
+    this.pool.publish(signed);
+    this._addMessage(this._eventToMsg(signed));
+  }
+
+  async loadHistory(channelId) {
+    const { serverId } = this.getChannelContext();
+    if (this.activeChannelId) {
+      this.pool.unsubscribe('chat-' + this.activeChannelId);
+      this.pool.unsubscribe('chat-live-' + this.activeChannelId);
+    }
+    this.activeChannelId = channelId;
+    this.messages = [];
+    this._emit('messages', { list: [] });
+    const chanHex = await hexChannelId(channelId, serverId);
+    const collected = [];
+    this.pool.subscribe('chat-' + channelId,
+      [{ kinds: [42], '#e': [chanHex], limit: 50 }],
+      (ev) => collected.push(this._eventToMsg(ev)),
+      () => {
+        collected.sort((a, b) => a.timestamp - b.timestamp);
+        this.messages = collected;
+        this._emit('messages', { list: collected });
+      });
+    this.pool.subscribe('chat-live-' + channelId,
+      [{ kinds: [42], '#e': [chanHex], since: Math.floor(Date.now() / 1000) }],
+      (ev) => this._addMessage(this._eventToMsg(ev)));
+  }
+
+  async deleteMessage(id) {
+    const signed = await this.auth.sign({ kind: 5, created_at: Math.floor(Date.now() / 1000), tags: [['e', id]], content: 'deleted' });
+    this.pool.publish(signed);
+    this.messages = this.messages.filter(m => m.id !== id);
+    this._emit('messages', { list: this.messages });
+  }
+
+  _eventToMsg(event) {
+    const tTags = (event.tags || []).filter(t => t[0] === 't').map(t => t[1]);
+    this._fetchProfile(event.pubkey);
+    return { id: event.id, type: 'text', userId: event.pubkey, content: event.content, timestamp: event.created_at * 1000, tags: tTags };
+  }
+
+  _addMessage(msg) {
+    if (this.messages.find(m => m.id === msg.id)) return;
+    this.messages = [...this.messages, msg];
+    this._emit('message', { message: msg });
+    this._emit('messages', { list: this.messages });
+  }
+
+  resolveProfile(pubkey) {
+    const p = this.profiles.get(pubkey);
+    if (p) return p.name || this.auth.npubShort(pubkey);
+    this._fetchProfile(pubkey);
+    return this.auth.npubShort(pubkey);
+  }
+
+  _fetchProfile(pubkey) {
+    if (this.fetching.has(pubkey)) return;
+    this.fetching.add(pubkey);
+    this.pool.subscribe('profile-' + pubkey,
+      [{ kinds: [0], authors: [pubkey], limit: 1 }],
+      (event) => { try { this.profiles.set(pubkey, JSON.parse(event.content)); this._emit('profile', { pubkey, profile: this.profiles.get(pubkey) }); } catch {} },
+      () => { this.pool.unsubscribe('profile-' + pubkey); this.fetching.delete(pubkey); });
+  }
+
+  updateProfile(pubkey, profile) { this.profiles.set(pubkey, profile); this._emit('profile', { pubkey, profile }); }
+
+  _emit(t, d) { this.dispatchEvent(new CustomEvent(t, { detail: d })); }
+}
+
+export const createChat = (opts) => new Chat(opts);

package/src/fsm.js

@@ -0,0 +1,51 @@
+export const createFSM = (xstate) => {
+  if (!xstate?.createMachine) throw new Error('xstate required');
+  return {
+    voiceMachine: xstate.createMachine({
+      initial: 'idle',
+      states: {
+        idle: { on: { connect: 'connecting' } },
+        connecting: { on: { connected: 'connected', fail: 'idle' } },
+        connected: { on: { disconnect: 'disconnecting' } },
+        disconnecting: { on: { done: 'idle' } }
+      }
+    }),
+    peerMachine: xstate.createMachine({
+      initial: 'new',
+      states: {
+        new: { on: { offer: 'offering', recv_offer: 'answering' } },
+        offering: { on: { recv_answer: 'connected', fail: 'new', restart: 'offering' } },
+        answering: { on: { sent_answer: 'connected', recv_answer: 'connected', fail: 'new' } },
+        connected: { on: { disconnect: 'reconnecting', close: 'closed' } },
+        reconnecting: { on: { offer: 'offering', recv_answer: 'connected', close: 'closed' } },
+        closed: {}
+      }
+    }),
+    cameraMachine: xstate.createMachine({
+      initial: 'idle',
+      states: {
+        idle: { on: { enable: 'requesting' } },
+        requesting: { on: { enabled: 'active', denied: 'idle' } },
+        active: { on: { disable: 'idle', error: 'idle' } },
+        error: { on: { enable: 'requesting' } }
+      }
+    }),
+    relayMachine: xstate.createMachine({
+      initial: 'connecting',
+      states: {
+        connecting: { on: { connected: 'connected', fail: 'error' } },
+        connected: { on: { fail: 'error', disconnect: 'disconnected' } },
+        disconnected: { on: { reconnect: 'connecting' } },
+        error: { on: { reconnect: 'connecting' } }
+      }
+    }),
+    sfuMachine: xstate.createMachine({
+      initial: 'mesh',
+      states: {
+        mesh: { on: { elect: 'electing' } },
+        electing: { on: { elected: 'star', dissolve: 'mesh' } },
+        star: { on: { dissolve: 'mesh' } }
+      }
+    })
+  };
+};

package/src/index.js

@@ -1,3 +1,15 @@
 export { RelayPool, createRelayPool } from './relay-pool.js';
 export { NostrAuth, createAuth } from './auth.js';
+export { createFSM } from './fsm.js';
+export { VoiceSession, createVoiceSession } from './voice.js';
+export { Chat, createChat } from './chat.js';
+export { Channels, createChannels } from './channels.js';
+export { Servers, createServers } from './servers.js';
+export { MessageBus, createMessageBus } from './message.js';
+export { Bans, createBans } from './bans.js';
+export { Roles, createRoles } from './roles.js';
+export { Settings, createSettings } from './settings.js';
+export { Media, createMedia } from './media.js';
+export { Pages, createPages } from './pages.js';
+export { createWireweave } from './wireweave.js';
 export * as debug from './debug.js';

package/src/media.js

@@ -0,0 +1,81 @@
+const BLOSSOM_SERVERS = [
+  'https://blossom.nostr.build',
+  'https://files.sovbit.host',
+  'https://nostrcheck.me'
+];
+
+const hashFile = async (file) => {
+  const buf = await file.arrayBuffer();
+  const h = await crypto.subtle.digest('SHA-256', buf);
+  return Array.from(new Uint8Array(h)).map(b => b.toString(16).padStart(2, '0')).join('');
+};
+
+const hexChannelId = async (channelId, serverId) => {
+  const h = await crypto.subtle.digest('SHA-256', new TextEncoder().encode((serverId || 'default') + ':' + channelId));
+  return Array.from(new Uint8Array(h)).map(b => b.toString(16).padStart(2, '0')).join('');
+};
+
+export class Media {
+  constructor({ relayPool, auth, servers = BLOSSOM_SERVERS }) {
+    if (!relayPool || !auth) throw new Error('Media: deps required');
+    this.pool = relayPool; this.auth = auth; this.servers = servers;
+  }
+
+  async _genAuth(file) {
+    if (!this.auth.pubkey) throw new Error('Not authenticated');
+    const hash = await hashFile(file);
+    const signed = await this.auth.sign({
+      kind: 24242, created_at: Math.floor(Date.now() / 1000),
+      tags: [['t', 'upload'], ['x', hash], ['expiration', String(Math.floor(Date.now() / 1000) + 600)]],
+      content: 'Upload ' + file.name
+    });
+    return { header: 'Nostr ' + btoa(JSON.stringify(signed)), hash };
+  }
+
+  async _uploadBlossom(file, serverUrl) {
+    const { header } = await this._genAuth(file);
+    const res = await fetch(serverUrl + '/upload', {
+      method: 'PUT', body: file,
+      headers: { Authorization: header, 'Content-Type': file.type || 'application/octet-stream' }
+    });
+    if (!res.ok) throw new Error('status ' + res.status);
+    const data = await res.json();
+    const url = data.url || (data.content && JSON.parse(data.content).url);
+    if (!url) throw new Error('no url in response');
+    return url;
+  }
+
+  async upload(file) {
+    const errors = [];
+    for (const srv of this.servers) {
+      try { return { url: await this._uploadBlossom(file, srv), type: file.type, name: file.name, size: file.size }; }
+      catch (e) { errors.push(srv + ': ' + e.message); }
+    }
+    throw new Error('upload failed: ' + errors.join('; '));
+  }
+
+  isMedia(url) {
+    if (typeof url !== 'string') return null;
+    if (/\.(png|jpe?g|gif|webp|svg|avif)(\?|$)/i.test(url)) return 'image';
+    if (/\.(mp4|webm|mov|ogg)(\?|$)/i.test(url)) return 'video';
+    return null;
+  }
+
+  extractUrls(text) { return text ? (text.match(/https?:\/\/[^\s<>"]+/g) || []) : []; }
+
+  async sendMedia(file, { channelId, serverId }) {
+    if (file.size > 20 * 1024 * 1024) throw new Error('file too large (max 20MB)');
+    const result = await this.upload(file);
+    const chanHex = await hexChannelId(channelId, serverId);
+    const imetaTag = ['imeta', 'url ' + result.url, 'm ' + result.type];
+    if (result.size) imetaTag.push('size ' + result.size);
+    const signed = await this.auth.sign({
+      kind: 42, created_at: Math.floor(Date.now() / 1000),
+      tags: [['e', chanHex, '', 'root'], imetaTag], content: result.url
+    });
+    this.pool.publish(signed);
+    return { signed, result };
+  }
+}
+
+export const createMedia = (opts) => new Media(opts);

package/src/message.js

@@ -0,0 +1,22 @@
+export class MessageBus extends EventTarget {
+  constructor({ maxMessages = 50 } = {}) {
+    super();
+    this.max = maxMessages;
+    this.messages = [];
+    this.handlers = {};
+  }
+
+  handle(m) { this.handlers[m.type]?.(m); }
+  register(type, fn) { this.handlers[type] = fn; }
+
+  add(text, { audioData = null, userId = null, username = null } = {}) {
+    const msg = { id: Date.now() + Math.random(), text, time: Date.now(), userId, username, audioData };
+    this.messages = [...this.messages, msg];
+    if (this.messages.length > this.max) this.messages = this.messages.slice(-this.max);
+    this.dispatchEvent(new CustomEvent('message', { detail: msg }));
+    this.dispatchEvent(new CustomEvent('messages', { detail: { list: this.messages } }));
+    return msg;
+  }
+}
+
+export const createMessageBus = (opts) => new MessageBus(opts);

package/src/pages.js

@@ -0,0 +1,77 @@
+const sanitize = (html) => {
+  if (typeof document === 'undefined') return html;
+  const el = document.createElement('div');
+  el.innerHTML = html;
+  el.querySelectorAll('script,iframe,object,embed,form,input,button').forEach(n => n.remove());
+  el.querySelectorAll('*').forEach(n => {
+    [...n.attributes].forEach(a => {
+      if (/^on/i.test(a.name) || (a.name === 'href' && /^javascript:/i.test(a.value)) || (a.name === 'src' && /^javascript:/i.test(a.value))) n.removeAttribute(a.name);
+    });
+  });
+  return el.innerHTML;
+};
+
+export class Pages extends EventTarget {
+  constructor({ relayPool, auth, roles }) {
+    super();
+    if (!relayPool || !auth || !roles) throw new Error('Pages: deps required');
+    this.pool = relayPool; this.auth = auth; this.roles = roles;
+    this.store = new Map(); this.subs = new Map();
+  }
+
+  _key(serverId, slug) { return 'zellous-page:' + serverId + ':' + slug; }
+  getPages(serverId) { return Array.from((this.store.get(serverId) || new Map()).values()); }
+
+  subscribe(serverId) {
+    if (this.subs.has(serverId)) return;
+    const creator = serverId?.split(':')[0];
+    if (!creator) return;
+    const subId = 'pages-' + serverId;
+    this.subs.set(serverId, subId);
+    this.pool.subscribe(subId,
+      [{ kinds: [30078], authors: [creator] }],
+      (event) => {
+        if (event.pubkey !== creator) return;
+        const dTag = (event.tags.find(t => t[0] === 'd') || [])[1] || '';
+        const prefix = 'zellous-page:' + serverId + ':';
+        if (!dTag.startsWith(prefix)) return;
+        const slug = dTag.slice(prefix.length); if (!slug) return;
+        try {
+          const data = JSON.parse(event.content);
+          const pages = this.store.get(serverId) || new Map();
+          if (data.deleted) pages.delete(slug);
+          else pages.set(slug, { slug, title: data.title || slug, html: sanitize(data.html || ''), updatedAt: event.created_at });
+          this.store.set(serverId, pages);
+          this.dispatchEvent(new CustomEvent('updated', { detail: { serverId, pages: this.getPages(serverId) } }));
+        } catch {}
+      });
+  }
+
+  unsubscribe(serverId) {
+    const subId = this.subs.get(serverId);
+    if (subId) { this.pool.unsubscribe(subId); this.subs.delete(serverId); }
+  }
+
+  async publish(serverId, slug, title, html) {
+    if (!this.roles.isAdmin(serverId)) throw new Error('Admin only');
+    const safe = sanitize(html);
+    const signed = await this.auth.sign({ kind: 30078, created_at: Math.floor(Date.now() / 1000), tags: [['d', this._key(serverId, slug)]], content: JSON.stringify({ title, html: safe }) });
+    this.pool.publish(signed);
+    const pages = this.store.get(serverId) || new Map();
+    pages.set(slug, { slug, title, html: safe, updatedAt: Math.floor(Date.now() / 1000) });
+    this.store.set(serverId, pages);
+    this.dispatchEvent(new CustomEvent('updated', { detail: { serverId, pages: this.getPages(serverId) } }));
+  }
+
+  async deletePage(serverId, slug) {
+    if (!this.roles.isAdmin(serverId)) throw new Error('Admin only');
+    const signed = await this.auth.sign({ kind: 30078, created_at: Math.floor(Date.now() / 1000), tags: [['d', this._key(serverId, slug)]], content: JSON.stringify({ deleted: true }) });
+    this.pool.publish(signed);
+    const pages = this.store.get(serverId) || new Map();
+    pages.delete(slug);
+    this.store.set(serverId, pages);
+    this.dispatchEvent(new CustomEvent('updated', { detail: { serverId, pages: this.getPages(serverId) } }));
+  }
+}
+
+export const createPages = (opts) => new Pages(opts);