createGroupLedger({ groupId, founders = [], mode = GOVERNANCEMODES.MAJORITY, threshold = null } = {})

async genesisGroup(ledger, { founderSigner, constitution = {} } = {})

async proposeGroupEvent(ledger, { type, payload = {}, signer, proposalId = null } = {})

replayGroupLedger({ groupId, founders = [], mode = GOVERNANCEMODES.MAJORITY, threshold = null, entries = [] } = {})

<! AUTOGENERATED by tools/extract api.py — content above HUMAN NOTES is overwritten Source: network/groupLedger/GroupLedger.js — private append only group governance ledger (network plan §15/§16/§17). Reuses the Causal State Engine's (hash chained append only log, spec §13) and as is; governance approval decisions go through (PolicyEngine). Every event is a signed protocol envelope (protocol.js ), so the ledger itself is a plain array of verifiable receipts — a group's current state is always the result of replaying it, never a separate source of truth. is in memory only; callers are responsible for persisting (e.g. via webgpu os/storage/AppSandbox on the OS side) and rehydrating with — this module does not import any OS/storage code, keeping the engine layer storage agnostic. Functions Create a new (empty, ungenesised) group ledger. Parameters: (object) — No description in source JSDoc. (string) — No description in source JSDoc. (string[]) — founder membershipIds (string) — GOVERNANCE MODES (number) — for THRESHOLD mode Returns: ledger state Append the GROUP GENESIS event and register the signing founder as the first member. Cast a vote toward approving a pending proposal (network plan §17 eviction flow). Current vote set for a pending proposal (read only copy). Propose (and, if the governance policy allows, immediately commit) a governance event. Safe/low risk actions commit right away; irreversible actions (MEMBER REVOKED/MEMBER BANNED/KEY ROTATED/ROLE CHANGED) require enough prior calls under the same first. Parameters: (object) — No description in source JSDoc. (object) — No description in source JSDoc. (string) — e.g. 'MEMBER ADDED', 'MEMBER REVOKED', ... (object) — No description in source JSDoc. (object) — proposer's signer (string) — required for actions


(string) — e.g. 'MEMBER ADDED', 'MEMBER REVOKED', ... (object) — No description in source JSDoc. (object) — proposer's signer (string) — required for actions needing approval Returns: } True if the ledger's hash chain is intact end to end (tamper check). Rebuild a live ledger from previously persisted (network plan §15 persistence gap — see this file's header comment; OS side storage, e.g. webgpu os/storage/AppSandbox, is the caller's job, not this module's). Replays each entry through (recomputing the exact same hash chain deterministically) and re derives / via the same side effect rules / apply live, so a rehydrated ledger behaves identically to one built by replaying the same operations in real time — with one honest limitation: entries carry no wall clock timestamp, and a envelope only embeds the ONE signer's public key, so a entry reconstructed from genesis (unlike a later , whose payload carries full details) will have and, for any co founder who isn't the genesis envelope's own signer, . This does NOT weaken governance security — founder protected mode checks (a Set of principals, fully and exactly restored from the genesis payload), not the map. Parameters: (object) — No description in source JSDoc. (string) — No description in source JSDoc. (string[]) — same shape as createGroupLedger (only matters if entries is empty) (string) — No description in source JSDoc. (number) — No description in source JSDoc. (Array<object ) — from a prior Returns: a live ledger <! HUMAN NOTES Notes & Examples No hand authored notes yet. Add page notes in or a reusable block in — see API Reference Standard.


network/groupLedger/index.js
Exports
Notes & Examples

<! AUTOGENERATED by tools/extract api.py — content above HUMAN NOTES is overwritten Source: No file level description found in source. Add one as a leading JSDoc comment, or document it below. Exports No ES module exports detected in this file. <! HUMAN NOTES Notes & Examples No hand authored notes yet. Add page notes in or a reusable block in — see API Reference Standard.


async createProfileIdentity(profileId = 'default')

<! AUTOGENERATED by tools/extract api.py — content above HUMAN NOTES is overwritten Source: network/identity/NetworkIdentity.js — profile/device/membership identity layer for the Particle Global OS Network Layer (network plan §11). The network plan keeps several identity levels distinct: profile id stable user identity, portable across devices/groups device id per device identity used for route/session proofs membership id per group pseudonymous identity (unlinkable across groups) engine/state/authority/Identity.js already wraps CollabIdentity (ECDSA P 256) as a generic , and now mints a SEPARATE persisted keypair per distinct principal string (Phase 0 audit finding — no new crypto, just named keys). This module is a thin, semantically named layer on top of that: each helper below is just with a principal string that encodes the identity level. Functions Bind the OS ProfileDriver as the canonical profile/Passport identity owner. The engine retains its named key fallback for standalone demos and tests, but an initialized OS always resolves the active profile through this provider. This device's per device signer — used for low level route/session proofs with a Masterserver (HELLO/PROVE). Never used as group identity. Returns: signer { principal, fingerprint, publicKeyHex, secure, sign, verify } This user's stable profile signer. One profile per logical user on this device (multiple profiles are supported by passing distinct s, e.g. for multi account testing) — each gets its own persisted keypair. Parameters: (string) — ='default'] Returns: signer A per group pseudonymous membership signer for a profile. Distinct keypair per (profileId, groupId) pair, so a member's participation in one group cannot be linked to their participation in another, or to their underlying


keypair per (profileId, groupId) pair, so a member's participation in one group cannot be linked to their participation in another, or to their underlying profile, by key alone. Parameters: (string) — No description in source JSDoc. (string) — No description in source JSDoc. Returns: signer Derive a stable "peer id" string for use in route tables / mesh topology from any signer's fingerprint (device, profile, or membership signer). Parameters: (object) — No description in source JSDoc. Constants — Full SHA 256 public key fingerprint used by Realm Network identities. Re exports <! HUMAN NOTES Notes & Examples No hand authored notes yet. Add page notes in or a reusable block in — see API Reference Standard.


network/index.js

network/index.js
Exports
Notes & Examples

<! AUTOGENERATED by tools/extract api.py — content above HUMAN NOTES is overwritten Source: network/index.js — public barrel for the Particle Global OS Network Layer. See C:\Users\btspa\.windsurf\plans\particle network layer 2bf6f0.md for the full plan. Phase 1 (protocol foundation): versioned envelopes, canonical signing, and profile/device/membership identity + route capabilities on top of the existing engine/collab (P2P) and engine/state (CSE) modules. Build status: [x] Phase 0 audit [x] Phase 1 protocol foundation [x] Phase 2 dynamic routes + master server list [x] Phase 2b live Masterserver signaling client (transport/MasterServerClient.js) [x] Phase 3 invites & trust groups [x] Phase 4 group crypto [x] Phase 5 peer tickets [x] Phase 6 sync manager/workstations, now WIRED to live transport (syncManager/SyncTransport.js broadcasts/merges workstation CRDT ops over an attached route's MasterServerClient.signal(), gated by SyncManager.shouldSync()) — demoed live in factory/apps/network manager's Routes tab [x] Phase 7 chunks [x] Phase 8 carrier layer [x] Phase 9 DHT lite (future/low priority scope), with a concrete BootstrapSource adapter for the browser extension's resident cert vault at webgpu os/drivers/ResidentBootstrapSource.js (OS layer glue, per this module's no webgpu os dependency rule — read only, honestly scoped to "remembered identity", not live background reachability) Exports No ES module exports detected in this file. <! HUMAN NOTES Notes & Examples No hand authored notes yet. Add page notes in or a reusable block in — see API Reference Standard.


async makeInvite({ groupId, routeId, roleOffer = 'member', oneTime = true, expiresAt = null, inviterSigner, } = {})

async verifyInvite(signedInvite, { now = Date.now()

<! AUTOGENERATED by tools/extract api.py — content above HUMAN NOTES is overwritten Source: network/invites/InvitePacket.js — signed, one time, expiring invites (network plan §13). An invite is a doorway into a group's approval process, NOT automatic membership: it just names a temporary meeting route and a role offer, and is signed by the inviter so anyone can verify who issued it. It does not itself grant route/group access — that capability is minted only after the join request identity exchange (see JoinFlow.js), once the joiner's real principal is known. "Base64 is not security" (network plan §13) — the encode/decode here is just a convenient transport, the actual guarantee is the ECDSA signature over the canonical envelope (protocol.js). Functions Build + sign an invite packet. Parameters: (object) — No description in source JSDoc. (string) — No description in source JSDoc. (string) — temporary meeting route where identities are exchanged (string) — ='member'] (boolean) — =true] (number) — epoch ms; null = no expiry (object) — from createMembershipIdentity()/createProfileIdentity() Returns: signed invite envelope URL safe base64 encoding of a signed invite envelope, for sharing as a code/link. Decode an invite code back into its (still UNVERIFIED) signed envelope. Verify a decoded invite: known protocol/type, not expired, and the signature actually matches the embedded inviter public key. Returns: } Create a registry to track which one time invites have already been used. <! HUMAN NOTES Notes & Examples No hand authored notes yet. Add page notes in or a reusable block in — see API Reference Standard.


async requestJoin({ signedInvite, joinerSigner } = {})

async verifyJoinRequest({ signedInvite, joinRequest, inviteRegistry = null, now = Date.now()

grantJoinCapability({ signedInvite, joinerPrincipal, groupRouteId, inviteRegistry = null, allow = [ROUTEACTIONS.ATTACH, ROUTEACTIONS.SUBSCRIBE, ROUTEACTIONS.PUBLISH], } = {})

<! AUTOGENERATED by tools/extract api.py — content above HUMAN NOTES is overwritten Source: network/invites/JoinFlow.js — invite temp route mutual identity proof exchange group policy check (network plan §13 invite pipeline). This module only establishes "this join request is a genuine, signed response to a live, unconsumed invite" — it does NOT decide group policy (vote thresholds, founder approval, etc). That decision belongs to GroupLedger.proposeGroupEvent('MEMBER ADDED', ...); once that commits, call grantJoinCapability() to actually let the new member attach to the group's real route. Functions Joiner side: build a signed join request referencing a (decoded) invite. Parameters: (object) — No description in source JSDoc. (object) — decoded invite envelope (from decodeInvite()) (object) — the joiner's signer (their real principal) Returns: signed JOIN REQUESTED envelope Inviter/group side: validate an invite together with a join request responding to it. Returns: } After the group has approved the join (GroupLedger MEMBER ADDED commit), mint the new member's first route capability for the group's real route and consume the invite if it was one time. Parameters: (object) — No description in source JSDoc. (object) — No description in source JSDoc. (string) — No description in source JSDoc. (string) — the group's real (post join) route id (object) — No description in source JSDoc. (string[]) — default: attach+subscribe+publish Returns: frozen route capability for the joiner <! HUMAN NOTES Notes & Examples No hand authored notes yet. Add page notes in or a reusable block in — see API Reference Standard.


network/invites/index.js
Exports
Notes & Examples


async makePeerTicket({ peerId, deviceId = null, profileId = null, groupId = null, services = [], routeHints = [], expiresAt = null, routeEpoch = null, encryptionEpoch = null, issuerSigner, } = {})

async verifyPeerTicket(signedTicket, { now = Date.now()

async sealPeerTicketToEpoch(groupCrypto, epoch, signedTicket)

<! AUTOGENERATED by tools/extract api.py — content above HUMAN NOTES is overwritten Source: network/peerTickets/PeerTicket.js — encrypted, remembered reconnect records (network plan §38). A peer ticket is a signed statement "peerId X is reachable, offers these services, at these route hints, valid until Y" — it lets a device reconnect to known peers/groups without the discovery server, once trust has already been established once. Sealing (encrypting the ticket itself) reuses the same ECDH wrap pattern as group welcome packets (engine/network/groupCrypto/GroupEpoch.js), OR a group's current encryption epoch directly, per network plan §38 "encrypt to recipient device key OR group epoch key". Functions Build + sign a peer ticket. Parameters: (object) — No description in source JSDoc. (string) — No description in source JSDoc. (string) — No description in source JSDoc. (string) — No description in source JSDoc. (string) — No description in source JSDoc. (string[]) — e.g. ['sync','chunks','workstation'] (string[]) — last known opaque route ids (number) — No description in source JSDoc. (number) — No description in source JSDoc. (number) — No description in source JSDoc. (object) — No description in source JSDoc. Returns: signed ticket envelope Verify a peer ticket: known protocol/type, not expired, signature valid. Returns: } ECDH wrap a signed ticket so only the holder of 's private key can read it. Recipient side: unwrap a device sealed ticket. Returns null (fails closed) on any error. Seal a ticket under a group encryption epoch (readable by any member with that epoch's key). Open an epoch sealed ticket. Returns null if the epoch key is missing/erased or tampered. <! HUMAN NOTES Notes & Examples No hand authored notes yet. Add page notes in or a reusable block in — see


null if the epoch key is missing/erased or tampered. <! HUMAN NOTES Notes & Examples No hand authored notes yet. Add page notes in or a reusable block in — see API Reference Standard.


pruneExpiredPeerTickets(store, now = Date.now()

<! AUTOGENERATED by tools/extract api.py — content above HUMAN NOTES is overwritten Source: network/peerTickets/PeerTicketStore.js — local reconnect memory (network plan §38). In memory only; callers persist via their own storage (e.g. webgpu os/storage/AppSandbox) and rehydrate with addPeerTicket() on boot — engine/network stays storage agnostic (see GroupLedger.js for the same pattern). Functions Create an empty peer ticket store. Remember a (already verified) peer ticket, keyed by its peerId. Overwrites any older ticket for the same peer. Look up the remembered ticket for a peer, or null. Forget a peer's ticket. Returns true if one existed. Remove tickets whose payload.expiresAt has passed. Returns the removed peerIds. All remembered tickets, most recently received first (network plan §38: try freshest known peers first). Full, JSON serializable snapshot of a peer ticket store for OS side persistence (network plan §38 persistence gap — see this file's header comment; storage itself, e.g. webgpu os/storage/AppSandbox, is the caller's job). Same shape already returns — exposed under its own name so the persistence contract (snapshot/hydrate pair) stays explicit even if the internal shape changes later. Rebuild a peer ticket store from a previously persisted snapshotPeerTicketStore() array. <! HUMAN NOTES Notes & Examples No hand authored notes yet. Add page notes in or a reusable block in — see API Reference Standard.


<! AUTOGENERATED by tools/extract api.py — content above HUMAN NOTES is overwritten Source: network/peerTickets/ReconnectOrder.js — full device boot reconnect order (network plan §38): cached peer tickets (freshest first) LAN group gossip master servers carrier DHT. Ties Phase 5 (peer tickets) onto Phase 2's (routes/MasterServerList.js) without modifying it. Functions Parameters: (object) — from createPeerTicketStore() (object) — from normalizeMasterServerList() Returns: } <! HUMAN NOTES Notes & Examples No hand authored notes yet. Add page notes in or a reusable block in — see API Reference Standard.


network/peerTickets/index.js
Exports
Notes & Examples


network/protocol.js

makeEnvelope({ protocol, type, payload = null, extra = {} } = {})

async verifyEnvelope(signedEnvelope, signer = null)

<! AUTOGENERATED by tools/extract api.py — content above HUMAN NOTES is overwritten Source: network/protocol.js — namespaced/versioned message envelopes for the Particle Global OS Network Layer (network plan §34). Every message on the network carries an explicit, versioned protocol namespace (e.g. ). Unversioned or unrecognized protocol strings are rejected outright — this is what lets the wire format evolve (particle route/2, ...) without silently misparsing old/foreign traffic. Canonical signing reuses the Causal State Engine's deterministic canonicalization (engine/state/util/canonical.js, RFC 8785 style) so that signed envelopes hash/verify identically regardless of key order or JS engine, and reuses CSE's cross actor verification (verifyWithKey) so a receiver can verify a sender's signature from just their public key hex. Functions True when is one of this build's known, versioned namespaces. Build an unsigned protocol envelope. Throws if isn't a known, versioned namespace (spec §34 rule: reject unversioned packets). Parameters: (object) — No description in source JSDoc. (string) — one of PROTOCOL VERSIONS (string) — message type (e.g. 'ATTACH ROUTE', 'HELLO') ( ) — JSON canonicalizable body (object) — additional top level fields (routeId, ttl, expiresAt, ...) Returns: frozen unsigned envelope Assert an inbound (possibly untrusted) message is a well formed envelope with a known protocol namespace. Does NOT verify signatures — see . Throws on failure so callers fail closed. Returns: the same message, for chaining Sign an envelope with a CSE authority signer (engine/state/authority/Identity.js , itself bound to a CollabIdentity ECDSA P 256 keypair). The signature covers the canonical bytes of the envelope BEFORE the signature/signerFingerprint fields exist, so


network/protocol.js

to a CollabIdentity ECDSA P 256 keypair). The signature covers the canonical bytes of the envelope BEFORE the signature/signerFingerprint fields exist, so verification reconstructs the same canonical body by stripping those two fields back off. Parameters: (object) — from makeEnvelope() (object) — from createSigner()/network identity helpers Returns: frozen signed envelope Verify a signed envelope. Pass either a (verifies against its own key — same principal round trip) or nothing to verify against the envelope's own embedded (cross actor verification, the normal case when receiving from a remote peer). Parameters: (object) — No description in source JSDoc. (object) — optional signer to verify against instead of the embedded key Constants — All known/versioned protocol namespaces (network plan §34). <! HUMAN NOTES Notes & Examples No hand authored notes yet. Add page notes in or a reusable block in — see API Reference Standard.


async verifyAccordCapabilityAdvertisement(record, { now = Date.now()

async negotiateAccordCapability(advertisements, request, options = {})

<! AUTOGENERATED by tools/extract api.py — content above HUMAN NOTES is overwritten Source: Signed, short lived Accord capability discovery records. Functions Select a verified capability that can satisfy an exact bounded request. Constants <! HUMAN NOTES Notes & Examples No hand authored notes yet. Add page notes in or a reusable block in — see API Reference Standard.


safeInteger(value, name, minimum = 0, maximum = Number.MAXSAFEINTEGER)

boundedToken(value, name, maximum = 128)

assertSecureRecordId(value, name = 'record ID')

normalizeTokenList(values, name, { maximum = 128, allowEmpty = false } = {})

normalizeIdList(values, name, { maximum = 128, allowEmpty = true } = {})

assertIdentityId(value, name = 'identity ID')

normalizeWindow(input, { issuedAt = Date.now()

validateActiveWindow(record, now = Date.now()

normalizeBudget(value, name = 'budget', { allowZero = false } = {})

assertSafePublicData(value, name = 'public data', { maximumBytes = ACCORDMAXPUBLICBYTES } = {})

canonicalPublicCopy(value, name = 'public data', options = {})

async finishSignedAccordRecord(record, idField, signer)

async verifySignedAccordRecord(record, { format, idField })

async authorizeWith(adapter, record, role)

<! AUTOGENERATED by tools/extract api.py — content above HUMAN NOTES is overwritten Source: Shared validation and domain separated signing for the Navi Accord wire protocol. Functions Validate bounded JSON compatible public data and reject common exfiltration containers. This is deliberately structural: unrestricted session exports, credentials, and private memory payloads cannot be smuggled under aliases. Constants <! HUMAN NOTES Notes & Examples No hand authored notes yet. Add page notes in or a reusable block in — see API Reference Standard.


async createAccordDelegation(task, input, signer)

async verifyAccordDelegation(record, { task, acceptance = null, capabilityGrant, verifyCapabilityGrant, now = Date.now()

async createAccordDelegationRevocation(delegation, input, signer)

async verifyAccordDelegationRevocation(record, { delegation, now = Date.now()

async createAccordApprovalProof(task, input, signer)

async verifyAccordApprovalProof(record, { task, now = Date.now()

<! AUTOGENERATED by tools/extract api.py — content above HUMAN NOTES is overwritten Source: Task bound capability delegation, revocation, and approval proofs. Classes Method Signature Summary Functions Constants <! HUMAN NOTES Notes & Examples No hand authored notes yet. Add page notes in or a reusable block in — see API Reference Standard.


consumeReplay(replayGuard, record, { idField, streamKey = null, sequence = null } = {})

<! AUTOGENERATED by tools/extract api.py — content above HUMAN NOTES is overwritten Source: Bounded replay and monotonic sequence protection for verified Accord records. Classes Method Signature Summary Functions <! HUMAN NOTES Notes & Examples No hand authored notes yet. Add page notes in or a reusable block in — see API Reference Standard.


async createAccordProgress(task, acceptance, input, signer)

async verifyAccordProgress(record, { task, acceptance, now = Date.now()

async createAccordCancellation(task, input, signer)

async verifyAccordCancellation(record, { task, now = Date.now()

async createAccordResultV1(task, acceptance, delegation, input, signer)

async verifyAccordResultV1(record, { task, acceptance, delegation, capabilityGrant, verifyCapabilityGrant, contextCapsules = [], approvalProofs = [], cancellation = null, now = Date.now()

async createAccordReputationEvidence(task, result, input, signer)

async verifyAccordReputationEvidence(record, { now = Date.now()

<! AUTOGENERATED by tools/extract api.py — content above HUMAN NOTES is overwritten Source: Signed Accord progress, cancellation, results, and purpose isolated reputation evidence. Functions Constants <! HUMAN NOTES Notes & Examples No hand authored notes yet. Add page notes in or a reusable block in — see API Reference Standard.


async verifyAccordTask(record, { now = Date.now()

async createAccordTaskAcceptance(task, input, signer)

async verifyAccordTaskAcceptance(record, { task, now = Date.now()

<! AUTOGENERATED by tools/extract api.py — content above HUMAN NOTES is overwritten Source: Requester signed Accord tasks and executor signed negotiated acceptance. Functions Constants <! HUMAN NOTES Notes & Examples No hand authored notes yet. Add page notes in or a reusable block in — see API Reference Standard.


async createContextCapsuleV1(task, input, signer)

async verifyContextCapsuleV1(record, { task, acceptance = null, now = Date.now()

<! AUTOGENERATED by tools/extract api.py — content above HUMAN NOTES is overwritten Source: Recipient bound, allowlisted, signed context for a single Accord task. Functions Constants <! HUMAN NOTES Notes & Examples No hand authored notes yet. Add page notes in or a reusable block in — see API Reference Standard.


network/realm/accord/index.js
Exports
Notes & Examples

<! AUTOGENERATED by tools/extract api.py — content above HUMAN NOTES is overwritten Source: No file level description found in source. Add one as a leading JSDoc comment, or document it below. Exports No ES module exports detected in this file. <! HUMAN NOTES Notes & Examples No hand authored notes yet. Add page notes in or a reusable block in — see API Reference Standard.


async verifyRealmAliasRecord(record, options = {})

<! AUTOGENERATED by tools/extract api.py — content above HUMAN NOTES is overwritten Source: RealmAddress.js — human aliases that resolve to location independent IDs. Classes In memory verified resolver. Persistence/discovery providers can replay records into it. Method Signature Summary Functions Parse and canonicalize a realm:// alias or direct ID address. Create an attributable alias update. Aliases can move; Realm IDs cannot. Constants <! HUMAN NOTES Notes & Examples No hand authored notes yet. Add page notes in or a reusable block in — see API Reference Standard.


assertRealmId(id, expectedType = null, label = 'Realm ID')

<! AUTOGENERATED by tools/extract api.py — content above HUMAN NOTES is overwritten Source: RealmIds.js — stable, typed identifiers for Realm Network resources. IDs are deliberately independent of names, hosts, routes, and storage locations. The digest is SHA 256 over domain separated canonical data, so the same control material always produces the same identifier while two resource types can never collide with one another. Functions Return the full SHA 256 fingerprint of a raw uncompressed P 256 key. Derive a typed stable ID from canonical control material. Callers must provide persistent material, never a location or session ID. Derive an identity controlled by a specific P 256 public key. Derive an immutable content identity from exact bytes. Constants <! HUMAN NOTES Notes & Examples No hand authored notes yet. Add page notes in or a reusable block in — see API Reference Standard.


network/realm/addressing/index.js
Exports
Notes & Examples


<! AUTOGENERATED by tools/extract api.py — content above HUMAN NOTES is overwritten Source: Feature gated Atlas provider contracts with bounded verified in memory stores. Classes A complete bounded provider suitable for local, direct contact, organization, and peer gossip adapters. Network code passes verified records into this contract; no provider becomes active until explicitly enabled. Method Signature Summary Functions Constants <! HUMAN NOTES Notes & Examples No hand authored notes yet. Add page notes in or a reusable block in — see API Reference Standard.


async verifyAtlasRecordV1(record, { now = Date.now()

canAccessAtlasRecordV1(record, context = {})

<! AUTOGENERATED by tools/extract api.py — content above HUMAN NOTES is overwritten Source: Signed, bounded Realm Atlas publication records and visibility policy. Classes Monotonic per publisher replay guard for verified Atlas histories. Method Signature Summary Functions Create a signed immutable AtlasRecordV1. Verify canonical structure, SHA 256 identity, signature, freshness, and optional publisher authority. Evaluate a viewer against the signed audience without granting entry permissions. Constants <! HUMAN NOTES Notes & Examples No hand authored notes yet. Add page notes in or a reusable block in — see API Reference Standard.


async createServerAtlasAdvertisement(record, { scopeKey, signer, issuedAt = Math.floor(Date.now()

async verifyServerAtlasAdvertisement(record, { now = Math.floor(Date.now()

async openServerAtlasAdvertisement(advertisement, { scopeKey, now = Date.now()

<! AUTOGENERATED by tools/extract api.py — content above HUMAN NOTES is overwritten Source: Optional opaque V3 Atlas provider matching the bounded ephemeral server contract. Classes Method Signature Summary Functions Build the exact opaque advertisement accepted by the additive V3 server. Verify and decrypt one V3 envelope without trusting the server that stored it. Constants <! HUMAN NOTES Notes & Examples No hand authored notes yet. Add page notes in or a reusable block in — see API Reference Standard.


network/realm/atlas/index.js
Exports
Notes & Examples


async verifyAuthorityHandoffMessage(message, options = {})

<! AUTOGENERATED by tools/extract api.py — content above HUMAN NOTES is overwritten Source: Checkpoint backed, signed authority handoff state machine. Classes Method Signature Summary Functions Constants <! HUMAN NOTES Notes & Examples No hand authored notes yet. Add page notes in or a reusable block in — see API Reference Standard.


async renewAuthorityLease(previous, input, signer)

async verifyAuthorityLease(lease, options = {})

async verifyAuthorityRevocation(record, options = {})

<! AUTOGENERATED by tools/extract api.py — content above HUMAN NOTES is overwritten Source: Signed, fenced authority leases for semantic Realm state. Leases are explicit records. They never confer authority merely because a peer has a connection, hosts a transport, or possesses a Capsule. Every mutation must present the active lease ID and its monotonically increasing fencing token. Functions Constants <! HUMAN NOTES Notes & Examples No hand authored notes yet. Add page notes in or a reusable block in — see API Reference Standard.


<! AUTOGENERATED by tools/extract api.py — content above HUMAN NOTES is overwritten Source: No file level description found in source. Add one as a leading JSDoc comment, or document it below. Classes In memory authority decision engine; persistence is supplied by the caller. Method Signature Summary Functions <! HUMAN NOTES Notes & Examples No hand authored notes yet. Add page notes in or a reusable block in — see API Reference Standard.


async verifyHostMigrationVote(vote, authorizeVoter = null)

<! AUTOGENERATED by tools/extract api.py — content above HUMAN NOTES is overwritten Source: No file level description found in source. Add one as a leading JSDoc comment, or document it below. Classes Method Signature Summary Functions Constants <! HUMAN NOTES Notes & Examples No hand authored notes yet. Add page notes in or a reusable block in — see API Reference Standard.


async verifySemanticEnvelope(value, options = {})

<! AUTOGENERATED by tools/extract api.py — content above HUMAN NOTES is overwritten Source: Semantic replication records, idempotent inboxes, resumable outboxes, and divergence evidence. Classes Method Signature Summary Method Signature Summary Functions Constants <! HUMAN NOTES Notes & Examples No hand authored notes yet. Add page notes in or a reusable block in — see API Reference Standard.


network/realm/authority/index.js
Exports
Notes & Examples


prepareRealmBranchStorageRecord(record, label = 'branch storage record')

<! AUTOGENERATED by tools/extract api.py — content above HUMAN NOTES is overwritten Source: Bounded persistent storage adapter for branch metadata and offline queues. Capsule/blob bytes remain in the shared RealmContentStore; this adapter never duplicates content addressed storage. Classes LocalStorage compatible persistent key/value adapter. Method Signature Summary Functions Constants <! HUMAN NOTES Notes & Examples No hand authored notes yet. Add page notes in or a reusable block in — see API Reference Standard.


async verifyMergeProposal(proposal, options = {})

async applyMergeProposal({ proposal, decisions, base, mine, theirs }, options = {})

async createMergeCommit(input, signer, options = {})

async verifyMergeCommit(event, options = {})

<! AUTOGENERATED by tools/extract api.py — content above HUMAN NOTES is overwritten Source: MergeProposalV1 contracts, dependency safe decisions, and merge commits. Functions Create a signed MergeProposalV1 from a semantic comparison. Verify proposal signature, IDs, dependency DAG, authorization, and expiry. Default policy: accept clean changes and retain conflicts on the source branch. Apply accepted changes to mine; rejected/conflicting source work is untouched. Apply a proposal and publish the decision as a signed Chronicle event. Any rejected work receives a stable signed branch rooted at the source head. Constants — Public MergeProposalV1 contract. <! HUMAN NOTES Notes & Examples No hand authored notes yet. Add page notes in or a reusable block in — see API Reference Standard.


<! AUTOGENERATED by tools/extract api.py — content above HUMAN NOTES is overwritten Source: Persistent, causal, resumable queue for signed offline Chronicle events. Classes Method Signature Summary Deliver every currently causal ready event at least once. A missing or failed acknowledgement returns the event to pending for a later reconnect. Constants <! HUMAN NOTES Notes & Examples No hand authored notes yet. Add page notes in or a reusable block in — see API Reference Standard.


async verifyRealmBranch(branch, options = {})

<! AUTOGENERATED by tools/extract api.py — content above HUMAN NOTES is overwritten Source: RealmBranchV1 identity, ownership, signed head chains, and branch DAGs. Classes Verified in memory projection of branch descriptors and RealmBranchRefV1 head chains. Persistence is delegated to BranchStorage.js. Method Signature Summary Functions Create a stable RealmBranchV1. The label is intentionally excluded from the identity derivation, so renaming or alias changes cannot change branch IDs. Verify branch identity, controller signature, and optional owner authority. Constants — Public RealmBranchV1 contract. <! HUMAN NOTES Notes & Examples No hand authored notes yet. Add page notes in or a reusable block in — see API Reference Standard.


async signBranchRecord(body, { idField, format }, signer)

async verifyBranchRecord(record, { idField, format })

<! AUTOGENERATED by tools/extract api.py — content above HUMAN NOTES is overwritten Source: Shared signed record plumbing for Realm branch contracts. Functions <! HUMAN NOTES Notes & Examples No hand authored notes yet. Add page notes in or a reusable block in — see API Reference Standard.


async compareSemanticSnapshots({ base, mine, theirs }, registry = createDefaultSemanticAdapterRegistry()

applySemanticChange(snapshot, change, selected, registry)

<! AUTOGENERATED by tools/extract api.py — content above HUMAN NOTES is overwritten Source: Explicit semantic and confluence proven CRDT adapters for three way merge. Classes Method Signature Summary Functions Produce a deterministic base/mine/theirs semantic comparison. Constants <! HUMAN NOTES Notes & Examples No hand authored notes yet. Add page notes in or a reusable block in — see API Reference Standard.


network/realm/branches/index.js
Re-exports
Notes & Examples

<! AUTOGENERATED by tools/extract api.py — content above HUMAN NOTES is overwritten Source: No file level description found in source. Add one as a leading JSDoc comment, or document it below. Re exports , , , , , , , , , , , , , , , , , , , , , , , , , , , , , <! HUMAN NOTES Notes & Examples No hand authored notes yet. Add page notes in or a reusable block in — see API Reference Standard.


<! AUTOGENERATED by tools/extract api.py — content above HUMAN NOTES is overwritten Source: No file level description found in source. Add one as a leading JSDoc comment, or document it below. Classes Method Signature Summary <! HUMAN NOTES Notes & Examples No hand authored notes yet. Add page notes in or a reusable block in — see API Reference Standard.


async createRealmBranchRef(input, signer, previous = null)

async verifyRealmBranchRef(ref, options = {})

<! AUTOGENERATED by tools/extract api.py — content above HUMAN NOTES is overwritten Source: No file level description found in source. Add one as a leading JSDoc comment, or document it below. Functions <! HUMAN NOTES Notes & Examples No hand authored notes yet. Add page notes in or a reusable block in — see API Reference Standard.


async adaptVerifiedPackageArtifact({ artifactBytes, parsedPackage, verification } = {})

async prepareRealmBlob(input, options = {})

async buildRealmCapsule(input, signer, options = {})

async verifyRealmCapsule(capsule, options = {})

async createOfflineCapsuleExport(capsule, resolveBlob, options = {})

async verifyOfflineCapsuleExport(bundle, options = {})

<! AUTOGENERATED by tools/extract api.py — content above HUMAN NOTES is overwritten Source: No file level description found in source. Add one as a leading JSDoc comment, or document it below. Functions Convert the output of PackageVerifier.parseAny()/verify() into the package input accepted by buildRealmCapsule. Package verification stays owned by the existing package stack; this adapter only binds its verified artifact bytes and roots into the Capsule. Constants <! HUMAN NOTES Notes & Examples No hand authored notes yet. Add page notes in or a reusable block in — see API Reference Standard.


class RealmCapsuleValidationError extends TypeError

validateRealmCapsuleShape(value, { requireSignature = true } = {})

validateDependencyGraph(records, options = {})


network/realm/capsule/index.js
Re-exports
Notes & Examples

<! AUTOGENERATED by tools/extract api.py — content above HUMAN NOTES is overwritten Source: No file level description found in source. Add one as a leading JSDoc comment, or document it below. Re exports , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , <! HUMAN NOTES Notes & Examples No hand authored notes yet. Add page notes in or a reusable block in — see API Reference Standard.


async verifyChronicleEvent(event, options = {})

async verifyChronicle(value, options = {})

<! AUTOGENERATED by tools/extract api.py — content above HUMAN NOTES is overwritten Source: RealmChronicle.js — signed SHA 256 causal history for a Realm branch. Chronicle events contain semantic records and state root transitions, not simulation ticks. The implementation is storage agnostic so the same verification code is used for local persistence, Capsule import, and peers. Classes Method Signature Summary Functions Create a complete signed Chronicle event. Verify content hash, event hash, signer fingerprint, signature, and optional actor binding. Verify and rebuild a complete Chronicle snapshot or event list. Constants <! HUMAN NOTES Notes & Examples No hand authored notes yet. Add page notes in or a reusable block in — see API Reference Standard.


network/realm/chronicle/index.js
Exports
Notes & Examples

<! AUTOGENERATED by tools/extract api.py — content above HUMAN NOTES is overwritten Source: No file level description found in source. Add one as a leading JSDoc comment, or document it below. Exports No ES module exports detected in this file. <! HUMAN NOTES Notes & Examples No hand authored notes yet. Add page notes in or a reusable block in — see API Reference Standard.


network/realm/contracts.js
Constants
Re-exports
Notes & Examples

<! AUTOGENERATED by tools/extract api.py — content above HUMAN NOTES is overwritten Source: Stable Realm Network V1 contract descriptors. Descriptors contain references to the concrete implementations. Importing this module does not create stores, links, providers, timers, or network connections. Constants Re exports , , , , , , , , <! HUMAN NOTES Notes & Examples No hand authored notes yet. Add page notes in or a reusable block in — see API Reference Standard.


async verifyGatePlan(record, options = {})

<! AUTOGENERATED by tools/extract api.py — content above HUMAN NOTES is overwritten Source: Fail closed Realm entry planning over verified identity, content, and policy evidence. Classes Runtime Gate evaluator. It owns no persistence and performs no entry itself; it only emits a short lived signed plan that Shield can enforce. Method Signature Summary Functions Constants <! HUMAN NOTES Notes & Examples No hand authored notes yet. Add page notes in or a reusable block in — see API Reference Standard.


network/realm/gate/index.js
Re-exports
Notes & Examples

<! AUTOGENERATED by tools/extract api.py — content above HUMAN NOTES is overwritten Source: No file level description found in source. Add one as a leading JSDoc comment, or document it below. Re exports , , , , , , , , <! HUMAN NOTES Notes & Examples No hand authored notes yet. Add page notes in or a reusable block in — see API Reference Standard.


async verifyCapabilityGrant(record, options = {})

async attenuateCapabilityGrant(parentRecord, input, signer)

async recoverCapabilityGrant(previousRecord, input, signer)

async verifyCapabilityRevocation(record, options = {})

async verifyCapabilityAuditReceipt(record, options = {})

<! AUTOGENERATED by tools/extract api.py — content above HUMAN NOTES is overwritten Source: Scoped, attenuable, delegable, revocable CapabilityGrantV1 contracts. Classes Runtime registry with online revocation and dynamic membership/role checks. Method Signature Summary Functions Constants — Public contract descriptor for callers that discover schemas dynamically. <! HUMAN NOTES Notes & Examples No hand authored notes yet. Add page notes in or a reusable block in — see API Reference Standard.


async finishSignedRecord(record, idField, signer)

async verifySignedRecord(record, { format, idField })

boundedInteger(value, name, minimum = 0)

boundedToken(value, name, maximum = 128, { wildcard = false } = {})

uniqueSorted(values, name, normalize, maximum = 128)

<! AUTOGENERATED by tools/extract api.py — content above HUMAN NOTES is overwritten Source: Shared signing primitives for Realm organization and capability records. Functions <! HUMAN NOTES Notes & Examples No hand authored notes yet. Add page notes in or a reusable block in — see API Reference Standard.


async replayOrganizationLedger(organizationRecord, envelopes, options = {})

<! AUTOGENERATED by tools/extract api.py — content above HUMAN NOTES is overwritten Source: Cryptographically verified organization history. The ledger uses the same contextual verifier for live persistence and replay. A proposal freezes its eligible membership set and quorum at its epoch; later joins cannot vote, while revoked members and superseded keys fail immediately. Classes Method Signature Summary Functions Constants <! HUMAN NOTES Notes & Examples No hand authored notes yet. Add page notes in or a reusable block in — see API Reference Standard.


<! AUTOGENERATED by tools/extract api.py — content above HUMAN NOTES is overwritten Source: Signed OrganizationV1 root contract and its fixed governance vocabulary. Functions Constants — Public contract descriptor for callers that discover schemas dynamically. <! HUMAN NOTES Notes & Examples No hand authored notes yet. Add page notes in or a reusable block in — see API Reference Standard.


network/realm/governance/index.js
Re-exports
Notes & Examples

<! AUTOGENERATED by tools/extract api.py — content above HUMAN NOTES is overwritten Source: No file level description found in source. Add one as a leading JSDoc comment, or document it below. Re exports , , , , , , , , , , , , , , , , , , , , , , , , , <! HUMAN NOTES Notes & Examples No hand authored notes yet. Add page notes in or a reusable block in — see API Reference Standard.


createHealthMonitor({ realmId = null, branchId = null, now = ()

recordHealthComponent(monitor, componentId, { status, reason = null, metrics = {}, ttlMs = 60000, } = {})

observeRealmLinkHealth(monitor, linkSnapshot, { ttlMs = 30000 } = {})

observeDiscoveryHealth(monitor, providerStatuses, { ttlMs = 60000 } = {})

observePresenceHealth(monitor, { activeActors = 0, rejected = 0, sequenceGaps = 0 } = {}, { ttlMs = 60000 } = {})

<! AUTOGENERATED by tools/extract api.py — content above HUMAN NOTES is overwritten Source: No file level description found in source. Add one as a leading JSDoc comment, or document it below. Functions Record a RealmLink snapshot without exposing identities, keys, or payloads. Constants <! HUMAN NOTES Notes & Examples No hand authored notes yet. Add page notes in or a reusable block in — see API Reference Standard.


projectEndpointReachability({ residentActive = false, routeCount = 0, masterservers = [], peers = [], observedAt = Date.now()

<! AUTOGENERATED by tools/extract api.py — content above HUMAN NOTES is overwritten Source: No file level description found in source. Add one as a leading JSDoc comment, or document it below. Functions Build a secret free reachability projection from locally observed evidence. Constants <! HUMAN NOTES Notes & Examples No hand authored notes yet. Add page notes in or a reusable block in — see API Reference Standard.


network/realm/health/index.js
Exports
Notes & Examples


async createPassportLineage({ passportId, createdAt = Date.now()

appendPassportRotation(lineage, newSigner, previousSigner, options = {})

appendPassportRecovery(lineage, newSigner, previousSigner, options = {})

async appendPassportRevocation(lineage, currentSigner, options = {})

async verifyDeviceGrant(grant, options = {})

async verifyDeviceRevocation(record, options = {})

async verifyRecoveryRecord(record, options = {})

<! AUTOGENERATED by tools/extract api.py — content above HUMAN NOTES is overwritten Source: RealmPassport.js — portable, signed public identity records. This module owns no keys and performs no persistence. It consumes the existing signer interface and produces canonical records that can be stored, copied, and independently verified by any Realm Network peer. Functions Create a self signed genesis lineage. The Passport ID is bound to its root key. Append a terminal, signed key revocation record. Verify every digest, key fingerprint, link, and signature in a lineage. Build a signed, allowlisted public Passport projection. Constants <! HUMAN NOTES Notes & Examples No hand authored notes yet. Add page notes in or a reusable block in — see API Reference Standard.


network/realm/identity/index.js
Exports
Notes & Examples


network/realm/index.js
Re-exports
Notes & Examples

<! AUTOGENERATED by tools/extract api.py — content above HUMAN NOTES is overwritten Source: Explicit exports win over same named subsystem descriptors and keep the public V1 contract surface stable while subsystem APIs remain available. Re exports , , , , , , , , , , , , , , , , , , , <! HUMAN NOTES Notes & Examples No hand authored notes yet. Add page notes in or a reusable block in — see API Reference Standard.


createContinuityRecord({ linkId, realmId, branchId, localPeerId, remotePeerId = null, sessionEpoch = 0, lastSentSequence = 0, remoteMaxSequence = 0, remoteSeenSequences = [], sealedReconnectCredential = null, peerTicket = null, routeHints = [], transfers = [], updatedAt = Date.now()

continuityStorageKey({ realmId, branchId, linkId })

createContinuityStore({ adapter = createMemoryContinuityAdapter()

updateTransferProgress(record, update, now = Date.now()

<! AUTOGENERATED by tools/extract api.py — content above HUMAN NOTES is overwritten Source: Storage agnostic continuity records for reconnect and verified transfer resume. Raw reconnect tokens are deliberately rejected: callers persist an opaque credential only after sealing it with the OS/profile storage layer. Functions In memory adapter for tests and ephemeral sessions; durable OS storage is injected with the same interface. Update one transfer monotonically; completed/cancelled records cannot be reopened. Constants <! HUMAN NOTES Notes & Examples No hand authored notes yet. Add page notes in or a reusable block in — see API Reference Standard.


normalizeDiscoveryCandidate(candidate, { sourceId, now = Date.now()

createDiscoveryProvider({ id, kind = DISCOVERYKIND.CUSTOM, priority = 0, discover, advertise = null, revoke = null, health = null, } = {})

async discoverRealmPeers(registry, query = {}, { timeoutMs = 5000, correlationId = null } = {})

createBootstrapRegistryProvider({ id = 'bootstrap', registry, priority = 10 } = {})

createPeerTicketDiscoveryProvider({ id = 'peer-tickets', store, priority = 100 } = {})

createDhtDiscoveryProvider({ id = 'dht', transport, priority = 20 } = {})

<! AUTOGENERATED by tools/extract api.py — content above HUMAN NOTES is overwritten Source: Realm discovery is an orchestration contract, not a new discovery network. Providers adapt the existing bootstrap, DHT, invite, contact, peer ticket, and Masterserver mechanisms into one bounded result shape. Functions Normalize an untrusted provider result into the Realm discovery shape. Define one discovery provider. Network algorithms remain in the adapted subsystem. Query all enabled providers concurrently; one provider failure never erases valid peer results. Adapt the existing ordered bootstrap registry without reproducing its scan logic. Adapt the existing signed peer ticket store into discovery hints. Adapt the existing mesh DHT query transport; callers choose exactly one query key. Constants <! HUMAN NOTES Notes & Examples No hand authored notes yet. Add page notes in or a reusable block in — see API Reference Standard.


createRealmLink({ linkId, realmId, branchId, localIdentity, signer, verifyIdentity, supportedCapabilities = [], authorizeCapabilities = async ({ requested, supported })

async attachRealmLinkTransport(link, session, { initiate = true } = {})

async handleRealmLinkFrame(link, frame, { binding = null } = {})

async sendRealmLinkData(link, kind, payload, { capability = null } = {})

realmLinkContinuityRecord(link, overrides = {})

async persistRealmLinkContinuity(link, overrides = {})

async markRealmLinkDisconnected(link, reason = 'transport-disconnected')

async closeRealmLink(link, reason = 'local-close')

<! AUTOGENERATED by tools/extract api.py — content above HUMAN NOTES is overwritten Source: No file level description found in source. Add one as a leading JSDoc comment, or document it below. Functions Create one transport independent logical link. is required so cryptographic key ownership is also checked against Passport/device authorization rather than trusted from an embedded public key. Attach an existing transport session and optionally initiate the authenticated handshake. Verify, deduplicate, authorize, and dispatch one inbound Realm Link frame. Attempt a higher priority channel while the current one remains live. Canonical digest input for diagnostics/evidence without exposing keys or payloads. Constants <! HUMAN NOTES Notes & Examples No hand authored notes yet. Add page notes in or a reusable block in — see API Reference Standard.


async signRealmLinkFrame({ linkId, realmId, branchId, senderPeerId, sessionEpoch, sequence, messageId, issuedAt, type, payload = null, signer, } = {})

async verifyRealmLinkFrame(frame, { linkId, realmId, branchId, now = Date.now()

createRealmLinkReplayWindow({ width = 256, maxSequence = 0, seen = [] } = {})

acceptRealmLinkReplay(window, frame, { now = Date.now()

<! AUTOGENERATED by tools/extract api.py — content above HUMAN NOTES is overwritten Source: No file level description found in source. Add one as a leading JSDoc comment, or document it below. Functions Build and sign one control/data frame using the existing authority signer. Cryptographically validate a frame. Passport/device authorization is a separate required hook. Sliding sequence window supports limited cross transport reordering while rejecting replay. Constants <! HUMAN NOTES Notes & Examples No hand authored notes yet. Add page notes in or a reusable block in — see API Reference Standard.


createTransportProvider({ id, kind = TRANSPORTKIND.CUSTOM, priority = null, canConnect = ()

async connectRealmTransport(registry, target, opts = {})

<! AUTOGENERATED by tools/extract api.py — content above HUMAN NOTES is overwritten Source: Realm transport providers adapt existing channels. They do not implement WebRTC, relays, WebSockets, LAN sockets, or encryption themselves. Functions Validate the minimal bidirectional channel RealmLink consumes. Try compatible providers in priority order. A failed direct path naturally falls through to an existing relay/WebSocket provider. True when a candidate session is a meaningful relay to direct upgrade. Constants <! HUMAN NOTES Notes & Examples No hand authored notes yet. Add page notes in or a reusable block in — see API Reference Standard.


network/realm/link/index.js
Exports
Notes & Examples

<! AUTOGENERATED by tools/extract api.py — content above HUMAN NOTES is overwritten Source: No file level description found in source. Add one as a leading JSDoc comment, or document it below. Exports No ES module exports detected in this file. <! HUMAN NOTES Notes & Examples No hand authored notes yet. Add page notes in or a reusable block in — see API Reference Standard.


createPresenceV1({ realmId, branchId, actorId, deviceId, sessionId, sequence, status = PRESENCESTATUS.ONLINE, activity = null, location = null, issuedAt = Date.now()

async verifyPresenceV1(record, { authorizeKey, now = Date.now()

createPresenceTracker({ authorizeKey, now = ()

pruneExpiredPresence(tracker, now = tracker.now()

presenceSnapshot(tracker, { realmId = null, branchId = null } = {})

<! AUTOGENERATED by tools/extract api.py — content above HUMAN NOTES is overwritten Source: No file level description found in source. Add one as a leading JSDoc comment, or document it below. Functions Verify signature, expiry, and Passport/device key authorization. Accept each signed session sequence once; a gap is surfaced but does not invent missing state. Constants <! HUMAN NOTES Notes & Examples No hand authored notes yet. Add page notes in or a reusable block in — see API Reference Standard.


network/realm/presence/index.js
Exports
Notes & Examples


normalizeRealmLocation(value, name = 'Realm location')

async verifyJourneyEvent(record, options = {})

async verifyJourneyJournal(events, options = {})

<! AUTOGENERATED by tools/extract api.py — content above HUMAN NOTES is overwritten Source: Signed publish/inspect/enter/leave history with exact branch aware returns. Classes An append only signed journal. Entry transitions are replayed locally; no network or storage side effects occur until a caller persists its snapshot. Method Signature Summary Functions Constants <! HUMAN NOTES Notes & Examples No hand authored notes yet. Add page notes in or a reusable block in — see API Reference Standard.


network/realm/publishing/index.js
Re-exports
Notes & Examples

<! AUTOGENERATED by tools/extract api.py — content above HUMAN NOTES is overwritten Source: No file level description found in source. Add one as a leading JSDoc comment, or document it below. Re exports , , , , , , , , <! HUMAN NOTES Notes & Examples No hand authored notes yet. Add page notes in or a reusable block in — see API Reference Standard.


network/realm/shield/RealmShield.js
Classes
class RealmShield
Functions
async verifyShieldAuditTrail(events)
Constants
Notes & Examples

<! AUTOGENERATED by tools/extract api.py — content above HUMAN NOTES is overwritten Source: Runtime isolation, quotas, moderation, and tamper evident audit for Realm entry. Classes Realm Shield is deliberately local. It applies signed Gate plans but stores no Realm authority and performs no server side enforcement. Method Signature Summary Functions Constants <! HUMAN NOTES Notes & Examples No hand authored notes yet. Add page notes in or a reusable block in — see API Reference Standard.


network/realm/shield/index.js
Re-exports
Notes & Examples

<! AUTOGENERATED by tools/extract api.py — content above HUMAN NOTES is overwritten Source: No file level description found in source. Add one as a leading JSDoc comment, or document it below. Re exports , , , , , , , <! HUMAN NOTES Notes & Examples No hand authored notes yet. Add page notes in or a reusable block in — see API Reference Standard.


saveParticleMasterServers(list, storage = globalThis.localStorage)

pickNextMasterServer(masterServers, { excluded = [] } = {})

<! AUTOGENERATED by tools/extract api.py — content above HUMAN NOTES is overwritten Source: network/routes/MasterServerList.js — client shipped master server list + connection fallback ordering (network plan §4). A master server is a meeting place, not an authority: it introduces peers and forwards signaling, nothing more (network plan §4/§6). This module only normalizes/validates the list shape and computes connection attempt order; it does not open any sockets (that is the signaling tier, Phase 2b/Phase A). Functions A fresh, mutable copy of the client shipped production bootstrap list. Strict read used by writers to quarantine unsupported/corrupt records. Validate + normalize a client master server list config (network plan §4). Unknown/malformed servers are dropped rather than throwing, so a bad entry in a self hosted community list can't break the whole client. Parameters: (object) — No description in source JSDoc. (Array) — No description in source JSDoc. (object) — No description in source JSDoc. Returns: } Pick the next enabled master server to try, in priority order, skipping any whose url is in (e.g. servers that just failed this round). Parameters: (object[]) — from normalizeMasterServerList().masterServers (object) — No description in source JSDoc. (string[]) — No description in source JSDoc. Build the full connection attempt order (network plan §4): cached peers LAN group gossip master servers (by priority) carrier DHT relay. Stages disabled via (or with no master servers configured) are omitted. Parameters: (object) — from normalizeMasterServerList() Returns: } Constants — Fallback stages other than master servers themselves, in priority order (§4). <! HUMAN NOTES Notes & Examples No hand authored notes yet. Add page notes in or a reusable block in — see


master servers themselves, in priority order (§4). <! HUMAN NOTES Notes & Examples No hand authored notes yet. Add page notes in or a reusable block in — see API Reference Standard.


async signNodeRoleAnnouncement({ routeId, nodeId, sequence, availability = 'foreground', roles = ['resident'], capabilities = [], ttlMs = NODEROLEMAXTTLMS, signer, now = Date.now()

async verifyNodeRoleAnnouncement(message, { routeId, peerId, lastSequence = 0, now = Date.now()

<! AUTOGENERATED by tools/extract api.py — content above HUMAN NOTES is overwritten Source: No file level description found in source. Add one as a leading JSDoc comment, or document it below. Functions Build a signed, expiring role announcement for one route. Verify signature, device key binding, route scope, freshness, and ordering. Constants <! HUMAN NOTES Notes & Examples No hand authored notes yet. Add page notes in or a reusable block in — see API Reference Standard.


createOsNetworkSession(routeId, opts = {})

sessionSendProtocol(session, peerId, data, { requireAdvertised = false } = {})

sessionBroadcastProtocol(session, data, { requireAdvertised = false } = {})

<! AUTOGENERATED by tools/extract api.py — content above HUMAN NOTES is overwritten Source: network/routes/OsNetworkSession.js — the concrete factory was designed to take (network plan Phase 2 note: "typically a thin wrapper around "). This was the one piece of the plan's own architecture that was designed but never actually instantiated — Phase 2b shipped the simpler Masterserver relay as direct transport shortcut ( ) for V1 sync, which left / / (all three built against a real peer addressed + ) with no live mesh to run on. This module closes that gap. 's Tier 4 signaling (see 's header comment) already reads from localStorage and lazily acquires the shared pinned V2 ParticleNetworkDaemon itself. Explicit compatibility endpoints may still use the shared V1 registry. Therefore gets real cross internet WebRTC signaling over the same Masterserver config the Control Panel manages. Deliberately skips CollabCore's own peer identity/ECDH handshake ( / / / , ): that machinery expects raw keys (ECDH keypair + identity proof), which is a different, lower level API than the CSE wrapped this layer's identity/ signers use (see 's own header comment). This is not a security gap — every OS level payload carried over this session already brings its own crypto/verification: content hashes, onion ECDH, AES GCM, signed / envelopes. CollabCore here is used purely as a WebRTC transport (data channels + DTLS), the same way et al. were written to treat any . Functions Parameters: (string) — No description in source JSDoc. (object) — No description in source JSDoc. (string) — stable peer id for this session (e.g. ) (string) — No description in source JSDoc. (string Uint8Array ArrayBuffer null) — private 32 byte invite secret or passphrase; null marks a public room ((peerId:string, op:object)


in source JSDoc. (string Uint8Array ArrayBuffer null) — private 32 byte invite secret or passphrase; null marks a public room ((peerId:string, op:object) = void) — called when no registered op handler consumed a message ((peerId:string) = void) — No description in source JSDoc. ((peerId:string) = void) — No description in source JSDoc. (object) — optional injected RouteProtocolRegistry ((event:object) = void) — structured protocol diagnostics Returns: session — pass to addSessionOpHandler/destroyOsNetworkSession Register an op handler (e.g. 's , 's , 's — all follow the same "handled?" chaining pattern). Handlers are tried in registration order; the first one that returns consumes the message. Returns: unsubscribe function Register a bounded, version aware route protocol handler. This session's — the exact shape ChunkTransport/CarrierRelay/DhtTransport expect. Send a versioned protocol envelope, optionally requiring peer advertisement. Broadcast one application op to every connected direct mesh neighbor. Broadcast a versioned envelope only to compatible or pre catalog peers. Connected peer IDs for routing and role coordination. Mesh topology stats for UI display (mode, neighbor count, supernode status, gossip counters). Locally measured, secret free peer transport observations. Protocol catalog, peer negotiation, and bounded dispatch counters. Tear down a session's WebRTC connections, signaling, and topology timers. <! HUMAN NOTES Notes & Examples No hand authored notes yet. Add page notes in or a reusable block in — see API Reference Standard.


network/routes/ReconnectBackoff.js
Functions
createReconnectBackoff(cfg = {})
nextBackoffDelay(backoff)
isBackoffExhausted(backoff)
resetBackoff(backoff)
Constants
Notes & Examples

<! AUTOGENERATED by tools/extract api.py — content above HUMAN NOTES is overwritten Source: network/routes/ReconnectBackoff.js — exponential reconnect backoff with jitter (network plan §8: "0.5s 1s 2s 4s 8s max 30s, with random jitter"). Mirrors the constants already used by engine/collab/CollabCore.js (RECONNECT BASE MS=1000, RECONNECT MAX MS=30000, MAX RECONNECT ATTEMPTS=8) so route level and WebRTC level reconnects behave consistently. Functions Create a reconnect backoff sequence. Parameters: (object) — No description in source JSDoc. (number) — No description in source JSDoc. (number) — No description in source JSDoc. (number) — 0 = unlimited (number) — +/ fraction of the delay to randomize (() = number) — injectable RNG for deterministic tests Returns: backoff state Compute the next delay (ms) and advance the attempt counter. Parameters: (object) — No description in source JSDoc. Returns: } True once has been exceeded (0 = never exhausted). Matches nextBackoffDelay's flag. Reset the attempt counter after a successful (re)connect. Constants <! HUMAN NOTES Notes & Examples No hand authored notes yet. Add page notes in or a reusable block in — see API Reference Standard.


registerRouteProtocol(registry, { id, protocols = [], matches = null, handle, authorize = null, validate = null, priority = 0, maxBytes = null, } = {})

async dispatchRouteProtocol(registry, peerId, op, context = {})

<! AUTOGENERATED by tools/extract api.py — content above HUMAN NOTES is overwritten Source: No file level description found in source. Add one as a leading JSDoc comment, or document it below. Functions Dispatch one route operation. Protocol bearing traffic always fails closed. Constants <! HUMAN NOTES Notes & Examples No hand authored notes yet. Add page notes in or a reusable block in — see API Reference Standard.


createRouteSessionManager({ createSession, destroySession = null } = {})

ensureRouteSession(manager, routeId, opts = {})

acquireRouteSession(manager, routeId, opts = {})

releaseRouteSession(manager, routeId, options = {})

teardownRouteSession(manager, routeId, options = {})

<! AUTOGENERATED by tools/extract api.py — content above HUMAN NOTES is overwritten Source: network/routes/RouteSessionManager.js — orchestrates one P2P session per attached route/group. Phase 0 audit finding: engine/collab/CollabCore.js is built around a single projectId/roomPassword session. The network layer needs many concurrent routes/groups at once, so rather than rewriting CollabCore.js (which would risk existing game collab call sites), this manager holds N session instances behind a pluggable factory — callers pass in (typically a thin wrapper around ) and this module just tracks lifecycle (one session per routeId, created on demand, torn down explicitly or when the route's last local lease is dropped). Functions Parameters: (object) — No description in source JSDoc. ((routeId:string, opts:object) = object) — No description in source JSDoc. ((session:object, routeId:string) = void) — No description in source JSDoc. Get the session for , creating it via the factory if it doesn't exist yet. Acquire one local consumer lease for a route. The first lease creates the session. The final release tears it down after a bounded idle grace period. Release one local route lease without affecting other consumers. Inspect lease ownership without exposing route secrets or session internals. Get an existing session, or null. Does NOT create one. Tear down and forget a route's session (calls if provided). List routeIds with a live session. <! HUMAN NOTES Notes & Examples No hand authored notes yet. Add page notes in or a reusable block in — see API Reference Standard.


attachRoute(table, { routeId, principal, capability, ttlMs = DEFAULTROUTETTLMS, meta = {} } = {})

heartbeatRoute(table, { routeId, principal, ttlMs = DEFAULTROUTETTLMS } = {})

detachRoute(table, { routeId, principal } = {})

<! AUTOGENERATED by tools/extract api.py — content above HUMAN NOTES is overwritten Source: network/routes/RouteTable.js — dynamic, capability gated routes for the Particle Global OS Network Layer (network plan §9 "dynamic routes instead of rooms" + §10 capability checks). A route is NOT server owned: it exists in this local table only while a capability holding principal has attached to it and kept its lease alive via heartbeats. There is no createRoute() — attachRoute() both creates the local entry (if absent) and joins it. Leases expire on their own; nothing here talks to a network — this is pure local bookkeeping that the Masterserver signaling tier (Phase 2b) and per route session manager below will drive. Functions Create an empty route table. Parameters: (object) — No description in source JSDoc. (string) — this device/session's peer id (for convenience defaults) Returns: route table state Attach to a route. Validates the capability authorizes for (principal, routeId) right now; if the route doesn't exist locally yet it is created (this is what "routes appear when clients attach" means — there is no separate creation step). Re attaching refreshes the lease. Parameters: (object) — No description in source JSDoc. (object) — No description in source JSDoc. (string) — No description in source JSDoc. (string) — the attaching signer's fingerprint (object) — from makeRouteCapability()/attenuateRouteCapability() (number) — lease duration (default DEFAULT ROUTE TTL MS) (object) — opaque local metadata (routeType, maxFanout, maxHops, ...) Returns: } Refresh a principal's lease on a route (heartbeat). Re checks the capability so a revoked capability cannot keep renewing its lease. Returns: } Detach a principal from a route. Removes the route entirely once empty. Remove all


so a revoked capability cannot keep renewing its lease. Returns: } Detach a principal from a route. Removes the route entirely once empty. Remove all expired subscriber leases (and any routes left with zero subscribers). Call this periodically (e.g. alongside heartbeat ticks). Returns: } removed leases True if currently has at least one live subscriber. Snapshot of a route's subscribers, or null. List all currently live routes (opaque summaries only — no capability objects). Constants — Default route lease TTL (network plan §9/§35: 90s). — Default heartbeat interval to keep a lease alive (network plan §8: 25 30s). <! HUMAN NOTES Notes & Examples No hand authored notes yet. Add page notes in or a reusable block in — see API Reference Standard.


network/routes/index.js
Exports
Notes & Examples


<! AUTOGENERATED by tools/extract api.py — content above HUMAN NOTES is overwritten Source: No file level description found in source. Add one as a leading JSDoc comment, or document it below. Classes Method Signature Summary <! HUMAN NOTES Notes & Examples No hand authored notes yet. Add page notes in or a reusable block in — see API Reference Standard.


<! AUTOGENERATED by tools/extract api.py — content above HUMAN NOTES is overwritten Source: No file level description found in source. Add one as a leading JSDoc comment, or document it below. Classes State Channel transport over browser to browser WebRTC mesh messages. Method Signature Summary Constants <! HUMAN NOTES Notes & Examples No hand authored notes yet. Add page notes in or a reusable block in — see API Reference Standard.


<! AUTOGENERATED by tools/extract api.py — content above HUMAN NOTES is overwritten Source: No file level description found in source. Add one as a leading JSDoc comment, or document it below. Classes Default standard transport: SSE projections/receipts down, HTTP intents up. Method Signature Summary Functions <! HUMAN NOTES Notes & Examples No hand authored notes yet. Add page notes in or a reusable block in — see API Reference Standard.


<! AUTOGENERATED by tools/extract api.py — content above HUMAN NOTES is overwritten Source: No file level description found in source. Add one as a leading JSDoc comment, or document it below. Classes Method Signature Summary Durable authority state used by witnesses and takeover candidates. Restore a non regressing checkpoint before resuming authority work. <! HUMAN NOTES Notes & Examples No hand authored notes yet. Add page notes in or a reusable block in — see API Reference Standard.


<! AUTOGENERATED by tools/extract api.py — content above HUMAN NOTES is overwritten Source: No file level description found in source. Add one as a leading JSDoc comment, or document it below. Classes Browser authority lifecycle with signed heartbeats, replicated checkpoints, deterministic takeover, and fencing. It never makes the discovery server an authority and can be attached to any MeshStateChannelTransport. Method Signature Summary <! HUMAN NOTES Notes & Examples No hand authored notes yet. Add page notes in or a reusable block in — see API Reference Standard.


createStateIntent(channelId, action, payload, options = {})

createStateProjection(channelId, projection, options = {})

createStateReceipt(intent, options = {})

validateStateChannelMessage(message, channelId = null)

readStateChannelMessage(message, channelId = null)

negotiateStateChannelVersion(peerVersions, localVersions = STATECHANNELSUPPORTEDVERSIONS)

<! AUTOGENERATED by tools/extract api.py — content above HUMAN NOTES is overwritten Source: No file level description found in source. Add one as a leading JSDoc comment, or document it below. Functions Constants <! HUMAN NOTES Notes & Examples No hand authored notes yet. Add page notes in or a reusable block in — see API Reference Standard.


<! AUTOGENERATED by tools/extract api.py — content above HUMAN NOTES is overwritten Source: No file level description found in source. Add one as a leading JSDoc comment, or document it below. Functions Resolve transport from authority location. Server backed channels remain SSE by default; peer authority explicitly selects the WebRTC mesh. Constants <! HUMAN NOTES Notes & Examples No hand authored notes yet. Add page notes in or a reusable block in — see API Reference Standard.


network/stateChannels/index.js
Exports
Notes & Examples

<! AUTOGENERATED by tools/extract api.py — content above HUMAN NOTES is overwritten Source: No file level description found in source. Add one as a leading JSDoc comment, or document it below. Exports No ES module exports detected in this file. <! HUMAN NOTES Notes & Examples No hand authored notes yet. Add page notes in or a reusable block in — see API Reference Standard.


network/syncManager/SyncCategory.js
Constants
Notes & Examples

<! AUTOGENERATED by tools/extract api.py — content above HUMAN NOTES is overwritten Source: network/syncManager/SyncCategory.js — sync categories + target scopes (network plan §20 Sync Manager). Constants — What a synced value may fan out to. — The category groupings a profile's Sync Manager governs (network plan §20). <! HUMAN NOTES Notes & Examples No hand authored notes yet. Add page notes in or a reusable block in — see API Reference Standard.


setSyncRule(manager, category, { scope, enabled, targetDeviceIds } = {})

<! AUTOGENERATED by tools/extract api.py — content above HUMAN NOTES is overwritten Source: network/syncManager/SyncManager.js — per profile sync rules (network plan §20). This module only decides WHAT should sync WHERE (rules + gating); it does not move any bytes — actual transport goes through the routes/ group crypto layers built in earlier phases. Rules are local, in memory config; callers persist them via their own storage. Functions Create a sync manager with sensible defaults (network plan §20 examples: "sync AI memory only to my devices", "never sync private keys" — private keys simply have no category here at all, by design). Parameters: (object) — No description in source JSDoc. (object) — partial overrides keyed by category Set/update a category's sync rule. Parameters: (object) — No description in source JSDoc. (string) — one of SYNC CATEGORIES (object) — No description in source JSDoc. (string) — one of SYNC SCOPE (boolean) — No description in source JSDoc. (string[]) — required/used when scope === SELECTED DEVICES Returns: the resulting rule Get a category's current rule, or null if unset. All rules as a flat array of . Should currently sync to right now? Used as a gate before a caller pushes an update over a route/group. <! HUMAN NOTES Notes & Examples No hand authored notes yet. Add page notes in or a reusable block in — see API Reference Standard.


createSyncTransport({ client, routeId, syncManager, category, targetScope, getWorkstation, setWorkstation })

<! AUTOGENERATED by tools/extract api.py — content above HUMAN NOTES is overwritten Source: network/syncManager/SyncTransport.js — moves the group workstation CRDT bytes that SyncManager.js only ever decided WHETHER to send (network plan §20, plus §18/§19's workstation CRDT). Reuses a caller owned, already connected + already route attached Particle daemon or explicitly enabled legacy client as the wire: local ops use to every other session attached to the route, and incoming SIGNAL events for that routeId are folded in via CRDT join ( ). CRDTs are commutative/idempotent by construction, so no ordering, ack, or conflict resolution logic is needed here — this is intentionally the entire transport. This module owns no socket/timer of its own; it is pure glue between SyncManager's gate ( ), Workstation's CRDT state, and whatever Particle signaling session + opaque route tag the caller has brought up (e.g. factory/apps/network manager's Routes tab, or a future group app). Functions Serialize a WorkstationState.js state object into a JSON safe wire payload. Inverse of serializeWorkstationState — reconstructs real CRDT instances (not plain values). Wire a live group workstation to a connected + route attached MasterServerClient. Both push (outgoing) and handleEvent (incoming) are gated by the same check, so disabling a category locally stops us from both broadcasting AND accepting that category's updates. Parameters: (object) — No description in source JSDoc. (object) — a connected (string) — the route both local and remote sessions are attached to (object) — from (string) — a entry gating this transport (typically 'desktop') (string) — the this route represents (e.g. ) Returns: } <! HUMAN NOTES Notes & Examples No hand authored notes yet. Add page notes in or a reusable


'desktop') (string) — the this route represents (e.g. ) Returns: } <! HUMAN NOTES Notes & Examples No hand authored notes yet. Add page notes in or a reusable block in — see API Reference Standard.


network/syncManager/index.js
Exports
Notes & Examples


createMasterServerClient({ url, deviceSigner = null, onEvent = null } = {})

<! AUTOGENERATED by tools/extract api.py — content above HUMAN NOTES is overwritten Source: network/transport/MasterServerClient.js — live WebSocket signaling client for a single Masterserver (network plan §7/§8/§12, Phase 2b). Speaks the tiny HELLO PROVE PING/PONG DISCOVER wire protocol implemented by Masterserver/app/routes.py. All outgoing envelopes use the namespace — the server validates and independently (Masterserver/app/protocol.py validate envelope), so a single namespace for every message type from this client is sufficient and matches the confirmed live wire format. PROVE requires signing the exact raw challenge bytes the server issued (Masterserver/app/session crypto.py verifies a raw P1363 ECDSA signature over those bytes) — NOT a stringified/hex encoded form of them. This is why deviceSigner.signRaw() (engine/state/authority/Identity.js) is used here instead of the string based signer.sign(). Functions Create a live client for one Masterserver. Does not auto connect — call explicitly. Parameters: (object) — No description in source JSDoc. (string) — wss:// URL of the Masterserver's /v1/ws endpoint (object) — signer from createDeviceIdentity() — required to complete PROVE Returns: client { connect, disconnect, ping, discover, getState } Constants — Connection lifecycle states surfaced via onEvent(). <! HUMAN NOTES Notes & Examples No hand authored notes yet. Add page notes in or a reusable block in — see API Reference Standard.


acquireSharedMasterServerClient({ url, deviceSigner = null, onEvent = null } = {})

<! AUTOGENERATED by tools/extract api.py — content above HUMAN NOTES is overwritten Source: network/transport/MasterServerRegistry.js — shared, ref counted transport/MasterServerClient.js registry (network plan §4/§7/§8/§12). Multiple independent OS consumers can each want a live session to the same Masterserver URL at the same time — e.g. SecureMesh's signaling tier (engine/collab/CollabSignal.js Tier 4) and the Particle Network control panel's live inspector (factory/apps/network manager/NetworkManagerApp.js). Without this, each would open its own redundant WebSocket + HELLO/PROVE handshake to the same server. This module multiplexes N listeners onto ONE underlying MasterServerClient connection per URL, connecting on first acquire and disconnecting only once every consumer has released it. A Masterserver route/session concept is per connection, not per consumer — sharing one session is exactly what "a master server introduces peers and forwards signaling" (README.md's can/cannot boundary) assumes: any number of local app level features can ride the same proven session and attach their own routes on it independently (ATTACH ROUTE is additive; a session can be attached to many routes at once). Functions Acquire a shared, ref counted MasterServerClient for , connecting it if this is the first consumer. Every event the underlying client emits is fanned out to every registered listener — consumers are expected to filter for events relevant to them (by routeId/message shape), same as they would with their own private client. Parameters: (object) — No description in source JSDoc. (string) — No description in source JSDoc. (object) — only used if this is the first consumer ((event:object) = void) — this consumer's own listener Returns: } True if a shared client for this url


(object) — only used if this is the first consumer ((event:object) = void) — this consumer's own listener Returns: } True if a shared client for this url already exists (connecting or connected). Current listener/ref count for a url's shared client, or null if none exists. Diagnostics only. <! HUMAN NOTES Notes & Examples No hand authored notes yet. Add page notes in or a reusable block in — see API Reference Standard.


network/transport/index.js
Exports
Notes & Examples


buildWorkstationCheckpointPayload(workstation, { governanceHead, appRegistryHash = null, manifestRoot = null } = {})

<! AUTOGENERATED by tools/extract api.py — content above HUMAN NOTES is overwritten Source: network/workstation/Workstation.js — a group's shared OS surface (network plan §18), distinct from any member's personal desktop. Wraps WorkstationState.js (the CRDT layer) with a groupId and a checkpoint payload builder for GroupLedger's WORKSTATION CHECKPOINTED event (network plan §19: "the governance ledger periodically checkpoints collaborative state" — the ledger stores authority decisions plus a hash of live state, not every live edit). Functions Create a new (empty) group workstation. Parameters: (object) — No description in source JSDoc. (string) — No description in source JSDoc. Merge in another replica's CRDT state (order independent). Stable content hash of the current workstation state ("desktopStateRoot"). Build the payload for a WORKSTATION CHECKPOINTED governance event (network plan §19). Pass the result straight into GroupLedger's . Parameters: (object) — No description in source JSDoc. (object) — No description in source JSDoc. (string) — ledger.eventLog.head at checkpoint time (string) — No description in source JSDoc. (string) — No description in source JSDoc. <! HUMAN NOTES Notes & Examples No hand authored notes yet. Add page notes in or a reusable block in — see API Reference Standard.


setWindowLayout(state, windowId, layout, ts, node = '')

setWallpaper(state, wallpaper, ts, node = '')

<! AUTOGENERATED by tools/extract api.py — content above HUMAN NOTES is overwritten Source: network/workstation/WorkstationState.js — CRDT backed group workstation surface (network plan §18/§19: shared desktop layout, app registry, folders, agents — distinct from any member's personal desktop). Reuses the Causal State Engine's approved CRDT types (ORSet for pinned apps/folders/agents membership, LWWRegister for per window layout and wallpaper) unmodified: every mutation returns a NEW state object (non mutating join algebra), so replicas that exchange state in any order converge without coordination. Functions Create an empty workstation CRDT state. Set a window's layout (LWW: highest (ts, node) wins on merge). Join two workstation states (CRDT merge — order independent, convergent). Plain, JSON serializable snapshot (for hashing/checkpointing/transport). <! HUMAN NOTES Notes & Examples No hand authored notes yet. Add page notes in or a reusable block in — see API Reference Standard.


network/workstation/index.js
Exports
Notes & Examples


render/CameraMath.js

computePerspectiveProjection(camera, aspectFallback, options = {})

computeViewProjMatrix(camera, transform, viewportWidth, viewportHeight)

<! AUTOGENERATED by tools/extract api.py — content above HUMAN NOTES is overwritten Source: No file level description found in source. Add one as a leading JSDoc comment, or document it below. Functions Compute perspective projection matrix. Parameters: (Object) — Camera with fov, aspect, near, far (number) — Fallback aspect ratio (Object) — Optional settings (boolean) — Use WebGPU [0,1] depth range (default: true) Returns: Projection matrix <! HUMAN NOTES Notes & Examples Shared GPU device Engine subsystems should reuse the cached wrapper returned by . The wrapper owns the native , its queue, granted features, limits, and device loss callbacks. Resources created by one native device cannot be used by another, so pass the shared wrapper or native device into each subsystem that needs GPU access. Example: Acquire the shared engine device Request a feature only when the application cannot run without it. automatically requests the engine's supported optional feature set, while reports the features actually granted to the device. Feature and limit checks Device loss Gotchas: First acquisition defines requirements: caches the wrapper. Supply mandatory features and limits on the first call. Native access: use and when a subsystem needs WebGPU primitives. Recovery: this module reports device loss but does not expose an in place API. Re bootstrap all device owned resources together. Limits: check the granted before large allocations. (Source: ) See also: GPU Device Sharing · Virtual GPU · GpuFormats


render/DrawHelpers.js

ensureDepthTexture(device, current, width, height)

ensureSceneColorTexture(device, current, width, height, format = "bgra8unorm")

buildViewProjData(projection, view, multiply, out = null)

renderVolumetricSmoke(encoder, swapView, smoke, options)

<! AUTOGENERATED by tools/extract api.py — content above HUMAN NOTES is overwritten Source: No file level description found in source. Add one as a leading JSDoc comment, or document it below. Functions Draw a mesh with the given bind group and uniforms. Draw multiple meshes efficiently. Create a render pass with standard settings. Ensure depth texture matches canvas size, recreating if needed. Ensure scene color texture matches canvas size, recreating if needed. Used for screen space water refraction which needs to sample the rendered scene. Parameters: (GPUDevice) — WebGPU device (GPUTexture) — Current scene color texture (or null) (number) — Canvas width (number) — Canvas height (string) — Texture format (default: 'bgra8unorm') Returns: } Build viewProj matrix data for a frame buffer. Render particle billboards or points in an existing render pass. Automatically detects point list vs triangle list topology. Parameters: (GPURenderPassEncoder) — Active render pass (Object) — Particle state object with pipeline, frameBuffer, etc. (Object) — { projection, view, updateBuffer, mat4Multiply, getCameraEyeBasis } Render volumetric smoke in a separate pass after the main render pass. Parameters: (GPUCommandEncoder) — Command encoder (GPUTextureView) — Swap chain texture view (Object) — Smoke state object (Object) — { projection, view, depthTextureView, getCameraEyeBasis, canvas, updateBuffer, mat4Multiply, mat4Inverse, logger } Returns: Whether smoke was rendered <! HUMAN NOTES Notes & Examples Shared GPU device Engine subsystems should reuse the cached wrapper returned by . The wrapper owns the native , its queue, granted features, limits, and device loss callbacks. Resources created by one native device cannot be used by another, so pass the shared wrapper or native device


render/DrawHelpers.js

features, limits, and device loss callbacks. Resources created by one native device cannot be used by another, so pass the shared wrapper or native device into each subsystem that needs GPU access. Example: Acquire the shared engine device Request a feature only when the application cannot run without it. automatically requests the engine's supported optional feature set, while reports the features actually granted to the device. Feature and limit checks Device loss Gotchas: First acquisition defines requirements: caches the wrapper. Supply mandatory features and limits on the first call. Native access: use and when a subsystem needs WebGPU primitives. Recovery: this module reports device loss but does not expose an in place API. Re bootstrap all device owned resources together. Limits: check the granted before large allocations. (Source: ) See also: GPU Device Sharing · Virtual GPU · GpuFormats


render/DualModeRenderer.js

velocityToColor(vx, vy, vz, scale = 0.1)

generateInstanceData(positions, velocities, particleSize = 1.0, colorScale = 0.1)

<! AUTOGENERATED by tools/extract api.py — content above HUMAN NOTES is overwritten Source: No file level description found in source. Add one as a leading JSDoc comment, or document it below. Classes Method Signature Summary Update particle data from storage buffer Update instance buffer with velocity to color mapping Upload instance data from CPU Update uniforms Render particles Method Signature Summary Initialize both renderers Update LOD based on camera distance to volume center Set view mode Update particle data Update volume density Render frame Get current rendering stats Resize render targets Functions Map velocity to color Parameters: (number) — No description in source JSDoc. (number) — No description in source JSDoc. (number) — No description in source JSDoc. (number) — No description in source JSDoc. Returns: RGBA Generate particle instance data from positions and velocities Parameters: (Float32Array) — xyz per particle (Float32Array) — xyz per particle (number) — No description in source JSDoc. (number) — No description in source JSDoc. Returns: 8 floats per particle Constants — View modes — LOD distance thresholds — Particle rendering styles <! HUMAN NOTES Notes & Examples Shared GPU device Engine subsystems should reuse the cached wrapper returned by . The wrapper owns the native , its queue, granted features, limits, and device loss callbacks. Resources created by one native device cannot be used by another, so pass the shared wrapper or native device into each subsystem that needs GPU access. Example: Acquire the shared engine device Request a feature only when the application cannot run without it. automatically requests the engine's supported optional feature set, while reports the features actually granted to the device. Feature and limit checks


render/DualModeRenderer.js

it. automatically requests the engine's supported optional feature set, while reports the features actually granted to the device. Feature and limit checks Device loss Gotchas: First acquisition defines requirements: caches the wrapper. Supply mandatory features and limits on the first call. Native access: use and when a subsystem needs WebGPU primitives. Recovery: this module reports device loss but does not expose an in place API. Re bootstrap all device owned resources together. Limits: check the granted before large allocations. (Source: ) See also: GPU Device Sharing · Virtual GPU · GpuFormats


render/IndexedClusterCuller.js

render/IndexedClusterCuller.js
Classes
class IndexedClusterCuller
Notes & Examples
Shared GPU device

<! AUTOGENERATED by tools/extract api.py — content above HUMAN NOTES is overwritten Source: No file level description found in source. Add one as a leading JSDoc comment, or document it below. Classes Method Signature Summary <! HUMAN NOTES Notes & Examples Shared GPU device Engine subsystems should reuse the cached wrapper returned by . The wrapper owns the native , its queue, granted features, limits, and device loss callbacks. Resources created by one native device cannot be used by another, so pass the shared wrapper or native device into each subsystem that needs GPU access. Example: Acquire the shared engine device Request a feature only when the application cannot run without it. automatically requests the engine's supported optional feature set, while reports the features actually granted to the device. Feature and limit checks Device loss Gotchas: First acquisition defines requirements: caches the wrapper. Supply mandatory features and limits on the first call. Native access: use and when a subsystem needs WebGPU primitives. Recovery: this module reports device loss but does not expose an in place API. Re bootstrap all device owned resources together. Limits: check the granted before large allocations. (Source: ) See also: GPU Device Sharing · Virtual GPU · GpuFormats


render/LightManager.js

render/LightManager.js
Classes
class LightManager
Notes & Examples
Shared GPU device

<! AUTOGENERATED by tools/extract api.py — content above HUMAN NOTES is overwritten Source: LightManager.js Collects ECS Light entities and uploads to GPU Queries all entities with Light + Transform components each frame, builds a GPU uniform buffer, and exposes a bind group for renderers. GPU Layout (std140 aligned): vec3 ambientColor + f32 ambientIntensity (16 bytes) vec3 sunDirection + f32 sunIntensity (16 bytes) vec3 sunColor + u32 lightCount (16 bytes) f32 globalBrightness + f32 enableDiffuse + f32 enableSun + f32 pad (16 bytes) Light[16] array (16 48 = 768 bytes) Total: 64 + 768 = 832 bytes Each Light (48 bytes, 12 floats): vec3 position + u32 lightType (16 bytes) vec3 color + f32 intensity (16 bytes) vec3 direction + f32 range (16 bytes) Classes Method Signature Summary Collect lights from ECS world and upload to GPU. Call once per frame before rendering. Get the WGSL struct definitions for the lighting uniform. Renderers embed this in their shader source. Get the WGSL lighting calculation function. Expects uniform to be bound. Uses PBR: GGX/Trowbridge Reitz NDF, Smith Schlick geometry, Schlick Fresnel. calcAllLighting(fragPos, normal, baseColor, viewDir, roughness, metallic) <! HUMAN NOTES Notes & Examples Shared GPU device Engine subsystems should reuse the cached wrapper returned by . The wrapper owns the native , its queue, granted features, limits, and device loss callbacks. Resources created by one native device cannot be used by another, so pass the shared wrapper or native device into each subsystem that needs GPU access. Example: Acquire the shared engine device Request a feature only when the application cannot run without it. automatically requests the engine's supported optional feature set, while reports the features actually granted to the device.


render/LightManager.js

cannot run without it. automatically requests the engine's supported optional feature set, while reports the features actually granted to the device. Feature and limit checks Device loss Gotchas: First acquisition defines requirements: caches the wrapper. Supply mandatory features and limits on the first call. Native access: use and when a subsystem needs WebGPU primitives. Recovery: this module reports device loss but does not expose an in place API. Re bootstrap all device owned resources together. Limits: check the granted before large allocations. (Source: ) See also: GPU Device Sharing · Virtual GPU · GpuFormats


render/Mesh.js

computeBoundsFromInterleavedPositions(vertexData, strideFloats, positionOffsetFloats = 0)

createScreenQuadMesh(device, options = {})

getVertexBufferLayoutForMesh(mesh, slot = 0)

createUnitCubeMesh(device, options = {})

<! AUTOGENERATED by tools/extract api.py — content above HUMAN NOTES is overwritten Source: No file level description found in source. Add one as a leading JSDoc comment, or document it below. Functions <! HUMAN NOTES Notes & Examples Shared GPU device Engine subsystems should reuse the cached wrapper returned by . The wrapper owns the native , its queue, granted features, limits, and device loss callbacks. Resources created by one native device cannot be used by another, so pass the shared wrapper or native device into each subsystem that needs GPU access. Example: Acquire the shared engine device Request a feature only when the application cannot run without it. automatically requests the engine's supported optional feature set, while reports the features actually granted to the device. Feature and limit checks Device loss Gotchas: First acquisition defines requirements: caches the wrapper. Supply mandatory features and limits on the first call. Native access: use and when a subsystem needs WebGPU primitives. Recovery: this module reports device loss but does not expose an in place API. Re bootstrap all device owned resources together. Limits: check the granted before large allocations. (Source: ) See also: GPU Device Sharing · Virtual GPU · GpuFormats


render/MinimapRenderer.js

render/MinimapRenderer.js
Classes
class MinimapRenderer
Notes & Examples
Shared GPU device

<! AUTOGENERATED by tools/extract api.py — content above HUMAN NOTES is overwritten Source: MinimapRenderer.js Top Down Minimap System Renders a 2D top down view of the terrain showing: Terrain colors based on block types Player position and direction indicator Chunk boundaries (optional) Points of interest markers Classes Method Signature Summary Initialize the minimap Update minimap Draw terrain using ImageData with SAMPLING OPTIMIZATION Only samples every Nth pixel to reduce CPU load from O(n²) to O(n²/step²) Apply brightness shading to a color Draw chunk borders Draw player marker Clear terrain cache (call when chunks change significantly) Invalidate cache for a specific chunk Resize minimap Load config <! HUMAN NOTES Notes & Examples Shared GPU device Engine subsystems should reuse the cached wrapper returned by . The wrapper owns the native , its queue, granted features, limits, and device loss callbacks. Resources created by one native device cannot be used by another, so pass the shared wrapper or native device into each subsystem that needs GPU access. Example: Acquire the shared engine device Request a feature only when the application cannot run without it. automatically requests the engine's supported optional feature set, while reports the features actually granted to the device. Feature and limit checks Device loss Gotchas: First acquisition defines requirements: caches the wrapper. Supply mandatory features and limits on the first call. Native access: use and when a subsystem needs WebGPU primitives. Recovery: this module reports device loss but does not expose an in place API. Re bootstrap all device owned resources together. Limits: check the granted before large allocations. (Source: ) See also: GPU Device Sharing · Virtual GPU · GpuFormats