Advanced

@johnhenry/oat-sim — test without camera hardware

npm

npm install @johnhenry/oat-sim

Latest on npm: @johnhenry/[email protected].

CDN

Raw files from jsDelivr, pinned to exact versions. jsDelivr does not rewrite bare imports, so the map also names every dependency the modules import.

<!-- In <head>, before any <script type="module"> or modulepreload. -->
<script type="importmap">
  {
    "imports": {
      "@johnhenry/oat-protocol": "https://cdn.jsdelivr.net/npm/@johnhenry/[email protected]/dist/index.js",
      "@johnhenry/oat-qr-fountain/fountain": "https://cdn.jsdelivr.net/npm/@johnhenry/[email protected]/dist/fountain.js",
      "@johnhenry/oat-sim": "https://cdn.jsdelivr.net/npm/@johnhenry/[email protected]/dist/index.js",
      "@noble/curves/ed25519": "https://cdn.jsdelivr.net/npm/@noble/[email protected]/esm/ed25519.js",
      "@noble/hashes/crypto": "https://cdn.jsdelivr.net/npm/@noble/[email protected]/esm/crypto.js",
      "@noble/hashes/sha2.js": "https://cdn.jsdelivr.net/npm/@noble/[email protected]/esm/sha2.js",
      "@noble/hashes/sha256": "https://cdn.jsdelivr.net/npm/@noble/[email protected]/esm/sha256.js",
      "@noble/hashes/utils.js": "https://cdn.jsdelivr.net/npm/@noble/[email protected]/esm/utils.js",
      "cbor-x": "https://cdn.jsdelivr.net/npm/[email protected]/index.js"
    }
  }
</script>
<script type="module">
  import * as oatSim from "@johnhenry/oat-sim";
</script>

Or with no import map, from esm.sh (it rewrites the imports itself):

import * as oatSim from "https://esm.sh/@johnhenry/[email protected]";

Loaded in headless Chromium on 2026-10-07. Ordering, SRI and CSP: Using @johnhenry packages in the browser.

Encodes and decodes a full artifact through the same fountain-coded pipeline <optical-send>/<optical-receive> use, with no camera and no display — plus deliberate loss, duplication, reordering, and corruption injection, so you can test how your app handles a bad optical link without ever pointing a real camera at a real screen.

This is the package to reach for in CI, or anywhere you need to exercise the receiver’s error paths (oat-rejected, retries, partial-frame handling) deterministically.

@johnhenry/oat-bootstrap — a small transfer unlocks a bigger one

npm

npm install @johnhenry/oat-bootstrap

Latest on npm: @johnhenry/[email protected].

CDN

Raw files from jsDelivr, pinned to exact versions. jsDelivr does not rewrite bare imports, so the map also names every dependency the modules import.

<!-- In <head>, before any <script type="module"> or modulepreload. -->
<script type="importmap">
  {
    "imports": {
      "@johnhenry/oat-bootstrap": "https://cdn.jsdelivr.net/npm/@johnhenry/[email protected]/dist/index.js",
      "@johnhenry/oat-protocol": "https://cdn.jsdelivr.net/npm/@johnhenry/[email protected]/dist/index.js",
      "@noble/curves/ed25519": "https://cdn.jsdelivr.net/npm/@noble/[email protected]/esm/ed25519.js",
      "@noble/hashes/crypto": "https://cdn.jsdelivr.net/npm/@noble/[email protected]/esm/crypto.js",
      "@noble/hashes/sha2.js": "https://cdn.jsdelivr.net/npm/@noble/[email protected]/esm/sha2.js",
      "@noble/hashes/sha256": "https://cdn.jsdelivr.net/npm/@noble/[email protected]/esm/sha256.js",
      "@noble/hashes/utils.js": "https://cdn.jsdelivr.net/npm/@noble/[email protected]/esm/utils.js",
      "cbor-x": "https://cdn.jsdelivr.net/npm/[email protected]/index.js"
    }
  }
</script>
<script type="module">
  import * as oatBootstrap from "@johnhenry/oat-bootstrap";
</script>

Or with no import map, from esm.sh (it rewrites the imports itself):

import * as oatBootstrap from "https://esm.sh/@johnhenry/[email protected]";

Loaded in headless Chromium on 2026-10-07. Ordering, SRI and CSP: Using @johnhenry packages in the browser.

The idea: a small, easily-transferred signed artifact bootstraps a faster follow-on channel that wouldn’t otherwise have a trust anchor. Two workflows ship:

• Verified release-manifest fetch — buildReleaseManifestArtifact/extractReleaseManifest/fetchAndVerifyManifest: a digest-checked, mirror-fallback HTTPS download, gated on signature verification before the fetch happens at all (see Security model — this function enforces its own check rather than trusting callers).
• Real WebRTC offer/answer — createOfferArtifact/createAnswerArtifact/applyAnswerArtifact: a genuine RTCPeerConnection with a live data channel, bootstrapped by exchanging the offer and answer as optical artifacts instead of a signaling server.

Not implemented: BitTorrent / content-addressed bootstrap was scoped as part of the original M5 milestone but never built. The pattern generalizes to it — the same “small signed artifact authorizes a bigger transfer” shape applies — it’s just not shipped code.

Everything together: the reference demo

examples/file-transfer in the repository (not published — it’s an app, not a library) wires sender and receiver together end to end: arbitrary file transfer with type-appropriate rendering, a declarative form UI proposal (safe-view kind 'form' — typed field descriptors, no HTML at all), live switching between Safe/Strict/Permissive/Locked-down receiver policies, a capability grant with a real effect (downloading a generated .ics file, re-checked at submit time), and the full ui.decision round trip sent back optically through a second sender/receiver pair.