@bombadil/rhizomatic

The TypeScript reference implementation of Rhizomatic — a portable format for arbitrarily relational data: composable, forkable, mergeable, and federatable by default.

• Every fact is a signed, content-addressed delta (an author's claim at a time).
• Merge is union — a grow-only set CRDT; any interleaving of the same deltas converges.
• Truth is not stored; it is resolved per-reader under a trust policy. Disagreement lives in superposition until a policy picks. Provenance and time-travel are intrinsic.

This is one of two parallel witnesses to the specification (the other is a Rust witness in the same repo). Both pass the same conformance vectors, byte-for-byte — determinism is the contract. See it run in the interactive tour.

Install

npm install @bombadil/rhizomatic

Quick taste

import { authorForSeed, signClaims, verifyDelta, DeltaSet } from "@bombadil/rhizomatic";

const seed = "00".repeat(32); // 32-byte hex seed — use real randomness in practice
const author = authorForSeed(seed);

// A delta is a signed set of pointers: an author's claim, content-addressed by its canonical bytes.
const delta = signClaims(
  {
    timestamp: 0,
    author,
    pointers: [{ role: "name", target: { kind: "primitive", value: "Ada" } }],
  },
  seed,
);

verifyDelta(delta); // "verified" (content address holds + signature checks out)

const world = new DeltaSet();
world.add(delta); // deduped by id; merge two DeltaSets and you get their union

The public surface also covers the operator algebra (evalTerm), schemas, resolution policies (resolveView), packs (packSet/unpackSet), the reactor, federation (Peer), and derivation. See the spec for what each layer means.

License

Dual-licensed under either of MIT or Apache-2.0, at your option.

Releasing (maintainers)

Publishing is cutting a tag: npm run release:patch|minor|major bumps the version, commits, tags rhizomatic-vX.Y.Z, and pushes; the release workflow then runs the full green-gate and publishes to npm via trusted publishing (OIDC — the workflow identity is the credential; no tokens anywhere, provenance automatic). The registry-side half is the package's npmjs.com Trusted Publisher setting: GitHub Actions, bombadil-labs/rhizomatic, workflow release.yml.