@2kw/ai 7.3.0-dev.1 → 7.3.0-dev.10

package/dist/relay-protocol/jws.d.ts

@@ -0,0 +1,28 @@
+import type { KeyObject } from "node:crypto";
+export declare class JwsError extends Error {
+    readonly code: "malformed" | "bad_alg" | "bad_typ" | "unknown_kid" | "bad_signature" | "bad_claims";
+    constructor(code: "malformed" | "bad_alg" | "bad_typ" | "unknown_kid" | "bad_signature" | "bad_claims", message: string);
+}
+export interface JwsHeader {
+    alg: "EdDSA";
+    typ: string;
+    kid: string;
+}
+export interface DecodedJws {
+    header: JwsHeader;
+    claims: Record<string, unknown>;
+    signingInput: string;
+    signature: Buffer;
+}
+/** Contract C3. */
+export declare function signJws(typ: string, kid: string, claims: Record<string, unknown>, key: KeyObject): string;
+export declare function decodeJws(token: string): DecodedJws;
+export declare function verifyJws(token: string, expectedTyp: string, keyFor: (kid: string) => KeyObject | undefined): DecodedJws;
+/** Contract C8. */
+export declare function enrolProofInput(token: string, kid: string, publicKey: string): string;
+export declare function signEnrolProof(key: KeyObject, token: string, kid: string, publicKey: string): string;
+/** Contract C5. */
+export declare function mintRelayJwt(key: KeyObject, kid: string, relayId: string, audience: string, nowSec: number): string;
+/** Checks the claims of an already signature-verified relay JWT; returns the relay id. */
+export declare function verifyRelayJwtClaims(claims: Record<string, unknown>, audience: string, nowSec: number): string;
+//# sourceMappingURL=jws.d.ts.map

package/dist/relay-protocol/jws.js

@@ -0,0 +1,113 @@
+import { b64url, fromB64url, randomHex } from "./b64.js";
+import { signBytes, verifyBytes } from "./keys.js";
+import { CLOCK_SKEW_SECONDS, MAX_JWT_LIFETIME_SECONDS, RELAY_TYP } from "./wire.js";
+export class JwsError extends Error {
+    code;
+    constructor(code, message) {
+        super(message);
+        this.code = code;
+        this.name = "JwsError";
+    }
+}
+function isRecord(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function part(json) {
+    return b64url(Buffer.from(JSON.stringify(json), "utf8"));
+}
+/** Contract C3. */
+export function signJws(typ, kid, claims, key) {
+    const signingInput = `${part({ alg: "EdDSA", typ, kid })}.${part(claims)}`;
+    return `${signingInput}.${b64url(signBytes(key, signingInput))}`;
+}
+export function decodeJws(token) {
+    const parts = token.split(".");
+    if (parts.length !== 3) {
+        throw new JwsError("malformed", "a compact JWS has three parts");
+    }
+    const [headerPart, payloadPart, signaturePart] = parts;
+    let header;
+    let claims;
+    let signature;
+    try {
+        header = JSON.parse(fromB64url(headerPart).toString("utf8"));
+        claims = JSON.parse(fromB64url(payloadPart).toString("utf8"));
+        signature = fromB64url(signaturePart);
+    }
+    catch {
+        throw new JwsError("malformed", "unparseable header, payload or signature");
+    }
+    if (!isRecord(header) || !isRecord(claims)) {
+        throw new JwsError("malformed", "header and payload must be JSON objects");
+    }
+    if (header.alg !== "EdDSA") {
+        throw new JwsError("bad_alg", "alg must be EdDSA");
+    }
+    if (typeof header.typ !== "string") {
+        throw new JwsError("malformed", "typ must be a string");
+    }
+    if (typeof header.kid !== "string" || header.kid.length < 1 || header.kid.length > 64) {
+        throw new JwsError("malformed", "kid must be a string of 1 to 64 characters");
+    }
+    if (signature.length !== 64) {
+        throw new JwsError("malformed", "an Ed25519 signature has 64 bytes");
+    }
+    return {
+        header: { alg: "EdDSA", typ: header.typ, kid: header.kid },
+        claims,
+        signingInput: `${headerPart}.${payloadPart}`,
+        signature,
+    };
+}
+export function verifyJws(token, expectedTyp, keyFor) {
+    const decoded = decodeJws(token);
+    if (decoded.header.typ !== expectedTyp) {
+        throw new JwsError("bad_typ", `typ must be ${expectedTyp}`);
+    }
+    const key = keyFor(decoded.header.kid);
+    if (key === undefined) {
+        throw new JwsError("unknown_kid", "no key for this kid");
+    }
+    if (!verifyBytes(key, decoded.signingInput, decoded.signature)) {
+        throw new JwsError("bad_signature", "signature does not verify");
+    }
+    return decoded;
+}
+/** Contract C8. */
+export function enrolProofInput(token, kid, publicKey) {
+    return `mcprelay-enrol-v1\n${token}\n${kid}\n${publicKey}`;
+}
+export function signEnrolProof(key, token, kid, publicKey) {
+    return b64url(signBytes(key, enrolProofInput(token, kid, publicKey)));
+}
+/** Contract C5. */
+export function mintRelayJwt(key, kid, relayId, audience, nowSec) {
+    return signJws(RELAY_TYP, kid, { iss: relayId, aud: audience, iat: nowSec, exp: nowSec + MAX_JWT_LIFETIME_SECONDS, jti: randomHex(16) }, key);
+}
+/** Checks the claims of an already signature-verified relay JWT; returns the relay id. */
+export function verifyRelayJwtClaims(claims, audience, nowSec) {
+    const { iss, aud, iat, exp } = claims;
+    if (typeof iss !== "string" || iss.length === 0) {
+        throw new JwsError("bad_claims", "relay JWT has no issuer");
+    }
+    if (aud !== audience) {
+        throw new JwsError("bad_claims", "relay JWT audience does not match");
+    }
+    if (typeof iat !== "number" || typeof exp !== "number" || !Number.isInteger(iat) || !Number.isInteger(exp)) {
+        throw new JwsError("bad_claims", "relay JWT times must be integers");
+    }
+    if (exp - iat > MAX_JWT_LIFETIME_SECONDS) {
+        throw new JwsError("bad_claims", "relay JWT lifetime exceeds 60 seconds");
+    }
+    if (exp < iat) {
+        throw new JwsError("bad_claims", "relay JWT expires before it was issued");
+    }
+    if (nowSec > exp + CLOCK_SKEW_SECONDS) {
+        throw new JwsError("bad_claims", "relay JWT expired");
+    }
+    if (iat > nowSec + CLOCK_SKEW_SECONDS) {
+        throw new JwsError("bad_claims", "relay JWT issued in the future");
+    }
+    return iss;
+}
+//# sourceMappingURL=jws.js.map

package/dist/relay-protocol/keys.d.ts

@@ -0,0 +1,26 @@
+import { type KeyObject } from "node:crypto";
+export interface Jwk {
+    kty: "OKP";
+    crv: "Ed25519";
+    x: string;
+    kid: string;
+    alg: "EdDSA";
+    use: "sig";
+}
+export declare function privateKeyFromSeed(seed: Uint8Array): KeyObject;
+export declare function privateKeyFromPem(pem: string): KeyObject;
+export declare function privateKeyToPem(key: KeyObject): string;
+export declare function generatePrivateKey(): KeyObject;
+export declare function rawPublicKey(key: KeyObject): Buffer;
+export declare function publicKeyFromRaw(raw: Uint8Array): KeyObject;
+export declare function publicKeyFromJwk(jwk: {
+    kty?: unknown;
+    crv?: unknown;
+    x?: unknown;
+}): KeyObject;
+/** Contract C2: first 16 characters of base64url(SHA-256(raw public key)). */
+export declare function kidOf(raw: Uint8Array): string;
+export declare function jwkOf(raw: Uint8Array): Jwk;
+export declare function signBytes(key: KeyObject, data: Uint8Array | string): Buffer;
+export declare function verifyBytes(key: KeyObject, data: Uint8Array | string, signature: Uint8Array): boolean;
+//# sourceMappingURL=keys.d.ts.map

package/dist/relay-protocol/keys.js

@@ -0,0 +1,80 @@
+// GENERATED COPY of relay/src/protocol/keys.ts (#1377). Do not edit here: edit the relay's file,
+// then run `npm run sync:relay-protocol` in cli/. `npm run check:relay-protocol` fails on any drift.
+import { createPrivateKey, createPublicKey, generateKeyPairSync, sign, verify, } from "node:crypto";
+import { b64url, fromB64url, sha256b64url } from "./b64.js";
+// DER prefixes for Ed25519 keys (RFC 8410): PKCS#8 private key and SPKI public key.
+const PKCS8_ED25519_PREFIX = Buffer.from("302e020100300506032b657004220420", "hex");
+const SPKI_ED25519_PREFIX = Buffer.from("302a300506032b6570032100", "hex");
+export function privateKeyFromSeed(seed) {
+    if (seed.length !== 32) {
+        throw new Error("Ed25519 seed must be 32 bytes");
+    }
+    return createPrivateKey({
+        key: Buffer.concat([PKCS8_ED25519_PREFIX, Buffer.from(seed)]),
+        format: "der",
+        type: "pkcs8",
+    });
+}
+export function privateKeyFromPem(pem) {
+    const key = createPrivateKey(pem);
+    if (key.asymmetricKeyType !== "ed25519") {
+        throw new Error("not an Ed25519 private key");
+    }
+    return key;
+}
+export function privateKeyToPem(key) {
+    return key.export({ format: "pem", type: "pkcs8" }).toString();
+}
+export function generatePrivateKey() {
+    return generateKeyPairSync("ed25519").privateKey;
+}
+export function rawPublicKey(key) {
+    if (key.asymmetricKeyType !== "ed25519") {
+        throw new Error("not an Ed25519 key");
+    }
+    // createPublicKey derives the public key from a private one, but rejects a public KeyObject.
+    const publicKey = key.type === "public" ? key : createPublicKey(key);
+    const der = publicKey.export({ format: "der", type: "spki" });
+    return Buffer.from(der.subarray(der.length - 32));
+}
+export function publicKeyFromRaw(raw) {
+    if (raw.length !== 32) {
+        throw new Error("Ed25519 public key must be 32 bytes");
+    }
+    return createPublicKey({
+        key: Buffer.concat([SPKI_ED25519_PREFIX, Buffer.from(raw)]),
+        format: "der",
+        type: "spki",
+    });
+}
+export function publicKeyFromJwk(jwk) {
+    if (jwk.kty !== "OKP" || jwk.crv !== "Ed25519" || typeof jwk.x !== "string") {
+        throw new Error("not an Ed25519 JWK");
+    }
+    return publicKeyFromRaw(fromB64url(jwk.x));
+}
+/** Contract C2: first 16 characters of base64url(SHA-256(raw public key)). */
+export function kidOf(raw) {
+    return sha256b64url(raw).slice(0, 16);
+}
+export function jwkOf(raw) {
+    return { kty: "OKP", crv: "Ed25519", x: b64url(raw), kid: kidOf(raw), alg: "EdDSA", use: "sig" };
+}
+function bytes(data) {
+    return typeof data === "string" ? Buffer.from(data, "utf8") : Buffer.from(data);
+}
+export function signBytes(key, data) {
+    return sign(null, bytes(data), key);
+}
+export function verifyBytes(key, data, signature) {
+    if (signature.length !== 64) {
+        return false;
+    }
+    try {
+        return verify(null, bytes(data), key, Buffer.from(signature));
+    }
+    catch {
+        return false;
+    }
+}
+//# sourceMappingURL=keys.js.map

package/dist/relay-protocol/pairing.d.ts

@@ -0,0 +1,26 @@
+/**
+ * Local bridge pairing (#1377, plan P3, P4, P6, P10): the redeem proof, the pairing poll token,
+ * the six-word fingerprint and the device configHash. The cli copies this file into
+ * `cli/src/relay-protocol/`, so it imports `node:crypto` and siblings only and runs on Node 18.
+ * test/vectors/pairing.json pins every function here for the backend too.
+ */
+import type { KeyObject } from "node:crypto";
+export declare const PAIR_PROOF_PREFIX = "localbridge-pair-v1";
+export declare const PAIRING_TYP = "localbridge-pairing+jwt";
+/** The C8 shape: what the bridge signs to redeem a pairing code. */
+export declare function pairProofInput(code: string, kid: string, publicKey: string, name: string, os: string): string;
+export declare function signPairProof(key: KeyObject, code: string, kid: string, publicKey: string, name: string, os: string): string;
+/** The pairing poll token: `iss` is the pairing id, `aud` is `<issuer>/v1/local-bridge/pairings`. */
+export declare function mintPairingJwt(key: KeyObject, kid: string, pairingId: string, issuer: string, nowSec: number): string;
+/** Six words: the first 66 bits of SHA-256(raw public key), big-endian, as six 11-bit indices. */
+export declare function fingerprintWords(rawPublicKey: Uint8Array): string[];
+export interface DeviceConfig {
+    shell: string | null;
+    workspaces: readonly {
+        name: string;
+        path: string;
+    }[];
+}
+/** C10 over what a device exposes: `{shell: <path or null>, workspaces sorted by name}`. */
+export declare function deviceConfigHash(config: DeviceConfig): string;
+//# sourceMappingURL=pairing.d.ts.map

package/dist/relay-protocol/pairing.js

@@ -0,0 +1,49 @@
+import { b64url, randomHex, sha256, sha256b64url } from "./b64.js";
+import { canonicalJson } from "./canonical-json.js";
+import { signJws } from "./jws.js";
+import { signBytes } from "./keys.js";
+import { MAX_JWT_LIFETIME_SECONDS } from "./wire.js";
+import { WORDLIST } from "./wordlist.js";
+export const PAIR_PROOF_PREFIX = "localbridge-pair-v1";
+export const PAIRING_TYP = "localbridge-pairing+jwt";
+/** The C8 shape: what the bridge signs to redeem a pairing code. */
+export function pairProofInput(code, kid, publicKey, name, os) {
+    return `${PAIR_PROOF_PREFIX}\n${code}\n${kid}\n${publicKey}\n${name}\n${os}`;
+}
+export function signPairProof(key, code, kid, publicKey, name, os) {
+    return b64url(signBytes(key, pairProofInput(code, kid, publicKey, name, os)));
+}
+/** The pairing poll token: `iss` is the pairing id, `aud` is `<issuer>/v1/local-bridge/pairings`. */
+export function mintPairingJwt(key, kid, pairingId, issuer, nowSec) {
+    return signJws(PAIRING_TYP, kid, {
+        iss: pairingId,
+        aud: `${issuer}/v1/local-bridge/pairings`,
+        iat: nowSec,
+        exp: nowSec + MAX_JWT_LIFETIME_SECONDS,
+        jti: randomHex(16),
+    }, key);
+}
+/** Six words: the first 66 bits of SHA-256(raw public key), big-endian, as six 11-bit indices. */
+export function fingerprintWords(rawPublicKey) {
+    if (rawPublicKey.length !== 32) {
+        throw new Error("Ed25519 public key must be 32 bytes");
+    }
+    const digest = sha256(rawPublicKey);
+    const words = [];
+    for (let i = 0; i < 6; i += 1) {
+        let index = 0;
+        for (let bit = i * 11; bit < (i + 1) * 11; bit += 1) {
+            index = (index << 1) | ((digest[bit >> 3] >> (7 - (bit & 7))) & 1);
+        }
+        words.push(WORDLIST[index]);
+    }
+    return words;
+}
+/** C10 over what a device exposes: `{shell: <path or null>, workspaces sorted by name}`. */
+export function deviceConfigHash(config) {
+    const workspaces = config.workspaces
+        .map(({ name, path }) => ({ name, path }))
+        .sort((a, b) => (a.name < b.name ? -1 : a.name > b.name ? 1 : 0));
+    return `sha256:${sha256b64url(canonicalJson({ shell: config.shell, workspaces }))}`;
+}
+//# sourceMappingURL=pairing.js.map

package/dist/relay-protocol/wire.d.ts

@@ -0,0 +1,101 @@
+/** Wire constants and message shapes shared by relay and hub. Spec §6, plan contract C4–C11. */
+export declare const REQUEST_TYP = "mcprelay-request+jwt";
+export declare const RELAY_TYP = "relay+jwt";
+export declare const PROTOCOL_VERSION = 1;
+export declare const MAX_BODY_BYTES: number;
+export declare const MAX_FRAME_PAYLOAD_BYTES: number;
+/**
+ * Frames a single POST to the hub may carry. The hub keeps the signatures of exactly this many
+ * recent frames, refuses a frames POST carrying more, and the relay never batches more — so an
+ * identical retry of the latest POST is always fully inside that window and is answered
+ * idempotently instead of being mistaken for a rewritten frame.
+ */
+export declare const MAX_FRAMES_PER_POST = 64;
+/**
+ * Cancel ids one poll may carry, in either direction. The hub puts at most this many tombstones
+ * into a poll response, oldest first, and the relay acks at most this many per poll — because an
+ * ack rides in the poll's QUERY STRING, and a request line plus headers has to stay inside the
+ * 16 KiB Node allows and the 8 KiB nginx and Apache ship with. An id is `rq_` + 32 hex = 35
+ * characters plus a comma, so 64 ids are 2 304 bytes: under 3 KiB with the rest of the URL,
+ * whatever else a proxy on the hop adds. Anything past the cap simply waits for the next poll.
+ */
+export declare const MAX_CANCELS_PER_POLL = 64;
+export declare const MAX_HEADER_BYTES: number;
+export declare const CLOCK_SKEW_SECONDS = 30;
+export declare const MAX_JWT_LIFETIME_SECONDS = 60;
+export declare const POLL_WAIT_SECONDS = 25;
+export declare const ACCEPTANCE_MS = 10000;
+export declare const OWNER_LEASE_MS = 30000;
+export declare const OFFLINE_MS = 60000;
+export declare const CALL_TOTAL_MS: number;
+export declare const LISTEN_TOTAL_MS: number;
+export declare const MAX_HEAD_DEADLINE_MS: number;
+export declare const CONTROL_RESERVE = 32;
+export type RequestClass = "CALL" | "CONTROL" | "LISTEN";
+export declare const REQUEST_CLASSES: readonly RequestClass[];
+export type HeaderPair = [string, string];
+export interface Envelope {
+    id: string;
+    server: string;
+    method: string;
+    url: string;
+    headers: HeaderPair[];
+    assertion: string;
+    /** base64url of the request body; the empty string for no body. */
+    body: string;
+}
+export interface PolledRequest {
+    requestClass: RequestClass;
+    envelope: Envelope;
+}
+export interface PollBody {
+    generation: string;
+    requests: PolledRequest[];
+    cancels: string[];
+    jwksRefresh: boolean;
+}
+export interface ForwardRequest {
+    relayId: string;
+    requestClass: RequestClass;
+    /** epoch seconds, equal to the assertion's dl claim */
+    headDeadlineAt: number;
+    envelope: Envelope;
+}
+/**
+ * Spec §6.7. The array is the source and the union is derived from it, so the set is enumerable
+ * at run time: the golden vectors publish a row per code and a unit test checks that table
+ * against this list, which is what stops the documented codes and the implemented ones drifting.
+ */
+export declare const ERROR_CODES: readonly ["connector_not_in_inventory", "relay_not_active", "relay_offline", "relay_unavailable", "relay_unknown", "not_allowlisted", "assertion_invalid", "config_changed", "stdio_capacity", "upstream_unreachable", "upstream_timeout", "upstream_incomplete", "outcome_unknown", "response_invalid", "body_too_large", "session_lost", "relay_in_use", "request_unknown", "protocol_unsupported"];
+export type ErrorCode = (typeof ERROR_CODES)[number];
+export type ForwardLine = {
+    kind: "hub";
+    code: ErrorCode;
+    message: string;
+} | {
+    kind: "frame";
+    frame: import("./frames.js").Frame;
+};
+export interface RequestAssertionClaims {
+    iss: string;
+    aud: string;
+    org: string;
+    rid: string;
+    srv: string;
+    cnu: string;
+    cfg: string;
+    cls: RequestClass;
+    htm: string;
+    htu: string;
+    hdh: string;
+    bdh: string;
+    dl: number;
+    sub: string;
+    agt?: string;
+    run?: string;
+    cid?: string;
+    iat: number;
+    exp: number;
+    jti: string;
+}
+//# sourceMappingURL=wire.d.ts.map

package/dist/relay-protocol/wire.js

@@ -0,0 +1,63 @@
+// GENERATED COPY of relay/src/protocol/wire.ts (#1377). Do not edit here: edit the relay's file,
+// then run `npm run sync:relay-protocol` in cli/. `npm run check:relay-protocol` fails on any drift.
+/** Wire constants and message shapes shared by relay and hub. Spec §6, plan contract C4–C11. */
+export const REQUEST_TYP = "mcprelay-request+jwt";
+export const RELAY_TYP = "relay+jwt";
+export const PROTOCOL_VERSION = 1;
+export const MAX_BODY_BYTES = 8 * 1024 * 1024;
+export const MAX_FRAME_PAYLOAD_BYTES = 1024 * 1024;
+/**
+ * Frames a single POST to the hub may carry. The hub keeps the signatures of exactly this many
+ * recent frames, refuses a frames POST carrying more, and the relay never batches more — so an
+ * identical retry of the latest POST is always fully inside that window and is answered
+ * idempotently instead of being mistaken for a rewritten frame.
+ */
+export const MAX_FRAMES_PER_POST = 64;
+/**
+ * Cancel ids one poll may carry, in either direction. The hub puts at most this many tombstones
+ * into a poll response, oldest first, and the relay acks at most this many per poll — because an
+ * ack rides in the poll's QUERY STRING, and a request line plus headers has to stay inside the
+ * 16 KiB Node allows and the 8 KiB nginx and Apache ship with. An id is `rq_` + 32 hex = 35
+ * characters plus a comma, so 64 ids are 2 304 bytes: under 3 KiB with the rest of the URL,
+ * whatever else a proxy on the hop adds. Anything past the cap simply waits for the next poll.
+ */
+export const MAX_CANCELS_PER_POLL = 64;
+export const MAX_HEADER_BYTES = 64 * 1024;
+export const CLOCK_SKEW_SECONDS = 30;
+export const MAX_JWT_LIFETIME_SECONDS = 60;
+export const POLL_WAIT_SECONDS = 25;
+export const ACCEPTANCE_MS = 10_000;
+export const OWNER_LEASE_MS = 30_000;
+export const OFFLINE_MS = 60_000;
+export const CALL_TOTAL_MS = 10 * 60_000;
+export const LISTEN_TOTAL_MS = 60 * 60_000;
+export const MAX_HEAD_DEADLINE_MS = 10 * 60_000;
+export const CONTROL_RESERVE = 32;
+export const REQUEST_CLASSES = ["CALL", "CONTROL", "LISTEN"];
+/**
+ * Spec §6.7. The array is the source and the union is derived from it, so the set is enumerable
+ * at run time: the golden vectors publish a row per code and a unit test checks that table
+ * against this list, which is what stops the documented codes and the implemented ones drifting.
+ */
+export const ERROR_CODES = [
+    "connector_not_in_inventory",
+    "relay_not_active",
+    "relay_offline",
+    "relay_unavailable",
+    "relay_unknown",
+    "not_allowlisted",
+    "assertion_invalid",
+    "config_changed",
+    "stdio_capacity",
+    "upstream_unreachable",
+    "upstream_timeout",
+    "upstream_incomplete",
+    "outcome_unknown",
+    "response_invalid",
+    "body_too_large",
+    "session_lost",
+    "relay_in_use",
+    "request_unknown",
+    "protocol_unsupported",
+];
+//# sourceMappingURL=wire.js.map

package/dist/relay-protocol/wordlist.d.ts

@@ -0,0 +1,30 @@
+/**
+ * The BIP-39 English word list, 2048 words: the alphabet of the six-word pairing fingerprint
+ * (plan P6). Copied unchanged from
+ * https://github.com/bitcoin/bips/blob/master/bip-0039/english.txt, whose SHA-256 (LF line
+ * endings, trailing newline) is 2f5eed53a4727b4bf8880d8f3f199efc90e58503646d9ff8eff3a2ed3b24dbda;
+ * test/unit/pairing.test.ts checks this copy against it. The backend reads the same file as
+ * backend/src/main/resources/localbridge/wordlist-en.txt.
+ *
+ * BIP 39 is published under the MIT License ("License: MIT" in its header,
+ * https://github.com/bitcoin/bips/blob/master/bip-0039.mediawiki).
+ *
+ * Copyright (c) 2013 Marek Palatinus, Pavol Rusnak, Aaron Voisine, Sean Bowe (the BIP 39 authors)
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy of this software
+ * and associated documentation files (the "Software"), to deal in the Software without
+ * restriction, including without limitation the rights to use, copy, modify, merge, publish,
+ * distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the
+ * Software is furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in all copies or
+ * substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING
+ * BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+ * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM,
+ * DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+ */
+export declare const WORDLIST: readonly string[];
+//# sourceMappingURL=wordlist.d.ts.map