@hediet/linkrpc-hub 0.0.1

package/dist/chunks/server-BAxchQhy.js

@@ -0,0 +1,1368 @@
+import "./hubConnectionAcceptor-B5-8JsFY.js";
+import "./nodeTransit-CWeFnbwt.js";
+import "./connectionTokenBinder.interfaces-B-beCg06.js";
+import { createRequire } from "node:module";
+import { InMemoryManagedIdentity, LinkRpcConnection, base64UrlToBytes, bytesToBase64Url, crypto, jcsCanonicalize, jcsCanonicalizeBytes, keyIdForPrincipal, publicKeyForKeyId, signCapability } from "@hediet/linkrpc";
+import { ROOT_SERVICE_ID, hubAccessInterface, isValidServiceId, mapTransport, walkHubDetailed } from "@hediet/linkrpc/hub/common";
+import { createHash, randomBytes } from "node:crypto";
+import * as fs from "node:fs/promises";
+import * as path from "node:path";
+//#region src/hub/server/hubRegisterServiceId.ts
+/**
+* Register an **in-process** service on `hub` under `serviceId`, returning a
+* {@link RegisteredServiceId} whose `connection` serves its interfaces.
+*
+* This is the hubv2 replacement for the v1 `hub.attachParticipant(pair.a)` +
+* `LinkRpcConnection.fromTransport(pair.b)` + `enableReflection({ serviceId })`
+* dance that every built-in extension service performed. It:
+*
+* 1. attaches an in-memory link to the hub and claims `serviceId` on it, so
+*    the hub routes every fully-qualified `serviceId::…` call to this service;
+* 2. exposes a {@link LinkRpcConnection} whose registered interfaces answer
+*    those calls (register them with `{ serviceId }`); and
+* 3. enables reflection under `serviceId` so the hub's aggregating
+*    `directory::list` surfaces this service.
+*
+* Disposing the returned handle (`svc.dispose()`) closes the connection and
+* detaches the link, releasing the claimed prefix.
+*
+* Unlike an accepted *participant* (which gets a {@link RootOverlay} and only
+* reaches the hub through its uplink), an in-process service is attached
+* directly to the hub as a prefix owner. It is fully trusted — no provenance,
+* identity, or forwarded-call gating applies to traffic it receives.
+*/
+function hubRegisterServiceId(hub, serviceId) {
+	const link = hub.attachOut();
+	link.addPrefixRoute(serviceId);
+	const connection = LinkRpcConnection.fromTransport(link.transport);
+	connection.enableReflection({ serviceId });
+	return new RegisteredServiceId(connection, link);
+}
+/**
+* Handle to an in-process service registered on a {@link Hub} via
+* {@link hubRegisterServiceId}. Owns both the {@link LinkRpcConnection} the
+* service serves its interfaces on and the hub {@link AttachedLink} that routes
+* traffic to it. {@link dispose} closes the connection and detaches the link
+* (releasing the claimed prefix) — wire it into the owning feature's disposal.
+*/
+var RegisteredServiceId = class {
+	connection;
+	_link;
+	constructor(connection, _link) {
+		this.connection = connection;
+		this._link = _link;
+	}
+	dispose() {
+		this.connection.close();
+		this._link.dispose();
+	}
+};
+//#endregion
+//#region src/hub/server/accessCandidates.ts
+/**
+* Fetch the full interface directory by recursively walking the hub's
+* **referral** directory graph. {@link walkHubDetailed} follows explicit
+* `hubrpc.directory` listings to collect leaf interfaces (folding transitive
+* root-node-id requirements onto descendants along the way). Routing claims do
+* not create referrals. This is the v2 replacement for the hub-internal
+* `_fullDirectory()`.
+*/
+async function fetchFullDirectory(connection, hubServiceId = "hub") {
+	const { listings } = await walkHubDetailed(connection.channel, { rootTarget: hubServiceId });
+	return listings.map((it) => ({
+		serviceId: it.serviceId,
+		interfaceId: it.interfaceId,
+		hash: it.hash,
+		...it.serviceDescription !== void 0 ? { serviceDescription: it.serviceDescription } : {},
+		...it.rootPrincipalSets !== void 0 ? { rootPrincipalSets: it.rootPrincipalSets } : {}
+	}));
+}
+/**
+* Resolve every dependency slot against a directory snapshot. Pure port of
+* the v1 hub's per-request candidate resolution loop + `_candidatesForSlot`.
+*/
+function resolveAccessCandidates(slots, directory) {
+	const dependencies = {};
+	const noCandidateSlots = [];
+	for (const [slotId, slot] of Object.entries(slots)) {
+		const candidates = candidatesForSlot(slot, directory);
+		dependencies[slotId] = {
+			request: slot,
+			candidates
+		};
+		if (candidates.length === 0) noCandidateSlots.push(slotId);
+	}
+	return {
+		dependencies,
+		noCandidateSlots
+	};
+}
+/**
+* Match one slot against the directory snapshot. A service is a candidate iff
+* it satisfies every `required` interface (by id, and by hash when pinned).
+*/
+function candidatesForSlot(slot, directory) {
+	const byPrefix = /* @__PURE__ */ new Map();
+	for (const it of directory) {
+		let entry = byPrefix.get(it.serviceId);
+		if (!entry) {
+			entry = { interfaces: [] };
+			byPrefix.set(it.serviceId, entry);
+		}
+		entry.interfaces.push({
+			id: it.interfaceId,
+			hash: it.hash
+		});
+		if (entry.serviceDescription === void 0 && it.serviceDescription !== void 0) entry.serviceDescription = it.serviceDescription;
+	}
+	const out = [];
+	for (const [prefix, entry] of byPrefix) {
+		const ifaces = entry.interfaces;
+		const satisfied = [];
+		const unsatisfied = [];
+		let missingRequired = false;
+		for (const req of slot.interfaces) if (ifaces.some((i) => i.id === req.id && (req.hash === void 0 || i.hash === req.hash))) satisfied.push(req);
+		else {
+			unsatisfied.push(req);
+			if (req.required) missingRequired = true;
+		}
+		if (missingRequired) continue;
+		out.push({
+			serviceId: prefix,
+			...entry.serviceDescription !== void 0 ? { serviceDescription: entry.serviceDescription } : {},
+			satisfiedInterfaces: satisfied,
+			unsatisfiedInterfaces: unsatisfied
+		});
+	}
+	return out;
+}
+//#endregion
+//#region src/hub/server/mintCapability.ts
+/**
+* Admin-issued capability minting for the v2 consent engine.
+*
+* v1 issued capabilities through the hub (`proposeCapability` +
+* `signProposedCapability`). In v2 the hub no longer signs anything — the
+* consent engine owns an admin {@link SigningIdentity} and mints capabilities
+* directly. A {@link SigningIdentity} signs over arbitrary bytes with its
+* Ed25519 key, which is exactly what {@link signCapability} needs, so this is
+* a thin wrapper that assembles a {@link Capability} and signs it.
+*/
+/**
+* Assemble and sign a {@link Capability} with the admin identity.
+*
+* This replaces the v1 `hub.proposeCapability` / `signProposedCapability`
+* pair: the consent engine decides the permissions (e.g. from
+* {@link resolveAccessCandidates} + the user's consent selection) and mints
+* the capability bound to the consumer's PrincipalId as `audience`.
+*/
+async function mintCapability(options) {
+	const capability = {
+		issuer: options.issuer.publicSigningIdentity.principal,
+		audience: options.audience,
+		permissions: [...options.permissions],
+		nonce: options.nonce ?? randomNonce(),
+		...options.expiresAtMs !== void 0 ? { expiresAtMs: options.expiresAtMs } : {},
+		...options.parentHash !== void 0 ? { parentHash: options.parentHash } : {}
+	};
+	return signCapability(capability, options.issuer);
+}
+function randomNonce() {
+	const bytes = /* @__PURE__ */ new Uint8Array(16);
+	globalThis.crypto.getRandomValues(bytes);
+	return bytesToBase64Url(bytes);
+}
+//#endregion
+//#region src/hub/server/capabilityProposal.ts
+/**
+* Capability proposal issuer — the byte-equality preview mechanism for the v2
+* consent engine, backed by an admin {@link Identity}.
+*
+* In v1 these were hub-core methods (`Hub.proposeCapability` / `signProposal` /
+* `redeemProposal`). In v2 the hub signs nothing, so the consent engine owns an
+* admin identity and runs the proposal protocol itself. The mechanism lets a
+* separate consent UI (a webview shell, reached over RPC) render the *exact*
+* `Capability` that will be signed, then return it verbatim for redemption —
+* with cryptographic guarantees that the displayed bytes equal the signed
+* bytes and that a proposal cannot be replayed or substituted across prompts.
+*
+* Protocol (all host-side, using the admin key):
+*   1. `propose({ audience, permissions, expiresAtMs? })` → an unsigned
+*      `Capability` tagged with an internal marker.
+*   2. `signProposal(cap, { bind? })` → a `CapabilityProposal`: the readable
+*      `capability` plus an opaque `$hubData` blob (a domain-separated
+*      signature over `canonicalJson({ preview: cap, bind? })`). The UI renders
+*      `capability` and, on approval, returns the whole proposal verbatim.
+*   3. `redeemProposal(proposal, { expectedBind? })` → a real
+*      `SignedCapability`. Verifies the `$hubData` signature, that the preview
+*      deep-equals `proposal.capability`, the optional `bind`, and a one-shot
+*      nonce; then signs the bare canonical cap so the result is an ordinary
+*      bearer token (verifiable by {@link verifyChain}).
+*/
+function isHubProposalData(v) {
+	return v !== null && typeof v === "object" && typeof v.payload === "string" && typeof v.signature === "string";
+}
+const _DURATION_TO_MS = {
+	once: 3e5,
+	shortLived: 3e5,
+	longLived: 864e5
+};
+/**
+* Convert an access duration into a Unix-milliseconds expiration timestamp, so
+* handlers compute the same `expiresAtMs` the issuer mints with. Returns
+* `undefined` for `persistent` (and any future never-expiring duration), which
+* callers pass straight to {@link CapabilityProposalIssuer.propose}/`mint` —
+* both omit `expiresAtMs` when it is `undefined`, yielding a non-expiring cap.
+* Defaults to the safe short TTL (`shortLived`) when no duration is supplied.
+*/
+function durationToExp(duration) {
+	const d = duration ?? "shortLived";
+	if (d === "persistent") return;
+	return Date.now() + _DURATION_TO_MS[d];
+}
+function canonicalEqual(a, b) {
+	try {
+		return jcsCanonicalize(a) === jcsCanonicalize(b);
+	} catch {
+		return false;
+	}
+}
+/** Marker proving a `Capability` came from {@link CapabilityProposalIssuer.propose}. */
+const _PROPOSED = Symbol("linkrpc.proposedCapability");
+/**
+* Issues capabilities and capability proposals signed by an admin
+* {@link SigningIdentity}. One instance per hub host; tracks redeemed nonces
+* for one-shot proposal redemption.
+*/
+var CapabilityProposalIssuer = class {
+	_issuer;
+	_redeemedNonces = /* @__PURE__ */ new Set();
+	_nonceCounter = 0;
+	constructor(_issuer) {
+		this._issuer = _issuer;
+	}
+	get issuerPrincipalId() {
+		return this._issuer.publicSigningIdentity.principal;
+	}
+	/**
+	* Build an unsigned `Capability` the issuer is willing to sign, tagged with
+	* an internal marker. {@link signProposal} refuses to sign anything lacking
+	* the marker — a guard against a handler fabricating arbitrary caps. The
+	* marker is non-enumerable, so it never affects serialization or signing.
+	*/
+	propose(args) {
+		const cap = {
+			issuer: this._issuer.publicSigningIdentity.principal,
+			audience: args.audience,
+			permissions: [...args.permissions],
+			nonce: this._nextNonce(),
+			...args.expiresAtMs !== void 0 ? { expiresAtMs: args.expiresAtMs } : {}
+		};
+		Object.defineProperty(cap, _PROPOSED, {
+			value: true,
+			enumerable: false,
+			configurable: false,
+			writable: false
+		});
+		return cap;
+	}
+	/**
+	* Mint a final `SignedCapability` directly from a proposed cap, bypassing
+	* the preview round-trip. Use when no UI needs to render the unsigned form.
+	*/
+	async mint(args) {
+		const cap = this.propose(args);
+		return this._sign(cap);
+	}
+	/**
+	* Pair a proposed `Capability` with a domain-separated signature over
+	* `canonicalJson({ preview: cap, bind? })`. The result is **not** a bearer
+	* token — only this issuer can redeem it.
+	*/
+	async signProposal(cap, opts) {
+		if (!cap[_PROPOSED]) throw new Error("signProposal: capability was not produced by propose()");
+		const payload = { preview: cap };
+		if (opts?.bind !== void 0) payload.bind = opts.bind;
+		const previewBytes = jcsCanonicalizeBytes(payload);
+		const sig = await this._issuer.sign(previewBytes);
+		return {
+			capability: cap,
+			$hubData: {
+				payload: bytesToBase64Url(previewBytes),
+				signature: bytesToBase64Url(sig)
+			}
+		};
+	}
+	/**
+	* Verify and redeem a {@link CapabilityProposal}, returning a real
+	* {@link SignedCapability}. Checks: `$hubData` signature, preview deep-equal
+	* to `proposal.capability`, optional `bind` match, and one-shot nonce.
+	*/
+	async redeemProposal(proposal, opts) {
+		if (!isHubProposalData(proposal.$hubData)) throw new Error("redeemProposal: malformed $hubData");
+		const payloadBytes = base64UrlToBytes(proposal.$hubData.payload);
+		const sigBytes = base64UrlToBytes(proposal.$hubData.signature);
+		const pubKey = publicKeyForKeyId(keyIdForPrincipal(this._issuer.publicSigningIdentity.principal));
+		if (!await crypto.verify(pubKey, payloadBytes, sigBytes)) throw new Error("redeemProposal: $hubData.signature does not verify");
+		let parsed;
+		try {
+			parsed = JSON.parse(new TextDecoder().decode(payloadBytes));
+		} catch (e) {
+			throw new Error(`redeemProposal: malformed payload (${e.message})`);
+		}
+		if (!canonicalEqual(parsed.preview, proposal.capability)) throw new Error("redeemProposal: proposal.capability does not match the signed preview");
+		const hasBind = parsed.bind !== void 0;
+		if (hasBind !== (opts?.expectedBind !== void 0)) throw new Error(hasBind ? "redeemProposal: proposal is bound but no expectedBind supplied" : "redeemProposal: expectedBind supplied but proposal has no bind");
+		if (hasBind && !canonicalEqual(parsed.bind, opts.expectedBind)) throw new Error("redeemProposal: bind does not match expectedBind");
+		const cap = parsed.preview;
+		if (this._redeemedNonces.has(cap.nonce)) throw new Error("redeemProposal: proposal already redeemed");
+		this._redeemedNonces.add(cap.nonce);
+		return this._sign(cap);
+	}
+	_sign(cap) {
+		return signCapability(cap, this._issuer);
+	}
+	_nextNonce() {
+		const bytes = /* @__PURE__ */ new Uint8Array(16);
+		globalThis.crypto.getRandomValues(bytes);
+		this._nonceCounter += 1;
+		return `${bytesToBase64Url(bytes)}-${this._nonceCounter}`;
+	}
+};
+//#endregion
+//#region src/hub/server/hubAccessService.ts
+/**
+* Install `hubAccess::{request,extend,requestAccess}` at the **connection
+* root** of a participant's overlay (root form, no serviceId prefix). The root
+* is never forwarded, so the consent front door is reached directly and needs
+* no capability of its own.
+*
+* The capability `audience` is taken **directly from `params.consumer.principal`**
+* — no longer derived from a verified call signer. A cap minted for a nodeId is
+* only usable by the holder of that node's key (enforced at call time by
+* `permits`, which checks `audience === call.signer`), so a self-asserted
+* audience grants no usable authority to a caller who does not hold the key.
+*/
+function registerHubAccessService(connection, options) {
+	const { handlers } = options;
+	connection.register(hubAccessInterface, {
+		request: async (params) => {
+			const consumerPrincipalId = params.consumer.principal;
+			const slots = {};
+			for (const [slotId, raw] of Object.entries(params.dependencies)) slots[slotId] = normalizeSlot(raw);
+			const { dependencies, noCandidateSlots } = resolveAccessCandidates(slots, [...await options.fetchDirectory()]);
+			if (noCandidateSlots.length > 0) return {
+				status: "noCandidates",
+				slots: [...noCandidateSlots]
+			};
+			const decision = await handlers.onAccessRequest({
+				consumer: params.consumer,
+				consumerPrincipalId,
+				dependencies,
+				duration: params.duration
+			});
+			if (!decision.granted) return decision.reason !== void 0 ? {
+				status: "denied",
+				reason: decision.reason
+			} : { status: "denied" };
+			const responseSlots = {};
+			for (const [slotId, binding] of Object.entries(decision.resolvedSlots)) {
+				const resolved = dependencies[slotId];
+				if (!resolved) continue;
+				if (!resolved.candidates.find((c) => c.serviceId === binding.serviceId)) continue;
+				responseSlots[slotId] = {
+					serviceId: binding.serviceId,
+					satisfiedInterfaces: [...binding.interfaces]
+				};
+			}
+			return {
+				status: "granted",
+				slots: responseSlots,
+				capabilities: [...decision.capabilities]
+			};
+		},
+		extend: async (params) => {
+			const consumerPrincipalId = params.consumer.principal;
+			const added = params.added.map((a) => ({
+				interfaceId: a.interfaceId,
+				member: a.member,
+				required: a.required !== false
+			}));
+			const decision = await handlers.onAccessExtend({
+				consumer: params.consumer,
+				consumerPrincipalId,
+				serviceId: params.serviceId,
+				added,
+				duration: params.duration
+			});
+			if (!decision.granted) return decision.reason !== void 0 ? {
+				status: "denied",
+				reason: decision.reason
+			} : { status: "denied" };
+			const grantedMembers = decision.grantedMembers.map((g) => ({
+				interfaceId: g.interfaceId,
+				member: g.member
+			}));
+			return decision.capabilities !== void 0 ? {
+				status: "granted",
+				serviceId: decision.serviceId,
+				granted: grantedMembers,
+				capabilities: [...decision.capabilities]
+			} : {
+				status: "granted",
+				serviceId: decision.serviceId,
+				granted: grantedMembers
+			};
+		},
+		requestAccess: async (params) => {
+			const consumerPrincipalId = params.consumer.principal;
+			const decision = await handlers.onAccessRequestDirect({
+				consumer: params.consumer,
+				consumerPrincipalId,
+				permissions: params.permissions,
+				duration: params.duration
+			});
+			if (!decision.granted) return decision.reason !== void 0 ? {
+				status: "denied",
+				reason: decision.reason
+			} : { status: "denied" };
+			return {
+				status: "granted",
+				capabilities: [...decision.capabilities]
+			};
+		}
+	});
+}
+function normalizeSlot(raw) {
+	return {
+		interfaces: raw.interfaces.map((i) => ({
+			id: i.id,
+			required: i.required !== false,
+			...i.hash !== void 0 ? { hash: i.hash } : {}
+		})),
+		members: (raw.members ?? []).map((m) => ({
+			interfaceId: m.interfaceId,
+			member: m.member,
+			required: m.required !== false
+		}))
+	};
+}
+//#endregion
+//#region src/hub/server/tokenIdentityStore.ts
+/**
+* The hub's connection-token mint + redemption store, shared between the
+* `connectionTokenBinder::bindConnectionToken` front door (mint) and a
+* `managedIdentity: { mode: "fromToken" }` / `grantedServiceId: { mode:
+* "fromToken" }` listener (redeem).
+*
+* Tokens are random, time-boxed and **single-use**: {@link redeem} consumes the
+* entry, so a token can bind exactly one connection and cannot be replayed once
+* used or expired. Expired entries are pruned lazily on access.
+*/
+var TokenIdentityStore = class {
+	_byToken = /* @__PURE__ */ new Map();
+	_defaultTtlMs;
+	_now;
+	_generate;
+	constructor(options = {}) {
+		this._defaultTtlMs = options.defaultTtlMs ?? 3e4;
+		this._now = options.now ?? (() => Date.now());
+		this._generate = options.generateToken ?? (() => randomBytes(32).toString("base64url"));
+	}
+	/** Mint a fresh single-use token bound to `binding`, valid for `ttlMs`. */
+	mint(binding = {}, ttlMs) {
+		this._prune();
+		const token = this._generate();
+		const expiresAt = this._now() + (ttlMs ?? this._defaultTtlMs);
+		this._byToken.set(token, {
+			identitySlot: binding.identitySlot,
+			grantedServiceIdNamespace: binding.grantedServiceIdNamespace,
+			expiresAt
+		});
+		return {
+			token,
+			expiresAt
+		};
+	}
+	/**
+	* Non-consuming existence check for the `hubrpc::initialize` token gate.
+	* Returns `true` iff the token is live (known and unexpired). Single-use is
+	* enforced separately by {@link redeem}.
+	*/
+	peek(token) {
+		if (token === void 0) return false;
+		const entry = this._byToken.get(token);
+		if (entry === void 0) return false;
+		if (entry.expiresAt <= this._now()) {
+			this._byToken.delete(token);
+			return false;
+		}
+		return true;
+	}
+	/**
+	* Consume `token`, returning its binding exactly once. Returns `undefined`
+	* for an unknown, expired or already-redeemed token (the caller should drop
+	* the connection in that case).
+	*/
+	redeem(token) {
+		if (token === void 0) return void 0;
+		const entry = this._byToken.get(token);
+		if (entry === void 0) return void 0;
+		this._byToken.delete(token);
+		if (entry.expiresAt <= this._now()) return void 0;
+		const binding = {};
+		if (entry.identitySlot !== void 0) binding.identitySlot = entry.identitySlot;
+		if (entry.grantedServiceIdNamespace !== void 0) binding.grantedServiceIdNamespace = entry.grantedServiceIdNamespace;
+		return binding;
+	}
+	/** Live (unexpired, unredeemed) token count — primarily for tests/metrics. */
+	get size() {
+		this._prune();
+		return this._byToken.size;
+	}
+	_prune() {
+		const now = this._now();
+		for (const [token, entry] of this._byToken) if (entry.expiresAt <= now) this._byToken.delete(token);
+	}
+};
+//#endregion
+//#region src/hub/server/provenance.ts
+/**
+* Annotate every transport from `source` with the provenance `provider`
+* resolves for it. On provider error/timeout — or when the returned
+* `identityKey` does not start with `` `${provider.identityNamespace}/` `` —
+* the transport is forwarded with `provenance: undefined`, unless
+* {@link WithProvenanceOptions.requireProvenance} is set, in which case it is
+* disposed and dropped.
+*
+* This is the one concrete {@link mapTransport} the hub ships: it is where
+* `net.Socket` (or any backend handle) is read for attestation and nowhere
+* else.
+*/
+function withProvenance(source, provider, options = {}) {
+	const namespacePrefix = `${provider.identityNamespace}/`;
+	return mapTransport(source, async (t) => {
+		const controller = new AbortController();
+		t.onDidClose(() => controller.abort());
+		let timer;
+		if (options.resolveTimeoutMs !== void 0) timer = setTimeout(() => controller.abort(), options.resolveTimeoutMs);
+		let provenance;
+		try {
+			const result = await provider.resolve(t, controller.signal);
+			if (!("error" in result) && result.identityKey.startsWith(namespacePrefix)) provenance = result;
+		} catch {
+			provenance = void 0;
+		} finally {
+			if (timer !== void 0) clearTimeout(timer);
+		}
+		if (provenance === void 0 && options.requireProvenance) {
+			t.dispose();
+			return;
+		}
+		return Object.assign(t, { provenance });
+	});
+}
+//#endregion
+//#region src/hub/server/prefixPolicy.ts
+/**
+* Default {@link PrefixPolicy}: a participant may claim only the prefix(es)
+* {@link PrincipalIdPrefixPolicyOptions.derivePrefixes} grants it. The out-of-box
+* derivation ties the claimable prefix to the peer's attested provenance, so
+* `docker/echo-provider` can serve `docker/echo-provider/*` and nothing can
+* impersonate it.
+*/
+var PrincipalIdPrefixPolicy = class {
+	_derive;
+	constructor(options = {}) {
+		this._derive = options.derivePrefixes ?? defaultDerivePrefixes;
+	}
+	authorizeClaim(ctx) {
+		if (this._derive(ctx).includes(ctx.requestedPrefix)) return { ok: true };
+		return {
+			ok: false,
+			reason: `not authorized to claim '${ctx.requestedPrefix}'`
+		};
+	}
+};
+function defaultDerivePrefixes(ctx) {
+	const provenance = ctx.transport.provenance;
+	if (!provenance) return [];
+	const prefix = provenance.identityKey;
+	if (prefix === ROOT_SERVICE_ID || !isValidServiceId(prefix)) return [];
+	return [prefix];
+}
+//#endregion
+//#region src/hub/server/sqliteIdentityKeystore.ts
+let _DatabaseSync;
+function _getDatabaseSync() {
+	if (_DatabaseSync === void 0) _DatabaseSync = createRequire(import.meta.url)("node:sqlite").DatabaseSync;
+	return _DatabaseSync;
+}
+const _codec = {
+	encode: (_slotId, plaintext) => plaintext,
+	decode: (_slotId, stored) => stored
+};
+const _SCHEMA = `
+CREATE TABLE IF NOT EXISTS identity_slots (
+    slot_id             TEXT PRIMARY KEY,
+    ed25519_priv        TEXT,
+    ed25519_pub         TEXT,
+    x25519_priv         TEXT,
+    x25519_pub          TEXT,
+    identity_created_at INTEGER,
+    files_dir           TEXT,
+    snooze_scope        TEXT,
+    snooze_expires_at   INTEGER,
+    created_at          INTEGER NOT NULL
+);
+CREATE TABLE IF NOT EXISTS identity_storage (
+    slot_id TEXT NOT NULL,
+    key     TEXT NOT NULL,
+    value   TEXT NOT NULL,
+    PRIMARY KEY (slot_id, key)
+);
+CREATE TABLE IF NOT EXISTS identity_keys (
+    slot_id  TEXT NOT NULL,
+    key_json TEXT NOT NULL,
+    PRIMARY KEY (slot_id, key_json)
+);
+`;
+/** Open (creating if needed) a SQLite-backed {@link IdentityKeystore}. */
+function createSqliteIdentityKeystore(opts) {
+	const db = opts.db ?? new (_getDatabaseSync())(_requireDbPath(opts));
+	db.exec(_SCHEMA);
+	return new _SqliteKeystore(db);
+}
+function _requireDbPath(opts) {
+	if (opts.dbPath === void 0) throw new Error("createSqliteIdentityKeystore: pass either `dbPath` or `db`");
+	return opts.dbPath;
+}
+/** Prepared statements shared by every slot handle on one connection. */
+var _Stmts = class {
+	selIdentity;
+	upsertIdentity;
+	ensureSlot;
+	slotExists;
+	setFilesDir;
+	getFilesDir;
+	setSnooze;
+	getSnooze;
+	clearSnooze;
+	listKeys;
+	hasKey;
+	addKey;
+	delKey;
+	storGet;
+	storSet;
+	storDel;
+	storKeys;
+	storCount;
+	delSlot;
+	delStorage;
+	delKeys;
+	constructor(db) {
+		this.selIdentity = db.prepare(`SELECT ed25519_priv, ed25519_pub, x25519_priv, x25519_pub
+             FROM identity_slots WHERE slot_id = ?`);
+		this.upsertIdentity = db.prepare(`INSERT INTO identity_slots
+                (slot_id, ed25519_priv, ed25519_pub, x25519_priv, x25519_pub,
+                 identity_created_at, created_at)
+             VALUES (?, ?, ?, ?, ?, ?, ?)
+             ON CONFLICT(slot_id) DO UPDATE SET
+                ed25519_priv = excluded.ed25519_priv,
+                ed25519_pub  = excluded.ed25519_pub,
+                x25519_priv  = excluded.x25519_priv,
+                x25519_pub   = excluded.x25519_pub,
+                identity_created_at = excluded.identity_created_at`);
+		this.ensureSlot = db.prepare(`INSERT OR IGNORE INTO identity_slots (slot_id, created_at) VALUES (?, ?)`);
+		this.slotExists = db.prepare(`SELECT 1 FROM identity_slots WHERE slot_id = ?`);
+		this.setFilesDir = db.prepare(`UPDATE identity_slots SET files_dir = ? WHERE slot_id = ?`);
+		this.getFilesDir = db.prepare(`SELECT files_dir FROM identity_slots WHERE slot_id = ?`);
+		this.setSnooze = db.prepare(`UPDATE identity_slots SET snooze_scope = ?, snooze_expires_at = ? WHERE slot_id = ?`);
+		this.getSnooze = db.prepare(`SELECT snooze_scope, snooze_expires_at FROM identity_slots WHERE slot_id = ?`);
+		this.clearSnooze = db.prepare(`UPDATE identity_slots SET snooze_scope = NULL, snooze_expires_at = NULL WHERE slot_id = ?`);
+		this.listKeys = db.prepare(`SELECT key_json FROM identity_keys WHERE slot_id = ?`);
+		this.hasKey = db.prepare(`SELECT 1 FROM identity_keys WHERE slot_id = ? AND key_json = ?`);
+		this.addKey = db.prepare(`INSERT OR IGNORE INTO identity_keys (slot_id, key_json) VALUES (?, ?)`);
+		this.delKey = db.prepare(`DELETE FROM identity_keys WHERE slot_id = ? AND key_json = ?`);
+		this.storGet = db.prepare(`SELECT value FROM identity_storage WHERE slot_id = ? AND key = ?`);
+		this.storSet = db.prepare(`INSERT OR REPLACE INTO identity_storage (slot_id, key, value) VALUES (?, ?, ?)`);
+		this.storDel = db.prepare(`DELETE FROM identity_storage WHERE slot_id = ? AND key = ?`);
+		this.storKeys = db.prepare(`SELECT key FROM identity_storage WHERE slot_id = ?`);
+		this.storCount = db.prepare(`SELECT COUNT(*) AS n FROM identity_storage WHERE slot_id = ?`);
+		this.delSlot = db.prepare(`DELETE FROM identity_slots WHERE slot_id = ?`);
+		this.delStorage = db.prepare(`DELETE FROM identity_storage WHERE slot_id = ?`);
+		this.delKeys = db.prepare(`DELETE FROM identity_keys WHERE slot_id = ?`);
+	}
+};
+var _SqliteKeystore = class {
+	_stmts;
+	_slots = /* @__PURE__ */ new Map();
+	constructor(db) {
+		this._stmts = new _Stmts(db);
+	}
+	slotById(id) {
+		return this._slot(id);
+	}
+	_slot(id) {
+		let existing = this._slots.get(id);
+		if (existing === void 0) {
+			existing = new _SqliteSlot(id, this._stmts);
+			this._slots.set(id, existing);
+		}
+		return existing;
+	}
+	async slotByIdAndKey(id, key) {
+		const slot = this._slot(id);
+		if (!await slot._exists()) return { error: "slotDoesNotExist" };
+		if (!await slot.hasKey(key)) return { error: "unknownKey" };
+		return slot;
+	}
+	async slotByIdAndTime(id, nowMs) {
+		const slot = this._slot(id);
+		if (!await slot.hasState()) return slot;
+		const snooze = await slot.getSnooze();
+		if (snooze !== void 0 && snooze.expiresAt > nowMs) return slot;
+		return { error: "consentRequired" };
+	}
+	async createSlotWithKey(id, key) {
+		const slot = this.slotById(id);
+		await slot.addKeys(key);
+		return slot;
+	}
+};
+var _SqliteSlot = class {
+	id;
+	_s;
+	_storage;
+	constructor(id, _s) {
+		this.id = id;
+		this._s = _s;
+		this._storage = new _SqliteSlotStorage(id, _s);
+	}
+	get storage() {
+		return this._storage;
+	}
+	async getOrCreateIdentity() {
+		const existing = await this.peekIdentity();
+		if (existing) return existing;
+		const ed = await crypto.generateKeypair();
+		const wrap = await crypto.generateX25519Keypair();
+		this._writeIdentity(ed, wrap);
+		return new InMemoryManagedIdentity(ed, wrap);
+	}
+	async importIdentity(ed, wrap) {
+		const existing = await this.peekIdentity();
+		if (existing) return existing;
+		this._writeIdentity(ed, wrap);
+		return new InMemoryManagedIdentity(ed, wrap);
+	}
+	async peekIdentity() {
+		const row = this._s.selIdentity.get(this.id);
+		if (row === void 0 || row.ed25519_priv === null || row.ed25519_pub === null || row.x25519_priv === null || row.x25519_pub === null) return;
+		const ed = {
+			privateKey: base64UrlToBytes(_codec.decode(this.id, row.ed25519_priv)),
+			publicKey: base64UrlToBytes(row.ed25519_pub)
+		};
+		const wrap = {
+			privateKey: base64UrlToBytes(_codec.decode(this.id, row.x25519_priv)),
+			publicKey: base64UrlToBytes(row.x25519_pub)
+		};
+		return new InMemoryManagedIdentity(ed, wrap);
+	}
+	_writeIdentity(ed, wrap) {
+		this._s.upsertIdentity.run(this.id, _codec.encode(this.id, bytesToBase64Url(ed.privateKey)), bytesToBase64Url(ed.publicKey), _codec.encode(this.id, bytesToBase64Url(wrap.privateKey)), bytesToBase64Url(wrap.publicKey), Date.now(), Date.now());
+	}
+	async listKeys() {
+		return this._s.listKeys.all(this.id).map((r) => _fromCanonicalKey(r.key_json));
+	}
+	async hasKey(key) {
+		return this._s.hasKey.get(this.id, _canonicalKey$1(key)) !== void 0;
+	}
+	async addKeys(...keys) {
+		if (keys.length === 0) return;
+		this._ensureRow();
+		for (const key of keys) this._s.addKey.run(this.id, _canonicalKey$1(key));
+	}
+	async deleteKey(key) {
+		return this._s.delKey.run(this.id, _canonicalKey$1(key)).changes > 0;
+	}
+	/** Internal: has this slot ever been created? */
+	async _exists() {
+		return this._s.slotExists.get(this.id) !== void 0;
+	}
+	async getSnooze() {
+		const row = this._s.getSnooze.get(this.id);
+		if (row === void 0 || row.snooze_scope === null || row.snooze_expires_at === null) return;
+		if (Date.now() >= row.snooze_expires_at) return void 0;
+		return {
+			scope: row.snooze_scope,
+			expiresAt: row.snooze_expires_at
+		};
+	}
+	async setSnooze(snooze) {
+		this._ensureRow();
+		this._s.setSnooze.run(snooze.scope, snooze.expiresAt, this.id);
+	}
+	async clearSnooze() {
+		this._s.clearSnooze.run(this.id);
+	}
+	async getFilesDir() {
+		const row = this._s.getFilesDir.get(this.id);
+		if (row === void 0 || row.files_dir === null) return void 0;
+		return row.files_dir;
+	}
+	async setFilesDir(absPath) {
+		this._ensureRow();
+		this._s.setFilesDir.run(absPath, this.id);
+	}
+	async hasFiles() {
+		const dir = await this.getFilesDir();
+		if (dir === void 0) return false;
+		try {
+			return (await fs.readdir(dir)).length > 0;
+		} catch (e) {
+			if (e.code === "ENOENT") return false;
+			throw e;
+		}
+	}
+	async wipeFiles() {
+		const dir = await this.getFilesDir();
+		if (dir === void 0) return;
+		let entries;
+		try {
+			entries = await fs.readdir(dir);
+		} catch (e) {
+			if (e.code === "ENOENT") return;
+			throw e;
+		}
+		await Promise.all(entries.map((name) => fs.rm(path.join(dir, name), {
+			recursive: true,
+			force: true
+		})));
+	}
+	async hasState() {
+		if (await this.peekIdentity()) return true;
+		const { n } = this._s.storCount.get(this.id);
+		if (n > 0) return true;
+		return this.hasFiles();
+	}
+	async delete() {
+		const filesDir = await this.getFilesDir().catch(() => void 0);
+		if (filesDir !== void 0) await fs.rm(filesDir, {
+			recursive: true,
+			force: true
+		});
+		this._s.delStorage.run(this.id);
+		this._s.delKeys.run(this.id);
+		this._s.delSlot.run(this.id);
+	}
+	_ensureRow() {
+		this._s.ensureSlot.run(this.id, Date.now());
+	}
+};
+/** Per-slot KV backing `identity.storage::*`, one row per key in `identity_storage`. */
+var _SqliteSlotStorage = class {
+	_slotId;
+	_s;
+	constructor(_slotId, _s) {
+		this._slotId = _slotId;
+		this._s = _s;
+	}
+	async get(key) {
+		const row = this._s.storGet.get(this._slotId, key);
+		if (row === void 0) return void 0;
+		return JSON.parse(_codec.decode(this._slotId, row.value));
+	}
+	async set(key, value) {
+		this._s.ensureSlot.run(this._slotId, Date.now());
+		this._s.storSet.run(this._slotId, key, _codec.encode(this._slotId, JSON.stringify(value)));
+	}
+	async delete(key) {
+		return this._s.storDel.run(this._slotId, key).changes > 0;
+	}
+	async list(prefix) {
+		const keys = this._s.storKeys.all(this._slotId).map((r) => r.key);
+		return prefix === void 0 ? keys : keys.filter((k) => k.startsWith(prefix));
+	}
+};
+/** Canonical (sorted-field) JSON for exact access-key equality. */
+function _canonicalKey$1(key) {
+	const entries = Object.keys(key).sort().map((k) => [k, key[k]]);
+	return JSON.stringify(entries);
+}
+/** Rebuild an access key from its canonical (sorted `[key, value]` pairs) JSON. */
+function _fromCanonicalKey(canonical) {
+	const entries = JSON.parse(canonical);
+	return Object.fromEntries(entries);
+}
+//#endregion
+//#region src/hub/server/identityKeystore.ts
+const _FILE_SCHEMA_VERSION = 1;
+const _DOMAIN = "hubrpc.identity.keystore.v1";
+const _STORAGE_DOMAIN = "hubrpc.identity.storage.v1";
+const _KEYS_DOMAIN = "hubrpc.identity.keys.v1";
+const _SNOOZE_DOMAIN = "hubrpc.identity.snooze.v1";
+const _FILESDIR_DOMAIN = "hubrpc.identity.filesdir.v1";
+function createIdentityKeystore(opts) {
+	if (opts.keystoreSecret.length < 32) throw new Error("createIdentityKeystore: keystoreSecret must be at least 32 bytes");
+	return new _IdentityKeystoreImpl(opts);
+}
+var _IdentityKeystoreImpl = class {
+	_slots = /* @__PURE__ */ new Map();
+	_opts;
+	_dirReady = false;
+	constructor(opts) {
+		this._opts = opts;
+	}
+	slotById(id) {
+		return this._slot(id);
+	}
+	async slotByIdAndKey(id, key) {
+		const slot = this._slot(id);
+		if (!await slot._exists()) return { error: "slotDoesNotExist" };
+		if (!await slot.hasKey(key)) return { error: "unknownKey" };
+		return slot;
+	}
+	async slotByIdAndTime(id, nowMs) {
+		const slot = this._slot(id);
+		if (!await slot.hasState()) return slot;
+		const snooze = await slot.getSnooze();
+		if (snooze !== void 0 && snooze.expiresAt > nowMs) return slot;
+		return { error: "consentRequired" };
+	}
+	async createSlotWithKey(id, key) {
+		const slot = this._slot(id);
+		await slot.addKeys(key);
+		return slot;
+	}
+	_slot(id) {
+		let existing = this._slots.get(id);
+		if (existing) return existing;
+		const hash = createHash("sha256").update(id).digest("hex").slice(0, 16);
+		existing = new _IdentitySlotImpl({
+			id,
+			identityFile: path.join(this._opts.storageDir, `${hash}.bin`),
+			storageFile: path.join(this._opts.storageDir, `${hash}.storage.bin`),
+			keysFile: path.join(this._opts.storageDir, `${hash}.keys.bin`),
+			snoozeFile: path.join(this._opts.storageDir, `${hash}.snooze.bin`),
+			filesDirFile: path.join(this._opts.storageDir, `${hash}.filesdir.bin`),
+			keystoreSecret: this._opts.keystoreSecret,
+			ensureDir: () => this._ensureDir()
+		});
+		this._slots.set(id, existing);
+		return existing;
+	}
+	async _ensureDir() {
+		if (this._dirReady) return;
+		await fs.mkdir(this._opts.storageDir, {
+			recursive: true,
+			mode: 448
+		});
+		this._dirReady = true;
+	}
+};
+var _IdentitySlotImpl = class {
+	_deps;
+	_identity;
+	_identityLoaded = false;
+	_storage;
+	_keys;
+	_keysFileExists = false;
+	_keysLoaded = false;
+	_keysWriteChain = Promise.resolve();
+	constructor(_deps) {
+		this._deps = _deps;
+		this._storage = new _FileBackedStorage({
+			slot: _deps.id,
+			file: _deps.storageFile,
+			keystoreSecret: _deps.keystoreSecret,
+			ensureDir: _deps.ensureDir
+		});
+	}
+	get id() {
+		return this._deps.id;
+	}
+	get storage() {
+		return this._storage;
+	}
+	async getOrCreateIdentity() {
+		const existing = await this.peekIdentity();
+		if (existing) return existing;
+		const ed = await crypto.generateKeypair();
+		const wrap = await crypto.generateX25519Keypair();
+		await this._writeIdentity(ed, wrap);
+		const identity = new InMemoryManagedIdentity(ed, wrap);
+		this._identity = identity;
+		this._identityLoaded = true;
+		return identity;
+	}
+	async peekIdentity() {
+		if (this._identityLoaded) return this._identity;
+		let raw;
+		try {
+			raw = await fs.readFile(this._deps.identityFile);
+		} catch (e) {
+			if (e.code === "ENOENT") {
+				this._identityLoaded = true;
+				this._identity = void 0;
+				return;
+			}
+			throw e;
+		}
+		const plain = await this._decryptIdentityPayload(raw);
+		const ed = {
+			privateKey: base64UrlToBytes(plain.ed25519.privateKey),
+			publicKey: base64UrlToBytes(plain.ed25519.publicKey)
+		};
+		const wrap = {
+			privateKey: base64UrlToBytes(plain.x25519.privateKey),
+			publicKey: base64UrlToBytes(plain.x25519.publicKey)
+		};
+		const identity = new InMemoryManagedIdentity(ed, wrap);
+		this._identity = identity;
+		this._identityLoaded = true;
+		return identity;
+	}
+	async hasState() {
+		if (await this.peekIdentity()) return true;
+		if ((await this._storage.list()).length > 0) return true;
+		return this.hasFiles();
+	}
+	async listKeys() {
+		return (await this._loadKeys()).map((k) => ({ ...k }));
+	}
+	async hasKey(key) {
+		const keys = await this._loadKeys();
+		const canon = _canonicalKey(key);
+		return keys.some((k) => _canonicalKey(k) === canon);
+	}
+	async addKeys(...keys) {
+		if (keys.length === 0) return;
+		await this._mutateKeys((current) => {
+			const seen = new Set(current.map((k) => _canonicalKey(k)));
+			for (const key of keys) {
+				const canon = _canonicalKey(key);
+				if (!seen.has(canon)) {
+					seen.add(canon);
+					current.push({ ...key });
+				}
+			}
+		});
+	}
+	async deleteKey(key) {
+		const canon = _canonicalKey(key);
+		let existed = false;
+		await this._mutateKeys((current) => {
+			const idx = current.findIndex((k) => _canonicalKey(k) === canon);
+			if (idx >= 0) {
+				existed = true;
+				current.splice(idx, 1);
+			}
+		});
+		return existed;
+	}
+	/** Internal: does this slot exist (i.e. has it ever been created)? */
+	async _exists() {
+		await this._loadKeys();
+		return this._keysFileExists;
+	}
+	async getSnooze() {
+		let raw;
+		try {
+			raw = await fs.readFile(this._deps.snoozeFile);
+		} catch (e) {
+			if (e.code === "ENOENT") return void 0;
+			throw e;
+		}
+		const obj = await _aesDecrypt(this._deps.keystoreSecret, _SNOOZE_DOMAIN, this._deps.id, raw);
+		if (obj.schemaVersion !== _FILE_SCHEMA_VERSION) throw new Error(`identity snooze: unsupported schemaVersion ${obj.schemaVersion}`);
+		if (obj.slot !== this._deps.id) throw new Error("identity snooze: slot mismatch");
+		if (Date.now() >= obj.expiresAt) return void 0;
+		return {
+			scope: obj.scope,
+			expiresAt: obj.expiresAt
+		};
+	}
+	async setSnooze(snooze) {
+		await this._deps.ensureDir();
+		const payload = {
+			schemaVersion: _FILE_SCHEMA_VERSION,
+			slot: this._deps.id,
+			scope: snooze.scope,
+			expiresAt: snooze.expiresAt
+		};
+		const ct = await _aesEncrypt(this._deps.keystoreSecret, _SNOOZE_DOMAIN, this._deps.id, payload);
+		await fs.writeFile(this._deps.snoozeFile, ct, { mode: 384 });
+	}
+	async clearSnooze() {
+		await _safeUnlink(this._deps.snoozeFile);
+	}
+	async getFilesDir() {
+		let raw;
+		try {
+			raw = await fs.readFile(this._deps.filesDirFile);
+		} catch (e) {
+			if (e.code === "ENOENT") return void 0;
+			throw e;
+		}
+		const obj = await _aesDecrypt(this._deps.keystoreSecret, _FILESDIR_DOMAIN, this._deps.id, raw);
+		if (obj.schemaVersion !== _FILE_SCHEMA_VERSION) throw new Error(`identity filesdir: unsupported schemaVersion ${obj.schemaVersion}`);
+		if (obj.slot !== this._deps.id) throw new Error("identity filesdir: slot mismatch");
+		return obj.dir;
+	}
+	async setFilesDir(absPath) {
+		await this._deps.ensureDir();
+		const payload = {
+			schemaVersion: _FILE_SCHEMA_VERSION,
+			slot: this._deps.id,
+			dir: absPath,
+			updatedAt: Date.now()
+		};
+		const ct = await _aesEncrypt(this._deps.keystoreSecret, _FILESDIR_DOMAIN, this._deps.id, payload);
+		await fs.writeFile(this._deps.filesDirFile, ct, { mode: 384 });
+	}
+	async hasFiles() {
+		const dir = await this.getFilesDir();
+		if (dir === void 0) return false;
+		try {
+			return (await fs.readdir(dir)).length > 0;
+		} catch (e) {
+			if (e.code === "ENOENT") return false;
+			throw e;
+		}
+	}
+	async wipeFiles() {
+		const dir = await this.getFilesDir();
+		if (dir === void 0) return;
+		let entries;
+		try {
+			entries = await fs.readdir(dir);
+		} catch (e) {
+			if (e.code === "ENOENT") return;
+			throw e;
+		}
+		await Promise.all(entries.map((name) => fs.rm(path.join(dir, name), {
+			recursive: true,
+			force: true
+		})));
+	}
+	async delete() {
+		this._identity = void 0;
+		this._identityLoaded = false;
+		this._keys = void 0;
+		this._keysLoaded = false;
+		this._keysFileExists = false;
+		this._storage._invalidate();
+		const filesDir = await this.getFilesDir().catch(() => void 0);
+		if (filesDir !== void 0) await fs.rm(filesDir, {
+			recursive: true,
+			force: true
+		});
+		await _safeUnlink(this._deps.identityFile);
+		await _safeUnlink(this._deps.storageFile);
+		await _safeUnlink(this._deps.keysFile);
+		await _safeUnlink(this._deps.snoozeFile);
+		await _safeUnlink(this._deps.filesDirFile);
+	}
+	async _writeIdentity(ed, wrap) {
+		await this._deps.ensureDir();
+		const payload = {
+			schemaVersion: _FILE_SCHEMA_VERSION,
+			slot: this._deps.id,
+			ed25519: {
+				privateKey: bytesToBase64Url(ed.privateKey),
+				publicKey: bytesToBase64Url(ed.publicKey)
+			},
+			x25519: {
+				privateKey: bytesToBase64Url(wrap.privateKey),
+				publicKey: bytesToBase64Url(wrap.publicKey)
+			},
+			createdAt: Date.now()
+		};
+		const ct = await _aesEncrypt(this._deps.keystoreSecret, _DOMAIN, this._deps.id, payload);
+		await fs.writeFile(this._deps.identityFile, ct, { mode: 384 });
+	}
+	async _decryptIdentityPayload(raw) {
+		const obj = await _aesDecrypt(this._deps.keystoreSecret, _DOMAIN, this._deps.id, raw);
+		if (obj.schemaVersion !== _FILE_SCHEMA_VERSION) throw new Error(`identity keystore: unsupported schemaVersion ${obj.schemaVersion}`);
+		if (obj.slot !== this._deps.id) throw new Error("identity keystore: slot mismatch");
+		return obj;
+	}
+	async _loadKeys() {
+		if (this._keysLoaded) return this._keys;
+		let raw;
+		try {
+			raw = await fs.readFile(this._deps.keysFile);
+		} catch (e) {
+			if (e.code === "ENOENT") {
+				this._keys = [];
+				this._keysFileExists = false;
+				this._keysLoaded = true;
+				return this._keys;
+			}
+			throw e;
+		}
+		const obj = await _aesDecrypt(this._deps.keystoreSecret, _KEYS_DOMAIN, this._deps.id, raw);
+		if (obj.schemaVersion !== _FILE_SCHEMA_VERSION) throw new Error(`identity keys: unsupported schemaVersion ${obj.schemaVersion}`);
+		if (obj.slot !== this._deps.id) throw new Error("identity keys: slot mismatch");
+		this._keys = obj.keys.map((k) => ({ ...k }));
+		this._keysFileExists = true;
+		this._keysLoaded = true;
+		return this._keys;
+	}
+	async _mutateKeys(fn) {
+		const next = this._keysWriteChain.then(async () => {
+			const keys = await this._loadKeys();
+			fn(keys);
+			await this._persistKeys(keys);
+		});
+		this._keysWriteChain = next.catch(() => {});
+		return next;
+	}
+	async _persistKeys(keys) {
+		await this._deps.ensureDir();
+		const payload = {
+			schemaVersion: _FILE_SCHEMA_VERSION,
+			slot: this._deps.id,
+			keys: keys.map((k) => ({ ...k })),
+			updatedAt: Date.now()
+		};
+		const ct = await _aesEncrypt(this._deps.keystoreSecret, _KEYS_DOMAIN, this._deps.id, payload);
+		await fs.writeFile(this._deps.keysFile, ct, { mode: 384 });
+		this._keysFileExists = true;
+	}
+};
+/** Canonical (sorted-field) JSON for exact access-key equality. */
+function _canonicalKey(key) {
+	const entries = Object.keys(key).sort().map((k) => [k, key[k]]);
+	return JSON.stringify(entries);
+}
+/**
+* File-backed per-slot storage. Lazily reads the encrypted file on first
+* access and caches the decrypted map in memory. Writes serialize
+* through `_writeChain` so concurrent `set`/`delete` calls don't
+* overwrite each other.
+*/
+var _FileBackedStorage = class {
+	_opts;
+	_data;
+	_loaded = false;
+	_writeChain = Promise.resolve();
+	constructor(_opts) {
+		this._opts = _opts;
+	}
+	/**
+	* Drop the cached map (called by the slot's `delete()` so the next
+	* `get` re-reads from disk, where the file is now gone).
+	*/
+	_invalidate() {
+		this._data = void 0;
+		this._loaded = false;
+	}
+	async get(key) {
+		const data = await this._load();
+		return Object.prototype.hasOwnProperty.call(data, key) ? data[key] : void 0;
+	}
+	async set(key, value) {
+		await this._mutate((data) => {
+			data[key] = value;
+		});
+	}
+	async delete(key) {
+		let existed = false;
+		await this._mutate((data) => {
+			existed = Object.prototype.hasOwnProperty.call(data, key);
+			if (existed) delete data[key];
+		});
+		return existed;
+	}
+	async list(prefix) {
+		const data = await this._load();
+		const keys = Object.keys(data);
+		return prefix === void 0 ? keys : keys.filter((k) => k.startsWith(prefix));
+	}
+	async _load() {
+		if (this._loaded) return this._data;
+		let raw;
+		try {
+			raw = await fs.readFile(this._opts.file);
+		} catch (e) {
+			if (e.code === "ENOENT") {
+				this._data = {};
+				this._loaded = true;
+				return this._data;
+			}
+			throw e;
+		}
+		const obj = await _aesDecrypt(this._opts.keystoreSecret, _STORAGE_DOMAIN, this._opts.slot, raw);
+		if (obj.schemaVersion !== _FILE_SCHEMA_VERSION) throw new Error(`identity storage: unsupported schemaVersion ${obj.schemaVersion}`);
+		if (obj.slot !== this._opts.slot) throw new Error("identity storage: slot mismatch");
+		this._data = { ...obj.entries };
+		this._loaded = true;
+		return this._data;
+	}
+	async _mutate(fn) {
+		const next = this._writeChain.then(async () => {
+			const data = await this._load();
+			fn(data);
+			await this._persist(data);
+		});
+		this._writeChain = next.catch(() => {});
+		return next;
+	}
+	async _persist(data) {
+		await this._opts.ensureDir();
+		const payload = {
+			schemaVersion: _FILE_SCHEMA_VERSION,
+			slot: this._opts.slot,
+			entries: data,
+			updatedAt: Date.now()
+		};
+		const ct = await _aesEncrypt(this._opts.keystoreSecret, _STORAGE_DOMAIN, this._opts.slot, payload);
+		await fs.writeFile(this._opts.file, ct, { mode: 384 });
+	}
+};
+async function _aesEncrypt(secret, domain, slot, payload) {
+	const pt = new TextEncoder().encode(JSON.stringify(payload));
+	const { createCipheriv, randomBytes } = await import("node:crypto");
+	const key = await _deriveKey(secret, domain);
+	const iv = randomBytes(12);
+	const cipher = createCipheriv("aes-256-gcm", key, iv);
+	cipher.setAAD(new TextEncoder().encode(`${domain}:${slot}`));
+	const enc = Buffer.concat([cipher.update(pt), cipher.final()]);
+	const tag = cipher.getAuthTag();
+	const out = new Uint8Array(28 + enc.length);
+	out.set(iv, 0);
+	out.set(tag, 12);
+	out.set(enc, 28);
+	return out;
+}
+async function _aesDecrypt(secret, domain, slot, raw) {
+	if (raw.length < 28) throw new Error(`${domain}: file too short`);
+	const iv = raw.subarray(0, 12);
+	const tag = raw.subarray(12, 28);
+	const ct = raw.subarray(28);
+	const { createDecipheriv } = await import("node:crypto");
+	const decipher = createDecipheriv("aes-256-gcm", await _deriveKey(secret, domain), iv);
+	decipher.setAAD(new TextEncoder().encode(`${domain}:${slot}`));
+	decipher.setAuthTag(tag);
+	const pt = Buffer.concat([decipher.update(ct), decipher.final()]);
+	return JSON.parse(pt.toString("utf8"));
+}
+async function _deriveKey(secret, domain) {
+	const { createHmac } = await import("node:crypto");
+	const prk = createHmac("sha256", Buffer.alloc(32)).update(secret).digest();
+	const info = Buffer.concat([Buffer.from(domain), Buffer.from([1])]);
+	return createHmac("sha256", prk).update(info).digest();
+}
+async function _safeUnlink(file) {
+	try {
+		await fs.unlink(file);
+	} catch (e) {
+		if (e.code !== "ENOENT") throw e;
+	}
+}
+//#endregion
+export { TokenIdentityStore as a, durationToExp as c, fetchFullDirectory as d, resolveAccessCandidates as f, withProvenance as i, mintCapability as l, hubRegisterServiceId as m, createSqliteIdentityKeystore as n, registerHubAccessService as o, RegisteredServiceId as p, PrincipalIdPrefixPolicy as r, CapabilityProposalIssuer as s, createIdentityKeystore as t, candidatesForSlot as u };
+
+//# sourceMappingURL=server-BAxchQhy.js.map