@iflow-mcp/jkheadley-instar 0.26.2

package/dist/threadline/ThreadlineBootstrap.js

@@ -0,0 +1,293 @@
+/**
+ * ThreadlineBootstrap — Auto-wires Threadline protocol into the agent server.
+ *
+ * Called during server boot to:
+ *   1. Persist identity keys (Ed25519) across restarts
+ *   2. Create HandshakeManager for crypto handshakes
+ *   3. Register MCP tools into Claude Code's ~/.claude.json
+ *   4. Announce agent presence for discovery
+ *   5. Start discovery heartbeat
+ *
+ * Design: The user never sees any of this. Threadline is ON when the agent boots.
+ * The agent IS the interface — users talk to their agent, the agent handles the rest.
+ *
+ * Part of Threadline Protocol integration (Principle #11: "I am the interface").
+ */
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { HandshakeManager } from './HandshakeManager.js';
+import { AgentDiscovery } from './AgentDiscovery.js';
+import { generateIdentityKeyPair } from './ThreadlineCrypto.js';
+import { ThreadlineClient } from './client/ThreadlineClient.js';
+import { InboundMessageGate } from './InboundMessageGate.js';
+import { AgentTrustManager } from './AgentTrustManager.js';
+// ── Constants ────────────────────────────────────────────────────────
+const IDENTITY_KEY_FILE = 'identity-keys.json';
+// ── Implementation ───────────────────────────────────────────────────
+/**
+ * Bootstrap the Threadline protocol stack.
+ *
+ * Creates the HandshakeManager, registers MCP tools, announces presence,
+ * and starts the discovery heartbeat. The ThreadlineRouter is created
+ * separately in server.ts because it depends on messaging infrastructure.
+ */
+export async function bootstrapThreadline(config) {
+    const threadlineDir = path.join(config.stateDir, 'threadline');
+    fs.mkdirSync(threadlineDir, { recursive: true });
+    // ── 1. Identity Keys (persist across restarts) ───────────────────
+    const identityKeys = loadOrCreateIdentityKeys(threadlineDir);
+    // ── 2. HandshakeManager ──────────────────────────────────────────
+    const handshakeManager = new HandshakeManager(config.stateDir, config.agentName);
+    // ── 3. Agent Discovery ───────────────────────────────────────────
+    const discovery = new AgentDiscovery({
+        stateDir: config.stateDir,
+        selfPath: config.projectDir,
+        selfName: config.agentName,
+        selfPort: config.port,
+    });
+    // Announce presence for other agents to find us
+    discovery.announcePresence({
+        capabilities: ['threadline', 'mcp'],
+        description: config.agentDescription ?? `${config.agentName} Instar agent`,
+        threadlineVersion: '1.0',
+        publicKey: identityKeys.publicKey.toString('hex'),
+        framework: 'instar',
+    });
+    // Start heartbeat for liveness detection
+    const stopHeartbeat = discovery.startPresenceHeartbeat();
+    // ── 4. Register MCP server into Claude Code config ───────────────
+    registerThreadlineMcp(config.projectDir, config.agentName, config.stateDir);
+    // ── 5. Cloud Relay Connection (opt-in) ─────────────────────────
+    const relayEnabled = config.relayEnabled === true
+        || process.env.THREADLINE_RELAY_ENABLED === 'true';
+    let relayClient;
+    let inboundGate;
+    let trustManager;
+    if (relayEnabled) {
+        const relayUrl = config.relayUrl
+            ?? process.env.THREADLINE_RELAY_URL
+            ?? 'wss://threadline-relay.fly.dev/v1/connect';
+        console.log(`Threadline: connecting to relay at ${relayUrl} (disable with THREADLINE_RELAY_ENABLED=false)`);
+        // Create trust manager for relay interactions
+        trustManager = new AgentTrustManager({ stateDir: config.stateDir });
+        // Create relay client
+        relayClient = new ThreadlineClient({
+            name: config.agentName,
+            relayUrl,
+            framework: config.framework ?? 'instar',
+            capabilities: config.capabilities ?? ['chat', 'threadline'],
+            visibility: config.visibility ?? 'public',
+            stateDir: config.stateDir,
+        });
+        // Create inbound message gate (imports ThreadlineRouter lazily if needed)
+        // For now, router is not available at bootstrap time — it's created in server.ts
+        // The gate will be wired to the router after server setup
+        inboundGate = new InboundMessageGate(trustManager, null, {
+            maxPayloadBytes: 64 * 1024,
+        });
+        // Route inbound relay messages through the gate
+        relayClient.on('message', async (msg) => {
+            if (!inboundGate)
+                return;
+            const decision = await inboundGate.evaluate(msg);
+            if (decision.action === 'pass' && decision.message) {
+                // Gate passed — emit for ThreadlineRouter to handle
+                relayClient.emit('gate-passed', decision);
+            }
+        });
+        // Handle unknown senders — decode payload directly (relay-authenticated, not E2E encrypted)
+        relayClient.on('unknown-sender', async (envelope) => {
+            if (!inboundGate || !envelope)
+                return;
+            // Attempt to decode the base64 payload as plaintext JSON
+            let textContent;
+            let msgType;
+            try {
+                const payloadStr = Buffer.from(envelope.payload, 'base64').toString('utf-8');
+                const parsed = JSON.parse(payloadStr);
+                if (typeof parsed === 'object' && parsed !== null && 'text' in parsed) {
+                    textContent = String(parsed.text);
+                    msgType = parsed.type;
+                }
+                else if (typeof parsed === 'string') {
+                    textContent = parsed;
+                }
+                else {
+                    textContent = JSON.stringify(parsed);
+                }
+            }
+            catch {
+                textContent = `[undecryptable relay message from ${String(envelope.from).slice(0, 16)}]`;
+            }
+            const received = {
+                from: String(envelope.from ?? 'unknown'),
+                fromName: String(envelope.from ?? 'unknown').slice(0, 8),
+                threadId: String(envelope.threadId ?? `relay-${Date.now()}`),
+                messageId: String(envelope.messageId ?? `msg-${Date.now()}`),
+                content: { content: textContent, type: msgType },
+                timestamp: String(envelope.timestamp ?? new Date().toISOString()),
+                envelope: envelope,
+            };
+            // Relay-authenticated unknown senders bypass the trust manager gate.
+            // The relay already verified their Ed25519 identity via challenge-response.
+            // We still run payload size checks but skip trust/rate checks.
+            const payloadSize = Buffer.byteLength(JSON.stringify(received.content), 'utf-8');
+            if (payloadSize > 64 * 1024) {
+                console.log(`Threadline: relay message from ${received.from.slice(0, 8)} blocked (payload too large: ${payloadSize})`);
+                return;
+            }
+            // Record the interaction for trust building
+            trustManager.recordMessageReceivedByFingerprint(received.from);
+            // Emit gate-passed with relay-authenticated trust level
+            relayClient.emit('gate-passed', {
+                action: 'pass',
+                reason: 'relay-authenticated',
+                trustLevel: 'verified',
+                fingerprint: received.from,
+                message: received,
+            });
+        });
+        // Log auto-discovery results
+        relayClient.on('auto-discovered', (info) => {
+            console.log(`Threadline: auto-discovered ${info.count} agent(s) on relay`);
+        });
+        try {
+            await relayClient.connect();
+            console.log(`Threadline: relay connected (fingerprint: ${relayClient.fingerprint})`);
+        }
+        catch (err) {
+            console.error(`Threadline: relay connection failed — ${err instanceof Error ? err.message : err}`);
+            console.log('Threadline: agent will operate in local-only mode');
+            relayClient = undefined;
+        }
+    }
+    return {
+        handshakeManager,
+        discovery,
+        identityKeys,
+        trustManager,
+        relayClient,
+        inboundGate,
+        shutdown: async () => {
+            stopHeartbeat();
+            if (relayClient) {
+                relayClient.disconnect();
+            }
+            if (inboundGate) {
+                inboundGate.shutdown();
+            }
+            if (trustManager) {
+                trustManager.flush();
+            }
+        },
+    };
+}
+// ── Identity Key Persistence ─────────────────────────────────────────
+function loadOrCreateIdentityKeys(threadlineDir) {
+    const keyFile = path.join(threadlineDir, IDENTITY_KEY_FILE);
+    if (fs.existsSync(keyFile)) {
+        try {
+            const data = JSON.parse(fs.readFileSync(keyFile, 'utf-8'));
+            if (data.publicKey && data.privateKey) {
+                return {
+                    publicKey: Buffer.from(data.publicKey, 'hex'),
+                    privateKey: Buffer.from(data.privateKey, 'hex'),
+                };
+            }
+        }
+        catch {
+            // Corrupted key file — regenerate
+        }
+    }
+    const keys = generateIdentityKeyPair();
+    // Persist atomically
+    const tmpFile = `${keyFile}.${process.pid}.tmp`;
+    fs.writeFileSync(tmpFile, JSON.stringify({
+        publicKey: keys.publicKey.toString('hex'),
+        privateKey: keys.privateKey.toString('hex'),
+        createdAt: new Date().toISOString(),
+    }, null, 2), { mode: 0o600 }); // Private key — restrictive permissions
+    fs.renameSync(tmpFile, keyFile);
+    return keys;
+}
+// ── MCP Registration ─────────────────────────────────────────────────
+/**
+ * Register the Threadline MCP server into Claude Code's config.
+ *
+ * Uses the same pattern as ensurePlaywrightMcp() — registers in both
+ * ~/.claude.json (local scope) and .mcp.json (project scope).
+ *
+ * The MCP server is a stdio process that Claude Code launches as a subprocess.
+ */
+function registerThreadlineMcp(projectDir, agentName, stateDir) {
+    const absDir = path.resolve(projectDir);
+    // The MCP server entry point — runs as a child process of Claude Code.
+    // Resolve the actual instar package location (handles both node_modules and npm-linked).
+    let mcpEntryPath = path.join(absDir, 'node_modules', 'instar', 'dist', 'threadline', 'mcp-stdio-entry.js');
+    if (!fs.existsSync(mcpEntryPath)) {
+        // Fall back to the running instar installation's dist directory.
+        // This handles npm-linked installs where node_modules/instar doesn't exist.
+        const thisFile = new URL(import.meta.url).pathname;
+        mcpEntryPath = path.join(path.dirname(thisFile), 'mcp-stdio-entry.js');
+    }
+    const mcpEntry = {
+        command: 'node',
+        args: [
+            mcpEntryPath,
+            '--state-dir', stateDir,
+            '--agent-name', agentName,
+        ],
+    };
+    // ── 1. Register in ~/.claude.json at local scope ──
+    const claudeJsonPath = path.join(os.homedir(), '.claude.json');
+    try {
+        let claudeJson = {};
+        if (fs.existsSync(claudeJsonPath)) {
+            claudeJson = JSON.parse(fs.readFileSync(claudeJsonPath, 'utf-8'));
+        }
+        if (!claudeJson.projects || typeof claudeJson.projects !== 'object') {
+            claudeJson.projects = {};
+        }
+        const projects = claudeJson.projects;
+        if (!projects[absDir]) {
+            projects[absDir] = {};
+        }
+        const projectEntry = projects[absDir];
+        if (!projectEntry.mcpServers || typeof projectEntry.mcpServers !== 'object') {
+            projectEntry.mcpServers = {};
+        }
+        const mcpServers = projectEntry.mcpServers;
+        // Register (or update) the Threadline MCP server
+        mcpServers.threadline = mcpEntry;
+        // Pre-accept trust
+        projectEntry.hasTrustDialogAccepted = true;
+        // Write atomically
+        const tmpPath = `${claudeJsonPath}.${process.pid}.tmp`;
+        fs.writeFileSync(tmpPath, JSON.stringify(claudeJson, null, 2));
+        fs.renameSync(tmpPath, claudeJsonPath);
+    }
+    catch {
+        // Non-fatal — .mcp.json fallback below
+    }
+    // ── 2. Also add to .mcp.json in the project root ──
+    const mcpJsonPath = path.join(projectDir, '.mcp.json');
+    try {
+        let mcpConfig = {};
+        if (fs.existsSync(mcpJsonPath)) {
+            mcpConfig = JSON.parse(fs.readFileSync(mcpJsonPath, 'utf-8'));
+        }
+        if (!mcpConfig.mcpServers || typeof mcpConfig.mcpServers !== 'object') {
+            mcpConfig.mcpServers = {};
+        }
+        const mcpServers = mcpConfig.mcpServers;
+        mcpServers.threadline = mcpEntry;
+        const tmpPath = `${mcpJsonPath}.${process.pid}.tmp`;
+        fs.writeFileSync(tmpPath, JSON.stringify(mcpConfig, null, 2));
+        fs.renameSync(tmpPath, mcpJsonPath);
+    }
+    catch {
+        // Non-fatal
+    }
+}
+//# sourceMappingURL=ThreadlineBootstrap.js.map

package/dist/threadline/ThreadlineBootstrap.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ThreadlineBootstrap.js","sourceRoot":"","sources":["../../src/threadline/ThreadlineBootstrap.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AACzD,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AACrD,OAAO,EAAE,uBAAuB,EAAE,MAAM,uBAAuB,CAAC;AAEhE,OAAO,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAC;AAEhE,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAC7D,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AA4C3D,wEAAwE;AAExE,MAAM,iBAAiB,GAAG,oBAAoB,CAAC;AAE/C,wEAAwE;AAExE;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,MAAiC;IAEjC,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC;IAC/D,EAAE,CAAC,SAAS,CAAC,aAAa,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAEjD,oEAAoE;IACpE,MAAM,YAAY,GAAG,wBAAwB,CAAC,aAAa,CAAC,CAAC;IAE7D,oEAAoE;IACpE,MAAM,gBAAgB,GAAG,IAAI,gBAAgB,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC;IAEjF,oEAAoE;IACpE,MAAM,SAAS,GAAG,IAAI,cAAc,CAAC;QACnC,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,QAAQ,EAAE,MAAM,CAAC,UAAU;QAC3B,QAAQ,EAAE,MAAM,CAAC,SAAS;QAC1B,QAAQ,EAAE,MAAM,CAAC,IAAI;KACtB,CAAC,CAAC;IAEH,gDAAgD;IAChD,SAAS,CAAC,gBAAgB,CAAC;QACzB,YAAY,EAAE,CAAC,YAAY,EAAE,KAAK,CAAC;QACnC,WAAW,EAAE,MAAM,CAAC,gBAAgB,IAAI,GAAG,MAAM,CAAC,SAAS,eAAe;QAC1E,iBAAiB,EAAE,KAAK;QACxB,SAAS,EAAE,YAAY,CAAC,SAAS,CAAC,QAAQ,CAAC,KAAK,CAAC;QACjD,SAAS,EAAE,QAAQ;KACpB,CAAC,CAAC;IAEH,yCAAyC;IACzC,MAAM,aAAa,GAAG,SAAS,CAAC,sBAAsB,EAAE,CAAC;IAEzD,oEAAoE;IACpE,qBAAqB,CAAC,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;IAE5E,kEAAkE;IAClE,MAAM,YAAY,GAAG,MAAM,CAAC,YAAY,KAAK,IAAI;WAC5C,OAAO,CAAC,GAAG,CAAC,wBAAwB,KAAK,MAAM,CAAC;IAErD,IAAI,WAAyC,CAAC;IAC9C,IAAI,WAA2C,CAAC;IAChD,IAAI,YAA2C,CAAC;IAEhD,IAAI,YAAY,EAAE,CAAC;QACjB,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ;eAC3B,OAAO,CAAC,GAAG,CAAC,oBAAoB;eAChC,2CAA2C,CAAC;QAEjD,OAAO,CAAC,GAAG,CAAC,sCAAsC,QAAQ,gDAAgD,CAAC,CAAC;QAE5G,8CAA8C;QAC9C,YAAY,GAAG,IAAI,iBAAiB,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC;QAEpE,sBAAsB;QACtB,WAAW,GAAG,IAAI,gBAAgB,CAAC;YACjC,IAAI,EAAE,MAAM,CAAC,SAAS;YACtB,QAAQ;YACR,SAAS,EAAE,MAAM,CAAC,SAAS,IAAI,QAAQ;YACvC,YAAY,EAAE,MAAM,CAAC,YAAY,IAAI,CAAC,MAAM,EAAE,YAAY,CAAC;YAC3D,UAAU,EAAE,MAAM,CAAC,UAAU,IAAI,QAAQ;YACzC,QAAQ,EAAE,MAAM,CAAC,QAAQ;SAC1B,CAAC,CAAC;QAEH,0EAA0E;QAC1E,iFAAiF;QACjF,0DAA0D;QAC1D,WAAW,GAAG,IAAI,kBAAkB,CAAC,YAAY,EAAE,IAAI,EAAE;YACvD,eAAe,EAAE,EAAE,GAAG,IAAI;SAC3B,CAAC,CAAC;QAEH,gDAAgD;QAChD,WAAW,CAAC,EAAE,CAAC,SAAS,EAAE,KAAK,EAAE,GAAoB,EAAE,EAAE;YACvD,IAAI,CAAC,WAAW;gBAAE,OAAO;YACzB,MAAM,QAAQ,GAAG,MAAM,WAAW,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;YACjD,IAAI,QAAQ,CAAC,MAAM,KAAK,MAAM,IAAI,QAAQ,CAAC,OAAO,EAAE,CAAC;gBACnD,oDAAoD;gBACpD,WAAY,CAAC,IAAI,CAAC,aAAa,EAAE,QAAQ,CAAC,CAAC;YAC7C,CAAC;QACH,CAAC,CAAC,CAAC;QAEH,4FAA4F;QAC5F,WAAW,CAAC,EAAE,CAAC,gBAAgB,EAAE,KAAK,EAAE,QAAiC,EAAE,EAAE;YAC3E,IAAI,CAAC,WAAW,IAAI,CAAC,QAAQ;gBAAE,OAAO;YAEtC,yDAAyD;YACzD,IAAI,WAAmB,CAAC;YACxB,IAAI,OAA2B,CAAC;YAChC,IAAI,CAAC;gBACH,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAiB,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;gBACvF,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;gBACtC,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,IAAI,MAAM,IAAI,MAAM,EAAE,CAAC;oBACtE,WAAW,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;oBAClC,OAAO,GAAG,MAAM,CAAC,IAA0B,CAAC;gBAC9C,CAAC;qBAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;oBACtC,WAAW,GAAG,MAAM,CAAC;gBACvB,CAAC;qBAAM,CAAC;oBACN,WAAW,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;gBACvC,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,WAAW,GAAG,qCAAqC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC;YAC3F,CAAC;YAED,MAAM,QAAQ,GAAoB;gBAChC,IAAI,EAAE,MAAM,CAAC,QAAQ,CAAC,IAAI,IAAI,SAAS,CAAC;gBACxC,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC,IAAI,IAAI,SAAS,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC;gBACxD,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC,QAAQ,IAAI,SAAS,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;gBAC5D,SAAS,EAAE,MAAM,CAAC,QAAQ,CAAC,SAAS,IAAI,OAAO,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;gBAC5D,OAAO,EAAE,EAAE,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,OAAO,EAAE;gBAChD,SAAS,EAAE,MAAM,CAAC,QAAQ,CAAC,SAAS,IAAI,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;gBACjE,QAAQ,EAAE,QAAiB;aAC5B,CAAC;YAEF,qEAAqE;YACrE,4EAA4E;YAC5E,+DAA+D;YAC/D,MAAM,WAAW,GAAG,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC,CAAC;YACjF,IAAI,WAAW,GAAG,EAAE,GAAG,IAAI,EAAE,CAAC;gBAC5B,OAAO,CAAC,GAAG,CAAC,kCAAkC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,gCAAgC,WAAW,GAAG,CAAC,CAAC;gBACvH,OAAO;YACT,CAAC;YAED,4CAA4C;YAC5C,YAAa,CAAC,kCAAkC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;YAEhE,wDAAwD;YACxD,WAAY,CAAC,IAAI,CAAC,aAAa,EAAE;gBAC/B,MAAM,EAAE,MAAe;gBACvB,MAAM,EAAE,qBAAqB;gBAC7B,UAAU,EAAE,UAAU;gBACtB,WAAW,EAAE,QAAQ,CAAC,IAAI;gBAC1B,OAAO,EAAE,QAAQ;aAClB,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QAEH,6BAA6B;QAC7B,WAAW,CAAC,EAAE,CAAC,iBAAiB,EAAE,CAAC,IAAuB,EAAE,EAAE;YAC5D,OAAO,CAAC,GAAG,CAAC,+BAA+B,IAAI,CAAC,KAAK,oBAAoB,CAAC,CAAC;QAC7E,CAAC,CAAC,CAAC;QAEH,IAAI,CAAC;YACH,MAAM,WAAW,CAAC,OAAO,EAAE,CAAC;YAC5B,OAAO,CAAC,GAAG,CAAC,6CAA6C,WAAW,CAAC,WAAW,GAAG,CAAC,CAAC;QACvF,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,KAAK,CAAC,yCAAyC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC;YACnG,OAAO,CAAC,GAAG,CAAC,mDAAmD,CAAC,CAAC;YACjE,WAAW,GAAG,SAAS,CAAC;QAC1B,CAAC;IACH,CAAC;IAED,OAAO;QACL,gBAAgB;QAChB,SAAS;QACT,YAAY;QACZ,YAAY;QACZ,WAAW;QACX,WAAW;QACX,QAAQ,EAAE,KAAK,IAAI,EAAE;YACnB,aAAa,EAAE,CAAC;YAChB,IAAI,WAAW,EAAE,CAAC;gBAChB,WAAW,CAAC,UAAU,EAAE,CAAC;YAC3B,CAAC;YACD,IAAI,WAAW,EAAE,CAAC;gBAChB,WAAW,CAAC,QAAQ,EAAE,CAAC;YACzB,CAAC;YACD,IAAI,YAAY,EAAE,CAAC;gBACjB,YAAY,CAAC,KAAK,EAAE,CAAC;YACvB,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC;AAED,wEAAwE;AAExE,SAAS,wBAAwB,CAAC,aAAqB;IACrD,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,iBAAiB,CAAC,CAAC;IAE5D,IAAI,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QAC3B,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;YAC3D,IAAI,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;gBACtC,OAAO;oBACL,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,CAAC;oBAC7C,UAAU,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,KAAK,CAAC;iBAChD,CAAC;YACJ,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,kCAAkC;QACpC,CAAC;IACH,CAAC;IAED,MAAM,IAAI,GAAG,uBAAuB,EAAE,CAAC;IAEvC,qBAAqB;IACrB,MAAM,OAAO,GAAG,GAAG,OAAO,IAAI,OAAO,CAAC,GAAG,MAAM,CAAC;IAChD,EAAE,CAAC,aAAa,CAAC,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC;QACvC,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,KAAK,CAAC;QACzC,UAAU,EAAE,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,KAAK,CAAC;QAC3C,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KACpC,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,wCAAwC;IACvE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAEhC,OAAO,IAAI,CAAC;AACd,CAAC;AAED,wEAAwE;AAExE;;;;;;;GAOG;AACH,SAAS,qBAAqB,CAAC,UAAkB,EAAE,SAAiB,EAAE,QAAgB;IACpF,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IAExC,uEAAuE;IACvE,yFAAyF;IACzF,IAAI,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,cAAc,EAAE,QAAQ,EAAE,MAAM,EAAE,YAAY,EAAE,oBAAoB,CAAC,CAAC;IAC3G,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;QACjC,iEAAiE;QACjE,4EAA4E;QAC5E,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC;QACnD,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,oBAAoB,CAAC,CAAC;IACzE,CAAC;IAED,MAAM,QAAQ,GAAG;QACf,OAAO,EAAE,MAAM;QACf,IAAI,EAAE;YACJ,YAAY;YACZ,aAAa,EAAE,QAAQ;YACvB,cAAc,EAAE,SAAS;SAC1B;KACF,CAAC;IAEF,qDAAqD;IACrD,MAAM,cAAc,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,cAAc,CAAC,CAAC;IAC/D,IAAI,CAAC;QACH,IAAI,UAAU,GAA4B,EAAE,CAAC;QAC7C,IAAI,EAAE,CAAC,UAAU,CAAC,cAAc,CAAC,EAAE,CAAC;YAClC,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,cAAc,EAAE,OAAO,CAAC,CAAC,CAAC;QACpE,CAAC;QAED,IAAI,CAAC,UAAU,CAAC,QAAQ,IAAI,OAAO,UAAU,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;YACpE,UAAU,CAAC,QAAQ,GAAG,EAAE,CAAC;QAC3B,CAAC;QACD,MAAM,QAAQ,GAAG,UAAU,CAAC,QAAmD,CAAC;QAEhF,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;YACtB,QAAQ,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC;QACxB,CAAC;QACD,MAAM,YAAY,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC;QAEtC,IAAI,CAAC,YAAY,CAAC,UAAU,IAAI,OAAO,YAAY,CAAC,UAAU,KAAK,QAAQ,EAAE,CAAC;YAC5E,YAAY,CAAC,UAAU,GAAG,EAAE,CAAC;QAC/B,CAAC;QACD,MAAM,UAAU,GAAG,YAAY,CAAC,UAAqC,CAAC;QAEtE,iDAAiD;QACjD,UAAU,CAAC,UAAU,GAAG,QAAQ,CAAC;QAEjC,mBAAmB;QACnB,YAAY,CAAC,sBAAsB,GAAG,IAAI,CAAC;QAE3C,mBAAmB;QACnB,MAAM,OAAO,GAAG,GAAG,cAAc,IAAI,OAAO,CAAC,GAAG,MAAM,CAAC;QACvD,EAAE,CAAC,aAAa,CAAC,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;QAC/D,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,cAAc,CAAC,CAAC;IACzC,CAAC;IAAC,MAAM,CAAC;QACP,uCAAuC;IACzC,CAAC;IAED,qDAAqD;IACrD,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC;IACvD,IAAI,CAAC;QACH,IAAI,SAAS,GAA4B,EAAE,CAAC;QAC5C,IAAI,EAAE,CAAC,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;YAC/B,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC,CAAC;QAChE,CAAC;QACD,IAAI,CAAC,SAAS,CAAC,UAAU,IAAI,OAAO,SAAS,CAAC,UAAU,KAAK,QAAQ,EAAE,CAAC;YACtE,SAAS,CAAC,UAAU,GAAG,EAAE,CAAC;QAC5B,CAAC;QACD,MAAM,UAAU,GAAG,SAAS,CAAC,UAAqC,CAAC;QACnE,UAAU,CAAC,UAAU,GAAG,QAAQ,CAAC;QAEjC,MAAM,OAAO,GAAG,GAAG,WAAW,IAAI,OAAO,CAAC,GAAG,MAAM,CAAC;QACpD,EAAE,CAAC,aAAa,CAAC,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;QAC9D,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;IACtC,CAAC;IAAC,MAAM,CAAC;QACP,YAAY;IACd,CAAC;AACH,CAAC"}

package/dist/threadline/ThreadlineCrypto.d.ts

@@ -0,0 +1,53 @@
+/**
+ * ThreadlineCrypto — Cryptographic utilities for the Threadline handshake.
+ *
+ * Implements Ed25519 identity keys, X25519 ephemeral key exchange,
+ * HKDF-SHA256 relay token derivation, and challenge-response signing.
+ *
+ * All operations use Node.js native `node:crypto` — no external libraries.
+ *
+ * Part of Threadline Protocol Phase 3.
+ */
+export interface KeyPair {
+    publicKey: Buffer;
+    privateKey: Buffer;
+}
+/**
+ * Generate an Ed25519 identity key pair for an agent.
+ * The identity key is long-lived — generated once and persisted.
+ */
+export declare function generateIdentityKeyPair(): KeyPair;
+/**
+ * Generate an ephemeral X25519 key pair for Diffie-Hellman exchange.
+ * Ephemeral keys are single-use per handshake.
+ */
+export declare function generateEphemeralKeyPair(): KeyPair;
+/**
+ * Ed25519 sign a message.
+ * Returns a 64-byte signature.
+ */
+export declare function sign(privateKeyRaw: Buffer, message: Buffer): Buffer;
+/**
+ * Ed25519 verify a signature.
+ */
+export declare function verify(publicKeyRaw: Buffer, message: Buffer, signature: Buffer): boolean;
+/**
+ * X25519 Diffie-Hellman key exchange.
+ * Returns a 32-byte shared secret.
+ */
+export declare function ecdh(privateKeyRaw: Buffer, publicKeyRaw: Buffer): Buffer;
+/**
+ * HKDF-SHA256 key derivation for relay tokens.
+ * Returns a 32-byte derived key.
+ */
+export declare function deriveRelayToken(sharedSecret: Buffer, salt: Buffer, info: string): Buffer;
+/**
+ * Compute a challenge response for the handshake.
+ *
+ * Signs: SHA256(nonce || identity_pub_A || identity_pub_B || eph_pub_A || eph_pub_B)
+ *
+ * This binds the challenge to both identities and both ephemeral keys,
+ * preventing relay and mismatch attacks.
+ */
+export declare function computeChallengeResponse(signingKey: Buffer, nonce: string, identityPubA: Buffer, identityPubB: Buffer, ephPubA: Buffer, ephPubB: Buffer): Buffer;
+//# sourceMappingURL=ThreadlineCrypto.d.ts.map

package/dist/threadline/ThreadlineCrypto.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ThreadlineCrypto.d.ts","sourceRoot":"","sources":["../../src/threadline/ThreadlineCrypto.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAMH,MAAM,WAAW,OAAO;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;CACpB;AAID;;;GAGG;AACH,wBAAgB,uBAAuB,IAAI,OAAO,CAMjD;AAED;;;GAGG;AACH,wBAAgB,wBAAwB,IAAI,OAAO,CAMlD;AAID;;;GAGG;AACH,wBAAgB,IAAI,CAAC,aAAa,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,CAWnE;AAED;;GAEG;AACH,wBAAgB,MAAM,CAAC,YAAY,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAWxF;AAID;;;GAGG;AACH,wBAAgB,IAAI,CAAC,aAAa,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,MAAM,CAuBxE;AAID;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,YAAY,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAEzF;AAID;;;;;;;GAOG;AACH,wBAAgB,wBAAwB,CACtC,UAAU,EAAE,MAAM,EAClB,KAAK,EAAE,MAAM,EACb,YAAY,EAAE,MAAM,EACpB,YAAY,EAAE,MAAM,EACpB,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,MAAM,GACd,MAAM,CASR"}

package/dist/threadline/ThreadlineCrypto.js

@@ -0,0 +1,123 @@
+/**
+ * ThreadlineCrypto — Cryptographic utilities for the Threadline handshake.
+ *
+ * Implements Ed25519 identity keys, X25519 ephemeral key exchange,
+ * HKDF-SHA256 relay token derivation, and challenge-response signing.
+ *
+ * All operations use Node.js native `node:crypto` — no external libraries.
+ *
+ * Part of Threadline Protocol Phase 3.
+ */
+import crypto from 'node:crypto';
+// ── Key Generation ───────────────────────────────────────────────────
+/**
+ * Generate an Ed25519 identity key pair for an agent.
+ * The identity key is long-lived — generated once and persisted.
+ */
+export function generateIdentityKeyPair() {
+    const { publicKey, privateKey } = crypto.generateKeyPairSync('ed25519');
+    return {
+        publicKey: publicKey.export({ type: 'spki', format: 'der' }).subarray(-32),
+        privateKey: privateKey.export({ type: 'pkcs8', format: 'der' }).subarray(-32),
+    };
+}
+/**
+ * Generate an ephemeral X25519 key pair for Diffie-Hellman exchange.
+ * Ephemeral keys are single-use per handshake.
+ */
+export function generateEphemeralKeyPair() {
+    const { publicKey, privateKey } = crypto.generateKeyPairSync('x25519');
+    return {
+        publicKey: publicKey.export({ type: 'spki', format: 'der' }).subarray(-32),
+        privateKey: privateKey.export({ type: 'pkcs8', format: 'der' }).subarray(-32),
+    };
+}
+// ── Signing & Verification ───────────────────────────────────────────
+/**
+ * Ed25519 sign a message.
+ * Returns a 64-byte signature.
+ */
+export function sign(privateKeyRaw, message) {
+    const privateKey = crypto.createPrivateKey({
+        key: Buffer.concat([
+            // Ed25519 PKCS#8 prefix (16 bytes) + 2 bytes (octet string tag + length)
+            Buffer.from('302e020100300506032b657004220420', 'hex'),
+            privateKeyRaw,
+        ]),
+        format: 'der',
+        type: 'pkcs8',
+    });
+    return Buffer.from(crypto.sign(null, message, privateKey));
+}
+/**
+ * Ed25519 verify a signature.
+ */
+export function verify(publicKeyRaw, message, signature) {
+    const publicKey = crypto.createPublicKey({
+        key: Buffer.concat([
+            // Ed25519 SPKI prefix (12 bytes)
+            Buffer.from('302a300506032b6570032100', 'hex'),
+            publicKeyRaw,
+        ]),
+        format: 'der',
+        type: 'spki',
+    });
+    return crypto.verify(null, message, publicKey, signature);
+}
+// ── Key Exchange ─────────────────────────────────────────────────────
+/**
+ * X25519 Diffie-Hellman key exchange.
+ * Returns a 32-byte shared secret.
+ */
+export function ecdh(privateKeyRaw, publicKeyRaw) {
+    const privateKey = crypto.createPrivateKey({
+        key: Buffer.concat([
+            // X25519 PKCS#8 prefix
+            Buffer.from('302e020100300506032b656e04220420', 'hex'),
+            privateKeyRaw,
+        ]),
+        format: 'der',
+        type: 'pkcs8',
+    });
+    const publicKey = crypto.createPublicKey({
+        key: Buffer.concat([
+            // X25519 SPKI prefix
+            Buffer.from('302a300506032b656e032100', 'hex'),
+            publicKeyRaw,
+        ]),
+        format: 'der',
+        type: 'spki',
+    });
+    return Buffer.from(crypto.diffieHellman({
+        privateKey,
+        publicKey,
+    }));
+}
+// ── Key Derivation ───────────────────────────────────────────────────
+/**
+ * HKDF-SHA256 key derivation for relay tokens.
+ * Returns a 32-byte derived key.
+ */
+export function deriveRelayToken(sharedSecret, salt, info) {
+    return Buffer.from(crypto.hkdfSync('sha256', sharedSecret, salt, info, 32));
+}
+// ── Challenge Response ───────────────────────────────────────────────
+/**
+ * Compute a challenge response for the handshake.
+ *
+ * Signs: SHA256(nonce || identity_pub_A || identity_pub_B || eph_pub_A || eph_pub_B)
+ *
+ * This binds the challenge to both identities and both ephemeral keys,
+ * preventing relay and mismatch attacks.
+ */
+export function computeChallengeResponse(signingKey, nonce, identityPubA, identityPubB, ephPubA, ephPubB) {
+    const hash = crypto.createHash('sha256');
+    hash.update(Buffer.from(nonce, 'utf-8'));
+    hash.update(identityPubA);
+    hash.update(identityPubB);
+    hash.update(ephPubA);
+    hash.update(ephPubB);
+    const digest = hash.digest();
+    return sign(signingKey, digest);
+}
+//# sourceMappingURL=ThreadlineCrypto.js.map

package/dist/threadline/ThreadlineCrypto.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ThreadlineCrypto.js","sourceRoot":"","sources":["../../src/threadline/ThreadlineCrypto.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,MAAM,MAAM,aAAa,CAAC;AASjC,wEAAwE;AAExE;;;GAGG;AACH,MAAM,UAAU,uBAAuB;IACrC,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,GAAG,MAAM,CAAC,mBAAmB,CAAC,SAAS,CAAC,CAAC;IACxE,OAAO;QACL,SAAS,EAAE,SAAS,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC;QAC1E,UAAU,EAAE,UAAU,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC;KAC9E,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,wBAAwB;IACtC,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,GAAG,MAAM,CAAC,mBAAmB,CAAC,QAAQ,CAAC,CAAC;IACvE,OAAO;QACL,SAAS,EAAE,SAAS,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC;QAC1E,UAAU,EAAE,UAAU,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC;KAC9E,CAAC;AACJ,CAAC;AAED,wEAAwE;AAExE;;;GAGG;AACH,MAAM,UAAU,IAAI,CAAC,aAAqB,EAAE,OAAe;IACzD,MAAM,UAAU,GAAG,MAAM,CAAC,gBAAgB,CAAC;QACzC,GAAG,EAAE,MAAM,CAAC,MAAM,CAAC;YACjB,yEAAyE;YACzE,MAAM,CAAC,IAAI,CAAC,kCAAkC,EAAE,KAAK,CAAC;YACtD,aAAa;SACd,CAAC;QACF,MAAM,EAAE,KAAK;QACb,IAAI,EAAE,OAAO;KACd,CAAC,CAAC;IACH,OAAO,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,UAAU,CAAC,CAAC,CAAC;AAC7D,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,MAAM,CAAC,YAAoB,EAAE,OAAe,EAAE,SAAiB;IAC7E,MAAM,SAAS,GAAG,MAAM,CAAC,eAAe,CAAC;QACvC,GAAG,EAAE,MAAM,CAAC,MAAM,CAAC;YACjB,iCAAiC;YACjC,MAAM,CAAC,IAAI,CAAC,0BAA0B,EAAE,KAAK,CAAC;YAC9C,YAAY;SACb,CAAC;QACF,MAAM,EAAE,KAAK;QACb,IAAI,EAAE,MAAM;KACb,CAAC,CAAC;IACH,OAAO,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC;AAC5D,CAAC;AAED,wEAAwE;AAExE;;;GAGG;AACH,MAAM,UAAU,IAAI,CAAC,aAAqB,EAAE,YAAoB;IAC9D,MAAM,UAAU,GAAG,MAAM,CAAC,gBAAgB,CAAC;QACzC,GAAG,EAAE,MAAM,CAAC,MAAM,CAAC;YACjB,uBAAuB;YACvB,MAAM,CAAC,IAAI,CAAC,kCAAkC,EAAE,KAAK,CAAC;YACtD,aAAa;SACd,CAAC;QACF,MAAM,EAAE,KAAK;QACb,IAAI,EAAE,OAAO;KACd,CAAC,CAAC;IACH,MAAM,SAAS,GAAG,MAAM,CAAC,eAAe,CAAC;QACvC,GAAG,EAAE,MAAM,CAAC,MAAM,CAAC;YACjB,qBAAqB;YACrB,MAAM,CAAC,IAAI,CAAC,0BAA0B,EAAE,KAAK,CAAC;YAC9C,YAAY;SACb,CAAC;QACF,MAAM,EAAE,KAAK;QACb,IAAI,EAAE,MAAM;KACb,CAAC,CAAC;IACH,OAAO,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC;QACtC,UAAU;QACV,SAAS;KACV,CAAC,CAAC,CAAC;AACN,CAAC;AAED,wEAAwE;AAExE;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAAC,YAAoB,EAAE,IAAY,EAAE,IAAY;IAC/E,OAAO,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,EAAE,YAAY,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC;AAC9E,CAAC;AAED,wEAAwE;AAExE;;;;;;;GAOG;AACH,MAAM,UAAU,wBAAwB,CACtC,UAAkB,EAClB,KAAa,EACb,YAAoB,EACpB,YAAoB,EACpB,OAAe,EACf,OAAe;IAEf,MAAM,IAAI,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;IACzC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC;IACzC,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;IAC1B,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;IAC1B,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACrB,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACrB,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;IAC7B,OAAO,IAAI,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;AAClC,CAAC"}

package/dist/threadline/ThreadlineEndpoints.d.ts

@@ -0,0 +1,35 @@
+/**
+ * ThreadlineEndpoints — HTTP route handlers for the Threadline protocol.
+ *
+ * Routes:
+ *   GET  /threadline/health              — Health check + version
+ *   POST /threadline/handshake/hello     — Initiate handshake (unauthenticated)
+ *   POST /threadline/handshake/confirm   — Complete handshake (unauthenticated)
+ *   POST /threadline/messages/receive    — Receive a message (authenticated)
+ *   GET  /threadline/messages/thread/:id — Get thread messages (authenticated)
+ *   GET  /threadline/blobs/:id           — Fetch blob content (authenticated)
+ *
+ * Authentication: Threadline-Relay token + signed headers for authenticated routes.
+ * Content-Type: application/threadline+json; version=1.0
+ *
+ * Part of Threadline Protocol Phase 3.
+ */
+import { Router } from 'express';
+import type { HandshakeManager } from './HandshakeManager.js';
+import type { ThreadlineRouter } from './ThreadlineRouter.js';
+export interface ThreadlineError {
+    error: {
+        code: string;
+        message: string;
+        retryable: boolean;
+        retryAfterSeconds?: number;
+    };
+}
+export interface ThreadlineEndpointsConfig {
+    /** Name of this agent */
+    localAgent: string;
+    /** Threadline protocol version */
+    version: string;
+}
+export declare function createThreadlineRoutes(handshakeManager: HandshakeManager, threadlineRouter: ThreadlineRouter | null, config: ThreadlineEndpointsConfig): Router;
+//# sourceMappingURL=ThreadlineEndpoints.d.ts.map

package/dist/threadline/ThreadlineEndpoints.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ThreadlineEndpoints.d.ts","sourceRoot":"","sources":["../../src/threadline/ThreadlineEndpoints.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AAGjC,OAAO,KAAK,EAAE,gBAAgB,EAAgC,MAAM,uBAAuB,CAAC;AAC5F,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAK9D,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE;QACL,IAAI,EAAE,MAAM,CAAC;QACb,OAAO,EAAE,MAAM,CAAC;QAChB,SAAS,EAAE,OAAO,CAAC;QACnB,iBAAiB,CAAC,EAAE,MAAM,CAAC;KAC5B,CAAC;CACH;AAED,MAAM,WAAW,yBAAyB;IACxC,yBAAyB;IACzB,UAAU,EAAE,MAAM,CAAC;IACnB,kCAAkC;IAClC,OAAO,EAAE,MAAM,CAAC;CACjB;AA8CD,wBAAgB,sBAAsB,CACpC,gBAAgB,EAAE,gBAAgB,EAClC,gBAAgB,EAAE,gBAAgB,GAAG,IAAI,EACzC,MAAM,EAAE,yBAAyB,GAChC,MAAM,CA6WR"}