@iflow-mcp/jkheadley-instar 0.26.2

package/dist/threadline/client/IdentityManager.js

@@ -0,0 +1,106 @@
+/**
+ * IdentityManager — Manages Ed25519 identity keys for relay agents.
+ *
+ * Generates, stores, and loads identity keypairs from disk.
+ * Part of Threadline Relay Phase 1.
+ */
+import fs from 'node:fs';
+import path from 'node:path';
+import { generateIdentityKeyPair } from '../ThreadlineCrypto.js';
+import { computeFingerprint, deriveX25519PublicKey } from './MessageEncryptor.js';
+export class IdentityManager {
+    stateDir;
+    keyFile;
+    identity = null;
+    constructor(stateDir) {
+        this.stateDir = stateDir;
+        this.keyFile = path.join(stateDir, 'threadline', 'identity.json');
+    }
+    /**
+     * Get or create the agent's identity.
+     * Generates a new keypair on first use, loads from disk on subsequent uses.
+     */
+    getOrCreate() {
+        if (this.identity)
+            return this.identity;
+        // Try loading from disk
+        const loaded = this.loadFromDisk();
+        if (loaded) {
+            this.identity = loaded;
+            return loaded;
+        }
+        // Generate new identity
+        const keypair = generateIdentityKeyPair();
+        const identity = {
+            fingerprint: computeFingerprint(keypair.publicKey),
+            publicKey: keypair.publicKey,
+            privateKey: keypair.privateKey,
+            x25519PublicKey: deriveX25519PublicKey(keypair.privateKey),
+            createdAt: new Date().toISOString(),
+        };
+        this.saveToDisk(identity);
+        this.identity = identity;
+        return identity;
+    }
+    /**
+     * Get the current identity without creating a new one.
+     */
+    get() {
+        if (this.identity)
+            return this.identity;
+        const loaded = this.loadFromDisk();
+        if (loaded) {
+            this.identity = loaded;
+        }
+        return this.identity;
+    }
+    /**
+     * Check if an identity exists.
+     */
+    exists() {
+        return this.identity !== null || fs.existsSync(this.keyFile);
+    }
+    /**
+     * Get the directory where keys are stored.
+     */
+    get keyDir() {
+        return path.dirname(this.keyFile);
+    }
+    // ── Private ─────────────────────────────────────────────────────
+    loadFromDisk() {
+        try {
+            if (!fs.existsSync(this.keyFile))
+                return null;
+            const raw = JSON.parse(fs.readFileSync(this.keyFile, 'utf-8'));
+            const privateKey = Buffer.from(raw.privateKey, 'base64');
+            return {
+                fingerprint: raw.fingerprint,
+                publicKey: Buffer.from(raw.publicKey, 'base64'),
+                privateKey,
+                x25519PublicKey: raw.x25519PublicKey
+                    ? Buffer.from(raw.x25519PublicKey, 'base64')
+                    : deriveX25519PublicKey(privateKey),
+                createdAt: raw.createdAt,
+            };
+        }
+        catch {
+            return null;
+        }
+    }
+    saveToDisk(identity) {
+        const dir = path.dirname(this.keyFile);
+        fs.mkdirSync(dir, { recursive: true });
+        const data = JSON.stringify({
+            fingerprint: identity.fingerprint,
+            publicKey: identity.publicKey.toString('base64'),
+            privateKey: identity.privateKey.toString('base64'),
+            x25519PublicKey: identity.x25519PublicKey.toString('base64'),
+            createdAt: identity.createdAt,
+        }, null, 2);
+        // Atomic write
+        const tmpPath = `${this.keyFile}.${process.pid}.tmp`;
+        fs.writeFileSync(tmpPath, data, { mode: 0o600 });
+        fs.renameSync(tmpPath, this.keyFile);
+    }
+}
+//# sourceMappingURL=IdentityManager.js.map

package/dist/threadline/client/IdentityManager.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"IdentityManager.js","sourceRoot":"","sources":["../../../src/threadline/client/IdentityManager.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,uBAAuB,EAAgB,MAAM,wBAAwB,CAAC;AAC/E,OAAO,EAAE,kBAAkB,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AAWlF,MAAM,OAAO,eAAe;IACT,QAAQ,CAAS;IACjB,OAAO,CAAS;IACzB,QAAQ,GAAwB,IAAI,CAAC;IAE7C,YAAY,QAAgB;QAC1B,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;QACzB,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,YAAY,EAAE,eAAe,CAAC,CAAC;IACpE,CAAC;IAED;;;OAGG;IACH,WAAW;QACT,IAAI,IAAI,CAAC,QAAQ;YAAE,OAAO,IAAI,CAAC,QAAQ,CAAC;QAExC,wBAAwB;QACxB,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,EAAE,CAAC;QACnC,IAAI,MAAM,EAAE,CAAC;YACX,IAAI,CAAC,QAAQ,GAAG,MAAM,CAAC;YACvB,OAAO,MAAM,CAAC;QAChB,CAAC;QAED,wBAAwB;QACxB,MAAM,OAAO,GAAG,uBAAuB,EAAE,CAAC;QAC1C,MAAM,QAAQ,GAAiB;YAC7B,WAAW,EAAE,kBAAkB,CAAC,OAAO,CAAC,SAAS,CAAC;YAClD,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,UAAU,EAAE,OAAO,CAAC,UAAU;YAC9B,eAAe,EAAE,qBAAqB,CAAC,OAAO,CAAC,UAAU,CAAC;YAC1D,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SACpC,CAAC;QAEF,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;QAC1B,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;QACzB,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED;;OAEG;IACH,GAAG;QACD,IAAI,IAAI,CAAC,QAAQ;YAAE,OAAO,IAAI,CAAC,QAAQ,CAAC;QACxC,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,EAAE,CAAC;QACnC,IAAI,MAAM,EAAE,CAAC;YACX,IAAI,CAAC,QAAQ,GAAG,MAAM,CAAC;QACzB,CAAC;QACD,OAAO,IAAI,CAAC,QAAQ,CAAC;IACvB,CAAC;IAED;;OAEG;IACH,MAAM;QACJ,OAAO,IAAI,CAAC,QAAQ,KAAK,IAAI,IAAI,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC/D,CAAC;IAED;;OAEG;IACH,IAAI,MAAM;QACR,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACpC,CAAC;IAED,mEAAmE;IAE3D,YAAY;QAClB,IAAI,CAAC;YACH,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC;gBAAE,OAAO,IAAI,CAAC;YAC9C,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;YAC/D,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;YACzD,OAAO;gBACL,WAAW,EAAE,GAAG,CAAC,WAAW;gBAC5B,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,QAAQ,CAAC;gBAC/C,UAAU;gBACV,eAAe,EAAE,GAAG,CAAC,eAAe;oBAClC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,eAAe,EAAE,QAAQ,CAAC;oBAC5C,CAAC,CAAC,qBAAqB,CAAC,UAAU,CAAC;gBACrC,SAAS,EAAE,GAAG,CAAC,SAAS;aACzB,CAAC;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAEO,UAAU,CAAC,QAAsB;QACvC,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACvC,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAEvC,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC;YAC1B,WAAW,EAAE,QAAQ,CAAC,WAAW;YACjC,SAAS,EAAE,QAAQ,CAAC,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC;YAChD,UAAU,EAAE,QAAQ,CAAC,UAAU,CAAC,QAAQ,CAAC,QAAQ,CAAC;YAClD,eAAe,EAAE,QAAQ,CAAC,eAAe,CAAC,QAAQ,CAAC,QAAQ,CAAC;YAC5D,SAAS,EAAE,QAAQ,CAAC,SAAS;SAC9B,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;QAEZ,eAAe;QACf,MAAM,OAAO,GAAG,GAAG,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,GAAG,MAAM,CAAC;QACrD,EAAE,CAAC,aAAa,CAAC,OAAO,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACjD,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;IACvC,CAAC;CACF"}

package/dist/threadline/client/MessageEncryptor.d.ts

@@ -0,0 +1,63 @@
+/**
+ * MessageEncryptor — Client-side E2E encryption for relay messages.
+ *
+ * Implements XChaCha20-Poly1305 with X25519 key exchange + HKDF-SHA256.
+ * Forward secrecy via ephemeral X25519 keys per message.
+ *
+ * Part of Threadline Relay Phase 1.
+ */
+import type { MessageEnvelope, AgentFingerprint } from '../relay/types.js';
+/** Plaintext message content before encryption */
+export interface PlaintextMessage {
+    content: string;
+    type?: string;
+    metadata?: Record<string, unknown>;
+}
+/**
+ * Convert Ed25519 private key to X25519 private key.
+ *
+ * The Ed25519 private key seed is hashed with SHA-512. The first 32 bytes
+ * are clamped per RFC 7748 to produce the X25519 private key scalar.
+ */
+export declare function edPrivateToX25519(edPrivateKey: Buffer): Buffer;
+/**
+ * Derive X25519 public key from Ed25519 private key.
+ *
+ * Since we can't do the birational map Ed25519→X25519 on public keys alone
+ * in node:crypto, we derive the X25519 keypair from the Ed25519 seed.
+ * Both sides need to share their X25519 public key alongside Ed25519.
+ */
+export declare function deriveX25519PublicKey(edPrivateKey: Buffer): Buffer;
+/**
+ * Compute agent fingerprint from Ed25519 public key.
+ * First 16 bytes of the public key, hex-encoded (32 characters).
+ */
+export declare function computeFingerprint(publicKey: Buffer): AgentFingerprint;
+export declare class MessageEncryptor {
+    private readonly edPrivateKey;
+    private readonly edPublicKey;
+    private readonly x25519Private;
+    /** X25519 public key — must be shared with peers for E2E encryption */
+    readonly x25519Public: Buffer;
+    readonly fingerprint: AgentFingerprint;
+    constructor(edPrivateKey: Buffer, edPublicKey: Buffer);
+    /**
+     * Encrypt a message for a specific recipient.
+     *
+     * @param recipientEdPubKey - Recipient's Ed25519 public key (for fingerprint/signing)
+     * @param recipientX25519PubKey - Recipient's X25519 public key (for encryption)
+     * @param threadId - Thread identifier
+     * @param message - Plaintext message
+     */
+    encrypt(recipientEdPubKey: Buffer, recipientX25519PubKey: Buffer, threadId: string, message: PlaintextMessage): MessageEnvelope;
+    /**
+     * Decrypt a message envelope.
+     * Verifies signature and decrypts content.
+     *
+     * @param envelope - The encrypted message envelope
+     * @param senderEdPubKey - Sender's Ed25519 public key (for signature verification)
+     * @param senderX25519PubKey - Sender's X25519 public key (for key agreement)
+     */
+    decrypt(envelope: MessageEnvelope, senderEdPubKey: Buffer, senderX25519PubKey: Buffer): PlaintextMessage;
+}
+//# sourceMappingURL=MessageEncryptor.d.ts.map

package/dist/threadline/client/MessageEncryptor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"MessageEncryptor.d.ts","sourceRoot":"","sources":["../../../src/threadline/client/MessageEncryptor.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAUH,OAAO,KAAK,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAK3E,kDAAkD;AAClD,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM,CAQ9D;AAED;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM,CAelE;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,SAAS,EAAE,MAAM,GAAG,gBAAgB,CAEtE;AAmCD,qBAAa,gBAAgB;IAC3B,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAS;IACtC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAS;IACrC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAS;IACvC,uEAAuE;IACvE,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,WAAW,EAAE,gBAAgB,CAAC;gBAE3B,YAAY,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM;IAQrD;;;;;;;OAOG;IACH,OAAO,CACL,iBAAiB,EAAE,MAAM,EACzB,qBAAqB,EAAE,MAAM,EAC7B,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,gBAAgB,GACxB,eAAe;IA0DlB;;;;;;;OAOG;IACH,OAAO,CACL,QAAQ,EAAE,eAAe,EACzB,cAAc,EAAE,MAAM,EACtB,kBAAkB,EAAE,MAAM,GACzB,gBAAgB;CAqCpB"}

package/dist/threadline/client/MessageEncryptor.js

@@ -0,0 +1,195 @@
+/**
+ * MessageEncryptor — Client-side E2E encryption for relay messages.
+ *
+ * Implements XChaCha20-Poly1305 with X25519 key exchange + HKDF-SHA256.
+ * Forward secrecy via ephemeral X25519 keys per message.
+ *
+ * Part of Threadline Relay Phase 1.
+ */
+import crypto from 'node:crypto';
+import { xchacha20poly1305 } from '@noble/ciphers/chacha.js';
+import { generateEphemeralKeyPair, ecdh, sign, verify, } from '../ThreadlineCrypto.js';
+/** HKDF info string for relay message encryption */
+const HKDF_INFO = 'threadline-relay-v1';
+/**
+ * Convert Ed25519 private key to X25519 private key.
+ *
+ * The Ed25519 private key seed is hashed with SHA-512. The first 32 bytes
+ * are clamped per RFC 7748 to produce the X25519 private key scalar.
+ */
+export function edPrivateToX25519(edPrivateKey) {
+    const hash = crypto.createHash('sha512').update(edPrivateKey).digest();
+    const scalar = Buffer.from(hash.subarray(0, 32));
+    // Clamp per RFC 7748
+    scalar[0] &= 248;
+    scalar[31] &= 127;
+    scalar[31] |= 64;
+    return scalar;
+}
+/**
+ * Derive X25519 public key from Ed25519 private key.
+ *
+ * Since we can't do the birational map Ed25519→X25519 on public keys alone
+ * in node:crypto, we derive the X25519 keypair from the Ed25519 seed.
+ * Both sides need to share their X25519 public key alongside Ed25519.
+ */
+export function deriveX25519PublicKey(edPrivateKey) {
+    const x25519Private = edPrivateToX25519(edPrivateKey);
+    const privateKeyObj = crypto.createPrivateKey({
+        key: Buffer.concat([
+            Buffer.from('302e020100300506032b656e04220420', 'hex'),
+            x25519Private,
+        ]),
+        format: 'der',
+        type: 'pkcs8',
+    });
+    const publicKeyDer = crypto.createPublicKey(privateKeyObj)
+        .export({ type: 'spki', format: 'der' });
+    return Buffer.from(publicKeyDer.subarray(-32));
+}
+/**
+ * Compute agent fingerprint from Ed25519 public key.
+ * First 16 bytes of the public key, hex-encoded (32 characters).
+ */
+export function computeFingerprint(publicKey) {
+    return publicKey.subarray(0, 16).toString('hex');
+}
+/**
+ * Perform X25519 key exchange between a private key and a public key.
+ * Validates that the shared secret is not all zeros (low-order point attack).
+ */
+function secureEcdh(privateKey, publicKey) {
+    const shared = ecdh(privateKey, publicKey);
+    // Validate: reject all-zero shared secrets
+    if (shared.every(b => b === 0)) {
+        throw new Error('X25519 produced all-zero shared secret (low-order point attack)');
+    }
+    return shared;
+}
+/**
+ * Derive encryption key using HKDF-SHA256.
+ */
+function deriveKey(ikm, salt) {
+    return Buffer.from(crypto.hkdfSync('sha256', ikm, salt, HKDF_INFO, 32));
+}
+/**
+ * Canonicalize envelope fields for signing.
+ * Sorted alphabetically, no whitespace, signature field excluded.
+ */
+function canonicalizeEnvelope(envelope) {
+    const sorted = {};
+    for (const key of Object.keys(envelope).sort()) {
+        if (key === 'signature')
+            continue;
+        sorted[key] = envelope[key];
+    }
+    return JSON.stringify(sorted);
+}
+export class MessageEncryptor {
+    edPrivateKey;
+    edPublicKey;
+    x25519Private;
+    /** X25519 public key — must be shared with peers for E2E encryption */
+    x25519Public;
+    fingerprint;
+    constructor(edPrivateKey, edPublicKey) {
+        this.edPrivateKey = edPrivateKey;
+        this.edPublicKey = edPublicKey;
+        this.x25519Private = edPrivateToX25519(edPrivateKey);
+        this.x25519Public = deriveX25519PublicKey(edPrivateKey);
+        this.fingerprint = computeFingerprint(edPublicKey);
+    }
+    /**
+     * Encrypt a message for a specific recipient.
+     *
+     * @param recipientEdPubKey - Recipient's Ed25519 public key (for fingerprint/signing)
+     * @param recipientX25519PubKey - Recipient's X25519 public key (for encryption)
+     * @param threadId - Thread identifier
+     * @param message - Plaintext message
+     */
+    encrypt(recipientEdPubKey, recipientX25519PubKey, threadId, message) {
+        // 1. Generate ephemeral X25519 keypair for forward secrecy
+        const ephemeral = generateEphemeralKeyPair();
+        // 2. Key agreement
+        // ES: ephemeral sender private × static recipient X25519 public
+        const es = secureEcdh(ephemeral.privateKey, recipientX25519PubKey);
+        // SS: static sender X25519 private × static recipient X25519 public
+        const ss = secureEcdh(this.x25519Private, recipientX25519PubKey);
+        // 3. Combine shared secrets and derive encryption key
+        const salt = crypto.randomBytes(32);
+        const ikm = Buffer.concat([es, ss]);
+        const encryptionKey = deriveKey(ikm, salt);
+        // 4. Securely erase ephemeral private key
+        ephemeral.privateKey.fill(0);
+        // 5. Encrypt with XChaCha20-Poly1305
+        const plaintext = Buffer.from(JSON.stringify(message), 'utf-8');
+        const nonce = crypto.randomBytes(24); // 192-bit nonce
+        const messageId = crypto.randomUUID();
+        const timestamp = new Date().toISOString();
+        // Build envelope fields for AAD
+        const envelopeBase = {
+            from: this.fingerprint,
+            to: computeFingerprint(recipientEdPubKey),
+            threadId,
+            messageId,
+            timestamp,
+            nonce: Buffer.from(nonce).toString('base64'),
+            ephemeralPubKey: ephemeral.publicKey.toString('base64'),
+            salt: salt.toString('base64'),
+        };
+        const aad = Buffer.from(canonicalizeEnvelope({ ...envelopeBase, payload: '' }), 'utf-8');
+        const cipher = xchacha20poly1305(new Uint8Array(encryptionKey), nonce, aad);
+        const ciphertext = cipher.encrypt(new Uint8Array(plaintext));
+        // 6. Build full envelope
+        const envelope = {
+            ...envelopeBase,
+            payload: Buffer.from(ciphertext).toString('base64'),
+        };
+        // 7. Sign the canonical envelope
+        const canonical = canonicalizeEnvelope(envelope);
+        const signature = sign(this.edPrivateKey, Buffer.from(canonical, 'utf-8'));
+        return {
+            ...envelope,
+            signature: signature.toString('base64'),
+        };
+    }
+    /**
+     * Decrypt a message envelope.
+     * Verifies signature and decrypts content.
+     *
+     * @param envelope - The encrypted message envelope
+     * @param senderEdPubKey - Sender's Ed25519 public key (for signature verification)
+     * @param senderX25519PubKey - Sender's X25519 public key (for key agreement)
+     */
+    decrypt(envelope, senderEdPubKey, senderX25519PubKey) {
+        // 1. Verify signature
+        const { signature: sig, ...withoutSig } = envelope;
+        const canonical = canonicalizeEnvelope(withoutSig);
+        const sigBuf = Buffer.from(sig, 'base64');
+        const valid = verify(senderEdPubKey, Buffer.from(canonical, 'utf-8'), sigBuf);
+        if (!valid) {
+            throw new Error('Invalid message signature');
+        }
+        // 2. Decode ephemeral public key
+        const ephemeralPub = Buffer.from(envelope.ephemeralPubKey, 'base64');
+        const salt = Buffer.from(envelope.salt, 'base64');
+        // 3. Key agreement (mirror of encryption)
+        // ES: static recipient X25519 private × ephemeral sender public
+        const es = secureEcdh(this.x25519Private, ephemeralPub);
+        // SS: static recipient X25519 private × static sender X25519 public
+        const ss = secureEcdh(this.x25519Private, senderX25519PubKey);
+        // 4. Derive encryption key
+        const ikm = Buffer.concat([es, ss]);
+        const encryptionKey = deriveKey(ikm, salt);
+        // 5. Decrypt
+        const nonce = Buffer.from(envelope.nonce, 'base64');
+        const ciphertext = Buffer.from(envelope.payload, 'base64');
+        // Recreate AAD
+        const envelopeForAAD = { ...withoutSig, payload: '' };
+        const aad = Buffer.from(canonicalizeEnvelope(envelopeForAAD), 'utf-8');
+        const decipher = xchacha20poly1305(new Uint8Array(encryptionKey), new Uint8Array(nonce), aad);
+        const plaintext = decipher.decrypt(new Uint8Array(ciphertext));
+        return JSON.parse(Buffer.from(plaintext).toString('utf-8'));
+    }
+}
+//# sourceMappingURL=MessageEncryptor.js.map

package/dist/threadline/client/MessageEncryptor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"MessageEncryptor.js","sourceRoot":"","sources":["../../../src/threadline/client/MessageEncryptor.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,MAAM,MAAM,aAAa,CAAC;AACjC,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAC7D,OAAO,EACL,wBAAwB,EACxB,IAAI,EACJ,IAAI,EACJ,MAAM,GACP,MAAM,wBAAwB,CAAC;AAGhC,oDAAoD;AACpD,MAAM,SAAS,GAAG,qBAAqB,CAAC;AASxC;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB,CAAC,YAAoB;IACpD,MAAM,IAAI,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,MAAM,EAAE,CAAC;IACvE,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;IACjD,qBAAqB;IACrB,MAAM,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC;IACjB,MAAM,CAAC,EAAE,CAAC,IAAI,GAAG,CAAC;IAClB,MAAM,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC;IACjB,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,qBAAqB,CAAC,YAAoB;IACxD,MAAM,aAAa,GAAG,iBAAiB,CAAC,YAAY,CAAC,CAAC;IAEtD,MAAM,aAAa,GAAG,MAAM,CAAC,gBAAgB,CAAC;QAC5C,GAAG,EAAE,MAAM,CAAC,MAAM,CAAC;YACjB,MAAM,CAAC,IAAI,CAAC,kCAAkC,EAAE,KAAK,CAAC;YACtD,aAAa;SACd,CAAC;QACF,MAAM,EAAE,KAAK;QACb,IAAI,EAAE,OAAO;KACd,CAAC,CAAC;IAEH,MAAM,YAAY,GAAG,MAAM,CAAC,eAAe,CAAC,aAAa,CAAC;SACvD,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;IAC3C,OAAO,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AACjD,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,kBAAkB,CAAC,SAAiB;IAClD,OAAO,SAAS,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AACnD,CAAC;AAED;;;GAGG;AACH,SAAS,UAAU,CAAC,UAAkB,EAAE,SAAiB;IACvD,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC;IAC3C,2CAA2C;IAC3C,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CAAC,iEAAiE,CAAC,CAAC;IACrF,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;GAEG;AACH,SAAS,SAAS,CAAC,GAAW,EAAE,IAAY;IAC1C,OAAO,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,EAAE,GAAG,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,CAAC,CAAC,CAAC;AAC1E,CAAC;AAED;;;GAGG;AACH,SAAS,oBAAoB,CAAC,QAAqE;IACjG,MAAM,MAAM,GAA4B,EAAE,CAAC;IAC3C,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;QAC/C,IAAI,GAAG,KAAK,WAAW;YAAE,SAAS;QAClC,MAAM,CAAC,GAAG,CAAC,GAAI,QAAoC,CAAC,GAAG,CAAC,CAAC;IAC3D,CAAC;IACD,OAAO,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;AAChC,CAAC;AAED,MAAM,OAAO,gBAAgB;IACV,YAAY,CAAS;IACrB,WAAW,CAAS;IACpB,aAAa,CAAS;IACvC,uEAAuE;IAC9D,YAAY,CAAS;IACrB,WAAW,CAAmB;IAEvC,YAAY,YAAoB,EAAE,WAAmB;QACnD,IAAI,CAAC,YAAY,GAAG,YAAY,CAAC;QACjC,IAAI,CAAC,WAAW,GAAG,WAAW,CAAC;QAC/B,IAAI,CAAC,aAAa,GAAG,iBAAiB,CAAC,YAAY,CAAC,CAAC;QACrD,IAAI,CAAC,YAAY,GAAG,qBAAqB,CAAC,YAAY,CAAC,CAAC;QACxD,IAAI,CAAC,WAAW,GAAG,kBAAkB,CAAC,WAAW,CAAC,CAAC;IACrD,CAAC;IAED;;;;;;;OAOG;IACH,OAAO,CACL,iBAAyB,EACzB,qBAA6B,EAC7B,QAAgB,EAChB,OAAyB;QAEzB,2DAA2D;QAC3D,MAAM,SAAS,GAAG,wBAAwB,EAAE,CAAC;QAE7C,mBAAmB;QACnB,gEAAgE;QAChE,MAAM,EAAE,GAAG,UAAU,CAAC,SAAS,CAAC,UAAU,EAAE,qBAAqB,CAAC,CAAC;QACnE,oEAAoE;QACpE,MAAM,EAAE,GAAG,UAAU,CAAC,IAAI,CAAC,aAAa,EAAE,qBAAqB,CAAC,CAAC;QAEjE,sDAAsD;QACtD,MAAM,IAAI,GAAG,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;QACpC,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;QACpC,MAAM,aAAa,GAAG,SAAS,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QAE3C,0CAA0C;QAC1C,SAAS,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAE7B,qCAAqC;QACrC,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC,CAAC;QAChE,MAAM,KAAK,GAAG,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC,gBAAgB;QAEtD,MAAM,SAAS,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;QACtC,MAAM,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QAE3C,gCAAgC;QAChC,MAAM,YAAY,GAAG;YACnB,IAAI,EAAE,IAAI,CAAC,WAAW;YACtB,EAAE,EAAE,kBAAkB,CAAC,iBAAiB,CAAC;YACzC,QAAQ;YACR,SAAS;YACT,SAAS;YACT,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC;YAC5C,eAAe,EAAE,SAAS,CAAC,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC;YACvD,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC;SAC9B,CAAC;QAEF,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,oBAAoB,CAAC,EAAE,GAAG,YAAY,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,EAAE,OAAO,CAAC,CAAC;QAEzF,MAAM,MAAM,GAAG,iBAAiB,CAAC,IAAI,UAAU,CAAC,aAAa,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC;QAC5E,MAAM,UAAU,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC;QAE7D,yBAAyB;QACzB,MAAM,QAAQ,GAAG;YACf,GAAG,YAAY;YACf,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC;SACpD,CAAC;QAEF,iCAAiC;QACjC,MAAM,SAAS,GAAG,oBAAoB,CAAC,QAAQ,CAAC,CAAC;QACjD,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC;QAE3E,OAAO;YACL,GAAG,QAAQ;YACX,SAAS,EAAE,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC;SACxC,CAAC;IACJ,CAAC;IAED;;;;;;;OAOG;IACH,OAAO,CACL,QAAyB,EACzB,cAAsB,EACtB,kBAA0B;QAE1B,sBAAsB;QACtB,MAAM,EAAE,SAAS,EAAE,GAAG,EAAE,GAAG,UAAU,EAAE,GAAG,QAAQ,CAAC;QACnD,MAAM,SAAS,GAAG,oBAAoB,CAAC,UAAU,CAAC,CAAC;QACnD,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;QAC1C,MAAM,KAAK,GAAG,MAAM,CAAC,cAAc,EAAE,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,CAAC;QAC9E,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;QAC/C,CAAC;QAED,iCAAiC;QACjC,MAAM,YAAY,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,eAAe,EAAE,QAAQ,CAAC,CAAC;QACrE,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;QAElD,0CAA0C;QAC1C,gEAAgE;QAChE,MAAM,EAAE,GAAG,UAAU,CAAC,IAAI,CAAC,aAAa,EAAE,YAAY,CAAC,CAAC;QACxD,oEAAoE;QACpE,MAAM,EAAE,GAAG,UAAU,CAAC,IAAI,CAAC,aAAa,EAAE,kBAAkB,CAAC,CAAC;QAE9D,2BAA2B;QAC3B,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;QACpC,MAAM,aAAa,GAAG,SAAS,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QAE3C,aAAa;QACb,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;QACpD,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QAE3D,eAAe;QACf,MAAM,cAAc,GAAG,EAAE,GAAG,UAAU,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;QACtD,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,oBAAoB,CAAC,cAAc,CAAC,EAAE,OAAO,CAAC,CAAC;QAEvE,MAAM,QAAQ,GAAG,iBAAiB,CAAC,IAAI,UAAU,CAAC,aAAa,CAAC,EAAE,IAAI,UAAU,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC;QAC9F,MAAM,SAAS,GAAG,QAAQ,CAAC,OAAO,CAAC,IAAI,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC;QAE/D,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;IAC9D,CAAC;CACF"}

package/dist/threadline/client/RegistryRestClient.d.ts

@@ -0,0 +1,46 @@
+/**
+ * RegistryRestClient — Lightweight REST client for the Threadline agent registry.
+ *
+ * Connects to the relay via WebSocket to authenticate and obtain a JWT token,
+ * then uses that token for REST API calls to the registry.
+ *
+ * Used by mcp-stdio-entry to give built-in Threadline MCP tools registry access.
+ * Part of Threadline Agent Registry Phase 3.
+ */
+import type { RegistryClient } from '../ThreadlineMCPServer.js';
+import type { IdentityInfo } from './IdentityManager.js';
+export interface RegistryRestClientConfig {
+    /** Relay WebSocket URL (e.g., wss://relay.threadline.dev/v1/connect) */
+    relayUrl: string;
+    /** Agent identity (Ed25519 keys) */
+    identity: IdentityInfo;
+    /** Agent display name */
+    agentName: string;
+    /** Agent capabilities */
+    capabilities?: string[];
+    /** Agent framework */
+    framework?: string;
+    /** Whether to register in the registry */
+    listed?: boolean;
+}
+export declare class RegistryRestClient implements RegistryClient {
+    private readonly config;
+    private token;
+    private tokenExpires;
+    private baseUrl;
+    constructor(config: RegistryRestClientConfig);
+    /**
+     * Connect to the relay to authenticate and obtain a registry JWT token.
+     * Must be called before using fetch().
+     */
+    authenticate(): Promise<void>;
+    hasToken(): boolean;
+    fetch(path: string, options?: {
+        method?: string;
+        body?: unknown;
+    }): Promise<{
+        status: number;
+        data: unknown;
+    }>;
+}
+//# sourceMappingURL=RegistryRestClient.d.ts.map

package/dist/threadline/client/RegistryRestClient.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"RegistryRestClient.d.ts","sourceRoot":"","sources":["../../../src/threadline/client/RegistryRestClient.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAIH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAChE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AAEzD,MAAM,WAAW,wBAAwB;IACvC,wEAAwE;IACxE,QAAQ,EAAE,MAAM,CAAC;IACjB,oCAAoC;IACpC,QAAQ,EAAE,YAAY,CAAC;IACvB,yBAAyB;IACzB,SAAS,EAAE,MAAM,CAAC;IAClB,yBAAyB;IACzB,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,sBAAsB;IACtB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,0CAA0C;IAC1C,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAED,qBAAa,kBAAmB,YAAW,cAAc;IACvD,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA2B;IAClD,OAAO,CAAC,KAAK,CAAuB;IACpC,OAAO,CAAC,YAAY,CAAuB;IAC3C,OAAO,CAAC,OAAO,CAAS;gBAEZ,MAAM,EAAE,wBAAwB;IAQ5C;;;OAGG;IACG,YAAY,IAAI,OAAO,CAAC,IAAI,CAAC;IAiEnC,QAAQ,IAAI,OAAO;IAYb,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;QAClC,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,IAAI,CAAC,EAAE,OAAO,CAAC;KAChB,GAAG,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,OAAO,CAAA;KAAE,CAAC;CAmB/C"}

package/dist/threadline/client/RegistryRestClient.js

@@ -0,0 +1,114 @@
+/**
+ * RegistryRestClient — Lightweight REST client for the Threadline agent registry.
+ *
+ * Connects to the relay via WebSocket to authenticate and obtain a JWT token,
+ * then uses that token for REST API calls to the registry.
+ *
+ * Used by mcp-stdio-entry to give built-in Threadline MCP tools registry access.
+ * Part of Threadline Agent Registry Phase 3.
+ */
+import { WebSocket } from 'ws';
+import { sign } from '../ThreadlineCrypto.js';
+export class RegistryRestClient {
+    config;
+    token = null;
+    tokenExpires = null;
+    baseUrl;
+    constructor(config) {
+        this.config = config;
+        // Derive REST URL from WebSocket URL
+        const wsUrl = new URL(config.relayUrl);
+        const protocol = wsUrl.protocol === 'wss:' ? 'https:' : 'http:';
+        this.baseUrl = `${protocol}//${wsUrl.host}`;
+    }
+    /**
+     * Connect to the relay to authenticate and obtain a registry JWT token.
+     * Must be called before using fetch().
+     */
+    async authenticate() {
+        return new Promise((resolve, reject) => {
+            const timeout = setTimeout(() => {
+                ws.close();
+                reject(new Error('Registry auth timeout'));
+            }, 15000);
+            const ws = new WebSocket(this.config.relayUrl);
+            ws.on('error', (err) => {
+                clearTimeout(timeout);
+                reject(new Error(`Registry auth connection failed: ${err.message}`));
+            });
+            ws.on('message', (raw) => {
+                try {
+                    const frame = JSON.parse(raw.toString());
+                    if (frame.type === 'challenge') {
+                        // Sign the challenge
+                        const signature = sign(this.config.identity.privateKey, Buffer.from(frame.nonce));
+                        ws.send(JSON.stringify({
+                            type: 'auth',
+                            publicKey: this.config.identity.publicKey.toString('base64'),
+                            signature: signature.toString('base64'),
+                            metadata: {
+                                name: this.config.agentName,
+                                capabilities: this.config.capabilities ?? ['chat'],
+                                framework: this.config.framework ?? 'instar',
+                            },
+                            registry: {
+                                listed: this.config.listed ?? false,
+                            },
+                        }));
+                    }
+                    else if (frame.type === 'auth_ok') {
+                        // Capture registry token
+                        if (frame.registry_token) {
+                            this.token = frame.registry_token;
+                            this.tokenExpires = frame.registry_token_expires || null;
+                        }
+                        clearTimeout(timeout);
+                        // Disconnect — we only needed the token
+                        ws.close();
+                        resolve();
+                    }
+                    else if (frame.type === 'auth_error') {
+                        clearTimeout(timeout);
+                        ws.close();
+                        reject(new Error(`Registry auth failed: ${frame.message}`));
+                    }
+                }
+                catch (err) {
+                    // Ignore parse errors
+                }
+            });
+            ws.on('close', () => {
+                clearTimeout(timeout);
+            });
+        });
+    }
+    hasToken() {
+        if (!this.token)
+            return false;
+        if (this.tokenExpires) {
+            const expires = new Date(this.tokenExpires).getTime();
+            if (Date.now() > expires) {
+                this.token = null;
+                return false;
+            }
+        }
+        return true;
+    }
+    async fetch(path, options) {
+        const url = `${this.baseUrl}${path}`;
+        const headers = {
+            'Content-Type': 'application/json',
+        };
+        if (this.token) {
+            headers['Authorization'] = `Bearer ${this.token}`;
+        }
+        const response = await globalThis.fetch(url, {
+            method: options?.method ?? 'GET',
+            headers,
+            body: options?.body ? JSON.stringify(options.body) : undefined,
+        });
+        const data = await response.json().catch(() => null);
+        return { status: response.status, data };
+    }
+}
+//# sourceMappingURL=RegistryRestClient.js.map

package/dist/threadline/client/RegistryRestClient.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"RegistryRestClient.js","sourceRoot":"","sources":["../../../src/threadline/client/RegistryRestClient.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,IAAI,CAAC;AAC/B,OAAO,EAAE,IAAI,EAAE,MAAM,wBAAwB,CAAC;AAmB9C,MAAM,OAAO,kBAAkB;IACZ,MAAM,CAA2B;IAC1C,KAAK,GAAkB,IAAI,CAAC;IAC5B,YAAY,GAAkB,IAAI,CAAC;IACnC,OAAO,CAAS;IAExB,YAAY,MAAgC;QAC1C,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,qCAAqC;QACrC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QACvC,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,KAAK,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC;QAChE,IAAI,CAAC,OAAO,GAAG,GAAG,QAAQ,KAAK,KAAK,CAAC,IAAI,EAAE,CAAC;IAC9C,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,YAAY;QAChB,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACrC,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,EAAE;gBAC9B,EAAE,CAAC,KAAK,EAAE,CAAC;gBACX,MAAM,CAAC,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC,CAAC;YAC7C,CAAC,EAAE,KAAK,CAAC,CAAC;YAEV,MAAM,EAAE,GAAG,IAAI,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YAE/C,EAAE,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;gBACrB,YAAY,CAAC,OAAO,CAAC,CAAC;gBACtB,MAAM,CAAC,IAAI,KAAK,CAAC,oCAAoC,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;YACvE,CAAC,CAAC,CAAC;YAEH,EAAE,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC,GAAG,EAAE,EAAE;gBACvB,IAAI,CAAC;oBACH,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC;oBAEzC,IAAI,KAAK,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;wBAC/B,qBAAqB;wBACrB,MAAM,SAAS,GAAG,IAAI,CACpB,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,UAAU,EAC/B,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CACzB,CAAC;wBAEF,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC;4BACrB,IAAI,EAAE,MAAM;4BACZ,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC;4BAC5D,SAAS,EAAE,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC;4BACvC,QAAQ,EAAE;gCACR,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,SAAS;gCAC3B,YAAY,EAAE,IAAI,CAAC,MAAM,CAAC,YAAY,IAAI,CAAC,MAAM,CAAC;gCAClD,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,SAAS,IAAI,QAAQ;6BAC7C;4BACD,QAAQ,EAAE;gCACR,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,MAAM,IAAI,KAAK;6BACpC;yBACF,CAAC,CAAC,CAAC;oBACN,CAAC;yBAAM,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;wBACpC,yBAAyB;wBACzB,IAAI,KAAK,CAAC,cAAc,EAAE,CAAC;4BACzB,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC,cAAc,CAAC;4BAClC,IAAI,CAAC,YAAY,GAAG,KAAK,CAAC,sBAAsB,IAAI,IAAI,CAAC;wBAC3D,CAAC;wBAED,YAAY,CAAC,OAAO,CAAC,CAAC;wBACtB,wCAAwC;wBACxC,EAAE,CAAC,KAAK,EAAE,CAAC;wBACX,OAAO,EAAE,CAAC;oBACZ,CAAC;yBAAM,IAAI,KAAK,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;wBACvC,YAAY,CAAC,OAAO,CAAC,CAAC;wBACtB,EAAE,CAAC,KAAK,EAAE,CAAC;wBACX,MAAM,CAAC,IAAI,KAAK,CAAC,yBAAyB,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;oBAC9D,CAAC;gBACH,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,sBAAsB;gBACxB,CAAC;YACH,CAAC,CAAC,CAAC;YAEH,EAAE,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;gBAClB,YAAY,CAAC,OAAO,CAAC,CAAC;YACxB,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC;IAED,QAAQ;QACN,IAAI,CAAC,IAAI,CAAC,KAAK;YAAE,OAAO,KAAK,CAAC;QAC9B,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;YACtB,MAAM,OAAO,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE,CAAC;YACtD,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,EAAE,CAAC;gBACzB,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC;gBAClB,OAAO,KAAK,CAAC;YACf,CAAC;QACH,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,IAAY,EAAE,OAGzB;QACC,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,OAAO,GAAG,IAAI,EAAE,CAAC;QACrC,MAAM,OAAO,GAA2B;YACtC,cAAc,EAAE,kBAAkB;SACnC,CAAC;QAEF,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,eAAe,CAAC,GAAG,UAAU,IAAI,CAAC,KAAK,EAAE,CAAC;QACpD,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,UAAU,CAAC,KAAK,CAAC,GAAG,EAAE;YAC3C,MAAM,EAAE,OAAO,EAAE,MAAM,IAAI,KAAK;YAChC,OAAO;YACP,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS;SAC/D,CAAC,CAAC;QAEH,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;QACrD,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC;IAC3C,CAAC;CACF"}

package/dist/threadline/client/RelayClient.d.ts

@@ -0,0 +1,77 @@
+/**
+ * RelayClient — WebSocket client for connecting to the Threadline relay.
+ *
+ * Handles authentication, reconnection, heartbeat, and message routing.
+ * Part of Threadline Relay Phase 1.
+ */
+import { EventEmitter } from 'node:events';
+import type { RelayClientConfig, AgentFingerprint, MessageEnvelope, DiscoverResultFrame, PresenceChangeFrame, AckFrame, ErrorFrame } from '../relay/types.js';
+import type { IdentityInfo } from './IdentityManager.js';
+export interface RelayClientEvents {
+    connected: (sessionId: string) => void;
+    disconnected: (reason: string) => void;
+    displaced: (reason: string) => void;
+    message: (envelope: MessageEnvelope) => void;
+    ack: (ack: AckFrame) => void;
+    error: (error: ErrorFrame) => void;
+    'presence-change': (change: PresenceChangeFrame) => void;
+    'discover-result': (result: DiscoverResultFrame) => void;
+}
+type ConnectionState = 'disconnected' | 'connecting' | 'authenticating' | 'connected';
+export declare class RelayClient extends EventEmitter {
+    private readonly config;
+    private readonly identity;
+    private socket;
+    private state;
+    private sessionId;
+    private reconnectAttempt;
+    private reconnectTimer;
+    private shouldReconnect;
+    private heartbeatInterval;
+    constructor(config: RelayClientConfig, identity: IdentityInfo);
+    /**
+     * Connect to the relay server.
+     */
+    connect(): Promise<string>;
+    /**
+     * Disconnect from the relay server.
+     */
+    disconnect(): void;
+    /**
+     * Send a message envelope to the relay.
+     */
+    sendMessage(envelope: MessageEnvelope): void;
+    /**
+     * Send an ack for a received message.
+     */
+    sendAck(messageId: string, status?: 'delivered'): void;
+    /**
+     * Discover agents on the relay.
+     */
+    discover(filter?: {
+        capability?: string;
+        framework?: string;
+        name?: string;
+    }): void;
+    /**
+     * Subscribe to presence changes.
+     */
+    subscribe(agentIds?: AgentFingerprint[]): void;
+    /**
+     * Get current connection state.
+     */
+    get connectionState(): ConnectionState;
+    /**
+     * Get the relay session ID.
+     */
+    get relaySessionId(): string | null;
+    /**
+     * Get the agent's fingerprint.
+     */
+    get fingerprint(): AgentFingerprint;
+    private doConnect;
+    private handleChallenge;
+    private scheduleReconnect;
+}
+export {};
+//# sourceMappingURL=RelayClient.d.ts.map

package/dist/threadline/client/RelayClient.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"RelayClient.d.ts","sourceRoot":"","sources":["../../../src/threadline/client/RelayClient.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAE3C,OAAO,KAAK,EACV,iBAAiB,EACjB,gBAAgB,EAEhB,eAAe,EACf,mBAAmB,EACnB,mBAAmB,EACnB,QAAQ,EACR,UAAU,EACX,MAAM,mBAAmB,CAAC;AAC3B,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AAEzD,MAAM,WAAW,iBAAiB;IAChC,SAAS,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,IAAI,CAAC;IACvC,YAAY,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,IAAI,CAAC;IACvC,SAAS,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,IAAI,CAAC;IACpC,OAAO,EAAE,CAAC,QAAQ,EAAE,eAAe,KAAK,IAAI,CAAC;IAC7C,GAAG,EAAE,CAAC,GAAG,EAAE,QAAQ,KAAK,IAAI,CAAC;IAC7B,KAAK,EAAE,CAAC,KAAK,EAAE,UAAU,KAAK,IAAI,CAAC;IACnC,iBAAiB,EAAE,CAAC,MAAM,EAAE,mBAAmB,KAAK,IAAI,CAAC;IACzD,iBAAiB,EAAE,CAAC,MAAM,EAAE,mBAAmB,KAAK,IAAI,CAAC;CAC1D;AAED,KAAK,eAAe,GAAG,cAAc,GAAG,YAAY,GAAG,gBAAgB,GAAG,WAAW,CAAC;AAEtF,qBAAa,WAAY,SAAQ,YAAY;IAC3C,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA8B;IACrD,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAe;IACxC,OAAO,CAAC,MAAM,CAA0B;IACxC,OAAO,CAAC,KAAK,CAAmC;IAChD,OAAO,CAAC,SAAS,CAAuB;IACxC,OAAO,CAAC,gBAAgB,CAAK;IAC7B,OAAO,CAAC,cAAc,CAA8C;IACpE,OAAO,CAAC,eAAe,CAAQ;IAC/B,OAAO,CAAC,iBAAiB,CAAuB;gBAEpC,MAAM,EAAE,iBAAiB,EAAE,QAAQ,EAAE,YAAY;IAiB7D;;OAEG;IACG,OAAO,IAAI,OAAO,CAAC,MAAM,CAAC;IAUhC;;OAEG;IACH,UAAU,IAAI,IAAI;IAclB;;OAEG;IACH,WAAW,CAAC,QAAQ,EAAE,eAAe,GAAG,IAAI;IAO5C;;OAEG;IACH,OAAO,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,GAAE,WAAyB,GAAG,IAAI;IAKnE;;OAEG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE;QAAE,UAAU,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI;IAOnF;;OAEG;IACH,SAAS,CAAC,QAAQ,CAAC,EAAE,gBAAgB,EAAE,GAAG,IAAI;IAO9C;;OAEG;IACH,IAAI,eAAe,IAAI,eAAe,CAErC;IAED;;OAEG;IACH,IAAI,cAAc,IAAI,MAAM,GAAG,IAAI,CAElC;IAED;;OAEG;IACH,IAAI,WAAW,IAAI,gBAAgB,CAElC;IAID,OAAO,CAAC,SAAS;IAoHjB,OAAO,CAAC,eAAe;IAmBvB,OAAO,CAAC,iBAAiB;CAkB1B"}