@makaio/framework 1.0.0-dev-1781022866275 → 1.0.0-dev-1781023871421

package/dist/namespace-Yna5-Pws.mjs

@@ -0,0 +1 @@
+import{harnessDefinitions as e}from"./services/harness/storage/schema.mjs";import{z as t}from"zod";import{ApprovalPolicySchema as n,HarnessDefinitionBaseSchema as r,HarnessDefinitionSchema as i}from"@makaio/framework/contracts";import{createStorageNamespaceDefinition as a}from"@makaio/framework/storage";const o=t.object({enabled:t.array(t.string()),disabled:t.array(t.string())}),s=r.omit({createdAt:!0,updatedAt:!0,approvalPolicy:!0,isDefault:!0,enabled:!0,nativeTools:!0,registryTools:!0,skills:!0}).extend({approvalPolicy:n,isDefault:t.boolean(),enabled:t.boolean(),nativeTools:o,registryTools:o,skills:o.optional()}).strict().refine(e=>!!e.adapterName||!!e.clientId,{message:`At least one of adapterName or clientId must be set`}),c=t.object({adapterName:t.string().optional(),clientId:t.string().optional(),name:t.string().optional()}),l=a(`harness`,{schemas:{get:{request:t.object({id:t.string()}),response:t.object({harness:i.nullable()})},set:{request:t.object({harness:s}),response:t.object({id:t.string()})},delete:{request:t.object({id:t.string()}),response:t.object({deleted:t.boolean()})},list:{request:c,response:t.object({harnesses:t.array(i)})}},extensions:{drizzle:{harnessDefinitions:e}}}),u=l.subjects;export{u as n,l as t};

package/dist/namespace-xcmbQlxh.mjs

@@ -0,0 +1 @@
+import{z as e}from"zod";import{createBusNamespace as t}from"@makaio/framework/core";import{localSubject as n}from"@makaio/framework/bus";const r=e.object({machineId:e.string()}),i={isReady:{request:e.object({}),response:e.object({ready:e.boolean(),machineId:e.string()})},"phase.busCreated":r,"phase.coreReady":r,"phase.servicesReady":r,"phase.coordinatorReady":n({request:r,response:e.object({})}),ready:r,"lifecycle.start":{request:e.object({machineId:e.string()}),response:e.object({})},"lifecycle.shutdown":{request:e.object({}),response:e.object({})},restart:{request:e.object({reason:e.string().optional()}),response:e.object({accepted:e.boolean()})}},a=t(`kernel`,i),o=a.subjects;let s;function c(e){if(e!==void 0&&s!==void 0&&s!==e)throw Error(`Workflow trigger type registry is already set. Clear it with setWorkflowTriggerTypeRegistry(undefined) before replacing it.`);s=e}function l(){return s}export{i as a,c as i,o as n,l as r,a as t};

package/dist/native-session-supervisor-B1TnaPUF.mjs

@@ -0,0 +1 @@
+import{r as e}from"./profile-6ynCD5k3.mjs";import{z as t}from"zod";import{createBusNamespace as n}from"@makaio/framework/core";const r=t.enum([`running`,`stopped`,`exited`,`unknown`]),i={request:t.object({clientId:t.string(),cwd:t.string(),command:t.string(),args:t.array(t.string()),env:t.record(t.string(),t.string()).optional(),sessionId:t.string().optional(),clientProfileName:e.optional(),adapterSessionId:t.string().optional(),metadata:t.record(t.string(),t.unknown()).optional()}),response:t.object({supervisorSessionId:t.string(),pid:t.number().int().positive()})},a={request:t.union([t.object({supervisorSessionId:t.string()}).strict(),t.object({sessionId:t.string()}).strict(),t.object({adapterSessionId:t.string()}).strict()]),response:t.object({success:t.boolean(),supervisorSessionId:t.string().optional(),pid:t.number().int().positive().optional(),terminalAttachment:t.object({canAttach:t.boolean()}).optional()})},o={request:t.object({supervisorSessionId:t.string(),signal:t.string().optional()}),response:t.object({success:t.boolean()})},s=t.object({supervisorSessionId:t.string(),clientId:t.string(),pid:t.number().int().positive().nullable(),status:r,cwd:t.string(),sessionId:t.string().optional(),adapterSessionId:t.string().optional(),startedAt:t.number().int().nonnegative(),stoppedAt:t.number().int().nonnegative().optional()}),c={request:t.union([t.object({}).strict(),t.object({supervisorSessionId:t.string()}).strict(),t.object({sessionId:t.string()}).strict(),t.object({adapterSessionId:t.string()}).strict()]),response:t.object({runtimes:t.array(s)})},l={launch:i,attach:a,stop:o,status:c},u=n(`native-session-supervisor`,l),d=u.subjects;export{i as a,s as c,a as i,r as l,d as n,c as o,l as r,o as s,u as t};

package/dist/node/bus-server/index.d.mts

@@ -0,0 +1,178 @@
+import { i as BusServerConfig, n as startBusServer, r as BusServer, t as StartBusServerOptions } from "../../server-lifecycle-YoSGFGnU.mjs";
+import { BusBroadcastMessage, BusMessage, BusRequestMessage, BusTransport, BusTransportError } from "@makaio/framework/bus";
+import { TransportAuth, WebSocketLike, WebSocketServerLike, WebSocketServerLike as WebSocketServerLike$1 } from "@makaio/framework/node/transports";
+
+//#region packages/bus-server/src/server.d.ts
+/**
+ * Create a bus server instance.
+ *
+ * This function creates a WebSocket server transport and provides a clean
+ * API for lifecycle management. The server will:
+ * - Accept incoming client connections
+ * - Handle optional authentication
+ * - Broadcast messages to all connected clients
+ * - Integrate with MakaioBus for message routing
+ * @param config - Server configuration
+ * @returns BusServer instance with start/stop methods
+ * @example
+ * ```typescript
+ * import { WebSocketServer } from 'ws';
+ * import { createBusServer } from '@makaio/framework/node/bus-server';
+ * import { HmacAuth } from '@makaio/framework/node/transports';
+ *
+ * const wss = new WebSocketServer({ port: 8080 });
+ * const server = createBusServer({
+ *   websocket: wss,
+ *   auth: new HmacAuth({ secret: process.env.BUS_SECRET! }),
+ *   debug: true,
+ * });
+ *
+ * await server.start();
+ * console.debug('Bus server started');
+ * console.debug('Connected clients:', server.getConnectionCount());
+ *
+ * // Later...
+ * await server.stop();
+ * ```
+ */
+declare function createBusServer(config: BusServerConfig): BusServer;
+//#endregion
+//#region packages/bus-server/src/loopback-transport.d.ts
+/**
+ * Options for constructing a {@link LoopbackTransport}.
+ */
+interface LoopbackTransportOptions {
+  /** The existing transport to proxy sends to. */
+  target: BusTransport;
+  /** Transport identity. Required — loopback is always registered under a caller-chosen name. */
+  name: string;
+}
+/**
+ * Loopback transport that proxies outbound sends to an existing transport.
+ *
+ * This transport is outbound-only: `onReceive` registers a no-op handler
+ * so the relay layer can include this transport in its target list without
+ * triggering double-dispatch of inbound messages.
+ *
+ * Lifecycle methods (`connect`, `disconnect`) are no-ops because the target
+ * transport owns its own lifecycle.
+ */
+declare class LoopbackTransport implements BusTransport {
+  #private;
+  /** Transport identity used as the registry key when registered on a bus. */
+  readonly name: string;
+  /**
+   * @param options - Construction options for the loopback transport.
+   */
+  constructor(options: LoopbackTransportOptions);
+  /** No-op: lifecycle is owned by the target transport. */
+  connect(): Promise<void>;
+  /** No-op: lifecycle is owned by the target transport. */
+  disconnect(): Promise<void>;
+  /**
+   * Delegate to the target transport.
+   * @param message - Bus message to send.
+   * @param timeout - Optional send timeout in milliseconds.
+   * @returns The target transport's send result.
+   */
+  send<TMessage extends BusMessage>(message: TMessage, timeout?: number): Promise<TMessage extends BusRequestMessage ? unknown : TMessage extends BusBroadcastMessage ? Array<{
+    nodeId: string;
+    payload: unknown;
+  }> : boolean>;
+  /**
+   * Delegate cancellation to the target transport if supported.
+   * @param correlationId - Correlation ID of the in-flight request to cancel.
+   * @param error - Optional error to surface at the cancelled call-site.
+   */
+  cancelRequest(correlationId: string, error?: Error): void;
+  /**
+   * No-op: this transport emits no inbound messages to prevent double-dispatch.
+   * @param _handler - Ignored receive handler.
+   * @returns Unsubscribe no-op.
+   */
+  onReceive(_handler: (message: BusMessage) => Promise<void>): () => void;
+  /**
+   * No-op: the loopback transport does not participate in subscription management.
+   * The target transport owns its own subscriptions.
+   */
+  subscribe(): Promise<void>;
+  /** No-op: see {@link subscribe}. */
+  unsubscribe(): Promise<void>;
+  /**
+   * Delegate readiness check to the target transport.
+   * @returns `true` when the target transport is ready or has no `isReady` method.
+   */
+  isReady(): boolean;
+  /**
+   * Delegate broadcast results to the target transport if supported.
+   * @param correlationId - Correlation ID of the originating broadcast.
+   * @param results - Collected per-node broadcast responses.
+   * @param error - Optional transport-level error for the broadcast.
+   */
+  onBroadcastResults(correlationId: string, results: ReadonlyArray<{
+    nodeId: string;
+    payload: unknown;
+  }>, error?: BusTransportError): void;
+}
+//#endregion
+//#region packages/bus-server/src/hono-websocket-bridge.d.ts
+/**
+ * Bridges Hono's per-route WebSocket handling to {@link ServerTransport}'s
+ * {@link WebSocketServerLike} connection listener interface.
+ *
+ * Instead of owning a real WebSocket server, this shim receives already-upgraded
+ * sockets from Hono's `upgradeWebSocket` handler and forwards them to
+ * `ServerTransport` as if they came from a `wss.on('connection')` event.
+ * @example
+ * ```typescript
+ * const bridge = new HonoWebSocketBridge();
+ * const busServer = createBusServer({ websocket: bridge, auth, debug });
+ * await busServer.start();
+ *
+ * app.get('/bus', upgradeWebSocket(() => ({
+ *   onOpen(_event, ws) {
+ *     bridge.accept(ws.raw as WebSocketLike);
+ *   },
+ * })));
+ * ```
+ */
+declare class HonoWebSocketBridge implements WebSocketServerLike$1 {
+  private readonly connectionListeners;
+  /**
+   * Register an event listener.
+   *
+   * Only `'connection'` listeners are tracked; `'error'` and `'close'` are
+   * accepted for interface compatibility but are no-ops on this shim.
+   * @param event - Event type
+   * @param listener - Listener to register
+   */
+  on(event: 'connection', listener: (socket: WebSocketLike) => void): void;
+  on(event: 'error', listener: (error: Error) => void): void;
+  on(event: 'close', listener: () => void): void;
+  /**
+   * Remove a previously registered event listener.
+   *
+   * Only `'connection'` listeners are tracked; `'error'` and `'close'` are
+   * accepted for interface compatibility but are no-ops on this shim.
+   * @param event - Event type
+   * @param listener - Listener to remove
+   */
+  off(event: 'connection', listener: (socket: WebSocketLike) => void): void;
+  off(event: 'error', listener: (error: Error) => void): void;
+  off(event: 'close', listener: () => void): void;
+  /**
+   * Clear all connection listeners (called by {@link ServerTransport} on disconnect).
+   * @param cb - Optional callback invoked after cleanup
+   */
+  close(cb?: (err?: Error) => void): void;
+  /**
+   * Feed an already-upgraded WebSocket into the transport layer.
+   *
+   * Called from Hono's `upgradeWebSocket` `onOpen` handler with `ws.raw`
+   * cast to {@link WebSocketLike}.
+   * @param socket - The raw WebSocket from Hono's WSContext
+   */
+  accept(socket: WebSocketLike): void;
+}
+//#endregion
+export { type BusServer, type BusServerConfig, HonoWebSocketBridge, LoopbackTransport, type LoopbackTransportOptions, type StartBusServerOptions, type TransportAuth, type WebSocketServerLike, createBusServer, startBusServer };

package/dist/node/bus-server/index.mjs

@@ -0,0 +1 @@
+import{n as e,r as t,t as n}from"../../server-lifecycle-FXTPW39-.mjs";var r=class{connectionListeners=new Set;on(e,t){e===`connection`&&this.connectionListeners.add(t)}off(e,t){e===`connection`&&this.connectionListeners.delete(t)}close(e){this.connectionListeners.clear(),e?.()}accept(e){for(let t of this.connectionListeners)t(e)}};export{r as HonoWebSocketBridge,t as LoopbackTransport,e as createBusServer,n as startBusServer};

package/dist/node/bus-server/server-lifecycle.d.mts

@@ -0,0 +1,2 @@
+import { n as startBusServer, t as StartBusServerOptions } from "../../server-lifecycle-YoSGFGnU.mjs";
+export { StartBusServerOptions, startBusServer };

package/dist/node/bus-server/server-lifecycle.mjs

@@ -0,0 +1 @@
+import{t as e}from"../../server-lifecycle-FXTPW39-.mjs";export{e as startBusServer};

package/dist/node/machine-identity/index.d.mts

@@ -0,0 +1,85 @@
+//#region packages/machine-identity/src/machine-keys.d.ts
+/**
+ * Persisted machine identity with ECDH and ECDSA keypairs.
+ * Loaded from or written to `~/.makaio/keys/` on Node.js.
+ * Used for E2E encryption and device pairing.
+ */
+interface PersistedMachineIdentity {
+  /**
+   * Stable machine identifier used for key cache validation.
+   *
+   * Prefers a hardware-derived identifier from OS-native facilities, but may
+   * fall back to the cached `machine.id` value when native lookup is unavailable.
+   */
+  machineId: string;
+  /** ECDH keypair for key agreement */
+  ecdhKeyPair: CryptoKeyPair;
+  /** ECDSA keypair for signing */
+  signingKeyPair: CryptoKeyPair;
+  /** ECDH public key as base64url */
+  publicKey: string;
+  /** ECDSA signing public key as base64url */
+  signingPublicKey: string;
+}
+/**
+ * Status of machine key files.
+ * - 'complete': All required key files exist
+ * - 'partial': Some but not all key files exist
+ * - 'missing': No key files exist
+ */
+type MachineKeyStatus = 'complete' | 'partial' | 'missing';
+/**
+ * Result of machine key validation.
+ */
+interface MachineKeyValidation {
+  /** Overall status of machine keys */
+  status: MachineKeyStatus;
+  /** Files that exist */
+  existing: string[];
+  /** Files that are missing */
+  missing: string[];
+}
+/**
+ * Load or generate machine identity.
+ *
+ * Seeds `machine.id` from OS-native facilities on first boot when available.
+ * After that, the persisted `machine.id` becomes the stable source of truth so
+ * pairing and E2E identities do not rotate if the native ID later changes or
+ * becomes newly available.
+ *
+ * On first run:
+ * - Creates the keys directory if it does not exist
+ * - Generates ECDH P-256 keypair → machine.key (PKCS8 PEM) + machine.pub (SPKI PEM)
+ * - Generates ECDSA P-256 keypair → machine-signing.key + machine-signing.pub
+ * - Writes resolved machine ID → machine.id
+ * - Sets file permissions to 0o600 (private key files)
+ *
+ * On subsequent runs:
+ * - Loads existing keys from PEM files
+ * - Warns if file permissions are too open
+ * @param keysDir - Directory for machine keys (e.g. `~/.makaio/keys`)
+ * @returns PersistedMachineIdentity with loaded/generated keys
+ */
+declare function loadOrCreateMachineIdentity(keysDir: string): Promise<PersistedMachineIdentity>;
+/**
+ * Validate machine key files and return detailed status.
+ *
+ * Checks existence of all required key files and categorizes the state:
+ * - 'complete': All 5 files exist (safe to load)
+ * - 'partial': Some files exist, some missing (inconsistent state)
+ * - 'missing': No files exist (safe to generate new keys)
+ * @param keysDir - Directory for machine keys (e.g. `~/.makaio/keys`)
+ * @returns Validation result with status and file details
+ */
+declare function validateMachineKeys(keysDir: string): Promise<MachineKeyValidation>;
+/**
+ * Check if machine keys exist.
+ *
+ * Returns true only if ALL required key files exist. If some files are missing,
+ * returns false and logs a warning about partial state.
+ * @param keysDir - Directory for machine keys (e.g. `~/.makaio/keys`)
+ * @returns true if all required key files exist
+ */
+declare function machineKeysExist(keysDir: string): Promise<boolean>;
+//#endregion
+export { type MachineKeyStatus, type MachineKeyValidation, type PersistedMachineIdentity, loadOrCreateMachineIdentity, machineKeysExist, validateMachineKeys };

package/dist/node/machine-identity/index.mjs

@@ -0,0 +1,3 @@
+import{execFileSync as e}from"node:child_process";import*as t from"node:fs/promises";import*as n from"node:path";import*as r from"node:fs";const i=5e3;function a(e){if(!e)return;let t=e.trim().toLowerCase();if(/^[0-9a-f]{32}$/.test(t))return t;if(/^\{?[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}\}?$/.test(t))return t.replace(/[{}]/g,``)}function o(){try{switch(process.platform){case`darwin`:return s();case`linux`:return c();case`win32`:return l();default:return}}catch{return}}function s(){let t=e(`/usr/sbin/ioreg`,[`-rd1`,`-c`,`IOPlatformExpertDevice`],{encoding:`utf-8`,timeout:i});return a(/"IOPlatformUUID"\s*=\s*"([^"]+)"/.exec(t)?.[1])}function c(){for(let e of[`/etc/machine-id`,`/var/lib/dbus/machine-id`])try{let t=a(r.readFileSync(e,`utf-8`));if(t)return t}catch{}}function l(){let t=e(`${process.env.SystemRoot??`C:\\Windows`}\\System32\\reg.exe`,[`query`,`HKLM\\SOFTWARE\\Microsoft\\Cryptography`,`/v`,`MachineGuid`],{encoding:`utf-8`,timeout:i});return a(/MachineGuid\s+REG_SZ\s+([^\r\n]+)/.exec(t)?.[1])}const u=new Map;async function d(e){try{let n=a(await t.readFile(e,`utf-8`));return n||console.warn(`[machine-keys] Ignoring malformed cached machine.id at ${e}.`),n}catch(e){if(e.code===`ENOENT`)return;throw e}}async function f(e){return e===void 0?o()||(console.warn(`[machine-keys] Falling back to generated machine ID; OS-native machine ID was unavailable.`),globalThis.crypto.randomUUID()):e}async function p(e,n){try{await t.chmod(e,n)}catch(e){let t=e;if(process.platform===`win32`||t.code===`ENOSYS`||t.code===`EINVAL`)return;throw e}}function m(e){let t=e;return{dir:t,ecdhPrivPath:n.join(t,`machine.key`),ecdhPubPath:n.join(t,`machine.pub`),signingPrivPath:n.join(t,`machine-signing.key`),signingPubPath:n.join(t,`machine-signing.pub`),idPath:n.join(t,`machine.id`)}}async function h(e){await new Promise(t=>setTimeout(t,e))}async function g(e){let r=n.join(e,`.machine-keys.lock`),i=Date.now()+5e3;for(;;)try{return{file:await t.open(r,`wx`,384),path:r}}catch(t){if(t.code!==`EEXIST`)throw t;if(Date.now()>=i)throw Error(`[machine-keys] Timed out waiting for initialization lock in ${e}`,{cause:t});await h(50)}}async function _(e){await e.file.close(),await t.unlink(e.path).catch(()=>void 0)}async function v(e,n,r){let i=`${e}.tmp-${process.pid}-${Date.now()}-${Math.random().toString(16).slice(2)}`;try{await t.writeFile(i,n,{mode:r}),await t.rename(i,e)}catch(e){throw await t.unlink(i).catch(()=>void 0),e}}async function y(e,n){let r=await t.readFile(e.ecdhPrivPath,`utf-8`),i=await t.readFile(e.ecdhPubPath,`utf-8`),a=await t.readFile(e.signingPrivPath,`utf-8`),o=await t.readFile(e.signingPubPath,`utf-8`);await w(e.ecdhPrivPath),await w(e.signingPrivPath);let s={privateKey:await A(r,`ECDH`),publicKey:await j(i,`ECDH`)},c={privateKey:await A(a,`ECDSA`),publicKey:await j(o,`ECDSA`)};return{machineId:n,ecdhKeyPair:s,signingKeyPair:c,publicKey:await k(s.publicKey),signingPublicKey:await k(c.publicKey)}}async function b(e,t,n){n!==void 0&&n!==t&&console.warn(`[machine-keys] Hardware ID changed. Regenerating keypairs.`);let r=await globalThis.crypto.subtle.generateKey({name:`ECDH`,namedCurve:`P-256`},!0,[`deriveKey`,`deriveBits`]),i=await globalThis.crypto.subtle.generateKey({name:`ECDSA`,namedCurve:`P-256`},!0,[`sign`,`verify`]),a=await D(r.privateKey),o=await O(r.publicKey),s=await D(i.privateKey),c=await O(i.publicKey);return await v(e.ecdhPrivPath,a,384),await v(e.ecdhPubPath,o,420),await v(e.signingPrivPath,s,384),await v(e.signingPubPath,c,420),await v(e.idPath,t,420),await p(e.ecdhPrivPath,384),await p(e.signingPrivPath,384),r={privateKey:await A(a,`ECDH`),publicKey:r.publicKey},i={privateKey:await A(s,`ECDSA`),publicKey:i.publicKey},{machineId:t,ecdhKeyPair:r,signingKeyPair:i,publicKey:await k(r.publicKey),signingPublicKey:await k(i.publicKey)}}async function x(e){let r=m(e),{dir:i,idPath:a}=r,o=u.get(i);if(o)return o;let s=(async()=>{await t.mkdir(i,{recursive:!0,mode:448});let o=await g(i);try{let t=await d(a),o=await S(e);if(o.status===`complete`&&t===void 0)throw Error(`[machine-keys] Missing or malformed machine.id in ${i} with complete key material present. Refusing to regenerate keys automatically to avoid identity rotation.`);let s=await f(t);if(o.status===`partial`){let e=o.missing.map(e=>n.basename(e)).join(`, `);throw Error(`[machine-keys] Incomplete machine key set in ${i}. Missing files: ${e}. Refusing to regenerate keys automatically because that would replace existing machine identity.`)}return o.status===`complete`&&t===s?await y(r,s):await b(r,s,t)}finally{await _(o)}})();u.set(i,s);try{return await s}finally{u.get(i)===s&&u.delete(i)}}async function S(e){let{idPath:n,ecdhPrivPath:r,ecdhPubPath:i,signingPrivPath:a,signingPubPath:o}=m(e),s=[n,r,i,a,o],c=await Promise.allSettled(s.map(e=>t.access(e).then(()=>e))),l=[],u=[];for(let[e,t]of c.entries())if(t.status===`fulfilled`)l.push(s[e]);else{let n=t.reason;if(n?.code===`ENOENT`)u.push(s[e]);else throw n}return{status:l.length===s.length?`complete`:l.length===0?`missing`:`partial`,existing:l,missing:u}}async function C(e){let t=await S(e);return t.status===`partial`&&console.warn(`Warning: Machine keys in partial state. Missing files:\n${t.missing.map(e=>`  - ${n.basename(e)}`).join(`
+`)}`),t.status===`complete`}async function w(e){let n=(await t.stat(e)).mode&511;(n&63||n&64)&&console.warn(`Warning: ${e} has permissive file mode ${n.toString(8)}. Should be 0o600.`)}function T(e,t){return`-----BEGIN ${e}-----\n${Buffer.from(t).toString(`base64`).match(/.{1,64}/g).join(`
+`)}\n-----END ${e}-----\n`}function E(e,t){let n=e.replace(`-----BEGIN ${t}-----`,``).replace(`-----END ${t}-----`,``).replace(/\s/g,``),r=Buffer.from(n,`base64`);return new Uint8Array(r)}async function D(e){return T(`PRIVATE KEY`,await globalThis.crypto.subtle.exportKey(`pkcs8`,e))}async function O(e){return T(`PUBLIC KEY`,await globalThis.crypto.subtle.exportKey(`spki`,e))}async function k(e){let t=await globalThis.crypto.subtle.exportKey(`raw`,e);return Buffer.from(t).toString(`base64url`)}async function A(e,t){return globalThis.crypto.subtle.importKey(`pkcs8`,E(e,`PRIVATE KEY`),{name:t,namedCurve:`P-256`},!1,t===`ECDH`?[`deriveKey`,`deriveBits`]:[`sign`])}async function j(e,t){return globalThis.crypto.subtle.importKey(`spki`,E(e,`PUBLIC KEY`),{name:t,namedCurve:`P-256`},!0,t===`ECDH`?[]:[`verify`])}export{x as loadOrCreateMachineIdentity,C as machineKeysExist,S as validateMachineKeys};