@onsignet/daemon 0.1.0

package/dist/agent-process.d.ts

@@ -0,0 +1,19 @@
+/**
+ * Managed agent process: spawn, crash detection, restart with exponential backoff (Addendum A1).
+ */
+import type { AgentProcessConfig } from "./config.js";
+export type AgentProcessStatus = "running" | "away" | "stopped";
+export interface AgentProcessState {
+    status: AgentProcessStatus;
+    pid: number | null;
+    restartCount: number;
+    lastExitCode: number | null;
+    lastExitSignal: string | null;
+}
+export declare function createAgentProcessRunner(config: AgentProcessConfig): {
+    getStatus: () => AgentProcessState;
+    start: (onStarted: (_err?: Error) => void) => void;
+    stop: (cb: () => void) => void;
+    clearRestartTimeout: () => void;
+};
+//# sourceMappingURL=agent-process.d.ts.map

package/dist/agent-process.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"agent-process.d.ts","sourceRoot":"","sources":["../src/agent-process.ts"],"names":[],"mappings":"AAAA;;GAEG;AAGH,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAMtD,MAAM,MAAM,kBAAkB,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,CAAC;AAEhE,MAAM,WAAW,iBAAiB;IAChC,MAAM,EAAE,kBAAkB,CAAC;IAC3B,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IACnB,YAAY,EAAE,MAAM,CAAC;IACrB,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;CAC/B;AAED,wBAAgB,wBAAwB,CAAC,MAAM,EAAE,kBAAkB;qBAQ3C,iBAAiB;uBA+Bb,CAAC,IAAI,CAAC,EAAE,KAAK,KAAK,IAAI,KAAG,IAAI;eAwCrC,MAAM,IAAI,KAAG,IAAI;+BA3DH,IAAI;EA4ErC"}

package/dist/agent-process.js

@@ -0,0 +1,102 @@
+"use strict";
+/**
+ * Managed agent process: spawn, crash detection, restart with exponential backoff (Addendum A1).
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createAgentProcessRunner = createAgentProcessRunner;
+const node_child_process_1 = require("node:child_process");
+const BACKOFFS_MS = [1000, 2000, 4000, 8000, 16000];
+const MAX_BACKOFF_MS = 16000;
+const STABILITY_RESET_MS = 5 * 60 * 1000; // 5 minutes
+function createAgentProcessRunner(config) {
+    let child = null;
+    let restartCount = 0;
+    let lastExitCode = null;
+    let lastExitSignal = null;
+    let lastStartTime = 0;
+    let timeoutId = null;
+    function getStatus() {
+        const status = child != null && child.exitCode == null ? "running" : restartCount >= (config.maxRestarts ?? 5) ? "stopped" : "away";
+        return {
+            status,
+            pid: child?.pid ?? null,
+            restartCount,
+            lastExitCode,
+            lastExitSignal,
+        };
+    }
+    function clearRestartTimeout() {
+        if (timeoutId != null) {
+            clearTimeout(timeoutId);
+            timeoutId = null;
+        }
+    }
+    function scheduleRestart(onStarted) {
+        if (!(config.restartOnCrash !== false) || restartCount >= (config.maxRestarts ?? 5)) {
+            onStarted();
+            return;
+        }
+        const backoffMs = BACKOFFS_MS[Math.min(restartCount, BACKOFFS_MS.length - 1)] ?? MAX_BACKOFF_MS;
+        timeoutId = setTimeout(() => {
+            timeoutId = null;
+            start(onStarted);
+        }, backoffMs);
+    }
+    function start(onStarted) {
+        if (child != null && child.exitCode == null) {
+            onStarted();
+            return;
+        }
+        const [cmd, ...args] = config.command.trim().split(/\s+/);
+        if (!cmd) {
+            onStarted(new Error("agent.command is empty"));
+            return;
+        }
+        try {
+            child = (0, node_child_process_1.spawn)(cmd, args, {
+                stdio: "inherit",
+                shell: true,
+                env: process.env,
+            });
+            lastStartTime = Date.now();
+            child.on("exit", (code, signal) => {
+                child = null;
+                lastExitCode = code ?? null;
+                lastExitSignal = signal ?? null;
+                restartCount += 1;
+                if (Date.now() - lastStartTime > STABILITY_RESET_MS) {
+                    restartCount = 0;
+                }
+                scheduleRestart(onStarted);
+            });
+            child.on("error", (_err) => {
+                child = null;
+                lastExitCode = null;
+                lastExitSignal = "error";
+                restartCount += 1;
+                scheduleRestart(onStarted);
+            });
+            onStarted();
+        }
+        catch (err) {
+            onStarted(err instanceof Error ? err : new Error(String(err)));
+        }
+    }
+    function stop(cb) {
+        clearRestartTimeout();
+        if (child == null || child.exitCode != null) {
+            cb();
+            return;
+        }
+        child.once("exit", () => cb());
+        child.kill("SIGTERM");
+        const forceKill = setTimeout(() => {
+            if (child != null && child.exitCode == null) {
+                child.kill("SIGKILL");
+            }
+        }, 10_000);
+        child.once("exit", () => clearTimeout(forceKill));
+    }
+    return { getStatus, start, stop, clearRestartTimeout };
+}
+//# sourceMappingURL=agent-process.js.map

package/dist/agent-process.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"agent-process.js","sourceRoot":"","sources":["../src/agent-process.ts"],"names":[],"mappings":";AAAA;;GAEG;;AAmBH,4DAgGC;AAjHD,2DAA8D;AAG9D,MAAM,WAAW,GAAG,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;AACpD,MAAM,cAAc,GAAG,KAAK,CAAC;AAC7B,MAAM,kBAAkB,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,YAAY;AAYtD,SAAgB,wBAAwB,CAAC,MAA0B;IACjE,IAAI,KAAK,GAAwB,IAAI,CAAC;IACtC,IAAI,YAAY,GAAG,CAAC,CAAC;IACrB,IAAI,YAAY,GAAkB,IAAI,CAAC;IACvC,IAAI,cAAc,GAAkB,IAAI,CAAC;IACzC,IAAI,aAAa,GAAG,CAAC,CAAC;IACtB,IAAI,SAAS,GAAyC,IAAI,CAAC;IAE3D,SAAS,SAAS;QAChB,MAAM,MAAM,GACV,KAAK,IAAI,IAAI,IAAI,KAAK,CAAC,QAAQ,IAAI,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,YAAY,IAAI,CAAC,MAAM,CAAC,WAAW,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC;QACvH,OAAO;YACL,MAAM;YACN,GAAG,EAAE,KAAK,EAAE,GAAG,IAAI,IAAI;YACvB,YAAY;YACZ,YAAY;YACZ,cAAc;SACf,CAAC;IACJ,CAAC;IAED,SAAS,mBAAmB;QAC1B,IAAI,SAAS,IAAI,IAAI,EAAE,CAAC;YACtB,YAAY,CAAC,SAAS,CAAC,CAAC;YACxB,SAAS,GAAG,IAAI,CAAC;QACnB,CAAC;IACH,CAAC;IAED,SAAS,eAAe,CAAC,SAAqB;QAC5C,IAAI,CAAC,CAAC,MAAM,CAAC,cAAc,KAAK,KAAK,CAAC,IAAI,YAAY,IAAI,CAAC,MAAM,CAAC,WAAW,IAAI,CAAC,CAAC,EAAE,CAAC;YACpF,SAAS,EAAE,CAAC;YACZ,OAAO;QACT,CAAC;QACD,MAAM,SAAS,GAAG,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,EAAE,WAAW,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,IAAI,cAAc,CAAC;QAChG,SAAS,GAAG,UAAU,CAAC,GAAG,EAAE;YAC1B,SAAS,GAAG,IAAI,CAAC;YACjB,KAAK,CAAC,SAAS,CAAC,CAAC;QACnB,CAAC,EAAE,SAAS,CAAC,CAAC;IAChB,CAAC;IAED,SAAS,KAAK,CAAC,SAAiC;QAC9C,IAAI,KAAK,IAAI,IAAI,IAAI,KAAK,CAAC,QAAQ,IAAI,IAAI,EAAE,CAAC;YAC5C,SAAS,EAAE,CAAC;YACZ,OAAO;QACT,CAAC;QACD,MAAM,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC1D,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,SAAS,CAAC,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC,CAAC;YAC/C,OAAO;QACT,CAAC;QACD,IAAI,CAAC;YACH,KAAK,GAAG,IAAA,0BAAK,EAAC,GAAG,EAAE,IAAI,EAAE;gBACvB,KAAK,EAAE,SAAS;gBAChB,KAAK,EAAE,IAAI;gBACX,GAAG,EAAE,OAAO,CAAC,GAAG;aACjB,CAAC,CAAC;YACH,aAAa,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YAC3B,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE;gBAChC,KAAK,GAAG,IAAI,CAAC;gBACb,YAAY,GAAG,IAAI,IAAI,IAAI,CAAC;gBAC5B,cAAc,GAAG,MAAM,IAAI,IAAI,CAAC;gBAChC,YAAY,IAAI,CAAC,CAAC;gBAClB,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,aAAa,GAAG,kBAAkB,EAAE,CAAC;oBACpD,YAAY,GAAG,CAAC,CAAC;gBACnB,CAAC;gBACD,eAAe,CAAC,SAAS,CAAC,CAAC;YAC7B,CAAC,CAAC,CAAC;YACH,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE;gBACzB,KAAK,GAAG,IAAI,CAAC;gBACb,YAAY,GAAG,IAAI,CAAC;gBACpB,cAAc,GAAG,OAAO,CAAC;gBACzB,YAAY,IAAI,CAAC,CAAC;gBAClB,eAAe,CAAC,SAAS,CAAC,CAAC;YAC7B,CAAC,CAAC,CAAC;YACH,SAAS,EAAE,CAAC;QACd,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,SAAS,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QACjE,CAAC;IACH,CAAC;IAED,SAAS,IAAI,CAAC,EAAc;QAC1B,mBAAmB,EAAE,CAAC;QACtB,IAAI,KAAK,IAAI,IAAI,IAAI,KAAK,CAAC,QAAQ,IAAI,IAAI,EAAE,CAAC;YAC5C,EAAE,EAAE,CAAC;YACL,OAAO;QACT,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QAC/B,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACtB,MAAM,SAAS,GAAG,UAAU,CAAC,GAAG,EAAE;YAChC,IAAI,KAAK,IAAI,IAAI,IAAI,KAAK,CAAC,QAAQ,IAAI,IAAI,EAAE,CAAC;gBAC5C,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YACxB,CAAC;QACH,CAAC,EAAE,MAAM,CAAC,CAAC;QACX,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC,CAAC;IACpD,CAAC;IAED,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,IAAI,EAAE,mBAAmB,EAAE,CAAC;AACzD,CAAC"}

package/dist/audit-log.d.ts

@@ -0,0 +1,23 @@
+export type AuditEventType = "message_sent" | "message_received" | "connection_up" | "connection_down" | "policy_change" | "message_approved" | "message_denied" | "key_revoked" | "key_self_revoked" | "key_rotated" | "message_rejected_revoked" | "attestation_invalid" | "capability_invalid" | "message_filtered_tier";
+export interface AuditEntry {
+    timestamp: string;
+    event: AuditEventType;
+    messageId?: string;
+    from?: string;
+    to?: string;
+    prevHash: string;
+}
+export declare class AuditLog {
+    private path;
+    private lastHash;
+    constructor(dataDir: string);
+    private hashChain;
+    append(entry: Omit<AuditEntry, "prevHash">): void;
+    /** Read the last N entries (newest last). Returns entries and whether the chain is valid. */
+    readRecent(limit: number): {
+        entries: AuditEntry[];
+        lastHash: string;
+        chainValid: boolean;
+    };
+}
+//# sourceMappingURL=audit-log.d.ts.map

package/dist/audit-log.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit-log.d.ts","sourceRoot":"","sources":["../src/audit-log.ts"],"names":[],"mappings":"AAUA,MAAM,MAAM,cAAc,GACtB,cAAc,GACd,kBAAkB,GAClB,eAAe,GACf,iBAAiB,GACjB,eAAe,GACf,kBAAkB,GAClB,gBAAgB,GAChB,aAAa,GACb,kBAAkB,GAClB,aAAa,GACb,0BAA0B,GAC1B,qBAAqB,GACrB,oBAAoB,GACpB,uBAAuB,CAAC;AAE5B,MAAM,WAAW,UAAU;IACzB,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,cAAc,CAAC;IACtB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,QAAQ,EAAE,MAAM,CAAC;CAClB;AAID,qBAAa,QAAQ;IACnB,OAAO,CAAC,IAAI,CAAS;IACrB,OAAO,CAAC,QAAQ,CAAa;gBAEjB,OAAO,EAAE,MAAM;IAgB3B,OAAO,CAAC,SAAS;IAIjB,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,UAAU,EAAE,UAAU,CAAC,GAAG,IAAI;IASjD,6FAA6F;IAC7F,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG;QAAE,OAAO,EAAE,UAAU,EAAE,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,OAAO,CAAA;KAAE;CA4B5F"}

package/dist/audit-log.js

@@ -0,0 +1,75 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AuditLog = void 0;
+/**
+ * Append-only JSONL audit log with SHA-256 hash chain.
+ */
+const node_fs_1 = require("node:fs");
+const node_path_1 = require("node:path");
+const node_crypto_1 = require("node:crypto");
+const LOG_FILE = "audit.log";
+const MODE_APPEND = 0o600;
+const ZERO_HASH = "0";
+class AuditLog {
+    path;
+    lastHash = ZERO_HASH;
+    constructor(dataDir) {
+        this.path = (0, node_path_1.join)(dataDir, LOG_FILE);
+        if (!(0, node_fs_1.existsSync)(this.path)) {
+            const dir = (0, node_path_1.join)(dataDir);
+            if (!(0, node_fs_1.existsSync)(dir))
+                (0, node_fs_1.mkdirSync)(dir, { recursive: true });
+            this.lastHash = ZERO_HASH;
+        }
+        else {
+            const lines = (0, node_fs_1.readFileSync)(this.path, "utf8").trim().split("\n").filter(Boolean);
+            if (lines.length > 0) {
+                const last = lines[lines.length - 1];
+                const parsed = JSON.parse(last);
+                this.lastHash = parsed.hash ?? ZERO_HASH;
+            }
+        }
+    }
+    hashChain(prevHash, line) {
+        return (0, node_crypto_1.createHash)("sha256").update(prevHash + line).digest("hex");
+    }
+    append(entry) {
+        const withPrev = { ...entry, prevHash: this.lastHash };
+        const line = JSON.stringify(withPrev) + "\n";
+        const hash = this.hashChain(this.lastHash, line);
+        const record = { ...withPrev, hash };
+        (0, node_fs_1.appendFileSync)(this.path, JSON.stringify(record) + "\n", { mode: MODE_APPEND });
+        this.lastHash = hash;
+    }
+    /** Read the last N entries (newest last). Returns entries and whether the chain is valid. */
+    readRecent(limit) {
+        if (!(0, node_fs_1.existsSync)(this.path)) {
+            return { entries: [], lastHash: ZERO_HASH, chainValid: true };
+        }
+        const content = (0, node_fs_1.readFileSync)(this.path, "utf8").trim();
+        const lines = content ? content.split("\n").filter(Boolean) : [];
+        let prevHash = ZERO_HASH;
+        let chainValid = true;
+        const entries = [];
+        for (const line of lines) {
+            const record = JSON.parse(line);
+            const withPrev = (({ hash: _h, ...e }) => e)(record);
+            const lineThatWasHashed = JSON.stringify(withPrev) + "\n";
+            const expectedHash = this.hashChain(prevHash, lineThatWasHashed);
+            if (record.hash !== expectedHash)
+                chainValid = false;
+            prevHash = record.hash ?? prevHash;
+            entries.push(withPrev);
+        }
+        const lastHash = lines.length > 0
+            ? JSON.parse(lines[lines.length - 1]).hash ?? ZERO_HASH
+            : ZERO_HASH;
+        return {
+            entries: entries.slice(-limit),
+            lastHash,
+            chainValid,
+        };
+    }
+}
+exports.AuditLog = AuditLog;
+//# sourceMappingURL=audit-log.js.map

package/dist/audit-log.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit-log.js","sourceRoot":"","sources":["../src/audit-log.ts"],"names":[],"mappings":";;;AAAA;;GAEG;AACH,qCAA8E;AAC9E,yCAAiC;AACjC,6CAAyC;AAEzC,MAAM,QAAQ,GAAG,WAAW,CAAC;AAC7B,MAAM,WAAW,GAAG,KAAK,CAAC;AA2B1B,MAAM,SAAS,GAAG,GAAG,CAAC;AAEtB,MAAa,QAAQ;IACX,IAAI,CAAS;IACb,QAAQ,GAAG,SAAS,CAAC;IAE7B,YAAY,OAAe;QACzB,IAAI,CAAC,IAAI,GAAG,IAAA,gBAAI,EAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QACpC,IAAI,CAAC,IAAA,oBAAU,EAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAC3B,MAAM,GAAG,GAAG,IAAA,gBAAI,EAAC,OAAO,CAAC,CAAC;YAC1B,IAAI,CAAC,IAAA,oBAAU,EAAC,GAAG,CAAC;gBAAE,IAAA,mBAAS,EAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YAC1D,IAAI,CAAC,QAAQ,GAAG,SAAS,CAAC;QAC5B,CAAC;aAAM,CAAC;YACN,MAAM,KAAK,GAAG,IAAA,sBAAY,EAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;YACjF,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACrB,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAE,CAAC;gBACtC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAsB,CAAC;gBACrD,IAAI,CAAC,QAAQ,GAAG,MAAM,CAAC,IAAI,IAAI,SAAS,CAAC;YAC3C,CAAC;QACH,CAAC;IACH,CAAC;IAEO,SAAS,CAAC,QAAgB,EAAE,IAAY;QAC9C,OAAO,IAAA,wBAAU,EAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,QAAQ,GAAG,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACpE,CAAC;IAED,MAAM,CAAC,KAAmC;QACxC,MAAM,QAAQ,GAAe,EAAE,GAAG,KAAK,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC;QACnE,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,GAAG,IAAI,CAAC;QAC7C,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;QACjD,MAAM,MAAM,GAAG,EAAE,GAAG,QAAQ,EAAE,IAAI,EAAE,CAAC;QACrC,IAAA,wBAAc,EAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,GAAG,IAAI,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC;QAChF,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC;IACvB,CAAC;IAED,6FAA6F;IAC7F,UAAU,CAAC,KAAa;QACtB,IAAI,CAAC,IAAA,oBAAU,EAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAC3B,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC;QAChE,CAAC;QACD,MAAM,OAAO,GAAG,IAAA,sBAAY,EAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;QACvD,MAAM,KAAK,GAAG,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACjE,IAAI,QAAQ,GAAG,SAAS,CAAC;QACzB,IAAI,UAAU,GAAG,IAAI,CAAC;QACtB,MAAM,OAAO,GAAiB,EAAE,CAAC;QACjC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAmC,CAAC;YAClE,MAAM,QAAQ,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,CAAe,CAAC;YACnE,MAAM,iBAAiB,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,GAAG,IAAI,CAAC;YAC1D,MAAM,YAAY,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,iBAAiB,CAAC,CAAC;YACjE,IAAI,MAAM,CAAC,IAAI,KAAK,YAAY;gBAAE,UAAU,GAAG,KAAK,CAAC;YACrD,QAAQ,GAAG,MAAM,CAAC,IAAI,IAAI,QAAQ,CAAC;YACnC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACzB,CAAC;QACD,MAAM,QAAQ,GACZ,KAAK,CAAC,MAAM,GAAG,CAAC;YACd,CAAC,CAAE,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAE,CAAuB,CAAC,IAAI,IAAI,SAAS;YAC/E,CAAC,CAAC,SAAS,CAAC;QAChB,OAAO;YACL,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC;YAC9B,QAAQ;YACR,UAAU;SACX,CAAC;IACJ,CAAC;CACF;AA9DD,4BA8DC"}

package/dist/config.d.ts

@@ -0,0 +1,30 @@
+export declare const DEFAULT_DATA_DIR: string;
+/** Optional managed agent process (Addendum A1). */
+export interface AgentProcessConfig {
+    /** Command to run (e.g. "node my-agent.js"). */
+    command: string;
+    /** Optional HTTP health check URL (e.g. "http://localhost:3000/health"). */
+    healthCheck?: string;
+    /** Restart agent on crash with exponential backoff. Default true. */
+    restartOnCrash?: boolean;
+    /** Max restarts before giving up; daemon keeps running. Default 5. */
+    maxRestarts?: number;
+}
+export interface DaemonConfig {
+    dataDir: string;
+    relayUrl: string;
+    httpPort: number;
+    httpHost: string;
+    /** Optional webhook URL for OpenClaw (daemon POSTs delivered messages here). */
+    openclawWebhookUrl?: string;
+    /** Optional secret for HMAC signing webhook payloads. */
+    openclawWebhookSecret?: string;
+    /** Optional marketplace API URL (legacy). Prefer directoryApiUrl for directory. */
+    marketplaceApiUrl?: string;
+    /** Optional directory API URL for profile, contacts, search (e.g. http://localhost:3001). */
+    directoryApiUrl?: string;
+    /** Optional managed agent process (signet start managed mode). */
+    agent?: AgentProcessConfig;
+}
+export declare function loadConfig(): DaemonConfig;
+//# sourceMappingURL=config.d.ts.map

package/dist/config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAQA,eAAO,MAAM,gBAAgB,QAA6B,CAAC;AAI3D,oDAAoD;AACpD,MAAM,WAAW,kBAAkB;IACjC,gDAAgD;IAChD,OAAO,EAAE,MAAM,CAAC;IAChB,4EAA4E;IAC5E,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,qEAAqE;IACrE,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,sEAAsE;IACtE,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,YAAY;IAC3B,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,gFAAgF;IAChF,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,yDAAyD;IACzD,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,mFAAmF;IACnF,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,6FAA6F;IAC7F,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,kEAAkE;IAClE,KAAK,CAAC,EAAE,kBAAkB,CAAC;CAC5B;AAmFD,wBAAgB,UAAU,IAAI,YAAY,CAqCzC"}

package/dist/config.js

@@ -0,0 +1,104 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DEFAULT_DATA_DIR = void 0;
+exports.loadConfig = loadConfig;
+/**
+ * Daemon config: ~/.agentmesh/config.json (or ~/.config/agentmesh/config.json on Linux),
+ * then dataDir/config.json, then env. Env overrides file. No secrets in config file.
+ */
+const node_fs_1 = require("node:fs");
+const node_path_1 = require("node:path");
+const node_os_1 = require("node:os");
+exports.DEFAULT_DATA_DIR = (0, node_path_1.join)((0, node_os_1.homedir)(), ".Signet");
+const DEFAULT_RELAY_URL = "wss://relay.onsignet.com";
+const DEFAULT_HTTP_PORT = 8766;
+function loadJson(path) {
+    if (!(0, node_fs_1.existsSync)(path))
+        return null;
+    try {
+        const raw = (0, node_fs_1.readFileSync)(path, "utf8");
+        return JSON.parse(raw);
+    }
+    catch {
+        return null;
+    }
+}
+function getStandardConfigPaths() {
+    const home = (0, node_os_1.homedir)();
+    const paths = [(0, node_path_1.join)(home, ".agentmesh", "config.json")];
+    if ((0, node_os_1.platform)() === "linux") {
+        paths.push((0, node_path_1.join)(home, ".config", "agentmesh", "config.json"));
+    }
+    return paths;
+}
+function isValidUrl(s) {
+    try {
+        const u = new URL(s);
+        return u.protocol === "ws:" || u.protocol === "wss:" || u.protocol === "http:" || u.protocol === "https:";
+    }
+    catch {
+        return false;
+    }
+}
+function validateAndApply(fromFile, dataDir) {
+    const relayUrl = process.env.SIGNET_RELAY_URL ?? fromFile?.relayUrl ?? fromFile?.relay_url ?? DEFAULT_RELAY_URL;
+    const httpPortRaw = process.env.SIGNET_HTTP_PORT ?? fromFile?.httpPort ?? fromFile?.http_port ?? DEFAULT_HTTP_PORT;
+    const httpPort = Number(httpPortRaw);
+    const httpHost = process.env.SIGNET_HTTP_HOST ?? fromFile?.httpHost ?? fromFile?.http_host ?? "127.0.0.1";
+    const resolvedDataDir = process.env.SIGNET_DATA_DIR ?? fromFile?.data_dir ?? dataDir;
+    if (!Number.isInteger(httpPort) || httpPort < 1 || httpPort > 65535) {
+        throw new Error(`Invalid config: httpPort must be 1-65535, got: ${httpPortRaw}`);
+    }
+    if (!isValidUrl(relayUrl)) {
+        throw new Error(`Invalid config: relayUrl must be a valid ws/wss/http/https URL, got: ${relayUrl}`);
+    }
+    const marketplaceApiUrl = process.env.MARKETPLACE_API_URL ?? fromFile?.marketplace_api_url;
+    const directoryApiUrl = process.env.DIRECTORY_API_URL ?? fromFile?.directory_api_url ?? marketplaceApiUrl;
+    const openclawWebhookUrl = process.env.SIGNET_OPENCLAW_WEBHOOK_URL ?? fromFile?.openclaw_webhook_url;
+    const openclawWebhookSecret = process.env.SIGNET_OPENCLAW_WEBHOOK_SECRET ?? fromFile?.openclaw_webhook_secret;
+    return {
+        relayUrl,
+        httpPort,
+        httpHost,
+        dataDir: resolvedDataDir,
+        ...(marketplaceApiUrl !== undefined && marketplaceApiUrl !== "" && { marketplaceApiUrl }),
+        ...(directoryApiUrl !== undefined && directoryApiUrl !== "" && { directoryApiUrl }),
+        ...(openclawWebhookUrl !== undefined && openclawWebhookUrl !== "" && { openclawWebhookUrl }),
+        ...(openclawWebhookSecret !== undefined && openclawWebhookSecret !== "" && { openclawWebhookSecret }),
+    };
+}
+function loadConfig() {
+    const defaultDataDir = process.env.SIGNET_DATA_DIR ?? exports.DEFAULT_DATA_DIR;
+    const standardPaths = getStandardConfigPaths();
+    const dataDirConfigPath = (0, node_path_1.join)(defaultDataDir, "config.json");
+    let fromFile = null;
+    for (const p of standardPaths) {
+        fromFile = loadJson(p);
+        if (fromFile != null)
+            break;
+    }
+    if (fromFile == null) {
+        fromFile = loadJson(dataDirConfigPath);
+    }
+    const applied = validateAndApply(fromFile, defaultDataDir);
+    const agent = fromFile?.agent?.command != null
+        ? {
+            command: fromFile.agent.command,
+            ...(fromFile.agent.healthCheck != null && fromFile.agent.healthCheck !== "" && { healthCheck: fromFile.agent.healthCheck }),
+            restartOnCrash: fromFile.agent.restartOnCrash !== false,
+            maxRestarts: typeof fromFile.agent.maxRestarts === "number" ? fromFile.agent.maxRestarts : 5,
+        }
+        : undefined;
+    return {
+        dataDir: applied.dataDir,
+        relayUrl: applied.relayUrl,
+        httpPort: applied.httpPort,
+        httpHost: applied.httpHost,
+        ...(applied.openclawWebhookUrl !== undefined && { openclawWebhookUrl: applied.openclawWebhookUrl }),
+        ...(applied.openclawWebhookSecret !== undefined && { openclawWebhookSecret: applied.openclawWebhookSecret }),
+        ...(applied.marketplaceApiUrl !== undefined && { marketplaceApiUrl: applied.marketplaceApiUrl }),
+        ...(applied.directoryApiUrl !== undefined && { directoryApiUrl: applied.directoryApiUrl }),
+        ...(agent !== undefined && { agent }),
+    };
+}
+//# sourceMappingURL=config.js.map

package/dist/config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":";;;AA0HA,gCAqCC;AA/JD;;;GAGG;AACH,qCAAmD;AACnD,yCAAiC;AACjC,qCAA4C;AAE/B,QAAA,gBAAgB,GAAG,IAAA,gBAAI,EAAC,IAAA,iBAAO,GAAE,EAAE,SAAS,CAAC,CAAC;AAC3D,MAAM,iBAAiB,GAAG,0BAA0B,CAAC;AACrD,MAAM,iBAAiB,GAAG,IAAI,CAAC;AAmD/B,SAAS,QAAQ,CAAI,IAAY;IAC/B,IAAI,CAAC,IAAA,oBAAU,EAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACnC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAA,sBAAY,EAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACvC,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAM,CAAC;IAC9B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,sBAAsB;IAC7B,MAAM,IAAI,GAAG,IAAA,iBAAO,GAAE,CAAC;IACvB,MAAM,KAAK,GAAG,CAAC,IAAA,gBAAI,EAAC,IAAI,EAAE,YAAY,EAAE,aAAa,CAAC,CAAC,CAAC;IACxD,IAAI,IAAA,kBAAQ,GAAE,KAAK,OAAO,EAAE,CAAC;QAC3B,KAAK,CAAC,IAAI,CAAC,IAAA,gBAAI,EAAC,IAAI,EAAE,SAAS,EAAE,WAAW,EAAE,aAAa,CAAC,CAAC,CAAC;IAChE,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,UAAU,CAAC,CAAS;IAC3B,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC;QACrB,OAAO,CAAC,CAAC,QAAQ,KAAK,KAAK,IAAI,CAAC,CAAC,QAAQ,KAAK,MAAM,IAAI,CAAC,CAAC,QAAQ,KAAK,OAAO,IAAI,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC;IAC5G,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,SAAS,gBAAgB,CACvB,QAAgC,EAChC,OAAe;IAEf,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,gBAAgB,IAAI,QAAQ,EAAE,QAAQ,IAAI,QAAQ,EAAE,SAAS,IAAI,iBAAiB,CAAC;IAChH,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,gBAAgB,IAAI,QAAQ,EAAE,QAAQ,IAAI,QAAQ,EAAE,SAAS,IAAI,iBAAiB,CAAC;IACnH,MAAM,QAAQ,GAAG,MAAM,CAAC,WAAW,CAAC,CAAC;IACrC,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,gBAAgB,IAAI,QAAQ,EAAE,QAAQ,IAAI,QAAQ,EAAE,SAAS,IAAI,WAAW,CAAC;IAC1G,MAAM,eAAe,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,IAAI,QAAQ,EAAE,QAAQ,IAAI,OAAO,CAAC;IAErF,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,QAAQ,GAAG,CAAC,IAAI,QAAQ,GAAG,KAAK,EAAE,CAAC;QACpE,MAAM,IAAI,KAAK,CAAC,kDAAkD,WAAW,EAAE,CAAC,CAAC;IACnF,CAAC;IACD,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CAAC,wEAAwE,QAAQ,EAAE,CAAC,CAAC;IACtG,CAAC;IACD,MAAM,iBAAiB,GAAG,OAAO,CAAC,GAAG,CAAC,mBAAmB,IAAI,QAAQ,EAAE,mBAAmB,CAAC;IAC3F,MAAM,eAAe,GAAG,OAAO,CAAC,GAAG,CAAC,iBAAiB,IAAI,QAAQ,EAAE,iBAAiB,IAAI,iBAAiB,CAAC;IAC1G,MAAM,kBAAkB,GAAG,OAAO,CAAC,GAAG,CAAC,2BAA2B,IAAI,QAAQ,EAAE,oBAAoB,CAAC;IACrG,MAAM,qBAAqB,GAAG,OAAO,CAAC,GAAG,CAAC,8BAA8B,IAAI,QAAQ,EAAE,uBAAuB,CAAC;IAE9G,OAAO;QACL,QAAQ;QACR,QAAQ;QACR,QAAQ;QACR,OAAO,EAAE,eAAe;QACxB,GAAG,CAAC,iBAAiB,KAAK,SAAS,IAAI,iBAAiB,KAAK,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC;QACzF,GAAG,CAAC,eAAe,KAAK,SAAS,IAAI,eAAe,KAAK,EAAE,IAAI,EAAE,eAAe,EAAE,CAAC;QACnF,GAAG,CAAC,kBAAkB,KAAK,SAAS,IAAI,kBAAkB,KAAK,EAAE,IAAI,EAAE,kBAAkB,EAAE,CAAC;QAC5F,GAAG,CAAC,qBAAqB,KAAK,SAAS,IAAI,qBAAqB,KAAK,EAAE,IAAI,EAAE,qBAAqB,EAAE,CAAC;KACtG,CAAC;AACJ,CAAC;AAED,SAAgB,UAAU;IACxB,MAAM,cAAc,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,IAAI,wBAAgB,CAAC;IACvE,MAAM,aAAa,GAAG,sBAAsB,EAAE,CAAC;IAC/C,MAAM,iBAAiB,GAAG,IAAA,gBAAI,EAAC,cAAc,EAAE,aAAa,CAAC,CAAC;IAE9D,IAAI,QAAQ,GAA2B,IAAI,CAAC;IAC5C,KAAK,MAAM,CAAC,IAAI,aAAa,EAAE,CAAC;QAC9B,QAAQ,GAAG,QAAQ,CAAkB,CAAC,CAAC,CAAC;QACxC,IAAI,QAAQ,IAAI,IAAI;YAAE,MAAM;IAC9B,CAAC;IACD,IAAI,QAAQ,IAAI,IAAI,EAAE,CAAC;QACrB,QAAQ,GAAG,QAAQ,CAAkB,iBAAiB,CAAC,CAAC;IAC1D,CAAC;IAED,MAAM,OAAO,GAAG,gBAAgB,CAAC,QAAQ,EAAE,cAAc,CAAC,CAAC;IAE3D,MAAM,KAAK,GACT,QAAQ,EAAE,KAAK,EAAE,OAAO,IAAI,IAAI;QAC9B,CAAC,CAAC;YACE,OAAO,EAAE,QAAQ,CAAC,KAAK,CAAC,OAAO;YAC/B,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,WAAW,IAAI,IAAI,IAAI,QAAQ,CAAC,KAAK,CAAC,WAAW,KAAK,EAAE,IAAI,EAAE,WAAW,EAAE,QAAQ,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC;YAC3H,cAAc,EAAE,QAAQ,CAAC,KAAK,CAAC,cAAc,KAAK,KAAK;YACvD,WAAW,EAAE,OAAO,QAAQ,CAAC,KAAK,CAAC,WAAW,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;SAC7F;QACH,CAAC,CAAC,SAAS,CAAC;IAEhB,OAAO;QACL,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,GAAG,CAAC,OAAO,CAAC,kBAAkB,KAAK,SAAS,IAAI,EAAE,kBAAkB,EAAE,OAAO,CAAC,kBAAkB,EAAE,CAAC;QACnG,GAAG,CAAC,OAAO,CAAC,qBAAqB,KAAK,SAAS,IAAI,EAAE,qBAAqB,EAAE,OAAO,CAAC,qBAAqB,EAAE,CAAC;QAC5G,GAAG,CAAC,OAAO,CAAC,iBAAiB,KAAK,SAAS,IAAI,EAAE,iBAAiB,EAAE,OAAO,CAAC,iBAAiB,EAAE,CAAC;QAChG,GAAG,CAAC,OAAO,CAAC,eAAe,KAAK,SAAS,IAAI,EAAE,eAAe,EAAE,OAAO,CAAC,eAAe,EAAE,CAAC;QAC1F,GAAG,CAAC,KAAK,KAAK,SAAS,IAAI,EAAE,KAAK,EAAE,CAAC;KACtC,CAAC;AACJ,CAAC"}

package/dist/errors.d.ts

@@ -0,0 +1,23 @@
+/**
+ * API error codes for stable client handling (product plan Section 20.4).
+ * Use in JSON responses as { error: string, code?: string }.
+ */
+export declare const ErrorCodes: {
+    readonly E_RELAY_DOWN: "E_RELAY_DOWN";
+    readonly E_RECIPIENT_OFFLINE: "E_RECIPIENT_OFFLINE";
+    readonly E_UNKNOWN_RECIPIENT: "E_UNKNOWN_RECIPIENT";
+    readonly E_INVALID_SIGNATURE: "E_INVALID_SIGNATURE";
+    readonly E_EXPIRED_CAPABILITY: "E_EXPIRED_CAPABILITY";
+    readonly E_INSUFFICIENT_CAPABILITY: "E_INSUFFICIENT_CAPABILITY";
+    readonly E_RATE_LIMITED: "E_RATE_LIMITED";
+    readonly E_DECRYPTION_FAILED: "E_DECRYPTION_FAILED";
+    readonly E_POLICY_DENIED: "E_POLICY_DENIED";
+    readonly E_HUMAN_DENIED: "E_HUMAN_DENIED";
+};
+export type ErrorCode = (typeof ErrorCodes)[keyof typeof ErrorCodes];
+export interface ApiErrorResponse {
+    error: string;
+    code?: ErrorCode;
+}
+export declare function apiError(message: string, code?: ErrorCode): ApiErrorResponse;
+//# sourceMappingURL=errors.d.ts.map

package/dist/errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,eAAO,MAAM,UAAU;;;;;;;;;;;CAWb,CAAC;AAEX,MAAM,MAAM,SAAS,GAAG,CAAC,OAAO,UAAU,CAAC,CAAC,MAAM,OAAO,UAAU,CAAC,CAAC;AAErE,MAAM,WAAW,gBAAgB;IAC/B,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,SAAS,CAAC;CAClB;AAED,wBAAgB,QAAQ,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,SAAS,GAAG,gBAAgB,CAE5E"}

package/dist/errors.js

@@ -0,0 +1,24 @@
+"use strict";
+/**
+ * API error codes for stable client handling (product plan Section 20.4).
+ * Use in JSON responses as { error: string, code?: string }.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ErrorCodes = void 0;
+exports.apiError = apiError;
+exports.ErrorCodes = {
+    E_RELAY_DOWN: "E_RELAY_DOWN",
+    E_RECIPIENT_OFFLINE: "E_RECIPIENT_OFFLINE",
+    E_UNKNOWN_RECIPIENT: "E_UNKNOWN_RECIPIENT",
+    E_INVALID_SIGNATURE: "E_INVALID_SIGNATURE",
+    E_EXPIRED_CAPABILITY: "E_EXPIRED_CAPABILITY",
+    E_INSUFFICIENT_CAPABILITY: "E_INSUFFICIENT_CAPABILITY",
+    E_RATE_LIMITED: "E_RATE_LIMITED",
+    E_DECRYPTION_FAILED: "E_DECRYPTION_FAILED",
+    E_POLICY_DENIED: "E_POLICY_DENIED",
+    E_HUMAN_DENIED: "E_HUMAN_DENIED",
+};
+function apiError(message, code) {
+    return code ? { error: message, code } : { error: message };
+}
+//# sourceMappingURL=errors.js.map

package/dist/errors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":";AAAA;;;GAGG;;;AAsBH,4BAEC;AAtBY,QAAA,UAAU,GAAG;IACxB,YAAY,EAAE,cAAc;IAC5B,mBAAmB,EAAE,qBAAqB;IAC1C,mBAAmB,EAAE,qBAAqB;IAC1C,mBAAmB,EAAE,qBAAqB;IAC1C,oBAAoB,EAAE,sBAAsB;IAC5C,yBAAyB,EAAE,2BAA2B;IACtD,cAAc,EAAE,gBAAgB;IAChC,mBAAmB,EAAE,qBAAqB;IAC1C,eAAe,EAAE,iBAAiB;IAClC,cAAc,EAAE,gBAAgB;CACxB,CAAC;AASX,SAAgB,QAAQ,CAAC,OAAe,EAAE,IAAgB;IACxD,OAAO,IAAI,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;AAC9D,CAAC"}

package/dist/identity.d.ts

@@ -0,0 +1,39 @@
+/**
+ * Identity management: generate on first run, store in dataDir with restrictive permissions.
+ */
+import { type Ed25519KeyPair, type X25519KeyPair } from "@onsignet/core";
+export interface StoredIdentity {
+    nodeId: string;
+    ed25519PublicKey: string;
+    ed25519SecretKey: string;
+    x25519PublicKey: string;
+    x25519SecretKey: string;
+}
+export interface StoredOwner {
+    publicKey: string;
+    secretKey: string;
+}
+export interface LoadedIdentity {
+    nodeId: string;
+    ed25519: Ed25519KeyPair;
+    x25519: X25519KeyPair;
+}
+export interface LoadedOwner {
+    ed25519: Ed25519KeyPair;
+}
+export declare function ensureDataDir(dataDir: string): void;
+export declare function loadOrCreateIdentity(dataDir: string): LoadedIdentity;
+export declare function loadOrCreateOwner(dataDir: string): LoadedOwner;
+/**
+ * Create owner attestation: sign("Signet owner attestation: agent <nodeId>").
+ */
+export declare function createOwnerAttestation(agentNodeId: string, ownerSecretKey: Uint8Array): string;
+/**
+ * Rotate agent identity: generate new keypair, backup old, return new identity.
+ * Caller is responsible for revoking the old key and reconnecting to the relay.
+ */
+export declare function rotateIdentity(dataDir: string): {
+    oldIdentity: LoadedIdentity;
+    newIdentity: LoadedIdentity;
+};
+//# sourceMappingURL=identity.d.ts.map

package/dist/identity.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity.d.ts","sourceRoot":"","sources":["../src/identity.ts"],"names":[],"mappings":"AAAA;;GAEG;AAIH,OAAO,EAML,KAAK,cAAc,EACnB,KAAK,aAAa,EACnB,MAAM,gBAAgB,CAAC;AAMxB,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,MAAM,CAAC;IACf,gBAAgB,EAAE,MAAM,CAAC;IACzB,gBAAgB,EAAE,MAAM,CAAC;IACzB,eAAe,EAAE,MAAM,CAAC;IACxB,eAAe,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,WAAW;IAC1B,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,cAAc,CAAC;IACxB,MAAM,EAAE,aAAa,CAAC;CACvB;AAED,MAAM,WAAW,WAAW;IAC1B,OAAO,EAAE,cAAc,CAAC;CACzB;AAID,wBAAgB,aAAa,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAEnD;AAED,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,MAAM,GAAG,cAAc,CA4BpE;AAED,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,GAAG,WAAW,CAoB9D;AAED;;GAEG;AACH,wBAAgB,sBAAsB,CAAC,WAAW,EAAE,MAAM,EAAE,cAAc,EAAE,UAAU,GAAG,MAAM,CAI9F;AAED;;;GAGG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAAE,MAAM,GAAG;IAAE,WAAW,EAAE,cAAc,CAAC;IAAC,WAAW,EAAE,cAAc,CAAA;CAAE,CA0B5G"}

package/dist/identity.js

@@ -0,0 +1,107 @@
+"use strict";
+/**
+ * Identity management: generate on first run, store in dataDir with restrictive permissions.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ensureDataDir = ensureDataDir;
+exports.loadOrCreateIdentity = loadOrCreateIdentity;
+exports.loadOrCreateOwner = loadOrCreateOwner;
+exports.createOwnerAttestation = createOwnerAttestation;
+exports.rotateIdentity = rotateIdentity;
+const fs_1 = require("fs");
+const path_1 = require("path");
+const core_1 = require("@onsignet/core");
+const IDENTITY_FILE = "identity.json";
+const OWNER_FILE = "owner.json";
+const MODE_RESTRICT = 0o600;
+const ATTESTATION_PREFIX = "Signet owner attestation: agent ";
+function ensureDataDir(dataDir) {
+    if (!(0, fs_1.existsSync)(dataDir))
+        (0, fs_1.mkdirSync)(dataDir, { recursive: true, mode: 0o700 });
+}
+function loadOrCreateIdentity(dataDir) {
+    ensureDataDir(dataDir);
+    const path = (0, path_1.join)(dataDir, IDENTITY_FILE);
+    if ((0, fs_1.existsSync)(path)) {
+        const raw = (0, fs_1.readFileSync)(path, "utf8");
+        const stored = JSON.parse(raw);
+        return {
+            nodeId: stored.nodeId,
+            ed25519: {
+                publicKey: (0, core_1.decodeBase64)(stored.ed25519PublicKey),
+                secretKey: (0, core_1.decodeBase64)(stored.ed25519SecretKey),
+            },
+            x25519: {
+                publicKey: (0, core_1.decodeBase64)(stored.x25519PublicKey),
+                secretKey: (0, core_1.decodeBase64)(stored.x25519SecretKey),
+            },
+        };
+    }
+    const identity = (0, core_1.createAgentIdentity)();
+    const stored = {
+        nodeId: identity.nodeId,
+        ed25519PublicKey: (0, core_1.encodeBase64)(identity.ed25519.publicKey),
+        ed25519SecretKey: (0, core_1.encodeBase64)(identity.ed25519.secretKey),
+        x25519PublicKey: (0, core_1.encodeBase64)(identity.x25519.publicKey),
+        x25519SecretKey: (0, core_1.encodeBase64)(identity.x25519.secretKey),
+    };
+    (0, fs_1.writeFileSync)(path, JSON.stringify(stored, null, 0), { mode: MODE_RESTRICT });
+    return identity;
+}
+function loadOrCreateOwner(dataDir) {
+    ensureDataDir(dataDir);
+    const path = (0, path_1.join)(dataDir, OWNER_FILE);
+    if ((0, fs_1.existsSync)(path)) {
+        const raw = (0, fs_1.readFileSync)(path, "utf8");
+        const stored = JSON.parse(raw);
+        return {
+            ed25519: {
+                publicKey: (0, core_1.decodeBase64)(stored.publicKey),
+                secretKey: (0, core_1.decodeBase64)(stored.secretKey),
+            },
+        };
+    }
+    const kp = (0, core_1.generateEd25519KeyPair)();
+    const stored = {
+        publicKey: (0, core_1.encodeBase64)(kp.publicKey),
+        secretKey: (0, core_1.encodeBase64)(kp.secretKey),
+    };
+    (0, fs_1.writeFileSync)(path, JSON.stringify(stored, null, 0), { mode: MODE_RESTRICT });
+    return { ed25519: kp };
+}
+/**
+ * Create owner attestation: sign("Signet owner attestation: agent <nodeId>").
+ */
+function createOwnerAttestation(agentNodeId, ownerSecretKey) {
+    const statement = ATTESTATION_PREFIX + agentNodeId;
+    const sig = (0, core_1.sign)(new TextEncoder().encode(statement), ownerSecretKey);
+    return (0, core_1.encodeBase64)(sig);
+}
+/**
+ * Rotate agent identity: generate new keypair, backup old, return new identity.
+ * Caller is responsible for revoking the old key and reconnecting to the relay.
+ */
+function rotateIdentity(dataDir) {
+    ensureDataDir(dataDir);
+    const identityPath = (0, path_1.join)(dataDir, IDENTITY_FILE);
+    // Load current identity
+    const oldIdentity = loadOrCreateIdentity(dataDir);
+    // Backup old identity
+    const backupPath = (0, path_1.join)(dataDir, `identity.${Date.now()}.backup.json`);
+    if ((0, fs_1.existsSync)(identityPath)) {
+        const raw = (0, fs_1.readFileSync)(identityPath, "utf8");
+        (0, fs_1.writeFileSync)(backupPath, raw, { mode: MODE_RESTRICT });
+    }
+    // Generate new identity
+    const newIdent = (0, core_1.createAgentIdentity)();
+    const stored = {
+        nodeId: newIdent.nodeId,
+        ed25519PublicKey: (0, core_1.encodeBase64)(newIdent.ed25519.publicKey),
+        ed25519SecretKey: (0, core_1.encodeBase64)(newIdent.ed25519.secretKey),
+        x25519PublicKey: (0, core_1.encodeBase64)(newIdent.x25519.publicKey),
+        x25519SecretKey: (0, core_1.encodeBase64)(newIdent.x25519.secretKey),
+    };
+    (0, fs_1.writeFileSync)(identityPath, JSON.stringify(stored, null, 0), { mode: MODE_RESTRICT });
+    return { oldIdentity, newIdentity: newIdent };
+}
+//# sourceMappingURL=identity.js.map

package/dist/identity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity.js","sourceRoot":"","sources":["../src/identity.ts"],"names":[],"mappings":";AAAA;;GAEG;;AA2CH,sCAEC;AAED,oDA4BC;AAED,8CAoBC;AAKD,wDAIC;AAMD,wCA0BC;AAxID,2BAAwE;AACxE,+BAA4B;AAC5B,yCAQwB;AAExB,MAAM,aAAa,GAAG,eAAe,CAAC;AACtC,MAAM,UAAU,GAAG,YAAY,CAAC;AAChC,MAAM,aAAa,GAAG,KAAK,CAAC;AAyB5B,MAAM,kBAAkB,GAAG,kCAAkC,CAAC;AAE9D,SAAgB,aAAa,CAAC,OAAe;IAC3C,IAAI,CAAC,IAAA,eAAU,EAAC,OAAO,CAAC;QAAE,IAAA,cAAS,EAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;AACjF,CAAC;AAED,SAAgB,oBAAoB,CAAC,OAAe;IAClD,aAAa,CAAC,OAAO,CAAC,CAAC;IACvB,MAAM,IAAI,GAAG,IAAA,WAAI,EAAC,OAAO,EAAE,aAAa,CAAC,CAAC;IAC1C,IAAI,IAAA,eAAU,EAAC,IAAI,CAAC,EAAE,CAAC;QACrB,MAAM,GAAG,GAAG,IAAA,iBAAY,EAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACvC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAmB,CAAC;QACjD,OAAO;YACL,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,OAAO,EAAE;gBACP,SAAS,EAAE,IAAA,mBAAY,EAAC,MAAM,CAAC,gBAAgB,CAAC;gBAChD,SAAS,EAAE,IAAA,mBAAY,EAAC,MAAM,CAAC,gBAAgB,CAAC;aACjD;YACD,MAAM,EAAE;gBACN,SAAS,EAAE,IAAA,mBAAY,EAAC,MAAM,CAAC,eAAe,CAAC;gBAC/C,SAAS,EAAE,IAAA,mBAAY,EAAC,MAAM,CAAC,eAAe,CAAC;aAChD;SACF,CAAC;IACJ,CAAC;IACD,MAAM,QAAQ,GAAG,IAAA,0BAAmB,GAAE,CAAC;IACvC,MAAM,MAAM,GAAmB;QAC7B,MAAM,EAAE,QAAQ,CAAC,MAAM;QACvB,gBAAgB,EAAE,IAAA,mBAAY,EAAC,QAAQ,CAAC,OAAO,CAAC,SAAS,CAAC;QAC1D,gBAAgB,EAAE,IAAA,mBAAY,EAAC,QAAQ,CAAC,OAAO,CAAC,SAAS,CAAC;QAC1D,eAAe,EAAE,IAAA,mBAAY,EAAC,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC;QACxD,eAAe,EAAE,IAAA,mBAAY,EAAC,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC;KACzD,CAAC;IACF,IAAA,kBAAa,EAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC,CAAC;IAC9E,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAgB,iBAAiB,CAAC,OAAe;IAC/C,aAAa,CAAC,OAAO,CAAC,CAAC;IACvB,MAAM,IAAI,GAAG,IAAA,WAAI,EAAC,OAAO,EAAE,UAAU,CAAC,CAAC;IACvC,IAAI,IAAA,eAAU,EAAC,IAAI,CAAC,EAAE,CAAC;QACrB,MAAM,GAAG,GAAG,IAAA,iBAAY,EAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACvC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAgB,CAAC;QAC9C,OAAO;YACL,OAAO,EAAE;gBACP,SAAS,EAAE,IAAA,mBAAY,EAAC,MAAM,CAAC,SAAS,CAAC;gBACzC,SAAS,EAAE,IAAA,mBAAY,EAAC,MAAM,CAAC,SAAS,CAAC;aAC1C;SACF,CAAC;IACJ,CAAC;IACD,MAAM,EAAE,GAAG,IAAA,6BAAsB,GAAE,CAAC;IACpC,MAAM,MAAM,GAAgB;QAC1B,SAAS,EAAE,IAAA,mBAAY,EAAC,EAAE,CAAC,SAAS,CAAC;QACrC,SAAS,EAAE,IAAA,mBAAY,EAAC,EAAE,CAAC,SAAS,CAAC;KACtC,CAAC;IACF,IAAA,kBAAa,EAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC,CAAC;IAC9E,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;AACzB,CAAC;AAED;;GAEG;AACH,SAAgB,sBAAsB,CAAC,WAAmB,EAAE,cAA0B;IACpF,MAAM,SAAS,GAAG,kBAAkB,GAAG,WAAW,CAAC;IACnD,MAAM,GAAG,GAAG,IAAA,WAAI,EAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,cAAc,CAAC,CAAC;IACtE,OAAO,IAAA,mBAAY,EAAC,GAAG,CAAC,CAAC;AAC3B,CAAC;AAED;;;GAGG;AACH,SAAgB,cAAc,CAAC,OAAe;IAC5C,aAAa,CAAC,OAAO,CAAC,CAAC;IACvB,MAAM,YAAY,GAAG,IAAA,WAAI,EAAC,OAAO,EAAE,aAAa,CAAC,CAAC;IAElD,wBAAwB;IACxB,MAAM,WAAW,GAAG,oBAAoB,CAAC,OAAO,CAAC,CAAC;IAElD,sBAAsB;IACtB,MAAM,UAAU,GAAG,IAAA,WAAI,EAAC,OAAO,EAAE,YAAY,IAAI,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;IACvE,IAAI,IAAA,eAAU,EAAC,YAAY,CAAC,EAAE,CAAC;QAC7B,MAAM,GAAG,GAAG,IAAA,iBAAY,EAAC,YAAY,EAAE,MAAM,CAAC,CAAC;QAC/C,IAAA,kBAAa,EAAC,UAAU,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC,CAAC;IAC1D,CAAC;IAED,wBAAwB;IACxB,MAAM,QAAQ,GAAG,IAAA,0BAAmB,GAAE,CAAC;IACvC,MAAM,MAAM,GAAmB;QAC7B,MAAM,EAAE,QAAQ,CAAC,MAAM;QACvB,gBAAgB,EAAE,IAAA,mBAAY,EAAC,QAAQ,CAAC,OAAO,CAAC,SAAS,CAAC;QAC1D,gBAAgB,EAAE,IAAA,mBAAY,EAAC,QAAQ,CAAC,OAAO,CAAC,SAAS,CAAC;QAC1D,eAAe,EAAE,IAAA,mBAAY,EAAC,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC;QACxD,eAAe,EAAE,IAAA,mBAAY,EAAC,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC;KACzD,CAAC;IACF,IAAA,kBAAa,EAAC,YAAY,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC,CAAC;IAEtF,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,QAAQ,EAAE,CAAC;AAChD,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,3 @@
+#!/usr/bin/env node
+export {};
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":""}