@ouro.bot/cli 0.1.0-alpha.56 → 0.1.0-alpha.561

package/dist/senses/voice/playback.js

@@ -0,0 +1,139 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.writeVoicePlaybackArtifact = writeVoicePlaybackArtifact;
+const fs = __importStar(require("fs/promises"));
+const path = __importStar(require("path"));
+const runtime_1 = require("../../nerves/runtime");
+const audio_routing_1 = require("./audio-routing");
+function audioExtension(mimeType) {
+    if (mimeType === "audio/mpeg")
+        return "mp3";
+    if (mimeType === "audio/wav" || mimeType === "audio/x-wav")
+        return "wav";
+    if (mimeType.startsWith("audio/pcm"))
+        return "pcm";
+    return "audio";
+}
+function safeFileStem(input) {
+    const stem = input
+        .trim()
+        .toLowerCase()
+        .replace(/[^a-z0-9]+/g, "-")
+        .replace(/^-+|-+$/g, "");
+    return stem || "utterance";
+}
+function commandFailureMessage(exitCode, result) {
+    const stderr = result.stderr?.trim();
+    if (stderr)
+        return `exit ${exitCode}: ${stderr}`;
+    const stdout = result.stdout?.trim();
+    if (stdout)
+        return `exit ${exitCode}: ${stdout}`;
+    return `exit ${exitCode}`;
+}
+async function writeVoicePlaybackArtifact(request) {
+    const mkdir = request.mkdir ?? fs.mkdir;
+    const writeFile = request.writeFile ?? fs.writeFile;
+    const commandRunner = request.commandRunner ?? (0, audio_routing_1.createNodeVoiceCommandRunner)();
+    const timeoutMs = request.timeoutMs ?? 30_000;
+    const playbackCommandPath = request.playbackCommandPath ?? "afplay";
+    const audioPath = path.join(request.outputDir, `${safeFileStem(request.utteranceId)}.${audioExtension(request.delivery.mimeType)}`);
+    await mkdir(request.outputDir, { recursive: true });
+    await writeFile(audioPath, request.delivery.audio);
+    (0, runtime_1.emitNervesEvent)({
+        component: "senses",
+        event: "senses.voice_playback_artifact_written",
+        message: "voice playback artifact written",
+        meta: {
+            utteranceId: request.utteranceId,
+            audioPath,
+            byteLength: request.delivery.byteLength,
+            mimeType: request.delivery.mimeType,
+        },
+    });
+    if (request.playAudio !== true) {
+        return {
+            status: "written",
+            audioPath,
+            byteLength: request.delivery.byteLength,
+            mimeType: request.delivery.mimeType,
+            playbackAttempted: false,
+        };
+    }
+    (0, runtime_1.emitNervesEvent)({
+        component: "senses",
+        event: "senses.voice_playback_start",
+        message: "starting voice playback",
+        meta: { utteranceId: request.utteranceId, audioPath, playbackCommandPath },
+    });
+    try {
+        const result = await commandRunner(playbackCommandPath, [audioPath], { timeoutMs });
+        if (typeof result.exitCode === "number" && result.exitCode !== 0) {
+            throw new Error(commandFailureMessage(result.exitCode, result));
+        }
+        (0, runtime_1.emitNervesEvent)({
+            component: "senses",
+            event: "senses.voice_playback_end",
+            message: "finished voice playback",
+            meta: { utteranceId: request.utteranceId, audioPath },
+        });
+        return {
+            status: "played",
+            audioPath,
+            byteLength: request.delivery.byteLength,
+            mimeType: request.delivery.mimeType,
+            playbackAttempted: true,
+        };
+    }
+    catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        (0, runtime_1.emitNervesEvent)({
+            level: "error",
+            component: "senses",
+            event: "senses.voice_playback_error",
+            message: "voice playback failed",
+            meta: { utteranceId: request.utteranceId, audioPath, error: message },
+        });
+        return {
+            status: "failed",
+            audioPath,
+            byteLength: request.delivery.byteLength,
+            mimeType: request.delivery.mimeType,
+            playbackAttempted: true,
+            error: message,
+        };
+    }
+}

package/dist/senses/voice/transcript.js

@@ -0,0 +1,70 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.buildVoiceTranscript = buildVoiceTranscript;
+exports.transcriptToPromptText = transcriptToPromptText;
+exports.normalizeVoiceSessionKey = normalizeVoiceSessionKey;
+const runtime_1 = require("../../nerves/runtime");
+function compactSpeechText(text) {
+    return text.replace(/\s+/g, " ").trim();
+}
+function buildVoiceTranscript(input) {
+    const text = compactSpeechText(input.text);
+    if (!text) {
+        (0, runtime_1.emitNervesEvent)({
+            level: "error",
+            component: "senses",
+            event: "senses.voice_transcript_error",
+            message: "voice transcript text is empty",
+            meta: { utteranceId: input.utteranceId },
+        });
+        throw new Error("voice transcript text is empty");
+    }
+    const transcript = {
+        utteranceId: input.utteranceId,
+        text,
+        source: input.source,
+        audioPath: input.audioPath ?? null,
+        language: input.language ?? null,
+        startedAt: input.startedAt ?? null,
+        endedAt: input.endedAt ?? null,
+    };
+    (0, runtime_1.emitNervesEvent)({
+        component: "senses",
+        event: "senses.voice_transcript_built",
+        message: "built voice transcript",
+        meta: { utteranceId: transcript.utteranceId, source: transcript.source, length: transcript.text.length },
+    });
+    return transcript;
+}
+function transcriptToPromptText(transcript) {
+    const text = compactSpeechText(transcript.text);
+    if (!text) {
+        (0, runtime_1.emitNervesEvent)({
+            level: "error",
+            component: "senses",
+            event: "senses.voice_transcript_error",
+            message: "voice prompt text is empty",
+            meta: { utteranceId: transcript.utteranceId },
+        });
+        throw new Error("voice transcript text is empty");
+    }
+    return text;
+}
+function normalizeVoiceSessionKey(value) {
+    const normalized = value
+        .trim()
+        .toLowerCase()
+        .replace(/[^a-z0-9]+/g, "-")
+        .replace(/^-+|-+$/g, "");
+    if (!normalized) {
+        (0, runtime_1.emitNervesEvent)({
+            level: "error",
+            component: "senses",
+            event: "senses.voice_transcript_error",
+            message: "voice session key is empty",
+            meta: { inputLength: value.length },
+        });
+        throw new Error("voice session key is empty");
+    }
+    return normalized;
+}

package/dist/senses/voice/turn.js

@@ -0,0 +1,85 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.runVoiceLoopbackTurn = runVoiceLoopbackTurn;
+const runtime_1 = require("../../nerves/runtime");
+const shared_turn_1 = require("../shared-turn");
+const transcript_1 = require("./transcript");
+async function runVoiceLoopbackTurn(options) {
+    const runSenseTurn = options.runSenseTurn ?? shared_turn_1.runSenseTurn;
+    let userMessage;
+    try {
+        userMessage = (0, transcript_1.transcriptToPromptText)(options.transcript);
+    }
+    catch (error) {
+        (0, runtime_1.emitNervesEvent)({
+            level: "error",
+            component: "senses",
+            event: "senses.voice_turn_error",
+            message: "voice turn rejected transcript",
+            meta: { utteranceId: options.transcript.utteranceId, error: error instanceof Error ? error.message : String(error) },
+        });
+        throw error;
+    }
+    (0, runtime_1.emitNervesEvent)({
+        component: "senses",
+        event: "senses.voice_turn_start",
+        message: "starting voice loopback turn",
+        meta: {
+            agentName: options.agentName,
+            friendId: options.friendId,
+            sessionKey: options.sessionKey,
+            utteranceId: options.transcript.utteranceId,
+        },
+    });
+    const turn = await runSenseTurn({
+        agentName: options.agentName,
+        channel: "voice",
+        friendId: options.friendId,
+        sessionKey: options.sessionKey,
+        userMessage,
+    });
+    try {
+        const spoken = await options.tts.synthesize({
+            utteranceId: options.transcript.utteranceId,
+            text: turn.response,
+        });
+        const result = {
+            responseText: turn.response,
+            ponderDeferred: turn.ponderDeferred,
+            tts: {
+                status: "delivered",
+                audio: spoken.audio,
+                byteLength: spoken.byteLength,
+                chunkCount: spoken.chunkCount,
+                mimeType: spoken.mimeType,
+                modelId: spoken.modelId,
+                voiceId: spoken.voiceId,
+            },
+        };
+        (0, runtime_1.emitNervesEvent)({
+            component: "senses",
+            event: "senses.voice_turn_end",
+            message: "voice loopback turn delivered speech",
+            meta: { utteranceId: options.transcript.utteranceId, responseLength: turn.response.length, byteLength: spoken.byteLength },
+        });
+        return result;
+    }
+    catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        (0, runtime_1.emitNervesEvent)({
+            level: "error",
+            component: "senses",
+            event: "senses.voice_turn_tts_error",
+            message: "voice loopback TTS failed after text response",
+            meta: { utteranceId: options.transcript.utteranceId, error: message, responseLength: turn.response.length },
+        });
+        return {
+            responseText: turn.response,
+            ponderDeferred: turn.ponderDeferred,
+            tts: {
+                status: "failed",
+                error: message,
+            },
+        };
+    }
+}

package/dist/senses/voice/types.js

@@ -0,0 +1,2 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });

package/dist/senses/voice/whisper.js

@@ -0,0 +1,161 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.parseWhisperCppTranscriptJson = parseWhisperCppTranscriptJson;
+exports.createNodeWhisperCppProcessRunner = createNodeWhisperCppProcessRunner;
+exports.createWhisperCppTranscriber = createWhisperCppTranscriber;
+const fs = __importStar(require("fs/promises"));
+const os = __importStar(require("os"));
+const path = __importStar(require("path"));
+const child_process_1 = require("child_process");
+const runtime_1 = require("../../nerves/runtime");
+const transcript_1 = require("./transcript");
+function parseWhisperCppTranscriptJson(raw) {
+    let parsed;
+    try {
+        parsed = JSON.parse(raw);
+    }
+    catch (error) {
+        throw new Error(`invalid whisper.cpp JSON: ${String(error)}`);
+    }
+    const text = typeof parsed.text === "string"
+        ? parsed.text.trim()
+        : Array.isArray(parsed.transcription)
+            ? parsed.transcription
+                .map((entry) => typeof entry.text === "string" ? entry.text.trim() : "")
+                .filter(Boolean)
+                .join(" ")
+                .trim()
+            : "";
+    if (!text) {
+        throw new Error("empty whisper.cpp transcript");
+    }
+    return text;
+}
+async function defaultMakeTempDir() {
+    return fs.mkdtemp(path.join(os.tmpdir(), "ouro-voice-whisper-"));
+}
+async function defaultRemoveDir(dir) {
+    await fs.rm(dir, { recursive: true, force: true });
+}
+function createNodeWhisperCppProcessRunner() {
+    return (command, args, options) => new Promise((resolve, reject) => {
+        const child = (0, child_process_1.spawn)(command, args, { stdio: ["ignore", "pipe", "pipe"] });
+        const stdout = [];
+        const stderr = [];
+        const timer = setTimeout(() => {
+            child.kill("SIGTERM");
+            reject(new Error(`command timed out after ${options.timeoutMs}ms`));
+        }, options.timeoutMs);
+        child.stdout.on("data", (chunk) => stdout.push(chunk));
+        child.stderr.on("data", (chunk) => stderr.push(chunk));
+        child.on("error", (error) => {
+            clearTimeout(timer);
+            reject(error);
+        });
+        child.on("close", (exitCode) => {
+            clearTimeout(timer);
+            resolve({
+                stdout: Buffer.concat(stdout).toString("utf8"),
+                stderr: Buffer.concat(stderr).toString("utf8"),
+                exitCode: exitCode ?? 0,
+            });
+        });
+    });
+}
+function createWhisperCppTranscriber(options) {
+    const timeoutMs = options.timeoutMs ?? 120_000;
+    const readFile = options.readFile ?? fs.readFile;
+    const makeTempDir = options.makeTempDir ?? defaultMakeTempDir;
+    const removeDir = options.removeDir ?? defaultRemoveDir;
+    const processRunner = options.processRunner ?? createNodeWhisperCppProcessRunner();
+    return {
+        async transcribe(request) {
+            const workDir = await makeTempDir();
+            const outputBase = path.join(workDir, "transcript");
+            const args = [
+                "-m",
+                options.modelPath,
+                "-f",
+                request.audioPath,
+                "-oj",
+                "-of",
+                outputBase,
+                ...(request.language ? ["-l", request.language] : []),
+            ];
+            (0, runtime_1.emitNervesEvent)({
+                component: "senses",
+                event: "senses.voice_stt_start",
+                message: "starting Whisper.cpp transcription",
+                meta: { utteranceId: request.utteranceId, audioPath: request.audioPath },
+            });
+            try {
+                const result = await processRunner(options.whisperCliPath, args, { timeoutMs });
+                if (typeof result.exitCode === "number" && result.exitCode !== 0) {
+                    throw new Error(`exit ${result.exitCode}${result.stderr ? `: ${result.stderr}` : ""}`);
+                }
+                const raw = await readFile(`${outputBase}.json`, "utf8");
+                const text = parseWhisperCppTranscriptJson(raw);
+                const transcript = (0, transcript_1.buildVoiceTranscript)({
+                    utteranceId: request.utteranceId,
+                    text,
+                    audioPath: request.audioPath,
+                    language: request.language,
+                    source: "whisper.cpp",
+                });
+                (0, runtime_1.emitNervesEvent)({
+                    component: "senses",
+                    event: "senses.voice_stt_end",
+                    message: "finished Whisper.cpp transcription",
+                    meta: { utteranceId: request.utteranceId, length: transcript.text.length },
+                });
+                return transcript;
+            }
+            catch (error) {
+                (0, runtime_1.emitNervesEvent)({
+                    level: "error",
+                    component: "senses",
+                    event: "senses.voice_stt_error",
+                    message: "Whisper.cpp transcription failed",
+                    meta: { utteranceId: request.utteranceId, error: error instanceof Error ? error.message : String(error) },
+                });
+                throw new Error(`whisper.cpp transcription failed: ${error instanceof Error ? error.message : String(error)}`);
+            }
+            finally {
+                await removeDir(workDir);
+            }
+        },
+    };
+}

package/dist/senses/voice-entry.js

@@ -0,0 +1,80 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+const agentArgIndex = process.argv.indexOf("--agent");
+const agentName = agentArgIndex >= 0 ? process.argv[agentArgIndex + 1] : undefined;
+if (!agentName) {
+    // eslint-disable-next-line no-console -- pre-boot guard: --agent check before imports
+    console.error("Missing required --agent <name> argument.\nUsage: node dist/senses/voice-entry.js --agent ouroboros");
+    process.exit(1);
+}
+const runtime_logging_1 = require("../heart/daemon/runtime-logging");
+const runtime_1 = require("../nerves/runtime");
+(0, runtime_logging_1.configureDaemonRuntimeLogger)("voice");
+(0, runtime_1.emitNervesEvent)({
+    component: "senses",
+    event: "senses.entry_boot",
+    message: "booting Voice entrypoint",
+    meta: { entry: "voice", agentName },
+});
+Promise.resolve().then(() => __importStar(require("../heart/runtime-credentials"))).then(async ({ readMachineRuntimeCredentialConfig, refreshMachineRuntimeCredentialConfig, refreshRuntimeCredentialConfig, waitForRuntimeCredentialBootstrap, }) => {
+    await waitForRuntimeCredentialBootstrap(agentName);
+    const { loadOrCreateMachineIdentity } = await Promise.resolve().then(() => __importStar(require("../heart/machine-identity")));
+    const machine = loadOrCreateMachineIdentity();
+    const machineConfig = readMachineRuntimeCredentialConfig(agentName);
+    if (!machineConfig.ok) {
+        await refreshMachineRuntimeCredentialConfig(agentName, machine.machineId, { preserveCachedOnFailure: true }).catch(() => undefined);
+    }
+    void refreshRuntimeCredentialConfig(agentName, { preserveCachedOnFailure: true }).catch(() => undefined);
+    (0, runtime_1.emitNervesEvent)({
+        component: "senses",
+        event: "senses.voice_entry_ready",
+        message: "Voice entrypoint is ready for managed voice turns",
+        meta: { entry: "voice", agentName, machineId: machine.machineId },
+    });
+    setInterval(() => undefined, 60_000);
+})
+    .catch((error) => {
+    (0, runtime_1.emitNervesEvent)({
+        level: "error",
+        component: "senses",
+        event: "senses.entry_error",
+        message: "Voice entrypoint failed",
+        meta: { entry: "voice", agentName, error: error instanceof Error ? error.message : String(error) },
+    });
+    // eslint-disable-next-line no-console -- fatal startup guard for sense process
+    console.error(error instanceof Error ? error.message : String(error));
+    process.exit(1);
+});

package/dist/trips/core.js

@@ -0,0 +1,138 @@
+"use strict";
+// Harness-side trip ledger primitive.
+//
+// Mirrors the substrate's @ouro/work-protocol/src/trip.ts contract (vendored
+// the same way mailroom/core.ts vendors mail). Slugger's framing: today,
+// doc-edits-from-mail keep falling back on freeform parsing because there is
+// no structured object between "mail body" and "travel doc". TripRecord +
+// TripLeg are that object — every leg fact carries non-optional provenance
+// (TripEvidence with discoveryMethod) so the ledger can be audited cleanly
+// and reasoned about under conflict.
+//
+// Per-agent ledger keypair design: in v1 each agent has ONE ledger keypair.
+// All TripRecord blobs are encrypted with that key. Cross-trip sharing
+// (handing one trip's facts to another party without their owning the whole
+// ledger) is a follow-on; it would shard to per-trip keys, which the
+// substrate's TripLedgerRegistry can already represent.
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.generateTripKeyPair = generateTripKeyPair;
+exports.encryptTripRecord = encryptTripRecord;
+exports.decryptTripRecord = decryptTripRecord;
+exports.newTripId = newTripId;
+exports.newLegId = newLegId;
+exports.newTripLedgerRecord = newTripLedgerRecord;
+const crypto = __importStar(require("node:crypto"));
+// ── Helpers: keys + crypto ─────────────────────────────────────────
+function safeLabel(label) {
+    return label.toLowerCase().replace(/[^a-z0-9_-]+/g, "-").replace(/^-+|-+$/g, "");
+}
+function generateTripKeyPair(label) {
+    const { publicKey, privateKey } = crypto.generateKeyPairSync("rsa", {
+        modulusLength: 2048,
+        publicKeyEncoding: { type: "spki", format: "pem" },
+        privateKeyEncoding: { type: "pkcs8", format: "pem" },
+    });
+    const slug = safeLabel(label) || "ledger";
+    const fingerprint = crypto.createHash("sha256").update(publicKey).digest("hex").slice(0, 16);
+    return {
+        keyId: `trip_${slug}_${fingerprint}`,
+        publicKeyPem: publicKey,
+        privateKeyPem: privateKey,
+    };
+}
+function encryptTripRecord(trip, publicKeyPem, keyId) {
+    const contentKey = crypto.randomBytes(32);
+    const iv = crypto.randomBytes(12);
+    const cipher = crypto.createCipheriv("aes-256-gcm", contentKey, iv);
+    const ciphertext = Buffer.concat([cipher.update(Buffer.from(JSON.stringify(trip), "utf-8")), cipher.final()]);
+    const authTag = cipher.getAuthTag();
+    const wrappedKey = crypto.publicEncrypt({ key: publicKeyPem, oaepHash: "sha256" }, contentKey);
+    return {
+        algorithm: "RSA-OAEP-SHA256+A256GCM",
+        keyId,
+        wrappedKey: wrappedKey.toString("base64"),
+        iv: iv.toString("base64"),
+        authTag: authTag.toString("base64"),
+        ciphertext: ciphertext.toString("base64"),
+    };
+}
+function decryptTripRecord(payload, privateKeyPem) {
+    const contentKey = crypto.privateDecrypt({
+        key: privateKeyPem,
+        oaepHash: "sha256",
+    }, Buffer.from(payload.wrappedKey, "base64"));
+    const decipher = crypto.createDecipheriv("aes-256-gcm", contentKey, Buffer.from(payload.iv, "base64"));
+    decipher.setAuthTag(Buffer.from(payload.authTag, "base64"));
+    const plaintext = Buffer.concat([
+        decipher.update(Buffer.from(payload.ciphertext, "base64")),
+        decipher.final(),
+    ]);
+    return JSON.parse(plaintext.toString("utf-8"));
+}
+// ── Helpers: deterministic ids ─────────────────────────────────────
+function newTripId(agentId, name, createdAt) {
+    const fingerprint = crypto.createHash("sha256")
+        .update(`${agentId}\n${name}\n${createdAt}`)
+        .digest("hex")
+        .slice(0, 16);
+    const slug = safeLabel(name) || "trip";
+    return `trip_${slug}_${fingerprint}`;
+}
+function newLegId(input) {
+    const distinguish = input.vendor || input.confirmationCode || crypto.randomUUID();
+    const fingerprint = crypto.createHash("sha256")
+        .update(`${input.tripId}\n${input.kind}\n${distinguish}\n${input.createdAt}`)
+        .digest("hex")
+        .slice(0, 16);
+    return `leg_${input.kind}_${fingerprint}`;
+}
+// ── Ledger record helpers ──────────────────────────────────────────
+function newTripLedgerRecord(input) {
+    const now = (input.now ?? (() => new Date().toISOString()))();
+    const keypair = generateTripKeyPair(input.label ?? input.agentId);
+    const ledgerId = `ledger_${safeLabel(input.agentId) || "agent"}_${crypto.createHash("sha256").update(`${input.agentId}\n${now}\n${keypair.keyId}`).digest("hex").slice(0, 16)}`;
+    return {
+        ledger: {
+            schemaVersion: 1,
+            agentId: input.agentId,
+            ledgerId,
+            keyId: keypair.keyId,
+            publicKeyPem: keypair.publicKeyPem,
+            createdAt: now,
+        },
+        keypair,
+    };
+}