@ours.network/sdk 0.1.1

package/dist/connector.js

@@ -0,0 +1,5 @@
+import { createRequire } from 'node:module'; const require = createRequire(import.meta.url);
+import{a as ne}from"./chunk-5EWCIQH6.js";import{mkdirSync as te,writeFileSync as Te,readFileSync as ve,readdirSync as ke,statSync as j,unlinkSync as Oe,chmodSync as se,createWriteStream as Me}from"node:fs";import{join as x,dirname as Ie,resolve as Ae}from"node:path";import{homedir as Ee}from"node:os";import{Readable as xe}from"node:stream";import{pipeline as De}from"node:stream/promises";var $e="0.1.1",Ne=new Set(["choose_identity","create_identity","create_root_identity"]),Ue="save_file",Le="get_files",re=a=>new Promise(g=>setTimeout(g,a)),V=a=>typeof a?.method=="string"&&a.id!==void 0&&a.id!==null,Ce=a=>a&&typeof a=="object"&&!("method"in a)&&a.id!==void 0&&a.id!==null,oe=a=>{let g=a.result;return!!a.error||!!(g&&g.isError)},ie=Number(process.env.OURS_RESTORE_TTL_MS)>0?Number(process.env.OURS_RESTORE_TTL_MS):7*24*60*60*1e3,ae=["1","true","yes","on"].includes((process.env.OURS_NO_AUTORESTORE??"").trim().toLowerCase());async function ze(a){let g=new URL(a.url),i=(...e)=>process.stderr.write(`[ours-proxy] ${e.join(" ")}
+`),z=e=>Number.isInteger(e)&&e>1,q=Number(process.env.OURS_CLIENT_PID),G=z(q)?q:z(process.ppid)?process.ppid:process.pid,B=(process.env.CLAUDE_CODE_SESSION_ID??"").trim()||`client:${G}`,w=null,M=null,$,f=null,I=new Map,N=new Set,_=null,S=ae?null:(process.env.CLAUDE_CODE_SESSION_ID??"").trim()||null,ce=a.stateDir??process.env.OURS_STATE_DIR??x(Ee(),".ours"),R=x(ce,"session-restore"),W=S&&/^[A-Za-z0-9._-]{1,200}$/.test(S)?S:null,y=W?x(R,`${W}.json`):null,Q=!1,U=null;function de(e){if(y)try{te(R,{recursive:!0,mode:448}),Te(y,JSON.stringify({claudeSessionId:S,identity:e,boundAt:new Date().toISOString()}),{mode:384}),se(R,448),se(y,384)}catch(t){i("restore persist failed (non-fatal):",String(t))}}function ue(){if(!y)return null;try{if(Date.now()-j(y).mtimeMs>ie)return null;let e=JSON.parse(ve(y,"utf8"));return(typeof e.identity=="string"?e.identity.trim():"")||null}catch{return null}}function le(){try{let e=Date.now();for(let t of ke(R)){if(!t.endsWith(".json"))continue;let n=x(R,t);try{e-j(n).mtimeMs>ie&&(Oe(n),i("session-restore: pruned expired record",t))}catch{}}}catch{}}let b=(()=>{let e=(process.env.OURS_REQUEST_TIMEOUT_MS??"").trim();if(e==="")return 12e4;let t=Number(e);return Number.isFinite(t)&&t>=0?t:12e4})(),p=new Map,A=new Map;function L(e,t,n){let o=p.get(e);if(!o)return;p.delete(e),o.progressToken!==void 0&&A.delete(o.progressToken);let s=Date.now()-o.sentAt;i(`FAILING BACK request id=${String(e)} method=${o.method} waited_ms=${s} reason=${n}`),m.send({jsonrpc:"2.0",id:e,error:{code:t,message:`ours proxy: no response from the ours daemon for "${o.method}" after ${s}ms (${n}). The request was NOT retried \u2014 retry it yourself if it is safe to repeat.`,data:{reason:n,method:o.method,waitedMs:s}}}).catch(r=>i("fail-back send failed:",String(r)))}b>0&&setInterval(()=>{let t=Date.now();for(let[n,o]of[...p])o.deadline<=t&&L(n,-32001,"watchdog timeout")},1e3).unref?.();let fe=6e4,X=3,C=0,h=0;function pe(e,t){m.send({jsonrpc:"2.0",method:"notifications/message",params:{level:e,logger:"ours-proxy",data:t}}).catch(n=>i("downstream notify failed:",String(n)))}let l=null,me=()=>l,E=!1,T=!1,v=!1,k=[],ge="__ours_proxy_init__",P=0,O=new Set,J=new Set,m=a.transports.createStdioServer();m.onmessage=e=>{let t=[],n=!1;for(let o of D(e)){let s=o;if(s.method==="notifications/initialized"&&(n=!0),V(s)){if(s.method==="initialize"&&(w=s,M)){i("absorbed re-initialize locally \u2014 upstream session kept stable"),m.send({jsonrpc:"2.0",id:s.id,result:M}).catch(r=>i("local initialize reply failed:",String(r)));continue}if(s.method==="tools/call"){let r=s.params;if(r&&Ne.has(r.name??"")&&typeof r.arguments?.name=="string"&&I.set(s.id,r.arguments.name),r?.name===Le&&N.add(s.id),r?.name===Ue){let c=s.params?.arguments??{};we(s.id,c);continue}}if(b>0){let r=s.id,c=s.params?._meta,d=Date.now();p.set(r,{method:typeof s.method=="string"?s.method:"unknown",sentAt:d,deadline:d+b,transport:null,progressToken:c?.progressToken}),c?.progressToken!==void 0&&A.set(c.progressToken,r)}}t.push(s)}if(t.length){let o=Array.isArray(e)?t:t[0];Y(o)}n&&ye()},m.onclose=()=>void H(0),m.onerror=e=>i("downstream error:",String(e));function ye(){if(Q||!f)return;Q=!0;let e=`__ours_proxy_restore_${++P}__`;O.add(e),U=e,i("session-restore: self-recovering bound identity",`"${f}"`),Y({jsonrpc:"2.0",id:e,method:"tools/call",params:{name:"choose_identity",arguments:{name:f}}})}function he(e,t){if(!(b<=0))for(let n of D(e)){let o=n.id;if(o===void 0)continue;let s=p.get(o);s&&(s.transport=t)}}async function we(e,t){let n=String(t.wire_id??"").trim(),o=String(t.dest_path??"").trim(),s=(r,c=!1)=>m.send({jsonrpc:"2.0",id:e,result:{content:[{type:"text",text:r}],isError:c}}).catch(d=>i("save_file reply failed:",String(d)));if(!n||!o){await s("save_file: both `wire_id` and `dest_path` are required.",!0);return}if(!/^[A-Za-z0-9]+$/.test(n)){await s("save_file: invalid wire_id.",!0);return}try{let r=new URL(g.href);r.pathname=`/files/${encodeURIComponent(n)}`,r.search="";let c={"x-ours-lease-token":B};a.apiToken&&(c["x-ours-api-token"]=a.apiToken);let d=await fetch(r,{headers:c});if(d.status===401||d.status===403){await s("save_file: ours daemon authentication failed; the monitor may be disarmed.",!0);return}if(d.status===404){await s(`save_file: no file with wire_id ${n} is available to the bound identity. Run get_files first; it may already be saved, or it belongs to another identity.`,!0);return}if(!d.ok||!d.body){await s(`save_file: ours daemon returned HTTP ${d.status}. Your ours daemon may be too old to support save_file \u2014 update it, or use get_files and copy the returned path yourself.`,!0);return}let u=Ae(o);te(Ie(u),{recursive:!0}),await De(xe.fromWeb(d.body),Me(u));let be=j(u).size;await s(`Saved file (wire_id ${n}) to ${u} (${be} bytes). The bytes were streamed daemon\u2192proxy\u2192disk and never entered this result.`)}catch(r){await s(`save_file failed: ${String(r)}`,!0)}}function Y(e){if(E&&l){let t=l;he(e,t),l.send(e).catch(n=>{i("upstream send failed:",String(n));let o=D(e),s=o.filter(r=>!V(r));s.length&&k.push(Array.isArray(e)?s:s[0]);for(let r of o){let c=r;V(c)&&p.has(c.id)&&L(c.id,-32e3,"upstream send failed")}F(t,"send failed")})}else k.push(e)}function F(e,t){if(T||v||l!==null&&e!==l)return;i(`upstream dropped (${t}) \u2014 reconnecting`),E=!1;let n=l;l=null;try{n?.close?.()}catch{}if(n)for(let[o,s]of[...p])s.transport===n&&L(o,-32e3,`upstream dropped (${t})`);Se()}function _e(e){e.onmessage=t=>{let n=[];for(let o of D(t)){let s=o;if(s.method==="notifications/progress"){let r=s.params?.progressToken;if(r!==void 0){let c=A.get(r),d=c!==void 0?p.get(c):void 0;d&&(d.deadline=Date.now()+b)}}if(Ce(s)){let r=s.id,c=p.get(r);c&&(p.delete(r),c.progressToken!==void 0&&A.delete(c.progressToken));let d=s.result?.protocolVersion;if(d&&(J.has(r)||Z(r))){$=d;try{l?.setProtocolVersion?.(d)}catch{}if(M==null&&Z(r)&&!O.has(r)){let u=s.result??null;u&&_&&(u.instructions=`${u.instructions?u.instructions+`
+
+`:""}${_}`),M=u}J.delete(r)}if(O.has(r)){O.delete(r),r===U&&(U=null,oe(s)&&(f=null,i("session-restore: re-bind refused (identity live elsewhere) \u2014 staying unbound")));continue}if(N.has(r)&&(N.delete(r),a.annotateResult?.(s)&&i("get_files: daemon copy unreadable by this OS user \u2014 asked the agent for a destination")),I.has(r)){let u=I.get(r);I.delete(r),oe(s)||(f=u,i("bound identity tracked:",u),de(u))}}n.push(s)}if(n.length){let o=Array.isArray(t)?n:n[0];m.send(o).catch(s=>i("downstream send failed:",String(s)))}},e.onerror=t=>{let n=String(t);if(i("upstream error:",n),!/Maximum reconnection attempts \(\d+\) exceeded/.test(n))return;let o=Date.now();if(o-C<fe){i(`notification stream exhausted again within cooldown \u2014 not escalating (${Math.round((o-C)/1e3)}s since last)`);return}if(C=o,h++,h>X){i(`NOTIFICATION STREAM DEAD \u2014 ${h-1} reconnect escalations exhausted; server\u2192client notifications are NOT arriving`),pe("error",`ours proxy: the server\u2192client notification stream could not be re-established after ${h-1} attempts. Tool calls still work, but you will NOT receive new-mail or other server notifications until this session reconnects. Treat any "waiting for a message" as unreliable.`);return}i(`notification stream exhausted its retries \u2014 escalating to a full reconnect (${h}/${X})`),F(e,"notification stream exhausted")},e.onclose=()=>F(e,"closed")}let Z=e=>w!=null&&w.id===e;async function K(){a.ensureDaemon&&await a.ensureDaemon().catch(t=>i("ensureDaemon:",String(t)));let e=a.transports.createHttpClient(g,{reconnectionOptions:{initialReconnectionDelay:1e3,maxReconnectionDelay:3e4,reconnectionDelayGrowFactor:1.5,maxRetries:5},requestInit:{headers:{"x-ours-lease-token":B,"x-ours-client-pid":String(G),...a.apiToken?{"x-ours-api-token":a.apiToken}:{}}}});if(_e(e),await e.start(),$)try{e.setProtocolVersion?.($)}catch{}l=e}async function ee(e,t){t&&e.id!==void 0&&O.add(e.id),await l.send(e)}async function Se(){if(v||T)return;v=!0;let e=500;for(;;){if(T){v=!1;return}try{if(await K(),w){let n=`${ge}${P}`;J.add(n),await ee({...w,id:n},!0),await l.send({jsonrpc:"2.0",method:"notifications/initialized"})}if(f){let n=`__ours_proxy_rebind_${++P}__`;await ee({jsonrpc:"2.0",id:n,method:"tools/call",params:{name:"choose_identity",arguments:{name:f}}},!0)}E=!0;let t=k.splice(0);for(let n of t)await l.send(n).catch(o=>i("flush failed:",String(o)));i("upstream reconnected",f?`(re-bound "${f}")`:""),h=0,v=!1;return}catch(t){i("reconnect attempt failed:",String(t)),await re(e),e=Math.min(Math.floor(e*1.5),1e4)}}}async function H(e){if(!T){T=!0;try{await l?.close()}catch{}try{await m.close()}catch{}process.exit(e)}}process.on("SIGINT",()=>void H(0)),process.on("SIGTERM",()=>void H(0)),process.on("unhandledRejection",e=>{i("UNHANDLED REJECTION (proxy stays up):",e instanceof Error?e.stack??e.message:String(e))}),process.on("uncaughtException",e=>{i("UNCAUGHT EXCEPTION (proxy stays up):",e?.stack??String(e))});async function Re(){let e=new URL(g.href);e.pathname="/state-dir";let t;try{t=await(await fetch(e,{signal:AbortSignal.timeout(3e3)})).json()}catch(n){i("compat handshake: could not read daemon /state-dir, proceeding:",String(n));return}_=ne({selfVersion:$e,daemonVersion:typeof t?.version=="string"?t.version:null}),_&&i(_)}if((async()=>{a.ensureDaemon&&await a.ensureDaemon().catch(n=>i("ensureDaemon:",String(n))),await Re();let e=500;for(;;)try{await K();break}catch(n){i("initial upstream connect failed, retrying:",String(n)),await re(e),e=Math.min(Math.floor(e*1.5),1e4)}E=!0;let t=k.splice(0);for(let n=0;n<t.length;n++){let o=me();if(!o){k.unshift(...t.slice(n));break}await o.send(t[n]).catch(s=>i("flush failed:",String(s)))}i(`upstream ready \u2014 stdio \u21C4 ${g.href}`)})(),S){le();let e=ue();e&&(f=e,i("session-restore: found prior binding for this session \u2014 will self-recover",`"${e}"`))}else ae&&i("session-restore: disabled via OURS_NO_AUTORESTORE \u2014 pure in-memory binding");await m.start(),i("proxy started (stdio transport up)")}function D(a){return Array.isArray(a)?a:[a]}export{ze as runProxy};

package/dist/daemon.d.ts

@@ -0,0 +1,5 @@
+export { bootWrapper } from './boot.js';
+export { startDaemon } from './http/server.js';
+export { startupProgress } from './runtime/env.js';
+export type { StartupProgressReporter } from './startup-progress.js';
+export type { DaemonHandle, DaemonOptions, McpIntegration, McpServerLike, McpTransportInit, McpTransportLike, } from './http/server.js';

package/dist/daemon.js

@@ -0,0 +1,2 @@
+import { createRequire } from 'node:module'; const require = createRequire(import.meta.url);
+import{a as e}from"./chunk-PCHN744Y.js";import"./chunk-37D5PCFY.js";import"./chunk-V64IUVSS.js";import"./chunk-ZAXRB5MO.js";import"./chunk-UELGY557.js";import"./chunk-KZMPGVQM.js";import"./chunk-AJQIWYXG.js";import"./chunk-NSPYN5TT.js";import"./chunk-VW2KWXSJ.js";import"./chunk-3DQSMLVZ.js";import"./chunk-7UUFYO6G.js";import"./chunk-UM73BGFH.js";import{a as t}from"./chunk-A3SXVUOC.js";import"./chunk-NMYSFQBL.js";import"./chunk-VOYMK2OO.js";import"./chunk-T25JIPX5.js";import"./chunk-HCIVLHKC.js";import"./chunk-NQQ4GSVI.js";import"./chunk-X4RVJ5VL.js";import"./chunk-DIRW7I4S.js";import"./chunk-YRPUM6JG.js";import"./chunk-LKFYUCN7.js";import"./chunk-P55RJGZU.js";import"./chunk-RAGUBE4Y.js";import"./chunk-Q3UVLSCX.js";import{h as r}from"./chunk-HSVIKO4D.js";import"./chunk-ZHH3PWEW.js";import"./chunk-IB2U7K6Y.js";import"./chunk-UJGRFV4J.js";export{t as bootWrapper,e as startDaemon,r as startupProgress};

package/dist/errors.d.ts

@@ -0,0 +1,40 @@
+export type OursErrorCode = 'NOT_BOUND' | 'BINDING_REASSIGNED' | 'BOUND_IDENTITY_GONE' | 'TEMP_CLOSING' | 'NAME_INVALID' | 'NAME_TAKEN' | 'PROVISION_FAILED' | 'NO_LEASE_HEADERS' | 'NO_LEASE_TOKEN' | 'RANDOM_NAME_EXHAUSTED' | 'NOT_BOUND_NO_NAME' | 'NOT_TEMPORARY' | 'TEMP_OWNED_ELSEWHERE' | 'TEMP_STALE' | 'BOUND_ELSEWHERE' | 'DELETE_PARTIAL' | 'CLOSE_FAILED' | 'ROOT_EXISTS' | 'ROOT_HAS_ROLES' | 'NO_SUCH_IDENTITY' | 'PATH_NOT_ABSOLUTE' | 'WRITE_FAILED' | 'PUBLIC_INVITE_NAMED' | 'INVITE_MALFORMED' | 'NO_POLICY_ARGS' | 'SEND_ARGS' | 'FILE_UNREADABLE' | 'FALLBACK_FAILED' | 'CONNECTOR_TOO_OLD' | 'NO_ROOT' | 'TX_FAILED' | 'INVALID_SELECTION' | 'MALFORMED_ID' | 'DUPLICATE_ID' | 'UNKNOWN_OR_STALE_ID';
+export declare class OursError extends Error {
+    readonly code: OursErrorCode;
+    constructor(code: OursErrorCode, message: string);
+}
+export declare const errNotBound: () => OursError;
+export declare const errBindingReassigned: () => OursError;
+export declare const errBoundIdentityGone: (name: string) => OursError;
+export declare const errTempClosingBound: (name: string) => OursError;
+export declare const errNameTaken: (tool: string, name: string) => OursError;
+export declare const errNoLeaseHeaders: () => OursError;
+export declare const errRandomNameExhausted: () => OursError;
+export declare const errRootExists: (rootName: string) => OursError;
+export declare const errNotBoundNoName: () => OursError;
+export declare const errNotTemporary: (name: string) => OursError;
+export declare const errTempOwnedElsewhereClose: (name: string, pid: number) => OursError;
+export declare const errTempClosedWithError: (name: string, deleteError: string, remote: string) => OursError;
+export declare const errPathNotAbsolute: (path: string) => OursError;
+export declare const errNoSuchIdentity: (name: string) => OursError;
+export declare const errNoLeaseToken: () => OursError;
+export declare const errTempClosingChoose: (name: string) => OursError;
+export declare const errTempOwnedLive: (name: string, pid: number) => OursError;
+export declare const errTempStale: (name: string, pid: number) => OursError;
+export declare const errBoundElsewhere: (name: string) => OursError;
+export declare const errTempOwnedElsewhereRemove: (name: string, pid: number) => OursError;
+export declare const errIdentityClosedWithError: (name: string, deleteError: string, remote: string) => OursError;
+export declare const errRootHasRoles: (name: string, roles: string[]) => OursError;
+export declare const errIdentityPartiallyRemoved: (name: string, fail: string) => OursError;
+export declare const errPublicInviteNamed: () => OursError;
+export declare const errNoPolicyArgs: () => OursError;
+export declare const errSendFileArgs: () => OursError;
+export declare const errSendFileFilenameRequired: () => OursError;
+export declare const errFileUnreadable: (detail: string) => OursError;
+export declare const errSaveFileFallback: (wireId: string, existsOnDisk: boolean) => OursError;
+export declare const errNoRoot: () => OursError;
+export declare const errInvalidSelection: (cap: number) => OursError;
+export declare const errMalformedId: () => OursError;
+export declare const errDuplicateId: () => OursError;
+export declare const errUnknownOrStaleId: () => OursError;
+export declare const errTool: (tool: string, detail: string, code?: OursErrorCode) => OursError;

package/dist/errors.js

@@ -0,0 +1,2 @@
+import { createRequire } from 'node:module'; const require = createRequire(import.meta.url);
+import{A,B,C,D,E,F,G,H,I,J,a,b,c,d,e,f,g,h,i,j,k,l,m,n,o,p,q,r,s,t,u,v,w,x,y,z}from"./chunk-UM73BGFH.js";export{a as OursError,c as errBindingReassigned,t as errBoundElsewhere,d as errBoundIdentityGone,H as errDuplicateId,C as errFileUnreadable,v as errIdentityClosedWithError,x as errIdentityPartiallyRemoved,F as errInvalidSelection,G as errMalformedId,f as errNameTaken,g as errNoLeaseHeaders,p as errNoLeaseToken,z as errNoPolicyArgs,E as errNoRoot,o as errNoSuchIdentity,b as errNotBound,j as errNotBoundNoName,k as errNotTemporary,n as errPathNotAbsolute,y as errPublicInviteNamed,h as errRandomNameExhausted,i as errRootExists,w as errRootHasRoles,D as errSaveFileFallback,A as errSendFileArgs,B as errSendFileFilenameRequired,m as errTempClosedWithError,e as errTempClosingBound,q as errTempClosingChoose,l as errTempOwnedElsewhereClose,u as errTempOwnedElsewhereRemove,r as errTempOwnedLive,s as errTempStale,J as errTool,I as errUnknownOrStaleId};

package/dist/events.d.ts

@@ -0,0 +1,144 @@
+import type { Identity } from './identity/model.js';
+export interface DaemonEvent {
+    /** The identity the event belongs to. Resolve sessions from this at FIRE time. */
+    identity: string;
+    /** The event name — the same string written to notifications.log. */
+    event: string;
+    /** The content-free record. Shapes for the measured events are below. */
+    record: Record<string, unknown>;
+}
+/** `on_message_received` (actor.mu:347) — emitted at +19/+31, saved at +20/+32. */
+export interface MessageReceivedRecord {
+    event: 'message_received';
+    from: string;
+    msg_id: string;
+    date: string;
+}
+/** `on_message_received`'s pre-introduction arm (actor.mu:347, emit +19). */
+export interface PendingMessageRecord {
+    event: 'pending_message';
+    from: string;
+    queued: string;
+}
+/** `on_file_received` (actor.mu:399) — emitted at +16, saved at +17. */
+export interface FileReceivedRecord {
+    event: 'file_received';
+    from: string;
+    sender_id: string;
+    file_id: string;
+    wire_id: string;
+    filename: string;
+    mime: string;
+    bytes: string;
+    date: string;
+}
+/** `on_contact_removed` (actor.mu:392) — emit only, there is no state write. */
+export interface ContactRemovedRecord {
+    event: 'contact_removed';
+    cid: string;
+    by: 'local' | 'peer';
+}
+export interface DaemonEventHandlers {
+    /**
+     * Every structured event appended to notifications.log, delivered
+     * SYNCHRONOUSLY at the point of the append.
+     *
+     * THROWING HERE IS A VETO for the events in VETOABLE_EVENTS: the throw
+     * reaches the ADAPT wrapper's action loop, which withholds the transaction's
+     * sends and never reaches the `_save_state` entry that follows the emit in the
+     * same action list. The arrival is NOT durable when this runs. It is also NOT
+     * undone — see "a veto is not a rollback" in the header.
+     *
+     * For every other event the throw simply propagates to whatever called
+     * appendNotifyLog, and TWO OF THOSE CALLERS BITE BACK:
+     *
+     *   `persist_recovered` — emitted inside `saveStateFailClosed`'s own `try`
+     *     (src/state.ts). A throw there is caught by that function's `catch`,
+     *     which sets `id.persistFailed = true`. SO THROWING ON persist_recovered
+     *     QUARANTINES THE IDENTITY — every subsequent mutation is rejected — for a
+     *     persist failure that did not happen. There is no signal that your
+     *     handler caused it.
+     *
+     *   `e2e_restore_rejected` — the one event emitted from BOTH sides. Check
+     *     `record.origin === 'restore'`: that is the boot/restore emit
+     *     (src/identity/provision.ts), where a throw is an ordinary exception on
+     *     the restore path. Without that marker you are inside the action loop and
+     *     a throw is a veto. The marker exists for exactly this question; it is
+     *     asserted by test/daemon-events.test.mjs so it cannot quietly disappear.
+     *
+     * WORKED EXAMPLE, because this one is not a footnote. Suppose you register a
+     * handler that mirrors every event to an external service and lets errors
+     * propagate. The service goes down. Your handler throws on `message_received`,
+     * which vetoes that transaction — and the veto returns to the daemon through
+     * `on_transaction_failure`, which emits `inbound_error`. Your handler is
+     * called again, for the event describing its own veto, and throws again. Every
+     * inbound message now costs two throws and lands unacknowledged, and nothing
+     * in the logs points at your handler. Catch your own errors unless throwing is
+     * the decision you meant to make.
+     */
+    event(e: DaemonEvent): void;
+    /**
+     * The human-readable summary channel — what `setNotifyHook` was.
+     *
+     * DEFERRED, THEREFORE NOT VETOABLE. All 17 call sites fire inside
+     * `process.nextTick` (16 in src/mufl/handlers.ts, one in src/state.ts), so by
+     * the time this runs the action loop has finished. A throw here is an
+     * UNCAUGHT EXCEPTION that takes the process down — it is not a veto and it is
+     * not swallowed. Catch your own errors in this one.
+     *
+     * The identity name is the only routing key on purpose: a host that resolves a
+     * session must do it HERE, at fire time, because a rebind between enqueue and
+     * delivery must route to the new session. No session id appears in this
+     * contract at all, which is what makes the eager version unrepresentable
+     * rather than merely discouraged.
+     */
+    notification(identityName: string, summary: string): void;
+}
+/**
+ * Events emitted from inside `wireHandlers`' `on_return_data` — i.e. inside the
+ * ADAPT wrapper's action loop, where a handler throw is a veto.
+ *
+ * DERIVED FROM THE SOURCE, NOT MAINTAINED BY HAND: every entry is an
+ * `appendNotifyLog` call site in src/mufl/handlers.ts, and
+ * test/daemon-events.test.mjs re-derives this set from that file and fails if it
+ * drifts. Do not edit it to make a test pass.
+ *
+ * TWO TRAPS, because "not in this set" does not mean "harmless":
+ *
+ *   1. `e2e_restore_rejected` is emitted from BOTH src/mufl/handlers.ts (inside
+ *      the loop — vetoable) and src/identity/provision.ts (at boot — not). The
+ *      same event name is vetoable or not depending on where it came from, and
+ *      the record does not say which.
+ *   2. `persist_recovered` is emitted inside `saveStateFailClosed`'s own `try`
+ *      (src/state.ts:127). A handler that throws there is caught by that
+ *      function's `catch`, which sets `id.persistFailed = true` — so throwing on
+ *      persist_recovered QUARANTINES THE IDENTITY for a persist failure that did
+ *      not happen. `persist_failed` (:133) is inside a nested try/catch and a
+ *      throw there is swallowed entirely.
+ *
+ * Trap 1 now has an answer rather than only a warning: the boot-side emit
+ * carries `origin: 'restore'`, so a handler can tell the two apart. Trap 2 has
+ * no such fix and is a genuine footgun; it is repeated on `event` above, at the
+ * point where a handler is registered, because that is where it will be read.
+ */
+export declare const VETOABLE_EVENTS: ReadonlySet<string>;
+/**
+ * Override one entry. Returns an "uninstall mine, if it is still the installed
+ * one" function — closing a daemon must not silently tear down a handler
+ * somebody else installed over it afterwards.
+ */
+export declare function setDaemonEventHandler<K extends keyof DaemonEventHandlers>(name: K, handler: DaemonEventHandlers[K]): () => void;
+/** Restore every entry to its neutral default. For tests and daemon teardown. */
+export declare function resetDaemonEventHandlers(): void;
+/** Is this entry still the neutral default? Used by the inertness assertions. */
+export declare function isDefaultHandler<K extends keyof DaemonEventHandlers>(name: K): boolean;
+/**
+ * Dispatch a structured event. SYNCHRONOUS AND UNGUARDED ON PURPOSE — the throw
+ * is the veto, so there is no try/catch here and there must never be one.
+ *
+ * Read on every call rather than closed over, so re-installing a handler between
+ * one event and the next is honoured.
+ */
+export declare function emitDaemonEvent(id: Identity, record: Record<string, unknown>): void;
+/** Dispatch a summary. Deferred by every caller; see the contract above. */
+export declare function emitDaemonNotification(identityName: string, summary: string): void;

package/dist/events.js

@@ -0,0 +1,2 @@
+import { createRequire } from 'node:module'; const require = createRequire(import.meta.url);
+import{a,b,c,d,e,f}from"./chunk-UJGRFV4J.js";export{a as VETOABLE_EVENTS,e as emitDaemonEvent,f as emitDaemonNotification,d as isDefaultHandler,c as resetDaemonEventHandlers,b as setDaemonEventHandler};

package/dist/files.d.ts

@@ -0,0 +1,2 @@
+export declare function mimeFromExt(p: string): string;
+export declare function sanitizeFilename(name: string): string;

package/dist/files.js

@@ -0,0 +1,2 @@
+import { createRequire } from 'node:module'; const require = createRequire(import.meta.url);
+import{a,b}from"./chunk-P55RJGZU.js";export{a as mimeFromExt,b as sanitizeFilename};

package/dist/gc.d.ts

@@ -0,0 +1,2 @@
+export declare function startGcTimer(): void;
+export declare function stopGcTimer(): void;

package/dist/gc.js

@@ -0,0 +1,2 @@
+import { createRequire } from 'node:module'; const require = createRequire(import.meta.url);
+import{a,b}from"./chunk-ZAXRB5MO.js";import"./chunk-NQQ4GSVI.js";import"./chunk-X4RVJ5VL.js";import"./chunk-DIRW7I4S.js";import"./chunk-YRPUM6JG.js";import"./chunk-LKFYUCN7.js";import"./chunk-P55RJGZU.js";import"./chunk-RAGUBE4Y.js";import"./chunk-Q3UVLSCX.js";import"./chunk-HSVIKO4D.js";import"./chunk-ZHH3PWEW.js";import"./chunk-IB2U7K6Y.js";import"./chunk-UJGRFV4J.js";export{a as startGcTimer,b as stopGcTimer};

package/dist/http/api-routes.d.ts

@@ -0,0 +1,63 @@
+import type { IncomingMessage, ServerResponse } from 'node:http';
+import type { SessionContext } from '../api/types.js';
+/** Everything under this prefix belongs to the typed surface. */
+export declare const API_PREFIX = "/api/v1/";
+type ApiHandler = (ctx: SessionContext, body: unknown) => unknown;
+/**
+ * The dispatch table — one entry per `OursApi` operation, keyed by its exported
+ * name. test/client-parity.test.mjs asserts BOTH directions of completeness:
+ * every operation exported from dist/api/*.js appears here, and every key here
+ * has a matching method on `OursClient`. Adding an operation without a route,
+ * or a route without a client method, is a test failure rather than a silent
+ * hole in the remote surface.
+ */
+export declare const API_OPERATIONS: {
+    createIdentity: ApiHandler;
+    createTemporaryIdentity: ApiHandler;
+    closeTemporaryIdentityOp: ApiHandler;
+    createRootIdentity: ApiHandler;
+    defineLocalIdentityFile: ApiHandler;
+    chooseIdentity: ApiHandler;
+    listIdentities: ApiHandler;
+    currentIdentity: ApiHandler;
+    removeIdentity: ApiHandler;
+    releaseLease: ApiHandler;
+    generateInvite: ApiHandler;
+    listInvites: ApiHandler;
+    revokeInvite: ApiHandler;
+    addContact: ApiHandler;
+    listContacts: ApiHandler;
+    listLocalContactBook: ApiHandler;
+    setLocalBookPolicy: ApiHandler;
+    removeContact: ApiHandler;
+    renameContact: ApiHandler;
+    respondToIntroduction: ApiHandler;
+    setBio: ApiHandler;
+    advertiseMigrate: ApiHandler;
+    setPersona: ApiHandler;
+    sendMessage: ApiHandler;
+    sendFile: ApiHandler;
+    listIncomingMessages: ApiHandler;
+    getMessages: ApiHandler;
+    deferMessages: ApiHandler;
+    listIncomingFiles: ApiHandler;
+    getFiles: ApiHandler;
+    saveFileFallbackNotice: ApiHandler;
+};
+/** The operation names `POST /api/v1/<op>` accepts. */
+export type ApiOperation = keyof typeof API_OPERATIONS;
+interface ApiSession {
+    ctx: SessionContext;
+    release(): void;
+}
+export declare function enterApiSession(req: IncomingMessage): ApiSession;
+/**
+ * Serve one `POST /api/v1/<operation>`. Owns its own auth check, method check
+ * and error handling, so the caller in src/http/server.ts is a single branch
+ * that cannot throw into the shared handler.
+ *
+ * `readBody` is passed in rather than re-implemented: src/http/server.ts holds
+ * the one verbatim copy of the baseline parser (index.ts:5095-5109).
+ */
+export declare function serveApiOperation(req: IncomingMessage, res: ServerResponse, pathname: string, readBody: (req: IncomingMessage) => Promise<unknown>): Promise<void>;
+export {};

package/dist/http/api-routes.js

@@ -0,0 +1,2 @@
+import { createRequire } from 'node:module'; const require = createRequire(import.meta.url);
+import{a,b,c,d}from"../chunk-UELGY557.js";import"../chunk-KZMPGVQM.js";import"../chunk-AJQIWYXG.js";import"../chunk-NSPYN5TT.js";import"../chunk-VW2KWXSJ.js";import"../chunk-3DQSMLVZ.js";import"../chunk-7UUFYO6G.js";import"../chunk-UM73BGFH.js";import"../chunk-NMYSFQBL.js";import"../chunk-VOYMK2OO.js";import"../chunk-T25JIPX5.js";import"../chunk-HCIVLHKC.js";import"../chunk-NQQ4GSVI.js";import"../chunk-X4RVJ5VL.js";import"../chunk-DIRW7I4S.js";import"../chunk-YRPUM6JG.js";import"../chunk-LKFYUCN7.js";import"../chunk-P55RJGZU.js";import"../chunk-RAGUBE4Y.js";import"../chunk-Q3UVLSCX.js";import"../chunk-HSVIKO4D.js";import"../chunk-ZHH3PWEW.js";import"../chunk-IB2U7K6Y.js";import"../chunk-UJGRFV4J.js";export{b as API_OPERATIONS,a as API_PREFIX,c as enterApiSession,d as serveApiOperation};

package/dist/http/server.d.ts

@@ -0,0 +1,120 @@
+import { type IncomingMessage, type ServerResponse } from 'node:http';
+import type { OursConfig } from '../config.js';
+import type { SessionContext } from '../api/types.js';
+/**
+ * The subset of `McpServer` this daemon touches, described structurally.
+ *
+ * ONLY WHAT THE SDK ACTUALLY CALLS BELONGS HERE. `sendLoggingMessage` used to be
+ * declared too, on the reasoning that pinning the host's contract in one place
+ * "keeps the two sides honest". It did the opposite: the SDK never calls it, so
+ * nothing here checked the hand-written signature, and it did not match the real
+ * class — `McpServer.sendLoggingMessage` takes a narrow `level` UNION where this
+ * said `string`. The result was an interface that REJECTED the very class it was
+ * written to describe:
+ *
+ *   error TS2322: Type '(ctx: SessionContext) => McpServer' is not assignable to
+ *   type '(ctx: SessionContext) => McpServerLike'.
+ *     Types of property 'level' are incompatible.
+ *       Type 'string' is not assignable to type '"error" | "warning" | …'.
+ *
+ * ours-mcp hit that on its first attempt to pass a real server to `createServer`.
+ * A structural type describing a dependency the SDK does not have can only be
+ * validated by a consumer, so it must claim the MINIMUM that makes the SDK work —
+ * every extra member is an unchecked guess that can only ever cost a consumer.
+ * `server.sendResourceUpdated` stays because the daemon's own session bookkeeping
+ * hands it out; `connect`/`close` stay because the daemon calls both.
+ */
+export interface McpServerLike {
+    connect(transport: unknown): Promise<void>;
+    close(): Promise<void>;
+    server: {
+        onerror?: (e: Error) => void;
+        sendResourceUpdated(a: {
+            uri: string;
+        }): void;
+    };
+}
+/** The subset of a Streamable-HTTP MCP transport this daemon touches. */
+export interface McpTransportLike {
+    readonly sessionId?: string;
+    onclose?: () => void;
+    handleRequest(req: IncomingMessage, res: ServerResponse, parsedBody?: unknown): Promise<void>;
+    close(): Promise<void>;
+}
+/** The construction arguments the daemon supplies for each new session. */
+export interface McpTransportInit {
+    sessionIdGenerator: () => string;
+    onsessioninitialized: (sid: string) => void;
+}
+export interface McpIntegration {
+    /**
+     * Build the per-session MCP server. `ctx` resolves the session id, lease
+     * token and client pid LAZILY — the transport has no session id until the
+     * initialize response, and the headers change on every request.
+     */
+    createServer(ctx: SessionContext): McpServerLike;
+    /** Build the transport. See THE MCP SEAM above for why this is injected. */
+    createTransport(init: McpTransportInit): McpTransportLike;
+    /**
+     * The MCP SDK's `isInitializeRequest`. Optional: without it the daemon uses
+     * the zod-free structural check below, which is deliberately lenient about
+     * `params` (a stricter re-implementation would risk rejecting a request the
+     * real predicate accepts). Hosts that have the MCP SDK should pass the real
+     * one so the two sides cannot drift.
+     */
+    isInitializeRequest?(body: unknown): boolean;
+    /**
+     * Called the moment a session id EXISTS, with the server built for it.
+     *
+     * THIS EXISTS BECAUSE ITS ABSENCE WAS A SILENT BUG, and the shape of the bug
+     * is worth keeping written down. `createServer(ctx)` runs BEFORE the
+     * initialize response, so `ctx.sessionId()` still answers 'pending' there —
+     * every host that tried to key its own registry inside createServer keyed
+     * nothing. ours-mcp did exactly that, guarded with `if (sid !== 'pending')`,
+     * so its serversBySession map stayed EMPTY for the whole life of the daemon
+     * and no inbox resource update ever reached an HTTP client. Nothing errored;
+     * the notify log printed the same line it prints on success.
+     *
+     * `onSessionClosed` had no counterpart, which is what made the gap easy to
+     * miss — a registry with a teardown hook and no setup hook looks complete.
+     * The server is passed rather than left for the host to correlate, because
+     * correlating "the server I made most recently" with "the session that just
+     * initialized" is a race as soon as two clients connect at once.
+     *
+     * ours-mcp's test/resource-updated.test.mjs is the end-to-end proof.
+     */
+    onSessionInitialized?(sid: string, server: McpServerLike): void;
+    /**
+     * Called once a session is gone (transport close, or dead-client reap) so the
+     * host can drop its own per-session registry. The SDK does not know about
+     * ours-mcp's serversBySession map; this is how it stays in step.
+     */
+    onSessionClosed?(sid: string): void;
+}
+export interface DaemonOptions {
+    /**
+     * The resolved runtime config. The SDK's engine modules read their config at
+     * MODULE LOAD (src/runtime/env.ts), so passing a different one here cannot
+     * retroactively move the state dir or the broker — set OURS_* / config.json
+     * BEFORE importing the SDK. Supplying a config that disagrees with the loaded
+     * one therefore throws rather than being silently half-applied.
+     */
+    config?: OursConfig;
+    mcp?: McpIntegration;
+    /**
+     * The HOST package's version, for the startup line. Without it the daemon
+     * announces the SDK's version, which is not the number a user installed.
+     */
+    version?: string;
+    /**
+     * Notification sink. Wired into src/notify.ts's `setNotifyHook`; the third
+     * argument is `leases.get(identityName)?.sid ?? null`, RESOLVED WHEN THE
+     * CALLBACK FIRES (see the wiring below).
+     */
+    onIdentityNotify?(identityName: string, summary: string, boundSessionId: string | null): void;
+}
+export interface DaemonHandle {
+    port: number;
+    close(): Promise<void>;
+}
+export declare function startDaemon(opts?: DaemonOptions): Promise<DaemonHandle>;

package/dist/http/server.js

@@ -0,0 +1,2 @@
+import { createRequire } from 'node:module'; const require = createRequire(import.meta.url);
+import{a}from"../chunk-PCHN744Y.js";import"../chunk-37D5PCFY.js";import"../chunk-V64IUVSS.js";import"../chunk-ZAXRB5MO.js";import"../chunk-UELGY557.js";import"../chunk-KZMPGVQM.js";import"../chunk-AJQIWYXG.js";import"../chunk-NSPYN5TT.js";import"../chunk-VW2KWXSJ.js";import"../chunk-3DQSMLVZ.js";import"../chunk-7UUFYO6G.js";import"../chunk-UM73BGFH.js";import"../chunk-A3SXVUOC.js";import"../chunk-NMYSFQBL.js";import"../chunk-VOYMK2OO.js";import"../chunk-T25JIPX5.js";import"../chunk-HCIVLHKC.js";import"../chunk-NQQ4GSVI.js";import"../chunk-X4RVJ5VL.js";import"../chunk-DIRW7I4S.js";import"../chunk-YRPUM6JG.js";import"../chunk-LKFYUCN7.js";import"../chunk-P55RJGZU.js";import"../chunk-RAGUBE4Y.js";import"../chunk-Q3UVLSCX.js";import"../chunk-HSVIKO4D.js";import"../chunk-ZHH3PWEW.js";import"../chunk-IB2U7K6Y.js";import"../chunk-UJGRFV4J.js";export{a as startDaemon};

package/dist/identity/hierarchy.d.ts

@@ -0,0 +1,20 @@
+import { type Identity } from './model.js';
+export declare function setRootName(name: string | null): void;
+export declare let rootName: string | null;
+export declare function readRootMarker(): string | null;
+export declare function clearRootMarker(): void;
+export interface IdentityInfo {
+    bio: string;
+    persona: string;
+    hasCert: boolean;
+    roleId: string;
+    rootCid: string;
+    rootName: string;
+    monitoringEnabled: boolean;
+}
+export declare function describeIdentity(id: Identity): IdentityInfo;
+export declare function delegateRole(root: Identity, role: Identity): Promise<void>;
+export declare function establishRoot(id: Identity): Promise<{
+    adopted: string[];
+    failed: string[];
+}>;

package/dist/identity/hierarchy.js

@@ -0,0 +1,2 @@
+import { createRequire } from 'node:module'; const require = createRequire(import.meta.url);
+import{a,b,c,d,e,f,g}from"../chunk-HCIVLHKC.js";import"../chunk-NQQ4GSVI.js";import"../chunk-X4RVJ5VL.js";import"../chunk-DIRW7I4S.js";import"../chunk-YRPUM6JG.js";import"../chunk-LKFYUCN7.js";import"../chunk-P55RJGZU.js";import"../chunk-RAGUBE4Y.js";import"../chunk-Q3UVLSCX.js";import"../chunk-HSVIKO4D.js";import"../chunk-ZHH3PWEW.js";import"../chunk-IB2U7K6Y.js";import"../chunk-UJGRFV4J.js";export{d as clearRootMarker,f as delegateRole,e as describeIdentity,g as establishRoot,c as readRootMarker,b as rootName,a as setRootName};

package/dist/identity/lease.d.ts

@@ -0,0 +1,29 @@
+import { type Identity } from './model.js';
+import type { OursErrorCode } from '../errors.js';
+export interface Lease {
+    identity: string;
+    token: string;
+    pid: number;
+    sid: string;
+    epoch: number;
+    boundAt: number;
+}
+export declare const leases: Map<string, Lease>;
+export declare const tombstones: Set<string>;
+export declare const sessionHeaders: Map<string, {
+    token?: string;
+    pid?: number;
+}>;
+export declare const outboundRemovalInFlight: Set<string>;
+export declare function pidAlive(pid: number): boolean;
+export declare function leaseByToken(token: string): Lease | undefined;
+export declare function persistBindings(): void;
+type Bound = {
+    id: Identity;
+} | {
+    error: string;
+    code: OursErrorCode;
+};
+export declare function resolveBound(sid: string): Bound;
+export declare function bindSession(sid: string, name: string): void;
+export {};

package/dist/identity/lease.js

@@ -0,0 +1,2 @@
+import { createRequire } from 'node:module'; const require = createRequire(import.meta.url);
+import{a,b,c,d,e,f,g,h,i}from"../chunk-RAGUBE4Y.js";import"../chunk-Q3UVLSCX.js";import"../chunk-HSVIKO4D.js";import"../chunk-ZHH3PWEW.js";import"../chunk-IB2U7K6Y.js";export{i as bindSession,f as leaseByToken,a as leases,d as outboundRemovalInFlight,g as persistBindings,e as pidAlive,h as resolveBound,c as sessionHeaders,b as tombstones};

package/dist/identity/lifecycle.d.ts

@@ -0,0 +1,5 @@
+import { type Identity, type TempCloseResult } from './model.js';
+export declare function deleteIdentityCompletely(id: Identity): string | null;
+export declare function closeTemporaryIdentity(id: Identity, cause: string): Promise<TempCloseResult>;
+export declare function sweepStaleTempIdentities(): void;
+export declare function sweepOrphanTempDirs(): void;

package/dist/identity/lifecycle.js

@@ -0,0 +1,2 @@
+import { createRequire } from 'node:module'; const require = createRequire(import.meta.url);
+import{a,b,c,d}from"../chunk-NMYSFQBL.js";import"../chunk-HCIVLHKC.js";import"../chunk-NQQ4GSVI.js";import"../chunk-X4RVJ5VL.js";import"../chunk-DIRW7I4S.js";import"../chunk-YRPUM6JG.js";import"../chunk-LKFYUCN7.js";import"../chunk-P55RJGZU.js";import"../chunk-RAGUBE4Y.js";import"../chunk-Q3UVLSCX.js";import"../chunk-HSVIKO4D.js";import"../chunk-ZHH3PWEW.js";import"../chunk-IB2U7K6Y.js";import"../chunk-UJGRFV4J.js";export{b as closeTemporaryIdentity,a as deleteIdentityCompletely,d as sweepOrphanTempDirs,c as sweepStaleTempIdentities};

package/dist/identity/model.d.ts

@@ -0,0 +1,67 @@
+import type { AdaptWrapper, AdaptPacketWrapper } from '@adapt-toolkit/sdk/wrappers';
+import type { AdaptValue } from '@adapt-toolkit/sdk/backend';
+type Pending = {
+    resolve: (v: AdaptValue) => void;
+    reject: (e: Error) => void;
+    timer: ReturnType<typeof setTimeout>;
+};
+export interface TempMeta {
+    owner: {
+        tokenHash: string;
+        pid: number;
+    };
+    createdAt: number;
+    closing?: Promise<TempCloseResult>;
+}
+export interface TempCloseResult {
+    attempted: number;
+    notified: number;
+    failed: number;
+    deleteError: string | null;
+}
+export interface Identity {
+    name: string;
+    cid: string;
+    pw: AdaptPacketWrapper;
+    dir: string;
+    pending: Pending[];
+    lock: Promise<void>;
+    persistFailed?: boolean;
+    temp?: TempMeta;
+}
+export declare let wrapper: AdaptWrapper;
+export declare function setWrapper(w: AdaptWrapper): void;
+export declare const identities: Map<string, Identity>;
+export declare let registrar: Identity | null;
+export declare let registrarAdBlob: Buffer | null;
+export declare function setRegistrar(id: Identity | null): void;
+export declare function setRegistrarAdBlob(blob: Buffer | null): void;
+export declare const identityDir: (name: string) => string;
+export declare const keyPath: (dir: string) => string;
+export declare const dataPath: (dir: string) => string;
+export declare const notifyLogPath: (dir: string) => string;
+export declare const unreadPath: (dir: string) => string;
+export declare const filesDirFor: (id: Identity) => string;
+export declare const tempMetaPath: (dir: string) => string;
+export declare const hashLeaseToken: (token: string) => string;
+export declare function writeTempMetaFile(dir: string, meta: {
+    owner: {
+        tokenHash: string;
+        pid: number;
+    };
+    createdAt: number;
+}): void;
+export declare function readTempMetaFile(dir: string): {
+    owner: {
+        tokenHash: string;
+        pid: number;
+    };
+    createdAt: number;
+} | null;
+export declare function tightenIdentityPerms(): void;
+export declare const isWireId: (s: string) => boolean;
+export declare const isSelectableWireId: (s: string) => boolean;
+export declare const FILE_SELECTION_CAP = 32;
+export declare function findIdentityFile(id: Identity, wireId: string): string | null;
+export declare function listPersistedNames(): string[];
+export {};

package/dist/identity/model.js

@@ -0,0 +1,2 @@
+import { createRequire } from 'node:module'; const require = createRequire(import.meta.url);
+import{a,b,c,d,e,f,g,h,i,j,k,l,m,n,o,p,q,r,s,t,u,v,w}from"../chunk-Q3UVLSCX.js";import"../chunk-HSVIKO4D.js";import"../chunk-ZHH3PWEW.js";import"../chunk-IB2U7K6Y.js";export{u as FILE_SELECTION_CAP,j as dataPath,m as filesDirFor,v as findIdentityFile,o as hashLeaseToken,c as identities,h as identityDir,t as isSelectableWireId,s as isWireId,i as keyPath,w as listPersistedNames,k as notifyLogPath,q as readTempMetaFile,d as registrar,e as registrarAdBlob,f as setRegistrar,g as setRegistrarAdBlob,b as setWrapper,n as tempMetaPath,r as tightenIdentityPerms,l as unreadPath,a as wrapper,p as writeTempMetaFile};

package/dist/identity/provision.d.ts

@@ -0,0 +1,12 @@
+import { type Identity } from './model.js';
+export declare function createPacket(name: string, seed: string, dir: string, track?: boolean, signingSecret?: string, deferExposure?: boolean): Promise<Identity>;
+export declare const reservedNames: Set<string>;
+export declare function provisionIdentity(name: string, opts?: {
+    exposeLocal: boolean;
+    localAutoAccept: boolean;
+    temp?: {
+        tokenHash: string;
+        pid: number;
+    };
+}): Promise<Identity>;
+export declare function restoreIdentity(name: string): Promise<Identity>;

package/dist/identity/provision.js

@@ -0,0 +1,2 @@
+import { createRequire } from 'node:module'; const require = createRequire(import.meta.url);
+import{w as a,x as b,y as c,z as d}from"../chunk-NQQ4GSVI.js";import"../chunk-X4RVJ5VL.js";import"../chunk-DIRW7I4S.js";import"../chunk-YRPUM6JG.js";import"../chunk-LKFYUCN7.js";import"../chunk-P55RJGZU.js";import"../chunk-RAGUBE4Y.js";import"../chunk-Q3UVLSCX.js";import"../chunk-HSVIKO4D.js";import"../chunk-ZHH3PWEW.js";import"../chunk-IB2U7K6Y.js";import"../chunk-UJGRFV4J.js";export{a as createPacket,c as provisionIdentity,b as reservedNames,d as restoreIdentity};