@ours.network/sdk 3.0.3 → 3.1.0

package/README.md

@@ -42,6 +42,35 @@ Old `autoStart` JSON and `OURS_AUTOSTART` are ignored in SDK 2. Start the daemon
 with `ours daemon start` or install its per-user service with
 `ours daemon install-service`.
 
+## Identity readiness and temporary lifetime
+
+Temporary identities require an existing Human/root identity. Creation stages
+the packet without routing or local publication, installs the root delegation,
+and only then exposes and binds the new role. Any failure before readiness rolls
+back its packet, keys, history, lease metadata, contact-book entry and directory.
+
+Restore follows the same readiness barrier. Existing delegated chains proceed;
+a legacy no-certificate identity is delegated under the host root before it is
+exposed. On a rootless host it remains a management-only quarantine row with
+only `{name, status}` until a Human/root is created and adopts it. Quarantined
+state cannot bind, send, advertise, publish, or serve notifications.
+
+`OursClient.releaseLease()` awaits teardown of every temporary identity owned by
+the lease token, including identities the client switched away from. Its result
+contains `released`, `closed`, `attempted`, `notified`, and `failed`; remote
+remove-me delivery remains best effort, while any local cleanup failure rejects
+with `OursError` code `DELETE_PARTIAL`. MCP `DELETE /mcp` uses the same awaited
+implementation.
+
+Crash recovery checks local owner PIDs every five seconds by default. Override
+with `OURS_SESSION_REAPER_INTERVAL_MS` (minimum 100 ms). Only an OS-confirmed
+`ESRCH` is destructive: live, missing, invalid, permission-denied, or otherwise
+unresolved PIDs are never reaped, and boot awaits stale/orphan cleanup before
+declaring readiness.
+
+The SDK has one release line: normal stable publication from `main`. It has no
+nightly/prerelease branch, tag, or publication workflow.
+
 ## Message and file history
 
 Application payloads are stored by the daemon, outside the MUFL packet. Each
@@ -53,6 +82,25 @@ Persistent history is available through `listHistory`, `getHistoryItem`,
 `getHistorySummary`,
 `listFiles`, and `getFileInfo`; `fetchFile` streams stored bytes from the daemon.
 
+Persistent history is bounded daemon-wide by `historyMaxBytes` (environment:
+`OURS_HISTORY_MAX_BYTES`), defaulting to 104857600 bytes (100 MiB). This is one
+cap for the entire state root, not a per-identity allowance. It accounts for
+each `history.sqlite3`, its WAL/SHM files, and immutable history blobs using
+filesystem measurements. Set it to `0` for unlimited history/disabled rotation.
+
+Rotation removes the globally oldest eligible rows while preserving remaining
+history order. Unread and pending-introduction inputs, outbound items still in
+`sent`, monitoring/control queues, and the newest application item in the state
+root are protected. Consequently protected/newest data can exceed the cap; the
+daemon reports that deterministic overflow instead of deleting it. Read the
+body-free status through `OursClient.historyStorage()` or authenticated
+`GET /history-storage`. Large legacy databases that cannot be safely converted
+within the bounded 128 MiB migration limit remain readable and report
+`compaction_blocked` rather than triggering an unbounded startup VACUUM.
+Incoming files also receive a five-minute access grace after `getFiles` marks
+them read, so a returned immutable path cannot be rotated while the caller is
+still consuming it; this bounded grace is reported as protected storage.
+
 This design intentionally does not coordinate protocol delivery receipts with
 the filesystem write. A process or local-storage failure after protocol
 acceptance can therefore lose an item even if its sender considers it delivered.

package/dist/api/contacts.js

@@ -1,2 +1,2 @@
 import { createRequire } from 'node:module'; const require = createRequire(import.meta.url);
-import{a,b,c,d,e,f,g,h,i,j}from"../chunk-LRMN6BSO.js";import"../chunk-SBKG5P7O.js";import"../chunk-J2Q2JDUS.js";import"../chunk-JOKNFUW3.js";import"../chunk-DIRW7I4S.js";import"../chunk-65KGEJBX.js";import"../chunk-M2WREVID.js";import"../chunk-PJ5F7BI6.js";import"../chunk-GJXNZNS6.js";import"../chunk-NODVUYDQ.js";import"../chunk-YRPUM6JG.js";import"../chunk-O3WRMYAS.js";import"../chunk-PMDY4YIZ.js";import"../chunk-ETBJ4VOK.js";import"../chunk-ZLCQNN5W.js";import"../chunk-ZHH3PWEW.js";import"../chunk-Y3VPZJTG.js";import"../chunk-TXAIJEXA.js";import"../chunk-JTBQO6IT.js";import"../chunk-WS6UFNKF.js";export{d as addContact,a as generateInvite,e as listContacts,b as listInvites,f as listLocalContactBook,h as removeContact,i as renameContact,j as respondToIntroduction,c as revokeInvite,g as setLocalBookPolicy};
+import{a,b,c,d,e,f,g,h,i,j}from"../chunk-ZOZFAMAX.js";import"../chunk-3CPIRV4P.js";import"../chunk-2ZQPUBE4.js";import"../chunk-7ZZWD64L.js";import"../chunk-Y77ZVHTD.js";import"../chunk-JOKNFUW3.js";import"../chunk-DIRW7I4S.js";import"../chunk-65KGEJBX.js";import"../chunk-WZQNO4PZ.js";import"../chunk-E34QSIVP.js";import"../chunk-AH3RIV2J.js";import"../chunk-YRPUM6JG.js";import"../chunk-7Q3OCSPV.js";import"../chunk-RL3OEL5W.js";import"../chunk-5JKYJZAR.js";import"../chunk-IFCOOPD7.js";import"../chunk-ZHH3PWEW.js";import"../chunk-Y3VPZJTG.js";import"../chunk-MGNMJ64X.js";import"../chunk-XIWAQH6S.js";import"../chunk-JTBQO6IT.js";import"../chunk-2X5HGMMO.js";export{d as addContact,a as generateInvite,e as listContacts,b as listInvites,f as listLocalContactBook,h as removeContact,i as renameContact,j as respondToIntroduction,c as revokeInvite,g as setLocalBookPolicy};

package/dist/api/files.js

@@ -1,2 +1,2 @@
 import { createRequire } from 'node:module'; const require = createRequire(import.meta.url);
-import{a,b,c}from"../chunk-PBLR7J42.js";import"../chunk-SBKG5P7O.js";import"../chunk-J2Q2JDUS.js";import"../chunk-JOKNFUW3.js";import"../chunk-DIRW7I4S.js";import"../chunk-65KGEJBX.js";import"../chunk-M2WREVID.js";import"../chunk-PJ5F7BI6.js";import"../chunk-GJXNZNS6.js";import"../chunk-NODVUYDQ.js";import"../chunk-YRPUM6JG.js";import"../chunk-O3WRMYAS.js";import"../chunk-PMDY4YIZ.js";import"../chunk-ETBJ4VOK.js";import"../chunk-ZLCQNN5W.js";import"../chunk-ZHH3PWEW.js";import"../chunk-Y3VPZJTG.js";import"../chunk-TXAIJEXA.js";import"../chunk-JTBQO6IT.js";import"../chunk-WS6UFNKF.js";export{b as getFiles,a as listIncomingFiles,c as saveFileFallbackNotice};
+import{a,b,c}from"../chunk-AAXXFRZP.js";import"../chunk-3CPIRV4P.js";import"../chunk-2ZQPUBE4.js";import"../chunk-7ZZWD64L.js";import"../chunk-Y77ZVHTD.js";import"../chunk-JOKNFUW3.js";import"../chunk-DIRW7I4S.js";import"../chunk-65KGEJBX.js";import"../chunk-WZQNO4PZ.js";import"../chunk-E34QSIVP.js";import"../chunk-AH3RIV2J.js";import"../chunk-YRPUM6JG.js";import"../chunk-7Q3OCSPV.js";import"../chunk-RL3OEL5W.js";import"../chunk-5JKYJZAR.js";import"../chunk-IFCOOPD7.js";import"../chunk-ZHH3PWEW.js";import"../chunk-Y3VPZJTG.js";import"../chunk-MGNMJ64X.js";import"../chunk-XIWAQH6S.js";import"../chunk-JTBQO6IT.js";import"../chunk-2X5HGMMO.js";export{b as getFiles,a as listIncomingFiles,c as saveFileFallbackNotice};

package/dist/api/history.js

@@ -1,2 +1,2 @@
 import { createRequire } from 'node:module'; const require = createRequire(import.meta.url);
-import{a,b,c,d,e}from"../chunk-5KVWI5BW.js";import"../chunk-SBKG5P7O.js";import"../chunk-J2Q2JDUS.js";import"../chunk-JOKNFUW3.js";import"../chunk-DIRW7I4S.js";import"../chunk-65KGEJBX.js";import"../chunk-M2WREVID.js";import"../chunk-PJ5F7BI6.js";import"../chunk-GJXNZNS6.js";import"../chunk-NODVUYDQ.js";import"../chunk-YRPUM6JG.js";import"../chunk-O3WRMYAS.js";import"../chunk-PMDY4YIZ.js";import"../chunk-ETBJ4VOK.js";import"../chunk-ZLCQNN5W.js";import"../chunk-ZHH3PWEW.js";import"../chunk-Y3VPZJTG.js";import"../chunk-TXAIJEXA.js";import"../chunk-JTBQO6IT.js";import"../chunk-WS6UFNKF.js";export{e as getFileInfo,b as getHistoryItem,c as getHistorySummary,d as listFiles,a as listHistory};
+import{a,b,c,d,e}from"../chunk-UZF6OB3R.js";import"../chunk-3CPIRV4P.js";import"../chunk-2ZQPUBE4.js";import"../chunk-7ZZWD64L.js";import"../chunk-Y77ZVHTD.js";import"../chunk-JOKNFUW3.js";import"../chunk-DIRW7I4S.js";import"../chunk-65KGEJBX.js";import"../chunk-WZQNO4PZ.js";import"../chunk-E34QSIVP.js";import"../chunk-AH3RIV2J.js";import"../chunk-YRPUM6JG.js";import"../chunk-7Q3OCSPV.js";import"../chunk-RL3OEL5W.js";import"../chunk-5JKYJZAR.js";import"../chunk-IFCOOPD7.js";import"../chunk-ZHH3PWEW.js";import"../chunk-Y3VPZJTG.js";import"../chunk-MGNMJ64X.js";import"../chunk-XIWAQH6S.js";import"../chunk-JTBQO6IT.js";import"../chunk-2X5HGMMO.js";export{e as getFileInfo,b as getHistoryItem,c as getHistorySummary,d as listFiles,a as listHistory};

package/dist/api/identity.js

@@ -1,2 +1,2 @@
 import { createRequire } from 'node:module'; const require = createRequire(import.meta.url);
-import{a,b,c,d,e,f,g,h,i,j,k}from"../chunk-SBKG5P7O.js";import"../chunk-J2Q2JDUS.js";import"../chunk-JOKNFUW3.js";import"../chunk-DIRW7I4S.js";import"../chunk-65KGEJBX.js";import"../chunk-M2WREVID.js";import"../chunk-PJ5F7BI6.js";import"../chunk-GJXNZNS6.js";import"../chunk-NODVUYDQ.js";import"../chunk-YRPUM6JG.js";import"../chunk-O3WRMYAS.js";import"../chunk-PMDY4YIZ.js";import"../chunk-ETBJ4VOK.js";import"../chunk-ZLCQNN5W.js";import"../chunk-ZHH3PWEW.js";import"../chunk-Y3VPZJTG.js";import"../chunk-TXAIJEXA.js";import"../chunk-JTBQO6IT.js";import"../chunk-WS6UFNKF.js";export{g as chooseIdentity,d as closeTemporaryIdentityOp,b as createIdentity,e as createRootIdentity,c as createTemporaryIdentity,i as currentIdentity,f as defineLocalIdentityFile,h as listIdentities,k as releaseLease,j as removeIdentity,a as requireBound};
+import{a,b,c,d,e,f,g,h,i,j,k}from"../chunk-3CPIRV4P.js";import"../chunk-2ZQPUBE4.js";import"../chunk-7ZZWD64L.js";import"../chunk-Y77ZVHTD.js";import"../chunk-JOKNFUW3.js";import"../chunk-DIRW7I4S.js";import"../chunk-65KGEJBX.js";import"../chunk-WZQNO4PZ.js";import"../chunk-E34QSIVP.js";import"../chunk-AH3RIV2J.js";import"../chunk-YRPUM6JG.js";import"../chunk-7Q3OCSPV.js";import"../chunk-RL3OEL5W.js";import"../chunk-5JKYJZAR.js";import"../chunk-IFCOOPD7.js";import"../chunk-ZHH3PWEW.js";import"../chunk-Y3VPZJTG.js";import"../chunk-MGNMJ64X.js";import"../chunk-XIWAQH6S.js";import"../chunk-JTBQO6IT.js";import"../chunk-2X5HGMMO.js";export{g as chooseIdentity,d as closeTemporaryIdentityOp,b as createIdentity,e as createRootIdentity,c as createTemporaryIdentity,i as currentIdentity,f as defineLocalIdentityFile,h as listIdentities,k as releaseLease,j as removeIdentity,a as requireBound};

package/dist/api/messaging.js

@@ -1,2 +1,2 @@
 import { createRequire } from 'node:module'; const require = createRequire(import.meta.url);
-import{a,b,c,d}from"../chunk-LPXPNZTS.js";import"../chunk-67DAPEUW.js";import"../chunk-VXVW4KJU.js";import"../chunk-5OAIOIQ2.js";import"../chunk-P55RJGZU.js";import"../chunk-SBKG5P7O.js";import"../chunk-J2Q2JDUS.js";import"../chunk-JOKNFUW3.js";import"../chunk-DIRW7I4S.js";import"../chunk-65KGEJBX.js";import"../chunk-M2WREVID.js";import"../chunk-PJ5F7BI6.js";import"../chunk-GJXNZNS6.js";import"../chunk-NODVUYDQ.js";import"../chunk-YRPUM6JG.js";import"../chunk-O3WRMYAS.js";import"../chunk-PMDY4YIZ.js";import"../chunk-ETBJ4VOK.js";import"../chunk-ZLCQNN5W.js";import"../chunk-ZHH3PWEW.js";import"../chunk-Y3VPZJTG.js";import"../chunk-TXAIJEXA.js";import"../chunk-JTBQO6IT.js";import"../chunk-WS6UFNKF.js";export{d as getMessages,c as listIncomingMessages,b as sendFile,a as sendMessage};
+import{a,b,c,d}from"../chunk-XKPZWKI4.js";import"../chunk-4QU3AKO6.js";import"../chunk-VXVW4KJU.js";import"../chunk-WBCVUXOI.js";import"../chunk-P55RJGZU.js";import"../chunk-3CPIRV4P.js";import"../chunk-2ZQPUBE4.js";import"../chunk-7ZZWD64L.js";import"../chunk-Y77ZVHTD.js";import"../chunk-JOKNFUW3.js";import"../chunk-DIRW7I4S.js";import"../chunk-65KGEJBX.js";import"../chunk-WZQNO4PZ.js";import"../chunk-E34QSIVP.js";import"../chunk-AH3RIV2J.js";import"../chunk-YRPUM6JG.js";import"../chunk-7Q3OCSPV.js";import"../chunk-RL3OEL5W.js";import"../chunk-5JKYJZAR.js";import"../chunk-IFCOOPD7.js";import"../chunk-ZHH3PWEW.js";import"../chunk-Y3VPZJTG.js";import"../chunk-MGNMJ64X.js";import"../chunk-XIWAQH6S.js";import"../chunk-JTBQO6IT.js";import"../chunk-2X5HGMMO.js";export{d as getMessages,c as listIncomingMessages,b as sendFile,a as sendMessage};

package/dist/api/profile.js

@@ -1,2 +1,2 @@
 import { createRequire } from 'node:module'; const require = createRequire(import.meta.url);
-import{a,b,c,d}from"../chunk-JTQMUWPE.js";import"../chunk-SBKG5P7O.js";import"../chunk-J2Q2JDUS.js";import"../chunk-JOKNFUW3.js";import"../chunk-DIRW7I4S.js";import"../chunk-65KGEJBX.js";import"../chunk-M2WREVID.js";import"../chunk-PJ5F7BI6.js";import"../chunk-GJXNZNS6.js";import"../chunk-NODVUYDQ.js";import"../chunk-YRPUM6JG.js";import"../chunk-O3WRMYAS.js";import"../chunk-PMDY4YIZ.js";import"../chunk-ETBJ4VOK.js";import"../chunk-ZLCQNN5W.js";import"../chunk-ZHH3PWEW.js";import"../chunk-Y3VPZJTG.js";import"../chunk-TXAIJEXA.js";import"../chunk-JTBQO6IT.js";import"../chunk-WS6UFNKF.js";export{b as advertiseMigrate,d as readvertiseOnUpgrade,a as setBio,c as setPersona};
+import{a,b,c,d}from"../chunk-3ZIC5X5I.js";import"../chunk-3CPIRV4P.js";import"../chunk-2ZQPUBE4.js";import"../chunk-7ZZWD64L.js";import"../chunk-Y77ZVHTD.js";import"../chunk-JOKNFUW3.js";import"../chunk-DIRW7I4S.js";import"../chunk-65KGEJBX.js";import"../chunk-WZQNO4PZ.js";import"../chunk-E34QSIVP.js";import"../chunk-AH3RIV2J.js";import"../chunk-YRPUM6JG.js";import"../chunk-7Q3OCSPV.js";import"../chunk-RL3OEL5W.js";import"../chunk-5JKYJZAR.js";import"../chunk-IFCOOPD7.js";import"../chunk-ZHH3PWEW.js";import"../chunk-Y3VPZJTG.js";import"../chunk-MGNMJ64X.js";import"../chunk-XIWAQH6S.js";import"../chunk-JTBQO6IT.js";import"../chunk-2X5HGMMO.js";export{b as advertiseMigrate,d as readvertiseOnUpgrade,a as setBio,c as setPersona};

package/dist/api/types.d.ts

@@ -29,6 +29,8 @@ export interface CreateIdentityResult {
 export interface CreateTempResult {
     info: IdentityInfo;
     ownerPid: number;
+    hierarchy: 'role';
+    underRoot: string;
     exposedLocal: boolean;
     localAutoAccept: boolean;
 }
@@ -37,16 +39,21 @@ export interface BindResult {
     cid: string;
     switchedFrom: string | null;
 }
-export interface IdentityTreeRow {
+export interface ActiveIdentityTreeRow {
     name: string;
     cid: string;
-    kind: 'root' | 'role' | 'flat';
+    kind: 'root' | 'role';
     temp: null | {
         state: 'mine' | 'other-live' | 'stale' | 'closing';
         ownerPid: number;
     };
     session: 'mine' | 'other-live' | null;
 }
+export interface QuarantinedIdentityTreeRow {
+    name: string;
+    status: 'awaiting-root' | 'migration-failed';
+}
+export type IdentityTreeRow = ActiveIdentityTreeRow | QuarantinedIdentityTreeRow;
 export interface RemoveResult {
     name: string;
     kind: 'permanent' | 'temporary';
@@ -198,6 +205,10 @@ export interface GetFilesResult {
 }
 export interface ReleaseLeaseResult {
     released: string[];
+    closed: string[];
+    attempted: number;
+    notified: number;
+    failed: number;
 }
 export interface SaveFileNotice {
     existsOnDisk: boolean;

package/dist/book.js

@@ -1,2 +1,2 @@
 import { createRequire } from 'node:module'; const require = createRequire(import.meta.url);
-import{A as e,B as f,C as g,D as h,E as i,F as j,w as a,x as b,y as c,z as d}from"./chunk-NODVUYDQ.js";import"./chunk-YRPUM6JG.js";import"./chunk-O3WRMYAS.js";import"./chunk-PMDY4YIZ.js";import"./chunk-ETBJ4VOK.js";import"./chunk-ZLCQNN5W.js";import"./chunk-ZHH3PWEW.js";import"./chunk-Y3VPZJTG.js";import"./chunk-TXAIJEXA.js";import"./chunk-JTBQO6IT.js";import"./chunk-WS6UFNKF.js";export{a as bookDir,c as bookPath,f as exportAdBlob,g as exportSigningSecret,j as pinRegistrar,h as publishToBook,d as readBook,b as registrarKeyPath,i as unpublishFromBook,e as writeBook};
+import{F as a,G as b,H as c,I as d,J as e,K as f,L as g,M as h,N as i,O as j}from"./chunk-AH3RIV2J.js";import"./chunk-YRPUM6JG.js";import"./chunk-7Q3OCSPV.js";import"./chunk-RL3OEL5W.js";import"./chunk-5JKYJZAR.js";import"./chunk-IFCOOPD7.js";import"./chunk-ZHH3PWEW.js";import"./chunk-Y3VPZJTG.js";import"./chunk-MGNMJ64X.js";import"./chunk-XIWAQH6S.js";import"./chunk-JTBQO6IT.js";import"./chunk-2X5HGMMO.js";export{a as bookDir,c as bookPath,f as exportAdBlob,g as exportSigningSecret,j as pinRegistrar,h as publishToBook,d as readBook,b as registrarKeyPath,i as unpublishFromBook,e as writeBook};

package/dist/boot.js

@@ -1,2 +1,2 @@
 import { createRequire } from 'node:module'; const require = createRequire(import.meta.url);
-import{a,b}from"./chunk-2XOTJ6G3.js";import"./chunk-EHCBEY52.js";import"./chunk-J2Q2JDUS.js";import"./chunk-JOKNFUW3.js";import"./chunk-DIRW7I4S.js";import"./chunk-M2WREVID.js";import"./chunk-PJ5F7BI6.js";import"./chunk-GJXNZNS6.js";import"./chunk-NODVUYDQ.js";import"./chunk-YRPUM6JG.js";import"./chunk-O3WRMYAS.js";import"./chunk-PMDY4YIZ.js";import"./chunk-ETBJ4VOK.js";import"./chunk-ZLCQNN5W.js";import"./chunk-ZHH3PWEW.js";import"./chunk-Y3VPZJTG.js";import"./chunk-TXAIJEXA.js";import"./chunk-JTBQO6IT.js";import"./chunk-WS6UFNKF.js";export{b as bootWrapper,a as wrapperBooted};
+import{a,b}from"./chunk-PMN5M2JA.js";import"./chunk-N4N4OLEW.js";import"./chunk-W34RPHBG.js";import"./chunk-Y77ZVHTD.js";import"./chunk-JOKNFUW3.js";import"./chunk-DIRW7I4S.js";import"./chunk-WZQNO4PZ.js";import"./chunk-E34QSIVP.js";import"./chunk-AH3RIV2J.js";import"./chunk-YRPUM6JG.js";import"./chunk-7Q3OCSPV.js";import"./chunk-RL3OEL5W.js";import"./chunk-5JKYJZAR.js";import"./chunk-IFCOOPD7.js";import"./chunk-ZHH3PWEW.js";import"./chunk-Y3VPZJTG.js";import"./chunk-MGNMJ64X.js";import"./chunk-XIWAQH6S.js";import"./chunk-JTBQO6IT.js";import"./chunk-2X5HGMMO.js";export{b as bootWrapper,a as wrapperBooted};

package/dist/chunk-2X5HGMMO.js

@@ -0,0 +1,5 @@
+import { createRequire } from 'node:module'; const require = createRequire(import.meta.url);
+import*as o from"node:fs";import{randomBytes as b}from"node:crypto";import{homedir as m}from"node:os";import{resolve as a,join as c,dirname as f,basename as _}from"node:path";var g=["owner","shared","open"],T=100*1024*1024,s={brokerUrl:"wss://broker1.ours.network",port:3050,stateDir:a(m(),".ours"),gcIntervalMs:36e5,historyMaxBytes:T,apiVisibility:"owner"};function d(){return process.env.OURS_CONFIG??c(m(),".ours","config.json")}function O(){let t;try{t=o.readFileSync(d(),"utf8")}catch{return{}}let e;try{e=JSON.parse(t)}catch{return{}}let i={};if(typeof e.brokerUrl=="string"&&(i.brokerUrl=e.brokerUrl),typeof e.port=="number"&&Number.isFinite(e.port)&&(i.port=e.port),typeof e.stateDir=="string"&&(i.stateDir=a(e.stateDir)),typeof e.gcIntervalMs=="number"&&Number.isFinite(e.gcIntervalMs)&&(i.gcIntervalMs=e.gcIntervalMs),Object.prototype.hasOwnProperty.call(e,"historyMaxBytes")&&(i.historyMaxBytes=S(e.historyMaxBytes,"config historyMaxBytes")),typeof e.apiVisibility=="string"&&g.includes(e.apiVisibility)&&(i.apiVisibility=e.apiVisibility),typeof e.apiToken=="string"&&e.apiToken.trim()&&(i.apiToken=e.apiToken.trim()),e.stt&&typeof e.stt=="object"){let r=e.stt,n={};typeof r.provider=="string"&&(n.provider=r.provider),typeof r.apiKey=="string"&&(n.apiKey=r.apiKey),typeof r.model=="string"&&(n.model=r.model),typeof r.baseUrl=="string"&&(n.baseUrl=r.baseUrl),typeof r.language=="string"&&(n.language=r.language),typeof r.maxBytes=="number"&&Number.isFinite(r.maxBytes)&&(n.maxBytes=r.maxBytes),typeof r.timeoutMs=="number"&&Number.isFinite(r.timeoutMs)&&(n.timeoutMs=r.timeoutMs),r.custom&&typeof r.custom=="object"&&(n.custom=r.custom),i.stt=n}return i}function v(){let t=process.env.OURS_API_VISIBILITY?.trim().toLowerCase();return t&&g.includes(t)?t:void 0}function l(t){let e=process.env[t];if(e===void 0)return;let i=parseInt(e,10);return Number.isNaN(i)?void 0:i}function S(t,e){if(typeof t!="number"||!Number.isSafeInteger(t)||t<0)throw new Error(`${e} must be a non-negative safe integer (0 disables history rotation)`);return t}function I(){let t=process.env.OURS_HISTORY_MAX_BYTES;if(t!==void 0){if(!/^[0-9]+$/.test(t))throw new Error("OURS_HISTORY_MAX_BYTES must be a non-negative safe integer (0 disables history rotation)");return S(Number(t),"OURS_HISTORY_MAX_BYTES")}}function w(){let t=O();return{brokerUrl:process.env.OURS_BROKER_URL??t.brokerUrl??s.brokerUrl,port:l("OURS_PORT")??t.port??s.port,stateDir:a(process.env.OURS_STATE_DIR??t.stateDir??s.stateDir),gcIntervalMs:l("OURS_GC_INTERVAL_MS")??t.gcIntervalMs??s.gcIntervalMs,historyMaxBytes:I()??t.historyMaxBytes??s.historyMaxBytes,apiVisibility:v()??t.apiVisibility??s.apiVisibility,apiToken:process.env.OURS_API_TOKEN?.trim()||t.apiToken,stt:U(t.stt)}}function U(t){let e={};process.env.OURS_STT_PROVIDER?.trim()&&(e.provider=process.env.OURS_STT_PROVIDER.trim()),process.env.OURS_STT_API_KEY?.trim()&&(e.apiKey=process.env.OURS_STT_API_KEY.trim()),process.env.OURS_STT_MODEL?.trim()&&(e.model=process.env.OURS_STT_MODEL.trim()),process.env.OURS_STT_BASE_URL?.trim()&&(e.baseUrl=process.env.OURS_STT_BASE_URL.trim()),process.env.OURS_STT_LANGUAGE?.trim()&&(e.language=process.env.OURS_STT_LANGUAGE.trim());let i={...t??{},...e};return Object.keys(i).length?i:void 0}var k="daemon-token";function R(t){return c(t.stateDir,k)}function B(t){let e=process.env.OURS_API_TOKEN?.trim();return e||t.apiToken?.trim()||void 0}function C(t,e={}){let i=process.env.OURS_API_TOKEN?.trim();if(i)return{token:i,source:"env"};let r=t.apiToken?.trim();if(r)return{token:r,source:"config"};let n=R(t);try{let p=o.readFileSync(n,"utf8").trim();if(p)return{token:p,source:"file"}}catch{}if(!e.generate)return null;let u=b(32).toString("hex");try{o.mkdirSync(f(n),{recursive:!0}),o.writeFileSync(n,u+`
+`,{mode:384}),o.chmodSync(n,384)}catch{}return{token:u,source:"generated"}}function F(t){let e=d();o.mkdirSync(f(e),{recursive:!0}),o.writeFileSync(e,JSON.stringify(t,null,2)+`
+`,{mode:384});try{o.chmodSync(e,384)}catch{}return e}var y=".ours-identity";function x(t){if(!t.name.trim())throw new Error("identity name must not be empty");let e={identity:t.name.trim()};return t.force&&(e.force=!0),e.expose_local=t.exposeLocal??!0,e.local_auto_accept=t.localAutoAccept??!0,e}function A(t){let e=a(t);return _(e)===y?e:c(e,y)}function N(t,e,i=!1){let r=x(e),n=A(t);if(!i&&o.existsSync(n))throw new Error(`${n} already exists \u2014 pass overwrite to replace it`);return o.mkdirSync(f(n),{recursive:!0}),o.writeFileSync(n,JSON.stringify(r,null,2)+`
+`),n}export{g as a,T as b,s as c,d,w as e,k as f,R as g,B as h,C as i,F as j,y as k,x as l,A as m,N as n};

package/dist/chunk-2ZQPUBE4.js

@@ -0,0 +1,2 @@
+import { createRequire } from 'node:module'; const require = createRequire(import.meta.url);
+import{b as E}from"./chunk-Y77ZVHTD.js";import{a as T}from"./chunk-65KGEJBX.js";import{a as i,b as w,h as L}from"./chunk-RL3OEL5W.js";import{c as y,d as l,o as R}from"./chunk-5JKYJZAR.js";import{j as g}from"./chunk-IFCOOPD7.js";async function j(o){let k=R(o),d=[];for(let[e,s]of[...i])s.token===o&&(i.delete(e),d.push(e));let m=[...y.values(),...[...l.values()].map(e=>e.identity)].filter(e=>e.temp?.owner.tokenHash===k),c=await Promise.allSettled(m.map(e=>E(e,"owning session released its lease"))),a=[],p=0,u=0,f=0,t=[];for(let e=0;e<c.length;e++){let s=c[e],n=m[e].name;if(s.status==="rejected"){t.push({name:n,error:String(s.reason)});continue}let r=s.value;l.delete(n),a.push(n),p+=r.attempted,u+=r.notified,f+=r.failed,r.deleteError&&t.push({name:n,error:r.deleteError})}w.delete(o),L(),g(`lease released by token \u2026${o.slice(-6)} (${a.length} temporary identity close(s) awaited)`);let h={released:d,closed:a,attempted:p,notified:u,failed:f};if(t.length>0)throw new T("DELETE_PARTIAL",`Lease release completed with ${t.length} local cleanup failure(s).`,{result:h,localFailures:t});return h}export{j as a};

package/dist/chunk-3CPIRV4P.js

@@ -0,0 +1,2 @@
+import { createRequire } from 'node:module'; const require = createRequire(import.meta.url);
+import{a as ye}from"./chunk-2ZQPUBE4.js";import{a as pe,b as fe,c as ue}from"./chunk-7ZZWD64L.js";import{a as le,b as O}from"./chunk-Y77ZVHTD.js";import{H as de,M as y,a as v,f as C,g as W,h as z,i as Q,j as Y,k as G,l as J,m as K,n as X,o as Z,p as P,q as ee,r as te,s as oe,t as ne,u as re,v as ie,w as se,x as ae}from"./chunk-65KGEJBX.js";import{a as ce,c as me}from"./chunk-WZQNO4PZ.js";import{A as j,E as U,j as u,m as _,n as T,o as k,q as N,s as S,t as E}from"./chunk-AH3RIV2J.js";import{a as g,b as V,f as w,g as q,i as M,j as R}from"./chunk-RL3OEL5W.js";import{c,d as h,o as I,p as H}from"./chunk-5JKYJZAR.js";import{j as L,q as b}from"./chunk-IFCOOPD7.js";import{l as B,n as $}from"./chunk-2X5HGMMO.js";import{randomBytes as we}from"node:crypto";import{isAbsolute as Ie}from"node:path";function he(n){try{return _(n)}catch{return null}}function A(n){let o=he(n);return{name:n.name,cid:n.cid,bio:o?.bio??"",persona:o?.persona??"",roleId:o?.roleId??"",rootCid:o?.rootCid??"",rootName:o?.rootName??""}}async function D(n,o){o&&await j(async e=>{await U(n,"::a2a_messaging::set_my_bio",{bio:o},e)})}function ge(n){let o=M(n.sessionId());if(!("error"in o))return o.id;throw new v(o.code,o.error)}async function Fe(n,o){let{name:e,bio:d,exposeLocal:s,localAutoAccept:l}=o,r=b(e);if(r)throw y("create_identity",r,"NAME_INVALID");if(c.has(e)||h.has(e))throw C("create_identity",e);try{let t=await E(e,{exposeLocal:s,localAutoAccept:l});await D(t,d);let i,m=null,a=[],p=[],f=u?c.get(u):void 0;if(f)await T(f,t),i="role",m=f.name,ce()&&me(f);else{i="root";let x=await k(t),F=await N(t);a=[...x.adopted,...F.adopted],p=[...x.failed,...F.failed]}return R(n.sessionId(),e),{info:A(t),hierarchy:i,underRoot:m,adopted:a,failed:p,exposedLocal:s,localAutoAccept:l}}catch(t){throw y("create_identity",String(t),"PROVISION_FAILED")}}async function Be(n,o){let{bio:e,exposeLocal:d,localAutoAccept:s}=o,l=n.leaseToken(),r=n.clientPid();if(!l||!r)throw W();let t=o.name;if(t!==void 0){let p=b(t);if(p)throw y("create_temporary_identity",p,"NAME_INVALID");if(c.has(t)||S.has(t))throw C("create_temporary_identity",t)}else{for(let p=0;p<5&&t===void 0;p++){let f=`tmp-${we(5).toString("hex")}`;!c.has(f)&&!S.has(f)&&(t=f)}if(t===void 0)throw z()}let i=t,m=u?c.get(u):void 0;if(!m)throw de();let a;try{return a=await pe(i,{localAutoAccept:s,temp:{tokenHash:I(l),pid:r}}),await D(a,e),await T(m,a),await fe(a,d),R(n.sessionId(),i),{info:A(a),ownerPid:r,hierarchy:"role",underRoot:m.name,exposedLocal:d,localAutoAccept:s}}catch(p){throw a&&ue(a,i,a.dir),y("create_temporary_identity",String(p),"PROVISION_FAILED")}}async function $e(n,o){let e=n.leaseToken(),d;if(o.name!==void 0){if(d=c.get(o.name),!d)return{name:o.name,result:null}}else{let r=e?q(e):void 0;if(d=r?c.get(r.identity):void 0,!d)throw Y()}if(!d.temp)throw G(d.name);let s=d.temp.owner,l=e!==void 0&&s.tokenHash===I(e);if(!l&&!d.temp.closing&&!w(s.pid))throw J(d.name,s.pid);try{let r=await O(d,l?"explicit close by owner":"stale reclaim via close_temporary_identity");if(r.deleteError){let t=r.attempted===0?"It had no contacts, so no remove-me notices were needed.":`Remove-me notices: ${r.notified}/${r.attempted} queued, ${r.failed} not sent (best effort \u2014 delivery and remote contact deletion are not guaranteed).`;throw K(d.name,r.deleteError,t)}return{name:d.name,result:r}}catch(r){throw r instanceof v?r:y("close_temporary_identity",String(r),"CLOSE_FAILED")}}async function He(n,o){let{name:e,bio:d,exposeLocal:s,localAutoAccept:l,skipIfRootExists:r}=o,t=b(e);if(t)throw y("create_root_identity",t,"NAME_INVALID");let i=u;if(r&&i&&c.has(i))throw Q(i);if(c.has(e)||h.has(e))throw C("create_root_identity",e);try{let m=await E(e,{exposeLocal:s,localAutoAccept:l});await D(m,d);let a=u?c.get(u):void 0;if(a&&a.name!==e)return await T(a,m),R(n.sessionId(),e),{info:A(m),hierarchy:"role",underRoot:a.name,adopted:[],failed:[],exposedLocal:s,localAutoAccept:l};let{adopted:p,failed:f}=await k(m),x=await N(m);return R(n.sessionId(),e),{info:A(m),hierarchy:"root",underRoot:null,adopted:[...p,...x.adopted],failed:[...f,...x.failed],exposedLocal:s,localAutoAccept:l}}catch(m){throw y("create_root_identity",String(m),"PROVISION_FAILED")}}async function Ve(n){if(!Ie(n.path))throw X(n.path);let o={name:n.name,force:n.force,exposeLocal:n.exposeLocal,localAutoAccept:n.localAutoAccept};try{return{written:$(n.path,o,n.overwrite),json:B(o)}}catch(e){throw y("define_local_identity_file",String(e),"WRITE_FAILED")}}async function qe(n,o){let{name:e,force:d}=o;if(!c.has(e))throw Z(e);let s=n.sessionId(),l=n.leaseToken();if(!l)throw P();let r=c.get(e);if(r.temp){if(r.temp.closing)throw ee(e);let a=r.temp.owner;if(a.tokenHash!==I(l))throw w(a.pid)?oe(e,a.pid):te(e,a.pid);let p=n.clientPid();if(p&&p!==a.pid){a.pid=p;try{H(r.dir,r.temp)}catch(f){L(`[${e}] temp marker refresh failed:`,String(f))}}}let t=g.get(e);if(t&&t.token!==l)if(w(t.pid))L(`auto-reclaiming "${e}" from dead client pid ${t.pid}`),g.delete(e);else if(d)V.add(t.token),g.delete(e);else throw ne(e);let i=[...g.values()].find(a=>a.token===l&&a.identity!==e)?.identity,m=i&&c.has(i)?i:null;return R(s,e),{name:e,cid:c.get(e).cid,switchedFrom:m}}async function Me(n){if(c.size===0&&h.size===0)return[];let o=n.leaseToken(),e=t=>{let i=g.get(t);return i?i.token===o?"mine":w(i.pid)?null:"other-live":null},d=t=>{if(!t.temp)return null;let i=t.temp.owner.pid;return t.temp.closing?{state:"closing",ownerPid:i}:o!==void 0&&t.temp.owner.tokenHash===I(o)?{state:"mine",ownerPid:i}:w(i)?{state:"stale",ownerPid:i}:{state:"other-live",ownerPid:i}},s=(t,i)=>({name:t.name,cid:t.cid,kind:i,temp:d(t),session:e(t.name)}),l=u?c.get(u):void 0,r=[];if(l){r.push({...s(l,"root"),temp:null});for(let t of c.values())t.name!==l.name&&_(t).roleId!==""&&r.push(s(t,"role"))}else for(let t of c.values())r.push(s(t,"role"));for(let[t,i]of h)r.push({name:t,status:i.status});return r}async function je(n){let o=ge(n),e=he(o);return{name:o.name,cid:o.cid,bio:e?.bio??"",persona:e?.persona??"",roleId:e?.roleId??"",rootCid:e?.rootCid??"",rootName:e?.rootName??"",temporary:o.temp!==void 0,isRoot:o.name===u,described:e!==null}}async function Ue(n,o){let{name:e}=o,d=h.get(e),s=c.get(e)??d?.identity;if(!s)throw y("remove_identity",`no identity named "${e}".`,"NO_SUCH_IDENTITY");if(s.temp){let r=n.leaseToken(),t=s.temp.owner;if((r===void 0||t.tokenHash!==I(r))&&!s.temp.closing&&!w(t.pid))throw re(e,t.pid);try{let i=await O(s,"remove_identity");if(h.delete(e),i.deleteError){let m=i.attempted===0?"":` Remove-me notices: ${i.notified}/${i.attempted} queued, ${i.failed} not sent (best effort).`;throw ie(e,i.deleteError,m)}return{name:e,kind:"temporary",close:i}}catch(i){throw i instanceof v?i:y("remove_identity",String(i),"CLOSE_FAILED")}}if(e===u){let r=[...c.values()].filter(t=>t.name!==e&&_(t).rootCid===s.cid);if(r.length>0)throw se(e,r.map(t=>t.name))}let l=le(s);if(l)throw ae(e,l);return h.delete(e),{name:e,kind:"permanent"}}async function We(n){let o=n.leaseToken();if(!o)throw P();return ye(o)}export{ge as a,Fe as b,Be as c,$e as d,He as e,Ve as f,qe as g,Me as h,je as i,Ue as j,We as k};

package/dist/chunk-3ZIC5X5I.js

@@ -0,0 +1,2 @@
+import { createRequire } from 'node:module'; const require = createRequire(import.meta.url);
+import{a as c}from"./chunk-3CPIRV4P.js";import{M as d}from"./chunk-65KGEJBX.js";import{A as o,E as n,j as g,m as f,n as p}from"./chunk-AH3RIV2J.js";import{c as m}from"./chunk-5JKYJZAR.js";import{j as u}from"./chunk-IFCOOPD7.js";async function h(i,s){let e=c(i),{bio:t}=s;try{await o(async a=>{await n(e,"::a2a_messaging::set_my_bio",{bio:t},a)});let r=0;if(e.name===g){for(let a of m.values())if(a.name!==e.name&&f(a).rootCid===e.cid)try{await p(e,a),r+=1}catch(y){u(`failed to refresh root profile in role "${a.name}":`,String(y))}}return{identity:e.name,rolesRefreshed:r}}catch(r){throw d("set_bio",String(r))}}async function x(i){let s=c(i);try{return await o(async e=>{let t=await n(s,"::a2a_messaging::advertise_migrate",{},e);return{wasAdvertising:t.Reduce("was_advertising").Visualize()==="true",advertising:t.Reduce("advertising").Visualize()==="true",offers:parseInt(t.Reduce("offers_initiated").Visualize(),10)||0}})}catch(e){throw d("advertise_migrate",String(e))}}async function P(i,s){let e=c(i),{persona:t}=s;try{return await o(async r=>{await n(e,"::a2a_messaging::set_my_persona",{persona:t},r)}),{identity:e.name}}catch(r){throw d("set_persona",String(r))}}async function C(i){let s=c(i);try{return{readvertised:await o(async t=>(await n(s,"::a2a_messaging::readvertise_on_upgrade",{},t)).Reduce("readvertised").Visualize())}}catch(e){throw d("readvertise_on_upgrade",String(e))}}export{h as a,x as b,P as c,C as d};

package/dist/{chunk-67DAPEUW.js → chunk-4QU3AKO6.js}

@@ -1,2 +1,2 @@
 import { createRequire } from 'node:module'; const require = createRequire(import.meta.url);
-import{c as b}from"./chunk-ETBJ4VOK.js";import{i as S}from"./chunk-ZLCQNN5W.js";import*as n from"node:fs";import{createHash as w}from"node:crypto";import{basename as _,join as f}from"node:path";var u=e=>f(e.dir,"uploads"),D=Number(process.env.OURS_UPLOAD_TTL_MS)>0?Number(process.env.OURS_UPLOAD_TTL_MS):60*60*1e3,I=/^[0-9a-f]{32}$/,L=()=>w("sha256").update(`${process.pid}:${Date.now()}:${Math.random()}`).digest("hex").slice(0,32),O=e=>I.test(e),U=(e,r)=>f(u(e),r),y=(e,r)=>f(u(e),`${r}.json`);function $(e){let r=e.replace(/[\u0000-\u001f\u007f]/g,"").replace(/\\/g,"/"),t=_(r);return(t===""||t==="."||t===".."?"":t).slice(0,255)}var i=class extends Error{constructor(t,s){super(s);this.status=t;this.name="UploadRefused"}};async function T(e,r,t){let s=$(t.filename);if(s==="")throw new i(400,"x-ours-filename is required and must be a plain file name");if(t.declaredBytes===null)throw new i(411,"Content-Length is required");if(t.declaredBytes>=t.cap)throw new i(400,`upload is ${t.declaredBytes} bytes, at or over the transport's ${t.cap}-byte envelope budget \u2014 it could not be sent even with no filename or MIME, so it is refused before it is stored`);let o=L();n.mkdirSync(u(e),{recursive:!0,mode:448});let d=U(e,o),a=w("sha256"),p=0,c=n.createWriteStream(d,{mode:384});try{await new Promise((m,x)=>{let g=l=>{r.unpipe?.(c),c.destroy(),x(l)};r.on("data",l=>{if(p+=l.length,p>t.declaredBytes){g(new i(400,"request body is longer than its Content-Length"));return}a.update(l)}),r.on("error",g),c.on("error",g),c.on("finish",()=>m()),r.pipe(c)})}catch(m){try{n.rmSync(d,{force:!0})}catch{}throw m}let h={upload_id:o,filename:s,mime:t.mime,size:p,sha256:a.digest("hex"),at:new Date().toISOString()};return n.writeFileSync(y(e,o),JSON.stringify(h),{mode:384}),h}function F(e,r){if(!O(r))return null;let t=U(e,r),s,o;try{s=n.readFileSync(t),o=JSON.parse(n.readFileSync(y(e,r),"utf8"))}catch{return null}finally{try{n.rmSync(t,{force:!0})}catch{}try{n.rmSync(y(e,r),{force:!0})}catch{}}return{meta:o,buf:s}}function R(){let e=0,r=Date.now()-D;for(let t of b.values()){let s=u(t),o;try{o=n.readdirSync(s)}catch{continue}for(let d of o){let a=f(s,d);try{if(n.statSync(a).mtimeMs>=r)continue;n.rmSync(a,{force:!0}),e++}catch{}}e>0&&S(`[${t.name}] swept ${e} stale staged upload file(s)`)}return e}export{u as a,D as b,O as c,$ as d,i as e,T as f,F as g,R as h};
+import{c as b}from"./chunk-5JKYJZAR.js";import{j as S}from"./chunk-IFCOOPD7.js";import*as n from"node:fs";import{createHash as w}from"node:crypto";import{basename as _,join as f}from"node:path";var u=e=>f(e.dir,"uploads"),D=Number(process.env.OURS_UPLOAD_TTL_MS)>0?Number(process.env.OURS_UPLOAD_TTL_MS):60*60*1e3,I=/^[0-9a-f]{32}$/,L=()=>w("sha256").update(`${process.pid}:${Date.now()}:${Math.random()}`).digest("hex").slice(0,32),O=e=>I.test(e),U=(e,r)=>f(u(e),r),y=(e,r)=>f(u(e),`${r}.json`);function $(e){let r=e.replace(/[\u0000-\u001f\u007f]/g,"").replace(/\\/g,"/"),t=_(r);return(t===""||t==="."||t===".."?"":t).slice(0,255)}var i=class extends Error{constructor(t,s){super(s);this.status=t;this.name="UploadRefused"}};async function T(e,r,t){let s=$(t.filename);if(s==="")throw new i(400,"x-ours-filename is required and must be a plain file name");if(t.declaredBytes===null)throw new i(411,"Content-Length is required");if(t.declaredBytes>=t.cap)throw new i(400,`upload is ${t.declaredBytes} bytes, at or over the transport's ${t.cap}-byte envelope budget \u2014 it could not be sent even with no filename or MIME, so it is refused before it is stored`);let o=L();n.mkdirSync(u(e),{recursive:!0,mode:448});let d=U(e,o),a=w("sha256"),p=0,c=n.createWriteStream(d,{mode:384});try{await new Promise((m,x)=>{let g=l=>{r.unpipe?.(c),c.destroy(),x(l)};r.on("data",l=>{if(p+=l.length,p>t.declaredBytes){g(new i(400,"request body is longer than its Content-Length"));return}a.update(l)}),r.on("error",g),c.on("error",g),c.on("finish",()=>m()),r.pipe(c)})}catch(m){try{n.rmSync(d,{force:!0})}catch{}throw m}let h={upload_id:o,filename:s,mime:t.mime,size:p,sha256:a.digest("hex"),at:new Date().toISOString()};return n.writeFileSync(y(e,o),JSON.stringify(h),{mode:384}),h}function F(e,r){if(!O(r))return null;let t=U(e,r),s,o;try{s=n.readFileSync(t),o=JSON.parse(n.readFileSync(y(e,r),"utf8"))}catch{return null}finally{try{n.rmSync(t,{force:!0})}catch{}try{n.rmSync(y(e,r),{force:!0})}catch{}}return{meta:o,buf:s}}function R(){let e=0,r=Date.now()-D;for(let t of b.values()){let s=u(t),o;try{o=n.readdirSync(s)}catch{continue}for(let d of o){let a=f(s,d);try{if(n.statSync(a).mtimeMs>=r)continue;n.rmSync(a,{force:!0}),e++}catch{}}e>0&&S(`[${t.name}] swept ${e} stale staged upload file(s)`)}return e}export{u as a,D as b,O as c,$ as d,i as e,T as f,F as g,R as h};

package/dist/chunk-5JKYJZAR.js

@@ -0,0 +1,2 @@
+import { createRequire } from 'node:module'; const require = createRequire(import.meta.url);
+import{c as s,j as a}from"./chunk-IFCOOPD7.js";import{a as d,w as f}from"./chunk-MGNMJ64X.js";import{join as n}from"node:path";import{createHash as y}from"node:crypto";import*as r from"node:fs";var g;function _(t){g=t}var W=new Map,$=new Map,h=null,x=null;function M(t){h=t}function E(t){x=t}var H=t=>n(s,t),u=t=>n(t,"identity.key"),b=t=>n(t,"state_data.bin"),w=t=>n(t,"notifications.log"),k=t=>n(t,"unread.json"),m=t=>n(t,"temp.json"),R=t=>y("sha256").update(t).digest("hex");function L(t,e){r.writeFileSync(m(t),JSON.stringify({v:1,owner:{token_sha256:e.owner.tokenHash,pid:e.owner.pid},created_at:e.createdAt}),{mode:384})}function j(t){try{let e=JSON.parse(r.readFileSync(m(t),"utf8"));return e.v!==1||typeof e.owner?.token_sha256!="string"||typeof e.owner?.pid!="number"?null:{owner:{tokenHash:e.owner.token_sha256,pid:e.owner.pid},createdAt:typeof e.created_at=="number"?e.created_at:0}}catch{return null}}function B(){for(let t of A()){let e=n(s,t);try{r.chmodSync(e,448)}catch(o){a(`[${t}] chmod 0700 failed:`,String(o))}for(let o of[b(e),u(e),d({dir:e}),`${d({dir:e})}-wal`,`${d({dir:e})}-shm`,w(e),k(e)])if(r.existsSync(o))try{r.chmodSync(o,384)}catch(i){a(`[${t}] chmod 0600 ${o} failed:`,String(i))}let p=n(e,"blobs");if(r.existsSync(p)){let o=i=>{for(let c of r.readdirSync(i,{withFileTypes:!0})){let l=n(i,c.name);c.isDirectory()?(r.chmodSync(l,448),o(l)):c.isFile()&&r.chmodSync(l,384)}};try{r.chmodSync(p,448),o(p)}catch(i){a(`[${t}] chmod history blobs failed:`,String(i))}}}}var S=t=>/^[A-Za-z0-9]+$/.test(t)&&t.length>0&&t.length<=128,C=t=>/^[A-Fa-f0-9]{64}$/.test(t);function D(t,e){if(!S(e))return null;try{return f(t,e)}catch{return null}}function A(){return r.existsSync(s)?r.readdirSync(s,{withFileTypes:!0}).filter(t=>t.isDirectory()&&r.existsSync(u(n(s,t.name)))).map(t=>t.name):[]}export{g as a,_ as b,W as c,$ as d,h as e,x as f,M as g,E as h,H as i,u as j,b as k,w as l,k as m,m as n,R as o,L as p,j as q,B as r,S as s,C as t,D as u,A as v};

package/dist/{chunk-O3WRMYAS.js → chunk-7Q3OCSPV.js}

@@ -1,4 +1,4 @@
 import { createRequire } from 'node:module'; const require = createRequire(import.meta.url);
-import{k as b,l as g}from"./chunk-ETBJ4VOK.js";import{c as y,i as N,p as v}from"./chunk-ZLCQNN5W.js";import{n as O,p as R}from"./chunk-TXAIJEXA.js";import{c as x,f as I,g as F}from"./chunk-JTBQO6IT.js";import{join as T}from"node:path";import*as s from"node:fs";var l=null;function U(n){l?.uninstall(),l=n===null?null:{hook:n,uninstall:x("notification",n)}}function W(n){l?.hook===n&&(l.uninstall(),l=null)}function L(n,e){F(n,e)}var V={onNotify:(n,e)=>L(n,e)},S={inbound:["message_received","file_received"],intro:["local_contact_request","pending_message"],get wake(){return[...S.inbound,...S.intro]}};function A(n){if(n===null||n==="")return null;let e=new Set;for(let r of n.split(",")){let t=r.trim();if(t==="")continue;let f=S[t];if(!f)throw new Error(t);for(let i of f)e.add(i)}return e}function M(n,e){return e===null?!0:typeof n.event=="string"&&e.has(n.event)}var p=new Map;function j(n){let e=p.get(n);if(!(!e||e.size===0))for(let r of[...e])try{r()}catch{}}function D(n,e){return new Promise(r=>{let t=p.get(n);t||(t=new Set,p.set(n,t));let f=!1,i=()=>{f||(f=!0,t.delete(a),t.size===0&&p.delete(n),clearTimeout(u),r())},a=i,u=setTimeout(i,e);t.add(a)})}var Y=new Set(["body","text","payload","data","bytes","content"]);function w(n){if(Buffer.isBuffer(n)||n instanceof Uint8Array)return;if(Array.isArray(n))return n.map(w).filter(r=>r!==void 0);if(!n||typeof n!="object")return n;let e={};for(let[r,t]of Object.entries(n)){if(Y.has(r.toLowerCase()))continue;let f=w(t);f!==void 0&&(e[r]=f)}return e}function q(n,e){let r=w(e);try{s.mkdirSync(n.dir,{recursive:!0,mode:448});let t=b(n.dir);s.appendFileSync(t,JSON.stringify(r)+`
+import{l as b,m as g}from"./chunk-5JKYJZAR.js";import{c as y,j as N,q as v}from"./chunk-IFCOOPD7.js";import{n as O,p as R}from"./chunk-MGNMJ64X.js";import{c as x,f as I,g as F}from"./chunk-JTBQO6IT.js";import{join as T}from"node:path";import*as s from"node:fs";var l=null;function U(n){l?.uninstall(),l=n===null?null:{hook:n,uninstall:x("notification",n)}}function W(n){l?.hook===n&&(l.uninstall(),l=null)}function L(n,e){F(n,e)}var V={onNotify:(n,e)=>L(n,e)},S={inbound:["message_received","file_received"],intro:["local_contact_request","pending_message"],get wake(){return[...S.inbound,...S.intro]}};function A(n){if(n===null||n==="")return null;let e=new Set;for(let r of n.split(",")){let t=r.trim();if(t==="")continue;let f=S[t];if(!f)throw new Error(t);for(let i of f)e.add(i)}return e}function M(n,e){return e===null?!0:typeof n.event=="string"&&e.has(n.event)}var p=new Map;function j(n){let e=p.get(n);if(!(!e||e.size===0))for(let r of[...e])try{r()}catch{}}function D(n,e){return new Promise(r=>{let t=p.get(n);t||(t=new Set,p.set(n,t));let f=!1,i=()=>{f||(f=!0,t.delete(a),t.size===0&&p.delete(n),clearTimeout(u),r())},a=i,u=setTimeout(i,e);t.add(a)})}var Y=new Set(["body","text","payload","data","bytes","content"]);function w(n){if(Buffer.isBuffer(n)||n instanceof Uint8Array)return;if(Array.isArray(n))return n.map(w).filter(r=>r!==void 0);if(!n||typeof n!="object")return n;let e={};for(let[r,t]of Object.entries(n)){if(Y.has(r.toLowerCase()))continue;let f=w(t);f!==void 0&&(e[r]=f)}return e}function q(n,e){let r=w(e);try{s.mkdirSync(n.dir,{recursive:!0,mode:448});let t=b(n.dir);s.appendFileSync(t,JSON.stringify(r)+`
 `,{mode:384}),s.chmodSync(t,384)}catch(t){N(`[${n.name}] failed to append notifications.log:`,String(t))}j(n.name),I(n,r)}function Q(n,e){let r=n.Reduce(e);return r.IsNil()?"":Buffer.from(r.GetBinary()).toString("hex")}var C=Number(process.env.OURS_NOTIFY_LONGPOLL_MS)>0?Number(process.env.OURS_NOTIFY_LONGPOLL_MS):25e3,J=250;function H(n){try{return s.statSync(n).size}catch{return 0}}function z(n,e,r){if(r<=e)return{events:[],cursor:e};let t=Buffer.alloc(r-e),f=0;try{let c=s.openSync(n,"r");try{f=s.readSync(c,t,0,t.length,e)}finally{s.closeSync(c)}}catch{return{events:[],cursor:e}}let i=t.subarray(0,f),a=i.lastIndexOf(10);if(a===-1)return{events:[],cursor:e};let u=[];for(let c of i.subarray(0,a+1).toString("utf8").split(`
 `))if(c.trim())try{u.push(JSON.parse(c))}catch{}return{events:u,cursor:e+a+1}}async function X(n,e,r,t,f=null){let i=b(T(y,r)),a=(d,m)=>{e.writableEnded||(e.writeHead(200,{"Content-Type":"application/json"}),e.end(JSON.stringify({cursor:d,events:m})))},u;try{u=A(f)}catch(d){e.writableEnded||(e.writeHead(400,{"Content-Type":"application/json"}),e.end(JSON.stringify({error:`unknown notification kind "${String(d.message)}" \u2014 known kinds: ${Object.keys(S).sort().join(", ")}`})));return}if(t===null||t==="tip"){a(H(i),[]);return}let c=parseInt(t,10);if(!Number.isFinite(c)||c<0){e.writableEnded||(e.writeHead(400,{"Content-Type":"application/json"}),e.end(JSON.stringify({error:"invalid since cursor"})));return}let o=!1;n.on("close",()=>{o=!0});let _=Date.now()+C;for(;!o;){let d=H(i);if(c>d&&(c=0),d>c){let{events:m,cursor:k}=z(i,c,d);c=k;let h=u===null?m:m.filter(E=>M(E,u));if(h.length>0){a(k,h);return}}if(Date.now()>=_)break;await D(r,Math.min(J,_-Date.now()))}o||a(c,[])}function Z(n){try{let e=O(n),r=R(n).map(i=>({file_id:String(i.file_id),sender_id:i.from.id,from:i.from.name,filename:i.filename,mime:i.mime,bytes:String(i.byte_length),date:i.date,wire_id:i.wire_id})),t={count:e.length,recent:e.slice(-10).map(i=>({from:i.from.name,msg_id:i.msg_id,date:i.date})),files:r.length,unread_files:r.slice(-10)};s.mkdirSync(n.dir,{recursive:!0,mode:448});let f=`${g(n.dir)}.tmp`;s.writeFileSync(f,JSON.stringify(t),{mode:384}),s.chmodSync(f,384),s.renameSync(f,g(n.dir))}catch(e){N(`[${n.name}] failed to refresh unread snapshot:`,String(e))}}function nn(){let n=[],e=[];try{e=s.readdirSync(y,{withFileTypes:!0})}catch{return{identities:n}}for(let r of e){if(!r.isDirectory()||v(r.name)!==null)continue;let t;try{t=JSON.parse(s.readFileSync(g(T(y,r.name)),"utf8"))}catch{continue}let f=Number.isSafeInteger(t.count)&&Number(t.count)>=0?Number(t.count):0,i=Number.isSafeInteger(t.files)&&Number(t.files)>=0?Number(t.files):0;if(f===0&&i===0)continue;let a=Array.isArray(t.recent)?t.recent.slice(-10).flatMap(c=>{if(!c||typeof c!="object")return[];let o=c;return typeof o.from!="string"||!["string","number"].includes(typeof o.msg_id)||typeof o.date!="string"?[]:[{from:o.from,msg_id:o.msg_id,date:o.date}]}):[],u=Array.isArray(t.unread_files)?t.unread_files.slice(-10).flatMap(c=>{if(!c||typeof c!="object")return[];let o=c;return typeof o.from!="string"||typeof o.filename!="string"||typeof o.mime!="string"||typeof o.wire_id!="string"?[]:[{from:o.from,filename:o.filename,mime:o.mime,wire_id:o.wire_id,...typeof o.sender_id=="string"?{sender_id:o.sender_id}:{},...["string","number"].includes(typeof o.file_id)?{file_id:o.file_id}:{},...["string","number"].includes(typeof o.bytes)?{bytes:o.bytes}:{},...typeof o.date=="string"?{date:o.date}:{}}]}):[];n.push({name:r.name,count:f,recent:a,files:i,unread_files:u})}return n.sort((r,t)=>String(r.name).localeCompare(String(t.name))),{identities:n}}export{U as a,W as b,L as c,V as d,S as e,A as f,M as g,j as h,D as i,q as j,Q as k,H as l,z as m,X as n,Z as o,nn as p};

package/dist/chunk-7ZZWD64L.js

@@ -0,0 +1,2 @@
+import { createRequire } from 'node:module'; const require = createRequire(import.meta.url);
+import{A as m,E as y,L as k,M as S,N as x,O as I,r as w,s as c,y as v}from"./chunk-AH3RIV2J.js";import{a as d,c as n,i as h,j as u,p as g}from"./chunk-5JKYJZAR.js";import{j as p}from"./chunk-IFCOOPD7.js";import{f,g as l}from"./chunk-MGNMJ64X.js";import*as a from"node:fs";import{randomBytes as _}from"node:crypto";async function O(e,r){if(c.has(e)||n.has(e))throw new Error(`identity name "${e}" is reserved or already present`);c.add(e);let i=h(e),t;try{a.mkdirSync(i,{recursive:!0,mode:448});let o;return r.temp&&(o={owner:{tokenHash:r.temp.tokenHash,pid:r.temp.pid},createdAt:Date.now()},g(i,o)),t=await w(e,_(24).toString("hex"),i,!1,void 0,!0),f(t),o&&(t.temp=o),a.writeFileSync(u(i),k(t),{mode:384}),await m(async s=>{await y(t,"::a2a_messaging::set_my_name",{name:e},s)}),await I(t),r.localAutoAccept||await m(async s=>{await y(t,"::actor::set_local_policy",{auto_accept:!1},s)}),v(t),p(`[${e}] provisioned UNEXPOSED pending hierarchy reconciliation`),t}catch(o){throw P(t,e,i),o}}async function B(e,r){d.expose_packet(e.cid),n.set(e.name,e);try{r&&await S(e),p(`[${e.name}] EXPOSED (routing + broker registration) \u2014 hierarchy reconciled`)}catch(i){throw P(e,e.name,e.dir),i}}function P(e,r,i){if(e){try{l(e)}catch{}try{x(e)}catch{}try{d.remove_packet(e.cid)}catch{}}n.delete(r);try{a.rmSync(i,{recursive:!0,force:!0})}catch{}c.delete(r)}export{O as a,B as b,P as c};

package/dist/chunk-AAXXFRZP.js

@@ -0,0 +1,4 @@
+import { createRequire } from 'node:module'; const require = createRequire(import.meta.url);
+import{a as f}from"./chunk-3CPIRV4P.js";import{h as v,j as x,k as $,l as C}from"./chunk-DIRW7I4S.js";import{I as O,J as N,K as j,L as H,M as h}from"./chunk-65KGEJBX.js";import{o as k}from"./chunk-7Q3OCSPV.js";import{t as S,u as I}from"./chunk-5JKYJZAR.js";import{b as p}from"./chunk-IFCOOPD7.js";import{a as u}from"./chunk-Y3VPZJTG.js";import{p as b,q as F}from"./chunk-MGNMJ64X.js";import{d as y,h as _,i as w}from"./chunk-XIWAQH6S.js";import{readFile as M}from"node:fs/promises";async function q(s){let o=f(s);try{return b(o)}catch(t){throw h("list_incoming_files",String(t))}}async function T(s,o={}){let t=f(s),{wire_ids:i}=o;if(i!==void 0){if(i.length<1||i.length>32)throw O(32);if(i.some(r=>!S(r)))throw N();if(new Set(i).size!==i.length)throw j()}let d=[];try{let r=F(t,{wire_ids:i,limit:o.limit});d=r.files.map(e=>e.wire_id),_(t.dir,"file",d);let l=[],a=[];for(let e of r.files){let g={file_id:e.file_id,wire_id:e.wire_id,from:e.from,filename:e.filename,path:e.blob_path,mime:e.mime,size:e.byte_length,sha256:e.sha256,status:"processed",date:e.date,kind:e.kind,sender:e.from.name};if(e.kind==="voice_message"){let c=v(p.stt),m;if(!c.ready)m={kind:"unconfigured",reason:c.reason};else try{let n=await x(await M(e.blob_path),e.filename,e.mime,p.stt);m=n.ok?{kind:"transcript",text:n.text}:{kind:"failed",error:n.error}}catch(n){m={kind:"failed",error:n instanceof Error?n.message:String(n)}}g.transcription=$(c,m,{audioPath:e.blob_path,wireId:e.wire_id}),a.push(C({sender:e.from.name,wire:e.wire_id,savedPath:e.blob_path,sizeBytes:e.byte_length},m))}else a.push(`  \u2022 ${e.filename} (${e.mime}, ${e.byte_length} B, sha256 ${e.sha256}) from ${e.from.name} \u2192 ${e.blob_path} {${e.wire_id}}`);l.push(g)}return k(t),{files:l,text:a.length===0?"No new files.":`${a.length} new file(s) available from immutable identity blob storage (bytes stay on disk, never in this result):
+${a.join(`
+`)}`,mode:i===void 0?"all_unread":"selected",requested:i??null,remaining:r.remaining}}catch(r){let l=String(r);throw i!==void 0&&/unknown, stale, or no longer unread/i.test(l)?H():h("get_files",l)}finally{d.length>0&&(w(t.dir,"file",d),y(t.dir))}}function A(s,o){let t=f(s);return{existsOnDisk:I(t,o.wire_id)!==null}}export{q as a,T as b,A as c};

package/dist/chunk-AH3RIV2J.js

@@ -0,0 +1,2 @@
+import { createRequire } from 'node:module'; const require = createRequire(import.meta.url);
+import{b as H}from"./chunk-YRPUM6JG.js";import{c as ke,d as Ve,j as y,k as A,o as E}from"./chunk-7Q3OCSPV.js";import{d as Ie}from"./chunk-RL3OEL5W.js";import{a as C,c as R,d as N,e as V,f as re,g as ve,h as Re,i as ne,j as q,k as T,p as $e,q as Se,v as be}from"./chunk-5JKYJZAR.js";import{c as j,j as c,p as L}from"./chunk-IFCOOPD7.js";import{d as ee,f as te,g as pe,h as ie,i as me,j as fe,k as ge,l as ye,s as _e,v as he,x as we}from"./chunk-MGNMJ64X.js";import{AdaptObjectLifetime as De}from"@adapt-toolkit/sdk/common";import{object_to_adapt_value as Fe}from"@adapt-toolkit/sdk/wrapper";import*as g from"node:fs";import{randomBytes as He}from"node:crypto";import*as z from"node:fs";import{randomBytes as Me}from"node:crypto";import{PacketWrapperConfigurator as Le}from"@adapt-toolkit/sdk/wrappers";import{AdaptObjectLifetime as Oe}from"@adapt-toolkit/sdk/common";function U(e){let t=e.Visualize(),r=Number(t);if(Number.isFinite(r)&&r>=0)return r;let n=Date.parse(t);if(!Number.isFinite(n))throw new Error("invalid host-event date");return n}function xe(e){let t=e.Reduce("reply_to");if(t.IsNil())return{};let r=t.Reduce("wire_id").Visualize(),n=t.Reduce("sentence");return n.IsNil()?{replyToWireId:r}:{replyToWireId:r,replyToSentence:Number(n.Visualize())}}function G(e,t){try{y(e,t)}catch(r){c(`[${e.name}] post-insert history wake failed event=${String(t.event??"")}:`,String(r))}}function ze(e,t){e.pw.on_return_data=r=>{let n=new Oe;r.Attach(n);try{let s=r.Reduce("kind").Visualize();if(s==="save_state"){B(e);return}if(s==="host_event"){let i=r.Reduce("payload"),p=i.Reduce("event").Visualize();if(p==="application_payload"){let a=i.Reduce("item_kind").Visualize(),o=i.Reduce("direction").Visualize(),d=i.Reduce("wire_id").Visualize(),u=i.Reduce("peer_cid").Visualize(),l=i.Reduce("peer_name").Visualize(),f=i.Reduce("encryption").Visualize(),v=i.Reduce("inbox_state"),b=o==="in"&&!v.IsNil()?v.Visualize():void 0;try{if((a==="message"?ie(e,{kind:"message",wireId:d,peerCid:u,peerName:l,direction:o,inboxState:b,body:i.Reduce("body").Visualize(),occurredAtMs:U(i.Reduce("date")),encryption:f,...xe(i)}):ie(e,{kind:"file",wireId:d,peerCid:u,peerName:l,direction:o,inboxState:b,filename:i.Reduce("filename").Visualize(),mime:i.Reduce("mime").Visualize(),bytes:Buffer.from(i.Reduce("data").GetBinary()),occurredAtMs:U(i.Reduce("date")),encryption:f,...xe(i)}))&&o==="in"&&b==="unread")if(a==="message"){let h=_e(e,d);G(e,{event:"message_received",from:l,sender_name:l,sender_id:u,msg_id:String(h.msg_id),wire_id:d,date:h.date}),E(e),process.nextTick(()=>t.onNotify(e.name,`[${e.name}] new message from ${l} (#${h.msg_id})`))}else{let h=he(e,d);G(e,{event:"file_received",from:l,sender_id:u,file_id:String(h.file_id),wire_id:d,filename:h.filename,mime:h.mime,bytes:String(h.byte_length),date:h.date}),E(e),process.nextTick(()=>t.onNotify(e.name,`[${e.name}] new file ${h.filename} (${h.byte_length} B) from ${l} (sender_id ${u}, file_id ${h.file_id}, wire_id ${d})`))}}catch(I){let h=a==="file"?"file":"message";ee(e,h,d,o),c(`[${e.name}] history ${h} write failed direction=${o} wire_id=${d}:`,String(I))}}else if(p==="pending_introduction_decision"){let a=i.Reduce("peer_cid").Visualize(),o=i.Reduce("action").Visualize();try{o==="approve"?ge(e,a):o==="reject"&&ye(e,a),E(e)}catch(d){c(`[${e.name}] pending-introduction history update failed action=${o} peer_cid=${a}:`,String(d))}}else if(p==="monitoring_payload"){let a=i.Reduce("item_id").Visualize();try{me(e,{kind:"monitoring_copy",itemId:a,sourceCid:i.Reduce("source_cid").Visualize(),sourceName:i.Reduce("source_name").Visualize(),direction:i.Reduce("direction").Visualize(),peerCid:i.Reduce("peer_cid").Visualize(),peerName:i.Reduce("peer_name").Visualize(),body:i.Reduce("body").Visualize(),occurredAtMs:U(i.Reduce("date"))})&&G(e,{event:"monitoring_copy",item_id:a})}catch(o){c(`[${e.name}] monitoring history write failed item_id=${a}:`,String(o))}}else if(p==="control_payload"){let a=i.Reduce("item_id").Visualize();try{fe(e,{kind:"control_request",itemId:a,senderCid:i.Reduce("sender_cid").Visualize(),senderName:i.Reduce("sender_name").Visualize(),payload:i.Reduce("payload").Visualize(),occurredAtMs:U(i.Reduce("date"))})&&G(e,{event:"control_request",item_id:a})}catch(o){c(`[${e.name}] control history write failed item_id=${a}:`,String(o))}}return}if(s==="notify_agent"){let i=r.Reduce("payload"),p=i.Reduce("event").Visualize();if(p==="receipt_received"){let a=i.Reduce("sender_id"),o=a.IsNil()?"":String(a.Visualize()),d=i.Reduce("kind"),u=d.IsNil()?"":String(d.Visualize()),l=[],f=i.Reduce("wire_ids");if(!f.IsNil())for(let I=0;;I++){let h=f.Reduce(I);if(h.IsNil())break;l.push(String(h.Visualize()))}let v=i.Reduce("date"),b=v.IsNil()?new Date().toISOString():String(v.Visualize());if(u==="delivered"||u==="read")try{we(e,o,u,l)}catch(I){ee(e,"receipt"),c(`[${e.name}] history receipt update failed sender_id=${o} kind=${u} count=${l.length}:`,String(I))}y(e,{event:"receipt_received",sender_id:o,kind:u,wire_ids:l,date:b})}else if(p==="contact_accepted"){let a=i.Reduce("name").Visualize(),o=i.Reduce("container_id").Visualize();W(e),process.nextTick(()=>t.onNotify(e.name,`[${e.name}] contact "${a}" (${o}) accepted your invite.`))}else if(p==="local_contact_added"){let a=i.Reduce("name").Visualize(),o=i.Reduce("container_id").Visualize();W(e),process.nextTick(()=>t.onNotify(e.name,`[${e.name}] local contact "${a}" (${o}) connected via the contact book.`))}else if(p==="contact_name_collision"){let a=i.Reduce("message").Visualize(),o=i.Reduce("desired").Visualize(),d=i.Reduce("assigned").Visualize(),u=i.Reduce("existing_container_id").Visualize(),l=i.Reduce("container_id").Visualize();y(e,{event:"contact_name_collision",desired:o,assigned:d,existing_container_id:u,container_id:l}),c(`[${e.name}] CONTACT NAME COLLISION \u2014 ${a}`),process.nextTick(()=>t.onNotify(e.name,`[${e.name}] \u26A0 ${a}`))}else if(p==="sibling_contact_added"){let a=i.Reduce("name").Visualize(),o=i.Reduce("container_id").Visualize();y(e,{event:"sibling_contact_added",from:a}),W(e),process.nextTick(()=>t.onNotify(e.name,`[${e.name}] sibling "${a}" (${o}) connected (intra-root auto-accept).`))}else if(p==="local_contact_request"){let a=i.Reduce("name").Visualize(),o=i.Reduce("container_id").Visualize();y(e,{event:"local_contact_request",from:a}),process.nextTick(()=>t.onNotify(e.name,`[${e.name}] pending local introduction from "${a}" (${o}) \u2014 approve or reject with respond_to_introduction.`))}else if(p==="pending_message"){let a=i.Reduce("sender_name").Visualize(),o=i.Reduce("queued").Visualize();y(e,{event:"pending_message",from:a,queued:o}),process.nextTick(()=>t.onNotify(e.name,`[${e.name}] "${a}" queued a message awaiting introduction approval (${o} queued).`))}else if(p==="e2e_restore_rejected")y(e,{event:"e2e_restore_rejected"}),c(`[${e.name}] E2E RESTORE REJECTED \u2014 corrupt session blob failed pickle_key validation; reset to empty e2e state, self-heal fallback will re-establish`),process.nextTick(()=>t.onNotify(e.name,`[${e.name}] persisted e2e sessions were corrupt \u2014 rejected cleanly, sessions re-establishing`));else if(p==="contact_restored"){let a=i.Reduce("name").Visualize(),o=i.Reduce("container_id").Visualize();y(e,{event:"contact_restored",from:a}),c(`[${e.name}] contact "${a}" restored (re-keyed)`),process.nextTick(()=>void oe(e,String(o)))}else if(p==="migration_active"){let a=i.Reduce("cid").Visualize(),o=i.Reduce("role").Visualize(),d=A(i,"epoch"),u=A(i,"session_id");y(e,{event:"migration_active",cid:String(a),role:String(o),...d?{epoch:d}:{},...u?{session_id:u}:{}}),c(`[migration] active cid=${a} role=${o}${d?` epoch=${d}`:""}${u?` session_id=${u}`:""}`)}else if(p==="e2e_app_send"){let a=i.Reduce("cid").Visualize(),o=A(i,"session_id"),d=i.Reduce("olm_type").Visualize(),u=i.Reduce("wire_id").Visualize(),l=i.Reduce("retained").IsNil()?void 0:i.Reduce("retained").GetBoolean(),f=[],v=i.Reduce("evicted");if(!v.IsNil())for(let b=0;;b++){let I=v.Reduce(b);if(I.IsNil())break;f.push(String(I.Visualize()))}y(e,{event:"e2e_app_send",cid:String(a),session_id:o,olm_type:String(d),wire_id:String(u),...l===!1?{retained:!1}:{},...f.length?{evicted:f}:{}}),c(`[${e.name}] [e2e-app] send cid=${a} session_id=${o} olm_type=${d} wire_id=${u}${l===!1?" retained=false":""}${f.length?` evicted=${f.join(",")}`:""}`),f.length&&process.nextTick(()=>t.onNotify(e.name,`[${e.name}] redrive window overflow: ${f.length} older unacked send(s) lost their auto-resend guarantee (${f.join(", ")})`))}else if(p==="dedup_degraded"){let a=i.Reduce("cid").Visualize(),o=i.Reduce("dropped_wire_id").Visualize();y(e,{event:"dedup_degraded",cid:String(a),dropped_wire_id:String(o)}),c(`[${e.name}] [e2e-app] DEDUP DEGRADED cid=${a} dropped_wire_id=${o} (storage ceiling \u2014 a late redrive of that id could re-deposit)`),process.nextTick(()=>t.onNotify(e.name,`[${e.name}] dedup window overflowed for ${String(a).slice(0,12)}\u2026 \u2014 one oldest entry dropped (guarantee loss surfaced)`))}else if(p==="e2e_delivery_expired"){let a=i.Reduce("cid").Visualize(),o=[],d=i.Reduce("wire_ids");if(!d.IsNil())for(let u=0;;u++){let l=d.Reduce(u);if(l.IsNil())break;o.push(String(l.Visualize()))}y(e,{event:"e2e_delivery_expired",cid:String(a),wire_ids:o}),c(`[${e.name}] [e2e-app] delivery EXPIRED (2-day TTL, receipt never arrived) cid=${a} wire_ids=${o.join(",")}`),process.nextTick(()=>t.onNotify(e.name,`[${e.name}] ${o.length} message(s)/file(s) to ${String(a).slice(0,12)}\u2026 expired undelivered (no receipt within 2 days)`))}else if(p==="e2e_app_recv"){let a=i.Reduce("cid").Visualize(),o=A(i,"session_id"),d=i.Reduce("ok").GetBoolean(),u=i.Reduce("wire_id").Visualize(),l=i.Reduce("code").IsNil()?void 0:String(i.Reduce("code").Visualize()),f=!i.Reduce("duplicate").IsNil(),v=!i.Reduce("file").IsNil();y(e,{event:"e2e_app_recv",cid:String(a),session_id:o,ok:d,wire_id:String(u),...l?{code:l}:{},...f?{duplicate:!0}:{},...v?{file:!0}:{}}),c(`[${e.name}] [e2e-app] recv cid=${a} session_id=${o} ok=${d} wire_id=${u}${l?` code=${l}`:""}${f?" duplicate=true":""}${v?" file=true":""}`)}else if(p==="e2e_rekey"){let a=i.Reduce("cid").Visualize(),o=i.Reduce("role").Visualize(),d=A(i,"session_id"),u=i.Reduce("attempts").IsNil()?void 0:String(i.Reduce("attempts").Visualize()),l=i.Reduce("peer_supports").IsNil()?void 0:String(i.Reduce("peer_supports").Visualize()),f=i.Reduce("rejected").IsNil()?void 0:String(i.Reduce("rejected").Visualize());y(e,{event:"e2e_rekey",cid:String(a),role:String(o),...d?{session_id:d}:{},...u?{attempts:u}:{},...l?{peer_supports:l}:{},...f?{rejected:f}:{}}),c(`[${e.name}] [e2e-rekey] cid=${a} role=${o}${d?` session_id=${d}`:""}${u?` attempts=${u}`:""}${l?` peer_supports=${l}`:""}${f?` rejected=${f}`:""}`)}else if(p==="migration_deferred_flush"){let a=i.Reduce("cid").Visualize(),o=i.Reduce("wire_id").Visualize();y(e,{event:"migration_deferred_flush",cid:String(a),wire_id:String(o)}),c(`[migration] flush-notify cid=${a} wire_id=${o} (deferred\u2192e2e; core delivers)`)}else if(p==="migration_stalled"){let a=i.Reduce("cid").Visualize(),o=i.Reduce("phase").Visualize(),d=i.Reduce("attempts").Visualize();y(e,{event:"migration_stalled",cid:String(a),phase:String(o),attempts:String(d)}),c(`[migration] stalled-notify cid=${a} phase=${o} attempts=${d} (core re-drives via sweep)`)}else if(p==="downgrade_refused"){let a=i.Reduce("cid").Visualize(),o=i.Reduce("wire_id"),d=o.IsNil()?"":String(o.Visualize());y(e,{event:"downgrade_refused",cid:String(a),...d?{wire_id:d}:{}}),c(`[e2e-route] downgrade-dropped cid=${a}${d?` wire_id=${d}`:""} (legacy plaintext from a migrated peer \u2014 dropped by core)`),process.nextTick(()=>t.onNotify(e.name,`[${e.name}] a message from a migrated contact was rejected as an unsafe downgrade (dropped).`))}else if(p==="contact_removed"){let a=String(i.Reduce("cid").Visualize()),o=Ie.has(e.name);y(e,{event:"contact_removed",cid:a,by:o?"local":"peer"}),o||(c(`[${e.name}] contact ${a} removed you (authenticated peer removal notice) \u2014 dropped from contacts`),process.nextTick(()=>t.onNotify(e.name,`[${e.name}] contact ${a.slice(0,12)}\u2026 removed you as a contact (the removal was applied locally too).`)))}else if(p==="monitoring_disabled"){let a=String(i.Reduce("cid").Visualize()),o=i.Reduce("cause"),d=o.IsNil()?"":String(o.Visualize());y(e,{event:"monitoring_disabled",cid:a,...d?{cause:d}:{}}),c(`[${e.name}] monitoring disabled (cid=${a}${d?` cause=${d}`:""})`),process.nextTick(()=>t.onNotify(e.name,`[${e.name}] the monitoring/control-plane binding was disabled${d==="control_plane_removed_contact"?" \u2014 the control plane removed you as a contact":""}.`))}else p==="control_request"||p==="host_provision_child"||p==="host_destroy_child"||p==="host_mint_child_invite"||p==="host_set_child_monitoring"?c(`[${e.name}] ${p}: the daemon-side control plane is removed \u2014 ignoring`):y(e,{event:p});return}let m=e.pending.shift();if(!m)return;clearTimeout(m.timer),m.resolve(r.Reduce("payload").Detach())}finally{n.Finalize()}},e.pw.on_transaction_failure=r=>{let n=e.pending.shift();n?(clearTimeout(n.timer),n.reject(new Error(r))):(c(`[${e.name}] inbound transaction rejected:`,r),y(e,{event:"inbound_error",message:r}),process.nextTick(()=>t.onNotify(e.name,`[${e.name}] inbound transaction rejected: ${r}`)))}}import{join as se}from"node:path";import*as x from"node:fs";var P=()=>se(j,L),ce=()=>se(P(),"registrar.key"),ae=()=>se(P(),"book.json");function K(){try{let e=JSON.parse(x.readFileSync(ae(),"utf8"));return e&&typeof e.entries=="object"?e.entries:{}}catch{return{}}}function Ne(e){x.mkdirSync(P(),{recursive:!0});let t=`${ae()}.tmp`;x.writeFileSync(t,JSON.stringify({v:1,entries:e},null,2),{mode:384}),x.renameSync(t,ae())}function D(e){return $(t=>Buffer.from(S(e,"::actor::export_address_document",t).GetBinary()))}function J(e){return $(t=>Buffer.from(S(e,"::actor::export_signing_secret",t).Serialize()).toString("hex"))}async function Q(e){if(!V)throw new Error("registrar is not available");let t=D(e),r=await w(async s=>{let m=await _(V,"::actor::sign_book_entry",{name:e.name,ad:V.pw.packet.NewBinaryFromBuffer(t).Attach(s)},s);return Buffer.from(m.Reduce("sig").GetBinary()).toString("base64url")}),n=K();n[e.name]={v:1,name:e.name,container_id:e.cid,address_document:t.toString("base64url"),published_at:new Date().toISOString(),registrar_sig:r},Ne(n),c(`[${e.name}] published to the local contact book`)}function de(e){let t=K(),r=Object.entries(t).find(([,n])=>n.container_id===e.cid);r&&(delete t[r[0]],Ne(t),c(`[${e.name}] removed from the local contact book (entry "${r[0]}")`))}async function Te(e){if(!re)throw new Error("registrar is not available");await w(async t=>{await _(e,"::actor::pin_registrar",{registrar_ad:e.pw.packet.NewBinaryFromBuffer(re).Attach(t)},t)})}import{join as je}from"node:path";import*as k from"node:fs";function ft(e){F=e}var X=()=>je(j,"root.json"),F=null;function gt(){try{let e=JSON.parse(k.readFileSync(X(),"utf8"));return typeof e.name=="string"?e.name:null}catch{return null}}function Ce(e){k.mkdirSync(j,{recursive:!0});let t=`${X()}.tmp`;k.writeFileSync(t,JSON.stringify({v:1,name:e})),k.renameSync(t,X())}function yt(){k.rmSync(X(),{force:!0})}function Ae(e){return $(t=>{let r=S(e,"::actor::describe_identity",t);return{bio:r.Reduce("bio").Visualize(),persona:r.Reduce("persona").Visualize(),hasCert:r.Reduce("has_cert").GetBoolean(),roleId:r.Reduce("role_id").Visualize(),rootCid:r.Reduce("root_cid").Visualize(),rootName:r.Reduce("root_name").Visualize(),monitoringEnabled:r.Reduce("monitoring_enabled").GetBoolean()}})}async function Y(e,t){await w(async r=>{let n=D(t),s=await _(e,"::actor::sign_delegation",{role_ad:e.pw.packet.NewBinaryFromBuffer(n).Attach(r),role_id:t.name},r),m=Buffer.from(s.Reduce("cert").GetBinary()),i=await _(e,"::actor::export_root_profile",{},r),p=Buffer.from(i.Reduce("profile").GetBinary()),a=D(e),o=Buffer.from((await _(t,"::actor::export_v1_address_document",{},r)).Reduce("ad").GetBinary()),d=await _(e,"::actor::sign_delegation",{role_ad:e.pw.packet.NewBinaryFromBuffer(o).Attach(r),role_id:t.name},r),u=Buffer.from(d.Reduce("cert").GetBinary());await _(t,"::actor::set_delegation",{cert:t.pw.packet.NewBinaryFromBuffer(m).Attach(r),root_ad:t.pw.packet.NewBinaryFromBuffer(a).Attach(r),root_profile:t.pw.packet.NewBinaryFromBuffer(p).Attach(r),cert_v1:t.pw.packet.NewBinaryFromBuffer(u).Attach(r)},r)}),c(`[${t.name}] delegated as a role under root "${e.name}"`)}async function _t(e){F=e.name,Ce(e.name);let t=[],r=[];for(let n of R.values())if(n.name!==e.name&&!n.temp)try{await Y(e,n),t.push(n.name)}catch(s){c(`failed to adopt "${n.name}" as a role under new root "${e.name}":`,String(s)),r.push(n.name)}return c(`[${e.name}] established as the host root${t.length?` (adopted ${t.length} role(s))`:""}`),{adopted:t,failed:r}}function qe(e){return Object.values(K()).some(t=>t.container_id===e.cid)}async function M(e){C.expose_packet(e.cid),R.set(e.name,e),N.delete(e.name),c(`[${e.name}] EXPOSED (routing + broker registration) \u2014 hierarchy reconciled after restore`);try{await Ee(e)}catch(t){c(`[${e.name}] post-activation contact restore sweep failed:`,String(t))}try{E(e)}catch(t){c(`[${e.name}] post-activation unread refresh failed:`,String(t))}return e}function ue(e,t){let r=qe(e);return r&&de(e),R.delete(e.name),N.set(e.name,{identity:e,status:t,exposeLocal:r}),c(`[${e.name}] QUARANTINED (${t}) \u2014 management-only, unexposed and unbindable`),e}async function Be(e){if(F===e.name)return M(e);let t=F?R.get(F):void 0,r;try{r=Ae(e)}catch(n){return c(`[${e.name}] hierarchy classification failed:`,String(n)),ue(e,"migration-failed")}if(t){if(r.hasCert&&r.roleId!==""&&r.rootCid!==t.cid)return c(`[${e.name}] preserved imported delegation from root ${r.rootCid.slice(0,12)}\u2026`),M(e);try{return await Y(t,e),M(e)}catch(n){return c(`[${e.name}] root delegation during restore failed:`,String(n)),ue(e,"migration-failed")}}return r.hasCert&&r.roleId!==""?M(e):ue(e,"awaiting-root")}async function It(e){let t=[],r=[];for(let[n,s]of[...N])try{await Y(e,s.identity),s.exposeLocal&&await Q(s.identity),await M(s.identity),N.delete(n),t.push(n)}catch(m){try{de(s.identity)}catch{}s.status="migration-failed",N.set(n,s),c(`[${n}] quarantine adoption failed under root "${e.name}":`,String(m)),r.push(n)}return{adopted:t,failed:r}}function Z(e,t,r,n=!0,s,m=!1){let i=new Le;i.deferred_exposure=m;let p=["--unit_hash",H.hash,"--seed_phrase",t,"--unit_dir_path",H.dir];return s&&p.push("--init_trn_argument",JSON.stringify(s)),i.process_arguments(p),new Promise((a,o)=>{let d=setTimeout(()=>o(new Error(`packet creation for "${e}" timed out`)),3e4);C.packet_manager.create_packet(i,u=>{clearTimeout(d);let l={name:e,cid:$(f=>u.packet.GetContainerID().Attach(f).Visualize()),pw:u,dir:r,pending:[],lock:Promise.resolve()};ze(l,Ve),n&&R.set(e,l),c(`[${e}] packet created \u2014 container id ${l.cid}`),a(l)},H.contents)})}var O=new Set(be());O.size>0&&c(`reserved ${O.size} persisted identity name(s) at module load: ${[...O].join(", ")}`);async function jt(e,t={exposeLocal:!0,localAutoAccept:!0}){if(O.has(e)||R.has(e))throw new Error(`identity name "${e}" is reserved \u2014 a persisted identity with this name is restoring, present, or being provisioned; refusing to provision over it`);O.add(e);let r;try{let n=ne(e);z.mkdirSync(n,{recursive:!0,mode:448});let s;t.temp&&(s={owner:{tokenHash:t.temp.tokenHash,pid:t.temp.pid},createdAt:Date.now()},$e(n,s));let m=Me(24).toString("hex"),i=await Z(e,m,n);return r=i,te(i),s&&(i.temp=s),z.writeFileSync(q(n),J(i),{mode:384}),await w(async p=>{await _(i,"::a2a_messaging::set_my_name",{name:e},p)}),await Te(i),t.localAutoAccept||await w(async p=>{await _(i,"::actor::set_local_policy",{auto_accept:!1},p)}),t.exposeLocal&&await Q(i),B(i),i}catch(n){throw r&&pe(r),O.delete(e),n}}async function Ct(e){let t=ne(e),r=z.readFileSync(q(t),"utf8").trim(),n=await Z(e,"",t,!1,r,!0);c(`[${e}] created QUARANTINED (no routing/broker registration, not client-bindable) \u2014 importing state before exposure`);let s=Number(process.env.OURS_TEST_RESTORE_HOLD_MS||"")||0;s>0&&(c(`[${e}] TEST HOLD: keeping restore open ${s}ms (OURS_TEST_RESTORE_HOLD_MS)`),await new Promise(o=>setTimeout(o,s)));let m=o=>/timed out waiting for the transaction result/.test(String(o)),i=(o,d,u)=>{c(`[${e}] ${o} ${d} \u2014 identity left UNEXPOSED and UNTRACKED (fail-closed)`),R.delete(e);try{C.remove_packet(n.cid)}catch(l){c(`[${e}] quarantined-packet teardown failed:`,String(l))}throw new Error(`identity "${e}": ${o} failed during restore (${d}) \u2014 left unexposed (fail-closed)`)},p=(o,d)=>i(o,"outcome UNKNOWN (timeout): the transaction may still execute and exposure would race it",d);if(Pe(t)){try{if(process.env.OURS_TEST_FORCE_IMPORT_TIMEOUT==="1")throw new Error("timed out waiting for the transaction result (forced by OURS_TEST_FORCE_IMPORT_TIMEOUT)");let o=z.readFileSync(T(t));await w(async d=>{let u=n.pw.packet.ParseValue(new Uint8Array(o)).Attach(d),l=Number(process.env.OURS_IMPORT_TIMEOUT_MS||"")||void 0;await _(n,"::actor::import_state",u,d,l)}),c(`[${e}] state import completed (positively observed)`)}catch(o){m(o)&&p("import_state",o),i("import_state","REFUSED: this release accepts only direct-host-storage app format 2; existing state was left untouched",o)}{try{let u=await w(async l=>{let f=await _(n,"::a2a_messaging::commit_e2e_restore",{},l),v=f.Reduce("status").Visualize(),b=f.Reduce("sessions").IsNil()?"0":f.Reduce("sessions").Visualize();return{status:String(v),sessions:String(b)}});c(`[${e}] e2e restore commit: status=${u.status} sessions=${u.sessions}`)}catch(u){m(u)&&p("commit_e2e_restore",u),c(`[${e}] E2E RESTORE REJECTED \u2014 staged session blob failed pickle_key validation; discarding it, fresh account + self-heal fallback take over: ${String(u).slice(0,260)}`),y(n,{event:"e2e_restore_rejected",origin:"restore",error:String(u).slice(0,300)});try{await w(async l=>{await _(n,"::a2a_messaging::reject_e2e_restore",{},l)})}catch(l){m(l)&&p("reject_e2e_restore",l),c(`[${e}] reject_e2e_restore failed (staging is transient; continuing):`,String(l))}}try{n.pw.refresh_identity_proof_document(),c(`[${e}] transport IPD refreshed from post-import state`)}catch(u){i("ipd_refresh","FAILED (IPD would advertise a stale bundle)",u)}let o=!1,d="";try{if(process.env.OURS_TEST_FORCE_IPD_INCOHERENT==="1")throw new Error("forced incoherent (OURS_TEST_FORCE_IPD_INCOHERENT)");let u=$(v=>String(S(n,"::a2a_messaging::e2e_self_fp",v).Reduce("ik").Visualize())),l=n.pw.identity_proof_document.Visualize(),f=u.replace(/^0x/i,"");o=f.length>=32&&l.toLowerCase().includes(f.toLowerCase()),d=u.slice(0,18),y(n,{event:"ipd_coherence",ik:u,coherent:o})}catch(u){i("ipd_coherence","probe FAILED (coherence unprovable)",u)}c(`[${e}] IPD/e2e coherence: account_ik=${d}\u2026 ipd_advertises_it=${o}`),o||i("ipd_coherence","IPD does NOT advertise the live account ik",new Error("incoherent transport IPD"))}}try{te(n)}catch(o){i("history_open","FAILED (SQLite history unavailable)",o)}let a=Se(n.dir);return a&&(n.temp=a),Be(n)}async function Jt(){g.mkdirSync(P(),{recursive:!0});let e;try{e=g.readFileSync(ce(),"utf8").trim()}catch{}let t=He(24).toString("hex");ve(await Z(L,t,P(),!1,e)),e||g.writeFileSync(ce(),J(V),{mode:384}),Re(D(V)),c(`contact-book registrar ready (${V.cid})`)}function Pe(e){try{return g.existsSync(T(e))&&g.statSync(T(e)).size>0}catch{return!1}}function Ue(e){let t=$(m=>Buffer.from(S(e,"::actor::export_state",m).Serialize()));g.mkdirSync(e.dir,{recursive:!0,mode:448});let r=T(e.dir),n=`${r}.tmp`,s;try{s=g.openSync(n,"w",384),g.fchmodSync(s,384),g.writeFileSync(s,t),g.fsyncSync(s),g.closeSync(s),s=void 0,g.renameSync(n,r),g.chmodSync(r,384);try{g.chmodSync(q(e.dir),384)}catch{}let m=g.openSync(e.dir,"r");try{g.fsyncSync(m)}finally{g.closeSync(m)}}catch(m){if(s!==void 0)try{g.closeSync(s)}catch{}try{g.rmSync(n,{force:!0})}catch{}throw m}}function B(e){try{Ue(e),e.persistFailed&&(e.persistFailed=!1,c(`[${e.name}] persist recovered \u2014 quarantine lifted`),y(e,{event:"persist_recovered"}))}catch(t){e.persistFailed=!0,c(`[${e.name}] PERSIST FAILED \u2014 identity quarantined (fail-closed), outbound of this txn withheld:`,String(t));try{y(e,{event:"persist_failed",error:String(t).slice(0,300)})}catch{}throw process.nextTick(()=>ke(e.name,`[${e.name}] PERSIST FAILED \u2014 messaging quarantined until the state file is writable again`)),t}}function $(e){let t=new De;try{return e(t)}finally{t.Finalize()}}async function w(e){let t=new De;try{return await e(t)}finally{t.Finalize()}}function S(e,t,r,n){let s=Fe({name:t,targ:n}),m=e.pw.packet.ExecuteTransaction(s);return s.Destroy(),r?m.Attach(r):m}async function Ge(e,t){let r=e.lock,n;e.lock=new Promise(s=>n=s),await r;try{return await t()}finally{n()}}function We(e,t,r=25e3){return new Promise((n,s)=>{let m=setTimeout(()=>{let i=e.pending.findIndex(p=>p.timer===m);i>=0&&e.pending.splice(i,1),s(new Error("timed out waiting for the transaction result"))},r);e.pending.push({resolve:n,reject:s,timer:m}),e.pw.add_client_message(t)})}function _(e,t,r,n,s){if(e.persistFailed)try{B(e)}catch(i){return Promise.reject(new Error(`identity "${e.name}" is quarantined: state persist is failing (${String(i)}) \u2014 mutations are rejected until state_data.bin is writable again`))}let m=Fe({name:t,targ:r});return Ge(e,()=>We(e,m,s)).then(i=>{if(m.Destroy(),e.persistFailed){try{i.Destroy()}catch{}throw new Error(`identity "${e.name}": state persist FAILED \u2014 this transaction's outbound was withheld (fail-closed); fix the state directory and retry`)}return n?i.Attach(n):i},i=>{try{m.Destroy()}catch{}throw i})}function ni(e){let t=[],r=e.Reduce("degraded");if(r.IsNil())return t;for(let n=0;;n++){let s=r.Reduce(n);if(s.IsNil())break;t.push({cid:s.Reduce("container_id").Visualize(),name:s.Reduce("name").Visualize(),attempts:Number(s.Reduce("attempts").Visualize()),queued:Number(s.Reduce("queued").Visualize())})}return t}function Ke(e){let t=[],r=e.Reduce("queues");if(r.IsNil())return t;for(let n=0;;n++){let s=r.Reduce(n);if(s.IsNil())break;t.push({cid:s.Reduce("container_id").Visualize(),queued:Number(s.Reduce("queued").Visualize()),degraded:s.Reduce("degraded").GetBoolean()})}return t}async function oe(e,t){try{let r=await w(async n=>{let s=await _(e,"::a2a_messaging::flush_deferred",{contact:t},n);return Number(s.Reduce("flushed").Visualize())});r>0&&c(`[${e.name}] flushed ${r} deferred message(s) to ${t.slice(0,12)}\u2026`)}catch(r){c(`[${e.name}] deferred flush to ${t.slice(0,12)}\u2026 failed:`,String(r))}}async function Ee(e){try{let t=await w(async n=>{let s=await _(e,"::a2a_messaging::restore_degraded_contacts",{},n);return Number(s.Reduce("requested").Visualize())});t>0&&c(`[${e.name}] contact restore requested for ${t} degraded contact(s)`);let r=$(n=>Ke(S(e,"::a2a_messaging::list_deferred_queues",n)));for(let n of r)n.degraded||await oe(e,n.cid)}catch(t){c(`[${e.name}] contact-restore sweep failed:`,String(t))}}async function Je(e){try{let t=await w(async r=>{let n=await _(e,"::a2a_messaging::reconcile_advertise",{},r),s=m=>n.Reduce(m).IsNil()?0:Number(n.Reduce(m).Visualize());return{changed:/true/i.test(n.Reduce("changed").Visualize()),capabilityAdvertised:s("capability_advertised"),legacyReadvertised:s("legacy_readvertised")}});(t.capabilityAdvertised>0||t.legacyReadvertised>0)&&c(`[${e.name}] capability reconcile: changed=${t.changed} advertised=${t.capabilityAdvertised} legacy_migration_bootstrap=${t.legacyReadvertised}`)}catch(t){c(`[${e.name}] capability reconcile sweep failed:`,String(t))}}var le=new Set;function W(e){if(!le.has(e.name)){le.add(e.name);for(let t of[2e3,15e3])setTimeout(()=>{t===15e3&&le.delete(e.name);let r=R.get(e.name);r&&Je(r)},t)}}async function oi(e){try{let t=await w(async r=>{let n=await _(e,"::a2a_messaging::readvertise_e2e_recovery",{},r);return Number(n.Reduce("readvertised").Visualize())});t>0&&c(`[${e.name}] re-advertised fresh AD to ${t} e2e contact(s) (session recovery)`)}catch(t){c(`[${e.name}] e2e recovery re-advertise failed:`,String(t))}try{await w(async t=>{await _(e,"::a2a_messaging::sweep_e2e_migrations",{},t)})}catch(t){c(`[${e.name}] e2e migration sweep failed:`,String(t))}try{let t=await w(async r=>{let n=await _(e,"::a2a_messaging::redrive_unacked_sweep",{},r),s=m=>n.Reduce(m).IsNil()?0:Number(n.Reduce(m).Visualize());return{redriven:s("redriven_contacts"),purged:s("purged_contacts"),deferred:s("deferred_contacts")}});(t.redriven>0||t.purged>0||t.deferred>0)&&c(`[${e.name}] unacked sweep: redriven=${t.redriven} ttl_purged=${t.purged} deferred=${t.deferred} contact(s)`)}catch(t){c(`[${e.name}] unacked redrive sweep failed:`,String(t))}}export{ni as a,Ke as b,oe as c,Ee as d,Je as e,W as f,oi as g,ze as h,ft as i,F as j,gt as k,yt as l,Ae as m,Y as n,_t as o,Be as p,It as q,Z as r,O as s,jt as t,Ct as u,Jt as v,Pe as w,Ue as x,B as y,$ as z,w as A,S as B,Ge as C,We as D,_ as E,P as F,ce as G,ae as H,K as I,Ne as J,D as K,J as L,Q as M,de as N,Te as O};

package/dist/chunk-E34QSIVP.js

@@ -0,0 +1,2 @@
+import { createRequire } from 'node:module'; const require = createRequire(import.meta.url);
+import{B as d,m as a,z as c}from"./chunk-AH3RIV2J.js";import{c as s}from"./chunk-5JKYJZAR.js";function y(e){try{return c(n=>{let i=d(e,"::a2a_capabilities::get_manifest",n).Reduce("capabilities");return i.IsNil()?[]:[...i.GetKeys()].map(t=>typeof t=="string"?t:t.Visualize())})}catch{return[]}}function R(e){let n="",i="",t="",u="",l=[];try{c(g=>{let p=d(e,"::a2a_capabilities::get_manifest",g),r=o=>{let f=p.Reduce(o);return f.IsNil()?"":f.Visualize()};n=r("app_id"),i=r("name"),t=r("description"),u=r("version");let m=p.Reduce("capabilities");m.IsNil()||(l=[...m.GetKeys()].map(o=>typeof o=="string"?o:o.Visualize()))})}catch{}return{app_id:n,name:i,description:t,version:u,capabilities:l,monitoring_status:"unbound"}}function h(e){let n=[];for(let i of s.values()){if(i.name===e.name)continue;let t=a(i);t.rootCid===e.cid&&n.push({name:i.name,cid:i.cid,role_id:t.roleId,bio:t.bio,monitoring:t.monitoringEnabled,capabilities:y(i)})}return n}function v(e,n){let i=s.get(n)??[...s.values()].find(t=>t.cid===n);return!i||i.name===e.name?null:a(i).rootCid===e.cid?i:null}export{y as a,R as b,h as c,v as d};

package/dist/{chunk-SEZTXIKN.js → chunk-FCQYDCQA.js}

@@ -1,2 +1,2 @@
 import { createRequire } from 'node:module'; const require = createRequire(import.meta.url);
-import{a as O}from"./chunk-HZCFYJAG.js";import{b as N,e as T}from"./chunk-WS6UFNKF.js";import{randomBytes as I}from"node:crypto";import{readFileSync as w}from"node:fs";import{homedir as x}from"node:os";import{join as v,resolve as p}from"node:path";var a=class extends Error{constructor(i,n){super(n);this.code=i;this.name="DaemonSelectionError"}},S=class extends a{constructor(i,n,d={}){super("DAEMON_UNAVAILABLE",`no ours daemon is running at ${i} for state directory ${JSON.stringify(n)}. Install the operator CLI with \`npm install --global @ours.network/cli\`, then start the shared daemon with \`ours daemon start\` or install/start its per-user service through \`ours daemon install-service\`. SDK applications attach to the shared daemon and do not start an embedded daemon.`);this.endpoint=i;this.stateDir=n;this.name="DaemonUnavailableError",d.cause!==void 0&&(this.cause=d.cause)}},b=N.port,C=T,R=".ours",k=["explicit","environment","config-file"];function _(e={}){let t=e.env??process.env,i=e.readTextFile??(h=>w(h,"utf8")),n=e.homeDir??x(),d=f(t,"OURS_INSTANCE");if(d!==void 0)throw new a("INCOHERENT_SELECTION",`OURS_INSTANCE=${JSON.stringify(d)} is set, but named daemon instances are not implemented. Select the daemon with an explicit endpoint/port option or with OURS_PORT, and unset OURS_INSTANCE.`);if(e.stateDir!==void 0&&e.expectStateDir!==void 0){let h=p(e.stateDir),D=p(e.expectStateDir);if(h!==D)throw new a("INCOHERENT_SELECTION",`stateDir ${JSON.stringify(h)} and expectStateDir ${JSON.stringify(D)} name different directories. The state directory decides which token is read; the expected one decides which daemon that token may be sent to. Reconcile them, or pass only one.`)}let r=V(e.configPath,f(t,"OURS_CONFIG")),s=r?L(r.value,i):{},o=E(e.port,F(f(t,"OURS_PORT")),s.port,b),c=E(e.stateDir??e.expectStateDir,f(t,"OURS_STATE_DIR"),s.stateDir,v(n,R)),l={value:p(c.value),source:c.source},g=e.endpoint!==void 0?{value:P(e.endpoint),source:"explicit"}:{value:`http://127.0.0.1:${o.value}`,source:o.source},m=f(t,"OURS_API_TOKEN");A({endpointSelected:e.endpoint!==void 0||o.source!=="default",endpointSource:g.source,stateDirIntentional:k.includes(l.source),stateDirSource:l.source,hasExplicitToken:e.token!==void 0&&e.token!=="",hasEnvToken:m!==void 0,requireExplicitSelection:e.requireExplicitSelection===!0,portSource:o.source});let y=U(e.token,m,s,l,i);return{baseUrl:g,port:o,stateDir:l,expectStateDir:e.expectStateDir!==void 0?p(e.expectStateDir):l.value,...y?{token:y}:{},...r?{configPath:r}:{}}}function K(e){return{baseUrl:e.baseUrl.value,baseUrlSource:e.baseUrl.source,port:e.port.value,portSource:e.port.source,stateDir:e.stateDir.value,stateDirSource:e.stateDir.source,expectStateDir:e.expectStateDir,tokenSource:e.token?.source??"none",configPath:e.configPath?.value??null}}function A(e){if(e.requireExplicitSelection){if(e.endpointSource==="default"&&e.portSource==="default")throw u(`requireExplicitSelection is set, but no daemon was selected. Pass endpoint/port, set OURS_PORT, or point OURS_CONFIG at a config file. Refusing the built-in default 127.0.0.1:${b}.`);if(!e.stateDirIntentional)throw u("requireExplicitSelection is set, but the state directory is the built-in default. Every auth-affecting field must be chosen deliberately: pass stateDir or expectStateDir, set OURS_STATE_DIR, or name a config file. Refusing before reading any token or opening any socket.")}if(e.endpointSelected&&!e.stateDirIntentional)throw u(`the endpoint was selected (source: ${e.endpointSource}) but the state directory is the built-in default. A daemon's API token belongs to one state directory, so reading the default token and sending it to a separately chosen endpoint would disclose a credential to it. Select the state directory too: stateDir, expectStateDir, OURS_STATE_DIR, or one config file. An explicit token alone is not enough \u2014 without an expected state directory there is nothing to assert the endpoint against before the token is sent.`);if(e.hasEnvToken&&!e.stateDirIntentional)throw u("OURS_API_TOKEN is set, but the state directory is the built-in default. An environment token is process-wide and authenticates to every daemon it is offered to, so it requires an explicitly expected state directory: pass stateDir or expectStateDir, or set OURS_STATE_DIR.");if(e.hasExplicitToken&&!e.stateDirIntentional)throw u("an explicit token was given, but the state directory is the built-in default, so there would be nothing to assert the daemon against before the token is sent. Pass expectStateDir (or stateDir) naming the state directory that token belongs to.")}function u(e){return new a("INCOHERENT_SELECTION",e)}function U(e,t,i,n,d){if(e!==void 0&&e!=="")return{value:e,source:"explicit"};if(t!==void 0)return{value:t,source:"environment"};let r=i.apiToken?.trim();if(r)return{value:r,source:"config-file"};try{let s=d(v(n.value,C)).trim();if(s)return{value:s,source:"token-file"}}catch{}}function L(e,t){let i;try{i=t(e)}catch{throw new a("CONFIG_UNREADABLE",`the daemon config file ${JSON.stringify(e)} could not be read.`)}let n;try{n=JSON.parse(i)}catch{throw new a("CONFIG_INVALID",`the daemon config file ${JSON.stringify(e)} is not valid JSON.`)}if(n===null||typeof n!="object"||Array.isArray(n))throw new a("CONFIG_INVALID",`the daemon config file ${JSON.stringify(e)} is not a JSON object.`);let d=n,r={},s=d.port;if(s!==void 0){if(typeof s!="number"||!Number.isInteger(s)||s<1||s>65535)throw new a("CONFIG_INVALID",`the daemon config file ${JSON.stringify(e)} declares an invalid port; expected an integer 1-65535.`);r.port=s}let o=d.stateDir;if(o!==void 0){if(typeof o!="string"||o.trim()==="")throw new a("CONFIG_INVALID",`the daemon config file ${JSON.stringify(e)} declares an invalid stateDir; expected a non-empty string.`);r.stateDir=o}let c=d.apiToken;if(c!==void 0){if(typeof c!="string"||c.trim()==="")throw new a("CONFIG_INVALID",`the daemon config file ${JSON.stringify(e)} declares an invalid apiToken; expected a non-empty string.`);r.apiToken=c}let l=d.apiVisibility;if(l!==void 0){if(l!=="owner"&&l!=="shared"&&l!=="open")throw new a("CONFIG_INVALID",`the daemon config file ${JSON.stringify(e)} declares an unknown apiVisibility ${JSON.stringify(l)}; expected "owner", "shared" or "open".`);r.apiVisibility=l}return r}function f(e,t){let i=e[t];if(i===void 0)return;let n=i.trim();return n===""?void 0:n}function F(e){if(e===void 0)return;let t=Number.parseInt(e,10);if(!Number.isInteger(t)||t<1||t>65535)throw new a("INCOHERENT_SELECTION",`OURS_PORT=${JSON.stringify(e)} is not a TCP port between 1 and 65535.`);return t}function P(e){return e.endsWith("/")?e.slice(0,-1):e}function E(e,t,i,n){return e!==void 0?{value:e,source:"explicit"}:t!==void 0?{value:t,source:"environment"}:i!==void 0?{value:i,source:"config-file"}:{value:n,source:"default"}}function V(e,t){if(e!==void 0)return{value:e,source:"explicit"};if(t!==void 0)return{value:t,source:"environment"}}async function $(e,t={}){let i=t.fetch??globalThis.fetch,n=new AbortController,d=setTimeout(()=>n.abort(),t.timeoutMs??5e3),r;try{let o=await i(`${e.baseUrl.value}/state-dir`,{signal:n.signal});if(!o.ok)throw new a("INCOHERENT_SELECTION",`${e.baseUrl.value}/state-dir answered HTTP ${o.status}, so the daemon at that address could not be identified. Refusing to send a credential to it.`);r=await o.json()}catch(o){throw o instanceof a?o:new S(e.baseUrl.value,e.expectStateDir,{cause:o})}finally{clearTimeout(d)}let s=typeof r.stateDir=="string"?p(r.stateDir):null;if(s===null)throw new a("INCOHERENT_SELECTION",`${e.baseUrl.value}/state-dir did not report a state directory, so this is not an ours daemon or not one this client understands. Refusing to send a credential to it.`);if(s!==e.expectStateDir)throw new a("INCOHERENT_SELECTION",`the daemon at ${e.baseUrl.value} owns state directory ${JSON.stringify(s)}, but this selection expects ${JSON.stringify(e.expectStateDir)}. The token belongs to the expected directory, so it is NOT being sent. Point the endpoint and the state directory at the same daemon.`)}async function j(e={}){let{leaseToken:t,clientPid:i,fetch:n,...d}=e,r=_(d);return await $(r,{fetch:n}),new O({url:r.baseUrl.value,leaseToken:t??I(32).toString("hex"),clientPid:i,apiToken:r.token?.value,fetch:n})}export{a,S as b,b as c,C as d,_ as e,K as f,$ as g,j as h};
+import{a as O}from"./chunk-P2AAWXWI.js";import{c as N,f as T}from"./chunk-2X5HGMMO.js";import{randomBytes as I}from"node:crypto";import{readFileSync as w}from"node:fs";import{homedir as x}from"node:os";import{join as v,resolve as p}from"node:path";var a=class extends Error{constructor(i,n){super(n);this.code=i;this.name="DaemonSelectionError"}},S=class extends a{constructor(i,n,d={}){super("DAEMON_UNAVAILABLE",`no ours daemon is running at ${i} for state directory ${JSON.stringify(n)}. Install the operator CLI with \`npm install --global @ours.network/cli\`, then start the shared daemon with \`ours daemon start\` or install/start its per-user service through \`ours daemon install-service\`. SDK applications attach to the shared daemon and do not start an embedded daemon.`);this.endpoint=i;this.stateDir=n;this.name="DaemonUnavailableError",d.cause!==void 0&&(this.cause=d.cause)}},b=N.port,C=T,R=".ours",k=["explicit","environment","config-file"];function _(e={}){let t=e.env??process.env,i=e.readTextFile??(h=>w(h,"utf8")),n=e.homeDir??x(),d=f(t,"OURS_INSTANCE");if(d!==void 0)throw new a("INCOHERENT_SELECTION",`OURS_INSTANCE=${JSON.stringify(d)} is set, but named daemon instances are not implemented. Select the daemon with an explicit endpoint/port option or with OURS_PORT, and unset OURS_INSTANCE.`);if(e.stateDir!==void 0&&e.expectStateDir!==void 0){let h=p(e.stateDir),D=p(e.expectStateDir);if(h!==D)throw new a("INCOHERENT_SELECTION",`stateDir ${JSON.stringify(h)} and expectStateDir ${JSON.stringify(D)} name different directories. The state directory decides which token is read; the expected one decides which daemon that token may be sent to. Reconcile them, or pass only one.`)}let r=V(e.configPath,f(t,"OURS_CONFIG")),s=r?L(r.value,i):{},o=E(e.port,F(f(t,"OURS_PORT")),s.port,b),c=E(e.stateDir??e.expectStateDir,f(t,"OURS_STATE_DIR"),s.stateDir,v(n,R)),l={value:p(c.value),source:c.source},g=e.endpoint!==void 0?{value:P(e.endpoint),source:"explicit"}:{value:`http://127.0.0.1:${o.value}`,source:o.source},m=f(t,"OURS_API_TOKEN");A({endpointSelected:e.endpoint!==void 0||o.source!=="default",endpointSource:g.source,stateDirIntentional:k.includes(l.source),stateDirSource:l.source,hasExplicitToken:e.token!==void 0&&e.token!=="",hasEnvToken:m!==void 0,requireExplicitSelection:e.requireExplicitSelection===!0,portSource:o.source});let y=U(e.token,m,s,l,i);return{baseUrl:g,port:o,stateDir:l,expectStateDir:e.expectStateDir!==void 0?p(e.expectStateDir):l.value,...y?{token:y}:{},...r?{configPath:r}:{}}}function K(e){return{baseUrl:e.baseUrl.value,baseUrlSource:e.baseUrl.source,port:e.port.value,portSource:e.port.source,stateDir:e.stateDir.value,stateDirSource:e.stateDir.source,expectStateDir:e.expectStateDir,tokenSource:e.token?.source??"none",configPath:e.configPath?.value??null}}function A(e){if(e.requireExplicitSelection){if(e.endpointSource==="default"&&e.portSource==="default")throw u(`requireExplicitSelection is set, but no daemon was selected. Pass endpoint/port, set OURS_PORT, or point OURS_CONFIG at a config file. Refusing the built-in default 127.0.0.1:${b}.`);if(!e.stateDirIntentional)throw u("requireExplicitSelection is set, but the state directory is the built-in default. Every auth-affecting field must be chosen deliberately: pass stateDir or expectStateDir, set OURS_STATE_DIR, or name a config file. Refusing before reading any token or opening any socket.")}if(e.endpointSelected&&!e.stateDirIntentional)throw u(`the endpoint was selected (source: ${e.endpointSource}) but the state directory is the built-in default. A daemon's API token belongs to one state directory, so reading the default token and sending it to a separately chosen endpoint would disclose a credential to it. Select the state directory too: stateDir, expectStateDir, OURS_STATE_DIR, or one config file. An explicit token alone is not enough \u2014 without an expected state directory there is nothing to assert the endpoint against before the token is sent.`);if(e.hasEnvToken&&!e.stateDirIntentional)throw u("OURS_API_TOKEN is set, but the state directory is the built-in default. An environment token is process-wide and authenticates to every daemon it is offered to, so it requires an explicitly expected state directory: pass stateDir or expectStateDir, or set OURS_STATE_DIR.");if(e.hasExplicitToken&&!e.stateDirIntentional)throw u("an explicit token was given, but the state directory is the built-in default, so there would be nothing to assert the daemon against before the token is sent. Pass expectStateDir (or stateDir) naming the state directory that token belongs to.")}function u(e){return new a("INCOHERENT_SELECTION",e)}function U(e,t,i,n,d){if(e!==void 0&&e!=="")return{value:e,source:"explicit"};if(t!==void 0)return{value:t,source:"environment"};let r=i.apiToken?.trim();if(r)return{value:r,source:"config-file"};try{let s=d(v(n.value,C)).trim();if(s)return{value:s,source:"token-file"}}catch{}}function L(e,t){let i;try{i=t(e)}catch{throw new a("CONFIG_UNREADABLE",`the daemon config file ${JSON.stringify(e)} could not be read.`)}let n;try{n=JSON.parse(i)}catch{throw new a("CONFIG_INVALID",`the daemon config file ${JSON.stringify(e)} is not valid JSON.`)}if(n===null||typeof n!="object"||Array.isArray(n))throw new a("CONFIG_INVALID",`the daemon config file ${JSON.stringify(e)} is not a JSON object.`);let d=n,r={},s=d.port;if(s!==void 0){if(typeof s!="number"||!Number.isInteger(s)||s<1||s>65535)throw new a("CONFIG_INVALID",`the daemon config file ${JSON.stringify(e)} declares an invalid port; expected an integer 1-65535.`);r.port=s}let o=d.stateDir;if(o!==void 0){if(typeof o!="string"||o.trim()==="")throw new a("CONFIG_INVALID",`the daemon config file ${JSON.stringify(e)} declares an invalid stateDir; expected a non-empty string.`);r.stateDir=o}let c=d.apiToken;if(c!==void 0){if(typeof c!="string"||c.trim()==="")throw new a("CONFIG_INVALID",`the daemon config file ${JSON.stringify(e)} declares an invalid apiToken; expected a non-empty string.`);r.apiToken=c}let l=d.apiVisibility;if(l!==void 0){if(l!=="owner"&&l!=="shared"&&l!=="open")throw new a("CONFIG_INVALID",`the daemon config file ${JSON.stringify(e)} declares an unknown apiVisibility ${JSON.stringify(l)}; expected "owner", "shared" or "open".`);r.apiVisibility=l}return r}function f(e,t){let i=e[t];if(i===void 0)return;let n=i.trim();return n===""?void 0:n}function F(e){if(e===void 0)return;let t=Number.parseInt(e,10);if(!Number.isInteger(t)||t<1||t>65535)throw new a("INCOHERENT_SELECTION",`OURS_PORT=${JSON.stringify(e)} is not a TCP port between 1 and 65535.`);return t}function P(e){return e.endsWith("/")?e.slice(0,-1):e}function E(e,t,i,n){return e!==void 0?{value:e,source:"explicit"}:t!==void 0?{value:t,source:"environment"}:i!==void 0?{value:i,source:"config-file"}:{value:n,source:"default"}}function V(e,t){if(e!==void 0)return{value:e,source:"explicit"};if(t!==void 0)return{value:t,source:"environment"}}async function $(e,t={}){let i=t.fetch??globalThis.fetch,n=new AbortController,d=setTimeout(()=>n.abort(),t.timeoutMs??5e3),r;try{let o=await i(`${e.baseUrl.value}/state-dir`,{signal:n.signal});if(!o.ok)throw new a("INCOHERENT_SELECTION",`${e.baseUrl.value}/state-dir answered HTTP ${o.status}, so the daemon at that address could not be identified. Refusing to send a credential to it.`);r=await o.json()}catch(o){throw o instanceof a?o:new S(e.baseUrl.value,e.expectStateDir,{cause:o})}finally{clearTimeout(d)}let s=typeof r.stateDir=="string"?p(r.stateDir):null;if(s===null)throw new a("INCOHERENT_SELECTION",`${e.baseUrl.value}/state-dir did not report a state directory, so this is not an ours daemon or not one this client understands. Refusing to send a credential to it.`);if(s!==e.expectStateDir)throw new a("INCOHERENT_SELECTION",`the daemon at ${e.baseUrl.value} owns state directory ${JSON.stringify(s)}, but this selection expects ${JSON.stringify(e.expectStateDir)}. The token belongs to the expected directory, so it is NOT being sent. Point the endpoint and the state directory at the same daemon.`)}async function j(e={}){let{leaseToken:t,clientPid:i,fetch:n,...d}=e,r=_(d);return await $(r,{fetch:n}),new O({url:r.baseUrl.value,leaseToken:t??I(32).toString("hex"),clientPid:i,apiToken:r.token?.value,fetch:n})}export{a,S as b,b as c,C as d,_ as e,K as f,$ as g,j as h};

package/dist/{chunk-ZLCQNN5W.js → chunk-IFCOOPD7.js}

@@ -1,3 +1,3 @@
 import { createRequire } from 'node:module'; const require = createRequire(import.meta.url);
-import{e as a}from"./chunk-ZHH3PWEW.js";import{d as s,f as i,g as u,h as p}from"./chunk-WS6UFNKF.js";import{timingSafeEqual as d}from"node:crypto";var b="3.0.3",r=s(),_=r.stateDir,k=r.brokerUrl,g=process.env.OURS_TRANSPORT??"http",E=r.port,A=r.gcIntervalMs,c=r.apiVisibility,R=Number(process.env.OURS_TEST_STARTUP_HEARTBEAT_MS||"")||void 0,N=g==="http"?a(_,{heartbeatMs:R}):null,v=(...e)=>process.stderr.write(`ours: ${e.join(" ")}
-`);function S(){if(c==="open")return null;if(c==="shared"){let e=u(r);if(!e)throw new Error(`apiVisibility=shared requires an operator-supplied token so it can be distributed to cross-user agents \u2014 set OURS_API_TOKEN or "apiToken" in config (${i(r)} is not used for shared mode). Use apiVisibility=owner for a same-user-only auto-token, or =open to disable auth.`);return e}return p(r,{generate:!0}).token}var f=S();function T(e){let t=e.headers["x-ours-api-token"];if(typeof t=="string"&&t)return t;let o=e.headers.authorization;if(typeof o=="string"){let n=/^Bearer\s+(.+)$/i.exec(o.trim());if(n)return n[1]}}function h(e){if(f===null)return!0;let t=T(e);if(!t)return!1;let o=Buffer.from(t),n=Buffer.from(f);return o.length===n.length&&d(o,n)}function P(e,t){return h(e)?!0:(t.writeHead(401,{"Content-Type":"application/json"}),t.end(JSON.stringify({error:"unauthorized"})),!1)}var O=/^[A-Za-z0-9 _.@-]{1,64}$/,l="contact-book";function y(e){return O.test(e)?e==="."||e===".."||e.includes("/")||e.includes("\\")?"invalid name":e===l?`"${l}" is reserved for the local contact book`:e==="root.json"||e==="bindings.json"?`"${e}" is reserved for daemon bookkeeping`:null:"name must be 1-64 chars of letters, digits, space, _ . @ or -"}export{b as a,r as b,_ as c,k as d,E as e,A as f,c as g,N as h,v as i,f as j,T as k,h as l,P as m,O as n,l as o,y as p};
+import{e as a}from"./chunk-ZHH3PWEW.js";import{e as s,g as i,h as u,i as p}from"./chunk-2X5HGMMO.js";import{timingSafeEqual as d}from"node:crypto";var b="3.1.0",r=s(),_=r.stateDir,E=r.brokerUrl,g=process.env.OURS_TRANSPORT??"http",k=r.port,A=r.gcIntervalMs,N=r.historyMaxBytes,c=r.apiVisibility,R=Number(process.env.OURS_TEST_STARTUP_HEARTBEAT_MS||"")||void 0,v=g==="http"?a(_,{heartbeatMs:R}):null,y=(...e)=>process.stderr.write(`ours: ${e.join(" ")}
+`);function S(){if(c==="open")return null;if(c==="shared"){let e=u(r);if(!e)throw new Error(`apiVisibility=shared requires an operator-supplied token so it can be distributed to cross-user agents \u2014 set OURS_API_TOKEN or "apiToken" in config (${i(r)} is not used for shared mode). Use apiVisibility=owner for a same-user-only auto-token, or =open to disable auth.`);return e}return p(r,{generate:!0}).token}var f=S();function T(e){let t=e.headers["x-ours-api-token"];if(typeof t=="string"&&t)return t;let o=e.headers.authorization;if(typeof o=="string"){let n=/^Bearer\s+(.+)$/i.exec(o.trim());if(n)return n[1]}}function h(e){if(f===null)return!0;let t=T(e);if(!t)return!1;let o=Buffer.from(t),n=Buffer.from(f);return o.length===n.length&&d(o,n)}function M(e,t){return h(e)?!0:(t.writeHead(401,{"Content-Type":"application/json"}),t.end(JSON.stringify({error:"unauthorized"})),!1)}var x=/^[A-Za-z0-9 _.@-]{1,64}$/,l="contact-book";function P(e){return x.test(e)?e==="."||e===".."||e.includes("/")||e.includes("\\")?"invalid name":e===l?`"${l}" is reserved for the local contact book`:e==="root.json"||e==="bindings.json"?`"${e}" is reserved for daemon bookkeeping`:null:"name must be 1-64 chars of letters, digits, space, _ . @ or -"}export{b as a,r as b,_ as c,E as d,k as e,A as f,N as g,c as h,v as i,y as j,f as k,T as l,h as m,M as n,x as o,l as p,P as q};