@sipher.dev/agents 0.1.0 → 0.1.2

package/dist/local-control-DKnrc-X8.d.ts

@@ -0,0 +1,27 @@
+//#region ../machine-protocol/src/local-control.d.ts
+interface LocalControlVersionRange {
+  minVersion: number;
+  maxVersion: number;
+}
+interface LocalControlCapability {
+  token: string;
+  ownerUserId: string;
+  deploymentId: string;
+  machineId: string;
+  lifecycleGeneration: number;
+  connectionGeneration: number;
+  activityGeneration: number;
+  candidateVersion: string;
+  policyDigest: string;
+  expiresAt: string;
+}
+interface LocalControlStatus {
+  deploymentId: string;
+  serviceKey: string;
+  machineId?: string;
+  state: "ready" | "starting" | "stopped" | "error";
+  installedVersion?: string;
+  serverVersion: null;
+}
+//#endregion
+export { LocalControlStatus as n, LocalControlVersionRange as r, LocalControlCapability as t };

package/dist/local-control-Dm6FcXAi.js

@@ -0,0 +1,429 @@
+import { D as discoverDeployment, _ as startInstalledConnectorService, a as installDeploymentConnector, b as resolveConnectorProfileContext, d as TokenStore, i as resolveVerifiedConnectorSnapshot, l as readConnectorRegistry, m as installConnectorLauncherService, p as connectorLauncherServiceIsRunning, r as resolveVerifiedConnectorRelease, s as withDeploymentReconciliationLock, u as removeConnectorRegistry, v as uninstallConnectorLauncherService, w as MachineClient } from "./release-resolver-PnPDodU9.js";
+import { C as canonicalSignedConnectorReleaseTuple, G as negotiateLocalControlVersion } from "./src-ghbvDJyd.js";
+import { readFile, readdir, rm, rmdir } from "node:fs/promises";
+import { basename, dirname, join } from "node:path";
+import { randomUUID } from "node:crypto";
+import { connect } from "node:net";
+//#region src/desktop-bootstrap.ts
+async function bootstrapDesktopConnector(input) {
+	const platform = input.platform ?? process.platform;
+	const arch = input.arch ?? process.arch;
+	const deployment = await (input.discover ?? discoverDeployment)(input.serverUrl);
+	const context = resolveConnectorProfileContext(deployment.serviceKey, platform, input.roots);
+	try {
+		return await withDeploymentReconciliationLock({
+			serviceKey: deployment.serviceKey,
+			platform,
+			...input.roots ? { roots: input.roots } : {},
+			run: () => bootstrapDesktopConnectorLocked(input, deployment, context, platform, arch)
+		});
+	} finally {
+		await removeEmptyStateParents(context.statePath);
+	}
+}
+async function bootstrapDesktopConnectorLocked(input, deployment, context, platform, arch) {
+	await reconcileRetirement({
+		deployment,
+		context,
+		transport: input.transport,
+		platform,
+		...input.roots ? { roots: input.roots } : {},
+		...input.uninstall ? { uninstall: input.uninstall } : {},
+		...input.serviceRunning ? { serviceRunning: input.serviceRunning } : {}
+	});
+	const store = new TokenStore(context.authStorePath);
+	let pending = await readPendingServiceBootstrap(deployment, store);
+	if (pending && input.seed.development?.refreshInstalledRuntime === true && !snapshotMatchesSeed(pending.snapshot, input.seed)) {
+		await store.clearBootstrapReceipt(deployment.deploymentId);
+		await store.removeClientCredentials(deployment.deploymentId);
+		pending = void 0;
+	}
+	if (pending) {
+		const release = await resolvePendingBootstrapRelease(input, pending.snapshot, platform, arch);
+		try {
+			await (input.install ?? installDeploymentConnector)({
+				deployment,
+				release,
+				credentials: pending.credentials,
+				connectorInstallId: pending.connectorInstallId,
+				challenge: pending.challenge,
+				platform,
+				arch,
+				...input.roots ? { roots: input.roots } : {},
+				reconciliationLockHeld: true,
+				acknowledge: (receiptId) => input.transport.request("/api/desktop-auth/machines/bootstrap/ack", { receipt_id: receiptId })
+			});
+			return {
+				serverUrl: deployment.serverUrl,
+				machineId: pending.credentials.machineId,
+				machineName: "This computer",
+				installedVersion: pending.snapshot.tuple.runtimeVersion,
+				reused: false
+			};
+		} finally {
+			await release.dispose();
+		}
+	}
+	const local = await discoverLocalConnector({
+		deploymentId: deployment.deploymentId,
+		serviceKey: deployment.serviceKey,
+		platform,
+		...input.roots ? { roots: input.roots } : {}
+	});
+	if (local.state === "ownership_conflict") throw codedError("ownership_conflict", "The local connector belongs to another deployment.");
+	if (local.state === "ready") {
+		if (!local.status.machineId) throw codedError("installed_connector_unavailable", "The connector is not yet registered.");
+		if (local.status.installedVersion && !versionSatisfiesCaret(local.status.installedVersion, deployment.connectorVersionRange)) throw codedError("installed_connector_incompatible", "The installed connector is outside this deployment's compatibility policy.");
+		if (!(input.seed.development?.refreshInstalledRuntime === true && local.status.installedVersion !== input.seed.snapshot.tuple.runtimeVersion)) return {
+			serverUrl: deployment.serverUrl,
+			machineId: local.status.machineId,
+			machineName: "This computer",
+			...local.status.installedVersion ? { installedVersion: local.status.installedVersion } : {},
+			reused: true
+		};
+	}
+	if (local.state !== "ready" && (local.entry || await readConnectorRegistry(context.registryPath))) throw codedError("installed_connector_unavailable", "The installed connector service is unavailable; Desktop will not replace a possibly busy supervisor.");
+	const release = await resolveBootstrapRelease(input, deployment, platform, arch);
+	try {
+		const prepared = await store.prepareDeployment(deployment);
+		const grant = await input.transport.request("/api/desktop-auth/machines/bootstrap/grant", {
+			deployment_id: deployment.deploymentId,
+			service_key: deployment.serviceKey,
+			connector_install_id: prepared.connectorInstallId,
+			challenge: prepared.challenge,
+			policy_digest: deployment.policyDigest,
+			release_tuple: release.snapshot.tuple
+		});
+		assertGrant(grant, deployment, prepared.connectorInstallId, release.snapshot.tuple);
+		const machineClient = new MachineClient(deployment.serverUrl);
+		const machine = await (input.claim ?? machineClient.claim.bind(machineClient))({
+			accessToken: grant.access_token,
+			deploymentId: deployment.deploymentId,
+			serviceKey: deployment.serviceKey,
+			connectorInstallId: prepared.connectorInstallId,
+			challenge: prepared.challenge,
+			bootstrap: {
+				policyDigest: deployment.policyDigest,
+				releaseTuple: release.snapshot.tuple
+			}
+		});
+		if (!machine.bootstrap) throw new Error("Server did not issue connector service credentials.");
+		await (input.install ?? installDeploymentConnector)({
+			deployment,
+			release,
+			credentials: {
+				...machine.bootstrap,
+				machineId: machine.machineId
+			},
+			connectorInstallId: prepared.connectorInstallId,
+			challenge: prepared.challenge,
+			platform,
+			arch,
+			...input.roots ? { roots: input.roots } : {},
+			reconciliationLockHeld: true,
+			acknowledge: (receiptId) => input.transport.request("/api/desktop-auth/machines/bootstrap/ack", { receipt_id: receiptId })
+		});
+		return {
+			serverUrl: deployment.serverUrl,
+			machineId: machine.machineId,
+			machineName: machine.name,
+			installedVersion: release.snapshot.tuple.runtimeVersion,
+			reused: false
+		};
+	} finally {
+		await release.dispose();
+	}
+}
+async function resolveBootstrapRelease(input, deployment, platform, arch) {
+	if (input.seed.snapshot.channel === deployment.connectorChannel && versionSatisfiesCaret(input.seed.snapshot.tuple.runtimeVersion, deployment.connectorVersionRange)) {
+		const tarball = input.seed.tarball;
+		return (input.resolveSnapshot ?? resolveVerifiedConnectorSnapshot)(input.seed.snapshot, {
+			platform,
+			arch,
+			...input.seed.verification,
+			fetch: async (url) => {
+				if (String(url) !== input.seed.snapshot.tuple.tarballUrl) return new Response("Not found", { status: 404 });
+				return new Response(Buffer.from(tarball));
+			}
+		});
+	}
+	return (input.resolveLive ?? resolveVerifiedConnectorRelease)(deployment, {
+		platform,
+		arch
+	});
+}
+async function resolvePendingBootstrapRelease(input, snapshot, platform, arch) {
+	if (snapshotMatchesSeed(snapshot, input.seed)) return (input.resolveSnapshot ?? resolveVerifiedConnectorSnapshot)(snapshot, {
+		platform,
+		arch,
+		...input.seed.verification,
+		fetch: async (url) => {
+			if (String(url) !== snapshot.tuple.tarballUrl) return new Response("Not found", { status: 404 });
+			return new Response(Buffer.from(input.seed.tarball));
+		}
+	});
+	return (input.resolveSnapshot ?? resolveVerifiedConnectorSnapshot)(snapshot, {
+		platform,
+		arch,
+		...input.seed.verification
+	});
+}
+function snapshotMatchesSeed(snapshot, seed) {
+	return snapshot.digest === seed.snapshot.digest && canonicalSignedConnectorReleaseTuple(snapshot.tuple) === canonicalSignedConnectorReleaseTuple(seed.snapshot.tuple);
+}
+async function reconcileRetirement(input) {
+	const profile = await new TokenStore(input.context.authStorePath).getProfile(input.deployment.deploymentId);
+	if (!profile) return;
+	const response = await input.transport.request("/api/desktop-auth/machines/retirement", {
+		deployment_id: input.deployment.deploymentId,
+		service_key: input.deployment.serviceKey,
+		connector_install_id: profile.connectorInstallId
+	});
+	if (response.owned !== true) throw codedError("ownership_conflict", "The installed connector belongs to another signed-in owner.");
+	if (!response.retirement) return;
+	if (input.platform !== "darwin" && input.platform !== "linux" && input.platform !== "win32") throw new Error(`Unsupported service platform: ${input.platform}.`);
+	await (input.uninstall ?? uninstallConnectorLauncherService)({
+		platform: input.platform,
+		context: input.context
+	});
+	if (await (input.serviceRunning ?? connectorLauncherServiceIsRunning)({
+		platform: input.platform,
+		context: input.context
+	})) throw new Error("Retired connector service is still running.");
+	if ((await discoverLocalConnector({
+		deploymentId: input.deployment.deploymentId,
+		serviceKey: input.deployment.serviceKey,
+		platform: input.platform,
+		...input.roots ? { roots: input.roots } : {}
+	})).state === "ready") throw new Error("Retired connector service is still running.");
+	await Promise.all([
+		removeConnectorRegistry(input.context),
+		rm(dirname(input.context.configPath), {
+			recursive: true,
+			force: true
+		}),
+		clearConnectorState(input.context)
+	]);
+	await input.transport.request("/api/desktop-auth/machines/retirement/ack", {
+		deployment_id: input.deployment.deploymentId,
+		service_key: input.deployment.serviceKey,
+		connector_install_id: profile.connectorInstallId,
+		revision: response.retirement.revision,
+		token: response.retirement.token
+	});
+}
+async function readPendingServiceBootstrap(deployment, store) {
+	const profile = await store.getProfile(deployment.deploymentId);
+	const receipt = profile?.bootstrapReceipt;
+	if (!profile?.machineId || !profile.refreshToken || !profile.accessToken || !profile.accessTokenExpiresAt || !receipt) return;
+	return {
+		connectorInstallId: profile.connectorInstallId,
+		challenge: profile.challenge,
+		snapshot: receipt.snapshot,
+		credentials: {
+			receiptId: receipt.receiptId,
+			machineId: profile.machineId,
+			refreshToken: profile.refreshToken,
+			accessToken: profile.accessToken,
+			accessTokenExpiresAt: profile.accessTokenExpiresAt
+		}
+	};
+}
+async function clearConnectorState(context) {
+	const lockName = basename(context.reconciliationLockPath);
+	const entries = await readdir(context.statePath).catch((error) => {
+		if (isCode(error, "ENOENT")) return [];
+		throw error;
+	});
+	await Promise.all(entries.filter((entry) => entry !== lockName).map((entry) => rm(join(context.statePath, entry), {
+		recursive: true,
+		force: true
+	})));
+}
+async function removeEmptyStateParents(statePath) {
+	const connectorsRoot = dirname(statePath);
+	const stateRoot = dirname(connectorsRoot);
+	for (const path of [
+		statePath,
+		connectorsRoot,
+		stateRoot
+	]) await rmdir(path).catch((error) => {
+		if (!isCode(error, "ENOENT") && !isCode(error, "ENOTEMPTY")) throw error;
+	});
+}
+function assertGrant(grant, deployment, connectorInstallId, tuple) {
+	if (grant.deployment_id !== deployment.deploymentId || grant.service_key !== deployment.serviceKey || grant.connector_install_id !== connectorInstallId || grant.policy_digest !== deployment.policyDigest || canonicalSignedConnectorReleaseTuple(grant.release_tuple) !== canonicalSignedConnectorReleaseTuple(tuple) || typeof grant.access_token !== "string" || !grant.access_token || !Number.isFinite(Date.parse(grant.expires_at))) throw new Error("Desktop connector bootstrap grant did not match the requested binding.");
+}
+function versionSatisfiesCaret(version, range) {
+	const actual = /^(\d+)\.(\d+)\.(\d+)$/.exec(version)?.slice(1).map(Number);
+	const minimum = /^\^(\d+)\.(\d+)\.(\d+)$/.exec(range)?.slice(1).map(Number);
+	if (!actual || !minimum) return false;
+	for (let index = 0; index < 3; index += 1) {
+		if (actual[index] < minimum[index]) return false;
+		if (actual[index] > minimum[index]) break;
+	}
+	return minimum[0] > 0 ? actual[0] === minimum[0] : actual[1] === minimum[1];
+}
+function codedError(code, message) {
+	return Object.assign(new Error(message), { code });
+}
+function isCode(error, code) {
+	return Boolean(error && typeof error === "object" && error.code === code);
+}
+//#endregion
+//#region src/local-control.ts
+var LocalControlIncompatibleError = class extends Error {
+	code = "local_control_incompatible";
+};
+var LocalControlClient = class {
+	options;
+	constructor(options) {
+		this.options = options;
+	}
+	async command(command, capability) {
+		const request = {
+			type: "local-control/request",
+			id: randomUUID(),
+			command,
+			...capability ? { capability } : {}
+		};
+		const response = await this.exchange(request);
+		if (!response.ok) throw Object.assign(new Error(response.message), { code: response.code });
+		return response.status;
+	}
+	exchange(request) {
+		const versions = this.options.versions ?? {
+			minVersion: 1,
+			maxVersion: 2
+		};
+		const timeoutMs = this.options.timeoutMs ?? 5e3;
+		return new Promise((resolve, reject) => {
+			const socket = connect(this.options.endpoint);
+			let buffer = "";
+			let accepted = false;
+			const timer = setTimeout(() => socket.destroy(/* @__PURE__ */ new Error("Local control timed out.")), timeoutMs);
+			const finish = (error, response) => {
+				clearTimeout(timer);
+				socket.destroy();
+				if (error) reject(error);
+				else if (response) resolve(response);
+			};
+			socket.setEncoding("utf8");
+			socket.once("error", (error) => finish(error));
+			socket.once("connect", () => {
+				socket.write(`${JSON.stringify({
+					type: "local-control/hello",
+					secret: this.options.secret,
+					...versions
+				})}\n`);
+			});
+			socket.on("data", (chunk) => {
+				buffer += chunk;
+				while (buffer.includes("\n")) {
+					const index = buffer.indexOf("\n");
+					const line = buffer.slice(0, index);
+					buffer = buffer.slice(index + 1);
+					let message;
+					try {
+						message = JSON.parse(line);
+					} catch {
+						finish(/* @__PURE__ */ new Error("Local control returned invalid JSON."));
+						return;
+					}
+					if (!accepted) {
+						if (isHelloRejected(message)) {
+							finish(message.code === "incompatible_version" ? new LocalControlIncompatibleError("Local control versions do not overlap.") : /* @__PURE__ */ new Error("Local control authentication failed."));
+							return;
+						}
+						if (!isHelloAccepted(message) || !negotiateLocalControlVersion(versions, messageRange(message))) {
+							finish(/* @__PURE__ */ new Error("Local control handshake was invalid."));
+							return;
+						}
+						accepted = true;
+						socket.write(`${JSON.stringify(request)}\n`);
+						continue;
+					}
+					if (isResponse(message, request.id)) finish(void 0, message);
+					else finish(/* @__PURE__ */ new Error("Local control response was invalid."));
+				}
+			});
+		});
+	}
+};
+async function discoverLocalConnector(input) {
+	const context = resolveConnectorProfileContext(input.serviceKey, input.platform, input.roots);
+	const entry = await readConnectorRegistry(context.registryPath);
+	if (!entry) return { state: "needs_bootstrap" };
+	if (entry.deploymentId !== input.deploymentId || entry.serviceKey !== input.serviceKey) return {
+		state: "ownership_conflict",
+		entry
+	};
+	try {
+		const secret = (await readFile(context.controlSecretPath, "utf8")).trim();
+		const status = await new LocalControlClient({
+			endpoint: entry.endpoint,
+			secret,
+			...input.versions ? { versions: input.versions } : {}
+		}).command("status");
+		if (status.deploymentId !== input.deploymentId || status.serviceKey !== input.serviceKey) return {
+			state: "ownership_conflict",
+			entry
+		};
+		return status.state === "ready" ? {
+			state: "ready",
+			entry,
+			status
+		} : {
+			state: "needs_bootstrap",
+			entry
+		};
+	} catch (error) {
+		if (error instanceof LocalControlIncompatibleError) throw error;
+		return {
+			state: "needs_bootstrap",
+			entry
+		};
+	}
+}
+async function runLocalControlCommand(input) {
+	const context = resolveConnectorProfileContext(input.serviceKey, input.platform, input.roots);
+	const entry = await readConnectorRegistry(context.registryPath);
+	if (!entry) throw Object.assign(/* @__PURE__ */ new Error("Connector service is not installed."), { code: "not_installed" });
+	if (entry.deploymentId !== input.deploymentId || entry.serviceKey !== input.serviceKey) throw Object.assign(/* @__PURE__ */ new Error("Connector service ownership conflict."), { code: "ownership_conflict" });
+	const platform = supportedServicePlatform(input.platform ?? process.platform);
+	if (input.command === "ensure-installed") await installConnectorLauncherService({
+		platform,
+		context
+	});
+	else if (input.command === "start") await startInstalledConnectorService({
+		platform,
+		context
+	});
+	const secret = (await readFile(context.controlSecretPath, "utf8")).trim();
+	const client = new LocalControlClient({
+		endpoint: entry.endpoint,
+		secret
+	});
+	return input.command === "ensure-installed" || input.command === "start" ? client.command("status") : client.command(input.command);
+}
+function supportedServicePlatform(platform) {
+	if (platform === "darwin" || platform === "linux" || platform === "win32") return platform;
+	throw new Error(`Unsupported service platform: ${platform}.`);
+}
+function isHelloAccepted(value) {
+	return Boolean(value && typeof value === "object" && value.type === "local-control/hello-accepted" && Number.isSafeInteger(value.version));
+}
+function isHelloRejected(value) {
+	return Boolean(value && typeof value === "object" && value.type === "local-control/hello-rejected");
+}
+function messageRange(message) {
+	return {
+		minVersion: message.version,
+		maxVersion: message.version
+	};
+}
+function isResponse(value, id) {
+	return Boolean(value && typeof value === "object" && value.type === "local-control/response" && value.id === id);
+}
+//#endregion
+export { bootstrapDesktopConnector as a, runLocalControlCommand as i, LocalControlIncompatibleError as n, discoverLocalConnector as r, LocalControlClient as t };

package/dist/local-control-server.d.ts

@@ -0,0 +1,18 @@
+import { n as LocalControlStatus, t as LocalControlCapability } from "./local-control-DKnrc-X8.js";
+
+//#region src/local-control-server.d.ts
+declare function startLocalControlServer(options: {
+  endpoint: string;
+  secretPath: string;
+  status(): Promise<LocalControlStatus> | LocalControlStatus;
+  onCommand?: (command: "ensure-installed" | "start" | "restart") => Promise<void>;
+  onUpdateCommand?: (command: "retry" | "force", capability: LocalControlCapability) => Promise<void>;
+  versions?: {
+    minVersion: number;
+    maxVersion: number;
+  };
+}): Promise<{
+  close: () => Promise<void>;
+}>;
+//#endregion
+export { startLocalControlServer };

package/dist/local-control-server.js

@@ -0,0 +1,149 @@
+import { G as negotiateLocalControlVersion, U as isLocalControlCommand, W as isLocalControlHello } from "./src-ghbvDJyd.js";
+import { chmod, readFile, rm } from "node:fs/promises";
+import { timingSafeEqual } from "node:crypto";
+import { createServer } from "node:net";
+//#region src/local-control-server.ts
+async function startLocalControlServer(options) {
+	const secret = (await readFile(options.secretPath, "utf8")).trim();
+	if (!secret) throw new Error("Local control secret is empty.");
+	if (!options.endpoint.startsWith("\\\\.\\pipe\\")) await rm(options.endpoint, { force: true });
+	const server = createServer((socket) => handleSocket(socket, secret, options));
+	await new Promise((resolve, reject) => {
+		server.once("error", reject);
+		server.listen({
+			path: options.endpoint,
+			readableAll: false,
+			writableAll: false
+		}, () => {
+			server.off("error", reject);
+			resolve();
+		});
+	});
+	if (!options.endpoint.startsWith("\\\\.\\pipe\\")) await chmod(options.endpoint, 384);
+	return { close: () => new Promise((resolve, reject) => server.close((error) => error ? reject(error) : resolve())) };
+}
+function handleSocket(socket, secret, options) {
+	let buffer = "";
+	let accepted = false;
+	let pending = Promise.resolve();
+	socket.setEncoding("utf8");
+	socket.on("data", (chunk) => {
+		buffer += chunk;
+		while (buffer.includes("\n")) {
+			const index = buffer.indexOf("\n");
+			const line = buffer.slice(0, index);
+			buffer = buffer.slice(index + 1);
+			pending = pending.then(() => handleLine(line, socket, secret, options, accepted)).then((value) => {
+				accepted = value;
+			}).catch(() => {
+				socket.destroy();
+			});
+		}
+	});
+}
+async function handleLine(line, socket, secret, options, accepted) {
+	let message;
+	try {
+		message = JSON.parse(line);
+	} catch {
+		socket.destroy();
+		return accepted;
+	}
+	if (!accepted) {
+		const supervisorVersions = options.versions ?? {
+			minVersion: 1,
+			maxVersion: 2
+		};
+		if (!isLocalControlHello(message) || !sameSecret(message.secret, secret)) {
+			send(socket, {
+				type: "local-control/hello-rejected",
+				code: "unauthorized",
+				supervisor: supervisorVersions
+			});
+			socket.end();
+			return false;
+		}
+		const version = negotiateLocalControlVersion(message, supervisorVersions);
+		if (!version) {
+			send(socket, {
+				type: "local-control/hello-rejected",
+				code: "incompatible_version",
+				supervisor: supervisorVersions
+			});
+			socket.end();
+			return false;
+		}
+		send(socket, {
+			type: "local-control/hello-accepted",
+			version,
+			deploymentId: (await options.status()).deploymentId
+		});
+		return true;
+	}
+	if (!isLocalControlCommand(message)) {
+		sendResponse(socket, {
+			type: "local-control/response",
+			id: requestId(message),
+			ok: false,
+			code: "invalid_request",
+			message: "Invalid local-control request."
+		});
+		return true;
+	}
+	if (message.command === "retry" || message.command === "force") {
+		if (!options.onUpdateCommand) {
+			sendResponse(socket, {
+				type: "local-control/response",
+				id: message.id,
+				ok: false,
+				code: "not_ready",
+				message: "Connector update control is unavailable."
+			});
+			return true;
+		}
+		await options.onUpdateCommand(message.command, message.capability);
+		sendResponse(socket, {
+			type: "local-control/response",
+			id: message.id,
+			ok: true,
+			status: await options.status()
+		});
+		return true;
+	}
+	if (message.command !== "status") {
+		if (!options.onCommand) {
+			sendResponse(socket, {
+				type: "local-control/response",
+				id: message.id,
+				ok: false,
+				code: "not_ready",
+				message: "Local service reconciliation is unavailable."
+			});
+			return true;
+		}
+		await options.onCommand(message.command);
+	}
+	sendResponse(socket, {
+		type: "local-control/response",
+		id: message.id,
+		ok: true,
+		status: await options.status()
+	});
+	return true;
+}
+function sendResponse(socket, response) {
+	send(socket, response);
+}
+function send(socket, value) {
+	socket.write(`${JSON.stringify(value)}\n`);
+}
+function requestId(value) {
+	return value && typeof value === "object" && typeof value.id === "string" ? value.id : "invalid";
+}
+function sameSecret(candidate, expected) {
+	const left = Buffer.from(candidate);
+	const right = Buffer.from(expected);
+	return left.length === right.length && timingSafeEqual(left, right);
+}
+//#endregion
+export { startLocalControlServer };