@threahq/bot-runtime-client 0.1.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Threa contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,99 @@
+# @threahq/bot-runtime-client
+
+Protocol client for Threa's bot runtime. It owns the `/bot` Socket.IO
+connection a runtime keeps open to Threa and routes the high-volume writes
+(presence, claim renewal, trace steps) over it, falling back to the public HTTP
+endpoints when the socket is down. It also carries the sealed-turn crypto an
+end-to-end-encrypted bot needs.
+
+Most connectors should use [`@threahq/remote-session`](https://www.npmjs.com/package/@threahq/remote-session),
+which builds the whole session loop on top of this package. Use this package
+directly when you want the socket and the write routing without the loop, for
+example a mention-driven bot that claims work with plain HTTP.
+
+The endpoints and events this package speaks are documented at
+[threa.io/developers](https://threa.io/developers): the `Bot runtimes` and
+`Bot invocations` sections of the API reference, and the "Connect your local
+agent" recipe.
+
+## Install
+
+```sh
+npm install @threahq/bot-runtime-client socket.io-client
+```
+
+`socket.io-client` is a peer dependency. Node 20+ or Bun.
+
+## Transport
+
+```ts
+import { BotRuntimeTransport } from "@threahq/bot-runtime-client"
+
+const transport = new BotRuntimeTransport({
+  baseUrl: "https://app.threa.io",
+  workspaceId: process.env.THREA_WORKSPACE_ID!,
+  apiKey: process.env.THREA_API_KEY!, // a threa_bk_ bot key
+  hello: {
+    instanceId: "my-laptop-1",
+    runtimeKind: "custom",
+    supportedCapabilities: ["mentionable"],
+  },
+  callbacks: {
+    onInvocationAvailable: () => drainClaims(),
+    onBootstrap: (snapshot) => console.log(snapshot.availableInvocations.length, "claimable"),
+  },
+  log: (line) => console.error(line),
+})
+
+await transport.connect()
+await transport.updatePresence({
+  runtimeKind: "custom",
+  instanceId: "my-laptop-1",
+  status: "available",
+  acceptingInvocations: true,
+  capabilities: {},
+})
+```
+
+`connect()` resolves the workspace's WebSocket hint from
+`GET /api/workspaces/:id/config`, opens the `/bot` namespace with the bot key,
+and sends `bot:hello`. The hello ack is the bootstrap snapshot
+(`availableInvocations`, `ownedClaims`); `onInvocationAvailable` fires when new
+work is claimable. If the hint cannot be resolved, the transport stays HTTP
+only and every write goes to the REST endpoint instead. The socket itself is
+not required for correctness; it removes the polling.
+
+Three writes are routed:
+
+| Method                          | Socket event           | HTTP fallback                     | Failure policy                                                                   |
+| ------------------------------- | ---------------------- | --------------------------------- | -------------------------------------------------------------------------------- |
+| `updatePresence(body)`          | `bot:presence:update`  | `POST /bot-runtime/presence`      | retry over HTTP on any missing ack                                               |
+| `renewClaim(id, token, ttl)`    | `bot:invocation:renew` | `POST /bot-invocations/:id/renew` | retry over HTTP on any missing ack; `{ notFound: true }` means the claim is gone |
+| `recordSteps(id, token, steps)` | `bot:invocation:steps` | `POST /bot-invocations/:id/steps` | best effort; a frame in flight is not re-sent                                    |
+
+Claiming, completing and failing an invocation are low-frequency writes and
+stay on HTTP; `@threahq/remote-session` exposes them as `ThreaClient`.
+
+Server-side rejections arrive as an ack with `ok: false` and a `code`
+(`NOT_FOUND`, `FORBIDDEN`, `INVALID_PAYLOAD`, ...). The transport logs them
+through `log` and does not throw; a caller that needs the result reads the
+return value (`renewClaim`) or checks `socketConnected`.
+
+## Sealed turns
+
+An owner can invite a bot into an end-to-end-encrypted scratchpad. The server
+then delivers the claim with a `sealedContext` instead of plaintext, and every
+reply and trace step must be ciphertext under the stream key. `E2eKeyring`
+holds the identity keys an owner wraps a stream key to — one per host by
+default, so every runtime on a box shares it — keeping them in the OS keychain
+or a `0600` file, `openSealedTurnContext` decrypts a claim,
+`sealReply` and `sealStep` encrypt what goes back, and `recordSealedSteps`
+sends sealed frames over the same socket. The wire format is the one the
+"Connect an encrypted agent" recipe describes; the SDK handles all of it for
+connectors, so only a runtime that bypasses the SDK needs these directly.
+
+## Versioning
+
+The package tracks the current public API version. Threa's REST API is dated
+(see the versioning page in the developer docs) and additive within a version,
+so a given release of this package keeps working against newer servers.

package/archive-grace.d.ts

@@ -0,0 +1,112 @@
+/**
+ * How long a runtime survives its scratchpad being archived before winding
+ * down. An unarchive inside this window reattaches the live agent in place.
+ * Shared: Claude (`@threahq/remote-session`) and Pi run separate session
+ * implementations, and a grace tuned on one must not diverge from the other.
+ */
+export declare const ARCHIVE_RESTORE_GRACE_MS: number;
+/** Reattach-probe cadence while detached. Bounded by the grace window, so it cannot become a quota burn. */
+export declare const ARCHIVE_RESTORE_PROBE_MS = 45000;
+/**
+ * Poll cadence while the `/bot` socket is up: pushes deliver work within a
+ * frame, so the poll is only a backstop for a dropped one. Shared because it
+ * is also the worst case for a runtime to notice an archive it was not pushed,
+ * which is what any external reaper has to wait out.
+ */
+export declare const WS_BACKSTOP_POLL_MS: number;
+/**
+ * The archive → grace → wind-down state machine, shared by every harness
+ * runtime.
+ *
+ * Archiving a scratchpad ends its session server-side, so the worktree behind
+ * it is finished — but archiving is also how a mis-click gets undone, so the
+ * wind-down (hand the worktree to harnessd, kill the tmux window) waits out a
+ * grace window that an unarchive can cancel.
+ *
+ * This is deliberately one implementation rather than one per runtime. Every
+ * bug this machine has produced came from the same shape: state read before an
+ * `await` and acted on after it, once the deadline had already fired or a
+ * second caller had won. The `pending` object is the identity token — every
+ * resumption re-checks `this.pending !== pending` and bails, which is what
+ * makes the wind-down terminal.
+ */
+export interface ArchiveGraceHooks {
+    /**
+     * Server truth for the attached direction. `undefined` means "could not
+     * tell" (transient failure, missing scope, outage) and never detaches — a
+     * diagnostic that did not run is not evidence the scratchpad is archived.
+     */
+    isArchived(rootStreamId: string): Promise<boolean | undefined>;
+    /**
+     * Server truth for the detached direction: try to revive this runtime's link.
+     * `true` once reattached, `false` while the scratchpad is still archived.
+     * Throwing is treated as `false` — the probe cadence retries.
+     */
+    reattach(rootStreamId: string): Promise<boolean>;
+    /** Detach effects: go offline, suspend claiming, pull the poll onto {@link probeDelayMs}. */
+    onDetached(rootStreamId: string, graceMs: number): Promise<void> | void;
+    /** Reattach effects: back to available, resume claiming. */
+    onReattached(rootStreamId: string): Promise<void> | void;
+    /**
+     * Terminal. Hand the worktree to harnessd ({@link markHarnessLinkWoundDown})
+     * and take the window down; the runtime usually dies here. Preserving the
+     * branch and removing the worktree is harnessd's job, never a runtime's —
+     * only harnessd holds the lock a concurrent revive also takes.
+     */
+    onWindDown(rootStreamId: string): Promise<void> | void;
+    log(message: string): void;
+}
+export interface ArchiveGraceOptions {
+    /** Override the grace window. Tests use a few hundred ms; production takes the shared default. */
+    graceMs?: number;
+}
+export declare class ArchiveGraceController {
+    private readonly hooks;
+    private pending;
+    private probing;
+    private stopped;
+    private transitions;
+    private readonly graceMs;
+    constructor(hooks: ArchiveGraceHooks, options?: ArchiveGraceOptions);
+    /** Detached and waiting out the grace: claims must stay suspended while this is true. */
+    get detached(): boolean;
+    get pendingRootStreamId(): string | undefined;
+    /**
+     * Bumped on every attach/detach transition. A runtime with a request already
+     * in flight snapshots this before awaiting and drops its result if the value
+     * moved — otherwise a link created before the archive lands is committed
+     * after it, resurrecting a link to a scratchpad that is archived
+     * server-side.
+     */
+    get generation(): number;
+    /**
+     * Poll cadence while detached, scaled so several probes always fit inside the
+     * grace even when it is shortened for a test. Bounded by the window, so it
+     * cannot become a quota burn.
+     */
+    get probeDelayMs(): number;
+    /**
+     * This root is archived (a `bot:session_archived` push, or a probe that
+     * found `archivedAt`). Callers scope the event to their own runtime session
+     * and current root before calling — a stale event for a retired root must
+     * never wind down the scratchpad now linked.
+     */
+    archived(rootStreamId: string): Promise<void>;
+    /**
+     * The scratchpad came back (a `bot:session_restored` push). Revives the link
+     * and cancels the wind-down; a transient failure keeps the detached state so
+     * the probe cadence retries inside the remaining window.
+     */
+    restored(): Promise<void>;
+    /**
+     * The poll-tick backstop. `bot:session_archived` is a one-shot push with no
+     * replay, so a runtime whose socket was down when the archive landed would
+     * otherwise hold its worktree forever. Re-derives from the server and drives
+     * whichever direction applies.
+     */
+    probe(currentRootStreamId: string | undefined): Promise<void>;
+    /** Teardown. Disarms the deadline so a shutting-down runtime cannot wind down behind itself. */
+    stop(): void;
+    private attemptReattach;
+    private windDown;
+}

package/attachment-files.d.ts

@@ -0,0 +1,15 @@
+/**
+ * One downloaded attachment's filename, stripped of path separators and
+ * Windows-hostile characters. An over-long name loses stem, never extension:
+ * the agent (and a `THREA_ATTACH:` re-upload) picks the mime type off the
+ * suffix, so a truncated `.png` would land as `application/octet-stream`.
+ */
+export declare function safeAttachmentFilename(filename: string): string;
+/**
+ * A downloaded attachment lands in a per-attachment-id subdirectory: filenames
+ * are not unique (the same `image.png` pasted into two messages, or one file
+ * carried by both the source and a context message), so a flat directory
+ * silently clobbers the earlier download. The leaf keeps the original filename
+ * so a re-upload round-trips the name and extension unchanged.
+ */
+export declare function attachmentLocalPath(dir: string, attachmentId: string, filename: string): string;

package/crypto.d.ts

@@ -0,0 +1,206 @@
+/**
+ * Vendored subset of `@threahq/crypto` (the repo's `packages/crypto`).
+ *
+ * The bot-runtime extensions ship standalone — they are copied to the user's
+ * machine (e.g. `~/.pi/agent/extensions/`) and installed there, where the
+ * private, unpublished `@threahq/crypto` workspace package cannot resolve. So the
+ * slice the sealed (E2EE) bot path needs is copied here verbatim and depends
+ * only on the published `@hpke/*` packages plus WebCrypto. Both harnesses
+ * (pi-remote, claude-code-remote via remote-session) consume this one copy.
+ *
+ * Source of truth: `packages/crypto/src/{encoding,hpke,stream-key,envelope,sealed-payload,attachment}.ts`.
+ * `crypto.parity.test.ts` imports BOTH this module and the canonical package and
+ * asserts byte-for-byte agreement on the AAD builders, envelope/payload versions,
+ * and cross seal/open + wrap/unwrap round-trips — so a drift here fails loudly.
+ * Keep the two in sync; if the canonical AAD layout or envelope version changes,
+ * the owner's client can no longer open this harness's sealed replies.
+ *
+ * Only the recipient/seal half lives here: the harness unwraps the stream key
+ * with its identity private key, opens history/prompt, and seals replies/steps
+ * under the stream key. It never wraps a key to another recipient, so the HPKE
+ * `seal`/`wrapStreamKey` direction is deliberately omitted.
+ */
+type CryptoKey = Awaited<ReturnType<typeof crypto.subtle.importKey>>;
+type CryptoKeyPair = {
+    publicKey: CryptoKey;
+    privateKey: CryptoKey;
+};
+export type { CryptoKey as WebCryptoKey };
+export declare function bytesToBase64(bytes: Uint8Array | ArrayBuffer): string;
+export declare function base64ToBytes(b64: string): Uint8Array<ArrayBuffer>;
+export declare function utf8Encode(text: string): Uint8Array<ArrayBuffer>;
+export declare function utf8Decode(bytes: Uint8Array): string;
+export declare function concatBytes(...parts: Uint8Array[]): Uint8Array<ArrayBuffer>;
+export declare function generateKeyPair(): Promise<CryptoKeyPair>;
+export declare function importRecipientPrivateKey(raw: Uint8Array | ArrayBuffer): Promise<CryptoKey>;
+export declare function exportPublicKey(key: CryptoKey): Promise<Uint8Array<ArrayBuffer>>;
+export declare function exportPrivateKey(key: CryptoKey): Promise<Uint8Array<ArrayBuffer>>;
+export declare function importRecipientPublicKey(raw: Uint8Array | ArrayBuffer): Promise<CryptoKey>;
+/** Stream-envelope version; a reader switches on `envelope.v`. */
+export declare const STREAM_ENVELOPE_VERSION = 2;
+export interface StreamEnvelope {
+    /** Always `STREAM_ENVELOPE_VERSION`; old clients reject an unknown version loudly. */
+    v: number;
+    /** Which generation of the stream's SSK sealed this message. */
+    keyGeneration: number;
+    /** Base64-encoded AES-GCM IV. */
+    iv: string;
+    /** Base64-encoded AAD (caller-supplied binding bytes — see `buildMessageAad`). */
+    aad: string;
+}
+export interface SealMessageInput {
+    /** 32-byte SSK for `keyGeneration`. */
+    key: Uint8Array;
+    keyGeneration: number;
+    payload: Uint8Array | string;
+    /** Bytes bound into AEAD as additional-authenticated-data — use `buildMessageAad`. Required. */
+    aad: Uint8Array;
+}
+export interface SealMessageResult {
+    envelope: StreamEnvelope;
+    /** AES-256-GCM ciphertext (tag included). */
+    ciphertext: Uint8Array<ArrayBuffer>;
+}
+/** AEAD-seal a message payload under the stream's SSK for `keyGeneration`. */
+export declare function sealMessage(input: SealMessageInput): Promise<SealMessageResult>;
+export interface OpenMessageInput {
+    /** 32-byte SSK for `envelope.keyGeneration`. */
+    key: Uint8Array;
+    envelope: StreamEnvelope;
+    /** AES-256-GCM ciphertext (tag included). */
+    ciphertext: Uint8Array;
+}
+/** Open an SSK-sealed message. Throws on version mismatch, wrong key, or forged AAD. */
+export declare function openMessage(input: OpenMessageInput): Promise<Uint8Array<ArrayBuffer>>;
+export declare function openMessageAsString(input: OpenMessageInput): Promise<string>;
+export interface UnwrapStreamKeyInput {
+    enc: Uint8Array;
+    ct: Uint8Array;
+    /** The recipient's HPKE private key (the harness's BIK private key). */
+    recipientPrivateKey: CryptoKey;
+    /** Must match the `aad` used at wrap time (see `buildWrapAad`). */
+    aad: Uint8Array;
+}
+export interface WrapStreamKeyInput {
+    /** The 32-byte SSK to wrap. */
+    key: Uint8Array;
+    /** The recipient's HPKE public key (imported via `importRecipientPublicKey`). */
+    recipientPublicKey: CryptoKey;
+    /** Slot binding — use `buildWrapAad`. Required. */
+    aad: Uint8Array;
+}
+/**
+ * HPKE-wrap an SSK to a recipient — used when a harness PROVISIONS a fresh
+ * stream key for its own E2E scratchpad (wrapping to the owner's UIK and its
+ * own BIK). Wire-identical to `@threahq/crypto`'s `wrapStreamKey`; the parity
+ * test asserts a vendored wrap opens with the vendored unwrap under the same
+ * AAD binding.
+ */
+export declare function wrapStreamKey(input: WrapStreamKeyInput): Promise<{
+    enc: Uint8Array;
+    ct: Uint8Array;
+}>;
+/** A fresh random 32-byte SSK (AES-256). */
+export declare function generateStreamKey(): Uint8Array<ArrayBuffer>;
+/** Recover the SSK from a wrap. Throws if the key doesn't match or AAD is forged. */
+export declare function unwrapStreamKey(input: UnwrapStreamKeyInput): Promise<Uint8Array<ArrayBuffer>>;
+/**
+ * Canonical AAD for an SSK wrap. Binds a wrap to its `(streamId, keyGeneration,
+ * recipientKeyId)` slot so a malicious server can't relocate a wrap row. Keep
+ * stable — changing the layout breaks unwrapping of every existing wrap.
+ */
+export declare function buildWrapAad(parts: {
+    streamId: string;
+    keyGeneration: number;
+    recipientKeyId: string;
+}): Uint8Array<ArrayBuffer>;
+/**
+ * Canonical AAD for an SSK-sealed message (and trace step — the `step_…` id
+ * rides the `messageId` slot). Binds the ciphertext to `streamId|messageId|senderId`
+ * so the server can't shuffle it onto another row. Keep stable.
+ */
+export declare function buildMessageAad(parts: {
+    streamId: string;
+    messageId: string;
+    senderId: string;
+}): Uint8Array<ArrayBuffer>;
+/**
+ * Canonical AAD for a sealed decision card and for the note a member attaches
+ * to their answer. Mirrors `buildDecisionAad` / `buildDecisionNoteAad` in
+ * `@threahq/crypto`; the label keeps the two apart, and both apart from a
+ * sealed message body. Keep stable.
+ */
+export declare function buildDecisionAad(parts: {
+    streamId: string;
+    decisionId: string;
+    requesterBotId: string;
+}): Uint8Array<ArrayBuffer>;
+export declare function buildDecisionNoteAad(parts: {
+    streamId: string;
+    decisionId: string;
+    decidedBy: string;
+}): Uint8Array<ArrayBuffer>;
+export declare const ATTACHMENT_AAD: Uint8Array<ArrayBuffer>;
+/** Single-key scheme: attachment keys are per-file, never rotated. */
+export declare const ATTACHMENT_KEY_GENERATION = 0;
+export interface EncryptedAttachment {
+    /** Ciphertext bytes to upload as the opaque file body (a valid `BlobPart`). */
+    ciphertext: Uint8Array<ArrayBuffer>;
+    /** Base64 key + iv to stash in the message's `attachmentRefs`. */
+    key: string;
+    iv: string;
+}
+/**
+ * Encrypt a file's bytes under a fresh single-use key for upload to an E2E
+ * stream. Returns the ciphertext plus the key/iv the message payload must carry
+ * so a recipient can decrypt it later. Reuses the message seal primitive
+ * (AES-256-GCM) rather than a parallel raw-bytes path (INV-35).
+ */
+export declare function encryptAttachmentBytes(plaintext: Uint8Array): Promise<EncryptedAttachment>;
+/**
+ * Decrypt the opaque S3 ciphertext of an E2E attachment back to its bytes, using
+ * the `key`/`iv` carried in the message's `attachmentRef`. Reconstructs the
+ * single-key envelope (gen 0, the domain-separation AAD) and opens it. Throws if
+ * the key/iv don't match or the bytes were tampered (AES-GCM tag check).
+ */
+export declare function decryptAttachmentBytes(input: {
+    ciphertext: Uint8Array;
+    key: string;
+    iv: string;
+}): Promise<Uint8Array<ArrayBuffer>>;
+export declare const E2E_PAYLOAD_VERSION = 1;
+/** One citation source sealed into a payload (structural twin of `@threahq/types`' `SourceItem`). */
+export interface SealedSourceItem {
+    type?: string;
+    title: string;
+    url: string;
+    snippet?: string;
+}
+/** A per-file attachment key sealed into a payload (structural twin of `@threahq/crypto`'s `AttachmentRef`). */
+export interface AttachmentRef {
+    attachmentId: string;
+    key: string;
+    iv: string;
+    filename: string;
+    mimeType: string;
+    sizeBytes: number;
+}
+export interface SealedPayloadExtras {
+    attachmentRefs?: AttachmentRef[];
+    sources?: SealedSourceItem[];
+    draftContentJson?: unknown;
+}
+/** Build the bytes to seal: bare markdown, or the versioned wrapper when an adjunct rides along. */
+export declare function serializeSealedPayload(contentMarkdown: string, extras?: SealedPayloadExtras): string;
+export interface ParsedSealedPayload {
+    contentMarkdown: string;
+    attachmentRefs: AttachmentRef[];
+    sources: SealedSourceItem[];
+    draftContentJson: unknown | null;
+}
+/**
+ * Inverse of `serializeSealedPayload`. A decrypted string is either the bare
+ * markdown body or the versioned wrapper; anything that doesn't parse as our
+ * wrapper is treated as raw markdown so older messages keep opening unchanged.
+ */
+export declare function parseSealedPayload(raw: string): ParsedSealedPayload;

package/index.d.ts

@@ -0,0 +1,14 @@
+export { BotRuntimeTransport } from "./transport.js";
+export type { InvocationCancellation, InvocationInputUpdate, ObserveClaimParams, ObservedClaimHandle, } from "./invocation-control.js";
+export { ARCHIVE_RESTORE_GRACE_MS, ARCHIVE_RESTORE_PROBE_MS, ArchiveGraceController, WS_BACKSTOP_POLL_MS, type ArchiveGraceHooks, type ArchiveGraceOptions, } from "./archive-grace.js";
+export { attachmentLocalPath, safeAttachmentFilename } from "./attachment-files.js";
+export { parseWsHint, buildBotSocketUrl, isObject, type WsHint } from "./ws-hint.js";
+export type { BotWriteAck, StepFrame, BotRuntimeHello, BotHelloBootstrap, BotE2eGrantPayload, BotE2eRevokePayload, BotRuntimeTransportCallbacks, BotRuntimeTransportOptions, DelegationAvailableNudge, BotDecisionPayload, CreateDecisionRequestBody, DecisionOption, DecisionRequest, DecisionRequestStatus, DecisionResolution, } from "./types.js";
+export { BotKeyring, mintE2eKeyRecord, THREA_CALLBACK_TOKEN_HEADER, mintStreamKeyWraps, openSealedAck, openSealedDecisionNote, openSealedTurnContext, parseSealedAckContext, parseSealedTurnContext, scrubSealedError, sealDecision, sealReply, sealStep, } from "./sealed.js";
+export type { BotIdentityKey, DecryptedHistoryItem, OpenedSealedTurn, ProvisionRecipient, ProvisionedWrap, SealedAckContext, SealedDecisionCard, SealedDecisionContent, SealedMessageWire, SealedReplyBody, SealedSskWrap, SealedStepFrame, SealedTurnContext, SealingState, } from "./sealed.js";
+export { base64ToBytes, buildDecisionAad, buildDecisionNoteAad, buildMessageAad, buildWrapAad, bytesToBase64, decryptAttachmentBytes, encryptAttachmentBytes, openMessageAsString, parseSealedPayload, sealMessage, serializeSealedPayload, type AttachmentRef, type EncryptedAttachment, type SealedPayloadExtras, type SealedSourceItem, type StreamEnvelope, } from "./crypto.js";
+export { SealedStreamClient, SealedStreamApiError, keyringKeySource } from "./sealed-stream-client.js";
+export type { OpenedSealedBody, SealedKeyIdentity, SealedKeySource, SealedMessageBody, SealedStreamClientOptions, SealedStreamMessage, SealedStreamPage, } from "./sealed-stream-client.js";
+export { E2E_KEY_SCOPES, E2E_KEY_STORE_KINDS, E2eKeyring, FileKeyStore, MacKeychainStore, SecretServiceStore, e2eKeyAccount, e2eStreamKeyAccount, e2eUserKeyAccount, readLegacyBikFile, resolveKeyStore, type CommandRunner, type E2eKeyRecord, type E2eKeyScope, type E2eKeyStore, type E2eKeyStoreKind, type E2eKeyringOptions, type HeldE2eKey, type ResolveKeyStoreInput, } from "./keyring.js";
+export { deriveKEK, unwrapPrivate, unlockUserKey, WrongPassphraseError, DEFAULT_KDF_PARAMS } from "./user-key.js";
+export type { KdfParams, UnlockUserKeyInput } from "./user-key.js";