instar 0.26.11 → 0.27.2

package/dist/threadline/TrustEvaluator.js

@@ -0,0 +1,93 @@
+/**
+ * TrustEvaluator — Computes trust level from local history + optional network signals.
+ *
+ * Spec Section 3.2 Layer 2:
+ * - Local trust: direct interaction history, circuit breaker state, user-granted upgrades
+ * - Network trust: MoltBridge IQS score (advisory only)
+ * - Local trust ALWAYS takes precedence over network signals
+ *
+ * Trust levels: untrusted → verified → trusted (no auto-escalation)
+ * Decay: trusted → verified at 90d inactivity, verified → untrusted at 180d
+ */
+import { TRUST_DECAY } from '../identity/types.js';
+// ── Evaluator ────────────────────────────────────────────────────────
+/**
+ * Evaluate the effective trust level for an agent.
+ *
+ * Pure function — no side effects, no state mutation.
+ * Deterministic given the same signals.
+ */
+export function evaluateTrust(signals, now) {
+    const currentTime = (now ?? new Date()).getTime();
+    let level = signals.localLevel;
+    let reason = `Local trust: ${level} (source: ${signals.source})`;
+    let downgraded = false;
+    // Circuit breaker auto-downgrade: 3 activations in 24h → untrusted
+    if (signals.circuitBreakerActivations >= 3) {
+        level = 'untrusted';
+        reason = `Auto-downgraded: ${signals.circuitBreakerActivations} circuit breaker activations in 24h`;
+        downgraded = true;
+    }
+    // Trust decay (only if not already downgraded by circuit breaker)
+    if (!downgraded && signals.lastInteraction) {
+        const lastTime = new Date(signals.lastInteraction).getTime();
+        const daysSinceInteraction = (currentTime - lastTime) / (24 * 60 * 60 * 1000);
+        if (level === 'trusted' && daysSinceInteraction > TRUST_DECAY.trustedToVerifiedDays) {
+            level = 'verified';
+            reason = `Trust decayed: no interaction for ${Math.floor(daysSinceInteraction)} days (threshold: ${TRUST_DECAY.trustedToVerifiedDays}d)`;
+            downgraded = true;
+        }
+        const totalDecayDays = TRUST_DECAY.trustedToVerifiedDays + TRUST_DECAY.verifiedToUntrustedDays;
+        if ((level === 'verified' || signals.localLevel === 'trusted') && daysSinceInteraction > totalDecayDays) {
+            level = 'untrusted';
+            reason = `Trust decayed: no interaction for ${Math.floor(daysSinceInteraction)} days (threshold: ${totalDecayDays}d)`;
+            downgraded = true;
+        }
+    }
+    // Network advisory (MoltBridge IQS) — advisory only, never overrides local
+    let networkAdvisory;
+    if (signals.networkIQS) {
+        if (signals.networkIQS === 'low' && level !== 'untrusted') {
+            networkAdvisory = `Warning: Network trust score is LOW for this agent. Local trust is ${level}.`;
+        }
+        else if (signals.networkIQS === 'high' && level === 'untrusted') {
+            networkAdvisory = `Note: Network trust score is HIGH but local trust is untrusted. Consider verifying.`;
+        }
+    }
+    return { level, reason, networkAdvisory, downgraded };
+}
+/**
+ * Check if a trust upgrade is allowed.
+ *
+ * Only user-granted and paired-machine-granted sources can upgrade trust.
+ * No auto-escalation ever.
+ */
+export function canUpgradeTrust(currentLevel, targetLevel, source) {
+    const order = ['untrusted', 'verified', 'trusted'];
+    const currentIdx = order.indexOf(currentLevel);
+    const targetIdx = order.indexOf(targetLevel);
+    if (targetIdx <= currentIdx) {
+        return { allowed: false, reason: 'Target level is not higher than current level' };
+    }
+    const allowedSources = ['user-granted', 'paired-machine-granted', 'invitation', 'os-verified'];
+    if (!allowedSources.includes(source)) {
+        return { allowed: false, reason: `Source "${source}" cannot upgrade trust. Requires user or verified source.` };
+    }
+    return { allowed: true, reason: `Upgrade from ${currentLevel} to ${targetLevel} via ${source}` };
+}
+/**
+ * Determine same-machine trust eligibility.
+ * Returns 'verified' if trust-domain criteria are met, null otherwise.
+ *
+ * Spec Section 3.5: Same OS user + same host + local IPC = auto-verified.
+ */
+export function evaluateSameMachineTrust(localUid, remoteUid, isLocalTransport) {
+    if (!isLocalTransport) {
+        return { eligible: false, reason: 'Not a local transport (Unix domain socket or loopback required)' };
+    }
+    if (localUid !== remoteUid) {
+        return { eligible: false, reason: `Different OS user: local=${localUid}, remote=${remoteUid}` };
+    }
+    return { eligible: true, reason: 'Same OS user, local transport — auto-verified eligible' };
+}
+//# sourceMappingURL=TrustEvaluator.js.map

package/dist/threadline/TrustEvaluator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"TrustEvaluator.js","sourceRoot":"","sources":["../../src/threadline/TrustEvaluator.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AAuCnD,wEAAwE;AAExE;;;;;GAKG;AACH,MAAM,UAAU,aAAa,CAAC,OAAqB,EAAE,GAAU;IAC7D,MAAM,WAAW,GAAG,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC;IAClD,IAAI,KAAK,GAAG,OAAO,CAAC,UAAU,CAAC;IAC/B,IAAI,MAAM,GAAG,gBAAgB,KAAK,aAAa,OAAO,CAAC,MAAM,GAAG,CAAC;IACjE,IAAI,UAAU,GAAG,KAAK,CAAC;IAEvB,mEAAmE;IACnE,IAAI,OAAO,CAAC,yBAAyB,IAAI,CAAC,EAAE,CAAC;QAC3C,KAAK,GAAG,WAAW,CAAC;QACpB,MAAM,GAAG,oBAAoB,OAAO,CAAC,yBAAyB,qCAAqC,CAAC;QACpG,UAAU,GAAG,IAAI,CAAC;IACpB,CAAC;IAED,kEAAkE;IAClE,IAAI,CAAC,UAAU,IAAI,OAAO,CAAC,eAAe,EAAE,CAAC;QAC3C,MAAM,QAAQ,GAAG,IAAI,IAAI,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC,OAAO,EAAE,CAAC;QAC7D,MAAM,oBAAoB,GAAG,CAAC,WAAW,GAAG,QAAQ,CAAC,GAAG,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;QAE9E,IAAI,KAAK,KAAK,SAAS,IAAI,oBAAoB,GAAG,WAAW,CAAC,qBAAqB,EAAE,CAAC;YACpF,KAAK,GAAG,UAAU,CAAC;YACnB,MAAM,GAAG,qCAAqC,IAAI,CAAC,KAAK,CAAC,oBAAoB,CAAC,qBAAqB,WAAW,CAAC,qBAAqB,IAAI,CAAC;YACzI,UAAU,GAAG,IAAI,CAAC;QACpB,CAAC;QAED,MAAM,cAAc,GAAG,WAAW,CAAC,qBAAqB,GAAG,WAAW,CAAC,uBAAuB,CAAC;QAC/F,IAAI,CAAC,KAAK,KAAK,UAAU,IAAI,OAAO,CAAC,UAAU,KAAK,SAAS,CAAC,IAAI,oBAAoB,GAAG,cAAc,EAAE,CAAC;YACxG,KAAK,GAAG,WAAW,CAAC;YACpB,MAAM,GAAG,qCAAqC,IAAI,CAAC,KAAK,CAAC,oBAAoB,CAAC,qBAAqB,cAAc,IAAI,CAAC;YACtH,UAAU,GAAG,IAAI,CAAC;QACpB,CAAC;IACH,CAAC;IAED,2EAA2E;IAC3E,IAAI,eAAmC,CAAC;IACxC,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC;QACvB,IAAI,OAAO,CAAC,UAAU,KAAK,KAAK,IAAI,KAAK,KAAK,WAAW,EAAE,CAAC;YAC1D,eAAe,GAAG,sEAAsE,KAAK,GAAG,CAAC;QACnG,CAAC;aAAM,IAAI,OAAO,CAAC,UAAU,KAAK,MAAM,IAAI,KAAK,KAAK,WAAW,EAAE,CAAC;YAClE,eAAe,GAAG,qFAAqF,CAAC;QAC1G,CAAC;IACH,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,UAAU,EAAE,CAAC;AACxD,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,eAAe,CAC7B,YAAwB,EACxB,WAAuB,EACvB,MAAmB;IAEnB,MAAM,KAAK,GAAiB,CAAC,WAAW,EAAE,UAAU,EAAE,SAAS,CAAC,CAAC;IACjE,MAAM,UAAU,GAAG,KAAK,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;IAC/C,MAAM,SAAS,GAAG,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;IAE7C,IAAI,SAAS,IAAI,UAAU,EAAE,CAAC;QAC5B,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,+CAA+C,EAAE,CAAC;IACrF,CAAC;IAED,MAAM,cAAc,GAAkB,CAAC,cAAc,EAAE,wBAAwB,EAAE,YAAY,EAAE,aAAa,CAAC,CAAC;IAC9G,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QACrC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,MAAM,2DAA2D,EAAE,CAAC;IAClH,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,gBAAgB,YAAY,OAAO,WAAW,QAAQ,MAAM,EAAE,EAAE,CAAC;AACnG,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,wBAAwB,CACtC,QAAgB,EAChB,SAAiB,EACjB,gBAAyB;IAEzB,IAAI,CAAC,gBAAgB,EAAE,CAAC;QACtB,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,iEAAiE,EAAE,CAAC;IACxG,CAAC;IACD,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,4BAA4B,QAAQ,YAAY,SAAS,EAAE,EAAE,CAAC;IAClG,CAAC;IACD,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,wDAAwD,EAAE,CAAC;AAC9F,CAAC"}

package/dist/threadline/UnifiedTrustWiring.d.ts

@@ -0,0 +1,66 @@
+/**
+ * UnifiedTrustWiring — Connects the three-layer trust model into the existing Threadline infrastructure.
+ *
+ * This module is the integration glue between:
+ * - Build 1: Canonical identity (src/identity/)
+ * - Build 2: AuthorizationPolicy, TrustEvaluator, SecureInvitation, MoltBridgeClient,
+ *            DiscoveryWaterfall, MessageSecurity, TrustAuditLog, SybilProtection
+ * - Existing: AgentTrustManager, InboundMessageGate, ThreadlineBootstrap
+ *
+ * Rather than modifying existing classes (risky for regressions), this creates
+ * a unified facade that composes all components.
+ */
+import type { AgentTrustManager } from './AgentTrustManager.js';
+import { AuthorizationPolicyManager, type PolicyEvaluation, type ResourceType, type ActionType } from './AuthorizationPolicy.js';
+import { type TrustLevel } from './TrustEvaluator.js';
+import { TrustAuditLog, type AuditAction } from './TrustAuditLog.js';
+import { SecureInvitationManager } from './SecureInvitation.js';
+import { DiscoveryWaterfall, type DiscoveryResult, type DiscoveryOptions } from './DiscoveryWaterfall.js';
+import { MoltBridgeClient, type MoltBridgeConfig } from '../moltbridge/MoltBridgeClient.js';
+import { CanonicalIdentityManager } from '../identity/IdentityManager.js';
+export interface UnifiedTrustConfig {
+    stateDir: string;
+    moltbridge?: MoltBridgeConfig;
+    /** Passphrase for canonical identity encryption. Omit for dev/unencrypted. */
+    identityPassphrase?: string;
+}
+export interface UnifiedTrustSystem {
+    /** The existing trust manager (backward-compatible) */
+    trustManager: AgentTrustManager;
+    /** New authorization policy manager */
+    authPolicy: AuthorizationPolicyManager;
+    /** Hash-chain audit log */
+    auditLog: TrustAuditLog;
+    /** Ed25519-signed invitation manager */
+    invitations: SecureInvitationManager;
+    /** Three-tier discovery */
+    discovery: DiscoveryWaterfall;
+    /** MoltBridge client (null if disabled) */
+    moltbridge: MoltBridgeClient | null;
+    /** Canonical identity manager */
+    identity: CanonicalIdentityManager;
+    /** Evaluate combined trust + authorization for a permission check */
+    checkPermission: (fingerprint: string, resource: ResourceType, resourceId: string | undefined, action: ActionType) => UnifiedPermissionResult;
+    /** Frame an incoming agent message for prompt injection defense */
+    frameMessage: (content: string, senderFingerprint: string) => string;
+    /** Run discovery waterfall */
+    discover: (options: DiscoveryOptions) => Promise<DiscoveryResult>;
+    /** Audit a trust/authorization event */
+    audit: (action: AuditAction, subject: string, actor: string, details?: Record<string, unknown>) => void;
+    /** Clean shutdown */
+    shutdown: () => void;
+}
+export interface UnifiedPermissionResult {
+    allowed: boolean;
+    trustLevel: TrustLevel;
+    authorizationResult: PolicyEvaluation;
+    reason: string;
+}
+/**
+ * Create the unified trust system.
+ *
+ * Call this during server initialization, after bootstrapThreadline().
+ * It wraps the existing AgentTrustManager with the three-layer model.
+ */
+export declare function createUnifiedTrustSystem(existingTrustManager: AgentTrustManager, config: UnifiedTrustConfig): UnifiedTrustSystem;
+//# sourceMappingURL=UnifiedTrustWiring.d.ts.map

package/dist/threadline/UnifiedTrustWiring.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"UnifiedTrustWiring.d.ts","sourceRoot":"","sources":["../../src/threadline/UnifiedTrustWiring.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,KAAK,EAAE,iBAAiB,EAAmB,MAAM,wBAAwB,CAAC;AACjF,OAAO,EAAE,0BAA0B,EAAE,KAAK,gBAAgB,EAAE,KAAK,YAAY,EAAE,KAAK,UAAU,EAAE,MAAM,0BAA0B,CAAC;AACjI,OAAO,EAAkC,KAAK,UAAU,EAAmC,MAAM,qBAAqB,CAAC;AACvH,OAAO,EAAE,aAAa,EAAE,KAAK,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAErE,OAAO,EAAE,uBAAuB,EAAwB,MAAM,uBAAuB,CAAC;AACtF,OAAO,EAAE,kBAAkB,EAAyB,KAAK,eAAe,EAAE,KAAK,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AACjI,OAAO,EAAE,gBAAgB,EAAE,KAAK,gBAAgB,EAAE,MAAM,mCAAmC,CAAC;AAC5F,OAAO,EAAE,wBAAwB,EAAE,MAAM,gCAAgC,CAAC;AAS1E,MAAM,WAAW,kBAAkB;IACjC,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,gBAAgB,CAAC;IAC9B,8EAA8E;IAC9E,kBAAkB,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED,MAAM,WAAW,kBAAkB;IACjC,uDAAuD;IACvD,YAAY,EAAE,iBAAiB,CAAC;IAChC,uCAAuC;IACvC,UAAU,EAAE,0BAA0B,CAAC;IACvC,2BAA2B;IAC3B,QAAQ,EAAE,aAAa,CAAC;IACxB,wCAAwC;IACxC,WAAW,EAAE,uBAAuB,CAAC;IACrC,2BAA2B;IAC3B,SAAS,EAAE,kBAAkB,CAAC;IAC9B,2CAA2C;IAC3C,UAAU,EAAE,gBAAgB,GAAG,IAAI,CAAC;IACpC,iCAAiC;IACjC,QAAQ,EAAE,wBAAwB,CAAC;IACnC,qEAAqE;IACrE,eAAe,EAAE,CAAC,WAAW,EAAE,MAAM,EAAE,QAAQ,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,GAAG,SAAS,EAAE,MAAM,EAAE,UAAU,KAAK,uBAAuB,CAAC;IAC9I,mEAAmE;IACnE,YAAY,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,iBAAiB,EAAE,MAAM,KAAK,MAAM,CAAC;IACrE,8BAA8B;IAC9B,QAAQ,EAAE,CAAC,OAAO,EAAE,gBAAgB,KAAK,OAAO,CAAC,eAAe,CAAC,CAAC;IAClE,wCAAwC;IACxC,KAAK,EAAE,CAAC,MAAM,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,CAAC;IACxG,qBAAqB;IACrB,QAAQ,EAAE,MAAM,IAAI,CAAC;CACtB;AAED,MAAM,WAAW,uBAAuB;IACtC,OAAO,EAAE,OAAO,CAAC;IACjB,UAAU,EAAE,UAAU,CAAC;IACvB,mBAAmB,EAAE,gBAAgB,CAAC;IACtC,MAAM,EAAE,MAAM,CAAC;CAChB;AAID;;;;;GAKG;AACH,wBAAgB,wBAAwB,CACtC,oBAAoB,EAAE,iBAAiB,EACvC,MAAM,EAAE,kBAAkB,GACzB,kBAAkB,CAiLpB"}

package/dist/threadline/UnifiedTrustWiring.js

@@ -0,0 +1,192 @@
+/**
+ * UnifiedTrustWiring — Connects the three-layer trust model into the existing Threadline infrastructure.
+ *
+ * This module is the integration glue between:
+ * - Build 1: Canonical identity (src/identity/)
+ * - Build 2: AuthorizationPolicy, TrustEvaluator, SecureInvitation, MoltBridgeClient,
+ *            DiscoveryWaterfall, MessageSecurity, TrustAuditLog, SybilProtection
+ * - Existing: AgentTrustManager, InboundMessageGate, ThreadlineBootstrap
+ *
+ * Rather than modifying existing classes (risky for regressions), this creates
+ * a unified facade that composes all components.
+ */
+import { AuthorizationPolicyManager } from './AuthorizationPolicy.js';
+import { TrustAuditLog } from './TrustAuditLog.js';
+import { frameIncomingMessage, detectPotentialInjection } from './MessageSecurity.js';
+import { SecureInvitationManager } from './SecureInvitation.js';
+import { DiscoveryWaterfall } from './DiscoveryWaterfall.js';
+import { MoltBridgeClient } from '../moltbridge/MoltBridgeClient.js';
+import { CanonicalIdentityManager } from '../identity/IdentityManager.js';
+import { hasLegacyIdentity, hasCanonicalIdentity, migrateFromLegacy, } from '../identity/Migration.js';
+// ── Factory ──────────────────────────────────────────────────────────
+/**
+ * Create the unified trust system.
+ *
+ * Call this during server initialization, after bootstrapThreadline().
+ * It wraps the existing AgentTrustManager with the three-layer model.
+ */
+export function createUnifiedTrustSystem(existingTrustManager, config) {
+    const { stateDir } = config;
+    // Initialize canonical identity (migrate from legacy if needed)
+    const identity = new CanonicalIdentityManager(stateDir);
+    if (!identity.exists()) {
+        if (hasLegacyIdentity(stateDir) && !hasCanonicalIdentity(stateDir)) {
+            const result = migrateFromLegacy(stateDir, {
+                passphrase: config.identityPassphrase,
+                skipRecovery: !config.identityPassphrase, // skip recovery in dev mode
+            });
+            // Note: result.recoveryPhrase should be surfaced to the user
+            // via the dashboard or attention queue. Not done here.
+            identity.load({ passphrase: config.identityPassphrase });
+        }
+        else {
+            identity.create({
+                passphrase: config.identityPassphrase,
+                skipRecovery: !config.identityPassphrase,
+            });
+        }
+    }
+    else {
+        identity.load({ passphrase: config.identityPassphrase });
+    }
+    // Create new components
+    const authPolicy = new AuthorizationPolicyManager(stateDir);
+    const auditLog = new TrustAuditLog(stateDir);
+    const invitations = new SecureInvitationManager(stateDir);
+    const discoveryWaterfall = new DiscoveryWaterfall();
+    // MoltBridge (optional)
+    let moltbridge = null;
+    if (config.moltbridge?.enabled) {
+        moltbridge = new MoltBridgeClient(config.moltbridge);
+        // Initialize SDK with identity keys for Ed25519 auth signing
+        const id = identity.get();
+        if (id) {
+            moltbridge.initializeWithIdentity(id);
+            // Register MoltBridge as discovery stage 3
+            const moltbridgeAdapter = {
+                source: 'moltbridge',
+                isAvailable: () => moltbridge !== null && moltbridge.initialized && !moltbridge.isCircuitBreakerOpen,
+                search: async (query, limit) => {
+                    const result = await moltbridge.discover(query, limit);
+                    return result.agents.map(a => ({
+                        fingerprint: a.agentId,
+                        displayName: a.agentName,
+                        capabilities: a.capabilities,
+                        source: 'moltbridge',
+                        sourcePrecedence: 1,
+                        iqsBand: undefined,
+                        profileCard: {
+                            narrativeSummary: a.agentName ? `${a.agentName} on MoltBridge` : undefined,
+                            profileCompletenessScore: undefined,
+                            profileUrl: `/agent/profile/${a.agentId}`,
+                        },
+                    }));
+                },
+            };
+            discoveryWaterfall.registerAdapter(moltbridgeAdapter);
+        }
+    }
+    // Wire trust change callback to audit log
+    // The existing trustManager's onTrustChange fires on every trust change.
+    // We intercept it to also write to the hash-chain audit log.
+    /**
+     * Combined permission check: trust baseline ∩ authorization grants.
+     *
+     * 1. Get trust level from existing AgentTrustManager
+     * 2. Check if trust level allows the operation baseline
+     * 3. Check authorization grants for explicit allow/deny
+     * 4. Combined result: both must allow
+     */
+    function checkPermission(fingerprint, resource, resourceId, action) {
+        // Trust baseline from existing manager
+        const trustLevel = existingTrustManager.getTrustLevelByFingerprint(fingerprint);
+        // checkPermission needs the agent name or fingerprint key — find the profile
+        const profile = existingTrustManager.getProfileByFingerprint(fingerprint);
+        const agentKey = profile?.agent ?? fingerprint;
+        const trustBaseline = existingTrustManager.checkPermission(agentKey, mapActionToOperation(action));
+        // Authorization policy check
+        const authResult = authPolicy.evaluate(fingerprint, resource, resourceId, action);
+        // Combined: trust baseline must allow AND (authorization must allow OR no grants exist)
+        // If no authorization grants exist, fall back to trust-only (backward compat)
+        const grantsExist = authPolicy.getGrantsForSubject(fingerprint).length > 0;
+        let allowed;
+        let reason;
+        if (!trustBaseline) {
+            allowed = false;
+            reason = `Trust baseline denied: trust level "${trustLevel}" does not permit "${action}"`;
+        }
+        else if (grantsExist && !authResult.allowed) {
+            allowed = false;
+            reason = `Authorization denied: ${authResult.reason}`;
+        }
+        else {
+            allowed = true;
+            reason = grantsExist
+                ? `Allowed: trust baseline (${trustLevel}) + authorization grant`
+                : `Allowed: trust baseline (${trustLevel}), no specific grants`;
+        }
+        return { allowed, trustLevel, authorizationResult: authResult, reason };
+    }
+    /**
+     * Frame an incoming message with security markers.
+     */
+    function frameMessage(content, senderFingerprint) {
+        const trustLevel = existingTrustManager.getTrustLevelByFingerprint(senderFingerprint);
+        // Detect potential injection (advisory logging)
+        const injectionCheck = detectPotentialInjection(content);
+        if (injectionCheck.suspicious) {
+            auditLog.append('injection-detected', senderFingerprint, 'system', {
+                patterns: injectionCheck.patterns,
+            });
+        }
+        return frameIncomingMessage(content, senderFingerprint, trustLevel);
+    }
+    /**
+     * Run discovery with registered adapters.
+     */
+    async function discover(options) {
+        return discoveryWaterfall.discover(options);
+    }
+    /**
+     * Write to the audit log.
+     */
+    function audit(action, subject, actor, details) {
+        auditLog.append(action, subject, actor, details);
+    }
+    /**
+     * Clean shutdown — flush all state to disk.
+     */
+    function shutdown() {
+        authPolicy.flush();
+        authPolicy.pruneExpired();
+    }
+    return {
+        trustManager: existingTrustManager,
+        authPolicy,
+        auditLog,
+        invitations,
+        discovery: discoveryWaterfall,
+        moltbridge,
+        identity,
+        checkPermission,
+        frameMessage,
+        discover,
+        audit,
+        shutdown,
+    };
+}
+// ── Helpers ──────────────────────────────────────────────────────────
+/** Map ActionType to legacy operation string for backward compat */
+function mapActionToOperation(action) {
+    const mapping = {
+        message: 'message',
+        request_task: 'task-request',
+        delegate: 'delegate',
+        read: 'data-share',
+        write: 'data-share',
+        execute: 'spawn',
+        probe: 'ping',
+    };
+    return mapping[action] ?? action;
+}
+//# sourceMappingURL=UnifiedTrustWiring.js.map

package/dist/threadline/UnifiedTrustWiring.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"UnifiedTrustWiring.js","sourceRoot":"","sources":["../../src/threadline/UnifiedTrustWiring.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAGH,OAAO,EAAE,0BAA0B,EAA6D,MAAM,0BAA0B,CAAC;AAEjI,OAAO,EAAE,aAAa,EAAoB,MAAM,oBAAoB,CAAC;AACrE,OAAO,EAAE,oBAAoB,EAAiC,wBAAwB,EAAE,MAAM,sBAAsB,CAAC;AACrH,OAAO,EAAE,uBAAuB,EAAwB,MAAM,uBAAuB,CAAC;AACtF,OAAO,EAAE,kBAAkB,EAAsE,MAAM,yBAAyB,CAAC;AACjI,OAAO,EAAE,gBAAgB,EAAyB,MAAM,mCAAmC,CAAC;AAC5F,OAAO,EAAE,wBAAwB,EAAE,MAAM,gCAAgC,CAAC;AAC1E,OAAO,EACL,iBAAiB,EACjB,oBAAoB,EACpB,iBAAiB,GAClB,MAAM,0BAA0B,CAAC;AA6ClC,wEAAwE;AAExE;;;;;GAKG;AACH,MAAM,UAAU,wBAAwB,CACtC,oBAAuC,EACvC,MAA0B;IAE1B,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,CAAC;IAE5B,gEAAgE;IAChE,MAAM,QAAQ,GAAG,IAAI,wBAAwB,CAAC,QAAQ,CAAC,CAAC;IACxD,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC;QACvB,IAAI,iBAAiB,CAAC,QAAQ,CAAC,IAAI,CAAC,oBAAoB,CAAC,QAAQ,CAAC,EAAE,CAAC;YACnE,MAAM,MAAM,GAAG,iBAAiB,CAAC,QAAQ,EAAE;gBACzC,UAAU,EAAE,MAAM,CAAC,kBAAkB;gBACrC,YAAY,EAAE,CAAC,MAAM,CAAC,kBAAkB,EAAE,4BAA4B;aACvE,CAAC,CAAC;YACH,6DAA6D;YAC7D,uDAAuD;YACvD,QAAQ,CAAC,IAAI,CAAC,EAAE,UAAU,EAAE,MAAM,CAAC,kBAAkB,EAAE,CAAC,CAAC;QAC3D,CAAC;aAAM,CAAC;YACN,QAAQ,CAAC,MAAM,CAAC;gBACd,UAAU,EAAE,MAAM,CAAC,kBAAkB;gBACrC,YAAY,EAAE,CAAC,MAAM,CAAC,kBAAkB;aACzC,CAAC,CAAC;QACL,CAAC;IACH,CAAC;SAAM,CAAC;QACN,QAAQ,CAAC,IAAI,CAAC,EAAE,UAAU,EAAE,MAAM,CAAC,kBAAkB,EAAE,CAAC,CAAC;IAC3D,CAAC;IAED,wBAAwB;IACxB,MAAM,UAAU,GAAG,IAAI,0BAA0B,CAAC,QAAQ,CAAC,CAAC;IAC5D,MAAM,QAAQ,GAAG,IAAI,aAAa,CAAC,QAAQ,CAAC,CAAC;IAC7C,MAAM,WAAW,GAAG,IAAI,uBAAuB,CAAC,QAAQ,CAAC,CAAC;IAC1D,MAAM,kBAAkB,GAAG,IAAI,kBAAkB,EAAE,CAAC;IAEpD,wBAAwB;IACxB,IAAI,UAAU,GAA4B,IAAI,CAAC;IAC/C,IAAI,MAAM,CAAC,UAAU,EAAE,OAAO,EAAE,CAAC;QAC/B,UAAU,GAAG,IAAI,gBAAgB,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;QAErD,6DAA6D;QAC7D,MAAM,EAAE,GAAG,QAAQ,CAAC,GAAG,EAAE,CAAC;QAC1B,IAAI,EAAE,EAAE,CAAC;YACP,UAAU,CAAC,sBAAsB,CAAC,EAAE,CAAC,CAAC;YAEtC,2CAA2C;YAC3C,MAAM,iBAAiB,GAAqB;gBAC1C,MAAM,EAAE,YAAY;gBACpB,WAAW,EAAE,GAAG,EAAE,CAAC,UAAU,KAAK,IAAI,IAAI,UAAU,CAAC,WAAW,IAAI,CAAC,UAAU,CAAC,oBAAoB;gBACpG,MAAM,EAAE,KAAK,EAAE,KAAa,EAAE,KAAa,EAAE,EAAE;oBAC7C,MAAM,MAAM,GAAG,MAAM,UAAW,CAAC,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;oBACxD,OAAO,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;wBAC7B,WAAW,EAAE,CAAC,CAAC,OAAO;wBACtB,WAAW,EAAE,CAAC,CAAC,SAAS;wBACxB,YAAY,EAAE,CAAC,CAAC,YAAY;wBAC5B,MAAM,EAAE,YAAqB;wBAC7B,gBAAgB,EAAE,CAAC;wBACnB,OAAO,EAAE,SAAS;wBAClB,WAAW,EAAE;4BACX,gBAAgB,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,SAAS,gBAAgB,CAAC,CAAC,CAAC,SAAS;4BAC1E,wBAAwB,EAAE,SAAS;4BACnC,UAAU,EAAE,kBAAkB,CAAC,CAAC,OAAO,EAAE;yBAC1C;qBACF,CAAC,CAAC,CAAC;gBACN,CAAC;aACF,CAAC;YACF,kBAAkB,CAAC,eAAe,CAAC,iBAAiB,CAAC,CAAC;QACxD,CAAC;IACH,CAAC;IAED,0CAA0C;IAC1C,yEAAyE;IACzE,6DAA6D;IAE7D;;;;;;;OAOG;IACH,SAAS,eAAe,CACtB,WAAmB,EACnB,QAAsB,EACtB,UAA8B,EAC9B,MAAkB;QAElB,uCAAuC;QACvC,MAAM,UAAU,GAAG,oBAAoB,CAAC,0BAA0B,CAAC,WAAW,CAAe,CAAC;QAC9F,6EAA6E;QAC7E,MAAM,OAAO,GAAG,oBAAoB,CAAC,uBAAuB,CAAC,WAAW,CAAC,CAAC;QAC1E,MAAM,QAAQ,GAAG,OAAO,EAAE,KAAK,IAAI,WAAW,CAAC;QAC/C,MAAM,aAAa,GAAG,oBAAoB,CAAC,eAAe,CACxD,QAAQ,EACR,oBAAoB,CAAC,MAAM,CAAC,CAC7B,CAAC;QAEF,6BAA6B;QAC7B,MAAM,UAAU,GAAG,UAAU,CAAC,QAAQ,CAAC,WAAW,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,CAAC,CAAC;QAElF,wFAAwF;QACxF,8EAA8E;QAC9E,MAAM,WAAW,GAAG,UAAU,CAAC,mBAAmB,CAAC,WAAW,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;QAE3E,IAAI,OAAgB,CAAC;QACrB,IAAI,MAAc,CAAC;QAEnB,IAAI,CAAC,aAAa,EAAE,CAAC;YACnB,OAAO,GAAG,KAAK,CAAC;YAChB,MAAM,GAAG,uCAAuC,UAAU,sBAAsB,MAAM,GAAG,CAAC;QAC5F,CAAC;aAAM,IAAI,WAAW,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC;YAC9C,OAAO,GAAG,KAAK,CAAC;YAChB,MAAM,GAAG,yBAAyB,UAAU,CAAC,MAAM,EAAE,CAAC;QACxD,CAAC;aAAM,CAAC;YACN,OAAO,GAAG,IAAI,CAAC;YACf,MAAM,GAAG,WAAW;gBAClB,CAAC,CAAC,4BAA4B,UAAU,yBAAyB;gBACjE,CAAC,CAAC,4BAA4B,UAAU,uBAAuB,CAAC;QACpE,CAAC;QAED,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,mBAAmB,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC;IAC1E,CAAC;IAED;;OAEG;IACH,SAAS,YAAY,CAAC,OAAe,EAAE,iBAAyB;QAC9D,MAAM,UAAU,GAAG,oBAAoB,CAAC,0BAA0B,CAAC,iBAAiB,CAAC,CAAC;QAEtF,gDAAgD;QAChD,MAAM,cAAc,GAAG,wBAAwB,CAAC,OAAO,CAAC,CAAC;QACzD,IAAI,cAAc,CAAC,UAAU,EAAE,CAAC;YAC9B,QAAQ,CAAC,MAAM,CAAC,oBAAoB,EAAE,iBAAiB,EAAE,QAAQ,EAAE;gBACjE,QAAQ,EAAE,cAAc,CAAC,QAAQ;aAClC,CAAC,CAAC;QACL,CAAC;QAED,OAAO,oBAAoB,CAAC,OAAO,EAAE,iBAAiB,EAAE,UAAU,CAAC,CAAC;IACtE,CAAC;IAED;;OAEG;IACH,KAAK,UAAU,QAAQ,CAAC,OAAyB;QAC/C,OAAO,kBAAkB,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IAC9C,CAAC;IAED;;OAEG;IACH,SAAS,KAAK,CACZ,MAAmB,EACnB,OAAe,EACf,KAAa,EACb,OAAiC;QAEjC,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;IACnD,CAAC;IAED;;OAEG;IACH,SAAS,QAAQ;QACf,UAAU,CAAC,KAAK,EAAE,CAAC;QACnB,UAAU,CAAC,YAAY,EAAE,CAAC;IAC5B,CAAC;IAED,OAAO;QACL,YAAY,EAAE,oBAAoB;QAClC,UAAU;QACV,QAAQ;QACR,WAAW;QACX,SAAS,EAAE,kBAAkB;QAC7B,UAAU;QACV,QAAQ;QACR,eAAe;QACf,YAAY;QACZ,QAAQ;QACR,KAAK;QACL,QAAQ;KACT,CAAC;AACJ,CAAC;AAED,wEAAwE;AAExE,oEAAoE;AACpE,SAAS,oBAAoB,CAAC,MAAkB;IAC9C,MAAM,OAAO,GAA+B;QAC1C,OAAO,EAAE,SAAS;QAClB,YAAY,EAAE,cAAc;QAC5B,QAAQ,EAAE,UAAU;QACpB,IAAI,EAAE,YAAY;QAClB,KAAK,EAAE,YAAY;QACnB,OAAO,EAAE,OAAO;QAChB,KAAK,EAAE,MAAM;KACd,CAAC;IACF,OAAO,OAAO,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC;AACnC,CAAC"}

package/dist/threadline/client/IdentityManager.d.ts

@@ -1,8 +1,14 @@
 /**
  * IdentityManager — Manages Ed25519 identity keys for relay agents.
  *
- * Generates, stores, and loads identity keypairs from disk.
- * Part of Threadline Relay Phase 1.
+ * Delegates to the canonical identity ({stateDir}/identity.json) when available,
+ * falling back to the legacy Threadline identity ({stateDir}/threadline/identity.json).
+ *
+ * This ensures backward compatibility: existing agents keep working with their
+ * legacy identity, while new/migrated agents use the canonical location.
+ *
+ * The IdentityInfo interface is unchanged — consumers don't need to know
+ * which storage backend is in use.
  */
 import type { AgentFingerprint } from '../relay/types.js';
 export interface IdentityInfo {
@@ -14,12 +20,18 @@ export interface IdentityInfo {
 }
 export declare class IdentityManager {
     private readonly stateDir;
-    private readonly keyFile;
+    private readonly legacyKeyFile;
+    private readonly canonicalKeyFile;
     private identity;
     constructor(stateDir: string);
     /**
      * Get or create the agent's identity.
-     * Generates a new keypair on first use, loads from disk on subsequent uses.
+     *
+     * Priority:
+     * 1. Cached in-memory identity
+     * 2. Canonical identity ({stateDir}/identity.json)
+     * 3. Legacy identity ({stateDir}/threadline/identity.json)
+     * 4. Generate new (saves to legacy path for backward compat)
      */
     getOrCreate(): IdentityInfo;
     /**
@@ -27,14 +39,23 @@ export declare class IdentityManager {
      */
     get(): IdentityInfo | null;
     /**
-     * Check if an identity exists.
+     * Check if an identity exists (canonical or legacy).
      */
     exists(): boolean;
     /**
      * Get the directory where keys are stored.
      */
     get keyDir(): string;
-    private loadFromDisk;
+    /**
+     * Load from canonical identity.json (new format).
+     * Only loads unencrypted keys — encrypted keys require the CanonicalIdentityManager
+     * with a passphrase, which is handled at a higher level.
+     */
+    private loadFromCanonical;
+    /**
+     * Load from legacy threadline/identity.json (old format).
+     */
+    private loadFromLegacy;
     private saveToDisk;
 }
 //# sourceMappingURL=IdentityManager.d.ts.map

package/dist/threadline/client/IdentityManager.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"IdentityManager.d.ts","sourceRoot":"","sources":["../../../src/threadline/client/IdentityManager.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAMH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAE1D,MAAM,WAAW,YAAY;IAC3B,WAAW,EAAE,gBAAgB,CAAC;IAC9B,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,eAAe,EAAE,MAAM,CAAC;IACxB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,qBAAa,eAAe;IAC1B,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAS;IAClC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAS;IACjC,OAAO,CAAC,QAAQ,CAA6B;gBAEjC,QAAQ,EAAE,MAAM;IAK5B;;;OAGG;IACH,WAAW,IAAI,YAAY;IAyB3B;;OAEG;IACH,GAAG,IAAI,YAAY,GAAG,IAAI;IAS1B;;OAEG;IACH,MAAM,IAAI,OAAO;IAIjB;;OAEG;IACH,IAAI,MAAM,IAAI,MAAM,CAEnB;IAID,OAAO,CAAC,YAAY;IAmBpB,OAAO,CAAC,UAAU;CAiBnB"}
+{"version":3,"file":"IdentityManager.d.ts","sourceRoot":"","sources":["../../../src/threadline/client/IdentityManager.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAMH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAE1D,MAAM,WAAW,YAAY;IAC3B,WAAW,EAAE,gBAAgB,CAAC;IAC9B,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,eAAe,EAAE,MAAM,CAAC;IACxB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,qBAAa,eAAe;IAC1B,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAS;IAClC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAS;IACvC,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAS;IAC1C,OAAO,CAAC,QAAQ,CAA6B;gBAEjC,QAAQ,EAAE,MAAM;IAM5B;;;;;;;;OAQG;IACH,WAAW,IAAI,YAAY;IAyB3B;;OAEG;IACH,GAAG,IAAI,YAAY,GAAG,IAAI;IAS1B;;OAEG;IACH,MAAM,IAAI,OAAO;IAMjB;;OAEG;IACH,IAAI,MAAM,IAAI,MAAM,CAEnB;IAID;;;;OAIG;IACH,OAAO,CAAC,iBAAiB;IAwBzB;;OAEG;IACH,OAAO,CAAC,cAAc;IAmBtB,OAAO,CAAC,UAAU;CAiBnB"}

package/dist/threadline/client/IdentityManager.js

@@ -1,8 +1,14 @@
 /**
  * IdentityManager — Manages Ed25519 identity keys for relay agents.
  *
- * Generates, stores, and loads identity keypairs from disk.
- * Part of Threadline Relay Phase 1.
+ * Delegates to the canonical identity ({stateDir}/identity.json) when available,
+ * falling back to the legacy Threadline identity ({stateDir}/threadline/identity.json).
+ *
+ * This ensures backward compatibility: existing agents keep working with their
+ * legacy identity, while new/migrated agents use the canonical location.
+ *
+ * The IdentityInfo interface is unchanged — consumers don't need to know
+ * which storage backend is in use.
  */
 import fs from 'node:fs';
 import path from 'node:path';
@@ -10,26 +16,33 @@ import { generateIdentityKeyPair } from '../ThreadlineCrypto.js';
 import { computeFingerprint, deriveX25519PublicKey } from './MessageEncryptor.js';
 export class IdentityManager {
     stateDir;
-    keyFile;
+    legacyKeyFile;
+    canonicalKeyFile;
     identity = null;
     constructor(stateDir) {
         this.stateDir = stateDir;
-        this.keyFile = path.join(stateDir, 'threadline', 'identity.json');
+        this.legacyKeyFile = path.join(stateDir, 'threadline', 'identity.json');
+        this.canonicalKeyFile = path.join(stateDir, 'identity.json');
     }
     /**
      * Get or create the agent's identity.
-     * Generates a new keypair on first use, loads from disk on subsequent uses.
+     *
+     * Priority:
+     * 1. Cached in-memory identity
+     * 2. Canonical identity ({stateDir}/identity.json)
+     * 3. Legacy identity ({stateDir}/threadline/identity.json)
+     * 4. Generate new (saves to legacy path for backward compat)
      */
     getOrCreate() {
         if (this.identity)
             return this.identity;
-        // Try loading from disk
-        const loaded = this.loadFromDisk();
+        // Try canonical first, then legacy
+        const loaded = this.loadFromCanonical() ?? this.loadFromLegacy();
         if (loaded) {
             this.identity = loaded;
             return loaded;
         }
-        // Generate new identity
+        // Generate new identity (legacy path for backward compat with standalone tooling)
         const keypair = generateIdentityKeyPair();
         const identity = {
             fingerprint: computeFingerprint(keypair.publicKey),
@@ -48,30 +61,63 @@ export class IdentityManager {
     get() {
         if (this.identity)
             return this.identity;
-        const loaded = this.loadFromDisk();
+        const loaded = this.loadFromCanonical() ?? this.loadFromLegacy();
         if (loaded) {
             this.identity = loaded;
         }
         return this.identity;
     }
     /**
-     * Check if an identity exists.
+     * Check if an identity exists (canonical or legacy).
      */
     exists() {
-        return this.identity !== null || fs.existsSync(this.keyFile);
+        return this.identity !== null
+            || fs.existsSync(this.canonicalKeyFile)
+            || fs.existsSync(this.legacyKeyFile);
     }
     /**
      * Get the directory where keys are stored.
      */
     get keyDir() {
-        return path.dirname(this.keyFile);
+        return path.dirname(this.legacyKeyFile);
     }
     // ── Private ─────────────────────────────────────────────────────
-    loadFromDisk() {
+    /**
+     * Load from canonical identity.json (new format).
+     * Only loads unencrypted keys — encrypted keys require the CanonicalIdentityManager
+     * with a passphrase, which is handled at a higher level.
+     */
+    loadFromCanonical() {
+        try {
+            if (!fs.existsSync(this.canonicalKeyFile))
+                return null;
+            const raw = JSON.parse(fs.readFileSync(this.canonicalKeyFile, 'utf-8'));
+            // Only load if unencrypted — encrypted keys need CanonicalIdentityManager
+            if (raw.privateKeyEncryption && raw.privateKeyEncryption !== 'none') {
+                return null;
+            }
+            const privateKey = Buffer.from(raw.privateKey, 'base64');
+            const publicKey = Buffer.from(raw.publicKey, 'base64');
+            return {
+                fingerprint: computeFingerprint(publicKey),
+                publicKey,
+                privateKey,
+                x25519PublicKey: deriveX25519PublicKey(privateKey),
+                createdAt: raw.createdAt,
+            };
+        }
+        catch {
+            return null;
+        }
+    }
+    /**
+     * Load from legacy threadline/identity.json (old format).
+     */
+    loadFromLegacy() {
         try {
-            if (!fs.existsSync(this.keyFile))
+            if (!fs.existsSync(this.legacyKeyFile))
                 return null;
-            const raw = JSON.parse(fs.readFileSync(this.keyFile, 'utf-8'));
+            const raw = JSON.parse(fs.readFileSync(this.legacyKeyFile, 'utf-8'));
             const privateKey = Buffer.from(raw.privateKey, 'base64');
             return {
                 fingerprint: raw.fingerprint,
@@ -88,7 +134,7 @@ export class IdentityManager {
         }
     }
     saveToDisk(identity) {
-        const dir = path.dirname(this.keyFile);
+        const dir = path.dirname(this.legacyKeyFile);
         fs.mkdirSync(dir, { recursive: true });
         const data = JSON.stringify({
             fingerprint: identity.fingerprint,
@@ -98,9 +144,9 @@ export class IdentityManager {
             createdAt: identity.createdAt,
         }, null, 2);
         // Atomic write
-        const tmpPath = `${this.keyFile}.${process.pid}.tmp`;
+        const tmpPath = `${this.legacyKeyFile}.${process.pid}.tmp`;
         fs.writeFileSync(tmpPath, data, { mode: 0o600 });
-        fs.renameSync(tmpPath, this.keyFile);
+        fs.renameSync(tmpPath, this.legacyKeyFile);
     }
 }
 //# sourceMappingURL=IdentityManager.js.map

package/dist/threadline/client/IdentityManager.js.map

@@ -1 +1 @@
-{"version":3,"file":"IdentityManager.js","sourceRoot":"","sources":["../../../src/threadline/client/IdentityManager.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,uBAAuB,EAAgB,MAAM,wBAAwB,CAAC;AAC/E,OAAO,EAAE,kBAAkB,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AAWlF,MAAM,OAAO,eAAe;IACT,QAAQ,CAAS;IACjB,OAAO,CAAS;IACzB,QAAQ,GAAwB,IAAI,CAAC;IAE7C,YAAY,QAAgB;QAC1B,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;QACzB,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,YAAY,EAAE,eAAe,CAAC,CAAC;IACpE,CAAC;IAED;;;OAGG;IACH,WAAW;QACT,IAAI,IAAI,CAAC,QAAQ;YAAE,OAAO,IAAI,CAAC,QAAQ,CAAC;QAExC,wBAAwB;QACxB,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,EAAE,CAAC;QACnC,IAAI,MAAM,EAAE,CAAC;YACX,IAAI,CAAC,QAAQ,GAAG,MAAM,CAAC;YACvB,OAAO,MAAM,CAAC;QAChB,CAAC;QAED,wBAAwB;QACxB,MAAM,OAAO,GAAG,uBAAuB,EAAE,CAAC;QAC1C,MAAM,QAAQ,GAAiB;YAC7B,WAAW,EAAE,kBAAkB,CAAC,OAAO,CAAC,SAAS,CAAC;YAClD,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,UAAU,EAAE,OAAO,CAAC,UAAU;YAC9B,eAAe,EAAE,qBAAqB,CAAC,OAAO,CAAC,UAAU,CAAC;YAC1D,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SACpC,CAAC;QAEF,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;QAC1B,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;QACzB,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED;;OAEG;IACH,GAAG;QACD,IAAI,IAAI,CAAC,QAAQ;YAAE,OAAO,IAAI,CAAC,QAAQ,CAAC;QACxC,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,EAAE,CAAC;QACnC,IAAI,MAAM,EAAE,CAAC;YACX,IAAI,CAAC,QAAQ,GAAG,MAAM,CAAC;QACzB,CAAC;QACD,OAAO,IAAI,CAAC,QAAQ,CAAC;IACvB,CAAC;IAED;;OAEG;IACH,MAAM;QACJ,OAAO,IAAI,CAAC,QAAQ,KAAK,IAAI,IAAI,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC/D,CAAC;IAED;;OAEG;IACH,IAAI,MAAM;QACR,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACpC,CAAC;IAED,mEAAmE;IAE3D,YAAY;QAClB,IAAI,CAAC;YACH,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC;gBAAE,OAAO,IAAI,CAAC;YAC9C,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;YAC/D,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;YACzD,OAAO;gBACL,WAAW,EAAE,GAAG,CAAC,WAAW;gBAC5B,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,QAAQ,CAAC;gBAC/C,UAAU;gBACV,eAAe,EAAE,GAAG,CAAC,eAAe;oBAClC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,eAAe,EAAE,QAAQ,CAAC;oBAC5C,CAAC,CAAC,qBAAqB,CAAC,UAAU,CAAC;gBACrC,SAAS,EAAE,GAAG,CAAC,SAAS;aACzB,CAAC;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAEO,UAAU,CAAC,QAAsB;QACvC,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACvC,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAEvC,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC;YAC1B,WAAW,EAAE,QAAQ,CAAC,WAAW;YACjC,SAAS,EAAE,QAAQ,CAAC,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC;YAChD,UAAU,EAAE,QAAQ,CAAC,UAAU,CAAC,QAAQ,CAAC,QAAQ,CAAC;YAClD,eAAe,EAAE,QAAQ,CAAC,eAAe,CAAC,QAAQ,CAAC,QAAQ,CAAC;YAC5D,SAAS,EAAE,QAAQ,CAAC,SAAS;SAC9B,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;QAEZ,eAAe;QACf,MAAM,OAAO,GAAG,GAAG,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,GAAG,MAAM,CAAC;QACrD,EAAE,CAAC,aAAa,CAAC,OAAO,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACjD,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;IACvC,CAAC;CACF"}
+{"version":3,"file":"IdentityManager.js","sourceRoot":"","sources":["../../../src/threadline/client/IdentityManager.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,uBAAuB,EAAgB,MAAM,wBAAwB,CAAC;AAC/E,OAAO,EAAE,kBAAkB,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AAWlF,MAAM,OAAO,eAAe;IACT,QAAQ,CAAS;IACjB,aAAa,CAAS;IACtB,gBAAgB,CAAS;IAClC,QAAQ,GAAwB,IAAI,CAAC;IAE7C,YAAY,QAAgB;QAC1B,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;QACzB,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,YAAY,EAAE,eAAe,CAAC,CAAC;QACxE,IAAI,CAAC,gBAAgB,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,eAAe,CAAC,CAAC;IAC/D,CAAC;IAED;;;;;;;;OAQG;IACH,WAAW;QACT,IAAI,IAAI,CAAC,QAAQ;YAAE,OAAO,IAAI,CAAC,QAAQ,CAAC;QAExC,mCAAmC;QACnC,MAAM,MAAM,GAAG,IAAI,CAAC,iBAAiB,EAAE,IAAI,IAAI,CAAC,cAAc,EAAE,CAAC;QACjE,IAAI,MAAM,EAAE,CAAC;YACX,IAAI,CAAC,QAAQ,GAAG,MAAM,CAAC;YACvB,OAAO,MAAM,CAAC;QAChB,CAAC;QAED,kFAAkF;QAClF,MAAM,OAAO,GAAG,uBAAuB,EAAE,CAAC;QAC1C,MAAM,QAAQ,GAAiB;YAC7B,WAAW,EAAE,kBAAkB,CAAC,OAAO,CAAC,SAAS,CAAC;YAClD,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,UAAU,EAAE,OAAO,CAAC,UAAU;YAC9B,eAAe,EAAE,qBAAqB,CAAC,OAAO,CAAC,UAAU,CAAC;YAC1D,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SACpC,CAAC;QAEF,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;QAC1B,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;QACzB,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED;;OAEG;IACH,GAAG;QACD,IAAI,IAAI,CAAC,QAAQ;YAAE,OAAO,IAAI,CAAC,QAAQ,CAAC;QACxC,MAAM,MAAM,GAAG,IAAI,CAAC,iBAAiB,EAAE,IAAI,IAAI,CAAC,cAAc,EAAE,CAAC;QACjE,IAAI,MAAM,EAAE,CAAC;YACX,IAAI,CAAC,QAAQ,GAAG,MAAM,CAAC;QACzB,CAAC;QACD,OAAO,IAAI,CAAC,QAAQ,CAAC;IACvB,CAAC;IAED;;OAEG;IACH,MAAM;QACJ,OAAO,IAAI,CAAC,QAAQ,KAAK,IAAI;eACxB,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,gBAAgB,CAAC;eACpC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;IACzC,CAAC;IAED;;OAEG;IACH,IAAI,MAAM;QACR,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;IAC1C,CAAC;IAED,mEAAmE;IAEnE;;;;OAIG;IACK,iBAAiB;QACvB,IAAI,CAAC;YACH,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,gBAAgB,CAAC;gBAAE,OAAO,IAAI,CAAC;YACvD,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,gBAAgB,EAAE,OAAO,CAAC,CAAC,CAAC;YAExE,0EAA0E;YAC1E,IAAI,GAAG,CAAC,oBAAoB,IAAI,GAAG,CAAC,oBAAoB,KAAK,MAAM,EAAE,CAAC;gBACpE,OAAO,IAAI,CAAC;YACd,CAAC;YAED,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;YACzD,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;YACvD,OAAO;gBACL,WAAW,EAAE,kBAAkB,CAAC,SAAS,CAAC;gBAC1C,SAAS;gBACT,UAAU;gBACV,eAAe,EAAE,qBAAqB,CAAC,UAAU,CAAC;gBAClD,SAAS,EAAE,GAAG,CAAC,SAAS;aACzB,CAAC;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED;;OAEG;IACK,cAAc;QACpB,IAAI,CAAC;YACH,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,aAAa,CAAC;gBAAE,OAAO,IAAI,CAAC;YACpD,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC,CAAC;YACrE,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;YACzD,OAAO;gBACL,WAAW,EAAE,GAAG,CAAC,WAAW;gBAC5B,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,QAAQ,CAAC;gBAC/C,UAAU;gBACV,eAAe,EAAE,GAAG,CAAC,eAAe;oBAClC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,eAAe,EAAE,QAAQ,CAAC;oBAC5C,CAAC,CAAC,qBAAqB,CAAC,UAAU,CAAC;gBACrC,SAAS,EAAE,GAAG,CAAC,SAAS;aACzB,CAAC;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAEO,UAAU,CAAC,QAAsB;QACvC,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;QAC7C,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAEvC,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC;YAC1B,WAAW,EAAE,QAAQ,CAAC,WAAW;YACjC,SAAS,EAAE,QAAQ,CAAC,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC;YAChD,UAAU,EAAE,QAAQ,CAAC,UAAU,CAAC,QAAQ,CAAC,QAAQ,CAAC;YAClD,eAAe,EAAE,QAAQ,CAAC,eAAe,CAAC,QAAQ,CAAC,QAAQ,CAAC;YAC5D,SAAS,EAAE,QAAQ,CAAC,SAAS;SAC9B,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;QAEZ,eAAe;QACf,MAAM,OAAO,GAAG,GAAG,IAAI,CAAC,aAAa,IAAI,OAAO,CAAC,GAAG,MAAM,CAAC;QAC3D,EAAE,CAAC,aAAa,CAAC,OAAO,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACjD,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC;IAC7C,CAAC;CACF"}