sealbridge 0.0.1 → 0.2.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (208) hide show
  1. package/NOTICE +43 -0
  2. package/README.ja.md +397 -0
  3. package/README.md +567 -1
  4. package/dist/cli/dist/acp.d.ts +2 -0
  5. package/dist/cli/dist/acp.js +6 -0
  6. package/dist/cli/dist/acp.js.map +1 -0
  7. package/dist/cli/dist/approval-summary.d.ts +2 -0
  8. package/dist/cli/dist/approval-summary.js +32 -0
  9. package/dist/cli/dist/approval-summary.js.map +1 -0
  10. package/dist/cli/dist/board.d.ts +47 -0
  11. package/dist/cli/dist/board.js +255 -0
  12. package/dist/cli/dist/board.js.map +1 -0
  13. package/dist/cli/dist/contacts.d.ts +18 -0
  14. package/dist/cli/dist/contacts.js +154 -0
  15. package/dist/cli/dist/contacts.js.map +1 -0
  16. package/dist/cli/dist/doctor.d.ts +13 -0
  17. package/dist/cli/dist/doctor.js +30 -0
  18. package/dist/cli/dist/doctor.js.map +1 -0
  19. package/dist/cli/dist/error-messages.d.ts +2 -0
  20. package/dist/cli/dist/error-messages.js +24 -0
  21. package/dist/cli/dist/error-messages.js.map +1 -0
  22. package/dist/cli/dist/index.d.ts +2 -0
  23. package/dist/cli/dist/index.js +194 -0
  24. package/dist/cli/dist/index.js.map +1 -0
  25. package/dist/cli/dist/invite-share.d.ts +16 -0
  26. package/dist/cli/dist/invite-share.js +163 -0
  27. package/dist/cli/dist/invite-share.js.map +1 -0
  28. package/dist/cli/dist/mcp.d.ts +17 -0
  29. package/dist/cli/dist/mcp.js +105 -0
  30. package/dist/cli/dist/mcp.js.map +1 -0
  31. package/dist/cli/dist/network.d.ts +1 -0
  32. package/dist/cli/dist/network.js +396 -0
  33. package/dist/cli/dist/network.js.map +1 -0
  34. package/dist/cli/dist/public-settings.d.ts +27 -0
  35. package/dist/cli/dist/public-settings.js +33 -0
  36. package/dist/cli/dist/public-settings.js.map +1 -0
  37. package/dist/cli/dist/receipt.d.ts +39 -0
  38. package/dist/cli/dist/receipt.js +90 -0
  39. package/dist/cli/dist/receipt.js.map +1 -0
  40. package/dist/cli/dist/receive-hook.d.ts +2 -0
  41. package/dist/cli/dist/receive-hook.js +35 -0
  42. package/dist/cli/dist/receive-hook.js.map +1 -0
  43. package/dist/cli/dist/task-input.d.ts +2 -0
  44. package/dist/cli/dist/task-input.js +19 -0
  45. package/dist/cli/dist/task-input.js.map +1 -0
  46. package/dist/cli/dist/wake-hook.d.ts +3 -0
  47. package/dist/cli/dist/wake-hook.js +32 -0
  48. package/dist/cli/dist/wake-hook.js.map +1 -0
  49. package/dist/examples/two-owner-demo/alice-policy.json +4 -0
  50. package/dist/examples/two-owner-demo/bob-policy.json +4 -0
  51. package/dist/examples/two-owner-demo/dist/run-demo.d.ts +71 -0
  52. package/dist/examples/two-owner-demo/dist/run-demo.js +383 -0
  53. package/dist/examples/two-owner-demo/dist/run-demo.js.map +1 -0
  54. package/dist/package.json +1 -0
  55. package/dist/packages/adapters/dist/command.d.ts +122 -0
  56. package/dist/packages/adapters/dist/command.js +378 -0
  57. package/dist/packages/adapters/dist/command.js.map +1 -0
  58. package/dist/packages/adapters/dist/credential-proxy.d.ts +37 -0
  59. package/dist/packages/adapters/dist/credential-proxy.js +363 -0
  60. package/dist/packages/adapters/dist/credential-proxy.js.map +1 -0
  61. package/dist/packages/adapters/dist/index.d.ts +6 -0
  62. package/dist/packages/adapters/dist/index.js +6 -0
  63. package/dist/packages/adapters/dist/index.js.map +1 -0
  64. package/dist/packages/adapters/dist/mcp.d.ts +32 -0
  65. package/dist/packages/adapters/dist/mcp.js +87 -0
  66. package/dist/packages/adapters/dist/mcp.js.map +1 -0
  67. package/dist/packages/adapters/dist/openai.d.ts +23 -0
  68. package/dist/packages/adapters/dist/openai.js +81 -0
  69. package/dist/packages/adapters/dist/openai.js.map +1 -0
  70. package/dist/packages/adapters/dist/sandbox.d.ts +45 -0
  71. package/dist/packages/adapters/dist/sandbox.js +60 -0
  72. package/dist/packages/adapters/dist/sandbox.js.map +1 -0
  73. package/dist/packages/core/dist/capability.d.ts +36 -0
  74. package/dist/packages/core/dist/capability.js +203 -0
  75. package/dist/packages/core/dist/capability.js.map +1 -0
  76. package/dist/packages/core/dist/contract.d.ts +33 -0
  77. package/dist/packages/core/dist/contract.js +97 -0
  78. package/dist/packages/core/dist/contract.js.map +1 -0
  79. package/dist/packages/core/dist/crypto.d.ts +34 -0
  80. package/dist/packages/core/dist/crypto.js +329 -0
  81. package/dist/packages/core/dist/crypto.js.map +1 -0
  82. package/dist/packages/core/dist/discovery.d.ts +129 -0
  83. package/dist/packages/core/dist/discovery.js +527 -0
  84. package/dist/packages/core/dist/discovery.js.map +1 -0
  85. package/dist/packages/core/dist/edge.d.ts +4 -0
  86. package/dist/packages/core/dist/edge.js +6 -0
  87. package/dist/packages/core/dist/edge.js.map +1 -0
  88. package/dist/packages/core/dist/index.d.ts +9 -0
  89. package/dist/packages/core/dist/index.js +10 -0
  90. package/dist/packages/core/dist/index.js.map +1 -0
  91. package/dist/packages/core/dist/receipts.d.ts +9 -0
  92. package/dist/packages/core/dist/receipts.js +67 -0
  93. package/dist/packages/core/dist/receipts.js.map +1 -0
  94. package/dist/packages/core/dist/relay-auth.d.ts +40 -0
  95. package/dist/packages/core/dist/relay-auth.js +106 -0
  96. package/dist/packages/core/dist/relay-auth.js.map +1 -0
  97. package/dist/packages/core/dist/revocation.d.ts +58 -0
  98. package/dist/packages/core/dist/revocation.js +112 -0
  99. package/dist/packages/core/dist/revocation.js.map +1 -0
  100. package/dist/packages/core/dist/schema.d.ts +11 -0
  101. package/dist/packages/core/dist/schema.js +48 -0
  102. package/dist/packages/core/dist/schema.js.map +1 -0
  103. package/dist/packages/core/dist/types.d.ts +172 -0
  104. package/dist/packages/core/dist/types.js +2 -0
  105. package/dist/packages/core/dist/types.js.map +1 -0
  106. package/dist/packages/ledger/dist/index.d.ts +84 -0
  107. package/dist/packages/ledger/dist/index.js +269 -0
  108. package/dist/packages/ledger/dist/index.js.map +1 -0
  109. package/dist/packages/relay/dist/fetch.d.ts +250 -0
  110. package/dist/packages/relay/dist/fetch.js +1401 -0
  111. package/dist/packages/relay/dist/fetch.js.map +1 -0
  112. package/dist/packages/relay/dist/index.d.ts +103 -0
  113. package/dist/packages/relay/dist/index.js +855 -0
  114. package/dist/packages/relay/dist/index.js.map +1 -0
  115. package/dist/packages/relay/dist/journal.d.ts +77 -0
  116. package/dist/packages/relay/dist/journal.js +339 -0
  117. package/dist/packages/relay/dist/journal.js.map +1 -0
  118. package/dist/packages/relay/dist/notifications.d.ts +63 -0
  119. package/dist/packages/relay/dist/notifications.js +55 -0
  120. package/dist/packages/relay/dist/notifications.js.map +1 -0
  121. package/dist/packages/relay/dist/retry.d.ts +12 -0
  122. package/dist/packages/relay/dist/retry.js +59 -0
  123. package/dist/packages/relay/dist/retry.js.map +1 -0
  124. package/dist/packages/relay/dist/ssrf.d.ts +32 -0
  125. package/dist/packages/relay/dist/ssrf.js +213 -0
  126. package/dist/packages/relay/dist/ssrf.js.map +1 -0
  127. package/dist/packages/relay/dist/worker.d.ts +92 -0
  128. package/dist/packages/relay/dist/worker.js +460 -0
  129. package/dist/packages/relay/dist/worker.js.map +1 -0
  130. package/dist/packages/runtime/dist/a2a.d.ts +8 -0
  131. package/dist/packages/runtime/dist/a2a.js +69 -0
  132. package/dist/packages/runtime/dist/a2a.js.map +1 -0
  133. package/dist/packages/runtime/dist/adapter.d.ts +51 -0
  134. package/dist/packages/runtime/dist/adapter.js +2 -0
  135. package/dist/packages/runtime/dist/adapter.js.map +1 -0
  136. package/dist/packages/runtime/dist/approval-providers.d.ts +99 -0
  137. package/dist/packages/runtime/dist/approval-providers.js +269 -0
  138. package/dist/packages/runtime/dist/approval-providers.js.map +1 -0
  139. package/dist/packages/runtime/dist/daily-limit.d.ts +2 -0
  140. package/dist/packages/runtime/dist/daily-limit.js +54 -0
  141. package/dist/packages/runtime/dist/daily-limit.js.map +1 -0
  142. package/dist/packages/runtime/dist/gateway.d.ts +35 -0
  143. package/dist/packages/runtime/dist/gateway.js +92 -0
  144. package/dist/packages/runtime/dist/gateway.js.map +1 -0
  145. package/dist/packages/runtime/dist/inbox.d.ts +10 -0
  146. package/dist/packages/runtime/dist/inbox.js +24 -0
  147. package/dist/packages/runtime/dist/inbox.js.map +1 -0
  148. package/dist/packages/runtime/dist/index.d.ts +13 -0
  149. package/dist/packages/runtime/dist/index.js +14 -0
  150. package/dist/packages/runtime/dist/index.js.map +1 -0
  151. package/dist/packages/runtime/dist/mcp-server.d.ts +90 -0
  152. package/dist/packages/runtime/dist/mcp-server.js +647 -0
  153. package/dist/packages/runtime/dist/mcp-server.js.map +1 -0
  154. package/dist/packages/runtime/dist/mcp-tool-catalog.d.ts +3 -0
  155. package/dist/packages/runtime/dist/mcp-tool-catalog.js +507 -0
  156. package/dist/packages/runtime/dist/mcp-tool-catalog.js.map +1 -0
  157. package/dist/packages/runtime/dist/mcp.d.ts +73 -0
  158. package/dist/packages/runtime/dist/mcp.js +67 -0
  159. package/dist/packages/runtime/dist/mcp.js.map +1 -0
  160. package/dist/packages/runtime/dist/policy.d.ts +19 -0
  161. package/dist/packages/runtime/dist/policy.js +41 -0
  162. package/dist/packages/runtime/dist/policy.js.map +1 -0
  163. package/dist/packages/runtime/dist/quota.d.ts +39 -0
  164. package/dist/packages/runtime/dist/quota.js +147 -0
  165. package/dist/packages/runtime/dist/quota.js.map +1 -0
  166. package/dist/packages/runtime/dist/session-audit.d.ts +107 -0
  167. package/dist/packages/runtime/dist/session-audit.js +520 -0
  168. package/dist/packages/runtime/dist/session-audit.js.map +1 -0
  169. package/dist/packages/runtime/dist/session-timeouts.d.ts +33 -0
  170. package/dist/packages/runtime/dist/session-timeouts.js +62 -0
  171. package/dist/packages/runtime/dist/session-timeouts.js.map +1 -0
  172. package/dist/packages/runtime/dist/session.d.ts +323 -0
  173. package/dist/packages/runtime/dist/session.js +2252 -0
  174. package/dist/packages/runtime/dist/session.js.map +1 -0
  175. package/dist/packages/runtime/dist/task-journal.d.ts +36 -0
  176. package/dist/packages/runtime/dist/task-journal.js +104 -0
  177. package/dist/packages/runtime/dist/task-journal.js.map +1 -0
  178. package/dist/packages/runtime/dist/verifier.d.ts +64 -0
  179. package/dist/packages/runtime/dist/verifier.js +109 -0
  180. package/dist/packages/runtime/dist/verifier.js.map +1 -0
  181. package/dist/packages/sandbox/dist/container.d.ts +33 -0
  182. package/dist/packages/sandbox/dist/container.js +189 -0
  183. package/dist/packages/sandbox/dist/container.js.map +1 -0
  184. package/dist/packages/sandbox/dist/index.d.ts +34 -0
  185. package/dist/packages/sandbox/dist/index.js +179 -0
  186. package/dist/packages/sandbox/dist/index.js.map +1 -0
  187. package/dist/packages/sandbox/dist/permission.d.ts +58 -0
  188. package/dist/packages/sandbox/dist/permission.js +90 -0
  189. package/dist/packages/sandbox/dist/permission.js.map +1 -0
  190. package/dist/spec/README.ja.md +76 -0
  191. package/dist/spec/README.md +135 -0
  192. package/dist/spec/ack-receipt.schema.json +77 -0
  193. package/dist/spec/agent-card.schema.json +83 -0
  194. package/dist/spec/approval-receipt.schema.json +94 -0
  195. package/dist/spec/audit-entry.schema.json +101 -0
  196. package/dist/spec/capability-token.schema.json +133 -0
  197. package/dist/spec/envelope.schema.json +197 -0
  198. package/dist/spec/examples/sample-ack-receipt.json +16 -0
  199. package/dist/spec/examples/sample-agent-card.json +35 -0
  200. package/dist/spec/examples/sample-approval-receipt.json +18 -0
  201. package/dist/spec/examples/sample-audit-entry.json +37 -0
  202. package/dist/spec/examples/sample-capability-token.json +39 -0
  203. package/dist/spec/examples/sample-envelope.json +21 -0
  204. package/dist/spec/examples/sample-task-manifest.json +141 -0
  205. package/dist/spec/examples/sample-usage-receipt.json +19 -0
  206. package/dist/spec/task-manifest.schema.json +422 -0
  207. package/dist/spec/usage-receipt.schema.json +91 -0
  208. package/package.json +61 -5
@@ -0,0 +1,24 @@
1
+ // SPDX-License-Identifier: Apache-2.0
2
+ const reasons = [
3
+ [/AGENT_AUTH_REQUIRED|AUTH|CREDENTIAL|UNAUTHORIZED|FORBIDDEN/, '認証を利用できません。ホスト側の API キー設定とログイン状態を確認して再実行してください。'],
4
+ [/INVITE_LINK_TOKEN_REQUIRED/, '招待リンクにトークンがありません。# 以降を含む完全なリンクを相手に依頼してください。'],
5
+ [/INVITE_EXPIRED|TOKEN_REVOKED/, '招待の期限が切れたか失効しています。相手に新しい招待を依頼してください。'],
6
+ [/TIMEOUT|TIMED_OUT|DEADLINE/, '待機または実行の制限時間を超えました。相手の稼働状況と時間制限の設定を確認してください。'],
7
+ [/ABORT|CANCEL/, '処理が中断されました。相手の稼働状況と中断理由を確認してから再実行してください。'],
8
+ [/APPROVAL|HITL|VERIFICATION_REJECTED/, '所有者の承認が得られませんでした。依頼内容と承認画面を確認し、所有者が操作してください。'],
9
+ [/BUDGET|QUOTA|LIMIT/, '設定された予算または利用上限に達しました。依頼を小さくするか、所有者と上限を確認してください。'],
10
+ [/EXECUTION_FAILED|ADAPTER_|CLAUDE_TASK_FAILED|CODEX_/, 'AI の実行に失敗しました。CLI のインストール、認証、ワーカーのログを確認してください。'],
11
+ [/RELAY_REQUIRED/, '接続先の中継器がありません。完全な招待リンクを使うか --relay を指定してください。'],
12
+ [/ENOENT|EACCES|EPERM/, 'ファイルまたはコマンドを利用できません。指定したパスとアクセス権を確認してください。'],
13
+ [/INVALID|MISSING|CONFLICTING|Missing |Unexpected |Duplicate |Unknown option/, '入力または設定が正しくありません。ファイル内容とオプションを --help で確認してください。'],
14
+ [/RELAY|CONNECT|ECONN|FETCH|NETWORK/i, '中継器に接続できません。URL、ネットワーク、相手の稼働状況を確認してください。'],
15
+ ];
16
+ export function japaneseErrorReason(message) {
17
+ return reasons.find(([pattern]) => pattern.test(message))?.[1];
18
+ }
19
+ export function formatCliError(error) {
20
+ const message = String(error);
21
+ const reason = japaneseErrorReason(error instanceof Error ? error.message : message);
22
+ return message + (reason ? '\n' + reason : '');
23
+ }
24
+ //# sourceMappingURL=error-messages.js.map
@@ -0,0 +1 @@
1
+ {"version":3,"file":"error-messages.js","sourceRoot":"","sources":["../src/error-messages.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,MAAM,OAAO,GAAuB;IAClC,CAAC,4DAA4D,EAAE,iDAAiD,CAAC;IACjH,CAAC,4BAA4B,EAAE,6CAA6C,CAAC;IAC7E,CAAC,8BAA8B,EAAE,sCAAsC,CAAC;IACxE,CAAC,4BAA4B,EAAE,8CAA8C,CAAC;IAC9E,CAAC,cAAc,EAAE,0CAA0C,CAAC;IAC5D,CAAC,qCAAqC,EAAE,8CAA8C,CAAC;IACvF,CAAC,oBAAoB,EAAE,iDAAiD,CAAC;IACzE,CAAC,qDAAqD,EAAE,gDAAgD,CAAC;IACzG,CAAC,gBAAgB,EAAE,+CAA+C,CAAC;IACnE,CAAC,qBAAqB,EAAE,4CAA4C,CAAC;IACrE,CAAC,4EAA4E,EAAE,kDAAkD,CAAC;IAClI,CAAC,oCAAoC,EAAE,0CAA0C,CAAC;CACnF,CAAC;AAEF,MAAM,UAAU,mBAAmB,CAAC,OAAe;IACjD,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;AACjE,CAAC;AACD,MAAM,UAAU,cAAc,CAAC,KAAc;IAC3C,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IAC9B,MAAM,MAAM,GAAG,mBAAmB,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;IACrF,OAAO,OAAO,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;AACjD,CAAC"}
@@ -0,0 +1,2 @@
1
+ #!/usr/bin/env node
2
+ export {};
@@ -0,0 +1,194 @@
1
+ #!/usr/bin/env node
2
+ // SPDX-License-Identifier: Apache-2.0
3
+ import { readFileSync, writeFileSync, mkdirSync } from 'node:fs';
4
+ import { generateKeyPair, validateSchema, signApproval } from '../../packages/core/dist/index.js';
5
+ import { parseJsonl, verifyAudit } from '../../packages/ledger/dist/index.js';
6
+ import { runDemo } from '../../examples/two-owner-demo/dist/run-demo.js';
7
+ import { networkCommand } from './network.js';
8
+ import { mcpServerCommand } from './mcp.js';
9
+ import { contactsCommand } from './contacts.js';
10
+ import { receiptCommand } from './receipt.js';
11
+ import { doctorCommand } from './doctor.js';
12
+ import { boardCommand } from './board.js';
13
+ import { formatCliError } from './error-messages.js';
14
+ const read = (path) => JSON.parse(readFileSync(path, 'utf8'));
15
+ const AUDIT_VERIFY_USAGE = 'Usage: sealbridge audit-verify <audit.jsonl|bundle.json> [trust-anchor.json] ' +
16
+ '[--expect-final-state <state>] [--expect-last-hash <hash>] [--expect-entry-count <n>]';
17
+ function auditVerifyFlag(args, index, name) {
18
+ const value = args[index + 1];
19
+ if (!value || value.startsWith('--'))
20
+ throw new Error('Missing ' + name);
21
+ return value;
22
+ }
23
+ function parseAuditVerifyArgs(args) {
24
+ const positionals = [];
25
+ let expectedFinalState;
26
+ let expectedLastEntryHash;
27
+ let expectedEntryCount;
28
+ for (let i = 0; i < args.length; i++) {
29
+ const arg = args[i];
30
+ if (arg === '--expect-final-state') {
31
+ if (expectedFinalState !== undefined)
32
+ throw new Error('Duplicate option: ' + arg);
33
+ expectedFinalState = auditVerifyFlag(args, i, arg);
34
+ i++;
35
+ continue;
36
+ }
37
+ if (arg === '--expect-last-hash') {
38
+ if (expectedLastEntryHash !== undefined)
39
+ throw new Error('Duplicate option: ' + arg);
40
+ expectedLastEntryHash = auditVerifyFlag(args, i, arg);
41
+ i++;
42
+ continue;
43
+ }
44
+ if (arg === '--expect-entry-count') {
45
+ if (expectedEntryCount !== undefined)
46
+ throw new Error('Duplicate option: ' + arg);
47
+ const raw = auditVerifyFlag(args, i, arg);
48
+ if (!/^(0|[1-9]\d*)$/.test(raw))
49
+ throw new Error('INVALID_EXPECT_ENTRY_COUNT');
50
+ const parsed = Number(raw);
51
+ if (!Number.isSafeInteger(parsed))
52
+ throw new Error('INVALID_EXPECT_ENTRY_COUNT');
53
+ expectedEntryCount = parsed;
54
+ i++;
55
+ continue;
56
+ }
57
+ if (arg.startsWith('--'))
58
+ throw new Error('Unknown option: ' + arg);
59
+ positionals.push(arg);
60
+ }
61
+ if (positionals.length < 1 || positionals.length > 2)
62
+ throw new Error(AUDIT_VERIFY_USAGE);
63
+ return {
64
+ input: positionals[0],
65
+ anchorPath: positionals[1],
66
+ expectedFinalState,
67
+ expectedLastEntryHash,
68
+ expectedEntryCount,
69
+ };
70
+ }
71
+ function save(path, value, privateFile = false) {
72
+ writeFileSync(path, JSON.stringify(value, null, 2) + '\n', {
73
+ mode: privateFile ? 0o600 : 0o644,
74
+ flag: 'wx',
75
+ });
76
+ }
77
+ async function main(args) {
78
+ const [command, ...rest] = args;
79
+ switch (command) {
80
+ case '--version':
81
+ case '-v':
82
+ console.log(JSON.parse(readFileSync(new URL('../../package.json', import.meta.url), 'utf8')).version);
83
+ break;
84
+ case 'doctor':
85
+ await doctorCommand();
86
+ break;
87
+ case 'board':
88
+ await boardCommand(rest);
89
+ break;
90
+ case 'contacts':
91
+ contactsCommand(rest);
92
+ break;
93
+ case 'receipt':
94
+ receiptCommand(rest);
95
+ break;
96
+ case 'relay':
97
+ case 'worker':
98
+ case 'delegate':
99
+ case 'discover':
100
+ case 'invite':
101
+ await networkCommand(command, rest);
102
+ break;
103
+ case 'mcp-server':
104
+ await mcpServerCommand(rest);
105
+ break;
106
+ case 'keygen': {
107
+ if (rest.length !== 1)
108
+ throw new Error('Usage: sealbridge keygen <owner.private.json>');
109
+ const key = generateKeyPair();
110
+ save(rest[0], key, true);
111
+ console.log(JSON.stringify({ did: key.did, keyFile: rest[0] }));
112
+ break;
113
+ }
114
+ case 'validate': {
115
+ const schema = rest.length === 1 ? 'task-manifest' : rest[0], path = rest.length === 1 ? rest[0] : rest[1];
116
+ if (!schema || !path)
117
+ throw new Error('Usage: sealbridge validate [schema-name] <file.json>');
118
+ validateSchema(schema, read(path));
119
+ console.log('VALID');
120
+ break;
121
+ }
122
+ case 'approve': {
123
+ const [keyFile, gate, taskId, targetFile, outputFile] = rest;
124
+ if (!keyFile || !gate || !taskId || !targetFile || !outputFile)
125
+ throw new Error('Usage: sealbridge approve <key.private.json> <gate> <taskId> <target.json> <approval.json>');
126
+ if (![
127
+ 'contract_acceptance',
128
+ 'external_side_effect',
129
+ 'budget_increase',
130
+ 'redelegation',
131
+ 'final_verification',
132
+ ].includes(gate))
133
+ throw new Error('INVALID_GATE');
134
+ const receipt = signApproval(taskId, gate, read(targetFile), read(keyFile));
135
+ validateSchema('approval-receipt', receipt);
136
+ save(outputFile, receipt);
137
+ console.log(JSON.stringify({ receiptId: receipt.payload.receiptId, outputFile }));
138
+ break;
139
+ }
140
+ case 'audit-verify': {
141
+ const parsed = parseAuditVerifyArgs(rest);
142
+ const input = readFileSync(parsed.input, 'utf8');
143
+ const bundle = parsed.input.endsWith('.jsonl')
144
+ ? parseJsonl(input)
145
+ : JSON.parse(input);
146
+ const options = {};
147
+ if (parsed.anchorPath) {
148
+ const file = read(parsed.anchorPath);
149
+ if (!file || typeof file !== 'object' || Array.isArray(file))
150
+ throw new Error('INVALID_TRUST_ANCHOR');
151
+ // A positional trust-anchor file still pins taskId and actors, as before.
152
+ options.trustAnchor = file;
153
+ options.taskId = typeof file.taskId === 'string' ? file.taskId : '';
154
+ options.actors =
155
+ Array.isArray(file.actors) && file.actors.length === 2
156
+ ? file.actors
157
+ : ['', ''];
158
+ if (typeof file.head === 'string')
159
+ options.head = file.head;
160
+ }
161
+ if (parsed.expectedFinalState !== undefined)
162
+ options.expectedFinalState = parsed.expectedFinalState;
163
+ if (parsed.expectedLastEntryHash !== undefined)
164
+ options.expectedLastEntryHash = parsed.expectedLastEntryHash;
165
+ if (parsed.expectedEntryCount !== undefined)
166
+ options.expectedEntryCount = parsed.expectedEntryCount;
167
+ const anchored = parsed.anchorPath !== undefined ||
168
+ parsed.expectedFinalState !== undefined ||
169
+ parsed.expectedLastEntryHash !== undefined ||
170
+ parsed.expectedEntryCount !== undefined;
171
+ const result = verifyAudit(bundle, anchored ? options : undefined);
172
+ console.log(JSON.stringify(result));
173
+ if (!result.valid)
174
+ process.exitCode = 1;
175
+ break;
176
+ }
177
+ case 'demo': {
178
+ const index = rest.indexOf('--audit-dir'), directory = index >= 0 ? rest[index + 1] : undefined;
179
+ if (index >= 0 && !directory)
180
+ throw new Error('Missing --audit-dir value');
181
+ if (directory)
182
+ mkdirSync(directory, { recursive: true, mode: 0o700 });
183
+ console.log(JSON.stringify(await runDemo(directory), null, 2));
184
+ break;
185
+ }
186
+ default:
187
+ throw new Error('Usage: sealbridge <doctor|keygen|validate|approve|audit-verify|receipt|contacts|board|demo|relay|worker|delegate|discover|invite|mcp-server>');
188
+ }
189
+ }
190
+ main(process.argv.slice(2)).catch((error) => {
191
+ console.error(formatCliError(error));
192
+ process.exitCode = 1;
193
+ });
194
+ //# sourceMappingURL=index.js.map
@@ -0,0 +1 @@
1
+ {"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AACA,sCAAsC;AACtC,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AACjE,OAAO,EAAE,eAAe,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AAE1E,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAEtD,OAAO,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAC;AAC9C,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAC9C,OAAO,EAAE,gBAAgB,EAAE,MAAM,UAAU,CAAC;AAC5C,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAChD,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAC9C,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAC1C,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AACrD,MAAM,IAAI,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAY,CAAC;AACjF,MAAM,kBAAkB,GACtB,+EAA+E;IAC/E,uFAAuF,CAAC;AAC1F,SAAS,eAAe,CAAC,IAAc,EAAE,KAAa,EAAE,IAAY;IAClE,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;IAC9B,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,UAAU,GAAG,IAAI,CAAC,CAAC;IACzE,OAAO,KAAK,CAAC;AACf,CAAC;AACD,SAAS,oBAAoB,CAAC,IAAc;IAO1C,MAAM,WAAW,GAAa,EAAE,CAAC;IACjC,IAAI,kBAAsC,CAAC;IAC3C,IAAI,qBAAyC,CAAC;IAC9C,IAAI,kBAAsC,CAAC;IAC3C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QACpB,IAAI,GAAG,KAAK,sBAAsB,EAAE,CAAC;YACnC,IAAI,kBAAkB,KAAK,SAAS;gBAAE,MAAM,IAAI,KAAK,CAAC,oBAAoB,GAAG,GAAG,CAAC,CAAC;YAClF,kBAAkB,GAAG,eAAe,CAAC,IAAI,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC;YACnD,CAAC,EAAE,CAAC;YACJ,SAAS;QACX,CAAC;QACD,IAAI,GAAG,KAAK,oBAAoB,EAAE,CAAC;YACjC,IAAI,qBAAqB,KAAK,SAAS;gBAAE,MAAM,IAAI,KAAK,CAAC,oBAAoB,GAAG,GAAG,CAAC,CAAC;YACrF,qBAAqB,GAAG,eAAe,CAAC,IAAI,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC;YACtD,CAAC,EAAE,CAAC;YACJ,SAAS;QACX,CAAC;QACD,IAAI,GAAG,KAAK,sBAAsB,EAAE,CAAC;YACnC,IAAI,kBAAkB,KAAK,SAAS;gBAAE,MAAM,IAAI,KAAK,CAAC,oBAAoB,GAAG,GAAG,CAAC,CAAC;YAClF,MAAM,GAAG,GAAG,eAAe,CAAC,IAAI,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC;YAC1C,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,GAAG,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;YAC/E,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;YAC3B,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;YACjF,kBAAkB,GAAG,MAAM,CAAC;YAC5B,CAAC,EAAE,CAAC;YACJ,SAAS;QACX,CAAC;QACD,IAAI,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,kBAAkB,GAAG,GAAG,CAAC,CAAC;QACpE,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACxB,CAAC;IACD,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,kBAAkB,CAAC,CAAC;IAC1F,OAAO;QACL,KAAK,EAAE,WAAW,CAAC,CAAC,CAAC;QACrB,UAAU,EAAE,WAAW,CAAC,CAAC,CAAC;QAC1B,kBAAkB;QAClB,qBAAqB;QACrB,kBAAkB;KACnB,CAAC;AACJ,CAAC;AACD,SAAS,IAAI,CAAC,IAAY,EAAE,KAAc,EAAE,WAAW,GAAG,KAAK;IAC7D,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE;QACzD,IAAI,EAAE,WAAW,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK;QACjC,IAAI,EAAE,IAAI;KACX,CAAC,CAAC;AACL,CAAC;AACD,KAAK,UAAU,IAAI,CAAC,IAAc;IAChC,MAAM,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC;IAChC,QAAQ,OAAO,EAAE,CAAC;QAChB,KAAK,WAAW,CAAC;QACjB,KAAK,IAAI;YACP,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,GAAG,CAAC,oBAAoB,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;YACtG,MAAM;QACR,KAAK,QAAQ;YACX,MAAM,aAAa,EAAE,CAAC;YACtB,MAAM;QACR,KAAK,OAAO;YACV,MAAM,YAAY,CAAC,IAAI,CAAC,CAAC;YACzB,MAAM;QACR,KAAK,UAAU;YACb,eAAe,CAAC,IAAI,CAAC,CAAC;YACtB,MAAM;QACR,KAAK,SAAS;YACZ,cAAc,CAAC,IAAI,CAAC,CAAC;YACrB,MAAM;QACR,KAAK,OAAO,CAAC;QACb,KAAK,QAAQ,CAAC;QACd,KAAK,UAAU,CAAC;QAChB,KAAK,UAAU,CAAC;QAChB,KAAK,QAAQ;YACX,MAAM,cAAc,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;YACpC,MAAM;QACR,KAAK,YAAY;YACf,MAAM,gBAAgB,CAAC,IAAI,CAAC,CAAC;YAC7B,MAAM;QACR,KAAK,QAAQ,CAAC,CAAC,CAAC;YACd,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;YACxF,MAAM,GAAG,GAAG,eAAe,EAAE,CAAC;YAC9B,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;YACzB,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;YAChE,MAAM;QACR,CAAC;QACD,KAAK,UAAU,CAAC,CAAC,CAAC;YAChB,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAC1D,IAAI,GAAG,IAAI,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAC/C,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI;gBAAE,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;YAC9F,cAAc,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;YACnC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YACrB,MAAM;QACR,CAAC;QACD,KAAK,SAAS,CAAC,CAAC,CAAC;YACf,MAAM,CAAC,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,UAAU,CAAC,GAAG,IAAI,CAAC;YAC7D,IAAI,CAAC,OAAO,IAAI,CAAC,IAAI,IAAI,CAAC,MAAM,IAAI,CAAC,UAAU,IAAI,CAAC,UAAU;gBAC5D,MAAM,IAAI,KAAK,CACb,4FAA4F,CAC7F,CAAC;YACJ,IACE,CAAC;gBACC,qBAAqB;gBACrB,sBAAsB;gBACtB,iBAAiB;gBACjB,cAAc;gBACd,oBAAoB;aACrB,CAAC,QAAQ,CAAC,IAAI,CAAC;gBAEhB,MAAM,IAAI,KAAK,CAAC,cAAc,CAAC,CAAC;YAClC,MAAM,OAAO,GAAG,YAAY,CAC1B,MAAM,EACN,IAAY,EACZ,IAAI,CAAC,UAAU,CAAC,EAChB,IAAI,CAAC,OAAO,CAAY,CACzB,CAAC;YACF,cAAc,CAAC,kBAAkB,EAAE,OAAO,CAAC,CAAC;YAC5C,IAAI,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;YAC1B,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,OAAO,CAAC,SAAS,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC;YAClF,MAAM;QACR,CAAC;QACD,KAAK,cAAc,CAAC,CAAC,CAAC;YACpB,MAAM,MAAM,GAAG,oBAAoB,CAAC,IAAI,CAAC,CAAC;YAC1C,MAAM,KAAK,GAAG,YAAY,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;YACjD,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC;gBAC5C,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC;gBACnB,CAAC,CAAE,IAAI,CAAC,KAAK,CAAC,KAAK,CAAiB,CAAC;YACvC,MAAM,OAAO,GAA6B,EAAE,CAAC;YAC7C,IAAI,MAAM,CAAC,UAAU,EAAE,CAAC;gBACtB,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,UAAU,CAA6B,CAAC;gBACjE,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;oBAC1D,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;gBAC1C,0EAA0E;gBAC1E,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC;gBAC3B,OAAO,CAAC,MAAM,GAAG,OAAO,IAAI,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;gBACpE,OAAO,CAAC,MAAM;oBACZ,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC;wBACpD,CAAC,CAAE,IAAI,CAAC,MAA2B;wBACnC,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;gBACf,IAAI,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ;oBAAE,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;YAC9D,CAAC;YACD,IAAI,MAAM,CAAC,kBAAkB,KAAK,SAAS;gBACzC,OAAO,CAAC,kBAAkB,GAAG,MAAM,CAAC,kBAAkB,CAAC;YACzD,IAAI,MAAM,CAAC,qBAAqB,KAAK,SAAS;gBAC5C,OAAO,CAAC,qBAAqB,GAAG,MAAM,CAAC,qBAAqB,CAAC;YAC/D,IAAI,MAAM,CAAC,kBAAkB,KAAK,SAAS;gBACzC,OAAO,CAAC,kBAAkB,GAAG,MAAM,CAAC,kBAAkB,CAAC;YACzD,MAAM,QAAQ,GACZ,MAAM,CAAC,UAAU,KAAK,SAAS;gBAC/B,MAAM,CAAC,kBAAkB,KAAK,SAAS;gBACvC,MAAM,CAAC,qBAAqB,KAAK,SAAS;gBAC1C,MAAM,CAAC,kBAAkB,KAAK,SAAS,CAAC;YAC1C,MAAM,MAAM,GAAG,WAAW,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;YACnE,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;YACpC,IAAI,CAAC,MAAM,CAAC,KAAK;gBAAE,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;YACxC,MAAM;QACR,CAAC;QACD,KAAK,MAAM,CAAC,CAAC,CAAC;YACZ,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,EACvC,SAAS,GAAG,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YACvD,IAAI,KAAK,IAAI,CAAC,IAAI,CAAC,SAAS;gBAAE,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;YAC3E,IAAI,SAAS;gBAAE,SAAS,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;YACtE,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,OAAO,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;YAC/D,MAAM;QACR,CAAC;QACD;YACE,MAAM,IAAI,KAAK,CACb,8IAA8I,CAC/I,CAAC;IACN,CAAC;AACH,CAAC;AACD,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;IAC1C,OAAO,CAAC,KAAK,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC,CAAC;IACrC,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;AACvB,CAAC,CAAC,CAAC"}
@@ -0,0 +1,16 @@
1
+ import type { Invite, KeyPair } from '@acp/core';
2
+ export declare function inviteToken(value: string): string;
3
+ export declare function openInvite(value: string, now?: number): Invite;
4
+ export declare function shareLink(token: string, host: string): string;
5
+ /** The QR contains exactly the verified link; no remote shortening or QR service. */
6
+ export declare function renderInviteQr(link: string, format: 'terminal' | 'svg' | 'png'): Promise<string | Buffer>;
7
+ export declare function verifiedExpiredInvite(value: string): Invite;
8
+ export declare function reissueInvite(value: string, key: KeyPair, seconds?: number, agentKey?: KeyPair): string;
9
+ export declare function friendlyExpiry(expiresAt: string, now?: number, locale?: string, timeZone?: string): string;
10
+ /** Validate remote input before touching local identity; never replace an existing key. */
11
+ export declare function setupInvite(value: string, keyPath: string, contactPath: string, out: string, name?: string): {
12
+ ownerDid: string;
13
+ keyFile: string;
14
+ reciprocalInviteFile: string;
15
+ };
16
+ export declare function inviteShareCommand(action: string, args: string[]): Promise<void>;
@@ -0,0 +1,163 @@
1
+ // SPDX-License-Identifier: Apache-2.0
2
+ import { readFileSync, writeFileSync, mkdirSync, lstatSync } from 'node:fs';
3
+ import { dirname, join } from 'node:path';
4
+ import { randomUUID } from 'node:crypto';
5
+ import { createInterface } from 'node:readline/promises';
6
+ import QRCode from 'qrcode';
7
+ import { createInviteToken, createSignedAgentCard, generateKeyPair, inviteTokenFromUri, parseAndVerifyInviteToken, signPayload, verifySigned } from '../../packages/core/dist/index.js';
8
+ import { addContact, contactsPath } from './contacts.js';
9
+ export function inviteToken(value) {
10
+ return inviteTokenFromUri(value);
11
+ }
12
+ export function openInvite(value, now = Date.now()) {
13
+ return parseAndVerifyInviteToken(inviteToken(value), now);
14
+ }
15
+ export function shareLink(token, host) {
16
+ openInvite(token);
17
+ const u = new URL(host);
18
+ if (u.protocol !== 'https:' || u.username || u.password || u.search || u.hash)
19
+ throw new Error('INVALID_SHARE_HOST');
20
+ u.hash = inviteToken(token);
21
+ return u.href;
22
+ }
23
+ /** The QR contains exactly the verified link; no remote shortening or QR service. */
24
+ export async function renderInviteQr(link, format) {
25
+ openInvite(link);
26
+ try {
27
+ if (format === 'png')
28
+ return await QRCode.toBuffer(link, { errorCorrectionLevel: 'L', margin: 4 });
29
+ return await QRCode.toString(link, { type: format, errorCorrectionLevel: 'L', margin: 4 });
30
+ }
31
+ catch {
32
+ throw new Error('QR_CAPACITY_EXCEEDED: share the full link instead; no truncated QR was created');
33
+ }
34
+ }
35
+ export function verifiedExpiredInvite(value) {
36
+ const token = inviteToken(value);
37
+ let issuedAt;
38
+ try {
39
+ issuedAt = JSON.parse(Buffer.from(token.slice(11), 'base64url').toString()).payload.issuedAt;
40
+ }
41
+ catch {
42
+ throw new Error('INVALID_INVITE');
43
+ }
44
+ const time = Date.parse(issuedAt);
45
+ if (!Number.isFinite(time) || time > Date.now())
46
+ throw new Error('INVALID_INVITE');
47
+ return parseAndVerifyInviteToken(token, time);
48
+ }
49
+ export function reissueInvite(value, key, seconds = 86400, agentKey) {
50
+ const old = verifiedExpiredInvite(value);
51
+ if (old.ownerDid !== key.did)
52
+ throw new Error('INVITE_ISSUER_KEY_REQUIRED');
53
+ const { type: _type, ownerDid: _owner, agentDelegation: _delegation, ...card } = old.agentCard.payload;
54
+ return createInviteToken({ agentCard: createSignedAgentCard({ ...card,
55
+ expiresAt: new Date(Date.now() + seconds * 1000).toISOString() }, key, agentKey), expiresInSeconds: seconds }, key);
56
+ }
57
+ export function friendlyExpiry(expiresAt, now = Date.now(), locale, timeZone) {
58
+ const date = new Date(expiresAt), remaining = date.getTime() - now;
59
+ if (!Number.isFinite(remaining))
60
+ throw new Error('INVALID_INVITE_EXPIRY');
61
+ const minutes = Math.max(1, Math.ceil(Math.abs(remaining) / 60000));
62
+ const amount = minutes < 60 ? `${minutes} minute${minutes === 1 ? '' : 's'}`
63
+ : `${Math.ceil(minutes / 60)} hour${Math.ceil(minutes / 60) === 1 ? '' : 's'}`;
64
+ const local = new Intl.DateTimeFormat(locale, { dateStyle: 'medium', timeStyle: 'long', timeZone }).format(date);
65
+ return remaining > 0 ? `Expires in ${amount} (${local})` : `Expired ${amount} ago (${local})`;
66
+ }
67
+ /** Validate remote input before touching local identity; never replace an existing key. */
68
+ export function setupInvite(value, keyPath, contactPath, out, name) {
69
+ const invite = openInvite(value);
70
+ let key;
71
+ try {
72
+ if (!lstatSync(keyPath).isFile())
73
+ throw new Error('INVALID_IDENTITY_FILE');
74
+ key = JSON.parse(readFileSync(keyPath, 'utf8'));
75
+ }
76
+ catch (error) {
77
+ if (error.code !== 'ENOENT')
78
+ throw error;
79
+ key = generateKeyPair();
80
+ mkdirSync(dirname(keyPath), { recursive: true, mode: 0o700 });
81
+ writeFileSync(keyPath, JSON.stringify(key), { flag: 'wx', mode: 0o600 });
82
+ }
83
+ if (!verifySigned(signPayload({ type: 'IdentityCheck' }, key), key.did))
84
+ throw new Error('INVALID_IDENTITY_KEY');
85
+ if (key.did === invite.ownerDid)
86
+ throw new Error('SELF_INVITE');
87
+ const card = createSignedAgentCard({ name: 'Sealbridge contact', agentDid: key.did, relayEndpoint: invite.relayUrl,
88
+ skills: [{ id: 'json-task', name: 'JSON task' }], accessMode: 'invite-only',
89
+ expiresAt: new Date(Date.now() + 86400000).toISOString() }, key);
90
+ const reciprocal = createInviteToken({ agentCard: card, expiresInSeconds: 86400 }, key);
91
+ writeFileSync(out, reciprocal, { flag: 'wx', mode: 0o600 });
92
+ addContact(contactPath, key, inviteToken(value), name);
93
+ return { ownerDid: key.did, keyFile: keyPath, reciprocalInviteFile: out };
94
+ }
95
+ async function confirm(message) {
96
+ const rl = createInterface({ input: process.stdin, output: process.stderr });
97
+ try {
98
+ if ((await rl.question(message + ' Type yes: ')).trim() !== 'yes')
99
+ throw new Error('APPROVAL_REJECTED');
100
+ }
101
+ finally {
102
+ rl.close();
103
+ }
104
+ }
105
+ export async function inviteShareCommand(action, args) {
106
+ const allowed = ['--file', '--host', '--png', '--svg', '--save-contact', '--key', '--agent-key', '--contacts', '--out', '--request'];
107
+ const flags = new Map();
108
+ for (let i = 0; i < args.length; i += 2) {
109
+ if (!allowed.includes(args[i]) || flags.has(args[i]) || !args[i + 1] || args[i + 1].startsWith('--'))
110
+ throw new Error('INVALID_INVITE_OPTION: automatic approval is not supported');
111
+ flags.set(args[i], args[i + 1]);
112
+ }
113
+ const need = (name) => { const v = flags.get('--' + name); if (!v)
114
+ throw new Error('Missing --' + name); return v; };
115
+ const value = readFileSync(need('file'), 'utf8').trim();
116
+ if (action === 'open') {
117
+ const p = openInvite(value);
118
+ const contactPath = flags.get('--contacts') ?? contactsPath();
119
+ const keyPath = flags.get('--key') ?? join(dirname(contactsPath()), 'owner.private.json');
120
+ const out = flags.get('--out') ?? join(dirname(keyPath), 'reciprocal-' + randomUUID() + '.txt');
121
+ const local = setupInvite(value, keyPath, contactPath, out, flags.get('--save-contact'));
122
+ const expiresAt = new Date(Math.min(Date.parse(p.expiresAt), Date.parse(p.agentCard.payload.expiresAt))).toISOString();
123
+ console.log(JSON.stringify({ name: p.agentCard.payload.name, ownerDid: p.ownerDid, agentDid: p.agentDid,
124
+ relay: p.relayUrl, expires: friendlyExpiry(expiresAt), expiresAt, local,
125
+ nextStep: 'Share reciprocalInviteFile with the inviter through your trusted channel. Start a sandbox worker with keyFile and this relay to receive JSON jobs.',
126
+ approval: 'Opening an invite does not approve work or allow automatic acceptance.' }));
127
+ }
128
+ else if (action === 'share') {
129
+ const link = shareLink(value, need('host'));
130
+ console.log(link);
131
+ console.log(await renderInviteQr(link, 'terminal'));
132
+ for (const type of ['png', 'svg'])
133
+ if (flags.has('--' + type))
134
+ writeFileSync(need(type), await renderInviteQr(link, type), { flag: 'wx', mode: 0o600 });
135
+ }
136
+ else if (action === 'request-reissue') {
137
+ const old = verifiedExpiredInvite(value);
138
+ const key = JSON.parse(readFileSync(need('key'), 'utf8'));
139
+ const request = signPayload({ type: 'InviteReissueRequest', requesterDid: key.did,
140
+ issuerDid: old.ownerDid, createdAt: new Date().toISOString() }, key);
141
+ writeFileSync(need('out'), JSON.stringify(request), { flag: 'wx', mode: 0o600 });
142
+ console.log('Re-issue request saved. Send it to the issuer for approval.');
143
+ }
144
+ else if (action === 'reissue') {
145
+ const key = JSON.parse(readFileSync(need('key'), 'utf8'));
146
+ if (flags.has('--request')) {
147
+ const r = JSON.parse(readFileSync(need('request'), 'utf8'));
148
+ if (!verifySigned(r, r.payload.requesterDid) || r.payload.type !== 'InviteReissueRequest' ||
149
+ r.payload.issuerDid !== key.did || !Number.isFinite(Date.parse(r.payload.createdAt)) ||
150
+ Math.abs(Date.now() - Date.parse(r.payload.createdAt)) > 86400000)
151
+ throw new Error('INVALID_REISSUE_REQUEST');
152
+ await confirm('Approve re-issue requested by ' + r.payload.requesterDid + '?');
153
+ }
154
+ else
155
+ await confirm('Approve a fresh 24-hour invite for the same identity?');
156
+ const agentKey = flags.has('--agent-key') ? JSON.parse(readFileSync(need('agent-key'), 'utf8')) : undefined;
157
+ writeFileSync(need('out'), reissueInvite(value, key, 86400, agentKey), { flag: 'wx', mode: 0o600 });
158
+ console.log('Fresh invite saved. Previous invite retains its own expiry/revocation.');
159
+ }
160
+ else
161
+ throw new Error('INVALID_INVITE_ACTION');
162
+ }
163
+ //# sourceMappingURL=invite-share.js.map
@@ -0,0 +1 @@
1
+ {"version":3,"file":"invite-share.js","sourceRoot":"","sources":["../src/invite-share.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AAC5E,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACzD,OAAO,MAAM,MAAM,QAAQ,CAAC;AAC5B,OAAO,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,eAAe,EAAE,kBAAkB,EAAE,yBAAyB,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AAEhK,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAEzD,MAAM,UAAU,WAAW,CAAC,KAAa;IACvC,OAAO,kBAAkB,CAAC,KAAK,CAAC,CAAC;AACnC,CAAC;AACD,MAAM,UAAU,UAAU,CAAC,KAAa,EAAE,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE;IACxD,OAAO,yBAAyB,CAAC,WAAW,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC;AAC5D,CAAC;AACD,MAAM,UAAU,SAAS,CAAC,KAAa,EAAE,IAAY;IACnD,UAAU,CAAC,KAAK,CAAC,CAAC;IAClB,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC;IACxB,IAAI,CAAC,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,IAAI;QAC3E,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAC;IACxC,CAAC,CAAC,IAAI,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC;IAC5B,OAAO,CAAC,CAAC,IAAI,CAAC;AAChB,CAAC;AACD,qFAAqF;AACrF,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,IAAY,EAAE,MAAkC;IACnF,UAAU,CAAC,IAAI,CAAC,CAAC;IACjB,IAAI,CAAC;QACH,IAAI,MAAM,KAAK,KAAK;YAAE,OAAO,MAAM,MAAM,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,oBAAoB,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC;QACnG,OAAO,MAAM,MAAM,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,oBAAoB,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC;IAC7F,CAAC;IAAC,MAAM,CAAC;QAAC,MAAM,IAAI,KAAK,CAAC,gFAAgF,CAAC,CAAC;IAAC,CAAC;AAChH,CAAC;AACD,MAAM,UAAU,qBAAqB,CAAC,KAAa;IACjD,MAAM,KAAK,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC;IACjC,IAAI,QAAgB,CAAC;IACrB,IAAI,CAAC;QAAC,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,WAAW,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC;IAAC,CAAC;IACrG,MAAM,CAAC;QAAC,MAAM,IAAI,KAAK,CAAC,gBAAgB,CAAC,CAAC;IAAC,CAAC;IAC5C,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IAClC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,gBAAgB,CAAC,CAAC;IACnF,OAAO,yBAAyB,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;AAChD,CAAC;AACD,MAAM,UAAU,aAAa,CAAC,KAAa,EAAE,GAAY,EAAE,OAAO,GAAG,KAAK,EAAE,QAAkB;IAC5F,MAAM,GAAG,GAAG,qBAAqB,CAAC,KAAK,CAAC,CAAC;IACzC,IAAI,GAAG,CAAC,QAAQ,KAAK,GAAG,CAAC,GAAG;QAAE,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;IAC5E,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,eAAe,EAAE,WAAW,EAAE,GAAG,IAAI,EAAE,GAAG,GAAG,CAAC,SAAS,CAAC,OAAO,CAAC;IACvG,OAAO,iBAAiB,CAAC,EAAE,SAAS,EAAE,qBAAqB,CAAC,EAAE,GAAG,IAAI;YACnE,SAAS,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE,EAAE,EAAE,GAAG,EAAE,QAAQ,CAAC,EAAE,gBAAgB,EAAE,OAAO,EAAE,EAAE,GAAG,CAAC,CAAC;AACxH,CAAC;AACD,MAAM,UAAU,cAAc,CAAC,SAAiB,EAAE,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,MAAe,EAAE,QAAiB;IACpG,MAAM,IAAI,GAAG,IAAI,IAAI,CAAC,SAAS,CAAC,EAAE,SAAS,GAAG,IAAI,CAAC,OAAO,EAAE,GAAG,GAAG,CAAC;IACnE,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;IAC1E,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC;IACpE,MAAM,MAAM,GAAG,OAAO,GAAG,EAAE,CAAC,CAAC,CAAC,GAAG,OAAO,UAAU,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,EAAE;QAC1E,CAAC,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,GAAG,EAAE,CAAC,QAAQ,IAAI,CAAC,IAAI,CAAC,OAAO,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC;IACjF,MAAM,KAAK,GAAG,IAAI,IAAI,CAAC,cAAc,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACjH,OAAO,SAAS,GAAG,CAAC,CAAC,CAAC,CAAC,cAAc,MAAM,KAAK,KAAK,GAAG,CAAC,CAAC,CAAC,WAAW,MAAM,SAAS,KAAK,GAAG,CAAC;AAChG,CAAC;AACD,2FAA2F;AAC3F,MAAM,UAAU,WAAW,CAAC,KAAa,EAAE,OAAe,EAAE,WAAmB,EAAE,GAAW,EAAE,IAAa;IACzG,MAAM,MAAM,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC;IACjC,IAAI,GAAY,CAAC;IACjB,IAAI,CAAC;QACH,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;QAC3E,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,OAAO,EAAE,MAAM,CAAC,CAAY,CAAC;IAC7D,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;YAAE,MAAM,KAAK,CAAC;QACpE,GAAG,GAAG,eAAe,EAAE,CAAC;QACxB,SAAS,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAC9D,aAAa,CAAC,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC3E,CAAC;IACD,IAAI,CAAC,YAAY,CAAC,WAAW,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,EAAE,GAAG,CAAC,EAAE,GAAG,CAAC,GAAG,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;IACjH,IAAI,GAAG,CAAC,GAAG,KAAK,MAAM,CAAC,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,aAAa,CAAC,CAAC;IAChE,MAAM,IAAI,GAAG,qBAAqB,CAAC,EAAE,IAAI,EAAE,oBAAoB,EAAE,QAAQ,EAAE,GAAG,CAAC,GAAG,EAAE,aAAa,EAAE,MAAM,CAAC,QAAQ;QAChH,MAAM,EAAE,CAAC,EAAE,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,EAAE,UAAU,EAAE,aAAa;QAC3E,SAAS,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,CAAC,CAAC,WAAW,EAAE,EAAE,EAAE,GAAG,CAAC,CAAC;IACnE,MAAM,UAAU,GAAG,iBAAiB,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,gBAAgB,EAAE,KAAK,EAAE,EAAE,GAAG,CAAC,CAAC;IACxF,aAAa,CAAC,GAAG,EAAE,UAAU,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC5D,UAAU,CAAC,WAAW,EAAE,GAAG,EAAE,WAAW,CAAC,KAAK,CAAC,EAAE,IAAI,CAAC,CAAC;IACvD,OAAO,EAAE,QAAQ,EAAE,GAAG,CAAC,GAAG,EAAE,OAAO,EAAE,OAAO,EAAE,oBAAoB,EAAE,GAAG,EAAE,CAAC;AAC5E,CAAC;AAED,KAAK,UAAU,OAAO,CAAC,OAAe;IACpC,MAAM,EAAE,GAAG,eAAe,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IAC7E,IAAI,CAAC;QAAC,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,OAAO,GAAG,aAAa,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,KAAK;YAAE,MAAM,IAAI,KAAK,CAAC,mBAAmB,CAAC,CAAC;IAAC,CAAC;YACxG,CAAC;QAAC,EAAE,CAAC,KAAK,EAAE,CAAC;IAAC,CAAC;AACzB,CAAC;AACD,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,MAAc,EAAE,IAAc;IACrE,MAAM,OAAO,GAAG,CAAC,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,gBAAgB,EAAE,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,OAAO,EAAE,WAAW,CAAC,CAAC;IACrI,MAAM,KAAK,GAAG,IAAI,GAAG,EAAkB,CAAC;IACxC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QACxC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC;YAClG,MAAM,IAAI,KAAK,CAAC,4DAA4D,CAAC,CAAC;QAChF,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IAClC,CAAC;IACD,MAAM,IAAI,GAAG,CAAC,IAAY,EAAE,EAAE,GAAG,MAAM,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,YAAY,GAAG,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;IAC7H,MAAM,KAAK,GAAG,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;IACxD,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;QACtB,MAAM,CAAC,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC;QAC5B,MAAM,WAAW,GAAG,KAAK,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,YAAY,EAAE,CAAC;QAC9D,MAAM,OAAO,GAAG,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,CAAC,EAAE,oBAAoB,CAAC,CAAC;QAC1F,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,aAAa,GAAG,UAAU,EAAE,GAAG,MAAM,CAAC,CAAC;QAChG,MAAM,KAAK,GAAG,WAAW,CAAC,KAAK,EAAE,OAAO,EAAE,WAAW,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAC;QACzF,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;QACvH,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ;YACrG,KAAK,EAAE,CAAC,CAAC,QAAQ,EAAE,OAAO,EAAE,cAAc,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,KAAK;YACvE,QAAQ,EAAE,oJAAoJ;YAC9J,QAAQ,EAAE,wEAAwE,EAAE,CAAC,CAAC,CAAC;IAC3F,CAAC;SAAM,IAAI,MAAM,KAAK,OAAO,EAAE,CAAC;QAC9B,MAAM,IAAI,GAAG,SAAS,CAAC,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;QAC5C,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAClB,OAAO,CAAC,GAAG,CAAC,MAAM,cAAc,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC,CAAC;QACpD,KAAK,MAAM,IAAI,IAAI,CAAC,KAAK,EAAE,KAAK,CAAU;YAAE,IAAI,KAAK,CAAC,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC;gBACpE,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,MAAM,cAAc,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC7F,CAAC;SAAM,IAAI,MAAM,KAAK,iBAAiB,EAAE,CAAC;QACxC,MAAM,GAAG,GAAG,qBAAqB,CAAC,KAAK,CAAC,CAAC;QACzC,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,CAAY,CAAC;QACrE,MAAM,OAAO,GAAG,WAAW,CAAiB,EAAE,IAAI,EAAE,sBAAsB,EAAE,YAAY,EAAE,GAAG,CAAC,GAAG;YAC/F,SAAS,EAAE,GAAG,CAAC,QAAQ,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,EAAE,GAAG,CAAC,CAAC;QACvE,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACjF,OAAO,CAAC,GAAG,CAAC,6DAA6D,CAAC,CAAC;IAC7E,CAAC;SAAM,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QAChC,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,CAAY,CAAC;QACrE,IAAI,KAAK,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC;YAC3B,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC,CAA2B,CAAC;YACtF,IAAI,CAAC,YAAY,CAAC,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,IAAI,KAAK,sBAAsB;gBACrF,CAAC,CAAC,OAAO,CAAC,SAAS,KAAK,GAAG,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;gBACpF,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,GAAG,QAAQ;gBAAE,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC;YAClH,MAAM,OAAO,CAAC,gCAAgC,GAAG,CAAC,CAAC,OAAO,CAAC,YAAY,GAAG,GAAG,CAAC,CAAC;QACjF,CAAC;;YAAM,MAAM,OAAO,CAAC,uDAAuD,CAAC,CAAC;QAC9E,MAAM,QAAQ,GAAG,KAAK,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC,CAAY,CAAC,CAAC,CAAC,SAAS,CAAC;QACvH,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,aAAa,CAAC,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACpG,OAAO,CAAC,GAAG,CAAC,wEAAwE,CAAC,CAAC;IACxF,CAAC;;QAAM,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;AAClD,CAAC"}
@@ -0,0 +1,17 @@
1
+ import type { KeyPair } from '@acp/core';
2
+ import type { AcpMcpServerOptions } from '@acp/runtime';
3
+ export interface ParsedMcpServerArgs {
4
+ keyFile?: string;
5
+ relay?: string;
6
+ allowedWorkerDids?: string[];
7
+ allowedRelayUrls?: string[];
8
+ allowPrivateRelay: boolean;
9
+ requireInteractiveApproval: boolean;
10
+ approvalWebhookUrl?: string;
11
+ }
12
+ /** Parse `acp mcp-server` flags without reading the owner key or opening stdio. */
13
+ export declare function parseMcpServerArgs(args: string[]): ParsedMcpServerArgs;
14
+ /** Map parsed flags onto server options. Does not read a key file or open stdio. */
15
+ export declare function mcpServerOptionsFromArgs(parsed: ParsedMcpServerArgs, owner: KeyPair): AcpMcpServerOptions;
16
+ /** `acp mcp-server` speaks MCP over stdio with an outbound allowlist and approval policy. */
17
+ export declare function mcpServerCommand(args: string[]): Promise<void>;
@@ -0,0 +1,105 @@
1
+ // SPDX-License-Identifier: Apache-2.0
2
+ import { readFileSync } from 'node:fs';
3
+ import { generateKeyPair } from '../../packages/core/dist/index.js';
4
+ import { AcpMcpServer } from '../../packages/runtime/dist/index.js';
5
+ const REPEATABLE = new Set(['--allow-worker', '--allow-relay']);
6
+ const KNOWN = new Set([
7
+ '--key',
8
+ '--relay',
9
+ '--allow-worker',
10
+ '--allow-relay',
11
+ '--allow-private-relay',
12
+ '--require-approval',
13
+ '--approval-webhook',
14
+ ]);
15
+ const USAGE = 'Usage: sealbridge mcp-server [--key <file>] [--relay URL] [--allow-private-relay] [--allow-worker <did>] [--allow-relay <url>] [--require-approval | --approval-webhook <url>]';
16
+ function flags(args) {
17
+ const out = new Map();
18
+ for (let i = 0; i < args.length; i++) {
19
+ const arg = args[i];
20
+ if (!arg.startsWith('--'))
21
+ throw new Error('Unexpected argument: ' + arg);
22
+ if (!KNOWN.has(arg))
23
+ throw new Error('Unexpected argument: ' + arg);
24
+ const next = args[i + 1];
25
+ const value = next && !next.startsWith('--') ? args[++i] : true;
26
+ if (REPEATABLE.has(arg)) {
27
+ if (typeof value !== 'string' || value.trim() === '')
28
+ throw new Error('Missing ' + arg);
29
+ const previous = out.get(arg);
30
+ out.set(arg, (typeof previous === 'string' && previous ? previous + ',' : '') + value);
31
+ continue;
32
+ }
33
+ if (out.has(arg))
34
+ throw new Error('Duplicate option: ' + arg);
35
+ out.set(arg, value);
36
+ }
37
+ return out;
38
+ }
39
+ function listOption(parsed, name) {
40
+ if (!parsed.has(name))
41
+ return undefined;
42
+ const raw = parsed.get(name);
43
+ if (typeof raw !== 'string')
44
+ throw new Error('Missing ' + name);
45
+ const values = raw
46
+ .split(',')
47
+ .map((part) => part.trim())
48
+ .filter(Boolean);
49
+ if (values.length === 0)
50
+ throw new Error('Missing ' + name);
51
+ return values;
52
+ }
53
+ /** Parse `acp mcp-server` flags without reading the owner key or opening stdio. */
54
+ export function parseMcpServerArgs(args) {
55
+ const parsed = flags(args);
56
+ if (parsed.has('--require-approval') && parsed.has('--approval-webhook'))
57
+ throw new Error('Use either --require-approval or --approval-webhook');
58
+ const relay = parsed.get('--relay');
59
+ if (parsed.has('--relay') && typeof relay !== 'string')
60
+ throw new Error('Missing --relay');
61
+ const webhook = parsed.get('--approval-webhook');
62
+ if (parsed.has('--approval-webhook') && typeof webhook !== 'string')
63
+ throw new Error('Missing --approval-webhook');
64
+ const key = parsed.get('--key');
65
+ if (parsed.has('--key') && typeof key !== 'string')
66
+ throw new Error(USAGE);
67
+ return {
68
+ keyFile: typeof key === 'string' ? key : undefined,
69
+ relay: typeof relay === 'string' ? relay : undefined,
70
+ allowedWorkerDids: listOption(parsed, '--allow-worker'),
71
+ allowedRelayUrls: listOption(parsed, '--allow-relay'),
72
+ allowPrivateRelay: parsed.has('--allow-private-relay'),
73
+ requireInteractiveApproval: parsed.has('--require-approval'),
74
+ approvalWebhookUrl: typeof webhook === 'string' ? webhook : undefined,
75
+ };
76
+ }
77
+ /** Map parsed flags onto server options. Does not read a key file or open stdio. */
78
+ export function mcpServerOptionsFromArgs(parsed, owner) {
79
+ return {
80
+ owner,
81
+ relay: parsed.relay,
82
+ allowedWorkerDids: parsed.allowedWorkerDids,
83
+ allowedRelayUrls: parsed.allowedRelayUrls,
84
+ allowPrivateRelay: parsed.allowPrivateRelay,
85
+ requireInteractiveApproval: parsed.requireInteractiveApproval,
86
+ approvalWebhookUrl: parsed.approvalWebhookUrl,
87
+ };
88
+ }
89
+ /** `acp mcp-server` speaks MCP over stdio with an outbound allowlist and approval policy. */
90
+ export async function mcpServerCommand(args) {
91
+ const parsed = parseMcpServerArgs(args);
92
+ const server = new AcpMcpServer(mcpServerOptionsFromArgs(parsed, resolveOwner(parsed.keyFile)));
93
+ await server.serve(process.stdin, process.stdout);
94
+ }
95
+ /**
96
+ * Load `--key <file>` when it is present. Omitting `--key` mints an in-memory
97
+ * Ed25519 identity so MCP scanners can call `initialize` and `tools/list`
98
+ * without a persisted owner key. `--key` with no path is still a usage error.
99
+ */
100
+ function resolveOwner(keyFile) {
101
+ if (!keyFile)
102
+ return generateKeyPair();
103
+ return JSON.parse(readFileSync(keyFile, 'utf8'));
104
+ }
105
+ //# sourceMappingURL=mcp.js.map
@@ -0,0 +1 @@
1
+ {"version":3,"file":"mcp.js","sourceRoot":"","sources":["../src/mcp.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAEvC,OAAO,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AAC5C,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAG5C,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,CAAC,gBAAgB,EAAE,eAAe,CAAC,CAAC,CAAC;AAChE,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC;IACpB,OAAO;IACP,SAAS;IACT,gBAAgB;IAChB,eAAe;IACf,uBAAuB;IACvB,oBAAoB;IACpB,oBAAoB;CACrB,CAAC,CAAC;AACH,MAAM,KAAK,GACT,gLAAgL,CAAC;AAEnL,SAAS,KAAK,CAAC,IAAc;IAC3B,MAAM,GAAG,GAAG,IAAI,GAAG,EAAyB,CAAC;IAC7C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QACpB,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,uBAAuB,GAAG,GAAG,CAAC,CAAC;QAC1E,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,uBAAuB,GAAG,GAAG,CAAC,CAAC;QACpE,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QACzB,MAAM,KAAK,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAChE,IAAI,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YACxB,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE;gBAAE,MAAM,IAAI,KAAK,CAAC,UAAU,GAAG,GAAG,CAAC,CAAC;YACxF,MAAM,QAAQ,GAAG,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YAC9B,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,CAAC,CAAC,CAAC,QAAQ,GAAG,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,CAAC;YACvF,SAAS;QACX,CAAC;QACD,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,oBAAoB,GAAG,GAAG,CAAC,CAAC;QAC9D,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IACtB,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,UAAU,CAAC,MAAkC,EAAE,IAAY;IAClE,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC;QAAE,OAAO,SAAS,CAAC;IACxC,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC7B,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,UAAU,GAAG,IAAI,CAAC,CAAC;IAChE,MAAM,MAAM,GAAG,GAAG;SACf,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;SAC1B,MAAM,CAAC,OAAO,CAAC,CAAC;IACnB,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,UAAU,GAAG,IAAI,CAAC,CAAC;IAC5D,OAAO,MAAM,CAAC;AAChB,CAAC;AAYD,mFAAmF;AACnF,MAAM,UAAU,kBAAkB,CAAC,IAAc;IAC/C,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC;IAC3B,IAAI,MAAM,CAAC,GAAG,CAAC,oBAAoB,CAAC,IAAI,MAAM,CAAC,GAAG,CAAC,oBAAoB,CAAC;QACtE,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;IACzE,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IACpC,IAAI,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,iBAAiB,CAAC,CAAC;IAC3F,MAAM,OAAO,GAAG,MAAM,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC;IACjD,IAAI,MAAM,CAAC,GAAG,CAAC,oBAAoB,CAAC,IAAI,OAAO,OAAO,KAAK,QAAQ;QACjE,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;IAChD,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IAChC,IAAI,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC;IAC3E,OAAO;QACL,OAAO,EAAE,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS;QAClD,KAAK,EAAE,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS;QACpD,iBAAiB,EAAE,UAAU,CAAC,MAAM,EAAE,gBAAgB,CAAC;QACvD,gBAAgB,EAAE,UAAU,CAAC,MAAM,EAAE,eAAe,CAAC;QACrD,iBAAiB,EAAE,MAAM,CAAC,GAAG,CAAC,uBAAuB,CAAC;QACtD,0BAA0B,EAAE,MAAM,CAAC,GAAG,CAAC,oBAAoB,CAAC;QAC5D,kBAAkB,EAAE,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS;KACtE,CAAC;AACJ,CAAC;AAED,oFAAoF;AACpF,MAAM,UAAU,wBAAwB,CACtC,MAA2B,EAC3B,KAAc;IAEd,OAAO;QACL,KAAK;QACL,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,iBAAiB,EAAE,MAAM,CAAC,iBAAiB;QAC3C,gBAAgB,EAAE,MAAM,CAAC,gBAAgB;QACzC,iBAAiB,EAAE,MAAM,CAAC,iBAAiB;QAC3C,0BAA0B,EAAE,MAAM,CAAC,0BAA0B;QAC7D,kBAAkB,EAAE,MAAM,CAAC,kBAAkB;KAC9C,CAAC;AACJ,CAAC;AAED,6FAA6F;AAC7F,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,IAAc;IACnD,MAAM,MAAM,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC;IACxC,MAAM,MAAM,GAAG,IAAI,YAAY,CAAC,wBAAwB,CAAC,MAAM,EAAE,YAAY,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;IAChG,MAAM,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;AACpD,CAAC;AAED;;;;GAIG;AACH,SAAS,YAAY,CAAC,OAA2B;IAC/C,IAAI,CAAC,OAAO;QAAE,OAAO,eAAe,EAAE,CAAC;IACvC,OAAO,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,OAAO,EAAE,MAAM,CAAC,CAAY,CAAC;AAC9D,CAAC"}
@@ -0,0 +1 @@
1
+ export declare function networkCommand(command: string, args: string[]): Promise<void>;