sealbridge 0.1.0 → 0.2.1

package/README.ja.md

@@ -14,10 +14,12 @@ Windows PowerShell:
 irm https://sealbridge.dev/install.ps1 | iex
 ```
 
-リリース準備中: インストーラーは sealbridge 0.1.0 を固定指定します。一般利用には同バージョンの npm 公開が必要です。このPRでは公開・デプロイしません。公開後、Node 22以上があれば `npm i -g sealbridge` または `npx sealbridge@latest` も使えます。
+インストーラーは現在のリリース sealbridge 0.2.0 を固定指定しており、同バージョンは npm で公開済みです。Node 22以上があれば `npm i -g sealbridge` または `npx sealbridge@latest` も使えます。
 
 ユーザー専用ディレクトリに導入し、Nodeが必要な場合は公式Node 22.22.0のチェックサムを検証します。秘密情報の入力・テレメトリー・管理者権限・Git・pnpmは不要です。macOS/Linuxでは新しいターミナルを開くか `. "$HOME/.profile"` を実行してください（パイプ実行では親シェルのPATHを変更できません）。Windowsでは現在と次回のPATHを設定します。`sealbridge doctor`、`sealbridge demo` で確認できます。doctorは中継器のヘルスチェックを1回行います。オフライン警告があってもインストールは保持します。
 
+インストーラーと `sealbridge doctor` は、Node 実行ファイルの解決済みパスとバージョンを表示します。Windows では、インストール先の npm ランチャーが使う Node を確認します。ランチャーと同じディレクトリにある `node.exe` が PATH より優先されます。macOS/Linux では PATH 上の Node を使います。doctor は自身を実行している Node を表示するため、後から PATH を変更すると結果が変わる場合があります。正常な項目は短い `(OK)` 行で表示し、対処方法は `(WARN)` 行だけに表示します。ワーカー鍵がなくても正常です。タスクを受け取る前に `.acp` ディレクトリを作成して `sealbridge keygen "$HOME/.acp/worker.private.json"` を実行するか、`--key` で既存の鍵を指定してください。
+
 削除はスクリプトを保存して `sh install.sh --uninstall` または `& ./install.ps1 -Uninstall`（PowerShellでの --uninstall 表記）を実行します。鍵は保持します。Unixではシェル設定の `# sealbridge installer` 行も削除してください。npmのみの導入は `npm uninstall -g sealbridge` で削除できます。保存先は `~/.local/share/sealbridge` と `%LOCALAPPDATA%\Sealbridge` です。
 
 
@@ -32,19 +34,23 @@ irm https://sealbridge.dev/install.ps1 | iex
 [招待共有・公開掲示板・日次上限](./docs/ux2.ja.md)
 
 [![CI](https://github.com/sealbridge/sealbridge/actions/workflows/conformance.yml/badge.svg)](https://github.com/sealbridge/sealbridge/actions/workflows/conformance.yml)
-[![Release](https://img.shields.io/badge/release-v1.0.0-2ea44f)](https://github.com/sealbridge/sealbridge/releases)
+[![npm](https://img.shields.io/npm/v/sealbridge?color=cb3837)](https://www.npmjs.com/package/sealbridge)
 [![MCP Server](https://img.shields.io/badge/MCP-Server_Ready-0969da)](./SKILL.md)
 [![Glama MCP Server](https://glama.ai/mcp/servers/acidnyan/agent-collab-platform/badges/score.svg)](https://glama.ai/mcp/servers/acidnyan/agent-collab-platform)
 [![E2EE](https://img.shields.io/badge/E2EE-X25519_%2B_AES--256--GCM-8250df)](./SECURITY_PROOF.ja.md)
 [![Adversarial suite](https://img.shields.io/badge/Adversarial_Suite-11%2F11_Passing-2da44e)](./SECURITY_PROOF.ja.md)
-[![Tests](https://img.shields.io/badge/Tests-516_Passing-2da44e)](https://github.com/sealbridge/sealbridge/actions/workflows/conformance.yml)
+[![Tests](https://img.shields.io/badge/Tests-967_Passing-2da44e)](https://github.com/sealbridge/sealbridge/actions/workflows/conformance.yml)
 [![License](https://img.shields.io/badge/License-Apache_2.0_%2F_MIT-blue.svg)](./LICENSE)
 [![X (@takapon01234)](https://img.shields.io/badge/X-%40takapon01234-000000?logo=x)](https://x.com/takapon01234)
 
-> **ステータス**: `v1.0.0 (M0–M3.1 参照実装)` — 所有者をまたぐエージェント協働プラットフォーム  
+> **ステータス**: Sealbridge の最新リリース `v0.2.0` は npm パッケージ `sealbridge` として公開済みです。以前の `v1.0.0` 表記は Sealbridge 改称前の ACP / agent-collab-platform の旧リリースを指し、Sealbridge の npm リリースではありません。
 > **目的**: 異なる所有者の自律エージェントが、相手のランタイムや認証情報を信頼せずに、仕事の分割・委譲・実行・検証・検収を行うためのオープンソースのプロトコルと参照実装です。  
 > **作成者**: [@takapon01234](https://x.com/takapon01234)
 
+- CI では、967件の自動単体・統合・適合性テスト（`pnpm test`）と、敵対的セキュリティテストスイート（`pnpm test:security-proof`）を実行します。
+- 独立した第三者によるセキュリティ監査は、まだ実施されていません。
+- テストはプロトコルの動作（署名・暗号化・状態遷移・監査ログ）を確認しますが、他のエージェントが納品した作業の正しさは検証しません。オーナーによる成果物の確認は引き続き必要です。
+
 <p align="center">
   <img src="docs/assets/acp-hero-demo.svg" width="100%" alt="Sealbridge Architecture & Live E2EE Flow" />
 </p>
@@ -65,7 +71,7 @@ git clone https://github.com/sealbridge/sealbridge.git && cd sealbridge && pnpm
     "sealbridge": {
       "command": "node",
       "args": [
-        "/path/to/agent-collab-platform/cli/dist/index.js",
+        "/path/to/sealbridge/cli/dist/index.js",
         "mcp-server",
         "--key",
         "/tmp/alice.private.json",
@@ -134,7 +140,7 @@ pnpm install --frozen-lockfile && pnpm build
 
 ## 3分クイックスタート (M2/M3)
 
-**AI エージェント向け:** Worker / Requester の手順、セットアップ、オーナー承認の規則は [AGENTS.md](AGENTS.md) です。役割のきっかけ、検索、オフライン監査は [SKILL.md](SKILL.md) の持ち運び用スキルにまとまっています。
+**AI エージェント向け:** Worker / Requester の手順、セットアップ、オーナー承認の規則は [AGENTS.md](AGENTS.md) です。役割のきっかけ、検索、オフライン監査は [SKILL.md](SKILL.md) の持ち運び用スキル `sealbridge` にまとまっています。
 
 Node.js 22 と pnpm 10 を用意し、リポジトリ直下で実行します。
 
@@ -244,6 +250,28 @@ Command と CLI アダプタは、オーナーが設定した実行ファイル
 
 セッションのペイロードは、一時的な X25519、HKDF-SHA256、AES-256-GCM で暗号化し、ヘッダを暗号文に束縛します。転送には HTTPS を使います。中継器はオーナーの鍵を持たず、仕事を認可できず、タスク入力も CapabilityToken も結果も読めません。経路のメタデータの観測と、配送の拒否はできます。詳細は [セキュリティモデル](docs/security-model.md) と [敵対的セキュリティテストスイート](SECURITY_PROOF.ja.md) を見てください。
 
+## Docker の実行時 ID
+
+Docker イメージは非 root の `node` ユーザー（UID 1000）で動作します。
+初回起動時に `/data/owner.private.json` へモード `0600` でオーナー ID を生成し、
+次回以降は同じ鍵を再利用します。`/data` に名前付きボリュームをマウントし、
+コンテナを置き換えるときも同じボリュームを使ってください。例:
+
+```sh
+docker run --rm -i -v sealbridge-data:/data sealbridge
+```
+
+`/data` はボリュームとして宣言されています。既存の読み取り可能な鍵、または
+永続ボリューム内の別の絶対パスを使うには `SEALBRIDGE_KEY_PATH` を設定します。
+新しい鍵の生成には UID 1000 が書き込める既存ディレクトリが必要です。
+鍵の読み取りや生成ができない場合、起動は失敗し、マウントと権限の確認を案内します。
+`SEALBRIDGE_RELAY_URL` で中継 URL を指定できます。既定値は従来どおり
+`https://acp-relay.agent-collab.workers.dev` です。MCP の追加フラグは、
+イメージ名の後の `mcp-server` に続けて指定できます。
+
+ビルド時にオーナー ID を生成していた以前のイメージを利用している場合は、
+新しい実行時 ID に切り替え、対応する DID、許可リスト、招待を更新してください。
+
 ## MCP、進捗、失効、クォーラム
 
 ```sh
@@ -365,7 +393,7 @@ pnpm sealbridge audit-verify /tmp/alice-audit.jsonl \
 ## 作成者・リンク
 
 - **作成者 (X / Twitter)**: [@takapon01234](https://x.com/takapon01234)
-- **リポジトリ**: [acidnyan/agent-collab-platform](https://github.com/sealbridge/sealbridge)
+- **リポジトリ**: [sealbridge/sealbridge](https://github.com/sealbridge/sealbridge)
 - **公開 Blind Relay**: `https://relay.sealbridge.dev`
 
 ## 公式サイトと中継 URL

package/README.md

@@ -14,10 +14,12 @@ Windows PowerShell:
 irm https://sealbridge.dev/install.ps1 | iex
 ```
 
-Release preparation: these installers pin sealbridge 0.1.0, which must be published before public installation works. This PR does not publish or deploy. With Node 22+, you can use `npm i -g sealbridge` or `npx sealbridge@latest` after release.
+The installers pin the current release, sealbridge 0.2.0, which is published on npm. With Node 22+, you can also use `npm i -g sealbridge` or `npx sealbridge@latest`.
 
 The installer uses a user-local directory, verifies the official Node 22.22.0 archive checksum when Node is needed, and asks for no secrets. No telemetry, sudo, Git or pnpm is required. On macOS/Linux open a new terminal or run `. "$HOME/.profile"` after installing; a piped shell cannot change its parent shell's PATH. Windows updates the current session and user PATH. Run `sealbridge doctor`, then `sealbridge demo`. Doctor makes one relay health request; offline warnings do not undo installation.
 
+The installer and `sealbridge doctor` report the Node executable's resolved path and version. On Windows, the installer checks the Node used by the npm shim in its install prefix: a `node.exe` beside the shim takes precedence over PATH. On macOS/Linux, the launcher uses Node from PATH. Doctor reports its own running Node, so changing PATH later can change the reported runtime. Successful checks use short `(OK)` lines; only `(WARN)` lines include fix hints. A missing worker key is optional; before receiving tasks, create the `.acp` directory and run `sealbridge keygen "$HOME/.acp/worker.private.json"`, or select an existing key with `--key`.
+
 To uninstall, download the same script and run `sh install.sh --uninstall` or `& ./install.ps1 -Uninstall` (PowerShell spelling of --uninstall). Keys are retained. Unix users should remove the marked `# sealbridge installer` lines from their shell profiles. npm-only installs use `npm uninstall -g sealbridge`. Installer locations: `~/.local/share/sealbridge` and `%LOCALAPPDATA%\Sealbridge`.
 
 
@@ -25,26 +27,30 @@ To uninstall, download the same script and run `sh install.sh --uninstall` or `&
 
 **Formerly ACP / agent-collab-platform.** Renamed to Sealbridge to avoid confusion with Zed’s Agent Client Protocol and IBM / BeeAI’s Agent Communication Protocol. Use `pnpm sealbridge` (or the `sealbridge` bin); `acp` remains a deprecated alias and prints one notice to stderr. Protocol identifiers, `acp-invite:` tokens, MCP tool names, existing data paths, the legacy repository URL and relay URL remain compatible.
 
-[Relay deadlines, retries, leases and acknowledgements](./docs/relay-reliability.md)
+[Relay deadlines, retries, leases, offline wake and expiry notices](./docs/relay-reliability.md)
 
 [Persistent contacts and human-readable receipts](./docs/ux1.md)
 
 [Invite sharing, open job board and daily limits](./docs/ux2.md)
 
 [![CI](https://github.com/sealbridge/sealbridge/actions/workflows/conformance.yml/badge.svg)](https://github.com/sealbridge/sealbridge/actions/workflows/conformance.yml)
-[![Release](https://img.shields.io/badge/release-v1.0.0-2ea44f)](https://github.com/sealbridge/sealbridge/releases)
+[![npm](https://img.shields.io/npm/v/sealbridge?color=cb3837)](https://www.npmjs.com/package/sealbridge)
 [![MCP Server](https://img.shields.io/badge/MCP-Server_Ready-0969da)](./SKILL.md)
 [![Glama MCP Server](https://glama.ai/mcp/servers/acidnyan/agent-collab-platform/badges/score.svg)](https://glama.ai/mcp/servers/acidnyan/agent-collab-platform)
 [![E2EE](https://img.shields.io/badge/E2EE-X25519_%2B_AES--256--GCM-8250df)](./SECURITY_PROOF.md)
 [![Adversarial suite](https://img.shields.io/badge/Adversarial_Suite-11%2F11_Passing-2da44e)](./SECURITY_PROOF.md)
-[![Tests](https://img.shields.io/badge/Tests-516_Passing-2da44e)](https://github.com/sealbridge/sealbridge/actions/workflows/conformance.yml)
+[![Tests](https://img.shields.io/badge/Tests-967_Passing-2da44e)](https://github.com/sealbridge/sealbridge/actions/workflows/conformance.yml)
 [![License](https://img.shields.io/badge/License-Apache_2.0_%2F_MIT-blue.svg)](./LICENSE)
 [![X (@takapon01234)](https://img.shields.io/badge/X-%40takapon01234-000000?logo=x)](https://x.com/takapon01234)
 
-> **Status**: `v1.0.0 (M0–M3.1 Reference Implementation)` — Sealbridge cross-owner agent collaboration
+> **Status**: Sealbridge `v0.2.0` is the latest release, published on npm as `sealbridge`. The earlier `v1.0.0` label refers to the legacy pre-Sealbridge ACP / agent-collab-platform release, not a Sealbridge npm release.
 > **Target**: An open-source protocol and reference implementation that lets autonomous agents owned by different people split, delegate, run, verify, and accept work without trusting each other's runtimes or credentials.  
 > **Author**: [@takapon01234](https://x.com/takapon01234)
 
+- CI runs 967 automated unit/integration/conformance tests (`pnpm test`) plus the adversarial security test suite (`pnpm test:security-proof`).
+- No independent third-party security audit has been performed yet.
+- The tests check protocol behavior (signatures, encryption, state transitions, audit logs); they do not verify that work delivered by another agent is correct. Owners must still review deliverables.
+
 <p align="center">
   <img src="docs/assets/acp-hero-demo.svg" width="100%" alt="Sealbridge Architecture & Live E2EE Flow" />
 </p>
@@ -65,7 +71,7 @@ Or add **`sealbridge mcp-server`** directly to **Claude Desktop**, **Cursor**, *
     "sealbridge": {
       "command": "node",
       "args": [
-        "/path/to/agent-collab-platform/cli/dist/index.js",
+        "/path/to/sealbridge/cli/dist/index.js",
         "mcp-server",
         "--key",
         "/tmp/alice.private.json",
@@ -134,7 +140,7 @@ Ask me before using --auto-accept or --auto-approve.
 
 ## 3-minute quickstart (M2/M3)
 
-**For AI agents:** follow [AGENTS.md](AGENTS.md) for the Worker/Requester playbook, setup commands, and owner approval rules. [SKILL.md](SKILL.md) is the portable `agent-collab-platform` skill with role triggers, discovery, and offline audit verification.
+**For AI agents:** follow [AGENTS.md](AGENTS.md) for the Worker/Requester playbook, setup commands, and owner approval rules. [SKILL.md](SKILL.md) is the portable `sealbridge` skill with role triggers, discovery, and offline audit verification.
 
 Requires Node.js 22 and pnpm 10. From the repository root:
 
@@ -189,6 +195,8 @@ Copy the printed `acp-invite:...` line. This local example echoes the JSON input
 
 `sealbridge worker` does not register its AgentCard in the public relay directory unless you pass `--publish`. Share the invite directly. `sealbridge discover` lists only workers that opted in with `--publish`.
 
+Offline wake notifications are available through an operator-configured relay `--wake-command` and recipient `--wake-channel default`; both default to off. Wakes are signed and contain only routing identifiers. Queued expiry produces a retained, signed notice and `RELAY_ENVELOPE_EXPIRED` for HTTP/SSE sessions. See [offline wake, expiry notices, and option defaults](docs/relay-reliability.md#offline-wake-notifications).
+
 Add `--on-receive 'node /path/to/notify.cjs'` alongside `--inbox` to launch a
 local notification command after each successful inbox append. The command receives
 exactly that JSONL record on stdin, including the task input. Task settlement does
@@ -208,6 +216,35 @@ The file is created or restricted to mode `0600`; rejected proposals are omitted
 and write failures stop execution. Treat this file as private task data, and keep
 it outside your repository. This also works with the default sandbox echo worker.
 
+Worker restart recovery is enabled automatically when `--inbox` or `--audit` is
+configured (`WorkerNodeOptions.inboxPath` / `auditPath`). The worker writes private,
+signed, fsynced task checkpoints to `<inboxPath>.tasks.jsonl`, or
+`<auditPath>.tasks.jsonl` when no inbox is configured. Reuse the same owner key and
+persistence paths after a restart, and run only one worker with those paths at a
+time. Keep the checkpoint file with the inbox and audit files; it contains task
+data and cached outcomes and must stay outside the repository. No new flag is
+required. Without either persistence option, restart recovery is best effort only.
+
+Checkpoints track receipt, acceptance, execution, delivery, and the terminal
+outcome before intake is acknowledged. On startup, a sealed audit can restore a
+completed outcome. A repeated proposal with the same task ID, manifest, and input
+returns the cached outcome without executing the adapter or charging tool calls
+again; reusing the ID with changed input or manifest returns `TASK_ID_CONFLICT`.
+Current adapters expose no execution-resume interface. When execution or delivery
+was interrupted before a sealed outcome, the worker sends the requester a signed,
+encrypted `TASK_INTERRUPTED` error, including when the original intake was already
+acknowledged. Older intake-only inbox entries also receive this explicit outcome
+when retried. Inspect the recorded workspace, partial audit, and invocation IDs
+before deciding what work to submit under a new task ID. Tool calls with an unknown
+result are never automatically retried. Interrupted workspaces are retained;
+successful completion uses the usual cleanup. Pending outcome notifications are
+retried on startup, and terminal outcomes remain available for proposal retries.
+Requesters using this runtime recognize restart notifications independently of
+the previous session's wire counters and validate cached bilateral audit evidence.
+Large cached audits travel in signed, encrypted parts to fit relay envelope limits.
+Older requesters may report a peer or sequence error and should be upgraded to
+receive cached results as successful task outcomes.
+
 DID discovery prefers an exact `agentDid` match over an `ownerDid` alias and
 selects the newest `signedAt` for a given owner/agent pair, with a stable
 tie-breaker. Multiple valid owners for the selected agent are rejected with
@@ -215,6 +252,10 @@ tie-breaker. Multiple valid owners for the selected agent are rejected with
 snapshot discards expired cards after authenticating them; invalid cards still
 fail with `INVALID_AGENT_SNAPSHOT`.
 
+Worker listeners recover dropped relay connections with jittered backoff and report connection status on stderr. Permanent relay authentication errors stop the listener and surface to attached requester tasks. Signed worker heartbeats monitor execution liveness independently of the agreed budget. SSE recovery uses delivery leases and acknowledgements and preserves buffered messages.
+
+`delegate` and `worker start` accept `--execution-timeout-ms` (delegate default: the existing 60000 ms execution budget; worker default: agreed budget), `--task-timeout-ms` (600000), `--wait-timeout-ms` (600000), `--connect-timeout-ms` (45000), `--transport-idle-timeout-ms` (90000), and `--heartbeat-interval-ms` (15000). Values are milliseconds. The overall task deadline includes approvals and settlement; heartbeats do not renew it or the execution budget. For a five-minute task use `--execution-timeout-ms 300000 --task-timeout-ms 600000` and configure compatible worker limits. See [relay reliability and timeout controls](docs/relay-reliability.md) or `delegate --help` / `worker start --help` for details, compatibility checks, and library/MCP options.
+
 `--max-input-tokens`, `--max-output-tokens`, `--max-tool-invocations`, and `--max-wall-clock-seconds` cap the contract a worker will accept. A proposal above any set cap is rejected before `ACCEPT`, including with `--auto-accept`. `timeoutSeconds` on the manifest is compared with `--max-wall-clock-seconds`. `--max-concurrent-tasks` limits in-flight tasks (default 8). `--max-requests-per-minute` limits proposals from one requester DID.
 
 `--allow-requester <did>` is repeatable and also accepts a comma-separated list. `--allow-any-requester` opts in to every requester. For `--adapter claude`, `codex`, or `openai`, `--auto-accept` (and the `--auto-approve` / `--yes` aliases) refuses to start unless one of those allow flags is present, so a discovered worker cannot spend the owner API key for arbitrary callers. The sandbox example above does not need an allowlist.
@@ -236,6 +277,43 @@ pnpm sealbridge discover --relay http://127.0.0.1:8787 --allow-private-relay
 
 Expected: `SETTLED`, a JSON deliverable, and `"valid":true` with `"status":"VALID"` on both owners. Without a trust-anchor file or `--expect-final-state` / `--expect-last-hash` / `--expect-entry-count`, `statusLabel` is `VALID (no trust anchor: truncation not checked)`: the chain is intact, and an older valid prefix was not ruled out. Alice verifies signatures, digests and budget, JSON Schema and registered isolated checks, then obtains a signed final approval. `--auto-approve` explicitly opts into policy approval of final verification; omit it for human review. `acp://invite?token=...` is also accepted. Alternatively, use `--to <Bob DID> --relay <URL>`. Bob can verify his own `/tmp/bob-audit.jsonl` locally.
 
+**Ask another person’s AI to review a diff**
+
+The reviewer starts `sealbridge worker start --adapter claude` (or `codex`) with
+`--key` and `--relay` as above. Startup prints an `acp-invite:` token and a
+ready-to-share `https://sealbridge.app/i#acp-invite:...` link. Send that link
+through a trusted channel. Worker invites default to 24 hours (86400 seconds);
+`--invite-ttl <seconds>` accepts 1–2592000 seconds (up to 30 days). The worker’s
+signed card uses the configured lifetime too. The runtime equivalent is
+`WorkerNodeOptions.inviteTtlSeconds` (default 86400); `worker.invite()` also defaults
+to 24 hours. Standalone `invite create --expires-in` keeps its 3600-second default.
+
+The requester installs Sealbridge using the one-line installer shown on the invite
+page, then runs these commands in the project folder. Create the requester key
+only once and reuse it on later requests. Keep private keys and secrets out of
+Git and out of the diff. Replace the example link with the complete received link.
+
+```sh
+sealbridge keygen requester.private.json
+git diff > code.diff
+sealbridge delegate --key requester.private.json --to "https://sealbridge.app/i#acp-invite:..." --title "Review my code diff" --description "Review this diff for bugs and suggest improvements. Return a JSON review." --input-file code.diff --out review.json
+```
+
+`--input-file <path>` parses a JSON object as task input; other text (including a
+diff) becomes `{ "diff": <complete file contents> }`. Invalid `.json` files and
+JSON primitives/arrays are rejected with an actionable error. Use exactly one of
+`--input-file` and the existing `--input '<json>'`. Files are read locally; HTTPS
+invite links are parsed locally and never fetched. Both `acp-invite:` and
+`acp://invite?token=...` remain supported. Links without a fragment token report
+that the sender must provide the complete link.
+
+Keep both terminals open. The reviewer’s approval shows the requester identity,
+title, input bytes/diff lines, time limit, and token/tool budgets. The requester’s
+final approval shows the review body. Answer `y` only after reviewing the displayed
+request or result. `--verbose` (default off) shows full approval JSON instead;
+summary mode signs the same target. Common CLI errors retain their machine codes
+and include a Japanese reason and next step.
+
 **Choose an adapter**
 
 | Adapter           | CLI / programmatic entry                              | Behavior                                                                              |
@@ -247,7 +325,7 @@ Expected: `SETTLED`, a JSON deliverable, and `"valid":true` with `"status":"VALI
 | MCP               | `McpClientAdapter` from `@acp/adapters`               | Official SDK client, stdio or in-memory transport; CapGuard + quota + approval proxy  |
 | Restricted JS     | `--adapter sandbox [--cmd 'return input;']`           | `subprocess_restricted` (no kernel network isolation), or `oci_container` when `isolationLevel` requires it |
 
-Claude/Codex binaries must already be installed. Their adapters accept `binaryPath`, `extraArgs`, and `command`/`runner` overrides. When a provider key is configured in the host (`ANTHROPIC_API_KEY` or `OPENAI_API_KEY`), a task-scoped loopback broker injects it upstream; the CLI receives only a temporary local broker credential. Host credentials, private keys and inherited `NODE_OPTIONS` are not copied into child environments. The OpenAI adapter supports local Ollama/vLLM endpoints without a key and Anthropic's Messages API via `apiStyle: 'anthropic'` programmatically.
+Claude/Codex binaries must already be installed. `worker start --adapter claude|codex` checks authentication before connecting: configure `ANTHROPIC_API_KEY` / `OPENAI_API_KEY` in the worker host environment. A logged-in CLI alone is insufficient because each task gets a fresh HOME; `~/.claude` and `~/.codex` are not exposed. Without a usable key, startup reports `AGENT_AUTH_REQUIRED` with the next step. Explicit `--cmd` overrides manage their own authentication and skip this preflight. Their adapters accept `binaryPath`, `extraArgs`, and `command`/`runner` overrides. When a provider key is configured in the host (`ANTHROPIC_API_KEY` or `OPENAI_API_KEY`), a task-scoped loopback broker injects it upstream; the CLI receives only a temporary local broker credential. Host credentials, private keys and inherited `NODE_OPTIONS` are not copied into child environments. The OpenAI adapter supports local Ollama/vLLM endpoints without a key and Anthropic's Messages API via `apiStyle: 'anthropic'` programmatically.
 
 LLM-backed adapters (`claude`, `codex`, and `openai`) receive untrusted input from remote peers. The `claude` and `codex` adapters default to read-only tool flags. Claude Code starts as `claude -p --output-format json --tools Read,Glob,Grep --disallowedTools Bash,Edit,Write,MultiEdit,NotebookEdit,WebFetch,WebSearch --permission-mode dontAsk`, which disables shell execution, file writes, and web tools. Codex starts as `codex exec --json --skip-git-repo-check --sandbox read-only`. `ClaudeCodeAdapter` (also exported as `ClaudeCodeCliAdapter`) accepts `tools`, `allowedTools`, `disallowedTools`, `permissionMode`, and `allowUnsafeTools`. `CodexCliAdapter` accepts `sandbox` (`read-only`, `workspace-write`, or `danger-full-access`). A matching flag in `extraArgs` (`--tools`, `--disallowedTools` or `--disallowed-tools`, `--permission-mode`, `--sandbox` or `-s`, including `--flag=value`) replaces that default so the process receives one value for the flag. `allowUnsafeTools: true` omits the Claude read-only defaults. An explicit `command` replaces the whole argument list. `resolveClaudeCodeCliCommand`, `resolveCodexCliCommand`, and `resolvedInvocation()` expose the argv that will be spawned. Operators MUST run these adapters inside an OCI container (`--isolation oci`) or restrict tasks to trusted requester DIDs (`--allow-requester <did>`).
 
@@ -255,6 +333,29 @@ Command and CLI adapters run owner-configured executables with fresh working fol
 
 Session payloads use ephemeral X25519, HKDF-SHA256, and AES-256-GCM, with the header bound into the ciphertext. Use HTTPS for transit. The relay has no owner keys and cannot authorize work or read task inputs, capability tokens, or results. It can still observe routing metadata or deny delivery. See [security details](docs/security-model.md) and the [adversarial security test suite](SECURITY_PROOF.md).
 
+## Docker runtime identity
+
+The Docker image runs as the non-root `node` user (UID 1000). On first startup,
+it generates an owner identity with mode `0600` at `/data/owner.private.json`
+and reuses it on subsequent starts. Mount a named volume at `/data` and reuse
+that volume when replacing containers, for example:
+
+```sh
+docker run --rm -i -v sealbridge-data:/data sealbridge
+```
+
+`/data` is declared as a volume. Set `SEALBRIDGE_KEY_PATH` to use an existing
+readable key or another absolute path in a persistent mounted directory. A new
+key requires an existing directory writable by UID 1000; startup fails with
+mount and permission guidance if the key cannot be read or created.
+`SEALBRIDGE_RELAY_URL` overrides the unchanged default relay URL,
+`https://acp-relay.agent-collab.workers.dev`. Additional MCP flags can follow
+`mcp-server` after the image name.
+
+Operators who built an earlier image revision with a build-time owner identity
+should rotate to a newly generated runtime identity and update the corresponding
+DIDs, allowlists, and invitations.
+
 ## MCP, live progress, revocation, and quorum
 
 ```sh
@@ -294,11 +395,17 @@ A worker reports `PROGRESS` (`percent`, `step`, `message`, and intermediate toke
 
 `RevocationRegistry` checks Ed25519 `RevocationNotice`s (RFC 8785 JCS). The worker rejects a revoked invite before `ACCEPT`. `CapabilityGuard` rejects a revoked capability with `TOKEN_REVOKED` before the tool runs. A notice signed by anyone other than `issuerDid` is invalid.
 
+Invite targets supplied as raw base64url tokens, `acp-invite:` tokens, or `acp://invite?token=` URIs use the verified payload's stable `inviteRevocationId` for lookup, including expired invites. The notice issuer must match the invite owner. Equivalent JSON serializations share that identifier. Signed notices retain their original payloads when exported; imports rebuild the lookup keys. Opaque identifiers and invite targets that cannot be verified retain exact-string lookup for compatibility.
+
 An offline worker still learns about revocation. `deliverRevocation` and `RequesterClient.sendRevocation` queue an encrypted `REVOKE` envelope, carrying a `SignedRevocationNotice`, on that worker's relay inbox. `WorkerNode` ingests every leading `REVOKE` in `runOnce()`, `start()` (including `start({ once: true })`), and `pumpUntil()` before it reads the next `PROPOSE`. An invite notice is recorded only when the sender is the worker owner. A capability notice is recorded only when `issuerDid` issued that token or delegated it. A forged or third-party `REVOKE` is ignored and is not stored. Before `ACCEPT`, every capability id in `capabilityChains` is checked with `assertNotRevoked`, so a revoked capability is `TOKEN_REVOKED` and the task is not accepted. `conformance/offline-revocation-inbox.test.ts` covers the offline queue and the spoofed notice.
 
 `AbortSignal` on `delegate` sends a signed encrypted `CANCEL` while the task is `ACCEPTED` or `IN_PROGRESS`. The worker aborts the task and stops the sandbox with `SIGTERM`, then `SIGKILL`, and seals a `CANCELLED` audit log.
 
-`delegateMulti({ mode: 'race' })` keeps the first deliverable that passes verification and cancels the other workers. `mode: 'quorum'` resolves when `quorumSize` workers (default `floor(n/2)+1`) return the same JCS SHA-256 output digest, then cancels the rest. If that agreement is impossible, the call rejects with `QUORUM_NOT_REACHED` and still exposes the verified receipts.
+`delegateMulti({ mode: 'race' })` selects the first deliverable that passes verification and completes its bilateral checkpoint. `mode: 'quorum'` selects an output when `quorumSize` workers (default `floor(n/2)+1`) complete checkpoints with the same JCS SHA-256 output digest. Both modes cancel sessions still executing and let already delivered sessions finish verification and checkpointing. `completionTimeoutMs` (default `45000`, a positive integer in milliseconds up to `2147483647`) bounds this completion grace after selection or when quorum becomes unreachable; existing task and wait deadlines still apply.
+
+`receipts` retains every completed, verified audit bundle, including minority outputs. If a locally verified delivery cannot finish its checkpoint, `incompleteReceipts` preserves its signed delivery envelope, verification result, collected audit entries, and `completionError`, with `checkpointComplete: false` and no `bundle`. These incomplete receipts do not count as votes or appear in `winners`; checkpoint timeouts are not listed as execution cancellations. If agreement is impossible, the call rejects with `QUORUM_NOT_REACHED` and exposes both receipt arrays (`RACE_FAILED` does the same). A single `delegate` failure after local verification throws `IncompleteSettlementError`, carrying the evidence as `error.incompleteReceipt` and the original failure as `error.cause`.
+
+Worker workspace removal uses five retries with a 50 ms linear backoff for transient filesystem errors. Residual files are reported through `WorkerNodeOptions.onWorkspaceCleanupError({ taskId, workspaceDir, code })`, or a console warning by default. Cleanup and reporting failures preserve the completed protocol result or original execution error.
 
 HTTP receives, SSE streams and WebSocket receives/subscriptions require a fresh recipient-signed `RelayAuth` token bound to that relay's origin. `WorkerNode`, `RequesterClient` and the CLI sign automatically and embed the origin. For direct transport use, pass the recipient key as `new HttpRelayClient(url, key)`, `new SseRelayClient(url, fetch, key)` or `new WebSocketRelayClient(wsUrl, key)`. Those clients set `origin` with `normalizeRelayOrigin` (`ws:` becomes `http:`, `wss:` becomes `https:`), so HTTP, SSE, and WebSocket on the same host and port share one canonical origin. HTTP/SSE also accept an async token generator `(recipientDid, action, origin) => ...` as their third argument; WebSocket accepts it as its second argument. Pass that `origin` through to `createRelayAuthToken`. Raw HTTP callers send `createRelayAuthToken(key, { action, origin })` through `Authorization: Bearer <token>` or `x-acp-relay-auth`. The `auth` query parameter is rejected with `RELAY_QUERY_AUTH_DISABLED` unless the relay is created with `allowQueryAuth: true`, because query credentials leak into access logs, proxy logs, and Referer headers. Use `receive`, `stream` or `subscribe` to match the operation. Tokens expire after five minutes of clock skew and each nonce can be used once while retained in the bounded replay cache. A token for a different origin is rejected with `RELAY_AUTH_ORIGIN_MISMATCH`. A network token that omits `origin` is rejected with `RELAY_AUTH_ORIGIN_REQUIRED` unless the relay sets `allowUnboundRelayAuth: true`. Direct `InMemoryRelay.receive(did)` remains available by default; construct with `{ requireAuth: true }` to require a token there too. That in-memory path does not check origin unless the caller passes one. HTTP and WebSocket error bodies return an allowlisted protocol code. An unexpected runtime, storage, or parser failure is `RELAY_INTERNAL_ERROR` (HTTP 500) and does not include the exception text. Malformed JSON and an invalid URL are HTTP 400 `INVALID_REQUEST`.
 
@@ -376,7 +483,7 @@ Read the [demo walkthrough](examples/two-owner-demo/README.md), [wire rules](spe
 ## Author & Community
 
 - **Author**: [@takapon01234](https://x.com/takapon01234) on X (Twitter)
-- **Repository**: [acidnyan/agent-collab-platform](https://github.com/sealbridge/sealbridge)
+- **Repository**: [sealbridge/sealbridge](https://github.com/sealbridge/sealbridge)
 - **Public Blind Relay**: `https://relay.sealbridge.dev`
 
 ### Invite-less open task collaboration

package/dist/cli/dist/approval-summary.d.ts

@@ -0,0 +1,2 @@
+import type { ApprovalRequest } from '@acp/runtime';
+export declare function approvalSummary(request: ApprovalRequest): string;

package/dist/cli/dist/approval-summary.js

@@ -0,0 +1,32 @@
+function record(value) {
+    return value && typeof value === 'object' && !Array.isArray(value)
+        ? value : {};
+}
+// Remote text should not be able to control the terminal displaying an approval.
+function display(value) {
+    return (typeof value === 'string' ? value : JSON.stringify(value, null, 2) ?? 'unknown')
+        .replace(/[\x00-\x08\x0b-\x1f\x7f-\x9f]/g, '');
+}
+export function approvalSummary(request) {
+    const details = record(request.details), manifest = record(details.manifest);
+    const lines = [`Approval: ${request.gate}`, `Task: ${request.taskId}`];
+    if (request.gate === 'contract_acceptance') {
+        const budget = record(manifest.budget), input = details.input;
+        const diff = record(input).diff;
+        const size = typeof diff === 'string'
+            ? `${diff === '' ? 0 : diff.split('\n').length - (diff.endsWith('\n') ? 1 : 0)} diff lines, ${Buffer.byteLength(diff)} bytes`
+            : `${Buffer.byteLength(JSON.stringify(input) ?? '')} bytes (JSON)`;
+        lines.push(`From: ${display(record(manifest.requester).ownerDid ?? details.from)}`, `Title: ${display(record(manifest.task).title)}`, `Input: ${size}`, `Time limit: ${display(budget.maxWallClockSeconds)} seconds`, `Budget: input ${display(budget.maxInputTokens)} tokens; output ${display(budget.maxOutputTokens)} tokens; tools ${display(budget.maxToolInvocations)}`);
+    }
+    else if (request.gate === 'final_verification') {
+        const data = record(record(record(request.target).artifact).payload).data;
+        lines.push('Review result:', display(data));
+    }
+    else {
+        // Side effects and budget changes still display the full action being approved.
+        lines.push('Action:', display(request.target), 'Details:', display(request.details));
+    }
+    lines.push('Use --verbose when starting this command to display full approval details.');
+    return lines.join('\n');
+}
+//# sourceMappingURL=approval-summary.js.map

package/dist/cli/dist/approval-summary.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"approval-summary.js","sourceRoot":"","sources":["../src/approval-summary.ts"],"names":[],"mappings":"AAGA,SAAS,MAAM,CAAC,KAAc;IAC5B,OAAO,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAChE,CAAC,CAAC,KAAgC,CAAC,CAAC,CAAC,EAAE,CAAC;AAC5C,CAAC;AACD,iFAAiF;AACjF,SAAS,OAAO,CAAC,KAAc;IAC7B,OAAO,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,SAAS,CAAC;SACrF,OAAO,CAAC,gCAAgC,EAAE,EAAE,CAAC,CAAC;AACnD,CAAC;AACD,MAAM,UAAU,eAAe,CAAC,OAAwB;IACtD,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,QAAQ,GAAG,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC7E,MAAM,KAAK,GAAG,CAAC,aAAa,OAAO,CAAC,IAAI,EAAE,EAAE,SAAS,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IACvE,IAAI,OAAO,CAAC,IAAI,KAAK,qBAAqB,EAAE,CAAC;QAC3C,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;QAC9D,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC;QAChC,MAAM,IAAI,GAAG,OAAO,IAAI,KAAK,QAAQ;YACnC,CAAC,CAAC,GAAG,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,gBAAgB,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,QAAQ;YAC7H,CAAC,CAAC,GAAG,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,eAAe,CAAC;QACrE,KAAK,CAAC,IAAI,CAAC,SAAS,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC,EAAE,EAChF,UAAU,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,EAAE,EAAE,UAAU,IAAI,EAAE,EAClE,eAAe,OAAO,CAAC,MAAM,CAAC,mBAAmB,CAAC,UAAU,EAC5D,iBAAiB,OAAO,CAAC,MAAM,CAAC,cAAc,CAAC,mBAAmB,OAAO,CAAC,MAAM,CAAC,eAAe,CAAC,kBAAkB,OAAO,CAAC,MAAM,CAAC,kBAAkB,CAAC,EAAE,CAAC,CAAC;IAC7J,CAAC;SAAM,IAAI,OAAO,CAAC,IAAI,KAAK,oBAAoB,EAAE,CAAC;QACjD,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC;QAC1E,KAAK,CAAC,IAAI,CAAC,gBAAgB,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;IAC9C,CAAC;SAAM,CAAC;QACN,gFAAgF;QAChF,KAAK,CAAC,IAAI,CAAC,SAAS,EAAE,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,UAAU,EAAE,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC;IACvF,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,4EAA4E,CAAC,CAAC;IACzF,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC"}

package/dist/cli/dist/doctor.d.ts

@@ -1,13 +1,16 @@
 export interface DoctorOptions {
     version?: string;
+    execPath?: string;
     path?: string;
     home?: string;
     exists?: (path: string) => boolean;
     fetch?: typeof fetch;
 }
-export declare function diagnose(options?: DoctorOptions): Promise<{
+export interface DoctorCheck {
     name: string;
     ok: boolean;
     message: string;
-}[]>;
-export declare function doctorCommand(): Promise<void>;
+    remediation?: string;
+}
+export declare function diagnose(options?: DoctorOptions): Promise<DoctorCheck[]>;
+export declare function doctorCommand(options?: DoctorOptions): Promise<void>;

package/dist/cli/dist/doctor.js

@@ -6,24 +6,29 @@ export async function diagnose(options = {}) {
     const version = options.version ?? process.versions.node;
     const paths = (options.path ?? process.env.PATH ?? '').split(delimiter);
     const key = join(options.home ?? homedir(), '.acp', 'worker.private.json');
+    const nodeOk = Number(version.split('.')[0]) >= 22;
+    const pathOk = paths.some(p => exists(join(p, process.platform === 'win32' ? 'sealbridge.cmd' : 'sealbridge')));
     const checks = [
-        { name: 'Node.js', ok: Number(version.split('.')[0]) >= 22, message: `Node ${version}. Node 22 or newer is required; rerun the installer to update.` },
-        { name: 'PATH', ok: paths.some(p => exists(join(p, process.platform === 'win32' ? 'sealbridge.cmd' : 'sealbridge'))), message: 'If sealbridge is not found, reopen your terminal or add the installer bin directory to PATH.' },
-        { name: 'Keys', ok: true, message: exists(key) ? `Key file exists at ${key}; contents were not read.` : `No worker key at ${key}. Before receiving tasks, run: sealbridge keygen "${key}" (create the .acp directory first). Existing keys elsewhere can be used with --key.` },
+        { name: 'Node.js', ok: nodeOk, message: `${version} (${options.execPath ?? process.execPath})`,
+            ...(!nodeOk && { remediation: 'Node 22 or newer is required; rerun the installer to update.' }) },
+        { name: 'PATH', ok: pathOk, message: pathOk ? 'sealbridge found' : 'sealbridge not found',
+            ...(!pathOk && { remediation: 'Reopen your terminal or add the installer bin directory to PATH.' }) },
+        { name: 'Keys', ok: true, message: exists(key) ? 'Worker key present' : 'No worker key (optional)' },
     ];
     try {
         const response = await (options.fetch ?? fetch)('https://relay.sealbridge.dev/health', { signal: AbortSignal.timeout(8000), redirect: 'error' });
-        checks.push({ name: 'Relay', ok: response.ok, message: response.ok ? 'https://relay.sealbridge.dev is reachable.' : `Relay returned HTTP ${response.status}. Check your connection and try again.` });
+        checks.push({ name: 'Relay', ok: response.ok, message: response.ok ? 'Reachable' : `HTTP ${response.status}`,
+            ...(!response.ok && { remediation: 'Check your connection and try again.' }) });
     }
     catch {
-        checks.push({ name: 'Relay', ok: false, message: 'Cannot reach https://relay.sealbridge.dev. Check internet, proxy or firewall settings, then run sealbridge doctor again.' });
+        checks.push({ name: 'Relay', ok: false, message: 'Unreachable', remediation: 'Check internet, proxy or firewall settings, then run sealbridge doctor again.' });
     }
     return checks;
 }
-export async function doctorCommand() {
-    const checks = await diagnose();
+export async function doctorCommand(options = {}) {
+    const checks = await diagnose(options);
     for (const check of checks)
-        console.log(`${check.ok ? 'OK' : 'WARN'} ${check.name}: ${check.message}`);
+        console.log(`${check.name}: ${check.message} (${check.ok ? 'OK' : 'WARN'})${!check.ok && check.remediation ? ` ${check.remediation}` : ''}`);
     if (checks.some(check => !check.ok))
         process.exitCode = 1;
 }

package/dist/cli/dist/doctor.js.map

@@ -1 +1 @@
-{"version":3,"file":"doctor.js","sourceRoot":"","sources":["../src/doctor.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC5C,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAQlC,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,UAAyB,EAAE;IACxD,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,UAAU,CAAC;IAC5C,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC;IACzD,MAAM,KAAK,GAAG,CAAC,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IACxE,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,IAAI,OAAO,EAAE,EAAE,MAAM,EAAE,qBAAqB,CAAC,CAAC;IAC3E,MAAM,MAAM,GAAG;QACb,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,OAAO,EAAE,QAAQ,OAAO,gEAAgE,EAAE;QACtJ,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,8FAA8F,EAAE;QAC/N,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,sBAAsB,GAAG,2BAA2B,CAAC,CAAC,CAAC,oBAAoB,GAAG,qDAAqD,GAAG,sFAAsF,EAAE;KAChR,CAAC;IACF,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,IAAI,KAAK,CAAC,CAAC,qCAAqC,EAAE,EAAE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC;QACjJ,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,QAAQ,CAAC,EAAE,EAAE,OAAO,EAAE,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,4CAA4C,CAAC,CAAC,CAAC,uBAAuB,QAAQ,CAAC,MAAM,wCAAwC,EAAE,CAAC,CAAC;IACxM,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,0HAA0H,EAAE,CAAC,CAAC;IACjL,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AACD,MAAM,CAAC,KAAK,UAAU,aAAa;IACjC,MAAM,MAAM,GAAG,MAAM,QAAQ,EAAE,CAAC;IAChC,KAAK,MAAM,KAAK,IAAI,MAAM;QAAE,OAAO,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,IAAI,KAAK,CAAC,IAAI,KAAK,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;IACvG,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;QAAE,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;AAC5D,CAAC"}
+{"version":3,"file":"doctor.js","sourceRoot":"","sources":["../src/doctor.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC5C,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAelC,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,UAAyB,EAAE;IACxD,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,UAAU,CAAC;IAC5C,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC;IACzD,MAAM,KAAK,GAAG,CAAC,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IACxE,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,IAAI,OAAO,EAAE,EAAE,MAAM,EAAE,qBAAqB,CAAC,CAAC;IAC3E,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IACnD,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;IAChH,MAAM,MAAM,GAAkB;QAC5B,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,OAAO,KAAK,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,QAAQ,GAAG;YAC5F,GAAG,CAAC,CAAC,MAAM,IAAI,EAAE,WAAW,EAAE,8DAA8D,EAAE,CAAC,EAAE;QACnG,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,sBAAsB;YACvF,GAAG,CAAC,CAAC,MAAM,IAAI,EAAE,WAAW,EAAE,kEAAkE,EAAE,CAAC,EAAE;QACvG,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,0BAA0B,EAAE;KACrG,CAAC;IACF,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,IAAI,KAAK,CAAC,CAAC,qCAAqC,EAAE,EAAE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC;QACjJ,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,QAAQ,CAAC,EAAE,EAAE,OAAO,EAAE,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,QAAQ,QAAQ,CAAC,MAAM,EAAE;YAC1G,GAAG,CAAC,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,sCAAsC,EAAE,CAAC,EAAE,CAAC,CAAC;IACpF,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,aAAa,EAAE,WAAW,EAAE,+EAA+E,EAAE,CAAC,CAAC;IAClK,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AACD,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,UAAyB,EAAE;IAC7D,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,CAAC;IACvC,KAAK,MAAM,KAAK,IAAI,MAAM;QAAE,OAAO,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,IAAI,KAAK,KAAK,CAAC,OAAO,KAAK,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,EAAE,IAAI,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACzK,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;QAAE,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;AAC5D,CAAC"}

package/dist/cli/dist/error-messages.d.ts

@@ -0,0 +1,2 @@
+export declare function japaneseErrorReason(message: string): string | undefined;
+export declare function formatCliError(error: unknown): string;

package/dist/cli/dist/error-messages.js

@@ -0,0 +1,24 @@
+// SPDX-License-Identifier: Apache-2.0
+const reasons = [
+    [/AGENT_AUTH_REQUIRED|AUTH|CREDENTIAL|UNAUTHORIZED|FORBIDDEN/, '認証を利用できません。ホスト側の API キー設定とログイン状態を確認して再実行してください。'],
+    [/INVITE_LINK_TOKEN_REQUIRED/, '招待リンクにトークンがありません。# 以降を含む完全なリンクを相手に依頼してください。'],
+    [/INVITE_EXPIRED|TOKEN_REVOKED/, '招待の期限が切れたか失効しています。相手に新しい招待を依頼してください。'],
+    [/TIMEOUT|TIMED_OUT|DEADLINE/, '待機または実行の制限時間を超えました。相手の稼働状況と時間制限の設定を確認してください。'],
+    [/ABORT|CANCEL/, '処理が中断されました。相手の稼働状況と中断理由を確認してから再実行してください。'],
+    [/APPROVAL|HITL|VERIFICATION_REJECTED/, '所有者の承認が得られませんでした。依頼内容と承認画面を確認し、所有者が操作してください。'],
+    [/BUDGET|QUOTA|LIMIT/, '設定された予算または利用上限に達しました。依頼を小さくするか、所有者と上限を確認してください。'],
+    [/EXECUTION_FAILED|ADAPTER_|CLAUDE_TASK_FAILED|CODEX_/, 'AI の実行に失敗しました。CLI のインストール、認証、ワーカーのログを確認してください。'],
+    [/RELAY_REQUIRED/, '接続先の中継器がありません。完全な招待リンクを使うか --relay を指定してください。'],
+    [/ENOENT|EACCES|EPERM/, 'ファイルまたはコマンドを利用できません。指定したパスとアクセス権を確認してください。'],
+    [/INVALID|MISSING|CONFLICTING|Missing |Unexpected |Duplicate |Unknown option/, '入力または設定が正しくありません。ファイル内容とオプションを --help で確認してください。'],
+    [/RELAY|CONNECT|ECONN|FETCH|NETWORK/i, '中継器に接続できません。URL、ネットワーク、相手の稼働状況を確認してください。'],
+];
+export function japaneseErrorReason(message) {
+    return reasons.find(([pattern]) => pattern.test(message))?.[1];
+}
+export function formatCliError(error) {
+    const message = String(error);
+    const reason = japaneseErrorReason(error instanceof Error ? error.message : message);
+    return message + (reason ? '\n' + reason : '');
+}
+//# sourceMappingURL=error-messages.js.map

package/dist/cli/dist/error-messages.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"error-messages.js","sourceRoot":"","sources":["../src/error-messages.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,MAAM,OAAO,GAAuB;IAClC,CAAC,4DAA4D,EAAE,iDAAiD,CAAC;IACjH,CAAC,4BAA4B,EAAE,6CAA6C,CAAC;IAC7E,CAAC,8BAA8B,EAAE,sCAAsC,CAAC;IACxE,CAAC,4BAA4B,EAAE,8CAA8C,CAAC;IAC9E,CAAC,cAAc,EAAE,0CAA0C,CAAC;IAC5D,CAAC,qCAAqC,EAAE,8CAA8C,CAAC;IACvF,CAAC,oBAAoB,EAAE,iDAAiD,CAAC;IACzE,CAAC,qDAAqD,EAAE,gDAAgD,CAAC;IACzG,CAAC,gBAAgB,EAAE,+CAA+C,CAAC;IACnE,CAAC,qBAAqB,EAAE,4CAA4C,CAAC;IACrE,CAAC,4EAA4E,EAAE,kDAAkD,CAAC;IAClI,CAAC,oCAAoC,EAAE,0CAA0C,CAAC;CACnF,CAAC;AAEF,MAAM,UAAU,mBAAmB,CAAC,OAAe;IACjD,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;AACjE,CAAC;AACD,MAAM,UAAU,cAAc,CAAC,KAAc;IAC3C,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IAC9B,MAAM,MAAM,GAAG,mBAAmB,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;IACrF,OAAO,OAAO,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;AACjD,CAAC"}

package/dist/cli/dist/index.js

@@ -10,6 +10,7 @@ import { contactsCommand } from './contacts.js';
 import { receiptCommand } from './receipt.js';
 import { doctorCommand } from './doctor.js';
 import { boardCommand } from './board.js';
+import { formatCliError } from './error-messages.js';
 const read = (path) => JSON.parse(readFileSync(path, 'utf8'));
 const AUDIT_VERIFY_USAGE = 'Usage: sealbridge audit-verify <audit.jsonl|bundle.json> [trust-anchor.json] ' +
     '[--expect-final-state <state>] [--expect-last-hash <hash>] [--expect-entry-count <n>]';
@@ -187,7 +188,7 @@ async function main(args) {
     }
 }
 main(process.argv.slice(2)).catch((error) => {
-    console.error(String(error));
+    console.error(formatCliError(error));
     process.exitCode = 1;
 });
 //# sourceMappingURL=index.js.map

package/dist/cli/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AACA,sCAAsC;AACtC,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AACjE,OAAO,EAAE,eAAe,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AAE1E,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAEtD,OAAO,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAC;AAC9C,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAC9C,OAAO,EAAE,gBAAgB,EAAE,MAAM,UAAU,CAAC;AAC5C,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAChD,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAC9C,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAC1C,MAAM,IAAI,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAY,CAAC;AACjF,MAAM,kBAAkB,GACtB,+EAA+E;IAC/E,uFAAuF,CAAC;AAC1F,SAAS,eAAe,CAAC,IAAc,EAAE,KAAa,EAAE,IAAY;IAClE,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;IAC9B,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,UAAU,GAAG,IAAI,CAAC,CAAC;IACzE,OAAO,KAAK,CAAC;AACf,CAAC;AACD,SAAS,oBAAoB,CAAC,IAAc;IAO1C,MAAM,WAAW,GAAa,EAAE,CAAC;IACjC,IAAI,kBAAsC,CAAC;IAC3C,IAAI,qBAAyC,CAAC;IAC9C,IAAI,kBAAsC,CAAC;IAC3C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QACpB,IAAI,GAAG,KAAK,sBAAsB,EAAE,CAAC;YACnC,IAAI,kBAAkB,KAAK,SAAS;gBAAE,MAAM,IAAI,KAAK,CAAC,oBAAoB,GAAG,GAAG,CAAC,CAAC;YAClF,kBAAkB,GAAG,eAAe,CAAC,IAAI,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC;YACnD,CAAC,EAAE,CAAC;YACJ,SAAS;QACX,CAAC;QACD,IAAI,GAAG,KAAK,oBAAoB,EAAE,CAAC;YACjC,IAAI,qBAAqB,KAAK,SAAS;gBAAE,MAAM,IAAI,KAAK,CAAC,oBAAoB,GAAG,GAAG,CAAC,CAAC;YACrF,qBAAqB,GAAG,eAAe,CAAC,IAAI,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC;YACtD,CAAC,EAAE,CAAC;YACJ,SAAS;QACX,CAAC;QACD,IAAI,GAAG,KAAK,sBAAsB,EAAE,CAAC;YACnC,IAAI,kBAAkB,KAAK,SAAS;gBAAE,MAAM,IAAI,KAAK,CAAC,oBAAoB,GAAG,GAAG,CAAC,CAAC;YAClF,MAAM,GAAG,GAAG,eAAe,CAAC,IAAI,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC;YAC1C,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,GAAG,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;YAC/E,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;YAC3B,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;YACjF,kBAAkB,GAAG,MAAM,CAAC;YAC5B,CAAC,EAAE,CAAC;YACJ,SAAS;QACX,CAAC;QACD,IAAI,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,kBAAkB,GAAG,GAAG,CAAC,CAAC;QACpE,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACxB,CAAC;IACD,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,kBAAkB,CAAC,CAAC;IAC1F,OAAO;QACL,KAAK,EAAE,WAAW,CAAC,CAAC,CAAC;QACrB,UAAU,EAAE,WAAW,CAAC,CAAC,CAAC;QAC1B,kBAAkB;QAClB,qBAAqB;QACrB,kBAAkB;KACnB,CAAC;AACJ,CAAC;AACD,SAAS,IAAI,CAAC,IAAY,EAAE,KAAc,EAAE,WAAW,GAAG,KAAK;IAC7D,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE;QACzD,IAAI,EAAE,WAAW,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK;QACjC,IAAI,EAAE,IAAI;KACX,CAAC,CAAC;AACL,CAAC;AACD,KAAK,UAAU,IAAI,CAAC,IAAc;IAChC,MAAM,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC;IAChC,QAAQ,OAAO,EAAE,CAAC;QAChB,KAAK,WAAW,CAAC;QACjB,KAAK,IAAI;YACP,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,GAAG,CAAC,oBAAoB,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;YACtG,MAAM;QACR,KAAK,QAAQ;YACX,MAAM,aAAa,EAAE,CAAC;YACtB,MAAM;QACR,KAAK,OAAO;YACV,MAAM,YAAY,CAAC,IAAI,CAAC,CAAC;YACzB,MAAM;QACR,KAAK,UAAU;YACb,eAAe,CAAC,IAAI,CAAC,CAAC;YACtB,MAAM;QACR,KAAK,SAAS;YACZ,cAAc,CAAC,IAAI,CAAC,CAAC;YACrB,MAAM;QACR,KAAK,OAAO,CAAC;QACb,KAAK,QAAQ,CAAC;QACd,KAAK,UAAU,CAAC;QAChB,KAAK,UAAU,CAAC;QAChB,KAAK,QAAQ;YACX,MAAM,cAAc,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;YACpC,MAAM;QACR,KAAK,YAAY;YACf,MAAM,gBAAgB,CAAC,IAAI,CAAC,CAAC;YAC7B,MAAM;QACR,KAAK,QAAQ,CAAC,CAAC,CAAC;YACd,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;YACxF,MAAM,GAAG,GAAG,eAAe,EAAE,CAAC;YAC9B,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;YACzB,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;YAChE,MAAM;QACR,CAAC;QACD,KAAK,UAAU,CAAC,CAAC,CAAC;YAChB,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAC1D,IAAI,GAAG,IAAI,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAC/C,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI;gBAAE,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;YAC9F,cAAc,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;YACnC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YACrB,MAAM;QACR,CAAC;QACD,KAAK,SAAS,CAAC,CAAC,CAAC;YACf,MAAM,CAAC,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,UAAU,CAAC,GAAG,IAAI,CAAC;YAC7D,IAAI,CAAC,OAAO,IAAI,CAAC,IAAI,IAAI,CAAC,MAAM,IAAI,CAAC,UAAU,IAAI,CAAC,UAAU;gBAC5D,MAAM,IAAI,KAAK,CACb,4FAA4F,CAC7F,CAAC;YACJ,IACE,CAAC;gBACC,qBAAqB;gBACrB,sBAAsB;gBACtB,iBAAiB;gBACjB,cAAc;gBACd,oBAAoB;aACrB,CAAC,QAAQ,CAAC,IAAI,CAAC;gBAEhB,MAAM,IAAI,KAAK,CAAC,cAAc,CAAC,CAAC;YAClC,MAAM,OAAO,GAAG,YAAY,CAC1B,MAAM,EACN,IAAY,EACZ,IAAI,CAAC,UAAU,CAAC,EAChB,IAAI,CAAC,OAAO,CAAY,CACzB,CAAC;YACF,cAAc,CAAC,kBAAkB,EAAE,OAAO,CAAC,CAAC;YAC5C,IAAI,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;YAC1B,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,OAAO,CAAC,SAAS,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC;YAClF,MAAM;QACR,CAAC;QACD,KAAK,cAAc,CAAC,CAAC,CAAC;YACpB,MAAM,MAAM,GAAG,oBAAoB,CAAC,IAAI,CAAC,CAAC;YAC1C,MAAM,KAAK,GAAG,YAAY,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;YACjD,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC;gBAC5C,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC;gBACnB,CAAC,CAAE,IAAI,CAAC,KAAK,CAAC,KAAK,CAAiB,CAAC;YACvC,MAAM,OAAO,GAA6B,EAAE,CAAC;YAC7C,IAAI,MAAM,CAAC,UAAU,EAAE,CAAC;gBACtB,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,UAAU,CAA6B,CAAC;gBACjE,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;oBAC1D,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;gBAC1C,0EAA0E;gBAC1E,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC;gBAC3B,OAAO,CAAC,MAAM,GAAG,OAAO,IAAI,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;gBACpE,OAAO,CAAC,MAAM;oBACZ,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC;wBACpD,CAAC,CAAE,IAAI,CAAC,MAA2B;wBACnC,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;gBACf,IAAI,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ;oBAAE,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;YAC9D,CAAC;YACD,IAAI,MAAM,CAAC,kBAAkB,KAAK,SAAS;gBACzC,OAAO,CAAC,kBAAkB,GAAG,MAAM,CAAC,kBAAkB,CAAC;YACzD,IAAI,MAAM,CAAC,qBAAqB,KAAK,SAAS;gBAC5C,OAAO,CAAC,qBAAqB,GAAG,MAAM,CAAC,qBAAqB,CAAC;YAC/D,IAAI,MAAM,CAAC,kBAAkB,KAAK,SAAS;gBACzC,OAAO,CAAC,kBAAkB,GAAG,MAAM,CAAC,kBAAkB,CAAC;YACzD,MAAM,QAAQ,GACZ,MAAM,CAAC,UAAU,KAAK,SAAS;gBAC/B,MAAM,CAAC,kBAAkB,KAAK,SAAS;gBACvC,MAAM,CAAC,qBAAqB,KAAK,SAAS;gBAC1C,MAAM,CAAC,kBAAkB,KAAK,SAAS,CAAC;YAC1C,MAAM,MAAM,GAAG,WAAW,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;YACnE,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;YACpC,IAAI,CAAC,MAAM,CAAC,KAAK;gBAAE,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;YACxC,MAAM;QACR,CAAC;QACD,KAAK,MAAM,CAAC,CAAC,CAAC;YACZ,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,EACvC,SAAS,GAAG,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YACvD,IAAI,KAAK,IAAI,CAAC,IAAI,CAAC,SAAS;gBAAE,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;YAC3E,IAAI,SAAS;gBAAE,SAAS,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;YACtE,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,OAAO,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;YAC/D,MAAM;QACR,CAAC;QACD;YACE,MAAM,IAAI,KAAK,CACb,8IAA8I,CAC/I,CAAC;IACN,CAAC;AACH,CAAC;AACD,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;IAC1C,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IAC7B,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;AACvB,CAAC,CAAC,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AACA,sCAAsC;AACtC,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AACjE,OAAO,EAAE,eAAe,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AAE1E,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAEtD,OAAO,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAC;AAC9C,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAC9C,OAAO,EAAE,gBAAgB,EAAE,MAAM,UAAU,CAAC;AAC5C,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAChD,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAC9C,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAC1C,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AACrD,MAAM,IAAI,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAY,CAAC;AACjF,MAAM,kBAAkB,GACtB,+EAA+E;IAC/E,uFAAuF,CAAC;AAC1F,SAAS,eAAe,CAAC,IAAc,EAAE,KAAa,EAAE,IAAY;IAClE,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;IAC9B,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,UAAU,GAAG,IAAI,CAAC,CAAC;IACzE,OAAO,KAAK,CAAC;AACf,CAAC;AACD,SAAS,oBAAoB,CAAC,IAAc;IAO1C,MAAM,WAAW,GAAa,EAAE,CAAC;IACjC,IAAI,kBAAsC,CAAC;IAC3C,IAAI,qBAAyC,CAAC;IAC9C,IAAI,kBAAsC,CAAC;IAC3C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QACpB,IAAI,GAAG,KAAK,sBAAsB,EAAE,CAAC;YACnC,IAAI,kBAAkB,KAAK,SAAS;gBAAE,MAAM,IAAI,KAAK,CAAC,oBAAoB,GAAG,GAAG,CAAC,CAAC;YAClF,kBAAkB,GAAG,eAAe,CAAC,IAAI,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC;YACnD,CAAC,EAAE,CAAC;YACJ,SAAS;QACX,CAAC;QACD,IAAI,GAAG,KAAK,oBAAoB,EAAE,CAAC;YACjC,IAAI,qBAAqB,KAAK,SAAS;gBAAE,MAAM,IAAI,KAAK,CAAC,oBAAoB,GAAG,GAAG,CAAC,CAAC;YACrF,qBAAqB,GAAG,eAAe,CAAC,IAAI,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC;YACtD,CAAC,EAAE,CAAC;YACJ,SAAS;QACX,CAAC;QACD,IAAI,GAAG,KAAK,sBAAsB,EAAE,CAAC;YACnC,IAAI,kBAAkB,KAAK,SAAS;gBAAE,MAAM,IAAI,KAAK,CAAC,oBAAoB,GAAG,GAAG,CAAC,CAAC;YAClF,MAAM,GAAG,GAAG,eAAe,CAAC,IAAI,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC;YAC1C,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,GAAG,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;YAC/E,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;YAC3B,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;YACjF,kBAAkB,GAAG,MAAM,CAAC;YAC5B,CAAC,EAAE,CAAC;YACJ,SAAS;QACX,CAAC;QACD,IAAI,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,kBAAkB,GAAG,GAAG,CAAC,CAAC;QACpE,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACxB,CAAC;IACD,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,kBAAkB,CAAC,CAAC;IAC1F,OAAO;QACL,KAAK,EAAE,WAAW,CAAC,CAAC,CAAC;QACrB,UAAU,EAAE,WAAW,CAAC,CAAC,CAAC;QAC1B,kBAAkB;QAClB,qBAAqB;QACrB,kBAAkB;KACnB,CAAC;AACJ,CAAC;AACD,SAAS,IAAI,CAAC,IAAY,EAAE,KAAc,EAAE,WAAW,GAAG,KAAK;IAC7D,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE;QACzD,IAAI,EAAE,WAAW,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK;QACjC,IAAI,EAAE,IAAI;KACX,CAAC,CAAC;AACL,CAAC;AACD,KAAK,UAAU,IAAI,CAAC,IAAc;IAChC,MAAM,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC;IAChC,QAAQ,OAAO,EAAE,CAAC;QAChB,KAAK,WAAW,CAAC;QACjB,KAAK,IAAI;YACP,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,GAAG,CAAC,oBAAoB,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;YACtG,MAAM;QACR,KAAK,QAAQ;YACX,MAAM,aAAa,EAAE,CAAC;YACtB,MAAM;QACR,KAAK,OAAO;YACV,MAAM,YAAY,CAAC,IAAI,CAAC,CAAC;YACzB,MAAM;QACR,KAAK,UAAU;YACb,eAAe,CAAC,IAAI,CAAC,CAAC;YACtB,MAAM;QACR,KAAK,SAAS;YACZ,cAAc,CAAC,IAAI,CAAC,CAAC;YACrB,MAAM;QACR,KAAK,OAAO,CAAC;QACb,KAAK,QAAQ,CAAC;QACd,KAAK,UAAU,CAAC;QAChB,KAAK,UAAU,CAAC;QAChB,KAAK,QAAQ;YACX,MAAM,cAAc,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;YACpC,MAAM;QACR,KAAK,YAAY;YACf,MAAM,gBAAgB,CAAC,IAAI,CAAC,CAAC;YAC7B,MAAM;QACR,KAAK,QAAQ,CAAC,CAAC,CAAC;YACd,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;YACxF,MAAM,GAAG,GAAG,eAAe,EAAE,CAAC;YAC9B,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;YACzB,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;YAChE,MAAM;QACR,CAAC;QACD,KAAK,UAAU,CAAC,CAAC,CAAC;YAChB,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAC1D,IAAI,GAAG,IAAI,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAC/C,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI;gBAAE,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;YAC9F,cAAc,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;YACnC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YACrB,MAAM;QACR,CAAC;QACD,KAAK,SAAS,CAAC,CAAC,CAAC;YACf,MAAM,CAAC,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,UAAU,CAAC,GAAG,IAAI,CAAC;YAC7D,IAAI,CAAC,OAAO,IAAI,CAAC,IAAI,IAAI,CAAC,MAAM,IAAI,CAAC,UAAU,IAAI,CAAC,UAAU;gBAC5D,MAAM,IAAI,KAAK,CACb,4FAA4F,CAC7F,CAAC;YACJ,IACE,CAAC;gBACC,qBAAqB;gBACrB,sBAAsB;gBACtB,iBAAiB;gBACjB,cAAc;gBACd,oBAAoB;aACrB,CAAC,QAAQ,CAAC,IAAI,CAAC;gBAEhB,MAAM,IAAI,KAAK,CAAC,cAAc,CAAC,CAAC;YAClC,MAAM,OAAO,GAAG,YAAY,CAC1B,MAAM,EACN,IAAY,EACZ,IAAI,CAAC,UAAU,CAAC,EAChB,IAAI,CAAC,OAAO,CAAY,CACzB,CAAC;YACF,cAAc,CAAC,kBAAkB,EAAE,OAAO,CAAC,CAAC;YAC5C,IAAI,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;YAC1B,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,OAAO,CAAC,SAAS,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC;YAClF,MAAM;QACR,CAAC;QACD,KAAK,cAAc,CAAC,CAAC,CAAC;YACpB,MAAM,MAAM,GAAG,oBAAoB,CAAC,IAAI,CAAC,CAAC;YAC1C,MAAM,KAAK,GAAG,YAAY,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;YACjD,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC;gBAC5C,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC;gBACnB,CAAC,CAAE,IAAI,CAAC,KAAK,CAAC,KAAK,CAAiB,CAAC;YACvC,MAAM,OAAO,GAA6B,EAAE,CAAC;YAC7C,IAAI,MAAM,CAAC,UAAU,EAAE,CAAC;gBACtB,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,UAAU,CAA6B,CAAC;gBACjE,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;oBAC1D,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;gBAC1C,0EAA0E;gBAC1E,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC;gBAC3B,OAAO,CAAC,MAAM,GAAG,OAAO,IAAI,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;gBACpE,OAAO,CAAC,MAAM;oBACZ,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC;wBACpD,CAAC,CAAE,IAAI,CAAC,MAA2B;wBACnC,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;gBACf,IAAI,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ;oBAAE,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;YAC9D,CAAC;YACD,IAAI,MAAM,CAAC,kBAAkB,KAAK,SAAS;gBACzC,OAAO,CAAC,kBAAkB,GAAG,MAAM,CAAC,kBAAkB,CAAC;YACzD,IAAI,MAAM,CAAC,qBAAqB,KAAK,SAAS;gBAC5C,OAAO,CAAC,qBAAqB,GAAG,MAAM,CAAC,qBAAqB,CAAC;YAC/D,IAAI,MAAM,CAAC,kBAAkB,KAAK,SAAS;gBACzC,OAAO,CAAC,kBAAkB,GAAG,MAAM,CAAC,kBAAkB,CAAC;YACzD,MAAM,QAAQ,GACZ,MAAM,CAAC,UAAU,KAAK,SAAS;gBAC/B,MAAM,CAAC,kBAAkB,KAAK,SAAS;gBACvC,MAAM,CAAC,qBAAqB,KAAK,SAAS;gBAC1C,MAAM,CAAC,kBAAkB,KAAK,SAAS,CAAC;YAC1C,MAAM,MAAM,GAAG,WAAW,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;YACnE,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;YACpC,IAAI,CAAC,MAAM,CAAC,KAAK;gBAAE,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;YACxC,MAAM;QACR,CAAC;QACD,KAAK,MAAM,CAAC,CAAC,CAAC;YACZ,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,EACvC,SAAS,GAAG,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YACvD,IAAI,KAAK,IAAI,CAAC,IAAI,CAAC,SAAS;gBAAE,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;YAC3E,IAAI,SAAS;gBAAE,SAAS,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;YACtE,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,OAAO,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;YAC/D,MAAM;QACR,CAAC;QACD;YACE,MAAM,IAAI,KAAK,CACb,8IAA8I,CAC/I,CAAC;IACN,CAAC;AACH,CAAC;AACD,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;IAC1C,OAAO,CAAC,KAAK,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC,CAAC;IACrC,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;AACvB,CAAC,CAAC,CAAC"}

package/dist/cli/dist/invite-share.js

@@ -4,16 +4,10 @@ import { dirname, join } from 'node:path';
 import { randomUUID } from 'node:crypto';
 import { createInterface } from 'node:readline/promises';
 import QRCode from 'qrcode';
-import { createInviteToken, createSignedAgentCard, generateKeyPair, parseAndVerifyInviteToken, signPayload, verifySigned } from '../../packages/core/dist/index.js';
+import { createInviteToken, createSignedAgentCard, generateKeyPair, inviteTokenFromUri, parseAndVerifyInviteToken, signPayload, verifySigned } from '../../packages/core/dist/index.js';
 import { addContact, contactsPath } from './contacts.js';
 export function inviteToken(value) {
-    if (value.startsWith('acp-invite:'))
-        return value;
-    const u = new URL(value);
-    if (u.protocol !== 'https:' || u.username || u.password || u.search ||
-        !/^#acp-invite:[A-Za-z0-9_-]+$/.test(u.hash))
-        throw new Error('INVALID_INVITE_LINK');
-    return u.hash.slice(1);
+    return inviteTokenFromUri(value);
 }
 export function openInvite(value, now = Date.now()) {
     return parseAndVerifyInviteToken(inviteToken(value), now);