sealbridge 0.2.2 → 0.3.0

package/dist/packages/runtime/dist/key-store.js

@@ -0,0 +1,226 @@
+// SPDX-License-Identifier: Apache-2.0
+import * as fs from 'node:fs';
+import { createHash, createPrivateKey } from 'node:crypto';
+import { join } from 'node:path';
+import { generateKeyPair, signPayload, verifySigned } from '../../core/dist/index.js';
+import { inspectLocalIdentity, resolveOrCreateIdentity, resolveDataRoot, ensurePrivateDirectory, checkPrivatePath, checkPrivateStat, } from './local-identity.js';
+import { readApplicationConfig } from './application-config.js';
+const failure = (code) => new Error(code);
+function validateKey(key) {
+    try {
+        if (!key || typeof key.did !== 'string' || typeof key.privateKey !== 'string' ||
+            createPrivateKey(key.privateKey).asymmetricKeyType !== 'ed25519' ||
+            !verifySigned(signPayload({ type: 'LocalIdentityCheck' }, key, '2026-01-01T00:00:00.000Z'), key.did))
+            throw failure('IDENTITY_INVALID');
+        return key;
+    }
+    catch {
+        throw failure('IDENTITY_INVALID');
+    }
+}
+/** File paths, legacy selection, validation and publication retain their existing implementation. */
+export class FileKeyStore {
+    options;
+    constructor(options = {}) {
+        this.options = options;
+    }
+    load(role) { return inspectLocalIdentity(role, this.options).key; }
+    createIfMissing(role) { return resolveOrCreateIdentity(role, this.options); }
+    exists(role) { return this.load(role) !== undefined; }
+    describe(role) {
+        const selected = inspectLocalIdentity(role, this.options);
+        return { backend: 'file', location: selected.path, source: selected.source };
+    }
+}
+/** Stable service name scoped to the normalized absolute data root; accounts are role names. */
+export function keychainService(options = {}) {
+    return 'sealbridge:' + createHash('sha256').update(resolveDataRoot(options)).digest('hex');
+}
+export class KeychainKeyStore {
+    module;
+    options;
+    service;
+    constructor(module, options = {}) {
+        this.module = module;
+        this.options = options;
+        this.service = keychainService(options);
+    }
+    describe(role) {
+        return { backend: 'keychain', location: this.service + '/' + role };
+    }
+    entry(role) {
+        return new this.module.Entry(this.service, role, { linux: { store: 'secret-service' } });
+    }
+    secret(role) {
+        try {
+            return this.entry(role).getPassword();
+        }
+        catch {
+            throw failure('KEY_STORE_UNAVAILABLE');
+        }
+    }
+    exists(role) { return this.secret(role) !== null; }
+    load(role) {
+        const secret = this.secret(role);
+        if (secret === null)
+            return undefined;
+        try {
+            if (Buffer.byteLength(secret) > 16 * 1024)
+                throw failure('IDENTITY_INVALID');
+            const jwk = JSON.parse(secret);
+            if (jwk.kty !== 'OKP' || jwk.crv !== 'Ed25519' || typeof jwk.d !== 'string' ||
+                typeof jwk.kid !== 'string')
+                throw failure('IDENTITY_INVALID');
+            const privateKey = createPrivateKey({ key: jwk, format: 'jwk' })
+                .export({ type: 'pkcs8', format: 'pem' }).toString();
+            return validateKey({ did: jwk.kid, privateKey });
+        }
+        catch {
+            throw failure('IDENTITY_INVALID');
+        }
+    }
+    createIfMissing(role) {
+        const existing = this.load(role);
+        if (existing)
+            return existing;
+        const io = this.options.fs ?? fs;
+        const platform = this.options.platform ?? process.platform;
+        const root = resolveDataRoot(this.options);
+        const lock = join(root, '.keychain-' + role + '.lock');
+        let fd;
+        try {
+            ensurePrivateDirectory(root, io, platform);
+            checkPrivatePath(lock, io, platform);
+            // The lock contains no key material and coordinates Sealbridge writers across processes.
+            fd = io.openSync(lock, fs.constants.O_WRONLY | fs.constants.O_CREAT | fs.constants.O_EXCL |
+                (fs.constants.O_NOFOLLOW ?? 0), 0o600);
+            checkPrivateStat(io.fstatSync(fd));
+            const winner = this.load(role);
+            if (winner)
+                return winner;
+            const key = generateKeyPair();
+            const jwk = createPrivateKey(key.privateKey).export({ format: 'jwk' });
+            try {
+                this.entry(role).setPassword(JSON.stringify({ ...jwk, kid: key.did }));
+            }
+            catch {
+                throw failure('KEY_STORE_UNAVAILABLE');
+            }
+            const stored = this.load(role);
+            if (!stored || stored.did !== key.did)
+                throw failure('KEY_STORE_CONFLICT');
+            return stored;
+        }
+        catch (error) {
+            if (error.code === 'EEXIST')
+                throw failure('KEY_STORE_BUSY');
+            if (error instanceof Error && /^(IDENTITY_|KEY_STORE_)/.test(error.message))
+                throw error;
+            throw failure('IDENTITY_STORE_UNWRITABLE');
+        }
+        finally {
+            if (fd !== undefined) {
+                io.closeSync(fd);
+                io.unlinkSync(lock);
+            }
+        }
+    }
+}
+export async function optionalKeyring(options, required) {
+    // A variable specifier keeps the native package optional for TypeScript and packaging.
+    const name = '@napi-rs/keyring';
+    try {
+        const module = await (options.keyringLoader ? options.keyringLoader() : import(name));
+        if (typeof module.Entry !== 'function')
+            throw failure('KEY_STORE_UNAVAILABLE');
+        return module;
+    }
+    catch {
+        if (required)
+            throw failure('KEY_STORE_UNAVAILABLE');
+        return undefined;
+    }
+}
+/** Resolve selection metadata without loading a backend or creating an identity. */
+export function keyStoreSelection(options = {}) {
+    if (options.explicitKeyPath !== undefined)
+        return { keyStore: 'file', source: 'option' };
+    const env = options.env ?? process.env;
+    let keyStore = options.keyStore ?? env.SEALBRIDGE_KEY_STORE;
+    let source = options.keyStore !== undefined ? 'option' : 'env';
+    if (keyStore === undefined) {
+        // Relay opt-in is evaluated by relay consumers, independently of identity storage.
+        keyStore = readApplicationConfig({ ...options, allowPrivateRelay: true }).keyStore;
+        source = keyStore === undefined ? 'default' : 'config';
+    }
+    if (keyStore !== undefined && keyStore !== 'file' && keyStore !== 'keychain' &&
+        (typeof keyStore !== 'object' || keyStore === null))
+        throw failure('KEY_STORE_INVALID');
+    return { keyStore: keyStore ?? 'file', source };
+}
+/** Inspect the other backend without creating entries; optional keychain inspection may be unavailable. */
+export async function otherKeyStorePresence(selected, options = {}) {
+    const module = selected === 'file' ? await optionalKeyring(options, false) : undefined;
+    if (selected === 'file' && !module)
+        return ['keychain: inspection unavailable'];
+    const other = selected === 'file' ? new KeychainKeyStore(module, options) : new FileKeyStore(options);
+    const warnings = [];
+    for (const role of ['requester', 'worker']) {
+        try {
+            if (await other.exists(role))
+                warnings.push(`${role}: identity also present in ${selected === 'file' ? 'keychain' : 'file'} backend; no identity was moved`);
+        }
+        catch (error) {
+            warnings.push(`${role}: other backend inspection returned ${error.message}`);
+        }
+    }
+    return warnings;
+}
+/** Explicit file paths always bypass backend configuration and optional module loading. */
+export async function selectKeyStore(role, options = {}) {
+    if (options.explicitKeyPath !== undefined)
+        return new FileKeyStore(options);
+    const selection = keyStoreSelection(options);
+    const selected = selection.source === 'default' ? undefined : selection.keyStore;
+    if (selected !== undefined && typeof selected === 'object' && selected !== null)
+        return selected;
+    if (selected === 'file')
+        return new FileKeyStore(options);
+    if (selected !== undefined && selected !== 'keychain')
+        throw failure('KEY_STORE_INVALID');
+    const module = await optionalKeyring(options, selected === 'keychain');
+    if (selected === 'keychain')
+        return new KeychainKeyStore(module, options);
+    const file = new FileKeyStore(options);
+    let keychainPresent = false;
+    if (module) {
+        try {
+            keychainPresent = new KeychainKeyStore(module, options).exists(role);
+        }
+        catch (error) {
+            // No keychain was selected; retain file operation when inspection is unavailable.
+            if (!(error instanceof Error) || error.message !== 'KEY_STORE_UNAVAILABLE')
+                throw error;
+        }
+    }
+    if (keychainPresent) {
+        if (file.exists(role))
+            throw failure('KEY_STORE_CONFLICT');
+        throw failure('KEY_STORE_SELECTION_REQUIRED');
+    }
+    return file;
+}
+/** Read-only inspection used by doctor and peer review; never creates an identity. */
+export async function inspectStoredIdentity(role, options = {}) {
+    const store = await selectKeyStore(role, options);
+    const description = await store.describe(role);
+    const key = await store.load(role);
+    return { ...description, present: key !== undefined, key: key === undefined ? undefined : validateKey(key) };
+}
+/** Resolve the configured store, preserving its create-if-missing semantics. */
+export async function resolveStoredIdentity(role, options = {}) {
+    const store = await selectKeyStore(role, options);
+    const existing = await store.load(role);
+    return validateKey(existing ?? await store.createIfMissing(role));
+}
+//# sourceMappingURL=key-store.js.map

package/dist/packages/runtime/dist/key-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"key-store.js","sourceRoot":"","sources":["../src/key-store.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,EAAE,UAAU,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAC3D,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,eAAe,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AAEvE,OAAO,EACL,oBAAoB,EAAE,uBAAuB,EAAE,eAAe,EAC9D,sBAAsB,EAAE,gBAAgB,EAAE,gBAAgB,GAC3D,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EAAE,qBAAqB,EAAE,MAAM,yBAAyB,CAAC;AAkChE,MAAM,OAAO,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC;AAElD,SAAS,WAAW,CAAC,GAAY;IAC/B,IAAI,CAAC;QACH,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,CAAC,GAAG,KAAK,QAAQ,IAAI,OAAO,GAAG,CAAC,UAAU,KAAK,QAAQ;YACzE,gBAAgB,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,iBAAiB,KAAK,SAAS;YAChE,CAAC,YAAY,CAAC,WAAW,CAAC,EAAE,IAAI,EAAE,oBAAoB,EAAE,EAAE,GAAG,EAC3D,0BAA0B,CAAC,EAAE,GAAG,CAAC,GAAG,CAAC;YAAE,MAAM,OAAO,CAAC,kBAAkB,CAAC,CAAC;QAC/E,OAAO,GAAG,CAAC;IACb,CAAC;IAAC,MAAM,CAAC;QAAC,MAAM,OAAO,CAAC,kBAAkB,CAAC,CAAC;IAAC,CAAC;AAChD,CAAC;AAED,qGAAqG;AACrG,MAAM,OAAO,YAAY;IACF;IAArB,YAAqB,UAAgC,EAAE;QAAlC,YAAO,GAAP,OAAO,CAA2B;IAAG,CAAC;IAC3D,IAAI,CAAC,IAAkB,IAAyB,OAAO,oBAAoB,CAAC,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IACtG,eAAe,CAAC,IAAkB,IAAa,OAAO,uBAAuB,CAAC,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;IACpG,MAAM,CAAC,IAAkB,IAAa,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC;IAC7E,QAAQ,CAAC,IAAkB;QACzB,MAAM,QAAQ,GAAG,oBAAoB,CAAC,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;QAC1D,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;IAC/E,CAAC;CACF;AAED,gGAAgG;AAChG,MAAM,UAAU,eAAe,CAAC,UAAgC,EAAE;IAChE,OAAO,aAAa,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC7F,CAAC;AAED,MAAM,OAAO,gBAAgB;IAEE;IAAgC;IAD5C,OAAO,CAAS;IACjC,YAA6B,MAAqB,EAAW,UAAgC,EAAE;QAAlE,WAAM,GAAN,MAAM,CAAe;QAAW,YAAO,GAAP,OAAO,CAA2B;QAC7F,IAAI,CAAC,OAAO,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC;IAC1C,CAAC;IACD,QAAQ,CAAC,IAAkB;QACzB,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,IAAI,CAAC,OAAO,GAAG,GAAG,GAAG,IAAI,EAAE,CAAC;IACtE,CAAC;IACO,KAAK,CAAC,IAAkB;QAC9B,OAAO,IAAI,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,gBAAgB,EAAE,EAAE,CAAC,CAAC;IAC3F,CAAC;IACO,MAAM,CAAC,IAAkB;QAC/B,IAAI,CAAC;YAAC,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC;QAAC,CAAC;QAC9C,MAAM,CAAC;YAAC,MAAM,OAAO,CAAC,uBAAuB,CAAC,CAAC;QAAC,CAAC;IACnD,CAAC;IACD,MAAM,CAAC,IAAkB,IAAa,OAAO,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC;IAC1E,IAAI,CAAC,IAAkB;QACrB,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACjC,IAAI,MAAM,KAAK,IAAI;YAAE,OAAO,SAAS,CAAC;QACtC,IAAI,CAAC;YACH,IAAI,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,GAAG,EAAE,GAAG,IAAI;gBAAE,MAAM,OAAO,CAAC,kBAAkB,CAAC,CAAC;YAC7E,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;YAC/B,IAAI,GAAG,CAAC,GAAG,KAAK,KAAK,IAAI,GAAG,CAAC,GAAG,KAAK,SAAS,IAAI,OAAO,GAAG,CAAC,CAAC,KAAK,QAAQ;gBACvE,OAAO,GAAG,CAAC,GAAG,KAAK,QAAQ;gBAAE,MAAM,OAAO,CAAC,kBAAkB,CAAC,CAAC;YACnE,MAAM,UAAU,GAAG,gBAAgB,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;iBAC7D,MAAM,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC;YACvD,OAAO,WAAW,CAAC,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,UAAU,EAAE,CAAC,CAAC;QACnD,CAAC;QAAC,MAAM,CAAC;YAAC,MAAM,OAAO,CAAC,kBAAkB,CAAC,CAAC;QAAC,CAAC;IAChD,CAAC;IACD,eAAe,CAAC,IAAkB;QAChC,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACjC,IAAI,QAAQ;YAAE,OAAO,QAAQ,CAAC;QAC9B,MAAM,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,CAAC;QACjC,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,QAAQ,CAAC;QAC3D,MAAM,IAAI,GAAG,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC3C,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,YAAY,GAAG,IAAI,GAAG,OAAO,CAAC,CAAC;QACvD,IAAI,EAAsB,CAAC;QAC3B,IAAI,CAAC;YACH,sBAAsB,CAAC,IAAI,EAAE,EAAE,EAAE,QAAQ,CAAC,CAAC;YAC3C,gBAAgB,CAAC,IAAI,EAAE,EAAE,EAAE,QAAQ,CAAC,CAAC;YACrC,yFAAyF;YACzF,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC,SAAS,CAAC,QAAQ,GAAG,EAAE,CAAC,SAAS,CAAC,OAAO,GAAG,EAAE,CAAC,SAAS,CAAC,MAAM;gBACvF,CAAC,EAAE,CAAC,SAAS,CAAC,UAAU,IAAI,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;YACzC,gBAAgB,CAAC,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC;YACnC,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC/B,IAAI,MAAM;gBAAE,OAAO,MAAM,CAAC;YAC1B,MAAM,GAAG,GAAG,eAAe,EAAE,CAAC;YAC9B,MAAM,GAAG,GAAG,gBAAgB,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;YACvE,IAAI,CAAC;gBAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;YAAC,CAAC;YAC/E,MAAM,CAAC;gBAAC,MAAM,OAAO,CAAC,uBAAuB,CAAC,CAAC;YAAC,CAAC;YACjD,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC/B,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,GAAG,KAAK,GAAG,CAAC,GAAG;gBAAE,MAAM,OAAO,CAAC,oBAAoB,CAAC,CAAC;YAC3E,OAAO,MAAM,CAAC;QAChB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;gBAAE,MAAM,OAAO,CAAC,gBAAgB,CAAC,CAAC;YACxF,IAAI,KAAK,YAAY,KAAK,IAAI,yBAAyB,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC;gBAAE,MAAM,KAAK,CAAC;YACzF,MAAM,OAAO,CAAC,2BAA2B,CAAC,CAAC;QAC7C,CAAC;gBAAS,CAAC;YACT,IAAI,EAAE,KAAK,SAAS,EAAE,CAAC;gBAAC,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;gBAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;YAAC,CAAC;QAClE,CAAC;IACH,CAAC;CACF;AAED,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,OAA6B,EAAE,QAAiB;IACpF,uFAAuF;IACvF,MAAM,IAAI,GAAG,kBAAkB,CAAC;IAChC,IAAI,CAAC;QACH,MAAM,MAAM,GAAkB,MAAM,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,OAAO,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;QACrG,IAAI,OAAO,MAAM,CAAC,KAAK,KAAK,UAAU;YAAE,MAAM,OAAO,CAAC,uBAAuB,CAAC,CAAC;QAC/E,OAAO,MAAM,CAAC;IAChB,CAAC;IAAC,MAAM,CAAC;QACP,IAAI,QAAQ;YAAE,MAAM,OAAO,CAAC,uBAAuB,CAAC,CAAC;QACrD,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAOD,oFAAoF;AACpF,MAAM,UAAU,iBAAiB,CAAC,UAAgC,EAAE;IAClE,IAAI,OAAO,CAAC,eAAe,KAAK,SAAS;QAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;IACzF,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;IACvC,IAAI,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,GAAG,CAAC,oBAAoB,CAAC;IAC5D,IAAI,MAAM,GAAgC,OAAO,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC;IAC5F,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,mFAAmF;QACnF,QAAQ,GAAG,qBAAqB,CAAC,EAAE,GAAG,OAAO,EAAE,iBAAiB,EAAE,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC;QACnF,MAAM,GAAG,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC;IACzD,CAAC;IACD,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,KAAK,MAAM,IAAI,QAAQ,KAAK,UAAU;QACxE,CAAC,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,KAAK,IAAI,CAAC;QAAE,MAAM,OAAO,CAAC,mBAAmB,CAAC,CAAC;IAC5F,OAAO,EAAE,QAAQ,EAAE,QAAQ,IAAI,MAAM,EAAE,MAAM,EAAE,CAAC;AAClD,CAAC;AAED,2GAA2G;AAC3G,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,QAA6B,EAAE,UAAgC,EAAE;IAC3G,MAAM,MAAM,GAAG,QAAQ,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,eAAe,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACvF,IAAI,QAAQ,KAAK,MAAM,IAAI,CAAC,MAAM;QAAE,OAAO,CAAC,kCAAkC,CAAC,CAAC;IAChF,MAAM,KAAK,GAAG,QAAQ,KAAK,MAAM,CAAC,CAAC,CAAC,IAAI,gBAAgB,CAAC,MAAO,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,YAAY,CAAC,OAAO,CAAC,CAAC;IACvG,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,KAAK,MAAM,IAAI,IAAI,CAAC,WAAW,EAAE,QAAQ,CAAU,EAAE,CAAC;QACpD,IAAI,CAAC;YACH,IAAI,MAAM,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC;gBAAE,QAAQ,CAAC,IAAI,CAAC,GAAG,IAAI,8BAA8B,QAAQ,KAAK,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,iCAAiC,CAAC,CAAC;QAC/J,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,QAAQ,CAAC,IAAI,CAAC,GAAG,IAAI,uCAAwC,KAAe,CAAC,OAAO,EAAE,CAAC,CAAC;QAC1F,CAAC;IACH,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,2FAA2F;AAC3F,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,IAAkB,EAAE,UAAgC,EAAE;IACzF,IAAI,OAAO,CAAC,eAAe,KAAK,SAAS;QAAE,OAAO,IAAI,YAAY,CAAC,OAAO,CAAC,CAAC;IAC5E,MAAM,SAAS,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC;IAC7C,MAAM,QAAQ,GAAG,SAAS,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,QAAQ,CAAC;IACjF,IAAI,QAAQ,KAAK,SAAS,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,KAAK,IAAI;QAAE,OAAO,QAAQ,CAAC;IACjG,IAAI,QAAQ,KAAK,MAAM;QAAE,OAAO,IAAI,YAAY,CAAC,OAAO,CAAC,CAAC;IAC1D,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,KAAK,UAAU;QAAE,MAAM,OAAO,CAAC,mBAAmB,CAAC,CAAC;IAC1F,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,OAAO,EAAE,QAAQ,KAAK,UAAU,CAAC,CAAC;IACvE,IAAI,QAAQ,KAAK,UAAU;QAAE,OAAO,IAAI,gBAAgB,CAAC,MAAO,EAAE,OAAO,CAAC,CAAC;IAC3E,MAAM,IAAI,GAAG,IAAI,YAAY,CAAC,OAAO,CAAC,CAAC;IACvC,IAAI,eAAe,GAAG,KAAK,CAAC;IAC5B,IAAI,MAAM,EAAE,CAAC;QACX,IAAI,CAAC;YAAC,eAAe,GAAG,IAAI,gBAAgB,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAAC,CAAC;QAC7E,OAAO,KAAK,EAAE,CAAC;YACb,kFAAkF;YAClF,IAAI,CAAC,CAAC,KAAK,YAAY,KAAK,CAAC,IAAI,KAAK,CAAC,OAAO,KAAK,uBAAuB;gBAAE,MAAM,KAAK,CAAC;QAC1F,CAAC;IACH,CAAC;IACD,IAAI,eAAe,EAAE,CAAC;QACpB,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC;YAAE,MAAM,OAAO,CAAC,oBAAoB,CAAC,CAAC;QAC3D,MAAM,OAAO,CAAC,8BAA8B,CAAC,CAAC;IAChD,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,sFAAsF;AACtF,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,IAAkB,EAAE,UAAgC,EAAE;IAChG,MAAM,KAAK,GAAG,MAAM,cAAc,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IAClD,MAAM,WAAW,GAAG,MAAM,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IAC/C,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACnC,OAAO,EAAE,GAAG,WAAW,EAAE,OAAO,EAAE,GAAG,KAAK,SAAS,EAAE,GAAG,EAAE,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC;AAC/G,CAAC;AAED,gFAAgF;AAChF,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,IAAkB,EAAE,UAAgC,EAAE;IAChG,MAAM,KAAK,GAAG,MAAM,cAAc,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IAClD,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACxC,OAAO,WAAW,CAAC,QAAQ,IAAI,MAAM,KAAK,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC;AACpE,CAAC"}

package/dist/packages/runtime/dist/local-identity.d.ts

@@ -0,0 +1,33 @@
+import * as fs from 'node:fs';
+import type { KeyPair } from '../../core/dist/index.js';
+export type IdentityRole = 'requester' | 'worker';
+export interface DataRootOptions {
+    env?: NodeJS.ProcessEnv;
+    home?: string;
+    platform?: NodeJS.Platform;
+}
+export interface LocalIdentityOptions extends DataRootOptions {
+    explicitKeyPath?: string;
+    /** Filesystem injection for deterministic I/O failure tests. */
+    fs?: typeof fs;
+}
+export interface LocalIdentity {
+    path: string;
+    source: 'explicit' | 'default' | 'legacy';
+    key?: KeyPair;
+}
+export declare function resolveDataRoot(options?: DataRootOptions): string;
+/** Reject links, except macOS's root-owned /var and /tmp system aliases. */
+export declare function checkPath(path: string, io: typeof fs, platform?: NodeJS.Platform): void;
+export declare function checkStat(stat: fs.Stats, directory?: boolean): void;
+export declare function inspectDirectory(path: string, io: typeof fs, platform?: NodeJS.Platform): void;
+/** Bounded descriptor-based read using the application private-file policy. */
+export declare function readPrivateFile(path: string, io: typeof fs, maxBytes: number, platform?: NodeJS.Platform): string | undefined;
+/** Inspect without creating directories or identities. Canonical files take precedence. */
+export declare function inspectLocalIdentity(role: IdentityRole, options?: LocalIdentityOptions): LocalIdentity;
+export declare function privateDirectory(path: string, io: typeof fs, platform?: NodeJS.Platform): void;
+/** Exclusive creation of a flushed private temporary file. Caller owns cleanup. */
+export declare function writePrivateFile(path: string, bytes: Buffer, io: typeof fs, platform?: NodeJS.Platform): void;
+/** Publish a flushed temporary key without replacing a concurrently committed identity. */
+export declare function resolveOrCreateIdentity(role: IdentityRole, options?: LocalIdentityOptions): KeyPair;
+export { checkPath as checkPrivatePath, checkStat as checkPrivateStat, inspectDirectory as inspectPrivateDirectory, privateDirectory as ensurePrivateDirectory, };

package/dist/packages/runtime/dist/local-identity.js

@@ -0,0 +1,278 @@
+// SPDX-License-Identifier: Apache-2.0
+import * as fs from 'node:fs';
+import { homedir } from 'node:os';
+import { dirname, join, posix, win32 } from 'node:path';
+import { createPrivateKey, randomUUID } from 'node:crypto';
+import { generateKeyPair, signPayload, verifySigned } from '../../core/dist/index.js';
+const MAX_KEY_BYTES = 16 * 1024;
+function failure(code) { return new Error(code); }
+function errno(error) { return error.code; }
+function context(options) {
+    const platform = options.platform ?? process.platform;
+    const paths = platform === 'win32' ? win32 : posix;
+    const env = options.env ?? process.env;
+    let home = options.home;
+    if (home === undefined) {
+        try {
+            home = homedir();
+        }
+        catch {
+            home = '';
+        }
+    }
+    return { platform, paths, env, home };
+}
+export function resolveDataRoot(options = {}) {
+    const { platform, paths, env, home } = context(options);
+    const override = env.SEALBRIDGE_DATA_DIR ?? env.ACP_DATA_DIR;
+    if (override !== undefined) {
+        if (!paths.isAbsolute(override))
+            throw failure('DATA_DIR_UNAVAILABLE');
+        return paths.normalize(override);
+    }
+    const base = platform === 'win32' ? env.LOCALAPPDATA
+        : platform === 'linux' ? env.XDG_DATA_HOME : undefined;
+    if (base) {
+        if (!paths.isAbsolute(base))
+            throw failure('DATA_DIR_UNAVAILABLE');
+        return paths.join(base, platform === 'win32' ? 'Sealbridge' : 'sealbridge');
+    }
+    if (!home || !paths.isAbsolute(home))
+        throw failure('DATA_DIR_UNAVAILABLE');
+    return platform === 'win32' ? paths.join(home, 'AppData', 'Local', 'Sealbridge')
+        : platform === 'darwin' ? paths.join(home, 'Library', 'Application Support', 'Sealbridge')
+            : paths.join(home, '.local', 'share', 'sealbridge');
+}
+function legacyPaths(role, options) {
+    const { paths, platform, env, home } = context(options);
+    if (!home || !paths.isAbsolute(home))
+        return [];
+    if (env.ACP_DATA_DIR !== undefined && !paths.isAbsolute(env.ACP_DATA_DIR))
+        throw failure('DATA_DIR_UNAVAILABLE');
+    const result = [paths.join(home, '.acp', role + '.private.json')];
+    if (role === 'requester') {
+        const oldRoot = env.ACP_DATA_DIR ?? (platform === 'win32'
+            ? paths.join(env.LOCALAPPDATA || home, 'AgentCollaborationPlatform')
+            : platform === 'darwin' ? paths.join(home, 'Library', 'Application Support', 'AgentCollaborationPlatform')
+                : paths.join(env.XDG_DATA_HOME || paths.join(home, '.local', 'share'), 'agent-collab-platform'));
+        if (!paths.isAbsolute(oldRoot))
+            throw failure('DATA_DIR_UNAVAILABLE');
+        result.push(paths.join(oldRoot, 'owner.private.json'));
+    }
+    return result;
+}
+/** Reject links, except macOS's root-owned /var and /tmp system aliases. */
+export function checkPath(path, io, platform = process.platform) {
+    const paths = platform === 'win32' ? win32 : posix;
+    const parent = paths.dirname(path);
+    if (parent !== path)
+        checkPath(parent, io, platform);
+    try {
+        const stat = io.lstatSync(path);
+        if (stat.isSymbolicLink()) {
+            if (platform !== 'darwin' || !['/var', '/tmp'].includes(path) || stat.uid !== 0)
+                throw failure('IDENTITY_INVALID');
+            const target = posix.resolve(parent, io.readlinkSync(path));
+            if (target !== '/private' + path)
+                throw failure('IDENTITY_INVALID');
+            checkPath(target, io, platform);
+        }
+    }
+    catch (error) {
+        if (errno(error) !== 'ENOENT')
+            throw error;
+    }
+}
+export function checkStat(stat, directory = false) {
+    if (directory ? !stat.isDirectory() : !stat.isFile())
+        throw failure('IDENTITY_INVALID');
+    if (process.platform !== 'win32' &&
+        (stat.uid !== process.getuid() || (stat.mode & 0o077) !== 0))
+        throw failure('IDENTITY_INVALID');
+}
+export function inspectDirectory(path, io, platform = process.platform) {
+    checkPath(path, io, platform);
+    const before = io.lstatSync(path);
+    checkStat(before, true);
+    if (process.platform === 'win32')
+        return;
+    const fd = io.openSync(path, fs.constants.O_RDONLY | (fs.constants.O_NOFOLLOW ?? 0) |
+        (fs.constants.O_DIRECTORY ?? 0));
+    try {
+        const stat = io.fstatSync(fd);
+        checkStat(stat, true);
+        if (stat.dev !== before.dev || stat.ino !== before.ino)
+            throw failure('IDENTITY_INVALID');
+    }
+    finally {
+        io.closeSync(fd);
+    }
+}
+/** Bounded descriptor-based read using the application private-file policy. */
+export function readPrivateFile(path, io, maxBytes, platform = process.platform) {
+    let fd;
+    let observed = false;
+    try {
+        checkPath(path, io, platform);
+        // Check type before opening so special files cannot block the reader.
+        const before = io.lstatSync(path);
+        observed = true;
+        checkStat(before);
+        fd = io.openSync(path, fs.constants.O_RDONLY | (fs.constants.O_NOFOLLOW ?? 0) |
+            (fs.constants.O_NONBLOCK ?? 0));
+        const stat = io.fstatSync(fd);
+        checkStat(stat);
+        if (stat.dev !== before.dev || stat.ino !== before.ino)
+            throw failure('IDENTITY_INVALID');
+        const bytes = Buffer.alloc(maxBytes + 1);
+        let length = 0;
+        while (length < bytes.length) {
+            const count = io.readSync(fd, bytes, length, bytes.length - length, null);
+            if (!count)
+                break;
+            length += count;
+        }
+        if (length > maxBytes)
+            throw failure('IDENTITY_INVALID');
+        return bytes.subarray(0, length).toString('utf8');
+    }
+    catch (error) {
+        if (errno(error) === 'ENOENT' && !observed)
+            return undefined;
+        if (error instanceof Error && error.message === 'IDENTITY_INVALID')
+            throw error;
+        throw failure('IDENTITY_UNREADABLE');
+    }
+    finally {
+        if (fd !== undefined)
+            io.closeSync(fd);
+    }
+}
+function readKey(path, io, platform) {
+    const contents = readPrivateFile(path, io, MAX_KEY_BYTES, platform);
+    if (contents === undefined)
+        return undefined;
+    try {
+        const value = JSON.parse(contents);
+        if (!value || typeof value.did !== 'string' || typeof value.privateKey !== 'string' ||
+            Object.keys(value).sort().join(',') !== 'did,privateKey' ||
+            createPrivateKey(value.privateKey).asymmetricKeyType !== 'ed25519' ||
+            !verifySigned(signPayload({ type: 'LocalIdentityCheck' }, value, '2026-01-01T00:00:00.000Z'), value.did))
+            throw failure('IDENTITY_INVALID');
+        return value;
+    }
+    catch {
+        throw failure('IDENTITY_INVALID');
+    }
+}
+/** Inspect without creating directories or identities. Canonical files take precedence. */
+export function inspectLocalIdentity(role, options = {}) {
+    const io = options.fs ?? fs;
+    const platform = options.platform ?? process.platform;
+    if (options.explicitKeyPath !== undefined) {
+        const path = context(options).paths.resolve(options.explicitKeyPath);
+        const key = readKey(path, io, platform);
+        if (!key)
+            throw failure('IDENTITY_UNREADABLE');
+        return { path, source: 'explicit', key };
+    }
+    const root = resolveDataRoot(options);
+    for (const directory of [root, join(root, 'identities')]) {
+        try {
+            inspectDirectory(directory, io, platform);
+        }
+        catch (error) {
+            if (errno(error) !== 'ENOENT') {
+                if (error instanceof Error && error.message === 'IDENTITY_INVALID')
+                    throw error;
+                throw failure('IDENTITY_UNREADABLE');
+            }
+        }
+    }
+    const path = join(root, 'identities', role + '.private.json');
+    const key = readKey(path, io, platform);
+    if (key)
+        return { path, source: 'default', key };
+    let legacy;
+    for (const candidate of legacyPaths(role, options)) {
+        const key = readKey(candidate, io, platform);
+        if (!key)
+            continue;
+        if (legacy && legacy.key.did !== key.did)
+            throw failure('IDENTITY_SELECTION_REQUIRED');
+        legacy ??= { path: candidate, source: 'legacy', key };
+    }
+    return legacy ?? { path, source: 'default' };
+}
+export function privateDirectory(path, io, platform = process.platform) {
+    checkPath(path, io, platform);
+    io.mkdirSync(path, { recursive: true, mode: 0o700 });
+    inspectDirectory(path, io, platform);
+}
+/** Exclusive creation of a flushed private temporary file. Caller owns cleanup. */
+export function writePrivateFile(path, bytes, io, platform = process.platform) {
+    checkPath(path, io, platform);
+    const fd = io.openSync(path, fs.constants.O_WRONLY | fs.constants.O_CREAT | fs.constants.O_EXCL |
+        (fs.constants.O_NOFOLLOW ?? 0), 0o600);
+    try {
+        checkStat(io.fstatSync(fd));
+        let offset = 0;
+        while (offset < bytes.length) {
+            const count = io.writeSync(fd, bytes, offset, bytes.length - offset);
+            if (!count)
+                throw failure('IDENTITY_STORE_UNWRITABLE');
+            offset += count;
+        }
+        io.fsyncSync(fd);
+    }
+    catch (error) {
+        io.closeSync(fd);
+        io.unlinkSync(path);
+        throw error;
+    }
+    io.closeSync(fd);
+}
+/** Publish a flushed temporary key without replacing a concurrently committed identity. */
+export function resolveOrCreateIdentity(role, options = {}) {
+    const io = options.fs ?? fs;
+    const platform = options.platform ?? process.platform;
+    const selected = inspectLocalIdentity(role, options);
+    if (selected.key)
+        return selected.key;
+    const root = resolveDataRoot(options);
+    const temporary = join(dirname(selected.path), '.' + role + '.' + randomUUID() + '.tmp');
+    let temporaryCreated = false;
+    try {
+        privateDirectory(root, io, platform);
+        privateDirectory(dirname(selected.path), io, platform);
+        writePrivateFile(temporary, Buffer.from(JSON.stringify(generateKeyPair()) + '\n'), io, platform);
+        temporaryCreated = true;
+        checkPath(selected.path, io, platform);
+        try {
+            io.linkSync(temporary, selected.path);
+        }
+        catch (error) {
+            if (errno(error) === 'EEXIST') { /* The committed winner is loaded below. */ }
+            else if (['ENOTSUP', 'EOPNOTSUPP', 'ENOSYS', 'EXDEV', 'EPERM'].includes(errno(error) ?? ''))
+                throw failure('IDENTITY_CREATION_UNSUPPORTED');
+            else
+                throw error;
+        }
+    }
+    catch (error) {
+        if (error instanceof Error && error.message.startsWith('IDENTITY_'))
+            throw error;
+        throw failure('IDENTITY_STORE_UNWRITABLE');
+    }
+    finally {
+        if (temporaryCreated)
+            io.unlinkSync(temporary);
+    }
+    const winner = readKey(selected.path, io, platform);
+    if (!winner)
+        throw failure('IDENTITY_UNREADABLE');
+    return winner;
+}
+// Shared checks for application files under the same data root.
+export { checkPath as checkPrivatePath, checkStat as checkPrivateStat, inspectDirectory as inspectPrivateDirectory, privateDirectory as ensurePrivateDirectory, };
+//# sourceMappingURL=local-identity.js.map

package/dist/packages/runtime/dist/local-identity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"local-identity.js","sourceRoot":"","sources":["../src/local-identity.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,WAAW,CAAC;AACxD,OAAO,EAAE,gBAAgB,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAC3D,OAAO,EAAE,eAAe,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AAmBvE,MAAM,aAAa,GAAG,EAAE,GAAG,IAAI,CAAC;AAChC,SAAS,OAAO,CAAC,IAAY,IAAW,OAAO,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AACjE,SAAS,KAAK,CAAC,KAAc,IAAwB,OAAQ,KAA+B,CAAC,IAAI,CAAC,CAAC,CAAC;AACpG,SAAS,OAAO,CAAC,OAAwB;IACvC,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,QAAQ,CAAC;IACtD,MAAM,KAAK,GAAG,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC;IACnD,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;IACvC,IAAI,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;IACxB,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QAAC,IAAI,CAAC;YAAC,IAAI,GAAG,OAAO,EAAE,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC;YAAC,IAAI,GAAG,EAAE,CAAC;QAAC,CAAC;IAAC,CAAC;IAC1E,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC;AACxC,CAAC;AACD,MAAM,UAAU,eAAe,CAAC,UAA2B,EAAE;IAC3D,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACxD,MAAM,QAAQ,GAAG,GAAG,CAAC,mBAAmB,IAAI,GAAG,CAAC,YAAY,CAAC;IAC7D,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,QAAQ,CAAC;YAAE,MAAM,OAAO,CAAC,sBAAsB,CAAC,CAAC;QACvE,OAAO,KAAK,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;IACnC,CAAC;IACD,MAAM,IAAI,GAAG,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,YAAY;QAClD,CAAC,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS,CAAC;IACzD,IAAI,IAAI,EAAE,CAAC;QACT,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC;YAAE,MAAM,OAAO,CAAC,sBAAsB,CAAC,CAAC;QACnE,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC;IAC9E,CAAC;IACD,IAAI,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,MAAM,OAAO,CAAC,sBAAsB,CAAC,CAAC;IAC5E,OAAO,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,YAAY,CAAC;QAC9E,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,qBAAqB,EAAE,YAAY,CAAC;YAC1F,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,YAAY,CAAC,CAAC;AACxD,CAAC;AACD,SAAS,WAAW,CAAC,IAAkB,EAAE,OAAwB;IAC/D,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACxD,IAAI,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,CAAC;IAChD,IAAI,GAAG,CAAC,YAAY,KAAK,SAAS,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,YAAY,CAAC;QACvE,MAAM,OAAO,CAAC,sBAAsB,CAAC,CAAC;IACxC,MAAM,MAAM,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,GAAG,eAAe,CAAC,CAAC,CAAC;IAClE,IAAI,IAAI,KAAK,WAAW,EAAE,CAAC;QACzB,MAAM,OAAO,GAAG,GAAG,CAAC,YAAY,IAAI,CAAC,QAAQ,KAAK,OAAO;YACvD,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,IAAI,IAAI,EAAE,4BAA4B,CAAC;YACpE,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,qBAAqB,EAAE,4BAA4B,CAAC;gBAC1G,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,aAAa,IAAI,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,OAAO,CAAC,EAAE,uBAAuB,CAAC,CAAC,CAAC;QACnG,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,OAAO,CAAC;YAAE,MAAM,OAAO,CAAC,sBAAsB,CAAC,CAAC;QACtE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,oBAAoB,CAAC,CAAC,CAAC;IACzD,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AACD,4EAA4E;AAC5E,MAAM,UAAU,SAAS,CAAC,IAAY,EAAE,EAAa,EAAE,WAA4B,OAAO,CAAC,QAAQ;IACjG,MAAM,KAAK,GAAG,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC;IACnD,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IACnC,IAAI,MAAM,KAAK,IAAI;QAAE,SAAS,CAAC,MAAM,EAAE,EAAE,EAAE,QAAQ,CAAC,CAAC;IACrD,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QAChC,IAAI,IAAI,CAAC,cAAc,EAAE,EAAE,CAAC;YAC1B,IAAI,QAAQ,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,GAAG,KAAK,CAAC;gBAC7E,MAAM,OAAO,CAAC,kBAAkB,CAAC,CAAC;YACpC,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC;YAC5D,IAAI,MAAM,KAAK,UAAU,GAAG,IAAI;gBAAE,MAAM,OAAO,CAAC,kBAAkB,CAAC,CAAC;YACpE,SAAS,CAAC,MAAM,EAAE,EAAE,EAAE,QAAQ,CAAC,CAAC;QAClC,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAAC,IAAI,KAAK,CAAC,KAAK,CAAC,KAAK,QAAQ;YAAE,MAAM,KAAK,CAAC;IAAC,CAAC;AACjE,CAAC;AACD,MAAM,UAAU,SAAS,CAAC,IAAc,EAAE,SAAS,GAAG,KAAK;IACzD,IAAI,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,EAAE;QAAE,MAAM,OAAO,CAAC,kBAAkB,CAAC,CAAC;IACxF,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO;QAC5B,CAAC,IAAI,CAAC,GAAG,KAAK,OAAO,CAAC,MAAO,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC;QAC/D,MAAM,OAAO,CAAC,kBAAkB,CAAC,CAAC;AACtC,CAAC;AACD,MAAM,UAAU,gBAAgB,CAAC,IAAY,EAAE,EAAa,EAAE,WAA4B,OAAO,CAAC,QAAQ;IACxG,SAAS,CAAC,IAAI,EAAE,EAAE,EAAE,QAAQ,CAAC,CAAC;IAC9B,MAAM,MAAM,GAAG,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IAClC,SAAS,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IACxB,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO;QAAE,OAAO;IACzC,MAAM,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC,SAAS,CAAC,QAAQ,GAAG,CAAC,EAAE,CAAC,SAAS,CAAC,UAAU,IAAI,CAAC,CAAC;QACjF,CAAC,EAAE,CAAC,SAAS,CAAC,WAAW,IAAI,CAAC,CAAC,CAAC,CAAC;IACnC,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;QAC9B,SAAS,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QACtB,IAAI,IAAI,CAAC,GAAG,KAAK,MAAM,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,KAAK,MAAM,CAAC,GAAG;YAAE,MAAM,OAAO,CAAC,kBAAkB,CAAC,CAAC;IAC5F,CAAC;YAAS,CAAC;QAAC,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;IAAC,CAAC;AACjC,CAAC;AACD,+EAA+E;AAC/E,MAAM,UAAU,eAAe,CAAC,IAAY,EAAE,EAAa,EAAE,QAAgB,EAAE,WAA4B,OAAO,CAAC,QAAQ;IACzH,IAAI,EAAsB,CAAC;IAC3B,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,IAAI,CAAC;QACH,SAAS,CAAC,IAAI,EAAE,EAAE,EAAE,QAAQ,CAAC,CAAC;QAC9B,sEAAsE;QACtE,MAAM,MAAM,GAAG,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QAClC,QAAQ,GAAG,IAAI,CAAC;QAChB,SAAS,CAAC,MAAM,CAAC,CAAC;QAClB,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC,SAAS,CAAC,QAAQ,GAAG,CAAC,EAAE,CAAC,SAAS,CAAC,UAAU,IAAI,CAAC,CAAC;YAC3E,CAAC,EAAE,CAAC,SAAS,CAAC,UAAU,IAAI,CAAC,CAAC,CAAC,CAAC;QAClC,MAAM,IAAI,GAAG,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;QAC9B,SAAS,CAAC,IAAI,CAAC,CAAC;QAChB,IAAI,IAAI,CAAC,GAAG,KAAK,MAAM,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,KAAK,MAAM,CAAC,GAAG;YAAE,MAAM,OAAO,CAAC,kBAAkB,CAAC,CAAC;QAC1F,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,QAAQ,GAAG,CAAC,CAAC,CAAC;QACzC,IAAI,MAAM,GAAG,CAAC,CAAC;QACf,OAAO,MAAM,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC;YAC7B,MAAM,KAAK,GAAG,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,GAAG,MAAM,EAAE,IAAI,CAAC,CAAC;YAC1E,IAAI,CAAC,KAAK;gBAAE,MAAM;YAClB,MAAM,IAAI,KAAK,CAAC;QAClB,CAAC;QACD,IAAI,MAAM,GAAG,QAAQ;YAAE,MAAM,OAAO,CAAC,kBAAkB,CAAC,CAAC;QACzD,OAAO,KAAK,CAAC,QAAQ,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACpD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,CAAC,KAAK,CAAC,KAAK,QAAQ,IAAI,CAAC,QAAQ;YAAE,OAAO,SAAS,CAAC;QAC7D,IAAI,KAAK,YAAY,KAAK,IAAI,KAAK,CAAC,OAAO,KAAK,kBAAkB;YAAE,MAAM,KAAK,CAAC;QAChF,MAAM,OAAO,CAAC,qBAAqB,CAAC,CAAC;IACvC,CAAC;YAAS,CAAC;QAAC,IAAI,EAAE,KAAK,SAAS;YAAE,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;IAAC,CAAC;AACvD,CAAC;AACD,SAAS,OAAO,CAAC,IAAY,EAAE,EAAa,EAAE,QAAyB;IACrE,MAAM,QAAQ,GAAG,eAAe,CAAC,IAAI,EAAE,EAAE,EAAE,aAAa,EAAE,QAAQ,CAAC,CAAC;IACpE,IAAI,QAAQ,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC7C,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAY,CAAC;QAC9C,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,CAAC,GAAG,KAAK,QAAQ,IAAI,OAAO,KAAK,CAAC,UAAU,KAAK,QAAQ;YAC/E,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,gBAAgB;YACxD,gBAAgB,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,iBAAiB,KAAK,SAAS;YAClE,CAAC,YAAY,CAAC,WAAW,CAAC,EAAE,IAAI,EAAE,oBAAoB,EAAE,EAAE,KAAK,EAC7D,0BAA0B,CAAC,EAAE,KAAK,CAAC,GAAG,CAAC;YAAE,MAAM,OAAO,CAAC,kBAAkB,CAAC,CAAC;QACjF,OAAO,KAAK,CAAC;IACf,CAAC;IAAC,MAAM,CAAC;QAAC,MAAM,OAAO,CAAC,kBAAkB,CAAC,CAAC;IAAC,CAAC;AAChD,CAAC;AACD,2FAA2F;AAC3F,MAAM,UAAU,oBAAoB,CAAC,IAAkB,EAAE,UAAgC,EAAE;IACzF,MAAM,EAAE,GAAG,OAAO,CAAC,EAAE,IAAI,EAAE,CAAC;IAC5B,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,QAAQ,CAAC;IACtD,IAAI,OAAO,CAAC,eAAe,KAAK,SAAS,EAAE,CAAC;QAC1C,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;QACrE,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,EAAE,EAAE,EAAE,QAAQ,CAAC,CAAC;QACxC,IAAI,CAAC,GAAG;YAAE,MAAM,OAAO,CAAC,qBAAqB,CAAC,CAAC;QAC/C,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC;IAC3C,CAAC;IACD,MAAM,IAAI,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC;IACtC,KAAK,MAAM,SAAS,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC,EAAE,CAAC;QACzD,IAAI,CAAC;YACH,gBAAgB,CAAC,SAAS,EAAE,EAAE,EAAE,QAAQ,CAAC,CAAC;QAC5C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,CAAC,KAAK,CAAC,KAAK,QAAQ,EAAE,CAAC;gBAC9B,IAAI,KAAK,YAAY,KAAK,IAAI,KAAK,CAAC,OAAO,KAAK,kBAAkB;oBAAE,MAAM,KAAK,CAAC;gBAChF,MAAM,OAAO,CAAC,qBAAqB,CAAC,CAAC;YACvC,CAAC;QACH,CAAC;IACH,CAAC;IACD,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,YAAY,EAAE,IAAI,GAAG,eAAe,CAAC,CAAC;IAC9D,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,EAAE,EAAE,EAAE,QAAQ,CAAC,CAAC;IACxC,IAAI,GAAG;QAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC;IACjD,IAAI,MAAiC,CAAC;IACtC,KAAK,MAAM,SAAS,IAAI,WAAW,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE,CAAC;QACnD,MAAM,GAAG,GAAG,OAAO,CAAC,SAAS,EAAE,EAAE,EAAE,QAAQ,CAAC,CAAC;QAC7C,IAAI,CAAC,GAAG;YAAE,SAAS;QACnB,IAAI,MAAM,IAAI,MAAM,CAAC,GAAI,CAAC,GAAG,KAAK,GAAG,CAAC,GAAG;YAAE,MAAM,OAAO,CAAC,6BAA6B,CAAC,CAAC;QACxF,MAAM,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC;IACxD,CAAC;IACD,OAAO,MAAM,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;AAC/C,CAAC;AACD,MAAM,UAAU,gBAAgB,CAAC,IAAY,EAAE,EAAa,EAAE,WAA4B,OAAO,CAAC,QAAQ;IACxG,SAAS,CAAC,IAAI,EAAE,EAAE,EAAE,QAAQ,CAAC,CAAC;IAC9B,EAAE,CAAC,SAAS,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACrD,gBAAgB,CAAC,IAAI,EAAE,EAAE,EAAE,QAAQ,CAAC,CAAC;AACvC,CAAC;AACD,mFAAmF;AACnF,MAAM,UAAU,gBAAgB,CAAC,IAAY,EAAE,KAAa,EAAE,EAAa,EAAE,WAA4B,OAAO,CAAC,QAAQ;IACvH,SAAS,CAAC,IAAI,EAAE,EAAE,EAAE,QAAQ,CAAC,CAAC;IAC9B,MAAM,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC,SAAS,CAAC,QAAQ,GAAG,EAAE,CAAC,SAAS,CAAC,OAAO,GAAG,EAAE,CAAC,SAAS,CAAC,MAAM;QAC7F,CAAC,EAAE,CAAC,SAAS,CAAC,UAAU,IAAI,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;IACzC,IAAI,CAAC;QACH,SAAS,CAAC,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC;QAC5B,IAAI,MAAM,GAAG,CAAC,CAAC;QACf,OAAO,MAAM,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC;YAC7B,MAAM,KAAK,GAAG,EAAE,CAAC,SAAS,CAAC,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,GAAG,MAAM,CAAC,CAAC;YACrE,IAAI,CAAC,KAAK;gBAAE,MAAM,OAAO,CAAC,2BAA2B,CAAC,CAAC;YACvD,MAAM,IAAI,KAAK,CAAC;QAClB,CAAC;QACD,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;IACnB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;QACjB,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;QACpB,MAAM,KAAK,CAAC;IACd,CAAC;IACD,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;AACnB,CAAC;AACD,2FAA2F;AAC3F,MAAM,UAAU,uBAAuB,CAAC,IAAkB,EAAE,UAAgC,EAAE;IAC5F,MAAM,EAAE,GAAG,OAAO,CAAC,EAAE,IAAI,EAAE,CAAC;IAC5B,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,QAAQ,CAAC;IACtD,MAAM,QAAQ,GAAG,oBAAoB,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IACrD,IAAI,QAAQ,CAAC,GAAG;QAAE,OAAO,QAAQ,CAAC,GAAG,CAAC;IACtC,MAAM,IAAI,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC;IACtC,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,GAAG,GAAG,IAAI,GAAG,GAAG,GAAG,UAAU,EAAE,GAAG,MAAM,CAAC,CAAC;IACzF,IAAI,gBAAgB,GAAG,KAAK,CAAC;IAC7B,IAAI,CAAC;QACH,gBAAgB,CAAC,IAAI,EAAE,EAAE,EAAE,QAAQ,CAAC,CAAC;QACrC,gBAAgB,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,QAAQ,CAAC,CAAC;QACvD,gBAAgB,CAAC,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,eAAe,EAAE,CAAC,GAAG,IAAI,CAAC,EAAE,EAAE,EAAE,QAAQ,CAAC,CAAC;QACjG,gBAAgB,GAAG,IAAI,CAAC;QACxB,SAAS,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,EAAE,QAAQ,CAAC,CAAC;QACvC,IAAI,CAAC;YAAC,EAAE,CAAC,QAAQ,CAAC,SAAS,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC;QAAC,CAAC;QAC9C,OAAO,KAAK,EAAE,CAAC;YACb,IAAI,KAAK,CAAC,KAAK,CAAC,KAAK,QAAQ,EAAE,CAAC,CAAC,2CAA2C,CAAC,CAAC;iBACzE,IAAI,CAAC,SAAS,EAAE,YAAY,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;gBACzF,MAAM,OAAO,CAAC,+BAA+B,CAAC,CAAC;;gBAC5C,MAAM,KAAK,CAAC;QACnB,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,KAAK,IAAI,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,WAAW,CAAC;YAAE,MAAM,KAAK,CAAC;QACjF,MAAM,OAAO,CAAC,2BAA2B,CAAC,CAAC;IAC7C,CAAC;YAAS,CAAC;QACT,IAAI,gBAAgB;YAAE,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;IACjD,CAAC;IACD,MAAM,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,EAAE,QAAQ,CAAC,CAAC;IACpD,IAAI,CAAC,MAAM;QAAE,MAAM,OAAO,CAAC,qBAAqB,CAAC,CAAC;IAClD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,gEAAgE;AAChE,OAAO,EACL,SAAS,IAAI,gBAAgB,EAC7B,SAAS,IAAI,gBAAgB,EAC7B,gBAAgB,IAAI,uBAAuB,EAC3C,gBAAgB,IAAI,sBAAsB,GAC3C,CAAC"}

package/dist/packages/runtime/dist/mcp-rpc.d.ts

@@ -0,0 +1,19 @@
+import type { Readable, Writable } from 'node:stream';
+import type { Json } from '../../core/dist/index.js';
+/** Duplex routing keeps replies and cancellation moving while tools await the host. */
+export declare class McpRpc {
+    private readonly output;
+    private readonly handle;
+    private framed?;
+    private serial;
+    private closed;
+    private readonly pending;
+    private readonly calls;
+    private writes;
+    constructor(output: Writable, handle: (message: unknown, signal?: AbortSignal) => Promise<Json | undefined>);
+    request(method: string, params: Json, signal: AbortSignal): Promise<unknown>;
+    private write;
+    private route;
+    close(): void;
+    serve(input: Readable): Promise<void>;
+}