sealbridge 0.2.2 → 0.3.0

package/dist/cli/dist/public-settings.js

@@ -4,30 +4,28 @@ export function publicSettingsFlags(s) {
         typeof s.public !== 'boolean' || typeof s.alwaysAsk !== 'boolean' || !Array.isArray(s.taskTypes) || !s.taskTypes.length ||
         s.taskTypes.some(t => typeof t !== 'string' || !/^[a-zA-Z0-9_.-]+$/.test(t)))
         throw new Error('INVALID_PUBLIC_SETTINGS');
-    const mapping = { maxInputTokens: 'open-max-input-tokens', maxOutputTokens: 'open-max-output-tokens',
-        maxToolCalls: 'open-max-tool-calls', maxWallSeconds: 'open-max-wall-seconds',
-        maxJobsPerPersonPerMinute: 'open-rate-limit-per-did', maxJobsPerDay: 'max-tasks-per-day' };
+    if (!s.alwaysAsk)
+        throw new Error('CONNECTION_OPENING_REQUIRED: Set alwaysAsk:true; connections require inspection and owner opening.');
+    const mapping = { maxInputTokens: 'max-input-tokens', maxOutputTokens: 'max-output-tokens',
+        maxToolCalls: 'max-tool-invocations', maxWallSeconds: 'max-wall-clock-seconds',
+        maxJobsPerPersonPerMinute: 'max-requests-per-minute', maxJobsPerDay: 'max-tasks-per-day' };
     for (const field of Object.keys(mapping))
         if (!Number.isSafeInteger(s[field]) || s[field] < 1)
             throw new Error('INVALID_PUBLIC_SETTINGS');
     const flags = ['--max-tasks-per-day', String(s.maxJobsPerDay)];
-    if (!s.public)
-        return flags;
-    flags.push('--open', '--publish', '--open-allow-task-type', [...new Set(s.taskTypes)].join(','));
+    if (s.public)
+        flags.push('--publish');
+    flags.push('--allow-task-type', [...new Set(s.taskTypes)].join(','));
     for (const field of Object.keys(mapping))
         if (field !== 'maxJobsPerDay')
             flags.push('--' + mapping[field], String(s[field]));
-    // Explicit false is the existing G3 opt-in; absence never implies auto-accept.
-    if (!s.alwaysAsk)
-        flags.push('--auto-accept', '--allow-any-requester');
     return flags;
 }
-export function publicProfileSummary(card, rate, daily, automatic = false) {
-    return { name: card.payload.name, access: card.payload.accessMode === 'open' ? 'Strangers may request jobs' : 'Invite only',
-        jobs: card.payload.skills.flatMap(s => s.taskTypes ?? []), perJob: card.payload.openPolicy ?? {},
+export function publicProfileSummary(card, rate, daily, automatic = false, budgets = {}) {
+    return { name: card.payload.name, access: 'Connection-based intake; unconnected requests held',
+        jobs: card.payload.skills.flatMap(s => s.taskTypes ?? []),
         hostLimits: { perPersonPerMinute: rate ?? null, perDay: daily ?? null, dayReset: '00:00 UTC' },
-        approval: automatic ? 'Automatic acceptance explicitly enabled' : 'Owner approval required',
-        notice: 'Host rate and daily limits are not advertised in the signed openPolicy. Available capacity is checked at admission.',
-        signedCard: card };
+        approval: 'Inspection and owner opening required for limited peers', inspection: 'unavailable',
+        perJob: budgets, automaticPolicy: automatic, signedCard: card };
 }
 //# sourceMappingURL=public-settings.js.map

package/dist/cli/dist/public-settings.js.map

@@ -1 +1 @@
-{"version":3,"file":"public-settings.js","sourceRoot":"","sources":["../src/public-settings.ts"],"names":[],"mappings":"AAaA,MAAM,UAAU,mBAAmB,CAAC,CAAiB;IACnD,IAAI,CAAC,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,EAAC,WAAW,EAAC,gBAAgB,EAAC,iBAAiB;QAClG,cAAc,EAAC,gBAAgB,EAAC,2BAA2B,EAAC,eAAe,EAAC,WAAW,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC;QACzG,OAAO,CAAC,CAAC,MAAM,KAAK,SAAS,IAAI,OAAO,CAAC,CAAC,SAAS,KAAK,SAAS,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,MAAM;QACvH,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC;IAC7H,MAAM,OAAO,GAAG,EAAE,cAAc,EAAE,uBAAuB,EAAE,eAAe,EAAE,wBAAwB;QAClG,YAAY,EAAE,qBAAqB,EAAE,cAAc,EAAE,uBAAuB;QAC5E,yBAAyB,EAAE,yBAAyB,EAAE,aAAa,EAAE,mBAAmB,EAAW,CAAC;IACtG,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAA6B;QAClE,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC;IAClG,MAAM,KAAK,GAAG,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC;IAC/D,IAAI,CAAC,CAAC,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC5B,KAAK,CAAC,IAAI,CAAC,QAAQ,EAAE,WAAW,EAAE,wBAAwB,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IACjG,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAA6B;QAClE,IAAI,KAAK,KAAK,eAAe;YAAE,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACrF,+EAA+E;IAC/E,IAAI,CAAC,CAAC,CAAC,SAAS;QAAE,KAAK,CAAC,IAAI,CAAC,eAAe,EAAE,uBAAuB,CAAC,CAAC;IACvE,OAAO,KAAK,CAAC;AACf,CAAC;AACD,MAAM,UAAU,oBAAoB,CAAC,IAAqB,EAAE,IAAa,EAAE,KAAc,EAAE,SAAS,GAAG,KAAK;IAC1G,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,UAAU,KAAK,MAAM,CAAC,CAAC,CAAC,4BAA4B,CAAC,CAAC,CAAC,aAAa;QACzH,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,UAAU,IAAI,EAAE;QAChG,UAAU,EAAE,EAAE,kBAAkB,EAAE,IAAI,IAAI,IAAI,EAAE,MAAM,EAAE,KAAK,IAAI,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE;QAC9F,QAAQ,EAAE,SAAS,CAAC,CAAC,CAAC,yCAAyC,CAAC,CAAC,CAAC,yBAAyB;QAC3F,MAAM,EAAE,qHAAqH;QAC7H,UAAU,EAAE,IAAI,EAAE,CAAC;AACvB,CAAC"}
+{"version":3,"file":"public-settings.js","sourceRoot":"","sources":["../src/public-settings.ts"],"names":[],"mappings":"AAaA,MAAM,UAAU,mBAAmB,CAAC,CAAiB;IACnD,IAAI,CAAC,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,EAAC,WAAW,EAAC,gBAAgB,EAAC,iBAAiB;QAClG,cAAc,EAAC,gBAAgB,EAAC,2BAA2B,EAAC,eAAe,EAAC,WAAW,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC;QACzG,OAAO,CAAC,CAAC,MAAM,KAAK,SAAS,IAAI,OAAO,CAAC,CAAC,SAAS,KAAK,SAAS,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,MAAM;QACvH,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC;IAC7H,IAAI,CAAC,CAAC,CAAC,SAAS;QAAE,MAAM,IAAI,KAAK,CAAC,oGAAoG,CAAC,CAAC;IACxI,MAAM,OAAO,GAAG,EAAE,cAAc,EAAE,kBAAkB,EAAE,eAAe,EAAE,mBAAmB;QACxF,YAAY,EAAE,sBAAsB,EAAE,cAAc,EAAE,wBAAwB;QAC9E,yBAAyB,EAAE,yBAAyB,EAAE,aAAa,EAAE,mBAAmB,EAAW,CAAC;IACtG,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAA6B;QAClE,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC;IAClG,MAAM,KAAK,GAAG,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC;IAC/D,IAAI,CAAC,CAAC,MAAM;QAAE,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IACtC,KAAK,CAAC,IAAI,CAAC,mBAAmB,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IACrE,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAA6B;QAClE,IAAI,KAAK,KAAK,eAAe;YAAE,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACrF,OAAO,KAAK,CAAC;AACf,CAAC;AACD,MAAM,UAAU,oBAAoB,CAAC,IAAqB,EAAE,IAAa,EAAE,KAAc,EAAE,SAAS,GAAG,KAAK,EAAE,UAA8C,EAAE;IAC5J,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,oDAAoD;QAC5F,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,IAAI,EAAE,CAAC;QACzD,UAAU,EAAE,EAAE,kBAAkB,EAAE,IAAI,IAAI,IAAI,EAAE,MAAM,EAAE,KAAK,IAAI,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE;QAC9F,QAAQ,EAAE,yDAAyD,EAAE,UAAU,EAAE,aAAa;QAC9F,MAAM,EAAE,OAAO,EAAE,eAAe,EAAE,SAAS,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC;AACpE,CAAC"}

package/dist/cli/dist/receipt.d.ts

@@ -1,4 +1,4 @@
-import type { AuditVerificationOptions } from '@acp/ledger';
+import type { AuditVerificationOptions } from '../../packages/ledger/dist/index.js';
 export declare function createReceipt(raw: string, anchor?: AuditVerificationOptions): {
     version: number;
     status: string;

package/dist/cli/dist/relay-auth.d.ts

@@ -0,0 +1,3 @@
+import type { RelayAuthRecoveryOptions } from '../../packages/relay/dist/index.js';
+export declare const RELAY_AUTH_HELP = "Relay authentication recovery:\n  --relay-auth-retries <n>                 Additional attempts after HTTP 401 (default: 3; 0: fail immediately).\n  --relay-auth-recovery-timeout-ms <ms>    Overall recovery window in milliseconds (default: 120000).\nHTTP 403 and other permanent rejections remain terminal.";
+export declare function relayAuthOptions(flags: Map<string, string | true>): RelayAuthRecoveryOptions;

package/dist/cli/dist/relay-auth.js

@@ -0,0 +1,23 @@
+// SPDX-License-Identifier: Apache-2.0
+import { validateRelayAuthRecoveryOptions } from '../../packages/relay/dist/index.js';
+export const RELAY_AUTH_HELP = `Relay authentication recovery:
+  --relay-auth-retries <n>                 Additional attempts after HTTP 401 (default: 3; 0: fail immediately).
+  --relay-auth-recovery-timeout-ms <ms>    Overall recovery window in milliseconds (default: 120000).
+HTTP 403 and other permanent rejections remain terminal.`;
+export function relayAuthOptions(flags) {
+    const count = (flag) => {
+        if (!flags.has(flag))
+            return undefined;
+        const raw = flags.get(flag);
+        if (typeof raw !== 'string' || !/^\d+$/.test(raw))
+            throw new Error('INVALID_' + flag.slice(2).toUpperCase().replaceAll('-', '_'));
+        return Number(raw);
+    };
+    const options = {
+        maxAuthRecoveryAttempts: count('--relay-auth-retries'),
+        authRecoveryTimeoutMs: count('--relay-auth-recovery-timeout-ms'),
+    };
+    validateRelayAuthRecoveryOptions(options);
+    return options;
+}
+//# sourceMappingURL=relay-auth.js.map

package/dist/cli/dist/relay-auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"relay-auth.js","sourceRoot":"","sources":["../src/relay-auth.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,OAAO,EAAE,gCAAgC,EAAE,MAAM,YAAY,CAAC;AAG9D,MAAM,CAAC,MAAM,eAAe,GAAG;;;yDAG0B,CAAC;AAE1D,MAAM,UAAU,gBAAgB,CAAC,KAAiC;IAChE,MAAM,KAAK,GAAG,CAAC,IAAY,EAAsB,EAAE;QACjD,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,OAAO,SAAS,CAAC;QACvC,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC5B,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC;YAC/C,MAAM,IAAI,KAAK,CAAC,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;QACjF,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC;IACrB,CAAC,CAAC;IACF,MAAM,OAAO,GAAG;QACd,uBAAuB,EAAE,KAAK,CAAC,sBAAsB,CAAC;QACtD,qBAAqB,EAAE,KAAK,CAAC,kCAAkC,CAAC;KACjE,CAAC;IACF,gCAAgC,CAAC,OAAO,CAAC,CAAC;IAC1C,OAAO,OAAO,CAAC;AACjB,CAAC"}

package/dist/cli/dist/requests.d.ts

@@ -0,0 +1,10 @@
+import type { IdentityStoreOptions } from '../../packages/runtime/dist/key-store.js';
+import type { HeldContentReviewProvider } from '../../packages/runtime/dist/index.js';
+import type { ConnectionsCommandOptions } from './connections.js';
+export declare function requestsCommand(args: string[], options?: {
+    identityOptions?: IdentityStoreOptions;
+    review?: (summary: string) => Promise<boolean>;
+    output?: (value: string) => void;
+    inspectionProvider?: HeldContentReviewProvider;
+    transportFactory?: ConnectionsCommandOptions['transportFactory'];
+}): Promise<void>;

package/dist/cli/dist/requests.js

@@ -0,0 +1,91 @@
+// SPDX-License-Identifier: Apache-2.0
+import { attachHeldDeliveryStatus } from '../../packages/runtime/dist/index.js';
+import { openEnvelope } from '../../packages/core/dist/index.js';
+import { inspectStoredIdentity } from '../../packages/runtime/dist/key-store.js';
+import { WorkerTrustStore, workerIntakePath, HeldRequestReview } from '../../packages/runtime/dist/index.js';
+import { confirmOwner, connectionsCommand } from './connections.js';
+export async function requestsCommand(args, options = {}) {
+    const usage = 'Usage: sealbridge requests list | show ID | approve ID [--trust trusted (legacy finite grant)] | discard ID | deny ID [--key FILE] [--role worker|requester]. Default approve offers limited connection consent; inspection and human confirmation required. / 既定の承認は limited の接続同意です。検査と所有者の確認が必要です。';
+    const output = options.output ?? console.log;
+    if (args.length === 1 && args[0] === '--help') {
+        output(usage);
+        return;
+    }
+    const [action, ...rest] = args, flags = new Map(), ids = [];
+    for (let i = 0; i < rest.length; i++) {
+        const flag = rest[i];
+        if (!flag.startsWith('--')) {
+            ids.push(flag);
+            continue;
+        }
+        if (!['--key', '--trust', '--role'].includes(flag) || flags.has(flag) || !rest[i + 1] || rest[i + 1].startsWith('--'))
+            throw new Error('INVALID_REQUEST_OPTION');
+        flags.set(flag, rest[++i]);
+    }
+    const trust = flags.get('--trust') ?? 'limited', role = flags.get('--role') ?? 'worker';
+    if (!['list', 'show', 'approve', 'discard', 'deny'].includes(action) || ids.length !== (action === 'list' ? 0 : 1) ||
+        !['limited', 'trusted'].includes(trust) || (flags.has('--trust') && action !== 'approve') || !['worker', 'requester'].includes(role))
+        throw new Error(usage);
+    const identityOptions = { ...options.identityOptions, explicitKeyPath: flags.get('--key') };
+    const key = (await inspectStoredIdentity(role, identityOptions)).key;
+    if (!key) {
+        if (action === 'list') {
+            output(JSON.stringify({ requests: [] }));
+            return;
+        }
+        throw new Error('REQUEST_REVIEW_UNAVAILABLE');
+    }
+    const store = new WorkerTrustStore(key, { path: workerIntakePath(key.did, identityOptions), fs: identityOptions.fs, platform: identityOptions.platform });
+    const review = new HeldRequestReview(key, { ...identityOptions, provider: options.inspectionProvider });
+    attachHeldDeliveryStatus(key, review, identityOptions, store);
+    if (action === 'list') {
+        // Legacy text previews are historical metadata, never reviewed content.
+        output(JSON.stringify({ requests: store.list().map(({ title: _title, description: _description, ...r }) => ({ ...r,
+                inspectionStatus: review.list().find(h => h.taskId === r.taskId)?.inspectionStatus ?? 'unavailable' })) }));
+        return;
+    }
+    const request = store.list().find(r => r.id === ids[0]);
+    if (!request)
+        throw new Error('REQUEST_NOT_FOUND');
+    const held = review.list().find(h => h.taskId === request.taskId);
+    if (action === 'show' || action === 'approve' && trust === 'limited') {
+        if (!held)
+            throw new Error('INSPECTION_INCOMPLETE');
+        const inspected = await review.inspect(held.id);
+        if (inspected.inspectionStatus !== 'complete')
+            throw new Error('INSPECTION_INCOMPLETE: ' + inspected.inspectionStatus);
+        if (action === 'show') {
+            output(JSON.stringify(review.showReviewedContent(held.id)));
+            return;
+        }
+    }
+    if (action === 'approve' && trust === 'limited') {
+        // A task without separate signed sender consent initiates an offer; it cannot infer reciprocal consent.
+        const connection = store.listConnections().find(c => c.peerOwnerDid === request.requesterOwnerDid);
+        if (!connection || !('relayUrl' in connection) || !connection.relayUrl)
+            throw new Error('CONNECTION_NOT_FOUND');
+        const body = openEnvelope(review.store.read(held.id).envelope, key);
+        const attached = body.connectionRequest;
+        await connectionsCommand([...(attached ? ['approve', attached.payload.taskId.slice(5)] : ['request', '--to', request.requesterOwnerDid]), '--relay', connection.relayUrl, '--role', role,
+            ...(flags.has('--key') ? ['--key', flags.get('--key')] : [])], options);
+        store.finishRequestReview(request.id);
+        if (held)
+            review.discard(held.id);
+        return;
+    }
+    const summary = JSON.stringify({ id: request.id, localOwnerDid: key.did, peerOwnerDid: request.requesterOwnerDid, action,
+        effect: action === 'deny' ? 'Block future admission; accepted tasks continue.' : action === 'discard' ? 'Discard held content only.' :
+            'Legacy explicit trusted grant for 24 hours; automatic policy may execute tasks. This is separate from connections.' });
+    if (!await confirmOwner(summary, options.review))
+        throw new Error('APPROVAL_REJECTED');
+    if (action === 'discard')
+        store.finishRequestReview(request.id, true);
+    else
+        store.decide(request.id, action, 'trusted');
+    if (held)
+        review.discard(held.id);
+    if (action === 'deny')
+        review.discardPeer(request.requesterOwnerDid);
+    output(JSON.stringify({ id: request.id, decision: action, ...(action === 'approve' ? { trust: 'trusted', legacy: true } : {}) }));
+}
+//# sourceMappingURL=requests.js.map

package/dist/cli/dist/requests.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"requests.js","sourceRoot":"","sources":["../src/requests.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,OAAO,EAAE,wBAAwB,EAAE,MAAM,cAAc,CAAC;AACxD,OAAO,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AAEzC,OAAO,EAAE,qBAAqB,EAAE,MAAM,wBAAwB,CAAC;AAE/D,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AAErF,OAAO,EAAE,YAAY,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAGpE,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,IAAc,EAAE,UAIlD,EAAE;IACJ,MAAM,KAAK,GAAG,uSAAuS,CAAC;IACtT,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,GAAG,CAAC;IAC7C,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,QAAQ,EAAE,CAAC;QAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAAC,OAAO;IAAC,CAAC;IACzE,MAAM,CAAC,MAAM,EAAE,GAAG,IAAI,CAAC,GAAG,IAAI,EAAE,KAAK,GAAG,IAAI,GAAG,EAAkB,EAAE,GAAG,GAAa,EAAE,CAAC;IACtF,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QACrB,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAAC,SAAS;QAAC,CAAC;QACzD,IAAI,CAAC,CAAC,OAAO,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;QACjK,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAC7B,CAAC;IACD,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,SAAS,EAAE,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,QAAQ,CAAC;IACxF,IAAI,CAAC,CAAC,MAAM,EAAC,MAAM,EAAC,SAAS,EAAC,SAAS,EAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC1G,CAAC,CAAC,SAAS,EAAC,SAAS,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,MAAM,KAAK,SAAS,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAC,WAAW,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC;IAC/J,MAAM,eAAe,GAAG,EAAE,GAAG,OAAO,CAAC,eAAe,EAAE,eAAe,EAAE,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;IAC5F,MAAM,GAAG,GAAG,CAAC,MAAM,qBAAqB,CAAC,IAA8B,EAAE,eAAe,CAAC,CAAC,CAAC,GAAG,CAAC;IAC/F,IAAI,CAAC,GAAG,EAAE,CAAC;QAAC,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;YAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;YAAC,OAAO;QAAC,CAAC;QAAC,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;IAAC,CAAC;IACzI,MAAM,KAAK,GAAG,IAAI,gBAAgB,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,gBAAgB,CAAC,GAAG,CAAC,GAAG,EAAE,eAAe,CAAC,EAAE,EAAE,EAAE,eAAe,CAAC,EAAE,EAAE,QAAQ,EAAE,eAAe,CAAC,QAAQ,EAAE,CAAC,CAAC;IAC1J,MAAM,MAAM,GAAG,IAAI,iBAAiB,CAAC,GAAG,EAAE,EAAE,GAAG,eAAe,EAAE,QAAQ,EAAE,OAAO,CAAC,kBAAkB,EAAE,CAAC,CAAC;IACxG,wBAAwB,CAAC,GAAG,EAAE,MAAM,EAAE,eAAe,EAAE,KAAK,CAAC,CAAC;IAC9D,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;QACtB,wEAAwE;QACxE,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,YAAY,EAAE,GAAG,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC;gBAChH,gBAAgB,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,CAAC,EAAE,gBAAgB,IAAI,aAAa,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QAAC,OAAO;IACxH,CAAC;IACD,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IACxD,IAAI,CAAC,OAAO;QAAE,MAAM,IAAI,KAAK,CAAC,mBAAmB,CAAC,CAAC;IACnD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IAClE,IAAI,MAAM,KAAK,MAAM,IAAI,MAAM,KAAK,SAAS,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACrE,IAAI,CAAC,IAAI;YAAE,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;QACpD,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAChD,IAAI,SAAS,CAAC,gBAAgB,KAAK,UAAU;YAAE,MAAM,IAAI,KAAK,CAAC,yBAAyB,GAAG,SAAS,CAAC,gBAAgB,CAAC,CAAC;QACvH,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;YAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,mBAAmB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;YAAC,OAAO;QAAC,CAAC;IACjG,CAAC;IACD,IAAI,MAAM,KAAK,SAAS,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QAChD,wGAAwG;QACxG,MAAM,UAAU,GAAG,KAAK,CAAC,eAAe,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,YAAY,KAAK,OAAO,CAAC,iBAAiB,CAAC,CAAC;QACnG,IAAI,CAAC,UAAU,IAAI,CAAC,CAAC,UAAU,IAAI,UAAU,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ;YAAE,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;QAChH,MAAM,IAAI,GAAG,YAAY,CAAyC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,IAAK,CAAC,EAAE,CAAE,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;QAC9G,MAAM,QAAQ,GAAG,IAAI,CAAC,iBAAiB,CAAC;QACxC,MAAM,kBAAkB,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,EAAE,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,CAAC,iBAAiB,CAAC,CAAC,EAAE,SAAS,EAAE,UAAU,CAAC,QAAQ,EAAE,QAAQ,EAAE,IAAI;YACtL,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,KAAK,CAAC,GAAG,CAAC,OAAO,CAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;QAC3E,KAAK,CAAC,mBAAmB,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QAAC,IAAI,IAAI;YAAE,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAAC,OAAO;IACnF,CAAC;IACD,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,OAAO,CAAC,EAAE,EAAE,aAAa,EAAE,GAAG,CAAC,GAAG,EAAE,YAAY,EAAE,OAAO,CAAC,iBAAiB,EAAE,MAAM;QACtH,MAAM,EAAE,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,kDAAkD,CAAC,CAAC,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,4BAA4B,CAAC,CAAC;YACpI,oHAAoH,EAAE,CAAC,CAAC;IAC5H,IAAI,CAAC,MAAM,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,MAAM,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,mBAAmB,CAAC,CAAC;IACvF,IAAI,MAAM,KAAK,SAAS;QAAE,KAAK,CAAC,mBAAmB,CAAC,OAAO,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;;QACjE,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,EAAE,MAA4B,EAAE,SAAS,CAAC,CAAC;IACvE,IAAI,IAAI;QAAE,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAClC,IAAI,MAAM,KAAK,MAAM;QAAE,MAAM,CAAC,WAAW,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC;IACrE,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,OAAO,CAAC,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;AACpI,CAAC"}

package/dist/cli/dist/sdk.d.ts

@@ -0,0 +1,10 @@
+/** Supported embedding surface for sealbridge/sdk. Keep exports explicit. */
+export { InviteStore, KeychainSecretStore, openKeychainSecretStore, FileKeyStore, KeychainKeyStore, inspectStoredIdentity, resolveStoredIdentity, selectKeyStore, keyStoreSelection, keychainService, resolveDataRoot, readApplicationConfig, setApplicationKeyStore, WorkerTrustStore, workerIntakePath, ConnectionService, ConnectionRouter, syncConnections, StoredConnectionExchange, ConnectionAdmissionReview, HeldRequestReview, unavailableHeldContentReviewProvider, AcpMcpServer, } from '../../packages/runtime/dist/index.js';
+export type { SavedInvite, InviteStoreOptions, SecretStore, DataRootOptions, LocalIdentityOptions, IdentityRole, IdentityStoreOptions, StoredIdentity, KeyStore, KeyStoreDescription, KeyStoreSelection, KeyringEntry, KeyringModule, ApplicationConfig, ApplicationConfigOptions, RelaySelectionOptions, ConnectionState, ConnectionStatus, ConnectionTrust, ConnectionPeer, ConnectionRecord, ConnectionSummary, PriorApprovedPeer, ConnectionServiceOptions, ConnectionServiceResult, ConnectionHumanReviewProvider, ConnectionInspectionPort, ConnectionPersistencePort, ConnectionOffer, ConnectionConsent, ConnectionOutboxEntry, ConnectionAcceptanceCommit, ConnectionRedemptionCommit, ConnectionTransport, ConnectionFrame, ConnectionRouterOptions, ConnectedEvent, ConnectionAdmissionReviewOptions, InboundConnectionSummary, HeldRequestReviewOptions, HeldContentReviewProvider, HeldInspectionContext, InspectionCompletion, AcpMcpServerOptions, ApprovalProvider, } from '../../packages/runtime/dist/index.js';
+export { generateKeyPair, createSignedAgentCard, verifySignedAgentCard, createInviteToken, inviteTokenFromUri, isInviteTarget, parseAndVerifyInviteToken, discoverAgentCards, findDiscoveredAgentCard, } from '../../packages/core/dist/index.js';
+export type { KeyPair, Json, Signed, SignedEnvelope, Invite, AgentSkill, DiscoveryAgentCard, CreateAgentCardOptions, SignedAgentCard, RelayEndpointPolicy, ConnectionRequest, ConnectionAccepted, ConnectionAck, ConnectionControl, } from '../../packages/core/dist/index.js';
+export type { RelayTransport } from '../../packages/relay/dist/index.js';
+export { connectionsCommand, connectionHumanReview } from './connections.js';
+export type { ConnectionsCommandOptions } from './connections.js';
+export { mcpServerCommand, parseMcpServerArgs, mcpServerOptionsFromArgs } from './mcp.js';
+export type { ParsedMcpServerArgs } from './mcp.js';

package/dist/cli/dist/sdk.js

@@ -0,0 +1,7 @@
+// SPDX-License-Identifier: Apache-2.0
+/** Supported embedding surface for sealbridge/sdk. Keep exports explicit. */
+export { InviteStore, KeychainSecretStore, openKeychainSecretStore, FileKeyStore, KeychainKeyStore, inspectStoredIdentity, resolveStoredIdentity, selectKeyStore, keyStoreSelection, keychainService, resolveDataRoot, readApplicationConfig, setApplicationKeyStore, WorkerTrustStore, workerIntakePath, ConnectionService, ConnectionRouter, syncConnections, StoredConnectionExchange, ConnectionAdmissionReview, HeldRequestReview, unavailableHeldContentReviewProvider, AcpMcpServer, } from '../../packages/runtime/dist/index.js';
+export { generateKeyPair, createSignedAgentCard, verifySignedAgentCard, createInviteToken, inviteTokenFromUri, isInviteTarget, parseAndVerifyInviteToken, discoverAgentCards, findDiscoveredAgentCard, } from '../../packages/core/dist/index.js';
+export { connectionsCommand, connectionHumanReview } from './connections.js';
+export { mcpServerCommand, parseMcpServerArgs, mcpServerOptionsFromArgs } from './mcp.js';
+//# sourceMappingURL=sdk.js.map

package/dist/cli/dist/sdk.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sdk.js","sourceRoot":"","sources":["../src/sdk.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,6EAA6E;AAC7E,OAAO,EACL,WAAW,EAAE,mBAAmB,EAAE,uBAAuB,EACzD,YAAY,EAAE,gBAAgB,EAAE,qBAAqB,EAAE,qBAAqB,EAC5E,cAAc,EAAE,iBAAiB,EAAE,eAAe,EAAE,eAAe,EACnE,qBAAqB,EAAE,sBAAsB,EAC7C,gBAAgB,EAAE,gBAAgB,EAClC,iBAAiB,EAAE,gBAAgB,EAAE,eAAe,EAAE,wBAAwB,EAAE,yBAAyB,EACzG,iBAAiB,EAAE,oCAAoC,EACvD,YAAY,GACb,MAAM,cAAc,CAAC;AAetB,OAAO,EACL,eAAe,EAAE,qBAAqB,EAAE,qBAAqB,EAC7D,iBAAiB,EAAE,kBAAkB,EAAE,cAAc,EAAE,yBAAyB,EAChF,kBAAkB,EAAE,uBAAuB,GAC5C,MAAM,WAAW,CAAC;AAOnB,OAAO,EAAE,kBAAkB,EAAE,qBAAqB,EAAE,MAAM,kBAAkB,CAAC;AAE7E,OAAO,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,wBAAwB,EAAE,MAAM,UAAU,CAAC"}

package/dist/cli/dist/setup-files.d.ts

@@ -0,0 +1,24 @@
+import * as fs from 'node:fs';
+import type { Node as JsonNode } from 'jsonc-parser';
+export interface Snapshot {
+    path: string;
+    bytes?: Buffer;
+    stat?: fs.Stats;
+}
+export interface FileChange extends Snapshot {
+    next: Buffer;
+    backup?: string;
+}
+/** Host directories are checked for links, without changing their permissions. */
+export declare function snapshot(path: string, io?: typeof fs, platform?: NodeJS.Platform): Snapshot;
+export declare function strictObject(bytes: Buffer): {
+    text: string;
+    tree: JsonNode;
+};
+export declare function hostChange(original: Snapshot, entry: unknown, options?: {
+    updateExisting?: boolean;
+    alternateEntry?: unknown;
+}): FileChange;
+export declare function assertUnchanged(original: Snapshot, io?: typeof fs, platform?: NodeJS.Platform): void;
+/** A backup remains available after a later write failure; never restore over owner edits. */
+export declare function publish(change: FileChange, root: string, io?: typeof fs, platform?: NodeJS.Platform): void;

package/dist/cli/dist/setup-files.js

@@ -0,0 +1,190 @@
+// SPDX-License-Identifier: Apache-2.0
+import * as fs from 'node:fs';
+import { randomUUID } from 'node:crypto';
+import { dirname, join } from 'node:path';
+import { isDeepStrictEqual } from 'node:util';
+import { parseTree } from 'jsonc-parser';
+import { checkPrivatePath, ensurePrivateDirectory } from '../../packages/runtime/dist/local-identity.js';
+function fail(code) { throw new Error(code); }
+const errno = (error) => error.code;
+/** Host directories are checked for links, without changing their permissions. */
+export function snapshot(path, io = fs, platform = process.platform) {
+    let fd;
+    try {
+        checkPrivatePath(path, io, platform);
+        let before;
+        try {
+            before = io.lstatSync(path);
+        }
+        catch (error) {
+            if (errno(error) === 'ENOENT')
+                return { path };
+            throw error;
+        }
+        if (!before.isFile() || before.size > 1024 * 1024)
+            fail('SETUP_CONFIG_INVALID');
+        fd = io.openSync(path, fs.constants.O_RDONLY | (fs.constants.O_NOFOLLOW ?? 0) |
+            (fs.constants.O_NONBLOCK ?? 0));
+        const stat = io.fstatSync(fd);
+        if (!stat.isFile() || stat.dev !== before.dev || stat.ino !== before.ino)
+            fail('SETUP_CONFIG_CHANGED');
+        const buffer = Buffer.alloc(1024 * 1024 + 1);
+        let length = 0, count;
+        while (length < buffer.length && (count = io.readSync(fd, buffer, length, buffer.length - length, null)))
+            length += count;
+        if (length > 1024 * 1024)
+            fail('SETUP_CONFIG_INVALID');
+        return { path, bytes: buffer.subarray(0, length), stat };
+    }
+    catch (error) {
+        if (error instanceof Error && error.message.startsWith('SETUP_'))
+            throw error;
+        if (error instanceof Error && error.message === 'IDENTITY_INVALID')
+            fail('SETUP_CONFIG_INVALID');
+        return fail('SETUP_WRITE_FAILED');
+    }
+    finally {
+        if (fd !== undefined)
+            io.closeSync(fd);
+    }
+}
+export function strictObject(bytes) {
+    const raw = bytes.toString('utf8');
+    if (!Buffer.from(raw).equals(bytes))
+        fail('SETUP_CONFIG_INVALID');
+    const text = raw.replace(/^\uFEFF/, '');
+    const errors = [];
+    const tree = parseTree(text, errors, { disallowComments: true, allowTrailingComma: false });
+    if (!tree || tree.type !== 'object' || errors.length)
+        fail('SETUP_CONFIG_INVALID');
+    function duplicates(node) {
+        if (node.type === 'object') {
+            const names = new Set();
+            for (const property of node.children ?? []) {
+                const name = property.children[0].value;
+                if (names.has(name))
+                    fail('SETUP_CONFIG_INVALID');
+                names.add(name);
+            }
+        }
+        for (const child of node.children ?? [])
+            duplicates(child);
+    }
+    duplicates(tree);
+    return { text, tree };
+}
+export function hostChange(original, entry, options = {}) {
+    const { text, tree } = strictObject(original.bytes ?? Buffer.from('{}\n'));
+    const value = JSON.parse(text);
+    const servers = tree.children?.find(p => p.children[0].value === 'mcpServers')?.children[1];
+    if (servers && servers.type !== 'object')
+        fail('SETUP_CONFIG_INVALID');
+    if (servers && Object.hasOwn(value.mcpServers, 'sealbridge')) {
+        const existing = value.mcpServers.sealbridge;
+        if (isDeepStrictEqual(existing, entry))
+            return { ...original, next: original.bytes };
+        if (!options.updateExisting)
+            fail(options.alternateEntry !== undefined && isDeepStrictEqual(existing, options.alternateEntry)
+                ? 'SETUP_APPROVAL_MODE_CONFLICT' : 'SETUP_ENTRY_CONFLICT');
+        const node = servers.children.find(p => p.children[0].value === 'sealbridge').children[1];
+        const bom = original.bytes?.subarray(0, 3).equals(Buffer.from([0xef, 0xbb, 0xbf])) ? '\uFEFF' : '';
+        const next = Buffer.from(bom + text.slice(0, node.offset) + JSON.stringify(entry) + text.slice(node.offset + node.length));
+        strictObject(next);
+        return { ...original, next };
+    }
+    // Insert only the property bytes. Existing keys, spacing, BOM and line endings stay intact.
+    const object = servers ?? tree;
+    const eol = text.includes('\r\n') ? '\r\n' : '\n';
+    const unit = /(?:^|\n)([ \t]+)"/.exec(text)?.[1] ?? '  ';
+    const base = servers ? unit : '';
+    const property = JSON.stringify(servers ? { sealbridge: entry } : { mcpServers: { sealbridge: entry } }, null, unit)
+        .slice(2, -2).split('\n').map(line => base + line).join(eol);
+    const children = object.children ?? [];
+    const last = children.at(-1);
+    const offset = last ? last.offset + last.length : object.offset + 1;
+    const tail = text.slice(offset, object.offset + object.length - 1);
+    const suffix = tail.includes('\n') ? '' : eol + base;
+    const next = text.slice(0, offset) + (last ? ',' : '') + eol + property + suffix + text.slice(offset);
+    const bom = original.bytes?.subarray(0, 3).equals(Buffer.from([0xef, 0xbb, 0xbf])) ? '\uFEFF' : '';
+    const bytes = Buffer.from(bom + next);
+    strictObject(bytes);
+    return { ...original, next: bytes };
+}
+export function assertUnchanged(original, io = fs, platform = process.platform) {
+    const current = snapshot(original.path, io, platform);
+    if (original.bytes === undefined ? current.bytes !== undefined :
+        !current.bytes?.equals(original.bytes) || current.stat.dev !== original.stat.dev ||
+            current.stat.ino !== original.stat.ino || current.stat.mode !== original.stat.mode ||
+            current.stat.uid !== original.stat.uid || current.stat.gid !== original.stat.gid)
+        fail('SETUP_CONFIG_CHANGED');
+}
+function flushed(path, bytes, mode, io, owner, created) {
+    const fd = io.openSync(path, fs.constants.O_WRONLY | fs.constants.O_CREAT | fs.constants.O_EXCL |
+        (fs.constants.O_NOFOLLOW ?? 0), mode);
+    try {
+        created?.();
+        if (process.platform !== 'win32' && owner) {
+            const stat = io.fstatSync(fd);
+            if (stat.uid !== owner.uid || stat.gid !== owner.gid)
+                io.fchownSync(fd, owner.uid, owner.gid);
+            io.fchmodSync(fd, mode);
+        }
+        let offset = 0;
+        while (offset < bytes.length) {
+            const count = io.writeSync(fd, bytes, offset, bytes.length - offset);
+            if (!count)
+                fail('SETUP_WRITE_FAILED');
+            offset += count;
+        }
+        io.fsyncSync(fd);
+    }
+    finally {
+        io.closeSync(fd);
+    }
+}
+/** A backup remains available after a later write failure; never restore over owner edits. */
+export function publish(change, root, io = fs, platform = process.platform) {
+    assertUnchanged(change, io, platform);
+    if (change.bytes?.equals(change.next))
+        return;
+    const temporary = join(dirname(change.path), '.sealbridge.' + randomUUID() + '.tmp');
+    let madeTemporary = false;
+    try {
+        if (change.bytes) {
+            const backups = join(root, 'setup', 'backups');
+            ensurePrivateDirectory(join(root, 'setup'), io, platform);
+            ensurePrivateDirectory(backups, io, platform);
+            change.backup = join(backups, randomUUID());
+            flushed(change.backup, change.bytes, 0o600, io);
+        }
+        checkPrivatePath(change.path, io, platform);
+        io.mkdirSync(dirname(change.path), { recursive: true });
+        checkPrivatePath(change.path, io, platform);
+        flushed(temporary, change.next, change.stat ? change.stat.mode & 0o777 : 0o600, io, change.stat, () => { madeTemporary = true; });
+        assertUnchanged(change, io, platform);
+        if (change.bytes)
+            io.renameSync(temporary, change.path);
+        else
+            io.linkSync(temporary, change.path);
+        const current = snapshot(change.path, io, platform);
+        if (!current.bytes?.equals(change.next))
+            fail('SETUP_CONFIG_CHANGED');
+    }
+    catch (error) {
+        if (error instanceof Error && error.message.startsWith('SETUP_'))
+            throw error;
+        fail(errno(error) === 'EEXIST' ? 'SETUP_CONFIG_CHANGED' : 'SETUP_WRITE_FAILED');
+    }
+    finally {
+        if (madeTemporary) {
+            try {
+                io.unlinkSync(temporary);
+            }
+            catch (error) {
+                if (errno(error) !== 'ENOENT')
+                    throw new Error('SETUP_WRITE_FAILED');
+            }
+        }
+    }
+}
+//# sourceMappingURL=setup-files.js.map

package/dist/cli/dist/setup-files.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"setup-files.js","sourceRoot":"","sources":["../src/setup-files.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAC;AAC9C,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAEzC,OAAO,EAAE,gBAAgB,EAAE,sBAAsB,EAAE,MAAM,6BAA6B,CAAC;AAIvF,SAAS,IAAI,CAAC,IAAY,IAAW,MAAM,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAC7D,MAAM,KAAK,GAAG,CAAC,KAAc,EAAE,EAAE,CAAE,KAA+B,CAAC,IAAI,CAAC;AAExE,kFAAkF;AAClF,MAAM,UAAU,QAAQ,CAAC,IAAY,EAAE,EAAE,GAAG,EAAE,EAAE,QAAQ,GAAG,OAAO,CAAC,QAAQ;IACzE,IAAI,EAAsB,CAAC;IAC3B,IAAI,CAAC;QACH,gBAAgB,CAAC,IAAI,EAAE,EAAE,EAAE,QAAQ,CAAC,CAAC;QACrC,IAAI,MAAgB,CAAC;QACrB,IAAI,CAAC;YAAC,MAAM,GAAG,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QAAC,CAAC;QACpC,OAAO,KAAK,EAAE,CAAC;YAAC,IAAI,KAAK,CAAC,KAAK,CAAC,KAAK,QAAQ;gBAAE,OAAO,EAAE,IAAI,EAAE,CAAC;YAAC,MAAM,KAAK,CAAC;QAAC,CAAC;QAC9E,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,MAAM,CAAC,IAAI,GAAG,IAAI,GAAG,IAAI;YAAE,IAAI,CAAC,sBAAsB,CAAC,CAAC;QAChF,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC,SAAS,CAAC,QAAQ,GAAG,CAAC,EAAE,CAAC,SAAS,CAAC,UAAU,IAAI,CAAC,CAAC;YAC3E,CAAC,EAAE,CAAC,SAAS,CAAC,UAAU,IAAI,CAAC,CAAC,CAAC,CAAC;QAClC,MAAM,IAAI,GAAG,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;QAC9B,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,IAAI,CAAC,GAAG,KAAK,MAAM,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,KAAK,MAAM,CAAC,GAAG;YAAE,IAAI,CAAC,sBAAsB,CAAC,CAAC;QACvG,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC;QAC7C,IAAI,MAAM,GAAG,CAAC,EAAE,KAAa,CAAC;QAC9B,OAAO,MAAM,GAAG,MAAM,CAAC,MAAM,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,GAAG,MAAM,EAAE,IAAI,CAAC,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC;QAC1H,IAAI,MAAM,GAAG,IAAI,GAAG,IAAI;YAAE,IAAI,CAAC,sBAAsB,CAAC,CAAC;QACvD,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC;IAC3D,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,KAAK,IAAI,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,QAAQ,CAAC;YAAE,MAAM,KAAK,CAAC;QAC9E,IAAI,KAAK,YAAY,KAAK,IAAI,KAAK,CAAC,OAAO,KAAK,kBAAkB;YAAE,IAAI,CAAC,sBAAsB,CAAC,CAAC;QACjG,OAAO,IAAI,CAAC,oBAAoB,CAAC,CAAC;IACpC,CAAC;YAAS,CAAC;QAAC,IAAI,EAAE,KAAK,SAAS;YAAE,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;IAAC,CAAC;AACvD,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,KAAa;IACxC,MAAM,GAAG,GAAG,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACnC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;QAAE,IAAI,CAAC,sBAAsB,CAAC,CAAC;IAClE,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;IACxC,MAAM,MAAM,GAAiB,EAAE,CAAC;IAChC,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,gBAAgB,EAAE,IAAI,EAAE,kBAAkB,EAAE,KAAK,EAAE,CAAC,CAAC;IAC5F,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM;QAAE,IAAI,CAAC,sBAAsB,CAAC,CAAC;IACnF,SAAS,UAAU,CAAC,IAAc;QAChC,IAAI,IAAI,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC3B,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;YAChC,KAAK,MAAM,QAAQ,IAAI,IAAI,CAAC,QAAQ,IAAI,EAAE,EAAE,CAAC;gBAC3C,MAAM,IAAI,GAAG,QAAQ,CAAC,QAAS,CAAC,CAAC,CAAC,CAAC,KAAe,CAAC;gBACnD,IAAI,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC;oBAAE,IAAI,CAAC,sBAAsB,CAAC,CAAC;gBAClD,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YAClB,CAAC;QACH,CAAC;QACD,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,QAAQ,IAAI,EAAE;YAAE,UAAU,CAAC,KAAK,CAAC,CAAC;IAC7D,CAAC;IACD,UAAU,CAAC,IAAI,CAAC,CAAC;IACjB,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;AACxB,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,QAAkB,EAAE,KAAc,EAC3D,UAAkE,EAAE;IACpE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,YAAY,CAAC,QAAQ,CAAC,KAAK,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;IAC3E,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAA4B,CAAC;IAC1D,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAS,CAAC,CAAC,CAAC,CAAC,KAAK,KAAK,YAAY,CAAC,EAAE,QAAS,CAAC,CAAC,CAAC,CAAC;IAC9F,IAAI,OAAO,IAAI,OAAO,CAAC,IAAI,KAAK,QAAQ;QAAE,IAAI,CAAC,sBAAsB,CAAC,CAAC;IACvE,IAAI,OAAO,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,UAAoB,EAAE,YAAY,CAAC,EAAE,CAAC;QACvE,MAAM,QAAQ,GAAI,KAAK,CAAC,UAAsC,CAAC,UAAU,CAAC;QAC1E,IAAI,iBAAiB,CAAC,QAAQ,EAAE,KAAK,CAAC;YAAE,OAAO,EAAE,GAAG,QAAQ,EAAE,IAAI,EAAE,QAAQ,CAAC,KAAM,EAAE,CAAC;QACtF,IAAI,CAAC,OAAO,CAAC,cAAc;YAAE,IAAI,CAAC,OAAO,CAAC,cAAc,KAAK,SAAS,IAAI,iBAAiB,CAAC,QAAQ,EAAE,OAAO,CAAC,cAAc,CAAC;gBAC3H,CAAC,CAAC,8BAA8B,CAAC,CAAC,CAAC,sBAAsB,CAAC,CAAC;QAC7D,MAAM,IAAI,GAAG,OAAO,CAAC,QAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAS,CAAC,CAAC,CAAC,CAAC,KAAK,KAAK,YAAY,CAAE,CAAC,QAAS,CAAC,CAAC,CAAC,CAAC;QAC9F,MAAM,GAAG,GAAG,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;QACnG,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,MAAM,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;QAC3H,YAAY,CAAC,IAAI,CAAC,CAAC;QACnB,OAAO,EAAE,GAAG,QAAQ,EAAE,IAAI,EAAE,CAAC;IAC/B,CAAC;IACD,4FAA4F;IAC5F,MAAM,MAAM,GAAG,OAAO,IAAI,IAAI,CAAC;IAC/B,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;IAClD,MAAM,IAAI,GAAG,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;IACzD,MAAM,IAAI,GAAG,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;IACjC,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,EAAE,UAAU,EAAE,KAAK,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC;SACjH,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC/D,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,IAAI,EAAE,CAAC;IACvC,MAAM,IAAI,GAAG,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IAC7B,MAAM,MAAM,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC;IACpE,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACnE,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,GAAG,IAAI,CAAC;IACrD,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,GAAG,GAAG,QAAQ,GAAG,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACtG,MAAM,GAAG,GAAG,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;IACnG,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,CAAC;IACtC,YAAY,CAAC,KAAK,CAAC,CAAC;IACpB,OAAO,EAAE,GAAG,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;AACtC,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,QAAkB,EAAE,EAAE,GAAG,EAAE,EAAE,QAAQ,GAAG,OAAO,CAAC,QAAQ;IACtF,MAAM,OAAO,GAAG,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,EAAE,QAAQ,CAAC,CAAC;IACtD,IAAI,QAAQ,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC;QAC5D,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,OAAO,CAAC,IAAK,CAAC,GAAG,KAAK,QAAQ,CAAC,IAAK,CAAC,GAAG;YAClF,OAAO,CAAC,IAAK,CAAC,GAAG,KAAK,QAAQ,CAAC,IAAK,CAAC,GAAG,IAAI,OAAO,CAAC,IAAK,CAAC,IAAI,KAAK,QAAQ,CAAC,IAAK,CAAC,IAAI;YACtF,OAAO,CAAC,IAAK,CAAC,GAAG,KAAK,QAAQ,CAAC,IAAK,CAAC,GAAG,IAAI,OAAO,CAAC,IAAK,CAAC,GAAG,KAAK,QAAQ,CAAC,IAAK,CAAC,GAAG;QACtF,IAAI,CAAC,sBAAsB,CAAC,CAAC;AACjC,CAAC;AAED,SAAS,OAAO,CAAC,IAAY,EAAE,KAAa,EAAE,IAAY,EAAE,EAAa,EAAE,KAAgB,EAAE,OAAoB;IAC/G,MAAM,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC,SAAS,CAAC,QAAQ,GAAG,EAAE,CAAC,SAAS,CAAC,OAAO,GAAG,EAAE,CAAC,SAAS,CAAC,MAAM;QAC7F,CAAC,EAAE,CAAC,SAAS,CAAC,UAAU,IAAI,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;IACxC,IAAI,CAAC;QACH,OAAO,EAAE,EAAE,CAAC;QACZ,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,IAAI,KAAK,EAAE,CAAC;YAC1C,MAAM,IAAI,GAAG,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;YAC9B,IAAI,IAAI,CAAC,GAAG,KAAK,KAAK,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,KAAK,KAAK,CAAC,GAAG;gBAAE,EAAE,CAAC,UAAU,CAAC,EAAE,EAAE,KAAK,CAAC,GAAG,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC;YAC9F,EAAE,CAAC,UAAU,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;QAC1B,CAAC;QACD,IAAI,MAAM,GAAG,CAAC,CAAC;QACf,OAAO,MAAM,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC;YAC7B,MAAM,KAAK,GAAG,EAAE,CAAC,SAAS,CAAC,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,GAAG,MAAM,CAAC,CAAC;YACrE,IAAI,CAAC,KAAK;gBAAE,IAAI,CAAC,oBAAoB,CAAC,CAAC;YACvC,MAAM,IAAI,KAAK,CAAC;QAClB,CAAC;QACD,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;IACnB,CAAC;YAAS,CAAC;QAAC,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;IAAC,CAAC;AACjC,CAAC;AAED,8FAA8F;AAC9F,MAAM,UAAU,OAAO,CAAC,MAAkB,EAAE,IAAY,EAAE,EAAE,GAAG,EAAE,EAAE,QAAQ,GAAG,OAAO,CAAC,QAAQ;IAC5F,eAAe,CAAC,MAAM,EAAE,EAAE,EAAE,QAAQ,CAAC,CAAC;IACtC,IAAI,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC;QAAE,OAAO;IAC9C,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,cAAc,GAAG,UAAU,EAAE,GAAG,MAAM,CAAC,CAAC;IACrF,IAAI,aAAa,GAAG,KAAK,CAAC;IAC1B,IAAI,CAAC;QACH,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;YACjB,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;YAC/C,sBAAsB,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE,EAAE,EAAE,QAAQ,CAAC,CAAC;YAC1D,sBAAsB,CAAC,OAAO,EAAE,EAAE,EAAE,QAAQ,CAAC,CAAC;YAC9C,MAAM,CAAC,MAAM,GAAG,IAAI,CAAC,OAAO,EAAE,UAAU,EAAE,CAAC,CAAC;YAC5C,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC;QAClD,CAAC;QACD,gBAAgB,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,EAAE,QAAQ,CAAC,CAAC;QAC5C,EAAE,CAAC,SAAS,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACxD,gBAAgB,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,EAAE,QAAQ,CAAC,CAAC;QAC5C,OAAO,CAAC,SAAS,EAAE,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,KAAK,EAAE,EAAE,EAAE,MAAM,CAAC,IAAI,EAC7F,GAAG,EAAE,GAAG,aAAa,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;QACnC,eAAe,CAAC,MAAM,EAAE,EAAE,EAAE,QAAQ,CAAC,CAAC;QACtC,IAAI,MAAM,CAAC,KAAK;YAAE,EAAE,CAAC,UAAU,CAAC,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;;YACnD,EAAE,CAAC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;QACzC,MAAM,OAAO,GAAG,QAAQ,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,EAAE,QAAQ,CAAC,CAAC;QACpD,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC;YAAE,IAAI,CAAC,sBAAsB,CAAC,CAAC;IACxE,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,KAAK,IAAI,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,QAAQ,CAAC;YAAE,MAAM,KAAK,CAAC;QAC9E,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,sBAAsB,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC;IAClF,CAAC;YAAS,CAAC;QACT,IAAI,aAAa,EAAE,CAAC;YAAC,IAAI,CAAC;gBAAC,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;YAAC,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBAAC,IAAI,KAAK,CAAC,KAAK,CAAC,KAAK,QAAQ;oBAAE,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAC;YAAC,CAAC;QAAC,CAAC;IAClJ,CAAC;AACH,CAAC"}

package/dist/cli/dist/setup-hosts.d.ts

@@ -0,0 +1,29 @@
+import * as fs from 'node:fs';
+import type { DataRootOptions } from '../../packages/runtime/dist/local-identity.js';
+export type SetupHost = 'claude-desktop' | 'cursor' | 'claude-code';
+export interface HostDestination {
+    host: SetupHost;
+    path: string;
+    evidence: string;
+}
+export interface HostOptions extends DataRootOptions {
+    fs?: typeof fs;
+    project?: string;
+}
+export declare function hostDestination(host: string, options: HostOptions): HostDestination;
+export declare function detectedHosts(options: HostOptions): HostDestination[];
+export interface McpEntry {
+    command: string;
+    args: string[];
+    env: {
+        SEALBRIDGE_DATA_DIR: string;
+    };
+}
+/** Resolve module-relative installed JavaScript, never a PATH shim or cwd-relative script. */
+export declare function runtimeEntry(root: string, options?: {
+    fs?: typeof fs;
+    platform?: NodeJS.Platform;
+    execPath?: string;
+    entryPath?: string;
+    requireApproval?: boolean;
+}): McpEntry;

package/dist/cli/dist/setup-hosts.js

@@ -0,0 +1,75 @@
+// SPDX-License-Identifier: Apache-2.0
+import * as fs from 'node:fs';
+import { homedir } from 'node:os';
+import { posix, win32 } from 'node:path';
+import { fileURLToPath } from 'node:url';
+export function hostDestination(host, options) {
+    const platform = options.platform ?? process.platform, paths = platform === 'win32' ? win32 : posix;
+    const home = options.home ?? homedir(), env = options.env ?? process.env;
+    if (!paths.isAbsolute(home))
+        throw new Error('SETUP_INVALID_ARGUMENT');
+    let path;
+    if (host === 'cursor')
+        path = paths.join(home, '.cursor', 'mcp.json');
+    else if (host === 'claude-desktop' && platform === 'darwin')
+        path = paths.join(home, 'Library', 'Application Support', 'Claude', 'claude_desktop_config.json');
+    else if (host === 'claude-desktop' && platform === 'win32' && env.APPDATA && paths.isAbsolute(env.APPDATA))
+        path = paths.join(env.APPDATA, 'Claude', 'claude_desktop_config.json');
+    else if (host === 'claude-code') {
+        if (!options.project || !paths.isAbsolute(options.project))
+            throw new Error('SETUP_INVALID_ARGUMENT');
+        path = paths.join(options.project, '.mcp.json');
+    }
+    else
+        throw new Error('SETUP_HOST_UNSUPPORTED');
+    return { host: host, path, evidence: paths.dirname(path) };
+}
+export function detectedHosts(options) {
+    const result = [], io = options.fs ?? fs;
+    for (const name of ['claude-desktop', 'cursor']) {
+        let host;
+        try {
+            host = hostDestination(name, options);
+        }
+        catch (error) {
+            if (error.message === 'SETUP_HOST_UNSUPPORTED')
+                continue;
+            throw error;
+        }
+        try {
+            if (io.lstatSync(host.evidence).isDirectory())
+                result.push(host);
+        }
+        catch (error) {
+            if (error.code !== 'ENOENT')
+                throw new Error('SETUP_WRITE_FAILED');
+        }
+    }
+    return result;
+}
+/** Resolve module-relative installed JavaScript, never a PATH shim or cwd-relative script. */
+export function runtimeEntry(root, options = {}) {
+    const io = options.fs ?? fs, platform = options.platform ?? process.platform;
+    const paths = platform === 'win32' ? win32 : posix;
+    const resolve = (path) => {
+        if (!paths.isAbsolute(path))
+            throw new Error('SETUP_RUNTIME_UNSTABLE');
+        const result = io.realpathSync(path);
+        if (/(^|[\\/])(_npx|npx|dlx|_tmp|\.tmp)([\\/]|$)|[\\/]\.pnpm[\\/]tmp[\\/]/i.test(path + '/' + result) ||
+            !io.statSync(result).isFile())
+            throw new Error('SETUP_RUNTIME_UNSTABLE');
+        return result;
+    };
+    try {
+        const command = resolve(options.execPath ?? process.execPath);
+        const entry = resolve(options.entryPath ?? fileURLToPath(new URL('./index.js', import.meta.url)));
+        if (!entry.endsWith('.js') || (platform === 'win32' && !/\.exe$/i.test(command)))
+            throw new Error();
+        return { command, args: [entry, 'mcp-server', ...(options.requireApproval === false ? [] : ['--require-approval'])],
+            env: { SEALBRIDGE_DATA_DIR: root } };
+    }
+    catch {
+        throw new Error('SETUP_RUNTIME_UNSTABLE');
+    }
+}
+//# sourceMappingURL=setup-hosts.js.map

package/dist/cli/dist/setup-hosts.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"setup-hosts.js","sourceRoot":"","sources":["../src/setup-hosts.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,WAAW,CAAC;AACzC,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAMzC,MAAM,UAAU,eAAe,CAAC,IAAY,EAAE,OAAoB;IAChE,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,QAAQ,EAAE,KAAK,GAAG,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC;IACpG,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,OAAO,EAAE,EAAE,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;IACzE,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;IACvE,IAAI,IAAY,CAAC;IACjB,IAAI,IAAI,KAAK,QAAQ;QAAE,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,UAAU,CAAC,CAAC;SACjE,IAAI,IAAI,KAAK,gBAAgB,IAAI,QAAQ,KAAK,QAAQ;QACzD,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,qBAAqB,EAAE,QAAQ,EAAE,4BAA4B,CAAC,CAAC;SAC/F,IAAI,IAAI,KAAK,gBAAgB,IAAI,QAAQ,KAAK,OAAO,IAAI,GAAG,CAAC,OAAO,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC;QACxG,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,QAAQ,EAAE,4BAA4B,CAAC,CAAC;SACpE,IAAI,IAAI,KAAK,aAAa,EAAE,CAAC;QAChC,IAAI,CAAC,OAAO,CAAC,OAAO,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,OAAO,CAAC,OAAO,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;QACtG,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;IAClD,CAAC;;QAAM,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;IACjD,OAAO,EAAE,IAAI,EAAE,IAAiB,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;AAC1E,CAAC;AACD,MAAM,UAAU,aAAa,CAAC,OAAoB;IAChD,MAAM,MAAM,GAAsB,EAAE,EAAE,EAAE,GAAG,OAAO,CAAC,EAAE,IAAI,EAAE,CAAC;IAC5D,KAAK,MAAM,IAAI,IAAI,CAAC,gBAAgB,EAAE,QAAQ,CAAC,EAAE,CAAC;QAChD,IAAI,IAAqB,CAAC;QAC1B,IAAI,CAAC;YAAC,IAAI,GAAG,eAAe,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QAAC,CAAC;QAC9C,OAAO,KAAK,EAAE,CAAC;YAAC,IAAK,KAAe,CAAC,OAAO,KAAK,wBAAwB;gBAAE,SAAS;YAAC,MAAM,KAAK,CAAC;QAAC,CAAC;QACnG,IAAI,CAAC;YAAC,IAAI,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,WAAW,EAAE;gBAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAAC,CAAC;QACzE,OAAO,KAAK,EAAE,CAAC;YAAC,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;gBAAE,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAC;QAAC,CAAC;IAClH,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAGD,8FAA8F;AAC9F,MAAM,UAAU,YAAY,CAAC,IAAY,EAAE,UAEvC,EAAE;IACJ,MAAM,EAAE,GAAG,OAAO,CAAC,EAAE,IAAI,EAAE,EAAE,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,QAAQ,CAAC;IAC7E,MAAM,KAAK,GAAG,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC;IACnD,MAAM,OAAO,GAAG,CAAC,IAAY,EAAE,EAAE;QAC/B,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;QACvE,MAAM,MAAM,GAAG,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;QACrC,IAAI,uEAAuE,CAAC,IAAI,CAAC,IAAI,GAAG,GAAG,GAAG,MAAM,CAAC;YACjG,CAAC,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;QAC7E,OAAO,MAAM,CAAC;IAChB,CAAC,CAAC;IACF,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,QAAQ,CAAC,CAAC;QAC9D,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,SAAS,IAAI,aAAa,CAAC,IAAI,GAAG,CAAC,YAAY,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QAClG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,KAAK,OAAO,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAAE,MAAM,IAAI,KAAK,EAAE,CAAC;QACpG,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,YAAY,EAAE,GAAG,CAAC,OAAO,CAAC,eAAe,KAAK,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC;YACjH,GAAG,EAAE,EAAE,mBAAmB,EAAE,IAAI,EAAE,EAAE,CAAC;IACzC,CAAC;IAAC,MAAM,CAAC;QAAC,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;IAAC,CAAC;AACxD,CAAC"}