@amalgm/browser 0.1.0

package/dist/src/adapters/mcp/tools.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tools.js","sourceRoot":"","sources":["../../../../src/adapters/mcp/tools.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,oBAAoB,EAAE,MAAM,iBAAiB,CAAC;AAEvD,OAAO,EAAE,wBAAwB,EAAE,MAAM,eAAe,CAAC;AACzD,OAAO,EAAE,oBAAoB,EAAE,MAAM,eAAe,CAAC;AAGrD,MAAM,UAAU,qBAAqB,CAAC,OAA8B;IAClE,OAAO,wBAAwB,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;QACnD,IAAI,EAAE,WAAW,UAAU,CAAC,IAAI,EAAE;QAClC,WAAW,EAAE,UAAU,CAAC,WAAW;QACnC,WAAW,EAAE,UAAU,CAAC,WAAW;QACnC,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM;YACzB,MAAM,KAAK,GAAG,MAAM,oBAAoB,CAAC,OAAO,EAAE,UAAU,CAAC,IAAI,EAAE,KAAK,EAAE;gBACxE,UAAU,EAAE,KAAK,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACjD,CAAC,CAAC;YACH,OAAO,SAAS,CAAC,KAAK,CAAC,CAAC;QAC1B,CAAC;KACF,CAAC,CAAC,CAAC;AACN,CAAC;AAED,SAAS,SAAS,CAAC,KAAc;IAC/B,MAAM,MAAM,GAAG,KAAmC,CAAC;IACnD,IAAI,MAAM,EAAE,IAAI,KAAK,SAAS,EAAE,CAAC;QAC/B,OAAO;YACL,OAAO,EAAE;gBACP,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,QAAQ,EAAE,MAAM,CAAC,OAAO,CAAC,QAAQ,EAAE;gBACjF,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,uBAAuB,MAAM,CAAC,OAAO,CAAC,KAAK,gCAAgC,EAAE;aACpG;YACD,iBAAiB,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,eAAe,EAAE,MAAM,CAAC,OAAO,CAAC,eAAe,EAAE;SACrH,CAAC;IACJ,CAAC;IACD,MAAM,SAAS,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;IAClC,OAAO;QACL,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,MAAM,CAAC,EAAE,CAAC;QACtF,iBAAiB,EAAE,SAAS;KAC7B,CAAC;AACJ,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC9B,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACrD,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,oBAAoB,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IAC1E,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IACtD,OAAO,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,KAAgC,CAAC;SACvE,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,6EAA6E,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;SAC3G,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;AACpD,CAAC"}

package/dist/src/adapters/mcp/types.d.ts

@@ -0,0 +1,17 @@
+export interface JsonRpcRequest {
+    jsonrpc?: string;
+    id?: string | number | null;
+    method?: string;
+    params?: Record<string, unknown>;
+}
+export interface BrowserMcpTool {
+    name: string;
+    description: string;
+    inputSchema: Record<string, unknown>;
+    handler(input: Record<string, unknown>, signal?: AbortSignal): Promise<unknown>;
+}
+export interface BrowserMcpServer {
+    tools: BrowserMcpTool[];
+    handle(message: JsonRpcRequest): Promise<unknown>;
+    start(input?: NodeJS.ReadableStream, output?: NodeJS.WritableStream): Promise<() => Promise<void>>;
+}

package/dist/src/adapters/mcp/types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.js.map

package/dist/src/adapters/mcp/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../../src/adapters/mcp/types.ts"],"names":[],"mappings":""}

package/dist/src/adapters/toolbox/aliases.d.ts

@@ -0,0 +1,5 @@
+import type { ProductActionName } from '../actions.js';
+export declare function resolveBrowserAlias(raw: string, input: Record<string, unknown>): {
+    name: ProductActionName;
+    input: Record<string, unknown>;
+};

package/dist/src/adapters/toolbox/aliases.js

@@ -0,0 +1,14 @@
+const cuaAliases = new Set([
+    'cua_screenshot', 'cua_click', 'cua_double_click', 'cua_move',
+    'cua_scroll', 'cua_type', 'cua_keypress', 'cua_drag',
+]);
+export function resolveBrowserAlias(raw, input) {
+    let name = raw.replace(/^toolbox__browser_/, '').replace(/^browser\./, '');
+    if (name.startsWith('browser_'))
+        name = name.slice('browser_'.length);
+    if (cuaAliases.has(name)) {
+        return { name: 'cua', input: { ...input, operation: { ...input, kind: name.slice('cua_'.length) } } };
+    }
+    return { name: name, input };
+}
+//# sourceMappingURL=aliases.js.map

package/dist/src/adapters/toolbox/aliases.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"aliases.js","sourceRoot":"","sources":["../../../../src/adapters/toolbox/aliases.ts"],"names":[],"mappings":"AAEA,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC;IACzB,gBAAgB,EAAE,WAAW,EAAE,kBAAkB,EAAE,UAAU;IAC7D,YAAY,EAAE,UAAU,EAAE,cAAc,EAAE,UAAU;CACrD,CAAC,CAAC;AAEH,MAAM,UAAU,mBAAmB,CACjC,GAAW,EACX,KAA8B;IAE9B,IAAI,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,oBAAoB,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC;IAC3E,IAAI,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC;QAAE,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;IACtE,IAAI,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;QACzB,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,GAAG,KAAK,EAAE,SAAS,EAAE,EAAE,GAAG,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,CAAC;IACxG,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,IAAyB,EAAE,KAAK,EAAE,CAAC;AACpD,CAAC"}

package/dist/src/adapters/toolbox/executor.d.ts

@@ -0,0 +1,6 @@
+import type { BrowserProductService } from '../../product-service.js';
+import type { BrowserRuntimeContext } from '../../types.js';
+export interface BrowserToolboxExecutionPolicy {
+    canExecute(actionId: string, context: BrowserRuntimeContext): boolean | Promise<boolean>;
+}
+export declare function createBrowserToolboxExecutor(browser: BrowserProductService, policy?: BrowserToolboxExecutionPolicy): (actionId: string, input: Record<string, unknown>, context?: BrowserRuntimeContext) => Promise<unknown>;

package/dist/src/adapters/toolbox/executor.js

@@ -0,0 +1,13 @@
+import { executeProductAction } from '../execute.js';
+import { resolveBrowserAlias } from './aliases.js';
+import { BrowserError } from '../../errors.js';
+export function createBrowserToolboxExecutor(browser, policy) {
+    return async (actionId, input, context = {}) => {
+        const action = resolveBrowserAlias(actionId, input);
+        if (policy && !await policy.canExecute(`browser.${action.name}`, context)) {
+            throw new BrowserError('AUTHORIZATION_DENIED', `Browser action browser.${action.name} is disabled.`);
+        }
+        return executeProductAction(browser, action.name, action.input, context);
+    };
+}
+//# sourceMappingURL=executor.js.map

package/dist/src/adapters/toolbox/executor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"executor.js","sourceRoot":"","sources":["../../../../src/adapters/toolbox/executor.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,oBAAoB,EAAE,MAAM,eAAe,CAAC;AACrD,OAAO,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AACnD,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAM/C,MAAM,UAAU,4BAA4B,CAC1C,OAA8B,EAC9B,MAAsC;IAEtC,OAAO,KAAK,EACV,QAAgB,EAChB,KAA8B,EAC9B,UAAiC,EAAE,EACjB,EAAE;QACpB,MAAM,MAAM,GAAG,mBAAmB,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;QACpD,IAAI,MAAM,IAAI,CAAC,MAAM,MAAM,CAAC,UAAU,CAAC,WAAW,MAAM,CAAC,IAAI,EAAE,EAAE,OAAO,CAAC,EAAE,CAAC;YAC1E,MAAM,IAAI,YAAY,CAAC,sBAAsB,EAAE,0BAA0B,MAAM,CAAC,IAAI,eAAe,CAAC,CAAC;QACvG,CAAC;QACD,OAAO,oBAAoB,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IAC3E,CAAC,CAAC;AACJ,CAAC"}

package/dist/src/adapters/toolbox/manifest.d.ts

@@ -0,0 +1,15 @@
+export interface BrowserToolboxManifest {
+    id: 'browser';
+    name: string;
+    description: string;
+    actions: Array<{
+        id: string;
+        name: string;
+        capability: 'core' | 'computer-use' | 'recording' | 'auth';
+        description: string;
+        inputSchema: Record<string, unknown>;
+        mcpName: string;
+    }>;
+    legacyGrants: Record<string, string[]>;
+}
+export declare function browserToolboxManifest(): BrowserToolboxManifest;

package/dist/src/adapters/toolbox/manifest.js

@@ -0,0 +1,24 @@
+import { browserActionDescriptors } from '../actions.js';
+export function browserToolboxManifest() {
+    const byCapability = (capability) => browserActionDescriptors.filter((action) => action.capability === capability).map((action) => `browser.${action.name}`);
+    return {
+        id: 'browser',
+        name: 'Browser',
+        description: 'Browse and operate the web in visible Electron or isolated headless Chromium sessions.',
+        actions: browserActionDescriptors.map((action) => ({
+            id: `browser.${action.name}`,
+            name: action.name,
+            capability: action.capability,
+            description: action.description,
+            inputSchema: action.inputSchema,
+            mcpName: `toolbox__browser_${action.name}`,
+        })),
+        legacyGrants: {
+            browser_cua: byCapability('computer-use'),
+            browser_recording: byCapability('recording'),
+            browser_auth: byCapability('auth'),
+            'amalgm.browser': browserActionDescriptors.map((action) => `browser.${action.name}`),
+        },
+    };
+}
+//# sourceMappingURL=manifest.js.map

package/dist/src/adapters/toolbox/manifest.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"manifest.js","sourceRoot":"","sources":["../../../../src/adapters/toolbox/manifest.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,wBAAwB,EAAE,MAAM,eAAe,CAAC;AAiBzD,MAAM,UAAU,sBAAsB;IACpC,MAAM,YAAY,GAAG,CAAC,UAAmE,EAAY,EAAE,CACrG,wBAAwB,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,UAAU,KAAK,UAAU,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,WAAW,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;IAC1H,OAAO;QACL,EAAE,EAAE,SAAS;QACb,IAAI,EAAE,SAAS;QACf,WAAW,EAAE,wFAAwF;QACrG,OAAO,EAAE,wBAAwB,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;YACjD,EAAE,EAAE,WAAW,MAAM,CAAC,IAAI,EAAE;YAC5B,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,UAAU,EAAE,MAAM,CAAC,UAAU;YAC7B,WAAW,EAAE,MAAM,CAAC,WAAW;YAC/B,WAAW,EAAE,MAAM,CAAC,WAAW;YAC/B,OAAO,EAAE,oBAAoB,MAAM,CAAC,IAAI,EAAE;SAC3C,CAAC,CAAC;QACH,YAAY,EAAE;YACZ,WAAW,EAAE,YAAY,CAAC,cAAc,CAAC;YACzC,iBAAiB,EAAE,YAAY,CAAC,WAAW,CAAC;YAC5C,YAAY,EAAE,YAAY,CAAC,MAAM,CAAC;YAClC,gBAAgB,EAAE,wBAAwB,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,WAAW,MAAM,CAAC,IAAI,EAAE,CAAC;SACrF;KACF,CAAC;AACJ,CAAC"}

package/dist/src/artifacts.d.ts

@@ -0,0 +1,14 @@
+import type { BrowserArtifact, BrowserRuntimeContext } from './types.js';
+import type { BrowserArtifactStore } from './ports.js';
+export declare class LocalArtifactStore implements BrowserArtifactStore {
+    readonly fallbackRoot: string;
+    constructor(fallbackRoot: string);
+    resolve(input: {
+        kind: BrowserArtifact['kind'];
+        name: string;
+        extension: string;
+        context: BrowserRuntimeContext;
+    }): Promise<string>;
+    inspect(file: string, kind: BrowserArtifact['kind'], mimeType: string): Promise<BrowserArtifact>;
+    remove(file: string): Promise<void>;
+}

package/dist/src/artifacts.js

@@ -0,0 +1,28 @@
+import fs from 'node:fs';
+import path from 'node:path';
+import { newId, safeId } from './ids.js';
+export class LocalArtifactStore {
+    fallbackRoot;
+    constructor(fallbackRoot) {
+        this.fallbackRoot = fallbackRoot;
+    }
+    async resolve(input) {
+        const root = input.context.artifactDestination
+            ? path.resolve(input.context.artifactDestination)
+            : this.fallbackRoot;
+        const directory = input.kind === 'recording'
+            ? path.join(root, '.amalgm', 'recordings')
+            : path.join(root, '.amalgm', 'browser', `${input.kind}s`);
+        await fs.promises.mkdir(directory, { recursive: true, mode: 0o700 });
+        const stamp = new Date().toISOString().replace(/[:.]/g, '-');
+        return path.join(directory, `${safeId(input.name)}-${stamp}.${safeId(input.extension)}`);
+    }
+    async inspect(file, kind, mimeType) {
+        const stats = await fs.promises.stat(file);
+        return { id: newId('artifact'), kind, path: file, mimeType, bytes: stats.size, createdAt: stats.birthtime.toISOString() };
+    }
+    async remove(file) {
+        await fs.promises.rm(file, { force: true });
+    }
+}
+//# sourceMappingURL=artifacts.js.map

package/dist/src/artifacts.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"artifacts.js","sourceRoot":"","sources":["../../src/artifacts.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAG7B,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,UAAU,CAAC;AAEzC,MAAM,OAAO,kBAAkB;IACR;IAArB,YAAqB,YAAoB;QAApB,iBAAY,GAAZ,YAAY,CAAQ;IAAG,CAAC;IAE7C,KAAK,CAAC,OAAO,CAAC,KAKb;QACC,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,mBAAmB;YAC5C,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,mBAAmB,CAAC;YACjD,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC;QACtB,MAAM,SAAS,GAAG,KAAK,CAAC,IAAI,KAAK,WAAW;YAC1C,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,YAAY,CAAC;YAC1C,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,GAAG,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC;QAC5D,MAAM,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACrE,MAAM,KAAK,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;QAC7D,OAAO,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,KAAK,IAAI,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;IAC3F,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,IAAY,EAAE,IAA6B,EAAE,QAAgB;QACzE,MAAM,KAAK,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC3C,OAAO,EAAE,EAAE,EAAE,KAAK,CAAC,UAAU,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,CAAC,IAAI,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,CAAC,WAAW,EAAE,EAAE,CAAC;IAC5H,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,IAAY;QACvB,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAC9C,CAAC;CACF"}

package/dist/src/auth/filter.d.ts

@@ -0,0 +1,3 @@
+export declare function filterAuthState(state: unknown, domains: string[]): unknown;
+export declare function stateStorageKinds(state: unknown): Array<'cookies' | 'localStorage' | 'sessionStorage'>;
+export declare function inferDomains(targetUrl: string, values?: string[]): string[];

package/dist/src/auth/filter.js

@@ -0,0 +1,60 @@
+import { cookieHostIsProtected } from '../cookies/policy.js';
+export function filterAuthState(state, domains) {
+    if (!state || typeof state !== 'object')
+        return { cookies: [], origins: [] };
+    const source = state;
+    const allowed = domains.map(normalizeDomain).filter(Boolean);
+    const cookies = Array.isArray(source.cookies)
+        ? source.cookies.filter((cookie) => cookieAllowed(cookie, allowed))
+        : [];
+    const origins = Array.isArray(source.origins)
+        ? source.origins.filter((origin) => originAllowed(origin, allowed))
+        : [];
+    return { ...source, cookies, origins };
+}
+export function stateStorageKinds(state) {
+    if (!state || typeof state !== 'object')
+        return [];
+    const source = state;
+    const kinds = [];
+    if (Array.isArray(source.cookies) && source.cookies.length)
+        kinds.push('cookies');
+    const origins = Array.isArray(source.origins) ? source.origins : [];
+    if (origins.some((origin) => Array.isArray(origin.localStorage) && origin.localStorage.length))
+        kinds.push('localStorage');
+    if (origins.some((origin) => Array.isArray(origin.sessionStorage) && origin.sessionStorage.length))
+        kinds.push('sessionStorage');
+    return kinds;
+}
+export function inferDomains(targetUrl, values = []) {
+    const domains = values.map(normalizeDomain).filter(Boolean);
+    try {
+        const inferred = normalizeDomain(new URL(targetUrl).hostname);
+        if (inferred)
+            domains.push(inferred);
+    }
+    catch { }
+    return [...new Set(domains)];
+}
+function cookieAllowed(value, domains) {
+    if (!value || typeof value !== 'object')
+        return false;
+    const domain = normalizeDomain(String(value.domain || ''));
+    return domains.some((allowed) => domain === allowed || domain.endsWith(`.${allowed}`));
+}
+function originAllowed(value, domains) {
+    if (!value || typeof value !== 'object')
+        return false;
+    try {
+        const host = new URL(String(value.origin || '')).hostname.toLowerCase();
+        return domains.some((allowed) => host === allowed || host.endsWith(`.${allowed}`));
+    }
+    catch {
+        return false;
+    }
+}
+function normalizeDomain(value) {
+    const domain = value.trim().replace(/^\./, '').toLowerCase();
+    return domain && !cookieHostIsProtected(domain) ? domain : '';
+}
+//# sourceMappingURL=filter.js.map

package/dist/src/auth/filter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"filter.js","sourceRoot":"","sources":["../../../src/auth/filter.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAE7D,MAAM,UAAU,eAAe,CAAC,KAAc,EAAE,OAAiB;IAC/D,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;IAC7E,MAAM,MAAM,GAAG,KAAgC,CAAC;IAChD,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAC7D,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC;QAC3C,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,aAAa,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QACnE,CAAC,CAAC,EAAE,CAAC;IACP,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC;QAC3C,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,aAAa,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QACnE,CAAC,CAAC,EAAE,CAAC;IACP,OAAO,EAAE,GAAG,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;AACzC,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,KAAc;IAC9C,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,EAAE,CAAC;IACnD,MAAM,MAAM,GAAG,KAAgC,CAAC;IAChD,MAAM,KAAK,GAAyD,EAAE,CAAC;IACvE,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM;QAAE,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAClF,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,OAAyC,CAAC,CAAC,CAAC,EAAE,CAAC;IACtG,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC,IAAI,MAAM,CAAC,YAAY,CAAC,MAAM,CAAC;QAAE,KAAK,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;IAC3H,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,cAAc,CAAC,IAAI,MAAM,CAAC,cAAc,CAAC,MAAM,CAAC;QAAE,KAAK,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;IACjI,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,SAAiB,EAAE,SAAmB,EAAE;IACnE,MAAM,OAAO,GAAG,MAAM,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAC5D,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,eAAe,CAAC,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC,QAAQ,CAAC,CAAC;QAC9D,IAAI,QAAQ;YAAE,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACvC,CAAC;IAAC,MAAM,CAAC,CAAA,CAAC;IACV,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;AAC/B,CAAC;AAED,SAAS,aAAa,CAAC,KAAc,EAAE,OAAiB;IACtD,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IACtD,MAAM,MAAM,GAAG,eAAe,CAAC,MAAM,CAAE,KAAuB,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,CAAC;IAC9E,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,MAAM,KAAK,OAAO,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,OAAO,EAAE,CAAC,CAAC,CAAC;AACzF,CAAC;AAED,SAAS,aAAa,CAAC,KAAc,EAAE,OAAiB;IACtD,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IACtD,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,MAAM,CAAE,KAAiC,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;QACrG,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,IAAI,KAAK,OAAO,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,OAAO,EAAE,CAAC,CAAC,CAAC;IACrF,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,KAAK,CAAC;IAAC,CAAC;AAC3B,CAAC;AAED,SAAS,eAAe,CAAC,KAAa;IACpC,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;IAC7D,OAAO,MAAM,IAAI,CAAC,qBAAqB,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;AAChE,CAAC"}

package/dist/src/auth/login.d.ts

@@ -0,0 +1,41 @@
+import type { BrowserRegistry } from '../ports.js';
+import type { BrowserService } from '../service.js';
+import type { BrowserActionResult, BrowserLoginSession, BrowserRuntimeContext, CuaOperation } from '../types.js';
+import { EncryptedSecretFile } from '../cookies/secret-file.js';
+import type { BrowserAuthService } from './service.js';
+export declare class BrowserLoginService {
+    readonly browser: BrowserService;
+    readonly auth: BrowserAuthService;
+    readonly registry: BrowserRegistry;
+    readonly secrets: EncryptedSecretFile;
+    readonly now: () => Date;
+    constructor(browser: BrowserService, auth: BrowserAuthService, registry: BrowserRegistry, secrets: EncryptedSecretFile, now?: () => Date);
+    list(): BrowserLoginSession[];
+    get(id: string): BrowserLoginSession;
+    create(input: {
+        targetUrl: string;
+        profileId?: string;
+        domains?: string[];
+        ttlMs?: number;
+        transport?: string;
+        liveUrl?: string;
+        context?: BrowserRuntimeContext;
+    }): {
+        session: BrowserLoginSession;
+        token: string;
+        url: string;
+    };
+    activate(id: string, token: string, context?: BrowserRuntimeContext): Promise<BrowserLoginSession>;
+    input(id: string, token: string, operation: CuaOperation, context?: BrowserRuntimeContext): Promise<BrowserActionResult>;
+    complete(input: {
+        id: string;
+        token: string;
+        bundleName?: string;
+        context?: BrowserRuntimeContext;
+    }): Promise<BrowserLoginSession>;
+    cancel(id: string, token: string): Promise<BrowserLoginSession>;
+    private authorized;
+    private expire;
+    private update;
+    private readSecrets;
+}

package/dist/src/auth/login.js

@@ -0,0 +1,145 @@
+import crypto from 'node:crypto';
+import { BrowserError } from '../errors.js';
+import { newId, safeId } from '../ids.js';
+import { inferDomains } from './filter.js';
+import { resolveLoginTransport } from './transport.js';
+export class BrowserLoginService {
+    browser;
+    auth;
+    registry;
+    secrets;
+    now;
+    constructor(browser, auth, registry, secrets, now = () => new Date()) {
+        this.browser = browser;
+        this.auth = auth;
+        this.registry = registry;
+        this.secrets = secrets;
+        this.now = now;
+    }
+    list() {
+        return this.registry.snapshot().loginSessions.map((session) => this.expire(session));
+    }
+    get(id) {
+        const session = this.list().find((value) => value.id === safeId(id));
+        if (!session)
+            throw new BrowserError('NOT_FOUND', `Browser login session ${id} does not exist.`);
+        return session;
+    }
+    create(input) {
+        try {
+            new URL(input.targetUrl);
+        }
+        catch {
+            throw new BrowserError('INVALID_INPUT', 'Login target must be a valid URL.');
+        }
+        const id = safeId(newId('login'));
+        const token = crypto.randomBytes(32).toString('base64url');
+        const timestamp = this.now();
+        const ttlMs = Math.min(Math.max(input.ttlMs || 15 * 60_000, 60_000), 60 * 60_000);
+        const context = input.context || {};
+        const transport = resolveLoginTransport({
+            ...(input.transport ? { transport: input.transport } : {}),
+            ...(input.liveUrl ? { liveUrl: input.liveUrl } : {}),
+            context,
+        });
+        const domains = inferDomains(input.targetUrl, input.domains);
+        if (!domains.length)
+            throw new BrowserError('INVALID_INPUT', 'Login target has no permitted authentication domain.');
+        const session = {
+            id,
+            profileId: safeId(input.profileId || id),
+            targetUrl: input.targetUrl,
+            domains,
+            status: 'pending',
+            ...transport,
+            expiresAt: new Date(timestamp.getTime() + ttlMs).toISOString(),
+            createdAt: timestamp.toISOString(),
+            updatedAt: timestamp.toISOString(),
+        };
+        this.registry.putLoginSession(session);
+        const data = this.readSecrets();
+        data.hashes[id] = tokenHash(token);
+        this.secrets.write(data);
+        void this.browser.publish({ type: 'login.updated', profileId: session.profileId, loginSessionId: id, status: session.status });
+        return { session, token, url: `/browser-auth/${encodeURIComponent(id)}?token=${encodeURIComponent(token)}` };
+    }
+    async activate(id, token, context = {}) {
+        const login = this.authorized(id, token);
+        const browserSession = await this.browser.createSession({
+            id: `login-${login.id}`,
+            profileId: login.profileId,
+            profileKind: 'durable',
+            context,
+        });
+        await this.browser.execute(browserSession.id, { type: 'open', url: login.targetUrl }, context);
+        return this.update(login, { status: 'active' });
+    }
+    async input(id, token, operation, context = {}) {
+        const login = this.authorized(id, token);
+        if (login.status !== 'active')
+            throw new BrowserError('CONFLICT', `Login session ${id} is ${login.status}.`);
+        return this.browser.execute(`login-${login.id}`, { type: 'cua', operation }, context);
+    }
+    async complete(input) {
+        const login = this.authorized(input.id, input.token);
+        if (login.status !== 'active')
+            throw new BrowserError('CONFLICT', `Login session ${login.id} is ${login.status}.`);
+        const bundle = await this.auth.save({
+            sessionId: `login-${login.id}`,
+            name: input.bundleName || `Login ${login.id}`,
+            domains: login.domains,
+            ...(input.context ? { context: input.context } : {}),
+        });
+        await this.browser.closeSession(`login-${login.id}`, input.context || {}).catch(() => undefined);
+        return this.update(login, { status: 'completed', authBundleId: bundle.id });
+    }
+    async cancel(id, token) {
+        const login = this.authorized(id, token);
+        if (login.status === 'active') {
+            await this.browser.closeSession(`login-${login.id}`).catch(() => undefined);
+        }
+        return this.update(login, { status: 'cancelled' });
+    }
+    authorized(id, token) {
+        const login = this.get(id);
+        if (['cancelled', 'completed', 'expired'].includes(login.status)) {
+            throw new BrowserError('CONFLICT', `Login session ${id} is ${login.status}.`);
+        }
+        const expected = this.readSecrets().hashes[login.id];
+        if (!expected || !constantTimeEqual(expected, tokenHash(token))) {
+            throw new BrowserError('AUTHORIZATION_DENIED', 'Login session token is invalid.');
+        }
+        return login;
+    }
+    expire(session) {
+        if (['pending', 'active'].includes(session.status) && Date.parse(session.expiresAt) <= this.now().getTime()) {
+            if (session.status === 'active')
+                void this.browser.closeSession(`login-${session.id}`).catch(() => undefined);
+            return this.update(session, { status: 'expired' });
+        }
+        return session;
+    }
+    update(session, patch) {
+        const updated = { ...session, ...patch, updatedAt: this.now().toISOString() };
+        this.registry.putLoginSession(updated);
+        if (['completed', 'cancelled', 'expired'].includes(updated.status)) {
+            const data = this.readSecrets();
+            delete data.hashes[updated.id];
+            this.secrets.write(data);
+        }
+        void this.browser.publish({
+            type: 'login.updated', profileId: updated.profileId, loginSessionId: updated.id, status: updated.status,
+        });
+        return updated;
+    }
+    readSecrets() {
+        return this.secrets.read() || { schemaVersion: 1, hashes: {} };
+    }
+}
+function tokenHash(token) { return crypto.createHash('sha256').update(token).digest('hex'); }
+function constantTimeEqual(left, right) {
+    const a = Buffer.from(left);
+    const b = Buffer.from(right);
+    return a.length === b.length && crypto.timingSafeEqual(a, b);
+}
+//# sourceMappingURL=login.js.map

package/dist/src/auth/login.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"login.js","sourceRoot":"","sources":["../../../src/auth/login.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,aAAa,CAAC;AACjC,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAC5C,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,WAAW,CAAC;AAK1C,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAE3C,OAAO,EAAE,qBAAqB,EAAE,MAAM,gBAAgB,CAAC;AAIvD,MAAM,OAAO,mBAAmB;IAEnB;IACA;IACA;IACA;IACA;IALX,YACW,OAAuB,EACvB,IAAwB,EACxB,QAAyB,EACzB,OAA4B,EAC5B,MAAkB,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE;QAJlC,YAAO,GAAP,OAAO,CAAgB;QACvB,SAAI,GAAJ,IAAI,CAAoB;QACxB,aAAQ,GAAR,QAAQ,CAAiB;QACzB,YAAO,GAAP,OAAO,CAAqB;QAC5B,QAAG,GAAH,GAAG,CAA+B;IAC1C,CAAC;IAEJ,IAAI;QACF,OAAO,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;IACvF,CAAC;IAED,GAAG,CAAC,EAAU;QACZ,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,KAAK,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;QACrE,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,YAAY,CAAC,WAAW,EAAE,yBAAyB,EAAE,kBAAkB,CAAC,CAAC;QACjG,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,MAAM,CAAC,KAQN;QACC,IAAI,CAAC;YAAC,IAAI,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC;YAAC,MAAM,IAAI,YAAY,CAAC,eAAe,EAAE,mCAAmC,CAAC,CAAC;QAAC,CAAC;QACzH,MAAM,EAAE,GAAG,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;QAClC,MAAM,KAAK,GAAG,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QAC3D,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC7B,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,IAAI,EAAE,GAAG,MAAM,EAAE,MAAM,CAAC,EAAE,EAAE,GAAG,MAAM,CAAC,CAAC;QAClF,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,IAAI,EAAE,CAAC;QACpC,MAAM,SAAS,GAAG,qBAAqB,CAAC;YACtC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC1D,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACpD,OAAO;SACR,CAAC,CAAC;QACH,MAAM,OAAO,GAAG,YAAY,CAAC,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;QAC7D,IAAI,CAAC,OAAO,CAAC,MAAM;YAAE,MAAM,IAAI,YAAY,CAAC,eAAe,EAAE,sDAAsD,CAAC,CAAC;QACrH,MAAM,OAAO,GAAwB;YACnC,EAAE;YACF,SAAS,EAAE,MAAM,CAAC,KAAK,CAAC,SAAS,IAAI,EAAE,CAAC;YACxC,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,OAAO;YACP,MAAM,EAAE,SAAS;YACjB,GAAG,SAAS;YACZ,SAAS,EAAE,IAAI,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,GAAG,KAAK,CAAC,CAAC,WAAW,EAAE;YAC9D,SAAS,EAAE,SAAS,CAAC,WAAW,EAAE;YAClC,SAAS,EAAE,SAAS,CAAC,WAAW,EAAE;SACnC,CAAC;QACF,IAAI,CAAC,QAAQ,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC;QACvC,MAAM,IAAI,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;QAChC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;QACnC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACzB,KAAK,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,cAAc,EAAE,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;QAC/H,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,iBAAiB,kBAAkB,CAAC,EAAE,CAAC,UAAU,kBAAkB,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC;IAC/G,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,EAAU,EAAE,KAAa,EAAE,UAAiC,EAAE;QAC3E,MAAM,KAAK,GAAG,IAAI,CAAC,UAAU,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;QACzC,MAAM,cAAc,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC;YACtD,EAAE,EAAE,SAAS,KAAK,CAAC,EAAE,EAAE;YACvB,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,WAAW,EAAE,SAAS;YACtB,OAAO;SACR,CAAC,CAAC;QACH,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,cAAc,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,CAAC,SAAS,EAAE,EAAE,OAAO,CAAC,CAAC;QAC/F,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC;IAClD,CAAC;IAED,KAAK,CAAC,KAAK,CACT,EAAU,EACV,KAAa,EACb,SAAuB,EACvB,UAAiC,EAAE;QAEnC,MAAM,KAAK,GAAG,IAAI,CAAC,UAAU,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;QACzC,IAAI,KAAK,CAAC,MAAM,KAAK,QAAQ;YAAE,MAAM,IAAI,YAAY,CAAC,UAAU,EAAE,iBAAiB,EAAE,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC;QAC7G,OAAO,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,SAAS,KAAK,CAAC,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,EAAE,OAAO,CAAC,CAAC;IACxF,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,KAKd;QACC,MAAM,KAAK,GAAG,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;QACrD,IAAI,KAAK,CAAC,MAAM,KAAK,QAAQ;YAAE,MAAM,IAAI,YAAY,CAAC,UAAU,EAAE,iBAAiB,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC;QACnH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;YAClC,SAAS,EAAE,SAAS,KAAK,CAAC,EAAE,EAAE;YAC9B,IAAI,EAAE,KAAK,CAAC,UAAU,IAAI,SAAS,KAAK,CAAC,EAAE,EAAE;YAC7C,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACrD,CAAC,CAAC;QACH,MAAM,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,SAAS,KAAK,CAAC,EAAE,EAAE,EAAE,KAAK,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QACjG,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC;IAC9E,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,EAAU,EAAE,KAAa;QACpC,MAAM,KAAK,GAAG,IAAI,CAAC,UAAU,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;QACzC,IAAI,KAAK,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;YAC9B,MAAM,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,SAAS,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QAC9E,CAAC;QACD,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC,CAAC;IACrD,CAAC;IAEO,UAAU,CAAC,EAAU,EAAE,KAAa;QAC1C,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC3B,IAAI,CAAC,WAAW,EAAE,WAAW,EAAE,SAAS,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;YACjE,MAAM,IAAI,YAAY,CAAC,UAAU,EAAE,iBAAiB,EAAE,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC;QAChF,CAAC;QACD,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACrD,IAAI,CAAC,QAAQ,IAAI,CAAC,iBAAiB,CAAC,QAAQ,EAAE,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;YAChE,MAAM,IAAI,YAAY,CAAC,sBAAsB,EAAE,iCAAiC,CAAC,CAAC;QACpF,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAEO,MAAM,CAAC,OAA4B;QACzC,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC;YAC5G,IAAI,OAAO,CAAC,MAAM,KAAK,QAAQ;gBAAE,KAAK,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,SAAS,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;YAC9G,OAAO,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC;QACrD,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAEO,MAAM,CAAC,OAA4B,EAAE,KAAmC;QAC9E,MAAM,OAAO,GAAG,EAAE,GAAG,OAAO,EAAE,GAAG,KAAK,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC;QAC9E,IAAI,CAAC,QAAQ,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC;QACvC,IAAI,CAAC,WAAW,EAAE,WAAW,EAAE,SAAS,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YACnE,MAAM,IAAI,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;YAChC,OAAO,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;YAC/B,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC3B,CAAC;QACD,KAAK,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC;YACxB,IAAI,EAAE,eAAe,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,cAAc,EAAE,OAAO,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM;SACxG,CAAC,CAAC;QACH,OAAO,OAAO,CAAC;IACjB,CAAC;IAEO,WAAW;QACjB,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,EAAgB,IAAI,EAAE,aAAa,EAAE,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;IAC/E,CAAC;CACF;AAED,SAAS,SAAS,CAAC,KAAa,IAAY,OAAO,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;AAC7G,SAAS,iBAAiB,CAAC,IAAY,EAAE,KAAa;IACpD,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAAC,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC1D,OAAO,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,IAAI,MAAM,CAAC,eAAe,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AAC/D,CAAC"}

package/dist/src/auth/portable.d.ts

@@ -0,0 +1,18 @@
+import type { BrowserAuthBundle } from '../types.js';
+export interface PortableAuthResource {
+    schemaVersion: 1;
+    bundle: BrowserAuthBundle;
+    encryption: {
+        algorithm: 'aes-256-gcm';
+        iv: string;
+        tag: string;
+        ciphertext: string;
+    };
+}
+interface PortablePayload {
+    bundle: BrowserAuthBundle;
+    state: unknown;
+}
+export declare function encryptPortableAuth(bundle: BrowserAuthBundle, state: unknown, keyValue: Buffer | string): PortableAuthResource;
+export declare function decryptPortableAuth(resource: PortableAuthResource, keyValue: Buffer | string): PortablePayload;
+export {};

package/dist/src/auth/portable.js

@@ -0,0 +1,48 @@
+import crypto from 'node:crypto';
+import { BrowserError } from '../errors.js';
+export function encryptPortableAuth(bundle, state, keyValue) {
+    const key = portableKey(keyValue);
+    const iv = crypto.randomBytes(12);
+    const cipher = crypto.createCipheriv('aes-256-gcm', key, iv);
+    const ciphertext = Buffer.concat([
+        cipher.update(JSON.stringify({ bundle, state })),
+        cipher.final(),
+    ]);
+    return {
+        schemaVersion: 1,
+        bundle,
+        encryption: {
+            algorithm: 'aes-256-gcm',
+            iv: iv.toString('base64'),
+            tag: cipher.getAuthTag().toString('base64'),
+            ciphertext: ciphertext.toString('base64'),
+        },
+    };
+}
+export function decryptPortableAuth(resource, keyValue) {
+    try {
+        if (resource.schemaVersion !== 1 || resource.encryption.algorithm !== 'aes-256-gcm')
+            throw new Error();
+        const decipher = crypto.createDecipheriv('aes-256-gcm', portableKey(keyValue), Buffer.from(resource.encryption.iv, 'base64'));
+        decipher.setAuthTag(Buffer.from(resource.encryption.tag, 'base64'));
+        const payload = JSON.parse(Buffer.concat([
+            decipher.update(Buffer.from(resource.encryption.ciphertext, 'base64')),
+            decipher.final(),
+        ]).toString('utf8'));
+        if (JSON.stringify(payload.bundle) !== JSON.stringify(resource.bundle))
+            throw new Error();
+        return payload;
+    }
+    catch (error) {
+        if (error instanceof BrowserError)
+            throw error;
+        throw new BrowserError('PROCESS_FAILED', 'Portable Browser auth resource failed integrity verification.');
+    }
+}
+function portableKey(value) {
+    const key = Buffer.isBuffer(value) ? value : Buffer.from(value, 'base64');
+    if (key.length !== 32)
+        throw new BrowserError('INVALID_INPUT', 'Portable Browser auth key must be 32 bytes.');
+    return key;
+}
+//# sourceMappingURL=portable.js.map

package/dist/src/auth/portable.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"portable.js","sourceRoot":"","sources":["../../../src/auth/portable.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,aAAa,CAAC;AACjC,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAgB5C,MAAM,UAAU,mBAAmB,CACjC,MAAyB,EACzB,KAAc,EACd,QAAyB;IAEzB,MAAM,GAAG,GAAG,WAAW,CAAC,QAAQ,CAAC,CAAC;IAClC,MAAM,EAAE,GAAG,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;IAClC,MAAM,MAAM,GAAG,MAAM,CAAC,cAAc,CAAC,aAAa,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;IAC7D,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC;QAC/B,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,KAAK,EAA4B,CAAC,CAAC;QAC1E,MAAM,CAAC,KAAK,EAAE;KACf,CAAC,CAAC;IACH,OAAO;QACL,aAAa,EAAE,CAAC;QAChB,MAAM;QACN,UAAU,EAAE;YACV,SAAS,EAAE,aAAa;YACxB,EAAE,EAAE,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC;YACzB,GAAG,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC;YAC3C,UAAU,EAAE,UAAU,CAAC,QAAQ,CAAC,QAAQ,CAAC;SAC1C;KACF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,mBAAmB,CACjC,QAA8B,EAC9B,QAAyB;IAEzB,IAAI,CAAC;QACH,IAAI,QAAQ,CAAC,aAAa,KAAK,CAAC,IAAI,QAAQ,CAAC,UAAU,CAAC,SAAS,KAAK,aAAa;YAAE,MAAM,IAAI,KAAK,EAAE,CAAC;QACvG,MAAM,QAAQ,GAAG,MAAM,CAAC,gBAAgB,CACtC,aAAa,EACb,WAAW,CAAC,QAAQ,CAAC,EACrB,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,EAAE,QAAQ,CAAC,CAC9C,CAAC;QACF,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,CAAC;QACpE,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC;YACvC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;YACtE,QAAQ,CAAC,KAAK,EAAE;SACjB,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAoB,CAAC;QACxC,IAAI,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC;YAAE,MAAM,IAAI,KAAK,EAAE,CAAC;QAC1F,OAAO,OAAO,CAAC;IACjB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,YAAY;YAAE,MAAM,KAAK,CAAC;QAC/C,MAAM,IAAI,YAAY,CAAC,gBAAgB,EAAE,+DAA+D,CAAC,CAAC;IAC5G,CAAC;AACH,CAAC;AAED,SAAS,WAAW,CAAC,KAAsB;IACzC,MAAM,GAAG,GAAG,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;IAC1E,IAAI,GAAG,CAAC,MAAM,KAAK,EAAE;QAAE,MAAM,IAAI,YAAY,CAAC,eAAe,EAAE,6CAA6C,CAAC,CAAC;IAC9G,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/src/auth/service.d.ts

@@ -0,0 +1,29 @@
+import type { BrowserRegistry } from '../ports.js';
+import type { BrowserService } from '../service.js';
+import type { BrowserAuthBundle, BrowserRuntimeContext } from '../types.js';
+import { BrowserAuthVault } from './vault.js';
+import { type PortableAuthResource } from './portable.js';
+export declare class BrowserAuthService {
+    readonly browser: BrowserService;
+    readonly registry: BrowserRegistry;
+    readonly vault: BrowserAuthVault;
+    readonly now: () => Date;
+    constructor(browser: BrowserService, registry: BrowserRegistry, vault: BrowserAuthVault, now?: () => Date);
+    list(): BrowserAuthBundle[];
+    get(id: string): BrowserAuthBundle;
+    save(input: {
+        sessionId: string;
+        id?: string;
+        name: string;
+        domains?: string[];
+        context?: BrowserRuntimeContext;
+    }): Promise<BrowserAuthBundle>;
+    load(input: {
+        sessionId: string;
+        bundleId: string;
+        context?: BrowserRuntimeContext;
+    }): Promise<BrowserAuthBundle>;
+    delete(id: string): void;
+    exportEncrypted(id: string, key: Buffer | string, context?: BrowserRuntimeContext): Promise<PortableAuthResource>;
+    importEncrypted(resource: PortableAuthResource, key: Buffer | string, context?: BrowserRuntimeContext): Promise<BrowserAuthBundle>;
+}