@amalgm/core 0.3.2 → 0.4.1

package/PURPOSE.md

@@ -32,9 +32,9 @@ Core owns exactly four things:
    ports, never reached for directly.
 
 `docs/responsibilities.md` enumerates every responsibility in full and maps
-each engine module to its target repo. This repository is where the kernel's
-rules become executable and testable; the engine repo remains the production
-source until each module is cut over.
+each historical Engine module to its target repo. This repository is where the
+kernel's rules become executable and testable; Shell is the production host
+that composes an exact Core release with the other product releases.
 
 ## Axioms
 
@@ -66,10 +66,10 @@ source until each module is cut over.
 8. **Contracts are byte-exact.** Path formats, plist labels, health
    vocabularies, error strings, and version-compare rules are preserved
    verbatim from the shipped engine; parity tests pin them until cutover.
-9. **The current runtime remains the single production source until moved.**
-   This package extracts contracts and decision logic with their tests; it
-   does not create a parallel execution path. The engine adopts it module by
-   module, deleting its duplicated copy in the same change.
+9. **Shell is the single production composer.** Core defines host-independent
+   contracts and decisions; `@amalgm/shell` binds them to machine effects and
+   exact product releases. Engine is historical reference evidence only and
+   never a runtime fallback.
 10. **Amalgm's own surfaces use this SDK.** A private shortcut in the CLI,
     gateway, or runtime means the SDK is incomplete — fix the SDK, not the
     caller.
@@ -102,7 +102,7 @@ source until each module is cut over.
     compatibility surfaces cannot masquerade as unfinished product work.
 18. **Machine setup is one trust rail with two entrances.** Browser polling and
     an approved setup code converge before the same registration, credential
-    split, proxy-refresh, installation, canonical-runtime, and readiness path;
+    split, installation, canonical-runtime, and readiness path;
     service selection is a downstream installation decision and an omitted
     selector means every service in the verified release catalog.
 19. **Every managed login includes Files.** Core and Files/Live are the minimum
@@ -130,6 +130,13 @@ source until each module is cut over.
     it requires fresh user approval, proof of the candidate private key, and a
     conditional swap from the expected old thumbprint. A completed swap is safe
     to retry, and corrupt local key material remains visible until that ceremony.
+24. **Provider access never becomes durable machine state.** Registration and
+    resume persist only identity, tunnel, and machine credentials. Products get
+    short-lived, exact grants from the in-memory broker, and resume removes any
+    retired proxy or HMAC credential left by an older installation.
+25. **Build output is a projection, never accumulated state.** Every build
+    removes `dist` before compiling, and packaging runs that clean build, so a
+    deleted source file cannot survive inside a release.
 
 ## Five surfaces, one behavior
 
@@ -146,7 +153,6 @@ behavior instead of delegating to the SDK is a bug.
 
 ## Status
 
-Charter stage. Inventory of the engine's kernel territory is in
-`docs/responsibilities.md`; extraction proceeds pure-cores-first, exactly as
-`@amalgm/live` was built. The engine runtime and CLI remain the production
-source; nothing consumes this package yet.
+Active SDK. `@amalgm/shell` is the production host and exact-version composer.
+The Engine inventory remains historical migration evidence; active runtime
+work must land in Core and Shell rather than reintroducing an Engine fallback.

package/README.md

@@ -4,8 +4,8 @@ The Amalgm kernel SDK: identity, transport, and supervision contracts —
 every law a machine needs to boot the platform, prove who it is, stay
 alive, and route traffic to everything else. Start with
 [PURPOSE.md](PURPOSE.md) (the charter) and
-[docs/responsibilities.md](docs/responsibilities.md) (every duty, and the
-knife table mapping the engine monolith onto its target repos).
+[docs/responsibilities.md](docs/responsibilities.md) (historical evidence and
+the knife table mapping the Engine monolith onto its owning repositories).
 
 The evolving product contract for the top-level command, modular service
 installation, and mandatory managed updates is
@@ -28,10 +28,9 @@ node surfaces/cli/amalgm-core.mjs label canary
 ```
 
 Rules of the house: zero runtime dependencies; nothing in `src/` imports
-`node:*` or reads `process.env`; contracts are byte-exact against the
-shipped engine (the production source until cutover — PURPOSE.md axiom 9);
-tests are exams — each states a law, and a mutant must be convicted by at
-least one.
+`node:*` or reads `process.env`; every build recreates `dist` from source;
+Shell is the production host and exact-version composer; tests are exams —
+each states a law, and a mutant must be convicted by at least one.
 
 Package releases use `.github/workflows/publish-package.yml`. A reviewed main
 commit is tagged exactly `v<package version>`; trusted npm publishing stages

package/dist/identity/auth-records.d.ts

@@ -2,14 +2,14 @@
  * Credential-record shaping laws (engine packages/amalgm/lib/auth-store.js
  * and runtime/scripts/proxy-token-store.js) — how a computer record splits
  * into its PUBLIC face (`computer.json`) and its SECRET envelope
- * (`auth.json`), how the two merge back, and when a proxy token counts as
- * fresh. Pure record computations only: reading, writing, and env access
- * stay host-side; the clock arrives as a port.
+ * (`auth.json`), and how the two merge back. Pure record computations only:
+ * reading, writing, and env access stay host-side; the clock arrives as a
+ * port.
  *
  * Records are loose JSON from disk, so inputs are typed as they truly are:
  * dictionaries of unknowns, validated key by key.
  */
-import type { ClockIsoPort, ClockMsPort } from './ports.js';
+import type { ClockIsoPort } from './ports.js';
 type Dict = Record<string, unknown>;
 /** Emails compare lowercased; a record's email is stored lowercased. */
 export declare function normalizeUserEmail(value: unknown): string;
@@ -21,6 +21,8 @@ export declare function userEmailFromRecord(record: unknown): string;
  * including the legacy camelCase and hmac spellings — is the contract.
  */
 export declare const SECRET_COMPUTER_KEYS: ReadonlySet<string>;
+/** Does a secret envelope still carry the retired durable proxy credential? */
+export declare function hasRetiredProxyAuth(auth: unknown): boolean;
 /** Does this record carry any secret worth an auth envelope?
  * (auth-store.js:78-81). Whitespace-only values do not count. */
 export declare function hasComputerSecrets(record: unknown): boolean;
@@ -38,16 +40,14 @@ export declare function publicComputerRecord(record: unknown, authFile?: string)
  * (auth-store.js:94-156):
  *
  *   { schema_version: 1, computer_id, device_id, user_id, user_email,
- *     app_url, tunnel: { token, url }, machine: { token },
- *     proxy: { token, expires_in, expires_at, refreshed_at } }
+ *     app_url, tunnel: { token, url }, machine: { token } }
  *
  * Merging over `existing` is additive: identity keys are copied only when
  * the record actually carries them, each token section is (re)stamped only
  * when its token arrives, and a record carrying only tunnel URLs updates
- * the URLs while PRESERVING the existing tunnel token. `expires_in`
- * collapses to undefined (dropped by JSON) when absent or zero. Legacy
- * proxy-token spellings (proxyToken, hmac_token, hmacToken) are honored on
- * input; the envelope speaks only the canonical shape.
+ * the URLs while PRESERVING the existing tunnel token. Retired proxy-token
+ * fields are dropped from both new records and existing envelopes: provider
+ * access is short-lived broker state, never durable machine state.
  */
 export declare function authFromRecord(record: unknown, existing: unknown, ports: ClockIsoPort): Dict;
 /**
@@ -78,70 +78,5 @@ export declare function assertRecordMatchesUserScope(record: unknown, context: {
     readonly runtimeLabel: string;
     readonly userScope: string;
 }): void;
-/** Refresh proxy tokens 10 minutes before they die (auth-store.js:22,
- * proxy-token-store.js:20) — one shared buffer, so the two freshness laws
- * below can never disagree about "soon". */
-export declare const PROXY_REFRESH_BUFFER_MS: number;
-/**
- * A record's proxy token under every spelling (auth-store.js:298-306), with
- * an explicitly supplied environment override winning. Pure: the engine
- * reads `process.env.AMALGM_PROXY_TOKEN`; the host passes that value in.
- */
-export declare function proxyTokenFromRecord(record: unknown, envProxyToken?: string): string;
-/**
- * The RECORD-side freshness law (auth-store.js:308-313), asked of a flat
- * computer record: no token at all means refresh (true); a token whose
- * expiry is missing or unparseable is trusted (false) — a legacy token
- * without metadata keeps working; otherwise refresh inside the buffer.
- * Note the deliberate asymmetry with {@link proxyTokenExpiresSoon}: over
- * there, missing metadata means refresh — the envelope is expected to
- * carry it.
- */
-export declare function proxyTokenNeedsRefresh(record: unknown, ports: ClockMsPort, envProxyToken?: string): boolean;
-/**
- * The ENVELOPE-side freshness law (proxy-token-store.js:110-117), asked of
- * an auth envelope, three branches exactly: no token → false (nothing to
- * refresh ahead of); token with missing OR unparseable expiry → true (an
- * envelope is expected to know its expiry; not knowing is stale); else
- * refresh inside the buffer.
- */
-export declare function proxyTokenExpiresSoon(auth: unknown, ports: ClockMsPort): boolean;
-/** Everything a proxy-token refresh call needs, distilled from the pair. */
-export interface ProxyRefreshContext {
-    readonly machineToken: string;
-    readonly appUrl: string;
-    readonly computerId: string;
-    readonly deviceId: string;
-}
-/**
- * The refresh-credential precedence chain (proxy-token-store.js:88-98):
- * the machine token is the machine's own auth token first, the legacy flat
- * spelling second, and — last resort — the tunnel token; addresses and ids
- * prefer the record over the envelope.
- */
-export declare function proxyRefreshContext(record: unknown, auth: unknown): ProxyRefreshContext;
-/**
- * May a refresh even be attempted? (proxy-token-store.js:100-103): a
- * machine token, an app URL, and a computer id are required; the device id
- * is optional context.
- */
-export declare function canRefreshProxyToken(context: {
-    readonly record: unknown;
-    readonly auth: unknown;
-}): boolean;
-/**
- * The persisted `auth.json` after a successful proxy-token refresh
- * (proxy-token-store.js:154-173): the prior envelope carried forward,
- * identity restated from the refresh context, the server's answers winning
- * over prior values field by field, and both `proxy.refreshed_at` and
- * `updated_at` stamped now. `expires_in` collapses to undefined (dropped
- * by JSON) when absent or zero. The caller guards with
- * {@link canRefreshProxyToken}; this is only the shape law.
- */
-export declare function refreshedProxyAuth(input: {
-    readonly record: unknown;
-    readonly auth: unknown;
-    readonly refreshed: unknown;
-}, ports: ClockIsoPort): Dict;
 export {};
 //# sourceMappingURL=auth-records.d.ts.map

package/dist/identity/auth-records.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth-records.d.ts","sourceRoot":"","sources":["../../src/identity/auth-records.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAGH,OAAO,KAAK,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAE5D,KAAK,IAAI,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AASpC,wEAAwE;AACxE,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAEzD;AAED,oFAAoF;AACpF,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,OAAO,GAAG,MAAM,CAG3D;AAED;;;;GAIG;AACH,eAAO,MAAM,oBAAoB,EAAE,WAAW,CAAC,MAAM,CAWnD,CAAC;AAEH;iEACiE;AACjE,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,OAAO,GAAG,OAAO,CAI3D;AAUD;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,OAAO,EAAE,QAAQ,SAAc,GAAG,IAAI,CASlF;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,cAAc,CAC5B,MAAM,EAAE,OAAO,EACf,QAAQ,EAAE,OAAO,EACjB,KAAK,EAAE,YAAY,GAClB,IAAI,CA6DN;AAED;;;;;;;GAOG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,GAAG,IAAI,GAAG,IAAI,CAmC3E;AAED;;;;;;;GAOG;AACH,wBAAgB,2BAA2B,CAAC,MAAM,EAAE,OAAO,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAK1F;AAED;;;;;GAKG;AACH,wBAAgB,4BAA4B,CAC1C,MAAM,EAAE,OAAO,EACf,OAAO,EAAE;IAAE,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;CAAE,GACrE,IAAI,CAQN;AAED;;4CAE4C;AAC5C,eAAO,MAAM,uBAAuB,QAAiB,CAAC;AAEtD;;;;GAIG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,OAAO,EAAE,aAAa,SAAK,GAAG,MAAM,CAShF;AAED;;;;;;;;GAQG;AACH,wBAAgB,sBAAsB,CACpC,MAAM,EAAE,OAAO,EACf,KAAK,EAAE,WAAW,EAClB,aAAa,SAAK,GACjB,OAAO,CAMT;AAED;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,WAAW,GAAG,OAAO,CAQhF;AAED,4EAA4E;AAC5E,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,GAAG,mBAAmB,CAcvF;AAED;;;;GAIG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAAE;IAAE,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAA;CAAE,GAAG,OAAO,CAG3G;AAED;;;;;;;;GAQG;AACH,wBAAgB,kBAAkB,CAChC,KAAK,EAAE;IAAE,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAA;CAAE,EACxF,KAAK,EAAE,YAAY,GAClB,IAAI,CA0BN"}
+{"version":3,"file":"auth-records.d.ts","sourceRoot":"","sources":["../../src/identity/auth-records.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAGH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAE/C,KAAK,IAAI,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AASpC,wEAAwE;AACxE,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAEzD;AAED,oFAAoF;AACpF,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,OAAO,GAAG,MAAM,CAG3D;AAED;;;;GAIG;AACH,eAAO,MAAM,oBAAoB,EAAE,WAAW,CAAC,MAAM,CAWnD,CAAC;AAcH,+EAA+E;AAC/E,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,OAAO,GAAG,OAAO,CAG1D;AAED;iEACiE;AACjE,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,OAAO,GAAG,OAAO,CAI3D;AAUD;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,OAAO,EAAE,QAAQ,SAAc,GAAG,IAAI,CASlF;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,cAAc,CAC5B,MAAM,EAAE,OAAO,EACf,QAAQ,EAAE,OAAO,EACjB,KAAK,EAAE,YAAY,GAClB,IAAI,CAyCN;AAED;;;;;;;GAOG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,GAAG,IAAI,GAAG,IAAI,CAsB3E;AAED;;;;;;;GAOG;AACH,wBAAgB,2BAA2B,CAAC,MAAM,EAAE,OAAO,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAK1F;AAED;;;;;GAKG;AACH,wBAAgB,4BAA4B,CAC1C,MAAM,EAAE,OAAO,EACf,OAAO,EAAE;IAAE,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;CAAE,GACrE,IAAI,CAQN"}

package/dist/identity/auth-records.js

@@ -2,9 +2,9 @@
  * Credential-record shaping laws (engine packages/amalgm/lib/auth-store.js
  * and runtime/scripts/proxy-token-store.js) — how a computer record splits
  * into its PUBLIC face (`computer.json`) and its SECRET envelope
- * (`auth.json`), how the two merge back, and when a proxy token counts as
- * fresh. Pure record computations only: reading, writing, and env access
- * stay host-side; the clock arrives as a port.
+ * (`auth.json`), and how the two merge back. Pure record computations only:
+ * reading, writing, and env access stay host-side; the clock arrives as a
+ * port.
  *
  * Records are loose JSON from disk, so inputs are typed as they truly are:
  * dictionaries of unknowns, validated key by key.
@@ -40,6 +40,22 @@ export const SECRET_COMPUTER_KEYS = new Set([
     'hmac_token',
     'hmacToken',
 ]);
+const RETIRED_PROXY_AUTH_KEYS = [
+    'proxy',
+    'proxy_token',
+    'proxy_token_expires_in',
+    'proxy_token_expires_at',
+    'proxy_token_refreshed_at',
+    'proxyToken',
+    'proxyTokenExpiresAt',
+    'hmac_token',
+    'hmacToken',
+];
+/** Does a secret envelope still carry the retired durable proxy credential? */
+export function hasRetiredProxyAuth(auth) {
+    const record = asDict(auth);
+    return !!record && RETIRED_PROXY_AUTH_KEYS.some((key) => key in record);
+}
 /** Does this record carry any secret worth an auth envelope?
  * (auth-store.js:78-81). Whitespace-only values do not count. */
 export function hasComputerSecrets(record) {
@@ -80,16 +96,14 @@ export function publicComputerRecord(record, authFile = 'auth.json') {
  * (auth-store.js:94-156):
  *
  *   { schema_version: 1, computer_id, device_id, user_id, user_email,
- *     app_url, tunnel: { token, url }, machine: { token },
- *     proxy: { token, expires_in, expires_at, refreshed_at } }
+ *     app_url, tunnel: { token, url }, machine: { token } }
  *
  * Merging over `existing` is additive: identity keys are copied only when
  * the record actually carries them, each token section is (re)stamped only
  * when its token arrives, and a record carrying only tunnel URLs updates
- * the URLs while PRESERVING the existing tunnel token. `expires_in`
- * collapses to undefined (dropped by JSON) when absent or zero. Legacy
- * proxy-token spellings (proxyToken, hmac_token, hmacToken) are honored on
- * input; the envelope speaks only the canonical shape.
+ * the URLs while PRESERVING the existing tunnel token. Retired proxy-token
+ * fields are dropped from both new records and existing envelopes: provider
+ * access is short-lived broker state, never durable machine state.
  */
 export function authFromRecord(record, existing, ports) {
     const now = ports.nowIso();
@@ -99,6 +113,8 @@ export function authFromRecord(record, existing, ports) {
         ...(asDict(existing) || {}),
         updated_at: now,
     };
+    for (const key of RETIRED_PROXY_AUTH_KEYS)
+        delete auth[key];
     for (const key of ['computer_id', 'device_id', 'user_id', 'user_email', 'app_url']) {
         const value = key === 'user_email' ? userEmailFromRecord(r) : cleanString(r?.[key]);
         if (value)
@@ -128,24 +144,6 @@ export function authFromRecord(record, existing, ports) {
             updated_at: now,
         };
     }
-    const proxyToken = (cleanString(r?.['proxy_token'])
-        || cleanString(r?.['proxyToken'])
-        || cleanString(r?.['hmac_token'])
-        || cleanString(r?.['hmacToken']));
-    if (proxyToken) {
-        const priorProxy = asDict(auth['proxy']);
-        auth['proxy'] = {
-            ...(priorProxy || {}),
-            token: proxyToken,
-            expires_in: Number(r?.['proxy_token_expires_in'] || priorProxy?.['expires_in'] || 0) || undefined,
-            expires_at: cleanString(r?.['proxy_token_expires_at'])
-                || cleanString(r?.['proxyTokenExpiresAt'])
-                || cleanString(priorProxy?.['expires_at']),
-            refreshed_at: cleanString(r?.['proxy_token_refreshed_at'])
-                || cleanString(priorProxy?.['refreshed_at'])
-                || now,
-        };
-    }
     return auth;
 }
 /**
@@ -170,7 +168,6 @@ export function mergeRecordAuth(record, auth) {
         return merged;
     const tunnel = asDict(a['tunnel']);
     const machine = asDict(a['machine']);
-    const proxy = asDict(a['proxy']);
     if (!merged['tunnel_token'])
         merged['tunnel_token'] = cleanString(tunnel?.['token']) || cleanString(a['tunnel_token']);
     if (!merged['tunnel_url'])
@@ -178,18 +175,6 @@ export function mergeRecordAuth(record, auth) {
     if (!merged['computer_auth_token']) {
         merged['computer_auth_token'] = cleanString(machine?.['token']) || cleanString(a['computer_auth_token']);
     }
-    if (!merged['proxy_token']) {
-        merged['proxy_token'] = cleanString(proxy?.['token']) || cleanString(a['proxy_token']);
-    }
-    if (!merged['proxy_token_expires_at']) {
-        merged['proxy_token_expires_at'] = cleanString(proxy?.['expires_at']) || cleanString(a['proxy_token_expires_at']);
-    }
-    if (!merged['proxy_token_expires_in'] && proxy?.['expires_in']) {
-        merged['proxy_token_expires_in'] = proxy['expires_in'];
-    }
-    if (!merged['proxy_token_refreshed_at']) {
-        merged['proxy_token_refreshed_at'] = cleanString(proxy?.['refreshed_at']);
-    }
     if (!merged['user_id'])
         merged['user_id'] = cleanString(a['user_id']);
     if (!merged['user_email'])
@@ -228,123 +213,4 @@ export function assertRecordMatchesUserScope(record, context) {
         return;
     throw new Error(`Refusing to save ${context.runtimeLabel} computer credentials for user ${userId} in scope ${expectedScope}.`);
 }
-/** Refresh proxy tokens 10 minutes before they die (auth-store.js:22,
- * proxy-token-store.js:20) — one shared buffer, so the two freshness laws
- * below can never disagree about "soon". */
-export const PROXY_REFRESH_BUFFER_MS = 10 * 60 * 1000;
-/**
- * A record's proxy token under every spelling (auth-store.js:298-306), with
- * an explicitly supplied environment override winning. Pure: the engine
- * reads `process.env.AMALGM_PROXY_TOKEN`; the host passes that value in.
- */
-export function proxyTokenFromRecord(record, envProxyToken = '') {
-    const r = asDict(record);
-    return (cleanString(envProxyToken)
-        || cleanString(r?.['proxy_token'])
-        || cleanString(r?.['proxyToken'])
-        || cleanString(r?.['hmac_token'])
-        || cleanString(r?.['hmacToken']));
-}
-/**
- * The RECORD-side freshness law (auth-store.js:308-313), asked of a flat
- * computer record: no token at all means refresh (true); a token whose
- * expiry is missing or unparseable is trusted (false) — a legacy token
- * without metadata keeps working; otherwise refresh inside the buffer.
- * Note the deliberate asymmetry with {@link proxyTokenExpiresSoon}: over
- * there, missing metadata means refresh — the envelope is expected to
- * carry it.
- */
-export function proxyTokenNeedsRefresh(record, ports, envProxyToken = '') {
-    if (!proxyTokenFromRecord(record, envProxyToken))
-        return true;
-    const r = asDict(record);
-    const expiresAt = Date.parse(String(r?.['proxy_token_expires_at'] || r?.['proxyTokenExpiresAt'] || ''));
-    if (!Number.isFinite(expiresAt))
-        return false;
-    return expiresAt - ports.nowMs() < PROXY_REFRESH_BUFFER_MS;
-}
-/**
- * The ENVELOPE-side freshness law (proxy-token-store.js:110-117), asked of
- * an auth envelope, three branches exactly: no token → false (nothing to
- * refresh ahead of); token with missing OR unparseable expiry → true (an
- * envelope is expected to know its expiry; not knowing is stale); else
- * refresh inside the buffer.
- */
-export function proxyTokenExpiresSoon(auth, ports) {
-    const proxy = asDict(asDict(auth)?.['proxy']);
-    if (!cleanString(proxy?.['token']))
-        return false;
-    const expiresAtRaw = cleanString(proxy?.['expires_at']);
-    if (!expiresAtRaw)
-        return true;
-    const expiresAt = Date.parse(expiresAtRaw);
-    if (!Number.isFinite(expiresAt))
-        return true;
-    return expiresAt - ports.nowMs() < PROXY_REFRESH_BUFFER_MS;
-}
-/**
- * The refresh-credential precedence chain (proxy-token-store.js:88-98):
- * the machine token is the machine's own auth token first, the legacy flat
- * spelling second, and — last resort — the tunnel token; addresses and ids
- * prefer the record over the envelope.
- */
-export function proxyRefreshContext(record, auth) {
-    const r = asDict(record);
-    const a = asDict(auth);
-    const machine = asDict(a?.['machine']);
-    const tunnel = asDict(a?.['tunnel']);
-    return {
-        machineToken: cleanString(machine?.['token'])
-            || cleanString(a?.['computer_auth_token'])
-            || cleanString(tunnel?.['token']),
-        appUrl: cleanString(r?.['app_url']) || cleanString(a?.['app_url']),
-        computerId: cleanString(r?.['computer_id']) || cleanString(a?.['computer_id']),
-        deviceId: cleanString(r?.['device_id']) || cleanString(a?.['device_id']),
-    };
-}
-/**
- * May a refresh even be attempted? (proxy-token-store.js:100-103): a
- * machine token, an app URL, and a computer id are required; the device id
- * is optional context.
- */
-export function canRefreshProxyToken(context) {
-    const refresh = proxyRefreshContext(context.record, context.auth);
-    return !!(refresh.machineToken && refresh.appUrl && refresh.computerId);
-}
-/**
- * The persisted `auth.json` after a successful proxy-token refresh
- * (proxy-token-store.js:154-173): the prior envelope carried forward,
- * identity restated from the refresh context, the server's answers winning
- * over prior values field by field, and both `proxy.refreshed_at` and
- * `updated_at` stamped now. `expires_in` collapses to undefined (dropped
- * by JSON) when absent or zero. The caller guards with
- * {@link canRefreshProxyToken}; this is only the shape law.
- */
-export function refreshedProxyAuth(input, ports) {
-    const { appUrl, computerId, deviceId } = proxyRefreshContext(input.record, input.auth);
-    const r = asDict(input.record);
-    const a = asDict(input.auth) || {};
-    const refreshed = asDict(input.refreshed);
-    const priorProxy = asDict(a['proxy']);
-    const now = ports.nowIso();
-    return {
-        ...a,
-        schema_version: 1,
-        computer_id: computerId,
-        device_id: deviceId,
-        user_id: cleanString(r?.['user_id']) || cleanString(a['user_id']),
-        user_email: cleanString(refreshed?.['user_email']).toLowerCase()
-            || cleanString(r?.['user_email']).toLowerCase()
-            || cleanString(a['user_email']).toLowerCase(),
-        app_url: appUrl,
-        proxy: {
-            ...(priorProxy || {}),
-            token: cleanString(refreshed?.['proxy_token']) || cleanString(priorProxy?.['token']),
-            expires_in: Number(refreshed?.['proxy_token_expires_in'] || priorProxy?.['expires_in'] || 0) || undefined,
-            expires_at: cleanString(refreshed?.['proxy_token_expires_at']) || cleanString(priorProxy?.['expires_at']),
-            refreshed_at: now,
-        },
-        updated_at: now,
-    };
-}
 //# sourceMappingURL=auth-records.js.map

package/dist/identity/auth-records.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth-records.js","sourceRoot":"","sources":["../../src/identity/auth-records.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AAKpD,MAAM,MAAM,GAAG,CAAC,KAAc,EAAe,EAAE,CAC7C,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAE,KAAc,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;AAEhE,SAAS,WAAW,CAAC,KAAc;IACjC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;AACvE,CAAC;AAED,wEAAwE;AACxE,MAAM,UAAU,kBAAkB,CAAC,KAAc;IAC/C,OAAO,WAAW,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC;AAC1C,CAAC;AAED,oFAAoF;AACpF,MAAM,UAAU,mBAAmB,CAAC,MAAe;IACjD,MAAM,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC;IACzB,OAAO,kBAAkB,CAAC,CAAC,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;AACnF,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAwB,IAAI,GAAG,CAAC;IAC/D,cAAc;IACd,qBAAqB;IACrB,aAAa;IACb,wBAAwB;IACxB,wBAAwB;IACxB,0BAA0B;IAC1B,YAAY;IACZ,qBAAqB;IACrB,YAAY;IACZ,WAAW;CACZ,CAAC,CAAC;AAEH;iEACiE;AACjE,MAAM,UAAU,kBAAkB,CAAC,MAAe;IAChD,MAAM,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC;IACzB,IAAI,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IACrB,OAAO,KAAK,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;AAC7E,CAAC;AAED;kEACkE;AAClE,MAAM,QAAQ,GAAG,CAAC,IAAY,EAAU,EAAE;IACxC,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;IAC5C,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,WAAW,CAAC,GAAG,CAAC,EAAE,OAAO,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC;IAC1E,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC;AACvD,CAAC,CAAC;AAEF;;;;;;;GAOG;AACH,MAAM,UAAU,oBAAoB,CAAC,MAAe,EAAE,QAAQ,GAAG,WAAW;IAC1E,MAAM,GAAG,GAAS;QAChB,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;QACzB,SAAS,EAAE,QAAQ,CAAC,QAAQ,CAAC;KAC9B,CAAC;IACF,MAAM,KAAK,GAAG,mBAAmB,CAAC,GAAG,CAAC,CAAC;IACvC,IAAI,KAAK;QAAE,GAAG,CAAC,YAAY,CAAC,GAAG,KAAK,CAAC;IACrC,KAAK,MAAM,GAAG,IAAI,oBAAoB;QAAE,OAAO,GAAG,CAAC,GAAG,CAAC,CAAC;IACxD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,cAAc,CAC5B,MAAe,EACf,QAAiB,EACjB,KAAmB;IAEnB,MAAM,GAAG,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC;IAC3B,MAAM,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC;IACzB,MAAM,IAAI,GAAS;QACjB,cAAc,EAAE,CAAC;QACjB,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;QAC3B,UAAU,EAAE,GAAG;KAChB,CAAC;IAEF,KAAK,MAAM,GAAG,IAAI,CAAC,aAAa,EAAE,WAAW,EAAE,SAAS,EAAE,YAAY,EAAE,SAAS,CAAU,EAAE,CAAC;QAC5F,MAAM,KAAK,GAAG,GAAG,KAAK,YAAY,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QACpF,IAAI,KAAK;YAAE,IAAI,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;IAC/B,CAAC;IAED,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC3C,MAAM,WAAW,GAAG,WAAW,CAAC,CAAC,EAAE,CAAC,cAAc,CAAC,CAAC,CAAC;IACrD,IAAI,WAAW,EAAE,CAAC;QAChB,IAAI,CAAC,QAAQ,CAAC,GAAG;YACf,GAAG,CAAC,WAAW,IAAI,EAAE,CAAC;YACtB,KAAK,EAAE,WAAW;YAClB,GAAG,EAAE,WAAW,CAAC,CAAC,EAAE,CAAC,YAAY,CAAC,CAAC,IAAI,WAAW,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,CAAC;YACxE,UAAU,EAAE,GAAG;SAChB,CAAC;IACJ,CAAC;SAAM,IAAI,CAAC,EAAE,CAAC,YAAY,CAAC,EAAE,CAAC;QAC7B,IAAI,CAAC,QAAQ,CAAC,GAAG;YACf,GAAG,CAAC,WAAW,IAAI,EAAE,CAAC;YACtB,GAAG,EAAE,WAAW,CAAC,CAAC,EAAE,CAAC,YAAY,CAAC,CAAC,IAAI,WAAW,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,CAAC;SACzE,CAAC;IACJ,CAAC;IAED,MAAM,iBAAiB,GAAG,WAAW,CAAC,CAAC,EAAE,CAAC,qBAAqB,CAAC,CAAC,CAAC;IAClE,IAAI,iBAAiB,EAAE,CAAC;QACtB,IAAI,CAAC,SAAS,CAAC,GAAG;YAChB,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,IAAI,EAAE,CAAC;YAClC,KAAK,EAAE,iBAAiB;YACxB,UAAU,EAAE,GAAG;SAChB,CAAC;IACJ,CAAC;IAED,MAAM,UAAU,GAAG,CACjB,WAAW,CAAC,CAAC,EAAE,CAAC,aAAa,CAAC,CAAC;WAC5B,WAAW,CAAC,CAAC,EAAE,CAAC,YAAY,CAAC,CAAC;WAC9B,WAAW,CAAC,CAAC,EAAE,CAAC,YAAY,CAAC,CAAC;WAC9B,WAAW,CAAC,CAAC,EAAE,CAAC,WAAW,CAAC,CAAC,CACjC,CAAC;IACF,IAAI,UAAU,EAAE,CAAC;QACf,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;QACzC,IAAI,CAAC,OAAO,CAAC,GAAG;YACd,GAAG,CAAC,UAAU,IAAI,EAAE,CAAC;YACrB,KAAK,EAAE,UAAU;YACjB,UAAU,EAAE,MAAM,CAAC,CAAC,EAAE,CAAC,wBAAwB,CAAC,IAAI,UAAU,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,IAAI,SAAS;YACjG,UAAU,EAAE,WAAW,CAAC,CAAC,EAAE,CAAC,wBAAwB,CAAC,CAAC;mBACjD,WAAW,CAAC,CAAC,EAAE,CAAC,qBAAqB,CAAC,CAAC;mBACvC,WAAW,CAAC,UAAU,EAAE,CAAC,YAAY,CAAC,CAAC;YAC5C,YAAY,EAAE,WAAW,CAAC,CAAC,EAAE,CAAC,0BAA0B,CAAC,CAAC;mBACrD,WAAW,CAAC,UAAU,EAAE,CAAC,cAAc,CAAC,CAAC;mBACzC,GAAG;SACT,CAAC;IACJ,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,eAAe,CAAC,MAAe,EAAE,IAAa;IAC5D,MAAM,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC;IACzB,IAAI,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACpB,MAAM,MAAM,GAAS,EAAE,GAAG,CAAC,EAAE,CAAC;IAC9B,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;IACvB,IAAI,CAAC,CAAC;QAAE,OAAO,MAAM,CAAC;IAEtB,MAAM,cAAc,GAAG,WAAW,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC;IACrD,MAAM,gBAAgB,GAAG,WAAW,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC;IACvD,IAAI,cAAc,IAAI,gBAAgB,IAAI,cAAc,KAAK,gBAAgB;QAAE,OAAO,MAAM,CAAC;IAE7F,MAAM,MAAM,GAAG,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;IACnC,MAAM,OAAO,GAAG,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC;IACrC,MAAM,KAAK,GAAG,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IACjC,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC;QAAE,MAAM,CAAC,cAAc,CAAC,GAAG,WAAW,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,CAAC,IAAI,WAAW,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC;IACvH,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC;QAAE,MAAM,CAAC,YAAY,CAAC,GAAG,WAAW,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC;IAC/E,IAAI,CAAC,MAAM,CAAC,qBAAqB,CAAC,EAAE,CAAC;QACnC,MAAM,CAAC,qBAAqB,CAAC,GAAG,WAAW,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,CAAC,IAAI,WAAW,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC;IAC3G,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,EAAE,CAAC;QAC3B,MAAM,CAAC,aAAa,CAAC,GAAG,WAAW,CAAC,KAAK,EAAE,CAAC,OAAO,CAAC,CAAC,IAAI,WAAW,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC;IACzF,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,wBAAwB,CAAC,EAAE,CAAC;QACtC,MAAM,CAAC,wBAAwB,CAAC,GAAG,WAAW,CAAC,KAAK,EAAE,CAAC,YAAY,CAAC,CAAC,IAAI,WAAW,CAAC,CAAC,CAAC,wBAAwB,CAAC,CAAC,CAAC;IACpH,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,wBAAwB,CAAC,IAAI,KAAK,EAAE,CAAC,YAAY,CAAC,EAAE,CAAC;QAC/D,MAAM,CAAC,wBAAwB,CAAC,GAAG,KAAK,CAAC,YAAY,CAAC,CAAC;IACzD,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,0BAA0B,CAAC,EAAE,CAAC;QACxC,MAAM,CAAC,0BAA0B,CAAC,GAAG,WAAW,CAAC,KAAK,EAAE,CAAC,cAAc,CAAC,CAAC,CAAC;IAC5E,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC;QAAE,MAAM,CAAC,SAAS,CAAC,GAAG,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC;IACtE,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC;QAAE,MAAM,CAAC,YAAY,CAAC,GAAG,kBAAkB,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC;IACtF,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC;QAAE,MAAM,CAAC,SAAS,CAAC,GAAG,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC;IACtE,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,2BAA2B,CAAC,MAAe,EAAE,YAAoB;IAC/E,MAAM,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC;IACzB,MAAM,KAAK,GAAG,qBAAqB,CAAC,CAAC,EAAE,CAAC,eAAe,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC3F,IAAI,CAAC,KAAK;QAAE,OAAO,YAAY,KAAK,MAAM,CAAC;IAC3C,OAAO,KAAK,KAAK,YAAY,CAAC;AAChC,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,4BAA4B,CAC1C,MAAe,EACf,OAAsE;IAEtE,MAAM,MAAM,GAAG,WAAW,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC;IACxD,MAAM,aAAa,GAAG,WAAW,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IACrD,IAAI,CAAC,MAAM,IAAI,CAAC,aAAa,IAAI,aAAa,KAAK,OAAO;QAAE,OAAO;IACnE,IAAI,MAAM,KAAK,aAAa;QAAE,OAAO;IACrC,MAAM,IAAI,KAAK,CACb,oBAAoB,OAAO,CAAC,YAAY,kCAAkC,MAAM,aAAa,aAAa,GAAG,CAC9G,CAAC;AACJ,CAAC;AAED;;4CAE4C;AAC5C,MAAM,CAAC,MAAM,uBAAuB,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAEtD;;;;GAIG;AACH,MAAM,UAAU,oBAAoB,CAAC,MAAe,EAAE,aAAa,GAAG,EAAE;IACtE,MAAM,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC;IACzB,OAAO,CACL,WAAW,CAAC,aAAa,CAAC;WACvB,WAAW,CAAC,CAAC,EAAE,CAAC,aAAa,CAAC,CAAC;WAC/B,WAAW,CAAC,CAAC,EAAE,CAAC,YAAY,CAAC,CAAC;WAC9B,WAAW,CAAC,CAAC,EAAE,CAAC,YAAY,CAAC,CAAC;WAC9B,WAAW,CAAC,CAAC,EAAE,CAAC,WAAW,CAAC,CAAC,CACjC,CAAC;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,sBAAsB,CACpC,MAAe,EACf,KAAkB,EAClB,aAAa,GAAG,EAAE;IAElB,IAAI,CAAC,oBAAoB,CAAC,MAAM,EAAE,aAAa,CAAC;QAAE,OAAO,IAAI,CAAC;IAC9D,MAAM,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC;IACzB,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,wBAAwB,CAAC,IAAI,CAAC,EAAE,CAAC,qBAAqB,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IACxG,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC;QAAE,OAAO,KAAK,CAAC;IAC9C,OAAO,SAAS,GAAG,KAAK,CAAC,KAAK,EAAE,GAAG,uBAAuB,CAAC;AAC7D,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,qBAAqB,CAAC,IAAa,EAAE,KAAkB;IACrE,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;IAC9C,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,CAAC,OAAO,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IACjD,MAAM,YAAY,GAAG,WAAW,CAAC,KAAK,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC;IACxD,IAAI,CAAC,YAAY;QAAE,OAAO,IAAI,CAAC;IAC/B,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IAC3C,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC;QAAE,OAAO,IAAI,CAAC;IAC7C,OAAO,SAAS,GAAG,KAAK,CAAC,KAAK,EAAE,GAAG,uBAAuB,CAAC;AAC7D,CAAC;AAUD;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CAAC,MAAe,EAAE,IAAa;IAChE,MAAM,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC;IACzB,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;IACvB,MAAM,OAAO,GAAG,MAAM,CAAC,CAAC,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC;IACvC,MAAM,MAAM,GAAG,MAAM,CAAC,CAAC,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC;IACrC,OAAO;QACL,YAAY,EACV,WAAW,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,CAAC;eAC5B,WAAW,CAAC,CAAC,EAAE,CAAC,qBAAqB,CAAC,CAAC;eACvC,WAAW,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,CAAC;QACnC,MAAM,EAAE,WAAW,CAAC,CAAC,EAAE,CAAC,SAAS,CAAC,CAAC,IAAI,WAAW,CAAC,CAAC,EAAE,CAAC,SAAS,CAAC,CAAC;QAClE,UAAU,EAAE,WAAW,CAAC,CAAC,EAAE,CAAC,aAAa,CAAC,CAAC,IAAI,WAAW,CAAC,CAAC,EAAE,CAAC,aAAa,CAAC,CAAC;QAC9E,QAAQ,EAAE,WAAW,CAAC,CAAC,EAAE,CAAC,WAAW,CAAC,CAAC,IAAI,WAAW,CAAC,CAAC,EAAE,CAAC,WAAW,CAAC,CAAC;KACzE,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,oBAAoB,CAAC,OAA6D;IAChG,MAAM,OAAO,GAAG,mBAAmB,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;IAClE,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,YAAY,IAAI,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,UAAU,CAAC,CAAC;AAC1E,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,kBAAkB,CAChC,KAAwF,EACxF,KAAmB;IAEnB,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,GAAG,mBAAmB,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;IACvF,MAAM,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAC/B,MAAM,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;IACnC,MAAM,SAAS,GAAG,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IAC1C,MAAM,UAAU,GAAG,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IACtC,MAAM,GAAG,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC;IAC3B,OAAO;QACL,GAAG,CAAC;QACJ,cAAc,EAAE,CAAC;QACjB,WAAW,EAAE,UAAU;QACvB,SAAS,EAAE,QAAQ;QACnB,OAAO,EAAE,WAAW,CAAC,CAAC,EAAE,CAAC,SAAS,CAAC,CAAC,IAAI,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QACjE,UAAU,EAAE,WAAW,CAAC,SAAS,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC,WAAW,EAAE;eAC3D,WAAW,CAAC,CAAC,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC,WAAW,EAAE;eAC5C,WAAW,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,WAAW,EAAE;QAC/C,OAAO,EAAE,MAAM;QACf,KAAK,EAAE;YACL,GAAG,CAAC,UAAU,IAAI,EAAE,CAAC;YACrB,KAAK,EAAE,WAAW,CAAC,SAAS,EAAE,CAAC,aAAa,CAAC,CAAC,IAAI,WAAW,CAAC,UAAU,EAAE,CAAC,OAAO,CAAC,CAAC;YACpF,UAAU,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC,wBAAwB,CAAC,IAAI,UAAU,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,IAAI,SAAS;YACzG,UAAU,EAAE,WAAW,CAAC,SAAS,EAAE,CAAC,wBAAwB,CAAC,CAAC,IAAI,WAAW,CAAC,UAAU,EAAE,CAAC,YAAY,CAAC,CAAC;YACzG,YAAY,EAAE,GAAG;SAClB;QACD,UAAU,EAAE,GAAG;KAChB,CAAC;AACJ,CAAC"}
+{"version":3,"file":"auth-records.js","sourceRoot":"","sources":["../../src/identity/auth-records.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AAKpD,MAAM,MAAM,GAAG,CAAC,KAAc,EAAe,EAAE,CAC7C,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAE,KAAc,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;AAEhE,SAAS,WAAW,CAAC,KAAc;IACjC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;AACvE,CAAC;AAED,wEAAwE;AACxE,MAAM,UAAU,kBAAkB,CAAC,KAAc;IAC/C,OAAO,WAAW,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC;AAC1C,CAAC;AAED,oFAAoF;AACpF,MAAM,UAAU,mBAAmB,CAAC,MAAe;IACjD,MAAM,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC;IACzB,OAAO,kBAAkB,CAAC,CAAC,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;AACnF,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAwB,IAAI,GAAG,CAAC;IAC/D,cAAc;IACd,qBAAqB;IACrB,aAAa;IACb,wBAAwB;IACxB,wBAAwB;IACxB,0BAA0B;IAC1B,YAAY;IACZ,qBAAqB;IACrB,YAAY;IACZ,WAAW;CACZ,CAAC,CAAC;AAEH,MAAM,uBAAuB,GAAG;IAC9B,OAAO;IACP,aAAa;IACb,wBAAwB;IACxB,wBAAwB;IACxB,0BAA0B;IAC1B,YAAY;IACZ,qBAAqB;IACrB,YAAY;IACZ,WAAW;CACH,CAAC;AAEX,+EAA+E;AAC/E,MAAM,UAAU,mBAAmB,CAAC,IAAa;IAC/C,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;IAC5B,OAAO,CAAC,CAAC,MAAM,IAAI,uBAAuB,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,IAAI,MAAM,CAAC,CAAC;AAC1E,CAAC;AAED;iEACiE;AACjE,MAAM,UAAU,kBAAkB,CAAC,MAAe;IAChD,MAAM,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC;IACzB,IAAI,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IACrB,OAAO,KAAK,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;AAC7E,CAAC;AAED;kEACkE;AAClE,MAAM,QAAQ,GAAG,CAAC,IAAY,EAAU,EAAE;IACxC,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;IAC5C,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,WAAW,CAAC,GAAG,CAAC,EAAE,OAAO,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC;IAC1E,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC;AACvD,CAAC,CAAC;AAEF;;;;;;;GAOG;AACH,MAAM,UAAU,oBAAoB,CAAC,MAAe,EAAE,QAAQ,GAAG,WAAW;IAC1E,MAAM,GAAG,GAAS;QAChB,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;QACzB,SAAS,EAAE,QAAQ,CAAC,QAAQ,CAAC;KAC9B,CAAC;IACF,MAAM,KAAK,GAAG,mBAAmB,CAAC,GAAG,CAAC,CAAC;IACvC,IAAI,KAAK;QAAE,GAAG,CAAC,YAAY,CAAC,GAAG,KAAK,CAAC;IACrC,KAAK,MAAM,GAAG,IAAI,oBAAoB;QAAE,OAAO,GAAG,CAAC,GAAG,CAAC,CAAC;IACxD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,cAAc,CAC5B,MAAe,EACf,QAAiB,EACjB,KAAmB;IAEnB,MAAM,GAAG,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC;IAC3B,MAAM,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC;IACzB,MAAM,IAAI,GAAS;QACjB,cAAc,EAAE,CAAC;QACjB,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;QAC3B,UAAU,EAAE,GAAG;KAChB,CAAC;IACF,KAAK,MAAM,GAAG,IAAI,uBAAuB;QAAE,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC;IAE5D,KAAK,MAAM,GAAG,IAAI,CAAC,aAAa,EAAE,WAAW,EAAE,SAAS,EAAE,YAAY,EAAE,SAAS,CAAU,EAAE,CAAC;QAC5F,MAAM,KAAK,GAAG,GAAG,KAAK,YAAY,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QACpF,IAAI,KAAK;YAAE,IAAI,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;IAC/B,CAAC;IAED,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC3C,MAAM,WAAW,GAAG,WAAW,CAAC,CAAC,EAAE,CAAC,cAAc,CAAC,CAAC,CAAC;IACrD,IAAI,WAAW,EAAE,CAAC;QAChB,IAAI,CAAC,QAAQ,CAAC,GAAG;YACf,GAAG,CAAC,WAAW,IAAI,EAAE,CAAC;YACtB,KAAK,EAAE,WAAW;YAClB,GAAG,EAAE,WAAW,CAAC,CAAC,EAAE,CAAC,YAAY,CAAC,CAAC,IAAI,WAAW,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,CAAC;YACxE,UAAU,EAAE,GAAG;SAChB,CAAC;IACJ,CAAC;SAAM,IAAI,CAAC,EAAE,CAAC,YAAY,CAAC,EAAE,CAAC;QAC7B,IAAI,CAAC,QAAQ,CAAC,GAAG;YACf,GAAG,CAAC,WAAW,IAAI,EAAE,CAAC;YACtB,GAAG,EAAE,WAAW,CAAC,CAAC,EAAE,CAAC,YAAY,CAAC,CAAC,IAAI,WAAW,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,CAAC;SACzE,CAAC;IACJ,CAAC;IAED,MAAM,iBAAiB,GAAG,WAAW,CAAC,CAAC,EAAE,CAAC,qBAAqB,CAAC,CAAC,CAAC;IAClE,IAAI,iBAAiB,EAAE,CAAC;QACtB,IAAI,CAAC,SAAS,CAAC,GAAG;YAChB,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,IAAI,EAAE,CAAC;YAClC,KAAK,EAAE,iBAAiB;YACxB,UAAU,EAAE,GAAG;SAChB,CAAC;IACJ,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,eAAe,CAAC,MAAe,EAAE,IAAa;IAC5D,MAAM,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC;IACzB,IAAI,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACpB,MAAM,MAAM,GAAS,EAAE,GAAG,CAAC,EAAE,CAAC;IAC9B,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;IACvB,IAAI,CAAC,CAAC;QAAE,OAAO,MAAM,CAAC;IAEtB,MAAM,cAAc,GAAG,WAAW,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC;IACrD,MAAM,gBAAgB,GAAG,WAAW,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC;IACvD,IAAI,cAAc,IAAI,gBAAgB,IAAI,cAAc,KAAK,gBAAgB;QAAE,OAAO,MAAM,CAAC;IAE7F,MAAM,MAAM,GAAG,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;IACnC,MAAM,OAAO,GAAG,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC;IACrC,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC;QAAE,MAAM,CAAC,cAAc,CAAC,GAAG,WAAW,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,CAAC,IAAI,WAAW,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC;IACvH,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC;QAAE,MAAM,CAAC,YAAY,CAAC,GAAG,WAAW,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC;IAC/E,IAAI,CAAC,MAAM,CAAC,qBAAqB,CAAC,EAAE,CAAC;QACnC,MAAM,CAAC,qBAAqB,CAAC,GAAG,WAAW,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,CAAC,IAAI,WAAW,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC;IAC3G,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC;QAAE,MAAM,CAAC,SAAS,CAAC,GAAG,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC;IACtE,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC;QAAE,MAAM,CAAC,YAAY,CAAC,GAAG,kBAAkB,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC;IACtF,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC;QAAE,MAAM,CAAC,SAAS,CAAC,GAAG,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC;IACtE,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,2BAA2B,CAAC,MAAe,EAAE,YAAoB;IAC/E,MAAM,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC;IACzB,MAAM,KAAK,GAAG,qBAAqB,CAAC,CAAC,EAAE,CAAC,eAAe,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC3F,IAAI,CAAC,KAAK;QAAE,OAAO,YAAY,KAAK,MAAM,CAAC;IAC3C,OAAO,KAAK,KAAK,YAAY,CAAC;AAChC,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,4BAA4B,CAC1C,MAAe,EACf,OAAsE;IAEtE,MAAM,MAAM,GAAG,WAAW,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC;IACxD,MAAM,aAAa,GAAG,WAAW,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IACrD,IAAI,CAAC,MAAM,IAAI,CAAC,aAAa,IAAI,aAAa,KAAK,OAAO;QAAE,OAAO;IACnE,IAAI,MAAM,KAAK,aAAa;QAAE,OAAO;IACrC,MAAM,IAAI,KAAK,CACb,oBAAoB,OAAO,CAAC,YAAY,kCAAkC,MAAM,aAAa,aAAa,GAAG,CAC9G,CAAC;AACJ,CAAC"}

package/dist/identity/local/api.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"api.d.ts","sourceRoot":"","sources":["../../../src/identity/local/api.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AAE3E,wBAAgB,cAAc,CAAC,OAAO,EAAE;IACtC,QAAQ,CAAC,SAAS,EAAE,kBAAkB,CAAC;IACvC,QAAQ,CAAC,WAAW,EAAE,oBAAoB,CAAC;CAC5C,GAAG,CAAC,OAAO,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,CAmC1C"}
+{"version":3,"file":"api.d.ts","sourceRoot":"","sources":["../../../src/identity/local/api.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AAE3E,wBAAgB,cAAc,CAAC,OAAO,EAAE;IACtC,QAAQ,CAAC,SAAS,EAAE,kBAAkB,CAAC;IACvC,QAAQ,CAAC,WAAW,EAAE,oBAAoB,CAAC;CAC5C,GAAG,CAAC,OAAO,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,CAuB1C"}

package/dist/identity/local/api.js

@@ -1,5 +1,4 @@
 import { discoverLocalHarnesses } from './discovery.js';
-import { resolveLocalAgentEnv } from './resolve.js';
 export function createLocalApi(options) {
     return async (request) => {
         const url = new URL(request.url);
@@ -21,13 +20,6 @@ export function createLocalApi(options) {
                 agents: discoverLocalHarnesses(options.discovery),
             });
         }
-        if (request.method === 'POST' && url.pathname === '/local/credentials/resolve') {
-            const body = await request.json();
-            if (typeof body.agentId !== 'string' || typeof body.authMode !== 'string') {
-                return json(400, { error: 'agentId and authMode are required' });
-            }
-            return json(200, { env: resolveLocalAgentEnv(body.agentId, body.authMode, typeof body.proxyToken === 'string' ? body.proxyToken : undefined, typeof body.proxyBaseUrl === 'string' ? body.proxyBaseUrl : undefined) });
-        }
         return json(404, { error: 'not found' });
     };
 }

package/dist/identity/local/api.js.map

@@ -1 +1 @@
-{"version":3,"file":"api.js","sourceRoot":"","sources":["../../../src/identity/local/api.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,sBAAsB,EAAE,MAAM,gBAAgB,CAAC;AACxD,OAAO,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAC;AAGpD,MAAM,UAAU,cAAc,CAAC,OAG9B;IACC,OAAO,KAAK,EAAE,OAAO,EAAE,EAAE;QACvB,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACjC,IAAI,OAAO,CAAC,MAAM,KAAK,KAAK,IAAI,CAAC,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,GAAG,CAAC,QAAQ,KAAK,oBAAoB,CAAC,EAAE,CAAC;YACrG,OAAO,IAAI,CAAC,GAAG,EAAE;gBACf,MAAM,EAAE,sBAAsB,CAAC,OAAO,CAAC,SAAS,CAAC;gBACjD,OAAO,EAAE,OAAO,CAAC,WAAW,CAAC,OAAO;gBACpC,aAAa,EAAE,OAAO,CAAC,WAAW,CAAC,aAAa;aACjD,CAAC,CAAC;QACL,CAAC;QACD,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM,IAAI,GAAG,CAAC,QAAQ,KAAK,aAAa,EAAE,CAAC;YAChE,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC,MAAM,EAAE,CAAC;YACjD,OAAO,IAAI,CAAC,GAAG,EAAE;gBACf,EAAE,EAAE,IAAI;gBACR,OAAO,EAAE,WAAW,CAAC,OAAO;gBAC5B,UAAU,EAAE,WAAW,CAAC,IAAI;gBAC5B,OAAO,EAAE,OAAO,CAAC,WAAW,CAAC,OAAO;gBACpC,aAAa,EAAE,OAAO,CAAC,WAAW,CAAC,aAAa;gBAChD,MAAM,EAAE,sBAAsB,CAAC,OAAO,CAAC,SAAS,CAAC;aAClD,CAAC,CAAC;QACL,CAAC;QACD,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM,IAAI,GAAG,CAAC,QAAQ,KAAK,4BAA4B,EAAE,CAAC;YAC/E,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,IAAI,EAA6B,CAAC;YAC7D,IAAI,OAAO,IAAI,CAAC,OAAO,KAAK,QAAQ,IAAI,OAAO,IAAI,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;gBAC1E,OAAO,IAAI,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,mCAAmC,EAAE,CAAC,CAAC;YACnE,CAAC;YACD,OAAO,IAAI,CAAC,GAAG,EAAE,EAAE,GAAG,EAAE,oBAAoB,CAC1C,IAAI,CAAC,OAAO,EACZ,IAAI,CAAC,QAAQ,EACb,OAAO,IAAI,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,EACjE,OAAO,IAAI,CAAC,YAAY,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS,CACtE,EAAE,CAAC,CAAC;QACP,CAAC;QACD,OAAO,IAAI,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC;IAC3C,CAAC,CAAC;AACJ,CAAC;AAED,SAAS,IAAI,CAAC,MAAc,EAAE,IAAa;IACzC,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE;QACxC,MAAM;QACN,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,eAAe,EAAE,UAAU,EAAE;KAC7E,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"api.js","sourceRoot":"","sources":["../../../src/identity/local/api.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,sBAAsB,EAAE,MAAM,gBAAgB,CAAC;AAGxD,MAAM,UAAU,cAAc,CAAC,OAG9B;IACC,OAAO,KAAK,EAAE,OAAO,EAAE,EAAE;QACvB,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACjC,IAAI,OAAO,CAAC,MAAM,KAAK,KAAK,IAAI,CAAC,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,GAAG,CAAC,QAAQ,KAAK,oBAAoB,CAAC,EAAE,CAAC;YACrG,OAAO,IAAI,CAAC,GAAG,EAAE;gBACf,MAAM,EAAE,sBAAsB,CAAC,OAAO,CAAC,SAAS,CAAC;gBACjD,OAAO,EAAE,OAAO,CAAC,WAAW,CAAC,OAAO;gBACpC,aAAa,EAAE,OAAO,CAAC,WAAW,CAAC,aAAa;aACjD,CAAC,CAAC;QACL,CAAC;QACD,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM,IAAI,GAAG,CAAC,QAAQ,KAAK,aAAa,EAAE,CAAC;YAChE,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC,MAAM,EAAE,CAAC;YACjD,OAAO,IAAI,CAAC,GAAG,EAAE;gBACf,EAAE,EAAE,IAAI;gBACR,OAAO,EAAE,WAAW,CAAC,OAAO;gBAC5B,UAAU,EAAE,WAAW,CAAC,IAAI;gBAC5B,OAAO,EAAE,OAAO,CAAC,WAAW,CAAC,OAAO;gBACpC,aAAa,EAAE,OAAO,CAAC,WAAW,CAAC,aAAa;gBAChD,MAAM,EAAE,sBAAsB,CAAC,OAAO,CAAC,SAAS,CAAC;aAClD,CAAC,CAAC;QACL,CAAC;QACD,OAAO,IAAI,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC;IAC3C,CAAC,CAAC;AACJ,CAAC;AAED,SAAS,IAAI,CAAC,MAAc,EAAE,IAAa;IACzC,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE;QACxC,MAAM;QACN,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,eAAe,EAAE,UAAU,EAAE;KAC7E,CAAC,CAAC;AACL,CAAC"}

package/dist/identity/local/index.d.ts

@@ -1,5 +1,4 @@
 export { createLocalApi } from './api.js';
 export { discoverLocalHarnesses } from './discovery.js';
-export { localReauthCommand, resolveLocalAgentEnv } from './resolve.js';
 export type * from './types.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/identity/local/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/identity/local/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,UAAU,CAAC;AAC1C,OAAO,EAAE,sBAAsB,EAAE,MAAM,gBAAgB,CAAC;AACxD,OAAO,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAC;AACxE,mBAAmB,YAAY,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/identity/local/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,UAAU,CAAC;AAC1C,OAAO,EAAE,sBAAsB,EAAE,MAAM,gBAAgB,CAAC;AACxD,mBAAmB,YAAY,CAAC"}

package/dist/identity/local/index.js

@@ -1,4 +1,3 @@
 export { createLocalApi } from './api.js';
 export { discoverLocalHarnesses } from './discovery.js';
-export { localReauthCommand, resolveLocalAgentEnv } from './resolve.js';
 //# sourceMappingURL=index.js.map

package/dist/identity/local/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/identity/local/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,UAAU,CAAC;AAC1C,OAAO,EAAE,sBAAsB,EAAE,MAAM,gBAAgB,CAAC;AACxD,OAAO,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/identity/local/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,UAAU,CAAC;AAC1C,OAAO,EAAE,sBAAsB,EAAE,MAAM,gBAAgB,CAAC"}

package/dist/identity/machine-setup.d.ts

@@ -6,7 +6,7 @@
 import type { ClockIsoPort, ClockMsPort } from './ports.js';
 import type { InstallationPlan, ReleaseCatalogVerifierPort, SignedReleaseCatalog } from '../supervision/installation-plan.js';
 type Dict = Record<string, unknown>;
-export type MachineSetupStage = 'device' | 'approval' | 'registration' | 'proxy_refresh' | 'catalog' | 'installation' | 'persistence' | 'user_ground' | 'runtime' | 'ready';
+export type MachineSetupStage = 'device' | 'approval' | 'registration' | 'catalog' | 'installation' | 'persistence' | 'user_ground' | 'runtime' | 'ready';
 export declare class MachineSetupError extends Error {
     readonly stage: MachineSetupStage;
     readonly code: string;
@@ -54,7 +54,6 @@ export interface MachineControlPlanePort {
         readonly computer_registration_token: string;
     }>;
     register(registrationToken: string, body: Dict): Promise<Dict>;
-    refreshProxy(computerAuthToken: string, body: Dict): Promise<Dict>;
 }
 export interface MachineCatalogPort {
     load(): Promise<SignedReleaseCatalog>;
@@ -156,7 +155,7 @@ export interface ReadyMachine {
 export declare function computerSetupBody(input: JoinMachineInput, deviceId: string): Dict;
 /** Browser approval and --setup-code converge before this function registers. */
 export declare function joinMachine(input: JoinMachineInput, ports: MachineSetupPorts): Promise<ReadyMachine>;
-/** A later process starts from disk and refreshes copy-on-success only. */
+/** A later process starts from disk, retiring obsolete secrets copy-on-success. */
 export declare function resumeMachine(ports: MachineSetupPorts): Promise<ReadyMachine>;
 export {};
 //# sourceMappingURL=machine-setup.d.ts.map

package/dist/identity/machine-setup.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"machine-setup.d.ts","sourceRoot":"","sources":["../../src/identity/machine-setup.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAUH,OAAO,KAAK,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAC5D,OAAO,KAAK,EACV,gBAAgB,EAChB,0BAA0B,EAC1B,oBAAoB,EACrB,MAAM,qCAAqC,CAAC;AAG7C,KAAK,IAAI,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAMpC,MAAM,MAAM,iBAAiB,GACzB,QAAQ,GACR,UAAU,GACV,cAAc,GACd,eAAe,GACf,SAAS,GACT,cAAc,GACd,aAAa,GACb,aAAa,GACb,SAAS,GACT,OAAO,CAAC;AAEZ,qBAAa,iBAAkB,SAAQ,KAAK;IAC1C,QAAQ,CAAC,KAAK,EAAE,iBAAiB,CAAC;IAClC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAC;gBAElB,KAAK,EAAE,iBAAiB,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,UAAQ,EAAE,OAAO,CAAC,EAAE,YAAY;CAOhG;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;CAC7B;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,YAAY,EAAE,IAAI,CAAC;IAC5B,QAAQ,CAAC,UAAU,EAAE,IAAI,CAAC;IAC1B,QAAQ,CAAC,YAAY,EAAE,gBAAgB,CAAC;IACxC,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;CACzB;AAED,MAAM,WAAW,eAAe;IAC9B,IAAI,IAAI,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC,CAAC;IACvC,IAAI,CAAC,MAAM,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC7C;AAED,mFAAmF;AACnF,MAAM,WAAW,gBAAgB;IAC/B,IAAI,IAAI,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC,CAAC;IACtC,IAAI,CAAC,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5C,SAAS,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CAC5B;AAED,MAAM,WAAW,uBAAuB;IACtC,KAAK,CAAC,IAAI,EAAE,IAAI,GAAG,OAAO,CAAC;QACzB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;QAC7B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;QAC5B,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;QAClC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;QAC5B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;KAC3B,CAAC,CAAC;IACH,IAAI,CAAC,IAAI,EAAE,IAAI,GAAG,OAAO,CACrB;QAAE,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAC;QAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,GAC1D;QAAE,QAAQ,CAAC,MAAM,EAAE,YAAY,GAAG,SAAS,GAAG,QAAQ,CAAA;KAAE,GACxD;QAAE,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAC;QAAC,QAAQ,CAAC,2BAA2B,EAAE,MAAM,CAAA;KAAE,CAChF,CAAC;IACF,MAAM,CAAC,IAAI,EAAE,IAAI,GAAG,OAAO,CAAC;QAAE,QAAQ,CAAC,2BAA2B,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC9E,QAAQ,CAAC,iBAAiB,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/D,YAAY,CAAC,iBAAiB,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACpE;AAED,MAAM,WAAW,kBAAkB;IACjC,IAAI,IAAI,OAAO,CAAC,oBAAoB,CAAC,CAAC;IACtC,QAAQ,CAAC,QAAQ,EAAE,0BAA0B,CAAC;CAC/C;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,aAAa;IAC5B,OAAO,CAAC,IAAI,EAAE,gBAAgB,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAC;IAC3D,QAAQ,CAAC,SAAS,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACtD;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;IACrC,QAAQ,CAAC,oBAAoB,EAAE,OAAO,CAAC;IACvC,QAAQ,CAAC,YAAY,EAAE;QAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;KAAE,CAAC;CACjF;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,QAAQ,EAAE,eAAe,CAAC;IACnC,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACvB;AAED,MAAM,WAAW,WAAW;IAC1B,KAAK,CAAC,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;CACxD;AAED,MAAM,MAAM,cAAc,GAAG,aAAa,GAAG,cAAc,GAAG,SAAS,GAAG,SAAS,CAAC;AAEpF;8EAC8E;AAC9E,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAC;IAC9B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAC;CACzB;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,QAAQ,EAAE;QACjB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;QACxB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;QAC3B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;KAC3B,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAAC;CACjC;AAED,MAAM,WAAW,qBAAqB;IACpC,qDAAqD;IACrD,SAAS,CAAC,KAAK,EAAE;QAAE,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;CAC1G;AAED,MAAM,WAAW,oBAAoB;IACnC,KAAK,CAAC,KAAK,EAAE;QACX,QAAQ,CAAC,KAAK,EAAE,iBAAiB,CAAC;QAClC,QAAQ,CAAC,MAAM,EAAE,SAAS,GAAG,WAAW,GAAG,QAAQ,CAAC;QACpD,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;KACxB,GAAG,IAAI,CAAC;CACV;AAED,MAAM,WAAW,iBAAkB,SAAQ,YAAY,EAAE,WAAW;IAClE,QAAQ,CAAC,WAAW,EAAE,eAAe,CAAC;IACtC,QAAQ,CAAC,YAAY,EAAE,gBAAgB,CAAC;IACxC,QAAQ,CAAC,YAAY,EAAE,uBAAuB,CAAC;IAC/C,QAAQ,CAAC,OAAO,EAAE,kBAAkB,CAAC;IACrC,QAAQ,CAAC,SAAS,EAAE,aAAa,CAAC;IAClC,QAAQ,CAAC,UAAU,EAAE,cAAc,CAAC;IACpC,QAAQ,CAAC,OAAO,EAAE,WAAW,CAAC;IAC9B,QAAQ,CAAC,YAAY,EAAE,qBAAqB,CAAC;IAC7C,QAAQ,CAAC,WAAW,EAAE,oBAAoB,CAAC;IAC3C,UAAU,IAAI,MAAM,CAAC;IACrB,KAAK,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAClC;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,QAAQ,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CACvC;AAED,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;IACzB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,YAAY,EAAE,gBAAgB,CAAC;IACxC,QAAQ,CAAC,UAAU,EAAE,kBAAkB,CAAC;IACxC,QAAQ,CAAC,OAAO,EAAE,cAAc,CAAC;CAClC;AA0BD,wEAAwE;AACxE,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,gBAAgB,EAAE,QAAQ,EAAE,MAAM,GAAG,IAAI,CASjF;AA2MD,iFAAiF;AACjF,wBAAsB,WAAW,CAAC,KAAK,EAAE,gBAAgB,EAAE,KAAK,EAAE,iBAAiB,GAAG,OAAO,CAAC,YAAY,CAAC,CAuF1G;AAED,2EAA2E;AAC3E,wBAAsB,aAAa,CAAC,KAAK,EAAE,iBAAiB,GAAG,OAAO,CAAC,YAAY,CAAC,CAgEnF"}
+{"version":3,"file":"machine-setup.d.ts","sourceRoot":"","sources":["../../src/identity/machine-setup.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AASH,OAAO,KAAK,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAC5D,OAAO,KAAK,EACV,gBAAgB,EAChB,0BAA0B,EAC1B,oBAAoB,EACrB,MAAM,qCAAqC,CAAC;AAG7C,KAAK,IAAI,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAMpC,MAAM,MAAM,iBAAiB,GACzB,QAAQ,GACR,UAAU,GACV,cAAc,GACd,SAAS,GACT,cAAc,GACd,aAAa,GACb,aAAa,GACb,SAAS,GACT,OAAO,CAAC;AAEZ,qBAAa,iBAAkB,SAAQ,KAAK;IAC1C,QAAQ,CAAC,KAAK,EAAE,iBAAiB,CAAC;IAClC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAC;gBAElB,KAAK,EAAE,iBAAiB,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,UAAQ,EAAE,OAAO,CAAC,EAAE,YAAY;CAOhG;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;CAC7B;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,YAAY,EAAE,IAAI,CAAC;IAC5B,QAAQ,CAAC,UAAU,EAAE,IAAI,CAAC;IAC1B,QAAQ,CAAC,YAAY,EAAE,gBAAgB,CAAC;IACxC,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;CACzB;AAED,MAAM,WAAW,eAAe;IAC9B,IAAI,IAAI,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC,CAAC;IACvC,IAAI,CAAC,MAAM,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC7C;AAED,mFAAmF;AACnF,MAAM,WAAW,gBAAgB;IAC/B,IAAI,IAAI,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC,CAAC;IACtC,IAAI,CAAC,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5C,SAAS,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CAC5B;AAED,MAAM,WAAW,uBAAuB;IACtC,KAAK,CAAC,IAAI,EAAE,IAAI,GAAG,OAAO,CAAC;QACzB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;QAC7B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;QAC5B,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;QAClC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;QAC5B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;KAC3B,CAAC,CAAC;IACH,IAAI,CAAC,IAAI,EAAE,IAAI,GAAG,OAAO,CACrB;QAAE,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAC;QAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,GAC1D;QAAE,QAAQ,CAAC,MAAM,EAAE,YAAY,GAAG,SAAS,GAAG,QAAQ,CAAA;KAAE,GACxD;QAAE,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAC;QAAC,QAAQ,CAAC,2BAA2B,EAAE,MAAM,CAAA;KAAE,CAChF,CAAC;IACF,MAAM,CAAC,IAAI,EAAE,IAAI,GAAG,OAAO,CAAC;QAAE,QAAQ,CAAC,2BAA2B,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC9E,QAAQ,CAAC,iBAAiB,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAChE;AAED,MAAM,WAAW,kBAAkB;IACjC,IAAI,IAAI,OAAO,CAAC,oBAAoB,CAAC,CAAC;IACtC,QAAQ,CAAC,QAAQ,EAAE,0BAA0B,CAAC;CAC/C;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,aAAa;IAC5B,OAAO,CAAC,IAAI,EAAE,gBAAgB,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAC;IAC3D,QAAQ,CAAC,SAAS,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACtD;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;IACrC,QAAQ,CAAC,oBAAoB,EAAE,OAAO,CAAC;IACvC,QAAQ,CAAC,YAAY,EAAE;QAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;KAAE,CAAC;CACjF;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,QAAQ,EAAE,eAAe,CAAC;IACnC,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACvB;AAED,MAAM,WAAW,WAAW;IAC1B,KAAK,CAAC,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;CACxD;AAED,MAAM,MAAM,cAAc,GAAG,aAAa,GAAG,cAAc,GAAG,SAAS,GAAG,SAAS,CAAC;AAEpF;8EAC8E;AAC9E,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAC;IAC9B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAC;CACzB;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,QAAQ,EAAE;QACjB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;QACxB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;QAC3B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;KAC3B,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAAC;CACjC;AAED,MAAM,WAAW,qBAAqB;IACpC,qDAAqD;IACrD,SAAS,CAAC,KAAK,EAAE;QAAE,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;CAC1G;AAED,MAAM,WAAW,oBAAoB;IACnC,KAAK,CAAC,KAAK,EAAE;QACX,QAAQ,CAAC,KAAK,EAAE,iBAAiB,CAAC;QAClC,QAAQ,CAAC,MAAM,EAAE,SAAS,GAAG,WAAW,GAAG,QAAQ,CAAC;QACpD,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;KACxB,GAAG,IAAI,CAAC;CACV;AAED,MAAM,WAAW,iBAAkB,SAAQ,YAAY,EAAE,WAAW;IAClE,QAAQ,CAAC,WAAW,EAAE,eAAe,CAAC;IACtC,QAAQ,CAAC,YAAY,EAAE,gBAAgB,CAAC;IACxC,QAAQ,CAAC,YAAY,EAAE,uBAAuB,CAAC;IAC/C,QAAQ,CAAC,OAAO,EAAE,kBAAkB,CAAC;IACrC,QAAQ,CAAC,SAAS,EAAE,aAAa,CAAC;IAClC,QAAQ,CAAC,UAAU,EAAE,cAAc,CAAC;IACpC,QAAQ,CAAC,OAAO,EAAE,WAAW,CAAC;IAC9B,QAAQ,CAAC,YAAY,EAAE,qBAAqB,CAAC;IAC7C,QAAQ,CAAC,WAAW,EAAE,oBAAoB,CAAC;IAC3C,UAAU,IAAI,MAAM,CAAC;IACrB,KAAK,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAClC;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,QAAQ,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CACvC;AAED,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;IACzB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,YAAY,EAAE,gBAAgB,CAAC;IACxC,QAAQ,CAAC,UAAU,EAAE,kBAAkB,CAAC;IACxC,QAAQ,CAAC,OAAO,EAAE,cAAc,CAAC;CAClC;AA0BD,wEAAwE;AACxE,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,gBAAgB,EAAE,QAAQ,EAAE,MAAM,GAAG,IAAI,CASjF;AA2LD,iFAAiF;AACjF,wBAAsB,WAAW,CAAC,KAAK,EAAE,gBAAgB,EAAE,KAAK,EAAE,iBAAiB,GAAG,OAAO,CAAC,YAAY,CAAC,CAoF1G;AAED,mFAAmF;AACnF,wBAAsB,aAAa,CAAC,KAAK,EAAE,iBAAiB,GAAG,OAAO,CAAC,YAAY,CAAC,CA8DnF"}

package/dist/identity/machine-setup.js

@@ -3,7 +3,7 @@
  * HTTP, files, browser opening, clocks, installation, and runtime boot are
  * ports. Service selection is deliberately absent from every auth request.
  */
-import { authFromRecord, mergeRecordAuth, proxyTokenExpiresSoon, publicComputerRecord, refreshedProxyAuth, } from './auth-records.js';
+import { authFromRecord, hasRetiredProxyAuth, mergeRecordAuth, publicComputerRecord, } from './auth-records.js';
 import { assertSetupCode, isUsableDeviceId, npmDeviceId } from './ids.js';
 import { resolveVerifiedInstallationPlan } from '../supervision/installation-plan.js';
 const asDict = (value) => (value && typeof value === 'object' && !Array.isArray(value) ? value : null);
@@ -27,7 +27,7 @@ function setupFailure(stage, error) {
     if (error instanceof MachineSetupError)
         return error;
     const code = stringValue(asDict(error)?.['code']) || 'operation_failed';
-    const recoverable = stage === 'approval' || stage === 'proxy_refresh' || stage === 'user_ground';
+    const recoverable = stage === 'approval' || stage === 'user_ground';
     return new MachineSetupError(stage, code, recoverable, error instanceof Error ? { cause: error } : undefined);
 }
 async function stableDevice(ports) {
@@ -162,32 +162,14 @@ async function convergeUserGround(record, ports) {
     assertUserGround(identity, evidence);
     return evidence;
 }
-function authMachineToken(auth) {
-    return stringValue(asDict(asDict(auth)?.['machine'])?.['token']);
-}
-function authProxyToken(auth) {
-    return stringValue(asDict(asDict(auth)?.['proxy'])?.['token']);
-}
-async function ensureFreshProxy(record, auth, ports) {
-    if (authProxyToken(auth) && !proxyTokenExpiresSoon(auth, ports))
-        return auth;
-    const computerAuthToken = authMachineToken(auth);
-    if (!computerAuthToken) {
-        throw new MachineSetupError('proxy_refresh', 'missing_computer_auth_token', true);
-    }
-    const refreshed = await ports.controlPlane.refreshProxy(computerAuthToken, {
-        computer_id: stringValue(record['computer_id']),
-        device_id: stringValue(record['device_id']),
-    });
-    const next = refreshedProxyAuth({ record, auth, refreshed }, ports);
-    if (!authProxyToken(next) || proxyTokenExpiresSoon(next, ports)) {
-        throw new MachineSetupError('proxy_refresh', 'proxy_token_not_fresh', true);
-    }
-    return next;
-}
 function hydrated(machine) {
     return mergeRecordAuth(machine.publicRecord, machine.secretAuth) || {};
 }
+function withoutRetiredProxyAuth(machine, ports) {
+    return hasRetiredProxyAuth(machine.secretAuth)
+        ? { ...machine, secretAuth: authFromRecord(hydrated(machine), null, ports) }
+        : machine;
+}
 function sameInstallation(left, right) {
     return left.releaseId === right.releaseId
         && JSON.stringify(left.selection) === JSON.stringify(right.selection)
@@ -249,10 +231,7 @@ export async function joinMachine(input, ports) {
         const registered = await ports.controlPlane.register(token, computerSetupBody(input, device.device_id));
         const record = registrationRecord(registered, input, device.device_id, ports.nowIso());
         diagnostic(ports, stage, 'completed');
-        stage = 'proxy_refresh';
-        diagnostic(ports, stage, 'started');
-        const auth = await ensureFreshProxy(record, authFromRecord(record, null, ports), ports);
-        diagnostic(ports, stage, 'completed');
+        const auth = authFromRecord(record, null, ports);
         stage = 'catalog';
         diagnostic(ports, stage, 'started');
         const catalog = await ports.catalog.load();
@@ -313,7 +292,7 @@ export async function joinMachine(input, ports) {
         throw failure;
     }
 }
-/** A later process starts from disk and refreshes copy-on-success only. */
+/** A later process starts from disk, retiring obsolete secrets copy-on-success. */
 export async function resumeMachine(ports) {
     let stage = 'persistence';
     let runtime = null;
@@ -327,9 +306,7 @@ export async function resumeMachine(ports) {
         if (stringValue(record['device_id']) !== device.device_id) {
             throw new MachineSetupError(stage, 'stored_device_mismatch');
         }
-        stage = 'proxy_refresh';
-        const auth = await ensureFreshProxy(record, stored.secretAuth, ports);
-        const current = auth === stored.secretAuth ? stored : { ...stored, secretAuth: auth };
+        const current = withoutRetiredProxyAuth(stored, ports);
         if (current !== stored) {
             stage = 'persistence';
             await ports.machineStore.save(current);

package/dist/identity/machine-setup.js.map

@@ -1 +1 @@
-{"version":3,"file":"machine-setup.js","sourceRoot":"","sources":["../../src/identity/machine-setup.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EACL,cAAc,EACd,eAAe,EACf,qBAAqB,EACrB,oBAAoB,EACpB,kBAAkB,GACnB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,eAAe,EAAE,gBAAgB,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC;AAO1E,OAAO,EAAE,+BAA+B,EAAE,MAAM,qCAAqC,CAAC;AAGtF,MAAM,MAAM,GAAG,CAAC,KAAc,EAAe,EAAE,CAAC,CAC9C,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAa,CAAC,CAAC,CAAC,IAAI,CACnF,CAAC;AACF,MAAM,WAAW,GAAG,CAAC,KAAc,EAAU,EAAE,CAAC,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;AAchG,MAAM,OAAO,iBAAkB,SAAQ,KAAK;IACjC,KAAK,CAAoB;IACzB,IAAI,CAAS;IACb,WAAW,CAAU;IAE9B,YAAY,KAAwB,EAAE,IAAY,EAAE,WAAW,GAAG,KAAK,EAAE,OAAsB;QAC7F,KAAK,CAAC,+BAA+B,KAAK,KAAK,IAAI,EAAE,EAAE,OAAO,CAAC,CAAC;QAChE,IAAI,CAAC,IAAI,GAAG,mBAAmB,CAAC;QAChC,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;QACnB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,WAAW,GAAG,WAAW,CAAC;IACjC,CAAC;CACF;AAoJD,SAAS,UAAU,CACjB,KAAwB,EACxB,KAAwB,EACxB,MAA0C,EAC1C,IAAa;IAEb,KAAK,CAAC,WAAW,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;AACxE,CAAC;AAED,SAAS,YAAY,CAAC,KAAwB,EAAE,KAAc;IAC5D,IAAI,KAAK,YAAY,iBAAiB;QAAE,OAAO,KAAK,CAAC;IACrD,MAAM,IAAI,GAAG,WAAW,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,MAAM,CAAC,CAAC,IAAI,kBAAkB,CAAC;IACxE,MAAM,WAAW,GAAG,KAAK,KAAK,UAAU,IAAI,KAAK,KAAK,eAAe,IAAI,KAAK,KAAK,aAAa,CAAC;IACjG,OAAO,IAAI,iBAAiB,CAAC,KAAK,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;AAChH,CAAC;AAED,KAAK,UAAU,YAAY,CAAC,KAAwB;IAClD,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC;IAChD,IAAI,QAAQ,IAAI,gBAAgB,CAAC,QAAQ,CAAC,SAAS,CAAC;QAAE,OAAO,QAAQ,CAAC;IACtE,MAAM,MAAM,GAAG,EAAE,SAAS,EAAE,WAAW,CAAC,KAAK,CAAC,UAAU,EAAE,CAAC,EAAE,UAAU,EAAE,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC;IAC1F,MAAM,KAAK,CAAC,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACrC,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,wEAAwE;AACxE,MAAM,UAAU,iBAAiB,CAAC,KAAuB,EAAE,QAAgB;IACzE,OAAO;QACL,SAAS,EAAE,QAAQ;QACnB,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,WAAW,EAAE,KAAK,CAAC,UAAU;QAC7B,aAAa,EAAE,KAAK,CAAC,YAAY;QACjC,MAAM,EAAE,KAAK,CAAC,MAAM;KACrB,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,iBAAiB,CAC9B,KAAuB,EACvB,QAAgB,EAChB,KAAwB;IAExB,MAAM,IAAI,GAAG,iBAAiB,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;IAChD,IAAI,KAAK,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;QAClC,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,YAAY,CAAC,MAAM,CAAC;YAC/C,GAAG,IAAI;YACP,UAAU,EAAE,eAAe,CAAC,KAAK,CAAC,SAAS,CAAC;SAC7C,CAAC,CAAC;QACH,MAAM,KAAK,GAAG,WAAW,CAAC,QAAQ,CAAC,2BAA2B,CAAC,CAAC;QAChE,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,iBAAiB,CAAC,UAAU,EAAE,4BAA4B,CAAC,CAAC;QAClF,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,YAAY,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACrD,IACE,CAAC,WAAW,CAAC,OAAO,CAAC,WAAW,CAAC;WAC9B,CAAC,WAAW,CAAC,OAAO,CAAC,UAAU,CAAC;WAChC,CAAC,WAAW,CAAC,OAAO,CAAC,gBAAgB,CAAC,EACzC,CAAC;QACD,MAAM,IAAI,iBAAiB,CAAC,UAAU,EAAE,wBAAwB,CAAC,CAAC;IACpE,CAAC;IACD,MAAM,KAAK,CAAC,YAAY,CAAC,SAAS,CAAC;QACjC,eAAe,EAAE,OAAO,CAAC,gBAAgB;QACzC,SAAS,EAAE,OAAO,CAAC,UAAU;KAC9B,CAAC,CAAC;IACH,MAAM,QAAQ,GAAG,KAAK,CAAC,KAAK,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,MAAM,CAAC,OAAO,CAAC,UAAU,IAAI,GAAG,CAAC,CAAC,GAAG,IAAI,CAAC;IACxF,IAAI,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,CAAC,OAAO,CAAC,QAAQ,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC;IACjE,OAAO,KAAK,CAAC,KAAK,EAAE,GAAG,QAAQ,EAAE,CAAC;QAChC,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,EAAE,GAAG,IAAI,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC;QAC5F,IAAI,MAAM,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;YACjC,MAAM,KAAK,GAAG,WAAW,CAAC,MAAM,CAAC,2BAA2B,CAAC,CAAC;YAC9D,IAAI,CAAC,KAAK;gBAAE,MAAM,IAAI,iBAAiB,CAAC,UAAU,EAAE,4BAA4B,CAAC,CAAC;YAClF,OAAO,KAAK,CAAC;QACf,CAAC;QACD,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YAChC,MAAM,IAAI,iBAAiB,CAAC,UAAU,EAAE,SAAS,MAAM,CAAC,MAAM,EAAE,EAAE,MAAM,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC;QACjG,CAAC;QACD,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,CAAC,MAAM,CAAC,QAAQ,IAAI,QAAQ,GAAG,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC;QAC1E,MAAM,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IAC9B,CAAC;IACD,MAAM,IAAI,iBAAiB,CAAC,UAAU,EAAE,eAAe,EAAE,IAAI,CAAC,CAAC;AACjE,CAAC;AAED,SAAS,kBAAkB,CACzB,QAAiB,EACjB,KAAuB,EACvB,QAAgB,EAChB,MAAc;IAEd,MAAM,UAAU,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC;IACpC,IAAI,CAAC,UAAU;QAAE,MAAM,IAAI,iBAAiB,CAAC,cAAc,EAAE,+BAA+B,CAAC,CAAC;IAC9F,IAAI,WAAW,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC,KAAK,QAAQ,EAAE,CAAC;QACtD,MAAM,IAAI,iBAAiB,CAAC,cAAc,EAAE,4BAA4B,CAAC,CAAC;IAC5E,CAAC;IACD,KAAK,MAAM,GAAG,IAAI;QAChB,aAAa,EAAE,SAAS,EAAE,YAAY,EAAE,cAAc,EAAE,YAAY;QACpE,qBAAqB;KACtB,EAAE,CAAC;QACF,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;YAClC,MAAM,IAAI,iBAAiB,CAAC,cAAc,EAAE,WAAW,GAAG,EAAE,CAAC,CAAC;QAChE,CAAC;IACH,CAAC;IACD,OAAO;QACL,GAAG,UAAU;QACb,OAAO,EAAE,KAAK,CAAC,MAAM;QACrB,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,WAAW,EAAE,KAAK,CAAC,UAAU;QAC7B,aAAa,EAAE,KAAK,CAAC,YAAY;QACjC,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,aAAa,EAAE,MAAM;KACtB,CAAC;AACJ,CAAC;AAED,SAAS,kBAAkB,CAAC,MAAY;IACtC,MAAM,QAAQ,GAAG;QACf,MAAM,EAAE,WAAW,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QACtC,SAAS,EAAE,WAAW,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,WAAW,EAAE;QAC1D,QAAQ,EAAE,WAAW,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;KAC3C,CAAC;IACF,IAAI,CAAC,QAAQ,CAAC,MAAM;QAAE,MAAM,IAAI,iBAAiB,CAAC,aAAa,EAAE,iBAAiB,CAAC,CAAC;IACpF,IAAI,CAAC,QAAQ,CAAC,SAAS;QAAE,MAAM,IAAI,iBAAiB,CAAC,aAAa,EAAE,oBAAoB,CAAC,CAAC;IAC1F,IAAI,CAAC,QAAQ,CAAC,QAAQ;QAAE,MAAM,IAAI,iBAAiB,CAAC,aAAa,EAAE,mBAAmB,CAAC,CAAC;IACxF,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,gBAAgB,CACvB,QAA+C,EAC/C,QAA4B;IAE5B,IAAI,QAAQ,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM,EAAE,CAAC;QACxC,MAAM,IAAI,iBAAiB,CAAC,aAAa,EAAE,sBAAsB,CAAC,CAAC;IACrE,CAAC;IACD,IAAI,QAAQ,CAAC,SAAS,CAAC,WAAW,EAAE,KAAK,QAAQ,CAAC,SAAS,EAAE,CAAC;QAC5D,MAAM,IAAI,iBAAiB,CAAC,aAAa,EAAE,uBAAuB,CAAC,CAAC;IACtE,CAAC;IACD,IAAI,QAAQ,CAAC,QAAQ,KAAK,QAAQ,CAAC,QAAQ,EAAE,CAAC;QAC5C,MAAM,IAAI,iBAAiB,CAAC,aAAa,EAAE,wBAAwB,CAAC,CAAC;IACvE,CAAC;IACD,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;QACrC,MAAM,IAAI,iBAAiB,CAAC,aAAa,EAAE,qBAAqB,CAAC,CAAC;IACpE,CAAC;IACD,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;QAC/C,MAAM,IAAI,iBAAiB,CAAC,aAAa,EAAE,2BAA2B,CAAC,CAAC;IAC1E,CAAC;IACD,IAAI,CAAC,CAAC,aAAa,EAAE,cAAc,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QACnF,MAAM,IAAI,iBAAiB,CAAC,aAAa,EAAE,qBAAqB,CAAC,CAAC;IACpE,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,QAAQ,CAAC,WAAW,GAAG,CAAC,EAAE,CAAC;QAC5E,MAAM,IAAI,iBAAiB,CAAC,aAAa,EAAE,yBAAyB,CAAC,CAAC;IACxE,CAAC;IACD,IAAI,QAAQ,CAAC,QAAQ,KAAK,IAAI,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,QAAQ,CAAC,YAAY,CAAC;WACzE,QAAQ,CAAC,YAAY,GAAG,CAAC,EAAE,CAAC;QAC/B,MAAM,IAAI,iBAAiB,CAAC,aAAa,EAAE,yBAAyB,CAAC,CAAC;IACxE,CAAC;AACH,CAAC;AAED,KAAK,UAAU,kBAAkB,CAAC,MAAY,EAAE,KAAwB;IACtE,MAAM,QAAQ,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAAC;IAC5C,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,UAAU,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAC3D,gBAAgB,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;IACrC,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,gBAAgB,CAAC,IAAa;IACrC,OAAO,WAAW,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;AACnE,CAAC;AAED,SAAS,cAAc,CAAC,IAAa;IACnC,OAAO,WAAW,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;AACjE,CAAC;AAED,KAAK,UAAU,gBAAgB,CAAC,MAAY,EAAE,IAAU,EAAE,KAAwB;IAChF,IAAI,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,qBAAqB,CAAC,IAAI,EAAE,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAC7E,MAAM,iBAAiB,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;IACjD,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACvB,MAAM,IAAI,iBAAiB,CAAC,eAAe,EAAE,6BAA6B,EAAE,IAAI,CAAC,CAAC;IACpF,CAAC;IACD,MAAM,SAAS,GAAG,MAAM,KAAK,CAAC,YAAY,CAAC,YAAY,CAAC,iBAAiB,EAAE;QACzE,WAAW,EAAE,WAAW,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;QAC/C,SAAS,EAAE,WAAW,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;KAC5C,CAAC,CAAC;IACH,MAAM,IAAI,GAAG,kBAAkB,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,KAAK,CAAC,CAAC;IACpE,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,qBAAqB,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,CAAC;QAChE,MAAM,IAAI,iBAAiB,CAAC,eAAe,EAAE,uBAAuB,EAAE,IAAI,CAAC,CAAC;IAC9E,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,QAAQ,CAAC,OAAsB;IACtC,OAAO,eAAe,CAAC,OAAO,CAAC,YAAY,EAAE,OAAO,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC;AACzE,CAAC;AAED,SAAS,gBAAgB,CAAC,IAAsB,EAAE,KAAuB;IACvE,OAAO,IAAI,CAAC,SAAS,KAAK,KAAK,CAAC,SAAS;WACpC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,SAAS,CAAC;WAClE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;AACxE,CAAC;AAED,KAAK,UAAU,mBAAmB,CAChC,MAAqB,EACrB,KAAwB;IAExB,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;IAC3C,MAAM,SAAS,GAAG,MAAM,CAAC,YAAY,CAAC,SAAS,KAAK,KAAK;QACvD,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,SAAS,CAAC;IAClC,OAAO,+BAA+B,CAAC,OAAO,EAAE,SAAS,EAAE,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;AACrF,CAAC;AAED,SAAS,aAAa,CAAC,OAAsB,EAAE,QAAyB;IACtE,MAAM,MAAM,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC;IACjC,MAAM,MAAM,GAAG,WAAW,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC;IAC9C,MAAM,UAAU,GAAG,WAAW,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC;IACtD,MAAM,QAAQ,GAAG,WAAW,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC;IAClD,IAAI,QAAQ,CAAC,MAAM,KAAK,MAAM;QAAE,MAAM,IAAI,iBAAiB,CAAC,SAAS,EAAE,yBAAyB,CAAC,CAAC;IAClG,IAAI,QAAQ,CAAC,UAAU,KAAK,UAAU;QAAE,MAAM,IAAI,iBAAiB,CAAC,SAAS,EAAE,2BAA2B,CAAC,CAAC;IAC5G,IAAI,QAAQ,CAAC,QAAQ,KAAK,QAAQ;QAAE,MAAM,IAAI,iBAAiB,CAAC,SAAS,EAAE,yBAAyB,CAAC,CAAC;IACtG,IAAI,CAAC,QAAQ,CAAC,oBAAoB;QAAE,MAAM,IAAI,iBAAiB,CAAC,SAAS,EAAE,2BAA2B,CAAC,CAAC;IACxG,IAAI,QAAQ,CAAC,YAAY,CAAC,MAAM,KAAK,MAAM,IAAI,QAAQ,CAAC,YAAY,CAAC,UAAU,KAAK,UAAU,EAAE,CAAC;QAC/F,MAAM,IAAI,iBAAiB,CAAC,SAAS,EAAE,wBAAwB,CAAC,CAAC;IACnE,CAAC;IACD,IAAI,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,YAAY,CAAC,QAAQ,CAAC,EAAE,CAAC;QACxF,MAAM,IAAI,iBAAiB,CAAC,SAAS,EAAE,0BAA0B,CAAC,CAAC;IACrE,CAAC;AACH,CAAC;AAED,KAAK,UAAU,aAAa,CAAC,OAAsB,EAAE,KAAwB;IAC3E,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACnD,IAAI,CAAC;QACH,aAAa,CAAC,OAAO,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;QACzC,OAAO,OAAO,CAAC;IACjB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,OAAO,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QAC5C,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED,iFAAiF;AACjF,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,KAAuB,EAAE,KAAwB;IACjF,IAAI,KAAK,GAAsB,QAAQ,CAAC;IACxC,IAAI,SAAS,GAA4B,IAAI,CAAC;IAC9C,IAAI,OAAO,GAA0B,IAAI,CAAC;IAC1C,IAAI,CAAC;QACH,UAAU,CAAC,KAAK,EAAE,KAAK,EAAE,SAAS,CAAC,CAAC;QACpC,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,KAAK,CAAC,CAAC;QACzC,UAAU,CAAC,KAAK,EAAE,KAAK,EAAE,WAAW,CAAC,CAAC;QAEtC,KAAK,GAAG,UAAU,CAAC;QACnB,UAAU,CAAC,KAAK,EAAE,KAAK,EAAE,SAAS,CAAC,CAAC;QACpC,MAAM,KAAK,GAAG,MAAM,iBAAiB,CAAC,KAAK,EAAE,MAAM,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;QACtE,UAAU,CAAC,KAAK,EAAE,KAAK,EAAE,WAAW,CAAC,CAAC;QAEtC,KAAK,GAAG,cAAc,CAAC;QACvB,UAAU,CAAC,KAAK,EAAE,KAAK,EAAE,SAAS,CAAC,CAAC;QACpC,MAAM,UAAU,GAAG,MAAM,KAAK,CAAC,YAAY,CAAC,QAAQ,CAClD,KAAK,EACL,iBAAiB,CAAC,KAAK,EAAE,MAAM,CAAC,SAAS,CAAC,CAC3C,CAAC;QACF,MAAM,MAAM,GAAG,kBAAkB,CAAC,UAAU,EAAE,KAAK,EAAE,MAAM,CAAC,SAAS,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;QACvF,UAAU,CAAC,KAAK,EAAE,KAAK,EAAE,WAAW,CAAC,CAAC;QAEtC,KAAK,GAAG,eAAe,CAAC;QACxB,UAAU,CAAC,KAAK,EAAE,KAAK,EAAE,SAAS,CAAC,CAAC;QACpC,MAAM,IAAI,GAAG,MAAM,gBAAgB,CAAC,MAAM,EAAE,cAAc,CAAC,MAAM,EAAE,IAAI,EAAE,KAAK,CAAC,EAAE,KAAK,CAAC,CAAC;QACxF,UAAU,CAAC,KAAK,EAAE,KAAK,EAAE,WAAW,CAAC,CAAC;QAEtC,KAAK,GAAG,SAAS,CAAC;QAClB,UAAU,CAAC,KAAK,EAAE,KAAK,EAAE,SAAS,CAAC,CAAC;QACpC,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;QAC3C,MAAM,YAAY,GAAG,+BAA+B,CAAC,OAAO,EAAE,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QACtG,UAAU,CAAC,KAAK,EAAE,KAAK,EAAE,WAAW,CAAC,CAAC;QAEtC,KAAK,GAAG,cAAc,CAAC;QACvB,UAAU,CAAC,KAAK,EAAE,KAAK,EAAE,SAAS,CAAC,CAAC;QACpC,SAAS,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;QACxD,UAAU,CAAC,KAAK,EAAE,KAAK,EAAE,WAAW,CAAC,CAAC;QAEtC,MAAM,MAAM,GAAkB;YAC5B,YAAY,EAAE,oBAAoB,CAAC,MAAM,CAAC;YAC1C,UAAU,EAAE,IAAI;YAChB,YAAY;YACZ,KAAK,EAAE,KAAK;SACb,CAAC;QACF,KAAK,GAAG,aAAa,CAAC;QACtB,UAAU,CAAC,KAAK,EAAE,KAAK,EAAE,SAAS,CAAC,CAAC;QACpC,MAAM,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACtC,UAAU,CAAC,KAAK,EAAE,KAAK,EAAE,WAAW,CAAC,CAAC;QAEtC,KAAK,GAAG,aAAa,CAAC;QACtB,UAAU,CAAC,KAAK,EAAE,KAAK,EAAE,SAAS,CAAC,CAAC;QACpC,MAAM,UAAU,GAAG,MAAM,kBAAkB,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QAC3D,UAAU,CAAC,KAAK,EAAE,KAAK,EAAE,WAAW,CAAC,CAAC;QAEtC,KAAK,GAAG,SAAS,CAAC;QAClB,UAAU,CAAC,KAAK,EAAE,KAAK,EAAE,SAAS,CAAC,CAAC;QACpC,MAAM,SAAS,GAAG,MAAM,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC;QAClD,IAAI,CAAC,SAAS;YAAE,MAAM,IAAI,iBAAiB,CAAC,KAAK,EAAE,yBAAyB,CAAC,CAAC;QAC9E,OAAO,GAAG,MAAM,aAAa,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;QAChD,MAAM,OAAO,CAAC,IAAI,EAAE,CAAC;QACrB,OAAO,GAAG,IAAI,CAAC;QACf,MAAM,WAAW,GAAG,MAAM,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC;QACpD,IAAI,CAAC,WAAW;YAAE,MAAM,IAAI,iBAAiB,CAAC,KAAK,EAAE,uBAAuB,CAAC,CAAC;QAC9E,OAAO,GAAG,MAAM,aAAa,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC;QAClD,UAAU,CAAC,KAAK,EAAE,KAAK,EAAE,WAAW,CAAC,CAAC;QAEtC,KAAK,GAAG,OAAO,CAAC;QAChB,UAAU,CAAC,KAAK,EAAE,KAAK,EAAE,SAAS,CAAC,CAAC;QACpC,MAAM,KAAK,CAAC,YAAY,CAAC,SAAS,EAAE,CAAC;QACrC,UAAU,CAAC,KAAK,EAAE,KAAK,EAAE,WAAW,CAAC,CAAC;QACtC,OAAO;YACL,MAAM,EAAE,OAAO;YACf,QAAQ,EAAE,MAAM,CAAC,SAAS;YAC1B,UAAU,EAAE,WAAW,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;YAC9C,MAAM,EAAE,WAAW,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;YACtC,YAAY;YACZ,UAAU;YACV,OAAO;SACR,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,OAAO;YAAE,MAAM,OAAO,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QACzD,IAAI,SAAS;YAAE,MAAM,KAAK,CAAC,SAAS,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QAChF,MAAM,OAAO,GAAG,YAAY,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QAC3C,UAAU,CAAC,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,QAAQ,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;QACzD,MAAM,OAAO,CAAC;IAChB,CAAC;AACH,CAAC;AAED,2EAA2E;AAC3E,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,KAAwB;IAC1D,IAAI,KAAK,GAAsB,aAAa,CAAC;IAC7C,IAAI,OAAO,GAA0B,IAAI,CAAC;IAC1C,IAAI,SAAS,GAA4B,IAAI,CAAC;IAC9C,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,KAAK,CAAC,CAAC;QACzC,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC;QAC/C,IAAI,CAAC,MAAM,EAAE,KAAK;YAAE,MAAM,IAAI,iBAAiB,CAAC,KAAK,EAAE,kBAAkB,EAAE,IAAI,CAAC,CAAC;QACjF,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC;QAChC,IAAI,WAAW,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,KAAK,MAAM,CAAC,SAAS,EAAE,CAAC;YAC1D,MAAM,IAAI,iBAAiB,CAAC,KAAK,EAAE,wBAAwB,CAAC,CAAC;QAC/D,CAAC;QAED,KAAK,GAAG,eAAe,CAAC;QACxB,MAAM,IAAI,GAAG,MAAM,gBAAgB,CAAC,MAAM,EAAE,MAAM,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;QACtE,MAAM,OAAO,GAAG,IAAI,KAAK,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,GAAG,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC;QACtF,IAAI,OAAO,KAAK,MAAM,EAAE,CAAC;YACvB,KAAK,GAAG,aAAa,CAAC;YACtB,MAAM,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACzC,CAAC;QAED,KAAK,GAAG,SAAS,CAAC;QAClB,UAAU,CAAC,KAAK,EAAE,KAAK,EAAE,SAAS,CAAC,CAAC;QACpC,MAAM,YAAY,GAAG,MAAM,mBAAmB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QAC/D,UAAU,CAAC,KAAK,EAAE,KAAK,EAAE,WAAW,CAAC,CAAC;QAEtC,MAAM,SAAS,GAAG,gBAAgB,CAAC,OAAO,CAAC,YAAY,EAAE,YAAY,CAAC;YACpE,CAAC,CAAC,OAAO;YACT,CAAC,CAAC,EAAE,GAAG,OAAO,EAAE,YAAY,EAAE,CAAC;QACjC,IAAI,SAAS,KAAK,OAAO,EAAE,CAAC;YAC1B,KAAK,GAAG,cAAc,CAAC;YACvB,UAAU,CAAC,KAAK,EAAE,KAAK,EAAE,SAAS,CAAC,CAAC;YACpC,SAAS,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;YACxD,UAAU,CAAC,KAAK,EAAE,KAAK,EAAE,WAAW,CAAC,CAAC;QACxC,CAAC;QAED,KAAK,GAAG,aAAa,CAAC;QACtB,UAAU,CAAC,KAAK,EAAE,KAAK,EAAE,SAAS,CAAC,CAAC;QACpC,MAAM,UAAU,GAAG,MAAM,kBAAkB,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QAC3D,UAAU,CAAC,KAAK,EAAE,KAAK,EAAE,WAAW,CAAC,CAAC;QAEtC,KAAK,GAAG,SAAS,CAAC;QAClB,OAAO,GAAG,MAAM,aAAa,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;QAChD,IAAI,SAAS,KAAK,OAAO,EAAE,CAAC;YAC1B,KAAK,GAAG,aAAa,CAAC;YACtB,MAAM,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YACzC,SAAS,GAAG,IAAI,CAAC;QACnB,CAAC;QACD,OAAO;YACL,MAAM,EAAE,OAAO;YACf,QAAQ,EAAE,MAAM,CAAC,SAAS;YAC1B,UAAU,EAAE,WAAW,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;YAC9C,MAAM,EAAE,WAAW,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;YACtC,YAAY,EAAE,SAAS,CAAC,YAAY;YACpC,UAAU;YACV,OAAO;SACR,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,OAAO;YAAE,MAAM,OAAO,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QACzD,IAAI,SAAS;YAAE,MAAM,KAAK,CAAC,SAAS,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QAChF,MAAM,OAAO,GAAG,YAAY,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QAC3C,UAAU,CAAC,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,QAAQ,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;QACzD,MAAM,OAAO,CAAC;IAChB,CAAC;AACH,CAAC"}
+{"version":3,"file":"machine-setup.js","sourceRoot":"","sources":["../../src/identity/machine-setup.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EACL,cAAc,EACd,mBAAmB,EACnB,eAAe,EACf,oBAAoB,GACrB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,eAAe,EAAE,gBAAgB,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC;AAO1E,OAAO,EAAE,+BAA+B,EAAE,MAAM,qCAAqC,CAAC;AAGtF,MAAM,MAAM,GAAG,CAAC,KAAc,EAAe,EAAE,CAAC,CAC9C,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAa,CAAC,CAAC,CAAC,IAAI,CACnF,CAAC;AACF,MAAM,WAAW,GAAG,CAAC,KAAc,EAAU,EAAE,CAAC,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;AAahG,MAAM,OAAO,iBAAkB,SAAQ,KAAK;IACjC,KAAK,CAAoB;IACzB,IAAI,CAAS;IACb,WAAW,CAAU;IAE9B,YAAY,KAAwB,EAAE,IAAY,EAAE,WAAW,GAAG,KAAK,EAAE,OAAsB;QAC7F,KAAK,CAAC,+BAA+B,KAAK,KAAK,IAAI,EAAE,EAAE,OAAO,CAAC,CAAC;QAChE,IAAI,CAAC,IAAI,GAAG,mBAAmB,CAAC;QAChC,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;QACnB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,WAAW,GAAG,WAAW,CAAC;IACjC,CAAC;CACF;AAmJD,SAAS,UAAU,CACjB,KAAwB,EACxB,KAAwB,EACxB,MAA0C,EAC1C,IAAa;IAEb,KAAK,CAAC,WAAW,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;AACxE,CAAC;AAED,SAAS,YAAY,CAAC,KAAwB,EAAE,KAAc;IAC5D,IAAI,KAAK,YAAY,iBAAiB;QAAE,OAAO,KAAK,CAAC;IACrD,MAAM,IAAI,GAAG,WAAW,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,MAAM,CAAC,CAAC,IAAI,kBAAkB,CAAC;IACxE,MAAM,WAAW,GAAG,KAAK,KAAK,UAAU,IAAI,KAAK,KAAK,aAAa,CAAC;IACpE,OAAO,IAAI,iBAAiB,CAAC,KAAK,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;AAChH,CAAC;AAED,KAAK,UAAU,YAAY,CAAC,KAAwB;IAClD,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC;IAChD,IAAI,QAAQ,IAAI,gBAAgB,CAAC,QAAQ,CAAC,SAAS,CAAC;QAAE,OAAO,QAAQ,CAAC;IACtE,MAAM,MAAM,GAAG,EAAE,SAAS,EAAE,WAAW,CAAC,KAAK,CAAC,UAAU,EAAE,CAAC,EAAE,UAAU,EAAE,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC;IAC1F,MAAM,KAAK,CAAC,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACrC,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,wEAAwE;AACxE,MAAM,UAAU,iBAAiB,CAAC,KAAuB,EAAE,QAAgB;IACzE,OAAO;QACL,SAAS,EAAE,QAAQ;QACnB,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,WAAW,EAAE,KAAK,CAAC,UAAU;QAC7B,aAAa,EAAE,KAAK,CAAC,YAAY;QACjC,MAAM,EAAE,KAAK,CAAC,MAAM;KACrB,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,iBAAiB,CAC9B,KAAuB,EACvB,QAAgB,EAChB,KAAwB;IAExB,MAAM,IAAI,GAAG,iBAAiB,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;IAChD,IAAI,KAAK,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;QAClC,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,YAAY,CAAC,MAAM,CAAC;YAC/C,GAAG,IAAI;YACP,UAAU,EAAE,eAAe,CAAC,KAAK,CAAC,SAAS,CAAC;SAC7C,CAAC,CAAC;QACH,MAAM,KAAK,GAAG,WAAW,CAAC,QAAQ,CAAC,2BAA2B,CAAC,CAAC;QAChE,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,iBAAiB,CAAC,UAAU,EAAE,4BAA4B,CAAC,CAAC;QAClF,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,YAAY,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACrD,IACE,CAAC,WAAW,CAAC,OAAO,CAAC,WAAW,CAAC;WAC9B,CAAC,WAAW,CAAC,OAAO,CAAC,UAAU,CAAC;WAChC,CAAC,WAAW,CAAC,OAAO,CAAC,gBAAgB,CAAC,EACzC,CAAC;QACD,MAAM,IAAI,iBAAiB,CAAC,UAAU,EAAE,wBAAwB,CAAC,CAAC;IACpE,CAAC;IACD,MAAM,KAAK,CAAC,YAAY,CAAC,SAAS,CAAC;QACjC,eAAe,EAAE,OAAO,CAAC,gBAAgB;QACzC,SAAS,EAAE,OAAO,CAAC,UAAU;KAC9B,CAAC,CAAC;IACH,MAAM,QAAQ,GAAG,KAAK,CAAC,KAAK,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,MAAM,CAAC,OAAO,CAAC,UAAU,IAAI,GAAG,CAAC,CAAC,GAAG,IAAI,CAAC;IACxF,IAAI,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,CAAC,OAAO,CAAC,QAAQ,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC;IACjE,OAAO,KAAK,CAAC,KAAK,EAAE,GAAG,QAAQ,EAAE,CAAC;QAChC,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,EAAE,GAAG,IAAI,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC;QAC5F,IAAI,MAAM,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;YACjC,MAAM,KAAK,GAAG,WAAW,CAAC,MAAM,CAAC,2BAA2B,CAAC,CAAC;YAC9D,IAAI,CAAC,KAAK;gBAAE,MAAM,IAAI,iBAAiB,CAAC,UAAU,EAAE,4BAA4B,CAAC,CAAC;YAClF,OAAO,KAAK,CAAC;QACf,CAAC;QACD,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YAChC,MAAM,IAAI,iBAAiB,CAAC,UAAU,EAAE,SAAS,MAAM,CAAC,MAAM,EAAE,EAAE,MAAM,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC;QACjG,CAAC;QACD,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,CAAC,MAAM,CAAC,QAAQ,IAAI,QAAQ,GAAG,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC;QAC1E,MAAM,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IAC9B,CAAC;IACD,MAAM,IAAI,iBAAiB,CAAC,UAAU,EAAE,eAAe,EAAE,IAAI,CAAC,CAAC;AACjE,CAAC;AAED,SAAS,kBAAkB,CACzB,QAAiB,EACjB,KAAuB,EACvB,QAAgB,EAChB,MAAc;IAEd,MAAM,UAAU,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC;IACpC,IAAI,CAAC,UAAU;QAAE,MAAM,IAAI,iBAAiB,CAAC,cAAc,EAAE,+BAA+B,CAAC,CAAC;IAC9F,IAAI,WAAW,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC,KAAK,QAAQ,EAAE,CAAC;QACtD,MAAM,IAAI,iBAAiB,CAAC,cAAc,EAAE,4BAA4B,CAAC,CAAC;IAC5E,CAAC;IACD,KAAK,MAAM,GAAG,IAAI;QAChB,aAAa,EAAE,SAAS,EAAE,YAAY,EAAE,cAAc,EAAE,YAAY;QACpE,qBAAqB;KACtB,EAAE,CAAC;QACF,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;YAClC,MAAM,IAAI,iBAAiB,CAAC,cAAc,EAAE,WAAW,GAAG,EAAE,CAAC,CAAC;QAChE,CAAC;IACH,CAAC;IACD,OAAO;QACL,GAAG,UAAU;QACb,OAAO,EAAE,KAAK,CAAC,MAAM;QACrB,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,WAAW,EAAE,KAAK,CAAC,UAAU;QAC7B,aAAa,EAAE,KAAK,CAAC,YAAY;QACjC,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,aAAa,EAAE,MAAM;KACtB,CAAC;AACJ,CAAC;AAED,SAAS,kBAAkB,CAAC,MAAY;IACtC,MAAM,QAAQ,GAAG;QACf,MAAM,EAAE,WAAW,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QACtC,SAAS,EAAE,WAAW,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,WAAW,EAAE;QAC1D,QAAQ,EAAE,WAAW,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;KAC3C,CAAC;IACF,IAAI,CAAC,QAAQ,CAAC,MAAM;QAAE,MAAM,IAAI,iBAAiB,CAAC,aAAa,EAAE,iBAAiB,CAAC,CAAC;IACpF,IAAI,CAAC,QAAQ,CAAC,SAAS;QAAE,MAAM,IAAI,iBAAiB,CAAC,aAAa,EAAE,oBAAoB,CAAC,CAAC;IAC1F,IAAI,CAAC,QAAQ,CAAC,QAAQ;QAAE,MAAM,IAAI,iBAAiB,CAAC,aAAa,EAAE,mBAAmB,CAAC,CAAC;IACxF,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,gBAAgB,CACvB,QAA+C,EAC/C,QAA4B;IAE5B,IAAI,QAAQ,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM,EAAE,CAAC;QACxC,MAAM,IAAI,iBAAiB,CAAC,aAAa,EAAE,sBAAsB,CAAC,CAAC;IACrE,CAAC;IACD,IAAI,QAAQ,CAAC,SAAS,CAAC,WAAW,EAAE,KAAK,QAAQ,CAAC,SAAS,EAAE,CAAC;QAC5D,MAAM,IAAI,iBAAiB,CAAC,aAAa,EAAE,uBAAuB,CAAC,CAAC;IACtE,CAAC;IACD,IAAI,QAAQ,CAAC,QAAQ,KAAK,QAAQ,CAAC,QAAQ,EAAE,CAAC;QAC5C,MAAM,IAAI,iBAAiB,CAAC,aAAa,EAAE,wBAAwB,CAAC,CAAC;IACvE,CAAC;IACD,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;QACrC,MAAM,IAAI,iBAAiB,CAAC,aAAa,EAAE,qBAAqB,CAAC,CAAC;IACpE,CAAC;IACD,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;QAC/C,MAAM,IAAI,iBAAiB,CAAC,aAAa,EAAE,2BAA2B,CAAC,CAAC;IAC1E,CAAC;IACD,IAAI,CAAC,CAAC,aAAa,EAAE,cAAc,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QACnF,MAAM,IAAI,iBAAiB,CAAC,aAAa,EAAE,qBAAqB,CAAC,CAAC;IACpE,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,QAAQ,CAAC,WAAW,GAAG,CAAC,EAAE,CAAC;QAC5E,MAAM,IAAI,iBAAiB,CAAC,aAAa,EAAE,yBAAyB,CAAC,CAAC;IACxE,CAAC;IACD,IAAI,QAAQ,CAAC,QAAQ,KAAK,IAAI,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,QAAQ,CAAC,YAAY,CAAC;WACzE,QAAQ,CAAC,YAAY,GAAG,CAAC,EAAE,CAAC;QAC/B,MAAM,IAAI,iBAAiB,CAAC,aAAa,EAAE,yBAAyB,CAAC,CAAC;IACxE,CAAC;AACH,CAAC;AAED,KAAK,UAAU,kBAAkB,CAAC,MAAY,EAAE,KAAwB;IACtE,MAAM,QAAQ,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAAC;IAC5C,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,UAAU,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAC3D,gBAAgB,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;IACrC,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,QAAQ,CAAC,OAAsB;IACtC,OAAO,eAAe,CAAC,OAAO,CAAC,YAAY,EAAE,OAAO,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC;AACzE,CAAC;AAED,SAAS,uBAAuB,CAC9B,OAAsB,EACtB,KAAwB;IAExB,OAAO,mBAAmB,CAAC,OAAO,CAAC,UAAU,CAAC;QAC5C,CAAC,CAAC,EAAE,GAAG,OAAO,EAAE,UAAU,EAAE,cAAc,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,EAAE;QAC5E,CAAC,CAAC,OAAO,CAAC;AACd,CAAC;AAED,SAAS,gBAAgB,CAAC,IAAsB,EAAE,KAAuB;IACvE,OAAO,IAAI,CAAC,SAAS,KAAK,KAAK,CAAC,SAAS;WACpC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,SAAS,CAAC;WAClE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;AACxE,CAAC;AAED,KAAK,UAAU,mBAAmB,CAChC,MAAqB,EACrB,KAAwB;IAExB,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;IAC3C,MAAM,SAAS,GAAG,MAAM,CAAC,YAAY,CAAC,SAAS,KAAK,KAAK;QACvD,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,SAAS,CAAC;IAClC,OAAO,+BAA+B,CAAC,OAAO,EAAE,SAAS,EAAE,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;AACrF,CAAC;AAED,SAAS,aAAa,CAAC,OAAsB,EAAE,QAAyB;IACtE,MAAM,MAAM,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC;IACjC,MAAM,MAAM,GAAG,WAAW,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC;IAC9C,MAAM,UAAU,GAAG,WAAW,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC;IACtD,MAAM,QAAQ,GAAG,WAAW,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC;IAClD,IAAI,QAAQ,CAAC,MAAM,KAAK,MAAM;QAAE,MAAM,IAAI,iBAAiB,CAAC,SAAS,EAAE,yBAAyB,CAAC,CAAC;IAClG,IAAI,QAAQ,CAAC,UAAU,KAAK,UAAU;QAAE,MAAM,IAAI,iBAAiB,CAAC,SAAS,EAAE,2BAA2B,CAAC,CAAC;IAC5G,IAAI,QAAQ,CAAC,QAAQ,KAAK,QAAQ;QAAE,MAAM,IAAI,iBAAiB,CAAC,SAAS,EAAE,yBAAyB,CAAC,CAAC;IACtG,IAAI,CAAC,QAAQ,CAAC,oBAAoB;QAAE,MAAM,IAAI,iBAAiB,CAAC,SAAS,EAAE,2BAA2B,CAAC,CAAC;IACxG,IAAI,QAAQ,CAAC,YAAY,CAAC,MAAM,KAAK,MAAM,IAAI,QAAQ,CAAC,YAAY,CAAC,UAAU,KAAK,UAAU,EAAE,CAAC;QAC/F,MAAM,IAAI,iBAAiB,CAAC,SAAS,EAAE,wBAAwB,CAAC,CAAC;IACnE,CAAC;IACD,IAAI,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,YAAY,CAAC,QAAQ,CAAC,EAAE,CAAC;QACxF,MAAM,IAAI,iBAAiB,CAAC,SAAS,EAAE,0BAA0B,CAAC,CAAC;IACrE,CAAC;AACH,CAAC;AAED,KAAK,UAAU,aAAa,CAAC,OAAsB,EAAE,KAAwB;IAC3E,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACnD,IAAI,CAAC;QACH,aAAa,CAAC,OAAO,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;QACzC,OAAO,OAAO,CAAC;IACjB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,OAAO,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QAC5C,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED,iFAAiF;AACjF,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,KAAuB,EAAE,KAAwB;IACjF,IAAI,KAAK,GAAsB,QAAQ,CAAC;IACxC,IAAI,SAAS,GAA4B,IAAI,CAAC;IAC9C,IAAI,OAAO,GAA0B,IAAI,CAAC;IAC1C,IAAI,CAAC;QACH,UAAU,CAAC,KAAK,EAAE,KAAK,EAAE,SAAS,CAAC,CAAC;QACpC,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,KAAK,CAAC,CAAC;QACzC,UAAU,CAAC,KAAK,EAAE,KAAK,EAAE,WAAW,CAAC,CAAC;QAEtC,KAAK,GAAG,UAAU,CAAC;QACnB,UAAU,CAAC,KAAK,EAAE,KAAK,EAAE,SAAS,CAAC,CAAC;QACpC,MAAM,KAAK,GAAG,MAAM,iBAAiB,CAAC,KAAK,EAAE,MAAM,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;QACtE,UAAU,CAAC,KAAK,EAAE,KAAK,EAAE,WAAW,CAAC,CAAC;QAEtC,KAAK,GAAG,cAAc,CAAC;QACvB,UAAU,CAAC,KAAK,EAAE,KAAK,EAAE,SAAS,CAAC,CAAC;QACpC,MAAM,UAAU,GAAG,MAAM,KAAK,CAAC,YAAY,CAAC,QAAQ,CAClD,KAAK,EACL,iBAAiB,CAAC,KAAK,EAAE,MAAM,CAAC,SAAS,CAAC,CAC3C,CAAC;QACF,MAAM,MAAM,GAAG,kBAAkB,CAAC,UAAU,EAAE,KAAK,EAAE,MAAM,CAAC,SAAS,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;QACvF,UAAU,CAAC,KAAK,EAAE,KAAK,EAAE,WAAW,CAAC,CAAC;QAEtC,MAAM,IAAI,GAAG,cAAc,CAAC,MAAM,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;QAEjD,KAAK,GAAG,SAAS,CAAC;QAClB,UAAU,CAAC,KAAK,EAAE,KAAK,EAAE,SAAS,CAAC,CAAC;QACpC,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;QAC3C,MAAM,YAAY,GAAG,+BAA+B,CAAC,OAAO,EAAE,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QACtG,UAAU,CAAC,KAAK,EAAE,KAAK,EAAE,WAAW,CAAC,CAAC;QAEtC,KAAK,GAAG,cAAc,CAAC;QACvB,UAAU,CAAC,KAAK,EAAE,KAAK,EAAE,SAAS,CAAC,CAAC;QACpC,SAAS,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;QACxD,UAAU,CAAC,KAAK,EAAE,KAAK,EAAE,WAAW,CAAC,CAAC;QAEtC,MAAM,MAAM,GAAkB;YAC5B,YAAY,EAAE,oBAAoB,CAAC,MAAM,CAAC;YAC1C,UAAU,EAAE,IAAI;YAChB,YAAY;YACZ,KAAK,EAAE,KAAK;SACb,CAAC;QACF,KAAK,GAAG,aAAa,CAAC;QACtB,UAAU,CAAC,KAAK,EAAE,KAAK,EAAE,SAAS,CAAC,CAAC;QACpC,MAAM,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACtC,UAAU,CAAC,KAAK,EAAE,KAAK,EAAE,WAAW,CAAC,CAAC;QAEtC,KAAK,GAAG,aAAa,CAAC;QACtB,UAAU,CAAC,KAAK,EAAE,KAAK,EAAE,SAAS,CAAC,CAAC;QACpC,MAAM,UAAU,GAAG,MAAM,kBAAkB,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QAC3D,UAAU,CAAC,KAAK,EAAE,KAAK,EAAE,WAAW,CAAC,CAAC;QAEtC,KAAK,GAAG,SAAS,CAAC;QAClB,UAAU,CAAC,KAAK,EAAE,KAAK,EAAE,SAAS,CAAC,CAAC;QACpC,MAAM,SAAS,GAAG,MAAM,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC;QAClD,IAAI,CAAC,SAAS;YAAE,MAAM,IAAI,iBAAiB,CAAC,KAAK,EAAE,yBAAyB,CAAC,CAAC;QAC9E,OAAO,GAAG,MAAM,aAAa,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;QAChD,MAAM,OAAO,CAAC,IAAI,EAAE,CAAC;QACrB,OAAO,GAAG,IAAI,CAAC;QACf,MAAM,WAAW,GAAG,MAAM,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC;QACpD,IAAI,CAAC,WAAW;YAAE,MAAM,IAAI,iBAAiB,CAAC,KAAK,EAAE,uBAAuB,CAAC,CAAC;QAC9E,OAAO,GAAG,MAAM,aAAa,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC;QAClD,UAAU,CAAC,KAAK,EAAE,KAAK,EAAE,WAAW,CAAC,CAAC;QAEtC,KAAK,GAAG,OAAO,CAAC;QAChB,UAAU,CAAC,KAAK,EAAE,KAAK,EAAE,SAAS,CAAC,CAAC;QACpC,MAAM,KAAK,CAAC,YAAY,CAAC,SAAS,EAAE,CAAC;QACrC,UAAU,CAAC,KAAK,EAAE,KAAK,EAAE,WAAW,CAAC,CAAC;QACtC,OAAO;YACL,MAAM,EAAE,OAAO;YACf,QAAQ,EAAE,MAAM,CAAC,SAAS;YAC1B,UAAU,EAAE,WAAW,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;YAC9C,MAAM,EAAE,WAAW,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;YACtC,YAAY;YACZ,UAAU;YACV,OAAO;SACR,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,OAAO;YAAE,MAAM,OAAO,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QACzD,IAAI,SAAS;YAAE,MAAM,KAAK,CAAC,SAAS,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QAChF,MAAM,OAAO,GAAG,YAAY,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QAC3C,UAAU,CAAC,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,QAAQ,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;QACzD,MAAM,OAAO,CAAC;IAChB,CAAC;AACH,CAAC;AAED,mFAAmF;AACnF,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,KAAwB;IAC1D,IAAI,KAAK,GAAsB,aAAa,CAAC;IAC7C,IAAI,OAAO,GAA0B,IAAI,CAAC;IAC1C,IAAI,SAAS,GAA4B,IAAI,CAAC;IAC9C,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,KAAK,CAAC,CAAC;QACzC,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC;QAC/C,IAAI,CAAC,MAAM,EAAE,KAAK;YAAE,MAAM,IAAI,iBAAiB,CAAC,KAAK,EAAE,kBAAkB,EAAE,IAAI,CAAC,CAAC;QACjF,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC;QAChC,IAAI,WAAW,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,KAAK,MAAM,CAAC,SAAS,EAAE,CAAC;YAC1D,MAAM,IAAI,iBAAiB,CAAC,KAAK,EAAE,wBAAwB,CAAC,CAAC;QAC/D,CAAC;QAED,MAAM,OAAO,GAAG,uBAAuB,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QACvD,IAAI,OAAO,KAAK,MAAM,EAAE,CAAC;YACvB,KAAK,GAAG,aAAa,CAAC;YACtB,MAAM,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACzC,CAAC;QAED,KAAK,GAAG,SAAS,CAAC;QAClB,UAAU,CAAC,KAAK,EAAE,KAAK,EAAE,SAAS,CAAC,CAAC;QACpC,MAAM,YAAY,GAAG,MAAM,mBAAmB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QAC/D,UAAU,CAAC,KAAK,EAAE,KAAK,EAAE,WAAW,CAAC,CAAC;QAEtC,MAAM,SAAS,GAAG,gBAAgB,CAAC,OAAO,CAAC,YAAY,EAAE,YAAY,CAAC;YACpE,CAAC,CAAC,OAAO;YACT,CAAC,CAAC,EAAE,GAAG,OAAO,EAAE,YAAY,EAAE,CAAC;QACjC,IAAI,SAAS,KAAK,OAAO,EAAE,CAAC;YAC1B,KAAK,GAAG,cAAc,CAAC;YACvB,UAAU,CAAC,KAAK,EAAE,KAAK,EAAE,SAAS,CAAC,CAAC;YACpC,SAAS,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;YACxD,UAAU,CAAC,KAAK,EAAE,KAAK,EAAE,WAAW,CAAC,CAAC;QACxC,CAAC;QAED,KAAK,GAAG,aAAa,CAAC;QACtB,UAAU,CAAC,KAAK,EAAE,KAAK,EAAE,SAAS,CAAC,CAAC;QACpC,MAAM,UAAU,GAAG,MAAM,kBAAkB,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QAC3D,UAAU,CAAC,KAAK,EAAE,KAAK,EAAE,WAAW,CAAC,CAAC;QAEtC,KAAK,GAAG,SAAS,CAAC;QAClB,OAAO,GAAG,MAAM,aAAa,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;QAChD,IAAI,SAAS,KAAK,OAAO,EAAE,CAAC;YAC1B,KAAK,GAAG,aAAa,CAAC;YACtB,MAAM,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YACzC,SAAS,GAAG,IAAI,CAAC;QACnB,CAAC;QACD,OAAO;YACL,MAAM,EAAE,OAAO;YACf,QAAQ,EAAE,MAAM,CAAC,SAAS;YAC1B,UAAU,EAAE,WAAW,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;YAC9C,MAAM,EAAE,WAAW,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;YACtC,YAAY,EAAE,SAAS,CAAC,YAAY;YACpC,UAAU;YACV,OAAO;SACR,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,OAAO;YAAE,MAAM,OAAO,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QACzD,IAAI,SAAS;YAAE,MAAM,KAAK,CAAC,SAAS,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QAChF,MAAM,OAAO,GAAG,YAAY,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QAC3C,UAAU,CAAC,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,QAAQ,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;QACzD,MAAM,OAAO,CAAC;IAChB,CAAC;AACH,CAAC"}

package/docs/authorization.md

@@ -23,6 +23,9 @@ needs.
 6. A machine key is pinned once. Replacement requires an explicit, browser-
    approved recovery bound to the expected old thumbprint and a different
    candidate key; retrying an already completed replacement is idempotent.
+7. Provider access is memory-only. Registration and machine resume never
+   persist an access token, DPoP proof, or provider proxy credential; resume
+   removes retired proxy and HMAC fields left by older installations.
 
 ## Public surface
 
@@ -36,4 +39,5 @@ Import `@amalgm/core/authorization` for:
 
 The default access lifetime is 15 minutes. Cached credentials refresh at least
 two minutes early, with up to 30 seconds of jitter. DPoP proofs are one-request
-artifacts and are never cached.
+artifacts and are never cached. The durable machine credential and P-256
+private key stay in the Shell host; products receive neither.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@amalgm/core",
-  "version": "0.3.2",
+  "version": "0.4.1",
   "description": "The Amalgm kernel SDK — identity, transport, supervision, and host capability contracts behind host-injected adapters.",
   "type": "module",
   "license": "UNLICENSED",
@@ -66,7 +66,9 @@
     "node": ">=18"
   },
   "scripts": {
-    "build": "tsc -p tsconfig.json",
+    "clean": "node -e \"require('node:fs').rmSync('dist',{recursive:true,force:true})\"",
+    "build": "npm run clean && tsc -p tsconfig.json",
+    "prepack": "npm run build",
     "test": "npm run build && node --test",
     "examine:machine-setup": "npm run build && node --test tests/supervision/installation-plan.test.js tests/machine-setup/examination.test.js",
     "examine:user-ground": "npm run build && npm --prefix ../amalgm-live run build && node --test examinations/user-ground/login.examination.mjs"

package/dist/identity/local/resolve.d.ts

@@ -1,7 +0,0 @@
-import type { LocalHarness } from './types.js';
-export declare function resolveLocalAgentEnv(agentId: LocalHarness['id'] | string, authMode: string, proxyToken?: string, proxyBaseUrl?: string): Record<string, string>;
-export declare function localReauthCommand(agentId: string): {
-    shell: string;
-    description: string;
-} | null;
-//# sourceMappingURL=resolve.d.ts.map

package/dist/identity/local/resolve.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"resolve.d.ts","sourceRoot":"","sources":["../../../src/identity/local/resolve.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAE/C,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,YAAY,CAAC,IAAI,CAAC,GAAG,MAAM,EACpC,QAAQ,EAAE,MAAM,EAChB,UAAU,CAAC,EAAE,MAAM,EACnB,YAAY,CAAC,EAAE,MAAM,GACpB,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAexB;AAED,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,MAAM,GAAG;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAajG"}

package/dist/identity/local/resolve.js

@@ -1,32 +0,0 @@
-export function resolveLocalAgentEnv(agentId, authMode, proxyToken, proxyBaseUrl) {
-    if (authMode !== 'amalgm' || !proxyToken || !proxyBaseUrl)
-        return {};
-    const base = proxyBaseUrl.replace(/\/+$/, '');
-    switch (agentId) {
-        case 'claude_code':
-            return { ANTHROPIC_API_KEY: proxyToken, ANTHROPIC_BASE_URL: `${base}/anthropic` };
-        case 'codex':
-            return { OPENAI_API_KEY: proxyToken, OPENAI_BASE_URL: `${base}/openai/v1` };
-        case 'opencode':
-            return { AI_GATEWAY_API_KEY: proxyToken, AI_GATEWAY_BASE_URL: `${base}/ai_gateway/v3/ai` };
-        case 'pi':
-            return { AI_GATEWAY_API_KEY: proxyToken, AI_GATEWAY_BASE_URL: `${base}/ai_gateway/v1` };
-        default:
-            return {};
-    }
-}
-export function localReauthCommand(agentId) {
-    switch (agentId) {
-        case 'claude_code': return { shell: 'claude', description: 'Run `claude`, then type /login to authenticate.' };
-        case 'codex': return { shell: 'codex login', description: '`codex login` walks through OAuth or API-key setup.' };
-        case 'opencode': return { shell: 'opencode auth login', description: '`opencode auth login` walks through provider setup.' };
-        case 'pi': return { shell: 'pi --terminal-login', description: '`pi --terminal-login` authenticates Pi in the terminal.' };
-        case 'amp': return { shell: 'amp --setup', description: '`amp --setup` configures Amp credentials.' };
-        case 'cursor': return {
-            shell: 'if command -v cursor-agent >/dev/null 2>&1; then cursor-agent login; else "$HOME/.local/bin/cursor-agent" login; fi',
-            description: '`cursor-agent login` opens the browser login flow.',
-        };
-        default: return null;
-    }
-}
-//# sourceMappingURL=resolve.js.map

package/dist/identity/local/resolve.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"resolve.js","sourceRoot":"","sources":["../../../src/identity/local/resolve.ts"],"names":[],"mappings":"AAEA,MAAM,UAAU,oBAAoB,CAClC,OAAoC,EACpC,QAAgB,EAChB,UAAmB,EACnB,YAAqB;IAErB,IAAI,QAAQ,KAAK,QAAQ,IAAI,CAAC,UAAU,IAAI,CAAC,YAAY;QAAE,OAAO,EAAE,CAAC;IACrE,MAAM,IAAI,GAAG,YAAY,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAC9C,QAAQ,OAAO,EAAE,CAAC;QAChB,KAAK,aAAa;YAChB,OAAO,EAAE,iBAAiB,EAAE,UAAU,EAAE,kBAAkB,EAAE,GAAG,IAAI,YAAY,EAAE,CAAC;QACpF,KAAK,OAAO;YACV,OAAO,EAAE,cAAc,EAAE,UAAU,EAAE,eAAe,EAAE,GAAG,IAAI,YAAY,EAAE,CAAC;QAC9E,KAAK,UAAU;YACb,OAAO,EAAE,kBAAkB,EAAE,UAAU,EAAE,mBAAmB,EAAE,GAAG,IAAI,mBAAmB,EAAE,CAAC;QAC7F,KAAK,IAAI;YACP,OAAO,EAAE,kBAAkB,EAAE,UAAU,EAAE,mBAAmB,EAAE,GAAG,IAAI,gBAAgB,EAAE,CAAC;QAC1F;YACE,OAAO,EAAE,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,OAAe;IAChD,QAAQ,OAAO,EAAE,CAAC;QAChB,KAAK,aAAa,CAAC,CAAC,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,WAAW,EAAE,iDAAiD,EAAE,CAAC;QAC/G,KAAK,OAAO,CAAC,CAAC,OAAO,EAAE,KAAK,EAAE,aAAa,EAAE,WAAW,EAAE,qDAAqD,EAAE,CAAC;QAClH,KAAK,UAAU,CAAC,CAAC,OAAO,EAAE,KAAK,EAAE,qBAAqB,EAAE,WAAW,EAAE,qDAAqD,EAAE,CAAC;QAC7H,KAAK,IAAI,CAAC,CAAC,OAAO,EAAE,KAAK,EAAE,qBAAqB,EAAE,WAAW,EAAE,yDAAyD,EAAE,CAAC;QAC3H,KAAK,KAAK,CAAC,CAAC,OAAO,EAAE,KAAK,EAAE,aAAa,EAAE,WAAW,EAAE,2CAA2C,EAAE,CAAC;QACtG,KAAK,QAAQ,CAAC,CAAC,OAAO;YACpB,KAAK,EAAE,qHAAqH;YAC5H,WAAW,EAAE,oDAAoD;SAClE,CAAC;QACF,OAAO,CAAC,CAAC,OAAO,IAAI,CAAC;IACvB,CAAC;AACH,CAAC"}