@amalgm/core 0.4.1 → 0.4.3

package/PURPOSE.md

@@ -100,6 +100,8 @@ that composes an exact Core release with the other product releases.
 17. **Retirement is explicit subtraction.** Every retired Engine prefix stays
     named as evidence but is absent from the active route table, so dead
     compatibility surfaces cannot masquerade as unfinished product work.
+    The retired `/email` compatibility door is owned by neither Core nor
+    Shell; current-user delivery belongs to the standalone Channels product.
 18. **Machine setup is one trust rail with two entrances.** Browser polling and
     an approved setup code converge before the same registration, credential
     split, installation, canonical-runtime, and readiness path;

package/dist/identity/authorization/index.d.ts

@@ -2,5 +2,6 @@ export * from './policy.js';
 export * from './claims.js';
 export * from './dpop.js';
 export * from './broker.js';
+export * from './resource.js';
 export * from './key-transition.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/identity/authorization/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/identity/authorization/index.ts"],"names":[],"mappings":"AAAA,cAAc,aAAa,CAAC;AAC5B,cAAc,aAAa,CAAC;AAC5B,cAAc,WAAW,CAAC;AAC1B,cAAc,aAAa,CAAC;AAC5B,cAAc,qBAAqB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/identity/authorization/index.ts"],"names":[],"mappings":"AAAA,cAAc,aAAa,CAAC;AAC5B,cAAc,aAAa,CAAC;AAC5B,cAAc,WAAW,CAAC;AAC1B,cAAc,aAAa,CAAC;AAC5B,cAAc,eAAe,CAAC;AAC9B,cAAc,qBAAqB,CAAC"}

package/dist/identity/authorization/index.js

@@ -2,5 +2,6 @@ export * from './policy.js';
 export * from './claims.js';
 export * from './dpop.js';
 export * from './broker.js';
+export * from './resource.js';
 export * from './key-transition.js';
 //# sourceMappingURL=index.js.map

package/dist/identity/authorization/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/identity/authorization/index.ts"],"names":[],"mappings":"AAAA,cAAc,aAAa,CAAC;AAC5B,cAAc,aAAa,CAAC;AAC5B,cAAc,WAAW,CAAC;AAC1B,cAAc,aAAa,CAAC;AAC5B,cAAc,qBAAqB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/identity/authorization/index.ts"],"names":[],"mappings":"AAAA,cAAc,aAAa,CAAC;AAC5B,cAAc,aAAa,CAAC;AAC5B,cAAc,WAAW,CAAC;AAC1B,cAAc,aAAa,CAAC;AAC5B,cAAc,eAAe,CAAC;AAC9B,cAAc,qBAAqB,CAAC"}

package/dist/identity/authorization/policy.d.ts

@@ -2,6 +2,8 @@
 export declare const AUTHORIZATION_POLICY: Readonly<{
     readonly 'amalgm-api-proxy': readonly string[];
     readonly 'amalgm-apps': readonly string[];
+    readonly 'amalgm-automations': readonly string[];
+    readonly 'amalgm-channels': readonly string[];
 }>;
 export type AuthorizationAudience = keyof typeof AUTHORIZATION_POLICY;
 export type AuthorizationScope = (typeof AUTHORIZATION_POLICY)[AuthorizationAudience][number];

package/dist/identity/authorization/policy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"policy.d.ts","sourceRoot":"","sources":["../../../src/identity/authorization/policy.ts"],"names":[],"mappings":"AAAA,6EAA6E;AAC7E,eAAO,MAAM,oBAAoB;;;EAatB,CAAC;AAEZ,MAAM,MAAM,qBAAqB,GAAG,MAAM,OAAO,oBAAoB,CAAC;AACtE,MAAM,MAAM,kBAAkB,GAAG,CAAC,OAAO,oBAAoB,CAAC,CAAC,qBAAqB,CAAC,CAAC,MAAM,CAAC,CAAC;AAE9F,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,qBAAqB,CAEtF;AAED,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,qBAAqB,GAAG,SAAS,kBAAkB,EAAE,CAEhG;AAED,wBAAgB,eAAe,CAC7B,QAAQ,EAAE,qBAAqB,EAC/B,MAAM,EAAE,SAAS,MAAM,EAAE,GACxB,SAAS,kBAAkB,EAAE,CAQ/B;AAED,qBAAa,wBAAyB,SAAQ,KAAK;IACjD,QAAQ,CAAC,IAAI,EAAE,iBAAiB,GAAG,mBAAmB,CAAC;gBAE3C,IAAI,EAAE,iBAAiB,GAAG,mBAAmB;CAO1D"}
+{"version":3,"file":"policy.d.ts","sourceRoot":"","sources":["../../../src/identity/authorization/policy.ts"],"names":[],"mappings":"AAAA,6EAA6E;AAC7E,eAAO,MAAM,oBAAoB;;;;;EAuBtB,CAAC;AAEZ,MAAM,MAAM,qBAAqB,GAAG,MAAM,OAAO,oBAAoB,CAAC;AACtE,MAAM,MAAM,kBAAkB,GAAG,CAAC,OAAO,oBAAoB,CAAC,CAAC,qBAAqB,CAAC,CAAC,MAAM,CAAC,CAAC;AAE9F,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,qBAAqB,CAEtF;AAED,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,qBAAqB,GAAG,SAAS,kBAAkB,EAAE,CAEhG;AAED,wBAAgB,eAAe,CAC7B,QAAQ,EAAE,qBAAqB,EAC/B,MAAM,EAAE,SAAS,MAAM,EAAE,GACxB,SAAS,kBAAkB,EAAE,CAQ/B;AAED,qBAAa,wBAAyB,SAAQ,KAAK;IACjD,QAAQ,CAAC,IAAI,EAAE,iBAAiB,GAAG,mBAAmB,CAAC;gBAE3C,IAAI,EAAE,iBAAiB,GAAG,mBAAmB;CAO1D"}

package/dist/identity/authorization/policy.js

@@ -12,6 +12,16 @@ export const AUTHORIZATION_POLICY = Object.freeze({
         'apps:read',
         'apps:run',
     ]),
+    'amalgm-automations': Object.freeze([
+        'automations:read',
+        'automations:write',
+        'runs:execute',
+        'runs:read',
+    ]),
+    'amalgm-channels': Object.freeze([
+        'channels:read',
+        'channels:send',
+    ]),
 });
 export function isAuthorizationAudience(value) {
     return typeof value === 'string' && value in AUTHORIZATION_POLICY;

package/dist/identity/authorization/policy.js.map

@@ -1 +1 @@
-{"version":3,"file":"policy.js","sourceRoot":"","sources":["../../../src/identity/authorization/policy.ts"],"names":[],"mappings":"AAAA,6EAA6E;AAC7E,MAAM,CAAC,MAAM,oBAAoB,GAAG,MAAM,CAAC,MAAM,CAAC;IAChD,kBAAkB,EAAE,MAAM,CAAC,MAAM,CAAC;QAChC,eAAe;QACf,aAAa;QACb,YAAY;QACZ,YAAY;QACZ,SAAS;KACV,CAAC;IACF,aAAa,EAAE,MAAM,CAAC,MAAM,CAAC;QAC3B,aAAa;QACb,WAAW;QACX,UAAU;KACX,CAAC;CACM,CAAC,CAAC;AAKZ,MAAM,UAAU,uBAAuB,CAAC,KAAc;IACpD,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,IAAI,oBAAoB,CAAC;AACpE,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,QAA+B;IAC/D,OAAO,oBAAoB,CAAC,QAAQ,CAAC,CAAC;AACxC,CAAC;AAED,MAAM,UAAU,eAAe,CAC7B,QAA+B,EAC/B,MAAyB;IAEzB,MAAM,OAAO,GAAG,IAAI,GAAG,CAAS,iBAAiB,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC7D,MAAM,MAAM,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;IACpC,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,wBAAwB,CAAC,iBAAiB,CAAC,CAAC;IAC/E,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;QAChD,MAAM,IAAI,wBAAwB,CAAC,mBAAmB,CAAC,CAAC;IAC1D,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAkC,CAAC;AACvE,CAAC;AAED,MAAM,OAAO,wBAAyB,SAAQ,KAAK;IACxC,IAAI,CAA0C;IAEvD,YAAY,IAA6C;QACvD,KAAK,CAAC,IAAI,KAAK,iBAAiB;YAC9B,CAAC,CAAC,8CAA8C;YAChD,CAAC,CAAC,sDAAsD,CAAC,CAAC;QAC5D,IAAI,CAAC,IAAI,GAAG,0BAA0B,CAAC;QACvC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;CACF"}
+{"version":3,"file":"policy.js","sourceRoot":"","sources":["../../../src/identity/authorization/policy.ts"],"names":[],"mappings":"AAAA,6EAA6E;AAC7E,MAAM,CAAC,MAAM,oBAAoB,GAAG,MAAM,CAAC,MAAM,CAAC;IAChD,kBAAkB,EAAE,MAAM,CAAC,MAAM,CAAC;QAChC,eAAe;QACf,aAAa;QACb,YAAY;QACZ,YAAY;QACZ,SAAS;KACV,CAAC;IACF,aAAa,EAAE,MAAM,CAAC,MAAM,CAAC;QAC3B,aAAa;QACb,WAAW;QACX,UAAU;KACX,CAAC;IACF,oBAAoB,EAAE,MAAM,CAAC,MAAM,CAAC;QAClC,kBAAkB;QAClB,mBAAmB;QACnB,cAAc;QACd,WAAW;KACZ,CAAC;IACF,iBAAiB,EAAE,MAAM,CAAC,MAAM,CAAC;QAC/B,eAAe;QACf,eAAe;KAChB,CAAC;CACM,CAAC,CAAC;AAKZ,MAAM,UAAU,uBAAuB,CAAC,KAAc;IACpD,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,IAAI,oBAAoB,CAAC;AACpE,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,QAA+B;IAC/D,OAAO,oBAAoB,CAAC,QAAQ,CAAC,CAAC;AACxC,CAAC;AAED,MAAM,UAAU,eAAe,CAC7B,QAA+B,EAC/B,MAAyB;IAEzB,MAAM,OAAO,GAAG,IAAI,GAAG,CAAS,iBAAiB,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC7D,MAAM,MAAM,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;IACpC,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,wBAAwB,CAAC,iBAAiB,CAAC,CAAC;IAC/E,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;QAChD,MAAM,IAAI,wBAAwB,CAAC,mBAAmB,CAAC,CAAC;IAC1D,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAkC,CAAC;AACvE,CAAC;AAED,MAAM,OAAO,wBAAyB,SAAQ,KAAK;IACxC,IAAI,CAA0C;IAEvD,YAAY,IAA6C;QACvD,KAAK,CAAC,IAAI,KAAK,iBAAiB;YAC9B,CAAC,CAAC,8CAA8C;YAChD,CAAC,CAAC,sDAAsD,CAAC,CAAC;QAC5D,IAAI,CAAC,IAAI,GAAG,0BAA0B,CAAC;QACvC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;CACF"}

package/dist/identity/authorization/resource.d.ts

@@ -0,0 +1,39 @@
+import { type AuthorizationAudience, type AuthorizationScope } from './policy.js';
+export interface VerifiedJwt {
+    readonly header: Readonly<Record<string, unknown>>;
+    readonly claims: Readonly<Record<string, unknown>>;
+}
+export interface MachineResourceVerifierPorts {
+    verifyAccessToken(token: string): Promise<VerifiedJwt>;
+    verifyDpopProof(proof: string): Promise<VerifiedJwt>;
+    jwkThumbprint(jwk: Readonly<Record<string, unknown>>): Promise<string>;
+    accessTokenHash(token: string): Promise<string>;
+    consumeProof(keyThumbprint: string, jti: string): Promise<boolean>;
+    nowSeconds(): number;
+}
+export interface MachineResourceRequest {
+    readonly authorization: string | null | undefined;
+    readonly dpop: string | null | undefined;
+    readonly method: string;
+    readonly url: string;
+    readonly issuer: string;
+    readonly audience: AuthorizationAudience;
+    readonly requiredScopes: readonly AuthorizationScope[];
+}
+export interface AuthorizedMachinePrincipal {
+    readonly userId: string;
+    readonly computerId: string;
+    readonly clientId: 'amalgm-shell';
+    readonly scopes: readonly AuthorizationScope[];
+    readonly keyThumbprint: string;
+}
+/**
+ * The one resource-server decision for every hosted Amalgm product. Crypto
+ * and shared replay persistence are injected; claims and DPoP law stay here.
+ */
+export declare function authorizeMachineResource(request: MachineResourceRequest, ports: MachineResourceVerifierPorts): Promise<AuthorizedMachinePrincipal>;
+export declare class MachineResourceAuthorizationError extends Error {
+    readonly code: string;
+    constructor(code: string);
+}
+//# sourceMappingURL=resource.d.ts.map

package/dist/identity/authorization/resource.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resource.d.ts","sourceRoot":"","sources":["../../../src/identity/authorization/resource.ts"],"names":[],"mappings":"AAOA,OAAO,EAEL,KAAK,qBAAqB,EAC1B,KAAK,kBAAkB,EACxB,MAAM,aAAa,CAAC;AAErB,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IACnD,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;CACpD;AAED,MAAM,WAAW,4BAA4B;IAC3C,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;IACvD,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;IACrD,aAAa,CAAC,GAAG,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IACvE,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAChD,YAAY,CAAC,aAAa,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACnE,UAAU,IAAI,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,aAAa,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC;IAClD,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC;IACzC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,QAAQ,EAAE,qBAAqB,CAAC;IACzC,QAAQ,CAAC,cAAc,EAAE,SAAS,kBAAkB,EAAE,CAAC;CACxD;AAED,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,QAAQ,EAAE,cAAc,CAAC;IAClC,QAAQ,CAAC,MAAM,EAAE,SAAS,kBAAkB,EAAE,CAAC;IAC/C,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;CAChC;AAED;;;GAGG;AACH,wBAAsB,wBAAwB,CAC5C,OAAO,EAAE,sBAAsB,EAC/B,KAAK,EAAE,4BAA4B,GAClC,OAAO,CAAC,0BAA0B,CAAC,CAwErC;AA8DD,qBAAa,iCAAkC,SAAQ,KAAK;IAC1D,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;gBAEV,IAAI,EAAE,MAAM;CAKzB"}

package/dist/identity/authorization/resource.js

@@ -0,0 +1,132 @@
+import { ACCESS_TOKEN_CLOCK_SKEW_SECONDS, ACCESS_TOKEN_TTL_SECONDS, DPOP_PROOF_MAX_AGE_SECONDS, scopesFromClaim, } from './claims.js';
+import { normalizeDpopHtu, normalizeDpopMethod } from './dpop.js';
+import { canonicalScopes, } from './policy.js';
+/**
+ * The one resource-server decision for every hosted Amalgm product. Crypto
+ * and shared replay persistence are injected; claims and DPoP law stay here.
+ */
+export async function authorizeMachineResource(request, ports) {
+    const token = dpopAccessToken(request.authorization);
+    const proofValue = requiredText(request.dpop, 'dpop_required');
+    const now = ports.nowSeconds();
+    if (!Number.isInteger(now))
+        throw new MachineResourceAuthorizationError('invalid_clock');
+    const access = await verified(() => ports.verifyAccessToken(token), 'invalid_access_token');
+    assertHeader(access.header, 'at+jwt', false);
+    const claims = access.claims;
+    if (claims.iss !== request.issuer || claims.aud !== request.audience) {
+        throw new MachineResourceAuthorizationError('access_target_mismatch');
+    }
+    const issuedAt = integerClaim(claims.iat, 'invalid_access_claims');
+    const expiresAt = integerClaim(claims.exp, 'invalid_access_claims');
+    if (issuedAt > now + ACCESS_TOKEN_CLOCK_SKEW_SECONDS
+        || expiresAt <= now - ACCESS_TOKEN_CLOCK_SKEW_SECONDS
+        || expiresAt - issuedAt > ACCESS_TOKEN_TTL_SECONDS)
+        throw new MachineResourceAuthorizationError('invalid_access_lifetime');
+    const userId = claimText(claims.sub, 'invalid_access_claims');
+    const computerId = claimText(claims.computer_id, 'invalid_access_claims');
+    if (claims.client_id !== 'amalgm-shell') {
+        throw new MachineResourceAuthorizationError('invalid_client');
+    }
+    claimText(claims.jti, 'invalid_access_claims');
+    const confirmation = record(claims.cnf, 'invalid_access_claims');
+    const keyThumbprint = claimText(confirmation.jkt, 'invalid_access_claims');
+    if (!/^[A-Za-z0-9_-]{43}$/.test(keyThumbprint)) {
+        throw new MachineResourceAuthorizationError('invalid_access_claims');
+    }
+    const rawScopes = scopesFromClaim(claims.scope);
+    let scopes;
+    try {
+        scopes = canonicalScopes(request.audience, rawScopes);
+    }
+    catch {
+        throw new MachineResourceAuthorizationError('invalid_scope');
+    }
+    const requiredScopes = canonicalScopes(request.audience, request.requiredScopes);
+    if (requiredScopes.some((scope) => !scopes.includes(scope))) {
+        throw new MachineResourceAuthorizationError('insufficient_scope');
+    }
+    const proof = await verified(() => ports.verifyDpopProof(proofValue), 'invalid_dpop_proof');
+    const publicJwk = assertHeader(proof.header, 'dpop+jwt', true);
+    const proofClaims = proof.claims;
+    if (proofClaims.htm !== normalizeDpopMethod(request.method)
+        || proofClaims.htu !== normalizeDpopHtu(request.url)
+        || proofClaims.ath !== await ports.accessTokenHash(token))
+        throw new MachineResourceAuthorizationError('dpop_target_mismatch');
+    const proofIat = integerClaim(proofClaims.iat, 'invalid_dpop_claims');
+    const proofJti = claimText(proofClaims.jti, 'invalid_dpop_claims');
+    if (Math.abs(now - proofIat) > DPOP_PROOF_MAX_AGE_SECONDS
+        || proofJti.length > 200)
+        throw new MachineResourceAuthorizationError('invalid_dpop_claims');
+    if (await ports.jwkThumbprint(publicJwk) !== keyThumbprint) {
+        throw new MachineResourceAuthorizationError('dpop_key_mismatch');
+    }
+    if (!await ports.consumeProof(keyThumbprint, proofJti)) {
+        throw new MachineResourceAuthorizationError('dpop_replayed');
+    }
+    return Object.freeze({
+        userId,
+        computerId,
+        clientId: 'amalgm-shell',
+        scopes,
+        keyThumbprint,
+    });
+}
+function dpopAccessToken(value) {
+    const match = value?.match(/^DPoP\s+(\S+)$/);
+    if (!match?.[1])
+        throw new MachineResourceAuthorizationError('dpop_access_required');
+    return match[1];
+}
+function assertHeader(header, type, requiresJwk) {
+    if (header.typ !== type || header.alg !== 'ES256') {
+        throw new MachineResourceAuthorizationError('invalid_jwt_header');
+    }
+    if (!requiresJwk)
+        return Object.freeze({});
+    const jwk = record(header.jwk, 'invalid_jwt_header');
+    if (jwk.kty !== 'EC'
+        || jwk.crv !== 'P-256'
+        || typeof jwk.x !== 'string'
+        || typeof jwk.y !== 'string'
+        || 'd' in jwk)
+        throw new MachineResourceAuthorizationError('invalid_jwt_header');
+    return jwk;
+}
+async function verified(operation, code) {
+    try {
+        return await operation();
+    }
+    catch {
+        throw new MachineResourceAuthorizationError(code);
+    }
+}
+function requiredText(value, code) {
+    if (typeof value !== 'string' || !value.trim()) {
+        throw new MachineResourceAuthorizationError(code);
+    }
+    return value.trim();
+}
+function claimText(value, code) {
+    return requiredText(value, code);
+}
+function integerClaim(value, code) {
+    if (!Number.isInteger(value))
+        throw new MachineResourceAuthorizationError(code);
+    return value;
+}
+function record(value, code) {
+    if (!value || typeof value !== 'object' || Array.isArray(value)) {
+        throw new MachineResourceAuthorizationError(code);
+    }
+    return value;
+}
+export class MachineResourceAuthorizationError extends Error {
+    code;
+    constructor(code) {
+        super(code);
+        this.name = 'MachineResourceAuthorizationError';
+        this.code = code;
+    }
+}
+//# sourceMappingURL=resource.js.map

package/dist/identity/authorization/resource.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resource.js","sourceRoot":"","sources":["../../../src/identity/authorization/resource.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,+BAA+B,EAC/B,wBAAwB,EACxB,0BAA0B,EAC1B,eAAe,GAChB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,MAAM,WAAW,CAAC;AAClE,OAAO,EACL,eAAe,GAGhB,MAAM,aAAa,CAAC;AAkCrB;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,OAA+B,EAC/B,KAAmC;IAEnC,MAAM,KAAK,GAAG,eAAe,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;IACrD,MAAM,UAAU,GAAG,YAAY,CAAC,OAAO,CAAC,IAAI,EAAE,eAAe,CAAC,CAAC;IAC/D,MAAM,GAAG,GAAG,KAAK,CAAC,UAAU,EAAE,CAAC;IAC/B,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC;QAAE,MAAM,IAAI,iCAAiC,CAAC,eAAe,CAAC,CAAC;IAEzF,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,iBAAiB,CAAC,KAAK,CAAC,EAAE,sBAAsB,CAAC,CAAC;IAC5F,YAAY,CAAC,MAAM,CAAC,MAAM,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC;IAC7C,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;IAC7B,IAAI,MAAM,CAAC,GAAG,KAAK,OAAO,CAAC,MAAM,IAAI,MAAM,CAAC,GAAG,KAAK,OAAO,CAAC,QAAQ,EAAE,CAAC;QACrE,MAAM,IAAI,iCAAiC,CAAC,wBAAwB,CAAC,CAAC;IACxE,CAAC;IACD,MAAM,QAAQ,GAAG,YAAY,CAAC,MAAM,CAAC,GAAG,EAAE,uBAAuB,CAAC,CAAC;IACnE,MAAM,SAAS,GAAG,YAAY,CAAC,MAAM,CAAC,GAAG,EAAE,uBAAuB,CAAC,CAAC;IACpE,IACE,QAAQ,GAAG,GAAG,GAAG,+BAA+B;WAC7C,SAAS,IAAI,GAAG,GAAG,+BAA+B;WAClD,SAAS,GAAG,QAAQ,GAAG,wBAAwB;QAClD,MAAM,IAAI,iCAAiC,CAAC,yBAAyB,CAAC,CAAC;IAEzE,MAAM,MAAM,GAAG,SAAS,CAAC,MAAM,CAAC,GAAG,EAAE,uBAAuB,CAAC,CAAC;IAC9D,MAAM,UAAU,GAAG,SAAS,CAAC,MAAM,CAAC,WAAW,EAAE,uBAAuB,CAAC,CAAC;IAC1E,IAAI,MAAM,CAAC,SAAS,KAAK,cAAc,EAAE,CAAC;QACxC,MAAM,IAAI,iCAAiC,CAAC,gBAAgB,CAAC,CAAC;IAChE,CAAC;IACD,SAAS,CAAC,MAAM,CAAC,GAAG,EAAE,uBAAuB,CAAC,CAAC;IAC/C,MAAM,YAAY,GAAG,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,uBAAuB,CAAC,CAAC;IACjE,MAAM,aAAa,GAAG,SAAS,CAAC,YAAY,CAAC,GAAG,EAAE,uBAAuB,CAAC,CAAC;IAC3E,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,aAAa,CAAC,EAAE,CAAC;QAC/C,MAAM,IAAI,iCAAiC,CAAC,uBAAuB,CAAC,CAAC;IACvE,CAAC;IAED,MAAM,SAAS,GAAG,eAAe,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAChD,IAAI,MAAqC,CAAC;IAC1C,IAAI,CAAC;QACH,MAAM,GAAG,eAAe,CAAC,OAAO,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;IACxD,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,iCAAiC,CAAC,eAAe,CAAC,CAAC;IAC/D,CAAC;IACD,MAAM,cAAc,GAAG,eAAe,CAAC,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,cAAc,CAAC,CAAC;IACjF,IAAI,cAAc,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;QAC5D,MAAM,IAAI,iCAAiC,CAAC,oBAAoB,CAAC,CAAC;IACpE,CAAC;IAED,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,eAAe,CAAC,UAAU,CAAC,EAAE,oBAAoB,CAAC,CAAC;IAC5F,MAAM,SAAS,GAAG,YAAY,CAAC,KAAK,CAAC,MAAM,EAAE,UAAU,EAAE,IAAI,CAAC,CAAC;IAC/D,MAAM,WAAW,GAAG,KAAK,CAAC,MAAM,CAAC;IACjC,IACE,WAAW,CAAC,GAAG,KAAK,mBAAmB,CAAC,OAAO,CAAC,MAAM,CAAC;WACpD,WAAW,CAAC,GAAG,KAAK,gBAAgB,CAAC,OAAO,CAAC,GAAG,CAAC;WACjD,WAAW,CAAC,GAAG,KAAK,MAAM,KAAK,CAAC,eAAe,CAAC,KAAK,CAAC;QACzD,MAAM,IAAI,iCAAiC,CAAC,sBAAsB,CAAC,CAAC;IACtE,MAAM,QAAQ,GAAG,YAAY,CAAC,WAAW,CAAC,GAAG,EAAE,qBAAqB,CAAC,CAAC;IACtE,MAAM,QAAQ,GAAG,SAAS,CAAC,WAAW,CAAC,GAAG,EAAE,qBAAqB,CAAC,CAAC;IACnE,IACE,IAAI,CAAC,GAAG,CAAC,GAAG,GAAG,QAAQ,CAAC,GAAG,0BAA0B;WAClD,QAAQ,CAAC,MAAM,GAAG,GAAG;QACxB,MAAM,IAAI,iCAAiC,CAAC,qBAAqB,CAAC,CAAC;IACrE,IAAI,MAAM,KAAK,CAAC,aAAa,CAAC,SAAS,CAAC,KAAK,aAAa,EAAE,CAAC;QAC3D,MAAM,IAAI,iCAAiC,CAAC,mBAAmB,CAAC,CAAC;IACnE,CAAC;IACD,IAAI,CAAC,MAAM,KAAK,CAAC,YAAY,CAAC,aAAa,EAAE,QAAQ,CAAC,EAAE,CAAC;QACvD,MAAM,IAAI,iCAAiC,CAAC,eAAe,CAAC,CAAC;IAC/D,CAAC;IAED,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,MAAM;QACN,UAAU;QACV,QAAQ,EAAE,cAAc;QACxB,MAAM;QACN,aAAa;KACd,CAAC,CAAC;AACL,CAAC;AAED,SAAS,eAAe,CAAC,KAAgC;IACvD,MAAM,KAAK,GAAG,KAAK,EAAE,KAAK,CAAC,gBAAgB,CAAC,CAAC;IAC7C,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;QAAE,MAAM,IAAI,iCAAiC,CAAC,sBAAsB,CAAC,CAAC;IACrF,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC;AAED,SAAS,YAAY,CACnB,MAAyC,EACzC,IAA2B,EAC3B,WAAoB;IAEpB,IAAI,MAAM,CAAC,GAAG,KAAK,IAAI,IAAI,MAAM,CAAC,GAAG,KAAK,OAAO,EAAE,CAAC;QAClD,MAAM,IAAI,iCAAiC,CAAC,oBAAoB,CAAC,CAAC;IACpE,CAAC;IACD,IAAI,CAAC,WAAW;QAAE,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IAC3C,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,oBAAoB,CAAC,CAAC;IACrD,IACE,GAAG,CAAC,GAAG,KAAK,IAAI;WACb,GAAG,CAAC,GAAG,KAAK,OAAO;WACnB,OAAO,GAAG,CAAC,CAAC,KAAK,QAAQ;WACzB,OAAO,GAAG,CAAC,CAAC,KAAK,QAAQ;WACzB,GAAG,IAAI,GAAG;QACb,MAAM,IAAI,iCAAiC,CAAC,oBAAoB,CAAC,CAAC;IACpE,OAAO,GAAG,CAAC;AACb,CAAC;AAED,KAAK,UAAU,QAAQ,CACrB,SAAqC,EACrC,IAAY;IAEZ,IAAI,CAAC;QACH,OAAO,MAAM,SAAS,EAAE,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,iCAAiC,CAAC,IAAI,CAAC,CAAC;IACpD,CAAC;AACH,CAAC;AAED,SAAS,YAAY,CAAC,KAAc,EAAE,IAAY;IAChD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC;QAC/C,MAAM,IAAI,iCAAiC,CAAC,IAAI,CAAC,CAAC;IACpD,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,EAAE,CAAC;AACtB,CAAC;AAED,SAAS,SAAS,CAAC,KAAc,EAAE,IAAY;IAC7C,OAAO,YAAY,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;AACnC,CAAC;AAED,SAAS,YAAY,CAAC,KAAc,EAAE,IAAY;IAChD,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,iCAAiC,CAAC,IAAI,CAAC,CAAC;IAChF,OAAO,KAAe,CAAC;AACzB,CAAC;AAED,SAAS,MAAM,CAAC,KAAc,EAAE,IAAY;IAC1C,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAChE,MAAM,IAAI,iCAAiC,CAAC,IAAI,CAAC,CAAC;IACpD,CAAC;IACD,OAAO,KAA0C,CAAC;AACpD,CAAC;AAED,MAAM,OAAO,iCAAkC,SAAQ,KAAK;IACjD,IAAI,CAAS;IAEtB,YAAY,IAAY;QACtB,KAAK,CAAC,IAAI,CAAC,CAAC;QACZ,IAAI,CAAC,IAAI,GAAG,mCAAmC,CAAC;QAChD,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;CACF"}

package/dist/transport/shipped-routes.d.ts

@@ -9,7 +9,7 @@
  * under its own '/pty' handling).
  *
  * Counts, pinned by tests: 3 gateway prefixes, 5 gateway exact paths,
- * 3 port-monitor prefixes, 1 chat prefix, 22 active MCP prefixes.
+ * 3 port-monitor prefixes, 1 chat prefix, 21 active MCP prefixes.
  *
  * This is product configuration riding in the kernel repo for the
  * cutover: the table SHAPE is core's; these CONTENTS belong to the
@@ -23,8 +23,10 @@ import type { RouteTable } from './routing.js';
  * `/tasks` is the superseded SQLite scheduler facade; `/mcp-connections` is
  * the superseded second registry now represented by Tools connection records
  * plus credential references resolved by Core's machine-local vault; `/github`
- * is superseded by the next cloud integration and credential collection model.
+ * is superseded by the next cloud integration and credential collection model;
+ * `/email` was the in-process Notifications compatibility door and is replaced
+ * by the independently deployed Channels product.
  */
-export declare const retiredEngineRoutePrefixes: readonly ["/tasks", "/mcp-connections", "/github"];
+export declare const retiredEngineRoutePrefixes: readonly ["/tasks", "/mcp-connections", "/github", "/email"];
 export declare const shippedRouteTable: RouteTable;
 //# sourceMappingURL=shipped-routes.d.ts.map

package/dist/transport/shipped-routes.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"shipped-routes.d.ts","sourceRoot":"","sources":["../../src/transport/shipped-routes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAE/C;;;;;;GAMG;AACH,eAAO,MAAM,0BAA0B,oDAAqD,CAAC;AAE7F,eAAO,MAAM,iBAAiB,EAAE,UA6B/B,CAAC"}
+{"version":3,"file":"shipped-routes.d.ts","sourceRoot":"","sources":["../../src/transport/shipped-routes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAE/C;;;;;;;;GAQG;AACH,eAAO,MAAM,0BAA0B,8DAA+D,CAAC;AAEvG,eAAO,MAAM,iBAAiB,EAAE,UA4B/B,CAAC"}

package/dist/transport/shipped-routes.js

@@ -9,7 +9,7 @@
  * under its own '/pty' handling).
  *
  * Counts, pinned by tests: 3 gateway prefixes, 5 gateway exact paths,
- * 3 port-monitor prefixes, 1 chat prefix, 22 active MCP prefixes.
+ * 3 port-monitor prefixes, 1 chat prefix, 21 active MCP prefixes.
  *
  * This is product configuration riding in the kernel repo for the
  * cutover: the table SHAPE is core's; these CONTENTS belong to the
@@ -22,9 +22,11 @@
  * `/tasks` is the superseded SQLite scheduler facade; `/mcp-connections` is
  * the superseded second registry now represented by Tools connection records
  * plus credential references resolved by Core's machine-local vault; `/github`
- * is superseded by the next cloud integration and credential collection model.
+ * is superseded by the next cloud integration and credential collection model;
+ * `/email` was the in-process Notifications compatibility door and is replaced
+ * by the independently deployed Channels product.
  */
-export const retiredEngineRoutePrefixes = ['/tasks', '/mcp-connections', '/github'];
+export const retiredEngineRoutePrefixes = ['/tasks', '/mcp-connections', '/github', '/email'];
 export const shippedRouteTable = {
     gatewayPrefixes: ['/__amalgm', '/diagnostics', '/pty'],
     gatewayExactPaths: ['/', '/healthz', '/runtime-state', '/pty/session', '/pty/resize'],
@@ -42,7 +44,6 @@ export const shippedRouteTable = {
         '/state',
         '/local',
         '/credentials',
-        '/email',
         '/slack',
         '/user-api-keys',
         '/apps',

package/dist/transport/shipped-routes.js.map

@@ -1 +1 @@
-{"version":3,"file":"shipped-routes.js","sourceRoot":"","sources":["../../src/transport/shipped-routes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAIH;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,QAAQ,EAAE,kBAAkB,EAAE,SAAS,CAAU,CAAC;AAE7F,MAAM,CAAC,MAAM,iBAAiB,GAAe;IAC3C,eAAe,EAAE,CAAC,WAAW,EAAE,cAAc,EAAE,MAAM,CAAC;IACtD,iBAAiB,EAAE,CAAC,GAAG,EAAE,UAAU,EAAE,gBAAgB,EAAE,cAAc,EAAE,aAAa,CAAC;IACrF,mBAAmB,EAAE,CAAC,YAAY,EAAE,QAAQ,EAAE,eAAe,CAAC;IAC9D,YAAY,EAAE,CAAC,OAAO,CAAC;IACvB,WAAW,EAAE;QACX,MAAM;QACN,SAAS;QACT,cAAc;QACd,iBAAiB;QACjB,YAAY;QACZ,kBAAkB;QAClB,KAAK;QACL,UAAU;QACV,QAAQ;QACR,QAAQ;QACR,cAAc;QACd,QAAQ;QACR,QAAQ;QACR,gBAAgB;QAChB,OAAO;QACP,YAAY;QACZ,SAAS;QACT,eAAe;QACf,gBAAgB;QAChB,SAAS;QACT,mBAAmB;QACnB,UAAU;KACX;CACF,CAAC"}
+{"version":3,"file":"shipped-routes.js","sourceRoot":"","sources":["../../src/transport/shipped-routes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAIH;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,QAAQ,EAAE,kBAAkB,EAAE,SAAS,EAAE,QAAQ,CAAU,CAAC;AAEvG,MAAM,CAAC,MAAM,iBAAiB,GAAe;IAC3C,eAAe,EAAE,CAAC,WAAW,EAAE,cAAc,EAAE,MAAM,CAAC;IACtD,iBAAiB,EAAE,CAAC,GAAG,EAAE,UAAU,EAAE,gBAAgB,EAAE,cAAc,EAAE,aAAa,CAAC;IACrF,mBAAmB,EAAE,CAAC,YAAY,EAAE,QAAQ,EAAE,eAAe,CAAC;IAC9D,YAAY,EAAE,CAAC,OAAO,CAAC;IACvB,WAAW,EAAE;QACX,MAAM;QACN,SAAS;QACT,cAAc;QACd,iBAAiB;QACjB,YAAY;QACZ,kBAAkB;QAClB,KAAK;QACL,UAAU;QACV,QAAQ;QACR,QAAQ;QACR,cAAc;QACd,QAAQ;QACR,gBAAgB;QAChB,OAAO;QACP,YAAY;QACZ,SAAS;QACT,eAAe;QACf,gBAAgB;QAChB,SAAS;QACT,mBAAmB;QACnB,UAAU;KACX;CACF,CAAC"}

package/docs/authorization.md

@@ -36,6 +36,15 @@ Import `@amalgm/core/authorization` for:
 - URL and method normalization;
 - the closed initial-pin, ordinary-reuse, and explicit-recovery transition;
 - `CredentialBroker`, whose issuer and signer effects are injected by Shell.
+- `authorizeMachineResource`, whose crypto and replay effects are injected by
+  a hosted product while Core makes the one claims-and-DPoP decision.
+
+The closed service grants are:
+
+- `amalgm-api-proxy`: one scope per supported LLM provider;
+- `amalgm-apps`: read, run, and manage apps;
+- `amalgm-automations`: read/write definitions and read/execute runs;
+- `amalgm-channels`: read delivery history and send to the current user.
 
 The default access lifetime is 15 minutes. Cached credentials refresh at least
 two minutes early, with up to 30 seconds of jitter. DPoP proofs are one-request

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@amalgm/core",
-  "version": "0.4.1",
+  "version": "0.4.3",
   "description": "The Amalgm kernel SDK — identity, transport, supervision, and host capability contracts behind host-injected adapters.",
   "type": "module",
   "license": "UNLICENSED",