@amalgm/core 0.4.2 → 0.4.4

package/PURPOSE.md

@@ -100,6 +100,8 @@ that composes an exact Core release with the other product releases.
 17. **Retirement is explicit subtraction.** Every retired Engine prefix stays
     named as evidence but is absent from the active route table, so dead
     compatibility surfaces cannot masquerade as unfinished product work.
+    The retired `/email` compatibility door is owned by neither Core nor
+    Shell; current-user delivery belongs to the standalone Channels product.
 18. **Machine setup is one trust rail with two entrances.** Browser polling and
     an approved setup code converge before the same registration, credential
     split, installation, canonical-runtime, and readiness path;
@@ -125,6 +127,8 @@ that composes an exact Core release with the other product releases.
    credential may mint an audience- and scope-exact access token, but every
    resource request also proves possession of that machine's key; Core owns
    the claims and renewal law while hosts own keys, storage, signing, and HTTP.
+   Behind a proxy, the configured public origin is authority for the DPoP URL;
+   caller-controlled forwarding headers are not.
 23. **Machine key replacement is an explicit recovery, never startup repair.**
     Ordinary registration may pin an absent key or reuse the same key; replacing
     it requires fresh user approval, proof of the candidate private key, and a

package/dist/identity/authorization/dpop.d.ts

@@ -17,4 +17,10 @@ export interface DpopSignerPort {
 /** RFC 9449 htu excludes query and fragment and uses an absolute URI. */
 export declare function normalizeDpopHtu(value: string): string;
 export declare function normalizeDpopMethod(value: string): string;
+/**
+ * Reconstruct the public resource URL behind a reverse proxy without trusting
+ * caller-controlled forwarding headers. Deployment config owns the origin;
+ * the HTTP request contributes only its origin-form path and query.
+ */
+export declare function publicResourceRequestUrl(publicOrigin: string, requestTarget: string): string;
 //# sourceMappingURL=dpop.d.ts.map

package/dist/identity/authorization/dpop.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"dpop.d.ts","sourceRoot":"","sources":["../../../src/identity/authorization/dpop.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;CAC/B;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,SAAS,CAAC,KAAK,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;CACnD;AAED,yEAAyE;AACzE,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAUtD;AAED,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAIzD"}
+{"version":3,"file":"dpop.d.ts","sourceRoot":"","sources":["../../../src/identity/authorization/dpop.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;CAC/B;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,SAAS,CAAC,KAAK,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;CACnD;AAED,yEAAyE;AACzE,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAUtD;AAED,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAIzD;AAED;;;;GAIG;AACH,wBAAgB,wBAAwB,CAAC,YAAY,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,GAAG,MAAM,CAe5F"}

package/dist/identity/authorization/dpop.js

@@ -16,4 +16,24 @@ export function normalizeDpopMethod(value) {
         throw new TypeError('DPoP method is invalid');
     return method;
 }
+/**
+ * Reconstruct the public resource URL behind a reverse proxy without trusting
+ * caller-controlled forwarding headers. Deployment config owns the origin;
+ * the HTTP request contributes only its origin-form path and query.
+ */
+export function publicResourceRequestUrl(publicOrigin, requestTarget) {
+    const origin = new URL(publicOrigin);
+    const loopback = origin.hostname === 'localhost' || origin.hostname === '127.0.0.1';
+    if ((origin.protocol !== 'https:' && !(loopback && origin.protocol === 'http:'))
+        || origin.username
+        || origin.password
+        || origin.pathname !== '/'
+        || origin.search
+        || origin.hash)
+        throw new TypeError('Public resource origin must be an HTTPS origin');
+    if (!requestTarget.startsWith('/') || requestTarget.startsWith('//')) {
+        throw new TypeError('Resource request target must use origin form');
+    }
+    return new URL(requestTarget, origin).toString();
+}
 //# sourceMappingURL=dpop.js.map

package/dist/identity/authorization/dpop.js.map

@@ -1 +1 @@
-{"version":3,"file":"dpop.js","sourceRoot":"","sources":["../../../src/identity/authorization/dpop.ts"],"names":[],"mappings":"AAmBA,yEAAyE;AACzE,MAAM,UAAU,gBAAgB,CAAC,KAAa;IAC5C,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IAC3B,IAAI,CAAC,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;QAChD,MAAM,IAAI,SAAS,CAAC,iCAAiC,CAAC,CAAC;IACzD,CAAC;IACD,GAAG,CAAC,QAAQ,GAAG,EAAE,CAAC;IAClB,GAAG,CAAC,QAAQ,GAAG,EAAE,CAAC;IAClB,GAAG,CAAC,MAAM,GAAG,EAAE,CAAC;IAChB,GAAG,CAAC,IAAI,GAAG,EAAE,CAAC;IACd,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC;AACxB,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,KAAa;IAC/C,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC1C,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC;QAAE,MAAM,IAAI,SAAS,CAAC,wBAAwB,CAAC,CAAC;IAC5E,OAAO,MAAM,CAAC;AAChB,CAAC"}
+{"version":3,"file":"dpop.js","sourceRoot":"","sources":["../../../src/identity/authorization/dpop.ts"],"names":[],"mappings":"AAmBA,yEAAyE;AACzE,MAAM,UAAU,gBAAgB,CAAC,KAAa;IAC5C,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IAC3B,IAAI,CAAC,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;QAChD,MAAM,IAAI,SAAS,CAAC,iCAAiC,CAAC,CAAC;IACzD,CAAC;IACD,GAAG,CAAC,QAAQ,GAAG,EAAE,CAAC;IAClB,GAAG,CAAC,QAAQ,GAAG,EAAE,CAAC;IAClB,GAAG,CAAC,MAAM,GAAG,EAAE,CAAC;IAChB,GAAG,CAAC,IAAI,GAAG,EAAE,CAAC;IACd,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC;AACxB,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,KAAa;IAC/C,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC1C,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC;QAAE,MAAM,IAAI,SAAS,CAAC,wBAAwB,CAAC,CAAC;IAC5E,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,wBAAwB,CAAC,YAAoB,EAAE,aAAqB;IAClF,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,YAAY,CAAC,CAAC;IACrC,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,KAAK,WAAW,IAAI,MAAM,CAAC,QAAQ,KAAK,WAAW,CAAC;IACpF,IACE,CAAC,MAAM,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,CAAC,QAAQ,IAAI,MAAM,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC;WACzE,MAAM,CAAC,QAAQ;WACf,MAAM,CAAC,QAAQ;WACf,MAAM,CAAC,QAAQ,KAAK,GAAG;WACvB,MAAM,CAAC,MAAM;WACb,MAAM,CAAC,IAAI;QACd,MAAM,IAAI,SAAS,CAAC,gDAAgD,CAAC,CAAC;IACxE,IAAI,CAAC,aAAa,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,aAAa,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QACrE,MAAM,IAAI,SAAS,CAAC,8CAA8C,CAAC,CAAC;IACtE,CAAC;IACD,OAAO,IAAI,GAAG,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC,QAAQ,EAAE,CAAC;AACnD,CAAC"}

package/dist/transport/shipped-routes.d.ts

@@ -9,7 +9,7 @@
  * under its own '/pty' handling).
  *
  * Counts, pinned by tests: 3 gateway prefixes, 5 gateway exact paths,
- * 3 port-monitor prefixes, 1 chat prefix, 22 active MCP prefixes.
+ * 3 port-monitor prefixes, 1 chat prefix, 21 active MCP prefixes.
  *
  * This is product configuration riding in the kernel repo for the
  * cutover: the table SHAPE is core's; these CONTENTS belong to the
@@ -23,8 +23,10 @@ import type { RouteTable } from './routing.js';
  * `/tasks` is the superseded SQLite scheduler facade; `/mcp-connections` is
  * the superseded second registry now represented by Tools connection records
  * plus credential references resolved by Core's machine-local vault; `/github`
- * is superseded by the next cloud integration and credential collection model.
+ * is superseded by the next cloud integration and credential collection model;
+ * `/email` was the in-process Notifications compatibility door and is replaced
+ * by the independently deployed Channels product.
  */
-export declare const retiredEngineRoutePrefixes: readonly ["/tasks", "/mcp-connections", "/github"];
+export declare const retiredEngineRoutePrefixes: readonly ["/tasks", "/mcp-connections", "/github", "/email"];
 export declare const shippedRouteTable: RouteTable;
 //# sourceMappingURL=shipped-routes.d.ts.map

package/dist/transport/shipped-routes.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"shipped-routes.d.ts","sourceRoot":"","sources":["../../src/transport/shipped-routes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAE/C;;;;;;GAMG;AACH,eAAO,MAAM,0BAA0B,oDAAqD,CAAC;AAE7F,eAAO,MAAM,iBAAiB,EAAE,UA6B/B,CAAC"}
+{"version":3,"file":"shipped-routes.d.ts","sourceRoot":"","sources":["../../src/transport/shipped-routes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAE/C;;;;;;;;GAQG;AACH,eAAO,MAAM,0BAA0B,8DAA+D,CAAC;AAEvG,eAAO,MAAM,iBAAiB,EAAE,UA4B/B,CAAC"}

package/dist/transport/shipped-routes.js

@@ -9,7 +9,7 @@
  * under its own '/pty' handling).
  *
  * Counts, pinned by tests: 3 gateway prefixes, 5 gateway exact paths,
- * 3 port-monitor prefixes, 1 chat prefix, 22 active MCP prefixes.
+ * 3 port-monitor prefixes, 1 chat prefix, 21 active MCP prefixes.
  *
  * This is product configuration riding in the kernel repo for the
  * cutover: the table SHAPE is core's; these CONTENTS belong to the
@@ -22,9 +22,11 @@
  * `/tasks` is the superseded SQLite scheduler facade; `/mcp-connections` is
  * the superseded second registry now represented by Tools connection records
  * plus credential references resolved by Core's machine-local vault; `/github`
- * is superseded by the next cloud integration and credential collection model.
+ * is superseded by the next cloud integration and credential collection model;
+ * `/email` was the in-process Notifications compatibility door and is replaced
+ * by the independently deployed Channels product.
  */
-export const retiredEngineRoutePrefixes = ['/tasks', '/mcp-connections', '/github'];
+export const retiredEngineRoutePrefixes = ['/tasks', '/mcp-connections', '/github', '/email'];
 export const shippedRouteTable = {
     gatewayPrefixes: ['/__amalgm', '/diagnostics', '/pty'],
     gatewayExactPaths: ['/', '/healthz', '/runtime-state', '/pty/session', '/pty/resize'],
@@ -42,7 +44,6 @@ export const shippedRouteTable = {
         '/state',
         '/local',
         '/credentials',
-        '/email',
         '/slack',
         '/user-api-keys',
         '/apps',

package/dist/transport/shipped-routes.js.map

@@ -1 +1 @@
-{"version":3,"file":"shipped-routes.js","sourceRoot":"","sources":["../../src/transport/shipped-routes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAIH;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,QAAQ,EAAE,kBAAkB,EAAE,SAAS,CAAU,CAAC;AAE7F,MAAM,CAAC,MAAM,iBAAiB,GAAe;IAC3C,eAAe,EAAE,CAAC,WAAW,EAAE,cAAc,EAAE,MAAM,CAAC;IACtD,iBAAiB,EAAE,CAAC,GAAG,EAAE,UAAU,EAAE,gBAAgB,EAAE,cAAc,EAAE,aAAa,CAAC;IACrF,mBAAmB,EAAE,CAAC,YAAY,EAAE,QAAQ,EAAE,eAAe,CAAC;IAC9D,YAAY,EAAE,CAAC,OAAO,CAAC;IACvB,WAAW,EAAE;QACX,MAAM;QACN,SAAS;QACT,cAAc;QACd,iBAAiB;QACjB,YAAY;QACZ,kBAAkB;QAClB,KAAK;QACL,UAAU;QACV,QAAQ;QACR,QAAQ;QACR,cAAc;QACd,QAAQ;QACR,QAAQ;QACR,gBAAgB;QAChB,OAAO;QACP,YAAY;QACZ,SAAS;QACT,eAAe;QACf,gBAAgB;QAChB,SAAS;QACT,mBAAmB;QACnB,UAAU;KACX;CACF,CAAC"}
+{"version":3,"file":"shipped-routes.js","sourceRoot":"","sources":["../../src/transport/shipped-routes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAIH;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,QAAQ,EAAE,kBAAkB,EAAE,SAAS,EAAE,QAAQ,CAAU,CAAC;AAEvG,MAAM,CAAC,MAAM,iBAAiB,GAAe;IAC3C,eAAe,EAAE,CAAC,WAAW,EAAE,cAAc,EAAE,MAAM,CAAC;IACtD,iBAAiB,EAAE,CAAC,GAAG,EAAE,UAAU,EAAE,gBAAgB,EAAE,cAAc,EAAE,aAAa,CAAC;IACrF,mBAAmB,EAAE,CAAC,YAAY,EAAE,QAAQ,EAAE,eAAe,CAAC;IAC9D,YAAY,EAAE,CAAC,OAAO,CAAC;IACvB,WAAW,EAAE;QACX,MAAM;QACN,SAAS;QACT,cAAc;QACd,iBAAiB;QACjB,YAAY;QACZ,kBAAkB;QAClB,KAAK;QACL,UAAU;QACV,QAAQ;QACR,QAAQ;QACR,cAAc;QACd,QAAQ;QACR,gBAAgB;QAChB,OAAO;QACP,YAAY;QACZ,SAAS;QACT,eAAe;QACf,gBAAgB;QAChB,SAAS;QACT,mBAAmB;QACnB,UAAU;KACX;CACF,CAAC"}

package/docs/authorization.md

@@ -16,14 +16,16 @@ needs.
    set, expiry, token id, signing key, and device-key thumbprint.
 3. Every resource request has a fresh DPoP proof bound to its method, URL,
    access token, and machine key.
-4. The broker caches an exact grant, refreshes before expiry with jitter,
+4. A proxied resource reconstructs that URL from its configured public origin
+   and the origin-form request target; forwarding headers are not authority.
+5. The broker caches an exact grant, refreshes before expiry with jitter,
    single-flights concurrent renewal, and performs no silent auth fallback.
-5. Audiences and scopes are closed sets. Adding a consumer changes this module
+6. Audiences and scopes are closed sets. Adding a consumer changes this module
    and its tests before any issuer or verifier accepts it.
-6. A machine key is pinned once. Replacement requires an explicit, browser-
+7. A machine key is pinned once. Replacement requires an explicit, browser-
    approved recovery bound to the expected old thumbprint and a different
    candidate key; retrying an already completed replacement is idempotent.
-7. Provider access is memory-only. Registration and machine resume never
+8. Provider access is memory-only. Registration and machine resume never
    persist an access token, DPoP proof, or provider proxy credential; resume
    removes retired proxy and HMAC fields left by older installations.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@amalgm/core",
-  "version": "0.4.2",
+  "version": "0.4.4",
   "description": "The Amalgm kernel SDK — identity, transport, supervision, and host capability contracts behind host-injected adapters.",
   "type": "module",
   "license": "UNLICENSED",