@amalgm/shell 0.1.0

package/dist/chat-payloads-host.d.ts

@@ -0,0 +1,8 @@
+import type { BrickMount } from "./gateway.js";
+/**
+ * Host effects for the chat brick's machine-payload API. The engine stores
+ * this map in SQLite `local_meta`; the shell preserves the same durable map
+ * contract in its existing system state directory. Record, GC, and HTTP laws
+ * remain in @amalgm/chat.
+ */
+export declare function chatPayloadsMount(stateDir: string): BrickMount;

package/dist/chat-payloads-host.js

@@ -0,0 +1,76 @@
+import { mkdirSync, readFileSync, renameSync, writeFileSync, } from "node:fs";
+import { join } from "node:path";
+import { createChatPayloadApi } from "@amalgm/chat/api";
+import { ChatPayloadStore } from "@amalgm/chat/warm";
+const FILE_NAME = "chat-payloads.json";
+/**
+ * Host effects for the chat brick's machine-payload API. The engine stores
+ * this map in SQLite `local_meta`; the shell preserves the same durable map
+ * contract in its existing system state directory. Record, GC, and HTTP laws
+ * remain in @amalgm/chat.
+ */
+export function chatPayloadsMount(stateDir) {
+    const api = createChatPayloadApi(new ChatPayloadStore({
+        store: fileStore(stateDir),
+        clockIso: () => new Date().toISOString(),
+        clockMs: () => Date.now(),
+    }));
+    return {
+        prefix: "/chat-payloads",
+        stream: async (req, res, pathname) => {
+            const url = new URL(req.url ?? "/", "http://localhost");
+            const request = new Request(`http://chat.local${pathname}${url.search}`, {
+                method: req.method ?? "GET",
+                headers: requestHeaders(req),
+                body: await requestBody(req),
+            });
+            await writeResponse(res, await api(request));
+        },
+    };
+}
+function fileStore(stateDir) {
+    const path = join(stateDir, FILE_NAME);
+    return {
+        read() {
+            try {
+                const parsed = JSON.parse(readFileSync(path, "utf8"));
+                return parsed && typeof parsed === "object" && !Array.isArray(parsed)
+                    ? parsed
+                    : {};
+            }
+            catch {
+                return {};
+            }
+        },
+        write(payloads) {
+            mkdirSync(stateDir, { recursive: true });
+            const temporary = `${path}.${process.pid}.tmp`;
+            writeFileSync(temporary, JSON.stringify(payloads), "utf8");
+            renameSync(temporary, path);
+        },
+    };
+}
+function requestHeaders(req) {
+    const headers = new Headers();
+    for (const [name, value] of Object.entries(req.headers)) {
+        if (typeof value === "string")
+            headers.set(name, value);
+        else if (value)
+            for (const item of value)
+                headers.append(name, item);
+    }
+    return headers;
+}
+async function requestBody(req) {
+    if (req.method === "GET" || req.method === "HEAD")
+        return undefined;
+    const chunks = [];
+    for await (const chunk of req)
+        chunks.push(chunk);
+    return chunks.length ? Buffer.concat(chunks).toString("utf8") : undefined;
+}
+async function writeResponse(res, response) {
+    res.writeHead(response.status, Object.fromEntries(response.headers.entries()));
+    res.end(Buffer.from(await response.arrayBuffer()));
+}
+//# sourceMappingURL=chat-payloads-host.js.map

package/dist/chat-payloads-host.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"chat-payloads-host.js","sourceRoot":"","sources":["../src/chat-payloads-host.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,SAAS,EACT,YAAY,EACZ,UAAU,EACV,aAAa,GACd,MAAM,SAAS,CAAC;AAEjB,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,OAAO,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AACxD,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAKrD,MAAM,SAAS,GAAG,oBAAoB,CAAC;AAEvC;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB,CAAC,QAAgB;IAChD,MAAM,GAAG,GAAG,oBAAoB,CAAC,IAAI,gBAAgB,CAAC;QACpD,KAAK,EAAE,SAAS,CAAC,QAAQ,CAAC;QAC1B,QAAQ,EAAE,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACxC,OAAO,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE;KAC1B,CAAC,CAAC,CAAC;IAEJ,OAAO;QACL,MAAM,EAAE,gBAAgB;QACxB,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,QAAQ,EAAE,EAAE;YACnC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,EAAE,kBAAkB,CAAC,CAAC;YACxD,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,oBAAoB,QAAQ,GAAG,GAAG,CAAC,MAAM,EAAE,EAAE;gBACvE,MAAM,EAAE,GAAG,CAAC,MAAM,IAAI,KAAK;gBAC3B,OAAO,EAAE,cAAc,CAAC,GAAG,CAAC;gBAC5B,IAAI,EAAE,MAAM,WAAW,CAAC,GAAG,CAAC;aAC7B,CAAC,CAAC;YACH,MAAM,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;QAC/C,CAAC;KACF,CAAC;AACJ,CAAC;AAED,SAAS,SAAS,CAAC,QAAgB;IACjC,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;IACvC,OAAO;QACL,IAAI;YACF,IAAI,CAAC;gBACH,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;gBAC/D,OAAO,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;oBACnE,CAAC,CAAC,MAAiC;oBACnC,CAAC,CAAC,EAAE,CAAC;YACT,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,EAAE,CAAC;YACZ,CAAC;QACH,CAAC;QACD,KAAK,CAAC,QAAgD;YACpD,SAAS,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YACzC,MAAM,SAAS,GAAG,GAAG,IAAI,IAAI,OAAO,CAAC,GAAG,MAAM,CAAC;YAC/C,aAAa,CAAC,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,CAAC;YAC3D,UAAU,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;QAC9B,CAAC;KACF,CAAC;AACJ,CAAC;AAED,SAAS,cAAc,CAAC,GAAoB;IAC1C,MAAM,OAAO,GAAG,IAAI,OAAO,EAAE,CAAC;IAC9B,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;QACxD,IAAI,OAAO,KAAK,KAAK,QAAQ;YAAE,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;aACnD,IAAI,KAAK;YAAE,KAAK,MAAM,IAAI,IAAI,KAAK;gBAAE,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IACvE,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,KAAK,UAAU,WAAW,CAAC,GAAoB;IAC7C,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM;QAAE,OAAO,SAAS,CAAC;IACpE,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,GAAG;QAAE,MAAM,CAAC,IAAI,CAAC,KAAe,CAAC,CAAC;IAC5D,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAC5E,CAAC;AAED,KAAK,UAAU,aAAa,CAAC,GAAmB,EAAE,QAAkB;IAClE,GAAG,CAAC,SAAS,CAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,WAAW,CAAC,QAAQ,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;IAC/E,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,QAAQ,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;AACrD,CAAC"}

package/dist/chat-relay-host.d.ts

@@ -0,0 +1,24 @@
+import type { ChatRelayContract, ChatRelayTurn, RelayFetchPort } from "@amalgm/chat/relay";
+import type { BrickMount } from "./gateway.js";
+export interface ChatRelayHostConfig {
+    readonly proxyCredentials: () => Promise<{
+        readonly baseUrl: string;
+        readonly token: string;
+    }>;
+    readonly contractForInput?: (input: Record<string, unknown>) => ChatRelayContract | null;
+    readonly turnForSession: (sessionId: string) => ChatRelayTurn | null;
+    readonly defaultMcpServer?: (contract: ChatRelayContract) => unknown;
+    readonly fetch?: RelayFetchPort;
+}
+/**
+ * Node sockets and the frozen-contract registry for Chat's portable relay API.
+ * Destination, authentication, and header laws remain in @amalgm/chat.
+ */
+export declare class ChatRelayHost {
+    #private;
+    constructor(config: ChatRelayHostConfig);
+    /** First registration owns relay authority for the lifetime of a session. */
+    registerInput(input: Record<string, unknown>, sessionId: string): ChatRelayContract | null;
+    forget(sessionId: string): void;
+    mounts(): BrickMount[];
+}

package/dist/chat-relay-host.js

@@ -0,0 +1,90 @@
+import { createChatRelayApi } from "@amalgm/chat/relay";
+/**
+ * Node sockets and the frozen-contract registry for Chat's portable relay API.
+ * Destination, authentication, and header laws remain in @amalgm/chat.
+ */
+export class ChatRelayHost {
+    #contracts = new Map();
+    #contractForInput;
+    #api;
+    constructor(config) {
+        this.#contractForInput = config.contractForInput;
+        this.#api = createChatRelayApi({
+            contractForSession: (sessionId) => this.#contracts.get(sessionId) ?? null,
+            turnForSession: config.turnForSession,
+            proxyCredentials: config.proxyCredentials,
+            defaultMcpServer: config.defaultMcpServer,
+            fetch: config.fetch ?? globalThis.fetch,
+        });
+    }
+    /** First registration owns relay authority for the lifetime of a session. */
+    registerInput(input, sessionId) {
+        const next = this.#contractForInput?.(input) ?? null;
+        if (!next?.sessionId)
+            return null;
+        if (next.sessionId !== sessionId)
+            return next;
+        const existing = this.#contracts.get(next.sessionId);
+        if (existing)
+            return existing;
+        this.#contracts.set(next.sessionId, next);
+        return next;
+    }
+    forget(sessionId) {
+        this.#contracts.delete(sessionId);
+    }
+    mounts() {
+        return ["/egress", "/mcp-relay"].map((prefix) => ({
+            prefix,
+            stream: async (req, res, pathname) => this.#serve(req, res, pathname),
+        }));
+    }
+    async #serve(req, res, pathname) {
+        try {
+            const response = await this.#api(await fetchRequest(req, pathname));
+            res.writeHead(response.status, Object.fromEntries(response.headers.entries()));
+            if (!response.body) {
+                res.end();
+                return;
+            }
+            const reader = response.body.getReader();
+            while (!res.destroyed) {
+                const chunk = await reader.read();
+                if (chunk.done)
+                    break;
+                res.write(Buffer.from(chunk.value));
+            }
+            if (!res.writableEnded)
+                res.end();
+        }
+        catch (error) {
+            if (res.headersSent || res.destroyed)
+                return;
+            res.writeHead(500, { "content-type": "application/json" });
+            res.end(JSON.stringify({ error: error instanceof Error ? error.message : "internal error" }));
+        }
+    }
+}
+async function fetchRequest(req, pathname) {
+    const url = new URL(req.url ?? pathname, "http://chat.local");
+    const headers = new Headers();
+    for (const [name, value] of Object.entries(req.headers)) {
+        if (Array.isArray(value))
+            for (const item of value)
+                headers.append(name, item);
+        else if (value !== undefined)
+            headers.set(name, value);
+    }
+    const method = req.method ?? "GET";
+    const chunks = [];
+    if (method !== "GET" && method !== "HEAD") {
+        for await (const chunk of req)
+            chunks.push(chunk);
+    }
+    return new Request(`http://chat.local${pathname}${url.search}`, {
+        method,
+        headers,
+        body: chunks.length ? Buffer.concat(chunks) : undefined,
+    });
+}
+//# sourceMappingURL=chat-relay-host.js.map

package/dist/chat-relay-host.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"chat-relay-host.js","sourceRoot":"","sources":["../src/chat-relay-host.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AAiBxD;;;GAGG;AACH,MAAM,OAAO,aAAa;IACf,UAAU,GAAG,IAAI,GAAG,EAA6B,CAAC;IAClD,iBAAiB,CAA2C;IAC5D,IAAI,CAAwC;IAErD,YAAY,MAA2B;QACrC,IAAI,CAAC,iBAAiB,GAAG,MAAM,CAAC,gBAAgB,CAAC;QACjD,IAAI,CAAC,IAAI,GAAG,kBAAkB,CAAC;YAC7B,kBAAkB,EAAE,CAAC,SAAS,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,IAAI;YACzE,cAAc,EAAE,MAAM,CAAC,cAAc;YACrC,gBAAgB,EAAE,MAAM,CAAC,gBAAgB;YACzC,gBAAgB,EAAE,MAAM,CAAC,gBAAgB;YACzC,KAAK,EAAE,MAAM,CAAC,KAAK,IAAI,UAAU,CAAC,KAAK;SACxC,CAAC,CAAC;IACL,CAAC;IAED,6EAA6E;IAC7E,aAAa,CAAC,KAA8B,EAAE,SAAiB;QAC7D,MAAM,IAAI,GAAG,IAAI,CAAC,iBAAiB,EAAE,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC;QACrD,IAAI,CAAC,IAAI,EAAE,SAAS;YAAE,OAAO,IAAI,CAAC;QAClC,IAAI,IAAI,CAAC,SAAS,KAAK,SAAS;YAAE,OAAO,IAAI,CAAC;QAC9C,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACrD,IAAI,QAAQ;YAAE,OAAO,QAAQ,CAAC;QAC9B,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;QAC1C,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,CAAC,SAAiB;QACtB,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IACpC,CAAC;IAED,MAAM;QACJ,OAAO,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;YAChD,MAAM;YACN,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,QAAQ,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,GAAG,EAAE,QAAQ,CAAC;SACtE,CAAC,CAAC,CAAC;IACN,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,GAAoB,EAAE,GAAmB,EAAE,QAAgB;QACtE,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,MAAM,YAAY,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,CAAC;YACpE,GAAG,CAAC,SAAS,CAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,WAAW,CAAC,QAAQ,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;YAC/E,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;gBACnB,GAAG,CAAC,GAAG,EAAE,CAAC;gBACV,OAAO;YACT,CAAC;YACD,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;YACzC,OAAO,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC;gBACtB,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;gBAClC,IAAI,KAAK,CAAC,IAAI;oBAAE,MAAM;gBACtB,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;YACtC,CAAC;YACD,IAAI,CAAC,GAAG,CAAC,aAAa;gBAAE,GAAG,CAAC,GAAG,EAAE,CAAC;QACpC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,GAAG,CAAC,WAAW,IAAI,GAAG,CAAC,SAAS;gBAAE,OAAO;YAC7C,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;YAC3D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,gBAAgB,EAAE,CAAC,CAAC,CAAC;QAChG,CAAC;IACH,CAAC;CACF;AAED,KAAK,UAAU,YAAY,CAAC,GAAoB,EAAE,QAAgB;IAChE,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,QAAQ,EAAE,mBAAmB,CAAC,CAAC;IAC9D,MAAM,OAAO,GAAG,IAAI,OAAO,EAAE,CAAC;IAC9B,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;QACxD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;YAAE,KAAK,MAAM,IAAI,IAAI,KAAK;gBAAE,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;aAC1E,IAAI,KAAK,KAAK,SAAS;YAAE,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACzD,CAAC;IACD,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,IAAI,KAAK,CAAC;IACnC,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,IAAI,MAAM,KAAK,KAAK,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;QAC1C,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,GAAG;YAAE,MAAM,CAAC,IAAI,CAAC,KAAe,CAAC,CAAC;IAC9D,CAAC;IACD,OAAO,IAAI,OAAO,CAAC,oBAAoB,QAAQ,GAAG,GAAG,CAAC,MAAM,EAAE,EAAE;QAC9D,MAAM;QACN,OAAO;QACP,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS;KACxD,CAAC,CAAC;AACL,CAAC"}

package/dist/cli.d.ts

@@ -0,0 +1 @@
+export declare function runCli(argv?: string[]): Promise<number>;

package/dist/cli.js

@@ -0,0 +1,157 @@
+import { spawn } from "node:child_process";
+import { MachineSetupError } from "@amalgm/core/identity";
+import { MachineHost, defaultMachineName } from "./machine-host.js";
+const VERSION = "0.1.0";
+export async function runCli(argv = process.argv) {
+    const parsed = parseArguments(argv.slice(2));
+    if (parsed.command === "help" || parsed.options.help) {
+        process.stdout.write(helpText());
+        return 0;
+    }
+    if (parsed.command === "version" || parsed.options.version) {
+        process.stdout.write(`${VERSION}\n`);
+        return 0;
+    }
+    if (!["login", "run", "status"].includes(parsed.command)) {
+        process.stderr.write(`Unknown command: ${parsed.command}\n\n${helpText()}`);
+        return 2;
+    }
+    const appUrl = option(parsed, "app-url") || process.env.AMALGM_APP_URL || "https://amalgm.ai";
+    const userEmail = option(parsed, "user") || undefined;
+    const host = new MachineHost({
+        homedir: option(parsed, "home") || undefined,
+        amalgmRoot: option(parsed, "amalgm-root") || undefined,
+        userEmail,
+        appUrl,
+        runtimeVersion: VERSION,
+        runtimeLabel: option(parsed, "runtime-label") || "main",
+        branch: option(parsed, "branch") || "main",
+        proxyUrl: option(parsed, "proxy-url") || undefined,
+        runtimePort: numericOption(parsed, "port"),
+        showSetup: async ({ verificationUrl, setupCode }) => {
+            process.stdout.write([
+                "",
+                "Open this URL in a browser to finish login:",
+                verificationUrl,
+                "",
+                `Setup code: ${setupCode}`,
+                "",
+            ].join("\n"));
+            if (!parsed.options["no-open"])
+                openBrowser(verificationUrl);
+        },
+        diagnostic: (event) => {
+            process.stdout.write(`AMALGM_SETUP ${JSON.stringify(event)}\n`);
+        },
+    });
+    try {
+        if (parsed.command === "status") {
+            const paths = host.selectedPaths();
+            process.stdout.write(`${JSON.stringify({
+                user: userEmail,
+                deviceFile: host.deviceFile,
+                userRoot: paths.userRoot,
+                machineDir: paths.machineDir,
+                database: `${paths.machineDir}/live/identity.db`,
+            }, null, 2)}\n`);
+            return 0;
+        }
+        const ready = parsed.command === "login"
+            ? await host.join({
+                name: option(parsed, "name") || defaultMachineName(),
+                ...(option(parsed, "setup-code") ? { setupCode: option(parsed, "setup-code") } : {}),
+            })
+            : await host.resume();
+        process.stdout.write(`AMALGM_READY ${JSON.stringify({
+            userId: ready.userId,
+            computerId: ready.computerId,
+            deviceId: ready.deviceId,
+            userRoot: ready.userGround.localRoot,
+            cloudHead: ready.userGround.cloudHead,
+            cloudMode: ready.userGround.mode,
+            entities: ready.userGround.entityCount,
+            watchers: ready.userGround.watcherRoots,
+            services: ready.installation.services,
+        })}\n`);
+        if (parsed.options["exit-after-ready"]) {
+            await ready.runtime.stop();
+            return 0;
+        }
+        await waitForShutdown();
+        return 0;
+    }
+    catch (error) {
+        if (error instanceof MachineSetupError) {
+            process.stderr.write(`Machine setup failed at ${error.stage}: ${error.code}\n`);
+        }
+        else {
+            process.stderr.write(`${error instanceof Error ? error.message : String(error)}\n`);
+        }
+        return 1;
+    }
+    finally {
+        await host.close();
+    }
+}
+function parseArguments(args) {
+    const remaining = [...args];
+    const command = remaining.shift() || "help";
+    const options = {};
+    const positionals = [];
+    for (let index = 0; index < remaining.length; index += 1) {
+        const argument = remaining[index];
+        if (!argument.startsWith("--")) {
+            positionals.push(argument);
+            continue;
+        }
+        const separator = argument.indexOf("=");
+        if (separator !== -1) {
+            options[argument.slice(2, separator)] = argument.slice(separator + 1);
+            continue;
+        }
+        const key = argument.slice(2);
+        const next = remaining[index + 1];
+        if (next && !next.startsWith("--")) {
+            options[key] = next;
+            index += 1;
+        }
+        else {
+            options[key] = true;
+        }
+    }
+    return { command, options, positionals };
+}
+function option(parsed, key) {
+    const value = parsed.options[key];
+    return typeof value === "string" ? value : "";
+}
+function numericOption(parsed, key) {
+    const value = Number(option(parsed, key));
+    return Number.isInteger(value) && value > 0 && value <= 65_535 ? value : undefined;
+}
+function openBrowser(url) {
+    const command = process.platform === "darwin" ? "open" : process.platform === "win32" ? "cmd" : "xdg-open";
+    const args = process.platform === "win32" ? ["/c", "start", "", url] : [url];
+    try {
+        const child = spawn(command, args, { detached: true, stdio: "ignore", windowsHide: true });
+        child.unref();
+    }
+    catch {
+        // The URL and setup code are always printed; browser launch is optional.
+    }
+}
+function waitForShutdown() {
+    return new Promise((resolve) => {
+        const finish = () => {
+            process.off("SIGINT", finish);
+            process.off("SIGTERM", finish);
+            resolve();
+        };
+        process.once("SIGINT", finish);
+        process.once("SIGTERM", finish);
+    });
+}
+function helpText() {
+    return `amalgm-shell ${VERSION}\n\nUsage:\n  amalgm-shell login [--setup-code CODE] [--no-open]\n  amalgm-shell run --user EMAIL\n  amalgm-shell status --user EMAIL\n\nOptions:\n  --app-url URL          Amalgm control plane (default: https://amalgm.ai)\n  --amalgm-root PATH     Visible installation root (default: ~/amalgm)\n  --home PATH            OS home override\n  --user EMAIL           Select one of multiple local users\n  --name NAME            Computer display name\n  --exit-after-ready     Examination-only: prove readiness, then stop\n`;
+}
+//# sourceMappingURL=cli.js.map

package/dist/cli.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli.js","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAE3C,OAAO,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAE1D,OAAO,EAAE,WAAW,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AAEpE,MAAM,OAAO,GAAG,OAAO,CAAC;AAQxB,MAAM,CAAC,KAAK,UAAU,MAAM,CAAC,IAAI,GAAG,OAAO,CAAC,IAAI;IAC9C,MAAM,MAAM,GAAG,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAC7C,IAAI,MAAM,CAAC,OAAO,KAAK,MAAM,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;QACrD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC;QACjC,OAAO,CAAC,CAAC;IACX,CAAC;IACD,IAAI,MAAM,CAAC,OAAO,KAAK,SAAS,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;QAC3D,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,OAAO,IAAI,CAAC,CAAC;QACrC,OAAO,CAAC,CAAC;IACX,CAAC;IACD,IAAI,CAAC,CAAC,OAAO,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;QACzD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,oBAAoB,MAAM,CAAC,OAAO,OAAO,QAAQ,EAAE,EAAE,CAAC,CAAC;QAC5E,OAAO,CAAC,CAAC;IACX,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,cAAc,IAAI,mBAAmB,CAAC;IAC9F,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,SAAS,CAAC;IACtD,MAAM,IAAI,GAAG,IAAI,WAAW,CAAC;QAC3B,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,SAAS;QAC5C,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,IAAI,SAAS;QACtD,SAAS;QACT,MAAM;QACN,cAAc,EAAE,OAAO;QACvB,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,IAAI,MAAM;QACvD,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,IAAI,MAAM;QAC1C,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,IAAI,SAAS;QAClD,WAAW,EAAE,aAAa,CAAC,MAAM,EAAE,MAAM,CAAC;QAC1C,SAAS,EAAE,KAAK,EAAE,EAAE,eAAe,EAAE,SAAS,EAAE,EAAE,EAAE;YAClD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC;gBACnB,EAAE;gBACF,6CAA6C;gBAC7C,eAAe;gBACf,EAAE;gBACF,eAAe,SAAS,EAAE;gBAC1B,EAAE;aACH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;YACd,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC;gBAAE,WAAW,CAAC,eAAe,CAAC,CAAC;QAC/D,CAAC;QACD,UAAU,EAAE,CAAC,KAAK,EAAE,EAAE;YACpB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,gBAAgB,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAClE,CAAC;KACF,CAAC,CAAC;IACH,IAAI,CAAC;QACH,IAAI,MAAM,CAAC,OAAO,KAAK,QAAQ,EAAE,CAAC;YAChC,MAAM,KAAK,GAAG,IAAI,CAAC,aAAa,EAAE,CAAC;YACnC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC;gBACrC,IAAI,EAAE,SAAS;gBACf,UAAU,EAAE,IAAI,CAAC,UAAU;gBAC3B,QAAQ,EAAE,KAAK,CAAC,QAAQ;gBACxB,UAAU,EAAE,KAAK,CAAC,UAAU;gBAC5B,QAAQ,EAAE,GAAG,KAAK,CAAC,UAAU,mBAAmB;aACjD,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;YACjB,OAAO,CAAC,CAAC;QACX,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,KAAK,OAAO;YACtC,CAAC,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC;gBAChB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,kBAAkB,EAAE;gBACpD,GAAG,CAAC,MAAM,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,YAAY,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACrF,CAAC;YACF,CAAC,CAAC,MAAM,IAAI,CAAC,MAAM,EAAE,CAAC;QACxB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,gBAAgB,IAAI,CAAC,SAAS,CAAC;YAClD,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,QAAQ,EAAE,KAAK,CAAC,UAAU,CAAC,SAAS;YACpC,SAAS,EAAE,KAAK,CAAC,UAAU,CAAC,SAAS;YACrC,SAAS,EAAE,KAAK,CAAC,UAAU,CAAC,IAAI;YAChC,QAAQ,EAAE,KAAK,CAAC,UAAU,CAAC,WAAW;YACtC,QAAQ,EAAE,KAAK,CAAC,UAAU,CAAC,YAAY;YACvC,QAAQ,EAAE,KAAK,CAAC,YAAY,CAAC,QAAQ;SACtC,CAAC,IAAI,CAAC,CAAC;QACR,IAAI,MAAM,CAAC,OAAO,CAAC,kBAAkB,CAAC,EAAE,CAAC;YACvC,MAAM,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;YAC3B,OAAO,CAAC,CAAC;QACX,CAAC;QACD,MAAM,eAAe,EAAE,CAAC;QACxB,OAAO,CAAC,CAAC;IACX,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,iBAAiB,EAAE,CAAC;YACvC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,2BAA2B,KAAK,CAAC,KAAK,KAAK,KAAK,CAAC,IAAI,IAAI,CAAC,CAAC;QAClF,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACtF,CAAC;QACD,OAAO,CAAC,CAAC;IACX,CAAC;YAAS,CAAC;QACT,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC;IACrB,CAAC;AACH,CAAC;AAED,SAAS,cAAc,CAAC,IAAuB;IAC7C,MAAM,SAAS,GAAG,CAAC,GAAG,IAAI,CAAC,CAAC;IAC5B,MAAM,OAAO,GAAG,SAAS,CAAC,KAAK,EAAE,IAAI,MAAM,CAAC;IAC5C,MAAM,OAAO,GAAqC,EAAE,CAAC;IACrD,MAAM,WAAW,GAAa,EAAE,CAAC;IACjC,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,SAAS,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QACzD,MAAM,QAAQ,GAAG,SAAS,CAAC,KAAK,CAAW,CAAC;QAC5C,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YAC/B,WAAW,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YAC3B,SAAS;QACX,CAAC;QACD,MAAM,SAAS,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACxC,IAAI,SAAS,KAAK,CAAC,CAAC,EAAE,CAAC;YACrB,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC;YACtE,SAAS;QACX,CAAC;QACD,MAAM,GAAG,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAC9B,MAAM,IAAI,GAAG,SAAS,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;QAClC,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YACnC,OAAO,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC;YACpB,KAAK,IAAI,CAAC,CAAC;QACb,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC;QACtB,CAAC;IACH,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,CAAC;AAC3C,CAAC;AAED,SAAS,MAAM,CAAC,MAAuB,EAAE,GAAW;IAClD,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAClC,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;AAChD,CAAC;AAED,SAAS,aAAa,CAAC,MAAuB,EAAE,GAAW;IACzD,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC;IAC1C,OAAO,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC,IAAI,KAAK,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AACrF,CAAC;AAED,SAAS,WAAW,CAAC,GAAW;IAC9B,MAAM,OAAO,GAAG,OAAO,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,UAAU,CAAC;IAC3G,MAAM,IAAI,GAAG,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IAC7E,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC;QAC3F,KAAK,CAAC,KAAK,EAAE,CAAC;IAChB,CAAC;IAAC,MAAM,CAAC;QACP,yEAAyE;IAC3E,CAAC;AACH,CAAC;AAED,SAAS,eAAe;IACtB,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,MAAM,MAAM,GAAG,GAAG,EAAE;YAClB,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;YAC9B,OAAO,CAAC,GAAG,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;YAC/B,OAAO,EAAE,CAAC;QACZ,CAAC,CAAC;QACF,OAAO,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QAC/B,OAAO,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;IAClC,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,QAAQ;IACf,OAAO,gBAAgB,OAAO,wgBAAwgB,CAAC;AACziB,CAAC"}

package/dist/compose.d.ts

@@ -0,0 +1,32 @@
+import { guardBearerRequest } from "@amalgm/core/transport";
+export interface ShellConfig {
+    /** Environment to resolve state dirs against. Defaults to process.env. */
+    env?: NodeJS.ProcessEnv;
+    /** Home directory override for tests. */
+    homedir?: string;
+    /** Visible Amalgm root override. Defaults to <homedir>/amalgm. */
+    amalgmRoot?: string;
+    /** Canonical user email; this is the presentation segment, not identity. */
+    userEmail?: string;
+    /** Compatibility spelling for tests and embedded callers. */
+    scope?: string;
+    /** Stable physical-device identity used only below the local control dir. */
+    deviceId?: string;
+    /** Runtime bearer token; when set, every guarded request must present it. */
+    runtimeToken?: string;
+}
+export interface ComposedShell {
+    /** Visible installation root and the selected portable user ground. */
+    amalgmRoot: string;
+    userDir: string;
+    deviceId: string;
+    /** Absolute state dir for every primitive the kernel knows about. */
+    stateDirs: Record<string, string>;
+    /** Fail-closed bearer guard bound to the shell's runtime token. */
+    guard: (headers: Record<string, string | string[] | undefined>) => ReturnType<typeof guardBearerRequest>;
+}
+/**
+ * Assemble the shell: one identity resolution and one auth guard, both owned
+ * by kernel law. The shell contributes wiring only — no behavior of its own.
+ */
+export declare function composeShell(config?: ShellConfig): ComposedShell;

package/dist/compose.js

@@ -0,0 +1,35 @@
+import { timingSafeEqual } from "node:crypto";
+import { homedir as osHomedir } from "node:os";
+import { join } from "node:path";
+import { PRIMITIVE_DIRS, resolveProductStateDir, scopedAmalgmDir, } from "@amalgm/core/identity";
+import { guardBearerRequest } from "@amalgm/core/transport";
+/**
+ * Assemble the shell: one identity resolution and one auth guard, both owned
+ * by kernel law. The shell contributes wiring only — no behavior of its own.
+ */
+export function composeShell(config = {}) {
+    const env = config.env ?? process.env;
+    const home = config.homedir ?? osHomedir();
+    const amalgmRoot = config.amalgmRoot ?? env.AMALGM_ROOT ?? join(home, "amalgm");
+    const userScope = config.userEmail ?? config.scope ?? env.AMALGM_USER_EMAIL ?? "local";
+    const userDir = scopedAmalgmDir(amalgmRoot, userScope);
+    const deviceId = config.deviceId ?? env.AMALGM_DEVICE_ID ?? "local-device";
+    const stateDirs = {};
+    for (const primitive of PRIMITIVE_DIRS) {
+        stateDirs[primitive] = resolveProductStateDir({
+            product: primitive,
+            primitive,
+            env,
+            homedir: amalgmRoot,
+            scope: userScope,
+        });
+    }
+    const guard = (headers) => guardBearerRequest({
+        // Kernel law is fail-closed: an unconfigured token ("") matches nothing.
+        headers,
+        expectedToken: config.runtimeToken ?? "",
+        timingSafeEqual,
+    });
+    return { amalgmRoot, userDir, deviceId, stateDirs, guard };
+}
+//# sourceMappingURL=compose.js.map

package/dist/compose.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"compose.js","sourceRoot":"","sources":["../src/compose.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC9C,OAAO,EAAE,OAAO,IAAI,SAAS,EAAE,MAAM,SAAS,CAAC;AAC/C,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,OAAO,EACL,cAAc,EACd,sBAAsB,EACtB,eAAe,GAChB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AA8B5D;;;GAGG;AACH,MAAM,UAAU,YAAY,CAAC,SAAsB,EAAE;IACnD,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;IACtC,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,IAAI,SAAS,EAAE,CAAC;IAC3C,MAAM,UAAU,GAAG,MAAM,CAAC,UAAU,IAAI,GAAG,CAAC,WAAW,IAAI,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IAChF,MAAM,SAAS,GAAG,MAAM,CAAC,SAAS,IAAI,MAAM,CAAC,KAAK,IAAI,GAAG,CAAC,iBAAiB,IAAI,OAAO,CAAC;IACvF,MAAM,OAAO,GAAG,eAAe,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC;IACvD,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,IAAI,GAAG,CAAC,gBAAgB,IAAI,cAAc,CAAC;IAE3E,MAAM,SAAS,GAA2B,EAAE,CAAC;IAC7C,KAAK,MAAM,SAAS,IAAI,cAAc,EAAE,CAAC;QACvC,SAAS,CAAC,SAAS,CAAC,GAAG,sBAAsB,CAAC;YAC5C,OAAO,EAAE,SAAS;YAClB,SAAS;YACT,GAAG;YACH,OAAO,EAAE,UAAU;YACnB,KAAK,EAAE,SAAS;SACjB,CAAC,CAAC;IACL,CAAC;IAED,MAAM,KAAK,GAA2B,CAAC,OAAO,EAAE,EAAE,CAChD,kBAAkB,CAAC;QACjB,yEAAyE;QACzE,OAAO;QACP,aAAa,EAAE,MAAM,CAAC,YAAY,IAAI,EAAE;QACxC,eAAe;KAChB,CAAC,CAAC;IAEL,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;AAC7D,CAAC"}

package/dist/credentials-host.d.ts

@@ -0,0 +1,7 @@
+import type { BrickMount } from "./gateway.js";
+/**
+ * Host effects for Core's one local credential vault. The cipher and file
+ * bytes remain compatible with Engine's
+ * runtime/scripts/chat-core/credentials/store.js.
+ */
+export declare function credentialsMounts(file: string): readonly BrickMount[];

package/dist/credentials-host.js

@@ -0,0 +1,143 @@
+import { createCipheriv, createDecipheriv, createHash, randomBytes, randomUUID, scryptSync, } from "node:crypto";
+import { chmodSync, mkdirSync, readFileSync, renameSync, rmSync, writeFileSync, } from "node:fs";
+import { homedir, hostname, userInfo } from "node:os";
+import { dirname } from "node:path";
+import { createCredentialsApi, CredentialVault } from "@amalgm/core/credentials";
+const CIPHER = "aes-256-gcm";
+/**
+ * Host effects for Core's one local credential vault. The cipher and file
+ * bytes remain compatible with Engine's
+ * runtime/scripts/chat-core/credentials/store.js.
+ */
+export function credentialsMounts(file) {
+    const vault = new CredentialVault({
+        store: fileStore(file),
+        cipher: machineCipher(),
+        now: () => new Date().toISOString(),
+        randomId: () => `cred_${randomUUID().replace(/-/g, "").slice(0, 18)}`,
+    });
+    const api = createCredentialsApi(vault);
+    const stream = async (req, res, pathname) => {
+        try {
+            const response = await api(await fetchRequest(req, pathname));
+            res.writeHead(response.status, Object.fromEntries(response.headers.entries()));
+            res.end(Buffer.from(await response.arrayBuffer()));
+        }
+        catch (error) {
+            res.writeHead(500, { "content-type": "application/json" });
+            res.end(JSON.stringify({ error: error instanceof Error ? error.message : "internal error" }));
+        }
+    };
+    return [
+        { prefix: "/credentials", stream },
+        { prefix: "/user-api-keys", stream },
+    ];
+}
+function fileStore(file) {
+    return {
+        read() {
+            try {
+                return JSON.parse(readFileSync(file, "utf8"));
+            }
+            catch {
+                return null;
+            }
+        },
+        write(document) {
+            mkdirSync(dirname(file), { recursive: true });
+            const temporary = `${file}.${process.pid}.${randomBytes(4).toString("hex")}.tmp`;
+            try {
+                writeFileSync(temporary, `${JSON.stringify(document, null, 2)}\n`, {
+                    encoding: "utf8",
+                    flag: "wx",
+                    mode: 0o600,
+                });
+                chmodSync(temporary, 0o600);
+                renameSync(temporary, file);
+                chmodSync(file, 0o600);
+            }
+            finally {
+                rmSync(temporary, { force: true });
+            }
+        },
+    };
+}
+function machineCipher() {
+    const deriveKey = (salt) => scryptSync(machineSecret(), salt, 32);
+    return {
+        encrypt(secret) {
+            const salt = randomBytes(16);
+            const iv = randomBytes(12);
+            const cipher = createCipheriv(CIPHER, deriveKey(salt), iv);
+            const data = Buffer.concat([cipher.update(secret, "utf8"), cipher.final()]);
+            return {
+                alg: CIPHER,
+                salt: salt.toString("base64url"),
+                iv: iv.toString("base64url"),
+                tag: cipher.getAuthTag().toString("base64url"),
+                data: data.toString("base64url"),
+            };
+        },
+        decrypt(value) {
+            const encrypted = credentialEnvelope(value);
+            const decipher = createDecipheriv(CIPHER, deriveKey(Buffer.from(encrypted.salt, "base64url")), Buffer.from(encrypted.iv, "base64url"));
+            decipher.setAuthTag(Buffer.from(encrypted.tag, "base64url"));
+            return Buffer.concat([
+                decipher.update(Buffer.from(encrypted.data, "base64url")),
+                decipher.final(),
+            ]).toString("utf8");
+        },
+        fingerprint(secret) {
+            return createHash("sha256").update(secret).digest("hex").slice(0, 16);
+        },
+    };
+}
+function machineSecret() {
+    return [hostname(), userInfo().username, homedir(), process.platform].filter(Boolean).join(":");
+}
+function credentialEnvelope(value) {
+    if (!value || typeof value !== "object" || Array.isArray(value)) {
+        throw new Error("Unsupported credential encryption format");
+    }
+    const candidate = value;
+    if (candidate.alg !== CIPHER
+        || typeof candidate.salt !== "string"
+        || typeof candidate.iv !== "string"
+        || typeof candidate.tag !== "string"
+        || typeof candidate.data !== "string") {
+        throw new Error("Unsupported credential encryption format");
+    }
+    return {
+        alg: CIPHER,
+        salt: candidate.salt,
+        iv: candidate.iv,
+        tag: candidate.tag,
+        data: candidate.data,
+    };
+}
+async function fetchRequest(req, pathname) {
+    const source = new URL(req.url ?? pathname, "http://credentials.local");
+    const method = req.method ?? "GET";
+    const chunks = [];
+    if (method !== "GET" && method !== "HEAD") {
+        for await (const chunk of req)
+            chunks.push(chunk);
+    }
+    return new Request(`http://credentials.local${pathname}${source.search}`, {
+        method,
+        headers: requestHeaders(req),
+        body: chunks.length ? Buffer.concat(chunks) : undefined,
+    });
+}
+function requestHeaders(req) {
+    const headers = new Headers();
+    for (const [name, value] of Object.entries(req.headers)) {
+        if (typeof value === "string")
+            headers.set(name, value);
+        else if (value)
+            for (const item of value)
+                headers.append(name, item);
+    }
+    return headers;
+}
+//# sourceMappingURL=credentials-host.js.map

package/dist/credentials-host.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"credentials-host.js","sourceRoot":"","sources":["../src/credentials-host.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,cAAc,EACd,gBAAgB,EAChB,UAAU,EACV,WAAW,EACX,UAAU,EACV,UAAU,GACX,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,SAAS,EACT,SAAS,EACT,YAAY,EACZ,UAAU,EACV,MAAM,EACN,aAAa,GACd,MAAM,SAAS,CAAC;AAEjB,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACtD,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEpC,OAAO,EAAE,oBAAoB,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AASjF,MAAM,MAAM,GAAG,aAAa,CAAC;AAU7B;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAAC,IAAY;IAC5C,MAAM,KAAK,GAAG,IAAI,eAAe,CAAC;QAChC,KAAK,EAAE,SAAS,CAAC,IAAI,CAAC;QACtB,MAAM,EAAE,aAAa,EAAE;QACvB,GAAG,EAAE,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACnC,QAAQ,EAAE,GAAG,EAAE,CAAC,QAAQ,UAAU,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE;KACtE,CAAC,CAAC;IACH,MAAM,GAAG,GAAG,oBAAoB,CAAC,KAAK,CAAC,CAAC;IACxC,MAAM,MAAM,GAAG,KAAK,EAAE,GAAoB,EAAE,GAAmB,EAAE,QAAgB,EAAE,EAAE;QACnF,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,MAAM,YAAY,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,CAAC;YAC9D,GAAG,CAAC,SAAS,CAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,WAAW,CAAC,QAAQ,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;YAC/E,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,QAAQ,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;QACrD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;YAC3D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,gBAAgB,EAAE,CAAC,CAAC,CAAC;QAChG,CAAC;IACH,CAAC,CAAC;IACF,OAAO;QACL,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,EAAE;QAClC,EAAE,MAAM,EAAE,gBAAgB,EAAE,MAAM,EAAE;KACrC,CAAC;AACJ,CAAC;AAED,SAAS,SAAS,CAAC,IAAY;IAC7B,OAAO;QACL,IAAI;YACF,IAAI,CAAC;gBACH,OAAO,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAY,CAAC;YAC3D,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,IAAI,CAAC;YACd,CAAC;QACH,CAAC;QACD,KAAK,CAAC,QAAiC;YACrC,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YAC9C,MAAM,SAAS,GAAG,GAAG,IAAI,IAAI,OAAO,CAAC,GAAG,IAAI,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC;YACjF,IAAI,CAAC;gBACH,aAAa,CAAC,SAAS,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE;oBACjE,QAAQ,EAAE,MAAM;oBAChB,IAAI,EAAE,IAAI;oBACV,IAAI,EAAE,KAAK;iBACZ,CAAC,CAAC;gBACH,SAAS,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;gBAC5B,UAAU,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;gBAC5B,SAAS,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;YACzB,CAAC;oBAAS,CAAC;gBACT,MAAM,CAAC,SAAS,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;YACrC,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC;AAED,SAAS,aAAa;IACpB,MAAM,SAAS,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,UAAU,CAAC,aAAa,EAAE,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;IAC1E,OAAO;QACL,OAAO,CAAC,MAAM;YACZ,MAAM,IAAI,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;YAC7B,MAAM,EAAE,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;YAC3B,MAAM,MAAM,GAAG,cAAc,CAAC,MAAM,EAAE,SAAS,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;YAC3D,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;YAC5E,OAAO;gBACL,GAAG,EAAE,MAAM;gBACX,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC;gBAChC,EAAE,EAAE,EAAE,CAAC,QAAQ,CAAC,WAAW,CAAC;gBAC5B,GAAG,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC,QAAQ,CAAC,WAAW,CAAC;gBAC9C,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC;aACJ,CAAC;QACjC,CAAC;QACD,OAAO,CAAC,KAAK;YACX,MAAM,SAAS,GAAG,kBAAkB,CAAC,KAAK,CAAC,CAAC;YAC5C,MAAM,QAAQ,GAAG,gBAAgB,CAC/B,MAAM,EACN,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC,EACnD,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,WAAW,CAAC,CACvC,CAAC;YACF,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC,CAAC;YAC7D,OAAO,MAAM,CAAC,MAAM,CAAC;gBACnB,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;gBACzD,QAAQ,CAAC,KAAK,EAAE;aACjB,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QACtB,CAAC;QACD,WAAW,CAAC,MAAM;YAChB,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACxE,CAAC;KACF,CAAC;AACJ,CAAC;AAED,SAAS,aAAa;IACpB,OAAO,CAAC,QAAQ,EAAE,EAAE,QAAQ,EAAE,CAAC,QAAQ,EAAE,OAAO,EAAE,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAClG,CAAC;AAED,SAAS,kBAAkB,CAAC,KAAc;IACxC,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAChE,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;IAC9D,CAAC;IACD,MAAM,SAAS,GAAG,KAAgC,CAAC;IACnD,IAAI,SAAS,CAAC,GAAG,KAAK,MAAM;WACvB,OAAO,SAAS,CAAC,IAAI,KAAK,QAAQ;WAClC,OAAO,SAAS,CAAC,EAAE,KAAK,QAAQ;WAChC,OAAO,SAAS,CAAC,GAAG,KAAK,QAAQ;WACjC,OAAO,SAAS,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QACxC,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;IAC9D,CAAC;IACD,OAAO;QACL,GAAG,EAAE,MAAM;QACX,IAAI,EAAE,SAAS,CAAC,IAAI;QACpB,EAAE,EAAE,SAAS,CAAC,EAAE;QAChB,GAAG,EAAE,SAAS,CAAC,GAAG;QAClB,IAAI,EAAE,SAAS,CAAC,IAAI;KACrB,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,YAAY,CAAC,GAAoB,EAAE,QAAgB;IAChE,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,QAAQ,EAAE,0BAA0B,CAAC,CAAC;IACxE,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,IAAI,KAAK,CAAC;IACnC,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,IAAI,MAAM,KAAK,KAAK,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;QAC1C,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,GAAG;YAAE,MAAM,CAAC,IAAI,CAAC,KAAe,CAAC,CAAC;IAC9D,CAAC;IACD,OAAO,IAAI,OAAO,CAAC,2BAA2B,QAAQ,GAAG,MAAM,CAAC,MAAM,EAAE,EAAE;QACxE,MAAM;QACN,OAAO,EAAE,cAAc,CAAC,GAAG,CAAC;QAC5B,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS;KACxD,CAAC,CAAC;AACL,CAAC;AAED,SAAS,cAAc,CAAC,GAAoB;IAC1C,MAAM,OAAO,GAAG,IAAI,OAAO,EAAE,CAAC;IAC9B,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;QACxD,IAAI,OAAO,KAAK,KAAK,QAAQ;YAAE,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;aACnD,IAAI,KAAK;YAAE,KAAK,MAAM,IAAI,IAAI,KAAK;gBAAE,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IACvE,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC"}

package/dist/diagnostics-host.d.ts

@@ -0,0 +1,3 @@
+import type { BrickMount } from "./gateway.js";
+/** Filesystem effects for Core's bounded diagnostics law. */
+export declare function diagnosticsMount(logDir: string): BrickMount;