@amalgm/shell 0.1.0

package/dist/forward.js

@@ -0,0 +1,36 @@
+import { request as httpRequest } from "node:http";
+/**
+ * Forward a gateway prefix to a brick's own HTTP server on loopback —
+ * the engine's gateway architecture (prefixes route to per-service ports)
+ * applied inside the shell. The prefix is re-rooted onto the brick
+ * server's own root (both agents and browser root their APIs at /v1):
+ * /agents/sessions reaches the agents server as /v1/sessions.
+ */
+export function forwardMount(prefix, port, options = {}) {
+    const root = options.root ?? "";
+    return {
+        prefix,
+        stream: (req, res, pathname) => {
+            const url = new URL(req.url ?? "/", "http://localhost");
+            const suffix = `${root}${pathname.slice(prefix.length)}` || "/";
+            const upstream = httpRequest({
+                host: "127.0.0.1",
+                port: port(),
+                method: req.method,
+                path: `${suffix}${url.search}`,
+                headers: { ...req.headers, host: `127.0.0.1:${port()}` },
+            }, (up) => {
+                res.writeHead(up.statusCode ?? 502, up.headers);
+                up.pipe(res);
+            });
+            upstream.on("error", () => {
+                if (!res.headersSent) {
+                    res.writeHead(502, { "Content-Type": "application/json" });
+                }
+                res.end(JSON.stringify({ error: "upstream unavailable" }));
+            });
+            req.pipe(upstream);
+        },
+    };
+}
+//# sourceMappingURL=forward.js.map

package/dist/forward.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"forward.js","sourceRoot":"","sources":["../src/forward.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,IAAI,WAAW,EAAE,MAAM,WAAW,CAAC;AAInD;;;;;;GAMG;AACH,MAAM,UAAU,YAAY,CAC1B,MAAc,EACd,IAAkB,EAClB,UAA6B,EAAE;IAE/B,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,EAAE,CAAC;IAChC,OAAO;QACL,MAAM;QACN,MAAM,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,QAAQ,EAAE,EAAE;YAC7B,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,EAAE,kBAAkB,CAAC,CAAC;YACxD,MAAM,MAAM,GAAG,GAAG,IAAI,GAAG,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,GAAG,CAAC;YAChE,MAAM,QAAQ,GAAG,WAAW,CAC1B;gBACE,IAAI,EAAE,WAAW;gBACjB,IAAI,EAAE,IAAI,EAAE;gBACZ,MAAM,EAAE,GAAG,CAAC,MAAM;gBAClB,IAAI,EAAE,GAAG,MAAM,GAAG,GAAG,CAAC,MAAM,EAAE;gBAC9B,OAAO,EAAE,EAAE,GAAG,GAAG,CAAC,OAAO,EAAE,IAAI,EAAE,aAAa,IAAI,EAAE,EAAE,EAAE;aACzD,EACD,CAAC,EAAE,EAAE,EAAE;gBACL,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC,UAAU,IAAI,GAAG,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC;gBAChD,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACf,CAAC,CACF,CAAC;YACF,QAAQ,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;gBACxB,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;oBACrB,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;gBAC7D,CAAC;gBACD,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,sBAAsB,EAAE,CAAC,CAAC,CAAC;YAC7D,CAAC,CAAC,CAAC;YACH,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACrB,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/gateway.d.ts

@@ -0,0 +1,33 @@
+import type { IncomingMessage, Server, ServerResponse } from "node:http";
+import type { Duplex } from "node:stream";
+/**
+ * A brick's served surface: a path prefix plus either a JSON-RPC handler
+ * (the shell writes the response) or a stream handler (the mount owns the
+ * response — SSE tails, long polls). Auth is decided before either runs.
+ */
+export interface BrickMount {
+    readonly prefix: string;
+    readonly handle?: (request: unknown) => Promise<unknown>;
+    readonly stream?: (req: IncomingMessage, res: ServerResponse, pathname: string) => void | Promise<void>;
+}
+/** A WebSocket-capable brick. Kernel auth is decided before `handle` runs. */
+export interface BrickUpgradeMount {
+    readonly prefix: string;
+    readonly handle: (req: IncomingMessage, socket: Duplex, head: Buffer, authorized: boolean) => void;
+}
+export interface GatewayConfig {
+    /** Environment the auth law reads. Defaults to process.env. */
+    env?: NodeJS.ProcessEnv;
+    /** Brick surfaces to serve, matched by longest prefix. */
+    mounts?: readonly BrickMount[];
+    /** WebSocket surfaces, admitted by the same runtime-token law. */
+    upgrades?: readonly BrickUpgradeMount[];
+    /** Paths whose brick performs its own request authentication. */
+    exemptPrefixes?: readonly string[];
+}
+/**
+ * The composed gateway: kernel law decides every request (preflight,
+ * exemption, auth), the shell only routes what the law allows to the
+ * brick that owns the prefix. No behavior lives here — axiom 1.
+ */
+export declare function createGateway(config?: GatewayConfig): Server;

package/dist/gateway.js

@@ -0,0 +1,85 @@
+import { timingSafeEqual } from "node:crypto";
+import { createServer } from "node:http";
+import { decideRuntimeHttp, isAuthorizedRuntimeRequest, isHealthPath, pathnameOf, runtimeAuthRequired, runtimeCorsHeaders, runtimeTokenFromEnv, } from "@amalgm/core/transport";
+/**
+ * The composed gateway: kernel law decides every request (preflight,
+ * exemption, auth), the shell only routes what the law allows to the
+ * brick that owns the prefix. No behavior lives here — axiom 1.
+ */
+export function createGateway(config = {}) {
+    const env = config.env ?? process.env;
+    const policy = {
+        required: runtimeAuthRequired(env),
+        expectedToken: runtimeTokenFromEnv(env),
+        timingSafeEqual,
+    };
+    const mounts = [...(config.mounts ?? [])].sort((a, b) => b.prefix.length - a.prefix.length);
+    const upgrades = [...(config.upgrades ?? [])].sort((a, b) => b.prefix.length - a.prefix.length);
+    const server = createServer((req, res) => {
+        const pathname = pathnameOf(req.url);
+        const origin = String(req.headers.origin ?? "");
+        const cors = runtimeCorsHeaders(origin);
+        const decision = decideRuntimeHttp({ method: req.method ?? "GET", pathname, headers: req.headers }, policy, { exemptPrefixes: config.exemptPrefixes });
+        if (decision.kind === "preflight") {
+            res.writeHead(decision.status, cors).end();
+            return;
+        }
+        if (decision.kind === "reject") {
+            res.writeHead(decision.status, { ...cors, ...decision.headers });
+            res.end(decision.body);
+            return;
+        }
+        if (isHealthPath(pathname)) {
+            res.writeHead(200, { ...cors, "Content-Type": "application/json" });
+            res.end(JSON.stringify({ ok: true }));
+            return;
+        }
+        const mount = mounts.find((m) => pathname === m.prefix || pathname.startsWith(`${m.prefix}/`));
+        if (!mount) {
+            res.writeHead(404, { ...cors, "Content-Type": "application/json" });
+            res.end(JSON.stringify({ error: "not found" }));
+            return;
+        }
+        if (mount.stream) {
+            for (const [name, value] of Object.entries(cors))
+                res.setHeader(name, value);
+            void mount.stream(req, res, pathname);
+            return;
+        }
+        const handle = mount.handle;
+        if (!handle) {
+            res.writeHead(404, { ...cors, "Content-Type": "application/json" });
+            res.end(JSON.stringify({ error: "not found" }));
+            return;
+        }
+        const chunks = [];
+        req.on("data", (chunk) => chunks.push(chunk));
+        req.on("end", () => {
+            void (async () => {
+                try {
+                    const raw = Buffer.concat(chunks).toString("utf8");
+                    const body = raw ? JSON.parse(raw) : {};
+                    const result = await handle(body);
+                    res.writeHead(200, { ...cors, "Content-Type": "application/json" });
+                    res.end(JSON.stringify(result ?? null));
+                }
+                catch (error) {
+                    res.writeHead(500, { ...cors, "Content-Type": "application/json" });
+                    res.end(JSON.stringify({ error: error instanceof Error ? error.message : "internal error" }));
+                }
+            })();
+        });
+    });
+    server.on("upgrade", (req, socket, head) => {
+        const pathname = pathnameOf(req.url);
+        const upgrade = upgrades.find((candidate) => pathname === candidate.prefix || pathname.startsWith(`${candidate.prefix}/`));
+        if (!upgrade) {
+            socket.end("HTTP/1.1 404 Not Found\r\nConnection: close\r\n\r\n");
+            return;
+        }
+        const authorized = isAuthorizedRuntimeRequest(req.headers, policy);
+        upgrade.handle(req, socket, head, authorized);
+    });
+    return server;
+}
+//# sourceMappingURL=gateway.js.map

package/dist/gateway.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"gateway.js","sourceRoot":"","sources":["../src/gateway.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC9C,OAAO,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AAIzC,OAAO,EACL,iBAAiB,EACjB,0BAA0B,EAC1B,YAAY,EACZ,UAAU,EACV,mBAAmB,EACnB,kBAAkB,EAClB,mBAAmB,GACpB,MAAM,wBAAwB,CAAC;AAwChC;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAAC,SAAwB,EAAE;IACtD,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;IACtC,MAAM,MAAM,GAAsB;QAChC,QAAQ,EAAE,mBAAmB,CAAC,GAAG,CAAC;QAClC,aAAa,EAAE,mBAAmB,CAAC,GAAG,CAAC;QACvC,eAAe;KAChB,CAAC;IACF,MAAM,MAAM,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAC5C,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC,MAAM,CAC5C,CAAC;IACF,MAAM,QAAQ,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAChD,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC,MAAM,CAC5C,CAAC;IAEF,MAAM,MAAM,GAAG,YAAY,CAAC,CAAC,GAAoB,EAAE,GAAmB,EAAE,EAAE;QACxE,MAAM,QAAQ,GAAG,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACrC,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC;QAChD,MAAM,IAAI,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAAC;QAExC,MAAM,QAAQ,GAAG,iBAAiB,CAChC,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,IAAI,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,EAC/D,MAAM,EACN,EAAE,cAAc,EAAE,MAAM,CAAC,cAAc,EAAE,CAC1C,CAAC;QAEF,IAAI,QAAQ,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;YAClC,GAAG,CAAC,SAAS,CAAC,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,GAAG,EAAE,CAAC;YAC3C,OAAO;QACT,CAAC;QACD,IAAI,QAAQ,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC/B,GAAG,CAAC,SAAS,CAAC,QAAQ,CAAC,MAAM,EAAE,EAAE,GAAG,IAAI,EAAE,GAAG,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC;YACjE,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;YACvB,OAAO;QACT,CAAC;QAED,IAAI,YAAY,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC3B,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,GAAG,IAAI,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;YACpE,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;YACtC,OAAO;QACT,CAAC;QAED,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,KAAK,CAAC,CAAC,MAAM,IAAI,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QAC/F,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,GAAG,IAAI,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;YACpE,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC;YAChD,OAAO;QACT,CAAC;QAED,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;YACjB,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC;gBAAE,GAAG,CAAC,SAAS,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;YAC7E,KAAK,KAAK,CAAC,MAAM,CAAC,GAAG,EAAE,GAAG,EAAE,QAAQ,CAAC,CAAC;YACtC,OAAO;QACT,CAAC;QACD,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC;QAC5B,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,GAAG,IAAI,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;YACpE,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC;YAChD,OAAO;QACT,CAAC;QAED,MAAM,MAAM,GAAa,EAAE,CAAC;QAC5B,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;QACtD,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE;YACjB,KAAK,CAAC,KAAK,IAAI,EAAE;gBACf,IAAI,CAAC;oBACH,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;oBACnD,MAAM,IAAI,GAAG,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;oBACxC,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,CAAC;oBAClC,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,GAAG,IAAI,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;oBACpE,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,IAAI,IAAI,CAAC,CAAC,CAAC;gBAC1C,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,GAAG,IAAI,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;oBACpE,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,gBAAgB,EAAE,CAAC,CAAC,CAAC;gBAChG,CAAC;YACH,CAAC,CAAC,EAAE,CAAC;QACP,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE;QACzC,MAAM,QAAQ,GAAG,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACrC,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,CAC3B,CAAC,SAAS,EAAE,EAAE,CAAC,QAAQ,KAAK,SAAS,CAAC,MAAM,IAAI,QAAQ,CAAC,UAAU,CAAC,GAAG,SAAS,CAAC,MAAM,GAAG,CAAC,CAC5F,CAAC;QACF,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,CAAC,GAAG,CAAC,qDAAqD,CAAC,CAAC;YAClE,OAAO;QACT,CAAC;QACD,MAAM,UAAU,GAAG,0BAA0B,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QACnE,OAAO,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,CAAC,CAAC;IAChD,CAAC,CAAC,CAAC;IAEH,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,23 @@
+export { composeShell } from "./compose.js";
+export type { ShellConfig, ComposedShell } from "./compose.js";
+export { createGateway } from "./gateway.js";
+export type { GatewayConfig, BrickMount, BrickUpgradeMount } from "./gateway.js";
+export { bootShell } from "./boot.js";
+export type { BootedShell, BootConfig } from "./boot.js";
+export { ChatHost } from "./chat-host.js";
+export type { ChatDriver, ChatHostConfig } from "./chat-host.js";
+export { ChatRelayHost } from "./chat-relay-host.js";
+export type { ChatRelayHostConfig } from "./chat-relay-host.js";
+export { createClaudeCodeDriver } from "./drivers/claude-code.js";
+export type { ClaudeCodeDriverOptions, ClaudeQuery } from "./drivers/claude-code.js";
+export { engineSurfaceProbes, measureEngineParity, paritySummary } from "./parity.js";
+export type { ParityProbe, ParityResult, ParityOptions, ParitySummary } from "./parity.js";
+export { FileStateEventStore } from "./state-store.js";
+export { FileWorkspaceStore } from "./workspace-store.js";
+export { WireClient, WireRequestError } from "./wire-client.js";
+export type { WireClientOptions } from "./wire-client.js";
+export { UserGroundHost } from "./user-ground-host.js";
+export type { UserGroundHostOptions } from "./user-ground-host.js";
+export { MachineHost, defaultMachineName } from "./machine-host.js";
+export type { MachineHostOptions } from "./machine-host.js";
+export { shellReleaseCatalog, shellReleaseVerifier } from "./release-catalog.js";

package/dist/index.js

@@ -0,0 +1,14 @@
+export { composeShell } from "./compose.js";
+export { createGateway } from "./gateway.js";
+export { bootShell } from "./boot.js";
+export { ChatHost } from "./chat-host.js";
+export { ChatRelayHost } from "./chat-relay-host.js";
+export { createClaudeCodeDriver } from "./drivers/claude-code.js";
+export { engineSurfaceProbes, measureEngineParity, paritySummary } from "./parity.js";
+export { FileStateEventStore } from "./state-store.js";
+export { FileWorkspaceStore } from "./workspace-store.js";
+export { WireClient, WireRequestError } from "./wire-client.js";
+export { UserGroundHost } from "./user-ground-host.js";
+export { MachineHost, defaultMachineName } from "./machine-host.js";
+export { shellReleaseCatalog, shellReleaseVerifier } from "./release-catalog.js";
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAE5C,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAE7C,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAEtC,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAE1C,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAErD,OAAO,EAAE,sBAAsB,EAAE,MAAM,0BAA0B,CAAC;AAElE,OAAO,EAAE,mBAAmB,EAAE,mBAAmB,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAEtF,OAAO,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AACvD,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAC1D,OAAO,EAAE,UAAU,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AAEhE,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAEvD,OAAO,EAAE,WAAW,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AAEpE,OAAO,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC"}

package/dist/local-host.d.ts

@@ -0,0 +1,8 @@
+import type { BrickMount } from "./gateway.js";
+export interface LocalHostConfig {
+    readonly home: string;
+    readonly env: NodeJS.ProcessEnv;
+    readonly amalgmPath: string;
+    readonly workspaceRoot: string;
+}
+export declare function localMount(config: LocalHostConfig): BrickMount;

package/dist/local-host.js

@@ -0,0 +1,101 @@
+import { existsSync, mkdirSync, readFileSync, statSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+import { createLocalApi } from "@amalgm/core/local";
+export function localMount(config) {
+    const amalgmPath = config.amalgmPath;
+    const workspaceRoot = config.workspaceRoot;
+    const api = createLocalApi({
+        discovery: discoveryHost(config),
+        environment: {
+            homedir: config.home,
+            workspaceRoot,
+            ensure: () => ensureLocalEnvironment(amalgmPath),
+        },
+    });
+    return {
+        prefix: "/local",
+        stream: async (req, res, pathname) => {
+            try {
+                const response = await api(await fetchRequest(req, pathname));
+                res.writeHead(response.status, Object.fromEntries(response.headers.entries()));
+                res.end(Buffer.from(await response.arrayBuffer()));
+            }
+            catch (error) {
+                res.writeHead(500, { "content-type": "application/json" });
+                res.end(JSON.stringify({ error: error instanceof Error ? error.message : "internal error" }));
+            }
+        },
+    };
+}
+function discoveryHost(config) {
+    return {
+        homedir: config.home,
+        join,
+        exists: existsSync,
+        nonEmptyFile(path) {
+            try {
+                const stats = statSync(path);
+                return stats.isFile() && stats.size > 0;
+            }
+            catch {
+                return false;
+            }
+        },
+        readJson(path) {
+            try {
+                return JSON.parse(readFileSync(path, "utf8"));
+            }
+            catch {
+                return null;
+            }
+        },
+        env: (name) => config.env[name],
+        // CLI/keychain probing is an optional host fact. File and env evidence
+        // remain useful when no interactive credential backend is composed.
+        authStatus: () => null,
+    };
+}
+function ensureLocalEnvironment(root) {
+    let created = false;
+    for (const directory of ["", "browser", "agents", "instructions", ".memories", "conversations/active", "conversations/saved", "workspaces"]) {
+        const path = join(root, directory);
+        if (!existsSync(path)) {
+            mkdirSync(path, { recursive: true });
+            created = true;
+        }
+    }
+    const configFile = join(root, "config.json");
+    if (!existsSync(configFile)) {
+        writeFileSync(configFile, JSON.stringify({ version: 1, createdAt: new Date().toISOString() }, null, 2) + "\n");
+        created = true;
+    }
+    const discoveryFile = join(root, "agents", "discovery.json");
+    if (!existsSync(discoveryFile)) {
+        writeFileSync(discoveryFile, JSON.stringify({ version: 1, lastScan: null, discovered: [] }, null, 2) + "\n");
+        created = true;
+    }
+    return { created, path: root };
+}
+async function fetchRequest(req, pathname) {
+    const url = new URL(req.url ?? pathname, "http://local.local");
+    const headers = new Headers();
+    for (const [name, value] of Object.entries(req.headers)) {
+        if (Array.isArray(value))
+            for (const item of value)
+                headers.append(name, item);
+        else if (value !== undefined)
+            headers.set(name, value);
+    }
+    const method = req.method ?? "GET";
+    const chunks = [];
+    if (method !== "GET" && method !== "HEAD") {
+        for await (const chunk of req)
+            chunks.push(chunk);
+    }
+    return new Request(`http://local.local${pathname}${url.search}`, {
+        method,
+        headers,
+        body: chunks.length ? Buffer.concat(chunks) : undefined,
+    });
+}
+//# sourceMappingURL=local-host.js.map

package/dist/local-host.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"local-host.js","sourceRoot":"","sources":["../src/local-host.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,QAAQ,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAEvF,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,OAAO,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAYpD,MAAM,UAAU,UAAU,CAAC,MAAuB;IAChD,MAAM,UAAU,GAAG,MAAM,CAAC,UAAU,CAAC;IACrC,MAAM,aAAa,GAAG,MAAM,CAAC,aAAa,CAAC;IAC3C,MAAM,GAAG,GAAG,cAAc,CAAC;QACzB,SAAS,EAAE,aAAa,CAAC,MAAM,CAAC;QAChC,WAAW,EAAE;YACX,OAAO,EAAE,MAAM,CAAC,IAAI;YACpB,aAAa;YACb,MAAM,EAAE,GAAG,EAAE,CAAC,sBAAsB,CAAC,UAAU,CAAC;SACjD;KACF,CAAC,CAAC;IACH,OAAO;QACL,MAAM,EAAE,QAAQ;QAChB,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,QAAQ,EAAE,EAAE;YACnC,IAAI,CAAC;gBACH,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,MAAM,YAAY,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,CAAC;gBAC9D,GAAG,CAAC,SAAS,CAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,WAAW,CAAC,QAAQ,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;gBAC/E,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,QAAQ,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;YACrD,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;gBAC3D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,gBAAgB,EAAE,CAAC,CAAC,CAAC;YAChG,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC;AAED,SAAS,aAAa,CAAC,MAAuB;IAC5C,OAAO;QACL,OAAO,EAAE,MAAM,CAAC,IAAI;QACpB,IAAI;QACJ,MAAM,EAAE,UAAU;QAClB,YAAY,CAAC,IAAI;YACf,IAAI,CAAC;gBACH,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;gBAC7B,OAAO,KAAK,CAAC,MAAM,EAAE,IAAI,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC;YAC1C,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,KAAK,CAAC;YACf,CAAC;QACH,CAAC;QACD,QAAQ,CAAC,IAAI;YACX,IAAI,CAAC;gBACH,OAAO,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;YAChD,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,IAAI,CAAC;YACd,CAAC;QACH,CAAC;QACD,GAAG,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC;QAC/B,uEAAuE;QACvE,oEAAoE;QACpE,UAAU,EAAE,GAAG,EAAE,CAAC,IAAI;KACvB,CAAC;AACJ,CAAC;AAED,SAAS,sBAAsB,CAAC,IAAY;IAC1C,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,KAAK,MAAM,SAAS,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,QAAQ,EAAE,cAAc,EAAE,WAAW,EAAE,sBAAsB,EAAE,qBAAqB,EAAE,YAAY,CAAC,EAAE,CAAC;QAC5I,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;QACnC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YACtB,SAAS,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YACrC,OAAO,GAAG,IAAI,CAAC;QACjB,CAAC;IACH,CAAC;IACD,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC;IAC7C,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QAC5B,aAAa,CAAC,UAAU,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;QAC/G,OAAO,GAAG,IAAI,CAAC;IACjB,CAAC;IACD,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,gBAAgB,CAAC,CAAC;IAC7D,IAAI,CAAC,UAAU,CAAC,aAAa,CAAC,EAAE,CAAC;QAC/B,aAAa,CAAC,aAAa,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,UAAU,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;QAC7G,OAAO,GAAG,IAAI,CAAC;IACjB,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;AACjC,CAAC;AAED,KAAK,UAAU,YAAY,CAAC,GAAoB,EAAE,QAAgB;IAChE,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,QAAQ,EAAE,oBAAoB,CAAC,CAAC;IAC/D,MAAM,OAAO,GAAG,IAAI,OAAO,EAAE,CAAC;IAC9B,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;QACxD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;YAAE,KAAK,MAAM,IAAI,IAAI,KAAK;gBAAE,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;aAC1E,IAAI,KAAK,KAAK,SAAS;YAAE,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACzD,CAAC;IACD,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,IAAI,KAAK,CAAC;IACnC,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,IAAI,MAAM,KAAK,KAAK,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;QAC1C,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,GAAG;YAAE,MAAM,CAAC,IAAI,CAAC,KAAe,CAAC,CAAC;IAC9D,CAAC;IACD,OAAO,IAAI,OAAO,CAAC,qBAAqB,QAAQ,GAAG,GAAG,CAAC,MAAM,EAAE,EAAE;QAC/D,MAAM;QACN,OAAO;QACP,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS;KACxD,CAAC,CAAC;AACL,CAAC"}

package/dist/machine-host.d.ts

@@ -0,0 +1,56 @@
+import { type JoinMachineInput, type MachineSetupPorts, type ReadyMachine } from "@amalgm/core/identity";
+export interface MachineHostOptions {
+    readonly homedir?: string;
+    readonly amalgmRoot?: string;
+    /** Required for an unambiguous resume when more than one user is present. */
+    readonly userEmail?: string;
+    readonly appUrl: string;
+    readonly runtimeVersion: string;
+    readonly runtimeLabel?: string;
+    readonly branch?: string;
+    readonly proxyUrl?: string;
+    readonly runtimePort?: number;
+    readonly showSetup?: (input: {
+        verificationUrl: string;
+        setupCode: string;
+    }) => Promise<void> | void;
+    readonly diagnostic?: (event: {
+        stage: string;
+        status: "started" | "completed" | "failed";
+        code?: string;
+    }) => void;
+}
+interface MachinePaths {
+    readonly userRoot: string;
+    readonly machineDir: string;
+    readonly publicRecord: string;
+    readonly secretAuth: string;
+    readonly installation: string;
+    readonly status: string;
+}
+/** The production effects around Core's machine-setup operation. It does not
+ * decide ordering, readiness, or installation selection; those remain Core. */
+export declare class MachineHost {
+    readonly options: MachineHostOptions;
+    readonly homedir: string;
+    readonly amalgmRoot: string;
+    readonly deviceFile: string;
+    readonly ports: MachineSetupPorts;
+    private selectedUserEmail;
+    private groundHost;
+    private running;
+    constructor(options: MachineHostOptions);
+    join(input: Omit<JoinMachineInput, "appUrl" | "platform" | "appVersion" | "runtimeLabel" | "branch">): Promise<ReadyMachine>;
+    resume(): Promise<ReadyMachine>;
+    selectedPaths(): MachinePaths;
+    close(): Promise<void>;
+    private ensureInstallationRoot;
+    private paths;
+    private requireSelectedUser;
+    private resolveUserForResume;
+    private loadMachine;
+    private saveMachine;
+    private startRuntime;
+}
+export declare function defaultMachineName(): string;
+export {};