@amalgm/shell 0.1.113 → 0.1.114

package/dist/authorization/key-store.js

@@ -0,0 +1,148 @@
+import { execFile } from "node:child_process";
+import { readFileSync, rmSync } from "node:fs";
+import { promisify } from "node:util";
+import { atomicJson } from "../filesystem.js";
+import { runSecretProcess } from "./secret-process.js";
+const execFileAsync = promisify(execFile);
+const KEYCHAIN_SERVICE = "com.amalgm.shell.authorization";
+export function createDeviceKeyStore(input) {
+    const file = fileStore(input.file);
+    const platform = input.platform ?? process.platform;
+    if (platform === "darwin")
+        return preferredStore(keychainStore(input.account), file);
+    if (platform === "win32")
+        return preferredStore(dpapiStore(input.file), file);
+    return file;
+}
+function fileStore(file) {
+    return {
+        load: async () => readStoredJson(file),
+        save: async (key) => atomicJson(file, key),
+        remove: async () => rmSync(file, { force: true }),
+    };
+}
+function keychainStore(account) {
+    return {
+        load: async () => {
+            try {
+                const { stdout } = await execFileAsync("/usr/bin/security", [
+                    "find-generic-password", "-a", account, "-s", KEYCHAIN_SERVICE, "-w",
+                ], { encoding: "utf8", maxBuffer: 64 * 1024 });
+                return JSON.parse(stdout.trim());
+            }
+            catch (error) {
+                const message = errorText(error);
+                if (message.includes("could not be found") || message.includes("SecKeychainSearchCopyNext: -25300")) {
+                    return null;
+                }
+                throw error;
+            }
+        },
+        save: async (key) => {
+            await runSecretProcess("/usr/bin/security", [
+                "add-generic-password", "-U", "-a", account, "-s", KEYCHAIN_SERVICE,
+                "-w",
+            ], `${JSON.stringify(key)}\n`);
+        },
+        remove: async () => {
+            try {
+                await execFileAsync("/usr/bin/security", [
+                    "delete-generic-password", "-a", account, "-s", KEYCHAIN_SERVICE,
+                ], { encoding: "utf8", maxBuffer: 64 * 1024 });
+            }
+            catch (error) {
+                const message = errorText(error);
+                if (!message.includes("could not be found") && !message.includes("SecKeychainSearchCopyNext: -25300")) {
+                    throw error;
+                }
+            }
+        },
+    };
+}
+function dpapiStore(file) {
+    const protect = [
+        "$ErrorActionPreference='Stop'",
+        "$p=[Text.Encoding]::UTF8.GetBytes([Console]::In.ReadToEnd())",
+        "$b=[Security.Cryptography.ProtectedData]::Protect($p,$null,[Security.Cryptography.DataProtectionScope]::CurrentUser)",
+        "[Console]::Out.Write([Convert]::ToBase64String($b))",
+    ].join(";");
+    const unprotect = [
+        "$ErrorActionPreference='Stop'",
+        "$b=[Convert]::FromBase64String([Console]::In.ReadToEnd().Trim())",
+        "$p=[Security.Cryptography.ProtectedData]::Unprotect($b,$null,[Security.Cryptography.DataProtectionScope]::CurrentUser)",
+        "[Console]::Out.Write([Text.Encoding]::UTF8.GetString($p))",
+    ].join(";");
+    return {
+        load: async () => {
+            const stored = readStoredJson(file);
+            if (stored?.storage !== "windows-dpapi" || !stored.ciphertext)
+                return null;
+            const value = await runSecretProcess("powershell.exe", ["-NoProfile", "-NonInteractive", "-Command", unprotect], stored.ciphertext);
+            return JSON.parse(value);
+        },
+        save: async (key) => {
+            const ciphertext = await runSecretProcess("powershell.exe", ["-NoProfile", "-NonInteractive", "-Command", protect], JSON.stringify(key));
+            atomicJson(file, { storage: "windows-dpapi", ciphertext });
+        },
+        remove: async () => rmSync(file, { force: true }),
+    };
+}
+function preferredStore(primary, fallback) {
+    let selected = null;
+    return {
+        load: async () => {
+            const primaryValue = await primary.load();
+            if (primaryValue) {
+                selected = "primary";
+                return primaryValue;
+            }
+            const fallbackValue = await fallback.load();
+            if (fallbackValue)
+                selected = "fallback";
+            return fallbackValue;
+        },
+        save: async (key) => {
+            if (selected === "primary")
+                return primary.save(key);
+            if (selected === "fallback")
+                return fallback.save(key);
+            try {
+                await primary.save(key);
+                selected = "primary";
+            }
+            catch {
+                await fallback.save(key);
+                selected = "fallback";
+            }
+        },
+        remove: async () => {
+            const errors = [];
+            await primary.remove().catch((error) => errors.push(error));
+            await fallback.remove().catch((error) => errors.push(error));
+            if (errors.length > 0)
+                throw errors[0];
+            selected = null;
+        },
+    };
+}
+function readStoredJson(file) {
+    try {
+        return JSON.parse(readFileSync(file, "utf8"));
+    }
+    catch (error) {
+        if (error && typeof error === "object" && "code" in error && error.code === "ENOENT") {
+            return null;
+        }
+        throw Object.assign(new Error("Stored authorization key is unreadable or corrupt"), {
+            code: "authorization_key_corrupt",
+            cause: error,
+        });
+    }
+}
+function errorText(error) {
+    if (!error || typeof error !== "object")
+        return String(error);
+    const value = error;
+    return `${String(value.message ?? "")} ${String(value.stderr ?? "")}`;
+}
+//# sourceMappingURL=key-store.js.map

package/dist/authorization/key-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"key-store.js","sourceRoot":"","sources":["../../src/authorization/key-store.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAE9C,OAAO,EAAE,YAAY,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AAC/C,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAEtC,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAEvD,MAAM,aAAa,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;AAC1C,MAAM,gBAAgB,GAAG,gCAAgC,CAAC;AAa1D,MAAM,UAAU,oBAAoB,CAAC,KAInC;IACA,MAAM,IAAI,GAAG,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACnC,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,IAAI,OAAO,CAAC,QAAQ,CAAC;IACpD,IAAI,QAAQ,KAAK,QAAQ;QAAE,OAAO,cAAc,CAAC,aAAa,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,IAAI,CAAC,CAAC;IACrF,IAAI,QAAQ,KAAK,OAAO;QAAE,OAAO,cAAc,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,CAAC;IAC9E,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,SAAS,CAAC,IAAY;IAC7B,OAAO;QACL,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC,cAAc,CAAkB,IAAI,CAAC;QACvD,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,EAAE,GAAG,CAAC;QAC1C,MAAM,EAAE,KAAK,IAAI,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;KAClD,CAAC;AACJ,CAAC;AAED,SAAS,aAAa,CAAC,OAAe;IACpC,OAAO;QACL,IAAI,EAAE,KAAK,IAAI,EAAE;YACf,IAAI,CAAC;gBACH,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,aAAa,CAAC,mBAAmB,EAAE;oBAC1D,uBAAuB,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,gBAAgB,EAAE,IAAI;iBACrE,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,EAAE,GAAG,IAAI,EAAE,CAAC,CAAC;gBAC/C,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,CAAoB,CAAC;YACtD,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,OAAO,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;gBACjC,IAAI,OAAO,CAAC,QAAQ,CAAC,oBAAoB,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,mCAAmC,CAAC,EAAE,CAAC;oBACpG,OAAO,IAAI,CAAC;gBACd,CAAC;gBACD,MAAM,KAAK,CAAC;YACd,CAAC;QACH,CAAC;QACD,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;YAClB,MAAM,gBAAgB,CAAC,mBAAmB,EAAE;gBAC1C,sBAAsB,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,gBAAgB;gBACnE,IAAI;aACL,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACjC,CAAC;QACD,MAAM,EAAE,KAAK,IAAI,EAAE;YACjB,IAAI,CAAC;gBACH,MAAM,aAAa,CAAC,mBAAmB,EAAE;oBACvC,yBAAyB,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,gBAAgB;iBACjE,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,EAAE,GAAG,IAAI,EAAE,CAAC,CAAC;YACjD,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,OAAO,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;gBACjC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,oBAAoB,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,mCAAmC,CAAC,EAAE,CAAC;oBACtG,MAAM,KAAK,CAAC;gBACd,CAAC;YACH,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC;AAED,SAAS,UAAU,CAAC,IAAY;IAC9B,MAAM,OAAO,GAAG;QACd,+BAA+B;QAC/B,8DAA8D;QAC9D,sHAAsH;QACtH,qDAAqD;KACtD,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACZ,MAAM,SAAS,GAAG;QAChB,+BAA+B;QAC/B,kEAAkE;QAClE,wHAAwH;QACxH,2DAA2D;KAC5D,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACZ,OAAO;QACL,IAAI,EAAE,KAAK,IAAI,EAAE;YACf,MAAM,MAAM,GAAG,cAAc,CAA4C,IAAI,CAAC,CAAC;YAC/E,IAAI,MAAM,EAAE,OAAO,KAAK,eAAe,IAAI,CAAC,MAAM,CAAC,UAAU;gBAAE,OAAO,IAAI,CAAC;YAC3E,MAAM,KAAK,GAAG,MAAM,gBAAgB,CAClC,gBAAgB,EAAE,CAAC,YAAY,EAAE,iBAAiB,EAAE,UAAU,EAAE,SAAS,CAAC,EAAE,MAAM,CAAC,UAAU,CAC9F,CAAC;YACF,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,CAAoB,CAAC;QAC9C,CAAC;QACD,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;YAClB,MAAM,UAAU,GAAG,MAAM,gBAAgB,CACvC,gBAAgB,EAAE,CAAC,YAAY,EAAE,iBAAiB,EAAE,UAAU,EAAE,OAAO,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAC9F,CAAC;YACF,UAAU,CAAC,IAAI,EAAE,EAAE,OAAO,EAAE,eAAe,EAAE,UAAU,EAAE,CAAC,CAAC;QAC7D,CAAC;QACD,MAAM,EAAE,KAAK,IAAI,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;KAClD,CAAC;AACJ,CAAC;AAED,SAAS,cAAc,CAAC,OAAuB,EAAE,QAAwB;IACvE,IAAI,QAAQ,GAAkC,IAAI,CAAC;IACnD,OAAO;QACL,IAAI,EAAE,KAAK,IAAI,EAAE;YACf,MAAM,YAAY,GAAG,MAAM,OAAO,CAAC,IAAI,EAAE,CAAC;YAC1C,IAAI,YAAY,EAAE,CAAC;gBACjB,QAAQ,GAAG,SAAS,CAAC;gBACrB,OAAO,YAAY,CAAC;YACtB,CAAC;YACD,MAAM,aAAa,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;YAC5C,IAAI,aAAa;gBAAE,QAAQ,GAAG,UAAU,CAAC;YACzC,OAAO,aAAa,CAAC;QACvB,CAAC;QACD,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;YAClB,IAAI,QAAQ,KAAK,SAAS;gBAAE,OAAO,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACrD,IAAI,QAAQ,KAAK,UAAU;gBAAE,OAAO,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACvD,IAAI,CAAC;gBACH,MAAM,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;gBACxB,QAAQ,GAAG,SAAS,CAAC;YACvB,CAAC;YAAC,MAAM,CAAC;gBACP,MAAM,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;gBACzB,QAAQ,GAAG,UAAU,CAAC;YACxB,CAAC;QACH,CAAC;QACD,MAAM,EAAE,KAAK,IAAI,EAAE;YACjB,MAAM,MAAM,GAAc,EAAE,CAAC;YAC7B,MAAM,OAAO,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;YAC5D,MAAM,QAAQ,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;YAC7D,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC;gBAAE,MAAM,MAAM,CAAC,CAAC,CAAC,CAAC;YACvC,QAAQ,GAAG,IAAI,CAAC;QAClB,CAAC;KACF,CAAC;AACJ,CAAC;AAED,SAAS,cAAc,CAAI,IAAY;IACrC,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAM,CAAC;IACrD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,IAAI,KAAK,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YACrF,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,mDAAmD,CAAC,EAAE;YAClF,IAAI,EAAE,2BAA2B;YACjC,KAAK,EAAE,KAAK;SACb,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED,SAAS,SAAS,CAAC,KAAc;IAC/B,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC;IAC9D,MAAM,KAAK,GAAG,KAAgD,CAAC;IAC/D,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC,OAAO,IAAI,EAAE,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,IAAI,EAAE,CAAC,EAAE,CAAC;AACxE,CAAC"}

package/dist/authorization/recovery-client.d.ts

@@ -0,0 +1,19 @@
+import type { DeviceKey } from "./device-key.js";
+type Dict = Record<string, unknown>;
+export interface AuthorizationRecoveryClientOptions {
+    readonly appUrl: string;
+    readonly body: Dict;
+    readonly signer: DeviceKey;
+    readonly setupCode?: string;
+    readonly fetch?: typeof globalThis.fetch;
+    readonly nowMs?: () => number;
+    readonly sleep?: (milliseconds: number) => Promise<void>;
+    readonly showSetup?: (input: {
+        readonly verificationUrl: string;
+        readonly setupCode: string;
+        readonly keyThumbprint: string;
+    }) => Promise<void> | void;
+}
+/** Browser-approved recovery with proof of the staged candidate private key. */
+export declare function requestAuthorizationKeyRecovery(options: AuthorizationRecoveryClientOptions): Promise<Dict>;
+export {};

package/dist/authorization/recovery-client.js

@@ -0,0 +1,102 @@
+import { assertSetupCode } from "@amalgm/core/identity";
+/** Browser-approved recovery with proof of the staged candidate private key. */
+export async function requestAuthorizationKeyRecovery(options) {
+    const fetchImpl = options.fetch ?? globalThis.fetch;
+    const nowMs = options.nowMs ?? (() => Date.now());
+    const sleep = options.sleep ?? ((milliseconds) => new Promise((resolve) => setTimeout(resolve, milliseconds)));
+    const origin = recoveryOrigin(options.appUrl);
+    const registrationToken = options.setupCode
+        ? text((await postJson(fetchImpl, origin, "/api/auth/computer-setup/redeem", {
+            ...options.body,
+            setup_code: assertSetupCode(options.setupCode),
+        })).computer_registration_token)
+        : await waitForApproval(options, fetchImpl, origin, nowMs, sleep);
+    if (!registrationToken)
+        throw recoveryError("authorization_recovery_token_missing");
+    const registerUrl = new URL("/api/computers/register", origin).toString();
+    const proof = await options.signer.signProof({ method: "POST", url: registerUrl });
+    return postJson(fetchImpl, origin, "/api/computers/register", options.body, {
+        authorization: `Bearer ${registrationToken}`,
+        dpop: proof,
+    });
+}
+async function waitForApproval(options, fetchImpl, origin, nowMs, sleep) {
+    const started = await postJson(fetchImpl, origin, "/api/auth/computer-setup/cli/start", options.body);
+    const deviceCode = text(started.device_code);
+    const setupCode = text(started.setup_code);
+    const verificationUrl = text(started.verification_url);
+    if (!deviceCode || !setupCode || !verificationUrl) {
+        throw recoveryError("authorization_recovery_start_invalid");
+    }
+    await options.showSetup?.({
+        verificationUrl,
+        setupCode,
+        keyThumbprint: options.signer.keyThumbprint,
+    });
+    const deadline = nowMs() + Math.max(60, number(started.expires_in, 180)) * 1000;
+    let intervalMs = Math.max(1, number(started.interval, 2)) * 1000;
+    while (nowMs() < deadline) {
+        const polled = await postJson(fetchImpl, origin, "/api/auth/computer-setup/cli/poll", {
+            ...options.body,
+            device_code: deviceCode,
+        });
+        const status = text(polled.status);
+        if (status === "approved")
+            return text(polled.computer_registration_token);
+        if (status !== "pending")
+            throw recoveryError(`authorization_recovery_${status || "invalid"}`);
+        intervalMs = Math.max(1, number(polled.interval, intervalMs / 1000)) * 1000;
+        await sleep(intervalMs);
+    }
+    throw recoveryError("authorization_recovery_timeout");
+}
+function recoveryOrigin(value) {
+    const url = new URL(value);
+    const loopback = url.hostname === "127.0.0.1" || url.hostname === "localhost" || url.hostname === "::1";
+    if (url.protocol !== "https:" && !(url.protocol === "http:" && loopback)) {
+        throw recoveryError("authorization_recovery_origin_insecure");
+    }
+    url.pathname = "/";
+    url.search = "";
+    url.hash = "";
+    return url.toString();
+}
+async function postJson(fetchImpl, origin, path, body, headers = {}) {
+    const response = await fetchImpl(new URL(path, origin), {
+        method: "POST",
+        redirect: "error",
+        headers: { accept: "application/json", "content-type": "application/json", ...headers },
+        body: JSON.stringify(body),
+    });
+    const bytes = new Uint8Array(await response.arrayBuffer());
+    if (bytes.byteLength > 64 * 1024)
+        throw recoveryError("authorization_recovery_response_too_large");
+    let payload = {};
+    try {
+        payload = bytes.byteLength > 0
+            ? JSON.parse(Buffer.from(bytes).toString("utf8"))
+            : {};
+    }
+    catch {
+        throw recoveryError("authorization_recovery_response_invalid");
+    }
+    if (!response.ok) {
+        throw Object.assign(new Error(`${response.status} ${text(payload.error) || response.statusText}`), {
+            code: `http_${response.status}`,
+            status: response.status,
+            payload,
+        });
+    }
+    return payload;
+}
+function number(value, fallback) {
+    const parsed = Number(value);
+    return Number.isFinite(parsed) ? parsed : fallback;
+}
+function text(value) {
+    return typeof value === "string" ? value.trim() : "";
+}
+function recoveryError(code) {
+    return Object.assign(new Error(code), { code });
+}
+//# sourceMappingURL=recovery-client.js.map

package/dist/authorization/recovery-client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"recovery-client.js","sourceRoot":"","sources":["../../src/authorization/recovery-client.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAqBxD,gFAAgF;AAChF,MAAM,CAAC,KAAK,UAAU,+BAA+B,CACnD,OAA2C;IAE3C,MAAM,SAAS,GAAG,OAAO,CAAC,KAAK,IAAI,UAAU,CAAC,KAAK,CAAC;IACpD,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IAClD,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,CAAC,CAAC,YAAY,EAAE,EAAE,CAAC,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC,CAAC,CAAC;IAC/G,MAAM,MAAM,GAAG,cAAc,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAC9C,MAAM,iBAAiB,GAAG,OAAO,CAAC,SAAS;QACzC,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,QAAQ,CAAC,SAAS,EAAE,MAAM,EAAE,iCAAiC,EAAE;YACzE,GAAG,OAAO,CAAC,IAAI;YACf,UAAU,EAAE,eAAe,CAAC,OAAO,CAAC,SAAS,CAAC;SAC/C,CAAC,CAAC,CAAC,2BAA2B,CAAC;QAClC,CAAC,CAAC,MAAM,eAAe,CAAC,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;IACpE,IAAI,CAAC,iBAAiB;QAAE,MAAM,aAAa,CAAC,sCAAsC,CAAC,CAAC;IAEpF,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,yBAAyB,EAAE,MAAM,CAAC,CAAC,QAAQ,EAAE,CAAC;IAC1E,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,CAAC,CAAC;IACnF,OAAO,QAAQ,CAAC,SAAS,EAAE,MAAM,EAAE,yBAAyB,EAAE,OAAO,CAAC,IAAI,EAAE;QAC1E,aAAa,EAAE,UAAU,iBAAiB,EAAE;QAC5C,IAAI,EAAE,KAAK;KACZ,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,eAAe,CAC5B,OAA2C,EAC3C,SAAkC,EAClC,MAAc,EACd,KAAmB,EACnB,KAA8C;IAE9C,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,SAAS,EAAE,MAAM,EAAE,oCAAoC,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;IACtG,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;IAC7C,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IAC3C,MAAM,eAAe,GAAG,IAAI,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC;IACvD,IAAI,CAAC,UAAU,IAAI,CAAC,SAAS,IAAI,CAAC,eAAe,EAAE,CAAC;QAClD,MAAM,aAAa,CAAC,sCAAsC,CAAC,CAAC;IAC9D,CAAC;IACD,MAAM,OAAO,CAAC,SAAS,EAAE,CAAC;QACxB,eAAe;QACf,SAAS;QACT,aAAa,EAAE,OAAO,CAAC,MAAM,CAAC,aAAa;KAC5C,CAAC,CAAC;IACH,MAAM,QAAQ,GAAG,KAAK,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,MAAM,CAAC,OAAO,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC,GAAG,IAAI,CAAC;IAChF,IAAI,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC;IACjE,OAAO,KAAK,EAAE,GAAG,QAAQ,EAAE,CAAC;QAC1B,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,SAAS,EAAE,MAAM,EAAE,mCAAmC,EAAE;YACpF,GAAG,OAAO,CAAC,IAAI;YACf,WAAW,EAAE,UAAU;SACxB,CAAC,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACnC,IAAI,MAAM,KAAK,UAAU;YAAE,OAAO,IAAI,CAAC,MAAM,CAAC,2BAA2B,CAAC,CAAC;QAC3E,IAAI,MAAM,KAAK,SAAS;YAAE,MAAM,aAAa,CAAC,0BAA0B,MAAM,IAAI,SAAS,EAAE,CAAC,CAAC;QAC/F,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,CAAC,MAAM,CAAC,QAAQ,EAAE,UAAU,GAAG,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC;QAC5E,MAAM,KAAK,CAAC,UAAU,CAAC,CAAC;IAC1B,CAAC;IACD,MAAM,aAAa,CAAC,gCAAgC,CAAC,CAAC;AACxD,CAAC;AAED,SAAS,cAAc,CAAC,KAAa;IACnC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IAC3B,MAAM,QAAQ,GAAG,GAAG,CAAC,QAAQ,KAAK,WAAW,IAAI,GAAG,CAAC,QAAQ,KAAK,WAAW,IAAI,GAAG,CAAC,QAAQ,KAAK,KAAK,CAAC;IACxG,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,CAAC,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,QAAQ,CAAC,EAAE,CAAC;QACzE,MAAM,aAAa,CAAC,wCAAwC,CAAC,CAAC;IAChE,CAAC;IACD,GAAG,CAAC,QAAQ,GAAG,GAAG,CAAC;IACnB,GAAG,CAAC,MAAM,GAAG,EAAE,CAAC;IAChB,GAAG,CAAC,IAAI,GAAG,EAAE,CAAC;IACd,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC;AACxB,CAAC;AAED,KAAK,UAAU,QAAQ,CACrB,SAAkC,EAClC,MAAc,EACd,IAAY,EACZ,IAAU,EACV,UAA4C,EAAE;IAE9C,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,IAAI,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE;QACtD,MAAM,EAAE,MAAM;QACd,QAAQ,EAAE,OAAO;QACjB,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE,cAAc,EAAE,kBAAkB,EAAE,GAAG,OAAO,EAAE;QACvF,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;KAC3B,CAAC,CAAC;IACH,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,MAAM,QAAQ,CAAC,WAAW,EAAE,CAAC,CAAC;IAC3D,IAAI,KAAK,CAAC,UAAU,GAAG,EAAE,GAAG,IAAI;QAAE,MAAM,aAAa,CAAC,2CAA2C,CAAC,CAAC;IACnG,IAAI,OAAO,GAAS,EAAE,CAAC;IACvB,IAAI,CAAC;QACH,OAAO,GAAG,KAAK,CAAC,UAAU,GAAG,CAAC;YAC5B,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAS;YACzD,CAAC,CAAC,EAAE,CAAC;IACT,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,aAAa,CAAC,yCAAyC,CAAC,CAAC;IACjE,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,GAAG,QAAQ,CAAC,MAAM,IAAI,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,QAAQ,CAAC,UAAU,EAAE,CAAC,EAAE;YACjG,IAAI,EAAE,QAAQ,QAAQ,CAAC,MAAM,EAAE;YAC/B,MAAM,EAAE,QAAQ,CAAC,MAAM;YACvB,OAAO;SACR,CAAC,CAAC;IACL,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,MAAM,CAAC,KAAc,EAAE,QAAgB;IAC9C,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IAC7B,OAAO,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC;AACrD,CAAC;AAED,SAAS,IAAI,CAAC,KAAc;IAC1B,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;AACvD,CAAC;AAED,SAAS,aAAa,CAAC,IAAY;IACjC,OAAO,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;AAClD,CAAC"}

package/dist/authorization/recovery-host.d.ts

@@ -0,0 +1,28 @@
+import { type StoredMachine } from "@amalgm/core/identity";
+import type { DeviceKeyStore } from "./key-store.js";
+export interface AuthorizationKeyRecoveryResult {
+    readonly status: "healthy" | "recovered";
+    readonly deviceId: string;
+    readonly computerId: string;
+    readonly keyThumbprint: string;
+}
+export declare function recoverMachineAuthorization(options: Readonly<{
+    machine: StoredMachine;
+    appUrl: string;
+    runtimeVersion: string;
+    runtimeLabel: string;
+    branch: string;
+    fallbackName: string;
+    fallbackPlatform: string;
+    stateDir: string;
+    platform?: NodeJS.Platform;
+    keyStore?: DeviceKeyStore;
+    recoveryKeyStore?: DeviceKeyStore;
+    setupCode?: string;
+    showSetup?: (input: {
+        verificationUrl: string;
+        setupCode: string;
+        keyThumbprint?: string;
+    }) => Promise<void> | void;
+    save(machine: StoredMachine): Promise<void>;
+}>): Promise<AuthorizationKeyRecoveryResult>;

package/dist/authorization/recovery-host.js

@@ -0,0 +1,93 @@
+import { authFromRecord, mergeRecordAuth, publicComputerRecord, } from "@amalgm/core/identity";
+import { deviceKeyFromStored, installationDeviceKeyStores, promoteInstallationDeviceKeyRecovery, requireInstallationDeviceKey, stageInstallationDeviceKeyRecovery, } from "./index.js";
+import { requestAuthorizationKeyRecovery } from "./recovery-client.js";
+export async function recoverMachineAuthorization(options) {
+    const record = mergeRecordAuth(options.machine.publicRecord, options.machine.secretAuth) ?? {};
+    const deviceId = text(record.device_id);
+    const computerId = text(record.computer_id);
+    const userId = text(record.user_id);
+    const expectedLocalKey = text(record.authorization_key_thumbprint);
+    if (!deviceId || !computerId || !userId)
+        throw recoveryError("authorization_recovery_identity_incomplete");
+    const keyOptions = {
+        stateDir: options.stateDir,
+        deviceId,
+        ...(options.platform ? { platform: options.platform } : {}),
+        ...(options.keyStore ? { keyStore: options.keyStore } : {}),
+        ...(options.recoveryKeyStore ? { recoveryKeyStore: options.recoveryKeyStore } : {}),
+    };
+    try {
+        const active = await requireInstallationDeviceKey(keyOptions);
+        if (!expectedLocalKey || active.keyThumbprint === expectedLocalKey) {
+            return result("healthy", deviceId, computerId, active.keyThumbprint);
+        }
+    }
+    catch (error) {
+        const code = text(error?.code);
+        if (code !== "authorization_key_missing" && code !== "authorization_key_corrupt")
+            throw error;
+    }
+    const pending = await installationDeviceKeyStores(keyOptions).pending.load();
+    if (pending) {
+        const staged = deviceKeyFromStored(pending, {});
+        if (expectedLocalKey && staged.keyThumbprint === expectedLocalKey) {
+            await promoteInstallationDeviceKeyRecovery({
+                ...keyOptions,
+                acceptedKeyThumbprint: staged.keyThumbprint,
+            });
+            return result("recovered", deviceId, computerId, staged.keyThumbprint);
+        }
+    }
+    const candidate = await stageInstallationDeviceKeyRecovery(keyOptions);
+    const response = await requestAuthorizationKeyRecovery({
+        appUrl: options.appUrl,
+        body: recoveryBody(options, record, deviceId, candidate.keyThumbprint),
+        signer: candidate,
+        ...(options.setupCode ? { setupCode: options.setupCode } : {}),
+        ...(options.showSetup ? { showSetup: options.showSetup } : {}),
+    });
+    assertRecoveryResponse(response, { deviceId, computerId, userId, key: candidate.keyThumbprint });
+    const merged = { ...record, ...response, app_url: options.appUrl };
+    await options.save({
+        publicRecord: publicComputerRecord(merged),
+        secretAuth: authFromRecord(merged, options.machine.secretAuth, { nowIso: () => new Date().toISOString() }),
+        installation: options.machine.installation,
+        ready: options.machine.ready,
+    });
+    await promoteInstallationDeviceKeyRecovery({
+        ...keyOptions,
+        acceptedKeyThumbprint: candidate.keyThumbprint,
+    });
+    return result("recovered", deviceId, computerId, candidate.keyThumbprint);
+}
+function recoveryBody(options, record, deviceId, key) {
+    return {
+        device_id: deviceId,
+        name: text(record.name) || options.fallbackName,
+        platform: text(record.platform) || options.fallbackPlatform,
+        app_version: options.runtimeVersion,
+        runtime_label: options.runtimeLabel,
+        branch: options.branch,
+        purpose: "authorization_key_recovery",
+        authorization_key_thumbprint: key,
+    };
+}
+function assertRecoveryResponse(response, expected) {
+    if (text(response.device_id) !== expected.deviceId
+        || text(response.computer_id) !== expected.computerId
+        || text(response.user_id) !== expected.userId
+        || text(response.authorization_key_thumbprint) !== expected.key
+        || !text(response.computer_auth_token)
+        || !text(response.tunnel_token))
+        throw recoveryError("authorization_recovery_response_mismatch");
+}
+function result(status, deviceId, computerId, keyThumbprint) {
+    return Object.freeze({ status, deviceId, computerId, keyThumbprint });
+}
+function recoveryError(code) {
+    return Object.assign(new Error(code), { code });
+}
+function text(value) {
+    return typeof value === "string" ? value.trim() : "";
+}
+//# sourceMappingURL=recovery-host.js.map

package/dist/authorization/recovery-host.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"recovery-host.js","sourceRoot":"","sources":["../../src/authorization/recovery-host.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,cAAc,EACd,eAAe,EACf,oBAAoB,GAErB,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EACL,mBAAmB,EACnB,2BAA2B,EAC3B,oCAAoC,EACpC,4BAA4B,EAC5B,kCAAkC,GACnC,MAAM,YAAY,CAAC;AAEpB,OAAO,EAAE,+BAA+B,EAAE,MAAM,sBAAsB,CAAC;AAWvE,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAAC,OAmBhD;IACA,MAAM,MAAM,GAAG,eAAe,CAAC,OAAO,CAAC,OAAO,CAAC,YAAY,EAAE,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC;IAC/F,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IACxC,MAAM,UAAU,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IAC5C,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACpC,MAAM,gBAAgB,GAAG,IAAI,CAAC,MAAM,CAAC,4BAA4B,CAAC,CAAC;IACnE,IAAI,CAAC,QAAQ,IAAI,CAAC,UAAU,IAAI,CAAC,MAAM;QAAE,MAAM,aAAa,CAAC,4CAA4C,CAAC,CAAC;IAC3G,MAAM,UAAU,GAAG;QACjB,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,QAAQ;QACR,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3D,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3D,GAAG,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACpF,CAAC;IAEF,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,4BAA4B,CAAC,UAAU,CAAC,CAAC;QAC9D,IAAI,CAAC,gBAAgB,IAAI,MAAM,CAAC,aAAa,KAAK,gBAAgB,EAAE,CAAC;YACnE,OAAO,MAAM,CAAC,SAAS,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,CAAC,aAAa,CAAC,CAAC;QACvE,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,GAAG,IAAI,CAAE,KAA4B,EAAE,IAAI,CAAC,CAAC;QACvD,IAAI,IAAI,KAAK,2BAA2B,IAAI,IAAI,KAAK,2BAA2B;YAAE,MAAM,KAAK,CAAC;IAChG,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,2BAA2B,CAAC,UAAU,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;IAC7E,IAAI,OAAO,EAAE,CAAC;QACZ,MAAM,MAAM,GAAG,mBAAmB,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;QAChD,IAAI,gBAAgB,IAAI,MAAM,CAAC,aAAa,KAAK,gBAAgB,EAAE,CAAC;YAClE,MAAM,oCAAoC,CAAC;gBACzC,GAAG,UAAU;gBACb,qBAAqB,EAAE,MAAM,CAAC,aAAa;aAC5C,CAAC,CAAC;YACH,OAAO,MAAM,CAAC,WAAW,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,CAAC,aAAa,CAAC,CAAC;QACzE,CAAC;IACH,CAAC;IAED,MAAM,SAAS,GAAG,MAAM,kCAAkC,CAAC,UAAU,CAAC,CAAC;IACvE,MAAM,QAAQ,GAAG,MAAM,+BAA+B,CAAC;QACrD,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,IAAI,EAAE,YAAY,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,CAAC,aAAa,CAAC;QACtE,MAAM,EAAE,SAAS;QACjB,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9D,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC/D,CAAC,CAAC;IACH,sBAAsB,CAAC,QAAQ,EAAE,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,EAAE,GAAG,EAAE,SAAS,CAAC,aAAa,EAAE,CAAC,CAAC;IAEjG,MAAM,MAAM,GAAG,EAAE,GAAG,MAAM,EAAE,GAAG,QAAQ,EAAE,OAAO,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC;IACnE,MAAM,OAAO,CAAC,IAAI,CAAC;QACjB,YAAY,EAAE,oBAAoB,CAAC,MAAM,CAAC;QAC1C,UAAU,EAAE,cAAc,CAAC,MAAM,EAAE,OAAO,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC;QAC1G,YAAY,EAAE,OAAO,CAAC,OAAO,CAAC,YAAY;QAC1C,KAAK,EAAE,OAAO,CAAC,OAAO,CAAC,KAAK;KAC7B,CAAC,CAAC;IACH,MAAM,oCAAoC,CAAC;QACzC,GAAG,UAAU;QACb,qBAAqB,EAAE,SAAS,CAAC,aAAa;KAC/C,CAAC,CAAC;IACH,OAAO,MAAM,CAAC,WAAW,EAAE,QAAQ,EAAE,UAAU,EAAE,SAAS,CAAC,aAAa,CAAC,CAAC;AAC5E,CAAC;AAED,SAAS,YAAY,CACnB,OAA0D,EAC1D,MAAY,EACZ,QAAgB,EAChB,GAAW;IAEX,OAAO;QACL,SAAS,EAAE,QAAQ;QACnB,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,OAAO,CAAC,YAAY;QAC/C,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,OAAO,CAAC,gBAAgB;QAC3D,WAAW,EAAE,OAAO,CAAC,cAAc;QACnC,aAAa,EAAE,OAAO,CAAC,YAAY;QACnC,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,OAAO,EAAE,4BAA4B;QACrC,4BAA4B,EAAE,GAAG;KAClC,CAAC;AACJ,CAAC;AAED,SAAS,sBAAsB,CAC7B,QAAc,EACd,QAAyF;IAEzF,IACE,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,KAAK,QAAQ,CAAC,QAAQ;WAC3C,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,KAAK,QAAQ,CAAC,UAAU;WAClD,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,MAAM;WAC1C,IAAI,CAAC,QAAQ,CAAC,4BAA4B,CAAC,KAAK,QAAQ,CAAC,GAAG;WAC5D,CAAC,IAAI,CAAC,QAAQ,CAAC,mBAAmB,CAAC;WACnC,CAAC,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC;QAC/B,MAAM,aAAa,CAAC,0CAA0C,CAAC,CAAC;AACpE,CAAC;AAED,SAAS,MAAM,CACb,MAAgD,EAChD,QAAgB,EAChB,UAAkB,EAClB,aAAqB;IAErB,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,UAAU,EAAE,aAAa,EAAE,CAAC,CAAC;AACxE,CAAC;AAED,SAAS,aAAa,CAAC,IAAY;IACjC,OAAO,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;AAClD,CAAC;AAED,SAAS,IAAI,CAAC,KAAc;IAC1B,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;AACvD,CAAC"}

package/dist/authorization/recovery.d.ts

@@ -0,0 +1,13 @@
+import type { DeviceKey } from "./device-key.js";
+import type { DeviceKeyStore } from "./key-store.js";
+export interface DeviceKeyRecoveryStores {
+    readonly active: DeviceKeyStore;
+    readonly pending: DeviceKeyStore;
+}
+/** Reuse one pending candidate so a lost server response is safe to retry. */
+export declare function stageDeviceKeyRecovery(stores: DeviceKeyRecoveryStores, ports?: Readonly<{
+    nowMs?: () => number;
+    randomUuid?: () => string;
+}>): Promise<DeviceKey>;
+/** Promote only the exact server-accepted candidate, then erase staging. */
+export declare function promoteDeviceKeyRecovery(stores: DeviceKeyRecoveryStores, acceptedKeyThumbprint: string): Promise<DeviceKey>;

package/dist/authorization/recovery.js

@@ -0,0 +1,27 @@
+import { deviceKeyFromStored, generateStoredDeviceKey, } from "./device-key.js";
+/** Reuse one pending candidate so a lost server response is safe to retry. */
+export async function stageDeviceKeyRecovery(stores, ports = {}) {
+    let candidate = await stores.pending.load();
+    if (!candidate) {
+        candidate = generateStoredDeviceKey();
+        await stores.pending.save(candidate);
+    }
+    return deviceKeyFromStored(candidate, ports);
+}
+/** Promote only the exact server-accepted candidate, then erase staging. */
+export async function promoteDeviceKeyRecovery(stores, acceptedKeyThumbprint) {
+    const candidate = await stores.pending.load();
+    if (!candidate)
+        throw recoveryError("authorization_recovery_candidate_missing");
+    const signer = deviceKeyFromStored(candidate, {});
+    if (signer.keyThumbprint !== acceptedKeyThumbprint) {
+        throw recoveryError("authorization_recovery_candidate_mismatch");
+    }
+    await stores.active.save(candidate);
+    await stores.pending.remove();
+    return signer;
+}
+function recoveryError(code) {
+    return Object.assign(new Error(code), { code });
+}
+//# sourceMappingURL=recovery.js.map

package/dist/authorization/recovery.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"recovery.js","sourceRoot":"","sources":["../../src/authorization/recovery.ts"],"names":[],"mappings":"AACA,OAAO,EACL,mBAAmB,EACnB,uBAAuB,GACxB,MAAM,iBAAiB,CAAC;AAQzB,8EAA8E;AAC9E,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,MAA+B,EAC/B,QAAuE,EAAE;IAEzE,IAAI,SAAS,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;IAC5C,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,SAAS,GAAG,uBAAuB,EAAE,CAAC;QACtC,MAAM,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACvC,CAAC;IACD,OAAO,mBAAmB,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;AAC/C,CAAC;AAED,4EAA4E;AAC5E,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,MAA+B,EAC/B,qBAA6B;IAE7B,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;IAC9C,IAAI,CAAC,SAAS;QAAE,MAAM,aAAa,CAAC,0CAA0C,CAAC,CAAC;IAChF,MAAM,MAAM,GAAG,mBAAmB,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;IAClD,IAAI,MAAM,CAAC,aAAa,KAAK,qBAAqB,EAAE,CAAC;QACnD,MAAM,aAAa,CAAC,2CAA2C,CAAC,CAAC;IACnE,CAAC;IACD,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACpC,MAAM,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;IAC9B,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,aAAa,CAAC,IAAY;IACjC,OAAO,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;AAClD,CAAC"}

package/dist/authorization/secret-process.d.ts

@@ -0,0 +1,2 @@
+/** Run a local credential helper without placing secret input in argv. */
+export declare function runSecretProcess(file: string, args: readonly string[], input: string): Promise<string>;

package/dist/authorization/secret-process.js

@@ -0,0 +1,32 @@
+import { spawn } from "node:child_process";
+const OUTPUT_LIMIT = 64 * 1024;
+/** Run a local credential helper without placing secret input in argv. */
+export function runSecretProcess(file, args, input) {
+    return new Promise((resolve, reject) => {
+        const child = spawn(file, args, { stdio: ["pipe", "pipe", "pipe"] });
+        const stdout = [];
+        const stderr = [];
+        let outputBytes = 0;
+        const collect = (target) => (chunk) => {
+            outputBytes += chunk.byteLength;
+            if (outputBytes > OUTPUT_LIMIT)
+                child.kill();
+            else
+                target.push(Buffer.from(chunk));
+        };
+        child.stdout.on("data", collect(stdout));
+        child.stderr.on("data", collect(stderr));
+        child.once("error", reject);
+        child.once("close", (code) => {
+            if (outputBytes > OUTPUT_LIMIT)
+                return reject(new Error("credential helper output exceeded limit"));
+            if (code === 0)
+                return resolve(Buffer.concat(stdout).toString("utf8"));
+            const error = new Error(`credential helper exited with code ${code ?? "unknown"}`);
+            error.stderr = Buffer.concat(stderr).toString("utf8");
+            reject(error);
+        });
+        child.stdin.end(input);
+    });
+}
+//# sourceMappingURL=secret-process.js.map

package/dist/authorization/secret-process.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secret-process.js","sourceRoot":"","sources":["../../src/authorization/secret-process.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAE3C,MAAM,YAAY,GAAG,EAAE,GAAG,IAAI,CAAC;AAE/B,0EAA0E;AAC1E,MAAM,UAAU,gBAAgB,CAC9B,IAAY,EACZ,IAAuB,EACvB,KAAa;IAEb,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;QACrE,MAAM,MAAM,GAAa,EAAE,CAAC;QAC5B,MAAM,MAAM,GAAa,EAAE,CAAC;QAC5B,IAAI,WAAW,GAAG,CAAC,CAAC;QACpB,MAAM,OAAO,GAAG,CAAC,MAAgB,EAAE,EAAE,CAAC,CAAC,KAAiB,EAAE,EAAE;YAC1D,WAAW,IAAI,KAAK,CAAC,UAAU,CAAC;YAChC,IAAI,WAAW,GAAG,YAAY;gBAAE,KAAK,CAAC,IAAI,EAAE,CAAC;;gBACxC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;QACvC,CAAC,CAAC;QACF,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;QACzC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;QACzC,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC5B,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE;YAC3B,IAAI,WAAW,GAAG,YAAY;gBAAE,OAAO,MAAM,CAAC,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC,CAAC;YACpG,IAAI,IAAI,KAAK,CAAC;gBAAE,OAAO,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;YACvE,MAAM,KAAK,GAAG,IAAI,KAAK,CAAC,sCAAsC,IAAI,IAAI,SAAS,EAAE,CAEhF,CAAC;YACF,KAAK,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;YACtD,MAAM,CAAC,KAAK,CAAC,CAAC;QAChB,CAAC,CAAC,CAAC;QACH,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACzB,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/boot.d.ts

@@ -1,23 +1,24 @@
 import type { Server } from "node:http";
 import { Agents } from "@amalgm/agents";
 import type { Apps } from "@amalgm/apps";
+import { type BrowserAuthorization, type BrowserDriver, type BrowserEventSink, type BrowserRuntimeSelector, type BrowserService } from "@amalgm/browser";
+import type { ChatRuntimePort } from "@amalgm/chat";
+import type { PlatformCredentialBroker } from "@amalgm/chat/host";
 import { StateRail } from "@amalgm/core/state";
 import { Notifications } from "@amalgm/tools";
 import type { EmailDelivery, Toolbox } from "@amalgm/tools";
 import type { PtySessionManager } from "@amalgm/core/pty";
 import { WorkspaceRegistry } from "@amalgm/live/workspace";
 import type { AutomationsHostConfig } from "./automations-host.js";
-import { ChatHost } from "./chat-host.js";
-import type { ChatDriver } from "./chat-host.js";
-import type { ChatRelayHostConfig } from "./chat-relay-host.js";
+import type { ChatHost } from "./chat-host.js";
 import type { ShellConfig } from "./compose.js";
 import type { AutomationEventsHostConfig } from "./events-host.js";
 import type { BrickMount } from "./gateway.js";
 export interface BootConfig extends ShellConfig {
-    /** Turn execution capability; when present the chat service mounts. */
-    chatDriver?: ChatDriver;
-    /** Chat relay contract/network ports; destinations remain contract-bound. */
-    chatRelay?: Partial<Omit<ChatRelayHostConfig, "turnForSession">>;
+    /** Optional runtime injection for tests or non-native hosts. */
+    chatRuntime?: ChatRuntimePort<any, any>;
+    /** Live platform grant capability. Required only for platform-auth Chat. */
+    credentialBroker?: PlatformCredentialBroker;
     /** Automations storage capability; when present /automations mounts. */
     automations?: AutomationsHostConfig;
     /** Automations delivery capability; when present /events mounts. */
@@ -26,16 +27,24 @@ export interface BootConfig extends ShellConfig {
     notifications?: {
         email?: EmailDelivery;
     };
+    /** Optional host capabilities for Shell's one Browser service. */
+    browser?: {
+        electronDriver?: BrowserDriver;
+        runtimeSelector?: BrowserRuntimeSelector;
+        eventSink?: BrowserEventSink;
+        authorization?: BrowserAuthorization;
+    };
 }
 export interface BootedShell {
     readonly gateway: Server;
     readonly stateDirs: Record<string, string>;
     readonly mounts: readonly BrickMount[];
-    readonly chat: ChatHost | null;
+    readonly chat: ChatHost;
     readonly agents: Agents;
     readonly apps: Apps;
     readonly toolbox: Toolbox;
     readonly notifications: Notifications;
+    readonly browser: BrowserService;
     readonly state: StateRail;
     readonly workspace: WorkspaceRegistry;
     readonly pty: PtySessionManager;
@@ -44,10 +53,9 @@ export interface BootedShell {
 }
 /**
  * Boot the shell: identity law hands every brick its state dir, each
- * brick's surface mounts on its engine prefix, and kernel law guards
+ * brick's surface mounts on its Shell prefix, and kernel law guards
  * the door. Bricks that ship their own HTTP server (agents, browser)
- * run on loopback and are forwarded to — the engine's own
- * prefix-to-service-port architecture, applied in-process.
+ * run on loopback and are forwarded through the same gateway.
  * Composition only — no brick behavior is defined here.
  */
 export declare function bootShell(config?: BootConfig): Promise<BootedShell>;