@fentaris/edge 0.2.0

package/dist/enrollment.js

@@ -0,0 +1,186 @@
+import { generateKeyPairSync, randomBytes, sign } from "node:crypto";
+const ACCESS_TOKEN = "access-token";
+const REFRESH_TOKEN = "refresh-token";
+const ACCESS_EXPIRES_AT = "access-expires-at";
+const DEVICE_CREDENTIAL = "device-credential";
+/** Device-authorization enrollment with random key creation and proof-of-possession. */
+export class EdgeEnrollmentService {
+    options;
+    now;
+    sleep;
+    constructor(options) {
+        this.options = options;
+        this.now = options.now ?? Date.now;
+        this.sleep = options.sleep ?? ((ms) => new Promise((resolve) => setTimeout(resolve, ms)));
+    }
+    async login() {
+        const existing = await this.options.platform.configStore.load();
+        if (existing && await this.options.platform.credentialStore.get(DEVICE_CREDENTIAL)) {
+            await this.validAccessToken();
+            return {
+                config: existing,
+                authorization: {
+                    deviceCode: "",
+                    userCode: "",
+                    verificationUri: "",
+                    expiresIn: 0,
+                    interval: 0,
+                },
+                repeated: true,
+            };
+        }
+        const keyPair = await this.loadOrCreateKeyPair();
+        const authorization = await this.options.authorization.begin();
+        await this.options.callbacks.onVerification(authorization);
+        const tokens = await this.awaitAuthorization(authorization);
+        const nonce = randomBytes(32).toString("base64url");
+        const proof = sign(null, Buffer.from(`${authorization.deviceCode}.${nonce}`), keyPair.privateKey).toString("base64url");
+        const enrolled = await this.options.enrollment.enroll({
+            accessToken: tokens.accessToken,
+            publicKey: keyPair.publicKey,
+            deviceCode: authorization.deviceCode,
+            nonce,
+            proof,
+            hostnameLabel: this.options.hostnameLabel?.(),
+        });
+        const config = {
+            edgeNodeId: enrolled.edgeNodeId,
+            tenantId: enrolled.tenantId,
+            gatewayUrl: enrolled.gatewayUrl,
+            enrolledAt: this.now(),
+            hostnameLabel: this.options.hostnameLabel?.(),
+        };
+        await this.options.platform.configStore.save(config);
+        await this.saveTokens(tokens);
+        await this.options.platform.credentialStore.set(DEVICE_CREDENTIAL, enrolled.deviceCredential);
+        return { config, authorization, repeated: false };
+    }
+    async validAccessToken() {
+        const accessToken = await this.options.platform.credentialStore.get(ACCESS_TOKEN);
+        const expiresAt = Number(await this.options.platform.credentialStore.get(ACCESS_EXPIRES_AT));
+        if (accessToken && Number.isFinite(expiresAt) && expiresAt > this.now() + 30_000) {
+            return accessToken;
+        }
+        const refreshToken = await this.options.platform.credentialStore.get(REFRESH_TOKEN);
+        if (!refreshToken)
+            throw new Error("Edge authorization is missing; run fentaris-edge login");
+        const refreshed = await this.options.authorization.refresh(refreshToken);
+        await this.saveTokens(refreshed);
+        return refreshed.accessToken;
+    }
+    async connectionCredentials() {
+        const config = await this.options.platform.configStore.load();
+        const keyPair = await this.options.platform.deviceKeyStore.load();
+        const deviceCredential = await this.options.platform.credentialStore.get(DEVICE_CREDENTIAL);
+        if (!config || !keyPair || !deviceCredential) {
+            throw new Error("Edge device is not enrolled; run fentaris-edge login");
+        }
+        return {
+            config,
+            keyPair,
+            deviceCredential,
+            accessToken: await this.validAccessToken(),
+        };
+    }
+    async revokeRemote() {
+        const config = await this.options.platform.configStore.load();
+        if (!config)
+            return;
+        await this.options.enrollment.revoke(config.edgeNodeId, await this.validAccessToken());
+    }
+    async clearLocalIdentity() {
+        await Promise.all([
+            this.options.platform.configStore.delete(),
+            this.options.platform.deviceKeyStore.delete(),
+            this.options.platform.credentialStore.delete(ACCESS_TOKEN),
+            this.options.platform.credentialStore.delete(REFRESH_TOKEN),
+            this.options.platform.credentialStore.delete(ACCESS_EXPIRES_AT),
+            this.options.platform.credentialStore.delete(DEVICE_CREDENTIAL),
+        ]);
+    }
+    async loadOrCreateKeyPair() {
+        const existing = await this.options.platform.deviceKeyStore.load();
+        if (existing)
+            return existing;
+        const generated = generateKeyPairSync("ed25519", {
+            publicKeyEncoding: { type: "spki", format: "pem" },
+            privateKeyEncoding: { type: "pkcs8", format: "pem" },
+        });
+        const keyPair = {
+            publicKey: generated.publicKey,
+            privateKey: generated.privateKey,
+            createdAt: this.now(),
+        };
+        await this.options.platform.deviceKeyStore.save(keyPair);
+        return keyPair;
+    }
+    async awaitAuthorization(request) {
+        const expiresAt = this.now() + request.expiresIn * 1_000;
+        let interval = Math.max(1, request.interval) * 1_000;
+        while (this.now() < expiresAt) {
+            const result = await this.options.authorization.poll(request.deviceCode);
+            if (result.status === "authorized")
+                return result.tokens;
+            if (result.status === "denied")
+                throw new Error("Device authorization was denied");
+            if (result.status === "expired")
+                break;
+            if (result.status === "slow-down")
+                interval += 5_000;
+            await this.sleep(interval);
+        }
+        throw new Error("Device authorization expired");
+    }
+    async saveTokens(tokens) {
+        await Promise.all([
+            this.options.platform.credentialStore.set(ACCESS_TOKEN, tokens.accessToken),
+            this.options.platform.credentialStore.set(REFRESH_TOKEN, tokens.refreshToken),
+            this.options.platform.credentialStore.set(ACCESS_EXPIRES_AT, String(tokens.expiresAt)),
+        ]);
+    }
+}
+/** HTTP device authorization provider for self-hosted or managed control planes. */
+export class HttpDeviceAuthorizationProvider {
+    baseUrl;
+    clientId;
+    constructor(baseUrl, clientId = "fentaris-edge") {
+        this.baseUrl = baseUrl;
+        this.clientId = clientId;
+    }
+    async begin() {
+        return postJson(`${this.baseUrl}/device/authorize`, { clientId: this.clientId });
+    }
+    async poll(deviceCode) {
+        return postJson(`${this.baseUrl}/device/token`, { clientId: this.clientId, deviceCode });
+    }
+    async refresh(refreshToken) {
+        return postJson(`${this.baseUrl}/token/refresh`, { clientId: this.clientId, refreshToken });
+    }
+}
+/** HTTP enrollment client. Sensitive authorization fields are never included in errors. */
+export class HttpEdgeEnrollmentClient {
+    baseUrl;
+    constructor(baseUrl) {
+        this.baseUrl = baseUrl;
+    }
+    async enroll(request) {
+        return postJson(`${this.baseUrl}/edge/enroll`, request, request.accessToken);
+    }
+    async revoke(edgeNodeId, accessToken) {
+        await postJson(`${this.baseUrl}/edge/revoke`, { edgeNodeId }, accessToken);
+    }
+}
+async function postJson(url, body, bearer) {
+    const response = await fetch(url, {
+        method: "POST",
+        headers: {
+            "content-type": "application/json",
+            ...(bearer ? { authorization: `Bearer ${bearer}` } : {}),
+        },
+        body: JSON.stringify(body),
+    });
+    if (!response.ok)
+        throw new Error(`Edge control-plane request failed with HTTP ${response.status}`);
+    return response.json();
+}
+//# sourceMappingURL=enrollment.js.map

package/dist/enrollment.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"enrollment.js","sourceRoot":"","sources":["../src/enrollment.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,aAAa,CAAC;AA0FrE,MAAM,YAAY,GAAG,cAAc,CAAC;AACpC,MAAM,aAAa,GAAG,eAAe,CAAC;AACtC,MAAM,iBAAiB,GAAG,mBAAmB,CAAC;AAC9C,MAAM,iBAAiB,GAAG,mBAAmB,CAAC;AAE9C,wFAAwF;AACxF,MAAM,OAAO,qBAAqB;IAIH;IAHZ,GAAG,CAAe;IAClB,KAAK,CAAgC;IAEtD,YAA6B,OAAqC;QAArC,YAAO,GAAP,OAAO,CAA8B;QAChE,IAAI,CAAC,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;QACnC,IAAI,CAAC,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;IAC5F,CAAC;IAED,KAAK,CAAC,KAAK;QACT,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC;QAChE,IAAI,QAAQ,IAAI,MAAM,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAC,GAAG,CAAC,iBAAiB,CAAC,EAAE,CAAC;YACnF,MAAM,IAAI,CAAC,gBAAgB,EAAE,CAAC;YAC9B,OAAO;gBACL,MAAM,EAAE,QAAQ;gBAChB,aAAa,EAAE;oBACb,UAAU,EAAE,EAAE;oBACd,QAAQ,EAAE,EAAE;oBACZ,eAAe,EAAE,EAAE;oBACnB,SAAS,EAAE,CAAC;oBACZ,QAAQ,EAAE,CAAC;iBACZ;gBACD,QAAQ,EAAE,IAAI;aACf,CAAC;QACJ,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,mBAAmB,EAAE,CAAC;QACjD,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,KAAK,EAAE,CAAC;QAC/D,MAAM,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,cAAc,CAAC,aAAa,CAAC,CAAC;QAC3D,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,aAAa,CAAC,CAAC;QAC5D,MAAM,KAAK,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QACpD,MAAM,KAAK,GAAG,IAAI,CAChB,IAAI,EACJ,MAAM,CAAC,IAAI,CAAC,GAAG,aAAa,CAAC,UAAU,IAAI,KAAK,EAAE,CAAC,EACnD,OAAO,CAAC,UAAU,CACnB,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QACxB,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC;YACpD,WAAW,EAAE,MAAM,CAAC,WAAW;YAC/B,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,UAAU,EAAE,aAAa,CAAC,UAAU;YACpC,KAAK;YACL,KAAK;YACL,aAAa,EAAE,IAAI,CAAC,OAAO,CAAC,aAAa,EAAE,EAAE;SAC9C,CAAC,CAAC;QACH,MAAM,MAAM,GAAoB;YAC9B,UAAU,EAAE,QAAQ,CAAC,UAAU;YAC/B,QAAQ,EAAE,QAAQ,CAAC,QAAQ;YAC3B,UAAU,EAAE,QAAQ,CAAC,UAAU;YAC/B,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE;YACtB,aAAa,EAAE,IAAI,CAAC,OAAO,CAAC,aAAa,EAAE,EAAE;SAC9C,CAAC;QACF,MAAM,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACrD,MAAM,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;QAC9B,MAAM,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAC,GAAG,CAAC,iBAAiB,EAAE,QAAQ,CAAC,gBAAgB,CAAC,CAAC;QAC9F,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;IACpD,CAAC;IAED,KAAK,CAAC,gBAAgB;QACpB,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QAClF,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC,CAAC;QAC7F,IAAI,WAAW,IAAI,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,EAAE,CAAC;YACjF,OAAO,WAAW,CAAC;QACrB,CAAC;QACD,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;QACpF,IAAI,CAAC,YAAY;YAAE,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;QAC7F,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;QACzE,MAAM,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;QACjC,OAAO,SAAS,CAAC,WAAW,CAAC;IAC/B,CAAC;IAED,KAAK,CAAC,qBAAqB;QACzB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC;QAC9D,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC;QAClE,MAAM,gBAAgB,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;QAC5F,IAAI,CAAC,MAAM,IAAI,CAAC,OAAO,IAAI,CAAC,gBAAgB,EAAE,CAAC;YAC7C,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;QAC1E,CAAC;QACD,OAAO;YACL,MAAM;YACN,OAAO;YACP,gBAAgB;YAChB,WAAW,EAAE,MAAM,IAAI,CAAC,gBAAgB,EAAE;SAC3C,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,YAAY;QAChB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC;QAC9D,IAAI,CAAC,MAAM;YAAE,OAAO;QACpB,MAAM,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,UAAU,EAAE,MAAM,IAAI,CAAC,gBAAgB,EAAE,CAAC,CAAC;IACzF,CAAC;IAED,KAAK,CAAC,kBAAkB;QACtB,MAAM,OAAO,CAAC,GAAG,CAAC;YAChB,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC,MAAM,EAAE;YAC1C,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC,MAAM,EAAE;YAC7C,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAC,MAAM,CAAC,YAAY,CAAC;YAC1D,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAC,MAAM,CAAC,aAAa,CAAC;YAC3D,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAC,MAAM,CAAC,iBAAiB,CAAC;YAC/D,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAC,MAAM,CAAC,iBAAiB,CAAC;SAChE,CAAC,CAAC;IACL,CAAC;IAEO,KAAK,CAAC,mBAAmB;QAC/B,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC;QACnE,IAAI,QAAQ;YAAE,OAAO,QAAQ,CAAC;QAC9B,MAAM,SAAS,GAAG,mBAAmB,CAAC,SAAS,EAAE;YAC/C,iBAAiB,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE;YAClD,kBAAkB,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE;SACrD,CAAC,CAAC;QACH,MAAM,OAAO,GAAwB;YACnC,SAAS,EAAE,SAAS,CAAC,SAAS;YAC9B,UAAU,EAAE,SAAS,CAAC,UAAU;YAChC,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;SACtB,CAAC;QACF,MAAM,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACzD,OAAO,OAAO,CAAC;IACjB,CAAC;IAEO,KAAK,CAAC,kBAAkB,CAAC,OAAmC;QAClE,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC,SAAS,GAAG,KAAK,CAAC;QACzD,IAAI,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,CAAC,QAAQ,CAAC,GAAG,KAAK,CAAC;QACrD,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,EAAE,CAAC;YAC9B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;YACzE,IAAI,MAAM,CAAC,MAAM,KAAK,YAAY;gBAAE,OAAO,MAAM,CAAC,MAAM,CAAC;YACzD,IAAI,MAAM,CAAC,MAAM,KAAK,QAAQ;gBAAE,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;YACnF,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS;gBAAE,MAAM;YACvC,IAAI,MAAM,CAAC,MAAM,KAAK,WAAW;gBAAE,QAAQ,IAAI,KAAK,CAAC;YACrD,MAAM,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QAC7B,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;IAClD,CAAC;IAEO,KAAK,CAAC,UAAU,CAAC,MAA+B;QACtD,MAAM,OAAO,CAAC,GAAG,CAAC;YAChB,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAC,GAAG,CAAC,YAAY,EAAE,MAAM,CAAC,WAAW,CAAC;YAC3E,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAC,GAAG,CAAC,aAAa,EAAE,MAAM,CAAC,YAAY,CAAC;YAC7E,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAC,GAAG,CAAC,iBAAiB,EAAE,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;SACvF,CAAC,CAAC;IACL,CAAC;CACF;AAED,oFAAoF;AACpF,MAAM,OAAO,+BAA+B;IACb;IAAkC;IAA/D,YAA6B,OAAe,EAAmB,WAAW,eAAe;QAA5D,YAAO,GAAP,OAAO,CAAQ;QAAmB,aAAQ,GAAR,QAAQ,CAAkB;IAAG,CAAC;IAC7F,KAAK,CAAC,KAAK;QACT,OAAO,QAAQ,CAAC,GAAG,IAAI,CAAC,OAAO,mBAAmB,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC;IACnF,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,UAAkB;QAC3B,OAAO,QAAQ,CAAC,GAAG,IAAI,CAAC,OAAO,eAAe,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,UAAU,EAAE,CAAC,CAAC;IAC3F,CAAC;IACD,KAAK,CAAC,OAAO,CAAC,YAAoB;QAChC,OAAO,QAAQ,CAAC,GAAG,IAAI,CAAC,OAAO,gBAAgB,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,YAAY,EAAE,CAAC,CAAC;IAC9F,CAAC;CACF;AAED,2FAA2F;AAC3F,MAAM,OAAO,wBAAwB;IACN;IAA7B,YAA6B,OAAe;QAAf,YAAO,GAAP,OAAO,CAAQ;IAAG,CAAC;IAChD,KAAK,CAAC,MAAM,CAAC,OAA8B;QACzC,OAAO,QAAQ,CAAC,GAAG,IAAI,CAAC,OAAO,cAAc,EAAE,OAAO,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC;IAC/E,CAAC;IACD,KAAK,CAAC,MAAM,CAAC,UAAkB,EAAE,WAAmB;QAClD,MAAM,QAAQ,CAAC,GAAG,IAAI,CAAC,OAAO,cAAc,EAAE,EAAE,UAAU,EAAE,EAAE,WAAW,CAAC,CAAC;IAC7E,CAAC;CACF;AAED,KAAK,UAAU,QAAQ,CAAI,GAAW,EAAE,IAAa,EAAE,MAAe;IACpE,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;QAChC,MAAM,EAAE,MAAM;QACd,OAAO,EAAE;YACP,cAAc,EAAE,kBAAkB;YAClC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,UAAU,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACzD;QACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;KAC3B,CAAC,CAAC;IACH,IAAI,CAAC,QAAQ,CAAC,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,+CAA+C,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;IACpG,OAAO,QAAQ,CAAC,IAAI,EAAgB,CAAC;AACvC,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,25 @@
+#!/usr/bin/env node
+import { createDefaultEdgeAgent, EdgeAgent, WebSocketEdgeConnectionClient } from "./agent.js";
+import { runEdgeCli, type EdgeCliIo } from "./cli.js";
+export { EdgeAgent, WebSocketEdgeConnectionClient, createDefaultEdgeAgent, runEdgeCli, };
+export type { DefaultAgentOptions, EdgeAgentOptions, EdgeAgentStatus, EdgeRuntimeSummary, EdgeRuntimeSummaryProvider, } from "./agent.js";
+export type { EdgeCliIo } from "./cli.js";
+export { EdgeEnrollmentService, HttpDeviceAuthorizationProvider, HttpEdgeEnrollmentClient, } from "./enrollment.js";
+export type { DeviceAuthorizationPollResult, DeviceAuthorizationProvider, DeviceAuthorizationRequest, EdgeAuthorizationTokens, EdgeConnection, EdgeConnectionClient, EdgeEnrollmentClient, EdgeEnrollmentRequest, EdgeEnrollmentResult, EdgeEnrollmentServiceOptions, EdgeLoginResult, EnrollmentCallbacks, } from "./enrollment.js";
+export { NodeProcessSupervisor, ProtectedFileCredentialStore, ProtectedJsonStore, defaultEdgePaths, nodeEdgePlatform, } from "./platform.js";
+export type { CredentialStore, EdgeLocalConfig, EdgePaths, EdgePlatform, JsonStore, ProcessStartOptions, ProcessSupervisorAdapter, StoredDeviceKeyPair, SupervisedProcess, } from "./platform.js";
+export { redactEdgeValue, safeEdgeError } from "./redaction.js";
+export { LocalSetupManager, NodeTerminalSetupPrompter, TerminalSetupProvider, } from "./setup.js";
+export { EdgeWorkloadSupervisor, ExecutableAllowlistPolicy } from "./supervisor.js";
+export { StdioEdgeWorkloadFactory } from "./stdioWorkload.js";
+export { EdgeAgentRuntime } from "./runtime.js";
+export type { EdgeAgentRuntimeOptions, EdgeConnectionRuntime, EdgeRuntimeConnection, } from "./runtime.js";
+export type { DeploymentReconcileResult, EdgeWorkload, EdgeWorkloadFactory, EdgeWorkloadPolicy, EdgeWorkloadSupervisorOptions, ExecutableAllowlistPolicyOptions, LocalMcpClient, LocalMcpCapabilityManifest, SupervisedDesiredDeployment, } from "./supervisor.js";
+export type { CompiledLocalLaunchPlan, DesiredSetupRequirement, LocalGrantDatabase, LocalGrantRecord, LocalSetupManagerOptions, LocalSetupProvider, LocalSetupState, LocalSetupStatus, SetupFieldResponse, TerminalSetupPrompter, } from "./setup.js";
+export declare function main(argv: readonly string[], options?: {
+    agent?: EdgeAgent;
+    io?: EdgeCliIo;
+    controlPlaneUrl?: string;
+}): Promise<number>;
+export declare function isDirectCliInvocation(entrypointUrl?: string, argvPath?: string): boolean;
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AAGA,OAAO,EAAE,sBAAsB,EAAE,SAAS,EAAE,6BAA6B,EAAE,MAAM,YAAY,CAAC;AAC9F,OAAO,EAAE,UAAU,EAAE,KAAK,SAAS,EAAE,MAAM,UAAU,CAAC;AAEtD,OAAO,EACL,SAAS,EACT,6BAA6B,EAC7B,sBAAsB,EACtB,UAAU,GACX,CAAC;AACF,YAAY,EACV,mBAAmB,EACnB,gBAAgB,EAChB,eAAe,EACf,kBAAkB,EAClB,0BAA0B,GAC3B,MAAM,YAAY,CAAC;AACpB,YAAY,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AAC1C,OAAO,EACL,qBAAqB,EACrB,+BAA+B,EAC/B,wBAAwB,GACzB,MAAM,iBAAiB,CAAC;AACzB,YAAY,EACV,6BAA6B,EAC7B,2BAA2B,EAC3B,0BAA0B,EAC1B,uBAAuB,EACvB,cAAc,EACd,oBAAoB,EACpB,oBAAoB,EACpB,qBAAqB,EACrB,oBAAoB,EACpB,4BAA4B,EAC5B,eAAe,EACf,mBAAmB,GACpB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,qBAAqB,EACrB,4BAA4B,EAC5B,kBAAkB,EAClB,gBAAgB,EAChB,gBAAgB,GACjB,MAAM,eAAe,CAAC;AACvB,YAAY,EACV,eAAe,EACf,eAAe,EACf,SAAS,EACT,YAAY,EACZ,SAAS,EACT,mBAAmB,EACnB,wBAAwB,EACxB,mBAAmB,EACnB,iBAAiB,GAClB,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAChE,OAAO,EACL,iBAAiB,EACjB,yBAAyB,EACzB,qBAAqB,GACtB,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,sBAAsB,EAAE,yBAAyB,EAAE,MAAM,iBAAiB,CAAC;AACpF,OAAO,EAAE,wBAAwB,EAAE,MAAM,oBAAoB,CAAC;AAC9D,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAChD,YAAY,EACV,uBAAuB,EACvB,qBAAqB,EACrB,qBAAqB,GACtB,MAAM,cAAc,CAAC;AACtB,YAAY,EACV,yBAAyB,EACzB,YAAY,EACZ,mBAAmB,EACnB,kBAAkB,EAClB,6BAA6B,EAC7B,gCAAgC,EAChC,cAAc,EACd,0BAA0B,EAC1B,2BAA2B,GAC5B,MAAM,iBAAiB,CAAC;AACzB,YAAY,EACV,uBAAuB,EACvB,uBAAuB,EACvB,kBAAkB,EAClB,gBAAgB,EAChB,wBAAwB,EACxB,kBAAkB,EAClB,eAAe,EACf,gBAAgB,EAChB,kBAAkB,EAClB,qBAAqB,GACtB,MAAM,YAAY,CAAC;AAEpB,wBAAsB,IAAI,CACxB,IAAI,EAAE,SAAS,MAAM,EAAE,EACvB,OAAO,GAAE;IACP,KAAK,CAAC,EAAE,SAAS,CAAC;IAClB,EAAE,CAAC,EAAE,SAAS,CAAC;IACf,eAAe,CAAC,EAAE,MAAM,CAAC;CACrB,GACL,OAAO,CAAC,MAAM,CAAC,CAejB;AAED,wBAAgB,qBAAqB,CAAC,aAAa,SAAkB,EAAE,QAAQ,SAAkB,GAAG,OAAO,CAG1G"}

package/dist/index.js

@@ -0,0 +1,48 @@
+#!/usr/bin/env node
+import { realpathSync } from "node:fs";
+import { fileURLToPath } from "node:url";
+import { createDefaultEdgeAgent, EdgeAgent, WebSocketEdgeConnectionClient } from "./agent.js";
+import { runEdgeCli } from "./cli.js";
+export { EdgeAgent, WebSocketEdgeConnectionClient, createDefaultEdgeAgent, runEdgeCli, };
+export { EdgeEnrollmentService, HttpDeviceAuthorizationProvider, HttpEdgeEnrollmentClient, } from "./enrollment.js";
+export { NodeProcessSupervisor, ProtectedFileCredentialStore, ProtectedJsonStore, defaultEdgePaths, nodeEdgePlatform, } from "./platform.js";
+export { redactEdgeValue, safeEdgeError } from "./redaction.js";
+export { LocalSetupManager, NodeTerminalSetupPrompter, TerminalSetupProvider, } from "./setup.js";
+export { EdgeWorkloadSupervisor, ExecutableAllowlistPolicy } from "./supervisor.js";
+export { StdioEdgeWorkloadFactory } from "./stdioWorkload.js";
+export { EdgeAgentRuntime } from "./runtime.js";
+export async function main(argv, options = {}) {
+    const io = options.io ?? {
+        out: (value) => console.log(value),
+        error: (value) => console.error(value),
+    };
+    const agent = options.agent ?? createDefaultEdgeAgent({
+        controlPlaneUrl: options.controlPlaneUrl ?? process.env.FENTARIS_EDGE_CONTROL_PLANE_URL ?? "",
+        onVerification: (request) => {
+            io.out(JSON.stringify({
+                verificationUri: request.verificationUri,
+                userCode: request.userCode,
+            }));
+        },
+    });
+    return runEdgeCli(argv, agent, io);
+}
+export function isDirectCliInvocation(entrypointUrl = import.meta.url, argvPath = process.argv[1]) {
+    if (!argvPath)
+        return false;
+    return resolvePath(fileURLToPath(entrypointUrl)) === resolvePath(argvPath);
+}
+if (isDirectCliInvocation()) {
+    main(process.argv.slice(2)).then((code) => {
+        process.exitCode = code;
+    });
+}
+function resolvePath(value) {
+    try {
+        return realpathSync(value);
+    }
+    catch {
+        return value;
+    }
+}
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AACA,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,sBAAsB,EAAE,SAAS,EAAE,6BAA6B,EAAE,MAAM,YAAY,CAAC;AAC9F,OAAO,EAAE,UAAU,EAAkB,MAAM,UAAU,CAAC;AAEtD,OAAO,EACL,SAAS,EACT,6BAA6B,EAC7B,sBAAsB,EACtB,UAAU,GACX,CAAC;AASF,OAAO,EACL,qBAAqB,EACrB,+BAA+B,EAC/B,wBAAwB,GACzB,MAAM,iBAAiB,CAAC;AAezB,OAAO,EACL,qBAAqB,EACrB,4BAA4B,EAC5B,kBAAkB,EAClB,gBAAgB,EAChB,gBAAgB,GACjB,MAAM,eAAe,CAAC;AAYvB,OAAO,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAChE,OAAO,EACL,iBAAiB,EACjB,yBAAyB,EACzB,qBAAqB,GACtB,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,sBAAsB,EAAE,yBAAyB,EAAE,MAAM,iBAAiB,CAAC;AACpF,OAAO,EAAE,wBAAwB,EAAE,MAAM,oBAAoB,CAAC;AAC9D,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AA8BhD,MAAM,CAAC,KAAK,UAAU,IAAI,CACxB,IAAuB,EACvB,UAII,EAAE;IAEN,MAAM,EAAE,GAAG,OAAO,CAAC,EAAE,IAAI;QACvB,GAAG,EAAE,CAAC,KAAa,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC;QAC1C,KAAK,EAAE,CAAC,KAAa,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC;KAC/C,CAAC;IACF,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,sBAAsB,CAAC;QACpD,eAAe,EAAE,OAAO,CAAC,eAAe,IAAI,OAAO,CAAC,GAAG,CAAC,+BAA+B,IAAI,EAAE;QAC7F,cAAc,EAAE,CAAC,OAAO,EAAE,EAAE;YAC1B,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC;gBACpB,eAAe,EAAE,OAAO,CAAC,eAAe;gBACxC,QAAQ,EAAE,OAAO,CAAC,QAAQ;aAC3B,CAAC,CAAC,CAAC;QACN,CAAC;KACF,CAAC,CAAC;IACH,OAAO,UAAU,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC;AACrC,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,aAAa,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;IAC/F,IAAI,CAAC,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC5B,OAAO,WAAW,CAAC,aAAa,CAAC,aAAa,CAAC,CAAC,KAAK,WAAW,CAAC,QAAQ,CAAC,CAAC;AAC7E,CAAC;AAED,IAAI,qBAAqB,EAAE,EAAE,CAAC;IAC5B,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE;QACxC,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC;IAC1B,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,WAAW,CAAC,KAAa;IAChC,IAAI,CAAC;QACH,OAAO,YAAY,CAAC,KAAK,CAAC,CAAC;IAC7B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC"}

package/dist/platform.d.ts

@@ -0,0 +1,82 @@
+export interface EdgePaths {
+    readonly dataDir: string;
+    readonly configFile: string;
+    readonly deviceKeyFile: string;
+    readonly credentialFile: string;
+}
+export interface JsonStore<T> {
+    load(): Promise<T | undefined>;
+    save(value: T): Promise<void>;
+    delete(): Promise<void>;
+}
+export interface CredentialStore {
+    get(name: string): Promise<string | undefined>;
+    set(name: string, value: string): Promise<void>;
+    delete(name: string): Promise<void>;
+}
+export interface ProcessStartOptions {
+    readonly command: string;
+    readonly args?: readonly string[];
+    readonly env?: Readonly<Record<string, string>>;
+    readonly cwd?: string;
+    readonly stderr?: "inherit" | "pipe" | "ignore";
+}
+export interface SupervisedProcess {
+    readonly pid?: number;
+    readonly exited: Promise<{
+        code: number | null;
+        signal: NodeJS.Signals | null;
+    }>;
+    terminate(signal?: NodeJS.Signals): void;
+}
+export interface ProcessSupervisorAdapter {
+    start(options: ProcessStartOptions): Promise<SupervisedProcess>;
+}
+export interface EdgePlatform {
+    readonly paths: EdgePaths;
+    readonly deviceKeyStore: JsonStore<StoredDeviceKeyPair>;
+    readonly configStore: JsonStore<EdgeLocalConfig>;
+    readonly credentialStore: CredentialStore;
+    readonly processSupervisor: ProcessSupervisorAdapter;
+}
+export interface StoredDeviceKeyPair {
+    readonly publicKey: string;
+    readonly privateKey: string;
+    readonly createdAt: number;
+}
+export interface EdgeLocalConfig {
+    readonly edgeNodeId: string;
+    readonly tenantId: string;
+    readonly gatewayUrl: string;
+    readonly enrolledAt: number;
+    readonly hostnameLabel?: string;
+}
+/** Resolve platform-specific local state paths without using them as identity. */
+export declare function defaultEdgePaths(home?: string, platform?: NodeJS.Platform): EdgePaths;
+/** Protected JSON file store used for local config and fallback secret state. */
+export declare class ProtectedJsonStore<T> implements JsonStore<T> {
+    private readonly file;
+    private readonly mode;
+    constructor(file: string, mode?: number);
+    load(): Promise<T | undefined>;
+    save(value: T): Promise<void>;
+    delete(): Promise<void>;
+}
+/**
+ * Protected file credential fallback. Platforms with an OS credential manager
+ * should supply another {@link CredentialStore}; this adapter never exposes
+ * the backing path or stored values through status APIs.
+ */
+export declare class ProtectedFileCredentialStore implements CredentialStore {
+    private readonly store;
+    constructor(file: string);
+    get(name: string): Promise<string | undefined>;
+    set(name: string, value: string): Promise<void>;
+    delete(name: string): Promise<void>;
+}
+/** Node child-process implementation hidden behind the process supervisor seam. */
+export declare class NodeProcessSupervisor implements ProcessSupervisorAdapter {
+    start(options: ProcessStartOptions): Promise<SupervisedProcess>;
+}
+export declare function nodeEdgePlatform(paths?: EdgePaths): EdgePlatform;
+//# sourceMappingURL=platform.d.ts.map

package/dist/platform.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"platform.d.ts","sourceRoot":"","sources":["../src/platform.ts"],"names":[],"mappings":"AAKA,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;CACjC;AAED,MAAM,WAAW,SAAS,CAAC,CAAC;IAC1B,IAAI,IAAI,OAAO,CAAC,CAAC,GAAG,SAAS,CAAC,CAAC;IAC/B,IAAI,CAAC,KAAK,EAAE,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9B,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACzB;AAED,MAAM,WAAW,eAAe;IAC9B,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;IAC/C,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAChD,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACrC;AAED,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,IAAI,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAClC,QAAQ,CAAC,GAAG,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAChD,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,GAAG,MAAM,GAAG,QAAQ,CAAC;CACjD;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;QAAE,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC,OAAO,GAAG,IAAI,CAAA;KAAE,CAAC,CAAC;IACjF,SAAS,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,OAAO,GAAG,IAAI,CAAC;CAC1C;AAED,MAAM,WAAW,wBAAwB;IACvC,KAAK,CAAC,OAAO,EAAE,mBAAmB,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAAC;CACjE;AAED,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,KAAK,EAAE,SAAS,CAAC;IAC1B,QAAQ,CAAC,cAAc,EAAE,SAAS,CAAC,mBAAmB,CAAC,CAAC;IACxD,QAAQ,CAAC,WAAW,EAAE,SAAS,CAAC,eAAe,CAAC,CAAC;IACjD,QAAQ,CAAC,eAAe,EAAE,eAAe,CAAC;IAC1C,QAAQ,CAAC,iBAAiB,EAAE,wBAAwB,CAAC;CACtD;AAED,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;CACjC;AAED,kFAAkF;AAClF,wBAAgB,gBAAgB,CAAC,IAAI,GAAE,MAAkB,EAAE,QAAQ,GAAE,MAAM,CAAC,QAA2B,GAAG,SAAS,CAYlH;AAED,iFAAiF;AACjF,qBAAa,kBAAkB,CAAC,CAAC,CAAE,YAAW,SAAS,CAAC,CAAC,CAAC;IAEtD,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,IAAI;gBADJ,IAAI,EAAE,MAAM,EACZ,IAAI,GAAE,MAAc;IAGjC,IAAI,IAAI,OAAO,CAAC,CAAC,GAAG,SAAS,CAAC;IAS9B,IAAI,CAAC,KAAK,EAAE,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC;IAW7B,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC;CAG9B;AAED;;;;GAIG;AACH,qBAAa,4BAA6B,YAAW,eAAe;IAClE,OAAO,CAAC,QAAQ,CAAC,KAAK,CAA6C;gBACvD,IAAI,EAAE,MAAM;IAGlB,GAAG,CAAC,IAAI,EAAE,MAAM;IAGhB,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM;IAI/B,MAAM,CAAC,IAAI,EAAE,MAAM;CAM1B;AAED,mFAAmF;AACnF,qBAAa,qBAAsB,YAAW,wBAAwB;IAC9D,KAAK,CAAC,OAAO,EAAE,mBAAmB,GAAG,OAAO,CAAC,iBAAiB,CAAC;CAStE;AAED,wBAAgB,gBAAgB,CAAC,KAAK,GAAE,SAA8B,GAAG,YAAY,CAQpF"}

package/dist/platform.js

@@ -0,0 +1,112 @@
+import { spawn } from "node:child_process";
+import { chmod, mkdir, readFile, rename, rm, writeFile } from "node:fs/promises";
+import { homedir } from "node:os";
+import path from "node:path";
+/** Resolve platform-specific local state paths without using them as identity. */
+export function defaultEdgePaths(home = homedir(), platform = process.platform) {
+    const dataDir = platform === "win32"
+        ? path.join(process.env.LOCALAPPDATA ?? home, "Fentaris", "edge")
+        : platform === "darwin"
+            ? path.join(home, "Library", "Application Support", "Fentaris", "edge")
+            : path.join(process.env.XDG_STATE_HOME ?? path.join(home, ".local", "state"), "fentaris", "edge");
+    return {
+        dataDir,
+        configFile: path.join(dataDir, "config.json"),
+        deviceKeyFile: path.join(dataDir, "device-key.json"),
+        credentialFile: path.join(dataDir, "credentials.json"),
+    };
+}
+/** Protected JSON file store used for local config and fallback secret state. */
+export class ProtectedJsonStore {
+    file;
+    mode;
+    constructor(file, mode = 0o600) {
+        this.file = file;
+        this.mode = mode;
+    }
+    async load() {
+        try {
+            return JSON.parse(await readFile(this.file, "utf8"));
+        }
+        catch (error) {
+            if (isNotFound(error))
+                return undefined;
+            throw error;
+        }
+    }
+    async save(value) {
+        const directory = path.dirname(this.file);
+        await mkdir(directory, { recursive: true, mode: 0o700 });
+        await chmod(directory, 0o700).catch(() => undefined);
+        const temporary = `${this.file}.${process.pid}.tmp`;
+        await writeFile(temporary, JSON.stringify(value), { encoding: "utf8", mode: this.mode });
+        await chmod(temporary, this.mode).catch(() => undefined);
+        await rename(temporary, this.file);
+        await chmod(this.file, this.mode).catch(() => undefined);
+    }
+    async delete() {
+        await rm(this.file, { force: true });
+    }
+}
+/**
+ * Protected file credential fallback. Platforms with an OS credential manager
+ * should supply another {@link CredentialStore}; this adapter never exposes
+ * the backing path or stored values through status APIs.
+ */
+export class ProtectedFileCredentialStore {
+    store;
+    constructor(file) {
+        this.store = new ProtectedJsonStore(file);
+    }
+    async get(name) {
+        return (await this.store.load())?.[name];
+    }
+    async set(name, value) {
+        const credentials = await this.store.load() ?? {};
+        await this.store.save({ ...credentials, [name]: value });
+    }
+    async delete(name) {
+        const credentials = await this.store.load() ?? {};
+        delete credentials[name];
+        if (Object.keys(credentials).length === 0)
+            await this.store.delete();
+        else
+            await this.store.save(credentials);
+    }
+}
+/** Node child-process implementation hidden behind the process supervisor seam. */
+export class NodeProcessSupervisor {
+    async start(options) {
+        const child = spawn(options.command, [...(options.args ?? [])], {
+            cwd: options.cwd,
+            env: options.env ? { ...process.env, ...options.env } : process.env,
+            stdio: ["pipe", "pipe", options.stderr ?? "pipe"],
+            windowsHide: true,
+        });
+        return childHandle(child);
+    }
+}
+export function nodeEdgePlatform(paths = defaultEdgePaths()) {
+    return {
+        paths,
+        deviceKeyStore: new ProtectedJsonStore(paths.deviceKeyFile),
+        configStore: new ProtectedJsonStore(paths.configFile),
+        credentialStore: new ProtectedFileCredentialStore(paths.credentialFile),
+        processSupervisor: new NodeProcessSupervisor(),
+    };
+}
+function childHandle(child) {
+    const exited = new Promise((resolve, reject) => {
+        child.once("error", reject);
+        child.once("exit", (code, signal) => resolve({ code, signal }));
+    });
+    return {
+        pid: child.pid,
+        exited,
+        terminate: (signal = "SIGTERM") => child.kill(signal),
+    };
+}
+function isNotFound(error) {
+    return error instanceof Error && "code" in error && error.code === "ENOENT";
+}
+//# sourceMappingURL=platform.js.map

package/dist/platform.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"platform.js","sourceRoot":"","sources":["../src/platform.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAqB,MAAM,oBAAoB,CAAC;AAC9D,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AACjF,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,IAAI,MAAM,WAAW,CAAC;AA6D7B,kFAAkF;AAClF,MAAM,UAAU,gBAAgB,CAAC,OAAe,OAAO,EAAE,EAAE,WAA4B,OAAO,CAAC,QAAQ;IACrG,MAAM,OAAO,GAAG,QAAQ,KAAK,OAAO;QAClC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,IAAI,IAAI,EAAE,UAAU,EAAE,MAAM,CAAC;QACjE,CAAC,CAAC,QAAQ,KAAK,QAAQ;YACrB,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,qBAAqB,EAAE,UAAU,EAAE,MAAM,CAAC;YACvE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,OAAO,CAAC,EAAE,UAAU,EAAE,MAAM,CAAC,CAAC;IACtG,OAAO;QACL,OAAO;QACP,UAAU,EAAE,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,aAAa,CAAC;QAC7C,aAAa,EAAE,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,iBAAiB,CAAC;QACpD,cAAc,EAAE,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,kBAAkB,CAAC;KACvD,CAAC;AACJ,CAAC;AAED,iFAAiF;AACjF,MAAM,OAAO,kBAAkB;IAEV;IACA;IAFnB,YACmB,IAAY,EACZ,OAAe,KAAK;QADpB,SAAI,GAAJ,IAAI,CAAQ;QACZ,SAAI,GAAJ,IAAI,CAAgB;IACpC,CAAC;IAEJ,KAAK,CAAC,IAAI;QACR,IAAI,CAAC;YACH,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAM,CAAC;QAC5D,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,UAAU,CAAC,KAAK,CAAC;gBAAE,OAAO,SAAS,CAAC;YACxC,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,KAAQ;QACjB,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC1C,MAAM,KAAK,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACzD,MAAM,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QACrD,MAAM,SAAS,GAAG,GAAG,IAAI,CAAC,IAAI,IAAI,OAAO,CAAC,GAAG,MAAM,CAAC;QACpD,MAAM,SAAS,CAAC,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;QACzF,MAAM,KAAK,CAAC,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QACzD,MAAM,MAAM,CAAC,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QACnC,MAAM,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IAC3D,CAAC;IAED,KAAK,CAAC,MAAM;QACV,MAAM,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACvC,CAAC;CACF;AAED;;;;GAIG;AACH,MAAM,OAAO,4BAA4B;IACtB,KAAK,CAA6C;IACnE,YAAY,IAAY;QACtB,IAAI,CAAC,KAAK,GAAG,IAAI,kBAAkB,CAAC,IAAI,CAAC,CAAC;IAC5C,CAAC;IACD,KAAK,CAAC,GAAG,CAAC,IAAY;QACpB,OAAO,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC;IAC3C,CAAC;IACD,KAAK,CAAC,GAAG,CAAC,IAAY,EAAE,KAAa;QACnC,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC;QAClD,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,GAAG,WAAW,EAAE,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;IAC3D,CAAC;IACD,KAAK,CAAC,MAAM,CAAC,IAAY;QACvB,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC;QAClD,OAAO,WAAW,CAAC,IAAI,CAAC,CAAC;QACzB,IAAI,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,MAAM,KAAK,CAAC;YAAE,MAAM,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;;YAChE,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IAC1C,CAAC;CACF;AAED,mFAAmF;AACnF,MAAM,OAAO,qBAAqB;IAChC,KAAK,CAAC,KAAK,CAAC,OAA4B;QACtC,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,EAAE;YAC9D,GAAG,EAAE,OAAO,CAAC,GAAG;YAChB,GAAG,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG;YACnE,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,IAAI,MAAM,CAAC;YACjD,WAAW,EAAE,IAAI;SAClB,CAAC,CAAC;QACH,OAAO,WAAW,CAAC,KAAK,CAAC,CAAC;IAC5B,CAAC;CACF;AAED,MAAM,UAAU,gBAAgB,CAAC,QAAmB,gBAAgB,EAAE;IACpE,OAAO;QACL,KAAK;QACL,cAAc,EAAE,IAAI,kBAAkB,CAAC,KAAK,CAAC,aAAa,CAAC;QAC3D,WAAW,EAAE,IAAI,kBAAkB,CAAC,KAAK,CAAC,UAAU,CAAC;QACrD,eAAe,EAAE,IAAI,4BAA4B,CAAC,KAAK,CAAC,cAAc,CAAC;QACvE,iBAAiB,EAAE,IAAI,qBAAqB,EAAE;KAC/C,CAAC;AACJ,CAAC;AAED,SAAS,WAAW,CAAC,KAAmB;IACtC,MAAM,MAAM,GAAG,IAAI,OAAO,CAAyD,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrG,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC5B,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;IAClE,CAAC,CAAC,CAAC;IACH,OAAO;QACL,GAAG,EAAE,KAAK,CAAC,GAAG;QACd,MAAM;QACN,SAAS,EAAE,CAAC,MAAM,GAAG,SAAS,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC;KACtD,CAAC;AACJ,CAAC;AAED,SAAS,UAAU,CAAC,KAAc;IAChC,OAAO,KAAK,YAAY,KAAK,IAAI,MAAM,IAAI,KAAK,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ,CAAC;AACzG,CAAC"}

package/dist/redaction.d.ts

@@ -0,0 +1,7 @@
+/** Recursively redact credentials, secrets, full environments, and private paths. */
+export declare function redactEdgeValue(value: unknown): unknown;
+export declare function safeEdgeError(error: unknown): {
+    name: string;
+    message: string;
+};
+//# sourceMappingURL=redaction.d.ts.map

package/dist/redaction.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"redaction.d.ts","sourceRoot":"","sources":["../src/redaction.ts"],"names":[],"mappings":"AAEA,qFAAqF;AACrF,wBAAgB,eAAe,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAEvD;AAED,wBAAgB,aAAa,CAAC,KAAK,EAAE,OAAO,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAM/E"}

package/dist/redaction.js

@@ -0,0 +1,19 @@
+import { redactEdgeProtocolValue } from "@fentaris/core";
+/** Recursively redact credentials, secrets, full environments, and private paths. */
+export function redactEdgeValue(value) {
+    return redactEdgeProtocolValue(value);
+}
+export function safeEdgeError(error) {
+    const normalized = error instanceof Error ? error : new Error(String(error));
+    return {
+        name: normalized.name,
+        message: String(redactText(normalized.message)),
+    };
+}
+function redactText(message) {
+    return message
+        .replace(/Bearer\s+\S+/gi, "Bearer [REDACTED]")
+        .replace(/(token|secret|credential|authorization)=\S+/gi, "$1=[REDACTED]")
+        .replace(/(?:\/Users\/|\/home\/|[A-Za-z]:\\Users\\)[^\s"']+/g, "[REDACTED_PATH]");
+}
+//# sourceMappingURL=redaction.js.map

package/dist/redaction.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"redaction.js","sourceRoot":"","sources":["../src/redaction.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,uBAAuB,EAAE,MAAM,gBAAgB,CAAC;AAEzD,qFAAqF;AACrF,MAAM,UAAU,eAAe,CAAC,KAAc;IAC5C,OAAO,uBAAuB,CAAC,KAAK,CAAC,CAAC;AACxC,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,KAAc;IAC1C,MAAM,UAAU,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IAC7E,OAAO;QACL,IAAI,EAAE,UAAU,CAAC,IAAI;QACrB,OAAO,EAAE,MAAM,CAAC,UAAU,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;KAChD,CAAC;AACJ,CAAC;AAED,SAAS,UAAU,CAAC,OAAe;IACjC,OAAO,OAAO;SACX,OAAO,CAAC,gBAAgB,EAAE,mBAAmB,CAAC;SAC9C,OAAO,CAAC,+CAA+C,EAAE,eAAe,CAAC;SACzE,OAAO,CAAC,oDAAoD,EAAE,iBAAiB,CAAC,CAAC;AACtF,CAAC"}

package/dist/runtime.d.ts

@@ -0,0 +1,54 @@
+import { type EdgeAgentMessage, type EdgeControlPlaneMessage, type EdgeProtocolClaims } from "@fentaris/core";
+import type { LocalSetupManager } from "./setup.js";
+import type { EdgeWorkloadSupervisor, LocalMcpCapabilityManifest } from "./supervisor.js";
+export interface EdgeRuntimeSummary {
+    readonly desiredDeployments: number;
+    readonly readyDeployments: number;
+    readonly blockedDeployments: number;
+}
+export interface EdgeRuntimeSummaryProvider {
+    summary(): Promise<EdgeRuntimeSummary>;
+}
+export interface EdgeRuntimeConnection {
+    readonly claims: EdgeProtocolClaims;
+    send(message: EdgeAgentMessage): Promise<void>;
+}
+/** Runtime callback surface consumed by the persistent WebSocket connection. */
+export interface EdgeConnectionRuntime extends EdgeRuntimeSummaryProvider {
+    connected(connection: EdgeRuntimeConnection): void | Promise<void>;
+    handle(message: Exclude<EdgeControlPlaneMessage, {
+        kind: "edge.hello.ack";
+    }>): void | Promise<void>;
+    disconnected(): void | Promise<void>;
+    clearLocalState?(): void | Promise<void>;
+}
+export interface EdgeAgentRuntimeOptions {
+    readonly setup: LocalSetupManager;
+    readonly supervisor: EdgeWorkloadSupervisor;
+}
+/**
+ * Reconciles cloud desired state and bridges correlated MCP traffic to the
+ * locally governed workload supervisor.
+ */
+export declare class EdgeAgentRuntime implements EdgeConnectionRuntime {
+    private readonly options;
+    private connection?;
+    private desiredVersion;
+    private reconcileQueue;
+    private statuses;
+    constructor(options: EdgeAgentRuntimeOptions);
+    connected(connection: EdgeRuntimeConnection): void;
+    handle(message: Exclude<EdgeControlPlaneMessage, {
+        kind: "edge.hello.ack";
+    }>): Promise<void>;
+    disconnected(): Promise<void>;
+    clearLocalState(): Promise<void>;
+    summary(): Promise<EdgeRuntimeSummary>;
+    reportCapabilityManifest(deploymentId: string, recipeDigest: string, manifest: LocalMcpCapabilityManifest): Promise<void>;
+    private reconcile;
+    private enqueueReconcile;
+    private assertTrustedRoute;
+    private send;
+    private requireConnection;
+}
+//# sourceMappingURL=runtime.d.ts.map

package/dist/runtime.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtime.d.ts","sourceRoot":"","sources":["../src/runtime.ts"],"names":[],"mappings":"AAAA,OAAO,EAKL,KAAK,gBAAgB,EAErB,KAAK,uBAAuB,EAE5B,KAAK,kBAAkB,EACxB,MAAM,gBAAgB,CAAC;AACxB,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AACpD,OAAO,KAAK,EACV,sBAAsB,EACtB,0BAA0B,EAC3B,MAAM,iBAAiB,CAAC;AAEzB,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;IACpC,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;CACrC;AAED,MAAM,WAAW,0BAA0B;IACzC,OAAO,IAAI,OAAO,CAAC,kBAAkB,CAAC,CAAC;CACxC;AAED,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,MAAM,EAAE,kBAAkB,CAAC;IACpC,IAAI,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAChD;AAED,gFAAgF;AAChF,MAAM,WAAW,qBAAsB,SAAQ,0BAA0B;IACvE,SAAS,CAAC,UAAU,EAAE,qBAAqB,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACnE,MAAM,CAAC,OAAO,EAAE,OAAO,CAAC,uBAAuB,EAAE;QAAE,IAAI,EAAE,gBAAgB,CAAA;KAAE,CAAC,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACpG,YAAY,IAAI,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACrC,eAAe,CAAC,IAAI,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC1C;AAED,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,KAAK,EAAE,iBAAiB,CAAC;IAClC,QAAQ,CAAC,UAAU,EAAE,sBAAsB,CAAC;CAC7C;AAED;;;GAGG;AACH,qBAAa,gBAAiB,YAAW,qBAAqB;IAMhD,OAAO,CAAC,QAAQ,CAAC,OAAO;IALpC,OAAO,CAAC,UAAU,CAAC,CAAwB;IAC3C,OAAO,CAAC,cAAc,CAAK;IAC3B,OAAO,CAAC,cAAc,CAAqB;IAC3C,OAAO,CAAC,QAAQ,CAA0C;gBAE7B,OAAO,EAAE,uBAAuB;IAE7D,SAAS,CAAC,UAAU,EAAE,qBAAqB,GAAG,IAAI;IAI5C,MAAM,CAAC,OAAO,EAAE,OAAO,CAAC,uBAAuB,EAAE;QAAE,IAAI,EAAE,gBAAgB,CAAA;KAAE,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC;IAe5F,YAAY,IAAI,OAAO,CAAC,IAAI,CAAC;IAK7B,eAAe,IAAI,OAAO,CAAC,IAAI,CAAC;IAQhC,OAAO,IAAI,OAAO,CAAC,kBAAkB,CAAC;IActC,wBAAwB,CAC5B,YAAY,EAAE,MAAM,EACpB,YAAY,EAAE,MAAM,EACpB,QAAQ,EAAE,0BAA0B,GACnC,OAAO,CAAC,IAAI,CAAC;YAaF,SAAS;IAoEvB,OAAO,CAAC,gBAAgB;IAMxB,OAAO,CAAC,kBAAkB;IAsB1B,OAAO,CAAC,IAAI;IAIZ,OAAO,CAAC,iBAAiB;CAI1B"}