@happier-dev/stack 0.1.0-preview.96.1 → 0.1.0

package/node_modules/@happier-dev/protocol/dist/connect/connectedServiceSchemas.d.ts

@@ -0,0 +1,149 @@
+import { z } from 'zod';
+export declare const ConnectedServiceIdSchema: z.ZodEnum<{
+    "openai-codex": "openai-codex";
+    anthropic: "anthropic";
+    gemini: "gemini";
+}>;
+export type ConnectedServiceId = z.infer<typeof ConnectedServiceIdSchema>;
+export declare const ConnectedServiceCredentialFormatSchema: z.ZodEnum<{
+    account_scoped_v1: "account_scoped_v1";
+}>;
+export type ConnectedServiceCredentialFormat = z.infer<typeof ConnectedServiceCredentialFormatSchema>;
+export declare const ConnectedServiceCredentialKindSchema: z.ZodEnum<{
+    oauth: "oauth";
+    token: "token";
+}>;
+export type ConnectedServiceCredentialKind = z.infer<typeof ConnectedServiceCredentialKindSchema>;
+export declare const ConnectedServiceProfileIdSchema: z.ZodString;
+export type ConnectedServiceProfileId = z.infer<typeof ConnectedServiceProfileIdSchema>;
+export declare const ConnectedServiceCredentialRecordV1Schema: z.ZodDiscriminatedUnion<[z.ZodObject<{
+    v: z.ZodLiteral<1>;
+    serviceId: z.ZodEnum<{
+        "openai-codex": "openai-codex";
+        anthropic: "anthropic";
+        gemini: "gemini";
+    }>;
+    profileId: z.ZodString;
+    createdAt: z.ZodNumber;
+    updatedAt: z.ZodNumber;
+    expiresAt: z.ZodNullable<z.ZodNumber>;
+    kind: z.ZodLiteral<"oauth">;
+    oauth: z.ZodObject<{
+        accessToken: z.ZodString;
+        refreshToken: z.ZodString;
+        idToken: z.ZodNullable<z.ZodString>;
+        scope: z.ZodNullable<z.ZodString>;
+        tokenType: z.ZodNullable<z.ZodString>;
+        providerAccountId: z.ZodNullable<z.ZodString>;
+        providerEmail: z.ZodNullable<z.ZodString>;
+        raw: z.ZodNullable<z.ZodUnknown>;
+    }, z.core.$strip>;
+    token: z.ZodNull;
+}, z.core.$strip>, z.ZodObject<{
+    v: z.ZodLiteral<1>;
+    serviceId: z.ZodEnum<{
+        "openai-codex": "openai-codex";
+        anthropic: "anthropic";
+        gemini: "gemini";
+    }>;
+    profileId: z.ZodString;
+    createdAt: z.ZodNumber;
+    updatedAt: z.ZodNumber;
+    expiresAt: z.ZodNullable<z.ZodNumber>;
+    kind: z.ZodLiteral<"token">;
+    oauth: z.ZodNull;
+    token: z.ZodObject<{
+        token: z.ZodString;
+        providerAccountId: z.ZodNullable<z.ZodString>;
+        providerEmail: z.ZodNullable<z.ZodString>;
+        raw: z.ZodNullable<z.ZodUnknown>;
+    }, z.core.$strip>;
+}, z.core.$strip>], "kind">;
+export type ConnectedServiceCredentialRecordV1 = z.infer<typeof ConnectedServiceCredentialRecordV1Schema>;
+export declare const SealedConnectedServiceCredentialV1Schema: z.ZodObject<{
+    format: z.ZodEnum<{
+        account_scoped_v1: "account_scoped_v1";
+    }>;
+    ciphertext: z.ZodString;
+}, z.core.$strip>;
+export type SealedConnectedServiceCredentialV1 = z.infer<typeof SealedConnectedServiceCredentialV1Schema>;
+export declare const ConnectedServiceQuotaUnitV1Schema: z.ZodEnum<{
+    unknown: "unknown";
+    tokens: "tokens";
+    count: "count";
+    credits: "credits";
+    usd: "usd";
+    requests: "requests";
+}>;
+export type ConnectedServiceQuotaUnitV1 = z.infer<typeof ConnectedServiceQuotaUnitV1Schema>;
+export declare const ConnectedServiceQuotaMeterV1Schema: z.ZodObject<{
+    meterId: z.ZodString;
+    label: z.ZodString;
+    used: z.ZodNullable<z.ZodNumber>;
+    limit: z.ZodNullable<z.ZodNumber>;
+    unit: z.ZodEnum<{
+        unknown: "unknown";
+        tokens: "tokens";
+        count: "count";
+        credits: "credits";
+        usd: "usd";
+        requests: "requests";
+    }>;
+    utilizationPct: z.ZodNullable<z.ZodNumber>;
+    resetsAt: z.ZodNullable<z.ZodNumber>;
+    status: z.ZodEnum<{
+        ok: "ok";
+        unavailable: "unavailable";
+        estimated: "estimated";
+    }>;
+    details: z.ZodDefault<z.ZodOptional<z.ZodObject<{
+        note: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    }, z.core.$strip>>>;
+}, z.core.$strip>;
+export type ConnectedServiceQuotaMeterV1 = z.infer<typeof ConnectedServiceQuotaMeterV1Schema>;
+export declare const ConnectedServiceQuotaSnapshotV1Schema: z.ZodObject<{
+    v: z.ZodLiteral<1>;
+    serviceId: z.ZodEnum<{
+        "openai-codex": "openai-codex";
+        anthropic: "anthropic";
+        gemini: "gemini";
+    }>;
+    profileId: z.ZodString;
+    fetchedAt: z.ZodNumber;
+    staleAfterMs: z.ZodNumber;
+    planLabel: z.ZodNullable<z.ZodString>;
+    accountLabel: z.ZodNullable<z.ZodString>;
+    meters: z.ZodArray<z.ZodObject<{
+        meterId: z.ZodString;
+        label: z.ZodString;
+        used: z.ZodNullable<z.ZodNumber>;
+        limit: z.ZodNullable<z.ZodNumber>;
+        unit: z.ZodEnum<{
+            unknown: "unknown";
+            tokens: "tokens";
+            count: "count";
+            credits: "credits";
+            usd: "usd";
+            requests: "requests";
+        }>;
+        utilizationPct: z.ZodNullable<z.ZodNumber>;
+        resetsAt: z.ZodNullable<z.ZodNumber>;
+        status: z.ZodEnum<{
+            ok: "ok";
+            unavailable: "unavailable";
+            estimated: "estimated";
+        }>;
+        details: z.ZodDefault<z.ZodOptional<z.ZodObject<{
+            note: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+        }, z.core.$strip>>>;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
+export type ConnectedServiceQuotaSnapshotV1 = z.infer<typeof ConnectedServiceQuotaSnapshotV1Schema>;
+export declare const SealedConnectedServiceQuotaSnapshotV1Schema: z.ZodObject<{
+    format: z.ZodEnum<{
+        account_scoped_v1: "account_scoped_v1";
+    }>;
+    ciphertext: z.ZodString;
+}, z.core.$strip>;
+export type SealedConnectedServiceQuotaSnapshotV1 = z.infer<typeof SealedConnectedServiceQuotaSnapshotV1Schema>;
+//# sourceMappingURL=connectedServiceSchemas.d.ts.map

package/node_modules/@happier-dev/protocol/dist/connect/connectedServiceSchemas.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"connectedServiceSchemas.d.ts","sourceRoot":"","sources":["../../src/connect/connectedServiceSchemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,eAAO,MAAM,wBAAwB;;;;EAInC,CAAC;AAEH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAE1E,eAAO,MAAM,sCAAsC;;EAAgC,CAAC;AACpF,MAAM,MAAM,gCAAgC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sCAAsC,CAAC,CAAC;AAEtG,eAAO,MAAM,oCAAoC;;;EAA6B,CAAC;AAC/E,MAAM,MAAM,8BAA8B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oCAAoC,CAAC,CAAC;AAElG,eAAO,MAAM,+BAA+B,aAIyB,CAAC;AAEtE,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,+BAA+B,CAAC,CAAC;AA6BxF,eAAO,MAAM,wCAAwC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;2BAWnD,CAAC;AAEH,MAAM,MAAM,kCAAkC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wCAAwC,CAAC,CAAC;AAE1G,eAAO,MAAM,wCAAwC;;;;;iBAGnD,CAAC;AAEH,MAAM,MAAM,kCAAkC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wCAAwC,CAAC,CAAC;AAE1G,eAAO,MAAM,iCAAiC;;;;;;;EAO5C,CAAC;AAEH,MAAM,MAAM,2BAA2B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iCAAiC,CAAC,CAAC;AAE5F,eAAO,MAAM,kCAAkC;;;;;;;;;;;;;;;;;;;;;;;iBAe7C,CAAC;AAEH,MAAM,MAAM,4BAA4B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kCAAkC,CAAC,CAAC;AAE9F,eAAO,MAAM,qCAAqC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAShD,CAAC;AAEH,MAAM,MAAM,+BAA+B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qCAAqC,CAAC,CAAC;AAEpG,eAAO,MAAM,2CAA2C;;;;;iBAGtD,CAAC;AAEH,MAAM,MAAM,qCAAqC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2CAA2C,CAAC,CAAC"}

package/node_modules/@happier-dev/protocol/dist/connect/connectedServiceSchemas.js

@@ -0,0 +1,92 @@
+import { z } from 'zod';
+export const ConnectedServiceIdSchema = z.enum([
+    'openai-codex',
+    'anthropic',
+    'gemini',
+]);
+export const ConnectedServiceCredentialFormatSchema = z.enum(['account_scoped_v1']);
+export const ConnectedServiceCredentialKindSchema = z.enum(['oauth', 'token']);
+export const ConnectedServiceProfileIdSchema = z
+    .string()
+    .min(1)
+    .max(64)
+    .regex(/^[a-zA-Z0-9][a-zA-Z0-9_:-]{0,63}$/, 'Invalid profile id');
+const OauthCredentialPayloadSchema = z.object({
+    accessToken: z.string().min(1),
+    refreshToken: z.string().min(1),
+    idToken: z.string().min(1).nullable(),
+    scope: z.string().min(1).nullable(),
+    tokenType: z.string().min(1).nullable(),
+    providerAccountId: z.string().min(1).nullable(),
+    providerEmail: z.string().min(1).nullable(),
+    raw: z.unknown().nullable(),
+});
+const TokenCredentialPayloadSchema = z.object({
+    token: z.string().min(1),
+    providerAccountId: z.string().min(1).nullable(),
+    providerEmail: z.string().min(1).nullable(),
+    raw: z.unknown().nullable(),
+});
+const ConnectedServiceCredentialBaseSchema = z.object({
+    v: z.literal(1),
+    serviceId: ConnectedServiceIdSchema,
+    profileId: ConnectedServiceProfileIdSchema,
+    createdAt: z.number().int().nonnegative(),
+    updatedAt: z.number().int().nonnegative(),
+    expiresAt: z.number().int().nonnegative().nullable(),
+});
+export const ConnectedServiceCredentialRecordV1Schema = z.discriminatedUnion('kind', [
+    ConnectedServiceCredentialBaseSchema.extend({
+        kind: z.literal('oauth'),
+        oauth: OauthCredentialPayloadSchema,
+        token: z.null(),
+    }),
+    ConnectedServiceCredentialBaseSchema.extend({
+        kind: z.literal('token'),
+        oauth: z.null(),
+        token: TokenCredentialPayloadSchema,
+    }),
+]);
+export const SealedConnectedServiceCredentialV1Schema = z.object({
+    format: ConnectedServiceCredentialFormatSchema,
+    ciphertext: z.string().min(1),
+});
+export const ConnectedServiceQuotaUnitV1Schema = z.enum([
+    'count',
+    'tokens',
+    'credits',
+    'usd',
+    'requests',
+    'unknown',
+]);
+export const ConnectedServiceQuotaMeterV1Schema = z.object({
+    meterId: z.string().min(1),
+    label: z.string().min(1),
+    used: z.number().finite().nullable(),
+    limit: z.number().finite().nullable(),
+    unit: ConnectedServiceQuotaUnitV1Schema,
+    utilizationPct: z.number().finite().min(0).max(100).nullable(),
+    resetsAt: z.number().int().nonnegative().nullable(),
+    status: z.enum(['ok', 'unavailable', 'estimated']),
+    details: z
+        .object({
+        note: z.string().min(1).nullable().optional(),
+    })
+        .optional()
+        .default({}),
+});
+export const ConnectedServiceQuotaSnapshotV1Schema = z.object({
+    v: z.literal(1),
+    serviceId: ConnectedServiceIdSchema,
+    profileId: ConnectedServiceProfileIdSchema,
+    fetchedAt: z.number().int().nonnegative(),
+    staleAfterMs: z.number().int().min(1),
+    planLabel: z.string().min(1).nullable(),
+    accountLabel: z.string().min(1).nullable(),
+    meters: z.array(ConnectedServiceQuotaMeterV1Schema),
+});
+export const SealedConnectedServiceQuotaSnapshotV1Schema = z.object({
+    format: ConnectedServiceCredentialFormatSchema,
+    ciphertext: z.string().min(1),
+});
+//# sourceMappingURL=connectedServiceSchemas.js.map

package/node_modules/@happier-dev/protocol/dist/connect/connectedServiceSchemas.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"connectedServiceSchemas.js","sourceRoot":"","sources":["../../src/connect/connectedServiceSchemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC,IAAI,CAAC;IAC3C,cAAc;IACd,WAAW;IACX,QAAQ;CACX,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,sCAAsC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC;AAGpF,MAAM,CAAC,MAAM,oCAAoC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;AAG/E,MAAM,CAAC,MAAM,+BAA+B,GAAG,CAAC;KAC3C,MAAM,EAAE;KACR,GAAG,CAAC,CAAC,CAAC;KACN,GAAG,CAAC,EAAE,CAAC;KACP,KAAK,CAAC,mCAAmC,EAAE,oBAAoB,CAAC,CAAC;AAItE,MAAM,4BAA4B,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1C,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9B,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC/B,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACrC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACnC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACvC,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAC/C,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAC3C,GAAG,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;CAC9B,CAAC,CAAC;AAEH,MAAM,4BAA4B,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1C,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACxB,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAC/C,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAC3C,GAAG,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;CAC9B,CAAC,CAAC;AAEH,MAAM,oCAAoC,GAAG,CAAC,CAAC,MAAM,CAAC;IAClD,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IACf,SAAS,EAAE,wBAAwB;IACnC,SAAS,EAAE,+BAA+B;IAC1C,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;IACzC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;IACzC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE;CACvD,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,wCAAwC,GAAG,CAAC,CAAC,kBAAkB,CAAC,MAAM,EAAE;IACjF,oCAAoC,CAAC,MAAM,CAAC;QACxC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC;QACxB,KAAK,EAAE,4BAA4B;QACnC,KAAK,EAAE,CAAC,CAAC,IAAI,EAAE;KAClB,CAAC;IACF,oCAAoC,CAAC,MAAM,CAAC;QACxC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC;QACxB,KAAK,EAAE,CAAC,CAAC,IAAI,EAAE;QACf,KAAK,EAAE,4BAA4B;KACtC,CAAC;CACL,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,wCAAwC,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7D,MAAM,EAAE,sCAAsC;IAC9C,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAChC,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,iCAAiC,GAAG,CAAC,CAAC,IAAI,CAAC;IACpD,OAAO;IACP,QAAQ;IACR,SAAS;IACT,KAAK;IACL,UAAU;IACV,SAAS;CACZ,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,kCAAkC,GAAG,CAAC,CAAC,MAAM,CAAC;IACvD,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1B,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACxB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACpC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACrC,IAAI,EAAE,iCAAiC;IACvC,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;IAC9D,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE;IACnD,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,aAAa,EAAE,WAAW,CAAC,CAAC;IAClD,OAAO,EAAE,CAAC;SACL,MAAM,CAAC;QACJ,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;KAChD,CAAC;SACD,QAAQ,EAAE;SACV,OAAO,CAAC,EAAE,CAAC;CACnB,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,qCAAqC,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1D,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IACf,SAAS,EAAE,wBAAwB;IACnC,SAAS,EAAE,+BAA+B;IAC1C,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;IACzC,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACrC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACvC,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAC1C,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,kCAAkC,CAAC;CACtD,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,2CAA2C,GAAG,CAAC,CAAC,MAAM,CAAC;IAChE,MAAM,EAAE,sCAAsC;IAC9C,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAChC,CAAC,CAAC"}

package/node_modules/@happier-dev/protocol/dist/crypto/accountScopedCipher.d.ts

@@ -0,0 +1,26 @@
+export type AccountScopedBlobKind = 'account_settings' | 'automation_template_payload' | 'connected_service_credential' | 'connected_service_quota_snapshot';
+export type AccountScopedCryptoMaterial = Readonly<{
+    type: 'legacy';
+    secret: Uint8Array;
+}> | Readonly<{
+    type: 'dataKey';
+    machineKey: Uint8Array;
+}>;
+export type AccountScopedCiphertextFormat = 'account_scoped_v1' | 'legacy_secretbox';
+export type AccountScopedOpenResult = Readonly<{
+    format: AccountScopedCiphertextFormat;
+    value: unknown;
+}> | null;
+export declare function deriveAccountMachineKeyFromRecoverySecret(recoverySecret: Uint8Array): Uint8Array;
+export declare function sealAccountScopedBlobCiphertext(params: {
+    kind: AccountScopedBlobKind;
+    material: AccountScopedCryptoMaterial;
+    payload: unknown;
+    randomBytes: (length: number) => Uint8Array;
+}): string;
+export declare function openAccountScopedBlobCiphertext(params: {
+    kind: AccountScopedBlobKind;
+    material: AccountScopedCryptoMaterial;
+    ciphertext: string;
+}): AccountScopedOpenResult;
+//# sourceMappingURL=accountScopedCipher.d.ts.map

package/node_modules/@happier-dev/protocol/dist/crypto/accountScopedCipher.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"accountScopedCipher.d.ts","sourceRoot":"","sources":["../../src/crypto/accountScopedCipher.ts"],"names":[],"mappings":"AAMA,MAAM,MAAM,qBAAqB,GAC7B,kBAAkB,GAClB,6BAA6B,GAC7B,8BAA8B,GAC9B,kCAAkC,CAAC;AAEvC,MAAM,MAAM,2BAA2B,GACnC,QAAQ,CAAC;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,MAAM,EAAE,UAAU,CAAA;CAAE,CAAC,GAChD,QAAQ,CAAC;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,UAAU,EAAE,UAAU,CAAA;CAAE,CAAC,CAAC;AAE1D,MAAM,MAAM,6BAA6B,GAAG,mBAAmB,GAAG,kBAAkB,CAAC;AAErF,MAAM,MAAM,uBAAuB,GAC/B,QAAQ,CAAC;IAAE,MAAM,EAAE,6BAA6B,CAAC;IAAC,KAAK,EAAE,OAAO,CAAA;CAAE,CAAC,GACnE,IAAI,CAAC;AA2CT,wBAAgB,yCAAyC,CAAC,cAAc,EAAE,UAAU,GAAG,UAAU,CAIhG;AAsBD,wBAAgB,+BAA+B,CAAC,MAAM,EAAE;IACtD,IAAI,EAAE,qBAAqB,CAAC;IAC5B,QAAQ,EAAE,2BAA2B,CAAC;IACtC,OAAO,EAAE,OAAO,CAAC;IACjB,WAAW,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,UAAU,CAAC;CAC7C,GAAG,MAAM,CAuBT;AAED,wBAAgB,+BAA+B,CAAC,MAAM,EAAE;IACtD,IAAI,EAAE,qBAAqB,CAAC;IAC5B,QAAQ,EAAE,2BAA2B,CAAC;IACtC,UAAU,EAAE,MAAM,CAAC;CACpB,GAAG,uBAAuB,CA4D1B"}

package/node_modules/@happier-dev/protocol/dist/crypto/accountScopedCipher.js

@@ -0,0 +1,135 @@
+import tweetnacl from 'tweetnacl';
+import { hmac } from '@noble/hashes/hmac';
+import { sha512 } from '@noble/hashes/sha512';
+import { decodeBase64, encodeBase64 } from './base64.js';
+const ACCOUNT_SCOPED_MAGIC_V1 = 0xa1;
+const ACCOUNT_SCOPED_KIND_BYTE = {
+    account_settings: 1,
+    automation_template_payload: 2,
+    connected_service_credential: 3,
+    connected_service_quota_snapshot: 4,
+};
+function encodeUtf8(value) {
+    return new TextEncoder().encode(value);
+}
+function hmacSha512(key, data) {
+    return hmac(sha512, key, data);
+}
+function deriveSecretKeyTreeRoot(seed, usage) {
+    const I = hmacSha512(encodeUtf8(`${usage} Master Seed`), seed);
+    return { key: I.slice(0, 32), chainCode: I.slice(32) };
+}
+function deriveSecretKeyTreeChild(chainCode, index) {
+    const indexBytes = encodeUtf8(index);
+    const data = new Uint8Array(1 + indexBytes.length);
+    data[0] = 0;
+    data.set(indexBytes, 1);
+    const I = hmacSha512(chainCode, data);
+    return { key: I.slice(0, 32), chainCode: I.slice(32) };
+}
+function deriveKey(master, usage, path) {
+    let state = deriveSecretKeyTreeRoot(master, usage);
+    for (const index of path) {
+        state = deriveSecretKeyTreeChild(state.chainCode, index);
+    }
+    return state.key;
+}
+export function deriveAccountMachineKeyFromRecoverySecret(recoverySecret) {
+    const contentSeed = deriveKey(recoverySecret, 'Happy EnCoder', ['content']);
+    // libsodium crypto_box_seed_keypair uses SHA-512(seed) and takes the first 32 bytes as the scalar.
+    return sha512(contentSeed).slice(0, 32);
+}
+function resolveMachineKey(material) {
+    return material.type === 'dataKey'
+        ? material.machineKey
+        : deriveAccountMachineKeyFromRecoverySecret(material.secret);
+}
+function deriveAccountScopedSecretboxKey(params) {
+    const info = encodeUtf8(`happier:account_scoped:${params.kind}:v1`);
+    return hmacSha512(params.machineKey, info).slice(0, 32);
+}
+function tryParseJson(value) {
+    try {
+        const decoded = new TextDecoder().decode(value);
+        return JSON.parse(decoded);
+    }
+    catch {
+        return null;
+    }
+}
+export function sealAccountScopedBlobCiphertext(params) {
+    const kindByte = ACCOUNT_SCOPED_KIND_BYTE[params.kind];
+    if (!Number.isFinite(kindByte)) {
+        throw new Error(`Unsupported account-scoped blob kind: ${String(params.kind)}`);
+    }
+    const machineKey = resolveMachineKey(params.material);
+    const key = deriveAccountScopedSecretboxKey({ machineKey, kind: params.kind });
+    const nonce = params.randomBytes(tweetnacl.secretbox.nonceLength);
+    if (nonce.length !== tweetnacl.secretbox.nonceLength) {
+        throw new Error(`Invalid nonce length: ${nonce.length}`);
+    }
+    const plaintextBytes = encodeUtf8(JSON.stringify(params.payload));
+    const boxed = tweetnacl.secretbox(plaintextBytes, nonce, key);
+    const out = new Uint8Array(2 + nonce.length + boxed.length);
+    out[0] = ACCOUNT_SCOPED_MAGIC_V1;
+    out[1] = kindByte;
+    out.set(nonce, 2);
+    out.set(boxed, 2 + nonce.length);
+    return encodeBase64(out, 'base64');
+}
+export function openAccountScopedBlobCiphertext(params) {
+    const kindByte = ACCOUNT_SCOPED_KIND_BYTE[params.kind];
+    if (!Number.isFinite(kindByte)) {
+        return null;
+    }
+    let bytes;
+    try {
+        bytes = decodeBase64(params.ciphertext, 'base64');
+    }
+    catch {
+        return null;
+    }
+    const machineKey = resolveMachineKey(params.material);
+    if (bytes.length >= 2 + tweetnacl.secretbox.nonceLength + 16 && bytes[0] === ACCOUNT_SCOPED_MAGIC_V1) {
+        if (bytes[1] !== kindByte) {
+            return null;
+        }
+        const nonce = bytes.slice(2, 2 + tweetnacl.secretbox.nonceLength);
+        const boxed = bytes.slice(2 + tweetnacl.secretbox.nonceLength);
+        const key = deriveAccountScopedSecretboxKey({ machineKey, kind: params.kind });
+        const opened = tweetnacl.secretbox.open(boxed, nonce, key);
+        const parsed = opened ? tryParseJson(new Uint8Array(opened)) : null;
+        if (parsed === null) {
+            return null;
+        }
+        return { format: 'account_scoped_v1', value: parsed };
+    }
+    // Backwards compatibility: legacy secretbox payloads that omitted magic/version bytes.
+    // Try opening with either:
+    // - raw machineKey (dataKey mode, e.g. old automation templates)
+    // - raw recovery secret (legacy mode, e.g. old account settings/templates)
+    if (bytes.length < tweetnacl.secretbox.nonceLength + 16) {
+        return null;
+    }
+    const nonce = bytes.slice(0, tweetnacl.secretbox.nonceLength);
+    const boxed = bytes.slice(tweetnacl.secretbox.nonceLength);
+    const candidates = [];
+    candidates.push(machineKey);
+    if (params.material.type === 'legacy') {
+        candidates.push(params.material.secret);
+    }
+    for (const key of candidates) {
+        try {
+            const opened = tweetnacl.secretbox.open(boxed, nonce, key);
+            const parsed = opened ? tryParseJson(new Uint8Array(opened)) : null;
+            if (parsed !== null) {
+                return { format: 'legacy_secretbox', value: parsed };
+            }
+        }
+        catch {
+            // continue
+        }
+    }
+    return null;
+}
+//# sourceMappingURL=accountScopedCipher.js.map

package/node_modules/@happier-dev/protocol/dist/crypto/accountScopedCipher.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"accountScopedCipher.js","sourceRoot":"","sources":["../../src/crypto/accountScopedCipher.ts"],"names":[],"mappings":"AAAA,OAAO,SAAS,MAAM,WAAW,CAAC;AAClC,OAAO,EAAE,IAAI,EAAE,MAAM,oBAAoB,CAAC;AAC1C,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAE9C,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAkBzD,MAAM,uBAAuB,GAAG,IAAI,CAAC;AAErC,MAAM,wBAAwB,GAA0C;IACtE,gBAAgB,EAAE,CAAC;IACnB,2BAA2B,EAAE,CAAC;IAC9B,4BAA4B,EAAE,CAAC;IAC/B,gCAAgC,EAAE,CAAC;CACpC,CAAC;AAEF,SAAS,UAAU,CAAC,KAAa;IAC/B,OAAO,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACzC,CAAC;AAED,SAAS,UAAU,CAAC,GAAe,EAAE,IAAgB;IACnD,OAAO,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;AACjC,CAAC;AAID,SAAS,uBAAuB,CAAC,IAAgB,EAAE,KAAa;IAC9D,MAAM,CAAC,GAAG,UAAU,CAAC,UAAU,CAAC,GAAG,KAAK,cAAc,CAAC,EAAE,IAAI,CAAC,CAAC;IAC/D,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,CAAC;AACzD,CAAC;AAED,SAAS,wBAAwB,CAAC,SAAqB,EAAE,KAAa;IACpE,MAAM,UAAU,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC;IACrC,MAAM,IAAI,GAAG,IAAI,UAAU,CAAC,CAAC,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC;IACnD,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IACZ,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC;IACxB,MAAM,CAAC,GAAG,UAAU,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;IACtC,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,CAAC;AACzD,CAAC;AAED,SAAS,SAAS,CAAC,MAAkB,EAAE,KAAa,EAAE,IAAuB;IAC3E,IAAI,KAAK,GAAG,uBAAuB,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IACnD,KAAK,MAAM,KAAK,IAAI,IAAI,EAAE,CAAC;QACzB,KAAK,GAAG,wBAAwB,CAAC,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;IAC3D,CAAC;IACD,OAAO,KAAK,CAAC,GAAG,CAAC;AACnB,CAAC;AAED,MAAM,UAAU,yCAAyC,CAAC,cAA0B;IAClF,MAAM,WAAW,GAAG,SAAS,CAAC,cAAc,EAAE,eAAe,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC;IAC5E,mGAAmG;IACnG,OAAO,MAAM,CAAC,WAAW,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AAC1C,CAAC;AAED,SAAS,iBAAiB,CAAC,QAAqC;IAC9D,OAAO,QAAQ,CAAC,IAAI,KAAK,SAAS;QAChC,CAAC,CAAC,QAAQ,CAAC,UAAU;QACrB,CAAC,CAAC,yCAAyC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;AACjE,CAAC;AAED,SAAS,+BAA+B,CAAC,MAA+D;IACtG,MAAM,IAAI,GAAG,UAAU,CAAC,0BAA0B,MAAM,CAAC,IAAI,KAAK,CAAC,CAAC;IACpE,OAAO,UAAU,CAAC,MAAM,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AAC1D,CAAC;AAED,SAAS,YAAY,CAAC,KAAiB;IACrC,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAChD,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC7B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,UAAU,+BAA+B,CAAC,MAK/C;IACC,MAAM,QAAQ,GAAG,wBAAwB,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACvD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CAAC,yCAAyC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAClF,CAAC;IAED,MAAM,UAAU,GAAG,iBAAiB,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IACtD,MAAM,GAAG,GAAG,+BAA+B,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;IAC/E,MAAM,KAAK,GAAG,MAAM,CAAC,WAAW,CAAC,SAAS,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC;IAClE,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS,CAAC,SAAS,CAAC,WAAW,EAAE,CAAC;QACrD,MAAM,IAAI,KAAK,CAAC,yBAAyB,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;IAC3D,CAAC;IAED,MAAM,cAAc,GAAG,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;IAClE,MAAM,KAAK,GAAG,SAAS,CAAC,SAAS,CAAC,cAAc,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC;IAE9D,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,CAAC,GAAG,KAAK,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC;IAC5D,GAAG,CAAC,CAAC,CAAC,GAAG,uBAAuB,CAAC;IACjC,GAAG,CAAC,CAAC,CAAC,GAAG,QAAQ,CAAC;IAClB,GAAG,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IAClB,GAAG,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC;IAEjC,OAAO,YAAY,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;AACrC,CAAC;AAED,MAAM,UAAU,+BAA+B,CAAC,MAI/C;IACC,MAAM,QAAQ,GAAG,wBAAwB,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACvD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC/B,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,KAAiB,CAAC;IACtB,IAAI,CAAC;QACH,KAAK,GAAG,YAAY,CAAC,MAAM,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;IACpD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,UAAU,GAAG,iBAAiB,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAEtD,IAAI,KAAK,CAAC,MAAM,IAAI,CAAC,GAAG,SAAS,CAAC,SAAS,CAAC,WAAW,GAAG,EAAE,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,uBAAuB,EAAE,CAAC;QACrG,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,QAAQ,EAAE,CAAC;YAC1B,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,GAAG,SAAS,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC;QAClE,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,GAAG,SAAS,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC;QAC/D,MAAM,GAAG,GAAG,+BAA+B,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;QAC/E,MAAM,MAAM,GAAG,SAAS,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC;QAC3D,MAAM,MAAM,GAAG,MAAM,CAAC,CAAC,CAAC,YAAY,CAAC,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QACpE,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;YACpB,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,EAAE,MAAM,EAAE,mBAAmB,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;IACxD,CAAC;IAED,uFAAuF;IACvF,2BAA2B;IAC3B,iEAAiE;IACjE,2EAA2E;IAC3E,IAAI,KAAK,CAAC,MAAM,GAAG,SAAS,CAAC,SAAS,CAAC,WAAW,GAAG,EAAE,EAAE,CAAC;QACxD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC;IAC9D,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC;IAE3D,MAAM,UAAU,GAAiB,EAAE,CAAC;IACpC,UAAU,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IAC5B,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QACtC,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC1C,CAAC;IAED,KAAK,MAAM,GAAG,IAAI,UAAU,EAAE,CAAC;QAC7B,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,SAAS,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC;YAC3D,MAAM,MAAM,GAAG,MAAM,CAAC,CAAC,CAAC,YAAY,CAAC,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;YACpE,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;gBACpB,OAAO,EAAE,MAAM,EAAE,kBAAkB,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;YACvD,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,WAAW;QACb,CAAC;IACH,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC"}

package/node_modules/@happier-dev/protocol/dist/crypto/accountScopedCipher.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=accountScopedCipher.test.d.ts.map

package/node_modules/@happier-dev/protocol/dist/crypto/accountScopedCipher.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"accountScopedCipher.test.d.ts","sourceRoot":"","sources":["../../src/crypto/accountScopedCipher.test.ts"],"names":[],"mappings":""}

package/node_modules/@happier-dev/protocol/dist/crypto/accountScopedCipher.test.js

@@ -0,0 +1,105 @@
+import { describe, expect, it } from 'vitest';
+import tweetnacl from 'tweetnacl';
+import { encodeBase64 } from './base64.js';
+import { openAccountScopedBlobCiphertext, sealAccountScopedBlobCiphertext, deriveAccountMachineKeyFromRecoverySecret, } from './accountScopedCipher.js';
+function deterministicRandomBytesFactory() {
+    let counter = 1;
+    return (length) => {
+        const out = new Uint8Array(length);
+        for (let i = 0; i < length; i++) {
+            out[i] = counter & 0xff;
+            counter++;
+        }
+        return out;
+    };
+}
+describe('accountScopedCipher', () => {
+    it('seals/opens without Buffer or atob/btoa globals', () => {
+        const prevBuffer = globalThis.Buffer;
+        const prevAtob = globalThis.atob;
+        const prevBtoa = globalThis.btoa;
+        globalThis.Buffer = undefined;
+        globalThis.atob = undefined;
+        globalThis.btoa = undefined;
+        try {
+            const kind = 'account_settings';
+            const machineKey = new Uint8Array(32).fill(9);
+            const material = { type: 'dataKey', machineKey };
+            const payload = { claudeLocalPermissionBridgeEnabled: true, schemaVersion: 1 };
+            const ciphertext = sealAccountScopedBlobCiphertext({
+                kind,
+                material,
+                payload,
+                randomBytes: deterministicRandomBytesFactory(),
+            });
+            const opened = openAccountScopedBlobCiphertext({ kind, material, ciphertext });
+            expect(opened?.format).toBe('account_scoped_v1');
+            expect(opened?.value).toEqual(payload);
+        }
+        finally {
+            globalThis.Buffer = prevBuffer;
+            globalThis.atob = prevAtob;
+            globalThis.btoa = prevBtoa;
+        }
+    });
+    it('seals and opens v1 ciphertext with dataKey material', () => {
+        const kind = 'account_settings';
+        const machineKey = new Uint8Array(32).fill(9);
+        const material = { type: 'dataKey', machineKey };
+        const payload = { claudeLocalPermissionBridgeEnabled: true, schemaVersion: 1 };
+        const ciphertext = sealAccountScopedBlobCiphertext({
+            kind,
+            material,
+            payload,
+            randomBytes: deterministicRandomBytesFactory(),
+        });
+        const opened = openAccountScopedBlobCiphertext({ kind, material, ciphertext });
+        expect(opened?.format).toBe('account_scoped_v1');
+        expect(opened?.value).toEqual(payload);
+    });
+    it('allows legacy and dataKey devices to read the same v1 ciphertext', () => {
+        const kind = 'account_settings';
+        const recoverySecret = new Uint8Array(32).fill(7);
+        const machineKey = deriveAccountMachineKeyFromRecoverySecret(recoverySecret);
+        const legacyMaterial = { type: 'legacy', secret: recoverySecret };
+        const dataKeyMaterial = { type: 'dataKey', machineKey };
+        const payload = { codexBackendMode: 'acp' };
+        const ciphertext = sealAccountScopedBlobCiphertext({
+            kind,
+            material: legacyMaterial,
+            payload,
+            randomBytes: deterministicRandomBytesFactory(),
+        });
+        expect(openAccountScopedBlobCiphertext({ kind, material: legacyMaterial, ciphertext })?.value).toEqual(payload);
+        expect(openAccountScopedBlobCiphertext({ kind, material: dataKeyMaterial, ciphertext })?.value).toEqual(payload);
+    });
+    it('opens legacy secretbox ciphertext encrypted with the recovery secret (backcompat)', () => {
+        const kind = 'account_settings';
+        const recoverySecret = new Uint8Array(32).fill(3);
+        const payload = { analyticsOptOut: false };
+        const nonce = new Uint8Array(24).fill(4);
+        const plaintext = new TextEncoder().encode(JSON.stringify(payload));
+        const boxed = tweetnacl.secretbox(plaintext, nonce, recoverySecret);
+        const legacyBytes = new Uint8Array(nonce.length + boxed.length);
+        legacyBytes.set(nonce, 0);
+        legacyBytes.set(boxed, nonce.length);
+        const legacyCiphertext = encodeBase64(legacyBytes, 'base64');
+        const material = { type: 'legacy', secret: recoverySecret };
+        const opened = openAccountScopedBlobCiphertext({ kind, material, ciphertext: legacyCiphertext });
+        expect(opened?.format).toBe('legacy_secretbox');
+        expect(opened?.value).toEqual(payload);
+    });
+    it('returns null when kind does not match', () => {
+        const payload = { x: 1 };
+        const machineKey = new Uint8Array(32).fill(8);
+        const material = { type: 'dataKey', machineKey };
+        const ciphertext = sealAccountScopedBlobCiphertext({
+            kind: 'account_settings',
+            material,
+            payload,
+            randomBytes: deterministicRandomBytesFactory(),
+        });
+        expect(openAccountScopedBlobCiphertext({ kind: 'automation_template_payload', material, ciphertext })).toBeNull();
+    });
+});
+//# sourceMappingURL=accountScopedCipher.test.js.map

package/node_modules/@happier-dev/protocol/dist/crypto/accountScopedCipher.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"accountScopedCipher.test.js","sourceRoot":"","sources":["../../src/crypto/accountScopedCipher.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAE9C,OAAO,SAAS,MAAM,WAAW,CAAC;AAClC,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAE3C,OAAO,EACL,+BAA+B,EAC/B,+BAA+B,EAG/B,yCAAyC,GAC1C,MAAM,0BAA0B,CAAC;AAElC,SAAS,+BAA+B;IACtC,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,OAAO,CAAC,MAAc,EAAE,EAAE;QACxB,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC;QACnC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YAChC,GAAG,CAAC,CAAC,CAAC,GAAG,OAAO,GAAG,IAAI,CAAC;YACxB,OAAO,EAAE,CAAC;QACZ,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC,CAAC;AACJ,CAAC;AAED,QAAQ,CAAC,qBAAqB,EAAE,GAAG,EAAE;IACnC,EAAE,CAAC,iDAAiD,EAAE,GAAG,EAAE;QACzD,MAAM,UAAU,GAAI,UAAkB,CAAC,MAAM,CAAC;QAC9C,MAAM,QAAQ,GAAI,UAAkB,CAAC,IAAI,CAAC;QAC1C,MAAM,QAAQ,GAAI,UAAkB,CAAC,IAAI,CAAC;QACzC,UAAkB,CAAC,MAAM,GAAG,SAAS,CAAC;QACtC,UAAkB,CAAC,IAAI,GAAG,SAAS,CAAC;QACpC,UAAkB,CAAC,IAAI,GAAG,SAAS,CAAC;QAErC,IAAI,CAAC;YACH,MAAM,IAAI,GAA0B,kBAAkB,CAAC;YACvD,MAAM,UAAU,GAAG,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAC9C,MAAM,QAAQ,GAAgC,EAAE,IAAI,EAAE,SAAS,EAAE,UAAU,EAAE,CAAC;YAC9E,MAAM,OAAO,GAAG,EAAE,kCAAkC,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC,EAAE,CAAC;YAE/E,MAAM,UAAU,GAAG,+BAA+B,CAAC;gBACjD,IAAI;gBACJ,QAAQ;gBACR,OAAO;gBACP,WAAW,EAAE,+BAA+B,EAAE;aAC/C,CAAC,CAAC;YAEH,MAAM,MAAM,GAAG,+BAA+B,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,UAAU,EAAE,CAAC,CAAC;YAC/E,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;YACjD,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QACzC,CAAC;gBAAS,CAAC;YACR,UAAkB,CAAC,MAAM,GAAG,UAAU,CAAC;YACvC,UAAkB,CAAC,IAAI,GAAG,QAAQ,CAAC;YACnC,UAAkB,CAAC,IAAI,GAAG,QAAQ,CAAC;QACtC,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qDAAqD,EAAE,GAAG,EAAE;QAC7D,MAAM,IAAI,GAA0B,kBAAkB,CAAC;QACvD,MAAM,UAAU,GAAG,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC9C,MAAM,QAAQ,GAAgC,EAAE,IAAI,EAAE,SAAS,EAAE,UAAU,EAAE,CAAC;QAC9E,MAAM,OAAO,GAAG,EAAE,kCAAkC,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC,EAAE,CAAC;QAE/E,MAAM,UAAU,GAAG,+BAA+B,CAAC;YACjD,IAAI;YACJ,QAAQ;YACR,OAAO;YACP,WAAW,EAAE,+BAA+B,EAAE;SAC/C,CAAC,CAAC;QAEH,MAAM,MAAM,GAAG,+BAA+B,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,UAAU,EAAE,CAAC,CAAC;QAC/E,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;QACjD,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IACzC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kEAAkE,EAAE,GAAG,EAAE;QAC1E,MAAM,IAAI,GAA0B,kBAAkB,CAAC;QACvD,MAAM,cAAc,GAAG,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClD,MAAM,UAAU,GAAG,yCAAyC,CAAC,cAAc,CAAC,CAAC;QAE7E,MAAM,cAAc,GAAgC,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;QAC/F,MAAM,eAAe,GAAgC,EAAE,IAAI,EAAE,SAAS,EAAE,UAAU,EAAE,CAAC;QACrF,MAAM,OAAO,GAAG,EAAE,gBAAgB,EAAE,KAAK,EAAE,CAAC;QAE5C,MAAM,UAAU,GAAG,+BAA+B,CAAC;YACjD,IAAI;YACJ,QAAQ,EAAE,cAAc;YACxB,OAAO;YACP,WAAW,EAAE,+BAA+B,EAAE;SAC/C,CAAC,CAAC;QAEH,MAAM,CAAC,+BAA+B,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,cAAc,EAAE,UAAU,EAAE,CAAC,EAAE,KAAK,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAChH,MAAM,CAAC,+BAA+B,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,eAAe,EAAE,UAAU,EAAE,CAAC,EAAE,KAAK,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IACnH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,mFAAmF,EAAE,GAAG,EAAE;QAC3F,MAAM,IAAI,GAA0B,kBAAkB,CAAC;QACvD,MAAM,cAAc,GAAG,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClD,MAAM,OAAO,GAAG,EAAE,eAAe,EAAE,KAAK,EAAE,CAAC;QAE3C,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACzC,MAAM,SAAS,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC;QACpE,MAAM,KAAK,GAAG,SAAS,CAAC,SAAS,CAAC,SAAS,EAAE,KAAK,EAAE,cAAc,CAAC,CAAC;QACpE,MAAM,WAAW,GAAG,IAAI,UAAU,CAAC,KAAK,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC;QAChE,WAAW,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;QAC1B,WAAW,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;QACrC,MAAM,gBAAgB,GAAG,YAAY,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;QAE7D,MAAM,QAAQ,GAAgC,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;QACzF,MAAM,MAAM,GAAG,+BAA+B,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,UAAU,EAAE,gBAAgB,EAAE,CAAC,CAAC;QACjG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;QAChD,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IACzC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uCAAuC,EAAE,GAAG,EAAE;QAC/C,MAAM,OAAO,GAAG,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC;QACzB,MAAM,UAAU,GAAG,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC9C,MAAM,QAAQ,GAAgC,EAAE,IAAI,EAAE,SAAS,EAAE,UAAU,EAAE,CAAC;QAC9E,MAAM,UAAU,GAAG,+BAA+B,CAAC;YACjD,IAAI,EAAE,kBAAkB;YACxB,QAAQ;YACR,OAAO;YACP,WAAW,EAAE,+BAA+B,EAAE;SAC/C,CAAC,CAAC;QAEH,MAAM,CAAC,+BAA+B,CAAC,EAAE,IAAI,EAAE,6BAA6B,EAAE,QAAQ,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;IACpH,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/node_modules/@happier-dev/protocol/dist/crypto/base64.d.ts

@@ -0,0 +1,4 @@
+export type Base64Variant = 'base64' | 'base64url';
+export declare function encodeBase64(bytes: Uint8Array, variant?: Base64Variant): string;
+export declare function decodeBase64(base64: string, variant?: Base64Variant): Uint8Array;
+//# sourceMappingURL=base64.d.ts.map

package/node_modules/@happier-dev/protocol/dist/crypto/base64.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"base64.d.ts","sourceRoot":"","sources":["../../src/crypto/base64.ts"],"names":[],"mappings":"AAEA,MAAM,MAAM,aAAa,GAAG,QAAQ,GAAG,WAAW,CAAC;AA0BnD,wBAAgB,YAAY,CAAC,KAAK,EAAE,UAAU,EAAE,OAAO,GAAE,aAAwB,GAAG,MAAM,CASzF;AAED,wBAAgB,YAAY,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,GAAE,aAAwB,GAAG,UAAU,CAG1F"}

package/node_modules/@happier-dev/protocol/dist/crypto/base64.js

@@ -0,0 +1,36 @@
+import { fromByteArray, toByteArray } from 'base64-js';
+function normalizeBase64ForDecoding(input, variant) {
+    let normalized = input.replace(/\s+/g, '');
+    if (variant === 'base64url') {
+        normalized = normalized.replace(/-/g, '+').replace(/_/g, '/');
+    }
+    // Keep only canonical base64 alphabet characters. This matches the permissive
+    // behavior of Node's Buffer base64 decoder, and prevents `base64-js` from
+    // throwing on incidental whitespace or accidental invalid characters.
+    normalized = normalized.replace(/[^A-Za-z0-9+/]/g, '');
+    // base64 strings with length % 4 === 1 are not decodable; truncate the final
+    // character to avoid throwing and align with Node's lenient decoder.
+    if (normalized.length % 4 === 1) {
+        normalized = normalized.slice(0, -1);
+    }
+    const padding = normalized.length % 4;
+    if (padding) {
+        normalized += '='.repeat(4 - padding);
+    }
+    return normalized;
+}
+export function encodeBase64(bytes, variant = 'base64') {
+    const base64 = fromByteArray(bytes);
+    if (variant === 'base64url') {
+        return base64
+            .replace(/\+/g, '-')
+            .replace(/\//g, '_')
+            .replace(/=/g, '');
+    }
+    return base64;
+}
+export function decodeBase64(base64, variant = 'base64') {
+    const normalized = normalizeBase64ForDecoding(base64, variant);
+    return toByteArray(normalized);
+}
+//# sourceMappingURL=base64.js.map

package/node_modules/@happier-dev/protocol/dist/crypto/base64.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"base64.js","sourceRoot":"","sources":["../../src/crypto/base64.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AAIvD,SAAS,0BAA0B,CAAC,KAAa,EAAE,OAAsB;IACvE,IAAI,UAAU,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAC3C,IAAI,OAAO,KAAK,WAAW,EAAE,CAAC;QAC5B,UAAU,GAAG,UAAU,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAChE,CAAC;IAED,8EAA8E;IAC9E,0EAA0E;IAC1E,sEAAsE;IACtE,UAAU,GAAG,UAAU,CAAC,OAAO,CAAC,iBAAiB,EAAE,EAAE,CAAC,CAAC;IAEvD,6EAA6E;IAC7E,qEAAqE;IACrE,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;QAChC,UAAU,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IACvC,CAAC;IAED,MAAM,OAAO,GAAG,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC;IACtC,IAAI,OAAO,EAAE,CAAC;QACZ,UAAU,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC;IACxC,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,KAAiB,EAAE,UAAyB,QAAQ;IAC/E,MAAM,MAAM,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;IACpC,IAAI,OAAO,KAAK,WAAW,EAAE,CAAC;QAC5B,OAAO,MAAM;aACV,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;aACnB,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;aACnB,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IACvB,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,MAAc,EAAE,UAAyB,QAAQ;IAC5E,MAAM,UAAU,GAAG,0BAA0B,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC/D,OAAO,WAAW,CAAC,UAAU,CAAC,CAAC;AACjC,CAAC"}

package/node_modules/@happier-dev/protocol/dist/crypto/base64.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=base64.test.d.ts.map

package/node_modules/@happier-dev/protocol/dist/crypto/base64.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"base64.test.d.ts","sourceRoot":"","sources":["../../src/crypto/base64.test.ts"],"names":[],"mappings":""}