@ouro.bot/cli 0.1.0-alpha.80 → 0.1.0-alpha.801

package/dist/repertoire/unraid-restart.js

@@ -0,0 +1,212 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SANCTUARY_RESTART_MUTATION = void 0;
+exports.createApprovedUnraidRestartExecutor = createApprovedUnraidRestartExecutor;
+const node_crypto_1 = require("node:crypto");
+const runtime_1 = require("../nerves/runtime");
+const unraid_client_1 = require("./unraid-client");
+exports.SANCTUARY_RESTART_MUTATION = `mutation SanctuaryRestart($id: PrefixedID!) {
+  docker { restart(id: $id) { id names state status autoStart } }
+}`;
+class RoutineActionReceiptError extends Error {
+    constructor(cause) {
+        super("routine action receipt persistence failed", { cause });
+        this.name = "RoutineActionReceiptError";
+    }
+}
+function failure(code, message) {
+    return { ok: false, error: { code, message, degraded: true } };
+}
+function exactTarget(result, name) {
+    if (!result.ok)
+        return failure("invalid_response", result.error.message);
+    const matches = result.data.containers.filter((container) => container.name === name);
+    if (matches.length === 0)
+        return failure("not_found", `container '${name}' was not found`);
+    if (matches.length !== 1)
+        return failure("ambiguous", `container '${name}' is ambiguous`);
+    return matches[0];
+}
+function validArgument(value) {
+    return typeof value === "string" && value.length > 0 && Buffer.byteLength(value, "utf8") <= 128 && !value.includes("\uFFFD");
+}
+function acknowledgedIdentity(data, target) {
+    const docker = data.docker;
+    if (!docker || typeof docker !== "object" || Array.isArray(docker))
+        return false;
+    const restart = docker.restart;
+    if (!restart || typeof restart !== "object" || Array.isArray(restart))
+        return false;
+    const record = restart;
+    return record.id === target.id && Array.isArray(record.names)
+        && record.names.length === 1 && String(record.names[0]).replace(/^\//u, "") === target.name;
+}
+function createApprovedUnraidRestartExecutor(options) {
+    const createClient = options.createClient ?? ((input) => new unraid_client_1.UnraidClient(input));
+    const sleep = options.sleep ?? ((milliseconds) => new Promise((resolve) => setTimeout(resolve, milliseconds)));
+    const now = options.now ?? (() => new Date());
+    const observationTimeoutMs = options.observationTimeoutMs ?? 30_000;
+    const transitionRoutine = (input) => {
+        try {
+            options.transitionRoutineAction?.(input);
+        }
+        catch (error) {
+            throw new RoutineActionReceiptError(error);
+        }
+    };
+    return async (args, execution) => {
+        if (!validArgument(args.container))
+            return failure("invalid_response", "container must be one bounded exact name");
+        const resolved = exactTarget(await options.listContainers(), args.container);
+        if ("ok" in resolved)
+            return resolved;
+        const fresh = exactTarget(await options.listContainers(), args.container);
+        if ("ok" in fresh)
+            return fresh;
+        if (fresh.id !== resolved.id)
+            return failure("stale_target", "container identity changed before restart");
+        let routineAuthorization = null;
+        if (execution?.routine) {
+            let authorization;
+            try {
+                authorization = await execution.routine.reauthorize();
+            }
+            catch {
+                return failure("stale_target", "routine relationship authorization is unavailable");
+            }
+            if (!authorization.allowed)
+                return failure("stale_target", authorization.reason);
+            if (!authorization.receiptId.trim() || !Number.isInteger(authorization.profileVersion) || authorization.profileVersion < 1) {
+                return failure("stale_target", "routine relationship authorization is not versioned");
+            }
+            routineAuthorization = { receiptId: authorization.receiptId, profileVersion: authorization.profileVersion };
+        }
+        const scenarioHandleDigest = options.acceptanceScenarioHandleDigest?.();
+        const approval = options.acceptanceApproval?.();
+        const attempt = {
+            container: { id: fresh.id, name: fresh.name },
+            beforeState: fresh.state,
+            observedAt: now().toISOString(),
+            actionDigest: (0, node_crypto_1.createHash)("sha256").update(JSON.stringify({ operation: "restart", container: { id: fresh.id, name: fresh.name } })).digest("hex"),
+            argumentDigest: (0, node_crypto_1.createHash)("sha256").update(JSON.stringify({ container: args.container })).digest("hex"),
+            ...(scenarioHandleDigest ? { scenarioHandleDigest } : {}),
+            ...(approval ? { approvalId: approval.approvalId } : {}),
+            attemptId: (0, node_crypto_1.randomUUID)(),
+            mutationAcknowledged: false,
+            afterState: null,
+        };
+        let routineReceipt = null;
+        let routineState = null;
+        if (execution?.routine) {
+            if (!options.reserveRoutineAction || !options.transitionRoutineAction)
+                return failure("invalid_response", "routine action ledger is unavailable");
+            try {
+                routineReceipt = options.reserveRoutineAction({
+                    key: execution.routine.key,
+                    expectedPolicyVersion: execution.routine.expectedPolicyVersion,
+                    authorizationReceiptId: routineAuthorization.receiptId,
+                    authorizationVersion: routineAuthorization.profileVersion,
+                    action: "unraid.container.restart",
+                    target: fresh.name,
+                    attemptId: attempt.attemptId,
+                    expectedBeforeState: fresh.state,
+                    resolvedTarget: { id: fresh.id, name: fresh.name },
+                    effect: { operation: "restart", targetId: fresh.id },
+                });
+                routineState = "reserved";
+            }
+            catch (error) {
+                return failure("stale_target", error instanceof Error ? error.message : "routine action authority changed");
+            }
+        }
+        if (approval && approval.argumentDigest !== attempt.argumentDigest)
+            return failure("stale_target", "approval arguments changed before restart");
+        await options.persistAttempt?.({ ...attempt, observedAt: now().toISOString(), state: "attempt_not_started" });
+        const apiKey = await options.loadWriteApiKey();
+        if (!apiKey.trim()) {
+            if (routineReceipt && routineState === "reserved")
+                transitionRoutine({ id: routineReceipt.id, expectedState: "reserved", state: "failed", recoveryState: { state: "completed", compensation: "none" } });
+            return failure("invalid_response", "Unraid write credential is unavailable");
+        }
+        const client = createClient({ endpoint: options.endpoint, apiKey });
+        if (routineReceipt && routineState === "reserved") {
+            transitionRoutine({ id: routineReceipt.id, expectedState: "reserved", state: "attempting" });
+            routineState = "attempting";
+        }
+        await options.persistAttempt?.({ ...attempt, observedAt: now().toISOString(), state: "attempting" });
+        (0, runtime_1.emitNervesEvent)({ component: "repertoire", event: "repertoire.unraid_restart_start", message: "approved Unraid restart started", meta: { containerId: fresh.id, containerName: fresh.name } });
+        const persistTerminal = async (terminal) => {
+            try {
+                await options.persistAttempt?.(terminal);
+                return true;
+            }
+            catch (error) {
+                (0, runtime_1.emitNervesEvent)({ level: "error", component: "repertoire", event: "repertoire.unraid_restart_error", message: "approved Unraid restart terminal receipt persistence failed", meta: { containerId: fresh.id, category: error instanceof Error ? error.name : "unknown" } });
+                return false;
+            }
+        };
+        let acknowledged = false;
+        let mutation = null;
+        try {
+            mutation = await client.mutate(exports.SANCTUARY_RESTART_MUTATION, { id: fresh.id });
+            acknowledged = acknowledgedIdentity(mutation, fresh);
+            if (!acknowledged)
+                throw new Error("restart response identity was invalid");
+        }
+        catch {
+            acknowledged = false;
+        }
+        if (acknowledged && mutation && routineReceipt && routineState === "attempting") {
+            transitionRoutine({ id: routineReceipt.id, expectedState: "attempting", state: "effect_acknowledged", effectReceipt: (0, node_crypto_1.createHash)("sha256").update(JSON.stringify(mutation)).digest("hex") });
+            routineState = "effect_acknowledged";
+        }
+        const startedAt = now().getTime();
+        let sawRestarting = false;
+        try {
+            do {
+                const observed = exactTarget(await options.listContainers(), args.container);
+                if (!("ok" in observed)) {
+                    if (observed.id !== fresh.id) {
+                        await persistTerminal({ ...attempt, observedAt: now().toISOString(), state: "attempted_or_indeterminate", mutationAcknowledged: acknowledged });
+                        if (routineReceipt && routineState)
+                            transitionRoutine({ id: routineReceipt.id, expectedState: routineState, state: "indeterminate", recoveryState: { state: "manual_inspection_required", compensation: "none" } });
+                        return failure("ambiguous", "container identity changed after restart attempt");
+                    }
+                    sawRestarting ||= observed.state === "restarting";
+                    if (observed.state === "running" && !observed.degraded && (acknowledged || sawRestarting)) {
+                        if (!await persistTerminal({ ...attempt, observedAt: now().toISOString(), state: "succeeded", mutationAcknowledged: acknowledged, afterState: observed.state })) {
+                            return failure("ambiguous", "restart succeeded but its terminal receipt could not be persisted; it was not retried");
+                        }
+                        if (routineReceipt && routineState === "attempting") {
+                            transitionRoutine({ id: routineReceipt.id, expectedState: "attempting", state: "effect_acknowledged", effectReceipt: (0, node_crypto_1.createHash)("sha256").update(JSON.stringify({ observation: "restarting", target: fresh.id })).digest("hex") });
+                            routineState = "effect_acknowledged";
+                        }
+                        if (routineReceipt && routineState === "effect_acknowledged") {
+                            transitionRoutine({ id: routineReceipt.id, expectedState: "effect_acknowledged", state: "verified", verifiedAfterState: observed.state, recoveryState: { state: "completed", compensation: "none" } });
+                            routineState = null;
+                        }
+                        (0, runtime_1.emitNervesEvent)({ component: "repertoire", event: "repertoire.unraid_restart_end", message: "approved Unraid restart completed", meta: { containerId: fresh.id, observedRestart: true } });
+                        return { ok: true, data: { container: { id: fresh.id, name: fresh.name }, beforeState: fresh.state, afterState: observed.state, observedRestart: true, degraded: false } };
+                    }
+                }
+                if (now().getTime() - startedAt >= observationTimeoutMs)
+                    break;
+                await sleep(1_000);
+            } while (true);
+        }
+        catch (error) {
+            if (error instanceof RoutineActionReceiptError)
+                throw error;
+            await persistTerminal({ ...attempt, observedAt: now().toISOString(), state: "attempted_or_indeterminate", mutationAcknowledged: acknowledged });
+            if (routineReceipt && routineState)
+                transitionRoutine({ id: routineReceipt.id, expectedState: routineState, state: "indeterminate", recoveryState: { state: "manual_inspection_required", compensation: "none" } });
+            (0, runtime_1.emitNervesEvent)({ level: "error", component: "repertoire", event: "repertoire.unraid_restart_error", message: "approved Unraid restart observation failed", meta: { containerId: fresh.id, acknowledged } });
+            return failure("ambiguous", "restart was attempted but observation failed; it was not retried");
+        }
+        await persistTerminal({ ...attempt, observedAt: now().toISOString(), state: "attempted_or_indeterminate", mutationAcknowledged: acknowledged });
+        if (routineReceipt && routineState)
+            transitionRoutine({ id: routineReceipt.id, expectedState: routineState, state: "indeterminate", recoveryState: { state: "manual_inspection_required", compensation: "none" } });
+        (0, runtime_1.emitNervesEvent)({ level: "error", component: "repertoire", event: "repertoire.unraid_restart_error", message: "approved Unraid restart outcome was ambiguous", meta: { containerId: fresh.id, acknowledged } });
+        return failure("ambiguous", "restart was attempted but could not be proven; it was not retried");
+    };
+}

package/dist/repertoire/user-profile.js

@@ -0,0 +1,131 @@
+"use strict";
+/**
+ * User profile model and vault storage.
+ *
+ * Profiles are stored as secure notes in the agent's Vaultwarden vault,
+ * keyed by friend ID: `user-profile/{friendId}`.
+ *
+ * The storage layer uses the existing CredentialStore interface — the profile
+ * JSON is stored in the `password` field of a login item (the vault's most
+ * reliable field for arbitrary data). Field-level access ensures the full
+ * profile is never dumped to model context unnecessarily.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.storeUserProfile = storeUserProfile;
+exports.getUserProfile = getUserProfile;
+exports.getUserProfileField = getUserProfileField;
+exports.deleteUserProfile = deleteUserProfile;
+exports.updateUserProfileFields = updateUserProfileFields;
+const runtime_1 = require("../nerves/runtime");
+// ---------------------------------------------------------------------------
+// Storage key
+// ---------------------------------------------------------------------------
+function profileKey(friendId) {
+    return `user-profile/${friendId}`;
+}
+function isMissingUserProfileError(err) {
+    const message = err instanceof Error ? err.message : String(err);
+    return /no credential found/i.test(message) || /field "password" not found/i.test(message);
+}
+// ---------------------------------------------------------------------------
+// CRUD operations
+// ---------------------------------------------------------------------------
+/**
+ * Store a complete user profile in the vault.
+ * Overwrites any existing profile for the given friend ID.
+ */
+async function storeUserProfile(friendId, profile, store) {
+    (0, runtime_1.emitNervesEvent)({
+        event: "repertoire.user_profile_store",
+        component: "repertoire",
+        message: `storing user profile for ${friendId}`,
+        meta: { friendId },
+    });
+    const key = profileKey(friendId);
+    /* v8 ignore start -- platform-dependent v8 branch counting on await @preserve */
+    await store.store(key, {
+        password: JSON.stringify(profile),
+        notes: "user-profile",
+    });
+    /* v8 ignore stop */
+}
+/**
+ * Retrieve the full user profile for a friend.
+ * Returns null if no profile exists. Throws if the stored data is malformed
+ * or the vault cannot be read.
+ */
+async function getUserProfile(friendId, store) {
+    (0, runtime_1.emitNervesEvent)({
+        event: "repertoire.user_profile_get",
+        component: "repertoire",
+        message: `getting user profile for ${friendId}`,
+        meta: { friendId },
+    });
+    try {
+        const raw = await store.getRawSecret(profileKey(friendId), "password");
+        const parsed = JSON.parse(raw);
+        if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+            throw new Error(`stored user profile for ${friendId} is malformed`);
+        }
+        return parsed;
+    }
+    catch (err) {
+        if (err instanceof SyntaxError) {
+            throw new Error(`stored user profile for ${friendId} is malformed`);
+        }
+        if (isMissingUserProfileError(err)) {
+            return null;
+        }
+        throw err;
+    }
+}
+/**
+ * Retrieve a specific field from a user profile.
+ * Returns undefined if the profile doesn't exist or the field is not set.
+ */
+async function getUserProfileField(friendId, field, store) {
+    const profile = await getUserProfile(friendId, store);
+    if (!profile)
+        return undefined;
+    return profile[field];
+}
+/**
+ * Delete a user profile from the vault.
+ * Returns true if the profile was deleted, false if it didn't exist.
+ */
+async function deleteUserProfile(friendId, store) {
+    (0, runtime_1.emitNervesEvent)({
+        event: "repertoire.user_profile_delete",
+        component: "repertoire",
+        message: `deleting user profile for ${friendId}`,
+        meta: { friendId },
+    });
+    return store.delete(profileKey(friendId));
+}
+/**
+ * Update specific fields on a user profile, merging with existing data.
+ * Creates the profile if it doesn't exist.
+ * Preferences are merged (not replaced) at the key level.
+ */
+async function updateUserProfileFields(friendId, fields, store) {
+    (0, runtime_1.emitNervesEvent)({
+        event: "repertoire.user_profile_update",
+        component: "repertoire",
+        message: `updating user profile fields for ${friendId}`,
+        meta: { friendId, fieldCount: Object.keys(fields).length },
+    });
+    const existing = await getUserProfile(friendId, store);
+    let merged;
+    if (existing) {
+        // Merge preferences at key level
+        const mergedPreferences = {
+            ...existing.preferences,
+            ...(fields.preferences ?? {}),
+        };
+        merged = { ...existing, ...fields, preferences: mergedPreferences };
+    }
+    else {
+        merged = fields;
+    }
+    await storeUserProfile(friendId, merged, store);
+}

package/dist/repertoire/vault-setup.js

@@ -0,0 +1,246 @@
+"use strict";
+/**
+ * Vault setup module — Bitwarden/Vaultwarden account creation.
+ *
+ * Implements the Bitwarden registration protocol using Node.js crypto:
+ * - PBKDF2-SHA256 for master key derivation
+ * - HKDF-SHA256 for key stretching
+ * - AES-256-CBC for symmetric key protection
+ * - RSA-2048 keypair for asymmetric encryption
+ *
+ * All crypto follows the Bitwarden security whitepaper:
+ * https://bitwarden.com/help/bitwarden-security-white-paper/
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.deriveMasterKey = deriveMasterKey;
+exports.deriveMasterPasswordHash = deriveMasterPasswordHash;
+exports.deriveStretchedMasterKey = deriveStretchedMasterKey;
+exports.makeProtectedSymmetricKey = makeProtectedSymmetricKey;
+exports.createVaultAccount = createVaultAccount;
+const crypto = __importStar(require("node:crypto"));
+const runtime_1 = require("../nerves/runtime");
+// ---------------------------------------------------------------------------
+// Crypto primitives
+// ---------------------------------------------------------------------------
+/**
+ * Derive the master key from password and email using PBKDF2-SHA256.
+ * Email is lowercased and used as the salt per Bitwarden spec.
+ */
+function deriveMasterKey(password, email, iterations) {
+    return new Promise((resolve, reject) => {
+        crypto.pbkdf2(password, email.toLowerCase(), iterations, 32, "sha256", (err, key) => {
+            /* v8 ignore next -- defensive: pbkdf2 rejects on invalid input @preserve */
+            if (err)
+                reject(err);
+            else
+                resolve(key);
+        });
+    });
+}
+/**
+ * Derive the master password hash: PBKDF2-SHA256(masterKey, password, 1 iteration).
+ * This hash is sent to the server for authentication — it never sees the master key.
+ */
+function deriveMasterPasswordHash(masterKey, password) {
+    return new Promise((resolve, reject) => {
+        crypto.pbkdf2(masterKey, password, 1, 32, "sha256", (err, hash) => {
+            /* v8 ignore next -- defensive: pbkdf2 rejects on invalid input @preserve */
+            if (err)
+                reject(err);
+            else
+                resolve(hash.toString("base64"));
+        });
+    });
+}
+/**
+ * Stretch the master key using HKDF-Expand-only (RFC 5869 §2.3) to produce a 64-byte key.
+ * First 32 bytes = encryption key, last 32 bytes = MAC key.
+ *
+ * CRITICAL: Bitwarden uses HKDF-Expand ONLY (no Extract step).
+ * Node.js crypto.hkdfSync() does Extract+Expand which produces DIFFERENT output.
+ * Reference: https://github.com/bitwarden/sdk-internal/blob/main/crates/bitwarden-crypto/src/util.rs
+ * Bitwarden calls Hkdf::<Sha256>::from_prk(masterKey).expand(info, output) — Expand only.
+ */
+function deriveStretchedMasterKey(masterKey) {
+    const encKey = hkdfExpandOnly(masterKey, "enc", 32);
+    const macKey = hkdfExpandOnly(masterKey, "mac", 32);
+    return Buffer.concat([encKey, macKey]);
+}
+/**
+ * HKDF-Expand only (RFC 5869 §2.3) — no Extract step.
+ * Matches Bitwarden's Hkdf::from_prk(prk).expand(info).
+ */
+function hkdfExpandOnly(prk, info, length) {
+    const hashLen = 32; // SHA-256
+    const n = Math.ceil(length / hashLen);
+    let okm = Buffer.alloc(0);
+    let t = Buffer.alloc(0);
+    for (let i = 1; i <= n; i++) {
+        t = crypto.createHmac("sha256", prk)
+            .update(Buffer.concat([t, Buffer.from(info, "utf8"), Buffer.from([i])]))
+            .digest();
+        okm = Buffer.concat([okm, t]);
+    }
+    return okm.subarray(0, length);
+}
+/**
+ * Encrypt data with AES-256-CBC and HMAC-SHA256 MAC.
+ * Returns a Bitwarden "type 2" cipherstring: "2.<iv>|<ct>|<mac>"
+ */
+function encryptWithStretchedKey(data, stretchedKey) {
+    const encKey = stretchedKey.subarray(0, 32);
+    const macKey = stretchedKey.subarray(32, 64);
+    const iv = crypto.randomBytes(16);
+    const cipher = crypto.createCipheriv("aes-256-cbc", encKey, iv);
+    const ct = Buffer.concat([cipher.update(data), cipher.final()]);
+    // MAC covers iv + ct
+    const mac = crypto.createHmac("sha256", macKey)
+        .update(iv)
+        .update(ct)
+        .digest();
+    return `2.${iv.toString("base64")}|${ct.toString("base64")}|${mac.toString("base64")}`;
+}
+/**
+ * Generate a 64-byte symmetric key, encrypt it with the stretched master key.
+ * Returns the "protected symmetric key" cipherstring.
+ */
+function makeProtectedSymmetricKey(stretchedMasterKey) {
+    const symKey = crypto.randomBytes(64);
+    return encryptWithStretchedKey(symKey, stretchedMasterKey);
+}
+/**
+ * Generate an RSA-2048 keypair.
+ * Returns { publicKey: base64-DER, privateKeyDer: Buffer }.
+ */
+function generateRsaKeypair() {
+    const { publicKey, privateKey } = crypto.generateKeyPairSync("rsa", {
+        modulusLength: 2048,
+        publicKeyEncoding: { type: "spki", format: "der" },
+        privateKeyEncoding: { type: "pkcs8", format: "der" },
+    });
+    return {
+        publicKeyB64: publicKey.toString("base64"),
+        privateKeyDer: privateKey,
+    };
+}
+// ---------------------------------------------------------------------------
+// Registration
+// ---------------------------------------------------------------------------
+const KDF_PBKDF2 = 0;
+const KDF_ITERATIONS = 600000;
+const REGISTER_ACCOUNT_PATH = "/identity/accounts/register";
+/**
+ * Create a Bitwarden account on the configured Vaultwarden server.
+ * Uses the Bitwarden registration API with standard KDF implementation.
+ */
+async function createVaultAccount(agentName, serverUrl, email, masterPassword) {
+    (0, runtime_1.emitNervesEvent)({
+        event: "repertoire.vault_setup_start",
+        component: "repertoire",
+        message: `creating vault account for ${agentName}`,
+        meta: { agentName, serverUrl, email },
+    });
+    try {
+        // Step 1: Derive keys
+        const masterKey = await deriveMasterKey(masterPassword, email, KDF_ITERATIONS);
+        const masterPasswordHash = await deriveMasterPasswordHash(masterKey, masterPassword);
+        const stretchedKey = deriveStretchedMasterKey(masterKey);
+        // Step 2: Generate symmetric key (64 bytes = 32 enc + 32 mac), encrypt with stretched key
+        const symKey = crypto.randomBytes(64);
+        const protectedSymKey = encryptWithStretchedKey(symKey, stretchedKey);
+        // Step 3: Generate RSA keypair, encrypt private key with the symmetric key
+        const { publicKeyB64, privateKeyDer } = generateRsaKeypair();
+        const encryptedPrivateKey = encryptWithStretchedKey(privateKeyDer, symKey);
+        // Step 4: POST registration
+        const registrationUrl = `${serverUrl}${REGISTER_ACCOUNT_PATH}`;
+        const res = await fetch(registrationUrl, {
+            method: "POST",
+            headers: { "Content-Type": "application/json" },
+            body: JSON.stringify({
+                name: agentName,
+                email,
+                masterPasswordHash,
+                masterPasswordHint: null,
+                key: protectedSymKey,
+                kdf: KDF_PBKDF2,
+                kdfIterations: KDF_ITERATIONS,
+                keys: {
+                    publicKey: publicKeyB64,
+                    encryptedPrivateKey,
+                },
+            }),
+        });
+        if (!res.ok) {
+            let errorDetail;
+            try {
+                const body = await res.json();
+                errorDetail = body.message ?? `HTTP ${res.status} ${res.statusText}`;
+            }
+            catch {
+                errorDetail = `HTTP ${res.status} ${res.statusText}`;
+            }
+            const endpointAwareError = `${errorDetail} from ${registrationUrl}. Check --server; Ouro expects a Bitwarden/Vaultwarden identity API.`;
+            (0, runtime_1.emitNervesEvent)({
+                level: "error",
+                event: "repertoire.vault_setup_error",
+                component: "repertoire",
+                message: `vault registration failed: ${endpointAwareError}`,
+                meta: { agentName, serverUrl, email, registrationUrl, reason: endpointAwareError },
+            });
+            return { success: false, email, serverUrl, error: endpointAwareError };
+        }
+        (0, runtime_1.emitNervesEvent)({
+            event: "repertoire.vault_setup_end",
+            component: "repertoire",
+            message: `vault account created for ${agentName}`,
+            meta: { agentName, serverUrl, email },
+        });
+        return { success: true, email, serverUrl };
+    }
+    catch (err) {
+        const reason = err instanceof Error ? err.message : String(err);
+        const registrationUrl = `${serverUrl}${REGISTER_ACCOUNT_PATH}`;
+        const endpointAwareError = `cannot reach vault registration endpoint ${registrationUrl}: ${reason}. Check network, DNS/TLS, and --server.`;
+        (0, runtime_1.emitNervesEvent)({
+            level: "error",
+            event: "repertoire.vault_setup_error",
+            component: "repertoire",
+            message: `vault setup failed: ${endpointAwareError}`,
+            meta: { agentName, serverUrl, email, registrationUrl, reason: endpointAwareError },
+        });
+        return { success: false, email, serverUrl, error: endpointAwareError };
+    }
+}