@sentropic/h2a-runtime 0.81.0

package/dist/auth-bundle.js

@@ -0,0 +1,112 @@
+import { readFile } from "node:fs/promises";
+import { homedir } from "node:os";
+import { join } from "node:path";
+/**
+ * For each CLI profile, the set of HOME-relative files we copy to the Pod's
+ * Secret so the in-cluster binary can read its OAuth credentials without
+ * re-authing in-Pod.
+ */
+export const PROFILE_AUTH_FILES = {
+    shell: [],
+    codex: [".codex/auth.json", ".codex/config.toml"],
+    opencode: [],
+    claude: [
+        ".claude/.credentials.json",
+        ".claude.json",
+        ".claude/settings.json",
+    ],
+    agy: [
+        ".gemini/oauth_creds.json",
+        ".gemini/google_accounts.json",
+        ".gemini/antigravity-cli/settings.json",
+    ],
+    gemini: [
+        ".gemini/oauth_creds.json",
+        ".gemini/google_accounts.json",
+        ".gemini/settings.json",
+        ".gemini/config/mcp_config.json",
+    ],
+    mistral: [],
+};
+const REQUIRED_AUTH_BUNDLE_PROFILES = {
+    codex: "codex login",
+    claude: "claude auth login",
+};
+export class AuthBundleMissingError extends Error {
+    profile;
+    knownPaths;
+    refreshHint;
+    constructor(profile, knownPaths, refreshHint) {
+        super(`[remote] No local auth files found for ${profile}. ` +
+            `Expected at least one of: ${knownPaths.join(", ")}. ` +
+            `Run \`${refreshHint}\` locally, then retry; or use --no-auth to start without bundled credentials.`);
+        this.profile = profile;
+        this.knownPaths = knownPaths;
+        this.refreshHint = refreshHint;
+        this.name = "AuthBundleMissingError";
+    }
+}
+export async function collectProfileAuth(profile, options = {}) {
+    const home = options.home ?? homedir();
+    const reader = options.readFileImpl ?? (async (path) => readFile(path));
+    const files = PROFILE_AUTH_FILES[profile] ?? [];
+    const bundle = {};
+    for (const relPath of files) {
+        try {
+            const data = await reader(join(home, relPath));
+            const payload = relPath === ".claude.json"
+                ? sanitizeClaudeConfig(data)
+                : relPath === ".claude/settings.json"
+                    ? sanitizeClaudeSettings(data)
+                    : Buffer.from(data);
+            bundle[relPath] = payload.toString("base64");
+        }
+        catch {
+            // missing auth files are skipped silently; the CLI in-Pod will fall back
+            // to its own login flow.
+        }
+    }
+    return bundle;
+}
+/**
+ * Strip native-install metadata from a bundled ~/.claude.json. Locally claude
+ * records `installMethod: "native"` + a local binary path (~/.local/bin/claude)
+ * that does not exist in the remote Pod, which makes the in-Pod claude warn
+ * "claude command not found". Dropping these lets the Pod's own install stand.
+ */
+function sanitizeClaudeConfig(data) {
+    try {
+        const obj = JSON.parse(Buffer.from(data).toString("utf8"));
+        delete obj.installMethod;
+        delete obj.autoUpdaterStatus;
+        return Buffer.from(JSON.stringify(obj), "utf8");
+    }
+    catch {
+        return Buffer.from(data);
+    }
+}
+/**
+ * Strip host/launcher-specific `hooks` from a bundled ~/.claude/settings.json.
+ * `remote enroll --install-hooks` registers SessionStart/SessionEnd hooks that
+ * shell out to the `remote` CLI — which exists on the laptop but NOT inside a
+ * session Pod. Shipping them verbatim makes the in-Pod claude fail every
+ * SessionStart with "SessionStart:resume hook error … /bin/sh: 1: remote: not
+ * found". The hooks are a local-launcher concern, so they never belong in a Pod.
+ */
+function sanitizeClaudeSettings(data) {
+    try {
+        const obj = JSON.parse(Buffer.from(data).toString("utf8"));
+        delete obj.hooks;
+        return Buffer.from(JSON.stringify(obj), "utf8");
+    }
+    catch {
+        return Buffer.from(data);
+    }
+}
+export function assertRequiredAuthBundle(profile, bundle) {
+    const refreshHint = REQUIRED_AUTH_BUNDLE_PROFILES[profile];
+    if (!refreshHint || Object.keys(bundle).length > 0)
+        return;
+    throw new AuthBundleMissingError(profile, PROFILE_AUTH_FILES[profile] ?? [], refreshHint);
+}
+//# sourceMappingURL=auth-bundle.js.map

package/dist/auth-bundle.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-bundle.js","sourceRoot":"","sources":["../src/auth-bundle.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAIjC;;;;GAIG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAE3B;IACF,KAAK,EAAE,EAAE;IACT,KAAK,EAAE,CAAC,kBAAkB,EAAE,oBAAoB,CAAC;IACjD,QAAQ,EAAE,EAAE;IACZ,MAAM,EAAE;QACN,2BAA2B;QAC3B,cAAc;QACd,uBAAuB;KACxB;IACD,GAAG,EAAE;QACH,0BAA0B;QAC1B,8BAA8B;QAC9B,uCAAuC;KACxC;IACD,MAAM,EAAE;QACN,0BAA0B;QAC1B,8BAA8B;QAC9B,uBAAuB;QACvB,gCAAgC;KACjC;IACD,OAAO,EAAE,EAAE;CACZ,CAAC;AAIF,MAAM,6BAA6B,GAAwC;IACzE,KAAK,EAAE,aAAa;IACpB,MAAM,EAAE,mBAAmB;CAC5B,CAAC;AAEF,MAAM,OAAO,sBAAuB,SAAQ,KAAK;IAEpC;IACA;IACA;IAHX,YACW,OAAmB,EACnB,UAAiC,EACjC,WAAmB;QAE5B,KAAK,CACH,0CAA0C,OAAO,IAAI;YACnD,6BAA6B,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI;YACtD,SAAS,WAAW,gFAAgF,CACvG,CAAC;QARO,YAAO,GAAP,OAAO,CAAY;QACnB,eAAU,GAAV,UAAU,CAAuB;QACjC,gBAAW,GAAX,WAAW,CAAQ;QAO5B,IAAI,CAAC,IAAI,GAAG,wBAAwB,CAAC;IACvC,CAAC;CACF;AAOD,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,OAAmB,EACnB,UAA8B,EAAE;IAEhC,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,OAAO,EAAE,CAAC;IACvC,MAAM,MAAM,GACV,OAAO,CAAC,YAAY,IAAI,CAAC,KAAK,EAAE,IAAY,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;IACnE,MAAM,KAAK,GAAG,kBAAkB,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;IAEhD,MAAM,MAAM,GAA2B,EAAE,CAAC;IAC1C,KAAK,MAAM,OAAO,IAAI,KAAK,EAAE,CAAC;QAC5B,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC;YAC/C,MAAM,OAAO,GACX,OAAO,KAAK,cAAc;gBACxB,CAAC,CAAC,oBAAoB,CAAC,IAAI,CAAC;gBAC5B,CAAC,CAAC,OAAO,KAAK,uBAAuB;oBACnC,CAAC,CAAC,sBAAsB,CAAC,IAAI,CAAC;oBAC9B,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC1B,MAAM,CAAC,OAAO,CAAC,GAAG,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAC/C,CAAC;QAAC,MAAM,CAAC;YACP,yEAAyE;YACzE,yBAAyB;QAC3B,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;GAKG;AACH,SAAS,oBAAoB,CAAC,IAAyB;IACrD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAGxD,CAAC;QACF,OAAO,GAAG,CAAC,aAAa,CAAC;QACzB,OAAO,GAAG,CAAC,iBAAiB,CAAC;QAC7B,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,CAAC;IAClD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC3B,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,sBAAsB,CAAC,IAAyB;IACvD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAGxD,CAAC;QACF,OAAO,GAAG,CAAC,KAAK,CAAC;QACjB,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,CAAC;IAClD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC3B,CAAC;AACH,CAAC;AAED,MAAM,UAAU,wBAAwB,CACtC,OAAmB,EACnB,MAAkB;IAElB,MAAM,WAAW,GAAG,6BAA6B,CAAC,OAAO,CAAC,CAAC;IAC3D,IAAI,CAAC,WAAW,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO;IAC3D,MAAM,IAAI,sBAAsB,CAC9B,OAAO,EACP,kBAAkB,CAAC,OAAO,CAAC,IAAI,EAAE,EACjC,WAAW,CACZ,CAAC;AACJ,CAAC"}

package/dist/auth-diagnostics.d.ts

@@ -0,0 +1,18 @@
+import type { CliProfile } from "./protocol-local.js";
+import { type CollectAuthOptions } from "./auth-bundle.js";
+import { type AuthRefreshResult, type RunCommand } from "./auth-refresh.js";
+export type AuthDiagnosticsStatus = AuthRefreshResult | {
+    readonly checked: false;
+    readonly reason: "skipped";
+};
+export type AuthDiagnosticsResult = {
+    readonly profile: CliProfile;
+    readonly authStatus: AuthDiagnosticsStatus;
+    readonly bundledFiles: ReadonlyArray<string>;
+};
+export type InspectProfileAuthOptions = CollectAuthOptions & {
+    readonly authRefresh?: boolean;
+    readonly runCommand?: RunCommand;
+};
+export declare function inspectProfileAuth(profile: CliProfile, options?: InspectProfileAuthOptions): Promise<AuthDiagnosticsResult>;
+//# sourceMappingURL=auth-diagnostics.d.ts.map

package/dist/auth-diagnostics.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-diagnostics.d.ts","sourceRoot":"","sources":["../src/auth-diagnostics.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAEtD,OAAO,EAIL,KAAK,kBAAkB,EACxB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAEL,KAAK,iBAAiB,EACtB,KAAK,UAAU,EAChB,MAAM,mBAAmB,CAAC;AAE3B,MAAM,MAAM,qBAAqB,GAC7B,iBAAiB,GACjB;IAAE,QAAQ,CAAC,OAAO,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAA;CAAE,CAAC;AAE5D,MAAM,MAAM,qBAAqB,GAAG;IAClC,QAAQ,CAAC,OAAO,EAAE,UAAU,CAAC;IAC7B,QAAQ,CAAC,UAAU,EAAE,qBAAqB,CAAC;IAC3C,QAAQ,CAAC,YAAY,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;CAC9C,CAAC;AAEF,MAAM,MAAM,yBAAyB,GAAG,kBAAkB,GAAG;IAC3D,QAAQ,CAAC,WAAW,CAAC,EAAE,OAAO,CAAC;IAC/B,QAAQ,CAAC,UAAU,CAAC,EAAE,UAAU,CAAC;CAClC,CAAC;AAEF,wBAAsB,kBAAkB,CACtC,OAAO,EAAE,UAAU,EACnB,OAAO,GAAE,yBAA8B,GACtC,OAAO,CAAC,qBAAqB,CAAC,CAsBhC"}

package/dist/auth-diagnostics.js

@@ -0,0 +1,23 @@
+import { assertRequiredAuthBundle, collectProfileAuth, } from "./auth-bundle.js";
+import { ensureProfileAuthFresh, } from "./auth-refresh.js";
+export async function inspectProfileAuth(profile, options = {}) {
+    const authStatus = options.authRefresh === false
+        ? { checked: false, reason: "skipped" }
+        : await ensureProfileAuthFresh(profile, {
+            ...(options.runCommand ? { runCommand: options.runCommand } : {}),
+        });
+    const collectOptions = {
+        ...(options.home !== undefined ? { home: options.home } : {}),
+        ...(options.readFileImpl !== undefined
+            ? { readFileImpl: options.readFileImpl }
+            : {}),
+    };
+    const bundle = await collectProfileAuth(profile, collectOptions);
+    assertRequiredAuthBundle(profile, bundle);
+    return {
+        profile,
+        authStatus,
+        bundledFiles: Object.keys(bundle),
+    };
+}
+//# sourceMappingURL=auth-diagnostics.js.map

package/dist/auth-diagnostics.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-diagnostics.js","sourceRoot":"","sources":["../src/auth-diagnostics.ts"],"names":[],"mappings":"AAEA,OAAO,EACL,wBAAwB,EACxB,kBAAkB,GAGnB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,sBAAsB,GAGvB,MAAM,mBAAmB,CAAC;AAiB3B,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,OAAmB,EACnB,UAAqC,EAAE;IAEvC,MAAM,UAAU,GACd,OAAO,CAAC,WAAW,KAAK,KAAK;QAC3B,CAAC,CAAE,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAY;QAClD,CAAC,CAAC,MAAM,sBAAsB,CAAC,OAAO,EAAE;YACpC,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAClE,CAAC,CAAC;IAET,MAAM,cAAc,GAAuB;QACzC,GAAG,CAAC,OAAO,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7D,GAAG,CAAC,OAAO,CAAC,YAAY,KAAK,SAAS;YACpC,CAAC,CAAC,EAAE,YAAY,EAAE,OAAO,CAAC,YAAY,EAAE;YACxC,CAAC,CAAC,EAAE,CAAC;KACR,CAAC;IACF,MAAM,MAAM,GAAe,MAAM,kBAAkB,CAAC,OAAO,EAAE,cAAc,CAAC,CAAC;IAC7E,wBAAwB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAE1C,OAAO;QACL,OAAO;QACP,UAAU;QACV,YAAY,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC;KAClC,CAAC;AACJ,CAAC"}

package/dist/auth-login.d.ts

@@ -0,0 +1,9 @@
+import type { CliProfile } from "./protocol-local.js";
+export type LoginCommand = {
+    readonly command: string;
+    readonly args: ReadonlyArray<string>;
+};
+export declare function getLoginCommand(profile: CliProfile): LoginCommand | undefined;
+export type RunInteractive = (cmd: LoginCommand) => Promise<number>;
+export declare function runInteractiveLogin(cmd: LoginCommand): Promise<number>;
+//# sourceMappingURL=auth-login.d.ts.map

package/dist/auth-login.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-login.d.ts","sourceRoot":"","sources":["../src/auth-login.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAEtD,MAAM,MAAM,YAAY,GAAG;IACzB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;CACtC,CAAC;AAYF,wBAAgB,eAAe,CAAC,OAAO,EAAE,UAAU,GAAG,YAAY,GAAG,SAAS,CAE7E;AAED,MAAM,MAAM,cAAc,GAAG,CAAC,GAAG,EAAE,YAAY,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;AAEpE,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,YAAY,GAAG,OAAO,CAAC,MAAM,CAAC,CAMtE"}

package/dist/auth-login.js

@@ -0,0 +1,21 @@
+import { spawn } from "node:child_process";
+/**
+ * The local enrollment command for each profile that ships a non-interactive
+ * (or terminal-driven) login. Profiles without an entry authenticate through
+ * their own in-CLI flow (e.g. `agy` opens a browser / prints an SSH-mode URL).
+ */
+const PROFILE_LOGIN = {
+    codex: { command: "codex", args: ["login"] },
+    claude: { command: "claude", args: ["auth", "login"] },
+};
+export function getLoginCommand(profile) {
+    return PROFILE_LOGIN[profile];
+}
+export function runInteractiveLogin(cmd) {
+    return new Promise((resolve) => {
+        const child = spawn(cmd.command, [...cmd.args], { stdio: "inherit" });
+        child.on("error", () => resolve(127));
+        child.on("close", (code) => resolve(code ?? 1));
+    });
+}
+//# sourceMappingURL=auth-login.js.map

package/dist/auth-login.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-login.js","sourceRoot":"","sources":["../src/auth-login.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAS3C;;;;GAIG;AACH,MAAM,aAAa,GAA8C;IAC/D,KAAK,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,OAAO,CAAC,EAAE;IAC5C,MAAM,EAAE,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE;CACvD,CAAC;AAEF,MAAM,UAAU,eAAe,CAAC,OAAmB;IACjD,OAAO,aAAa,CAAC,OAAO,CAAC,CAAC;AAChC,CAAC;AAID,MAAM,UAAU,mBAAmB,CAAC,GAAiB;IACnD,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC,GAAG,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC;QACtE,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;QACtC,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC;IAClD,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/auth-refresh.d.ts

@@ -0,0 +1,32 @@
+import type { CliProfile } from "./protocol-local.js";
+export type CommandResult = {
+    readonly status: number;
+    readonly stdout: string;
+    readonly stderr: string;
+    readonly timedOut?: boolean;
+};
+export type RunCommand = (command: string, args: ReadonlyArray<string>, options: {
+    timeoutMs: number;
+}) => Promise<CommandResult>;
+export type AuthRefreshResult = {
+    readonly checked: true;
+    readonly command: string;
+} | {
+    readonly checked: false;
+    readonly reason: "no-status-command";
+};
+export type EnsureAuthFreshOptions = {
+    readonly timeoutMs?: number;
+    readonly runCommand?: RunCommand;
+};
+export declare class AuthRefreshError extends Error {
+    readonly profile: CliProfile;
+    readonly refreshHint: string;
+    readonly result: CommandResult;
+    constructor(profile: CliProfile, refreshHint: string, result: CommandResult);
+}
+export declare function runStatusCommand(command: string, args: ReadonlyArray<string>, options: {
+    timeoutMs: number;
+}): Promise<CommandResult>;
+export declare function ensureProfileAuthFresh(profile: CliProfile, options?: EnsureAuthFreshOptions): Promise<AuthRefreshResult>;
+//# sourceMappingURL=auth-refresh.d.ts.map

package/dist/auth-refresh.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-refresh.d.ts","sourceRoot":"","sources":["../src/auth-refresh.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAqBtD,MAAM,MAAM,aAAa,GAAG;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC;CAC7B,CAAC;AAEF,MAAM,MAAM,UAAU,GAAG,CACvB,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,aAAa,CAAC,MAAM,CAAC,EAC3B,OAAO,EAAE;IAAE,SAAS,EAAE,MAAM,CAAA;CAAE,KAC3B,OAAO,CAAC,aAAa,CAAC,CAAC;AAE5B,MAAM,MAAM,iBAAiB,GACzB;IAAE,QAAQ,CAAC,OAAO,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GACpD;IAAE,QAAQ,CAAC,OAAO,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,mBAAmB,CAAA;CAAE,CAAC;AAEtE,MAAM,MAAM,sBAAsB,GAAG;IACnC,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,UAAU,CAAC,EAAE,UAAU,CAAC;CAClC,CAAC;AAEF,qBAAa,gBAAiB,SAAQ,KAAK;IAEvC,QAAQ,CAAC,OAAO,EAAE,UAAU;IAC5B,QAAQ,CAAC,WAAW,EAAE,MAAM;IAC5B,QAAQ,CAAC,MAAM,EAAE,aAAa;gBAFrB,OAAO,EAAE,UAAU,EACnB,WAAW,EAAE,MAAM,EACnB,MAAM,EAAE,aAAa;CAWjC;AAED,wBAAgB,gBAAgB,CAC9B,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,aAAa,CAAC,MAAM,CAAC,EAC3B,OAAO,EAAE;IAAE,SAAS,EAAE,MAAM,CAAA;CAAE,GAC7B,OAAO,CAAC,aAAa,CAAC,CAsCxB;AAED,wBAAsB,sBAAsB,CAC1C,OAAO,EAAE,UAAU,EACnB,OAAO,GAAE,sBAA2B,GACnC,OAAO,CAAC,iBAAiB,CAAC,CAgB5B"}

package/dist/auth-refresh.js

@@ -0,0 +1,83 @@
+import { spawn } from "node:child_process";
+const PROFILE_AUTH_STATUS = {
+    codex: {
+        command: "codex",
+        args: ["login", "status"],
+        refreshHint: "codex login",
+    },
+    claude: {
+        command: "claude",
+        args: ["auth", "status"],
+        refreshHint: "claude auth login",
+    },
+};
+export class AuthRefreshError extends Error {
+    profile;
+    refreshHint;
+    result;
+    constructor(profile, refreshHint, result) {
+        const detail = result.timedOut
+            ? "status check timed out"
+            : `status check failed with exit ${result.status}`;
+        super(`[remote] ${profile} auth is not ready to bundle (${detail}). ` +
+            `Run \`${refreshHint}\` locally, then retry; or use --no-auth-refresh to bypass this preflight.`);
+        this.profile = profile;
+        this.refreshHint = refreshHint;
+        this.result = result;
+        this.name = "AuthRefreshError";
+    }
+}
+export function runStatusCommand(command, args, options) {
+    return new Promise((resolve) => {
+        const child = spawn(command, args, { stdio: ["ignore", "pipe", "pipe"] });
+        let settled = false;
+        let timedOut = false;
+        const stdout = [];
+        const stderr = [];
+        const timer = setTimeout(() => {
+            timedOut = true;
+            child.kill("SIGTERM");
+        }, options.timeoutMs);
+        const finish = (result) => {
+            if (settled)
+                return;
+            settled = true;
+            clearTimeout(timer);
+            resolve(result);
+        };
+        child.stdout.on("data", (chunk) => stdout.push(chunk));
+        child.stderr.on("data", (chunk) => stderr.push(chunk));
+        child.on("error", (error) => {
+            finish({
+                status: 127,
+                stdout: Buffer.concat(stdout).toString("utf8"),
+                stderr: String(error),
+            });
+        });
+        child.on("close", (code) => {
+            finish({
+                status: code ?? 1,
+                stdout: Buffer.concat(stdout).toString("utf8"),
+                stderr: Buffer.concat(stderr).toString("utf8"),
+                ...(timedOut ? { timedOut } : {}),
+            });
+        });
+    });
+}
+export async function ensureProfileAuthFresh(profile, options = {}) {
+    const statusCommand = PROFILE_AUTH_STATUS[profile];
+    if (!statusCommand)
+        return { checked: false, reason: "no-status-command" };
+    const runner = options.runCommand ?? runStatusCommand;
+    const result = await runner(statusCommand.command, statusCommand.args, {
+        timeoutMs: options.timeoutMs ?? 10_000,
+    });
+    if (result.status === 0) {
+        return {
+            checked: true,
+            command: [statusCommand.command, ...statusCommand.args].join(" "),
+        };
+    }
+    throw new AuthRefreshError(profile, statusCommand.refreshHint, result);
+}
+//# sourceMappingURL=auth-refresh.js.map

package/dist/auth-refresh.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-refresh.js","sourceRoot":"","sources":["../src/auth-refresh.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAU3C,MAAM,mBAAmB,GAAmD;IAC1E,KAAK,EAAE;QACL,OAAO,EAAE,OAAO;QAChB,IAAI,EAAE,CAAC,OAAO,EAAE,QAAQ,CAAC;QACzB,WAAW,EAAE,aAAa;KAC3B;IACD,MAAM,EAAE;QACN,OAAO,EAAE,QAAQ;QACjB,IAAI,EAAE,CAAC,MAAM,EAAE,QAAQ,CAAC;QACxB,WAAW,EAAE,mBAAmB;KACjC;CACF,CAAC;AAwBF,MAAM,OAAO,gBAAiB,SAAQ,KAAK;IAE9B;IACA;IACA;IAHX,YACW,OAAmB,EACnB,WAAmB,EACnB,MAAqB;QAE9B,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ;YAC5B,CAAC,CAAC,wBAAwB;YAC1B,CAAC,CAAC,iCAAiC,MAAM,CAAC,MAAM,EAAE,CAAC;QACrD,KAAK,CACH,YAAY,OAAO,iCAAiC,MAAM,KAAK;YAC7D,SAAS,WAAW,4EAA4E,CACnG,CAAC;QAVO,YAAO,GAAP,OAAO,CAAY;QACnB,gBAAW,GAAX,WAAW,CAAQ;QACnB,WAAM,GAAN,MAAM,CAAe;QAS9B,IAAI,CAAC,IAAI,GAAG,kBAAkB,CAAC;IACjC,CAAC;CACF;AAED,MAAM,UAAU,gBAAgB,CAC9B,OAAe,EACf,IAA2B,EAC3B,OAA8B;IAE9B,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;QAC1E,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,IAAI,QAAQ,GAAG,KAAK,CAAC;QACrB,MAAM,MAAM,GAAa,EAAE,CAAC;QAC5B,MAAM,MAAM,GAAa,EAAE,CAAC;QAE5B,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;YAC5B,QAAQ,GAAG,IAAI,CAAC;YAChB,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACxB,CAAC,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;QAEtB,MAAM,MAAM,GAAG,CAAC,MAAqB,EAAE,EAAE;YACvC,IAAI,OAAO;gBAAE,OAAO;YACpB,OAAO,GAAG,IAAI,CAAC;YACf,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,OAAO,CAAC,MAAM,CAAC,CAAC;QAClB,CAAC,CAAC;QAEF,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;QAC/D,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;QAC/D,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE;YAC1B,MAAM,CAAC;gBACL,MAAM,EAAE,GAAG;gBACX,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC;gBAC9C,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC;aACtB,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QACH,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE;YACzB,MAAM,CAAC;gBACL,MAAM,EAAE,IAAI,IAAI,CAAC;gBACjB,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC;gBAC9C,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC;gBAC9C,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAClC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,OAAmB,EACnB,UAAkC,EAAE;IAEpC,MAAM,aAAa,GAAG,mBAAmB,CAAC,OAAO,CAAC,CAAC;IACnD,IAAI,CAAC,aAAa;QAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC;IAE3E,MAAM,MAAM,GAAG,OAAO,CAAC,UAAU,IAAI,gBAAgB,CAAC;IACtD,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,OAAO,EAAE,aAAa,CAAC,IAAI,EAAE;QACrE,SAAS,EAAE,OAAO,CAAC,SAAS,IAAI,MAAM;KACvC,CAAC,CAAC;IACH,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,OAAO;YACL,OAAO,EAAE,IAAI;YACb,OAAO,EAAE,CAAC,aAAa,CAAC,OAAO,EAAE,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;SAClE,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,gBAAgB,CAAC,OAAO,EAAE,aAAa,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;AACzE,CAAC"}

package/dist/auth-tools.d.ts

@@ -0,0 +1,55 @@
+/**
+ * Auxiliary tool-CLI auth bundling. Beyond the session's primary CLI
+ * (claude/codex), a deported session usually needs other authenticated CLIs
+ * (scw, gh, aws, gcloud, az). This registry maps each known tool to its
+ * HOME-relative auth/config files; the CLI can detect which are authenticated
+ * locally (to propose them) and bundle the selected ones into the remote
+ * session's Secret so they work in the Pod.
+ *
+ * These are sensitive (cloud secret keys, tokens) — bundling is always opt-in
+ * (the user picks which tools), never automatic.
+ */
+export declare const KNOWN_TOOLS: string[];
+/** Flattened {relpath, tool, broad} for every tool auth file — for secret audits. */
+export declare const TOOL_AUTH_INFO: ReadonlyArray<{
+    relpath: string;
+    tool: string;
+    broad: boolean;
+}>;
+export type ToolAuthStatus = {
+    readonly tool: string;
+    readonly present: boolean;
+    readonly loginHint: string;
+};
+/** Report which known tools are authenticated locally (primary file exists). */
+export declare function detectToolAuth(home?: string): ToolAuthStatus[];
+/**
+ * Does the LOCAL machine actually HAVE creds to push for `tool`? True only when
+ * at least one of the tool's HOME-relative files exists AND is non-empty (a
+ * zero-byte `~/.npmrc` or `~/.docker/config.json` carries no auth). For `gh` we
+ * also accept a token resolvable via `gh auth token` (the keyring case), since
+ * `collectToolAuth` regenerates a file-based hosts.yml from it.
+ *
+ * The slice-2 pod-side 401 probe→push uses this as a GUARD: when the local side
+ * has nothing to give for a tool, pushing is pointless (the Pod's probe stays
+ * 401 → infinite useless push), so the probe is skipped ENTIRELY for that tool
+ * — no probe, no push, no log. An unknown tool is "no local creds". PURE-ish
+ * (only stats files / runs `gh auth token`); exported for tests via `home`.
+ */
+export declare function localCredsExistFor(tool: string, home?: string): boolean;
+/** Validate a requested tool list, returning {known, unknown}. */
+export declare function partitionTools(requested: ReadonlyArray<string>): {
+    known: string[];
+    unknown: string[];
+};
+/**
+ * Collect the HOME-relative auth files for the given tools, base64-encoded, as a
+ * credentials bundle (same shape as the profile auth bundle). Missing files are
+ * skipped silently. Returns the bundle plus the list of tools that actually
+ * contributed at least one file.
+ */
+export declare function collectToolAuth(tools: ReadonlyArray<string>, home?: string): Promise<{
+    bundle: Record<string, string>;
+    bundled: string[];
+}>;
+//# sourceMappingURL=auth-tools.d.ts.map

package/dist/auth-tools.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-tools.d.ts","sourceRoot":"","sources":["../src/auth-tools.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AA4CH,eAAO,MAAM,WAAW,UAAyB,CAAC;AAKlD,qFAAqF;AACrF,eAAO,MAAM,cAAc,EAAE,aAAa,CAAC;IACzC,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,OAAO,CAAC;CAChB,CAEA,CAAC;AAEF,MAAM,MAAM,cAAc,GAAG;IAC3B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B,CAAC;AAEF,gFAAgF;AAChF,wBAAgB,cAAc,CAAC,IAAI,GAAE,MAAkB,GAAG,cAAc,EAAE,CAMzE;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,kBAAkB,CAChC,IAAI,EAAE,MAAM,EACZ,IAAI,GAAE,MAAkB,GACvB,OAAO,CAkBT;AAED,kEAAkE;AAClE,wBAAgB,cAAc,CAAC,SAAS,EAAE,aAAa,CAAC,MAAM,CAAC,GAAG;IAChE,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB,CAQA;AAED;;;;;GAKG;AACH,wBAAsB,eAAe,CACnC,KAAK,EAAE,aAAa,CAAC,MAAM,CAAC,EAC5B,IAAI,GAAE,MAAkB,GACvB,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAAC,OAAO,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC,CA8BhE"}

package/dist/auth-tools.js

@@ -0,0 +1,163 @@
+/**
+ * Auxiliary tool-CLI auth bundling. Beyond the session's primary CLI
+ * (claude/codex), a deported session usually needs other authenticated CLIs
+ * (scw, gh, aws, gcloud, az). This registry maps each known tool to its
+ * HOME-relative auth/config files; the CLI can detect which are authenticated
+ * locally (to propose them) and bundle the selected ones into the remote
+ * session's Secret so they work in the Pod.
+ *
+ * These are sensitive (cloud secret keys, tokens) — bundling is always opt-in
+ * (the user picks which tools), never automatic.
+ */
+import { readFile } from "node:fs/promises";
+import { existsSync, statSync } from "node:fs";
+import { spawnSync } from "node:child_process";
+import { homedir } from "node:os";
+import { join } from "node:path";
+/**
+ * `present` is decided by the FIRST file (the primary credential); the rest are
+ * companion config files bundled alongside when present.
+ */
+const TOOL_AUTH = {
+    scw: { files: [".config/scw/config.yaml"], loginHint: "scw init" },
+    gh: { files: [".config/gh/hosts.yml"], loginHint: "gh auth login" },
+    aws: { files: [".aws/credentials", ".aws/config"], loginHint: "aws configure" },
+    gcloud: {
+        files: [
+            ".config/gcloud/application_default_credentials.json",
+            ".config/gcloud/active_config",
+            ".config/gcloud/credentials.db",
+            ".config/gcloud/access_tokens.db",
+        ],
+        loginHint: "gcloud auth login && gcloud auth application-default login",
+    },
+    azure: {
+        files: [".azure/azureProfile.json", ".azure/msal_token_cache.json"],
+        loginHint: "az login",
+    },
+    // Slice 2 COVERAGE: ride the same opt-in bundling. npm's per-registry
+    // `_authToken` lives in ~/.npmrc; docker's per-registry `auth` lives in
+    // ~/.docker/config.json. Same ToolSpec shape (present = first file exists),
+    // no behavior change to how bundling works.
+    npm: { files: [".npmrc"], loginHint: "npm login" },
+    docker: { files: [".docker/config.json"], loginHint: "docker login" },
+};
+export const KNOWN_TOOLS = Object.keys(TOOL_AUTH);
+/** Tools carrying long-lived, account-wide cloud credentials (flagged in audits). */
+const BROAD_TOOLS = new Set(["aws", "gcloud", "azure"]);
+/** Flattened {relpath, tool, broad} for every tool auth file — for secret audits. */
+export const TOOL_AUTH_INFO = Object.entries(TOOL_AUTH).flatMap(([tool, spec]) => spec.files.map((relpath) => ({ relpath, tool, broad: BROAD_TOOLS.has(tool) })));
+/** Report which known tools are authenticated locally (primary file exists). */
+export function detectToolAuth(home = homedir()) {
+    return KNOWN_TOOLS.map((tool) => {
+        const spec = TOOL_AUTH[tool];
+        const present = existsSync(join(home, spec.files[0]));
+        return { tool, present, loginHint: spec.loginHint };
+    });
+}
+/**
+ * Does the LOCAL machine actually HAVE creds to push for `tool`? True only when
+ * at least one of the tool's HOME-relative files exists AND is non-empty (a
+ * zero-byte `~/.npmrc` or `~/.docker/config.json` carries no auth). For `gh` we
+ * also accept a token resolvable via `gh auth token` (the keyring case), since
+ * `collectToolAuth` regenerates a file-based hosts.yml from it.
+ *
+ * The slice-2 pod-side 401 probe→push uses this as a GUARD: when the local side
+ * has nothing to give for a tool, pushing is pointless (the Pod's probe stays
+ * 401 → infinite useless push), so the probe is skipped ENTIRELY for that tool
+ * — no probe, no push, no log. An unknown tool is "no local creds". PURE-ish
+ * (only stats files / runs `gh auth token`); exported for tests via `home`.
+ */
+export function localCredsExistFor(tool, home = homedir()) {
+    const spec = TOOL_AUTH[tool];
+    if (!spec)
+        return false;
+    for (const rel of spec.files) {
+        try {
+            if (statSync(join(home, rel)).size > 0)
+                return true;
+        }
+        catch {
+            // missing/unreadable → not a usable local cred
+        }
+    }
+    // gh may keep its token in the OS keyring rather than a file; collectToolAuth
+    // regenerates hosts.yml from `gh auth token`, so a resolvable token counts.
+    if (tool === "gh") {
+        const token = spawnSync("gh", ["auth", "token"], { encoding: "utf8" })
+            .stdout?.trim();
+        if (token)
+            return true;
+    }
+    return false;
+}
+/** Validate a requested tool list, returning {known, unknown}. */
+export function partitionTools(requested) {
+    const known = [];
+    const unknown = [];
+    for (const t of requested) {
+        if (t in TOOL_AUTH)
+            known.push(t);
+        else
+            unknown.push(t);
+    }
+    return { known, unknown };
+}
+/**
+ * Collect the HOME-relative auth files for the given tools, base64-encoded, as a
+ * credentials bundle (same shape as the profile auth bundle). Missing files are
+ * skipped silently. Returns the bundle plus the list of tools that actually
+ * contributed at least one file.
+ */
+export async function collectToolAuth(tools, home = homedir()) {
+    const bundle = {};
+    const bundled = [];
+    for (const tool of tools) {
+        const spec = TOOL_AUTH[tool];
+        if (!spec)
+            continue;
+        let contributed = false;
+        for (const rel of spec.files) {
+            try {
+                const data = await readFile(join(home, rel));
+                bundle[rel] = Buffer.from(data).toString("base64");
+                contributed = true;
+            }
+            catch {
+                // missing/unreadable file → skip
+            }
+        }
+        // gh stores its token in the OS keyring (not hosts.yml) when login used
+        // secure storage, so the bundled hosts.yml has no `oauth_token` and the Pod
+        // can't auth (no keyring/dbus). Regenerate a file-based hosts.yml carrying
+        // the token from `gh auth token` so the Pod authenticates without a keyring.
+        if (tool === "gh") {
+            const ghHosts = buildGhHostsYaml();
+            if (ghHosts) {
+                bundle[".config/gh/hosts.yml"] = Buffer.from(ghHosts, "utf8").toString("base64");
+                contributed = true;
+            }
+        }
+        if (contributed)
+            bundled.push(tool);
+    }
+    return { bundle, bundled };
+}
+/**
+ * Build a self-contained `~/.config/gh/hosts.yml` with the token resolved via
+ * `gh auth token` (works regardless of keyring vs file storage), so the Pod's
+ * gh is authenticated from the file alone — no OS keyring / dbus needed.
+ */
+function buildGhHostsYaml() {
+    const token = spawnSync("gh", ["auth", "token"], { encoding: "utf8" })
+        .stdout?.trim();
+    if (!token)
+        return undefined;
+    const user = spawnSync("gh", ["api", "user", "--jq", ".login"], { encoding: "utf8" })
+        .stdout?.trim() || "";
+    return (`github.com:\n` +
+        `    oauth_token: ${token}\n` +
+        `    git_protocol: https\n` +
+        (user ? `    user: ${user}\n` : ""));
+}
+//# sourceMappingURL=auth-tools.js.map

package/dist/auth-tools.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-tools.js","sourceRoot":"","sources":["../src/auth-tools.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAC/C,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAC/C,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AASjC;;;GAGG;AACH,MAAM,SAAS,GAAuC;IACpD,GAAG,EAAE,EAAE,KAAK,EAAE,CAAC,yBAAyB,CAAC,EAAE,SAAS,EAAE,UAAU,EAAE;IAClE,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,sBAAsB,CAAC,EAAE,SAAS,EAAE,eAAe,EAAE;IACnE,GAAG,EAAE,EAAE,KAAK,EAAE,CAAC,kBAAkB,EAAE,aAAa,CAAC,EAAE,SAAS,EAAE,eAAe,EAAE;IAC/E,MAAM,EAAE;QACN,KAAK,EAAE;YACL,qDAAqD;YACrD,8BAA8B;YAC9B,+BAA+B;YAC/B,iCAAiC;SAClC;QACD,SAAS,EAAE,4DAA4D;KACxE;IACD,KAAK,EAAE;QACL,KAAK,EAAE,CAAC,0BAA0B,EAAE,8BAA8B,CAAC;QACnE,SAAS,EAAE,UAAU;KACtB;IACD,sEAAsE;IACtE,wEAAwE;IACxE,4EAA4E;IAC5E,4CAA4C;IAC5C,GAAG,EAAE,EAAE,KAAK,EAAE,CAAC,QAAQ,CAAC,EAAE,SAAS,EAAE,WAAW,EAAE;IAClD,MAAM,EAAE,EAAE,KAAK,EAAE,CAAC,qBAAqB,CAAC,EAAE,SAAS,EAAE,cAAc,EAAE;CACtE,CAAC;AAEF,MAAM,CAAC,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;AAElD,qFAAqF;AACrF,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC;AAExD,qFAAqF;AACrF,MAAM,CAAC,MAAM,cAAc,GAItB,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,EAAE,CACtD,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAC/E,CAAC;AAQF,gFAAgF;AAChF,MAAM,UAAU,cAAc,CAAC,OAAe,OAAO,EAAE;IACrD,OAAO,WAAW,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;QAC9B,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,CAAE,CAAC;QAC9B,MAAM,OAAO,GAAG,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,CAAC,CAAC;QACvD,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC;IACtD,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,kBAAkB,CAChC,IAAY,EACZ,OAAe,OAAO,EAAE;IAExB,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;IAC7B,IAAI,CAAC,IAAI;QAAE,OAAO,KAAK,CAAC;IACxB,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;QAC7B,IAAI,CAAC;YACH,IAAI,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC;gBAAE,OAAO,IAAI,CAAC;QACtD,CAAC;QAAC,MAAM,CAAC;YACP,+CAA+C;QACjD,CAAC;IACH,CAAC;IACD,8EAA8E;IAC9E,4EAA4E;IAC5E,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;QAClB,MAAM,KAAK,GAAG,SAAS,CAAC,IAAI,EAAE,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;aACnE,MAAM,EAAE,IAAI,EAAE,CAAC;QAClB,IAAI,KAAK;YAAE,OAAO,IAAI,CAAC;IACzB,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,kEAAkE;AAClE,MAAM,UAAU,cAAc,CAAC,SAAgC;IAI7D,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,KAAK,MAAM,CAAC,IAAI,SAAS,EAAE,CAAC;QAC1B,IAAI,CAAC,IAAI,SAAS;YAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;;YAC7B,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACvB,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;AAC5B,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,KAA4B,EAC5B,OAAe,OAAO,EAAE;IAExB,MAAM,MAAM,GAA2B,EAAE,CAAC;IAC1C,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;QAC7B,IAAI,CAAC,IAAI;YAAE,SAAS;QACpB,IAAI,WAAW,GAAG,KAAK,CAAC;QACxB,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YAC7B,IAAI,CAAC;gBACH,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC;gBAC7C,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;gBACnD,WAAW,GAAG,IAAI,CAAC;YACrB,CAAC;YAAC,MAAM,CAAC;gBACP,iCAAiC;YACnC,CAAC;QACH,CAAC;QACD,wEAAwE;QACxE,4EAA4E;QAC5E,2EAA2E;QAC3E,6EAA6E;QAC7E,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;YAClB,MAAM,OAAO,GAAG,gBAAgB,EAAE,CAAC;YACnC,IAAI,OAAO,EAAE,CAAC;gBACZ,MAAM,CAAC,sBAAsB,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;gBACjF,WAAW,GAAG,IAAI,CAAC;YACrB,CAAC;QACH,CAAC;QACD,IAAI,WAAW;YAAE,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACtC,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;AAC7B,CAAC;AAED;;;;GAIG;AACH,SAAS,gBAAgB;IACvB,MAAM,KAAK,GAAG,SAAS,CAAC,IAAI,EAAE,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;SACnE,MAAM,EAAE,IAAI,EAAE,CAAC;IAClB,IAAI,CAAC,KAAK;QAAE,OAAO,SAAS,CAAC;IAC7B,MAAM,IAAI,GACR,SAAS,CAAC,IAAI,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;SACrE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IAC1B,OAAO,CACL,eAAe;QACf,oBAAoB,KAAK,IAAI;QAC7B,2BAA2B;QAC3B,CAAC,IAAI,CAAC,CAAC,CAAC,aAAa,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CACpC,CAAC;AACJ,CAAC"}

package/dist/browser-bridge-local.d.ts

@@ -0,0 +1,27 @@
+import type { UatExposurePolicy } from "./protocol-local.js";
+export declare const NOVNC_POD_PORT = 6080;
+export type ExposureRequester = "operator" | "session-owner" | "anonymous";
+export type ExposureDecision = {
+    readonly allowed: true;
+} | {
+    readonly allowed: false;
+    readonly reason: string;
+};
+export type ExposureRequest = {
+    readonly policy: UatExposurePolicy;
+    readonly requester: ExposureRequester;
+    readonly hasToken: boolean;
+    readonly expiresInMs?: number;
+};
+export type RandomBytes = (length: number) => Uint8Array;
+export declare function evaluateExposure(req: ExposureRequest): ExposureDecision;
+export declare function buildForwardCommand(sessionId: string, localPort?: number): string;
+export declare function buildNoVncUrl(opts: {
+    readonly localPort?: number;
+    readonly token: string;
+    readonly interactive?: boolean;
+    readonly autoconnect?: boolean;
+    readonly host?: string;
+}): string;
+export declare function mintNoVncToken(rng?: RandomBytes): string;
+//# sourceMappingURL=browser-bridge-local.d.ts.map

package/dist/browser-bridge-local.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"browser-bridge-local.d.ts","sourceRoot":"","sources":["../src/browser-bridge-local.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAE7D,eAAO,MAAM,cAAc,OAAO,CAAC;AAEnC,MAAM,MAAM,iBAAiB,GAAG,UAAU,GAAG,eAAe,GAAG,WAAW,CAAC;AAC3E,MAAM,MAAM,gBAAgB,GAAG;IAAE,QAAQ,CAAC,OAAO,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,QAAQ,CAAC,OAAO,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AACjH,MAAM,MAAM,eAAe,GAAG;IAC5B,QAAQ,CAAC,MAAM,EAAE,iBAAiB,CAAC;IACnC,QAAQ,CAAC,SAAS,EAAE,iBAAiB,CAAC;IACtC,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;IAC3B,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;CAC/B,CAAC;AACF,MAAM,MAAM,WAAW,GAAG,CAAC,MAAM,EAAE,MAAM,KAAK,UAAU,CAAC;AAEzD,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,eAAe,GAAG,gBAAgB,CAuBvE;AAED,wBAAgB,mBAAmB,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,MAAM,CAGjF;AAED,wBAAgB,aAAa,CAAC,IAAI,EAAE;IAAE,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,MAAM,CAU3L;AAQD,wBAAgB,cAAc,CAAC,GAAG,GAAE,WAAgC,GAAG,MAAM,CAE5E"}