@vibesdotdev/hq 0.0.0-stage → 1.0.0-rc.2

package/dist/app/auth/service.consumer.js

@@ -0,0 +1,79 @@
+import { constantTimeEqualBytes } from '@vibesdotdev/security';
+import { DEFAULT_OS_APP_CAPABILITIES } from "./types.js";
+import { listAppTokensFromRecord, getTokenByIdFromRecord, createTokenRecord, revokeTokenRecord, listPairingsFromRecord, createOrUpdatePairingRecord, ensureMachineProfile } from "./sync.consumer.js";
+import { CreateAppTokenInputSchema, CreatePairingInputSchema } from "./schemas/auth.js";
+function nowIso() {
+    return new Date().toISOString();
+}
+async function hashToken(secret) {
+    const digest = await crypto.subtle.digest('SHA-256', new TextEncoder().encode(secret));
+    return new Uint8Array(digest).toHex();
+}
+function tokenSecret() {
+    return `vbt_${crypto.getRandomValues(new Uint8Array(24)).toHex()}`;
+}
+function safeEqualHex(leftHex, rightHex) {
+    const left = Uint8Array.fromHex(leftHex);
+    const right = Uint8Array.fromHex(rightHex);
+    return constantTimeEqualBytes(left, right);
+}
+export async function createAppToken(runtime, input) {
+    input = CreateAppTokenInputSchema.parse(input);
+    const createdAt = nowIso();
+    const secret = tokenSecret();
+    const record = {
+        id: `token_${crypto.randomUUID()}`,
+        appId: input.appId,
+        tokenHash: await hashToken(secret),
+        tokenPreview: secret.slice(0, 12),
+        capabilities: input.capabilities?.length ? input.capabilities : DEFAULT_OS_APP_CAPABILITIES,
+        description: input.description,
+        expiresAt: input.expiresInDays
+            ? new Date(Date.now() + input.expiresInDays * 86400000).toISOString()
+            : undefined,
+        createdAt,
+        updatedAt: createdAt,
+        syncEnabled: input.syncEnabled ?? false,
+        source: 'local'
+    };
+    await createTokenRecord(runtime, record);
+    return { record, secret };
+}
+export async function listAppTokens(runtime, includeRevoked = false) {
+    return listAppTokensFromRecord(runtime, includeRevoked);
+}
+export async function revokeAppToken(runtime, tokenId) {
+    return revokeTokenRecord(runtime, tokenId);
+}
+export async function resolveTokenId(runtime, input) {
+    if (input.tokenId) {
+        const token = await getTokenByIdFromRecord(runtime, input.tokenId);
+        if (token && !token.revokedAt) {
+            return token.id;
+        }
+        return null;
+    }
+    if (!input.tokenSecret)
+        return null;
+    const secretHash = await hashToken(input.tokenSecret);
+    const tokens = await listAppTokensFromRecord(runtime, false);
+    for (const token of tokens) {
+        if (safeEqualHex(token.tokenHash, secretHash)) {
+            return token.id;
+        }
+    }
+    return null;
+}
+export async function getTokenById(runtime, tokenId) {
+    return getTokenByIdFromRecord(runtime, tokenId);
+}
+export async function getLocalMachineProfile(runtime) {
+    return ensureMachineProfile(runtime);
+}
+export async function createOrUpdatePairing(runtime, input) {
+    return createOrUpdatePairingRecord(runtime, CreatePairingInputSchema.parse(input));
+}
+export async function listAppPairings(runtime, appId) {
+    return listPairingsFromRecord(runtime, appId);
+}
+//# sourceMappingURL=service.consumer.js.map

package/dist/app/auth/service.consumer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"service.consumer.js","sourceRoot":"","sources":["../../../src/app/auth/service.consumer.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,sBAAsB,EAAE,MAAM,uBAAuB,CAAC;AAC/D,OAAO,EAKN,2BAA2B,EAC3B,MAAM,YAAY,CAAC;AACpB,OAAO,EACN,uBAAuB,EACvB,sBAAsB,EACtB,iBAAiB,EACjB,iBAAiB,EACjB,sBAAsB,EACtB,2BAA2B,EAC3B,oBAAoB,EAEpB,MAAM,oBAAoB,CAAC;AAI5B,OAAO,EAAE,yBAAyB,EAAE,wBAAwB,EAAuD,MAAM,mBAAmB,CAAC;AAG7I,SAAS,MAAM;IACd,OAAO,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;AACjC,CAAC;AAED,KAAK,UAAU,SAAS,CAAC,MAAc;IACtC,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;IACvF,OAAO,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,CAAC;AACvC,CAAC;AAED,SAAS,WAAW;IACnB,OAAO,OAAO,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC;AACpE,CAAC;AAED,SAAS,YAAY,CAAC,OAAe,EAAE,QAAgB;IACtD,MAAM,IAAI,GAAG,UAAU,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IACzC,MAAM,KAAK,GAAG,UAAU,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC3C,OAAO,sBAAsB,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;AAC5C,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CACnC,OAAsB,EACtB,KAA0B;IAE1B,KAAK,GAAG,yBAAyB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAC/C,MAAM,SAAS,GAAG,MAAM,EAAE,CAAC;IAC3B,MAAM,MAAM,GAAG,WAAW,EAAE,CAAC;IAC7B,MAAM,MAAM,GAAqB;QAChC,EAAE,EAAE,SAAS,MAAM,CAAC,UAAU,EAAE,EAAE;QAClC,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,SAAS,EAAE,MAAM,SAAS,CAAC,MAAM,CAAC;QAClC,YAAY,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC;QACjC,YAAY,EAAE,KAAK,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC,2BAA2B;QAC3F,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,SAAS,EAAE,KAAK,CAAC,aAAa;YAC7B,CAAC,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,aAAa,GAAG,QAAQ,CAAC,CAAC,WAAW,EAAE;YACrE,CAAC,CAAC,SAAS;QACZ,SAAS;QACT,SAAS,EAAE,SAAS;QACpB,WAAW,EAAE,KAAK,CAAC,WAAW,IAAI,KAAK;QACvC,MAAM,EAAE,OAAO;KACf,CAAC;IAEF,MAAM,iBAAiB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAEzC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;AAC3B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,OAAsB,EAAE,cAAc,GAAG,KAAK;IACjF,OAAO,uBAAuB,CAAC,OAAO,EAAE,cAAc,CAAC,CAAC;AACzD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,OAAsB,EAAE,OAAe;IAC3E,OAAO,iBAAiB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;AAC5C,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,OAAsB,EAAE,KAG5D;IACA,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;QACnB,MAAM,KAAK,GAAG,MAAM,sBAAsB,CAAC,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;QACnE,IAAI,KAAK,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC;YAC/B,OAAO,KAAK,CAAC,EAAE,CAAC;QACjB,CAAC;QACD,OAAO,IAAI,CAAC;IACb,CAAC;IAED,IAAI,CAAC,KAAK,CAAC,WAAW;QAAE,OAAO,IAAI,CAAC;IAEpC,MAAM,UAAU,GAAG,MAAM,SAAS,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;IACtD,MAAM,MAAM,GAAG,MAAM,uBAAuB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IAC7D,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC5B,IAAI,YAAY,CAAC,KAAK,CAAC,SAAS,EAAE,UAAU,CAAC,EAAE,CAAC;YAC/C,OAAO,KAAK,CAAC,EAAE,CAAC;QACjB,CAAC;IACF,CAAC;IACD,OAAO,IAAI,CAAC;AACb,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,OAAsB,EAAE,OAAe;IACzE,OAAO,sBAAsB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;AACjD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,OAAsB;IAClE,OAAO,oBAAoB,CAAC,OAAO,CAAC,CAAC;AACtC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAC1C,OAAsB,EACtB,KAAyB;IAEzB,OAAO,2BAA2B,CAAC,OAAO,EAAE,wBAAwB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;AACpF,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,OAAsB,EAAE,KAAc;IAC3E,OAAO,sBAAsB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;AAC/C,CAAC"}

package/dist/app/auth/sync.consumer.d.ts

@@ -0,0 +1,2 @@
+export * from './sync.ts';
+//# sourceMappingURL=sync.consumer.d.ts.map

package/dist/app/auth/sync.consumer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sync.consumer.d.ts","sourceRoot":"","sources":["../../../src/app/auth/sync.consumer.ts"],"names":[],"mappings":"AAAA,cAAc,WAAW,CAAC"}

package/dist/app/auth/sync.consumer.js

@@ -0,0 +1,2 @@
+export * from "./sync.js";
+//# sourceMappingURL=sync.consumer.js.map

package/dist/app/auth/sync.consumer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sync.consumer.js","sourceRoot":"","sources":["../../../src/app/auth/sync.consumer.ts"],"names":[],"mappings":"AAAA,cAAc,WAAW,CAAC"}

package/dist/app/auth/sync.d.ts

@@ -0,0 +1,23 @@
+import { type VibesRuntime } from '@vibesdotdev/kernel';
+import type { OsAppPairingRecord, OsAppSyncRecord, OsAppTokenRecord, OsLocalMachineProfile } from './types.ts';
+export declare function createDefaultMachineProfile(runtime: HqAuthRuntime): OsLocalMachineProfile;
+/** The runtime whose `os.app-auth-*` storage records hold app auth state. */
+export type HqAuthRuntime = Pick<VibesRuntime, 'query' | 'localEnvironment'>;
+export declare function collectOsAppAuthSyncRecords(runtime: HqAuthRuntime): Promise<OsAppSyncRecord[]>;
+export declare function mergePulledOsAppAuthSyncRecords(runtime: HqAuthRuntime, records: OsAppSyncRecord[]): Promise<void>;
+export declare function ensureMachineProfile(runtime: HqAuthRuntime): Promise<OsLocalMachineProfile>;
+export declare function listAppTokensFromRecord(runtime: HqAuthRuntime, includeRevoked?: boolean): Promise<OsAppTokenRecord[]>;
+export declare function getTokenByIdFromRecord(runtime: HqAuthRuntime, tokenId: string): Promise<OsAppTokenRecord | null>;
+export declare function createTokenRecord(runtime: HqAuthRuntime, token: OsAppTokenRecord): Promise<void>;
+export declare function revokeTokenRecord(runtime: HqAuthRuntime, tokenId: string): Promise<OsAppTokenRecord | null>;
+export declare function listPairingsFromRecord(runtime: HqAuthRuntime, appId?: string): Promise<OsAppPairingRecord[]>;
+export declare function createOrUpdatePairingRecord(runtime: HqAuthRuntime, input: {
+    appId: string;
+    tokenId: string;
+    machineId: string;
+    machineName: string;
+    hardware: 'consumer' | 'bridge' | 'desktop' | 'mobile' | 'cloud';
+    trustLevel: 'same-user' | 'paired-machine';
+    metadata?: Record<string, string>;
+}): Promise<OsAppPairingRecord>;
+//# sourceMappingURL=sync.d.ts.map

package/dist/app/auth/sync.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sync.d.ts","sourceRoot":"","sources":["../../../src/app/auth/sync.ts"],"names":[],"mappings":"AAEA,OAAO,EAAmB,KAAK,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACzE,OAAO,KAAK,EAAE,kBAAkB,EAAE,eAAe,EAAE,gBAAgB,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAC;AAI/G,wBAAgB,2BAA2B,CAAC,OAAO,EAAE,aAAa,GAAG,qBAAqB,CAQzF;AAQD,6EAA6E;AAC7E,MAAM,MAAM,aAAa,GAAG,IAAI,CAAC,YAAY,EAAE,OAAO,GAAG,kBAAkB,CAAC,CAAC;AA2D7E,wBAAsB,2BAA2B,CAAC,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,eAAe,EAAE,CAAC,CAkCpG;AAmCD,wBAAsB,+BAA+B,CACpD,OAAO,EAAE,aAAa,EACtB,OAAO,EAAE,eAAe,EAAE,GACxB,OAAO,CAAC,IAAI,CAAC,CAoDf;AAED,wBAAsB,oBAAoB,CAAC,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,qBAAqB,CAAC,CAgBjG;AAED,wBAAsB,uBAAuB,CAC5C,OAAO,EAAE,aAAa,EACtB,cAAc,UAAQ,GACpB,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAY7B;AAED,wBAAsB,sBAAsB,CAC3C,OAAO,EAAE,aAAa,EACtB,OAAO,EAAE,MAAM,GACb,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAMlC;AAED,wBAAsB,iBAAiB,CAAC,OAAO,EAAE,aAAa,EAAE,KAAK,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC,CAiBtG;AAED,wBAAsB,iBAAiB,CACtC,OAAO,EAAE,aAAa,EACtB,OAAO,EAAE,MAAM,GACb,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAYlC;AAED,wBAAsB,sBAAsB,CAC3C,OAAO,EAAE,aAAa,EACtB,KAAK,CAAC,EAAE,MAAM,GACZ,OAAO,CAAC,kBAAkB,EAAE,CAAC,CAY/B;AAED,wBAAsB,2BAA2B,CAAC,OAAO,EAAE,aAAa,EAAE,KAAK,EAAE;IAChF,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,UAAU,GAAG,QAAQ,GAAG,SAAS,GAAG,QAAQ,GAAG,OAAO,CAAC;IACjE,UAAU,EAAE,WAAW,GAAG,gBAAgB,CAAC;IAC3C,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAClC,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAkD9B"}

package/dist/app/auth/sync.js

@@ -0,0 +1,290 @@
+import * as z from 'zod/v4';
+import { OsAppTokenRecordSchema, OsAppPairingRecordSchema, OsAppSyncRecordSchema, PairingMetadataSchema } from "./schemas/auth.js";
+import { CapabilityError } from '@vibesdotdev/kernel';
+export function createDefaultMachineProfile(runtime) {
+    const host = runtime.localEnvironment.getHostname?.();
+    if (!host)
+        throw new CapabilityError('This host declares no machine name.', 'UNAVAILABLE', { reason: 'host-name-unavailable' });
+    return {
+        id: `machine_${crypto.randomUUID()}`,
+        name: host,
+        host
+    };
+}
+function sortedByUpdated(items) {
+    return [...items].sort((a, b) => b.updatedAt.localeCompare(a.updatedAt));
+}
+/**
+ * The enabled `storage/record` `recordId` on `runtime`, or null when the host
+ * composes none (the one confirmed absence). A record that fails to load
+ * propagates.
+ */
+async function authRecord(runtime, recordId) {
+    const query = runtime
+        .query('storage/record')
+        .withId(recordId)
+        .enabled();
+    if (query.descriptors().length === 0)
+        return null;
+    return query.resolve();
+}
+const getTokensInterface = (runtime) => authRecord(runtime, 'os.app-auth-tokens');
+const getPairingsInterface = (runtime) => authRecord(runtime, 'os.app-auth-pairings');
+const getMachineInterface = (runtime) => authRecord(runtime, 'os.app-auth-machine');
+function payloadFromToken(token) {
+    return {
+        appId: token.appId,
+        tokenHash: token.tokenHash,
+        tokenPreview: token.tokenPreview,
+        capabilities: token.capabilities,
+        description: token.description ?? null,
+        expiresAt: token.expiresAt ?? null,
+        createdAt: token.createdAt,
+        updatedAt: token.updatedAt,
+        lastUsedAt: token.lastUsedAt ?? null,
+        revokedAt: token.revokedAt ?? null,
+        syncEnabled: token.syncEnabled,
+        source: token.source
+    };
+}
+function payloadFromPairing(pairing) {
+    return {
+        appId: pairing.appId,
+        tokenId: pairing.tokenId,
+        machineId: pairing.machineId,
+        machineName: pairing.machineName,
+        hardware: pairing.hardware,
+        trustLevel: pairing.trustLevel,
+        metadata: JSON.stringify(pairing.metadata),
+        createdAt: pairing.createdAt,
+        updatedAt: pairing.updatedAt,
+        revokedAt: pairing.revokedAt ?? null,
+        source: pairing.source
+    };
+}
+export async function collectOsAppAuthSyncRecords(runtime) {
+    const tokensInterface = await getTokensInterface(runtime);
+    const pairingsInterface = await getPairingsInterface(runtime);
+    const tokens = [];
+    const pairings = [];
+    if (tokensInterface) {
+        await tokensInterface.initialize();
+        const result = await tokensInterface.list({ includeDeleted: true });
+        for (const token of result.items) {
+            tokens.push({
+                id: token.id,
+                recordType: 'token',
+                updatedAt: token.updatedAt,
+                payload: payloadFromToken(token)
+            });
+        }
+    }
+    if (pairingsInterface) {
+        await pairingsInterface.initialize();
+        const result = await pairingsInterface.list({ includeDeleted: true });
+        for (const pairing of result.items) {
+            pairings.push({
+                id: pairing.id,
+                recordType: 'pairing',
+                updatedAt: pairing.updatedAt,
+                payload: payloadFromPairing(pairing)
+            });
+        }
+    }
+    return [...tokens, ...pairings];
+}
+function toToken(record) {
+    return OsAppTokenRecordSchema.parse({
+        ...Object.fromEntries(Object.entries(record.payload).filter(([, value]) => value !== null)),
+        id: record.id,
+        createdAt: record.payload.createdAt ?? record.updatedAt,
+        updatedAt: record.payload.updatedAt ?? record.updatedAt,
+        source: 'synced'
+    });
+}
+function toPairing(record) {
+    const metadata = z.string().default('{}').parse(record.payload.metadata);
+    let parsedMetadata;
+    try {
+        parsedMetadata = PairingMetadataSchema.parse(JSON.parse(metadata));
+    }
+    catch (cause) {
+        throw new CapabilityError('Pulled pairing metadata is unreadable.', 'INVALID_INPUT', {
+            reason: 'data-corrupt', retryable: false, details: { recordId: record.id }, cause
+        });
+    }
+    return OsAppPairingRecordSchema.parse({
+        ...Object.fromEntries(Object.entries(record.payload).filter(([, value]) => value !== null)),
+        id: record.id,
+        machineName: record.payload.machineName ?? record.payload.machineId,
+        hardware: record.payload.hardware ?? 'consumer',
+        trustLevel: record.payload.trustLevel ?? 'paired-machine',
+        metadata: parsedMetadata,
+        createdAt: record.payload.createdAt ?? record.updatedAt,
+        updatedAt: record.payload.updatedAt ?? record.updatedAt,
+        source: 'synced'
+    });
+}
+export async function mergePulledOsAppAuthSyncRecords(runtime, records) {
+    const tokensInterface = await getTokensInterface(runtime);
+    const pairingsInterface = await getPairingsInterface(runtime);
+    if (!tokensInterface || !pairingsInterface) {
+        return;
+    }
+    await tokensInterface.initialize();
+    await pairingsInterface.initialize();
+    const admitted = z.array(OsAppSyncRecordSchema).parse(records);
+    const incomingTokens = admitted.filter((r) => r.recordType === 'token').map(toToken);
+    const incomingPairings = admitted.filter((r) => r.recordType === 'pairing').map(toPairing);
+    const existingTokensResult = await tokensInterface.list({ includeDeleted: true });
+    const existingPairingsResult = await pairingsInterface.list({ includeDeleted: true });
+    const tokensById = new Map(existingTokensResult.items.map((t) => [t.id, t]));
+    const pairingsById = new Map(existingPairingsResult.items.map((p) => [p.id, p]));
+    for (const token of incomingTokens) {
+        const current = tokensById.get(token.id);
+        if (!current || token.updatedAt >= current.updatedAt) {
+            tokensById.set(token.id, token);
+        }
+    }
+    for (const pairing of incomingPairings) {
+        const current = pairingsById.get(pairing.id);
+        if (!current || pairing.updatedAt >= current.updatedAt) {
+            pairingsById.set(pairing.id, pairing);
+        }
+    }
+    for (const token of tokensById.values()) {
+        const exists = await tokensInterface.exists(token.id);
+        if (exists) {
+            await tokensInterface.update(token.id, token);
+        }
+        else {
+            await tokensInterface.create(token);
+        }
+    }
+    for (const pairing of pairingsById.values()) {
+        const exists = await pairingsInterface.exists(pairing.id);
+        if (exists) {
+            await pairingsInterface.update(pairing.id, pairing);
+        }
+        else {
+            await pairingsInterface.create(pairing);
+        }
+    }
+}
+export async function ensureMachineProfile(runtime) {
+    const machineInterface = await getMachineInterface(runtime);
+    if (!machineInterface) {
+        return createDefaultMachineProfile(runtime);
+    }
+    await machineInterface.initialize();
+    const result = await machineInterface.list({ limit: 1 });
+    if (result.items.length > 0) {
+        return result.items[0];
+    }
+    const profile = createDefaultMachineProfile(runtime);
+    await machineInterface.create(profile);
+    return profile;
+}
+export async function listAppTokensFromRecord(runtime, includeRevoked = false) {
+    const tokensInterface = await getTokensInterface(runtime);
+    if (!tokensInterface)
+        return [];
+    await tokensInterface.initialize();
+    const result = await tokensInterface.list({ includeDeleted: true });
+    const filtered = includeRevoked
+        ? result.items
+        : result.items.filter((token) => !token.revokedAt);
+    return sortedByUpdated(filtered);
+}
+export async function getTokenByIdFromRecord(runtime, tokenId) {
+    const tokensInterface = await getTokensInterface(runtime);
+    if (!tokensInterface)
+        return null;
+    await tokensInterface.initialize();
+    return (await tokensInterface.get(tokenId)) ?? null;
+}
+export async function createTokenRecord(runtime, token) {
+    const tokensInterface = await getTokensInterface(runtime);
+    // A token that cannot be stored must not be handed out as if it were.
+    if (!tokensInterface) {
+        throw new CapabilityError('This host composes no os.app-auth-tokens record.', 'UNAVAILABLE', {
+            reason: 'app-auth-store-unavailable',
+            retryable: false
+        });
+    }
+    await tokensInterface.initialize();
+    const exists = await tokensInterface.exists(token.id);
+    if (exists) {
+        await tokensInterface.update(token.id, token);
+    }
+    else {
+        await tokensInterface.create(token);
+    }
+}
+export async function revokeTokenRecord(runtime, tokenId) {
+    const tokensInterface = await getTokensInterface(runtime);
+    if (!tokensInterface)
+        return null;
+    await tokensInterface.initialize();
+    const existing = await tokensInterface.get(tokenId);
+    if (!existing)
+        return null;
+    const now = new Date().toISOString();
+    const revoked = { ...existing, revokedAt: now, updatedAt: now };
+    await tokensInterface.update(tokenId, revoked);
+    return revoked;
+}
+export async function listPairingsFromRecord(runtime, appId) {
+    const pairingsInterface = await getPairingsInterface(runtime);
+    if (!pairingsInterface)
+        return [];
+    await pairingsInterface.initialize();
+    const result = await pairingsInterface.list({ includeDeleted: true });
+    const filtered = result.items.filter((pairing) => !pairing.revokedAt && (!appId || pairing.appId === appId));
+    return sortedByUpdated(filtered);
+}
+export async function createOrUpdatePairingRecord(runtime, input) {
+    const pairingsInterface = await getPairingsInterface(runtime);
+    if (!pairingsInterface) {
+        throw new CapabilityError('This host composes no os.app-auth-pairings record.', 'UNAVAILABLE', {
+            reason: 'app-auth-store-unavailable',
+            retryable: false
+        });
+    }
+    await pairingsInterface.initialize();
+    const now = new Date().toISOString();
+    const existingResult = await pairingsInterface.list({ includeDeleted: true });
+    const existing = existingResult.items.find((pairing) => pairing.appId === input.appId && pairing.machineId === input.machineId && !pairing.revokedAt);
+    const record = existing
+        ? {
+            ...existing,
+            tokenId: input.tokenId,
+            machineName: input.machineName,
+            hardware: input.hardware,
+            trustLevel: input.trustLevel,
+            metadata: input.metadata ?? existing.metadata,
+            updatedAt: now
+        }
+        : {
+            id: `pair_${crypto.randomUUID()}`,
+            appId: input.appId,
+            tokenId: input.tokenId,
+            machineId: input.machineId,
+            machineName: input.machineName,
+            hardware: input.hardware,
+            trustLevel: input.trustLevel,
+            metadata: input.metadata ?? {},
+            createdAt: now,
+            updatedAt: now,
+            source: 'local'
+        };
+    const exists = await pairingsInterface.exists(record.id);
+    if (exists) {
+        await pairingsInterface.update(record.id, record);
+    }
+    else {
+        await pairingsInterface.create(record);
+    }
+    return record;
+}
+//# sourceMappingURL=sync.js.map

package/dist/app/auth/sync.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sync.js","sourceRoot":"","sources":["../../../src/app/auth/sync.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAC5B,OAAO,EAAE,sBAAsB,EAAE,wBAAwB,EAAE,qBAAqB,EAAE,qBAAqB,EAAE,MAAM,mBAAmB,CAAC;AACnI,OAAO,EAAE,eAAe,EAAqB,MAAM,qBAAqB,CAAC;AAKzE,MAAM,UAAU,2BAA2B,CAAC,OAAsB;IACjE,MAAM,IAAI,GAAG,OAAO,CAAC,gBAAgB,CAAC,WAAW,EAAE,EAAE,CAAC;IACtD,IAAI,CAAC,IAAI;QAAE,MAAM,IAAI,eAAe,CAAC,qCAAqC,EAAE,aAAa,EAAE,EAAE,MAAM,EAAE,uBAAuB,EAAE,CAAC,CAAC;IAChI,OAAO;QACN,EAAE,EAAE,WAAW,MAAM,CAAC,UAAU,EAAE,EAAE;QACpC,IAAI,EAAE,IAAI;QACV,IAAI;KACJ,CAAC;AACH,CAAC;AAED,SAAS,eAAe,CAAkC,KAAU;IACnE,OAAO,CAAC,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC;AAC1E,CAAC;AAOD;;;;GAIG;AACH,KAAK,UAAU,UAAU,CAAI,OAAsB,EAAE,QAAgB;IACpE,MAAM,KAAK,GAAG,OAAO;SACnB,KAAK,CAA6C,gBAAgB,CAAC;SACnE,MAAM,CAAC,QAAQ,CAAC;SAChB,OAAO,EAAE,CAAC;IACZ,IAAI,KAAK,CAAC,WAAW,EAAE,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAClD,OAAO,KAAK,CAAC,OAAO,EAAE,CAAC;AACxB,CAAC;AAED,MAAM,kBAAkB,GAAG,CAAC,OAAsB,EAAE,EAAE,CAAC,UAAU,CAAmB,OAAO,EAAE,oBAAoB,CAAC,CAAC;AACnH,MAAM,oBAAoB,GAAG,CAAC,OAAsB,EAAE,EAAE,CACvD,UAAU,CAAqB,OAAO,EAAE,sBAAsB,CAAC,CAAC;AACjE,MAAM,mBAAmB,GAAG,CAAC,OAAsB,EAAE,EAAE,CACtD,UAAU,CAAwB,OAAO,EAAE,qBAAqB,CAAC,CAAC;AAEnE,SAAS,gBAAgB,CACxB,KAAuB;IAEvB,OAAO;QACN,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,WAAW,EAAE,KAAK,CAAC,WAAW,IAAI,IAAI;QACtC,SAAS,EAAE,KAAK,CAAC,SAAS,IAAI,IAAI;QAClC,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,UAAU,EAAE,KAAK,CAAC,UAAU,IAAI,IAAI;QACpC,SAAS,EAAE,KAAK,CAAC,SAAS,IAAI,IAAI;QAClC,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,MAAM,EAAE,KAAK,CAAC,MAAM;KACpB,CAAC;AACH,CAAC;AAED,SAAS,kBAAkB,CAC1B,OAA2B;IAE3B,OAAO;QACN,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,WAAW,EAAE,OAAO,CAAC,WAAW;QAChC,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,UAAU,EAAE,OAAO,CAAC,UAAU;QAC9B,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,QAAQ,CAAC;QAC1C,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,SAAS,EAAE,OAAO,CAAC,SAAS,IAAI,IAAI;QACpC,MAAM,EAAE,OAAO,CAAC,MAAM;KACtB,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAAC,OAAsB;IACvE,MAAM,eAAe,GAAG,MAAM,kBAAkB,CAAC,OAAO,CAAC,CAAC;IAC1D,MAAM,iBAAiB,GAAG,MAAM,oBAAoB,CAAC,OAAO,CAAC,CAAC;IAE9D,MAAM,MAAM,GAAsB,EAAE,CAAC;IACrC,MAAM,QAAQ,GAAsB,EAAE,CAAC;IAEvC,IAAI,eAAe,EAAE,CAAC;QACrB,MAAM,eAAe,CAAC,UAAU,EAAE,CAAC;QACnC,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,IAAI,CAAC,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC,CAAC;QACpE,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;YAClC,MAAM,CAAC,IAAI,CAAC;gBACX,EAAE,EAAE,KAAK,CAAC,EAAE;gBACZ,UAAU,EAAE,OAAO;gBACnB,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,OAAO,EAAE,gBAAgB,CAAC,KAAK,CAAC;aAChC,CAAC,CAAC;QACJ,CAAC;IACF,CAAC;IAED,IAAI,iBAAiB,EAAE,CAAC;QACvB,MAAM,iBAAiB,CAAC,UAAU,EAAE,CAAC;QACrC,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC,IAAI,CAAC,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC,CAAC;QACtE,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;YACpC,QAAQ,CAAC,IAAI,CAAC;gBACb,EAAE,EAAE,OAAO,CAAC,EAAE;gBACd,UAAU,EAAE,SAAS;gBACrB,SAAS,EAAE,OAAO,CAAC,SAAS;gBAC5B,OAAO,EAAE,kBAAkB,CAAC,OAAO,CAAC;aACpC,CAAC,CAAC;QACJ,CAAC;IACF,CAAC;IAED,OAAO,CAAC,GAAG,MAAM,EAAE,GAAG,QAAQ,CAAC,CAAC;AACjC,CAAC;AAED,SAAS,OAAO,CAAC,MAAuB;IACvC,OAAO,sBAAsB,CAAC,KAAK,CAAC;QACnC,GAAG,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,KAAK,KAAK,IAAI,CAAC,CAAC;QAC3F,EAAE,EAAE,MAAM,CAAC,EAAE;QACb,SAAS,EAAE,MAAM,CAAC,OAAO,CAAC,SAAS,IAAI,MAAM,CAAC,SAAS;QACvD,SAAS,EAAE,MAAM,CAAC,OAAO,CAAC,SAAS,IAAI,MAAM,CAAC,SAAS;QACvD,MAAM,EAAE,QAAQ;KAChB,CAAC,CAAC;AACJ,CAAC;AAED,SAAS,SAAS,CAAC,MAAuB;IACzC,MAAM,QAAQ,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IACzE,IAAI,cAAqD,CAAC;IAC1D,IAAI,CAAC;QACJ,cAAc,GAAG,qBAAqB,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC;IACpE,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,MAAM,IAAI,eAAe,CAAC,wCAAwC,EAAE,eAAe,EAAE;YACpF,MAAM,EAAE,cAAc,EAAE,SAAS,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,QAAQ,EAAE,MAAM,CAAC,EAAE,EAAE,EAAE,KAAK;SACjF,CAAC,CAAC;IACJ,CAAC;IACD,OAAO,wBAAwB,CAAC,KAAK,CAAC;QACrC,GAAG,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,KAAK,KAAK,IAAI,CAAC,CAAC;QAC3F,EAAE,EAAE,MAAM,CAAC,EAAE;QACb,WAAW,EAAE,MAAM,CAAC,OAAO,CAAC,WAAW,IAAI,MAAM,CAAC,OAAO,CAAC,SAAS;QACnE,QAAQ,EAAE,MAAM,CAAC,OAAO,CAAC,QAAQ,IAAI,UAAU;QAC/C,UAAU,EAAE,MAAM,CAAC,OAAO,CAAC,UAAU,IAAI,gBAAgB;QACzD,QAAQ,EAAE,cAAc;QACxB,SAAS,EAAE,MAAM,CAAC,OAAO,CAAC,SAAS,IAAI,MAAM,CAAC,SAAS;QACvD,SAAS,EAAE,MAAM,CAAC,OAAO,CAAC,SAAS,IAAI,MAAM,CAAC,SAAS;QACvD,MAAM,EAAE,QAAQ;KAChB,CAAC,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,+BAA+B,CACpD,OAAsB,EACtB,OAA0B;IAE1B,MAAM,eAAe,GAAG,MAAM,kBAAkB,CAAC,OAAO,CAAC,CAAC;IAC1D,MAAM,iBAAiB,GAAG,MAAM,oBAAoB,CAAC,OAAO,CAAC,CAAC;IAE9D,IAAI,CAAC,eAAe,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAC5C,OAAO;IACR,CAAC;IAED,MAAM,eAAe,CAAC,UAAU,EAAE,CAAC;IACnC,MAAM,iBAAiB,CAAC,UAAU,EAAE,CAAC;IAErC,MAAM,QAAQ,GAAG,CAAC,CAAC,KAAK,CAAC,qBAAqB,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC/D,MAAM,cAAc,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,KAAK,OAAO,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IACrF,MAAM,gBAAgB,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IAE3F,MAAM,oBAAoB,GAAG,MAAM,eAAe,CAAC,IAAI,CAAC,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC,CAAC;IAClF,MAAM,sBAAsB,GAAG,MAAM,iBAAiB,CAAC,IAAI,CAAC,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC,CAAC;IAEtF,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,oBAAoB,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IAC7E,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,sBAAsB,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IAEjF,KAAK,MAAM,KAAK,IAAI,cAAc,EAAE,CAAC;QACpC,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACzC,IAAI,CAAC,OAAO,IAAI,KAAK,CAAC,SAAS,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC;YACtD,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;QACjC,CAAC;IACF,CAAC;IAED,KAAK,MAAM,OAAO,IAAI,gBAAgB,EAAE,CAAC;QACxC,MAAM,OAAO,GAAG,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QAC7C,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,SAAS,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC;YACxD,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;QACvC,CAAC;IACF,CAAC;IAED,KAAK,MAAM,KAAK,IAAI,UAAU,CAAC,MAAM,EAAE,EAAE,CAAC;QACzC,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACtD,IAAI,MAAM,EAAE,CAAC;YACZ,MAAM,eAAe,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;QAC/C,CAAC;aAAM,CAAC;YACP,MAAM,eAAe,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACrC,CAAC;IACF,CAAC;IAED,KAAK,MAAM,OAAO,IAAI,YAAY,CAAC,MAAM,EAAE,EAAE,CAAC;QAC7C,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QAC1D,IAAI,MAAM,EAAE,CAAC;YACZ,MAAM,iBAAiB,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;QACrD,CAAC;aAAM,CAAC;YACP,MAAM,iBAAiB,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QACzC,CAAC;IACF,CAAC;AACF,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,OAAsB;IAChE,MAAM,gBAAgB,GAAG,MAAM,mBAAmB,CAAC,OAAO,CAAC,CAAC;IAC5D,IAAI,CAAC,gBAAgB,EAAE,CAAC;QACvB,OAAO,2BAA2B,CAAC,OAAO,CAAC,CAAC;IAC7C,CAAC;IAED,MAAM,gBAAgB,CAAC,UAAU,EAAE,CAAC;IACpC,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC;IAEzD,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC7B,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACxB,CAAC;IAED,MAAM,OAAO,GAAG,2BAA2B,CAAC,OAAO,CAAC,CAAC;IACrD,MAAM,gBAAgB,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACvC,OAAO,OAAO,CAAC;AAChB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC5C,OAAsB,EACtB,cAAc,GAAG,KAAK;IAEtB,MAAM,eAAe,GAAG,MAAM,kBAAkB,CAAC,OAAO,CAAC,CAAC;IAC1D,IAAI,CAAC,eAAe;QAAE,OAAO,EAAE,CAAC;IAEhC,MAAM,eAAe,CAAC,UAAU,EAAE,CAAC;IACnC,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,IAAI,CAAC,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC,CAAC;IAEpE,MAAM,QAAQ,GAAG,cAAc;QAC9B,CAAC,CAAC,MAAM,CAAC,KAAK;QACd,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IAEpD,OAAO,eAAe,CAAC,QAAQ,CAAC,CAAC;AAClC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC3C,OAAsB,EACtB,OAAe;IAEf,MAAM,eAAe,GAAG,MAAM,kBAAkB,CAAC,OAAO,CAAC,CAAC;IAC1D,IAAI,CAAC,eAAe;QAAE,OAAO,IAAI,CAAC;IAElC,MAAM,eAAe,CAAC,UAAU,EAAE,CAAC;IACnC,OAAO,CAAC,MAAM,eAAe,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,IAAI,IAAI,CAAC;AACrD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,OAAsB,EAAE,KAAuB;IACtF,MAAM,eAAe,GAAG,MAAM,kBAAkB,CAAC,OAAO,CAAC,CAAC;IAC1D,sEAAsE;IACtE,IAAI,CAAC,eAAe,EAAE,CAAC;QACtB,MAAM,IAAI,eAAe,CAAC,kDAAkD,EAAE,aAAa,EAAE;YAC5F,MAAM,EAAE,4BAA4B;YACpC,SAAS,EAAE,KAAK;SAChB,CAAC,CAAC;IACJ,CAAC;IAED,MAAM,eAAe,CAAC,UAAU,EAAE,CAAC;IACnC,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IACtD,IAAI,MAAM,EAAE,CAAC;QACZ,MAAM,eAAe,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;IAC/C,CAAC;SAAM,CAAC;QACP,MAAM,eAAe,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACrC,CAAC;AACF,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACtC,OAAsB,EACtB,OAAe;IAEf,MAAM,eAAe,GAAG,MAAM,kBAAkB,CAAC,OAAO,CAAC,CAAC;IAC1D,IAAI,CAAC,eAAe;QAAE,OAAO,IAAI,CAAC;IAElC,MAAM,eAAe,CAAC,UAAU,EAAE,CAAC;IACnC,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IACpD,IAAI,CAAC,QAAQ;QAAE,OAAO,IAAI,CAAC;IAE3B,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACrC,MAAM,OAAO,GAAqB,EAAE,GAAG,QAAQ,EAAE,SAAS,EAAE,GAAG,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC;IAClF,MAAM,eAAe,CAAC,MAAM,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAC/C,OAAO,OAAO,CAAC;AAChB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC3C,OAAsB,EACtB,KAAc;IAEd,MAAM,iBAAiB,GAAG,MAAM,oBAAoB,CAAC,OAAO,CAAC,CAAC;IAC9D,IAAI,CAAC,iBAAiB;QAAE,OAAO,EAAE,CAAC;IAElC,MAAM,iBAAiB,CAAC,UAAU,EAAE,CAAC;IACrC,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC,IAAI,CAAC,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC,CAAC;IAEtE,MAAM,QAAQ,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,CACnC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,SAAS,IAAI,CAAC,CAAC,KAAK,IAAI,OAAO,CAAC,KAAK,KAAK,KAAK,CAAC,CACtE,CAAC;IAEF,OAAO,eAAe,CAAC,QAAQ,CAAC,CAAC;AAClC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAAC,OAAsB,EAAE,KAQzE;IACA,MAAM,iBAAiB,GAAG,MAAM,oBAAoB,CAAC,OAAO,CAAC,CAAC;IAC9D,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACxB,MAAM,IAAI,eAAe,CAAC,oDAAoD,EAAE,aAAa,EAAE;YAC9F,MAAM,EAAE,4BAA4B;YACpC,SAAS,EAAE,KAAK;SAChB,CAAC,CAAC;IACJ,CAAC;IAED,MAAM,iBAAiB,CAAC,UAAU,EAAE,CAAC;IACrC,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAErC,MAAM,cAAc,GAAG,MAAM,iBAAiB,CAAC,IAAI,CAAC,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC,CAAC;IAC9E,MAAM,QAAQ,GAAG,cAAc,CAAC,KAAK,CAAC,IAAI,CACzC,CAAC,OAAO,EAAE,EAAE,CACX,OAAO,CAAC,KAAK,KAAK,KAAK,CAAC,KAAK,IAAI,OAAO,CAAC,SAAS,KAAK,KAAK,CAAC,SAAS,IAAI,CAAC,OAAO,CAAC,SAAS,CAC7F,CAAC;IAEF,MAAM,MAAM,GAAuB,QAAQ;QAC1C,CAAC,CAAC;YACA,GAAG,QAAQ;YACX,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,QAAQ,EAAE,KAAK,CAAC,QAAQ,IAAI,QAAQ,CAAC,QAAQ;YAC7C,SAAS,EAAE,GAAG;SACd;QACF,CAAC,CAAC;YACA,EAAE,EAAE,QAAQ,MAAM,CAAC,UAAU,EAAE,EAAE;YACjC,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,QAAQ,EAAE,KAAK,CAAC,QAAQ,IAAI,EAAE;YAC9B,SAAS,EAAE,GAAG;YACd,SAAS,EAAE,GAAG;YACd,MAAM,EAAE,OAAO;SACf,CAAC;IAEJ,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IACzD,IAAI,MAAM,EAAE,CAAC;QACZ,MAAM,iBAAiB,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;IACnD,CAAC;SAAM,CAAC;QACP,MAAM,iBAAiB,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACxC,CAAC;IAED,OAAO,MAAM,CAAC;AACf,CAAC"}

package/dist/app/auth/types.d.ts

@@ -0,0 +1,20 @@
+import type * as z from 'zod/v4';
+import type { OsAppCapabilitySchema, OsAppTokenRecordSchema, OsAppPairingRecordSchema, OsLocalMachineProfileSchema, OsAppSyncRecordSchema } from './schemas/auth.ts';
+export type OsAppCapability = z.infer<typeof OsAppCapabilitySchema>;
+export declare const DEFAULT_OS_APP_CAPABILITIES: OsAppCapability[];
+export type OsAppTokenRecord = z.infer<typeof OsAppTokenRecordSchema>;
+export type OsAppPairingRecord = z.infer<typeof OsAppPairingRecordSchema>;
+export type OsLocalMachineProfile = z.infer<typeof OsLocalMachineProfileSchema>;
+export type OsAppTrustLevel = OsAppPairingRecord['trustLevel'];
+export type OsAppHardwareTarget = OsAppPairingRecord['hardware'];
+export interface OsAppAuthFile {
+    version: 1;
+    updatedAt: string;
+    localMachine: OsLocalMachineProfile;
+    tokens: OsAppTokenRecord[];
+    pairings: OsAppPairingRecord[];
+}
+export type OsAppSyncRecord = z.infer<typeof OsAppSyncRecordSchema>;
+export type OsAppSyncRecordType = OsAppSyncRecord['recordType'];
+export type { CreatePairingInput } from './schemas/auth.ts';
+//# sourceMappingURL=types.d.ts.map

package/dist/app/auth/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/app/auth/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,KAAK,CAAC,MAAM,QAAQ,CAAC;AACjC,OAAO,KAAK,EAAE,qBAAqB,EAAE,sBAAsB,EAAE,wBAAwB,EAAE,2BAA2B,EAAE,qBAAqB,EAAE,MAAM,mBAAmB,CAAC;AACrK,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAEpE,eAAO,MAAM,2BAA2B,EAAE,eAAe,EAKxD,CAAC;AAEF,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AACtE,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAC1E,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC;AAChF,MAAM,MAAM,eAAe,GAAG,kBAAkB,CAAC,YAAY,CAAC,CAAC;AAC/D,MAAM,MAAM,mBAAmB,GAAG,kBAAkB,CAAC,UAAU,CAAC,CAAC;AAEjE,MAAM,WAAW,aAAa;IAC7B,OAAO,EAAE,CAAC,CAAC;IACX,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,qBAAqB,CAAC;IACpC,MAAM,EAAE,gBAAgB,EAAE,CAAC;IAC3B,QAAQ,EAAE,kBAAkB,EAAE,CAAC;CAC/B;AAED,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AACpE,MAAM,MAAM,mBAAmB,GAAG,eAAe,CAAC,YAAY,CAAC,CAAC;AAEhE,YAAY,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC"}

package/dist/app/auth/types.js

@@ -0,0 +1,7 @@
+export const DEFAULT_OS_APP_CAPABILITIES = [
+    'runtime.query',
+    'runtime.invoke',
+    'session.read',
+    'session.handoff'
+];
+//# sourceMappingURL=types.js.map

package/dist/app/auth/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../src/app/auth/types.ts"],"names":[],"mappings":"AAIA,MAAM,CAAC,MAAM,2BAA2B,GAAsB;IAC7D,eAAe;IACf,gBAAgB;IAChB,cAAc;IACd,iBAAiB;CACjB,CAAC"}

package/dist/app/sync/hq.app-auth.sync-bridge.descriptor.d.ts

@@ -0,0 +1,9 @@
+import type { SyncBridgeDescriptor } from '@vibesdotdev/storage/schemas/sync-bridge-descriptor';
+/**
+ * Disabled until an owner app implements `/api/os/app-auth` (vibesCrudCollection
+ * shape). Keeping the bridge registered-but-disabled avoids a phantom sync
+ * target that always 404s and pollutes `storage sync status`.
+ */
+declare const descriptor: SyncBridgeDescriptor;
+export default descriptor;
+//# sourceMappingURL=hq.app-auth.sync-bridge.descriptor.d.ts.map

package/dist/app/sync/hq.app-auth.sync-bridge.descriptor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"hq.app-auth.sync-bridge.descriptor.d.ts","sourceRoot":"","sources":["../../../src/app/sync/hq.app-auth.sync-bridge.descriptor.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,qDAAqD,CAAC;AAEhG;;;;GAIG;AACH,QAAA,MAAM,UAAU,sBAsCd,CAAC;AAEH,eAAe,UAAU,CAAC"}

package/dist/app/sync/hq.app-auth.sync-bridge.descriptor.js

@@ -0,0 +1,45 @@
+import * as z from 'zod/v4';
+import { OsAppSyncRecordSchema } from "../auth/schemas/auth.js";
+import { createRuntimeAsset } from '@vibesdotdev/kernel';
+/**
+ * Disabled until an owner app implements `/api/os/app-auth` (vibesCrudCollection
+ * shape). Keeping the bridge registered-but-disabled avoids a phantom sync
+ * target that always 404s and pollutes `storage sync status`.
+ */
+const descriptor = createRuntimeAsset({
+    id: 'hq.app-auth',
+    kind: 'storage/sync-bridge',
+    name: 'OS App Auth Sync',
+    description: 'Sync app token metadata and app pairings across hardware boundaries (disabled — no owner route yet)',
+    tags: ['os', 'app', 'auth', 'pairing', 'sync'],
+    enabled: false,
+    source: {
+        runtimeKind: 'os/app-auth'
+    },
+    target: {
+        apiPath: '/api/os/app-auth',
+        entityPath: '/api/os/app-auth/:id',
+        // Dual envelope: collections use { results: [...] } (vibesCrudCollection).
+        listField: 'results'
+    },
+    sync: {
+        direction: 'bidirectional',
+        ownershipFilter: 'all',
+        conflictStrategy: 'newest',
+        sensitiveFields: [],
+        idField: 'id'
+    },
+    collect: async ({ runtime }) => {
+        const { collectOsAppAuthSyncRecords } = await import("../auth/sync.js");
+        const records = await collectOsAppAuthSyncRecords(runtime);
+        return records.map((record) => ({ ...record }));
+    },
+    writePulled: async (items, { runtime }) => {
+        const { mergePulledOsAppAuthSyncRecords } = await import("../auth/sync.js");
+        await mergePulledOsAppAuthSyncRecords(runtime, z.array(OsAppSyncRecordSchema).parse(items));
+    },
+    toRemote: (item) => item,
+    fromRemote: (record) => record
+});
+export default descriptor;
+//# sourceMappingURL=hq.app-auth.sync-bridge.descriptor.js.map

package/dist/app/sync/hq.app-auth.sync-bridge.descriptor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"hq.app-auth.sync-bridge.descriptor.js","sourceRoot":"","sources":["../../../src/app/sync/hq.app-auth.sync-bridge.descriptor.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAC5B,OAAO,EAAE,qBAAqB,EAAE,MAAM,yBAAyB,CAAC;AAChE,OAAO,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AAGzD;;;;GAIG;AACH,MAAM,UAAU,GAAG,kBAAkB,CAAuB;IAC3D,EAAE,EAAE,aAAa;IACjB,IAAI,EAAE,qBAAqB;IAC3B,IAAI,EAAE,kBAAkB;IACxB,WAAW,EACV,qGAAqG;IACtG,IAAI,EAAE,CAAC,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,CAAC;IAC9C,OAAO,EAAE,KAAK;IACd,MAAM,EAAE;QACP,WAAW,EAAE,aAAa;KAC1B;IACD,MAAM,EAAE;QACP,OAAO,EAAE,kBAAkB;QAC3B,UAAU,EAAE,sBAAsB;QAClC,2EAA2E;QAC3E,SAAS,EAAE,SAAS;KACpB;IACD,IAAI,EAAE;QACL,SAAS,EAAE,eAAe;QAC1B,eAAe,EAAE,KAAK;QACtB,gBAAgB,EAAE,QAAQ;QAC1B,eAAe,EAAE,EAAE;QACnB,OAAO,EAAE,IAAI;KACb;IACD,OAAO,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE;QAC9B,MAAM,EAAE,2BAA2B,EAAE,GAAG,MAAM,MAAM,CAAC,iBAAiB,CAAC,CAAC;QACxE,MAAM,OAAO,GAAG,MAAM,2BAA2B,CAAC,OAAO,CAAC,CAAC;QAC3D,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,MAAM,EAAE,CAAC,CAAC,CAAC;IACjD,CAAC;IACD,WAAW,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE;QACzC,MAAM,EAAE,+BAA+B,EAAE,GAAG,MAAM,MAAM,CAAC,iBAAiB,CAAC,CAAC;QAC5E,MAAM,+BAA+B,CACpC,OAAO,EACP,CAAC,CAAC,KAAK,CAAC,qBAAqB,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAC3C,CAAC;IACH,CAAC;IACD,QAAQ,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI;IACxB,UAAU,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM;CAC9B,CAAC,CAAC;AAEH,eAAe,UAAU,CAAC"}

package/dist/applets/component-ref.d.ts

@@ -0,0 +1,6 @@
+/**
+ * Re-export from @vibesdotdev/applets — ownership moved in Tranche 3 Task 3.4.
+ * Kept as a local shim so existing HQ-internal imports don't all change at once.
+ */
+export { AppletComponentRefSchema, parseAppletComponentRef, formatAppletComponentRef, type AppletComponentRef } from '@vibesdotdev/applets/component-ref';
+//# sourceMappingURL=component-ref.d.ts.map

package/dist/applets/component-ref.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"component-ref.d.ts","sourceRoot":"","sources":["../../src/applets/component-ref.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EACN,wBAAwB,EACxB,uBAAuB,EACvB,wBAAwB,EACxB,KAAK,kBAAkB,EACvB,MAAM,oCAAoC,CAAC"}

package/dist/applets/component-ref.js

@@ -0,0 +1,6 @@
+/**
+ * Re-export from @vibesdotdev/applets — ownership moved in Tranche 3 Task 3.4.
+ * Kept as a local shim so existing HQ-internal imports don't all change at once.
+ */
+export { AppletComponentRefSchema, parseAppletComponentRef, formatAppletComponentRef } from '@vibesdotdev/applets/component-ref';
+//# sourceMappingURL=component-ref.js.map

package/dist/applets/component-ref.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"component-ref.js","sourceRoot":"","sources":["../../src/applets/component-ref.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EACN,wBAAwB,EACxB,uBAAuB,EACvB,wBAAwB,EAExB,MAAM,oCAAoC,CAAC"}

package/dist/applets/index.d.ts

@@ -0,0 +1,3 @@
+export { isAppletArtifact, isAppletNotification, selectAppletArtifact, selectAppletArtifactIndex } from '@vibesdotdev/applets';
+export { AppletComponentRefSchema, formatAppletComponentRef, parseAppletComponentRef, type AppletComponentRef } from './component-ref.ts';
+//# sourceMappingURL=index.d.ts.map

package/dist/applets/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/applets/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACN,gBAAgB,EAChB,oBAAoB,EACpB,oBAAoB,EACpB,yBAAyB,EACzB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACN,wBAAwB,EACxB,wBAAwB,EACxB,uBAAuB,EACvB,KAAK,kBAAkB,EACvB,MAAM,oBAAoB,CAAC"}

package/dist/applets/index.js

@@ -0,0 +1,3 @@
+export { isAppletArtifact, isAppletNotification, selectAppletArtifact, selectAppletArtifactIndex } from '@vibesdotdev/applets';
+export { AppletComponentRefSchema, formatAppletComponentRef, parseAppletComponentRef } from "./component-ref.js";
+//# sourceMappingURL=index.js.map

package/dist/applets/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/applets/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACN,gBAAgB,EAChB,oBAAoB,EACpB,oBAAoB,EACpB,yBAAyB,EACzB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACN,wBAAwB,EACxB,wBAAwB,EACxB,uBAAuB,EAEvB,MAAM,oBAAoB,CAAC"}

package/dist/approval/approval-resolved.event.descriptor.d.ts

@@ -0,0 +1,11 @@
+/** `hq.approval.resolved`: an hq-surface approval row was answered; waiting requests listen for it. */
+declare const _default: {
+    kind: "runtime/event";
+    id: string;
+    source: string;
+    name: string;
+    description: string;
+    trigger: string;
+};
+export default _default;
+//# sourceMappingURL=approval-resolved.event.descriptor.d.ts.map

package/dist/approval/approval-resolved.event.descriptor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"approval-resolved.event.descriptor.d.ts","sourceRoot":"","sources":["../../src/approval/approval-resolved.event.descriptor.ts"],"names":[],"mappings":"AAAA,uGAAuG;;;;;;;;;AAIvG,wBAOG"}

package/dist/approval/approval-resolved.event.descriptor.js

@@ -0,0 +1,11 @@
+/** `hq.approval.resolved`: an hq-surface approval row was answered; waiting requests listen for it. */
+import { createRuntimeAsset } from '@vibesdotdev/kernel';
+export default createRuntimeAsset({
+    kind: 'runtime/event',
+    id: 'hq.approval.resolved',
+    source: 'hq/approval',
+    name: 'Approval answered',
+    description: 'An hq-surface approval request was approved or discarded. Payload: notificationId and status.',
+    trigger: 'custom'
+});
+//# sourceMappingURL=approval-resolved.event.descriptor.js.map

package/dist/approval/approval-resolved.event.descriptor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"approval-resolved.event.descriptor.js","sourceRoot":"","sources":["../../src/approval/approval-resolved.event.descriptor.ts"],"names":[],"mappings":"AAAA,uGAAuG;AAEvG,OAAO,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AAEzD,eAAe,kBAAkB,CAAC;IACjC,IAAI,EAAE,eAAe;IACrB,EAAE,EAAE,sBAAsB;IAC1B,MAAM,EAAE,aAAa;IACrB,IAAI,EAAE,mBAAmB;IACzB,WAAW,EAAE,+FAA+F;IAC5G,OAAO,EAAE,QAAQ;CACjB,CAAC,CAAC"}