actas 0.0.0-stage → 0.4.0

package/client/identity.mjs

@@ -0,0 +1,95 @@
+import {readFile,mkdir,open,rename} from 'node:fs/promises';
+import {homedir} from 'node:os';
+import {join,dirname} from 'node:path';
+import {randomUUID} from 'node:crypto';
+
+const path=()=>process.env.ACTAS_CONNECTION_FILE||join(homedir(),'.config','actas','identity.json');
+function validate(value){
+ if(value?.kind==='management'){
+  if(value.version!==1||typeof value.ownerId!=='string'||!value.ownerId||typeof value.managementId!=='string'||!/^actas_m_[0-9a-f-]{36}\.[A-Za-z0-9_-]{32,}$/.test(value.token)||value.token.split('.')[0]!=='actas_m_'+value.managementId)throw Error('Invalid management connection.');
+  const url=new URL(value.apiUrl);if(url.username||url.password||url.search||url.hash||url.pathname!=='/'||(url.protocol!=='https:'&&!(url.protocol==='http:'&&['localhost','127.0.0.1','[::1]'].includes(url.hostname))))throw Error('Connection requires HTTPS or local development.');
+  return {version:1,kind:'management',apiUrl:url.origin,ownerId:value.ownerId,managementId:value.managementId,token:value.token};
+ }
+ if(value?.version!==1||typeof value.identityId!=='string'||!/^agt_[0-9a-f-]{36}$/.test(value.identityId)||typeof value.token!=='string'||!/^actas_[0-9a-f-]{36}\.[A-Za-z0-9_-]{32,}$/.test(value.token))throw Error('Invalid identity connection.');
+ const url=new URL(value.apiUrl);
+ if(url.username||url.password||url.search||url.hash||url.pathname!=='/'||(url.protocol!=='https:'&&!(url.protocol==='http:'&&['localhost','127.0.0.1','[::1]'].includes(url.hostname))))throw Error('Identity connection requires HTTPS or local development.');
+ return {version:1,apiUrl:url.origin,identityId:value.identityId,token:value.token};
+}
+async function readConnection(file){
+ try{const raw=await readFile(file,'utf8');if(raw.length>16384)throw Error();return validate(JSON.parse(raw));}catch{throw Error('Could not read a valid identity connection. Run actas connect <connection.json>.');}
+}
+export async function readIdentityConnection(file=path()){return readConnection(file);}
+export async function identityRequest(connection,route,method='GET',body,extraHeaders={}){
+ let response;
+ try{response=await fetch(connection.apiUrl+'/api/v1'+route,{method,redirect:'error',headers:{Origin:connection.apiUrl,Authorization:'Bearer '+connection.token,'Content-Type':'application/json',...extraHeaders},signal:AbortSignal.timeout(15000),...(body===undefined?{}:{body:JSON.stringify(body)})});}catch{throw Error('ActAs could not be reached. No automatic retry was made.');}
+ if(!response.ok)throw Error(response.status===401?'Access expired or was revoked. Reconnect through your workspace.':response.status===403?'This connection does not permit that action.':`ActAs request failed (${response.status}).`);
+ try{return (await response.json()).data;}catch{throw Error('Invalid ActAs response.');}
+}
+export async function connectIdentity(file){
+ const connection=await readConnection(file);
+ const identity=await identityRequest(connection,connection.kind==='management'?'/me':'/identities/'+encodeURIComponent(connection.identityId));
+ if(connection.kind==='management'?(identity.id!==connection.managementId||identity.owners?.[0]?.id!==connection.ownerId):identity.id!==connection.identityId)throw Error('Identity connection mismatch.');
+ const destination=path();await mkdir(dirname(destination),{recursive:true,mode:0o700});
+ const temp=destination+'.'+randomUUID();const handle=await open(temp,'wx',0o600);
+ try{await handle.writeFile(JSON.stringify(connection)+'\n');}finally{await handle.close();}
+ await rename(temp,destination);
+ return {status:'connected',...(connection.kind==='management'?{managementId:identity.id,ownerId:connection.ownerId}:{identityId:identity.id}),name:identity.name};
+}
+export const identityHelp=`ActAs — identity, email and accounts for agents
+
+  actas connect <connection.json>  Import scoped identity access
+  actas identity                   Show your connected identity
+  actas resources                  List permitted identity resources
+  actas resources save             Save a resource from JSON on stdin
+  actas mail <inbox-id>             List inbox messages
+  actas mail <inbox-id> <message-id> Read one message
+  actas mail send <inbox-id> --key <stable-key>   Send JSON on stdin
+  actas mail reply <inbox-id> <message-id> --key <stable-key>  Reply with JSON on stdin
+  actas secret <resource-id>        Retrieve a permitted secret
+
+Download a connection from your workspace's identity Access tab.
+Secret retrieval and message reads can return sensitive values; use only in the
+intended authorized runtime. Never pass secret values as command arguments.
+Sending needs emails:send plus the owner’s Can send email switch. Reply also needs
+emails:read. Send: {"to":"person@example.com","subject":"Hello","text":"Hello"}.
+Reply: {"text":"Thanks"}. Optional simple HTML; no attachments, CC or BCC.
+Reuse the SAME key and SAME body to inspect uncertain sends; never use a fresh key
+while a pending/unknown result needs operator reconciliation. Exit 2 means unconfirmed.
+Legacy configure/signup/login commands remain available for existing clients.
+`;
+export async function runIdentityCommand(args){
+ const [command,...rest]=args;
+ if(!['connect','identity','resources','mail','secret'].includes(command))return false;
+ try{
+  let result;
+  if(command==='connect'){
+   if(rest.length!==1)throw Error('Use actas connect <connection.json>.');
+   result=await connectIdentity(rest[0]);
+  }else{
+   const connection=await readConnection(path());
+   if(connection.kind==='management')throw Error('Use management commands: actas identity list/create, email create, connection issue/revoke, or activity.');
+   if(command==='identity'&&!rest.length)result=await identityRequest(connection,'/identities/'+connection.identityId);
+   else if(command==='resources'&&!rest.length)result=await identityRequest(connection,'/identities/'+connection.identityId+'/resources');
+   else if(command==='resources'&&rest.length===1&&rest[0]==='save'){
+    let input='';for await(const chunk of process.stdin){input+=chunk;if(input.length>100000)throw Error('Resource input is too large.');}
+    let body;try{body=JSON.parse(input);}catch{throw Error('Expected a resource JSON object on stdin.');}
+    if(!body||typeof body!=='object'||Array.isArray(body))throw Error('Expected a resource JSON object on stdin.');
+    const identity=await identityRequest(connection,'/identities/'+connection.identityId);
+    result=await identityRequest(connection,'/resources','POST',{...body,ownerId:identity.ownerId,productId:identity.productId,identityId:identity.id});
+   }else if(command==='mail'&&['send','reply'].includes(rest[0])){
+    const reply=rest[0]==='reply',keyIndex=reply?3:2;
+    if(rest.length!==keyIndex+2||rest[keyIndex]!=='--key'||! /^[A-Za-z0-9_-]{16,128}$/.test(rest[keyIndex+1]))throw Error('Use actas mail send <inbox-id> --key <stable-key> or mail reply <inbox-id> <message-id> --key <stable-key>.');
+    let input='';for await(const chunk of process.stdin){input+=chunk;if(Buffer.byteLength(input)>256*1024)throw Error('Message input is too large.');}
+    let body;try{body=JSON.parse(input);}catch{throw Error('Expected message JSON on stdin.');}
+    if(!body||typeof body!=='object'||Array.isArray(body))throw Error('Expected message JSON on stdin.');
+    result=await identityRequest(connection,'/emails/'+encodeURIComponent(rest[1])+(reply?'/messages/'+encodeURIComponent(rest[2])+'/reply':'/send'),'POST',body,{'Idempotency-Key':rest[keyIndex+1]});
+    if(!['sent','delivered'].includes(result.status))process.exitCode=2;
+   }else if(command==='mail'&&rest.length>=1&&rest.length<=2){
+    result=await identityRequest(connection,'/emails/'+encodeURIComponent(rest[0])+'/messages'+(rest[1]?'/'+encodeURIComponent(rest[1]):''));
+   }else if(command==='secret'&&rest.length===1)result=await identityRequest(connection,'/resources/'+encodeURIComponent(rest[0])+'/reveal','POST',{});
+   else throw Error('Invalid command arguments. Run actas help.');
+  }
+  process.stdout.write(JSON.stringify(result,null,2)+'\n');
+ }catch(error){process.stderr.write(JSON.stringify({status:'failed',message:error.message})+'\n');process.exitCode=1;}
+ return true;
+}

package/client/management.mjs

@@ -0,0 +1,74 @@
+import {readFile,open} from 'node:fs/promises';
+import {identityRequest,readIdentityConnection} from './identity.mjs';
+export const managementHelp=`Workspace management
+  actas connect ./mgmt.json
+  actas identity list
+  actas identity create <name> [--product ID] [--local-part NAME] [--domain DOMAIN]
+  actas identity rename <id> <name>
+  actas identity revoke <id>
+  actas domains list
+  actas domains add <domain>
+  actas domains verify <domain>
+  actas domains remove <domain>
+  actas sending <identity> on|off
+  actas email create <identity>
+  actas connection list
+  actas connection issue <identity> --scopes emails:read --inbox ID --out ./agent.json
+  actas connection revoke <id>
+  actas activity
+  actas management list --owner ID
+  actas management issue --owner ID --name NAME --scopes LIST --confirm WORKSPACE --out ./mgmt.json
+  actas management rotate ID --owner ID --name NAME --scopes LIST --confirm WORKSPACE --out ./mgmt.json
+  actas management revoke ID
+Management issuance uses ACTAS_HUMAN_CONNECTION_FILE (a private human bearer file).
+An explicit --confirm workspace name reconfirms delegation. --days defaults to 90,
+maximum 365. Secret connection output requires --out (exclusive mode 0600 file)
+or explicit --stdout. Never place a token in command arguments.
+`;
+function flags(args,allowed){const values={};for(let i=0;i<args.length;i++){const k=args[i];if(!allowed.includes(k)||Object.hasOwn(values,k))throw Error('Unknown or repeated management option.');values[k]=k==='--stdout'?true:args[++i];if(values[k]===undefined)throw Error('Missing management option.');}return values;}
+async function secretOutput(options,action){
+ if(Boolean(options['--out'])===Boolean(options['--stdout']))throw Error('Choose --out FILE or explicit --stdout for connection output.');
+ let handle;if(options['--out'])handle=await open(options['--out'],'wx',0o600);
+ try{const result=await action();if(handle){await handle.writeFile(JSON.stringify(result,null,2)+'\n');return {status:'issued',file:options['--out']};}process.stdout.write(JSON.stringify(result,null,2)+'\n');return null;}finally{await handle?.close();}
+}
+async function human(){
+ try{const c=JSON.parse(await readFile(process.env.ACTAS_HUMAN_CONNECTION_FILE,'utf8'));const u=new URL(c.apiUrl);if(u.username||u.password||u.search||u.hash||u.pathname!=='/'||(u.protocol!=='https:'&&!(u.protocol==='http:'&&['localhost','127.0.0.1','[::1]'].includes(u.hostname)))||typeof c.token!=='string'||!c.token||c.token.startsWith('actas_'))throw Error();return {...c,apiUrl:u.origin};}catch{throw Error('Use a private ACTAS_HUMAN_CONNECTION_FILE with a current human bearer.');}
+}
+export async function runManagementCommand(args){
+ const [command,action,...rest]=args;
+ if(!(['sending','domains','email','connection','management','activity'].includes(command)||command==='identity'&&['list','create','rename','revoke'].includes(action)))return false;
+ try{
+  let result;
+  if(command==='management'){
+   const c=await human();
+   if(action==='list'){const f=flags(rest,['--owner']);if(!f['--owner'])throw Error('Select --owner.');result=await identityRequest(c,'/management?ownerId='+encodeURIComponent(f['--owner']));}
+   else if(action==='revoke'&&rest.length===1)result=await identityRequest(c,'/management/'+encodeURIComponent(rest[0]),'DELETE');
+   else if(['issue','rotate'].includes(action)){
+    const id=action==='rotate'?rest.shift():null;const f=flags(rest,['--owner','--name','--scopes','--confirm','--days','--out','--stdout']);
+    const days=Number(f['--days']??90);if(!Number.isInteger(days)||days<1||days>365||!f['--owner']||!f['--name']||!f['--scopes']||!f['--confirm']||action==='rotate'&&!id)throw Error('Supply owner, name, scopes, confirmation and 1–365 days.');
+    result=await secretOutput(f,async()=> (await identityRequest(c,'/management'+(id?'/'+encodeURIComponent(id)+'/rotate':''),'POST',{ownerId:f['--owner'],name:f['--name'],scopes:f['--scopes'].split(','),confirmWorkspace:f['--confirm'],expiresAt:Date.now()+days*86400000})).connection);
+   }else throw Error('Invalid management command.');
+  }else{
+   const c=await readIdentityConnection();if(c.kind!=='management')throw Error('Connect a management connection first.');
+   if(command==='sending'&&action&&rest.length===1&&['on','off'].includes(rest[0]))result=await identityRequest(c,'/identities/'+encodeURIComponent(action)+'/sending','PATCH',{canSend:rest[0]==='on'});
+   else if(command==='domains'&&action==='list'&&!rest.length)result=await identityRequest(c,'/domains?ownerId='+encodeURIComponent(c.ownerId));
+   else if(command==='domains'&&action==='add'&&rest.length===1)result=await identityRequest(c,'/domains','POST',{ownerId:c.ownerId,domain:rest[0]});
+   else if(command==='domains'&&action==='verify'&&rest.length===1)result=await identityRequest(c,'/domains/'+encodeURIComponent(rest[0])+'/verify','POST',{});
+   else if(command==='domains'&&action==='remove'&&rest.length===1)result=await identityRequest(c,'/domains/'+encodeURIComponent(rest[0]),'DELETE');
+   else if(command==='identity'&&action==='list'&&!rest.length)result=await identityRequest(c,'/identities');
+   else if(command==='identity'&&action==='create'){const name=rest.shift(),f=flags(rest,['--product','--local-part','--domain']);if(!name)throw Error('Supply an agent name.');result=await identityRequest(c,'/identities','POST',{ownerId:c.ownerId,name,productId:f['--product']||null,...(f['--local-part']?{localPart:f['--local-part']}:{}),...(f['--domain']?{domain:f['--domain']}:{})});}
+   else if(command==='identity'&&action==='rename'&&rest.length===2)result=await identityRequest(c,'/identities/'+encodeURIComponent(rest[0]),'PATCH',{name:rest[1]});
+   else if(command==='identity'&&action==='revoke'&&rest.length===1)result=await identityRequest(c,'/identities/'+encodeURIComponent(rest[0])+'/revoke','POST',{});
+   else if(command==='email'&&action==='create'&&rest.length===1)result=await identityRequest(c,'/identities/'+encodeURIComponent(rest[0])+'/email','POST',{});
+   else if(command==='connection'&&action==='list'&&!rest.length)result=await identityRequest(c,'/clients');
+   else if(command==='connection'&&action==='revoke'&&rest.length===1)result=await identityRequest(c,'/clients/'+encodeURIComponent(rest[0]),'DELETE');
+   else if(command==='connection'&&action==='issue'){
+    const id=rest.shift(),f=flags(rest,['--scopes','--inbox','--resources','--name','--out','--stdout']);if(!id||!f['--scopes']||!f['--inbox']&&!f['--resources'])throw Error('Supply identity, scopes and --inbox or --resources.');
+    result=await secretOutput(f,async()=>{const identity=await identityRequest(c,'/identities/'+encodeURIComponent(id));const issued=await identityRequest(c,'/clients','POST',{ownerId:c.ownerId,productId:identity.productId,identityId:id,name:f['--name']||identity.name+' runtime',scopes:[...new Set(['resources:read',...f['--scopes'].split(',')])],resourceIds:f['--inbox']?[f['--inbox']] : f['--resources'].split(','),identityFields:[]});return {version:1,apiUrl:c.apiUrl,identityId:id,token:issued.token};});
+   }else if(command==='activity'&&action===undefined)result=await identityRequest(c,'/activity');
+   else throw Error('Invalid management command. Run actas help.');
+  }
+  if(result!==null)process.stdout.write(JSON.stringify(result,null,2)+'\n');
+ }catch{process.stderr.write(JSON.stringify({status:'failed',message:'Management command failed. Check arguments, access and private output file; reconcile uncertain issuance in Access before retrying.'})+'\n');process.exitCode=1;}
+ return true;
+}

package/client/package-cli.mjs

@@ -0,0 +1,8 @@
+#!/usr/bin/env node
+// Load the MCP dependencies only when a stdio MCP client requests them.
+if(process.argv[2]==='mcp'){
+ const {main}=await import('./accounts-mcp.mjs');
+ await main().catch(()=>{process.stderr.write('ActAs MCP could not start. Check the private connection file and permissions.\n');process.exitCode=1;});
+}else{
+ await import('./public-cli.mjs');
+}

package/client/public-cli.mjs

@@ -0,0 +1,32 @@
+#!/usr/bin/env node
+import {runRegistryCommand,registryHelp} from './accounts-registry.mjs';
+if(await runRegistryCommand(process.argv.slice(2)))process.exit(process.exitCode||0);
+import {runManagementCommand,managementHelp} from './management.mjs';
+if(await runManagementCommand(process.argv.slice(2)))process.exit(process.exitCode||0);
+import {runVaultCommand,vaultHelp} from './vault.mjs';
+if(await runVaultCommand(process.argv.slice(2)))process.exit(process.exitCode||0);
+import {runIdentityCommand,identityHelp} from './identity.mjs';
+if(await runIdentityCommand(process.argv.slice(2)))process.exit(process.exitCode||0);
+import {configureAccount} from './configure.mjs';
+import {existsSync} from 'node:fs';
+import {homedir} from 'node:os';
+import {join} from 'node:path';
+import {accountFlow,targetUrl} from './accounts.mjs';
+import {callerExecutor,loadMappings,selectMapping} from './caller.mjs';
+import {externalExecutor} from './external-caller.mjs';
+const [action,url,...args]=process.argv.slice(2);
+if(action==='configure'){try{if(!url||args.length)throw new Error('Use actas configure <connection.json>.');console.log(JSON.stringify(await configureAccount(url)));}catch(e){console.error(JSON.stringify({status:'failed',message:e.message}));process.exitCode=1;}process.exit(process.exitCode||0);}
+if(!action||['help','--help','-h'].includes(action)){
+ console.log(registryHelp+"\n"+managementHelp+"\n"+identityHelp+"\n"+vaultHelp);
+}else try{
+ if(!['signup','login'].includes(action)||!url||args.length%2)throw new Error('Use actas signup <url> or actas login <url>.');
+ const flags={};for(let i=0;i<args.length;i+=2){if(!['--account','--continue'].includes(args[i])||flags[args[i]]||!args[i+1])throw new Error('Unknown or repeated option.');flags[args[i]]=args[i+1];}
+ const fallback=join(homedir(),'.config','actas','accounts.json');
+ const accountsPath=process.env.ACTAS_ACCOUNTS_FILE||(existsSync(fallback)?fallback:undefined);
+ const selected=selectMapping(await loadMappings(accountsPath),targetUrl(url).origin,flags['--account']);
+ if(selected&&!selected.actions.includes(action))throw new Error('Account action is not authorised.');
+ const options={accountsPath,reportPath:flags['--continue']};
+ const external=await externalExecutor(options),caller=await callerExecutor(options);
+ const {exitCode,...result}=await accountFlow(action,url,{accountRef:selected?.accountRef,execute:async state=>(await external(state))||caller(state)});
+ console.log(JSON.stringify(result,null,2));process.exitCode=exitCode;
+}catch(error){console.error(JSON.stringify({status:'failed',message:error.message}));process.exitCode=1;}

package/client/vault.mjs

@@ -0,0 +1,130 @@
+import {readFile,open,rename,unlink,lstat,chmod,readdir} from 'node:fs/promises';
+import {join,dirname,resolve} from 'node:path';
+import {homedir} from 'node:os';
+import {spawn} from 'node:child_process';
+import {randomUUID} from 'node:crypto';
+import {StringDecoder} from 'node:string_decoder';
+import {parseEnv} from 'node:util';
+import {identityRequest,readIdentityConnection} from './identity.mjs';
+const fail=()=>{throw Error('Invalid vault command. Run actas help. Values belong only at private prompts.');};
+export const vaultHelp=`Workspace vault (exact and folder grants; no values in command arguments)
+  actas totp add /path [--replace]    Read seed or otpauth URI from stdin
+  actas totp code /path
+  actas totp status /path
+  actas secret set /path/KEY [--replace]
+  actas secret list [--path /folder]
+  actas secret versions /path/KEY
+  actas secret restore /path/KEY VERSION
+  actas run --keys A,B [--path /folder] -- cmd [args]
+  actas env sync <dir> --path /folder --keys A,B [--force] [--dry-run]
+  actas env inventory <dir>       List local .env.local key names only
+  actas script add /path/script
+  actas script check /path/script
+  actas grant list
+  actas grant add <client|identity>:ID /path <read|write|reveal|run|totp:code> [--folder]
+  actas grant revoke ID
+Connected agents and management automation use ACTAS_CONNECTION_FILE. Paths default to ACTAS_VAULT_PATH
+or /shared for run and env sync. For owner grant management use a
+private ACTAS_HUMAN_CONNECTION_FILE containing apiUrl and a current human bearer
+token, plus ACTAS_WORKSPACE_ID and optional ACTAS_PRODUCT_ID. Human tokens expire;
+reconnect through the normal workspace session. Membership suffices; no admin powers.
+Children are trusted consumers, not a sandbox. They may intentionally print values.
+`;
+export function validPath(path){if(typeof path!=='string'||path.length>512||!/^\/(?:[A-Za-z0-9_-]+\/)*[A-Za-z0-9_-]+$/.test(path))fail();return path;}
+export function keyNames(raw){const keys=raw?.split(',');if(!keys?.length||keys.some(x=>! /^[A-Za-z_][A-Za-z0-9_]*$/.test(x))||new Set(keys).size!==keys.length)fail();return keys;}
+export function childEnvironment(parent=process.env){return Object.fromEntries(['PATH','HOME','TMPDIR','LANG','LC_ALL','SYSTEMROOT'].filter(k=>parent[k]!==undefined).map(k=>[k,parent[k]]));}
+export function privatePrompt(labels,input=process.stdin,output=process.stdout){
+ if(!input.isTTY||!output.isTTY||typeof input.setRawMode!=='function')throw Error('Use a private Terminal with TTY input and output. Nothing saved.');
+ return new Promise((resolve,reject)=>{
+  let fields=[],current='',done=false,swallowLF=false;const decoder=new StringDecoder('utf8'),wasRaw=input.isRaw;
+  function finish(error){if(done)return;done=true;input.removeListener('data',data);input.removeListener('end',cancel);input.removeListener('error',cancel);for(const s of ['SIGINT','SIGTERM','SIGHUP'])process.removeListener(s,cancel);input.setRawMode(Boolean(wasRaw));input.pause();output.write('\n');const result=fields;fields=[];current='';error?reject(error):resolve(result);}
+  function cancel(){finish(Error('Private entry cancelled. Nothing saved.'));}
+  function data(chunk){for(const c of typeof chunk==='string'?chunk:decoder.write(chunk)){
+   if(done)return;if(c==='\x03'||c==='\x04')return cancel();if(c==='\x7f'||c==='\b'){current=[...current].slice(0,-1).join('');continue;}if(c==='\x15'){current='';continue;}
+   if(c==='\n'&&swallowLF){swallowLF=false;continue;}swallowLF=c==='\r';
+   if(c==='\n'||c==='\r'){fields.push(current);current='';output.write('\n');if(fields.length===labels.length)return finish();output.write(labels[fields.length]+': ');}
+   else if(c.charCodeAt(0)<32||c.charCodeAt(0)===127)return finish(Error('Unsupported control input. Nothing saved.'));
+   else{current+=c;if(current.length>65536)return finish(Error('Entry too long. Nothing saved.'));}
+  }}
+  input.setRawMode(true);input.on('data',data);input.once('end',cancel);input.once('error',cancel);for(const s of ['SIGINT','SIGTERM','SIGHUP'])process.once(s,cancel);output.write(labels[0]+': ');input.resume();
+ });
+}
+async function context(){
+ if(process.env.ACTAS_HUMAN_CONNECTION_FILE){
+  let connection;try{connection=JSON.parse(await readFile(process.env.ACTAS_HUMAN_CONNECTION_FILE,'utf8'));const url=new URL(connection.apiUrl);if(url.username||url.password||url.search||url.hash||url.pathname!=='/'||(url.protocol!=='https:'&&!(url.protocol==='http:'&&['localhost','127.0.0.1','[::1]'].includes(url.hostname)))||typeof connection.token!=='string'||!connection.token||connection.token.startsWith('actas_'))throw Error();connection.apiUrl=url.origin;}catch{throw Error('Could not read a valid human connection.');}
+  if(!process.env.ACTAS_WORKSPACE_ID)throw Error('Select ACTAS_WORKSPACE_ID for human vault commands.');
+  return {connection,scope:{ownerId:process.env.ACTAS_WORKSPACE_ID,productId:process.env.ACTAS_PRODUCT_ID||null}};
+ }
+ const connection=await readIdentityConnection();if(connection.kind==='management')return {connection,scope:{ownerId:connection.ownerId,productId:process.env.ACTAS_PRODUCT_ID||null}};const identity=await identityRequest(connection,'/identities/'+connection.identityId);return {connection,scope:{ownerId:identity.ownerId,productId:identity.productId}};
+}
+export function requestVault(ctx,route,body,method='POST'){return identityRequest(ctx.connection,'/vault'+route,method,body===undefined?undefined:{...body,...ctx.scope});}
+function options(args,allowed){const out={};for(let i=0;i<args.length;i++){const name=args[i];if(!allowed.includes(name)||Object.hasOwn(out,name))fail();out[name]=['--replace','--force','--dry-run'].includes(name)?true:args[++i];if(out[name]===undefined)fail();}return out;}
+async function selected(ctx,path,keys){validPath(path);const values={};for(const key of keys){const item=await requestVault(ctx,'/read',{path:path+'/'+key,action:'reveal'});if(typeof item?.value!=='string'||item.value.includes('\0'))throw Error('Invalid vault response. Command was not started.');values[key]=item.value;}return values;}
+export function runChild(command,env,card,spawnChild=spawn){
+ if(!command.length)fail();return new Promise((resolve,reject)=>{
+  let child;try{child=spawnChild(command[0],command.slice(1),{env,shell:false,stdio:card?['pipe','inherit','inherit']:'inherit'});}catch{reject(Error('Unable to start requested command.'));return;}
+  const forward=signal=>child.kill(signal);const sigint=()=>forward('SIGINT'),sigterm=()=>forward('SIGTERM');process.on('SIGINT',sigint);process.on('SIGTERM',sigterm);
+  function cleanup(){process.removeListener('SIGINT',sigint);process.removeListener('SIGTERM',sigterm);}
+  child.once('error',()=>{cleanup();reject(Error('Unable to start requested command.'));});child.once('exit',(code,signal)=>{cleanup();resolve(code??(signal?1:0));});
+  if(card){child.stdin.on('error',()=>{});child.stdin.end(JSON.stringify(card)+'\n');}
+ });
+}
+// Node dotenv has no escaped-newline syntax. Quote literal multiline values and
+// reject the rare value containing all three quote delimiters rather than corrupt it.
+export function encodeEnv(value){for(const quote of ['"',"'",'`'])if(!value.includes(quote))return quote+value+quote;throw Error('Value cannot be represented losslessly in a dotenv file. Use actas run.');}
+export async function syncEnv(directory,values,{force=false,dryRun=false}={}){
+ const file=join(resolve(directory),'.env.local');let raw='';try{const info=await lstat(file);if(!info.isFile()||info.isSymbolicLink())throw Error();raw=await readFile(file,'utf8');}catch(e){if(e.code!=='ENOENT')throw Error('Unable to read a regular target env file.');}
+ let existing;try{existing=parseEnv(raw);}catch{throw Error('Target env file could not be parsed.');}
+ const updates=new Map(),actions=[];for(const [key,value] of Object.entries(values)){keyNames(key);if(existing[key]&&!force){actions.push({key,action:'kept-existing'});continue;}updates.set(key,encodeEnv(value));actions.push({key,action:Object.hasOwn(existing,key)?'updated':'added'});}
+ if(!dryRun&&updates.size){
+  // Remove complete multiline assignments, preserve unrelated lines/comments.
+  const lines=raw.split(/\r?\n/),out=[];const consumed=new Set();
+  for(let i=0;i<lines.length;i++){const match=/^\s*(?:export\s+)?([A-Za-z_][A-Za-z0-9_]*)\s*=\s*(.*)$/.exec(lines[i]);if(!match||!updates.has(match[1])){out.push(lines[i]);continue;}
+   const v=match[2],q=v[0];if(['"',"'",'`'].includes(q)&&!v.slice(1).includes(q)){while(++i<lines.length&&!lines[i].includes(q)){} }
+   if(!consumed.has(match[1]))out.push(match[1]+'='+updates.get(match[1]));consumed.add(match[1]);
+  }
+  for(const [k,v] of updates)if(!consumed.has(k))out.push(k+'='+v);
+  const next=out.join('\n').replace(/\n*$/,'')+'\n';const parsed=parseEnv(next);for(const [key] of updates)if(parsed[key]!==values[key])throw Error('Env serialization could not preserve the value. Nothing written.');
+  const temp=join(dirname(file),'.actas-env-'+randomUUID());let handle;try{handle=await open(temp,'wx',0o600);await handle.writeFile(next);await handle.close();handle=null;await rename(temp,file);await chmod(file,0o600);}finally{await handle?.close();await unlink(temp).catch(()=>{});}
+ }
+ return {target:file,dryRun,actions};
+}
+export async function inventoryEnv(directory){
+ const raw=await readFile(join(resolve(directory),'.env.local'),'utf8');return {keys:[...new Set([...raw.matchAll(/^\s*(?:export\s+)?([A-Za-z_][A-Za-z0-9_]*)\s*=/gm)].map(m=>m[1]))].sort()};
+}
+export async function runVaultCommand(args){
+ const [cmd,sub,...rest]=args;if(!['run','env','card','script','grant','totp'].includes(cmd)&&!(cmd==='secret'&&['set','list','versions','restore'].includes(sub)))return false;
+ try{
+  let result;
+  if(cmd==='env'&&sub==='inventory'){if(rest.length!==1)fail();result=await inventoryEnv(rest[0]);}
+  else{
+   const ctx=await context();
+   if(cmd==='run'||cmd==='card'&&sub==='run'){
+    const split=args.indexOf('--');if(split<0||split===args.length-1)fail();let values,card;
+    if(cmd==='run'){const flags=options(args.slice(1,split),['--path','--keys']);values=await selected(ctx,flags['--path']||process.env.ACTAS_VAULT_PATH||'/shared',keyNames(flags['--keys']));}
+    else{if(split!==3)fail();card=(await requestVault(ctx,'/read',{path:validPath(args[2]),action:'run'})).card;if(!card)throw Error('Invalid card response. Command was not started.');}
+    process.exitCode=await runChild(args.slice(split+1),{...childEnvironment(),...values},card);return true;
+   }
+   else if(cmd==='env'&&sub==='sync'){const [dir,...extra]=rest;if(!dir)fail();const flags=options(extra,['--path','--keys','--force','--dry-run']);const values=await selected(ctx,flags['--path']||process.env.ACTAS_VAULT_PATH||'/shared',keyNames(flags['--keys']));result=await syncEnv(dir,values,{force:flags['--force'],dryRun:flags['--dry-run']});}
+   else if(cmd==='secret'&&sub==='list'){const flags=options(rest,['--path']);const query=new URLSearchParams({ownerId:ctx.scope.ownerId,...(ctx.scope.productId?{productId:ctx.scope.productId}:{}),...(flags['--path']?{path:validPath(flags['--path'])}:{})});result=(await requestVault(ctx,'/entries?'+query,undefined,'GET')).filter(x=>x.kind==='secret'&&(!flags['--path']||x.path.startsWith(validPath(flags['--path'])+'/')));}
+   else if(cmd==='totp'&&sub==='add'){const path=validPath(rest[0]),flags=options(rest.slice(1),['--replace']);let value='';for await(const chunk of process.stdin){value+=chunk;if(value.length>8192)fail();}result=await requestVault(ctx,'/set',{path,kind:'totp',value:value.trim(),replace:flags['--replace']===true});}
+   else if(cmd==='totp'&&['code','status'].includes(sub)){if(rest.length!==1)fail();result=await requestVault(ctx,'/read',{path:validPath(rest[0]),action:sub==='code'?'totp:code':'read'});}
+   else if(cmd==='secret'&&sub==='set'||cmd==='card'&&sub==='add'){
+    const path=validPath(rest[0]),flags=options(rest.slice(1),['--replace']);let value;
+    if(cmd==='secret'){const entered=await privatePrompt(['Secret value','Repeat value']);if(!entered[0]||entered[0]!==entered[1])throw Error('Values are empty or do not match. Nothing saved.');value=entered[0];}
+    else{const [cardholder,number,expiryMonth,expiryYear,cvc,label]=await privatePrompt(['Cardholder','Number','Expiry month (MM)','Expiry year (YYYY)','CVC (internal workspace only; blank to omit)','Label']);value={cardholder,number,expiryMonth,expiryYear,...(cvc?{cvc}:{}),label};}
+    result=await requestVault(ctx,'/set',{path,kind:cmd==='secret'?'secret':'card',value,replace:flags['--replace']===true});
+   }
+   else if(cmd==='secret'&&sub==='versions'){if(rest.length!==1)fail();result=await requestVault(ctx,'/versions',{path:validPath(rest[0])});}
+   else if(cmd==='secret'&&sub==='restore'){if(rest.length!==2||!/^\d+$/.test(rest[1]))fail();result=await requestVault(ctx,'/restore',{path:validPath(rest[0]),version:Number(rest[1])});}
+   else if(cmd==='card'&&sub==='status'||cmd==='script'&&sub==='check'){if(rest.length!==1)fail();result=await requestVault(ctx,'/read',{path:validPath(rest[0]),action:cmd==='script'?'run':'read'});}
+   else if(cmd==='script'&&sub==='add'){if(rest.length!==1)fail();result=await requestVault(ctx,'/set',{path:validPath(rest[0]),kind:'script'});}
+   else if(cmd==='grant'&&sub==='list'){if(rest.length)fail();const query=new URLSearchParams({ownerId:ctx.scope.ownerId,...(ctx.scope.productId?{productId:ctx.scope.productId}:{})});result=await requestVault(ctx,'/grants?'+query,undefined,'GET');}
+   else if(cmd==='grant'&&sub==='add'){if(rest.length!==3&&!(rest.length===4&&rest[3]==='--folder'))fail();const m=/^(client|identity):(.+)$/.exec(rest[0]);if(!m||!['read','write','reveal','run','totp:code'].includes(rest[2]))fail();result=await requestVault(ctx,'/grants',{principalKind:m[1],principalId:m[2],path:validPath(rest[1]),action:rest[2],folder:rest[3]==='--folder'});}
+   else if(cmd==='grant'&&sub==='revoke'){if(rest.length!==1)fail();result=await requestVault(ctx,'/grants/'+encodeURIComponent(rest[0]),undefined,'DELETE');}
+   else fail();
+  }
+  process.stdout.write(JSON.stringify(result,null,2)+'\n');
+ }catch{process.stderr.write('ActAs vault operation failed. No sensitive diagnostics displayed; verify metadata before retrying a write.\n');process.exitCode=1;}
+ return true;
+}

package/package.json

@@ -1,6 +1,30 @@
 {
   "name": "actas",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+  "version": "0.4.0",
+  "mcpName": "dev.actas/accounts",
+  "type": "module",
+  "description": "Persistent identity, email, saved accounts and scoped credentials for AI agents",
+  "homepage": "https://actas.dev/?utm_source=npm&utm_medium=directory&utm_campaign=launch",
+  "keywords": [
+    "mcp",
+    "mcp-server",
+    "actas",
+    "ai-agent",
+    "email",
+    "identity",
+    "credentials"
+  ],
+  "bin": {
+    "actas": "client/package-cli.mjs",
+    "actas-accounts-mcp": "client/accounts-mcp.mjs"
+  },
+  "engines": {
+    "node": ">=22"
+  },
+  "license": "MIT",
+  "dependencies": {
+    "@modelcontextprotocol/sdk": "^1.32.0",
+    "zod": "4.5.4",
+    "playwright": "1.63.0"
+  }
+}

package/scripts/proof-client.mjs

@@ -0,0 +1,29 @@
+/** Compatibility client for the retained controlled-service proof only. */
+export class ActAsError extends Error {
+ constructor(status,code,message){super(message);this.name='ActAsError';this.status=status;this.code=code;}
+}
+export class ActAs {
+ constructor({url,token}) {
+  this.url=(url||'https://actas.dev').replace(/\/$/,'');
+  const parsed=new URL(this.url);
+  if(parsed.protocol!=='https:' && !(parsed.protocol==='http:'&&['localhost','127.0.0.1','[::1]'].includes(parsed.hostname))) throw new Error('ActAs requires HTTPS, except on loopback for local development.');
+  if(!token)throw new Error('An explicitly scoped ActAs API token is required.');
+  this.token=token;
+ }
+ async request(path,{method='GET',body,idempotencyKey}={}) {
+  const response=await fetch(this.url+'/api/v1'+path,{method,redirect:'error',headers:{Authorization:`Bearer ${this.token}`,...(body!==undefined?{'Content-Type':'application/json'}:{}),...(idempotencyKey?{'Idempotency-Key':idempotencyKey}:{})},...(body!==undefined?{body:JSON.stringify(body)}:{})});
+  const payload=await response.json().catch(()=>null);
+  if(!response.ok){const error=new ActAsError(response.status,payload?.error?.code||'request_failed',payload?.error?.message||'ActAs could not complete the request.');error.operation=method+' '+path;throw error;}
+  return payload?.data;
+ }
+ me(){return this.request('/me');}
+ list(type,filters={}){return this.request('/resources?'+new URLSearchParams({type,...Object.fromEntries(Object.entries(filters).filter(([,v])=>v!==null&&v!==undefined))}));}
+ get(id){return this.request('/resources/'+encodeURIComponent(id));}
+ create(resource){return this.request('/resources',{method:'POST',body:resource});}
+ update(id,patch){return this.request('/resources/'+encodeURIComponent(id),{method:'PATCH',body:patch});}
+ reveal(id){return this.request('/resources/'+encodeURIComponent(id)+'/reveal',{method:'POST'});}
+ provisionEmail(resource,idempotencyKey){if(!idempotencyKey)throw new Error('An idempotency key is required.');return this.request('/emails',{method:'POST',body:resource,idempotencyKey});}
+ messages(id){return this.request('/emails/'+encodeURIComponent(id)+'/messages');}
+ message(id,messageId){return this.request('/emails/'+encodeURIComponent(id)+'/messages/'+encodeURIComponent(messageId));}
+ activity(){return this.request('/activity');}
+}