borgmcp 1.1.15 → 2.0.1

package/dist/server-endpoint.d.ts

@@ -0,0 +1,9 @@
+/**
+ * Normalize the endpoint accepted by `borg assimilate --host <host>`.
+ *
+ * Bare hosts default to HTTPS, including loopback: the ratified v1 server
+ * architecture requires TLS for every authority. Plaintext endpoints are
+ * rejected even on loopback so enrollment credentials never cross HTTP.
+ */
+export declare function normalizeServerEndpoint(input: string): string;
+//# sourceMappingURL=server-endpoint.d.ts.map

package/dist/server-endpoint.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"server-endpoint.d.ts","sourceRoot":"","sources":["../src/server-endpoint.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CA8B7D"}

package/dist/server-endpoint.js

@@ -0,0 +1,38 @@
+/**
+ * Normalize the endpoint accepted by `borg assimilate --host <host>`.
+ *
+ * Bare hosts default to HTTPS, including loopback: the ratified v1 server
+ * architecture requires TLS for every authority. Plaintext endpoints are
+ * rejected even on loopback so enrollment credentials never cross HTTP.
+ */
+export function normalizeServerEndpoint(input) {
+    const raw = input.trim();
+    if (!raw)
+        throw new Error('--host requires a host or URL');
+    const hasScheme = /^[a-z][a-z0-9+.-]*:\/\//i.test(raw);
+    let url;
+    try {
+        url = new URL(hasScheme ? raw : `https://${raw}`);
+    }
+    catch {
+        // Never echo the raw input: malformed URLs may contain pasted credentials.
+        throw new Error('invalid Borg server endpoint');
+    }
+    if (url.protocol !== 'https:') {
+        throw new Error('Borg server endpoints must use https://');
+    }
+    if (url.username || url.password) {
+        throw new Error('Borg server endpoints must not contain credentials');
+    }
+    if (url.search || url.hash) {
+        throw new Error('Borg server endpoints must not contain a query string or fragment');
+    }
+    if (url.pathname !== '/' && url.pathname !== '') {
+        throw new Error('Borg server endpoints must not contain a path');
+    }
+    if (url.hostname === '0.0.0.0' || url.hostname === '[::]') {
+        throw new Error('Borg server endpoints must not use a wildcard address');
+    }
+    return url.origin;
+}
+//# sourceMappingURL=server-endpoint.js.map

package/dist/server-endpoint.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"server-endpoint.js","sourceRoot":"","sources":["../src/server-endpoint.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,MAAM,UAAU,uBAAuB,CAAC,KAAa;IACnD,MAAM,GAAG,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IACzB,IAAI,CAAC,GAAG;QAAE,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;IAE3D,MAAM,SAAS,GAAG,0BAA0B,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACvD,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,GAAG,EAAE,CAAC,CAAC;IACpD,CAAC;IAAC,MAAM,CAAC;QACP,2EAA2E;QAC3E,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;IAClD,CAAC;IAED,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;IAC7D,CAAC;IACD,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ,EAAE,CAAC;QACjC,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;IACxE,CAAC;IACD,IAAI,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC;QAC3B,MAAM,IAAI,KAAK,CAAC,mEAAmE,CAAC,CAAC;IACvF,CAAC;IACD,IAAI,GAAG,CAAC,QAAQ,KAAK,GAAG,IAAI,GAAG,CAAC,QAAQ,KAAK,EAAE,EAAE,CAAC;QAChD,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;IACnE,CAAC;IACD,IAAI,GAAG,CAAC,QAAQ,KAAK,SAAS,IAAI,GAAG,CAAC,QAAQ,KAAK,MAAM,EAAE,CAAC;QAC1D,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;IAC3E,CAAC;IAED,OAAO,GAAG,CAAC,MAAM,CAAC;AACpB,CAAC"}

package/dist/server-errors.d.ts

@@ -0,0 +1,50 @@
+export type BorgServerErrorCode = 'NOT_ENROLLED' | 'CREDENTIAL_REJECTED' | 'INVITATION_REJECTED' | 'CREATE_CUBE_DENIED' | 'ATTACH_CONFLICT' | 'SESSION_REJECTED';
+/** Safe, non-secret state code for deterministic authority recovery copy. */
+export declare class BorgServerError extends Error {
+    readonly code: BorgServerErrorCode;
+    constructor(code: BorgServerErrorCode, message: string);
+}
+/**
+ * CR5: a STABLE TYPED non-ok HTTP verdict from a verified server. Carries the raw
+ * status so the seat probe classifies endpoint/protocol-mismatch (404) vs
+ * server-failure (5xx) from the actual code — never a mutable error-text regex.
+ * The message is kept identical to the pre-typed string for call-site parity.
+ */
+export declare class BorgServerHttpError extends Error {
+    readonly status: number;
+    readonly code?: ErrorCode | undefined;
+    constructor(status: number, message: string, code?: ErrorCode | undefined);
+}
+export declare class LocalManageRequiredError extends Error {
+    readonly operation: string;
+    readonly cubeName: string;
+    readonly noMutation: string;
+    constructor(operation: string, cubeName: string, noMutation: string);
+}
+export declare class LocalManageCredentialUnavailableError extends Error {
+    readonly operation: string;
+    readonly cubeName: string;
+    readonly noMutation: string;
+    constructor(operation: string, cubeName: string, noMutation: string);
+}
+/**
+ * CR5: a STABLE TYPED terminal trust verdict — the pinned server identity no longer
+ * matches. This is a security boundary: it must be classified from the error TYPE,
+ * never from an error-text regex ("regex classification is not an authority
+ * boundary"). trust-mismatch is terminal (never launch-anyway, never credential-send).
+ */
+export declare class BorgServerTrustError extends Error {
+    constructor(message: string);
+}
+/**
+ * CR5: a STABLE TYPED transport-failure verdict — the server was unreachable
+ * (connection refused/reset, DNS failure) or the request timed out. Distinct from
+ * an HTTP status; genuinely transient.
+ */
+export declare class BorgServerUnreachableError extends Error {
+    constructor(message: string, options?: {
+        cause?: unknown;
+    });
+}
+import type { ErrorCode } from 'borgmcp-shared/protocol';
+//# sourceMappingURL=server-errors.d.ts.map

package/dist/server-errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"server-errors.d.ts","sourceRoot":"","sources":["../src/server-errors.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,mBAAmB,GAC3B,cAAc,GACd,qBAAqB,GACrB,qBAAqB,GACrB,oBAAoB,GACpB,iBAAiB,GACjB,kBAAkB,CAAC;AAEvB,6EAA6E;AAC7E,qBAAa,eAAgB,SAAQ,KAAK;aAEtB,IAAI,EAAE,mBAAmB;gBAAzB,IAAI,EAAE,mBAAmB,EACzC,OAAO,EAAE,MAAM;CAKlB;AAED;;;;;GAKG;AACH,qBAAa,mBAAoB,SAAQ,KAAK;aAE1B,MAAM,EAAE,MAAM;aAEd,IAAI,CAAC,EAAE,SAAS;gBAFhB,MAAM,EAAE,MAAM,EAC9B,OAAO,EAAE,MAAM,EACC,IAAI,CAAC,EAAE,SAAS,YAAA;CAKnC;AAED,qBAAa,wBAAyB,SAAQ,KAAK;aAE/B,SAAS,EAAE,MAAM;aACjB,QAAQ,EAAE,MAAM;aAChB,UAAU,EAAE,MAAM;gBAFlB,SAAS,EAAE,MAAM,EACjB,QAAQ,EAAE,MAAM,EAChB,UAAU,EAAE,MAAM;CAWrC;AAED,qBAAa,qCAAsC,SAAQ,KAAK;aAE5C,SAAS,EAAE,MAAM;aACjB,QAAQ,EAAE,MAAM;aAChB,UAAU,EAAE,MAAM;gBAFlB,SAAS,EAAE,MAAM,EACjB,QAAQ,EAAE,MAAM,EAChB,UAAU,EAAE,MAAM;CASrC;AAED;;;;;GAKG;AACH,qBAAa,oBAAqB,SAAQ,KAAK;gBACjC,OAAO,EAAE,MAAM;CAI5B;AAED;;;;GAIG;AACH,qBAAa,0BAA2B,SAAQ,KAAK;gBACvC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE;CAI3D;AACD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yBAAyB,CAAC"}

package/dist/server-errors.js

@@ -0,0 +1,79 @@
+/** Safe, non-secret state code for deterministic authority recovery copy. */
+export class BorgServerError extends Error {
+    code;
+    constructor(code, message) {
+        super(message);
+        this.code = code;
+        this.name = 'BorgServerError';
+    }
+}
+/**
+ * CR5: a STABLE TYPED non-ok HTTP verdict from a verified server. Carries the raw
+ * status so the seat probe classifies endpoint/protocol-mismatch (404) vs
+ * server-failure (5xx) from the actual code — never a mutable error-text regex.
+ * The message is kept identical to the pre-typed string for call-site parity.
+ */
+export class BorgServerHttpError extends Error {
+    status;
+    code;
+    constructor(status, message, code) {
+        super(message);
+        this.status = status;
+        this.code = code;
+        this.name = 'BorgServerHttpError';
+    }
+}
+export class LocalManageRequiredError extends Error {
+    operation;
+    cubeName;
+    noMutation;
+    constructor(operation, cubeName, noMutation) {
+        super(`[LOCAL-MANAGE-REQUIRED] This session cannot ${operation} because ` +
+            'the selected local client does not have cube management access.\n\n' +
+            'Coordinator and Queen are workflow roles; they do not grant server permissions. ' +
+            `${noMutation} Do not retry this request from this session.\n\n` +
+            'Use a session whose local client already has management access to this cube.');
+        this.operation = operation;
+        this.cubeName = cubeName;
+        this.noMutation = noMutation;
+        this.name = 'LocalManageRequiredError';
+    }
+}
+export class LocalManageCredentialUnavailableError extends Error {
+    operation;
+    cubeName;
+    noMutation;
+    constructor(operation, cubeName, noMutation) {
+        super(`The selected local client credential for cube "${cubeName}" is missing or unreadable. ` +
+            `This session cannot ${operation}. ${noMutation} Restore or re-enroll the selected local ` +
+            'client before retrying.');
+        this.operation = operation;
+        this.cubeName = cubeName;
+        this.noMutation = noMutation;
+        this.name = 'LocalManageCredentialUnavailableError';
+    }
+}
+/**
+ * CR5: a STABLE TYPED terminal trust verdict — the pinned server identity no longer
+ * matches. This is a security boundary: it must be classified from the error TYPE,
+ * never from an error-text regex ("regex classification is not an authority
+ * boundary"). trust-mismatch is terminal (never launch-anyway, never credential-send).
+ */
+export class BorgServerTrustError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = 'BorgServerTrustError';
+    }
+}
+/**
+ * CR5: a STABLE TYPED transport-failure verdict — the server was unreachable
+ * (connection refused/reset, DNS failure) or the request timed out. Distinct from
+ * an HTTP status; genuinely transient.
+ */
+export class BorgServerUnreachableError extends Error {
+    constructor(message, options) {
+        super(message, options);
+        this.name = 'BorgServerUnreachableError';
+    }
+}
+//# sourceMappingURL=server-errors.js.map

package/dist/server-errors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"server-errors.js","sourceRoot":"","sources":["../src/server-errors.ts"],"names":[],"mappings":"AAQA,6EAA6E;AAC7E,MAAM,OAAO,eAAgB,SAAQ,KAAK;IAEtB;IADlB,YACkB,IAAyB,EACzC,OAAe;QAEf,KAAK,CAAC,OAAO,CAAC,CAAC;QAHC,SAAI,GAAJ,IAAI,CAAqB;QAIzC,IAAI,CAAC,IAAI,GAAG,iBAAiB,CAAC;IAChC,CAAC;CACF;AAED;;;;;GAKG;AACH,MAAM,OAAO,mBAAoB,SAAQ,KAAK;IAE1B;IAEA;IAHlB,YACkB,MAAc,EAC9B,OAAe,EACC,IAAgB;QAEhC,KAAK,CAAC,OAAO,CAAC,CAAC;QAJC,WAAM,GAAN,MAAM,CAAQ;QAEd,SAAI,GAAJ,IAAI,CAAY;QAGhC,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAC;IACpC,CAAC;CACF;AAED,MAAM,OAAO,wBAAyB,SAAQ,KAAK;IAE/B;IACA;IACA;IAHlB,YACkB,SAAiB,EACjB,QAAgB,EAChB,UAAkB;QAElC,KAAK,CACH,+CAA+C,SAAS,WAAW;YACnE,qEAAqE;YACrE,kFAAkF;YAClF,GAAG,UAAU,mDAAmD;YAChE,8EAA8E,CAC/E,CAAC;QAVc,cAAS,GAAT,SAAS,CAAQ;QACjB,aAAQ,GAAR,QAAQ,CAAQ;QAChB,eAAU,GAAV,UAAU,CAAQ;QASlC,IAAI,CAAC,IAAI,GAAG,0BAA0B,CAAC;IACzC,CAAC;CACF;AAED,MAAM,OAAO,qCAAsC,SAAQ,KAAK;IAE5C;IACA;IACA;IAHlB,YACkB,SAAiB,EACjB,QAAgB,EAChB,UAAkB;QAElC,KAAK,CACH,kDAAkD,QAAQ,8BAA8B;YACxF,uBAAuB,SAAS,KAAK,UAAU,2CAA2C;YAC1F,yBAAyB,CAC1B,CAAC;QARc,cAAS,GAAT,SAAS,CAAQ;QACjB,aAAQ,GAAR,QAAQ,CAAQ;QAChB,eAAU,GAAV,UAAU,CAAQ;QAOlC,IAAI,CAAC,IAAI,GAAG,uCAAuC,CAAC;IACtD,CAAC;CACF;AAED;;;;;GAKG;AACH,MAAM,OAAO,oBAAqB,SAAQ,KAAK;IAC7C,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,sBAAsB,CAAC;IACrC,CAAC;CACF;AAED;;;;GAIG;AACH,MAAM,OAAO,0BAA2B,SAAQ,KAAK;IACnD,YAAY,OAAe,EAAE,OAA6B;QACxD,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QACxB,IAAI,CAAC,IAAI,GAAG,4BAA4B,CAAC;IAC3C,CAAC;CACF"}

package/dist/server-handshake.d.ts

@@ -0,0 +1,197 @@
+import { type CreateCubeResponse, type ProtocolTagPreflight, type ServerCapability } from 'borgmcp-shared/protocol';
+import { activatePendingServerEnrollment, clearPendingServerCubeCreation, clearPendingServerEnrollment, getServerCredential, getServerCredentialRecord, getPendingServerEnrollment, getOrCreatePendingServerCubeCreation, getOrCreatePendingServerEnrollment } from './config.js';
+import { activateAndBindSeat, bindPendingSeatToWorktree, scrubPendingSeat, seatRef, type ActivateSeatOutcome, type BindPendingSeatOutcome, type SeatBinding, type SeatOperation as ServerSessionOperation } from './seats.js';
+import { loadBorgServerTrust, type BorgServerTrust } from './server-trust.js';
+export declare const DEFAULT_LOCAL_SERVER_ORIGIN: "https://127.0.0.1:7091";
+type FetchLike = typeof fetch;
+/** Bodyless, non-identifying liveness probe from the shared contract. */
+export declare function probeBorgServer(origin: string, fetchImpl?: FetchLike, timeoutMs?: number): Promise<boolean>;
+/**
+ * Credential-free protocol-tag preflight. After the caller has verified pinned
+ * TLS, confirm the server speaks the exact protocol tag BEFORE any bearer is
+ * created, sent, or a seat attached. Sends NO Authorization header, cookie,
+ * query, or body; rejects redirects; and bounds the response. A tag mismatch,
+ * an extra field, or any transport anomaly fails closed here — no keychain
+ * write and no attach. The bearer is proven only at attach.
+ */
+export declare function preflightBorgServerTag(origin: string, fetchImpl?: FetchLike): Promise<ProtocolTagPreflight>;
+export interface EnrolledServerConnection {
+    token: string;
+    trustIdentity: string;
+    protocol: ProtocolTagPreflight;
+    clientId?: string | null;
+    serverCapabilities?: ServerCapability[];
+}
+export interface ResolvedServerAuthority extends BorgServerTrust {
+    token: string;
+}
+export interface NewServerEnrollment extends EnrolledServerConnection {
+    clientId: string;
+    serverCapabilities: ServerCapability[];
+}
+export interface ServerAttachResult {
+    cube: {
+        id: string;
+        name: string;
+    };
+    role: {
+        id: string;
+        name: string;
+        role_class?: 'queen' | 'worker';
+        is_human_seat?: boolean;
+    };
+    drone: {
+        id: string;
+        label: string;
+    };
+    session: {
+        credentialRef: string;
+        sessionId: string;
+        expiresAt: string;
+    };
+    result: 'created' | 'reused';
+}
+/**
+ * Attach an enrolled client principal to one granted cube/role over protocol v2.
+ * The client CSPRNG-generates the session bearer and persists it PENDING in the
+ * OS keychain (keyed by the stable per-seat identity) BEFORE this request, so an
+ * interrupted/lost response is recovered by re-sending the exact same bearer —
+ * the server binds only its digest. A verified `created`/`reused` response
+ * activates that pending record in place; the server never returns a bearer.
+ */
+/**
+ * The PREPARE + network half of an attach, WITHOUT the keychain pending→ACTIVE
+ * transition. The deferred `activate` / `scrubPending` thunks let the cube-lock-
+ * owning orchestration (assimilate) FINALIZE binding-FIRST: write the cubes
+ * binding referencing this exact pending record under the cube lock, THEN call
+ * `activate()` as the single last step. `credentialRef` is the deterministic
+ * per-seat account, known here (before activation) so the binding can reference
+ * it. `scrubPending` compare-and-scrubs ONLY this own pending record on a
+ * FINALIZE abort.
+ */
+export interface PreparedServerAttach {
+    cube: ServerAttachResult['cube'];
+    role: ServerAttachResult['role'];
+    drone: ServerAttachResult['drone'];
+    session: {
+        sessionId: string;
+        expiresAt: string;
+    };
+    result: 'created' | 'reused';
+    credentialRef: string;
+    pendingBearerDigest: string;
+    /** The single-store ATOMIC activate+bind (CR#2 collapse): given the worktree
+     *  binding + display (known only at FINALIZE), stamp the exact digest-matched
+     *  PENDING record ACTIVE and bind the worktree in ONE commit. Returns the typed
+     *  outcome (`activated`/`missing`/`replaced`) — never throws for a race. */
+    activate: (binding: SeatBinding) => Promise<ActivateSeatOutcome>;
+    scrubPending: () => Promise<boolean>;
+    /** CR#2: bind the EXACT digest-matched PENDING record to the preserved worktree
+     *  WITHOUT activating (it stays pending). Invoked by the activation-failure path so
+     *  the preserved sibling worktree owns a discoverable, resumable pending record —
+     *  the rerun FROM there re-derives the exact ref and re-sends the identical bearer
+     *  (ghost-free convergence). Fail-closed typed outcome; never throws for a race. */
+    bindPending: (binding: SeatBinding) => Promise<BindPendingSeatOutcome>;
+}
+/**
+ * The NETWORK-ONLY half of an attach: POST the ALREADY-MINTED pending bearer and
+ * decode, WITHOUT minting (the mint is owned by the single-store prepareSeat, CR#1).
+ * Returns the deferred activate/scrubPending handles: FINALIZE calls `activate`
+ * with the decided worktree binding, and activateAndBindSeat stamps ACTIVE + binds
+ * the worktree in ONE atomic commit (activate+bind merged — no cross-store gap).
+ */
+export declare function sendBorgServerAttach(origin: string, trustIdentity: string, parentCredential: string, request: {
+    cubeId: string;
+    roleId: string;
+    operation: ServerSessionOperation;
+    priorDroneId?: string;
+}, pendingBearer: string, deps?: {
+    fetchImpl?: FetchLike;
+    activateAndBind?: typeof activateAndBindSeat;
+    bindPending?: typeof bindPendingSeatToWorktree;
+    scrubPending?: typeof scrubPendingSeat;
+    sessionCredentialRef?: typeof seatRef;
+}): Promise<PreparedServerAttach>;
+/**
+ * Redeem one invitation after the caller has verified TLS and derived the
+ * stable server/CA identity. The client-generated bearer + retry key are
+ * persisted PENDING in the local 0600 file store before the first request. A
+ * transport-ambiguous exchange is retried with that exact tuple; only a decoded
+ * response followed by an authenticated protocol proof activates the bearer.
+ */
+export declare function enrollBorgServer(origin: string, trustIdentity: string, invitation: string, deps?: {
+    fetchImpl?: FetchLike;
+    prepareEnrollment?: typeof getOrCreatePendingServerEnrollment;
+    activateEnrollment?: typeof activatePendingServerEnrollment;
+    clearPendingEnrollment?: typeof clearPendingServerEnrollment;
+    clientName?: string;
+}): Promise<NewServerEnrollment>;
+/** Resume an exact durable enrollment tuple without asking for the invitation again. */
+export declare function resumeBorgServerEnrollment(origin: string, trustIdentity: string, deps?: {
+    fetchImpl?: FetchLike;
+    loadPendingEnrollment?: typeof getPendingServerEnrollment;
+    activateEnrollment?: typeof activatePendingServerEnrollment;
+    clearPendingEnrollment?: typeof clearPendingServerEnrollment;
+    onPending?: () => void;
+}): Promise<NewServerEnrollment | null>;
+/**
+ * Create one repository cube through the narrow owner capability. The retry
+ * key is persisted in the OS keychain before network I/O and reused exactly
+ * after an ambiguous transport result. Ordinary clients are denied locally
+ * before any create request is sent.
+ */
+export declare function createBorgServerCube(origin: string, trustIdentity: string, parentCredential: string, input: {
+    projectRoot: string;
+    name: string;
+}, deps?: {
+    fetchImpl?: FetchLike;
+    loadCredentialRecord?: typeof getServerCredentialRecord;
+    prepareCubeCreation?: typeof getOrCreatePendingServerCubeCreation;
+    clearCubeCreation?: typeof clearPendingServerCubeCreation;
+}): Promise<CreateCubeResponse>;
+export declare function createLocalBorgServerCube(origin: string, trustIdentity: string, parentCredential: string, input: {
+    projectRoot: string;
+    name: string;
+}, deps?: {
+    loadTrust?: typeof loadBorgServerTrust;
+}): Promise<CreateCubeResponse>;
+/**
+ * Swappable Part-4 integration seam. Trust verification supplies the server/CA
+ * identity; this function then reads only the credential bound to that exact
+ * origin+identity pair and negotiates the authenticated shared contract.
+ */
+export declare function connectEnrolledBorgServer(origin: string, trustIdentity: string, deps?: {
+    loadCredential?: typeof getServerCredential;
+    loadCredentialRecord?: typeof getServerCredentialRecord;
+    fetchImpl?: FetchLike;
+}): Promise<EnrolledServerConnection>;
+/** Resolve the same-user server CA and its authority-bound keychain credential. */
+export declare function resolveBorgServerAuthority(origin: string, deps?: {
+    loadTrust?: typeof loadBorgServerTrust;
+    loadCredential?: typeof getServerCredential;
+    loadCredentialRecord?: typeof getServerCredentialRecord;
+}): Promise<ResolvedServerAuthority>;
+/** Load pinned trust, then prove the stored credential against /api/protocol. */
+export declare function connectLocalBorgServer(origin: string, deps?: {
+    loadTrust?: typeof loadBorgServerTrust;
+    loadCredential?: typeof getServerCredential;
+    loadCredentialRecord?: typeof getServerCredentialRecord;
+}): Promise<EnrolledServerConnection>;
+/** Load and verify the local CA before sending an enrollment invitation. */
+export declare function enrollLocalBorgServer(origin: string, invitation: string, deps?: {
+    loadTrust?: typeof loadBorgServerTrust;
+    prepareEnrollment?: typeof getOrCreatePendingServerEnrollment;
+    activateEnrollment?: typeof activatePendingServerEnrollment;
+    clearPendingEnrollment?: typeof clearPendingServerEnrollment;
+    clientName?: string;
+}): Promise<NewServerEnrollment>;
+/** Load verified trust and resume a prior ambiguous enrollment before prompting. */
+export declare function resumeLocalBorgServerEnrollment(origin: string, deps?: {
+    loadTrust?: typeof loadBorgServerTrust;
+    loadPendingEnrollment?: typeof getPendingServerEnrollment;
+    onPending?: () => void;
+}): Promise<NewServerEnrollment | null>;
+/** Advisory discovery that still verifies the server-owned CA. */
+export declare function probeLocalBorgServer(origin: string): Promise<boolean>;
+export {};
+//# sourceMappingURL=server-handshake.d.ts.map

package/dist/server-handshake.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"server-handshake.d.ts","sourceRoot":"","sources":["../src/server-handshake.ts"],"names":[],"mappings":"AAAA,OAAO,EAgBL,KAAK,kBAAkB,EACvB,KAAK,oBAAoB,EACzB,KAAK,gBAAgB,EACtB,MAAM,yBAAyB,CAAC;AAEjC,OAAO,EACL,+BAA+B,EAC/B,8BAA8B,EAC9B,4BAA4B,EAC5B,mBAAmB,EACnB,yBAAyB,EACzB,0BAA0B,EAC1B,oCAAoC,EACpC,kCAAkC,EAEnC,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,mBAAmB,EACnB,yBAAyB,EACzB,gBAAgB,EAChB,OAAO,EACP,KAAK,mBAAmB,EACxB,KAAK,sBAAsB,EAC3B,KAAK,WAAW,EAChB,KAAK,aAAa,IAAI,sBAAsB,EAC7C,MAAM,YAAY,CAAC;AAGpB,OAAO,EACL,mBAAmB,EACnB,KAAK,eAAe,EACrB,MAAM,mBAAmB,CAAC;AAM3B,eAAO,MAAM,2BAA2B,EAAG,wBAAiC,CAAC;AAE7E,KAAK,SAAS,GAAG,OAAO,KAAK,CAAC;AAM9B,yEAAyE;AACzE,wBAAsB,eAAe,CACnC,MAAM,EAAE,MAAM,EACd,SAAS,GAAE,SAAiB,EAC5B,SAAS,SAAM,GACd,OAAO,CAAC,OAAO,CAAC,CAelB;AAsBD;;;;;;;GAOG;AACH,wBAAsB,sBAAsB,CAC1C,MAAM,EAAE,MAAM,EACd,SAAS,GAAE,SAAiB,GAC3B,OAAO,CAAC,oBAAoB,CAAC,CA2B/B;AAED,MAAM,WAAW,wBAAwB;IACvC,KAAK,EAAE,MAAM,CAAC;IACd,aAAa,EAAE,MAAM,CAAC;IACtB,QAAQ,EAAE,oBAAoB,CAAC;IAC/B,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,kBAAkB,CAAC,EAAE,gBAAgB,EAAE,CAAC;CACzC;AAED,MAAM,WAAW,uBAAwB,SAAQ,eAAe;IAC9D,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,mBAAoB,SAAQ,wBAAwB;IACnE,QAAQ,EAAE,MAAM,CAAC;IACjB,kBAAkB,EAAE,gBAAgB,EAAE,CAAC;CACxC;AAED,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IACnC,IAAI,EAAE;QACJ,EAAE,EAAE,MAAM,CAAC;QACX,IAAI,EAAE,MAAM,CAAC;QACb,UAAU,CAAC,EAAE,OAAO,GAAG,QAAQ,CAAC;QAChC,aAAa,CAAC,EAAE,OAAO,CAAC;KACzB,CAAC;IACF,KAAK,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;IACrC,OAAO,EAAE;QACP,aAAa,EAAE,MAAM,CAAC;QACtB,SAAS,EAAE,MAAM,CAAC;QAClB,SAAS,EAAE,MAAM,CAAC;KACnB,CAAC;IACF,MAAM,EAAE,SAAS,GAAG,QAAQ,CAAC;CAC9B;AAED;;;;;;;GAOG;AACH;;;;;;;;;GASG;AACH,MAAM,WAAW,oBAAoB;IACnC,IAAI,EAAE,kBAAkB,CAAC,MAAM,CAAC,CAAC;IACjC,IAAI,EAAE,kBAAkB,CAAC,MAAM,CAAC,CAAC;IACjC,KAAK,EAAE,kBAAkB,CAAC,OAAO,CAAC,CAAC;IACnC,OAAO,EAAE;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC;IAClD,MAAM,EAAE,SAAS,GAAG,QAAQ,CAAC;IAC7B,aAAa,EAAE,MAAM,CAAC;IACtB,mBAAmB,EAAE,MAAM,CAAC;IAC5B;;;gFAG4E;IAC5E,QAAQ,EAAE,CAAC,OAAO,EAAE,WAAW,KAAK,OAAO,CAAC,mBAAmB,CAAC,CAAC;IACjE,YAAY,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC;IACrC;;;;wFAIoF;IACpF,WAAW,EAAE,CAAC,OAAO,EAAE,WAAW,KAAK,OAAO,CAAC,sBAAsB,CAAC,CAAC;CACxE;AAED;;;;;;GAMG;AACH,wBAAsB,oBAAoB,CACxC,MAAM,EAAE,MAAM,EACd,aAAa,EAAE,MAAM,EACrB,gBAAgB,EAAE,MAAM,EACxB,OAAO,EAAE;IACP,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,sBAAsB,CAAC;IAClC,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB,EACD,aAAa,EAAE,MAAM,EACrB,IAAI,GAAE;IACJ,SAAS,CAAC,EAAE,SAAS,CAAC;IACtB,eAAe,CAAC,EAAE,OAAO,mBAAmB,CAAC;IAC7C,WAAW,CAAC,EAAE,OAAO,yBAAyB,CAAC;IAC/C,YAAY,CAAC,EAAE,OAAO,gBAAgB,CAAC;IACvC,oBAAoB,CAAC,EAAE,OAAO,OAAO,CAAC;CAClC,GACL,OAAO,CAAC,oBAAoB,CAAC,CAgJ/B;AAQD;;;;;;GAMG;AACH,wBAAsB,gBAAgB,CACpC,MAAM,EAAE,MAAM,EACd,aAAa,EAAE,MAAM,EACrB,UAAU,EAAE,MAAM,EAClB,IAAI,GAAE;IACJ,SAAS,CAAC,EAAE,SAAS,CAAC;IACtB,iBAAiB,CAAC,EAAE,OAAO,kCAAkC,CAAC;IAC9D,kBAAkB,CAAC,EAAE,OAAO,+BAA+B,CAAC;IAC5D,sBAAsB,CAAC,EAAE,OAAO,4BAA4B,CAAC;IAC7D,UAAU,CAAC,EAAE,MAAM,CAAC;CAChB,GACL,OAAO,CAAC,mBAAmB,CAAC,CAkF9B;AAED,wFAAwF;AACxF,wBAAsB,0BAA0B,CAC9C,MAAM,EAAE,MAAM,EACd,aAAa,EAAE,MAAM,EACrB,IAAI,GAAE;IACJ,SAAS,CAAC,EAAE,SAAS,CAAC;IACtB,qBAAqB,CAAC,EAAE,OAAO,0BAA0B,CAAC;IAC1D,kBAAkB,CAAC,EAAE,OAAO,+BAA+B,CAAC;IAC5D,sBAAsB,CAAC,EAAE,OAAO,4BAA4B,CAAC;IAC7D,SAAS,CAAC,EAAE,MAAM,IAAI,CAAC;CACnB,GACL,OAAO,CAAC,mBAAmB,GAAG,IAAI,CAAC,CAkBrC;AAED;;;;;GAKG;AACH,wBAAsB,oBAAoB,CACxC,MAAM,EAAE,MAAM,EACd,aAAa,EAAE,MAAM,EACrB,gBAAgB,EAAE,MAAM,EACxB,KAAK,EAAE;IAAE,WAAW,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,EAC5C,IAAI,GAAE;IACJ,SAAS,CAAC,EAAE,SAAS,CAAC;IACtB,oBAAoB,CAAC,EAAE,OAAO,yBAAyB,CAAC;IACxD,mBAAmB,CAAC,EAAE,OAAO,oCAAoC,CAAC;IAClE,iBAAiB,CAAC,EAAE,OAAO,8BAA8B,CAAC;CACtD,GACL,OAAO,CAAC,kBAAkB,CAAC,CAiF7B;AAED,wBAAsB,yBAAyB,CAC7C,MAAM,EAAE,MAAM,EACd,aAAa,EAAE,MAAM,EACrB,gBAAgB,EAAE,MAAM,EACxB,KAAK,EAAE;IAAE,WAAW,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,EAC5C,IAAI,GAAE;IAAE,SAAS,CAAC,EAAE,OAAO,mBAAmB,CAAA;CAAO,GACpD,OAAO,CAAC,kBAAkB,CAAC,CAQ7B;AAED;;;;GAIG;AACH,wBAAsB,yBAAyB,CAC7C,MAAM,EAAE,MAAM,EACd,aAAa,EAAE,MAAM,EACrB,IAAI,GAAE;IACJ,cAAc,CAAC,EAAE,OAAO,mBAAmB,CAAC;IAC5C,oBAAoB,CAAC,EAAE,OAAO,yBAAyB,CAAC;IACxD,SAAS,CAAC,EAAE,SAAS,CAAC;CAClB,GACL,OAAO,CAAC,wBAAwB,CAAC,CA0BnC;AAED,mFAAmF;AACnF,wBAAsB,0BAA0B,CAC9C,MAAM,EAAE,MAAM,EACd,IAAI,GAAE;IACJ,SAAS,CAAC,EAAE,OAAO,mBAAmB,CAAC;IACvC,cAAc,CAAC,EAAE,OAAO,mBAAmB,CAAC;IAC5C,oBAAoB,CAAC,EAAE,OAAO,yBAAyB,CAAC;CACpD,GACL,OAAO,CAAC,uBAAuB,CAAC,CAkBlC;AAED,iFAAiF;AACjF,wBAAsB,sBAAsB,CAC1C,MAAM,EAAE,MAAM,EACd,IAAI,GAAE;IACJ,SAAS,CAAC,EAAE,OAAO,mBAAmB,CAAC;IACvC,cAAc,CAAC,EAAE,OAAO,mBAAmB,CAAC;IAC5C,oBAAoB,CAAC,EAAE,OAAO,yBAAyB,CAAC;CACpD,GACL,OAAO,CAAC,wBAAwB,CAAC,CASnC;AAED,4EAA4E;AAC5E,wBAAsB,qBAAqB,CACzC,MAAM,EAAE,MAAM,EACd,UAAU,EAAE,MAAM,EAClB,IAAI,GAAE;IACJ,SAAS,CAAC,EAAE,OAAO,mBAAmB,CAAC;IACvC,iBAAiB,CAAC,EAAE,OAAO,kCAAkC,CAAC;IAC9D,kBAAkB,CAAC,EAAE,OAAO,+BAA+B,CAAC;IAC5D,sBAAsB,CAAC,EAAE,OAAO,4BAA4B,CAAC;IAC7D,UAAU,CAAC,EAAE,MAAM,CAAC;CAChB,GACL,OAAO,CAAC,mBAAmB,CAAC,CAW9B;AAED,oFAAoF;AACpF,wBAAsB,+BAA+B,CACnD,MAAM,EAAE,MAAM,EACd,IAAI,GAAE;IACJ,SAAS,CAAC,EAAE,OAAO,mBAAmB,CAAC;IACvC,qBAAqB,CAAC,EAAE,OAAO,0BAA0B,CAAC;IAC1D,SAAS,CAAC,EAAE,MAAM,IAAI,CAAC;CACnB,GACL,OAAO,CAAC,mBAAmB,GAAG,IAAI,CAAC,CASrC;AAED,kEAAkE;AAClE,wBAAsB,oBAAoB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAO3E"}