borgmcp 1.1.15 → 2.0.2

package/dist/server-trust.d.ts

@@ -0,0 +1,14 @@
+export type ServerFetch = typeof fetch;
+export interface BorgServerTrust {
+    identity: string;
+    fetchImpl: ServerFetch;
+}
+/**
+ * Minimal fetch-compatible HTTPS transport bound to one origin and one
+ * explicit local CA. Node's global fetch cannot consume the server-owned CA,
+ * and disabling certificate validation would collapse the authority boundary.
+ */
+export declare function createPinnedServerFetch(origin: string, caCertificate: string): ServerFetch;
+export declare function loadBorgServerTrust(origin: string, dataDirectory?: string): Promise<BorgServerTrust>;
+export declare function __clearServerTrustCacheForTest(): void;
+//# sourceMappingURL=server-trust.d.ts.map

package/dist/server-trust.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"server-trust.d.ts","sourceRoot":"","sources":["../src/server-trust.ts"],"names":[],"mappings":"AA0CA,MAAM,MAAM,WAAW,GAAG,OAAO,KAAK,CAAC;AAEvC,MAAM,WAAW,eAAe;IAC9B,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,WAAW,CAAC;CACxB;AAyFD;;;;GAIG;AACH,wBAAgB,uBAAuB,CAAC,MAAM,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,GAAG,WAAW,CA0E1F;AAED,wBAAsB,mBAAmB,CACvC,MAAM,EAAE,MAAM,EACd,aAAa,SAAwB,GACpC,OAAO,CAAC,eAAe,CAAC,CAoB1B;AAED,wBAAgB,8BAA8B,IAAI,IAAI,CAErD"}

package/dist/server-trust.js

@@ -0,0 +1,225 @@
+import { createHash, timingSafeEqual, X509Certificate } from 'node:crypto';
+import { constants } from 'node:fs';
+import { open } from 'node:fs/promises';
+import { request as httpsRequest } from 'node:https';
+import { homedir } from 'node:os';
+import { join, resolve } from 'node:path';
+import { Readable } from 'node:stream';
+import { BorgServerTrustError } from './server-errors.js';
+// CR5 TLS LATTICE: OpenSSL/Node TLS certificate-verification error codes. A raw
+// CA / cert-chain / SAN failure from the pinned transport is a potential MITM and
+// MUST be a TERMINAL trust-mismatch verdict — never a transient 'restart' blip.
+// Connection refusal / reset / timeout are NOT in here: those stay raw transport
+// errors so the seat probe classifies them as `unreachable` (genuinely transient).
+const TLS_TRUST_ERROR_CODES = new Set([
+    'DEPTH_ZERO_SELF_SIGNED_CERT',
+    'SELF_SIGNED_CERT_IN_CHAIN',
+    'UNABLE_TO_GET_ISSUER_CERT',
+    'UNABLE_TO_GET_ISSUER_CERT_LOCALLY',
+    'UNABLE_TO_VERIFY_LEAF_SIGNATURE',
+    'CERT_UNTRUSTED',
+    'CERT_CHAIN_TOO_LONG',
+    'HOSTNAME_MISMATCH',
+    'ERR_TLS_CERT_ALTNAME_INVALID',
+]);
+/**
+ * True iff `code` is a PINNED-TRANSPORT certificate-verification failure (bad CA,
+ * unverifiable chain, self-signed leaf, expired/not-yet-valid cert, or a SAN /
+ * hostname mismatch). These are terminal trust-mismatch — a restart never fixes a
+ * wrong cert. `CERT_*` covers the OpenSSL verify family (CERT_HAS_EXPIRED,
+ * CERT_NOT_YET_VALID, CERT_REVOKED, …); `ERR_TLS_CERT*` covers Node's SAN check.
+ */
+function isPinnedTransportTrustFailure(code) {
+    if (!code)
+        return false;
+    return (code.startsWith('CERT_') ||
+        code.startsWith('ERR_TLS_CERT') ||
+        TLS_TRUST_ERROR_CODES.has(code));
+}
+const trustCache = new Map();
+function serverDataDirectory() {
+    return resolve(process.env.BORG_SERVER_DATA_DIR ?? join(homedir(), '.borg', 'server'));
+}
+async function readTrustFile(path) {
+    let handle;
+    try {
+        handle = await open(path, constants.O_RDONLY | constants.O_NOFOLLOW);
+    }
+    catch (error) {
+        if (error.code === 'ENOENT') {
+            throw new Error('Borg server trust files were not found');
+        }
+        throw new Error('Borg server trust files could not be opened safely');
+    }
+    try {
+        const metadata = await handle.stat();
+        if (!metadata.isFile() || (metadata.mode & 0o077) !== 0) {
+            throw new Error('Borg server trust files must be private regular files');
+        }
+        if (typeof process.getuid === 'function' && metadata.uid !== process.getuid()) {
+            throw new Error('Borg server trust files must be owned by the current user');
+        }
+        return await handle.readFile('utf8');
+    }
+    finally {
+        await handle.close();
+    }
+}
+function decodeTrustConfig(value) {
+    let parsed;
+    try {
+        parsed = JSON.parse(value);
+    }
+    catch {
+        throw new Error('Borg server trust metadata is invalid');
+    }
+    if (typeof parsed !== 'object' || parsed === null || Array.isArray(parsed)) {
+        throw new Error('Borg server trust metadata is invalid');
+    }
+    const fingerprint = parsed.ca_spki_sha256;
+    if (typeof fingerprint !== 'string' || !/^[a-f0-9]{64}$/i.test(fingerprint)) {
+        throw new Error('Borg server trust metadata is missing a valid CA identity');
+    }
+    return { ca_spki_sha256: fingerprint.toLowerCase() };
+}
+function verifyCaIdentity(certificate, expected) {
+    let parsed;
+    try {
+        parsed = new X509Certificate(certificate);
+    }
+    catch {
+        throw new Error('Borg server CA certificate is invalid');
+    }
+    if (!parsed.ca)
+        throw new Error('Borg server trust anchor is not a CA certificate');
+    const actual = createHash('sha256')
+        .update(parsed.publicKey.export({ type: 'spki', format: 'der' }))
+        .digest();
+    const expectedBytes = Buffer.from(expected, 'hex');
+    if (expectedBytes.length !== actual.length || !timingSafeEqual(actual, expectedBytes)) {
+        throw new Error('Borg server CA certificate does not match its pinned identity');
+    }
+    return `spki-sha256:${actual.toString('hex')}`;
+}
+function responseHeaders(rawHeaders) {
+    const headers = new Headers();
+    for (let index = 0; index < rawHeaders.length; index += 2) {
+        const name = rawHeaders[index];
+        const value = rawHeaders[index + 1];
+        if (name !== undefined && value !== undefined)
+            headers.append(name, value);
+    }
+    return headers;
+}
+function requestBody(value) {
+    if (value === null || value === undefined)
+        return undefined;
+    if (typeof value === 'string')
+        return value;
+    if (value instanceof Uint8Array)
+        return value;
+    if (value instanceof ArrayBuffer)
+        return new Uint8Array(value);
+    throw new Error('Borg server transport received an unsupported request body');
+}
+/**
+ * Minimal fetch-compatible HTTPS transport bound to one origin and one
+ * explicit local CA. Node's global fetch cannot consume the server-owned CA,
+ * and disabling certificate validation would collapse the authority boundary.
+ */
+export function createPinnedServerFetch(origin, caCertificate) {
+    const authority = new URL(origin);
+    if (authority.protocol !== 'https:' || authority.origin !== origin) {
+        throw new Error('Borg server trust requires a canonical HTTPS origin');
+    }
+    return (async (input, init = {}) => {
+        const url = input instanceof Request ? new URL(input.url) : new URL(input.toString());
+        if (url.origin !== authority.origin || url.protocol !== 'https:') {
+            throw new Error('Borg server transport refused a cross-authority request');
+        }
+        if (input instanceof Request) {
+            throw new Error('Borg server transport requires an explicit URL and request options');
+        }
+        if (init.signal?.aborted)
+            throw new DOMException('This operation was aborted', 'AbortError');
+        const body = requestBody(init.body);
+        const headers = new Headers(init.headers);
+        return await new Promise((resolvePromise, rejectPromise) => {
+            const request = httpsRequest({
+                protocol: 'https:',
+                hostname: url.hostname.replace(/^\[(.*)\]$/, '$1'),
+                port: url.port || 443,
+                path: `${url.pathname}${url.search}`,
+                method: init.method ?? 'GET',
+                headers: Object.fromEntries(headers.entries()),
+                ca: caCertificate,
+                rejectUnauthorized: true,
+                minVersion: 'TLSv1.3',
+            }, (incoming) => {
+                const status = incoming.statusCode ?? 500;
+                if (init.redirect === 'error' && status >= 300 && status < 400) {
+                    incoming.resume();
+                    rejectPromise(new Error('Borg server redirect refused'));
+                    return;
+                }
+                const noBody = init.method === 'HEAD' || status === 204 || status === 304;
+                const stream = noBody
+                    ? null
+                    : Readable.toWeb(incoming);
+                if (noBody)
+                    incoming.resume();
+                resolvePromise(new Response(stream, {
+                    status,
+                    statusText: incoming.statusMessage,
+                    headers: responseHeaders(incoming.rawHeaders),
+                }));
+            });
+            const abort = () => {
+                request.destroy(new DOMException('This operation was aborted', 'AbortError'));
+            };
+            init.signal?.addEventListener('abort', abort, { once: true });
+            request.once('close', () => init.signal?.removeEventListener('abort', abort));
+            request.once('error', (error) => {
+                // CR5: a pinned-transport CERT/CA/SAN verification failure is TERMINAL trust
+                // — type it as BorgServerTrustError so the seat probe returns `trust-mismatch`
+                // (never `indeterminate` → "restart"). Connection refusal/reset/timeout carry
+                // a transport errno (or an AbortError) and are rethrown RAW so the probe
+                // classifies them as `unreachable`.
+                const code = error.code;
+                if (isPinnedTransportTrustFailure(code)) {
+                    rejectPromise(new BorgServerTrustError(`Borg server presented a certificate that failed pinned verification (${code})`));
+                    return;
+                }
+                rejectPromise(error);
+            });
+            if (body !== undefined)
+                request.write(body);
+            request.end();
+        });
+    });
+}
+export async function loadBorgServerTrust(origin, dataDirectory = serverDataDirectory()) {
+    const key = `${dataDirectory}\0${origin}`;
+    let pending = trustCache.get(key);
+    if (!pending) {
+        pending = (async () => {
+            const [certificate, configText] = await Promise.all([
+                readTrustFile(join(dataDirectory, 'ca.crt')),
+                readTrustFile(join(dataDirectory, 'server.json')),
+            ]);
+            const config = decodeTrustConfig(configText);
+            const identity = verifyCaIdentity(certificate, config.ca_spki_sha256);
+            return {
+                identity,
+                fetchImpl: createPinnedServerFetch(origin, certificate),
+            };
+        })();
+        trustCache.set(key, pending);
+        pending.catch(() => trustCache.delete(key));
+    }
+    return pending;
+}
+export function __clearServerTrustCacheForTest() {
+    trustCache.clear();
+}
+//# sourceMappingURL=server-trust.js.map

package/dist/server-trust.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"server-trust.js","sourceRoot":"","sources":["../src/server-trust.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC3E,OAAO,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AACpC,OAAO,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AACxC,OAAO,EAAE,OAAO,IAAI,YAAY,EAAE,MAAM,YAAY,CAAC;AACrD,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AACvC,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAE1D,gFAAgF;AAChF,kFAAkF;AAClF,gFAAgF;AAChF,iFAAiF;AACjF,mFAAmF;AACnF,MAAM,qBAAqB,GAAG,IAAI,GAAG,CAAC;IACpC,6BAA6B;IAC7B,2BAA2B;IAC3B,2BAA2B;IAC3B,mCAAmC;IACnC,iCAAiC;IACjC,gBAAgB;IAChB,qBAAqB;IACrB,mBAAmB;IACnB,8BAA8B;CAC/B,CAAC,CAAC;AAEH;;;;;;GAMG;AACH,SAAS,6BAA6B,CAAC,IAAwB;IAC7D,IAAI,CAAC,IAAI;QAAE,OAAO,KAAK,CAAC;IACxB,OAAO,CACL,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC;QACxB,IAAI,CAAC,UAAU,CAAC,cAAc,CAAC;QAC/B,qBAAqB,CAAC,GAAG,CAAC,IAAI,CAAC,CAChC,CAAC;AACJ,CAAC;AAaD,MAAM,UAAU,GAAG,IAAI,GAAG,EAAoC,CAAC;AAE/D,SAAS,mBAAmB;IAC1B,OAAO,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,oBAAoB,IAAI,IAAI,CAAC,OAAO,EAAE,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC;AACzF,CAAC;AAED,KAAK,UAAU,aAAa,CAAC,IAAY;IACvC,IAAI,MAAM,CAAC;IACX,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,QAAQ,GAAG,SAAS,CAAC,UAAU,CAAC,CAAC;IACvE,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YACvD,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;QAC5D,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;IACxE,CAAC;IACD,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;QACrC,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;YACxD,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;QAC3E,CAAC;QACD,IAAI,OAAO,OAAO,CAAC,MAAM,KAAK,UAAU,IAAI,QAAQ,CAAC,GAAG,KAAK,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;YAC9E,MAAM,IAAI,KAAK,CAAC,2DAA2D,CAAC,CAAC;QAC/E,CAAC;QACD,OAAO,MAAM,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACvC,CAAC;YAAS,CAAC;QACT,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;IACvB,CAAC;AACH,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAa;IACtC,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAC7B,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;IAC3D,CAAC;IACD,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3E,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;IAC3D,CAAC;IACD,MAAM,WAAW,GAAI,MAAkC,CAAC,cAAc,CAAC;IACvE,IAAI,OAAO,WAAW,KAAK,QAAQ,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;QAC5E,MAAM,IAAI,KAAK,CAAC,2DAA2D,CAAC,CAAC;IAC/E,CAAC;IACD,OAAO,EAAE,cAAc,EAAE,WAAW,CAAC,WAAW,EAAE,EAAE,CAAC;AACvD,CAAC;AAED,SAAS,gBAAgB,CAAC,WAAmB,EAAE,QAAgB;IAC7D,IAAI,MAAuB,CAAC;IAC5B,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,eAAe,CAAC,WAAW,CAAC,CAAC;IAC5C,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;IAC3D,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;IACpF,MAAM,MAAM,GAAG,UAAU,CAAC,QAAQ,CAAC;SAChC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;SAChE,MAAM,EAAE,CAAC;IACZ,MAAM,aAAa,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;IACnD,IAAI,aAAa,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM,IAAI,CAAC,eAAe,CAAC,MAAM,EAAE,aAAa,CAAC,EAAE,CAAC;QACtF,MAAM,IAAI,KAAK,CAAC,+DAA+D,CAAC,CAAC;IACnF,CAAC;IACD,OAAO,eAAe,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;AACjD,CAAC;AAED,SAAS,eAAe,CAAC,UAAoB;IAC3C,MAAM,OAAO,GAAG,IAAI,OAAO,EAAE,CAAC;IAC9B,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,UAAU,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QAC1D,MAAM,IAAI,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC;QAC/B,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;QACpC,IAAI,IAAI,KAAK,SAAS,IAAI,KAAK,KAAK,SAAS;YAAE,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAC7E,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,WAAW,CAAC,KAAc;IACjC,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC5D,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC5C,IAAI,KAAK,YAAY,UAAU;QAAE,OAAO,KAAK,CAAC;IAC9C,IAAI,KAAK,YAAY,WAAW;QAAE,OAAO,IAAI,UAAU,CAAC,KAAK,CAAC,CAAC;IAC/D,MAAM,IAAI,KAAK,CAAC,4DAA4D,CAAC,CAAC;AAChF,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,uBAAuB,CAAC,MAAc,EAAE,aAAqB;IAC3E,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;IAClC,IAAI,SAAS,CAAC,QAAQ,KAAK,QAAQ,IAAI,SAAS,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;QACnE,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;IACzE,CAAC;IAED,OAAO,CAAC,KAAK,EAAE,KAA6B,EAAE,OAAoB,EAAE,EAAqB,EAAE;QACzF,MAAM,GAAG,GAAG,KAAK,YAAY,OAAO,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC;QACtF,IAAI,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,MAAM,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;YACjE,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAC;QAC7E,CAAC;QACD,IAAI,KAAK,YAAY,OAAO,EAAE,CAAC;YAC7B,MAAM,IAAI,KAAK,CAAC,oEAAoE,CAAC,CAAC;QACxF,CAAC;QACD,IAAI,IAAI,CAAC,MAAM,EAAE,OAAO;YAAE,MAAM,IAAI,YAAY,CAAC,4BAA4B,EAAE,YAAY,CAAC,CAAC;QAE7F,MAAM,IAAI,GAAG,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACpC,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC1C,OAAO,MAAM,IAAI,OAAO,CAAW,CAAC,cAAc,EAAE,aAAa,EAAE,EAAE;YACnE,MAAM,OAAO,GAAG,YAAY,CAAC;gBAC3B,QAAQ,EAAE,QAAQ;gBAClB,QAAQ,EAAE,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,YAAY,EAAE,IAAI,CAAC;gBAClD,IAAI,EAAE,GAAG,CAAC,IAAI,IAAI,GAAG;gBACrB,IAAI,EAAE,GAAG,GAAG,CAAC,QAAQ,GAAG,GAAG,CAAC,MAAM,EAAE;gBACpC,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,KAAK;gBAC5B,OAAO,EAAE,MAAM,CAAC,WAAW,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;gBAC9C,EAAE,EAAE,aAAa;gBACjB,kBAAkB,EAAE,IAAI;gBACxB,UAAU,EAAE,SAAS;aACtB,EAAE,CAAC,QAAQ,EAAE,EAAE;gBACd,MAAM,MAAM,GAAG,QAAQ,CAAC,UAAU,IAAI,GAAG,CAAC;gBAC1C,IAAI,IAAI,CAAC,QAAQ,KAAK,OAAO,IAAI,MAAM,IAAI,GAAG,IAAI,MAAM,GAAG,GAAG,EAAE,CAAC;oBAC/D,QAAQ,CAAC,MAAM,EAAE,CAAC;oBAClB,aAAa,CAAC,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC,CAAC;oBACzD,OAAO;gBACT,CAAC;gBACD,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,KAAK,MAAM,IAAI,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG,CAAC;gBAC1E,MAAM,MAAM,GAAG,MAAM;oBACnB,CAAC,CAAC,IAAI;oBACN,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAA+B,CAAC;gBAC3D,IAAI,MAAM;oBAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;gBAC9B,cAAc,CAAC,IAAI,QAAQ,CAAC,MAAM,EAAE;oBAClC,MAAM;oBACN,UAAU,EAAE,QAAQ,CAAC,aAAa;oBAClC,OAAO,EAAE,eAAe,CAAC,QAAQ,CAAC,UAAU,CAAC;iBAC9C,CAAC,CAAC,CAAC;YACN,CAAC,CAAC,CAAC;YAEH,MAAM,KAAK,GAAG,GAAS,EAAE;gBACvB,OAAO,CAAC,OAAO,CAAC,IAAI,YAAY,CAAC,4BAA4B,EAAE,YAAY,CAAC,CAAC,CAAC;YAChF,CAAC,CAAC;YACF,IAAI,CAAC,MAAM,EAAE,gBAAgB,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;YAC9D,OAAO,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,MAAM,EAAE,mBAAmB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC;YAC9E,OAAO,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE;gBAC9B,6EAA6E;gBAC7E,+EAA+E;gBAC/E,8EAA8E;gBAC9E,yEAAyE;gBACzE,oCAAoC;gBACpC,MAAM,IAAI,GAAI,KAA+B,CAAC,IAAI,CAAC;gBACnD,IAAI,6BAA6B,CAAC,IAAI,CAAC,EAAE,CAAC;oBACxC,aAAa,CACX,IAAI,oBAAoB,CACtB,wEAAwE,IAAI,GAAG,CAChF,CACF,CAAC;oBACF,OAAO;gBACT,CAAC;gBACD,aAAa,CAAC,KAAK,CAAC,CAAC;YACvB,CAAC,CAAC,CAAC;YACH,IAAI,IAAI,KAAK,SAAS;gBAAE,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YAC5C,OAAO,CAAC,GAAG,EAAE,CAAC;QAChB,CAAC,CAAC,CAAC;IACL,CAAC,CAAgB,CAAC;AACpB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,MAAc,EACd,aAAa,GAAG,mBAAmB,EAAE;IAErC,MAAM,GAAG,GAAG,GAAG,aAAa,KAAK,MAAM,EAAE,CAAC;IAC1C,IAAI,OAAO,GAAG,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAClC,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,GAAG,CAAC,KAAK,IAAI,EAAE;YACpB,MAAM,CAAC,WAAW,EAAE,UAAU,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;gBAClD,aAAa,CAAC,IAAI,CAAC,aAAa,EAAE,QAAQ,CAAC,CAAC;gBAC5C,aAAa,CAAC,IAAI,CAAC,aAAa,EAAE,aAAa,CAAC,CAAC;aAClD,CAAC,CAAC;YACH,MAAM,MAAM,GAAG,iBAAiB,CAAC,UAAU,CAAC,CAAC;YAC7C,MAAM,QAAQ,GAAG,gBAAgB,CAAC,WAAW,EAAE,MAAM,CAAC,cAAc,CAAC,CAAC;YACtE,OAAO;gBACL,QAAQ;gBACR,SAAS,EAAE,uBAAuB,CAAC,MAAM,EAAE,WAAW,CAAC;aACxD,CAAC;QACJ,CAAC,CAAC,EAAE,CAAC;QACL,UAAU,CAAC,GAAG,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QAC7B,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9C,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,UAAU,8BAA8B;IAC5C,UAAU,CAAC,KAAK,EAAE,CAAC;AACrB,CAAC"}

package/dist/session-continuity.d.ts

@@ -0,0 +1,33 @@
+import { type ActiveCube } from './cubes.js';
+import { prepareSeatReplacement, promoteSeatReplacement, refreshActiveSeatSession, scrubSeatReplacement, type SeatRecord } from './seats.js';
+export declare const SESSION_RENEWAL_LEAD_MS: number;
+interface AttachOutcome {
+    result: 'created' | 'reused';
+    droneId: string;
+    sessionId: string;
+    expiresAt: string;
+}
+interface SessionContinuityDeps {
+    now(): number;
+    randomCredential(): string;
+    getSeat(ref: string, binding: {
+        origin: string;
+        trustIdentity: string;
+        cubeId: string;
+    }): Promise<SeatRecord | null>;
+    getActive(): Promise<ActiveCube | null>;
+    getParentCredential(origin: string, trustIdentity: string): Promise<string | null>;
+    sendAttach(record: SeatRecord, bearer: string, parentCredential: string): Promise<AttachOutcome>;
+    prepareReplacement: typeof prepareSeatReplacement;
+    refreshSession: typeof refreshActiveSeatSession;
+    promoteReplacement: typeof promoteSeatReplacement;
+    scrubReplacement: typeof scrubSeatReplacement;
+}
+export declare function ensureLocalSessionFresh(active: ActiveCube): Promise<ActiveCube>;
+export declare function recoverExpiredLocalSession(active: ActiveCube): Promise<ActiveCube>;
+/** @internal */
+export declare function __renewLocalSessionForTest(active: ActiveCube, mode: 'proactive' | 'expired', deps: SessionContinuityDeps): Promise<ActiveCube>;
+/** @internal */
+export declare function __resetSessionContinuityForTest(): void;
+export {};
+//# sourceMappingURL=session-continuity.d.ts.map

package/dist/session-continuity.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-continuity.d.ts","sourceRoot":"","sources":["../src/session-continuity.ts"],"names":[],"mappings":"AAEA,OAAO,EAAiB,KAAK,UAAU,EAAE,MAAM,YAAY,CAAC;AAK5D,OAAO,EAEL,sBAAsB,EACtB,sBAAsB,EACtB,wBAAwB,EACxB,oBAAoB,EAEpB,KAAK,UAAU,EAChB,MAAM,YAAY,CAAC;AAEpB,eAAO,MAAM,uBAAuB,QAAa,CAAC;AAElD,UAAU,aAAa;IACrB,MAAM,EAAE,SAAS,GAAG,QAAQ,CAAC;IAC7B,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,UAAU,qBAAqB;IAC7B,GAAG,IAAI,MAAM,CAAC;IACd,gBAAgB,IAAI,MAAM,CAAC;IAC3B,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,aAAa,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CAAC;IACrH,SAAS,IAAI,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CAAC;IACxC,mBAAmB,CAAC,MAAM,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IACnF,UAAU,CAAC,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,gBAAgB,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC;IACjG,kBAAkB,EAAE,OAAO,sBAAsB,CAAC;IAClD,cAAc,EAAE,OAAO,wBAAwB,CAAC;IAChD,kBAAkB,EAAE,OAAO,sBAAsB,CAAC;IAClD,gBAAgB,EAAE,OAAO,oBAAoB,CAAC;CAC/C;AA8ND,wBAAgB,uBAAuB,CAAC,MAAM,EAAE,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC,CAE/E;AAED,wBAAgB,0BAA0B,CAAC,MAAM,EAAE,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC,CAElF;AAED,gBAAgB;AAChB,wBAAgB,0BAA0B,CACxC,MAAM,EAAE,UAAU,EAClB,IAAI,EAAE,WAAW,GAAG,SAAS,EAC7B,IAAI,EAAE,qBAAqB,GAC1B,OAAO,CAAC,UAAU,CAAC,CAErB;AAED,gBAAgB;AAChB,wBAAgB,+BAA+B,IAAI,IAAI,CAEtD"}

package/dist/session-continuity.js

@@ -0,0 +1,220 @@
+import { createHash, randomBytes } from 'node:crypto';
+import { getServerCredential } from './config.js';
+import { getActiveCube } from './cubes.js';
+import { DroneEvictedError } from './drone-lifecycle.js';
+import { sendBorgServerAttach } from './server-handshake.js';
+import { BorgServerError, BorgServerTrustError } from './server-errors.js';
+import { loadBorgServerTrust } from './server-trust.js';
+import { getActiveSeat, prepareSeatReplacement, promoteSeatReplacement, refreshActiveSeatSession, scrubSeatReplacement, seatRef, } from './seats.js';
+export const SESSION_RENEWAL_LEAD_MS = 5 * 60_000;
+const defaultDeps = {
+    now: Date.now,
+    randomCredential: () => randomBytes(32).toString('base64url'),
+    getSeat: getActiveSeat,
+    getActive: getActiveCube,
+    getParentCredential: getServerCredential,
+    async sendAttach(record, bearer, parentCredential) {
+        const trust = await loadBorgServerTrust(record.origin);
+        if (trust.identity !== record.trustIdentity) {
+            throw new BorgServerTrustError('Borg server trust identity changed; refusing session renewal');
+        }
+        const attached = await sendBorgServerAttach(record.origin, record.trustIdentity, parentCredential, {
+            cubeId: record.cubeId,
+            roleId: record.roleId,
+            operation: record.operation,
+            priorDroneId: record.droneId,
+        }, bearer, { fetchImpl: trust.fetchImpl });
+        return {
+            result: attached.result,
+            droneId: attached.drone.id,
+            sessionId: attached.session.sessionId,
+            expiresAt: attached.session.expiresAt,
+        };
+    },
+    prepareReplacement: prepareSeatReplacement,
+    refreshSession: refreshActiveSeatSession,
+    promoteReplacement: promoteSeatReplacement,
+    scrubReplacement: scrubSeatReplacement,
+};
+const inflight = new Map();
+const digestOf = (value) => createHash('sha256').update(value).digest('hex');
+function sameSeat(active, candidate) {
+    return candidate !== null &&
+        candidate.apiUrl === active.apiUrl &&
+        candidate.serverTrustIdentity === active.serverTrustIdentity &&
+        candidate.cubeId === active.cubeId &&
+        candidate.droneId === active.droneId &&
+        candidate.localSessionCredentialRef === active.localSessionCredentialRef;
+}
+function seatBinding(record) {
+    return {
+        origin: record.origin,
+        trustIdentity: record.trustIdentity,
+        cubeId: record.cubeId,
+    };
+}
+function validActiveRecord(active, record) {
+    return record !== null &&
+        record.state === 'active' &&
+        record.origin === active.apiUrl &&
+        record.trustIdentity === active.serverTrustIdentity &&
+        record.cubeId === active.cubeId &&
+        record.droneId === active.droneId &&
+        seatRef(record) === active.localSessionCredentialRef;
+}
+function deterministicAttachFailure(error) {
+    return error instanceof BorgServerError ||
+        error instanceof BorgServerTrustError ||
+        error instanceof DroneEvictedError;
+}
+async function reloadSameSeat(active, deps, requireFreshCredential = false) {
+    const current = await deps.getActive();
+    if (!sameSeat(active, current) || (requireFreshCredential && current.sessionToken === active.sessionToken)) {
+        throw new Error('Session renewal no longer targets the same saved seat');
+    }
+    return current;
+}
+async function performRenewal(active, mode, deps) {
+    if (!active.serverTrustIdentity || !active.localSessionCredentialRef) {
+        throw new Error('Selected Borg server authority state is missing or unreadable');
+    }
+    const binding = {
+        origin: active.apiUrl,
+        trustIdentity: active.serverTrustIdentity,
+        cubeId: active.cubeId,
+    };
+    const record = await deps.getSeat(active.localSessionCredentialRef, binding);
+    if (!validActiveRecord(active, record)) {
+        throw new Error('Session renewal no longer targets the same saved seat');
+    }
+    const activeDigest = digestOf(active.sessionToken);
+    if (digestOf(record.credential) !== activeDigest) {
+        return reloadSameSeat(active, deps, true);
+    }
+    const expiresIn = Date.parse(record.expiresAt) - deps.now();
+    if (mode === 'proactive' && expiresIn > SESSION_RENEWAL_LEAD_MS && record.replacement === undefined) {
+        return active;
+    }
+    const parentCredential = await deps.getParentCredential(record.origin, record.trustIdentity);
+    if (!parentCredential)
+        throw new Error('Selected Borg server parent credential is missing or unreadable');
+    const recordBinding = seatBinding(record);
+    let restoreRequired = mode === 'expired' || expiresIn <= 0 || record.replacement !== undefined;
+    if (!restoreRequired) {
+        let attached = null;
+        try {
+            attached = await deps.sendAttach(record, record.credential, parentCredential);
+        }
+        catch (error) {
+            if (error instanceof BorgServerError && error.code === 'AUTH_EXPIRED') {
+                restoreRequired = true;
+            }
+            else {
+                throw error;
+            }
+        }
+        if (!restoreRequired) {
+            if (!attached)
+                throw new Error('Session renewal returned no result');
+            const renewedExpiry = Date.parse(attached.expiresAt);
+            if (attached.result !== 'reused' ||
+                attached.droneId !== record.droneId ||
+                attached.sessionId !== record.sessionId ||
+                !Number.isFinite(renewedExpiry) ||
+                renewedExpiry <= Date.parse(record.expiresAt)) {
+                throw new Error('Session renewal did not preserve the same saved seat');
+            }
+            const refreshed = await deps.refreshSession({
+                ref: active.localSessionCredentialRef,
+                binding: recordBinding,
+                expectedDroneId: record.droneId,
+                expectedActiveDigest: activeDigest,
+                expectedSessionId: record.sessionId,
+                expiresAt: attached.expiresAt,
+            });
+            if (!refreshed)
+                return reloadSameSeat(active, deps);
+            return reloadSameSeat(active, deps);
+        }
+    }
+    const replacement = await deps.prepareReplacement({
+        ref: active.localSessionCredentialRef,
+        binding: recordBinding,
+        expectedDroneId: record.droneId,
+        expectedActiveDigest: activeDigest,
+        replacementCredential: deps.randomCredential(),
+    });
+    if (!replacement.ok)
+        return reloadSameSeat(active, deps, true);
+    let attached;
+    try {
+        attached = await deps.sendAttach(record, replacement.credential, parentCredential);
+    }
+    catch (error) {
+        if (deterministicAttachFailure(error)) {
+            await deps.scrubReplacement({
+                ref: active.localSessionCredentialRef,
+                binding: recordBinding,
+                expectedActiveDigest: activeDigest,
+                expectedReplacementDigest: replacement.digest,
+            });
+        }
+        throw error;
+    }
+    const restoredExpiry = Date.parse(attached.expiresAt);
+    if ((attached.result !== 'created' && attached.result !== 'reused') ||
+        attached.droneId !== record.droneId ||
+        attached.sessionId === record.sessionId ||
+        !Number.isFinite(restoredExpiry) ||
+        restoredExpiry <= deps.now()) {
+        await deps.scrubReplacement({
+            ref: active.localSessionCredentialRef,
+            binding: recordBinding,
+            expectedActiveDigest: activeDigest,
+            expectedReplacementDigest: replacement.digest,
+        });
+        throw new Error('Session renewal did not preserve the same saved seat');
+    }
+    const promoted = await deps.promoteReplacement({
+        ref: active.localSessionCredentialRef,
+        binding: recordBinding,
+        expectedDroneId: record.droneId,
+        expectedActiveDigest: activeDigest,
+        expectedReplacementDigest: replacement.digest,
+        sessionId: attached.sessionId,
+        expiresAt: attached.expiresAt,
+    });
+    if (promoted !== 'promoted')
+        return reloadSameSeat(active, deps, true);
+    return reloadSameSeat(active, deps, true);
+}
+function renewLocalSession(active, mode, deps) {
+    const key = active.localSessionCredentialRef;
+    if (!key)
+        return Promise.reject(new Error('Selected Borg server authority state is missing or unreadable'));
+    const existing = inflight.get(key);
+    if (existing)
+        return existing;
+    const renewal = performRenewal(active, mode, deps);
+    inflight.set(key, renewal);
+    void renewal.finally(() => {
+        if (inflight.get(key) === renewal)
+            inflight.delete(key);
+    }).catch(() => { });
+    return renewal;
+}
+export function ensureLocalSessionFresh(active) {
+    return renewLocalSession(active, 'proactive', defaultDeps);
+}
+export function recoverExpiredLocalSession(active) {
+    return renewLocalSession(active, 'expired', defaultDeps);
+}
+/** @internal */
+export function __renewLocalSessionForTest(active, mode, deps) {
+    return renewLocalSession(active, mode, deps);
+}
+/** @internal */
+export function __resetSessionContinuityForTest() {
+    inflight.clear();
+}
+//# sourceMappingURL=session-continuity.js.map

package/dist/session-continuity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-continuity.js","sourceRoot":"","sources":["../src/session-continuity.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AACtD,OAAO,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAClD,OAAO,EAAE,aAAa,EAAmB,MAAM,YAAY,CAAC;AAC5D,OAAO,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AACzD,OAAO,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAC7D,OAAO,EAAE,eAAe,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAC3E,OAAO,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AACxD,OAAO,EACL,aAAa,EACb,sBAAsB,EACtB,sBAAsB,EACtB,wBAAwB,EACxB,oBAAoB,EACpB,OAAO,GAER,MAAM,YAAY,CAAC;AAEpB,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,GAAG,MAAM,CAAC;AAsBlD,MAAM,WAAW,GAA0B;IACzC,GAAG,EAAE,IAAI,CAAC,GAAG;IACb,gBAAgB,EAAE,GAAG,EAAE,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC;IAC7D,OAAO,EAAE,aAAa;IACtB,SAAS,EAAE,aAAa;IACxB,mBAAmB,EAAE,mBAAmB;IACxC,KAAK,CAAC,UAAU,CAAC,MAAM,EAAE,MAAM,EAAE,gBAAgB;QAC/C,MAAM,KAAK,GAAG,MAAM,mBAAmB,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACvD,IAAI,KAAK,CAAC,QAAQ,KAAK,MAAM,CAAC,aAAa,EAAE,CAAC;YAC5C,MAAM,IAAI,oBAAoB,CAAC,8DAA8D,CAAC,CAAC;QACjG,CAAC;QACD,MAAM,QAAQ,GAAG,MAAM,oBAAoB,CACzC,MAAM,CAAC,MAAM,EACb,MAAM,CAAC,aAAa,EACpB,gBAAgB,EAChB;YACE,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,YAAY,EAAE,MAAM,CAAC,OAAO;SAC7B,EACD,MAAM,EACN,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,CAC/B,CAAC;QACF,OAAO;YACL,MAAM,EAAE,QAAQ,CAAC,MAAM;YACvB,OAAO,EAAE,QAAQ,CAAC,KAAK,CAAC,EAAE;YAC1B,SAAS,EAAE,QAAQ,CAAC,OAAO,CAAC,SAAS;YACrC,SAAS,EAAE,QAAQ,CAAC,OAAO,CAAC,SAAS;SACtC,CAAC;IACJ,CAAC;IACD,kBAAkB,EAAE,sBAAsB;IAC1C,cAAc,EAAE,wBAAwB;IACxC,kBAAkB,EAAE,sBAAsB;IAC1C,gBAAgB,EAAE,oBAAoB;CACvC,CAAC;AAEF,MAAM,QAAQ,GAAG,IAAI,GAAG,EAA+B,CAAC;AACxD,MAAM,QAAQ,GAAG,CAAC,KAAa,EAAE,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAErF,SAAS,QAAQ,CAAC,MAAkB,EAAE,SAA4B;IAChE,OAAO,SAAS,KAAK,IAAI;QACvB,SAAS,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM;QAClC,SAAS,CAAC,mBAAmB,KAAK,MAAM,CAAC,mBAAmB;QAC5D,SAAS,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM;QAClC,SAAS,CAAC,OAAO,KAAK,MAAM,CAAC,OAAO;QACpC,SAAS,CAAC,yBAAyB,KAAK,MAAM,CAAC,yBAAyB,CAAC;AAC7E,CAAC;AAED,SAAS,WAAW,CAAC,MAAkB;IACrC,OAAO;QACL,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,aAAa,EAAE,MAAM,CAAC,aAAa;QACnC,MAAM,EAAE,MAAM,CAAC,MAAM;KACtB,CAAC;AACJ,CAAC;AAED,SAAS,iBAAiB,CAAC,MAAkB,EAAE,MAAyB;IACtE,OAAO,MAAM,KAAK,IAAI;QACpB,MAAM,CAAC,KAAK,KAAK,QAAQ;QACzB,MAAM,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM;QAC/B,MAAM,CAAC,aAAa,KAAK,MAAM,CAAC,mBAAmB;QACnD,MAAM,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM;QAC/B,MAAM,CAAC,OAAO,KAAK,MAAM,CAAC,OAAO;QACjC,OAAO,CAAC,MAAM,CAAC,KAAK,MAAM,CAAC,yBAAyB,CAAC;AACzD,CAAC;AAED,SAAS,0BAA0B,CAAC,KAAc;IAChD,OAAO,KAAK,YAAY,eAAe;QACrC,KAAK,YAAY,oBAAoB;QACrC,KAAK,YAAY,iBAAiB,CAAC;AACvC,CAAC;AAED,KAAK,UAAU,cAAc,CAC3B,MAAkB,EAClB,IAA2B,EAC3B,sBAAsB,GAAG,KAAK;IAE9B,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC;IACvC,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC,IAAI,CAAC,sBAAsB,IAAI,OAAO,CAAC,YAAY,KAAK,MAAM,CAAC,YAAY,CAAC,EAAE,CAAC;QAC3G,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;IAC3E,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,KAAK,UAAU,cAAc,CAC3B,MAAkB,EAClB,IAA6B,EAC7B,IAA2B;IAE3B,IAAI,CAAC,MAAM,CAAC,mBAAmB,IAAI,CAAC,MAAM,CAAC,yBAAyB,EAAE,CAAC;QACrE,MAAM,IAAI,KAAK,CAAC,+DAA+D,CAAC,CAAC;IACnF,CAAC;IACD,MAAM,OAAO,GAAG;QACd,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,aAAa,EAAE,MAAM,CAAC,mBAAmB;QACzC,MAAM,EAAE,MAAM,CAAC,MAAM;KACtB,CAAC;IACF,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,yBAAyB,EAAE,OAAO,CAAC,CAAC;IAC7E,IAAI,CAAC,iBAAiB,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC;QACvC,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;IAC3E,CAAC;IACD,MAAM,YAAY,GAAG,QAAQ,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;IACnD,IAAI,QAAQ,CAAC,MAAM,CAAC,UAAU,CAAC,KAAK,YAAY,EAAE,CAAC;QACjD,OAAO,cAAc,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IAC5C,CAAC;IACD,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,SAAU,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC7D,IAAI,IAAI,KAAK,WAAW,IAAI,SAAS,GAAG,uBAAuB,IAAI,MAAM,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;QACpG,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,MAAM,gBAAgB,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,aAAa,CAAC,CAAC;IAC7F,IAAI,CAAC,gBAAgB;QAAE,MAAM,IAAI,KAAK,CAAC,iEAAiE,CAAC,CAAC;IAC1G,MAAM,aAAa,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC;IAE1C,IAAI,eAAe,GAAG,IAAI,KAAK,SAAS,IAAI,SAAS,IAAI,CAAC,IAAI,MAAM,CAAC,WAAW,KAAK,SAAS,CAAC;IAC/F,IAAI,CAAC,eAAe,EAAE,CAAC;QACrB,IAAI,QAAQ,GAAyB,IAAI,CAAC;QAC1C,IAAI,CAAC;YACH,QAAQ,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,MAAM,CAAC,UAAU,EAAE,gBAAgB,CAAC,CAAC;QAChF,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,eAAe,IAAI,KAAK,CAAC,IAAI,KAAK,cAAc,EAAE,CAAC;gBACtE,eAAe,GAAG,IAAI,CAAC;YACzB,CAAC;iBAAM,CAAC;gBACN,MAAM,KAAK,CAAC;YACd,CAAC;QACH,CAAC;QACD,IAAI,CAAC,eAAe,EAAE,CAAC;YACrB,IAAI,CAAC,QAAQ;gBAAE,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;YACrE,MAAM,aAAa,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;YACrD,IACE,QAAQ,CAAC,MAAM,KAAK,QAAQ;gBAC5B,QAAQ,CAAC,OAAO,KAAK,MAAM,CAAC,OAAO;gBACnC,QAAQ,CAAC,SAAS,KAAK,MAAM,CAAC,SAAS;gBACvC,CAAC,MAAM,CAAC,QAAQ,CAAC,aAAa,CAAC;gBAC/B,aAAa,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,SAAU,CAAC,EAC9C,CAAC;gBACD,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;YAC1E,CAAC;YACD,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC;gBAC1C,GAAG,EAAE,MAAM,CAAC,yBAAyB;gBACrC,OAAO,EAAE,aAAa;gBACtB,eAAe,EAAE,MAAM,CAAC,OAAQ;gBAChC,oBAAoB,EAAE,YAAY;gBAClC,iBAAiB,EAAE,MAAM,CAAC,SAAU;gBACpC,SAAS,EAAE,QAAQ,CAAC,SAAS;aAC9B,CAAC,CAAC;YACH,IAAI,CAAC,SAAS;gBAAE,OAAO,cAAc,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;YACpD,OAAO,cAAc,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QACtC,CAAC;IACH,CAAC;IAED,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC;QAChD,GAAG,EAAE,MAAM,CAAC,yBAAyB;QACrC,OAAO,EAAE,aAAa;QACtB,eAAe,EAAE,MAAM,CAAC,OAAQ;QAChC,oBAAoB,EAAE,YAAY;QAClC,qBAAqB,EAAE,IAAI,CAAC,gBAAgB,EAAE;KAC/C,CAAC,CAAC;IACH,IAAI,CAAC,WAAW,CAAC,EAAE;QAAE,OAAO,cAAc,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IAE/D,IAAI,QAAuB,CAAC;IAC5B,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,WAAW,CAAC,UAAU,EAAE,gBAAgB,CAAC,CAAC;IACrF,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,0BAA0B,CAAC,KAAK,CAAC,EAAE,CAAC;YACtC,MAAM,IAAI,CAAC,gBAAgB,CAAC;gBAC1B,GAAG,EAAE,MAAM,CAAC,yBAAyB;gBACrC,OAAO,EAAE,aAAa;gBACtB,oBAAoB,EAAE,YAAY;gBAClC,yBAAyB,EAAE,WAAW,CAAC,MAAM;aAC9C,CAAC,CAAC;QACL,CAAC;QACD,MAAM,KAAK,CAAC;IACd,CAAC;IACD,MAAM,cAAc,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;IACtD,IACE,CAAC,QAAQ,CAAC,MAAM,KAAK,SAAS,IAAI,QAAQ,CAAC,MAAM,KAAK,QAAQ,CAAC;QAC/D,QAAQ,CAAC,OAAO,KAAK,MAAM,CAAC,OAAO;QACnC,QAAQ,CAAC,SAAS,KAAK,MAAM,CAAC,SAAS;QACvC,CAAC,MAAM,CAAC,QAAQ,CAAC,cAAc,CAAC;QAChC,cAAc,IAAI,IAAI,CAAC,GAAG,EAAE,EAC5B,CAAC;QACD,MAAM,IAAI,CAAC,gBAAgB,CAAC;YAC1B,GAAG,EAAE,MAAM,CAAC,yBAAyB;YACrC,OAAO,EAAE,aAAa;YACtB,oBAAoB,EAAE,YAAY;YAClC,yBAAyB,EAAE,WAAW,CAAC,MAAM;SAC9C,CAAC,CAAC;QACH,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;IAC1E,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC;QAC7C,GAAG,EAAE,MAAM,CAAC,yBAAyB;QACrC,OAAO,EAAE,aAAa;QACtB,eAAe,EAAE,MAAM,CAAC,OAAQ;QAChC,oBAAoB,EAAE,YAAY;QAClC,yBAAyB,EAAE,WAAW,CAAC,MAAM;QAC7C,SAAS,EAAE,QAAQ,CAAC,SAAS;QAC7B,SAAS,EAAE,QAAQ,CAAC,SAAS;KAC9B,CAAC,CAAC;IACH,IAAI,QAAQ,KAAK,UAAU;QAAE,OAAO,cAAc,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IACvE,OAAO,cAAc,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;AAC5C,CAAC;AAED,SAAS,iBAAiB,CACxB,MAAkB,EAClB,IAA6B,EAC7B,IAA2B;IAE3B,MAAM,GAAG,GAAG,MAAM,CAAC,yBAAyB,CAAC;IAC7C,IAAI,CAAC,GAAG;QAAE,OAAO,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,+DAA+D,CAAC,CAAC,CAAC;IAC5G,MAAM,QAAQ,GAAG,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACnC,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAC;IAC9B,MAAM,OAAO,GAAG,cAAc,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IACnD,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IAC3B,KAAK,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE;QACxB,IAAI,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,OAAO;YAAE,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAC1D,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IACnB,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,MAAkB;IACxD,OAAO,iBAAiB,CAAC,MAAM,EAAE,WAAW,EAAE,WAAW,CAAC,CAAC;AAC7D,CAAC;AAED,MAAM,UAAU,0BAA0B,CAAC,MAAkB;IAC3D,OAAO,iBAAiB,CAAC,MAAM,EAAE,SAAS,EAAE,WAAW,CAAC,CAAC;AAC3D,CAAC;AAED,gBAAgB;AAChB,MAAM,UAAU,0BAA0B,CACxC,MAAkB,EAClB,IAA6B,EAC7B,IAA2B;IAE3B,OAAO,iBAAiB,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;AAC/C,CAAC;AAED,gBAAgB;AAChB,MAAM,UAAU,+BAA+B;IAC7C,QAAQ,CAAC,KAAK,EAAE,CAAC;AACnB,CAAC"}

package/dist/setup-confirm.d.ts

@@ -12,8 +12,8 @@
  *
  * SECURITY (SR-light, gh#818 221c43df): the disclosure lists file PATHS +
  * at most the PUBLIC `BORG_API_URL` — there is NO token/secret in the
- * written config to echo. Tokens live in the AES-256-GCM keychain, and
- * Step-1 runs BEFORE OAuth, so at mutation time no token even exists.
+ * written config to echo. Local credentials live in the local 0600-permission
+ * seat store, and the written config never contains a token or secret.
  */
 export interface ConfigMutationTarget {
     /** Human-readable config file path (tilde form). */
@@ -77,7 +77,7 @@ export declare function parseYesFlag(argv: string[]): boolean;
  *
  * The disclosure + confirm prompt exists to obtain informed consent for the
  * config writes Step-1 performs (gh#818). On a pure refresh — the normal
- * OAuth-refresh re-run where every DETECTED agent CLI already has the full
+ * setup re-run where every DETECTED agent CLI already has the full
  * borg setup (MCP server registered AND every hook write already applied) —
  * there is no mutation to consent to, so the prompt is redundant and skipped.
  *

package/dist/setup-confirm.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"setup-confirm.d.ts","sourceRoot":"","sources":["../src/setup-confirm.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,MAAM,WAAW,oBAAoB;IACnC,oDAAoD;IACpD,IAAI,EAAE,MAAM,CAAC;IACb,2BAA2B;IAC3B,MAAM,EAAE,MAAM,CAAC;CAChB;AAED;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CAAC,IAAI,EAAE;IAC1C,MAAM,EAAE,OAAO,CAAC;IAChB,KAAK,EAAE,OAAO,CAAC;IACf,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB,GAAG,oBAAoB,EAAE,CA6BzB;AAED;;;;GAIG;AACH,wBAAgB,8BAA8B,CAC5C,OAAO,EAAE,oBAAoB,EAAE,GAC9B,MAAM,CAUR;AAED,MAAM,MAAM,eAAe,GAAG,SAAS,GAAG,OAAO,CAAC;AAElD,MAAM,WAAW,yBAAyB;IACxC,sCAAsC;IACtC,KAAK,EAAE,OAAO,CAAC;IACf,sCAAsC;IACtC,GAAG,EAAE,OAAO,CAAC;IACb;;;;OAIG;IACH,OAAO,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC;CACjC;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,qBAAqB,CACzC,IAAI,EAAE,yBAAyB,GAC9B,OAAO,CAAC,eAAe,CAAC,CAK1B;AAED;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAEpD;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE;IACzC,MAAM,EAAE,OAAO,CAAC;IAChB,KAAK,EAAE,OAAO,CAAC;IACf,QAAQ,EAAE,OAAO,CAAC;IAClB,mBAAmB,EAAE,OAAO,CAAC;IAC7B,kBAAkB,EAAE,OAAO,CAAC;IAC5B,qBAAqB,EAAE,OAAO,CAAC;IAC/B,iBAAiB,EAAE,OAAO,CAAC;IAC3B,gBAAgB,EAAE,OAAO,CAAC;CAC3B,GAAG,OAAO,CAMV"}