salt-agent-sdk 0.1.0 → 0.19.0

package/dist/identityShare.js

@@ -0,0 +1,308 @@
+"use strict";
+// Identity on Salt, R3 + R4 (design-fleet/runs/2026-09-22-identity/plan.md
+// sections 5, 7, 8): sending a SIGNED SLICE of an agent's own identity
+// sections into a chat as ordinary E2E ciphertext, answering an incoming
+// ask for one, and revoking a disclosure already sent. Builds directly on
+// identity.ts's R1 (the card vocabulary, canonicalizeJcs) and client.ts's
+// R1 identity()/setIdentity() -- this module is what turns those into
+// something an agent can actually SEND.
+//
+// Wire, inside the E2E plaintext, one marker line then (for SLICE) a JSON
+// line:
+//
+//   [[SALT-IDENTITY-SLICE id=01J9…]]
+//   {"sections":[{"key":"bio","value":"Forecasts for any city.","proof":null}],
+//    "signature":"-----BEGIN PGP SIGNATURE-----…"}
+//
+//   [[SALT-IDENTITY-ASK id=01J9… keys=bio,link]]
+//   Mind sharing your bio and link?
+//
+//   [[SALT-IDENTITY-DECLINE id=01J9… ask=01J8…]]
+//
+//   [[SALT-IDENTITY-REVOKE id=01J9…]]
+//
+// `id` on SLICE/DECLINE/REVOKE is that message's OWN id (a fresh
+// crypto.randomUUID()). `ask` (SLICE and DECLINE only) is the id of the
+// SALT-IDENTITY-ASK this message answers -- present only when answering
+// one, so an asker's client can resolve which question got answered. The
+// signature on a SLICE is an OpenPGP ARMORED DETACHED signature
+// (crypto.ts's signDetached), by the sender's own key, over
+// `canonicalizeJcs(sections)` -- the sections array alone, not the whole
+// payload object (identity.ts's canonicalizeJcs is the exact same RFC
+// 8785 canonicalizer salt-api's card signing uses, reused here with an
+// OpenPGP signature standing in for Salt's Ed25519 Web Bot Auth key -- a
+// slice is signed as coming from the agent, never checked by Salt).
+//
+// One id names the WHOLE share, not one recipient's row: `share`'s ledger
+// is per-RECIPIENT (salt-api keys a row on subject + recipient + id), but
+// a single `id`, generated ONCE per share() call, is posted for every
+// recipient's row -- so the one wire message's `id=`, the message_id
+// PATCHed onto every row, and `revoke(id)` (which revokes every row under
+// that id in one call) all refer to the same share, regardless of how
+// many recipients it went to.
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.IDENTITY_MARKER_PREFIX = void 0;
+exports.parseIdentityMarker = parseIdentityMarker;
+exports.formatIdentityAsk = formatIdentityAsk;
+exports.formatIdentitySlice = formatIdentitySlice;
+exports.formatIdentityDecline = formatIdentityDecline;
+exports.formatIdentityRevoke = formatIdentityRevoke;
+exports.createIdentitySharer = createIdentitySharer;
+const node_crypto_1 = require("node:crypto");
+const pgp = __importStar(require("./crypto"));
+const identity_js_1 = require("./identity.js");
+const ids_js_1 = require("./ids.js");
+// --- Wire markers ----------------------------------------------------------
+/** Every SALT-IDENTITY-* marker starts with this -- webhook.ts checks it before attempting the more specific parse, the same way it gates on delegations.FLOOR_REQUEST_MARKER. */
+exports.IDENTITY_MARKER_PREFIX = "[[SALT-IDENTITY-";
+const ID_RE = /^[A-Za-z0-9_-]{1,64}$/;
+const KEY_RE = /^[a-z0-9_]{1,64}$/;
+const MARKER_RE = /^\[\[SALT-IDENTITY-(ASK|SLICE|DECLINE|REVOKE)([^\]\n]*)\]\]\n?/;
+function parseAttrs(raw) {
+    const attrs = {};
+    for (const pair of raw.trim().split(/\s+/).filter(Boolean)) {
+        const eq = pair.indexOf("=");
+        if (eq > 0)
+            attrs[pair.slice(0, eq)] = pair.slice(eq + 1);
+    }
+    return attrs;
+}
+/**
+ * Parses one SALT-IDENTITY-* marker (plus, for SLICE, its JSON line) out of
+ * a decrypted plaintext. Returns null for anything that isn't one of these
+ * four markers, or that starts as one but is malformed (a bad id, an ASK
+ * with no keys, a SLICE whose JSON doesn't parse into {sections,
+ * signature}) -- webhook.ts treats either case as "starts with the prefix
+ * but nothing usable came out of it" and drops the message rather than
+ * guessing.
+ */
+function parseIdentityMarker(plaintext) {
+    const match = MARKER_RE.exec(plaintext || "");
+    if (!match)
+        return null;
+    const attrs = parseAttrs(match[2]);
+    const id = attrs.id || "";
+    if (!ID_RE.test(id))
+        return null;
+    const rest = plaintext.slice(match[0].length);
+    switch (match[1]) {
+        case "ASK": {
+            const keys = (attrs.keys || "")
+                .split(",")
+                .map((k) => k.trim())
+                .filter(Boolean);
+            if (keys.length === 0)
+                return null;
+            const text = rest.trim();
+            return { kind: "ask", id, keys, text: text || undefined };
+        }
+        case "SLICE": {
+            let parsed;
+            try {
+                parsed = JSON.parse(rest);
+            }
+            catch {
+                return null;
+            }
+            const payload = parsed;
+            if (!payload || !Array.isArray(payload.sections) || typeof payload.signature !== "string")
+                return null;
+            return { kind: "slice", id, askId: attrs.ask, payload: payload };
+        }
+        case "DECLINE":
+            return { kind: "decline", id, askId: attrs.ask };
+        case "REVOKE":
+            return { kind: "revoke", id };
+        default:
+            return null;
+    }
+}
+/** `[[SALT-IDENTITY-ASK id=… keys=k1,k2]]`, optionally followed by a text line. */
+function formatIdentityAsk(id, keys, text) {
+    if (!ID_RE.test(id))
+        throw new Error("identity ask needs an id of letters, digits, _ or -.");
+    const clean = keys.map((k) => k.trim()).filter(Boolean);
+    if (clean.length === 0)
+        throw new Error("identity ask needs at least one section key.");
+    const line = `[[SALT-IDENTITY-ASK id=${id} keys=${clean.join(",")}]]`;
+    const body = (text || "").trim();
+    return body ? `${line}\n${body}` : line;
+}
+/** `[[SALT-IDENTITY-SLICE id=… [ask=…]]]` followed by the {sections, signature} JSON line. */
+function formatIdentitySlice(id, sections, signature, askId) {
+    if (!ID_RE.test(id))
+        throw new Error("identity slice needs an id of letters, digits, _ or -.");
+    const attrs = askId ? `id=${id} ask=${askId}` : `id=${id}`;
+    return `[[SALT-IDENTITY-SLICE ${attrs}]]\n${JSON.stringify({ sections, signature })}`;
+}
+/** `[[SALT-IDENTITY-DECLINE id=… [ask=…]]]`. */
+function formatIdentityDecline(id, askId) {
+    if (!ID_RE.test(id))
+        throw new Error("identity decline needs an id of letters, digits, _ or -.");
+    return askId ? `[[SALT-IDENTITY-DECLINE id=${id} ask=${askId}]]` : `[[SALT-IDENTITY-DECLINE id=${id}]]`;
+}
+/** `[[SALT-IDENTITY-REVOKE id=…]]`. */
+function formatIdentityRevoke(id) {
+    if (!ID_RE.test(id))
+        throw new Error("identity revoke needs an id of letters, digits, _ or -.");
+    return `[[SALT-IDENTITY-REVOKE id=${id}]]`;
+}
+async function recipientMembers(client, caller, chatId) {
+    const members = await client.getChatMembers(caller.apiKey, chatId);
+    return members.filter((m) => !(0, ids_js_1.sameId)(m.id, caller.saltAppId) && !m.observer);
+}
+async function encryptToMembers(caller, members, plaintext) {
+    const recipientKeys = members.filter((m) => !!m.public_key).map((m) => m.public_key);
+    if (recipientKeys.length === 0)
+        throw new Error("No one in this chat has a usable public key -- nothing was sent.");
+    const message = await pgp.encryptFor(plaintext, recipientKeys);
+    const senderMessage = await pgp.encryptFor(plaintext, [caller.publicKey]);
+    return { message, senderMessage };
+}
+/** Builds the {share, ask, decline, disclosures, revoke} surface bound to one client. */
+function createIdentitySharer(client, pgpPassphrase) {
+    async function share(caller, chatId, keys, opts = {}) {
+        const wanted = (keys || []).map((k) => k.trim()).filter(Boolean);
+        if (wanted.length === 0)
+            throw new Error("identity.share needs at least one section key.");
+        for (const key of wanted) {
+            if (!KEY_RE.test(key))
+                throw new Error(`identity.share: "${key}" is not a valid section key -- nothing was sent.`);
+        }
+        const recipients = await recipientMembers(client, caller, chatId);
+        if (recipients.length === 0)
+            throw new Error("No one to share with in this chat -- nothing was sent.");
+        // This agent's own sections. A key the agent has never stated is
+        // refused locally, before any ledger row is written. A section scoped
+        // to nobody is NOT refused: since 0.87.0 the share IS the grant -- the
+        // ledger row salt-api writes for this recipient is what admits them.
+        const mine = await client.identity(caller.apiKey);
+        const byKey = new Map(mine.sections.map((s) => [s.key, s]));
+        const sections = wanted.map((key) => {
+            const section = byKey.get(key);
+            if (!section || section.value == null) {
+                throw new Error(`identity.share: "${key}" is not a section this agent has -- nothing was sent.`);
+            }
+            const proof = section.kind === "proof" ? (section.checked_by ? { by: section.checked_by } : true) : null;
+            return { key, value: section.value, proof };
+        });
+        // One id for the WHOLE share -- posted as every recipient's ledger row
+        // (salt-api keys a row on subject + recipient + id, so the same id
+        // across recipients is exactly what creates one row each, not a
+        // collision), BEFORE any ciphertext, aborting on the first refusal
+        // (plan section 8's "0 bytes of section value reach the server" holds
+        // either way: this sends section KEYS, never a value). No claimed
+        // scope: a share may mix public and private sections, and salt-api
+        // records the narrowest real scope after the grant (0.86.1, 0.87.0).
+        const id = (0, node_crypto_1.randomUUID)();
+        for (const member of recipients) {
+            await client.postIdentityDisclosure(caller.apiKey, {
+                id,
+                section_keys: wanted,
+                chat_id: chatId,
+                recipient_id: member.id,
+            });
+        }
+        const signature = await pgp.signDetached((0, identity_js_1.canonicalizeJcs)(sections), caller.privateKey, pgpPassphrase);
+        const plaintext = formatIdentitySlice(id, sections, signature, opts.ask);
+        const { message, senderMessage } = await encryptToMembers(caller, recipients, plaintext);
+        const posted = (await client.postMessage(caller.apiKey, chatId, message, senderMessage));
+        const messageId = (posted?.message_id ?? posted?.id);
+        try {
+            // One id, one PATCH -- it reaches every row under it.
+            await client.setIdentityDisclosureMessage(caller.apiKey, id, messageId);
+        }
+        catch {
+            // Best-effort: the slice is already sent and readable either way; a
+            // failed PATCH only means the ledger is missing the message_id it
+            // would otherwise carry.
+        }
+        return { id, messageId, recipients: recipients.map((m) => m.id) };
+    }
+    async function ask(caller, chatId, keys, text) {
+        const wanted = (keys || []).map((k) => k.trim()).filter(Boolean);
+        if (wanted.length === 0)
+            throw new Error("identity.ask needs at least one section key.");
+        const chat = await client.getChat(caller.apiKey, chatId);
+        if (!chat.users || chat.users.length !== 2) {
+            throw new Error("identity.ask can only be sent in a 1:1 chat -- nothing was sent.");
+        }
+        const id = (0, node_crypto_1.randomUUID)();
+        const plaintext = formatIdentityAsk(id, wanted, text);
+        const others = chat.users.filter((u) => !(0, ids_js_1.sameId)(u.id, caller.saltAppId));
+        const { message, senderMessage } = await encryptToMembers(caller, others, plaintext);
+        await client.postMessage(caller.apiKey, chatId, message, senderMessage);
+        return id;
+    }
+    async function decline(caller, chatId, askId) {
+        const recipients = await recipientMembers(client, caller, chatId);
+        if (recipients.length === 0)
+            throw new Error("No one to decline to in this chat -- nothing was sent.");
+        const id = (0, node_crypto_1.randomUUID)();
+        const plaintext = formatIdentityDecline(id, askId);
+        const { message, senderMessage } = await encryptToMembers(caller, recipients, plaintext);
+        await client.postMessage(caller.apiKey, chatId, message, senderMessage);
+        return { id };
+    }
+    async function disclosures(caller, opts) {
+        const result = await client.listIdentityDisclosures(caller.apiKey, opts);
+        return result.disclosures ?? [];
+    }
+    async function revoke(caller, id) {
+        // Revokes every ledger row under `id` (every recipient) in one call; the
+        // API answers `{disclosures: [...]}`, one row per recipient, all in the
+        // same chat, so one REVOKE marker into that chat covers the share.
+        const { disclosures: rows } = await client.revokeIdentityDisclosure(caller.apiKey, id);
+        const chatId = rows[0]?.chat_id;
+        const plaintext = formatIdentityRevoke(id);
+        try {
+            if (chatId) {
+                const recipients = await recipientMembers(client, caller, chatId);
+                if (recipients.length > 0) {
+                    const { message, senderMessage } = await encryptToMembers(caller, recipients, plaintext);
+                    await client.postMessage(caller.apiKey, chatId, message, senderMessage);
+                }
+            }
+        }
+        catch {
+            // Best-effort: the rows are revoked server-side (nothing new will be
+            // served for them) even if telling this chat about it right now failed.
+        }
+        return rows;
+    }
+    return { share, ask, decline, disclosures, revoke };
+}
+//# sourceMappingURL=identityShare.js.map

package/dist/identityShare.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"identityShare.js","sourceRoot":"","sources":["../src/identityShare.ts"],"names":[],"mappings":";AAAA,2EAA2E;AAC3E,uEAAuE;AACvE,yEAAyE;AACzE,0EAA0E;AAC1E,0EAA0E;AAC1E,sEAAsE;AACtE,wCAAwC;AACxC,EAAE;AACF,0EAA0E;AAC1E,QAAQ;AACR,EAAE;AACF,qCAAqC;AACrC,gFAAgF;AAChF,mDAAmD;AACnD,EAAE;AACF,iDAAiD;AACjD,oCAAoC;AACpC,EAAE;AACF,iDAAiD;AACjD,EAAE;AACF,sCAAsC;AACtC,EAAE;AACF,iEAAiE;AACjE,wEAAwE;AACxE,wEAAwE;AACxE,yEAAyE;AACzE,gEAAgE;AAChE,4DAA4D;AAC5D,yEAAyE;AACzE,sEAAsE;AACtE,uEAAuE;AACvE,yEAAyE;AACzE,oEAAoE;AACpE,EAAE;AACF,0EAA0E;AAC1E,0EAA0E;AAC1E,sEAAsE;AACtE,qEAAqE;AACrE,0EAA0E;AAC1E,sEAAsE;AACtE,8BAA8B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA+C9B,kDAoCC;AAGD,8CAOC;AAGD,kDAIC;AAGD,sDAGC;AAGD,oDAGC;AAyGD,oDAqHC;AA5UD,6CAAyC;AAEzC,8CAAgC;AAChC,+CAAkE;AAElE,qCAA+C;AAE/C,8EAA8E;AAE9E,kLAAkL;AACrK,QAAA,sBAAsB,GAAG,kBAAkB,CAAC;AAEzD,MAAM,KAAK,GAAG,uBAAuB,CAAC;AACtC,MAAM,MAAM,GAAG,mBAAmB,CAAC;AACnC,MAAM,SAAS,GAAG,gEAAgE,CAAC;AAEnF,SAAS,UAAU,CAAC,GAAW;IAC7B,MAAM,KAAK,GAA2B,EAAE,CAAC;IACzC,KAAK,MAAM,IAAI,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;QAC3D,MAAM,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC7B,IAAI,EAAE,GAAG,CAAC;YAAE,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;IAC5D,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAaD;;;;;;;;GAQG;AACH,SAAgB,mBAAmB,CAAC,SAAiB;IACnD,MAAM,KAAK,GAAG,SAAS,CAAC,IAAI,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC;IAC9C,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACxB,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IACnC,MAAM,EAAE,GAAG,KAAK,CAAC,EAAE,IAAI,EAAE,CAAC;IAC1B,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QAAE,OAAO,IAAI,CAAC;IACjC,MAAM,IAAI,GAAG,SAAS,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IAE9C,QAAQ,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;QACjB,KAAK,KAAK,CAAC,CAAC,CAAC;YACX,MAAM,IAAI,GAAG,CAAC,KAAK,CAAC,IAAI,IAAI,EAAE,CAAC;iBAC5B,KAAK,CAAC,GAAG,CAAC;iBACV,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;iBACpB,MAAM,CAAC,OAAO,CAAC,CAAC;YACnB,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YACnC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;YACzB,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,IAAI,SAAS,EAAE,CAAC;QAC5D,CAAC;QACD,KAAK,OAAO,CAAC,CAAC,CAAC;YACb,IAAI,MAAe,CAAC;YACpB,IAAI,CAAC;gBACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YAC5B,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,IAAI,CAAC;YACd,CAAC;YACD,MAAM,OAAO,GAAG,MAA8C,CAAC;YAC/D,IAAI,CAAC,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,OAAO,OAAO,CAAC,SAAS,KAAK,QAAQ;gBAAE,OAAO,IAAI,CAAC;YACvG,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,GAAG,EAAE,OAAO,EAAE,OAA+B,EAAE,CAAC;QAC3F,CAAC;QACD,KAAK,SAAS;YACZ,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,GAAG,EAAE,CAAC;QACnD,KAAK,QAAQ;YACX,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;QAChC;YACE,OAAO,IAAI,CAAC;IAChB,CAAC;AACH,CAAC;AAED,mFAAmF;AACnF,SAAgB,iBAAiB,CAAC,EAAU,EAAE,IAAc,EAAE,IAAa;IACzE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;IAC7F,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACxD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;IACxF,MAAM,IAAI,GAAG,0BAA0B,EAAE,SAAS,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC;IACtE,MAAM,IAAI,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACjC,OAAO,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AAC1C,CAAC;AAED,8FAA8F;AAC9F,SAAgB,mBAAmB,CAAC,EAAU,EAAE,QAAuB,EAAE,SAAiB,EAAE,KAAc;IACxG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;IAC/F,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,QAAQ,KAAK,EAAE,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC;IAC3D,OAAO,yBAAyB,KAAK,OAAO,IAAI,CAAC,SAAS,CAAC,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC;AACxF,CAAC;AAED,gDAAgD;AAChD,SAAgB,qBAAqB,CAAC,EAAU,EAAE,KAAc;IAC9D,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAC;IACjG,OAAO,KAAK,CAAC,CAAC,CAAC,8BAA8B,EAAE,QAAQ,KAAK,IAAI,CAAC,CAAC,CAAC,8BAA8B,EAAE,IAAI,CAAC;AAC1G,CAAC;AAED,uCAAuC;AACvC,SAAgB,oBAAoB,CAAC,EAAU;IAC7C,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAC;IAChG,OAAO,6BAA6B,EAAE,IAAI,CAAC;AAC7C,CAAC;AA2FD,KAAK,UAAU,gBAAgB,CAAC,MAAkB,EAAE,MAAqB,EAAE,MAAc;IACvF,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,cAAc,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACnE,OAAO,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAA,eAAM,EAAC,CAAC,CAAC,EAAE,EAAE,MAAM,CAAC,SAAS,CAAC,IAAI,CAAE,CAA4B,CAAC,QAAQ,CAAC,CAAC;AAC3G,CAAC;AAED,KAAK,UAAU,gBAAgB,CAAC,MAAqB,EAAE,OAAuC,EAAE,SAAiB;IAC/G,MAAM,aAAa,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAoB,CAAC,CAAC;IAC/F,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,kEAAkE,CAAC,CAAC;IACpH,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,UAAU,CAAC,SAAS,EAAE,aAAa,CAAC,CAAC;IAC/D,MAAM,aAAa,GAAG,MAAM,GAAG,CAAC,UAAU,CAAC,SAAS,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC;IAC1E,OAAO,EAAE,OAAO,EAAE,aAAa,EAAE,CAAC;AACpC,CAAC;AAED,yFAAyF;AACzF,SAAgB,oBAAoB,CAAC,MAAkB,EAAE,aAAqB;IAC5E,KAAK,UAAU,KAAK,CAAC,MAAqB,EAAE,MAAc,EAAE,IAAc,EAAE,OAAqB,EAAE;QACjG,MAAM,MAAM,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QACjE,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;QAC3F,KAAK,MAAM,GAAG,IAAI,MAAM,EAAE,CAAC;YACzB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,oBAAoB,GAAG,mDAAmD,CAAC,CAAC;QACrH,CAAC;QAED,MAAM,UAAU,GAAG,MAAM,gBAAgB,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;QAClE,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;QAEvG,iEAAiE;QACjE,sEAAsE;QACtE,uEAAuE;QACvE,qEAAqE;QACrE,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAClD,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QAC5D,MAAM,QAAQ,GAAkB,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE;YACjD,MAAM,OAAO,GAAG,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YAC/B,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,KAAK,IAAI,IAAI,EAAE,CAAC;gBACtC,MAAM,IAAI,KAAK,CAAC,oBAAoB,GAAG,wDAAwD,CAAC,CAAC;YACnG,CAAC;YACD,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;YACzG,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,KAAK,EAAE,CAAC;QAC9C,CAAC,CAAC,CAAC;QAEH,uEAAuE;QACvE,mEAAmE;QACnE,gEAAgE;QAChE,mEAAmE;QACnE,sEAAsE;QACtE,kEAAkE;QAClE,mEAAmE;QACnE,qEAAqE;QACrE,MAAM,EAAE,GAAG,IAAA,wBAAU,GAAE,CAAC;QACxB,KAAK,MAAM,MAAM,IAAI,UAAU,EAAE,CAAC;YAChC,MAAM,MAAM,CAAC,sBAAsB,CAAC,MAAM,CAAC,MAAM,EAAE;gBACjD,EAAE;gBACF,YAAY,EAAE,MAAM;gBACpB,OAAO,EAAE,MAAM;gBACf,YAAY,EAAE,MAAM,CAAC,EAAE;aACxB,CAAC,CAAC;QACL,CAAC;QAED,MAAM,SAAS,GAAG,MAAM,GAAG,CAAC,YAAY,CAAC,IAAA,6BAAe,EAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,UAAU,EAAE,aAAa,CAAC,CAAC;QACtG,MAAM,SAAS,GAAG,mBAAmB,CAAC,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;QACzE,MAAM,EAAE,OAAO,EAAE,aAAa,EAAE,GAAG,MAAM,gBAAgB,CAAC,MAAM,EAAE,UAAU,EAAE,SAAS,CAAC,CAAC;QACzF,MAAM,MAAM,GAAG,CAAC,MAAM,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,aAAa,CAAC,CAAgD,CAAC;QACxI,MAAM,SAAS,GAAG,CAAC,MAAM,EAAE,UAAU,IAAI,MAAM,EAAE,EAAE,CAAW,CAAC;QAE/D,IAAI,CAAC;YACH,sDAAsD;YACtD,MAAM,MAAM,CAAC,4BAA4B,CAAC,MAAM,CAAC,MAAM,EAAE,EAAE,EAAE,SAAS,CAAC,CAAC;QAC1E,CAAC;QAAC,MAAM,CAAC;YACP,oEAAoE;YACpE,kEAAkE;YAClE,yBAAyB;QAC3B,CAAC;QAED,OAAO,EAAE,EAAE,EAAE,SAAS,EAAE,UAAU,EAAE,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;IACpE,CAAC;IAED,KAAK,UAAU,GAAG,CAAC,MAAqB,EAAE,MAAc,EAAE,IAAc,EAAE,IAAa;QACrF,MAAM,MAAM,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QACjE,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;QAEzF,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QACzD,IAAI,CAAC,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC3C,MAAM,IAAI,KAAK,CAAC,kEAAkE,CAAC,CAAC;QACtF,CAAC;QAED,MAAM,EAAE,GAAG,IAAA,wBAAU,GAAE,CAAC;QACxB,MAAM,SAAS,GAAG,iBAAiB,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;QACtD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAA,eAAM,EAAC,CAAC,CAAC,EAAE,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC;QACzE,MAAM,EAAE,OAAO,EAAE,aAAa,EAAE,GAAG,MAAM,gBAAgB,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC;QACrF,MAAM,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,aAAa,CAAC,CAAC;QACxE,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,KAAK,UAAU,OAAO,CAAC,MAAqB,EAAE,MAAc,EAAE,KAAc;QAC1E,MAAM,UAAU,GAAG,MAAM,gBAAgB,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;QAClE,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;QACvG,MAAM,EAAE,GAAG,IAAA,wBAAU,GAAE,CAAC;QACxB,MAAM,SAAS,GAAG,qBAAqB,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;QACnD,MAAM,EAAE,OAAO,EAAE,aAAa,EAAE,GAAG,MAAM,gBAAgB,CAAC,MAAM,EAAE,UAAU,EAAE,SAAS,CAAC,CAAC;QACzF,MAAM,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,aAAa,CAAC,CAAC;QACxE,OAAO,EAAE,EAAE,EAAE,CAAC;IAChB,CAAC;IAED,KAAK,UAAU,WAAW,CAAC,MAAqB,EAAE,IAA0C;QAC1F,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,uBAAuB,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QACzE,OAAO,MAAM,CAAC,WAAW,IAAI,EAAE,CAAC;IAClC,CAAC;IAED,KAAK,UAAU,MAAM,CAAC,MAAqB,EAAE,EAAU;QACrD,yEAAyE;QACzE,wEAAwE;QACxE,mEAAmE;QACnE,MAAM,EAAE,WAAW,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,wBAAwB,CAAC,MAAM,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QACvF,MAAM,MAAM,GAAG,IAAI,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC;QAChC,MAAM,SAAS,GAAG,oBAAoB,CAAC,EAAE,CAAC,CAAC;QAC3C,IAAI,CAAC;YACH,IAAI,MAAM,EAAE,CAAC;gBACX,MAAM,UAAU,GAAG,MAAM,gBAAgB,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;gBAClE,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oBAC1B,MAAM,EAAE,OAAO,EAAE,aAAa,EAAE,GAAG,MAAM,gBAAgB,CAAC,MAAM,EAAE,UAAU,EAAE,SAAS,CAAC,CAAC;oBACzF,MAAM,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,aAAa,CAAC,CAAC;gBAC1E,CAAC;YACH,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,qEAAqE;YACrE,wEAAwE;QAC1E,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,CAAC;AACtD,CAAC"}

package/dist/ids.d.ts

@@ -0,0 +1,11 @@
+export type SaltId = string;
+/**
+ * Do two ids name the same record?
+ *
+ * Ids reach this SDK from several places -- a webhook body, a REST response,
+ * an env var, a model's tool call -- and only some of them are guaranteed to
+ * be canonically cased. Comparing through here rather than with `===` keeps a
+ * capitalisation difference from reading as a different record.
+ */
+export declare function sameId(a: unknown, b: unknown): boolean;
+//# sourceMappingURL=ids.d.ts.map

package/dist/ids.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ids.d.ts","sourceRoot":"","sources":["../src/ids.ts"],"names":[],"mappings":"AAYA,MAAM,MAAM,MAAM,GAAG,MAAM,CAAC;AAE5B;;;;;;;GAOG;AACH,wBAAgB,MAAM,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,OAAO,GAAG,OAAO,CAGtD"}

package/dist/ids.js

@@ -0,0 +1,17 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.sameId = sameId;
+/**
+ * Do two ids name the same record?
+ *
+ * Ids reach this SDK from several places -- a webhook body, a REST response,
+ * an env var, a model's tool call -- and only some of them are guaranteed to
+ * be canonically cased. Comparing through here rather than with `===` keeps a
+ * capitalisation difference from reading as a different record.
+ */
+function sameId(a, b) {
+    if (a == null || b == null)
+        return false;
+    return String(a).toLowerCase() === String(b).toLowerCase();
+}
+//# sourceMappingURL=ids.js.map

package/dist/ids.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ids.js","sourceRoot":"","sources":["../src/ids.ts"],"names":[],"mappings":";;AAsBA,wBAGC;AAXD;;;;;;;GAOG;AACH,SAAgB,MAAM,CAAC,CAAU,EAAE,CAAU;IAC3C,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,IAAI;QAAE,OAAO,KAAK,CAAC;IACzC,OAAO,MAAM,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,KAAK,MAAM,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;AAC7D,CAAC"}

package/dist/index.d.ts

@@ -1,8 +1,21 @@
+export * from "./ids";
 export * from "./client";
 export * from "./crypto";
+export * from "./recovery";
+export * from "./identity";
+export * from "./identityShare";
 export * from "./identities";
+export * from "./register";
+export * from "./reconcile";
 export * from "./delegations";
+export * from "./work";
+export * from "./sessions";
+export * from "./scriptJob";
+export * from "./chatPrivacy";
 export * from "./webhook";
+export * from "./ask";
+export * from "./socket";
 export * from "./actions";
 export * from "./config";
+export * from "./device/index.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,UAAU,CAAC;AACzB,cAAc,UAAU,CAAC;AACzB,cAAc,cAAc,CAAC;AAC7B,cAAc,eAAe,CAAC;AAC9B,cAAc,WAAW,CAAC;AAC1B,cAAc,WAAW,CAAC;AAC1B,cAAc,UAAU,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,OAAO,CAAC;AACtB,cAAc,UAAU,CAAC;AACzB,cAAc,UAAU,CAAC;AACzB,cAAc,YAAY,CAAC;AAC3B,cAAc,YAAY,CAAC;AAC3B,cAAc,iBAAiB,CAAC;AAChC,cAAc,cAAc,CAAC;AAC7B,cAAc,YAAY,CAAC;AAC3B,cAAc,aAAa,CAAC;AAC5B,cAAc,eAAe,CAAC;AAC9B,cAAc,QAAQ,CAAC;AACvB,cAAc,YAAY,CAAC;AAC3B,cAAc,aAAa,CAAC;AAC5B,cAAc,eAAe,CAAC;AAC9B,cAAc,WAAW,CAAC;AAC1B,cAAc,OAAO,CAAC;AACtB,cAAc,UAAU,CAAC;AACzB,cAAc,WAAW,CAAC;AAC1B,cAAc,UAAU,CAAC;AACzB,cAAc,mBAAmB,CAAC"}

package/dist/index.js

@@ -14,11 +14,24 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
     for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
 };
 Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("./ids"), exports);
 __exportStar(require("./client"), exports);
 __exportStar(require("./crypto"), exports);
+__exportStar(require("./recovery"), exports);
+__exportStar(require("./identity"), exports);
+__exportStar(require("./identityShare"), exports);
 __exportStar(require("./identities"), exports);
+__exportStar(require("./register"), exports);
+__exportStar(require("./reconcile"), exports);
 __exportStar(require("./delegations"), exports);
+__exportStar(require("./work"), exports);
+__exportStar(require("./sessions"), exports);
+__exportStar(require("./scriptJob"), exports);
+__exportStar(require("./chatPrivacy"), exports);
 __exportStar(require("./webhook"), exports);
+__exportStar(require("./ask"), exports);
+__exportStar(require("./socket"), exports);
 __exportStar(require("./actions"), exports);
 __exportStar(require("./config"), exports);
+__exportStar(require("./device/index.js"), exports);
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,2CAAyB;AACzB,2CAAyB;AACzB,+CAA6B;AAC7B,gDAA8B;AAC9B,4CAA0B;AAC1B,4CAA0B;AAC1B,2CAAyB"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,wCAAsB;AACtB,2CAAyB;AACzB,2CAAyB;AACzB,6CAA2B;AAC3B,6CAA2B;AAC3B,kDAAgC;AAChC,+CAA6B;AAC7B,6CAA2B;AAC3B,8CAA4B;AAC5B,gDAA8B;AAC9B,yCAAuB;AACvB,6CAA2B;AAC3B,8CAA4B;AAC5B,gDAA8B;AAC9B,4CAA0B;AAC1B,wCAAsB;AACtB,2CAAyB;AACzB,4CAA0B;AAC1B,2CAAyB;AACzB,oDAAkC"}

package/dist/reconcile.d.ts

@@ -0,0 +1,25 @@
+import type { SaltClient } from "./client";
+import type { IdentityStore } from "./identities";
+import { type SaltId } from "./ids.js";
+export interface ReconcileLogger {
+    info: (msg: string) => void;
+    error: (msg: string) => void;
+}
+export interface ReconcileResult {
+    /** Identities whose stored id already matched what salt-api reports. */
+    unchanged: number;
+    /** Identities moved to the id salt-api reports for their api key. */
+    reassigned: Array<{
+        username: string;
+        from: SaltId;
+        to: SaltId;
+    }>;
+    /** Identities left exactly as they were because the API could not be asked. */
+    failed: Array<{
+        username: string;
+        saltAppId: SaltId;
+        error: string;
+    }>;
+}
+export declare function reconcileIdentityIds(store: IdentityStore, client: Pick<SaltClient, "whoAmI">, logger?: ReconcileLogger): Promise<ReconcileResult>;
+//# sourceMappingURL=reconcile.d.ts.map

package/dist/reconcile.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"reconcile.d.ts","sourceRoot":"","sources":["../src/reconcile.ts"],"names":[],"mappings":"AAkBA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,UAAU,CAAC;AAC3C,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAClD,OAAO,EAAU,KAAK,MAAM,EAAE,MAAM,UAAU,CAAC;AAE/C,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;IAC5B,KAAK,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;CAC9B;AAED,MAAM,WAAW,eAAe;IAC9B,wEAAwE;IACxE,SAAS,EAAE,MAAM,CAAC;IAClB,qEAAqE;IACrE,UAAU,EAAE,KAAK,CAAC;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAClE,+EAA+E;IAC/E,MAAM,EAAE,KAAK,CAAC;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CACvE;AAED,wBAAsB,oBAAoB,CACxC,KAAK,EAAE,aAAa,EACpB,MAAM,EAAE,IAAI,CAAC,UAAU,EAAE,QAAQ,CAAC,EAClC,MAAM,GAAE,eAA6D,GACpE,OAAO,CAAC,eAAe,CAAC,CA0C1B"}

package/dist/reconcile.js

@@ -0,0 +1,60 @@
+"use strict";
+// Re-key hosted identities to the ids salt-api actually uses for them.
+//
+// Every webhook is routed by Salt id: salt-api puts `agent.id` in
+// X-Salt-Agent-Id and the server finds the signing key with
+// `identities.get(thatId)`. The store, though, holds whatever id was current
+// when the identity was REGISTERED -- an env var, a create response -- and
+// nothing ever revisited it. When salt-api moved every primary key to a uuid
+// (Sep 2026) each hosted identity kept its integer id on disk, every lookup
+// missed, and every message to those agents was rejected as "no signing key"
+// while health checks stayed green: the dot reports liveness, not delivery.
+//
+// So the stored id is a hint and the API is the truth. An api key belongs to
+// exactly one agent, and GET /agents/webhook_secret answers with that agent's
+// canonical id, so confirming an identity is one call. Run this at boot before
+// serving; createWebhookServer also runs it when a lookup misses, so an id
+// change while the process is up heals on the first affected delivery instead
+// of waiting for a restart.
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.reconcileIdentityIds = reconcileIdentityIds;
+const ids_js_1 = require("./ids.js");
+async function reconcileIdentityIds(store, client, logger = { info: console.log, error: console.error }) {
+    const result = { unchanged: 0, reassigned: [], failed: [] };
+    // all() is a snapshot, so re-keying inside the loop is safe.
+    for (const identity of store.all()) {
+        const label = identity.username || String(identity.saltAppId);
+        let canonical;
+        let failure;
+        try {
+            canonical = (await client.whoAmI(identity.apiKey)).agent_id;
+            if (!canonical)
+                failure = "no agent_id in the response";
+        }
+        catch (err) {
+            failure = err.message;
+        }
+        if (failure !== undefined || !canonical) {
+            // A revoked key or an unreachable API is not a reason to touch the
+            // store. The identity stays exactly as it is; deleting or guessing here
+            // would turn a transient outage into lost keys.
+            const error = failure ?? "no agent_id in the response";
+            result.failed.push({ username: label, saltAppId: identity.saltAppId, error });
+            logger.error(`[identities] could not confirm the id of ${label} (${identity.saltAppId}): ${error}`);
+            continue;
+        }
+        if ((0, ids_js_1.sameId)(canonical, identity.saltAppId)) {
+            result.unchanged += 1;
+            continue;
+        }
+        const from = identity.saltAppId;
+        const alreadyRegistered = store.get(canonical) !== undefined;
+        store.reassignId(from, canonical);
+        result.reassigned.push({ username: label, from, to: canonical });
+        logger.info(alreadyRegistered
+            ? `[identities] ${label}: dropped the stale entry under ${from}; already registered as ${canonical}`
+            : `[identities] ${label}: re-keyed ${from} -> ${canonical}`);
+    }
+    return result;
+}
+//# sourceMappingURL=reconcile.js.map

package/dist/reconcile.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"reconcile.js","sourceRoot":"","sources":["../src/reconcile.ts"],"names":[],"mappings":";AAAA,uEAAuE;AACvE,EAAE;AACF,kEAAkE;AAClE,4DAA4D;AAC5D,6EAA6E;AAC7E,2EAA2E;AAC3E,6EAA6E;AAC7E,4EAA4E;AAC5E,6EAA6E;AAC7E,4EAA4E;AAC5E,EAAE;AACF,6EAA6E;AAC7E,8EAA8E;AAC9E,+EAA+E;AAC/E,2EAA2E;AAC3E,8EAA8E;AAC9E,4BAA4B;;AAoB5B,oDA8CC;AA9DD,qCAA+C;AAgBxC,KAAK,UAAU,oBAAoB,CACxC,KAAoB,EACpB,MAAkC,EAClC,SAA0B,EAAE,IAAI,EAAE,OAAO,CAAC,GAAG,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE;IAErE,MAAM,MAAM,GAAoB,EAAE,SAAS,EAAE,CAAC,EAAE,UAAU,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;IAE7E,6DAA6D;IAC7D,KAAK,MAAM,QAAQ,IAAI,KAAK,CAAC,GAAG,EAAE,EAAE,CAAC;QACnC,MAAM,KAAK,GAAG,QAAQ,CAAC,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;QAE9D,IAAI,SAA6B,CAAC;QAClC,IAAI,OAA2B,CAAC;QAChC,IAAI,CAAC;YACH,SAAS,GAAG,CAAC,MAAM,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC;YAC5D,IAAI,CAAC,SAAS;gBAAE,OAAO,GAAG,6BAA6B,CAAC;QAC1D,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,GAAI,GAAa,CAAC,OAAO,CAAC;QACnC,CAAC;QACD,IAAI,OAAO,KAAK,SAAS,IAAI,CAAC,SAAS,EAAE,CAAC;YACxC,mEAAmE;YACnE,wEAAwE;YACxE,gDAAgD;YAChD,MAAM,KAAK,GAAG,OAAO,IAAI,6BAA6B,CAAC;YACvD,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,SAAS,EAAE,QAAQ,CAAC,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC;YAC9E,MAAM,CAAC,KAAK,CAAC,4CAA4C,KAAK,KAAK,QAAQ,CAAC,SAAS,MAAM,KAAK,EAAE,CAAC,CAAC;YACpG,SAAS;QACX,CAAC;QAED,IAAI,IAAA,eAAM,EAAC,SAAS,EAAE,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;YAC1C,MAAM,CAAC,SAAS,IAAI,CAAC,CAAC;YACtB,SAAS;QACX,CAAC;QAED,MAAM,IAAI,GAAG,QAAQ,CAAC,SAAS,CAAC;QAChC,MAAM,iBAAiB,GAAG,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,KAAK,SAAS,CAAC;QAC7D,KAAK,CAAC,UAAU,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;QAClC,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC;QACjE,MAAM,CAAC,IAAI,CACT,iBAAiB;YACf,CAAC,CAAC,gBAAgB,KAAK,mCAAmC,IAAI,2BAA2B,SAAS,EAAE;YACpG,CAAC,CAAC,gBAAgB,KAAK,cAAc,IAAI,OAAO,SAAS,EAAE,CAC9D,CAAC;IACJ,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/recovery.d.ts

@@ -0,0 +1,51 @@
+import type { SaltId } from "./ids.js";
+/** One row of GET /api/v1/recovery_request/incoming, and the body of a `recovery_share_requested` delivery (which adds `type`). */
+export interface RecoveryRequestForGuardian {
+    id: SaltId;
+    requester_id: SaltId;
+    requester_username?: string;
+    requester_display_name?: string;
+    threshold: number | null;
+    collected: number;
+    already_contributed: boolean;
+    /** Armored PGP public key minted by the requester for this attempt alone. */
+    ephemeral_public_key: string;
+    created_at: string;
+    expires_at: string;
+    type?: "recovery_share_requested";
+}
+/** A guardian seat awaiting (or carrying) this account's answer: GET /api/v1/recovery_shares/invitations, and the body of a `recovery_guardian_invited` delivery. */
+export interface RecoveryGuardianInvitation {
+    id: SaltId;
+    status: "pending" | "accepted" | "declined";
+    owner_id: SaltId;
+    owner_username?: string;
+    owner_display_name?: string;
+    threshold: number;
+    created_at: string;
+    type?: "recovery_guardian_invited";
+}
+/** One row of GET /api/v1/recovery_shares/held: a share this guardian holds for `owner_id`. */
+export interface HeldRecoveryShare {
+    owner_id: SaltId;
+    owner_username?: string;
+    owner_display_name?: string;
+    /** Armored PGP message, encrypted to this guardian's public key. */
+    encrypted_share: string;
+    threshold: number;
+}
+/** Re-seal a plaintext share to the requester's ephemeral public key (salt-fe `sealShareForRequester`). */
+export declare function sealShareForRequester(plainShareB64: string, ephemeralPublicKey: string): Promise<string>;
+/**
+ * Open the share held for `ownerId` with the guardian's own key and re-seal
+ * it to the request's ephemeral key. Returns the armor to POST as
+ * `sealed_share`. Throws if no share is held for that owner, or the share
+ * cannot be opened with this key.
+ */
+export declare function resealHeldShare(params: {
+    held: HeldRecoveryShare[];
+    request: Pick<RecoveryRequestForGuardian, "requester_id" | "ephemeral_public_key">;
+    privateKey: string;
+    passphrase: string;
+}): Promise<string>;
+//# sourceMappingURL=recovery.d.ts.map

package/dist/recovery.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"recovery.d.ts","sourceRoot":"","sources":["../src/recovery.ts"],"names":[],"mappings":"AAmCA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,UAAU,CAAC;AAEvC,mIAAmI;AACnI,MAAM,WAAW,0BAA0B;IACzC,EAAE,EAAE,MAAM,CAAC;IACX,YAAY,EAAE,MAAM,CAAC;IACrB,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,SAAS,EAAE,MAAM,CAAC;IAClB,mBAAmB,EAAE,OAAO,CAAC;IAC7B,6EAA6E;IAC7E,oBAAoB,EAAE,MAAM,CAAC;IAC7B,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,CAAC,EAAE,0BAA0B,CAAC;CACnC;AAED,qKAAqK;AACrK,MAAM,WAAW,0BAA0B;IACzC,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,SAAS,GAAG,UAAU,GAAG,UAAU,CAAC;IAC5C,QAAQ,EAAE,MAAM,CAAC;IACjB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,CAAC,EAAE,2BAA2B,CAAC;CACpC;AAED,+FAA+F;AAC/F,MAAM,WAAW,iBAAiB;IAChC,QAAQ,EAAE,MAAM,CAAC;IACjB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,oEAAoE;IACpE,eAAe,EAAE,MAAM,CAAC;IACxB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,2GAA2G;AAC3G,wBAAsB,qBAAqB,CAAC,aAAa,EAAE,MAAM,EAAE,kBAAkB,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAE9G;AAED;;;;;GAKG;AACH,wBAAsB,eAAe,CAAC,MAAM,EAAE;IAC5C,IAAI,EAAE,iBAAiB,EAAE,CAAC;IAC1B,OAAO,EAAE,IAAI,CAAC,0BAA0B,EAAE,cAAc,GAAG,sBAAsB,CAAC,CAAC;IACnF,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;CACpB,GAAG,OAAO,CAAC,MAAM,CAAC,CAMlB"}

package/dist/recovery.js

@@ -0,0 +1,59 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.sealShareForRequester = sealShareForRequester;
+exports.resealHeldShare = resealHeldShare;
+// Social recovery, guardian side (salt-api parity both ways, 2026-10-05: an
+// agent may be a recovery guardian). Mirrors salt-fe's GuardianRequests.jsx
+// and utilities/socialRecovery.js `sealShareForRequester`:
+//
+//   1. The owner sealed a Shamir share to THIS guardian's PGP public key
+//      (GET /api/v1/recovery_shares/held returns the armor).
+//   2. Someone starts a recovery. The guardian learns of it as a
+//      `recovery_share_requested` delivery (webhook or socket outbox) or by
+//      GET /api/v1/recovery_request/incoming; each request carries the
+//      requester's throwaway `ephemeral_public_key`.
+//   3. The guardian opens its share with its OWN key and re-seals the same
+//      plaintext to that ephemeral key, then
+//      POST /api/v1/recovery_requests/:id/contribute { sealed_share }.
+//
+// A seat counts only once the guardian ACCEPTED it
+// (POST /api/v1/recovery_shares/:id/accept); until then Salt holds the share
+// back and the guardian can release nothing.
+//
+// Salt never sees the share. The plaintext is a base64 Shamir share and is
+// re-sealed byte for byte -- do not parse or alter it. Combining shares is the
+// REQUESTER's browser's job; nothing here needs a Shamir implementation.
+//
+// `client.releaseRecoveryShare` takes ONLY a request id and reads the
+// requester and the ephemeral key from Salt's own `incoming` record. Never
+// accept a requester id or an ephemeral key from a delivery body, a prompt
+// or a tool argument: pairing a victim's share with an attacker's key is the
+// whole attack (confused deputy). `resealHeldShare` is exported for hosts
+// that must do the steps themselves; feed it the server's record, nothing else.
+//
+// Checking the request is genuine is the guardian's judgement, exactly as it
+// is for a person ("check with them another way first"): releasing a share to
+// a bogus request is how a stolen session becomes an account recovery. An
+// agent host should gate `releaseRecoveryShare` behind whatever approval its
+// owner configured; this helper does not decide.
+const crypto_js_1 = require("./crypto.js");
+/** Re-seal a plaintext share to the requester's ephemeral public key (salt-fe `sealShareForRequester`). */
+async function sealShareForRequester(plainShareB64, ephemeralPublicKey) {
+    return (0, crypto_js_1.encryptFor)(plainShareB64, [ephemeralPublicKey]);
+}
+/**
+ * Open the share held for `ownerId` with the guardian's own key and re-seal
+ * it to the request's ephemeral key. Returns the armor to POST as
+ * `sealed_share`. Throws if no share is held for that owner, or the share
+ * cannot be opened with this key.
+ */
+async function resealHeldShare(params) {
+    const mine = params.held.find((h) => String(h.owner_id) === String(params.request.requester_id));
+    if (!mine)
+        throw new Error("no share held for this requester");
+    const plain = await (0, crypto_js_1.decrypt)(mine.encrypted_share, params.privateKey, params.passphrase);
+    if (!plain)
+        throw new Error("could not open the held share with this key");
+    return sealShareForRequester(plain, params.request.ephemeral_public_key);
+}
+//# sourceMappingURL=recovery.js.map