teamclaws 1.0.4 → 2.0.1

package/dist/broker.js

@@ -7,20 +7,23 @@ import { assertExactKeys, isObject, normalizeUuid, parsePendingPairing, parseWor
 export class BrokerClient {
     fetcher;
     deviceName;
+    authorization;
     constructor(options = {}) {
         this.fetcher = options.fetcher ?? fetch;
         this.deviceName = options.deviceName ?? hostname;
+        this.authorization = options.authorization;
     }
     currentDeviceName() {
         return normalizedDeviceName(this.deviceName());
     }
-    async servers(accessToken, signal) {
-        const response = await requestJson(this.fetcher, `${API_BASE}servers/?include_inventory=1&include_description=1&include_editable_metadata=1`, {
-            headers: requestHeaders(accessToken),
+    async servers(signal) {
+        const url = `${API_BASE}servers/?include_inventory=1&include_description=1&include_editable_metadata=1`;
+        const response = await requestJson(this.fetcher, url, {
+            headers: await this.issuerHeaders("GET", url),
             ...(signal ? { signal } : {}),
         });
         if (response.status === 401) {
-            throw new TeamClawsError("invalid_authentication", "The TeamClaws login is no longer valid. Run `teamclaws login` to authenticate.", {
+            throw new TeamClawsError("invalid_authentication", "The TeamClaws CLI authorization is inactive. Run `teamclaws login` to authorize this computer again.", {
                 exitCode: 3,
             });
         }
@@ -29,7 +32,7 @@ export class BrokerClient {
         }
         return parseWorkspaceInventory(response.body);
     }
-    async updateServerMetadata(accessToken, serverId, updates, signal) {
+    async updateServerMetadata(serverId, updates, signal) {
         if (Object.keys(updates).length === 0 ||
             (updates.alias !== undefined && [...updates.alias.trim()].length > 100) ||
             (updates.description !== undefined &&
@@ -37,9 +40,10 @@ export class BrokerClient {
             throw new TeamClawsError("invalid_server_metadata", "Provide a name of 100 characters or fewer and/or a description of 2000 characters or fewer.", { exitCode: 2 });
         }
         const id = normalizeUuid(serverId);
-        const response = await requestJson(this.fetcher, `${API_BASE}servers/${id}/metadata/`, {
+        const url = `${API_BASE}servers/${id}/metadata/`;
+        const response = await requestJson(this.fetcher, url, {
             method: "POST",
-            headers: requestHeaders(accessToken),
+            headers: await this.issuerHeaders("POST", url),
             body: updates,
             ...(signal ? { signal } : {}),
         });
@@ -50,11 +54,12 @@ export class BrokerClient {
         assertExactKeys(response.body, ["server"], [], "server metadata response");
         return editableServer(response.body.server, id);
     }
-    async claimMetadataPrompt(accessToken, serverId, signal) {
+    async claimMetadataPrompt(serverId, signal) {
         const id = normalizeUuid(serverId);
-        const response = await requestJson(this.fetcher, `${API_BASE}servers/${id}/metadata-prompt/claim/`, {
+        const url = `${API_BASE}servers/${id}/metadata-prompt/claim/`;
+        const response = await requestJson(this.fetcher, url, {
             method: "POST",
-            headers: requestHeaders(accessToken),
+            headers: await this.issuerHeaders("POST", url),
             body: {},
             ...(signal ? { signal } : {}),
         });
@@ -70,11 +75,18 @@ export class BrokerClient {
             server: editableServer(response.body.server, id),
         };
     }
-    async startPairing(target, accessToken, signal) {
-        const request = pairingStartRequest(target, this.currentDeviceName());
-        const response = await requestJson(this.fetcher, `${API_BASE}pairing/start/`, {
+    async startPairing(target, signal) {
+        if (!this.authorization)
+            throw new TeamClawsError("login_required", "CLI authorization is required for pairing.", { exitCode: 3 });
+        const grant = await this.authorization.requireGrant();
+        const request = pairingStartRequest(target, this.currentDeviceName(), grant);
+        const url = `${API_BASE}pairing/start/`;
+        const response = await requestJson(this.fetcher, url, {
             method: "POST",
-            headers: requestHeaders(accessToken),
+            headers: {
+                ...requestHeaders(),
+                DPoP: await this.authorization.dpop(grant.machine_key, "POST", url),
+            },
             body: request,
             ...(signal ? { signal } : {}),
         });
@@ -91,6 +103,14 @@ export class BrokerClient {
         }
         return pending;
     }
+    async issuerHeaders(method, url) {
+        if (!this.authorization)
+            throw new TeamClawsError("login_required", "CLI authorization is required.", { exitCode: 3 });
+        return {
+            ...requestHeaders(),
+            ...(await this.authorization.accountHeadersFor(method, url)),
+        };
+    }
 }
 function invalidMetadataResponse() {
     return new TeamClawsError("invalid_response", "TeamClaws returned invalid server metadata.", { exitCode: 9 });
@@ -114,7 +134,7 @@ function editableServer(value, expectedId) {
         can_edit_metadata: true,
     };
 }
-export function pairingStartRequest(target, deviceName) {
+export function pairingStartRequest(target, deviceName, grant) {
     return {
         contract_version: CONTRACT_VERSION,
         target,
@@ -122,6 +142,7 @@ export function pairingStartRequest(target, deviceName) {
         device_name: deviceName,
         client_name: CLIENT_NAME,
         client_version: PACKAGE_VERSION,
+        authorization_id: grant.authorization_id,
     };
 }
 export function normalizedDeviceName(value) {
@@ -131,11 +152,9 @@ export function normalizedDeviceName(value) {
         .slice(0, MAX_DEVICE_NAME_LENGTH);
     return normalized || "Unnamed computer";
 }
-function requestHeaders(accessToken) {
+function requestHeaders() {
     const headers = {
         "User-Agent": `${CLIENT_NAME}/${PACKAGE_VERSION}`.slice(0, MAX_CLIENT_LABEL_LENGTH),
     };
-    if (accessToken)
-        headers.Authorization = `Bearer ${accessToken}`;
     return headers;
 }

package/dist/constants.js

@@ -1,11 +1,12 @@
 export const PACKAGE_NAME = "teamclaws";
-export const PACKAGE_VERSION = "1.0.4";
+export const PACKAGE_VERSION = "2.0.1";
 export const CLIENT_NAME = "teamclaws-cli";
 export const CONTRACT_VERSION = 1;
 export const OUTPUT_SCHEMA_VERSION = 1;
 export const TEAMCLAWS_ORIGIN = "https://www.teamclaws.com";
 export const API_RESOURCE = `${TEAMCLAWS_ORIGIN}/api/cli/v1`;
 export const API_BASE = `${API_RESOURCE}/`;
+export const API_V2_BASE = `${TEAMCLAWS_ORIGIN}/api/cli/v2/`;
 export const OAUTH_CLIENT_ID = "teamclaws-cli";
 export const OAUTH_DEVICE_AUTHORIZATION_URL = `${TEAMCLAWS_ORIGIN}/o/device-authorization/`;
 export const OAUTH_TOKEN_URL = `${TEAMCLAWS_ORIGIN}/o/token/`;

package/dist/external-chat.js

@@ -1,7 +1,8 @@
 import { randomUUID } from "node:crypto";
 import { PACKAGE_VERSION } from "./constants.js";
 import { TeamClawsError } from "./errors.js";
-import { errorFromResponse, requestJson, } from "./http.js";
+import { errorFromResponse, } from "./http.js";
+import { TargetAuthorization, requestTargetJson, } from "./target-authorization.js";
 import { isObject, normalizeUuid, parseVerifiedWorkspace, parseVerifiedDevice, requireHttpsUrl, requireInteger, requireString, } from "./validation.js";
 const REQUIRED_SCOPES = new Set([
     "external_chat:capabilities:read",
@@ -27,12 +28,16 @@ export class ExternalChatClient {
     now;
     store;
     output;
+    authorization;
     wait;
     constructor(options) {
         this.fetcher = options.fetcher ?? fetch;
         this.now = options.now ?? (() => performance.now());
         this.store = options.store;
         this.output = options.output;
+        this.authorization =
+            options.authorization ??
+                new TargetAuthorization(this.store, this.fetcher);
         this.wait = options.wait ?? waitFor;
     }
     async capabilities(target, signal) {
@@ -64,9 +69,9 @@ export class ExternalChatClient {
                 ? AbortSignal.any([timeout, signal])
                 : timeout;
             try {
-                const response = await requestJson(this.fetcher, `${credential.origin}/teamclaws-admin/api/device-chat/v1/capabilities/`, {
+                const url = `${credential.origin}/teamclaws-admin/api/device-chat/v1/capabilities/`;
+                const response = await requestTargetJson(this.fetcher, this.authorization, url, credential, {
                     headers: {
-                        Authorization: bearer(credential),
                         "User-Agent": `TeamClaws-CLI/${PACKAGE_VERSION}`,
                     },
                     timeoutMs,
@@ -124,7 +129,7 @@ export class ExternalChatClient {
         const message = validateMessage(options.message, context.capabilities);
         this.output.chatCapabilities(selection);
         const clientRequestId = validUuid(options.clientRequestId ?? randomUUID());
-        const response = await this.request(`${context.credential.origin}/teamclaws-admin/api/device-chat/v1/sessions/`, context.authorization, {
+        const response = await this.request(`${context.credential.origin}/teamclaws-admin/api/device-chat/v1/sessions/`, context.credential, {
             method: "POST",
             body: {
                 client_request_id: clientRequestId,
@@ -150,7 +155,7 @@ export class ExternalChatClient {
         const sessionId = validUuid(options.sessionId);
         const message = validateMessage(options.message, context.capabilities);
         const clientRequestId = validUuid(options.clientRequestId ?? randomUUID());
-        const response = await this.request(`${context.credential.origin}/teamclaws-admin/api/device-chat/v1/sessions/${sessionId}/messages/create/`, context.authorization, {
+        const response = await this.request(`${context.credential.origin}/teamclaws-admin/api/device-chat/v1/sessions/${sessionId}/messages/create/`, context.credential, {
             method: "POST",
             body: { client_request_id: clientRequestId, body_text: message },
         }, [200, 202], signal);
@@ -171,7 +176,7 @@ export class ExternalChatClient {
         const credential = await this.store.findWorkspace(target);
         if (!credential)
             throw new TeamClawsError("re_pair_required", "No saved pairing was found for this workspace. Pair it first.", { exitCode: 3 });
-        const response = await this.request(`${credential.origin}/teamclaws-admin/api/device-pairings/me/`, bearer(credential), {}, [200], signal);
+        const response = await this.request(`${credential.origin}/teamclaws-admin/api/device-pairings/me/`, credential, {}, [200], signal);
         parseVerifiedDevice(response.body, credential.device_id);
         requirePairingScopes(response.body);
         this.output.chatSessionsList(credential, await this.store.listConversations(credential));
@@ -203,8 +208,7 @@ export class ExternalChatClient {
         if (!credential) {
             throw new TeamClawsError("re_pair_required", "No saved pairing was found for this workspace. Pair it first.", { exitCode: 3 });
         }
-        const authorization = bearer(credential);
-        const verifiedResponse = await this.request(`${credential.origin}/teamclaws-admin/api/device-pairings/me/`, authorization, {}, [200], signal);
+        const verifiedResponse = await this.request(`${credential.origin}/teamclaws-admin/api/device-pairings/me/`, credential, {}, [200], signal);
         const verified = parseVerifiedWorkspace(verifiedResponse.body, credential.device_id, credential.origin);
         requirePairingScopes(verifiedResponse.body);
         const handoff = requireReadyHandoff(verified.external_chat_handoff);
@@ -212,14 +216,12 @@ export class ExternalChatClient {
             const result = await this.listInventory(target, signal, credential);
             return {
                 credential,
-                authorization,
                 capabilities: parseCapabilities(result.external_chat_capabilities, true),
             };
         }
-        const capabilityResponse = await this.request(new URL(handoff.capabilities_url, `${credential.origin}/`).toString(), authorization, {}, [200], signal);
+        const capabilityResponse = await this.request(new URL(handoff.capabilities_url, `${credential.origin}/`).toString(), credential, {}, [200], signal);
         return {
             credential,
-            authorization,
             capabilities: parseCapabilities(capabilityResponse.body),
         };
     }
@@ -237,7 +239,7 @@ export class ExternalChatClient {
                     known_revision: String(knownRevision),
                     after_response_message_id: String(responseCursor),
                 });
-                const response = await this.request(`${context.credential.origin}/teamclaws-admin/api/device-chat/v1/requests/${current.requestId}/?${query.toString()}`, context.authorization, {}, [200], signal);
+                const response = await this.request(`${context.credential.origin}/teamclaws-admin/api/device-chat/v1/requests/${current.requestId}/?${query.toString()}`, context.credential, {}, [200], signal);
                 if (!isObject(response.body))
                     throw invalidChatResponse();
                 state = parseRequest(response.body.request, context.credential.origin);
@@ -291,21 +293,22 @@ export class ExternalChatClient {
         this.output.chatRequestFailed(state.sessionId, state.requestId, state.status, code, detail, state.ownerUrl);
         return 1;
     }
-    async request(url, authorization, options, expected, signal) {
+    async request(url, credential, options, expected, signal) {
         for (let attempt = 0; attempt < 3; attempt += 1) {
             try {
-                const response = await requestJson(this.fetcher, url, {
+                const response = await requestTargetJson(this.fetcher, this.authorization, url, credential, {
                     ...options,
                     headers: {
                         ...options.headers,
-                        Authorization: authorization,
                         "User-Agent": `TeamClaws-CLI/${PACKAGE_VERSION}`,
                     },
                     ...(signal ? { signal } : {}),
                 });
                 if (expected.includes(response.status))
                     return response;
-                if (response.status === 429 && attempt < 2) {
+                if (options.method !== "POST" &&
+                    response.status === 429 &&
+                    attempt < 2) {
                     await this.wait(retryAfter(response) * 1_000, signal);
                     continue;
                 }
@@ -314,6 +317,7 @@ export class ExternalChatClient {
             catch (error) {
                 if (error instanceof TeamClawsError &&
                     error.retryable &&
+                    options.method !== "POST" &&
                     attempt < 2 &&
                     !signal?.aborted) {
                     await this.wait((attempt + 1) * 1_000, signal);
@@ -325,9 +329,6 @@ export class ExternalChatClient {
         throw new TeamClawsError("external_chat_failed", "The workspace did not complete the external chat request.", { exitCode: 5 });
     }
 }
-function bearer(credential) {
-    return `Bearer ${credential.device_id}:${credential.device_token}`;
-}
 function requireReadyHandoff(handoff) {
     if (handoff.status === "ready")
         return handoff;

package/dist/http.js

@@ -61,6 +61,8 @@ export async function requestJson(fetcher, url, options = {}) {
         .get("content-type")
         ?.split(";", 1)[0]
         ?.trim();
+    if (response.status === 204)
+        return { status: 204, headers: response.headers, body: null };
     if (contentType !== "application/json") {
         throw new TeamClawsError("invalid_response", "TeamClaws returned a non-JSON response.", {
             exitCode: 9,

package/dist/machine-key.js

@@ -0,0 +1,245 @@
+import { createHash, createPrivateKey, createPublicKey, generateKeyPairSync, randomUUID, sign as signBytes, } from "node:crypto";
+import { execFile as execFileCallback } from "node:child_process";
+import { constants as fsConstants } from "node:fs";
+import { lstat, mkdir, open, link, unlink } from "node:fs/promises";
+import { homedir } from "node:os";
+import { join } from "node:path";
+import { promisify } from "node:util";
+import { TeamClawsError } from "./errors.js";
+const execFile = promisify(execFileCallback);
+export class OsMachineKeyProvider {
+    root;
+    constructor(root) {
+        this.root = root ?? join(homedir(), ".teamclaws");
+    }
+    async create() {
+        if (process.platform === "linux" || process.platform === "darwin")
+            return this.createPosix();
+        if (process.platform !== "win32")
+            throw keyUnavailable();
+        const name = `teamclaws-cli-${randomUUID()}`;
+        const output = await runCng("create", name);
+        let parsed;
+        try {
+            parsed = JSON.parse(output);
+        }
+        catch {
+            throw keyUnavailable();
+        }
+        if (typeof parsed !== "object" ||
+            parsed === null ||
+            !("x" in parsed) ||
+            !("y" in parsed) ||
+            typeof parsed.x !== "string" ||
+            typeof parsed.y !== "string" ||
+            !/^[A-Za-z0-9_-]{43}$/u.test(parsed.x) ||
+            !/^[A-Za-z0-9_-]{43}$/u.test(parsed.y))
+            throw keyUnavailable();
+        const public_jwk = {
+            kty: "EC",
+            crv: "P-256",
+            x: parsed.x,
+            y: parsed.y,
+        };
+        return {
+            provider: "windows-cng",
+            name,
+            public_jwk,
+            jkt: jwkThumbprint(public_jwk),
+        };
+    }
+    async sign(reference, input) {
+        if ((process.platform === "linux" || process.platform === "darwin") &&
+            reference.provider === "posix-file")
+            return this.signPosix(reference, input);
+        if (process.platform !== "win32" || reference.provider !== "windows-cng")
+            throw keyUnavailable();
+        if (!/^teamclaws-cli-[0-9a-f-]{36}$/u.test(reference.name))
+            throw keyUnavailable();
+        const signature = (await runCng("sign", reference.name, input)).trim();
+        if (!/^[A-Za-z0-9_-]{86}$/u.test(signature))
+            throw keyUnavailable();
+        return signature;
+    }
+    keyDirectory() {
+        return join(this.root, "machine-keys");
+    }
+    async privatePosixDirectory() {
+        const directory = this.keyDirectory();
+        try {
+            await mkdir(this.root, { recursive: true, mode: 0o700 });
+            await assertPrivateDirectory(this.root);
+            await mkdir(directory, { recursive: true, mode: 0o700 });
+            await assertPrivateDirectory(directory);
+            return directory;
+        }
+        catch {
+            throw keyUnavailable();
+        }
+    }
+    async createPosix() {
+        const directory = await this.privatePosixDirectory();
+        const name = `teamclaws-cli-${randomUUID()}`;
+        const temporary = join(directory, `.${name}.tmp`);
+        const destination = join(directory, `${name}.pem`);
+        const { privateKey, publicKey } = generateKeyPairSync("ec", {
+            namedCurve: "prime256v1",
+        });
+        const public_jwk = publicKey.export({ format: "jwk" });
+        const pem = privateKey.export({ type: "pkcs8", format: "pem" });
+        let handle;
+        let linked = false;
+        try {
+            handle = await open(temporary, fsConstants.O_CREAT |
+                fsConstants.O_EXCL |
+                fsConstants.O_WRONLY |
+                fsConstants.O_NOFOLLOW, 0o600);
+            await handle.writeFile(pem);
+            await handle.sync();
+            await handle.close();
+            handle = undefined;
+            await assertPrivateFile(temporary);
+            await link(temporary, destination);
+            linked = true;
+            await unlink(temporary);
+            const directoryHandle = await open(directory, fsConstants.O_RDONLY | fsConstants.O_DIRECTORY | fsConstants.O_NOFOLLOW);
+            try {
+                await directoryHandle.sync();
+            }
+            finally {
+                await directoryHandle.close();
+            }
+            return {
+                provider: "posix-file",
+                name,
+                public_jwk,
+                jkt: jwkThumbprint(public_jwk),
+            };
+        }
+        catch {
+            await handle?.close().catch(() => undefined);
+            await unlink(temporary).catch(() => undefined);
+            if (linked)
+                await unlink(destination).catch(() => undefined);
+            throw keyUnavailable();
+        }
+    }
+    async signPosix(reference, input) {
+        if (!/^teamclaws-cli-[0-9a-f-]{36}$/u.test(reference.name))
+            throw keyUnavailable();
+        try {
+            await assertPrivateDirectory(this.root);
+            await assertPrivateDirectory(this.keyDirectory());
+            const path = join(this.keyDirectory(), `${reference.name}.pem`);
+            const handle = await open(path, fsConstants.O_RDONLY | fsConstants.O_NOFOLLOW);
+            let pem;
+            try {
+                const info = await handle.stat();
+                if (!info.isFile() ||
+                    info.uid !== process.getuid?.() ||
+                    (info.mode & 0o777) !== 0o600 ||
+                    info.size > 8192)
+                    throw keyUnavailable();
+                pem = await handle.readFile();
+            }
+            finally {
+                await handle.close();
+            }
+            const privateKey = createPrivateKey(pem);
+            const actualJwk = createPublicKey(privateKey).export({
+                format: "jwk",
+            });
+            if (jwkThumbprint(actualJwk) !== reference.jkt ||
+                actualJwk.x !== reference.public_jwk.x ||
+                actualJwk.y !== reference.public_jwk.y)
+                throw keyUnavailable();
+            return signBytes("sha256", Buffer.from(input, "ascii"), {
+                key: privateKey,
+                dsaEncoding: "ieee-p1363",
+            }).toString("base64url");
+        }
+        catch {
+            throw keyUnavailable();
+        }
+    }
+}
+async function assertPrivateDirectory(path) {
+    const info = await lstat(path);
+    if (!info.isDirectory() ||
+        info.isSymbolicLink() ||
+        info.uid !== process.getuid?.() ||
+        (info.mode & 0o777) !== 0o700)
+        throw keyUnavailable();
+}
+async function assertPrivateFile(path) {
+    const info = await lstat(path);
+    if (!info.isFile() ||
+        info.isSymbolicLink() ||
+        info.uid !== process.getuid?.() ||
+        (info.mode & 0o777) !== 0o600)
+        throw keyUnavailable();
+}
+export function jwkThumbprint(jwk) {
+    return createHash("sha256")
+        .update(JSON.stringify({ crv: jwk.crv, kty: jwk.kty, x: jwk.x, y: jwk.y }), "ascii")
+        .digest("base64url");
+}
+// The named CNG key is scoped to the Windows user and is never exportable.
+// Only public coordinates and signatures leave CNG. No private JWK is serialized.
+const cngScript = String.raw `
+$ErrorActionPreference = 'Stop'
+$provider = [System.Security.Cryptography.CngProvider]::MicrosoftSoftwareKeyStorageProvider
+if ($operation -eq 'create') {
+  $parameters = New-Object System.Security.Cryptography.CngKeyCreationParameters
+  $parameters.Provider = $provider
+  $parameters.KeyUsage = [System.Security.Cryptography.CngKeyUsages]::Signing
+  $parameters.ExportPolicy = [System.Security.Cryptography.CngExportPolicies]::None
+  $key = [System.Security.Cryptography.CngKey]::Create([System.Security.Cryptography.CngAlgorithm]::ECDsaP256, $keyName, $parameters)
+  try {
+    $ecdsa = New-Object System.Security.Cryptography.ECDsaCng($key)
+    try {
+      $point = $ecdsa.ExportParameters($false).Q
+      $x = [Convert]::ToBase64String($point.X).TrimEnd('=').Replace('+','-').Replace('/','_')
+      $y = [Convert]::ToBase64String($point.Y).TrimEnd('=').Replace('+','-').Replace('/','_')
+      Write-Output ('{"x":"' + $x + '","y":"' + $y + '"}')
+    } finally { $ecdsa.Dispose() }
+  } finally { $key.Dispose() }
+} elseif ($operation -eq 'sign') {
+  $key = [System.Security.Cryptography.CngKey]::Open($keyName, $provider)
+  try {
+    $ecdsa = New-Object System.Security.Cryptography.ECDsaCng($key)
+    try {
+      $hash = [System.Security.Cryptography.SHA256]::Create()
+      try { $digest = $hash.ComputeHash([Text.Encoding]::ASCII.GetBytes($signingInput)) }
+      finally { $hash.Dispose() }
+      $signature = $ecdsa.SignHash($digest)
+      Write-Output ([Convert]::ToBase64String($signature).TrimEnd('=').Replace('+','-').Replace('/','_'))
+    } finally { $ecdsa.Dispose() }
+  } finally { $key.Dispose() }
+} else { throw 'Unsupported machine key operation' }
+`;
+async function runCng(operation, name, input) {
+    try {
+        if (!/^(create|sign)$/u.test(operation) ||
+            !/^teamclaws-cli-[0-9a-f-]{36}$/u.test(name) ||
+            (input !== undefined && !/^[A-Za-z0-9_.-]{1,4096}$/u.test(input)))
+            throw keyUnavailable();
+        const script = `$operation='${operation}'\n$keyName='${name}'\n$signingInput='${input ?? ""}'\n${cngScript}`;
+        const { stdout } = await execFile("powershell.exe", [
+            "-NoProfile",
+            "-NonInteractive",
+            "-EncodedCommand",
+            ConvertScript(script),
+        ], { encoding: "utf8", windowsHide: true, maxBuffer: 4096 });
+        return stdout.trim();
+    }
+    catch {
+        throw keyUnavailable();
+    }
+}
+function ConvertScript(script) {
+    return Buffer.from(script, "utf16le").toString("base64");
+}
+function keyUnavailable() {
+    return new TeamClawsError("machine_key_unavailable", "A protected machine key is required for CLI authorization.", { exitCode: 9 });
+}