tr-plugin-auth 0.0.0-stage → 1.0.1

package/src/session-credentials.mjs

@@ -0,0 +1,71 @@
+import crypto from 'node:crypto';
+import jwt from 'jsonwebtoken';
+import bcrypt from 'bcrypt';
+import { loadSecretsSync, saveSecretsSync } from './secrets-gateway.mjs';
+
+export const BCRYPT_COST = 12;
+const keys = { dashboard: 'SESSION_SECRET', 'step-up': 'SESSION_SECRET', collaboration: 'COLLAB_SESSION_SECRET' };
+
+/** Credential operations never expose signing material or use alternate stores. */
+export function createSessionCredentials({ brainDir, load = loadSecretsSync, save = saveSecretsSync } = {}) {
+  if (!brainDir) throw new Error('An explicit auth store is required');
+  const signingKey = purpose => {
+    if (!Object.hasOwn(keys, purpose)) throw new Error('Unsupported token purpose');
+    const value = load(brainDir)[keys[purpose]];
+    if (typeof value !== 'string' || Buffer.byteLength(value) < 32) throw new Error('Required auth signing credential is missing or invalid; initialize it through auth');
+    return value;
+  };
+  return {
+    async registerCollaborationPassword(username, password) {
+      if (typeof username !== 'string' || !/^[A-Za-z0-9_.@-]{1,128}$/.test(username) || typeof password !== 'string' || password.length < 8 || password.length > 4096) throw new Error('Invalid collaboration credential');
+      const hash = await bcrypt.hash(password, BCRYPT_COST);
+      const values = load(brainDir);
+      const hashes = values.collaboration_password_hashes || {};
+      const key = username.toLowerCase();
+      if (Object.hasOwn(hashes, key)) throw new Error('User already exists');
+      values.collaboration_password_hashes = { ...hashes, [key]: hash };
+      save(brainDir, values);
+      return { registered: true };
+    },
+    async verifyCollaborationPassword(username, password) {
+      if (typeof username !== 'string' || typeof password !== 'string' || password.length > 4096) return false;
+      const hashes = load(brainDir).collaboration_password_hashes || {};
+      const hash = Object.hasOwn(hashes, username.toLowerCase()) ? hashes[username.toLowerCase()] : null;
+      return typeof hash === 'string' ? bcrypt.compare(password, hash) : false;
+    },
+    signToken(purpose, payload, { ttlSeconds = 86400 } = {}) {
+      if (!Number.isInteger(ttlSeconds) || ttlSeconds < 15 || ttlSeconds > 604800) throw new Error('Invalid token lifetime');
+      return jwt.sign(payload, signingKey(purpose), { algorithm: 'HS256', expiresIn: ttlSeconds, audience: purpose, issuer: 'total-recall-auth' });
+    },
+    verifyToken(purpose, token) {
+      return jwt.verify(token, signingKey(purpose), { algorithms: ['HS256'], audience: purpose, issuer: 'total-recall-auth' });
+    },
+    dashboardState() {
+      const values = load(brainDir);
+      return { configured: typeof values.dashboard_password_hash === 'string' && values.dashboard_password_hash.length > 0, forcePasswordReset: values.dashboard_force_password_reset === true };
+    },
+    async verifyDashboardPassword(password) {
+      if (typeof password !== 'string' || !password || password.length > 4096) return false;
+      const hash = load(brainDir).dashboard_password_hash;
+      return typeof hash === 'string' && hash.length > 0 ? bcrypt.compare(password, hash) : false;
+    },
+    async setDashboardPassword(password, { forcePasswordReset = false } = {}) {
+      if (typeof password !== 'string' || password.length < 8 || password.length > 4096) throw new Error('Invalid password length');
+      const hash = await bcrypt.hash(password, BCRYPT_COST);
+      // Read after bcrypt; preserve updates completed while hashing. One encrypted commit.
+      const values = load(brainDir);
+      values.dashboard_password_hash = hash;
+      values.dashboard_force_password_reset = forcePasswordReset === true;
+      values.SESSION_SECRET = crypto.randomBytes(32).toString('hex');
+      save(brainDir, values);
+      return { updated: true, sessionsInvalidated: true };
+    },
+    rotateSession(purpose = 'dashboard') {
+      if (!Object.hasOwn(keys, purpose)) throw new Error('Unsupported token purpose');
+      const values = load(brainDir);
+      values[keys[purpose]] = crypto.randomBytes(32).toString('hex');
+      save(brainDir, values);
+      return { rotated: true, key: keys[purpose] };
+    },
+  };
+}

package/src/ssss-store.mjs

@@ -0,0 +1,13 @@
+/** Bind only to an explicitly verified native Total Recall storage contract. */
+import fs from 'node:fs';
+import path from 'node:path';
+import { createRequire } from 'node:module';
+import { pathToFileURL } from 'node:url';
+const require = createRequire(import.meta.url);
+let source;
+if (process.env.TR_PACKAGE_ROOT) {
+  const root = path.resolve(process.env.TR_PACKAGE_ROOT);
+  if (JSON.parse(fs.readFileSync(path.join(root, 'package.json'), 'utf8')).name !== 'total-recall-brain') throw new Error('Invalid native Total Recall host');
+  source = path.join(root, 'src/core/plugin-state-store.mjs');
+} else source = require.resolve('total-recall-brain/src/core/plugin-state-store.mjs');
+export const { PluginStateStore } = await import(pathToFileURL(source).href);

package/src/stdin.mjs

@@ -0,0 +1,31 @@
+import fs from 'node:fs';
+
+export const MAX_STDIN_BYTES = 1024 * 1024;
+
+/**
+ * Read all of fd 0 synchronously. A pipe inherited from a parent Node process can be
+ * non-blocking, and then readFileSync(0) throws EAGAIN when the producer has not
+ * written yet (for example `secret get … | secret set … --stdin`, where the first
+ * command is still unlocking the store). Wait and retry instead of failing.
+ */
+export function readAllStdinSync({ fd = 0, maxBytes = MAX_STDIN_BYTES } = {}) {
+  const chunks = [];
+  let total = 0;
+  const buf = Buffer.alloc(64 * 1024);
+  const pause = new Int32Array(new SharedArrayBuffer(4));
+  for (;;) {
+    let n;
+    try {
+      n = fs.readSync(fd, buf, 0, buf.length, null);
+    } catch (err) {
+      if (err.code === 'EAGAIN') { Atomics.wait(pause, 0, 0, 10); continue; }
+      if (err.code === 'EOF') break;
+      throw err;
+    }
+    if (n === 0) break;
+    total += n;
+    if (total > maxBytes) throw new Error(`stdin value exceeds ${maxBytes} bytes`);
+    chunks.push(Buffer.from(buf.subarray(0, n)));
+  }
+  return Buffer.concat(chunks).toString('utf8');
+}

package/src/throttled-fetch.mjs

@@ -0,0 +1,3 @@
+import { importHostModule } from './host-runtime.mjs';
+const hostModule = await importHostModule('src/core/throttled-fetch.mjs');
+export const { loadFirewallPolicy, blockDomain, unblockDomain, getAuditLog, throttledFetch, safeFetch, getGateStats, resetGateStats, resetGateStateForTests, setFirewallReady } = hostModule;

package/src/vault.mjs

@@ -0,0 +1,3 @@
+import { importHostModule } from './host-runtime.mjs';
+const hostModule = await importHostModule('src/core/vault.mjs');
+export const { isSafeVaultName, atomicWrite, safeStringify, walkMd, loadNodes, loadMergedNodes, writeNode, deleteNode, createMemoryNode, loadSkills } = hostModule;

package/src/vfs-documents.mjs

@@ -0,0 +1,3 @@
+import { importHostModule } from './host-runtime.mjs';
+const hostModule = await importHostModule('src/core/vfs-documents.mjs');
+export const { defaultVaultRoot, listVfsDocuments, listVfsDocumentsUnder, findVfsDocument, findVfsDocumentByType, findVfsDocumentByPath } = hostModule;

package/src/webauthn-store.mjs

@@ -0,0 +1,265 @@
+/**
+ * WebAuthn / passkey credential store for Total Recall dashboard.
+ *
+ * Credentials live under <brain>/config/webauthn.json (mode 0600).
+ * Challenges are in-memory only (short TTL).
+ * Never store secret values here — only authenticator public keys.
+ */
+
+import fs from 'node:fs';
+import path from 'node:path';
+import crypto from 'node:crypto';
+import { authState } from './metadata-state.mjs';
+import {
+  generateRegistrationOptions,
+  verifyRegistrationResponse,
+  generateAuthenticationOptions,
+  verifyAuthenticationResponse,
+} from '@simplewebauthn/server';
+
+const CHALLENGE_TTL_MS = 5 * 60 * 1000;
+/** @type {Map<string, { challenge: string, type: string, exp: number }>} */
+const challenges = new Map();
+
+const DASHBOARD_USER = {
+  id: Buffer.from('total-recall-dashboard-owner'),
+  name: 'dashboard',
+  displayName: 'Total Recall Owner',
+};
+
+export function resolveWebAuthnPath(brainDir) {
+  return path.join(brainDir, 'config', 'webauthn.json');
+}
+
+const snapshots = new WeakMap();
+function loadStore(brainDir) {
+  const filePath = resolveWebAuthnPath(brainDir);
+    const client = authState(filePath);
+    const data = client.read({ version: 1, credentials: [] });
+    if (!data || !Array.isArray(data.credentials)) {
+      throw new Error('Invalid passkey registry');
+    }
+    snapshots.set(data, client); return data;
+}
+
+function saveStore(brainDir, store) {
+  const client = snapshots.get(store);
+  if (!client || client.file !== path.resolve(resolveWebAuthnPath(brainDir))) throw new Error('Passkey writes require an owned read snapshot');
+  return client.write(store);
+}
+
+export function listPasskeys(brainDir) {
+  const store = loadStore(brainDir);
+  return store.credentials.map(c => ({
+    id: c.id,
+    created_at: c.created_at || null,
+    transports: c.transports || [],
+    deviceType: c.deviceType || null,
+    backedUp: !!c.backedUp,
+    label: c.label || 'Passkey',
+  }));
+}
+
+export function hasPasskeys(brainDir) {
+  return loadStore(brainDir).credentials.length > 0;
+}
+
+function putChallenge(key, challenge, type) {
+  challenges.set(key, { challenge, type, exp: Date.now() + CHALLENGE_TTL_MS });
+}
+
+function takeChallenge(key, type) {
+  const row = challenges.get(key);
+  challenges.delete(key);
+  if (!row) return null;
+  if (row.exp < Date.now()) return null;
+  if (type && row.type !== type) return null;
+  return row.challenge;
+}
+
+/**
+ * Derive rpID + origin from the request (localhost-safe).
+ */
+export function resolveRpFromRequest(req) {
+  const rawHost = String(req.get('x-forwarded-host') || req.get('host') || 'localhost:3000');
+  const host = rawHost.split(',')[0].trim();
+  let hostname = host.split(':')[0] || 'localhost';
+  // WebAuthn: 127.0.0.1 is awkward; prefer localhost
+  if (hostname === '127.0.0.1') hostname = 'localhost';
+
+  const protoHeader = req.get('x-forwarded-proto');
+  const proto =
+    protoHeader?.split(',')[0]?.trim() ||
+    (req.secure || process.env.NODE_ENV === 'production' ? 'https' : 'http');
+
+  // Rebuild origin; map 127.0.0.1 → localhost for WebAuthn origin match
+  let originHost = host.replace(/^127\.0\.0\.1/, 'localhost');
+  const origin = `${proto}://${originHost}`;
+
+  return {
+    rpID: hostname,
+    rpName: 'Total Recall',
+    origin,
+  };
+}
+
+function challengeKey(req, kind) {
+  const sid = req.auth?.type || 'anon';
+  return `${kind}:${sid}:${req.ip || 'local'}`;
+}
+
+/**
+ * @param {string} brainDir
+ * @param {import('express').Request} req
+ */
+export async function beginRegistration(brainDir, req) {
+  const { rpID, rpName } = resolveRpFromRequest(req);
+  const store = loadStore(brainDir);
+  const options = await generateRegistrationOptions({
+    rpName,
+    rpID,
+    userName: DASHBOARD_USER.name,
+    userDisplayName: DASHBOARD_USER.displayName,
+    userID: DASHBOARD_USER.id,
+    attestationType: 'none',
+    excludeCredentials: store.credentials.map((c) => ({
+      id: c.id,
+      transports: c.transports,
+    })),
+    authenticatorSelection: {
+      residentKey: 'preferred',
+      userVerification: 'preferred',
+      authenticatorAttachment: 'platform',
+    },
+  });
+  putChallenge(challengeKey(req, 'reg'), options.challenge, 'reg');
+  return options;
+}
+
+/**
+ * @param {string} brainDir
+ * @param {import('express').Request} req
+ * @param {object} response - browser registration response JSON
+ * @param {{ label?: string }} opts
+ */
+export async function finishRegistration(brainDir, req, response, opts = {}) {
+  const expectedChallenge = takeChallenge(challengeKey(req, 'reg'), 'reg');
+  if (!expectedChallenge) {
+    throw new Error('Registration challenge expired or missing. Try again.');
+  }
+  const { rpID, origin } = resolveRpFromRequest(req);
+  const verification = await verifyRegistrationResponse({
+    response,
+    expectedChallenge,
+    expectedOrigin: origin,
+    expectedRPID: rpID,
+    requireUserVerification: false,
+  });
+  if (!verification.verified || !verification.registrationInfo) {
+    throw new Error('Passkey registration failed verification');
+  }
+
+  const { credential, credentialDeviceType, credentialBackedUp } = verification.registrationInfo;
+  const store = loadStore(brainDir);
+  const id = credential.id;
+  // Replace if same id re-registered
+  store.credentials = store.credentials.filter((c) => c.id !== id);
+  store.credentials.push({
+    id,
+    publicKey: Buffer.from(credential.publicKey).toString('base64url'),
+    counter: credential.counter ?? 0,
+    transports: response.response?.transports || credential.transports || [],
+    deviceType: credentialDeviceType,
+    backedUp: !!credentialBackedUp,
+    label: opts.label || 'Passkey',
+    created_at: new Date().toISOString(),
+  });
+  saveStore(brainDir, store);
+  return { id, verified: true };
+}
+
+/**
+ * @param {string} brainDir
+ * @param {import('express').Request} req
+ */
+export async function beginAuthentication(brainDir, req) {
+  const store = loadStore(brainDir);
+  if (!store.credentials.length) {
+    throw new Error('No passkeys registered. Register a passkey first.');
+  }
+  const { rpID } = resolveRpFromRequest(req);
+  const options = await generateAuthenticationOptions({
+    rpID,
+    userVerification: 'preferred',
+    allowCredentials: store.credentials.map((c) => ({
+      id: c.id,
+      transports: c.transports,
+    })),
+  });
+  putChallenge(challengeKey(req, 'auth'), options.challenge, 'auth');
+  return options;
+}
+
+/**
+ * @param {string} brainDir
+ * @param {import('express').Request} req
+ * @param {object} response
+ */
+export async function finishAuthentication(brainDir, req, response) {
+  const expectedChallenge = takeChallenge(challengeKey(req, 'auth'), 'auth');
+  if (!expectedChallenge) {
+    throw new Error('Authentication challenge expired or missing. Try again.');
+  }
+  const store = loadStore(brainDir);
+  const credId = response?.id;
+  const stored = store.credentials.find((c) => c.id === credId);
+  if (!stored) {
+    throw new Error('Unknown passkey credential');
+  }
+  const { rpID, origin } = resolveRpFromRequest(req);
+
+  const verification = await verifyAuthenticationResponse({
+    response,
+    expectedChallenge,
+    expectedOrigin: origin,
+    expectedRPID: rpID,
+    credential: {
+      id: stored.id,
+      publicKey: Buffer.from(stored.publicKey, 'base64url'),
+      counter: stored.counter || 0,
+      transports: stored.transports,
+    },
+    requireUserVerification: false,
+  });
+
+  if (!verification.verified) {
+    throw new Error('Passkey authentication failed');
+  }
+
+  const newCounter = verification.authenticationInfo?.newCounter;
+  if (typeof newCounter === 'number') {
+    stored.counter = newCounter;
+    saveStore(brainDir, store);
+  }
+
+  return {
+    verified: true,
+    credentialId: stored.id,
+  };
+}
+
+export function deletePasskey(brainDir, credentialId) {
+  const store = loadStore(brainDir);
+  const before = store.credentials.length;
+  store.credentials = store.credentials.filter((c) => c.id !== credentialId);
+  if (store.credentials.length === before) {
+    return { found: false };
+  }
+  saveStore(brainDir, store);
+  return { found: true, deleted: true };
+}
+
+/** Test helper */
+export function _clearChallengesForTests() {
+  challenges.clear();
+}

package/ui/DESIGN.md

@@ -0,0 +1,19 @@
+# DESIGN.md — Auth & Secrets
+
+```yaml
+tokens:
+  brand-name: "Auth & Secrets"
+  wordmark: "ENCLAVE AUTH"
+  color-primary: "#10b981"
+  color-background: "#064e3b"
+  color-accent: "#34d399"
+  badge: "FIDO2 Enclave"
+  font-body: "system-ui, -apple-system, sans-serif"
+  font-mono: "'JetBrains Mono', monospace"
+  border-radius: "8px"
+```
+
+## Brand & Typographic Wordmark
+- **Name**: Auth & Secrets
+- **Wordmark Logo**: `ENCLAVE AUTH`
+- **Palette**: Deep Forest `#064e3b`, Emerald `#10b981`, Mint `#34d399`. Secure biometric FIDO2 WebAuthn & OAuth2 sessions.

package/ui/card.js

@@ -0,0 +1,274 @@
+/**
+ * Auth & Secrets — Hardware WebAuthn Biometric FIDO2 Passkeys & OAuth Sessions
+ * Auth controls display only requested operation results.
+ *
+ * Zero emojis, authentic commercial brand identity, touch-first ergonomics (>=44px).
+ */
+
+export class AuthCard extends HTMLElement {
+  constructor() {
+    super();
+    this.executing = false;
+  }
+
+  connectedCallback() {
+    this.attachShadow({ mode: 'open' });
+    this.render();
+
+  }
+
+  async execute(action, args = []) {
+    const out = this.shadowRoot.querySelector('#card-out');
+    const actionLabel = action.toUpperCase();
+    if (out) out.textContent = `[ENCLAVE AUTH] Running ${actionLabel}...`;
+    this.executing = true;
+
+    try {
+      const res = await this.host.run(action, args);
+      let text = '';
+      if (typeof res === 'object') {
+        text = res.output || JSON.stringify(res, null, 2);
+      } else {
+        text = String(res);
+      }
+      if (out) out.textContent = text.trim();
+    } catch (err) {
+      if (out) out.textContent = `[ENCLAVE ERROR] ${err.message}`;
+    } finally {
+      this.executing = false;
+    }
+  }
+
+  render() {
+    const root = this.shadowRoot;
+    if (!root) return;
+
+    root.innerHTML = `
+      <style>
+        :host {
+          display: block;
+          font-family: 'Space Grotesk', -apple-system, sans-serif;
+          background: #021a12;
+          color: #ecfdf5;
+          border-radius: 14px;
+          border: 1px solid #064e3b;
+          padding: 16px;
+          box-sizing: border-box;
+          user-select: none;
+        }
+
+        * { box-sizing: border-box; }
+
+        .brand-bar {
+          display: flex;
+          justify-content: space-between;
+          align-items: center;
+          margin-bottom: 12px;
+          padding-bottom: 10px;
+          border-bottom: 1px solid rgba(16, 185, 129, 0.2);
+        }
+
+        .identity {
+          display: flex;
+          align-items: center;
+          gap: 10px;
+        }
+
+        .logo-mark {
+          width: 32px;
+          height: 32px;
+          border-radius: 8px;
+          background: linear-gradient(135deg, #047857 0%, #064e3b 100%);
+          border: 1px solid #10b981;
+          display: flex;
+          align-items: center;
+          justify-content: center;
+          flex-shrink: 0;
+        }
+
+        .title-block {
+          display: flex;
+          flex-direction: column;
+        }
+
+        .name {
+          font-size: 15px;
+          font-weight: 800;
+          letter-spacing: -0.01em;
+          color: #ffffff;
+          line-height: 1.2;
+        }
+
+        .tagline {
+          font-size: 11px;
+          color: #6ee7b7;
+          font-family: 'JetBrains Mono', monospace;
+        }
+
+        .badge-enclave {
+          font-family: 'JetBrains Mono', monospace;
+          font-size: 10px;
+          font-weight: 700;
+          letter-spacing: 0.05em;
+          text-transform: uppercase;
+          background: rgba(16, 185, 129, 0.15);
+          color: #34d399;
+          border: 1px solid rgba(16, 185, 129, 0.4);
+          padding: 3px 8px;
+          border-radius: 6px;
+        }
+
+        /* Biometric Enclave Telemetry Deck */
+        .enclave-deck {
+          display: flex;
+          align-items: center;
+          justify-content: space-between;
+          gap: 12px;
+          background: rgba(4, 47, 34, 0.6);
+          border: 1px solid rgba(16, 185, 129, 0.25);
+          border-radius: 10px;
+          padding: 10px 14px;
+          margin-bottom: 12px;
+        }
+
+        .enclave-info {
+          display: flex;
+          flex-direction: column;
+          gap: 3px;
+          flex: 1;
+        }
+
+        .enclave-title {
+          font-size: 13.5px;
+          font-weight: 700;
+          color: #a7f3d0;
+          letter-spacing: 0.02em;
+        }
+
+        .enclave-status {
+          font-family: 'JetBrains Mono', monospace;
+          font-size: 10px;
+          color: #6ee7b7;
+        }
+
+        .canvas-container {
+          width: 50px;
+          height: 50px;
+          display: flex;
+          align-items: center;
+          justify-content: center;
+        }
+
+        /* Action Buttons Grid (>=44px touch targets) */
+        .actions-grid {
+          display: grid;
+          grid-template-columns: repeat(3, 1fr);
+          gap: 6px;
+          margin-bottom: 10px;
+        }
+
+        .btn-action {
+          min-height: 44px;
+          min-width: 44px;
+          background: rgba(255, 255, 255, 0.04);
+          border: 1px solid rgba(16, 185, 129, 0.25);
+          border-radius: 8px;
+          color: #ecfdf5;
+          font-family: 'Space Grotesk', sans-serif;
+          font-size: 11px;
+          font-weight: 700;
+          letter-spacing: 0.02em;
+          cursor: pointer;
+          touch-action: manipulation;
+          display: flex;
+          align-items: center;
+          justify-content: center;
+          text-align: center;
+          padding: 4px 6px;
+          transition: all 0.15s ease;
+        }
+
+        .btn-action:hover {
+          background: #047857;
+          border-color: #10b981;
+          color: #ffffff;
+        }
+
+        .btn-action.btn-passkey {
+          background: rgba(16, 185, 129, 0.18);
+          border-color: #10b981;
+          color: #34d399;
+        }
+
+        .btn-action.btn-passkey:hover {
+          background: #10b981;
+          color: #021a12;
+        }
+
+        /* Terminal Readout */
+        .terminal-readout {
+          background: #01110b;
+          border: 1px solid rgba(16, 185, 129, 0.2);
+          border-radius: 8px;
+          padding: 8px 12px;
+          font-family: 'JetBrains Mono', monospace;
+          font-size: 11px;
+          line-height: 1.4;
+          color: #34d399;
+          min-height: 42px;
+          max-height: 100px;
+          overflow-y: auto;
+          white-space: pre-wrap;
+          word-break: break-all;
+        }
+      </style>
+
+      <!-- Commercial Brand Identity (Rendered once) -->
+      <div class="brand-bar">
+        <div class="identity">
+          <div class="logo-mark">
+            <svg width="18" height="18" viewBox="0 0 24 24" fill="none" stroke="#34d399" stroke-width="2" stroke-linecap="round" stroke-linejoin="round">
+              <path d="M12 22s8-4 8-10V5l-8-3-8 3v7c0 6 8 10 8 10z"></path>
+            </svg>
+          </div>
+          <div class="title-block">
+            <span class="name">Auth & Secrets</span>
+            <span class="tagline">Biometric FIDO2 Passkeys</span>
+          </div>
+        </div>
+        <span class="badge-enclave">AUTH</span>
+      </div>
+
+      <!-- Biometric Enclave Deck -->
+      <div class="enclave-deck">
+        <div class="enclave-info">
+          <span class="enclave-title">WebAuthn Security Keys</span>
+          <span class="enclave-status">Review registered credentials and authentication settings</span>
+        </div>
+
+      </div>
+
+      <!-- Touch-First Actions (>=44px touch targets) -->
+      <div class="actions-grid">
+        <button class="btn-action btn-passkey" data-cmd="passkey">PASSKEYS</button>
+        <button class="btn-action" data-cmd="session">SESSIONS</button>
+        <button class="btn-action" data-cmd="status">STATUS</button>
+      </div>
+
+      <!-- Live Terminal Output -->
+      <div class="terminal-readout" id="card-out">Not checked. Select an action to retrieve current auth information.</div>
+    `;
+
+    const buttons = root.querySelectorAll('.btn-action');
+    buttons.forEach(btn => {
+      btn.addEventListener('click', () => {
+        const cmd = btn.getAttribute('data-cmd');
+        this.execute(cmd, []);
+      });
+    });
+  }
+}
+
+if (!customElements.get('tr-auth-card')) {
+  customElements.define('tr-auth-card', AuthCard);
+}