vault-go 0.11.0 → 0.13.0

package/dist/local-device.js

@@ -0,0 +1,185 @@
+import { randomUUID, createHash } from "node:crypto";
+import { readFileSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+import { hostname, platform } from "node:os";
+import { loadConfig, loadTokens, saveTokens } from "./config.js";
+import { VaultCloudError } from "./cloud.js";
+export function localDevice(home, cloud, storage, version) {
+    const owner = () => createHash("sha256")
+        .update(loadConfig(home).apiUrl + "|" + (loadConfig(home).email ?? ""))
+        .digest("hex");
+    let status = { status: "unregistered" };
+    let inFlight = null;
+    let stopped = false;
+    const record = () => {
+        const d = storage?.read("local-device.json");
+        return d?.owner === owner() ? d : null;
+    };
+    function adopt(value, requestOwner) {
+        const made = value;
+        if (!/^[a-f0-9-]{36}$/.test(made.id) ||
+            !/^vg_device_[a-f0-9]{64}$/.test(made.deviceToken) ||
+            typeof made.accessToken !== "string" ||
+            typeof made.refreshToken !== "string")
+            throw new Error("Invalid registration response.");
+        const device = {
+            id: made.id,
+            token: made.deviceToken,
+            owner: requestOwner,
+        };
+        storage.write("local-device.json", device);
+        saveTokens({
+            accessToken: made.accessToken,
+            refreshToken: made.refreshToken,
+            expiresIn: made.expiresIn,
+            expiresAt: Date.now() + (made.expiresIn || 900) * 1000,
+        }, home);
+        return device;
+    }
+    function installationId() {
+        const path = join(home, "local-installation.json");
+        try {
+            const value = JSON.parse(readFileSync(path, "utf8"));
+            if (/^[a-f0-9-]{36}$/.test(value.id))
+                return value.id;
+            throw new Error("Invalid installation identity.");
+        }
+        catch (error) {
+            if (error.code !== "ENOENT")
+                throw error;
+            const id = randomUUID();
+            writeFileSync(path, JSON.stringify({ id }), { mode: 0o600, flag: "wx" });
+            return id;
+        }
+    }
+    async function heartbeat() {
+        if (stopped)
+            return;
+        if (inFlight)
+            return inFlight;
+        if (!loadTokens(home) || !storage) {
+            status = {
+                status: "unregistered",
+                ...(!storage ? { error: "cache_key_unavailable" } : {}),
+            };
+            return;
+        }
+        const requestOwner = owner();
+        inFlight = Promise.resolve().then(async () => {
+            try {
+                let device = record();
+                if (device?.revoked) {
+                    status = { status: "revoked" };
+                    return;
+                }
+                if (device) {
+                    let binding;
+                    try {
+                        binding = JSON.parse(Buffer.from(loadTokens(home).accessToken.split(".")[1], "base64url").toString()).deviceId;
+                    }
+                    catch { }
+                    if (binding !== device.id) {
+                        const before = loadTokens(home)?.accessToken;
+                        const made = await cloud.rotateDevice(device.id);
+                        if (stopped ||
+                            requestOwner !== owner() ||
+                            before !== loadTokens(home)?.accessToken)
+                            return;
+                        device = adopt(made, requestOwner);
+                    }
+                }
+                if (!device) {
+                    const before = loadTokens(home);
+                    const made = await cloud.registerDevice({
+                        name: hostname().slice(0, 80),
+                        platform: platform(),
+                        installationId: installationId(),
+                        agentVersion: version,
+                        localProtection: "encrypted-cache",
+                    });
+                    if (stopped ||
+                        requestOwner !== owner() ||
+                        loadTokens(home)?.accessToken !== before?.accessToken)
+                        return;
+                    device = adopt(made, requestOwner);
+                }
+                const result = (await cloud.deviceAction(device.id, device.token, "heartbeat", { agentVersion: version, localProtection: "encrypted-cache" }));
+                if (stopped || requestOwner !== owner())
+                    return;
+                status = {
+                    status: "online",
+                    ...(result.name ? { name: result.name } : {}),
+                    ...(result.lastSeenAt ? { lastSeenAt: result.lastSeenAt } : {}),
+                };
+            }
+            catch (error) {
+                if (stopped || requestOwner !== owner())
+                    return;
+                if (error instanceof VaultCloudError &&
+                    (error.status === 401 || error.status === 409)) {
+                    const current = record();
+                    if (current)
+                        storage.write("local-device.json", { ...current, revoked: true });
+                    status = {
+                        status: "revoked",
+                        error: "device_reauthorization_required",
+                    };
+                }
+                else
+                    status = {
+                        status: "offline",
+                        error: error instanceof VaultCloudError && error.status === 403
+                            ? "browser_reauthentication_required"
+                            : "device_connection_unavailable",
+                    };
+            }
+            finally {
+                inFlight = null;
+            }
+        });
+        return inFlight;
+    }
+    return {
+        heartbeat,
+        close() {
+            stopped = true;
+        },
+        status: () => ({ ...status }),
+        async disconnect() {
+            await inFlight;
+            const current = record();
+            if (current && !current.revoked) {
+                try {
+                    await cloud.deviceAction(current.id, current.token, "disconnect");
+                }
+                catch (error) {
+                    if (!(error instanceof VaultCloudError && error.status === 401))
+                        throw error;
+                }
+            }
+            if (current)
+                storage?.write("local-device.json", { ...current, revoked: true });
+            status = { status: "revoked" };
+        },
+        // New browser authentication is explicit user consent to authorize this installation again.
+        async reauthorize() {
+            if (!storage)
+                throw new Error("Encrypted device credential storage is unavailable.");
+            await inFlight;
+            const current = record();
+            const requestOwner = owner(), before = loadTokens(home)?.accessToken;
+            if (current) {
+                const made = await cloud.rotateDevice(current.id);
+                if (stopped ||
+                    requestOwner !== owner() ||
+                    before !== loadTokens(home)?.accessToken)
+                    return;
+                adopt(made, requestOwner);
+            }
+            else if (status.status === "revoked") {
+                writeFileSync(join(home, "local-installation.json"), JSON.stringify({ id: randomUUID() }), { mode: 0o600 });
+            }
+            await heartbeat();
+        },
+    };
+}

package/dist/local-install.d.ts

@@ -1,7 +1,7 @@
 export declare const LOCAL_PORT = 38850;
 export declare const localUrl = "http://localhost:38850/";
 export interface LocalHealth {
-    service: 'vault-go';
+    service: "vault-go";
     version: string;
     port: number;
 }
@@ -11,7 +11,14 @@ export declare function startLocal(home?: string): Promise<LocalHealth>;
 export declare function openLocal(home?: string): Promise<void>;
 export declare function stopLocal(home?: string): Promise<boolean>;
 export declare function launchAgentXml(executable: string, worker: string, home: string): string;
+interface LaunchAgentOperations {
+    run: (args: string[]) => Promise<void>;
+    wait: (milliseconds: number) => Promise<void>;
+    report: (message: string) => void;
+}
+export declare function replaceLaunchAgent(domain: string, path: string, prepare: () => Promise<void>, operations: LaunchAgentOperations): Promise<void>;
 export declare function installLocal(home?: string): Promise<{
     startup: boolean;
 }>;
 export declare function uninstallLocal(home?: string): Promise<void>;
+export {};

package/dist/local-install.js

@@ -1,89 +1,120 @@
-import { execFile, spawn } from 'node:child_process';
-import { createHmac, randomBytes, timingSafeEqual } from 'node:crypto';
-import { chmodSync, copyFileSync, existsSync, mkdirSync, openSync, closeSync, readFileSync, readdirSync, renameSync, rmSync, writeFileSync } from 'node:fs';
-import { homedir } from 'node:os';
-import { dirname, join } from 'node:path';
-import { fileURLToPath } from 'node:url';
-import { promisify } from 'node:util';
-import { vaultHome } from './config.js';
-import { openVaultBrowser } from './auth.js';
+import { execFile, spawn } from "node:child_process";
+import { createHmac, randomBytes, timingSafeEqual } from "node:crypto";
+import { chmodSync, copyFileSync, existsSync, mkdirSync, openSync, closeSync, readFileSync, readdirSync, renameSync, rmSync, writeFileSync, } from "node:fs";
+import { homedir } from "node:os";
+import { dirname, join } from "node:path";
+import { fileURLToPath } from "node:url";
+import { promisify } from "node:util";
+import { vaultHome } from "./config.js";
+import { openVaultBrowser } from "./auth.js";
 const execute = promisify(execFile);
 export const LOCAL_PORT = 38850;
-const LABEL = 'com.resolveup.vault-go';
-const OWNER = '<!-- Managed by vault-go local install -->';
+const LABEL = "com.resolveup.vault-go";
+const OWNER = "<!-- Managed by vault-go local install -->";
 export const localUrl = `http://localhost:${LOCAL_PORT}/`;
 export async function localStatus(port = LOCAL_PORT, home = vaultHome()) {
-    const challenge = randomBytes(32).toString('base64url');
+    const challenge = randomBytes(32).toString("base64url");
     let response;
     try {
-        response = await fetch(`http://127.0.0.1:${port}/health?challenge=${challenge}`, { signal: AbortSignal.timeout(1500), redirect: 'error' });
+        response = await fetch(`http://127.0.0.1:${port}/health?challenge=${challenge}`, { signal: AbortSignal.timeout(1500), redirect: "error" });
     }
     catch {
         return null;
     }
     let body;
     try {
-        body = await response.json();
+        body = (await response.json());
     }
     catch {
         throw new Error(`Port ${port} is occupied by another service.`);
     }
-    if (!response.ok || body.service !== 'vault-go' || typeof body.version !== 'string' || !/^\d+\.\d+\.\d+/.test(body.version) || body.port !== port) {
+    if (!response.ok ||
+        body.service !== "vault-go" ||
+        typeof body.version !== "string" ||
+        !/^\d+\.\d+\.\d+/.test(body.version) ||
+        body.port !== port) {
         throw new Error(`Port ${port} is occupied by another service.`);
     }
-    const expected = createHmac('sha256', localToken(home)).update(challenge).digest();
-    const received = Buffer.from(body.proof ?? '', 'base64url');
-    if (expected.length !== received.length || !timingSafeEqual(expected, received))
+    const expected = createHmac("sha256", localToken(home))
+        .update(challenge)
+        .digest();
+    const received = Buffer.from(body.proof ?? "", "base64url");
+    if (expected.length !== received.length ||
+        !timingSafeEqual(expected, received))
         throw new Error(`Could not verify the Vault service on port ${port}.`);
     return { service: body.service, version: body.version, port: body.port };
 }
 export function stageLocalRuntime(home = vaultHome(), source = dirname(fileURLToPath(import.meta.url))) {
-    const manifest = JSON.parse(readFileSync(join(source, '..', 'package.json'), 'utf8'));
-    const root = join(home, 'local-runtime');
-    const target = join(root, 'dist');
+    const manifest = JSON.parse(readFileSync(join(source, "..", "package.json"), "utf8"));
+    const root = join(home, "local-runtime");
+    const target = join(root, "dist");
     mkdirSync(target, { recursive: true, mode: 0o700 });
     chmodSync(root, 0o700);
     chmodSync(target, 0o700);
-    const excluded = new Set(['index.js', 'server.js', 'installer.js', 'cli.js', 'auth.js']);
-    if (!existsSync(join(source, 'local-worker.js')))
-        throw new Error('Local worker is missing. Build or reinstall vault-go first.');
+    const excluded = new Set(["index.js", "server.js", "installer.js", "cli.js"]);
+    if (!existsSync(join(source, "local-worker.js")))
+        throw new Error("Local worker is missing. Build or reinstall vault-go first.");
     for (const file of readdirSync(source)) {
-        if (!file.endsWith('.js') || file.endsWith('.test.js') || excluded.has(file))
+        if (!file.endsWith(".js") ||
+            file.endsWith(".test.js") ||
+            excluded.has(file))
             continue;
         const destination = join(target, file);
         copyFileSync(join(source, file), `${destination}.tmp`);
         chmodSync(`${destination}.tmp`, 0o600);
         renameSync(`${destination}.tmp`, destination);
     }
-    writeFileSync(join(root, 'package.json'), JSON.stringify({ name: 'vault-go-local-runtime', version: manifest.version, type: 'module' }), { mode: 0o600 });
-    return join(target, 'local-worker.js');
+    const assets = join(root, "assets");
+    mkdirSync(assets, { recursive: true, mode: 0o700 });
+    const logo = join(source, "..", "assets", "vault-logo-glass.png");
+    if (existsSync(logo)) {
+        copyFileSync(logo, join(assets, "vault-logo-glass.png"));
+        chmodSync(join(assets, "vault-logo-glass.png"), 0o600);
+    }
+    writeFileSync(join(root, "package.json"), JSON.stringify({
+        name: "vault-go-local-runtime",
+        version: manifest.version,
+        type: "module",
+    }), { mode: 0o600 });
+    return join(target, "local-worker.js");
 }
 export async function startLocal(home = vaultHome()) {
     const running = await localStatus(LOCAL_PORT, home);
     if (running)
         return running;
     const worker = stageLocalRuntime(home);
-    const log = openSync(join(home, 'local-service.log'), 'a', 0o600);
+    const log = openSync(join(home, "local-service.log"), "a", 0o600);
     try {
-        const child = spawn(process.execPath, [worker], { detached: true, stdio: ['ignore', log, log], env: { ...process.env, VAULT_GO_HOME: home, VAULT_GO_LOCAL_PORT: String(LOCAL_PORT) } });
-        await new Promise((resolve, reject) => { child.once('spawn', resolve); child.once('error', reject); });
+        const child = spawn(process.execPath, [worker], {
+            detached: true,
+            stdio: ["ignore", log, log],
+            env: {
+                ...process.env,
+                VAULT_GO_HOME: home,
+                VAULT_GO_LOCAL_PORT: String(LOCAL_PORT),
+            },
+        });
+        await new Promise((resolve, reject) => {
+            child.once("spawn", resolve);
+            child.once("error", reject);
+        });
         child.unref();
     }
     finally {
         closeSync(log);
     }
     for (let attempt = 0; attempt < 40; attempt++) {
-        await new Promise(resolve => setTimeout(resolve, 150));
+        await new Promise((resolve) => setTimeout(resolve, 150));
         const status = await localStatus(LOCAL_PORT, home);
         if (status)
             return status;
     }
-    throw new Error(`Local service did not start. Check ${join(home, 'local-service.log')}.`);
+    throw new Error(`Local service did not start. Check ${join(home, "local-service.log")}.`);
 }
 function localToken(home) {
-    const value = JSON.parse(readFileSync(join(home, 'local-access.json'), 'utf8'));
+    const value = JSON.parse(readFileSync(join(home, "local-access.json"), "utf8"));
     if (!value.token || !/^[A-Za-z0-9_-]{32,}$/.test(value.token))
-        throw new Error('Local access token is missing or invalid.');
+        throw new Error("Local access token is missing or invalid.");
     return value.token;
 }
 export async function openLocal(home = vaultHome()) {
@@ -92,32 +123,102 @@ export async function openLocal(home = vaultHome()) {
         await openVaultBrowser(`${localUrl}#token=${encodeURIComponent(localToken(home))}`);
     }
     catch {
-        throw new Error('Could not open the local dashboard. Retry: vault-go local open');
+        throw new Error("Could not open the local dashboard. Retry: vault-go local open");
     }
 }
 export async function stopLocal(home = vaultHome()) {
-    if (!await localStatus(LOCAL_PORT, home))
+    if (!(await localStatus(LOCAL_PORT, home)))
         return false;
-    const result = await fetch(`http://127.0.0.1:${LOCAL_PORT}/api/shutdown`, { method: 'POST', headers: { Authorization: `Bearer ${localToken(home)}` }, signal: AbortSignal.timeout(3000), redirect: 'error' });
+    const result = await fetch(`http://127.0.0.1:${LOCAL_PORT}/api/shutdown`, {
+        method: "POST",
+        headers: { Authorization: `Bearer ${localToken(home)}` },
+        signal: AbortSignal.timeout(3000),
+        redirect: "error",
+    });
     if (!result.ok)
         throw new Error(`Local shutdown refused (${result.status}).`);
     for (let attempt = 0; attempt < 20; attempt++) {
-        if (!await localStatus(LOCAL_PORT, home))
+        if (!(await localStatus(LOCAL_PORT, home)))
             return true;
-        await new Promise(resolve => setTimeout(resolve, 100));
+        await new Promise((resolve) => setTimeout(resolve, 100));
     }
-    throw new Error('Local service has not stopped yet.');
+    throw new Error("Local service has not stopped yet.");
 }
 export function launchAgentXml(executable, worker, home) {
-    const escape = (value) => value.replace(/[&<>"']/g, c => ({ '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;', "'": '&apos;' }[c]));
-    return `<?xml version="1.0" encoding="UTF-8"?>\n${OWNER}\n<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">\n<plist version="1.0"><dict><key>Label</key><string>${LABEL}</string><key>ProgramArguments</key><array><string>${escape(executable)}</string><string>${escape(worker)}</string></array><key>EnvironmentVariables</key><dict><key>VAULT_GO_HOME</key><string>${escape(home)}</string><key>VAULT_GO_LOCAL_PORT</key><string>${LOCAL_PORT}</string></dict><key>RunAtLoad</key><true/><key>StandardOutPath</key><string>${escape(join(home, 'local-service.log'))}</string><key>StandardErrorPath</key><string>${escape(join(home, 'local-service.log'))}</string></dict></plist>\n`;
+    const escape = (value) => value.replace(/[&<>"']/g, (c) => ({
+        "&": "&amp;",
+        "<": "&lt;",
+        ">": "&gt;",
+        '"': "&quot;",
+        "'": "&apos;",
+    })[c]);
+    return `<?xml version="1.0" encoding="UTF-8"?>\n${OWNER}\n<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">\n<plist version="1.0"><dict><key>Label</key><string>${LABEL}</string><key>ProgramArguments</key><array><string>${escape(executable)}</string><string>${escape(worker)}</string></array><key>EnvironmentVariables</key><dict><key>VAULT_GO_HOME</key><string>${escape(home)}</string><key>VAULT_GO_LOCAL_PORT</key><string>${LOCAL_PORT}</string><key>PATH</key><string>${escape(process.env["PATH"] || "/usr/local/bin:/usr/bin:/bin")}</string></dict><key>RunAtLoad</key><true/><key>StandardOutPath</key><string>${escape(join(home, "local-service.log"))}</string><key>StandardErrorPath</key><string>${escape(join(home, "local-service.log"))}</string></dict></plist>\n`;
+}
+function agentPath() {
+    return join(homedir(), "Library", "LaunchAgents", `${LABEL}.plist`);
+}
+function assertOwned(path) {
+    if (existsSync(path) && !readFileSync(path, "utf8").includes(OWNER))
+        throw new Error(`Refusing to replace an unowned startup file: ${path}`);
+}
+export async function replaceLaunchAgent(domain, path, prepare, operations) {
+    const target = `${domain}/${LABEL}`;
+    const codeOf = (error) => error?.code;
+    const isAbsent = async () => {
+        try {
+            await operations.run(["print", target]);
+            return false;
+        }
+        catch (error) {
+            // launchctl uses 113 for an unknown service. Other failures do not prove removal.
+            const stderr = String(error?.stderr ?? "");
+            if (codeOf(error) === 113 &&
+                stderr.includes(`Could not find service "${LABEL}"`))
+                return true;
+            throw error;
+        }
+    };
+    let bootoutError;
+    try {
+        await operations.run(["bootout", target]);
+    }
+    catch (error) {
+        bootoutError = error;
+    }
+    for (let attempt = 0;; attempt++) {
+        if (await isAbsent()) {
+            if (bootoutError &&
+                codeOf(bootoutError) !== 3 &&
+                codeOf(bootoutError) !== 113)
+                throw bootoutError;
+            break;
+        }
+        if (bootoutError)
+            throw bootoutError;
+        if (attempt === 39)
+            throw new Error(`LaunchAgent ${target} is still registered after bootout; bootstrap was not attempted.`);
+        await operations.wait(250);
+    }
+    await prepare();
+    for (let attempt = 0; attempt < 3; attempt++) {
+        try {
+            await operations.run(["bootstrap", domain, path]);
+            return;
+        }
+        catch (error) {
+            // Error 5 can be a teardown race, but is also a genuine configuration failure.
+            // Retry only when print independently proves that no job was registered.
+            if (codeOf(error) !== 5 || attempt === 2 || !(await isAbsent()))
+                throw error;
+            const message = error instanceof Error ? error.message : String(error);
+            operations.report(`launchctl bootstrap: ${message}\nConfirmed ${target} is absent; retrying (${attempt + 2}/3).`);
+            await operations.wait(500 * (attempt + 1));
+        }
+    }
 }
-function agentPath() { return join(homedir(), 'Library', 'LaunchAgents', `${LABEL}.plist`); }
-function assertOwned(path) { if (existsSync(path) && !readFileSync(path, 'utf8').includes(OWNER))
-    throw new Error(`Refusing to replace an unowned startup file: ${path}`); }
 export async function installLocal(home = vaultHome()) {
     const worker = stageLocalRuntime(home);
-    if (process.platform !== 'darwin') {
+    if (process.platform !== "darwin") {
         await startLocal(home);
         return { startup: false };
     }
@@ -126,34 +227,46 @@ export async function installLocal(home = vaultHome()) {
     await localStatus(LOCAL_PORT, home);
     mkdirSync(dirname(path), { recursive: true });
     const domain = `gui/${process.getuid()}`;
-    // An absent registration is expected on the first installation.
-    try {
-        await execute('launchctl', ['bootout', `${domain}/${LABEL}`]);
-    }
-    catch { }
-    await stopLocal(home);
-    writeFileSync(path, launchAgentXml(process.execPath, worker, home), { mode: 0o600 });
-    await execute('launchctl', ['bootstrap', domain, path]);
+    await replaceLaunchAgent(domain, path, async () => {
+        await stopLocal(home);
+        writeFileSync(path, launchAgentXml(process.execPath, worker, home), {
+            mode: 0o600,
+        });
+    }, {
+        run: async (args) => {
+            await execute("launchctl", args, { timeout: 5000 });
+        },
+        wait: (milliseconds) => new Promise((resolve) => setTimeout(resolve, milliseconds)),
+        report: (message) => {
+            process.stderr.write(`${message}\n`);
+        },
+    });
     for (let attempt = 0; attempt < 40; attempt++) {
         const health = await localStatus(LOCAL_PORT, home);
         if (health)
             return { startup: true };
-        await new Promise(resolve => setTimeout(resolve, 150));
+        await new Promise((resolve) => setTimeout(resolve, 150));
     }
-    throw new Error('LaunchAgent was registered, but the local service did not start. Check local-service.log.');
+    throw new Error("LaunchAgent was registered, but the local service did not start. Check local-service.log.");
 }
 export async function uninstallLocal(home = vaultHome()) {
-    if (process.platform === 'darwin') {
+    if (process.platform === "darwin") {
         const path = agentPath();
         assertOwned(path);
         if (existsSync(path)) {
             try {
-                await execute('launchctl', ['bootout', `gui/${process.getuid()}/${LABEL}`]);
+                await execute("launchctl", [
+                    "bootout",
+                    `gui/${process.getuid()}/${LABEL}`,
+                ]);
             }
             catch (error) {
                 // Only remove registration files after confirming the job is absent.
                 try {
-                    await execute('launchctl', ['print', `gui/${process.getuid()}/${LABEL}`]);
+                    await execute("launchctl", [
+                        "print",
+                        `gui/${process.getuid()}/${LABEL}`,
+                    ]);
                 }
                 catch {
                     rmSync(path);

package/dist/local-service.d.ts

@@ -1,13 +1,23 @@
-import { type IncomingMessage } from 'node:http';
-import { VaultCloudClient } from './cloud.js';
+import { type IncomingMessage } from "node:http";
+import { VaultCloudClient } from "./cloud.js";
+import { authenticateWithBrowser } from "./auth.js";
+import { localDevice } from "./local-device.js";
+import { generateContext, listContextEngines } from "./context-engines.js";
 export declare const LOCAL_PORT = 38850;
 export declare function localAccessToken(home: string): string;
-type LocalCloud = Pick<VaultCloudClient, 'projects' | 'feed' | 'health'>;
+type LocalCloud = Pick<VaultCloudClient, "projects" | "feed" | "health">;
 export declare function startLocalService(options?: {
     home?: string;
     port?: number;
     cloud?: LocalCloud;
     pollMs?: number;
+    authenticate?: typeof authenticateWithBrowser;
+    cacheKey?: Buffer;
+    device?: ReturnType<typeof localDevice> | false;
+    context?: {
+        list: () => ReturnType<typeof listContextEngines>;
+        generate: typeof generateContext;
+    };
 }): Promise<{
     server: import("http").Server<typeof IncomingMessage, typeof import("http").ServerResponse>;
     port: number;