@2kw/ai 7.2.1 → 7.3.0-dev.10

package/dist/agent-config/schema.d.ts

@@ -5,7 +5,10 @@
  * Kept as a TS constant: package.json `files` publishes only dist JS/d.ts.
  */
 export declare const AGENT_SCHEMA_ID = "https://docs.2kw.ai/schemas/agent.v1.json";
-/** Types the backend injects or cannot execute; authoring them has no effect or breaks the run. */
+/**
+ * Types the backend injects or cannot execute; authoring them has no effect or breaks the run.
+ * The backend refuses the same map on save (NonAuthorableTools, #1263); its test fails if they differ.
+ */
 export declare const NON_AUTHORABLE_TOOL_TYPES: Record<string, string>;
 export declare const agentSchema: {
     readonly $schema: "https://json-schema.org/draft/2020-12/schema";
@@ -209,6 +212,35 @@ export declare const agentSchema: {
                 };
             };
         };
+        readonly webFetchTool: {
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["type"];
+            readonly properties: {
+                readonly type: {
+                    readonly const: "web_fetch";
+                };
+                readonly config: {
+                    readonly type: "object";
+                    readonly properties: {
+                        readonly source: {
+                            readonly enum: readonly ["proxy", "native"];
+                        };
+                        readonly allowedDomains: {
+                            readonly type: "array";
+                            readonly items: {
+                                readonly type: "string";
+                                readonly pattern: "^(?=.{1,253}$)([\\p{L}\\p{N}](?:[\\p{L}\\p{N}-]{0,61}[\\p{L}\\p{N}])?\\.)+\\p{L}(?:[\\p{L}\\p{N}-]{0,61}[\\p{L}\\p{N}])?$";
+                            };
+                            readonly maxItems: 10;
+                        };
+                    };
+                };
+                readonly requiresConfirmation: {
+                    readonly type: "boolean";
+                };
+            };
+        };
         readonly extractionTool: {
             readonly type: "object";
             readonly additionalProperties: false;
@@ -389,6 +421,18 @@ export declare const agentSchema: {
                 readonly then: {
                     readonly $ref: "#/$defs/webSearchTool";
                 };
+            }, {
+                readonly if: {
+                    required: string[];
+                    properties: {
+                        type: {
+                            const: string;
+                        };
+                    };
+                };
+                readonly then: {
+                    readonly $ref: "#/$defs/webFetchTool";
+                };
             }, {
                 readonly if: {
                     required: string[];

package/dist/agent-config/schema.js

@@ -20,9 +20,13 @@ const MODEL_REF = {
 // inner hyphens, Unicode or ASCII. Mirrors WebToolEntryValidator.HOST; needs a Unicode-aware regex engine.
 const HOSTNAME = "^(?=.{1,253}$)([\\p{L}\\p{N}](?:[\\p{L}\\p{N}-]{0,61}[\\p{L}\\p{N}])?\\.)+\\p{L}(?:[\\p{L}\\p{N}-]{0,61}[\\p{L}\\p{N}])?$";
 const oneOfLowercase = (...values) => ({ type: "string", enum: values });
-/** Types the backend injects or cannot execute; authoring them has no effect or breaks the run. */
+/**
+ * Types the backend injects or cannot execute; authoring them has no effect or breaks the run.
+ * The backend refuses the same map on save (NonAuthorableTools, #1263); its test fails if they differ.
+ */
 export const NON_AUTHORABLE_TOOL_TYPES = {
-    "backbone.tool_search": "the planner adds it automatically",
+    "backbone.tool_search": "it is added automatically when tool discovery is on",
+    "backbone.tool_call": "it is added automatically when tool discovery is on",
     "backbone.skill_read": "it is added at run time when skills are pinned",
     // #944: SkillsetPinner injects it for eligible callers and strips any stored copy (#779).
     "backbone.skills_apply": "it is added at run time for callers allowed to author skills",
@@ -34,6 +38,7 @@ export const NON_AUTHORABLE_TOOL_TYPES = {
 const BUILTIN_TYPES = [
     "file_search",
     "web_search",
+    "web_fetch",
     "backbone.extraction",
     "backbone.document_convert",
     "backbone.todo",
@@ -150,6 +155,24 @@ export const agentSchema = {
                 requiresConfirmation: { type: "boolean" },
             },
         },
+        // Backbone's own fetcher reads a page the user or an earlier search named. A missing config, `config: {}`
+        // or a missing source is the proxy; `native` is accepted and answers provider_unavailable until it ships.
+        webFetchTool: {
+            type: "object",
+            additionalProperties: false,
+            required: ["type"],
+            properties: {
+                type: { const: "web_fetch" },
+                config: {
+                    type: "object",
+                    properties: {
+                        source: { enum: ["proxy", "native"] },
+                        allowedDomains: { type: "array", items: { type: "string", pattern: HOSTNAME }, maxItems: 10 },
+                    },
+                },
+                requiresConfirmation: { type: "boolean" },
+            },
+        },
         extractionTool: {
             type: "object",
             additionalProperties: false,
@@ -237,6 +260,7 @@ export const agentSchema = {
             allOf: [
                 { if: typeIs("file_search"), then: { $ref: "#/$defs/fileSearchTool" } },
                 { if: typeIs("web_search"), then: { $ref: "#/$defs/webSearchTool" } },
+                { if: typeIs("web_fetch"), then: { $ref: "#/$defs/webFetchTool" } },
                 { if: typeIs("backbone.extraction"), then: { $ref: "#/$defs/extractionTool" } },
                 { if: typeIs("backbone.document_convert"), then: { $ref: "#/$defs/documentConvertTool" } },
                 { if: typeIs("backbone.todo"), then: { $ref: "#/$defs/todoTool" } },

package/dist/agent-config/template.js

@@ -29,6 +29,9 @@ tools: []
 #   - type: web_search
 #     config:
 #       allowedDomains: [example.com]
+#   - type: web_fetch
+#     config:
+#       allowedDomains: [example.com]
 #   - type: backbone.extraction
 #     config:
 #       schemaIds: [schema_id]

package/dist/agent-config/validate.js

@@ -8,6 +8,8 @@ const NULLABLE_KEYS = ["description", "models", "instructions", "tools", "hitlPo
 const TOOL_RULE_CLASSES = new Set(["read", "write", "destructive"]);
 /** web_search config keys whose explicit `null` the backend reads as absent. */
 const WEB_SEARCH_NULLABLE_KEYS = ["source", "fallback", "searchProviderId", "allowedDomains"];
+/** web_fetch config keys whose explicit `null` the backend reads as absent. */
+const WEB_FETCH_NULLABLE_KEYS = ["source", "allowedDomains"];
 const isPlainObject = (v) => typeof v === "object" && v !== null && !Array.isArray(v);
 /**
  * A deep copy of `doc` in the form the backend actually checks: explicit nulls it treats as absent
@@ -34,7 +36,9 @@ export function normalizeForValidation(doc) {
             if (isPlainObject(tool) && tool.annotations === null)
                 delete tool.annotations;
             if (isPlainObject(tool) && tool.type === "web_search")
-                normalizeWebSearch(tool);
+                normalizeWebTool(tool, WEB_SEARCH_NULLABLE_KEYS);
+            if (isPlainObject(tool) && tool.type === "web_fetch")
+                normalizeWebTool(tool, WEB_FETCH_NULLABLE_KEYS);
         }
     }
     const policy = copy.hitlPolicy;
@@ -55,13 +59,13 @@ export function normalizeForValidation(doc) {
     return copy;
 }
 /** WebToolEntryValidator reads a null config and null config fields as absent, and trims each domain. */
-function normalizeWebSearch(tool) {
+function normalizeWebTool(tool, nullableKeys) {
     if (tool.config === null)
         delete tool.config;
     const config = tool.config;
     if (!isPlainObject(config))
         return;
-    for (const key of WEB_SEARCH_NULLABLE_KEYS) {
+    for (const key of nullableKeys) {
         if (config[key] === null)
             delete config[key];
     }
@@ -125,6 +129,7 @@ export function validateAgentConfig(raw) {
     }
     if (Array.isArray(record.tools)) {
         let webSearchSeen = false;
+        let webFetchSeen = false;
         record.tools.forEach((tool, i) => {
             const type = tool?.type;
             if (typeof type === "string" && Object.hasOwn(NON_AUTHORABLE_TOOL_TYPES, type)) {
@@ -136,6 +141,11 @@ export function validateAgentConfig(raw) {
                     issues.push({ pointer: `/tools/${i}/type`, message: "an agent may carry only one web_search tool" });
                 webSearchSeen = true;
             }
+            if (type === "web_fetch") {
+                if (webFetchSeen)
+                    issues.push({ pointer: `/tools/${i}/type`, message: "an agent may carry only one web_fetch tool" });
+                webFetchSeen = true;
+            }
         });
     }
     if (Array.isArray(record.skills)) {

package/dist/bridge/hub.d.ts

@@ -0,0 +1,11 @@
+import type { KeyObject } from "node:crypto";
+import type { BridgeIdentity } from "./store.js";
+/**
+ * One long poll at `{baseUrl}/v1/mcp-relay/hub/poll`, the call that keeps a paired computer
+ * present (#1377, plan P14). The headers are the network relay's (relay/src/relay/hub-client.ts):
+ * a relay JWT for `<issuer>/v1/mcp-relay/hub`, the protocol version and a replica id. It asks for
+ * no work (`calls=0`): S1 only stays reachable. Resolves with the HTTP status; throws on a
+ * transport failure or the 35 s timeout, and a `ClockSkewError` for a 401 a wrong clock caused.
+ */
+export declare function pollHub(identity: BridgeIdentity, key: KeyObject, replicaId: string, signal: AbortSignal): Promise<number>;
+//# sourceMappingURL=hub.d.ts.map

package/dist/bridge/hub.js

@@ -0,0 +1,44 @@
+import { mintRelayJwt } from "../relay-protocol/jws.js";
+import { kidOf, rawPublicKey } from "../relay-protocol/keys.js";
+import { POLL_WAIT_SECONDS, PROTOCOL_VERSION } from "../relay-protocol/wire.js";
+import { BRIDGE_VERSION } from "./inventory.js";
+import { clockSkew } from "./pairing.js";
+/**
+ * One long poll at `{baseUrl}/v1/mcp-relay/hub/poll`, the call that keeps a paired computer
+ * present (#1377, plan P14). The headers are the network relay's (relay/src/relay/hub-client.ts):
+ * a relay JWT for `<issuer>/v1/mcp-relay/hub`, the protocol version and a replica id. It asks for
+ * no work (`calls=0`): S1 only stays reachable. Resolves with the HTTP status; throws on a
+ * transport failure or the 35 s timeout, and a `ClockSkewError` for a 401 a wrong clock caused.
+ */
+export async function pollHub(identity, key, replicaId, signal) {
+    const query = new URLSearchParams({ calls: "0", listen: "0", control: "0", wait: String(POLL_WAIT_SECONDS) });
+    const kid = kidOf(rawPublicKey(key));
+    const audience = `${identity.issuer}/v1/mcp-relay/hub`;
+    // AbortSignal.any needs Node 20; the cli still runs on 18.
+    const timeout = new AbortController();
+    const abort = () => timeout.abort();
+    const timer = setTimeout(abort, (POLL_WAIT_SECONDS + 10) * 1000);
+    signal.addEventListener("abort", abort, { once: true });
+    try {
+        const response = await fetch(`${identity.baseUrl}/v1/mcp-relay/hub/poll?${query}`, {
+            headers: {
+                authorization: `Bearer ${mintRelayJwt(key, kid, identity.relayId, audience, Math.floor(Date.now() / 1000))}`,
+                "mcprelay-protocol": String(PROTOCOL_VERSION),
+                "mcprelay-version": BRIDGE_VERSION,
+                "mcprelay-replica": replicaId,
+            },
+            redirect: "error",
+            signal: timeout.signal,
+        });
+        const skew = response.status === 401 ? clockSkew(response) : null;
+        await response.body?.cancel();
+        if (skew)
+            throw skew;
+        return response.status;
+    }
+    finally {
+        clearTimeout(timer);
+        signal.removeEventListener("abort", abort);
+    }
+}
+//# sourceMappingURL=hub.js.map

package/dist/bridge/inventory.d.ts

@@ -0,0 +1,27 @@
+import type { BridgeConfig, Workspace } from "./toml.js";
+/** What `PUT /v1/local-bridge/inventory` takes (#1377, plan P10). */
+export interface DeviceInventory {
+    bridgeVersion: string;
+    protocolVersion: number;
+    os: string;
+    shell: {
+        path: string;
+        version: string | null;
+    } | null;
+    workspaces: Workspace[];
+    configHash: string;
+}
+export declare const BRIDGE_VERSION: string;
+/**
+ * What redeem takes as `name` and `os`: 1 to 64 characters, none of them a control, format
+ * (bidi, zero-width) or line/paragraph separator, the backend's `[^\p{C}\p{Zl}\p{Zp}]{1,64}`.
+ */
+export declare const LABEL: RegExp;
+/** `value` made into a {@link LABEL}, or `fallback` when nothing is left. */
+export declare function printable(value: string, fallback: string): string;
+export declare function deviceName(): string;
+/** "Windows 11 Pro" on Windows; the kernel name and release elsewhere. */
+export declare function deviceOs(): string;
+export declare function inventoryOf(input: Omit<DeviceInventory, "protocolVersion" | "configHash">): DeviceInventory;
+export declare function collectInventory(config: BridgeConfig): Promise<DeviceInventory>;
+//# sourceMappingURL=inventory.d.ts.map

package/dist/bridge/inventory.js

@@ -0,0 +1,41 @@
+import { createRequire } from "node:module";
+import { hostname, release, type, version } from "node:os";
+import { deviceConfigHash } from "../relay-protocol/pairing.js";
+import { PROTOCOL_VERSION } from "../relay-protocol/wire.js";
+import { bashVersion, findBash } from "./shell.js";
+export const BRIDGE_VERSION = createRequire(import.meta.url)("../../package.json").version;
+/**
+ * What redeem takes as `name` and `os`: 1 to 64 characters, none of them a control, format
+ * (bidi, zero-width) or line/paragraph separator, the backend's `[^\p{C}\p{Zl}\p{Zp}]{1,64}`.
+ */
+export const LABEL = /^[^\p{C}\p{Zl}\p{Zp}]{1,64}$/u;
+/** `value` made into a {@link LABEL}, or `fallback` when nothing is left. */
+export function printable(value, fallback) {
+    // Code points, not UTF-16 units: a cut surrogate pair would itself be a control character.
+    const clean = Array.from(value.replace(/[\p{C}\p{Zl}\p{Zp}]/gu, " ").trim()).slice(0, 64).join("");
+    return clean === "" ? fallback : clean;
+}
+export function deviceName() {
+    return printable(hostname(), "computer");
+}
+/** "Windows 11 Pro" on Windows; the kernel name and release elsewhere. */
+export function deviceOs() {
+    return printable(process.platform === "win32" ? version() : `${type()} ${release()}`, process.platform);
+}
+export function inventoryOf(input) {
+    return {
+        ...input,
+        protocolVersion: PROTOCOL_VERSION,
+        configHash: deviceConfigHash({ shell: input.shell?.path ?? null, workspaces: input.workspaces }),
+    };
+}
+export async function collectInventory(config) {
+    const shellPath = findBash(config.shell);
+    return inventoryOf({
+        bridgeVersion: BRIDGE_VERSION,
+        os: deviceOs(),
+        shell: shellPath === null ? null : { path: shellPath, version: await bashVersion(shellPath) },
+        workspaces: config.workspaces,
+    });
+}
+//# sourceMappingURL=inventory.js.map

package/dist/bridge/pairing.d.ts

@@ -0,0 +1,41 @@
+import type { KeyObject } from "node:crypto";
+import { type Jwk } from "../relay-protocol/keys.js";
+import type { DeviceInventory } from "./inventory.js";
+import type { BridgeIdentity } from "./store.js";
+/** The computer was revoked or is unknown to the backend: final, never retried. */
+export declare class DeviceGoneError extends Error {
+    constructor();
+}
+/** The 401 came from this computer's clock, not from a revocation: nothing is deleted. */
+export declare class ClockSkewError extends Error {
+    readonly offsetSeconds: number;
+    constructor(offsetSeconds: number, then?: string);
+}
+/** For a 401: the clock error when the response's `Date` and this computer's clock differ by more than 30 s. */
+export declare function clockSkew(response: Response, then?: string): ClockSkewError | null;
+export interface Redeemed {
+    pairingId: string;
+    expiresAt: string;
+    issuer: string;
+    fingerprint: string[];
+}
+/**
+ * Redeems a pairing code with a fresh key. Returns the words this key makes, checked against the
+ * backend's: those are the words the member compares with chat.
+ */
+export declare function redeem(baseUrl: string, key: KeyObject, code: string, name: string, os: string): Promise<Redeemed>;
+export type Confirmed = Pick<BridgeIdentity, "relayId" | "organizationId" | "ownerMemberId" | "issuer"> & {
+    jwks: {
+        keys: Jwk[];
+    };
+};
+/**
+ * Asks every 2 s whether the member confirmed the pairing in chat. Resolves with the device's
+ * identity, or null when the pairing expired. A failed request is asked again on the next tick.
+ */
+export declare function awaitConfirmation(baseUrl: string, key: KeyObject, redeemed: Redeemed): Promise<Confirmed | null>;
+/** A relay JWT for the backend's device endpoints. */
+export declare function relayAuthorization(identity: BridgeIdentity, key: KeyObject): string;
+export declare function reportInventory(identity: BridgeIdentity, key: KeyObject, inventory: DeviceInventory): Promise<void>;
+export declare function disconnectDevice(identity: BridgeIdentity, key: KeyObject): Promise<void>;
+//# sourceMappingURL=pairing.d.ts.map

package/dist/bridge/pairing.js

@@ -0,0 +1,158 @@
+import { BackboneApiError } from "../lib/errors.js";
+import { b64url } from "../relay-protocol/b64.js";
+import { mintRelayJwt } from "../relay-protocol/jws.js";
+import { kidOf, rawPublicKey } from "../relay-protocol/keys.js";
+import { fingerprintWords, mintPairingJwt, signPairProof } from "../relay-protocol/pairing.js";
+/**
+ * The bridge's own calls to the backend (#1377, plan P3, P4, P10). None carries an account
+ * credential: redeem is open, the pairing poll signs with the new key, and once paired every call
+ * carries a relay JWT signed by the device key.
+ */
+const POLL_INTERVAL_MS = 2_000;
+/** The computer was revoked or is unknown to the backend: final, never retried. */
+export class DeviceGoneError extends Error {
+    constructor() {
+        super("This computer was disconnected. Run 2kw bridge connect to pair it again.");
+        this.name = "DeviceGoneError";
+    }
+}
+/** The skew the backend allows on a signed token's `iat`/`exp`; past it every signed call gets a 401. */
+const MAX_SKEW_S = 30;
+/** The 401 came from this computer's clock, not from a revocation: nothing is deleted. */
+export class ClockSkewError extends Error {
+    offsetSeconds;
+    constructor(offsetSeconds, then = "Set it to the right time, then run this again.") {
+        super(`This computer's clock is off by ${Math.abs(offsetSeconds)} s and must be corrected. ${then}`);
+        this.offsetSeconds = offsetSeconds;
+        this.name = "ClockSkewError";
+    }
+}
+/** For a 401: the clock error when the response's `Date` and this computer's clock differ by more than 30 s. */
+export function clockSkew(response, then) {
+    const server = Date.parse(response.headers.get("date") ?? "");
+    if (Number.isNaN(server))
+        return null;
+    const offset = Math.round((Date.now() - server) / 1000);
+    return Math.abs(offset) > MAX_SKEW_S ? new ClockSkewError(offset, then) : null;
+}
+const nowSec = () => Math.floor(Date.now() / 1000);
+const sleep = (ms) => new Promise((done) => setTimeout(done, ms));
+async function apiError(response) {
+    let body = {};
+    try {
+        body = (await response.json());
+    }
+    catch {
+        // Not JSON: the status line is all there is.
+    }
+    const str = (v) => (typeof v === "string" ? v : undefined);
+    return new BackboneApiError({
+        status: response.status,
+        error: str(body.errorCode) ?? str(body.title) ?? str(body.error) ?? response.statusText,
+        message: str(body.detail) ?? str(body.message) ?? `HTTP ${response.status}: ${response.statusText}`,
+        timestamp: new Date().toISOString(),
+        errorCode: str(body.errorCode),
+    });
+}
+/**
+ * Redeems a pairing code with a fresh key. Returns the words this key makes, checked against the
+ * backend's: those are the words the member compares with chat.
+ */
+export async function redeem(baseUrl, key, code, name, os) {
+    const raw = rawPublicKey(key);
+    const publicKey = b64url(raw);
+    const kid = kidOf(raw);
+    const proof = signPairProof(key, code, kid, publicKey, name, os);
+    const response = await fetch(`${baseUrl}/v1/local-bridge/pairings/redeem`, {
+        method: "POST",
+        headers: { "content-type": "application/json" },
+        body: JSON.stringify({ code, publicKey, kid, proof, name, os }),
+        redirect: "error",
+    });
+    if (!response.ok) {
+        const error = await apiError(response);
+        // Someone who saw the code may have used it first; chat would then show their computer.
+        if (error.errorCode === "PAIRING_CODE_INVALID") {
+            error.message += " If chat now asks you to confirm a computer, do not confirm it; start a new pairing in chat.";
+        }
+        throw error;
+    }
+    const redeemed = (await response.json());
+    const words = fingerprintWords(raw);
+    if (!Array.isArray(redeemed.fingerprint) || redeemed.fingerprint.join(" ") !== words.join(" ")) {
+        throw new Error("The server reported a different key for this computer. Nothing was connected.");
+    }
+    return { ...redeemed, fingerprint: words };
+}
+/**
+ * Asks every 2 s whether the member confirmed the pairing in chat. Resolves with the device's
+ * identity, or null when the pairing expired. A failed request is asked again on the next tick.
+ */
+export async function awaitConfirmation(baseUrl, key, redeemed) {
+    const kid = kidOf(rawPublicKey(key));
+    // Past this a failing backend cannot leave the command waiting forever.
+    const deadline = Date.parse(redeemed.expiresAt) + 60_000;
+    for (;;) {
+        if (Date.now() > deadline)
+            return null;
+        let response;
+        try {
+            response = await fetch(`${baseUrl}/v1/local-bridge/pairings/${encodeURIComponent(redeemed.pairingId)}`, {
+                headers: { authorization: `Bearer ${mintPairingJwt(key, kid, redeemed.pairingId, redeemed.issuer, nowSec())}` },
+                redirect: "error",
+            });
+        }
+        catch {
+            response = undefined;
+        }
+        if (response?.ok) {
+            const body = (await response.json());
+            if (body.status === "CONFIRMED") {
+                const { relayId, organizationId, ownerMemberId, issuer, jwks } = body;
+                return { relayId, organizationId, ownerMemberId, issuer, jwks };
+            }
+            if (body.status === "EXPIRED")
+                return null;
+        }
+        else if (response?.status === 401 || response?.status === 404) {
+            const skew = response.status === 401
+                ? clockSkew(response, "Do not confirm this computer in chat; set the clock right, then start a new pairing.")
+                : null;
+            if (skew)
+                throw skew;
+            // A newer pairing replaced this one, or it lapsed: the same outcome for this computer.
+            return null;
+        }
+        else if (response && response.status < 500) {
+            throw await apiError(response);
+        }
+        await sleep(POLL_INTERVAL_MS);
+    }
+}
+/** A relay JWT for the backend's device endpoints. */
+export function relayAuthorization(identity, key) {
+    return `Bearer ${mintRelayJwt(key, kidOf(rawPublicKey(key)), identity.relayId, `${identity.issuer}/v1/mcp-relay`, nowSec())}`;
+}
+async function deviceCall(identity, key, method, path, body) {
+    const response = await fetch(`${identity.baseUrl}${path}`, {
+        method,
+        headers: {
+            authorization: relayAuthorization(identity, key),
+            ...(body === undefined ? {} : { "content-type": "application/json" }),
+        },
+        body: body === undefined ? undefined : JSON.stringify(body),
+        redirect: "error",
+    });
+    if (response.status === 401)
+        throw clockSkew(response) ?? new DeviceGoneError();
+    if (!response.ok)
+        throw await apiError(response);
+    await response.body?.cancel();
+}
+export function reportInventory(identity, key, inventory) {
+    return deviceCall(identity, key, "PUT", "/v1/local-bridge/inventory", inventory);
+}
+export function disconnectDevice(identity, key) {
+    return deviceCall(identity, key, "POST", "/v1/local-bridge/device/disconnect");
+}
+//# sourceMappingURL=pairing.js.map

package/dist/bridge/paths.d.ts

@@ -0,0 +1,7 @@
+/**
+ * Where the local bridge keeps its key, identity and bridge.toml (#1377, plan P14):
+ * `%APPDATA%\2kw\bridge` on Windows, `~/.config/2kw/bridge` on Linux and macOS.
+ * `AI_2KW_BRIDGE_DIR` overrides it. Built here because `conf`'s own directories differ.
+ */
+export declare function bridgeDir(env?: NodeJS.ProcessEnv, platform?: NodeJS.Platform, home?: string): string;
+//# sourceMappingURL=paths.d.ts.map

package/dist/bridge/paths.js

@@ -0,0 +1,16 @@
+import { homedir } from "node:os";
+import { posix, win32 } from "node:path";
+/**
+ * Where the local bridge keeps its key, identity and bridge.toml (#1377, plan P14):
+ * `%APPDATA%\2kw\bridge` on Windows, `~/.config/2kw/bridge` on Linux and macOS.
+ * `AI_2KW_BRIDGE_DIR` overrides it. Built here because `conf`'s own directories differ.
+ */
+export function bridgeDir(env = process.env, platform = process.platform, home = homedir()) {
+    if (env.AI_2KW_BRIDGE_DIR)
+        return env.AI_2KW_BRIDGE_DIR;
+    if (platform === "win32") {
+        return win32.join(env.APPDATA ?? win32.join(home, "AppData", "Roaming"), "2kw", "bridge");
+    }
+    return posix.join(home, ".config", "2kw", "bridge");
+}
+//# sourceMappingURL=paths.js.map

package/dist/bridge/run.d.ts

@@ -0,0 +1,12 @@
+import type { KeyObject } from "node:crypto";
+import { type BridgeIdentity } from "./store.js";
+/**
+ * The foreground loop of `2kw bridge run` (#1377, plan P14). Reports the inventory at start, when
+ * bridge.toml (or the bash it names) changes, and every 10 minutes, and long-polls the hub so the
+ * computer shows as present. A 401 from either is final and rejects with {@link DeviceGoneError}:
+ * unlike the network relay, a device does not wait for its credential to come back. A 401 a wrong
+ * clock caused rejects with {@link ClockSkewError}, and a 426 from either with the update message.
+ * Resolves when `signal` aborts.
+ */
+export declare function runBridge(dir: string, identity: BridgeIdentity, key: KeyObject, signal: AbortSignal): Promise<void>;
+//# sourceMappingURL=run.d.ts.map