@agentdeck/bridge 1.1.0 → 1.2.0

package/dist/daemon-server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"daemon-server.d.ts","sourceRoot":"","sources":["../src/daemon-server.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAIH,OAAO,SAAS,MAAM,IAAI,CAAC;AAC3B,OAAO,EAAE,UAAU,EAA8B,MAAM,kBAAkB,CAAC;AA2H1E,OAAO,EAIL,KAAK,gBAAgB,EACtB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAiF,KAAK,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AA0DtI,OAAO,EAC0E,eAAe,EAI/F,MAAM,gBAAgB,CAAC;AAUxB,OAAO,EAYL,KAAK,kBAAkB,EACxB,MAAM,uBAAuB,CAAC;AAM/B,OAAO,EAA6B,KAAK,oBAAoB,EAAE,MAAM,IAAI,CAAC;AAsI1E,UAAU,QAAQ;IAChB,YAAY,EAAE,MAAM,CAAC;IACrB,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,6EAA6E;IAC7E,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAeD,iBAAS,cAAc,CAAC,QAAQ,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,cAAc,CAAC,EAAE,MAAM,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAOxH;AAkBD;;0DAE0D;AAC1D,iBAAS,kBAAkB,CACzB,aAAa,EAAE,MAAM,EACrB,YAAY,EAAE,MAAM,EACpB,UAAU,GAAE,MAAM,CAAC,IAAI,CAAC,oBAAoB,EAAE,CAAuB,GACpE,MAAM,GAAG,SAAS,CAqBpB;AASD;;0CAE0C;AAC1C,iBAAS,uBAAuB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAcrE;AA6CD;;;;;;;;;;;;;;uDAcuD;AACvD,iBAAS,oBAAoB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAQpD;AAED;;;;;;;;;sEASsE;AACtE,iBAAS,YAAY,CACnB,MAAM,EAAE,MAAM,EACd,YAAY,EAAE,MAAM,EACpB,eAAe,CAAC,EAAE,kBAAkB,GACnC;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,OAAO,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAAC,aAAa,CAAC,EAAE,MAAM,CAAA;CAAE,CAyB9G;AAED;mEACmE;AACnE,iBAAS,cAAc,CACrB,KAAK,EAAE,MAAM,GAAG,SAAS,EACzB,QAAQ,CAAC,EAAE,kBAAkB,EAC7B,aAAa,CAAC,EAAE,MAAM,GACrB,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAAC,GAAG,SAAS,CA8B3E;AAoBD;;;;;;;;;;;GAWG;AACH,wBAAgB,wBAAwB,CACtC,IAAI,EAAE;IAAE,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,EAAE,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,EAC5C,YAAY,EAAE,KAAK,CAAC;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,EAAE,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,GAClD,OAAO,CAST;AAkBD,iBAAS,iBAAiB,CAAC,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,EAAE,EAAE,SAAS,GAAG,IAAI,CAoD1E;AAYD,iBAAS,yBAAyB,CAAC,EAAE,EAAE,SAAS,GAAG,IAAI,CAStD;AAED,iBAAS,mBAAmB,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAsBlE;AA6ED,gBAAgB;AAChB,wBAAgB,uBAAuB,CAAC,CAAC,EAAE;IAAE,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IAAC,aAAa,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAKzH;AACD,gBAAgB;AAChB,wBAAgB,wBAAwB,IAAI,IAAI,CAS/C;AACD,gBAAgB;AAChB,eAAO,MAAM,gBAAgB;;;;;;;;;;;;4BAYH,kBAAkB,KAAG,QAAQ,GAAG,SAAS;gCACvC,IAAI;CAC/B,CAAC;AAEF,iBAAe,mBAAmB,CAAC,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CA8F3H;AA6FD,iEAAiE;AACjE,wBAAsB,iBAAiB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAwB1F;AAED;;;;;;;;;GASG;AACH,wBAAgB,0BAA0B,CAAC,CAAC,SAAS;IAAE,SAAS,CAAC,EAAE,MAAM,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAAE,EACnH,KAAK,EAAE,CAAC,GACP,CAAC,CAWH;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAgB,yBAAyB,CACvC,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,MAAM,GACb;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,aAAa,GAAG,WAAW,GAAG,UAAU,GAAG,aAAa,GAAG,UAAU,GAAG,UAAU,CAAA;CAAE,CAiBrH;AAID,MAAM,WAAW,aAAa;IAC5B,wEAAwE;IACxE,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;;;OAKG;IACH,UAAU,CAAC,EAAE,gBAAgB,CAAC;IAC9B,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,+DAA+D;IAC/D,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,kEAAkE;IAClE,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAyID,wBAAsB,WAAW,CAAC,IAAI,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC,CAs4JpE"}
+{"version":3,"file":"daemon-server.d.ts","sourceRoot":"","sources":["../src/daemon-server.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAIH,OAAO,SAAS,MAAM,IAAI,CAAC;AAC3B,OAAO,EAAE,UAAU,EAA8B,MAAM,kBAAkB,CAAC;AA2H1E,OAAO,EAIL,KAAK,gBAAgB,EACtB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAiF,KAAK,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAmEtI,OAAO,EAC0E,eAAe,EAI/F,MAAM,gBAAgB,CAAC;AAYxB,OAAO,EAYL,KAAK,kBAAkB,EACxB,MAAM,uBAAuB,CAAC;AAM/B,OAAO,EAA6B,KAAK,oBAAoB,EAAE,MAAM,IAAI,CAAC;AAwI1E,UAAU,QAAQ;IAChB,YAAY,EAAE,MAAM,CAAC;IACrB,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,6EAA6E;IAC7E,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAeD,iBAAS,cAAc,CAAC,QAAQ,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,cAAc,CAAC,EAAE,MAAM,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAOxH;AAkBD;;0DAE0D;AAC1D,iBAAS,kBAAkB,CACzB,aAAa,EAAE,MAAM,EACrB,YAAY,EAAE,MAAM,EACpB,UAAU,GAAE,MAAM,CAAC,IAAI,CAAC,oBAAoB,EAAE,CAAuB,GACpE,MAAM,GAAG,SAAS,CAqBpB;AASD;;0CAE0C;AAC1C,iBAAS,uBAAuB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAcrE;AA6CD;;;;;;;;;;;;;;uDAcuD;AACvD,iBAAS,oBAAoB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAQpD;AAED;;;;;;;;;sEASsE;AACtE,iBAAS,YAAY,CACnB,MAAM,EAAE,MAAM,EACd,YAAY,EAAE,MAAM,EACpB,eAAe,CAAC,EAAE,kBAAkB,GACnC;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,OAAO,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAAC,aAAa,CAAC,EAAE,MAAM,CAAA;CAAE,CAyB9G;AAED;mEACmE;AACnE,iBAAS,cAAc,CACrB,KAAK,EAAE,MAAM,GAAG,SAAS,EACzB,QAAQ,CAAC,EAAE,kBAAkB,EAC7B,aAAa,CAAC,EAAE,MAAM,GACrB,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAAC,GAAG,SAAS,CA8B3E;AAoBD;;;;;;;;;;;GAWG;AACH,wBAAgB,wBAAwB,CACtC,IAAI,EAAE;IAAE,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,EAAE,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,EAC5C,YAAY,EAAE,KAAK,CAAC;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,EAAE,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,GAClD,OAAO,CAST;AAkBD,iBAAS,iBAAiB,CAAC,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,EAAE,EAAE,SAAS,GAAG,IAAI,CAsD1E;AAYD,iBAAS,yBAAyB,CAAC,EAAE,EAAE,SAAS,GAAG,IAAI,CAStD;AAED,iBAAS,mBAAmB,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAsBlE;AA6ED,gBAAgB;AAChB,wBAAgB,uBAAuB,CAAC,CAAC,EAAE;IAAE,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IAAC,aAAa,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAKzH;AACD,gBAAgB;AAChB,wBAAgB,wBAAwB,IAAI,IAAI,CAS/C;AACD,gBAAgB;AAChB,eAAO,MAAM,gBAAgB;;;;;;;;;;;;4BAYH,kBAAkB,KAAG,QAAQ,GAAG,SAAS;gCACvC,IAAI;CAC/B,CAAC;AAEF,iBAAe,mBAAmB,CAAC,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CA8F3H;AA6FD,iEAAiE;AACjE,wBAAsB,iBAAiB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAwB1F;AAED;;;;;;;;;GASG;AACH,wBAAgB,0BAA0B,CAAC,CAAC,SAAS;IAAE,SAAS,CAAC,EAAE,MAAM,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAAE,EACnH,KAAK,EAAE,CAAC,GACP,CAAC,CAWH;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAgB,yBAAyB,CACvC,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,MAAM,GACb;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,aAAa,GAAG,WAAW,GAAG,UAAU,GAAG,aAAa,GAAG,UAAU,GAAG,UAAU,CAAA;CAAE,CAiBrH;AAID,MAAM,WAAW,aAAa;IAC5B,wEAAwE;IACxE,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;;;OAKG;IACH,UAAU,CAAC,EAAE,gBAAgB,CAAC;IAC9B,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,+DAA+D;IAC/D,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,kEAAkE;IAClE,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AA2ID,wBAAsB,WAAW,CAAC,IAAI,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC,CAooKpE"}

package/dist/daemon-server.js

@@ -81,6 +81,7 @@ import { fetchUsageFromApi, resetConsecutiveFailures } from './usage-api.js';
 import { getOrCreateToken, isLocalConnection, validateToken } from './auth.js';
 import { buildPublicHealth, gateHttpRequest, isAuthorizedHttpRequest } from './http-auth-gate.js';
 import { closePairingWindow, getPairingWindowStatus, openPairingWindow, pairingWindowOpen, redeemPairingCode, } from './pairing-window.js';
+import { approvePeer, dismissKnock, isApprovedPeer, pairingApprovals, pairingKnocks, recordKnock, revokePeer, } from './pairing-knocks.js';
 import { getLastFrame, renderPreviewFrame, onFrameRendered, offFrameRendered } from './pixoo/pixoo-bridge.js';
 import { loadIDotMatrixDevices } from './idotmatrix/idotmatrix-settings.js';
 import { handlePixooWake } from './pixoo/pixoo-client.js';
@@ -118,10 +119,12 @@ import { threadModule } from './card-modules.js';
 import { AutonomousPocketEngine, createAutonomousPocketModules, parsePocketAutonomyConfig, } from './pocket-autonomy.js';
 import { WeatherProvider, parseWeatherSettings } from './weather.js';
 import { CalendarProvider, parseCalendarSettings } from './calendar.js';
+import { loadLearningPack, matchesLearningPackRequest } from './learning-pack.js';
+import { loadFontPack, matchesFontPackRequest } from './font-pack.js';
 import { renderGlanceFrame, GLANCE_FRAME_BOARDS } from './glance-frame.js';
 import { isPortableReaderProfile, negotiateSurface, parseHttpSurfaceIdentity, pullOtaResponseStatus, surfaceErrorBody, surfaceAllowsEvent, SurfaceProtocolError, validateSurfaceOtaIdentity, validateSurfaceQueryTuple, usesPortableReaderProjection, } from './surface-protocol.js';
 import { resolveRelayedUsageEvent } from './relayed-usage.js';
-import { CARD_FEED_PATH, CARD_OUTBOX_PATH, GLANCE_FRAME_PATH } from '@agentdeck/shared';
+import { CARD_FEED_PATH, CARD_OUTBOX_PATH, FONT_PACK_PATH, GLANCE_FRAME_PATH, LEARNING_PACK_PATH } from '@agentdeck/shared';
 import { readFileSync, statSync, writeFileSync, appendFileSync } from 'fs';
 import { readFile, rm } from 'fs/promises';
 import { tmpdir, networkInterfaces } from 'os';
@@ -517,6 +520,8 @@ function registerWifiEsp32(d, ws) {
         touchDownSamples: typeof d.touchDownSamples === 'number' ? d.touchDownSamples : undefined,
         touchGestures: typeof d.touchGestures === 'number' ? d.touchGestures : undefined,
         alsReady: typeof d.alsReady === 'boolean' ? d.alsReady : undefined,
+        repaintCount: typeof d.repaintCount === 'number' ? d.repaintCount : undefined,
+        fullRefreshCount: typeof d.fullRefreshCount === 'number' ? d.fullRefreshCount : undefined,
         lastSeenMs: Date.now(),
     });
     wifiEsp32Sockets.set(key, ws);
@@ -1066,6 +1071,8 @@ function buildNodeModuleHealth(startedModules) {
                 sessionCount: status.sessionCount,
                 usageFiveH: status.usageFiveH,
                 processingCount: status.processingCount,
+                repaintCount: status.repaintCount,
+                fullRefreshCount: status.fullRefreshCount,
                 deviceInfoFresh: status.deviceInfoFresh,
             } : null,
             lastReadAt: status.lastReadAt,
@@ -1429,6 +1436,29 @@ export async function startDaemon(opts) {
     // Assigned after BridgeCore exists. The HTTP handler reads it only after
     // startup; nullable keeps the tiny listen→core initialization window safe.
     let subagentTimeline = null;
+    // The learning pack is immutable for one daemon lifetime. Package upgrades
+    // arrive with a new AgentDeck build; validating once keeps every sleeping
+    // reader pull cheap while a corrupt/mislicensed bundle fails closed.
+    let surfaceLearningPack = null;
+    try {
+        surfaceLearningPack = loadLearningPack();
+        log(`[agentdeck] Surface learning pack ready: ${surfaceLearningPack.advert.id}`
+            + ` v${surfaceLearningPack.advert.version} (${surfaceLearningPack.advert.size} bytes,`
+            + ` ${surfaceLearningPack.advert.licenseSpdx})`);
+    }
+    catch (err) {
+        log(`[agentdeck] Surface learning pack disabled: ${err instanceof Error ? err.message : String(err)}`);
+    }
+    let surfaceFontPack = null;
+    try {
+        surfaceFontPack = loadFontPack();
+        log(`[agentdeck] Surface font pack ready: ${surfaceFontPack.advert.id}`
+            + ` v${surfaceFontPack.advert.version} (${surfaceFontPack.advert.size} bytes,`
+            + ` ${surfaceFontPack.advert.licenseSpdx})`);
+    }
+    catch (err) {
+        log(`[agentdeck] Surface font pack disabled: ${err instanceof Error ? err.message : String(err)}`);
+    }
     // ===== HTTP server =====
     const httpServer = createServer((req, res) => {
         // LAN default-deny (issue #145): a request that is neither same-machine
@@ -1626,6 +1656,82 @@ export async function startDaemon(opts) {
             res.end(JSON.stringify({ open: false }));
             return;
         }
+        // The operator-approval half of the credential path. A code asks the DEVICE
+        // to prove something; these ask the OPERATOR, and only the second one a
+        // camera-less reader can complete. Like the window routes above they sit
+        // BEHIND the normal auth gate — a remote peer able to approve itself would
+        // be granting itself a credential.
+        //
+        // GET  /pair/knocks             → { knocks, approvals }
+        // POST /pair/approve  { key }   → { approved: true }
+        // POST /pair/revoke   { key }   → { revoked: bool }
+        // POST /pair/dismiss  { key }   → { dismissed: bool }
+        // The wire shape is the Swift daemon's, field for field: the Mac app in
+        // CLIENT mode calls these routes against whichever daemon holds 9120, so a
+        // shape of our own would break its approval UI on exactly the machines that
+        // run both. `deviceId` is "" rather than null when a row is address-scoped
+        // (the client maps "" back to nil), and every timestamp is epoch ms.
+        if (req.method === 'GET' && pathname === '/pair/knocks') {
+            res.writeHead(200, { 'Content-Type': 'application/json', 'Cache-Control': 'no-store' });
+            res.end(JSON.stringify({
+                knocks: pairingKnocks().map((k) => ({
+                    key: k.key,
+                    ip: k.ip,
+                    deviceId: k.deviceId ?? '',
+                    attempts: k.attempts,
+                    firstSeen: k.firstSeen,
+                    lastSeen: k.lastSeen,
+                    staleToken: k.staleToken,
+                })),
+                approved: pairingApprovals().map((a) => ({
+                    key: a.key,
+                    deviceId: a.deviceId ?? '',
+                    lastIP: a.lastIP,
+                    approvedAt: a.approvedAt,
+                })),
+            }));
+            return;
+        }
+        if (req.method === 'POST' && (pathname === '/pair/approve'
+            || pathname === '/pair/revoke' || pathname === '/pair/dismiss')) {
+            void (async () => {
+                let body = {};
+                try {
+                    body = await readJsonBody(req, 4096);
+                }
+                catch { /* defaults */ }
+                const key = typeof body.key === 'string' ? body.key : '';
+                if (!key) {
+                    res.writeHead(400, { 'Content-Type': 'application/json' });
+                    res.end(JSON.stringify({ error: 'key required' }));
+                    return;
+                }
+                res.writeHead(200, { 'Content-Type': 'application/json', 'Cache-Control': 'no-store' });
+                if (pathname === '/pair/approve') {
+                    approvePeer(key);
+                    log(`[agentdeck] Operator approved peer ${key}`);
+                    res.end(JSON.stringify({ approved: key }));
+                }
+                else if (pathname === '/pair/revoke') {
+                    revokePeer(key);
+                    log(`[agentdeck] Operator revoked peer ${key}`);
+                    res.end(JSON.stringify({ revoked: key }));
+                }
+                else {
+                    // Dismiss is silent, as in Swift — it is not an operator decision
+                    // about trust, just a row cleared off a list.
+                    dismissKnock(key);
+                    res.end(JSON.stringify({ dismissed: key }));
+                }
+            })().catch(() => {
+                try {
+                    res.writeHead(500, { 'Content-Type': 'application/json' });
+                    res.end(JSON.stringify({ error: 'could not update approvals' }));
+                }
+                catch { /* client gone */ }
+            });
+            return;
+        }
         if (req.method === 'GET' && pathname === '/status') {
             const snap = core.stateMachine.getSnapshot();
             res.writeHead(200, { 'Content-Type': 'application/json' });
@@ -2024,6 +2130,138 @@ export async function startDaemon(opts) {
             }
             return;
         }
+        // ===== Licensed learning-pack delivery — portable-reader/v1 =====
+        if (req.method === 'GET' && pathname === LEARNING_PACK_PATH) {
+            const ip = req.socket.remoteAddress ?? '';
+            let surfaceIdentity;
+            try {
+                surfaceIdentity = parseHttpSurfaceIdentity(req.headers, 'learning.pack.read');
+                if (!surfaceIdentity) {
+                    throw new SurfaceProtocolError(400, 'surface_identity_required', 'Learning-pack delivery requires all Surface identity headers');
+                }
+                validateSurfaceQueryTuple(surfaceIdentity, parsedUrl.searchParams);
+                if (surfaceIdentity.productId !== 'io.pocketdaily.reader') {
+                    throw new SurfaceProtocolError(409, 'surface_learning_product_mismatch', 'This learning pack is registered for Pocket Daily Reader');
+                }
+            }
+            catch (err) {
+                if (err instanceof SurfaceProtocolError) {
+                    res.writeHead(err.status, { 'Content-Type': 'application/json' });
+                    res.end(JSON.stringify(surfaceErrorBody(err)));
+                    return;
+                }
+                throw err;
+            }
+            if (!surfaceLearningPack) {
+                res.writeHead(503, { 'Content-Type': 'application/json', 'Cache-Control': 'no-store' });
+                res.end(JSON.stringify({ error: 'learning_pack_unavailable' }));
+                return;
+            }
+            if (!matchesLearningPackRequest(surfaceLearningPack, parsedUrl.searchParams.get('id'), parsedUrl.searchParams.get('version'))) {
+                res.writeHead(404, { 'Content-Type': 'application/json', 'Cache-Control': 'no-store' });
+                res.end(JSON.stringify({ error: 'learning_pack_not_found' }));
+                return;
+            }
+            const preferredIp = preferredPullOtaIp(ip, req.socket.localAddress ?? '');
+            if (preferredIp) {
+                const routePort = req.socket.localPort ?? 9120;
+                log(`[agentdeck] Surface path redirect: learning-pack ${surfaceIdentity.board} (${ip}) via ${preferredIp}`);
+                res.writeHead(307, {
+                    Location: `http://${preferredIp}:${routePort}${parsedUrl.pathname}${parsedUrl.search}`,
+                    'Cache-Control': 'no-store',
+                    'Connection': 'close',
+                });
+                res.end();
+                return;
+            }
+            log(`[agentdeck] learning-pack download: ${surfaceIdentity.board} (${ip})`
+                + ` ← ${surfaceLearningPack.advert.id} v${surfaceLearningPack.advert.version}`);
+            const requestedFrom = Number(parsedUrl.searchParams.get('from') ?? '0');
+            const requestedLimitRaw = parsedUrl.searchParams.get('limit');
+            const requestedLimit = requestedLimitRaw == null ? undefined : Number(requestedLimitRaw);
+            const { from, body } = pullOtaSegment(surfaceLearningPack.bytes, requestedFrom, requestedLimit);
+            res.writeHead(200, {
+                'Content-Type': 'application/vnd.pocketdaily.learning-pack',
+                'Content-Length': String(body.length),
+                ...(from > 0
+                    ? { 'Content-Range': body.length > 0
+                            ? `bytes ${from}-${from + body.length - 1}/${surfaceLearningPack.bytes.length}`
+                            : `bytes */${surfaceLearningPack.bytes.length}` }
+                    : {}),
+                'X-Learning-Pack-MD5': surfaceLearningPack.advert.md5,
+                'X-Learning-Pack-License': surfaceLearningPack.advert.licenseSpdx,
+                'Cache-Control': 'no-store',
+                'Connection': 'close',
+            });
+            res.end(body);
+            return;
+        }
+        // ===== Licensed automatic font-pack delivery — portable-reader/v1 =====
+        if (req.method === 'GET' && pathname === FONT_PACK_PATH) {
+            const ip = req.socket.remoteAddress ?? '';
+            let surfaceIdentity;
+            try {
+                surfaceIdentity = parseHttpSurfaceIdentity(req.headers, 'font.pack.read');
+                if (!surfaceIdentity) {
+                    throw new SurfaceProtocolError(400, 'surface_identity_required', 'Font-pack delivery requires all Surface identity headers');
+                }
+                validateSurfaceQueryTuple(surfaceIdentity, parsedUrl.searchParams);
+                if (surfaceIdentity.productId !== 'io.pocketdaily.reader') {
+                    throw new SurfaceProtocolError(409, 'surface_font_product_mismatch', 'This font pack is registered for Pocket Daily Reader');
+                }
+            }
+            catch (err) {
+                if (err instanceof SurfaceProtocolError) {
+                    res.writeHead(err.status, { 'Content-Type': 'application/json' });
+                    res.end(JSON.stringify(surfaceErrorBody(err)));
+                    return;
+                }
+                throw err;
+            }
+            if (!surfaceFontPack) {
+                res.writeHead(503, { 'Content-Type': 'application/json', 'Cache-Control': 'no-store' });
+                res.end(JSON.stringify({ error: 'font_pack_unavailable' }));
+                return;
+            }
+            if (!matchesFontPackRequest(surfaceFontPack, parsedUrl.searchParams.get('id'), parsedUrl.searchParams.get('version'))) {
+                res.writeHead(404, { 'Content-Type': 'application/json', 'Cache-Control': 'no-store' });
+                res.end(JSON.stringify({ error: 'font_pack_not_found' }));
+                return;
+            }
+            const preferredIp = preferredPullOtaIp(ip, req.socket.localAddress ?? '');
+            if (preferredIp) {
+                const routePort = req.socket.localPort ?? 9120;
+                log(`[agentdeck] Surface path redirect: font-pack ${surfaceIdentity.board} (${ip}) via ${preferredIp}`);
+                res.writeHead(307, {
+                    Location: `http://${preferredIp}:${routePort}${parsedUrl.pathname}${parsedUrl.search}`,
+                    'Cache-Control': 'no-store',
+                    'Connection': 'close',
+                });
+                res.end();
+                return;
+            }
+            log(`[agentdeck] font-pack download: ${surfaceIdentity.board} (${ip})`
+                + ` ← ${surfaceFontPack.advert.id} v${surfaceFontPack.advert.version}`);
+            const requestedFrom = Number(parsedUrl.searchParams.get('from') ?? '0');
+            const requestedLimitRaw = parsedUrl.searchParams.get('limit');
+            const requestedLimit = requestedLimitRaw == null ? undefined : Number(requestedLimitRaw);
+            const { from, body } = pullOtaSegment(surfaceFontPack.bytes, requestedFrom, requestedLimit);
+            res.writeHead(200, {
+                'Content-Type': 'application/vnd.pocketdaily.cpfont',
+                'Content-Length': String(body.length),
+                ...(from > 0
+                    ? { 'Content-Range': body.length > 0
+                            ? `bytes ${from}-${from + body.length - 1}/${surfaceFontPack.bytes.length}`
+                            : `bytes */${surfaceFontPack.bytes.length}` }
+                    : {}),
+                'X-Font-Pack-MD5': surfaceFontPack.advert.md5,
+                'X-Font-Pack-License': surfaceFontPack.advert.licenseSpdx,
+                'Cache-Control': 'no-store',
+                'Connection': 'close',
+            });
+            res.end(body);
+            return;
+        }
         // ===== Card Feed pull sync (M6) — wake-sync-sleep battery clients =====
         // Auth mirrors /apme: local connections are free; anything else needs the
         // pairing token (?token=). Devices hold it from provisioning — since
@@ -2193,6 +2431,19 @@ export async function startDaemon(opts) {
                     const fwAdvert = stagedFwAdvert(pullBoard ?? undefined, otaIdentity, surfaceIdentity?.clientVersion);
                     if (fwAdvert)
                         feed.fw = fwAdvert;
+                    if (!fwAdvert && surfaceLearningPack
+                        && surfaceIdentity?.productId === 'io.pocketdaily.reader'
+                        && surfaceIdentity.capabilities.includes('learning.pack.update')) {
+                        // The advert deliberately rides unchanged responses. It is omitted
+                        // during OTA-first bootstrap so the device installs firmware before
+                        // spending its battery/link budget on content bytes.
+                        feed.learningPack = surfaceLearningPack.advert;
+                    }
+                    if (!fwAdvert && surfaceFontPack
+                        && surfaceIdentity?.productId === 'io.pocketdaily.reader'
+                        && surfaceIdentity.capabilities.includes('font.pack.update')) {
+                        feed.fontPack = surfaceFontPack.advert;
+                    }
                     const telemetry = parsePullTelemetry(parsedUrl.searchParams);
                     if (applyPullOtaBootstrap(feed, fwAdvert !== undefined)) {
                         // Do not make a weak-link X3 receive and parse a full content deck
@@ -3610,6 +3861,7 @@ export async function startDaemon(opts) {
             core.wsServer.broadcast(resolveRelayedUsageEvent({
                 relayed: u,
                 ownCodexRateLimits: core.lastBuiltCodexRateLimits,
+                ownLiveFamilyAuthorityExpiresAtMs: core.lastBuiltCodexLiveFamilyAuthorityExpiresAtMs,
                 buildOwnUsage: () => core.buildUsage(),
             }));
         }
@@ -3663,6 +3915,8 @@ export async function startDaemon(opts) {
                     version: d.version ?? null,
                     stale: d.stale,
                     serialActive: d.serialActive,
+                    repaintCount: d.repaintCount ?? null,
+                    fullRefreshCount: d.fullRefreshCount ?? null,
                 })),
             };
         }
@@ -3730,6 +3984,14 @@ export async function startDaemon(opts) {
         bridgeIp: getLanIp(),
         bridgePort: port,
     }));
+    // Operator-approval authentication (daemon only, for the same reason). The
+    // roster belongs to the process that serves the operator's approval routes;
+    // a session bridge sharing WsServer must not answer "is this peer approved?"
+    // from a second, unowned copy of it.
+    core.wsServer.setPairingApprovalHooks({
+        isApproved: (ip, deviceId) => isApprovedPeer(ip, deviceId),
+        record: (ip, deviceId, staleToken) => recordKnock(ip, deviceId, staleToken),
+    });
     // WS-path display_state re-sync: the 5s serial heartbeat above only covers
     // USB-attached boards. WiFi boards (InkDeck) receive display_state edge-
     // triggered over the plugin WS — a missed wake edge would leave an e-ink