@agimon-ai/doompi-session 0.0.1-alpha.1

package/dist/src/extensions/workspaces/sessions/(backend)/root.server.mjs

@@ -0,0 +1,99 @@
+import { provideBackgroundWorkService } from "../../../../services/backgroundWorkService/index.mjs";
+import { createPeerCommunication, parseRemoteSessionReference, peerSessionReference, readSessionPeerConfig } from "../../../../services/peerTransport/index.mjs";
+import { createSessionDirectory } from "../../../../services/sessionDirectory/index.mjs";
+import { createSessionGroupStore } from "../../../../services/sessionGroups/index.mjs";
+import { DOOM_SESSION_INTERCOM_SERVICE } from "../../../../services/sessionIntercom/type.mjs";
+import { createSessionGroupDeliveryAuthorizer, createSessionIntercom } from "../../../../services/sessionIntercom/index.mjs";
+import { readDoomSessionDelivery } from "../../../../services/sessionDelivery/type.mjs";
+import { provideSessionDeliveryService } from "../../../../services/sessionDelivery/index.mjs";
+import { registerSessionPeerInbox } from "../../../../services/peerInbox/index.mjs";
+import fs from "node:fs";
+import path from "node:path";
+import { defineRoot } from "@agimon-ai/doompi-core/extension-file";
+//#region src/extensions/workspaces/sessions/(backend)/root.server.ts
+var root_server_default = defineRoot((pluginContext) => ({
+	value: void 0,
+	services: [provideBackgroundWorkService, (context) => {
+		const agent = pluginContext.agent;
+		const session = agent?.context.session;
+		const communication = pluginContext.host.context.sessionCommunication;
+		const homeDirectory = pluginContext.host.context.homeDirectory;
+		const sessionService = pluginContext.host.context.sessionService;
+		if (!agent || !session?.admitPrompt || !communication || !homeDirectory || !sessionService?.canCommunicate) throw new Error("Session delivery requires the headless agent, authenticated session communication, host home directory, and communication policy.");
+		const sessionDirectory = path.join(homeDirectory, ".pi", ".doom", "session");
+		const deliveryDirectory = path.join(sessionDirectory, "delivery");
+		fs.mkdirSync(deliveryDirectory, {
+			recursive: true,
+			mode: 448
+		});
+		const peerCommunication = createPeerCommunication({
+			local: communication,
+			homeDirectory
+		});
+		const peerConfig = readSessionPeerConfig(homeDirectory);
+		const remotePeerIsGranted = (peerKey) => {
+			const peer = parseRemoteSessionReference(peerKey);
+			return peer !== void 0 && peerConfig?.peers.some((candidate) => candidate.hostId === peer.hostId && candidate.allowedSessionIds.includes(agent.context.sessionId)) === true;
+		};
+		const fallbackAuthorization = (peerKey) => sessionService.canCommunicate?.(agent.context.sessionId, peerKey) === true || remotePeerIsGranted(peerKey);
+		const groups = peerConfig ? createSessionGroupStore({ databasePath: path.join(sessionDirectory, "groups.sqlite") }) : void 0;
+		const localHostId = peerConfig?.hostId;
+		const selfReference = localHostId ? peerSessionReference(localHostId, agent.context.sessionId) : void 0;
+		const groupAuthorization = groups && selfReference && localHostId ? createSessionGroupDeliveryAuthorizer({
+			selfReference,
+			groups,
+			peerReference: (peerKey) => parseRemoteSessionReference(peerKey) === void 0 ? peerSessionReference(localHostId, peerKey) : peerKey,
+			fallback: fallbackAuthorization
+		}) : void 0;
+		const closeDelivery = provideSessionDeliveryService(context, {
+			databasePath: path.join(deliveryDirectory, `${agent.context.sessionId}.sqlite`),
+			recipientKey: agent.context.sessionId,
+			communication: peerCommunication,
+			authorizePeer: (peerKey, metadata) => groupAuthorization?.(peerKey, metadata) ?? fallbackAuthorization(peerKey),
+			admitPrompt: (prompt, delivery) => session.admitPrompt(prompt, delivery)
+		});
+		const service = readDoomSessionDelivery(context);
+		if (!service?.receive) throw new Error("Session peer delivery receiver was not installed.");
+		const unprovide = [];
+		if (groups && selfReference && peerConfig) {
+			const directory = createSessionDirectory({ authorizeDiscovery: (caller, subject) => {
+				const reference = peerSessionReference(subject.hostId, subject.sessionId);
+				return groups.groupsFor(caller).some((group) => group.members.includes(reference)) ? { capabilities: ["message"] } : void 0;
+			} });
+			for (const peer of peerConfig.peers) for (const sessionId of peer.allowedSessionIds) directory.observe({
+				hostId: peer.hostId,
+				sessionId,
+				hostIncarnation: "unknown",
+				sessionIncarnation: "unknown",
+				sequence: 0,
+				observedAt: 0,
+				staleAfterMs: 0,
+				deliveryTarget: peerSessionReference(peer.hostId, sessionId),
+				reachability: "unknown",
+				runtime: "unknown",
+				activity: "unknown",
+				voice: {
+					eligible: "unknown",
+					readiness: "unknown"
+				}
+			});
+			unprovide.push(context.provide(DOOM_SESSION_INTERCOM_SERVICE, createSessionIntercom({
+				selfReference,
+				directory,
+				groups,
+				delivery: service
+			})));
+		}
+		const unregister = registerSessionPeerInbox(agent.context.sessionId, (sourceKey, kind, payload) => service.receive?.(sourceKey, kind, payload));
+		return async () => {
+			unregister();
+			for (const release of unprovide.reverse()) release();
+			await closeDelivery();
+			groups?.close();
+		};
+	}]
+}));
+//#endregion
+export { root_server_default as default };
+
+//# sourceMappingURL=root.server.mjs.map

package/dist/src/extensions/workspaces/sessions/(backend)/root.server.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"root.server.mjs","names":[],"sources":["../../../../../../src/extensions/workspaces/sessions/(backend)/root.server.ts"],"sourcesContent":["import fs from 'node:fs';\nimport path from 'node:path';\n\nimport { defineRoot } from '@agimon-ai/doompi-core/extension-file';\nimport type { DoomServerPluginContext } from '@agimon-ai/doompi-core/server-facet';\n\nimport { provideBackgroundWorkService } from '../../../../services/backgroundWorkService';\nimport { registerSessionPeerInbox } from '../../../../services/peerInbox';\nimport {\n  createPeerCommunication,\n  parseRemoteSessionReference,\n  peerSessionReference,\n  readSessionPeerConfig,\n} from '../../../../services/peerTransport';\nimport { provideSessionDeliveryService, readDoomSessionDelivery } from '../../../../services/sessionDelivery';\nimport { createSessionDirectory } from '../../../../services/sessionDirectory';\nimport { createSessionGroupStore } from '../../../../services/sessionGroups';\nimport {\n  DOOM_SESSION_INTERCOM_SERVICE,\n  createSessionGroupDeliveryAuthorizer,\n  createSessionIntercom,\n} from '../../../../services/sessionIntercom';\n\nexport default defineRoot((pluginContext: DoomServerPluginContext) => ({\n  value: undefined,\n  services: [\n    provideBackgroundWorkService,\n    (context) => {\n      const agent = pluginContext.agent;\n      const session = agent?.context.session;\n      const communication = pluginContext.host.context.sessionCommunication;\n      const homeDirectory = pluginContext.host.context.homeDirectory;\n      const sessionService = pluginContext.host.context.sessionService;\n      if (!agent || !session?.admitPrompt || !communication || !homeDirectory || !sessionService?.canCommunicate) {\n        throw new Error(\n          'Session delivery requires the headless agent, authenticated session communication, host home directory, and communication policy.',\n        );\n      }\n      const sessionDirectory = path.join(homeDirectory, '.pi', '.doom', 'session');\n      const deliveryDirectory = path.join(sessionDirectory, 'delivery');\n      fs.mkdirSync(deliveryDirectory, { recursive: true, mode: 0o700 });\n      const peerCommunication = createPeerCommunication({ local: communication, homeDirectory });\n      const peerConfig = readSessionPeerConfig(homeDirectory);\n      const remotePeerIsGranted = (peerKey: string): boolean => {\n        const peer = parseRemoteSessionReference(peerKey);\n        return (\n          peer !== undefined &&\n          peerConfig?.peers.some(\n            (candidate) =>\n              candidate.hostId === peer.hostId && candidate.allowedSessionIds.includes(agent.context.sessionId),\n          ) === true\n        );\n      };\n      const fallbackAuthorization = (peerKey: string): boolean =>\n        sessionService.canCommunicate?.(agent.context.sessionId, peerKey) === true || remotePeerIsGranted(peerKey);\n      const groups = peerConfig\n        ? createSessionGroupStore({ databasePath: path.join(sessionDirectory, 'groups.sqlite') })\n        : undefined;\n      const localHostId = peerConfig?.hostId;\n      const selfReference = localHostId ? peerSessionReference(localHostId, agent.context.sessionId) : undefined;\n      const groupAuthorization =\n        groups && selfReference && localHostId\n          ? createSessionGroupDeliveryAuthorizer({\n              selfReference,\n              groups,\n              peerReference: (peerKey) =>\n                parseRemoteSessionReference(peerKey) === undefined\n                  ? peerSessionReference(localHostId, peerKey)\n                  : peerKey,\n              fallback: fallbackAuthorization,\n            })\n          : undefined;\n      const closeDelivery = provideSessionDeliveryService(context, {\n        databasePath: path.join(deliveryDirectory, `${agent.context.sessionId}.sqlite`),\n        recipientKey: agent.context.sessionId,\n        communication: peerCommunication,\n        authorizePeer: (peerKey, metadata) => groupAuthorization?.(peerKey, metadata) ?? fallbackAuthorization(peerKey),\n        admitPrompt: (prompt, delivery) => session.admitPrompt!(prompt, delivery),\n      });\n      const service = readDoomSessionDelivery(context);\n      if (!service?.receive) throw new Error('Session peer delivery receiver was not installed.');\n      const unprovide: (() => void)[] = [];\n      if (groups && selfReference && peerConfig) {\n        const directory = createSessionDirectory({\n          authorizeDiscovery: (caller, subject) => {\n            const reference = peerSessionReference(subject.hostId, subject.sessionId);\n            const permitted = groups.groupsFor(caller).some((group) => group.members.includes(reference));\n            return permitted ? { capabilities: ['message'] } : undefined;\n          },\n        });\n        for (const peer of peerConfig.peers)\n          for (const sessionId of peer.allowedSessionIds)\n            directory.observe({\n              hostId: peer.hostId,\n              sessionId,\n              hostIncarnation: 'unknown',\n              sessionIncarnation: 'unknown',\n              sequence: 0,\n              observedAt: 0,\n              staleAfterMs: 0,\n              deliveryTarget: peerSessionReference(peer.hostId, sessionId),\n              reachability: 'unknown',\n              runtime: 'unknown',\n              activity: 'unknown',\n              voice: { eligible: 'unknown', readiness: 'unknown' },\n            });\n        unprovide.push(\n          context.provide(\n            DOOM_SESSION_INTERCOM_SERVICE,\n            createSessionIntercom({ selfReference, directory, groups, delivery: service }),\n          ),\n        );\n      }\n      const unregister = registerSessionPeerInbox(agent.context.sessionId, (sourceKey, kind, payload) =>\n        service.receive?.(sourceKey, kind, payload),\n      );\n      return async () => {\n        unregister();\n        for (const release of unprovide.reverse()) release();\n        await closeDelivery();\n        groups?.close();\n      };\n    },\n  ],\n}));\n"],"mappings":";;;;;;;;;;;;;AAuBA,IAAA,sBAAe,YAAY,mBAA4C;CACrE,OAAO,KAAA;CACP,UAAU,CACR,+BACC,YAAY;EACX,MAAM,QAAQ,cAAc;EAC5B,MAAM,UAAU,OAAO,QAAQ;EAC/B,MAAM,gBAAgB,cAAc,KAAK,QAAQ;EACjD,MAAM,gBAAgB,cAAc,KAAK,QAAQ;EACjD,MAAM,iBAAiB,cAAc,KAAK,QAAQ;EAClD,IAAI,CAAC,SAAS,CAAC,SAAS,eAAe,CAAC,iBAAiB,CAAC,iBAAiB,CAAC,gBAAgB,gBAC1F,MAAM,IAAI,MACR,mIACF;EAEF,MAAM,mBAAmB,KAAK,KAAK,eAAe,OAAO,SAAS,SAAS;EAC3E,MAAM,oBAAoB,KAAK,KAAK,kBAAkB,UAAU;EAChE,GAAG,UAAU,mBAAmB;GAAE,WAAW;GAAM,MAAM;EAAM,CAAC;EAChE,MAAM,oBAAoB,wBAAwB;GAAE,OAAO;GAAe;EAAc,CAAC;EACzF,MAAM,aAAa,sBAAsB,aAAa;EACtD,MAAM,uBAAuB,YAA6B;GACxD,MAAM,OAAO,4BAA4B,OAAO;GAChD,OACE,SAAS,KAAA,KACT,YAAY,MAAM,MACf,cACC,UAAU,WAAW,KAAK,UAAU,UAAU,kBAAkB,SAAS,MAAM,QAAQ,SAAS,CACpG,MAAM;EAEV;EACA,MAAM,yBAAyB,YAC7B,eAAe,iBAAiB,MAAM,QAAQ,WAAW,OAAO,MAAM,QAAQ,oBAAoB,OAAO;EAC3G,MAAM,SAAS,aACX,wBAAwB,EAAE,cAAc,KAAK,KAAK,kBAAkB,eAAe,EAAE,CAAC,IACtF,KAAA;EACJ,MAAM,cAAc,YAAY;EAChC,MAAM,gBAAgB,cAAc,qBAAqB,aAAa,MAAM,QAAQ,SAAS,IAAI,KAAA;EACjG,MAAM,qBACJ,UAAU,iBAAiB,cACvB,qCAAqC;GACnC;GACA;GACA,gBAAgB,YACd,4BAA4B,OAAO,MAAM,KAAA,IACrC,qBAAqB,aAAa,OAAO,IACzC;GACN,UAAU;EACZ,CAAC,IACD,KAAA;EACN,MAAM,gBAAgB,8BAA8B,SAAS;GAC3D,cAAc,KAAK,KAAK,mBAAmB,GAAG,MAAM,QAAQ,UAAU,QAAQ;GAC9E,cAAc,MAAM,QAAQ;GAC5B,eAAe;GACf,gBAAgB,SAAS,aAAa,qBAAqB,SAAS,QAAQ,KAAK,sBAAsB,OAAO;GAC9G,cAAc,QAAQ,aAAa,QAAQ,YAAa,QAAQ,QAAQ;EAC1E,CAAC;EACD,MAAM,UAAU,wBAAwB,OAAO;EAC/C,IAAI,CAAC,SAAS,SAAS,MAAM,IAAI,MAAM,mDAAmD;EAC1F,MAAM,YAA4B,CAAC;EACnC,IAAI,UAAU,iBAAiB,YAAY;GACzC,MAAM,YAAY,uBAAuB,EACvC,qBAAqB,QAAQ,YAAY;IACvC,MAAM,YAAY,qBAAqB,QAAQ,QAAQ,QAAQ,SAAS;IAExE,OADkB,OAAO,UAAU,MAAM,CAAC,CAAC,MAAM,UAAU,MAAM,QAAQ,SAAS,SAAS,CAC5E,IAAI,EAAE,cAAc,CAAC,SAAS,EAAE,IAAI,KAAA;GACrD,EACF,CAAC;GACD,KAAK,MAAM,QAAQ,WAAW,OAC5B,KAAK,MAAM,aAAa,KAAK,mBAC3B,UAAU,QAAQ;IAChB,QAAQ,KAAK;IACb;IACA,iBAAiB;IACjB,oBAAoB;IACpB,UAAU;IACV,YAAY;IACZ,cAAc;IACd,gBAAgB,qBAAqB,KAAK,QAAQ,SAAS;IAC3D,cAAc;IACd,SAAS;IACT,UAAU;IACV,OAAO;KAAE,UAAU;KAAW,WAAW;IAAU;GACrD,CAAC;GACL,UAAU,KACR,QAAQ,QACN,+BACA,sBAAsB;IAAE;IAAe;IAAW;IAAQ,UAAU;GAAQ,CAAC,CAC/E,CACF;EACF;EACA,MAAM,aAAa,yBAAyB,MAAM,QAAQ,YAAY,WAAW,MAAM,YACrF,QAAQ,UAAU,WAAW,MAAM,OAAO,CAC5C;EACA,OAAO,YAAY;GACjB,WAAW;GACX,KAAK,MAAM,WAAW,UAAU,QAAQ,GAAG,QAAQ;GACnD,MAAM,cAAc;GACpB,QAAQ,MAAM;EAChB;CACF,CACF;AACF,EAAE"}

package/dist/src/schemas/apiContracts.cjs

@@ -0,0 +1,33 @@
+let _agimon_ai_doompi_core_api_contracts = require("@agimon-ai/doompi-core/api-contracts");
+let typebox = require("typebox");
+//#region src/schemas/apiContracts.ts
+/** The endpoint validates its own HMAC peer credential because tunnel device authentication is intentionally bypassed. */
+const http = [{
+	id: "peer-inbox",
+	scope: "global",
+	basePath: "session-peer",
+	method: "POST",
+	path: "/inbox",
+	authentication: "none",
+	description: "Accept an HMAC-authenticated durable Session delivery envelope from an explicitly configured tunnel peer.",
+	body: {
+		contentType: "application/json",
+		required: true,
+		schema: typebox.Type.Unknown()
+	},
+	responses: (0, _agimon_ai_doompi_core_api_contracts.jsonApiResponses)(typebox.Type.Object({
+		accepted: typebox.Type.Boolean(),
+		state: typebox.Type.String()
+	}))
+}];
+const apiContracts = (0, _agimon_ai_doompi_core_api_contracts.defineApiContract)({
+	version: 1,
+	http,
+	sockets: [],
+	dynamic: []
+});
+//#endregion
+exports.apiContracts = apiContracts;
+exports.default = apiContracts;
+
+//# sourceMappingURL=apiContracts.cjs.map

package/dist/src/schemas/apiContracts.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"apiContracts.cjs","names":["Type","jsonApiResponses","defineApiContract"],"sources":["../../../src/schemas/apiContracts.ts"],"sourcesContent":["import { defineApiContract, jsonApiResponses, type DoomHttpContract } from '@agimon-ai/doompi-core/api-contracts';\nimport { Type } from 'typebox';\n\n/** The endpoint validates its own HMAC peer credential because tunnel device authentication is intentionally bypassed. */\nconst http: DoomHttpContract[] = [\n  {\n    id: 'peer-inbox',\n    scope: 'global',\n    basePath: 'session-peer',\n    method: 'POST',\n    path: '/inbox',\n    authentication: 'none',\n    description:\n      'Accept an HMAC-authenticated durable Session delivery envelope from an explicitly configured tunnel peer.',\n    body: { contentType: 'application/json', required: true, schema: Type.Unknown() },\n    responses: jsonApiResponses(Type.Object({ accepted: Type.Boolean(), state: Type.String() })),\n  },\n];\n\nexport const apiContracts = defineApiContract({ version: 1, http, sockets: [], dynamic: [] });\nexport default apiContracts;\n"],"mappings":";;;;AAIA,MAAM,OAA2B,CAC/B;CACE,IAAI;CACJ,OAAO;CACP,UAAU;CACV,QAAQ;CACR,MAAM;CACN,gBAAgB;CAChB,aACE;CACF,MAAM;EAAE,aAAa;EAAoB,UAAU;EAAM,QAAQA,QAAAA,KAAK,QAAQ;CAAE;CAChF,YAAA,GAAWC,qCAAAA,iBAAAA,CAAiBD,QAAAA,KAAK,OAAO;EAAE,UAAUA,QAAAA,KAAK,QAAQ;EAAG,OAAOA,QAAAA,KAAK,OAAO;CAAE,CAAC,CAAC;AAC7F,CACF;AAEA,MAAa,gBAAA,GAAeE,qCAAAA,kBAAAA,CAAkB;CAAE,SAAS;CAAG;CAAM,SAAS,CAAC;CAAG,SAAS,CAAC;AAAE,CAAC"}

package/dist/src/schemas/apiContracts.d.cts

@@ -0,0 +1,52 @@
+//#region src/schemas/apiContracts.d.ts
+export declare const apiContracts: {
+  version: 1;
+  protocols?: Record<string, string> | undefined;
+  schemas?: Record<string, boolean | object> | undefined;
+  http: {
+    id: string;
+    scope: "global" | "session" | "workspace";
+    basePath?: string | undefined;
+    path: string;
+    method: "DELETE" | "GET" | "HEAD" | "OPTIONS" | "PATCH" | "POST" | "PUT";
+    description: string;
+    availability?: string | undefined;
+    authentication: "device" | "none" | "owner";
+    parameters?: {
+      name: string;
+      in: "header" | "path" | "query";
+      required: boolean;
+      schema: boolean | object;
+    }[] | undefined;
+    body?: {
+      contentType: string;
+      contentTypes?: string[] | undefined;
+      required: boolean;
+      schema: boolean | object;
+    } | undefined;
+    responses: Record<string, {
+      description: string;
+      contentType?: string | undefined;
+      schema?: boolean | object | undefined;
+      events?: Record<string, boolean | object> | undefined;
+    }>;
+  }[];
+  sockets: {
+    id: string;
+    scope: "global" | "session" | "workspace";
+    description: string;
+    availability?: string | undefined;
+    service: string;
+    member: string;
+    direction: "client-to-server" | "server-to-client";
+    kind: "channel" | "method" | "state";
+    input: boolean | object;
+    output?: boolean | object | undefined;
+    errors?: boolean | object | undefined;
+  }[];
+  dynamic: string[];
+  gaps?: string[] | undefined;
+};
+//#endregion
+export { apiContracts as default };
+//# sourceMappingURL=apiContracts.d.cts.map

package/dist/src/schemas/apiContracts.d.cts.map

@@ -0,0 +1 @@
+{"version":3,"file":"apiContracts.d.cts","names":[],"sources":["../../../src/schemas/apiContracts.ts"],"mappings":";qBAmBa"}

package/dist/src/schemas/apiContracts.d.mts

@@ -0,0 +1,52 @@
+//#region src/schemas/apiContracts.d.ts
+export declare const apiContracts: {
+  version: 1;
+  protocols?: Record<string, string> | undefined;
+  schemas?: Record<string, boolean | object> | undefined;
+  http: {
+    id: string;
+    scope: "global" | "session" | "workspace";
+    basePath?: string | undefined;
+    path: string;
+    method: "DELETE" | "GET" | "HEAD" | "OPTIONS" | "PATCH" | "POST" | "PUT";
+    description: string;
+    availability?: string | undefined;
+    authentication: "device" | "none" | "owner";
+    parameters?: {
+      name: string;
+      in: "header" | "path" | "query";
+      required: boolean;
+      schema: boolean | object;
+    }[] | undefined;
+    body?: {
+      contentType: string;
+      contentTypes?: string[] | undefined;
+      required: boolean;
+      schema: boolean | object;
+    } | undefined;
+    responses: Record<string, {
+      description: string;
+      contentType?: string | undefined;
+      schema?: boolean | object | undefined;
+      events?: Record<string, boolean | object> | undefined;
+    }>;
+  }[];
+  sockets: {
+    id: string;
+    scope: "global" | "session" | "workspace";
+    description: string;
+    availability?: string | undefined;
+    service: string;
+    member: string;
+    direction: "client-to-server" | "server-to-client";
+    kind: "channel" | "method" | "state";
+    input: boolean | object;
+    output?: boolean | object | undefined;
+    errors?: boolean | object | undefined;
+  }[];
+  dynamic: string[];
+  gaps?: string[] | undefined;
+};
+//#endregion
+export { apiContracts as default };
+//# sourceMappingURL=apiContracts.d.mts.map

package/dist/src/schemas/apiContracts.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"apiContracts.d.mts","names":[],"sources":["../../../src/schemas/apiContracts.ts"],"mappings":";qBAmBa"}

package/dist/src/schemas/apiContracts.mjs

@@ -0,0 +1,32 @@
+import { defineApiContract, jsonApiResponses } from "@agimon-ai/doompi-core/api-contracts";
+import { Type } from "typebox";
+//#region src/schemas/apiContracts.ts
+/** The endpoint validates its own HMAC peer credential because tunnel device authentication is intentionally bypassed. */
+const http = [{
+	id: "peer-inbox",
+	scope: "global",
+	basePath: "session-peer",
+	method: "POST",
+	path: "/inbox",
+	authentication: "none",
+	description: "Accept an HMAC-authenticated durable Session delivery envelope from an explicitly configured tunnel peer.",
+	body: {
+		contentType: "application/json",
+		required: true,
+		schema: Type.Unknown()
+	},
+	responses: jsonApiResponses(Type.Object({
+		accepted: Type.Boolean(),
+		state: Type.String()
+	}))
+}];
+const apiContracts = defineApiContract({
+	version: 1,
+	http,
+	sockets: [],
+	dynamic: []
+});
+//#endregion
+export { apiContracts, apiContracts as default };
+
+//# sourceMappingURL=apiContracts.mjs.map

package/dist/src/schemas/apiContracts.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"apiContracts.mjs","names":[],"sources":["../../../src/schemas/apiContracts.ts"],"sourcesContent":["import { defineApiContract, jsonApiResponses, type DoomHttpContract } from '@agimon-ai/doompi-core/api-contracts';\nimport { Type } from 'typebox';\n\n/** The endpoint validates its own HMAC peer credential because tunnel device authentication is intentionally bypassed. */\nconst http: DoomHttpContract[] = [\n  {\n    id: 'peer-inbox',\n    scope: 'global',\n    basePath: 'session-peer',\n    method: 'POST',\n    path: '/inbox',\n    authentication: 'none',\n    description:\n      'Accept an HMAC-authenticated durable Session delivery envelope from an explicitly configured tunnel peer.',\n    body: { contentType: 'application/json', required: true, schema: Type.Unknown() },\n    responses: jsonApiResponses(Type.Object({ accepted: Type.Boolean(), state: Type.String() })),\n  },\n];\n\nexport const apiContracts = defineApiContract({ version: 1, http, sockets: [], dynamic: [] });\nexport default apiContracts;\n"],"mappings":";;;;AAIA,MAAM,OAA2B,CAC/B;CACE,IAAI;CACJ,OAAO;CACP,UAAU;CACV,QAAQ;CACR,MAAM;CACN,gBAAgB;CAChB,aACE;CACF,MAAM;EAAE,aAAa;EAAoB,UAAU;EAAM,QAAQ,KAAK,QAAQ;CAAE;CAChF,WAAW,iBAAiB,KAAK,OAAO;EAAE,UAAU,KAAK,QAAQ;EAAG,OAAO,KAAK,OAAO;CAAE,CAAC,CAAC;AAC7F,CACF;AAEA,MAAa,eAAe,kBAAkB;CAAE,SAAS;CAAG;CAAM,SAAS,CAAC;CAAG,SAAS,CAAC;AAAE,CAAC"}

package/dist/src/services/backgroundWorkService/index.cjs

@@ -0,0 +1,79 @@
+let _agimon_ai_doompi_core_background_work = require("@agimon-ai/doompi-core/background-work");
+let typebox_value = require("typebox/value");
+//#region src/services/backgroundWorkService/index.ts
+/** Creates the generation-bound, pull-based coordinator shared by session extensions. */
+function createBackgroundWorkService(ctx) {
+	const registrations = /* @__PURE__ */ new Map();
+	const generation = `doom-background-work:${crypto.randomUUID()}`;
+	const changed = (provider, providerGeneration, kind) => {
+		ctx.emit(_agimon_ai_doompi_core_background_work.DOOM_BACKGROUND_WORK_CHANGED_EVENT, {
+			provider,
+			generation: providerGeneration,
+			kind
+		});
+	};
+	return Object.freeze({
+		generation,
+		register(provider) {
+			if (!provider || typeof provider !== "object" || typeof provider.listActiveWork !== "function") throw new TypeError("A background-work provider must expose listActiveWork().");
+			const name = provider.provider.trim();
+			if (!name || name !== provider.provider) throw new TypeError("A background-work provider requires a trimmed, non-empty name.");
+			const token = Symbol(name);
+			const providerGeneration = `${name}:${crypto.randomUUID()}`;
+			registrations.set(name, {
+				token,
+				generation: providerGeneration,
+				provider
+			});
+			changed(name, providerGeneration, "registered");
+			let disposed = false;
+			return Object.freeze({
+				provider: name,
+				generation: providerGeneration,
+				update() {
+					if (!disposed && registrations.get(name)?.token === token) changed(name, providerGeneration, "updated");
+				},
+				dispose() {
+					if (disposed) return;
+					disposed = true;
+					if (registrations.get(name)?.token !== token) return;
+					registrations.delete(name);
+					changed(name, providerGeneration, "unregistered");
+				}
+			});
+		},
+		snapshot(sessionId) {
+			const items = [];
+			const errors = [];
+			for (const [provider, registration] of registrations) try {
+				const current = registration.provider.listActiveWork();
+				if (!Array.isArray(current)) throw new TypeError("listActiveWork() must return an array.");
+				for (const item of current) {
+					if (!(0, typebox_value.Check)(_agimon_ai_doompi_core_background_work.BackgroundProviderWorkItemSchema, item)) throw new TypeError("listActiveWork() returned an invalid item.");
+					if (sessionId === void 0 || item.sessionId === sessionId) items.push({
+						provider,
+						...item
+					});
+				}
+			} catch (error) {
+				errors.push({
+					provider,
+					message: error instanceof Error ? error.message : String(error)
+				});
+			}
+			return Object.freeze({
+				items: Object.freeze(items),
+				errors: Object.freeze(errors)
+			});
+		}
+	});
+}
+/** Installs one coordinator in the current session service context. */
+function provideBackgroundWorkService(context) {
+	context.provide(_agimon_ai_doompi_core_background_work.DOOM_BACKGROUND_WORK_SERVICE, createBackgroundWorkService(context));
+}
+//#endregion
+exports.createBackgroundWorkService = createBackgroundWorkService;
+exports.provideBackgroundWorkService = provideBackgroundWorkService;
+
+//# sourceMappingURL=index.cjs.map

package/dist/src/services/backgroundWorkService/index.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.cjs","names":["DOOM_BACKGROUND_WORK_CHANGED_EVENT","Check","BackgroundProviderWorkItemSchema","DOOM_BACKGROUND_WORK_SERVICE"],"sources":["../../../../src/services/backgroundWorkService/index.ts"],"sourcesContent":["import {\n  BackgroundProviderWorkItemSchema,\n  DOOM_BACKGROUND_WORK_CHANGED_EVENT,\n  DOOM_BACKGROUND_WORK_SERVICE,\n  type BackgroundWorkProvider,\n  type BackgroundWorkProviderHandle,\n  type DoomBackgroundWorkService,\n  type DoomBackgroundWorkSnapshot,\n} from '@agimon-ai/doompi-core/background-work';\nimport type { Context } from '@deepseek-ai/cordis';\nimport { Check } from 'typebox/value';\n\ninterface ProviderRegistration {\n  readonly token: symbol;\n  readonly generation: string;\n  readonly provider: BackgroundWorkProvider;\n}\n\n/** Creates the generation-bound, pull-based coordinator shared by session extensions. */\nexport function createBackgroundWorkService(ctx: Context): DoomBackgroundWorkService {\n  const registrations = new Map<string, ProviderRegistration>();\n  const generation = `doom-background-work:${crypto.randomUUID()}`;\n\n  const changed = (\n    provider: string,\n    providerGeneration: string,\n    kind: 'registered' | 'updated' | 'unregistered',\n  ): void => {\n    ctx.emit(DOOM_BACKGROUND_WORK_CHANGED_EVENT, { provider, generation: providerGeneration, kind });\n  };\n\n  const service: DoomBackgroundWorkService = {\n    generation,\n    register(provider): BackgroundWorkProviderHandle {\n      if (!provider || typeof provider !== 'object' || typeof provider.listActiveWork !== 'function') {\n        throw new TypeError('A background-work provider must expose listActiveWork().');\n      }\n      const name = provider.provider.trim();\n      if (!name || name !== provider.provider) {\n        throw new TypeError('A background-work provider requires a trimmed, non-empty name.');\n      }\n      const token = Symbol(name);\n      const providerGeneration = `${name}:${crypto.randomUUID()}`;\n      registrations.set(name, { token, generation: providerGeneration, provider });\n      changed(name, providerGeneration, 'registered');\n      let disposed = false;\n      return Object.freeze({\n        provider: name,\n        generation: providerGeneration,\n        update(): void {\n          if (!disposed && registrations.get(name)?.token === token) {\n            changed(name, providerGeneration, 'updated');\n          }\n        },\n        dispose(): void {\n          if (disposed) return;\n          disposed = true;\n          if (registrations.get(name)?.token !== token) return;\n          registrations.delete(name);\n          changed(name, providerGeneration, 'unregistered');\n        },\n      });\n    },\n    snapshot(sessionId?: string): DoomBackgroundWorkSnapshot {\n      const items: DoomBackgroundWorkSnapshot['items'][number][] = [];\n      const errors: DoomBackgroundWorkSnapshot['errors'][number][] = [];\n      for (const [provider, registration] of registrations) {\n        try {\n          const current = registration.provider.listActiveWork();\n          if (!Array.isArray(current)) throw new TypeError('listActiveWork() must return an array.');\n          for (const item of current) {\n            if (!Check(BackgroundProviderWorkItemSchema, item)) {\n              throw new TypeError('listActiveWork() returned an invalid item.');\n            }\n            if (sessionId === undefined || item.sessionId === sessionId) items.push({ provider, ...item });\n          }\n        } catch (error) {\n          errors.push({ provider, message: error instanceof Error ? error.message : String(error) });\n        }\n      }\n      return Object.freeze({ items: Object.freeze(items), errors: Object.freeze(errors) });\n    },\n  };\n  return Object.freeze(service);\n}\n\n/** Installs one coordinator in the current session service context. */\nexport function provideBackgroundWorkService(context: Context): void {\n  context.provide(DOOM_BACKGROUND_WORK_SERVICE, createBackgroundWorkService(context));\n}\n"],"mappings":";;;;AAmBA,SAAgB,4BAA4B,KAAyC;CACnF,MAAM,gCAAgB,IAAI,IAAkC;CAC5D,MAAM,aAAa,wBAAwB,OAAO,WAAW;CAE7D,MAAM,WACJ,UACA,oBACA,SACS;EACT,IAAI,KAAKA,uCAAAA,oCAAoC;GAAE;GAAU,YAAY;GAAoB;EAAK,CAAC;CACjG;CAsDA,OAAO,OAAO,OAAO;EAnDnB;EACA,SAAS,UAAwC;GAC/C,IAAI,CAAC,YAAY,OAAO,aAAa,YAAY,OAAO,SAAS,mBAAmB,YAClF,MAAM,IAAI,UAAU,0DAA0D;GAEhF,MAAM,OAAO,SAAS,SAAS,KAAK;GACpC,IAAI,CAAC,QAAQ,SAAS,SAAS,UAC7B,MAAM,IAAI,UAAU,gEAAgE;GAEtF,MAAM,QAAQ,OAAO,IAAI;GACzB,MAAM,qBAAqB,GAAG,KAAK,GAAG,OAAO,WAAW;GACxD,cAAc,IAAI,MAAM;IAAE;IAAO,YAAY;IAAoB;GAAS,CAAC;GAC3E,QAAQ,MAAM,oBAAoB,YAAY;GAC9C,IAAI,WAAW;GACf,OAAO,OAAO,OAAO;IACnB,UAAU;IACV,YAAY;IACZ,SAAe;KACb,IAAI,CAAC,YAAY,cAAc,IAAI,IAAI,CAAC,EAAE,UAAU,OAClD,QAAQ,MAAM,oBAAoB,SAAS;IAE/C;IACA,UAAgB;KACd,IAAI,UAAU;KACd,WAAW;KACX,IAAI,cAAc,IAAI,IAAI,CAAC,EAAE,UAAU,OAAO;KAC9C,cAAc,OAAO,IAAI;KACzB,QAAQ,MAAM,oBAAoB,cAAc;IAClD;GACF,CAAC;EACH;EACA,SAAS,WAAgD;GACvD,MAAM,QAAuD,CAAC;GAC9D,MAAM,SAAyD,CAAC;GAChE,KAAK,MAAM,CAAC,UAAU,iBAAiB,eACrC,IAAI;IACF,MAAM,UAAU,aAAa,SAAS,eAAe;IACrD,IAAI,CAAC,MAAM,QAAQ,OAAO,GAAG,MAAM,IAAI,UAAU,wCAAwC;IACzF,KAAK,MAAM,QAAQ,SAAS;KAC1B,IAAI,EAAA,GAACC,cAAAA,MAAAA,CAAMC,uCAAAA,kCAAkC,IAAI,GAC/C,MAAM,IAAI,UAAU,4CAA4C;KAElE,IAAI,cAAc,KAAA,KAAa,KAAK,cAAc,WAAW,MAAM,KAAK;MAAE;MAAU,GAAG;KAAK,CAAC;IAC/F;GACF,SAAS,OAAO;IACd,OAAO,KAAK;KAAE;KAAU,SAAS,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;IAAE,CAAC;GAC3F;GAEF,OAAO,OAAO,OAAO;IAAE,OAAO,OAAO,OAAO,KAAK;IAAG,QAAQ,OAAO,OAAO,MAAM;GAAE,CAAC;EACrF;CAEyB,CAAC;AAC9B;;AAGA,SAAgB,6BAA6B,SAAwB;CACnE,QAAQ,QAAQC,uCAAAA,8BAA8B,4BAA4B,OAAO,CAAC;AACpF"}

package/dist/src/services/backgroundWorkService/index.d.cts

@@ -0,0 +1,9 @@
+import { DoomBackgroundWorkService } from "@agimon-ai/doompi-core/background-work";
+import { Context } from "@deepseek-ai/cordis";
+//#region src/services/backgroundWorkService/index.d.ts
+/** Creates the generation-bound, pull-based coordinator shared by session extensions. */
+export declare function createBackgroundWorkService(ctx: Context): DoomBackgroundWorkService;
+/** Installs one coordinator in the current session service context. */
+export declare function provideBackgroundWorkService(context: Context): void;
+//#endregion
+//# sourceMappingURL=index.d.cts.map

package/dist/src/services/backgroundWorkService/index.d.cts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.cts","names":[],"sources":["../../../../src/services/backgroundWorkService/index.ts"],"mappings":";;;;wBAmBgB,4BAA4B,KAAK,UAAU;;wBAoE3C,6BAA6B,SAAS"}

package/dist/src/services/backgroundWorkService/index.d.mts

@@ -0,0 +1,9 @@
+import { DoomBackgroundWorkService } from "@agimon-ai/doompi-core/background-work";
+import { Context } from "@deepseek-ai/cordis";
+//#region src/services/backgroundWorkService/index.d.ts
+/** Creates the generation-bound, pull-based coordinator shared by session extensions. */
+export declare function createBackgroundWorkService(ctx: Context): DoomBackgroundWorkService;
+/** Installs one coordinator in the current session service context. */
+export declare function provideBackgroundWorkService(context: Context): void;
+//#endregion
+//# sourceMappingURL=index.d.mts.map

package/dist/src/services/backgroundWorkService/index.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.mts","names":[],"sources":["../../../../src/services/backgroundWorkService/index.ts"],"mappings":";;;;wBAmBgB,4BAA4B,KAAK,UAAU;;wBAoE3C,6BAA6B,SAAS"}

package/dist/src/services/backgroundWorkService/index.mjs

@@ -0,0 +1,78 @@
+import { BackgroundProviderWorkItemSchema, DOOM_BACKGROUND_WORK_CHANGED_EVENT, DOOM_BACKGROUND_WORK_SERVICE } from "@agimon-ai/doompi-core/background-work";
+import { Check } from "typebox/value";
+//#region src/services/backgroundWorkService/index.ts
+/** Creates the generation-bound, pull-based coordinator shared by session extensions. */
+function createBackgroundWorkService(ctx) {
+	const registrations = /* @__PURE__ */ new Map();
+	const generation = `doom-background-work:${crypto.randomUUID()}`;
+	const changed = (provider, providerGeneration, kind) => {
+		ctx.emit(DOOM_BACKGROUND_WORK_CHANGED_EVENT, {
+			provider,
+			generation: providerGeneration,
+			kind
+		});
+	};
+	return Object.freeze({
+		generation,
+		register(provider) {
+			if (!provider || typeof provider !== "object" || typeof provider.listActiveWork !== "function") throw new TypeError("A background-work provider must expose listActiveWork().");
+			const name = provider.provider.trim();
+			if (!name || name !== provider.provider) throw new TypeError("A background-work provider requires a trimmed, non-empty name.");
+			const token = Symbol(name);
+			const providerGeneration = `${name}:${crypto.randomUUID()}`;
+			registrations.set(name, {
+				token,
+				generation: providerGeneration,
+				provider
+			});
+			changed(name, providerGeneration, "registered");
+			let disposed = false;
+			return Object.freeze({
+				provider: name,
+				generation: providerGeneration,
+				update() {
+					if (!disposed && registrations.get(name)?.token === token) changed(name, providerGeneration, "updated");
+				},
+				dispose() {
+					if (disposed) return;
+					disposed = true;
+					if (registrations.get(name)?.token !== token) return;
+					registrations.delete(name);
+					changed(name, providerGeneration, "unregistered");
+				}
+			});
+		},
+		snapshot(sessionId) {
+			const items = [];
+			const errors = [];
+			for (const [provider, registration] of registrations) try {
+				const current = registration.provider.listActiveWork();
+				if (!Array.isArray(current)) throw new TypeError("listActiveWork() must return an array.");
+				for (const item of current) {
+					if (!Check(BackgroundProviderWorkItemSchema, item)) throw new TypeError("listActiveWork() returned an invalid item.");
+					if (sessionId === void 0 || item.sessionId === sessionId) items.push({
+						provider,
+						...item
+					});
+				}
+			} catch (error) {
+				errors.push({
+					provider,
+					message: error instanceof Error ? error.message : String(error)
+				});
+			}
+			return Object.freeze({
+				items: Object.freeze(items),
+				errors: Object.freeze(errors)
+			});
+		}
+	});
+}
+/** Installs one coordinator in the current session service context. */
+function provideBackgroundWorkService(context) {
+	context.provide(DOOM_BACKGROUND_WORK_SERVICE, createBackgroundWorkService(context));
+}
+//#endregion
+export { createBackgroundWorkService, provideBackgroundWorkService };
+
+//# sourceMappingURL=index.mjs.map

package/dist/src/services/backgroundWorkService/index.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.mjs","names":[],"sources":["../../../../src/services/backgroundWorkService/index.ts"],"sourcesContent":["import {\n  BackgroundProviderWorkItemSchema,\n  DOOM_BACKGROUND_WORK_CHANGED_EVENT,\n  DOOM_BACKGROUND_WORK_SERVICE,\n  type BackgroundWorkProvider,\n  type BackgroundWorkProviderHandle,\n  type DoomBackgroundWorkService,\n  type DoomBackgroundWorkSnapshot,\n} from '@agimon-ai/doompi-core/background-work';\nimport type { Context } from '@deepseek-ai/cordis';\nimport { Check } from 'typebox/value';\n\ninterface ProviderRegistration {\n  readonly token: symbol;\n  readonly generation: string;\n  readonly provider: BackgroundWorkProvider;\n}\n\n/** Creates the generation-bound, pull-based coordinator shared by session extensions. */\nexport function createBackgroundWorkService(ctx: Context): DoomBackgroundWorkService {\n  const registrations = new Map<string, ProviderRegistration>();\n  const generation = `doom-background-work:${crypto.randomUUID()}`;\n\n  const changed = (\n    provider: string,\n    providerGeneration: string,\n    kind: 'registered' | 'updated' | 'unregistered',\n  ): void => {\n    ctx.emit(DOOM_BACKGROUND_WORK_CHANGED_EVENT, { provider, generation: providerGeneration, kind });\n  };\n\n  const service: DoomBackgroundWorkService = {\n    generation,\n    register(provider): BackgroundWorkProviderHandle {\n      if (!provider || typeof provider !== 'object' || typeof provider.listActiveWork !== 'function') {\n        throw new TypeError('A background-work provider must expose listActiveWork().');\n      }\n      const name = provider.provider.trim();\n      if (!name || name !== provider.provider) {\n        throw new TypeError('A background-work provider requires a trimmed, non-empty name.');\n      }\n      const token = Symbol(name);\n      const providerGeneration = `${name}:${crypto.randomUUID()}`;\n      registrations.set(name, { token, generation: providerGeneration, provider });\n      changed(name, providerGeneration, 'registered');\n      let disposed = false;\n      return Object.freeze({\n        provider: name,\n        generation: providerGeneration,\n        update(): void {\n          if (!disposed && registrations.get(name)?.token === token) {\n            changed(name, providerGeneration, 'updated');\n          }\n        },\n        dispose(): void {\n          if (disposed) return;\n          disposed = true;\n          if (registrations.get(name)?.token !== token) return;\n          registrations.delete(name);\n          changed(name, providerGeneration, 'unregistered');\n        },\n      });\n    },\n    snapshot(sessionId?: string): DoomBackgroundWorkSnapshot {\n      const items: DoomBackgroundWorkSnapshot['items'][number][] = [];\n      const errors: DoomBackgroundWorkSnapshot['errors'][number][] = [];\n      for (const [provider, registration] of registrations) {\n        try {\n          const current = registration.provider.listActiveWork();\n          if (!Array.isArray(current)) throw new TypeError('listActiveWork() must return an array.');\n          for (const item of current) {\n            if (!Check(BackgroundProviderWorkItemSchema, item)) {\n              throw new TypeError('listActiveWork() returned an invalid item.');\n            }\n            if (sessionId === undefined || item.sessionId === sessionId) items.push({ provider, ...item });\n          }\n        } catch (error) {\n          errors.push({ provider, message: error instanceof Error ? error.message : String(error) });\n        }\n      }\n      return Object.freeze({ items: Object.freeze(items), errors: Object.freeze(errors) });\n    },\n  };\n  return Object.freeze(service);\n}\n\n/** Installs one coordinator in the current session service context. */\nexport function provideBackgroundWorkService(context: Context): void {\n  context.provide(DOOM_BACKGROUND_WORK_SERVICE, createBackgroundWorkService(context));\n}\n"],"mappings":";;;;AAmBA,SAAgB,4BAA4B,KAAyC;CACnF,MAAM,gCAAgB,IAAI,IAAkC;CAC5D,MAAM,aAAa,wBAAwB,OAAO,WAAW;CAE7D,MAAM,WACJ,UACA,oBACA,SACS;EACT,IAAI,KAAK,oCAAoC;GAAE;GAAU,YAAY;GAAoB;EAAK,CAAC;CACjG;CAsDA,OAAO,OAAO,OAAO;EAnDnB;EACA,SAAS,UAAwC;GAC/C,IAAI,CAAC,YAAY,OAAO,aAAa,YAAY,OAAO,SAAS,mBAAmB,YAClF,MAAM,IAAI,UAAU,0DAA0D;GAEhF,MAAM,OAAO,SAAS,SAAS,KAAK;GACpC,IAAI,CAAC,QAAQ,SAAS,SAAS,UAC7B,MAAM,IAAI,UAAU,gEAAgE;GAEtF,MAAM,QAAQ,OAAO,IAAI;GACzB,MAAM,qBAAqB,GAAG,KAAK,GAAG,OAAO,WAAW;GACxD,cAAc,IAAI,MAAM;IAAE;IAAO,YAAY;IAAoB;GAAS,CAAC;GAC3E,QAAQ,MAAM,oBAAoB,YAAY;GAC9C,IAAI,WAAW;GACf,OAAO,OAAO,OAAO;IACnB,UAAU;IACV,YAAY;IACZ,SAAe;KACb,IAAI,CAAC,YAAY,cAAc,IAAI,IAAI,CAAC,EAAE,UAAU,OAClD,QAAQ,MAAM,oBAAoB,SAAS;IAE/C;IACA,UAAgB;KACd,IAAI,UAAU;KACd,WAAW;KACX,IAAI,cAAc,IAAI,IAAI,CAAC,EAAE,UAAU,OAAO;KAC9C,cAAc,OAAO,IAAI;KACzB,QAAQ,MAAM,oBAAoB,cAAc;IAClD;GACF,CAAC;EACH;EACA,SAAS,WAAgD;GACvD,MAAM,QAAuD,CAAC;GAC9D,MAAM,SAAyD,CAAC;GAChE,KAAK,MAAM,CAAC,UAAU,iBAAiB,eACrC,IAAI;IACF,MAAM,UAAU,aAAa,SAAS,eAAe;IACrD,IAAI,CAAC,MAAM,QAAQ,OAAO,GAAG,MAAM,IAAI,UAAU,wCAAwC;IACzF,KAAK,MAAM,QAAQ,SAAS;KAC1B,IAAI,CAAC,MAAM,kCAAkC,IAAI,GAC/C,MAAM,IAAI,UAAU,4CAA4C;KAElE,IAAI,cAAc,KAAA,KAAa,KAAK,cAAc,WAAW,MAAM,KAAK;MAAE;MAAU,GAAG;KAAK,CAAC;IAC/F;GACF,SAAS,OAAO;IACd,OAAO,KAAK;KAAE;KAAU,SAAS,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;IAAE,CAAC;GAC3F;GAEF,OAAO,OAAO,OAAO;IAAE,OAAO,OAAO,OAAO,KAAK;IAAG,QAAQ,OAAO,OAAO,MAAM;GAAE,CAAC;EACrF;CAEyB,CAAC;AAC9B;;AAGA,SAAgB,6BAA6B,SAAwB;CACnE,QAAQ,QAAQ,8BAA8B,4BAA4B,OAAO,CAAC;AACpF"}

package/dist/src/services/peerInbox/index.cjs

@@ -0,0 +1,18 @@
+//#region src/services/peerInbox/index.ts
+const inboxes = /* @__PURE__ */ new Map();
+/** Registers one live session-owned peer inbox. This registry is reachable only by the Session route. */
+function registerSessionPeerInbox(sessionId, inbox) {
+	if (inboxes.has(sessionId)) throw new Error(`Session peer inbox '${sessionId}' is already registered.`);
+	inboxes.set(sessionId, inbox);
+	return () => {
+		if (inboxes.get(sessionId) === inbox) inboxes.delete(sessionId);
+	};
+}
+function deliverSessionPeerEnvelope(targetSessionId, sourceKey, type, payload) {
+	return inboxes.get(targetSessionId)?.(sourceKey, type, payload);
+}
+//#endregion
+exports.deliverSessionPeerEnvelope = deliverSessionPeerEnvelope;
+exports.registerSessionPeerInbox = registerSessionPeerInbox;
+
+//# sourceMappingURL=index.cjs.map

package/dist/src/services/peerInbox/index.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.cjs","names":[],"sources":["../../../../src/services/peerInbox/index.ts"],"sourcesContent":["import type { DoomSessionDeliveryInboxState } from '../sessionDelivery';\n\nexport type SessionPeerInbox = (\n  sourceKey: string,\n  type: string,\n  payload: unknown,\n) => DoomSessionDeliveryInboxState | undefined;\n\nconst inboxes = new Map<string, SessionPeerInbox>();\n\n/** Registers one live session-owned peer inbox. This registry is reachable only by the Session route. */\nexport function registerSessionPeerInbox(sessionId: string, inbox: SessionPeerInbox): () => void {\n  if (inboxes.has(sessionId)) throw new Error(`Session peer inbox '${sessionId}' is already registered.`);\n  inboxes.set(sessionId, inbox);\n  return () => {\n    if (inboxes.get(sessionId) === inbox) inboxes.delete(sessionId);\n  };\n}\n\nexport function deliverSessionPeerEnvelope(\n  targetSessionId: string,\n  sourceKey: string,\n  type: string,\n  payload: unknown,\n): DoomSessionDeliveryInboxState | undefined {\n  return inboxes.get(targetSessionId)?.(sourceKey, type, payload);\n}\n"],"mappings":";AAQA,MAAM,0BAAU,IAAI,IAA8B;;AAGlD,SAAgB,yBAAyB,WAAmB,OAAqC;CAC/F,IAAI,QAAQ,IAAI,SAAS,GAAG,MAAM,IAAI,MAAM,uBAAuB,UAAU,yBAAyB;CACtG,QAAQ,IAAI,WAAW,KAAK;CAC5B,aAAa;EACX,IAAI,QAAQ,IAAI,SAAS,MAAM,OAAO,QAAQ,OAAO,SAAS;CAChE;AACF;AAEA,SAAgB,2BACd,iBACA,WACA,MACA,SAC2C;CAC3C,OAAO,QAAQ,IAAI,eAAe,CAAC,GAAG,WAAW,MAAM,OAAO;AAChE"}

package/dist/src/services/peerInbox/index.mjs

@@ -0,0 +1,17 @@
+//#region src/services/peerInbox/index.ts
+const inboxes = /* @__PURE__ */ new Map();
+/** Registers one live session-owned peer inbox. This registry is reachable only by the Session route. */
+function registerSessionPeerInbox(sessionId, inbox) {
+	if (inboxes.has(sessionId)) throw new Error(`Session peer inbox '${sessionId}' is already registered.`);
+	inboxes.set(sessionId, inbox);
+	return () => {
+		if (inboxes.get(sessionId) === inbox) inboxes.delete(sessionId);
+	};
+}
+function deliverSessionPeerEnvelope(targetSessionId, sourceKey, type, payload) {
+	return inboxes.get(targetSessionId)?.(sourceKey, type, payload);
+}
+//#endregion
+export { deliverSessionPeerEnvelope, registerSessionPeerInbox };
+
+//# sourceMappingURL=index.mjs.map

package/dist/src/services/peerInbox/index.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.mjs","names":[],"sources":["../../../../src/services/peerInbox/index.ts"],"sourcesContent":["import type { DoomSessionDeliveryInboxState } from '../sessionDelivery';\n\nexport type SessionPeerInbox = (\n  sourceKey: string,\n  type: string,\n  payload: unknown,\n) => DoomSessionDeliveryInboxState | undefined;\n\nconst inboxes = new Map<string, SessionPeerInbox>();\n\n/** Registers one live session-owned peer inbox. This registry is reachable only by the Session route. */\nexport function registerSessionPeerInbox(sessionId: string, inbox: SessionPeerInbox): () => void {\n  if (inboxes.has(sessionId)) throw new Error(`Session peer inbox '${sessionId}' is already registered.`);\n  inboxes.set(sessionId, inbox);\n  return () => {\n    if (inboxes.get(sessionId) === inbox) inboxes.delete(sessionId);\n  };\n}\n\nexport function deliverSessionPeerEnvelope(\n  targetSessionId: string,\n  sourceKey: string,\n  type: string,\n  payload: unknown,\n): DoomSessionDeliveryInboxState | undefined {\n  return inboxes.get(targetSessionId)?.(sourceKey, type, payload);\n}\n"],"mappings":";AAQA,MAAM,0BAAU,IAAI,IAA8B;;AAGlD,SAAgB,yBAAyB,WAAmB,OAAqC;CAC/F,IAAI,QAAQ,IAAI,SAAS,GAAG,MAAM,IAAI,MAAM,uBAAuB,UAAU,yBAAyB;CACtG,QAAQ,IAAI,WAAW,KAAK;CAC5B,aAAa;EACX,IAAI,QAAQ,IAAI,SAAS,MAAM,OAAO,QAAQ,OAAO,SAAS;CAChE;AACF;AAEA,SAAgB,2BACd,iBACA,WACA,MACA,SAC2C;CAC3C,OAAO,QAAQ,IAAI,eAAe,CAAC,GAAG,WAAW,MAAM,OAAO;AAChE"}

package/dist/src/services/peerInboxApi/index.cjs

@@ -0,0 +1,48 @@
+const require_index = require("../peerTransport/index.cjs");
+const require_index$1 = require("../peerInbox/index.cjs");
+//#region src/services/peerInboxApi/index.ts
+const MAX_BODY_BYTES = 65536;
+const DELIVERY_TYPES = /* @__PURE__ */ new Set(["doom/session-delivery/envelope", "doom/session-delivery/ack"]);
+function response(status, error) {
+	return Response.json({ error }, { status });
+}
+/** Narrow HMAC-authenticated endpoint that a trusted tunnel may forward without device authentication. */
+const peerInboxApi = {
+	basePath: "session-peer",
+	start(context) {
+		const config = context.homeDirectory === void 0 ? void 0 : require_index.readSessionPeerConfig(context.homeDirectory);
+		const replay = context.homeDirectory === void 0 ? void 0 : require_index.createPeerReplayGuard(context.homeDirectory);
+		return {
+			async fetch(request) {
+				if (request.method !== "POST" || new URL(request.url).pathname !== "/inbox") return response(404, "Not found.");
+				if (!config) return response(503, "Paired Session delivery is not configured.");
+				const length = request.headers.get("content-length");
+				if (length !== null && (!/^\d+$/u.test(length) || Number(length) > MAX_BODY_BYTES)) return response(413, "Request body is too large.");
+				const body = await request.text();
+				if (Buffer.byteLength(body) > MAX_BODY_BYTES) return response(413, "Request body is too large.");
+				const peer = require_index.verifyPeerRequest(config, request, body);
+				if (!peer) return response(401, "Paired Session request is unauthorized.");
+				if (!replay?.admit(request)) return response(409, "Paired Session request was already received.");
+				let parsed;
+				try {
+					parsed = JSON.parse(body);
+				} catch {
+					return response(400, "Paired Session request is malformed.");
+				}
+				const envelope = require_index.parseSessionPeerEnvelope(parsed);
+				if (!envelope || !DELIVERY_TYPES.has(envelope.type)) return response(400, "Paired Session envelope is invalid.");
+				if (!peer.allowedSessionIds.includes(envelope.targetSessionId)) return response(403, "Peer is not granted this session.");
+				const state = require_index$1.deliverSessionPeerEnvelope(envelope.targetSessionId, require_index.peerSessionReference(peer.hostId, envelope.sourceSessionId), envelope.type, envelope.payload);
+				return state === void 0 ? response(404, "Target Session is unavailable.") : Response.json({
+					accepted: true,
+					state
+				}, { status: 202 });
+			},
+			close: () => replay?.close()
+		};
+	}
+};
+//#endregion
+exports.peerInboxApi = peerInboxApi;
+
+//# sourceMappingURL=index.cjs.map

package/dist/src/services/peerInboxApi/index.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.cjs","names":["readSessionPeerConfig","createPeerReplayGuard","verifyPeerRequest","parseSessionPeerEnvelope","deliverSessionPeerEnvelope","peerSessionReference"],"sources":["../../../../src/services/peerInboxApi/index.ts"],"sourcesContent":["import type { DoomApi, DoomApiHandler } from '@agimon-ai/doompi-core/package-api';\n\nimport { deliverSessionPeerEnvelope } from '../peerInbox';\nimport {\n  createPeerReplayGuard,\n  parseSessionPeerEnvelope,\n  peerSessionReference,\n  readSessionPeerConfig,\n  verifyPeerRequest,\n} from '../peerTransport';\n\nconst MAX_BODY_BYTES = 64 * 1024;\nconst DELIVERY_TYPES = new Set(['doom/session-delivery/envelope', 'doom/session-delivery/ack']);\n\nfunction response(status: number, error: string): Response {\n  return Response.json({ error }, { status });\n}\n\n/** Narrow HMAC-authenticated endpoint that a trusted tunnel may forward without device authentication. */\nexport const peerInboxApi: DoomApi = {\n  basePath: 'session-peer',\n  start(context): DoomApiHandler {\n    const config = context.homeDirectory === undefined ? undefined : readSessionPeerConfig(context.homeDirectory);\n    const replay = context.homeDirectory === undefined ? undefined : createPeerReplayGuard(context.homeDirectory);\n    return {\n      async fetch(request) {\n        if (request.method !== 'POST' || new URL(request.url).pathname !== '/inbox') return response(404, 'Not found.');\n        if (!config) return response(503, 'Paired Session delivery is not configured.');\n        const length = request.headers.get('content-length');\n        if (length !== null && (!/^\\d+$/u.test(length) || Number(length) > MAX_BODY_BYTES))\n          return response(413, 'Request body is too large.');\n        const body = await request.text();\n        if (Buffer.byteLength(body) > MAX_BODY_BYTES) return response(413, 'Request body is too large.');\n        const peer = verifyPeerRequest(config, request, body);\n        if (!peer) return response(401, 'Paired Session request is unauthorized.');\n        if (!replay?.admit(request)) return response(409, 'Paired Session request was already received.');\n        let parsed: unknown;\n        try {\n          parsed = JSON.parse(body) as unknown;\n        } catch {\n          return response(400, 'Paired Session request is malformed.');\n        }\n        const envelope = parseSessionPeerEnvelope(parsed);\n        if (!envelope || !DELIVERY_TYPES.has(envelope.type))\n          return response(400, 'Paired Session envelope is invalid.');\n        if (!peer.allowedSessionIds.includes(envelope.targetSessionId))\n          return response(403, 'Peer is not granted this session.');\n        const state = deliverSessionPeerEnvelope(\n          envelope.targetSessionId,\n          peerSessionReference(peer.hostId, envelope.sourceSessionId),\n          envelope.type,\n          envelope.payload,\n        );\n        return state === undefined\n          ? response(404, 'Target Session is unavailable.')\n          : Response.json({ accepted: true, state }, { status: 202 });\n      },\n      close: () => replay?.close(),\n    };\n  },\n};\n"],"mappings":";;;AAWA,MAAM,iBAAiB;AACvB,MAAM,iCAAiB,IAAI,IAAI,CAAC,kCAAkC,2BAA2B,CAAC;AAE9F,SAAS,SAAS,QAAgB,OAAyB;CACzD,OAAO,SAAS,KAAK,EAAE,MAAM,GAAG,EAAE,OAAO,CAAC;AAC5C;;AAGA,MAAa,eAAwB;CACnC,UAAU;CACV,MAAM,SAAyB;EAC7B,MAAM,SAAS,QAAQ,kBAAkB,KAAA,IAAY,KAAA,IAAYA,cAAAA,sBAAsB,QAAQ,aAAa;EAC5G,MAAM,SAAS,QAAQ,kBAAkB,KAAA,IAAY,KAAA,IAAYC,cAAAA,sBAAsB,QAAQ,aAAa;EAC5G,OAAO;GACL,MAAM,MAAM,SAAS;IACnB,IAAI,QAAQ,WAAW,UAAU,IAAI,IAAI,QAAQ,GAAG,CAAC,CAAC,aAAa,UAAU,OAAO,SAAS,KAAK,YAAY;IAC9G,IAAI,CAAC,QAAQ,OAAO,SAAS,KAAK,4CAA4C;IAC9E,MAAM,SAAS,QAAQ,QAAQ,IAAI,gBAAgB;IACnD,IAAI,WAAW,SAAS,CAAC,SAAS,KAAK,MAAM,KAAK,OAAO,MAAM,IAAI,iBACjE,OAAO,SAAS,KAAK,4BAA4B;IACnD,MAAM,OAAO,MAAM,QAAQ,KAAK;IAChC,IAAI,OAAO,WAAW,IAAI,IAAI,gBAAgB,OAAO,SAAS,KAAK,4BAA4B;IAC/F,MAAM,OAAOC,cAAAA,kBAAkB,QAAQ,SAAS,IAAI;IACpD,IAAI,CAAC,MAAM,OAAO,SAAS,KAAK,yCAAyC;IACzE,IAAI,CAAC,QAAQ,MAAM,OAAO,GAAG,OAAO,SAAS,KAAK,8CAA8C;IAChG,IAAI;IACJ,IAAI;KACF,SAAS,KAAK,MAAM,IAAI;IAC1B,QAAQ;KACN,OAAO,SAAS,KAAK,sCAAsC;IAC7D;IACA,MAAM,WAAWC,cAAAA,yBAAyB,MAAM;IAChD,IAAI,CAAC,YAAY,CAAC,eAAe,IAAI,SAAS,IAAI,GAChD,OAAO,SAAS,KAAK,qCAAqC;IAC5D,IAAI,CAAC,KAAK,kBAAkB,SAAS,SAAS,eAAe,GAC3D,OAAO,SAAS,KAAK,mCAAmC;IAC1D,MAAM,QAAQC,gBAAAA,2BACZ,SAAS,iBACTC,cAAAA,qBAAqB,KAAK,QAAQ,SAAS,eAAe,GAC1D,SAAS,MACT,SAAS,OACX;IACA,OAAO,UAAU,KAAA,IACb,SAAS,KAAK,gCAAgC,IAC9C,SAAS,KAAK;KAAE,UAAU;KAAM;IAAM,GAAG,EAAE,QAAQ,IAAI,CAAC;GAC9D;GACA,aAAa,QAAQ,MAAM;EAC7B;CACF;AACF"}