@cydm/happy-elves 0.1.0-beta.69 → 0.1.0-beta.70

package/apps/cli/dist/commands/daemon.js

@@ -1,7 +1,7 @@
 import { createHash, timingSafeEqual } from "node:crypto";
 import os from "node:os";
 import path from "node:path";
-import { assertLocalDaemonVerified, cliErrorFromFetch, CliError, compactText, ControllerClient, configDir, configPath, daemonPidPath, deriveOrchestration, diagnoseInstallation, emitDoctorResult, idleSessionStatuses, localDaemonStatus, normalizeRelayUrl, ok, parsePairingClaimResponse, randomId, readConfig, readDaemonConfig, readLocalAuditLog, readRelayJson, redactedDaemonConfig, requirePositional, requireRelayUrl, requireString, showMachine, spawnDaemonStart, stopLocalDaemon, throwRelayHttpError, wantsJson, withAccountConfigTransaction } from "./lib/index.js";
+import { assertLocalDaemonVerified, canonicalRelayUrl, cliErrorFromFetch, CliError, compactText, ControllerClient, configDir, configPath, daemonPidPath, deriveOrchestration, diagnoseInstallation, emitDoctorResult, idleSessionStatuses, localDaemonStatus, ok, parsePairingClaimResponse, randomId, readConfig, readDaemonConfig, readLocalAuditLog, readRelayJson, redactedDaemonConfig, requirePositional, requireRelayUrl, requireString, showMachine, spawnDaemonStart, stopLocalDaemon, throwRelayHttpError, wantsJson, withAccountConfigTransaction } from "./lib/index.js";
 function positiveLimit(flags, fallback) {
     const value = flags.limit;
     if (value === undefined)
@@ -103,7 +103,7 @@ export async function handleDaemon({ domain, action, flags }) {
                 throw new CliError(`Daemon configuration already exists at ${transaction.daemonPath}. Pairing never replaces an existing machine identity; use an explicit account recovery or migration flow.`, "CONFIG_EXISTS");
             }
             const existingController = await transaction.readController();
-            if (existingController && (canonicalPairRelay(existingController.relayUrl) !== canonicalPairRelay(relayUrl) ||
+            if (existingController && (canonicalRelayUrl(existingController.relayUrl, "Controller config") !== canonicalRelayUrl(relayUrl) ||
                 !pairSecretsEqual(existingController.accountSecret, accountSecret))) {
                 throw new CliError("Daemon pairing does not match the existing controller relay/account. No relay request was sent and no configuration was changed.", "CONFIG_SPLIT_BRAIN");
             }
@@ -145,7 +145,7 @@ export async function handleDaemon({ domain, action, flags }) {
         return true;
     }
     if (domain === "daemon" && action === "doctor") {
-        const requestedRelay = typeof flags.relay === "string" ? flags.relay : undefined;
+        const requestedRelay = typeof flags.relay === "string" ? requireRelayUrl(flags) : undefined;
         const data = await diagnoseInstallation("daemon", requestedRelay);
         emitDoctorResult("daemon.doctor", "Daemon doctor", data, flags);
         return true;
@@ -346,11 +346,6 @@ export async function handleDaemon({ domain, action, flags }) {
     }
     return false;
 }
-function canonicalPairRelay(value) {
-    const url = new URL(value);
-    url.hash = "";
-    return normalizeRelayUrl(url.toString());
-}
 function pairSecretsEqual(left, right) {
     const leftDigest = createHash("sha256").update(left).digest();
     const rightDigest = createHash("sha256").update(right).digest();

package/apps/cli/dist/commands/lib/bootstrap-config.js

@@ -2,7 +2,7 @@ import { ControllerClient } from "../../../../../packages/client/dist/index.js";
 import { generateAccountSecret, randomId } from "../../../../../packages/shared/dist/index.js";
 import { CliError } from "../../errors.js";
 import { defaultHostedControllerUrl, defaultHostedRelayUrl } from "./paths.js";
-import { normalizeRelayUrl, redactedRelayUrl, requireRelayUrl, withAccountConfigTransaction, } from "./config.js";
+import { canonicalRelayUrl, redactedRelayUrl, requireRelayUrl, withAccountConfigTransaction, } from "./config.js";
 import { cliErrorFromFetch, parsePairingClaimResponse, parsePairingStartResponse, readRelayJson, throwRelayHttpError } from "./relay-http.js";
 function settledConfigValue(result) {
     if (result.status === "rejected")
@@ -31,9 +31,9 @@ export async function readStartConfigPreflight(flags, transaction) {
 }
 export function classifyStartConfig(params) {
     const { controller, daemon } = params;
-    const explicitRelayUrl = params.explicitRelayUrl ? canonicalBootstrapRelayUrl(params.explicitRelayUrl) : undefined;
-    const controllerRelayUrl = controller ? canonicalBootstrapRelayUrl(controller.relayUrl) : undefined;
-    const daemonRelayUrl = daemon ? canonicalBootstrapRelayUrl(daemon.relayUrl) : undefined;
+    const explicitRelayUrl = params.explicitRelayUrl ? canonicalRelayUrl(params.explicitRelayUrl) : undefined;
+    const controllerRelayUrl = controller ? canonicalRelayUrl(controller.relayUrl, "Controller config") : undefined;
+    const daemonRelayUrl = daemon ? canonicalRelayUrl(daemon.relayUrl, "Daemon config") : undefined;
     if (controller && daemon) {
         if (controllerRelayUrl !== daemonRelayUrl || controller.accountSecret !== daemon.accountSecret) {
             throw splitBrainError(controller, daemon);
@@ -50,33 +50,19 @@ export function classifyStartConfig(params) {
     }
     return {
         kind: controller && daemon ? "ready" : controller ? "controller-only" : "fresh",
-        relayUrl: explicitRelayUrl ?? configuredRelay ?? canonicalBootstrapRelayUrl(defaultHostedRelayUrl),
+        relayUrl: explicitRelayUrl ?? configuredRelay ?? canonicalRelayUrl(defaultHostedRelayUrl),
         explicitRelay: Boolean(explicitRelayUrl),
         ...(controller ? { controller } : {}),
         ...(daemon ? { daemon } : {}),
     };
 }
 function splitBrainError(controller, daemon) {
-    const relayDetail = canonicalBootstrapRelayUrl(controller.relayUrl) === canonicalBootstrapRelayUrl(daemon.relayUrl)
+    const relayDetail = canonicalRelayUrl(controller.relayUrl, "Controller config") === canonicalRelayUrl(daemon.relayUrl, "Daemon config")
         ? `Both files name ${redactedRelayUrl(controller.relayUrl)}, but their account identities differ.`
         : `Controller relay: ${redactedRelayUrl(controller.relayUrl)}. Daemon relay: ${redactedRelayUrl(daemon.relayUrl)}.`;
     return new CliError(`Controller and daemon configurations belong to different workspaces. ${relayDetail} ` +
         "No configuration or daemon process was changed. Recover the controller identity from an already signed-in Web Controller via Settings > Browsers > Add and a one-time invite.", "CONFIG_SPLIT_BRAIN");
 }
-function canonicalBootstrapRelayUrl(value) {
-    let url;
-    try {
-        url = new URL(value);
-    }
-    catch {
-        throw new CliError("Relay URL is invalid.", "CONFIG_INVALID");
-    }
-    if (url.protocol !== "http:" && url.protocol !== "https:") {
-        throw new CliError("Relay URL must use http or https.", "CONFIG_INVALID");
-    }
-    url.pathname = url.pathname.replace(/\/+$/, "");
-    return normalizeRelayUrl(url.toString());
-}
 async function createControllerConfig(params, transaction, deferWrite = false) {
     const accountSecret = generateAccountSecret();
     let response;
@@ -107,7 +93,7 @@ async function createControllerConfig(params, transaction, deferWrite = false) {
 }
 export async function ensureControllerConfig(params) {
     if (params.existing) {
-        if (canonicalBootstrapRelayUrl(params.existing.relayUrl) !== canonicalBootstrapRelayUrl(params.relayUrl)) {
+        if (canonicalRelayUrl(params.existing.relayUrl, "Controller config") !== canonicalRelayUrl(params.relayUrl)) {
             throw new CliError("Existing controller credentials do not match the requested relay. happy-elves start does not migrate accounts.", "CONFIG_RELAY_MISMATCH");
         }
         return { config: params.existing, created: false, reconfigured: false };
@@ -160,7 +146,7 @@ async function createDaemonConfig(config, machineName, transaction, deferWrite =
 }
 export async function ensureDaemonPaired(config, machineName, existing, transaction, deferWrite = false, signal, expectedAccountId) {
     if (existing) {
-        if (canonicalBootstrapRelayUrl(existing.relayUrl) !== canonicalBootstrapRelayUrl(config.relayUrl) ||
+        if (canonicalRelayUrl(existing.relayUrl, "Daemon config") !== canonicalRelayUrl(config.relayUrl, "Controller config") ||
             existing.accountSecret !== config.accountSecret) {
             throw splitBrainError(config, existing);
         }

package/apps/cli/dist/commands/lib/config.d.ts

@@ -27,6 +27,7 @@ export type AccountConfigTransaction = {
 export declare function requireString(flags: Record<string, string | boolean>, key: string): string;
 export declare function requirePositional(value: string | undefined, name: string): string;
 export declare function normalizeRelayUrl(value: string): string;
+export declare function canonicalRelayUrl(value: string, label?: string): string;
 export declare function redactedRelayUrl(value: string): string;
 export declare function requireRelayUrl(flags: Record<string, string | boolean>, key?: string): string;
 export declare function readConfig(flags: Record<string, string | boolean>): Promise<CliConfig>;

package/apps/cli/dist/commands/lib/config.js

@@ -1,6 +1,7 @@
 import { createHash, randomBytes } from "node:crypto";
 import fs from "node:fs/promises";
 import path from "node:path";
+import { canonicalRelayIdentity } from "../../../../../packages/shared/dist/index.js";
 import { isDaemonProcessAlive, readDaemonProcessStartedAtMs } from "../../../../../packages/shared/dist/node/daemon-process.js";
 import { CliError } from "../../errors.js";
 import { configDir, configPath } from "./paths.js";
@@ -24,6 +25,14 @@ export function requirePositional(value, name) {
 export function normalizeRelayUrl(value) {
     return value.replace(/\/+$/, "");
 }
+export function canonicalRelayUrl(value, label = "Relay") {
+    try {
+        return canonicalRelayIdentity(value);
+    }
+    catch (error) {
+        throw new CliError(`${label} relayUrl is invalid: ${error instanceof Error ? error.message : String(error)}`, "CONFIG_INVALID");
+    }
+}
 export function redactedRelayUrl(value) {
     try {
         const url = new URL(value);
@@ -45,17 +54,7 @@ function assertStringField(candidate, field, label) {
     return value;
 }
 function assertRelayUrl(value, label) {
-    let url;
-    try {
-        url = new URL(value);
-    }
-    catch {
-        throw new CliError(`${label} config relayUrl is invalid.`, "CONFIG_INVALID");
-    }
-    if (url.protocol !== "http:" && url.protocol !== "https:") {
-        throw new CliError(`${label} config relayUrl must use http or https.`, "CONFIG_INVALID");
-    }
-    return normalizeRelayUrl(value);
+    return canonicalRelayUrl(value, `${label} config`);
 }
 export function requireRelayUrl(flags, key = "relay") {
     try {
@@ -145,7 +144,7 @@ async function readOptionalDaemonConfig() {
     return value === undefined ? undefined : assertDaemonConfigShape(value);
 }
 export async function readConfig(flags) {
-    const relayUrl = typeof flags.relay === "string" ? normalizeRelayUrl(flags.relay) : process.env.HAPPY_ELVES_RELAY_URL;
+    const relayUrl = typeof flags.relay === "string" ? flags.relay : process.env.HAPPY_ELVES_RELAY_URL;
     const controllerToken = typeof flags.token === "string" ? flags.token : process.env.HAPPY_ELVES_CONTROLLER_TOKEN;
     const accountSecret = typeof flags.secret === "string" ? flags.secret : process.env.HAPPY_ELVES_ACCOUNT_SECRET;
     if (relayUrl && controllerToken && accountSecret) {

package/apps/cli/dist/commands/lib/doctor.js

@@ -4,7 +4,7 @@ import path from "node:path";
 import { daemonRuntimeConfigFingerprint, parseDaemonRuntimeIdentity, } from "../../../../../packages/shared/dist/node/daemon-process.js";
 import { CliError } from "../../errors.js";
 import { CliExit } from "./cli-exit.js";
-import { normalizeRelayUrl, redactedControllerConfig, redactedDaemonConfig, redactedRelayUrl, withAccountConfigTransaction, } from "./config.js";
+import { canonicalRelayUrl, redactedControllerConfig, redactedDaemonConfig, requireRelayUrl, withAccountConfigTransaction, } from "./config.js";
 import { localDaemonStatus, readLocalDaemonPidIdentity } from "./local-daemon.js";
 import { ok, wantsJson, writeError } from "./json.js";
 import { configDir, configPath, daemonRuntimeIdentityPath } from "./paths.js";
@@ -14,7 +14,8 @@ export async function diagnoseInstallation(mode = "controller", requestedRelay)
     const { controller, daemon, controllerState, daemonState } = await readConfigSnapshot(checks, mode === "controller");
     let splitBrain = false;
     if (controller && daemon) {
-        const relayMatches = canonicalRelayUrl(controller.relayUrl) === canonicalRelayUrl(daemon.relayUrl);
+        const relayMatches = canonicalRelayUrl(controller.relayUrl, "Controller config") ===
+            canonicalRelayUrl(daemon.relayUrl, "Daemon config");
         const accountMatches = secretValuesEqual(controller.accountSecret, daemon.accountSecret);
         splitBrain = !relayMatches || !accountMatches;
         checks.push({
@@ -33,9 +34,9 @@ export async function diagnoseInstallation(mode = "controller", requestedRelay)
     }
     const relayTargets = new Map();
     if (controller)
-        relayTargets.set(`controller:${canonicalRelayUrl(controller.relayUrl)}`, { name: "controller-relay", relayUrl: controller.relayUrl });
+        relayTargets.set(`controller:${canonicalRelayUrl(controller.relayUrl, "Controller config")}`, { name: "controller-relay", relayUrl: controller.relayUrl });
     if (daemon)
-        relayTargets.set(`daemon:${canonicalRelayUrl(daemon.relayUrl)}`, { name: "daemon-relay", relayUrl: daemon.relayUrl });
+        relayTargets.set(`daemon:${canonicalRelayUrl(daemon.relayUrl, "Daemon config")}`, { name: "daemon-relay", relayUrl: daemon.relayUrl });
     if (requestedRelay)
         relayTargets.set(`requested:${canonicalRelayUrl(requestedRelay)}`, { name: "requested-relay", relayUrl: requestedRelay });
     const relayChecks = await Promise.all([...relayTargets.values()].map(probeRelay));
@@ -71,7 +72,7 @@ export async function diagnoseInstallation(mode = "controller", requestedRelay)
     return { ok: checks.every((check) => check.ok), ...(code ? { code } : {}), checks };
 }
 export async function topLevelDoctor(flags) {
-    const requestedRelay = typeof flags.relay === "string" ? flags.relay : undefined;
+    const requestedRelay = typeof flags.relay === "string" ? requireRelayUrl(flags) : undefined;
     const data = await diagnoseInstallation("controller", requestedRelay);
     emitDoctorResult("doctor", "Happy Elves doctor", data, flags);
 }
@@ -216,8 +217,16 @@ async function inspectRuntimeIdentity(daemonRunning, daemonConfig) {
             code: "DAEMON_RUNTIME_CONFIG_MISMATCH",
         };
     }
+    let relayMatches = false;
+    try {
+        relayMatches = canonicalRelayUrl(runtime.relayUrl, "Daemon runtime") ===
+            canonicalRelayUrl(daemonConfig.relayUrl, "Daemon config");
+    }
+    catch {
+        relayMatches = false;
+    }
     const configMatches = runtime.configFingerprint === daemonRuntimeConfigFingerprint(daemonConfig) &&
-        canonicalRelayUrl(runtime.relayUrl) === canonicalRelayUrl(daemonConfig.relayUrl) &&
+        relayMatches &&
         runtime.accountId === daemonConfig.accountId &&
         runtime.machineId === daemonConfig.machineId;
     return {
@@ -240,19 +249,6 @@ function secretValuesEqual(left, right) {
     const rightDigest = createHash("sha256").update(right).digest();
     return timingSafeEqual(leftDigest, rightDigest);
 }
-function canonicalRelayUrl(value) {
-    try {
-        const url = new URL(value);
-        url.username = "";
-        url.password = "";
-        url.search = "";
-        url.hash = "";
-        return normalizeRelayUrl(url.toString());
-    }
-    catch {
-        return normalizeRelayUrl(redactedRelayUrl(value));
-    }
-}
 function displayRelayUrl(value) {
     return canonicalRelayUrl(value);
 }

package/apps/cli/dist/commands/lib/local-daemon.js

@@ -2,6 +2,7 @@ import { spawn } from "node:child_process";
 import { randomBytes } from "node:crypto";
 import fs from "node:fs/promises";
 import path from "node:path";
+import { canonicalRelayIdentity } from "../../../../../packages/shared/dist/index.js";
 import { daemonRuntimeConfigFingerprint, daemonProcessStatusForIdentity, isDaemonProcessAlive, parseDaemonPidIdentity, parseDaemonRuntimeIdentity, stopVerifiedDaemonProcess, } from "../../../../../packages/shared/dist/node/daemon-process.js";
 import { CliError } from "../../errors.js";
 import { configDir, daemonPidPath, daemonRuntimeIdentityPath } from "./paths.js";
@@ -47,8 +48,15 @@ export async function inspectLocalDaemonRuntime(config) {
         pidIdentity.record.startedAt === runtime.startedAt;
     if (!ownerMatches)
         return { state: "owner-mismatch", identity: runtime };
+    let relayMatches = false;
+    try {
+        relayMatches = canonicalRelayIdentity(runtime.relayUrl) === canonicalRelayIdentity(config.relayUrl);
+    }
+    catch {
+        relayMatches = false;
+    }
     const configMatches = runtime.configFingerprint === daemonRuntimeConfigFingerprint(config) &&
-        canonicalRelayUrl(runtime.relayUrl) === canonicalRelayUrl(config.relayUrl) &&
+        relayMatches &&
         runtime.accountId === config.accountId &&
         runtime.machineId === config.machineId;
     return configMatches
@@ -198,16 +206,3 @@ async function settleChildExit(handle, timeoutMs) {
         clearTimeout(timer);
     return settled;
 }
-function canonicalRelayUrl(value) {
-    try {
-        const url = new URL(value);
-        url.username = "";
-        url.password = "";
-        url.search = "";
-        url.hash = "";
-        return url.toString().replace(/\/+$/u, "");
-    }
-    catch {
-        return value.replace(/\/+$/u, "");
-    }
-}

package/apps/cli/dist/commands/lib/scope.js

@@ -1,5 +1,5 @@
 import { CliError } from "../../errors.js";
-import { normalizeRelayUrl } from "./config.js";
+import { canonicalRelayUrl } from "./config.js";
 export const DEFAULT_COMMAND_TIMEOUT_MS = 1000 * 1000;
 export function parseDurationMs(value, fallbackMs) {
     if (typeof value !== "string")
@@ -117,7 +117,7 @@ export function parseControllerJoinUrl(value) {
     const relay = url.searchParams.get("relay");
     url.search = "";
     url.hash = "";
-    return { relayUrl: normalizeRelayUrl(relay ?? url.toString()), code, inviteSecret };
+    return { relayUrl: canonicalRelayUrl(relay ?? url.toString()), code, inviteSecret };
 }
 export function parseStopOn(value) {
     if (typeof value !== "string" || !value.trim())

package/apps/cli/dist/commands/remote.js

@@ -1,6 +1,6 @@
 import { timingSafeEqual } from "node:crypto";
 import os from "node:os";
-import { CliError, ControllerClient, configPath, normalizeRelayUrl, ok, parseControllerJoinUrl, parseDurationMs, randomId, readConfig, redactedRelayUrl, relayHealth, requirePositional, requireRelayUrl, requireString, showMachine, wantsJson, wantsVerbose, withAccountConfigTransaction } from "./lib/index.js";
+import { canonicalRelayUrl, CliError, ControllerClient, configPath, ok, parseControllerJoinUrl, parseDurationMs, randomId, readConfig, redactedRelayUrl, relayHealth, requirePositional, requireRelayUrl, requireString, showMachine, wantsJson, wantsVerbose, withAccountConfigTransaction } from "./lib/index.js";
 function sameSecret(left, right) {
     const leftBytes = Buffer.from(left, "utf8");
     const rightBytes = Buffer.from(right, "utf8");
@@ -150,7 +150,7 @@ export async function handleRemote({ domain, action, positional, flags }) {
                 if (!daemonConfig) {
                     throw new CliError("Controller recovery requires an existing daemon configuration from the account being recovered.", "CONTROLLER_RECOVERY_REQUIRES_DAEMON");
                 }
-                if (normalizeRelayUrl(daemonConfig.relayUrl) !== normalizeRelayUrl(relayUrl)) {
+                if (canonicalRelayUrl(daemonConfig.relayUrl, "Daemon config") !== canonicalRelayUrl(relayUrl)) {
                     throw new CliError(`Controller recovery relay ${redactedRelayUrl(relayUrl)} does not match daemon relay ${redactedRelayUrl(daemonConfig.relayUrl)}. The invite was not consumed.`, "CONFIG_SPLIT_BRAIN");
                 }
                 // Validate an existing controller before consuming the one-time

package/apps/daemon/dist/config.js

@@ -1,6 +1,7 @@
 import { randomBytes } from "node:crypto";
 import fs from "node:fs/promises";
 import path from "node:path";
+import { canonicalRelayIdentity } from "../../../packages/shared/dist/index.js";
 import { configDir, configPath } from "./paths.js";
 import { DaemonCliError } from "./errors.js";
 const runtimeEnvKeys = new Set([
@@ -35,11 +36,9 @@ function assertConfigShape(value) {
     if (typeof relayUrl !== "string") {
         throw new DaemonCliError("Daemon config relayUrl is invalid.", "CONFIG_INVALID");
     }
+    let canonicalRelayUrl;
     try {
-        const parsedRelayUrl = new URL(relayUrl);
-        if (parsedRelayUrl.protocol !== "http:" && parsedRelayUrl.protocol !== "https:") {
-            throw new Error("Unsupported protocol");
-        }
+        canonicalRelayUrl = canonicalRelayIdentity(relayUrl);
     }
     catch {
         throw new DaemonCliError("Daemon config relayUrl is invalid.", "CONFIG_INVALID");
@@ -54,6 +53,7 @@ function assertConfigShape(value) {
     }
     return {
         ...candidate,
+        relayUrl: canonicalRelayUrl,
         ...(Object.keys(runtimeEnv).length > 0 ? { runtimeEnv } : {}),
     };
 }

package/apps/daemon/dist/pair.js

@@ -2,7 +2,7 @@ import { createHash, timingSafeEqual } from "node:crypto";
 import os from "node:os";
 import fs from "node:fs/promises";
 import path from "node:path";
-import { randomId } from "../../../packages/shared/dist/index.js";
+import { canonicalRelayIdentity, randomId } from "../../../packages/shared/dist/index.js";
 import { acquireDaemonAccountConfigLock } from "./account-config-lock.js";
 import { parseDaemonFlags, requireString } from "./args.js";
 import { configDir, configPath } from "./paths.js";
@@ -157,11 +157,7 @@ async function assertControllerCompatible(relayUrl, accountSecret) {
     }
 }
 function canonicalRelay(value) {
-    const url = new URL(value);
-    if (url.protocol !== "http:" && url.protocol !== "https:")
-        throw new Error("unsupported relay protocol");
-    url.hash = "";
-    return url.toString().replace(/\/+$/u, "");
+    return canonicalRelayIdentity(value);
 }
 function displayRelayUrl(value) {
     const url = new URL(value);

package/apps/daemon/dist/relay-http.js

@@ -1,4 +1,4 @@
-import { parseServerMessage } from "../../../packages/shared/dist/index.js";
+import { canonicalRelayIdentity, parseServerMessage } from "../../../packages/shared/dist/index.js";
 import { DaemonCliError } from "./errors.js";
 export async function relayHttpError(response, fallback) {
     const text = await response.text();
@@ -37,26 +37,18 @@ export function parsePairingClaimResponse(value) {
     }
     return { accountId, machineId, machineToken };
 }
-function normalizeRelayUrl(value) {
-    return value.replace(/\/+$/, "");
-}
 export function assertRelayUrl(value) {
-    let url;
     try {
-        url = new URL(value);
+        return canonicalRelayIdentity(value);
     }
     catch {
         throw new DaemonCliError("Daemon relayUrl is invalid.", "INVALID_ARGUMENT");
     }
-    if (url.protocol !== "http:" && url.protocol !== "https:") {
-        throw new DaemonCliError("Daemon relayUrl must use http or https.", "INVALID_ARGUMENT");
-    }
-    return normalizeRelayUrl(value);
 }
 export function relayWsUrl(relayUrl) {
-    const url = new URL(relayUrl);
+    const url = new URL(assertRelayUrl(relayUrl));
     url.protocol = url.protocol === "https:" ? "wss:" : "ws:";
-    url.pathname = "/ws";
+    url.pathname = `${url.pathname.replace(/\/+$/u, "")}/ws`;
     url.search = "";
     return url.toString();
 }

package/apps/daemon/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cydm/happy-elves-daemon",
-  "version": "0.1.0-beta.69",
+  "version": "0.1.0-beta.70",
   "private": true,
   "type": "module"
 }

package/build-identity.json

@@ -1,6 +1,6 @@
 {
-  "cliVersion": "0.1.0-beta.69",
+  "cliVersion": "0.1.0-beta.70",
   "channel": "beta",
-  "commit": "0757ffd251eceab467d3faf4abd69aaea554ce3d",
+  "commit": "bbda639f03e3302c5cfdf4f2cb8417dd0a5ea1f7",
   "orchestratorContractVersion": 4
 }

package/npm-shrinkwrap.json

@@ -1,12 +1,12 @@
 {
   "name": "@cydm/happy-elves",
-  "version": "0.1.0-beta.69",
+  "version": "0.1.0-beta.70",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@cydm/happy-elves",
-      "version": "0.1.0-beta.69",
+      "version": "0.1.0-beta.70",
       "license": "Apache-2.0",
       "dependencies": {
         "@fastify/cors": "11.2.0",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cydm/happy-elves",
-  "version": "0.1.0-beta.69",
+  "version": "0.1.0-beta.70",
   "description": "Remote controller for local coding agents with hosted or self-hosted relay support.",
   "type": "module",
   "bin": {

package/packages/client/dist/http.js

@@ -1,26 +1,19 @@
+import { canonicalRelayIdentity } from "../../shared/dist/index.js";
 import { ControllerClientError } from "./errors.js";
 import { requireNonEmpty } from "./validation.js";
 export function normalizeRelayUrl(value) {
-    const raw = requireNonEmpty(value, "relayUrl").replace(/\/+$/, "");
-    let url;
+    const raw = requireNonEmpty(value, "relayUrl");
     try {
-        url = new URL(raw);
+        return canonicalRelayIdentity(raw);
     }
-    catch {
-        throw new ControllerClientError(`Invalid relayUrl: ${value}`, "INVALID_ARGUMENT");
-    }
-    if (url.protocol !== "http:" && url.protocol !== "https:") {
-        throw new ControllerClientError(`Invalid relayUrl protocol: ${url.protocol}`, "INVALID_ARGUMENT");
+    catch (error) {
+        throw new ControllerClientError(`Invalid relayUrl: ${error instanceof Error ? error.message : String(error)}`, "INVALID_ARGUMENT");
     }
-    url.pathname = url.pathname.replace(/\/+$/, "");
-    url.search = "";
-    url.hash = "";
-    return url.toString().replace(/\/+$/, "");
 }
 export function wsUrl(relayUrl) {
-    const url = new URL(relayUrl);
+    const url = new URL(normalizeRelayUrl(relayUrl));
     url.protocol = url.protocol === "https:" ? "wss:" : "ws:";
-    url.pathname = "/ws";
+    url.pathname = `${url.pathname.replace(/\/+$/u, "")}/ws`;
     url.search = "";
     return url.toString();
 }

package/packages/shared/dist/index.d.ts

@@ -4,5 +4,6 @@ export * from "./diagnostics.js";
 export * from "./ids.js";
 export * from "./protocol.js";
 export * from "./process-command.js";
+export * from "./relay-url.js";
 export * from "./session-name.js";
 export * from "./session-state.js";

package/packages/shared/dist/index.js

@@ -4,5 +4,6 @@ export * from "./diagnostics.js";
 export * from "./ids.js";
 export * from "./protocol.js";
 export * from "./process-command.js";
+export * from "./relay-url.js";
 export * from "./session-name.js";
 export * from "./session-state.js";

package/packages/shared/dist/relay-url.d.ts

@@ -0,0 +1,8 @@
+/**
+ * Return the stable identity of a relay endpoint.
+ *
+ * Relay URLs are origins with an optional base path. Credentials and URL
+ * metadata are never meaningful relay identity, so accepting them would let
+ * different callers compare or contact the same input differently.
+ */
+export declare function canonicalRelayIdentity(value: string): string;

package/packages/shared/dist/relay-url.js

@@ -0,0 +1,37 @@
+/**
+ * Return the stable identity of a relay endpoint.
+ *
+ * Relay URLs are origins with an optional base path. Credentials and URL
+ * metadata are never meaningful relay identity, so accepting them would let
+ * different callers compare or contact the same input differently.
+ */
+export function canonicalRelayIdentity(value) {
+    if (typeof value !== "string" || value.length === 0 || value.trim() !== value) {
+        throw new Error("Relay URL must be a non-empty URL without surrounding whitespace.");
+    }
+    let url;
+    try {
+        url = new URL(value);
+    }
+    catch {
+        throw new Error("Relay URL is invalid.");
+    }
+    if (url.protocol !== "http:" && url.protocol !== "https:") {
+        throw new Error("Relay URL must use http or https.");
+    }
+    const authorityStart = value.indexOf("//");
+    const authority = authorityStart >= 0
+        ? value.slice(authorityStart + 2).split(/[/?#]/u, 1)[0]
+        : "";
+    if (url.username || url.password || authority.includes("@")) {
+        throw new Error("Relay URL must not contain userinfo.");
+    }
+    if (value.includes("?")) {
+        throw new Error("Relay URL must not contain a query.");
+    }
+    if (value.includes("#")) {
+        throw new Error("Relay URL must not contain a fragment.");
+    }
+    url.pathname = url.pathname.replace(/\/+$/u, "");
+    return url.toString().replace(/\/+$/u, "");
+}