@fffattiger/pix-cli 0.1.0

package/dist/commands/host-runner.js

@@ -0,0 +1,302 @@
+import { createHostApp, createNodeServer, exposureModeForBind, consoleLogger, createEnvGateConfigSource, SessiondRuntimeGateway, createRuntimeWorkspaceAuthorizer, createProductionResources, createProductionCatalogs, createSessiondSessionsClient, createSessiondSessionDeleteClient, createSessiondSessionRenameClient, createSessiondSessionSettingsClient, createCapabilityResolver, InvalidAllowedRootsError, InvalidHostDirError, InvalidCatalogAgentDirError, PRODUCTION_MAX_UPLOAD_BYTES, PRODUCTION_FULL_CAPABILITIES, RESOURCE_DEGRADED_CAPABILITIES, } from "@fffattiger/pix-host";
+import { SessiondRpcClient } from "@fffattiger/pix-sessiond/client";
+import { spawn } from "node:child_process";
+import { homedir } from "node:os";
+import { isAbsolute, join } from "node:path";
+import { resolveClientDist } from "../paths.js";
+import { readLocalSecret } from "../secret.js";
+import { pixLog, pixErr } from "../log.js";
+/**
+ * Resolve the agent config directory for production catalogs (D3B-R1B).
+ * Prefer `PI_CODING_AGENT_DIR` when the variable is present (including empty);
+ * otherwise `~/.pi/agent`. Any explicit value must be non-empty absolute with
+ * no NUL — empty/relative/NUL never fall back to home. Never reads the real
+ * configuration contents.
+ */
+export function resolveCatalogAgentDir(env = process.env) {
+    // `!== undefined` means the operator set the variable (even to "").
+    if (env.PI_CODING_AGENT_DIR !== undefined) {
+        const fromEnv = env.PI_CODING_AGENT_DIR;
+        if (typeof fromEnv !== "string" || fromEnv === "" || fromEnv.includes("\0") || !isAbsolute(fromEnv)) {
+            throw new InvalidCatalogAgentDirError("PI_CODING_AGENT_DIR must be a non-empty absolute path");
+        }
+        return fromEnv;
+    }
+    return join(homedir(), ".pi", "agent");
+}
+/**
+ * Honest production capability projection (D3A-1 + D1A-2 phase 2 + D3A Worktrees).
+ *
+ * The resource surface (files/git/watch/upload + read-only worktree list) is
+ * mounted on the Host and stays advertised in BOTH states; `agent` (the
+ * runtime), `sessions` (read-only session history) and `worktree.write` (the
+ * sessiond-guarded worktree create/remove capability) are added only while
+ * sessiond is up, since they depend on the sessiond-backed catalog/runtime and
+ * the managed-worktrees ledger. `worktree` is the read-only list token
+ * (GET /v1/worktrees) and does not depend on sessiond. These two lists are
+ * shared by the HTTP probe and the WS handshake via the single production
+ * resolver, so the four capability surfaces never disagree.
+ */
+/** Best-effort browser launch; never fatal — `--no-open` is the safe default. */
+function openBrowser(url) {
+    try {
+        let child;
+        if (process.platform === "darwin") {
+            child = spawn("open", [url], { detached: true, stdio: "ignore" });
+        }
+        else if (process.platform === "win32") {
+            child = spawn("cmd", ["/c", "start", "", url], { detached: true, stdio: "ignore" });
+        }
+        else {
+            child = spawn("xdg-open", [url], { detached: true, stdio: "ignore" });
+        }
+        child.unref();
+    }
+    catch {
+        pixLog(`could not open browser automatically; visit ${url}`);
+    }
+}
+/**
+ * Gate config for the boot composition. The host gate intentionally fails
+ * closed for non-public APIs when no credential is configured, but a local
+ * single-user boot with no password should expose the full local surface (e.g.
+ * /v1/capabilities) out of the box. So an `unconfigured` local read is mapped to
+ * `disabled`. LAN binds remain fail-closed: decideGateRequest forces
+ * AUTH_REQUIRED_FOR_LAN for non-public paths whenever mode === "lan" and the
+ * credential is not `enabled`, regardless of this mapping. Explicit `enabled`
+ * (password set) and explicit `disabled` are passed through unchanged.
+ */
+export function createBootGateConfigSource() {
+    const env = createEnvGateConfigSource();
+    return {
+        read() {
+            const base = env.read();
+            if (base.status === "unconfigured") {
+                return { status: "disabled", source: base.source };
+            }
+            return base;
+        },
+    };
+}
+/** Format an IPv6 bind address as a valid URL authority. */
+export function formatHostForUrl(hostname) {
+    return hostname.includes(":") && !hostname.startsWith("[") ? `[${hostname}]` : hostname;
+}
+/** Merge the bind address with operator-configured trusted hostnames. */
+export function resolveAllowedHosts(bindHostname, env = process.env) {
+    const candidates = [
+        bindHostname,
+        env.PIX_HOSTNAME,
+        ...(env.PIX_ALLOWED_HOSTS?.split(",") ?? []),
+    ];
+    return [...new Set(candidates.map((value) => value?.trim()).filter((value) => Boolean(value)))];
+}
+/**
+ * Boot the Hono Host bound to `options.hostname:options.port`, serving the
+ * built Vite client, the sessiond-backed runtime WS gateway and the D3A-1
+ * production resource surface (files/git/watch/upload + worktree safety).
+ *
+ * The sessiond secret is read strictly read-only ONCE at startup and bound to
+ * the capability resolver, the runtime WS gateway and the worktree safety
+ * adapter — a secret rotation while the Host keeps running surfaces as an auth
+ * failure (degraded), never a silent re-read. The same resolver drives the HTTP
+ * projection (health/capabilities/bootstrap) and the per-connection WS
+ * handshake, so the four capability surfaces stay consistent.
+ *
+ * `PIX_ALLOWED_ROOTS` is canonicalized before listen: a bad configuration
+ * (empty / non-absolute / missing / not-a-directory) prints ONE safe line and
+ * exits 1 WITHOUT listening or touching the running sessiond.
+ *
+ * Only the Host is torn down on SIGINT/SIGTERM: the sessiond is a separate
+ * (detached or pre-existing) process and must survive a Host restart.
+ */
+export async function runHost(location, options) {
+    const exposureMode = exposureModeForBind(options.hostname);
+    const clientDist = resolveClientDist();
+    // Read the sessiond local secret strictly read-only ONCE and fail closed
+    // when it is missing or unsafe: a Host that cannot authenticate to its own
+    // sessiond must not silently advertise a runtime gateway. The captured secret
+    // is then bound to the resolver, the WS gateway and the worktree adapter.
+    let secret;
+    try {
+        secret = await readLocalSecret(location.paths.secretFile);
+    }
+    catch (error) {
+        pixErr(`sessiond secret unavailable (fail closed): ${error.message}`);
+        return 1;
+    }
+    if (secret === undefined) {
+        pixErr(`sessiond secret not published yet (fail closed): ${location.paths.secretFile}`);
+        return 1;
+    }
+    // Assemble production ResourceDeps from PIX_ALLOWED_ROOTS + the fixed
+    // sessiond endpoint+secret. This canonicalizes/identity-pins roots AND opens
+    // the PIX_HOST_DIR durable trusted-roots ledger (acquiring the exclusive
+    // lifetime Host-dir lock) BEFORE listen: any configuration failure, a held or
+    // stale Host-dir lock, or a corrupt ledger exits 1 with a single safe line,
+    // leaving the running sessiond untouched and binding no socket.
+    let production;
+    try {
+        production = await createProductionResources({
+            allowedRootsEnv: process.env.PIX_ALLOWED_ROOTS,
+            cwd: process.cwd(),
+            endpoint: location.paths.endpoint,
+            secret,
+            hostDirEnv: process.env.PIX_HOST_DIR,
+            logger: consoleLogger,
+        });
+    }
+    catch (error) {
+        // InvalidHostDirError / InvalidAllowedRootsError are already sanitized.
+        // Unknown failures must not echo raw Error.message (may contain paths).
+        pixErr(error instanceof InvalidAllowedRootsError || error instanceof InvalidHostDirError
+            ? error.message
+            : "host resource configuration failed");
+        return 1;
+    }
+    // D3B-R1B: mount production read-only catalogs. agentDir is path-shape only
+    // (never reads config contents). Logs never print agentDir or secrets.
+    let catalogs;
+    try {
+        const agentDir = resolveCatalogAgentDir();
+        catalogs = createProductionCatalogs({
+            agentDir,
+            roots: production.deps.allowedRoots,
+        });
+    }
+    catch (error) {
+        // Release the lifetime Host-dir lock: a failed startup must not leave a
+        // stale lock (the Host runner owns cleanup on startup failure).
+        await production.trustedRootsLedger.close().catch(() => { });
+        pixErr(error instanceof InvalidCatalogAgentDirError
+            ? error.message
+            : `catalog configuration failed: ${error.message}`);
+        return 1;
+    }
+    // Single seam-normalized capability authority: built from the SAME deps that
+    // mount the routes (sessiond probe + raw production lists + mounted catalog
+    // and session-mutation seams). BOTH the HTTP projection (via
+    // `capabilityResolver` below) and the per-connection WS handshake consume
+    // this ONE resolver, so health/capabilities/bootstrap and the runtime
+    // handshake can never disagree and no raw production list bypasses
+    // mounted-seam normalization.
+    const hostDeps = {
+        exposureMode,
+        clientDist,
+        allowedHosts: resolveAllowedHosts(options.hostname),
+        // HTTP/bootstrap projection: full when sessiond is up, degraded (resource
+        // surface only) when down. `agent` + `sessions` + `worktree.write` are added
+        // only while up; `worktree` (read-only list) is advertised in both states.
+        // These raw lists are ONLY consumed through the seam-normalizing resolver.
+        sessiond: production.resolver,
+        capabilities: {
+            full: [...PRODUCTION_FULL_CAPABILITIES],
+            readonly: [...RESOURCE_DEGRADED_CAPABILITIES],
+        },
+        // D3A-1 production resource services: files/git/watch/upload + worktree
+        // safety (busy preflight + mutation guard wired from the shared adapter).
+        resources: production.deps,
+        // D3B-R1B: read-only catalogs (models/auth/skills/plugins/commands/trust).
+        // Catalog capability tokens stay advertised even when sessiond is down.
+        catalogs,
+        // D1A-2 phase 2: read-only session history (/v1/sessions*) backed by the
+        // fixed sessiond catalog. The capability token is driven by the resolver
+        // above (sessions only while up); while down these routes answer 503.
+        // D4: DELETE /v1/sessions/:id is mounted ONLY alongside the production
+        // mutation guard (sessiond system.ping) and the narrow delete RPC client;
+        // `session.delete` is advertised only while sessiond is up (full caps).
+        // D4: PATCH /v1/sessions/:id (rename) is mounted the same way with the
+        // narrow rename RPC client + the shared mutation guard; `session.write` is
+        // advertised only while sessiond is up (full caps). The default full
+        // resource composition exposes the rename seam; null/unavailable seams fail
+        // closed (route not mounted / 503).
+        sessions: {
+            client: createSessiondSessionsClient({ endpoint: location.paths.endpoint, secret }),
+            roots: production.deps.allowedRoots,
+            delete: {
+                client: createSessiondSessionDeleteClient({ endpoint: location.paths.endpoint, secret }),
+                mutationGuard: production.adapter,
+            },
+            rename: {
+                client: createSessiondSessionRenameClient({ endpoint: location.paths.endpoint, secret }),
+                mutationGuard: production.adapter,
+            },
+            settings: {
+                client: createSessiondSessionSettingsClient({ endpoint: location.paths.endpoint, secret }),
+                mutationGuard: production.adapter,
+            },
+        },
+        gate: { config: createBootGateConfigSource() },
+        logger: consoleLogger,
+        // WS transport ceiling matches the advertised maxUpload so a full upload is
+        // actually receivable instead of being rejected at the frame layer.
+        wsMaxPayloadBytes: PRODUCTION_MAX_UPLOAD_BYTES,
+    };
+    const capabilityResolver = createCapabilityResolver(hostDeps);
+    // One trusted sessiond client for the runtime gateway and the Host-owned
+    // exact-session authorizer. AllowedRoots stays the only workspace policy.
+    const sessiondClient = new SessiondRpcClient({ endpoint: location.paths.endpoint, secret });
+    const runtimeWs = new SessiondRuntimeGateway({
+        client: sessiondClient,
+        mode: exposureMode,
+        // The SAME seam-normalized resolver drives the per-WS-handshake capability
+        // projection as the HTTP routes (deps.capabilityResolver): the gateway
+        // advertises only `capabilities` from this shared output, so the WS and
+        // HTTP surfaces can never disagree.
+        resolveCapabilities: () => capabilityResolver.resolve(),
+        runtimeWorkspaceAuthorizer: createRuntimeWorkspaceAuthorizer({
+            client: sessiondClient,
+            roots: production.deps.allowedRoots,
+        }),
+        // WS advertised upload ceiling mirrors the resource upload limit so the two
+        // projections can never drift apart.
+        limits: { maxUpload: PRODUCTION_MAX_UPLOAD_BYTES },
+        logger: consoleLogger,
+    });
+    const host = createHostApp({
+        ...hostDeps,
+        capabilityResolver,
+        runtimeWs,
+    });
+    const handle = await createNodeServer(host, {
+        port: options.port,
+        hostname: options.hostname,
+    }).catch(async (error) => {
+        // Host runner owns cleanup on startup failure: release the lifetime lock.
+        await production.trustedRootsLedger.close().catch(() => { });
+        throw error;
+    });
+    const url = `http://${formatHostForUrl(options.hostname)}:${handle.port}`;
+    pixLog(`host listening on ${url}`);
+    pixLog(`sessiond at ${location.directory} (endpoint ${location.endpoint})`);
+    pixLog(`resource surface mounted (roots: ${production.deps.allowedRoots.roots().length}; capabilities up: ${JSON.stringify(PRODUCTION_FULL_CAPABILITIES)}); sessions history routes mounted (read-only + delete + rename); catalog surface mounted (models/auth/skills/plugins/trust read + trust mutation + read-only themes, sessiond-independent); press Ctrl+C to stop the host`);
+    if (options.open)
+        openBrowser(url);
+    let closing = false;
+    const shutdown = async (signal) => {
+        if (closing)
+            return;
+        closing = true;
+        pixLog(`${signal} received — closing host (sessiond keeps running)`);
+        try {
+            await handle.close();
+        }
+        catch (error) {
+            pixErr(`host close error: ${error.message}`);
+        }
+        // Graceful shutdown releases only our exact Host-dir lock identity.
+        try {
+            await production.trustedRootsLedger.close();
+        }
+        catch (error) {
+            pixErr(`host lock release error: ${error.message}`);
+        }
+        process.exit(0);
+    };
+    process.on("SIGINT", (signal) => void shutdown(signal));
+    process.on("SIGTERM", (signal) => void shutdown(signal));
+    // The listening server keeps the event loop alive; block until a signal.
+    await new Promise(() => { });
+    return 0;
+}
+//# sourceMappingURL=host-runner.js.map

package/dist/commands/host-runner.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"host-runner.js","sourceRoot":"","sources":["../../src/commands/host-runner.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,aAAa,EACb,gBAAgB,EAChB,mBAAmB,EACnB,aAAa,EACb,yBAAyB,EACzB,sBAAsB,EACtB,gCAAgC,EAChC,yBAAyB,EACzB,wBAAwB,EACxB,4BAA4B,EAC5B,iCAAiC,EACjC,iCAAiC,EACjC,mCAAmC,EACnC,wBAAwB,EACxB,wBAAwB,EACxB,mBAAmB,EACnB,2BAA2B,EAC3B,2BAA2B,EAC3B,4BAA4B,EAC5B,8BAA8B,GAI/B,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,iBAAiB,EAAE,MAAM,iCAAiC,CAAC;AACpE,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAC3C,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAG7C,OAAO,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAChD,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAC/C,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,WAAW,CAAC;AAE3C;;;;;;GAMG;AACH,MAAM,UAAU,sBAAsB,CAAC,MAAyB,OAAO,CAAC,GAAG;IACzE,oEAAoE;IACpE,IAAI,GAAG,CAAC,mBAAmB,KAAK,SAAS,EAAE,CAAC;QAC1C,MAAM,OAAO,GAAG,GAAG,CAAC,mBAAmB,CAAC;QACxC,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,EAAE,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;YACpG,MAAM,IAAI,2BAA2B,CAAC,uDAAuD,CAAC,CAAC;QACjG,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IACD,OAAO,IAAI,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;AACzC,CAAC;AAED;;;;;;;;;;;;GAYG;AAEH,iFAAiF;AACjF,SAAS,WAAW,CAAC,GAAW;IAC9B,IAAI,CAAC;QACH,IAAI,KAAK,CAAC;QACV,IAAI,OAAO,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;YAClC,KAAK,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC;QACpE,CAAC;aAAM,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;YACxC,KAAK,GAAG,KAAK,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC;QACtF,CAAC;aAAM,CAAC;YACN,KAAK,GAAG,KAAK,CAAC,UAAU,EAAE,CAAC,GAAG,CAAC,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC;QACxE,CAAC;QACD,KAAK,CAAC,KAAK,EAAE,CAAC;IAChB,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,CAAC,+CAA+C,GAAG,EAAE,CAAC,CAAC;IAC/D,CAAC;AACH,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,0BAA0B;IACxC,MAAM,GAAG,GAAG,yBAAyB,EAAE,CAAC;IACxC,OAAO;QACL,IAAI;YACF,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;YACxB,IAAI,IAAI,CAAC,MAAM,KAAK,cAAc,EAAE,CAAC;gBACnC,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC;YACrD,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;KACF,CAAC;AACJ,CAAC;AAED,4DAA4D;AAC5D,MAAM,UAAU,gBAAgB,CAAC,QAAgB;IAC/C,OAAO,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,QAAQ,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC;AAC1F,CAAC;AAED,yEAAyE;AACzE,MAAM,UAAU,mBAAmB,CACjC,YAAoB,EACpB,MAAyB,OAAO,CAAC,GAAG;IAEpC,MAAM,UAAU,GAAG;QACjB,YAAY;QACZ,GAAG,CAAC,YAAY;QAChB,GAAG,CAAC,GAAG,CAAC,iBAAiB,EAAE,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;KAC7C,CAAC;IACF,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,EAAmB,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;AACnH,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,CAAC,KAAK,UAAU,OAAO,CAC3B,QAA0B,EAC1B,OAAoB;IAEpB,MAAM,YAAY,GAAG,mBAAmB,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC3D,MAAM,UAAU,GAAG,iBAAiB,EAAE,CAAC;IAEvC,yEAAyE;IACzE,2EAA2E;IAC3E,8EAA8E;IAC9E,0EAA0E;IAC1E,IAAI,MAA0B,CAAC;IAC/B,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,eAAe,CAAC,QAAQ,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;IAC5D,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,CAAC,8CAA+C,KAAe,CAAC,OAAO,EAAE,CAAC,CAAC;QACjF,OAAO,CAAC,CAAC;IACX,CAAC;IACD,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,MAAM,CAAC,oDAAoD,QAAQ,CAAC,KAAK,CAAC,UAAU,EAAE,CAAC,CAAC;QACxF,OAAO,CAAC,CAAC;IACX,CAAC;IAED,sEAAsE;IACtE,6EAA6E;IAC7E,yEAAyE;IACzE,8EAA8E;IAC9E,4EAA4E;IAC5E,gEAAgE;IAChE,IAAI,UAAU,CAAC;IACf,IAAI,CAAC;QACH,UAAU,GAAG,MAAM,yBAAyB,CAAC;YAC3C,eAAe,EAAE,OAAO,CAAC,GAAG,CAAC,iBAAiB;YAC9C,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE;YAClB,QAAQ,EAAE,QAAQ,CAAC,KAAK,CAAC,QAAQ;YACjC,MAAM;YACN,UAAU,EAAE,OAAO,CAAC,GAAG,CAAC,YAAY;YACpC,MAAM,EAAE,aAAa;SACtB,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,wEAAwE;QACxE,wEAAwE;QACxE,MAAM,CACJ,KAAK,YAAY,wBAAwB,IAAI,KAAK,YAAY,mBAAmB;YAC/E,CAAC,CAAC,KAAK,CAAC,OAAO;YACf,CAAC,CAAC,oCAAoC,CACzC,CAAC;QACF,OAAO,CAAC,CAAC;IACX,CAAC;IAED,4EAA4E;IAC5E,uEAAuE;IACvE,IAAI,QAAQ,CAAC;IACb,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,sBAAsB,EAAE,CAAC;QAC1C,QAAQ,GAAG,wBAAwB,CAAC;YAClC,QAAQ;YACR,KAAK,EAAE,UAAU,CAAC,IAAI,CAAC,YAAY;SACpC,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,wEAAwE;QACxE,gEAAgE;QAChE,MAAM,UAAU,CAAC,kBAAkB,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QAC5D,MAAM,CACJ,KAAK,YAAY,2BAA2B;YAC1C,CAAC,CAAC,KAAK,CAAC,OAAO;YACf,CAAC,CAAC,iCAAkC,KAAe,CAAC,OAAO,EAAE,CAChE,CAAC;QACF,OAAO,CAAC,CAAC;IACX,CAAC;IAED,6EAA6E;IAC7E,4EAA4E;IAC5E,6DAA6D;IAC7D,0EAA0E;IAC1E,sEAAsE;IACtE,mEAAmE;IACnE,8BAA8B;IAC9B,MAAM,QAAQ,GAAG;QACf,YAAY;QACZ,UAAU;QACV,YAAY,EAAE,mBAAmB,CAAC,OAAO,CAAC,QAAQ,CAAC;QACnD,0EAA0E;QAC1E,6EAA6E;QAC7E,2EAA2E;QAC3E,2EAA2E;QAC3E,QAAQ,EAAE,UAAU,CAAC,QAAQ;QAC7B,YAAY,EAAE;YACZ,IAAI,EAAE,CAAC,GAAG,4BAA4B,CAAC;YACvC,QAAQ,EAAE,CAAC,GAAG,8BAA8B,CAAC;SAC9C;QACD,wEAAwE;QACxE,0EAA0E;QAC1E,SAAS,EAAE,UAAU,CAAC,IAAI;QAC1B,2EAA2E;QAC3E,wEAAwE;QACxE,QAAQ;QACR,yEAAyE;QACzE,yEAAyE;QACzE,sEAAsE;QACtE,uEAAuE;QACvE,0EAA0E;QAC1E,wEAAwE;QACxE,uEAAuE;QACvE,2EAA2E;QAC3E,qEAAqE;QACrE,4EAA4E;QAC5E,oCAAoC;QACpC,QAAQ,EAAE;YACR,MAAM,EAAE,4BAA4B,CAAC,EAAE,QAAQ,EAAE,QAAQ,CAAC,KAAK,CAAC,QAAQ,EAAE,MAAM,EAAE,CAAC;YACnF,KAAK,EAAE,UAAU,CAAC,IAAI,CAAC,YAAY;YACnC,MAAM,EAAE;gBACN,MAAM,EAAE,iCAAiC,CAAC,EAAE,QAAQ,EAAE,QAAQ,CAAC,KAAK,CAAC,QAAQ,EAAE,MAAM,EAAE,CAAC;gBACxF,aAAa,EAAE,UAAU,CAAC,OAAO;aAClC;YACD,MAAM,EAAE;gBACN,MAAM,EAAE,iCAAiC,CAAC,EAAE,QAAQ,EAAE,QAAQ,CAAC,KAAK,CAAC,QAAQ,EAAE,MAAM,EAAE,CAAC;gBACxF,aAAa,EAAE,UAAU,CAAC,OAAO;aAClC;YACD,QAAQ,EAAE;gBACR,MAAM,EAAE,mCAAmC,CAAC,EAAE,QAAQ,EAAE,QAAQ,CAAC,KAAK,CAAC,QAAQ,EAAE,MAAM,EAAE,CAAC;gBAC1F,aAAa,EAAE,UAAU,CAAC,OAAO;aAClC;SACF;QACD,IAAI,EAAE,EAAE,MAAM,EAAE,0BAA0B,EAAE,EAAE;QAC9C,MAAM,EAAE,aAAa;QACrB,4EAA4E;QAC5E,oEAAoE;QACpE,iBAAiB,EAAE,2BAA2B;KAC/C,CAAC;IACF,MAAM,kBAAkB,GAAG,wBAAwB,CAAC,QAAQ,CAAC,CAAC;IAE9D,yEAAyE;IACzE,0EAA0E;IAC1E,MAAM,cAAc,GAAG,IAAI,iBAAiB,CAAC,EAAE,QAAQ,EAAE,QAAQ,CAAC,KAAK,CAAC,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;IAC5F,MAAM,SAAS,GAAG,IAAI,sBAAsB,CAAC;QAC3C,MAAM,EAAE,cAAc;QACtB,IAAI,EAAE,YAAY;QAClB,2EAA2E;QAC3E,uEAAuE;QACvE,wEAAwE;QACxE,oCAAoC;QACpC,mBAAmB,EAAE,GAAG,EAAE,CAAC,kBAAkB,CAAC,OAAO,EAAE;QACvD,0BAA0B,EAAE,gCAAgC,CAAC;YAC3D,MAAM,EAAE,cAAc;YACtB,KAAK,EAAE,UAAU,CAAC,IAAI,CAAC,YAAY;SACpC,CAAC;QACF,4EAA4E;QAC5E,qCAAqC;QACrC,MAAM,EAAE,EAAE,SAAS,EAAE,2BAA2B,EAAE;QAClD,MAAM,EAAE,aAAa;KACtB,CAAC,CAAC;IAEH,MAAM,IAAI,GAAG,aAAa,CAAC;QACzB,GAAG,QAAQ;QACX,kBAAkB;QAClB,SAAS;KACV,CAAC,CAAC;IAEH,MAAM,MAAM,GAAqB,MAAM,gBAAgB,CAAC,IAAI,EAAE;QAC5D,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,QAAQ,EAAE,OAAO,CAAC,QAAQ;KAC3B,CAAC,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;QACvB,0EAA0E;QAC1E,MAAM,UAAU,CAAC,kBAAkB,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QAC5D,MAAM,KAAK,CAAC;IACd,CAAC,CAAC,CAAC;IACH,MAAM,GAAG,GAAG,UAAU,gBAAgB,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;IAC1E,MAAM,CAAC,qBAAqB,GAAG,EAAE,CAAC,CAAC;IACnC,MAAM,CAAC,eAAe,QAAQ,CAAC,SAAS,cAAc,QAAQ,CAAC,QAAQ,GAAG,CAAC,CAAC;IAC5E,MAAM,CAAC,oCAAoC,UAAU,CAAC,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,CAAC,MAAM,sBAAsB,IAAI,CAAC,SAAS,CAAC,4BAA4B,CAAC,4NAA4N,CAAC,CAAC;IAEtX,IAAI,OAAO,CAAC,IAAI;QAAE,WAAW,CAAC,GAAG,CAAC,CAAC;IAEnC,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,MAAM,QAAQ,GAAG,KAAK,EAAE,MAAsB,EAAiB,EAAE;QAC/D,IAAI,OAAO;YAAE,OAAO;QACpB,OAAO,GAAG,IAAI,CAAC;QACf,MAAM,CAAC,GAAG,MAAM,mDAAmD,CAAC,CAAC;QACrE,IAAI,CAAC;YACH,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;QACvB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,qBAAsB,KAAe,CAAC,OAAO,EAAE,CAAC,CAAC;QAC1D,CAAC;QACD,oEAAoE;QACpE,IAAI,CAAC;YACH,MAAM,UAAU,CAAC,kBAAkB,CAAC,KAAK,EAAE,CAAC;QAC9C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,4BAA6B,KAAe,CAAC,OAAO,EAAE,CAAC,CAAC;QACjE,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC,CAAC;IACF,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,KAAK,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;IACxD,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,KAAK,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;IAEzD,yEAAyE;IACzE,MAAM,IAAI,OAAO,CAAO,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IAClC,OAAO,CAAC,CAAC;AACX,CAAC"}

package/dist/commands/host.d.ts

@@ -0,0 +1,7 @@
+/**
+ * `pix-host` / `pix host` — boot the Host only. Requires an already-running,
+ * pingable sessiond; it never spawns one, so it is the right entry for a
+ * supervised restart of the web layer while sessions stay alive.
+ */
+export declare function hostCommand(argv: string[]): Promise<number>;
+//# sourceMappingURL=host.d.ts.map

package/dist/commands/host.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"host.d.ts","sourceRoot":"","sources":["../../src/commands/host.ts"],"names":[],"mappings":"AAKA;;;;GAIG;AACH,wBAAsB,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CAoBjE"}

package/dist/commands/host.js

@@ -0,0 +1,30 @@
+import { parseBindArgs } from "../args.js";
+import { inspectSessiond, locateSessiond } from "../supervise.js";
+import { runHost } from "./host-runner.js";
+import { pixLog, pixErr } from "../log.js";
+/**
+ * `pix-host` / `pix host` — boot the Host only. Requires an already-running,
+ * pingable sessiond; it never spawns one, so it is the right entry for a
+ * supervised restart of the web layer while sessions stay alive.
+ */
+export async function hostCommand(argv) {
+    let options;
+    try {
+        options = parseBindArgs(argv);
+    }
+    catch (error) {
+        pixErr(error.message);
+        return 2;
+    }
+    const status = await inspectSessiond();
+    if (!status.pingable) {
+        pixErr(status.alive
+            ? `sessiond locked (pid ${status.pid}) but not reachable at ${status.endpoint}`
+            : "no reachable sessiond; start one with `pix start` or `pix sessiond`");
+        return 1;
+    }
+    pixLog(`sessiond reachable (pid ${status.pid}); starting host`);
+    const location = locateSessiond();
+    return runHost(location, options);
+}
+//# sourceMappingURL=host.js.map

package/dist/commands/host.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"host.js","sourceRoot":"","sources":["../../src/commands/host.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAoB,MAAM,YAAY,CAAC;AAC7D,OAAO,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAClE,OAAO,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAC3C,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,WAAW,CAAC;AAE3C;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,IAAc;IAC9C,IAAI,OAAoB,CAAC;IACzB,IAAI,CAAC;QACH,OAAO,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;IAChC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,CAAE,KAAe,CAAC,OAAO,CAAC,CAAC;QACjC,OAAO,CAAC,CAAC;IACX,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,eAAe,EAAE,CAAC;IACvC,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;QACrB,MAAM,CACJ,MAAM,CAAC,KAAK;YACV,CAAC,CAAC,wBAAwB,MAAM,CAAC,GAAG,0BAA0B,MAAM,CAAC,QAAQ,EAAE;YAC/E,CAAC,CAAC,qEAAqE,CAC1E,CAAC;QACF,OAAO,CAAC,CAAC;IACX,CAAC;IACD,MAAM,CAAC,2BAA2B,MAAM,CAAC,GAAG,kBAAkB,CAAC,CAAC;IAChE,MAAM,QAAQ,GAAG,cAAc,EAAE,CAAC;IAClC,OAAO,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;AACpC,CAAC"}

package/dist/commands/sessiond-foreground.d.ts

@@ -0,0 +1,7 @@
+/**
+ * `pix sessiond` — run the sessiond daemon in the foreground (same lifecycle as
+ * the `pix-sessiond` bin). Reads `PIX_SESSIOND_DIR` then `~/.pi/pix/sessiond`.
+ * Returns the daemon's exit code; never returns while the daemon is running.
+ */
+export declare function sessiondCommand(): Promise<number>;
+//# sourceMappingURL=sessiond-foreground.d.ts.map

package/dist/commands/sessiond-foreground.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sessiond-foreground.d.ts","sourceRoot":"","sources":["../../src/commands/sessiond-foreground.ts"],"names":[],"mappings":"AAGA;;;;GAIG;AACH,wBAAsB,eAAe,IAAI,OAAO,CAAC,MAAM,CAAC,CAOvD"}

package/dist/commands/sessiond-foreground.js

@@ -0,0 +1,17 @@
+import { main } from "@fffattiger/pix-sessiond/daemon";
+import { pixErr } from "../log.js";
+/**
+ * `pix sessiond` — run the sessiond daemon in the foreground (same lifecycle as
+ * the `pix-sessiond` bin). Reads `PIX_SESSIOND_DIR` then `~/.pi/pix/sessiond`.
+ * Returns the daemon's exit code; never returns while the daemon is running.
+ */
+export async function sessiondCommand() {
+    try {
+        return await main();
+    }
+    catch (error) {
+        pixErr(error.message);
+        return 1;
+    }
+}
+//# sourceMappingURL=sessiond-foreground.js.map

package/dist/commands/sessiond-foreground.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sessiond-foreground.js","sourceRoot":"","sources":["../../src/commands/sessiond-foreground.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,iCAAiC,CAAC;AACvD,OAAO,EAAE,MAAM,EAAE,MAAM,WAAW,CAAC;AAEnC;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe;IACnC,IAAI,CAAC;QACH,OAAO,MAAM,IAAI,EAAE,CAAC;IACtB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,CAAE,KAAe,CAAC,OAAO,CAAC,CAAC;QACjC,OAAO,CAAC,CAAC;IACX,CAAC;AACH,CAAC"}

package/dist/commands/start.d.ts

@@ -0,0 +1,7 @@
+/**
+ * `pix start` — M1 one-command boot. Ensures a pingable sessiond (reusing an
+ * existing one, otherwise spawning a detached daemon and waiting for RPC
+ * readiness), then boots the Hono Host serving the built client.
+ */
+export declare function startCommand(argv: string[]): Promise<number>;
+//# sourceMappingURL=start.d.ts.map

package/dist/commands/start.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"start.d.ts","sourceRoot":"","sources":["../../src/commands/start.ts"],"names":[],"mappings":"AAKA;;;;GAIG;AACH,wBAAsB,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CAiBlE"}

package/dist/commands/start.js

@@ -0,0 +1,30 @@
+import { parseBindArgs } from "../args.js";
+import { ensureSessiond, locateSessiond } from "../supervise.js";
+import { runHost } from "./host-runner.js";
+import { pixLog, pixErr } from "../log.js";
+/**
+ * `pix start` — M1 one-command boot. Ensures a pingable sessiond (reusing an
+ * existing one, otherwise spawning a detached daemon and waiting for RPC
+ * readiness), then boots the Hono Host serving the built client.
+ */
+export async function startCommand(argv) {
+    let options;
+    try {
+        options = parseBindArgs(argv);
+    }
+    catch (error) {
+        pixErr(error.message);
+        return 2;
+    }
+    try {
+        await ensureSessiond(undefined, pixLog);
+    }
+    catch (error) {
+        pixErr(error.message);
+        return 1;
+    }
+    // After ensure, the resolved location matches the daemon's directory.
+    const location = locateSessiond();
+    return runHost(location, options);
+}
+//# sourceMappingURL=start.js.map

package/dist/commands/start.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"start.js","sourceRoot":"","sources":["../../src/commands/start.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAoB,MAAM,YAAY,CAAC;AAC7D,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AACjE,OAAO,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAC3C,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,WAAW,CAAC;AAE3C;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,IAAc;IAC/C,IAAI,OAAoB,CAAC;IACzB,IAAI,CAAC;QACH,OAAO,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;IAChC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,CAAE,KAAe,CAAC,OAAO,CAAC,CAAC;QACjC,OAAO,CAAC,CAAC;IACX,CAAC;IACD,IAAI,CAAC;QACH,MAAM,cAAc,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;IAC1C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,CAAE,KAAe,CAAC,OAAO,CAAC,CAAC;QACjC,OAAO,CAAC,CAAC;IACX,CAAC;IACD,sEAAsE;IACtE,MAAM,QAAQ,GAAG,cAAc,EAAE,CAAC;IAClC,OAAO,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;AACpC,CAAC"}

package/dist/commands/status.d.ts

@@ -0,0 +1,7 @@
+/**
+ * `pix status` — report sessiond lifecycle state: not running / stale lock /
+ * running, with pid, instance id, endpoint and directory. When a live pid is
+ * found, reachability is confirmed by a real RPC ping (not pid-aliveness alone).
+ */
+export declare function statusCommand(): Promise<number>;
+//# sourceMappingURL=status.d.ts.map

package/dist/commands/status.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"status.d.ts","sourceRoot":"","sources":["../../src/commands/status.ts"],"names":[],"mappings":"AAGA;;;;GAIG;AACH,wBAAsB,aAAa,IAAI,OAAO,CAAC,MAAM,CAAC,CAuBrD"}

package/dist/commands/status.js

@@ -0,0 +1,34 @@
+import { inspectSessiond } from "../supervise.js";
+import { pixLog } from "../log.js";
+/**
+ * `pix status` — report sessiond lifecycle state: not running / stale lock /
+ * running, with pid, instance id, endpoint and directory. When a live pid is
+ * found, reachability is confirmed by a real RPC ping (not pid-aliveness alone).
+ */
+export async function statusCommand() {
+    const status = await inspectSessiond();
+    if (status.obstructed) {
+        // A live listener without a lock, an unsafe lock, or a live-but-unreachable
+        // pid is an authoritative obstacle, never "not running" — report it
+        // honestly and exit non-zero so scripts do not treat the directory as down.
+        pixLog("sessiond: obstructed");
+        pixLog(`  reason: ${status.obstruction ?? "sessiond state is unsafe"}`);
+        pixLog(`  directory: ${status.directory}`);
+        return 1;
+    }
+    if (status.pid === undefined) {
+        pixLog("sessiond: not running");
+    }
+    else if (!status.alive) {
+        pixLog("sessiond: not running (stale lock)");
+        pixLog(`  pid: ${status.pid}  instance: ${status.instanceId ?? "?"}`);
+    }
+    else {
+        pixLog(`sessiond: running (${status.pingable ? "healthy" : "locked but unreachable"})`);
+        pixLog(`  pid: ${status.pid}  instance: ${status.instanceId ?? "?"}`);
+        pixLog(`  endpoint: ${status.endpoint}`);
+    }
+    pixLog(`  directory: ${status.directory}`);
+    return 0;
+}
+//# sourceMappingURL=status.js.map

package/dist/commands/status.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"status.js","sourceRoot":"","sources":["../../src/commands/status.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAClD,OAAO,EAAE,MAAM,EAAE,MAAM,WAAW,CAAC;AAEnC;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa;IACjC,MAAM,MAAM,GAAG,MAAM,eAAe,EAAE,CAAC;IACvC,IAAI,MAAM,CAAC,UAAU,EAAE,CAAC;QACtB,4EAA4E;QAC5E,oEAAoE;QACpE,4EAA4E;QAC5E,MAAM,CAAC,sBAAsB,CAAC,CAAC;QAC/B,MAAM,CAAC,aAAa,MAAM,CAAC,WAAW,IAAI,0BAA0B,EAAE,CAAC,CAAC;QACxE,MAAM,CAAC,gBAAgB,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC;QAC3C,OAAO,CAAC,CAAC;IACX,CAAC;IACD,IAAI,MAAM,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;QAC7B,MAAM,CAAC,uBAAuB,CAAC,CAAC;IAClC,CAAC;SAAM,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;QACzB,MAAM,CAAC,oCAAoC,CAAC,CAAC;QAC7C,MAAM,CAAC,UAAU,MAAM,CAAC,GAAG,eAAe,MAAM,CAAC,UAAU,IAAI,GAAG,EAAE,CAAC,CAAC;IACxE,CAAC;SAAM,CAAC;QACN,MAAM,CAAC,sBAAsB,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,wBAAwB,GAAG,CAAC,CAAC;QACxF,MAAM,CAAC,UAAU,MAAM,CAAC,GAAG,eAAe,MAAM,CAAC,UAAU,IAAI,GAAG,EAAE,CAAC,CAAC;QACtE,MAAM,CAAC,eAAe,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC;IAC3C,CAAC;IACD,MAAM,CAAC,gBAAgB,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC;IAC3C,OAAO,CAAC,CAAC;AACX,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,24 @@
+/**
+ * pix CLI — production composition + lifecycle entry point.
+ *
+ * Dispatches the lifecycle commands (`start`, `host`, `status`, `down`,
+ * `sessiond`, `test:e2e:startup`) to their command modules. The root
+ * `scripts/product-entry.mjs` and the `pix` bin both reach the CLI through
+ * {@link runCli}, keeping a single source of truth for command behavior.
+ *
+ * Composition-root scope: this package only starts/stops the Host and sessiond
+ * and discovers running instances. It imports no Worker/runtime/WS/files
+ * resources and declares no capability beyond what the Host actually mounts.
+ */
+/**
+ * Read the CLI package version from the manifest adjacent to this compiled
+ * module (`dist/index.js` → `../package.json`), which holds in both the
+ * workspace layout and the REL1 self-contained release bundle.
+ */
+export declare function resolveCliVersion(fromUrl?: string): string;
+/**
+ * Run the pix CLI against `argv` (the args after the command name). Resolves
+ * with the process exit code; never throws — errors are mapped to exit codes.
+ */
+export declare function runCli(argv: string[]): Promise<number>;
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAYH;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,GAAE,MAAwB,GAAG,MAAM,CAY3E;AAYD;;;GAGG;AACH,wBAAsB,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CA8B5D"}

package/dist/index.js

@@ -0,0 +1,83 @@
+/**
+ * pix CLI — production composition + lifecycle entry point.
+ *
+ * Dispatches the lifecycle commands (`start`, `host`, `status`, `down`,
+ * `sessiond`, `test:e2e:startup`) to their command modules. The root
+ * `scripts/product-entry.mjs` and the `pix` bin both reach the CLI through
+ * {@link runCli}, keeping a single source of truth for command behavior.
+ *
+ * Composition-root scope: this package only starts/stops the Host and sessiond
+ * and discovers running instances. It imports no Worker/runtime/WS/files
+ * resources and declares no capability beyond what the Host actually mounts.
+ */
+import { readFileSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { fileURLToPath } from "node:url";
+import { startCommand } from "./commands/start.js";
+import { hostCommand } from "./commands/host.js";
+import { statusCommand } from "./commands/status.js";
+import { downCommand } from "./commands/down.js";
+import { sessiondCommand } from "./commands/sessiond-foreground.js";
+import { pixErr, pixLog } from "./log.js";
+/**
+ * Read the CLI package version from the manifest adjacent to this compiled
+ * module (`dist/index.js` → `../package.json`), which holds in both the
+ * workspace layout and the REL1 self-contained release bundle.
+ */
+export function resolveCliVersion(fromUrl = import.meta.url) {
+    try {
+        const manifest = JSON.parse(readFileSync(join(dirname(fileURLToPath(fromUrl)), "..", "package.json"), "utf8"));
+        if (typeof manifest.version === "string" && manifest.version.length > 0) {
+            return manifest.version;
+        }
+    }
+    catch {
+        // fall through to a fixed unknown marker
+    }
+    return "unknown";
+}
+function printHelp() {
+    pixLog("usage: pix <command> [options]");
+    pixLog("commands:");
+    pixLog("  start [--hostname H] [--port P] [--open|--no-open]  ensure sessiond + boot host");
+    pixLog("  host  [--hostname H] [--port P] [--open|--no-open]  boot host only (needs sessiond)");
+    pixLog("  status                                              report sessiond state");
+    pixLog("  down --all                                          stop sessiond (requires --all)");
+    pixLog("  sessiond                                            run sessiond in the foreground");
+}
+/**
+ * Run the pix CLI against `argv` (the args after the command name). Resolves
+ * with the process exit code; never throws — errors are mapped to exit codes.
+ */
+export async function runCli(argv) {
+    const command = argv[0];
+    const rest = argv.slice(1);
+    switch (command) {
+        case "--version":
+        case "-v": {
+            pixLog(`pix ${resolveCliVersion()}`);
+            return 0;
+        }
+        case "start":
+            return startCommand(rest);
+        case "host":
+            return hostCommand(rest);
+        case "status":
+            return statusCommand();
+        case "down":
+            return downCommand(rest);
+        case "sessiond":
+            return sessiondCommand();
+        case undefined:
+        case "-h":
+        case "--help":
+        case "help":
+            printHelp();
+            return 0;
+        default:
+            pixErr(`unknown command: ${command}`);
+            printHelp();
+            return 2;
+    }
+}
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACnD,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,EAAE,eAAe,EAAE,MAAM,mCAAmC,CAAC;AACpE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,UAAU,CAAC;AAE1C;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAAC,UAAkB,MAAM,CAAC,IAAI,CAAC,GAAG;IACjE,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CACzB,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC,EAAE,IAAI,EAAE,cAAc,CAAC,EAAE,MAAM,CAAC,CACzD,CAAC;QAC3B,IAAI,OAAO,QAAQ,CAAC,OAAO,KAAK,QAAQ,IAAI,QAAQ,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxE,OAAO,QAAQ,CAAC,OAAO,CAAC;QAC1B,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,yCAAyC;IAC3C,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,SAAS;IAChB,MAAM,CAAC,gCAAgC,CAAC,CAAC;IACzC,MAAM,CAAC,WAAW,CAAC,CAAC;IACpB,MAAM,CAAC,mFAAmF,CAAC,CAAC;IAC5F,MAAM,CAAC,uFAAuF,CAAC,CAAC;IAChG,MAAM,CAAC,6EAA6E,CAAC,CAAC;IACtF,MAAM,CAAC,sFAAsF,CAAC,CAAC;IAC/F,MAAM,CAAC,sFAAsF,CAAC,CAAC;AACjG,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,MAAM,CAAC,IAAc;IACzC,MAAM,OAAO,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IACxB,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAC3B,QAAQ,OAAO,EAAE,CAAC;QAChB,KAAK,WAAW,CAAC;QACjB,KAAK,IAAI,CAAC,CAAC,CAAC;YACV,MAAM,CAAC,OAAO,iBAAiB,EAAE,EAAE,CAAC,CAAC;YACrC,OAAO,CAAC,CAAC;QACX,CAAC;QACD,KAAK,OAAO;YACV,OAAO,YAAY,CAAC,IAAI,CAAC,CAAC;QAC5B,KAAK,MAAM;YACT,OAAO,WAAW,CAAC,IAAI,CAAC,CAAC;QAC3B,KAAK,QAAQ;YACX,OAAO,aAAa,EAAE,CAAC;QACzB,KAAK,MAAM;YACT,OAAO,WAAW,CAAC,IAAI,CAAC,CAAC;QAC3B,KAAK,UAAU;YACb,OAAO,eAAe,EAAE,CAAC;QAC3B,KAAK,SAAS,CAAC;QACf,KAAK,IAAI,CAAC;QACV,KAAK,QAAQ,CAAC;QACd,KAAK,MAAM;YACT,SAAS,EAAE,CAAC;YACZ,OAAO,CAAC,CAAC;QACX;YACE,MAAM,CAAC,oBAAoB,OAAO,EAAE,CAAC,CAAC;YACtC,SAAS,EAAE,CAAC;YACZ,OAAO,CAAC,CAAC;IACb,CAAC;AACH,CAAC"}

package/dist/log.d.ts

@@ -0,0 +1,8 @@
+/**
+ * Single brand namespace for all user-visible CLI output. Every line is
+ * prefixed `[pix]` so logs/errors are unambiguous regardless of which process
+ * emitted them.
+ */
+export declare function pixLog(message: string): void;
+export declare function pixErr(message: string): void;
+//# sourceMappingURL=log.d.ts.map

package/dist/log.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"log.d.ts","sourceRoot":"","sources":["../src/log.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,wBAAgB,MAAM,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAE5C;AAED,wBAAgB,MAAM,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAE5C"}