@fnndsc/calypso 0.2.0

package/dist/daemon/server.js

@@ -0,0 +1,466 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CalypsoDaemon = void 0;
+/**
+ * @file The CALYPSO daemon: a WebSocket host over one engine, with a session
+ * bus.
+ *
+ * The daemon binds the loopback interface only and hosts a single hosted
+ * engine. A surface attaches with the contract version and the attach token
+ * (compared in constant time); once attached it drives the engine with
+ * `execute` and `complete` messages and receives `result` and completion
+ * replies. Command execution is serialized per connection — shell semantics,
+ * and what keeps each command's error boundary correct.
+ *
+ * All attached surfaces share one session. A **session bus** broadcasts every
+ * result envelope to the *other* attached surfaces (tagged with the surface
+ * that produced it), so a command issued in one surface is immediately
+ * visible in the rest. A bounded **scrollback** ring buffer of recent
+ * envelopes is replayed to an attaching surface so it does not join blind;
+ * scrollback is presentation, not truth — a daemon restart loses it, which is
+ * correct, and the durable record is an opt-in transcript materialized to
+ * CUBE.
+ *
+ * CUBE credentials never cross the wire: the engine the daemon hosts holds its
+ * own CUBE session, established by the launcher exactly as the CLI does;
+ * surfaces authenticate to the daemon, not to CUBE.
+ *
+ * @module
+ */
+const node_crypto_1 = require("node:crypto");
+const ws_1 = require("ws");
+const token_js_1 = require("./token.js");
+const version_js_1 = require("../protocol/version.js");
+const validate_js_1 = require("../protocol/validate.js");
+/** The default number of envelopes retained for scrollback replay. */
+const SCROLLBACK_DEFAULT = 200;
+/**
+ * A WebSocket daemon hosting one engine for attached surfaces, with a session
+ * bus broadcasting activity across them.
+ */
+class CalypsoDaemon {
+    /**
+     * @param options - The engine to host, the attach token, the bind address,
+     *   and the scrollback size.
+     */
+    constructor(options) {
+        /** The one session all surfaces share; returned in each attach ack. */
+        this.sessionId = (0, node_crypto_1.randomBytes)(8).toString('hex');
+        this.surfaces = new Set();
+        this.scrollback = [];
+        this.wss = null;
+        /**
+         * Execution is serialized across the whole session (one foreground command
+         * at a time), so a prompt raised mid-command has one unambiguous surface to
+         * ask — the one running the current command.
+         */
+        this.queue = Promise.resolve();
+        this.currentOrigin = null;
+        this.currentId = null;
+        this.pendingPrompts = new Map();
+        this.promptSeq = 0;
+        this.pendingPipes = new Map();
+        this.pipeSeq = 0;
+        this.pendingEdits = new Map();
+        this.editSeq = 0;
+        this.engine = options.engine;
+        this.token = options.token;
+        this.port = options.port ?? 0;
+        this.host = options.host ?? '127.0.0.1';
+        this.scrollbackSize = options.scrollbackSize ?? SCROLLBACK_DEFAULT;
+        this.promptProvider = options.promptProvider;
+    }
+    /**
+     * Starts listening.
+     *
+     * @returns The bound port (useful when an ephemeral port was requested).
+     */
+    start() {
+        return new Promise((resolve, reject) => {
+            const wss = new ws_1.WebSocketServer({ host: this.host, port: this.port });
+            wss.on('listening', () => resolve(wss.address().port));
+            wss.on('error', reject);
+            wss.on('connection', (socket) => this.connection_handle(socket));
+            this.wss = wss;
+        });
+    }
+    /**
+     * Stops listening and closes all connections.
+     *
+     * @returns A promise resolving when the server has closed.
+     */
+    stop() {
+        return new Promise((resolve) => {
+            if (!this.wss) {
+                resolve();
+                return;
+            }
+            for (const client of this.wss.clients) {
+                client.terminate();
+            }
+            this.wss.close(() => resolve());
+            this.wss = null;
+        });
+    }
+    /**
+     * Handles one surface connection: an attach handshake, then serialized
+     * command dispatch, with the surface removed from the bus on close.
+     *
+     * @param socket - The connected surface.
+     */
+    connection_handle(socket) {
+        let surface = null;
+        socket.on('message', (data) => {
+            let parsed;
+            try {
+                parsed = JSON.parse(data.toString());
+            }
+            catch (err) {
+                const message = err instanceof Error ? err.message : String(err);
+                this.send(socket, { type: 'error', reason: `malformed JSON: ${message}` });
+                return;
+            }
+            if (!surface) {
+                surface = this.attach_handle(socket, parsed);
+                return;
+            }
+            const message = (0, validate_js_1.clientMessage_parse)(parsed);
+            if (!message.ok || message.value === undefined) {
+                this.send(socket, { type: 'error', reason: message.error ?? 'invalid message' });
+                return;
+            }
+            const value = message.value;
+            const attached = surface;
+            if (value.type === 'execute') {
+                // One shared queue: commands from every surface run one at a time.
+                this.queue = this.queue.then(() => this.execute_run(attached, value));
+            }
+            else if (value.type === 'complete') {
+                void this.complete_run(socket, value);
+            }
+            else if (value.type === 'promptAnswer') {
+                this.promptAnswer_settle(value.promptId, value.answer);
+            }
+            else if (value.type === 'pipeResult') {
+                this.pipeResult_settle(value.pipeId, value.output);
+            }
+            else if (value.type === 'editResult') {
+                this.editResult_settle(value.editId, { content: value.content, changed: value.changed });
+            }
+            else {
+                this.send(socket, { type: 'error', reason: 'already attached' });
+            }
+        });
+        socket.on('close', () => {
+            if (surface) {
+                this.surfaces.delete(surface);
+            }
+        });
+    }
+    /**
+     * Validates an attach handshake: contract version, then constant-time
+     * token check. On success the surface is acknowledged, registered on the
+     * bus, and replayed the scrollback so it does not join blind; on failure it
+     * is told why and disconnected.
+     *
+     * @param socket - The connecting surface.
+     * @param raw - The first message received.
+     * @returns The registered surface, or null when the attach was refused.
+     */
+    attach_handle(socket, raw) {
+        const attach = (0, validate_js_1.attach_parse)(raw);
+        if (!attach.ok || attach.value === undefined) {
+            this.send(socket, { type: 'error', reason: attach.error ?? 'invalid attach' });
+            socket.close();
+            return null;
+        }
+        if (!(0, token_js_1.token_matches)(this.token, attach.value.token)) {
+            this.send(socket, { type: 'error', reason: 'invalid token' });
+            socket.close();
+            return null;
+        }
+        // Each connection is a distinct surface (its own bus tag); all attach to
+        // the one shared session returned in the ack.
+        const surface = { socket, id: (0, node_crypto_1.randomBytes)(8).toString('hex') };
+        this.surfaces.add(surface);
+        this.send(socket, { type: 'attached', session: this.sessionId, protocolVersion: version_js_1.CONTRACT_VERSION });
+        this.scrollback_replay(socket);
+        // The newcomer shows the right prompt immediately, before any command.
+        void this.promptline_push(surface);
+        return surface;
+    }
+    /**
+     * Renders the current prompt (when the host supplies a provider) and pushes
+     * it to a surface, or to all surfaces when none is given. Called after each
+     * command — the context may have changed — and on attach.
+     *
+     * @param target - The surface to push to; omitted to push to all.
+     */
+    async promptline_push(target) {
+        if (!this.promptProvider) {
+            return;
+        }
+        const text = await this.promptProvider();
+        if (target) {
+            this.send(target.socket, { type: 'promptline', text });
+            return;
+        }
+        for (const surface of this.surfaces) {
+            this.send(surface.socket, { type: 'promptline', text });
+        }
+    }
+    /**
+     * Replays the retained scrollback to a freshly attached surface as session
+     * events, so it arrives seeing recent activity rather than blank.
+     *
+     * @param socket - The surface to replay to.
+     */
+    scrollback_replay(socket) {
+        for (const entry of this.scrollback) {
+            this.send(socket, { type: 'session', surface: entry.surface, envelope: entry.envelope });
+        }
+    }
+    /**
+     * Records an envelope in scrollback (trimming to the retention bound) and
+     * broadcasts it to every attached surface except the one that produced it,
+     * which already received it as the correlated `result`.
+     *
+     * @param origin - The surface that produced the envelope.
+     * @param envelope - The envelope to publish.
+     */
+    bus_publish(origin, envelope) {
+        this.scrollback.push({ surface: origin.id, envelope });
+        if (this.scrollback.length > this.scrollbackSize) {
+            this.scrollback.splice(0, this.scrollback.length - this.scrollbackSize);
+        }
+        for (const surface of this.surfaces) {
+            if (surface !== origin) {
+                this.send(surface.socket, { type: 'session', surface: origin.id, envelope });
+            }
+        }
+    }
+    /**
+     * Runs one execute request: replies to the requester with the result, and
+     * publishes each envelope to the session bus.
+     *
+     * @param origin - The surface that submitted the request.
+     * @param message - The execute request.
+     */
+    async execute_run(origin, message) {
+        // The command runs with this surface as the prompt target, so any prompt
+        // the engine raises is asked of the surface that submitted the command.
+        this.currentOrigin = origin;
+        this.currentId = message.id;
+        try {
+            const envelopes = await this.engine.line_execute(message.line);
+            this.send(origin.socket, { type: 'result', id: message.id, envelopes });
+            for (const envelope of envelopes) {
+                this.bus_publish(origin, envelope);
+            }
+        }
+        catch (err) {
+            const reason = err instanceof Error ? err.message : String(err);
+            this.send(origin.socket, { type: 'error', id: message.id, reason });
+        }
+        finally {
+            this.currentOrigin = null;
+            this.currentId = null;
+        }
+        // The command may have changed session context (cwd, connection); push the
+        // refreshed prompt to every surface.
+        await this.promptline_push();
+    }
+    /**
+     * Raises a prompt on the surface running the current command, returning its
+     * answer. The host installs an engine-side input broker that calls this; the
+     * engine therefore prompts through the wire without knowing the transport.
+     *
+     * @param message - The prompt text to show.
+     * @param hidden - Whether to request no-echo entry (a password).
+     * @returns The surface's answer.
+     * @throws {Error} When no command is executing (nothing to prompt for) or the
+     *   surface disconnects before answering.
+     */
+    prompt_current(message, hidden) {
+        const origin = this.currentOrigin;
+        if (!origin) {
+            return Promise.reject(new Error('no active command to prompt for'));
+        }
+        const promptId = `p${this.promptSeq++}`;
+        return new Promise((resolve, reject) => {
+            this.pendingPrompts.set(promptId, resolve);
+            const onClose = () => {
+                if (this.pendingPrompts.delete(promptId)) {
+                    reject(new Error('surface disconnected before answering'));
+                }
+            };
+            origin.socket.once('close', onClose);
+            this.send(origin.socket, { type: 'prompt', promptId, message, hidden });
+        });
+    }
+    /**
+     * Streams structured progress from the executing command to its origin
+     * surface. Progress is live-only; when no command is active or the surface is
+     * gone, the event is dropped.
+     *
+     * @param event - The structured progress facts.
+     * @returns True when the event was sent to a surface.
+     */
+    progress_current(event) {
+        const origin = this.currentOrigin;
+        const id = this.currentId;
+        if (!origin || !id || origin.socket.readyState !== ws_1.WebSocket.OPEN) {
+            return false;
+        }
+        this.send(origin.socket, { type: 'progress', id, ...event });
+        return true;
+    }
+    /**
+     * Streams an opaque live output chunk from the executing command to its
+     * origin surface. Output is live telemetry, distinct from final envelopes;
+     * when no command is active or the origin surface is gone, it is dropped.
+     *
+     * @param channel - The output channel that produced the chunk.
+     * @param chunk - The text chunk to forward.
+     * @returns True when the chunk was sent to a surface.
+     */
+    output_current(channel, chunk) {
+        const origin = this.currentOrigin;
+        const id = this.currentId;
+        if (!origin || !id || origin.socket.readyState !== ws_1.WebSocket.OPEN) {
+            return false;
+        }
+        this.send(origin.socket, { type: 'output', id, channel, chunk });
+        return true;
+    }
+    /**
+     * Resolves a pending prompt with the surface's answer.
+     *
+     * @param promptId - The prompt correlation id.
+     * @param answer - The answer the surface supplied.
+     */
+    promptAnswer_settle(promptId, answer) {
+        const resolve = this.pendingPrompts.get(promptId);
+        if (resolve) {
+            this.pendingPrompts.delete(promptId);
+            resolve(answer);
+        }
+    }
+    /**
+     * Runs a pipeline segment on the surface running the current command,
+     * returning its output. The host installs a `pipeSegment` on its engine-side
+     * surface that calls this, so a pipeline's segments run on the client and
+     * never on the daemon host. Data crosses the wire base64-encoded.
+     *
+     * @param command - The segment command line.
+     * @param input - The bytes to feed the segment.
+     * @returns The segment's output bytes.
+     * @throws {Error} When no command is executing or the surface disconnects.
+     */
+    pipe_current(command, input) {
+        const origin = this.currentOrigin;
+        if (!origin) {
+            return Promise.reject(new Error('no active command to run a pipe segment for'));
+        }
+        const pipeId = `x${this.pipeSeq++}`;
+        return new Promise((resolve, reject) => {
+            this.pendingPipes.set(pipeId, resolve);
+            const onClose = () => {
+                if (this.pendingPipes.delete(pipeId)) {
+                    reject(new Error('surface disconnected before returning pipe output'));
+                }
+            };
+            origin.socket.once('close', onClose);
+            this.send(origin.socket, { type: 'pipe', pipeId, command, input: input.toString('base64') });
+        });
+    }
+    /**
+     * Resolves a pending pipe segment with the surface's output.
+     *
+     * @param pipeId - The pipe correlation id.
+     * @param output - The base64-encoded segment output.
+     */
+    pipeResult_settle(pipeId, output) {
+        const resolve = this.pendingPipes.get(pipeId);
+        if (resolve) {
+            this.pendingPipes.delete(pipeId);
+            resolve(Buffer.from(output, 'base64'));
+        }
+    }
+    /**
+     * Opens content in the editor of the surface running the current command
+     * and returns the edited result. The host installs a `localEdit` on its
+     * engine-side surface that calls this, so `edit` opens the operator's own
+     * editor and never one on the daemon host.
+     *
+     * @param content - The content to edit.
+     * @param extension - An optional filename extension for syntax mode.
+     * @returns The edited content and whether it changed.
+     * @throws {Error} When no command is executing or the surface disconnects.
+     */
+    edit_current(content, extension) {
+        const origin = this.currentOrigin;
+        if (!origin) {
+            return Promise.reject(new Error('no active command to edit for'));
+        }
+        const editId = `e${this.editSeq++}`;
+        return new Promise((resolve, reject) => {
+            this.pendingEdits.set(editId, resolve);
+            const onClose = () => {
+                if (this.pendingEdits.delete(editId)) {
+                    reject(new Error('surface disconnected before returning the edit'));
+                }
+            };
+            origin.socket.once('close', onClose);
+            this.send(origin.socket, { type: 'edit', editId, content, extension });
+        });
+    }
+    /**
+     * Resolves a pending edit with the surface's result.
+     *
+     * @param editId - The edit correlation id.
+     * @param outcome - The edited content and changed flag.
+     */
+    editResult_settle(editId, outcome) {
+        const resolve = this.pendingEdits.get(editId);
+        if (resolve) {
+            this.pendingEdits.delete(editId);
+            resolve(outcome);
+        }
+    }
+    /**
+     * Runs one completion request and sends its reply, or an error. Completion
+     * is a read and is not broadcast.
+     *
+     * @param socket - The surface to reply to.
+     * @param message - The completion request.
+     */
+    async complete_run(socket, message) {
+        try {
+            const result = await this.engine.line_complete(message.prefix);
+            this.send(socket, {
+                type: 'complete',
+                id: message.id,
+                prefix: result.prefix,
+                candidates: result.candidates,
+            });
+        }
+        catch (err) {
+            const reason = err instanceof Error ? err.message : String(err);
+            this.send(socket, { type: 'error', id: message.id, reason });
+        }
+    }
+    /**
+     * Sends a message to a surface if the socket is still open.
+     *
+     * @param socket - The destination surface.
+     * @param message - The message to send.
+     */
+    send(socket, message) {
+        if (socket.readyState === ws_1.WebSocket.OPEN) {
+            socket.send(JSON.stringify(message));
+        }
+    }
+}
+exports.CalypsoDaemon = CalypsoDaemon;
+//# sourceMappingURL=server.js.map

package/dist/daemon/server.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"server.js","sourceRoot":"","sources":["../../src/daemon/server.ts"],"names":[],"mappings":";;;AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,6CAA0C;AAE1C,2BAA8D;AAE9D,yCAA2C;AAC3C,uDAA0D;AAC1D,yDAA4E;AA0B5E,sEAAsE;AACtE,MAAM,kBAAkB,GAAW,GAAG,CAAC;AAwBvC;;;GAGG;AACH,MAAa,aAAa;IA2BxB;;;OAGG;IACH,YAAY,OAAsB;QAxBlC,uEAAuE;QACtD,cAAS,GAAW,IAAA,yBAAW,EAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QACnD,aAAQ,GAAiB,IAAI,GAAG,EAAW,CAAC;QAC5C,eAAU,GAAmB,EAAE,CAAC;QACzC,QAAG,GAA2B,IAAI,CAAC;QAC3C;;;;WAIG;QACK,UAAK,GAAkB,OAAO,CAAC,OAAO,EAAE,CAAC;QACzC,kBAAa,GAAmB,IAAI,CAAC;QACrC,cAAS,GAAkB,IAAI,CAAC;QACvB,mBAAc,GAA0C,IAAI,GAAG,EAAoC,CAAC;QAC7G,cAAS,GAAW,CAAC,CAAC;QACb,iBAAY,GAA0C,IAAI,GAAG,EAAoC,CAAC;QAC3G,YAAO,GAAW,CAAC,CAAC;QACX,iBAAY,GAA+C,IAAI,GAAG,EAAyC,CAAC;QACrH,YAAO,GAAW,CAAC,CAAC;QAO1B,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;QAC7B,IAAI,CAAC,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;QAC3B,IAAI,CAAC,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,CAAC,CAAC;QAC9B,IAAI,CAAC,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,WAAW,CAAC;QACxC,IAAI,CAAC,cAAc,GAAG,OAAO,CAAC,cAAc,IAAI,kBAAkB,CAAC;QACnE,IAAI,CAAC,cAAc,GAAG,OAAO,CAAC,cAAc,CAAC;IAC/C,CAAC;IAED;;;;OAIG;IACI,KAAK;QACV,OAAO,IAAI,OAAO,CAAC,CAAC,OAA+B,EAAE,MAA4B,EAAE,EAAE;YACnF,MAAM,GAAG,GAAoB,IAAI,oBAAe,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;YACvF,GAAG,CAAC,EAAE,CAAC,WAAW,EAAE,GAAG,EAAE,CAAC,OAAO,CAAE,GAAG,CAAC,OAAO,EAAkB,CAAC,IAAI,CAAC,CAAC,CAAC;YACxE,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YACxB,GAAG,CAAC,EAAE,CAAC,YAAY,EAAE,CAAC,MAAiB,EAAE,EAAE,CAAC,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC,CAAC;YAC5E,IAAI,CAAC,GAAG,GAAG,GAAG,CAAC;QACjB,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;;;OAIG;IACI,IAAI;QACT,OAAO,IAAI,OAAO,CAAC,CAAC,OAAmB,EAAE,EAAE;YACzC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC;gBACd,OAAO,EAAE,CAAC;gBACV,OAAO;YACT,CAAC;YACD,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC;gBACtC,MAAM,CAAC,SAAS,EAAE,CAAC;YACrB,CAAC;YACD,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC;YAChC,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC;QAClB,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;;;;OAKG;IACK,iBAAiB,CAAC,MAAiB;QACzC,IAAI,OAAO,GAAmB,IAAI,CAAC;QAEnC,MAAM,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC,IAAa,EAAE,EAAE;YACrC,IAAI,MAAe,CAAC;YACpB,IAAI,CAAC;gBACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC;YACvC,CAAC;YAAC,OAAO,GAAY,EAAE,CAAC;gBACtB,MAAM,OAAO,GAAW,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;gBACzE,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,mBAAmB,OAAO,EAAE,EAAE,CAAC,CAAC;gBAC3E,OAAO;YACT,CAAC;YAED,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,OAAO,GAAG,IAAI,CAAC,aAAa,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;gBAC7C,OAAO;YACT,CAAC;YAED,MAAM,OAAO,GAAG,IAAA,iCAAmB,EAAC,MAAM,CAAC,CAAC;YAC5C,IAAI,CAAC,OAAO,CAAC,EAAE,IAAI,OAAO,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;gBAC/C,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,iBAAiB,EAAE,CAAC,CAAC;gBACjF,OAAO;YACT,CAAC;YACD,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;YAC5B,MAAM,QAAQ,GAAY,OAAO,CAAC;YAClC,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;gBAC7B,mEAAmE;gBACnE,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,WAAW,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC;YACxE,CAAC;iBAAM,IAAI,KAAK,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;gBACrC,KAAK,IAAI,CAAC,YAAY,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;YACxC,CAAC;iBAAM,IAAI,KAAK,CAAC,IAAI,KAAK,cAAc,EAAE,CAAC;gBACzC,IAAI,CAAC,mBAAmB,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;YACzD,CAAC;iBAAM,IAAI,KAAK,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;gBACvC,IAAI,CAAC,iBAAiB,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;YACrD,CAAC;iBAAM,IAAI,KAAK,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;gBACvC,IAAI,CAAC,iBAAiB,CAAC,KAAK,CAAC,MAAM,EAAE,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;YAC3F,CAAC;iBAAM,CAAC;gBACN,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAC,CAAC;YACnE,CAAC;QACH,CAAC,CAAC,CAAC;QAEH,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;YACtB,IAAI,OAAO,EAAE,CAAC;gBACZ,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;YAChC,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;;;OASG;IACK,aAAa,CAAC,MAAiB,EAAE,GAAY;QACnD,MAAM,MAAM,GAAG,IAAA,0BAAY,EAAC,GAAG,CAAC,CAAC;QACjC,IAAI,CAAC,MAAM,CAAC,EAAE,IAAI,MAAM,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;YAC7C,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,KAAK,IAAI,gBAAgB,EAAE,CAAC,CAAC;YAC/E,MAAM,CAAC,KAAK,EAAE,CAAC;YACf,OAAO,IAAI,CAAC;QACd,CAAC;QACD,IAAI,CAAC,IAAA,wBAAa,EAAC,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;YACnD,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC,CAAC;YAC9D,MAAM,CAAC,KAAK,EAAE,CAAC;YACf,OAAO,IAAI,CAAC;QACd,CAAC;QACD,yEAAyE;QACzE,8CAA8C;QAC9C,MAAM,OAAO,GAAY,EAAE,MAAM,EAAE,EAAE,EAAE,IAAA,yBAAW,EAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACxE,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAC3B,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,IAAI,CAAC,SAAS,EAAE,eAAe,EAAE,6BAAgB,EAAE,CAAC,CAAC;QACpG,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC;QAC/B,uEAAuE;QACvE,KAAK,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC;QACnC,OAAO,OAAO,CAAC;IACjB,CAAC;IAED;;;;;;OAMG;IACK,KAAK,CAAC,eAAe,CAAC,MAAgB;QAC5C,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC;YACzB,OAAO;QACT,CAAC;QACD,MAAM,IAAI,GAAW,MAAM,IAAI,CAAC,cAAc,EAAE,CAAC;QACjD,IAAI,MAAM,EAAE,CAAC;YACX,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC;YACvD,OAAO;QACT,CAAC;QACD,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YACpC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC;QAC1D,CAAC;IACH,CAAC;IAED;;;;;OAKG;IACK,iBAAiB,CAAC,MAAiB;QACzC,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;YACpC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC;QAC3F,CAAC;IACH,CAAC;IAED;;;;;;;OAOG;IACK,WAAW,CAAC,MAAe,EAAE,QAAyB;QAC5D,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC;QACvD,IAAI,IAAI,CAAC,UAAU,CAAC,MAAM,GAAG,IAAI,CAAC,cAAc,EAAE,CAAC;YACjD,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,EAAE,IAAI,CAAC,UAAU,CAAC,MAAM,GAAG,IAAI,CAAC,cAAc,CAAC,CAAC;QAC1E,CAAC;QACD,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YACpC,IAAI,OAAO,KAAK,MAAM,EAAE,CAAC;gBACvB,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,CAAC,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC;YAC/E,CAAC;QACH,CAAC;IACH,CAAC;IAED;;;;;;OAMG;IACK,KAAK,CAAC,WAAW,CAAC,MAAe,EAAE,OAAuB;QAChE,yEAAyE;QACzE,wEAAwE;QACxE,IAAI,CAAC,aAAa,GAAG,MAAM,CAAC;QAC5B,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,EAAE,CAAC;QAC5B,IAAI,CAAC;YACH,MAAM,SAAS,GAAsB,MAAM,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YAClF,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,OAAO,CAAC,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC;YACxE,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;gBACjC,IAAI,CAAC,WAAW,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;YACrC,CAAC;QACH,CAAC;QAAC,OAAO,GAAY,EAAE,CAAC;YACtB,MAAM,MAAM,GAAW,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACxE,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,OAAO,CAAC,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;QACtE,CAAC;gBAAS,CAAC;YACT,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC;YAC1B,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC;QACxB,CAAC;QACD,2EAA2E;QAC3E,qCAAqC;QACrC,MAAM,IAAI,CAAC,eAAe,EAAE,CAAC;IAC/B,CAAC;IAED;;;;;;;;;;OAUG;IACI,cAAc,CAAC,OAAe,EAAE,MAAe;QACpD,MAAM,MAAM,GAAmB,IAAI,CAAC,aAAa,CAAC;QAClD,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC,CAAC;QACtE,CAAC;QACD,MAAM,QAAQ,GAAW,IAAI,IAAI,CAAC,SAAS,EAAE,EAAE,CAAC;QAChD,OAAO,IAAI,OAAO,CAAC,CAAC,OAAiC,EAAE,MAA4B,EAAE,EAAE;YACrF,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;YAC3C,MAAM,OAAO,GAAG,GAAS,EAAE;gBACzB,IAAI,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;oBACzC,MAAM,CAAC,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC,CAAC;gBAC7D,CAAC;YACH,CAAC,CAAC;YACF,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YACrC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC;QAC1E,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;OAOG;IACI,gBAAgB,CAAC,KAAoB;QAC1C,MAAM,MAAM,GAAmB,IAAI,CAAC,aAAa,CAAC;QAClD,MAAM,EAAE,GAAkB,IAAI,CAAC,SAAS,CAAC;QACzC,IAAI,CAAC,MAAM,IAAI,CAAC,EAAE,IAAI,MAAM,CAAC,MAAM,CAAC,UAAU,KAAK,cAAS,CAAC,IAAI,EAAE,CAAC;YAClE,OAAO,KAAK,CAAC;QACf,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,EAAE,EAAE,GAAG,KAAK,EAAE,CAAC,CAAC;QAC7D,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;;;;;;OAQG;IACI,cAAc,CAAC,OAAkC,EAAE,KAAa;QACrE,MAAM,MAAM,GAAmB,IAAI,CAAC,aAAa,CAAC;QAClD,MAAM,EAAE,GAAkB,IAAI,CAAC,SAAS,CAAC;QACzC,IAAI,CAAC,MAAM,IAAI,CAAC,EAAE,IAAI,MAAM,CAAC,MAAM,CAAC,UAAU,KAAK,cAAS,CAAC,IAAI,EAAE,CAAC;YAClE,OAAO,KAAK,CAAC;QACf,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;QACjE,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;;;OAKG;IACK,mBAAmB,CAAC,QAAgB,EAAE,MAAc;QAC1D,MAAM,OAAO,GAA2C,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC1F,IAAI,OAAO,EAAE,CAAC;YACZ,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YACrC,OAAO,CAAC,MAAM,CAAC,CAAC;QAClB,CAAC;IACH,CAAC;IAED;;;;;;;;;;OAUG;IACI,YAAY,CAAC,OAAe,EAAE,KAAa;QAChD,MAAM,MAAM,GAAmB,IAAI,CAAC,aAAa,CAAC;QAClD,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC,CAAC;QAClF,CAAC;QACD,MAAM,MAAM,GAAW,IAAI,IAAI,CAAC,OAAO,EAAE,EAAE,CAAC;QAC5C,OAAO,IAAI,OAAO,CAAC,CAAC,OAAiC,EAAE,MAA4B,EAAE,EAAE;YACrF,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;YACvC,MAAM,OAAO,GAAG,GAAS,EAAE;gBACzB,IAAI,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;oBACrC,MAAM,CAAC,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC,CAAC;gBACzE,CAAC;YACH,CAAC,CAAC;YACF,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YACrC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;QAC/F,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;;;;OAKG;IACK,iBAAiB,CAAC,MAAc,EAAE,MAAc;QACtD,MAAM,OAAO,GAA2C,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACtF,IAAI,OAAO,EAAE,CAAC;YACZ,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YACjC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC;QACzC,CAAC;IACH,CAAC;IAED;;;;;;;;;;OAUG;IACI,YAAY,CAAC,OAAe,EAAE,SAA6B;QAChE,MAAM,MAAM,GAAmB,IAAI,CAAC,aAAa,CAAC;QAClD,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC,CAAC;QACpE,CAAC;QACD,MAAM,MAAM,GAAW,IAAI,IAAI,CAAC,OAAO,EAAE,EAAE,CAAC;QAC5C,OAAO,IAAI,OAAO,CAAC,CAAC,OAAsC,EAAE,MAA4B,EAAE,EAAE;YAC1F,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;YACvC,MAAM,OAAO,GAAG,GAAS,EAAE;gBACzB,IAAI,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;oBACrC,MAAM,CAAC,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC,CAAC;gBACtE,CAAC;YACH,CAAC,CAAC;YACF,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YACrC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC,CAAC;QACzE,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;;;;OAKG;IACK,iBAAiB,CAAC,MAAc,EAAE,OAAoB;QAC5D,MAAM,OAAO,GAAgD,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC3F,IAAI,OAAO,EAAE,CAAC;YACZ,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YACjC,OAAO,CAAC,OAAO,CAAC,CAAC;QACnB,CAAC;IACH,CAAC;IAED;;;;;;OAMG;IACK,KAAK,CAAC,YAAY,CAAC,MAAiB,EAAE,OAAwB;QACpE,IAAI,CAAC;YACH,MAAM,MAAM,GAAqB,MAAM,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;YACjF,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE;gBAChB,IAAI,EAAE,UAAU;gBAChB,EAAE,EAAE,OAAO,CAAC,EAAE;gBACd,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,UAAU,EAAE,MAAM,CAAC,UAAU;aAC9B,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAY,EAAE,CAAC;YACtB,MAAM,MAAM,GAAW,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACxE,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,OAAO,CAAC,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;QAC/D,CAAC;IACH,CAAC;IAED;;;;;OAKG;IACK,IAAI,CAAC,MAAiB,EAAE,OAAsB;QACpD,IAAI,MAAM,CAAC,UAAU,KAAK,cAAS,CAAC,IAAI,EAAE,CAAC;YACzC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC;QACvC,CAAC;IACH,CAAC;CACF;AA3bD,sCA2bC"}

package/dist/daemon/token.d.ts

@@ -0,0 +1,24 @@
+/**
+ * Generates a fresh attach token: 256 bits of randomness, hex-encoded.
+ *
+ * @returns The token string.
+ */
+export declare function token_generate(): string;
+/**
+ * Writes the token to a file readable only by the current user (mode 0600),
+ * for same-user discovery.
+ *
+ * @param token - The token to write.
+ * @param path - The destination file path.
+ */
+export declare function token_writeFile(token: string, path: string): void;
+/**
+ * Compares a provided token against the expected one in constant time, so a
+ * mismatch reveals nothing through timing. Unequal lengths fail fast (and are
+ * not themselves secret).
+ *
+ * @param expected - The daemon's token.
+ * @param provided - The token a surface presented at attach.
+ * @returns True when the tokens match exactly.
+ */
+export declare function token_matches(expected: string, provided: string): boolean;

package/dist/daemon/token.js

@@ -0,0 +1,56 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.token_generate = token_generate;
+exports.token_writeFile = token_writeFile;
+exports.token_matches = token_matches;
+/**
+ * @file The attach token: generation, discovery file, and constant-time
+ * comparison.
+ *
+ * The daemon's attach perimeter is the proven local-daemon model: a random
+ * token generated at startup, required in every attach handshake, compared in
+ * constant time. The token is printed and written to a user-readable file so
+ * a same-user surface can discover it without it crossing an untrusted
+ * channel. Remote access is an operator concern (an SSH tunnel or TLS proxy
+ * in front, with the token still gating attach inside it).
+ *
+ * @module
+ */
+const node_crypto_1 = require("node:crypto");
+const node_fs_1 = require("node:fs");
+/**
+ * Generates a fresh attach token: 256 bits of randomness, hex-encoded.
+ *
+ * @returns The token string.
+ */
+function token_generate() {
+    return (0, node_crypto_1.randomBytes)(32).toString('hex');
+}
+/**
+ * Writes the token to a file readable only by the current user (mode 0600),
+ * for same-user discovery.
+ *
+ * @param token - The token to write.
+ * @param path - The destination file path.
+ */
+function token_writeFile(token, path) {
+    (0, node_fs_1.writeFileSync)(path, `${token}\n`, { mode: 0o600 });
+}
+/**
+ * Compares a provided token against the expected one in constant time, so a
+ * mismatch reveals nothing through timing. Unequal lengths fail fast (and are
+ * not themselves secret).
+ *
+ * @param expected - The daemon's token.
+ * @param provided - The token a surface presented at attach.
+ * @returns True when the tokens match exactly.
+ */
+function token_matches(expected, provided) {
+    const expectedBytes = Buffer.from(expected, 'utf-8');
+    const providedBytes = Buffer.from(provided, 'utf-8');
+    if (expectedBytes.length !== providedBytes.length) {
+        return false;
+    }
+    return (0, node_crypto_1.timingSafeEqual)(expectedBytes, providedBytes);
+}
+//# sourceMappingURL=token.js.map

package/dist/daemon/token.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"token.js","sourceRoot":"","sources":["../../src/daemon/token.ts"],"names":[],"mappings":";;AAqBA,wCAEC;AASD,0CAEC;AAWD,sCAOC;AApDD;;;;;;;;;;;;GAYG;AACH,6CAA2D;AAC3D,qCAAwC;AAExC;;;;GAIG;AACH,SAAgB,cAAc;IAC5B,OAAO,IAAA,yBAAW,EAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AACzC,CAAC;AAED;;;;;;GAMG;AACH,SAAgB,eAAe,CAAC,KAAa,EAAE,IAAY;IACzD,IAAA,uBAAa,EAAC,IAAI,EAAE,GAAG,KAAK,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;AACrD,CAAC;AAED;;;;;;;;GAQG;AACH,SAAgB,aAAa,CAAC,QAAgB,EAAE,QAAgB;IAC9D,MAAM,aAAa,GAAW,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IAC7D,MAAM,aAAa,GAAW,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IAC7D,IAAI,aAAa,CAAC,MAAM,KAAK,aAAa,CAAC,MAAM,EAAE,CAAC;QAClD,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,IAAA,6BAAe,EAAC,aAAa,EAAE,aAAa,CAAC,CAAC;AACvD,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,19 @@
+/**
+ * @file The CALYPSO wire contract: public surface.
+ *
+ * calypso is the fifth mise package: the session daemon that hosts a chell
+ * engine and serves it to surfaces over a WebSocket. This first slice is the
+ * wire contract — the typed protocol schemas and the boundary validation
+ * that every message crosses. The daemon, session bus, and remote client
+ * build on it.
+ *
+ * @see docs/calypso.adoc for the governing design.
+ * @module
+ */
+export { CONTRACT_VERSION, version_isCompatible } from './protocol/version.js';
+export { envelopeStatusSchema, stackMessageSchema, envelopeModelSchema, resolutionTraceSchema, commandEnvelopeSchema, type WireEnvelope, } from './protocol/envelope.js';
+export { channelSchema, attachMessageSchema, executeMessageSchema, completeRequestSchema, clientMessageSchema, attachedMessageSchema, resultMessageSchema, completeReplySchema, outputMessageSchema, progressOperationSchema, progressKindSchema, progressPhaseSchema, progressUnitSchema, progressStatusSchema, progressMessageSchema, sessionMessageSchema, errorMessageSchema, serverMessageSchema, type ClientMessage, type ProgressEvent, type ServerMessage, } from './protocol/messages.js';
+export { clientMessage_parse, serverMessage_parse, clientMessage_fromJson, attach_parse, type ParseResult, } from './protocol/validate.js';
+export { type HostedEngine, type CompletionResult } from './daemon/engine.js';
+export { token_generate, token_writeFile, token_matches } from './daemon/token.js';
+export { CalypsoDaemon, type DaemonOptions, type EditOutcome } from './daemon/server.js';

package/dist/index.js

@@ -0,0 +1,55 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CalypsoDaemon = exports.token_matches = exports.token_writeFile = exports.token_generate = exports.attach_parse = exports.clientMessage_fromJson = exports.serverMessage_parse = exports.clientMessage_parse = exports.serverMessageSchema = exports.errorMessageSchema = exports.sessionMessageSchema = exports.progressMessageSchema = exports.progressStatusSchema = exports.progressUnitSchema = exports.progressPhaseSchema = exports.progressKindSchema = exports.progressOperationSchema = exports.outputMessageSchema = exports.completeReplySchema = exports.resultMessageSchema = exports.attachedMessageSchema = exports.clientMessageSchema = exports.completeRequestSchema = exports.executeMessageSchema = exports.attachMessageSchema = exports.channelSchema = exports.commandEnvelopeSchema = exports.resolutionTraceSchema = exports.envelopeModelSchema = exports.stackMessageSchema = exports.envelopeStatusSchema = exports.version_isCompatible = exports.CONTRACT_VERSION = void 0;
+/**
+ * @file The CALYPSO wire contract: public surface.
+ *
+ * calypso is the fifth mise package: the session daemon that hosts a chell
+ * engine and serves it to surfaces over a WebSocket. This first slice is the
+ * wire contract — the typed protocol schemas and the boundary validation
+ * that every message crosses. The daemon, session bus, and remote client
+ * build on it.
+ *
+ * @see docs/calypso.adoc for the governing design.
+ * @module
+ */
+var version_js_1 = require("./protocol/version.js");
+Object.defineProperty(exports, "CONTRACT_VERSION", { enumerable: true, get: function () { return version_js_1.CONTRACT_VERSION; } });
+Object.defineProperty(exports, "version_isCompatible", { enumerable: true, get: function () { return version_js_1.version_isCompatible; } });
+var envelope_js_1 = require("./protocol/envelope.js");
+Object.defineProperty(exports, "envelopeStatusSchema", { enumerable: true, get: function () { return envelope_js_1.envelopeStatusSchema; } });
+Object.defineProperty(exports, "stackMessageSchema", { enumerable: true, get: function () { return envelope_js_1.stackMessageSchema; } });
+Object.defineProperty(exports, "envelopeModelSchema", { enumerable: true, get: function () { return envelope_js_1.envelopeModelSchema; } });
+Object.defineProperty(exports, "resolutionTraceSchema", { enumerable: true, get: function () { return envelope_js_1.resolutionTraceSchema; } });
+Object.defineProperty(exports, "commandEnvelopeSchema", { enumerable: true, get: function () { return envelope_js_1.commandEnvelopeSchema; } });
+var messages_js_1 = require("./protocol/messages.js");
+Object.defineProperty(exports, "channelSchema", { enumerable: true, get: function () { return messages_js_1.channelSchema; } });
+Object.defineProperty(exports, "attachMessageSchema", { enumerable: true, get: function () { return messages_js_1.attachMessageSchema; } });
+Object.defineProperty(exports, "executeMessageSchema", { enumerable: true, get: function () { return messages_js_1.executeMessageSchema; } });
+Object.defineProperty(exports, "completeRequestSchema", { enumerable: true, get: function () { return messages_js_1.completeRequestSchema; } });
+Object.defineProperty(exports, "clientMessageSchema", { enumerable: true, get: function () { return messages_js_1.clientMessageSchema; } });
+Object.defineProperty(exports, "attachedMessageSchema", { enumerable: true, get: function () { return messages_js_1.attachedMessageSchema; } });
+Object.defineProperty(exports, "resultMessageSchema", { enumerable: true, get: function () { return messages_js_1.resultMessageSchema; } });
+Object.defineProperty(exports, "completeReplySchema", { enumerable: true, get: function () { return messages_js_1.completeReplySchema; } });
+Object.defineProperty(exports, "outputMessageSchema", { enumerable: true, get: function () { return messages_js_1.outputMessageSchema; } });
+Object.defineProperty(exports, "progressOperationSchema", { enumerable: true, get: function () { return messages_js_1.progressOperationSchema; } });
+Object.defineProperty(exports, "progressKindSchema", { enumerable: true, get: function () { return messages_js_1.progressKindSchema; } });
+Object.defineProperty(exports, "progressPhaseSchema", { enumerable: true, get: function () { return messages_js_1.progressPhaseSchema; } });
+Object.defineProperty(exports, "progressUnitSchema", { enumerable: true, get: function () { return messages_js_1.progressUnitSchema; } });
+Object.defineProperty(exports, "progressStatusSchema", { enumerable: true, get: function () { return messages_js_1.progressStatusSchema; } });
+Object.defineProperty(exports, "progressMessageSchema", { enumerable: true, get: function () { return messages_js_1.progressMessageSchema; } });
+Object.defineProperty(exports, "sessionMessageSchema", { enumerable: true, get: function () { return messages_js_1.sessionMessageSchema; } });
+Object.defineProperty(exports, "errorMessageSchema", { enumerable: true, get: function () { return messages_js_1.errorMessageSchema; } });
+Object.defineProperty(exports, "serverMessageSchema", { enumerable: true, get: function () { return messages_js_1.serverMessageSchema; } });
+var validate_js_1 = require("./protocol/validate.js");
+Object.defineProperty(exports, "clientMessage_parse", { enumerable: true, get: function () { return validate_js_1.clientMessage_parse; } });
+Object.defineProperty(exports, "serverMessage_parse", { enumerable: true, get: function () { return validate_js_1.serverMessage_parse; } });
+Object.defineProperty(exports, "clientMessage_fromJson", { enumerable: true, get: function () { return validate_js_1.clientMessage_fromJson; } });
+Object.defineProperty(exports, "attach_parse", { enumerable: true, get: function () { return validate_js_1.attach_parse; } });
+var token_js_1 = require("./daemon/token.js");
+Object.defineProperty(exports, "token_generate", { enumerable: true, get: function () { return token_js_1.token_generate; } });
+Object.defineProperty(exports, "token_writeFile", { enumerable: true, get: function () { return token_js_1.token_writeFile; } });
+Object.defineProperty(exports, "token_matches", { enumerable: true, get: function () { return token_js_1.token_matches; } });
+var server_js_1 = require("./daemon/server.js");
+Object.defineProperty(exports, "CalypsoDaemon", { enumerable: true, get: function () { return server_js_1.CalypsoDaemon; } });
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;AAAA;;;;;;;;;;;GAWG;AACH,oDAA+E;AAAtE,8GAAA,gBAAgB,OAAA;AAAE,kHAAA,oBAAoB,OAAA;AAC/C,sDAOgC;AAN9B,mHAAA,oBAAoB,OAAA;AACpB,iHAAA,kBAAkB,OAAA;AAClB,kHAAA,mBAAmB,OAAA;AACnB,oHAAA,qBAAqB,OAAA;AACrB,oHAAA,qBAAqB,OAAA;AAGvB,sDAsBgC;AArB9B,4GAAA,aAAa,OAAA;AACb,kHAAA,mBAAmB,OAAA;AACnB,mHAAA,oBAAoB,OAAA;AACpB,oHAAA,qBAAqB,OAAA;AACrB,kHAAA,mBAAmB,OAAA;AACnB,oHAAA,qBAAqB,OAAA;AACrB,kHAAA,mBAAmB,OAAA;AACnB,kHAAA,mBAAmB,OAAA;AACnB,kHAAA,mBAAmB,OAAA;AACnB,sHAAA,uBAAuB,OAAA;AACvB,iHAAA,kBAAkB,OAAA;AAClB,kHAAA,mBAAmB,OAAA;AACnB,iHAAA,kBAAkB,OAAA;AAClB,mHAAA,oBAAoB,OAAA;AACpB,oHAAA,qBAAqB,OAAA;AACrB,mHAAA,oBAAoB,OAAA;AACpB,iHAAA,kBAAkB,OAAA;AAClB,kHAAA,mBAAmB,OAAA;AAKrB,sDAMgC;AAL9B,kHAAA,mBAAmB,OAAA;AACnB,kHAAA,mBAAmB,OAAA;AACnB,qHAAA,sBAAsB,OAAA;AACtB,2GAAA,YAAY,OAAA;AAId,8CAAmF;AAA1E,0GAAA,cAAc,OAAA;AAAE,2GAAA,eAAe,OAAA;AAAE,yGAAA,aAAa,OAAA;AACvD,gDAAyF;AAAhF,0GAAA,aAAa,OAAA"}