@hansjm10/volt-coding-agent 0.0.0-bootstrap.0 → 0.1.0

package/dist/core/remote/iroh/engine.d.ts

@@ -0,0 +1,148 @@
+import type { IrohBiStreamLike, IrohBytes, IrohRecvStreamLike } from "../../rpc/index.ts";
+import { type IrohRemoteRpcGrant } from "./access-grant.ts";
+import { IrohRemoteAuditLogger } from "./audit.ts";
+import { type IrohRemoteClientAuthorizationResult, type IrohRemoteClientAuthorizationSuccess } from "./authorization.ts";
+import { type IrohRemoteConversationSelection, type IrohRemoteHandshakeFailure, type IrohRemoteHandshakeResponse, type IrohRemoteHandshakeSuccess, type IrohRemoteHello } from "./handshake.ts";
+import { type IrohRemoteHandshakeLineReadOptions } from "./handshake-reader.ts";
+import { type IrohRemoteRelayMode } from "./protocol.ts";
+import { type IrohRemoteClient, type IrohRemoteWorkspace } from "./state.ts";
+import type { IrohRemoteClientAccessUpdateResult, IrohRemoteClientRePairApprovalResult, IrohRemoteClientRevocationResult, IrohRemoteHostStateManager } from "./state-manager.ts";
+import { type IrohRemoteTicketPayload } from "./ticket.ts";
+import { type IrohRemoteWorkspaceAvailabilityClassifier } from "./workspace.ts";
+export declare const DEFAULT_IROH_REMOTE_PAIRING_TICKET_TTL_MS: number;
+export interface IrohRemoteHostEngineOptions {
+    allowTools?: string;
+    rpcGrant?: IrohRemoteRpcGrant;
+    auditLogger?: IrohRemoteAuditLogger;
+    hostNodeId?: string;
+    now?: () => number;
+    pairingExpiresAt?: number;
+    pairingSecret?: string;
+    relayMode?: IrohRemoteRelayMode;
+    relayUrls?: string[];
+    stateManager: IrohRemoteHostStateManager;
+    classifyWorkspaceAvailability?: IrohRemoteWorkspaceAvailabilityClassifier;
+    validateWorkspace?: (workspace: IrohRemoteWorkspace) => boolean | Promise<boolean>;
+    workspace: IrohRemoteWorkspace;
+}
+export interface IrohRemoteHostPairOptions {
+    allowTools?: string;
+    rpcGrant?: IrohRemoteRpcGrant;
+    expiresAt?: number;
+    irohTicket: string;
+    labelHint?: string;
+    nodeId?: string;
+    relayMode?: IrohRemoteRelayMode;
+    relayUrls?: string[];
+    relayAuthToken?: string;
+    secret?: string;
+    ttlMs?: number;
+    workspace?: string;
+}
+export interface IrohRemotePairingTicket {
+    expiresAt: number;
+    payload: IrohRemoteTicketPayload;
+    secret: string;
+    ticket: string;
+}
+export type IrohRemoteHostHandshakeResult = {
+    ok: true;
+    authorization: IrohRemoteClientAuthorizationSuccess;
+    hello: IrohRemoteHello;
+    initialInput: IrohBytes;
+    response: IrohRemoteHandshakeSuccess;
+    responseWritten: boolean;
+    responseWriteError?: string;
+} | {
+    ok: false;
+    error: string;
+    initialInput: IrohBytes;
+    response: IrohRemoteHandshakeFailure;
+    responseWritten: boolean;
+    responseWriteError?: string;
+};
+export interface IrohRemoteHostReadHandshakeOptions extends IrohRemoteHandshakeLineReadOptions {
+    child?: string;
+    conversationSession?: {
+        selection: IrohRemoteConversationSelection;
+        sessionId: string;
+        requestedSessionId?: string;
+    };
+    writeSuccessResponse?: boolean;
+}
+export interface IrohRemoteClientEngineOptions {
+    auditLogger?: IrohRemoteAuditLogger;
+    clientLabel?: string;
+    clientNodeId?: string;
+    now?: () => number;
+}
+export interface IrohRemoteClientTicketHello {
+    hello: IrohRemoteHello;
+    payload: IrohRemoteTicketPayload;
+}
+export interface IrohRemoteClientHandshakeResponseResult {
+    initialInput: IrohBytes;
+    response: IrohRemoteHandshakeResponse;
+}
+export interface IrohRemoteClientReadHandshakeResponseOptions extends IrohRemoteHandshakeLineReadOptions {
+    expectedHostNodeId?: string;
+}
+export declare class IrohRemoteHostEngine {
+    private readonly auditLogger;
+    private readonly classifyWorkspaceAvailability;
+    private readonly hostNodeId;
+    private readonly relayMode;
+    private readonly relayUrls;
+    private readonly now;
+    private readonly stateManager;
+    private readonly validateWorkspace;
+    private readonly workspace;
+    private authorizationQueue;
+    private allowTools;
+    private rpcGrant;
+    private pairingAllowTools;
+    private pairingRpcGrant;
+    private pairingExpiresAt;
+    private pairingSecret;
+    private pairingWorkspaceName;
+    constructor(options: IrohRemoteHostEngineOptions);
+    pair(options: IrohRemoteHostPairOptions): Promise<IrohRemotePairingTicket>;
+    listClients(): Promise<IrohRemoteClient[]>;
+    revokeClient(nodeId: string): Promise<IrohRemoteClientRevocationResult>;
+    updateClientAccess(nodeId: string, expectedRevision: number, access: {
+        allowedTools: string;
+        rpcGrant: IrohRemoteRpcGrant;
+    }): Promise<IrohRemoteClientAccessUpdateResult>;
+    approveClientRePair(nodeId: string): Promise<IrohRemoteClientRePairApprovalResult>;
+    setClientLastSessionId(nodeId: string, workspace: string, sessionId: string): Promise<IrohRemoteClient | undefined>;
+    authorizeHello(hello: IrohRemoteHello, remoteNodeId: string): Promise<IrohRemoteClientAuthorizationResult>;
+    private ensurePrimaryWorkspaceRegistered;
+    private resolvePairWorkspace;
+    private authorizeHelloUnlocked;
+    private runAuthorizationExclusive;
+    readHandshake(stream: IrohBiStreamLike, remoteNodeId: string, options?: IrohRemoteHostReadHandshakeOptions): Promise<IrohRemoteHostHandshakeResult>;
+    setAllowTools(allowTools: string): void;
+    clearPairingSecretForWorkspace(workspaceName: string): boolean;
+    cancelPairingSecretByHash(secretHash: string): Promise<boolean>;
+    private ensureRuntimePairingWorkspaceRegistered;
+    private clearPairingSecret;
+    private createHandshakeFailure;
+    private createHandshakeSuccessResponse;
+    private writeHandshakeResult;
+    private logPairingTicketLifecycle;
+    private logAuthorization;
+    private log;
+}
+export declare class IrohRemoteClientEngine {
+    private readonly auditLogger;
+    private readonly clientLabel;
+    private readonly clientNodeId;
+    private readonly now;
+    constructor(options?: IrohRemoteClientEngineOptions);
+    createHelloFromTicket(ticket: string): Promise<IrohRemoteClientTicketHello>;
+    createHello(payload: IrohRemoteTicketPayload): IrohRemoteHello;
+    writeHello(stream: IrohBiStreamLike, payload: IrohRemoteTicketPayload): Promise<IrohRemoteHello>;
+    readHandshakeResponse(recv: IrohRecvStreamLike, options?: IrohRemoteClientReadHandshakeResponseOptions): Promise<IrohRemoteClientHandshakeResponseResult>;
+    private log;
+}
+//# sourceMappingURL=engine.d.ts.map

package/dist/core/remote/iroh/engine.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"engine.d.ts","sourceRoot":"","sources":["../../../../src/core/remote/iroh/engine.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,gBAAgB,EAAE,SAAS,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AAC1F,OAAO,EAAyD,KAAK,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AACnH,OAAO,EAAkC,qBAAqB,EAAE,MAAM,YAAY,CAAC;AACnF,OAAO,EAEN,KAAK,mCAAmC,EACxC,KAAK,oCAAoC,EACzC,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAKN,KAAK,+BAA+B,EAEpC,KAAK,0BAA0B,EAC/B,KAAK,2BAA2B,EAChC,KAAK,0BAA0B,EAC/B,KAAK,eAAe,EAGpB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACN,KAAK,kCAAkC,EAIvC,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EAIN,KAAK,mBAAmB,EAExB,MAAM,eAAe,CAAC;AACvB,OAAO,EACN,KAAK,gBAAgB,EAErB,KAAK,mBAAmB,EAExB,MAAM,YAAY,CAAC;AACpB,OAAO,KAAK,EACX,kCAAkC,EAClC,oCAAoC,EACpC,gCAAgC,EAChC,0BAA0B,EAC1B,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAIN,KAAK,uBAAuB,EAC5B,MAAM,aAAa,CAAC;AACrB,OAAO,EAA2B,KAAK,yCAAyC,EAAE,MAAM,gBAAgB,CAAC;AAEzG,eAAO,MAAM,yCAAyC,QAAiB,CAAC;AAExE,MAAM,WAAW,2BAA2B;IAC3C,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,kBAAkB,CAAC;IAC9B,WAAW,CAAC,EAAE,qBAAqB,CAAC;IACpC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,SAAS,CAAC,EAAE,mBAAmB,CAAC;IAChC,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;IACrB,YAAY,EAAE,0BAA0B,CAAC;IACzC,6BAA6B,CAAC,EAAE,yCAAyC,CAAC;IAC1E,iBAAiB,CAAC,EAAE,CAAC,SAAS,EAAE,mBAAmB,KAAK,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACnF,SAAS,EAAE,mBAAmB,CAAC;CAC/B;AAED,MAAM,WAAW,yBAAyB;IACzC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,kBAAkB,CAAC;IAC9B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,mBAAmB,CAAC;IAChC,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;IACrB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,uBAAuB;IACvC,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,uBAAuB,CAAC;IACjC,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;CACf;AAED,MAAM,MAAM,6BAA6B,GACtC;IACA,EAAE,EAAE,IAAI,CAAC;IACT,aAAa,EAAE,oCAAoC,CAAC;IACpD,KAAK,EAAE,eAAe,CAAC;IACvB,YAAY,EAAE,SAAS,CAAC;IACxB,QAAQ,EAAE,0BAA0B,CAAC;IACrC,eAAe,EAAE,OAAO,CAAC;IACzB,kBAAkB,CAAC,EAAE,MAAM,CAAC;CAC3B,GACD;IACA,EAAE,EAAE,KAAK,CAAC;IACV,KAAK,EAAE,MAAM,CAAC;IACd,YAAY,EAAE,SAAS,CAAC;IACxB,QAAQ,EAAE,0BAA0B,CAAC;IACrC,eAAe,EAAE,OAAO,CAAC;IACzB,kBAAkB,CAAC,EAAE,MAAM,CAAC;CAC3B,CAAC;AAEL,MAAM,WAAW,kCAAmC,SAAQ,kCAAkC;IAC7F,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,mBAAmB,CAAC,EAAE;QACrB,SAAS,EAAE,+BAA+B,CAAC;QAC3C,SAAS,EAAE,MAAM,CAAC;QAClB,kBAAkB,CAAC,EAAE,MAAM,CAAC;KAC5B,CAAC;IACF,oBAAoB,CAAC,EAAE,OAAO,CAAC;CAC/B;AAED,MAAM,WAAW,6BAA6B;IAC7C,WAAW,CAAC,EAAE,qBAAqB,CAAC;IACpC,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,2BAA2B;IAC3C,KAAK,EAAE,eAAe,CAAC;IACvB,OAAO,EAAE,uBAAuB,CAAC;CACjC;AAED,MAAM,WAAW,uCAAuC;IACvD,YAAY,EAAE,SAAS,CAAC;IACxB,QAAQ,EAAE,2BAA2B,CAAC;CACtC;AAED,MAAM,WAAW,4CAA6C,SAAQ,kCAAkC;IACvG,kBAAkB,CAAC,EAAE,MAAM,CAAC;CAC5B;AA6BD,qBAAa,oBAAoB;IAChC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAwB;IACpD,OAAO,CAAC,QAAQ,CAAC,6BAA6B,CAAwD;IACtG,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAqB;IAChD,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAkC;IAC5D,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAuB;IACjD,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAe;IACnC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAA6B;IAC1D,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAA+E;IACjH,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAsB;IAChD,OAAO,CAAC,kBAAkB,CAAoC;IAC9D,OAAO,CAAC,UAAU,CAAS;IAC3B,OAAO,CAAC,QAAQ,CAAqB;IACrC,OAAO,CAAC,iBAAiB,CAAqB;IAC9C,OAAO,CAAC,eAAe,CAAiC;IACxD,OAAO,CAAC,gBAAgB,CAAqB;IAC7C,OAAO,CAAC,aAAa,CAAqB;IAC1C,OAAO,CAAC,oBAAoB,CAAqB;IAEjD,YAAY,OAAO,EAAE,2BAA2B,EAgB/C;IAEK,IAAI,CAAC,OAAO,EAAE,yBAAyB,GAAG,OAAO,CAAC,uBAAuB,CAAC,CAuD/E;IAEK,WAAW,IAAI,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAI/C;IAEK,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,gCAAgC,CAAC,CAS5E;IAEK,kBAAkB,CACvB,MAAM,EAAE,MAAM,EACd,gBAAgB,EAAE,MAAM,EACxB,MAAM,EAAE;QAAE,YAAY,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,kBAAkB,CAAA;KAAE,GAC5D,OAAO,CAAC,kCAAkC,CAAC,CAiB7C;IAEK,mBAAmB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,oCAAoC,CAAC,CASvF;IAEK,sBAAsB,CAC3B,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,MAAM,EACjB,SAAS,EAAE,MAAM,GACf,OAAO,CAAC,gBAAgB,GAAG,SAAS,CAAC,CAEvC;IAEK,cAAc,CAAC,KAAK,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,mCAAmC,CAAC,CAE/G;YAEa,gCAAgC;YAShC,oBAAoB;YAiBpB,sBAAsB;IAkCpC,OAAO,CAAC,yBAAyB;IAS3B,aAAa,CAClB,MAAM,EAAE,gBAAgB,EACxB,YAAY,EAAE,MAAM,EACpB,OAAO,GAAE,kCAAuC,GAC9C,OAAO,CAAC,6BAA6B,CAAC,CAkDxC;IAED,aAAa,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAEtC;IAED,8BAA8B,CAAC,aAAa,EAAE,MAAM,GAAG,OAAO,CAM7D;IAEK,yBAAyB,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAQpE;YAEa,uCAAuC;IAerD,OAAO,CAAC,kBAAkB;YAQZ,sBAAsB;IAyBpC,OAAO,CAAC,8BAA8B;YAgDxB,oBAAoB;YAiBpB,yBAAyB;YAqCzB,gBAAgB;YAiBhB,GAAG;CAcjB;AAED,qBAAa,sBAAsB;IAClC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAwB;IACpD,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAqB;IACjD,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAqB;IAClD,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAe;IAEnC,YAAY,OAAO,GAAE,6BAAkC,EAKtD;IAEK,qBAAqB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,2BAA2B,CAAC,CAUhF;IAED,WAAW,CAAC,OAAO,EAAE,uBAAuB,GAAG,eAAe,CAW7D;IAEK,UAAU,CAAC,MAAM,EAAE,gBAAgB,EAAE,OAAO,EAAE,uBAAuB,GAAG,OAAO,CAAC,eAAe,CAAC,CASrG;IAEK,qBAAqB,CAC1B,IAAI,EAAE,kBAAkB,EACxB,OAAO,GAAE,4CAAiD,GACxD,OAAO,CAAC,uCAAuC,CAAC,CAelD;YAEa,GAAG;CAOjB","sourcesContent":["import { Buffer } from \"node:buffer\";\nimport { randomBytes } from \"node:crypto\";\nimport type { IrohBiStreamLike, IrohBytes, IrohRecvStreamLike } from \"../../rpc/index.ts\";\nimport { cloneIrohRemoteRpcGrant, createIrohRemotePresetAccess, type IrohRemoteRpcGrant } from \"./access-grant.ts\";\nimport { type IrohRemoteAuditEventInput, IrohRemoteAuditLogger } from \"./audit.ts\";\nimport {\n\thashIrohRemotePairingSecret,\n\ttype IrohRemoteClientAuthorizationResult,\n\ttype IrohRemoteClientAuthorizationSuccess,\n} from \"./authorization.ts\";\nimport {\n\tassertIrohRemoteHandshakeHostIdentity,\n\tcreateIrohRemoteHandshakeFailure,\n\tcreateIrohRemoteHandshakeSuccess,\n\ttype IrohRemoteConversationHandshakeMetadata,\n\ttype IrohRemoteConversationSelection,\n\tIrohRemoteHandshakeError,\n\ttype IrohRemoteHandshakeFailure,\n\ttype IrohRemoteHandshakeResponse,\n\ttype IrohRemoteHandshakeSuccess,\n\ttype IrohRemoteHello,\n\tparseIrohRemoteHandshakeResponseLine,\n\tparseIrohRemoteHelloLine,\n} from \"./handshake.ts\";\nimport {\n\ttype IrohRemoteHandshakeLineReadOptions,\n\treadIrohRemoteHandshakeLine,\n\twriteIrohRemoteHandshakeResponse,\n\twriteIrohRemoteHello,\n} from \"./handshake-reader.ts\";\nimport { createIrohRemoteHostMetadata } from \"./metadata.ts\";\nimport {\n\tDEFAULT_IROH_REMOTE_ALLOW_TOOLS,\n\tIROH_REMOTE_ALPN,\n\tIROH_REMOTE_HOST_FEATURES,\n\ttype IrohRemoteRelayMode,\n\tnormalizeIrohRemoteAllowTools,\n} from \"./protocol.ts\";\nimport {\n\ttype IrohRemoteClient,\n\ttype IrohRemoteHostState,\n\ttype IrohRemoteWorkspace,\n\tparseIrohRemoteWorkspace,\n} from \"./state.ts\";\nimport type {\n\tIrohRemoteClientAccessUpdateResult,\n\tIrohRemoteClientRePairApprovalResult,\n\tIrohRemoteClientRevocationResult,\n\tIrohRemoteHostStateManager,\n} from \"./state-manager.ts\";\nimport {\n\tassertIrohRemoteTicketNotExpired,\n\tdecodeIrohRemoteTicketPayload,\n\tencodeIrohRemoteTicketPayload,\n\ttype IrohRemoteTicketPayload,\n} from \"./ticket.ts\";\nimport { findIrohRemoteWorkspace, type IrohRemoteWorkspaceAvailabilityClassifier } from \"./workspace.ts\";\n\nexport const DEFAULT_IROH_REMOTE_PAIRING_TICKET_TTL_MS = 10 * 60 * 1000;\n\nexport interface IrohRemoteHostEngineOptions {\n\tallowTools?: string;\n\trpcGrant?: IrohRemoteRpcGrant;\n\tauditLogger?: IrohRemoteAuditLogger;\n\thostNodeId?: string;\n\tnow?: () => number;\n\tpairingExpiresAt?: number;\n\tpairingSecret?: string;\n\trelayMode?: IrohRemoteRelayMode;\n\trelayUrls?: string[];\n\tstateManager: IrohRemoteHostStateManager;\n\tclassifyWorkspaceAvailability?: IrohRemoteWorkspaceAvailabilityClassifier;\n\tvalidateWorkspace?: (workspace: IrohRemoteWorkspace) => boolean | Promise<boolean>;\n\tworkspace: IrohRemoteWorkspace;\n}\n\nexport interface IrohRemoteHostPairOptions {\n\tallowTools?: string;\n\trpcGrant?: IrohRemoteRpcGrant;\n\texpiresAt?: number;\n\tirohTicket: string;\n\tlabelHint?: string;\n\tnodeId?: string;\n\trelayMode?: IrohRemoteRelayMode;\n\trelayUrls?: string[];\n\trelayAuthToken?: string;\n\tsecret?: string;\n\tttlMs?: number;\n\tworkspace?: string;\n}\n\nexport interface IrohRemotePairingTicket {\n\texpiresAt: number;\n\tpayload: IrohRemoteTicketPayload;\n\tsecret: string;\n\tticket: string;\n}\n\nexport type IrohRemoteHostHandshakeResult =\n\t| {\n\t\t\tok: true;\n\t\t\tauthorization: IrohRemoteClientAuthorizationSuccess;\n\t\t\thello: IrohRemoteHello;\n\t\t\tinitialInput: IrohBytes;\n\t\t\tresponse: IrohRemoteHandshakeSuccess;\n\t\t\tresponseWritten: boolean;\n\t\t\tresponseWriteError?: string;\n\t  }\n\t| {\n\t\t\tok: false;\n\t\t\terror: string;\n\t\t\tinitialInput: IrohBytes;\n\t\t\tresponse: IrohRemoteHandshakeFailure;\n\t\t\tresponseWritten: boolean;\n\t\t\tresponseWriteError?: string;\n\t  };\n\nexport interface IrohRemoteHostReadHandshakeOptions extends IrohRemoteHandshakeLineReadOptions {\n\tchild?: string;\n\tconversationSession?: {\n\t\tselection: IrohRemoteConversationSelection;\n\t\tsessionId: string;\n\t\trequestedSessionId?: string;\n\t};\n\twriteSuccessResponse?: boolean;\n}\n\nexport interface IrohRemoteClientEngineOptions {\n\tauditLogger?: IrohRemoteAuditLogger;\n\tclientLabel?: string;\n\tclientNodeId?: string;\n\tnow?: () => number;\n}\n\nexport interface IrohRemoteClientTicketHello {\n\thello: IrohRemoteHello;\n\tpayload: IrohRemoteTicketPayload;\n}\n\nexport interface IrohRemoteClientHandshakeResponseResult {\n\tinitialInput: IrohBytes;\n\tresponse: IrohRemoteHandshakeResponse;\n}\n\nexport interface IrohRemoteClientReadHandshakeResponseOptions extends IrohRemoteHandshakeLineReadOptions {\n\texpectedHostNodeId?: string;\n}\n\nfunction createConversationHandshakeMetadata(\n\thello: IrohRemoteHello,\n\tconversationSession: { selection: IrohRemoteConversationSelection; sessionId: string; requestedSessionId?: string },\n): IrohRemoteConversationHandshakeMetadata {\n\tif (hello.mode !== \"conversation\") {\n\t\tthrow new Error(\"conversation handshake metadata requires a conversation hello\");\n\t}\n\treturn {\n\t\ttarget: hello.conversation.target,\n\t\tsessionId: conversationSession.sessionId,\n\t\tselection: conversationSession.selection,\n\t\t...(conversationSession.requestedSessionId === undefined\n\t\t\t? {}\n\t\t\t: { requestedSessionId: conversationSession.requestedSessionId }),\n\t};\n}\n\nfunction isEmptyIrohRemoteHostStateForRuntimePairingBootstrap(state: IrohRemoteHostState): boolean {\n\treturn (\n\t\tstate.workspaces.length === 0 &&\n\t\tstate.clients.length === 0 &&\n\t\t(state.revokedClients ?? []).length === 0 &&\n\t\t(state.pendingPairingTickets ?? []).length === 0 &&\n\t\t(state.pairingSecretTombstones ?? []).length === 0\n\t);\n}\n\nexport class IrohRemoteHostEngine {\n\tprivate readonly auditLogger: IrohRemoteAuditLogger;\n\tprivate readonly classifyWorkspaceAvailability: IrohRemoteWorkspaceAvailabilityClassifier | undefined;\n\tprivate readonly hostNodeId: string | undefined;\n\tprivate readonly relayMode: IrohRemoteRelayMode | undefined;\n\tprivate readonly relayUrls: string[] | undefined;\n\tprivate readonly now: () => number;\n\tprivate readonly stateManager: IrohRemoteHostStateManager;\n\tprivate readonly validateWorkspace: ((workspace: IrohRemoteWorkspace) => boolean | Promise<boolean>) | undefined;\n\tprivate readonly workspace: IrohRemoteWorkspace;\n\tprivate authorizationQueue: Promise<void> = Promise.resolve();\n\tprivate allowTools: string;\n\tprivate rpcGrant: IrohRemoteRpcGrant;\n\tprivate pairingAllowTools: string | undefined;\n\tprivate pairingRpcGrant: IrohRemoteRpcGrant | undefined;\n\tprivate pairingExpiresAt: number | undefined;\n\tprivate pairingSecret: string | undefined;\n\tprivate pairingWorkspaceName: string | undefined;\n\n\tconstructor(options: IrohRemoteHostEngineOptions) {\n\t\tconst defaultAccess = createIrohRemotePresetAccess(\"coding\");\n\t\tthis.allowTools = normalizeIrohRemoteAllowTools(options.allowTools ?? DEFAULT_IROH_REMOTE_ALLOW_TOOLS);\n\t\tthis.rpcGrant = cloneIrohRemoteRpcGrant(options.rpcGrant ?? defaultAccess.rpcGrant);\n\t\tthis.auditLogger = options.auditLogger ?? new IrohRemoteAuditLogger();\n\t\tthis.classifyWorkspaceAvailability = options.classifyWorkspaceAvailability;\n\t\tthis.hostNodeId = options.hostNodeId;\n\t\tthis.relayMode = options.relayMode;\n\t\tthis.relayUrls = options.relayUrls;\n\t\tthis.now = options.now ?? Date.now;\n\t\tthis.pairingExpiresAt = options.pairingExpiresAt;\n\t\tthis.pairingSecret = options.pairingSecret;\n\t\tthis.pairingWorkspaceName = options.pairingSecret === undefined ? undefined : options.workspace.name;\n\t\tthis.stateManager = options.stateManager;\n\t\tthis.validateWorkspace = options.validateWorkspace;\n\t\tthis.workspace = parseIrohRemoteWorkspace(options.workspace);\n\t}\n\n\tasync pair(options: IrohRemoteHostPairOptions): Promise<IrohRemotePairingTicket> {\n\t\treturn this.runAuthorizationExclusive(async () => {\n\t\t\tconst requestedWorkspace = options.workspace ?? this.workspace.name;\n\t\t\tconst workspace = await this.resolvePairWorkspace(requestedWorkspace, options.workspace === undefined);\n\n\t\t\tconst secret = options.secret ?? randomBytes(24).toString(\"base64url\");\n\t\t\tconst createdAt = this.now();\n\t\t\tconst expiresAt =\n\t\t\t\toptions.expiresAt ?? createdAt + (options.ttlMs ?? DEFAULT_IROH_REMOTE_PAIRING_TICKET_TTL_MS);\n\t\t\tconst allowTools = normalizeIrohRemoteAllowTools(\n\t\t\t\toptions.allowTools ?? workspace.allowedTools ?? this.allowTools,\n\t\t\t);\n\t\t\tconst rpcGrant = cloneIrohRemoteRpcGrant(options.rpcGrant ?? this.rpcGrant);\n\t\t\tthis.pairingAllowTools = allowTools;\n\t\t\tthis.pairingRpcGrant = rpcGrant;\n\t\t\tthis.pairingSecret = secret;\n\t\t\tthis.pairingExpiresAt = expiresAt;\n\t\t\tthis.pairingWorkspaceName = workspace.name;\n\t\t\tconst pendingPairingTicket = await this.stateManager.addPendingPairingTicket({\n\t\t\t\tsecretHash: hashIrohRemotePairingSecret(secret),\n\t\t\t\tworkspace: workspace.name,\n\t\t\t\tallowedTools: allowTools,\n\t\t\t\trpcGrant,\n\t\t\t\texpiresAt,\n\t\t\t\tcreatedAt,\n\t\t\t\t...(options.labelHint === undefined ? {} : { labelHint: options.labelHint }),\n\t\t\t});\n\n\t\t\tconst payload: IrohRemoteTicketPayload = {\n\t\t\t\talpn: IROH_REMOTE_ALPN,\n\t\t\t\texpiresAt,\n\t\t\t\tirohTicket: options.irohTicket,\n\t\t\t\tnodeId: options.nodeId,\n\t\t\t\trelayMode: options.relayMode,\n\t\t\t\t...(options.relayUrls === undefined ? {} : { relayUrls: options.relayUrls }),\n\t\t\t\t...(options.relayAuthToken === undefined ? {} : { relayAuthToken: options.relayAuthToken }),\n\t\t\t\tsecret,\n\t\t\t\tworkspace: workspace.name,\n\t\t\t};\n\t\t\tconst ticket = encodeIrohRemoteTicketPayload(payload);\n\t\t\tawait this.log({\n\t\t\t\ttype: \"pairing_ticket_created\",\n\t\t\t\tworkspace: payload.workspace,\n\t\t\t\tdetails: {\n\t\t\t\t\tallowedTools: pendingPairingTicket.allowedTools,\n\t\t\t\t\trpcGrant: pendingPairingTicket.rpcGrant,\n\t\t\t\t\tcreatedAt: pendingPairingTicket.createdAt,\n\t\t\t\t\texpiresAt: pendingPairingTicket.expiresAt,\n\t\t\t\t\tlabelHint: pendingPairingTicket.labelHint,\n\t\t\t\t\tnodeId: options.nodeId,\n\t\t\t\t\trelayMode: options.relayMode,\n\t\t\t\t},\n\t\t\t});\n\t\t\treturn { expiresAt, payload, secret, ticket };\n\t\t});\n\t}\n\n\tasync listClients(): Promise<IrohRemoteClient[]> {\n\t\tconst clients = await this.stateManager.listClients();\n\t\tawait this.log({ type: \"clients_listed\", details: { count: clients.length } });\n\t\treturn clients;\n\t}\n\n\tasync revokeClient(nodeId: string): Promise<IrohRemoteClientRevocationResult> {\n\t\tconst result = await this.stateManager.revokeClient(nodeId, this.now());\n\t\tawait this.log({\n\t\t\ttype: \"client_revoked\",\n\t\t\tclientNodeId: nodeId,\n\t\t\tsuccess: result.revoked,\n\t\t\terror: result.revoked ? undefined : \"client not found\",\n\t\t});\n\t\treturn result;\n\t}\n\n\tasync updateClientAccess(\n\t\tnodeId: string,\n\t\texpectedRevision: number,\n\t\taccess: { allowedTools: string; rpcGrant: IrohRemoteRpcGrant },\n\t): Promise<IrohRemoteClientAccessUpdateResult> {\n\t\tconst result = await this.stateManager.updateClientAccess(nodeId, expectedRevision, access);\n\t\tawait this.log({\n\t\t\ttype: \"client_access_updated\",\n\t\t\tclientNodeId: nodeId,\n\t\t\tsuccess: result.ok,\n\t\t\terror: result.ok ? undefined : result.reason,\n\t\t\tdetails: result.ok\n\t\t\t\t? {\n\t\t\t\t\t\texpectedRevision,\n\t\t\t\t\t\trevision: result.client.rpcGrant.revision,\n\t\t\t\t\t\tallowedTools: result.client.allowedTools,\n\t\t\t\t\t\trpcCapabilities: result.client.rpcGrant.capabilities,\n\t\t\t\t\t}\n\t\t\t\t: { expectedRevision, currentRevision: result.currentRevision },\n\t\t});\n\t\treturn result;\n\t}\n\n\tasync approveClientRePair(nodeId: string): Promise<IrohRemoteClientRePairApprovalResult> {\n\t\tconst result = await this.stateManager.approveClientRePair(nodeId, this.now());\n\t\tawait this.log({\n\t\t\ttype: \"client_repair_approved\",\n\t\t\tclientNodeId: nodeId,\n\t\t\tsuccess: result.approved,\n\t\t\terror: result.approved ? undefined : \"revoked client not found\",\n\t\t});\n\t\treturn result;\n\t}\n\n\tasync setClientLastSessionId(\n\t\tnodeId: string,\n\t\tworkspace: string,\n\t\tsessionId: string,\n\t): Promise<IrohRemoteClient | undefined> {\n\t\treturn this.stateManager.setClientLastSessionId(nodeId, workspace, sessionId);\n\t}\n\n\tasync authorizeHello(hello: IrohRemoteHello, remoteNodeId: string): Promise<IrohRemoteClientAuthorizationResult> {\n\t\treturn this.runAuthorizationExclusive(() => this.authorizeHelloUnlocked(hello, remoteNodeId));\n\t}\n\n\tprivate async ensurePrimaryWorkspaceRegistered(): Promise<IrohRemoteWorkspace> {\n\t\tconst state = await this.stateManager.getState();\n\t\tconst workspace = findIrohRemoteWorkspace(state, this.workspace.name);\n\t\tif (workspace) {\n\t\t\treturn workspace;\n\t\t}\n\t\treturn await this.stateManager.upsertWorkspace(this.workspace);\n\t}\n\n\tprivate async resolvePairWorkspace(\n\t\tworkspaceName: string,\n\t\tregisterPrimaryFallback: boolean,\n\t): Promise<IrohRemoteWorkspace> {\n\t\tconst workspace =\n\t\t\tregisterPrimaryFallback && workspaceName === this.workspace.name\n\t\t\t\t? await this.ensurePrimaryWorkspaceRegistered()\n\t\t\t\t: findIrohRemoteWorkspace(await this.stateManager.getState(), workspaceName);\n\t\tif (!workspace) {\n\t\t\tthrow new Error(`workspace_unavailable: workspace not registered: ${workspaceName}`);\n\t\t}\n\t\tif (this.validateWorkspace !== undefined && !(await this.validateWorkspace(workspace))) {\n\t\t\tthrow new Error(`workspace_unavailable: workspace path is unavailable: ${workspaceName}`);\n\t\t}\n\t\treturn workspace;\n\t}\n\n\tprivate async authorizeHelloUnlocked(\n\t\thello: IrohRemoteHello,\n\t\tremoteNodeId: string,\n\t): Promise<IrohRemoteClientAuthorizationResult> {\n\t\tawait this.ensureRuntimePairingWorkspaceRegistered();\n\t\tconst allowTools = normalizeIrohRemoteAllowTools(\n\t\t\tthis.pairingSecret !== undefined && hello.secret === this.pairingSecret\n\t\t\t\t? (this.pairingAllowTools ?? this.allowTools)\n\t\t\t\t: this.allowTools,\n\t\t);\n\t\tconst result = await this.stateManager.authorizeClient(hello, remoteNodeId, {\n\t\t\tallowTools,\n\t\t\trpcGrant:\n\t\t\t\tthis.pairingSecret !== undefined && hello.secret === this.pairingSecret\n\t\t\t\t\t? (this.pairingRpcGrant ?? this.rpcGrant)\n\t\t\t\t\t: this.rpcGrant,\n\t\t\tclassifyWorkspaceAvailability: this.classifyWorkspaceAvailability,\n\t\t\tnow: this.now(),\n\t\t\tpairingExpiresAt: this.pairingExpiresAt,\n\t\t\tpairingSecret: this.pairingSecret,\n\t\t\tvalidateWorkspace: this.validateWorkspace,\n\t\t});\n\n\t\tif (result.ok && result.pairingSecretConsumed) {\n\t\t\tthis.clearPairingSecret();\n\t\t} else if (!result.ok && result.pairingSecretExpired) {\n\t\t\tthis.clearPairingSecret();\n\t\t}\n\n\t\tawait this.logPairingTicketLifecycle(result, remoteNodeId);\n\t\tawait this.logAuthorization(hello, remoteNodeId, result);\n\t\treturn result;\n\t}\n\n\tprivate runAuthorizationExclusive<T>(operation: () => Promise<T>): Promise<T> {\n\t\tconst run = this.authorizationQueue.then(operation, operation);\n\t\tthis.authorizationQueue = run.then(\n\t\t\t() => undefined,\n\t\t\t() => undefined,\n\t\t);\n\t\treturn run;\n\t}\n\n\tasync readHandshake(\n\t\tstream: IrohBiStreamLike,\n\t\tremoteNodeId: string,\n\t\toptions: IrohRemoteHostReadHandshakeOptions = {},\n\t): Promise<IrohRemoteHostHandshakeResult> {\n\t\tlet initialInput: IrohBytes = Buffer.alloc(0);\n\t\ttry {\n\t\t\tconst handshake = await readIrohRemoteHandshakeLine(stream.recv, options);\n\t\t\tinitialInput = handshake.rest;\n\t\t\tif (handshake.line === undefined) {\n\t\t\t\treturn await this.writeHandshakeResult(\n\t\t\t\t\tstream,\n\t\t\t\t\tawait this.createHandshakeFailure(\"missing handshake\", initialInput),\n\t\t\t\t);\n\t\t\t}\n\n\t\t\tconst hello = parseIrohRemoteHelloLine(handshake.line);\n\t\t\tconst authorization = await this.authorizeHello(hello, remoteNodeId);\n\t\t\tif (!authorization.ok) {\n\t\t\t\treturn await this.writeHandshakeResult(stream, {\n\t\t\t\t\tok: false,\n\t\t\t\t\terror: authorization.error,\n\t\t\t\t\tinitialInput,\n\t\t\t\t\tresponse: createIrohRemoteHandshakeFailure(authorization.error, {\n\t\t\t\t\t\thostNodeId: this.hostNodeId,\n\t\t\t\t\t\toutcome: authorization.outcome,\n\t\t\t\t\t\tworkspace: authorization.workspace?.name,\n\t\t\t\t\t}),\n\t\t\t\t\tresponseWritten: false,\n\t\t\t\t});\n\t\t\t}\n\n\t\t\tconst successResult: IrohRemoteHostHandshakeResult = {\n\t\t\t\tok: true,\n\t\t\t\tauthorization,\n\t\t\t\thello,\n\t\t\t\tinitialInput,\n\t\t\t\tresponse: this.createHandshakeSuccessResponse(hello, authorization, remoteNodeId, options),\n\t\t\t\tresponseWritten: false,\n\t\t\t};\n\t\t\tif (options.writeSuccessResponse === false) {\n\t\t\t\treturn successResult;\n\t\t\t}\n\t\t\treturn await this.writeHandshakeResult(stream, successResult);\n\t\t} catch (error: unknown) {\n\t\t\treturn await this.writeHandshakeResult(\n\t\t\t\tstream,\n\t\t\t\tawait this.createHandshakeFailure(\n\t\t\t\t\terror instanceof Error ? error.message : String(error),\n\t\t\t\t\tinitialInput,\n\t\t\t\t\terror,\n\t\t\t\t),\n\t\t\t);\n\t\t}\n\t}\n\n\tsetAllowTools(allowTools: string): void {\n\t\tthis.allowTools = normalizeIrohRemoteAllowTools(allowTools);\n\t}\n\n\tclearPairingSecretForWorkspace(workspaceName: string): boolean {\n\t\tif (this.pairingWorkspaceName !== workspaceName) {\n\t\t\treturn false;\n\t\t}\n\t\tthis.clearPairingSecret();\n\t\treturn true;\n\t}\n\n\tasync cancelPairingSecretByHash(secretHash: string): Promise<boolean> {\n\t\treturn this.runAuthorizationExclusive(async () => {\n\t\t\tconst liveSecretMatches =\n\t\t\t\tthis.pairingSecret !== undefined && hashIrohRemotePairingSecret(this.pairingSecret) === secretHash;\n\t\t\tif (liveSecretMatches) this.clearPairingSecret();\n\t\t\tconst removedPendingTicket = await this.stateManager.removePendingPairingTicket(secretHash);\n\t\t\treturn liveSecretMatches || removedPendingTicket;\n\t\t});\n\t}\n\n\tprivate async ensureRuntimePairingWorkspaceRegistered(): Promise<void> {\n\t\tif (this.pairingSecret === undefined || this.pairingWorkspaceName !== this.workspace.name) {\n\t\t\treturn;\n\t\t}\n\t\tconst state = await this.stateManager.getState();\n\t\tif (findIrohRemoteWorkspace(state, this.workspace.name)) {\n\t\t\treturn;\n\t\t}\n\t\tif (isEmptyIrohRemoteHostStateForRuntimePairingBootstrap(state)) {\n\t\t\tawait this.stateManager.upsertWorkspace(this.workspace);\n\t\t\treturn;\n\t\t}\n\t\tthis.clearPairingSecret();\n\t}\n\n\tprivate clearPairingSecret(): void {\n\t\tthis.pairingAllowTools = undefined;\n\t\tthis.pairingRpcGrant = undefined;\n\t\tthis.pairingSecret = undefined;\n\t\tthis.pairingExpiresAt = undefined;\n\t\tthis.pairingWorkspaceName = undefined;\n\t}\n\n\tprivate async createHandshakeFailure(\n\t\terror: string,\n\t\tinitialInput: IrohBytes,\n\t\tcause?: unknown,\n\t): Promise<IrohRemoteHostHandshakeResult> {\n\t\tconst outcome = cause instanceof IrohRemoteHandshakeError ? cause.outcome : undefined;\n\t\tawait this.log({\n\t\t\ttype: \"handshake_rejected\",\n\t\t\tworkspace: this.workspace.name,\n\t\t\tsuccess: false,\n\t\t\terror,\n\t\t\tdetails: outcome === undefined ? undefined : { outcome },\n\t\t});\n\t\treturn {\n\t\t\tok: false,\n\t\t\terror,\n\t\t\tinitialInput,\n\t\t\tresponse: createIrohRemoteHandshakeFailure(error, {\n\t\t\t\thostNodeId: this.hostNodeId,\n\t\t\t\t...(outcome === undefined ? {} : { outcome }),\n\t\t\t}),\n\t\t\tresponseWritten: false,\n\t\t};\n\t}\n\n\tprivate createHandshakeSuccessResponse(\n\t\thello: IrohRemoteHello,\n\t\tauthorization: IrohRemoteClientAuthorizationSuccess,\n\t\tremoteNodeId: string,\n\t\toptions: IrohRemoteHostReadHandshakeOptions,\n\t): IrohRemoteHandshakeSuccess {\n\t\tconst common = {\n\t\t\tchild: options.child,\n\t\t\tclientNodeId: remoteNodeId,\n\t\t\tfeatures: [...IROH_REMOTE_HOST_FEATURES],\n\t\t\thostNodeId: this.hostNodeId,\n\t\t\tremoteHost: createIrohRemoteHostMetadata({\n\t\t\t\tauthorization,\n\t\t\t\thostNodeId: this.hostNodeId,\n\t\t\t\trelayMode: this.relayMode,\n\t\t\t\trelayUrls: this.relayUrls,\n\t\t\t\tfeatures: [...IROH_REMOTE_HOST_FEATURES],\n\t\t\t}),\n\t\t\tworkspace: authorization.workspace.name,\n\t\t};\n\t\tif (hello.mode === \"workspaceDiscovery\") {\n\t\t\treturn createIrohRemoteHandshakeSuccess({\n\t\t\t\t...common,\n\t\t\t\tworkspaceDiscovery: { purpose: hello.workspaceDiscovery.purpose },\n\t\t\t});\n\t\t}\n\t\tif (hello.mode === \"workspaceManagement\") {\n\t\t\treturn createIrohRemoteHandshakeSuccess({\n\t\t\t\t...common,\n\t\t\t\tworkspaceManagement: { purpose: hello.workspaceManagement.purpose },\n\t\t\t});\n\t\t}\n\t\tif (options.conversationSession === undefined) {\n\t\t\tif (options.writeSuccessResponse === false) {\n\t\t\t\treturn createIrohRemoteHandshakeSuccess(common);\n\t\t\t}\n\t\t\tthrow new IrohRemoteHandshakeError(\n\t\t\t\t\"conversation_streams_unsupported\",\n\t\t\t\t\"conversation stream requires resolved session metadata\",\n\t\t\t);\n\t\t}\n\t\treturn createIrohRemoteHandshakeSuccess({\n\t\t\t...common,\n\t\t\tsessionId: options.conversationSession.sessionId,\n\t\t\tconversation: createConversationHandshakeMetadata(hello, options.conversationSession),\n\t\t});\n\t}\n\n\tprivate async writeHandshakeResult(\n\t\tstream: IrohBiStreamLike,\n\t\tresult: IrohRemoteHostHandshakeResult,\n\t): Promise<IrohRemoteHostHandshakeResult> {\n\t\ttry {\n\t\t\tawait writeIrohRemoteHandshakeResponse(stream.send, result.response);\n\t\t\treturn { ...result, responseWritten: true };\n\t\t} catch (error) {\n\t\t\t// Authorization may already be committed; response write failures should not reclassify the result.\n\t\t\treturn {\n\t\t\t\t...result,\n\t\t\t\tresponseWritten: false,\n\t\t\t\tresponseWriteError: error instanceof Error ? error.message : String(error),\n\t\t\t};\n\t\t}\n\t}\n\n\tprivate async logPairingTicketLifecycle(\n\t\tresult: IrohRemoteClientAuthorizationResult,\n\t\tremoteNodeId: string,\n\t): Promise<void> {\n\t\tfor (const ticket of result.expiredPairingTickets ?? []) {\n\t\t\tawait this.log({\n\t\t\t\ttype: \"pairing_ticket_expired\",\n\t\t\t\tworkspace: ticket.workspace,\n\t\t\t\tsuccess: false,\n\t\t\t\tdetails: {\n\t\t\t\t\tallowedTools: ticket.allowedTools,\n\t\t\t\t\trpcGrant: ticket.rpcGrant,\n\t\t\t\t\tcreatedAt: ticket.createdAt,\n\t\t\t\t\texpiresAt: ticket.expiresAt,\n\t\t\t\t},\n\t\t\t});\n\t\t}\n\t\tif (!result.ok || !result.pairingSecretConsumed) {\n\t\t\treturn;\n\t\t}\n\t\tawait this.log({\n\t\t\ttype: \"pairing_ticket_consumed\",\n\t\t\tclientNodeId: remoteNodeId,\n\t\t\tworkspace: result.workspace.name,\n\t\t\tsuccess: true,\n\t\t\tdetails: result.consumedPairingTicket\n\t\t\t\t? {\n\t\t\t\t\t\tallowedTools: result.consumedPairingTicket.allowedTools,\n\t\t\t\t\t\trpcGrant: result.consumedPairingTicket.rpcGrant,\n\t\t\t\t\t\tcreatedAt: result.consumedPairingTicket.createdAt,\n\t\t\t\t\t\texpiresAt: result.consumedPairingTicket.expiresAt,\n\t\t\t\t\t\tlabelHint: result.consumedPairingTicket.labelHint,\n\t\t\t\t\t}\n\t\t\t\t: undefined,\n\t\t});\n\t}\n\n\tprivate async logAuthorization(\n\t\thello: IrohRemoteHello,\n\t\tremoteNodeId: string,\n\t\tresult: IrohRemoteClientAuthorizationResult,\n\t): Promise<void> {\n\t\tawait this.log({\n\t\t\ttype: result.ok ? \"client_authorized\" : \"client_rejected\",\n\t\t\tclientNodeId: remoteNodeId,\n\t\t\tworkspace: hello.workspace,\n\t\t\tsuccess: result.ok,\n\t\t\terror: result.ok ? undefined : result.error,\n\t\t\tdetails: result.ok\n\t\t\t\t? { paired: result.paired }\n\t\t\t\t: { outcome: result.outcome, pairingSecretExpired: result.pairingSecretExpired },\n\t\t});\n\t}\n\n\tprivate async log(event: IrohRemoteAuditEventInput): Promise<void> {\n\t\ttry {\n\t\t\tawait this.auditLogger.log(event);\n\t\t} catch (error) {\n\t\t\t// A valid handshake must not be reclassified as a failure when audit I/O\n\t\t\t// fails, but a dropped security-relevant event must not vanish silently.\n\t\t\t// Surface it to the daemon log (captured stderr) so the omission is visible.\n\t\t\tconsole.error(\n\t\t\t\t`[iroh-remote] failed to write audit event ${event.type}: ${\n\t\t\t\t\terror instanceof Error ? error.message : String(error)\n\t\t\t\t}`,\n\t\t\t);\n\t\t}\n\t}\n}\n\nexport class IrohRemoteClientEngine {\n\tprivate readonly auditLogger: IrohRemoteAuditLogger;\n\tprivate readonly clientLabel: string | undefined;\n\tprivate readonly clientNodeId: string | undefined;\n\tprivate readonly now: () => number;\n\n\tconstructor(options: IrohRemoteClientEngineOptions = {}) {\n\t\tthis.auditLogger = options.auditLogger ?? new IrohRemoteAuditLogger();\n\t\tthis.clientLabel = options.clientLabel;\n\t\tthis.clientNodeId = options.clientNodeId;\n\t\tthis.now = options.now ?? Date.now;\n\t}\n\n\tasync createHelloFromTicket(ticket: string): Promise<IrohRemoteClientTicketHello> {\n\t\tconst payload = decodeIrohRemoteTicketPayload(ticket);\n\t\tassertIrohRemoteTicketNotExpired(payload, this.now());\n\t\tconst hello = this.createHello(payload);\n\t\tawait this.log({\n\t\t\ttype: \"ticket_loaded\",\n\t\t\tworkspace: payload.workspace,\n\t\t\tdetails: { nodeId: payload.nodeId, relayMode: payload.relayMode },\n\t\t});\n\t\treturn { hello, payload };\n\t}\n\n\tcreateHello(payload: IrohRemoteTicketPayload): IrohRemoteHello {\n\t\treturn {\n\t\t\ttype: \"volt_iroh_hello\",\n\t\t\tprotocol: IROH_REMOTE_ALPN,\n\t\t\tworkspace: payload.workspace,\n\t\t\tsecret: payload.secret,\n\t\t\tclientLabel: this.clientLabel,\n\t\t\tclientNodeId: this.clientNodeId,\n\t\t\tmode: \"conversation\",\n\t\t\tconversation: { target: \"last\" },\n\t\t};\n\t}\n\n\tasync writeHello(stream: IrohBiStreamLike, payload: IrohRemoteTicketPayload): Promise<IrohRemoteHello> {\n\t\tconst hello = this.createHello(payload);\n\t\tawait writeIrohRemoteHello(stream.send, hello);\n\t\tawait this.log({\n\t\t\ttype: \"hello_sent\",\n\t\t\tworkspace: payload.workspace,\n\t\t\tdetails: { nodeId: payload.nodeId },\n\t\t});\n\t\treturn hello;\n\t}\n\n\tasync readHandshakeResponse(\n\t\trecv: IrohRecvStreamLike,\n\t\toptions: IrohRemoteClientReadHandshakeResponseOptions = {},\n\t): Promise<IrohRemoteClientHandshakeResponseResult> {\n\t\tconst handshake = await readIrohRemoteHandshakeLine(recv, options);\n\t\tif (handshake.line === undefined) {\n\t\t\tthrow new Error(\"missing handshake response\");\n\t\t}\n\t\tconst response = parseIrohRemoteHandshakeResponseLine(handshake.line);\n\t\tassertIrohRemoteHandshakeHostIdentity(response, options.expectedHostNodeId);\n\t\tawait this.log({\n\t\t\ttype: \"handshake_response_received\",\n\t\t\tworkspace: response.success ? response.workspace : undefined,\n\t\t\tsuccess: response.success,\n\t\t\terror: response.success ? undefined : response.error,\n\t\t\tdetails: response.success ? undefined : { outcome: response.outcome },\n\t\t});\n\t\treturn { initialInput: handshake.rest, response };\n\t}\n\n\tprivate async log(event: IrohRemoteAuditEventInput): Promise<void> {\n\t\ttry {\n\t\t\tawait this.auditLogger.log(event);\n\t\t} catch {\n\t\t\t// Client-side protocol progress should not fail after audit I/O fails.\n\t\t}\n\t}\n}\n"]}