@inhuman.tools/harness 0.1.0 → 0.3.0

package/dist/server/daemon/kernel/remote-access.d.ts

@@ -0,0 +1,75 @@
+import type { CredentialsStore } from "../../../connections/credentials.js";
+import { type DevicePollClock } from "../../../providers/auth/index.js";
+export declare const DEFAULT_RELAY_URL = "https://harness.inhuman.tools";
+export declare const WORKOS_CLIENT_ID_ENV = "HARNESS_REMOTE_WORKOS_CLIENT_ID";
+export declare const RELAY_URL_ENV = "HARNESS_REMOTE_URL";
+/** DEV ONLY (local e2e against `wrangler dev`): a ready-made relay bearer, `dev.<secret>.<sub>.<email>`. Unset in every real run. */
+export declare const DEV_TOKEN_ENV = "HARNESS_REMOTE_DEV_TOKEN";
+export declare const WORKOS_DEVICE_CODE_URL = "https://api.workos.com/user_management/authorize/device";
+export declare const WORKOS_TOKEN_URL = "https://api.workos.com/user_management/authenticate";
+/** Reserved ids in the credentials store; connection ids are slugs of a name and never contain `:`. */
+export declare const REMOTE_TOKENS_ID = "remote:tokens";
+export declare const REMOTE_MACHINE_ID = "remote:machine";
+export declare const REMOTE_LOGIN_HINT = "Approve this machine for remote access in the browser, then continue";
+export type RemoteStatus = {
+    readonly loggedIn: boolean;
+    readonly email?: string;
+    readonly machineId: string;
+    readonly machineName: string;
+    readonly relayUrl: string;
+    readonly connected: boolean;
+    /** Why remote access is down: set when the relay or WorkOS refused the stored login. */
+    readonly lastError?: string;
+};
+export type RemoteAccessOptions = {
+    readonly credentials: CredentialsStore & {
+        write: NonNullable<CredentialsStore["write"]>;
+    };
+    readonly env?: Readonly<Record<string, string | undefined>>;
+    readonly fetch?: typeof fetch;
+    readonly hostname?: () => string;
+    readonly clock?: DevicePollClock;
+};
+/** Parks the open-url form; resolves when the human continues, rejects when they cancel. */
+export type RemoteLoginUi = (body: string) => Promise<unknown>;
+/** Cheap boot-time check, before any kernel exists. */
+export declare function remoteLoggedIn(root: string, env?: Readonly<Record<string, string | undefined>>): boolean;
+export declare class RemoteAccess {
+    #private;
+    constructor(options: RemoteAccessOptions);
+    get relayUrl(): string;
+    /** Minted once and kept; survives logout. */
+    machine(): {
+        readonly machineId: string;
+        readonly machineName: string;
+    };
+    /** `connected` is the connector's control socket; this class only knows the login. */
+    status(connected?: boolean): RemoteStatus;
+    /**
+     * Device login. `ui` parks the open-url form first; the poll starts after
+     * the human continues. A UI cancel rejects `ui`, and nothing is stored.
+     */
+    login(ui: RemoteLoginUi, options?: {
+        name?: string;
+        signal?: AbortSignal;
+    }): Promise<{
+        email: string;
+        machineId: string;
+    }>;
+    logout(): {
+        readonly wasLoggedIn: boolean;
+    };
+    /** A transient reason shown in `remote/status`; `undefined` clears it. */
+    noteError(message: string | undefined): void;
+    /** The stored login is dead (revoked grant, relay 401 on a fresh token): drop it and say why. */
+    revoke(reason: string): void;
+    /**
+     * A bearer token for the relay, refreshed first when it expires within the
+     * skew. `undefined` when logged out, including when WorkOS answers
+     * `invalid_grant` (the tokens are then dropped). Other refresh failures
+     * reject and keep the tokens. Concurrent callers share one refresh,
+     * which matters because WorkOS rotates refresh tokens.
+     */
+    accessToken(now?: number, force?: boolean): Promise<string | undefined>;
+}
+//# sourceMappingURL=remote-access.d.ts.map

package/dist/server/daemon/kernel/remote-access.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"remote-access.d.ts","sourceRoot":"","sources":["../../../../src/server/daemon/kernel/remote-access.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAC;AAClE,OAAO,EAQL,KAAK,eAAe,EAErB,MAAM,kBAAkB,CAAC;AAI1B,eAAO,MAAM,iBAAiB,kCAAkC,CAAC;AACjE,eAAO,MAAM,oBAAoB,oCAAoC,CAAC;AACtE,eAAO,MAAM,aAAa,uBAAuB,CAAC;AAClD,qIAAqI;AACrI,eAAO,MAAM,aAAa,6BAA6B,CAAC;AAGxD,eAAO,MAAM,sBAAsB,4DAAmC,CAAC;AACvE,eAAO,MAAM,gBAAgB,wDAA+B,CAAC;AAE7D,uGAAuG;AACvG,eAAO,MAAM,gBAAgB,kBAAkB,CAAC;AAChD,eAAO,MAAM,iBAAiB,mBAAmB,CAAC;AAElD,eAAO,MAAM,iBAAiB,yEAAyE,CAAC;AAExG,MAAM,MAAM,YAAY,GAAG;IACzB,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;IAC3B,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;IAC5B,wFAAwF;IACxF,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;CAC7B,CAAC;AAEF,MAAM,MAAM,mBAAmB,GAAG;IAChC,QAAQ,CAAC,WAAW,EAAE,gBAAgB,GAAG;QAAE,KAAK,EAAE,WAAW,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC,CAAA;KAAE,CAAC;IAC3F,QAAQ,CAAC,GAAG,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC,CAAC;IAC5D,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;IAC9B,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,MAAM,CAAC;IACjC,QAAQ,CAAC,KAAK,CAAC,EAAE,eAAe,CAAC;CAClC,CAAC;AAEF,4FAA4F;AAC5F,MAAM,MAAM,aAAa,GAAG,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;AAE/D,uDAAuD;AACvD,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,GAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAe,GAAG,OAAO,CAGrH;AAiBD,qBAAa,YAAY;;gBASX,OAAO,EAAE,mBAAmB;IAQxC,IAAI,QAAQ,IAAI,MAAM,CAGrB;IAED,6CAA6C;IAC7C,OAAO,IAAI;QAAE,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;KAAE;IAQvE,sFAAsF;IACtF,MAAM,CAAC,SAAS,UAAQ,GAAG,YAAY;IAevC;;;OAGG;IACG,KAAK,CAAC,EAAE,EAAE,aAAa,EAAE,OAAO,GAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,WAAW,CAAA;KAAO;;;;IAkBpF,MAAM,IAAI;QAAE,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAA;KAAE;IAO3C,0EAA0E;IAC1E,SAAS,CAAC,OAAO,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI;IAI5C,iGAAiG;IACjG,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI;IAK5B;;;;;;OAMG;IACH,WAAW,CAAC,GAAG,SAAa,EAAE,KAAK,UAAQ,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC;CA6E1E"}

package/dist/server/daemon/kernel/remote-access.js

@@ -0,0 +1,206 @@
+/**
+ * Daemon side of remote access: WorkOS device login, token storage and
+ * refresh, the machine identity. A kernel service, not a PEW connection:
+ * it provides no ability, has no model catalog and no per-connection config.
+ * Tokens and the machine id live in the kernel's durable credentials under
+ * reserved ids; the connector (phase 3b) calls {@link RemoteAccess.accessToken}.
+ */
+import { randomBytes } from "node:crypto";
+import { hostname } from "node:os";
+import { accessTokenExpiring, OidcGrantError, pollDeviceToken, refreshOidcToken, requestDeviceCode, secretsFromTokens, } from "../../../providers/auth/index.js";
+import { readConnectionSecrets } from "../../secrets.js";
+export const DEFAULT_RELAY_URL = "https://harness.inhuman.tools";
+export const WORKOS_CLIENT_ID_ENV = "HARNESS_REMOTE_WORKOS_CLIENT_ID";
+export const RELAY_URL_ENV = "HARNESS_REMOTE_URL";
+/** DEV ONLY (local e2e against `wrangler dev`): a ready-made relay bearer, `dev.<secret>.<sub>.<email>`. Unset in every real run. */
+export const DEV_TOKEN_ENV = "HARNESS_REMOTE_DEV_TOKEN";
+const WORKOS_API = "https://api.workos.com/user_management";
+export const WORKOS_DEVICE_CODE_URL = `${WORKOS_API}/authorize/device`;
+export const WORKOS_TOKEN_URL = `${WORKOS_API}/authenticate`;
+/** Reserved ids in the credentials store; connection ids are slugs of a name and never contain `:`. */
+export const REMOTE_TOKENS_ID = "remote:tokens";
+export const REMOTE_MACHINE_ID = "remote:machine";
+export const REMOTE_LOGIN_HINT = "Approve this machine for remote access in the browser, then continue";
+/** Cheap boot-time check, before any kernel exists. */
+export function remoteLoggedIn(root, env = process.env) {
+    if (devToken(env) !== undefined)
+        return true;
+    return readConnectionSecrets(root, REMOTE_TOKENS_ID).refreshToken !== undefined;
+}
+function devToken(env) {
+    const token = env[DEV_TOKEN_ENV]?.trim();
+    return token === undefined || token === "" ? undefined : token;
+}
+/** The email in a dev bearer (everything after `dev.<secret>.<sub>.`), or a placeholder. */
+function devEmail(token) {
+    const email = token.split(".").slice(3).join(".");
+    return email === "" ? "dev@local" : email;
+}
+function quote(text) {
+    return `"${text.replaceAll("\\", "\\\\").replaceAll('"', String.raw `\"`)}"`;
+}
+export class RemoteAccess {
+    #credentials;
+    #env;
+    #fetch;
+    #hostname;
+    #clock;
+    #refreshing = null;
+    #lastError;
+    constructor(options) {
+        this.#credentials = options.credentials;
+        this.#env = options.env ?? process.env;
+        this.#fetch = options.fetch;
+        this.#hostname = options.hostname ?? hostname;
+        this.#clock = options.clock;
+    }
+    get relayUrl() {
+        const url = this.#env[RELAY_URL_ENV]?.trim();
+        return (url === undefined || url === "" ? DEFAULT_RELAY_URL : url).replace(/\/+$/, "");
+    }
+    /** Minted once and kept; survives logout. */
+    machine() {
+        const bag = this.#credentials.read(REMOTE_MACHINE_ID);
+        const machineId = bag.machineId ?? randomBytes(16).toString("base64url");
+        const machineName = bag.machineName ?? this.#hostname();
+        if (bag.machineId === undefined)
+            this.#credentials.write(REMOTE_MACHINE_ID, { ...bag, machineId });
+        return { machineId, machineName };
+    }
+    /** `connected` is the connector's control socket; this class only knows the login. */
+    status(connected = false) {
+        const dev = devToken(this.#env);
+        const tokens = this.#credentials.read(REMOTE_TOKENS_ID);
+        const loggedIn = dev !== undefined || tokens.refreshToken !== undefined;
+        const email = dev === undefined ? tokens.email : devEmail(dev);
+        return {
+            loggedIn,
+            ...(loggedIn && email !== undefined ? { email } : {}),
+            ...this.machine(),
+            relayUrl: this.relayUrl,
+            connected,
+            ...(this.#lastError === undefined ? {} : { lastError: this.#lastError }),
+        };
+    }
+    /**
+     * Device login. `ui` parks the open-url form first; the poll starts after
+     * the human continues. A UI cancel rejects `ui`, and nothing is stored.
+     */
+    async login(ui, options = {}) {
+        const clientId = await this.#configuredClientId();
+        const client = this.#deviceClient(clientId);
+        const device = await requestDeviceCode(client);
+        await ui(`(harness/open-url :url ${quote(device.verificationUriComplete)} :description ${quote(REMOTE_LOGIN_HINT)})`);
+        const tokens = await pollDeviceToken(client, device, this.#clock, options.signal);
+        // The refresh token is bound to the client that minted it.
+        this.#credentials.write(REMOTE_TOKENS_ID, { ...secretsFromTokens(tokens), clientId });
+        this.#lastError = undefined;
+        if (options.name !== undefined) {
+            const bag = this.#credentials.read(REMOTE_MACHINE_ID);
+            this.#credentials.write(REMOTE_MACHINE_ID, { ...bag, machineName: options.name });
+        }
+        return { email: tokens.email ?? "", machineId: this.machine().machineId };
+    }
+    logout() {
+        const wasLoggedIn = this.#credentials.read(REMOTE_TOKENS_ID).refreshToken !== undefined;
+        this.#credentials.write(REMOTE_TOKENS_ID, {});
+        this.#lastError = undefined;
+        return { wasLoggedIn };
+    }
+    /** A transient reason shown in `remote/status`; `undefined` clears it. */
+    noteError(message) {
+        this.#lastError = message;
+    }
+    /** The stored login is dead (revoked grant, relay 401 on a fresh token): drop it and say why. */
+    revoke(reason) {
+        this.#credentials.write(REMOTE_TOKENS_ID, {});
+        this.#lastError = reason;
+    }
+    /**
+     * A bearer token for the relay, refreshed first when it expires within the
+     * skew. `undefined` when logged out, including when WorkOS answers
+     * `invalid_grant` (the tokens are then dropped). Other refresh failures
+     * reject and keep the tokens. Concurrent callers share one refresh,
+     * which matters because WorkOS rotates refresh tokens.
+     */
+    accessToken(now = Date.now(), force = false) {
+        const dev = devToken(this.#env);
+        if (dev !== undefined)
+            return Promise.resolve(dev);
+        const tokens = this.#credentials.read(REMOTE_TOKENS_ID);
+        if (tokens.apiKey === undefined || tokens.refreshToken === undefined)
+            return Promise.resolve(undefined);
+        if (!force && !accessTokenExpiring(tokens.expiresAt, now))
+            return Promise.resolve(tokens.apiKey);
+        const { refreshToken, clientId } = tokens;
+        this.#refreshing ??= this.#refresh(refreshToken, clientId).finally(() => {
+            this.#refreshing = null;
+        });
+        return this.#refreshing;
+    }
+    async #refresh(refreshToken, storedClientId) {
+        let refreshed;
+        try {
+            const clientId = storedClientId ?? (await this.#configuredClientId());
+            refreshed = await refreshOidcToken(this.#profile(clientId), refreshToken);
+        }
+        catch (error) {
+            if (!(error instanceof OidcGrantError) || error.code !== "invalid_grant")
+                throw error;
+            this.revoke("The remote-access login expired or was revoked. Run `inhuman login` again.");
+            return undefined;
+        }
+        const previous = this.#credentials.read(REMOTE_TOKENS_ID);
+        // A refresh body may omit the user; keep who we were.
+        this.#credentials.write(REMOTE_TOKENS_ID, { ...previous, ...secretsFromTokens(refreshed) });
+        return refreshed.apiKey;
+    }
+    /** The env override, else the client the relay publishes at `/api/config`. */
+    async #configuredClientId() {
+        const override = this.#env[WORKOS_CLIENT_ID_ENV]?.trim();
+        if (override !== undefined && override !== "")
+            return override;
+        const url = `${this.relayUrl}/api/config`;
+        let published;
+        try {
+            const res = await (this.#fetch ?? fetch)(url, { signal: AbortSignal.timeout(10_000) });
+            if (!res.ok)
+                throw new Error(`HTTP ${res.status}`);
+            published = (await res.json()).workosClientId;
+        }
+        catch (error) {
+            throw new Error(`Could not reach the relay at ${url}: ${error instanceof Error ? error.message : String(error)}`);
+        }
+        if (typeof published !== "string" || published.trim() === "") {
+            throw new Error(`Remote access is not configured: the relay at ${this.relayUrl} publishes no WorkOS client id; set ${WORKOS_CLIENT_ID_ENV} to override`);
+        }
+        return published.trim();
+    }
+    #deviceClient(clientId) {
+        return {
+            driver: "remote",
+            label: "WorkOS",
+            clientId,
+            deviceCodeUrl: WORKOS_DEVICE_CODE_URL,
+            tokenUrl: WORKOS_TOKEN_URL,
+            scope: "",
+            minIntervalSec: 1,
+            ...(this.#fetch === undefined ? {} : { fetch: this.#fetch }),
+        };
+    }
+    #profile(clientId) {
+        return {
+            driver: "remote",
+            clientId,
+            authorizeUrl: "",
+            tokenUrl: WORKOS_TOKEN_URL,
+            userinfoUrl: "",
+            scope: "",
+            extraAuthorize: {},
+            loginHint: REMOTE_LOGIN_HINT,
+            baseUrl: this.relayUrl,
+            ...(this.#fetch === undefined ? {} : { fetch: this.#fetch }),
+        };
+    }
+}
+//# sourceMappingURL=remote-access.js.map

package/dist/server/daemon/kernel/remote-access.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"remote-access.js","sourceRoot":"","sources":["../../../../src/server/daemon/kernel/remote-access.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAGnC,OAAO,EACL,mBAAmB,EACnB,cAAc,EACd,eAAe,EACf,gBAAgB,EAChB,iBAAiB,EACjB,iBAAiB,GAIlB,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EAAE,qBAAqB,EAAE,MAAM,kBAAkB,CAAC;AAEzD,MAAM,CAAC,MAAM,iBAAiB,GAAG,+BAA+B,CAAC;AACjE,MAAM,CAAC,MAAM,oBAAoB,GAAG,iCAAiC,CAAC;AACtE,MAAM,CAAC,MAAM,aAAa,GAAG,oBAAoB,CAAC;AAClD,qIAAqI;AACrI,MAAM,CAAC,MAAM,aAAa,GAAG,0BAA0B,CAAC;AAExD,MAAM,UAAU,GAAG,wCAAwC,CAAC;AAC5D,MAAM,CAAC,MAAM,sBAAsB,GAAG,GAAG,UAAU,mBAAmB,CAAC;AACvE,MAAM,CAAC,MAAM,gBAAgB,GAAG,GAAG,UAAU,eAAe,CAAC;AAE7D,uGAAuG;AACvG,MAAM,CAAC,MAAM,gBAAgB,GAAG,eAAe,CAAC;AAChD,MAAM,CAAC,MAAM,iBAAiB,GAAG,gBAAgB,CAAC;AAElD,MAAM,CAAC,MAAM,iBAAiB,GAAG,sEAAsE,CAAC;AAwBxG,uDAAuD;AACvD,MAAM,UAAU,cAAc,CAAC,IAAY,EAAE,MAAoD,OAAO,CAAC,GAAG;IAC1G,IAAI,QAAQ,CAAC,GAAG,CAAC,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IAC7C,OAAO,qBAAqB,CAAC,IAAI,EAAE,gBAAgB,CAAC,CAAC,YAAY,KAAK,SAAS,CAAC;AAClF,CAAC;AAED,SAAS,QAAQ,CAAC,GAAiD;IACjE,MAAM,KAAK,GAAG,GAAG,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,CAAC;IACzC,OAAO,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC;AACjE,CAAC;AAED,4FAA4F;AAC5F,SAAS,QAAQ,CAAC,KAAa;IAC7B,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAClD,OAAO,KAAK,KAAK,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,KAAK,CAAC;AAC5C,CAAC;AAED,SAAS,KAAK,CAAC,IAAY;IACzB,OAAO,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE,MAAM,CAAC,GAAG,CAAA,IAAI,CAAC,GAAG,CAAC;AAC9E,CAAC;AAED,MAAM,OAAO,YAAY;IACd,YAAY,CAAqC;IACjD,IAAI,CAA+C;IACnD,MAAM,CAA2B;IACjC,SAAS,CAAe;IACxB,MAAM,CAA8B;IAC7C,WAAW,GAAuC,IAAI,CAAC;IACvD,UAAU,CAAqB;IAE/B,YAAY,OAA4B;QACtC,IAAI,CAAC,YAAY,GAAG,OAAO,CAAC,WAAW,CAAC;QACxC,IAAI,CAAC,IAAI,GAAG,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;QACvC,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC;QAC5B,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,QAAQ,IAAI,QAAQ,CAAC;QAC9C,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC;IAC9B,CAAC;IAED,IAAI,QAAQ;QACV,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,CAAC;QAC7C,OAAO,CAAC,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,EAAE,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACzF,CAAC;IAED,6CAA6C;IAC7C,OAAO;QACL,MAAM,GAAG,GAAG,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;QACtD,MAAM,SAAS,GAAG,GAAG,CAAC,SAAS,IAAI,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QACzE,MAAM,WAAW,GAAG,GAAG,CAAC,WAAW,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;QACxD,IAAI,GAAG,CAAC,SAAS,KAAK,SAAS;YAAE,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,iBAAiB,EAAE,EAAE,GAAG,GAAG,EAAE,SAAS,EAAE,CAAC,CAAC;QACnG,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,CAAC;IACpC,CAAC;IAED,sFAAsF;IACtF,MAAM,CAAC,SAAS,GAAG,KAAK;QACtB,MAAM,GAAG,GAAG,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAChC,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;QACxD,MAAM,QAAQ,GAAG,GAAG,KAAK,SAAS,IAAI,MAAM,CAAC,YAAY,KAAK,SAAS,CAAC;QACxE,MAAM,KAAK,GAAG,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;QAC/D,OAAO;YACL,QAAQ;YACR,GAAG,CAAC,QAAQ,IAAI,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACrD,GAAG,IAAI,CAAC,OAAO,EAAE;YACjB,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,SAAS;YACT,GAAG,CAAC,IAAI,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC;SACzE,CAAC;IACJ,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,KAAK,CAAC,EAAiB,EAAE,UAAmD,EAAE;QAClF,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,mBAAmB,EAAE,CAAC;QAClD,MAAM,MAAM,GAAG,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC;QAC5C,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC,MAAM,CAAC,CAAC;QAC/C,MAAM,EAAE,CACN,0BAA0B,KAAK,CAAC,MAAM,CAAC,uBAAuB,CAAC,iBAAiB,KAAK,CAAC,iBAAiB,CAAC,GAAG,CAC5G,CAAC;QACF,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;QAClF,2DAA2D;QAC3D,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,gBAAgB,EAAE,EAAE,GAAG,iBAAiB,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC;QACtF,IAAI,CAAC,UAAU,GAAG,SAAS,CAAC;QAC5B,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YAC/B,MAAM,GAAG,GAAG,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;YACtD,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,iBAAiB,EAAE,EAAE,GAAG,GAAG,EAAE,WAAW,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;QACpF,CAAC;QACD,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,SAAS,EAAE,CAAC;IAC5E,CAAC;IAED,MAAM;QACJ,MAAM,WAAW,GAAG,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,YAAY,KAAK,SAAS,CAAC;QACxF,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,gBAAgB,EAAE,EAAE,CAAC,CAAC;QAC9C,IAAI,CAAC,UAAU,GAAG,SAAS,CAAC;QAC5B,OAAO,EAAE,WAAW,EAAE,CAAC;IACzB,CAAC;IAED,0EAA0E;IAC1E,SAAS,CAAC,OAA2B;QACnC,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC;IAC5B,CAAC;IAED,iGAAiG;IACjG,MAAM,CAAC,MAAc;QACnB,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,gBAAgB,EAAE,EAAE,CAAC,CAAC;QAC9C,IAAI,CAAC,UAAU,GAAG,MAAM,CAAC;IAC3B,CAAC;IAED;;;;;;OAMG;IACH,WAAW,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,KAAK,GAAG,KAAK;QACzC,MAAM,GAAG,GAAG,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAChC,IAAI,GAAG,KAAK,SAAS;YAAE,OAAO,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACnD,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;QACxD,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS,IAAI,MAAM,CAAC,YAAY,KAAK,SAAS;YAAE,OAAO,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QACxG,IAAI,CAAC,KAAK,IAAI,CAAC,mBAAmB,CAAC,MAAM,CAAC,SAAS,EAAE,GAAG,CAAC;YAAE,OAAO,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACjG,MAAM,EAAE,YAAY,EAAE,QAAQ,EAAE,GAAG,MAAM,CAAC;QAC1C,IAAI,CAAC,WAAW,KAAK,IAAI,CAAC,QAAQ,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE;YACtE,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC;QAC1B,CAAC,CAAC,CAAC;QACH,OAAO,IAAI,CAAC,WAAW,CAAC;IAC1B,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,YAAoB,EAAE,cAAkC;QACrE,IAAI,SAAS,CAAC;QACd,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,cAAc,IAAI,CAAC,MAAM,IAAI,CAAC,mBAAmB,EAAE,CAAC,CAAC;YACtE,SAAS,GAAG,MAAM,gBAAgB,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,YAAY,CAAC,CAAC;QAC5E,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,CAAC,KAAK,YAAY,cAAc,CAAC,IAAI,KAAK,CAAC,IAAI,KAAK,eAAe;gBAAE,MAAM,KAAK,CAAC;YACtF,IAAI,CAAC,MAAM,CAAC,4EAA4E,CAAC,CAAC;YAC1F,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,MAAM,QAAQ,GAAG,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;QAC1D,sDAAsD;QACtD,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,gBAAgB,EAAE,EAAE,GAAG,QAAQ,EAAE,GAAG,iBAAiB,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;QAC5F,OAAO,SAAS,CAAC,MAAM,CAAC;IAC1B,CAAC;IAED,8EAA8E;IAC9E,KAAK,CAAC,mBAAmB;QACvB,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,oBAAoB,CAAC,EAAE,IAAI,EAAE,CAAC;QACzD,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,KAAK,EAAE;YAAE,OAAO,QAAQ,CAAC;QAC/D,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,QAAQ,aAAa,CAAC;QAC1C,IAAI,SAAkB,CAAC;QACvB,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,IAAI,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YACvF,IAAI,CAAC,GAAG,CAAC,EAAE;gBAAE,MAAM,IAAI,KAAK,CAAC,QAAQ,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;YACnD,SAAS,GAAI,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAkC,CAAC,cAAc,CAAC;QAClF,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CAAC,gCAAgC,GAAG,KAAK,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACpH,CAAC;QACD,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;YAC7D,MAAM,IAAI,KAAK,CACb,iDAAiD,IAAI,CAAC,QAAQ,uCAAuC,oBAAoB,cAAc,CACxI,CAAC;QACJ,CAAC;QACD,OAAO,SAAS,CAAC,IAAI,EAAE,CAAC;IAC1B,CAAC;IAED,aAAa,CAAC,QAAgB;QAC5B,OAAO;YACL,MAAM,EAAE,QAAQ;YAChB,KAAK,EAAE,QAAQ;YACf,QAAQ;YACR,aAAa,EAAE,sBAAsB;YACrC,QAAQ,EAAE,gBAAgB;YAC1B,KAAK,EAAE,EAAE;YACT,cAAc,EAAE,CAAC;YACjB,GAAG,CAAC,IAAI,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC;SAC7D,CAAC;IACJ,CAAC;IAED,QAAQ,CAAC,QAAgB;QACvB,OAAO;YACL,MAAM,EAAE,QAAQ;YAChB,QAAQ;YACR,YAAY,EAAE,EAAE;YAChB,QAAQ,EAAE,gBAAgB;YAC1B,WAAW,EAAE,EAAE;YACf,KAAK,EAAE,EAAE;YACT,cAAc,EAAE,EAAE;YAClB,SAAS,EAAE,iBAAiB;YAC5B,OAAO,EAAE,IAAI,CAAC,QAAQ;YACtB,GAAG,CAAC,IAAI,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC;SAC7D,CAAC;IACJ,CAAC;CACF"}

package/dist/server/daemon/kernel/remote-connector.d.ts

@@ -0,0 +1,29 @@
+import type { RemoteAccess } from "./remote-access.js";
+import { type LocalHttp } from "./remote-http.js";
+export type Backoff = {
+    readonly baseMs: number;
+    readonly maxMs: number;
+};
+export type RemoteConnectorOptions = {
+    readonly access: RemoteAccess;
+    /** The daemon's unix socket (what `ensure()` waits on). */
+    readonly sockPath: string;
+    readonly http: LocalHttp;
+    readonly backoff?: Backoff;
+    /** 0..1, for tests. */
+    readonly random?: () => number;
+    readonly keepaliveMs?: number;
+    /** Give up on a control handshake that neither opens nor fails. */
+    readonly connectTimeoutMs?: number;
+};
+export declare class RemoteConnector {
+    #private;
+    constructor(options: RemoteConnectorOptions);
+    /** The control socket is open. */
+    get connected(): boolean;
+    get running(): boolean;
+    start(): void;
+    /** Closes every socket and ends the loop. Resolves once the loop has unwound. */
+    stop(): Promise<void>;
+}
+//# sourceMappingURL=remote-connector.d.ts.map

package/dist/server/daemon/kernel/remote-connector.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"remote-connector.d.ts","sourceRoot":"","sources":["../../../../src/server/daemon/kernel/remote-connector.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AACvD,OAAO,EAAc,KAAK,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAE9D,MAAM,MAAM,OAAO,GAAG;IAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAE1E,MAAM,MAAM,sBAAsB,GAAG;IACnC,QAAQ,CAAC,MAAM,EAAE,YAAY,CAAC;IAC9B,2DAA2D;IAC3D,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IACzB,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC;IAC3B,uBAAuB;IACvB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,MAAM,CAAC;IAC/B,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,mEAAmE;IACnE,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;CACpC,CAAC;AA4CF,qBAAa,eAAe;;gBAkBd,OAAO,EAAE,sBAAsB;IAU3C,kCAAkC;IAClC,IAAI,SAAS,IAAI,OAAO,CAEvB;IAED,IAAI,OAAO,IAAI,OAAO,CAErB;IAED,KAAK,IAAI,IAAI;IAOb,iFAAiF;IAC3E,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;CA6W5B"}