@knpkv/control-center 0.1.0

package/dist/server/server/runtime/NodeTransport.d.ts

@@ -0,0 +1,57 @@
+import * as NodeServices from "@effect/platform-node/NodeServices";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as Schema from "effect/Schema";
+import type * as Etag from "effect/unstable/http/Etag";
+import type * as HttpPlatform from "effect/unstable/http/HttpPlatform";
+import type * as HttpServer from "effect/unstable/http/HttpServer";
+import type { ServeError } from "effect/unstable/http/HttpServerError";
+import type * as Http from "node:http";
+import type * as Https from "node:https";
+import { SecretStore } from "../secrets/SecretStore.js";
+import type { SecretStoreError } from "../secrets/SecretStoreError.js";
+import type { BindConfig } from "../security/BindConfig.js";
+type NodeServerServices = Etag.Generator | HttpPlatform.HttpPlatform | HttpServer.HttpServer | NodeServices.NodeServices;
+declare const DirectTlsServerError_base: Schema.Class<DirectTlsServerError, Schema.TaggedStruct<"DirectTlsServerError", {
+    readonly reason: Schema.Literals<readonly ["material-missing", "material-invalid"]>;
+}>, import("effect/Cause").YieldableError>;
+/** Direct TLS configuration could not be turned into an HTTPS server. */
+export declare class DirectTlsServerError extends DirectTlsServerError_base {
+}
+/** Runtime transport selected from a previously decoded bind policy. */
+export type ControlCenterTransportProtocol = "http" | "https";
+/** Node parser and connection budgets applied before Effect route handling. */
+export interface NodeListenerSecurityPolicy {
+    readonly maximumHeaderBytes: number;
+    readonly maximumHeaderCount: number;
+    readonly headersTimeoutMilliseconds: number;
+    readonly requestTimeoutMilliseconds: number;
+}
+/** Conservative listener-level budgets shared by HTTP and direct TLS. */
+export declare const NODE_LISTENER_SECURITY_POLICY: NodeListenerSecurityPolicy;
+/** Return the listener protocol implied by the validated transport policy. */
+export declare const controlCenterTransportProtocol: (bindConfig: BindConfig) => ControlCenterTransportProtocol;
+/** Construct HTTPS while releasing source secret leases as soon as Node has parsed them. */
+export declare const makeDirectTlsNodeServer: (bindConfig: Schema.Struct.ReadonlySide<{
+    readonly host: Schema.brand<Schema.String, "BindHost">;
+    readonly port: Schema.Number;
+    readonly publicOrigin: Schema.brand<Schema.String, "OriginString">;
+    readonly allowedHosts: Schema.$Array<Schema.brand<Schema.String, "HostToken">>;
+    readonly allowedOrigins: Schema.$Array<Schema.brand<Schema.String, "OriginString">>;
+    readonly transportPolicy: Schema.Literals<readonly ["loopback-http", "direct-tls", "trusted-tls-proxy", "insecure-lan"]>;
+    readonly directTls: Schema.NullOr<Schema.Struct<{
+        readonly certificateRef: Schema.brand<Schema.String, "SecretRef">;
+        readonly privateKeyRef: Schema.brand<Schema.String, "SecretRef">;
+    }>>;
+    readonly trustedProxyAddresses: Schema.$Array<Schema.brand<Schema.String, "ProxyAddress">>;
+    readonly cookieSecure: Schema.Boolean;
+    readonly lanAdministrationAllowed: Schema.Boolean;
+}, "Type">) => Effect.Effect<Https.Server<typeof Http.IncomingMessage, typeof Http.ServerResponse>, SecretStoreError | DirectTlsServerError, SecretStore>;
+/** Build the Node listener required by the validated transport mode. */
+export declare const makeNodeTransportLayer: (bindConfig: BindConfig) => Layer.Layer<NodeServerServices, DirectTlsServerError | SecretStoreError | ServeError, SecretStore>;
+/** Node platform services used to acquire the owner-only secret store before listening. */
+export declare const nodeSecretPlatformLayer: Layer.Layer<NodeServices.NodeServices, never, never>;
+/** Node outbound HTTP client used by first-party provider adapters. */
+export declare const nodeOutboundHttpClientLayer: Layer.Layer<import("effect/unstable/http/HttpClient").HttpClient, never, never>;
+export {};
+//# sourceMappingURL=NodeTransport.d.ts.map

package/dist/server/server/runtime/NodeTransport.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"NodeTransport.d.ts","sourceRoot":"","sources":["../../../../src/server/runtime/NodeTransport.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,YAAY,MAAM,oCAAoC,CAAA;AAClE,OAAO,KAAK,MAAM,MAAM,eAAe,CAAA;AACvC,OAAO,KAAK,KAAK,MAAM,cAAc,CAAA;AACrC,OAAO,KAAK,MAAM,MAAM,eAAe,CAAA;AACvC,OAAO,KAAK,KAAK,IAAI,MAAM,2BAA2B,CAAA;AACtD,OAAO,KAAK,KAAK,YAAY,MAAM,mCAAmC,CAAA;AACtE,OAAO,KAAK,KAAK,UAAU,MAAM,iCAAiC,CAAA;AAClE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,sCAAsC,CAAA;AAEtE,OAAO,KAAK,KAAK,IAAI,MAAM,WAAW,CAAA;AAEtC,OAAO,KAAK,KAAK,KAAK,MAAM,YAAY,CAAA;AAIxC,OAAO,EAAE,WAAW,EAAE,MAAM,2BAA2B,CAAA;AACvD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,gCAAgC,CAAA;AACtE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,2BAA2B,CAAA;AAE3D,KAAK,kBAAkB,GACnB,IAAI,CAAC,SAAS,GACd,YAAY,CAAC,YAAY,GACzB,UAAU,CAAC,UAAU,GACrB,YAAY,CAAC,YAAY,CAAA;;;;AAE7B,yEAAyE;AACzE,qBAAa,oBAAqB,SAAQ,yBAKzC;CAAG;AAEJ,wEAAwE;AACxE,MAAM,MAAM,8BAA8B,GAAG,MAAM,GAAG,OAAO,CAAA;AAE7D,+EAA+E;AAC/E,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAA;IACnC,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAA;IACnC,QAAQ,CAAC,0BAA0B,EAAE,MAAM,CAAA;IAC3C,QAAQ,CAAC,0BAA0B,EAAE,MAAM,CAAA;CAC5C;AAED,yEAAyE;AACzE,eAAO,MAAM,6BAA6B,EAAE,0BAK3C,CAAA;AAqBD,8EAA8E;AAC9E,eAAO,MAAM,8BAA8B,GACzC,YAAY,UAAU,KACrB,8BAAgG,CAAA;AAEnG,4FAA4F;AAC5F,eAAO,MAAM,uBAAuB;;;;;;;;;;;;;;yJAyClC,CAAA;AAEF,wEAAwE;AACxE,eAAO,MAAM,sBAAsB,GACjC,YAAY,UAAU,KACrB,KAAK,CAAC,KAAK,CACZ,kBAAkB,EAClB,oBAAoB,GAAG,gBAAgB,GAAG,UAAU,EACpD,WAAW,CAcZ,CAAA;AAED,2FAA2F;AAC3F,eAAO,MAAM,uBAAuB,sDAAqB,CAAA;AAEzD,uEAAuE;AACvE,eAAO,MAAM,2BAA2B,iFAA4B,CAAA"}

package/dist/server/server/runtime/ReleaseSynchronizationStartup.d.ts

@@ -0,0 +1,44 @@
+import * as Context from "effect/Context";
+import type * as Crypto from "effect/Crypto";
+import * as Layer from "effect/Layer";
+import * as Schema from "effect/Schema";
+import type { ReleaseId } from "../../domain/identifiers.js";
+import { type ReleaseSynchronizationFailure, type ReleaseSynchronizationInput, type ReleaseSynchronizationOutcome } from "../application/releaseSynchronization.js";
+import { Persistence, type PersistenceOperationFailure } from "../persistence/Persistence.js";
+import { type PluginConnectionMapV1 } from "../plugins/PluginConnectionMap.js";
+import { ControlCenterBootstrap } from "./Bootstrap.js";
+import type { DomainEventWakeups } from "./DomainEventWakeups.js";
+import { type ServerDraining, ServerLifecycle } from "./ServerLifecycle.js";
+/** Explicit configured startup synchronization; absent options keep normal runtime startup inert. */
+export interface ReleaseSynchronizationStartupOptions {
+    readonly input: ReleaseSynchronizationInput;
+    readonly pluginConnections: PluginConnectionMapV1;
+}
+declare const ReleaseSynchronizationStartupConfigurationError_base: Schema.Class<ReleaseSynchronizationStartupConfigurationError, Schema.TaggedStruct<"ReleaseSynchronizationStartupConfigurationError", {
+    readonly diagnosticCode: Schema.Literals<readonly ["bootstrap-disabled", "workspace-mismatch"]>;
+}>, import("effect/Cause").YieldableError>;
+/** Bounded startup configuration mismatch that must be fixed before listening. */
+export declare class ReleaseSynchronizationStartupConfigurationError extends ReleaseSynchronizationStartupConfigurationError_base {
+}
+/** Startup synchronization state retained for diagnostics and runtime tests. */
+export type ReleaseSynchronizationStartupState = {
+    readonly _tag: "disabled";
+} | {
+    readonly _tag: "connection-disabled";
+    readonly reconciledAttempts: number;
+} | {
+    readonly _tag: "completed";
+    readonly outcome: ReleaseSynchronizationOutcome;
+    readonly reconciledAttempts: number;
+};
+declare const ReleaseSynchronizationStartup_base: Context.ServiceClass<ReleaseSynchronizationStartup, "@knpkv/control-center/server/runtime/ReleaseSynchronizationStartup", ReleaseSynchronizationStartupState>;
+/** Startup synchronization result, available only inside the server composition. */
+export declare class ReleaseSynchronizationStartup extends ReleaseSynchronizationStartup_base {
+}
+export type ReleaseSynchronizationStartupError = PersistenceOperationFailure | ReleaseSynchronizationFailure | ServerDraining | ReleaseSynchronizationStartupConfigurationError;
+/** Build the ordered optional startup service after workspace bootstrap. */
+export declare const releaseSynchronizationStartupLayer: (options: ReleaseSynchronizationStartupOptions | null) => Layer.Layer<ReleaseSynchronizationStartup, ReleaseSynchronizationStartupError, ControlCenterBootstrap | Crypto.Crypto | DomainEventWakeups | Persistence | ServerLifecycle>;
+/** Read the projected release identity without exposing provider runtime internals. */
+export declare const releaseIdFromStartupState: (state: ReleaseSynchronizationStartupState) => ReleaseId | null;
+export {};
+//# sourceMappingURL=ReleaseSynchronizationStartup.d.ts.map

package/dist/server/server/runtime/ReleaseSynchronizationStartup.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ReleaseSynchronizationStartup.d.ts","sourceRoot":"","sources":["../../../../src/server/runtime/ReleaseSynchronizationStartup.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,OAAO,MAAM,gBAAgB,CAAA;AACzC,OAAO,KAAK,KAAK,MAAM,MAAM,eAAe,CAAA;AAE5C,OAAO,KAAK,KAAK,MAAM,cAAc,CAAA;AACrC,OAAO,KAAK,MAAM,MAAM,eAAe,CAAA;AAEvC,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,6BAA6B,CAAA;AAC5D,OAAO,EAGL,KAAK,6BAA6B,EAClC,KAAK,2BAA2B,EAChC,KAAK,6BAA6B,EAEnC,MAAM,0CAA0C,CAAA;AACjD,OAAO,EAAE,WAAW,EAAE,KAAK,2BAA2B,EAAE,MAAM,+BAA+B,CAAA;AAC7F,OAAO,EAAuB,KAAK,qBAAqB,EAAE,MAAM,mCAAmC,CAAA;AACnG,OAAO,EAAE,sBAAsB,EAAE,MAAM,gBAAgB,CAAA;AACvD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAA;AACjE,OAAO,EAAE,KAAK,cAAc,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAA;AAE3E,qGAAqG;AACrG,MAAM,WAAW,oCAAoC;IACnD,QAAQ,CAAC,KAAK,EAAE,2BAA2B,CAAA;IAC3C,QAAQ,CAAC,iBAAiB,EAAE,qBAAqB,CAAA;CAClD;;;;AAED,kFAAkF;AAClF,qBAAa,+CAAgD,SAAQ,oDAOnE;CAAG;AAEL,gFAAgF;AAChF,MAAM,MAAM,kCAAkC,GAC1C;IAAE,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAA;CAAE,GAC7B;IAAE,QAAQ,CAAC,IAAI,EAAE,qBAAqB,CAAC;IAAC,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAA;CAAE,GAC7E;IACA,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAA;IAC1B,QAAQ,CAAC,OAAO,EAAE,6BAA6B,CAAA;IAC/C,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAA;CACpC,CAAA;;AAEH,oFAAoF;AACpF,qBAAa,6BAA8B,SAAQ,kCAGsB;CAAG;AAE5E,MAAM,MAAM,kCAAkC,GAC1C,2BAA2B,GAC3B,6BAA6B,GAC7B,cAAc,GACd,+CAA+C,CAAA;AAmCnD,4EAA4E;AAC5E,eAAO,MAAM,kCAAkC,GAC7C,SAAS,oCAAoC,GAAG,IAAI,KACnD,KAAK,CAAC,KAAK,CACZ,6BAA6B,EAC7B,kCAAkC,EAClC,sBAAsB,GAAG,MAAM,CAAC,MAAM,GAAG,kBAAkB,GAAG,WAAW,GAAG,eAAe,CAIA,CAAA;AAE7F,uFAAuF;AACvF,eAAO,MAAM,yBAAyB,GACpC,OAAO,kCAAkC,KACxC,SAAS,GAAG,IAAmE,CAAA"}

package/dist/server/server/runtime/RequestUrlBoundary.d.ts

@@ -0,0 +1,4 @@
+import * as HttpRouter from "effect/unstable/http/HttpRouter";
+/** Reject oversized UTF-8 request targets before route selection or body work. */
+export declare const requestUrlBoundaryLayer: import("effect/Layer").Layer<never, never, HttpRouter.HttpRouter>;
+//# sourceMappingURL=RequestUrlBoundary.d.ts.map

package/dist/server/server/runtime/RequestUrlBoundary.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"RequestUrlBoundary.d.ts","sourceRoot":"","sources":["../../../../src/server/runtime/RequestUrlBoundary.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,UAAU,MAAM,iCAAiC,CAAA;AAO7D,kFAAkF;AAClF,eAAO,MAAM,uBAAuB,mEAenC,CAAA"}

package/dist/server/server/runtime/ServerLifecycle.d.ts

@@ -0,0 +1,74 @@
+import * as Cause from "effect/Cause";
+import * as Context from "effect/Context";
+import type * as Duration from "effect/Duration";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as Schema from "effect/Schema";
+import type * as Scope from "effect/Scope";
+/** Whether this process still accepts work that can change durable state. */
+export type ServerLifecyclePhase = "accepting" | "draining";
+declare const ServerDraining_base: Schema.Class<ServerDraining, Schema.TaggedStruct<"ServerDraining", {}>, Cause.YieldableError>;
+/** New work reached the process after graceful drain had begun. */
+export declare class ServerDraining extends ServerDraining_base {
+}
+declare const ServerDrainHookConflict_base: Schema.Class<ServerDrainHookConflict, Schema.TaggedStruct<"ServerDrainHookConflict", {
+    readonly hookId: Schema.String;
+}>, Cause.YieldableError>;
+/** Two live subsystems attempted to own the same drain hook identity. */
+export declare class ServerDrainHookConflict extends ServerDrainHookConflict_base {
+}
+/** A secret-free result for the complete work-and-flush drain sequence. */
+export type ServerDrainResult = {
+    readonly _tag: "Drained";
+} | {
+    readonly _tag: "DeadlineExceeded";
+} | {
+    readonly _tag: "HooksFailed";
+    readonly hookIds: ReadonlyArray<string>;
+};
+interface ServerDrainHook {
+    readonly hookId: string;
+    readonly run: Effect.Effect<void>;
+}
+interface ServerLifecycleService {
+    /** Move to draining exactly once and wake every drain observer. */
+    readonly beginDrain: Effect.Effect<void>;
+    /** Complete when graceful drain has begun. */
+    readonly awaitDrain: Effect.Effect<void>;
+    /** Complete after drain begins and every admitted mutation has finished. */
+    readonly awaitMutationsDrained: Effect.Effect<void>;
+    /** Complete after drain begins and every admitted mutation or background job has finished. */
+    readonly awaitWorkDrained: Effect.Effect<void>;
+    /** Begin drain and report the complete work-and-flush result before the deadline. */
+    readonly drainWithin: (duration: Duration.Input) => Effect.Effect<ServerDrainResult>;
+    /** Current lifecycle phase for diagnostics and deterministic tests. */
+    readonly phase: Effect.Effect<ServerLifecyclePhase>;
+    /** Reject new mutations after drain, while retaining admitted work until it exits. */
+    readonly runMutation: <A, E, R>(effect: Effect.Effect<A, E, R>) => Effect.Effect<A, E | ServerDraining, R>;
+    /** Reject new background jobs after drain, while retaining admitted jobs until they exit. */
+    readonly runBackground: <A, E, R>(effect: Effect.Effect<A, E, R>) => Effect.Effect<A, E | ServerDraining, R>;
+    /** Retain one named, infallible flush hook for this server scope. */
+    readonly registerDrainHook: (hook: ServerDrainHook) => Effect.Effect<void, ServerDrainHookConflict | ServerDraining, Scope.Scope>;
+    /** Atomically retain a long-lived stream only while the process is accepting work. */
+    readonly acquireStream: Effect.Effect<void, ServerDraining, Scope.Scope>;
+}
+declare const ServerLifecycle_base: Context.ServiceClass<ServerLifecycle, "@knpkv/control-center/server/runtime/ServerLifecycle", ServerLifecycleService>;
+/** Shared lifecycle boundary for HTTP mutations, streams, and background work. */
+export declare class ServerLifecycle extends ServerLifecycle_base {
+    /** Construct an isolated lifecycle for tests and explicit embedding. */
+    static readonly make: Effect.Effect<{
+        beginDrain: Effect.Effect<void, never, never>;
+        awaitDrain: Effect.Effect<void, never, never>;
+        awaitMutationsDrained: Effect.Effect<void, never, never>;
+        awaitWorkDrained: Effect.Effect<void, never, never>;
+        drainWithin: (duration: Duration.Input) => Effect.Effect<ServerDrainResult, never, never>;
+        phase: Effect.Effect<ServerLifecyclePhase, never, never>;
+        runMutation: <A, E, R>(effect: Effect.Effect<A, E, R>) => Effect.Effect<A, ServerDraining | E, R>;
+        runBackground: <A, E, R>(effect: Effect.Effect<A, E, R>) => Effect.Effect<A, ServerDraining | E, R>;
+        registerDrainHook: (hook: ServerDrainHook) => Effect.Effect<void, ServerDrainHookConflict | ServerDraining, Scope.Scope>;
+        acquireStream: Effect.Effect<void, ServerDraining, Scope.Scope>;
+    }, never, never>;
+    static readonly layer: Layer.Layer<ServerLifecycle, never, never>;
+}
+export {};
+//# sourceMappingURL=ServerLifecycle.d.ts.map

package/dist/server/server/runtime/ServerLifecycle.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ServerLifecycle.d.ts","sourceRoot":"","sources":["../../../../src/server/runtime/ServerLifecycle.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,KAAK,MAAM,cAAc,CAAA;AACrC,OAAO,KAAK,OAAO,MAAM,gBAAgB,CAAA;AAEzC,OAAO,KAAK,KAAK,QAAQ,MAAM,iBAAiB,CAAA;AAChD,OAAO,KAAK,MAAM,MAAM,eAAe,CAAA;AACvC,OAAO,KAAK,KAAK,MAAM,cAAc,CAAA;AAGrC,OAAO,KAAK,MAAM,MAAM,eAAe,CAAA;AACvC,OAAO,KAAK,KAAK,KAAK,MAAM,cAAc,CAAA;AAE1C,6EAA6E;AAC7E,MAAM,MAAM,oBAAoB,GAAG,WAAW,GAAG,UAAU,CAAA;;AAE3D,mEAAmE;AACnE,qBAAa,cAAe,SAAQ,mBAGnC;CAAG;;;;AAEJ,yEAAyE;AACzE,qBAAa,uBAAwB,SAAQ,4BAG5C;CAAG;AAEJ,2EAA2E;AAC3E,MAAM,MAAM,iBAAiB,GACzB;IAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAA;CAAE,GAC5B;IAAE,QAAQ,CAAC,IAAI,EAAE,kBAAkB,CAAA;CAAE,GACrC;IAAE,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC,MAAM,CAAC,CAAA;CAAE,CAAA;AAE7E,UAAU,eAAe;IACvB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;CAClC;AAqBD,UAAU,sBAAsB;IAC9B,mEAAmE;IACnE,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;IACxC,8CAA8C;IAC9C,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;IACxC,4EAA4E;IAC5E,QAAQ,CAAC,qBAAqB,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;IACnD,8FAA8F;IAC9F,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;IAC9C,qFAAqF;IACrF,QAAQ,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE,QAAQ,CAAC,KAAK,KAAK,MAAM,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAA;IACpF,uEAAuE;IACvE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,oBAAoB,CAAC,CAAA;IACnD,sFAAsF;IACtF,QAAQ,CAAC,WAAW,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAC5B,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,KAC3B,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,GAAG,cAAc,EAAE,CAAC,CAAC,CAAA;IAC5C,6FAA6F;IAC7F,QAAQ,CAAC,aAAa,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAC9B,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,KAC3B,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,GAAG,cAAc,EAAE,CAAC,CAAC,CAAA;IAC5C,qEAAqE;IACrE,QAAQ,CAAC,iBAAiB,EAAE,CAC1B,IAAI,EAAE,eAAe,KAClB,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,uBAAuB,GAAG,cAAc,EAAE,KAAK,CAAC,KAAK,CAAC,CAAA;IAC/E,sFAAsF;IACtF,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,cAAc,EAAE,KAAK,CAAC,KAAK,CAAC,CAAA;CACzE;;AA+MD,kFAAkF;AAClF,qBAAa,eAAgB,SAAQ,oBAEpC;IACC,wEAAwE;IACxE,MAAM,CAAC,QAAQ,CAAC,IAAI;;;;;gCAvEW,QAAQ,CAAC,KAAK;;sBA+C7B,CAAC,EAAE,CAAC,EAAE,CAAC,UAAU,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;wBAQrC,CAAC,EAAE,CAAC,EAAE,CAAC,UAAU,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;kCA5CjD,eAAe,KACpB,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,uBAAuB,GAAG,cAAc,EAAE,KAAK,CAAC,KAAK,CAAC;;qBA2DjC;IAE5C,MAAM,CAAC,QAAQ,CAAC,KAAK,6CAAsD;CAC5E"}

package/dist/server/server/runtime/index.d.ts

@@ -0,0 +1,9 @@
+/** Runnable Node server composition and startup bootstrap. @packageDocumentation */
+export { ControlCenterBootstrap, type ControlCenterBootstrapError, controlCenterBootstrapLayer, type ControlCenterBootstrapOptions, type ControlCenterBootstrapState, makeControlCenterBootstrap } from "./Bootstrap.js";
+export { type ControlCenterServerError, type ControlCenterServerOptions, makeControlCenterApplication, makeControlCenterServer } from "./ControlCenterServer.js";
+export { DomainEventWakeups } from "./DomainEventWakeups.js";
+export { type ControlCenterTransportProtocol, controlCenterTransportProtocol, DirectTlsServerError, makeNodeTransportLayer, NODE_LISTENER_SECURITY_POLICY, type NodeListenerSecurityPolicy } from "./NodeTransport.js";
+export { releaseIdFromStartupState, ReleaseSynchronizationStartup, ReleaseSynchronizationStartupConfigurationError, type ReleaseSynchronizationStartupError, releaseSynchronizationStartupLayer, type ReleaseSynchronizationStartupOptions, type ReleaseSynchronizationStartupState } from "./ReleaseSynchronizationStartup.js";
+export { requestUrlBoundaryLayer } from "./RequestUrlBoundary.js";
+export { ServerDraining, ServerLifecycle, type ServerLifecyclePhase } from "./ServerLifecycle.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/server/server/runtime/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/server/runtime/index.ts"],"names":[],"mappings":"AAAA,oFAAoF;AACpF,OAAO,EACL,sBAAsB,EACtB,KAAK,2BAA2B,EAChC,2BAA2B,EAC3B,KAAK,6BAA6B,EAClC,KAAK,2BAA2B,EAChC,0BAA0B,EAC3B,MAAM,gBAAgB,CAAA;AACvB,OAAO,EACL,KAAK,wBAAwB,EAC7B,KAAK,0BAA0B,EAC/B,4BAA4B,EAC5B,uBAAuB,EACxB,MAAM,0BAA0B,CAAA;AACjC,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAA;AAC5D,OAAO,EACL,KAAK,8BAA8B,EACnC,8BAA8B,EAC9B,oBAAoB,EACpB,sBAAsB,EACtB,6BAA6B,EAC7B,KAAK,0BAA0B,EAChC,MAAM,oBAAoB,CAAA;AAC3B,OAAO,EACL,yBAAyB,EACzB,6BAA6B,EAC7B,+CAA+C,EAC/C,KAAK,kCAAkC,EACvC,kCAAkC,EAClC,KAAK,oCAAoC,EACzC,KAAK,kCAAkC,EACxC,MAAM,oCAAoC,CAAA;AAC3C,OAAO,EAAE,uBAAuB,EAAE,MAAM,yBAAyB,CAAA;AACjE,OAAO,EAAE,cAAc,EAAE,eAAe,EAAE,KAAK,oBAAoB,EAAE,MAAM,sBAAsB,CAAA"}

package/dist/server/server/secrets/SecretRef.d.ts

@@ -0,0 +1,6 @@
+import { Schema } from "effect";
+/** Opaque identifier for an owner-only secret. It never contains secret bytes. */
+export declare const SecretRef: Schema.brand<Schema.String, "SecretRef">;
+/** Decoded opaque secret identifier. */
+export type SecretRef = typeof SecretRef.Type;
+//# sourceMappingURL=SecretRef.d.ts.map

package/dist/server/server/secrets/SecretRef.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"SecretRef.d.ts","sourceRoot":"","sources":["../../../../src/server/secrets/SecretRef.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAA;AAI/B,kFAAkF;AAClF,eAAO,MAAM,SAAS,0CAEW,CAAA;AAEjC,wCAAwC;AACxC,MAAM,MAAM,SAAS,GAAG,OAAO,SAAS,CAAC,IAAI,CAAA"}

package/dist/server/server/secrets/SecretStore.d.ts

@@ -0,0 +1,39 @@
+import type { Scope } from "effect";
+import { Context, Crypto, Effect, FileSystem, Layer, Path, Schema } from "effect";
+import { SecretRef } from "./SecretRef.js";
+import { type SecretStoreError } from "./SecretStoreError.js";
+/** Absolute owner-controlled directory for secret values. */
+export declare const SecretRoot: Schema.brand<Schema.String, "SecretRoot">;
+/** Decoded owner-controlled secret root. */
+export type SecretRoot = typeof SecretRoot.Type;
+/** Construction options. Values remain bounded even when callers omit the limit. */
+export interface SecretStoreOptions {
+    readonly secretRoot: SecretRoot;
+    readonly maximumSecretBytes?: number | undefined;
+}
+/**
+ * Scoped access to one secret value. The backing bytes are zeroed when the
+ * surrounding Effect scope closes and are intentionally not serializable.
+ */
+export interface SecretLease {
+    readonly byteLength: number;
+    readonly withBytes: <A, E, R>(use: (bytes: Uint8Array) => Effect.Effect<A, E, R>) => Effect.Effect<A, E, R>;
+    readonly toJSON: () => "[REDACTED]";
+    readonly toString: () => "[REDACTED]";
+}
+interface SecretStoreService {
+    readonly create: (value: Uint8Array) => Effect.Effect<SecretRef, SecretStoreError>;
+    /** Publish a replacement generation while retaining the old reference for active leases. */
+    readonly rotate: (ref: SecretRef, value: Uint8Array) => Effect.Effect<SecretRef, SecretStoreError>;
+    readonly remove: (ref: SecretRef) => Effect.Effect<void, SecretStoreError>;
+    readonly resolve: (ref: SecretRef) => Effect.Effect<SecretLease, SecretStoreError, Scope.Scope>;
+}
+declare const SecretStore_base: Context.ServiceClass<SecretStore, "@knpkv/control-center/server/secrets/SecretStore", SecretStoreService>;
+/** Owner-only, reference-based storage with scoped secret resolution. */
+export declare class SecretStore extends SecretStore_base {
+    static readonly layer: (options: SecretStoreOptions) => Layer.Layer<SecretStore, SecretStoreError, Crypto.Crypto | FileSystem.FileSystem | Path.Path>;
+}
+/** Constructs a store while capturing all runtime services in its layer. */
+export declare const makeSecretStore: (options: SecretStoreOptions) => Effect.Effect<SecretStore["Service"], SecretStoreError, Crypto.Crypto | FileSystem.FileSystem | Path.Path>;
+export {};
+//# sourceMappingURL=SecretStore.d.ts.map

package/dist/server/server/secrets/SecretStore.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"SecretStore.d.ts","sourceRoot":"","sources":["../../../../src/server/secrets/SecretStore.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAgC,KAAK,EAAE,MAAM,QAAQ,CAAA;AACjE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,KAAK,EAAU,IAAI,EAA0B,MAAM,EAAE,MAAM,QAAQ,CAAA;AAEjH,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAA;AAC1C,OAAO,EAGL,KAAK,gBAAgB,EAItB,MAAM,uBAAuB,CAAA;AAqB9B,6DAA6D;AAC7D,eAAO,MAAM,UAAU,2CAMW,CAAA;AAElC,4CAA4C;AAC5C,MAAM,MAAM,UAAU,GAAG,OAAO,UAAU,CAAC,IAAI,CAAA;AAE/C,oFAAoF;AACpF,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,UAAU,EAAE,UAAU,CAAA;IAC/B,QAAQ,CAAC,kBAAkB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;CACjD;AAED;;;GAGG;AACH,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,SAAS,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAC1B,GAAG,EAAE,CAAC,KAAK,EAAE,UAAU,KAAK,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,KAC/C,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAA;IAC3B,QAAQ,CAAC,MAAM,EAAE,MAAM,YAAY,CAAA;IACnC,QAAQ,CAAC,QAAQ,EAAE,MAAM,YAAY,CAAA;CACtC;AAED,UAAU,kBAAkB;IAC1B,QAAQ,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,UAAU,KAAK,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,gBAAgB,CAAC,CAAA;IAClF,4FAA4F;IAC5F,QAAQ,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,SAAS,EAAE,KAAK,EAAE,UAAU,KAAK,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,gBAAgB,CAAC,CAAA;IAClG,QAAQ,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,SAAS,KAAK,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,gBAAgB,CAAC,CAAA;IAC1E,QAAQ,CAAC,OAAO,EAAE,CAChB,GAAG,EAAE,SAAS,KACX,MAAM,CAAC,MAAM,CAAC,WAAW,EAAE,gBAAgB,EAAE,KAAK,CAAC,KAAK,CAAC,CAAA;CAC/D;;AAED,yEAAyE;AACzE,qBAAa,WAAY,SAAQ,gBAEhC;IACC,MAAM,CAAC,QAAQ,CAAC,KAAK,GACnB,SAAS,kBAAkB,KAC1B,KAAK,CAAC,KAAK,CAAC,WAAW,EAAE,gBAAgB,EAAE,MAAM,CAAC,MAAM,GAAG,UAAU,CAAC,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,CAC3C;CACtD;AAgCD,4EAA4E;AAC5E,eAAO,MAAM,eAAe,EAAE,CAC5B,OAAO,EAAE,kBAAkB,KACxB,MAAM,CAAC,MAAM,CAChB,WAAW,CAAC,SAAS,CAAC,EACtB,gBAAgB,EAChB,MAAM,CAAC,MAAM,GAAG,UAAU,CAAC,UAAU,GAAG,IAAI,CAAC,IAAI,CAobjD,CAAA"}

package/dist/server/server/secrets/SecretStoreError.d.ts

@@ -0,0 +1,41 @@
+import { Schema } from "effect";
+declare const SecretStoreInputError_base: Schema.Class<SecretStoreInputError, Schema.TaggedStruct<"SecretStoreInputError", {
+    readonly operation: Schema.String;
+    readonly message: Schema.String;
+}>, import("effect/Cause").YieldableError>;
+/** A secret-store option or reference did not satisfy the storage contract. */
+export declare class SecretStoreInputError extends SecretStoreInputError_base {
+}
+declare const SecretNotFoundError_base: Schema.Class<SecretNotFoundError, Schema.TaggedStruct<"SecretNotFoundError", {
+    readonly ref: Schema.brand<Schema.String, "SecretRef">;
+}>, import("effect/Cause").YieldableError>;
+/** The requested opaque reference has no stored value. */
+export declare class SecretNotFoundError extends SecretNotFoundError_base {
+}
+declare const SecretTooLargeError_base: Schema.Class<SecretTooLargeError, Schema.TaggedStruct<"SecretTooLargeError", {
+    readonly actualBytes: Schema.Number;
+    readonly maximumBytes: Schema.Number;
+}>, import("effect/Cause").YieldableError>;
+/** A secret value exceeded the store's configured byte bound. */
+export declare class SecretTooLargeError extends SecretTooLargeError_base {
+}
+declare const SecretProtectionError_base: Schema.Class<SecretProtectionError, Schema.TaggedStruct<"SecretProtectionError", {
+    readonly operation: Schema.String;
+    readonly message: Schema.String;
+}>, import("effect/Cause").YieldableError>;
+/** A path, entry, owner, or mode violated the owner-only storage boundary. */
+export declare class SecretProtectionError extends SecretProtectionError_base {
+}
+declare const SecretStoreIoError_base: Schema.Class<SecretStoreIoError, Schema.TaggedStruct<"SecretStoreIoError", {
+    readonly operation: Schema.String;
+    readonly message: Schema.String;
+}>, import("effect/Cause").YieldableError>;
+/** The platform secret-storage operation failed. */
+export declare class SecretStoreIoError extends SecretStoreIoError_base {
+}
+/** Redacts platform details, paths, and values at the storage boundary. */
+export declare const secretStoreIoError: (operation: string, _cause: unknown) => SecretStoreIoError;
+/** Typed, structurally redacted failures exposed by the secret-store boundary. */
+export type SecretStoreError = SecretNotFoundError | SecretProtectionError | SecretStoreInputError | SecretStoreIoError | SecretTooLargeError;
+export {};
+//# sourceMappingURL=SecretStoreError.d.ts.map

package/dist/server/server/secrets/SecretStoreError.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"SecretStoreError.d.ts","sourceRoot":"","sources":["../../../../src/server/secrets/SecretStoreError.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAA;;;;;AAI/B,+EAA+E;AAC/E,qBAAa,qBAAsB,SAAQ,0BAG1C;CAAG;;;;AAEJ,0DAA0D;AAC1D,qBAAa,mBAAoB,SAAQ,wBAGxC;CAAG;;;;;AAEJ,iEAAiE;AACjE,qBAAa,mBAAoB,SAAQ,wBAMxC;CAAG;;;;;AAEJ,8EAA8E;AAC9E,qBAAa,qBAAsB,SAAQ,0BAG1C;CAAG;;;;;AAEJ,oDAAoD;AACpD,qBAAa,kBAAmB,SAAQ,uBAGvC;CAAG;AAEJ,2EAA2E;AAC3E,eAAO,MAAM,kBAAkB,GAAI,WAAW,MAAM,EAAE,QAAQ,OAAO,KAAG,kBACoB,CAAA;AAE5F,kFAAkF;AAClF,MAAM,MAAM,gBAAgB,GACxB,mBAAmB,GACnB,qBAAqB,GACrB,qBAAqB,GACrB,kBAAkB,GAClB,mBAAmB,CAAA"}

package/dist/server/server/secrets/index.d.ts

@@ -0,0 +1,5 @@
+/** Server-only owner-protected secret storage. */
+export * from "./SecretRef.js";
+export * from "./SecretStore.js";
+export * from "./SecretStoreError.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/server/server/secrets/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/server/secrets/index.ts"],"names":[],"mappings":"AAAA,kDAAkD;AAClD,cAAc,gBAAgB,CAAA;AAC9B,cAAc,kBAAkB,CAAA;AAChC,cAAc,uBAAuB,CAAA"}

package/dist/server/server/security/BindConfig.d.ts

@@ -0,0 +1,51 @@
+import { Effect, Schema } from "effect";
+/** Opaque references to the certificate and private key required by direct TLS. */
+export declare const DirectTlsMaterial: Schema.Struct<{
+    readonly certificateRef: Schema.brand<Schema.String, "SecretRef">;
+    readonly privateKeyRef: Schema.brand<Schema.String, "SecretRef">;
+}>;
+export type DirectTlsMaterial = typeof DirectTlsMaterial.Type;
+declare const BindConfigError_base: Schema.Class<BindConfigError, Schema.TaggedStruct<"BindConfigError", {
+    readonly reason: Schema.Literals<readonly ["invalid-input", "invalid-origin", "invalid-host-port", "lan-requires-public-origin", "lan-requires-host-allowlist", "lan-requires-origin-allowlist", "lan-requires-transport-policy", "conflicting-transport-policy", "public-origin-mismatch"]>;
+}>, import("effect/Cause").YieldableError>;
+/** A decoded bind configuration is invalid or would expose an ambiguous endpoint. */
+export declare class BindConfigError extends BindConfigError_base {
+}
+export declare const TransportPolicy: Schema.Literals<readonly ["loopback-http", "direct-tls", "trusted-tls-proxy", "insecure-lan"]>;
+export type TransportPolicy = typeof TransportPolicy.Type;
+export declare const BindConfig: Schema.Struct<{
+    readonly host: Schema.brand<Schema.String, "BindHost">;
+    readonly port: Schema.Number;
+    readonly publicOrigin: Schema.brand<Schema.String, "OriginString">;
+    readonly allowedHosts: Schema.$Array<Schema.brand<Schema.String, "HostToken">>;
+    readonly allowedOrigins: Schema.$Array<Schema.brand<Schema.String, "OriginString">>;
+    readonly transportPolicy: Schema.Literals<readonly ["loopback-http", "direct-tls", "trusted-tls-proxy", "insecure-lan"]>;
+    readonly directTls: Schema.NullOr<Schema.Struct<{
+        readonly certificateRef: Schema.brand<Schema.String, "SecretRef">;
+        readonly privateKeyRef: Schema.brand<Schema.String, "SecretRef">;
+    }>>;
+    readonly trustedProxyAddresses: Schema.$Array<Schema.brand<Schema.String, "ProxyAddress">>;
+    readonly cookieSecure: Schema.Boolean;
+    readonly lanAdministrationAllowed: Schema.Boolean;
+}>;
+export type BindConfig = typeof BindConfig.Type;
+/** Decode loopback-first bind configuration and reject ambiguous LAN exposure. */
+export declare const decodeBindConfig: (input: unknown) => Effect.Effect<Schema.Struct.ReadonlySide<{
+    readonly host: Schema.brand<Schema.String, "BindHost">;
+    readonly port: Schema.Number;
+    readonly publicOrigin: Schema.brand<Schema.String, "OriginString">;
+    readonly allowedHosts: Schema.$Array<Schema.brand<Schema.String, "HostToken">>;
+    readonly allowedOrigins: Schema.$Array<Schema.brand<Schema.String, "OriginString">>;
+    readonly transportPolicy: Schema.Literals<readonly ["loopback-http", "direct-tls", "trusted-tls-proxy", "insecure-lan"]>;
+    readonly directTls: Schema.NullOr<Schema.Struct<{
+        readonly certificateRef: Schema.brand<Schema.String, "SecretRef">;
+        readonly privateKeyRef: Schema.brand<Schema.String, "SecretRef">;
+    }>>;
+    readonly trustedProxyAddresses: Schema.$Array<Schema.brand<Schema.String, "ProxyAddress">>;
+    readonly cookieSecure: Schema.Boolean;
+    readonly lanAdministrationAllowed: Schema.Boolean;
+}, "Type">, BindConfigError, never>;
+/** Derive terminal-safe reachable URLs without printing wildcard bind addresses. */
+export declare const effectiveReachableUrls: (config: BindConfig, detectedPrivateAddresses: ReadonlyArray<string>) => ReadonlyArray<string>;
+export {};
+//# sourceMappingURL=BindConfig.d.ts.map

package/dist/server/server/security/BindConfig.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"BindConfig.d.ts","sourceRoot":"","sources":["../../../../src/server/security/BindConfig.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAA;AAoCvC,mFAAmF;AACnF,eAAO,MAAM,iBAAiB;;;EAG5B,CAAA;AAEF,MAAM,MAAM,iBAAiB,GAAG,OAAO,iBAAiB,CAAC,IAAI,CAAA;;;;AAa7D,qFAAqF;AACrF,qBAAa,eAAgB,SAAQ,oBAYnC;CAAG;AAEL,eAAO,MAAM,eAAe,gGAAwF,CAAA;AAEpH,MAAM,MAAM,eAAe,GAAG,OAAO,eAAe,CAAC,IAAI,CAAA;AAEzD,eAAO,MAAM,UAAU;;;;;;;;;;;;;;EAWrB,CAAA;AAEF,MAAM,MAAM,UAAU,GAAG,OAAO,UAAU,CAAC,IAAI,CAAA;AAgD/C,kFAAkF;AAClF,eAAO,MAAM,gBAAgB;;;;;;;;;;;;;;mCAwG3B,CAAA;AA8BF,oFAAoF;AACpF,eAAO,MAAM,sBAAsB,GACjC,QAAQ,UAAU,EAClB,0BAA0B,aAAa,CAAC,MAAM,CAAC,KAC9C,aAAa,CAAC,MAAM,CAgBtB,CAAA"}

package/dist/server/server/security/RequestSecurity.d.ts

@@ -0,0 +1,84 @@
+import { Crypto, Effect, Redacted, Schema } from "effect";
+import type { BindConfig } from "./BindConfig.js";
+export declare const RequestAccess: Schema.Literals<readonly ["public-pair", "authenticated-read"]>;
+export type RequestAccess = typeof RequestAccess.Type;
+export declare const InsecureLanCapability: Schema.Literals<readonly ["release-read", "release-action", "release-agent", "session-self-read", "provider-configuration", "policy-administration", "pairing-administration", "session-administration", "secret-inspection"]>;
+export type InsecureLanCapability = typeof InsecureLanCapability.Type;
+export declare const CsrfDigest: Schema.brand<Schema.String, "CsrfDigest">;
+export type CsrfDigest = typeof CsrfDigest.Type;
+export declare const CsrfToken: Schema.brand<Schema.String, "CsrfToken">;
+export type CsrfToken = typeof CsrfToken.Type;
+declare const RequestShape: Schema.Struct<{
+    readonly method: Schema.String;
+    readonly host: Schema.String;
+    readonly origin: Schema.Union<readonly [Schema.String, Schema.Null]>;
+    readonly csrfToken: Schema.Union<readonly [Schema.String, Schema.Null]>;
+    readonly forwardedHost: Schema.Union<readonly [Schema.String, Schema.Null]>;
+    readonly forwardedProto: Schema.Union<readonly [Schema.String, Schema.Null]>;
+    readonly remoteAddress: Schema.Union<readonly [Schema.String, Schema.Null]>;
+}>;
+export type RequestShape = typeof RequestShape.Type;
+export interface SessionCookiePolicy {
+    readonly name: "cc_session";
+    readonly httpOnly: true;
+    readonly sameSite: "strict";
+    readonly path: "/";
+    readonly secure: boolean;
+}
+/** A capability-bearing authenticated read checked by centralized middleware. */
+export interface AuthenticatedReadAuthorization {
+    readonly config: BindConfig;
+    readonly request: unknown;
+    readonly capability: InsecureLanCapability;
+}
+/** A capability-bearing mutation whose CSRF proof is verified at the authorization boundary. */
+export interface AuthenticatedMutationAuthorization {
+    readonly config: BindConfig;
+    readonly request: unknown;
+    readonly capability: InsecureLanCapability;
+}
+declare const RequestSecurityError_base: Schema.Class<RequestSecurityError, Schema.TaggedStruct<"RequestSecurityError", {
+    readonly reason: Schema.Literals<readonly ["invalid-request", "host-rejected", "origin-required", "origin-rejected", "csrf-required", "csrf-rejected", "method-mismatch", "proxy-rejected", "insecure-lan-capability-rejected"]>;
+}>, import("effect/Cause").YieldableError>;
+/** A request failed the same-origin/session transport policy. */
+export declare class RequestSecurityError extends RequestSecurityError_base {
+}
+/** Forwarded headers are authoritative only from an exact trusted proxy address. */
+export declare const effectiveRequestAuthority: (config: BindConfig, request: RequestShape) => {
+    readonly host: string;
+    readonly protocol: "http" | "https";
+};
+/** Authorize a public pairing mutation or an authenticated safe read. */
+export declare const authorizeRequest: (config: Schema.Struct.ReadonlySide<{
+    readonly host: Schema.brand<Schema.String, "BindHost">;
+    readonly port: Schema.Number;
+    readonly publicOrigin: Schema.brand<Schema.String, "OriginString">;
+    readonly allowedHosts: Schema.$Array<Schema.brand<Schema.String, "HostToken">>;
+    readonly allowedOrigins: Schema.$Array<Schema.brand<Schema.String, "OriginString">>;
+    readonly transportPolicy: Schema.Literals<readonly ["loopback-http", "direct-tls", "trusted-tls-proxy", "insecure-lan"]>;
+    readonly directTls: Schema.NullOr<Schema.Struct<{
+        readonly certificateRef: Schema.brand<Schema.String, "SecretRef">;
+        readonly privateKeyRef: Schema.brand<Schema.String, "SecretRef">;
+    }>>;
+    readonly trustedProxyAddresses: Schema.$Array<Schema.brand<Schema.String, "ProxyAddress">>;
+    readonly cookieSecure: Schema.Boolean;
+    readonly lanAdministrationAllowed: Schema.Boolean;
+}, "Type">, input: unknown, access: "public-pair" | "authenticated-read") => Effect.Effect<undefined, RequestSecurityError, never>;
+/** Hash a CSRF token for storage beside its session without retaining the token. */
+export declare const hashCsrfToken: (token: string) => Effect.Effect<string & import("effect/Brand").Brand<"CsrfDigest">, RequestSecurityError, Crypto.Crypto>;
+/** Verify a supplied CSRF token against the fixed-size stored digest. */
+export declare const verifyCsrfToken: (token: string | null, expectedDigest: string) => Effect.Effect<undefined, RequestSecurityError, Crypto.Crypto>;
+/** Insecure HTTP LAN clients cannot perform administration or inspect secrets. */
+export declare const authorizeInsecureLanCapability: (config: BindConfig, capability: InsecureLanCapability) => Effect.Effect<void, RequestSecurityError>;
+/** Authorize a safe authenticated read together with its deployment capability policy. */
+export declare const authorizeAuthenticatedRead: (authorization: AuthenticatedReadAuthorization) => Effect.Effect<void, RequestSecurityError, never>;
+/**
+ * Authorize transport, exact Origin, session-owned CSRF verification, and
+ * capability as one mutation guard. The required verifier is normally
+ * `Auth.authorizeMutation` closed over the request's session token.
+ */
+export declare const authorizeAuthenticatedMutation: <A, E, R>(authorization: AuthenticatedMutationAuthorization, verifySessionCsrf: (csrfToken: Redacted.Redacted<string>) => Effect.Effect<A, E, R>) => Effect.Effect<A, RequestSecurityError | E, R>;
+/** Cookie attributes for the opaque session token; the token itself is never represented here. */
+export declare const sessionCookiePolicy: (config: BindConfig) => SessionCookiePolicy;
+export {};
+//# sourceMappingURL=RequestSecurity.d.ts.map

package/dist/server/server/security/RequestSecurity.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"RequestSecurity.d.ts","sourceRoot":"","sources":["../../../../src/server/security/RequestSecurity.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,EAAY,QAAQ,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAA;AAEnE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAA;AAIjD,eAAO,MAAM,aAAa,iEAAyD,CAAA;AAEnF,MAAM,MAAM,aAAa,GAAG,OAAO,aAAa,CAAC,IAAI,CAAA;AAErD,eAAO,MAAM,qBAAqB,gOAUhC,CAAA;AAEF,MAAM,MAAM,qBAAqB,GAAG,OAAO,qBAAqB,CAAC,IAAI,CAAA;AAErE,eAAO,MAAM,UAAU,2CAEW,CAAA;AAElC,MAAM,MAAM,UAAU,GAAG,OAAO,UAAU,CAAC,IAAI,CAAA;AAE/C,eAAO,MAAM,SAAS,0CAEW,CAAA;AAEjC,MAAM,MAAM,SAAS,GAAG,OAAO,SAAS,CAAC,IAAI,CAAA;AAE7C,QAAA,MAAM,YAAY;;;;;;;;EAQhB,CAAA;AAEF,MAAM,MAAM,YAAY,GAAG,OAAO,YAAY,CAAC,IAAI,CAAA;AAEnD,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAA;IAC3B,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAA;IACvB,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAA;IAC3B,QAAQ,CAAC,IAAI,EAAE,GAAG,CAAA;IAClB,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAA;CACzB;AAED,iFAAiF;AACjF,MAAM,WAAW,8BAA8B;IAC7C,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAA;IAC3B,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAA;IACzB,QAAQ,CAAC,UAAU,EAAE,qBAAqB,CAAA;CAC3C;AAED,gGAAgG;AAChG,MAAM,WAAW,kCAAkC;IACjD,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAA;IAC3B,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAA;IACzB,QAAQ,CAAC,UAAU,EAAE,qBAAqB,CAAA;CAC3C;;;;AAED,iEAAiE;AACjE,qBAAa,oBAAqB,SAAQ,yBAYxC;CAAG;AAIL,oFAAoF;AACpF,eAAO,MAAM,yBAAyB,GACpC,QAAQ,UAAU,EAClB,SAAS,YAAY,KACpB;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAA;CAM9D,CAAA;AAmCD,yEAAyE;AACzE,eAAO,MAAM,gBAAgB;;;;;;;;;;;;;;kIA6B3B,CAAA;AAWF,oFAAoF;AACpF,eAAO,MAAM,aAAa,4HAYxB,CAAA;AAEF,yEAAyE;AACzE,eAAO,MAAM,eAAe,iHAkB1B,CAAA;AAEF,kFAAkF;AAClF,eAAO,MAAM,8BAA8B,GACzC,QAAQ,UAAU,EAClB,YAAY,qBAAqB,KAChC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,oBAAoB,CAU1C,CAAA;AAED,0FAA0F;AAC1F,eAAO,MAAM,0BAA0B,qGAKrC,CAAA;AAEF;;;;GAIG;AACH,eAAO,MAAM,8BAA8B,GACzC,CAAC,EACD,CAAC,EACD,CAAC,oFAG8B,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,kDAOnF,CAAA;AAEF,kGAAkG;AAClG,eAAO,MAAM,mBAAmB,GAAI,QAAQ,UAAU,KAAG,mBAMvD,CAAA"}

package/dist/server/server/security/index.d.ts

@@ -0,0 +1,3 @@
+export * from "./BindConfig.js";
+export * from "./RequestSecurity.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/server/server/security/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/server/security/index.ts"],"names":[],"mappings":"AAAA,cAAc,iBAAiB,CAAA;AAC/B,cAAc,sBAAsB,CAAA"}

package/package.json

@@ -0,0 +1,101 @@
+{
+  "name": "@knpkv/control-center",
+  "version": "0.1.0",
+  "description": "Human- and agent-oriented delivery control center",
+  "license": "MIT",
+  "author": "knpkv",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/knpkv/npm.git",
+    "directory": "packages/control-center"
+  },
+  "type": "module",
+  "bin": {
+    "control-center": "./dist/server/server/cli.js"
+  },
+  "main": "./dist/server/index.js",
+  "types": "./dist/server/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/server/index.d.ts",
+      "import": "./dist/server/index.js"
+    },
+    "./api": {
+      "types": "./dist/server/api/index.d.ts",
+      "import": "./dist/server/api/index.js"
+    },
+    "./domain": {
+      "types": "./dist/server/domain/index.d.ts",
+      "import": "./dist/server/domain/index.js"
+    },
+    "./server": {
+      "types": "./dist/server/server/index.d.ts",
+      "import": "./dist/server/server/index.js"
+    }
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "files": [
+    "dist",
+    "README.md"
+  ],
+  "engines": {
+    "node": ">=24"
+  },
+  "dependencies": {
+    "@aws-sdk/credential-providers": "^3.1085.0",
+    "@distilled.cloud/aws": "0.29.1",
+    "@effect/platform-browser": "4.0.0-beta.98",
+    "@effect/platform-node": "4.0.0-beta.98",
+    "@effect/sql-libsql": "4.0.0-beta.98",
+    "effect": "4.0.0-beta.98",
+    "react": "^19.2.7",
+    "react-dom": "^19.2.7",
+    "react-markdown": "^10.1.0",
+    "react-router": "^8.2.0",
+    "remark-gfm": "^4.0.1",
+    "@knpkv/ai-claude": "^0.1.0",
+    "@knpkv/ai-codex": "^0.1.0",
+    "@knpkv/ai-runtime": "^0.1.0",
+    "@knpkv/atlassian-common": "^1.2.0",
+    "@knpkv/codecommit-core": "^0.9.0",
+    "@knpkv/clockify-api-client": "^1.0.0",
+    "@knpkv/confluence-api-client": "^1.0.0",
+    "@knpkv/confluence-to-markdown": "^2.1.1",
+    "@knpkv/control-center-sql": "^0.1.0",
+    "@knpkv/jira-api-client": "^1.0.0",
+    "@knpkv/rly": "^0.1.0"
+  },
+  "devDependencies": {
+    "@effect/vitest": "4.0.0-beta.98",
+    "@playwright/test": "1.61.1",
+    "@types/node": "^26.1.1",
+    "@types/react": "^19.2.17",
+    "@types/react-dom": "^19.2.3",
+    "@vitejs/plugin-react": "^6.0.3",
+    "rimraf": "^6.1.3",
+    "tsx": "^4.23.0",
+    "typescript": "^6.0.3",
+    "vite": "^8.1.4",
+    "vitest": "^4.1.10"
+  },
+  "scripts": {
+    "benchmark": "pnpm benchmark:contracts && pnpm benchmark:runtime",
+    "benchmark:contracts": "tsx scripts/runBenchmark.ts",
+    "benchmark:runtime": "pnpm build && rimraf test-results/control-center/runtime-benchmark.json && CONTROL_CENTER_RUNTIME_BENCHMARK_OUTPUT=test-results/control-center/runtime-benchmark.json playwright test e2e/real-runtime.spec.ts --grep \"measures warmed\" --config playwright.config.ts && CONTROL_CENTER_RUNTIME_BENCHMARK_OUTPUT=test-results/control-center/runtime-benchmark.json tsx scripts/validateRuntimeBenchmarkReport.ts",
+    "build": "tsx scripts/run-build.ts",
+    "check": "pnpm validate:boundaries && pnpm lint:rly-css-tokens && tsc -b tsconfig.json",
+    "clean": "rimraf dist *.tsbuildinfo node_modules/.cache",
+    "dev": "vite --host 127.0.0.1 --port 5173 --strictPort",
+    "lint": "eslint \"{src,test,e2e,scripts}/**/*.{ts,tsx}\" vite.config.ts vitest.config.ts playwright.config.ts && pnpm lint:rly-css-tokens",
+    "lint:rly-css-tokens": "tsx scripts/validateRlyCssTokens.ts",
+    "preview": "vite preview --outDir dist/client --host 127.0.0.1 --port 4173 --strictPort",
+    "start": "node ./dist/server/server/cli.js",
+    "test": "vitest run",
+    "test:browser": "pnpm test:e2e",
+    "test:e2e": "pnpm --filter @knpkv/control-center^... build && pnpm build && playwright test --config playwright.config.ts",
+    "validate:boundaries": "tsx scripts/validate-boundaries.ts",
+    "validate:dist": "tsx scripts/validate-dist.ts"
+  }
+}