@map-audio/pam-mcp-server 1.25.0 → 1.28.0

package/dist/daemon.js

@@ -0,0 +1,871 @@
+// ../../daemon/client/src/index.ts
+import { constants } from "node:fs";
+import { lstat, open, readFile } from "node:fs/promises";
+import { Socket } from "node:net";
+
+// ../../daemon/client/src/generated/protocol.ts
+var PROTOCOL_VERSION = { major: 1, minor: 1 };
+var FRAME_HEADER_BYTES = 4;
+var MAX_FRAME_BODY_BYTES = 1048576;
+var LIMITS = {
+  maxClients: 32,
+  maxInFlightRequests: 64,
+  maxQueuedOutboundBytes: 4194304,
+  maxPromptBytes: 8192,
+  maxCataloguePageRecords: 100,
+  maxArtifactEntries: 256,
+  maxRequestIdDigits: 20,
+  maxStringBytes: 65536,
+  maxMcpMessageBytes: 786432,
+  maxArrayItems: 256,
+  maxObjectMembers: 128,
+  maxJsonDepth: 32,
+  maxErrorMessageBytes: 4096,
+  maxRequiredFields: 64
+};
+var METHODS = [
+  "system.authenticate",
+  "system.capabilities",
+  "system.health",
+  "catalogue.list",
+  "catalogue.get",
+  "catalogue.install",
+  "catalogue.remove",
+  "session.open",
+  "session.status",
+  "session.close",
+  "model.load",
+  "model.unload",
+  "model.configure",
+  "render.submit",
+  "render.status",
+  "render.cancel",
+  "metrics.read",
+  "metrics.reset",
+  "system.shutdown",
+  "job.status",
+  "job.cancel",
+  "model.ps",
+  "mcp.open",
+  "mcp.message",
+  "job.result",
+  "pack.install"
+];
+var ERROR_CODES = [
+  "auth_failed",
+  "frame_too_large",
+  "version_unsupported",
+  "invalid_request",
+  "method_not_found",
+  "not_found",
+  "not_admitted",
+  "resource_exhausted",
+  "session_not_owned",
+  "model_crashed",
+  "cancelled",
+  "timeout",
+  "unavailable",
+  "model_in_use",
+  "job_expired",
+  "daemon_restarted",
+  "result_too_large",
+  "pack_license_required",
+  "pack_not_found",
+  "pack_not_installed",
+  "pack_in_use",
+  "pack_catalog_unavailable",
+  "pack_download_failed",
+  "pack_signing_unavailable",
+  "pack_invalid",
+  "pack_install_failed",
+  "pack_unsupported_product"
+];
+var isErrorCode = (value) => typeof value === "string" && ERROR_CODES.includes(value);
+
+// ../../daemon/client/src/codec.ts
+var ProtocolError = class extends TypeError {
+  constructor(message, code = "invalid_request") {
+    super(message);
+    this.code = code;
+    this.name = "PamdProtocolError";
+  }
+  code;
+};
+var textEncoder = new TextEncoder();
+var textDecoder = new TextDecoder("utf-8", { fatal: true, ignoreBOM: true });
+var COMMON_FIELDS = ["major", "minor", "requiredFields"];
+var KIND_FIELDS = {
+  method: ["id", "method", "params"],
+  event: ["event", "data"],
+  result: ["id", "result"],
+  error: ["id", "error"]
+};
+function isRecord(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function isDecimalRequestId(value) {
+  return typeof value === "string" && /^(0|[1-9][0-9]*)$/.test(value) && value.length <= LIMITS.maxRequestIdDigits && BigInt(value) <= 18446744073709551615n;
+}
+function isWireName(value) {
+  return typeof value === "string" && value.length > 0 && textEncoder.encode(value).byteLength <= LIMITS.maxStringBytes;
+}
+function validateJsonValue(value, depth = 1, opaqueMcp = false, opaqueString = false) {
+  if (depth > LIMITS.maxJsonDepth) throw new ProtocolError("JSON nesting exceeds the protocol limit");
+  if (typeof value === "string") {
+    if (/[\uD800-\uDBFF](?![\uDC00-\uDFFF])|(?<![\uD800-\uDBFF])[\uDC00-\uDFFF]/.test(value)) {
+      throw new ProtocolError("JSON string contains an unpaired surrogate");
+    }
+    if (textEncoder.encode(value).byteLength > (opaqueString ? LIMITS.maxMcpMessageBytes : LIMITS.maxStringBytes)) throw new ProtocolError("JSON string exceeds the protocol limit");
+  } else if (typeof value === "number" && !Number.isFinite(value)) {
+    throw new ProtocolError("non-finite JSON number");
+  } else if (Array.isArray(value)) {
+    if (value.length > LIMITS.maxArrayItems) throw new ProtocolError("JSON array exceeds the protocol limit");
+    for (const item of value) validateJsonValue(item, depth + 1);
+  } else if (isRecord(value)) {
+    const entries = Object.entries(value);
+    if (entries.length > LIMITS.maxObjectMembers) throw new ProtocolError("JSON object exceeds the protocol limit");
+    for (const [key, item] of entries) {
+      validateJsonValue(key);
+      validateJsonValue(item, depth + 1, opaqueMcp && ["params", "data", "result"].includes(key), opaqueMcp && ["message", "resultJson"].includes(key));
+    }
+  } else if (value !== null && typeof value !== "boolean" && typeof value !== "number") {
+    throw new ProtocolError("value is not representable in JSON");
+  }
+}
+function parseBody(text) {
+  const stack = [];
+  const tokens = /"(?:[^"\\\u0000-\u001f]|\\(?:["\\/bfnrt]|u[0-9a-fA-F]{4}))*"|[{}\[\]]/g;
+  for (const match of text.matchAll(tokens)) {
+    const token = match[0];
+    if (token === "{" || token === "[") {
+      stack.push(token === "{" ? /* @__PURE__ */ new Set() : void 0);
+      if (stack.length > LIMITS.maxJsonDepth) throw new ProtocolError("JSON nesting exceeds the protocol limit");
+    } else if (token === "}" || token === "]") {
+      stack.pop();
+    } else {
+      let next = match.index + token.length;
+      while (next < text.length && /[ \t\r\n]/.test(text[next])) ++next;
+      if (text[next] === ":") {
+        const key = JSON.parse(token);
+        const keys = stack.at(-1);
+        if (keys?.has(key)) throw new ProtocolError("duplicate JSON object key");
+        keys?.add(key);
+      }
+    }
+  }
+  return JSON.parse(text);
+}
+function validateRequiredFields(value, kind) {
+  if (!Object.hasOwn(value, "requiredFields")) return;
+  const fields = value.requiredFields;
+  if (!Array.isArray(fields) || fields.length > LIMITS.maxRequiredFields || new Set(fields).size !== fields.length) {
+    throw new ProtocolError("requiredFields is invalid");
+  }
+  const known = [...COMMON_FIELDS, ...KIND_FIELDS[kind] ?? []];
+  for (const field of fields) {
+    if (typeof field !== "string") throw new ProtocolError("requiredFields contains a non-string value");
+    if (!known.includes(field) || !Object.hasOwn(value, field)) {
+      throw new ProtocolError(`envelope requires an unsupported field: ${field}`, "version_unsupported");
+    }
+  }
+}
+function validateEnvelope(value) {
+  const opaqueMcp = isRecord(value) && (value.method === "mcp.message" || value.method === "job.result" || value.event === "mcp.message" || Object.hasOwn(value, "result"));
+  validateJsonValue(value, 1, opaqueMcp);
+  if (!isRecord(value)) throw new ProtocolError("protocol envelope must be an object");
+  if (!Number.isInteger(value.major) || Number(value.major) < 0 || Number(value.major) > 65535 || !Number.isInteger(value.minor) || Number(value.minor) < 0 || Number(value.minor) > 65535) {
+    throw new ProtocolError("invalid protocol version");
+  }
+  if (value.major !== PROTOCOL_VERSION.major) throw new ProtocolError("unsupported protocol major", "version_unsupported");
+  const discriminators = Object.keys(KIND_FIELDS).filter((field) => Object.hasOwn(value, field));
+  const kind = discriminators[0];
+  if (discriminators.length !== 1 || kind === void 0) throw new ProtocolError("protocol envelope must contain one discriminator");
+  if (kind === "method") {
+    if (!isDecimalRequestId(value.id) || typeof value.method !== "string" || !isRecord(value.params)) {
+      throw new ProtocolError("invalid request envelope");
+    }
+    if (!METHODS.some((method) => method === value.method)) throw new ProtocolError("unknown method", "method_not_found");
+  } else if (kind === "event") {
+    if (!isWireName(value.event) || !Object.hasOwn(value, "data")) throw new ProtocolError("invalid event envelope");
+  } else if (kind === "result") {
+    if (!isDecimalRequestId(value.id)) throw new ProtocolError("invalid response envelope");
+  } else if (!isDecimalRequestId(value.id) || !isRecord(value.error) || !isWireName(value.error.code) || typeof value.error.message !== "string" || textEncoder.encode(value.error.message).byteLength > LIMITS.maxErrorMessageBytes) {
+    throw new ProtocolError("invalid error envelope");
+  }
+  validateRequiredFields(value, kind);
+}
+var isEventEnvelope = (envelope) => Object.hasOwn(envelope, "event");
+var isErrorEnvelope = (envelope) => Object.hasOwn(envelope, "error");
+var isResponseEnvelope = (envelope) => Object.hasOwn(envelope, "result");
+function readNetworkLength(header) {
+  return new DataView(header.buffer, header.byteOffset, header.byteLength).getUint32(0, false);
+}
+function frameBodyLength(header) {
+  if (header.byteLength !== FRAME_HEADER_BYTES) throw new ProtocolError("invalid protocol frame header");
+  const bodyBytes = readNetworkLength(header);
+  if (bodyBytes === 0) throw new ProtocolError("empty protocol frame");
+  if (bodyBytes > MAX_FRAME_BODY_BYTES) throw new ProtocolError("protocol frame exceeds its limit", "frame_too_large");
+  return bodyBytes;
+}
+function decodeBody(body) {
+  if (body.byteLength === 0) throw new ProtocolError("empty protocol body");
+  if (body.byteLength > MAX_FRAME_BODY_BYTES) throw new ProtocolError("protocol body exceeds its limit", "frame_too_large");
+  try {
+    const value = parseBody(textDecoder.decode(body));
+    validateEnvelope(value);
+    return value;
+  } catch (error) {
+    if (error instanceof ProtocolError) throw error;
+    throw new ProtocolError("malformed UTF-8 JSON body");
+  }
+}
+var ProtocolCodec = class {
+  header = new Uint8Array(FRAME_HEADER_BYTES);
+  headerSize = 0;
+  body = new Uint8Array(0);
+  bodySize = 0;
+  static encode(envelope) {
+    validateEnvelope(envelope);
+    const body = textEncoder.encode(JSON.stringify(envelope));
+    if (body.byteLength > MAX_FRAME_BODY_BYTES) throw new ProtocolError("protocol body exceeds its limit", "frame_too_large");
+    const frame = new Uint8Array(FRAME_HEADER_BYTES + body.byteLength);
+    new DataView(frame.buffer).setUint32(0, body.byteLength, false);
+    frame.set(body, FRAME_HEADER_BYTES);
+    return frame;
+  }
+  push(bytes) {
+    const output = [];
+    let offset = 0;
+    try {
+      while (offset < bytes.byteLength) {
+        if (this.headerSize < FRAME_HEADER_BYTES) {
+          const count2 = Math.min(FRAME_HEADER_BYTES - this.headerSize, bytes.byteLength - offset);
+          this.header.set(bytes.subarray(offset, offset + count2), this.headerSize);
+          this.headerSize += count2;
+          offset += count2;
+          if (this.headerSize < FRAME_HEADER_BYTES) continue;
+          this.body = new Uint8Array(frameBodyLength(this.header));
+          this.bodySize = 0;
+        }
+        const count = Math.min(this.body.byteLength - this.bodySize, bytes.byteLength - offset);
+        this.body.set(bytes.subarray(offset, offset + count), this.bodySize);
+        this.bodySize += count;
+        offset += count;
+        if (this.bodySize !== this.body.byteLength) continue;
+        output.push(decodeBody(this.body));
+        this.reset();
+      }
+      return output;
+    } catch (error) {
+      this.reset();
+      throw error;
+    }
+  }
+  reset() {
+    this.header.fill(0);
+    this.headerSize = 0;
+    this.body = new Uint8Array(0);
+    this.bodySize = 0;
+  }
+};
+
+// ../../daemon/client/src/index.ts
+var LOOPBACK_ADDRESS = "127.0.0.1";
+var TOKEN = /^[A-Za-z0-9_-]{42}[AEIMQUYcgkosw048]$/;
+var MAX_REQUEST_ID = 18446744073709551615n;
+var MAX_OWNER_FILE_BYTES = 64 * 1024;
+var O_SHLOCK = 16;
+var PamdApiError = class extends Error {
+  constructor(wireCode, message) {
+    super(message);
+    this.wireCode = wireCode;
+    this.name = "PamdApiError";
+    this.code = isErrorCode(wireCode) ? wireCode : "unavailable";
+  }
+  wireCode;
+  code;
+};
+function assertToken(token) {
+  if (!TOKEN.test(token)) throw new TypeError("PAM token must encode 32 bytes as unpadded base64url");
+}
+var PamdClient = class {
+  constructor(transport, token, onEvent = () => {
+  }, authenticationTimeoutMs = 5e3) {
+    this.transport = transport;
+    this.onEvent = onEvent;
+    assertToken(token);
+    this.authentication = this.submit(
+      "system.authenticate",
+      { token },
+      { timeoutMs: authenticationTimeoutMs },
+      true
+    ).then((result) => {
+      if (result?.authenticated !== true) throw new PamdApiError("auth_failed", "server did not confirm authentication");
+    });
+    void this.authentication.catch((error) => this.fail(this.asError(error)));
+    void this.readLoop();
+  }
+  transport;
+  onEvent;
+  nextRequestId = 1n;
+  pending = /* @__PURE__ */ new Map();
+  retired = /* @__PURE__ */ new Set();
+  writeQueue = Promise.resolve();
+  queuedBytes = 0;
+  writing;
+  failure;
+  closed = false;
+  authentication;
+  events = [];
+  eventBytes = 0;
+  eventDispatch;
+  ready() {
+    return this.authentication;
+  }
+  connectionError() {
+    return this.failure;
+  }
+  request(method, params = {}, options = {}) {
+    return this.submit(method, params, options);
+  }
+  close() {
+    this.closed = true;
+    this.fail(new PamdApiError("unavailable", "client closed"));
+    if (this.eventDispatch !== void 0) clearImmediate(this.eventDispatch);
+    this.events = [];
+    this.eventBytes = 0;
+  }
+  submit(method, params, options, authenticating = false) {
+    if (this.failure !== void 0) return Promise.reject(this.failure);
+    const timeout = options.timeoutMs ?? 3e4;
+    if (!Number.isFinite(timeout) || timeout <= 0 || timeout > 2147483647) {
+      return Promise.reject(new PamdApiError("timeout", "invalid or expired request deadline"));
+    }
+    if (options.signal?.aborted) return Promise.reject(new PamdApiError("cancelled", "request cancelled locally"));
+    if (this.pending.size + this.retired.size >= LIMITS.maxInFlightRequests || this.nextRequestId > MAX_REQUEST_ID) {
+      return Promise.reject(new PamdApiError("resource_exhausted", "client request limit reached"));
+    }
+    const deadline = performance.now() + timeout;
+    const id = String(this.nextRequestId);
+    let bytes;
+    try {
+      bytes = ProtocolCodec.encode({ major: PROTOCOL_VERSION.major, minor: PROTOCOL_VERSION.minor, id, method, params });
+    } catch (error) {
+      return Promise.reject(this.asError(error));
+    }
+    if (this.queuedBytes + bytes.byteLength > LIMITS.maxQueuedOutboundBytes) {
+      return Promise.reject(new PamdApiError("resource_exhausted", "client outbound queue is full"));
+    }
+    ++this.nextRequestId;
+    this.queuedBytes += bytes.byteLength;
+    const result = new Promise((resolve, reject) => {
+      const abort = () => this.abandon(id, new PamdApiError("cancelled", "request cancelled locally; remote work may continue"));
+      const timer = setTimeout(
+        () => this.abandon(id, new PamdApiError("timeout", "request deadline expired; remote work may continue")),
+        Math.max(0, deadline - performance.now())
+      );
+      this.pending.set(id, {
+        resolve: (value) => resolve(value),
+        reject,
+        deadline,
+        timer,
+        dispatched: false,
+        removeAbort: () => options.signal?.removeEventListener("abort", abort)
+      });
+      options.signal?.addEventListener("abort", abort, { once: true });
+      if (options.signal?.aborted) abort();
+    });
+    this.writeQueue = this.writeQueue.then(async () => {
+      if (!authenticating) await this.authentication;
+      const pending = this.pending.get(id);
+      if (pending === void 0 || this.failure !== void 0) return;
+      if (performance.now() >= pending.deadline) {
+        this.abandon(id, new PamdApiError("timeout", "request deadline expired"));
+        return;
+      }
+      pending.dispatched = true;
+      this.writing = id;
+      try {
+        await this.transport.write(bytes);
+      } finally {
+        this.writing = void 0;
+      }
+    }).catch((error) => this.fail(this.asError(error))).finally(() => {
+      this.queuedBytes -= bytes.byteLength;
+    });
+    return result;
+  }
+  remove(id) {
+    const pending = this.pending.get(id);
+    if (pending !== void 0) {
+      this.pending.delete(id);
+      clearTimeout(pending.timer);
+      pending.removeAbort();
+    }
+    return pending;
+  }
+  abandon(id, error) {
+    const pending = this.remove(id);
+    if (pending === void 0) return;
+    pending.reject(error);
+    if (this.writing === id) {
+      this.fail(error);
+    } else if (pending.dispatched) {
+      this.retired.add(id);
+    }
+  }
+  asError(error) {
+    if (error instanceof PamdApiError) return error;
+    return new PamdApiError(
+      error instanceof ProtocolError ? error.code : "unavailable",
+      error instanceof Error ? error.message : String(error)
+    );
+  }
+  fail(error) {
+    if (this.failure !== void 0) return;
+    this.failure = error;
+    for (const id of this.pending.keys()) this.remove(id)?.reject(error);
+    this.transport.close();
+  }
+  queueEvent(event) {
+    if (this.failure !== void 0) return;
+    const size = Buffer.byteLength(JSON.stringify(event));
+    if (this.events.length >= LIMITS.maxArrayItems || this.eventBytes + size > LIMITS.maxQueuedOutboundBytes) {
+      throw new PamdApiError("resource_exhausted", "client event queue is full");
+    }
+    this.events.push(event);
+    this.eventBytes += size;
+    if (this.eventDispatch !== void 0) return;
+    this.eventDispatch = setImmediate(() => {
+      this.eventDispatch = void 0;
+      const events = this.events;
+      this.events = [];
+      this.eventBytes = 0;
+      for (const event2 of events) {
+        if (this.closed) break;
+        try {
+          this.onEvent(event2);
+        } catch {
+        }
+      }
+    });
+  }
+  async readLoop() {
+    try {
+      while (this.failure === void 0) {
+        const envelope = decodeBody(await this.transport.readExactly(frameBodyLength(await this.transport.readExactly(FRAME_HEADER_BYTES))));
+        if (this.failure !== void 0) return;
+        if (isEventEnvelope(envelope)) {
+          this.queueEvent(envelope);
+          continue;
+        }
+        if (!isErrorEnvelope(envelope) && !isResponseEnvelope(envelope)) throw new PamdApiError("invalid_request", "server sent a request envelope");
+        if (envelope.id === "0" && isErrorEnvelope(envelope)) throw new PamdApiError(envelope.error.code, envelope.error.message);
+        const pending = this.pending.get(envelope.id);
+        if (pending === void 0) {
+          if (this.retired.delete(envelope.id)) continue;
+          throw new PamdApiError("invalid_request", "server sent an unknown response id");
+        }
+        if (!pending.dispatched) throw new PamdApiError("invalid_request", "server replied before request dispatch");
+        this.remove(envelope.id);
+        if (performance.now() >= pending.deadline) pending.reject(new PamdApiError("timeout", "reply arrived after request deadline"));
+        else if (isErrorEnvelope(envelope)) pending.reject(new PamdApiError(envelope.error.code, envelope.error.message));
+        else pending.resolve(envelope.result);
+      }
+    } catch (error) {
+      this.fail(this.asError(error));
+    }
+  }
+};
+var SocketTransport = class {
+  constructor(socket) {
+    this.socket = socket;
+    const limit = LIMITS.maxQueuedOutboundBytes + FRAME_HEADER_BYTES + MAX_FRAME_BODY_BYTES;
+    socket.on("data", (chunk) => {
+      this.chunks.push(chunk);
+      this.size += chunk.byteLength;
+      if (this.size > limit) {
+        this.fail(new Error("PAM server sent more unread data than the protocol allows"));
+        socket.destroy();
+      }
+      this.wake();
+    });
+    socket.on("error", (error) => this.fail(error));
+    socket.on("close", () => this.fail(new Error("PAM connection closed")));
+  }
+  socket;
+  chunks = [];
+  size = 0;
+  waiter;
+  failure;
+  fail(error) {
+    this.failure ??= error;
+    this.wake();
+  }
+  wake() {
+    this.waiter?.();
+    this.waiter = void 0;
+  }
+  write(bytes) {
+    return new Promise((resolve, reject) => {
+      this.socket.write(bytes, (error) => error ? reject(error) : resolve());
+    });
+  }
+  async readExactly(bytes) {
+    while (this.size < bytes) {
+      if (this.failure !== void 0) throw this.failure;
+      await new Promise((resolve) => {
+        this.waiter = resolve;
+      });
+    }
+    const [only] = this.chunks;
+    const joined = this.chunks.length === 1 && only !== void 0 ? only : Buffer.concat(this.chunks, this.size);
+    const result = joined.subarray(0, bytes);
+    const rest = joined.subarray(bytes);
+    this.chunks = rest.byteLength > 0 ? [rest] : [];
+    this.size = rest.byteLength;
+    return result;
+  }
+  close() {
+    this.socket.destroy();
+  }
+};
+async function connectPamd(port, token, onEvent, timeoutMs = 5e3) {
+  if (!Number.isInteger(port) || port < 1 || port > 65535) throw new RangeError("PAM port must be between 1 and 65535");
+  if (!Number.isFinite(timeoutMs) || timeoutMs <= 0 || timeoutMs > 2147483647) throw new RangeError("invalid connection timeout");
+  assertToken(token);
+  const deadline = performance.now() + timeoutMs;
+  const socket = new Socket();
+  await new Promise((resolve, reject) => {
+    const timer = setTimeout(() => socket.destroy(new PamdApiError("timeout", "connection deadline expired")), timeoutMs);
+    const onError = (error) => {
+      clearTimeout(timer);
+      reject(error instanceof PamdApiError ? error : new PamdApiError("unavailable", error.message));
+    };
+    socket.once("error", onError);
+    socket.connect(port, LOOPBACK_ADDRESS, () => {
+      clearTimeout(timer);
+      socket.removeListener("error", onError);
+      resolve();
+    });
+  });
+  const remaining = deadline - performance.now();
+  if (remaining <= 0) {
+    socket.destroy();
+    throw new PamdApiError("timeout", "connection deadline expired");
+  }
+  const client = new PamdClient(new SocketTransport(socket), token, onEvent, remaining);
+  try {
+    await client.ready();
+    return client;
+  } catch (error) {
+    client.close();
+    throw error;
+  }
+}
+async function readOwnerOnlyFile(path, label) {
+  const handle = await open(path, constants.O_RDONLY | (constants.O_NOFOLLOW ?? 0));
+  try {
+    const stats = await handle.stat();
+    const effectiveUserId = process.geteuid?.();
+    if (!stats.isFile() || stats.size > MAX_OWNER_FILE_BYTES || process.platform !== "win32" && ((stats.mode & 63) !== 0 || effectiveUserId === void 0 || stats.uid !== effectiveUserId)) {
+      throw new PamdApiError("invalid_request", `${label} must be a small regular owner-only file`);
+    }
+    const buffer = Buffer.alloc(stats.size);
+    const { bytesRead } = await handle.read(buffer, 0, stats.size, 0);
+    return buffer.subarray(0, bytesRead).toString("utf8");
+  } finally {
+    await handle.close();
+  }
+}
+async function readPamdDiscovery(path) {
+  const record2 = JSON.parse(await readOwnerOnlyFile(path, "PAM discovery record"));
+  if (!isRecord(record2) || record2.protocolMajor !== PROTOCOL_VERSION.major || !Number.isInteger(record2.protocolMinor) || Number(record2.protocolMinor) < 0 || Number(record2.protocolMinor) > 65535 || record2.address !== LOOPBACK_ADDRESS || !Number.isInteger(record2.port) || Number(record2.port) < 1 || Number(record2.port) > 65535 || !Number.isSafeInteger(record2.processId) || Number(record2.processId) <= 0 || typeof record2.daemonEpoch !== "string" || record2.daemonEpoch.length === 0 || typeof record2.tokenFile !== "string" || record2.tokenFile.length === 0) {
+    throw new PamdApiError("invalid_request", "PAM discovery record is invalid or incompatible");
+  }
+  return {
+    protocolMajor: record2.protocolMajor,
+    protocolMinor: Number(record2.protocolMinor),
+    address: LOOPBACK_ADDRESS,
+    port: Number(record2.port),
+    processId: Number(record2.processId),
+    daemonEpoch: record2.daemonEpoch,
+    tokenFile: record2.tokenFile
+  };
+}
+function errorCode(error) {
+  return isRecord(error) && typeof error.code === "string" ? error.code : void 0;
+}
+async function linuxFlockHeld(lock) {
+  const info = await lstat(lock, { bigint: true });
+  const major = info.dev >> 8n & 0xfffn | info.dev >> 32n & ~0xfffn;
+  const minor = info.dev & 0xffn | info.dev >> 12n & ~0xffn;
+  const inode = `${major.toString(16).padStart(2, "0")}:${minor.toString(16).padStart(2, "0")}:${info.ino}`;
+  return (await readFile("/proc/locks", "utf8")).split("\n").some((line) => {
+    const fields = line.trim().split(/\s+/);
+    return fields[1] === "FLOCK" && fields[3] === "WRITE" && fields[5] === inode;
+  });
+}
+async function daemonHoldsLock(discovery) {
+  const lock = `${discovery}.lock`;
+  try {
+    if (process.platform !== "win32") {
+      const info = await lstat(lock);
+      if (!info.isFile() || info.uid !== process.geteuid?.() || (info.mode & 63) !== 0) {
+        throw new PamdApiError("invalid_request", "PAM discovery lock must be a regular owner-only file");
+      }
+    }
+    if (process.platform === "linux") return await linuxFlockHeld(lock);
+    if (process.platform !== "darwin" && process.platform !== "win32") {
+      throw new PamdApiError("unavailable", "this platform cannot verify which PAM daemon owns discovery");
+    }
+    const flags = process.platform === "darwin" ? constants.O_RDONLY | constants.O_NOFOLLOW | O_SHLOCK | constants.O_NONBLOCK : constants.O_RDONLY;
+    await (await open(lock, flags)).close();
+    return false;
+  } catch (error) {
+    if (error instanceof PamdApiError) throw error;
+    const code = errorCode(error);
+    if (code === "ENOENT") return false;
+    if (code === (process.platform === "win32" ? "EBUSY" : "EAGAIN")) return true;
+    throw new PamdApiError("invalid_request", "PAM discovery lock is unreadable or unsafe");
+  }
+}
+async function connectPamdFromDiscovery(path, onEvent) {
+  const unowned = new PamdApiError("unavailable", "no running PAM daemon has published this discovery record");
+  if (!await daemonHoldsLock(path)) throw unowned;
+  const record2 = await readPamdDiscovery(path).catch((error) => {
+    throw errorCode(error) === "ENOENT" ? unowned : error;
+  });
+  const token = (await readOwnerOnlyFile(record2.tokenFile, "PAM token")).trim();
+  const confirmed = await readPamdDiscovery(path).catch(() => void 0);
+  if (confirmed?.daemonEpoch !== record2.daemonEpoch || confirmed.port !== record2.port || confirmed.tokenFile !== record2.tokenFile) {
+    throw new PamdApiError("unavailable", "the PAM daemon discovery record changed while connecting");
+  }
+  return connectPamd(record2.port, token, onEvent);
+}
+
+// src/daemon.ts
+import { createHash, randomUUID } from "node:crypto";
+import { constants as constants2 } from "node:fs";
+import { mkdir, open as open2, realpath, rename, unlink } from "node:fs/promises";
+import { basename, dirname, isAbsolute, join } from "node:path";
+import { setTimeout as delay } from "node:timers/promises";
+function record(value) {
+  return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+function failure(code, message, detail = {}) {
+  return new Error(JSON.stringify({ ok: false, code, error: message, ...detail }));
+}
+function daemonError(error, detail) {
+  if (error instanceof PamdApiError) return failure(error.wireCode, error.message, detail);
+  if (error instanceof Error && error.message.startsWith('{"ok":false,')) return error;
+  return failure("unavailable", error instanceof Error ? error.message : String(error), detail);
+}
+var DaemonSession = class {
+  constructor(discovery, dataRoot, outputDirectory) {
+    this.discovery = discovery;
+    this.dataRoot = dataRoot;
+    this.outputDirectory = outputDirectory;
+  }
+  discovery;
+  dataRoot;
+  outputDirectory;
+  client;
+  closing = false;
+  calls = /* @__PURE__ */ new Map();
+  connection() {
+    if (this.closing) throw failure("cancelled", "Plugin session is closing");
+    return this.client ??= connectPamdFromDiscovery(this.discovery);
+  }
+  async job(method, params, signal) {
+    const controller = new AbortController();
+    const requestKey = randomUUID();
+    const cancel = () => {
+      controller.abort();
+      if (this.client) void this.client.then((client) => this.cancelRequest(client, requestKey)).catch(() => {
+      });
+    };
+    signal?.addEventListener("abort", cancel, { once: true });
+    if (signal?.aborted) controller.abort();
+    this.calls.set(controller, requestKey);
+    let jobId;
+    let daemonEpoch;
+    try {
+      if (controller.signal.aborted) throw failure("cancelled", "Request cancelled");
+      const client = await this.connection();
+      if (controller.signal.aborted) throw failure("cancelled", "Request cancelled");
+      const accepted = await this.submit(client, method, params, requestKey);
+      jobId = accepted.jobId;
+      daemonEpoch = accepted.daemonEpoch;
+      let snapshot = accepted;
+      const deadline = performance.now() + 5 * 60 * 1e3;
+      let cancellationSent = false;
+      for (; ; ) {
+        if (snapshot.jobId !== jobId || snapshot.daemonEpoch !== daemonEpoch)
+          throw failure("daemon_restarted", "Job identity changed", { jobId, daemonEpoch, requestKey });
+        if (typeof snapshot.progress !== "number" || !Number.isFinite(snapshot.progress) || snapshot.progress < 0 || snapshot.progress > 1)
+          throw failure("invalid_result", "Invalid daemon job progress", { jobId, daemonEpoch, requestKey });
+        if (snapshot.state === "succeeded") {
+          if (controller.signal.aborted) throw failure("cancelled", "Request cancelled", { jobId, daemonEpoch, requestKey });
+          if (!record(snapshot.result)) throw failure("invalid_result", "Daemon job has no result");
+          return snapshot.result;
+        }
+        if (snapshot.state === "failed" || snapshot.state === "cancelled") {
+          const detail = record(snapshot.error) ? snapshot.error : {};
+          throw failure(String(detail.code ?? "invalid_result"), String(detail.message ?? "Daemon job failed"), { jobId, daemonEpoch, requestKey });
+        }
+        if (snapshot.state !== "queued" && snapshot.state !== "running") throw failure("invalid_result", "Invalid daemon job state");
+        if (controller.signal.aborted && !cancellationSent) {
+          await client.request("job.cancel", { jobId }, { timeoutMs: 500 });
+          cancellationSent = true;
+        }
+        if (performance.now() >= deadline) throw failure("timeout", "Inspect this job before retrying", { jobId, daemonEpoch, requestKey });
+        await delay(25);
+        snapshot = await client.request("job.status", { jobId, expectedEpoch: daemonEpoch }, { timeoutMs: 5e3 });
+        if (!record(snapshot)) throw failure("invalid_result", "Invalid daemon job snapshot");
+      }
+    } catch (error) {
+      throw daemonError(error, { ...jobId ? { jobId, daemonEpoch } : {}, requestKey });
+    } finally {
+      this.calls.delete(controller);
+      signal?.removeEventListener("abort", cancel);
+    }
+  }
+  async submit(client, method, params, requestKey) {
+    const snapshot = await client.request(method, { ...params, requestKey }, { timeoutMs: 5e3 });
+    if (!record(snapshot) || typeof snapshot.jobId !== "string" || !snapshot.jobId || typeof snapshot.daemonEpoch !== "string" || !snapshot.daemonEpoch)
+      throw failure("invalid_result", "Daemon returned no job identity", { requestKey });
+    return snapshot;
+  }
+  async remove(modelId, signal) {
+    await this.job("catalogue.remove", { modelId }, signal);
+    return { ok: true, model: modelId };
+  }
+  // Downloads outlive the MCP request: a client timeout must not cancel a multi-GB pull.
+  async startDownload(modelId) {
+    const requestKey = randomUUID();
+    try {
+      const { jobId, daemonEpoch, state, progress } = await this.submit(await this.connection(), "catalogue.install", { modelId }, requestKey);
+      return { ok: true, model: modelId, jobId, daemonEpoch, requestKey, state, progress };
+    } catch (error) {
+      throw daemonError(error, { requestKey });
+    }
+  }
+  async downloadStatus({ model, jobId, daemonEpoch, requestKey }) {
+    try {
+      const snapshot = await (await this.connection()).request("job.status", { jobId, expectedEpoch: daemonEpoch }, { timeoutMs: 5e3 });
+      if (!record(snapshot) || snapshot.jobId !== jobId || snapshot.daemonEpoch !== daemonEpoch)
+        throw failure("daemon_restarted", "Job identity changed", { jobId, daemonEpoch, requestKey });
+      const { state, progress, error } = snapshot;
+      return {
+        model,
+        jobId,
+        daemonEpoch,
+        requestKey,
+        state,
+        progress,
+        inFlight: state === "queued" || state === "running",
+        ...state === "succeeded" ? { downloaded: true } : {},
+        ...record(error) ? { error } : {}
+      };
+    } catch (error) {
+      throw daemonError(error, { jobId, daemonEpoch, requestKey });
+    }
+  }
+  async generate(args, signal) {
+    const result = await this.job("render.submit", {
+      modelId: "stable-audio-3-small-sfx",
+      prompt: args.prompt,
+      category: args.category,
+      durationSeconds: args.durationSeconds,
+      seed: args.seed ?? 0
+    }, signal);
+    if (signal?.aborted || this.closing) throw failure("cancelled", "Request cancelled");
+    try {
+      const wavPath = await this.publish(result, signal);
+      return { ok: true, wavPath, sampleRate: result.sampleRate, seed: result.seed };
+    } catch (error) {
+      if (error instanceof Error && error.message.startsWith('{"ok":false,')) throw error;
+      throw failure("unavailable", error instanceof Error ? error.message : String(error));
+    }
+  }
+  async publish(result, signal) {
+    if (typeof result.path !== "string" || !isAbsolute(result.path) || typeof result.fileSha256 !== "string" || !/^[a-f0-9]{64}$/.test(result.fileSha256) || !Number.isInteger(result.seed) || Number(result.seed) <= 0 || Number(result.seed) > 4294967295 || !Number.isInteger(result.sampleRate) || Number(result.sampleRate) <= 0 || Number(result.sampleRate) > 384e3)
+      throw failure("invalid_result", "Daemon returned invalid render metadata");
+    const source = await realpath(result.path);
+    const root = await realpath(join(this.dataRoot, "pam-renders"));
+    if (dirname(dirname(source)) !== root || basename(source) !== "audio.wav")
+      throw failure("invalid_result", "Render artifact escapes the daemon render directory");
+    await mkdir(this.outputDirectory, { recursive: true });
+    const output = await realpath(this.outputDirectory);
+    const destination = join(output, `${randomUUID()}.wav`);
+    const partial = `${destination}.partial`;
+    let published = false;
+    let partialCreated = false;
+    const input = await open2(source, constants2.O_RDONLY | (constants2.O_NOFOLLOW ?? 0));
+    try {
+      if (!(await input.stat()).isFile()) throw failure("invalid_result", "Render artifact is not a regular file");
+      const reserved = await open2(destination, "wx", 384);
+      await reserved.close();
+      try {
+        const target = await open2(partial, "wx", 384);
+        partialCreated = true;
+        try {
+          const hash = createHash("sha256");
+          const bytes = Buffer.alloc(65536);
+          for (; ; ) {
+            if (signal?.aborted || this.closing) throw failure("cancelled", "Request cancelled");
+            const { bytesRead } = await input.read(bytes, 0, bytes.length, null);
+            if (!bytesRead) break;
+            hash.update(bytes.subarray(0, bytesRead));
+            let offset = 0;
+            while (offset < bytesRead) {
+              const written = await target.write(bytes, offset, bytesRead - offset);
+              if (!written.bytesWritten) throw failure("unavailable", "Cannot copy render artifact");
+              offset += written.bytesWritten;
+            }
+          }
+          if (hash.digest("hex") !== result.fileSha256) throw failure("invalid_result", "Render artifact failed integrity verification");
+        } finally {
+          await target.close();
+        }
+        if (signal?.aborted || this.closing) throw failure("cancelled", "Request cancelled");
+        await rename(partial, destination);
+        published = true;
+        return join(this.outputDirectory, basename(destination));
+      } finally {
+        if (partialCreated) await unlink(partial).catch(() => {
+        });
+        if (!published) await unlink(destination).catch(() => {
+        });
+      }
+    } finally {
+      await input.close();
+    }
+  }
+  async cancelRequest(client, requestKey) {
+    try {
+      const snapshot = await client.request("job.status", { requestKey }, { timeoutMs: 300 });
+      if (record(snapshot) && typeof snapshot.jobId === "string" && (snapshot.state === "queued" || snapshot.state === "running"))
+        await client.request("job.cancel", { jobId: snapshot.jobId }, { timeoutMs: 300 });
+    } catch {
+    }
+  }
+  async close() {
+    this.closing = true;
+    for (const call of this.calls.keys()) call.abort();
+    if (!this.client) return;
+    try {
+      const client = await this.client;
+      await Promise.all([...this.calls.values()].map((key) => this.cancelRequest(client, key)));
+      const deadline = performance.now() + 500;
+      while (this.calls.size && performance.now() < deadline) await delay(10);
+      client.close();
+    } catch {
+    }
+  }
+};
+export {
+  DaemonSession
+};
+//# sourceMappingURL=daemon.js.map