@moltzap/client 2026.812.0 → 2026.902.0

package/dist/contract.types-check.d.ts

@@ -0,0 +1,99 @@
+/**
+ * @file The public Client is one addressed structural endpoint. Sends always
+ * create one fresh Client-owned intent, and inbound deliveries carry a certified
+ * direct or complete-group message plus transport-only acknowledgment.
+ */
+import type { DateTime, Effect, Scope, Stream } from "effect";
+import type { acquireHarnessEndpoint, AgentAddress, ConnectError, Content, ContentPart, DeliveryAcknowledgeError, DirectMessage, GroupAddress, GroupMessage, HarnessEndpoint, HistoryExportRecord, InboundDelivery, InboundMessage, ListenError, MessageAddressInput, PostId, SendError, SendInput } from "./index.js";
+type Equal<Left, Right> = [Left, Right] extends [Right, Left] ? true : false;
+type Expect<Value extends true> = Value;
+type ExpectedSendInput = Readonly<{
+    to: MessageAddressInput;
+    content: Content;
+}>;
+type ExpectedDirectMessage = Readonly<{
+    kind: "direct";
+    postId: PostId;
+    address: AgentAddress;
+    sender: AgentAddress;
+    content: Content;
+}>;
+type ExpectedGroupMessage = Readonly<{
+    kind: "group";
+    postId: PostId;
+    address: GroupAddress;
+    sender: AgentAddress;
+    members: readonly [
+        AgentAddress,
+        AgentAddress,
+        AgentAddress,
+        ...AgentAddress[]
+    ];
+    content: Content;
+}>;
+type ExpectedDelivery = Readonly<{
+    message: InboundMessage;
+    acknowledge: Effect.Effect<void, DeliveryAcknowledgeError>;
+}>;
+type ExpectedEndpoint = Readonly<{
+    send: (input: SendInput) => Effect.Effect<void, SendError>;
+    messages: Stream.Stream<InboundDelivery, ListenError>;
+}>;
+type SendInputIsExact = Expect<Equal<SendInput, ExpectedSendInput>>;
+type DirectMessageIsExact = Expect<Equal<DirectMessage, ExpectedDirectMessage>>;
+type GroupMessageIsExact = Expect<Equal<GroupMessage, ExpectedGroupMessage>>;
+type InboundMessageIsExact = Expect<Equal<InboundMessage, DirectMessage | GroupMessage>>;
+type DeliveryIsExact = Expect<Equal<InboundDelivery, ExpectedDelivery>>;
+type EndpointIsExact = Expect<Equal<HarnessEndpoint, ExpectedEndpoint>>;
+type ExpectedHistoryExportRecord = Readonly<{
+    kind: "inbound";
+    message: InboundMessage;
+    at: DateTime.Utc;
+}> | Readonly<{
+    kind: "outbound";
+    to: MessageAddressInput;
+    content: Content;
+    outcome: Readonly<{
+        kind: "certified";
+        postId: PostId;
+    }> | Readonly<{
+        kind: "failed";
+        reason: SendError["reason"];
+    }>;
+    at: DateTime.Utc;
+}> | Readonly<{
+    kind: "export-failed";
+    reason: string;
+    at: DateTime.Utc;
+}>;
+type HistoryExportRecordIsExact = Expect<Equal<HistoryExportRecord, ExpectedHistoryExportRecord>>;
+type ContentIsNonempty = Expect<Content extends readonly [ContentPart, ...ContentPart[]] ? true : false>;
+type AgentAddressIsInput = Expect<AgentAddress extends MessageAddressInput ? true : false>;
+type GroupAddressIsInput = Expect<GroupAddress extends MessageAddressInput ? true : false>;
+type SendReasonsAreExact = Expect<Equal<SendError["reason"], "invalid-address" | "unknown-agent" | "membership-invalid" | "content-invalid" | "not-registered" | "version-mismatch" | "certification-unavailable" | "persistence-failed" | "network-unavailable">>;
+type ListenReasonsAreExact = Expect<Equal<ListenError["reason"], "already-listening" | "incompatible-daemon" | "transport-failed" | "decode-failed">>;
+type AcknowledgeReasonsAreExact = Expect<Equal<DeliveryAcknowledgeError["reason"], "unknown-delivery" | "delivery-conflict" | "persistence-failed" | "transport-failed">>;
+type ConnectReasonsAreExact = Expect<Equal<ConnectError["reason"], "transport-failed" | "decode-failed" | "incompatible-daemon">>;
+type AcquisitionIsScoped = Expect<Equal<Parameters<typeof acquireHarnessEndpoint>, [endpoint: URL]>>;
+type AcquisitionResultIsExact = Expect<Equal<ReturnType<typeof acquireHarnessEndpoint>, Effect.Effect<HarnessEndpoint, ConnectError, Scope.Scope>>>;
+/** Compile-time witnesses for the accepted public Client boundary. */
+export type HarnessEndpointCanaries = [
+    SendInputIsExact,
+    DirectMessageIsExact,
+    GroupMessageIsExact,
+    InboundMessageIsExact,
+    DeliveryIsExact,
+    EndpointIsExact,
+    ContentIsNonempty,
+    AgentAddressIsInput,
+    GroupAddressIsInput,
+    SendReasonsAreExact,
+    HistoryExportRecordIsExact,
+    ListenReasonsAreExact,
+    AcknowledgeReasonsAreExact,
+    ConnectReasonsAreExact,
+    AcquisitionIsScoped,
+    AcquisitionResultIsExact
+];
+export {};
+//# sourceMappingURL=contract.types-check.d.ts.map

package/dist/contract.types-check.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"contract.types-check.d.ts","sourceRoot":"","sources":["../src/contract.types-check.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAC9D,OAAO,KAAK,EACV,sBAAsB,EACtB,YAAY,EACZ,YAAY,EACZ,OAAO,EACP,WAAW,EACX,wBAAwB,EACxB,aAAa,EACb,YAAY,EACZ,YAAY,EACZ,eAAe,EACf,mBAAmB,EACnB,eAAe,EACf,cAAc,EACd,WAAW,EACX,mBAAmB,EACnB,MAAM,EACN,SAAS,EACT,SAAS,EACV,MAAM,YAAY,CAAC;AAEpB,KAAK,KAAK,CAAC,IAAI,EAAE,KAAK,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,CAAC,GAAG,IAAI,GAAG,KAAK,CAAC;AAC7E,KAAK,MAAM,CAAC,KAAK,SAAS,IAAI,IAAI,KAAK,CAAC;AAExC,KAAK,iBAAiB,GAAG,QAAQ,CAAC;IAChC,EAAE,EAAE,mBAAmB,CAAC;IACxB,OAAO,EAAE,OAAO,CAAC;CAClB,CAAC,CAAC;AACH,KAAK,qBAAqB,GAAG,QAAQ,CAAC;IACpC,IAAI,EAAE,QAAQ,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,YAAY,CAAC;IACtB,MAAM,EAAE,YAAY,CAAC;IACrB,OAAO,EAAE,OAAO,CAAC;CAClB,CAAC,CAAC;AACH,KAAK,oBAAoB,GAAG,QAAQ,CAAC;IACnC,IAAI,EAAE,OAAO,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,YAAY,CAAC;IACtB,MAAM,EAAE,YAAY,CAAC;IACrB,OAAO,EAAE,SAAS;QAChB,YAAY;QACZ,YAAY;QACZ,YAAY;QACZ,GAAG,YAAY,EAAE;KAClB,CAAC;IACF,OAAO,EAAE,OAAO,CAAC;CAClB,CAAC,CAAC;AACH,KAAK,gBAAgB,GAAG,QAAQ,CAAC;IAC/B,OAAO,EAAE,cAAc,CAAC;IACxB,WAAW,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,wBAAwB,CAAC,CAAC;CAC5D,CAAC,CAAC;AACH,KAAK,gBAAgB,GAAG,QAAQ,CAAC;IAC/B,IAAI,EAAE,CAAC,KAAK,EAAE,SAAS,KAAK,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;IAC3D,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,eAAe,EAAE,WAAW,CAAC,CAAC;CACvD,CAAC,CAAC;AAEH,KAAK,gBAAgB,GAAG,MAAM,CAAC,KAAK,CAAC,SAAS,EAAE,iBAAiB,CAAC,CAAC,CAAC;AACpE,KAAK,oBAAoB,GAAG,MAAM,CAAC,KAAK,CAAC,aAAa,EAAE,qBAAqB,CAAC,CAAC,CAAC;AAChF,KAAK,mBAAmB,GAAG,MAAM,CAAC,KAAK,CAAC,YAAY,EAAE,oBAAoB,CAAC,CAAC,CAAC;AAC7E,KAAK,qBAAqB,GAAG,MAAM,CACjC,KAAK,CAAC,cAAc,EAAE,aAAa,GAAG,YAAY,CAAC,CACpD,CAAC;AACF,KAAK,eAAe,GAAG,MAAM,CAAC,KAAK,CAAC,eAAe,EAAE,gBAAgB,CAAC,CAAC,CAAC;AACxE,KAAK,eAAe,GAAG,MAAM,CAAC,KAAK,CAAC,eAAe,EAAE,gBAAgB,CAAC,CAAC,CAAC;AACxE,KAAK,2BAA2B,GAC5B,QAAQ,CAAC;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,OAAO,EAAE,cAAc,CAAC;IAAC,EAAE,EAAE,QAAQ,CAAC,GAAG,CAAA;CAAE,CAAC,GACxE,QAAQ,CAAC;IACP,IAAI,EAAE,UAAU,CAAC;IACjB,EAAE,EAAE,mBAAmB,CAAC;IACxB,OAAO,EAAE,OAAO,CAAC;IACjB,OAAO,EACH,QAAQ,CAAC;QAAE,IAAI,EAAE,WAAW,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,GAC/C,QAAQ,CAAC;QAAE,IAAI,EAAE,QAAQ,CAAC;QAAC,MAAM,EAAE,SAAS,CAAC,QAAQ,CAAC,CAAA;KAAE,CAAC,CAAC;IAC9D,EAAE,EAAE,QAAQ,CAAC,GAAG,CAAC;CAClB,CAAC,GACF,QAAQ,CAAC;IAAE,IAAI,EAAE,eAAe,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,EAAE,EAAE,QAAQ,CAAC,GAAG,CAAA;CAAE,CAAC,CAAC;AAC1E,KAAK,0BAA0B,GAAG,MAAM,CACtC,KAAK,CAAC,mBAAmB,EAAE,2BAA2B,CAAC,CACxD,CAAC;AACF,KAAK,iBAAiB,GAAG,MAAM,CAC7B,OAAO,SAAS,SAAS,CAAC,WAAW,EAAE,GAAG,WAAW,EAAE,CAAC,GAAG,IAAI,GAAG,KAAK,CACxE,CAAC;AACF,KAAK,mBAAmB,GAAG,MAAM,CAC/B,YAAY,SAAS,mBAAmB,GAAG,IAAI,GAAG,KAAK,CACxD,CAAC;AACF,KAAK,mBAAmB,GAAG,MAAM,CAC/B,YAAY,SAAS,mBAAmB,GAAG,IAAI,GAAG,KAAK,CACxD,CAAC;AACF,KAAK,mBAAmB,GAAG,MAAM,CAC/B,KAAK,CACH,SAAS,CAAC,QAAQ,CAAC,EACjB,iBAAiB,GACjB,eAAe,GACf,oBAAoB,GACpB,iBAAiB,GACjB,gBAAgB,GAChB,kBAAkB,GAClB,2BAA2B,GAC3B,oBAAoB,GACpB,qBAAqB,CACxB,CACF,CAAC;AACF,KAAK,qBAAqB,GAAG,MAAM,CACjC,KAAK,CACH,WAAW,CAAC,QAAQ,CAAC,EACnB,mBAAmB,GACnB,qBAAqB,GACrB,kBAAkB,GAClB,eAAe,CAClB,CACF,CAAC;AACF,KAAK,0BAA0B,GAAG,MAAM,CACtC,KAAK,CACH,wBAAwB,CAAC,QAAQ,CAAC,EAChC,kBAAkB,GAClB,mBAAmB,GACnB,oBAAoB,GACpB,kBAAkB,CACrB,CACF,CAAC;AACF,KAAK,sBAAsB,GAAG,MAAM,CAClC,KAAK,CACH,YAAY,CAAC,QAAQ,CAAC,EACtB,kBAAkB,GAAG,eAAe,GAAG,qBAAqB,CAC7D,CACF,CAAC;AACF,KAAK,mBAAmB,GAAG,MAAM,CAC/B,KAAK,CAAC,UAAU,CAAC,OAAO,sBAAsB,CAAC,EAAE,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,CAClE,CAAC;AACF,KAAK,wBAAwB,GAAG,MAAM,CACpC,KAAK,CACH,UAAU,CAAC,OAAO,sBAAsB,CAAC,EACzC,MAAM,CAAC,MAAM,CAAC,eAAe,EAAE,YAAY,EAAE,KAAK,CAAC,KAAK,CAAC,CAC1D,CACF,CAAC;AAEF,sEAAsE;AACtE,MAAM,MAAM,uBAAuB,GAAG;IACpC,gBAAgB;IAChB,oBAAoB;IACpB,mBAAmB;IACnB,qBAAqB;IACrB,eAAe;IACf,eAAe;IACf,iBAAiB;IACjB,mBAAmB;IACnB,mBAAmB;IACnB,mBAAmB;IACnB,0BAA0B;IAC1B,qBAAqB;IACrB,0BAA0B;IAC1B,sBAAsB;IACtB,mBAAmB;IACnB,wBAAwB;CACzB,CAAC"}

package/dist/contract.types-check.js

@@ -0,0 +1,7 @@
+/**
+ * @file The public Client is one addressed structural endpoint. Sends always
+ * create one fresh Client-owned intent, and inbound deliveries carry a certified
+ * direct or complete-group message plus transport-only acknowledgment.
+ */
+export {};
+//# sourceMappingURL=contract.types-check.js.map

package/dist/contract.types-check.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"contract.types-check.js","sourceRoot":"","sources":["../src/contract.types-check.ts"],"names":[],"mappings":"AAAA;;;;GAIG"}

package/dist/daemon/configuration.d.ts

@@ -0,0 +1,46 @@
+/** @file Exact daemon process configuration and redacted bootstrap material. */
+import { AgentSigningAuthority, type Ed25519PublicKey as Ed25519PublicKeyValue } from "@moltzap/identity";
+import { Effect, Redacted } from "effect";
+/** Closed reason that daemon configuration cannot become startup authority. */
+export type DaemonConfigurationFailure = "environment" | "agent-private-key-file" | "agent-private-key" | "admission-credential-file" | "admission-credential";
+declare const DaemonConfigurationError_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "DaemonConfigurationError";
+} & Readonly<A>;
+/** One non-diagnostic daemon configuration failure. */
+export declare class DaemonConfigurationError extends DaemonConfigurationError_base<{
+    readonly reason: DaemonConfigurationFailure;
+}> {
+}
+/** Exact non-secret values and redacted secret-file locations for one daemon. */
+export interface DaemonProcessConfiguration {
+    readonly stateDirectory: string;
+    readonly mcpPort: number;
+    readonly registryOrigin: URL;
+    readonly registrySignerPublicKey: Ed25519PublicKeyValue;
+    readonly routerOrigin: URL;
+    readonly agentPrivateKeyFile: Redacted.Redacted;
+    readonly admissionCredentialFile: Redacted.Redacted;
+    /**
+     * File the daemon appends its delivered and sent messages to, one JSON
+     * line each, when the operator asks for that record.
+     */
+    readonly historyExport?: string;
+}
+/** Loaded private authority required by daemon registration and network calls. */
+export interface DaemonBootstrap {
+    readonly configuration: DaemonProcessConfiguration;
+    readonly signingAuthority: AgentSigningAuthority;
+    readonly agentPublicKey: Ed25519PublicKeyValue;
+    readonly admissionCredential: Redacted.Redacted;
+}
+/** Loads exactly the seven required daemon process inputs and the optional export. */
+export declare const loadDaemonProcessConfiguration: Effect.Effect<DaemonProcessConfiguration, DaemonConfigurationError>;
+/**
+ * Reads exact secret bytes and constructs the configured Ed25519 authority.
+ *
+ * @param configuration Validated seven-input process configuration.
+ * @returns Redacted admission and opaque agent signing authority.
+ */
+export declare const loadDaemonBootstrap: (configuration: DaemonProcessConfiguration) => Effect.Effect<DaemonBootstrap, DaemonConfigurationError>;
+export {};
+//# sourceMappingURL=configuration.d.ts.map

package/dist/daemon/configuration.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"configuration.d.ts","sourceRoot":"","sources":["../../src/daemon/configuration.ts"],"names":[],"mappings":"AAAA,gFAAgF;AAEhF,OAAO,EACL,qBAAqB,EAErB,KAAK,gBAAgB,IAAI,qBAAqB,EAC/C,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAgB,MAAM,EAAE,QAAQ,EAAU,MAAM,QAAQ,CAAC;AA8DhE,+EAA+E;AAC/E,MAAM,MAAM,0BAA0B,GAClC,aAAa,GACb,wBAAwB,GACxB,mBAAmB,GACnB,2BAA2B,GAC3B,sBAAsB,CAAC;;;;AAE3B,uDAAuD;AACvD,qBAAa,wBAAyB,SAAQ,8BAE5C;IACA,QAAQ,CAAC,MAAM,EAAE,0BAA0B,CAAC;CAC7C,CAAC;CAAG;AAEL,iFAAiF;AACjF,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,cAAc,EAAE,GAAG,CAAC;IAC7B,QAAQ,CAAC,uBAAuB,EAAE,qBAAqB,CAAC;IACxD,QAAQ,CAAC,YAAY,EAAE,GAAG,CAAC;IAC3B,QAAQ,CAAC,mBAAmB,EAAE,QAAQ,CAAC,QAAQ,CAAC;IAChD,QAAQ,CAAC,uBAAuB,EAAE,QAAQ,CAAC,QAAQ,CAAC;IACpD;;;OAGG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;CACjC;AAED,kFAAkF;AAClF,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,aAAa,EAAE,0BAA0B,CAAC;IACnD,QAAQ,CAAC,gBAAgB,EAAE,qBAAqB,CAAC;IACjD,QAAQ,CAAC,cAAc,EAAE,qBAAqB,CAAC;IAC/C,QAAQ,CAAC,mBAAmB,EAAE,QAAQ,CAAC,QAAQ,CAAC;CACjD;AAMD,sFAAsF;AACtF,eAAO,MAAM,8BAA8B,EAAE,MAAM,CAAC,MAAM,CACxD,0BAA0B,EAC1B,wBAAwB,CAKzB,CAAC;AAwDF;;;;;GAKG;AACH,eAAO,MAAM,mBAAmB,kBACf,0BAA0B,KACxC,MAAM,CAAC,MAAM,CAAC,eAAe,EAAE,wBAAwB,CAWT,CAAC"}

package/dist/daemon/configuration.js

@@ -0,0 +1,69 @@
+/** @file Exact daemon process configuration and redacted bootstrap material. */
+import { AgentSigningAuthority, Ed25519PublicKey, } from "@moltzap/identity";
+import { Config, Data, Effect, Redacted, Schema } from "effect";
+// eslint-disable-next-line agent-code-guard/prefer-effect-platform -- Bootstrap reads two configured Node files before the daemon composes its platform services.
+import { readFile } from "node:fs/promises";
+const canonicalUnsignedDecimal = Schema.String.pipe(Schema.pattern(/^(?:0|[1-9]\d*)$/u));
+const port = canonicalUnsignedDecimal.pipe(Schema.compose(Schema.NumberFromString), Schema.int(), Schema.between(1, 65_535));
+const configuredPath = Schema.String.pipe(Schema.minLength(1), Schema.filter((value) => !value.includes("\u0000")));
+const isSerializedOrigin = (value) => {
+    if (!URL.canParse(value)) {
+        return false;
+    }
+    const parsed = new URL(value);
+    return ((parsed.protocol === "http:" || parsed.protocol === "https:") &&
+        value === parsed.origin);
+};
+const origin = Schema.String.pipe(Schema.filter(isSerializedOrigin), Schema.compose(Schema.URL));
+const compactPublicKeyJson = Schema.String.pipe(Schema.pattern(/^\{"crv":"Ed25519","kty":"OKP","x":"[A-Za-z0-9_-]{43}"\}$/u), Schema.compose(Schema.parseJson(Ed25519PublicKey)));
+const admissionCredential = Schema.String.pipe(Schema.minLength(8), Schema.maxLength(512), Schema.pattern(/^[A-Za-z0-9\-._~+/]+=*$/u));
+const configuredValues = Config.all({
+    stateDirectory: Schema.Config("MOLTZAPD_STATE_DIRECTORY", configuredPath),
+    mcpPort: Schema.Config("MOLTZAPD_MCP_PORT", port),
+    registryOrigin: Schema.Config("MOLTZAPD_REGISTRY_ORIGIN", origin),
+    registrySignerPublicKey: Schema.Config("MOLTZAPD_REGISTRY_SIGNER_PUBLIC_KEY", compactPublicKeyJson),
+    routerOrigin: Schema.Config("MOLTZAPD_ROUTER_ORIGIN", origin),
+    agentPrivateKeyFile: Config.redacted(Schema.Config("MOLTZAPD_AGENT_PRIVATE_KEY_FILE", configuredPath)),
+    admissionCredentialFile: Config.redacted(Schema.Config("MOLTZAPD_ADMISSION_CREDENTIAL_FILE", configuredPath)),
+    historyExport: Schema.Config("MOLTZAPD_HISTORY_EXPORT", configuredPath).pipe(Config.withDefault(undefined)),
+});
+/** One non-diagnostic daemon configuration failure. */
+export class DaemonConfigurationError extends Data.TaggedError("DaemonConfigurationError") {
+}
+const configurationError = (reason) => new DaemonConfigurationError({ reason });
+/** Loads exactly the seven required daemon process inputs and the optional export. */
+export const loadDaemonProcessConfiguration = configuredValues.pipe(Effect.map((configuration) => configuration), Effect.mapError(() => configurationError("environment")), Effect.withSpan("loadDaemonProcessConfiguration"));
+const utf8Decoder = new TextDecoder("utf-8", {
+    fatal: true,
+    ignoreBOM: true,
+});
+const readExactUtf8 = (path, reason) => Effect.tryPromise({
+    try: () => readFile(Redacted.value(path)),
+    catch: () => configurationError(reason),
+}).pipe(Effect.flatMap((bytes) => Effect.try({
+    try: () => utf8Decoder.decode(bytes),
+    catch: () => configurationError(reason),
+})));
+const loadSigningAuthority = (configuration) => readExactUtf8(configuration.agentPrivateKeyFile, "agent-private-key-file").pipe(Effect.flatMap((privateKey) => AgentSigningAuthority.fromPkcs8(Redacted.make(privateKey))), Effect.mapError((error) => error._tag === "DaemonConfigurationError"
+    ? error
+    : configurationError("agent-private-key")));
+const loadAdmissionCredential = (configuration) => readExactUtf8(configuration.admissionCredentialFile, "admission-credential-file").pipe(Effect.flatMap(Schema.decodeUnknown(admissionCredential)), Effect.map(Redacted.make), Effect.mapError((error) => error._tag === "DaemonConfigurationError"
+    ? error
+    : configurationError("admission-credential")));
+/**
+ * Reads exact secret bytes and constructs the configured Ed25519 authority.
+ *
+ * @param configuration Validated seven-input process configuration.
+ * @returns Redacted admission and opaque agent signing authority.
+ */
+export const loadDaemonBootstrap = (configuration) => Effect.gen(function* () {
+    const signingAuthority = yield* loadSigningAuthority(configuration);
+    const loadedAdmissionCredential = yield* loadAdmissionCredential(configuration);
+    return Object.freeze({
+        configuration,
+        signingAuthority,
+        agentPublicKey: AgentSigningAuthority.publicKey(signingAuthority),
+        admissionCredential: loadedAdmissionCredential,
+    });
+}).pipe(Effect.withSpan("loadDaemonBootstrap"));
+//# sourceMappingURL=configuration.js.map

package/dist/daemon/configuration.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"configuration.js","sourceRoot":"","sources":["../../src/daemon/configuration.ts"],"names":[],"mappings":"AAAA,gFAAgF;AAEhF,OAAO,EACL,qBAAqB,EACrB,gBAAgB,GAEjB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAChE,kKAAkK;AAClK,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAE5C,MAAM,wBAAwB,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CACjD,MAAM,CAAC,OAAO,CAAC,mBAAmB,CAAC,CACpC,CAAC;AACF,MAAM,IAAI,GAAG,wBAAwB,CAAC,IAAI,CACxC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,gBAAgB,CAAC,EACvC,MAAM,CAAC,GAAG,EAAE,EACZ,MAAM,CAAC,OAAO,CAAC,CAAC,EAAE,MAAM,CAAC,CAC1B,CAAC;AACF,MAAM,cAAc,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CACvC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,EACnB,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CACpD,CAAC;AAEF,MAAM,kBAAkB,GAAG,CAAC,KAAa,EAAW,EAAE;IACpD,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IAC9B,OAAO,CACL,CAAC,MAAM,CAAC,QAAQ,KAAK,OAAO,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,CAAC;QAC7D,KAAK,KAAK,MAAM,CAAC,MAAM,CACxB,CAAC;AACJ,CAAC,CAAC;AAEF,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAC/B,MAAM,CAAC,MAAM,CAAC,kBAAkB,CAAC,EACjC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAC3B,CAAC;AACF,MAAM,oBAAoB,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAC7C,MAAM,CAAC,OAAO,CAAC,4DAA4D,CAAC,EAC5E,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,gBAAgB,CAAC,CAAC,CACnD,CAAC;AACF,MAAM,mBAAmB,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAC5C,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,EACnB,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,EACrB,MAAM,CAAC,OAAO,CAAC,0BAA0B,CAAC,CAC3C,CAAC;AAEF,MAAM,gBAAgB,GAAG,MAAM,CAAC,GAAG,CAAC;IAClC,cAAc,EAAE,MAAM,CAAC,MAAM,CAAC,0BAA0B,EAAE,cAAc,CAAC;IACzE,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,mBAAmB,EAAE,IAAI,CAAC;IACjD,cAAc,EAAE,MAAM,CAAC,MAAM,CAAC,0BAA0B,EAAE,MAAM,CAAC;IACjE,uBAAuB,EAAE,MAAM,CAAC,MAAM,CACpC,qCAAqC,EACrC,oBAAoB,CACrB;IACD,YAAY,EAAE,MAAM,CAAC,MAAM,CAAC,wBAAwB,EAAE,MAAM,CAAC;IAC7D,mBAAmB,EAAE,MAAM,CAAC,QAAQ,CAClC,MAAM,CAAC,MAAM,CAAC,iCAAiC,EAAE,cAAc,CAAC,CACjE;IACD,uBAAuB,EAAE,MAAM,CAAC,QAAQ,CACtC,MAAM,CAAC,MAAM,CAAC,oCAAoC,EAAE,cAAc,CAAC,CACpE;IACD,aAAa,EAAE,MAAM,CAAC,MAAM,CAAC,yBAAyB,EAAE,cAAc,CAAC,CAAC,IAAI,CAC1E,MAAM,CAAC,WAAW,CAAC,SAAS,CAAC,CAC9B;CACF,CAAC,CAAC;AAUH,uDAAuD;AACvD,MAAM,OAAO,wBAAyB,SAAQ,IAAI,CAAC,WAAW,CAC5D,0BAA0B,CAG1B;CAAG;AA0BL,MAAM,kBAAkB,GAAG,CACzB,MAAkC,EACR,EAAE,CAAC,IAAI,wBAAwB,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;AAExE,sFAAsF;AACtF,MAAM,CAAC,MAAM,8BAA8B,GAGvC,gBAAgB,CAAC,IAAI,CACvB,MAAM,CAAC,GAAG,CAAC,CAAC,aAAa,EAA8B,EAAE,CAAC,aAAa,CAAC,EACxE,MAAM,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAC,kBAAkB,CAAC,aAAa,CAAC,CAAC,EACxD,MAAM,CAAC,QAAQ,CAAC,gCAAgC,CAAC,CAClD,CAAC;AAEF,MAAM,WAAW,GAAG,IAAI,WAAW,CAAC,OAAO,EAAE;IAC3C,KAAK,EAAE,IAAI;IACX,SAAS,EAAE,IAAI;CAChB,CAAC,CAAC;AAEH,MAAM,aAAa,GAAG,CACpB,IAAuB,EACvB,MAA8D,EACb,EAAE,CACnD,MAAM,CAAC,UAAU,CAAC;IAChB,GAAG,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACzC,KAAK,EAAE,GAAG,EAAE,CAAC,kBAAkB,CAAC,MAAM,CAAC;CACxC,CAAC,CAAC,IAAI,CACL,MAAM,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE,CACvB,MAAM,CAAC,GAAG,CAAC;IACT,GAAG,EAAE,GAAG,EAAE,CAAC,WAAW,CAAC,MAAM,CAAC,KAAK,CAAC;IACpC,KAAK,EAAE,GAAG,EAAE,CAAC,kBAAkB,CAAC,MAAM,CAAC;CACxC,CAAC,CACH,CACF,CAAC;AAEJ,MAAM,oBAAoB,GAAG,CAC3B,aAAyC,EACuB,EAAE,CAClE,aAAa,CACX,aAAa,CAAC,mBAAmB,EACjC,wBAAwB,CACzB,CAAC,IAAI,CACJ,MAAM,CAAC,OAAO,CAAC,CAAC,UAAU,EAAE,EAAE,CAC5B,qBAAqB,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAC3D,EACD,MAAM,CAAC,QAAQ,CAAC,CAAC,KAAK,EAAE,EAAE,CACxB,KAAK,CAAC,IAAI,KAAK,0BAA0B;IACvC,CAAC,CAAC,KAAK;IACP,CAAC,CAAC,kBAAkB,CAAC,mBAAmB,CAAC,CAC5C,CACF,CAAC;AAEJ,MAAM,uBAAuB,GAAG,CAC9B,aAAyC,EACmB,EAAE,CAC9D,aAAa,CACX,aAAa,CAAC,uBAAuB,EACrC,2BAA2B,CAC5B,CAAC,IAAI,CACJ,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,aAAa,CAAC,mBAAmB,CAAC,CAAC,EACzD,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,EACzB,MAAM,CAAC,QAAQ,CAAC,CAAC,KAAK,EAAE,EAAE,CACxB,KAAK,CAAC,IAAI,KAAK,0BAA0B;IACvC,CAAC,CAAC,KAAK;IACP,CAAC,CAAC,kBAAkB,CAAC,sBAAsB,CAAC,CAC/C,CACF,CAAC;AAEJ;;;;;GAKG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CACjC,aAAyC,EACiB,EAAE,CAC5D,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,MAAM,gBAAgB,GAAG,KAAK,CAAC,CAAC,oBAAoB,CAAC,aAAa,CAAC,CAAC;IACpE,MAAM,yBAAyB,GAC7B,KAAK,CAAC,CAAC,uBAAuB,CAAC,aAAa,CAAC,CAAC;IAChD,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,aAAa;QACb,gBAAgB;QAChB,cAAc,EAAE,qBAAqB,CAAC,SAAS,CAAC,gBAAgB,CAAC;QACjE,mBAAmB,EAAE,yBAAyB;KAC/C,CAAC,CAAC;AACL,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,qBAAqB,CAAC,CAAC,CAAC"}

package/dist/daemon/management.d.ts

@@ -0,0 +1,23 @@
+/** @file Private owner-authorized management over Registry and endpoint state. */
+import { Registry } from "@moltzap/identity/registry";
+import { Effect } from "effect";
+import type { EndpointStore } from "../endpoint/store.js";
+import type { HarnessMcpOperations } from "../harness-mcp-wire.js";
+import type { DaemonBootstrap } from "./configuration.js";
+type ManagementOperation = "readStatus" | "register" | "searchAgents" | "searchConversations" | "readConversation";
+/** Closed management-only projection consumed by the MCP presentation. */
+export type DaemonManagementOperations = Pick<HarnessMcpOperations, ManagementOperation>;
+/**
+ * Builds management operations with one captured Registry service.
+ *
+ * @param input Daemon bootstrap authority and its exclusively owned store.
+ * @param input.store Durable endpoint state owned by this daemon.
+ * @param input.bootstrap Fixed identity and service configuration.
+ * @returns Closed operations ready for the loopback MCP presentation.
+ */
+export declare const makeDaemonManagementOperations: (input: {
+    readonly store: EndpointStore;
+    readonly bootstrap: DaemonBootstrap;
+}) => Effect.Effect<DaemonManagementOperations, never, Registry>;
+export {};
+//# sourceMappingURL=management.d.ts.map

package/dist/daemon/management.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"management.d.ts","sourceRoot":"","sources":["../../src/daemon/management.ts"],"names":[],"mappings":"AAAA,kFAAkF;AAOlF,OAAO,EACL,QAAQ,EAKT,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAAsB,MAAM,EAAU,MAAM,QAAQ,CAAC;AAC5D,OAAO,KAAK,EAEV,aAAa,EAKd,MAAM,sBAAsB,CAAC;AAC9B,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AASnE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AA2B1D,KAAK,mBAAmB,GACpB,YAAY,GACZ,UAAU,GACV,cAAc,GACd,qBAAqB,GACrB,kBAAkB,CAAC;AAwDvB,0EAA0E;AAC1E,MAAM,MAAM,0BAA0B,GAAG,IAAI,CAC3C,oBAAoB,EACpB,mBAAmB,CACpB,CAAC;AA8wBF;;;;;;;GAOG;AACH,eAAO,MAAM,8BAA8B,UAAW;IACpD,QAAQ,CAAC,KAAK,EAAE,aAAa,CAAC;IAC9B,QAAQ,CAAC,SAAS,EAAE,eAAe,CAAC;CACrC,KAAG,MAAM,CAAC,MAAM,CAAC,0BAA0B,EAAE,KAAK,EAAE,QAAQ,CAWD,CAAC"}