@moxt-ai/mobius 0.0.24 → 0.0.25

package/dist/agent-catalog/publish-agent-catalog.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"publish-agent-catalog.d.ts","sourceRoot":"","sources":["../../src/agent-catalog/publish-agent-catalog.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAwBjD,wBAAsB,mBAAmB,CAAC,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAoClG"}
+{"version":3,"file":"publish-agent-catalog.d.ts","sourceRoot":"","sources":["../../src/agent-catalog/publish-agent-catalog.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AA6BjD,wBAAsB,mBAAmB,CAAC,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAoClG"}

package/dist/agent-catalog/publish-agent-catalog.js

@@ -8,14 +8,19 @@ class AgentCatalogPublishError extends Error {
         this.name = "AgentCatalogPublishError";
     }
 }
-function catalogEndpoint(relayUrl) {
-    const endpoint = new URL(relayUrl);
+function catalogEndpoint(config) {
+    const endpoint = new URL(config.relayUrl);
     endpoint.protocol = endpoint.protocol === "wss:" ? "https:" : "http:";
-    if (!endpoint.pathname.endsWith("/daemon")) {
-        throw new AgentCatalogPublishError("The Relay URL is invalid");
+    if (endpoint.pathname.endsWith("/daemon")) {
+        endpoint.pathname = `${endpoint.pathname.slice(0, -"/daemon".length)}/catalog`;
+        return endpoint;
     }
-    endpoint.pathname = `${endpoint.pathname.slice(0, -"/daemon".length)}/catalog`;
-    return endpoint;
+    const runtimePath = "/v1/runtimes/connect";
+    if (endpoint.pathname.endsWith(runtimePath)) {
+        endpoint.pathname = `${endpoint.pathname.slice(0, -runtimePath.length)}/channels/${encodeURIComponent(config.channelId)}/catalog`;
+        return endpoint;
+    }
+    throw new AgentCatalogPublishError("The Relay URL is invalid");
 }
 export async function publishAgentCatalog(config, signal) {
     signal.throwIfAborted();
@@ -24,7 +29,7 @@ export async function publishAgentCatalog(config, signal) {
     let response;
     const catalog = config.catalog.read();
     try {
-        response = await fetch(catalogEndpoint(config.relayUrl), {
+        response = await fetch(catalogEndpoint(config), {
             body: JSON.stringify({
                 agents: catalog.agents.map((agent) => ({
                     agentPath: agent.agentIdentity.requestedPath,

package/dist/agent-catalog/publish-agent-catalog.js.map

@@ -1 +1 @@
-{"version":3,"file":"publish-agent-catalog.js","sourceRoot":"","sources":["../../src/agent-catalog/publish-agent-catalog.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,QAAQ,CAAC;AAG/B,OAAO,EAAE,0BAA0B,EAAE,MAAM,iCAAiC,CAAC;AAE7E,MAAM,mCAAmC,GAAG,MAAM,CAAC;AAEnD,MAAM,wBAAyB,SAAQ,KAAK;IAC/B,IAAI,GAAG,6BAA6B,CAAC;IAE9C,YAAY,OAAe,EAAE,OAAO,GAAiB,EAAE;QACnD,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QACxB,IAAI,CAAC,IAAI,GAAG,0BAA0B,CAAC;IAC3C,CAAC;CACJ;AAED,SAAS,eAAe,CAAC,QAAa;IAClC,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC;IACnC,QAAQ,CAAC,QAAQ,GAAG,QAAQ,CAAC,QAAQ,KAAK,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC;IACtE,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;QACzC,MAAM,IAAI,wBAAwB,CAAC,0BAA0B,CAAC,CAAC;IACnE,CAAC;IACD,QAAQ,CAAC,QAAQ,GAAG,GAAG,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,SAAS,CAAC,MAAM,CAAC,UAAU,CAAC;IAC/E,OAAO,QAAQ,CAAC;AACpB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,MAAoB,EAAE,MAAmB;IAC/E,MAAM,CAAC,cAAc,EAAE,CAAC;IACxB,MAAM,aAAa,GAAG,WAAW,CAAC,OAAO,CAAC,mCAAmC,CAAC,CAAC;IAC/E,MAAM,aAAa,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC,CAAC;IAC/D,IAAI,QAA2C,CAAC;IAChD,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;IACtC,IAAI,CAAC;QACD,QAAQ,GAAG,MAAM,KAAK,CAAC,eAAe,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE;YACrD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACjB,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;oBACnC,SAAS,EAAE,KAAK,CAAC,aAAa,CAAC,aAAa;oBAC5C,YAAY,EAAE,KAAK,CAAC,YAAY;oBAChC,YAAY,EAAE,KAAK,CAAC,YAAY;oBAChC,EAAE,EAAE,KAAK,CAAC,EAAE;oBACZ,KAAK,EAAE,KAAK,CAAC,KAAK;iBACrB,CAAC,CAAC;gBACH,iBAAiB,EAAE,OAAO,CAAC,iBAAiB;aAC/C,CAAC;YACF,UAAU,EAAE,0BAA0B;YACtC,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC/C,MAAM,EAAE,KAAK;YACb,MAAM,EAAE,aAAa;SACxB,CAAC,CAAC;IACP,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACb,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;YACjB,MAAM,CAAC,cAAc,EAAE,CAAC;QAC5B,CAAC;QACD,MAAM,IAAI,wBAAwB,CAC9B,aAAa,CAAC,OAAO,CAAC,CAAC,CAAC,oCAAoC,CAAC,CAAC,CAAC,wCAAwC,EACvG,EAAE,KAAK,EAAE,KAAK,EAAE,CACnB,CAAC;IACN,CAAC;IACD,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC;IAC9B,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACf,MAAM,IAAI,wBAAwB,CAAC,6CAA6C,CAAC,CAAC;IACtF,CAAC;AACL,CAAC"}
+{"version":3,"file":"publish-agent-catalog.js","sourceRoot":"","sources":["../../src/agent-catalog/publish-agent-catalog.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,QAAQ,CAAC;AAG/B,OAAO,EAAE,0BAA0B,EAAE,MAAM,iCAAiC,CAAC;AAE7E,MAAM,mCAAmC,GAAG,MAAM,CAAC;AAEnD,MAAM,wBAAyB,SAAQ,KAAK;IAC/B,IAAI,GAAG,6BAA6B,CAAC;IAE9C,YAAY,OAAe,EAAE,OAAO,GAAiB,EAAE;QACnD,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QACxB,IAAI,CAAC,IAAI,GAAG,0BAA0B,CAAC;IAC3C,CAAC;CACJ;AAED,SAAS,eAAe,CAAC,MAAoB;IACzC,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAC1C,QAAQ,CAAC,QAAQ,GAAG,QAAQ,CAAC,QAAQ,KAAK,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC;IACtE,IAAI,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;QACxC,QAAQ,CAAC,QAAQ,GAAG,GAAG,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,SAAS,CAAC,MAAM,CAAC,UAAU,CAAC;QAC/E,OAAO,QAAQ,CAAC;IACpB,CAAC;IACD,MAAM,WAAW,GAAG,sBAAsB,CAAC;IAC3C,IAAI,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;QAC1C,QAAQ,CAAC,QAAQ,GAAG,GAAG,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,WAAW,CAAC,MAAM,CAAC,aAAa,kBAAkB,CAAC,MAAM,CAAC,SAAS,CAAC,UAAU,CAAC;QAClI,OAAO,QAAQ,CAAC;IACpB,CAAC;IACD,MAAM,IAAI,wBAAwB,CAAC,0BAA0B,CAAC,CAAC;AACnE,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,MAAoB,EAAE,MAAmB;IAC/E,MAAM,CAAC,cAAc,EAAE,CAAC;IACxB,MAAM,aAAa,GAAG,WAAW,CAAC,OAAO,CAAC,mCAAmC,CAAC,CAAC;IAC/E,MAAM,aAAa,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC,CAAC;IAC/D,IAAI,QAA2C,CAAC;IAChD,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;IACtC,IAAI,CAAC;QACD,QAAQ,GAAG,MAAM,KAAK,CAAC,eAAe,CAAC,MAAM,CAAC,EAAE;YAC5C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACjB,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;oBACnC,SAAS,EAAE,KAAK,CAAC,aAAa,CAAC,aAAa;oBAC5C,YAAY,EAAE,KAAK,CAAC,YAAY;oBAChC,YAAY,EAAE,KAAK,CAAC,YAAY;oBAChC,EAAE,EAAE,KAAK,CAAC,EAAE;oBACZ,KAAK,EAAE,KAAK,CAAC,KAAK;iBACrB,CAAC,CAAC;gBACH,iBAAiB,EAAE,OAAO,CAAC,iBAAiB;aAC/C,CAAC;YACF,UAAU,EAAE,0BAA0B;YACtC,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC/C,MAAM,EAAE,KAAK;YACb,MAAM,EAAE,aAAa;SACxB,CAAC,CAAC;IACP,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACb,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;YACjB,MAAM,CAAC,cAAc,EAAE,CAAC;QAC5B,CAAC;QACD,MAAM,IAAI,wBAAwB,CAC9B,aAAa,CAAC,OAAO,CAAC,CAAC,CAAC,oCAAoC,CAAC,CAAC,CAAC,wCAAwC,EACvG,EAAE,KAAK,EAAE,KAAK,EAAE,CACnB,CAAC;IACN,CAAC;IACD,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC;IAC9B,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACf,MAAM,IAAI,wBAAwB,CAAC,6CAA6C,CAAC,CAAC;IACtF,CAAC;AACL,CAAC"}

package/dist/cli.js

@@ -11,7 +11,7 @@ import { mkdir as mkdir5 } from "node:fs/promises";
 // package.json
 var package_default = {
   name: "@moxt-ai/mobius",
-  version: "0.0.24",
+  version: "0.0.25",
   description: "Mobius CLI for pairing and running local AI agent services.",
   type: "module",
   bin: {
@@ -21,6 +21,10 @@ var package_default = {
     ".": {
       types: "./dist/index.d.ts",
       import: "./dist/index.js"
+    },
+    "./runtime": {
+      types: "./dist/runtime.d.ts",
+      import: "./dist/runtime.js"
     }
   },
   files: [
@@ -38,7 +42,7 @@ var package_default = {
     directory: "packages/cli"
   },
   scripts: {
-    build: "tsc --project tsconfig.build.json && esbuild src/cli.ts src/index.ts --bundle --platform=node --format=esm --sourcemap --outdir=dist --external:@agentclientprotocol/* --external:undici",
+    build: "tsc --project tsconfig.build.json && esbuild src/cli.ts src/index.ts src/runtime.ts --bundle --platform=node --format=esm --sourcemap --outdir=dist --external:@agentclientprotocol/* --external:undici",
     dev: "node --watch src/cli.ts",
     prepack: "pnpm build",
     start: "node dist/cli.js",
@@ -2578,54 +2582,6 @@ async function discoverLocalAgentInventory(options) {
   return new LocalAgentInventory(discoveries);
 }
 
-// src/audit/audit-store.ts
-import { mkdirSync } from "node:fs";
-import { dirname as dirname3 } from "node:path";
-import { DatabaseSync } from "node:sqlite";
-var AuditStore = class {
-  database;
-  constructor(path2) {
-    mkdirSync(dirname3(path2), { recursive: true });
-    this.database = new DatabaseSync(path2);
-    this.database.exec(`
-      CREATE TABLE IF NOT EXISTS audit_events (
-        id INTEGER PRIMARY KEY AUTOINCREMENT,
-        recorded_at TEXT NOT NULL,
-        event TEXT NOT NULL,
-        command_id TEXT NOT NULL,
-        session_id TEXT NOT NULL,
-        details_json TEXT NOT NULL DEFAULT '{}'
-      ) STRICT
-    `);
-    const columns = this.database.prepare("PRAGMA table_info(audit_events)").all();
-    if (!columns.some((column) => Reflect.get(column, "name") === "details_json")) {
-      this.database.exec("ALTER TABLE audit_events ADD COLUMN details_json TEXT NOT NULL DEFAULT '{}'");
-    }
-  }
-  record(record2) {
-    this.database.prepare(
-      `
-          INSERT INTO audit_events (
-            recorded_at,
-            event,
-            command_id,
-            session_id,
-            details_json
-          ) VALUES (?, ?, ?, ?, ?)
-        `
-    ).run(
-      (/* @__PURE__ */ new Date()).toISOString(),
-      record2.event,
-      record2.commandId,
-      record2.sessionId,
-      JSON.stringify(record2.details ?? {})
-    );
-  }
-  close() {
-    this.database.close();
-  }
-};
-
 // src/bots/bot-message-command.ts
 import { randomUUID } from "node:crypto";
 import { createConnection } from "node:net";
@@ -23254,9 +23210,9 @@ var decodeSessionEventAcknowledgement = (encoded) => decode5(encoded, eventAckno
 var decodeSessionEventRejection = (encoded) => decode5(encoded, eventRejectionSchema);
 
 // src/config.ts
-function loadDefaultWorkspace() {
-  const { MOBIUS_DEFAULT_WORKSPACE: configuredWorkspace } = process.env;
-  return configuredWorkspace ?? join13(readStateDirectory(), "workspace");
+function loadDefaultWorkspace(environment = process.env) {
+  const { MOBIUS_DEFAULT_WORKSPACE: configuredWorkspace } = environment;
+  return configuredWorkspace ?? join13(readStateDirectory(environment), "workspace");
 }
 function createDaemonConfig(connection, agents = [], installableAgents = []) {
   return {
@@ -23283,7 +23239,9 @@ var IDENTIFIER_PATTERN5 = /^[a-zA-Z0-9][a-zA-Z0-9._:-]{0,127}$/;
 var TOKEN_PATTERN2 = /^[a-zA-Z0-9_-]{32,256}$/;
 var MAX_CONNECTION_FILE_LENGTH = 16 * 1024;
 var CLAIM_RESPONSE_KEYS = ["channelId", "daemonToken", "runtimeId"];
-var SAVED_CONNECTION_KEYS = ["defaultWorkspace", "channelId", "daemonToken", "relayOrigin"];
+var REDEEM_RESPONSE_KEYS = ["channelId", "runtimeCredential", "runtimeId"];
+var LEGACY_SAVED_CONNECTION_KEYS = ["defaultWorkspace", "channelId", "daemonToken", "relayOrigin"];
+var SAVED_CONNECTION_KEYS = ["defaultWorkspace", "channelId", "relayOrigin", "runtimeCredential"];
 var PairingClientError = class extends Error {
   code;
   constructor(code, message, options = {}) {
@@ -23320,7 +23278,7 @@ function readSingleOption(arguments_, option2) {
 function assertKnownArguments(arguments_) {
   for (let index = 0; index < arguments_.length; index += 2) {
     const option2 = arguments_[index];
-    if (option2 !== "--url" && option2 !== "--code" && option2 !== "--workspace") {
+    if (option2 !== "--url" && option2 !== "--code" && option2 !== "--pairing" && option2 !== "--workspace") {
       throw new PairingClientError("invalid_arguments", `Unknown pairing option: ${option2 ?? "missing option"}`);
     }
   }
@@ -23360,10 +23318,17 @@ function parsePairCommand(arguments_) {
   assertKnownArguments(arguments_);
   return {
     code: parsePairingCode(readSingleOption(arguments_, "--code")),
+    pairingId: arguments_.includes("--pairing") ? validatePairingId(readSingleOption(arguments_, "--pairing")) : "",
     relayOrigin: parseRelayOrigin(readSingleOption(arguments_, "--url")),
     workspace: arguments_.includes("--workspace") ? readSingleOption(arguments_, "--workspace") : loadDefaultWorkspace()
   };
 }
+function validatePairingId(value) {
+  if (!IDENTIFIER_PATTERN5.test(value)) {
+    throw new PairingClientError("invalid_pairing_id", "The Runtime pairing ID is invalid");
+  }
+  return value;
+}
 function parseChannelArgument(arguments_) {
   if (arguments_.length !== 2 || arguments_[0] !== "--channel") {
     throw new PairingClientError("invalid_arguments", "Usage: mobius start --channel <channel-id>");
@@ -23420,17 +23385,17 @@ function readRelayError(value) {
   }
   return new PairingClientError("pairing_failed", "The relay could not pair this machine");
 }
-function decodeClaimResponse(value) {
-  if (!isRecord7(value) || !hasExactKeys(value, CLAIM_RESPONSE_KEYS)) {
+function decodePairingResponse(value, credentialField, expectedKeys) {
+  if (!isRecord7(value) || !hasExactKeys(value, expectedKeys)) {
     throw new PairingClientError("invalid_relay_response", "The relay returned an invalid pairing response");
   }
   const channelId = value["channelId"];
-  const daemonToken2 = value["daemonToken"];
+  const runtimeCredential = value[credentialField];
   const runtimeId = value["runtimeId"];
-  if (typeof channelId !== "string" || !IDENTIFIER_PATTERN5.test(channelId) || typeof daemonToken2 !== "string" || !TOKEN_PATTERN2.test(daemonToken2) || typeof runtimeId !== "string" || !IDENTIFIER_PATTERN5.test(runtimeId)) {
+  if (typeof channelId !== "string" || !IDENTIFIER_PATTERN5.test(channelId) || typeof runtimeCredential !== "string" || !TOKEN_PATTERN2.test(runtimeCredential) || typeof runtimeId !== "string" || !IDENTIFIER_PATTERN5.test(runtimeId)) {
     throw new PairingClientError("invalid_relay_response", "The relay returned an invalid pairing response");
   }
-  return { channelId, daemonToken: daemonToken2, runtimeId };
+  return { channelId, runtimeCredential, runtimeId };
 }
 async function claimPairing(options, defaultWorkspace, localAgents, installableAgents, signal) {
   const agents = localAgents.map((agent) => ({
@@ -23440,7 +23405,7 @@ async function claimPairing(options, defaultWorkspace, localAgents, installableA
     id: agent.id,
     label: agent.label
   }));
-  const endpoint = mobiusApiUrl(options.relayOrigin, "/pairings/claim");
+  const endpoint = options.pairingId.length > 0 ? mobiusApiUrl(options.relayOrigin, `/v1/runtime-pairings/${encodeURIComponent(options.pairingId)}/redeem`) : mobiusApiUrl(options.relayOrigin, "/pairings/claim");
   let response;
   try {
     response = await fetch2(endpoint, {
@@ -23463,10 +23428,10 @@ async function claimPairing(options, defaultWorkspace, localAgents, installableA
   if (!response.ok) {
     throw readRelayError(value);
   }
-  return decodeClaimResponse(value);
+  return options.pairingId.length > 0 ? decodePairingResponse(value, "runtimeCredential", REDEEM_RESPONSE_KEYS) : decodePairingResponse(value, "daemonToken", CLAIM_RESPONSE_KEYS);
 }
-async function persistConnection(channelId, relayOrigin, daemonToken2, defaultWorkspace) {
-  const connectionsDirectory = join14(readStateDirectory(), "connections");
+async function persistConnection(channelId, relayOrigin, runtimeCredential, defaultWorkspace, environment) {
+  const connectionsDirectory = join14(readStateDirectory(environment), "connections");
   await mkdir3(connectionsDirectory, { mode: 448, recursive: true });
   const connectionPath = join14(connectionsDirectory, `${channelId}.json`);
   const temporaryPath = join14(connectionsDirectory, `.${channelId}.${randomUUID2()}.tmp`);
@@ -23476,8 +23441,8 @@ async function persistConnection(channelId, relayOrigin, daemonToken2, defaultWo
       {
         defaultWorkspace,
         channelId,
-        daemonToken: daemonToken2,
-        relayOrigin: relayOrigin.toString()
+        relayOrigin: relayOrigin.toString(),
+        runtimeCredential
       },
       null,
       2
@@ -23489,25 +23454,25 @@ async function persistConnection(channelId, relayOrigin, daemonToken2, defaultWo
   return connectionPath;
 }
 function decodeSavedConnection(value, expectedChannelId) {
-  if (!isRecord7(value) || !hasExactKeys(value, SAVED_CONNECTION_KEYS)) {
+  if (!isRecord7(value) || !hasExactKeys(value, SAVED_CONNECTION_KEYS) && !hasExactKeys(value, LEGACY_SAVED_CONNECTION_KEYS)) {
     throw new PairingClientError("invalid_connection", "The saved connection is invalid");
   }
   const defaultWorkspace = value["defaultWorkspace"];
   const channelId = value["channelId"];
-  const daemonToken2 = value["daemonToken"];
+  const runtimeCredential = value["runtimeCredential"] ?? value["daemonToken"];
   const relayOrigin = value["relayOrigin"];
-  if (typeof defaultWorkspace !== "string" || typeof channelId !== "string" || channelId !== expectedChannelId || !IDENTIFIER_PATTERN5.test(channelId) || typeof daemonToken2 !== "string" || !TOKEN_PATTERN2.test(daemonToken2) || typeof relayOrigin !== "string") {
+  if (typeof defaultWorkspace !== "string" || typeof channelId !== "string" || channelId !== expectedChannelId || !IDENTIFIER_PATTERN5.test(channelId) || typeof runtimeCredential !== "string" || !TOKEN_PATTERN2.test(runtimeCredential) || typeof relayOrigin !== "string") {
     throw new PairingClientError("invalid_connection", "The saved connection is invalid");
   }
   return {
     defaultWorkspace,
     channelId,
-    daemonToken: daemonToken2,
-    relayOrigin: parseRelayOrigin(relayOrigin)
+    relayOrigin: parseRelayOrigin(relayOrigin),
+    runtimeCredential
   };
 }
-async function readSavedConnection(channelId) {
-  const connectionPath = join14(readStateDirectory(), "connections", `${channelId}.json`);
+async function readSavedConnection(channelId, environment) {
+  const connectionPath = join14(readStateDirectory(environment), "connections", `${channelId}.json`);
   let encoded = "";
   const handle = await open4(connectionPath, "r");
   try {
@@ -23529,8 +23494,8 @@ async function readSavedConnection(channelId) {
   return {
     defaultWorkspace: await resolveDefaultWorkspace(connection.defaultWorkspace),
     channelId: connection.channelId,
-    daemonToken: connection.daemonToken,
-    relayOrigin: connection.relayOrigin
+    relayOrigin: connection.relayOrigin,
+    runtimeCredential: connection.runtimeCredential
   };
 }
 function assertInventoryUsable(inventory) {
@@ -23538,15 +23503,12 @@ function assertInventoryUsable(inventory) {
     throw new PairingClientError("no_supported_agent", "No supported Agent is available for local discovery");
   }
 }
-function buildPairedDaemon(connection, connectionPath, inventory) {
+function buildPairedDaemon(connection, connectionPath, inventory, environment) {
   assertInventoryUsable(inventory);
-  const relayUrl = mobiusApiUrl(
-    connection.relayOrigin,
-    `/channels/${encodeURIComponent(connection.channelId)}/daemon`
-  );
+  const relayUrl = mobiusApiUrl(connection.relayOrigin, "/v1/runtimes/connect");
   relayUrl.protocol = relayUrl.protocol === "https:" ? "wss:" : "ws:";
-  relayUrl.searchParams.set("token", connection.daemonToken);
-  const auditDatabasePath = join14(readStateDirectory(), "audit", `${connection.channelId}.sqlite`);
+  relayUrl.searchParams.set("token", connection.runtimeCredential);
+  const auditDatabasePath = join14(readStateDirectory(environment), "audit", `${connection.channelId}.sqlite`);
   return {
     channelUrl: new URL(`/channels/${encodeURIComponent(connection.channelId)}`, connection.relayOrigin).toString(),
     config: createDaemonConfig(
@@ -23562,12 +23524,11 @@ function buildPairedDaemon(connection, connectionPath, inventory) {
     connectionPath
   };
 }
-async function pairLocalMachine(arguments_, signal = new AbortController().signal) {
-  const options = parsePairCommand(arguments_);
+async function pairRuntime(options, signal, environment) {
   const defaultWorkspace = await resolveDefaultWorkspace(options.workspace);
   const inventory = await discoverLocalAgentInventory({
     defaultWorkspace,
-    environment: process.env,
+    environment,
     signal
   });
   assertInventoryUsable(inventory);
@@ -23576,31 +23537,87 @@ async function pairLocalMachine(arguments_, signal = new AbortController().signa
   const connectionPath = await persistConnection(
     claim2.channelId,
     options.relayOrigin,
-    claim2.daemonToken,
-    defaultWorkspace
+    claim2.runtimeCredential,
+    defaultWorkspace,
+    environment
   );
   return buildPairedDaemon(
     {
       defaultWorkspace,
       channelId: claim2.channelId,
-      daemonToken: claim2.daemonToken,
-      relayOrigin: options.relayOrigin
+      relayOrigin: options.relayOrigin,
+      runtimeCredential: claim2.runtimeCredential
     },
     connectionPath,
-    inventory
+    inventory,
+    environment
   );
 }
-async function resumeLocalMachine(arguments_, signal = new AbortController().signal) {
-  const channelId = parseChannelArgument(arguments_);
-  const connectionPath = join14(readStateDirectory(), "connections", `${channelId}.json`);
-  const connection = await readSavedConnection(channelId);
+async function pairLocalMachine(arguments_, signal = new AbortController().signal) {
+  return await pairRuntime(parsePairCommand(arguments_), signal, process.env);
+}
+async function resumeMobiusRuntime(channelId, signal, environment = process.env) {
+  const normalizedChannelId = validatePairingId(channelId);
+  const connectionPath = join14(readStateDirectory(environment), "connections", `${normalizedChannelId}.json`);
+  const connection = await readSavedConnection(normalizedChannelId, environment);
   const inventory = await discoverLocalAgentInventory({
     defaultWorkspace: connection.defaultWorkspace,
-    environment: process.env,
+    environment,
     signal
   });
-  return buildPairedDaemon(connection, connectionPath, inventory);
+  return buildPairedDaemon(connection, connectionPath, inventory, environment);
 }
+async function resumeLocalMachine(arguments_, signal = new AbortController().signal) {
+  return await resumeMobiusRuntime(parseChannelArgument(arguments_), signal, process.env);
+}
+
+// src/audit/audit-store.ts
+import { mkdirSync } from "node:fs";
+import { dirname as dirname3 } from "node:path";
+import { DatabaseSync } from "node:sqlite";
+var AuditStore = class {
+  database;
+  constructor(path2) {
+    mkdirSync(dirname3(path2), { recursive: true });
+    this.database = new DatabaseSync(path2);
+    this.database.exec(`
+      CREATE TABLE IF NOT EXISTS audit_events (
+        id INTEGER PRIMARY KEY AUTOINCREMENT,
+        recorded_at TEXT NOT NULL,
+        event TEXT NOT NULL,
+        command_id TEXT NOT NULL,
+        session_id TEXT NOT NULL,
+        details_json TEXT NOT NULL DEFAULT '{}'
+      ) STRICT
+    `);
+    const columns = this.database.prepare("PRAGMA table_info(audit_events)").all();
+    if (!columns.some((column) => Reflect.get(column, "name") === "details_json")) {
+      this.database.exec("ALTER TABLE audit_events ADD COLUMN details_json TEXT NOT NULL DEFAULT '{}'");
+    }
+  }
+  record(record2) {
+    this.database.prepare(
+      `
+          INSERT INTO audit_events (
+            recorded_at,
+            event,
+            command_id,
+            session_id,
+            details_json
+          ) VALUES (?, ?, ?, ?, ?)
+        `
+    ).run(
+      (/* @__PURE__ */ new Date()).toISOString(),
+      record2.event,
+      record2.commandId,
+      record2.sessionId,
+      JSON.stringify(record2.details ?? {})
+    );
+  }
+  close() {
+    this.database.close();
+  }
+};
 
 // src/run-daemon.ts
 import { randomUUID as randomUUID6 } from "node:crypto";
@@ -26992,14 +27009,19 @@ var AgentCatalogPublishError = class extends Error {
     this.name = "AgentCatalogPublishError";
   }
 };
-function catalogEndpoint(relayUrl) {
-  const endpoint = new URL(relayUrl);
+function catalogEndpoint(config2) {
+  const endpoint = new URL(config2.relayUrl);
   endpoint.protocol = endpoint.protocol === "wss:" ? "https:" : "http:";
-  if (!endpoint.pathname.endsWith("/daemon")) {
-    throw new AgentCatalogPublishError("The Relay URL is invalid");
+  if (endpoint.pathname.endsWith("/daemon")) {
+    endpoint.pathname = `${endpoint.pathname.slice(0, -"/daemon".length)}/catalog`;
+    return endpoint;
   }
-  endpoint.pathname = `${endpoint.pathname.slice(0, -"/daemon".length)}/catalog`;
-  return endpoint;
+  const runtimePath = "/v1/runtimes/connect";
+  if (endpoint.pathname.endsWith(runtimePath)) {
+    endpoint.pathname = `${endpoint.pathname.slice(0, -runtimePath.length)}/channels/${encodeURIComponent(config2.channelId)}/catalog`;
+    return endpoint;
+  }
+  throw new AgentCatalogPublishError("The Relay URL is invalid");
 }
 async function publishAgentCatalog(config2, signal) {
   signal.throwIfAborted();
@@ -27008,7 +27030,7 @@ async function publishAgentCatalog(config2, signal) {
   let response;
   const catalog = config2.catalog.read();
   try {
-    response = await fetch3(catalogEndpoint(config2.relayUrl), {
+    response = await fetch3(catalogEndpoint(config2), {
       body: JSON.stringify({
         agents: catalog.agents.map((agent) => ({
           agentPath: agent.agentIdentity.requestedPath,
@@ -29064,10 +29086,17 @@ function parseReference(resource) {
 function downloadUrl(config2, command, reference) {
   const url2 = new URL(config2.relayUrl);
   url2.protocol = url2.protocol === "wss:" ? "https:" : "http:";
-  if (!url2.pathname.endsWith("/daemon")) {
-    throw new PromptArtifactError("artifact_endpoint_invalid", "The Relay artifact endpoint is invalid");
+  let channelPath = "";
+  if (url2.pathname.endsWith("/daemon")) {
+    channelPath = url2.pathname.slice(0, -"/daemon".length);
+  } else {
+    const runtimePath = "/v1/runtimes/connect";
+    if (!url2.pathname.endsWith(runtimePath)) {
+      throw new PromptArtifactError("artifact_endpoint_invalid", "The Relay artifact endpoint is invalid");
+    }
+    channelPath = `${url2.pathname.slice(0, -runtimePath.length)}/channels/${encodeURIComponent(config2.channelId)}`;
   }
-  url2.pathname = `${url2.pathname.slice(0, -"/daemon".length)}/sessions/${encodeURIComponent(command.sessionId)}/commands/${encodeURIComponent(command.commandId)}/artifacts/${encodeURIComponent(reference.artifactId)}/content`;
+  url2.pathname = `${channelPath}/sessions/${encodeURIComponent(command.sessionId)}/commands/${encodeURIComponent(command.commandId)}/artifacts/${encodeURIComponent(reference.artifactId)}/content`;
   url2.searchParams.delete("liveness");
   return url2;
 }
@@ -29226,8 +29255,16 @@ var RelayConnectionError = class extends Error {
 function connectRelay(url2, signal) {
   signal.throwIfAborted();
   return new Promise((resolve5, reject) => {
-    const socket = new WebSocket(url2, {
-      dispatcher: environmentProxyDispatcher
+    const endpoint = new URL(url2);
+    const headers = {};
+    if (endpoint.pathname.endsWith("/v1/runtimes/connect")) {
+      const runtimeCredential = endpoint.searchParams.get("token") ?? "";
+      endpoint.searchParams.delete("token");
+      headers["authorization"] = `Bearer ${runtimeCredential}`;
+    }
+    const socket = new WebSocket(endpoint, {
+      dispatcher: environmentProxyDispatcher,
+      headers
     });
     let finished = false;
     const timeout = setTimeout(onTimeout, CONNECTION_TIMEOUT_MILLISECONDS);
@@ -29848,10 +29885,17 @@ var ActiveTurnReconciliationError = class extends Error {
 function activeTurnReconciliationEndpoint(config2, turn) {
   const endpoint = new URL(config2.relayUrl);
   endpoint.protocol = endpoint.protocol === "wss:" ? "https:" : "http:";
-  if (!endpoint.pathname.endsWith("/daemon")) {
-    throw new ActiveTurnReconciliationError("The Relay URL is invalid");
+  let channelPath = "";
+  if (endpoint.pathname.endsWith("/daemon")) {
+    channelPath = endpoint.pathname.slice(0, -"/daemon".length);
+  } else {
+    const runtimePath = "/v1/runtimes/connect";
+    if (!endpoint.pathname.endsWith(runtimePath)) {
+      throw new ActiveTurnReconciliationError("The Relay URL is invalid");
+    }
+    channelPath = `${endpoint.pathname.slice(0, -runtimePath.length)}/channels/${encodeURIComponent(config2.channelId)}`;
   }
-  endpoint.pathname = `${endpoint.pathname.slice(0, -"/daemon".length)}/sessions/${encodeURIComponent(turn.command.sessionId)}/attempts/${encodeURIComponent(turn.attemptId)}/reconciliation`;
+  endpoint.pathname = `${channelPath}/sessions/${encodeURIComponent(turn.command.sessionId)}/attempts/${encodeURIComponent(turn.attemptId)}/reconciliation`;
   endpoint.searchParams.delete("liveness");
   return endpoint;
 }
@@ -31176,6 +31220,69 @@ async function runDaemon(config2, audit, signal, timer = systemDaemonTimer) {
   }
 }
 
+// src/runtime.ts
+var APP_CREDENTIAL_PATTERN = /^mapp_[a-zA-Z0-9_-]{22}_[a-zA-Z0-9_-]{43}$/;
+var CONVERSATION_CREDENTIAL_PATTERN = /^mconv_[a-zA-Z0-9_-]{22}_[a-zA-Z0-9_-]{43}$/;
+var RUNTIME_CREDENTIAL_PATTERN = /^[a-zA-Z0-9_-]{32,256}$/;
+var MobiusRuntimeConfigurationError = class extends Error {
+  code = "runtime_configuration_invalid";
+  constructor(message, options = {}) {
+    super(message, options);
+    this.name = "MobiusRuntimeConfigurationError";
+  }
+};
+var MobiusRuntimeState = class {
+};
+var IdleMobiusRuntimeState = class extends MobiusRuntimeState {
+};
+var RunningMobiusRuntimeState = class extends MobiusRuntimeState {
+};
+var FinishedMobiusRuntimeState = class extends MobiusRuntimeState {
+};
+function validateRuntimeRelay(relayUrl) {
+  if (relayUrl.protocol !== "ws:" && relayUrl.protocol !== "wss:") {
+    throw new MobiusRuntimeConfigurationError("The Runtime relay URL must use WebSocket transport");
+  }
+  const credential = relayUrl.searchParams.get("token") ?? "";
+  if (credential.length === 0) {
+    throw new MobiusRuntimeConfigurationError("The Runtime relay credential is required");
+  }
+  if (APP_CREDENTIAL_PATTERN.test(credential)) {
+    throw new MobiusRuntimeConfigurationError("An AppCredential cannot be held by a local Runtime");
+  }
+  if (CONVERSATION_CREDENTIAL_PATTERN.test(credential)) {
+    throw new MobiusRuntimeConfigurationError("A ConversationAccessToken cannot be held by a local Runtime");
+  }
+  if (!RUNTIME_CREDENTIAL_PATTERN.test(credential)) {
+    throw new MobiusRuntimeConfigurationError("The Runtime relay credential is invalid");
+  }
+}
+function validateRuntimeConfiguration(config2) {
+  validateRuntimeRelay(config2.relayUrl);
+}
+var MobiusRuntimeEngine = class {
+  #config;
+  #state = new IdleMobiusRuntimeState();
+  constructor(config2) {
+    validateRuntimeConfiguration(config2);
+    this.#config = config2;
+  }
+  run = async (signal) => {
+    if (!(this.#state instanceof IdleMobiusRuntimeState)) {
+      throw new MobiusRuntimeConfigurationError("A Mobius Runtime engine can only be started once");
+    }
+    signal.throwIfAborted();
+    this.#state = new RunningMobiusRuntimeState();
+    const audit = new AuditStore(this.#config.auditDatabasePath);
+    try {
+      await runDaemon(this.#config, audit, signal);
+    } finally {
+      audit.close();
+      this.#state = new FinishedMobiusRuntimeState();
+    }
+  };
+};
+
 // src/cli.ts
 var shutdown = new AbortController();
 process.once("SIGINT", () => shutdown.abort());
@@ -31183,7 +31290,7 @@ process.once("SIGTERM", () => shutdown.abort());
 var USAGE = `Mobius CLI
 
 Usage:
-  mobius pair --url <relay-url> --code <pairing-code> [--workspace <directory>]
+  mobius pair --url <relay-url> --pairing <runtime-pairing-id> --code <pairing-code> [--workspace <directory>]
   mobius start --channel <channel-id>
   mobius agents [--json]
   mobius bot message send --target <current|alias> --text <message>
@@ -31256,12 +31363,7 @@ async function main() {
   process.stdout.write(`Default workspace: ${config2.defaultWorkspace}
 
 `);
-  const audit = new AuditStore(config2.auditDatabasePath);
-  try {
-    await runDaemon(config2, audit, shutdown.signal);
-  } finally {
-    audit.close();
-  }
+  await new MobiusRuntimeEngine(config2).run(shutdown.signal);
 }
 try {
   await main();