@openrig/cli 0.2.0 → 0.3.1

package/daemon/dist/domain/workspace/getting-started-narrative.js

@@ -0,0 +1,237 @@
+// V0.3.1 slice 21 onboarding-conveyor.
+//
+// Narrative tab content for the getting-started mission's two slices.
+// The scaffold writes these as README.md / timeline.md / PROGRESS.md
+// inside each slice folder so a new operator's fresh install ships
+// with a click-through-to-learn experience: opening each tab teaches
+// both (a) what a conveyor run is and (b) what each Project tab does.
+//
+// PARITY CONTRACT with CLI:
+// `packages/cli/src/commands/config-init-workspace.ts` duplicates the
+// same narrative inline because cli + daemon don't cross-import today.
+// `packages/daemon/test/getting-started-narrative-parity.test.ts`
+// asserts byte-identical content with the CLI counterpart so drift
+// fails CI. If you update this content, update the CLI mirror in
+// lockstep.
+//
+// Content authored from the slice 21 onboarding-conveyor IMPLEMENTATION-PRD (Appendix A) in the substrate openrig-work tree.
+export const FIRST_CONVEYOR_RUN_README = `# First Conveyor Run
+
+Welcome to OpenRig. This is the first slice in your getting-started mission. It exists to teach you what a **conveyor run** is + how OpenRig moves work through a multi-agent topology.
+
+## What a conveyor run is
+
+A **conveyor** is OpenRig's central work-movement primitive. One conveyor run = one complete flow of work through your topology:
+
+1. **Slice declared** — operator (you) or an agent declares a slice with intent + acceptance criteria
+2. **Work routed** — orchestrator picks the slice up + routes it to the right agent
+3. **Agents collaborate** — work moves agent-to-agent via durable handoffs (queue items)
+4. **Evidence accumulates** — each step leaves a trail: commits, files, proof packets, screenshots
+5. **Slice closes** — acceptance criteria met; orchestrator routes the result back
+
+You're looking at a mocked conveyor run RIGHT NOW. The other tabs (Story / Progress / Artifacts / Tests / Queue / Topology) each show a different slice of this same run.
+
+## Walking the tabs
+
+- **Overview** (you're here) — read what a slice intends + how to use the rest of the tabs
+- **Story** — narrative timeline of what happened, beat by beat
+- **Progress** — acceptance checklist; what's done, what's pending
+- **Artifacts** — files produced, commits, proof packets — the durable evidence trail
+- **Tests** — pass/fail summaries + screenshots + verification proof
+- **Queue** — operational qitems showing how work moved between agents
+- **Topology** — the rig graph; which agents touched this slice + which edges fired
+
+## Click through
+
+Try them in order. Each tab teaches itself.
+`;
+export const FIRST_CONVEYOR_RUN_TIMELINE = `# Story — First Conveyor Run
+
+## 2026-04-15 09:00 — Slice declared
+
+Operator request: "Build a CLI tool that lints todo lists." Slice declared in \`getting-started/slices/first-conveyor-run/\`. Acceptance: \`tdl lint <file>\` exits non-zero on malformed entries.
+
+## 09:02 — Orchestrator routes
+
+\`orch-lead@getting-started\` picks up the slice. Routes to \`driver@getting-started\` via \`rig queue handoff\`. Driver receives nudge; opens IMPL-PRD; reads acceptance.
+
+## 09:05 — Driver picks up
+
+Driver claims qitem. Reads slice scope. Surveys existing tdl repo (this is a worked example — imagine the repo is real). Plans: parse YAML; validate entries; exit code per finding.
+
+## 09:30 — First commit
+
+\`feat(lint): parse + validate todo entries\` — driver commits 4 files. Stream event emitted; visible in Artifacts tab.
+
+## 10:15 — Driver hands to reviewer
+
+Acceptance met locally. Driver hands off to \`reviewer@getting-started\`. Reviewer opens diff; reads tests.
+
+## 10:25 — Reviewer flags concern
+
+"Edge case: what about UTF-8 entries with combining characters?" Hands back to driver as \`concerning\`.
+
+## 10:40 — Driver addresses
+
+Driver fixes UTF-8 handling. Re-runs tests; all pass. Hands back.
+
+## 11:00 — Reviewer accepts
+
+\`accept\` decision; closes qitem with \`closure-reason: handed_off_to orch-lead\`. Conveyor proceeds.
+
+## 11:05 — Slice ships
+
+Orchestrator merges. Proof packet generated. Slice marked SHIPPED.
+
+---
+
+**What you just read**: one conveyor run from declaration to ship. ~2 hours wall-clock; 3 agents involved; 1 handoff with concern + remediation; 5 stream events; 1 proof packet.
+
+The Story tab shows this kind of narrative for any real slice. Driver-authored \`timeline.md\` files live in each slice folder; this is yours to read + your operator's to update as work moves.
+`;
+export const FIRST_CONVEYOR_RUN_PROGRESS = `---
+title: First Conveyor Run Progress
+status: active
+mission: getting-started
+rail-item: getting-started
+slice: first-conveyor-run
+---
+
+# Progress — First Conveyor Run
+
+## Acceptance criteria
+
+- [x] Parse YAML todo entries
+- [x] Validate per-entry shape (id, title, status, due-date)
+- [x] Exit non-zero on malformed entries
+- [x] Handle UTF-8 entries with combining characters
+- [x] Tests pass (12/12)
+- [x] Reviewer accepts
+- [x] Slice merged
+
+## Status: SHIPPED
+
+This was a mocked conveyor run — no real code was produced. But the Progress tab works the same way for real work: as acceptance criteria are met, boxes get checked; the operator can scan at a glance whether the slice is on track.
+
+## How the Progress tab works
+
+The tab renders the slice's \`PROGRESS.md\` markdown file. Driver updates it as work progresses. Operator scans it during walks. Founder reviews at slice closure.
+
+Try writing one for a real slice you start. It's just markdown; live updates appear here.
+`;
+export const INSPECT_PROJECT_EVIDENCE_README = `# Inspect Project Evidence
+
+The previous slice (First Conveyor Run) showed you what a conveyor run looks like as it happens. This slice teaches you how to inspect the evidence after a run completes.
+
+## Why inspect evidence?
+
+In OpenRig, agents work autonomously. The operator (you) doesn't watch every keystroke. Instead, the operator:
+
+1. Declares slices with clear acceptance
+2. Routes them to agents
+3. Inspects evidence when slices close
+
+The Artifacts + Tests + Queue + Topology tabs are your inspection surface. They show you what happened, with enough detail to:
+
+- Verify the acceptance was actually met
+- Spot subtle issues a passing test might miss
+- Build trust in the agents over time
+
+## Walking the tabs
+
+- **Overview** — you're here; learn what to look for
+- **Story** — read the narrative of what happened (high-level)
+- **Progress** — acceptance status at a glance
+- **Artifacts** — the durable evidence: files, commits, proof packets. **THIS IS THE TAB YOU LEARN MOST FROM.**
+- **Tests** — pass/fail + screenshots + verification proof
+- **Queue** — who handed what to whom (audit trail of decisions)
+- **Topology** — which agents touched this; which edges fired
+
+## Key inspection skills
+
+When walking a finished slice:
+
+1. **Read the Story** for context — what was the operator trying to do?
+2. **Check Progress** — did acceptance actually pass? Any TODO boxes?
+3. **Open Artifacts → Files** — sample-read 2-3 files; does the code match what the Story claimed?
+4. **Open Tests → Proof packets** — do screenshots actually show what was claimed?
+5. **Read Queue** — were there concerning decisions? Hand-offs to escalation?
+6. **Skim Topology** — were unexpected agents involved?
+
+Trust comes from repeated successful inspections, not from a single proof packet.
+`;
+export const INSPECT_PROJECT_EVIDENCE_TIMELINE = `# Story — Inspect Project Evidence
+
+This slice mirrors the previous one (First Conveyor Run). The same agents shipped the same work. But this view is from the inspector's angle, not the runner's.
+
+## 11:10 — Operator opens project
+
+Operator (you, in the real world) opens \`/project/slice/first-conveyor-run\` after the slice ships. First read: the Progress tab. All boxes checked.
+
+## 11:12 — Read Story
+
+Operator reads the Story narrative. Notices the reviewer's UTF-8 concern + driver's remediation. Confidence-building: there was friction, friction was caught, friction was addressed.
+
+## 11:15 — Open Artifacts
+
+Operator clicks Artifacts. Sees 4 commits, 5 files, 1 proof packet, 2 screenshots. Opens commit \`feat(lint): parse + validate todo entries\`. Reads the diff.
+
+## 11:18 — Read tests
+
+Operator opens Tests tab. 12/12 passing. Opens the proof packet — screenshot shows CLI output \`Error: malformed entry at line 3\`. Visually verifies the acceptance was met.
+
+## 11:22 — Skim Queue
+
+Operator scrolls Queue. 4 qitems in chronological order. Sees the \`concerning\` decision + subsequent \`accept\`. Confidence reinforced.
+
+## 11:25 — Mark complete
+
+Operator marks slice acceptance complete. Closes the inspection.
+
+---
+
+**What you just read**: a clean inspection in ~15 minutes. Operator builds trust through the evidence trail. This is the OpenRig usage pattern at scale: declare → route → inspect.
+`;
+export const INSPECT_PROJECT_EVIDENCE_PROGRESS = `---
+title: Inspect Project Evidence Progress
+status: active
+mission: getting-started
+rail-item: getting-started
+slice: inspect-project-evidence
+---
+
+# Progress — Inspect Project Evidence
+
+## Inspection checklist
+
+- [x] Read Story (context: what was being done)
+- [x] Check Progress (acceptance status)
+- [x] Sample-read Artifacts files
+- [x] Verify Tests proof packets visually
+- [x] Skim Queue for concerning decisions
+- [x] Skim Topology for unexpected agents
+
+## Status: COMPLETE
+
+This was a mocked inspection — a worked example of the inspection workflow.
+
+## How to apply this
+
+For any real slice that ships in YOUR project: open the slice page, walk the tabs in this order, check each box mentally. Over time you'll develop instincts for what passes the smell test vs what needs deeper investigation.
+`;
+/** Slice id → narrative content map. Scaffold callers use this to
+ *  override the boilerplate sliceReadme / sliceProgress for the two
+ *  getting-started slices. Other slices keep the boilerplate. */
+export const GETTING_STARTED_NARRATIVE = {
+    "first-conveyor-run": {
+        readme: FIRST_CONVEYOR_RUN_README,
+        timeline: FIRST_CONVEYOR_RUN_TIMELINE,
+        progress: FIRST_CONVEYOR_RUN_PROGRESS,
+    },
+    "inspect-project-evidence": {
+        readme: INSPECT_PROJECT_EVIDENCE_README,
+        timeline: INSPECT_PROJECT_EVIDENCE_TIMELINE,
+        progress: INSPECT_PROJECT_EVIDENCE_PROGRESS,
+    },
+};
+//# sourceMappingURL=getting-started-narrative.js.map

package/daemon/dist/domain/workspace/getting-started-narrative.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"getting-started-narrative.js","sourceRoot":"","sources":["../../../src/domain/workspace/getting-started-narrative.ts"],"names":[],"mappings":"AAAA,uCAAuC;AACvC,EAAE;AACF,sEAAsE;AACtE,qEAAqE;AACrE,mEAAmE;AACnE,qEAAqE;AACrE,sEAAsE;AACtE,EAAE;AACF,4BAA4B;AAC5B,sEAAsE;AACtE,uEAAuE;AACvE,kEAAkE;AAClE,mEAAmE;AACnE,iEAAiE;AACjE,YAAY;AACZ,EAAE;AACF,6HAA6H;AAE7H,MAAM,CAAC,MAAM,yBAAyB,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA6BxC,CAAC;AAEF,MAAM,CAAC,MAAM,2BAA2B,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA2C1C,CAAC;AAEF,MAAM,CAAC,MAAM,2BAA2B,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA6B1C,CAAC;AAEF,MAAM,CAAC,MAAM,+BAA+B,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAwC9C,CAAC;AAEF,MAAM,CAAC,MAAM,iCAAiC,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA+BhD,CAAC;AAEF,MAAM,CAAC,MAAM,iCAAiC,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;CA0BhD,CAAC;AAEF;;iEAEiE;AACjE,MAAM,CAAC,MAAM,yBAAyB,GAGlC;IACF,oBAAoB,EAAE;QACpB,MAAM,EAAE,yBAAyB;QACjC,QAAQ,EAAE,2BAA2B;QACrC,QAAQ,EAAE,2BAA2B;KACtC;IACD,0BAA0B,EAAE;QAC1B,MAAM,EAAE,+BAA+B;QACvC,QAAQ,EAAE,iCAAiC;QAC3C,QAAQ,EAAE,iCAAiC;KAC5C;CACF,CAAC"}

package/daemon/dist/domain/workspace/workspace-resolver.d.ts

@@ -0,0 +1,25 @@
+import type { WorkspaceSpec, WorkspaceKind, NodeWorkspaceInfo } from "../types.js";
+export interface WhoamiWorkspaceBlock {
+    workspaceRoot: string;
+    activeRepo: string | null;
+    repos: Array<{
+        name: string;
+        path: string;
+        kind: WorkspaceKind;
+    }>;
+    knowledgeRoot: string | null;
+    knowledgeKind: WorkspaceKind | null;
+}
+export declare function resolveWorkspaceContext(opts: {
+    spec: WorkspaceSpec | null;
+    cwd: string | null;
+    envOverride: string | null;
+}): WhoamiWorkspaceBlock | null;
+/** PL-007 — per-node workspace summary derived from a node's cwd against
+ *  the rig's WorkspaceSpec. Used by NodeInventory. Returns null when the
+ *  rig has no workspace declaration. */
+export declare function resolveNodeWorkspace(opts: {
+    spec: WorkspaceSpec | null;
+    cwd: string | null;
+}): NodeWorkspaceInfo | null;
+//# sourceMappingURL=workspace-resolver.d.ts.map

package/daemon/dist/domain/workspace/workspace-resolver.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"workspace-resolver.d.ts","sourceRoot":"","sources":["../../../src/domain/workspace/workspace-resolver.ts"],"names":[],"mappings":"AAeA,OAAO,KAAK,EAAE,aAAa,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAEnF,MAAM,WAAW,oBAAoB;IACnC,aAAa,EAAE,MAAM,CAAC;IACtB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,KAAK,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,aAAa,CAAA;KAAE,CAAC,CAAC;IAClE,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,aAAa,EAAE,aAAa,GAAG,IAAI,CAAC;CACrC;AAED,wBAAgB,uBAAuB,CAAC,IAAI,EAAE;IAC5C,IAAI,EAAE,aAAa,GAAG,IAAI,CAAC;IAC3B,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IACnB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;CAC5B,GAAG,oBAAoB,GAAG,IAAI,CAsB9B;AAED;;wCAEwC;AACxC,wBAAgB,oBAAoB,CAAC,IAAI,EAAE;IACzC,IAAI,EAAE,aAAa,GAAG,IAAI,CAAC;IAC3B,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;CACpB,GAAG,iBAAiB,GAAG,IAAI,CAmC3B"}

package/daemon/dist/domain/workspace/workspace-resolver.js

@@ -0,0 +1,86 @@
+// PL-007 Workspace Primitive v0 — runtime resolution of typed workspace
+// context for whoami / node-inventory consumers.
+//
+// Given a persisted RigSpec.workspace block + a node's cwd + an optional
+// per-session env override, derive:
+//   - workspaceRoot          — verbatim from the spec
+//   - activeRepo             — env override, else default_repo, else null
+//   - repos                  — typed list (name, path, kind)
+//   - knowledgeRoot, knowledgeKind — verbatim when declared
+//
+// Per-node kind resolution (used by node-inventory) walks the cwd up the
+// directory tree looking for the longest containing repo path; falls back
+// to "knowledge" when cwd is under knowledgeRoot, else null.
+import * as path from "node:path";
+export function resolveWorkspaceContext(opts) {
+    const { spec, envOverride } = opts;
+    if (!spec)
+        return null;
+    // env override wins when it names a declared repo; otherwise fall through
+    // to default_repo. Unknown override is honored verbatim per PL-007 PRD §
+    // Item 3 — operators set OPENRIG_TARGET_REPO consciously.
+    const repoNames = new Set(spec.repos.map((r) => r.name));
+    let activeRepo = null;
+    if (envOverride && envOverride.trim() !== "") {
+        activeRepo = envOverride;
+    }
+    else if (spec.defaultRepo && repoNames.has(spec.defaultRepo)) {
+        activeRepo = spec.defaultRepo;
+    }
+    return {
+        workspaceRoot: spec.workspaceRoot,
+        activeRepo,
+        repos: spec.repos.map((r) => ({ name: r.name, path: r.path, kind: r.kind })),
+        knowledgeRoot: spec.knowledgeRoot ?? null,
+        knowledgeKind: spec.knowledgeRoot ? "knowledge" : null,
+    };
+}
+/** PL-007 — per-node workspace summary derived from a node's cwd against
+ *  the rig's WorkspaceSpec. Used by NodeInventory. Returns null when the
+ *  rig has no workspace declaration. */
+export function resolveNodeWorkspace(opts) {
+    const { spec, cwd } = opts;
+    if (!spec)
+        return null;
+    let activeRepo = null;
+    let kind = null;
+    if (cwd) {
+        // Find the longest-prefix repo whose path contains cwd.
+        let best = null;
+        for (const r of spec.repos) {
+            if (isInside(cwd, r.path) && r.path.length > (best?.len ?? -1)) {
+                best = { name: r.name, kind: r.kind, len: r.path.length };
+            }
+        }
+        if (best) {
+            activeRepo = best.name;
+            kind = best.kind;
+        }
+        else if (spec.knowledgeRoot && isInside(cwd, spec.knowledgeRoot)) {
+            kind = "knowledge";
+        }
+    }
+    // Fall back to the rig's default_repo when cwd doesn't resolve.
+    if (!activeRepo && spec.defaultRepo) {
+        activeRepo = spec.defaultRepo;
+        if (!kind) {
+            const r = spec.repos.find((x) => x.name === spec.defaultRepo);
+            if (r)
+                kind = r.kind;
+        }
+    }
+    return {
+        workspaceRoot: spec.workspaceRoot,
+        activeRepo,
+        kind,
+    };
+}
+function isInside(child, parent) {
+    const normChild = path.resolve(child);
+    const normParent = path.resolve(parent);
+    if (normChild === normParent)
+        return true;
+    const rel = path.relative(normParent, normChild);
+    return rel !== "" && !rel.startsWith("..") && !path.isAbsolute(rel);
+}
+//# sourceMappingURL=workspace-resolver.js.map

package/daemon/dist/domain/workspace/workspace-resolver.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"workspace-resolver.js","sourceRoot":"","sources":["../../../src/domain/workspace/workspace-resolver.ts"],"names":[],"mappings":"AAAA,wEAAwE;AACxE,iDAAiD;AACjD,EAAE;AACF,yEAAyE;AACzE,oCAAoC;AACpC,sDAAsD;AACtD,0EAA0E;AAC1E,6DAA6D;AAC7D,4DAA4D;AAC5D,EAAE;AACF,yEAAyE;AACzE,0EAA0E;AAC1E,6DAA6D;AAE7D,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAWlC,MAAM,UAAU,uBAAuB,CAAC,IAIvC;IACC,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,GAAG,IAAI,CAAC;IACnC,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IAEvB,0EAA0E;IAC1E,yEAAyE;IACzE,0DAA0D;IAC1D,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IACzD,IAAI,UAAU,GAAkB,IAAI,CAAC;IACrC,IAAI,WAAW,IAAI,WAAW,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QAC7C,UAAU,GAAG,WAAW,CAAC;IAC3B,CAAC;SAAM,IAAI,IAAI,CAAC,WAAW,IAAI,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;QAC/D,UAAU,GAAG,IAAI,CAAC,WAAW,CAAC;IAChC,CAAC;IAED,OAAO;QACL,aAAa,EAAE,IAAI,CAAC,aAAa;QACjC,UAAU;QACV,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QAC5E,aAAa,EAAE,IAAI,CAAC,aAAa,IAAI,IAAI;QACzC,aAAa,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI;KACvD,CAAC;AACJ,CAAC;AAED;;wCAEwC;AACxC,MAAM,UAAU,oBAAoB,CAAC,IAGpC;IACC,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;IAC3B,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IAEvB,IAAI,UAAU,GAAkB,IAAI,CAAC;IACrC,IAAI,IAAI,GAAyB,IAAI,CAAC;IACtC,IAAI,GAAG,EAAE,CAAC;QACR,wDAAwD;QACxD,IAAI,IAAI,GAA8D,IAAI,CAAC;QAC3E,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YAC3B,IAAI,QAAQ,CAAC,GAAG,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC/D,IAAI,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;YAC5D,CAAC;QACH,CAAC;QACD,IAAI,IAAI,EAAE,CAAC;YACT,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC;YACvB,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;QACnB,CAAC;aAAM,IAAI,IAAI,CAAC,aAAa,IAAI,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC,aAAa,CAAC,EAAE,CAAC;YACnE,IAAI,GAAG,WAAW,CAAC;QACrB,CAAC;IACH,CAAC;IACD,gEAAgE;IAChE,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;QACpC,UAAU,GAAG,IAAI,CAAC,WAAW,CAAC;QAC9B,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,WAAW,CAAC,CAAC;YAC9D,IAAI,CAAC;gBAAE,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC;QACvB,CAAC;IACH,CAAC;IAED,OAAO;QACL,aAAa,EAAE,IAAI,CAAC,aAAa;QACjC,UAAU;QACV,IAAI;KACL,CAAC;AACJ,CAAC;AAED,SAAS,QAAQ,CAAC,KAAa,EAAE,MAAc;IAC7C,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IACtC,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACxC,IAAI,SAAS,KAAK,UAAU;QAAE,OAAO,IAAI,CAAC;IAC1C,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC;IACjD,OAAO,GAAG,KAAK,EAAE,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;AACtE,CAAC"}

package/daemon/dist/index.d.ts

@@ -1,2 +1,3 @@
-export declare function startServer(port?: number): Promise<import("@hono/node-server").ServerType>;
+import { type ServerType } from "@hono/node-server";
+export declare function startServer(port?: number): Promise<ServerType>;
 //# sourceMappingURL=index.d.ts.map

package/daemon/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAIA,wBAAsB,WAAW,CAAC,IAAI,CAAC,EAAE,MAAM,mDAiC9C"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAS,KAAK,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAQ3D,wBAAsB,WAAW,CAAC,IAAI,CAAC,EAAE,MAAM,uBAgF9C"}

package/daemon/dist/index.js

@@ -1,22 +1,56 @@
 import { serve } from "@hono/node-server";
 import { readOpenRigEnv } from "./openrig-compat.js";
 import { createDaemon } from "./startup.js";
+import { assertBindAuthInvariant, detectTailscaleInterface, } from "./middleware/auth-bearer-token.js";
 export async function startServer(port) {
     const p = port ?? parseInt(readOpenRigEnv("OPENRIG_PORT", "RIGGED_PORT") ?? "7433", 10);
     const dbPath = readOpenRigEnv("OPENRIG_DB", "RIGGED_DB") ?? "openrig.sqlite";
-    const { app, contextMonitor, deps } = await createDaemon({ dbPath });
-    const h = readOpenRigEnv("OPENRIG_HOST", "RIGGED_HOST") ?? "127.0.0.1";
-    const server = serve({ fetch: app.fetch, port: p, hostname: h }, (info) => {
-        console.log(`OpenRig daemon listening on http://localhost:${info.port}`);
-        // Start context monitor polling only after successful server bind
-        contextMonitor.start();
-        // PL-004 Phase C: start watchdog scheduler. Joins the supervision
-        // tree post-bind so the HTTP surface is ready before the first
-        // tick (matches contextMonitor pattern).
-        deps.watchdogScheduler?.start();
-    });
+    // bug-fix slice auth-bearer-tailscale-trust: distinguish "explicit
+    // operator opt-in" from "default" by treating an undefined env as
+    // default. When explicit, the operator takes responsibility (and the
+    // bearer invariant applies to their chosen host). When default, the
+    // daemon always binds loopback and ALSO binds the active tailscale
+    // interface (if present) — both accepted paths in the invariant.
+    const explicitHost = readOpenRigEnv("OPENRIG_HOST", "RIGGED_HOST");
+    // PL-005 Phase B: bearer token for Mission Control write verbs.
+    // No legacy alias (this env var is new in Phase B).
+    const bearerToken = process.env.OPENRIG_AUTH_BEARER_TOKEN ?? null;
+    let bindHosts;
+    if (explicitHost) {
+        // Operator opt-in path — invariant enforces bearer requirement for
+        // genuinely public/LAN binds; loopback/tailscale binds short-circuit.
+        await assertBindAuthInvariant({ host: explicitHost, bearerToken });
+        bindHosts = [explicitHost];
+    }
+    else {
+        // Default path — loopback always, plus tailscale auto-add when active.
+        const tailscaleIp = detectTailscaleInterface();
+        bindHosts = tailscaleIp ? ["127.0.0.1", tailscaleIp] : ["127.0.0.1"];
+    }
+    const { app, contextMonitor, deps } = await createDaemon({ dbPath, bearerToken });
+    // Multi-bind via N serve() instances sharing the same Hono app.
+    // Hono's serve() targets a single host:port; for multi-bind we spawn
+    // one per host. The contextMonitor + watchdog scheduler only start
+    // once after the first successful bind callback fires.
+    let monitorsStarted = false;
+    const servers = [];
+    for (const host of bindHosts) {
+        const srv = serve({ fetch: app.fetch, port: p, hostname: host }, (info) => {
+            console.log(`OpenRig daemon listening on http://${host}:${info.port}`);
+            if (!monitorsStarted) {
+                monitorsStarted = true;
+                contextMonitor.start();
+                // PL-004 Phase C: start watchdog scheduler. Joins the supervision
+                // tree post-bind so the HTTP surface is ready before the first
+                // tick (matches contextMonitor pattern).
+                deps.watchdogScheduler?.start();
+            }
+        });
+        servers.push(srv);
+    }
     // PL-004 Phase C: graceful shutdown — stop scheduler before process
     // exit so any in-flight policy evaluation completes (or is awaited).
+    // Multi-bind: close every serve() instance in parallel.
     const shutdown = async (sig) => {
         console.log(`OpenRig daemon received ${sig}; shutting down`);
         try {
@@ -25,11 +59,21 @@ export async function startServer(port) {
         catch (err) {
             console.error("[watchdog] shutdown error", err);
         }
+        await Promise.all(servers.map((srv) => new Promise((resolve) => {
+            try {
+                srv.close(() => resolve());
+            }
+            catch {
+                resolve();
+            }
+        })));
         process.exit(0);
     };
     process.once("SIGINT", () => void shutdown("SIGINT"));
     process.once("SIGTERM", () => void shutdown("SIGTERM"));
-    return server;
+    // Backward-compatible single-server return (callers that just need a
+    // handle reference; multi-bind shutdown is wired via signal handlers).
+    return servers[0];
 }
 // Only start the server when this file is executed directly (not imported).
 const isDirectRun = process.argv[1] &&

package/daemon/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,mBAAmB,CAAC;AAC1C,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AACrD,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAE5C,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,IAAa;IAC7C,MAAM,CAAC,GAAG,IAAI,IAAI,QAAQ,CAAC,cAAc,CAAC,cAAc,EAAE,aAAa,CAAC,IAAI,MAAM,EAAE,EAAE,CAAC,CAAC;IACxF,MAAM,MAAM,GAAG,cAAc,CAAC,YAAY,EAAE,WAAW,CAAC,IAAI,gBAAgB,CAAC;IAE7E,MAAM,EAAE,GAAG,EAAE,cAAc,EAAE,IAAI,EAAE,GAAG,MAAM,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;IAErE,MAAM,CAAC,GAAG,cAAc,CAAC,cAAc,EAAE,aAAa,CAAC,IAAI,WAAW,CAAC;IAEvE,MAAM,MAAM,GAAG,KAAK,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,EAAE,CAAC,IAAI,EAAE,EAAE;QACxE,OAAO,CAAC,GAAG,CAAC,gDAAgD,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;QACzE,kEAAkE;QAClE,cAAc,CAAC,KAAK,EAAE,CAAC;QACvB,kEAAkE;QAClE,+DAA+D;QAC/D,yCAAyC;QACzC,IAAI,CAAC,iBAAiB,EAAE,KAAK,EAAE,CAAC;IAClC,CAAC,CAAC,CAAC;IAEH,oEAAoE;IACpE,qEAAqE;IACrE,MAAM,QAAQ,GAAG,KAAK,EAAE,GAAW,EAAE,EAAE;QACrC,OAAO,CAAC,GAAG,CAAC,2BAA2B,GAAG,iBAAiB,CAAC,CAAC;QAC7D,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,iBAAiB,EAAE,IAAI,EAAE,CAAC;QACvC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,KAAK,CAAC,2BAA2B,EAAE,GAAG,CAAC,CAAC;QAClD,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC,CAAC;IACF,OAAO,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,EAAE,CAAC,KAAK,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC;IACtD,OAAO,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,KAAK,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC;IAExD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,4EAA4E;AAC5E,MAAM,WAAW,GACf,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;IACf,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,UAAU,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;AAElD,IAAI,WAAW,EAAE,CAAC;IAChB,WAAW,EAAE,CAAC;AAChB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAmB,MAAM,mBAAmB,CAAC;AAC3D,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AACrD,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAC5C,OAAO,EACL,uBAAuB,EACvB,wBAAwB,GACzB,MAAM,mCAAmC,CAAC;AAE3C,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,IAAa;IAC7C,MAAM,CAAC,GAAG,IAAI,IAAI,QAAQ,CAAC,cAAc,CAAC,cAAc,EAAE,aAAa,CAAC,IAAI,MAAM,EAAE,EAAE,CAAC,CAAC;IACxF,MAAM,MAAM,GAAG,cAAc,CAAC,YAAY,EAAE,WAAW,CAAC,IAAI,gBAAgB,CAAC;IAE7E,mEAAmE;IACnE,kEAAkE;IAClE,qEAAqE;IACrE,oEAAoE;IACpE,mEAAmE;IACnE,iEAAiE;IACjE,MAAM,YAAY,GAAG,cAAc,CAAC,cAAc,EAAE,aAAa,CAAC,CAAC;IACnE,gEAAgE;IAChE,oDAAoD;IACpD,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,yBAAyB,IAAI,IAAI,CAAC;IAElE,IAAI,SAAmB,CAAC;IACxB,IAAI,YAAY,EAAE,CAAC;QACjB,mEAAmE;QACnE,sEAAsE;QACtE,MAAM,uBAAuB,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,WAAW,EAAE,CAAC,CAAC;QACnE,SAAS,GAAG,CAAC,YAAY,CAAC,CAAC;IAC7B,CAAC;SAAM,CAAC;QACN,uEAAuE;QACvE,MAAM,WAAW,GAAG,wBAAwB,EAAE,CAAC;QAC/C,SAAS,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC;IACvE,CAAC;IAED,MAAM,EAAE,GAAG,EAAE,cAAc,EAAE,IAAI,EAAE,GAAG,MAAM,YAAY,CAAC,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC,CAAC;IAElF,gEAAgE;IAChE,qEAAqE;IACrE,mEAAmE;IACnE,uDAAuD;IACvD,IAAI,eAAe,GAAG,KAAK,CAAC;IAC5B,MAAM,OAAO,GAAiB,EAAE,CAAC;IACjC,KAAK,MAAM,IAAI,IAAI,SAAS,EAAE,CAAC;QAC7B,MAAM,GAAG,GAAG,KAAK,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,EAAE;YACxE,OAAO,CAAC,GAAG,CAAC,sCAAsC,IAAI,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;YACvE,IAAI,CAAC,eAAe,EAAE,CAAC;gBACrB,eAAe,GAAG,IAAI,CAAC;gBACvB,cAAc,CAAC,KAAK,EAAE,CAAC;gBACvB,kEAAkE;gBAClE,+DAA+D;gBAC/D,yCAAyC;gBACzC,IAAI,CAAC,iBAAiB,EAAE,KAAK,EAAE,CAAC;YAClC,CAAC;QACH,CAAC,CAAC,CAAC;QACH,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACpB,CAAC;IAED,oEAAoE;IACpE,qEAAqE;IACrE,wDAAwD;IACxD,MAAM,QAAQ,GAAG,KAAK,EAAE,GAAW,EAAE,EAAE;QACrC,OAAO,CAAC,GAAG,CAAC,2BAA2B,GAAG,iBAAiB,CAAC,CAAC;QAC7D,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,iBAAiB,EAAE,IAAI,EAAE,CAAC;QACvC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,KAAK,CAAC,2BAA2B,EAAE,GAAG,CAAC,CAAC;QAClD,CAAC;QACD,MAAM,OAAO,CAAC,GAAG,CACf,OAAO,CAAC,GAAG,CACT,CAAC,GAAG,EAAE,EAAE,CACN,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE;YAC5B,IAAI,CAAC;gBACH,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC;YAC7B,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,EAAE,CAAC;YACZ,CAAC;QACH,CAAC,CAAC,CACL,CACF,CAAC;QACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC,CAAC;IACF,OAAO,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,EAAE,CAAC,KAAK,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC;IACtD,OAAO,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,KAAK,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC;IAExD,qEAAqE;IACrE,uEAAuE;IACvE,OAAO,OAAO,CAAC,CAAC,CAAE,CAAC;AACrB,CAAC;AAED,4EAA4E;AAC5E,MAAM,WAAW,GACf,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;IACf,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,UAAU,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;AAElD,IAAI,WAAW,EAAE,CAAC;IAChB,WAAW,EAAE,CAAC;AAChB,CAAC"}

package/daemon/dist/lib/pane-envelope.d.ts

@@ -0,0 +1,7 @@
+/** Wrap a tmux-pane body with the canonical From/To envelope. The
+ *  recipient pane sees both the sender's identity and a reply hint.
+ *  Cross-host nudges should NOT double-wrap: the remote rig wraps
+ *  when it processes the same command (matches `wrapSendBody`'s
+ *  cross-host carve-out). */
+export declare function wrapPaneEnvelope(sender: string | undefined, recipient: string, body: string): string;
+//# sourceMappingURL=pane-envelope.d.ts.map

package/daemon/dist/lib/pane-envelope.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pane-envelope.d.ts","sourceRoot":"","sources":["../../src/lib/pane-envelope.ts"],"names":[],"mappings":"AAuBA;;;;6BAI6B;AAC7B,wBAAgB,gBAAgB,CAC9B,MAAM,EAAE,MAAM,GAAG,SAAS,EAC1B,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE,MAAM,GACX,MAAM,CAUR"}

package/daemon/dist/lib/pane-envelope.js

@@ -0,0 +1,38 @@
+// V0.3.1 slice 23 founder-walk-queue-handoff-envelope.
+//
+// Daemon-side renderer for the email-style envelope the recipient's
+// tmux pane shows when a peer sends them a message (`rig send`) or
+// when a queue handoff/create nudges them. Wrapping the body with
+// From / To / --- / body / --- / ↩ Reply gives both a sender
+// identity and a copy-pasteable reply hint.
+//
+// PARITY CONTRACT with CLI:
+// `packages/cli/src/commands/send.ts :: wrapSendBody` must produce
+// BYTE-IDENTICAL output for the same inputs. The two implementations
+// live in separate packages because cli + daemon don't cross-import
+// today; the contract is enforced via:
+//   1. Identical function body (visual diff)
+//   2. `packages/daemon/test/pane-envelope.test.ts` mirroring the
+//      assertions in `packages/cli/test/send-header.test.ts`
+//   3. Live integration parity (HG-5): a queue handoff nudge and a
+//      rig send to the same destination render byte-identical
+//      output except for the body content
+// If you update this function, update wrapSendBody in lockstep.
+const SENDER_FALLBACK = "<unknown sender>";
+/** Wrap a tmux-pane body with the canonical From/To envelope. The
+ *  recipient pane sees both the sender's identity and a reply hint.
+ *  Cross-host nudges should NOT double-wrap: the remote rig wraps
+ *  when it processes the same command (matches `wrapSendBody`'s
+ *  cross-host carve-out). */
+export function wrapPaneEnvelope(sender, recipient, body) {
+    const senderLabel = sender && sender.trim().length > 0 ? sender : SENDER_FALLBACK;
+    return [
+        `From: ${senderLabel}`,
+        `To: ${recipient}`,
+        "---",
+        body,
+        "---",
+        `↩ Reply: rig send ${senderLabel} "..."`,
+    ].join("\n");
+}
+//# sourceMappingURL=pane-envelope.js.map

package/daemon/dist/lib/pane-envelope.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pane-envelope.js","sourceRoot":"","sources":["../../src/lib/pane-envelope.ts"],"names":[],"mappings":"AAAA,uDAAuD;AACvD,EAAE;AACF,oEAAoE;AACpE,mEAAmE;AACnE,kEAAkE;AAClE,6DAA6D;AAC7D,4CAA4C;AAC5C,EAAE;AACF,4BAA4B;AAC5B,mEAAmE;AACnE,qEAAqE;AACrE,oEAAoE;AACpE,uCAAuC;AACvC,6CAA6C;AAC7C,kEAAkE;AAClE,6DAA6D;AAC7D,mEAAmE;AACnE,8DAA8D;AAC9D,0CAA0C;AAC1C,gEAAgE;AAEhE,MAAM,eAAe,GAAG,kBAAkB,CAAC;AAE3C;;;;6BAI6B;AAC7B,MAAM,UAAU,gBAAgB,CAC9B,MAA0B,EAC1B,SAAiB,EACjB,IAAY;IAEZ,MAAM,WAAW,GAAG,MAAM,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,eAAe,CAAC;IAClF,OAAO;QACL,SAAS,WAAW,EAAE;QACtB,OAAO,SAAS,EAAE;QAClB,KAAK;QACL,IAAI;QACJ,KAAK;QACL,qBAAqB,WAAW,QAAQ;KACzC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC"}

package/daemon/dist/middleware/auth-bearer-token.d.ts

@@ -0,0 +1,91 @@
+import { type NetworkInterfaceInfo } from "node:os";
+import type { MiddlewareHandler } from "hono";
+/**
+ * Constant-time string equality using Node's timingSafeEqual.
+ * Returns false when lengths differ (timingSafeEqual throws on
+ * length mismatch; we pad-compare to keep a constant-ish branch
+ * profile while still returning the honest false).
+ */
+export declare function constantTimeEqual(a: string, b: string): boolean;
+export interface AuthBearerTokenOpts {
+    /**
+     * The expected bearer token. When this is null, the middleware
+     * lets all requests through (the daemon-level startup check
+     * elsewhere ensures this only happens when bound on loopback).
+     */
+    expectedToken: string | null;
+}
+/**
+ * Hono middleware that enforces bearer-token auth on the routes it
+ * is mounted on. Returns 401 with a three-part error body for missing
+ * or mismatched tokens.
+ *
+ * When `expectedToken` is null, the middleware passes through. The
+ * startup check in `startup.ts` ensures null is only valid when the
+ * bind interface is loopback.
+ */
+export declare function authBearerTokenMiddleware(opts: AuthBearerTokenOpts): MiddlewareHandler;
+/**
+ * Detect whether a host bind value is loopback-only (safe to skip
+ * bearer requirement) vs non-loopback (tailnet / public; requires
+ * bearer). Loopback set: `127.x.x.x`, `::1`, `localhost`. Anything
+ * else (including `0.0.0.0`, `::`, named hostnames, tailnet IPs) is
+ * treated as non-loopback.
+ */
+export declare function isLoopbackBind(host: string | undefined | null): boolean;
+/**
+ * Detect tailscale CGNAT IPv4 (100.64.0.0/10) and ULA IPv6 prefix
+ * (fd7a:115c:a1e0::/48). Returns true for tailnet-literal IP addresses
+ * only; hostname callers must first resolve via {@link resolveToIpOrNull}.
+ *
+ * Rationale: tailscale's WireGuard mesh + ACLs ARE the auth boundary, so
+ * a tailnet-bound daemon does not need an additional bearer token. The
+ * CGNAT IPv4 range and ULA IPv6 prefix are reserved by tailscale and
+ * documented; collisions on real-world networks are essentially zero.
+ *
+ * Boundary semantics for HG-3: CGNAT is 100.64.0.0/10 → first octet
+ * exactly 100, second octet 64..127 inclusive. 100.63.x.x and
+ * 100.128.x.x are NOT tailnet.
+ */
+export declare function isTailscaleBind(host: string | undefined | null): boolean;
+/**
+ * Pure helper for {@link detectTailscaleInterface}: takes a NetworkInterfaces
+ * dictionary (the shape returned by os.networkInterfaces()) and returns the
+ * first non-internal address that matches the tailnet IP ranges, or null.
+ * Factored out so tests can supply synthetic interface fixtures without
+ * mocking node:os.
+ */
+export declare function findTailscaleIpInInterfaces(interfaces: NodeJS.Dict<NetworkInterfaceInfo[]>): string | null;
+/**
+ * Probe the host's network interfaces and return the first tailscale-IP
+ * address found (CGNAT IPv4 or tailnet ULA IPv6), or null when no tailnet
+ * interface is currently active. Used at daemon startup to decide whether
+ * to multi-bind (loopback + tailnet) or loopback-only. Detection is
+ * IP-based, not interface-name-based, so it survives platform differences
+ * in how tailscale names its tun device.
+ */
+export declare function detectTailscaleInterface(): string | null;
+/**
+ * Resolve a hostname to its first IP via node:dns/promises lookup.
+ * Returns null on resolution failure (DNS error, timeout, no such host).
+ * Wrapped with a 5s race-timeout per Risk 9.2 in the slice IMPL-PRD so an
+ * unresponsive resolver does not stall daemon startup indefinitely.
+ */
+export declare function resolveToIpOrNull(host: string): Promise<string | null>;
+export declare class AuthBearerTokenStartupError extends Error {
+    constructor(message: string);
+}
+/**
+ * Startup-side check (HARD-GATE audit row 8). Throws an explicit
+ * AuthBearerTokenStartupError when the bind interface is genuinely
+ * public/LAN AND the bearer token is empty. Loopback or tailscale-IP
+ * binds short-circuit (the tailnet is the auth boundary). Hostname
+ * binds resolve via DNS first; if resolution yields a loopback or
+ * tailnet IP, the same short-circuit applies. Public/LAN binds without
+ * a bearer throw and the daemon refuses to start.
+ */
+export declare function assertBindAuthInvariant(opts: {
+    host: string;
+    bearerToken: string | null;
+}): Promise<void>;
+//# sourceMappingURL=auth-bearer-token.d.ts.map

package/daemon/dist/middleware/auth-bearer-token.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-bearer-token.d.ts","sourceRoot":"","sources":["../../src/middleware/auth-bearer-token.ts"],"names":[],"mappings":"AA0BA,OAAO,EAAqB,KAAK,oBAAoB,EAAE,MAAM,SAAS,CAAC;AACvE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,MAAM,CAAC;AAE9C;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,GAAG,OAAO,CAe/D;AAwBD,MAAM,WAAW,mBAAmB;IAClC;;;;OAIG;IACH,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;CAC9B;AAED;;;;;;;;GAQG;AACH,wBAAgB,yBAAyB,CACvC,IAAI,EAAE,mBAAmB,GACxB,iBAAiB,CAyBnB;AAED;;;;;;GAMG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,GAAG,OAAO,CAWvE;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,GAAG,OAAO,CAaxE;AAED;;;;;;GAMG;AACH,wBAAgB,2BAA2B,CACzC,UAAU,EAAE,MAAM,CAAC,IAAI,CAAC,oBAAoB,EAAE,CAAC,GAC9C,MAAM,GAAG,IAAI,CASf;AAED;;;;;;;GAOG;AACH,wBAAgB,wBAAwB,IAAI,MAAM,GAAG,IAAI,CAExD;AAED;;;;;GAKG;AACH,wBAAsB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAa5E;AAED,qBAAa,2BAA4B,SAAQ,KAAK;gBACxC,OAAO,EAAE,MAAM;CAI5B;AAED;;;;;;;;GAQG;AACH,wBAAsB,uBAAuB,CAAC,IAAI,EAAE;IAClD,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;CAC5B,GAAG,OAAO,CAAC,IAAI,CAAC,CAqBhB"}