@openrig/cli 0.2.0 → 0.3.1

package/daemon/dist/middleware/auth-bearer-token.js

@@ -0,0 +1,236 @@
+// PL-005 Phase B: bearer-token middleware for /api/mission-control/*.
+//
+// Per slice IMPL § Write Set + audit hard-gates 8 + 9:
+//   - Constant-time bearer comparison via Node `crypto.timingSafeEqual`.
+//     No early-return on byte mismatch.
+//   - 401 with three-part error body on missing or mismatched token
+//     (what failed + why it matters + what to do).
+//   - Daemon refuses to start with a non-loopback bind interface AND
+//     empty bearer config — startup-side check (see startup.ts).
+//
+// MVP context (single-developer, single-user, single-host): one static
+// bearer token sourced from a config field. NO OAuth / SSO / per-user
+// routing / role-based permissions / token rotation. Token holder is
+// fully privileged.
+//
+// Mounted on /api/mission-control/* write verbs at minimum (POST
+// /action, POST /notifications/test). Reads (GET /views, /audit, etc.)
+// MAY be gated under the same token at operator option (Phase B
+// driver default: gate writes only; reads remain open behind tailnet
+// bind for the headed-browser-from-phone case where the operator
+// hasn't typed the token into mobile yet — the bearer is for write
+// integrity, not view confidentiality).
+import { Buffer } from "node:buffer";
+import { timingSafeEqual } from "node:crypto";
+import { promises as dns } from "node:dns";
+import { networkInterfaces } from "node:os";
+/**
+ * Constant-time string equality using Node's timingSafeEqual.
+ * Returns false when lengths differ (timingSafeEqual throws on
+ * length mismatch; we pad-compare to keep a constant-ish branch
+ * profile while still returning the honest false).
+ */
+export function constantTimeEqual(a, b) {
+    // Length check is unavoidable for timingSafeEqual to work, but the
+    // compare is still constant-time within the equal-length case. For
+    // unequal lengths we still run a fixed-size compare against a buffer
+    // of zeros so an attacker cannot infer "wrong length vs wrong byte"
+    // from response timing.
+    const aBuf = Buffer.from(a, "utf8");
+    const bBuf = Buffer.from(b, "utf8");
+    if (aBuf.length !== bBuf.length) {
+        // Compare against a same-length zero buffer to keep the call site
+        // cost similar across mismatch paths. Result is always false here.
+        timingSafeEqual(aBuf, Buffer.alloc(aBuf.length));
+        return false;
+    }
+    return timingSafeEqual(aBuf, bBuf);
+}
+/**
+ * Three-part error body shape per OpenRig honest-error-reporting
+ * convention. Renders inside the route's c.json call.
+ */
+function unauthorizedBody(reason) {
+    return {
+        error: "unauthorized",
+        message: `Mission Control auth failed: ${reason}`,
+        what_failed: reason,
+        why_it_matters: "Mission Control write verbs require a bearer token because the daemon may be bound on a non-loopback interface (tailnet) where unauthenticated mutation would be unsafe.",
+        what_to_do: "Set the auth.bearerToken field in daemon config (or OPENRIG_AUTH_BEARER_TOKEN env), restart the daemon, and resend the request with `Authorization: Bearer <token>`.",
+    };
+}
+/**
+ * Hono middleware that enforces bearer-token auth on the routes it
+ * is mounted on. Returns 401 with a three-part error body for missing
+ * or mismatched tokens.
+ *
+ * When `expectedToken` is null, the middleware passes through. The
+ * startup check in `startup.ts` ensures null is only valid when the
+ * bind interface is loopback.
+ */
+export function authBearerTokenMiddleware(opts) {
+    const { expectedToken } = opts;
+    return async (c, next) => {
+        if (expectedToken === null) {
+            // Loopback-only mode (no bearer configured). Pass through.
+            await next();
+            return;
+        }
+        const header = c.req.header("Authorization") ?? c.req.header("authorization");
+        if (!header) {
+            return c.json(unauthorizedBody("missing Authorization header"), 401);
+        }
+        const match = /^Bearer\s+(.+)$/i.exec(header);
+        if (!match) {
+            return c.json(unauthorizedBody("Authorization header must be 'Bearer <token>'"), 401);
+        }
+        const provided = match[1].trim();
+        if (!constantTimeEqual(provided, expectedToken)) {
+            return c.json(unauthorizedBody("bearer token does not match"), 401);
+        }
+        await next();
+    };
+}
+/**
+ * Detect whether a host bind value is loopback-only (safe to skip
+ * bearer requirement) vs non-loopback (tailnet / public; requires
+ * bearer). Loopback set: `127.x.x.x`, `::1`, `localhost`. Anything
+ * else (including `0.0.0.0`, `::`, named hostnames, tailnet IPs) is
+ * treated as non-loopback.
+ */
+export function isLoopbackBind(host) {
+    if (!host || host.length === 0) {
+        // Default Hono / @hono/node-server bind is 0.0.0.0 — treat as
+        // non-loopback for safety (force operator to either bind explicitly
+        // to 127.0.0.1 or set the bearer token).
+        return false;
+    }
+    const trimmed = host.trim().toLowerCase();
+    if (trimmed === "localhost" || trimmed === "::1" || trimmed === "[::1]")
+        return true;
+    if (trimmed.startsWith("127."))
+        return true;
+    return false;
+}
+/**
+ * Detect tailscale CGNAT IPv4 (100.64.0.0/10) and ULA IPv6 prefix
+ * (fd7a:115c:a1e0::/48). Returns true for tailnet-literal IP addresses
+ * only; hostname callers must first resolve via {@link resolveToIpOrNull}.
+ *
+ * Rationale: tailscale's WireGuard mesh + ACLs ARE the auth boundary, so
+ * a tailnet-bound daemon does not need an additional bearer token. The
+ * CGNAT IPv4 range and ULA IPv6 prefix are reserved by tailscale and
+ * documented; collisions on real-world networks are essentially zero.
+ *
+ * Boundary semantics for HG-3: CGNAT is 100.64.0.0/10 → first octet
+ * exactly 100, second octet 64..127 inclusive. 100.63.x.x and
+ * 100.128.x.x are NOT tailnet.
+ */
+export function isTailscaleBind(host) {
+    if (!host)
+        return false;
+    const trimmed = host.trim().toLowerCase();
+    const ipv4Match = /^(\d+)\.(\d+)\.(\d+)\.(\d+)$/.exec(trimmed);
+    if (ipv4Match) {
+        const first = parseInt(ipv4Match[1], 10);
+        const second = parseInt(ipv4Match[2], 10);
+        if (first === 100 && second >= 64 && second <= 127)
+            return true;
+        return false;
+    }
+    const cleaned = trimmed.replace(/^\[|\]$/g, "");
+    if (cleaned.startsWith("fd7a:115c:a1e0:"))
+        return true;
+    return false;
+}
+/**
+ * Pure helper for {@link detectTailscaleInterface}: takes a NetworkInterfaces
+ * dictionary (the shape returned by os.networkInterfaces()) and returns the
+ * first non-internal address that matches the tailnet IP ranges, or null.
+ * Factored out so tests can supply synthetic interface fixtures without
+ * mocking node:os.
+ */
+export function findTailscaleIpInInterfaces(interfaces) {
+    for (const addrs of Object.values(interfaces)) {
+        if (!addrs)
+            continue;
+        for (const addr of addrs) {
+            if (addr.internal)
+                continue;
+            if (isTailscaleBind(addr.address))
+                return addr.address;
+        }
+    }
+    return null;
+}
+/**
+ * Probe the host's network interfaces and return the first tailscale-IP
+ * address found (CGNAT IPv4 or tailnet ULA IPv6), or null when no tailnet
+ * interface is currently active. Used at daemon startup to decide whether
+ * to multi-bind (loopback + tailnet) or loopback-only. Detection is
+ * IP-based, not interface-name-based, so it survives platform differences
+ * in how tailscale names its tun device.
+ */
+export function detectTailscaleInterface() {
+    return findTailscaleIpInInterfaces(networkInterfaces());
+}
+/**
+ * Resolve a hostname to its first IP via node:dns/promises lookup.
+ * Returns null on resolution failure (DNS error, timeout, no such host).
+ * Wrapped with a 5s race-timeout per Risk 9.2 in the slice IMPL-PRD so an
+ * unresponsive resolver does not stall daemon startup indefinitely.
+ */
+export async function resolveToIpOrNull(host) {
+    try {
+        const timeout = new Promise((resolve) => {
+            setTimeout(() => resolve(null), 5000).unref();
+        });
+        const lookup = dns
+            .lookup(host, { all: false })
+            .then((r) => r.address)
+            .catch(() => null);
+        return await Promise.race([lookup, timeout]);
+    }
+    catch {
+        return null;
+    }
+}
+export class AuthBearerTokenStartupError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = "AuthBearerTokenStartupError";
+    }
+}
+/**
+ * Startup-side check (HARD-GATE audit row 8). Throws an explicit
+ * AuthBearerTokenStartupError when the bind interface is genuinely
+ * public/LAN AND the bearer token is empty. Loopback or tailscale-IP
+ * binds short-circuit (the tailnet is the auth boundary). Hostname
+ * binds resolve via DNS first; if resolution yields a loopback or
+ * tailnet IP, the same short-circuit applies. Public/LAN binds without
+ * a bearer throw and the daemon refuses to start.
+ */
+export async function assertBindAuthInvariant(opts) {
+    if (isLoopbackBind(opts.host))
+        return;
+    if (isTailscaleBind(opts.host))
+        return;
+    let resolvedIp = null;
+    // Hostname (non-IP literal) — resolve and re-check.
+    if (!/^[\d.]+$/.test(opts.host) && !opts.host.includes(":")) {
+        resolvedIp = await resolveToIpOrNull(opts.host);
+        if (resolvedIp) {
+            if (isLoopbackBind(resolvedIp))
+                return;
+            if (isTailscaleBind(resolvedIp))
+                return;
+        }
+    }
+    if (opts.bearerToken && opts.bearerToken.length > 0)
+        return;
+    throw new AuthBearerTokenStartupError(`daemon refusing to start: bind host '${opts.host}'${resolvedIp ? ` (resolves to ${resolvedIp})` : ""} is not loopback or tailscale, ` +
+        `and auth.bearerToken (env OPENRIG_AUTH_BEARER_TOKEN) is empty. ` +
+        `Either: (a) bind to 127.0.0.1 / localhost, (b) bind to a tailscale interface (100.64.0.0/10 IPv4 or fd7a:115c:a1e0::/48 IPv6), ` +
+        `or (c) set OPENRIG_AUTH_BEARER_TOKEN to a non-empty value before starting the daemon.`);
+}
+//# sourceMappingURL=auth-bearer-token.js.map

package/daemon/dist/middleware/auth-bearer-token.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-bearer-token.js","sourceRoot":"","sources":["../../src/middleware/auth-bearer-token.ts"],"names":[],"mappings":"AAAA,sEAAsE;AACtE,EAAE;AACF,uDAAuD;AACvD,yEAAyE;AACzE,wCAAwC;AACxC,oEAAoE;AACpE,mDAAmD;AACnD,qEAAqE;AACrE,iEAAiE;AACjE,EAAE;AACF,uEAAuE;AACvE,sEAAsE;AACtE,qEAAqE;AACrE,oBAAoB;AACpB,EAAE;AACF,iEAAiE;AACjE,uEAAuE;AACvE,gEAAgE;AAChE,qEAAqE;AACrE,iEAAiE;AACjE,mEAAmE;AACnE,wCAAwC;AAExC,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AACrC,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC9C,OAAO,EAAE,QAAQ,IAAI,GAAG,EAAE,MAAM,UAAU,CAAC;AAC3C,OAAO,EAAE,iBAAiB,EAA6B,MAAM,SAAS,CAAC;AAGvE;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB,CAAC,CAAS,EAAE,CAAS;IACpD,mEAAmE;IACnE,mEAAmE;IACnE,qEAAqE;IACrE,oEAAoE;IACpE,wBAAwB;IACxB,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;IACpC,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;IACpC,IAAI,IAAI,CAAC,MAAM,KAAK,IAAI,CAAC,MAAM,EAAE,CAAC;QAChC,kEAAkE;QAClE,mEAAmE;QACnE,eAAe,CAAC,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;QACjD,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,eAAe,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;AACrC,CAAC;AAED;;;GAGG;AACH,SAAS,gBAAgB,CAAC,MAAc;IAOtC,OAAO;QACL,KAAK,EAAE,cAAc;QACrB,OAAO,EAAE,gCAAgC,MAAM,EAAE;QACjD,WAAW,EAAE,MAAM;QACnB,cAAc,EACZ,0KAA0K;QAC5K,UAAU,EACR,sKAAsK;KACzK,CAAC;AACJ,CAAC;AAWD;;;;;;;;GAQG;AACH,MAAM,UAAU,yBAAyB,CACvC,IAAyB;IAEzB,MAAM,EAAE,aAAa,EAAE,GAAG,IAAI,CAAC;IAC/B,OAAO,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;QACvB,IAAI,aAAa,KAAK,IAAI,EAAE,CAAC;YAC3B,2DAA2D;YAC3D,MAAM,IAAI,EAAE,CAAC;YACb,OAAO;QACT,CAAC;QACD,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;QAC9E,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,8BAA8B,CAAC,EAAE,GAAG,CAAC,CAAC;QACvE,CAAC;QACD,MAAM,KAAK,GAAG,kBAAkB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC9C,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,CAAC,CAAC,IAAI,CACX,gBAAgB,CAAC,+CAA+C,CAAC,EACjE,GAAG,CACJ,CAAC;QACJ,CAAC;QACD,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,CAAE,CAAC,IAAI,EAAE,CAAC;QAClC,IAAI,CAAC,iBAAiB,CAAC,QAAQ,EAAE,aAAa,CAAC,EAAE,CAAC;YAChD,OAAO,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,6BAA6B,CAAC,EAAE,GAAG,CAAC,CAAC;QACtE,CAAC;QACD,MAAM,IAAI,EAAE,CAAC;IACf,CAAC,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,cAAc,CAAC,IAA+B;IAC5D,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC/B,8DAA8D;QAC9D,oEAAoE;QACpE,yCAAyC;QACzC,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC1C,IAAI,OAAO,KAAK,WAAW,IAAI,OAAO,KAAK,KAAK,IAAI,OAAO,KAAK,OAAO;QAAE,OAAO,IAAI,CAAC;IACrF,IAAI,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC;IAC5C,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,eAAe,CAAC,IAA+B;IAC7D,IAAI,CAAC,IAAI;QAAE,OAAO,KAAK,CAAC;IACxB,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC1C,MAAM,SAAS,GAAG,8BAA8B,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC/D,IAAI,SAAS,EAAE,CAAC;QACd,MAAM,KAAK,GAAG,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAE,EAAE,EAAE,CAAC,CAAC;QAC1C,MAAM,MAAM,GAAG,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAE,EAAE,EAAE,CAAC,CAAC;QAC3C,IAAI,KAAK,KAAK,GAAG,IAAI,MAAM,IAAI,EAAE,IAAI,MAAM,IAAI,GAAG;YAAE,OAAO,IAAI,CAAC;QAChE,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;IAChD,IAAI,OAAO,CAAC,UAAU,CAAC,iBAAiB,CAAC;QAAE,OAAO,IAAI,CAAC;IACvD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,2BAA2B,CACzC,UAA+C;IAE/C,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC;QAC9C,IAAI,CAAC,KAAK;YAAE,SAAS;QACrB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,IAAI,IAAI,CAAC,QAAQ;gBAAE,SAAS;YAC5B,IAAI,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC;gBAAE,OAAO,IAAI,CAAC,OAAO,CAAC;QACzD,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,wBAAwB;IACtC,OAAO,2BAA2B,CAAC,iBAAiB,EAAE,CAAC,CAAC;AAC1D,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,IAAY;IAClD,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE;YAC5C,UAAU,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,CAAC,KAAK,EAAE,CAAC;QAChD,CAAC,CAAC,CAAC;QACH,MAAM,MAAM,GAAG,GAAG;aACf,MAAM,CAAC,IAAI,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC;aAC5B,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC;aACtB,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;QACrB,OAAO,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IAC/C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,OAAO,2BAA4B,SAAQ,KAAK;IACpD,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,6BAA6B,CAAC;IAC5C,CAAC;CACF;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAAC,IAG7C;IACC,IAAI,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO;IACtC,IAAI,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO;IAEvC,IAAI,UAAU,GAAkB,IAAI,CAAC;IACrC,oDAAoD;IACpD,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QAC5D,UAAU,GAAG,MAAM,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAChD,IAAI,UAAU,EAAE,CAAC;YACf,IAAI,cAAc,CAAC,UAAU,CAAC;gBAAE,OAAO;YACvC,IAAI,eAAe,CAAC,UAAU,CAAC;gBAAE,OAAO;QAC1C,CAAC;IACH,CAAC;IAED,IAAI,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO;IAC5D,MAAM,IAAI,2BAA2B,CACnC,wCAAwC,IAAI,CAAC,IAAI,IAAI,UAAU,CAAC,CAAC,CAAC,iBAAiB,UAAU,GAAG,CAAC,CAAC,CAAC,EAAE,iCAAiC;QACpI,iEAAiE;QACjE,iIAAiI;QACjI,uFAAuF,CAC1F,CAAC;AACJ,CAAC"}

package/daemon/dist/openrig-compat.d.ts

@@ -2,7 +2,7 @@ export declare function getOpenRigHome(): string;
 export declare function getLegacyRiggedHome(): string;
 export declare const OPENRIG_HOME: string;
 export declare const LEGACY_RIGGED_HOME: string;
-export declare function readOpenRigEnv(primary: string, legacy: string): string | undefined;
+export declare function readOpenRigEnv(primary: string, legacy?: string): string | undefined;
 export declare function getPreferredOpenRigHome(): string;
 export declare function getDefaultOpenRigPath(filename: string): string;
 export declare function getCompatibleOpenRigPath(filename: string): string;

package/daemon/dist/openrig-compat.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"openrig-compat.d.ts","sourceRoot":"","sources":["../src/openrig-compat.ts"],"names":[],"mappings":"AAMA,wBAAgB,cAAc,IAAI,MAAM,CAIvC;AAED,wBAAgB,mBAAmB,IAAI,MAAM,CAE5C;AAED,eAAO,MAAM,YAAY,QAAmB,CAAC;AAC7C,eAAO,MAAM,kBAAkB,QAAwB,CAAC;AAQxD,wBAAgB,cAAc,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAWlF;AAED,wBAAgB,uBAAuB,IAAI,MAAM,CAahD;AAED,wBAAgB,qBAAqB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAE9D;AAED,wBAAgB,wBAAwB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAgBjE"}
+{"version":3,"file":"openrig-compat.d.ts","sourceRoot":"","sources":["../src/openrig-compat.ts"],"names":[],"mappings":"AAMA,wBAAgB,cAAc,IAAI,MAAM,CAIvC;AAED,wBAAgB,mBAAmB,IAAI,MAAM,CAE5C;AAED,eAAO,MAAM,YAAY,QAAmB,CAAC;AAC7C,eAAO,MAAM,kBAAkB,QAAwB,CAAC;AAQxD,wBAAgB,cAAc,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAanF;AAED,wBAAgB,uBAAuB,IAAI,MAAM,CAahD;AAED,wBAAgB,qBAAqB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAE9D;AAED,wBAAgB,wBAAwB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAgBjE"}

package/daemon/dist/openrig-compat.js

@@ -23,10 +23,12 @@ export function readOpenRigEnv(primary, legacy) {
     const primaryValue = process.env[primary];
     if (primaryValue !== undefined && primaryValue !== "")
         return primaryValue;
-    const legacyValue = process.env[legacy];
-    if (legacyValue !== undefined && legacyValue !== "") {
-        warnOnce(`env:${legacy}`, `Warning: ${legacy} is deprecated; use ${primary} instead.`);
-        return legacyValue;
+    if (legacy) {
+        const legacyValue = process.env[legacy];
+        if (legacyValue !== undefined && legacyValue !== "") {
+            warnOnce(`env:${legacy}`, `Warning: ${legacy} is deprecated; use ${primary} instead.`);
+            return legacyValue;
+        }
     }
     return undefined;
 }

package/daemon/dist/openrig-compat.js.map

@@ -1 +1 @@
-{"version":3,"file":"openrig-compat.js","sourceRoot":"","sources":["../src/openrig-compat.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,MAAM,UAAU,GAAG,IAAI,GAAG,EAAU,CAAC;AAErC,MAAM,UAAU,cAAc;IAC5B,MAAM,UAAU,GAAG,cAAc,CAAC,cAAc,EAAE,aAAa,CAAC,CAAC;IACjE,IAAI,UAAU,KAAK,SAAS;QAAE,OAAO,UAAU,CAAC;IAChD,OAAO,IAAI,CAAC,OAAO,EAAE,EAAE,UAAU,CAAC,CAAC;AACrC,CAAC;AAED,MAAM,UAAU,mBAAmB;IACjC,OAAO,IAAI,CAAC,OAAO,EAAE,EAAE,SAAS,CAAC,CAAC;AACpC,CAAC;AAED,MAAM,CAAC,MAAM,YAAY,GAAG,cAAc,EAAE,CAAC;AAC7C,MAAM,CAAC,MAAM,kBAAkB,GAAG,mBAAmB,EAAE,CAAC;AAExD,SAAS,QAAQ,CAAC,GAAW,EAAE,OAAe;IAC5C,IAAI,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC;QAAE,OAAO;IAChC,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACpB,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;AACxB,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,OAAe,EAAE,MAAc;IAC5D,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IAC1C,IAAI,YAAY,KAAK,SAAS,IAAI,YAAY,KAAK,EAAE;QAAE,OAAO,YAAY,CAAC;IAE3E,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACxC,IAAI,WAAW,KAAK,SAAS,IAAI,WAAW,KAAK,EAAE,EAAE,CAAC;QACpD,QAAQ,CAAC,OAAO,MAAM,EAAE,EAAE,YAAY,MAAM,uBAAuB,OAAO,WAAW,CAAC,CAAC;QACvF,OAAO,WAAW,CAAC;IACrB,CAAC;IAED,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,MAAM,UAAU,uBAAuB;IACrC,MAAM,WAAW,GAAG,cAAc,EAAE,CAAC;IACrC,MAAM,gBAAgB,GAAG,mBAAmB,EAAE,CAAC;IAE/C,IAAI,UAAU,CAAC,WAAW,CAAC;QAAE,OAAO,WAAW,CAAC;IAChD,IAAI,UAAU,CAAC,gBAAgB,CAAC,EAAE,CAAC;QACjC,QAAQ,CACN,WAAW,EACX,yCAAyC,gBAAgB,gBAAgB,WAAW,GAAG,CACxF,CAAC;QACF,OAAO,gBAAgB,CAAC;IAC1B,CAAC;IACD,OAAO,WAAW,CAAC;AACrB,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,QAAgB;IACpD,OAAO,IAAI,CAAC,cAAc,EAAE,EAAE,QAAQ,CAAC,CAAC;AAC1C,CAAC;AAED,MAAM,UAAU,wBAAwB,CAAC,QAAgB;IACvD,MAAM,WAAW,GAAG,cAAc,EAAE,CAAC;IACrC,MAAM,gBAAgB,GAAG,mBAAmB,EAAE,CAAC;IAC/C,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;IAChD,IAAI,UAAU,CAAC,WAAW,CAAC;QAAE,OAAO,WAAW,CAAC;IAEhD,MAAM,UAAU,GAAG,IAAI,CAAC,gBAAgB,EAAE,QAAQ,CAAC,CAAC;IACpD,IAAI,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QAC3B,QAAQ,CACN,QAAQ,QAAQ,EAAE,EAClB,oCAAoC,UAAU,gBAAgB,WAAW,GAAG,CAC7E,CAAC;QACF,OAAO,UAAU,CAAC;IACpB,CAAC;IAED,OAAO,WAAW,CAAC;AACrB,CAAC"}
+{"version":3,"file":"openrig-compat.js","sourceRoot":"","sources":["../src/openrig-compat.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,MAAM,UAAU,GAAG,IAAI,GAAG,EAAU,CAAC;AAErC,MAAM,UAAU,cAAc;IAC5B,MAAM,UAAU,GAAG,cAAc,CAAC,cAAc,EAAE,aAAa,CAAC,CAAC;IACjE,IAAI,UAAU,KAAK,SAAS;QAAE,OAAO,UAAU,CAAC;IAChD,OAAO,IAAI,CAAC,OAAO,EAAE,EAAE,UAAU,CAAC,CAAC;AACrC,CAAC;AAED,MAAM,UAAU,mBAAmB;IACjC,OAAO,IAAI,CAAC,OAAO,EAAE,EAAE,SAAS,CAAC,CAAC;AACpC,CAAC;AAED,MAAM,CAAC,MAAM,YAAY,GAAG,cAAc,EAAE,CAAC;AAC7C,MAAM,CAAC,MAAM,kBAAkB,GAAG,mBAAmB,EAAE,CAAC;AAExD,SAAS,QAAQ,CAAC,GAAW,EAAE,OAAe;IAC5C,IAAI,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC;QAAE,OAAO;IAChC,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACpB,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;AACxB,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,OAAe,EAAE,MAAe;IAC7D,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IAC1C,IAAI,YAAY,KAAK,SAAS,IAAI,YAAY,KAAK,EAAE;QAAE,OAAO,YAAY,CAAC;IAE3E,IAAI,MAAM,EAAE,CAAC;QACX,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACxC,IAAI,WAAW,KAAK,SAAS,IAAI,WAAW,KAAK,EAAE,EAAE,CAAC;YACpD,QAAQ,CAAC,OAAO,MAAM,EAAE,EAAE,YAAY,MAAM,uBAAuB,OAAO,WAAW,CAAC,CAAC;YACvF,OAAO,WAAW,CAAC;QACrB,CAAC;IACH,CAAC;IAED,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,MAAM,UAAU,uBAAuB;IACrC,MAAM,WAAW,GAAG,cAAc,EAAE,CAAC;IACrC,MAAM,gBAAgB,GAAG,mBAAmB,EAAE,CAAC;IAE/C,IAAI,UAAU,CAAC,WAAW,CAAC;QAAE,OAAO,WAAW,CAAC;IAChD,IAAI,UAAU,CAAC,gBAAgB,CAAC,EAAE,CAAC;QACjC,QAAQ,CACN,WAAW,EACX,yCAAyC,gBAAgB,gBAAgB,WAAW,GAAG,CACxF,CAAC;QACF,OAAO,gBAAgB,CAAC;IAC1B,CAAC;IACD,OAAO,WAAW,CAAC;AACrB,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,QAAgB;IACpD,OAAO,IAAI,CAAC,cAAc,EAAE,EAAE,QAAQ,CAAC,CAAC;AAC1C,CAAC;AAED,MAAM,UAAU,wBAAwB,CAAC,QAAgB;IACvD,MAAM,WAAW,GAAG,cAAc,EAAE,CAAC;IACrC,MAAM,gBAAgB,GAAG,mBAAmB,EAAE,CAAC;IAC/C,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;IAChD,IAAI,UAAU,CAAC,WAAW,CAAC;QAAE,OAAO,WAAW,CAAC;IAEhD,MAAM,UAAU,GAAG,IAAI,CAAC,gBAAgB,EAAE,QAAQ,CAAC,CAAC;IACpD,IAAI,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QAC3B,QAAQ,CACN,QAAQ,QAAQ,EAAE,EAClB,oCAAoC,UAAU,gBAAgB,WAAW,GAAG,CAC7E,CAAC;QACF,OAAO,UAAU,CAAC;IACpB,CAAC;IAED,OAAO,WAAW,CAAC;AACrB,CAAC"}

package/daemon/dist/routes/agent-images.d.ts

@@ -0,0 +1,8 @@
+import { Hono } from "hono";
+export interface AgentImageRoutesDeps {
+    /** Spec-library roots scanned by the evidence guard. v0 includes
+     *  the canonical user spec directory + workspace specs root. */
+    specRoots: () => readonly string[];
+}
+export declare function agentImagesRoutes(deps: AgentImageRoutesDeps): Hono;
+//# sourceMappingURL=agent-images.d.ts.map

package/daemon/dist/routes/agent-images.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"agent-images.d.ts","sourceRoot":"","sources":["../../src/routes/agent-images.ts"],"names":[],"mappings":"AAkBA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AA6B5B,MAAM,WAAW,oBAAoB;IACnC;oEACgE;IAChE,SAAS,EAAE,MAAM,SAAS,MAAM,EAAE,CAAC;CACpC;AAED,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,oBAAoB,GAAG,IAAI,CAoMlE"}

package/daemon/dist/routes/agent-images.js

@@ -0,0 +1,253 @@
+// Fork Primitive + Starter Agent Images v0 (PL-016) — daemon HTTP
+// routes.
+//
+// Endpoints:
+//   GET    /api/agent-images/library                — list all images (resume token redacted)
+//   POST   /api/agent-images/library/sync           — re-walk discovery roots
+//   GET    /api/agent-images/library/:id            — image manifest + stats (resume token redacted)
+//   GET    /api/agent-images/library/:id/preview    — manifest + sized supplementary file metadata
+//   POST   /api/agent-images/library/:id/pin        — pin from prune
+//   POST   /api/agent-images/library/:id/unpin      — unpin
+//   DELETE /api/agent-images/library/:id            — delete (subject to evidence guard unless force=true)
+//   POST   /api/agent-images/snapshot               — capture a new image from a source seat
+//   POST   /api/agent-images/prune                  — prune evictable images (dry-run by default)
+//
+// Resume tokens are NEVER returned over the wire — they're redacted at
+// route boundary. Only the rigspec-instantiator (in-process) consumes
+// the token directly.
+import { Hono } from "hono";
+import { rmSync } from "node:fs";
+import { evaluateProtection } from "../domain/agent-images/evidence-guard.js";
+import { AgentImageError } from "../domain/agent-images/agent-image-types.js";
+function redactResumeToken(entry) {
+    return { ...entry, sourceResumeToken: "(redacted)" };
+}
+export function agentImagesRoutes(deps) {
+    const router = new Hono();
+    router.get("/library", (c) => {
+        const lib = c.get("agentImageLibrary");
+        if (!lib)
+            return c.json({ error: "agent_image_library_unavailable" }, 503);
+        return c.json(lib.list().map(redactResumeToken));
+    });
+    router.post("/library/sync", (c) => {
+        const lib = c.get("agentImageLibrary");
+        if (!lib)
+            return c.json({ error: "agent_image_library_unavailable" }, 503);
+        const result = lib.scan();
+        return c.json({ ...result, entries: lib.list().map(redactResumeToken) });
+    });
+    router.post("/snapshot", async (c) => {
+        const capturer = c.get("snapshotCapturer");
+        if (!capturer)
+            return c.json({ error: "snapshot_capturer_unavailable" }, 503);
+        const body = (await c.req.json().catch(() => ({})));
+        if (!body.sourceSession || !body.name) {
+            return c.json({
+                error: "missing_required_fields",
+                hint: "POST body must include { sourceSession, name }",
+            }, 400);
+        }
+        try {
+            const result = capturer.capture({
+                sourceSession: body.sourceSession,
+                name: body.name,
+                version: body.version,
+                notes: body.notes,
+                estimatedTokens: body.estimatedTokens,
+                lineage: body.lineage,
+            });
+            // Redact resume token in the response — operator just needs the
+            // image id and on-disk path.
+            return c.json({
+                imageId: result.imageId,
+                imagePath: result.imagePath,
+                manifest: { ...result.manifest, sourceResumeToken: "(redacted)" },
+            });
+        }
+        catch (err) {
+            if (err instanceof AgentImageError) {
+                const status = err.code === "image_not_found" ? 404
+                    : err.code === "runtime_mismatch" ? 400
+                        : err.code === "image_referenced" ? 409
+                            : 500;
+                return c.json({ error: err.code, message: err.message, details: err.details ?? null }, status);
+            }
+            return c.json({ error: "snapshot_failed", message: err.message }, 500);
+        }
+    });
+    router.post("/prune", async (c) => {
+        const lib = c.get("agentImageLibrary");
+        if (!lib)
+            return c.json({ error: "agent_image_library_unavailable" }, 503);
+        const body = (await c.req.json().catch(() => ({})));
+        const dryRun = body.dryRun !== false;
+        const force = !!body.force;
+        const images = lib.list();
+        const protections = evaluateProtection({
+            images,
+            specRoots: deps.specRoots(),
+        });
+        const protectedImages = protections.filter((p) => p.protected);
+        const evictable = protections.filter((p) => !p.protected);
+        if (dryRun) {
+            return c.json({
+                dryRun: true,
+                protected: protectedImages,
+                evictable: evictable.map((p) => ({ imageId: p.imageId, imageName: p.imageName, imageVersion: p.imageVersion })),
+            });
+        }
+        // Real prune: delete evictable images. Force overrides the guard
+        // — protected images get deleted too. CATASTROPHIC bounce risk on
+        // force; surface it visibly in the response.
+        const targets = force ? protections : evictable;
+        const deleted = [];
+        const errors = [];
+        for (const t of targets) {
+            const entry = lib.get(t.imageId);
+            if (!entry)
+                continue;
+            try {
+                rmSync(entry.sourcePath, { recursive: true, force: true });
+                deleted.push(t.imageId);
+            }
+            catch (err) {
+                errors.push({ imageId: t.imageId, error: err.message });
+            }
+        }
+        lib.scan();
+        return c.json({
+            dryRun: false,
+            forced: force,
+            deleted,
+            errors,
+            protected: force ? [] : protectedImages,
+        });
+    });
+    router.get("/library/:id", (c) => {
+        const lib = c.get("agentImageLibrary");
+        if (!lib)
+            return c.json({ error: "agent_image_library_unavailable" }, 503);
+        const id = decodeURIComponent(c.req.param("id"));
+        if (id === "sync" || id === "snapshot" || id === "prune")
+            return c.notFound();
+        const entry = lib.get(id);
+        if (!entry)
+            return c.json({ error: `Agent image '${id}' not found in library` }, 404);
+        return c.json(redactResumeToken(entry));
+    });
+    router.get("/library/:id/preview", (c) => {
+        const lib = c.get("agentImageLibrary");
+        if (!lib)
+            return c.json({ error: "agent_image_library_unavailable" }, 503);
+        const id = decodeURIComponent(c.req.param("id"));
+        const entry = lib.get(id);
+        if (!entry)
+            return c.json({ error: `Agent image '${id}' not found in library` }, 404);
+        return c.json({
+            id,
+            name: entry.name,
+            version: entry.version,
+            runtime: entry.runtime,
+            sourceSeat: entry.sourceSeat,
+            manifestEstimatedTokens: entry.manifestEstimatedTokens,
+            derivedEstimatedTokens: entry.derivedEstimatedTokens,
+            stats: entry.stats,
+            lineage: entry.lineage,
+            pinned: entry.pinned,
+            notes: entry.notes,
+            files: entry.files,
+            starterSnippet: buildStarterSnippet(entry),
+        });
+    });
+    router.post("/library/:id/pin", (c) => {
+        const lib = c.get("agentImageLibrary");
+        if (!lib)
+            return c.json({ error: "agent_image_library_unavailable" }, 503);
+        const id = decodeURIComponent(c.req.param("id"));
+        try {
+            lib.pin(id);
+            return c.json({ ok: true, id, pinned: true });
+        }
+        catch (err) {
+            if (err instanceof AgentImageError && err.code === "image_not_found") {
+                return c.json({ error: err.code, message: err.message }, 404);
+            }
+            return c.json({ error: "pin_failed", message: err.message }, 500);
+        }
+    });
+    router.post("/library/:id/unpin", (c) => {
+        const lib = c.get("agentImageLibrary");
+        if (!lib)
+            return c.json({ error: "agent_image_library_unavailable" }, 503);
+        const id = decodeURIComponent(c.req.param("id"));
+        try {
+            lib.unpin(id);
+            return c.json({ ok: true, id, pinned: false });
+        }
+        catch (err) {
+            if (err instanceof AgentImageError && err.code === "image_not_found") {
+                return c.json({ error: err.code, message: err.message }, 404);
+            }
+            return c.json({ error: "unpin_failed", message: err.message }, 500);
+        }
+    });
+    router.delete("/library/:id", (c) => {
+        const lib = c.get("agentImageLibrary");
+        if (!lib)
+            return c.json({ error: "agent_image_library_unavailable" }, 503);
+        const id = decodeURIComponent(c.req.param("id"));
+        const force = (c.req.query("force") ?? "") === "true";
+        const entry = lib.get(id);
+        if (!entry)
+            return c.json({ error: `Agent image '${id}' not found in library` }, 404);
+        // Evidence guard for non-force deletes.
+        if (!force) {
+            const protections = evaluateProtection({
+                images: lib.list(),
+                specRoots: deps.specRoots(),
+            });
+            const status = protections.find((p) => p.imageId === id);
+            if (status && status.protected) {
+                return c.json({
+                    error: "image_referenced",
+                    message: `Agent image '${id}' is protected: ${status.reasons.join(", ")}. Use force=true to override.`,
+                    reasons: status.reasons,
+                    references: status.references,
+                }, 409);
+            }
+        }
+        try {
+            rmSync(entry.sourcePath, { recursive: true, force: true });
+            lib.scan();
+            return c.json({ ok: true, id, forced: force });
+        }
+        catch (err) {
+            return c.json({ error: "delete_failed", message: err.message }, 500);
+        }
+    });
+    return router;
+}
+/** PRD § Item 5: review-pane "Use as starter" surface. We synthesize
+ *  the agent.yaml snippet here so the UI can render it directly with
+ *  no client-side templating.
+ *
+ *  PL-016 source-cwd behavior: when the
+ *  manifest carries source_cwd, the snippet emits `cwd: <source_cwd>`
+ *  ahead of the session_source block. The fork
+ *  starts in the SAME directory the parent session was created in,
+ *  Claude's project-dir-scoped session storage works because the jsonl
+ *  file lives there. The daemon relies on provider cwd resolution and
+ *  does NOT override cwd at fork dispatch. If the operator manually
+ *  changes cwd, fork fails honestly with "no
+ *  conversation found". Manifests without source_cwd (pre-Finding-2)
+ *  render without the cwd line for back-compat. */
+function buildStarterSnippet(entry) {
+    const lines = [];
+    if (entry.sourceCwd) {
+        lines.push(`cwd: ${JSON.stringify(entry.sourceCwd)}`);
+    }
+    lines.push("session_source:", "  mode: agent_image", "  ref:", "    kind: image_name", `    value: ${JSON.stringify(entry.name)}`, `    version: ${JSON.stringify(entry.version)}`);
+    return lines.join("\n") + "\n";
+}
+//# sourceMappingURL=agent-images.js.map

package/daemon/dist/routes/agent-images.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"agent-images.js","sourceRoot":"","sources":["../../src/routes/agent-images.ts"],"names":[],"mappings":"AAAA,kEAAkE;AAClE,UAAU;AACV,EAAE;AACF,aAAa;AACb,8FAA8F;AAC9F,8EAA8E;AAC9E,qGAAqG;AACrG,mGAAmG;AACnG,qEAAqE;AACrE,4DAA4D;AAC5D,2GAA2G;AAC3G,6FAA6F;AAC7F,kGAAkG;AAClG,EAAE;AACF,uEAAuE;AACvE,sEAAsE;AACtE,sBAAsB;AAEtB,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AAGjC,OAAO,EAAE,kBAAkB,EAAE,MAAM,0CAA0C,CAAC;AAC9E,OAAO,EAAE,eAAe,EAAwB,MAAM,6CAA6C,CAAC;AAoBpG,SAAS,iBAAiB,CAAuD,KAAQ;IACvF,OAAO,EAAE,GAAG,KAAK,EAAE,iBAAiB,EAAE,YAAY,EAAE,CAAC;AACvD,CAAC;AAQD,MAAM,UAAU,iBAAiB,CAAC,IAA0B;IAC1D,MAAM,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;IAE1B,MAAM,CAAC,GAAG,CAAC,UAAU,EAAE,CAAC,CAAC,EAAE,EAAE;QAC3B,MAAM,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC,mBAA4B,CAAyC,CAAC;QACxF,IAAI,CAAC,GAAG;YAAE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iCAAiC,EAAE,EAAE,GAAG,CAAC,CAAC;QAC3E,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC,CAAC;IACnD,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,IAAI,CAAC,eAAe,EAAE,CAAC,CAAC,EAAE,EAAE;QACjC,MAAM,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC,mBAA4B,CAAyC,CAAC;QACxF,IAAI,CAAC,GAAG;YAAE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iCAAiC,EAAE,EAAE,GAAG,CAAC,CAAC;QAC3E,MAAM,MAAM,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;QAC1B,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,GAAG,MAAM,EAAE,OAAO,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,iBAAiB,CAAC,EAAE,CAAC,CAAC;IAC3E,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACnC,MAAM,QAAQ,GAAG,CAAC,CAAC,GAAG,CAAC,kBAA2B,CAAiC,CAAC;QACpF,IAAI,CAAC,QAAQ;YAAE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,+BAA+B,EAAE,EAAE,GAAG,CAAC,CAAC;QAC9E,MAAM,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,IAAI,EAAgB,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAiB,CAAC;QAClF,IAAI,CAAC,IAAI,CAAC,aAAa,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;YACtC,OAAO,CAAC,CAAC,IAAI,CAAC;gBACZ,KAAK,EAAE,yBAAyB;gBAChC,IAAI,EAAE,gDAAgD;aACvD,EAAE,GAAG,CAAC,CAAC;QACV,CAAC;QACD,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,QAAQ,CAAC,OAAO,CAAC;gBAC9B,aAAa,EAAE,IAAI,CAAC,aAAa;gBACjC,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,OAAO,EAAE,IAAI,CAAC,OAAO;gBACrB,KAAK,EAAE,IAAI,CAAC,KAAK;gBACjB,eAAe,EAAE,IAAI,CAAC,eAAe;gBACrC,OAAO,EAAE,IAAI,CAAC,OAAO;aACtB,CAAC,CAAC;YACH,gEAAgE;YAChE,6BAA6B;YAC7B,OAAO,CAAC,CAAC,IAAI,CAAC;gBACZ,OAAO,EAAE,MAAM,CAAC,OAAO;gBACvB,SAAS,EAAE,MAAM,CAAC,SAAS;gBAC3B,QAAQ,EAAE,EAAE,GAAG,MAAM,CAAC,QAAQ,EAAE,iBAAiB,EAAE,YAAY,EAAE;aAClE,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,eAAe,EAAE,CAAC;gBACnC,MAAM,MAAM,GAAG,GAAG,CAAC,IAAI,KAAK,iBAAiB,CAAC,CAAC,CAAC,GAAG;oBACjD,CAAC,CAAC,GAAG,CAAC,IAAI,KAAK,kBAAkB,CAAC,CAAC,CAAC,GAAG;wBACvC,CAAC,CAAC,GAAG,CAAC,IAAI,KAAK,kBAAkB,CAAC,CAAC,CAAC,GAAG;4BACvC,CAAC,CAAC,GAAG,CAAC;gBACR,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,IAAI,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,IAAI,IAAI,EAAE,EAAE,MAAM,CAAC,CAAC;YACjG,CAAC;YACD,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,OAAO,EAAG,GAAa,CAAC,OAAO,EAAE,EAAE,GAAG,CAAC,CAAC;QACpF,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAChC,MAAM,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC,mBAA4B,CAAyC,CAAC;QACxF,IAAI,CAAC,GAAG;YAAE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iCAAiC,EAAE,EAAE,GAAG,CAAC,CAAC;QAC3E,MAAM,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,IAAI,EAAa,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAc,CAAC;QAC5E,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,KAAK,KAAK,CAAC;QACrC,MAAM,KAAK,GAAG,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC;QAC3B,MAAM,MAAM,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;QAC1B,MAAM,WAAW,GAAG,kBAAkB,CAAC;YACrC,MAAM;YACN,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE;SAC5B,CAAC,CAAC;QACH,MAAM,eAAe,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QAC/D,MAAM,SAAS,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QAC1D,IAAI,MAAM,EAAE,CAAC;YACX,OAAO,CAAC,CAAC,IAAI,CAAC;gBACZ,MAAM,EAAE,IAAI;gBACZ,SAAS,EAAE,eAAe;gBAC1B,SAAS,EAAE,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,EAAE,YAAY,EAAE,CAAC,CAAC,YAAY,EAAE,CAAC,CAAC;aAChH,CAAC,CAAC;QACL,CAAC;QACD,iEAAiE;QACjE,kEAAkE;QAClE,6CAA6C;QAC7C,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC;QAChD,MAAM,OAAO,GAAa,EAAE,CAAC;QAC7B,MAAM,MAAM,GAA8C,EAAE,CAAC;QAC7D,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;YACxB,MAAM,KAAK,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;YACjC,IAAI,CAAC,KAAK;gBAAE,SAAS;YACrB,IAAI,CAAC;gBACH,MAAM,CAAC,KAAK,CAAC,UAAU,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;gBAC3D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;YAC1B,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,KAAK,EAAG,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;YACrE,CAAC;QACH,CAAC;QACD,GAAG,CAAC,IAAI,EAAE,CAAC;QACX,OAAO,CAAC,CAAC,IAAI,CAAC;YACZ,MAAM,EAAE,KAAK;YACb,MAAM,EAAE,KAAK;YACb,OAAO;YACP,MAAM;YACN,SAAS,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,eAAe;SACxC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,GAAG,CAAC,cAAc,EAAE,CAAC,CAAC,EAAE,EAAE;QAC/B,MAAM,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC,mBAA4B,CAAyC,CAAC;QACxF,IAAI,CAAC,GAAG;YAAE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iCAAiC,EAAE,EAAE,GAAG,CAAC,CAAC;QAC3E,MAAM,EAAE,GAAG,kBAAkB,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;QACjD,IAAI,EAAE,KAAK,MAAM,IAAI,EAAE,KAAK,UAAU,IAAI,EAAE,KAAK,OAAO;YAAE,OAAO,CAAC,CAAC,QAAQ,EAAE,CAAC;QAC9E,MAAM,KAAK,GAAG,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC1B,IAAI,CAAC,KAAK;YAAE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,wBAAwB,EAAE,EAAE,GAAG,CAAC,CAAC;QACtF,OAAO,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,KAAK,CAAC,CAAC,CAAC;IAC1C,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,GAAG,CAAC,sBAAsB,EAAE,CAAC,CAAC,EAAE,EAAE;QACvC,MAAM,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC,mBAA4B,CAAyC,CAAC;QACxF,IAAI,CAAC,GAAG;YAAE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iCAAiC,EAAE,EAAE,GAAG,CAAC,CAAC;QAC3E,MAAM,EAAE,GAAG,kBAAkB,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;QACjD,MAAM,KAAK,GAAG,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC1B,IAAI,CAAC,KAAK;YAAE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,wBAAwB,EAAE,EAAE,GAAG,CAAC,CAAC;QACtF,OAAO,CAAC,CAAC,IAAI,CAAC;YACZ,EAAE;YACF,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,uBAAuB,EAAE,KAAK,CAAC,uBAAuB;YACtD,sBAAsB,EAAE,KAAK,CAAC,sBAAsB;YACpD,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,cAAc,EAAE,mBAAmB,CAAC,KAAK,CAAC;SAC3C,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,IAAI,CAAC,kBAAkB,EAAE,CAAC,CAAC,EAAE,EAAE;QACpC,MAAM,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC,mBAA4B,CAAyC,CAAC;QACxF,IAAI,CAAC,GAAG;YAAE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iCAAiC,EAAE,EAAE,GAAG,CAAC,CAAC;QAC3E,MAAM,EAAE,GAAG,kBAAkB,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;QACjD,IAAI,CAAC;YACH,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YACZ,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;QAChD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,eAAe,IAAI,GAAG,CAAC,IAAI,KAAK,iBAAiB,EAAE,CAAC;gBACrE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,IAAI,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,EAAE,GAAG,CAAC,CAAC;YAChE,CAAC;YACD,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,YAAY,EAAE,OAAO,EAAG,GAAa,CAAC,OAAO,EAAE,EAAE,GAAG,CAAC,CAAC;QAC/E,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,IAAI,CAAC,oBAAoB,EAAE,CAAC,CAAC,EAAE,EAAE;QACtC,MAAM,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC,mBAA4B,CAAyC,CAAC;QACxF,IAAI,CAAC,GAAG;YAAE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iCAAiC,EAAE,EAAE,GAAG,CAAC,CAAC;QAC3E,MAAM,EAAE,GAAG,kBAAkB,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;QACjD,IAAI,CAAC;YACH,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YACd,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;QACjD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,eAAe,IAAI,GAAG,CAAC,IAAI,KAAK,iBAAiB,EAAE,CAAC;gBACrE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,IAAI,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,EAAE,GAAG,CAAC,CAAC;YAChE,CAAC;YACD,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,OAAO,EAAG,GAAa,CAAC,OAAO,EAAE,EAAE,GAAG,CAAC,CAAC;QACjF,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,MAAM,CAAC,cAAc,EAAE,CAAC,CAAC,EAAE,EAAE;QAClC,MAAM,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC,mBAA4B,CAAyC,CAAC;QACxF,IAAI,CAAC,GAAG;YAAE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iCAAiC,EAAE,EAAE,GAAG,CAAC,CAAC;QAC3E,MAAM,EAAE,GAAG,kBAAkB,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;QACjD,MAAM,KAAK,GAAG,CAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAwB,IAAI,EAAE,CAAC,KAAK,MAAM,CAAC;QAC9E,MAAM,KAAK,GAAG,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC1B,IAAI,CAAC,KAAK;YAAE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,wBAAwB,EAAE,EAAE,GAAG,CAAC,CAAC;QACtF,wCAAwC;QACxC,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,WAAW,GAAG,kBAAkB,CAAC;gBACrC,MAAM,EAAE,GAAG,CAAC,IAAI,EAAE;gBAClB,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE;aAC5B,CAAC,CAAC;YACH,MAAM,MAAM,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,EAAE,CAAC,CAAC;YACzD,IAAI,MAAM,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;gBAC/B,OAAO,CAAC,CAAC,IAAI,CAAC;oBACZ,KAAK,EAAE,kBAAkB;oBACzB,OAAO,EAAE,gBAAgB,EAAE,mBAAmB,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,+BAA+B;oBACtG,OAAO,EAAE,MAAM,CAAC,OAAO;oBACvB,UAAU,EAAE,MAAM,CAAC,UAAU;iBAC9B,EAAE,GAAG,CAAC,CAAC;YACV,CAAC;QACH,CAAC;QACD,IAAI,CAAC;YACH,MAAM,CAAC,KAAK,CAAC,UAAU,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;YAC3D,GAAG,CAAC,IAAI,EAAE,CAAC;YACX,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;QACjD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,eAAe,EAAE,OAAO,EAAG,GAAa,CAAC,OAAO,EAAE,EAAE,GAAG,CAAC,CAAC;QAClF,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;;;;;;;;;mDAamD;AACnD,SAAS,mBAAmB,CAAC,KAAsB;IACjD,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC;QACpB,KAAK,CAAC,IAAI,CAAC,QAAQ,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;IACxD,CAAC;IACD,KAAK,CAAC,IAAI,CACR,iBAAiB,EACjB,qBAAqB,EACrB,QAAQ,EACR,sBAAsB,EACtB,cAAc,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,EAC1C,gBAAgB,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAChD,CAAC;IACF,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;AACjC,CAAC"}

package/daemon/dist/routes/config.d.ts

@@ -0,0 +1,3 @@
+import { Hono } from "hono";
+export declare function configRoutes(): Hono;
+//# sourceMappingURL=config.d.ts.map

package/daemon/dist/routes/config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../src/routes/config.ts"],"names":[],"mappings":"AAcA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAmB5B,wBAAgB,YAAY,IAAI,IAAI,CAyFnC"}