@openrig/cli 0.3.0 → 0.3.2

package/daemon/dist/index.d.ts

@@ -1,2 +1,3 @@
-export declare function startServer(port?: number): Promise<import("@hono/node-server").ServerType>;
+import { type ServerType } from "@hono/node-server";
+export declare function startServer(port?: number): Promise<ServerType>;
 //# sourceMappingURL=index.d.ts.map

package/daemon/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAKA,wBAAsB,WAAW,CAAC,IAAI,CAAC,EAAE,MAAM,mDA0C9C"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAS,KAAK,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAQ3D,wBAAsB,WAAW,CAAC,IAAI,CAAC,EAAE,MAAM,uBA0F9C"}

package/daemon/dist/index.js

@@ -1,31 +1,61 @@
 import { serve } from "@hono/node-server";
 import { readOpenRigEnv } from "./openrig-compat.js";
 import { createDaemon } from "./startup.js";
-import { assertBindAuthInvariant } from "./middleware/auth-bearer-token.js";
+import { assertBindAuthInvariant, detectTailscaleInterface, } from "./middleware/auth-bearer-token.js";
 export async function startServer(port) {
     const p = port ?? parseInt(readOpenRigEnv("OPENRIG_PORT", "RIGGED_PORT") ?? "7433", 10);
     const dbPath = readOpenRigEnv("OPENRIG_DB", "RIGGED_DB") ?? "openrig.sqlite";
-    const h = readOpenRigEnv("OPENRIG_HOST", "RIGGED_HOST") ?? "127.0.0.1";
+    // bug-fix slice auth-bearer-tailscale-trust: distinguish "explicit
+    // operator opt-in" from "default" by treating an undefined env as
+    // default. When explicit, the operator takes responsibility (and the
+    // bearer invariant applies to their chosen host). When default, the
+    // daemon always binds loopback and ALSO binds the active tailscale
+    // interface (if present) — both accepted paths in the invariant.
+    const explicitHost = readOpenRigEnv("OPENRIG_HOST", "RIGGED_HOST");
     // PL-005 Phase B: bearer token for Mission Control write verbs.
     // No legacy alias (this env var is new in Phase B).
     const bearerToken = process.env.OPENRIG_AUTH_BEARER_TOKEN ?? null;
-    // PL-005 Phase B HARD-GATE (audit row 8): refuse non-loopback bind
-    // when no bearer token is configured. Prevents shipping a tailnet-
-    // bound daemon with no auth on Mission Control write verbs.
-    // Throws AuthBearerTokenStartupError before any DB or HTTP work.
-    assertBindAuthInvariant({ host: h, bearerToken });
+    let bindHosts;
+    if (explicitHost) {
+        // Operator opt-in path — invariant enforces bearer requirement for
+        // genuinely public/LAN binds; loopback/tailscale binds short-circuit.
+        await assertBindAuthInvariant({ host: explicitHost, bearerToken });
+        bindHosts = [explicitHost];
+    }
+    else {
+        // Default path — loopback always, plus tailscale auto-add when active.
+        const tailscaleIp = detectTailscaleInterface();
+        bindHosts = tailscaleIp ? ["127.0.0.1", tailscaleIp] : ["127.0.0.1"];
+    }
     const { app, contextMonitor, deps } = await createDaemon({ dbPath, bearerToken });
-    const server = serve({ fetch: app.fetch, port: p, hostname: h }, (info) => {
-        console.log(`OpenRig daemon listening on http://localhost:${info.port}`);
-        // Start context monitor polling only after successful server bind
-        contextMonitor.start();
-        // PL-004 Phase C: start watchdog scheduler. Joins the supervision
-        // tree post-bind so the HTTP surface is ready before the first
-        // tick (matches contextMonitor pattern).
-        deps.watchdogScheduler?.start();
-    });
+    // Multi-bind via N serve() instances sharing the same Hono app.
+    // Hono's serve() targets a single host:port; for multi-bind we spawn
+    // one per host. The contextMonitor + watchdog scheduler only start
+    // once after the first successful bind callback fires.
+    let monitorsStarted = false;
+    const servers = [];
+    for (const host of bindHosts) {
+        const srv = serve({ fetch: app.fetch, port: p, hostname: host }, (info) => {
+            console.log(`OpenRig daemon listening on http://${host}:${info.port}`);
+            if (!monitorsStarted) {
+                monitorsStarted = true;
+                contextMonitor.start();
+                // PL-004 Phase C: start watchdog scheduler. Joins the supervision
+                // tree post-bind so the HTTP surface is ready before the first
+                // tick (matches contextMonitor pattern).
+                deps.watchdogScheduler?.start();
+                // Slice 15 — start the seat-activity scheduler (1Hz default).
+                // Polls every running tmux-bound seat's silence_flag so
+                // PsProjectionService + node-inventory enrichment serve
+                // fresh data on each request.
+                deps.seatActivityService?.start(deps.rigRepo.db);
+            }
+        });
+        servers.push(srv);
+    }
     // PL-004 Phase C: graceful shutdown — stop scheduler before process
     // exit so any in-flight policy evaluation completes (or is awaited).
+    // Multi-bind: close every serve() instance in parallel.
     const shutdown = async (sig) => {
         console.log(`OpenRig daemon received ${sig}; shutting down`);
         try {
@@ -34,11 +64,27 @@ export async function startServer(port) {
         catch (err) {
             console.error("[watchdog] shutdown error", err);
         }
+        try {
+            deps.seatActivityService?.stop();
+        }
+        catch (err) {
+            console.error("[seat-activity] shutdown error", err);
+        }
+        await Promise.all(servers.map((srv) => new Promise((resolve) => {
+            try {
+                srv.close(() => resolve());
+            }
+            catch {
+                resolve();
+            }
+        })));
         process.exit(0);
     };
     process.once("SIGINT", () => void shutdown("SIGINT"));
     process.once("SIGTERM", () => void shutdown("SIGTERM"));
-    return server;
+    // Backward-compatible single-server return (callers that just need a
+    // handle reference; multi-bind shutdown is wired via signal handlers).
+    return servers[0];
 }
 // Only start the server when this file is executed directly (not imported).
 const isDirectRun = process.argv[1] &&

package/daemon/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,mBAAmB,CAAC;AAC1C,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AACrD,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAC5C,OAAO,EAAE,uBAAuB,EAAE,MAAM,mCAAmC,CAAC;AAE5E,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,IAAa;IAC7C,MAAM,CAAC,GAAG,IAAI,IAAI,QAAQ,CAAC,cAAc,CAAC,cAAc,EAAE,aAAa,CAAC,IAAI,MAAM,EAAE,EAAE,CAAC,CAAC;IACxF,MAAM,MAAM,GAAG,cAAc,CAAC,YAAY,EAAE,WAAW,CAAC,IAAI,gBAAgB,CAAC;IAE7E,MAAM,CAAC,GAAG,cAAc,CAAC,cAAc,EAAE,aAAa,CAAC,IAAI,WAAW,CAAC;IACvE,gEAAgE;IAChE,oDAAoD;IACpD,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,yBAAyB,IAAI,IAAI,CAAC;IAElE,mEAAmE;IACnE,mEAAmE;IACnE,4DAA4D;IAC5D,iEAAiE;IACjE,uBAAuB,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC;IAElD,MAAM,EAAE,GAAG,EAAE,cAAc,EAAE,IAAI,EAAE,GAAG,MAAM,YAAY,CAAC,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC,CAAC;IAElF,MAAM,MAAM,GAAG,KAAK,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,EAAE,CAAC,IAAI,EAAE,EAAE;QACxE,OAAO,CAAC,GAAG,CAAC,gDAAgD,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;QACzE,kEAAkE;QAClE,cAAc,CAAC,KAAK,EAAE,CAAC;QACvB,kEAAkE;QAClE,+DAA+D;QAC/D,yCAAyC;QACzC,IAAI,CAAC,iBAAiB,EAAE,KAAK,EAAE,CAAC;IAClC,CAAC,CAAC,CAAC;IAEH,oEAAoE;IACpE,qEAAqE;IACrE,MAAM,QAAQ,GAAG,KAAK,EAAE,GAAW,EAAE,EAAE;QACrC,OAAO,CAAC,GAAG,CAAC,2BAA2B,GAAG,iBAAiB,CAAC,CAAC;QAC7D,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,iBAAiB,EAAE,IAAI,EAAE,CAAC;QACvC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,KAAK,CAAC,2BAA2B,EAAE,GAAG,CAAC,CAAC;QAClD,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC,CAAC;IACF,OAAO,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,EAAE,CAAC,KAAK,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC;IACtD,OAAO,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,KAAK,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC;IAExD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,4EAA4E;AAC5E,MAAM,WAAW,GACf,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;IACf,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,UAAU,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;AAElD,IAAI,WAAW,EAAE,CAAC;IAChB,WAAW,EAAE,CAAC;AAChB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAmB,MAAM,mBAAmB,CAAC;AAC3D,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AACrD,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAC5C,OAAO,EACL,uBAAuB,EACvB,wBAAwB,GACzB,MAAM,mCAAmC,CAAC;AAE3C,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,IAAa;IAC7C,MAAM,CAAC,GAAG,IAAI,IAAI,QAAQ,CAAC,cAAc,CAAC,cAAc,EAAE,aAAa,CAAC,IAAI,MAAM,EAAE,EAAE,CAAC,CAAC;IACxF,MAAM,MAAM,GAAG,cAAc,CAAC,YAAY,EAAE,WAAW,CAAC,IAAI,gBAAgB,CAAC;IAE7E,mEAAmE;IACnE,kEAAkE;IAClE,qEAAqE;IACrE,oEAAoE;IACpE,mEAAmE;IACnE,iEAAiE;IACjE,MAAM,YAAY,GAAG,cAAc,CAAC,cAAc,EAAE,aAAa,CAAC,CAAC;IACnE,gEAAgE;IAChE,oDAAoD;IACpD,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,yBAAyB,IAAI,IAAI,CAAC;IAElE,IAAI,SAAmB,CAAC;IACxB,IAAI,YAAY,EAAE,CAAC;QACjB,mEAAmE;QACnE,sEAAsE;QACtE,MAAM,uBAAuB,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,WAAW,EAAE,CAAC,CAAC;QACnE,SAAS,GAAG,CAAC,YAAY,CAAC,CAAC;IAC7B,CAAC;SAAM,CAAC;QACN,uEAAuE;QACvE,MAAM,WAAW,GAAG,wBAAwB,EAAE,CAAC;QAC/C,SAAS,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC;IACvE,CAAC;IAED,MAAM,EAAE,GAAG,EAAE,cAAc,EAAE,IAAI,EAAE,GAAG,MAAM,YAAY,CAAC,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC,CAAC;IAElF,gEAAgE;IAChE,qEAAqE;IACrE,mEAAmE;IACnE,uDAAuD;IACvD,IAAI,eAAe,GAAG,KAAK,CAAC;IAC5B,MAAM,OAAO,GAAiB,EAAE,CAAC;IACjC,KAAK,MAAM,IAAI,IAAI,SAAS,EAAE,CAAC;QAC7B,MAAM,GAAG,GAAG,KAAK,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,EAAE;YACxE,OAAO,CAAC,GAAG,CAAC,sCAAsC,IAAI,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;YACvE,IAAI,CAAC,eAAe,EAAE,CAAC;gBACrB,eAAe,GAAG,IAAI,CAAC;gBACvB,cAAc,CAAC,KAAK,EAAE,CAAC;gBACvB,kEAAkE;gBAClE,+DAA+D;gBAC/D,yCAAyC;gBACzC,IAAI,CAAC,iBAAiB,EAAE,KAAK,EAAE,CAAC;gBAChC,8DAA8D;gBAC9D,wDAAwD;gBACxD,wDAAwD;gBACxD,8BAA8B;gBAC9B,IAAI,CAAC,mBAAmB,EAAE,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;YACnD,CAAC;QACH,CAAC,CAAC,CAAC;QACH,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACpB,CAAC;IAED,oEAAoE;IACpE,qEAAqE;IACrE,wDAAwD;IACxD,MAAM,QAAQ,GAAG,KAAK,EAAE,GAAW,EAAE,EAAE;QACrC,OAAO,CAAC,GAAG,CAAC,2BAA2B,GAAG,iBAAiB,CAAC,CAAC;QAC7D,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,iBAAiB,EAAE,IAAI,EAAE,CAAC;QACvC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,KAAK,CAAC,2BAA2B,EAAE,GAAG,CAAC,CAAC;QAClD,CAAC;QACD,IAAI,CAAC;YACH,IAAI,CAAC,mBAAmB,EAAE,IAAI,EAAE,CAAC;QACnC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,KAAK,CAAC,gCAAgC,EAAE,GAAG,CAAC,CAAC;QACvD,CAAC;QACD,MAAM,OAAO,CAAC,GAAG,CACf,OAAO,CAAC,GAAG,CACT,CAAC,GAAG,EAAE,EAAE,CACN,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE;YAC5B,IAAI,CAAC;gBACH,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC;YAC7B,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,EAAE,CAAC;YACZ,CAAC;QACH,CAAC,CAAC,CACL,CACF,CAAC;QACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC,CAAC;IACF,OAAO,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,EAAE,CAAC,KAAK,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC;IACtD,OAAO,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,KAAK,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC;IAExD,qEAAqE;IACrE,uEAAuE;IACvE,OAAO,OAAO,CAAC,CAAC,CAAE,CAAC;AACrB,CAAC;AAED,4EAA4E;AAC5E,MAAM,WAAW,GACf,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;IACf,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,UAAU,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;AAElD,IAAI,WAAW,EAAE,CAAC;IAChB,WAAW,EAAE,CAAC;AAChB,CAAC"}

package/daemon/dist/lib/pane-envelope.d.ts

@@ -0,0 +1,7 @@
+/** Wrap a tmux-pane body with the canonical From/To envelope. The
+ *  recipient pane sees both the sender's identity and a reply hint.
+ *  Cross-host nudges should NOT double-wrap: the remote rig wraps
+ *  when it processes the same command (matches `wrapSendBody`'s
+ *  cross-host carve-out). */
+export declare function wrapPaneEnvelope(sender: string | undefined, recipient: string, body: string): string;
+//# sourceMappingURL=pane-envelope.d.ts.map

package/daemon/dist/lib/pane-envelope.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pane-envelope.d.ts","sourceRoot":"","sources":["../../src/lib/pane-envelope.ts"],"names":[],"mappings":"AAuBA;;;;6BAI6B;AAC7B,wBAAgB,gBAAgB,CAC9B,MAAM,EAAE,MAAM,GAAG,SAAS,EAC1B,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE,MAAM,GACX,MAAM,CAUR"}

package/daemon/dist/lib/pane-envelope.js

@@ -0,0 +1,38 @@
+// V0.3.1 slice 23 founder-walk-queue-handoff-envelope.
+//
+// Daemon-side renderer for the email-style envelope the recipient's
+// tmux pane shows when a peer sends them a message (`rig send`) or
+// when a queue handoff/create nudges them. Wrapping the body with
+// From / To / --- / body / --- / ↩ Reply gives both a sender
+// identity and a copy-pasteable reply hint.
+//
+// PARITY CONTRACT with CLI:
+// `packages/cli/src/commands/send.ts :: wrapSendBody` must produce
+// BYTE-IDENTICAL output for the same inputs. The two implementations
+// live in separate packages because cli + daemon don't cross-import
+// today; the contract is enforced via:
+//   1. Identical function body (visual diff)
+//   2. `packages/daemon/test/pane-envelope.test.ts` mirroring the
+//      assertions in `packages/cli/test/send-header.test.ts`
+//   3. Live integration parity (HG-5): a queue handoff nudge and a
+//      rig send to the same destination render byte-identical
+//      output except for the body content
+// If you update this function, update wrapSendBody in lockstep.
+const SENDER_FALLBACK = "<unknown sender>";
+/** Wrap a tmux-pane body with the canonical From/To envelope. The
+ *  recipient pane sees both the sender's identity and a reply hint.
+ *  Cross-host nudges should NOT double-wrap: the remote rig wraps
+ *  when it processes the same command (matches `wrapSendBody`'s
+ *  cross-host carve-out). */
+export function wrapPaneEnvelope(sender, recipient, body) {
+    const senderLabel = sender && sender.trim().length > 0 ? sender : SENDER_FALLBACK;
+    return [
+        `From: ${senderLabel}`,
+        `To: ${recipient}`,
+        "---",
+        body,
+        "---",
+        `↩ Reply: rig send ${senderLabel} "..."`,
+    ].join("\n");
+}
+//# sourceMappingURL=pane-envelope.js.map

package/daemon/dist/lib/pane-envelope.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pane-envelope.js","sourceRoot":"","sources":["../../src/lib/pane-envelope.ts"],"names":[],"mappings":"AAAA,uDAAuD;AACvD,EAAE;AACF,oEAAoE;AACpE,mEAAmE;AACnE,kEAAkE;AAClE,6DAA6D;AAC7D,4CAA4C;AAC5C,EAAE;AACF,4BAA4B;AAC5B,mEAAmE;AACnE,qEAAqE;AACrE,oEAAoE;AACpE,uCAAuC;AACvC,6CAA6C;AAC7C,kEAAkE;AAClE,6DAA6D;AAC7D,mEAAmE;AACnE,8DAA8D;AAC9D,0CAA0C;AAC1C,gEAAgE;AAEhE,MAAM,eAAe,GAAG,kBAAkB,CAAC;AAE3C;;;;6BAI6B;AAC7B,MAAM,UAAU,gBAAgB,CAC9B,MAA0B,EAC1B,SAAiB,EACjB,IAAY;IAEZ,MAAM,WAAW,GAAG,MAAM,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,eAAe,CAAC;IAClF,OAAO;QACL,SAAS,WAAW,EAAE;QACtB,OAAO,SAAS,EAAE;QAClB,KAAK;QACL,IAAI;QACJ,KAAK;QACL,qBAAqB,WAAW,QAAQ;KACzC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC"}

package/daemon/dist/middleware/auth-bearer-token.d.ts

@@ -1,3 +1,4 @@
+import { type NetworkInterfaceInfo } from "node:os";
 import type { MiddlewareHandler } from "hono";
 /**
  * Constant-time string equality using Node's timingSafeEqual.
@@ -32,18 +33,59 @@ export declare function authBearerTokenMiddleware(opts: AuthBearerTokenOpts): Mi
  * treated as non-loopback.
  */
 export declare function isLoopbackBind(host: string | undefined | null): boolean;
+/**
+ * Detect tailscale CGNAT IPv4 (100.64.0.0/10) and ULA IPv6 prefix
+ * (fd7a:115c:a1e0::/48). Returns true for tailnet-literal IP addresses
+ * only; hostname callers must first resolve via {@link resolveToIpOrNull}.
+ *
+ * Rationale: tailscale's WireGuard mesh + ACLs ARE the auth boundary, so
+ * a tailnet-bound daemon does not need an additional bearer token. The
+ * CGNAT IPv4 range and ULA IPv6 prefix are reserved by tailscale and
+ * documented; collisions on real-world networks are essentially zero.
+ *
+ * Boundary semantics for HG-3: CGNAT is 100.64.0.0/10 → first octet
+ * exactly 100, second octet 64..127 inclusive. 100.63.x.x and
+ * 100.128.x.x are NOT tailnet.
+ */
+export declare function isTailscaleBind(host: string | undefined | null): boolean;
+/**
+ * Pure helper for {@link detectTailscaleInterface}: takes a NetworkInterfaces
+ * dictionary (the shape returned by os.networkInterfaces()) and returns the
+ * first non-internal address that matches the tailnet IP ranges, or null.
+ * Factored out so tests can supply synthetic interface fixtures without
+ * mocking node:os.
+ */
+export declare function findTailscaleIpInInterfaces(interfaces: NodeJS.Dict<NetworkInterfaceInfo[]>): string | null;
+/**
+ * Probe the host's network interfaces and return the first tailscale-IP
+ * address found (CGNAT IPv4 or tailnet ULA IPv6), or null when no tailnet
+ * interface is currently active. Used at daemon startup to decide whether
+ * to multi-bind (loopback + tailnet) or loopback-only. Detection is
+ * IP-based, not interface-name-based, so it survives platform differences
+ * in how tailscale names its tun device.
+ */
+export declare function detectTailscaleInterface(): string | null;
+/**
+ * Resolve a hostname to its first IP via node:dns/promises lookup.
+ * Returns null on resolution failure (DNS error, timeout, no such host).
+ * Wrapped with a 5s race-timeout per Risk 9.2 in the slice IMPL-PRD so an
+ * unresponsive resolver does not stall daemon startup indefinitely.
+ */
+export declare function resolveToIpOrNull(host: string): Promise<string | null>;
 export declare class AuthBearerTokenStartupError extends Error {
     constructor(message: string);
 }
 /**
  * Startup-side check (HARD-GATE audit row 8). Throws an explicit
- * AuthBearerTokenStartupError when the bind interface is non-loopback
- * AND the bearer token is empty. Called from index.ts BEFORE
- * `serve()` listens, so the daemon refuses to start in the unsafe
- * configuration.
+ * AuthBearerTokenStartupError when the bind interface is genuinely
+ * public/LAN AND the bearer token is empty. Loopback or tailscale-IP
+ * binds short-circuit (the tailnet is the auth boundary). Hostname
+ * binds resolve via DNS first; if resolution yields a loopback or
+ * tailnet IP, the same short-circuit applies. Public/LAN binds without
+ * a bearer throw and the daemon refuses to start.
  */
 export declare function assertBindAuthInvariant(opts: {
     host: string;
     bearerToken: string | null;
-}): void;
+}): Promise<void>;
 //# sourceMappingURL=auth-bearer-token.d.ts.map

package/daemon/dist/middleware/auth-bearer-token.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth-bearer-token.d.ts","sourceRoot":"","sources":["../../src/middleware/auth-bearer-token.ts"],"names":[],"mappings":"AAyBA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,MAAM,CAAC;AAE9C;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,GAAG,OAAO,CAe/D;AAwBD,MAAM,WAAW,mBAAmB;IAClC;;;;OAIG;IACH,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;CAC9B;AAED;;;;;;;;GAQG;AACH,wBAAgB,yBAAyB,CACvC,IAAI,EAAE,mBAAmB,GACxB,iBAAiB,CAyBnB;AAED;;;;;;GAMG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,GAAG,OAAO,CAWvE;AAED,qBAAa,2BAA4B,SAAQ,KAAK;gBACxC,OAAO,EAAE,MAAM;CAI5B;AAED;;;;;;GAMG;AACH,wBAAgB,uBAAuB,CAAC,IAAI,EAAE;IAC5C,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;CAC5B,GAAG,IAAI,CAQP"}
+{"version":3,"file":"auth-bearer-token.d.ts","sourceRoot":"","sources":["../../src/middleware/auth-bearer-token.ts"],"names":[],"mappings":"AA0BA,OAAO,EAAqB,KAAK,oBAAoB,EAAE,MAAM,SAAS,CAAC;AACvE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,MAAM,CAAC;AAE9C;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,GAAG,OAAO,CAe/D;AAwBD,MAAM,WAAW,mBAAmB;IAClC;;;;OAIG;IACH,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;CAC9B;AAED;;;;;;;;GAQG;AACH,wBAAgB,yBAAyB,CACvC,IAAI,EAAE,mBAAmB,GACxB,iBAAiB,CAyBnB;AAED;;;;;;GAMG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,GAAG,OAAO,CAWvE;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,GAAG,OAAO,CAaxE;AAED;;;;;;GAMG;AACH,wBAAgB,2BAA2B,CACzC,UAAU,EAAE,MAAM,CAAC,IAAI,CAAC,oBAAoB,EAAE,CAAC,GAC9C,MAAM,GAAG,IAAI,CASf;AAED;;;;;;;GAOG;AACH,wBAAgB,wBAAwB,IAAI,MAAM,GAAG,IAAI,CAExD;AAED;;;;;GAKG;AACH,wBAAsB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAa5E;AAED,qBAAa,2BAA4B,SAAQ,KAAK;gBACxC,OAAO,EAAE,MAAM;CAI5B;AAED;;;;;;;;GAQG;AACH,wBAAsB,uBAAuB,CAAC,IAAI,EAAE;IAClD,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;CAC5B,GAAG,OAAO,CAAC,IAAI,CAAC,CAqBhB"}

package/daemon/dist/middleware/auth-bearer-token.js

@@ -22,6 +22,8 @@
 // integrity, not view confidentiality).
 import { Buffer } from "node:buffer";
 import { timingSafeEqual } from "node:crypto";
+import { promises as dns } from "node:dns";
+import { networkInterfaces } from "node:os";
 /**
  * Constant-time string equality using Node's timingSafeEqual.
  * Returns false when lengths differ (timingSafeEqual throws on
@@ -110,6 +112,89 @@ export function isLoopbackBind(host) {
         return true;
     return false;
 }
+/**
+ * Detect tailscale CGNAT IPv4 (100.64.0.0/10) and ULA IPv6 prefix
+ * (fd7a:115c:a1e0::/48). Returns true for tailnet-literal IP addresses
+ * only; hostname callers must first resolve via {@link resolveToIpOrNull}.
+ *
+ * Rationale: tailscale's WireGuard mesh + ACLs ARE the auth boundary, so
+ * a tailnet-bound daemon does not need an additional bearer token. The
+ * CGNAT IPv4 range and ULA IPv6 prefix are reserved by tailscale and
+ * documented; collisions on real-world networks are essentially zero.
+ *
+ * Boundary semantics for HG-3: CGNAT is 100.64.0.0/10 → first octet
+ * exactly 100, second octet 64..127 inclusive. 100.63.x.x and
+ * 100.128.x.x are NOT tailnet.
+ */
+export function isTailscaleBind(host) {
+    if (!host)
+        return false;
+    const trimmed = host.trim().toLowerCase();
+    const ipv4Match = /^(\d+)\.(\d+)\.(\d+)\.(\d+)$/.exec(trimmed);
+    if (ipv4Match) {
+        const first = parseInt(ipv4Match[1], 10);
+        const second = parseInt(ipv4Match[2], 10);
+        if (first === 100 && second >= 64 && second <= 127)
+            return true;
+        return false;
+    }
+    const cleaned = trimmed.replace(/^\[|\]$/g, "");
+    if (cleaned.startsWith("fd7a:115c:a1e0:"))
+        return true;
+    return false;
+}
+/**
+ * Pure helper for {@link detectTailscaleInterface}: takes a NetworkInterfaces
+ * dictionary (the shape returned by os.networkInterfaces()) and returns the
+ * first non-internal address that matches the tailnet IP ranges, or null.
+ * Factored out so tests can supply synthetic interface fixtures without
+ * mocking node:os.
+ */
+export function findTailscaleIpInInterfaces(interfaces) {
+    for (const addrs of Object.values(interfaces)) {
+        if (!addrs)
+            continue;
+        for (const addr of addrs) {
+            if (addr.internal)
+                continue;
+            if (isTailscaleBind(addr.address))
+                return addr.address;
+        }
+    }
+    return null;
+}
+/**
+ * Probe the host's network interfaces and return the first tailscale-IP
+ * address found (CGNAT IPv4 or tailnet ULA IPv6), or null when no tailnet
+ * interface is currently active. Used at daemon startup to decide whether
+ * to multi-bind (loopback + tailnet) or loopback-only. Detection is
+ * IP-based, not interface-name-based, so it survives platform differences
+ * in how tailscale names its tun device.
+ */
+export function detectTailscaleInterface() {
+    return findTailscaleIpInInterfaces(networkInterfaces());
+}
+/**
+ * Resolve a hostname to its first IP via node:dns/promises lookup.
+ * Returns null on resolution failure (DNS error, timeout, no such host).
+ * Wrapped with a 5s race-timeout per Risk 9.2 in the slice IMPL-PRD so an
+ * unresponsive resolver does not stall daemon startup indefinitely.
+ */
+export async function resolveToIpOrNull(host) {
+    try {
+        const timeout = new Promise((resolve) => {
+            setTimeout(() => resolve(null), 5000).unref();
+        });
+        const lookup = dns
+            .lookup(host, { all: false })
+            .then((r) => r.address)
+            .catch(() => null);
+        return await Promise.race([lookup, timeout]);
+    }
+    catch {
+        return null;
+    }
+}
 export class AuthBearerTokenStartupError extends Error {
     constructor(message) {
         super(message);
@@ -118,18 +203,34 @@ export class AuthBearerTokenStartupError extends Error {
 }
 /**
  * Startup-side check (HARD-GATE audit row 8). Throws an explicit
- * AuthBearerTokenStartupError when the bind interface is non-loopback
- * AND the bearer token is empty. Called from index.ts BEFORE
- * `serve()` listens, so the daemon refuses to start in the unsafe
- * configuration.
+ * AuthBearerTokenStartupError when the bind interface is genuinely
+ * public/LAN AND the bearer token is empty. Loopback or tailscale-IP
+ * binds short-circuit (the tailnet is the auth boundary). Hostname
+ * binds resolve via DNS first; if resolution yields a loopback or
+ * tailnet IP, the same short-circuit applies. Public/LAN binds without
+ * a bearer throw and the daemon refuses to start.
  */
-export function assertBindAuthInvariant(opts) {
+export async function assertBindAuthInvariant(opts) {
     if (isLoopbackBind(opts.host))
         return;
+    if (isTailscaleBind(opts.host))
+        return;
+    let resolvedIp = null;
+    // Hostname (non-IP literal) — resolve and re-check.
+    if (!/^[\d.]+$/.test(opts.host) && !opts.host.includes(":")) {
+        resolvedIp = await resolveToIpOrNull(opts.host);
+        if (resolvedIp) {
+            if (isLoopbackBind(resolvedIp))
+                return;
+            if (isTailscaleBind(resolvedIp))
+                return;
+        }
+    }
     if (opts.bearerToken && opts.bearerToken.length > 0)
         return;
-    throw new AuthBearerTokenStartupError(`daemon refusing to start: bind host '${opts.host}' is non-loopback but auth.bearerToken (env OPENRIG_AUTH_BEARER_TOKEN) is empty. ` +
-        `Either bind to 127.0.0.1 / localhost, OR set OPENRIG_AUTH_BEARER_TOKEN to a non-empty value before start. ` +
-        `Mission Control write verbs require bearer auth on any non-loopback bind because tailnet/public exposure without auth would let any peer on the network mutate operator state.`);
+    throw new AuthBearerTokenStartupError(`daemon refusing to start: bind host '${opts.host}'${resolvedIp ? ` (resolves to ${resolvedIp})` : ""} is not loopback or tailscale, ` +
+        `and auth.bearerToken (env OPENRIG_AUTH_BEARER_TOKEN) is empty. ` +
+        `Either: (a) bind to 127.0.0.1 / localhost, (b) bind to a tailscale interface (100.64.0.0/10 IPv4 or fd7a:115c:a1e0::/48 IPv6), ` +
+        `or (c) set OPENRIG_AUTH_BEARER_TOKEN to a non-empty value before starting the daemon.`);
 }
 //# sourceMappingURL=auth-bearer-token.js.map

package/daemon/dist/middleware/auth-bearer-token.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth-bearer-token.js","sourceRoot":"","sources":["../../src/middleware/auth-bearer-token.ts"],"names":[],"mappings":"AAAA,sEAAsE;AACtE,EAAE;AACF,uDAAuD;AACvD,yEAAyE;AACzE,wCAAwC;AACxC,oEAAoE;AACpE,mDAAmD;AACnD,qEAAqE;AACrE,iEAAiE;AACjE,EAAE;AACF,uEAAuE;AACvE,sEAAsE;AACtE,qEAAqE;AACrE,oBAAoB;AACpB,EAAE;AACF,iEAAiE;AACjE,uEAAuE;AACvE,gEAAgE;AAChE,qEAAqE;AACrE,iEAAiE;AACjE,mEAAmE;AACnE,wCAAwC;AAExC,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AACrC,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAG9C;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB,CAAC,CAAS,EAAE,CAAS;IACpD,mEAAmE;IACnE,mEAAmE;IACnE,qEAAqE;IACrE,oEAAoE;IACpE,wBAAwB;IACxB,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;IACpC,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;IACpC,IAAI,IAAI,CAAC,MAAM,KAAK,IAAI,CAAC,MAAM,EAAE,CAAC;QAChC,kEAAkE;QAClE,mEAAmE;QACnE,eAAe,CAAC,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;QACjD,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,eAAe,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;AACrC,CAAC;AAED;;;GAGG;AACH,SAAS,gBAAgB,CAAC,MAAc;IAOtC,OAAO;QACL,KAAK,EAAE,cAAc;QACrB,OAAO,EAAE,gCAAgC,MAAM,EAAE;QACjD,WAAW,EAAE,MAAM;QACnB,cAAc,EACZ,0KAA0K;QAC5K,UAAU,EACR,sKAAsK;KACzK,CAAC;AACJ,CAAC;AAWD;;;;;;;;GAQG;AACH,MAAM,UAAU,yBAAyB,CACvC,IAAyB;IAEzB,MAAM,EAAE,aAAa,EAAE,GAAG,IAAI,CAAC;IAC/B,OAAO,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;QACvB,IAAI,aAAa,KAAK,IAAI,EAAE,CAAC;YAC3B,2DAA2D;YAC3D,MAAM,IAAI,EAAE,CAAC;YACb,OAAO;QACT,CAAC;QACD,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;QAC9E,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,8BAA8B,CAAC,EAAE,GAAG,CAAC,CAAC;QACvE,CAAC;QACD,MAAM,KAAK,GAAG,kBAAkB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC9C,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,CAAC,CAAC,IAAI,CACX,gBAAgB,CAAC,+CAA+C,CAAC,EACjE,GAAG,CACJ,CAAC;QACJ,CAAC;QACD,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,CAAE,CAAC,IAAI,EAAE,CAAC;QAClC,IAAI,CAAC,iBAAiB,CAAC,QAAQ,EAAE,aAAa,CAAC,EAAE,CAAC;YAChD,OAAO,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,6BAA6B,CAAC,EAAE,GAAG,CAAC,CAAC;QACtE,CAAC;QACD,MAAM,IAAI,EAAE,CAAC;IACf,CAAC,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,cAAc,CAAC,IAA+B;IAC5D,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC/B,8DAA8D;QAC9D,oEAAoE;QACpE,yCAAyC;QACzC,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC1C,IAAI,OAAO,KAAK,WAAW,IAAI,OAAO,KAAK,KAAK,IAAI,OAAO,KAAK,OAAO;QAAE,OAAO,IAAI,CAAC;IACrF,IAAI,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC;IAC5C,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,OAAO,2BAA4B,SAAQ,KAAK;IACpD,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,6BAA6B,CAAC;IAC5C,CAAC;CACF;AAED;;;;;;GAMG;AACH,MAAM,UAAU,uBAAuB,CAAC,IAGvC;IACC,IAAI,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO;IACtC,IAAI,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO;IAC5D,MAAM,IAAI,2BAA2B,CACnC,wCAAwC,IAAI,CAAC,IAAI,mFAAmF;QAClI,4GAA4G;QAC5G,gLAAgL,CACnL,CAAC;AACJ,CAAC"}
+{"version":3,"file":"auth-bearer-token.js","sourceRoot":"","sources":["../../src/middleware/auth-bearer-token.ts"],"names":[],"mappings":"AAAA,sEAAsE;AACtE,EAAE;AACF,uDAAuD;AACvD,yEAAyE;AACzE,wCAAwC;AACxC,oEAAoE;AACpE,mDAAmD;AACnD,qEAAqE;AACrE,iEAAiE;AACjE,EAAE;AACF,uEAAuE;AACvE,sEAAsE;AACtE,qEAAqE;AACrE,oBAAoB;AACpB,EAAE;AACF,iEAAiE;AACjE,uEAAuE;AACvE,gEAAgE;AAChE,qEAAqE;AACrE,iEAAiE;AACjE,mEAAmE;AACnE,wCAAwC;AAExC,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AACrC,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC9C,OAAO,EAAE,QAAQ,IAAI,GAAG,EAAE,MAAM,UAAU,CAAC;AAC3C,OAAO,EAAE,iBAAiB,EAA6B,MAAM,SAAS,CAAC;AAGvE;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB,CAAC,CAAS,EAAE,CAAS;IACpD,mEAAmE;IACnE,mEAAmE;IACnE,qEAAqE;IACrE,oEAAoE;IACpE,wBAAwB;IACxB,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;IACpC,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;IACpC,IAAI,IAAI,CAAC,MAAM,KAAK,IAAI,CAAC,MAAM,EAAE,CAAC;QAChC,kEAAkE;QAClE,mEAAmE;QACnE,eAAe,CAAC,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;QACjD,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,eAAe,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;AACrC,CAAC;AAED;;;GAGG;AACH,SAAS,gBAAgB,CAAC,MAAc;IAOtC,OAAO;QACL,KAAK,EAAE,cAAc;QACrB,OAAO,EAAE,gCAAgC,MAAM,EAAE;QACjD,WAAW,EAAE,MAAM;QACnB,cAAc,EACZ,0KAA0K;QAC5K,UAAU,EACR,sKAAsK;KACzK,CAAC;AACJ,CAAC;AAWD;;;;;;;;GAQG;AACH,MAAM,UAAU,yBAAyB,CACvC,IAAyB;IAEzB,MAAM,EAAE,aAAa,EAAE,GAAG,IAAI,CAAC;IAC/B,OAAO,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;QACvB,IAAI,aAAa,KAAK,IAAI,EAAE,CAAC;YAC3B,2DAA2D;YAC3D,MAAM,IAAI,EAAE,CAAC;YACb,OAAO;QACT,CAAC;QACD,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;QAC9E,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,8BAA8B,CAAC,EAAE,GAAG,CAAC,CAAC;QACvE,CAAC;QACD,MAAM,KAAK,GAAG,kBAAkB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC9C,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,CAAC,CAAC,IAAI,CACX,gBAAgB,CAAC,+CAA+C,CAAC,EACjE,GAAG,CACJ,CAAC;QACJ,CAAC;QACD,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,CAAE,CAAC,IAAI,EAAE,CAAC;QAClC,IAAI,CAAC,iBAAiB,CAAC,QAAQ,EAAE,aAAa,CAAC,EAAE,CAAC;YAChD,OAAO,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,6BAA6B,CAAC,EAAE,GAAG,CAAC,CAAC;QACtE,CAAC;QACD,MAAM,IAAI,EAAE,CAAC;IACf,CAAC,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,cAAc,CAAC,IAA+B;IAC5D,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC/B,8DAA8D;QAC9D,oEAAoE;QACpE,yCAAyC;QACzC,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC1C,IAAI,OAAO,KAAK,WAAW,IAAI,OAAO,KAAK,KAAK,IAAI,OAAO,KAAK,OAAO;QAAE,OAAO,IAAI,CAAC;IACrF,IAAI,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC;IAC5C,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,eAAe,CAAC,IAA+B;IAC7D,IAAI,CAAC,IAAI;QAAE,OAAO,KAAK,CAAC;IACxB,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC1C,MAAM,SAAS,GAAG,8BAA8B,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC/D,IAAI,SAAS,EAAE,CAAC;QACd,MAAM,KAAK,GAAG,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAE,EAAE,EAAE,CAAC,CAAC;QAC1C,MAAM,MAAM,GAAG,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAE,EAAE,EAAE,CAAC,CAAC;QAC3C,IAAI,KAAK,KAAK,GAAG,IAAI,MAAM,IAAI,EAAE,IAAI,MAAM,IAAI,GAAG;YAAE,OAAO,IAAI,CAAC;QAChE,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;IAChD,IAAI,OAAO,CAAC,UAAU,CAAC,iBAAiB,CAAC;QAAE,OAAO,IAAI,CAAC;IACvD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,2BAA2B,CACzC,UAA+C;IAE/C,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC;QAC9C,IAAI,CAAC,KAAK;YAAE,SAAS;QACrB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,IAAI,IAAI,CAAC,QAAQ;gBAAE,SAAS;YAC5B,IAAI,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC;gBAAE,OAAO,IAAI,CAAC,OAAO,CAAC;QACzD,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,wBAAwB;IACtC,OAAO,2BAA2B,CAAC,iBAAiB,EAAE,CAAC,CAAC;AAC1D,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,IAAY;IAClD,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE;YAC5C,UAAU,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,CAAC,KAAK,EAAE,CAAC;QAChD,CAAC,CAAC,CAAC;QACH,MAAM,MAAM,GAAG,GAAG;aACf,MAAM,CAAC,IAAI,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC;aAC5B,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC;aACtB,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;QACrB,OAAO,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IAC/C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,OAAO,2BAA4B,SAAQ,KAAK;IACpD,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,6BAA6B,CAAC;IAC5C,CAAC;CACF;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAAC,IAG7C;IACC,IAAI,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO;IACtC,IAAI,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO;IAEvC,IAAI,UAAU,GAAkB,IAAI,CAAC;IACrC,oDAAoD;IACpD,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QAC5D,UAAU,GAAG,MAAM,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAChD,IAAI,UAAU,EAAE,CAAC;YACf,IAAI,cAAc,CAAC,UAAU,CAAC;gBAAE,OAAO;YACvC,IAAI,eAAe,CAAC,UAAU,CAAC;gBAAE,OAAO;QAC1C,CAAC;IACH,CAAC;IAED,IAAI,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO;IAC5D,MAAM,IAAI,2BAA2B,CACnC,wCAAwC,IAAI,CAAC,IAAI,IAAI,UAAU,CAAC,CAAC,CAAC,iBAAiB,UAAU,GAAG,CAAC,CAAC,CAAC,EAAE,iCAAiC;QACpI,iEAAiE;QACjE,iIAAiI;QACjI,uFAAuF,CAC1F,CAAC;AACJ,CAAC"}

package/daemon/dist/routes/bundles.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"bundles.d.ts","sourceRoot":"","sources":["../../src/routes/bundles.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAiB5B,eAAO,MAAM,YAAY,4EAAa,CAAC"}
+{"version":3,"file":"bundles.d.ts","sourceRoot":"","sources":["../../src/routes/bundles.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AA+N5B,eAAO,MAAM,YAAY,4EAAa,CAAC"}