@pellux/goodvibes-sdk 0.18.3 → 0.18.11

package/dist/platform/runtime/remote/distributed-runtime-pairing.js

@@ -0,0 +1,405 @@
+import { randomUUID } from 'node:crypto';
+import { buildAudit, fingerprint, hashSecret, matchesSecret, randomSecret, sanitizePairRequest, sanitizePeer, sanitizeToken, } from './distributed-runtime-utils.js';
+import { expireDistributedPairRequests, persistDistributedRuntime, pruneAndPersistDistributedRuntime, publishDistributedRuntimeEvent, recordDistributedRuntimeAudit, startDistributedRuntime, } from './distributed-runtime-store.js';
+export async function requestDistributedPairing(state, input) {
+    await startDistributedRuntime(state);
+    const now = Date.now();
+    const challenge = randomSecret('gvpair');
+    const request = {
+        id: `pair-${randomUUID().slice(0, 8)}`,
+        peerKind: input.peerKind,
+        requestedId: input.requestedId?.trim() || `${input.peerKind}-${randomUUID().slice(0, 8)}`,
+        label: input.label.trim() || `${input.peerKind} peer`,
+        platform: input.platform,
+        deviceFamily: input.deviceFamily,
+        version: input.version,
+        clientMode: input.clientMode,
+        capabilities: [...(input.capabilities ?? [])],
+        commands: [...(input.commands ?? [])],
+        requestedBy: input.requestedBy ?? 'remote',
+        status: 'pending',
+        challengePreview: fingerprint(challenge),
+        challengeHash: hashSecret(challenge),
+        createdAt: now,
+        updatedAt: now,
+        expiresAt: now + Math.max(30_000, Math.trunc(input.ttlMs ?? 10 * 60_000)),
+        remoteAddress: input.remoteAddress,
+        metadata: input.metadata ?? {},
+    };
+    state.pairRequests.set(request.id, request);
+    recordDistributedRuntimeAudit(state, buildAudit('pair-requested', input.requestedBy ?? 'remote', {
+        requestId: request.id,
+        note: `${request.peerKind}:${request.label}`,
+        metadata: request.metadata,
+    }));
+    await pruneAndPersistDistributedRuntime(state);
+    publishDistributedRuntimeEvent(state, 'remote-pair-requested', sanitizePairRequest(request));
+    return { request: sanitizePairRequest(request), challenge };
+}
+export async function approveDistributedPairRequest(state, requestId, input = {}) {
+    await startDistributedRuntime(state);
+    const request = state.pairRequests.get(requestId);
+    if (!request)
+        return null;
+    expireDistributedPairRequests(state);
+    if (request.status !== 'pending' && request.status !== 'approved') {
+        return { request: sanitizePairRequest(request), peer: sanitizePeer(ensurePeerFromRequest(state, request, input.label, input.metadata)) };
+    }
+    const peer = ensurePeerFromRequest(state, request, input.label, input.metadata);
+    const updated = {
+        ...request,
+        status: 'approved',
+        approvedAt: Date.now(),
+        updatedAt: Date.now(),
+        peerId: peer.id,
+        metadata: {
+            ...request.metadata,
+            ...(input.metadata ?? {}),
+        },
+    };
+    state.pairRequests.set(requestId, updated);
+    recordDistributedRuntimeAudit(state, buildAudit('pair-approved', input.actor ?? 'operator', {
+        requestId,
+        peerId: peer.id,
+        note: input.note ?? peer.label,
+    }));
+    await pruneAndPersistDistributedRuntime(state);
+    publishDistributedRuntimeEvent(state, 'remote-pair-approved', {
+        request: sanitizePairRequest(updated),
+        peer: sanitizePeer(peer),
+    });
+    return { request: sanitizePairRequest(updated), peer: sanitizePeer(peer) };
+}
+export async function rejectDistributedPairRequest(state, requestId, input = {}) {
+    await startDistributedRuntime(state);
+    const request = state.pairRequests.get(requestId);
+    if (!request)
+        return null;
+    const updated = {
+        ...request,
+        status: 'rejected',
+        rejectedAt: Date.now(),
+        updatedAt: Date.now(),
+    };
+    state.pairRequests.set(requestId, updated);
+    recordDistributedRuntimeAudit(state, buildAudit('pair-rejected', input.actor ?? 'operator', {
+        requestId,
+        note: input.note ?? updated.label,
+    }));
+    await pruneAndPersistDistributedRuntime(state);
+    publishDistributedRuntimeEvent(state, 'remote-pair-rejected', sanitizePairRequest(updated));
+    return sanitizePairRequest(updated);
+}
+export async function verifyDistributedPairRequest(state, requestId, challenge, input = {}) {
+    await startDistributedRuntime(state);
+    expireDistributedPairRequests(state);
+    const request = state.pairRequests.get(requestId);
+    if (!request)
+        return null;
+    if (request.status !== 'approved')
+        return null;
+    if (!matchesSecret(challenge, request.challengeHash))
+        return null;
+    const peer = ensurePeerFromRequest(state, request, undefined, input.metadata);
+    const issued = issueToken(state, peer.id, 'pair-verified-token');
+    const verifiedRequest = {
+        ...request,
+        status: 'verified',
+        verifiedAt: Date.now(),
+        updatedAt: Date.now(),
+        peerId: peer.id,
+        remoteAddress: input.remoteAddress ?? request.remoteAddress,
+        metadata: {
+            ...request.metadata,
+            ...(input.metadata ?? {}),
+        },
+    };
+    state.pairRequests.set(requestId, verifiedRequest);
+    const connectedPeer = updatePeerConnectionState(state, peer.id, 'connected', {
+        remoteAddress: input.remoteAddress,
+    }) ?? peer;
+    recordDistributedRuntimeAudit(state, buildAudit('pair-verified', 'remote-peer', {
+        requestId,
+        peerId: peer.id,
+        note: connectedPeer.label,
+    }));
+    await pruneAndPersistDistributedRuntime(state);
+    publishDistributedRuntimeEvent(state, 'remote-pair-verified', {
+        request: sanitizePairRequest(verifiedRequest),
+        peer: sanitizePeer(connectedPeer),
+    });
+    return {
+        peer: sanitizePeer(connectedPeer),
+        token: {
+            ...sanitizeToken(issued.token),
+            value: issued.value,
+        },
+    };
+}
+export async function rotateDistributedPeerToken(state, peerId, input = {}) {
+    await startDistributedRuntime(state);
+    const peer = state.peers.get(peerId);
+    if (!peer)
+        return null;
+    const issued = issueToken(state, peerId, input.label ?? 'rotated-access-token', input.scopes);
+    recordDistributedRuntimeAudit(state, buildAudit('token-rotated', input.actor ?? 'operator', {
+        peerId,
+        note: issued.token.label,
+    }));
+    await pruneAndPersistDistributedRuntime(state);
+    const updatedPeer = state.peers.get(peerId);
+    publishDistributedRuntimeEvent(state, 'remote-token-rotated', {
+        peer: sanitizePeer(updatedPeer),
+        tokenId: issued.token.id,
+    });
+    return {
+        peer: sanitizePeer(updatedPeer),
+        token: {
+            ...sanitizeToken(issued.token),
+            value: issued.value,
+        },
+    };
+}
+export async function revokeDistributedPeerToken(state, peerId, input = {}) {
+    await startDistributedRuntime(state);
+    const peer = state.peers.get(peerId);
+    if (!peer)
+        return null;
+    const now = Date.now();
+    let changed = false;
+    const nextTokens = peer.tokens.map((token) => {
+        if (input.tokenId && token.id !== input.tokenId)
+            return token;
+        if (token.revokedAt)
+            return token;
+        changed = true;
+        return {
+            ...token,
+            revokedAt: now,
+        };
+    });
+    if (!changed)
+        return sanitizePeer(peer);
+    const activeToken = nextTokens.find((token) => !token.revokedAt && token.id !== input.tokenId) ?? null;
+    const updated = {
+        ...peer,
+        status: activeToken ? peer.status : 'revoked',
+        activeTokenId: activeToken?.id,
+        tokens: nextTokens,
+    };
+    state.peers.set(peerId, updated);
+    recordDistributedRuntimeAudit(state, buildAudit('token-revoked', input.actor ?? 'operator', {
+        peerId,
+        note: input.note ?? input.tokenId ?? updated.label,
+    }));
+    await pruneAndPersistDistributedRuntime(state);
+    publishDistributedRuntimeEvent(state, 'remote-token-revoked', { peer: sanitizePeer(updated), tokenId: input.tokenId ?? null });
+    return sanitizePeer(updated);
+}
+export async function disconnectDistributedPeer(state, peerId, input = {}) {
+    await startDistributedRuntime(state);
+    const peer = updatePeerConnectionState(state, peerId, 'disconnected');
+    if (!peer)
+        return null;
+    if (input.requeueClaimedWork !== false) {
+        for (const item of state.work.values()) {
+            if (item.peerId !== peerId || item.status !== 'claimed')
+                continue;
+            state.work.set(item.id, {
+                ...item,
+                status: 'queued',
+                claimTokenId: undefined,
+                claimedAt: undefined,
+                leaseExpiresAt: undefined,
+                updatedAt: Date.now(),
+                metadata: {
+                    ...item.metadata,
+                    requeuedReason: input.note ?? 'peer-disconnected',
+                },
+            });
+        }
+    }
+    recordDistributedRuntimeAudit(state, buildAudit('peer-disconnected', input.actor ?? 'operator', {
+        peerId,
+        note: input.note ?? peer.label,
+    }));
+    await pruneAndPersistDistributedRuntime(state);
+    publishDistributedRuntimeEvent(state, 'remote-peer-disconnected', sanitizePeer(peer));
+    return sanitizePeer(peer);
+}
+export async function authenticateDistributedPeerToken(state, tokenValue, remoteAddress) {
+    await startDistributedRuntime(state);
+    if (!tokenValue.trim())
+        return null;
+    for (const peer of state.peers.values()) {
+        for (const token of peer.tokens) {
+            if (token.revokedAt)
+                continue;
+            if (!matchesSecret(tokenValue, token.secretHash))
+                continue;
+            const now = Date.now();
+            const updatedToken = {
+                ...token,
+                lastUsedAt: now,
+            };
+            const updatedPeer = {
+                ...peer,
+                status: 'connected',
+                lastSeenAt: now,
+                lastConnectedAt: now,
+                lastRemoteAddress: remoteAddress ?? peer.lastRemoteAddress,
+                activeTokenId: updatedToken.id,
+                tokens: peer.tokens.map((entry) => entry.id === updatedToken.id ? updatedToken : entry),
+            };
+            state.peers.set(peer.id, updatedPeer);
+            await persistDistributedRuntime(state);
+            return {
+                peer: sanitizePeer(updatedPeer),
+                token: updatedToken,
+            };
+        }
+    }
+    return null;
+}
+export async function heartbeatDistributedPeer(state, auth, input = {}) {
+    await startDistributedRuntime(state);
+    const peer = state.peers.get(auth.peer.id);
+    if (!peer)
+        throw new Error(`Unknown distributed peer: ${auth.peer.id}`);
+    const updated = {
+        ...peer,
+        status: 'connected',
+        lastSeenAt: Date.now(),
+        lastConnectedAt: Date.now(),
+        lastRemoteAddress: input.remoteAddress ?? peer.lastRemoteAddress,
+        capabilities: input.capabilities ? [...input.capabilities] : peer.capabilities,
+        commands: input.commands ? [...input.commands] : peer.commands,
+        version: input.version ?? peer.version,
+        clientMode: input.clientMode ?? peer.clientMode,
+        metadata: {
+            ...peer.metadata,
+            ...(input.metadata ?? {}),
+        },
+    };
+    state.peers.set(peer.id, updated);
+    recordDistributedRuntimeAudit(state, buildAudit('peer-connected', peer.id, {
+        peerId: peer.id,
+        note: updated.label,
+    }));
+    await pruneAndPersistDistributedRuntime(state);
+    publishDistributedRuntimeEvent(state, 'remote-peer-heartbeat', sanitizePeer(updated));
+    return sanitizePeer(updated);
+}
+function ensurePeerFromRequest(state, request, labelOverride, metadata) {
+    const existing = request.peerId ? state.peers.get(request.peerId) : [...state.peers.values()].find((peer) => peer.requestedId === request.requestedId);
+    if (existing) {
+        const merged = {
+            ...existing,
+            label: labelOverride?.trim() || existing.label,
+            platform: request.platform ?? existing.platform,
+            deviceFamily: request.deviceFamily ?? existing.deviceFamily,
+            version: request.version ?? existing.version,
+            clientMode: request.clientMode ?? existing.clientMode,
+            capabilities: request.capabilities.length > 0 ? request.capabilities : existing.capabilities,
+            commands: request.commands.length > 0 ? request.commands : existing.commands,
+            metadata: {
+                ...existing.metadata,
+                ...request.metadata,
+                ...(metadata ?? {}),
+            },
+        };
+        state.peers.set(existing.id, merged);
+        return merged;
+    }
+    const peer = {
+        id: `${request.peerKind}-${randomUUID().slice(0, 8)}`,
+        kind: request.peerKind,
+        label: labelOverride?.trim() || request.label,
+        requestedId: request.requestedId,
+        platform: request.platform,
+        deviceFamily: request.deviceFamily,
+        version: request.version,
+        clientMode: request.clientMode,
+        capabilities: request.capabilities,
+        commands: request.commands,
+        permissions: undefined,
+        status: 'paired',
+        pairedAt: Date.now(),
+        verifiedAt: undefined,
+        lastSeenAt: undefined,
+        lastConnectedAt: undefined,
+        lastDisconnectedAt: undefined,
+        lastRemoteAddress: request.remoteAddress,
+        activeTokenId: undefined,
+        tokens: [],
+        metadata: {
+            ...request.metadata,
+            ...(metadata ?? {}),
+        },
+    };
+    state.peers.set(peer.id, peer);
+    return peer;
+}
+function ensurePlaceholderPeer(state, peerId, kind) {
+    const existing = state.peers.get(peerId);
+    if (existing)
+        return existing;
+    const peer = {
+        id: peerId,
+        kind,
+        label: peerId,
+        requestedId: peerId,
+        capabilities: [],
+        commands: [],
+        permissions: undefined,
+        status: 'idle',
+        pairedAt: Date.now(),
+        tokens: [],
+        metadata: {},
+    };
+    state.peers.set(peer.id, peer);
+    return peer;
+}
+function issueToken(state, peerId, label, scopes = ['remote:pull', 'remote:complete', 'remote:heartbeat']) {
+    const peer = state.peers.get(peerId);
+    if (!peer)
+        throw new Error(`Unknown distributed peer: ${peerId}`);
+    const value = randomSecret('gvrt');
+    const issuedAt = Date.now();
+    const token = {
+        id: `dtoken-${randomUUID().slice(0, 8)}`,
+        label,
+        scopes: [...scopes],
+        issuedAt,
+        lastUsedAt: undefined,
+        rotatedAt: issuedAt,
+        revokedAt: undefined,
+        fingerprint: fingerprint(value),
+        secretHash: hashSecret(value),
+    };
+    const nextTokens = peer.tokens.map((entry) => entry.revokedAt ? entry : { ...entry, revokedAt: issuedAt });
+    nextTokens.push(token);
+    state.peers.set(peerId, {
+        ...peer,
+        status: peer.status === 'revoked' ? 'paired' : peer.status,
+        verifiedAt: issuedAt,
+        activeTokenId: token.id,
+        tokens: nextTokens,
+    });
+    return { token, value };
+}
+function updatePeerConnectionState(state, peerId, status, input = {}) {
+    const peer = state.peers.get(peerId);
+    if (!peer)
+        return null;
+    const now = Date.now();
+    const updated = {
+        ...peer,
+        status,
+        lastSeenAt: now,
+        ...(status === 'connected' ? { lastConnectedAt: now } : { lastDisconnectedAt: now }),
+        ...(input.remoteAddress ? { lastRemoteAddress: input.remoteAddress } : {}),
+    };
+    state.peers.set(peerId, updated);
+    return updated;
+}

package/dist/platform/runtime/remote/distributed-runtime-store.d.ts

@@ -0,0 +1,23 @@
+import type { DistributedPendingWork, DistributedRuntimeAuditRecord, DistributedRuntimeManagerState, DistributedRuntimePairRequest, DistributedPeerKind, DistributedPeerRecord, DistributedRuntimeWaiter } from './distributed-runtime-types.js';
+export declare function attachDistributedRuntime(state: DistributedRuntimeManagerState, input: {
+    readonly sessionBridge?: DistributedRuntimeManagerState['sessionBridge'];
+    readonly approvalBridge?: DistributedRuntimeManagerState['approvalBridge'];
+    readonly automationBridge?: DistributedRuntimeManagerState['automationBridge'];
+    readonly eventPublisher?: DistributedRuntimeManagerState['eventPublisher'];
+}): void;
+export declare function startDistributedRuntime(state: DistributedRuntimeManagerState): Promise<void>;
+export declare function listDistributedRuntimePairRequests(state: DistributedRuntimeManagerState, limit?: number): DistributedRuntimePairRequest[];
+export declare function listDistributedRuntimePeers(state: DistributedRuntimeManagerState, kind?: DistributedPeerKind, limit?: number): DistributedPeerRecord[];
+export declare function listDistributedRuntimeWork(state: DistributedRuntimeManagerState, limit?: number, peerId?: string): DistributedPendingWork[];
+export declare function listDistributedRuntimeAudit(state: DistributedRuntimeManagerState, limit?: number): DistributedRuntimeAuditRecord[];
+export declare function getDistributedRuntimeSnapshot(state: DistributedRuntimeManagerState): Record<string, unknown>;
+export declare function publishDistributedRuntimeEvent(state: DistributedRuntimeManagerState, event: string, payload: unknown): void;
+export declare function recordDistributedRuntimeAudit(state: DistributedRuntimeManagerState, record: DistributedRuntimeAuditRecord): void;
+export declare function expireDistributedPairRequests(state: DistributedRuntimeManagerState, now?: number): void;
+export declare function requeueDistributedExpiredClaims(state: DistributedRuntimeManagerState, now?: number): void;
+export declare function waitForDistributedWork(state: DistributedRuntimeManagerState, workId: string, timeoutMs: number): Promise<DistributedPendingWork | null>;
+export declare function resolveDistributedRuntimeWaiters(state: DistributedRuntimeManagerState, work: DistributedPendingWork): void;
+export declare function removeDistributedRuntimeWaiter(state: DistributedRuntimeManagerState, workId: string, resolve: DistributedRuntimeWaiter['resolve']): void;
+export declare function pruneAndPersistDistributedRuntime(state: DistributedRuntimeManagerState): Promise<void>;
+export declare function persistDistributedRuntime(state: DistributedRuntimeManagerState): Promise<void>;
+//# sourceMappingURL=distributed-runtime-store.d.ts.map

package/dist/platform/runtime/remote/distributed-runtime-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"distributed-runtime-store.d.ts","sourceRoot":"","sources":["../../../../src/platform/runtime/remote/distributed-runtime-store.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EACV,sBAAsB,EACtB,6BAA6B,EAC7B,8BAA8B,EAC9B,6BAA6B,EAE7B,mBAAmB,EACnB,qBAAqB,EACrB,wBAAwB,EACzB,MAAM,gCAAgC,CAAC;AAiBxC,wBAAgB,wBAAwB,CACtC,KAAK,EAAE,8BAA8B,EACrC,KAAK,EAAE;IACL,QAAQ,CAAC,aAAa,CAAC,EAAE,8BAA8B,CAAC,eAAe,CAAC,CAAC;IACzE,QAAQ,CAAC,cAAc,CAAC,EAAE,8BAA8B,CAAC,gBAAgB,CAAC,CAAC;IAC3E,QAAQ,CAAC,gBAAgB,CAAC,EAAE,8BAA8B,CAAC,kBAAkB,CAAC,CAAC;IAC/E,QAAQ,CAAC,cAAc,CAAC,EAAE,8BAA8B,CAAC,gBAAgB,CAAC,CAAC;CAC5E,GACA,IAAI,CAKN;AAED,wBAAsB,uBAAuB,CAAC,KAAK,EAAE,8BAA8B,GAAG,OAAO,CAAC,IAAI,CAAC,CAyBlG;AAED,wBAAgB,kCAAkC,CAChD,KAAK,EAAE,8BAA8B,EACrC,KAAK,SAAM,GACV,6BAA6B,EAAE,CAGjC;AAED,wBAAgB,2BAA2B,CACzC,KAAK,EAAE,8BAA8B,EACrC,IAAI,CAAC,EAAE,mBAAmB,EAC1B,KAAK,SAAM,GACV,qBAAqB,EAAE,CAKzB;AAED,wBAAgB,0BAA0B,CACxC,KAAK,EAAE,8BAA8B,EACrC,KAAK,SAAM,EACX,MAAM,CAAC,EAAE,MAAM,GACd,sBAAsB,EAAE,CAK1B;AAED,wBAAgB,2BAA2B,CACzC,KAAK,EAAE,8BAA8B,EACrC,KAAK,SAAM,GACV,6BAA6B,EAAE,CAEjC;AAED,wBAAgB,6BAA6B,CAAC,KAAK,EAAE,8BAA8B,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CA+B5G;AAED,wBAAgB,8BAA8B,CAAC,KAAK,EAAE,8BAA8B,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,GAAG,IAAI,CAE3H;AAED,wBAAgB,6BAA6B,CAC3C,KAAK,EAAE,8BAA8B,EACrC,MAAM,EAAE,6BAA6B,GACpC,IAAI,CAKN;AAED,wBAAgB,6BAA6B,CAAC,KAAK,EAAE,8BAA8B,EAAE,GAAG,SAAa,GAAG,IAAI,CA0B3G;AAED,wBAAgB,+BAA+B,CAAC,KAAK,EAAE,8BAA8B,EAAE,GAAG,SAAa,GAAG,IAAI,CAyC7G;AAED,wBAAsB,sBAAsB,CAC1C,KAAK,EAAE,8BAA8B,EACrC,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,sBAAsB,GAAG,IAAI,CAAC,CAcxC;AAED,wBAAgB,gCAAgC,CAAC,KAAK,EAAE,8BAA8B,EAAE,IAAI,EAAE,sBAAsB,GAAG,IAAI,CAQ1H;AAED,wBAAgB,8BAA8B,CAC5C,KAAK,EAAE,8BAA8B,EACrC,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,wBAAwB,CAAC,SAAS,CAAC,GAC3C,IAAI,CAMN;AAED,wBAAsB,iCAAiC,CAAC,KAAK,EAAE,8BAA8B,GAAG,OAAO,CAAC,IAAI,CAAC,CAkB5G;AAED,wBAAsB,yBAAyB,CAAC,KAAK,EAAE,8BAA8B,GAAG,OAAO,CAAC,IAAI,CAAC,CAOpG"}

package/dist/platform/runtime/remote/distributed-runtime-store.js

@@ -0,0 +1,238 @@
+import { normalizeAudit, normalizePairRequest, normalizePeer, normalizeWork, sanitizePairRequest, sanitizePeer, sortPairRequests, sortPeers, sortWork, } from './distributed-runtime-utils.js';
+const MAX_AUDIT = 500;
+const MAX_WORK_HISTORY = 500;
+const MAX_PAIR_REQUESTS = 250;
+export function attachDistributedRuntime(state, input) {
+    if (input.sessionBridge)
+        state.sessionBridge = input.sessionBridge;
+    if (input.approvalBridge)
+        state.approvalBridge = input.approvalBridge;
+    if (input.automationBridge)
+        state.automationBridge = input.automationBridge;
+    if (input.eventPublisher)
+        state.eventPublisher = input.eventPublisher;
+}
+export async function startDistributedRuntime(state) {
+    if (state.loaded)
+        return;
+    const snapshot = await state.store.load();
+    state.pairRequests.clear();
+    state.peers.clear();
+    state.work.clear();
+    state.audit.length = 0;
+    for (const request of snapshot?.pairRequests ?? []) {
+        const normalized = normalizePairRequest(request);
+        if (normalized)
+            state.pairRequests.set(normalized.id, normalized);
+    }
+    for (const peer of snapshot?.peers ?? []) {
+        const normalized = normalizePeer(peer);
+        if (normalized)
+            state.peers.set(normalized.id, normalized);
+    }
+    for (const item of snapshot?.work ?? []) {
+        const normalized = normalizeWork(item);
+        if (normalized)
+            state.work.set(normalized.id, normalized);
+    }
+    for (const record of snapshot?.audit ?? []) {
+        const normalized = normalizeAudit(record);
+        if (normalized)
+            state.audit.push(normalized);
+    }
+    state.loaded = true;
+    await pruneAndPersistDistributedRuntime(state);
+}
+export function listDistributedRuntimePairRequests(state, limit = 100) {
+    expireDistributedPairRequests(state);
+    return sortPairRequests(state.pairRequests.values()).slice(0, Math.max(1, limit)).map(sanitizePairRequest);
+}
+export function listDistributedRuntimePeers(state, kind, limit = 200) {
+    return sortPeers(state.peers.values())
+        .filter((peer) => !kind || peer.kind === kind)
+        .slice(0, Math.max(1, limit))
+        .map(sanitizePeer);
+}
+export function listDistributedRuntimeWork(state, limit = 200, peerId) {
+    requeueDistributedExpiredClaims(state);
+    return sortWork(state.work.values())
+        .filter((item) => !peerId || item.peerId === peerId)
+        .slice(0, Math.max(1, limit));
+}
+export function listDistributedRuntimeAudit(state, limit = 100) {
+    return state.audit.slice(0, Math.max(1, limit));
+}
+export function getDistributedRuntimeSnapshot(state) {
+    expireDistributedPairRequests(state);
+    requeueDistributedExpiredClaims(state);
+    const peers = listDistributedRuntimePeers(state, undefined, 500);
+    const work = listDistributedRuntimeWork(state, 500);
+    return {
+        capturedAt: Date.now(),
+        pairRequests: {
+            total: state.pairRequests.size,
+            pending: [...state.pairRequests.values()].filter((request) => request.status === 'pending').length,
+            approved: [...state.pairRequests.values()].filter((request) => request.status === 'approved').length,
+            entries: listDistributedRuntimePairRequests(state, 100),
+        },
+        peers: {
+            total: peers.length,
+            connected: peers.filter((peer) => peer.status === 'connected').length,
+            nodes: peers.filter((peer) => peer.kind === 'node').length,
+            devices: peers.filter((peer) => peer.kind === 'device').length,
+            entries: peers,
+        },
+        work: {
+            total: work.length,
+            queued: work.filter((item) => item.status === 'queued').length,
+            claimed: work.filter((item) => item.status === 'claimed').length,
+            completed: work.filter((item) => item.status === 'completed').length,
+            failed: work.filter((item) => item.status === 'failed').length,
+            cancelled: work.filter((item) => item.status === 'cancelled').length,
+            entries: work.slice(0, 100),
+        },
+        audit: listDistributedRuntimeAudit(state, 100),
+    };
+}
+export function publishDistributedRuntimeEvent(state, event, payload) {
+    state.eventPublisher?.(event, payload);
+}
+export function recordDistributedRuntimeAudit(state, record) {
+    state.audit.unshift(record);
+    if (state.audit.length > MAX_AUDIT) {
+        state.audit.length = MAX_AUDIT;
+    }
+}
+export function expireDistributedPairRequests(state, now = Date.now()) {
+    let changed = false;
+    for (const [requestId, request] of state.pairRequests.entries()) {
+        if (request.status === 'pending' || request.status === 'approved') {
+            if (request.expiresAt <= now) {
+                state.pairRequests.set(requestId, {
+                    ...request,
+                    status: 'expired',
+                    updatedAt: now,
+                });
+                recordDistributedRuntimeAudit(state, {
+                    id: `drt-audit-${requestId}-${now}`,
+                    action: 'pair-expired',
+                    actor: 'distributed-runtime',
+                    requestId,
+                    createdAt: now,
+                    note: request.label,
+                    metadata: {},
+                });
+                changed = true;
+            }
+        }
+    }
+    if (changed) {
+        void persistDistributedRuntime(state);
+    }
+}
+export function requeueDistributedExpiredClaims(state, now = Date.now()) {
+    let changed = false;
+    for (const [workId, item] of state.work.entries()) {
+        if (item.status !== 'claimed')
+            continue;
+        if (!item.leaseExpiresAt || item.leaseExpiresAt > now)
+            continue;
+        state.work.set(workId, {
+            ...item,
+            status: 'queued',
+            claimTokenId: undefined,
+            claimedAt: undefined,
+            leaseExpiresAt: undefined,
+            updatedAt: now,
+            metadata: {
+                ...item.metadata,
+                lastLeaseExpiryAt: now,
+            },
+        });
+        recordDistributedRuntimeAudit(state, {
+            id: `drt-audit-${workId}-${now}`,
+            action: 'work-expired',
+            actor: 'distributed-runtime',
+            peerId: item.peerId,
+            workId,
+            createdAt: now,
+            note: item.command,
+            metadata: {},
+        });
+        const peer = state.peers.get(item.peerId);
+        if (peer) {
+            state.peers.set(peer.id, {
+                ...peer,
+                status: 'disconnected',
+                lastSeenAt: now,
+                lastDisconnectedAt: now,
+            });
+        }
+        changed = true;
+    }
+    if (changed) {
+        void persistDistributedRuntime(state);
+    }
+}
+export async function waitForDistributedWork(state, workId, timeoutMs) {
+    const existing = state.work.get(workId);
+    if (existing && existing.status !== 'queued' && existing.status !== 'claimed') {
+        return existing;
+    }
+    return await new Promise((resolve) => {
+        const timer = setTimeout(() => {
+            removeDistributedRuntimeWaiter(state, workId, resolve);
+            resolve(null);
+        }, timeoutMs);
+        const bucket = state.waiters.get(workId) ?? [];
+        bucket.push({ resolve, timer });
+        state.waiters.set(workId, bucket);
+    });
+}
+export function resolveDistributedRuntimeWaiters(state, work) {
+    const bucket = state.waiters.get(work.id);
+    if (!bucket)
+        return;
+    state.waiters.delete(work.id);
+    for (const waiter of bucket) {
+        if (waiter.timer)
+            clearTimeout(waiter.timer);
+        waiter.resolve(work);
+    }
+}
+export function removeDistributedRuntimeWaiter(state, workId, resolve) {
+    const bucket = state.waiters.get(workId);
+    if (!bucket)
+        return;
+    const next = bucket.filter((waiter) => waiter.resolve !== resolve);
+    if (next.length === 0)
+        state.waiters.delete(workId);
+    else
+        state.waiters.set(workId, next);
+}
+export async function pruneAndPersistDistributedRuntime(state) {
+    expireDistributedPairRequests(state);
+    requeueDistributedExpiredClaims(state);
+    const pairRequests = sortPairRequests(state.pairRequests.values());
+    for (const request of pairRequests.slice(MAX_PAIR_REQUESTS)) {
+        state.pairRequests.delete(request.id);
+    }
+    const work = sortWork(state.work.values());
+    const keep = new Set(work
+        .filter((item) => item.status === 'queued' || item.status === 'claimed')
+        .concat(work.filter((item) => item.status !== 'queued' && item.status !== 'claimed').slice(0, MAX_WORK_HISTORY))
+        .map((item) => item.id));
+    for (const workId of [...state.work.keys()]) {
+        if (!keep.has(workId))
+            state.work.delete(workId);
+    }
+    await persistDistributedRuntime(state);
+}
+export async function persistDistributedRuntime(state) {
+    await state.store.persist({
+        pairRequests: [...state.pairRequests.values()],
+        peers: [...state.peers.values()],
+        work: [...state.work.values()],
+        audit: [...state.audit],
+    });
+}