@runtypelabs/cli 2.59.1 → 2.59.2

package/dist/chunk-Dn8eaJuu.js

@@ -0,0 +1,1042 @@
+#!/usr/bin/env node
+import { F as getCliVersion, M as Conf, P as getRuntypeHomeDir, l as normalizeApiUrl } from "./index.js";
+import { C as unknown, b as string, c as boolean, f as literal, h as object, i as _enum, m as number, s as array, u as discriminatedUnion, v as record } from "./chunk-BOpO6xE-.js";
+import { n as datetime } from "./chunk-D9ZbUnks.js";
+import chalk from "chalk";
+import fs from "node:fs";
+import path from "node:path";
+import os from "node:os";
+import { createHash, randomUUID } from "node:crypto";
+import { setTimeout as setTimeout$1 } from "node:timers/promises";
+import WebSocket from "ws";
+object({
+	audience: literal("runtype-device-relay"),
+	deviceId: string().min(1).max(128),
+	connectionId: string().min(1).max(128),
+	nonce: string().min(16).max(128),
+	issuedAt: number().int().nonnegative(),
+	expiresAt: number().int().positive()
+}).strict();
+new TextEncoder();
+function bytesToBase64Url(bytes) {
+	let binary = "";
+	for (const byte of bytes) binary += String.fromCharCode(byte);
+	return btoa(binary).replace(/\+/gu, "-").replace(/\//gu, "_").replace(/=+$/u, "");
+}
+function base64UrlToBytes(value) {
+	if (!/^[A-Za-z0-9_-]+$/u.test(value)) return null;
+	const padded = value.replace(/-/gu, "+").replace(/_/gu, "/") + "=".repeat((4 - value.length % 4) % 4);
+	try {
+		const binary = atob(padded);
+		return Uint8Array.from(binary, (character) => character.charCodeAt(0));
+	} catch {
+		return null;
+	}
+}
+// ../device-bridge/src/device-identity.ts
+const encoder = new TextEncoder();
+function toArrayBuffer(bytes) {
+	const copy = new Uint8Array(bytes.byteLength);
+	copy.set(bytes);
+	return copy.buffer;
+}
+function exportedKeyBytes(value) {
+	if (!(value instanceof ArrayBuffer)) throw new Error("Expected a binary key export");
+	return new Uint8Array(value);
+}
+/**
+* Builds the exact string a device signs to open a relay connection.
+* Format: `runtype-device-connect-v1`, device id, timestamp, and nonce, separated by newlines.
+*/
+function deviceConnectionSignaturePayload(input) {
+	return `runtype-device-connect-v1\n${input.deviceId}\n${input.timestamp}\n${input.nonce}`;
+}
+function requireCryptoKeyPair(value) {
+	if ("publicKey" in value && "privateKey" in value) return value;
+	throw new Error("Ed25519 identity must be a key pair");
+}
+async function generateDeviceIdentity() {
+	const keyPair = requireCryptoKeyPair(await crypto.subtle.generateKey("Ed25519", true, ["sign", "verify"]));
+	const rawPublicKey = exportedKeyBytes(await crypto.subtle.exportKey("raw", keyPair.publicKey));
+	if (rawPublicKey.byteLength !== 32) throw new Error("Ed25519 public key must be 32 bytes");
+	return {
+		keyPair,
+		publicKey: bytesToBase64Url(rawPublicKey)
+	};
+}
+async function exportDevicePrivateKey(privateKey) {
+	return bytesToBase64Url(exportedKeyBytes(await crypto.subtle.exportKey("pkcs8", privateKey)));
+}
+async function importDevicePrivateKey(privateKey) {
+	const pkcs8 = base64UrlToBytes(privateKey);
+	if (!pkcs8) throw new Error("Device private key must be base64url PKCS8");
+	return crypto.subtle.importKey("pkcs8", toArrayBuffer(pkcs8), { name: "Ed25519" }, false, ["sign"]);
+}
+async function signDeviceConnectionChallenge(input) {
+	const signature = new Uint8Array(await crypto.subtle.sign("Ed25519", input.privateKey, encoder.encode(deviceConnectionSignaturePayload({
+		deviceId: input.deviceId,
+		timestamp: input.timestamp,
+		nonce: input.nonce
+	}))));
+	if (signature.byteLength !== 64) throw new Error("Ed25519 signature must be 64 bytes");
+	return bytesToBase64Url(signature);
+}
+const DEVICE_MAX_FRAME_BYTES = 1048576;
+const identifierSchema = string().min(1).max(128);
+const isoDateSchema = datetime({ offset: true });
+const jsonObjectSchema = record(string(), unknown());
+const devicePlatformSchema = _enum(["macos", "cli"]);
+const devicePermissionStateSchema = _enum([
+	"granted",
+	"denied",
+	"not_determined",
+	"restricted",
+	"unavailable"
+]);
+const devicePluginHealthSchema = _enum([
+	"healthy",
+	"degraded",
+	"unavailable",
+	"disabled"
+]);
+const deviceToolSchema = object({
+	name: identifierSchema.regex(/^[a-z][a-z0-9_]*$/),
+	title: string().min(1).max(120),
+	description: string().min(1).max(2e3),
+	inputSchema: jsonObjectSchema,
+	sideEffect: boolean().default(false)
+}).strict();
+const devicePluginManifestSchema = object({
+	id: identifierSchema.regex(/^[a-z][a-z0-9_-]*$/),
+	displayName: string().min(1).max(120),
+	version: string().min(1).max(64),
+	health: devicePluginHealthSchema,
+	statusMessage: string().max(500).optional(),
+	permissions: record(string(), devicePermissionStateSchema).default({}),
+	tools: array(deviceToolSchema).max(50)
+}).strict();
+const deviceCapabilityManifestSchema = object({
+	deviceId: identifierSchema,
+	generatedAt: isoDateSchema,
+	plugins: array(devicePluginManifestSchema).max(20)
+}).strict().superRefine((manifest, ctx) => {
+	const toolNames = /* @__PURE__ */ new Set();
+	let toolCount = 0;
+	for (const plugin of manifest.plugins) for (const tool of plugin.tools) {
+		toolCount++;
+		if (toolNames.has(tool.name)) ctx.addIssue({
+			code: "custom",
+			message: `Duplicate device tool name: ${tool.name}`,
+			path: ["plugins"]
+		});
+		toolNames.add(tool.name);
+	}
+	if (toolCount > 50) ctx.addIssue({
+		code: "custom",
+		message: `Device manifests may advertise at most 50 tools`,
+		path: ["plugins"]
+	});
+});
+const deviceErrorCodeSchema = _enum([
+	"DEVICE_OFFLINE",
+	"DEVICE_REVOKED",
+	"DEVICE_BUSY",
+	"PLUGIN_UNAVAILABLE",
+	"PERMISSION_DENIED",
+	"MESSAGES_NOT_READY",
+	"APP_VERSION_UNSUPPORTED",
+	"PROTOCOL_VERSION_UNSUPPORTED",
+	"REQUEST_EXPIRED",
+	"AMBIGUOUS_SIDE_EFFECT",
+	"POLICY_DENIED",
+	"TOOL_NOT_FOUND",
+	"INVALID_REQUEST",
+	"DUPLICATE_INVOCATION",
+	"INTERNAL_ERROR"
+]);
+const deviceErrorSchema = object({
+	code: deviceErrorCodeSchema,
+	message: string().min(1).max(1e3),
+	retryable: boolean(),
+	details: jsonObjectSchema.optional()
+}).strict();
+const deviceInvocationSchema = object({
+	id: identifierSchema,
+	idempotencyKey: string().min(16).max(256),
+	toolName: identifierSchema,
+	sideEffect: boolean(),
+	arguments: jsonObjectSchema,
+	requestedAt: isoDateSchema,
+	deadline: isoDateSchema
+}).strict();
+const deviceInvocationResultSchema = object({
+	invocationId: identifierSchema,
+	status: _enum([
+		"success",
+		"error",
+		"ambiguous"
+	]),
+	completedAt: isoDateSchema,
+	output: unknown().optional(),
+	error: deviceErrorSchema.optional()
+}).strict().superRefine((result, ctx) => {
+	if (result.status === "success" && result.error) ctx.addIssue({
+		code: "custom",
+		message: "Successful results cannot include an error"
+	});
+	if (result.status !== "success" && !result.error) ctx.addIssue({
+		code: "custom",
+		message: "Non-success results must include an error"
+	});
+});
+const protocolEnvelopeSchema = object({ protocolVersion: literal(1) });
+const relayToDeviceMessageSchema = discriminatedUnion("type", [
+	protocolEnvelopeSchema.extend({
+		type: literal("invoke"),
+		invocation: deviceInvocationSchema
+	}).strict(),
+	protocolEnvelopeSchema.extend({
+		type: literal("cancel"),
+		invocationId: identifierSchema,
+		reason: string().max(500).optional()
+	}).strict(),
+	protocolEnvelopeSchema.extend({
+		type: literal("event_ack"),
+		eventId: identifierSchema
+	}).strict(),
+	protocolEnvelopeSchema.extend({
+		type: literal("shutdown"),
+		reason: _enum([
+			"revoked",
+			"replaced",
+			"maintenance",
+			"unsupported_version"
+		])
+	}).strict()
+]);
+const deviceToRelayMessageSchema = discriminatedUnion("type", [
+	protocolEnvelopeSchema.extend({
+		type: literal("hello"),
+		deviceId: identifierSchema,
+		connectionId: identifierSchema,
+		platform: devicePlatformSchema,
+		appVersion: string().min(1).max(64),
+		connectedAt: isoDateSchema
+	}).strict(),
+	protocolEnvelopeSchema.extend({
+		type: literal("capabilities"),
+		manifest: deviceCapabilityManifestSchema
+	}).strict(),
+	protocolEnvelopeSchema.extend({
+		type: literal("heartbeat"),
+		sentAt: isoDateSchema
+	}).strict(),
+	protocolEnvelopeSchema.extend({
+		type: literal("invocation_result"),
+		result: deviceInvocationResultSchema
+	}).strict(),
+	protocolEnvelopeSchema.extend({
+		type: literal("event"),
+		eventId: identifierSchema,
+		pluginId: identifierSchema,
+		eventName: identifierSchema,
+		occurredAt: isoDateSchema,
+		payload: jsonObjectSchema
+	}).strict()
+]);
+object({
+	deviceId: identifierSchema,
+	online: boolean(),
+	lastSeenAt: isoDateSchema.optional(),
+	connectionId: identifierSchema.optional(),
+	appVersion: string().max(64).optional(),
+	protocolVersion: number().int().positive().optional(),
+	manifest: deviceCapabilityManifestSchema.optional()
+}).strict();
+function deviceError(code, message, retryable, details) {
+	return deviceErrorSchema.parse({
+		code,
+		message,
+		retryable,
+		details
+	});
+}
+// ../device-bridge/src/localhost-http.ts
+const LOCALHOST_HTTP_TOOL_NAME = "localhost_http_call";
+const LOCALHOST_HTTP_MAX_BODY_BYTES = DEVICE_MAX_FRAME_BYTES;
+const LOOPBACK_HOSTS = /* @__PURE__ */ new Set([
+	"127.0.0.1",
+	"localhost",
+	"::1"
+]);
+const localhostHttpMethodSchema = _enum([
+	"GET",
+	"POST",
+	"PUT",
+	"PATCH",
+	"DELETE",
+	"HEAD"
+]);
+const localhostHttpCallArgsSchema = object({
+	method: localhostHttpMethodSchema,
+	url: string().url(),
+	headers: record(string(), string().max(8192)).optional(),
+	allowedAuthHeaderName: string().regex(/^[!#$%&'*+.^_`|~0-9A-Za-z-]+$/).max(256).optional(),
+	body: string().max(LOCALHOST_HTTP_MAX_BODY_BYTES).optional(),
+	timeoutMs: number().int().min(100).max(3e5).optional()
+}).strict();
+const localhostHttpCallResultSchema = object({
+	status: number().int().min(100).max(599),
+	statusText: string().max(120),
+	headers: record(string(), string()),
+	body: string().max(LOCALHOST_HTTP_MAX_BODY_BYTES)
+}).strict();
+var LocalhostHttpCallError = class extends Error {
+	code;
+	constructor(message, code) {
+		super(message);
+		this.code = code;
+		this.name = "LocalhostHttpCallError";
+	}
+};
+function parseLoopbackHttpUrl(urlString) {
+	let url;
+	try {
+		url = new URL(urlString);
+	} catch {
+		throw new LocalhostHttpCallError("URL is not valid", "INVALID_REQUEST");
+	}
+	if (url.protocol !== "http:" && url.protocol !== "https:") throw new LocalhostHttpCallError("Only http and https loopback URLs are allowed", "NOT_LOOPBACK");
+	if (url.username || url.password) throw new LocalhostHttpCallError("Loopback URLs cannot include credentials", "INVALID_REQUEST");
+	const hostname = url.hostname.replace(/^\[|\]$/g, "").toLowerCase();
+	if (!LOOPBACK_HOSTS.has(hostname)) throw new LocalhostHttpCallError("Device HTTP calls may only target 127.0.0.1, localhost, or ::1", "NOT_LOOPBACK");
+	return url;
+}
+function normalizedLoopbackPort(url) {
+	if (url.port !== "") return url.port;
+	return url.protocol === "https:" ? "443" : "80";
+}
+/**
+* Reports whether a device HTTP call may be forwarded to the listen target.
+* Loopback host aliases compare equal. A URL that is not loopback HTTP is refused.
+*/
+function isAllowedListenTarget(requestUrl, forwardTo) {
+	try {
+		const request = parseLoopbackHttpUrl(requestUrl);
+		const target = parseLoopbackHttpUrl(forwardTo);
+		return request.protocol === target.protocol && normalizedLoopbackPort(request) === normalizedLoopbackPort(target);
+	} catch (error) {
+		if (error instanceof LocalhostHttpCallError) return false;
+		throw error;
+	}
+}
+const FORWARDED_REQUEST_HEADERS = /* @__PURE__ */ new Set([
+	"accept",
+	"authorization",
+	"a2a-version",
+	"content-type",
+	"x-api-key",
+	"x-runtype-identity"
+]);
+const BLOCKED_AUTH_HEADERS = /* @__PURE__ */ new Set([
+	"host",
+	"cookie",
+	"connection",
+	"content-length",
+	"transfer-encoding",
+	"upgrade",
+	"proxy-authorization",
+	"proxy-authenticate",
+	"te",
+	"trailer",
+	"keep-alive"
+]);
+function forwardedRequestHeaders(headers, allowedAuthHeaderName) {
+	const out = new Headers();
+	if (!headers) return out;
+	for (const [name, value] of Object.entries(headers)) {
+		const normalized = name.toLowerCase();
+		const configuredAuth = normalized === allowedAuthHeaderName?.toLowerCase() && !BLOCKED_AUTH_HEADERS.has(normalized) && !normalized.startsWith("sec-") && !normalized.startsWith("proxy-");
+		if (!FORWARDED_REQUEST_HEADERS.has(normalized) && !configuredAuth) continue;
+		out.set(name, value);
+	}
+	return out;
+}
+async function readResponseBody(response) {
+	if (!response.body) return "";
+	const reader = response.body.getReader();
+	const decoder = new TextDecoder();
+	const chunks = [];
+	let bytes = 0;
+	try {
+		while (true) {
+			const { done, value } = await reader.read();
+			if (done) break;
+			bytes += value.byteLength;
+			if (bytes > LOCALHOST_HTTP_MAX_BODY_BYTES) {
+				await reader.cancel();
+				throw new LocalhostHttpCallError(`Response body exceeds ${LOCALHOST_HTTP_MAX_BODY_BYTES} bytes`, "BODY_TOO_LARGE");
+			}
+			chunks.push(decoder.decode(value, { stream: true }));
+		}
+		chunks.push(decoder.decode());
+		return chunks.join("");
+	} finally {
+		reader.releaseLock();
+	}
+}
+async function executeLocalhostHttpCall(args, fetchImpl = fetch, signal) {
+	const url = parseLoopbackHttpUrl(args.url);
+	const timeoutMs = args.timeoutMs ?? 3e4;
+	const response = await fetchImpl(url, {
+		method: args.method,
+		headers: forwardedRequestHeaders(args.headers, args.allowedAuthHeaderName),
+		body: args.method === "GET" || args.method === "HEAD" ? void 0 : args.body,
+		signal: signal ? AbortSignal.any([signal, AbortSignal.timeout(timeoutMs)]) : AbortSignal.timeout(timeoutMs),
+		redirect: "error"
+	});
+	const body = await readResponseBody(response);
+	const headers = {};
+	response.headers.forEach((value, key) => {
+		headers[key] = value;
+	});
+	return localhostHttpCallResultSchema.parse({
+		status: response.status,
+		statusText: response.statusText,
+		headers,
+		body
+	});
+}
+// src/lib/device-listen-identity.ts
+const DEVICE_LISTEN_CONFIG = "device-listen";
+function isRecord$1(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function copyIdentity(identity) {
+	return {
+		deviceId: identity.deviceId,
+		name: identity.name,
+		publicKey: identity.publicKey,
+		privateKey: identity.privateKey
+	};
+}
+function readIdentity(value) {
+	if (!isRecord$1(value)) throw new Error("Stored device identity is invalid");
+	const { deviceId, name, publicKey, privateKey } = value;
+	if (deviceId !== null && (typeof deviceId !== "string" || deviceId.length === 0)) throw new Error("Stored device identity is invalid");
+	if (typeof name !== "string" || name.trim().length === 0 || name.length > 120) throw new Error("Stored device identity is invalid");
+	if (typeof publicKey !== "string" || !/^[A-Za-z0-9_-]{43}$/u.test(publicKey)) throw new Error("Stored device identity is invalid");
+	if (typeof privateKey !== "string" || !/^[A-Za-z0-9_-]{40,}$/u.test(privateKey)) throw new Error("Stored device identity is invalid");
+	return {
+		deviceId,
+		name,
+		publicKey,
+		privateKey
+	};
+}
+/** Hostname shown in Runtype until the operator passes --name. */
+function resolveDeviceListenName(requested) {
+	const explicit = requested?.trim();
+	if (explicit) return explicit.slice(0, 120);
+	const hostname = os.hostname().trim();
+	if (!hostname) return "This computer";
+	return hostname.slice(0, 120);
+}
+async function createDeviceListenIdentity(name) {
+	const { keyPair, publicKey } = await generateDeviceIdentity();
+	return {
+		deviceId: null,
+		name,
+		publicKey,
+		privateKey: await exportDevicePrivateKey(keyPair.privateKey)
+	};
+}
+async function signDeviceListenChallenge(identity, input) {
+	return signDeviceConnectionChallenge({
+		privateKey: await importDevicePrivateKey(identity.privateKey),
+		...input
+	});
+}
+function deviceListenEncryptionKey() {
+	const hostname = os.hostname();
+	const username = os.userInfo().username;
+	return createHash("sha256").update(`runtype-device-listen-${hostname}-${username}`).digest("hex");
+}
+function isCorruptStoreError(error) {
+	if (error instanceof SyntaxError) return true;
+	const message = error instanceof Error ? error.message : String(error);
+	return /JSON|bad decrypt|authenticate data|unable to authenticate/iu.test(message);
+}
+function createConfig(cwd, encryptionKey, configName) {
+	return new Conf({
+		projectName: "runtype-cli",
+		projectSuffix: "",
+		configName,
+		cwd,
+		encryptionKey,
+		defaults: { identities: {} }
+	});
+}
+function openConfig(cwd, encryptionKey, configName) {
+	try {
+		return createConfig(cwd, encryptionKey, configName);
+	} catch (error) {
+		if (!isCorruptStoreError(error)) throw error;
+		const filePath = path.join(cwd, `${configName}.json`);
+		if (fs.existsSync(filePath)) fs.unlinkSync(filePath);
+		return createConfig(cwd, encryptionKey, configName);
+	}
+}
+function createDeviceListenIdentityStore(options) {
+	const config = openConfig(options.cwd ?? getRuntypeHomeDir(), options.encryptionKey ?? deviceListenEncryptionKey(), workspaceConfigName(options.workspace, options.namespace));
+	return {
+		async load(apiUrl) {
+			const value = (config.get("identities") ?? {})[normalizeApiUrl(apiUrl)];
+			if (value === void 0) return null;
+			return readIdentity(value);
+		},
+		async save(apiUrl, identity) {
+			const key = normalizeApiUrl(apiUrl);
+			const identities = {
+				...config.get("identities"),
+				[key]: copyIdentity(readIdentity(identity))
+			};
+			config.set("identities", identities);
+		}
+	};
+}
+function workspaceConfigName(workspace, namespace) {
+	if (!workspace.userId) throw new Error("Authenticated device owner is required");
+	const scope = createHash("sha256").update(JSON.stringify(namespace ? [
+		workspace.userId,
+		workspace.orgId,
+		namespace
+	] : [workspace.userId, workspace.orgId])).digest("hex");
+	return `${DEVICE_LISTEN_CONFIG}-${scope}`;
+}
+function frameText(data) {
+	if (typeof data === "string") return data;
+	if (Buffer.isBuffer(data)) return data.toString("utf8");
+	if (data instanceof ArrayBuffer) return Buffer.from(data).toString("utf8");
+	return Buffer.concat(data).toString("utf8");
+}
+function closeReason(reason) {
+	return typeof reason === "string" ? reason : reason.toString("utf8");
+}
+function localhostFailureCode(error) {
+	if (error.code === "NOT_LOOPBACK") return "POLICY_DENIED";
+	if (error.code === "REQUEST_EXPIRED") return "REQUEST_EXPIRED";
+	if (error.code === "INTERNAL_ERROR") return "INTERNAL_ERROR";
+	return "INVALID_REQUEST";
+}
+function resultMessage(invocationId, status, output, error) {
+	return deviceToRelayMessageSchema.parse({
+		type: "invocation_result",
+		protocolVersion: 1,
+		result: {
+			invocationId,
+			status,
+			completedAt: (/* @__PURE__ */ new Date()).toISOString(),
+			...status === "success" ? { output } : { error }
+		}
+	});
+}
+function failureMessage(invocationId, code, message) {
+	return resultMessage(invocationId, "error", void 0, deviceError(code, message.slice(0, 1e3), false));
+}
+async function executeInvocation(invocation, forwardTo, fetchImpl, signal) {
+	if (invocation.toolName !== "localhost_http_call") return failureMessage(invocation.id, "TOOL_NOT_FOUND", `Tool ${invocation.toolName} is not available`);
+	const deadline = Date.parse(invocation.deadline);
+	if (Number.isNaN(deadline) || deadline <= Date.now()) return failureMessage(invocation.id, "REQUEST_EXPIRED", "Device invocation expired before local execution");
+	const parsed = localhostHttpCallArgsSchema.safeParse(invocation.arguments);
+	if (!parsed.success) return failureMessage(invocation.id, "INVALID_REQUEST", "localhost_http_call arguments are invalid");
+	if (!isAllowedListenTarget(parsed.data.url, forwardTo)) return failureMessage(invocation.id, "POLICY_DENIED", "That URL is outside the forwarded loopback port");
+	try {
+		const timeoutMs = Math.min(parsed.data.timeoutMs ?? 3e4, deadline - Date.now());
+		if (timeoutMs <= 0) return failureMessage(invocation.id, "REQUEST_EXPIRED", "Device invocation expired");
+		const output = await executeLocalhostHttpCall({
+			...parsed.data,
+			timeoutMs
+		}, fetchImpl, signal);
+		return resultMessage(invocation.id, "success", output);
+	} catch (error) {
+		if (error instanceof LocalhostHttpCallError) return failureMessage(invocation.id, localhostFailureCode(error), error.message);
+		const message = error instanceof Error ? error.message : "The localhost request failed";
+		return failureMessage(invocation.id, "INTERNAL_ERROR", message || "The localhost request failed");
+	}
+}
+function connectRelaySocket(relayUrl, headers) {
+	const socket = new WebSocket(relayUrl, { headers });
+	return {
+		send(data) {
+			socket.send(data);
+		},
+		close(code, reason) {
+			socket.close(code, reason);
+		},
+		terminate() {
+			socket.terminate();
+		},
+		onOpen(listener) {
+			socket.on("open", listener);
+		},
+		onMessage(listener) {
+			socket.on("message", (data) => listener(data));
+		},
+		onClose(listener) {
+			socket.on("close", (code, reason) => listener(code, reason));
+		},
+		onError(listener) {
+			socket.on("error", listener);
+		}
+	};
+}
+function startDeviceListenSession(options) {
+	const fetchImpl = options.fetchImpl ?? fetch;
+	const socket = (options.socketFactory ?? connectRelaySocket)(options.relayUrl, { Authorization: `Bearer ${options.token}` });
+	let settled = false;
+	let terminal = null;
+	let heartbeat = null;
+	let closeTimer;
+	const active = /* @__PURE__ */ new Map();
+	const abortActive = () => {
+		for (const controller of active.values()) controller.abort();
+		active.clear();
+	};
+	let resolveClosed = () => {};
+	const closed = new Promise((resolve) => {
+		resolveClosed = resolve;
+	});
+	const finish = (code, reason, cleanupFailed = false) => {
+		if (settled) return;
+		settled = true;
+		abortActive();
+		if (heartbeat) clearInterval(heartbeat);
+		if (closeTimer) clearTimeout(closeTimer);
+		heartbeat = null;
+		resolveClosed({
+			code,
+			reason,
+			intent: terminal ?? "unexpected",
+			...cleanupFailed ? { cleanupFailed: true } : {}
+		});
+		try {
+			socket.close(code, reason);
+		} catch {
+			return;
+		}
+	};
+	const send = (message) => {
+		socket.send(JSON.stringify(deviceToRelayMessageSchema.parse(message)));
+	};
+	const requestClose = (code, reason) => {
+		if (settled || closeTimer) return;
+		abortActive();
+		closeTimer = setTimeout(() => {
+			try {
+				socket.terminate();
+			} catch {
+				finish(1011, "Relay socket termination failed", true);
+				return;
+			}
+			finish(code, reason);
+		}, 500);
+		try {
+			socket.close(code, reason);
+		} catch {
+			try {
+				socket.terminate();
+			} catch {
+				finish(1011, "Relay socket termination failed", true);
+				return;
+			}
+			finish(code, reason);
+		}
+	};
+	const localhostManifest = () => ({
+		deviceId: options.deviceId,
+		generatedAt: (/* @__PURE__ */ new Date()).toISOString(),
+		plugins: [{
+			id: "localhost-http",
+			displayName: "Localhost HTTP",
+			version: "1.0.0",
+			health: "healthy",
+			permissions: {},
+			tools: [{
+				name: LOCALHOST_HTTP_TOOL_NAME,
+				title: "Call a loopback HTTP origin",
+				description: "Fetch a 127.0.0.1, localhost, or ::1 URL from the paired device. Used to call a local agent.",
+				inputSchema: {
+					type: "object",
+					properties: {
+						method: {
+							type: "string",
+							enum: [
+								"GET",
+								"POST",
+								"PUT",
+								"PATCH",
+								"DELETE",
+								"HEAD"
+							]
+						},
+						url: { type: "string" },
+						headers: {
+							type: "object",
+							additionalProperties: { type: "string" }
+						},
+						body: { type: "string" },
+						timeoutMs: {
+							type: "integer",
+							minimum: 100,
+							maximum: 3e5
+						},
+						allowedAuthHeaderName: { type: "string" }
+					},
+					required: ["method", "url"],
+					additionalProperties: false
+				},
+				sideEffect: true
+			}]
+		}]
+	});
+	socket.onOpen(() => {
+		if (settled || closeTimer) return;
+		try {
+			send({
+				type: "hello",
+				protocolVersion: 1,
+				deviceId: options.deviceId,
+				connectionId: options.connectionId,
+				platform: "cli",
+				appVersion: options.appVersion,
+				connectedAt: (/* @__PURE__ */ new Date()).toISOString()
+			});
+			send({
+				type: "capabilities",
+				protocolVersion: 1,
+				manifest: localhostManifest()
+			});
+			heartbeat = setInterval(() => {
+				if (settled) return;
+				try {
+					send({
+						type: "heartbeat",
+						protocolVersion: 1,
+						sentAt: (/* @__PURE__ */ new Date()).toISOString()
+					});
+				} catch {
+					finish(1011, "Heartbeat failed");
+				}
+			}, options.heartbeatIntervalMs ?? 2e4);
+			options.onListening?.();
+		} catch (error) {
+			finish(1011, error instanceof Error ? error.message : "Device hello failed");
+		}
+	});
+	socket.onMessage((data) => {
+		handleFrame(data).catch(() => {
+			finish(1011, "Device session failed");
+		});
+	});
+	socket.onClose((code, reason) => {
+		finish(code, closeReason(reason));
+	});
+	socket.onError(() => {
+		requestClose(1011, "Relay socket error");
+	});
+	async function handleFrame(data) {
+		let parsed;
+		try {
+			parsed = relayToDeviceMessageSchema.safeParse(JSON.parse(frameText(data)));
+		} catch {
+			return;
+		}
+		if (!parsed.success || settled) return;
+		if (parsed.data.type === "shutdown") {
+			abortActive();
+			terminal = parsed.data.reason === "revoked" ? "revoked" : terminal;
+			requestClose(1e3, parsed.data.reason);
+			return;
+		}
+		if (parsed.data.type === "cancel") {
+			active.get(parsed.data.invocationId)?.abort();
+			return;
+		}
+		if (parsed.data.type !== "invoke") return;
+		const invocation = parsed.data.invocation;
+		if (active.has(invocation.id)) return;
+		const controller = new AbortController();
+		active.set(invocation.id, controller);
+		try {
+			const message = await executeInvocation(invocation, options.forwardTo, fetchImpl, controller.signal);
+			if (!settled && !controller.signal.aborted) send(message);
+		} finally {
+			active.delete(invocation.id);
+		}
+	}
+	return {
+		closed,
+		close(code = 1e3, reason = "Interrupted") {
+			if (settled) return;
+			terminal = terminal ?? "stop";
+			requestClose(code, reason);
+		}
+	};
+}
+// src/lib/device-listen.ts
+const DEVICE_LISTEN_RECONNECT_DELAYS_MS = [
+	250,
+	500,
+	1e3
+];
+var DeviceListenError = class extends Error {
+	constructor(message) {
+		super(message);
+		this.name = "DeviceListenError";
+	}
+};
+var DeviceListenCleanupError = class extends DeviceListenError {};
+function isRecord(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function httpStatus(error) {
+	if (!isRecord(error) || typeof error.statusCode !== "number") return null;
+	return error.statusCode;
+}
+function unwrapData(response) {
+	if (!isRecord(response) || !("data" in response)) throw new DeviceListenError("Runtype API returned an invalid device response");
+	return response.data;
+}
+function requireDeviceId(value) {
+	if (!isRecord(value) || typeof value.id !== "string" || value.id.length === 0) throw new DeviceListenError("Runtype API returned an invalid device response");
+	return value.id;
+}
+function readRelayConnection(value) {
+	if (!isRecord(value) || typeof value.connectionId !== "string" || value.connectionId.length === 0 || typeof value.token !== "string" || value.token.length === 0 || typeof value.relayUrl !== "string" || value.relayUrl.length === 0) throw new DeviceListenError("Runtype API returned an invalid device response");
+	return {
+		connectionId: value.connectionId,
+		token: value.token,
+		relayUrl: value.relayUrl
+	};
+}
+async function untilStopped(work, signal) {
+	let abort = () => {};
+	const stopped = new Promise((_, reject) => {
+		abort = () => reject(new DeviceListenError("Device listener stopped"));
+		signal.addEventListener("abort", abort, { once: true });
+		if (signal.aborted) abort();
+	});
+	try {
+		return await Promise.race([work, stopped]);
+	} finally {
+		signal.removeEventListener("abort", abort);
+	}
+}
+function installProcessSignalHandlers(stop) {
+	const onStop = () => stop();
+	process.on("SIGINT", onStop);
+	process.on("SIGTERM", onStop);
+	return () => {
+		process.off("SIGINT", onStop);
+		process.off("SIGTERM", onStop);
+	};
+}
+function deviceListenAppVersion(version = getCliVersion()) {
+	const value = `runtype-cli/${version}`;
+	return value.length <= 64 ? value : value.slice(0, 64);
+}
+function assertListenForwardTarget(value) {
+	if (!value?.trim()) throw new DeviceListenError("Missing required option --forward-to <url>");
+	try {
+		const url = parseLoopbackHttpUrl(value.trim());
+		return `${url.protocol}//${url.host}`;
+	} catch (error) {
+		throw new DeviceListenError(error instanceof Error ? error.message : String(error));
+	}
+}
+function printListening(deviceId, forwardTo) {
+	console.log("Listening for this workspace");
+	console.log(`  Device   ${deviceId}`);
+	console.log(`  Forward  ${forwardTo}`);
+	console.log("  Only this Runtype workspace can call this process.");
+	console.log("  Keep this running. Ctrl-C to stop.");
+}
+async function pairIdentity(client, identity, appVersion) {
+	const session = unwrapData(await client.post("/devices/pairing-sessions", {}));
+	if (!isRecord(session) || typeof session.code !== "string" || session.code.length === 0) throw new DeviceListenError("Runtype API returned an invalid device response");
+	identity.deviceId = requireDeviceId(unwrapData(await client.post("/devices/pair", {
+		code: session.code,
+		name: identity.name,
+		platform: "cli",
+		publicKey: identity.publicKey,
+		appVersion
+	})));
+}
+async function requestConnectionToken(client, identity, nonce, timestamp) {
+	if (!identity.deviceId) throw new DeviceListenError("Device is not paired");
+	const signature = await signDeviceListenChallenge(identity, {
+		deviceId: identity.deviceId,
+		timestamp,
+		nonce
+	});
+	return readRelayConnection(unwrapData(await client.post(`/devices/${encodeURIComponent(identity.deviceId)}/connection-token`, {
+		timestamp,
+		nonce,
+		signature
+	})));
+}
+async function verifyStoredDeviceOwnership(client, deviceId) {
+	let response;
+	try {
+		response = await client.get(`/devices/${encodeURIComponent(deviceId)}`);
+	} catch (error) {
+		if (httpStatus(error) === 403 || httpStatus(error) === 404) throw new DeviceListenError("Cannot reuse this device in the authenticated workspace. Verify ownership and DEVICES:READ permission.");
+		throw error;
+	}
+	if (requireDeviceId(unwrapData(response)) !== deviceId) throw new DeviceListenError("Runtype API returned a different device during ownership verification");
+}
+async function recoverRevokedIdentity(client, store, apiUrl, identity, appVersion) {
+	const rotated = await createDeviceListenIdentity(identity.name);
+	identity.publicKey = rotated.publicKey;
+	identity.privateKey = rotated.privateKey;
+	identity.deviceId = null;
+	await store.save(apiUrl, identity);
+	await pairIdentity(client, identity, appVersion);
+	await store.save(apiUrl, identity);
+}
+async function obtainConnection(client, store, apiUrl, identity, appVersion, createNonce, now, repaired, recoverRevoked = true) {
+	if (!identity.deviceId) {
+		await pairIdentity(client, identity, appVersion);
+		await store.save(apiUrl, identity);
+	} else await verifyStoredDeviceOwnership(client, identity.deviceId);
+	try {
+		return await requestConnectionToken(client, identity, createNonce(), now());
+	} catch (error) {
+		if (httpStatus(error) === 503) throw new DeviceListenError("Device relay is not configured");
+		if (httpStatus(error) !== 410) throw error;
+		if (!recoverRevoked || repaired.done) throw new DeviceListenError("This device was revoked");
+		repaired.done = true;
+		await recoverRevokedIdentity(client, store, apiUrl, identity, appVersion);
+		try {
+			return await requestConnectionToken(client, identity, createNonce(), now());
+		} catch (retryError) {
+			if (httpStatus(retryError) === 503) throw new DeviceListenError("Device relay is not configured");
+			if (httpStatus(retryError) === 410) throw new DeviceListenError("This device was revoked");
+			throw retryError;
+		}
+	}
+}
+async function runDeviceListen(options) {
+	const forwardTo = assertListenForwardTarget(options.forwardTo);
+	const stopped = new AbortController();
+	const sleep = options.sleep ?? ((milliseconds) => setTimeout$1(milliseconds, void 0, { signal: stopped.signal }));
+	const setExitCode = options.setExitCode ?? ((code) => {
+		process.exitCode = code;
+	});
+	const reconnectDelays = options.reconnectDelaysMs ?? DEVICE_LISTEN_RECONNECT_DELAYS_MS;
+	const createNonce = options.createNonce ?? (() => randomUUID());
+	const now = options.now ?? (() => Date.now());
+	const appVersion = options.appVersion ?? deviceListenAppVersion();
+	const runtime = {
+		stopping: false,
+		active: null
+	};
+	const requestStop = () => {
+		runtime.stopping = true;
+		stopped.abort();
+		runtime.active?.close(1e3, "Interrupted");
+	};
+	options.signal?.addEventListener("abort", requestStop, { once: true });
+	if (options.signal?.aborted) requestStop();
+	const uninstall = (options.installSignalHandlers ?? installProcessSignalHandlers)(requestStop);
+	const repaired = { done: false };
+	let announcedJson = false;
+	let reconnects = 0;
+	try {
+		let identity = await options.identityStore.load(options.apiUrl);
+		if (!identity) {
+			identity = await createDeviceListenIdentity(resolveDeviceListenName(options.name));
+			await options.identityStore.save(options.apiUrl, identity);
+		} else if (options.name?.trim()) {
+			identity = {
+				...identity,
+				name: resolveDeviceListenName(options.name)
+			};
+			await options.identityStore.save(options.apiUrl, identity);
+		}
+		while (!runtime.stopping) {
+			options.onStatus?.("connecting");
+			const credentials = await obtainConnection(options.client, options.identityStore, options.apiUrl, identity, appVersion, createNonce, now, repaired, options.recoverRevokedIdentity);
+			if (runtime.stopping || !identity.deviceId) break;
+			const deviceId = identity.deviceId;
+			const session = startDeviceListenSession({
+				relayUrl: credentials.relayUrl,
+				token: credentials.token,
+				deviceId,
+				connectionId: credentials.connectionId,
+				forwardTo,
+				appVersion,
+				socketFactory: options.socketFactory,
+				fetchImpl: options.fetchImpl,
+				onListening: () => {
+					reconnects = 0;
+					options.onStatus?.("listening");
+					options.onReady?.({
+						deviceId,
+						forwardTo
+					});
+					if (options.quiet) return;
+					if (options.json) {
+						if (announcedJson) return;
+						announcedJson = true;
+						console.log(JSON.stringify({
+							deviceId,
+							forwardTo,
+							relayUrl: credentials.relayUrl
+						}));
+						return;
+					}
+					printListening(deviceId, forwardTo);
+				}
+			});
+			runtime.active = session;
+			if (runtime.stopping) session.close(1e3, "Interrupted");
+			const close = await session.closed;
+			runtime.active = null;
+			if (close.cleanupFailed) throw new DeviceListenCleanupError("Device relay cleanup failed");
+			if (runtime.stopping || close.intent === "stop") {
+				setExitCode(0);
+				return;
+			}
+			if (close.intent === "revoked") throw new DeviceListenError("This device was revoked");
+			if (reconnects >= reconnectDelays.length) {
+				options.onStatus?.("offline");
+				if (!options.quiet) console.error(chalk.red("Offline. Stopped listening after repeated disconnects."));
+				setExitCode(1);
+				return;
+			}
+			options.onStatus?.("offline");
+			if (!options.quiet) console.error(chalk.yellow("Offline. Reconnecting."));
+			await untilStopped(sleep(reconnectDelays[reconnects] ?? 0), stopped.signal);
+			reconnects += 1;
+			if (runtime.stopping) break;
+		}
+		setExitCode(0);
+	} catch (error) {
+		if (runtime.stopping && !(error instanceof DeviceListenCleanupError)) {
+			setExitCode(0);
+			return;
+		}
+		setExitCode(1);
+		throw error;
+	} finally {
+		runtime.active?.close(1e3, "Stopped");
+		runtime.active = null;
+		uninstall();
+		options.signal?.removeEventListener("abort", requestStop);
+		options.onStatus?.("stopped");
+	}
+}
+export { createDeviceListenIdentityStore as i, assertListenForwardTarget as n, runDeviceListen as r, DeviceListenCleanupError as t };
+