@rynx-ai/daemon 0.1.0 → 0.1.10-beta.2

package/dist/remote-runtime-access-store.d.ts

@@ -0,0 +1,62 @@
+import Database from "better-sqlite3";
+declare const DEFAULT_AUTHORITIES: readonly ["daemon.full"];
+export type RuntimeAuthority = (typeof DEFAULT_AUTHORITIES)[number];
+export type RemoteRuntimeAccessErrorCode = "invalid_claim" | "claim_expired" | "claim_used" | "grant_not_found" | "grant_revoked" | "grant_identity_mismatch" | "conflict" | "corrupt_state";
+export declare class RemoteRuntimeAccessError extends Error {
+    readonly code: RemoteRuntimeAccessErrorCode;
+    constructor(code: RemoteRuntimeAccessErrorCode, message: string, options?: ErrorOptions);
+}
+export interface RuntimePairingClaim {
+    claimId: string;
+    claimSecret: string;
+    authorities: readonly RuntimeAuthority[];
+    clientLabel: string | null;
+    createdAt: string;
+    expiresAt: string;
+}
+export interface RuntimeClientGrant {
+    grantId: string;
+    clientId: string;
+    /** Canonical Ed25519 SubjectPublicKeyInfo DER, base64url encoded. */
+    clientPublicKey: string;
+    clientLabel: string | null;
+    authorities: readonly RuntimeAuthority[];
+    createdAt: string;
+    revokedAt: string | null;
+    lastUsedAt: string | null;
+}
+export interface CreatePairingClaimInput {
+    ttlMs: number;
+    label?: string;
+}
+export interface RedeemPairingClaimInput {
+    claimId: string;
+    claimSecret: string;
+    clientId: string;
+    clientPublicKey: string;
+    label?: string;
+}
+export interface ResolveActiveGrantInput {
+    grantId: string;
+    clientId: string;
+    clientPublicKey: string;
+}
+type Clock = () => Date;
+/** SQLite-backed enrollment and client authorization state for a direct runtime. */
+export declare class RemoteRuntimeAccessStore {
+    private readonly connection;
+    private readonly clock;
+    constructor(connection?: Database.Database, clock?: Clock);
+    createPairingClaim(input: CreatePairingClaimInput): RuntimePairingClaim;
+    redeemPairingClaim(input: RedeemPairingClaimInput): RuntimeClientGrant;
+    resolveActiveGrant(input: ResolveActiveGrantInput): RuntimeClientGrant;
+    listClientGrants(): RuntimeClientGrant[];
+    /** Recheck an already authenticated peer before each dispatched operation. */
+    isClientGrantActive(grantIdInput: string, clientIdInput: string): boolean;
+    revokeClientGrant(grantIdInput: string): boolean;
+    deleteRevokedClientGrant(grantIdInput: string): boolean;
+    private replayConsumedClaim;
+    private deleteRetainedExpiredClaims;
+    private now;
+}
+export {};

package/dist/remote-runtime-access-store.js

@@ -0,0 +1,393 @@
+import { createHash, createPublicKey, randomBytes, timingSafeEqual, } from "node:crypto";
+import { db } from "./db.js";
+const CLAIM_SECRET_HASH_DOMAIN = "rynx-runtime-pairing-claim-secret-v1\0";
+const DEFAULT_AUTHORITIES = Object.freeze(["daemon.full"]);
+const MIN_TTL_MS = 1_000;
+const MAX_TTL_MS = 15 * 60_000;
+const EXPIRED_UNCONSUMED_CLAIM_RETENTION_MS = 24 * 60 * 60_000;
+const CLAIM_CLEANUP_BATCH_SIZE = 256;
+const MAX_ID_LENGTH = 256;
+const MAX_KEY_LENGTH = 512;
+const MAX_LABEL_LENGTH = 128;
+const ID_PATTERN = /^[A-Za-z0-9][A-Za-z0-9._~-]*$/;
+const BASE64URL_PATTERN = /^[A-Za-z0-9_-]+$/;
+export class RemoteRuntimeAccessError extends Error {
+    code;
+    constructor(code, message, options) {
+        super(message, options);
+        this.name = "RemoteRuntimeAccessError";
+        this.code = code;
+    }
+}
+/** SQLite-backed enrollment and client authorization state for a direct runtime. */
+export class RemoteRuntimeAccessStore {
+    connection;
+    clock;
+    constructor(connection = db(), clock = () => new Date()) {
+        this.connection = connection;
+        this.clock = clock;
+    }
+    createPairingClaim(input) {
+        const ttlMs = validTtl(input.ttlMs);
+        const clientLabel = optionalLabel(input.label, "conflict");
+        const claimId = `claim_${randomBytes(18).toString("base64url")}`;
+        const claimSecret = randomBytes(32).toString("base64url");
+        const created = this.now();
+        const createdAt = created.toISOString();
+        const expiresAt = new Date(created.getTime() + ttlMs).toISOString();
+        const create = this.connection.transaction(() => {
+            this.deleteRetainedExpiredClaims(created);
+            this.connection
+                .prepare(`INSERT INTO runtime_pairing_claims
+             (claim_id, secret_hash, authorities, client_label, created_at, expires_at,
+              consumed_at, consumed_client_id, consumed_client_public_key, consumed_grant_id)
+           VALUES (?, ?, ?, ?, ?, ?, NULL, NULL, NULL, NULL)`)
+                .run(claimId, hashClaimSecret(claimSecret).toString("hex"), JSON.stringify(DEFAULT_AUTHORITIES), clientLabel, createdAt, expiresAt);
+        });
+        create.immediate();
+        return {
+            claimId,
+            claimSecret,
+            authorities: DEFAULT_AUTHORITIES,
+            clientLabel,
+            createdAt,
+            expiresAt,
+        };
+    }
+    redeemPairingClaim(input) {
+        const claimId = validId(input.claimId, "claimId", "invalid_claim");
+        const claimSecret = validClaimSecret(input.claimSecret);
+        const clientId = validId(input.clientId, "clientId", "invalid_claim");
+        const clientPublicKey = canonicalEd25519PublicKey(input.clientPublicKey, "invalid_claim");
+        const requestedLabel = optionalLabel(input.label, "invalid_claim");
+        const redeem = this.connection.transaction(() => {
+            const now = this.now().toISOString();
+            const claim = this.connection
+                .prepare(`SELECT claim_id, secret_hash, authorities, client_label, created_at, expires_at,
+                  consumed_at, consumed_client_id, consumed_client_public_key, consumed_grant_id
+           FROM runtime_pairing_claims
+           WHERE claim_id = ?`)
+                .get(claimId);
+            if (!claim) {
+                throw accessError("invalid_claim", "pairing claim is invalid");
+            }
+            assertAuthorities(claim.authorities);
+            assertClaimSecret(claim.secret_hash, claimSecret);
+            if (claim.consumed_at !== null) {
+                return this.replayConsumedClaim(claim, clientId, clientPublicKey);
+            }
+            assertUnconsumedClaimShape(claim);
+            if (claim.expires_at <= now) {
+                throw accessError("claim_expired", "pairing claim has expired");
+            }
+            const grantId = `grant_${randomBytes(18).toString("base64url")}`;
+            const clientLabel = requestedLabel ?? claim.client_label;
+            this.connection
+                .prepare(`INSERT INTO runtime_client_grants
+             (grant_id, client_id, client_public_key, client_label, authorities,
+              created_at, revoked_at, last_used_at)
+           VALUES (?, ?, ?, ?, ?, ?, NULL, NULL)`)
+                .run(grantId, clientId, clientPublicKey, clientLabel, JSON.stringify(DEFAULT_AUTHORITIES), now);
+            const consumed = this.connection
+                .prepare(`UPDATE runtime_pairing_claims
+           SET consumed_at = ?, consumed_client_id = ?, consumed_client_public_key = ?,
+               consumed_grant_id = ?
+           WHERE claim_id = ? AND consumed_at IS NULL`)
+                .run(now, clientId, clientPublicKey, grantId, claimId);
+            if (consumed.changes !== 1) {
+                throw accessError("conflict", "pairing claim was consumed concurrently");
+            }
+            return {
+                grantId,
+                clientId,
+                clientPublicKey,
+                clientLabel,
+                authorities: DEFAULT_AUTHORITIES,
+                createdAt: now,
+                revokedAt: null,
+                lastUsedAt: null,
+            };
+        });
+        try {
+            return redeem.immediate();
+        }
+        catch (error) {
+            if (error instanceof RemoteRuntimeAccessError)
+                throw error;
+            if (isSqliteConstraint(error)) {
+                throw accessError("conflict", "client identity already has a runtime grant", error);
+            }
+            throw error;
+        }
+    }
+    resolveActiveGrant(input) {
+        const grantId = validId(input.grantId, "grantId", "grant_not_found");
+        const clientId = validId(input.clientId, "clientId", "grant_identity_mismatch");
+        const clientPublicKey = canonicalEd25519PublicKey(input.clientPublicKey, "grant_identity_mismatch");
+        const resolve = this.connection.transaction(() => {
+            const row = this.connection
+                .prepare(`SELECT grant_id, client_id, client_public_key, client_label, authorities,
+                  created_at, revoked_at, last_used_at
+           FROM runtime_client_grants
+           WHERE grant_id = ?`)
+                .get(grantId);
+            if (!row)
+                throw accessError("grant_not_found", "runtime client grant was not found");
+            const grant = grantFromRow(row);
+            if (grant.clientId !== clientId || grant.clientPublicKey !== clientPublicKey) {
+                throw accessError("grant_identity_mismatch", "runtime client grant identity does not match");
+            }
+            if (grant.revokedAt !== null) {
+                throw accessError("grant_revoked", "runtime client grant has been revoked");
+            }
+            const lastUsedAt = this.now().toISOString();
+            const updated = this.connection
+                .prepare(`UPDATE runtime_client_grants
+           SET last_used_at = ?
+           WHERE grant_id = ? AND client_id = ? AND client_public_key = ? AND revoked_at IS NULL`)
+                .run(lastUsedAt, grantId, clientId, clientPublicKey);
+            if (updated.changes !== 1) {
+                throw accessError("grant_revoked", "runtime client grant is no longer active");
+            }
+            return { ...grant, lastUsedAt };
+        });
+        return resolve.immediate();
+    }
+    listClientGrants() {
+        const rows = this.connection
+            .prepare(`SELECT grant_id, client_id, client_public_key, client_label, authorities,
+                created_at, revoked_at, last_used_at
+         FROM runtime_client_grants
+         ORDER BY created_at, grant_id`)
+            .all();
+        return rows.map(grantFromRow);
+    }
+    /** Recheck an already authenticated peer before each dispatched operation. */
+    isClientGrantActive(grantIdInput, clientIdInput) {
+        const grantId = validId(grantIdInput, "grantId", "grant_not_found");
+        const clientId = validId(clientIdInput, "clientId", "grant_identity_mismatch");
+        const row = this.connection
+            .prepare(`SELECT grant_id, client_id, client_public_key, client_label, authorities,
+                created_at, revoked_at, last_used_at
+         FROM runtime_client_grants
+         WHERE grant_id = ?`)
+            .get(grantId);
+        if (!row)
+            return false;
+        const grant = grantFromRow(row);
+        return grant.clientId === clientId && grant.revokedAt === null;
+    }
+    revokeClientGrant(grantIdInput) {
+        const grantId = validId(grantIdInput, "grantId", "grant_not_found");
+        const revokedAt = this.now().toISOString();
+        const revoke = this.connection.transaction(() => {
+            const revoked = this.connection
+                .prepare(`UPDATE runtime_client_grants
+           SET revoked_at = ?
+           WHERE grant_id = ? AND revoked_at IS NULL`)
+                .run(revokedAt, grantId).changes === 1;
+            // An active grant keeps its consumed claim so the enrolling client can
+            // recover an accepted response it missed. Revocation ends that retry
+            // contract, so remove the no-longer-secret enrollment record atomically.
+            this.connection
+                .prepare(`DELETE FROM runtime_pairing_claims
+           WHERE consumed_grant_id = ? AND consumed_at IS NOT NULL`)
+                .run(grantId);
+            return revoked;
+        });
+        return revoke.immediate();
+    }
+    deleteRevokedClientGrant(grantIdInput) {
+        const grantId = validId(grantIdInput, "grantId", "grant_not_found");
+        return this.connection
+            .prepare(`DELETE FROM runtime_client_grants
+         WHERE grant_id = ? AND revoked_at IS NOT NULL`)
+            .run(grantId).changes === 1;
+    }
+    replayConsumedClaim(claim, clientId, clientPublicKey) {
+        if (claim.consumed_client_id === null ||
+            claim.consumed_client_public_key === null ||
+            claim.consumed_grant_id === null) {
+            throw accessError("corrupt_state", "consumed pairing claim is incomplete");
+        }
+        let consumedPublicKey;
+        try {
+            consumedPublicKey = canonicalEd25519PublicKey(claim.consumed_client_public_key, "corrupt_state");
+        }
+        catch (error) {
+            if (error instanceof RemoteRuntimeAccessError)
+                throw error;
+            throw accessError("corrupt_state", "consumed pairing claim has an invalid client key", error);
+        }
+        if (claim.consumed_client_id !== clientId || consumedPublicKey !== clientPublicKey) {
+            throw accessError("claim_used", "pairing claim has already been used");
+        }
+        const row = this.connection
+            .prepare(`SELECT grant_id, client_id, client_public_key, client_label, authorities,
+                created_at, revoked_at, last_used_at
+         FROM runtime_client_grants
+         WHERE grant_id = ?`)
+            .get(claim.consumed_grant_id);
+        if (!row) {
+            throw accessError("corrupt_state", "consumed pairing claim has no associated grant");
+        }
+        const grant = grantFromRow(row);
+        if (grant.clientId !== clientId || grant.clientPublicKey !== clientPublicKey) {
+            throw accessError("corrupt_state", "consumed pairing claim and grant identities differ");
+        }
+        if (grant.revokedAt !== null) {
+            throw accessError("grant_revoked", "runtime client grant has been revoked");
+        }
+        return grant;
+    }
+    deleteRetainedExpiredClaims(now) {
+        const cutoff = new Date(now.getTime() - EXPIRED_UNCONSUMED_CLAIM_RETENTION_MS).toISOString();
+        this.connection
+            .prepare(`DELETE FROM runtime_pairing_claims
+         WHERE claim_id IN (
+           SELECT claim_id
+           FROM runtime_pairing_claims
+           WHERE expires_at <= ? AND consumed_at IS NULL
+           ORDER BY expires_at
+           LIMIT ?
+         )`)
+            .run(cutoff, CLAIM_CLEANUP_BATCH_SIZE);
+    }
+    now() {
+        const value = this.clock();
+        if (!(value instanceof Date) || !Number.isFinite(value.getTime())) {
+            throw accessError("corrupt_state", "runtime access clock returned an invalid date");
+        }
+        return new Date(value.getTime());
+    }
+}
+function validTtl(value) {
+    if (!Number.isSafeInteger(value) || value < MIN_TTL_MS || value > MAX_TTL_MS) {
+        throw accessError("conflict", `ttlMs must be an integer between ${MIN_TTL_MS} and ${MAX_TTL_MS}`);
+    }
+    return value;
+}
+function validId(value, label, code) {
+    if (typeof value !== "string" ||
+        value.length === 0 ||
+        value.length > MAX_ID_LENGTH ||
+        value.trim() !== value ||
+        !ID_PATTERN.test(value)) {
+        throw accessError(code, `${label} is invalid`);
+    }
+    return value;
+}
+function validClaimSecret(value) {
+    if (typeof value !== "string" ||
+        value.length !== 43 ||
+        !BASE64URL_PATTERN.test(value) ||
+        Buffer.from(value, "base64url").length !== 32 ||
+        Buffer.from(value, "base64url").toString("base64url") !== value) {
+        throw accessError("invalid_claim", "pairing claim is invalid");
+    }
+    return value;
+}
+function optionalLabel(value, code) {
+    if (value === undefined)
+        return null;
+    if (typeof value !== "string" ||
+        value.length === 0 ||
+        value.length > MAX_LABEL_LENGTH ||
+        value.trim() !== value ||
+        /[\u0000-\u001f\u007f]/.test(value)) {
+        throw accessError(code, "client label is invalid");
+    }
+    return value;
+}
+function canonicalEd25519PublicKey(value, code) {
+    if (typeof value !== "string" ||
+        value.length === 0 ||
+        value.length > MAX_KEY_LENGTH ||
+        !BASE64URL_PATTERN.test(value)) {
+        throw accessError(code, "client public key is invalid");
+    }
+    try {
+        const bytes = Buffer.from(value, "base64url");
+        if (bytes.toString("base64url") !== value) {
+            throw new Error("non-canonical base64url");
+        }
+        const key = createPublicKey({ key: bytes, format: "der", type: "spki" });
+        if (key.asymmetricKeyType !== "ed25519") {
+            throw new Error("not an Ed25519 key");
+        }
+        return key.export({ format: "der", type: "spki" }).toString("base64url");
+    }
+    catch (error) {
+        if (error instanceof RemoteRuntimeAccessError)
+            throw error;
+        throw accessError(code, "client public key is invalid", error);
+    }
+}
+function assertAuthorities(raw) {
+    try {
+        const parsed = JSON.parse(raw);
+        if (!Array.isArray(parsed) ||
+            parsed.length !== 1 ||
+            parsed[0] !== DEFAULT_AUTHORITIES[0]) {
+            throw new Error("unsupported authorities");
+        }
+    }
+    catch (error) {
+        throw accessError("corrupt_state", "runtime authorities are corrupt", error);
+    }
+}
+function assertClaimSecret(storedHash, claimSecret) {
+    const expected = hashClaimSecret(claimSecret);
+    let actual;
+    try {
+        if (!/^[0-9a-f]{64}$/.test(storedHash))
+            throw new Error("invalid secret hash");
+        actual = Buffer.from(storedHash, "hex");
+    }
+    catch (error) {
+        throw accessError("corrupt_state", "pairing claim secret hash is corrupt", error);
+    }
+    if (actual.length !== expected.length || !timingSafeEqual(actual, expected)) {
+        throw accessError("invalid_claim", "pairing claim is invalid");
+    }
+}
+function assertUnconsumedClaimShape(claim) {
+    if (claim.consumed_client_id !== null ||
+        claim.consumed_client_public_key !== null ||
+        claim.consumed_grant_id !== null) {
+        throw accessError("corrupt_state", "unconsumed pairing claim has consumed identity state");
+    }
+}
+function hashClaimSecret(secret) {
+    return createHash("sha256").update(CLAIM_SECRET_HASH_DOMAIN).update(secret).digest();
+}
+function grantFromRow(row) {
+    validId(row.grant_id, "stored grantId", "corrupt_state");
+    validId(row.client_id, "stored clientId", "corrupt_state");
+    const clientPublicKey = canonicalEd25519PublicKey(row.client_public_key, "corrupt_state");
+    if (clientPublicKey !== row.client_public_key) {
+        throw accessError("corrupt_state", "stored client public key is not canonical");
+    }
+    const clientLabel = row.client_label === null ? null : optionalLabel(row.client_label, "corrupt_state");
+    assertAuthorities(row.authorities);
+    return {
+        grantId: row.grant_id,
+        clientId: row.client_id,
+        clientPublicKey,
+        clientLabel,
+        authorities: DEFAULT_AUTHORITIES,
+        createdAt: row.created_at,
+        revokedAt: row.revoked_at,
+        lastUsedAt: row.last_used_at,
+    };
+}
+function isSqliteConstraint(error) {
+    return (typeof error === "object" &&
+        error !== null &&
+        "code" in error &&
+        typeof error.code === "string" &&
+        error.code.startsWith("SQLITE_CONSTRAINT"));
+}
+function accessError(code, message, cause) {
+    return new RemoteRuntimeAccessError(code, message, cause === undefined ? undefined : { cause });
+}

package/dist/remote-runtime-admin.d.ts

@@ -0,0 +1,35 @@
+import { type PairingOffer } from "@rynx-ai/protocol/direct-runtime";
+import type { DirectRuntimeConnectionHub, RemoteRuntimeAdminHost } from "@rynx-ai/server";
+import type { DirectRuntimeConfig } from "./direct-runtime-config.js";
+import type { DaemonDirectRuntimeEncryptionIdentity, DaemonInstallationIdentity } from "./installation-id.js";
+import { RemoteRuntimeAccessStore } from "./remote-runtime-access-store.js";
+export declare class DaemonRemoteRuntimeAdmin implements RemoteRuntimeAdminHost {
+    private readonly identity;
+    private readonly encryption;
+    private readonly access;
+    private readonly directConfig;
+    private readonly connections;
+    constructor(identity: DaemonInstallationIdentity, encryption: DaemonDirectRuntimeEncryptionIdentity, access: RemoteRuntimeAccessStore, directConfig: DirectRuntimeConfig, connections: DirectRuntimeConnectionHub);
+    listShareAddresses(): import("@rynx-ai/protocol/control").ControlRuntimeShareAddress[];
+    createPairingOffer(input?: {
+        clientLabel?: string;
+        address?: string;
+    }): PairingOffer;
+    listClientGrants(): {
+        grantId: string;
+        clientId: string;
+        clientLabel: string | null;
+        clientKeyFingerprint: string;
+        authorities: "daemon.full"[];
+        createdAt: string;
+        revokedAt: string | null;
+        lastUsedAt: string | null;
+    }[];
+    revokeClientGrant(grantId: string): {
+        revoked: boolean;
+        closedConnections: number;
+    };
+    deleteRevokedClientGrant(grantId: string): {
+        deleted: boolean;
+    };
+}

package/dist/remote-runtime-admin.js

@@ -0,0 +1,110 @@
+import { createHash } from "node:crypto";
+import { DIRECT_RUNTIME_CONTROL_PATH, parsePairingOffer, } from "@rynx-ai/protocol/direct-runtime";
+import { listRuntimeShareAddresses } from "./runtime-share-addresses.js";
+const DEFAULT_PAIRING_TTL_MS = 5 * 60_000;
+export class DaemonRemoteRuntimeAdmin {
+    identity;
+    encryption;
+    access;
+    directConfig;
+    connections;
+    constructor(identity, encryption, access, directConfig, connections) {
+        this.identity = identity;
+        this.encryption = encryption;
+        this.access = access;
+        this.directConfig = directConfig;
+        this.connections = connections;
+    }
+    listShareAddresses() {
+        return listRuntimeShareAddresses({ bindHost: this.directConfig.bindHost });
+    }
+    createPairingOffer(input = {}) {
+        const directEndpoint = advertisedEndpoint(input.address, this.directConfig.port);
+        const claim = this.access.createPairingClaim({
+            ttlMs: DEFAULT_PAIRING_TTL_MS,
+            ...(input.clientLabel ? { label: input.clientLabel } : {}),
+        });
+        return parsePairingOffer({
+            type: "rynx.remote-runtime.pairing-offer",
+            enrollmentVersion: 2,
+            daemonId: this.identity.installationId,
+            identityAlgorithm: "Ed25519",
+            identityPublicKey: this.identity.publicKey,
+            security: "e2ee-v1",
+            encryptionAlgorithm: "X25519",
+            serverEncryptionPublicKey: this.encryption.publicKey,
+            directEndpoint,
+            claimId: claim.claimId,
+            claimSecret: claim.claimSecret,
+            expiresAt: claim.expiresAt,
+        });
+    }
+    listClientGrants() {
+        return this.access.listClientGrants().map(redactGrant);
+    }
+    revokeClientGrant(grantId) {
+        const revoked = this.access.revokeClientGrant(grantId);
+        const closedConnections = revoked ? this.connections.revokeGrant(grantId) : 0;
+        return { revoked, closedConnections };
+    }
+    deleteRevokedClientGrant(grantId) {
+        return { deleted: this.access.deleteRevokedClientGrant(grantId) };
+    }
+}
+function advertisedEndpoint(address, listenerPort) {
+    const input = address?.trim() || "127.0.0.1";
+    let endpoint;
+    if (/^[a-z][a-z0-9+.-]*:\/\//i.test(input)) {
+        try {
+            endpoint = new URL(input);
+        }
+        catch {
+            throw new Error("Direct Runtime address must be a host or ws(s) URL");
+        }
+    }
+    else {
+        if (/[/\\?#@\s]/.test(input)) {
+            throw new Error("Direct Runtime address must be a host or ws(s) URL");
+        }
+        const host = input.includes(":") ? `[${input}]` : input;
+        try {
+            endpoint = new URL(`ws://${host}:${listenerPort}`);
+        }
+        catch {
+            throw new Error("Direct Runtime address must be a host or ws(s) URL");
+        }
+    }
+    if ((endpoint.protocol !== "ws:" && endpoint.protocol !== "wss:") ||
+        endpoint.username ||
+        endpoint.password ||
+        endpoint.search ||
+        endpoint.hash ||
+        !endpoint.hostname ||
+        endpoint.hostname === "0.0.0.0" ||
+        endpoint.hostname === "[::]" ||
+        endpoint.hostname === "::") {
+        throw new Error("Direct Runtime address must be a credential-free dialable ws(s) route");
+    }
+    if (endpoint.pathname !== "/" && endpoint.pathname !== DIRECT_RUNTIME_CONTROL_PATH) {
+        throw new Error(`Direct Runtime address path must be / or ${DIRECT_RUNTIME_CONTROL_PATH}`);
+    }
+    endpoint.pathname = DIRECT_RUNTIME_CONTROL_PATH;
+    return endpoint.toString();
+}
+function redactGrant(grant) {
+    return {
+        grantId: grant.grantId,
+        clientId: grant.clientId,
+        clientLabel: grant.clientLabel,
+        clientKeyFingerprint: publicKeyFingerprint(grant.clientPublicKey),
+        authorities: [...grant.authorities],
+        createdAt: grant.createdAt,
+        revokedAt: grant.revokedAt,
+        lastUsedAt: grant.lastUsedAt,
+    };
+}
+function publicKeyFingerprint(publicKey) {
+    return `SHA256:${createHash("sha256")
+        .update(Buffer.from(publicKey, "base64url"))
+        .digest("base64url")}`;
+}