@rynx-ai/daemon 0.1.0 → 0.1.9

package/dist/index-daemon.js

@@ -3,16 +3,39 @@
  * The resident daemon entry — this is what pm2 keeps alive.
  *
  * Boot order matters: install the EPIPE guard first (we're a pm2 child).
- * Importing `@rynx-ai/core` hydrates `{RYNX_HOME}/config.json` into the environment,
- * so `loadConfig()` sees runtime settings; then read the channel registry config,
- * resolve enabled channel plugins, and hand the factories to the channel-agnostic
- * `@rynx-ai/server` composition root.
+ * The composition root reads static plugin manifests, projects chat instances
+ * onto remote runner handles, and supervises non-chat plugin workers. Installed
+ * plugin code is loaded only in child processes.
  */
 import { startRynxDaemonServer } from "./daemon-server.js";
 import { installStdioEpipeGuard } from "./stdio-epipe-guard.js";
 installStdioEpipeGuard();
 async function main() {
-    await startRynxDaemonServer();
+    const server = await startRynxDaemonServer();
+    let shutdownPromise;
+    const shutdown = (signal) => {
+        if (shutdownPromise)
+            return shutdownPromise;
+        process.off("SIGINT", onSigint);
+        process.off("SIGTERM", onSigterm);
+        shutdownPromise = (async () => {
+            console.log(JSON.stringify({ level: "info", type: "shutdown", signal }));
+            await server.shutdown();
+        })();
+        shutdownPromise.catch((error) => {
+            process.exitCode = 1;
+            console.error(`Shutdown failed: ${error instanceof Error ? (error.stack ?? error.message) : String(error)}`);
+        });
+        return shutdownPromise;
+    };
+    const onSigint = () => {
+        void shutdown("SIGINT");
+    };
+    const onSigterm = () => {
+        void shutdown("SIGTERM");
+    };
+    process.once("SIGINT", onSigint);
+    process.once("SIGTERM", onSigterm);
 }
 main().catch((err) => {
     console.error(`Fatal error: ${err instanceof Error ? (err.stack ?? err.message) : String(err)}`);

package/dist/installation-id.d.ts

@@ -0,0 +1,33 @@
+import { type ServerAcceptedProofFields, type ServerHelloProofFields } from "@rynx-ai/protocol/direct-runtime";
+export declare function daemonInstallationIdFile(env?: NodeJS.ProcessEnv): string;
+export declare function daemonInstallationKeyFile(env?: NodeJS.ProcessEnv): string;
+export declare function daemonDirectRuntimeEncryptionKeyFile(env?: NodeJS.ProcessEnv): string;
+export interface DaemonInstallationIdentity {
+    installationId: string;
+    algorithm: "Ed25519";
+    /** SPKI DER, base64url encoded. Safe to expose to isolated plugin runners. */
+    publicKey: string;
+    sign(pluginId: string, challenge: string): string;
+    signDirectRuntimeServerHello(channelBinding: Uint8Array, hello: ServerHelloProofFields): string;
+    signDirectRuntimeServerAccepted(channelBinding: Uint8Array, helloHash: Uint8Array, authenticateHash: Uint8Array, accepted: ServerAcceptedProofFields): string;
+}
+export interface DaemonDirectRuntimeEncryptionIdentity {
+    algorithm: "X25519";
+    /** X25519 SubjectPublicKeyInfo DER encoded as unpadded base64url. */
+    publicKey: string;
+    /** Derive one 32-byte shared secret without exposing the persistent private key. */
+    deriveSharedSecret(peerPublicKey: string): Uint8Array;
+}
+/** Direct hosting requires ownership/mode/no-follow checks for its persistent server key. */
+export declare function isDaemonDirectRuntimeHostingSupported(platform?: NodeJS.Platform): boolean;
+/** Load or atomically create the daemon's persistent Direct Runtime E2EE key. */
+export declare function loadOrCreateDaemonDirectRuntimeEncryptionIdentity(env?: NodeJS.ProcessEnv): Promise<DaemonDirectRuntimeEncryptionIdentity>;
+/** Load the stable installation id and proof key without exposing private key material. */
+export declare function loadOrCreateDaemonInstallationIdentity(env?: NodeJS.ProcessEnv): Promise<DaemonInstallationIdentity>;
+/** Synchronous composition-root variant used before spawning an explicit plugin CLI. */
+export declare function loadOrCreateDaemonInstallationIdentitySync(env?: NodeJS.ProcessEnv): DaemonInstallationIdentity;
+/** Load the public ID, creating the proof key first on a new installation. */
+export declare function loadOrCreateDaemonInstallationId(env?: NodeJS.ProcessEnv): Promise<string>;
+/** Synchronous variant for CLI dispatch, which must pin the plugin before yielding. */
+export declare function loadOrCreateDaemonInstallationIdSync(env?: NodeJS.ProcessEnv): string;
+export declare function installationProofPayload(installationId: string, pluginId: string, challenge: string): Buffer;