@rynx-ai/daemon 0.1.0 → 0.1.9

package/dist/remote-runtime-admin.js

@@ -0,0 +1,107 @@
+import { createHash } from "node:crypto";
+import { DIRECT_RUNTIME_CONTROL_PATH, parsePairingOffer, } from "@rynx-ai/protocol/direct-runtime";
+import { listRuntimeShareAddresses } from "./runtime-share-addresses.js";
+const DEFAULT_PAIRING_TTL_MS = 5 * 60_000;
+export class DaemonRemoteRuntimeAdmin {
+    identity;
+    encryption;
+    access;
+    directConfig;
+    connections;
+    constructor(identity, encryption, access, directConfig, connections) {
+        this.identity = identity;
+        this.encryption = encryption;
+        this.access = access;
+        this.directConfig = directConfig;
+        this.connections = connections;
+    }
+    listShareAddresses() {
+        return listRuntimeShareAddresses({ bindHost: this.directConfig.bindHost });
+    }
+    createPairingOffer(input = {}) {
+        const directEndpoint = advertisedEndpoint(input.address, this.directConfig.port);
+        const claim = this.access.createPairingClaim({
+            ttlMs: DEFAULT_PAIRING_TTL_MS,
+            ...(input.clientLabel ? { label: input.clientLabel } : {}),
+        });
+        return parsePairingOffer({
+            type: "rynx.remote-runtime.pairing-offer",
+            enrollmentVersion: 2,
+            daemonId: this.identity.installationId,
+            identityAlgorithm: "Ed25519",
+            identityPublicKey: this.identity.publicKey,
+            security: "e2ee-v1",
+            encryptionAlgorithm: "X25519",
+            serverEncryptionPublicKey: this.encryption.publicKey,
+            directEndpoint,
+            claimId: claim.claimId,
+            claimSecret: claim.claimSecret,
+            expiresAt: claim.expiresAt,
+        });
+    }
+    listClientGrants() {
+        return this.access.listClientGrants().map(redactGrant);
+    }
+    revokeClientGrant(grantId) {
+        const revoked = this.access.revokeClientGrant(grantId);
+        const closedConnections = revoked ? this.connections.revokeGrant(grantId) : 0;
+        return { revoked, closedConnections };
+    }
+}
+function advertisedEndpoint(address, listenerPort) {
+    const input = address?.trim() || "127.0.0.1";
+    let endpoint;
+    if (/^[a-z][a-z0-9+.-]*:\/\//i.test(input)) {
+        try {
+            endpoint = new URL(input);
+        }
+        catch {
+            throw new Error("Direct Runtime address must be a host or ws(s) URL");
+        }
+    }
+    else {
+        if (/[/\\?#@\s]/.test(input)) {
+            throw new Error("Direct Runtime address must be a host or ws(s) URL");
+        }
+        const host = input.includes(":") ? `[${input}]` : input;
+        try {
+            endpoint = new URL(`ws://${host}:${listenerPort}`);
+        }
+        catch {
+            throw new Error("Direct Runtime address must be a host or ws(s) URL");
+        }
+    }
+    if ((endpoint.protocol !== "ws:" && endpoint.protocol !== "wss:") ||
+        endpoint.username ||
+        endpoint.password ||
+        endpoint.search ||
+        endpoint.hash ||
+        !endpoint.hostname ||
+        endpoint.hostname === "0.0.0.0" ||
+        endpoint.hostname === "[::]" ||
+        endpoint.hostname === "::") {
+        throw new Error("Direct Runtime address must be a credential-free dialable ws(s) route");
+    }
+    if (endpoint.pathname !== "/" && endpoint.pathname !== DIRECT_RUNTIME_CONTROL_PATH) {
+        throw new Error(`Direct Runtime address path must be / or ${DIRECT_RUNTIME_CONTROL_PATH}`);
+    }
+    endpoint.pathname = DIRECT_RUNTIME_CONTROL_PATH;
+    return endpoint.toString();
+}
+function redactGrant(grant) {
+    return {
+        grantId: grant.grantId,
+        clientId: grant.clientId,
+        clientLabel: grant.clientLabel,
+        clientKeyFingerprint: publicKeyFingerprint(grant.clientPublicKey),
+        authorities: [...grant.authorities],
+        createdAt: grant.createdAt,
+        revokedAt: grant.revokedAt,
+        lastUsedAt: grant.lastUsedAt,
+    };
+}
+function publicKeyFingerprint(publicKey) {
+    return `SHA256:${createHash("sha256")
+        .update(Buffer.from(publicKey, "base64url"))
+        .digest("base64url")}`;
+}

package/dist/remote-runtime-connection-manager.d.ts

@@ -0,0 +1,92 @@
+import { type RuntimeBrowserSurfaceOpenFrame } from "@rynx-ai/protocol/runtime-browser-surface";
+import { type DirectRuntimeConnection, type DirectRuntimeBrowserSurfaceConnection, type DirectRuntimeCredential } from "@rynx-ai/remote-runtime-client";
+import type { DirectRuntimeBrowserSurfaceHost, DirectRuntimeEmulatorSurfaceHost, RemoteRuntimeDispatcher, RuntimeConnectionLease, RuntimeConnectionResolverHost } from "@rynx-ai/server";
+import { type FileRemoteRuntimeCredentialStore, type RemoteRuntimeClientCredential } from "./remote-runtime-credential-store.js";
+import { type RemoteRuntimeTarget, type RemoteRuntimeTargetStore } from "./remote-runtime-target-store.js";
+export type RuntimeConnectionManagerErrorCode = "invalid_target" | "not_found" | "authentication_failed" | "identity_mismatch" | "incompatible" | "protocol_error" | "deadline_exceeded" | "outcome_unknown" | "closed" | "cancelled";
+export declare class RuntimeConnectionManagerError extends Error {
+    readonly code: RuntimeConnectionManagerErrorCode;
+    readonly outcome: "not_started" | "unknown" | undefined;
+    constructor(code: RuntimeConnectionManagerErrorCode, message: string, options?: ErrorOptions & {
+        outcome?: "not_started" | "unknown";
+    });
+}
+interface RuntimeTargetReader {
+    get(selector: string): RemoteRuntimeTarget | undefined;
+}
+interface RuntimeCredentialReader {
+    load(credentialRef: string): Promise<RemoteRuntimeClientCredential>;
+}
+interface RuntimeClientAdapter {
+    connect(credential: DirectRuntimeCredential): Promise<DirectRuntimeConnection>;
+    openBrowserSurface?(credential: DirectRuntimeCredential, frame: RuntimeBrowserSurfaceOpenFrame, options?: {
+        timeoutMs?: number;
+        signal?: AbortSignal;
+    }): Promise<DirectRuntimeBrowserSurfaceConnection>;
+}
+export interface DaemonRuntimeConnectionManagerOptions {
+    localDaemonId: string;
+    dispatcher: Pick<RemoteRuntimeDispatcher, "dispatch" | "openSessionEvents" | "openSessionTerminal">;
+    localBrowserSurface?: DirectRuntimeBrowserSurfaceHost;
+    localEmulatorSurface?: DirectRuntimeEmulatorSurfaceHost;
+    targets: Pick<RemoteRuntimeTargetStore, "get"> | RuntimeTargetReader;
+    credentials: Pick<FileRemoteRuntimeCredentialStore, "load"> | RuntimeCredentialReader;
+    client?: RuntimeClientAdapter;
+    idleTtlMs?: number;
+    maxIdleConnections?: number;
+}
+/**
+ * Daemon-owned Local/Direct Runtime resolver.
+ *
+ * Application callers receive only a logical target and a typed call surface;
+ * target routes and client credentials never cross this boundary. Direct
+ * connections are reused while healthy, but a failed call is never retried.
+ */
+export declare class DaemonRuntimeConnectionManager implements RuntimeConnectionResolverHost {
+    private readonly options;
+    private readonly client;
+    private readonly idleTtlMs;
+    private readonly maxIdleConnections;
+    private readonly slots;
+    private readonly generations;
+    private localStatusSnapshot?;
+    private closed;
+    private managerClosePromise?;
+    constructor(options: DaemonRuntimeConnectionManagerOptions);
+    acquire(selector: string, options?: {
+        signal?: AbortSignal;
+    }): Promise<RuntimeConnectionLease>;
+    /** Synchronously detaches the generation, then closes it asynchronously. */
+    invalidate(daemonId: string): Promise<void>;
+    close(): Promise<void>;
+    private localLease;
+    private callLocal;
+    private readLocalStatus;
+    private dispatchLocalRequest;
+    private rememberLocalStatus;
+    private assertMethodSupported;
+    private assertSessionEventsSupported;
+    private assertSessionTerminalSupported;
+    private directLease;
+    private wrapDirectSessionSubscription;
+    private openDedicatedDirectTerminal;
+    private openDedicatedDirectBrowserSurface;
+    private openDedicatedDirectEmulatorSurface;
+    private slotFor;
+    private openDirectConnection;
+    private evict;
+    private closeSlot;
+    private trackDedicatedTerminal;
+    private trackDedicatedBrowserSurface;
+    private trackDedicatedEmulatorSurface;
+    private registerDedicatedCloser;
+    private scheduleIdleClose;
+    private pruneIdleConnections;
+    private cancelIdleTimer;
+    private assertOpen;
+    private assertSlotCurrent;
+    private isSlotCurrent;
+    private generation;
+    private bumpGeneration;
+}
+export {};