@rynx-ai/server 0.1.0 → 0.1.10-beta.2

package/dist/runtime-web-auth.js

@@ -0,0 +1,132 @@
+import { randomBytes, timingSafeEqual } from "node:crypto";
+import { isIP } from "node:net";
+export const RUNTIME_WEB_CAPABILITY_HEADER = "x-rynx-runtime-capability";
+export const RUNTIME_WEB_CAPABILITY_QUERY = "capability";
+/**
+ * Process-lifetime CSRF capability shared by the Runtime HTTP BFF and its
+ * browser WebSocket upgrades. It is not a daemon-management credential.
+ */
+export const RUNTIME_WEB_CAPABILITY = randomBytes(32).toString("base64url");
+export function runtimeWebAccessPolicyForBindHost(bindHost) {
+    const normalized = normalizeAddress(bindHost.trim().replace(/^\[|\]$/g, ""))?.toLowerCase();
+    return {
+        mode: normalized === "127.0.0.1" || normalized === "::1" || normalized === "localhost"
+            ? "loopback"
+            : "host",
+    };
+}
+/**
+ * Authorize a browser request before any Runtime lease or terminal is opened.
+ * Socket address and the original Host header are both checked to resist DNS
+ * rebinding; mutation metadata and the capability provide the CSRF fence.
+ */
+export function authorizeRuntimeWebRequest(request, options = {}) {
+    const access = options.access ?? { mode: "loopback" };
+    if (access.mode === "loopback" && !isLoopbackAddress(request.socket.remoteAddress)) {
+        return { status: 403, error: "loopback_only" };
+    }
+    const host = originalHostHeader(request);
+    if (!host || !isAllowedHostAuthority(request, host, access)) {
+        return { status: 403, error: "invalid_host" };
+    }
+    if (!options.mutation)
+        return undefined;
+    if (!isSameOriginBrowserMutation(request, host)) {
+        return { status: 403, error: "cross_origin" };
+    }
+    if (!safeTokenEquals(options.capability ?? "", RUNTIME_WEB_CAPABILITY)) {
+        return { status: 401, error: "invalid_runtime_capability" };
+    }
+    return undefined;
+}
+function isLoopbackAddress(value) {
+    const normalized = normalizeAddress(value);
+    return normalized === "127.0.0.1" || normalized === "::1";
+}
+function normalizeAddress(value) {
+    return value?.startsWith("::ffff:") ? value.slice("::ffff:".length) : value;
+}
+/** Read the HTTP/1 Host header exactly as received; duplicate Hosts fail closed. */
+function originalHostHeader(request) {
+    let host;
+    const raw = request.rawHeaders;
+    for (let index = 0; index < raw.length; index += 2) {
+        if (raw[index]?.toLowerCase() !== "host")
+            continue;
+        if (host !== undefined)
+            return undefined;
+        host = raw[index + 1];
+    }
+    return host;
+}
+function isAllowedHostAuthority(request, host, access) {
+    if (isLoopbackHostAuthority(host)) {
+        return isLoopbackAddress(request.socket.remoteAddress);
+    }
+    if (access.mode !== "host")
+        return false;
+    const hostAddress = ipHostAuthorityAddress(host);
+    const localAddress = normalizeAddress(request.socket.localAddress);
+    return hostAddress !== undefined && localAddress !== undefined &&
+        hostAddress.toLowerCase() === localAddress.toLowerCase();
+}
+function isLoopbackHostAuthority(value) {
+    if (value.length === 0 || value !== value.trim())
+        return false;
+    const match = /^(?:localhost|127\.0\.0\.1|\[::1\])(?::(\d{1,5}))?$/i.exec(value);
+    if (!match)
+        return false;
+    if (match[1] === undefined)
+        return true;
+    const port = Number(match[1]);
+    return Number.isInteger(port) && port >= 1 && port <= 65_535;
+}
+function ipHostAuthorityAddress(value) {
+    if (value.length === 0 || value !== value.trim())
+        return undefined;
+    const match = /^(?:([0-9.]+)|\[([0-9a-f:.]+)\])(?::(\d{1,5}))?$/i.exec(value);
+    if (!match)
+        return undefined;
+    const address = match[1] ?? match[2];
+    if (isIP(address) === 0)
+        return undefined;
+    if (match[3] !== undefined) {
+        const port = Number(match[3]);
+        if (!Number.isInteger(port) || port < 1 || port > 65_535)
+            return undefined;
+    }
+    return address;
+}
+function isSameOriginBrowserMutation(request, host) {
+    const fetchSite = singleHeader(request.headers["sec-fetch-site"]).trim().toLowerCase();
+    if (fetchSite && fetchSite !== "same-origin")
+        return false;
+    const origin = singleHeader(request.headers.origin).trim();
+    if (origin) {
+        try {
+            const parsed = new URL(origin);
+            const directScheme = request.socket.encrypted ? "https" : "http";
+            const expected = new URL(`${directScheme}://${host}`);
+            if (parsed.username ||
+                parsed.password ||
+                parsed.pathname !== "/" ||
+                parsed.search ||
+                parsed.hash ||
+                parsed.origin !== expected.origin) {
+                return false;
+            }
+        }
+        catch {
+            return false;
+        }
+    }
+    return fetchSite === "same-origin" || origin.length > 0;
+}
+function singleHeader(value) {
+    return typeof value === "string" ? value : "";
+}
+function safeTokenEquals(actual, expected) {
+    const left = Buffer.from(actual, "utf8");
+    const right = Buffer.from(expected, "utf8");
+    return left.byteLength === right.byteLength && timingSafeEqual(left, right);
+}

package/dist/server.d.ts

@@ -1,11 +1,53 @@
+import type { Server as HttpServer } from "node:http";
 import Koa from "koa";
-import { ConversationRuntime, type AppConfig, type ChannelFactory, type ChannelInstanceDescriptor, type SessionBus, type SessionLogStore, type SessionRegistry } from "@rynx-ai/core";
-import { RunnerManager, type CodexSessionStore } from "@rynx-ai/runtime";
+import { ConversationRuntime, type AgentCapabilities, type AgentSessionStore, type AppConfig, type ChannelInstanceDescriptor, type SessionEvent, type SessionBus, type SessionLogStore, type SessionRegistry } from "@rynx-ai/core";
+import type { SessionInteractionResolution } from "@rynx-ai/protocol";
+import type { ControlRuntimeShareAddress, DaemonBrowserArtifactCleanResult, DaemonBrowserArtifactInstallInput, DaemonBrowserArtifactInstallResult, DaemonBrowserArtifactUpdateInput, DaemonBrowserArtifactVersionResult, DaemonCleanupSessionsInput, DaemonCleanupSessionsResult, DaemonChromeInspectionConfigureInput, DaemonChromeInspectionStatus, DaemonShutdownIfIdleResult } from "@rynx-ai/protocol/control";
+import type { PluginInstallCommitInput, PluginInstallCommitResult, PluginInstallPreparation, PluginInstallPrepareInput, PluginManagementItem } from "@rynx-ai/protocol/plugin-management";
+import type { PairingOffer } from "@rynx-ai/protocol/direct-runtime";
+import type { DaemonStatus } from "@rynx-ai/protocol/remote-runtime";
+import type { RuntimeBrowserBootstrapCredential, RuntimeBrowserEndpointDescriptor } from "@rynx-ai/protocol/runtime-browser-bootstrap";
+import type { RuntimeBrowserInspectMessage, RuntimeBrowserInspectTarget } from "@rynx-ai/protocol/runtime-browser-inspect";
+import type { RuntimeBrowserSurfaceClientFrame, RuntimeBrowserSurfaceImageFrame, RuntimeBrowserSurfaceOpenFrame, RuntimeBrowserSurfaceReadyFrame, RuntimeBrowserSurfaceServerFrame } from "@rynx-ai/protocol/runtime-browser-surface";
+import type { RuntimeEmulatorSurfaceImageFrame, RuntimeEmulatorSurfaceReadyFrame } from "@rynx-ai/protocol/runtime-emulator-surface";
+import type { RemoteRuntimeRpcMethod, RemoteRuntimeRpcParams, RemoteRuntimeRpcResultFor, RemoteRuntimeSequencedSessionEvent } from "@rynx-ai/protocol/remote-runtime-rpc";
+import type { PluginAgentSummary, PluginResolvedSessionExecution, PluginSessionExecutionSnapshot } from "@rynx-ai/plugin-sdk";
+import { RunnerManager, type CodexSessionStore, type RunnerSessionContextProvider } from "@rynx-ai/runtime";
 import { ChannelManager } from "./channel-manager.js";
-import { type ControlPlaneDeps } from "./control-api.js";
+import { type ControlPlaneDeps, type LocalSessionResourceHost, type SessionResourceLifecycle } from "./control-api.js";
+import type { DaemonRuntimeHost } from "./remote-runtime.js";
+import { type AttachDesktopBrowserHostServerOptions } from "./desktop-browser-host.js";
+import { SessionRuntimeIndex } from "./session-runtime-index.js";
+import type { SessionEmulatorService } from "./session-emulator-service.js";
+import { type SessionTerminalHost } from "./session-terminal-host.js";
+import type { ProviderCliManagementHost } from "./provider-cli-host.js";
+import { type RuntimeWebAccessPolicy } from "./runtime-web-auth.js";
 export { ChannelManager } from "./channel-manager.js";
 export type { ChannelInstanceStatus } from "./channel-manager.js";
-export type { ControlPlaneDeps, StoredSessionMeta } from "./control-api.js";
+export type { ProviderCliManagementHost, ProviderCliStatusHost, } from "./provider-cli-host.js";
+export { MachineSessionService, MachineSessionServiceFailure, MachineSessionServiceInputError, synthesizeSessionTitle, } from "./machine-session-service.js";
+export type { MachineSessionAgentCatalogPort, MachineSessionCreateInput, MachineSessionCreateResult, MachineSessionDeleteResult, MachineSessionInterruptPort, MachineSessionInterruptResult, MachineSessionInteractionResult, MachineSessionListInput, MachineSessionListPage, MachineSessionMessageResult, MachineSessionMessageEnqueueResult, MachineSessionMessageInput, MachineSessionMessageOperationState, MachineSessionPendingMessage, MachineSessionPendingMessagePort, MachineSessionPreparedInput, MachineSessionResourcePort, MachineSessionRunnerPort, MachineSessionRuntimeStatePort, MachineSessionServiceFailureCode, MachineSessionServiceOptions, MachineSessionServicePorts, MachineSessionSnapshotInput, MachineSessionSnapshotPage, MachineSessionWatch, } from "./machine-session-service.js";
+export { SessionBrowserHostError, SessionBrowserService, SessionBrowserServiceError, SessionBrowserSurfaceUnsupportedError, } from "./session-browser-service.js";
+export type { SessionBrowserHost, SessionBrowserHostCreateInput, SessionBrowserHostErrorCode, SessionBrowserHostEvent, SessionBrowserHostHandle, SessionBrowserHostPage, SessionBrowserHostSurfaceFrame, SessionBrowserHostSurfaceOpenInput, SessionBrowserHostSurfaceSource, SessionBrowserHostSurfaceTrustedInput, SessionBrowserHostSurfaceViewport, SessionBrowserHostSnapshot, SessionBrowserInspectionEndpoint, SessionBrowserInspectionTarget, SessionBrowserRegistryPort, SessionBrowserServiceErrorCode, SessionBrowserServiceOptions, SessionBrowserServicePorts, SessionBrowserSurfaceOpenInput, SessionBrowserSurfaceSource, } from "./session-browser-service.js";
+export { SessionEmulatorBindingConflictError, SessionEmulatorService, SessionEmulatorServiceError, } from "./session-emulator-service.js";
+export type { SessionEmulatorBindingRecord, SessionEmulatorBindingStore, SessionEmulatorServiceErrorCode, SessionEmulatorServiceOptions, SessionEmulatorSurface, } from "./session-emulator-service.js";
+export { SessionBrowserSurfaceCoordinator } from "./session-browser-surface-coordinator.js";
+export type { SessionBrowserSurfaceCoordinatorOptions, } from "./session-browser-surface-coordinator.js";
+export { attachDesktopBrowserHostServer, createDesktopFirstSessionBrowserHost, DesktopBrowserHostAbsentError, DesktopBrowserHostProtocolError, DesktopBrowserHostRegistry, } from "./desktop-browser-host.js";
+export type { AttachDesktopBrowserHostServerOptions, DesktopBrowserHostRegistryOptions, } from "./desktop-browser-host.js";
+export type { ControlPlaneDeps, LocalSessionResourceHost, StoredSessionMeta, } from "./control-api.js";
+export { createDaemonRuntimeHost, encodeDaemonStatus } from "./remote-runtime.js";
+export type { DaemonRuntimeHost, DaemonRuntimeSnapshot } from "./remote-runtime.js";
+export { DIRECT_RUNTIME_CONTROL_PATH, DirectRuntimeConnectionHub, startDirectRuntimeServer, } from "./direct-runtime-server.js";
+export type { DirectRuntimeAuthenticationResult, DirectRuntimeAuthenticator, DirectRuntimeEmulatorSurfaceAttachment, DirectRuntimeEmulatorSurfaceHost, DirectRuntimePeer, DirectRuntimeServer, DirectRuntimeServerLimits, StartDirectRuntimeServerOptions, } from "./direct-runtime-server.js";
+export { attachDirectRuntimeBrowserSurfaceServer, DirectRuntimeBrowserSurfaceHostError, } from "./direct-runtime-browser-surface-server.js";
+export { attachDirectRuntimeBrowserInspectServer, DirectRuntimeBrowserInspectHostError, } from "./direct-runtime-browser-inspect-server.js";
+export type { AttachDirectRuntimeBrowserInspectServerOptions, DirectRuntimeBrowserInspectAttachment, DirectRuntimeBrowserInspectConnectionHub, DirectRuntimeBrowserInspectHost, DirectRuntimeBrowserInspectServer, DirectRuntimeBrowserInspectServerLimits, DirectRuntimeBrowserInspectTransportCloseReason, } from "./direct-runtime-browser-inspect-server.js";
+export type { AttachDirectRuntimeBrowserSurfaceServerOptions, DirectRuntimeBrowserSurfaceAttachment, DirectRuntimeBrowserSurfaceAttachmentEvent, DirectRuntimeBrowserSurfaceConnectionHub, DirectRuntimeBrowserSurfaceHost, DirectRuntimeBrowserSurfaceServer, DirectRuntimeBrowserSurfaceServerLimits, DirectRuntimeBrowserSurfaceTransportCloseReason, } from "./direct-runtime-browser-surface-server.js";
+export { RemoteRuntimeDispatcher } from "./remote-runtime-dispatcher.js";
+export type { AuthenticatedRuntimeSubject, RemoteRuntimeEmulatorHost, RemoteRuntimeSessionEmulatorHost, RemoteRuntimeDispatchContext, RemoteRuntimeDispatcherOptions, } from "./remote-runtime-dispatcher.js";
+export { createRunnerSessionTerminalHost, SessionTerminalOpenError, SessionTerminalStreamError, } from "./session-terminal-host.js";
+export type { RunnerSessionTerminalHostOptions, RunnerSessionTerminalHost, SessionTerminalAttachment, SessionTerminalCloseInfo, SessionTerminalCloseReason, SessionTerminalHost, SessionTerminalOpenErrorCode, SessionTerminalOpenOptions, SessionTerminalRole, } from "./session-terminal-host.js";
 export type { ControlChannel, ControlChannelType, ControlInstanceConfig, ControlInstanceStatus, ControlAgentSummary, } from "@rynx-ai/protocol/control";
 export interface CreateAppOptions {
     config?: AppConfig;
@@ -20,16 +62,27 @@ export interface CreateAppOptions {
         sessionLog?: SessionLogStore;
         runnerManager?: RunnerManager;
         sessionStore?: CodexSessionStore;
+        pluginRuntimeStatus?: () => unknown;
+        pluginRuntimeReload?: (pluginId: string) => Promise<unknown>;
+        pluginRuntimeEnsure?: (pluginId: string) => Promise<unknown>;
+        daemonManagement?: DaemonManagementHost;
+        remoteRuntime?: DaemonRuntimeHost;
+        remoteRuntimeAdmin?: RemoteRuntimeAdminHost;
+        runtimeTargetControl?: RuntimeTargetControlHost;
+        runtimeWebAccess?: RuntimeWebAccessPolicy;
+        runtimeConnectionResolver?: RuntimeConnectionResolverHost;
+        localSessionResources?: LocalSessionResourceHost;
+        sessionEmulators?: SessionEmulatorService;
+        /** Host lifecycle signal for ending SSE/video streams before drain. */
+        shutdownSignal?: AbortSignal;
+        sessionRuntimeIndex?: SessionRuntimeIndex;
+        sessionLifecycle?: SessionResourceLifecycle;
+        runtimeLocalBrowser?: RuntimeLocalBrowserAutomationHost;
+        providerClis?: ProviderCliManagementHost;
     };
 }
 export interface StartServerOptions {
     config?: AppConfig;
-    /**
-     * Legacy: channel plugins to mount as one shared-context batch. Kept for
-     * back-compat (and tests); the daemon now uses {@link loadInstances} so each
-     * instance gets its own context. Empty ⇒ a pure `/health` server.
-     */
-    channelFactories?: ChannelFactory[];
     /** Static set of channel instances to mount, each with its own context. */
     channelInstances?: ChannelInstanceDescriptor[];
     /**
@@ -55,12 +108,311 @@ export interface StartServerOptions {
      * per session; the control plane lists every session uniformly from it.
      */
     sessionRegistry?: SessionRegistry;
+    /** Trusted daemon-side bridge for isolated plugin runners. Installed plugin
+     *  code never receives these objects; the bridge projects capability-gated
+     *  JSON RPC from them. */
+    pluginRuntime?: PluginRuntimeLifecycle;
+    /** Narrow, loopback-only bridge for resident-daemon management clients. */
+    daemonManagement?: DaemonManagementHost;
+    /** Transport-independent Remote Runtime application port. */
+    remoteRuntime?: DaemonRuntimeHost;
+    /** Loopback-only enrollment and client-grant administration. */
+    remoteRuntimeAdmin?: RemoteRuntimeAdminHost;
+    /** Local BFF authority for explicit Local or Direct Runtime targets. */
+    runtimeTargetControl?: RuntimeTargetControlHost;
+    /** Secret-owning backend resolver for explicit Local or Direct Runtime calls. */
+    runtimeConnectionResolver?: RuntimeConnectionResolverHost;
+    /** In-process resource authority used only by the Local Runtime BFF. */
+    localSessionResources?: LocalSessionResourceHost;
+    /** Runtime-owned Session Emulator binding authority for Local compatibility routes. */
+    sessionEmulators?: SessionEmulatorService;
+    /** Pre-composed daemon-owned Session runtime. Supplying this lets the daemon
+     *  inject the same application service into Local HTTP and Direct Runtime
+     *  adapters without mirroring Session state into another owner. */
+    sessionRuntimeServices?: SessionRuntimeServices;
+    /** Shared fence for Session-owned resources on canonical and legacy deletes. */
+    sessionLifecycle?: SessionResourceLifecycle;
+    /** Shared local terminal host. Supplying this lets Local HTTP/WebSocket and
+     *  Direct Runtime attachments contribute to one activity count. */
+    sessionTerminals?: SessionTerminalHost;
+    /** Runtime-local, Session-capability-authorized CDP bootstrap. Never remote. */
+    runtimeLocalBrowser?: RuntimeLocalBrowserAutomationHost;
+    /** Runtime-owned provider CLI inspection and local lifecycle operations. */
+    providerClis?: ProviderCliManagementHost;
+    /** Private resident-app Browser Host socket, authenticated by daemonManagement. */
+    desktopBrowserHost?: Omit<AttachDesktopBrowserHostServerOptions, "managementToken">;
+}
+export interface SessionRuntimeServices {
+    sessionStore: CodexSessionStore;
+    runnerManager: RunnerManager;
+    sessionBus: SessionBus;
+    sessionRuntimeIndex: SessionRuntimeIndex;
+    conversationRuntime: ConversationRuntime;
+}
+export interface PluginRuntimeHostServices {
+    conversationRuntime: ConversationRuntime;
+    capabilities: AgentCapabilities;
+    sessionStore: AgentSessionStore;
+    sessionRegistry: SessionRegistry;
+    agentCatalog: {
+        list(): Promise<PluginAgentSummary[]>;
+        get(id: string): Promise<PluginAgentSummary | null>;
+        resolveExecution(input: {
+            defaultAgent?: string;
+            session: PluginSessionExecutionSnapshot;
+        }): Promise<PluginResolvedSessionExecution>;
+    };
+    interruptSession(sessionId: string): Promise<boolean>;
+    resolveSessionInteraction(sessionId: string, interactionId: string, resolution: SessionInteractionResolution): Promise<{
+        disposition: "applied" | "already_resolved" | "not_found" | "invalid";
+    }>;
+}
+export interface PluginRuntimeLifecycle {
+    bindHostServices(services: PluginRuntimeHostServices): void;
+    startPluginRuntimes(): Promise<void>;
+    reloadPluginRuntime(pluginId: string): Promise<unknown>;
+    ensurePluginRuntime(pluginId: string): Promise<unknown>;
+    /** Cached process/contribution health; must not block on plugin RPC. */
+    statusSnapshot(): unknown;
+    dispose(): Promise<void>;
+}
+export interface DaemonControlIdentity {
+    installationId: string;
+    algorithm: "Ed25519";
+    publicKey: string;
+}
+export interface PluginCliInvocationInput {
+    pluginId: string;
+    args: string[];
+    stdin?: string;
+}
+export interface PluginCliInvocationOutput {
+    code: number;
+    stdout: string;
+    stderr: string;
+    truncated: boolean;
+}
+export interface DaemonManagementInvocationContext {
+    signal: AbortSignal;
+}
+export interface PluginManagementHost {
+    listPlugins(): {
+        plugins: PluginManagementItem[];
+    } | Promise<{
+        plugins: PluginManagementItem[];
+    }>;
+    setPluginEnabled(pluginId: string, enabled: boolean): PluginManagementItem | undefined | Promise<PluginManagementItem | undefined>;
+    uninstallPlugin(pluginId: string): Promise<boolean>;
+    prepareInstallation(input: PluginInstallPrepareInput, context: DaemonManagementInvocationContext): Promise<PluginInstallPreparation>;
+    commitInstallation(token: string, input: PluginInstallCommitInput, context: DaemonManagementInvocationContext): Promise<PluginInstallCommitResult>;
+    cancelPreparation(token: string): boolean | Promise<boolean>;
+    dispose?(): void | Promise<void>;
+}
+export interface BrowserArtifactManagementHost {
+    install(input: DaemonBrowserArtifactInstallInput, context: DaemonManagementInvocationContext): Promise<DaemonBrowserArtifactInstallResult>;
+    update(input: DaemonBrowserArtifactUpdateInput, context: DaemonManagementInvocationContext): Promise<DaemonBrowserArtifactInstallResult>;
+    version(): DaemonBrowserArtifactVersionResult;
+    clean(): DaemonBrowserArtifactCleanResult;
+}
+export interface MaintenanceManagementHost {
+    cleanupSessions(input: DaemonCleanupSessionsInput): DaemonCleanupSessionsResult;
+}
+export interface ChromeInspectionManagementHost {
+    status(): DaemonChromeInspectionStatus | Promise<DaemonChromeInspectionStatus>;
+    configure(input: DaemonChromeInspectionConfigureInput): Promise<DaemonChromeInspectionStatus>;
+}
+/** The complete local management authority injected by the daemon composition root. */
+export interface DaemonManagementHost {
+    managementToken: string;
+    identity(): DaemonControlIdentity;
+    /** Public, non-secret health signal used to detect an in-place daemon rebuild. */
+    buildStatus?(): {
+        restartRequired: boolean;
+    };
+    /** Perform one final activity check and schedule shutdown only when idle. */
+    shutdownIfIdle?(): DaemonShutdownIfIdleResult;
+    /** Stateful plugin registry operations owned by the resident daemon. */
+    pluginManagement?: PluginManagementHost;
+    /** Stateful Chrome for Testing artifact operations owned by the daemon. */
+    browserArtifacts?: BrowserArtifactManagementHost;
+    /** Destructive maintenance operations over daemon-owned state. */
+    maintenance?: MaintenanceManagementHost;
+    /** Local Chrome DevTools discovery gateway configuration and readiness. */
+    chromeInspection?: ChromeInspectionManagementHost;
+    invokePluginCli(input: PluginCliInvocationInput, context: DaemonManagementInvocationContext): Promise<PluginCliInvocationOutput>;
+}
+/**
+ * Runtime-local Browser automation bootstrap. Returning `undefined` means the
+ * Session capability was not accepted; implementations must not reveal which
+ * half of the credential was wrong.
+ */
+export interface RuntimeLocalBrowserAutomationHost {
+    authorizeCredential(credential: RuntimeBrowserBootstrapCredential): boolean | Promise<boolean>;
+    endpointForCredential(credential: RuntimeBrowserBootstrapCredential): Promise<RuntimeBrowserEndpointDescriptor | undefined>;
+    endpointForSession(sessionId: string): Promise<RuntimeBrowserEndpointDescriptor>;
+}
+export interface RemoteRuntimeClientGrantView {
+    grantId: string;
+    clientId: string;
+    clientLabel: string | null;
+    clientKeyFingerprint: string;
+    authorities: string[];
+    createdAt: string;
+    revokedAt: string | null;
+    lastUsedAt: string | null;
 }
+/** Local operator authority for enabling new Direct clients and revoking them. */
+export interface RemoteRuntimeAdminHost {
+    listShareAddresses(): ControlRuntimeShareAddress[];
+    createPairingOffer(input?: {
+        clientLabel?: string;
+        /** Host or ws(s) endpoint advertised by this individual access link. */
+        address?: string;
+    }): PairingOffer;
+    listClientGrants(): RemoteRuntimeClientGrantView[];
+    revokeClientGrant(grantId: string): {
+        revoked: boolean;
+        closedConnections: number;
+    };
+    deleteRevokedClientGrant(grantId: string): {
+        deleted: boolean;
+    };
+}
+/** Secret-free Runtime target projection safe for the local Control Plane UI. */
+export interface RuntimeTargetView {
+    /** Client-local selector: the reserved `local` selector or an opaque daemon id. */
+    selector: string;
+    daemonId: string;
+    displayName: string;
+    binding: "local" | "direct";
+    endpoint?: string;
+    identityKeyFingerprint?: string;
+    createdAt?: string;
+}
+export interface RuntimeTargetTestResult {
+    target: RuntimeTargetView;
+    status: DaemonStatus;
+}
+export interface RuntimeTargetPairResult {
+    target: RuntimeTargetView;
+    /** Authenticated status probe completed before the target is reported paired. */
+    status: DaemonStatus;
+}
+/** Local backend seam; credentials and pinned identity keys never cross it. */
+export interface RuntimeTargetControlHost {
+    list(): RuntimeTargetView[] | Promise<RuntimeTargetView[]>;
+    pair(input: {
+        offer: unknown;
+        displayName?: string;
+        replaceExisting?: boolean;
+        expectedDaemonId?: string;
+    }): RuntimeTargetPairResult | Promise<RuntimeTargetPairResult>;
+    test(selector: string): RuntimeTargetTestResult | Promise<RuntimeTargetTestResult>;
+    forget(daemonId: string): {
+        forgotten: true;
+    } | Promise<{
+        forgotten: true;
+    }>;
+}
+/** Secret-free logical Runtime connection leased by the local Control Plane BFF. */
+export interface RuntimeConnectionLease {
+    readonly target: {
+        selector: string;
+        daemonId: string;
+    };
+    call<M extends RemoteRuntimeRpcMethod>(method: M, params: RemoteRuntimeRpcParams<M>, options?: {
+        signal?: AbortSignal;
+        timeoutMs?: number;
+    }): Promise<RemoteRuntimeRpcResultFor<M>>;
+    subscribeSessionEvents(sessionId: string, options?: {
+        signal?: AbortSignal;
+        timeoutMs?: number;
+    }): Promise<RuntimeSessionEventsSubscription>;
+    openSessionTerminal(sessionId: string, options: {
+        role: "owner" | "read-only";
+        cols: number;
+        rows: number;
+        signal?: AbortSignal;
+        timeoutMs?: number;
+    }): Promise<import("./session-terminal-host.js").SessionTerminalAttachment>;
+    openBrowserSurface(frame: RuntimeBrowserSurfaceOpenFrame, options?: {
+        signal?: AbortSignal;
+        timeoutMs?: number;
+    }): Promise<RuntimeBrowserSurfaceConnection>;
+    openBrowserInspect(target: RuntimeBrowserInspectTarget, options?: {
+        signal?: AbortSignal;
+        timeoutMs?: number;
+    }): Promise<RuntimeBrowserInspectConnection>;
+    openEmulatorSurface(sessionId: string, bindingId: string, options?: {
+        signal?: AbortSignal;
+        timeoutMs?: number;
+        maximumFrameRate?: number;
+    }): Promise<RuntimeEmulatorSurfaceConnection>;
+    release(): void;
+}
+/** Secret-free Browser presentation stream owned by one selected Runtime. */
+export interface RuntimeBrowserSurfaceConnection extends AsyncIterable<RuntimeBrowserSurfaceEvent> {
+    readonly ready: RuntimeBrowserSurfaceReadyFrame;
+    send(frame: Exclude<RuntimeBrowserSurfaceClientFrame, RuntimeBrowserSurfaceOpenFrame>): Promise<void>;
+    close(): Promise<void>;
+}
+export type RuntimeBrowserSurfaceEvent = Exclude<RuntimeBrowserSurfaceServerFrame, RuntimeBrowserSurfaceReadyFrame> | RuntimeBrowserSurfaceImageFrame;
+/** Dedicated transparent CDP stream owned by one selected Runtime page. */
+export interface RuntimeBrowserInspectConnection extends AsyncIterable<RuntimeBrowserInspectMessage> {
+    readonly daemonInstanceId: string;
+    send(message: RuntimeBrowserInspectMessage): Promise<void>;
+    close(): Promise<void>;
+}
+export interface RuntimeEmulatorSurfaceConnection extends AsyncIterable<RuntimeEmulatorSurfaceImageFrame> {
+    readonly ready: RuntimeEmulatorSurfaceReadyFrame;
+    sendTouch(point: {
+        phase: "begin" | "move" | "end";
+        x: number;
+        y: number;
+    }): Promise<void>;
+    close(): Promise<void>;
+}
+/** One Runtime-owned live Session tail. The lease must outlive this handle. */
+export interface RuntimeSessionEventsSubscription extends AsyncIterable<RemoteRuntimeSequencedSessionEvent> {
+    readonly sessionId: string;
+    readonly daemonInstanceId: string;
+    close(): Promise<void>;
+}
+/** Application-facing half of the daemon-owned connection manager. */
+export interface RuntimeConnectionResolverHost {
+    acquire(selector: string, options?: {
+        signal?: AbortSignal;
+    }): Promise<RuntimeConnectionLease>;
+}
+/** HTTP server plus an idempotent join point for all daemon-owned resources. */
+export interface RynxServer extends HttpServer {
+    /** Synchronously stop new HTTP admission without closing upgraded Hosts. */
+    stopAccepting(): void;
+    shutdown(): Promise<void>;
+}
+/** Preserve one session's mirror order without serializing unrelated sessions. */
+export declare class SessionMirrorQueue {
+    private readonly persist;
+    private readonly tails;
+    constructor(persist: (sessionId: string, event: SessionEvent) => Promise<void>);
+    enqueue(sessionId: string, event: SessionEvent): Promise<void>;
+}
+/**
+ * Compose the process-owned Session runtime once. The daemon may call this
+ * before creating its Direct dispatcher; {@link startServer} accepts the same
+ * bundle and therefore does not create a second bus, runtime index, or runner.
+ */
+export declare function createSessionRuntimeServices(input: {
+    config: AppConfig;
+    sessionLog?: SessionLogStore;
+    onMirrorError?: (error: unknown, sessionId: string) => void;
+    sessionContextProvider?: RunnerSessionContextProvider;
+}): SessionRuntimeServices;
 /**
  * The HTTP surface is just a liveness probe for container orchestration — all
  * agent capabilities are forwarded through the mounted channel plugins (the
  * Lark bot reaches its server over an outbound WebSocket long connection), so
  * no agent request / response / SSE endpoints are exposed here.
  */
-export declare function createApp({ control }?: CreateAppOptions): Koa<Koa.DefaultState, Koa.DefaultContext>;
-export declare function startServer({ config, channelFactories, channelInstances, loadInstances, control, sessionLog, sessionRegistry, }?: StartServerOptions): Promise<import("node:http").Server<typeof import("node:http").IncomingMessage, typeof import("node:http").ServerResponse>>;
+export declare function createApp({ config, control }?: CreateAppOptions): Koa<Koa.DefaultState, Koa.DefaultContext>;
+export declare function startServer({ config, channelInstances, loadInstances, control, sessionLog, sessionRegistry, pluginRuntime, daemonManagement, remoteRuntime, remoteRuntimeAdmin, runtimeTargetControl, runtimeConnectionResolver, localSessionResources, sessionEmulators, sessionRuntimeServices, sessionLifecycle, sessionTerminals, runtimeLocalBrowser, providerClis, desktopBrowserHost, }?: StartServerOptions): Promise<RynxServer>;