@rynx-ai/server 0.1.0 → 0.1.9

package/dist/remote-runtime-session-projection.js

@@ -0,0 +1,556 @@
+import { boundSessionInteractionRouting, sessionInteractionRoutingSkeletonBytes, SESSION_INTERACTION_STRUCTURAL_LIMITS, } from "@rynx-ai/protocol";
+import { parseRemoteRuntimeSessionEventsFrame, parseRemoteRuntimeSessionListResult, parseRemoteRuntimeSessionSnapshotResult, REMOTE_RUNTIME_SESSION_MAX_EVENT_BYTES, REMOTE_RUNTIME_SESSION_MAX_ITEM_BYTES, REMOTE_RUNTIME_SESSION_MAX_PAYLOAD_BYTES, truncateRemoteRuntimeSessionPayload, } from "@rynx-ai/protocol/remote-runtime-rpc";
+const MAX_RPC_RESULT_BYTES = 60 * 1_024;
+const MAX_TRUNCATIONS = 64;
+const MAX_TITLE_CHARS = 1_024;
+const MAX_DESCRIPTION_CHARS = 8_192;
+const MAX_PROJECTED_RUNTIME_BYTES = 10 * 1024;
+export class RemoteRuntimeSessionProjectionError extends Error {
+    constructor(message, options) {
+        super(message, options);
+        this.name = "RemoteRuntimeSessionProjectionError";
+    }
+}
+/** Validate the list application result without truncating identity or summaries. */
+export function projectRemoteRuntimeSessionListResult(value) {
+    if (isRecord(value) && value.directoryTruncated === true) {
+        throw new RemoteRuntimeSessionProjectionError("Remote Session directory exceeded its application scan bound");
+    }
+    const projected = parseRemoteRuntimeSessionListResult(value);
+    assertByteBudget(projected, MAX_RPC_RESULT_BYTES, "Remote Session list result");
+    return projected;
+}
+/** Project canonical history payloads into the bounded Direct Runtime DTO. */
+export function projectRemoteRuntimeSessionSnapshotResult(value) {
+    const items = value.items.map((item) => projectRemoteRuntimeSessionItem(item));
+    const runtime = projectRuntimeSnapshot(value.runtime);
+    const candidate = {
+        sessionId: value.sessionId,
+        items,
+        runtime,
+        hasMore: value.hasMore,
+        ...(value.nextAfterId === undefined ? {} : { nextAfterId: value.nextAfterId }),
+    };
+    const refs = [
+        ...items.flatMap((item) => collectItemPayloadRefs(item)),
+    ];
+    fitAggregate(candidate, refs, MAX_RPC_RESULT_BYTES, "Remote Session snapshot result");
+    for (const item of items) {
+        fitAggregate(item, collectItemPayloadRefs(item), REMOTE_RUNTIME_SESSION_MAX_ITEM_BYTES, `Remote Session item ${item.id}`);
+    }
+    try {
+        return parseRemoteRuntimeSessionSnapshotResult(candidate);
+    }
+    catch (error) {
+        throw projectionError("Remote Session snapshot cannot be represented safely", error);
+    }
+}
+function projectRuntimeSnapshot(value) {
+    const runtime = structuredClone(value);
+    if (!isRecord(runtime) || !Array.isArray(runtime.pendingInteractions))
+        return runtime;
+    const pendingInteractions = runtime.pendingInteractions.map((entry) => {
+        if (!isRecord(entry) || !isRecord(entry.interaction))
+            return entry;
+        return {
+            responseId: entry.responseId,
+            interactionId: entry.interaction.interactionId,
+        };
+    });
+    if (!Array.isArray(runtime.activeResponseIds)) {
+        runtime.pendingInteractions = pendingInteractions;
+        return runtime;
+    }
+    const originalActive = runtime.activeResponseIds;
+    const projected = {
+        status: runtime.status,
+        activeResponseIds: [],
+        pendingInteractions: [],
+    };
+    const active = projected.activeResponseIds;
+    for (const responseId of originalActive) {
+        active.push(responseId);
+        if (byteLengthJson(projected) <= MAX_PROJECTED_RUNTIME_BYTES)
+            continue;
+        active.pop();
+        break;
+    }
+    const pending = projected.pendingInteractions;
+    for (const entry of pendingInteractions) {
+        pending.push(entry);
+        if (byteLengthJson(projected) <= MAX_PROJECTED_RUNTIME_BYTES)
+            continue;
+        pending.pop();
+        break;
+    }
+    if (active.length < originalActive.length) {
+        addOmission(projected, "activeResponseIds", originalActive.length, originalActive.length - active.length);
+    }
+    if (pending.length < pendingInteractions.length) {
+        addOmission(projected, "pendingInteractions", pendingInteractions.length, pendingInteractions.length - pending.length);
+    }
+    return projected;
+}
+/** Project one canonical durable item, preserving every identity and array entry. */
+export function projectRemoteRuntimeSessionItem(item) {
+    const projected = structuredClone(item);
+    boundHistoricalInteractionRouting(projected);
+    const refs = collectItemPayloadRefs(projected);
+    boundPayloads(refs);
+    fitAggregate(projected, refs, REMOTE_RUNTIME_SESSION_MAX_ITEM_BYTES, `Remote Session item ${item.id}`);
+    validateProjectedItem(projected);
+    return projected;
+}
+function boundHistoricalInteractionRouting(item) {
+    if (item.type !== "interaction_request" || !isRecord(item.data))
+        return;
+    const interaction = item.data.interaction;
+    if (!isRecord(interaction) || !Array.isArray(interaction.fields) || !Array.isArray(interaction.actions)) {
+        return;
+    }
+    let bounded;
+    try {
+        bounded = boundSessionInteractionRouting(interaction);
+    }
+    catch {
+        return;
+    }
+    const originalEntries = interactionOptionCount(interaction);
+    const retainedEntries = interactionOptionCount(bounded);
+    if (retainedEntries === originalEntries)
+        return;
+    item.data.interaction = bounded;
+    addOmission(item, "data.interaction.fields[*].options", originalEntries, originalEntries - retainedEntries);
+    if (sessionInteractionRoutingSkeletonBytes(bounded) >
+        SESSION_INTERACTION_STRUCTURAL_LIMITS.routingSkeletonBytes) {
+        throw new RemoteRuntimeSessionProjectionError("Remote Session interaction routing identities exceed the canonical budget");
+    }
+}
+function interactionOptionCount(interaction) {
+    return interaction.fields.reduce((total, field) => total + (field.type === "select" ? field.options.length : 0), 0);
+}
+/** Project one live event and reject any event that can be proven cross-session. */
+export function projectRemoteRuntimeSessionEvent(event, expectedSessionId) {
+    if (expectedSessionId !== undefined)
+        assertEventScope(event, expectedSessionId);
+    const projected = structuredClone(event);
+    projectNestedEventItems(projected);
+    const refs = collectEventPayloadRefs(projected);
+    boundPayloads(refs);
+    fitAggregate(projected, refs, REMOTE_RUNTIME_SESSION_MAX_EVENT_BYTES, "Remote Session event");
+    for (const item of eventItemRecords(projected)) {
+        fitAggregate(item, collectItemPayloadRefs(item), REMOTE_RUNTIME_SESSION_MAX_ITEM_BYTES, "Remote Session event item");
+    }
+    try {
+        const frame = parseRemoteRuntimeSessionEventsFrame({
+            type: "session.events.event",
+            subscriptionId: "projection",
+            event: projected,
+        });
+        if (frame.type !== "session.events.event")
+            throw new Error("unexpected event frame");
+        return frame.event;
+    }
+    catch (error) {
+        throw projectionError("Remote Session event cannot be represented safely", error);
+    }
+}
+function validateProjectedItem(item) {
+    try {
+        parseRemoteRuntimeSessionSnapshotResult({
+            sessionId: item.sessionId,
+            items: [item],
+            runtime: { status: "idle", activeResponseIds: [], pendingInteractions: [] },
+            hasMore: false,
+        });
+    }
+    catch (error) {
+        throw projectionError(`Remote Session item ${item.id} cannot be represented safely`, error);
+    }
+}
+function projectNestedEventItems(event) {
+    if (event.type === "response.output_item.done" ||
+        event.type === "session.input.consumed" ||
+        event.type === "session.interaction.requested" ||
+        event.type === "session.interaction.resolved" ||
+        event.type === "session.interaction.cancelled") {
+        if (isRecord(event.item)) {
+            event.item = projectRemoteRuntimeSessionItem(event.item);
+        }
+        // The durable interaction_request item is authoritative. Carrying the
+        // canonical top-level duplicate over Direct makes legal routing values
+        // impossible to fit in the fixed frame budget.
+        if (event.type === "session.interaction.requested")
+            delete event.interaction;
+    }
+}
+function collectItemPayloadRefs(item) {
+    const refs = [];
+    const data = isRecord(item.data) ? item.data : undefined;
+    if (!data)
+        return refs;
+    switch (item.type) {
+        case "message":
+            collectContentParts(data.content, "data.content", item, refs);
+            break;
+        case "function_call":
+            addRef(data, "arguments", "data.arguments", item, refs, 16_384, true);
+            break;
+        case "function_call_output":
+            addRef(data, "output", "data.output", item, refs, 16_384, true);
+            break;
+        case "reasoning":
+            collectContentParts(data.summary, "data.summary", item, refs);
+            break;
+        case "terminal_command":
+            addRef(data, "command", "data.command", item, refs, 16_384, true);
+            addOptionalRef(data, "stdout", "data.stdout", item, refs, 16_384, true);
+            addOptionalRef(data, "stderr", "data.stderr", item, refs, 16_384, true);
+            break;
+        case "interaction_request":
+            collectInteraction(data.interaction, "data.interaction", item, refs);
+            break;
+        case "interaction_resolution":
+            collectInteractionResolution(data.resolution, "data.resolution", item, refs);
+            addOptionalRef(data, "reason", "data.reason", item, refs, MAX_DESCRIPTION_CHARS, true);
+            break;
+        case "error":
+            addRef(data, "message", "data.message", item, refs, 16_384, true);
+            break;
+    }
+    return refs;
+}
+function collectEventPayloadRefs(event) {
+    const refs = eventItemRecords(event).flatMap((item) => collectItemPayloadRefs(item));
+    switch (event.type) {
+        case "session.status":
+            addOptionalRef(event, "note", "note", event, refs, MAX_DESCRIPTION_CHARS, true);
+            break;
+        case "response.output_text.delta":
+        case "response.reasoning_summary_text.delta":
+        case "response.function_call_output.delta":
+            addRef(event, "delta", "delta", event, refs, 16_384, true);
+            break;
+        case "session.interaction.resolved":
+            collectInteractionResolution(event.resolution, "resolution", event, refs);
+            break;
+        case "session.interaction.cancelled":
+            addOptionalRef(event, "reason", "reason", event, refs, MAX_DESCRIPTION_CHARS, true);
+            break;
+        case "response.completed":
+            collectJsonStrings(event.usage, "usage", event, refs, 0);
+            break;
+        case "response.failed":
+            if (isRecord(event.error)) {
+                addRef(event.error, "message", "error.message", event, refs, 16_384, true);
+            }
+            break;
+        case "session.todos":
+            if (Array.isArray(event.todos)) {
+                event.todos.forEach((todo, index) => {
+                    if (isRecord(todo)) {
+                        addRef(todo, "subject", `todos[${index}].subject`, event, refs, MAX_DESCRIPTION_CHARS, true, "todos[*].subject");
+                    }
+                });
+            }
+            break;
+    }
+    return refs;
+}
+function collectInteraction(value, prefix, owner, refs) {
+    if (!isRecord(value))
+        return;
+    addRef(value, "title", `${prefix}.title`, owner, refs, MAX_TITLE_CHARS, true);
+    addOptionalRef(value, "description", `${prefix}.description`, owner, refs, MAX_DESCRIPTION_CHARS, true);
+    if (isRecord(value.context)) {
+        const context = value.context;
+        addOptionalRef(context, "summary", `${prefix}.context.summary`, owner, refs, MAX_DESCRIPTION_CHARS, true);
+        addOptionalRef(context, "toolName", `${prefix}.context.toolName`, owner, refs, MAX_TITLE_CHARS, true);
+        addOptionalRef(context, "command", `${prefix}.context.command`, owner, refs, 16_384, true);
+        addOptionalRef(context, "cwd", `${prefix}.context.cwd`, owner, refs, 4_096, true);
+        addOptionalRef(context, "diff", `${prefix}.context.diff`, owner, refs, 16_384, true);
+    }
+    if (Array.isArray(value.fields)) {
+        value.fields.forEach((field, index) => {
+            if (!isRecord(field))
+                return;
+            const fieldPrefix = `${prefix}.fields[${index}]`;
+            addRef(field, "label", `${fieldPrefix}.label`, owner, refs, MAX_TITLE_CHARS, true, `${prefix}.fields[*].label`);
+            addOptionalRef(field, "description", `${fieldPrefix}.description`, owner, refs, MAX_DESCRIPTION_CHARS, true, `${prefix}.fields[*].description`);
+            addOptionalRef(field, "placeholder", `${fieldPrefix}.placeholder`, owner, refs, MAX_TITLE_CHARS, true, `${prefix}.fields[*].placeholder`);
+            if (Array.isArray(field.options)) {
+                field.options.forEach((option, optionIndex) => {
+                    if (!isRecord(option))
+                        return;
+                    const optionPrefix = `${fieldPrefix}.options[${optionIndex}]`;
+                    addRef(option, "label", `${optionPrefix}.label`, owner, refs, MAX_TITLE_CHARS, true, `${prefix}.fields[*].options[*].label`);
+                    addOptionalRef(option, "description", `${optionPrefix}.description`, owner, refs, MAX_DESCRIPTION_CHARS, true, `${prefix}.fields[*].options[*].description`);
+                });
+            }
+        });
+    }
+    if (Array.isArray(value.actions)) {
+        value.actions.forEach((action, index) => {
+            if (!isRecord(action))
+                return;
+            const actionPrefix = `${prefix}.actions[${index}]`;
+            addRef(action, "label", `${actionPrefix}.label`, owner, refs, MAX_TITLE_CHARS, true, `${prefix}.actions[*].label`);
+            addOptionalRef(action, "description", `${actionPrefix}.description`, owner, refs, MAX_DESCRIPTION_CHARS, true, `${prefix}.actions[*].description`);
+        });
+    }
+}
+function collectInteractionResolution(value, prefix, owner, refs) {
+    if (!isRecord(value) || !isRecord(value.answers))
+        return;
+    for (const [key, answer] of Object.entries(value.answers)) {
+        if (typeof answer === "string") {
+            addRef(value.answers, key, `${prefix}.answers.${key}`, owner, refs, 16_384, true);
+        }
+        else if (Array.isArray(answer)) {
+            answer.forEach((entry, index) => {
+                if (typeof entry === "string") {
+                    addArrayRef(answer, index, `${prefix}.answers.${key}[${index}]`, owner, refs, 16_384, true);
+                }
+            });
+        }
+    }
+}
+function collectContentParts(value, prefix, owner, refs) {
+    if (!Array.isArray(value))
+        return;
+    value.forEach((part, index) => {
+        if (isRecord(part))
+            addRef(part, "text", `${prefix}[${index}].text`, owner, refs, 16_384, true);
+    });
+}
+function collectJsonStrings(value, prefix, owner, refs, depth) {
+    if (depth > 8)
+        return;
+    if (Array.isArray(value)) {
+        value.forEach((entry, index) => {
+            if (typeof entry === "string") {
+                addArrayRef(value, index, `${prefix}[${index}]`, owner, refs, 16_384, true);
+            }
+            else {
+                collectJsonStrings(entry, `${prefix}[${index}]`, owner, refs, depth + 1);
+            }
+        });
+        return;
+    }
+    if (!isRecord(value))
+        return;
+    for (const [key, entry] of Object.entries(value)) {
+        if (typeof entry === "string") {
+            addRef(value, key, `${prefix}.${key}`, owner, refs, 16_384, true);
+        }
+        else {
+            collectJsonStrings(entry, `${prefix}.${key}`, owner, refs, depth + 1);
+        }
+    }
+}
+function addOptionalRef(container, key, field, owner, refs, maxChars, allowEmpty, metadataField) {
+    if (container[key] !== undefined) {
+        addRef(container, key, field, owner, refs, maxChars, allowEmpty, metadataField);
+    }
+}
+function addArrayRef(container, index, field, owner, refs, maxChars, allowEmpty) {
+    addRef(container, String(index), field, owner, refs, maxChars, allowEmpty);
+}
+function addRef(container, key, field, owner, refs, maxChars, allowEmpty, metadataField = field) {
+    const value = container[key];
+    if (typeof value !== "string")
+        return;
+    const existing = existingOriginalBytes(owner, metadataField);
+    const currentBytes = byteLength(value);
+    if (existing !== undefined && existing < currentBytes) {
+        throw new RemoteRuntimeSessionProjectionError(`invalid truncation metadata for ${field}`);
+    }
+    refs.push({
+        container,
+        key,
+        field,
+        metadataField,
+        owner,
+        originalUtf8Bytes: existing ?? currentBytes,
+        maxChars,
+        allowEmpty,
+    });
+}
+function boundPayloads(refs) {
+    for (const ref of refs) {
+        const current = currentText(ref);
+        let next = safeCharacterPrefix(current, ref.maxChars);
+        next = truncateRemoteRuntimeSessionPayload(next, REMOTE_RUNTIME_SESSION_MAX_PAYLOAD_BYTES).text;
+        if (next !== current)
+            applyTruncation(ref, next);
+    }
+}
+function fitAggregate(value, refs, maxBytes, field) {
+    let size = byteLengthJson(value);
+    let attempts = 0;
+    while (size > maxBytes) {
+        const candidates = refs
+            .map((ref) => ({ ref, bytes: byteLength(currentText(ref)), jsonBytes: byteLengthJson(currentText(ref)) }))
+            .filter(({ ref, bytes }) => bytes > minimumBytes(ref))
+            .sort((left, right) => right.jsonBytes - left.jsonBytes || left.ref.field.localeCompare(right.ref.field));
+        const candidate = candidates[0];
+        if (!candidate) {
+            throw new RemoteRuntimeSessionProjectionError(`${field} exceeds ${maxBytes} bytes without truncatable payload`);
+        }
+        const overflow = size - maxBytes;
+        const target = Math.max(minimumBytes(candidate.ref), candidate.bytes - Math.max(1, overflow));
+        const next = truncateRemoteRuntimeSessionPayload(currentText(candidate.ref), target).text;
+        if (next === currentText(candidate.ref)) {
+            throw new RemoteRuntimeSessionProjectionError(`${field} cannot make projection progress`);
+        }
+        applyTruncation(candidate.ref, next);
+        const nextSize = byteLengthJson(value);
+        if (nextSize >= size && attempts > refs.length) {
+            throw new RemoteRuntimeSessionProjectionError(`${field} truncation metadata exceeds its savings`);
+        }
+        size = nextSize;
+        attempts += 1;
+        if (attempts > 10_000)
+            throw new RemoteRuntimeSessionProjectionError(`${field} projection did not converge`);
+    }
+}
+function applyTruncation(ref, text) {
+    if (!ref.allowEmpty && text.length === 0) {
+        throw new RemoteRuntimeSessionProjectionError(`${ref.field} cannot be projected to an empty value`);
+    }
+    ref.container[ref.key] = text;
+    const truncations = truncationList(ref.owner);
+    const existing = truncations.find((entry) => entry.field === ref.metadataField);
+    if (existing) {
+        existing.originalUtf8Bytes = Math.max(existing.originalUtf8Bytes, ref.originalUtf8Bytes);
+        return;
+    }
+    if (truncations.length >= MAX_TRUNCATIONS) {
+        throw new RemoteRuntimeSessionProjectionError(`projection exceeds ${MAX_TRUNCATIONS} truncation records`);
+    }
+    if (ref.metadataField.length === 0 ||
+        ref.metadataField.length > 256 ||
+        /[\u0000-\u001f\u007f]/.test(ref.metadataField)) {
+        throw new RemoteRuntimeSessionProjectionError("projection field path is not representable");
+    }
+    truncations.push({ field: ref.metadataField, originalUtf8Bytes: ref.originalUtf8Bytes });
+    ref.owner.truncations = truncations;
+}
+function addOmission(owner, field, originalEntries, omittedEntries) {
+    if (omittedEntries <= 0)
+        return;
+    const omissions = omissionList(owner);
+    const existing = omissions.find((entry) => entry.field === field);
+    if (existing) {
+        existing.originalEntries = Math.max(existing.originalEntries, originalEntries);
+        existing.omittedEntries = Math.max(existing.omittedEntries, omittedEntries);
+    }
+    else {
+        omissions.push({ field, originalEntries, omittedEntries, reason: "wire_budget" });
+    }
+    owner.omissions = omissions;
+}
+function omissionList(owner) {
+    if (owner.omissions === undefined)
+        return [];
+    if (!Array.isArray(owner.omissions)) {
+        throw new RemoteRuntimeSessionProjectionError("invalid existing omission metadata");
+    }
+    return owner.omissions.map((entry) => {
+        if (!isRecord(entry) ||
+            typeof entry.field !== "string" ||
+            !Number.isSafeInteger(entry.originalEntries) ||
+            entry.originalEntries <= 0 ||
+            !Number.isSafeInteger(entry.omittedEntries) ||
+            entry.omittedEntries <= 0 ||
+            entry.omittedEntries > entry.originalEntries ||
+            entry.reason !== "wire_budget") {
+            throw new RemoteRuntimeSessionProjectionError("invalid existing omission metadata");
+        }
+        return entry;
+    });
+}
+function truncationList(owner) {
+    if (owner.truncations === undefined)
+        return [];
+    if (!Array.isArray(owner.truncations)) {
+        throw new RemoteRuntimeSessionProjectionError("invalid existing truncation metadata");
+    }
+    return owner.truncations.map((entry) => {
+        if (!isRecord(entry) ||
+            typeof entry.field !== "string" ||
+            !Number.isSafeInteger(entry.originalUtf8Bytes) ||
+            entry.originalUtf8Bytes <= 0) {
+            throw new RemoteRuntimeSessionProjectionError("invalid existing truncation metadata");
+        }
+        return entry;
+    });
+}
+function existingOriginalBytes(owner, field) {
+    return truncationList(owner).find((entry) => entry.field === field)?.originalUtf8Bytes;
+}
+function currentText(ref) {
+    const value = ref.container[ref.key];
+    if (typeof value !== "string") {
+        throw new RemoteRuntimeSessionProjectionError(`${ref.field} changed during projection`);
+    }
+    return value;
+}
+function minimumBytes(ref) {
+    if (ref.allowEmpty)
+        return 0;
+    const current = currentText(ref);
+    const first = [...current][0];
+    return first === undefined ? 0 : byteLength(first);
+}
+function safeCharacterPrefix(value, maxChars) {
+    if (value.length <= maxChars)
+        return value;
+    let end = maxChars;
+    const code = value.charCodeAt(end - 1);
+    if (code >= 0xd800 && code <= 0xdbff)
+        end -= 1;
+    return value.slice(0, end);
+}
+function eventItemRecords(event) {
+    return isRecord(event.item) ? [event.item] : [];
+}
+function assertEventScope(event, expectedSessionId) {
+    let actual;
+    switch (event.type) {
+        case "session.status":
+        case "response.created":
+        case "session.interaction.requested":
+        case "session.interaction.resolved":
+        case "session.interaction.cancelled":
+        case "session.todos":
+        case "session.rotated":
+            actual = event.sessionId;
+            break;
+        case "response.output_item.done":
+        case "session.input.consumed":
+            actual = event.item.sessionId;
+            break;
+    }
+    if (actual !== undefined && actual !== expectedSessionId) {
+        throw new RemoteRuntimeSessionProjectionError("Remote Session event belongs to another session");
+    }
+}
+function assertByteBudget(value, maxBytes, field) {
+    const size = byteLengthJson(value);
+    if (size > maxBytes) {
+        throw new RemoteRuntimeSessionProjectionError(`${field} exceeds ${maxBytes} bytes`);
+    }
+}
+function byteLength(value) {
+    return Buffer.byteLength(value, "utf8");
+}
+function byteLengthJson(value) {
+    return Buffer.byteLength(JSON.stringify(value), "utf8");
+}
+function isRecord(value) {
+    return Boolean(value) && typeof value === "object" && !Array.isArray(value);
+}
+function projectionError(message, cause) {
+    return new RemoteRuntimeSessionProjectionError(message, { cause });
+}

package/dist/remote-runtime.d.ts

@@ -0,0 +1,22 @@
+import { type DaemonStatus } from "@rynx-ai/protocol/remote-runtime";
+/** Encoding-neutral application snapshot for one daemon Runtime incarnation. */
+export interface DaemonRuntimeSnapshot {
+    daemonId: string;
+    daemonInstanceId: string;
+    coreProtocolVersion: number;
+    minimumCompatibleCoreVersion: number;
+    semanticCapabilities: readonly string[];
+    startedAt: Date;
+}
+/** Transport-independent application port exposed through Local or Direct bindings. */
+export interface DaemonRuntimeHost {
+    status(): DaemonRuntimeSnapshot;
+}
+/**
+ * Freeze the boot snapshot at daemon startup while returning defensive copies
+ * to adapters. A future live capability registry may replace this factory
+ * without changing the host contract or boot identity fields.
+ */
+export declare function createDaemonRuntimeHost(input: DaemonRuntimeSnapshot): DaemonRuntimeHost;
+/** Map the application snapshot onto the current JSON Core wire DTO. */
+export declare function encodeDaemonStatus(status: DaemonRuntimeSnapshot): DaemonStatus;

package/dist/remote-runtime.js

@@ -0,0 +1,32 @@
+import { parseDaemonStatus, } from "@rynx-ai/protocol/remote-runtime";
+/**
+ * Freeze the boot snapshot at daemon startup while returning defensive copies
+ * to adapters. A future live capability registry may replace this factory
+ * without changing the host contract or boot identity fields.
+ */
+export function createDaemonRuntimeHost(input) {
+    const dto = encodeDaemonStatus(input);
+    const status = {
+        ...dto,
+        semanticCapabilities: [...dto.semanticCapabilities],
+        startedAt: new Date(dto.startedAt),
+    };
+    return {
+        status: () => ({
+            ...status,
+            semanticCapabilities: [...status.semanticCapabilities],
+            startedAt: new Date(status.startedAt),
+        }),
+    };
+}
+/** Map the application snapshot onto the current JSON Core wire DTO. */
+export function encodeDaemonStatus(status) {
+    if (!(status.startedAt instanceof Date) || !Number.isFinite(status.startedAt.getTime())) {
+        throw new Error("invalid daemon Runtime status: startedAt must be a valid Date");
+    }
+    return parseDaemonStatus({
+        ...status,
+        semanticCapabilities: [...status.semanticCapabilities],
+        startedAt: status.startedAt.toISOString(),
+    });
+}

package/dist/runtime-web-auth.d.ts

@@ -0,0 +1,21 @@
+import type { IncomingMessage } from "node:http";
+export declare const RUNTIME_WEB_CAPABILITY_HEADER = "x-rynx-runtime-capability";
+export declare const RUNTIME_WEB_CAPABILITY_QUERY = "capability";
+/**
+ * Process-lifetime CSRF capability shared by the Runtime HTTP BFF and its
+ * browser WebSocket upgrades. It is not a daemon-management credential.
+ */
+export declare const RUNTIME_WEB_CAPABILITY: string;
+export interface RuntimeWebAuthorizationFailure {
+    status: 401 | 403;
+    error: "loopback_only" | "invalid_host" | "cross_origin" | "invalid_runtime_capability";
+}
+/**
+ * Authorize a browser request before any Runtime lease or terminal is opened.
+ * Socket address and the original Host header are both checked to resist DNS
+ * rebinding; mutation metadata and the capability provide the CSRF fence.
+ */
+export declare function authorizeRuntimeWebRequest(request: IncomingMessage, options?: {
+    mutation?: boolean;
+    capability?: string;
+}): RuntimeWebAuthorizationFailure | undefined;