@skrr-ai/cli 0.1.114 → 0.1.116

package/dist/node_modules/@skrr-ai/auth-core/dist/cjs/daemonWire.js

@@ -1,614 +1,585 @@
 "use strict";
-/**
- * daemonWire.ts — the ONE declaration of every name the daemon and the API
- * put on the wire between them, with what each name is for (OSK-16617).
- *
- * `computerWire.ts` proved the pattern for one family: the names live in the
- * published package every end can import, and a boundary spec fails on a
- * second spelling. This module generalises it to the whole daemon wire. Each
- * entry declares:
- *
- *   - `direction` — who sends it. `bidirectional` means both ends send AND
- *     handle the same name (`rpc:request`, the model-proxy relay);
- *   - `delivery` — `acked` when the sender learns that it arrived (a Socket.IO
- *     acknowledgement callback, or an answer event named in `answeredBy`),
- *     `fire_and_forget` otherwise;
- *   - `stability` — `stable`: every supported daemon and API speak it, and a
- *     change needs a new capability; `experimental`: newer than the fleet, or
- *     declared ahead of a speaker (`dormant` says which), and its shape may
- *     still move; `deprecated`: kept only so an older peer is heard, never
- *     newly sent;
- *   - `capability` — the capability the daemon announces before the API may
- *     send it (or before the daemon itself sends it). `null` means the event
- *     predates capability gating and every supported daemon speaks it;
- *   - `payload` — the zod schema that validates it, NAMED (an export of
- *     `@skrr-ai/data-provider`, which owns every zod schema; this module stays
- *     zod-free so the browser, React Native and a bun-compiled daemon all load
- *     it), or `unvalidated`. "This event has no schema" is a recorded fact
- *     here, counted by `scripts/daemon-wire/unvalidated-ratchet.mjs`, which
- *     lets the count fall and never rise.
- *
- * Who checks it:
- *
- *   - `daemon/src/daemon-wire-registry.test.ts` parses the daemon's source and
- *     fails on an event the daemon handles or sends that is not declared here,
- *     or that it handles or sends against its declared direction;
- *   - `api/server/websocket/__tests__/daemonWireRegistry.spec.js` holds the
- *     API's SSE ingress table (`EXACT_DAEMON_INGRESS`) and its daemon-socket
- *     listeners to the same declarations. The API keeps its own table on
- *     purpose: the routing kind is server-owned, and an API booting on a stale
- *     package build must not lose routes;
- *   - `scripts/daemon-wire/generate-schema.mjs` writes
- *     `docs/protocol/daemon-wire.schema.json` from here (the Codex
- *     `generate-json-schema` analogue), and a spec fails when it is stale.
- *
- * Event names, never routing: a `{provider}` placeholder stands for one
- * session-provider spelling (`daemon:{provider}:request`). Which spellings are
- * heard is `firstPartyHarness.ts`'s and the API's `sessionProvider.js`'s
- * decision, not this table's.
- */
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.DAEMON_WIRE_NAMES = exports.DAEMON_WIRE = exports.DAEMON_WIRE_CARRIERS = exports.DAEMON_WIRE_STABILITIES = exports.DAEMON_WIRE_DELIVERIES = exports.DAEMON_WIRE_DIRECTIONS = void 0;
-exports.daemonWireEntry = daemonWireEntry;
-exports.daemonWireSends = daemonWireSends;
-exports.daemonWireHandles = daemonWireHandles;
-const computerWire_js_1 = require("./computerWire.js");
-// ---------------------------------------------------------------------------
-// Vocabulary
-// ---------------------------------------------------------------------------
-exports.DAEMON_WIRE_DIRECTIONS = [
-    'server_to_daemon',
-    'daemon_to_server',
-    'bidirectional',
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var daemonWire_exports = {};
+__export(daemonWire_exports, {
+  DAEMON_WIRE: () => DAEMON_WIRE,
+  DAEMON_WIRE_CARRIERS: () => DAEMON_WIRE_CARRIERS,
+  DAEMON_WIRE_DELIVERIES: () => DAEMON_WIRE_DELIVERIES,
+  DAEMON_WIRE_DIRECTIONS: () => DAEMON_WIRE_DIRECTIONS,
+  DAEMON_WIRE_NAMES: () => DAEMON_WIRE_NAMES,
+  DAEMON_WIRE_STABILITIES: () => DAEMON_WIRE_STABILITIES,
+  daemonWireEntry: () => daemonWireEntry,
+  daemonWireHandles: () => daemonWireHandles,
+  daemonWireSends: () => daemonWireSends
+});
+module.exports = __toCommonJS(daemonWire_exports);
+var import_desktopWire = require("./desktopWire.js");
+var import_computerWire = require("./computerWire.js");
+const DAEMON_WIRE_DIRECTIONS = [
+  "server_to_daemon",
+  "daemon_to_server",
+  "bidirectional"
 ];
-exports.DAEMON_WIRE_DELIVERIES = ['fire_and_forget', 'acked'];
-exports.DAEMON_WIRE_STABILITIES = ['stable', 'experimental', 'deprecated'];
-/**
- * How a name travels. `event` is its own Socket.IO / SSE event; `rpc` is a
- * `method` inside `rpc:request`, answered on `rpc:response` — the shape SSE
- * needs because it has no acknowledgement callback. Several older methods are
- * still ALSO their own event for a Socket.IO daemon, and are declared once
- * with both.
- */
-exports.DAEMON_WIRE_CARRIERS = ['event', 'rpc'];
-const UNVALIDATED = Object.freeze({ kind: 'unvalidated' });
-const EVENT = Object.freeze(['event']);
-const RPC = Object.freeze(['rpc']);
-const EVENT_AND_RPC = Object.freeze(['event', 'rpc']);
+const DAEMON_WIRE_DELIVERIES = ["fire_and_forget", "acked"];
+const DAEMON_WIRE_STABILITIES = ["stable", "experimental", "deprecated"];
+const DAEMON_WIRE_CARRIERS = ["event", "rpc"];
+const UNVALIDATED = Object.freeze({ kind: "unvalidated" });
+const EVENT = Object.freeze(["event"]);
+const RPC = Object.freeze(["rpc"]);
+const EVENT_AND_RPC = Object.freeze(["event", "rpc"]);
 function entry(name, direction, purpose, rest = {}) {
-    return Object.freeze({
-        name,
-        direction,
-        delivery: rest.delivery ?? 'fire_and_forget',
-        ...(rest.answeredBy ? { answeredBy: rest.answeredBy } : {}),
-        stability: rest.stability ?? 'stable',
-        capability: rest.capability ?? null,
-        ...(rest.serverCapability ? { serverCapability: rest.serverCapability } : {}),
-        carriers: rest.carriers ?? EVENT,
-        payload: rest.payload ?? UNVALIDATED,
-        purpose,
-        ...(rest.relayedFromClient ? { relayedFromClient: true } : {}),
-        ...(rest.dormant ? { dormant: rest.dormant } : {}),
-    });
+  return Object.freeze({
+    name,
+    direction,
+    delivery: rest.delivery ?? "fire_and_forget",
+    ...rest.answeredBy ? { answeredBy: rest.answeredBy } : {},
+    stability: rest.stability ?? "stable",
+    capability: rest.capability ?? null,
+    ...rest.serverCapability ? { serverCapability: rest.serverCapability } : {},
+    carriers: rest.carriers ?? EVENT,
+    payload: rest.payload ?? UNVALIDATED,
+    purpose,
+    ...rest.relayedFromClient ? { relayedFromClient: true } : {},
+    ...rest.dormant ? { dormant: rest.dormant } : {}
+  });
 }
-const toDaemon = (name, purpose, rest) => entry(name, 'server_to_daemon', purpose, rest);
-const toServer = (name, purpose, rest) => entry(name, 'daemon_to_server', purpose, rest);
-// Capability strings the daemon announces for the non-computer families. They
-// are DECLARED in the daemon (`dedicated-ssh.ts`, `dedicated-service-probe.ts`,
-// `terminal/…`, `connection.ts` BASE_TOOLS); the daemon spec fails when one
-// named here is not a string the daemon announces, so this is a reference to
-// that declaration, not a second one.
-const SSH_BRIDGE = 'ssh_bridge_v1';
-const SSH_STREAM_RESUME = 'ssh_stream_resume_v2';
-const SERVICES = 'services_v1';
-const PERSISTENT_TERMINAL = 'persistent_terminal_v1';
-const SESSION_TURN_DIFF_LIVE = 'session_turn_diff_live_v1';
-const WORKSPACE_ISOLATION_PROBE = 'workspace_isolation_probe_v1';
-const TOOL_RESPONSE_OUTBOX = 'tool_response_outbox_v1';
-const SESSION_STEER = 'session_steer_v1';
-// ---------------------------------------------------------------------------
-// Connection, identity, liveness
-// ---------------------------------------------------------------------------
+const toDaemon = (name, purpose, rest) => entry(name, "server_to_daemon", purpose, rest);
+const toServer = (name, purpose, rest) => entry(name, "daemon_to_server", purpose, rest);
+const SSH_BRIDGE = "ssh_bridge_v1";
+const SSH_STREAM_RESUME = "ssh_stream_resume_v2";
+const SERVICES = "services_v1";
+const PERSISTENT_TERMINAL = "persistent_terminal_v1";
+const SESSION_TURN_DIFF_LIVE = "session_turn_diff_live_v1";
+const WORKSPACE_ISOLATION_PROBE = "workspace_isolation_probe_v1";
+const TOOL_RESPONSE_OUTBOX = "tool_response_outbox_v1";
+const SESSION_STEER = "session_steer_v1";
 const CONNECTION = [
-    toServer('daemon:register', 'The daemon introduces itself: identity, version, capabilities, sessions it holds.', {
-        delivery: 'acked',
-        answeredBy: 'daemon:registered',
-    }),
-    toDaemon('daemon:registered', 'The API accepted a register: the binding, `serverCaps`, and the state version the daemon reconciles against.'),
-    toServer('daemon:heartbeat', 'Liveness and runtime state, every interval. Acked once the API announced `serverCaps.ackHeartbeat`.', {
-        delivery: 'acked',
-        serverCapability: 'ackHeartbeat',
-    }),
-    toDaemon('daemon:ping:request', 'A round-trip latency probe from the API.', {
-        delivery: 'acked',
-        answeredBy: 'daemon:ping:response',
-    }),
-    toServer('daemon:ping:response', 'The answer to `daemon:ping:request`, echoing its `pingId`.'),
-    toServer('daemon:shuttingDown', 'The daemon is draining before it exits, so the API can fail over without waiting for the socket to time out.'),
-    toDaemon('server:draining', 'This API task is draining: reconnect (after jitter) to another one.'),
-    toDaemon('auth:revoked', 'The credential this socket used was revoked: stop retrying and ask the person to sign in again.'),
-    toServer('daemon:auth-failed', 'The daemon could not refresh its own credential and needs the person to sign in again.'),
-    toServer('daemon:auth-warning', "The daemon's credential expires soon."),
-    toDaemon('error:unauthorized', 'The API refused an event this daemon sent, for lack of authority, naming the event.'),
-    toDaemon('error:validation', 'The API refused an event this daemon sent as malformed, naming the event.'),
-    toDaemon('daemon:update-available', 'A newer daemon release is available, or this one is below the supported floor.'),
-    toDaemon('daemon:consent-status', "The account's consent state as the API holds it, re-sent on change."),
-    toDaemon('daemon:managed-instructions:changed', 'The managed instruction block for this machine changed: sync it into CLAUDE.md / AGENTS.md.'),
-    toServer('daemon:cost:update', 'Spend observed on a session, for the cost meter.'),
-    toServer('daemon:usage:snapshot', 'The provider usage-limit snapshot the daemon read locally.'),
+  toServer("daemon:register", "The daemon introduces itself: identity, version, capabilities, sessions it holds.", {
+    delivery: "acked",
+    answeredBy: "daemon:registered"
+  }),
+  toDaemon("daemon:registered", "The API accepted a register: the binding, `serverCaps`, and the state version the daemon reconciles against."),
+  toServer("daemon:heartbeat", "Liveness and runtime state, every interval. Acked once the API announced `serverCaps.ackHeartbeat`.", {
+    delivery: "acked",
+    serverCapability: "ackHeartbeat"
+  }),
+  toDaemon("daemon:ping:request", "A round-trip latency probe from the API.", {
+    delivery: "acked",
+    answeredBy: "daemon:ping:response"
+  }),
+  toServer("daemon:ping:response", "The answer to `daemon:ping:request`, echoing its `pingId`."),
+  toServer("daemon:shuttingDown", "The daemon is draining before it exits, so the API can fail over without waiting for the socket to time out."),
+  toDaemon("server:draining", "This API task is draining: reconnect (after jitter) to another one."),
+  toDaemon("auth:revoked", "The credential this socket used was revoked: stop retrying and ask the person to sign in again."),
+  toDaemon("error:stale-process", "This daemon process was replaced by a fresher registration; stop transport drain recovery before disconnect.", {
+    payload: { kind: "zod", schema: "daemonConnectionFenceErrorSchema" }
+  }),
+  toDaemon("error:stale-generation", "This Dedicated Runtime generation is no longer active; stop transport drain recovery before disconnect.", {
+    payload: { kind: "zod", schema: "daemonConnectionFenceErrorSchema" }
+  }),
+  toDaemon("error:stale-binding", "This daemon credential was rebound to another account; stop transport drain recovery before disconnect.", {
+    payload: { kind: "zod", schema: "daemonConnectionFenceErrorSchema" }
+  }),
+  toServer("daemon:auth-failed", "The daemon could not refresh its own credential and needs the person to sign in again."),
+  toServer("daemon:auth-warning", "The daemon's credential expires soon."),
+  toDaemon("error:unauthorized", "The API refused an event this daemon sent, for lack of authority, naming the event."),
+  toDaemon("error:validation", "The API refused an event this daemon sent as malformed, naming the event."),
+  toDaemon("daemon:update-available", "A newer daemon release is available, or this one is below the supported floor."),
+  toDaemon("daemon:consent-status", "The account's consent state as the API holds it, re-sent on change."),
+  toDaemon("daemon:managed-instructions:changed", "The managed instruction block for this machine changed: sync it into CLAUDE.md / AGENTS.md."),
+  toServer("daemon:cost:update", "Spend observed on a session, for the cost meter."),
+  toServer("daemon:usage:snapshot", "The provider usage-limit snapshot the daemon read locally.")
 ];
-// ---------------------------------------------------------------------------
-// Control RPC — `rpc:request` / `rpc:response`, and the methods they carry
-// ---------------------------------------------------------------------------
 const RPC_ENVELOPE = [
-    entry('rpc:request', 'bidirectional', 'A correlated request `{id, method, payload}`; either end may ask. The method set is declared below.', {
-        delivery: 'acked',
-        answeredBy: 'rpc:response',
-    }),
-    entry('rpc:response', 'bidirectional', 'The answer to `rpc:request`, `{id, ok, result | error}`.'),
-    toServer('rpc:cancel', 'Abandon an in-flight `rpc:request` by id.', {
-        dormant: 'The API handles it (`websocket/rpc.js`); no daemon sends it, and a daemon-side call is bounded by its own timeout instead.',
-    }),
+  entry("rpc:request", "bidirectional", "A correlated request `{id, method, payload}`; either end may ask. The method set is declared below.", {
+    delivery: "acked",
+    answeredBy: "rpc:response"
+  }),
+  entry("rpc:response", "bidirectional", "The answer to `rpc:request`, `{id, ok, result | error}`."),
+  toServer("rpc:cancel", "Abandon an in-flight `rpc:request` by id.", {
+    dormant: "The API handles it (`websocket/rpc.js`); no daemon sends it, and a daemon-side call is bounded by its own timeout instead."
+  })
 ];
 const RPC_METHODS = [
-    toDaemon('daemon:list-dirs', 'List directories under a path, for the working-directory picker.', {
-        delivery: 'acked',
-        carriers: EVENT_AND_RPC,
-        relayedFromClient: true,
-    }),
-    toDaemon('daemon:set-cwd', "Change the daemon's working directory.", {
-        delivery: 'acked',
-        carriers: EVENT_AND_RPC,
-        relayedFromClient: true,
-    }),
-    toDaemon('daemon:list-skill-content', "Read one local skill's content, matched by path hash.", {
-        delivery: 'acked',
-        carriers: EVENT_AND_RPC,
-    }),
-    toDaemon('daemon:list-skills', 'The skills a session in a directory would see, for the `/` menu.', {
-        delivery: 'acked',
-        carriers: RPC,
-    }),
-    toDaemon('daemon:harness:list-models', 'The models the installed harness can run.', {
-        delivery: 'acked',
-        carriers: RPC,
-    }),
-    toDaemon('daemon:workspace:isolation-probe', 'Whether an isolated Run could be rooted where this machine would root it.', {
-        delivery: 'acked',
-        carriers: RPC,
-        capability: WORKSPACE_ISOLATION_PROBE,
-    }),
-    toDaemon('managed-instructions:preflight', 'Check a managed instruction block against local files before it is written.', {
-        delivery: 'acked',
-        carriers: RPC,
-    }),
-    toDaemon('daemon:get-local-signals-config', 'Read the local-signals (file drop) configuration.', {
-        delivery: 'acked',
-        carriers: EVENT_AND_RPC,
-        dormant: 'The API asks (`routes/daemons.js`), but only `connection-handlers/daemon-rpc.ts`, which nothing in production loads, answers; the live dispatcher replies "Unknown RPC method", which the route maps.',
-    }),
-    toDaemon('daemon:set-file-drop-watchers', 'Replace the local-signals file drop watchers.', {
-        delivery: 'acked',
-        carriers: EVENT_AND_RPC,
-        dormant: 'The API asks (`routes/daemons.js`), but only `connection-handlers/daemon-rpc.ts`, which nothing in production loads, answers; the live dispatcher replies "Unknown RPC method", which the route maps.',
-    }),
-    ...['list', 'install', 'update', 'get-job', 'rescan'].map((op) => toDaemon(`daemon:cli-installers:${op}`, `Managed harness CLI installers: ${op}.`, {
-        delivery: 'acked',
-        carriers: EVENT_AND_RPC,
-    })),
-    toDaemon('daemon.session.status', "A daemon session's live status.", {
-        delivery: 'acked',
-        carriers: RPC,
-    }),
-    toDaemon('daemon.session.steer', 'A follow-up into the running turn; acks whether the turn took it.', {
-        delivery: 'acked',
-        carriers: RPC,
-        capability: SESSION_STEER,
-        stability: 'experimental',
-    }),
-    toDaemon('daemon.session.stop', 'Stop one daemon session.', { delivery: 'acked', carriers: RPC }),
-    toDaemon('daemon.session.spawn', 'Start a daemon session under the daemon-session registry.', {
-        delivery: 'acked',
-        carriers: RPC,
-    }),
-    toDaemon('daemon.session.resume', 'Resume a daemon session under the daemon-session registry.', {
-        delivery: 'acked',
-        carriers: RPC,
-    }),
-    toDaemon('daemon.stop', 'Stop the daemon process.', { delivery: 'acked', carriers: RPC }),
-    toServer('daemon.session.claim', 'Claim a session actor under a fence before running it.', {
-        delivery: 'acked',
-        carriers: RPC,
-    }),
+  toDaemon("daemon:list-dirs", "List directories under a path, for the working-directory picker.", {
+    delivery: "acked",
+    carriers: EVENT_AND_RPC,
+    relayedFromClient: true
+  }),
+  toDaemon("daemon:set-cwd", "Change the daemon's working directory.", {
+    delivery: "acked",
+    carriers: EVENT_AND_RPC,
+    relayedFromClient: true
+  }),
+  toDaemon("daemon:list-skill-content", "Read one local skill's content, matched by path hash.", {
+    delivery: "acked",
+    carriers: EVENT_AND_RPC
+  }),
+  toDaemon("daemon:list-skills", "The skills a session in a directory would see, for the `/` menu.", {
+    delivery: "acked",
+    carriers: RPC
+  }),
+  toDaemon("daemon:harness:list-models", "The models the installed harness can run.", {
+    delivery: "acked",
+    carriers: RPC
+  }),
+  toDaemon("daemon:workspace:isolation-probe", "Whether an isolated Run could be rooted where this machine would root it.", {
+    delivery: "acked",
+    carriers: RPC,
+    capability: WORKSPACE_ISOLATION_PROBE
+  }),
+  toDaemon("managed-instructions:preflight", "Check a managed instruction block against local files before it is written.", {
+    delivery: "acked",
+    carriers: RPC
+  }),
+  toDaemon("daemon:get-local-signals-config", "Read the local-signals (file drop) configuration.", {
+    delivery: "acked",
+    carriers: EVENT_AND_RPC,
+    dormant: 'The API asks (`routes/daemons.js`), but only `connection-handlers/daemon-rpc.ts`, which nothing in production loads, answers; the live dispatcher replies "Unknown RPC method", which the route maps.'
+  }),
+  toDaemon("daemon:set-file-drop-watchers", "Replace the local-signals file drop watchers.", {
+    delivery: "acked",
+    carriers: EVENT_AND_RPC,
+    dormant: 'The API asks (`routes/daemons.js`), but only `connection-handlers/daemon-rpc.ts`, which nothing in production loads, answers; the live dispatcher replies "Unknown RPC method", which the route maps.'
+  }),
+  ...["list", "install", "update", "get-job", "rescan"].map((op) => toDaemon(`daemon:cli-installers:${op}`, `Managed harness CLI installers: ${op}.`, {
+    delivery: "acked",
+    carriers: EVENT_AND_RPC
+  })),
+  toDaemon("daemon.session.status", "A daemon session's live status.", {
+    delivery: "acked",
+    carriers: RPC
+  }),
+  toDaemon("daemon.session.steer", "A follow-up into the running turn; acks whether the turn took it.", {
+    delivery: "acked",
+    carriers: RPC,
+    capability: SESSION_STEER,
+    stability: "experimental"
+  }),
+  toDaemon("daemon.session.stop", "Stop one daemon session.", { delivery: "acked", carriers: RPC }),
+  toDaemon("daemon.session.spawn", "Start a daemon session under the daemon-session registry.", {
+    delivery: "acked",
+    carriers: RPC
+  }),
+  toDaemon("daemon.session.resume", "Resume a daemon session under the daemon-session registry.", {
+    delivery: "acked",
+    carriers: RPC
+  }),
+  toDaemon("daemon.stop", "Stop the daemon process.", { delivery: "acked", carriers: RPC }),
+  toServer("daemon.session.claim", "Claim a session actor under a fence before running it.", {
+    delivery: "acked",
+    carriers: RPC
+  })
 ];
-// ---------------------------------------------------------------------------
-// Sessions (a harness turn on the machine)
-// ---------------------------------------------------------------------------
 const SESSIONS = [
-    toDaemon('daemon:{provider}:request', 'Start or continue a harness session turn under this provider spelling.', {
-        delivery: 'acked',
-        answeredBy: 'daemon:{provider}:response',
-    }),
-    toServer('daemon:{provider}:response', "A session turn's output: envelopes, then its terminal fact. Acked as a durable receipt once the API announced `serverCaps.responseAck`.", {
-        delivery: 'acked',
-        serverCapability: 'responseAck',
-    }),
-    toDaemon('daemon:{provider}:cancel', 'Cancel a running session turn.', {
-        delivery: 'acked',
-        answeredBy: 'daemon:{provider}:cancel:ack',
-    }),
-    toServer('daemon:{provider}:cancel:ack', 'Whether the cancel reached a running turn.'),
-    toDaemon('daemon:local:request', 'A whole task for the daemon to run autonomously (hybrid local mode).', {
-        stability: 'deprecated',
-        dormant: 'The daemon still handles it; no API code sends it any more.',
-    }),
-    toServer('daemon:delivery:ack', 'The daemon received a dispatched request, so the API stops redelivering it.'),
-    toServer('daemon:session:accepted', 'The daemon accepted a session request and owns its execution.'),
-    toServer('daemon:session:actor:heartbeat', 'A running session actor is alive.'),
-    toServer('daemon:session:replay', 'Envelopes written to the offline queue while disconnected, replayed after register.', {
-        delivery: 'acked',
-    }),
-    toServer('daemon:session:turn-diff', "A running turn's diff, live (not an envelope).", {
-        capability: SESSION_TURN_DIFF_LIVE,
-        stability: 'experimental',
-    }),
-    toServer('daemon:claude:permission:request', 'A harness asks a person to approve a tool call.', {
-        delivery: 'acked',
-        answeredBy: 'daemon:claude:permission:response',
-    }),
-    toDaemon('daemon:claude:permission:response', "A person's answer to a permission request."),
-    entry('daemon:claude:permission:cancel', 'bidirectional', 'A permission request is no longer pending: the harness withdrew it, or the API timed it out.'),
-    toServer('daemon:claude:permission:mode', 'The harness changed its permission mode.'),
-    toServer('daemon:claude:question:request', 'A harness asks a person a question.', {
-        delivery: 'acked',
-        answeredBy: 'daemon:claude:question:response',
-    }),
-    toDaemon('daemon:claude:question:response', "A person's answer to a question."),
+  toDaemon("daemon:{provider}:request", "Start or continue a harness session turn under this provider spelling.", {
+    delivery: "acked",
+    answeredBy: "daemon:{provider}:response"
+  }),
+  toServer("daemon:{provider}:response", "A session turn's output: envelopes, then its terminal fact. Acked as a durable receipt once the API announced `serverCaps.responseAck`.", {
+    delivery: "acked",
+    serverCapability: "responseAck"
+  }),
+  toDaemon("daemon:{provider}:cancel", "Cancel a running session turn.", {
+    delivery: "acked",
+    answeredBy: "daemon:{provider}:cancel:ack"
+  }),
+  toServer("daemon:{provider}:cancel:ack", "Whether the cancel reached a running turn."),
+  toDaemon("daemon:local:request", "A whole task for the daemon to run autonomously (hybrid local mode).", {
+    stability: "deprecated",
+    dormant: "The daemon still handles it; no API code sends it any more."
+  }),
+  toServer("daemon:delivery:ack", "The daemon received a dispatched request, so the API stops redelivering it."),
+  toServer("daemon:session:accepted", "The daemon accepted a session request and owns its execution."),
+  toServer("daemon:session:actor:heartbeat", "A running session actor is alive."),
+  toServer("daemon:session:replay", "Envelopes written to the offline queue while disconnected, replayed after register.", {
+    delivery: "acked"
+  }),
+  toServer("daemon:session:turn-diff", "A running turn's diff, live (not an envelope).", {
+    capability: SESSION_TURN_DIFF_LIVE,
+    stability: "experimental"
+  }),
+  toServer("daemon:claude:permission:request", "A harness asks a person to approve a tool call.", {
+    delivery: "acked",
+    answeredBy: "daemon:claude:permission:response"
+  }),
+  toDaemon("daemon:claude:permission:response", "A person's answer to a permission request."),
+  entry("daemon:claude:permission:cancel", "bidirectional", "A permission request is no longer pending: the harness withdrew it, or the API timed it out."),
+  toServer("daemon:claude:permission:mode", "The harness changed its permission mode."),
+  toServer("daemon:claude:question:request", "A harness asks a person a question.", {
+    delivery: "acked",
+    answeredBy: "daemon:claude:question:response"
+  }),
+  toDaemon("daemon:claude:question:response", "A person's answer to a question.")
 ];
-// ---------------------------------------------------------------------------
-// Tools (the cloud agent's tool calls, proxied to the machine)
-// ---------------------------------------------------------------------------
 const TOOLS = [
-    toDaemon('daemon:tool:request', 'Run one tool call on this machine.', {
-        delivery: 'acked',
-        answeredBy: 'daemon:tool:response',
-    }),
-    toServer('daemon:tool:response', "A tool call's result. Written to the outbox and retried until acked once the API announced `serverCaps.toolResponseAck`; fire-and-forget otherwise.", {
-        delivery: 'acked',
-        serverCapability: 'toolResponseAck',
-        capability: TOOL_RESPONSE_OUTBOX,
-    }),
-    toDaemon('daemon:tool:cancel', 'Abandon a running tool call.'),
-    toServer('daemon:wire:chunk', 'One slice of a tool or session response above the single-message ceiling, sha256-checked and reassembled by the API before the reassembled event reaches its normal handler. Sent only to a server that announced `serverCaps.wireChunking`; the last slice is acked by that handler (OSK-16616).', {
-        delivery: 'acked',
-        stability: 'experimental',
-        serverCapability: 'wireChunking',
-        capability: 'wire_chunking_v1',
-    }),
+  toDaemon("daemon:tool:request", "Run one tool call on this machine.", {
+    delivery: "acked",
+    answeredBy: "daemon:tool:response"
+  }),
+  toServer("daemon:tool:response", "A tool call's result. Written to the outbox and retried until acked once the API announced `serverCaps.toolResponseAck`; fire-and-forget otherwise.", {
+    delivery: "acked",
+    serverCapability: "toolResponseAck",
+    capability: TOOL_RESPONSE_OUTBOX
+  }),
+  toDaemon("daemon:tool:cancel", "Abandon a running tool call."),
+  toDaemon("daemon:computer:use-control", "An authorized person observes, configures, stops or recovers the machine Computer Use provider.", {
+    stability: "experimental",
+    capability: "computer_use_mcp_v1",
+    delivery: "acked",
+    answeredBy: "daemon:computer:ack",
+    payload: { kind: "zod", schema: "daemonComputerUseControlSchema" }
+  }),
+  toDaemon("daemon:computer-use:rotate-credential", "The approved hosted-desktop owner requests credential rotation for this exact active machine lease generation.", {
+    stability: "experimental",
+    capability: "computer_use_mcp_v1",
+    delivery: "acked",
+    answeredBy: "daemon:computer:ack",
+    payload: { kind: "zod", schema: "daemonComputerUseRotateCredentialSchema" }
+  }),
+  toDaemon("daemon:computer-use:revoke", "Revoke cloud Computer Use bindings after owner machine authority was removed.", {
+    stability: "experimental",
+    capability: "computer_use_mcp_v1",
+    payload: { kind: "zod", schema: "daemonComputerUseRevokeSchema" }
+  }),
+  ...["subscribe", "protocol", "unsubscribe"].map((operation) => toDaemon(import_desktopWire.DAEMON_COMPUTER_DESKTOP_EVENTS[operation], `Read-only desktop stream: ${operation}; bound to an authenticated attachment and generation.`, {
+    stability: "experimental",
+    capability: import_desktopWire.COMPUTER_DESKTOP_CAPABILITY,
+    delivery: "acked",
+    answeredBy: "daemon:computer:ack",
+    payload: { kind: "zod", schema: `daemonComputerDesktop${operation[0].toUpperCase()}${operation.slice(1)}Schema` }
+  })),
+  ...["control", "input"].map((operation) => toDaemon(import_desktopWire.DAEMON_COMPUTER_DESKTOP_EVENTS[operation], `Human-only typed desktop ${operation}; exact authenticated attachment, stream and generation.`, {
+    stability: "experimental",
+    capability: import_desktopWire.COMPUTER_DESKTOP_CONTROL_CAPABILITY,
+    delivery: "acked",
+    answeredBy: "daemon:computer:ack",
+    payload: { kind: "zod", schema: `daemonComputerDesktop${operation[0].toUpperCase()}${operation.slice(1)}Schema` }
+  })),
+  toServer(import_desktopWire.DAEMON_COMPUTER_DESKTOP_EVENTS.controlChanged, "Private desktop holder and input revocation fact; never carries a control token.", {
+    stability: "experimental",
+    capability: import_desktopWire.COMPUTER_DESKTOP_CONTROL_CAPABILITY,
+    payload: { kind: "zod", schema: "computerDesktopControlResultSchema" }
+  }),
+  toServer(import_desktopWire.DAEMON_COMPUTER_DESKTOP_EVENTS.data, "Read-only desktop stream data or a terminal close fact for one attachment generation.", {
+    stability: "experimental",
+    capability: import_desktopWire.COMPUTER_DESKTOP_CAPABILITY,
+    payload: { kind: "zod", schema: "computerDesktopDataSchema" }
+  }),
+  toServer("daemon:wire:chunk", "One slice of a tool or session response above the single-message ceiling, sha256-checked and reassembled by the API before the reassembled event reaches its normal handler. Sent only to a server that announced `serverCaps.wireChunking`; the last slice is acked by that handler (OSK-16616).", {
+    delivery: "acked",
+    stability: "experimental",
+    serverCapability: "wireChunking",
+    capability: "wire_chunking_v1"
+  })
 ];
-// ---------------------------------------------------------------------------
-// Terminals
-// ---------------------------------------------------------------------------
 const TERMINALS = [
-    toDaemon('daemon:terminal:start', 'Open a terminal (persistent when `persistent: true` and announced).', {
-        delivery: 'acked',
-        answeredBy: 'daemon:terminal:start:ack',
-    }),
-    toServer('daemon:terminal:start:ack', 'Whether the terminal started.'),
-    toDaemon('daemon:terminal:input', 'Bytes typed into a terminal.'),
-    toDaemon('daemon:terminal:resize', "A terminal's new size."),
-    toDaemon('daemon:terminal:stop', 'Close a terminal.'),
-    toServer('daemon:terminal:output', 'Bytes a terminal wrote.'),
-    ...['list', 'kill', 'rename'].map((op) => toDaemon(`dedicated:terminal:${op}`, `Persistent terminal management: ${op}.`, {
-        delivery: 'acked',
-        answeredBy: 'dedicated:terminal:ack',
-        capability: PERSISTENT_TERMINAL,
-        relayedFromClient: true,
-    })),
-    toServer('dedicated:terminal:ack', 'The answer to a persistent terminal list / kill / rename, relayed to the asking client under the same name.', {
-        capability: PERSISTENT_TERMINAL,
-    }),
+  toDaemon("daemon:terminal:start", "Open a terminal (persistent when `persistent: true` and announced).", {
+    delivery: "acked",
+    answeredBy: "daemon:terminal:start:ack"
+  }),
+  toServer("daemon:terminal:start:ack", "Whether the terminal started."),
+  toDaemon("daemon:terminal:input", "Bytes typed into a terminal."),
+  toDaemon("daemon:terminal:resize", "A terminal's new size."),
+  toDaemon("daemon:terminal:stop", "Close a terminal."),
+  toServer("daemon:terminal:output", "Bytes a terminal wrote."),
+  ...["list", "kill", "rename"].map((op) => toDaemon(`dedicated:terminal:${op}`, `Persistent terminal management: ${op}.`, {
+    delivery: "acked",
+    answeredBy: "dedicated:terminal:ack",
+    capability: PERSISTENT_TERMINAL,
+    relayedFromClient: true
+  })),
+  toServer("dedicated:terminal:ack", "The answer to a persistent terminal list / kill / rename, relayed to the asking client under the same name.", {
+    capability: PERSISTENT_TERMINAL
+  })
 ];
-// ---------------------------------------------------------------------------
-// Dedicated Runtime guest
-// ---------------------------------------------------------------------------
 const DEDICATED = [
-    toDaemon('daemon:dedicated:quiesce', "Quiesce the guest's workload before a stop, so the workspace is consistent.", {
-        delivery: 'acked',
-        answeredBy: 'daemon:dedicated:quiesce:ack',
-    }),
-    toServer('daemon:dedicated:quiesce:ack', 'The quiesce outcome, when the transport has no acknowledgement callback.'),
-    toDaemon('daemon:dedicated:thaw', 'Release a quiesce.', {
-        delivery: 'acked',
-        answeredBy: 'daemon:dedicated:thaw:ack',
-    }),
-    toServer('daemon:dedicated:thaw:ack', 'The thaw outcome, when the transport has no acknowledgement callback.'),
-    toServer('daemon:dedicated:git-credential', "Mint a short-lived git credential for the guest's workload.", {
-        delivery: 'acked',
-    }),
-    ...['register', 'heartbeat', 'bye'].map((verb) => toServer(`daemon:agent-worker:${verb}`, `The guest agent worker's liveness lane: ${verb}.`)),
-    toDaemon('daemon:ssh:start', 'Open a tenant SSH channel.', {
-        delivery: 'acked',
-        answeredBy: 'daemon:ssh:start:ack',
-        capability: SSH_BRIDGE,
-    }),
-    toServer('daemon:ssh:start:ack', 'Whether the SSH channel opened.', { capability: SSH_BRIDGE }),
-    toDaemon('daemon:ssh:resume', "Resume an SSH channel's byte stream after a reconnect.", {
-        delivery: 'acked',
-        answeredBy: 'daemon:ssh:resume:ack',
-        capability: SSH_STREAM_RESUME,
-    }),
-    toServer('daemon:ssh:resume:ack', 'Whether the SSH stream resumed, and from where.', {
-        capability: SSH_STREAM_RESUME,
-    }),
-    toDaemon('daemon:ssh:input', 'Bytes into an SSH channel.', {
-        delivery: 'acked',
-        answeredBy: 'daemon:ssh:input:ack',
-        capability: SSH_BRIDGE,
-    }),
-    toServer('daemon:ssh:input:ack', 'Input received, for flow control.', { capability: SSH_BRIDGE }),
-    toDaemon('daemon:ssh:keepalive', 'Keep an idle SSH channel open.', { capability: SSH_BRIDGE }),
-    toDaemon('daemon:ssh:stop', 'Close an SSH channel.', { capability: SSH_BRIDGE }),
-    toServer('daemon:ssh:output', 'Bytes out of an SSH channel.', { capability: SSH_BRIDGE }),
-    toServer('daemon:ssh:closed', 'An SSH channel closed, with the reason.', {
-        capability: SSH_BRIDGE,
-    }),
-    ...['list', 'get', 'create', 'update', 'action', 'logs', 'approve', 'secret', 'exec'].map((op) => toDaemon(`daemon:service:${op}`, `Declared services: ${op}.`, {
-        delivery: 'acked',
-        answeredBy: 'daemon:service:ack',
-        capability: SERVICES,
-    })),
-    toDaemon('daemon:service:logs:stop', "Stop following a service's log.", { capability: SERVICES }),
-    toServer('daemon:service:ack', 'The answer to a `daemon:service:*` request, by `requestId`.', {
-        capability: SERVICES,
-    }),
-    toServer('daemon:service:state', 'A declared service changed state.', { capability: SERVICES }),
-    toServer('daemon:service:log', 'Lines from a followed service log.', { capability: SERVICES }),
-    toServer('daemon:service:log:closed', 'A followed service log ended.', { capability: SERVICES }),
-    toServer('daemon:service:proposed', 'The agent proposed a service for a person to approve.', {
-        capability: SERVICES,
-    }),
+  toDaemon("daemon:dedicated:quiesce", "Quiesce the guest's workload before a stop, so the workspace is consistent.", {
+    delivery: "acked",
+    answeredBy: "daemon:dedicated:quiesce:ack"
+  }),
+  toServer("daemon:dedicated:quiesce:ack", "The quiesce outcome, when the transport has no acknowledgement callback."),
+  toDaemon("daemon:dedicated:thaw", "Release a quiesce.", {
+    delivery: "acked",
+    answeredBy: "daemon:dedicated:thaw:ack"
+  }),
+  toServer("daemon:dedicated:thaw:ack", "The thaw outcome, when the transport has no acknowledgement callback."),
+  toServer("daemon:dedicated:git-credential", "Mint a short-lived git credential for the guest's workload.", {
+    delivery: "acked"
+  }),
+  ...["register", "heartbeat", "bye"].map((verb) => toServer(`daemon:agent-worker:${verb}`, `The guest agent worker's liveness lane: ${verb}.`)),
+  toDaemon("daemon:ssh:start", "Open a tenant SSH channel.", {
+    delivery: "acked",
+    answeredBy: "daemon:ssh:start:ack",
+    capability: SSH_BRIDGE
+  }),
+  toServer("daemon:ssh:start:ack", "Whether the SSH channel opened.", { capability: SSH_BRIDGE }),
+  toDaemon("daemon:ssh:resume", "Resume an SSH channel's byte stream after a reconnect.", {
+    delivery: "acked",
+    answeredBy: "daemon:ssh:resume:ack",
+    capability: SSH_STREAM_RESUME
+  }),
+  toServer("daemon:ssh:resume:ack", "Whether the SSH stream resumed, and from where.", {
+    capability: SSH_STREAM_RESUME
+  }),
+  toDaemon("daemon:ssh:input", "Bytes into an SSH channel.", {
+    delivery: "acked",
+    answeredBy: "daemon:ssh:input:ack",
+    capability: SSH_BRIDGE
+  }),
+  toServer("daemon:ssh:input:ack", "Input received, for flow control.", { capability: SSH_BRIDGE }),
+  toDaemon("daemon:ssh:keepalive", "Keep an idle SSH channel open.", { capability: SSH_BRIDGE }),
+  toDaemon("daemon:ssh:stop", "Close an SSH channel.", { capability: SSH_BRIDGE }),
+  toServer("daemon:ssh:output", "Bytes out of an SSH channel.", { capability: SSH_BRIDGE }),
+  toServer("daemon:ssh:closed", "An SSH channel closed, with the reason.", {
+    capability: SSH_BRIDGE
+  }),
+  ...["list", "get", "create", "update", "action", "logs", "approve", "secret", "exec"].map((op) => toDaemon(`daemon:service:${op}`, `Declared services: ${op}.`, {
+    delivery: "acked",
+    answeredBy: "daemon:service:ack",
+    capability: SERVICES
+  })),
+  toDaemon("daemon:service:logs:stop", "Stop following a service's log.", { capability: SERVICES }),
+  toServer("daemon:service:ack", "The answer to a `daemon:service:*` request, by `requestId`.", {
+    capability: SERVICES
+  }),
+  toServer("daemon:service:state", "A declared service changed state.", { capability: SERVICES }),
+  toServer("daemon:service:log", "Lines from a followed service log.", { capability: SERVICES }),
+  toServer("daemon:service:log:closed", "A followed service log ended.", { capability: SERVICES }),
+  toServer("daemon:service:proposed", "The agent proposed a service for a person to approve.", {
+    capability: SERVICES
+  })
 ];
-// ---------------------------------------------------------------------------
-// Model proxy (sandbox ⇄ home daemon, relayed by the API)
-// ---------------------------------------------------------------------------
-/**
- * Declared in `@skrr-ai/inference-broker` (`MODEL_PROXY_EVENTS`); the daemon
- * spec holds these to that table. Every name both enters and leaves the API:
- * the sandbox daemon sends a request the API relays to the home daemon, and
- * the home daemon's response is relayed back.
- */
 const MODEL_PROXY = [
-    entry('daemon:model-proxy:request', 'bidirectional', "A sandbox daemon's model request, relayed to the home daemon that holds the subscription."),
-    entry('daemon:model-proxy:cancel', 'bidirectional', 'Abort an in-flight model-proxy exchange.'),
-    entry('daemon:model-proxy:response', 'bidirectional', 'The response head, relayed back to the sandbox daemon.'),
-    entry('daemon:model-proxy:response:chunk', 'bidirectional', 'A response body chunk.'),
-    entry('daemon:model-proxy:response:end', 'bidirectional', 'The response ended.'),
+  entry("daemon:model-proxy:request", "bidirectional", "A sandbox daemon's model request, relayed to the home daemon that holds the subscription."),
+  entry("daemon:model-proxy:cancel", "bidirectional", "Abort an in-flight model-proxy exchange."),
+  entry("daemon:model-proxy:response", "bidirectional", "The response head, relayed back to the sandbox daemon."),
+  entry("daemon:model-proxy:response:chunk", "bidirectional", "A response body chunk."),
+  entry("daemon:model-proxy:response:end", "bidirectional", "The response ended.")
 ];
-// ---------------------------------------------------------------------------
-// Retired (accepted and ignored by the API so an older daemon is not refused)
-// ---------------------------------------------------------------------------
-/** The API's own list is `Computer/RetiredFamilies.js` `RETIRED_DAEMON_EVENTS`; its spec holds the two equal. */
 const RETIRED = [
-    'daemon:browser:liveview:frame',
-    'daemon:browser:liveview:state',
-    'daemon:browser:liveview:ack',
-    'daemon:browser:sessions',
-    'daemon:agent-terminal:state',
-    'daemon:agent-terminal:attach:ack',
-    'daemon:agent-terminal:control:ack',
-    'daemon:agent-terminal:error',
-    'daemon:terminal:run:chunk',
-].map((name) => toServer(name, 'Retired with the old browser live view and agent-terminal attach (OSK-13509); accepted and ignored.', {
-    stability: 'deprecated',
-    dormant: 'No current daemon sends it.',
+  "daemon:browser:liveview:frame",
+  "daemon:browser:liveview:state",
+  "daemon:browser:liveview:ack",
+  "daemon:browser:sessions",
+  "daemon:agent-terminal:state",
+  "daemon:agent-terminal:attach:ack",
+  "daemon:agent-terminal:control:ack",
+  "daemon:agent-terminal:error",
+  "daemon:terminal:run:chunk"
+].map((name) => toServer(name, "Retired with the old browser live view and agent-terminal attach (OSK-13509); accepted and ignored.", {
+  stability: "deprecated",
+  dormant: "No current daemon sends it."
 }));
-/**
- * One row per `DAEMON_COMPUTER_EVENTS` key. `satisfies Record<…>` makes a new
- * computer event a compile error here until it has a capability, a delivery
- * and a purpose. Requests that carry a `requestId` are answered on
- * `daemon:computer:ack`.
- */
 const COMPUTER_META = {
-    attach: {
-        capability: computerWire_js_1.COMPUTER_CAPABILITIES.computer,
-        acked: true,
-        purpose: 'Bind an attachment: its principal, operations and (dedicated) generation.',
-    },
-    detach: {
-        capability: computerWire_js_1.COMPUTER_CAPABILITIES.computer,
-        acked: false,
-        purpose: 'Unbind an attachment.',
-    },
-    grants: {
-        capability: computerWire_js_1.COMPUTER_CAPABILITIES.access,
-        acked: false,
-        purpose: "The machine's whole grant set, on registration and on every change.",
-    },
-    subscribe: {
-        capability: computerWire_js_1.COMPUTER_CAPABILITIES.computer,
-        acked: true,
-        purpose: 'Observe one surface.',
-    },
-    unsubscribe: {
-        capability: computerWire_js_1.COMPUTER_CAPABILITIES.computer,
-        acked: false,
-        purpose: 'Stop observing one surface.',
-    },
-    frameAck: {
-        capability: computerWire_js_1.COMPUTER_CAPABILITIES.browserObserve,
-        acked: false,
-        purpose: 'A viewer painted a page frame and wants the next.',
-    },
-    control: {
-        capability: computerWire_js_1.COMPUTER_CAPABILITIES.computer,
-        acked: true,
-        purpose: 'Take, release, request, grant or decline control of a surface.',
-    },
-    share: {
-        capability: computerWire_js_1.COMPUTER_CAPABILITIES.surfaceShare,
-        acked: true,
-        purpose: "Share or unshare a person's own surface with an agent session.",
-    },
-    input: {
-        capability: computerWire_js_1.COMPUTER_CAPABILITIES.computer,
-        acked: false,
-        purpose: 'One input from the control holder, carrying the lease epoch.',
-    },
-    open: {
-        capability: computerWire_js_1.COMPUTER_CAPABILITIES.computer,
-        acked: true,
-        purpose: "Open a person's own terminal or browser window.",
-    },
-    close: { capability: computerWire_js_1.COMPUTER_CAPABILITIES.computer, acked: true, purpose: 'Close a surface.' },
-    activityFill: {
-        capability: computerWire_js_1.COMPUTER_CAPABILITIES.computer,
-        acked: true,
-        purpose: 'The activity events after a `seq`, to fill a gap.',
-    },
-    filesWatch: {
-        capability: computerWire_js_1.COMPUTER_CAPABILITIES.filesWatch,
-        acked: true,
-        purpose: 'The directories expanded and files open, which scope the file watches.',
-    },
-    files: {
-        capability: computerWire_js_1.COMPUTER_CAPABILITIES.files,
-        acked: true,
-        purpose: 'One file operation, relayed from the machine file routes.',
-        stability: 'experimental',
-        dormant: 'Declared in computerWire.ts; the file routes reach the daemon as `File*` tool requests on `daemon:tool:request`, and neither end speaks this name.',
-    },
-    dialog: {
-        capability: computerWire_js_1.COMPUTER_CAPABILITIES.browserPage,
-        acked: true,
-        purpose: 'Answer a dialog the page is blocked on.',
-    },
-    copy: {
-        capability: computerWire_js_1.COMPUTER_CAPABILITIES.browserPage,
-        acked: true,
-        purpose: 'Copy-out: the text the person selected on the page.',
-    },
-    fileChooser: {
-        capability: computerWire_js_1.COMPUTER_CAPABILITIES.browserFileChooser,
-        acked: true,
-        purpose: 'Answer the file chooser a page opened.',
-    },
-    teaching: {
-        capability: computerWire_js_1.COMPUTER_CAPABILITIES.browserTeaching,
-        acked: true,
-        purpose: 'Control an explicitly selected, bounded browser teaching or activity-review capture.',
-    },
-    pin: {
-        capability: computerWire_js_1.COMPUTER_CAPABILITIES.surfacePin,
-        acked: false,
-        purpose: 'Pin or unpin the surface an open human-input request names.',
-    },
-    services: {
-        capability: computerWire_js_1.COMPUTER_CAPABILITIES.declaredServices,
-        acked: true,
-        purpose: "Declare, withdraw or list the machine's declared services.",
-    },
-    daemonLog: {
-        capability: computerWire_js_1.COMPUTER_CAPABILITIES.daemonLog,
-        acked: true,
-        purpose: "Read the tail of the daemon's own process log.",
-    },
-    ack: {
-        capability: computerWire_js_1.COMPUTER_CAPABILITIES.computer,
-        acked: false,
-        purpose: 'The answer to any computer request that carried a `requestId`.',
-    },
-    manifest: {
-        capability: computerWire_js_1.COMPUTER_CAPABILITIES.computer,
-        acked: false,
-        purpose: 'A whole manifest, or a revisioned delta.',
-    },
-    data: {
-        capability: computerWire_js_1.COMPUTER_CAPABILITIES.computer,
-        acked: false,
-        purpose: 'Terminal bytes with a byte cursor, or a page frame.',
-    },
-    activity: {
-        capability: computerWire_js_1.COMPUTER_CAPABILITIES.computer,
-        acked: false,
-        purpose: 'Activity events.',
-    },
-    detached: {
-        capability: computerWire_js_1.COMPUTER_CAPABILITIES.computer,
-        acked: false,
-        purpose: 'The daemon detached an attachment itself, e.g. its grant was revoked.',
-    },
-    filesChanged: {
-        capability: computerWire_js_1.COMPUTER_CAPABILITIES.filesWatch,
-        acked: false,
-        purpose: "One attachment's scoped watches saw changes, or went stale.",
-    },
-    diagnostics: {
-        capability: computerWire_js_1.COMPUTER_CAPABILITIES.diagnostics,
-        acked: false,
-        purpose: "The daemon's frame-lane counters while anyone is attached.",
-    },
+  attach: {
+    capability: import_computerWire.COMPUTER_CAPABILITIES.computer,
+    acked: true,
+    purpose: "Bind an attachment: its principal, operations and (dedicated) generation."
+  },
+  detach: {
+    capability: import_computerWire.COMPUTER_CAPABILITIES.computer,
+    acked: false,
+    purpose: "Unbind an attachment."
+  },
+  grants: {
+    capability: import_computerWire.COMPUTER_CAPABILITIES.access,
+    acked: false,
+    purpose: "The machine's whole grant set, on registration and on every change."
+  },
+  subscribe: {
+    capability: import_computerWire.COMPUTER_CAPABILITIES.computer,
+    acked: true,
+    purpose: "Observe one surface."
+  },
+  unsubscribe: {
+    capability: import_computerWire.COMPUTER_CAPABILITIES.computer,
+    acked: false,
+    purpose: "Stop observing one surface."
+  },
+  frameAck: {
+    capability: import_computerWire.COMPUTER_CAPABILITIES.browserObserve,
+    acked: false,
+    purpose: "A viewer painted a page frame and wants the next."
+  },
+  control: {
+    capability: import_computerWire.COMPUTER_CAPABILITIES.computer,
+    acked: true,
+    purpose: "Take, release, request, grant or decline control of a surface."
+  },
+  share: {
+    capability: import_computerWire.COMPUTER_CAPABILITIES.surfaceShare,
+    acked: true,
+    purpose: "Share or unshare a person's own surface with an agent session."
+  },
+  input: {
+    capability: import_computerWire.COMPUTER_CAPABILITIES.computer,
+    acked: false,
+    purpose: "One input from the control holder, carrying the lease epoch."
+  },
+  open: {
+    capability: import_computerWire.COMPUTER_CAPABILITIES.computer,
+    acked: true,
+    purpose: "Open a person's own terminal or browser window."
+  },
+  close: { capability: import_computerWire.COMPUTER_CAPABILITIES.computer, acked: true, purpose: "Close a surface." },
+  activityFill: {
+    capability: import_computerWire.COMPUTER_CAPABILITIES.computer,
+    acked: true,
+    purpose: "The activity events after a `seq`, to fill a gap."
+  },
+  filesWatch: {
+    capability: import_computerWire.COMPUTER_CAPABILITIES.filesWatch,
+    acked: true,
+    purpose: "The directories expanded and files open, which scope the file watches."
+  },
+  files: {
+    capability: import_computerWire.COMPUTER_CAPABILITIES.files,
+    acked: true,
+    purpose: "One file operation, relayed from the machine file routes.",
+    stability: "experimental",
+    dormant: "Declared in computerWire.ts; the file routes reach the daemon as `File*` tool requests on `daemon:tool:request`, and neither end speaks this name."
+  },
+  dialog: {
+    capability: import_computerWire.COMPUTER_CAPABILITIES.browserPage,
+    acked: true,
+    purpose: "Answer a dialog the page is blocked on."
+  },
+  copy: {
+    capability: import_computerWire.COMPUTER_CAPABILITIES.browserPage,
+    acked: true,
+    purpose: "Copy-out: the text the person selected on the page."
+  },
+  fileChooser: {
+    capability: import_computerWire.COMPUTER_CAPABILITIES.browserFileChooser,
+    acked: true,
+    purpose: "Answer the file chooser a page opened."
+  },
+  teaching: {
+    capability: import_computerWire.COMPUTER_CAPABILITIES.browserTeaching,
+    acked: true,
+    purpose: "Control an explicitly selected, bounded browser teaching or activity-review capture."
+  },
+  pin: {
+    capability: import_computerWire.COMPUTER_CAPABILITIES.surfacePin,
+    acked: false,
+    purpose: "Pin or unpin the surface an open human-input request names."
+  },
+  services: {
+    capability: import_computerWire.COMPUTER_CAPABILITIES.declaredServices,
+    acked: true,
+    purpose: "Declare, withdraw or list the machine's declared services."
+  },
+  daemonLog: {
+    capability: import_computerWire.COMPUTER_CAPABILITIES.daemonLog,
+    acked: true,
+    purpose: "Read the tail of the daemon's own process log."
+  },
+  ack: {
+    capability: import_computerWire.COMPUTER_CAPABILITIES.computer,
+    acked: false,
+    purpose: "The answer to any computer request that carried a `requestId`."
+  },
+  manifest: {
+    capability: import_computerWire.COMPUTER_CAPABILITIES.computer,
+    acked: false,
+    purpose: "A whole manifest, or a revisioned delta."
+  },
+  data: {
+    capability: import_computerWire.COMPUTER_CAPABILITIES.computer,
+    acked: false,
+    purpose: "Terminal bytes with a byte cursor, or a page frame."
+  },
+  activity: {
+    capability: import_computerWire.COMPUTER_CAPABILITIES.computer,
+    acked: false,
+    purpose: "Activity events."
+  },
+  detached: {
+    capability: import_computerWire.COMPUTER_CAPABILITIES.computer,
+    acked: false,
+    purpose: "The daemon detached an attachment itself, e.g. its grant was revoked."
+  },
+  filesChanged: {
+    capability: import_computerWire.COMPUTER_CAPABILITIES.filesWatch,
+    acked: false,
+    purpose: "One attachment's scoped watches saw changes, or went stale."
+  },
+  diagnostics: {
+    capability: import_computerWire.COMPUTER_CAPABILITIES.diagnostics,
+    acked: false,
+    purpose: "The daemon's frame-lane counters while anyone is attached."
+  }
 };
-const REPORT_KEYS = new Set(computerWire_js_1.DAEMON_COMPUTER_REPORT_EVENT_KEYS);
-const COMPUTER = Object.keys(computerWire_js_1.DAEMON_COMPUTER_EVENTS).map((key) => {
-    const meta = COMPUTER_META[key];
-    return entry(computerWire_js_1.DAEMON_COMPUTER_EVENTS[key], REPORT_KEYS.has(key) ? 'daemon_to_server' : 'server_to_daemon', meta.purpose, {
-        delivery: meta.acked ? 'acked' : 'fire_and_forget',
-        ...(meta.acked ? { answeredBy: computerWire_js_1.DAEMON_COMPUTER_EVENTS.ack } : {}),
-        capability: meta.capability,
-        stability: meta.stability ?? 'stable',
-        payload: { kind: 'zod', schema: `DAEMON_COMPUTER_EVENT_PAYLOAD_SCHEMAS.${key}` },
-        ...(meta.dormant ? { dormant: meta.dormant } : {}),
-    });
+const REPORT_KEYS = new Set(import_computerWire.DAEMON_COMPUTER_REPORT_EVENT_KEYS);
+const COMPUTER = Object.keys(import_computerWire.DAEMON_COMPUTER_EVENTS).map((key) => {
+  const meta = COMPUTER_META[key];
+  return entry(import_computerWire.DAEMON_COMPUTER_EVENTS[key], REPORT_KEYS.has(key) ? "daemon_to_server" : "server_to_daemon", meta.purpose, {
+    delivery: meta.acked ? "acked" : "fire_and_forget",
+    ...meta.acked ? { answeredBy: import_computerWire.DAEMON_COMPUTER_EVENTS.ack } : {},
+    capability: meta.capability,
+    stability: meta.stability ?? "stable",
+    payload: { kind: "zod", schema: `DAEMON_COMPUTER_EVENT_PAYLOAD_SCHEMAS.${key}` },
+    ...meta.dormant ? { dormant: meta.dormant } : {}
+  });
 });
-// ---------------------------------------------------------------------------
-// The registry
-// ---------------------------------------------------------------------------
-/** Every daemon ⇄ API name, in declaration order (which the generated schema keeps). */
-exports.DAEMON_WIRE = Object.freeze([
-    ...CONNECTION,
-    ...RPC_ENVELOPE,
-    ...RPC_METHODS,
-    ...SESSIONS,
-    ...TOOLS,
-    ...TERMINALS,
-    ...DEDICATED,
-    ...MODEL_PROXY,
-    ...COMPUTER,
-    ...RETIRED,
+const DAEMON_WIRE = Object.freeze([
+  ...CONNECTION,
+  ...RPC_ENVELOPE,
+  ...RPC_METHODS,
+  ...SESSIONS,
+  ...TOOLS,
+  ...TERMINALS,
+  ...DEDICATED,
+  ...MODEL_PROXY,
+  ...COMPUTER,
+  ...RETIRED
 ]);
-exports.DAEMON_WIRE_NAMES = Object.freeze(exports.DAEMON_WIRE.map((e) => e.name));
-const BY_NAME = new Map(exports.DAEMON_WIRE.map((e) => [e.name, e]));
-const TEMPLATED = exports.DAEMON_WIRE.filter((e) => e.name.includes('{')).map((e) => ({
-    entry: e,
-    pattern: new RegExp(`^${e.name
-        .split(/(\{[a-zA-Z]+\})/)
-        .map((part) => /^\{[a-zA-Z]+\}$/.test(part)
-        ? '[a-z0-9][a-z0-9-]*'
-        : part.replace(/[.*+?^${}()|[\]\\]/g, '\\$&'))
-        .join('')}$`),
+const DAEMON_WIRE_NAMES = Object.freeze(DAEMON_WIRE.map((e) => e.name));
+const BY_NAME = new Map(DAEMON_WIRE.map((e) => [e.name, e]));
+const TEMPLATED = DAEMON_WIRE.filter((e) => e.name.includes("{")).map((e) => ({
+  entry: e,
+  pattern: new RegExp(`^${e.name.split(/(\{[a-zA-Z]+\})/).map((part) => /^\{[a-zA-Z]+\}$/.test(part) ? "[a-z0-9][a-z0-9-]*" : part.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")).join("")}$`)
 }));
-/**
- * The declaration a concrete name belongs to, or null. An exact declaration
- * wins over a templated one: `daemon:ping:response` is its own event, not a
- * `daemon:{provider}:response`. A templated match says only that the SHAPE is
- * declared; whether a provider spelling is heard is the API's decision.
- */
 function daemonWireEntry(name) {
-    const exact = BY_NAME.get(name);
-    if (exact)
-        return exact;
-    return TEMPLATED.find((t) => t.pattern.test(name))?.entry ?? null;
+  const exact = BY_NAME.get(name);
+  if (exact)
+    return exact;
+  return TEMPLATED.find((t) => t.pattern.test(name))?.entry ?? null;
 }
-/** Whether `direction` lets `end` send the name. */
-function daemonWireSends(entry, end) {
-    if (entry.direction === 'bidirectional')
-        return true;
-    return end === 'daemon'
-        ? entry.direction === 'daemon_to_server'
-        : entry.direction === 'server_to_daemon';
+function daemonWireSends(entry2, end) {
+  if (entry2.direction === "bidirectional")
+    return true;
+  return end === "daemon" ? entry2.direction === "daemon_to_server" : entry2.direction === "server_to_daemon";
 }
-/** Whether `direction` lets `end` handle the name. */
-function daemonWireHandles(entry, end) {
-    return daemonWireSends(entry, end === 'daemon' ? 'server' : 'daemon');
+function daemonWireHandles(entry2, end) {
+  return daemonWireSends(entry2, end === "daemon" ? "server" : "daemon");
 }
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  DAEMON_WIRE,
+  DAEMON_WIRE_CARRIERS,
+  DAEMON_WIRE_DELIVERIES,
+  DAEMON_WIRE_DIRECTIONS,
+  DAEMON_WIRE_NAMES,
+  DAEMON_WIRE_STABILITIES,
+  daemonWireEntry,
+  daemonWireHandles,
+  daemonWireSends
+});