@synoi/gateway-lite 0.1.0

package/dist/cdro-mirror.js

@@ -0,0 +1,280 @@
+"use strict";
+/**
+ * cdro-mirror.ts — SRAID Phases 4-6 dual-write framework.
+ *
+ * Phase 4 (decision_receipt CDROs):
+ *   Every Decision Receipt that lands in the SQLite receipts table is
+ *   ALSO mirrored as a CDRO into an EdgeStore-backed store. Readers stay
+ *   pointed at the SQLite table until the parity audit clears.
+ *
+ * Phase 5 (gateway_manifest CDROs):
+ *   The build-manifest.ts script emits the legacy dist/manifest.json AND
+ *   a CDRO form alongside. The integrity heartbeat sends both
+ *   manifest_sha256 (legacy) and manifest_oid (new) so the control plane
+ *   sees the migration progress without breaking older gateways.
+ *
+ * Phase 6 (license CDROs):
+ *   The control plane mirrors license records as CDROs at issue/rotate
+ *   time. The CDRO mirror lives in this module's symmetric form on the
+ *   control plane (see synoi-control/src/licensing/cdro-mirror.ts).
+ *
+ * Failures are non-fatal. The SQLite write is load-bearing; the CDRO
+ * mirror is best-effort. If the mirror fails, the production path keeps
+ * working — the gateway-side parity report flags the gap.
+ *
+ * Storage:
+ *   - DB path: $SYNOI_DATA_DIR/cdro-mirror.db (separate from vault.db
+ *     and receipts.db; we don't want CDRO migration to affect cache or
+ *     receipt verification semantics).
+ *   - Scope per object_type: `receipts`, `manifest`, `license`.
+ */
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.mirrorReceipt = mirrorReceipt;
+exports.buildReceiptCdro = buildReceiptCdro;
+exports.mirrorManifest = mirrorManifest;
+exports.buildManifestCdro = buildManifestCdro;
+exports.getMirroredReceipt = getMirroredReceipt;
+exports.getMirroredManifest = getMirroredManifest;
+exports.cdroMirrorStats = cdroMirrorStats;
+exports._resetForTests = _resetForTests;
+const node_fs_1 = __importDefault(require("node:fs"));
+const node_os_1 = __importDefault(require("node:os"));
+const node_path_1 = __importDefault(require("node:path"));
+const vault_1 = require("@synoi/vault");
+const DEFAULT_DIR = process.env.SYNOI_DATA_DIR ?? node_path_1.default.join(node_os_1.default.homedir(), '.synoi');
+let _store = null;
+let _enabled = process.env.SYNOI_CDRO_MIRROR !== '0';
+const _stats = {
+    enabled: _enabled,
+    total_writes: 0,
+    total_failures: 0,
+    by_type: {},
+    last_error: null,
+    last_error_type: null,
+    store_path: null,
+};
+function lazyStore() {
+    if (!_enabled)
+        return null;
+    if (_store)
+        return _store;
+    try {
+        // openDatabase() appends 'synoi.db' to the path. Give it a dedicated
+        // subdir so the CDRO-mirror DB lives under
+        // $SYNOI_DATA_DIR/cdro-mirror/synoi.db without colliding with the
+        // gateway's other SQLite files.
+        const dir = node_path_1.default.join(DEFAULT_DIR, 'cdro-mirror');
+        node_fs_1.default.mkdirSync(dir, { recursive: true });
+        _store = (0, vault_1.openDatabase)({ path: dir, scope: 'mirror' });
+        _stats.store_path = node_path_1.default.join(dir, 'synoi.db');
+        return _store;
+    }
+    catch (err) {
+        _enabled = false;
+        _stats.enabled = false;
+        process.stderr.write(`[cdro-mirror] disabled: ${err.message}\n`);
+        return null;
+    }
+}
+function bumpStats(type, success, err) {
+    _stats.total_writes++;
+    if (!_stats.by_type[type])
+        _stats.by_type[type] = { writes: 0, failures: 0 };
+    _stats.by_type[type].writes++;
+    if (!success) {
+        _stats.total_failures++;
+        _stats.by_type[type].failures++;
+        if (err) {
+            _stats.last_error = err.message;
+            _stats.last_error_type = type;
+        }
+    }
+}
+function mirrorReceipt(input) {
+    const store = lazyStore();
+    if (!store)
+        return;
+    try {
+        const cdro = buildReceiptCdro(input);
+        store.putCDRO(cdro, 'receipts');
+        bumpStats('decision_receipt', true);
+    }
+    catch (err) {
+        bumpStats('decision_receipt', false, err);
+        process.stderr.write(`[cdro-mirror] receipt err ${input.receipt_id}: ${err.message}\n`);
+    }
+}
+function buildReceiptCdro(input) {
+    return (0, vault_1.buildCDRO)({
+        object_id: input.receipt_id,
+        object_type: 'decision_receipt',
+        schema_version: '1.0.0',
+        canonical_fields: [
+            { field_id: 1, type_tag: vault_1.FieldType.STRING, value: input.receipt_id },
+            { field_id: 2, type_tag: vault_1.FieldType.STRING, value: input.tenant_id },
+            { field_id: 3, type_tag: vault_1.FieldType.STRING, value: input.decision },
+            { field_id: 4, type_tag: vault_1.FieldType.STRING, value: input.action_class },
+            { field_id: 5, type_tag: vault_1.FieldType.STRING, value: input.risk_level },
+            { field_id: 6, type_tag: vault_1.FieldType.STRING, value: input.oid_hex },
+            { field_id: 7, type_tag: vault_1.FieldType.UINT64, value: input.recorded_at },
+            { field_id: 8, type_tag: vault_1.FieldType.STRING, value: input.signature },
+            { field_id: 9, type_tag: vault_1.FieldType.STRING, value: input.signer_key_id },
+            ...(input.gateway_manifest_sha256
+                ? [{ field_id: 10, type_tag: vault_1.FieldType.STRING, value: input.gateway_manifest_sha256 }]
+                : []),
+            // N16 Phase 2 — HITL decision identity fields (omit when absent).
+            // field_id 11: decided_by  — identity of the approver/denier.
+            // field_id 12: parent_receipt_id — links this decision receipt to the
+            //   original action receipt it gates (the chain anchor).
+            ...(input.decided_by
+                ? [{ field_id: 11, type_tag: vault_1.FieldType.STRING, value: input.decided_by }]
+                : []),
+            ...(input.parent_receipt_id
+                ? [{ field_id: 12, type_tag: vault_1.FieldType.STRING, value: input.parent_receipt_id }]
+                : []),
+        ],
+        field_policies: [
+            { field_id: 1, policy: vault_1.FieldPolicyType.REQUIRED_CANONICAL, importance_weight: 255, bio_level: vault_1.BioLevel.ATOM },
+            { field_id: 2, policy: vault_1.FieldPolicyType.REQUIRED_CANONICAL, importance_weight: 255, bio_level: vault_1.BioLevel.ATOM },
+            { field_id: 3, policy: vault_1.FieldPolicyType.REQUIRED_CANONICAL, importance_weight: 255, bio_level: vault_1.BioLevel.ATOM },
+            { field_id: 4, policy: vault_1.FieldPolicyType.REQUIRED_CANONICAL, importance_weight: 200, bio_level: vault_1.BioLevel.ATOM },
+            { field_id: 5, policy: vault_1.FieldPolicyType.REQUIRED_CANONICAL, importance_weight: 200, bio_level: vault_1.BioLevel.ATOM },
+            { field_id: 6, policy: vault_1.FieldPolicyType.REQUIRED_CANONICAL, importance_weight: 255, bio_level: vault_1.BioLevel.ATOM },
+            { field_id: 7, policy: vault_1.FieldPolicyType.REQUIRED_CANONICAL, importance_weight: 200, bio_level: vault_1.BioLevel.ATOM },
+            { field_id: 8, policy: vault_1.FieldPolicyType.REQUIRED_CANONICAL, importance_weight: 255, bio_level: vault_1.BioLevel.ATOM },
+            { field_id: 9, policy: vault_1.FieldPolicyType.REQUIRED_CANONICAL, importance_weight: 200, bio_level: vault_1.BioLevel.ATOM },
+            ...(input.gateway_manifest_sha256
+                ? [{ field_id: 10, policy: vault_1.FieldPolicyType.REQUIRED_CANONICAL, importance_weight: 255, bio_level: vault_1.BioLevel.ATOM }]
+                : []),
+            ...(input.decided_by
+                ? [{ field_id: 11, policy: vault_1.FieldPolicyType.REQUIRED_CANONICAL, importance_weight: 255, bio_level: vault_1.BioLevel.ATOM }]
+                : []),
+            ...(input.parent_receipt_id
+                ? [{ field_id: 12, policy: vault_1.FieldPolicyType.REQUIRED_CANONICAL, importance_weight: 255, bio_level: vault_1.BioLevel.ATOM }]
+                : []),
+        ],
+        provenance: {
+            source: 'synoi-gateway',
+            ingest_path: 'receipt-store.putReceipt → cdro-mirror.mirrorReceipt',
+            ingest_timestamp: Date.now(),
+            raw_hash: input.signature,
+        },
+        truth_quality: {
+            birth_level: 'full',
+            extraction_depth: 'deep',
+            plaintext_availability: 'available',
+            provenance_confidence: 1.0,
+            trust_level: 'authoritative',
+        },
+    });
+}
+function mirrorManifest(input) {
+    const store = lazyStore();
+    if (!store)
+        return null;
+    try {
+        const cdro = buildManifestCdro(input);
+        store.putCDRO(cdro, 'manifest');
+        bumpStats('gateway_manifest', true);
+        // Return the oid_hex for the heartbeat to send alongside manifest_sha256.
+        const stored = store.getCDROById(cdro.object_id);
+        return stored?.oid_hex ?? null;
+    }
+    catch (err) {
+        bumpStats('gateway_manifest', false, err);
+        process.stderr.write(`[cdro-mirror] manifest err: ${err.message}\n`);
+        return null;
+    }
+}
+function buildManifestCdro(input) {
+    // The files list is encoded as a JSON STRING because the CDRO LIST
+    // type requires typed-value entries (FieldType+value pairs), not raw
+    // objects. JSON-encoding preserves content-addressing — same files
+    // → same string → same canonical_hash.
+    const filesJson = JSON.stringify([...input.files].sort((a, b) => a.path.localeCompare(b.path)));
+    return (0, vault_1.buildCDRO)({
+        // Use the manifest_sha256 as object_id so the same manifest content
+        // always produces the same object_id (idempotent re-mirror on rebuild).
+        object_id: `manifest:${input.manifest_sha256}`,
+        object_type: 'gateway_manifest',
+        schema_version: '1.0.0',
+        canonical_fields: [
+            { field_id: 1, type_tag: vault_1.FieldType.STRING, value: input.version },
+            { field_id: 2, type_tag: vault_1.FieldType.UINT64, value: input.built_at },
+            { field_id: 3, type_tag: vault_1.FieldType.STRING, value: input.manifest_sha256 },
+            { field_id: 4, type_tag: vault_1.FieldType.STRING, value: filesJson },
+        ],
+        field_policies: [
+            { field_id: 1, policy: vault_1.FieldPolicyType.REQUIRED_CANONICAL, importance_weight: 200, bio_level: vault_1.BioLevel.ATOM },
+            { field_id: 2, policy: vault_1.FieldPolicyType.REQUIRED_CANONICAL, importance_weight: 200, bio_level: vault_1.BioLevel.ATOM },
+            { field_id: 3, policy: vault_1.FieldPolicyType.REQUIRED_CANONICAL, importance_weight: 255, bio_level: vault_1.BioLevel.ATOM },
+            { field_id: 4, policy: vault_1.FieldPolicyType.REQUIRED_CANONICAL, importance_weight: 200, bio_level: vault_1.BioLevel.MOLECULE },
+        ],
+        provenance: {
+            source: 'synoi-gateway',
+            ingest_path: 'build-manifest.ts → cdro-mirror.mirrorManifest',
+            ingest_timestamp: Date.now(),
+        },
+        truth_quality: {
+            birth_level: 'full',
+            extraction_depth: 'deep',
+            plaintext_availability: 'available',
+            provenance_confidence: 1.0,
+            trust_level: 'authoritative',
+        },
+    });
+}
+// ── Read-side helpers (for parity audits) ──────────────────────────────────
+function getMirroredReceipt(receipt_id) {
+    const store = lazyStore();
+    if (!store)
+        return null;
+    const row = store.getCDROById(receipt_id);
+    return row?.cdro ?? null;
+}
+function getMirroredManifest(manifest_sha256) {
+    const store = lazyStore();
+    if (!store)
+        return null;
+    const row = store.getCDROById(`manifest:${manifest_sha256}`);
+    return row?.cdro ?? null;
+}
+// ── Stats ──────────────────────────────────────────────────────────────────
+function cdroMirrorStats() {
+    return { ..._stats, enabled: _enabled };
+}
+/** For tests — reset state, close any open store. */
+function _resetForTests(dir) {
+    if (_store) {
+        try {
+            _store.close();
+        }
+        catch { }
+    }
+    _store = null;
+    _enabled = process.env.SYNOI_CDRO_MIRROR !== '0';
+    _stats.enabled = _enabled;
+    _stats.total_writes = 0;
+    _stats.total_failures = 0;
+    _stats.by_type = {};
+    _stats.last_error = null;
+    _stats.last_error_type = null;
+    _stats.store_path = null;
+    if (dir) {
+        try {
+            node_fs_1.default.rmSync(node_path_1.default.join(dir, 'cdro-mirror.db'), { force: true });
+        }
+        catch { }
+        try {
+            node_fs_1.default.rmSync(node_path_1.default.join(dir, 'cdro-mirror.db-wal'), { force: true });
+        }
+        catch { }
+        try {
+            node_fs_1.default.rmSync(node_path_1.default.join(dir, 'cdro-mirror.db-shm'), { force: true });
+        }
+        catch { }
+    }
+}

package/dist/daemon.js

@@ -0,0 +1,194 @@
+"use strict";
+// SPDX-License-Identifier: AGPL-3.0-or-later
+// SPDX-FileCopyrightText: 2026 SynOI Inc.
+//
+// Dual-licensed: AGPL-3.0-or-later by default; commercial license available
+// via licensing@synoi.systems. See LICENSE + LICENSE.synoi-commercial.md.
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.startLiteDaemon = startLiteDaemon;
+/**
+ * daemon.ts — standalone lite daemon entrypoint (ADR_014 Section 10.3 item 1).
+ *
+ * Mounts ONLY the /local/* localhost API (localIngestRouter +
+ * startLocalIngestSweep). Does NOT import src/index.ts (the full multi-surface
+ * gateway monolith) and therefore does NOT import/wire:
+ *   - the channel registry (getChannelRegistry / registerInstagration,
+ *     src/gap/channels/*: composio, http, mcp, llm, workflow-webhook/n8n/
+ *     zapier, slack, sms, voice, mobile-push, home-assistant, ar-overlay) —
+ *     the premium pricing fence, ADR_014 Section 10.2
+ *   - the control-plane client (src/license-client.ts — SYNOI_CONTROL_URL /
+ *     api.synoi.systems license validation)
+ *   - KMS (src/key-provider.ts AwsKmsKeyProvider, src/gap/signing-oracle.ts
+ *     VaultKmsSigningOracle — the managed-custody hybrid tier lite has no
+ *     custody for)
+ *
+ * This is a SEPARATE module graph from src/index.ts: this file has its own
+ * `import express` and its own `app`, not index.ts's. The CI dep-graph
+ * assertion (test/daemon-dep-graph.test.ts) enforces the three exclusions
+ * above as a BUILD-time property, not a code-review-time one.
+ *
+ * Clean-room boot contract (ADR_014 Section 10.3 release gate): on a machine
+ * that has never seen SynOI, with SYNOI_LITE=1 and NO AWS_*, NO
+ * control-plane URL, NO Paddle env, and an empty ~/.synoi, this process:
+ *   1. generates and persists a per-instance operator-owned Ed25519 key
+ *      (gap/lite-signing-key.ts) — first-run only; every later boot loads the
+ *      SAME key
+ *   2. seals the local operator enrollment record with that SAME persisted
+ *      key (gap/operator-enrollment.ts, Security F1 fix, 2026-07-12) — NOT
+ *      the gateway's ephemeral SYNOI_ALLOW_EPHEMERAL_KEYS bundle, which used
+ *      to be regenerated fresh every boot and silently un-enrolled the
+ *      operator on restart. Lite no longer calls initSigningKeys() at all:
+ *      it has no dependence on SYNOI_ALLOW_EPHEMERAL_KEYS, on any
+ *      KeyProvider, or on the gateway's key history for anything.
+ *   3. listens on 127.0.0.1 serving /local/* only
+ *
+ * NOTE (accuracy, not a claim of full independence): SYNOI_ALLOW_EPHEMERAL_
+ * KEYS is not read anywhere in THIS file's boot sequence any more (steps 1-2
+ * above). It is, today, still read by localIngestRouter's POST /local/gate
+ * handler (gap/local-ingest-router.ts:1146-1157) for an UNRELATED reason: a
+ * bootstrap-sentinel bypass that lets the hero bundle OID 'capbundle/1' pass
+ * the grant-existence check without a real gap_grants row, because lite has
+ * no capability-grant issuance ceremony built yet. Until that ships, a lite
+ * operator who wants POST /local/gate to accept 'capbundle/1' still needs to
+ * set this env var (see packages/gateway-lite/README.md) -- but the daemon's OWN
+ * boot, and the enrollment record's survival across restarts, do not.
+ *
+ * One `gate()`-style POST /local/gate, one operator approve via the
+ * signed-assent ceremony, and the resulting receipt self-signs against the
+ * operator's own key (receipt_scheme=synoi.receipt/gap-selfsign) and verifies
+ * through the published @synoi/verify package — see
+ * test/local-ingest-lite-mode.test.ts for the server-side proof and the
+ * Builder's report for the full process-level clean-room boot transcript.
+ *
+ * No em dashes. No AI attribution.
+ */
+const express_1 = __importDefault(require("express"));
+const local_ingest_router_1 = __importStar(require("./gap/local-ingest-router"));
+const lite_mode_1 = require("./gap/lite-mode");
+const lite_signing_key_1 = require("./gap/lite-signing-key");
+const DEFAULT_PORT = Number(process.env['SYNOI_LITE_PORT'] ?? process.env['PORT'] ?? 8787);
+/**
+ * Boot the standalone lite daemon and return the listening HTTP server.
+ * Exported (not just invoked at module scope) so tests and an eventual
+ * `npx @synoi/gateway-lite` bin wrapper can both drive it without re-importing
+ * this module's require.main guard.
+ */
+async function startLiteDaemon(port = DEFAULT_PORT) {
+    // Lite mode: decision receipts AND the operator-enrollment seal both
+    // self-sign with the per-instance operator key (@synoi/gap `receipt()`
+    // shape for receipts, Ed25519-only DSSE for the enrollment seal), never
+    // the gateway's KMS-hybrid / ephemeral-bundle tier. Set BEFORE any request
+    // can arrive. This single flag (gap/lite-mode.ts) governs both.
+    (0, lite_mode_1.setLiteMode)(true);
+    // Generate-or-load the persisted operator signing key before accepting any
+    // request, so the very first receipt (and the very first enrollment seal)
+    // this process ever signs uses the same key every later signature (and
+    // every later restart) will use. Also fails loud here, at boot, rather
+    // than on the first decide call, if the key file is present but corrupt
+    // (see lite-signing-key.ts). No initSigningKeys() call in lite mode: after
+    // the Security F1 fix (2026-07-12), lite has no dependence on
+    // SYNOI_ALLOW_EPHEMERAL_KEYS, any KeyProvider, or the gateway's key
+    // history for anything at all.
+    //
+    // The ASYNC loader (Security F3, 2026-07-12): tries the OS credential
+    // store (Windows DPAPI / macOS Keychain / Linux secret-tool) before
+    // falling back to a hardened plaintext file. Must run here, at boot,
+    // because the synchronous per-request code paths (receipt signing,
+    // enrollment sealing) cannot await a keystore CLI round-trip mid-request;
+    // this call populates the same in-process cache those paths read from.
+    const liteKeyResult = await (0, lite_signing_key_1.loadOrCreateLiteSigningKeyAsync)();
+    const liteKey = liteKeyResult.keyPair;
+    const app = (0, express_1.default)();
+    app.use('/local', local_ingest_router_1.default);
+    // Anything outside /local/* is not part of the lite daemon's surface —
+    // there is no /v1, /admin, /internal, /billing, /hitl webhook fan-in, etc.
+    // here, unlike the full monolith.
+    app.use((_req, res) => {
+        res.status(404).json({
+            error: 'not_found',
+            detail: 'the lite daemon serves /local/* only',
+            type: 'not_found',
+        });
+    });
+    return await new Promise((resolve) => {
+        const server = app.listen(port, '127.0.0.1', () => {
+            const actualPort = (() => {
+                const a = server.address();
+                return typeof a === 'object' && a !== null ? a.port : port;
+            })();
+            process.stdout.write(`[synoi-lite] Listening on http://127.0.0.1:${actualPort}\n`);
+            process.stdout.write(`[synoi-lite] Operator signing key: ${liteKey.keyId ?? '(unlabeled)'}\n`);
+            process.stdout.write(`[synoi-lite] Dashboard:            http://127.0.0.1:${actualPort}/local/dashboard\n`);
+            process.stdout.write(`[synoi-lite] API base:             http://127.0.0.1:${actualPort}/local\n`);
+            // Security F3 loud disclosure (2026-07-12 quality gate). Printed on
+            // EVERY boot, not just first run: an operator who has forgotten how
+            // this key is protected should be reminded every time, not once.
+            if (liteKeyResult.backend === 'os-keystore') {
+                process.stdout.write(`[synoi-lite] Key custody: your operator signing key is wrapped by this machine's OS ` +
+                    `credential store (${liteKeyResult.keystorePlatform ?? 'unknown'}). Any process running as ` +
+                    `YOUR OS user account can still ask the OS to unwrap and use it -- the keystore protects ` +
+                    `against OTHER users/accounts on this machine, not against other processes running AS you. ` +
+                    `There is no managed custody and no account recovery: if this machine or your OS profile is ` +
+                    `lost, the key is gone and every receipt it signed can no longer be re-signed under a ` +
+                    `continuous identity.\n`);
+            }
+            else {
+                process.stdout.write(`[synoi-lite] Key custody: your operator signing key is stored UNENCRYPTED at ` +
+                    `${(0, lite_signing_key_1.getLiteSigningKeyPath)()} (OS keystore unavailable on this machine -- see the line above ` +
+                    `if one printed, or packages/gateway-lite/README.md). Any process running as YOUR OS user account ` +
+                    `can read this file and sign as the operator. ${process.platform === 'win32' ? 'This file\'s Windows ACL is restricted to your account (icacls owner-only).' : 'This file has POSIX mode 0600 (owner read/write only).'} ` +
+                    `There is no managed custody and no account recovery: if this file is lost or this machine is ` +
+                    `lost, the key is gone.\n`);
+            }
+            if (liteKeyResult.fallbackWarning !== '') {
+                process.stdout.write(`[synoi-lite] WARNING: ${liteKeyResult.fallbackWarning}\n`);
+            }
+            (0, local_ingest_router_1.startLocalIngestSweep)();
+            resolve(server);
+        });
+    });
+}
+// Run directly: `node dist/daemon.js` (built) or `tsx src/daemon.ts` / `ts-node src/daemon.ts` (dev).
+// Mirrors src/index.ts's require.main guard exactly.
+if (require.main === module) {
+    startLiteDaemon().catch(err => {
+        process.stderr.write(`[synoi-lite] FATAL: ${err instanceof Error ? err.stack : String(err)}\n`);
+        process.exit(1);
+    });
+}