@vibesdotdev/kernel-rpc 0.0.0-stage → 1.0.0-rc.3

package/dist/daemon/auth/ingress/finalize.js

@@ -0,0 +1,40 @@
+import { CaughtFailureSchema } from '@vibesdotdev/kernel';
+import { JsonDocumentSchema } from "../../../schemas/daemon/daemon-http.js";
+import { redactStackTraces } from "../redact.js";
+export async function finalize(response, corsHeaders, httpDebug) {
+    for (const [key, value] of Object.entries(corsHeaders)) {
+        response.headers.set(key, value);
+    }
+    if (httpDebug)
+        return response;
+    const contentType = response.headers.get('Content-Type') ?? '';
+    if (!contentType.includes('application/json'))
+        return response;
+    const text = await response.clone().text();
+    if (!text.includes('"stack"'))
+        return response;
+    try {
+        const parsed = JsonDocumentSchema.parse(JSON.parse(text));
+        const redacted = redactStackTraces(parsed, { debug: false });
+        const headers = new Headers(response.headers);
+        const body = JSON.stringify(redacted);
+        headers.set('Content-Length', String(new TextEncoder().encode(body).byteLength));
+        return new Response(body, {
+            status: response.status,
+            statusText: response.statusText,
+            headers
+        });
+    }
+    catch (error) {
+        // A JSON-typed body carrying a stack that does not parse cannot be
+        // redacted, so it is withheld, never passed through unredacted.
+        if (!(error instanceof SyntaxError))
+            throw error;
+        const cause = CaughtFailureSchema.parse(error);
+        const headers = new Headers(corsHeaders);
+        headers.set('Content-Type', 'application/json');
+        const init = { status: 502, headers, cause };
+        return new Response(JSON.stringify({ success: false, error: 'The response body could not be redacted and was withheld' }), init);
+    }
+}
+//# sourceMappingURL=finalize.js.map

package/dist/daemon/auth/ingress/finalize.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"finalize.js","sourceRoot":"","sources":["../../../../src/daemon/auth/ingress/finalize.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAC1D,OAAO,EAAE,kBAAkB,EAAE,MAAM,wCAAwC,CAAC;AAC5E,OAAO,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AAEjD,MAAM,CAAC,KAAK,UAAU,QAAQ,CAC7B,QAAkB,EAClB,WAAmC,EACnC,SAAkB;IAElB,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,CAAC;QACxD,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IAClC,CAAC;IAED,IAAI,SAAS;QAAE,OAAO,QAAQ,CAAC;IAE/B,MAAM,WAAW,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC;IAC/D,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,kBAAkB,CAAC;QAAE,OAAO,QAAQ,CAAC;IAE/D,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,CAAC;IAC3C,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC;QAAE,OAAO,QAAQ,CAAC;IAE/C,IAAI,CAAC;QACJ,MAAM,MAAM,GAAG,kBAAkB,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;QAC1D,MAAM,QAAQ,GAAG,iBAAiB,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;QAC7D,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QAC9C,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;QACtC,OAAO,CAAC,GAAG,CAAC,gBAAgB,EAAE,MAAM,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC;QACjF,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE;YACzB,MAAM,EAAE,QAAQ,CAAC,MAAM;YACvB,UAAU,EAAE,QAAQ,CAAC,UAAU;YAC/B,OAAO;SACP,CAAC,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,mEAAmE;QACnE,gEAAgE;QAChE,IAAI,CAAC,CAAC,KAAK,YAAY,WAAW,CAAC;YAAE,MAAM,KAAK,CAAC;QACjD,MAAM,KAAK,GAAG,mBAAmB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC/C,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,WAAW,CAAC,CAAC;QACzC,OAAO,CAAC,GAAG,CAAC,cAAc,EAAE,kBAAkB,CAAC,CAAC;QAChD,MAAM,IAAI,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;QAC7C,OAAO,IAAI,QAAQ,CAClB,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,0DAA0D,EAAE,CAAC,EACrG,IAAI,CACJ,CAAC;IACH,CAAC;AACF,CAAC"}

package/dist/daemon/auth/ingress/json.d.ts

@@ -0,0 +1,4 @@
+import { type JsonDocument } from '../../../schemas/daemon/daemon-http.ts';
+/** All routes share bounded JSON admission; failures contain no request data. */
+export declare function parseDaemonJson(text: string): JsonDocument | Response;
+//# sourceMappingURL=json.d.ts.map

package/dist/daemon/auth/ingress/json.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"json.d.ts","sourceRoot":"","sources":["../../../../src/daemon/auth/ingress/json.ts"],"names":[],"mappings":"AAEA,OAAO,EAAsB,KAAK,YAAY,EAAE,MAAM,wCAAwC,CAAC;AAE/F,iFAAiF;AACjF,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,YAAY,GAAG,QAAQ,CAiBrE"}

package/dist/daemon/auth/ingress/json.js

@@ -0,0 +1,23 @@
+import { attempt } from "../../../core/protocol/lifecycle/attempt.js";
+import { HOST_FAILURES } from "../../../core/protocol/transport/failure-describer.js";
+import { JsonDocumentSchema } from "../../../schemas/daemon/daemon-http.js";
+/** All routes share bounded JSON admission; failures contain no request data. */
+export function parseDaemonJson(text) {
+    const document = attempt(() => JSON.parse(text));
+    if (!document.ok) {
+        return Response.json({
+            success: false, error: 'Invalid JSON in request body',
+            code: 'INVALID_INPUT', reason: 'rpc-request-invalid-json',
+            cause: HOST_FAILURES.describe(document.failure)
+        }, { status: 400 });
+    }
+    const parsed = JsonDocumentSchema.safeParse(document.value);
+    if (!parsed.success) {
+        return Response.json({
+            success: false, error: 'RPC request data exceeds the supported depth or value domain.',
+            code: 'INVALID_INPUT', reason: 'rpc-request-invalid-data'
+        }, { status: 400 });
+    }
+    return parsed.data;
+}
+//# sourceMappingURL=json.js.map

package/dist/daemon/auth/ingress/json.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"json.js","sourceRoot":"","sources":["../../../../src/daemon/auth/ingress/json.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,6CAA6C,CAAC;AACtE,OAAO,EAAE,aAAa,EAAE,MAAM,uDAAuD,CAAC;AACtF,OAAO,EAAE,kBAAkB,EAAqB,MAAM,wCAAwC,CAAC;AAE/F,iFAAiF;AACjF,MAAM,UAAU,eAAe,CAAC,IAAY;IAC3C,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;IACjD,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QAClB,OAAO,QAAQ,CAAC,IAAI,CAAC;YACpB,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,8BAA8B;YACrD,IAAI,EAAE,eAAe,EAAE,MAAM,EAAE,0BAA0B;YACzD,KAAK,EAAE,aAAa,CAAC,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC;SAC/C,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;IACrB,CAAC;IACD,MAAM,MAAM,GAAG,kBAAkB,CAAC,SAAS,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC5D,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACrB,OAAO,QAAQ,CAAC,IAAI,CAAC;YACpB,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,+DAA+D;YACtF,IAAI,EAAE,eAAe,EAAE,MAAM,EAAE,0BAA0B;SACzD,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;IACrB,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC;AACpB,CAAC"}

package/dist/daemon/auth/ingress/nonce.d.ts

@@ -0,0 +1,4 @@
+import { type TcpHandlerDeps } from '../../../schemas/daemon/daemon-http.ts';
+export declare function handleNonceMint(req: Request, deps: TcpHandlerDeps): Promise<Response>;
+export declare function handleSubscribeWithNonce(req: Request, url: URL, deps: TcpHandlerDeps): Promise<Response>;
+//# sourceMappingURL=nonce.d.ts.map

package/dist/daemon/auth/ingress/nonce.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"nonce.d.ts","sourceRoot":"","sources":["../../../../src/daemon/auth/ingress/nonce.ts"],"names":[],"mappings":"AAAA,OAAO,EAAsB,KAAK,cAAc,EAAE,MAAM,wCAAwC,CAAC;AAIjG,wBAAsB,eAAe,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,cAAc,GAAG,OAAO,CAAC,QAAQ,CAAC,CAyB3F;AAED,wBAAsB,wBAAwB,CAC7C,GAAG,EAAE,OAAO,EACZ,GAAG,EAAE,GAAG,EACR,IAAI,EAAE,cAAc,GAClB,OAAO,CAAC,QAAQ,CAAC,CAwBnB"}

package/dist/daemon/auth/ingress/nonce.js

@@ -0,0 +1,50 @@
+import { NonceChannelSchema } from "../../../schemas/daemon/daemon-http.js";
+import { authenticateBearer, readDaemonBody } from "./body.js";
+import { parseDaemonJson } from "./json.js";
+const RUNTIME_DAEMON_SUBSCRIBE_REF = 'runtime-daemon.subscribe';
+export async function handleNonceMint(req, deps) {
+    const auth = authenticateBearer(req, deps.tokenRegistry);
+    if (!auth) {
+        return Response.json({ success: false, error: 'Unauthorized' }, { status: 401 });
+    }
+    const text = await readDaemonBody(req, deps);
+    if (text instanceof Response)
+        return text;
+    let channel;
+    if (req.headers.get('Content-Type')?.includes('application/json')) {
+        // JSON is optional; non-JSON bodies retain their historical ignored semantics.
+        if (text.trim().length > 0) {
+            const document = parseDaemonJson(text);
+            if (document instanceof Response)
+                return document;
+            const channelBody = NonceChannelSchema.safeParse(document);
+            if (channelBody.success)
+                channel = channelBody.data.channel;
+        }
+    }
+    // runtime-rpc's one nonce store (sweep-on-mint, no timer; RC07). The
+    // channel is recorded as the nonce's binding.
+    const { nonce, expiresAt } = deps.nonceStore.mint(channel ? { binding: { ref: RUNTIME_DAEMON_SUBSCRIBE_REF, channel } } : {});
+    return Response.json({ success: true, nonce, expiresAt });
+}
+export async function handleSubscribeWithNonce(req, url, deps) {
+    const nonce = url.searchParams.get('nonce');
+    if (!nonce) {
+        return Response.json({
+            success: false,
+            error: 'Missing nonce. Mint one via POST /subscribe with a Bearer token first.'
+        }, { status: 401 });
+    }
+    const consumed = deps.nonceStore.consume(nonce);
+    if (!consumed) {
+        return Response.json({ success: false, error: 'Invalid or expired nonce' }, { status: 401 });
+    }
+    url.searchParams.delete('nonce');
+    const cleaned = new Request(url.toString(), {
+        method: 'GET',
+        headers: req.headers,
+        signal: req.signal
+    });
+    return deps.handleSubscribeStream(cleaned);
+}
+//# sourceMappingURL=nonce.js.map

package/dist/daemon/auth/ingress/nonce.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"nonce.js","sourceRoot":"","sources":["../../../../src/daemon/auth/ingress/nonce.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAuB,MAAM,wCAAwC,CAAC;AACjG,OAAO,EAAE,kBAAkB,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAC/D,OAAO,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AAC5C,MAAM,4BAA4B,GAAG,0BAA0B,CAAC;AAChE,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,GAAY,EAAE,IAAoB;IACvE,MAAM,IAAI,GAAG,kBAAkB,CAAC,GAAG,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC;IACzD,IAAI,CAAC,IAAI,EAAE,CAAC;QACX,OAAO,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;IAClF,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,cAAc,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IAC7C,IAAI,IAAI,YAAY,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC1C,IAAI,OAA2B,CAAC;IAChC,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,EAAE,QAAQ,CAAC,kBAAkB,CAAC,EAAE,CAAC;QACnE,+EAA+E;QAC/E,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC5B,MAAM,QAAQ,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC;YACvC,IAAI,QAAQ,YAAY,QAAQ;gBAAE,OAAO,QAAQ,CAAC;YAClD,MAAM,WAAW,GAAG,kBAAkB,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;YAC3D,IAAI,WAAW,CAAC,OAAO;gBAAE,OAAO,GAAG,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC;QAC7D,CAAC;IACF,CAAC;IAED,qEAAqE;IACrE,8CAA8C;IAC9C,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,IAAI,CAAC,UAAU,CAAC,IAAI,CAChD,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,GAAG,EAAE,4BAA4B,EAAE,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAC1E,CAAC;IACF,OAAO,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC;AAC3D,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC7C,GAAY,EACZ,GAAQ,EACR,IAAoB;IAEpB,MAAM,KAAK,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IAC5C,IAAI,CAAC,KAAK,EAAE,CAAC;QACZ,OAAO,QAAQ,CAAC,IAAI,CACnB;YACC,OAAO,EAAE,KAAK;YACd,KAAK,EAAE,wEAAwE;SAC/E,EACD,EAAE,MAAM,EAAE,GAAG,EAAE,CACf,CAAC;IACH,CAAC;IAED,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IAChD,IAAI,CAAC,QAAQ,EAAE,CAAC;QACf,OAAO,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,0BAA0B,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;IAC9F,CAAC;IAED,GAAG,CAAC,YAAY,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACjC,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE;QAC3C,MAAM,EAAE,KAAK;QACb,OAAO,EAAE,GAAG,CAAC,OAAO;QACpB,MAAM,EAAE,GAAG,CAAC,MAAM;KAClB,CAAC,CAAC;IACH,OAAO,IAAI,CAAC,qBAAqB,CAAC,OAAO,CAAC,CAAC;AAC5C,CAAC"}

package/dist/daemon/auth/ingress/pair.d.ts

@@ -0,0 +1,10 @@
+import { type TcpHandlerDeps } from '../../../schemas/daemon/daemon-http.ts';
+/**
+ * `POST /pair` — complete a pairing handshake.
+ *
+ * Unauthenticated by design: the single-use pairing code (TTL'd + rate-limited
+ * in `validatePairingRequest`) is the credential. Invalid, expired, and
+ * rate-limited codes all collapse to one indistinguishable 401.
+ */
+export declare function handlePair(req: Request, deps: TcpHandlerDeps): Promise<Response>;
+//# sourceMappingURL=pair.d.ts.map

package/dist/daemon/auth/ingress/pair.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pair.d.ts","sourceRoot":"","sources":["../../../../src/daemon/auth/ingress/pair.ts"],"names":[],"mappings":"AAAA,OAAO,EAAqB,KAAK,cAAc,EAAE,MAAM,wCAAwC,CAAC;AAWhG;;;;;;GAMG;AACH,wBAAsB,UAAU,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,cAAc,GAAG,OAAO,CAAC,QAAQ,CAAC,CAiCtF"}

package/dist/daemon/auth/ingress/pair.js

@@ -0,0 +1,42 @@
+import {} from "../../../schemas/daemon/daemon-http.js";
+import { PairingRequestSchema } from "../../../schemas/pairing.js";
+import { readDaemonBody } from "./body.js";
+import { parseDaemonJson } from "./json.js";
+/** Shape-validate the `/pair` request body. A parsed miss is an absent pair body. */
+function parsePairingRequestBody(body) {
+    const parsed = PairingRequestSchema.safeParse(body);
+    if (!parsed.success)
+        return null;
+    return parsed.data;
+}
+/**
+ * `POST /pair` — complete a pairing handshake.
+ *
+ * Unauthenticated by design: the single-use pairing code (TTL'd + rate-limited
+ * in `validatePairingRequest`) is the credential. Invalid, expired, and
+ * rate-limited codes all collapse to one indistinguishable 401.
+ */
+export async function handlePair(req, deps) {
+    if (!deps.completePairing) {
+        return Response.json({ success: false, error: 'Pairing is not enabled on this daemon' }, { status: 404 });
+    }
+    const text = await readDaemonBody(req, deps);
+    if (text instanceof Response)
+        return text;
+    const body = parseDaemonJson(text);
+    if (body instanceof Response)
+        return body;
+    const request = parsePairingRequestBody(body);
+    if (!request) {
+        return Response.json({
+            success: false,
+            error: 'Pairing request must include non-empty `code`, `name`, and `machineId` strings'
+        }, { status: 400 });
+    }
+    const response = await deps.completePairing(request);
+    if (!response) {
+        return Response.json({ success: false, error: 'Invalid or expired pairing code' }, { status: 401 });
+    }
+    return Response.json({ success: true, ...response });
+}
+//# sourceMappingURL=pair.js.map

package/dist/daemon/auth/ingress/pair.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pair.js","sourceRoot":"","sources":["../../../../src/daemon/auth/ingress/pair.ts"],"names":[],"mappings":"AAAA,OAAO,EAA0C,MAAM,wCAAwC,CAAC;AAChG,OAAO,EAAE,oBAAoB,EAAuB,MAAM,6BAA6B,CAAC;AACxF,OAAO,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAC3C,OAAO,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AAC5C,qFAAqF;AACrF,SAAS,uBAAuB,CAAC,IAAkB;IAClD,MAAM,MAAM,GAAG,oBAAoB,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IACpD,IAAI,CAAC,MAAM,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IACjC,OAAO,MAAM,CAAC,IAAI,CAAC;AACpB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,GAAY,EAAE,IAAoB;IAClE,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,CAAC;QAC3B,OAAO,QAAQ,CAAC,IAAI,CACnB,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,uCAAuC,EAAE,EAClE,EAAE,MAAM,EAAE,GAAG,EAAE,CACf,CAAC;IACH,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,cAAc,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IAC7C,IAAI,IAAI,YAAY,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC1C,MAAM,IAAI,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC;IACnC,IAAI,IAAI,YAAY,QAAQ;QAAE,OAAO,IAAI,CAAC;IAE1C,MAAM,OAAO,GAAG,uBAAuB,CAAC,IAAI,CAAC,CAAC;IAC9C,IAAI,CAAC,OAAO,EAAE,CAAC;QACd,OAAO,QAAQ,CAAC,IAAI,CACnB;YACC,OAAO,EAAE,KAAK;YACd,KAAK,EAAE,gFAAgF;SACvF,EACD,EAAE,MAAM,EAAE,GAAG,EAAE,CACf,CAAC;IACH,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC;IACrD,IAAI,CAAC,QAAQ,EAAE,CAAC;QACf,OAAO,QAAQ,CAAC,IAAI,CACnB,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,iCAAiC,EAAE,EAC5D,EAAE,MAAM,EAAE,GAAG,EAAE,CACf,CAAC;IACH,CAAC;IAED,OAAO,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,QAAQ,EAAE,CAAC,CAAC;AACtD,CAAC"}

package/dist/daemon/auth/ingress/rpc.d.ts

@@ -0,0 +1,3 @@
+import type { TcpHandlerDeps } from '../../../schemas/daemon/daemon-http.ts';
+export declare function handleRpc(req: Request, deps: TcpHandlerDeps): Promise<Response>;
+//# sourceMappingURL=rpc.d.ts.map

package/dist/daemon/auth/ingress/rpc.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rpc.d.ts","sourceRoot":"","sources":["../../../../src/daemon/auth/ingress/rpc.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,wCAAwC,CAAC;AAI7E,wBAAsB,SAAS,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,cAAc,GAAG,OAAO,CAAC,QAAQ,CAAC,CASrF"}

package/dist/daemon/auth/ingress/rpc.js

@@ -0,0 +1,15 @@
+import { authenticateBearer, readDaemonBody } from "./body.js";
+import { parseDaemonJson } from "./json.js";
+export async function handleRpc(req, deps) {
+    const auth = authenticateBearer(req, deps.tokenRegistry);
+    if (!auth)
+        return Response.json({ success: false, error: 'Unauthorized' }, { status: 401 });
+    const text = await readDaemonBody(req, deps);
+    if (text instanceof Response)
+        return text;
+    const message = parseDaemonJson(text);
+    if (message instanceof Response)
+        return message;
+    return deps.dispatchRpc(message, auth);
+}
+//# sourceMappingURL=rpc.js.map

package/dist/daemon/auth/ingress/rpc.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rpc.js","sourceRoot":"","sources":["../../../../src/daemon/auth/ingress/rpc.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,kBAAkB,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAC/D,OAAO,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AAE5C,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,GAAY,EAAE,IAAoB;IACjE,MAAM,IAAI,GAAG,kBAAkB,CAAC,GAAG,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC;IACzD,IAAI,CAAC,IAAI;QAAE,OAAO,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;IAE5F,MAAM,IAAI,GAAG,MAAM,cAAc,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IAC7C,IAAI,IAAI,YAAY,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC1C,MAAM,OAAO,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC;IACtC,IAAI,OAAO,YAAY,QAAQ;QAAE,OAAO,OAAO,CAAC;IAChD,OAAO,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;AACxC,CAAC"}

package/dist/daemon/auth/pairing-binding.d.ts

@@ -0,0 +1,44 @@
+/**
+ * Pairing ↔ daemon-auth binding.
+ *
+ * Bridges the pairing module's machine-capability vocabulary
+ * (`tool`/`storage`/`config`/`invoke`/`subscribe`) into the daemon TCP
+ * layer's capability classes (`read`/`write`), and wires the two granting-side
+ * obligations the handshake needs to actually work:
+ *
+ * 1. {@link createPairingCompleter} — the `/pair` route handler body: validate
+ *    the code, persist the issued token + requester identity in
+ *    `paired-clients.json`, and register the token into the live
+ *    TokenRegistry so it authenticates immediately.
+ * 2. {@link registerPersistedPairedClientTokens} — called at daemon startup so
+ *    tokens issued by previous daemon processes keep authenticating
+ *    (pairing survives restarts).
+ */
+import type { RuntimeRef } from '@vibesdotdev/kernel';
+import type { LocalMachineIdentity } from '../pairing/machine-identity.consumer.ts';
+import type { PairingCodes } from '../pairing/pairing.ts';
+import type { MachineCapability, PairingRequest, PairingResponse } from '../pairing/types.ts';
+import type { TokenRegistry } from '../../transports/http/auth/token-registry.ts';
+/**
+ * @deprecated The per-verb capability split (read/write) has been removed.
+ * The function is kept as a no-op shim so call sites compile without changes.
+ * A valid connection token now authorises the connection only; per-invoke
+ * authorisation is L5's job.
+ */
+export declare function daemonCapabilitiesForMachine(_capabilities: readonly MachineCapability[]): string[];
+/**
+ * Register every persisted paired-client token (the store under `runtime`'s
+ * path roots) into the registry. Returns the number of tokens registered.
+ * Called at daemon startup.
+ */
+export declare function registerPersistedPairedClientTokens(registry: TokenRegistry, runtime: RuntimeRef): Promise<number>;
+/**
+ * Build the granting-side pairing completer the TCP `/pair` route invokes.
+ *
+ * On a valid code it persists the issued token (so it survives restarts via
+ * {@link registerPersistedPairedClientTokens}) and registers it into the live
+ * registry with mapped capabilities; on an invalid/expired/rate-limited code
+ * it returns null and persists nothing.
+ */
+export declare function createPairingCompleter(registry: TokenRegistry, runtime: RuntimeRef, identity: () => Promise<LocalMachineIdentity>, codes: PairingCodes): (request: PairingRequest) => Promise<PairingResponse | null>;
+//# sourceMappingURL=pairing-binding.d.ts.map

package/dist/daemon/auth/pairing-binding.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pairing-binding.d.ts","sourceRoot":"","sources":["../../../src/daemon/auth/pairing-binding.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AACtD,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,yCAAyC,CAAC;AAEpF,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AAC1D,OAAO,KAAK,EAAE,iBAAiB,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAC9F,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,8CAA8C,CAAC;AAElF;;;;;GAKG;AACH,wBAAgB,4BAA4B,CAC3C,aAAa,EAAE,SAAS,iBAAiB,EAAE,GACzC,MAAM,EAAE,CAEV;AAED;;;;GAIG;AACH,wBAAsB,mCAAmC,CACxD,QAAQ,EAAE,aAAa,EACvB,OAAO,EAAE,UAAU,GACjB,OAAO,CAAC,MAAM,CAAC,CAQjB;AAED;;;;;;;GAOG;AACH,wBAAgB,sBAAsB,CACrC,QAAQ,EAAE,aAAa,EACvB,OAAO,EAAE,UAAU,EACnB,QAAQ,EAAE,MAAM,OAAO,CAAC,oBAAoB,CAAC,EAC7C,KAAK,EAAE,YAAY,GACjB,CAAC,OAAO,EAAE,cAAc,KAAK,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC,CAe9D"}

package/dist/daemon/auth/pairing-binding.js

@@ -0,0 +1,66 @@
+/**
+ * Pairing ↔ daemon-auth binding.
+ *
+ * Bridges the pairing module's machine-capability vocabulary
+ * (`tool`/`storage`/`config`/`invoke`/`subscribe`) into the daemon TCP
+ * layer's capability classes (`read`/`write`), and wires the two granting-side
+ * obligations the handshake needs to actually work:
+ *
+ * 1. {@link createPairingCompleter} — the `/pair` route handler body: validate
+ *    the code, persist the issued token + requester identity in
+ *    `paired-clients.json`, and register the token into the live
+ *    TokenRegistry so it authenticates immediately.
+ * 2. {@link registerPersistedPairedClientTokens} — called at daemon startup so
+ *    tokens issued by previous daemon processes keep authenticating
+ *    (pairing survives restarts).
+ */
+import { addPairedClient, readPairedClients } from "../pairing/paired-clients.consumer.js";
+/**
+ * @deprecated The per-verb capability split (read/write) has been removed.
+ * The function is kept as a no-op shim so call sites compile without changes.
+ * A valid connection token now authorises the connection only; per-invoke
+ * authorisation is L5's job.
+ */
+export function daemonCapabilitiesForMachine(_capabilities) {
+    return [];
+}
+/**
+ * Register every persisted paired-client token (the store under `runtime`'s
+ * path roots) into the registry. Returns the number of tokens registered.
+ * Called at daemon startup.
+ */
+export async function registerPersistedPairedClientTokens(registry, runtime) {
+    const clients = await readPairedClients(runtime);
+    for (const client of clients) {
+        // Retired verb scoping: paired tokens authorise the connection only
+        // (per-invoke authorisation is the invoke gate's job).
+        registry.register(client.token, {});
+    }
+    return clients.length;
+}
+/**
+ * Build the granting-side pairing completer the TCP `/pair` route invokes.
+ *
+ * On a valid code it persists the issued token (so it survives restarts via
+ * {@link registerPersistedPairedClientTokens}) and registers it into the live
+ * registry with mapped capabilities; on an invalid/expired/rate-limited code
+ * it returns null and persists nothing.
+ */
+export function createPairingCompleter(registry, runtime, identity, codes) {
+    return async (request) => {
+        const local = await identity();
+        const response = codes.validate(request, local.id, local.name);
+        if (!response)
+            return null;
+        await addPairedClient(runtime, {
+            machineId: request.machineId,
+            name: request.name,
+            token: response.token,
+            capabilities: response.capabilities,
+            pairedAt: new Date().toISOString()
+        });
+        registry.register(response.token, {});
+        return response;
+    };
+}
+//# sourceMappingURL=pairing-binding.js.map

package/dist/daemon/auth/pairing-binding.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pairing-binding.js","sourceRoot":"","sources":["../../../src/daemon/auth/pairing-binding.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAIH,OAAO,EAAE,eAAe,EAAE,iBAAiB,EAAE,MAAM,uCAAuC,CAAC;AAK3F;;;;;GAKG;AACH,MAAM,UAAU,4BAA4B,CAC3C,aAA2C;IAE3C,OAAO,EAAE,CAAC;AACX,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,mCAAmC,CACxD,QAAuB,EACvB,OAAmB;IAEnB,MAAM,OAAO,GAAG,MAAM,iBAAiB,CAAC,OAAO,CAAC,CAAC;IACjD,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC9B,oEAAoE;QACpE,uDAAuD;QACvD,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACrC,CAAC;IACD,OAAO,OAAO,CAAC,MAAM,CAAC;AACvB,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,sBAAsB,CACrC,QAAuB,EACvB,OAAmB,EACnB,QAA6C,EAC7C,KAAmB;IAEnB,OAAO,KAAK,EAAE,OAAO,EAAE,EAAE;QACxB,MAAM,KAAK,GAAG,MAAM,QAAQ,EAAE,CAAC;QAC/B,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAC,OAAO,EAAE,KAAK,CAAC,EAAE,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QAC/D,IAAI,CAAC,QAAQ;YAAE,OAAO,IAAI,CAAC;QAC3B,MAAM,eAAe,CAAC,OAAO,EAAE;YAC9B,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,KAAK,EAAE,QAAQ,CAAC,KAAK;YACrB,YAAY,EAAE,QAAQ,CAAC,YAAY;YACnC,QAAQ,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SAClC,CAAC,CAAC;QACH,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QACtC,OAAO,QAAQ,CAAC;IACjB,CAAC,CAAC;AACH,CAAC"}

package/dist/daemon/auth/redact.d.ts

@@ -0,0 +1,3 @@
+/** The HTTP owner preserves JSON and structured wire domains with the same bounded, memoized walk. */
+export { redactStackTraces, type RedactStackOptions } from '../../transports/http/auth/redact.ts';
+//# sourceMappingURL=redact.d.ts.map

package/dist/daemon/auth/redact.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"redact.d.ts","sourceRoot":"","sources":["../../../src/daemon/auth/redact.ts"],"names":[],"mappings":"AAAA,sGAAsG;AACtG,OAAO,EAAE,iBAAiB,EAAE,KAAK,kBAAkB,EAAE,MAAM,sCAAsC,CAAC"}

package/dist/daemon/auth/redact.js

@@ -0,0 +1,3 @@
+/** The HTTP owner preserves JSON and structured wire domains with the same bounded, memoized walk. */
+export { redactStackTraces } from "../../transports/http/auth/redact.js";
+//# sourceMappingURL=redact.js.map

package/dist/daemon/auth/redact.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"redact.js","sourceRoot":"","sources":["../../../src/daemon/auth/redact.ts"],"names":[],"mappings":"AAAA,sGAAsG;AACtG,OAAO,EAAE,iBAAiB,EAA2B,MAAM,sCAAsC,CAAC"}

package/dist/daemon/auth/tcp-dispatch.d.ts

@@ -0,0 +1,6 @@
+import { type InvokePipeline } from '@vibesdotdev/kernel';
+import { type BearerAuth, type JsonDocument } from '../../schemas/daemon/daemon-http.ts';
+import { type RuntimeRpcRoot } from '../services/api/rpc-root.ts';
+/** Credential metadata reaches admission separately from the untrusted command. */
+export declare function createTcpRpcDispatcher(root: RuntimeRpcRoot, pipeline: InvokePipeline): (message: JsonDocument, auth?: BearerAuth) => Promise<Response>;
+//# sourceMappingURL=tcp-dispatch.d.ts.map

package/dist/daemon/auth/tcp-dispatch.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tcp-dispatch.d.ts","sourceRoot":"","sources":["../../../src/daemon/auth/tcp-dispatch.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAI1D,OAAO,EAAqC,KAAK,UAAU,EAAE,KAAK,YAAY,EAAE,MAAM,qCAAqC,CAAC;AAC5H,OAAO,EAAoB,KAAK,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAMpF,mFAAmF;AACnF,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,cAAc,EAAE,QAAQ,EAAE,cAAc,IACtE,SAAS,YAAY,EAAE,OAAO,UAAU,KAAG,OAAO,CAAC,QAAQ,CAAC,CAyB1E"}

package/dist/daemon/auth/tcp-dispatch.js

@@ -0,0 +1,41 @@
+import {} from '@vibesdotdev/kernel';
+import { attemptAsync } from "../../core/protocol/lifecycle/attempt.js";
+import { FailureDescriber } from "../../core/protocol/transport/failure-describer.js";
+import { toRpcError } from "../../core/protocol/wire/verbs.js";
+import { RpcCommandSchema, RpcObjectSchema } from "../../schemas/daemon/daemon-http.js";
+import { RPC_ROOT_METHODS } from "../services/api/rpc-root.js";
+function commandRefusal(error) {
+    return Response.json({ success: false, error, code: 'INVALID_INPUT', reason: 'rpc-command-invalid' }, { status: 400 });
+}
+/** Credential metadata reaches admission separately from the untrusted command. */
+export function createTcpRpcDispatcher(root, pipeline) {
+    return async (message, auth) => {
+        const object = RpcObjectSchema.safeParse(message);
+        if (!object.success)
+            return commandRefusal('Expected an RPC command object');
+        const named = RpcCommandSchema.safeParse(object.data);
+        if (!named.success)
+            return commandRefusal('Expected an RPC command name');
+        const method = RPC_ROOT_METHODS.find((entry) => entry === named.data.command) ?? 'command';
+        const outcome = await attemptAsync(async () => {
+            const gated = pipeline.wrap(root, {
+                kind: 'runtime/rpc', implId: 'runtime-daemon', origin: 'remote',
+                caller: auth?.info.caller,
+                remotePeer: {
+                    runtimeId: auth?.info.label ?? 'http-client', transport: 'http', connectionId: crypto.randomUUID(),
+                    verified: auth?.info.caller ? { source: 'http-bearer', caller: auth.info.caller } : undefined
+                }
+            });
+            return Response.json(await gated[method](object.data));
+        });
+        if (outcome.ok)
+            return outcome.value;
+        const failure = new FailureDescriber([auth?.token]).describe(outcome.failure);
+        const cause = toRpcError(failure);
+        return Response.json({
+            success: false, error: cause.message, code: cause.code,
+            reason: cause.reason, details: cause.details, cause
+        }, { status: method === 'command' ? 404 : 500 });
+    };
+}
+//# sourceMappingURL=tcp-dispatch.js.map

package/dist/daemon/auth/tcp-dispatch.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tcp-dispatch.js","sourceRoot":"","sources":["../../../src/daemon/auth/tcp-dispatch.ts"],"names":[],"mappings":"AAAA,OAAO,EAAuB,MAAM,qBAAqB,CAAC;AAC1D,OAAO,EAAE,YAAY,EAAE,MAAM,0CAA0C,CAAC;AACxE,OAAO,EAAE,gBAAgB,EAAE,MAAM,oDAAoD,CAAC;AACtF,OAAO,EAAE,UAAU,EAAE,MAAM,mCAAmC,CAAC;AAC/D,OAAO,EAAE,gBAAgB,EAAE,eAAe,EAAsC,MAAM,qCAAqC,CAAC;AAC5H,OAAO,EAAE,gBAAgB,EAAuB,MAAM,6BAA6B,CAAC;AAEpF,SAAS,cAAc,CAAC,KAAa;IACpC,OAAO,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,eAAe,EAAE,MAAM,EAAE,qBAAqB,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;AACxH,CAAC;AAED,mFAAmF;AACnF,MAAM,UAAU,sBAAsB,CAAC,IAAoB,EAAE,QAAwB;IACpF,OAAO,KAAK,EAAE,OAAqB,EAAE,IAAiB,EAAqB,EAAE;QAC5E,MAAM,MAAM,GAAG,eAAe,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;QAClD,IAAI,CAAC,MAAM,CAAC,OAAO;YAAE,OAAO,cAAc,CAAC,gCAAgC,CAAC,CAAC;QAC7E,MAAM,KAAK,GAAG,gBAAgB,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACtD,IAAI,CAAC,KAAK,CAAC,OAAO;YAAE,OAAO,cAAc,CAAC,8BAA8B,CAAC,CAAC;QAC1E,MAAM,MAAM,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,SAAS,CAAC;QAC3F,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC,KAAK,IAAI,EAAE;YAC7C,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE;gBACjC,IAAI,EAAE,aAAa,EAAE,MAAM,EAAE,gBAAgB,EAAE,MAAM,EAAE,QAAQ;gBAC/D,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,MAAM;gBACzB,UAAU,EAAE;oBACX,SAAS,EAAE,IAAI,EAAE,IAAI,CAAC,KAAK,IAAI,aAAa,EAAE,SAAS,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,CAAC,UAAU,EAAE;oBAClG,QAAQ,EAAE,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,SAAS;iBAC7F;aACD,CAAC,CAAC;YACH,OAAO,QAAQ,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;QACxD,CAAC,CAAC,CAAC;QACH,IAAI,OAAO,CAAC,EAAE;YAAE,OAAO,OAAO,CAAC,KAAK,CAAC;QACrC,MAAM,OAAO,GAAG,IAAI,gBAAgB,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAC9E,MAAM,KAAK,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC;QAClC,OAAO,QAAQ,CAAC,IAAI,CAAC;YACpB,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI;YACtD,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,KAAK;SACnD,EAAE,EAAE,MAAM,EAAE,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC;IAClD,CAAC,CAAC;AACH,CAAC"}

package/dist/daemon/auth/tcp-handler.d.ts

@@ -0,0 +1,22 @@
+/**
+ * TCP fetch-handler factory for the runtime daemon.
+ *
+ * Layers four checks on top of the inner `handleSubscribe` / RPC
+ * dispatcher used by the Unix socket transport:
+ * 1. CORS allowlist (origin echo, never `*` unless opted in)
+ * 2. Bearer-token auth (Authorization header only — `?token=` is gone)
+ * 3. Per-verb capability scoping (read-only vs write)
+ * 4. SSE nonce flow (single-use, minted via `POST /subscribe`)
+ *
+ * `POST /pair` is the one endpoint that does not require a bearer token: the
+ * single-use, TTL'd, rate-limited pairing code IS the credential (the caller
+ * is by definition not yet paired). It is only mounted when the daemon
+ * supplies `completePairing`.
+ *
+ * Stack-trace fields are stripped from JSON responses unless the operator
+ * passes `httpDebug: true`.
+ */
+import { type TcpHandlerDeps } from '../../schemas/daemon/daemon-http.ts';
+export type { TcpHandlerDeps } from '../../schemas/daemon/daemon-http.ts';
+export declare function createTcpHandler(input: TcpHandlerDeps): (req: Request) => Promise<Response>;
+//# sourceMappingURL=tcp-handler.d.ts.map

package/dist/daemon/auth/tcp-handler.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tcp-handler.d.ts","sourceRoot":"","sources":["../../../src/daemon/auth/tcp-handler.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,EAAwB,KAAK,cAAc,EAAE,MAAM,qCAAqC,CAAC;AAKhG,YAAY,EAAE,cAAc,EAAE,MAAM,qCAAqC,CAAC;AAE1E,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,cAAc,GAAG,CAAC,GAAG,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,CAuE3F"}

package/dist/daemon/auth/tcp-handler.js

@@ -0,0 +1,61 @@
+/**
+ * TCP fetch-handler factory for the runtime daemon.
+ *
+ * Layers four checks on top of the inner `handleSubscribe` / RPC
+ * dispatcher used by the Unix socket transport:
+ * 1. CORS allowlist (origin echo, never `*` unless opted in)
+ * 2. Bearer-token auth (Authorization header only — `?token=` is gone)
+ * 3. Per-verb capability scoping (read-only vs write)
+ * 4. SSE nonce flow (single-use, minted via `POST /subscribe`)
+ *
+ * `POST /pair` is the one endpoint that does not require a bearer token: the
+ * single-use, TTL'd, rate-limited pairing code IS the credential (the caller
+ * is by definition not yet paired). It is only mounted when the daemon
+ * supplies `completePairing`.
+ *
+ * Stack-trace fields are stripped from JSON responses unless the operator
+ * passes `httpDebug: true`.
+ */
+import { TcpHandlerDepsSchema } from "../../schemas/daemon/daemon-http.js";
+import { finalize } from "./ingress/finalize.js";
+import { handleNonceMint, handleSubscribeWithNonce } from "./ingress/nonce.js";
+import { handlePair } from "./ingress/pair.js";
+import { handleRpc } from "./ingress/rpc.js";
+export function createTcpHandler(input) {
+    const deps = TcpHandlerDepsSchema.parse(input);
+    return async (req) => {
+        const origin = req.headers.get('Origin');
+        const cors = deps.corsPolicy.resolve(origin);
+        const url = new URL(req.url, `http://${deps.hostname}`);
+        const method = req.method.toUpperCase();
+        if (method === 'OPTIONS') {
+            return new Response(null, {
+                status: cors.allowed ? 204 : 403,
+                headers: cors.headers
+            });
+        }
+        if (origin && !cors.allowed) {
+            return finalize(Response.json({ success: false, error: 'Origin not allowed' }, { status: 403 }), cors.headers, deps.httpDebug);
+        }
+        if (url.searchParams.has('token')) {
+            return finalize(Response.json({
+                success: false,
+                error: 'Query-string `?token=` is no longer accepted; send Authorization: Bearer header for RPC, or mint a nonce via POST /subscribe for SSE.'
+            }, { status: 401 }), cors.headers, deps.httpDebug);
+        }
+        if (method === 'POST' && url.pathname === '/subscribe') {
+            return finalize(await handleNonceMint(req, deps), cors.headers, deps.httpDebug);
+        }
+        if (method === 'GET' && url.pathname === '/subscribe') {
+            return finalize(await handleSubscribeWithNonce(req, url, deps), cors.headers, deps.httpDebug);
+        }
+        if (method === 'POST' && url.pathname === '/rpc') {
+            return finalize(await handleRpc(req, deps), cors.headers, deps.httpDebug);
+        }
+        if (method === 'POST' && url.pathname === '/pair') {
+            return finalize(await handlePair(req, deps), cors.headers, deps.httpDebug);
+        }
+        return finalize(Response.json({ success: false, error: `Not found: ${method} ${url.pathname}` }, { status: 404 }), cors.headers, deps.httpDebug);
+    };
+}
+//# sourceMappingURL=tcp-handler.js.map

package/dist/daemon/auth/tcp-handler.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tcp-handler.js","sourceRoot":"","sources":["../../../src/daemon/auth/tcp-handler.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,EAAE,oBAAoB,EAAuB,MAAM,qCAAqC,CAAC;AAChG,OAAO,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAC;AACjD,OAAO,EAAE,eAAe,EAAE,wBAAwB,EAAE,MAAM,oBAAoB,CAAC;AAC/E,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAC/C,OAAO,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAG7C,MAAM,UAAU,gBAAgB,CAAC,KAAqB;IACrD,MAAM,IAAI,GAAG,oBAAoB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAC/C,OAAO,KAAK,EAAE,GAAG,EAAE,EAAE;QACpB,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACzC,MAAM,IAAI,GAAG,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAC7C,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,UAAU,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC;QACxD,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;QAExC,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YAC1B,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE;gBACzB,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG;gBAChC,OAAO,EAAE,IAAI,CAAC,OAAO;aACrB,CAAC,CAAC;QACJ,CAAC;QAED,IAAI,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;YAC7B,OAAO,QAAQ,CACd,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,oBAAoB,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,EAC/E,IAAI,CAAC,OAAO,EACZ,IAAI,CAAC,SAAS,CACd,CAAC;QACH,CAAC;QAED,IAAI,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;YACnC,OAAO,QAAQ,CACd,QAAQ,CAAC,IAAI,CACZ;gBACC,OAAO,EAAE,KAAK;gBACd,KAAK,EACJ,uIAAuI;aACxI,EACD,EAAE,MAAM,EAAE,GAAG,EAAE,CACf,EACD,IAAI,CAAC,OAAO,EACZ,IAAI,CAAC,SAAS,CACd,CAAC;QACH,CAAC;QAED,IAAI,MAAM,KAAK,MAAM,IAAI,GAAG,CAAC,QAAQ,KAAK,YAAY,EAAE,CAAC;YACxD,OAAO,QAAQ,CACd,MAAM,eAAe,CAAC,GAAG,EAAE,IAAI,CAAC,EAChC,IAAI,CAAC,OAAO,EACZ,IAAI,CAAC,SAAS,CACd,CAAC;QACH,CAAC;QAED,IAAI,MAAM,KAAK,KAAK,IAAI,GAAG,CAAC,QAAQ,KAAK,YAAY,EAAE,CAAC;YACvD,OAAO,QAAQ,CACd,MAAM,wBAAwB,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,EAC9C,IAAI,CAAC,OAAO,EACZ,IAAI,CAAC,SAAS,CACd,CAAC;QACH,CAAC;QAED,IAAI,MAAM,KAAK,MAAM,IAAI,GAAG,CAAC,QAAQ,KAAK,MAAM,EAAE,CAAC;YAClD,OAAO,QAAQ,CAAC,MAAM,SAAS,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;QAC3E,CAAC;QAED,IAAI,MAAM,KAAK,MAAM,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;YACnD,OAAO,QAAQ,CAAC,MAAM,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;QAC5E,CAAC;QAED,OAAO,QAAQ,CACd,QAAQ,CAAC,IAAI,CACZ,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,cAAc,MAAM,IAAI,GAAG,CAAC,QAAQ,EAAE,EAAE,EACjE,EAAE,MAAM,EAAE,GAAG,EAAE,CACf,EACD,IAAI,CAAC,OAAO,EACZ,IAAI,CAAC,SAAS,CACd,CAAC;IACH,CAAC,CAAC;AACH,CAAC"}

package/dist/daemon/client/contracts1/arguments.d.ts

@@ -0,0 +1,3 @@
+import { type CommandArgRecord } from '../../commands/command-argv.ts';
+export declare function jsonRecord(value: unknown): CommandArgRecord;
+//# sourceMappingURL=arguments.d.ts.map

package/dist/daemon/client/contracts1/arguments.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"arguments.d.ts","sourceRoot":"","sources":["../../../../src/daemon/client/contracts1/arguments.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,gBAAgB,EAAE,MAAM,gCAAgC,CAAC;AAOvE,wBAAgB,UAAU,CAAC,KAAK,EAAE,OAAO,GAAG,gBAAgB,CAW3D"}

package/dist/daemon/client/contracts1/arguments.js

@@ -0,0 +1,17 @@
+import {} from "../../commands/command-argv.js";
+import { OptionalJsonRecordSchema } from "../../../schemas/daemon/daemon-client.js";
+import { JsonDocumentSchema } from "../../../schemas/daemon/daemon-http.js";
+export function jsonRecord(value) {
+    const parsed = OptionalJsonRecordSchema.safeParse(value);
+    if (!parsed.success) {
+        throw new Error('RpcUnixClient: arguments are not a JSON object');
+    }
+    const defined = {};
+    for (const [key, item] of Object.entries(parsed.data)) {
+        const kept = JsonDocumentSchema.safeParse(item);
+        if (kept.success)
+            defined[key] = kept.data;
+    }
+    return defined;
+}
+//# sourceMappingURL=arguments.js.map

package/dist/daemon/client/contracts1/arguments.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"arguments.js","sourceRoot":"","sources":["../../../../src/daemon/client/contracts1/arguments.ts"],"names":[],"mappings":"AAAA,OAAO,EAAyB,MAAM,gCAAgC,CAAC;AAEvE,OAAO,EACP,wBAAwB,EACvB,MAAM,0CAA0C,CAAC;AAClD,OAAO,EAAE,kBAAkB,EAAE,MAAM,wCAAwC,CAAC;AAE5E,MAAM,UAAU,UAAU,CAAC,KAAc;IACxC,MAAM,MAAM,GAAG,wBAAwB,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IACzD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACrB,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;IACnE,CAAC;IACD,MAAM,OAAO,GAAqB,EAAE,CAAC;IACrC,KAAK,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;QACvD,MAAM,IAAI,GAAG,kBAAkB,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QAChD,IAAI,IAAI,CAAC,OAAO;YAAE,OAAO,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC;IAC5C,CAAC;IACD,OAAO,OAAO,CAAC;AAChB,CAAC"}