@viewportai/daemon 0.1.0 → 0.2.1

package/dist/relay/bridge-backoff.d.ts

@@ -0,0 +1,3 @@
+export declare function sleep(ms: number): Promise<void>;
+export declare function computeBackoffMs(attempt: number): number;
+//# sourceMappingURL=bridge-backoff.d.ts.map

package/dist/relay/bridge-backoff.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"bridge-backoff.d.ts","sourceRoot":"","sources":["../../src/relay/bridge-backoff.ts"],"names":[],"mappings":"AAEA,wBAAgB,KAAK,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAE/C;AAED,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAIxD"}

package/dist/relay/bridge-backoff.js

@@ -0,0 +1,10 @@
+import { RECONNECT_BASE_MS, RECONNECT_MAX_MS } from './bridge-constants.js';
+export function sleep(ms) {
+    return new Promise((resolve) => setTimeout(resolve, ms));
+}
+export function computeBackoffMs(attempt) {
+    const exp = Math.min(RECONNECT_MAX_MS, RECONNECT_BASE_MS * 2 ** Math.max(0, attempt - 1));
+    const jitter = Math.floor(Math.random() * 250);
+    return Math.min(RECONNECT_MAX_MS, exp + jitter);
+}
+//# sourceMappingURL=bridge-backoff.js.map

package/dist/relay/bridge-backoff.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bridge-backoff.js","sourceRoot":"","sources":["../../src/relay/bridge-backoff.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAE5E,MAAM,UAAU,KAAK,CAAC,EAAU;IAC9B,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;AAC3D,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,OAAe;IAC9C,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,gBAAgB,EAAE,iBAAiB,GAAG,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC;IAC1F,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,GAAG,CAAC,CAAC;IAC/C,OAAO,IAAI,CAAC,GAAG,CAAC,gBAAgB,EAAE,GAAG,GAAG,MAAM,CAAC,CAAC;AAClD,CAAC"}

package/dist/relay/bridge-connections.d.ts

@@ -0,0 +1,26 @@
+import type { WebSocket as WsType } from 'ws';
+type RelayWs = WsType;
+export interface OpenDaemonSocketOptions {
+    daemonWsUrl: string;
+    daemonAuthToken?: string;
+    daemonTlsVerify?: 'auto' | '0' | '1';
+    daemonCaCertPath?: string;
+    daemonTlsPins?: string[];
+}
+export interface RelayDaemonUrlOptions {
+    relayEndpoint: string;
+    workspaceId: string;
+    runtimeTargetId?: string;
+}
+export interface OpenRelayDaemonSocketOptions extends RelayDaemonUrlOptions {
+    relayToken: string;
+    relayTlsVerify?: 'auto' | '0' | '1';
+    relayCaCertPath?: string;
+    relayTlsPins?: string[];
+}
+export declare function daemonAuthHeaders(token: string | undefined): Record<string, string> | undefined;
+export declare function relayDaemonUrl(options: RelayDaemonUrlOptions): string;
+export declare function openDaemonSocket(options: OpenDaemonSocketOptions): Promise<RelayWs>;
+export declare function openRelayDaemonSocket(options: OpenRelayDaemonSocketOptions): Promise<RelayWs>;
+export {};
+//# sourceMappingURL=bridge-connections.d.ts.map

package/dist/relay/bridge-connections.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"bridge-connections.d.ts","sourceRoot":"","sources":["../../src/relay/bridge-connections.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,IAAI,MAAM,EAAE,MAAM,IAAI,CAAC;AAI9C,KAAK,OAAO,GAAG,MAAM,CAAC;AAEtB,MAAM,WAAW,uBAAuB;IACtC,WAAW,EAAE,MAAM,CAAC;IACpB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,eAAe,CAAC,EAAE,MAAM,GAAG,GAAG,GAAG,GAAG,CAAC;IACrC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;CAC1B;AAED,MAAM,WAAW,qBAAqB;IACpC,aAAa,EAAE,MAAM,CAAC;IACtB,WAAW,EAAE,MAAM,CAAC;IACpB,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,4BAA6B,SAAQ,qBAAqB;IACzE,UAAU,EAAE,MAAM,CAAC;IACnB,cAAc,CAAC,EAAE,MAAM,GAAG,GAAG,GAAG,GAAG,CAAC;IACpC,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;CACzB;AAED,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,SAAS,CAG/F;AAED,wBAAgB,cAAc,CAAC,OAAO,EAAE,qBAAqB,GAAG,MAAM,CAQrE;AAED,wBAAsB,gBAAgB,CAAC,OAAO,EAAE,uBAAuB,GAAG,OAAO,CAAC,OAAO,CAAC,CAYzF;AAED,wBAAsB,qBAAqB,CACzC,OAAO,EAAE,4BAA4B,GACpC,OAAO,CAAC,OAAO,CAAC,CAelB"}

package/dist/relay/bridge-connections.js

@@ -0,0 +1,34 @@
+import WebSocket from 'ws';
+import { resolveRelayTlsOptions, wsOpen } from './bridge-network.js';
+export function daemonAuthHeaders(token) {
+    if (!token)
+        return undefined;
+    return { authorization: `Bearer ${token}` };
+}
+export function relayDaemonUrl(options) {
+    return (`${options.relayEndpoint}?role=workspace-daemon` +
+        `&workspaceId=${encodeURIComponent(options.workspaceId)}` +
+        (options.runtimeTargetId
+            ? `&runtimeTargetId=${encodeURIComponent(options.runtimeTargetId)}`
+            : ''));
+}
+export async function openDaemonSocket(options) {
+    const daemonWs = new WebSocket(options.daemonWsUrl, {
+        ...resolveRelayTlsOptions(options.daemonWsUrl, options.daemonTlsVerify ?? 'auto', options.daemonCaCertPath, options.daemonTlsPins),
+        headers: daemonAuthHeaders(options.daemonAuthToken),
+    });
+    await wsOpen(daemonWs);
+    return daemonWs;
+}
+export async function openRelayDaemonSocket(options) {
+    const relayUrl = relayDaemonUrl(options);
+    const relayWs = new WebSocket(relayUrl, {
+        ...resolveRelayTlsOptions(relayUrl, options.relayTlsVerify ?? 'auto', options.relayCaCertPath, options.relayTlsPins),
+        headers: {
+            authorization: `Bearer ${options.relayToken}`,
+        },
+    });
+    await wsOpen(relayWs);
+    return relayWs;
+}
+//# sourceMappingURL=bridge-connections.js.map

package/dist/relay/bridge-connections.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bridge-connections.js","sourceRoot":"","sources":["../../src/relay/bridge-connections.ts"],"names":[],"mappings":"AACA,OAAO,SAAS,MAAM,IAAI,CAAC;AAC3B,OAAO,EAAE,sBAAsB,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAyBrE,MAAM,UAAU,iBAAiB,CAAC,KAAyB;IACzD,IAAI,CAAC,KAAK;QAAE,OAAO,SAAS,CAAC;IAC7B,OAAO,EAAE,aAAa,EAAE,UAAU,KAAK,EAAE,EAAE,CAAC;AAC9C,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,OAA8B;IAC3D,OAAO,CACL,GAAG,OAAO,CAAC,aAAa,wBAAwB;QAChD,gBAAgB,kBAAkB,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE;QACzD,CAAC,OAAO,CAAC,eAAe;YACtB,CAAC,CAAC,oBAAoB,kBAAkB,CAAC,OAAO,CAAC,eAAe,CAAC,EAAE;YACnE,CAAC,CAAC,EAAE,CAAC,CACR,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,OAAgC;IACrE,MAAM,QAAQ,GAAG,IAAI,SAAS,CAAC,OAAO,CAAC,WAAW,EAAE;QAClD,GAAG,sBAAsB,CACvB,OAAO,CAAC,WAAW,EACnB,OAAO,CAAC,eAAe,IAAI,MAAM,EACjC,OAAO,CAAC,gBAAgB,EACxB,OAAO,CAAC,aAAa,CACtB;QACD,OAAO,EAAE,iBAAiB,CAAC,OAAO,CAAC,eAAe,CAAC;KACpD,CAAC,CAAC;IACH,MAAM,MAAM,CAAC,QAAQ,CAAC,CAAC;IACvB,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,OAAqC;IAErC,MAAM,QAAQ,GAAG,cAAc,CAAC,OAAO,CAAC,CAAC;IACzC,MAAM,OAAO,GAAG,IAAI,SAAS,CAAC,QAAQ,EAAE;QACtC,GAAG,sBAAsB,CACvB,QAAQ,EACR,OAAO,CAAC,cAAc,IAAI,MAAM,EAChC,OAAO,CAAC,eAAe,EACvB,OAAO,CAAC,YAAY,CACrB;QACD,OAAO,EAAE;YACP,aAAa,EAAE,UAAU,OAAO,CAAC,UAAU,EAAE;SAC9C;KACF,CAAC,CAAC;IACH,MAAM,MAAM,CAAC,OAAO,CAAC,CAAC;IACtB,OAAO,OAAO,CAAC;AACjB,CAAC"}

package/dist/relay/bridge-constants.d.ts

@@ -0,0 +1,12 @@
+export declare const RECONNECT_BASE_MS = 1000;
+export declare const RECONNECT_MAX_MS = 30000;
+export declare const RELAY_CONNECT_TIMEOUT_MS = 8000;
+export declare const DAEMON_CONNECT_TIMEOUT_MS = 8000;
+export declare const DEFAULT_MAX_PENDING_OUTBOUND = 500;
+export declare const DEFAULT_MAX_PENDING_OUTBOUND_BYTES: number;
+export declare const ISSUE_FAILURE_THRESHOLD = 5;
+export declare const CIRCUIT_BREAKER_MS = 60000;
+export declare const RELAY_REPLAY_WINDOW = 1024;
+export declare const RELAY_KEY_ROTATE_AFTER_MESSAGES = 250;
+export declare const RELAY_SESSION_IDLE_TTL_MS: number;
+//# sourceMappingURL=bridge-constants.d.ts.map

package/dist/relay/bridge-constants.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"bridge-constants.d.ts","sourceRoot":"","sources":["../../src/relay/bridge-constants.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,iBAAiB,OAAQ,CAAC;AACvC,eAAO,MAAM,gBAAgB,QAAS,CAAC;AACvC,eAAO,MAAM,wBAAwB,OAAQ,CAAC;AAC9C,eAAO,MAAM,yBAAyB,OAAQ,CAAC;AAC/C,eAAO,MAAM,4BAA4B,MAAM,CAAC;AAChD,eAAO,MAAM,kCAAkC,QAAgB,CAAC;AAChE,eAAO,MAAM,uBAAuB,IAAI,CAAC;AACzC,eAAO,MAAM,kBAAkB,QAAS,CAAC;AACzC,eAAO,MAAM,mBAAmB,OAAO,CAAC;AACxC,eAAO,MAAM,+BAA+B,MAAM,CAAC;AACnD,eAAO,MAAM,yBAAyB,QAAc,CAAC"}

package/dist/relay/bridge-constants.js

@@ -0,0 +1,12 @@
+export const RECONNECT_BASE_MS = 1_000;
+export const RECONNECT_MAX_MS = 30_000;
+export const RELAY_CONNECT_TIMEOUT_MS = 8_000;
+export const DAEMON_CONNECT_TIMEOUT_MS = 8_000;
+export const DEFAULT_MAX_PENDING_OUTBOUND = 500;
+export const DEFAULT_MAX_PENDING_OUTBOUND_BYTES = 4 * 1_048_576;
+export const ISSUE_FAILURE_THRESHOLD = 5;
+export const CIRCUIT_BREAKER_MS = 60_000;
+export const RELAY_REPLAY_WINDOW = 1024;
+export const RELAY_KEY_ROTATE_AFTER_MESSAGES = 250;
+export const RELAY_SESSION_IDLE_TTL_MS = 15 * 60_000;
+//# sourceMappingURL=bridge-constants.js.map

package/dist/relay/bridge-constants.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bridge-constants.js","sourceRoot":"","sources":["../../src/relay/bridge-constants.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,iBAAiB,GAAG,KAAK,CAAC;AACvC,MAAM,CAAC,MAAM,gBAAgB,GAAG,MAAM,CAAC;AACvC,MAAM,CAAC,MAAM,wBAAwB,GAAG,KAAK,CAAC;AAC9C,MAAM,CAAC,MAAM,yBAAyB,GAAG,KAAK,CAAC;AAC/C,MAAM,CAAC,MAAM,4BAA4B,GAAG,GAAG,CAAC;AAChD,MAAM,CAAC,MAAM,kCAAkC,GAAG,CAAC,GAAG,SAAS,CAAC;AAChE,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC;AACzC,MAAM,CAAC,MAAM,kBAAkB,GAAG,MAAM,CAAC;AACzC,MAAM,CAAC,MAAM,mBAAmB,GAAG,IAAI,CAAC;AACxC,MAAM,CAAC,MAAM,+BAA+B,GAAG,GAAG,CAAC;AACnD,MAAM,CAAC,MAAM,yBAAyB,GAAG,EAAE,GAAG,MAAM,CAAC"}

package/dist/relay/bridge-crypto.d.ts

@@ -0,0 +1,19 @@
+import type { RelayHandshakeProfile } from './bridge-key-exchange.js';
+export interface RelayEnvelopeV2 {
+    type: 'e2ee';
+    version: 2;
+    profile: RelayHandshakeProfile;
+    sessionId: string;
+    epoch: number;
+    seq: number;
+    iv: string;
+    tag: string;
+    ciphertext: string;
+}
+export declare function toBase64Url(buffer: Buffer): string;
+export declare function fromBase64Url(value: string): Buffer;
+export declare function normalizeP256PrivateKey(raw: Buffer): Buffer | null;
+export declare function parseRelayEnvelope(raw: string): RelayEnvelopeV2;
+export declare function encryptEnvelope(key: Buffer, plaintext: string, metadata: Pick<RelayEnvelopeV2, 'profile' | 'sessionId' | 'epoch' | 'seq'>): string;
+export declare function decryptEnvelope(key: Buffer, envelope: RelayEnvelopeV2): string;
+//# sourceMappingURL=bridge-crypto.d.ts.map

package/dist/relay/bridge-crypto.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"bridge-crypto.d.ts","sourceRoot":"","sources":["../../src/relay/bridge-crypto.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,0BAA0B,CAAC;AAEtE,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,CAAC,CAAC;IACX,OAAO,EAAE,qBAAqB,CAAC;IAC/B,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;IACd,GAAG,EAAE,MAAM,CAAC;IACZ,EAAE,EAAE,MAAM,CAAC;IACX,GAAG,EAAE,MAAM,CAAC;IACZ,UAAU,EAAE,MAAM,CAAC;CACpB;AAeD,wBAAgB,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAElD;AAED,wBAAgB,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAEnD;AAED,wBAAgB,uBAAuB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAUlE;AAED,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG,eAAe,CAsB/D;AAED,wBAAgB,eAAe,CAC7B,GAAG,EAAE,MAAM,EACX,SAAS,EAAE,MAAM,EACjB,QAAQ,EAAE,IAAI,CAAC,eAAe,EAAE,SAAS,GAAG,WAAW,GAAG,OAAO,GAAG,KAAK,CAAC,GACzE,MAAM,CAkBR;AAED,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,eAAe,GAAG,MAAM,CAS9E"}

package/dist/relay/bridge-crypto.js

@@ -0,0 +1,72 @@
+import crypto from 'node:crypto';
+function isRelayHandshakeProfile(value) {
+    return value === 'noise-ik' || value === 'noise-ikpsk2';
+}
+function toEnvelopeAad(envelope) {
+    return Buffer.from(`viewport-relay-envelope-v2|${envelope.profile}|${envelope.sessionId}|${envelope.epoch}|${envelope.seq}`, 'utf8');
+}
+export function toBase64Url(buffer) {
+    return buffer.toString('base64url');
+}
+export function fromBase64Url(value) {
+    return Buffer.from(value, 'base64url');
+}
+export function normalizeP256PrivateKey(raw) {
+    if (raw.length === 0 || raw.length > 32) {
+        return null;
+    }
+    if (raw.length === 32) {
+        return raw;
+    }
+    return Buffer.concat([Buffer.alloc(32 - raw.length, 0), raw]);
+}
+export function parseRelayEnvelope(raw) {
+    const parsed = JSON.parse(raw);
+    if (parsed.type !== 'e2ee' ||
+        parsed.version !== 2 ||
+        !isRelayHandshakeProfile(parsed.profile) ||
+        typeof parsed.sessionId !== 'string' ||
+        parsed.sessionId.trim().length === 0 ||
+        typeof parsed.epoch !== 'number' ||
+        !Number.isInteger(parsed.epoch) ||
+        parsed.epoch < 1 ||
+        typeof parsed.seq !== 'number' ||
+        !Number.isInteger(parsed.seq) ||
+        parsed.seq < 1 ||
+        typeof parsed.iv !== 'string' ||
+        typeof parsed.tag !== 'string' ||
+        typeof parsed.ciphertext !== 'string') {
+        throw new Error('Invalid relay envelope');
+    }
+    return parsed;
+}
+export function encryptEnvelope(key, plaintext, metadata) {
+    const iv = crypto.randomBytes(12);
+    const cipher = crypto.createCipheriv('aes-256-gcm', key, iv);
+    cipher.setAAD(toEnvelopeAad(metadata));
+    const ciphertext = Buffer.concat([cipher.update(plaintext, 'utf8'), cipher.final()]);
+    const tag = cipher.getAuthTag();
+    const envelope = {
+        type: 'e2ee',
+        version: 2,
+        profile: metadata.profile,
+        sessionId: metadata.sessionId,
+        epoch: metadata.epoch,
+        seq: metadata.seq,
+        iv: toBase64Url(iv),
+        tag: toBase64Url(tag),
+        ciphertext: toBase64Url(ciphertext),
+    };
+    return JSON.stringify(envelope);
+}
+export function decryptEnvelope(key, envelope) {
+    const iv = fromBase64Url(envelope.iv);
+    const tag = fromBase64Url(envelope.tag);
+    const ciphertext = fromBase64Url(envelope.ciphertext);
+    const decipher = crypto.createDecipheriv('aes-256-gcm', key, iv);
+    decipher.setAAD(toEnvelopeAad(envelope));
+    decipher.setAuthTag(tag);
+    const plaintext = Buffer.concat([decipher.update(ciphertext), decipher.final()]);
+    return plaintext.toString('utf8');
+}
+//# sourceMappingURL=bridge-crypto.js.map

package/dist/relay/bridge-crypto.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bridge-crypto.js","sourceRoot":"","sources":["../../src/relay/bridge-crypto.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,aAAa,CAAC;AAejC,SAAS,uBAAuB,CAAC,KAAc;IAC7C,OAAO,KAAK,KAAK,UAAU,IAAI,KAAK,KAAK,cAAc,CAAC;AAC1D,CAAC;AAED,SAAS,aAAa,CACpB,QAA0E;IAE1E,OAAO,MAAM,CAAC,IAAI,CAChB,8BAA8B,QAAQ,CAAC,OAAO,IAAI,QAAQ,CAAC,SAAS,IAAI,QAAQ,CAAC,KAAK,IAAI,QAAQ,CAAC,GAAG,EAAE,EACxG,MAAM,CACP,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,MAAc;IACxC,OAAO,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AACtC,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,KAAa;IACzC,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC;AACzC,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,GAAW;IACjD,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,IAAI,GAAG,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;QACxC,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,GAAG,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;QACtB,OAAO,GAAG,CAAC;IACb,CAAC;IAED,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;AAChE,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,GAAW;IAC5C,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAA6B,CAAC;IAC3D,IACE,MAAM,CAAC,IAAI,KAAK,MAAM;QACtB,MAAM,CAAC,OAAO,KAAK,CAAC;QACpB,CAAC,uBAAuB,CAAC,MAAM,CAAC,OAAO,CAAC;QACxC,OAAO,MAAM,CAAC,SAAS,KAAK,QAAQ;QACpC,MAAM,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC;QACpC,OAAO,MAAM,CAAC,KAAK,KAAK,QAAQ;QAChC,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC;QAC/B,MAAM,CAAC,KAAK,GAAG,CAAC;QAChB,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ;QAC9B,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,GAAG,CAAC;QAC7B,MAAM,CAAC,GAAG,GAAG,CAAC;QACd,OAAO,MAAM,CAAC,EAAE,KAAK,QAAQ;QAC7B,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ;QAC9B,OAAO,MAAM,CAAC,UAAU,KAAK,QAAQ,EACrC,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;IAC5C,CAAC;IAED,OAAO,MAAyB,CAAC;AACnC,CAAC;AAED,MAAM,UAAU,eAAe,CAC7B,GAAW,EACX,SAAiB,EACjB,QAA0E;IAE1E,MAAM,EAAE,GAAG,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;IAClC,MAAM,MAAM,GAAG,MAAM,CAAC,cAAc,CAAC,aAAa,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;IAC7D,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC,CAAC;IACvC,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IACrF,MAAM,GAAG,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;IAChC,MAAM,QAAQ,GAAoB;QAChC,IAAI,EAAE,MAAM;QACZ,OAAO,EAAE,CAAC;QACV,OAAO,EAAE,QAAQ,CAAC,OAAO;QACzB,SAAS,EAAE,QAAQ,CAAC,SAAS;QAC7B,KAAK,EAAE,QAAQ,CAAC,KAAK;QACrB,GAAG,EAAE,QAAQ,CAAC,GAAG;QACjB,EAAE,EAAE,WAAW,CAAC,EAAE,CAAC;QACnB,GAAG,EAAE,WAAW,CAAC,GAAG,CAAC;QACrB,UAAU,EAAE,WAAW,CAAC,UAAU,CAAC;KACpC,CAAC;IACF,OAAO,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;AAClC,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,GAAW,EAAE,QAAyB;IACpE,MAAM,EAAE,GAAG,aAAa,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;IACtC,MAAM,GAAG,GAAG,aAAa,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;IACxC,MAAM,UAAU,GAAG,aAAa,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;IACtD,MAAM,QAAQ,GAAG,MAAM,CAAC,gBAAgB,CAAC,aAAa,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;IACjE,QAAQ,CAAC,MAAM,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC,CAAC;IACzC,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;IACzB,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IACjF,OAAO,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;AACpC,CAAC"}

package/dist/relay/bridge-daemon-key-registration.d.ts

@@ -0,0 +1,16 @@
+import type { DaemonRelayIdentity } from './bridge-key-exchange.js';
+interface DaemonKeyRegistrationOptions {
+    relayServerUrl: string;
+    workspaceId: string;
+    runtimeTargetId?: string;
+    relayTlsVerify?: 'auto' | '0' | '1';
+    relayCaCertPath?: string;
+    relayTlsPins?: string[];
+}
+export declare function registerDaemonPublicKeyWithControlPlane(input: {
+    options: DaemonKeyRegistrationOptions;
+    identity: DaemonRelayIdentity | null;
+    daemonIssueToken: string | null;
+}): Promise<string | null>;
+export {};
+//# sourceMappingURL=bridge-daemon-key-registration.d.ts.map

package/dist/relay/bridge-daemon-key-registration.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"bridge-daemon-key-registration.d.ts","sourceRoot":"","sources":["../../src/relay/bridge-daemon-key-registration.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAMpE,UAAU,4BAA4B;IACpC,cAAc,EAAE,MAAM,CAAC;IACvB,WAAW,EAAE,MAAM,CAAC;IACpB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,cAAc,CAAC,EAAE,MAAM,GAAG,GAAG,GAAG,GAAG,CAAC;IACpC,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;CACzB;AAED,wBAAsB,uCAAuC,CAAC,KAAK,EAAE;IACnE,OAAO,EAAE,4BAA4B,CAAC;IACtC,QAAQ,EAAE,mBAAmB,GAAG,IAAI,CAAC;IACrC,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;CACjC,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAgEzB"}

package/dist/relay/bridge-daemon-key-registration.js

@@ -0,0 +1,70 @@
+import { BridgeError } from './bridge-errors.js';
+import { ConfigManager } from '../core/config.js';
+import { logger as out } from '../core/output.js';
+import { transportFetch } from '../cli/network.js';
+export async function registerDaemonPublicKeyWithControlPlane(input) {
+    if (!input.identity) {
+        throw new BridgeError('DAEMON_KEY_REGISTER_FAILED', 'daemon identity unavailable');
+    }
+    const url = `${input.options.relayServerUrl.replace(/\/+$/, '')}` +
+        `/api/runtime/workspaces/${encodeURIComponent(input.options.workspaceId)}/daemon-key`;
+    const controller = new AbortController();
+    const timeout = setTimeout(() => controller.abort(), 8_000);
+    let res;
+    try {
+        res = await transportFetch(url, {
+            method: 'POST',
+            headers: { 'content-type': 'application/json' },
+            body: JSON.stringify({
+                credential: input.daemonIssueToken ?? undefined,
+                daemonPublicKey: input.identity.publicKey,
+                runtimeTargetId: input.options.runtimeTargetId,
+            }),
+            signal: controller.signal,
+            tlsVerify: input.options.relayTlsVerify ?? 'auto',
+            caCertPath: input.options.relayCaCertPath,
+            tlsPins: input.options.relayTlsPins,
+        });
+    }
+    catch (error) {
+        clearTimeout(timeout);
+        throw new BridgeError('DAEMON_KEY_REGISTER_FAILED', error instanceof Error ? error.message : String(error));
+    }
+    clearTimeout(timeout);
+    const parsed = (await res.json().catch(() => null));
+    if (!res.ok || !parsed?.ok) {
+        const reason = parsed?.reason ?? parsed?.error ?? `HTTP ${res.status}`;
+        throw new BridgeError('DAEMON_KEY_REGISTER_FAILED', `daemon key registration failed: ${reason}`);
+    }
+    const issuedToken = parsed.daemonIssueToken?.trim() ?? '';
+    if (issuedToken.length > 0) {
+        await persistIssueToken(issuedToken);
+        return issuedToken;
+    }
+    if (input.daemonIssueToken && input.daemonIssueToken.trim().length > 0) {
+        return input.daemonIssueToken;
+    }
+    throw new BridgeError('DAEMON_KEY_REGISTER_FAILED', 'daemon key registration succeeded but daemon issue token was missing');
+}
+async function persistIssueToken(issueToken) {
+    const normalized = issueToken.trim();
+    if (normalized.length === 0)
+        return;
+    try {
+        const manager = new ConfigManager();
+        await manager.load();
+        const daemonConfig = manager.getDaemonConfig() ?? {};
+        const relayConfig = daemonConfig.relay ?? {};
+        await manager.setDaemonConfig({
+            ...daemonConfig,
+            relay: {
+                ...relayConfig,
+                issueToken: normalized,
+            },
+        });
+    }
+    catch (error) {
+        out.warn(`[relay] failed to persist daemon issue token: ${error instanceof Error ? error.message : String(error)}`);
+    }
+}
+//# sourceMappingURL=bridge-daemon-key-registration.js.map

package/dist/relay/bridge-daemon-key-registration.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bridge-daemon-key-registration.js","sourceRoot":"","sources":["../../src/relay/bridge-daemon-key-registration.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAClD,OAAO,EAAE,MAAM,IAAI,GAAG,EAAE,MAAM,mBAAmB,CAAC;AAClD,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAWnD,MAAM,CAAC,KAAK,UAAU,uCAAuC,CAAC,KAI7D;IACC,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC;QACpB,MAAM,IAAI,WAAW,CAAC,4BAA4B,EAAE,6BAA6B,CAAC,CAAC;IACrF,CAAC;IAED,MAAM,GAAG,GACP,GAAG,KAAK,CAAC,OAAO,CAAC,cAAc,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,EAAE;QACrD,2BAA2B,kBAAkB,CAAC,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC,aAAa,CAAC;IAExF,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;IACzC,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,KAAK,CAAC,CAAC;IAE5D,IAAI,GAAa,CAAC;IAClB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,cAAc,CAAC,GAAG,EAAE;YAC9B,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACnB,UAAU,EAAE,KAAK,CAAC,gBAAgB,IAAI,SAAS;gBAC/C,eAAe,EAAE,KAAK,CAAC,QAAQ,CAAC,SAAS;gBACzC,eAAe,EAAE,KAAK,CAAC,OAAO,CAAC,eAAe;aAC/C,CAAC;YACF,MAAM,EAAE,UAAU,CAAC,MAAM;YACzB,SAAS,EAAE,KAAK,CAAC,OAAO,CAAC,cAAc,IAAI,MAAM;YACjD,UAAU,EAAE,KAAK,CAAC,OAAO,CAAC,eAAe;YACzC,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,YAAY;SACpC,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,YAAY,CAAC,OAAO,CAAC,CAAC;QACtB,MAAM,IAAI,WAAW,CACnB,4BAA4B,EAC5B,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CACvD,CAAC;IACJ,CAAC;IACD,YAAY,CAAC,OAAO,CAAC,CAAC;IAEtB,MAAM,MAAM,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAK1C,CAAC;IAET,IAAI,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,MAAM,EAAE,EAAE,EAAE,CAAC;QAC3B,MAAM,MAAM,GAAG,MAAM,EAAE,MAAM,IAAI,MAAM,EAAE,KAAK,IAAI,QAAQ,GAAG,CAAC,MAAM,EAAE,CAAC;QACvE,MAAM,IAAI,WAAW,CACnB,4BAA4B,EAC5B,mCAAmC,MAAM,EAAE,CAC5C,CAAC;IACJ,CAAC;IAED,MAAM,WAAW,GAAG,MAAM,CAAC,gBAAgB,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IAC1D,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC3B,MAAM,iBAAiB,CAAC,WAAW,CAAC,CAAC;QACrC,OAAO,WAAW,CAAC;IACrB,CAAC;IACD,IAAI,KAAK,CAAC,gBAAgB,IAAI,KAAK,CAAC,gBAAgB,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvE,OAAO,KAAK,CAAC,gBAAgB,CAAC;IAChC,CAAC;IAED,MAAM,IAAI,WAAW,CACnB,4BAA4B,EAC5B,sEAAsE,CACvE,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,iBAAiB,CAAC,UAAkB;IACjD,MAAM,UAAU,GAAG,UAAU,CAAC,IAAI,EAAE,CAAC;IACrC,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO;IACpC,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,IAAI,aAAa,EAAE,CAAC;QACpC,MAAM,OAAO,CAAC,IAAI,EAAE,CAAC;QACrB,MAAM,YAAY,GAAG,OAAO,CAAC,eAAe,EAAE,IAAI,EAAE,CAAC;QACrD,MAAM,WAAW,GAAG,YAAY,CAAC,KAAK,IAAI,EAAE,CAAC;QAC7C,MAAM,OAAO,CAAC,eAAe,CAAC;YAC5B,GAAG,YAAY;YACf,KAAK,EAAE;gBACL,GAAG,WAAW;gBACd,UAAU,EAAE,UAAU;aACvB;SACF,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,GAAG,CAAC,IAAI,CACN,iDAAiD,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAC1G,CAAC;IACJ,CAAC;AACH,CAAC"}

package/dist/relay/bridge-errors.d.ts

@@ -0,0 +1,8 @@
+export type BridgeErrorCode = 'TOKEN_ISSUE_FAILED' | 'TOKEN_RESPONSE_INVALID' | 'DAEMON_KEY_REGISTER_FAILED' | 'KEY_EXCHANGE_FAILED' | 'WEBSOCKET_CONNECT_TIMEOUT' | 'ENVELOPE_DECRYPT_FAILED' | 'CIRCUIT_OPEN' | 'WEBSOCKET_ERROR' | 'UNKNOWN';
+export declare class BridgeError extends Error {
+    readonly code: BridgeErrorCode;
+    constructor(code: BridgeErrorCode, message: string);
+}
+export declare function normalizeBridgeError(error: unknown): BridgeError;
+export declare function isControlPlaneBridgeError(code: BridgeErrorCode): boolean;
+//# sourceMappingURL=bridge-errors.d.ts.map

package/dist/relay/bridge-errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"bridge-errors.d.ts","sourceRoot":"","sources":["../../src/relay/bridge-errors.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,eAAe,GACvB,oBAAoB,GACpB,wBAAwB,GACxB,4BAA4B,GAC5B,qBAAqB,GACrB,2BAA2B,GAC3B,yBAAyB,GACzB,cAAc,GACd,iBAAiB,GACjB,SAAS,CAAC;AAEd,qBAAa,WAAY,SAAQ,KAAK;IAElC,QAAQ,CAAC,IAAI,EAAE,eAAe;gBAArB,IAAI,EAAE,eAAe,EAC9B,OAAO,EAAE,MAAM;CAKlB;AAED,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,OAAO,GAAG,WAAW,CAQhE;AAED,wBAAgB,yBAAyB,CAAC,IAAI,EAAE,eAAe,GAAG,OAAO,CAMxE"}

package/dist/relay/bridge-errors.js

@@ -0,0 +1,23 @@
+export class BridgeError extends Error {
+    code;
+    constructor(code, message) {
+        super(message);
+        this.code = code;
+        this.name = 'BridgeError';
+    }
+}
+export function normalizeBridgeError(error) {
+    if (error instanceof BridgeError) {
+        return error;
+    }
+    if (error instanceof Error) {
+        return new BridgeError('UNKNOWN', error.message);
+    }
+    return new BridgeError('UNKNOWN', String(error));
+}
+export function isControlPlaneBridgeError(code) {
+    return (code === 'TOKEN_ISSUE_FAILED' ||
+        code === 'TOKEN_RESPONSE_INVALID' ||
+        code === 'DAEMON_KEY_REGISTER_FAILED');
+}
+//# sourceMappingURL=bridge-errors.js.map

package/dist/relay/bridge-errors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bridge-errors.js","sourceRoot":"","sources":["../../src/relay/bridge-errors.ts"],"names":[],"mappings":"AAWA,MAAM,OAAO,WAAY,SAAQ,KAAK;IAEzB;IADX,YACW,IAAqB,EAC9B,OAAe;QAEf,KAAK,CAAC,OAAO,CAAC,CAAC;QAHN,SAAI,GAAJ,IAAI,CAAiB;QAI9B,IAAI,CAAC,IAAI,GAAG,aAAa,CAAC;IAC5B,CAAC;CACF;AAED,MAAM,UAAU,oBAAoB,CAAC,KAAc;IACjD,IAAI,KAAK,YAAY,WAAW,EAAE,CAAC;QACjC,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,KAAK,YAAY,KAAK,EAAE,CAAC;QAC3B,OAAO,IAAI,WAAW,CAAC,SAAS,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;IACnD,CAAC;IACD,OAAO,IAAI,WAAW,CAAC,SAAS,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;AACnD,CAAC;AAED,MAAM,UAAU,yBAAyB,CAAC,IAAqB;IAC7D,OAAO,CACL,IAAI,KAAK,oBAAoB;QAC7B,IAAI,KAAK,wBAAwB;QACjC,IAAI,KAAK,4BAA4B,CACtC,CAAC;AACJ,CAAC"}

package/dist/relay/bridge-frame-logger.d.ts

@@ -0,0 +1,2 @@
+export declare function logDaemonFrameSummary(source: 'daemon->relay' | 'relay->daemon', payload: string): void;
+//# sourceMappingURL=bridge-frame-logger.d.ts.map

package/dist/relay/bridge-frame-logger.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"bridge-frame-logger.d.ts","sourceRoot":"","sources":["../../src/relay/bridge-frame-logger.ts"],"names":[],"mappings":"AAEA,wBAAgB,qBAAqB,CACnC,MAAM,EAAE,eAAe,GAAG,eAAe,EACzC,OAAO,EAAE,MAAM,GACd,IAAI,CAsCN"}

package/dist/relay/bridge-frame-logger.js

@@ -0,0 +1,37 @@
+import { logger as out } from '../core/output.js';
+export function logDaemonFrameSummary(source, payload) {
+    let parsed;
+    try {
+        parsed = JSON.parse(payload);
+    }
+    catch {
+        return;
+    }
+    if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed))
+        return;
+    const frame = parsed;
+    const type = typeof frame.type === 'string' ? frame.type : '';
+    if (!type)
+        return;
+    if (type === 'hello') {
+        const directories = Array.isArray(frame.directories) ? frame.directories.length : 0;
+        const activeSessions = Array.isArray(frame.activeSessions) ? frame.activeSessions.length : 0;
+        const discoveredSessions = Array.isArray(frame.discoveredSessions)
+            ? frame.discoveredSessions.length
+            : 0;
+        out.log(`[relay] ${source} hello dirs=${directories} active=${activeSessions} discovered=${discoveredSessions}`);
+        return;
+    }
+    if (type === 'session-list') {
+        const sessions = Array.isArray(frame.sessions) ? frame.sessions.length : 0;
+        const directoryId = typeof frame.directoryId === 'string' ? frame.directoryId : '<unknown>';
+        const total = typeof frame.total === 'number' ? frame.total : sessions;
+        out.log(`[relay] ${source} session-list directory=${directoryId} returned=${sessions} total=${total}`);
+        return;
+    }
+    if (type === 'discovered-sessions-updated') {
+        const sessions = Array.isArray(frame.sessions) ? frame.sessions.length : 0;
+        out.log(`[relay] ${source} discovered-sessions-updated count=${sessions}`);
+    }
+}
+//# sourceMappingURL=bridge-frame-logger.js.map

package/dist/relay/bridge-frame-logger.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bridge-frame-logger.js","sourceRoot":"","sources":["../../src/relay/bridge-frame-logger.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,IAAI,GAAG,EAAE,MAAM,mBAAmB,CAAC;AAElD,MAAM,UAAU,qBAAqB,CACnC,MAAyC,EACzC,OAAe;IAEf,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC/B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO;IACT,CAAC;IACD,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;QAAE,OAAO;IAC3E,MAAM,KAAK,GAAG,MAAiC,CAAC;IAChD,MAAM,IAAI,GAAG,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;IAC9D,IAAI,CAAC,IAAI;QAAE,OAAO;IAElB,IAAI,IAAI,KAAK,OAAO,EAAE,CAAC;QACrB,MAAM,WAAW,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;QACpF,MAAM,cAAc,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;QAC7F,MAAM,kBAAkB,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,kBAAkB,CAAC;YAChE,CAAC,CAAC,KAAK,CAAC,kBAAkB,CAAC,MAAM;YACjC,CAAC,CAAC,CAAC,CAAC;QACN,GAAG,CAAC,GAAG,CACL,WAAW,MAAM,eAAe,WAAW,WAAW,cAAc,eAAe,kBAAkB,EAAE,CACxG,CAAC;QACF,OAAO;IACT,CAAC;IAED,IAAI,IAAI,KAAK,cAAc,EAAE,CAAC;QAC5B,MAAM,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;QAC3E,MAAM,WAAW,GAAG,OAAO,KAAK,CAAC,WAAW,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,WAAW,CAAC;QAC5F,MAAM,KAAK,GAAG,OAAO,KAAK,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC;QACvE,GAAG,CAAC,GAAG,CACL,WAAW,MAAM,2BAA2B,WAAW,aAAa,QAAQ,UAAU,KAAK,EAAE,CAC9F,CAAC;QACF,OAAO;IACT,CAAC;IAED,IAAI,IAAI,KAAK,6BAA6B,EAAE,CAAC;QAC3C,MAAM,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;QAC3E,GAAG,CAAC,GAAG,CAAC,WAAW,MAAM,sCAAsC,QAAQ,EAAE,CAAC,CAAC;IAC7E,CAAC;AACH,CAAC"}

package/dist/relay/bridge-handshake-profile.d.ts

@@ -0,0 +1,3 @@
+import type { RelayHandshakeProfile } from './bridge-key-exchange.js';
+export declare function isCompatibleProfile(required: RelayHandshakeProfile, requested: RelayHandshakeProfile): boolean;
+//# sourceMappingURL=bridge-handshake-profile.d.ts.map

package/dist/relay/bridge-handshake-profile.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"bridge-handshake-profile.d.ts","sourceRoot":"","sources":["../../src/relay/bridge-handshake-profile.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,0BAA0B,CAAC;AAMtE,wBAAgB,mBAAmB,CACjC,QAAQ,EAAE,qBAAqB,EAC/B,SAAS,EAAE,qBAAqB,GAC/B,OAAO,CAET"}

package/dist/relay/bridge-handshake-profile.js

@@ -0,0 +1,7 @@
+function profileStrength(profile) {
+    return profile === 'noise-ikpsk2' ? 2 : 1;
+}
+export function isCompatibleProfile(required, requested) {
+    return profileStrength(requested) >= profileStrength(required);
+}
+//# sourceMappingURL=bridge-handshake-profile.js.map

package/dist/relay/bridge-handshake-profile.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bridge-handshake-profile.js","sourceRoot":"","sources":["../../src/relay/bridge-handshake-profile.ts"],"names":[],"mappings":"AAEA,SAAS,eAAe,CAAC,OAA8B;IACrD,OAAO,OAAO,KAAK,cAAc,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC5C,CAAC;AAED,MAAM,UAAU,mBAAmB,CACjC,QAA+B,EAC/B,SAAgC;IAEhC,OAAO,eAAe,CAAC,SAAS,CAAC,IAAI,eAAe,CAAC,QAAQ,CAAC,CAAC;AACjE,CAAC"}

package/dist/relay/bridge-identity-store.d.ts

@@ -0,0 +1,9 @@
+export interface DaemonRelayIdentity {
+    deviceId: string;
+    createdAt: number;
+    publicKey: string;
+    privateKey: string;
+    algorithm: 'p256';
+}
+export declare function loadOrCreateIdentity(): Promise<DaemonRelayIdentity>;
+//# sourceMappingURL=bridge-identity-store.d.ts.map

package/dist/relay/bridge-identity-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"bridge-identity-store.d.ts","sourceRoot":"","sources":["../../src/relay/bridge-identity-store.ts"],"names":[],"mappings":"AAMA,MAAM,WAAW,mBAAmB;IAClC,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;CACnB;AAmED,wBAAsB,oBAAoB,IAAI,OAAO,CAAC,mBAAmB,CAAC,CAUzE"}

package/dist/relay/bridge-identity-store.js

@@ -0,0 +1,73 @@
+import * as crypto from 'node:crypto';
+import fs from 'node:fs/promises';
+import path from 'node:path';
+import { configDir } from '../core/config.js';
+import { fromBase64Url, normalizeP256PrivateKey, toBase64Url } from './bridge-crypto.js';
+function globalIdentityFilePath() {
+    return path.join(configDir(), 'relay-daemon-identity.json');
+}
+async function writeJsonAtomic(filePath, value) {
+    const dir = path.dirname(filePath);
+    await fs.mkdir(dir, { recursive: true });
+    const tmp = `${filePath}.tmp-${process.pid}-${Date.now()}`;
+    await fs.writeFile(tmp, JSON.stringify(value, null, 2) + '\n', { mode: 0o600 });
+    await fs.rename(tmp, filePath);
+}
+async function readIdentityFile(filePath) {
+    try {
+        const raw = await fs.readFile(filePath, 'utf8');
+        const parsed = JSON.parse(raw);
+        if (parsed.algorithm === 'p256' &&
+            typeof parsed.deviceId === 'string' &&
+            parsed.deviceId.trim().length > 0 &&
+            typeof parsed.publicKey === 'string' &&
+            typeof parsed.privateKey === 'string') {
+            const priv = normalizeP256PrivateKey(fromBase64Url(parsed.privateKey));
+            const pub = fromBase64Url(parsed.publicKey);
+            if (priv && pub.length === 65 && pub[0] === 0x04) {
+                return {
+                    deviceId: parsed.deviceId,
+                    createdAt: typeof parsed.createdAt === 'number' ? parsed.createdAt : 0,
+                    algorithm: 'p256',
+                    publicKey: parsed.publicKey,
+                    privateKey: toBase64Url(priv),
+                };
+            }
+        }
+    }
+    catch {
+        // handled by caller
+    }
+    return null;
+}
+async function writeIdentityFile(filePath, identity) {
+    await writeJsonAtomic(filePath, identity);
+}
+async function createIdentity() {
+    const createdAt = Date.now();
+    const deviceId = crypto.randomUUID();
+    const ecdh = crypto.createECDH('prime256v1');
+    const publicKey = ecdh.generateKeys();
+    const privateKey = normalizeP256PrivateKey(ecdh.getPrivateKey());
+    if (!privateKey) {
+        throw new Error('failed to generate daemon relay identity');
+    }
+    return {
+        deviceId,
+        createdAt,
+        algorithm: 'p256',
+        publicKey: toBase64Url(publicKey),
+        privateKey: toBase64Url(privateKey),
+    };
+}
+export async function loadOrCreateIdentity() {
+    const globalPath = globalIdentityFilePath();
+    const existing = await readIdentityFile(globalPath);
+    if (existing) {
+        return existing;
+    }
+    const identity = await createIdentity();
+    await writeIdentityFile(globalPath, identity);
+    return identity;
+}
+//# sourceMappingURL=bridge-identity-store.js.map

package/dist/relay/bridge-identity-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bridge-identity-store.js","sourceRoot":"","sources":["../../src/relay/bridge-identity-store.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,MAAM,aAAa,CAAC;AACtC,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAClC,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAC9C,OAAO,EAAE,aAAa,EAAE,uBAAuB,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAUzF,SAAS,sBAAsB;IAC7B,OAAO,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,EAAE,4BAA4B,CAAC,CAAC;AAC9D,CAAC;AAED,KAAK,UAAU,eAAe,CAAC,QAAgB,EAAE,KAAc;IAC7D,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IACnC,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACzC,MAAM,GAAG,GAAG,GAAG,QAAQ,QAAQ,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;IAC3D,MAAM,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAChF,MAAM,EAAE,CAAC,MAAM,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;AACjC,CAAC;AAED,KAAK,UAAU,gBAAgB,CAAC,QAAgB;IAC9C,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QAChD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAiC,CAAC;QAC/D,IACE,MAAM,CAAC,SAAS,KAAK,MAAM;YAC3B,OAAO,MAAM,CAAC,QAAQ,KAAK,QAAQ;YACnC,MAAM,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC;YACjC,OAAO,MAAM,CAAC,SAAS,KAAK,QAAQ;YACpC,OAAO,MAAM,CAAC,UAAU,KAAK,QAAQ,EACrC,CAAC;YACD,MAAM,IAAI,GAAG,uBAAuB,CAAC,aAAa,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC;YACvE,MAAM,GAAG,GAAG,aAAa,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;YAC5C,IAAI,IAAI,IAAI,GAAG,CAAC,MAAM,KAAK,EAAE,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;gBACjD,OAAO;oBACL,QAAQ,EAAE,MAAM,CAAC,QAAQ;oBACzB,SAAS,EAAE,OAAO,MAAM,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;oBACtE,SAAS,EAAE,MAAM;oBACjB,SAAS,EAAE,MAAM,CAAC,SAAS;oBAC3B,UAAU,EAAE,WAAW,CAAC,IAAI,CAAC;iBAC9B,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,oBAAoB;IACtB,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,KAAK,UAAU,iBAAiB,CAAC,QAAgB,EAAE,QAA6B;IAC9E,MAAM,eAAe,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;AAC5C,CAAC;AAED,KAAK,UAAU,cAAc;IAC3B,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC7B,MAAM,QAAQ,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;IAErC,MAAM,IAAI,GAAG,MAAM,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC;IAC7C,MAAM,SAAS,GAAG,IAAI,CAAC,YAAY,EAAE,CAAC;IACtC,MAAM,UAAU,GAAG,uBAAuB,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC,CAAC;IACjE,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;IAC9D,CAAC;IAED,OAAO;QACL,QAAQ;QACR,SAAS;QACT,SAAS,EAAE,MAAM;QACjB,SAAS,EAAE,WAAW,CAAC,SAAS,CAAC;QACjC,UAAU,EAAE,WAAW,CAAC,UAAU,CAAC;KACpC,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oBAAoB;IACxC,MAAM,UAAU,GAAG,sBAAsB,EAAE,CAAC;IAC5C,MAAM,QAAQ,GAAG,MAAM,gBAAgB,CAAC,UAAU,CAAC,CAAC;IACpD,IAAI,QAAQ,EAAE,CAAC;QACb,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,cAAc,EAAE,CAAC;IACxC,MAAM,iBAAiB,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;IAC9C,OAAO,QAAQ,CAAC;AAClB,CAAC"}

package/dist/relay/bridge-jwt.d.ts

@@ -0,0 +1,18 @@
+export interface RelayTokenClaims {
+    e2eeProfile?: string;
+    pairingSecret?: string;
+    iss?: string;
+    aud?: string | string[];
+    exp?: number;
+    iat?: number;
+    nbf?: number;
+    jti?: string;
+}
+export interface RelayTokenVerificationOptions {
+    issuer?: string;
+    audience?: string;
+    signingKeys: Record<string, string>;
+    clockSkewSec?: number;
+}
+export declare function verifyRelayTokenClaims(relayToken: string, options: RelayTokenVerificationOptions): RelayTokenClaims;
+//# sourceMappingURL=bridge-jwt.d.ts.map

package/dist/relay/bridge-jwt.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"bridge-jwt.d.ts","sourceRoot":"","sources":["../../src/relay/bridge-jwt.ts"],"names":[],"mappings":"AAGA,MAAM,WAAW,gBAAgB;IAC/B,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IACxB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,6BAA6B;IAC5C,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACpC,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AA+ED,wBAAgB,sBAAsB,CACpC,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE,6BAA6B,GACrC,gBAAgB,CAiGlB"}