@viewportai/daemon 0.2.0 → 0.3.0

package/dist/server/http-server.js

@@ -5,67 +5,18 @@
  */
 import fs from 'node:fs/promises';
 import path from 'node:path';
-import { z } from 'zod';
-import { HookBaseInputSchema } from '../hooks/types.js';
 import { extractBearerToken } from './auth.js';
 import { isHostAllowed, isLoopbackHost, isOriginAllowed, isPathWithin } from './security.js';
-import { metrics } from '../core/metrics.js';
-import { encodeProjectDir, readSessionMessagesRich } from '../discovery/jsonl-reader.js';
-import { readCodexSessionMessagesRich } from '../discovery/codex.js';
-import { issuePairingOffer, redeemPairingOffer } from './pairing-offers.js';
-import { readPersistedReplayMeta, readPersistedSessionMessagesRich } from './ring-buffer.js';
+import { registerHealthRoutes } from './http-health-routes.js';
+import { registerContextRoutes } from './http-context-routes.js';
+import { registerLifecycleRoutes } from './http-lifecycle-routes.js';
+import { registerPairingRoutes } from './http-pairing-routes.js';
+import { registerSessionRoutes } from './http-session-routes.js';
+import { DirectoryRegisterBodySchema, HookBodySchema, WorkflowApprovalBodySchema, WorkflowCancelBodySchema, WorkflowRunBodySchema, WorkflowValidateBodySchema, invalidPayloadError, } from './http-request-schemas.js';
+import { parseSessionMessageLimit, parseSessionMessageOffset, readDaemonSessionMessagePage, } from './session-message-reader.js';
+import { ViewportError } from '../core/errors.js';
 const startTime = Date.now();
-const SessionModeBodySchema = z.object({ mode: z.enum(['detect', 'bypass']) }).strict();
-const WorktreeRollbackBodySchema = z.object({ toSha: z.string().trim().min(1) }).strict();
-const WorktreeRetryBodySchema = z.object({ fromSha: z.string().trim().min(1) }).strict();
-const WorktreeSquashBodySchema = z
-    .object({
-    targetBranch: z.string().trim().min(1).optional(),
-    commitMessage: z.string().trim().min(1).optional(),
-})
-    .strict();
-const PermissionRespondBodySchema = z
-    .object({
-    sessionId: z.string().trim().min(1),
-    requestId: z.string().trim().min(1),
-    behavior: z.enum(['allow', 'deny']),
-    message: z.string().trim().min(1).optional(),
-    allowAlways: z.boolean().optional(),
-})
-    .strict();
-const DirectoryRegisterBodySchema = z
-    .object({
-    path: z.string().trim().min(1),
-    config: z.record(z.string(), z.unknown()).optional(),
-})
-    .strict();
-const PairRedeemBodySchema = z
-    .object({
-    offerId: z.string().trim().min(1),
-    proof: z.string().trim().min(1),
-    trustAnchor: z.string().trim().min(1),
-    clientPublicKey: z.string().trim().min(1),
-    clientProof: z.string().trim().min(1),
-})
-    .strict();
-const PairOfferBodySchema = z
-    .object({
-    ttlSeconds: z.number().int().min(30).max(3600).optional(),
-})
-    .strict();
-const HookBodySchema = HookBaseInputSchema.extend({
-    adapter: z.string().trim().min(1).max(64).optional(),
-}).passthrough();
-const REDEEM_WINDOW_MS = 60_000;
-const REDEEM_MAX_ATTEMPTS = 12;
-const REDEEM_ATTEMPT_IP_MAP_MAX = 2_048;
-function invalidPayloadError(error) {
-    const first = error.issues[0];
-    if (!first)
-        return 'Invalid payload';
-    const field = first.path.join('.') || '<root>';
-    return `Invalid payload at ${field}: ${first.message}`;
-}
+export { recordRedeemAttempt } from './http-pairing-routes.js';
 function isHookAuthBypassAllowed(securityProfile) {
     if (!securityProfile)
         return true;
@@ -76,39 +27,12 @@ function isPairAuthBypassAllowed(securityProfile) {
         return false;
     return securityProfile.profile === 'local' && isLoopbackHost(securityProfile.host);
 }
-export function recordRedeemAttempt(attemptsByIp, ip, nowMs) {
-    const staleBefore = nowMs - REDEEM_WINDOW_MS;
-    const previous = attemptsByIp.get(ip);
-    const freshAttempts = (previous?.attempts ?? []).filter((timestamp) => timestamp >= staleBefore);
-    freshAttempts.push(nowMs);
-    attemptsByIp.set(ip, {
-        attempts: freshAttempts,
-        updatedAt: nowMs,
-    });
-    if (attemptsByIp.size > REDEEM_ATTEMPT_IP_MAP_MAX) {
-        for (const [candidateIp, entry] of attemptsByIp.entries()) {
-            const newestAttempt = entry.attempts.at(-1);
-            if (typeof newestAttempt !== 'number' || newestAttempt < staleBefore) {
-                attemptsByIp.delete(candidateIp);
-            }
-        }
-    }
-    while (attemptsByIp.size > REDEEM_ATTEMPT_IP_MAP_MAX) {
-        const oldest = attemptsByIp.entries().next();
-        if (oldest.done) {
-            break;
-        }
-        attemptsByIp.delete(oldest.value[0]);
-    }
-    return freshAttempts.length;
-}
 export function registerHttpRoutes(app, daemon, registry, options) {
     const hookRouter = options?.hookRouter;
     const auth = options?.auth;
     const runtime = options?.runtime;
     const securityProfile = options?.securityProfile;
     const mustRequireAuth = !!auth || securityProfile?.requireAuth === true;
-    const redeemAttemptTimestamps = new Map();
     // Security/auth hook for protected routes.
     app.addHook('onRequest', async (request, reply) => {
         const rawUrl = request.url ?? '';
@@ -128,6 +52,9 @@ export function registerHttpRoutes(app, daemon, registry, options) {
             return;
         const isLifecycleUrl = url === '/api/lifecycle/shutdown' || url === '/api/lifecycle/restart';
         if (isLifecycleUrl) {
+            if (!mustRequireAuth) {
+                return;
+            }
             if (!auth) {
                 return reply.status(401).send({ error: 'Unauthorized' });
             }
@@ -158,31 +85,10 @@ export function registerHttpRoutes(app, daemon, registry, options) {
     // ---------------------------------------------------------------------------
     // Health
     // ---------------------------------------------------------------------------
-    app.get('/health', async () => {
-        const memory = process.memoryUsage();
-        return {
-            status: 'ok',
-            uptime: Math.floor((Date.now() - (runtime?.startedAt ?? startTime)) / 1000),
-            pid: process.pid,
-            startedAt: runtime?.startedAt ?? startTime,
-            now: Date.now(),
-            host: runtime?.host ?? '127.0.0.1',
-            port: runtime?.port ?? Number(process.env['PORT'] ?? 7070),
-            listen: runtime?.listen ?? `${runtime?.host ?? '127.0.0.1'}:${runtime?.port ?? 7070}`,
-            socketPath: runtime?.socketPath,
-            sessions: daemon.getActiveSessions().length,
-            directories: daemon.directoryManager.list().length,
-            agents: daemon.getAvailableAgents().join(', ') || 'none',
-            version: runtime?.version ?? '0.1.0',
-            process: {
-                node: process.version,
-                platform: process.platform,
-                arch: process.arch,
-                memoryRss: memory.rss,
-                memoryHeapUsed: memory.heapUsed,
-                memoryHeapTotal: memory.heapTotal,
-            },
-        };
+    registerHealthRoutes(app, daemon, {
+        getRelayStatus: options?.getRelayStatus,
+        runtime,
+        startedAtFallback: startTime,
     });
     // ---------------------------------------------------------------------------
     // Directories
@@ -191,239 +97,144 @@ export function registerHttpRoutes(app, daemon, registry, options) {
     // ---------------------------------------------------------------------------
     // Session/operator surfaces
     // ---------------------------------------------------------------------------
-    app.get('/api/sessions', async (request) => {
-        const scope = request.query.scope ?? 'all';
-        const directoryIdFilter = typeof request.query.directoryId === 'string' ? request.query.directoryId : undefined;
-        const agentFilter = typeof request.query.agent === 'string' ? request.query.agent.trim() : undefined;
-        const active = daemon
-            .listActiveSessions()
-            .map((session) => {
-            const dir = daemon.directoryManager.get(session.directoryId);
-            return {
-                source: 'active',
-                id: session.sessionId,
-                sessionId: session.sessionId,
-                directoryId: session.directoryId,
-                directoryPath: dir?.path ?? null,
-                agentId: session.agent,
-                state: session.state,
-                mode: session.mode,
-                resumable: true,
-                lastActivity: null,
-                summary: null,
-                messageCount: null,
-            };
-        })
-            .filter((session) => {
-            if (directoryIdFilter && session.directoryId !== directoryIdFilter)
-                return false;
-            if (agentFilter && session.agentId !== agentFilter)
-                return false;
-            return true;
-        });
-        const discovered = [...daemon.getDiscoveredSessions().entries()]
-            .flatMap(([directoryId, sessions]) => sessions.map((session) => {
-            const dir = daemon.directoryManager.get(directoryId);
-            return {
-                source: 'discovered',
-                id: session.sessionId,
-                sessionId: session.sessionId,
-                directoryId,
-                directoryPath: dir?.path ?? null,
-                agentId: session.agentId,
-                state: 'idle',
-                mode: 'detect',
-                resumable: session.resumable,
-                lastActivity: session.lastModified,
-                summary: session.summary,
-                messageCount: session.messageCount ?? null,
-            };
-        }))
-            .filter((session) => {
-            if (directoryIdFilter && session.directoryId !== directoryIdFilter)
-                return false;
-            if (agentFilter && session.agentId !== agentFilter)
-                return false;
-            return true;
-        });
-        const sessions = scope === 'active'
-            ? active
-            : scope === 'discovered'
-                ? discovered
-                : [...active, ...discovered];
-        sessions.sort((a, b) => {
-            const aTime = a.lastActivity ?? 0;
-            const bTime = b.lastActivity ?? 0;
-            if (aTime !== bTime)
-                return bTime - aTime;
-            return a.sessionId.localeCompare(b.sessionId);
-        });
-        return {
-            sessions,
-            counts: {
-                active: active.length,
-                discovered: discovered.length,
-                total: sessions.length,
-            },
-        };
-    });
-    app.post('/api/sessions/:id/stop', async (request, reply) => {
+    registerSessionRoutes(app, daemon);
+    registerContextRoutes(app);
+    app.post('/api/directories', async (request, reply) => {
+        const parsedBody = DirectoryRegisterBodySchema.safeParse(request.body);
+        if (!parsedBody.success) {
+            return reply.status(400).send({ error: invalidPayloadError(parsedBody.error) });
+        }
+        const { path: dirPath, config } = parsedBody.data;
         try {
-            await daemon.killSession(request.params.id);
-            return { ok: true, sessionId: request.params.id };
+            const info = await daemon.directoryManager.register(dirPath, config);
+            daemon.emit('directory:registered', { directoryId: info.id, path: info.path });
+            return reply.status(201).send(info);
         }
-        catch {
-            return reply.status(404).send({ error: 'Session not found' });
+        catch (err) {
+            return reply.status(400).send({
+                error: err instanceof Error ? err.message : 'Failed to register directory',
+            });
         }
     });
-    app.get('/api/sessions/:id/mode', async (request, reply) => {
-        try {
-            const info = daemon.getSessionInfo(request.params.id);
-            return {
-                sessionId: request.params.id,
-                mode: info.mode,
-            };
-        }
-        catch {
-            return reply.status(404).send({ error: 'Session not found' });
+    app.delete('/api/directories/:id', async (request, reply) => {
+        const dir = daemon.directoryManager.get(request.params.id);
+        if (!dir) {
+            return reply.status(404).send({ error: 'Directory not found' });
         }
+        await daemon.directoryManager.unregister(request.params.id);
+        daemon.emit('directory:unregistered', { directoryId: request.params.id });
+        return reply.status(204).send();
     });
-    app.put('/api/sessions/:id/mode', async (request, reply) => {
-        const parsedBody = SessionModeBodySchema.safeParse(request.body);
+    // ---------------------------------------------------------------------------
+    // Workflows
+    // ---------------------------------------------------------------------------
+    app.post('/api/workflows/validate', async (request, reply) => {
+        const parsedBody = WorkflowValidateBodySchema.safeParse(request.body);
         if (!parsedBody.success) {
             return reply.status(400).send({ error: invalidPayloadError(parsedBody.error) });
         }
-        const { mode } = parsedBody.data;
         try {
-            daemon.setSessionMode(request.params.id, mode);
+            const workflow = parsedBody.data.workflowYaml
+                ? daemon.workflowRunner.validateText(parsedBody.data.workflowYaml, parsedBody.data.workflowSourceRef)
+                : await daemon.workflowRunner.validateFile(parsedBody.data.workflowPath);
             return {
-                ok: true,
-                sessionId: request.params.id,
-                mode,
+                workflow: {
+                    name: workflow.definition.name,
+                    title: workflow.definition.title,
+                    description: workflow.definition.description,
+                    digest: workflow.digest,
+                    sourcePath: workflow.sourcePath,
+                    nodeCount: Object.keys(workflow.definition.nodes).length,
+                },
             };
         }
-        catch {
-            return reply.status(404).send({ error: 'Session not found' });
+        catch (error) {
+            return reply.status(400).send({
+                error: error instanceof Error ? error.message : 'Workflow validation failed',
+            });
         }
     });
-    app.get('/api/worktrees', async (request, reply) => {
-        try {
-            const worktrees = daemon.listWorktrees(request.query.sessionId);
-            return {
-                worktrees,
-                count: worktrees.length,
-            };
-        }
-        catch {
-            return reply.status(404).send({ error: 'Session not found' });
-        }
+    app.get('/api/workflows/runs', async (request) => {
+        const limit = Number.parseInt(request.query.limit ?? '50', 10);
+        const runs = await daemon.workflowRunner.listRuns(Number.isFinite(limit) ? limit : 50);
+        return { runs };
     });
-    app.post('/api/worktrees/:id/rollback', async (request, reply) => {
-        const parsedBody = WorktreeRollbackBodySchema.safeParse(request.body);
+    app.post('/api/workflows/runs', async (request, reply) => {
+        const parsedBody = WorkflowRunBodySchema.safeParse(request.body);
         if (!parsedBody.success) {
             return reply.status(400).send({ error: invalidPayloadError(parsedBody.error) });
         }
-        const { toSha } = parsedBody.data;
         try {
-            await daemon.rollback(request.params.id, toSha);
-            return { ok: true, sessionId: request.params.id, toSha };
+            const run = await daemon.workflowRunner.startRun({
+                workflowPath: parsedBody.data.workflowPath,
+                workflowYaml: parsedBody.data.workflowYaml,
+                workflowSourceRef: parsedBody.data.workflowSourceRef,
+                workflowContract: parsedBody.data.workflowContract,
+                directoryId: parsedBody.data.directoryId,
+                inputs: parsedBody.data.inputs,
+                resourceId: parsedBody.data.resourceId,
+                runtimeTargetId: parsedBody.data.runtimeTargetId,
+                platformRunId: parsedBody.data.platformRunId,
+                rerunOfWorkflowRunId: parsedBody.data.rerunOfWorkflowRunId,
+                executionPolicy: parsedBody.data.executionPolicy,
+                initiation: parsedBody.data.initiation ?? 'browser',
+            });
+            return reply.status(201).send({ run });
         }
-        catch {
-            return reply.status(404).send({ error: 'Session not found' });
+        catch (error) {
+            return reply.status(400).send({
+                error: error instanceof Error ? error.message : 'Failed to start workflow run',
+            });
         }
     });
-    app.post('/api/worktrees/:id/retry', async (request, reply) => {
-        const parsedBody = WorktreeRetryBodySchema.safeParse(request.body);
-        if (!parsedBody.success) {
-            return reply.status(400).send({ error: invalidPayloadError(parsedBody.error) });
-        }
-        const { fromSha } = parsedBody.data;
+    app.post('/api/workflows/runs/:id/rerun', async (request, reply) => {
         try {
-            const retryPath = await daemon.branchRetry(request.params.id, fromSha);
-            return { ok: true, sessionId: request.params.id, fromSha, retryPath };
+            const run = await daemon.workflowRunner.rerunRun(request.params.id);
+            return reply.status(201).send({ run });
         }
-        catch {
-            return reply.status(404).send({ error: 'Session not found' });
+        catch (error) {
+            return reply.status(400).send({
+                error: error instanceof Error ? error.message : 'Failed to rerun workflow',
+            });
         }
     });
-    app.post('/api/worktrees/:id/squash', async (request, reply) => {
-        const parsedBody = WorktreeSquashBodySchema.safeParse(request.body ?? {});
-        if (!parsedBody.success) {
-            return reply.status(400).send({ error: invalidPayloadError(parsedBody.error) });
-        }
-        const targetBranch = parsedBody.data.targetBranch ?? 'main';
-        const commitMessage = parsedBody.data.commitMessage ?? `chore: squash merge viewport session ${request.params.id}`;
-        try {
-            await daemon.squashMerge(request.params.id, targetBranch, commitMessage);
-            return { ok: true, sessionId: request.params.id, targetBranch };
-        }
-        catch {
-            return reply.status(404).send({ error: 'Session not found' });
+    app.get('/api/workflows/runs/:id', async (request, reply) => {
+        const run = await daemon.workflowRunner.getRun(request.params.id);
+        if (!run) {
+            return reply.status(404).send({ error: 'Workflow run not found' });
         }
+        return { run };
     });
-    app.get('/api/permissions/pending', async (request) => {
-        const sessionId = request.query.sessionId;
-        const pending = daemon.listPendingPermissions(sessionId);
-        return {
-            pending,
-            count: pending.length,
-        };
-    });
-    app.post('/api/permissions/respond', async (request, reply) => {
-        const parsedBody = PermissionRespondBodySchema.safeParse(request.body);
+    app.post('/api/workflows/runs/:id/approvals/:nodeId', async (request, reply) => {
+        const parsedBody = WorkflowApprovalBodySchema.safeParse(request.body);
         if (!parsedBody.success) {
             return reply.status(400).send({ error: invalidPayloadError(parsedBody.error) });
         }
-        const { sessionId, requestId, behavior, allowAlways, message } = parsedBody.data;
         try {
-            if (behavior === 'allow' && allowAlways) {
-                const toolName = daemon.getRequestToolName(requestId);
-                if (toolName) {
-                    daemon.addAutoApprove(sessionId, toolName);
-                }
-            }
-            await daemon.respondPermission(sessionId, requestId, {
-                behavior,
-                ...(behavior === 'deny' && message ? { message } : {}),
-            });
-            return {
-                ok: true,
-                sessionId,
-                requestId,
-                behavior,
-                allowAlways: behavior === 'allow' ? allowAlways === true : false,
-            };
+            const run = await daemon.workflowRunner.decideApproval(request.params.id, request.params.nodeId, parsedBody.data);
+            return { run };
         }
-        catch {
-            return reply.status(404).send({ error: 'Session or permission request not found' });
+        catch (error) {
+            return reply.status(400).send({
+                error: error instanceof Error ? error.message : 'Failed to resolve workflow approval',
+            });
         }
     });
-    app.post('/api/directories', async (request, reply) => {
-        const parsedBody = DirectoryRegisterBodySchema.safeParse(request.body);
+    app.post('/api/workflows/runs/:id/cancel', async (request, reply) => {
+        const parsedBody = WorkflowCancelBodySchema.safeParse(request.body);
         if (!parsedBody.success) {
             return reply.status(400).send({ error: invalidPayloadError(parsedBody.error) });
         }
-        const { path: dirPath, config } = parsedBody.data;
         try {
-            const info = await daemon.directoryManager.register(dirPath, config);
-            daemon.emit('directory:registered', { directoryId: info.id, path: info.path });
-            return reply.status(201).send(info);
+            const run = await daemon.workflowRunner.cancelRun(request.params.id, parsedBody.data);
+            return { run };
         }
-        catch (err) {
+        catch (error) {
             return reply.status(400).send({
-                error: err instanceof Error ? err.message : 'Failed to register directory',
+                error: error instanceof Error ? error.message : 'Failed to cancel workflow run',
             });
         }
     });
-    app.delete('/api/directories/:id', async (request, reply) => {
-        const dir = daemon.directoryManager.get(request.params.id);
-        if (!dir) {
-            return reply.status(404).send({ error: 'Directory not found' });
-        }
-        await daemon.directoryManager.unregister(request.params.id);
-        daemon.emit('directory:unregistered', { directoryId: request.params.id });
-        return reply.status(204).send();
-    });
     // ---------------------------------------------------------------------------
     // Session diffs
     // ---------------------------------------------------------------------------
@@ -432,8 +243,11 @@ export function registerHttpRoutes(app, daemon, registry, options) {
             const diffs = await daemon.getSessionDiffs(request.params.id);
             return diffs;
         }
-        catch {
-            return reply.status(404).send({ error: 'Session not found' });
+        catch (error) {
+            if (error instanceof ViewportError) {
+                return reply.status(error.statusCode).send({ error: error.message, errorCode: error.code });
+            }
+            return reply.status(500).send({ error: 'Failed to read session messages' });
         }
     });
     app.get('/api/sessions/:id/summary-diff', async (request, reply) => {
@@ -441,39 +255,31 @@ export function registerHttpRoutes(app, daemon, registry, options) {
             const diff = await daemon.getSessionSummaryDiff(request.params.id);
             return { diff };
         }
-        catch {
-            return reply.status(404).send({ error: 'Session not found' });
+        catch (error) {
+            if (error instanceof ViewportError) {
+                return reply.status(error.statusCode).send({ error: error.message, errorCode: error.code });
+            }
+            return reply.status(500).send({ error: 'Failed to read session messages' });
         }
     });
     // ---------------------------------------------------------------------------
     // Session messages (from JSONL files — discovered sessions)
     // ---------------------------------------------------------------------------
     app.get('/api/directories/:directoryId/sessions/:sessionId/messages', async (request, reply) => {
-        const dir = daemon.directoryManager.get(request.params.directoryId);
-        if (!dir) {
-            return reply.status(404).send({ error: 'Directory not found' });
-        }
-        const activeHistoryMeta = readPersistedReplayMeta(request.params.sessionId);
-        if (activeHistoryMeta?.directoryId === request.params.directoryId) {
-            return { messages: readPersistedSessionMessagesRich(request.params.sessionId) };
-        }
-        const discovered = daemon.getDiscoveredSessions(request.params.directoryId).get(request.params.directoryId) ??
-            [];
-        const discoveredSession = discovered.find((s) => s.sessionId === request.params.sessionId);
-        if (!discoveredSession) {
-            return reply.status(404).send({ error: 'Session not found' });
-        }
         try {
-            if (discoveredSession.agentId === 'codex') {
-                const messages = await readCodexSessionMessagesRich(request.params.sessionId, discoveredSession.sourcePath);
-                return { messages };
-            }
-            const projectDirName = encodeProjectDir(dir.path);
-            const messages = await readSessionMessagesRich(projectDirName, request.params.sessionId);
-            return { messages };
+            const page = await readDaemonSessionMessagePage(daemon, request.params.directoryId, request.params.sessionId, {
+                limit: request.query.limit === undefined
+                    ? undefined
+                    : parseSessionMessageLimit(request.query.limit),
+                offset: parseSessionMessageOffset(request.query.offset),
+            });
+            return page;
         }
-        catch {
-            return reply.status(404).send({ error: 'Session not found' });
+        catch (error) {
+            if (error instanceof ViewportError) {
+                return reply.status(error.statusCode).send({ error: error.message, errorCode: error.code });
+            }
+            return reply.status(500).send({ error: 'Failed to read session messages' });
         }
     });
     // ---------------------------------------------------------------------------
@@ -520,14 +326,6 @@ export function registerHttpRoutes(app, daemon, registry, options) {
     // ---------------------------------------------------------------------------
     // Metrics / observability
     // ---------------------------------------------------------------------------
-    app.get('/api/metrics', async () => {
-        const snapshot = metrics.snapshot();
-        // Add live gauges
-        snapshot.gauges['sessions.active'] = daemon.getActiveSessions().length;
-        snapshot.gauges['directories.registered'] = daemon.directoryManager.list().length;
-        snapshot.gauges['uptime.seconds'] = Math.floor((Date.now() - startTime) / 1000);
-        return snapshot;
-    });
     // ---------------------------------------------------------------------------
     // Config (read-only — layered config for a directory)
     // ---------------------------------------------------------------------------
@@ -542,95 +340,14 @@ export function registerHttpRoutes(app, daemon, registry, options) {
     // ---------------------------------------------------------------------------
     // Lifecycle control (used by supervisor / CLI)
     // ---------------------------------------------------------------------------
-    app.post('/api/lifecycle/shutdown', async (_request, reply) => {
-        if (!options?.onLifecycleShutdown) {
-            return reply.status(404).send({ error: 'Lifecycle control unavailable' });
-        }
-        void options.onLifecycleShutdown();
-        return { status: 'shutdown_requested' };
-    });
-    app.post('/api/lifecycle/restart', async (_request, reply) => {
-        if (!options?.onLifecycleRestart) {
-            return reply.status(404).send({ error: 'Lifecycle control unavailable' });
-        }
-        void options.onLifecycleRestart();
-        return { status: 'restart_requested' };
+    registerLifecycleRoutes(app, {
+        onLifecycleRestart: options?.onLifecycleRestart,
+        onLifecycleShutdown: options?.onLifecycleShutdown,
     });
+    registerPairingRoutes(app, { runtime, securityProfile });
     // ---------------------------------------------------------------------------
     // Hook endpoint — receives events from agent CLI hooks (vpd hook notify)
     // ---------------------------------------------------------------------------
-    app.post('/api/pair/offer', async (request, reply) => {
-        const parsed = PairOfferBodySchema.safeParse(request.body ?? {});
-        if (!parsed.success) {
-            metrics.increment('pair.offer.invalid_payload');
-            return reply.status(400).send({ error: invalidPayloadError(parsed.error) });
-        }
-        const ttlSeconds = parsed.data.ttlSeconds ?? 600;
-        const host = runtime?.host ?? '127.0.0.1';
-        const port = runtime?.port ?? Number(process.env['PORT'] ?? 7070);
-        const listen = runtime?.listen ?? `${host}:${port}`;
-        const profile = securityProfile?.profile ?? 'local';
-        const issued = await issuePairingOffer({
-            ttlSeconds,
-            connection: {
-                host,
-                port,
-                listen,
-                socketPath: runtime?.socketPath,
-                profile,
-            },
-        });
-        metrics.increment('pair.offer.success');
-        return {
-            offerId: issued.offerId,
-            createdAt: issued.createdAt,
-            expiresAt: issued.expiresAt,
-            redeemSecret: issued.redeemSecret,
-            trustAnchor: issued.trustAnchor,
-            daemonDeviceId: issued.daemonDeviceId,
-            daemonPublicKey: issued.daemonPublicKey,
-            host: issued.host,
-            port: issued.port,
-            listen: issued.listen,
-            socketPath: issued.socketPath,
-            profile: issued.profile,
-        };
-    });
-    app.post('/api/pair/redeem', async (request, reply) => {
-        const ip = request.ip ?? 'unknown';
-        const attemptCount = recordRedeemAttempt(redeemAttemptTimestamps, ip, Date.now());
-        if (attemptCount > REDEEM_MAX_ATTEMPTS) {
-            metrics.increment('pair.redeem.rate_limited');
-            return reply.status(429).send({ error: 'Too many redeem attempts. Try again later.' });
-        }
-        const parsedBody = PairRedeemBodySchema.safeParse(request.body);
-        if (!parsedBody.success) {
-            metrics.increment('pair.redeem.invalid_payload');
-            return reply.status(400).send({ error: invalidPayloadError(parsedBody.error) });
-        }
-        const { offerId, proof, trustAnchor, clientPublicKey, clientProof } = parsedBody.data;
-        const redeemed = await redeemPairingOffer(offerId, proof, trustAnchor, clientPublicKey, clientProof);
-        if (!redeemed) {
-            metrics.increment('pair.redeem.failed');
-            return reply.status(404).send({ error: 'Offer not found or no longer valid' });
-        }
-        metrics.increment('pair.redeem.success');
-        return {
-            offerId: redeemed.offerId,
-            createdAt: redeemed.createdAt,
-            expiresAt: redeemed.expiresAt,
-            peerId: redeemed.peerId,
-            daemonDeviceId: redeemed.daemonDeviceId,
-            daemonPublicKey: redeemed.daemonPublicKey,
-            relayPairingPeerId: redeemed.relayPairingPeerId,
-            serverSignature: redeemed.serverSignature,
-            host: redeemed.connection.host,
-            port: redeemed.connection.port,
-            listen: redeemed.connection.listen,
-            socketPath: redeemed.connection.socketPath,
-            profile: redeemed.connection.profile,
-        };
-    });
     if (hookRouter) {
         app.post('/api/hook', async (request, reply) => {
             const parsed = HookBodySchema.safeParse(request.body);