appduct 0.10.0 → 0.11.1

package/dist/daemon/socket-probe.js

@@ -1,28 +0,0 @@
-/**
- * "Is anything listening on the control socket?" — the cheapest liveness signal the state dir
- * offers, and the one that answers fastest when a daemon is up.
- *
- * It lives in its own module rather than in `rpc/client.ts` (its first caller) because
- * `daemon/log-rotation.ts` needs it too, and `rpc/client.ts` already imports *that*. Keeping the
- * probe here means neither has to import the other.
- */
-import { connect } from "node:net";
-/**
- * Resolves `true` when a connection to `socketPath` is accepted. A refusal, a missing socket file,
- * or any other error resolves `false` — this never rejects, so callers can use it as a plain
- * predicate. Note it proves a listener exists *right now*; it cannot prove one will not appear a
- * moment later.
- */
-export const isSocketConnectable = (socketPath) => {
-    return new Promise((resolve) => {
-        const socket = connect(socketPath);
-        socket.once("connect", () => {
-            socket.destroy();
-            resolve(true);
-        });
-        socket.once("error", () => {
-            socket.destroy();
-            resolve(false);
-        });
-    });
-};

package/dist/daemon/state-dir.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"state-dir.d.ts","sourceRoot":"","sources":["../../src/daemon/state-dir.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAMH,MAAM,MAAM,aAAa,GAAG;IAC1B,gCAAgC;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,kGAAkG;IAClG,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,oGAAoG;IACpG,aAAa,EAAE,MAAM,CAAC;CACvB,CAAC;AAEF,sGAAsG;AACtG,eAAO,MAAM,eAAe,GAAI,WAAW,MAAM,KAAG,MAEnD,CAAC;AAEF,eAAO,MAAM,gBAAgB,GAAI,UAAU,MAAM,KAAG,aAWnD,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,aAAa,GAAI,OAAO,aAAa,KAAG,MAEpD,CAAC;AAEF,wGAAwG;AACxG,eAAO,MAAM,cAAc,GAAU,UAAU,MAAM,KAAG,OAAO,CAAC,aAAa,CAU5E,CAAC"}

package/dist/daemon/state-dir.js

@@ -1,43 +0,0 @@
-/**
- * State directory resolution and layout (ARCHITECTURE.md §3).
- *
- * Default `~/.appduct/`, overridable with `APPDUCT_STATE_DIR` (tests rely on the
- * override). Created lazily with mode `0700`.
- */
-import { homedir } from "node:os";
-import { join } from "node:path";
-import { mkdir, chmod } from "node:fs/promises";
-/** Resolves the state directory: explicit `override`, else `APPDUCT_STATE_DIR`, else `~/.appduct`. */
-export const resolveStateDir = (override) => {
-    return override ?? process.env.APPDUCT_STATE_DIR ?? join(homedir(), ".appduct");
-};
-export const getStateDirPaths = (stateDir) => {
-    return {
-        root: stateDir,
-        socketPath: join(stateDir, "daemon.sock"),
-        pidFilePath: join(stateDir, "daemon.pid"),
-        logFilePath: join(stateDir, "daemon.log"),
-        keyPath: join(stateDir, "key.pem"),
-        configPath: join(stateDir, "config.json"),
-        auditDir: join(stateDir, "audit"),
-        spawnLockPath: join(stateDir, "daemon.spawn.lock"),
-    };
-};
-/**
- * Single seam for the control-socket address. Today this is always the UDS path; a Windows
- * named-pipe implementation (`\\.\pipe\appduct-<user>`) plugs in here without touching any
- * caller (ARCHITECTURE.md §13 — best-effort, not blocking v2.0).
- */
-export const getSocketPath = (paths) => {
-    return paths.socketPath;
-};
-/** Creates the state dir (and `audit/`) with mode `0700` if missing; tightens the mode if it exists. */
-export const ensureStateDir = async (stateDir) => {
-    const paths = getStateDirPaths(stateDir);
-    await mkdir(paths.auditDir, { recursive: true });
-    await chmod(paths.root, 0o700);
-    // `mkdir` honors the process umask (commonly 0o022, yielding drwxr-xr-x); tighten explicitly so
-    // `audit/` matches every other path under the state dir (ARCHITECTURE.md §3).
-    await chmod(paths.auditDir, 0o700);
-    return paths;
-};

package/dist/daemon/timers.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"timers.d.ts","sourceRoot":"","sources":["../../src/daemon/timers.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,MAAM,MAAM,WAAW,GAAG,UAAU,CAAC,OAAO,UAAU,CAAC,CAAC;AACxD,MAAM,MAAM,cAAc,GAAG,UAAU,CAAC,OAAO,WAAW,CAAC,CAAC;AAE5D,MAAM,MAAM,QAAQ,GAAG;IACrB,UAAU,EAAE,CAAC,QAAQ,EAAE,MAAM,IAAI,EAAE,EAAE,EAAE,MAAM,KAAK,WAAW,CAAC;IAC9D,YAAY,EAAE,CAAC,MAAM,EAAE,WAAW,KAAK,IAAI,CAAC;IAC5C,WAAW,EAAE,CAAC,QAAQ,EAAE,MAAM,IAAI,EAAE,EAAE,EAAE,MAAM,KAAK,cAAc,CAAC;IAClE,aAAa,EAAE,CAAC,MAAM,EAAE,cAAc,KAAK,IAAI,CAAC;CACjD,CAAC;AAEF,eAAO,MAAM,YAAY,EAAE,QAK1B,CAAC"}

package/dist/daemon/timers.js

@@ -1,12 +0,0 @@
-/**
- * Injectable timer seam (LOOP.md: "use injectable clock/timer seams for tests"). Every daemon
- * module that schedules a TTL/grace/pre-claim/keepalive timer takes a {@link TimerFns} so tests
- * can substitute an implementation that fires deterministically instead of waiting on real wall
- * time, and so every timer this package creates can be traced back to a single seam for cleanup.
- */
-export const systemTimers = {
-    setTimeout: (callback, ms) => setTimeout(callback, ms),
-    clearTimeout: (handle) => clearTimeout(handle),
-    setInterval: (callback, ms) => setInterval(callback, ms),
-    clearInterval: (handle) => clearInterval(handle),
-};

package/dist/daemon/tls.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"tls.d.ts","sourceRoot":"","sources":["../../src/daemon/tls.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAIH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAKrD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AAEtD,qBAAa,YAAa,SAAQ,KAAK;gBACzB,OAAO,EAAE,MAAM;CAI5B;AAED;;0CAE0C;AAC1C,MAAM,MAAM,SAAS,GAAG,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;AAElD;6EAC6E;AAC7E,eAAO,MAAM,cAAc,GAAU,SAAS,MAAM,KAAG,OAAO,CAAC,MAAM,CAWpE,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,wBAAwB,GAAU,SAAS,MAAM,EAAE,OAAO,SAAS,KAAG,OAAO,CAAC,MAAM,CAiBhG,CAAC;AAEF,MAAM,MAAM,WAAW,GAAG;IACxB,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,iBAAiB,EAAE,iBAAiB,CAAC;CACtC,CAAC;AAEF,MAAM,MAAM,UAAU,GAAG;IACvB,sDAAsD;IACtD,OAAO,EAAE,MAAM,WAAW,CAAC;IAC3B,2GAA2G;IAC3G,OAAO,EAAE,CAAC,OAAO,CAAC,EAAE,iBAAiB,KAAK,OAAO,CAAC,WAAW,CAAC,CAAC;IAC/D,4GAA4G;IAC5G,UAAU,EAAE,MAAM,MAAM,EAAE,CAAC;CAC5B,CAAC;AAEF,MAAM,MAAM,uBAAuB,GAAG;IACpC,OAAO,EAAE,MAAM,CAAC;IAChB,aAAa,EAAE,MAAM,iBAAiB,CAAC;IACvC,yFAAyF;IACzF,IAAI,CAAC,EAAE,SAAS,CAAC;CAClB,CAAC;AAEF,eAAO,MAAM,gBAAgB,GAAU,SAAS,uBAAuB,KAAG,OAAO,CAAC,UAAU,CAuB3F,CAAC;AAEF,eAAO,MAAM,eAAe,GAAI,SAAS,iBAAiB,EAAE,MAAM,MAAM,KAAG,aAE1E,CAAC"}

package/dist/daemon/tls.js

@@ -1,79 +0,0 @@
-/**
- * Host key loading and leaf-certificate minting (ARCHITECTURE.md §3, §8). Reuses
- * `host-certificate.ts` for the actual X.509 generation; this module
- * owns key-file hygiene (refusing over-permissive key files) and re-minting the leaf when
- * the advertised address changes so the certificate's SAN stays valid.
- *
- * The SPKI pin is derived from the key's public key alone (`spki-pin.ts`), so it never changes
- * across re-mints — only the certificate's SAN entries do.
- *
- * Opt-in hardening, dev-mode zero-config bootstrap: a *missing* key file is no longer fatal.
- * `createTlsManager` auto-generates one (same material/hygiene as `appduct keygen`, via
- * `key-material.ts`) so a first-time `appduct daemon` needs no manual keygen step, and reports
- * the new key's SPKI fingerprint through the optional `warn` callback. An existing key with bad
- * permissions is still refused outright — auto-generation only fills the *missing* case, it never
- * silently replaces a key that's already there.
- */
-import { stat, readFile } from "node:fs/promises";
-import { generateHostCertificate } from "../host-certificate.js";
-import { generatePrivateKeyPem, writePrivateKeyAtomically } from "../key-material.js";
-import { getSpkiPinFromPrivateKeyPem } from "../spki-pin.js";
-export class HostKeyError extends Error {
-    constructor(message) {
-        super(message);
-        this.name = "HostKeyError";
-    }
-}
-/** Refuses a key file that is group/world-readable. Missing files are handled by the caller
- * (`loadOrGenerateHostKeyPem`), which auto-generates instead of throwing. */
-export const loadHostKeyPem = async (keyPath) => {
-    const fileStat = await stat(keyPath);
-    if ((fileStat.mode & 0o077) !== 0) {
-        throw new HostKeyError(`Appduct host key at "${keyPath}" is group- or world-readable (mode ${(fileStat.mode & 0o777).toString(8)}). ` +
-            `Refusing to load it — run "chmod 600 ${keyPath}" or re-run "appduct keygen".`);
-    }
-    return readFile(keyPath, "utf8");
-};
-/**
- * Loads the host key at `keyPath`, generating one in its place if none exists yet (dev-mode
- * zero-config bootstrap). Only the ENOENT case auto-generates: any other `stat`/`readFile` failure
- * (including bad permissions) still propagates as before, so a deliberately hardened/misconfigured
- * key file is never silently overwritten.
- */
-export const loadOrGenerateHostKeyPem = async (keyPath, warn) => {
-    try {
-        return await loadHostKeyPem(keyPath);
-    }
-    catch (error) {
-        if (error.code !== "ENOENT") {
-            throw error;
-        }
-    }
-    const keyPem = generatePrivateKeyPem();
-    await writePrivateKeyAtomically(keyPath, keyPem);
-    warn?.(`Appduct: no host key found at "${keyPath}" — generated one (dev mode). ` +
-        `SPKI pin: ${getSpkiPinFromPrivateKeyPem(keyPem)}`);
-    return keyPem;
-};
-export const createTlsManager = async (options) => {
-    const keyPem = await loadOrGenerateHostKeyPem(options.keyPath, options.warn);
-    const mint = async (address) => {
-        const { certPem, spkiPin } = await generateHostCertificate(keyPem, address.address);
-        return { certPem, keyPem, spkiPin, advertisedAddress: address };
-    };
-    let material = await mint(options.detectAddress());
-    return {
-        current: () => material,
-        refresh: async (address) => {
-            const next = address ?? options.detectAddress();
-            if (next.address !== material.advertisedAddress.address || next.family !== material.advertisedAddress.family) {
-                material = await mint(next);
-            }
-            return material;
-        },
-        pinnedKeys: () => [material.spkiPin],
-    };
-};
-export const toAgentEndpoint = (address, port) => {
-    return { family: address.family, address: address.address, port };
-};

package/dist/errors.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AA4CpE,qBAAa,eAAgB,SAAQ,KAAK;IACxC,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC;IAC5B,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC;gBAEf,IAAI,EAAE,YAAY,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,OAAO;CAMnE;AAED,eAAO,MAAM,UAAU,GAAI,SAAS,MAAM,EAAE,UAAU,OAAO,KAAG,eAE/D,CAAC;AAEF,eAAO,MAAM,eAAe,GAAI,SAAS,MAAM,EAAE,UAAU,OAAO,KAAG,eAEpE,CAAC;AAEF,eAAO,MAAM,eAAe,GAAI,SAAS,MAAM,EAAE,UAAU,OAAO,KAAG,eAEpE,CAAC;AAEF,eAAO,MAAM,YAAY,GAAI,SAAS,MAAM,EAAE,UAAU,OAAO,KAAG,eAEjE,CAAC;AAEF,eAAO,MAAM,SAAS,GAAI,SAAS,MAAM,EAAE,UAAU,OAAO,KAAG,eAE9D,CAAC;AAEF,eAAO,MAAM,eAAe,GAAI,SAAS,MAAM,EAAE,UAAU,OAAO,KAAG,eAEpE,CAAC;AAEF,eAAO,MAAM,aAAa,GAAI,SAAS,MAAM,EAAE,UAAU,OAAO,KAAG,eAElE,CAAC;AAEF,eAAO,MAAM,eAAe,GAAI,SAAS,MAAM,EAAE,UAAU,OAAO,KAAG,eAEpE,CAAC;AAEF,eAAO,MAAM,cAAc,GAAI,SAAS,MAAM,EAAE,UAAU,OAAO,KAAG,eAEnE,CAAC;AAEF,eAAO,MAAM,iBAAiB,GAAI,OAAO,OAAO,KAAG,KAAK,IAAI,eAE3D,CAAC;AAUF;;;;;;GAMG;AACH,eAAO,MAAM,UAAU,GAAI,OAAO,OAAO,KAAG,QAqD3C,CAAC;AAEF;oGACoG;AACpG,eAAO,MAAM,mBAAmB,GAAI,OAAO,OAAO,KAAG,MAmBpD,CAAC"}

package/dist/errors.js

@@ -1,162 +0,0 @@
-import { DaemonRpcError, DaemonVersionMismatchError, isDaemonUnreachableError } from "./rpc/client.js";
-const EXIT_CODE_BY_ERROR_TYPE = {
-    usage_error: 64,
-    validation_error: 65,
-    // EX_NOINPUT (66): "an input file did not exist or was not readable" — `doctor` throws this for a
-    // missing external tool or an unreadable/corrupt artifact, deliberately distinct from every other
-    // code here so a release pipeline can't mistake "we couldn't tell" for either a clean pass or an
-    // assertion failure (docs/tasks/08-appduct-doctor.md).
-    inspection_error: 66,
-    connection_error: 70,
-    session_error: 71,
-    tool_error: 72,
-    permission_error: 77,
-    internal_error: 1,
-    // `doctor --assert-present`/`--assert-absent`: the artifact was inspected successfully and the
-    // assertion did not hold. Distinct from `inspection_error` (66) — this means the answer is known
-    // and it's "no", not "couldn't tell" — and distinct from `internal_error` (1) so a caller can't
-    // conflate a normal assertion failure with an unexpected crash.
-    assertion_error: 3,
-};
-/**
- * Maps the daemon's wire `error.data.type` (ARCHITECTURE.md §5) onto a sysexits class for exit-code
- * purposes only — the CLI error's rendered `type` field still preserves the wire type verbatim
- * (see {@link toCliError}); this table never leaks into rendered output.
- */
-const RPC_ERROR_EXIT_CLASS = {
-    no_session: "session_error",
-    ambiguous_session: "session_error",
-    unknown_session: "session_error",
-    session_not_active: "session_error",
-    session_suspended: "session_error",
-    tool_not_found: "tool_error",
-    tool_input_validation_error: "tool_error",
-    tool_output_validation_error: "tool_error",
-    tool_execution_error: "tool_error",
-    tool_serialization_error: "tool_error",
-    tool_timeout: "tool_error",
-    tool_cancelled: "tool_error",
-    policy_denied: "permission_error",
-    invalid_request: "validation_error",
-};
-export class AppductCliError extends Error {
-    type;
-    details;
-    constructor(type, message, details) {
-        super(message);
-        this.name = "AppductCliError";
-        this.type = type;
-        this.details = details;
-    }
-}
-export const usageError = (message, details) => {
-    return new AppductCliError("usage_error", message, details);
-};
-export const validationError = (message, details) => {
-    return new AppductCliError("validation_error", message, details);
-};
-export const connectionError = (message, details) => {
-    return new AppductCliError("connection_error", message, details);
-};
-export const sessionError = (message, details) => {
-    return new AppductCliError("session_error", message, details);
-};
-export const toolError = (message, details) => {
-    return new AppductCliError("tool_error", message, details);
-};
-export const permissionError = (message, details) => {
-    return new AppductCliError("permission_error", message, details);
-};
-export const internalError = (message, details) => {
-    return new AppductCliError("internal_error", message, details);
-};
-export const inspectionError = (message, details) => {
-    return new AppductCliError("inspection_error", message, details);
-};
-export const assertionError = (message, details) => {
-    return new AppductCliError("assertion_error", message, details);
-};
-export const isAppductCliError = (value) => {
-    return value instanceof AppductCliError;
-};
-/** True for a `DaemonRpcError` whose `data.type` is a known wire `ErrorType` (always the case for
- * `RpcApplicationError`-originated failures; JSON-RPC transport-level errors like "Method not
- * found" carry no `data` and fall through to `internal_error`). */
-const rpcErrorClass = (error) => {
-    const type = error.data?.type;
-    return type ? RPC_ERROR_EXIT_CLASS[type] : undefined;
-};
-/**
- * Converts any error thrown from a command handler into the CLI's rendered `CliError` shape.
- * RPC/app-originated failures (`DaemonRpcError` with a preserved `data.type`) keep that type
- * **verbatim** in `type` — never re-wrapped under a generic bucket (ARCHITECTURE.md §5) — so e.g.
- * `invoke --json` on a failing tool call renders `error.type === "tool_execution_error"`, not
- * `"tool_error"`. `getExitCodeForError` still buckets that same error into a sysexits class.
- */
-export const toCliError = (error) => {
-    if (isAppductCliError(error)) {
-        return {
-            type: error.type,
-            message: error.message,
-            details: error.details,
-        };
-    }
-    // Daemon/CLI version drift that could not be resolved automatically (issue #30). Rendered as a
-    // `connection_error` — the daemon is reachable, but not one this client can safely talk to —
-    // with both versions and the live-session count in `details` so `--json` consumers can act on it
-    // without parsing the message.
-    if (error instanceof DaemonVersionMismatchError) {
-        return {
-            type: "connection_error",
-            message: error.message,
-            details: {
-                daemon_version: error.daemonVersion,
-                client_version: error.clientVersion,
-                session_count: error.sessionCount,
-                pending_link_count: error.pendingLinkCount,
-            },
-        };
-    }
-    if (error instanceof DaemonRpcError && error.data?.type) {
-        return {
-            type: error.data.type,
-            message: error.message,
-            details: error.data.details,
-        };
-    }
-    if (isDaemonUnreachableError(error)) {
-        return {
-            type: "connection_error",
-            message: error instanceof Error ? error.message : "The Appduct daemon is unreachable.",
-        };
-    }
-    if (error instanceof Error) {
-        return {
-            type: "internal_error",
-            message: error.message,
-        };
-    }
-    return {
-        type: "internal_error",
-        message: "An unexpected error occurred.",
-        details: error,
-    };
-};
-/** Computes the process exit code for the *original* thrown error (not the rendered `CliError`) so
- * that the sysexits classification never depends on — or leaks into — the rendered `type` field. */
-export const getExitCodeForError = (error) => {
-    if (isAppductCliError(error)) {
-        return EXIT_CODE_BY_ERROR_TYPE[error.type];
-    }
-    if (error instanceof DaemonVersionMismatchError) {
-        return EXIT_CODE_BY_ERROR_TYPE.connection_error;
-    }
-    if (error instanceof DaemonRpcError) {
-        const cliErrorClass = rpcErrorClass(error);
-        return EXIT_CODE_BY_ERROR_TYPE[cliErrorClass ?? "internal_error"];
-    }
-    if (isDaemonUnreachableError(error)) {
-        return EXIT_CODE_BY_ERROR_TYPE.connection_error;
-    }
-    return EXIT_CODE_BY_ERROR_TYPE.internal_error;
-};

package/dist/host-certificate.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"host-certificate.d.ts","sourceRoot":"","sources":["../src/host-certificate.ts"],"names":[],"mappings":"AAAA,OAAO,kBAAkB,CAAC;AAyB1B,KAAK,wBAAwB,GAAG;IAC9B,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;CACjB,CAAC;AAwHF,eAAO,MAAM,uBAAuB,GAClC,QAAQ,MAAM,EACd,cAAc,MAAM,KACnB,OAAO,CAAC,wBAAwB,CAyClC,CAAC"}

package/dist/host-certificate.js

@@ -1,111 +0,0 @@
-import "reflect-metadata";
-import { createPrivateKey, createPublicKey, randomBytes, webcrypto, } from "node:crypto";
-import { BasicConstraintsExtension, DNS, ExtendedKeyUsage, ExtendedKeyUsageExtension, IP, KeyUsageFlags, KeyUsagesExtension, SubjectAlternativeNameExtension, SubjectKeyIdentifierExtension, X509CertificateGenerator, } from "@peculiar/x509";
-import { getSpkiPinFromPrivateKeyPem } from "./spki-pin.js";
-const CERT_VALIDITY_WINDOW_MS = 7 * 24 * 60 * 60 * 1000;
-const CERT_CLOCK_SKEW_MS = 5 * 60 * 1000;
-const toArrayBuffer = (view) => {
-    return Uint8Array.from(view).buffer;
-};
-const decodeBase64Url = (value) => {
-    return Uint8Array.from(Buffer.from(value, "base64url"));
-};
-const resolveEcHash = (curve) => {
-    switch (curve) {
-        case "P-256":
-            return "SHA-256";
-        case "P-384":
-            return "SHA-384";
-        case "P-521":
-            return "SHA-512";
-        default:
-            throw new Error(`Unsupported EC named curve "${curve}" for Appduct host certificates.`);
-    }
-};
-const importSigningKeyPair = async (keyPem) => {
-    const privateKeyObject = createPrivateKey(keyPem);
-    const publicKeyObject = createPublicKey(privateKeyObject);
-    const privateKeyDer = Buffer.from(privateKeyObject.export({ format: "der", type: "pkcs8" }));
-    const publicKeyDer = Buffer.from(publicKeyObject.export({ format: "der", type: "spki" }));
-    const jwk = privateKeyObject.export({ format: "jwk" });
-    if (jwk.kty === "RSA") {
-        const modulusLength = privateKeyObject.asymmetricKeyDetails?.modulusLength;
-        if (typeof modulusLength !== "number" || typeof jwk.e !== "string") {
-            throw new Error("Appduct could not determine RSA key details for certificate generation.");
-        }
-        const publicExponent = decodeBase64Url(jwk.e);
-        const importAlgorithm = {
-            name: "RSASSA-PKCS1-v1_5",
-            hash: "SHA-256",
-            modulusLength,
-            publicExponent,
-        };
-        return {
-            keyType: "rsa",
-            privateKey: await webcrypto.subtle.importKey("pkcs8", toArrayBuffer(privateKeyDer), importAlgorithm, false, ["sign"]),
-            publicKey: await webcrypto.subtle.importKey("spki", toArrayBuffer(publicKeyDer), importAlgorithm, true, ["verify"]),
-            signingAlgorithm: {
-                name: "RSASSA-PKCS1-v1_5",
-                hash: "SHA-256",
-            },
-        };
-    }
-    if (jwk.kty === "EC") {
-        const namedCurve = jwk.crv;
-        if (typeof namedCurve !== "string") {
-            throw new Error("Appduct could not determine the EC named curve for certificate generation.");
-        }
-        const importAlgorithm = {
-            name: "ECDSA",
-            namedCurve,
-        };
-        const signingAlgorithm = {
-            ...importAlgorithm,
-            hash: resolveEcHash(namedCurve),
-        };
-        return {
-            keyType: "ec",
-            privateKey: await webcrypto.subtle.importKey("pkcs8", toArrayBuffer(privateKeyDer), importAlgorithm, false, ["sign"]),
-            publicKey: await webcrypto.subtle.importKey("spki", toArrayBuffer(publicKeyDer), importAlgorithm, true, ["verify"]),
-            signingAlgorithm: {
-                name: "ECDSA",
-                hash: resolveEcHash(namedCurve),
-            },
-        };
-    }
-    throw new Error(`Appduct does not support "${jwk.kty ?? privateKeyObject.asymmetricKeyType}" host keys.`);
-};
-export const generateHostCertificate = async (keyPem, advertisedIp) => {
-    const keys = await importSigningKeyPair(keyPem);
-    const sanEntries = [
-        { type: DNS, value: "localhost" },
-        { type: IP, value: "127.0.0.1" },
-    ];
-    if (advertisedIp !== "127.0.0.1") {
-        sanEntries.push({ type: IP, value: advertisedIp });
-    }
-    const keyUsage = KeyUsageFlags.digitalSignature |
-        (keys.keyType === "rsa" ? KeyUsageFlags.keyEncipherment : KeyUsageFlags.keyAgreement);
-    const certificate = await X509CertificateGenerator.createSelfSigned({
-        name: "CN=Appduct Host",
-        notBefore: new Date(Date.now() - CERT_CLOCK_SKEW_MS),
-        notAfter: new Date(Date.now() + CERT_VALIDITY_WINDOW_MS),
-        signingAlgorithm: keys.signingAlgorithm,
-        keys: {
-            privateKey: keys.privateKey,
-            publicKey: keys.publicKey,
-        },
-        extensions: [
-            new BasicConstraintsExtension(false, undefined, true),
-            new KeyUsagesExtension(keyUsage, true),
-            new ExtendedKeyUsageExtension([ExtendedKeyUsage.serverAuth], false),
-            new SubjectAlternativeNameExtension(sanEntries, false),
-            await SubjectKeyIdentifierExtension.create(keys.publicKey),
-        ],
-    });
-    const certPem = certificate.toString("pem");
-    return {
-        certPem,
-        spkiPin: getSpkiPinFromPrivateKeyPem(keyPem),
-    };
-};

package/dist/index.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,UAAU,CAAC;AACzB,cAAc,aAAa,CAAC;AAC5B,cAAc,aAAa,CAAC"}

package/dist/key-material.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"key-material.d.ts","sourceRoot":"","sources":["../src/key-material.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAMH,eAAO,MAAM,qBAAqB,QAAO,MAYxC,CAAC;AAEF;;;+DAG+D;AAC/D,eAAO,MAAM,yBAAyB,GAAU,MAAM,MAAM,EAAE,QAAQ,MAAM,KAAG,OAAO,CAAC,IAAI,CAgB1F,CAAC"}

package/dist/key-material.js

@@ -1,42 +0,0 @@
-/**
- * Host private-key generation and atomic persistence (ARCHITECTURE.md §3, §10). Shared by
- * `appduct keygen` (explicit, user-invoked) and the daemon's zero-config dev-mode
- * auto-generation at startup (`daemon/tls.ts`) — both call sites need byte-identical key material
- * (RSA-2048, PKCS8 PEM) and identical file hygiene (0600, atomic rename via a `wx`-flagged temp
- * file so a concurrent writer can never observe a partial key).
- */
-import { generateKeyPairSync } from "node:crypto";
-import { dirname } from "node:path";
-import { mkdir, rename, rm, writeFile } from "node:fs/promises";
-export const generatePrivateKeyPem = () => {
-    const { privateKey } = generateKeyPairSync("rsa", {
-        modulusLength: 2048,
-        publicExponent: 0x10001,
-    });
-    return privateKey
-        .export({
-        format: "pem",
-        type: "pkcs8",
-    })
-        .toString("utf8");
-};
-/** Writes `keyPem` at `path` atomically (temp file + rename) with mode 0600. The temp file uses
- * `wx` so two concurrent writers can never interleave; callers that want to overwrite an existing
- * `path` still succeed, since `rename` replaces the destination on POSIX regardless of whether it
- * already existed — only the *temp* path must be exclusive. */
-export const writePrivateKeyAtomically = async (path, keyPem) => {
-    const temporaryPath = `${path}.${process.pid}.${Date.now()}.tmp`;
-    await mkdir(dirname(path), { recursive: true });
-    try {
-        await writeFile(temporaryPath, keyPem, {
-            encoding: "utf8",
-            mode: 0o600,
-            flag: "wx",
-        });
-        await rename(temporaryPath, path);
-    }
-    catch (error) {
-        await rm(temporaryPath, { force: true }).catch(() => { });
-        throw error;
-    }
-};

package/dist/link.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"link.d.ts","sourceRoot":"","sources":["../src/link.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AACH,OAAO,EAAe,KAAK,aAAa,EAAE,KAAK,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AAEzF,OAAO,EAUL,KAAK,MAAM,EACX,KAAK,UAAU,EAChB,MAAM,sBAAsB,CAAC;AAI9B,OAAO,EAAc,KAAK,OAAO,EAAE,MAAM,iBAAiB,CAAC;AAU3D;;;;;;;;GAQG;AACH,eAAO,MAAM,eAAe,GAAI,QAAQ,MAAM,EAAE,QAAQ,gBAAgB,KAAG,MACc,CAAC;AAE1F,MAAM,MAAM,eAAe,GAAG;IAC5B,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;yCACqC;IACrC,MAAM,CAAC,EAAE,UAAU,CAAC;IACpB;0FACsF;IACtF,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,4FAA4F;IAC5F,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;mDAC+C;IAC/C,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,yFAAyF;IACzF,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;sCACkC;IAClC,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;2GAEuG;IACvG,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB;qFACiF;IACjF,SAAS,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;CAC/B,CAAC;AAEF,MAAM,MAAM,cAAc,GAAG;IAC3B,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,aAAa,CAAC;IACxB,oBAAoB;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,GAAG,EAAE,MAAM,CAAC;IACZ,SAAS,CAAC,EAAE,IAAI,CAAC;IACjB,MAAM,CAAC,EAAE,UAAU,CAAC;CACrB,CAAC;AAEF;;wFAEwF;AACxF,eAAO,MAAM,QAAQ,GAAU,SAAS,eAAe,KAAG,OAAO,CAAC,cAAc,CA8F/E,CAAC"}

package/dist/link.js

@@ -1,117 +0,0 @@
-/**
- * Shared core of `link.create` + deep-link composition + optional emulator/simulator delivery
- * (ARCHITECTURE.md §8, §10): mints a pending session via `link.create`, then composes
- * `<scheme>:///?appduct=<payload>&pin=<spki-pin>` and optionally delivers it to a booted
- * Android emulator/device or iOS simulator. Used by `commands/link.ts` (`appduct link`) and
- * `client/bootstrap.ts` (`appduct/client`'s `link()`) so this shape — scheme resolution, the
- * `pin` query param, the `127.0.0.1` emulator/simulator address override (which the experimental
- * `ios-device` target deliberately opts out of) — can't drift between the CLI and the programmatic
- * client.
- *
- * The `pin` param is separate from the `appduct` bootstrap blob (opt-in hardening dev-mode) — it
- * is never part of that binary v2 payload, so old apps that don't know about it simply ignore it.
- * It carries the daemon's SPKI pin (same value as `daemon.status`'s `pinnedKeys[0]` / `appduct
- * keygen`'s output) so a debug build with no build-time `cliPins` configured can trust it for this
- * one connection instead of requiring a native rebuild just to test locally. The pin is standard
- * (non-URL-safe) base64 (`sha256/<44-char-base64>`, may contain `+`/`/`/`=`), so it is percent-
- * encoded here; native/JS parsers use `URLSearchParams`, which decodes it back.
- */
-import { RPC_METHODS } from "@appduct/shared";
-import { deliverToOpenTarget, isOpenTarget, isValidBundleId, invalidBundleIdMessage, isLoopbackAddress, loopbackAddressMessage, usesLoopbackAddress, MISSING_BUNDLE_ID_MESSAGE, OPEN_TARGETS, } from "./cli/open-target.js";
-import { loadConfig } from "./daemon/config.js";
-import { getStateDirPaths } from "./daemon/state-dir.js";
-import { usageError } from "./errors.js";
-import { callDaemon } from "./rpc/client.js";
-import { resolveSchemeOrThrow } from "./scheme.js";
-/** The emulator/simulator fast path forces `127.0.0.1`: the daemon's wss listener already binds
- * all interfaces, and both delivery mechanisms (adb reverse, the iOS simulator's shared host
- * network) make the daemon reachable there regardless of the machine's real LAN address. A
- * physical iOS device (`ios-device`) has no such tunnel, so it keeps the detected LAN address —
- * see `usesLoopbackAddress`. */
-const OPEN_TARGET_ADDRESS_OVERRIDE = "127.0.0.1";
-/**
- * The deep-link shape, in one place: `<scheme>:///?appduct=<payload>&pin=<spki-pin>`. Exported
- * so `mcp/connect-tool.ts` composes byte-identical links rather than a second, drifting copy — the
- * `pin` param went missing from the MCP side exactly because there were two of these.
- *
- * The pin is standard (non-URL-safe) base64 (`sha256/<44 chars>`, possibly containing `+`/`/`/`=`),
- * so it is percent-encoded; parsers use `URLSearchParams`, which decodes it back. It is appended
- * *after* the bootstrap blob, so anything reading `appduct=` must stop at the `&`.
- */
-export const composeDeepLink = (scheme, result) => `${scheme}:///?appduct=${result.deepLinkPayload}&pin=${encodeURIComponent(result.pin)}`;
-/** Throws `usageError`/`AppductCliError` on validation failure — `commands/link.ts` renders
- * that straight through the CLI's own error path; `client/bootstrap.ts` converts it to a
- * `AppductError` via `toAppductError` (which already understands `AppductCliError`). */
-export const mintLink = async (options) => {
-    if (options.target !== undefined && !isOpenTarget(options.target)) {
-        throw usageError(`"target" must be one of ${OPEN_TARGETS.map((target) => `"${target}"`).join(", ")} (got "${options.target}").`);
-    }
-    if (options.device !== undefined && options.target === undefined) {
-        throw usageError('"device" only applies alongside a target.');
-    }
-    if (options.bundleId !== undefined && options.target !== "ios-device") {
-        throw usageError('"bundleId" only applies alongside target "ios-device".');
-    }
-    if (options.relaunch !== undefined && options.target !== "ios-device") {
-        throw usageError('"relaunch" only applies alongside target "ios-device".');
-    }
-    const paths = getStateDirPaths(options.stateDir);
-    const config = await loadConfig(paths);
-    const scheme = await resolveSchemeOrThrow({
-        flagScheme: options.scheme,
-        env: options.schemeEnv,
-        cwd: options.cwd,
-        configScheme: config.scheme,
-        stateConfigPath: paths.configPath,
-        stateDirRoot: paths.root,
-    });
-    // `ios-device` needs a bundle id `devicectl` can launch; resolved (and required) *before* the
-    // link is minted so a missing one is a plain usage error rather than a stranded pending session.
-    const bundleId = options.target === "ios-device" ? (options.bundleId ?? config.iosBundleId) : undefined;
-    if (options.target === "ios-device" && !bundleId) {
-        throw usageError(MISSING_BUNDLE_ID_MESSAGE);
-    }
-    if (bundleId !== undefined && !isValidBundleId(bundleId)) {
-        throw usageError(invalidBundleIdMessage(bundleId));
-    }
-    const result = await callDaemon(RPC_METHODS.linkCreate, {
-        ttlSeconds: options.ttlSeconds,
-        addressOverride: options.target && usesLoopbackAddress(options.target) ? OPEN_TARGET_ADDRESS_OVERRIDE : undefined,
-    }, { stateDir: options.stateDir, spawn: options.spawn, autoSpawn: options.autoSpawn });
-    // A physical device is the one target that cannot reach a loopback address, and
-    // `detectAdvertisedAddress` falls back to `127.0.0.1` when it finds no routable interface. Left
-    // unchecked, the link would be delivered happily and then never claimed — a silent hang in
-    // `wait_for_session` with nothing pointing at the cause.
-    if (options.target === "ios-device" && isLoopbackAddress(result.endpoint.address)) {
-        throw usageError(loopbackAddressMessage(result.endpoint.address));
-    }
-    const deepLink = composeDeepLink(scheme, result);
-    if (options.target) {
-        await deliverToOpenTarget({
-            target: options.target,
-            deepLink,
-            wssPort: result.endpoint.port,
-            device: options.device,
-            bundleId,
-            relaunch: options.relaunch,
-            exec: options.exec,
-            env: options.env,
-        });
-        return {
-            sessionId: result.sessionId,
-            deepLink,
-            endpoint: result.endpoint,
-            expiresAt: result.expiresAt,
-            pin: result.pin,
-            delivered: true,
-            target: options.target,
-        };
-    }
-    return {
-        sessionId: result.sessionId,
-        deepLink,
-        endpoint: result.endpoint,
-        expiresAt: result.expiresAt,
-        pin: result.pin,
-    };
-};

package/dist/mcp/connect-tool.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"connect-tool.d.ts","sourceRoot":"","sources":["../../src/mcp/connect-tool.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AASH,OAAO,EAUL,KAAK,MAAM,EACX,KAAK,UAAU,EAChB,MAAM,uBAAuB,CAAC;AAI/B,OAAO,EAKL,KAAK,OAAO,EACb,MAAM,kBAAkB,CAAC;AAC1B,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAEpD,eAAO,MAAM,iBAAiB,oBAAoB,CAAC;AACnD,eAAO,MAAM,0BAA0B,6BAA6B,CAAC;AA6BrE,eAAO,MAAM,uBAAuB;;;;;;;;;;;;;;;;;;;;;;;;;;CA2B1B,CAAC;AAEX,eAAO,MAAM,gCAAgC;;;;;;;;;;;;;;;;;CAiBnC,CAAC;AAEX;;mGAEmG;AACnG,qBAAa,mBAAoB,SAAQ,KAAK;IAE1C,QAAQ,CAAC,IAAI,EAAE,iBAAiB,GAAG,cAAc,GAAG,sBAAsB;gBAAjE,IAAI,EAAE,iBAAiB,GAAG,cAAc,GAAG,sBAAsB,EAC1E,OAAO,EAAE,MAAM;CAKlB;AA6DD,MAAM,MAAM,eAAe,GAAG;IAC5B,IAAI,EAAE,UAAU,CAAC;IACjB;;0EAEsE;IACtE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;qFACiF;IACjF,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB;sEACkE;IAClE,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;CACzB,CAAC;AAEF,MAAM,MAAM,iBAAiB,GAAG;IAC9B,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,IAAI,CAAC;IACjB,MAAM,CAAC,EAAE,UAAU,CAAC;IACpB,wFAAwF;IACxF,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,gFAAgF;IAChF,YAAY,CAAC,EAAE,IAAI,CAAC;IACpB;kDAC8C;IAC9C,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,sFAAsF;IACtF,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,uGAAuG;IACvG,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB,CAAC;AAsEF,eAAO,MAAM,iBAAiB,GAC5B,SAAS,OAAO,EAChB,MAAM,eAAe,KACpB,OAAO,CAAC,iBAAiB,CA4I3B,CAAC;AA6BF,MAAM,MAAM,sBAAsB,GAAG;IACnC,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB,CAAC;AAEF,MAAM,MAAM,wBAAwB,GAAG;IACrC,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,IAAI,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;CACf,CAAC;AAEF,eAAO,MAAM,wBAAwB,GACnC,SAAS,OAAO,EAChB,MAAM,sBAAsB,KAC3B,OAAO,CAAC,wBAAwB,CAiHlC,CAAC"}