fuli-context 0.12.0 → 0.12.2

package/npm-shrinkwrap.json

@@ -1,17 +1,19 @@
 {
   "name": "fuli-context",
-  "version": "0.12.0",
+  "version": "0.12.2",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "fuli-context",
-      "version": "0.12.0",
+      "version": "0.12.2",
       "license": "Apache-2.0",
       "dependencies": {
         "@a2a-js/sdk": "1.3.0",
         "@hono/node-server": "2.0.12",
         "@modelcontextprotocol/sdk": "^1.31.0",
+        "@peculiar/x509": "2.1.0",
+        "reflect-metadata": "0.2.2",
         "zod": "^4.4.3"
       },
       "bin": {
@@ -683,6 +685,225 @@
         "url": "https://github.com/sponsors/Boshen"
       }
     },
+    "node_modules/@peculiar/asn1-asym-key": {
+      "version": "2.10.0",
+      "resolved": "https://registry.npmjs.org/@peculiar/asn1-asym-key/-/asn1-asym-key-2.10.0.tgz",
+      "integrity": "sha512-1R8xUTeqcUTSMLFTTCzJyFuKiq3y25EQKs9DezUetJ8qMqbJyxo3XkzykiwwT/Xzlt5/vRzS/sW4M1r+pq1FTg==",
+      "license": "MIT",
+      "dependencies": {
+        "@peculiar/asn1-pkcs8": "^2.10.0",
+        "@peculiar/asn1-schema": "^2.10.0",
+        "@peculiar/asn1-x509": "^2.10.0",
+        "asn1js": "^3.0.10",
+        "tslib": "^2.8.1"
+      },
+      "engines": {
+        "node": ">=14"
+      }
+    },
+    "node_modules/@peculiar/asn1-cms": {
+      "version": "2.10.0",
+      "resolved": "https://registry.npmjs.org/@peculiar/asn1-cms/-/asn1-cms-2.10.0.tgz",
+      "integrity": "sha512-CkX0H4NCIOMHOU3rh2xXZywinYZ/EnJlaOlJiGI0e5L4XjFqHf4iH30LMbXWChVppdA9ljbanjtzQFOhDNfTWg==",
+      "license": "MIT",
+      "dependencies": {
+        "@peculiar/asn1-schema": "^2.10.0",
+        "@peculiar/asn1-x509": "^2.10.0",
+        "@peculiar/asn1-x509-attr": "^2.10.0",
+        "asn1js": "^3.0.10",
+        "tslib": "^2.8.1"
+      },
+      "engines": {
+        "node": ">=14"
+      }
+    },
+    "node_modules/@peculiar/asn1-csr": {
+      "version": "2.10.0",
+      "resolved": "https://registry.npmjs.org/@peculiar/asn1-csr/-/asn1-csr-2.10.0.tgz",
+      "integrity": "sha512-jTPTr/9rxKM+niQLMF3jiAMb0lWHUhUHIuSOhdGCIfpB4FAQYf9SoiXOgxP8bS/68IB+bj+1OHvVnDVCQfVUZw==",
+      "license": "MIT",
+      "dependencies": {
+        "@peculiar/asn1-schema": "^2.10.0",
+        "@peculiar/asn1-x509": "^2.10.0",
+        "asn1js": "^3.0.10",
+        "tslib": "^2.8.1"
+      },
+      "engines": {
+        "node": ">=14"
+      }
+    },
+    "node_modules/@peculiar/asn1-ecc": {
+      "version": "2.10.0",
+      "resolved": "https://registry.npmjs.org/@peculiar/asn1-ecc/-/asn1-ecc-2.10.0.tgz",
+      "integrity": "sha512-GFd3iOjFrWX+QWH2R2dO5QSJyyRGv9CIBKtRlGlPNCvb2RvmCbBDexe91MJgV76c69d998Xsa+CvuQ98seoiPg==",
+      "license": "MIT",
+      "dependencies": {
+        "@peculiar/asn1-schema": "^2.10.0",
+        "@peculiar/asn1-x509": "^2.10.0",
+        "asn1js": "^3.0.10",
+        "tslib": "^2.8.1"
+      },
+      "engines": {
+        "node": ">=14"
+      }
+    },
+    "node_modules/@peculiar/asn1-pfx": {
+      "version": "2.10.0",
+      "resolved": "https://registry.npmjs.org/@peculiar/asn1-pfx/-/asn1-pfx-2.10.0.tgz",
+      "integrity": "sha512-1y3QK9ZH1IPleAMmRoJlPS10eGkAWnULETW8zDFNUK1ffqpG7zmDY+kYBMYQgwlcQZ2iitLm2z2EBP0xzRXpaA==",
+      "license": "MIT",
+      "dependencies": {
+        "@peculiar/asn1-cms": "^2.10.0",
+        "@peculiar/asn1-pkcs8": "^2.10.0",
+        "@peculiar/asn1-rsa": "^2.10.0",
+        "@peculiar/asn1-schema": "^2.10.0",
+        "asn1js": "^3.0.10",
+        "tslib": "^2.8.1"
+      },
+      "engines": {
+        "node": ">=14"
+      }
+    },
+    "node_modules/@peculiar/asn1-pkcs8": {
+      "version": "2.10.0",
+      "resolved": "https://registry.npmjs.org/@peculiar/asn1-pkcs8/-/asn1-pkcs8-2.10.0.tgz",
+      "integrity": "sha512-Ri+BZT9bnwqlHWmhs7lvWjvJRxKev2hA2+4EbZajgeYWCbR8hyv0znF4DhsFouOhMj2nSDV/iGJ6DMQtwITnCw==",
+      "license": "MIT",
+      "dependencies": {
+        "@peculiar/asn1-schema": "^2.10.0",
+        "@peculiar/asn1-x509": "^2.10.0",
+        "asn1js": "^3.0.10",
+        "tslib": "^2.8.1"
+      },
+      "engines": {
+        "node": ">=14"
+      }
+    },
+    "node_modules/@peculiar/asn1-pkcs9": {
+      "version": "2.10.0",
+      "resolved": "https://registry.npmjs.org/@peculiar/asn1-pkcs9/-/asn1-pkcs9-2.10.0.tgz",
+      "integrity": "sha512-XIXsbDQFezYk6fudczkuvawkRD4GNpISGCqfYhdkJlvcGF/RFknU+0DDJagOaJqBf+PdPzk4J9oMqDGcvfR9HQ==",
+      "license": "MIT",
+      "dependencies": {
+        "@peculiar/asn1-cms": "^2.10.0",
+        "@peculiar/asn1-pfx": "^2.10.0",
+        "@peculiar/asn1-pkcs8": "^2.10.0",
+        "@peculiar/asn1-schema": "^2.10.0",
+        "@peculiar/asn1-x509": "^2.10.0",
+        "@peculiar/asn1-x509-attr": "^2.10.0",
+        "asn1js": "^3.0.10",
+        "tslib": "^2.8.1"
+      },
+      "engines": {
+        "node": ">=14"
+      }
+    },
+    "node_modules/@peculiar/asn1-rsa": {
+      "version": "2.10.0",
+      "resolved": "https://registry.npmjs.org/@peculiar/asn1-rsa/-/asn1-rsa-2.10.0.tgz",
+      "integrity": "sha512-4Jvmwlh3gZAhNZ4/u7JSyLuce9hofOFZ4o3PYKAccCImGnyaT5CMym/ATgvAvqpOYFNW531oPZvJlEBhJy9VfA==",
+      "license": "MIT",
+      "dependencies": {
+        "@peculiar/asn1-schema": "^2.10.0",
+        "@peculiar/asn1-x509": "^2.10.0",
+        "asn1js": "^3.0.10",
+        "tslib": "^2.8.1"
+      },
+      "engines": {
+        "node": ">=14"
+      }
+    },
+    "node_modules/@peculiar/asn1-schema": {
+      "version": "2.10.0",
+      "resolved": "https://registry.npmjs.org/@peculiar/asn1-schema/-/asn1-schema-2.10.0.tgz",
+      "integrity": "sha512-GhokD41lV4gQrrLYm3wCkHfBOnJrnhDMgt4XeMW8gzfE1UdJqIuSwsE+ggf82XBjUXRJylcm+KIGQFa4utIVLw==",
+      "license": "MIT",
+      "dependencies": {
+        "@peculiar/utils": "^2.0.2",
+        "asn1js": "^3.0.10",
+        "tslib": "^2.8.1"
+      },
+      "engines": {
+        "node": ">=14"
+      }
+    },
+    "node_modules/@peculiar/asn1-x509": {
+      "version": "2.10.0",
+      "resolved": "https://registry.npmjs.org/@peculiar/asn1-x509/-/asn1-x509-2.10.0.tgz",
+      "integrity": "sha512-ucNVg8+ANveTpMN3fy9lA2alryONdXc2A4cEG2hMniWbvQt+YOZoe8BI80YYNO8FBcuDY1qbDQ4uQGQVraHxGA==",
+      "license": "MIT",
+      "dependencies": {
+        "@peculiar/asn1-schema": "^2.10.0",
+        "@peculiar/utils": "^2.0.2",
+        "asn1js": "^3.0.10",
+        "tslib": "^2.8.1"
+      },
+      "engines": {
+        "node": ">=14"
+      }
+    },
+    "node_modules/@peculiar/asn1-x509-attr": {
+      "version": "2.10.0",
+      "resolved": "https://registry.npmjs.org/@peculiar/asn1-x509-attr/-/asn1-x509-attr-2.10.0.tgz",
+      "integrity": "sha512-/85GtKOKmgvuSJNlaFfwGWNdRSZZ+hpF02NyM01XiCdzpaZONiBltDyfluFPvFx966CR+ZHNSG1jniwpy07oGg==",
+      "license": "MIT",
+      "dependencies": {
+        "@peculiar/asn1-schema": "^2.10.0",
+        "@peculiar/asn1-x509": "^2.10.0",
+        "asn1js": "^3.0.10",
+        "tslib": "^2.8.1"
+      },
+      "engines": {
+        "node": ">=14"
+      }
+    },
+    "node_modules/@peculiar/asn1-x509-post-quantum": {
+      "version": "2.10.0",
+      "resolved": "https://registry.npmjs.org/@peculiar/asn1-x509-post-quantum/-/asn1-x509-post-quantum-2.10.0.tgz",
+      "integrity": "sha512-cXKcZ30wKbUkRK5RK4Z3W1imewXvHAB9apEAuIqJ0OOkOQCpJrwLOuN38QlsEXqOI+3gtUv8Kf3UZohUmCbf3w==",
+      "license": "MIT",
+      "dependencies": {
+        "@peculiar/asn1-asym-key": "^2.10.0",
+        "@peculiar/asn1-schema": "^2.10.0",
+        "@peculiar/asn1-x509": "^2.10.0",
+        "asn1js": "^3.0.10",
+        "tslib": "^2.8.1"
+      },
+      "engines": {
+        "node": ">=14"
+      }
+    },
+    "node_modules/@peculiar/utils": {
+      "version": "2.0.3",
+      "resolved": "https://registry.npmjs.org/@peculiar/utils/-/utils-2.0.3.tgz",
+      "integrity": "sha512-+oL3HPFRIZ1St2K50lWCXiioIgSoxzz7R1J3uF6neO2yl1sgmpgY6XXJH4BdpoDkMWznQTeYF6oWNDZLCdQ4eQ==",
+      "license": "MIT",
+      "dependencies": {
+        "tslib": "^2.8.1"
+      }
+    },
+    "node_modules/@peculiar/x509": {
+      "version": "2.1.0",
+      "resolved": "https://registry.npmjs.org/@peculiar/x509/-/x509-2.1.0.tgz",
+      "integrity": "sha512-IYbg1R03CSQGWwl24kGyqrdVtixNSbRaDvBg1r5wyYjTP+VwPQkka1BzTgU5+vxiuwqg04OxdvdJ1xYYFIdUSA==",
+      "license": "MIT",
+      "dependencies": {
+        "@peculiar/asn1-cms": "^2.9.4",
+        "@peculiar/asn1-csr": "^2.9.4",
+        "@peculiar/asn1-ecc": "^2.9.4",
+        "@peculiar/asn1-pkcs9": "^2.9.4",
+        "@peculiar/asn1-rsa": "^2.9.4",
+        "@peculiar/asn1-schema": "^2.9.4",
+        "@peculiar/asn1-x509": "^2.9.4",
+        "@peculiar/asn1-x509-post-quantum": "^2.9.4",
+        "pvtsutils": "^1.3.6",
+        "tslib": "^2.8.1",
+        "tsyringe": "^4.10.0"
+      },
+      "engines": {
+        "node": ">=20.0.0"
+      }
+    },
     "node_modules/@pkgjs/parseargs": {
       "version": "0.11.0",
       "resolved": "https://registry.npmjs.org/@pkgjs/parseargs/-/parseargs-0.11.0.tgz",
@@ -1795,6 +2016,20 @@
         "url": "https://github.com/chalk/ansi-styles?sponsor=1"
       }
     },
+    "node_modules/asn1js": {
+      "version": "3.0.10",
+      "resolved": "https://registry.npmjs.org/asn1js/-/asn1js-3.0.10.tgz",
+      "integrity": "sha512-S2s3aOytiKdFRdulw2qPE51MzjzVOisppcVv7jVFR+Kw0kxwvFrDcYA0h7Ndqbmj0HkMIXYWaoj7fli8kgx1eg==",
+      "license": "BSD-3-Clause",
+      "dependencies": {
+        "pvtsutils": "^1.3.6",
+        "pvutils": "^1.1.5",
+        "tslib": "^2.8.1"
+      },
+      "engines": {
+        "node": ">=12.0.0"
+      }
+    },
     "node_modules/assertion-error": {
       "version": "2.0.1",
       "resolved": "https://registry.npmjs.org/assertion-error/-/assertion-error-2.0.1.tgz",
@@ -4440,6 +4675,24 @@
         "node": ">=6"
       }
     },
+    "node_modules/pvtsutils": {
+      "version": "1.3.6",
+      "resolved": "https://registry.npmjs.org/pvtsutils/-/pvtsutils-1.3.6.tgz",
+      "integrity": "sha512-PLgQXQ6H2FWCaeRak8vvk1GW462lMxB5s3Jm673N82zI4vqtVUPuZdffdZbPDFRoU8kAhItWFtPCWiPpp4/EDg==",
+      "license": "MIT",
+      "dependencies": {
+        "tslib": "^2.8.1"
+      }
+    },
+    "node_modules/pvutils": {
+      "version": "1.2.0",
+      "resolved": "https://registry.npmjs.org/pvutils/-/pvutils-1.2.0.tgz",
+      "integrity": "sha512-BbubeCEyTuQjVMakvJQ/Sxbc93F2pwmbsxONT/ZRrwU7Ua38d8unYTwXpTVLAKJ4BDuH9IGztCjQcd/N/39Dvg==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=16.0.0"
+      }
+    },
     "node_modules/qs": {
       "version": "6.16.0",
       "resolved": "https://registry.npmjs.org/qs/-/qs-6.16.0.tgz",
@@ -4529,6 +4782,12 @@
         "url": "https://paulmillr.com/funding/"
       }
     },
+    "node_modules/reflect-metadata": {
+      "version": "0.2.2",
+      "resolved": "https://registry.npmjs.org/reflect-metadata/-/reflect-metadata-0.2.2.tgz",
+      "integrity": "sha512-urBwgfrvVP/eAyXx4hluJivBKzuEbSQs9rKWCrCkbSxNv8mxPcUZKeuoF3Uy4mJl3Lwprp6yy5/39VWigZ4K6Q==",
+      "license": "Apache-2.0"
+    },
     "node_modules/require-from-string": {
       "version": "2.0.2",
       "resolved": "https://registry.npmjs.org/require-from-string/-/require-from-string-2.0.2.tgz",
@@ -5065,9 +5324,25 @@
       "version": "2.8.1",
       "resolved": "https://registry.npmjs.org/tslib/-/tslib-2.8.1.tgz",
       "integrity": "sha512-oJFu94HQb+KVduSUQL7wnpmqnfmLsOA/nAh6b6EH0wCEoK0/mPeXU6c3wKDV83MkOuHPRHtSXKKU99IBazS/2w==",
-      "dev": true,
-      "license": "0BSD",
-      "optional": true
+      "license": "0BSD"
+    },
+    "node_modules/tsyringe": {
+      "version": "4.10.0",
+      "resolved": "https://registry.npmjs.org/tsyringe/-/tsyringe-4.10.0.tgz",
+      "integrity": "sha512-axr3IdNuVIxnaK5XGEUFTu3YmAQ6lllgrvqfEoR16g/HGnYY/6We4oWENtAnzK6/LpJ2ur9PAb80RBt7/U4ugw==",
+      "license": "MIT",
+      "dependencies": {
+        "tslib": "^1.9.3"
+      },
+      "engines": {
+        "node": ">= 6.0.0"
+      }
+    },
+    "node_modules/tsyringe/node_modules/tslib": {
+      "version": "1.14.1",
+      "resolved": "https://registry.npmjs.org/tslib/-/tslib-1.14.1.tgz",
+      "integrity": "sha512-Xni35NKzjgMrwevysHTCArtLDpPvye8zV/0E4EyYn43P7/7qvQwPh9BGkHewbMulVntbigmcT7rdX3BNo9wRJg==",
+      "license": "0BSD"
     },
     "node_modules/type-is": {
       "version": "2.1.0",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fuli-context",
-  "version": "0.12.0",
+  "version": "0.12.2",
   "description": "Local-first collaboration relationship graph for AI agents.",
   "type": "module",
   "files": [
@@ -22,7 +22,8 @@
     "graph-provider/fuli_graph/**/*.py",
     "skills/",
     "compose.graphiti.yml",
-    "docs/judgment-and-autonomy.md"
+    "docs/judgment-and-autonomy.md",
+    "docs/client-connections.md"
   ],
   "bin": {
     "fl": "src/cli.js",
@@ -44,6 +45,7 @@
     "dev:web": "vite",
     "build": "run-s typecheck:web build:web",
     "build:web": "vite build",
+    "build:site": "node scripts/build-site.js",
     "typecheck:web": "vue-tsc --noEmit -p tsconfig.app.json",
     "test:node": "node --test",
     "test:web": "vitest run --config vitest.config.ts",
@@ -79,6 +81,8 @@
     "@a2a-js/sdk": "1.3.0",
     "@hono/node-server": "2.0.12",
     "@modelcontextprotocol/sdk": "^1.31.0",
+    "@peculiar/x509": "2.1.0",
+    "reflect-metadata": "0.2.2",
     "zod": "^4.4.3"
   },
   "devDependencies": {

package/skills/operating-fuli/SKILL.md

@@ -35,9 +35,9 @@ Start from `list_agent_interfaces`; names and schemas can evolve. Common workflo
 
 For read-only questions, use the narrowest list/get/search tool and return source and scope information. For writes, keep the user-requested scope explicit and verify after mutation. For multi-step operations, stop on the first failed invariant rather than continuing with a partially stale plan.
 
-## HR questions and finding people
+## AR questions and finding people
 
-When the user addresses HR or Bole to ask about organization or find someone, resolve the existing dedicated HR identity and read `list_project_agents` plus `get_project_agent_coordination_policy` for the exact personal space and relevant project. Use recorded roles, assignments and team membership; do not invent an organization or recruit a replacement HR. Match names, responsibilities and capabilities, but never guess between ambiguous or duplicate names. Link each resolved name to its personal page at `/agents/{encodedPersonalSpaceId}/{encodedAgentId}`. Answering in the HR role does not mean a worker has started; report actual execution separately.
+When the user addresses AR or Bole to ask about organization or find someone, resolve the existing dedicated AR identity and read `list_project_agents` plus `get_project_agent_coordination_policy` for the exact personal space and relevant project. Use recorded roles, assignments and team membership; do not invent an organization or recruit a replacement AR. Match names, responsibilities and capabilities, but never guess between ambiguous or duplicate names. Link each resolved name to its personal page at `/agents/{encodedPersonalSpaceId}/{encodedAgentId}`. Answering in the AR role does not mean a worker has started; report actual execution separately.
 
 ## Before starting collaborators
 
@@ -60,4 +60,4 @@ State what changed, the exact project or item scope, the verification result, an
 
 Include the task's named durable owner and profile link from `agent_receipt` or the successful checkpoint's `conversation.receipt`. Include Jefa or other peers only with an actual `collaboration_receipt`, naming the tool work they performed; board tools do not imply a separate model worker ran. Keep this receipt brief and distinguish work completion, memory checkpoint and visible-transcript coverage. Do not report saved memory when capture failed or is disabled.
 
-For cross-client continuation, copy the supplied continuation prompt into the same project's connected client. A leading `@Name` matches exact directory names; `@{agentId}` is the stable form (the generated prompt percent-encodes unusual IDs). Duplicate names require an exact ID in the current request; an ambiguous explicit mention must not fall back to the prior session owner or memory. This is FULI task-entry matching, not registration in a client's native @ menu. Obtain a fresh task token before `resume_agent_conversation`; never copy an old token between clients. If no qualified owner exists, route staffing through HR before implementation; Jefa remains a management peer. Preserve confirmed taste/personality/preferences and Agent character/expectations in delegated context.
+For cross-client continuation, copy the supplied continuation prompt into the same project's connected client. A leading `@Name` matches exact directory names; `@{agentId}` is the stable form (the generated prompt percent-encodes unusual IDs). Duplicate names require an exact ID in the current request; an ambiguous explicit mention must not fall back to the prior session owner or memory. This is FULI task-entry matching, not registration in a client's native @ menu. Obtain a fresh task token before `resume_agent_conversation`; never copy an old token between clients. If no qualified owner exists, route staffing through AR before implementation; Jefa remains a management peer. Preserve confirmed taste/personality/preferences and Agent character/expectations in delegated context.

package/src/agent-peer/coordinator-http.js

@@ -0,0 +1,117 @@
+import { createServer } from 'node:https';
+import { setTimeout as delay } from 'node:timers/promises';
+
+import { derToPem, PEER_LIMITS, PeerError, sha256Hex } from './protocol.js';
+
+const CLAIM_POLL_MS = 400;
+const SWEEP_MS = 5_000;
+
+// The only network listener of the LAN roundtable. Every route requires a
+// TLS-verified, currently paired device, except one-use pairing, which accepts
+// a not-yet-trusted client certificate and authorizes it by invitation code.
+export async function startCoordinatorServer({ service, identity, host, port = 0, claimWaitMs = PEER_LIMITS.claimWaitMs }) {
+  const secureContext = () => ({ ...identity.tlsOptions, ca: service.trustedCertificates() });
+  const server = createServer({
+    ...secureContext(), requestCert: true, rejectUnauthorized: false, minVersion: 'TLSv1.3',
+    requestTimeout: claimWaitMs + 15_000, headersTimeout: 10_000, maxHeaderSize: 8192,
+  }, (request, response) => {
+    handle(request, response).catch((error) => send(response, error.status ?? 500,
+      { error: error instanceof PeerError ? error.code : 'internal_error', message: error instanceof PeerError ? error.message : 'Request failed' }));
+  });
+  server.keepAliveTimeout = 5_000;
+
+  async function handle(request, response) {
+    const { pathname } = new URL(request.url, 'https://peer.invalid');
+    if (request.method !== 'POST' || !pathname.startsWith('/peer/1/')) throw new PeerError('not_found', 'Not found', 404);
+    if (request.headers['content-type']?.split(';')[0].trim() !== 'application/json') throw new PeerError('unsupported_media_type', 'JSON required', 415);
+    const certificate = request.socket.getPeerX509Certificate?.();
+    if (!certificate) throw new PeerError('certificate_required', 'A device certificate is required', 401);
+    const body = await readBody(request);
+    if (pathname === '/peer/1/pair') {
+      sendJson(response, service.pair({ code: body.code, name: body.name, authority: body.authority, certPem: derToPem(certificate.raw) }));
+      return;
+    }
+    if (!request.socket.authorized) throw new PeerError('device_not_trusted', 'This device is not paired', 403);
+    const nodeId = service.authenticate(sha256Hex(certificate.raw)).id;
+    switch (pathname) {
+      case '/peer/1/directory/publish': return sendJson(response, service.publishDirectory(nodeId, body));
+      case '/peer/1/directory': return sendJson(response, service.directory(nodeId));
+      case '/peer/1/messages': return sendJson(response, service.submit(nodeId, body));
+      case '/peer/1/claim': return sendJson(response, { claim: await longPollClaim(nodeId, request, response) });
+      case '/peer/1/renew': return sendJson(response, service.renew(nodeId, body));
+      case '/peer/1/result': return sendJson(response, service.result(nodeId, body));
+      case '/peer/1/status': return sendJson(response, service.status(nodeId, body));
+      case '/peer/1/cancel': return sendJson(response, service.cancel(nodeId, body));
+      case '/peer/1/leave': return sendJson(response, service.revoke(nodeId));
+      default: throw new PeerError('not_found', 'Not found', 404);
+    }
+  }
+
+  // Stops before claiming once the waiting runner is gone, so nothing is
+  // handed to a closed connection.
+  async function longPollClaim(nodeId, request, response) {
+    const deadline = Date.now() + claimWaitMs;
+    const gone = new AbortController();
+    const markClosed = () => gone.abort();
+    request.once('close', () => { if (!response.writableEnded) markClosed(); });
+    response.once('close', markClosed);
+    for (;;) {
+      if (gone.signal.aborted || request.socket.destroyed) return null;
+      service.authenticate(nodeId);
+      const claimed = service.claim(nodeId);
+      if (claimed || Date.now() >= deadline) return claimed;
+      try { await delay(CLAIM_POLL_MS, undefined, { signal: gone.signal }); } catch { return null; }
+    }
+  }
+
+  function sendJson(response, value) {
+    send(response, 200, value);
+  }
+
+  const sweeper = setInterval(() => { try { service.sweep(); } catch { /* next sweep retries */ } }, SWEEP_MS);
+  sweeper.unref();
+  await new Promise((resolve, reject) => {
+    server.once('error', reject);
+    server.listen(port, host, () => { server.off('error', reject); resolve(); });
+  });
+  return {
+    address: server.address(),
+    // Trust changes apply to new connections; existing ones are re-checked per request.
+    refreshTrust: () => server.setSecureContext(secureContext()),
+    close: () => new Promise((resolve) => {
+      clearInterval(sweeper);
+      server.close(() => resolve());
+      server.closeAllConnections?.();
+    }),
+  };
+}
+
+function readBody(request) {
+  return new Promise((resolve, reject) => {
+    let size = 0;
+    const chunks = [];
+    request.on('data', (chunk) => {
+      size += chunk.length;
+      if (size > PEER_LIMITS.requestBytes) {
+        reject(new PeerError('payload_too_large', 'Request body is too large', 413));
+        request.destroy();
+      } else chunks.push(chunk);
+    });
+    request.on('end', () => {
+      if (!size) return resolve({});
+      try {
+        const value = JSON.parse(Buffer.concat(chunks).toString('utf8'));
+        resolve(value && typeof value === 'object' && !Array.isArray(value) ? value : {});
+      } catch { reject(new PeerError('invalid_json', 'Invalid JSON body')); }
+    });
+    request.on('error', reject);
+  });
+}
+
+function send(response, status, value) {
+  if (response.headersSent) return;
+  const body = JSON.stringify(value);
+  response.writeHead(status, { 'content-type': 'application/json; charset=utf-8', 'cache-control': 'no-store',
+    'content-length': Buffer.byteLength(body) });
+  response.end(body);
+}