@astralyn/sash 0.1.0

package/dist/daemon/handlers/proxy.js

@@ -0,0 +1,12 @@
+export async function proxyStatus(ctx, req) {
+    const inspection = await ctx.systemProxy.inspect(req.searchParams.get("fresh") === "1");
+    const body = {
+        desired: ctx.settings.committed().systemProxy,
+        applied: inspection.applied,
+        ...inspection.state,
+        appliedKnown: inspection.appliedKnown,
+        stateKnown: inspection.stateKnown,
+        ...(inspection.queryError ? { queryError: inspection.queryError } : {}),
+    };
+    return { status: 200, json: body };
+}

package/dist/daemon/handlers/settings.js

@@ -0,0 +1,48 @@
+import fs from "node:fs";
+import { parseSettingsPatch, } from "../../contracts.js";
+import { HttpError } from "../../daemon-http.js";
+import { parseSettingsText, publicSettings } from "../../settings.js";
+function writeResultBody(result) {
+    return {
+        restartRequired: result.restartRequired,
+        settings: publicSettings(result.settings),
+    };
+}
+export function readSettings(ctx) {
+    return { status: 200, json: publicSettings(ctx.settings.committed()) };
+}
+export async function patchSettings(ctx, req) {
+    const body = await req.readJson();
+    let patch;
+    try {
+        patch = parseSettingsPatch(body, "request");
+    }
+    catch (err) {
+        throw new HttpError(400, err.message);
+    }
+    const result = await ctx.settingsService.apply(patch);
+    return { status: 200, json: writeResultBody(result) };
+}
+export function readSettingsFile(ctx) {
+    let content;
+    try {
+        content = fs.readFileSync(ctx.layout.settingsFile, "utf8");
+    }
+    catch {
+        throw new HttpError(404, "Settings file does not exist yet");
+    }
+    return { status: 200, json: { content } };
+}
+export async function writeSettingsFile(ctx, req) {
+    const body = await req.readJson(256 * 1024);
+    const content = typeof body.content === "string" ? body.content : "";
+    let parsed;
+    try {
+        parsed = parseSettingsText(content, ctx.layout.settingsFile);
+    }
+    catch (err) {
+        throw new HttpError(400, err.message);
+    }
+    const result = await ctx.settingsService.applyFileSettings(parsed);
+    return { status: 200, json: writeResultBody(result) };
+}

package/dist/daemon/router.js

@@ -0,0 +1,312 @@
+import { isControlMutation, isControlRequestAuthorized, isLoopbackHostHeader, isLoopbackOriginHeader, } from "../daemon-auth.js";
+import { parseJsonObjectBody, sendError, sendJson } from "../daemon-http.js";
+import { forwardHttpToCore } from "../daemon-proxy.js";
+import { serveStaticUi } from "../daemon-static.js";
+import { errorToHttp } from "./errors.js";
+import { reloadCoreConfig, restartCore, startCore, stopCore } from "./handlers/core.js";
+import { daemonStatus, health, shutdownDaemon } from "./handlers/daemon.js";
+import { activateProfile, addProfile, importProfile, listProfiles, readProfileContent, removeProfile, renameProfile, updateAllProfiles, updateProfile, writeProfileContent, } from "./handlers/profiles.js";
+import { proxyStatus } from "./handlers/proxy.js";
+import { patchSettings, readSettings, readSettingsFile, writeSettingsFile, } from "./handlers/settings.js";
+export function parseDaemonRequestTarget(rawTarget, hostHeader) {
+    if (!rawTarget.startsWith("/") || rawTarget.startsWith("//")) {
+        throw new Error("Unsupported HTTP request-target form");
+    }
+    const base = new URL(`http://${hostHeader}`);
+    const url = new URL(rawTarget, base);
+    if (url.origin !== base.origin || url.hash) {
+        throw new Error("Invalid HTTP origin-form request target");
+    }
+    return {
+        pathname: url.pathname,
+        routePathname: url.pathname.replace(/\/+$/, "") || "/",
+        search: url.search,
+        searchParams: url.searchParams,
+    };
+}
+export function coreApiTarget(target) {
+    const prefix = "/core/api";
+    const suffix = target.pathname.slice(prefix.length);
+    const upstreamPath = suffix ? `/${suffix.replace(/^\/+/, "")}` : "/";
+    return `${upstreamPath}${target.search}`;
+}
+function path(pathname) {
+    return new URLPattern({ pathname });
+}
+const CORE_API_PREFIX = "/core/api";
+export function buildRoutes() {
+    return [
+        { methods: ["GET"], pattern: path("/sash/daemon/health"), auth: "public", handler: health },
+        {
+            methods: ["GET"],
+            pattern: path("/sash/daemon/status"),
+            auth: "public",
+            handler: daemonStatus,
+        },
+        {
+            methods: ["POST"],
+            pattern: path("/sash/daemon/shutdown"),
+            auth: "control",
+            handler: shutdownDaemon,
+        },
+        { methods: ["POST"], pattern: path("/sash/core/start"), auth: "control", handler: startCore },
+        { methods: ["POST"], pattern: path("/sash/core/stop"), auth: "control", handler: stopCore },
+        {
+            methods: ["POST"],
+            pattern: path("/sash/core/restart"),
+            auth: "control",
+            handler: restartCore,
+        },
+        {
+            methods: ["POST"],
+            pattern: path("/sash/core/reload"),
+            auth: "control",
+            handler: reloadCoreConfig,
+        },
+        { methods: ["GET"], pattern: path("/sash/proxy"), auth: "public", handler: proxyStatus },
+        { methods: ["GET"], pattern: path("/sash/settings"), auth: "public", handler: readSettings },
+        {
+            methods: ["PATCH"],
+            pattern: path("/sash/settings"),
+            auth: "control",
+            handler: patchSettings,
+        },
+        {
+            methods: ["GET"],
+            pattern: path("/sash/settings/file"),
+            auth: "control",
+            handler: readSettingsFile,
+        },
+        {
+            methods: ["PUT"],
+            pattern: path("/sash/settings/file"),
+            auth: "control",
+            handler: writeSettingsFile,
+        },
+        {
+            methods: ["GET", "POST"],
+            pattern: path("/sash/profiles"),
+            auth: "public",
+            handler: (ctx, req) => (req.method === "POST" ? addProfile(ctx, req) : listProfiles(ctx)),
+        },
+        {
+            methods: ["POST"],
+            pattern: path("/sash/profiles/import"),
+            auth: "control",
+            handler: importProfile,
+        },
+        {
+            methods: ["POST"],
+            pattern: path("/sash/profiles/update-all"),
+            auth: "control",
+            handler: updateAllProfiles,
+        },
+        {
+            methods: ["PUT"],
+            pattern: path("/sash/profiles/active"),
+            auth: "control",
+            handler: activateProfile,
+        },
+        {
+            methods: ["POST"],
+            pattern: path("/sash/profiles/:id([0-9]+)/update"),
+            auth: "control",
+            handler: updateProfile,
+        },
+        {
+            methods: ["GET", "PUT"],
+            pattern: path("/sash/profiles/:id([0-9]+)/content"),
+            auth: "control",
+            handler: (ctx, req) => req.method === "PUT" ? writeProfileContent(ctx, req) : readProfileContent(ctx, req),
+        },
+        {
+            methods: ["PATCH", "DELETE"],
+            pattern: path("/sash/profiles/:id([0-9]+)"),
+            auth: "control",
+            handler: (ctx, req) => req.method === "DELETE" ? removeProfile(ctx, req) : renameProfile(ctx, req),
+        },
+        {
+            methods: "*",
+            pattern: path(CORE_API_PREFIX),
+            auth: "gateway",
+            raw: forwardToCore,
+        },
+        {
+            methods: "*",
+            pattern: path(`${CORE_API_PREFIX}/*`),
+            auth: "gateway",
+            raw: forwardToCore,
+        },
+        {
+            methods: ["GET", "HEAD"],
+            pattern: path("/"),
+            auth: "public",
+            handler: (_ctx, req) => ({ status: 302, location: `/ui/${req.search}` }),
+        },
+        {
+            methods: ["GET", "HEAD"],
+            pattern: path("/ui"),
+            auth: "public",
+            raw: serveUiIndexOrRedirect,
+        },
+        {
+            methods: ["GET", "HEAD"],
+            pattern: path("/ui/*"),
+            auth: "public",
+            raw: serveUiAsset,
+        },
+    ];
+}
+function forwardToCore(ctx, req, res, target) {
+    const runtime = ctx.settings.runtime();
+    forwardHttpToCore(req, res, coreApiTarget(target), runtime.controller, runtime.secret);
+}
+function serveUiIndexOrRedirect(ctx, req, res, target) {
+    if (target.pathname === "/ui") {
+        res.writeHead(302, { Location: `/ui/${target.search}` });
+        res.end();
+        return;
+    }
+    serveUiAsset(ctx, req, res, target);
+}
+function serveUiAsset(ctx, req, res, target) {
+    if (!serveStaticUi(req, res, target.pathname, ctx.layout)) {
+        sendError(res, 404, "not_found", `Not found: ${req.method} ${target.routePathname}`);
+    }
+}
+const METHOD_ORDER = ["GET", "HEAD", "POST", "PUT", "PATCH", "DELETE", "OPTIONS"];
+function methodOrder(method) {
+    const index = METHOD_ORDER.indexOf(method);
+    return index < 0 ? METHOD_ORDER.length : index;
+}
+export function requiredParam(req, name) {
+    const value = req.params[name];
+    if (value === undefined)
+        throw new Error(`Missing route parameter: ${name}`);
+    return value;
+}
+function writeResponse(res, response) {
+    if (response.after) {
+        const after = response.after;
+        let ran = false;
+        const run = () => {
+            if (ran)
+                return;
+            ran = true;
+            after();
+        };
+        res.once("finish", run);
+        res.once("close", run);
+    }
+    if (response.json !== undefined) {
+        sendJson(res, response.status, response.json);
+        return;
+    }
+    if (response.location !== undefined) {
+        res.writeHead(response.status, { Location: response.location });
+        res.end();
+        return;
+    }
+    res.writeHead(response.status);
+    res.end();
+}
+export function matchRoute(routes, method, pathname) {
+    const matches = [];
+    for (const route of routes) {
+        const result = route.pattern.exec({ pathname });
+        if (result)
+            matches.push({ route, params: result.pathname.groups });
+    }
+    const matched = matches.find((candidate) => candidate.route.methods === "*" || candidate.route.methods.includes(method));
+    if (matched)
+        return { kind: "matched", ...matched };
+    if (matches.length === 0)
+        return { kind: "notFound" };
+    const allow = [
+        ...new Set(matches.flatMap((candidate) => candidate.route.methods === "*" ? METHOD_ORDER : candidate.route.methods)),
+    ].sort((left, right) => methodOrder(left) - methodOrder(right));
+    return { kind: "methodNotAllowed", allow };
+}
+export async function dispatch(ctx, routes, req, res) {
+    if (!isLoopbackHostHeader(req.headers.host)) {
+        sendError(res, 421, "http", "Invalid Host header");
+        return;
+    }
+    let target;
+    try {
+        target = parseDaemonRequestTarget(req.url ?? "/", req.headers.host ?? "");
+    }
+    catch {
+        sendError(res, 400, "http", "Invalid request target");
+        return;
+    }
+    const method = req.method?.toUpperCase() ?? "GET";
+    const pathname = target.routePathname;
+    const match = matchRoute(routes, method, pathname);
+    const route = match.kind === "matched" ? match.route : undefined;
+    if (!isLoopbackOriginHeader(req.headers.origin)) {
+        sendError(res, 403, "unauthorized", "Invalid Origin header");
+        return;
+    }
+    const requiresAuth = route ? route.auth !== "public" : isControlMutation(method);
+    if (requiresAuth &&
+        !isControlRequestAuthorized(req, {
+            daemonSecret: ctx.settings.committed().daemonSecret,
+            bootToken: ctx.token,
+        })) {
+        sendError(res, 401, "unauthorized", "Unauthorized control request");
+        return;
+    }
+    if (ctx.gate.isClosing && isControlMutation(method)) {
+        sendError(res, 503, "shutting_down", "sashd is shutting down");
+        return;
+    }
+    if (!route || match.kind !== "matched") {
+        if (match.kind === "methodNotAllowed") {
+            res.setHeader("Allow", match.allow.join(", "));
+            sendError(res, 405, "http", "Method Not Allowed");
+            return;
+        }
+        sendError(res, 404, "not_found", `Not found: ${method} ${pathname}`);
+        return;
+    }
+    try {
+        if (route.raw) {
+            await route.raw(ctx, req, res, target);
+            return;
+        }
+        if (!route.handler)
+            throw new Error(`Route has no handler: ${method} ${pathname}`);
+        const request = {
+            method,
+            pathname,
+            params: match.params,
+            search: target.search,
+            searchParams: target.searchParams,
+            raw: req,
+            readJson: (maxBytes) => parseJsonObjectBody(req, maxBytes),
+        };
+        writeResponse(res, await route.handler(ctx, request));
+    }
+    catch (err) {
+        const mapping = errorToHttp(err);
+        if (mapping.status >= 500) {
+            console.error(`[sashd] unhandled error in ${method} ${pathname}:`, err);
+        }
+        if (res.writableEnded || res.destroyed)
+            return;
+        if (res.headersSent) {
+            res.destroy();
+            return;
+        }
+        sendError(res, mapping.status, mapping.code, mapping.message);
+    }
+}
+export function matchWebSocketUpgrade(routes, method, target) {
+    const gateways = routes.filter((route) => route.auth === "gateway" && route.pattern.test({ pathname: target.routePathname }));
+    if (gateways.length === 0)
+        return { kind: "notFound" };
+    if (method.toUpperCase() !== "GET")
+        return { kind: "methodNotAllowed", allow: ["GET"] };
+    return { kind: "gateway", target: coreApiTarget(target) };
+}

package/dist/daemon/scheduler.js

@@ -0,0 +1,33 @@
+export function startProfileUpdateScheduler(profiles, scheduler = {}) {
+    const intervalMs = scheduler.intervalMs ?? 15 * 60 * 1000;
+    const kickoffMs = scheduler.kickoffMs ?? 10_000;
+    const scheduleInterval = scheduler.setInterval ?? setInterval;
+    const clearScheduledInterval = scheduler.clearInterval ?? clearInterval;
+    const scheduleTimeout = scheduler.setTimeout ?? setTimeout;
+    const clearScheduledTimeout = scheduler.clearTimeout ?? clearTimeout;
+    const autoUpdateProfiles = async () => {
+        try {
+            await profiles.updateDue();
+        }
+        catch {
+        }
+    };
+    const intervalTimer = scheduleInterval(() => {
+        void autoUpdateProfiles();
+    }, intervalMs);
+    intervalTimer.unref();
+    const kickoffTimer = scheduleTimeout(() => {
+        void autoUpdateProfiles();
+    }, kickoffMs);
+    kickoffTimer.unref();
+    let stopped = false;
+    return {
+        stop: () => {
+            if (stopped)
+                return;
+            clearScheduledInterval(intervalTimer);
+            clearScheduledTimeout(kickoffTimer);
+            stopped = true;
+        },
+    };
+}

package/dist/daemon/server.js

@@ -0,0 +1,121 @@
+import http from "node:http";
+import { isLoopbackHostHeader, isLoopbackOriginHeader, isWebSocketRequestAuthorized, } from "../daemon-auth.js";
+import { forwardWsToCore } from "../daemon-proxy.js";
+import { buildDaemonContext } from "./app.js";
+import { buildRoutes, dispatch, matchWebSocketUpgrade, parseDaemonRequestTarget, } from "./router.js";
+import { startProfileUpdateScheduler } from "./scheduler.js";
+function rejectUpgrade(socket, status, message, allow) {
+    const body = `${message}\n`;
+    const allowHeader = allow ? `Allow: ${allow.join(", ")}\r\n` : "";
+    socket.end(`HTTP/1.1 ${status} ${message}\r\nConnection: close\r\n${allowHeader}Content-Type: text/plain; charset=utf-8\r\nContent-Length: ${Buffer.byteLength(body)}\r\n\r\n${body}`);
+}
+export function createDaemonServer(deps) {
+    const app = buildDaemonContext(deps);
+    const { context } = app;
+    const routes = buildRoutes();
+    const server = http.createServer((req, res) => {
+        void dispatch(context, routes, req, res).catch((err) => {
+            console.error("[sashd] unhandled HTTP request error:", err);
+            if (res.writableEnded || res.destroyed)
+                return;
+            if (res.headersSent) {
+                res.destroy();
+                return;
+            }
+            res.writeHead(500, { "Content-Type": "application/json; charset=utf-8" });
+            res.end(JSON.stringify({ error: { code: "internal", message: "Internal server error" } }));
+        });
+    });
+    const upgradedSockets = new Set();
+    const handleUpgrade = (req, socket, head) => {
+        if (!isLoopbackHostHeader(req.headers.host)) {
+            rejectUpgrade(socket, 421, "Invalid Host header");
+            return;
+        }
+        if (!isLoopbackOriginHeader(req.headers.origin)) {
+            rejectUpgrade(socket, 403, "Invalid Origin header");
+            return;
+        }
+        if (!isWebSocketRequestAuthorized(req, {
+            daemonSecret: context.settings.committed().daemonSecret,
+            bootToken: context.token,
+        })) {
+            rejectUpgrade(socket, 401, "Unauthorized WebSocket request");
+            return;
+        }
+        let target;
+        try {
+            target = parseDaemonRequestTarget(req.url ?? "/", req.headers.host ?? "");
+        }
+        catch {
+            rejectUpgrade(socket, 400, "Invalid request target");
+            return;
+        }
+        const route = matchWebSocketUpgrade(routes, req.method?.toUpperCase() ?? "GET", target);
+        if (route.kind === "methodNotAllowed") {
+            rejectUpgrade(socket, 405, "Method Not Allowed", route.allow);
+            return;
+        }
+        if (route.kind === "notFound") {
+            rejectUpgrade(socket, 404, "WebSocket endpoint not found");
+            return;
+        }
+        if (context.gate.isClosing) {
+            rejectUpgrade(socket, 503, "sashd is shutting down");
+            return;
+        }
+        const runtime = context.settings.runtime();
+        forwardWsToCore(req, socket, head, route.target, runtime.controller, runtime.secret);
+    };
+    server.on("upgrade", (req, socket, head) => {
+        upgradedSockets.add(socket);
+        socket.once("close", () => upgradedSockets.delete(socket));
+        try {
+            handleUpgrade(req, socket, head);
+        }
+        catch (err) {
+            console.error("[sashd] unhandled WebSocket upgrade error:", err);
+            if (!socket.destroyed)
+                rejectUpgrade(socket, 500, "WebSocket proxy failed");
+        }
+    });
+    const scheduler = startProfileUpdateScheduler(context.profiles, deps.scheduler ?? {});
+    let listenerClosePromise;
+    const closeListener = () => {
+        if (listenerClosePromise)
+            return listenerClosePromise;
+        const attempt = (async () => {
+            if (server.listening) {
+                const closed = new Promise((resolve, reject) => {
+                    server.close((err) => (err ? reject(err) : resolve()));
+                });
+                server.closeAllConnections();
+                for (const socket of upgradedSockets)
+                    socket.destroy();
+                await closed;
+            }
+            scheduler.stop();
+        })();
+        listenerClosePromise = attempt;
+        void attempt.catch(() => {
+            if (listenerClosePromise === attempt) {
+                listenerClosePromise = undefined;
+                context.gate.reopen();
+            }
+        });
+        return attempt;
+    };
+    context.closeListener = closeListener;
+    const closeDaemon = async () => {
+        await context.shutdown();
+        await closeListener();
+    };
+    return {
+        server,
+        supervisor: app.supervisor,
+        lifecycle: app.lifecycle,
+        token: app.token,
+        port: context.settings.committed().daemonPort,
+        close: closeDaemon,
+    };
+}

package/dist/daemon-auth.js

@@ -0,0 +1,71 @@
+import crypto from "node:crypto";
+import { WEB_SOCKET_AUTH_PROTOCOL, WEB_SOCKET_TOKEN_PROTOCOL_PREFIX } from "./contracts.js";
+function firstHeader(value) {
+    return Array.isArray(value) ? (value[0] ?? "") : (value ?? "");
+}
+function secretsEqual(actual, expected) {
+    const a = Buffer.from(actual);
+    const b = Buffer.from(expected);
+    return a.length === b.length && crypto.timingSafeEqual(a, b);
+}
+function isLoopbackHostname(hostname) {
+    const normalized = hostname.toLowerCase();
+    return normalized === "127.0.0.1" || normalized === "localhost" || normalized === "[::1]";
+}
+export function isLoopbackHostHeader(value) {
+    if (!value)
+        return false;
+    try {
+        return isLoopbackHostname(new URL(`http://${value}`).hostname);
+    }
+    catch {
+        return false;
+    }
+}
+export function isLoopbackOriginHeader(value) {
+    if (!value)
+        return true;
+    try {
+        return isLoopbackHostname(new URL(value).hostname);
+    }
+    catch {
+        return false;
+    }
+}
+export function isControlMutation(method) {
+    return method !== "GET" && method !== "HEAD" && method !== "OPTIONS";
+}
+export function isControlRequestAuthorized(req, opts) {
+    const authorization = firstHeader(req.headers.authorization);
+    const bearer = authorization.match(/^Bearer\s+(.+)$/i)?.[1]?.trim() ?? "";
+    if (bearer && opts.daemonSecret && secretsEqual(bearer, opts.daemonSecret))
+        return true;
+    const webToken = firstHeader(req.headers["x-sash-token"]).trim();
+    return Boolean(webToken && secretsEqual(webToken, opts.bootToken));
+}
+function webSocketProtocols(value) {
+    return (Array.isArray(value) ? value.join(",") : (value ?? ""))
+        .split(",")
+        .map((protocol) => protocol.trim())
+        .filter(Boolean);
+}
+export function isWebSocketRequestAuthorized(req, opts) {
+    if (isControlRequestAuthorized(req, opts))
+        return true;
+    return webSocketProtocols(req.headers["sec-websocket-protocol"]).some((protocol) => {
+        if (!protocol.startsWith(WEB_SOCKET_TOKEN_PROTOCOL_PREFIX))
+            return false;
+        const token = protocol.slice(WEB_SOCKET_TOKEN_PROTOCOL_PREFIX.length);
+        return Boolean(token && secretsEqual(token, opts.bootToken));
+    });
+}
+export function webSocketAuthResponseProtocol(value) {
+    const protocols = webSocketProtocols(value);
+    return (protocols.find((protocol) => protocol === WEB_SOCKET_AUTH_PROTOCOL) ??
+        protocols.find((protocol) => protocol.startsWith(WEB_SOCKET_TOKEN_PROTOCOL_PREFIX)));
+}
+export function coreWebSocketProtocols(value) {
+    const protocols = webSocketProtocols(value).filter((protocol) => protocol !== WEB_SOCKET_AUTH_PROTOCOL &&
+        !protocol.startsWith(WEB_SOCKET_TOKEN_PROTOCOL_PREFIX));
+    return protocols.length > 0 ? protocols.join(", ") : undefined;
+}

package/dist/daemon-client.js

@@ -0,0 +1,55 @@
+import { ERROR_BODY_LIMIT, fetchWithRetry } from "./http.js";
+import { SashClient } from "./sash-client.js";
+const DAEMON_SUCCESS_BODY_LIMIT = 1024 * 1024;
+const daemonFetch = async (url, init) => {
+    const res = await fetchWithRetry(url, {
+        method: init.method,
+        headers: init.headers,
+        ...(init.body !== undefined ? { body: init.body } : {}),
+        direct: true,
+        deadlineMs: init.timeoutMs,
+        ...(init.attempts !== undefined ? { attempts: init.attempts } : {}),
+    });
+    return {
+        status: res.statusCode,
+        text: () => res.text(res.statusCode >= 200 && res.statusCode < 300
+            ? DAEMON_SUCCESS_BODY_LIMIT
+            : ERROR_BODY_LIMIT),
+    };
+};
+export class SashDaemonClient {
+    baseUrl;
+    client;
+    constructor(port, secret) {
+        this.baseUrl = `http://127.0.0.1:${port}`;
+        const trimmed = (secret || "").trim();
+        this.client = new SashClient({
+            baseUrl: this.baseUrl,
+            token: () => trimmed,
+            fetchFn: daemonFetch,
+        });
+    }
+    health() {
+        return this.client.health();
+    }
+    async isReachable() {
+        try {
+            return Boolean((await this.health()).token);
+        }
+        catch {
+            return false;
+        }
+    }
+    status(fresh = false) {
+        return this.client.status(fresh);
+    }
+    startCore() {
+        return this.client.startCore();
+    }
+    maintenanceShutdown() {
+        return this.client.shutdown();
+    }
+    async shutdown() {
+        await this.client.shutdown();
+    }
+}

package/dist/daemon-entry.js

@@ -0,0 +1,13 @@
+#!/usr/bin/env node
+import "./node-version-guard.js";
+import { runDaemon } from "./daemon.js";
+async function main() {
+    try {
+        await runDaemon();
+    }
+    catch (err) {
+        console.error(`[sashd] fatal: ${err.message}`);
+        process.exit(1);
+    }
+}
+await main();