@augmentd-labs/canvas-edge 0.4.1 → 0.5.0

package/README.md

@@ -75,3 +75,12 @@ mirrors.json). `CANVAS_DIRECTION=pull` makes the container a backup target
 
 Protocol: canvas-server `docs/canvas-edge-protocol.md` (tunnel) and
 `docs/sync-protocol.md` (file plane).
+
+### Client certificates (0.5.0+)
+
+Hub remotes retain `tls: { certFile, keyFile }` from the shared client config.
+Workspace remotes can carry the same optional fields. Pairing, tunnel sockets,
+mirror status calls, and object transfers all use the identity. Container bootstrap
+accepts `CANVAS_TLS_CERT`/`CANVAS_TLS_KEY` as a complete pair of file paths; mount
+these files read-only. Use leaf-first PEM chains and protected unencrypted RSA/EC
+keys. Server verification is enabled. Restart the daemon/container after renewal.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@augmentd-labs/canvas-edge",
-  "version": "0.4.1",
+  "version": "0.5.0",
   "description": "Canvas device runtime: folder mirrors (canvas-stored Mirror engine) + edge tunnel client (dist artifact)",
   "license": "AGPL-3.0-or-later",
   "type": "module",
@@ -36,7 +36,8 @@
     "picomatch": "^2.3.1",
     "fastify": "^4.29.1",
     "pino": "^10.3.1",
-    "socket.io-client": "^4.8.3"
+    "socket.io-client": "^4.8.3",
+    "@augmentd-labs/canvas-api-client": "^0.4.0"
   },
   "repository": {
     "type": "git",
@@ -46,6 +47,6 @@
   "bundleDependencies": [
     "canvas-stored"
   ],
-  "canvasRev": "0dbc541",
+  "canvasRev": "61917c2",
   "canvasSource": "runtimes/edge"
 }

package/src/EdgeClient.js

@@ -1,5 +1,6 @@
 'use strict';
 
+import { createTlsTransport, resolveTls } from '@augmentd-labs/canvas-api-client/tls';
 import { io } from 'socket.io-client';
 
 const CHUNK_SIZE = 256 * 1024;
@@ -15,6 +16,7 @@ const CHUNK_SIZE = 256 * 1024;
  * See docs/canvas-edge-protocol.md for the frame protocol.
  */
 export default class EdgeClient {
+    #transport;
     #serverUrl;
     #token;
     #localApp;
@@ -23,10 +25,11 @@ export default class EdgeClient {
     #announced = false;
     #forwarded = [];
 
-    constructor({ serverUrl, token, localApp, announce }) {
+    constructor({ serverUrl, token, localApp, announce, tls }) {
         if (!serverUrl || !token || !localApp?.inject || !announce?.instanceId) {
             throw new Error('EdgeClient requires serverUrl, token, localApp (fastify) and announce.instanceId');
         }
+        this.#transport = createTlsTransport(serverUrl, resolveTls(tls));
         this.#serverUrl = serverUrl.replace(/\/+$/, '');
         this.#token = token;
         this.#localApp = localApp;
@@ -38,17 +41,20 @@ export default class EdgeClient {
    * existing device registration endpoint. Persist the result locally and
    * never touch the user token again.
    */
-    static async pair({ serverUrl, userToken, name, type = 'edge', ...deviceInfo }) {
-        const res = await fetch(`${serverUrl.replace(/\/+$/, '')}/rest/v2/auth/devices/register`, {
-            method: 'POST',
-            headers: { 'Content-Type': 'application/json', Authorization: `Bearer ${userToken}` },
-            body: JSON.stringify({ name, type, ...deviceInfo }),
-        });
-        const json = await res.json().catch(() => null);
-        if (!res.ok || !json?.payload?.token) {
-            throw new Error(`Edge pairing failed: ${json?.message || res.statusText}`);
-        }
-        return { token: json.payload.token, deviceId: json.payload.deviceId || json.payload.id };
+    static async pair({ serverUrl, userToken, name, type = 'edge', tls, ...deviceInfo }) {
+        const transport = createTlsTransport(serverUrl, resolveTls(tls));
+        try {
+            const res = await transport.fetch(`${serverUrl.replace(/\/+$/, '')}/rest/v2/auth/devices/register`, {
+                method: 'POST',
+                headers: { 'Content-Type': 'application/json', Authorization: `Bearer ${userToken}` },
+                body: JSON.stringify({ name, type, ...deviceInfo }),
+            });
+            const json = await res.json().catch(() => null);
+            if (!res.ok || !json?.payload?.token) {
+                throw new Error(`Edge pairing failed: ${json?.message || res.statusText}`);
+            }
+            return { token: json.payload.token, deviceId: json.payload.deviceId || json.payload.id };
+        } finally { await transport.dispose(); }
     }
 
     get connected() {
@@ -58,8 +64,9 @@ export default class EdgeClient {
     connect() {
         if (this.#socket) return this;
         this.#socket = io(this.#serverUrl, {
+            ...this.#transport.socketOptions,
             auth: { token: this.#token },
-            transports: ['websocket'],
+            transports: this.#transport.socketOptions.transports || ['websocket'],
         });
         // Announce on every (re)connect — announce is idempotent full state.
         this.#socket.on('connect', () => this.#socket.emit('edge:announce', this.#announce));
@@ -121,6 +128,7 @@ export default class EdgeClient {
     }
 
     close() {
+        void this.#transport.dispose().catch(() => {});
         for (const [emitter, listener] of this.#forwarded) emitter.off('**', listener);
         this.#forwarded = [];
         this.#socket?.disconnect();

package/src/env.js

@@ -1,5 +1,6 @@
 'use strict';
 
+import { resolveTls } from '@augmentd-labs/canvas-api-client/tls';
 import fs from 'fs';
 import os from 'os';
 import path from 'path';
@@ -81,7 +82,7 @@ export function ensureEnvConfig(env = process.env) {
     const prior = remotes[hubId] || {};
     // A device token minted for this remote stays authoritative; env only
     // seeds the user/API token it started from.
-    remotes[hubId] = { ...prior, url, apiBase: prior.apiBase || '/rest/v2', auth: { ...(prior.auth || {}), token }, source: 'env' };
+    remotes[hubId] = { ...prior, url, apiBase: prior.apiBase || '/rest/v2', auth: { ...(prior.auth || {}), token }, source: 'env', ...(resolveTls(prior.url && new URL(prior.url).origin !== new URL(url).origin ? undefined : prior.tls, env) ? { tls: resolveTls(prior.url && new URL(prior.url).origin !== new URL(url).origin ? undefined : prior.tls, env) } : { tls: undefined }) };
     writeJson(EDGE_PATHS.remotes, remotes);
 
     const cfg = readJson(EDGE_PATHS.mirrors, { version: 1, mirrors: [] }) || { version: 1, mirrors: [] };
@@ -142,7 +143,7 @@ export async function ensureDeviceToken(remoteId, { logger = null } = {}) {
     if (!r?.url || r.source !== 'env' || r.device?.token || !r.auth?.token) return hubFor(remoteId);
     const identity = deviceIdentity(null);
     const paired = await EdgeClient.pair({
-        serverUrl: r.url, userToken: r.auth.token, name: identity.deviceName, type: 'edge',
+        serverUrl: r.url, tls: resolveTls(r.tls), userToken: r.auth.token, name: identity.deviceName, type: 'edge',
         deviceId: identity.deviceId, hostname: os.hostname(), platform: process.platform, arch: process.arch,
     });
     remotes[remoteId] = { ...r, device: { deviceId: paired.deviceId || identity.deviceId, token: paired.token, registeredAt: new Date().toISOString() } };
@@ -161,6 +162,7 @@ export function hubFor(remoteId) {
     return {
         id: remoteId,
         url: String(r.url).replace(/\/+$/, ''),
+        tls: resolveTls(r.tls),
         apiBase: r.apiBase || '/rest/v2',
         token,
         deviceId: deviceToken && r.device?.deviceId ? String(r.device.deviceId) : null,

package/src/mirror-runtime.js

@@ -1,5 +1,6 @@
 'use strict';
 
+import { createTlsTransport } from '@augmentd-labs/canvas-api-client/tls';
 import fs from 'fs';
 import path from 'path';
 import { io } from 'socket.io-client';
@@ -29,6 +30,7 @@ const STATUS_HEARTBEAT_MS = 60000;
  * ledger as `full` so a hub that lost its replica table rebuilds it.
  */
 export class MirrorRuntime {
+    #transport;
     #mirror;
     #hub;
     #identity;
@@ -45,6 +47,7 @@ export class MirrorRuntime {
     constructor({ mirror, hub, identity, logger }) {
         this.#mirror = mirror;
         this.#hub = hub;
+        this.#transport = createTlsTransport(hub.url, hub.tls);
         this.#identity = identity;
         this.#logger = logger;
     }
@@ -87,6 +90,7 @@ export class MirrorRuntime {
         this.#stored.addBackend('trash', { driver: 'file', root: path.join(internal, 'trash'), watch: false });
         this.#stored.addBackend('conflicts', { driver: 'file', root: path.join(internal, 'conflicts'), watch: false });
         this.#stored.addBackend('canvas:hub', {
+            fetch: this.#transport.fetch,
             driver: 'canvas', url: this.#hub.url, apiBase: this.#hub.apiBase, token: this.#hub.token,
             workspaceId: this.#mirror.workspaceId || this.#mirror.workspaceName, backend: 'workspace:home',
             deviceId: this.#identity.deviceId, deviceName: this.#identity.deviceName, prefixes: this.#mirror.pins || [], pollInterval: 30000,
@@ -113,6 +117,7 @@ export class MirrorRuntime {
     }
 
     async stop() {
+        // Close pooled TLS connections after stopping mirror activity below.
         clearInterval(this.#reporter);
         clearTimeout(this.#reportTimer);
         this.#socket?.close();
@@ -121,6 +126,7 @@ export class MirrorRuntime {
         await this.#stored?.stop().catch(() => {});
         this.#engine = null;
         this.#stored = null;
+        await this.#transport.dispose();
     }
 
     status() {
@@ -133,7 +139,7 @@ export class MirrorRuntime {
 
     async #fetchHubExclusions() {
         try {
-            const res = await fetch(`${this.#hub.url}${this.#hub.apiBase}/workspaces/${encodeURIComponent(this.#mirror.workspaceName)}/backends/file/workspace%3Ahome`, {
+            const res = await this.#transport.fetch(`${this.#hub.url}${this.#hub.apiBase}/workspaces/${encodeURIComponent(this.#mirror.workspaceName)}/backends/file/workspace%3Ahome`, {
                 headers: { authorization: `Bearer ${this.#hub.token}` },
             });
             const json = await res.json();
@@ -147,7 +153,7 @@ export class MirrorRuntime {
     async #resolveWorkspaceId() {
         if (this.#mirror.workspaceId && /^[0-9a-f-]{36}$/i.test(this.#mirror.workspaceId)) return this.#mirror.workspaceId;
         try {
-            const res = await fetch(`${this.#hub.url}${this.#hub.apiBase}/workspaces/${encodeURIComponent(this.#mirror.workspaceName)}`, { headers: { authorization: `Bearer ${this.#hub.token}` } });
+            const res = await this.#transport.fetch(`${this.#hub.url}${this.#hub.apiBase}/workspaces/${encodeURIComponent(this.#mirror.workspaceName)}`, { headers: { authorization: `Bearer ${this.#hub.token}` } });
             const json = await res.json();
             return json?.payload?.workspace?.id || json?.payload?.id || this.#mirror.workspaceId || this.#mirror.workspaceName;
         } catch { return this.#mirror.workspaceId || this.#mirror.workspaceName; }
@@ -156,7 +162,7 @@ export class MirrorRuntime {
     async #connectSocket() {
         try {
             const wsId = await this.#resolveWorkspaceId();
-            const socket = io(this.#hub.url, { auth: { token: this.#hub.token }, transports: ['websocket'], reconnection: true, reconnectionDelay: 1000, reconnectionDelayMax: 30000 });
+            const socket = io(this.#hub.url, { ...this.#transport.socketOptions, auth: { token: this.#hub.token }, transports: this.#transport.socketOptions.transports || ['websocket'], reconnection: true, reconnectionDelay: 1000, reconnectionDelayMax: 30000 });
             this.#socket = socket;
             socket.on('connect', () => { socket.emit('subscribe', { channel: `workspace:${wsId}` }); this.resync().catch(() => {}); });
             socket.on('backend.changed', (e) => { if (!e?.backend || e.backend === 'workspace:home') this.nudge(); });
@@ -188,7 +194,7 @@ export class MirrorRuntime {
         this.#pendingApplied = full ? [] : mergePairs(this.#pendingApplied, delta);
         const applied = full ? (typeof engine.appliedSnapshot === 'function' ? engine.appliedSnapshot() : []) : this.#pendingApplied;
         try {
-            const res = await fetch(`${this.#hub.url}${this.#hub.apiBase}/workspaces/${ws}/mirrors/${encodeURIComponent(this.#identity.deviceId)}/status`, {
+            const res = await this.#transport.fetch(`${this.#hub.url}${this.#hub.apiBase}/workspaces/${ws}/mirrors/${encodeURIComponent(this.#identity.deviceId)}/status`, {
                 method: 'POST',
                 headers: { authorization: `Bearer ${this.#hub.token}`, 'content-type': 'application/json' },
                 body: JSON.stringify({

package/src/remote-config.js

@@ -1,5 +1,6 @@
 'use strict';
 
+import { normalizeTls } from '@augmentd-labs/canvas-api-client/tls';
 import fs from 'node:fs';
 import path from 'node:path';
 
@@ -35,11 +36,12 @@ export function listRemotes(config = {}) {
             url: remote.url.replace(/\/+$/, ''),
             token: remote.token,
             enabled: remote.enabled !== false,
+            ...(remote.tls ? { tls: normalizeTls(remote.tls) } : {}),
         }));
 }
 
 /** Add or update (matched by url) a remote entry, persisting workspace.json. */
-export function saveRemote(dir, { url, token, enabled = true }) {
+export function saveRemote(dir, { url, token, enabled = true, tls }) {
     if (!url || !token) throw new Error('remote requires url and token');
     const file = workspaceConfigPath(dir);
     const config = readWorkspaceConfig(dir);
@@ -50,8 +52,9 @@ export function saveRemote(dir, { url, token, enabled = true }) {
         existing.url = normalizedUrl;
         existing.token = token;
         existing.enabled = enabled;
+        if (tls !== undefined) existing.tls = normalizeTls(tls);
     } else {
-        remotes.push({ url: normalizedUrl, token, enabled });
+        remotes.push({ url: normalizedUrl, token, enabled, ...(tls ? { tls: normalizeTls(tls) } : {}) });
     }
     config.remotes = remotes;
     fs.writeFileSync(file, JSON.stringify(config, null, 2) + '\n');

package/src/runtime.js

@@ -45,6 +45,7 @@ export function connectRemotes({ dir, localApp, events, clientFactory } = {}) {
             const client = createClient({
                 serverUrl: remote.url,
                 token: remote.token,
+                tls: remote.tls,
                 localApp,
                 announce,
             });