@chatroomcp/chatroom 0.1.3

package/dist/plugins/cloud/api-client.js

@@ -0,0 +1,122 @@
+import { z } from "zod";
+import { CLOUD_ENTITLEMENT_SCHEMA, CLOUD_LEASE_SCHEMA, } from "./types.js";
+import { signDeviceProof } from "./device-proof.js";
+const customerSchema = z.object({ id: z.string().min(1) }).strict();
+const recoveryCredentialSchema = z
+    .object({
+    recoveryKey: z.string().regex(/^crr\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+$/),
+})
+    .strict();
+const sessionSchema = z
+    .object({
+    purchaseToken: z.string().min(24),
+    managementUrl: z.string().url(),
+    expiresAt: z.string().datetime(),
+})
+    .strict();
+const statusSchema = z
+    .object({
+    managementSessionActive: z.boolean(),
+    entitlements: z.array(CLOUD_ENTITLEMENT_SCHEMA),
+    customer: customerSchema.nullable(),
+    publicPrefix: z.string().min(1).nullable(),
+})
+    .strict();
+const restoreSchema = z
+    .object({
+    entitlements: z.array(CLOUD_ENTITLEMENT_SCHEMA),
+    customer: customerSchema,
+    publicPrefix: z.string().min(1).nullable(),
+    recoveryKey: z.string().regex(/^crr\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+$/),
+})
+    .strict();
+const prefixSchema = z
+    .object({
+    publicPrefix: z.string().min(1),
+    mcpUrl: z.string().url(),
+    webUrl: z.string().url(),
+})
+    .strict();
+export class CloudApiClient {
+    baseUrl;
+    constructor(baseUrl) {
+        this.baseUrl = baseUrl;
+    }
+    async createManagementSession(identity) {
+        const payload = { devicePublicKey: identity.devicePublicKey };
+        return sessionSchema.parse(await this.devicePost("/v1/device/session", "session", identity, payload));
+    }
+    async status(identity, purchaseToken) {
+        const payload = {
+            devicePublicKey: identity.devicePublicKey,
+            purchaseToken,
+        };
+        return statusSchema.parse(await this.devicePost("/v1/device/status", "status", identity, payload));
+    }
+    async restore(identity, recoveryKey) {
+        const payload = { devicePublicKey: identity.devicePublicKey, recoveryKey };
+        return restoreSchema.parse(await this.devicePost("/v1/device/restore", "restore", identity, payload));
+    }
+    async replaceRecoveryKey(identity) {
+        const payload = { devicePublicKey: identity.devicePublicKey };
+        return recoveryCredentialSchema.parse(await this.devicePost("/v1/device/recovery-key", "recovery-key", identity, payload));
+    }
+    async setPrefix(identity, prefix) {
+        const payload = { devicePublicKey: identity.devicePublicKey, prefix };
+        return prefixSchema.parse(await this.devicePost("/v1/device/prefix", "prefix", identity, payload));
+    }
+    async lease(identity, requestedServices) {
+        const payload = {
+            devicePublicKey: identity.devicePublicKey,
+            requestedServices,
+        };
+        return CLOUD_LEASE_SCHEMA.parse(await this.devicePost("/v1/device/lease", "lease", identity, payload));
+    }
+    async devicePost(path, operation, identity, payload) {
+        const proof = signDeviceProof({
+            operation,
+            installationId: identity.installationId,
+            devicePrivateKey: identity.devicePrivateKey,
+            payload,
+        });
+        const response = await fetch(new URL(path, `${this.baseUrl}/`), {
+            method: "POST",
+            headers: {
+                "content-type": "application/json",
+                accept: "application/json",
+            },
+            body: JSON.stringify({
+                installationId: identity.installationId,
+                ...payload,
+                ...proof,
+            }),
+        });
+        const body = (await response.json().catch(() => null));
+        if (!response.ok) {
+            const message = typeof body === "object" &&
+                body &&
+                "message" in body &&
+                typeof body.message === "string"
+                ? body.message
+                : `ChatRoom Cloud request failed (${response.status})`;
+            const issues = typeof body === "object" &&
+                body &&
+                "issues" in body &&
+                Array.isArray(body.issues)
+                ? body.issues.flatMap((issue) => {
+                    if (!issue || typeof issue !== "object")
+                        return [];
+                    const path = "path" in issue && Array.isArray(issue.path)
+                        ? issue.path.join(".")
+                        : "";
+                    const detail = "message" in issue && typeof issue.message === "string"
+                        ? issue.message
+                        : "";
+                    return detail ? [`${path || "request"}: ${detail}`] : [];
+                })
+                : [];
+            throw new Error(issues.length ? `${message}: ${issues.join("; ")}` : message);
+        }
+        return body;
+    }
+}

package/dist/plugins/cloud/controller.d.ts

@@ -0,0 +1,48 @@
+import type { ChatRoomConfig } from "../../config/types.js";
+import { type CloudServiceId, type CloudStatus } from "./types.js";
+interface ExternalAccessSink {
+    setCloud(state: {
+        mcpBaseUrl: string | null;
+        webBaseUrl: string | null;
+    }): void;
+    clearCloud(): void;
+}
+export declare class CloudController {
+    private readonly config;
+    private readonly externalAccess?;
+    private readonly store;
+    private readonly api;
+    private state;
+    private tunnel;
+    private connection;
+    private lastError;
+    private managementTimer;
+    private renewalTimer;
+    private stopped;
+    private constructor();
+    static create(config: ChatRoomConfig, externalAccess?: ExternalAccessSink): Promise<CloudController>;
+    status(): CloudStatus;
+    start(): Promise<void>;
+    stop(): Promise<void>;
+    managementUrl(): Promise<{
+        url: string;
+        expiresAt: string;
+    }>;
+    syncStatus(): Promise<CloudStatus>;
+    restore(recoveryKey: string): Promise<{
+        status: CloudStatus;
+        recoveryKey: string;
+    }>;
+    replaceRecoveryKey(): Promise<string>;
+    setPrefix(prefix: string): Promise<CloudStatus>;
+    setService(service: CloudServiceId, enabled: boolean): Promise<CloudStatus>;
+    private refreshLeaseIfNeeded;
+    private connectTunnel;
+    private publishExternalAccess;
+    private scheduleManagementSync;
+    private scheduleRenewal;
+    private validManagementSession;
+    private identity;
+    private setError;
+}
+export {};

package/dist/plugins/cloud/controller.js

@@ -0,0 +1,282 @@
+import { CloudApiClient } from "./api-client.js";
+import { CloudStateStore } from "./state-store.js";
+import { CloudTunnelClient } from "./tunnel-client.js";
+import { CLOUD_SERVICES, } from "./types.js";
+export class CloudController {
+    config;
+    externalAccess;
+    store;
+    api;
+    state;
+    tunnel = null;
+    connection = "inactive";
+    lastError = null;
+    managementTimer = null;
+    renewalTimer = null;
+    stopped = true;
+    constructor(config, cloudApi, externalAccess) {
+        this.config = config;
+        this.externalAccess = externalAccess;
+        this.store = new CloudStateStore(config.dataDir);
+        this.api = new CloudApiClient(cloudApi);
+    }
+    static async create(config, externalAccess) {
+        const apiBaseUrl = (process.env.CHATROOM_CLOUD_API ?? "https://chatroomcp.com").replace(/\/$/, "");
+        const controller = new CloudController(config, apiBaseUrl, externalAccess);
+        controller.state = await controller.store.loadOrCreate();
+        controller.publishExternalAccess();
+        return controller;
+    }
+    status() {
+        return {
+            installationId: this.state.installationId,
+            customerId: this.state.customerId,
+            publicPrefix: this.state.publicPrefix,
+            desiredServices: { ...this.state.desiredServices },
+            entitlements: [...this.state.entitlements],
+            managementSessionActive: Boolean(this.state.managementSession &&
+                Date.parse(this.state.managementSession.expiresAt) > Date.now()),
+            connection: this.connection,
+            mcpUrl: this.state.lease?.mcpBaseUrl
+                ? `${this.state.lease.mcpBaseUrl}/mcp`
+                : null,
+            webUrl: this.state.lease?.webBaseUrl ?? null,
+            lastError: this.lastError,
+        };
+    }
+    async start() {
+        if (!this.stopped)
+            return;
+        this.stopped = false;
+        await this.syncStatus().catch((error) => this.setError(error));
+        this.scheduleManagementSync();
+    }
+    async stop() {
+        this.stopped = true;
+        if (this.managementTimer)
+            clearTimeout(this.managementTimer);
+        if (this.renewalTimer)
+            clearTimeout(this.renewalTimer);
+        this.managementTimer = null;
+        this.renewalTimer = null;
+        this.tunnel?.stop();
+        this.tunnel = null;
+        this.externalAccess?.clearCloud();
+        if (this.state.lease)
+            this.connection = "disconnected";
+    }
+    async managementUrl() {
+        const current = this.state.managementSession;
+        if (current && Date.parse(current.expiresAt) > Date.now()) {
+            return { url: current.managementUrl, expiresAt: current.expiresAt };
+        }
+        const session = await this.api.createManagementSession(this.identity());
+        this.state = {
+            ...this.state,
+            managementSession: {
+                purchaseToken: session.purchaseToken,
+                managementUrl: session.managementUrl,
+                expiresAt: session.expiresAt,
+            },
+        };
+        await this.store.save(this.state);
+        this.scheduleManagementSync(0);
+        return { url: session.managementUrl, expiresAt: session.expiresAt };
+    }
+    async syncStatus() {
+        const managementSession = this.validManagementSession();
+        const previousEntitlements = this.state.entitlements;
+        const previousPrefix = this.state.publicPrefix;
+        const result = await this.api.status(this.identity(), managementSession?.purchaseToken ?? null);
+        const nextCustomerId = result.customer?.id ?? null;
+        this.state = {
+            ...this.state,
+            customerId: nextCustomerId,
+            publicPrefix: result.publicPrefix,
+            desiredServices: enableNewlyPurchasedServices(this.state.desiredServices, previousEntitlements.map((entry) => entry.service), result.entitlements.map((entry) => entry.service)),
+            entitlements: result.entitlements,
+            managementSession: result.managementSessionActive
+                ? managementSession
+                : null,
+        };
+        await this.store.save(this.state);
+        if (!this.stopped) {
+            await this.refreshLeaseIfNeeded(previousPrefix !== null && previousPrefix !== result.publicPrefix);
+            this.connectTunnel();
+            this.scheduleRenewal();
+        }
+        this.lastError = null;
+        return this.status();
+    }
+    async restore(recoveryKey) {
+        const previousEntitlements = this.state.entitlements;
+        const result = await this.api.restore(this.identity(), recoveryKey);
+        this.state = {
+            ...this.state,
+            customerId: result.customer.id,
+            publicPrefix: result.publicPrefix,
+            desiredServices: enableNewlyPurchasedServices(this.state.desiredServices, previousEntitlements.map((entry) => entry.service), result.entitlements.map((entry) => entry.service)),
+            entitlements: result.entitlements,
+            lease: null,
+        };
+        await this.store.save(this.state);
+        this.tunnel?.stop();
+        this.tunnel = null;
+        if (!this.stopped) {
+            await this.refreshLeaseIfNeeded(true);
+            this.connectTunnel();
+            this.scheduleRenewal();
+        }
+        this.lastError = null;
+        return { status: this.status(), recoveryKey: result.recoveryKey };
+    }
+    async replaceRecoveryKey() {
+        const result = await this.api.replaceRecoveryKey(this.identity());
+        return result.recoveryKey;
+    }
+    async setPrefix(prefix) {
+        const result = await this.api.setPrefix(this.identity(), prefix);
+        this.state = { ...this.state, publicPrefix: result.publicPrefix };
+        await this.store.save(this.state);
+        if (!this.stopped && this.state.entitlements.length > 0) {
+            await this.refreshLeaseIfNeeded(true);
+            this.connectTunnel();
+            this.scheduleRenewal();
+        }
+        this.lastError = null;
+        return this.status();
+    }
+    async setService(service, enabled) {
+        if (!CLOUD_SERVICES.includes(service))
+            throw new Error(`Unknown Cloud service: ${service}`);
+        this.state = {
+            ...this.state,
+            desiredServices: { ...this.state.desiredServices, [service]: enabled },
+        };
+        await this.store.save(this.state);
+        if (!this.stopped) {
+            await this.refreshLeaseIfNeeded(true);
+            this.connectTunnel();
+            this.scheduleRenewal();
+        }
+        this.lastError = null;
+        return this.status();
+    }
+    async refreshLeaseIfNeeded(force) {
+        const entitled = new Set(this.state.entitlements.map((entry) => entry.service));
+        const requested = CLOUD_SERVICES.filter((service) => this.state.desiredServices[service] && entitled.has(service));
+        if (requested.length === 0) {
+            if (this.state.lease) {
+                this.state = { ...this.state, lease: null };
+                await this.store.save(this.state);
+            }
+            this.tunnel?.drainAndStop();
+            this.tunnel = null;
+            this.connection = "inactive";
+            this.publishExternalAccess();
+            return;
+        }
+        const current = this.state.lease;
+        const sameServices = current &&
+            requested.length === current.services.length &&
+            requested.every((service) => current.services.includes(service));
+        const fresh = current && Date.parse(current.expiresAt) - Date.now() > 15 * 60 * 1000;
+        if (!force && sameServices && fresh) {
+            this.publishExternalAccess();
+            return;
+        }
+        const lease = await this.api.lease(this.identity(), requested);
+        this.state = { ...this.state, lease };
+        await this.store.save(this.state);
+        this.publishExternalAccess();
+        this.tunnel?.updateLease(lease);
+    }
+    connectTunnel() {
+        if (this.stopped ||
+            this.tunnel ||
+            !this.state.lease ||
+            this.state.lease.services.length === 0)
+            return;
+        this.connection = "connecting";
+        this.tunnel = new CloudTunnelClient(this.state.lease, { devicePrivateKey: this.state.devicePrivateKey }, this.config.server, {
+            onConnected: () => {
+                this.lastError = null;
+                this.connection = "connected";
+            },
+            onDisconnected: () => {
+                if (!this.stopped && this.state.lease)
+                    this.connection = "disconnected";
+            },
+            onError: (error) => this.setError(error),
+        });
+        this.tunnel.start();
+    }
+    publishExternalAccess() {
+        const lease = this.state.lease;
+        const activeLease = lease && Date.parse(lease.expiresAt) > Date.now() ? lease : null;
+        this.externalAccess?.setCloud({
+            mcpBaseUrl: activeLease?.services.includes("remote_mcp")
+                ? activeLease.mcpBaseUrl
+                : null,
+            webBaseUrl: activeLease?.services.includes("remote_web")
+                ? activeLease.webBaseUrl
+                : null,
+        });
+    }
+    scheduleManagementSync(delayMs = 3_000) {
+        if (this.managementTimer)
+            clearTimeout(this.managementTimer);
+        this.managementTimer = null;
+        if (this.stopped || !this.validManagementSession())
+            return;
+        this.managementTimer = setTimeout(() => {
+            this.managementTimer = null;
+            void this.syncStatus()
+                .catch((error) => this.setError(error))
+                .finally(() => this.scheduleManagementSync());
+        }, delayMs);
+        this.managementTimer.unref();
+    }
+    scheduleRenewal() {
+        if (this.renewalTimer)
+            clearTimeout(this.renewalTimer);
+        this.renewalTimer = null;
+        const lease = this.state.lease;
+        if (this.stopped || !lease)
+            return;
+        const remaining = Date.parse(lease.expiresAt) - Date.now();
+        const delay = Math.max(60_000, remaining - (10 + Math.random() * 10) * 60_000);
+        this.renewalTimer = setTimeout(() => {
+            this.renewalTimer = null;
+            void this.refreshLeaseIfNeeded(true)
+                .then(() => this.connectTunnel())
+                .catch((error) => this.setError(error))
+                .finally(() => this.scheduleRenewal());
+        }, delay);
+        this.renewalTimer.unref();
+    }
+    validManagementSession() {
+        const value = this.state.managementSession;
+        return value && Date.parse(value.expiresAt) > Date.now() ? value : null;
+    }
+    identity() {
+        return {
+            installationId: this.state.installationId,
+            devicePublicKey: this.state.devicePublicKey,
+            devicePrivateKey: this.state.devicePrivateKey,
+        };
+    }
+    setError(error) {
+        this.lastError = error instanceof Error ? error.message : String(error);
+        this.connection = "error";
+    }
+}
+function enableNewlyPurchasedServices(desiredServices, previousEntitlements, currentEntitlements) {
+    const previous = new Set(previousEntitlements);
+    const current = new Set(currentEntitlements);
+    const next = { ...desiredServices };
+    for (const service of CLOUD_SERVICES)
+        if (!previous.has(service) && current.has(service))
+            next[service] = true;
+    return next;
+}

package/dist/plugins/cloud/device-proof.d.ts

@@ -0,0 +1,9 @@
+export declare function signDeviceProof(input: {
+    operation: string;
+    installationId: string;
+    devicePrivateKey: string;
+    payload: unknown;
+}): {
+    timestamp: string;
+    signature: string;
+};

package/dist/plugins/cloud/device-proof.js

@@ -0,0 +1,17 @@
+import { createHash, createPrivateKey, sign } from "node:crypto";
+export function signDeviceProof(input) {
+    const timestamp = new Date().toISOString();
+    const payloadHash = createHash("sha256")
+        .update(JSON.stringify(input.payload))
+        .digest("base64url");
+    const message = Buffer.from(`chatroom-cloud-device-v1\n${input.operation}\n${input.installationId}\n${timestamp}\n${payloadHash}`);
+    const key = createPrivateKey({
+        key: Buffer.from(input.devicePrivateKey, "base64url"),
+        format: "der",
+        type: "pkcs8",
+    });
+    return {
+        timestamp,
+        signature: sign(null, message, key).toString("base64url"),
+    };
+}

package/dist/plugins/cloud/plugin.d.ts

@@ -0,0 +1,4 @@
+import type { InternalPlugin } from "../types.js";
+import { CloudController } from "./controller.js";
+export declare const CloudService: import("../types.js").ServiceToken<CloudController>;
+export declare function createCloudPlugin(): InternalPlugin;

package/dist/plugins/cloud/plugin.js

@@ -0,0 +1,17 @@
+import { createServiceToken } from "../types.js";
+import { CloudController } from "./controller.js";
+export const CloudService = createServiceToken("cloud");
+export function createCloudPlugin() {
+    let controller = null;
+    return {
+        id: "cloud",
+        async activate(context) {
+            controller = await CloudController.create(context.config, context.externalAccess);
+            context.services.provide(CloudService, controller);
+        },
+        async deactivate() {
+            await controller?.stop();
+            controller = null;
+        },
+    };
+}

package/dist/plugins/cloud/state-store.d.ts

@@ -0,0 +1,7 @@
+import { type CloudPersistedState } from "./types.js";
+export declare class CloudStateStore {
+    readonly filePath: string;
+    constructor(dataDir: string);
+    loadOrCreate(): Promise<CloudPersistedState>;
+    save(state: CloudPersistedState): Promise<void>;
+}

package/dist/plugins/cloud/state-store.js

@@ -0,0 +1,74 @@
+import { generateKeyPairSync, randomUUID } from "node:crypto";
+import { chmod, mkdir, readFile, rename, writeFile } from "node:fs/promises";
+import path from "node:path";
+import { z } from "zod";
+import { CLOUD_DESIRED_SERVICES_SCHEMA, CLOUD_ENTITLEMENT_SCHEMA, CLOUD_LEASE_SCHEMA, } from "./types.js";
+const stateSchema = z
+    .object({
+    schemaVersion: z.literal(1),
+    installationId: z.string().uuid(),
+    devicePublicKey: z.string().min(20),
+    devicePrivateKey: z.string().min(20),
+    customerId: z.string().min(1).nullable(),
+    publicPrefix: z.string().min(1).nullable(),
+    desiredServices: CLOUD_DESIRED_SERVICES_SCHEMA,
+    entitlements: z.array(CLOUD_ENTITLEMENT_SCHEMA),
+    managementSession: z
+        .object({
+        purchaseToken: z.string().min(24),
+        managementUrl: z.string().url(),
+        expiresAt: z.string().datetime(),
+    })
+        .strict()
+        .nullable(),
+    lease: CLOUD_LEASE_SCHEMA.nullable(),
+})
+    .strict();
+export class CloudStateStore {
+    filePath;
+    constructor(dataDir) {
+        this.filePath = path.join(dataDir, "cloud.json");
+    }
+    async loadOrCreate() {
+        try {
+            return stateSchema.parse(JSON.parse(await readFile(this.filePath, "utf8")));
+        }
+        catch (error) {
+            if (error.code !== "ENOENT")
+                throw error;
+        }
+        const state = createInitialState();
+        await this.save(state);
+        return state;
+    }
+    async save(state) {
+        const validated = stateSchema.parse(state);
+        await mkdir(path.dirname(this.filePath), { recursive: true, mode: 0o700 });
+        const temporary = `${this.filePath}.${process.pid}.${randomUUID()}.tmp`;
+        await writeFile(temporary, `${JSON.stringify(validated, null, 2)}\n`, {
+            mode: 0o600,
+        });
+        await chmod(temporary, 0o600).catch(() => undefined);
+        await rename(temporary, this.filePath);
+        await chmod(this.filePath, 0o600).catch(() => undefined);
+    }
+}
+function createInitialState() {
+    const { publicKey, privateKey } = generateKeyPairSync("ed25519");
+    return {
+        schemaVersion: 1,
+        installationId: randomUUID(),
+        devicePublicKey: publicKey
+            .export({ format: "der", type: "spki" })
+            .toString("base64url"),
+        devicePrivateKey: privateKey
+            .export({ format: "der", type: "pkcs8" })
+            .toString("base64url"),
+        customerId: null,
+        publicPrefix: null,
+        desiredServices: { remote_mcp: true, remote_web: true },
+        entitlements: [],
+        managementSession: null,
+        lease: null,
+    };
+}

package/dist/plugins/cloud/tunnel-client.d.ts

@@ -0,0 +1,36 @@
+import { type CloudLeaseState } from "./types.js";
+export declare class CloudTunnelClient {
+    private lease;
+    private readonly identity;
+    private readonly local;
+    private readonly callbacks;
+    private socket;
+    private reconnectTimer;
+    private stopped;
+    private attempts;
+    private closeWhenIdle;
+    private acceptingServices;
+    private readonly streams;
+    constructor(lease: CloudLeaseState, identity: {
+        devicePrivateKey: string;
+    }, local: {
+        host: string;
+        port: number;
+    }, callbacks: {
+        onConnected(): void;
+        onDisconnected(): void;
+        onError(error: Error): void;
+    });
+    start(): void;
+    stop(): void;
+    drainAndStop(): void;
+    updateLease(lease: CloudLeaseState): void;
+    private connect;
+    private handleControl;
+    private openStream;
+    private finishStream;
+    private handleBinary;
+    private send;
+    private sendBinary;
+    private scheduleReconnect;
+}