@gtc6244/immediacy-daemon 0.1.0

package/dist/src/config.d.ts

@@ -0,0 +1,33 @@
+/**
+ * AppConfigStore — daemon-owned app configuration (prompts + git behavior).
+ *
+ * Holds the editable {@link AppConfig} the app surfaces in Settings: the custom
+ * prompt text injected into agent sessions/actions, and the git lifecycle
+ * behavior for workspaces. Persisted to `~/.immediacy/config.json`.
+ *
+ * Unlike credentials.ts this carries no secret material, so the file is written
+ * world-readable (0644) rather than 0600 — but it keeps the same in-memory
+ * cache + serialized atomic-rename persist() so concurrent set() calls can't
+ * tear the file. Clients read it via `settings.get` → `settings.result` and
+ * replace it wholesale via `config.set`; every change is broadcast so all
+ * clients converge (see server.ts).
+ */
+import type { AppConfig } from "./protocol.js";
+/** First-run config: empty prompts, and git defaults that match today's
+ *  hardcoded behavior (auto -u on push, an `immediacy/` custom prefix). */
+export declare const DEFAULT_CONFIG: AppConfig;
+/** Coerce arbitrary (untrusted / partial) input into a valid AppConfig, filling
+ *  any missing or malformed field from {@link DEFAULT_CONFIG}. Never throws. */
+export declare function sanitizeConfig(input: unknown): AppConfig;
+export declare class AppConfigStore {
+    private config;
+    /** Serializes writes so two concurrent set() calls can't interleave. */
+    private writeChain;
+    load(): Promise<void>;
+    /** The current config (defensive: callers get the live object; treat as
+     *  read-only — mutate only through set()). */
+    get(): AppConfig;
+    /** Replace the config wholesale, sanitizing untrusted input, then persist. */
+    set(input: unknown): Promise<AppConfig>;
+    private persist;
+}

package/dist/src/config.js

@@ -0,0 +1,122 @@
+/**
+ * AppConfigStore — daemon-owned app configuration (prompts + git behavior).
+ *
+ * Holds the editable {@link AppConfig} the app surfaces in Settings: the custom
+ * prompt text injected into agent sessions/actions, and the git lifecycle
+ * behavior for workspaces. Persisted to `~/.immediacy/config.json`.
+ *
+ * Unlike credentials.ts this carries no secret material, so the file is written
+ * world-readable (0644) rather than 0600 — but it keeps the same in-memory
+ * cache + serialized atomic-rename persist() so concurrent set() calls can't
+ * tear the file. Clients read it via `settings.get` → `settings.result` and
+ * replace it wholesale via `config.set`; every change is broadcast so all
+ * clients converge (see server.ts).
+ */
+import { mkdir, readFile, rename, writeFile } from "node:fs/promises";
+import { homedir } from "node:os";
+import { dirname, join } from "node:path";
+const CONFIG_FILE = process.env.CONFIG_FILE ?? join(homedir(), ".immediacy", "config.json");
+/** A prompt/prefix a malicious client can't blow up to a multi-MB blob on disk. */
+const MAX_PROMPT_LEN = 8192;
+const MAX_PREFIX_LEN = 128;
+const BRANCH_PREFIX_TYPES = ["none", "username", "custom"];
+/** First-run config: empty prompts, and git defaults that match today's
+ *  hardcoded behavior (auto -u on push, an `immediacy/` custom prefix). */
+export const DEFAULT_CONFIG = {
+    prompts: {
+        general: "",
+        codeReview: "",
+        createPr: "",
+        fixErrors: "",
+        resolveMergeConflicts: "",
+        renameBranch: "",
+    },
+    git: {
+        deleteBranchOnArchive: false,
+        archiveOnMerge: false,
+        worktreePushAutoSetupRemote: true,
+        branchPrefixType: "custom",
+        branchPrefix: "immediacy/",
+    },
+};
+function str(v, fallback, max) {
+    if (typeof v !== "string")
+        return fallback;
+    // Trim only the tail cap; keep interior whitespace (prompts are multi-line).
+    return v.length > max ? v.slice(0, max) : v;
+}
+function bool(v, fallback) {
+    return typeof v === "boolean" ? v : fallback;
+}
+function prefixType(v) {
+    return BRANCH_PREFIX_TYPES.includes(v)
+        ? v
+        : DEFAULT_CONFIG.git.branchPrefixType;
+}
+/** Coerce arbitrary (untrusted / partial) input into a valid AppConfig, filling
+ *  any missing or malformed field from {@link DEFAULT_CONFIG}. Never throws. */
+export function sanitizeConfig(input) {
+    const obj = (input ?? {});
+    const p = (obj.prompts ?? {});
+    const g = (obj.git ?? {});
+    const D = DEFAULT_CONFIG;
+    return {
+        prompts: {
+            general: str(p.general, D.prompts.general, MAX_PROMPT_LEN),
+            codeReview: str(p.codeReview, D.prompts.codeReview, MAX_PROMPT_LEN),
+            createPr: str(p.createPr, D.prompts.createPr, MAX_PROMPT_LEN),
+            fixErrors: str(p.fixErrors, D.prompts.fixErrors, MAX_PROMPT_LEN),
+            resolveMergeConflicts: str(p.resolveMergeConflicts, D.prompts.resolveMergeConflicts, MAX_PROMPT_LEN),
+            renameBranch: str(p.renameBranch, D.prompts.renameBranch, MAX_PROMPT_LEN),
+        },
+        git: {
+            deleteBranchOnArchive: bool(g.deleteBranchOnArchive, D.git.deleteBranchOnArchive),
+            archiveOnMerge: bool(g.archiveOnMerge, D.git.archiveOnMerge),
+            worktreePushAutoSetupRemote: bool(g.worktreePushAutoSetupRemote, D.git.worktreePushAutoSetupRemote),
+            branchPrefixType: prefixType(g.branchPrefixType),
+            branchPrefix: str(g.branchPrefix, D.git.branchPrefix, MAX_PREFIX_LEN),
+        },
+    };
+}
+export class AppConfigStore {
+    config = sanitizeConfig(DEFAULT_CONFIG);
+    /** Serializes writes so two concurrent set() calls can't interleave. */
+    writeChain = Promise.resolve();
+    async load() {
+        try {
+            const raw = await readFile(CONFIG_FILE, "utf8");
+            this.config = sanitizeConfig(JSON.parse(raw));
+            console.log("[config] restored app config");
+        }
+        catch {
+            /* no prior state — keep defaults */
+        }
+    }
+    /** The current config (defensive: callers get the live object; treat as
+     *  read-only — mutate only through set()). */
+    get() {
+        return this.config;
+    }
+    /** Replace the config wholesale, sanitizing untrusted input, then persist. */
+    async set(input) {
+        this.config = sanitizeConfig(input);
+        await this.persist();
+        return this.config;
+    }
+    persist() {
+        // Snapshot synchronously so a later set() can't race this write, then chain
+        // onto any in-flight write so concurrent set() calls serialize instead of
+        // interleaving (mirrors credentials.ts). No secrets here → default 0644.
+        const snapshot = JSON.stringify(this.config, null, 2);
+        this.writeChain = this.writeChain
+            .catch(() => { })
+            .then(async () => {
+            await mkdir(dirname(CONFIG_FILE), { recursive: true });
+            const tmp = `${CONFIG_FILE}.${process.pid}.tmp`;
+            await writeFile(tmp, snapshot, "utf8");
+            await rename(tmp, CONFIG_FILE);
+        });
+        return this.writeChain;
+    }
+}
+//# sourceMappingURL=config.js.map

package/dist/src/config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../../src/config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AACtE,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAQ1C,MAAM,WAAW,GACf,OAAO,CAAC,GAAG,CAAC,WAAW,IAAI,IAAI,CAAC,OAAO,EAAE,EAAE,YAAY,EAAE,aAAa,CAAC,CAAC;AAE1E,mFAAmF;AACnF,MAAM,cAAc,GAAG,IAAI,CAAC;AAC5B,MAAM,cAAc,GAAG,GAAG,CAAC;AAE3B,MAAM,mBAAmB,GAAuB,CAAC,MAAM,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAC;AAE/E;2EAC2E;AAC3E,MAAM,CAAC,MAAM,cAAc,GAAc;IACvC,OAAO,EAAE;QACP,OAAO,EAAE,EAAE;QACX,UAAU,EAAE,EAAE;QACd,QAAQ,EAAE,EAAE;QACZ,SAAS,EAAE,EAAE;QACb,qBAAqB,EAAE,EAAE;QACzB,YAAY,EAAE,EAAE;KACjB;IACD,GAAG,EAAE;QACH,qBAAqB,EAAE,KAAK;QAC5B,cAAc,EAAE,KAAK;QACrB,2BAA2B,EAAE,IAAI;QACjC,gBAAgB,EAAE,QAAQ;QAC1B,YAAY,EAAE,YAAY;KAC3B;CACF,CAAC;AAEF,SAAS,GAAG,CAAC,CAAU,EAAE,QAAgB,EAAE,GAAW;IACpD,IAAI,OAAO,CAAC,KAAK,QAAQ;QAAE,OAAO,QAAQ,CAAC;IAC3C,6EAA6E;IAC7E,OAAO,CAAC,CAAC,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC9C,CAAC;AAED,SAAS,IAAI,CAAC,CAAU,EAAE,QAAiB;IACzC,OAAO,OAAO,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;AAC/C,CAAC;AAED,SAAS,UAAU,CAAC,CAAU;IAC5B,OAAO,mBAAmB,CAAC,QAAQ,CAAC,CAAqB,CAAC;QACxD,CAAC,CAAE,CAAsB;QACzB,CAAC,CAAC,cAAc,CAAC,GAAG,CAAC,gBAAgB,CAAC;AAC1C,CAAC;AAED;gFACgF;AAChF,MAAM,UAAU,cAAc,CAAC,KAAc;IAC3C,MAAM,GAAG,GAAG,CAAC,KAAK,IAAI,EAAE,CAAyC,CAAC;IAClE,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,IAAI,EAAE,CAAkD,CAAC;IAC/E,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,EAAE,CAA8C,CAAC;IACvE,MAAM,CAAC,GAAG,cAAc,CAAC;IACzB,OAAO;QACL,OAAO,EAAE;YACP,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,cAAc,CAAC;YAC1D,UAAU,EAAE,GAAG,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC,OAAO,CAAC,UAAU,EAAE,cAAc,CAAC;YACnE,QAAQ,EAAE,GAAG,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,EAAE,cAAc,CAAC;YAC7D,SAAS,EAAE,GAAG,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,SAAS,EAAE,cAAc,CAAC;YAChE,qBAAqB,EAAE,GAAG,CACxB,CAAC,CAAC,qBAAqB,EACvB,CAAC,CAAC,OAAO,CAAC,qBAAqB,EAC/B,cAAc,CACf;YACD,YAAY,EAAE,GAAG,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC,CAAC,OAAO,CAAC,YAAY,EAAE,cAAc,CAAC;SAC1E;QACD,GAAG,EAAE;YACH,qBAAqB,EAAE,IAAI,CACzB,CAAC,CAAC,qBAAqB,EACvB,CAAC,CAAC,GAAG,CAAC,qBAAqB,CAC5B;YACD,cAAc,EAAE,IAAI,CAAC,CAAC,CAAC,cAAc,EAAE,CAAC,CAAC,GAAG,CAAC,cAAc,CAAC;YAC5D,2BAA2B,EAAE,IAAI,CAC/B,CAAC,CAAC,2BAA2B,EAC7B,CAAC,CAAC,GAAG,CAAC,2BAA2B,CAClC;YACD,gBAAgB,EAAE,UAAU,CAAC,CAAC,CAAC,gBAAgB,CAAC;YAChD,YAAY,EAAE,GAAG,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC,CAAC,GAAG,CAAC,YAAY,EAAE,cAAc,CAAC;SACtE;KACF,CAAC;AACJ,CAAC;AAED,MAAM,OAAO,cAAc;IACjB,MAAM,GAAc,cAAc,CAAC,cAAc,CAAC,CAAC;IAC3D,wEAAwE;IAChE,UAAU,GAAkB,OAAO,CAAC,OAAO,EAAE,CAAC;IAEtD,KAAK,CAAC,IAAI;QACR,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;YAChD,IAAI,CAAC,MAAM,GAAG,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;YAC9C,OAAO,CAAC,GAAG,CAAC,8BAA8B,CAAC,CAAC;QAC9C,CAAC;QAAC,MAAM,CAAC;YACP,oCAAoC;QACtC,CAAC;IACH,CAAC;IAED;kDAC8C;IAC9C,GAAG;QACD,OAAO,IAAI,CAAC,MAAM,CAAC;IACrB,CAAC;IAED,8EAA8E;IAC9E,KAAK,CAAC,GAAG,CAAC,KAAc;QACtB,IAAI,CAAC,MAAM,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC;QACpC,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;QACrB,OAAO,IAAI,CAAC,MAAM,CAAC;IACrB,CAAC;IAEO,OAAO;QACb,4EAA4E;QAC5E,0EAA0E;QAC1E,yEAAyE;QACzE,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;QACtD,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,UAAU;aAC9B,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC;aACf,IAAI,CAAC,KAAK,IAAI,EAAE;YACf,MAAM,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YACvD,MAAM,GAAG,GAAG,GAAG,WAAW,IAAI,OAAO,CAAC,GAAG,MAAM,CAAC;YAChD,MAAM,SAAS,CAAC,GAAG,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;YACvC,MAAM,MAAM,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;QACjC,CAAC,CAAC,CAAC;QACL,OAAO,IAAI,CAAC,UAAU,CAAC;IACzB,CAAC;CACF"}

package/dist/src/credentials.d.ts

@@ -0,0 +1,38 @@
+/**
+ * CredentialsStore — provider API keys stored on the daemon.
+ *
+ * Holds the OpenRouter / Anthropic / OpenAI API keys the agent backends bill
+ * against, persisted to `~/.immediacy/credentials.json` (chmod 0600, like the
+ * NaCl keypair in crypto.ts — never world-readable). The macOS client manages
+ * them over the wire (`settings.set`); every client can read the presence
+ * indicator (`settings.get` → `settings.result`), which carries no raw key.
+ *
+ * Precedence when resolving a key for a session: the stored value wins, and the
+ * matching environment variable (ANTHROPIC_API_KEY / OPENAI_API_KEY /
+ * OPENROUTER_API_KEY) is the fallback — so a daemon launched with env-configured
+ * keys keeps working, and a key typed into the app overrides it.
+ *
+ * SSO fallback: Anthropic and OpenAI have no stored/env key → sessions use the
+ * CLI/SDK's own cached subscription login (Claude Code login / Codex ChatGPT
+ * login). OpenRouter has no login concept, so with no key it is simply unset.
+ */
+import type { CredentialInfo, CredentialProvider } from "./protocol.js";
+export declare class CredentialsStore {
+    private stored;
+    /** Serializes writes so two concurrent setKey() calls can't interleave. */
+    private writeChain;
+    load(): Promise<void>;
+    /**
+     * The effective API key for a provider: the stored value, else the env
+     * fallback. Empty string is treated as unset. Undefined means "no key — use
+     * the SSO/login path (or leave unset for OpenRouter)".
+     */
+    getKey(provider: CredentialProvider): string | undefined;
+    /** Set (non-empty) or clear (empty) a provider's stored key, then persist. */
+    setKey(provider: CredentialProvider, apiKey: string): Promise<void>;
+    /** Per-provider status for `settings.result` — never carries a raw key. */
+    status(): CredentialInfo[];
+    /** True when `p` is a known provider (guards `settings.set` input). */
+    static isProvider(p: unknown): p is CredentialProvider;
+    private persist;
+}

package/dist/src/credentials.js

@@ -0,0 +1,120 @@
+/**
+ * CredentialsStore — provider API keys stored on the daemon.
+ *
+ * Holds the OpenRouter / Anthropic / OpenAI API keys the agent backends bill
+ * against, persisted to `~/.immediacy/credentials.json` (chmod 0600, like the
+ * NaCl keypair in crypto.ts — never world-readable). The macOS client manages
+ * them over the wire (`settings.set`); every client can read the presence
+ * indicator (`settings.get` → `settings.result`), which carries no raw key.
+ *
+ * Precedence when resolving a key for a session: the stored value wins, and the
+ * matching environment variable (ANTHROPIC_API_KEY / OPENAI_API_KEY /
+ * OPENROUTER_API_KEY) is the fallback — so a daemon launched with env-configured
+ * keys keeps working, and a key typed into the app overrides it.
+ *
+ * SSO fallback: Anthropic and OpenAI have no stored/env key → sessions use the
+ * CLI/SDK's own cached subscription login (Claude Code login / Codex ChatGPT
+ * login). OpenRouter has no login concept, so with no key it is simply unset.
+ */
+import { mkdir, readFile, rename, writeFile } from "node:fs/promises";
+import { homedir } from "node:os";
+import { dirname, join } from "node:path";
+const CREDENTIALS_FILE = process.env.CREDENTIALS_FILE ??
+    join(homedir(), ".immediacy", "credentials.json");
+const PROVIDERS = ["anthropic", "openai", "openrouter"];
+/** The env var that seeds each provider when no key is stored. */
+const ENV_VAR = {
+    anthropic: "ANTHROPIC_API_KEY",
+    openai: "OPENAI_API_KEY",
+    openrouter: "OPENROUTER_API_KEY",
+};
+/** Providers that can fall back to a subscription/CLI login when no key is set. */
+const HAS_SSO_FALLBACK = {
+    anthropic: true,
+    openai: true,
+    openrouter: false,
+};
+/** Last 4 chars behind an ellipsis, e.g. "…6f2a"; a bare "…" for a short/absent
+ *  key so a key of 4 or fewer chars is never shown in full. */
+function mask(key) {
+    if (!key)
+        return null;
+    return key.length > 4 ? `…${key.slice(-4)}` : "…";
+}
+export class CredentialsStore {
+    stored = {};
+    /** Serializes writes so two concurrent setKey() calls can't interleave. */
+    writeChain = Promise.resolve();
+    async load() {
+        try {
+            const raw = await readFile(CREDENTIALS_FILE, "utf8");
+            const parsed = JSON.parse(raw);
+            for (const p of PROVIDERS) {
+                const v = parsed[p];
+                if (typeof v === "string" && v.trim())
+                    this.stored[p] = v;
+            }
+            console.log(`[credentials] restored ${Object.keys(this.stored).length} key(s)`);
+        }
+        catch {
+            /* no prior state */
+        }
+    }
+    /**
+     * The effective API key for a provider: the stored value, else the env
+     * fallback. Empty string is treated as unset. Undefined means "no key — use
+     * the SSO/login path (or leave unset for OpenRouter)".
+     */
+    getKey(provider) {
+        const stored = this.stored[provider]?.trim();
+        if (stored)
+            return stored;
+        const env = process.env[ENV_VAR[provider]]?.trim();
+        return env || undefined;
+    }
+    /** Set (non-empty) or clear (empty) a provider's stored key, then persist. */
+    async setKey(provider, apiKey) {
+        const trimmed = apiKey.trim();
+        if (trimmed)
+            this.stored[provider] = trimmed;
+        else
+            delete this.stored[provider];
+        await this.persist();
+    }
+    /** Per-provider status for `settings.result` — never carries a raw key. */
+    status() {
+        return PROVIDERS.map((provider) => {
+            const key = this.getKey(provider);
+            const hasKey = Boolean(key);
+            const source = hasKey
+                ? "apikey"
+                : HAS_SSO_FALLBACK[provider]
+                    ? "sso"
+                    : "none";
+            return { provider, source, hasKey, maskedKey: mask(key) };
+        });
+    }
+    /** True when `p` is a known provider (guards `settings.set` input). */
+    static isProvider(p) {
+        return typeof p === "string" && PROVIDERS.includes(p);
+    }
+    persist() {
+        // Snapshot synchronously so a later mutation can't race this write, then
+        // chain onto any in-flight write so concurrent setKey() calls serialize
+        // instead of interleaving (a torn write would silently drop every key on
+        // the next load()). Write to a temp file created 0600 — never world-readable,
+        // even for the instant before a chmod — then atomically rename into place
+        // (secret-bearing, mirrors crypto.ts keys.json).
+        const snapshot = JSON.stringify(this.stored, null, 2);
+        this.writeChain = this.writeChain
+            .catch(() => { })
+            .then(async () => {
+            await mkdir(dirname(CREDENTIALS_FILE), { recursive: true });
+            const tmp = `${CREDENTIALS_FILE}.${process.pid}.tmp`;
+            await writeFile(tmp, snapshot, { mode: 0o600 });
+            await rename(tmp, CREDENTIALS_FILE);
+        });
+        return this.writeChain;
+    }
+}
+//# sourceMappingURL=credentials.js.map

package/dist/src/credentials.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"credentials.js","sourceRoot":"","sources":["../../src/credentials.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AACtE,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAO1C,MAAM,gBAAgB,GACpB,OAAO,CAAC,GAAG,CAAC,gBAAgB;IAC5B,IAAI,CAAC,OAAO,EAAE,EAAE,YAAY,EAAE,kBAAkB,CAAC,CAAC;AAEpD,MAAM,SAAS,GAAyB,CAAC,WAAW,EAAE,QAAQ,EAAE,YAAY,CAAC,CAAC;AAE9E,kEAAkE;AAClE,MAAM,OAAO,GAAuC;IAClD,SAAS,EAAE,mBAAmB;IAC9B,MAAM,EAAE,gBAAgB;IACxB,UAAU,EAAE,oBAAoB;CACjC,CAAC;AAEF,mFAAmF;AACnF,MAAM,gBAAgB,GAAwC;IAC5D,SAAS,EAAE,IAAI;IACf,MAAM,EAAE,IAAI;IACZ,UAAU,EAAE,KAAK;CAClB,CAAC;AAIF;+DAC+D;AAC/D,SAAS,IAAI,CAAC,GAAuB;IACnC,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IACtB,OAAO,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC;AACpD,CAAC;AAED,MAAM,OAAO,gBAAgB;IACnB,MAAM,GAAW,EAAE,CAAC;IAC5B,2EAA2E;IACnE,UAAU,GAAkB,OAAO,CAAC,OAAO,EAAE,CAAC;IAEtD,KAAK,CAAC,IAAI;QACR,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC,CAAC;YACrD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAW,CAAC;YACzC,KAAK,MAAM,CAAC,IAAI,SAAS,EAAE,CAAC;gBAC1B,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;gBACpB,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,IAAI,EAAE;oBAAE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;YAC5D,CAAC;YACD,OAAO,CAAC,GAAG,CAAC,0BAA0B,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,SAAS,CAAC,CAAC;QAClF,CAAC;QAAC,MAAM,CAAC;YACP,oBAAoB;QACtB,CAAC;IACH,CAAC;IAED;;;;OAIG;IACH,MAAM,CAAC,QAA4B;QACjC,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,CAAC;QAC7C,IAAI,MAAM;YAAE,OAAO,MAAM,CAAC;QAC1B,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC;QACnD,OAAO,GAAG,IAAI,SAAS,CAAC;IAC1B,CAAC;IAED,8EAA8E;IAC9E,KAAK,CAAC,MAAM,CAAC,QAA4B,EAAE,MAAc;QACvD,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC;QAC9B,IAAI,OAAO;YAAE,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,OAAO,CAAC;;YACxC,OAAO,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAClC,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;IACvB,CAAC;IAED,2EAA2E;IAC3E,MAAM;QACJ,OAAO,SAAS,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE;YAChC,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YAClC,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;YAC5B,MAAM,MAAM,GAAqB,MAAM;gBACrC,CAAC,CAAC,QAAQ;gBACV,CAAC,CAAC,gBAAgB,CAAC,QAAQ,CAAC;oBAC1B,CAAC,CAAC,KAAK;oBACP,CAAC,CAAC,MAAM,CAAC;YACb,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QAC5D,CAAC,CAAC,CAAC;IACL,CAAC;IAED,uEAAuE;IACvE,MAAM,CAAC,UAAU,CAAC,CAAU;QAC1B,OAAO,OAAO,CAAC,KAAK,QAAQ,IAAK,SAAsB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;IACtE,CAAC;IAEO,OAAO;QACb,yEAAyE;QACzE,wEAAwE;QACxE,yEAAyE;QACzE,8EAA8E;QAC9E,0EAA0E;QAC1E,iDAAiD;QACjD,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;QACtD,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,UAAU;aAC9B,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC;aACf,IAAI,CAAC,KAAK,IAAI,EAAE;YACf,MAAM,KAAK,CAAC,OAAO,CAAC,gBAAgB,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YAC5D,MAAM,GAAG,GAAG,GAAG,gBAAgB,IAAI,OAAO,CAAC,GAAG,MAAM,CAAC;YACrD,MAAM,SAAS,CAAC,GAAG,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;YAChD,MAAM,MAAM,CAAC,GAAG,EAAE,gBAAgB,CAAC,CAAC;QACtC,CAAC,CAAC,CAAC;QACL,OAAO,IAAI,CAAC,UAAU,CAAC;IACzB,CAAC;CACF"}

package/dist/src/crypto.d.ts

@@ -0,0 +1,49 @@
+/**
+ * E2E crypto (slice 5) — keep the Cloudflare edge blind.
+ *
+ * Cloudflare terminates TLS and can see plaintext. We additionally seal the
+ * envelope `payload` with crypto_box (X25519 + XSalsa20-Poly1305 — NaCl box),
+ * wire-compatible with libsodium's `crypto_box_easy` on the Flutter side
+ * (sodium_libs). The outer fields (v, id, ts, ws, type) stay clear for routing.
+ *
+ * On the wire an encrypted payload is: { n: base64(nonce), c: base64(cipher) }.
+ *
+ * This is IN ADDITION to Cloudflare Access — Access does authn/authz at the
+ * edge; the box keeps payload contents private from the edge.
+ */
+import type { Envelope } from "./protocol.js";
+export interface Keypair {
+    publicKey: Buffer;
+    secretKey: Buffer;
+}
+/** Load the daemon keypair, generating + persisting one on first run. */
+export declare function loadOrCreateKeypair(): Promise<Keypair>;
+/** One paired client. `pub` is base64 of its X25519 public key. */
+export interface Peer {
+    pub: string;
+    addedAt: number;
+    label?: string;
+}
+/** True iff `b64` is canonical base64 of a full-length crypto_box public key. */
+export declare function isValidPublicKeyB64(b64: string): boolean;
+/**
+ * Every paired client. Reads `peers.json`, migrating a legacy single-peer
+ * `peer.json` (and honoring the PEER_PUBLIC_KEY dev override) on first read so
+ * an existing pairing keeps working after the multi-device upgrade.
+ */
+export declare function loadPeers(): Promise<Peer[]>;
+/**
+ * Add a client public key to the paired set (idempotent) and persist. Returns
+ * the updated list. Trust-on-first-use: the caller has already cleared the
+ * Cloudflare Access gate, which is the shared pairing secret.
+ */
+export declare function addPeer(pub: string, label?: string): Promise<Peer[]>;
+/** Codec abstraction so the server/hub don't care whether crypto is on. */
+export interface Codec {
+    encode(env: Envelope): string;
+    decode(raw: string): Envelope;
+}
+/** Cleartext codec (slices 1–4 default, and local dev). */
+export declare const clearCodec: Codec;
+/** NaCl-box codec: seals/opens only the `payload` field. */
+export declare function boxCodec(self: Keypair, peerPublicKey: Buffer): Codec;

package/dist/src/crypto.js

@@ -0,0 +1,202 @@
+/**
+ * E2E crypto (slice 5) — keep the Cloudflare edge blind.
+ *
+ * Cloudflare terminates TLS and can see plaintext. We additionally seal the
+ * envelope `payload` with crypto_box (X25519 + XSalsa20-Poly1305 — NaCl box),
+ * wire-compatible with libsodium's `crypto_box_easy` on the Flutter side
+ * (sodium_libs). The outer fields (v, id, ts, ws, type) stay clear for routing.
+ *
+ * On the wire an encrypted payload is: { n: base64(nonce), c: base64(cipher) }.
+ *
+ * This is IN ADDITION to Cloudflare Access — Access does authn/authz at the
+ * edge; the box keeps payload contents private from the edge.
+ */
+import sodium from "sodium-native";
+import { existsSync } from "node:fs";
+import { mkdir, readFile, writeFile, chmod } from "node:fs/promises";
+import { homedir } from "node:os";
+import { dirname, join } from "node:path";
+import { PROTOCOL_VERSION } from "./protocol.js";
+import { ProtocolError } from "./envelope.js";
+const KEYS_FILE = process.env.KEYS_FILE ?? join(homedir(), ".immediacy", "keys.json");
+const PEER_FILE = process.env.PEER_FILE ?? join(homedir(), ".immediacy", "peer.json");
+// Multi-device pairing: the set of every client public key we've paired with,
+// so encryption isn't pinned to one device (the old single PEER_FILE). Each
+// entry is bound to its own socket at connect time (per-socket sealing).
+const PEERS_FILE = process.env.PEERS_FILE ?? join(homedir(), ".immediacy", "peers.json");
+/** Load the daemon keypair, generating + persisting one on first run. */
+export async function loadOrCreateKeypair() {
+    if (existsSync(KEYS_FILE)) {
+        const j = JSON.parse(await readFile(KEYS_FILE, "utf8"));
+        return {
+            publicKey: Buffer.from(j.publicKey, "base64"),
+            secretKey: Buffer.from(j.secretKey, "base64"),
+        };
+    }
+    const publicKey = Buffer.alloc(sodium.crypto_box_PUBLICKEYBYTES);
+    const secretKey = Buffer.alloc(sodium.crypto_box_SECRETKEYBYTES);
+    sodium.crypto_box_keypair(publicKey, secretKey);
+    await mkdir(dirname(KEYS_FILE), { recursive: true });
+    await writeFile(KEYS_FILE, JSON.stringify({
+        publicKey: publicKey.toString("base64"),
+        secretKey: secretKey.toString("base64"),
+    }), "utf8");
+    await chmod(KEYS_FILE, 0o600); // secret key — never world-readable
+    return { publicKey, secretKey };
+}
+/** True iff `b64` is canonical base64 of a full-length crypto_box public key. */
+export function isValidPublicKeyB64(b64) {
+    // Node's Buffer.from(x, "base64") never throws and silently drops invalid
+    // characters, so a decoded-length check alone lets malformed input through.
+    // Require a strict base64 alphabet up front, then confirm the value
+    // round-trips to the exact same canonical string at the expected length.
+    if (typeof b64 !== "string" || !/^[A-Za-z0-9+/]+={0,2}$/.test(b64))
+        return false;
+    const buf = Buffer.from(b64, "base64");
+    return (buf.length === sodium.crypto_box_PUBLICKEYBYTES && buf.toString("base64") === b64);
+}
+/**
+ * Every paired client. Reads `peers.json`, migrating a legacy single-peer
+ * `peer.json` (and honoring the PEER_PUBLIC_KEY dev override) on first read so
+ * an existing pairing keeps working after the multi-device upgrade.
+ */
+export async function loadPeers() {
+    const peers = [];
+    const seen = new Set();
+    const push = (pub, label) => {
+        if (!pub || seen.has(pub) || !isValidPublicKeyB64(pub))
+            return;
+        seen.add(pub);
+        peers.push({ pub, addedAt: Date.now(), label });
+    };
+    if (existsSync(PEERS_FILE)) {
+        try {
+            const j = JSON.parse(await readFile(PEERS_FILE, "utf8"));
+            for (const p of j.peers ?? []) {
+                // Validate on the way in too: a corrupted or hand-edited peers.json must
+                // not seed invalid keys into the paired set (matches the push() helper).
+                if (p && typeof p.pub === "string" && !seen.has(p.pub) && isValidPublicKeyB64(p.pub)) {
+                    seen.add(p.pub);
+                    peers.push({ pub: p.pub, addedAt: p.addedAt ?? Date.now(), label: p.label });
+                }
+            }
+        }
+        catch {
+            /* corrupt file — fall through to migration/env seeds */
+        }
+    }
+    else if (existsSync(PEER_FILE)) {
+        // Migrate the legacy single-peer file.
+        try {
+            const j = JSON.parse(await readFile(PEER_FILE, "utf8"));
+            if (j.publicKey)
+                push(j.publicKey, "migrated");
+        }
+        catch {
+            /* ignore */
+        }
+    }
+    if (process.env.PEER_PUBLIC_KEY)
+        push(process.env.PEER_PUBLIC_KEY, "env");
+    return peers;
+}
+// Serializes the peers.json read-modify-write so two devices pairing at the
+// same time can't each read the old file and clobber the other's entry.
+let addChain = Promise.resolve([]);
+/**
+ * Add a client public key to the paired set (idempotent) and persist. Returns
+ * the updated list. Trust-on-first-use: the caller has already cleared the
+ * Cloudflare Access gate, which is the shared pairing secret.
+ */
+export function addPeer(pub, label) {
+    addChain = addChain.then(async () => {
+        const peers = await loadPeers();
+        if (!peers.some((p) => p.pub === pub)) {
+            peers.push({ pub, addedAt: Date.now(), label });
+            await mkdir(dirname(PEERS_FILE), { recursive: true });
+            await writeFile(PEERS_FILE, JSON.stringify({ peers }, null, 2), "utf8");
+            await chmod(PEERS_FILE, 0o600);
+        }
+        return peers;
+    });
+    return addChain;
+}
+/** Upper bound for one sealed payload — matches the largest legitimate frame
+ * (file contents are truncated daemon-side well below this). */
+const MAX_SEALED_BYTES = 16 * 1024 * 1024;
+/** Cleartext codec (slices 1–4 default, and local dev). */
+export const clearCodec = {
+    encode: (env) => JSON.stringify(env),
+    decode: (raw) => parseEnvelope(raw),
+};
+/** NaCl-box codec: seals/opens only the `payload` field. */
+export function boxCodec(self, peerPublicKey) {
+    return {
+        encode(env) {
+            const plaintext = Buffer.from(JSON.stringify(env.payload), "utf8");
+            const nonce = Buffer.alloc(sodium.crypto_box_NONCEBYTES);
+            sodium.randombytes_buf(nonce);
+            const cipher = Buffer.alloc(plaintext.length + sodium.crypto_box_MACBYTES);
+            sodium.crypto_box_easy(cipher, plaintext, nonce, peerPublicKey, self.secretKey);
+            const sealed = {
+                ...env,
+                payload: { n: nonce.toString("base64"), c: cipher.toString("base64") },
+            };
+            return JSON.stringify(sealed);
+        },
+        decode(raw) {
+            const env = parseEnvelope(raw, /*allowSealed*/ true);
+            const sealed = env.payload;
+            if (typeof sealed.n !== "string" || typeof sealed.c !== "string") {
+                throw new ProtocolError("not_sealed", "payload is not a sealed box");
+            }
+            const nonce = Buffer.from(sealed.n, "base64");
+            const cipher = Buffer.from(sealed.c, "base64");
+            // Validate sizes before allocating: a short ciphertext would make the
+            // alloc below negative (RangeError), and an oversized frame would
+            // allocate unbounded memory — both should fail as protocol errors.
+            if (nonce.length !== sodium.crypto_box_NONCEBYTES) {
+                throw new ProtocolError("bad_sealed_box", "nonce has the wrong length");
+            }
+            if (cipher.length < sodium.crypto_box_MACBYTES || cipher.length > MAX_SEALED_BYTES) {
+                throw new ProtocolError("bad_sealed_box", "ciphertext length out of range");
+            }
+            const plaintext = Buffer.alloc(cipher.length - sodium.crypto_box_MACBYTES);
+            const ok = sodium.crypto_box_open_easy(plaintext, cipher, nonce, peerPublicKey, self.secretKey);
+            if (!ok)
+                throw new ProtocolError("decrypt_failed", "box authentication failed");
+            env.payload = JSON.parse(plaintext.toString("utf8"));
+            return env;
+        },
+    };
+}
+/** Shared envelope structural check (payload shape relaxed when sealed). */
+function parseEnvelope(raw, allowSealed = false) {
+    let parsed;
+    try {
+        parsed = JSON.parse(raw);
+    }
+    catch {
+        throw new ProtocolError("bad_json", "frame was not valid JSON");
+    }
+    if (typeof parsed !== "object" || parsed === null) {
+        throw new ProtocolError("bad_envelope", "frame was not an object");
+    }
+    const e = parsed;
+    if (e.v !== PROTOCOL_VERSION) {
+        throw new ProtocolError("bad_version", `unsupported version ${String(e.v)}`);
+    }
+    if (typeof e.id !== "string")
+        throw new ProtocolError("bad_envelope", "missing id");
+    if (typeof e.type !== "string")
+        throw new ProtocolError("bad_envelope", "missing type");
+    if (!("ws" in e) || (e.ws !== null && typeof e.ws !== "string")) {
+        throw new ProtocolError("bad_envelope", "ws must be string or null");
+    }
+    if (typeof e.payload !== "object" || e.payload === null) {
+        throw new ProtocolError("bad_envelope", "payload must be an object");
+    }
+    void allowSealed;
+    return parsed;
+}
+//# sourceMappingURL=crypto.js.map

package/dist/src/crypto.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"crypto.js","sourceRoot":"","sources":["../../src/crypto.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,MAAM,MAAM,eAAe,CAAC;AACnC,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AACrE,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAE1C,OAAO,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AACjD,OAAO,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAE9C,MAAM,SAAS,GACb,OAAO,CAAC,GAAG,CAAC,SAAS,IAAI,IAAI,CAAC,OAAO,EAAE,EAAE,YAAY,EAAE,WAAW,CAAC,CAAC;AACtE,MAAM,SAAS,GACb,OAAO,CAAC,GAAG,CAAC,SAAS,IAAI,IAAI,CAAC,OAAO,EAAE,EAAE,YAAY,EAAE,WAAW,CAAC,CAAC;AACtE,8EAA8E;AAC9E,4EAA4E;AAC5E,yEAAyE;AACzE,MAAM,UAAU,GACd,OAAO,CAAC,GAAG,CAAC,UAAU,IAAI,IAAI,CAAC,OAAO,EAAE,EAAE,YAAY,EAAE,YAAY,CAAC,CAAC;AAOxE,yEAAyE;AACzE,MAAM,CAAC,KAAK,UAAU,mBAAmB;IACvC,IAAI,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QAC1B,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC,CAGrD,CAAC;QACF,OAAO;YACL,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,EAAE,QAAQ,CAAC;YAC7C,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,EAAE,QAAQ,CAAC;SAC9C,CAAC;IACJ,CAAC;IACD,MAAM,SAAS,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,yBAAyB,CAAC,CAAC;IACjE,MAAM,SAAS,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,yBAAyB,CAAC,CAAC;IACjE,MAAM,CAAC,kBAAkB,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;IAChD,MAAM,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACrD,MAAM,SAAS,CACb,SAAS,EACT,IAAI,CAAC,SAAS,CAAC;QACb,SAAS,EAAE,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC;QACvC,SAAS,EAAE,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC;KACxC,CAAC,EACF,MAAM,CACP,CAAC;IACF,MAAM,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC,CAAC,oCAAoC;IACnE,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC;AAClC,CAAC;AASD,iFAAiF;AACjF,MAAM,UAAU,mBAAmB,CAAC,GAAW;IAC7C,0EAA0E;IAC1E,4EAA4E;IAC5E,oEAAoE;IACpE,yEAAyE;IACzE,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAC,wBAAwB,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IACjF,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IACvC,OAAO,CACL,GAAG,CAAC,MAAM,KAAK,MAAM,CAAC,yBAAyB,IAAI,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,GAAG,CAClF,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS;IAC7B,MAAM,KAAK,GAAW,EAAE,CAAC;IACzB,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,MAAM,IAAI,GAAG,CAAC,GAAW,EAAE,KAAc,EAAE,EAAE;QAC3C,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,mBAAmB,CAAC,GAAG,CAAC;YAAE,OAAO;QAC/D,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACd,KAAK,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;IAClD,CAAC,CAAC;IAEF,IAAI,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QAC3B,IAAI,CAAC;YACH,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC,CAAuB,CAAC;YAC/E,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,IAAI,EAAE,EAAE,CAAC;gBAC9B,yEAAyE;gBACzE,yEAAyE;gBACzE,IAAI,CAAC,IAAI,OAAO,CAAC,CAAC,GAAG,KAAK,QAAQ,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,mBAAmB,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;oBACrF,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;oBAChB,KAAK,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,IAAI,IAAI,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;gBAC/E,CAAC;YACH,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,wDAAwD;QAC1D,CAAC;IACH,CAAC;SAAM,IAAI,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QACjC,uCAAuC;QACvC,IAAI,CAAC;YACH,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC,CAA2B,CAAC;YAClF,IAAI,CAAC,CAAC,SAAS;gBAAE,IAAI,CAAC,CAAC,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC;QACjD,CAAC;QAAC,MAAM,CAAC;YACP,YAAY;QACd,CAAC;IACH,CAAC;IACD,IAAI,OAAO,CAAC,GAAG,CAAC,eAAe;QAAE,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,KAAK,CAAC,CAAC;IAC1E,OAAO,KAAK,CAAC;AACf,CAAC;AAED,4EAA4E;AAC5E,wEAAwE;AACxE,IAAI,QAAQ,GAAoB,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;AAEpD;;;;GAIG;AACH,MAAM,UAAU,OAAO,CAAC,GAAW,EAAE,KAAc;IACjD,QAAQ,GAAG,QAAQ,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE;QAClC,MAAM,KAAK,GAAG,MAAM,SAAS,EAAE,CAAC;QAChC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,GAAG,CAAC,EAAE,CAAC;YACtC,KAAK,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;YAChD,MAAM,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YACtD,MAAM,SAAS,CAAC,UAAU,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;YACxE,MAAM,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;QACjC,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC,CAAC,CAAC;IACH,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;gEACgE;AAChE,MAAM,gBAAgB,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;AAQ1C,2DAA2D;AAC3D,MAAM,CAAC,MAAM,UAAU,GAAU;IAC/B,MAAM,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC;IACpC,MAAM,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,aAAa,CAAC,GAAG,CAAC;CACpC,CAAC;AAEF,4DAA4D;AAC5D,MAAM,UAAU,QAAQ,CAAC,IAAa,EAAE,aAAqB;IAC3D,OAAO;QACL,MAAM,CAAC,GAAa;YAClB,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,CAAC;YACnE,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,qBAAqB,CAAC,CAAC;YACzD,MAAM,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;YAC9B,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,GAAG,MAAM,CAAC,mBAAmB,CAAC,CAAC;YAC3E,MAAM,CAAC,eAAe,CAAC,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,aAAa,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;YAChF,MAAM,MAAM,GAAG;gBACb,GAAG,GAAG;gBACN,OAAO,EAAE,EAAE,CAAC,EAAE,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC,EAAE,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE;aACvE,CAAC;YACF,OAAO,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QAChC,CAAC;QACD,MAAM,CAAC,GAAW;YAChB,MAAM,GAAG,GAAG,aAAa,CAAC,GAAG,EAAE,eAAe,CAAC,IAAI,CAAC,CAAC;YACrD,MAAM,MAAM,GAAG,GAAG,CAAC,OAAgD,CAAC;YACpE,IAAI,OAAO,MAAM,CAAC,CAAC,KAAK,QAAQ,IAAI,OAAO,MAAM,CAAC,CAAC,KAAK,QAAQ,EAAE,CAAC;gBACjE,MAAM,IAAI,aAAa,CAAC,YAAY,EAAE,6BAA6B,CAAC,CAAC;YACvE,CAAC;YACD,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;YAC9C,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;YAC/C,sEAAsE;YACtE,kEAAkE;YAClE,mEAAmE;YACnE,IAAI,KAAK,CAAC,MAAM,KAAK,MAAM,CAAC,qBAAqB,EAAE,CAAC;gBAClD,MAAM,IAAI,aAAa,CAAC,gBAAgB,EAAE,4BAA4B,CAAC,CAAC;YAC1E,CAAC;YACD,IAAI,MAAM,CAAC,MAAM,GAAG,MAAM,CAAC,mBAAmB,IAAI,MAAM,CAAC,MAAM,GAAG,gBAAgB,EAAE,CAAC;gBACnF,MAAM,IAAI,aAAa,CAAC,gBAAgB,EAAE,gCAAgC,CAAC,CAAC;YAC9E,CAAC;YACD,MAAM,SAAS,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,GAAG,MAAM,CAAC,mBAAmB,CAAC,CAAC;YAC3E,MAAM,EAAE,GAAG,MAAM,CAAC,oBAAoB,CACpC,SAAS,EACT,MAAM,EACN,KAAK,EACL,aAAa,EACb,IAAI,CAAC,SAAS,CACf,CAAC;YACF,IAAI,CAAC,EAAE;gBAAE,MAAM,IAAI,aAAa,CAAC,gBAAgB,EAAE,2BAA2B,CAAC,CAAC;YAChF,GAAG,CAAC,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;YACrD,OAAO,GAAG,CAAC;QACb,CAAC;KACF,CAAC;AACJ,CAAC;AAED,4EAA4E;AAC5E,SAAS,aAAa,CAAC,GAAW,EAAE,WAAW,GAAG,KAAK;IACrD,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,aAAa,CAAC,UAAU,EAAE,0BAA0B,CAAC,CAAC;IAClE,CAAC;IACD,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;QAClD,MAAM,IAAI,aAAa,CAAC,cAAc,EAAE,yBAAyB,CAAC,CAAC;IACrE,CAAC;IACD,MAAM,CAAC,GAAG,MAAiC,CAAC;IAC5C,IAAI,CAAC,CAAC,CAAC,KAAK,gBAAgB,EAAE,CAAC;QAC7B,MAAM,IAAI,aAAa,CAAC,aAAa,EAAE,uBAAuB,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAC/E,CAAC;IACD,IAAI,OAAO,CAAC,CAAC,EAAE,KAAK,QAAQ;QAAE,MAAM,IAAI,aAAa,CAAC,cAAc,EAAE,YAAY,CAAC,CAAC;IACpF,IAAI,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ;QAAE,MAAM,IAAI,aAAa,CAAC,cAAc,EAAE,cAAc,CAAC,CAAC;IACxF,IAAI,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,KAAK,IAAI,IAAI,OAAO,CAAC,CAAC,EAAE,KAAK,QAAQ,CAAC,EAAE,CAAC;QAChE,MAAM,IAAI,aAAa,CAAC,cAAc,EAAE,2BAA2B,CAAC,CAAC;IACvE,CAAC;IACD,IAAI,OAAO,CAAC,CAAC,OAAO,KAAK,QAAQ,IAAI,CAAC,CAAC,OAAO,KAAK,IAAI,EAAE,CAAC;QACxD,MAAM,IAAI,aAAa,CAAC,cAAc,EAAE,2BAA2B,CAAC,CAAC;IACvE,CAAC;IACD,KAAK,WAAW,CAAC;IACjB,OAAO,MAAkB,CAAC;AAC5B,CAAC"}

package/dist/src/daemon-identity.d.ts

@@ -0,0 +1,31 @@
+/**
+ * DaemonIdentity — this daemon's stable id + human name.
+ *
+ * A client can talk to several daemons at once (it dials each tunnel/host
+ * independently — daemons never talk to each other), and labels each by name.
+ * This store gives the daemon a stable `daemonId` (minted once, persisted) and a
+ * human `name` that defaults to the machine hostname and can be changed over the
+ * wire (`daemon.rename`). Persisted to `~/.immediacy/daemon.json`.
+ *
+ * No secret material, so the file is world-readable (0644) like config.json —
+ * but it keeps the same serialized atomic-rename persist() so a concurrent
+ * rename can't tear the file.
+ */
+import { type DaemonInfoPayload } from "./protocol.js";
+export declare class DaemonIdentity {
+    private daemonId;
+    private name;
+    private readonly version;
+    /** Serializes writes so two concurrent rename() calls can't interleave. */
+    private writeChain;
+    /**
+     * Load the persisted identity, minting a fresh id (and a hostname-derived
+     * default name) on first run and writing it back so it stays stable.
+     */
+    load(): Promise<void>;
+    /** Set the human name (trimmed, non-empty, length-capped) and persist. */
+    rename(name: string): Promise<void>;
+    /** The wire payload for `daemon.info` (pushed on connect / rename / get). */
+    info(): DaemonInfoPayload;
+    private persist;
+}