@gtc6244/immediacy-daemon 0.2.2 → 0.2.3

package/dist/src/relay-transport.js

@@ -0,0 +1,180 @@
+/**
+ * Relay transport (daemon side) — docs/WEBRTC_MIGRATION.md Phase 4.
+ *
+ * The daemon keeps ONE persistent WebSocket to its Durable Object (`/daemon/
+ * <rid>`) whenever it's running. The DO multiplexes every client over that single
+ * socket, tagged by client id. `RelayDaemon` demuxes: each client id gets its own
+ * `Transport` (a `SubTransport` over the shared ws), which feeds a `Mux` + the
+ * §5.3 responder handshake — exactly the same session stack the loopback and LAN
+ * paths use. The relay only ever sees sealed frames.
+ */
+import { WebSocket } from "ws";
+import { Mux } from "./transport.js";
+import { RelayType, encodeDaemon, decodeDaemon } from "./relay-wire.js";
+import { respondHandshakeOverMux } from "./lan.js";
+/** A per-client Transport over the daemon's shared relay WebSocket. */
+class SubTransport {
+    clientId;
+    ws;
+    frameCb = null;
+    closeCb = null;
+    closed = false;
+    constructor(clientId, ws) {
+        this.clientId = clientId;
+        this.ws = ws;
+    }
+    send(bytes) {
+        if (this.closed || this.ws.readyState !== WebSocket.OPEN)
+            return;
+        this.ws.send(encodeDaemon(RelayType.DATA, this.clientId, bytes));
+    }
+    /** Called by RelayDaemon when a DATA frame for this client arrives. */
+    deliver(frame) {
+        this.frameCb?.(frame);
+    }
+    bufferedAmount() {
+        return this.ws.bufferedAmount;
+    }
+    onFrame(cb) {
+        this.frameCb = cb;
+    }
+    onClose(cb) {
+        this.closeCb = cb;
+    }
+    whenWritable(highWaterMark) {
+        // `ws` has no drain event; poll the buffered amount briefly. Client-bound
+        // volume is dominated by the daemon→client terminal stream, throttled above.
+        if (this.closed || this.ws.bufferedAmount < highWaterMark)
+            return Promise.resolve();
+        return new Promise((resolve) => {
+            const t = setInterval(() => {
+                if (this.closed || this.ws.bufferedAmount < highWaterMark) {
+                    clearInterval(t);
+                    resolve();
+                }
+            }, 10);
+        });
+    }
+    close() {
+        if (this.closed)
+            return;
+        this.closed = true;
+        this.closeCb?.();
+    }
+}
+/**
+ * Maintains the daemon's persistent relay socket and per-client sessions. Call
+ * `connect()` to dial; it reconnects with backoff on drop so the daemon is
+ * reachable over the relay whenever it's running (the Phase-4 acceptance:
+ * "daemon restart auto-reconnects with no user action").
+ */
+export class RelayDaemon {
+    deps;
+    relayUrl;
+    opts;
+    ws = null;
+    subs = new Map();
+    closed = false;
+    attempt = 0;
+    reconnectTimer = null;
+    /** Called for each client that completes the handshake over the relay. */
+    onSession;
+    constructor(deps, relayUrl, opts) {
+        this.deps = deps;
+        this.relayUrl = relayUrl;
+        this.opts = opts;
+    }
+    /** The daemon endpoint for this daemon's rendezvous id. */
+    url() {
+        const rid = this.deps.identity.rendezvousId();
+        const base = `${this.relayUrl.replace(/\/$/, "")}/daemon/${rid}`;
+        return this.opts?.license ? `${base}?license=${encodeURIComponent(this.opts.license)}` : base;
+    }
+    connect() {
+        if (this.closed)
+            return;
+        const ws = new WebSocket(this.url());
+        this.ws = ws;
+        ws.binaryType = "nodebuffer";
+        ws.on("open", () => {
+            this.attempt = 0;
+        });
+        ws.on("message", (data) => this.onMessage(Buffer.isBuffer(data) ? data : Buffer.from(data)));
+        ws.on("close", () => this.onClose());
+        ws.on("error", () => {
+            /* surfaced via close */
+        });
+    }
+    onMessage(bytes) {
+        let env;
+        try {
+            env = decodeDaemon(bytes);
+        }
+        catch {
+            return;
+        }
+        if (env.type === RelayType.CLIENT_OPEN) {
+            this.openClient(env.clientId);
+        }
+        else if (env.type === RelayType.CLIENT_CLOSE) {
+            this.subs.get(env.clientId)?.close();
+            this.subs.delete(env.clientId);
+        }
+        else if (env.type === RelayType.DATA) {
+            this.subs.get(env.clientId)?.deliver(env.payload);
+        }
+    }
+    openClient(clientId) {
+        if (!this.ws)
+            return;
+        const sub = new SubTransport(clientId, this.ws);
+        this.subs.set(clientId, sub);
+        const mux = new Mux(sub);
+        const pairing = this.deps.pairing;
+        respondHandshakeOverMux(mux, {
+            daemonSignSecret: this.deps.identity.signSecretKey(),
+            rendezvousId: this.deps.identity.rendezvousId(),
+            isPaired: (dev) => this.deps.devices.has(dev),
+            redeemCode: pairing ? (_dev, code) => pairing.consume(code) : undefined,
+        })
+            .then(async ({ channel, devicePub, paired, label }) => {
+            if (paired)
+                await this.deps.devices.add(devicePub, label ?? "device");
+            void this.deps.devices.touch(devicePub).catch(() => { });
+            this.onSession?.({
+                clientId,
+                mux,
+                channel,
+                devicePub,
+                close: () => sub.close(),
+                onClose: (cb) => sub.onClose(cb),
+            });
+        })
+            .catch(() => {
+            sub.close();
+            this.subs.delete(clientId);
+        });
+    }
+    onClose() {
+        for (const sub of this.subs.values())
+            sub.close();
+        this.subs.clear();
+        this.ws = null;
+        if (this.closed)
+            return;
+        // Reconnect with capped backoff so the daemon re-registers automatically.
+        const delay = Math.min(30_000, 1000 * 2 ** this.attempt++);
+        this.reconnectTimer = setTimeout(() => this.connect(), delay);
+    }
+    close() {
+        this.closed = true;
+        if (this.reconnectTimer)
+            clearTimeout(this.reconnectTimer);
+        for (const sub of this.subs.values())
+            sub.close();
+        this.subs.clear();
+        this.ws?.close();
+        this.ws = null;
+    }
+}
+//# sourceMappingURL=relay-transport.js.map

package/dist/src/relay-transport.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"relay-transport.js","sourceRoot":"","sources":["../../src/relay-transport.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,IAAI,CAAC;AAE/B,OAAO,EAAE,GAAG,EAAE,MAAM,gBAAgB,CAAC;AACrC,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AACxE,OAAO,EAAE,uBAAuB,EAAE,MAAM,UAAU,CAAC;AAKnD,uEAAuE;AACvE,MAAM,YAAY;IAMG;IACA;IANX,OAAO,GAAqC,IAAI,CAAC;IACjD,OAAO,GAAwB,IAAI,CAAC;IAC5C,MAAM,GAAG,KAAK,CAAC;IAEf,YACmB,QAAgB,EAChB,EAAa;QADb,aAAQ,GAAR,QAAQ,CAAQ;QAChB,OAAE,GAAF,EAAE,CAAW;IAC7B,CAAC;IAEJ,IAAI,CAAC,KAAa;QAChB,IAAI,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,EAAE,CAAC,UAAU,KAAK,SAAS,CAAC,IAAI;YAAE,OAAO;QACjE,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,YAAY,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC;IACnE,CAAC;IACD,uEAAuE;IACvE,OAAO,CAAC,KAAa;QACnB,IAAI,CAAC,OAAO,EAAE,CAAC,KAAK,CAAC,CAAC;IACxB,CAAC;IACD,cAAc;QACZ,OAAO,IAAI,CAAC,EAAE,CAAC,cAAc,CAAC;IAChC,CAAC;IACD,OAAO,CAAC,EAA2B;QACjC,IAAI,CAAC,OAAO,GAAG,EAAE,CAAC;IACpB,CAAC;IACD,OAAO,CAAC,EAAc;QACpB,IAAI,CAAC,OAAO,GAAG,EAAE,CAAC;IACpB,CAAC;IACD,YAAY,CAAC,aAAqB;QAChC,0EAA0E;QAC1E,6EAA6E;QAC7E,IAAI,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,EAAE,CAAC,cAAc,GAAG,aAAa;YAAE,OAAO,OAAO,CAAC,OAAO,EAAE,CAAC;QACpF,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;YAC7B,MAAM,CAAC,GAAG,WAAW,CAAC,GAAG,EAAE;gBACzB,IAAI,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,EAAE,CAAC,cAAc,GAAG,aAAa,EAAE,CAAC;oBAC1D,aAAa,CAAC,CAAC,CAAC,CAAC;oBACjB,OAAO,EAAE,CAAC;gBACZ,CAAC;YACH,CAAC,EAAE,EAAE,CAAC,CAAC;QACT,CAAC,CAAC,CAAC;IACL,CAAC;IACD,KAAK;QACH,IAAI,IAAI,CAAC,MAAM;YAAE,OAAO;QACxB,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;QACnB,IAAI,CAAC,OAAO,EAAE,EAAE,CAAC;IACnB,CAAC;CACF;AAsBD;;;;;GAKG;AACH,MAAM,OAAO,WAAW;IAWH;IACA;IACA;IAZX,EAAE,GAAqB,IAAI,CAAC;IACnB,IAAI,GAAG,IAAI,GAAG,EAAwB,CAAC;IAChD,MAAM,GAAG,KAAK,CAAC;IACf,OAAO,GAAG,CAAC,CAAC;IACZ,cAAc,GAAyC,IAAI,CAAC;IAEpE,0EAA0E;IAC1E,SAAS,CAAmC;IAE5C,YACmB,IAAqB,EACrB,QAAgB,EAChB,IAA2B;QAF3B,SAAI,GAAJ,IAAI,CAAiB;QACrB,aAAQ,GAAR,QAAQ,CAAQ;QAChB,SAAI,GAAJ,IAAI,CAAuB;IAC3C,CAAC;IAEJ,2DAA2D;IACnD,GAAG;QACT,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,YAAY,EAAE,CAAC;QAC9C,MAAM,IAAI,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,WAAW,GAAG,EAAE,CAAC;QACjE,OAAO,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,GAAG,IAAI,YAAY,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IAChG,CAAC;IAED,OAAO;QACL,IAAI,IAAI,CAAC,MAAM;YAAE,OAAO;QACxB,MAAM,EAAE,GAAG,IAAI,SAAS,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;QACrC,IAAI,CAAC,EAAE,GAAG,EAAE,CAAC;QACb,EAAE,CAAC,UAAU,GAAG,YAAY,CAAC;QAC7B,EAAE,CAAC,EAAE,CAAC,MAAM,EAAE,GAAG,EAAE;YACjB,IAAI,CAAC,OAAO,GAAG,CAAC,CAAC;QACnB,CAAC,CAAC,CAAC;QACH,EAAE,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC,IAAY,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAmB,CAAC,CAAC,CAAC,CAAC;QACpH,EAAE,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC;QACrC,EAAE,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;YAClB,wBAAwB;QAC1B,CAAC,CAAC,CAAC;IACL,CAAC;IAEO,SAAS,CAAC,KAAa;QAC7B,IAAI,GAAwD,CAAC;QAC7D,IAAI,CAAC;YACH,GAAG,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC;QAC5B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO;QACT,CAAC;QACD,IAAI,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,WAAW,EAAE,CAAC;YACvC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAChC,CAAC;aAAM,IAAI,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,YAAY,EAAE,CAAC;YAC/C,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,CAAC;YACrC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACjC,CAAC;aAAM,IAAI,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,IAAI,EAAE,CAAC;YACvC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACpD,CAAC;IACH,CAAC;IAEO,UAAU,CAAC,QAAgB;QACjC,IAAI,CAAC,IAAI,CAAC,EAAE;YAAE,OAAO;QACrB,MAAM,GAAG,GAAG,IAAI,YAAY,CAAC,QAAQ,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;QAChD,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;QAC7B,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;QACzB,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC;QAClC,uBAAuB,CAAC,GAAG,EAAE;YAC3B,gBAAgB,EAAE,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,aAAa,EAAE;YACpD,YAAY,EAAE,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,YAAY,EAAE;YAC/C,QAAQ,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC;YAC7C,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS;SACxE,CAAC;aACC,IAAI,CAAC,KAAK,EAAE,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE,EAAE;YACpD,IAAI,MAAM;gBAAE,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,EAAE,KAAK,IAAI,QAAQ,CAAC,CAAC;YACtE,KAAK,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;YACxD,IAAI,CAAC,SAAS,EAAE,CAAC;gBACf,QAAQ;gBACR,GAAG;gBACH,OAAO;gBACP,SAAS;gBACT,KAAK,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,KAAK,EAAE;gBACxB,OAAO,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;aACjC,CAAC,CAAC;QACL,CAAC,CAAC;aACD,KAAK,CAAC,GAAG,EAAE;YACV,GAAG,CAAC,KAAK,EAAE,CAAC;YACZ,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAC7B,CAAC,CAAC,CAAC;IACP,CAAC;IAEO,OAAO;QACb,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE;YAAE,GAAG,CAAC,KAAK,EAAE,CAAC;QAClD,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;QAClB,IAAI,CAAC,EAAE,GAAG,IAAI,CAAC;QACf,IAAI,IAAI,CAAC,MAAM;YAAE,OAAO;QACxB,0EAA0E;QAC1E,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,GAAG,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC;QAC3D,IAAI,CAAC,cAAc,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,KAAK,CAAC,CAAC;IAChE,CAAC;IAED,KAAK;QACH,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;QACnB,IAAI,IAAI,CAAC,cAAc;YAAE,YAAY,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QAC3D,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE;YAAE,GAAG,CAAC,KAAK,EAAE,CAAC;QAClD,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;QAClB,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,CAAC;QACjB,IAAI,CAAC,EAAE,GAAG,IAAI,CAAC;IACjB,CAAC;CACF"}

package/dist/src/relay-wire.d.ts

@@ -0,0 +1,25 @@
+/**
+ * Relay envelope codec (daemon copy) — mirrors `relay/src/wire.ts`.
+ *
+ * The daemon holds ONE WebSocket to its Durable Object and multiplexes every
+ * client over it, tagged by the DO-assigned client id:
+ *
+ *   daemon ↔ DO:  [u8 type][u32 clientId (BE)][payload]
+ *     DATA (0)          payload = one frame for/from that client
+ *     CLIENT_OPEN (1)   DO→daemon: a client connected (start a session)
+ *     CLIENT_CLOSE (2)  DO→daemon: a client disconnected (tear it down)
+ *
+ * Duplicated here (not imported) because daemon/ and relay/ are separate
+ * packages; kept in sync by a shared shape + the relay's own wire tests.
+ */
+export declare const RelayType: {
+    readonly DATA: 0;
+    readonly CLIENT_OPEN: 1;
+    readonly CLIENT_CLOSE: 2;
+};
+export declare function encodeDaemon(type: number, clientId: number, payload?: Buffer): Buffer;
+export declare function decodeDaemon(bytes: Buffer): {
+    type: number;
+    clientId: number;
+    payload: Buffer;
+};

package/dist/src/relay-wire.js

@@ -0,0 +1,37 @@
+/**
+ * Relay envelope codec (daemon copy) — mirrors `relay/src/wire.ts`.
+ *
+ * The daemon holds ONE WebSocket to its Durable Object and multiplexes every
+ * client over it, tagged by the DO-assigned client id:
+ *
+ *   daemon ↔ DO:  [u8 type][u32 clientId (BE)][payload]
+ *     DATA (0)          payload = one frame for/from that client
+ *     CLIENT_OPEN (1)   DO→daemon: a client connected (start a session)
+ *     CLIENT_CLOSE (2)  DO→daemon: a client disconnected (tear it down)
+ *
+ * Duplicated here (not imported) because daemon/ and relay/ are separate
+ * packages; kept in sync by a shared shape + the relay's own wire tests.
+ */
+export const RelayType = {
+    DATA: 0,
+    CLIENT_OPEN: 1,
+    CLIENT_CLOSE: 2,
+};
+export function encodeDaemon(type, clientId, payload) {
+    const out = Buffer.allocUnsafe(5 + (payload?.length ?? 0));
+    out.writeUInt8(type & 0xff, 0);
+    out.writeUInt32BE(clientId >>> 0, 1);
+    if (payload)
+        payload.copy(out, 5);
+    return out;
+}
+export function decodeDaemon(bytes) {
+    if (bytes.length < 5)
+        throw new RangeError("short daemon envelope");
+    return {
+        type: bytes.readUInt8(0),
+        clientId: bytes.readUInt32BE(1),
+        payload: bytes.subarray(5),
+    };
+}
+//# sourceMappingURL=relay-wire.js.map

package/dist/src/relay-wire.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"relay-wire.js","sourceRoot":"","sources":["../../src/relay-wire.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,MAAM,CAAC,MAAM,SAAS,GAAG;IACvB,IAAI,EAAE,CAAC;IACP,WAAW,EAAE,CAAC;IACd,YAAY,EAAE,CAAC;CACP,CAAC;AAEX,MAAM,UAAU,YAAY,CAAC,IAAY,EAAE,QAAgB,EAAE,OAAgB;IAC3E,MAAM,GAAG,GAAG,MAAM,CAAC,WAAW,CAAC,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,IAAI,CAAC,CAAC,CAAC,CAAC;IAC3D,GAAG,CAAC,UAAU,CAAC,IAAI,GAAG,IAAI,EAAE,CAAC,CAAC,CAAC;IAC/B,GAAG,CAAC,aAAa,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC;IACrC,IAAI,OAAO;QAAE,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;IAClC,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,KAAa;IACxC,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;QAAE,MAAM,IAAI,UAAU,CAAC,uBAAuB,CAAC,CAAC;IACpE,OAAO;QACL,IAAI,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC;QACxB,QAAQ,EAAE,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC;QAC/B,OAAO,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC;KAC3B,CAAC;AACJ,CAAC"}

package/dist/src/rendezvous.d.ts

@@ -0,0 +1,57 @@
+/**
+ * RendezvousIdentity — the daemon's Ed25519 *signing* identity (§3.1).
+ *
+ * This is the load-bearing trust root that replaces Cloudflare Access. It is
+ * SEPARATE from:
+ *   - `keys.json`   (X25519 crypto_box, `crypto.ts`) — legacy E2E envelope box,
+ *                    to be retired in Phase 5.
+ *   - `daemon.json` (`daemon-identity.ts`)           — display id + human name.
+ *
+ * Persisted at `~/.immediacy/identity.key` (mode 0600) as the base64 of the
+ * 32-byte Ed25519 seed — the single source of truth. The keypair and the
+ * rendezvous id are re-derived from the seed on every load, never stored.
+ *
+ * Rendezvous id = base32( HMAC-SHA256(seed, "immediacy-rendezvous-v1")[:16] )
+ * — 128 bits, used as the Durable Object name and the mDNS instance id.
+ *
+ * No backup (decision #1): there is no export/import path. Wiping `~/.immediacy`
+ * mints a fresh seed ⇒ a new rendezvous id ⇒ every client must re-pair.
+ */
+/** base32-encode `buf` (RFC 4648, lowercase, unpadded). */
+export declare function base32Encode(buf: Buffer): string;
+/** True iff `b64` is canonical base64 of a full-length Ed25519 public key. */
+export declare function isValidSignPublicKeyB64(b64: string): boolean;
+/** Sign `message` with a 64-byte Ed25519 secret key. Returns the 64-byte sig. */
+export declare function signDetached(message: Buffer, secretKey: Buffer): Buffer;
+/**
+ * Verify a detached Ed25519 signature. Returns false (never throws) on any
+ * malformed input so callers can treat a bad signature as a plain auth failure.
+ */
+export declare function verifyDetached(signature: Buffer, message: Buffer, publicKey: Buffer): boolean;
+export declare class RendezvousIdentity {
+    private seed;
+    private publicKey;
+    private secretKey;
+    private rendezvous;
+    /** Serializes writes so two concurrent rename() calls can't interleave. */
+    private writeChain;
+    /**
+     * Load the persisted seed, minting + persisting a fresh one on first run,
+     * then derive the keypair and rendezvous id. Idempotent across restarts:
+     * the same seed always yields the same keypair and id.
+     */
+    load(): Promise<void>;
+    /** The rendezvous id (base32, 128-bit): the DO name + mDNS instance id. */
+    rendezvousId(): string;
+    /** The Ed25519 public key, base64 — this is what clients pin at pair time. */
+    publicKeyB64(): string;
+    /** The raw Ed25519 public key (32 bytes). */
+    signPublicKey(): Buffer;
+    /** The raw Ed25519 secret key (64 bytes) — never leaves the daemon. */
+    signSecretKey(): Buffer;
+    /** Sign a message with the daemon identity key. */
+    sign(message: Buffer): Buffer;
+    private persist;
+}
+/** Derive the base32 rendezvous id from a 32-byte seed. Pure + deterministic. */
+export declare function deriveRendezvousId(seed: Buffer): string;

package/dist/src/rendezvous.js

@@ -0,0 +1,152 @@
+/**
+ * RendezvousIdentity — the daemon's Ed25519 *signing* identity (§3.1).
+ *
+ * This is the load-bearing trust root that replaces Cloudflare Access. It is
+ * SEPARATE from:
+ *   - `keys.json`   (X25519 crypto_box, `crypto.ts`) — legacy E2E envelope box,
+ *                    to be retired in Phase 5.
+ *   - `daemon.json` (`daemon-identity.ts`)           — display id + human name.
+ *
+ * Persisted at `~/.immediacy/identity.key` (mode 0600) as the base64 of the
+ * 32-byte Ed25519 seed — the single source of truth. The keypair and the
+ * rendezvous id are re-derived from the seed on every load, never stored.
+ *
+ * Rendezvous id = base32( HMAC-SHA256(seed, "immediacy-rendezvous-v1")[:16] )
+ * — 128 bits, used as the Durable Object name and the mDNS instance id.
+ *
+ * No backup (decision #1): there is no export/import path. Wiping `~/.immediacy`
+ * mints a fresh seed ⇒ a new rendezvous id ⇒ every client must re-pair.
+ */
+import sodium from "sodium-native";
+import { createHmac } from "node:crypto";
+import { existsSync } from "node:fs";
+import { mkdir, readFile, rename, writeFile, chmod } from "node:fs/promises";
+import { homedir } from "node:os";
+import { dirname, join } from "node:path";
+const IDENTITY_FILE = process.env.IDENTITY_FILE ?? join(homedir(), ".immediacy", "identity.key");
+/** Domain-separation label for the rendezvous-id HMAC. Bump = new id space. */
+const RENDEZVOUS_LABEL = "immediacy-rendezvous-v1";
+/** RFC 4648 base32 alphabet, lowercase, no padding (mDNS/DO-name friendly). */
+const BASE32_ALPHABET = "abcdefghijklmnopqrstuvwxyz234567";
+/** base32-encode `buf` (RFC 4648, lowercase, unpadded). */
+export function base32Encode(buf) {
+    let out = "";
+    let bits = 0;
+    let value = 0;
+    for (const byte of buf) {
+        value = (value << 8) | byte;
+        bits += 8;
+        while (bits >= 5) {
+            bits -= 5;
+            out += BASE32_ALPHABET[(value >>> bits) & 31];
+        }
+    }
+    if (bits > 0)
+        out += BASE32_ALPHABET[(value << (5 - bits)) & 31];
+    return out;
+}
+/** True iff `b64` is canonical base64 of a full-length Ed25519 public key. */
+export function isValidSignPublicKeyB64(b64) {
+    // Node's base64 decoder silently drops invalid characters, so a length check
+    // alone lets malformed input through. Require a strict alphabet, then confirm
+    // the value round-trips to the same canonical string at the exact length.
+    if (typeof b64 !== "string" || !/^[A-Za-z0-9+/]+={0,2}$/.test(b64))
+        return false;
+    const buf = Buffer.from(b64, "base64");
+    return (buf.length === sodium.crypto_sign_PUBLICKEYBYTES &&
+        buf.toString("base64") === b64);
+}
+/** Sign `message` with a 64-byte Ed25519 secret key. Returns the 64-byte sig. */
+export function signDetached(message, secretKey) {
+    const sig = Buffer.alloc(sodium.crypto_sign_BYTES);
+    sodium.crypto_sign_detached(sig, message, secretKey);
+    return sig;
+}
+/**
+ * Verify a detached Ed25519 signature. Returns false (never throws) on any
+ * malformed input so callers can treat a bad signature as a plain auth failure.
+ */
+export function verifyDetached(signature, message, publicKey) {
+    if (signature.length !== sodium.crypto_sign_BYTES ||
+        publicKey.length !== sodium.crypto_sign_PUBLICKEYBYTES) {
+        return false;
+    }
+    return sodium.crypto_sign_verify_detached(signature, message, publicKey);
+}
+export class RendezvousIdentity {
+    seed = Buffer.alloc(0);
+    publicKey = Buffer.alloc(0);
+    secretKey = Buffer.alloc(0);
+    rendezvous = "";
+    /** Serializes writes so two concurrent rename() calls can't interleave. */
+    writeChain = Promise.resolve();
+    /**
+     * Load the persisted seed, minting + persisting a fresh one on first run,
+     * then derive the keypair and rendezvous id. Idempotent across restarts:
+     * the same seed always yields the same keypair and id.
+     */
+    async load() {
+        let seed = null;
+        if (existsSync(IDENTITY_FILE)) {
+            try {
+                const raw = (await readFile(IDENTITY_FILE, "utf8")).trim();
+                const buf = Buffer.from(raw, "base64");
+                if (buf.length === sodium.crypto_sign_SEEDBYTES)
+                    seed = buf;
+            }
+            catch {
+                /* unreadable — fall through to mint a fresh seed */
+            }
+        }
+        if (!seed) {
+            seed = Buffer.alloc(sodium.crypto_sign_SEEDBYTES);
+            sodium.randombytes_buf(seed);
+            await this.persist(seed);
+        }
+        this.seed = seed;
+        this.publicKey = Buffer.alloc(sodium.crypto_sign_PUBLICKEYBYTES);
+        this.secretKey = Buffer.alloc(sodium.crypto_sign_SECRETKEYBYTES);
+        sodium.crypto_sign_seed_keypair(this.publicKey, this.secretKey, this.seed);
+        this.rendezvous = deriveRendezvousId(this.seed);
+        console.log(`[rendezvous] identity ${this.rendezvous}`);
+    }
+    /** The rendezvous id (base32, 128-bit): the DO name + mDNS instance id. */
+    rendezvousId() {
+        return this.rendezvous;
+    }
+    /** The Ed25519 public key, base64 — this is what clients pin at pair time. */
+    publicKeyB64() {
+        return this.publicKey.toString("base64");
+    }
+    /** The raw Ed25519 public key (32 bytes). */
+    signPublicKey() {
+        return this.publicKey;
+    }
+    /** The raw Ed25519 secret key (64 bytes) — never leaves the daemon. */
+    signSecretKey() {
+        return this.secretKey;
+    }
+    /** Sign a message with the daemon identity key. */
+    sign(message) {
+        return signDetached(message, this.secretKey);
+    }
+    persist(seed) {
+        const snapshot = seed.toString("base64");
+        this.writeChain = this.writeChain
+            .catch(() => { })
+            .then(async () => {
+            await mkdir(dirname(IDENTITY_FILE), { recursive: true });
+            const tmp = `${IDENTITY_FILE}.${process.pid}.tmp`;
+            await writeFile(tmp, snapshot, "utf8");
+            await chmod(tmp, 0o600); // secret seed — never world-readable
+            await rename(tmp, IDENTITY_FILE);
+        });
+        return this.writeChain;
+    }
+}
+/** Derive the base32 rendezvous id from a 32-byte seed. Pure + deterministic. */
+export function deriveRendezvousId(seed) {
+    const mac = createHmac("sha256", seed).update(RENDEZVOUS_LABEL).digest();
+    return base32Encode(mac.subarray(0, 16)); // 128 bits
+}
+//# sourceMappingURL=rendezvous.js.map

package/dist/src/rendezvous.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rendezvous.js","sourceRoot":"","sources":["../../src/rendezvous.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,MAAM,MAAM,eAAe,CAAC;AACnC,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AAC7E,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAE1C,MAAM,aAAa,GACjB,OAAO,CAAC,GAAG,CAAC,aAAa,IAAI,IAAI,CAAC,OAAO,EAAE,EAAE,YAAY,EAAE,cAAc,CAAC,CAAC;AAE7E,+EAA+E;AAC/E,MAAM,gBAAgB,GAAG,yBAAyB,CAAC;AAEnD,+EAA+E;AAC/E,MAAM,eAAe,GAAG,kCAAkC,CAAC;AAE3D,2DAA2D;AAC3D,MAAM,UAAU,YAAY,CAAC,GAAW;IACtC,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,KAAK,MAAM,IAAI,IAAI,GAAG,EAAE,CAAC;QACvB,KAAK,GAAG,CAAC,KAAK,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC;QAC5B,IAAI,IAAI,CAAC,CAAC;QACV,OAAO,IAAI,IAAI,CAAC,EAAE,CAAC;YACjB,IAAI,IAAI,CAAC,CAAC;YACV,GAAG,IAAI,eAAe,CAAC,CAAC,KAAK,KAAK,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;QAChD,CAAC;IACH,CAAC;IACD,IAAI,IAAI,GAAG,CAAC;QAAE,GAAG,IAAI,eAAe,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC;IACjE,OAAO,GAAG,CAAC;AACb,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,uBAAuB,CAAC,GAAW;IACjD,6EAA6E;IAC7E,8EAA8E;IAC9E,0EAA0E;IAC1E,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAC,wBAAwB,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IACjF,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IACvC,OAAO,CACL,GAAG,CAAC,MAAM,KAAK,MAAM,CAAC,0BAA0B;QAChD,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,GAAG,CAC/B,CAAC;AACJ,CAAC;AAED,iFAAiF;AACjF,MAAM,UAAU,YAAY,CAAC,OAAe,EAAE,SAAiB;IAC7D,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC;IACnD,MAAM,CAAC,oBAAoB,CAAC,GAAG,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;IACrD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,cAAc,CAC5B,SAAiB,EACjB,OAAe,EACf,SAAiB;IAEjB,IACE,SAAS,CAAC,MAAM,KAAK,MAAM,CAAC,iBAAiB;QAC7C,SAAS,CAAC,MAAM,KAAK,MAAM,CAAC,0BAA0B,EACtD,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,MAAM,CAAC,2BAA2B,CAAC,SAAS,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;AAC3E,CAAC;AAED,MAAM,OAAO,kBAAkB;IACrB,IAAI,GAAW,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAC/B,SAAS,GAAW,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACpC,SAAS,GAAW,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACpC,UAAU,GAAG,EAAE,CAAC;IACxB,2EAA2E;IACnE,UAAU,GAAkB,OAAO,CAAC,OAAO,EAAE,CAAC;IAEtD;;;;OAIG;IACH,KAAK,CAAC,IAAI;QACR,IAAI,IAAI,GAAkB,IAAI,CAAC;QAC/B,IAAI,UAAU,CAAC,aAAa,CAAC,EAAE,CAAC;YAC9B,IAAI,CAAC;gBACH,MAAM,GAAG,GAAG,CAAC,MAAM,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;gBAC3D,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;gBACvC,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,CAAC,qBAAqB;oBAAE,IAAI,GAAG,GAAG,CAAC;YAC9D,CAAC;YAAC,MAAM,CAAC;gBACP,oDAAoD;YACtD,CAAC;QACH,CAAC;QACD,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,qBAAqB,CAAC,CAAC;YAClD,MAAM,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC;YAC7B,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAC3B,CAAC;QACD,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,SAAS,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,0BAA0B,CAAC,CAAC;QACjE,IAAI,CAAC,SAAS,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,0BAA0B,CAAC,CAAC;QACjE,MAAM,CAAC,wBAAwB,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QAC3E,IAAI,CAAC,UAAU,GAAG,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAChD,OAAO,CAAC,GAAG,CAAC,yBAAyB,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC;IAC1D,CAAC;IAED,2EAA2E;IAC3E,YAAY;QACV,OAAO,IAAI,CAAC,UAAU,CAAC;IACzB,CAAC;IAED,8EAA8E;IAC9E,YAAY;QACV,OAAO,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAC3C,CAAC;IAED,6CAA6C;IAC7C,aAAa;QACX,OAAO,IAAI,CAAC,SAAS,CAAC;IACxB,CAAC;IAED,uEAAuE;IACvE,aAAa;QACX,OAAO,IAAI,CAAC,SAAS,CAAC;IACxB,CAAC;IAED,mDAAmD;IACnD,IAAI,CAAC,OAAe;QAClB,OAAO,YAAY,CAAC,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;IAC/C,CAAC;IAEO,OAAO,CAAC,IAAY;QAC1B,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;QACzC,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,UAAU;aAC9B,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC;aACf,IAAI,CAAC,KAAK,IAAI,EAAE;YACf,MAAM,KAAK,CAAC,OAAO,CAAC,aAAa,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YACzD,MAAM,GAAG,GAAG,GAAG,aAAa,IAAI,OAAO,CAAC,GAAG,MAAM,CAAC;YAClD,MAAM,SAAS,CAAC,GAAG,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;YACvC,MAAM,KAAK,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC,qCAAqC;YAC9D,MAAM,MAAM,CAAC,GAAG,EAAE,aAAa,CAAC,CAAC;QACnC,CAAC,CAAC,CAAC;QACL,OAAO,IAAI,CAAC,UAAU,CAAC;IACzB,CAAC;CACF;AAED,iFAAiF;AACjF,MAAM,UAAU,kBAAkB,CAAC,IAAY;IAC7C,MAAM,GAAG,GAAG,UAAU,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC,MAAM,EAAE,CAAC;IACzE,OAAO,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,WAAW;AACvD,CAAC"}

package/dist/src/server.d.ts

@@ -7,7 +7,9 @@
  */
 import { type Server } from "node:http";
 import { WebSocketServer } from "ws";
-import { type Keypair } from "./crypto.js";
+import { RendezvousIdentity } from "./rendezvous.js";
+import { DeviceTable } from "./devices.js";
+import { PairingCodes } from "./pairing.js";
 import { Hub } from "./hub.js";
 import { WorkspaceManager } from "./workspace.js";
 import { JobScheduler } from "./jobs/scheduler.js";
@@ -15,13 +17,21 @@ export interface DaemonOptions {
     port: number;
     host: string;
     /**
-     * Present when E2E is on. The daemon seals each socket's frames to that
-     * device's key after its `hello` handshake; without this, every socket stays
-     * cleartext (local dev / slices 1–4).
+     * The multi-transport session handshake services (docs/WEBRTC_MIGRATION.md):
+     * the daemon's Ed25519 identity, its paired-device table, and the in-memory
+     * pairing-code issuer. This is the only E2E path since the Phase-5 cutover.
      */
-    crypto?: {
-        self: Keypair;
-    };
+    rendezvous?: RendezvousServices;
+    /** LAN direct server (Phase 3); its sessions attach to the same dispatch. */
+    lan?: import("./lan.js").LanServer;
+    /** Relay client (Phase 4); its per-client sessions attach to the dispatch. */
+    relay?: import("./relay-transport.js").RelayDaemon;
+}
+/** The Phase-1 session-handshake services, constructed once at startup. */
+export interface RendezvousServices {
+    identity: RendezvousIdentity;
+    devices: DeviceTable;
+    pairing: PairingCodes;
 }
 export interface Daemon {
     http: Server;
@@ -29,5 +39,7 @@ export interface Daemon {
     hub: Hub;
     workspaces: WorkspaceManager;
     jobs: JobScheduler;
+    /** The session-handshake services, when enabled (see DaemonOptions). */
+    rendezvous?: RendezvousServices;
 }
 export declare function startServer(opts: DaemonOptions): Promise<Daemon>;