@gtc6244/immediacy-daemon 0.2.2 → 0.2.4

package/dist/src/framing.d.ts

@@ -0,0 +1,76 @@
+/**
+ * Frame codec (docs/WEBRTC_MIGRATION.md §5.4 / §3.7, Phase 2).
+ *
+ * A transport-independent binary framing layer that sits UNDER the session
+ * sealer and OVER any byte transport (loopback, LAN TCP, DO relay, WebRTC data
+ * channel). One codec serves them all, so a payload chunked here is reassembled
+ * identically everywhere.
+ *
+ *   ┌───────────┬──────┬───────┬────────────────┐
+ *   │ channelId │ seq  │ flags │ payload        │
+ *   │ u16 (BE)  │ u32  │ u8    │ bytes          │
+ *   └───────────┴──────┴───────┴────────────────┘
+ *
+ * Channels multiplex independent logical streams over one transport:
+ *   - control  (ordered/reliable)
+ *   - rpc      (ordered/reliable)
+ *   - terminal (coalesced firehose)
+ *   - events   (ordered/reliable)
+ *
+ * Chunking lives HERE (not at call sites): any message larger than
+ * MAX_CHUNK_BYTES is split across frames with the MORE flag set on every frame
+ * but the last, and reassembled on receipt. WebRTC (SCTP ~256 KB practical cap)
+ * therefore inherits large-message support for free. The codec is mirrored in
+ * the Flutter and macOS clients; parity is pinned by a shared known-answer vector
+ * (scripts/framing-vector.ts).
+ */
+/** Channel ids — stable wire constants. */
+export declare const Channel: {
+    readonly control: 0;
+    readonly rpc: 1;
+    readonly terminal: 2;
+    readonly events: 3;
+};
+export type ChannelId = (typeof Channel)[keyof typeof Channel];
+/** Frame flag bits. */
+export declare const Flag: {
+    /** More chunks of this logical message follow on the same channel. */
+    readonly MORE: 1;
+};
+/** Fixed header size: u16 channelId + u32 seq + u8 flags. */
+export declare const HEADER_BYTES = 7;
+/** Max payload bytes per frame. Anything larger is chunked. */
+export declare const MAX_CHUNK_BYTES: number;
+/** Upper bound on a reassembled message (guards an unbounded-memory peer). */
+export declare const MAX_MESSAGE_BYTES: number;
+export interface Frame {
+    channelId: number;
+    seq: number;
+    flags: number;
+    payload: Buffer;
+}
+/** Encode one frame to bytes (header || payload). */
+export declare function encodeFrame(frame: Frame): Buffer;
+/** Decode one frame from bytes. Throws on a short/oversized buffer. */
+export declare function decodeFrame(buf: Buffer): Frame;
+/**
+ * Split a logical message into ordered frames on `channelId`, starting at `seq`.
+ * Each frame but the last carries the MORE flag. An empty message yields a
+ * single empty frame (so zero-length messages still round-trip).
+ */
+export declare function splitMessage(channelId: number, seq: number, message: Buffer, maxChunk?: number): Frame[];
+/**
+ * Reassembles chunked messages per channel. Feed decoded frames in receipt
+ * order; `push` returns the complete message when a frame without the MORE flag
+ * arrives, or null while more chunks are pending. Ordered delivery per channel
+ * is assumed (true for every transport we run this over).
+ */
+export declare class Reassembler {
+    private readonly buffers;
+    private readonly sizes;
+    /** Feed one frame; returns `{channelId, message}` when complete, else null. */
+    push(frame: Frame): {
+        channelId: number;
+        message: Buffer;
+    } | null;
+}

package/dist/src/framing.js

@@ -0,0 +1,133 @@
+/**
+ * Frame codec (docs/WEBRTC_MIGRATION.md §5.4 / §3.7, Phase 2).
+ *
+ * A transport-independent binary framing layer that sits UNDER the session
+ * sealer and OVER any byte transport (loopback, LAN TCP, DO relay, WebRTC data
+ * channel). One codec serves them all, so a payload chunked here is reassembled
+ * identically everywhere.
+ *
+ *   ┌───────────┬──────┬───────┬────────────────┐
+ *   │ channelId │ seq  │ flags │ payload        │
+ *   │ u16 (BE)  │ u32  │ u8    │ bytes          │
+ *   └───────────┴──────┴───────┴────────────────┘
+ *
+ * Channels multiplex independent logical streams over one transport:
+ *   - control  (ordered/reliable)
+ *   - rpc      (ordered/reliable)
+ *   - terminal (coalesced firehose)
+ *   - events   (ordered/reliable)
+ *
+ * Chunking lives HERE (not at call sites): any message larger than
+ * MAX_CHUNK_BYTES is split across frames with the MORE flag set on every frame
+ * but the last, and reassembled on receipt. WebRTC (SCTP ~256 KB practical cap)
+ * therefore inherits large-message support for free. The codec is mirrored in
+ * the Flutter and macOS clients; parity is pinned by a shared known-answer vector
+ * (scripts/framing-vector.ts).
+ */
+/** Channel ids — stable wire constants. */
+export const Channel = {
+    control: 0,
+    rpc: 1,
+    terminal: 2,
+    events: 3,
+};
+/** Frame flag bits. */
+export const Flag = {
+    /** More chunks of this logical message follow on the same channel. */
+    MORE: 0x01,
+};
+/** Fixed header size: u16 channelId + u32 seq + u8 flags. */
+export const HEADER_BYTES = 7;
+/** Max payload bytes per frame. Anything larger is chunked. */
+export const MAX_CHUNK_BYTES = 64 * 1024;
+/** Upper bound on a reassembled message (guards an unbounded-memory peer). */
+export const MAX_MESSAGE_BYTES = 32 * 1024 * 1024;
+/** Encode one frame to bytes (header || payload). */
+export function encodeFrame(frame) {
+    const out = Buffer.allocUnsafe(HEADER_BYTES + frame.payload.length);
+    out.writeUInt16BE(frame.channelId & 0xffff, 0);
+    out.writeUInt32BE(frame.seq >>> 0, 2);
+    out.writeUInt8(frame.flags & 0xff, 6);
+    frame.payload.copy(out, HEADER_BYTES);
+    return out;
+}
+/** Decode one frame from bytes. Throws on a short/oversized buffer. */
+export function decodeFrame(buf) {
+    if (buf.length < HEADER_BYTES) {
+        throw new RangeError("frame shorter than the header");
+    }
+    const payload = buf.subarray(HEADER_BYTES);
+    if (payload.length > MAX_CHUNK_BYTES) {
+        throw new RangeError("frame payload exceeds MAX_CHUNK_BYTES");
+    }
+    return {
+        channelId: buf.readUInt16BE(0),
+        seq: buf.readUInt32BE(2),
+        flags: buf.readUInt8(6),
+        payload,
+    };
+}
+/**
+ * Split a logical message into ordered frames on `channelId`, starting at `seq`.
+ * Each frame but the last carries the MORE flag. An empty message yields a
+ * single empty frame (so zero-length messages still round-trip).
+ */
+export function splitMessage(channelId, seq, message, maxChunk = MAX_CHUNK_BYTES) {
+    const frames = [];
+    let offset = 0;
+    let s = seq >>> 0;
+    do {
+        const end = Math.min(offset + maxChunk, message.length);
+        const isLast = end >= message.length;
+        frames.push({
+            channelId,
+            seq: s,
+            flags: isLast ? 0 : Flag.MORE,
+            payload: message.subarray(offset, end),
+        });
+        offset = end;
+        s = (s + 1) >>> 0;
+    } while (offset < message.length);
+    return frames;
+}
+/**
+ * Reassembles chunked messages per channel. Feed decoded frames in receipt
+ * order; `push` returns the complete message when a frame without the MORE flag
+ * arrives, or null while more chunks are pending. Ordered delivery per channel
+ * is assumed (true for every transport we run this over).
+ */
+export class Reassembler {
+    buffers = new Map();
+    sizes = new Map();
+    /** Feed one frame; returns `{channelId, message}` when complete, else null. */
+    push(frame) {
+        const prior = this.buffers.get(frame.channelId);
+        const size = (this.sizes.get(frame.channelId) ?? 0) + frame.payload.length;
+        if (size > MAX_MESSAGE_BYTES) {
+            this.buffers.delete(frame.channelId);
+            this.sizes.delete(frame.channelId);
+            throw new RangeError("reassembled message exceeds MAX_MESSAGE_BYTES");
+        }
+        if (frame.flags & Flag.MORE) {
+            // Accumulate; more to come.
+            const chunks = prior ?? [];
+            chunks.push(Buffer.from(frame.payload));
+            this.buffers.set(frame.channelId, chunks);
+            this.sizes.set(frame.channelId, size);
+            return null;
+        }
+        // Final chunk: assemble and reset this channel.
+        let message;
+        if (prior && prior.length > 0) {
+            prior.push(Buffer.from(frame.payload));
+            message = Buffer.concat(prior);
+        }
+        else {
+            message = Buffer.from(frame.payload);
+        }
+        this.buffers.delete(frame.channelId);
+        this.sizes.delete(frame.channelId);
+        return { channelId: frame.channelId, message };
+    }
+}
+//# sourceMappingURL=framing.js.map

package/dist/src/framing.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"framing.js","sourceRoot":"","sources":["../../src/framing.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,2CAA2C;AAC3C,MAAM,CAAC,MAAM,OAAO,GAAG;IACrB,OAAO,EAAE,CAAC;IACV,GAAG,EAAE,CAAC;IACN,QAAQ,EAAE,CAAC;IACX,MAAM,EAAE,CAAC;CACD,CAAC;AAGX,uBAAuB;AACvB,MAAM,CAAC,MAAM,IAAI,GAAG;IAClB,sEAAsE;IACtE,IAAI,EAAE,IAAI;CACF,CAAC;AAEX,6DAA6D;AAC7D,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,CAAC;AAE9B,+DAA+D;AAC/D,MAAM,CAAC,MAAM,eAAe,GAAG,EAAE,GAAG,IAAI,CAAC;AAEzC,8EAA8E;AAC9E,MAAM,CAAC,MAAM,iBAAiB,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;AASlD,qDAAqD;AACrD,MAAM,UAAU,WAAW,CAAC,KAAY;IACtC,MAAM,GAAG,GAAG,MAAM,CAAC,WAAW,CAAC,YAAY,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACpE,GAAG,CAAC,aAAa,CAAC,KAAK,CAAC,SAAS,GAAG,MAAM,EAAE,CAAC,CAAC,CAAC;IAC/C,GAAG,CAAC,aAAa,CAAC,KAAK,CAAC,GAAG,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC;IACtC,GAAG,CAAC,UAAU,CAAC,KAAK,CAAC,KAAK,GAAG,IAAI,EAAE,CAAC,CAAC,CAAC;IACtC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC;IACtC,OAAO,GAAG,CAAC;AACb,CAAC;AAED,uEAAuE;AACvE,MAAM,UAAU,WAAW,CAAC,GAAW;IACrC,IAAI,GAAG,CAAC,MAAM,GAAG,YAAY,EAAE,CAAC;QAC9B,MAAM,IAAI,UAAU,CAAC,+BAA+B,CAAC,CAAC;IACxD,CAAC;IACD,MAAM,OAAO,GAAG,GAAG,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;IAC3C,IAAI,OAAO,CAAC,MAAM,GAAG,eAAe,EAAE,CAAC;QACrC,MAAM,IAAI,UAAU,CAAC,uCAAuC,CAAC,CAAC;IAChE,CAAC;IACD,OAAO;QACL,SAAS,EAAE,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC;QAC9B,GAAG,EAAE,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC;QACxB,KAAK,EAAE,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC;QACvB,OAAO;KACR,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,YAAY,CAC1B,SAAiB,EACjB,GAAW,EACX,OAAe,EACf,QAAQ,GAAG,eAAe;IAE1B,MAAM,MAAM,GAAY,EAAE,CAAC;IAC3B,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,IAAI,CAAC,GAAG,GAAG,KAAK,CAAC,CAAC;IAClB,GAAG,CAAC;QACF,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,GAAG,QAAQ,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;QACxD,MAAM,MAAM,GAAG,GAAG,IAAI,OAAO,CAAC,MAAM,CAAC;QACrC,MAAM,CAAC,IAAI,CAAC;YACV,SAAS;YACT,GAAG,EAAE,CAAC;YACN,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI;YAC7B,OAAO,EAAE,OAAO,CAAC,QAAQ,CAAC,MAAM,EAAE,GAAG,CAAC;SACvC,CAAC,CAAC;QACH,MAAM,GAAG,GAAG,CAAC;QACb,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC;IACpB,CAAC,QAAQ,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE;IAClC,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;GAKG;AACH,MAAM,OAAO,WAAW;IACL,OAAO,GAAG,IAAI,GAAG,EAAoB,CAAC;IACtC,KAAK,GAAG,IAAI,GAAG,EAAkB,CAAC;IAEnD,+EAA+E;IAC/E,IAAI,CAAC,KAAY;QACf,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QAChD,MAAM,IAAI,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;QAC3E,IAAI,IAAI,GAAG,iBAAiB,EAAE,CAAC;YAC7B,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;YACrC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;YACnC,MAAM,IAAI,UAAU,CAAC,+CAA+C,CAAC,CAAC;QACxE,CAAC;QACD,IAAI,KAAK,CAAC,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;YAC5B,4BAA4B;YAC5B,MAAM,MAAM,GAAG,KAAK,IAAI,EAAE,CAAC;YAC3B,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;YACxC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;YAC1C,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;YACtC,OAAO,IAAI,CAAC;QACd,CAAC;QACD,gDAAgD;QAChD,IAAI,OAAe,CAAC;QACpB,IAAI,KAAK,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC9B,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;YACvC,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACjC,CAAC;aAAM,CAAC;YACN,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACvC,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QACrC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QACnC,OAAO,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,OAAO,EAAE,CAAC;IACjD,CAAC;CACF"}

package/dist/src/hub.d.ts

@@ -8,9 +8,21 @@
  * (cleartext until it completes the `hello` handshake, then a NaCl box sealed to
  * that device's key). Sends and broadcasts therefore encode per-socket.
  */
-import { WebSocket } from "ws";
 import type { Envelope, MessageType, PayloadFor } from "./protocol.js";
 import { type Codec } from "./crypto.js";
+/**
+ * The minimal socket surface the hub/dispatch need — satisfied by both a `ws`
+ * WebSocket (the live WS path) and a `SessionSocket` (a LAN/relay session
+ * adapter, see session-socket.ts). Keeping the dispatch on this structural type
+ * lets one `handleFrame` serve every transport.
+ */
+export interface SocketLike {
+    /** WebSocket.readyState; OPEN === 1. */
+    readonly readyState: number;
+    /** Bytes queued but not yet flushed (for forward backpressure). */
+    readonly bufferedAmount: number;
+    send(data: string, cb?: (err?: Error) => void): void;
+}
 export declare class Hub {
     private requireSealed;
     /** Each attached socket and the codec its frames are (de)coded with. */
@@ -31,10 +43,10 @@ export declare class Hub {
     constructor(requireSealed?: boolean);
     /** A socket whose channel is sealed to its device key (post-`hello`). */
     private sealed;
-    add(socket: WebSocket): void;
-    remove(socket: WebSocket): void;
+    add(socket: SocketLike): void;
+    remove(socket: SocketLike): void;
     /** Follow the live daemon log on this socket (idempotent). */
-    subscribeLog(socket: WebSocket): void;
+    subscribeLog(socket: SocketLike): void;
     /** Push a daemon→client message to just the log subscribers. */
     broadcastLog<T extends MessageType>(type: T, ws: string | null, payload: PayloadFor<T>): void;
     /**
@@ -46,11 +58,11 @@ export declare class Hub {
      */
     hasLiveClients(): boolean;
     /** The codec bound to a socket (cleartext if unknown/unpaired). */
-    codecFor(socket: WebSocket): Codec;
+    codecFor(socket: SocketLike): Codec;
     /** Bind a socket to a codec (called once the device's key is known). */
-    setCodec(socket: WebSocket, codec: Codec): void;
+    setCodec(socket: SocketLike, codec: Codec): void;
     /** Send to one socket, sealed with that socket's own codec. */
-    send(socket: WebSocket, env: Envelope): void;
+    send(socket: SocketLike, env: Envelope): void;
     /**
      * Like `send`, but invoke `after` once the frame has been handed to the OS
      * socket buffer (or immediately if the socket is already closed). Lets a
@@ -61,9 +73,9 @@ export declare class Hub {
      * the side effect when the frame never made it to the socket. A closed socket
      * reports a synthetic error rather than pretending the frame was delivered.
      */
-    sendThen(socket: WebSocket, env: Envelope, after: (err?: Error) => void): void;
+    sendThen(socket: SocketLike, env: Envelope, after: (err?: Error) => void): void;
     /** Build + send a daemon→client message to ONE socket (per-device streams). */
-    sendTo<T extends MessageType>(socket: WebSocket, type: T, ws: string | null, payload: PayloadFor<T>): void;
+    sendTo<T extends MessageType>(socket: SocketLike, type: T, ws: string | null, payload: PayloadFor<T>): void;
     /** Build + broadcast a daemon→client message to every attached socket. */
     broadcast<T extends MessageType>(type: T, ws: string | null, payload: PayloadFor<T>): void;
 }

package/dist/src/hub.js

@@ -8,9 +8,10 @@
  * (cleartext until it completes the `hello` handshake, then a NaCl box sealed to
  * that device's key). Sends and broadcasts therefore encode per-socket.
  */
-import { WebSocket } from "ws";
 import { make } from "./envelope.js";
 import { clearCodec } from "./crypto.js";
+/** WebSocket.OPEN — avoids importing `ws` just for the constant. */
+const OPEN = 1;
 export class Hub {
     requireSealed;
     /** Each attached socket and the codec its frames are (de)coded with. */
@@ -56,7 +57,7 @@ export class Hub {
         const env = make(type, ws, payload);
         for (const socket of this.logSubscribers) {
             const codec = this.conns.get(socket);
-            if (codec && socket.readyState === WebSocket.OPEN && this.sealed(socket)) {
+            if (codec && socket.readyState === OPEN && this.sealed(socket)) {
                 socket.send(codec.encode(env));
             }
         }
@@ -86,7 +87,7 @@ export class Hub {
     }
     /** Send to one socket, sealed with that socket's own codec. */
     send(socket, env) {
-        if (socket.readyState === WebSocket.OPEN)
+        if (socket.readyState === OPEN)
             socket.send(this.codecFor(socket).encode(env));
     }
     /**
@@ -100,7 +101,7 @@ export class Hub {
      * reports a synthetic error rather than pretending the frame was delivered.
      */
     sendThen(socket, env, after) {
-        if (socket.readyState === WebSocket.OPEN) {
+        if (socket.readyState === OPEN) {
             socket.send(this.codecFor(socket).encode(env), (err) => after(err ?? undefined));
         }
         else {
@@ -115,7 +116,7 @@ export class Hub {
     broadcast(type, ws, payload) {
         const env = make(type, ws, payload);
         for (const [socket, codec] of this.conns) {
-            if (socket.readyState === WebSocket.OPEN && this.sealed(socket)) {
+            if (socket.readyState === OPEN && this.sealed(socket)) {
                 socket.send(codec.encode(env));
             }
         }

package/dist/src/hub.js.map

@@ -1 +1 @@
-{"version":3,"file":"hub.js","sourceRoot":"","sources":["../../src/hub.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,IAAI,CAAC;AAE/B,OAAO,EAAE,IAAI,EAAE,MAAM,eAAe,CAAC;AACrC,OAAO,EAAE,UAAU,EAAc,MAAM,aAAa,CAAC;AAErD,MAAM,OAAO,GAAG;IAiBM;IAhBpB,wEAAwE;IAChE,KAAK,GAAG,IAAI,GAAG,EAAoB,CAAC;IAC5C;;;;OAIG;IACK,cAAc,GAAG,IAAI,GAAG,EAAa,CAAC;IAE9C;;;;;;OAMG;IACH,YAAoB,gBAAgB,KAAK;QAArB,kBAAa,GAAb,aAAa,CAAQ;IAAG,CAAC;IAE7C,yEAAyE;IACjE,MAAM,CAAC,MAAiB;QAC9B,OAAO,CAAC,IAAI,CAAC,aAAa,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,UAAU,CAAC;IACtE,CAAC;IAED,GAAG,CAAC,MAAiB;QACnB,2EAA2E;QAC3E,0CAA0C;QAC1C,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IACrC,CAAC;IACD,MAAM,CAAC,MAAiB;QACtB,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAC1B,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACrC,CAAC;IAED,8DAA8D;IAC9D,YAAY,CAAC,MAAiB;QAC5B,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC;YAAE,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAC9D,CAAC;IAED,gEAAgE;IAChE,YAAY,CAAwB,IAAO,EAAE,EAAiB,EAAE,OAAsB;QACpF,IAAI,IAAI,CAAC,cAAc,CAAC,IAAI,KAAK,CAAC;YAAE,OAAO;QAC3C,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,EAAE,EAAE,EAAE,OAAO,CAAC,CAAC;QACpC,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,cAAc,EAAE,CAAC;YACzC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YACrC,IAAI,KAAK,IAAI,MAAM,CAAC,UAAU,KAAK,SAAS,CAAC,IAAI,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;gBACzE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;YACjC,CAAC;QACH,CAAC;IACH,CAAC;IAED;;;;;;OAMG;IACH,cAAc;QACZ,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC;YACvC,IAAI,MAAM,CAAC,UAAU,KAAK,SAAS,CAAC,IAAI;gBAAE,OAAO,IAAI,CAAC;QACxD,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,mEAAmE;IACnE,QAAQ,CAAC,MAAiB;QACxB,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,UAAU,CAAC;IAC9C,CAAC;IAED,wEAAwE;IACxE,QAAQ,CAAC,MAAiB,EAAE,KAAY;QACtC,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC;YAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IAC5D,CAAC;IAED,+DAA+D;IAC/D,IAAI,CAAC,MAAiB,EAAE,GAAa;QACnC,IAAI,MAAM,CAAC,UAAU,KAAK,SAAS,CAAC,IAAI;YAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3F,CAAC;IAED;;;;;;;;;OASG;IACH,QAAQ,CAAC,MAAiB,EAAE,GAAa,EAAE,KAA4B;QACrE,IAAI,MAAM,CAAC,UAAU,KAAK,SAAS,CAAC,IAAI,EAAE,CAAC;YACzC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,IAAI,SAAS,CAAC,CAAC,CAAC;QACnF,CAAC;aAAM,CAAC;YACN,KAAK,CAAC,IAAI,KAAK,CAAC,iBAAiB,CAAC,CAAC,CAAC;QACtC,CAAC;IACH,CAAC;IAED,+EAA+E;IAC/E,MAAM,CACJ,MAAiB,EACjB,IAAO,EACP,EAAiB,EACjB,OAAsB;QAEtB,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,EAAE,EAAE,EAAE,OAAO,CAAC,CAAC,CAAC;IAC7C,CAAC;IAED,0EAA0E;IAC1E,SAAS,CAAwB,IAAO,EAAE,EAAiB,EAAE,OAAsB;QACjF,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,EAAE,EAAE,EAAE,OAAO,CAAC,CAAC;QACpC,KAAK,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YACzC,IAAI,MAAM,CAAC,UAAU,KAAK,SAAS,CAAC,IAAI,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;gBAChE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;YACjC,CAAC;QACH,CAAC;IACH,CAAC;CACF"}
+{"version":3,"file":"hub.js","sourceRoot":"","sources":["../../src/hub.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAGH,OAAO,EAAE,IAAI,EAAE,MAAM,eAAe,CAAC;AACrC,OAAO,EAAE,UAAU,EAAc,MAAM,aAAa,CAAC;AAgBrD,oEAAoE;AACpE,MAAM,IAAI,GAAG,CAAC,CAAC;AAEf,MAAM,OAAO,GAAG;IAiBM;IAhBpB,wEAAwE;IAChE,KAAK,GAAG,IAAI,GAAG,EAAqB,CAAC;IAC7C;;;;OAIG;IACK,cAAc,GAAG,IAAI,GAAG,EAAc,CAAC;IAE/C;;;;;;OAMG;IACH,YAAoB,gBAAgB,KAAK;QAArB,kBAAa,GAAb,aAAa,CAAQ;IAAG,CAAC;IAE7C,yEAAyE;IACjE,MAAM,CAAC,MAAkB;QAC/B,OAAO,CAAC,IAAI,CAAC,aAAa,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,UAAU,CAAC;IACtE,CAAC;IAED,GAAG,CAAC,MAAkB;QACpB,2EAA2E;QAC3E,0CAA0C;QAC1C,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IACrC,CAAC;IACD,MAAM,CAAC,MAAkB;QACvB,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAC1B,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACrC,CAAC;IAED,8DAA8D;IAC9D,YAAY,CAAC,MAAkB;QAC7B,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC;YAAE,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAC9D,CAAC;IAED,gEAAgE;IAChE,YAAY,CAAwB,IAAO,EAAE,EAAiB,EAAE,OAAsB;QACpF,IAAI,IAAI,CAAC,cAAc,CAAC,IAAI,KAAK,CAAC;YAAE,OAAO;QAC3C,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,EAAE,EAAE,EAAE,OAAO,CAAC,CAAC;QACpC,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,cAAc,EAAE,CAAC;YACzC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YACrC,IAAI,KAAK,IAAI,MAAM,CAAC,UAAU,KAAK,IAAI,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC/D,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;YACjC,CAAC;QACH,CAAC;IACH,CAAC;IAED;;;;;;OAMG;IACH,cAAc;QACZ,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC;YACvC,IAAI,MAAM,CAAC,UAAU,KAAK,SAAS,CAAC,IAAI;gBAAE,OAAO,IAAI,CAAC;QACxD,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,mEAAmE;IACnE,QAAQ,CAAC,MAAkB;QACzB,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,UAAU,CAAC;IAC9C,CAAC;IAED,wEAAwE;IACxE,QAAQ,CAAC,MAAkB,EAAE,KAAY;QACvC,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC;YAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IAC5D,CAAC;IAED,+DAA+D;IAC/D,IAAI,CAAC,MAAkB,EAAE,GAAa;QACpC,IAAI,MAAM,CAAC,UAAU,KAAK,IAAI;YAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;IACjF,CAAC;IAED;;;;;;;;;OASG;IACH,QAAQ,CAAC,MAAkB,EAAE,GAAa,EAAE,KAA4B;QACtE,IAAI,MAAM,CAAC,UAAU,KAAK,IAAI,EAAE,CAAC;YAC/B,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,IAAI,SAAS,CAAC,CAAC,CAAC;QACnF,CAAC;aAAM,CAAC;YACN,KAAK,CAAC,IAAI,KAAK,CAAC,iBAAiB,CAAC,CAAC,CAAC;QACtC,CAAC;IACH,CAAC;IAED,+EAA+E;IAC/E,MAAM,CACJ,MAAkB,EAClB,IAAO,EACP,EAAiB,EACjB,OAAsB;QAEtB,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,EAAE,EAAE,EAAE,OAAO,CAAC,CAAC,CAAC;IAC7C,CAAC;IAED,0EAA0E;IAC1E,SAAS,CAAwB,IAAO,EAAE,EAAiB,EAAE,OAAsB;QACjF,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,EAAE,EAAE,EAAE,OAAO,CAAC,CAAC;QACpC,KAAK,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YACzC,IAAI,MAAM,CAAC,UAAU,KAAK,IAAI,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;gBACtD,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;YACjC,CAAC;QACH,CAAC;IACH,CAAC;CACF"}

package/dist/src/index.d.ts

@@ -18,8 +18,8 @@
  *   OLLAMA_BASE_URL  default http://localhost:11434 — local Ollama endpoint for
  *                    the Ollama backend (keyless; OLLAMA_API_KEY only for a
  *                    protected/remote instance).
- *   E2E           1 to enable the NaCl box layer (needs a paired peer key)
- *   PEER_PUBLIC_KEY  base64 of the client's public key (dev pairing shortcut)
- *   WORKTREE_ROOT, STATE_FILE, KEYS_FILE, PEER_FILE — storage overrides
+ *   PAIRING       1 to render a pairing QR on startup until a device pairs
+ *   IDENTITY_FILE, DEVICES_FILE — session-identity storage overrides
+ *   WORKTREE_ROOT, STATE_FILE — storage overrides
  */
 export {};

package/dist/src/index.js

@@ -18,31 +18,91 @@
  *   OLLAMA_BASE_URL  default http://localhost:11434 — local Ollama endpoint for
  *                    the Ollama backend (keyless; OLLAMA_API_KEY only for a
  *                    protected/remote instance).
- *   E2E           1 to enable the NaCl box layer (needs a paired peer key)
- *   PEER_PUBLIC_KEY  base64 of the client's public key (dev pairing shortcut)
- *   WORKTREE_ROOT, STATE_FILE, KEYS_FILE, PEER_FILE — storage overrides
+ *   PAIRING       1 to render a pairing QR on startup until a device pairs
+ *   IDENTITY_FILE, DEVICES_FILE — session-identity storage overrides
+ *   WORKTREE_ROOT, STATE_FILE — storage overrides
  */
 import { startServer } from "./server.js";
-import { loadOrCreateKeypair, loadPeers } from "./crypto.js";
+import { RendezvousIdentity } from "./rendezvous.js";
+import { DeviceTable } from "./devices.js";
+import { PairingCodes, buildPairingPayload, renderPairingQr } from "./pairing.js";
+import { LanServer } from "./lan.js";
+import { RelayDaemon } from "./relay-transport.js";
 import { OLLAMA_BASE_URL, refreshOllamaModels } from "./agent/ollama-probe.js";
 const port = Number(process.env.DAEMON_PORT ?? 8787);
 const host = process.env.DAEMON_HOST ?? "127.0.0.1";
 const agentMode = (process.env.AGENT_MODE ?? "claude").toLowerCase();
-const e2e = process.env.E2E === "1";
-async function resolveCrypto() {
-    if (!e2e)
-        return undefined;
-    const self = await loadOrCreateKeypair();
-    console.log(`[daemon] E2E on. Daemon public key (encode this into the pairing QR):\n  ${self.publicKey.toString("base64")}`);
-    // Devices pair themselves on connect (the `hello` handshake, gated by the
-    // Cloudflare Access token). Pre-existing pairings are just logged here.
-    const peers = await loadPeers();
-    console.log(`[daemon] ${peers.length} paired device(s); each socket seals to its own key on hello.`);
-    return { self };
+/**
+ * Multi-transport session handshake (docs/WEBRTC_MIGRATION.md). Mints/loads the
+ * daemon's Ed25519 identity + rendezvous id and the paired-device table. Since
+ * the Phase-5 cutover this is the only E2E path (the NaCl box + Cloudflare Access
+ * gate are gone).
+ */
+async function resolveRendezvous() {
+    const identity = new RendezvousIdentity();
+    await identity.load();
+    const devices = new DeviceTable();
+    await devices.load();
+    const pairing = new PairingCodes();
+    console.log(`[daemon] rendezvous ${identity.rendezvousId()} · ${devices.list().length} paired device(s)`);
+    return { identity, devices, pairing };
+}
+const rendezvous = await resolveRendezvous();
+// LAN direct (Phase 3): advertise `_immediacy._tcp` + accept TCP handshakes, so a
+// device on the same network reaches this daemon with no relay. On by default;
+// LAN=0 disables (e.g. locked-down networks).
+const lan = process.env.LAN === "0" ? undefined : new LanServer(rendezvous);
+// Relay (Phase 4): keep a persistent socket to the Durable Object for this
+// daemon's rendezvous id, so a device on cellular reaches it behind NAT. Enabled
+// by pointing RELAY_URL at the signal server (e.g. wss://signal.example.com).
+const relayUrl = (process.env.RELAY_URL ?? "").trim();
+const relay = relayUrl
+    ? new RelayDaemon(rendezvous, relayUrl, { license: process.env.LICENSE_TOKEN })
+    : undefined;
+const daemon = await startServer({ port, host, rendezvous, lan, relay });
+// startServer wired each server's onSession into the shared dispatch; now bring
+// the transports up.
+if (lan) {
+    try {
+        const lanPort = await lan.start(0, { host: "0.0.0.0" });
+        console.log(`[daemon] LAN direct on tcp/${lanPort} (mDNS _immediacy._tcp)`);
+    }
+    catch (err) {
+        console.log(`[daemon] LAN direct unavailable: ${err instanceof Error ? err.message : String(err)}`);
+    }
+}
+if (relay) {
+    relay.connect();
+    console.log(`[daemon] relay: connecting to ${relayUrl} for ${rendezvous.identity.rendezvousId()}`);
 }
-const crypto = await resolveCrypto();
-const daemon = await startServer({ port, host, crypto });
 console.log(`[daemon] agent mode: ${agentMode}`);
+// Pairing QR for a new device (PAIRING=1). Issues a fresh single-use code and
+// renders a scannable QR, refreshing before the 60s TTL lapses, until the first
+// device pairs. Off by default so existing daemons don't print a QR on restart.
+if (process.env.PAIRING === "1") {
+    const pairingBaseline = rendezvous.devices.list().length;
+    const showQr = async () => {
+        const { code } = rendezvous.pairing.issue();
+        console.log("\n[daemon] Scan to pair a new device:");
+        await renderPairingQr(buildPairingPayload({
+            rendezvousId: rendezvous.identity.rendezvousId(),
+            daemonPublicKeyB64: rendezvous.identity.publicKeyB64(),
+            code,
+            signalUrl: process.env.SIGNAL_URL,
+        }));
+    };
+    await showQr();
+    const pairingTimer = setInterval(() => {
+        // Stop once a new device has paired.
+        if (rendezvous.devices.list().length > pairingBaseline) {
+            clearInterval(pairingTimer);
+            console.log("[daemon] device paired — stopping pairing QR.");
+            return;
+        }
+        void showQr();
+    }, 55_000);
+    pairingTimer.unref();
+}
 // Probe for a local Ollama and, if present, load the models it serves so they
 // show up in the picker. Best-effort: an unreachable Ollama just yields none.
 const ollamaModelList = await refreshOllamaModels(true);
@@ -77,6 +137,8 @@ function shutdown(signal) {
     console.log(`\n[daemon] ${signal} received, closing…`);
     clearInterval(mediaSweepTimer);
     daemon.jobs.stop(); // cancel cron timers so nothing fires mid-teardown
+    relay?.close();
+    void lan?.stop();
     void daemon.workspaces.shutdown().finally(() => {
         daemon.wss.close();
         daemon.http.close(() => process.exit(0));

package/dist/src/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,mBAAmB,EAAE,SAAS,EAAgB,MAAM,aAAa,CAAC;AAC3E,OAAO,EAAE,eAAe,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAC;AAE/E,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,WAAW,IAAI,IAAI,CAAC,CAAC;AACrD,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,WAAW,IAAI,WAAW,CAAC;AACpD,MAAM,SAAS,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,IAAI,QAAQ,CAAC,CAAC,WAAW,EAAE,CAAC;AACrE,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,KAAK,GAAG,CAAC;AAEpC,KAAK,UAAU,aAAa;IAC1B,IAAI,CAAC,GAAG;QAAE,OAAO,SAAS,CAAC;IAC3B,MAAM,IAAI,GAAG,MAAM,mBAAmB,EAAE,CAAC;IACzC,OAAO,CAAC,GAAG,CACT,4EAA4E,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAChH,CAAC;IACF,0EAA0E;IAC1E,wEAAwE;IACxE,MAAM,KAAK,GAAG,MAAM,SAAS,EAAE,CAAC;IAChC,OAAO,CAAC,GAAG,CACT,YAAY,KAAK,CAAC,MAAM,+DAA+D,CACxF,CAAC;IACF,OAAO,EAAE,IAAI,EAAE,CAAC;AAClB,CAAC;AAED,MAAM,MAAM,GAAG,MAAM,aAAa,EAAE,CAAC;AACrC,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;AAEzD,OAAO,CAAC,GAAG,CAAC,wBAAwB,SAAS,EAAE,CAAC,CAAC;AAEjD,8EAA8E;AAC9E,8EAA8E;AAC9E,MAAM,eAAe,GAAG,MAAM,mBAAmB,CAAC,IAAI,CAAC,CAAC;AACxD,IAAI,eAAe,CAAC,MAAM,EAAE,CAAC;IAC3B,OAAO,CAAC,GAAG,CACT,oBAAoB,eAAe,CAAC,MAAM,sBAAsB,eAAe,MAAM,eAAe;SACjG,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAChB,IAAI,CAAC,IAAI,CAAC,EAAE,CAChB,CAAC;AACJ,CAAC;KAAM,CAAC;IACN,OAAO,CAAC,GAAG,CACT,qCAAqC,eAAe,2DAA2D,CAChH,CAAC;AACJ,CAAC;AAED,2EAA2E;AAC3E,2EAA2E;AAC3E,6EAA6E;AAC7E,2EAA2E;AAC3E,oFAAoF;AACpF,MAAM,cAAc,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAC/C,KAAK,UAAU,UAAU;IACvB,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,UAAU;aACpB,UAAU,EAAE;aACZ,YAAY,CAAC,MAAM,CAAC,UAAU,CAAC,gBAAgB,EAAE,CAAC,CAAC;IACxD,CAAC;IAAC,MAAM,CAAC;QACP,iBAAiB;IACnB,CAAC;AACH,CAAC;AACD,UAAU,CAAC,GAAG,EAAE,CAAC,KAAK,UAAU,EAAE,EAAE,MAAM,CAAC,CAAC,KAAK,EAAE,CAAC;AACpD,MAAM,eAAe,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC,KAAK,UAAU,EAAE,EAAE,cAAc,CAAC,CAAC;AAC7E,eAAe,CAAC,KAAK,EAAE,CAAC;AAExB,SAAS,QAAQ,CAAC,MAAc;IAC9B,OAAO,CAAC,GAAG,CAAC,cAAc,MAAM,qBAAqB,CAAC,CAAC;IACvD,aAAa,CAAC,eAAe,CAAC,CAAC;IAC/B,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,mDAAmD;IACvE,KAAK,MAAM,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE;QAC7C,MAAM,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC;QACnB,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;QACzC,UAAU,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,KAAK,EAAE,CAAC;IAClD,CAAC,CAAC,CAAC;AACL,CAAC;AAED,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC;AAC/C,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,OAAO,EAAE,WAAW,EAA2B,MAAM,aAAa,CAAC;AACnE,OAAO,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AACrD,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAC3C,OAAO,EAAE,YAAY,EAAE,mBAAmB,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAClF,OAAO,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AACrC,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AACnD,OAAO,EAAE,eAAe,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAC;AAE/E,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,WAAW,IAAI,IAAI,CAAC,CAAC;AACrD,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,WAAW,IAAI,WAAW,CAAC;AACpD,MAAM,SAAS,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,IAAI,QAAQ,CAAC,CAAC,WAAW,EAAE,CAAC;AAErE;;;;;GAKG;AACH,KAAK,UAAU,iBAAiB;IAC9B,MAAM,QAAQ,GAAG,IAAI,kBAAkB,EAAE,CAAC;IAC1C,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;IACtB,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;IAClC,MAAM,OAAO,CAAC,IAAI,EAAE,CAAC;IACrB,MAAM,OAAO,GAAG,IAAI,YAAY,EAAE,CAAC;IACnC,OAAO,CAAC,GAAG,CACT,uBAAuB,QAAQ,CAAC,YAAY,EAAE,MAAM,OAAO,CAAC,IAAI,EAAE,CAAC,MAAM,mBAAmB,CAC7F,CAAC;IACF,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;AACxC,CAAC;AAED,MAAM,UAAU,GAAG,MAAM,iBAAiB,EAAE,CAAC;AAE7C,kFAAkF;AAClF,+EAA+E;AAC/E,8CAA8C;AAC9C,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,KAAK,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,SAAS,CAAC,UAAU,CAAC,CAAC;AAE5E,2EAA2E;AAC3E,iFAAiF;AACjF,8EAA8E;AAC9E,MAAM,QAAQ,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;AACtD,MAAM,KAAK,GAAG,QAAQ;IACpB,CAAC,CAAC,IAAI,WAAW,CAAC,UAAU,EAAE,QAAQ,EAAE,EAAE,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,aAAa,EAAE,CAAC;IAC/E,CAAC,CAAC,SAAS,CAAC;AAEd,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,UAAU,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC;AAEzE,gFAAgF;AAChF,qBAAqB;AACrB,IAAI,GAAG,EAAE,CAAC;IACR,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC;QACxD,OAAO,CAAC,GAAG,CAAC,8BAA8B,OAAO,yBAAyB,CAAC,CAAC;IAC9E,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,GAAG,CAAC,oCAAoC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACtG,CAAC;AACH,CAAC;AACD,IAAI,KAAK,EAAE,CAAC;IACV,KAAK,CAAC,OAAO,EAAE,CAAC;IAChB,OAAO,CAAC,GAAG,CAAC,iCAAiC,QAAQ,QAAQ,UAAU,CAAC,QAAQ,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC;AACrG,CAAC;AAED,OAAO,CAAC,GAAG,CAAC,wBAAwB,SAAS,EAAE,CAAC,CAAC;AAEjD,8EAA8E;AAC9E,gFAAgF;AAChF,gFAAgF;AAChF,IAAI,OAAO,CAAC,GAAG,CAAC,OAAO,KAAK,GAAG,EAAE,CAAC;IAChC,MAAM,eAAe,GAAG,UAAU,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,MAAM,CAAC;IACzD,MAAM,MAAM,GAAG,KAAK,IAAmB,EAAE;QACvC,MAAM,EAAE,IAAI,EAAE,GAAG,UAAU,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;QAC5C,OAAO,CAAC,GAAG,CAAC,uCAAuC,CAAC,CAAC;QACrD,MAAM,eAAe,CACnB,mBAAmB,CAAC;YAClB,YAAY,EAAE,UAAU,CAAC,QAAQ,CAAC,YAAY,EAAE;YAChD,kBAAkB,EAAE,UAAU,CAAC,QAAQ,CAAC,YAAY,EAAE;YACtD,IAAI;YACJ,SAAS,EAAE,OAAO,CAAC,GAAG,CAAC,UAAU;SAClC,CAAC,CACH,CAAC;IACJ,CAAC,CAAC;IACF,MAAM,MAAM,EAAE,CAAC;IACf,MAAM,YAAY,GAAG,WAAW,CAAC,GAAG,EAAE;QACpC,qCAAqC;QACrC,IAAI,UAAU,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,eAAe,EAAE,CAAC;YACvD,aAAa,CAAC,YAAY,CAAC,CAAC;YAC5B,OAAO,CAAC,GAAG,CAAC,+CAA+C,CAAC,CAAC;YAC7D,OAAO;QACT,CAAC;QACD,KAAK,MAAM,EAAE,CAAC;IAChB,CAAC,EAAE,MAAM,CAAC,CAAC;IACX,YAAY,CAAC,KAAK,EAAE,CAAC;AACvB,CAAC;AAED,8EAA8E;AAC9E,8EAA8E;AAC9E,MAAM,eAAe,GAAG,MAAM,mBAAmB,CAAC,IAAI,CAAC,CAAC;AACxD,IAAI,eAAe,CAAC,MAAM,EAAE,CAAC;IAC3B,OAAO,CAAC,GAAG,CACT,oBAAoB,eAAe,CAAC,MAAM,sBAAsB,eAAe,MAAM,eAAe;SACjG,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAChB,IAAI,CAAC,IAAI,CAAC,EAAE,CAChB,CAAC;AACJ,CAAC;KAAM,CAAC;IACN,OAAO,CAAC,GAAG,CACT,qCAAqC,eAAe,2DAA2D,CAChH,CAAC;AACJ,CAAC;AAED,2EAA2E;AAC3E,2EAA2E;AAC3E,6EAA6E;AAC7E,2EAA2E;AAC3E,oFAAoF;AACpF,MAAM,cAAc,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAC/C,KAAK,UAAU,UAAU;IACvB,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,UAAU;aACpB,UAAU,EAAE;aACZ,YAAY,CAAC,MAAM,CAAC,UAAU,CAAC,gBAAgB,EAAE,CAAC,CAAC;IACxD,CAAC;IAAC,MAAM,CAAC;QACP,iBAAiB;IACnB,CAAC;AACH,CAAC;AACD,UAAU,CAAC,GAAG,EAAE,CAAC,KAAK,UAAU,EAAE,EAAE,MAAM,CAAC,CAAC,KAAK,EAAE,CAAC;AACpD,MAAM,eAAe,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC,KAAK,UAAU,EAAE,EAAE,cAAc,CAAC,CAAC;AAC7E,eAAe,CAAC,KAAK,EAAE,CAAC;AAExB,SAAS,QAAQ,CAAC,MAAc;IAC9B,OAAO,CAAC,GAAG,CAAC,cAAc,MAAM,qBAAqB,CAAC,CAAC;IACvD,aAAa,CAAC,eAAe,CAAC,CAAC;IAC/B,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,mDAAmD;IACvE,KAAK,EAAE,KAAK,EAAE,CAAC;IACf,KAAK,GAAG,EAAE,IAAI,EAAE,CAAC;IACjB,KAAK,MAAM,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE;QAC7C,MAAM,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC;QACnB,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;QACzC,UAAU,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,KAAK,EAAE,CAAC;IAClD,CAAC,CAAC,CAAC;AACL,CAAC;AAED,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC;AAC/C,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC"}

package/dist/src/lan.d.ts

@@ -0,0 +1,103 @@
+/**
+ * LAN direct transport (docs/WEBRTC_MIGRATION.md Phase 3).
+ *
+ * Priority-2 path: when a client and daemon share a network segment they talk
+ * directly over TCP — no Cloudflare, no relay, works with the router's WAN link
+ * unplugged. The daemon:
+ *   - advertises `_immediacy._tcp` over mDNS (TXT `rid=<rendezvous id>`) so a
+ *     client can discover it without any typed address;
+ *   - listens on TCP and, per connection, runs the §5.3 session handshake over
+ *     the frame `Mux` (tcp-transport.ts + transport.ts), then hands the caller a
+ *     `SecureChannel` for that peer.
+ *
+ * The handshake and frame codec are the SAME modules the loopback and (future)
+ * relay/WebRTC paths use — only the byte transport differs.
+ */
+import { Mux } from "./transport.js";
+import { type SecureChannel, type InitiatorOpts } from "./session.js";
+import type { RendezvousIdentity } from "./rendezvous.js";
+import type { DeviceTable } from "./devices.js";
+/** bonjour "type" (it prepends `_` and appends `._tcp`) ⇒ `_immediacy._tcp`. */
+export declare const LAN_SERVICE_TYPE = "immediacy";
+/** A peer session established over LAN. */
+export interface LanSession {
+    mux: Mux;
+    channel: SecureChannel;
+    /** The peer device's Ed25519 pubkey (base64), from its handshake msg1. */
+    devicePub: string;
+    close(): void;
+    /** Register a callback for when the peer/transport drops. */
+    onClose(cb: () => void): void;
+}
+/**
+ * Run the responder (daemon) side of the handshake over `mux`'s control channel:
+ * receive msg1, verify the device against `isPaired`, reply msg2, and resolve
+ * with the established `SecureChannel`. Rejects on an unknown/revoked device or a
+ * malformed/failed handshake.
+ */
+export declare function respondHandshakeOverMux(mux: Mux, opts: {
+    daemonSignSecret: Buffer;
+    rendezvousId: string;
+    isPaired: (devicePubB64: string) => boolean;
+    /** First-pairing hook (see `ResponderOpts.redeemCode`). */
+    redeemCode?: (devicePubB64: string, code: string) => boolean;
+}, timeoutMs?: number): Promise<{
+    channel: SecureChannel;
+    devicePub: string;
+    paired: boolean;
+    label?: string;
+}>;
+/**
+ * Run the initiator (client) side over `mux`'s control channel: send msg1, wait
+ * for msg2, and resolve with the `SecureChannel`. Used by the LAN test and
+ * mirrored by the Flutter/macOS LAN clients.
+ */
+export declare function initiateHandshakeOverMux(mux: Mux, opts: InitiatorOpts, timeoutMs?: number): Promise<SecureChannel>;
+export interface RendezvousLike {
+    identity: RendezvousIdentity;
+    devices: DeviceTable;
+    /**
+     * Single-use pairing codes. When present, a brand-new device can pair inline
+     * during the handshake (msg1 carries a code). Omit to disable LAN pairing.
+     */
+    pairing?: {
+        consume(code: string): boolean;
+    };
+}
+export declare class LanServer {
+    private readonly rendezvous;
+    private server?;
+    private bonjour?;
+    private service?;
+    constructor(rendezvous: RendezvousLike);
+    /** Called for each peer that completes the handshake over LAN. */
+    onSession?: (session: LanSession) => void;
+    /**
+     * Start the TCP listener and advertise it over mDNS. Returns the bound port.
+     * `advertise: false` skips mDNS (useful in tests / restricted networks).
+     */
+    start(port?: number, opts?: {
+        advertise?: boolean;
+        host?: string;
+    }): Promise<number>;
+    private advertise;
+    private onConnection;
+    stop(): Promise<void>;
+}
+/** Discovered daemon on the LAN. */
+export interface LanPeer {
+    rendezvousId: string;
+    host: string;
+    port: number;
+    name: string;
+}
+/**
+ * Browse the LAN for advertised daemons. Calls `onPeer` for each service that
+ * carries a rendezvous-id TXT record. Returns a stop function.
+ */
+export declare function browseLan(onPeer: (peer: LanPeer) => void): () => void;
+/** Open a LAN TCP connection to `host:port` and wrap it in a `Mux`. */
+export declare function lanConnect(host: string, port: number): Promise<{
+    mux: Mux;
+    close(): void;
+}>;