@hydra-acp/archiver 0.1.16 → 0.1.18

package/README.md

@@ -20,7 +20,24 @@ Conflict resolution is last-writer-wins by envelope `uploadedAt`. The envelope f
 From npm (recommended once published):
 
 ```sh
-npm install -g @hydra-acp/archiver
+npm install -g @hydra-acp/cli @hydra-acp/archiver
+```
+
+This drops the `hydra-acp` (and `hydra`) CLI plus a `hydra-acp-archiver` binary on your PATH. The CLI dispatches `hydra-acp <name>` to any `hydra-acp-<name>` binary on PATH, so the archiver is also reachable as `hydra-acp archiver`.
+
+Or from source:
+
+```sh
+git clone git@github.com:smagnuso/hydra-acp-archiver.git ~/dev/hydra-acp-archiver
+cd ~/dev/hydra-acp-archiver
+npm install
+npm run build
+```
+
+## Setup
+
+```sh
+hydra-acp archiver setup
 ```
 
 Or from source:
@@ -40,7 +57,7 @@ hydra-acp-archiver setup
 
 The wizard walks you through picking a backend (Google Drive / S3 / Filesystem), configuring credentials, optionally generating an AES-256-GCM key for encryption, writing `~/.hydra-acp/archiver.conf`, and registering the archiver as a hydra extension. About 1 minute for S3/Filesystem; about 5–8 minutes for Google Drive (the GCP Console click-through is the long pole).
 
-Re-run `hydra-acp-archiver setup` any time to switch backends or rotate keys — it preserves existing custom config keys.
+Re-run `hydra-acp archiver setup` any time to switch backends or rotate keys — it preserves existing custom config keys.
 
 <details>
 <summary>Manual Google Drive setup (if you prefer not to run the wizard)</summary>
@@ -54,7 +71,7 @@ You provide your own OAuth client (Google's terms make it impractical to ship a
 3. Configure the **OAuth consent screen**. User type: **External**. Add your Google account under **Test Users**.
 4. **Credentials → Create credentials → OAuth client ID**. Application type: **Desktop app**.
 5. Download the resulting JSON and save it to `~/.hydra-acp/archiver-google-credentials.json` (or anywhere, and set `HYDRA_ACP_ARCHIVER_GOOGLE_CREDENTIALS`).
-6. Run `hydra-acp-archiver gdrive login`. Your browser opens to Google's consent screen. The "Google hasn't verified this app" interstitial is expected for an unverified personal-use client — click **Advanced → Go to (unsafe)** and approve. The redirect lands on a transient local server, the archiver writes `~/.hydra-acp/archiver-google-token.json` (mode 0600), and you're done.
+6. Run `hydra-acp archiver gdrive login`. Your browser opens to Google's consent screen. The "Google hasn't verified this app" interstitial is expected for an unverified personal-use client — click **Advanced → Go to (unsafe)** and approve. The redirect lands on a transient local server, the archiver writes `~/.hydra-acp/archiver-google-token.json` (mode 0600), and you're done.
 7. Register: `hydra-acp extensions add hydra-acp-archiver`.
 
 After this, restart the daemon. The archiver process starts up, creates a `hydra-acp-archive/` folder in your Drive on first upload, and begins syncing.
@@ -84,7 +101,7 @@ That writes the equivalent entry into `~/.hydra-acp/config.json`. On `hydra-acp
 
 ## Multi-machine setup
 
-Run `hydra-acp-archiver setup` on each machine that should sync. For Google Drive, log in with the **same Google account** and use the **same Drive folder name** so each machine points at the shared archive. For S3, point each machine at the same bucket. For filesystem, point each at a directory that some external sync tool (Syncthing, Dropbox, iCloud) mirrors.
+Run `hydra-acp archiver setup` on each machine that should sync. For Google Drive, log in with the **same Google account** and use the **same Drive folder name** so each machine points at the shared archive. For S3, point each machine at the same bucket. For filesystem, point each at a directory that some external sync tool (Syncthing, Dropbox, iCloud) mirrors.
 
 If you turned on encryption, copy `~/.hydra-acp/archiver-key` from your first machine to each peer; the wizard's fingerprint output lets you verify they match.
 
@@ -152,7 +169,7 @@ All three backends support optional AES-256-GCM encryption. When enabled, blobs
 Generate a key on one machine:
 
 ```sh
-hydra-acp-archiver keygen
+hydra-acp archiver keygen
 ```
 
 This writes a 32-byte key as a hex file (mode 0600) and prints:
@@ -207,7 +224,7 @@ Set `HYDRA_ACP_ARCHIVER_HOST_ID` to override the default (`os.hostname()` saniti
 
 ### Key rotation and re-upload
 
-When encryption is enabled and you regenerate the key (`hydra-acp-archiver keygen`), the fingerprint prefix changes. The new prefix namespace is empty, so the cold sweep on the next daemon start re-uploads all sessions encrypted with the new key. Old blobs under the previous prefix are simply ignored — no decryption errors, no manual cleanup required (though you can delete the old prefix from the bucket/dir when convenient).
+When encryption is enabled and you regenerate the key (`hydra-acp archiver keygen`), the fingerprint prefix changes. The new prefix namespace is empty, so the cold sweep on the next daemon start re-uploads all sessions encrypted with the new key. Old blobs under the previous prefix are simply ignored — no decryption errors, no manual cleanup required (though you can delete the old prefix from the bucket/dir when convenient).
 
 ## Configuration file
 
@@ -296,13 +313,13 @@ Return `false` to skip an upload. Any other value (including `undefined`) archiv
 
 - `~/.hydra-acp/archiver-state.json` — per-lineage cache of last uploaded hash + last seen remote upload, used for self-loop suppression. Safe to delete; archiver will rebuild it.
 - `~/.hydra-acp/archiver-google-credentials.json` — OAuth client JSON you downloaded.
-- `~/.hydra-acp/archiver-google-token.json` — refresh + access token (mode 0600). Re-run `hydra-acp-archiver login` to refresh.
-- `~/.hydra-acp/archiver-key` — encryption key (mode 0600), written by `hydra-acp-archiver keygen`. Copy this file to every machine in your sync group. Keep it safe — losing it means losing access to encrypted blobs.
+- `~/.hydra-acp/archiver-google-token.json` — refresh + access token (mode 0600). Re-run `hydra-acp archiver login` to refresh.
+- `~/.hydra-acp/archiver-key` — encryption key (mode 0600), written by `hydra-acp archiver keygen`. Copy this file to every machine in your sync group. Keep it safe — losing it means losing access to encrypted blobs.
 
 ## Troubleshooting
 
 - **`Missing HYDRA_ACP_TOKEN env var`** — you ran the archiver directly instead of via the daemon. Run it as a registered extension.
-- **`No Google OAuth token at …`** — run `hydra-acp-archiver gdrive login` first.
+- **`No Google OAuth token at …`** — run `hydra-acp archiver gdrive login` first.
 - **`OAuth credentials file not found`** — follow the **First-time Google setup** steps to download the client JSON from GCP Console.
 - **Files aren't appearing in Drive** — check `~/.hydra-acp/extensions/hydra-acp-archiver.log` for errors. Common: consent-screen test-user list doesn't include your Google account.
 - **Two machines kept overwriting each other** — that's last-writer-wins working as designed if both are actively editing the same session. Avoid editing the same session on two machines simultaneously; one of them will lose its diff. A future `activeOn` claim-lock will close this gap.

package/dist/acp/attach.js

@@ -1,201 +1 @@
-import { EventEmitter } from "node:events";
-import { readFileSync } from "node:fs";
-import { WebSocket } from "ws";
-import { logger } from "../util/log.js";
-const pkg = JSON.parse(readFileSync(new URL("../../package.json", import.meta.url), "utf8"));
-import { ACP_PROTOCOL_VERSION, isNotification, isRequest, isResponse, } from "./protocol.js";
-const log = logger("acp");
-export class AcpAttach extends EventEmitter {
-    opts;
-    ws;
-    nextId = 1;
-    pending = new Map();
-    connected = false;
-    constructor(opts) {
-        super();
-        this.opts = opts;
-    }
-    get sessionId() {
-        return this.opts.sessionId;
-    }
-    get isConnected() {
-        return this.connected;
-    }
-    start() {
-        log.debug(`connecting ${this.opts.daemonWsUrl} for ${this.opts.sessionId}`);
-        const subprotocols = ["acp.v1", `hydra-acp-token.${this.opts.token}`];
-        let ws;
-        try {
-            ws = new WebSocket(this.opts.daemonWsUrl, subprotocols);
-        }
-        catch (err) {
-            this.emit("error", err);
-            return;
-        }
-        this.ws = ws;
-        ws.on("open", () => {
-            this.connected = true;
-            log.info(`ws open ${this.opts.sessionId}`);
-            void this.handshake()
-                .then(() => {
-                this.emit("open");
-            })
-                .catch((err) => {
-                this.emit("error", err);
-                try {
-                    this.ws?.close();
-                }
-                catch {
-                    void 0;
-                }
-            });
-        });
-        ws.on("message", (data, isBinary) => {
-            if (isBinary) {
-                return;
-            }
-            const text = data.toString("utf8");
-            try {
-                const parsed = JSON.parse(text);
-                this.onMessage(parsed);
-            }
-            catch (err) {
-                log.warn(`parse error on ${this.opts.sessionId}: ${err.message}; raw=${text.slice(0, 200)}`);
-            }
-        });
-        ws.on("error", (err) => {
-            log.warn(`ws error ${this.opts.sessionId}: ${err.message}`);
-            this.emit("error", err);
-        });
-        ws.on("close", (code, reason) => {
-            const hadError = code >= 4000 || code === 1006 || code === 1011;
-            const reasonText = reason.toString("utf8");
-            this.connected = false;
-            log.info(`ws closed ${this.opts.sessionId} code=${code}${reasonText ? ` reason=${reasonText}` : ""}`);
-            for (const [, p] of this.pending) {
-                p.reject(new Error("ws closed"));
-            }
-            this.pending.clear();
-            this.emit("close", { hadError });
-        });
-    }
-    stop() {
-        if (this.ws && this.ws.readyState !== WebSocket.CLOSED) {
-            try {
-                this.ws.close();
-            }
-            catch {
-                void 0;
-            }
-        }
-    }
-    async request(method, params) {
-        const id = this.nextId++;
-        const msg = {
-            jsonrpc: "2.0",
-            id,
-            method,
-            ...(params !== undefined ? { params } : {}),
-        };
-        this.write(msg);
-        return new Promise((resolve, reject) => {
-            this.pending.set(id, {
-                resolve: (resp) => {
-                    if (resp.error) {
-                        reject(new Error(`${resp.error.code}: ${resp.error.message}`));
-                    }
-                    else {
-                        resolve(resp.result);
-                    }
-                },
-                reject,
-            });
-        });
-    }
-    notify(method, params) {
-        const msg = {
-            jsonrpc: "2.0",
-            method,
-            ...(params !== undefined ? { params } : {}),
-        };
-        this.write(msg);
-    }
-    reply(id, result) {
-        const msg = { jsonrpc: "2.0", id, result };
-        this.write(msg);
-    }
-    replyError(id, code, message) {
-        const msg = {
-            jsonrpc: "2.0",
-            id,
-            error: { code, message },
-        };
-        this.write(msg);
-    }
-    async handshake() {
-        try {
-            await this.request("initialize", {
-                protocolVersion: ACP_PROTOCOL_VERSION,
-                clientCapabilities: {
-                    fs: { readTextFile: false, writeTextFile: false },
-                    terminal: false,
-                },
-            });
-        }
-        catch (err) {
-            log.warn(`initialize failed for ${this.opts.sessionId}: ${err.message}`);
-        }
-        try {
-            // historyPolicy: "none" — the archiver pulls full bundles via REST,
-            // it doesn't need history replayed over the WS attach.
-            //
-            // readonly: true — the archiver is a passive observer. On a live
-            // session this still binds as a real attached client and streams
-            // session/update. On a cold session it takes the daemon's viewer
-            // path instead of resurrecting an agent, so re-attaching after an
-            // idle close can't keep a quiet session on a resurrection treadmill.
-            const attachResult = await this.request("session/attach", {
-                sessionId: this.opts.sessionId,
-                historyPolicy: "none",
-                // readonly is a hydra extension → rides under _meta["hydra-acp"]
-                // (session/attach keeps only RFD #533 fields at the top level).
-                _meta: { "hydra-acp": { readonly: true } },
-                clientInfo: { name: "hydra-acp-archiver", version: pkg.version },
-            });
-            log.info(`attached ${this.opts.sessionId}${attachResult.replayed !== undefined
-                ? ` replayed=${attachResult.replayed}`
-                : ""}`);
-        }
-        catch (err) {
-            log.warn(`session/attach failed for ${this.opts.sessionId}: ${err.message}`);
-            throw err;
-        }
-    }
-    write(msg) {
-        if (!this.ws || this.ws.readyState !== WebSocket.OPEN) {
-            log.warn(`drop write to closed ws: ${JSON.stringify(msg)}`);
-            return;
-        }
-        this.ws.send(JSON.stringify(msg));
-    }
-    onMessage(m) {
-        if (isResponse(m)) {
-            const p = this.pending.get(m.id);
-            if (p) {
-                this.pending.delete(m.id);
-                p.resolve(m);
-            }
-            else {
-                log.debug(`unmatched response id=${String(m.id)}`);
-            }
-            this.emit("response", m);
-        }
-        else if (isRequest(m)) {
-            this.emit("request", m);
-        }
-        else if (isNotification(m)) {
-            this.emit("notification", m);
-        }
-    }
-}
-//# sourceMappingURL=attach.js.map
+import{EventEmitter as p}from"node:events";import{readFileSync as d}from"node:fs";import{WebSocket as c}from"ws";import{logger as h}from"../util/log.js";const l=JSON.parse(d(new URL("../../package.json",import.meta.url),"utf8"));import{ACP_PROTOCOL_VERSION as f,isNotification as g,isRequest as u,isResponse as w}from"./protocol.js";const o=h("acp");class E extends p{constructor(e){super();this.opts=e}opts;ws;nextId=1;pending=new Map;connected=!1;get sessionId(){return this.opts.sessionId}get isConnected(){return this.connected}start(){o.debug(`connecting ${this.opts.daemonWsUrl} for ${this.opts.sessionId}`);const e=["acp.v1",`hydra-acp-token.${this.opts.token}`];let t;try{t=new c(this.opts.daemonWsUrl,e)}catch(s){this.emit("error",s);return}this.ws=t,t.on("open",()=>{this.connected=!0,o.info(`ws open ${this.opts.sessionId}`),this.handshake().then(()=>{this.emit("open")}).catch(s=>{this.emit("error",s);try{this.ws?.close()}catch{}})}),t.on("message",(s,r)=>{if(r)return;const i=s.toString("utf8");try{const n=JSON.parse(i);this.onMessage(n)}catch(n){o.warn(`parse error on ${this.opts.sessionId}: ${n.message}; raw=${i.slice(0,200)}`)}}),t.on("error",s=>{o.warn(`ws error ${this.opts.sessionId}: ${s.message}`),this.emit("error",s)}),t.on("close",(s,r)=>{const i=s>=4e3||s===1006||s===1011,n=r.toString("utf8");this.connected=!1,o.info(`ws closed ${this.opts.sessionId} code=${s}${n?` reason=${n}`:""}`);for(const[,a]of this.pending)a.reject(new Error("ws closed"));this.pending.clear(),this.emit("close",{hadError:i})})}stop(){if(this.ws&&this.ws.readyState!==c.CLOSED)try{this.ws.close()}catch{}}async request(e,t){const s=this.nextId++,r={jsonrpc:"2.0",id:s,method:e,...t!==void 0?{params:t}:{}};return this.write(r),new Promise((i,n)=>{this.pending.set(s,{resolve:a=>{a.error?n(new Error(`${a.error.code}: ${a.error.message}`)):i(a.result)},reject:n})})}notify(e,t){const s={jsonrpc:"2.0",method:e,...t!==void 0?{params:t}:{}};this.write(s)}reply(e,t){const s={jsonrpc:"2.0",id:e,result:t};this.write(s)}replyError(e,t,s){const r={jsonrpc:"2.0",id:e,error:{code:t,message:s}};this.write(r)}async handshake(){try{await this.request("initialize",{protocolVersion:f,clientCapabilities:{fs:{readTextFile:!1,writeTextFile:!1},terminal:!1}})}catch(e){o.warn(`initialize failed for ${this.opts.sessionId}: ${e.message}`)}try{const e=await this.request("session/attach",{sessionId:this.opts.sessionId,historyPolicy:"none",_meta:{"hydra-acp":{readonly:!0}},clientInfo:{name:"hydra-acp-archiver",version:l.version}});o.info(`attached ${this.opts.sessionId}${e.replayed!==void 0?` replayed=${e.replayed}`:""}`)}catch(e){throw o.warn(`session/attach failed for ${this.opts.sessionId}: ${e.message}`),e}}write(e){if(!this.ws||this.ws.readyState!==c.OPEN){o.warn(`drop write to closed ws: ${JSON.stringify(e)}`);return}this.ws.send(JSON.stringify(e))}onMessage(e){if(w(e)){const t=this.pending.get(e.id);t?(this.pending.delete(e.id),t.resolve(e)):o.debug(`unmatched response id=${String(e.id)}`),this.emit("response",e)}else u(e)?this.emit("request",e):g(e)&&this.emit("notification",e)}}export{E as AcpAttach};

package/dist/acp/protocol.js

@@ -1,13 +1 @@
-// ACP wire protocol version this extension speaks. Single source of
-// truth for the initialize handshake; never a literal at the callsite.
-export const ACP_PROTOCOL_VERSION = 1;
-export function isRequest(m) {
-    return "method" in m && "id" in m;
-}
-export function isNotification(m) {
-    return "method" in m && !("id" in m);
-}
-export function isResponse(m) {
-    return !("method" in m) && "id" in m;
-}
-//# sourceMappingURL=protocol.js.map
+const e=1;function o(n){return"method"in n&&"id"in n}function s(n){return"method"in n&&!("id"in n)}function t(n){return!("method"in n)&&"id"in n}export{e as ACP_PROTOCOL_VERSION,s as isNotification,o as isRequest,t as isResponse};

package/dist/archive-loop.js

@@ -1,134 +1 @@
-import { hostname, userInfo } from "node:os";
-import { hashBundle, keyFor, serialize, wrap, } from "./envelope.js";
-import { logger } from "./util/log.js";
-const log = logger("archive");
-export class ArchiveLoop {
-    opts;
-    host;
-    pending = new Map();
-    // Tracks sessionId -> meta we know about (just cwd/title/agentId for
-    // now), so the rule fn has something to decide on.
-    meta = new Map();
-    stopped = false;
-    constructor(opts) {
-        this.opts = opts;
-        this.host = opts.host ?? defaultHost();
-    }
-    setMeta(sessionId, meta) {
-        this.meta.set(sessionId, meta);
-    }
-    forgetSession(sessionId) {
-        const p = this.pending.get(sessionId);
-        if (p) {
-            clearTimeout(p.timer);
-            this.pending.delete(sessionId);
-        }
-        this.meta.delete(sessionId);
-    }
-    // Cancel any pending debounced upload and synchronously run one final
-    // flush — used when a session transitions live → cold so we capture
-    // its last state. Errors are logged, not thrown, so callers can
-    // fire-and-forget. The session's meta is dropped after the flush
-    // resolves.
-    async finalFlush(sessionId) {
-        const existing = this.pending.get(sessionId);
-        if (existing) {
-            clearTimeout(existing.timer);
-            this.pending.delete(sessionId);
-        }
-        try {
-            await this.flush(sessionId);
-        }
-        catch (err) {
-            log.warn(`final flush ${sessionId} failed: ${err.message}`);
-        }
-        this.meta.delete(sessionId);
-    }
-    markDirty(sessionId) {
-        if (this.stopped) {
-            return;
-        }
-        const existing = this.pending.get(sessionId);
-        if (existing) {
-            clearTimeout(existing.timer);
-        }
-        const timer = setTimeout(() => {
-            this.pending.delete(sessionId);
-            void this.flush(sessionId).catch((err) => {
-                log.warn(`flush ${sessionId} failed: ${err.message}`);
-            });
-        }, this.opts.debounceMs);
-        timer.unref();
-        this.pending.set(sessionId, { timer });
-    }
-    stop() {
-        this.stopped = true;
-        for (const p of this.pending.values()) {
-            clearTimeout(p.timer);
-        }
-        this.pending.clear();
-    }
-    // flushNow is exposed for tests so they don't have to wait out the
-    // debounce window. Production code goes through markDirty.
-    async flushNow(sessionId) {
-        const existing = this.pending.get(sessionId);
-        if (existing) {
-            clearTimeout(existing.timer);
-            this.pending.delete(sessionId);
-        }
-        await this.flush(sessionId);
-    }
-    async flush(sessionId) {
-        const bundle = await this.opts.daemon.exportSession(sessionId);
-        const lineageId = bundle.session.lineageId;
-        if (!lineageId) {
-            log.warn(`session ${sessionId} export had no lineageId; skipping`);
-            return;
-        }
-        const meta = this.meta.get(sessionId);
-        const rule = this.opts.getRule();
-        const shouldArchive = await runRule(rule, {
-            sessionId,
-            lineageId,
-            meta: meta ?? {},
-        });
-        if (!shouldArchive) {
-            log.debug(`rule skipped session ${sessionId} (lineage ${lineageId})`);
-            return;
-        }
-        const newHash = hashBundle(bundle);
-        const prev = this.opts.state.get(lineageId);
-        if (prev.lastUploadedHash === newHash) {
-            log.debug(`unchanged content for lineage ${lineageId} — skip upload`);
-            return;
-        }
-        const envelope = wrap(bundle, lineageId, this.host);
-        await this.opts.backend.put(keyFor(lineageId), serialize(envelope));
-        await this.opts.state.set(lineageId, {
-            lastUploadedHash: newHash,
-            lastUploadedAt: envelope.uploadedAt,
-        });
-        log.info(`uploaded lineage=${lineageId} session=${sessionId} hash=${newHash.slice(0, 22)}…`);
-    }
-}
-async function runRule(rule, ev) {
-    try {
-        const r = await rule(ev);
-        return r !== false;
-    }
-    catch (err) {
-        log.warn(`rule threw for ${ev.sessionId}: ${err.message}; defaulting to archive`);
-        return true;
-    }
-}
-function defaultHost() {
-    let user = "unknown";
-    try {
-        user = userInfo().username;
-    }
-    catch {
-        // happens in some sandboxes; fall through
-    }
-    return { host: hostname(), user };
-}
-//# sourceMappingURL=archive-loop.js.map
+import{hostname as p,userInfo as h}from"node:os";import{hashBundle as c,keyFor as u,serialize as d,wrap as g}from"./envelope.js";import{logger as m}from"./util/log.js";const n=m("archive");class b{constructor(e){this.opts=e;this.host=e.host??v()}opts;host;pending=new Map;meta=new Map;stopped=!1;setMeta(e,t){this.meta.set(e,t)}forgetSession(e){const t=this.pending.get(e);t&&(clearTimeout(t.timer),this.pending.delete(e)),this.meta.delete(e)}async finalFlush(e){const t=this.pending.get(e);t&&(clearTimeout(t.timer),this.pending.delete(e));try{await this.flush(e)}catch(i){n.warn(`final flush ${e} failed: ${i.message}`)}this.meta.delete(e)}markDirty(e){if(this.stopped)return;const t=this.pending.get(e);t&&clearTimeout(t.timer);const i=setTimeout(()=>{this.pending.delete(e),this.flush(e).catch(r=>{n.warn(`flush ${e} failed: ${r.message}`)})},this.opts.debounceMs);i.unref(),this.pending.set(e,{timer:i})}stop(){this.stopped=!0;for(const e of this.pending.values())clearTimeout(e.timer);this.pending.clear()}async flushNow(e){const t=this.pending.get(e);t&&(clearTimeout(t.timer),this.pending.delete(e)),await this.flush(e)}async flush(e){const t=await this.opts.daemon.exportSession(e),i=t.session.lineageId;if(!i){n.warn(`session ${e} export had no lineageId; skipping`);return}const r=this.meta.get(e),l=this.opts.getRule();if(!await f(l,{sessionId:e,lineageId:i,meta:r??{}})){n.debug(`rule skipped session ${e} (lineage ${i})`);return}const s=c(t);if(this.opts.state.get(i).lastUploadedHash===s){n.debug(`unchanged content for lineage ${i} \u2014 skip upload`);return}const a=g(t,i,this.host);await this.opts.backend.put(u(i),d(a)),await this.opts.state.set(i,{lastUploadedHash:s,lastUploadedAt:a.uploadedAt}),n.info(`uploaded lineage=${i} session=${e} hash=${s.slice(0,22)}\u2026`)}}async function f(o,e){try{return await o(e)!==!1}catch(t){return n.warn(`rule threw for ${e.sessionId}: ${t.message}; defaulting to archive`),!0}}function v(){let o="unknown";try{o=h().username}catch{}return{host:p(),user:o}}export{b as ArchiveLoop};

package/dist/backend/encrypted.js

@@ -1,59 +1 @@
-import { createCipheriv, createDecipheriv, createHash, randomBytes, } from "node:crypto";
-const VERSION = 1;
-const VERSION_LEN = 1;
-const FINGERPRINT_LEN = 8;
-const IV_LEN = 12;
-const TAG_LEN = 16;
-// Offset to the start of ciphertext within a blob.
-const HEADER_LEN = VERSION_LEN + FINGERPRINT_LEN + IV_LEN;
-export class EncryptedBackend {
-    inner;
-    key;
-    keyFingerprint;
-    constructor(inner, key) {
-        this.inner = inner;
-        this.key = key;
-        if (key.length !== 32)
-            throw new Error("encryption key must be 32 bytes");
-        this.keyFingerprint = createHash("sha256").update(key).digest().subarray(0, FINGERPRINT_LEN);
-    }
-    init() {
-        return this.inner.init();
-    }
-    list() {
-        return this.inner.list();
-    }
-    delete(key) {
-        return this.inner.delete(key);
-    }
-    async put(key, data) {
-        const iv = randomBytes(IV_LEN);
-        const cipher = createCipheriv("aes-256-gcm", this.key, iv);
-        const ciphertext = Buffer.concat([cipher.update(data), cipher.final()]);
-        const tag = cipher.getAuthTag();
-        await this.inner.put(key, Buffer.concat([Buffer.from([VERSION]), this.keyFingerprint, iv, ciphertext, tag]));
-    }
-    async get(key) {
-        const blob = await this.inner.get(key);
-        if (blob.length < HEADER_LEN + TAG_LEN)
-            throw new Error(`encrypted blob too short for key ${key}`);
-        const version = blob[0];
-        if (version !== VERSION)
-            throw new Error(`unsupported encryption version ${version} for key ${key}: upgrade the archiver`);
-        const fingerprint = blob.subarray(VERSION_LEN, VERSION_LEN + FINGERPRINT_LEN);
-        if (!fingerprint.equals(this.keyFingerprint))
-            throw new Error(`key mismatch: blob ${key} was encrypted with a different key`);
-        const iv = blob.subarray(VERSION_LEN + FINGERPRINT_LEN, HEADER_LEN);
-        const tag = blob.subarray(blob.length - TAG_LEN);
-        const ciphertext = blob.subarray(HEADER_LEN, blob.length - TAG_LEN);
-        const decipher = createDecipheriv("aes-256-gcm", this.key, iv);
-        decipher.setAuthTag(tag);
-        try {
-            return Buffer.concat([decipher.update(ciphertext), decipher.final()]);
-        }
-        catch {
-            throw new Error(`blob ${key} failed authentication — data may be corrupted`);
-        }
-    }
-}
-//# sourceMappingURL=encrypted.js.map
+import{createCipheriv as d,createDecipheriv as g,createHash as l,randomBytes as m}from"node:crypto";const y=1,i=1,o=8,f=12,h=16,p=i+o+f;class B{constructor(r,e){this.inner=r;this.key=e;if(e.length!==32)throw new Error("encryption key must be 32 bytes");this.keyFingerprint=l("sha256").update(e).digest().subarray(0,o)}inner;key;keyFingerprint;init(){return this.inner.init()}list(){return this.inner.list()}delete(r){return this.inner.delete(r)}async put(r,e){const t=m(f),n=d("aes-256-gcm",this.key,t),s=Buffer.concat([n.update(e),n.final()]),a=n.getAuthTag();await this.inner.put(r,Buffer.concat([Buffer.from([y]),this.keyFingerprint,t,s,a]))}async get(r){const e=await this.inner.get(r);if(e.length<p+h)throw new Error(`encrypted blob too short for key ${r}`);const t=e[0];if(t!==y)throw new Error(`unsupported encryption version ${t} for key ${r}: upgrade the archiver`);if(!e.subarray(i,i+o).equals(this.keyFingerprint))throw new Error(`key mismatch: blob ${r} was encrypted with a different key`);const s=e.subarray(i+o,p),a=e.subarray(e.length-h),u=e.subarray(p,e.length-h),c=g("aes-256-gcm",this.key,s);c.setAuthTag(a);try{return Buffer.concat([c.update(u),c.final()])}catch{throw new Error(`blob ${r} failed authentication \u2014 data may be corrupted`)}}}export{B as EncryptedBackend};

package/dist/backend/factory.js

@@ -1,28 +1 @@
-import { FsBackend } from "./fs.js";
-import { GoogleDriveBackend } from "./google-drive.js";
-import { S3Backend } from "./s3.js";
-export function makeBackend(config) {
-    switch (config.backend) {
-        case "fs":
-            return new FsBackend({ dir: config.fsDir, prefix: config.prefix });
-        case "google-drive":
-            return new GoogleDriveBackend({
-                credentialsPath: config.credentialsPath,
-                tokenPath: config.tokenPath,
-                folderName: config.driveFolderName,
-                prefix: config.prefix,
-            });
-        case "s3":
-            return new S3Backend({
-                bucket: config.s3Bucket,
-                region: config.s3Region,
-                endpoint: config.s3Endpoint,
-                prefix: config.prefix,
-            });
-        default: {
-            const exhaustive = config.backend;
-            throw new Error(`unknown backend: ${String(exhaustive)}`);
-        }
-    }
-}
-//# sourceMappingURL=factory.js.map
+import{FsBackend as t}from"./fs.js";import{GoogleDriveBackend as n}from"./google-drive.js";import{S3Backend as a}from"./s3.js";function s(e){switch(e.backend){case"fs":return new t({dir:e.fsDir,prefix:e.prefix});case"google-drive":return new n({credentialsPath:e.credentialsPath,tokenPath:e.tokenPath,folderName:e.driveFolderName,prefix:e.prefix});case"s3":return new a({bucket:e.s3Bucket,region:e.s3Region,endpoint:e.s3Endpoint,prefix:e.prefix});default:{const r=e.backend;throw new Error(`unknown backend: ${String(r)}`)}}}export{s as makeBackend};

package/dist/backend/fs.js

@@ -1,78 +1 @@
-import { mkdir, readFile, readdir, rename, stat, unlink, writeFile, } from "node:fs/promises";
-import { dirname, resolve } from "node:path";
-import { logger } from "../util/log.js";
-const log = logger("backend.fs");
-// Filesystem-backed implementation. Useful for tests, for users who want
-// to point a folder-sync tool (Syncthing, Dropbox) at the archive
-// directory, and for development against a local daemon.
-export class FsBackend {
-    opts;
-    root;
-    constructor(opts) {
-        this.opts = opts;
-        this.root = opts.prefix !== "" ? resolve(opts.dir, opts.prefix) : opts.dir;
-    }
-    async init() {
-        await mkdir(this.root, { recursive: true });
-        log.info(`fs backend ready at ${this.root}`);
-    }
-    async list() {
-        return this.walk(this.root, "");
-    }
-    async walk(dir, rel) {
-        let names;
-        try {
-            names = await readdir(dir);
-        }
-        catch (err) {
-            const e = err;
-            if (e.code === "ENOENT") {
-                return [];
-            }
-            throw err;
-        }
-        const out = [];
-        for (const name of names) {
-            if (name.startsWith(".") || name.endsWith(".tmp")) {
-                continue;
-            }
-            const full = resolve(dir, name);
-            const entryRel = rel !== "" ? `${rel}/${name}` : name;
-            try {
-                const s = await stat(full);
-                if (s.isDirectory()) {
-                    out.push(...await this.walk(full, entryRel));
-                }
-                else if (s.isFile()) {
-                    out.push({ key: entryRel, size: s.size, modifiedAt: s.mtime.toISOString() });
-                }
-            }
-            catch (err) {
-                log.debug(`stat ${full}: ${err.message}`);
-            }
-        }
-        return out;
-    }
-    async get(key) {
-        return readFile(resolve(this.root, key));
-    }
-    async put(key, data) {
-        const dest = resolve(this.root, key);
-        const tmp = `${dest}.tmp`;
-        await mkdir(dirname(dest), { recursive: true });
-        await writeFile(tmp, data);
-        await rename(tmp, dest);
-    }
-    async delete(key) {
-        try {
-            await unlink(resolve(this.root, key));
-        }
-        catch (err) {
-            const e = err;
-            if (e.code !== "ENOENT") {
-                throw err;
-            }
-        }
-    }
-}
-//# sourceMappingURL=fs.js.map
+import{mkdir as d,readFile as y,readdir as f,rename as p,stat as l,unlink as u,writeFile as h}from"node:fs/promises";import{dirname as k,resolve as o}from"node:path";import{logger as g}from"../util/log.js";const m=g("backend.fs");class v{constructor(t){this.opts=t;this.root=t.prefix!==""?o(t.dir,t.prefix):t.dir}opts;root;async init(){await d(this.root,{recursive:!0}),m.info(`fs backend ready at ${this.root}`)}async list(){return this.walk(this.root,"")}async walk(t,e){let i;try{i=await f(t)}catch(r){if(r.code==="ENOENT")return[];throw r}const n=[];for(const r of i){if(r.startsWith(".")||r.endsWith(".tmp"))continue;const a=o(t,r),c=e!==""?`${e}/${r}`:r;try{const s=await l(a);s.isDirectory()?n.push(...await this.walk(a,c)):s.isFile()&&n.push({key:c,size:s.size,modifiedAt:s.mtime.toISOString()})}catch(s){m.debug(`stat ${a}: ${s.message}`)}}return n}async get(t){return y(o(this.root,t))}async put(t,e){const i=o(this.root,t),n=`${i}.tmp`;await d(k(i),{recursive:!0}),await h(n,e),await p(n,i)}async delete(t){try{await u(o(this.root,t))}catch(e){if(e.code!=="ENOENT")throw e}}}export{v as FsBackend};