@hydra-acp/archiver 0.1.16 → 0.1.18

package/dist/setup/wizard.js

@@ -1,415 +1,17 @@
-import { spawnSync } from "node:child_process";
-import { createHash } from "node:crypto";
-import { copyFileSync, existsSync, mkdirSync, readFileSync, rmSync, statSync, writeFileSync } from "node:fs";
-import { homedir } from "node:os";
-import { delimiter, join, resolve } from "node:path";
-import { loadLoginConfig } from "../config.js";
-import { runKeygen } from "../keygen.js";
-import { runGoogleLogin } from "../oauth/google.js";
-import { loadAwsCredentials } from "../util/aws-credentials.js";
-import { PRIMARY_CONF_PATH, readExisting, writeConf } from "./conf-writer.js";
-import { formatAge, scanDownloadsForGoogleCredentials } from "./downloads-scan.js";
-import { ask, confirm, openBrowser, pause, pickFromList } from "./prompts.js";
-const TOTAL_STEPS = 6;
-const BOLD = "\x1b[1m";
-const GREEN = "\x1b[32m";
-const YELLOW = "\x1b[33m";
-const RED = "\x1b[31m";
-const DIM = "\x1b[2m";
-const RESET = "\x1b[0m";
-function header(num, total, title) {
-    process.stdout.write(`\n  ${BOLD}[${num}/${total}] ${title}${RESET}\n\n`);
-}
-function ok(msg) {
-    process.stdout.write(`      ${GREEN}✓${RESET} ${msg}\n`);
-}
-function warn(msg) {
-    process.stdout.write(`      ${YELLOW}⚠${RESET} ${msg}\n`);
-}
-function fail(msg) {
-    process.stderr.write(`      ${RED}✗ ${msg}${RESET}\n`);
-    process.exit(1);
-}
-function info(msg) {
-    process.stdout.write(`      ${msg}\n`);
-}
-function blank() {
-    process.stdout.write("\n");
-}
-function hasBin(name) {
-    const dirs = (process.env.PATH ?? "").split(delimiter);
-    const exts = process.platform === "win32" ? [".exe", ".cmd", ".bat", ""] : [""];
-    for (const dir of dirs) {
-        if (!dir)
-            continue;
-        for (const ext of exts) {
-            const full = join(dir, name + ext);
-            try {
-                if (statSync(full).isFile())
-                    return true;
-            }
-            catch {
-                // ignore
-            }
-        }
-    }
-    return false;
-}
-const HYDRA_HOME = resolve(homedir(), ".hydra-acp");
-const HYDRA_CONFIG_PATH = resolve(HYDRA_HOME, "config.json");
-const DEFAULT_KEY_PATH = resolve(HYDRA_HOME, "archiver-key");
-const DEFAULT_FS_DIR = resolve(HYDRA_HOME, "archive");
-const DEFAULT_DRIVE_FOLDER = "hydra-acp-archive";
-function readHydraConfigExtensions() {
-    try {
-        const cfg = JSON.parse(readFileSync(HYDRA_CONFIG_PATH, "utf8"));
-        return new Set(Object.keys(cfg.extensions ?? {}));
-    }
-    catch {
-        return new Set();
-    }
-}
-function keyFingerprint(keyPath) {
-    try {
-        const hex = readFileSync(keyPath, "utf8").trim();
-        if (!/^[0-9a-f]+$/i.test(hex))
-            return undefined;
-        const bytes = Buffer.from(hex, "hex");
-        if (bytes.length !== 32)
-            return undefined;
-        return createHash("sha256").update(bytes).digest().subarray(0, 8).toString("hex");
-    }
-    catch {
-        return undefined;
-    }
-}
-async function step1ExistingCheck() {
-    header(1, TOTAL_STEPS, "Checking existing setup");
-    info("This wizard configures a backend (Google Drive / S3 / Filesystem),");
-    info("optional encryption, and registers the archiver with hydra.");
-    blank();
-    const { map } = readExisting(PRIMARY_CONF_PATH);
-    if (map.size === 0) {
-        ok("No existing archiver config found.");
-        return { reconfigure: true };
-    }
-    const backend = map.get("BACKEND") ?? "google-drive";
-    info(`Existing config at ${PRIMARY_CONF_PATH}`);
-    info(`  Backend: ${backend}`);
-    if (backend === "google-drive")
-        info(`  Drive folder: ${map.get("DRIVE_FOLDER") ?? DEFAULT_DRIVE_FOLDER}`);
-    else if (backend === "s3")
-        info(`  S3 bucket: ${map.get("S3_BUCKET") ?? "(missing)"}`);
-    else if (backend === "fs")
-        info(`  FS dir: ${map.get("FS_DIR") ?? DEFAULT_FS_DIR}`);
-    const keyPath = map.get("KEY_PATH") ?? (existsSync(DEFAULT_KEY_PATH) ? DEFAULT_KEY_PATH : undefined);
-    if (map.get("KEY_PATH")) {
-        const fp = keyFingerprint(map.get("KEY_PATH"));
-        info(`  Encryption: on${fp ? ` (fingerprint ${fp})` : ""}`);
-    }
-    else {
-        info(`  Encryption: off`);
-    }
-    const registered = readHydraConfigExtensions().has("hydra-acp-archiver");
-    info(`  Registered with hydra: ${registered ? "yes" : "no"}`);
-    blank();
-    if (!(await confirm("Reconfigure from scratch?", false))) {
-        info("Edit ~/.hydra-acp/archiver.conf directly to tune individual settings.");
-        return { reconfigure: false };
-    }
-    return { reconfigure: true };
-}
-async function step2PickBackend() {
-    header(2, TOTAL_STEPS, "Pick a backend");
-    const choices = [
-        {
-            backend: "google-drive",
-            label: "Google Drive\n           Easiest cross-machine sync. Free up to 15 GB. One-time GCP\n           setup (~5 min in the Cloud Console).",
-        },
-        {
-            backend: "s3",
-            label: "S3 / S3-compatible (R2, B2, MinIO, Wasabi)\n           Best for larger archives. Needs AWS-style creds and an\n           existing bucket.",
-        },
-        {
-            backend: "fs",
-            label: "Filesystem\n           Useful with Syncthing/Dropbox mirroring a folder, or for\n           local-only testing.",
-        },
-    ];
-    const picked = await pickFromList("Choose:", choices, (c) => c.label);
-    if (!picked)
-        fail("A backend is required.");
-    ok(`Backend: ${picked.backend}`);
-    return { backend: picked.backend };
-}
-async function step3aGoogleDrive() {
-    header(3, TOTAL_STEPS, "Configure Google Drive");
-    const login = loadLoginConfig();
-    const credentialsPath = login.credentialsPath;
-    if (existsSync(credentialsPath)) {
-        ok(`Google OAuth credentials found at ${credentialsPath}.`);
-    }
-    else {
-        info("First-time setup. You need an OAuth client from Google Cloud Console.");
-        blank();
-        info("  1. Pick or create a project");
-        info("  2. APIs & Services → Library → enable Google Drive API");
-        info("  3. OAuth consent screen → User type: External → add yourself as a Test User");
-        info("  4. Credentials → Create credentials → OAuth client ID → Application: Desktop app");
-        info("  5. Download the JSON (lands in ~/Downloads)");
-        blank();
-        await pause("Press Enter to open the Cloud Console...");
-        openBrowser("https://console.cloud.google.com/");
-        blank();
-        await pause("Press Enter once you've downloaded the JSON...");
-        const hit = scanDownloadsForGoogleCredentials();
-        let srcPath;
-        if (hit) {
-            blank();
-            info(`Found ${hit.path} (${formatAge(hit.ageMs)}).`);
-            if (await confirm("Use this file?", true))
-                srcPath = hit.path;
-        }
-        if (!srcPath) {
-            blank();
-            const manual = await ask("Path to the downloaded JSON");
-            if (!manual)
-                fail("A credentials file is required.");
-            srcPath = manual.startsWith("~/") ? manual.replace(/^~/, homedir()) : manual;
-        }
-        if (!existsSync(srcPath))
-            fail(`File not found: ${srcPath}`);
-        mkdirSync(HYDRA_HOME, { recursive: true });
-        copyFileSync(srcPath, credentialsPath);
-        try {
-            const { chmodSync } = await import("node:fs");
-            chmodSync(credentialsPath, 0o600);
-        }
-        catch {
-            // chmod not meaningful on win32
-        }
-        ok(`Saved to ${credentialsPath} (chmod 600).`);
-    }
-    blank();
-    const driveFolder = await ask("Drive folder name", DEFAULT_DRIVE_FOLDER);
-    blank();
-    info("Now we run Google's OAuth flow. Your browser will open to a consent");
-    info("screen. The 'Google hasn't verified this app' interstitial is expected");
-    info("for a personal OAuth client — click 'Advanced' → 'Go to (unsafe)' → 'Allow'.");
-    blank();
-    await pause("Press Enter to start OAuth...");
-    try {
-        await runGoogleLogin({ credentialsPath, tokenPath: login.tokenPath });
-    }
-    catch (err) {
-        fail(`Google OAuth failed: ${err.message}`);
-    }
-    ok(`OAuth complete. Token saved to ${login.tokenPath}.`);
-    return { driveFolder, credentialsPath };
-}
-async function step3bS3() {
-    header(3, TOTAL_STEPS, "Configure S3");
-    blank();
-    info("S3 endpoint hints:");
-    info(`  ${DIM}AWS S3${RESET}        leave Endpoint blank, set Region`);
-    info(`  ${DIM}Cloudflare R2${RESET} https://<accountid>.r2.cloudflarestorage.com`);
-    info(`  ${DIM}Backblaze B2${RESET}  https://s3.<region>.backblazeb2.com`);
-    info(`  ${DIM}MinIO${RESET}         your MinIO endpoint URL`);
-    blank();
-    const bucket = await ask("S3 bucket name");
-    if (!bucket)
-        fail("A bucket name is required for S3.");
-    const region = (await ask("Region (blank for SDK default)")) || undefined;
-    const endpoint = (await ask("Endpoint URL (blank for AWS S3)")) || undefined;
-    blank();
-    try {
-        const creds = loadAwsCredentials();
-        const masked = `${creds.accessKeyId.slice(0, 4)}…${creds.accessKeyId.slice(-4)}`;
-        const source = process.env.AWS_ACCESS_KEY_ID ? "env vars" : `~/.aws/credentials (profile: ${process.env.AWS_PROFILE ?? "default"})`;
-        ok(`AWS creds found via ${source} — access key ${masked}.`);
-    }
-    catch (err) {
-        warn(`${err.message}`);
-        info("The archiver will fail to start until creds are in place.");
-    }
-    return { bucket, region, endpoint };
-}
-async function step3cFilesystem() {
-    header(3, TOTAL_STEPS, "Configure Filesystem");
-    const suggestions = [];
-    for (const candidate of ["Syncthing", "Dropbox", "iCloud Drive", "OneDrive"]) {
-        const full = resolve(homedir(), candidate);
-        if (existsSync(full))
-            suggestions.push(full);
-    }
-    let dir;
-    if (suggestions.length > 0) {
-        info("Found sync folders that could host the archive:");
-        blank();
-        suggestions.forEach((s, i) => info(`  ${i + 1}. ${s}/hydra-acp-archive`));
-        info(`  c. Custom path`);
-        info(`  d. Default (${DEFAULT_FS_DIR})`);
-        blank();
-        const reply = (await ask("Choice", "d")).toLowerCase();
-        if (reply === "d" || reply === "") {
-            dir = DEFAULT_FS_DIR;
-        }
-        else if (reply === "c") {
-            const custom = await ask("Archive directory", DEFAULT_FS_DIR);
-            dir = custom.startsWith("~/") ? custom.replace(/^~/, homedir()) : custom;
-        }
-        else {
-            const n = Number.parseInt(reply, 10);
-            if (Number.isInteger(n) && n >= 1 && n <= suggestions.length)
-                dir = resolve(suggestions[n - 1], "hydra-acp-archive");
-        }
-        if (!dir)
-            fail("Invalid choice.");
-    }
-    else {
-        const raw = await ask("Archive directory", DEFAULT_FS_DIR);
-        dir = raw.startsWith("~/") ? raw.replace(/^~/, homedir()) : raw;
-    }
-    try {
-        mkdirSync(dir, { recursive: true });
-        const probe = resolve(dir, ".hydra-acp-archiver-test");
-        writeFileSync(probe, "ok");
-        rmSync(probe);
-        ok(`Directory writable: ${dir}`);
-    }
-    catch (err) {
-        fail(`Cannot write to ${dir}: ${err.message}`);
-    }
-    return { dir };
-}
-async function step4Encryption(backend) {
-    header(4, TOTAL_STEPS, "Encryption");
-    const defaultYes = backend !== "fs";
-    if (backend === "fs")
-        info("Filesystem backend — encryption is optional (you already control the disk).");
-    else
-        info(`${backend === "google-drive" ? "Google Drive" : "S3"} backend — encryption is recommended (data leaves your machine).`);
-    blank();
-    if (!(await confirm("Enable AES-256-GCM encryption at rest?", defaultYes))) {
-        return { enabled: false, keyPath: undefined };
-    }
-    const existingFp = keyFingerprint(DEFAULT_KEY_PATH);
-    if (existingFp) {
-        info(`Existing key at ${DEFAULT_KEY_PATH} (fingerprint ${existingFp}).`);
-        if (await confirm("Use this key?", true))
-            return { enabled: true, keyPath: DEFAULT_KEY_PATH };
-        blank();
-        warn("Rotating the key makes the existing archive unreadable until re-uploaded.");
-        if (!(await confirm("Generate a new key (overwrites the existing file)?", false)))
-            return { enabled: true, keyPath: DEFAULT_KEY_PATH };
-    }
-    blank();
-    await runKeygen();
-    blank();
-    info(`Copy ${DEFAULT_KEY_PATH} to each machine that should share this archive.`);
-    return { enabled: true, keyPath: DEFAULT_KEY_PATH };
-}
-async function step5WriteConfig(args) {
-    header(5, TOTAL_STEPS, "Writing config");
-    const login = loadLoginConfig();
-    const updates = {
-        BACKEND: args.backend,
-    };
-    if (args.backend === "google-drive" && args.google) {
-        if (args.google.driveFolder !== DEFAULT_DRIVE_FOLDER)
-            updates.DRIVE_FOLDER = args.google.driveFolder;
-        if (args.google.credentialsPath !== login.credentialsPath)
-            updates.GOOGLE_CREDENTIALS = args.google.credentialsPath;
-    }
-    else if (args.backend === "s3" && args.s3) {
-        updates.S3_BUCKET = args.s3.bucket;
-        if (args.s3.region)
-            updates.S3_REGION = args.s3.region;
-        if (args.s3.endpoint)
-            updates.S3_ENDPOINT = args.s3.endpoint;
-    }
-    else if (args.backend === "fs" && args.fs) {
-        if (args.fs.dir !== DEFAULT_FS_DIR)
-            updates.FS_DIR = args.fs.dir;
-    }
-    if (args.encryption.enabled && args.encryption.keyPath)
-        updates.KEY_PATH = args.encryption.keyPath;
-    writeConf(PRIMARY_CONF_PATH, updates);
-    ok(`Wrote ${PRIMARY_CONF_PATH} (chmod 600).`);
-    blank();
-    info("Final config:");
-    const { map } = readExisting(PRIMARY_CONF_PATH);
-    for (const [k, v] of map)
-        info(`  ${k}=${v}`);
-}
-async function step6RegisterExtension() {
-    header(6, TOTAL_STEPS, "Register with hydra (optional)");
-    if (!hasBin("hydra-acp")) {
-        info("hydra-acp not found on PATH. Register manually later with:");
-        info("  hydra-acp extensions add hydra-acp-archiver");
-        return;
-    }
-    if (readHydraConfigExtensions().has("hydra-acp-archiver")) {
-        ok("Already registered as a hydra extension.");
-        info("Restart the daemon to pick up the new config: hydra-acp daemon restart");
-        return;
-    }
-    info("hydra can manage hydra-acp-archiver as a subprocess that auto-starts");
-    info("with the daemon. This adds an entry to ~/.hydra-acp/config.json.");
-    blank();
-    if (!(await confirm("Register hydra-acp-archiver as a hydra extension?", true))) {
-        info("Skipping. Register later with:");
-        info("  hydra-acp extensions add hydra-acp-archiver");
-        return;
-    }
-    const cmdArgs = ["extensions", "add", "hydra-acp-archiver"];
-    if (!hasBin("hydra-acp-archiver")) {
-        const scriptPath = process.argv[1] ?? "";
-        if (!scriptPath) {
-            warn("Couldn't determine script path; falling back to bare command.");
-        }
-        else if (scriptPath.includes("/.npm/_npx/")) {
-            warn("Looks like you're running via npx — registering this transient path");
-            warn("would break on the next npx cache cleanup. Install globally first:");
-            info("  npm install -g @hydra-acp/archiver");
-            info("Then register with: hydra-acp extensions add hydra-acp-archiver");
-            return;
-        }
-        else {
-            cmdArgs.push("--command", "node", "--args", scriptPath);
-        }
-    }
-    info(`Running: hydra-acp ${cmdArgs.join(" ")}`);
-    const result = spawnSync("hydra-acp", cmdArgs, { stdio: "inherit" });
-    if (result.status === 0) {
-        ok("Registered.");
-        info("Start the daemon (or restart if already running): hydra-acp daemon restart");
-    }
-    else {
-        blank();
-        warn(`hydra-acp exited with code ${result.status ?? "?"}.`);
-        info("Register manually later with:");
-        info(`  hydra-acp ${cmdArgs.join(" ")}`);
-    }
-}
-export async function runSetup() {
-    process.stdout.write(`\n  ${BOLD}hydra-acp-archiver setup${RESET}\n`);
-    const step1 = await step1ExistingCheck();
-    if (!step1.reconfigure)
-        return;
-    const { backend } = await step2PickBackend();
-    let google;
-    let s3;
-    let fs;
-    if (backend === "google-drive")
-        google = await step3aGoogleDrive();
-    else if (backend === "s3")
-        s3 = await step3bS3();
-    else
-        fs = await step3cFilesystem();
-    const encryption = await step4Encryption(backend);
-    await step5WriteConfig({ backend, google, s3, fs, encryption });
-    await step6RegisterExtension();
-    blank();
-    ok("Setup complete.");
-}
-//# sourceMappingURL=wizard.js.map
+import{spawnSync as G}from"node:child_process";import{createHash as T}from"node:crypto";import{copyFileSync as I,existsSync as w,mkdirSync as A,readFileSync as P,rmSync as B,statSync as L,writeFileSync as N}from"node:fs";import{homedir as v}from"node:os";import{delimiter as H,join as K,resolve as p}from"node:path";import{loadLoginConfig as x}from"../config.js";import{runKeygen as W}from"../keygen.js";import{runGoogleLogin as Y}from"../oauth/google.js";import{loadAwsCredentials as U}from"../util/aws-credentials.js";import{PRIMARY_CONF_PATH as b,readExisting as C,writeConf as M}from"./conf-writer.js";import{formatAge as j,scanDownloadsForGoogleCredentials as z}from"./downloads-scan.js";import{ask as l,confirm as y,openBrowser as J,pause as E,pickFromList as q}from"./prompts.js";const u=6,D="\x1B[1m",V="\x1B[32m",Q="\x1B[33m",X="\x1B[31m",S="\x1B[2m",d="\x1B[0m";function f(e,n,i){process.stdout.write(`
+  ${D}[${e}/${n}] ${i}${d}
+
+`)}function c(e){process.stdout.write(`      ${V}\u2713${d} ${e}
+`)}function m(e){process.stdout.write(`      ${Q}\u26A0${d} ${e}
+`)}function g(e){process.stderr.write(`      ${X}\u2717 ${e}${d}
+`),process.exit(1)}function t(e){process.stdout.write(`      ${e}
+`)}function o(){process.stdout.write(`
+`)}function F(e){const n=(process.env.PATH??"").split(H),i=process.platform==="win32"?[".exe",".cmd",".bat",""]:[""];for(const r of n)if(r)for(const s of i){const a=K(r,e+s);try{if(L(a).isFile())return!0}catch{}}return!1}const $=p(v(),".hydra-acp"),Z=p($,"config.json"),h=p($,"archiver-key"),k=p($,"archive"),R="hydra-acp-archive";function O(){try{const e=JSON.parse(P(Z,"utf8"));return new Set(Object.keys(e.extensions??{}))}catch{return new Set}}function _(e){try{const n=P(e,"utf8").trim();if(!/^[0-9a-f]+$/i.test(n))return;const i=Buffer.from(n,"hex");return i.length!==32?void 0:T("sha256").update(i).digest().subarray(0,8).toString("hex")}catch{return}}async function ee(){f(1,u,"Checking existing setup"),t("This wizard configures a backend (Google Drive / S3 / Filesystem),"),t("optional encryption, and registers the archiver with hydra."),o();const{map:e}=C(b);if(e.size===0)return c("No existing archiver config found."),{reconfigure:!0};const n=e.get("BACKEND")??"google-drive";t(`Existing config at ${b}`),t(`  Backend: ${n}`),n==="google-drive"?t(`  Drive folder: ${e.get("DRIVE_FOLDER")??R}`):n==="s3"?t(`  S3 bucket: ${e.get("S3_BUCKET")??"(missing)"}`):n==="fs"&&t(`  FS dir: ${e.get("FS_DIR")??k}`);const i=e.get("KEY_PATH")??(w(h)?h:void 0);if(e.get("KEY_PATH")){const s=_(e.get("KEY_PATH"));t(`  Encryption: on${s?` (fingerprint ${s})`:""}`)}else t("  Encryption: off");const r=O().has("hydra-acp-archiver");return t(`  Registered with hydra: ${r?"yes":"no"}`),o(),await y("Reconfigure from scratch?",!1)?{reconfigure:!0}:(t("Edit ~/.hydra-acp/archiver.conf directly to tune individual settings."),{reconfigure:!1})}async function te(){f(2,u,"Pick a backend");const n=await q("Choose:",[{backend:"google-drive",label:`Google Drive
+           Easiest cross-machine sync. Free up to 15 GB. One-time GCP
+           setup (~5 min in the Cloud Console).`},{backend:"s3",label:`S3 / S3-compatible (R2, B2, MinIO, Wasabi)
+           Best for larger archives. Needs AWS-style creds and an
+           existing bucket.`},{backend:"fs",label:`Filesystem
+           Useful with Syncthing/Dropbox mirroring a folder, or for
+           local-only testing.`}],i=>i.label);return n||g("A backend is required."),c(`Backend: ${n.backend}`),{backend:n.backend}}async function ne(){f(3,u,"Configure Google Drive");const e=x(),n=e.credentialsPath;if(w(n))c(`Google OAuth credentials found at ${n}.`);else{t("First-time setup. You need an OAuth client from Google Cloud Console."),o(),t("  1. Pick or create a project"),t("  2. APIs & Services \u2192 Library \u2192 enable Google Drive API"),t("  3. OAuth consent screen \u2192 User type: External \u2192 add yourself as a Test User"),t("  4. Credentials \u2192 Create credentials \u2192 OAuth client ID \u2192 Application: Desktop app"),t("  5. Download the JSON (lands in ~/Downloads)"),o(),await E("Press Enter to open the Cloud Console..."),J("https://console.cloud.google.com/"),o(),await E("Press Enter once you've downloaded the JSON...");const r=z();let s;if(r&&(o(),t(`Found ${r.path} (${j(r.ageMs)}).`),await y("Use this file?",!0)&&(s=r.path)),!s){o();const a=await l("Path to the downloaded JSON");a||g("A credentials file is required."),s=a.startsWith("~/")?a.replace(/^~/,v()):a}w(s)||g(`File not found: ${s}`),A($,{recursive:!0}),I(s,n);try{const{chmodSync:a}=await import("node:fs");a(n,384)}catch{}c(`Saved to ${n} (chmod 600).`)}o();const i=await l("Drive folder name",R);o(),t("Now we run Google's OAuth flow. Your browser will open to a consent"),t("screen. The 'Google hasn't verified this app' interstitial is expected"),t("for a personal OAuth client \u2014 click 'Advanced' \u2192 'Go to (unsafe)' \u2192 'Allow'."),o(),await E("Press Enter to start OAuth...");try{await Y({credentialsPath:n,tokenPath:e.tokenPath})}catch(r){g(`Google OAuth failed: ${r.message}`)}return c(`OAuth complete. Token saved to ${e.tokenPath}.`),{driveFolder:i,credentialsPath:n}}async function ie(){f(3,u,"Configure S3"),o(),t("S3 endpoint hints:"),t(`  ${S}AWS S3${d}        leave Endpoint blank, set Region`),t(`  ${S}Cloudflare R2${d} https://<accountid>.r2.cloudflarestorage.com`),t(`  ${S}Backblaze B2${d}  https://s3.<region>.backblazeb2.com`),t(`  ${S}MinIO${d}         your MinIO endpoint URL`),o();const e=await l("S3 bucket name");e||g("A bucket name is required for S3.");const n=await l("Region (blank for SDK default)")||void 0,i=await l("Endpoint URL (blank for AWS S3)")||void 0;o();try{const r=U(),s=`${r.accessKeyId.slice(0,4)}\u2026${r.accessKeyId.slice(-4)}`,a=process.env.AWS_ACCESS_KEY_ID?"env vars":`~/.aws/credentials (profile: ${process.env.AWS_PROFILE??"default"})`;c(`AWS creds found via ${a} \u2014 access key ${s}.`)}catch(r){m(`${r.message}`),t("The archiver will fail to start until creds are in place.")}return{bucket:e,region:n,endpoint:i}}async function re(){f(3,u,"Configure Filesystem");const e=[];for(const i of["Syncthing","Dropbox","iCloud Drive","OneDrive"]){const r=p(v(),i);w(r)&&e.push(r)}let n;if(e.length>0){t("Found sync folders that could host the archive:"),o(),e.forEach((r,s)=>t(`  ${s+1}. ${r}/hydra-acp-archive`)),t("  c. Custom path"),t(`  d. Default (${k})`),o();const i=(await l("Choice","d")).toLowerCase();if(i==="d"||i==="")n=k;else if(i==="c"){const r=await l("Archive directory",k);n=r.startsWith("~/")?r.replace(/^~/,v()):r}else{const r=Number.parseInt(i,10);Number.isInteger(r)&&r>=1&&r<=e.length&&(n=p(e[r-1],"hydra-acp-archive"))}n||g("Invalid choice.")}else{const i=await l("Archive directory",k);n=i.startsWith("~/")?i.replace(/^~/,v()):i}try{A(n,{recursive:!0});const i=p(n,".hydra-acp-archiver-test");N(i,"ok"),B(i),c(`Directory writable: ${n}`)}catch(i){g(`Cannot write to ${n}: ${i.message}`)}return{dir:n}}async function oe(e){f(4,u,"Encryption");const n=e!=="fs";if(t(e==="fs"?"Filesystem backend \u2014 encryption is optional (you already control the disk).":`${e==="google-drive"?"Google Drive":"S3"} backend \u2014 encryption is recommended (data leaves your machine).`),o(),!await y("Enable AES-256-GCM encryption at rest?",n))return{enabled:!1,keyPath:void 0};const i=_(h);if(i){if(t(`Existing key at ${h} (fingerprint ${i}).`),await y("Use this key?",!0))return{enabled:!0,keyPath:h};if(o(),m("Rotating the key makes the existing archive unreadable until re-uploaded."),!await y("Generate a new key (overwrites the existing file)?",!1))return{enabled:!0,keyPath:h}}return o(),await W(),o(),t(`Copy ${h} to each machine that should share this archive.`),{enabled:!0,keyPath:h}}async function se(e){f(5,u,"Writing config");const n=x(),i={BACKEND:e.backend};e.backend==="google-drive"&&e.google?(e.google.driveFolder!==R&&(i.DRIVE_FOLDER=e.google.driveFolder),e.google.credentialsPath!==n.credentialsPath&&(i.GOOGLE_CREDENTIALS=e.google.credentialsPath)):e.backend==="s3"&&e.s3?(i.S3_BUCKET=e.s3.bucket,e.s3.region&&(i.S3_REGION=e.s3.region),e.s3.endpoint&&(i.S3_ENDPOINT=e.s3.endpoint)):e.backend==="fs"&&e.fs&&e.fs.dir!==k&&(i.FS_DIR=e.fs.dir),e.encryption.enabled&&e.encryption.keyPath&&(i.KEY_PATH=e.encryption.keyPath),M(b,i),c(`Wrote ${b} (chmod 600).`),o(),t("Final config:");const{map:r}=C(b);for(const[s,a]of r)t(`  ${s}=${a}`)}async function ae(){if(f(6,u,"Register with hydra (optional)"),!F("hydra-acp")){t("hydra-acp not found on PATH. Register manually later with:"),t("  hydra-acp extensions add hydra-acp-archiver");return}if(O().has("hydra-acp-archiver")){c("Already registered as a hydra extension."),t("Restart the daemon to pick up the new config: hydra-acp daemon restart");return}if(t("hydra can manage hydra-acp-archiver as a subprocess that auto-starts"),t("with the daemon. This adds an entry to ~/.hydra-acp/config.json."),o(),!await y("Register hydra-acp-archiver as a hydra extension?",!0)){t("Skipping. Register later with:"),t("  hydra-acp extensions add hydra-acp-archiver");return}const e=["extensions","add","hydra-acp-archiver"];if(!F("hydra-acp-archiver")){const i=process.argv[1]??"";if(!i)m("Couldn't determine script path; falling back to bare command.");else if(i.includes("/.npm/_npx/")){m("Looks like you're running via npx \u2014 registering this transient path"),m("would break on the next npx cache cleanup. Install globally first:"),t("  npm install -g @hydra-acp/archiver"),t("Then register with: hydra-acp extensions add hydra-acp-archiver");return}else e.push("--command","node","--args",i)}t(`Running: hydra-acp ${e.join(" ")}`);const n=G("hydra-acp",e,{stdio:"inherit"});n.status===0?(c("Registered."),t("Start the daemon (or restart if already running): hydra-acp daemon restart")):(o(),m(`hydra-acp exited with code ${n.status??"?"}.`),t("Register manually later with:"),t(`  hydra-acp ${e.join(" ")}`))}async function Se(){if(process.stdout.write(`
+  ${D}hydra-acp-archiver setup${d}
+`),!(await ee()).reconfigure)return;const{backend:n}=await te();let i,r,s;n==="google-drive"?i=await ne():n==="s3"?r=await ie():s=await re();const a=await oe(n);await se({backend:n,google:i,s3:r,fs:s,encryption:a}),await ae(),o(),c("Setup complete.")}export{Se as runSetup};

package/dist/state.js

@@ -1,129 +1 @@
-import { mkdir, readFile, rename, writeFile } from "node:fs/promises";
-import { dirname } from "node:path";
-import { logger } from "./util/log.js";
-const log = logger("state");
-function emptyState(appVersion, prefix, backend) {
-    return { appVersion, prefix, backend, lineages: {} };
-}
-// All writes go through a single in-process queue so concurrent
-// setLineageState calls don't interleave their read-modify-write cycles
-// and lose updates. Cross-process safety is out of scope — only one
-// archiver runs per hydra daemon.
-export class SyncState {
-    path;
-    cache;
-    writeChain = Promise.resolve();
-    constructor(path) {
-        this.path = path;
-    }
-    async load(appVersion, prefix, backend) {
-        try {
-            const text = await readFile(this.path, "utf8");
-            const parsed = JSON.parse(text);
-            if (!parsed.lineages) {
-                log.warn(`state file at ${this.path} had unexpected shape; ignoring`);
-                this.cache = emptyState(appVersion, prefix, backend);
-                return;
-            }
-            const storedVersion = parsed.appVersion;
-            const storedPrefix = parsed.prefix;
-            const storedBackend = parsed.backend;
-            this.cache = parsed;
-            this.cache.appVersion = appVersion;
-            this.cache.prefix = prefix;
-            this.cache.backend = backend;
-            const versionChanged = storedVersion !== appVersion;
-            const namespaceChanged = storedPrefix !== prefix || storedBackend !== backend;
-            if (versionChanged || namespaceChanged) {
-                if (versionChanged) {
-                    log.info(`version changed (${storedVersion ?? "?"} → ${appVersion}); resetting pull state`);
-                }
-                if (namespaceChanged) {
-                    log.info(`namespace changed (${storedBackend ?? "?"}:${storedPrefix ?? "none"} → ${backend}:${prefix}); resetting pull state`);
-                }
-                for (const entry of Object.values(this.cache.lineages)) {
-                    delete entry.lastSeenRemoteUploadedAt;
-                    delete entry.lastSeenRemoteBy;
-                    delete entry.importedSessionId;
-                }
-                await this.flush();
-            }
-        }
-        catch (err) {
-            const e = err;
-            if (e.code === "ENOENT") {
-                this.cache = emptyState(appVersion, prefix, backend);
-                return;
-            }
-            log.warn(`failed to read ${this.path}: ${e.message}; starting fresh`);
-            this.cache = emptyState(appVersion, prefix, backend);
-        }
-    }
-    get(lineageId) {
-        if (!this.cache) {
-            throw new Error("SyncState.get called before load()");
-        }
-        return this.cache.lineages[lineageId] ?? {};
-    }
-    set(lineageId, patch) {
-        if (!this.cache) {
-            throw new Error("SyncState.set called before load()");
-        }
-        const prev = this.cache.lineages[lineageId] ?? {};
-        this.cache.lineages[lineageId] = { ...prev, ...patch };
-        return this.flush();
-    }
-    lineageIds() {
-        if (!this.cache)
-            throw new Error("SyncState.lineageIds called before load()");
-        return Object.keys(this.cache.lineages);
-    }
-    // Clear pull-side state for a lineage whose imported session was deleted,
-    // so the pull loop will treat the next peer envelope as unseen.
-    async resetImport(lineageId) {
-        if (!this.cache)
-            throw new Error("SyncState.resetImport called before load()");
-        const entry = this.cache.lineages[lineageId];
-        if (!entry)
-            return;
-        delete entry.lastSeenRemoteUploadedAt;
-        delete entry.lastSeenRemoteBy;
-        delete entry.importedSessionId;
-        return this.flush();
-    }
-    // Drop any lineage entry whose key isn't present on the backend.
-    // Called once at startup so that a wiped backend (Drive nuke, retention
-    // delete, etc.) doesn't leave us with stale "I already uploaded" beliefs
-    // — the next flush re-uploads from scratch. State stays a hint cache;
-    // the backend stays the source of truth.
-    async reconcile(presentLineageIds) {
-        if (!this.cache) {
-            throw new Error("SyncState.reconcile called before load()");
-        }
-        let pruned = 0;
-        for (const id of Object.keys(this.cache.lineages)) {
-            if (!presentLineageIds.has(id)) {
-                delete this.cache.lineages[id];
-                pruned += 1;
-            }
-        }
-        if (pruned > 0) {
-            await this.flush();
-        }
-        return pruned;
-    }
-    flush() {
-        const snapshot = JSON.stringify(this.cache, null, 2);
-        const next = this.writeChain.then(async () => {
-            await mkdir(dirname(this.path), { recursive: true });
-            const tmp = `${this.path}.tmp`;
-            await writeFile(tmp, snapshot, { mode: 0o600 });
-            await rename(tmp, this.path);
-        });
-        this.writeChain = next.catch((err) => {
-            log.warn(`failed to persist ${this.path}: ${err.message}`);
-        });
-        return next;
-    }
-}
-//# sourceMappingURL=state.js.map
+import{mkdir as p,readFile as m,rename as S,writeFile as u}from"node:fs/promises";import{dirname as w}from"node:path";import{logger as y}from"./util/log.js";const a=y("state");function o(c,t,e){return{appVersion:c,prefix:t,backend:e,lineages:{}}}class P{constructor(t){this.path=t}path;cache;writeChain=Promise.resolve();async load(t,e,s){try{const r=await m(this.path,"utf8"),i=JSON.parse(r);if(!i.lineages){a.warn(`state file at ${this.path} had unexpected shape; ignoring`),this.cache=o(t,e,s);return}const h=i.appVersion,l=i.prefix,d=i.backend;this.cache=i,this.cache.appVersion=t,this.cache.prefix=e,this.cache.backend=s;const g=h!==t,f=l!==e||d!==s;if(g||f){g&&a.info(`version changed (${h??"?"} \u2192 ${t}); resetting pull state`),f&&a.info(`namespace changed (${d??"?"}:${l??"none"} \u2192 ${s}:${e}); resetting pull state`);for(const n of Object.values(this.cache.lineages))delete n.lastSeenRemoteUploadedAt,delete n.lastSeenRemoteBy,delete n.importedSessionId;await this.flush()}}catch(r){const i=r;if(i.code==="ENOENT"){this.cache=o(t,e,s);return}a.warn(`failed to read ${this.path}: ${i.message}; starting fresh`),this.cache=o(t,e,s)}}get(t){if(!this.cache)throw new Error("SyncState.get called before load()");return this.cache.lineages[t]??{}}set(t,e){if(!this.cache)throw new Error("SyncState.set called before load()");const s=this.cache.lineages[t]??{};return this.cache.lineages[t]={...s,...e},this.flush()}lineageIds(){if(!this.cache)throw new Error("SyncState.lineageIds called before load()");return Object.keys(this.cache.lineages)}async resetImport(t){if(!this.cache)throw new Error("SyncState.resetImport called before load()");const e=this.cache.lineages[t];if(e)return delete e.lastSeenRemoteUploadedAt,delete e.lastSeenRemoteBy,delete e.importedSessionId,this.flush()}async reconcile(t){if(!this.cache)throw new Error("SyncState.reconcile called before load()");let e=0;for(const s of Object.keys(this.cache.lineages))t.has(s)||(delete this.cache.lineages[s],e+=1);return e>0&&await this.flush(),e}flush(){const t=JSON.stringify(this.cache,null,2),e=this.writeChain.then(async()=>{await p(w(this.path),{recursive:!0});const s=`${this.path}.tmp`;await u(s,t,{mode:384}),await S(s,this.path)});return this.writeChain=e.catch(s=>{a.warn(`failed to persist ${this.path}: ${s.message}`)}),e}}export{P as SyncState};

package/dist/util/aws-credentials.js

@@ -1,82 +1 @@
-import { readFileSync } from "node:fs";
-import { homedir } from "node:os";
-import { resolve } from "node:path";
-function parseIni(text) {
-    const sections = new Map();
-    let current;
-    for (const raw of text.split(/\r?\n/)) {
-        const line = raw.trim();
-        if (!line || line.startsWith("#") || line.startsWith(";"))
-            continue;
-        if (line.startsWith("[") && line.endsWith("]")) {
-            // config file uses "[profile name]", credentials file uses "[name]"
-            const name = line.slice(1, -1).trim().replace(/^profile\s+/, "");
-            current = new Map();
-            sections.set(name, current);
-        }
-        else if (current) {
-            const eq = line.indexOf("=");
-            if (eq >= 0)
-                current.set(line.slice(0, eq).trim(), line.slice(eq + 1).trim());
-        }
-    }
-    return sections;
-}
-function readSection(path, profile) {
-    try {
-        return parseIni(readFileSync(path, "utf8")).get(profile);
-    }
-    catch {
-        return undefined;
-    }
-}
-// Credential chain: env vars > ~/.aws/credentials > ~/.aws/config
-export function loadAwsCredentials(profile) {
-    const profileName = profile ??
-        process.env.AWS_PROFILE ??
-        process.env.AWS_DEFAULT_PROFILE ??
-        "default";
-    const envKey = process.env.AWS_ACCESS_KEY_ID;
-    const envSecret = process.env.AWS_SECRET_ACCESS_KEY;
-    if (envKey && envSecret) {
-        return {
-            accessKeyId: envKey,
-            secretAccessKey: envSecret,
-            sessionToken: process.env.AWS_SESSION_TOKEN,
-        };
-    }
-    const home = homedir();
-    const credsPath = process.env.AWS_SHARED_CREDENTIALS_FILE ??
-        resolve(home, ".aws", "credentials");
-    const cfgPath = process.env.AWS_CONFIG_FILE ?? resolve(home, ".aws", "config");
-    const creds = readSection(credsPath, profileName);
-    const cfg = readSection(cfgPath, profileName);
-    const accessKeyId = creds?.get("aws_access_key_id") ?? cfg?.get("aws_access_key_id");
-    const secretAccessKey = creds?.get("aws_secret_access_key") ?? cfg?.get("aws_secret_access_key");
-    if (!accessKeyId || !secretAccessKey) {
-        throw new Error(`No AWS credentials found for profile "${profileName}". ` +
-            `Set AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY, or configure ~/.aws/credentials.`);
-    }
-    return {
-        accessKeyId,
-        secretAccessKey,
-        sessionToken: creds?.get("aws_session_token") ?? cfg?.get("aws_session_token"),
-    };
-}
-// Region resolution: explicit > env vars > ~/.aws/config > us-east-1
-export function resolveRegion(explicit, profile) {
-    if (explicit)
-        return explicit;
-    if (process.env.AWS_REGION)
-        return process.env.AWS_REGION;
-    if (process.env.AWS_DEFAULT_REGION)
-        return process.env.AWS_DEFAULT_REGION;
-    const profileName = profile ??
-        process.env.AWS_PROFILE ??
-        process.env.AWS_DEFAULT_PROFILE ??
-        "default";
-    const cfgPath = process.env.AWS_CONFIG_FILE ??
-        resolve(homedir(), ".aws", "config");
-    return readSection(cfgPath, profileName)?.get("region") ?? "us-east-1";
-}
-//# sourceMappingURL=aws-credentials.js.map
+import{readFileSync as A}from"node:fs";import{homedir as S}from"node:os";import{resolve as a}from"node:path";function E(t){const s=new Map;let n;for(const c of t.split(/\r?\n/)){const e=c.trim();if(!(!e||e.startsWith("#")||e.startsWith(";"))){if(e.startsWith("[")&&e.endsWith("]")){const r=e.slice(1,-1).trim().replace(/^profile\s+/,"");n=new Map,s.set(r,n)}else if(n){const r=e.indexOf("=");r>=0&&n.set(e.slice(0,r).trim(),e.slice(r+1).trim())}}}return s}function _(t,s){try{return E(A(t,"utf8")).get(s)}catch{return}}function I(t){const s=t??process.env.AWS_PROFILE??process.env.AWS_DEFAULT_PROFILE??"default",n=process.env.AWS_ACCESS_KEY_ID,c=process.env.AWS_SECRET_ACCESS_KEY;if(n&&c)return{accessKeyId:n,secretAccessKey:c,sessionToken:process.env.AWS_SESSION_TOKEN};const e=S(),r=process.env.AWS_SHARED_CREDENTIALS_FILE??a(e,".aws","credentials"),p=process.env.AWS_CONFIG_FILE??a(e,".aws","config"),i=_(r,s),o=_(p,s),f=i?.get("aws_access_key_id")??o?.get("aws_access_key_id"),g=i?.get("aws_secret_access_key")??o?.get("aws_secret_access_key");if(!f||!g)throw new Error(`No AWS credentials found for profile "${s}". Set AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY, or configure ~/.aws/credentials.`);return{accessKeyId:f,secretAccessKey:g,sessionToken:i?.get("aws_session_token")??o?.get("aws_session_token")}}function W(t,s){if(t)return t;if(process.env.AWS_REGION)return process.env.AWS_REGION;if(process.env.AWS_DEFAULT_REGION)return process.env.AWS_DEFAULT_REGION;const n=s??process.env.AWS_PROFILE??process.env.AWS_DEFAULT_PROFILE??"default",c=process.env.AWS_CONFIG_FILE??a(S(),".aws","config");return _(c,n)?.get("region")??"us-east-1"}export{I as loadAwsCredentials,W as resolveRegion};