@kdonev/termscape 0.1.0

package/dist/remote/deployer.js

@@ -0,0 +1,216 @@
+import { createServer } from 'node:net';
+import { readFileSync } from 'node:fs';
+import { basename } from 'node:path';
+import { Client as SshClient } from 'ssh2';
+const DEFAULT_REMOTE_DIR = '~/.termscape';
+function connectConfig(c) {
+    const cfg = {
+        host: c.sshHost,
+        port: c.sshPort,
+        username: c.sshUser,
+        readyTimeout: 20_000,
+    };
+    if (c.privateKeyPath) {
+        cfg.privateKey = readFileSync(c.privateKeyPath);
+        if (c.passphrase)
+            cfg.passphrase = c.passphrase;
+    }
+    else {
+        // Fall back to the user's running SSH agent, which is how most people
+        // already authenticate; we never prompt for or store a password.
+        cfg.agent = process.env.SSH_AUTH_SOCK ?? (process.platform === 'win32' ? 'pageant' : undefined);
+    }
+    return cfg;
+}
+export function sshConnect(c) {
+    return new Promise((resolve, reject) => {
+        const conn = new SshClient();
+        conn.on('ready', () => resolve(conn));
+        conn.on('error', (err) => reject(new Error(`ssh ${c.sshUser}@${c.sshHost}: ${err.message}`)));
+        conn.connect(connectConfig(c));
+    });
+}
+export function exec(conn, command) {
+    return new Promise((resolve, reject) => {
+        conn.exec(command, (err, stream) => {
+            if (err)
+                return reject(err);
+            let stdout = '';
+            let stderr = '';
+            stream.on('data', (d) => (stdout += d.toString()));
+            stream.stderr.on('data', (d) => (stderr += d.toString()));
+            stream.on('close', (code) => resolve({ code: code ?? 0, stdout, stderr }));
+        });
+    });
+}
+/** What is already on the remote machine, before we change anything. */
+export async function probe(conn, remoteDir = DEFAULT_REMOTE_DIR) {
+    const node = await exec(conn, 'node --version 2>/dev/null || true');
+    const nodeVersion = node.stdout.trim() || null;
+    const nodeMajor = nodeVersion ? Number(nodeVersion.replace(/^v/, '').split('.')[0]) : 0;
+    const installed = await exec(conn, `cat ${remoteDir}/hub/package.json 2>/dev/null | grep '"version"' || true`);
+    const m = installed.stdout.match(/"version"\s*:\s*"([^"]+)"/);
+    return { nodeVersion, nodeMajor, installedVersion: m?.[1] ?? null };
+}
+async function upload(conn, localPath, remotePath) {
+    return new Promise((resolve, reject) => {
+        conn.sftp((err, sftp) => {
+            if (err)
+                return reject(err);
+            sftp.fastPut(localPath, remotePath, (e) => (e ? reject(e) : resolve()));
+        });
+    });
+}
+/**
+ * Install or upgrade the hub on the remote machine. Native modules are rebuilt
+ * there, because node-pty and better-sqlite3 prebuilds are per platform and
+ * per architecture and the remote is frequently neither.
+ */
+export async function provision(conn, opts) {
+    const remoteDir = opts.remoteDir ?? DEFAULT_REMOTE_DIR;
+    const log = opts.log ?? (() => { });
+    if (!opts.packagePath) {
+        throw new Error('remote hub is missing or out of date and no package tarball was supplied; ' +
+            'run `npm pack -w @termscape/hub` and pass its path');
+    }
+    const tarball = basename(opts.packagePath);
+    log(`uploading ${tarball}`);
+    await exec(conn, `mkdir -p ${remoteDir}`);
+    await upload(conn, opts.packagePath, `${remoteDir}/${tarball}`);
+    log('installing on remote');
+    // The dependency tree is the slowest thing to rebuild over there and the
+    // tarball never carries one, so it is moved aside rather than deleted along
+    // with the install it lives in.
+    await exec(conn, `cd ${remoteDir} && rm -rf node_modules.kept` +
+        ` && if [ -d hub/node_modules ]; then mv hub/node_modules node_modules.kept; fi` +
+        ` && rm -rf hub && mkdir -p hub && tar xzf ${tarball} -C hub --strip-components=1` +
+        ` && if [ -d node_modules.kept ]; then mv node_modules.kept hub/node_modules; fi`);
+    // What the tree already there has to match to be worth keeping: the
+    // fingerprint the tarball shipped, plus the two things it cannot know - the
+    // Node ABI those modules were built against, and the platform.
+    const stamp = `"$(cat deps.fingerprint 2>/dev/null || echo none)-` +
+        `$(node -p 'process.versions.node.split(".")[0] + "-" + process.platform + "-" + process.arch')"`;
+    // The stamp claims the tree still works; the require confirms it does.
+    // Trusting the stamp alone would trade a slow deploy for a remote hub that
+    // cannot load its own modules.
+    const reusable = await exec(conn, `cd ${remoteDir}/hub && [ -d node_modules ]` +
+        ` && [ "$(cat ../deps.stamp 2>/dev/null)" = ${stamp} ]` +
+        ` && node -e 'require("node-pty"); require("better-sqlite3")'`);
+    if (reusable.code === 0) {
+        log('dependencies unchanged; keeping the modules already there');
+        return;
+    }
+    // A half-finished tree must not inherit the last deploy's stamp.
+    await exec(conn, `rm -f ${remoteDir}/deps.stamp`);
+    // Prebuilt binaries first: node-pty and better-sqlite3 publish them for the
+    // mainstream platforms, and downloading one beats compiling it every time.
+    let install = await exec(conn, `cd ${remoteDir}/hub && npm install --omit=dev --no-audit --no-fund 2>&1 | tail -20`);
+    if (install.code !== 0) {
+        log('no prebuilt binaries for this platform; compiling instead');
+        install = await exec(conn, `cd ${remoteDir}/hub && npm install --omit=dev --no-audit --no-fund --build-from-source 2>&1 | tail -20`);
+    }
+    if (install.code !== 0) {
+        throw new Error(`remote install failed (exit ${install.code}). This host has no prebuilt ` +
+            `binaries and no C++ toolchain for node-pty and better-sqlite3.\n` +
+            `${install.stdout}\n${install.stderr}`);
+    }
+    await exec(conn, `cd ${remoteDir}/hub && printf '%s' ${stamp} > ../deps.stamp`);
+    log('installed');
+}
+/**
+ * Start the remote hub detached, so it outlives this SSH session — the whole
+ * reason for running a daemon instead of an ssh subprocess.
+ */
+export async function startRemoteHub(conn, opts) {
+    const remoteDir = opts.remoteDir ?? DEFAULT_REMOTE_DIR;
+    const logFile = `${remoteDir}/hub.log`;
+    // Reuse an already-running daemon rather than starting a second one.
+    const existing = await exec(conn, `cat ${remoteDir}/hub.port 2>/dev/null || true`);
+    const existingPort = Number(existing.stdout.trim());
+    if (existingPort > 0) {
+        const alive = await exec(conn, `curl -s -m 2 http://127.0.0.1:${existingPort}/health || true`);
+        const m = alive.stdout.match(/"hubVersion"\s*:\s*"([^"]+)"/);
+        if (m)
+            return { port: existingPort, version: m[1] };
+    }
+    await exec(conn, `cd ${remoteDir}/hub && TERMSCAPE_HOME=${remoteDir} nohup node dist/cli.js --headless --port 0 --token '${opts.token}' > ${logFile} 2>&1 &`);
+    // The CLI prints TERMSCAPE_PORT=<n> precisely so this can be parsed.
+    for (let i = 0; i < 40; i++) {
+        await new Promise((r) => setTimeout(r, 250));
+        const out = await exec(conn, `grep -m1 TERMSCAPE_PORT= ${logFile} 2>/dev/null || true`);
+        const m = out.stdout.match(/TERMSCAPE_PORT=(\d+)/);
+        if (m) {
+            const port = Number(m[1]);
+            await exec(conn, `echo ${port} > ${remoteDir}/hub.port`);
+            const v = await exec(conn, `curl -s -m 3 http://127.0.0.1:${port}/health || true`);
+            const vm = v.stdout.match(/"hubVersion"\s*:\s*"([^"]+)"/);
+            return { port, version: vm?.[1] ?? 'unknown' };
+        }
+    }
+    const tail = await exec(conn, `tail -30 ${logFile} 2>/dev/null || true`);
+    throw new Error(`remote hub did not report a port.\n${tail.stdout}`);
+}
+/**
+ * Local TCP listener that pipes every connection through the SSH channel to
+ * the remote hub's loopback port. Gives us a plain ws:// URL to hand the peer
+ * client, which keeps SSH entirely out of the peer protocol.
+ */
+export function openTunnel(conn, remotePort) {
+    return new Promise((resolve, reject) => {
+        const server = createServer((socket) => {
+            conn.forwardOut('127.0.0.1', 0, '127.0.0.1', remotePort, (err, stream) => {
+                if (err) {
+                    socket.destroy();
+                    return;
+                }
+                socket.pipe(stream).pipe(socket);
+                stream.on('error', () => socket.destroy());
+                socket.on('error', () => stream.destroy());
+            });
+        });
+        server.on('error', reject);
+        // Loopback only: the tunnel entrance must not be reachable from the network.
+        server.listen(0, '127.0.0.1', () => {
+            const addr = server.address();
+            if (!addr || typeof addr === 'string')
+                return reject(new Error('tunnel bind failed'));
+            resolve({ localPort: addr.port, server });
+        });
+    });
+}
+/** Probe, provision if needed, start, and tunnel. */
+export async function deploy(opts) {
+    const log = opts.log ?? (() => { });
+    const conn = await sshConnect(opts);
+    try {
+        const p = await probe(conn, opts.remoteDir);
+        if (!p.nodeVersion) {
+            throw new Error('no node on the remote host; install Node 22 or newer there first');
+        }
+        if (p.nodeMajor < 22) {
+            throw new Error(`remote node is ${p.nodeVersion}; this hub needs Node 22 or newer`);
+        }
+        log(`remote node ${p.nodeVersion}, hub ${p.installedVersion ?? 'not installed'}`);
+        if (p.installedVersion !== opts.expectedVersion) {
+            await provision(conn, opts);
+        }
+        const { port, version } = await startRemoteHub(conn, opts);
+        log(`remote hub ${version} on 127.0.0.1:${port}`);
+        const { localPort, server } = await openTunnel(conn, port);
+        log(`tunnel ready on 127.0.0.1:${localPort}`);
+        return {
+            localUrl: `ws://127.0.0.1:${localPort}/peer`,
+            remotePort: port,
+            remoteHubVersion: version,
+            dispose: async () => {
+                await new Promise((res) => server.close(() => res()));
+                conn.end();
+            },
+        };
+    }
+    catch (err) {
+        conn.end();
+        throw err;
+    }
+}
+//# sourceMappingURL=deployer.js.map

package/dist/remote/deployer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"deployer.js","sourceRoot":"","sources":["../../src/remote/deployer.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAA4B,MAAM,UAAU,CAAC;AAClE,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AACrC,OAAO,EAAE,MAAM,IAAI,SAAS,EAAsB,MAAM,MAAM,CAAC;AA0C/D,MAAM,kBAAkB,GAAG,cAAc,CAAC;AAE1C,SAAS,aAAa,CAAC,CAAkB;IACvC,MAAM,GAAG,GAAkB;QACzB,IAAI,EAAE,CAAC,CAAC,OAAO;QACf,IAAI,EAAE,CAAC,CAAC,OAAO;QACf,QAAQ,EAAE,CAAC,CAAC,OAAO;QACnB,YAAY,EAAE,MAAM;KACrB,CAAC;IACF,IAAI,CAAC,CAAC,cAAc,EAAE,CAAC;QACrB,GAAG,CAAC,UAAU,GAAG,YAAY,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC;QAChD,IAAI,CAAC,CAAC,UAAU;YAAE,GAAG,CAAC,UAAU,GAAG,CAAC,CAAC,UAAU,CAAC;IAClD,CAAC;SAAM,CAAC;QACN,sEAAsE;QACtE,iEAAiE;QACjE,GAAG,CAAC,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,aAAa,IAAI,CAAC,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IAClG,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,CAAkB;IAC3C,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,IAAI,GAAG,IAAI,SAAS,EAAE,CAAC;QAC7B,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;QACtC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,OAAO,KAAK,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC;QAC9F,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC;IACjC,CAAC,CAAC,CAAC;AACL,CAAC;AAQD,MAAM,UAAU,IAAI,CAAC,IAAe,EAAE,OAAe;IACnD,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,EAAE;YACjC,IAAI,GAAG;gBAAE,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC;YAC5B,IAAI,MAAM,GAAG,EAAE,CAAC;YAChB,IAAI,MAAM,GAAG,EAAE,CAAC;YAChB,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC;YAC3D,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC;YAClE,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAY,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;QACrF,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAQD,wEAAwE;AACxE,MAAM,CAAC,KAAK,UAAU,KAAK,CAAC,IAAe,EAAE,SAAS,GAAG,kBAAkB;IACzE,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,oCAAoC,CAAC,CAAC;IACpE,MAAM,WAAW,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,IAAI,CAAC;IAC/C,MAAM,SAAS,GAAG,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAExF,MAAM,SAAS,GAAG,MAAM,IAAI,CAC1B,IAAI,EACJ,OAAO,SAAS,0DAA0D,CAC3E,CAAC;IACF,MAAM,CAAC,GAAG,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC,2BAA2B,CAAC,CAAC;IAC9D,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,gBAAgB,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC;AACtE,CAAC;AAED,KAAK,UAAU,MAAM,CAAC,IAAe,EAAE,SAAiB,EAAE,UAAkB;IAC1E,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE;YACtB,IAAI,GAAG;gBAAE,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC;YAC5B,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,UAAU,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;QAC1E,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,IAAe,EACf,IAAmB;IAEnB,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,kBAAkB,CAAC;IACvD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IACnC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CACb,4EAA4E;YAC1E,oDAAoD,CACvD,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IAC3C,GAAG,CAAC,aAAa,OAAO,EAAE,CAAC,CAAC;IAC5B,MAAM,IAAI,CAAC,IAAI,EAAE,YAAY,SAAS,EAAE,CAAC,CAAC;IAC1C,MAAM,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,WAAW,EAAE,GAAG,SAAS,IAAI,OAAO,EAAE,CAAC,CAAC;IAEhE,GAAG,CAAC,sBAAsB,CAAC,CAAC;IAC5B,yEAAyE;IACzE,4EAA4E;IAC5E,gCAAgC;IAChC,MAAM,IAAI,CACR,IAAI,EACJ,MAAM,SAAS,8BAA8B;QAC3C,gFAAgF;QAChF,6CAA6C,OAAO,8BAA8B;QAClF,iFAAiF,CACpF,CAAC;IAEF,oEAAoE;IACpE,4EAA4E;IAC5E,+DAA+D;IAC/D,MAAM,KAAK,GACT,oDAAoD;QACpD,iGAAiG,CAAC;IAEpG,uEAAuE;IACvE,2EAA2E;IAC3E,+BAA+B;IAC/B,MAAM,QAAQ,GAAG,MAAM,IAAI,CACzB,IAAI,EACJ,MAAM,SAAS,6BAA6B;QAC1C,8CAA8C,KAAK,IAAI;QACvD,8DAA8D,CACjE,CAAC;IACF,IAAI,QAAQ,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;QACxB,GAAG,CAAC,2DAA2D,CAAC,CAAC;QACjE,OAAO;IACT,CAAC;IAED,iEAAiE;IACjE,MAAM,IAAI,CAAC,IAAI,EAAE,SAAS,SAAS,aAAa,CAAC,CAAC;IAElD,4EAA4E;IAC5E,2EAA2E;IAC3E,IAAI,OAAO,GAAG,MAAM,IAAI,CACtB,IAAI,EACJ,MAAM,SAAS,qEAAqE,CACrF,CAAC;IACF,IAAI,OAAO,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;QACvB,GAAG,CAAC,2DAA2D,CAAC,CAAC;QACjE,OAAO,GAAG,MAAM,IAAI,CAClB,IAAI,EACJ,MAAM,SAAS,yFAAyF,CACzG,CAAC;IACJ,CAAC;IACD,IAAI,OAAO,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CACb,+BAA+B,OAAO,CAAC,IAAI,+BAA+B;YACxE,kEAAkE;YAClE,GAAG,OAAO,CAAC,MAAM,KAAK,OAAO,CAAC,MAAM,EAAE,CACzC,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,CAAC,IAAI,EAAE,MAAM,SAAS,uBAAuB,KAAK,kBAAkB,CAAC,CAAC;IAChF,GAAG,CAAC,WAAW,CAAC,CAAC;AACnB,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,IAAe,EACf,IAAmB;IAEnB,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,kBAAkB,CAAC;IACvD,MAAM,OAAO,GAAG,GAAG,SAAS,UAAU,CAAC;IAEvC,qEAAqE;IACrE,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,OAAO,SAAS,+BAA+B,CAAC,CAAC;IACnF,MAAM,YAAY,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;IACpD,IAAI,YAAY,GAAG,CAAC,EAAE,CAAC;QACrB,MAAM,KAAK,GAAG,MAAM,IAAI,CACtB,IAAI,EACJ,iCAAiC,YAAY,iBAAiB,CAC/D,CAAC;QACF,MAAM,CAAC,GAAG,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,8BAA8B,CAAC,CAAC;QAC7D,IAAI,CAAC;YAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,CAAE,EAAE,CAAC;IACvD,CAAC;IAED,MAAM,IAAI,CACR,IAAI,EACJ,MAAM,SAAS,0BAA0B,SAAS,wDAAwD,IAAI,CAAC,KAAK,OAAO,OAAO,SAAS,CAC5I,CAAC;IAEF,qEAAqE;IACrE,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC;QAC5B,MAAM,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;QAC7C,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,4BAA4B,OAAO,sBAAsB,CAAC,CAAC;QACxF,MAAM,CAAC,GAAG,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,sBAAsB,CAAC,CAAC;QACnD,IAAI,CAAC,EAAE,CAAC;YACN,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YAC1B,MAAM,IAAI,CAAC,IAAI,EAAE,QAAQ,IAAI,MAAM,SAAS,WAAW,CAAC,CAAC;YACzD,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,iCAAiC,IAAI,iBAAiB,CAAC,CAAC;YACnF,MAAM,EAAE,GAAG,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,8BAA8B,CAAC,CAAC;YAC1D,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,SAAS,EAAE,CAAC;QACjD,CAAC;IACH,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,YAAY,OAAO,sBAAsB,CAAC,CAAC;IACzE,MAAM,IAAI,KAAK,CAAC,sCAAsC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;AACvE,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,UAAU,CACxB,IAAe,EACf,UAAkB;IAElB,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,MAAM,GAAG,YAAY,CAAC,CAAC,MAAM,EAAE,EAAE;YACrC,IAAI,CAAC,UAAU,CAAC,WAAW,EAAE,CAAC,EAAE,WAAW,EAAE,UAAU,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,EAAE;gBACvE,IAAI,GAAG,EAAE,CAAC;oBACR,MAAM,CAAC,OAAO,EAAE,CAAC;oBACjB,OAAO;gBACT,CAAC;gBACD,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;gBACjC,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;gBAC3C,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;YAC7C,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QACH,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC3B,6EAA6E;QAC7E,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,WAAW,EAAE,GAAG,EAAE;YACjC,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC;YAC9B,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ;gBAAE,OAAO,MAAM,CAAC,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAC,CAAC;YACtF,OAAO,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;QAC5C,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAED,qDAAqD;AACrD,MAAM,CAAC,KAAK,UAAU,MAAM,CAAC,IAAmB;IAC9C,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IACnC,MAAM,IAAI,GAAG,MAAM,UAAU,CAAC,IAAI,CAAC,CAAC;IAEpC,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,MAAM,KAAK,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;QAC5C,IAAI,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;YACnB,MAAM,IAAI,KAAK,CAAC,kEAAkE,CAAC,CAAC;QACtF,CAAC;QACD,IAAI,CAAC,CAAC,SAAS,GAAG,EAAE,EAAE,CAAC;YACrB,MAAM,IAAI,KAAK,CAAC,kBAAkB,CAAC,CAAC,WAAW,mCAAmC,CAAC,CAAC;QACtF,CAAC;QACD,GAAG,CAAC,eAAe,CAAC,CAAC,WAAW,SAAS,CAAC,CAAC,gBAAgB,IAAI,eAAe,EAAE,CAAC,CAAC;QAElF,IAAI,CAAC,CAAC,gBAAgB,KAAK,IAAI,CAAC,eAAe,EAAE,CAAC;YAChD,MAAM,SAAS,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QAC9B,CAAC;QAED,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,MAAM,cAAc,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QAC3D,GAAG,CAAC,cAAc,OAAO,iBAAiB,IAAI,EAAE,CAAC,CAAC;QAElD,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,MAAM,UAAU,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QAC3D,GAAG,CAAC,6BAA6B,SAAS,EAAE,CAAC,CAAC;QAE9C,OAAO;YACL,QAAQ,EAAE,kBAAkB,SAAS,OAAO;YAC5C,UAAU,EAAE,IAAI;YAChB,gBAAgB,EAAE,OAAO;YACzB,OAAO,EAAE,KAAK,IAAI,EAAE;gBAClB,MAAM,IAAI,OAAO,CAAO,CAAC,GAAG,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;gBAC5D,IAAI,CAAC,GAAG,EAAE,CAAC;YACb,CAAC;SACF,CAAC;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,CAAC,GAAG,EAAE,CAAC;QACX,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC"}

package/dist/remote/enroll.d.ts

@@ -0,0 +1,14 @@
+import type { FastifyInstance } from 'fastify';
+import type { Hub } from '../hub.js';
+export interface EnrollOptions {
+    hub: Hub;
+    /** Origin another machine can reach us on, or null when we are loopback-bound. */
+    enrollOrigin: () => string | null;
+}
+export interface Enrollment {
+    /** Mint a single-use token for one download. */
+    mint(): string;
+    pendingCount(): number;
+}
+export declare function registerEnrollment(app: FastifyInstance, opts: EnrollOptions): Enrollment;
+//# sourceMappingURL=enroll.d.ts.map

package/dist/remote/enroll.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"enroll.d.ts","sourceRoot":"","sources":["../../src/remote/enroll.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,SAAS,CAAC;AAQ/C,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AA0BrC,MAAM,WAAW,aAAa;IAC5B,GAAG,EAAE,GAAG,CAAC;IACT,kFAAkF;IAClF,YAAY,EAAE,MAAM,MAAM,GAAG,IAAI,CAAC;CACnC;AAED,MAAM,WAAW,UAAU;IACzB,gDAAgD;IAChD,IAAI,IAAI,MAAM,CAAC;IACf,YAAY,IAAI,MAAM,CAAC;CACxB;AAED,wBAAgB,kBAAkB,CAChC,GAAG,EAAE,eAAe,EACpB,IAAI,EAAE,aAAa,GAClB,UAAU,CAoKZ"}

package/dist/remote/enroll.js

@@ -0,0 +1,244 @@
+import { randomBytes, randomUUID } from 'node:crypto';
+import { createReadStream } from 'node:fs';
+import { PeerRequest, PEER_SCHEMA_VERSION, } from '../protocol/index.js';
+import { HUB_VERSION } from '../hub.js';
+import { joinScriptPosix, joinScriptPowerShell } from './join-script.js';
+import { hubTarballPath } from './tarball.js';
+/**
+ * The pull half of attaching a machine.
+ *
+ * Instead of this hub reaching out over SSH, the other machine opens this
+ * hub's page, downloads an installer, runs it, and dials back. That inverts
+ * who needs credentials — nobody types an SSH key here — and it puts install
+ * failures in the terminal of the person who can actually fix them.
+ *
+ * Enrollment tokens are single-use and short-lived, and live in memory only.
+ * A hub restart invalidates outstanding downloads, which is the right trade
+ * for a credential that is supposed to be spent within minutes of minting.
+ */
+const ENROLL_TTL_MS = 15 * 60 * 1000;
+/**
+ * Minting is unauthenticated, so it has to be bounded. Nobody has 64 machines
+ * mid-join at once; anything past that is someone hammering the page, and the
+ * oldest unspent token is the safest thing to drop.
+ */
+const MAX_PENDING = 64;
+export function registerEnrollment(app, opts) {
+    const { hub, enrollOrigin } = opts;
+    /** token -> expiry. Single-use: matching deletes. */
+    const pending = new Map();
+    function sweep() {
+        const now = Date.now();
+        for (const [token, expires] of pending) {
+            if (expires <= now)
+                pending.delete(token);
+        }
+    }
+    function mint() {
+        sweep();
+        while (pending.size >= MAX_PENDING) {
+            // Insertion-ordered, so the first key is the oldest still-unspent token.
+            pending.delete(pending.keys().next().value);
+        }
+        const token = randomBytes(24).toString('base64url');
+        pending.set(token, Date.now() + ENROLL_TTL_MS);
+        return token;
+    }
+    function consume(token) {
+        sweep();
+        if (!pending.has(token))
+            return false;
+        pending.delete(token);
+        return true;
+    }
+    /* ------------------------------------------------------------- the page */
+    /**
+     * The one route served without the client token. It is reachable only when
+     * the hub was deliberately bound off loopback, and it exposes nothing but a
+     * command to copy.
+     */
+    app.get('/join', async (_req, reply) => {
+        const origin = enrollOrigin();
+        if (!origin) {
+            return reply
+                .code(404)
+                .type('text/html; charset=utf-8')
+                .send(notReachablePage());
+        }
+        return reply
+            .type('text/html; charset=utf-8')
+            .header('cache-control', 'no-store')
+            .send(joinPage(origin));
+    });
+    app.get('/join.sh', async (_req, reply) => {
+        const origin = enrollOrigin();
+        if (!origin)
+            return reply.code(404).send('# this hub is not reachable from other machines\n');
+        return reply
+            .type('text/x-shellscript; charset=utf-8')
+            .header('cache-control', 'no-store')
+            .send(joinScriptPosix(origin, mint()));
+    });
+    app.get('/join.ps1', async (_req, reply) => {
+        const origin = enrollOrigin();
+        if (!origin)
+            return reply.code(404).send('# this hub is not reachable from other machines\n');
+        return reply
+            .type('text/plain; charset=utf-8')
+            .header('cache-control', 'no-store')
+            .send(joinScriptPowerShell(origin, mint()));
+    });
+    app.get('/hub.tgz', async (_req, reply) => {
+        const tarball = hubTarballPath();
+        if (!tarball) {
+            return reply
+                .code(503)
+                .send('hub package not built; run `npm run build` on the hub machine\n');
+        }
+        return reply.type('application/gzip').send(createReadStream(tarball));
+    });
+    /* --------------------------------------------------------- inbound peers */
+    /**
+     * A host dialling in. It speaks first, exactly as we would if we had dialled
+     * it; the only difference is that its token is an enrollment or host token
+     * rather than one we minted for a deploy.
+     */
+    app.get('/peer-in', { websocket: true }, (socket) => {
+        let settled = false;
+        const reply = (msg) => {
+            if (socket.readyState === socket.OPEN)
+                socket.send(JSON.stringify(msg));
+        };
+        const refuse = (message) => {
+            reply({ t: 'err', id: 'hello', message });
+            socket.close();
+        };
+        const onHello = (raw) => {
+            // Everything after the handshake belongs to the PeerConnection that
+            // adopts this socket, not to us.
+            if (settled)
+                return;
+            let parsed;
+            try {
+                parsed = PeerRequest.safeParse(JSON.parse(raw.toString('utf8')));
+            }
+            catch {
+                return refuse('unparseable hello');
+            }
+            if (!parsed.success || parsed.data.t !== 'hello') {
+                return refuse('expected hello');
+            }
+            const hello = parsed.data;
+            if (hello.schemaVersion !== PEER_SCHEMA_VERSION) {
+                return refuse(`peer schema mismatch: you speak v${hello.schemaVersion}, this hub speaks ` +
+                    `v${PEER_SCHEMA_VERSION}. Re-run the join command to get a matching hub.`);
+            }
+            let host = null;
+            let issuedToken;
+            const known = hub.store.hostByToken(hello.token);
+            if (known) {
+                // A host we have seen before, coming back after a restart or a drop.
+                host = { ...known, hubVersion: hello.hubVersion };
+                hub.store.upsertHost(host);
+            }
+            else if (consume(hello.token)) {
+                if (!hello.enroll)
+                    return refuse('enrollment token used without host details');
+                issuedToken = randomBytes(24).toString('base64url');
+                host = {
+                    id: randomUUID(),
+                    label: hello.enroll.label,
+                    kind: 'enrolled',
+                    sshHost: null,
+                    sshUser: null,
+                    sshPort: 22,
+                    platform: `${hello.enroll.platform}-${hello.enroll.arch}`,
+                    hubVersion: hello.hubVersion,
+                    state: 'connecting',
+                    lastSeenAt: null,
+                    error: null,
+                };
+                hub.store.upsertHost({ ...host, hostToken: issuedToken });
+                hub.emit('host', host);
+            }
+            else {
+                return refuse('unknown or expired enrollment token; open the join page again');
+            }
+            settled = true;
+            reply({
+                t: 'welcome',
+                hubVersion: HUB_VERSION,
+                schemaVersion: PEER_SCHEMA_VERSION,
+                ...(issuedToken ? { hostToken: issuedToken } : {}),
+            });
+            hub.peers.addInbound(host, socket, hello.hubVersion);
+        };
+        socket.on('message', onHello);
+    });
+    return { mint, pendingCount: () => (sweep(), pending.size) };
+}
+/* ------------------------------------------------------------------ pages */
+const PAGE_CSS = `
+  :root { color-scheme: dark; }
+  body {
+    margin: 0; padding: 48px 24px;
+    background: #0a0c10; color: #d5dae2;
+    font: 14px/1.6 ui-sans-serif, system-ui, -apple-system, "Segoe UI", Roboto, sans-serif;
+  }
+  main { max-width: 660px; margin: 0 auto; }
+  h1 { font-size: 22px; font-weight: 600; margin: 0 0 4px; }
+  p.lede { color: #7c8596; margin: 0 0 32px; }
+  h2 { font-size: 12px; text-transform: uppercase; letter-spacing: .08em;
+       color: #7c8596; font-weight: 600; margin: 28px 0 8px; }
+  pre {
+    background: #12161e; border: 1px solid #262d3b; border-radius: 6px;
+    padding: 12px 14px; overflow-x: auto; margin: 0;
+    font: 12.5px/1.5 ui-monospace, SFMono-Regular, Menlo, Consolas, monospace;
+    color: #d5dae2;
+  }
+  .note { color: #7c8596; font-size: 12.5px; margin-top: 10px; }
+  .warn { color: #d8b271; }
+  code { font-family: ui-monospace, SFMono-Regular, Menlo, Consolas, monospace; }
+`;
+function joinPage(origin) {
+    return `<!doctype html>
+<meta charset="utf-8">
+<meta name="viewport" content="width=device-width, initial-scale=1">
+<title>Join this canvas</title>
+<style>${PAGE_CSS}</style>
+<main>
+  <h1>Add this machine to the canvas</h1>
+  <p class="lede">Run one of these here. It installs the hub under
+    <code>~/.termscape</code> and connects back to <code>${escapeHtml(origin)}</code>.</p>
+
+  <h2>macOS &middot; Linux</h2>
+  <pre>curl -fsSL ${escapeHtml(origin)}/join.sh | sh</pre>
+
+  <h2>Windows (PowerShell)</h2>
+  <pre>irm ${escapeHtml(origin)}/join.ps1 | iex</pre>
+
+  <p class="note">Needs Node 22 or newer. The installer says exactly what is
+    missing before it changes anything.</p>
+  <p class="note warn">Each download carries its own single-use key, good for
+    15 minutes. Run the command soon after copying it.</p>
+</main>
+`;
+}
+function notReachablePage() {
+    return `<!doctype html>
+<meta charset="utf-8">
+<title>Not reachable</title>
+<style>${PAGE_CSS}</style>
+<main>
+  <h1>This hub is bound to loopback</h1>
+  <p class="lede">Nothing outside this machine can reach it, so there is
+    nothing to join yet.</p>
+  <p class="note">Restart the hub with <code>--listen lan</code> to make it
+    reachable on your local network, then reload this page.</p>
+</main>
+`;
+}
+function escapeHtml(s) {
+    return s.replace(/[&<>"]/g, (c) => `&#${c.charCodeAt(0)};`);
+}
+//# sourceMappingURL=enroll.js.map

package/dist/remote/enroll.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"enroll.js","sourceRoot":"","sources":["../../src/remote/enroll.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACtD,OAAO,EAAE,gBAAgB,EAAE,MAAM,SAAS,CAAC;AAG3C,OAAO,EACL,WAAW,EACX,mBAAmB,GAGpB,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AACxC,OAAO,EAAE,eAAe,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AACzE,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAE9C;;;;;;;;;;;GAWG;AAEH,MAAM,aAAa,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AACrC;;;;GAIG;AACH,MAAM,WAAW,GAAG,EAAE,CAAC;AAcvB,MAAM,UAAU,kBAAkB,CAChC,GAAoB,EACpB,IAAmB;IAEnB,MAAM,EAAE,GAAG,EAAE,YAAY,EAAE,GAAG,IAAI,CAAC;IACnC,qDAAqD;IACrD,MAAM,OAAO,GAAG,IAAI,GAAG,EAAkB,CAAC;IAE1C,SAAS,KAAK;QACZ,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,KAAK,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC,IAAI,OAAO,EAAE,CAAC;YACvC,IAAI,OAAO,IAAI,GAAG;gBAAE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAC5C,CAAC;IACH,CAAC;IAED,SAAS,IAAI;QACX,KAAK,EAAE,CAAC;QACR,OAAO,OAAO,CAAC,IAAI,IAAI,WAAW,EAAE,CAAC;YACnC,yEAAyE;YACzE,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC,KAAM,CAAC,CAAC;QAC/C,CAAC;QACD,MAAM,KAAK,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QACpD,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,aAAa,CAAC,CAAC;QAC/C,OAAO,KAAK,CAAC;IACf,CAAC;IAED,SAAS,OAAO,CAAC,KAAa;QAC5B,KAAK,EAAE,CAAC;QACR,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;QACtC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACtB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,4EAA4E;IAE5E;;;;OAIG;IACH,GAAG,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE;QACrC,MAAM,MAAM,GAAG,YAAY,EAAE,CAAC;QAC9B,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,KAAK;iBACT,IAAI,CAAC,GAAG,CAAC;iBACT,IAAI,CAAC,0BAA0B,CAAC;iBAChC,IAAI,CAAC,gBAAgB,EAAE,CAAC,CAAC;QAC9B,CAAC;QACD,OAAO,KAAK;aACT,IAAI,CAAC,0BAA0B,CAAC;aAChC,MAAM,CAAC,eAAe,EAAE,UAAU,CAAC;aACnC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;IAC5B,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,GAAG,CAAC,UAAU,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE;QACxC,MAAM,MAAM,GAAG,YAAY,EAAE,CAAC;QAC9B,IAAI,CAAC,MAAM;YAAE,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,mDAAmD,CAAC,CAAC;QAC9F,OAAO,KAAK;aACT,IAAI,CAAC,mCAAmC,CAAC;aACzC,MAAM,CAAC,eAAe,EAAE,UAAU,CAAC;aACnC,IAAI,CAAC,eAAe,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;IAC3C,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,GAAG,CAAC,WAAW,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE;QACzC,MAAM,MAAM,GAAG,YAAY,EAAE,CAAC;QAC9B,IAAI,CAAC,MAAM;YAAE,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,mDAAmD,CAAC,CAAC;QAC9F,OAAO,KAAK;aACT,IAAI,CAAC,2BAA2B,CAAC;aACjC,MAAM,CAAC,eAAe,EAAE,UAAU,CAAC;aACnC,IAAI,CAAC,oBAAoB,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;IAChD,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,GAAG,CAAC,UAAU,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE;QACxC,MAAM,OAAO,GAAG,cAAc,EAAE,CAAC;QACjC,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,KAAK;iBACT,IAAI,CAAC,GAAG,CAAC;iBACT,IAAI,CAAC,iEAAiE,CAAC,CAAC;QAC7E,CAAC;QACD,OAAO,KAAK,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC,CAAC;IACxE,CAAC,CAAC,CAAC;IAEH,6EAA6E;IAE7E;;;;OAIG;IACH,GAAG,CAAC,GAAG,CAAC,UAAU,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,EAAE,CAAC,MAAiB,EAAE,EAAE;QAC7D,IAAI,OAAO,GAAG,KAAK,CAAC;QAEpB,MAAM,KAAK,GAAG,CAAC,GAAiB,EAAQ,EAAE;YACxC,IAAI,MAAM,CAAC,UAAU,KAAK,MAAM,CAAC,IAAI;gBAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC;QAC1E,CAAC,CAAC;QACF,MAAM,MAAM,GAAG,CAAC,OAAe,EAAQ,EAAE;YACvC,KAAK,CAAC,EAAE,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;YAC1C,MAAM,CAAC,KAAK,EAAE,CAAC;QACjB,CAAC,CAAC;QAEF,MAAM,OAAO,GAAG,CAAC,GAAW,EAAQ,EAAE;YACpC,oEAAoE;YACpE,iCAAiC;YACjC,IAAI,OAAO;gBAAE,OAAO;YAEpB,IAAI,MAAM,CAAC;YACX,IAAI,CAAC;gBACH,MAAM,GAAG,WAAW,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;YACnE,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,MAAM,CAAC,mBAAmB,CAAC,CAAC;YACrC,CAAC;YACD,IAAI,CAAC,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,OAAO,EAAE,CAAC;gBACjD,OAAO,MAAM,CAAC,gBAAgB,CAAC,CAAC;YAClC,CAAC;YACD,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC;YAE1B,IAAI,KAAK,CAAC,aAAa,KAAK,mBAAmB,EAAE,CAAC;gBAChD,OAAO,MAAM,CACX,oCAAoC,KAAK,CAAC,aAAa,oBAAoB;oBACzE,IAAI,mBAAmB,kDAAkD,CAC5E,CAAC;YACJ,CAAC;YAED,IAAI,IAAI,GAAgB,IAAI,CAAC;YAC7B,IAAI,WAA+B,CAAC;YAEpC,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YACjD,IAAI,KAAK,EAAE,CAAC;gBACV,qEAAqE;gBACrE,IAAI,GAAG,EAAE,GAAG,KAAK,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,CAAC;gBAClD,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;YAC7B,CAAC;iBAAM,IAAI,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;gBAChC,IAAI,CAAC,KAAK,CAAC,MAAM;oBAAE,OAAO,MAAM,CAAC,4CAA4C,CAAC,CAAC;gBAC/E,WAAW,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;gBACpD,IAAI,GAAG;oBACL,EAAE,EAAE,UAAU,EAAE;oBAChB,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,KAAK;oBACzB,IAAI,EAAE,UAAU;oBAChB,OAAO,EAAE,IAAI;oBACb,OAAO,EAAE,IAAI;oBACb,OAAO,EAAE,EAAE;oBACX,QAAQ,EAAE,GAAG,KAAK,CAAC,MAAM,CAAC,QAAQ,IAAI,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE;oBACzD,UAAU,EAAE,KAAK,CAAC,UAAU;oBAC5B,KAAK,EAAE,YAAY;oBACnB,UAAU,EAAE,IAAI;oBAChB,KAAK,EAAE,IAAI;iBACZ,CAAC;gBACF,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,GAAG,IAAI,EAAE,SAAS,EAAE,WAAW,EAAE,CAAC,CAAC;gBAC1D,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;YACzB,CAAC;iBAAM,CAAC;gBACN,OAAO,MAAM,CAAC,+DAA+D,CAAC,CAAC;YACjF,CAAC;YAED,OAAO,GAAG,IAAI,CAAC;YACf,KAAK,CAAC;gBACJ,CAAC,EAAE,SAAS;gBACZ,UAAU,EAAE,WAAW;gBACvB,aAAa,EAAE,mBAAmB;gBAClC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACnD,CAAC,CAAC;YACH,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC;QACvD,CAAC,CAAC;QAEF,MAAM,CAAC,EAAE,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;IAChC,CAAC,CAAC,CAAC;IAEH,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,GAAG,EAAE,CAAC,CAAC,KAAK,EAAE,EAAE,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;AAC/D,CAAC;AAED,8EAA8E;AAE9E,MAAM,QAAQ,GAAG;;;;;;;;;;;;;;;;;;;;;CAqBhB,CAAC;AAEF,SAAS,QAAQ,CAAC,MAAc;IAC9B,OAAO;;;;SAIA,QAAQ;;;;2DAI0C,UAAU,CAAC,MAAM,CAAC;;;oBAGzD,UAAU,CAAC,MAAM,CAAC;;;aAGzB,UAAU,CAAC,MAAM,CAAC;;;;;;;CAO9B,CAAC;AACF,CAAC;AAED,SAAS,gBAAgB;IACvB,OAAO;;;SAGA,QAAQ;;;;;;;;CAQhB,CAAC;AACF,CAAC;AAED,SAAS,UAAU,CAAC,CAAS;IAC3B,OAAO,CAAC,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;AAC9D,CAAC"}

package/dist/remote/join-script.d.ts

@@ -0,0 +1,29 @@
+/**
+ * The installers a joining machine downloads and runs.
+ *
+ * They are generated rather than shipped as files so the hub's own origin and
+ * a freshly minted single-use token are baked in — the person running this has
+ * nothing to configure and nothing to paste twice.
+ *
+ * Both scripts follow the same order, and it matters: work out what is missing
+ * first, and say precisely what is happening *before* changing anything. The
+ * SSH deploy path could only report a failure as a wall of build output in a
+ * tooltip; here the message lands in the terminal of the person standing at
+ * the keyboard.
+ *
+ * They are also deliberately chatty. Two steps take a minute or more — pulling
+ * ~30MB of Node, and an `npm install` that may compile native modules — and a
+ * terminal that prints nothing for that long is indistinguishable from one
+ * that has hung. Every long step therefore says what it is about to do, ticks
+ * while it runs, and reports how long it took.
+ *
+ * When Node is missing or too old, a private copy is fetched into
+ * `~/.termscape/node` rather than installed system-wide. That is deliberate:
+ * it needs no administrator rights, no package manager, and no PATH surgery
+ * that a fresh shell would have to pick up; and uninstalling is deleting one
+ * directory. The download is checksum-verified against nodejs.org's own
+ * SHASUMS256.txt, because this is a binary we are about to execute.
+ */
+export declare function joinScriptPosix(origin: string, token: string): string;
+export declare function joinScriptPowerShell(origin: string, token: string): string;
+//# sourceMappingURL=join-script.d.ts.map

package/dist/remote/join-script.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"join-script.d.ts","sourceRoot":"","sources":["../../src/remote/join-script.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAUH,wBAAgB,eAAe,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CA8SrE;AAED,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAoX1E"}