@rome-os/node 0.1.0

package/dist/local.js

@@ -0,0 +1,33 @@
+import { createHash } from "node:crypto";
+import { homedir } from "node:os";
+import { join, resolve } from "node:path";
+import { isRecord } from "./actions.js";
+import { cloudOrigin } from "./cloud.js";
+import { readPrivateJson } from "./storage.js";
+export function configRoot() {
+    return resolve(process.env.ROME_NODE_CONFIG_DIR ||
+        (process.platform === "win32"
+            ? join(process.env.LOCALAPPDATA || homedir(), "RomeNode")
+            : join(process.env.XDG_CONFIG_HOME || join(homedir(), ".config"), "rome-node")));
+}
+export const callerCredentialPath = () => join(configRoot(), "caller.json");
+export const daemonStatePath = () => join(configRoot(), "daemon.json");
+export function daemonPort() {
+    const override = process.env.ROME_NODE_DAEMON_PORT;
+    if (override !== undefined) {
+        const port = Number(override);
+        if (!Number.isInteger(port) || port < 1024 || port > 65535)
+            throw new Error("ROME_NODE_DAEMON_PORT must be a port between 1024 and 65535.");
+        return port;
+    }
+    return 20000 + (createHash("sha256").update(configRoot()).digest().readUInt32BE(0) % 40000);
+}
+export async function readCallerCredential() {
+    const value = await readPrivateJson(callerCredentialPath());
+    if (!isRecord(value) ||
+        typeof value.cloudUrl !== "string" ||
+        typeof value.token !== "string" ||
+        !/^romedev_[A-Za-z0-9_-]{43}$/.test(value.token))
+        throw new Error("Configure a communication token with rome-node auth --cloud <origin> using stdin first.");
+    return { cloudUrl: cloudOrigin(value.cloudUrl), token: value.token };
+}

package/dist/login.d.ts

@@ -0,0 +1,6 @@
+export interface DeviceSession {
+    cloudUrl: string;
+    token: string;
+    deviceId: string;
+}
+export declare function loginDevice(cloudUrl: string, name: string, signal: AbortSignal): Promise<DeviceSession>;

package/dist/login.js

@@ -0,0 +1,100 @@
+import { createServer } from "node:http";
+import { createHash, randomBytes } from "node:crypto";
+import { platform } from "node:os";
+import { cloudOrigin } from "./cloud.js";
+import { validId } from "./protocol.js";
+export async function loginDevice(cloudUrl, name, signal) {
+    const cloud = new URL(cloudOrigin(cloudUrl));
+    const verifier = randomBytes(32).toString("base64url");
+    const state = randomBytes(32).toString("base64url");
+    return new Promise((resolve, reject) => {
+        if (signal.aborted) {
+            reject(new Error("Authorization canceled."));
+            return;
+        }
+        let redeeming = false;
+        const server = createServer(async (request, response) => {
+            const incoming = new URL(request.url ?? "/", "http://127.0.0.1");
+            if (request.method !== "GET" ||
+                incoming.pathname !== "/callback" ||
+                incoming.searchParams.get("state") !== state ||
+                incoming.searchParams.get("iss") !== cloud.origin ||
+                !incoming.searchParams.get("code") ||
+                redeeming) {
+                response.writeHead(400).end("Invalid authorization callback");
+                return;
+            }
+            redeeming = true;
+            try {
+                const result = await fetch(`${cloud.origin}/oauth2/token`, {
+                    method: "POST",
+                    signal: AbortSignal.any([signal, AbortSignal.timeout(5000)]),
+                    redirect: "error",
+                    body: new URLSearchParams({
+                        grant_type: "authorization_code",
+                        client_id: "rome-computer",
+                        redirect_uri: redirectUri,
+                        code: incoming.searchParams.get("code"),
+                        code_verifier: verifier,
+                        platform: platform() === "darwin" ? "macos" : platform() === "win32" ? "windows" : "linux",
+                    }),
+                });
+                if (!result.ok)
+                    throw new Error("Token exchange rejected");
+                const body = (await result.json());
+                if (typeof body.access_token !== "string" ||
+                    !/^romedev_[A-Za-z0-9_-]{43}$/.test(body.access_token) ||
+                    !validId(body.device_id))
+                    throw new Error("Invalid token response");
+                response
+                    .writeHead(200, { "content-type": "text/plain", "cache-control": "no-store" })
+                    .end("Device authorized. Return to Rome Node.");
+                resolve({ cloudUrl: cloud.origin, token: body.access_token, deviceId: body.device_id });
+            }
+            catch {
+                response.writeHead(400).end("Device authorization failed. Run rome-node connect to retry.");
+                reject(new Error("Device authorization failed"));
+            }
+            finally {
+                clearTimeout(timer);
+                signal.removeEventListener("abort", abort);
+                server.close();
+            }
+        });
+        let redirectUri;
+        const abort = () => {
+            clearTimeout(timer);
+            server.closeAllConnections();
+            server.close();
+            reject(new Error("Authorization canceled."));
+        };
+        const timer = setTimeout(() => {
+            server.close();
+            signal.removeEventListener("abort", abort);
+            reject(new Error("Login timed out"));
+        }, 5 * 60_000);
+        signal.addEventListener("abort", abort, { once: true });
+        server.on("error", () => {
+            clearTimeout(timer);
+            signal.removeEventListener("abort", abort);
+            reject(new Error("Loopback listener failed"));
+        });
+        server.listen(0, "127.0.0.1", () => {
+            const address = server.address();
+            if (!address || typeof address === "string")
+                return;
+            redirectUri = `http://127.0.0.1:${address.port}/callback`;
+            const url = new URL("/oauth2/authorize", cloud);
+            url.search = new URLSearchParams({
+                response_type: "code",
+                client_id: "rome-computer",
+                redirect_uri: redirectUri,
+                code_challenge: createHash("sha256").update(verifier).digest("base64url"),
+                code_challenge_method: "S256",
+                state,
+                display_name: name,
+            }).toString();
+            process.stderr.write(`Open this URL in your browser to authorize ${name}:\n${url}\n`);
+        });
+    });
+}

package/dist/protocol.d.ts

@@ -0,0 +1,30 @@
+export declare const MAX_MESSAGE_BYTES: number;
+export declare const MAX_CLIENT_BUFFER_BYTES: number;
+export declare const CLOSE: {
+    readonly revoked: 4001;
+    readonly superseded: 4002;
+    readonly outputLimit: 4003;
+    readonly invalid: 1008;
+    readonly tooLarge: 1009;
+};
+export interface OutboundEnvelope {
+    id: string;
+    to: string;
+    payload: unknown;
+}
+export interface InboundEnvelope {
+    id: string;
+    from: string;
+    payload: unknown;
+}
+interface RouteError {
+    id: string;
+    type: "error";
+    code: "target_unavailable" | "invalid_message" | "message_too_large";
+}
+export type GatewayMessage = InboundEnvelope | RouteError;
+export declare function validId(value: unknown): value is string;
+export declare function outboundEnvelope(value: unknown): OutboundEnvelope | null;
+export declare function gatewayMessage(value: unknown): GatewayMessage | null;
+export declare function byteLength(value: string): number;
+export {};

package/dist/protocol.js

@@ -0,0 +1,40 @@
+export const MAX_MESSAGE_BYTES = 128 * 1024;
+export const MAX_CLIENT_BUFFER_BYTES = 1024 * 1024;
+export const CLOSE = {
+    revoked: 4001,
+    superseded: 4002,
+    outputLimit: 4003,
+    invalid: 1008,
+    tooLarge: 1009,
+};
+export function validId(value) {
+    return (typeof value === "string" &&
+        value.length > 0 &&
+        value.length <= 128 &&
+        !/[\u0000-\u0020\u007f]/.test(value));
+}
+export function outboundEnvelope(value) {
+    if (!value || typeof value !== "object" || Array.isArray(value))
+        return null;
+    const item = value;
+    if (!validId(item.id) || !validId(item.to) || !Object.hasOwn(item, "payload"))
+        return null;
+    return { id: item.id, to: item.to, payload: item.payload };
+}
+export function gatewayMessage(value) {
+    if (!value || typeof value !== "object" || Array.isArray(value))
+        return null;
+    const item = value;
+    if (!validId(item.id))
+        return null;
+    if (item.type === "error" &&
+        ["target_unavailable", "invalid_message", "message_too_large"].includes(String(item.code))) {
+        return item;
+    }
+    if (validId(item.from) && Object.hasOwn(item, "payload"))
+        return { id: item.id, from: item.from, payload: item.payload };
+    return null;
+}
+export function byteLength(value) {
+    return new TextEncoder().encode(value).byteLength;
+}

package/dist/socket.d.ts

@@ -0,0 +1,2 @@
+import type { ClientSocket } from "./client.js";
+export declare function createNodeSocket(url: string, authorization: string): ClientSocket;

package/dist/socket.js

@@ -0,0 +1,27 @@
+import WebSocket from "ws";
+import { MAX_MESSAGE_BYTES } from "./protocol.js";
+export function createNodeSocket(url, authorization) {
+    const socket = new WebSocket(url, {
+        headers: { Authorization: authorization },
+        handshakeTimeout: 10_000,
+        maxPayload: MAX_MESSAGE_BYTES,
+        followRedirects: false,
+    });
+    let alive = true;
+    const heartbeat = setInterval(() => {
+        if (socket.readyState !== WebSocket.OPEN)
+            return;
+        if (!alive) {
+            socket.terminate();
+            return;
+        }
+        alive = false;
+        socket.ping();
+    }, 30_000);
+    heartbeat.unref();
+    socket.on("pong", () => {
+        alive = true;
+    });
+    socket.on("close", () => clearInterval(heartbeat));
+    return socket;
+}

package/dist/storage.d.ts

@@ -0,0 +1,2 @@
+export declare function readPrivateJson(path: string): Promise<unknown>;
+export declare function writePrivateJson(path: string, value: unknown): Promise<void>;

package/dist/storage.js

@@ -0,0 +1,37 @@
+import { chmod, mkdir, readFile, rename, rm, writeFile } from "node:fs/promises";
+import { dirname } from "node:path";
+import { randomUUID } from "node:crypto";
+import { execFile } from "node:child_process";
+import { promisify } from "node:util";
+export async function readPrivateJson(path) {
+    try {
+        return JSON.parse(await readFile(path, "utf8"));
+    }
+    catch (error) {
+        if (error instanceof SyntaxError || error.code === "ENOENT")
+            return null;
+        throw new Error("Could not read the local credential file.");
+    }
+}
+export async function writePrivateJson(path, value) {
+    const dir = dirname(path);
+    await mkdir(dir, { recursive: true, mode: 0o700 });
+    if (process.platform === "win32") {
+        const run = promisify(execFile);
+        const { stdout } = await run("whoami.exe", ["/user", "/fo", "csv", "/nh"]);
+        const sid = stdout.match(/S-1-\d+(?:-\d+)+/)?.[0];
+        if (!sid)
+            throw new Error("Could not determine the Windows account identity.");
+        await run("icacls.exe", [dir, "/inheritance:r", "/grant:r", `*${sid}:(OI)(CI)F`]);
+    }
+    else
+        await chmod(dir, 0o700);
+    const temporary = `${path}.${randomUUID()}.tmp`;
+    try {
+        await writeFile(temporary, JSON.stringify(value), { mode: 0o600, flag: "wx" });
+        await rename(temporary, path);
+    }
+    finally {
+        await rm(temporary, { force: true });
+    }
+}

package/package.json

@@ -0,0 +1,43 @@
+{
+  "name": "@rome-os/node",
+  "version": "0.1.0",
+  "description": "Rome device protocol, Gateway client, and remote computer CLI",
+  "license": "MIT",
+  "type": "module",
+  "engines": {
+    "node": ">=24"
+  },
+  "bin": {
+    "rome-node": "./bin/rome-node.js"
+  },
+  "files": [
+    "bin",
+    "dist",
+    "README.md"
+  ],
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "default": "./dist/index.js"
+    }
+  },
+  "dependencies": {
+    "ws": "^8.18.0"
+  },
+  "devDependencies": {
+    "@rstest/core": "^0.11.11",
+    "@types/node": "25.2.3",
+    "@types/ws": "^8.18.0",
+    "typescript": "^5.9.3"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/rome-os/rome.git",
+    "directory": "packages/rome-node"
+  },
+  "scripts": {
+    "build": "tsc -p tsconfig.build.json",
+    "typecheck": "tsc --noEmit",
+    "test": "pnpm build && ../../scripts/test-env.sh rstest"
+  }
+}