@threadbase-sh/streamer 1.60.0 → 1.61.0

package/dist/cli.cjs

@@ -31270,7 +31270,7 @@ var require_websocket = __commonJS({
     var http = require("http");
     var net = require("net");
     var tls = require("tls");
-    var { randomBytes: randomBytes5, createHash: createHash8 } = require("crypto");
+    var { randomBytes: randomBytes5, createHash: createHash9 } = require("crypto");
     var { Duplex, Readable: Readable2 } = require("stream");
     var { URL: URL2 } = require("url");
     var PerMessageDeflate2 = require_permessage_deflate();
@@ -31938,7 +31938,7 @@ var require_websocket = __commonJS({
           abortHandshake(websocket, socket, "Invalid Upgrade header");
           return;
         }
-        const digest = createHash8("sha1").update(key + GUID).digest("base64");
+        const digest = createHash9("sha1").update(key + GUID).digest("base64");
         if (res.headers["sec-websocket-accept"] !== digest) {
           abortHandshake(websocket, socket, "Invalid Sec-WebSocket-Accept header");
           return;
@@ -32307,7 +32307,7 @@ var require_websocket_server = __commonJS({
     var EventEmitter5 = require("events");
     var http = require("http");
     var { Duplex } = require("stream");
-    var { createHash: createHash8 } = require("crypto");
+    var { createHash: createHash9 } = require("crypto");
     var extension2 = require_extension();
     var PerMessageDeflate2 = require_permessage_deflate();
     var subprotocol2 = require_subprotocol();
@@ -32614,7 +32614,7 @@ var require_websocket_server = __commonJS({
           );
         }
         if (this._state > RUNNING) return abortHandshake(socket, 503);
-        const digest = createHash8("sha1").update(key + GUID).digest("base64");
+        const digest = createHash9("sha1").update(key + GUID).digest("base64");
         const headers = [
           "HTTP/1.1 101 Switching Protocols",
           "Upgrade: websocket",
@@ -97360,6 +97360,81 @@ var init_platform = __esm({
   }
 });
 
+// src/server-identity.ts
+function serverIdentityKeyPath() {
+  const dir = process.env.THREADBASE_CONFIG_DIR ?? (0, import_path3.join)((0, import_os5.homedir)(), ".threadbase");
+  return (0, import_path3.join)(dir, "keys", "server-identity.key");
+}
+function loadOrCreateServerIdentity() {
+  const path2 = serverIdentityKeyPath();
+  let raw2;
+  try {
+    raw2 = (0, import_fs4.readFileSync)(path2, "utf-8");
+  } catch (err) {
+    if (err.code !== "ENOENT") throw err;
+    return generateIdentity(path2);
+  }
+  let privateKey;
+  try {
+    privateKey = (0, import_crypto4.createPrivateKey)({ key: JSON.parse(raw2).key, format: "jwk" });
+  } catch {
+    throw new Error(
+      `Server identity key at ${path2} could not be read. Refusing to generate a new one \u2014 that would invalidate every paired device. Repair or delete the file deliberately.`
+    );
+  }
+  return { publicKey: publicKeyOf(privateKey), privateKey };
+}
+function serverIdentityPublicKey() {
+  return loadOrCreateServerIdentity().publicKey;
+}
+function serverIdentityFingerprint(publicKeyBase64url) {
+  const raw2 = Buffer.from(publicKeyBase64url, "base64url");
+  const hex3 = (0, import_crypto4.createHash)("sha256").update(raw2).digest().subarray(0, 16).toString("hex");
+  return hex3.match(/.{4}/g)?.join(" ") ?? hex3;
+}
+function currentServerIdentityFingerprint() {
+  return serverIdentityFingerprint(serverIdentityPublicKey());
+}
+function generateIdentity(path2) {
+  const { privateKey } = (0, import_crypto4.generateKeyPairSync)("x25519");
+  const file2 = {
+    v: IDENTITY_FILE_VERSION,
+    createdAt: (/* @__PURE__ */ new Date()).toISOString(),
+    key: privateKey.export({ format: "jwk" })
+  };
+  (0, import_fs4.mkdirSync)((0, import_path3.dirname)(path2), { recursive: true, mode: 448 });
+  const tmp = `${path2}.tmp`;
+  (0, import_fs4.writeFileSync)(tmp, `${JSON.stringify(file2)}
+`, { encoding: "utf-8", mode: 384 });
+  (0, import_fs4.chmodSync)(tmp, 384);
+  (0, import_fs4.renameSync)(tmp, path2);
+  const publicKey = publicKeyOf(privateKey);
+  getLogger("identity").info(`Generated server identity key ${publicKey}`, {
+    event: "identity.key_generated",
+    path: path2
+  });
+  return { publicKey, privateKey };
+}
+function publicKeyOf(privateKey) {
+  const jwk = (0, import_crypto4.createPublicKey)(privateKey).export({ format: "jwk" });
+  if (jwk.crv !== "X25519" || typeof jwk.x !== "string") {
+    throw new Error(`Server identity key at ${serverIdentityKeyPath()} is not an X25519 key`);
+  }
+  return jwk.x;
+}
+var import_crypto4, import_fs4, import_os5, import_path3, IDENTITY_FILE_VERSION;
+var init_server_identity = __esm({
+  "src/server-identity.ts"() {
+    "use strict";
+    import_crypto4 = require("crypto");
+    import_fs4 = require("fs");
+    import_os5 = require("os");
+    import_path3 = require("path");
+    init_logger();
+    IDENTITY_FILE_VERSION = 1;
+  }
+});
+
 // node_modules/fast-glob/out/utils/array.js
 var require_array = __commonJS({
   "node_modules/fast-glob/out/utils/array.js"(exports2) {
@@ -128273,6 +128348,43 @@ var init_repo = __esm({
   }
 });
 
+// cli/identity.ts
+var identity_exports = {};
+__export(identity_exports, {
+  formatIdentityBanner: () => formatIdentityBanner,
+  runIdentity: () => runIdentity
+});
+function runIdentity(deps) {
+  const keyPath = (deps.keyPath ?? serverIdentityKeyPath)();
+  const fingerprint2 = deps.fingerprint ?? currentServerIdentityFingerprint;
+  let value;
+  try {
+    value = fingerprint2();
+  } catch (err) {
+    deps.log.error(
+      `Could not read the server identity key: ${err instanceof Error ? err.message : String(err)}`
+    );
+    return 1;
+  }
+  deps.log.info(formatIdentityBanner(value, keyPath));
+  return 0;
+}
+function formatIdentityBanner(fingerprint2, keyPath) {
+  return [
+    `Server identity  (X25519, ${keyPath})`,
+    "",
+    `  ${fingerprint2}`,
+    "",
+    "Compare this with the fingerprint your phone shows when you add this server."
+  ].join("\n");
+}
+var init_identity = __esm({
+  "cli/identity.ts"() {
+    "use strict";
+    init_server_identity();
+  }
+});
+
 // cli/setKey.ts
 var setKey_exports = {};
 __export(setKey_exports, {
@@ -135627,67 +135739,7 @@ var PushRepository = class {
 
 // src/api/routes/misc.routes.ts
 init_logger();
-
-// src/server-identity.ts
-var import_crypto4 = require("crypto");
-var import_fs4 = require("fs");
-var import_os5 = require("os");
-var import_path3 = require("path");
-init_logger();
-var IDENTITY_FILE_VERSION = 1;
-function serverIdentityKeyPath() {
-  const dir = process.env.THREADBASE_CONFIG_DIR ?? (0, import_path3.join)((0, import_os5.homedir)(), ".threadbase");
-  return (0, import_path3.join)(dir, "keys", "server-identity.key");
-}
-function loadOrCreateServerIdentity() {
-  const path2 = serverIdentityKeyPath();
-  let raw2;
-  try {
-    raw2 = (0, import_fs4.readFileSync)(path2, "utf-8");
-  } catch (err) {
-    if (err.code !== "ENOENT") throw err;
-    return generateIdentity(path2);
-  }
-  let privateKey;
-  try {
-    privateKey = (0, import_crypto4.createPrivateKey)({ key: JSON.parse(raw2).key, format: "jwk" });
-  } catch {
-    throw new Error(
-      `Server identity key at ${path2} could not be read. Refusing to generate a new one \u2014 that would invalidate every paired device. Repair or delete the file deliberately.`
-    );
-  }
-  return { publicKey: publicKeyOf(privateKey), privateKey };
-}
-function serverIdentityPublicKey() {
-  return loadOrCreateServerIdentity().publicKey;
-}
-function generateIdentity(path2) {
-  const { privateKey } = (0, import_crypto4.generateKeyPairSync)("x25519");
-  const file2 = {
-    v: IDENTITY_FILE_VERSION,
-    createdAt: (/* @__PURE__ */ new Date()).toISOString(),
-    key: privateKey.export({ format: "jwk" })
-  };
-  (0, import_fs4.mkdirSync)((0, import_path3.dirname)(path2), { recursive: true, mode: 448 });
-  const tmp = `${path2}.tmp`;
-  (0, import_fs4.writeFileSync)(tmp, `${JSON.stringify(file2)}
-`, { encoding: "utf-8", mode: 384 });
-  (0, import_fs4.chmodSync)(tmp, 384);
-  (0, import_fs4.renameSync)(tmp, path2);
-  const publicKey = publicKeyOf(privateKey);
-  getLogger("identity").info(`Generated server identity key ${publicKey}`, {
-    event: "identity.key_generated",
-    path: path2
-  });
-  return { publicKey, privateKey };
-}
-function publicKeyOf(privateKey) {
-  const jwk = (0, import_crypto4.createPublicKey)(privateKey).export({ format: "jwk" });
-  if (jwk.crv !== "X25519" || typeof jwk.x !== "string") {
-    throw new Error(`Server identity key at ${serverIdentityKeyPath()} is not an X25519 key`);
-  }
-  return jwk.x;
-}
+init_server_identity();
 
 // src/services/push/apnsClient.ts
 var import_node_crypto = require("crypto");
@@ -150263,6 +150315,9 @@ function seal(plaintext, recipientPublicKeyBase64) {
   };
 }
 
+// src/server.ts
+init_server_identity();
+
 // src/server-wiring.ts
 var import_fs31 = require("fs");
 
@@ -155134,6 +155189,9 @@ function parseDirScanDebounceEnv(raw2) {
   return Number.isNaN(parsed) || parsed < 0 ? void 0 : parsed;
 }
 
+// cli/index.ts
+init_server_identity();
+
 // src/updater/check-update.ts
 var import_semver = __toESM(require_semver2(), 1);
 
@@ -158775,6 +158833,7 @@ init_platform2();
 init_logger();
 init_protocol();
 init_socket();
+init_server_identity();
 var log11 = getLogger("prod");
 function clearSupervisorLogs() {
   let paths;
@@ -158827,6 +158886,7 @@ async function runProdStatus() {
 async function runProdDoctor(opts, deps = {}) {
   const findings = [];
   const repairs = [];
+  let identity;
   let ptyHost;
   const marker = readMarker();
   if (marker && !marker.userHeld && !isPidAlive(marker.devPid)) {
@@ -158839,6 +158899,15 @@ async function runProdDoctor(opts, deps = {}) {
   if (!getSupervisor().isAgentLoaded()) {
     findings.push("launchd agent is not loaded \u2014 prod is fully down");
   }
+  if (deps.serverIdentityFingerprint) {
+    try {
+      identity = deps.serverIdentityFingerprint();
+    } catch (err) {
+      findings.push(
+        `server identity key at ${serverIdentityKeyPath()} is unreadable: ` + (err instanceof Error ? err.message : String(err))
+      );
+    }
+  }
   const conflicts = detectConflictingAgents();
   for (const c of conflicts) {
     if (c.resolution === "uninstall-homebrew") {
@@ -158867,7 +158936,7 @@ async function runProdDoctor(opts, deps = {}) {
       );
     }
   }
-  return { findings, repairs, ...ptyHost ? { ptyHost } : {} };
+  return { findings, repairs, ...identity ? { identity } : {}, ...ptyHost ? { ptyHost } : {} };
 }
 function toPowerShellLiteral(value) {
   return `'${value.replace(/'/g, "''")}'`;
@@ -159016,7 +159085,13 @@ function registerProdCommands(program3) {
     log11.info(what, void 0, "console");
   });
   prod.command("doctor").description("Detect stale markers, missing agents, and pty-host health").option("--fix", "Apply repairs (default is dry-run)", false).action(async (opts) => {
-    const r = await runProdDoctor({ fix: opts.fix === true });
+    const r = await runProdDoctor(
+      { fix: opts.fix === true },
+      { serverIdentityFingerprint: currentServerIdentityFingerprint }
+    );
+    if (r.identity) {
+      log11.info(`identity: ${r.identity}`, void 0, "console");
+    }
     if (r.ptyHost) {
       log11.info(
         r.ptyHost.reachable ? `pty-host: reachable, protocol=${r.ptyHost.protocolVersion}, sessions=${r.ptyHost.sessionCount}` : `pty-host: unreachable (${r.ptyHost.error})`,
@@ -159408,6 +159483,16 @@ program2.command("pair").description("Print a pairing QR code (server must alrea
   const publicUrl = loadPublicUrl() ?? null;
   await printServerBanner({ port, apiKey, publicUrl, includeQr: true });
 });
+program2.command("identity").description("Print this server's identity fingerprint for out-of-band verification").action(async () => {
+  const { runIdentity: runIdentity2 } = await Promise.resolve().then(() => (init_identity(), identity_exports));
+  const code = runIdentity2({
+    log: {
+      info: (msg) => log14.info(msg, void 0, "console"),
+      error: (msg) => log14.error(msg, void 0, "console")
+    }
+  });
+  process.exit(code);
+});
 program2.command("set-key [key]").description("Set the streamer API key in ~/.threadbase/server.yaml").action(async (key) => {
   const { runSetKey: runSetKey2 } = await Promise.resolve().then(() => (init_setKey(), setKey_exports));
   const code = await runSetKey2(