edge-ai-client-ts 1.0.0

package/dist/daemon/manager.js

@@ -0,0 +1,461 @@
+/**
+ * Daemon/service manager — mirrors `edge-client/src/daemon/manager.rs`.
+ *
+ * Installs and manages the edge-client daemon as a user-scoped background
+ * service on Linux (systemd --user), macOS (launchd LaunchAgent), and Windows
+ * (Task Scheduler). NO root/admin required anywhere — Standard User only.
+ *
+ * Linux:  writes ~/.config/systemd/user/${serviceName}.service + `systemctl --user enable --now`
+ * macOS:  writes ~/Library/LaunchAgents/${serviceName}.plist   + `launchctl bootstrap gui/$UID`
+ * Win:    writes %LOCALAPPDATA%\\edge-client-ts\\tasks\\${serviceName}.xml + `schtasks /Create`
+ *
+ * The exec command is `node ${binaryPath}` so a `bin/ec-ts.js` shim works
+ * (or, on packaged installs, the resolved entry file).
+ */
+import * as fs from 'node:fs/promises';
+import * as fssync from 'node:fs';
+import * as os from 'node:os';
+import * as path from 'node:path';
+import { execFile } from 'node:child_process';
+import { promisify } from 'node:util';
+const execFileP = promisify(execFile);
+// ──────────────────────────── service manager ──────────────────────
+export class ServiceManager {
+    static detectPlatform() {
+        switch (process.platform) {
+            case 'linux':
+                return 'linux';
+            case 'darwin':
+                return 'darwin';
+            case 'win32':
+                return 'win32';
+            case 'freebsd':
+                return 'freebsd';
+            default:
+                return 'other';
+        }
+    }
+    /** Default service name. */
+    static defaultServiceName() {
+        return 'edge-client-ts';
+    }
+    /** Default install dir per platform (user-scoped, no root). */
+    static defaultInstallDir(platform = ServiceManager.detectPlatform()) {
+        if (platform === 'win32') {
+            return path.join(process.env.LOCALAPPDATA ?? os.homedir(), 'edge-client-ts', 'bin');
+        }
+        return path.join(os.homedir(), '.local', 'bin');
+    }
+    // ────────────── paths ──────────────
+    /** Resolve the service-unit file path for the current platform. */
+    getServiceFilePath(platform, serviceName) {
+        switch (platform) {
+            case 'linux':
+                return path.join(process.env.XDG_CONFIG_HOME ?? path.join(os.homedir(), '.config'), 'systemd', 'user', `${serviceName}.service`);
+            case 'darwin':
+                return path.join(os.homedir(), 'Library', 'LaunchAgents', `${serviceName}.plist`);
+            case 'win32': {
+                const dir = path.join(process.env.LOCALAPPDATA ?? os.homedir(), 'edge-client-ts', 'tasks');
+                return path.join(dir, `${serviceName}.xml`);
+            }
+            default:
+                throw new Error(`edge-client-ts does not support service install on platform '${platform}'`);
+        }
+    }
+    // ────────────── generators ──────────────
+    /** Linux systemd --user unit file contents. */
+    generateSystemdUnit(opts, serviceName) {
+        // SECURITY (C1, security-review 2026-07-11): validate every
+        // interpolated value. Newlines / control chars in `binaryPath`,
+        // `configDir`, or any `userEnv` value would let an attacker inject
+        // additional systemd directives (e.g. ExecStart=/bin/pwned).
+        // Throws on the first unsafe char.
+        validateServiceName(serviceName);
+        const binaryPath = escapeSystemdValue(opts.binaryPath, 'binaryPath');
+        const configDir = escapeSystemdValue(opts.configDir, 'configDir');
+        const envLines = Object.entries(opts.userEnv ?? {})
+            .map(([k, v]) => {
+            validateEnvName(k);
+            const safeV = escapeSystemdValue(v, `userEnv.${k}`);
+            return `Environment=${k}=${safeV}`;
+        })
+            .join('\n');
+        return `[Unit]
+Description=Edge-client-ts daemon (Edge AI Agent fleet)
+After=network-online.target
+Wants=network-online.target
+
+[Service]
+Type=simple
+ExecStart=${process.execPath} ${binaryPath} run
+Restart=on-failure
+RestartSec=5
+WorkingDirectory=${configDir}
+${envLines}
+
+[Install]
+WantedBy=default.target
+`;
+    }
+    /** macOS LaunchAgent plist contents. */
+    generateLaunchdPlist(opts, serviceName) {
+        validateServiceName(serviceName);
+        const envDict = Object.entries(opts.userEnv ?? {})
+            .map(([k, v]) => {
+            validateEnvName(k);
+            const safeK = escapeXmlAttr(k);
+            const safeV = escapeXmlAttr(v);
+            return `    <key>${safeK}</key>\n    <string>${safeV}</string>`;
+        })
+            .join('\n');
+        return `<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+  <key>Label</key>
+  <string>${escapeXmlAttr(serviceName)}</string>
+  <key>ProgramArguments</key>
+  <array>
+    <string>${escapeXmlAttr(process.execPath)}</string>
+    <string>${escapeXmlAttr(opts.binaryPath)}</string>
+    <string>run</string>
+  </array>
+  <key>RunAtLoad</key>
+  <true/>
+  <key>KeepAlive</key>
+  <true/>
+  <key>WorkingDirectory</key>
+  <string>${escapeXmlAttr(opts.configDir)}</string>
+  <key>EnvironmentVariables</key>
+  <dict>
+${envDict}
+  </dict>
+  <key>StandardOutPath</key>
+  <string>${escapeXmlAttr(path.join(os.homedir(), "Library", "Logs", serviceName + ".log"))}</string>
+  <key>StandardErrorPath</key>
+  <string>${escapeXmlAttr(path.join(os.homedir(), "Library", "Logs", serviceName + ".err"))}</string>
+</dict>
+</plist>
+`;
+    }
+    /** Windows Task Scheduler XML (no admin needed when created per-user). */
+    generateSchtasksXml(opts, serviceName) {
+        validateServiceName(serviceName);
+        const envLines = Object.entries(opts.userEnv ?? {})
+            .map(([k, v]) => {
+            validateEnvName(k);
+            return `      <EnvVar Name="${escapeXmlAttr(k)}" Value="${escapeXmlAttr(v)}"/>`;
+        })
+            .join('\n');
+        return `<?xml version="1.0" encoding="UTF-16"?>
+<Task version="1.4" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">
+  <RegistrationInfo>
+    <Description>Edge-client-ts daemon (Edge AI Agent fleet)</Description>
+  </RegistrationInfo>
+  <Triggers>
+    <LogonTrigger>
+      <Enabled>true</Enabled>
+    </LogonTrigger>
+  </Triggers>
+  <Principals>
+    <Principal id="Author">
+      <GroupId>S-1-5-4</GroupId>
+      <RunLevel>LeastPrivilege</RunLevel>
+    </Principal>
+  </Principals>
+  <Settings>
+    <MultipleInstancesPolicy>IgnoreNew</MultipleInstancesPolicy>
+    <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>
+    <StopIfGoingOnBatteries>false</StopIfGoingOnBatteries>
+    <AllowHardTerminate>true</AllowHardTerminate>
+    <StartWhenAvailable>true</StartWhenAvailable>
+    <RunOnlyIfNetworkAvailable>true</RunOnlyIfNetworkAvailable>
+    <AllowStartOnDemand>true</AllowStartOnDemand>
+    <Enabled>true</Enabled>
+    <Hidden>false</Hidden>
+    <ExecutionTimeLimit>PT0S</ExecutionTimeLimit>
+    <Priority>7</Priority>
+  </Settings>
+  <Actions Context="Author">
+    <Exec>
+      <Command>${escapeXmlAttr(process.execPath)}</Command>
+      <Arguments>${escapeXmlAttr(opts.binaryPath + ' run')}</Arguments>
+      <WorkingDirectory>${escapeXmlAttr(opts.configDir)}</WorkingDirectory>
+${envLines}
+    </Exec>
+  </Actions>
+</Task>
+`;
+    }
+    // ────────────── install / uninstall ──────────────
+    async install(opts) {
+        const platform = ServiceManager.detectPlatform();
+        const serviceName = opts.serviceName ?? ServiceManager.defaultServiceName();
+        const unitPath = this.getServiceFilePath(platform, serviceName);
+        await fs.mkdir(path.dirname(unitPath), { recursive: true });
+        let content;
+        switch (platform) {
+            case 'linux':
+                content = this.generateSystemdUnit(opts, serviceName);
+                await fs.writeFile(unitPath, content, { mode: 0o644 });
+                await execFileP('systemctl', ['--user', 'daemon-reload']);
+                await execFileP('systemctl', ['--user', 'enable', '--now', `${serviceName}.service`]);
+                return;
+            case 'darwin':
+                content = this.generateLaunchdPlist(opts, serviceName);
+                await fs.writeFile(unitPath, content, { mode: 0o644 });
+                await execFileP('launchctl', ['bootstrap', `gui/${process.getuid?.() ?? os.userInfo().uid}`, unitPath]);
+                return;
+            case 'win32': {
+                const schtasksDir = path.dirname(unitPath);
+                await fs.mkdir(schtasksDir, { recursive: true });
+                content = this.generateSchtasksXml(opts, serviceName);
+                await fs.writeFile(unitPath, content, 'utf16le');
+                // /RU $env:USERNAME so we don't need admin (per-user task).
+                await execFileP('schtasks', [
+                    '/Create',
+                    '/XML', unitPath,
+                    '/TN', serviceName,
+                    '/RU', process.env.USERNAME ?? os.userInfo().username,
+                    '/F',
+                ]);
+                return;
+            }
+            default:
+                throw new Error(`edge-client-ts does not support service install on platform '${platform}'; run \`ec-ts run\` manually.`);
+        }
+    }
+    async uninstall(opts) {
+        const platform = ServiceManager.detectPlatform();
+        const serviceName = opts.serviceName ?? ServiceManager.defaultServiceName();
+        const unitPath = this.getServiceFilePath(platform, serviceName);
+        switch (platform) {
+            case 'linux':
+                try {
+                    await execFileP('systemctl', ['--user', 'disable', '--now', `${serviceName}.service`]);
+                }
+                catch {
+                    /* not installed */
+                }
+                break;
+            case 'darwin':
+                try {
+                    await execFileP('launchctl', ['bootout', `gui/${process.getuid?.() ?? os.userInfo().uid}/${serviceName}`]);
+                }
+                catch {
+                    /* not installed */
+                }
+                break;
+            case 'win32':
+                try {
+                    await execFileP('schtasks', ['/Delete', '/TN', serviceName, '/F']);
+                }
+                catch {
+                    /* not installed */
+                }
+                break;
+            default:
+                throw new Error(`edge-client-ts does not support service uninstall on platform '${platform}'`);
+        }
+        try {
+            await fs.unlink(unitPath);
+        }
+        catch {
+            /* file already gone */
+        }
+    }
+    async start(serviceName = ServiceManager.defaultServiceName()) {
+        switch (ServiceManager.detectPlatform()) {
+            case 'linux':
+                await execFileP('systemctl', ['--user', 'start', `${serviceName}.service`]);
+                return;
+            case 'darwin':
+                await execFileP('launchctl', ['kickstart', '-k', `gui/${process.getuid?.() ?? os.userInfo().uid}/${serviceName}`]);
+                return;
+            case 'win32':
+                await execFileP('schtasks', ['/Run', '/TN', serviceName]);
+                return;
+            default:
+                throw new Error('unsupported platform');
+        }
+    }
+    async stop(serviceName = ServiceManager.defaultServiceName()) {
+        switch (ServiceManager.detectPlatform()) {
+            case 'linux':
+                await execFileP('systemctl', ['--user', 'stop', `${serviceName}.service`]);
+                return;
+            case 'darwin':
+                await execFileP('launchctl', ['kill', `gui/${process.getuid?.() ?? os.userInfo().uid}/${serviceName}`]);
+                return;
+            case 'win32':
+                await execFileP('schtasks', ['/End', '/TN', serviceName]);
+                return;
+            default:
+                throw new Error('unsupported platform');
+        }
+    }
+    async status(serviceName = ServiceManager.defaultServiceName()) {
+        const platform = ServiceManager.detectPlatform();
+        const unitPath = this.getServiceFilePath(platform, serviceName);
+        const installed = (() => {
+            try {
+                fssync.accessSync(unitPath, fssync.constants.F_OK);
+                return true;
+            }
+            catch {
+                return false;
+            }
+        })();
+        let running = false;
+        let detail = '';
+        try {
+            switch (platform) {
+                case 'linux': {
+                    const { stdout } = await execFileP('systemctl', ['--user', 'is-active', `${serviceName}.service`]);
+                    running = stdout.trim() === 'active';
+                    detail = `systemd ${running ? 'active' : 'inactive'}`;
+                    break;
+                }
+                case 'darwin': {
+                    const { stdout } = await execFileP('launchctl', ['list']);
+                    running = stdout.includes(serviceName);
+                    detail = running ? 'launchd loaded' : 'launchd unloaded';
+                    break;
+                }
+                case 'win32': {
+                    const { stdout } = await execFileP('schtasks', ['/Query', '/TN', serviceName, '/FO', 'LIST']);
+                    running = stdout.includes('Running');
+                    detail = running ? 'schtasks running' : 'schtasks idle';
+                    break;
+                }
+                default:
+                    detail = 'unsupported platform';
+            }
+        }
+        catch (e) {
+            detail = `query failed: ${String(e).slice(0, 100)}`;
+            running = false;
+        }
+        return { installed, running, platform, detail };
+    }
+    async isInstalled(serviceName = ServiceManager.defaultServiceName()) {
+        const platform = ServiceManager.detectPlatform();
+        const unitPath = this.getServiceFilePath(platform, serviceName);
+        try {
+            await fs.access(unitPath);
+            return true;
+        }
+        catch {
+            return false;
+        }
+    }
+}
+// ──────────────────────────── helpers ──────────────────────────────
+/** Expand `~` / `$HOME` / `%USERPROFILE%` placeholders. */
+export function expandUser(p) {
+    if (p.startsWith('~/') || p === '~') {
+        return path.join(os.homedir(), p.slice(p === '~' ? 1 : 2));
+    }
+    if (p.startsWith('$HOME')) {
+        return path.join(os.homedir(), p.slice(5));
+    }
+    if (p.startsWith('%USERPROFILE%')) {
+        return path.join(process.env.USERPROFILE ?? os.homedir(), p.slice(14));
+    }
+    if (p.startsWith('%LOCALAPPDATA%')) {
+        return path.join(process.env.LOCALAPPDATA ?? os.homedir(), p.slice(14));
+    }
+    return p;
+}
+// ──────────────────────────────────────────────────────────────────
+// SECURITY: input validation + escaping for daemon template fields
+// (security-review 2026-07-11 — C1: template injection).
+//
+// All values interpolated into systemd units, launchd plists, or
+// schtasks XML MUST be validated by the helpers below. The historical
+// raw-string interpolation allowed a malicious `binaryPath`,
+// `configDir`, `serviceName`, or `userEnv` value containing a newline
+// to inject additional directives such as:
+//
+//   binaryPath: "/safe/path\n[Service]\nExecStart=/bin/pwned"
+//
+// which produces a systemd unit with TWO `ExecStart=` lines — the second
+// one runs the attacker's command on `systemctl start`. Equivalent
+// attacks work via plist XML injection (`</string><key>...
+// <array><string>/bin/sh</string>...</array>`) and schtasks
+// `</Command><Exec>...` manipulation.
+//
+// The helpers below throw on any un-safe input so `install()` fails
+// fast instead of silently writing a malicious service definition.
+// ──────────────────────────────────────────────────────────────────
+/**
+ * Validate a string is safe to interpolate into a systemd unit file.
+ * systemd's INI-like parser treats `[section]` at the start of a line
+ * as a section boundary and `Key=` as a directive. A newline in any
+ * interpolated value therefore lets an attacker close the current
+ * directive, start a new `[Service]` section, and inject `ExecStart=`,
+ * `Environment=`, etc. We reject anything containing ASCII control
+ * characters; legitimate values never need them.
+ */
+export function escapeSystemdValue(value, fieldName) {
+    // eslint-disable-next-line no-control-regex
+    if (/[\x00-\x1f]/.test(value)) {
+        throw new RangeError(`daemon: ${fieldName} contains control characters (refusing to emit injection):\n${value}`);
+    }
+    return value;
+}
+/**
+ * XML-escape a string for use inside an attribute value or element
+ * text in plist/schtasks XML. The chars `<`, `>`, `&`, `"`, `'`
+ * MUST be escaped or an attacker can break out of the surrounding
+ * construct (`</string><key>ProgramArguments</key>...`) and inject
+ * arbitrary plist/schtasks directives. See C1 in security-review
+ * 2026-07-11.
+ */
+export function escapeXmlAttr(value) {
+    return value
+        .replace(/&/g, '&amp;')
+        .replace(/</g, '&lt;')
+        .replace(/>/g, '&gt;')
+        .replace(/"/g, '&quot;')
+        .replace(/'/g, '&apos;')
+        .replace(/[\x00-\x08\x0b\x0c\x0e-\x1f]/g, ''); // strip control chars (except \t, \n, \r)
+}
+/**
+ * Validate that a service name is a valid systemd unit / plist label /
+ * schtasks task name. The charset is intentionally narrow:
+ *   - alphanumerics, dash, underscore, dot
+ *   - no path separators, no newlines, no leading dot
+ * Mirrors the constraints checked by `systemd-escape`, launchd
+ * `Label=`, and `schtasks` at registration time — failing here gives a
+ * clear "invalid serviceName" error instead of a confusing OS-level
+ * "unit name not valid" rejection at install.
+ */
+export function validateServiceName(name) {
+    if (typeof name !== 'string' || name.length === 0 || name.length > 64) {
+        throw new RangeError(`daemon: serviceName must be 1–64 chars (got ${name.length})`);
+    }
+    if (!/^[A-Za-z0-9_.-]+$/.test(name)) {
+        throw new RangeError(`daemon: serviceName contains invalid chars (only [A-Za-z0-9_.-] allowed): ${JSON.stringify(name)}`);
+    }
+    if (name === '.' || name === '..' || name.startsWith('.')) {
+        throw new RangeError(`daemon: serviceName cannot be "." or start with "." (got ${JSON.stringify(name)})`);
+    }
+}
+/**
+ * Validate that an env var name is a portable POSIX identifier. systemd,
+ * launchd, and schtasks all follow the same rules:
+ *   - [A-Za-z_][A-Za-z0-9_]*
+ *   - no leading digit
+ *   - empty refused
+ * A name like `RELAY;ExecStart=/bin/sh` would otherwise inject
+ * additional directives.
+ */
+export function validateEnvName(name) {
+    if (typeof name !== 'string' || name.length === 0) {
+        throw new RangeError('daemon: userEnv key must be a non-empty string');
+    }
+    if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(name)) {
+        throw new RangeError(`daemon: userEnv key '${name}' must match /^[A-Za-z_][A-Za-z0-9_]*$/`);
+    }
+}

package/dist/index.d.ts

@@ -0,0 +1,39 @@
+/**
+ * @edgeai/edge-client-ts — TypeScript (Model 1) parallel edge-client.
+ *
+ * Public entry point. Re-exports every module the binary / library users need.
+ *
+ * Layout mirrors the Rust edge-client:
+ *   config/   settings + cmd-gate schema
+ *   crypto/   AES-256-GCM, HMAC-SHA256, TLS cert-pinning
+ *   logging/  file logger
+ *   network/  WS client (`/edge` JSON stream)
+ *   buffer/   disk-backed offline queue
+ *   session/  PTY shell (with 17-byte frame codec), SFTP, pi RPC, fail-fast,
+ *             session manager, persistence
+ *   cli/      dispatch + run/enroll/whoami/status/devices/messages subcommands
+ *   daemon/   per-OS service install (systemd-user / launchd / schtasks)
+ */
+export * from './config/settings.js';
+export * from './config/cmd-gate.js';
+export * from './crypto/aes-gcm.js';
+export * from './crypto/hmac.js';
+export * from './crypto/tls-guard.js';
+export { FileLogger } from './logging/file-logger.js';
+export { EdgeWsClient, type EdgeWsClientOptions, type EdgeWsClientEventMap, type RegisterMessage, type StreamMessage, type AckMessage, type HeartbeatMessage, type SystemMetrics, type JsonObject, type BufferDrainable, } from './network/ws-client.js';
+export { DiskBufferQueue, BufferFullError, type QueueEntry } from './buffer/disk-queue.js';
+export { SHELL_HEADER_LEN, SESSION_ID_LEN, RESIZE_PAYLOAD_LEN, FrameType, frameTypeFromByte, newSessionId, sessionIdFromString, sessionIdToString, dataFrame, resizeFrame, closeFrame, encodeFrame, decodeFrame, decodeResizePayload, type ShellFrame, } from './session/shell-frame.js';
+export { FORBIDDEN_KEYWORDS, INSPECTABLE_EVENT_TYPES, FAIL_FAST_ERROR_CONTENT, ENV_FAIL_FAST, failFastEnabled, detectForbidden, buildSyntheticErrorEvent, } from './session/fail-fast.js';
+export { ShellManager, type DataHandler, type ExitHandler } from './session/shell.js';
+export { SftpForwarder } from './session/sftp.js';
+export { PiProcess, hasLimits, systemdRunAvailable, resetSystemdRunCache, wrapWithCgroup, promptCommand, abortCommand, setModelCommand, setThinkingLevelCommand, compactCommand, getAvailableModelsCommand, newPiSessionId, extractSessionId, eventMsgId, type RpcCommand, type PiEvent, type ResourcesConfig, } from './session/pi-rpc.js';
+export { SessionManager, type SessionManagerOptions, type HeartbeatMetadata } from './session/manager.js';
+export { SessionIdStore, persistSessionState, loadSessionState, type SessionState } from './session/persistence.js';
+export { dispatch } from './cli/index.js';
+export { runDaemon } from './cli/run.js';
+export { enroll } from './cli/enroll.js';
+export { whoami } from './cli/whoami.js';
+export { status } from './cli/status.js';
+export { listDevices } from './cli/devices.js';
+export { listMessages } from './cli/messages.js';
+export { ServiceManager, expandUser, type Platform, type ServiceInstallOpts, type ServiceStatus, } from './daemon/manager.js';

package/dist/index.js

@@ -0,0 +1,63 @@
+/**
+ * @edgeai/edge-client-ts — TypeScript (Model 1) parallel edge-client.
+ *
+ * Public entry point. Re-exports every module the binary / library users need.
+ *
+ * Layout mirrors the Rust edge-client:
+ *   config/   settings + cmd-gate schema
+ *   crypto/   AES-256-GCM, HMAC-SHA256, TLS cert-pinning
+ *   logging/  file logger
+ *   network/  WS client (`/edge` JSON stream)
+ *   buffer/   disk-backed offline queue
+ *   session/  PTY shell (with 17-byte frame codec), SFTP, pi RPC, fail-fast,
+ *             session manager, persistence
+ *   cli/      dispatch + run/enroll/whoami/status/devices/messages subcommands
+ *   daemon/   per-OS service install (systemd-user / launchd / schtasks)
+ */
+// ---------------------------------------------------------------------------
+// Config
+// ---------------------------------------------------------------------------
+export * from './config/settings.js';
+export * from './config/cmd-gate.js';
+// ---------------------------------------------------------------------------
+// Crypto
+// ---------------------------------------------------------------------------
+export * from './crypto/aes-gcm.js';
+export * from './crypto/hmac.js';
+export * from './crypto/tls-guard.js';
+// ---------------------------------------------------------------------------
+// Logging
+// ---------------------------------------------------------------------------
+export { FileLogger } from './logging/file-logger.js';
+// ---------------------------------------------------------------------------
+// Network
+// ---------------------------------------------------------------------------
+export { EdgeWsClient, } from './network/ws-client.js';
+// ---------------------------------------------------------------------------
+// Buffer (offline queue)
+// ---------------------------------------------------------------------------
+export { DiskBufferQueue, BufferFullError } from './buffer/disk-queue.js';
+// ---------------------------------------------------------------------------
+// Session
+// ---------------------------------------------------------------------------
+export { SHELL_HEADER_LEN, SESSION_ID_LEN, RESIZE_PAYLOAD_LEN, FrameType, frameTypeFromByte, newSessionId, sessionIdFromString, sessionIdToString, dataFrame, resizeFrame, closeFrame, encodeFrame, decodeFrame, decodeResizePayload, } from './session/shell-frame.js';
+export { FORBIDDEN_KEYWORDS, INSPECTABLE_EVENT_TYPES, FAIL_FAST_ERROR_CONTENT, ENV_FAIL_FAST, failFastEnabled, detectForbidden, buildSyntheticErrorEvent, } from './session/fail-fast.js';
+export { ShellManager } from './session/shell.js';
+export { SftpForwarder } from './session/sftp.js';
+export { PiProcess, hasLimits, systemdRunAvailable, resetSystemdRunCache, wrapWithCgroup, promptCommand, abortCommand, setModelCommand, setThinkingLevelCommand, compactCommand, getAvailableModelsCommand, newPiSessionId, extractSessionId, eventMsgId, } from './session/pi-rpc.js';
+export { SessionManager } from './session/manager.js';
+export { SessionIdStore, persistSessionState, loadSessionState } from './session/persistence.js';
+// ---------------------------------------------------------------------------
+// CLI dispatch (used by bin/ec-ts.js)
+// ---------------------------------------------------------------------------
+export { dispatch } from './cli/index.js';
+export { runDaemon } from './cli/run.js';
+export { enroll } from './cli/enroll.js';
+export { whoami } from './cli/whoami.js';
+export { status } from './cli/status.js';
+export { listDevices } from './cli/devices.js';
+export { listMessages } from './cli/messages.js';
+// ---------------------------------------------------------------------------
+// Daemon (service install)
+// ---------------------------------------------------------------------------
+export { ServiceManager, expandUser, } from './daemon/manager.js';

package/dist/logging/file-logger.d.ts

@@ -0,0 +1,21 @@
+/**
+ * File-based logger — mirrors `edge-client/src/logging/file_logger.rs`.
+ *
+ * Writes timestamped log lines to a daily log file under `logDir`
+ * (e.g. `edge-client-2026-07-11.log`). Thread-safe via a mutex
+ * (in Node, a simple serialization queue).
+ */
+export declare class FileLogger {
+    private readonly logDir;
+    private stream;
+    private writeQueue;
+    constructor(logDir: string);
+    /** Write a formatted log line at the given level. */
+    log(level: string, message: string): Promise<void>;
+    info(message: string): Promise<void>;
+    warn(message: string): Promise<void>;
+    error(message: string): Promise<void>;
+    /** Flush + close the underlying stream. */
+    close(): Promise<void>;
+    private writeRaw;
+}

package/dist/logging/file-logger.js

@@ -0,0 +1,71 @@
+/**
+ * File-based logger — mirrors `edge-client/src/logging/file_logger.rs`.
+ *
+ * Writes timestamped log lines to a daily log file under `logDir`
+ * (e.g. `edge-client-2026-07-11.log`). Thread-safe via a mutex
+ * (in Node, a simple serialization queue).
+ */
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+export class FileLogger {
+    logDir;
+    stream;
+    writeQueue = Promise.resolve();
+    constructor(logDir) {
+        this.logDir = logDir;
+        fs.mkdirSync(logDir, { recursive: true });
+        const today = formatDate(new Date());
+        const logFile = path.join(logDir, `edge-client-${today}.log`);
+        this.stream = fs.createWriteStream(logFile, { flags: 'a' });
+    }
+    /** Write a formatted log line at the given level. */
+    log(level, message) {
+        const timestamp = formatTimestamp(new Date());
+        const line = `[${timestamp}] [${level}] ${message}\n`;
+        return this.writeRaw(line);
+    }
+    info(message) {
+        return this.log('INFO', message);
+    }
+    warn(message) {
+        return this.log('WARN', message);
+    }
+    error(message) {
+        return this.log('ERROR', message);
+    }
+    /** Flush + close the underlying stream. */
+    close() {
+        return this.writeQueue.then(() => {
+            this.stream?.end();
+            this.stream = undefined;
+        });
+    }
+    writeRaw(line) {
+        this.writeQueue = this.writeQueue.then(() => {
+            return new Promise((resolve) => {
+                if (this.stream === undefined) {
+                    resolve();
+                    return;
+                }
+                this.stream.write(line, () => resolve());
+            });
+        });
+        return this.writeQueue;
+    }
+}
+/** Format a date as `YYYY-MM-DD` (for the log filename). */
+function formatDate(d) {
+    const y = d.getFullYear();
+    const m = String(d.getMonth() + 1).padStart(2, '0');
+    const day = String(d.getDate()).padStart(2, '0');
+    return `${y}-${m}-${day}`;
+}
+/** Format a date as `YYYY-MM-DD HH:MM:SS.mmm` (for log line timestamps). */
+function formatTimestamp(d) {
+    const date = formatDate(d);
+    const h = String(d.getHours()).padStart(2, '0');
+    const min = String(d.getMinutes()).padStart(2, '0');
+    const s = String(d.getSeconds()).padStart(2, '0');
+    const ms = String(d.getMilliseconds()).padStart(3, '0');
+    return `${date} ${h}:${min}:${s}.${ms}`;
+}