frely-cli 0.3.0

package/README.md

@@ -0,0 +1,157 @@
+# frely-cli
+
+设计与 ChatGPT MCP 用户流程见 [`docs/chatgpt-mcp.md`](docs/chatgpt-mcp.md)。
+
+`frely-cli` is Frely's local command-line client and MCP runtime. The target flow is:
+
+```text
+install -> frely login -> frely mcp setup -> add MCP URL to ChatGPT
+```
+
+There is no separate `friday-local` project. Local MCP execution belongs to `frely-cli`.
+
+## Quick install
+
+After `frely-cli` is published, Frely can serve the repository `install.sh` as:
+
+```sh
+curl -fsSL https://app.frely.cloud/install.sh | sh
+```
+
+The installer requires Node.js 22 or newer and installs `frely-cli@latest` through npm.
+
+## Install from a local checkout
+
+The package requires Node.js 22 or newer. To install the current source checkout with Bun:
+
+```sh
+cd /path/to/frely-cli
+bun install
+bun run build
+bun install --global "$PWD"
+```
+
+Use the absolute `$PWD` path in the global install command. Bun installs the `frely` executable in its global bin directory. If the command is not found, add that directory to your `PATH`:
+
+```sh
+export PATH="$(bun pm bin -g):$PATH"
+```
+
+If Bun reports that the `keytar` lifecycle script is blocked, trust the native dependency and reinstall:
+
+```sh
+bun pm trust keytar
+bun install
+```
+
+The repository currently has an npm lockfile rather than a committed Bun lockfile. The first `bun install` may create `bun.lock`; handle that file according to the repository's lockfile policy.
+
+## First use
+
+```sh
+frely login
+frely mcp setup --workspace /path/to/project
+```
+
+`mcp setup` performs three client-side steps:
+
+1. enrolls this machine with the logged-in Frely account;
+2. obtains the stable public MCP URL;
+3. installs and starts the user-level background Device Relay service.
+
+It prints the MCP URL to add to ChatGPT. The background service keeps the outbound connection alive, so no terminal window or inbound port is required.
+
+You can print the URL again with:
+
+```sh
+frely mcp url
+```
+
+Or show ChatGPT-oriented instructions with:
+
+```sh
+frely mcp chatgpt
+```
+
+## Commands
+
+```text
+frely login [--relay <https-url>]
+frely logout
+frely whoami
+frely status [--json]
+frely doctor [--json]
+frely mcp setup [--workspace <path>]
+frely mcp url [--json]
+frely mcp status [--json]
+frely mcp chatgpt
+frely mcp serve [--workspace <path>]
+frely mcp service status|start|stop|uninstall [--json]
+frely mcp revoke
+frely mcp stdio [--workspace <path>]
+```
+
+`frely mcp serve` is the foreground/debug form of the same Device Relay client. `frely mcp setup` uses a LaunchAgent on macOS and a systemd user service on Linux.
+
+`frely logout` stops the background service before removing the account session. `frely mcp revoke` removes the background service, revokes the server-side device binding, and deletes the local device private key.
+
+## MCP provisioning contract
+
+The CLI expects Frely Relay to expose these authenticated user endpoints:
+
+```text
+POST /api/user/device-relay/enroll
+POST /api/user/device-relay/connect
+POST /api/user/device-relay/revoke
+```
+
+Enrollment returns:
+
+```json
+{
+  "deviceId": "...",
+  "mcpUrl": "https://.../mcp/..."
+}
+```
+
+The public MCP URL is a private bearer URL of the form `https://app.frely.cloud/mcp/<device-id>/<private-secret>`. The secret is high entropy, is only stored as a SHA-256 hash by the Relay, and must be treated as a credential. ChatGPT uses this URL with MCP Authentication set to `None`; no separate ChatGPT MCP OAuth flow is required.
+
+A Device Relay connection request uses the enrolled Ed25519 device key and returns a short-lived connection grant:
+
+```json
+{
+  "websocketUrl": "wss://...",
+  "accessToken": "short-lived-token",
+  "expiresAt": "..."
+}
+```
+
+The access token is sent only in the WebSocket `Authorization` header. It is not printed and is not persisted in the MCP URL.
+
+## Device Relay
+
+The WebSocket subprotocol is `frely.device-relay.v1`. Requests use independent request IDs and a 64-request inflight window. Read-only local operations may overlap; writes and shell operations use the local fair scheduler. This avoids LocalMCP's device-wide `busy -> 429` behavior.
+
+The client requests a fresh short-lived connection grant for every connection attempt and reconnects with bounded exponential backoff. A renewed Frely login is picked up by the next reconnect without reinstalling the service.
+
+## Local MCP capabilities
+
+The local MCP server exposes workspace inspection, file search/read/write/patch, directory create/delete/move, shell commands, and persistent process management.
+
+Filesystem tools are constrained to the selected workspace, reject symlink escapes, cap normal file reads/writes at 1 MiB, use no-follow reads, and use atomic replacement for writes. `run_command` and persistent process tools execute with the current OS user's permissions; the workspace only constrains their working directory and is not a shell sandbox.
+
+## Authentication and secrets
+
+- Password input requires an interactive TTY and is not stored.
+- Frely account session credentials are stored through Keychain / Secret Service via `keytar`.
+- The device Ed25519 private key is stored in the OS credential store.
+- Device binding metadata includes the private MCP bearer URL and therefore uses owner-only file permissions; the Relay stores only the MCP secret hash.
+- Device connection grants are short lived and stay in memory.
+- The MCP URL does not contain the device private key, account session, or connection grant, but the URL's private secret is itself a credential.
+- `doctor` never prints passwords, sessions, private keys, or connection grants.
+
+## Current server dependency
+
+The CLI side of installation, account login, device enrollment, MCP URL discovery, background service lifecycle, Device Relay WebSocket transport, multiplexing, reconnection, and local MCP execution is implemented here.
+
+A Frely Relay deployment must implement the three provisioning endpoints, Device Relay WebSocket host, and public private-URL MCP ingress before `frely mcp setup` can produce a working ChatGPT connection. The private MCP URL is the ChatGPT-side bearer credential, so no separate ChatGPT MCP authentication service is required.

package/dist/auth.d.ts

@@ -0,0 +1,27 @@
+export interface PublicUser {
+    id: string;
+    email: string;
+    name?: string | null;
+}
+export interface AuthSnapshot {
+    configured: boolean;
+    relayUrl?: string;
+    user?: PublicUser;
+    credentialStored: boolean;
+    configPath: string;
+    configMode?: number;
+}
+export declare function authConfigPath(): string;
+export declare function normalizeRelayUrl(value?: string): string;
+export declare function login(email: string, password: string, relayInput?: string): Promise<PublicUser>;
+export declare function whoami(): Promise<PublicUser>;
+export declare function requireLogin(): Promise<{
+    config: {
+        relayUrl: string;
+    };
+    user: PublicUser;
+    cookie: string;
+}>;
+export declare function logout(): Promise<void>;
+export declare function inspectAuth(): Promise<AuthSnapshot>;
+export declare function probeCredentialStore(): Promise<void>;

package/dist/auth.js

@@ -0,0 +1,208 @@
+import { randomUUID } from "node:crypto";
+import { chmod, mkdir, readFile, rename, stat, unlink, writeFile } from "node:fs/promises";
+import { homedir } from "node:os";
+import { dirname, join } from "node:path";
+import keytar from "keytar";
+const SERVICE = "frely-cli";
+const SESSION_COOKIE_NAME = "friday_session_token";
+const CONFIG_VERSION = 1;
+const DEFAULT_RELAY = "https://app.frely.cloud";
+const REQUEST_TIMEOUT_MS = 15_000;
+export function authConfigPath() {
+    const root = process.env.XDG_CONFIG_HOME || join(homedir(), ".config");
+    return join(root, "frely", "config.json");
+}
+function accountKey(relayUrl) {
+    return new URL(relayUrl).origin;
+}
+export function normalizeRelayUrl(value) {
+    const url = new URL(value || process.env.FRELY_RELAY_URL || DEFAULT_RELAY);
+    if (url.protocol !== "https:" && !(url.protocol === "http:" && ["127.0.0.1", "localhost", "::1"].includes(url.hostname))) {
+        throw new Error("Frely Relay must use HTTPS outside loopback development.");
+    }
+    url.pathname = "";
+    url.search = "";
+    url.hash = "";
+    return url.origin;
+}
+export async function login(email, password, relayInput) {
+    if (!email.trim() || !password)
+        throw new Error("Email and password are required.");
+    const relayUrl = normalizeRelayUrl(relayInput);
+    const response = await fetchWithTimeout(`${relayUrl}/api/auth/login`, {
+        method: "POST",
+        headers: {
+            "content-type": "application/json",
+            "origin": relayUrl,
+            "accept": "application/json",
+        },
+        body: JSON.stringify({ email: email.trim(), password }),
+        redirect: "error",
+    });
+    const payload = await safeJson(response);
+    if (!response.ok)
+        throw new Error(publicError(payload, response.status));
+    const user = parseUser(payload);
+    const cookie = sessionCookie(response.headers);
+    if (!cookie)
+        throw new Error("Frely login succeeded without a usable session cookie.");
+    const key = accountKey(relayUrl);
+    await keytar.setPassword(SERVICE, key, cookie);
+    try {
+        await writeConfig({ version: CONFIG_VERSION, relayUrl, user });
+    }
+    catch (error) {
+        await keytar.deletePassword(SERVICE, key).catch(() => false);
+        throw error;
+    }
+    return user;
+}
+export async function whoami() {
+    const config = await readConfig();
+    const cookie = await keytar.getPassword(SERVICE, accountKey(config.relayUrl));
+    if (!cookie)
+        throw new Error("No Frely login is stored. Run `frely login`.");
+    const response = await fetchWithTimeout(`${config.relayUrl}/api/auth/me`, {
+        headers: { "cookie": cookie, "accept": "application/json" },
+        redirect: "error",
+    });
+    const payload = await safeJson(response);
+    if (!response.ok) {
+        if (response.status === 401)
+            throw new Error("Frely login expired. Run `frely login`.");
+        throw new Error(publicError(payload, response.status));
+    }
+    const user = parseUser(payload);
+    if (user.id !== config.user.id || user.email !== config.user.email || user.name !== config.user.name) {
+        await writeConfig({ ...config, user });
+    }
+    return user;
+}
+export async function requireLogin() {
+    const config = await readConfig();
+    const cookie = await keytar.getPassword(SERVICE, accountKey(config.relayUrl));
+    if (!cookie)
+        throw new Error("No Frely login is stored. Run `frely login`.");
+    const user = await whoami();
+    return { config: { relayUrl: config.relayUrl }, user, cookie };
+}
+export async function logout() {
+    const config = await readConfig().catch(() => null);
+    if (!config) {
+        await unlink(authConfigPath()).catch(() => undefined);
+        return;
+    }
+    const key = accountKey(config.relayUrl);
+    const cookie = await keytar.getPassword(SERVICE, key);
+    if (cookie) {
+        await fetchWithTimeout(`${config.relayUrl}/api/auth/logout`, {
+            method: "POST",
+            headers: { "cookie": cookie, "origin": config.relayUrl, "content-type": "application/json" },
+            body: "{}",
+            redirect: "error",
+        }).catch(() => undefined);
+    }
+    await keytar.deletePassword(SERVICE, key).catch(() => false);
+    await unlink(authConfigPath()).catch(() => undefined);
+}
+export async function inspectAuth() {
+    const path = authConfigPath();
+    const config = await readConfig().catch(() => null);
+    if (!config)
+        return { configured: false, credentialStored: false, configPath: path };
+    const credentialStored = Boolean(await keytar.getPassword(SERVICE, accountKey(config.relayUrl)));
+    const fileStat = await stat(path).catch(() => null);
+    return {
+        configured: true,
+        relayUrl: config.relayUrl,
+        user: config.user,
+        credentialStored,
+        configPath: path,
+        ...(fileStat ? { configMode: fileStat.mode & 0o777 } : {}),
+    };
+}
+export async function probeCredentialStore() {
+    const account = `doctor:${randomUUID()}`;
+    const value = randomUUID();
+    await keytar.setPassword(SERVICE, account, value);
+    try {
+        if (await keytar.getPassword(SERVICE, account) !== value)
+            throw new Error("Credential store readback failed.");
+    }
+    finally {
+        await keytar.deletePassword(SERVICE, account).catch(() => false);
+    }
+}
+async function readConfig() {
+    const raw = await readFile(authConfigPath(), "utf8").catch(() => null);
+    if (!raw)
+        throw new Error("No Frely login is configured. Run `frely login`.");
+    let value;
+    try {
+        value = JSON.parse(raw);
+    }
+    catch {
+        throw new Error("Frely CLI configuration is invalid.");
+    }
+    if (value.version !== CONFIG_VERSION || typeof value.relayUrl !== "string" || !value.user || typeof value.user.id !== "string" || typeof value.user.email !== "string") {
+        throw new Error("Frely CLI configuration is invalid.");
+    }
+    return value;
+}
+async function writeConfig(config) {
+    const path = authConfigPath();
+    await mkdir(dirname(path), { recursive: true, mode: 0o700 });
+    await chmod(dirname(path), 0o700).catch(() => undefined);
+    const tmp = `${path}.${process.pid}.${Date.now()}.tmp`;
+    await writeFile(tmp, `${JSON.stringify(config, null, 2)}\n`, { mode: 0o600, flag: "wx" });
+    await rename(tmp, path);
+    await chmod(path, 0o600).catch(() => undefined);
+}
+async function fetchWithTimeout(url, init) {
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), REQUEST_TIMEOUT_MS);
+    timer.unref?.();
+    try {
+        return await fetch(url, { ...init, signal: controller.signal });
+    }
+    catch (error) {
+        if (controller.signal.aborted)
+            throw new Error("Frely request timed out.");
+        throw error;
+    }
+    finally {
+        clearTimeout(timer);
+    }
+}
+async function safeJson(response) {
+    try {
+        return await response.json();
+    }
+    catch {
+        return null;
+    }
+}
+function parseUser(payload) {
+    const root = payload && typeof payload === "object" ? payload : {};
+    const candidate = root.user && typeof root.user === "object" ? root.user : root;
+    if (typeof candidate.id !== "string" || typeof candidate.email !== "string")
+        throw new Error("Frely returned an invalid user profile.");
+    return { id: candidate.id, email: candidate.email, ...(typeof candidate.name === "string" ? { name: candidate.name } : {}) };
+}
+function sessionCookie(headers) {
+    const extended = headers;
+    const setCookies = extended.getSetCookie?.() ?? (headers.get("set-cookie") ? [headers.get("set-cookie")] : []);
+    for (const value of setCookies) {
+        const pair = value.split(";", 1)[0]?.trim();
+        if (pair?.startsWith(`${SESSION_COOKIE_NAME}=`))
+            return pair;
+    }
+    return null;
+}
+function publicError(payload, status) {
+    const root = payload && typeof payload === "object" ? payload : {};
+    const error = root.error && typeof root.error === "object" ? root.error : root;
+    const message = typeof error.message === "string" ? error.message : null;
+    return message || `Frely request failed with HTTP ${status}.`;
+}
+//# sourceMappingURL=auth.js.map

package/dist/auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../src/auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC3F,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,MAAM,MAAM,QAAQ,CAAC;AAE5B,MAAM,OAAO,GAAG,WAAW,CAAC;AAC5B,MAAM,mBAAmB,GAAG,sBAAsB,CAAC;AACnD,MAAM,cAAc,GAAG,CAAC,CAAC;AACzB,MAAM,aAAa,GAAG,yBAAyB,CAAC;AAChD,MAAM,kBAAkB,GAAG,MAAM,CAAC;AAuBlC,MAAM,UAAU,cAAc;IAC5B,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,IAAI,IAAI,CAAC,OAAO,EAAE,EAAE,SAAS,CAAC,CAAC;IACvE,OAAO,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,aAAa,CAAC,CAAC;AAC5C,CAAC;AAED,SAAS,UAAU,CAAC,QAAgB;IAClC,OAAO,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC;AAClC,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,KAAc;IAC9C,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,IAAI,OAAO,CAAC,GAAG,CAAC,eAAe,IAAI,aAAa,CAAC,CAAC;IAC3E,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,CAAC,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,CAAC,WAAW,EAAE,WAAW,EAAE,KAAK,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC;QACzH,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAC;IAC9E,CAAC;IACD,GAAG,CAAC,QAAQ,GAAG,EAAE,CAAC;IAClB,GAAG,CAAC,MAAM,GAAG,EAAE,CAAC;IAChB,GAAG,CAAC,IAAI,GAAG,EAAE,CAAC;IACd,OAAO,GAAG,CAAC,MAAM,CAAC;AACpB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,KAAK,CAAC,KAAa,EAAE,QAAgB,EAAE,UAAmB;IAC9E,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,IAAI,CAAC,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;IACpF,MAAM,QAAQ,GAAG,iBAAiB,CAAC,UAAU,CAAC,CAAC;IAC/C,MAAM,QAAQ,GAAG,MAAM,gBAAgB,CAAC,GAAG,QAAQ,iBAAiB,EAAE;QACpE,MAAM,EAAE,MAAM;QACd,OAAO,EAAE;YACP,cAAc,EAAE,kBAAkB;YAClC,QAAQ,EAAE,QAAQ;YAClB,QAAQ,EAAE,kBAAkB;SAC7B;QACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,IAAI,EAAE,EAAE,QAAQ,EAAE,CAAC;QACvD,QAAQ,EAAE,OAAO;KAClB,CAAC,CAAC;IACH,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACzC,IAAI,CAAC,QAAQ,CAAC,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,WAAW,CAAC,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;IACzE,MAAM,IAAI,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC;IAChC,MAAM,MAAM,GAAG,aAAa,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IAC/C,IAAI,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;IACvF,MAAM,GAAG,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;IACjC,MAAM,MAAM,CAAC,WAAW,CAAC,OAAO,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC;IAC/C,IAAI,CAAC;QACH,MAAM,WAAW,CAAC,EAAE,OAAO,EAAE,cAAc,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;IACjE,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,MAAM,CAAC,cAAc,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC;QAC7D,MAAM,KAAK,CAAC;IACd,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,MAAM;IAC1B,MAAM,MAAM,GAAG,MAAM,UAAU,EAAE,CAAC;IAClC,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC,OAAO,EAAE,UAAU,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC9E,IAAI,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;IAC7E,MAAM,QAAQ,GAAG,MAAM,gBAAgB,CAAC,GAAG,MAAM,CAAC,QAAQ,cAAc,EAAE;QACxE,OAAO,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,kBAAkB,EAAE;QAC3D,QAAQ,EAAE,OAAO;KAClB,CAAC,CAAC;IACH,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACzC,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG;YAAE,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;QACxF,MAAM,IAAI,KAAK,CAAC,WAAW,CAAC,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;IACzD,CAAC;IACD,MAAM,IAAI,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC;IAChC,IAAI,IAAI,CAAC,EAAE,KAAK,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,IAAI,CAAC,KAAK,KAAK,MAAM,CAAC,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,IAAI,KAAK,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;QACrG,MAAM,WAAW,CAAC,EAAE,GAAG,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;IACzC,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY;IAChC,MAAM,MAAM,GAAG,MAAM,UAAU,EAAE,CAAC;IAClC,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC,OAAO,EAAE,UAAU,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC9E,IAAI,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;IAC7E,MAAM,IAAI,GAAG,MAAM,MAAM,EAAE,CAAC;IAC5B,OAAO,EAAE,MAAM,EAAE,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;AACjE,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,MAAM;IAC1B,MAAM,MAAM,GAAG,MAAM,UAAU,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;IACpD,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,MAAM,CAAC,cAAc,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QACtD,OAAO;IACT,CAAC;IACD,MAAM,GAAG,GAAG,UAAU,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IACxC,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;IACtD,IAAI,MAAM,EAAE,CAAC;QACX,MAAM,gBAAgB,CAAC,GAAG,MAAM,CAAC,QAAQ,kBAAkB,EAAE;YAC3D,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC5F,IAAI,EAAE,IAAI;YACV,QAAQ,EAAE,OAAO;SAClB,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IAC5B,CAAC;IACD,MAAM,MAAM,CAAC,cAAc,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC;IAC7D,MAAM,MAAM,CAAC,cAAc,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;AACxD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,WAAW;IAC/B,MAAM,IAAI,GAAG,cAAc,EAAE,CAAC;IAC9B,MAAM,MAAM,GAAG,MAAM,UAAU,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;IACpD,IAAI,CAAC,MAAM;QAAE,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,gBAAgB,EAAE,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC;IACrF,MAAM,gBAAgB,GAAG,OAAO,CAAC,MAAM,MAAM,CAAC,WAAW,CAAC,OAAO,EAAE,UAAU,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;IACjG,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;IACpD,OAAO;QACL,UAAU,EAAE,IAAI;QAChB,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,gBAAgB;QAChB,UAAU,EAAE,IAAI;QAChB,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,QAAQ,CAAC,IAAI,GAAG,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC3D,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oBAAoB;IACxC,MAAM,OAAO,GAAG,UAAU,UAAU,EAAE,EAAE,CAAC;IACzC,MAAM,KAAK,GAAG,UAAU,EAAE,CAAC;IAC3B,MAAM,MAAM,CAAC,WAAW,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;IAClD,IAAI,CAAC;QACH,IAAI,MAAM,MAAM,CAAC,WAAW,CAAC,OAAO,EAAE,OAAO,CAAC,KAAK,KAAK;YAAE,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;IACjH,CAAC;YAAS,CAAC;QACT,MAAM,MAAM,CAAC,cAAc,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC;IACnE,CAAC;AACH,CAAC;AAED,KAAK,UAAU,UAAU;IACvB,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,cAAc,EAAE,EAAE,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;IACvE,IAAI,CAAC,GAAG;QAAE,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;IAC9E,IAAI,KAAyB,CAAC;IAC9B,IAAI,CAAC;QACH,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAuB,CAAC;IAChD,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;IACzD,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,KAAK,cAAc,IAAI,OAAO,KAAK,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,IAAI,IAAI,OAAO,KAAK,CAAC,IAAI,CAAC,EAAE,KAAK,QAAQ,IAAI,OAAO,KAAK,CAAC,IAAI,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;QACvK,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;IACzD,CAAC;IACD,OAAO,KAAkB,CAAC;AAC5B,CAAC;AAED,KAAK,UAAU,WAAW,CAAC,MAAiB;IAC1C,MAAM,IAAI,GAAG,cAAc,EAAE,CAAC;IAC9B,MAAM,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC7D,MAAM,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IACzD,MAAM,GAAG,GAAG,GAAG,IAAI,IAAI,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC;IACvD,MAAM,SAAS,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;IAC1F,MAAM,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IACxB,MAAM,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;AAClD,CAAC;AAED,KAAK,UAAU,gBAAgB,CAAC,GAAW,EAAE,IAAiB;IAC5D,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;IACzC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,kBAAkB,CAAC,CAAC;IACvE,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC;IAChB,IAAI,CAAC;QACH,OAAO,MAAM,KAAK,CAAC,GAAG,EAAE,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC;IAClE,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,UAAU,CAAC,MAAM,CAAC,OAAO;YAAE,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC;QAC3E,MAAM,KAAK,CAAC;IACd,CAAC;YAAS,CAAC;QACT,YAAY,CAAC,KAAK,CAAC,CAAC;IACtB,CAAC;AACH,CAAC;AAED,KAAK,UAAU,QAAQ,CAAC,QAAkB;IACxC,IAAI,CAAC;QACH,OAAO,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;IAC/B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,SAAS,CAAC,OAAgB;IACjC,MAAM,IAAI,GAAG,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAkC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC9F,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAA+B,CAAC,CAAC,CAAC,IAAI,CAAC;IAC3G,IAAI,OAAO,SAAS,CAAC,EAAE,KAAK,QAAQ,IAAI,OAAO,SAAS,CAAC,KAAK,KAAK,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;IACxI,OAAO,EAAE,EAAE,EAAE,SAAS,CAAC,EAAE,EAAE,KAAK,EAAE,SAAS,CAAC,KAAK,EAAE,GAAG,CAAC,OAAO,SAAS,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;AAC/H,CAAC;AAED,SAAS,aAAa,CAAC,OAAgB;IACrC,MAAM,QAAQ,GAAG,OAAsD,CAAC;IACxE,MAAM,UAAU,GAAG,QAAQ,CAAC,YAAY,EAAE,EAAE,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAChH,KAAK,MAAM,KAAK,IAAI,UAAU,EAAE,CAAC;QAC/B,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC;QAC5C,IAAI,IAAI,EAAE,UAAU,CAAC,GAAG,mBAAmB,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;IAC/D,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,WAAW,CAAC,OAAgB,EAAE,MAAc;IACnD,MAAM,IAAI,GAAG,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAkC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC9F,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAgC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC1G,MAAM,OAAO,GAAG,OAAO,KAAK,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;IACzE,OAAO,OAAO,IAAI,kCAAkC,MAAM,GAAG,CAAC;AAChE,CAAC"}

package/dist/device/control.d.ts

@@ -0,0 +1,10 @@
+import { type DeviceBinding } from "./state.js";
+export interface ConnectionGrant {
+    websocketUrl: string;
+    accessToken: string;
+    expiresAt: string;
+}
+export declare function ensureDevice(): Promise<DeviceBinding>;
+export declare function currentDevice(): Promise<DeviceBinding | null>;
+export declare function connectionGrant(binding?: DeviceBinding): Promise<ConnectionGrant>;
+export declare function revokeDevice(): Promise<void>;

package/dist/device/control.js

@@ -0,0 +1,164 @@
+import { hostname, platform } from "node:os";
+import { requireLogin } from "../auth.js";
+import { createConnectionProof, deleteDeviceIdentity, loadOrCreateDeviceIdentity } from "./identity.js";
+import { clearDeviceBinding, readDeviceBinding, writeDeviceBinding } from "./state.js";
+const CLIENT_VERSION = "0.3.0";
+const TIMEOUT_MS = 15_000;
+export async function ensureDevice() {
+    const auth = await requireLogin();
+    const existing = await readDeviceBinding();
+    if (existing && existing.relayUrl === auth.config.relayUrl && existing.userId === auth.user.id)
+        return existing;
+    const identity = await loadOrCreateDeviceIdentity(auth.config.relayUrl, auth.user.id);
+    const response = await relayFetch(auth.config.relayUrl, auth.cookie, "/api/user/device-relay/enroll", {
+        method: "POST",
+        body: JSON.stringify({
+            publicKeySpki: identity.publicKeySpki,
+            keyThumbprint: identity.keyThumbprint,
+            deviceName: hostname(),
+            platform: platform(),
+            cliVersion: CLIENT_VERSION,
+        }),
+    });
+    if (response.status === 404 || response.status === 405)
+        throw new Error("This Frely Relay does not provide MCP device enrollment yet.");
+    const payload = await responseJson(response);
+    if (!response.ok)
+        throw new Error(publicError(payload, response.status));
+    const record = object(payload);
+    const deviceId = requiredString(record, "deviceId", 256);
+    const mcpUrl = validateMcpUrl(requiredString(record, "mcpUrl", 4096));
+    const binding = {
+        version: 1,
+        relayUrl: auth.config.relayUrl,
+        userId: auth.user.id,
+        deviceId,
+        publicKeySpki: identity.publicKeySpki,
+        keyThumbprint: identity.keyThumbprint,
+        mcpUrl,
+        updatedAt: new Date().toISOString(),
+    };
+    await writeDeviceBinding(binding);
+    return binding;
+}
+export async function currentDevice() {
+    const auth = await requireLogin();
+    const binding = await readDeviceBinding();
+    if (!binding || binding.relayUrl !== auth.config.relayUrl || binding.userId !== auth.user.id)
+        return null;
+    return binding;
+}
+export async function connectionGrant(binding) {
+    const auth = await requireLogin();
+    const device = binding ?? await ensureDevice();
+    if (device.relayUrl !== auth.config.relayUrl || device.userId !== auth.user.id)
+        throw new Error("Device binding does not belong to the current Frely login.");
+    const identity = await loadOrCreateDeviceIdentity(auth.config.relayUrl, auth.user.id);
+    if (identity.keyThumbprint !== device.keyThumbprint)
+        throw new Error("Device key does not match the enrolled device.");
+    const proof = createConnectionProof(identity, device.deviceId);
+    const response = await relayFetch(auth.config.relayUrl, auth.cookie, "/api/user/device-relay/connect", {
+        method: "POST",
+        body: JSON.stringify(proof),
+    });
+    if (response.status === 404 || response.status === 405)
+        throw new Error("This Frely Relay does not provide Device Relay connections yet.");
+    const payload = await responseJson(response);
+    if (!response.ok)
+        throw new Error(publicError(payload, response.status));
+    const record = object(payload);
+    return {
+        websocketUrl: validateWebSocketUrl(requiredString(record, "websocketUrl", 4096)),
+        accessToken: requiredString(record, "accessToken", 8192),
+        expiresAt: requiredString(record, "expiresAt", 128),
+    };
+}
+export async function revokeDevice() {
+    const auth = await requireLogin();
+    const binding = await currentDevice();
+    if (!binding) {
+        await clearDeviceBinding();
+        await deleteDeviceIdentity(auth.config.relayUrl, auth.user.id);
+        return;
+    }
+    const response = await relayFetch(auth.config.relayUrl, auth.cookie, "/api/user/device-relay/revoke", {
+        method: "POST",
+        body: JSON.stringify({ deviceId: binding.deviceId }),
+    });
+    if (response.status === 404 || response.status === 405)
+        throw new Error("This Frely Relay does not provide Device Relay revocation yet.");
+    if (!response.ok) {
+        const payload = await responseJson(response);
+        throw new Error(publicError(payload, response.status));
+    }
+    await clearDeviceBinding();
+    await deleteDeviceIdentity(auth.config.relayUrl, auth.user.id);
+}
+async function relayFetch(relayUrl, cookie, path, init) {
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), TIMEOUT_MS);
+    timer.unref?.();
+    try {
+        return await fetch(`${relayUrl}${path}`, {
+            ...init,
+            redirect: "error",
+            signal: controller.signal,
+            headers: {
+                "accept": "application/json",
+                "content-type": "application/json",
+                "cookie": cookie,
+                "origin": relayUrl,
+                ...(init.headers ?? {}),
+            },
+        });
+    }
+    catch (error) {
+        if (controller.signal.aborted)
+            throw new Error("Frely Device Relay request timed out.");
+        throw error;
+    }
+    finally {
+        clearTimeout(timer);
+    }
+}
+function validateMcpUrl(value) {
+    const url = new URL(value);
+    if (url.protocol !== "https:" && !(url.protocol === "http:" && ["127.0.0.1", "localhost", "::1"].includes(url.hostname)))
+        throw new Error("Relay returned an invalid MCP URL.");
+    if (url.username || url.password || url.search || url.hash)
+        throw new Error("MCP URL must not contain URL userinfo, query parameters, or fragments.");
+    return url.toString();
+}
+function validateWebSocketUrl(value) {
+    const url = new URL(value);
+    if (url.protocol !== "wss:" && !(url.protocol === "ws:" && ["127.0.0.1", "localhost", "::1"].includes(url.hostname)))
+        throw new Error("Relay returned an invalid Device Relay WebSocket URL.");
+    if (url.username || url.password)
+        throw new Error("Device Relay WebSocket URL must not contain credentials.");
+    return url.toString();
+}
+async function responseJson(response) {
+    try {
+        return await response.json();
+    }
+    catch {
+        return null;
+    }
+}
+function object(value) {
+    if (!value || typeof value !== "object" || Array.isArray(value))
+        throw new Error("Frely Relay returned an invalid Device Relay response.");
+    return value;
+}
+function requiredString(record, key, max) {
+    const value = record[key];
+    if (typeof value !== "string" || value.length < 1 || value.length > max)
+        throw new Error(`Frely Relay returned an invalid ${key}.`);
+    return value;
+}
+function publicError(payload, status) {
+    const record = payload && typeof payload === "object" && !Array.isArray(payload) ? payload : {};
+    const error = record.error && typeof record.error === "object" && !Array.isArray(record.error) ? record.error : record;
+    return typeof error.message === "string" ? error.message : `Frely Device Relay request failed with HTTP ${status}.`;
+}
+//# sourceMappingURL=control.js.map

package/dist/device/control.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"control.js","sourceRoot":"","sources":["../../src/device/control.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAC7C,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAC1C,OAAO,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,0BAA0B,EAAE,MAAM,eAAe,CAAC;AACxG,OAAO,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,kBAAkB,EAAsB,MAAM,YAAY,CAAC;AAE3G,MAAM,cAAc,GAAG,OAAO,CAAC;AAC/B,MAAM,UAAU,GAAG,MAAM,CAAC;AAQ1B,MAAM,CAAC,KAAK,UAAU,YAAY;IAChC,MAAM,IAAI,GAAG,MAAM,YAAY,EAAE,CAAC;IAClC,MAAM,QAAQ,GAAG,MAAM,iBAAiB,EAAE,CAAC;IAC3C,IAAI,QAAQ,IAAI,QAAQ,CAAC,QAAQ,KAAK,IAAI,CAAC,MAAM,CAAC,QAAQ,IAAI,QAAQ,CAAC,MAAM,KAAK,IAAI,CAAC,IAAI,CAAC,EAAE;QAAE,OAAO,QAAQ,CAAC;IAChH,MAAM,QAAQ,GAAG,MAAM,0BAA0B,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACtF,MAAM,QAAQ,GAAG,MAAM,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,IAAI,CAAC,MAAM,EAAE,+BAA+B,EAAE;QACpG,MAAM,EAAE,MAAM;QACd,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;YACnB,aAAa,EAAE,QAAQ,CAAC,aAAa;YACrC,aAAa,EAAE,QAAQ,CAAC,aAAa;YACrC,UAAU,EAAE,QAAQ,EAAE;YACtB,QAAQ,EAAE,QAAQ,EAAE;YACpB,UAAU,EAAE,cAAc;SAC3B,CAAC;KACH,CAAC,CAAC;IACH,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG;QAAE,MAAM,IAAI,KAAK,CAAC,8DAA8D,CAAC,CAAC;IACxI,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC,QAAQ,CAAC,CAAC;IAC7C,IAAI,CAAC,QAAQ,CAAC,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,WAAW,CAAC,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;IACzE,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC;IAC/B,MAAM,QAAQ,GAAG,cAAc,CAAC,MAAM,EAAE,UAAU,EAAE,GAAG,CAAC,CAAC;IACzD,MAAM,MAAM,GAAG,cAAc,CAAC,cAAc,CAAC,MAAM,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC;IACtE,MAAM,OAAO,GAAkB;QAC7B,OAAO,EAAE,CAAC;QACV,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ;QAC9B,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE;QACpB,QAAQ;QACR,aAAa,EAAE,QAAQ,CAAC,aAAa;QACrC,aAAa,EAAE,QAAQ,CAAC,aAAa;QACrC,MAAM;QACN,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KACpC,CAAC;IACF,MAAM,kBAAkB,CAAC,OAAO,CAAC,CAAC;IAClC,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa;IACjC,MAAM,IAAI,GAAG,MAAM,YAAY,EAAE,CAAC;IAClC,MAAM,OAAO,GAAG,MAAM,iBAAiB,EAAE,CAAC;IAC1C,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,QAAQ,KAAK,IAAI,CAAC,MAAM,CAAC,QAAQ,IAAI,OAAO,CAAC,MAAM,KAAK,IAAI,CAAC,IAAI,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC;IAC1G,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,OAAuB;IAC3D,MAAM,IAAI,GAAG,MAAM,YAAY,EAAE,CAAC;IAClC,MAAM,MAAM,GAAG,OAAO,IAAI,MAAM,YAAY,EAAE,CAAC;IAC/C,IAAI,MAAM,CAAC,QAAQ,KAAK,IAAI,CAAC,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,MAAM,KAAK,IAAI,CAAC,IAAI,CAAC,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,4DAA4D,CAAC,CAAC;IAC9J,MAAM,QAAQ,GAAG,MAAM,0BAA0B,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACtF,IAAI,QAAQ,CAAC,aAAa,KAAK,MAAM,CAAC,aAAa;QAAE,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;IACvH,MAAM,KAAK,GAAG,qBAAqB,CAAC,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;IAC/D,MAAM,QAAQ,GAAG,MAAM,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,IAAI,CAAC,MAAM,EAAE,gCAAgC,EAAE;QACrG,MAAM,EAAE,MAAM;QACd,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC;KAC5B,CAAC,CAAC;IACH,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG;QAAE,MAAM,IAAI,KAAK,CAAC,iEAAiE,CAAC,CAAC;IAC3I,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC,QAAQ,CAAC,CAAC;IAC7C,IAAI,CAAC,QAAQ,CAAC,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,WAAW,CAAC,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;IACzE,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC;IAC/B,OAAO;QACL,YAAY,EAAE,oBAAoB,CAAC,cAAc,CAAC,MAAM,EAAE,cAAc,EAAE,IAAI,CAAC,CAAC;QAChF,WAAW,EAAE,cAAc,CAAC,MAAM,EAAE,aAAa,EAAE,IAAI,CAAC;QACxD,SAAS,EAAE,cAAc,CAAC,MAAM,EAAE,WAAW,EAAE,GAAG,CAAC;KACpD,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY;IAChC,MAAM,IAAI,GAAG,MAAM,YAAY,EAAE,CAAC;IAClC,MAAM,OAAO,GAAG,MAAM,aAAa,EAAE,CAAC;IACtC,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,kBAAkB,EAAE,CAAC;QAC3B,MAAM,oBAAoB,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC/D,OAAO;IACT,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,IAAI,CAAC,MAAM,EAAE,+BAA+B,EAAE;QACpG,MAAM,EAAE,MAAM;QACd,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC;KACrD,CAAC,CAAC;IACH,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG;QAAE,MAAM,IAAI,KAAK,CAAC,gEAAgE,CAAC,CAAC;IAC1I,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC,QAAQ,CAAC,CAAC;QAC7C,MAAM,IAAI,KAAK,CAAC,WAAW,CAAC,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;IACzD,CAAC;IACD,MAAM,kBAAkB,EAAE,CAAC;IAC3B,MAAM,oBAAoB,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AACjE,CAAC;AAED,KAAK,UAAU,UAAU,CAAC,QAAgB,EAAE,MAAc,EAAE,IAAY,EAAE,IAAiB;IACzF,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;IACzC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,UAAU,CAAC,CAAC;IAC/D,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC;IAChB,IAAI,CAAC;QACH,OAAO,MAAM,KAAK,CAAC,GAAG,QAAQ,GAAG,IAAI,EAAE,EAAE;YACvC,GAAG,IAAI;YACP,QAAQ,EAAE,OAAO;YACjB,MAAM,EAAE,UAAU,CAAC,MAAM;YACzB,OAAO,EAAE;gBACP,QAAQ,EAAE,kBAAkB;gBAC5B,cAAc,EAAE,kBAAkB;gBAClC,QAAQ,EAAE,MAAM;gBAChB,QAAQ,EAAE,QAAQ;gBAClB,GAAG,CAAC,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC;aACxB;SACF,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,UAAU,CAAC,MAAM,CAAC,OAAO;YAAE,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;QACxF,MAAM,KAAK,CAAC;IACd,CAAC;YAAS,CAAC;QACT,YAAY,CAAC,KAAK,CAAC,CAAC;IACtB,CAAC;AACH,CAAC;AAED,SAAS,cAAc,CAAC,KAAa;IACnC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IAC3B,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,CAAC,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,CAAC,WAAW,EAAE,WAAW,EAAE,KAAK,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;IAChL,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,IAAI;QAAE,MAAM,IAAI,KAAK,CAAC,wEAAwE,CAAC,CAAC;IACtJ,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC;AACxB,CAAC;AAED,SAAS,oBAAoB,CAAC,KAAa;IACzC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IAC3B,IAAI,GAAG,CAAC,QAAQ,KAAK,MAAM,IAAI,CAAC,CAAC,GAAG,CAAC,QAAQ,KAAK,KAAK,IAAI,CAAC,WAAW,EAAE,WAAW,EAAE,KAAK,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;IAC/L,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAC;IAC9G,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC;AACxB,CAAC;AAED,KAAK,UAAU,YAAY,CAAC,QAAkB;IAC5C,IAAI,CAAC;QAAC,OAAO,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,IAAI,CAAC;IAAC,CAAC;AAC9D,CAAC;AAED,SAAS,MAAM,CAAC,KAAc;IAC5B,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;IAC3I,OAAO,KAAgC,CAAC;AAC1C,CAAC;AAED,SAAS,cAAc,CAAC,MAA+B,EAAE,GAAW,EAAE,GAAW;IAC/E,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;IAC1B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,GAAG;QAAE,MAAM,IAAI,KAAK,CAAC,mCAAmC,GAAG,GAAG,CAAC,CAAC;IACpI,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,WAAW,CAAC,OAAgB,EAAE,MAAc;IACnD,MAAM,MAAM,GAAG,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAkC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC3H,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,IAAI,OAAO,MAAM,CAAC,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAgC,CAAC,CAAC,CAAC,MAAM,CAAC;IAClJ,OAAO,OAAO,KAAK,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,+CAA+C,MAAM,GAAG,CAAC;AACtH,CAAC"}

package/dist/device/identity.d.ts

@@ -0,0 +1,16 @@
+export interface DeviceIdentity {
+    publicKeySpki: string;
+    keyThumbprint: string;
+    signMessage(message: string): string;
+}
+export declare function loadOrCreateDeviceIdentity(relayUrl: string, userId: string): Promise<DeviceIdentity>;
+export declare function deleteDeviceIdentity(relayUrl: string, userId: string): Promise<void>;
+export declare function connectionProofMessage(deviceId: string, issuedAt: string, nonce: string): string;
+export declare function createConnectionProof(identity: DeviceIdentity, deviceId: string): {
+    deviceId: string;
+    publicKeySpki: string;
+    keyThumbprint: string;
+    issuedAt: string;
+    nonce: string;
+    signature: string;
+};

package/dist/device/identity.js

@@ -0,0 +1,49 @@
+import { createHash, createPrivateKey, createPublicKey, generateKeyPairSync, randomBytes, sign } from "node:crypto";
+import keytar from "keytar";
+const SERVICE = "frely-cli-device";
+function account(relayUrl, userId) {
+    return `${new URL(relayUrl).origin}|${userId}`;
+}
+export async function loadOrCreateDeviceIdentity(relayUrl, userId) {
+    const key = account(relayUrl, userId);
+    let privateKeyPem = await keytar.getPassword(SERVICE, key);
+    if (!privateKeyPem) {
+        const pair = generateKeyPairSync("ed25519");
+        privateKeyPem = pair.privateKey.export({ type: "pkcs8", format: "pem" }).toString();
+        await keytar.setPassword(SERVICE, key, privateKeyPem);
+    }
+    return identityFromPrivateKey(privateKeyPem);
+}
+export async function deleteDeviceIdentity(relayUrl, userId) {
+    await keytar.deletePassword(SERVICE, account(relayUrl, userId)).catch(() => false);
+}
+export function connectionProofMessage(deviceId, issuedAt, nonce) {
+    return `frely.device-relay.connect.v1\n${deviceId}\n${issuedAt}\n${nonce}`;
+}
+export function createConnectionProof(identity, deviceId) {
+    const issuedAt = new Date().toISOString();
+    const nonce = randomBytes(24).toString("base64url");
+    const message = connectionProofMessage(deviceId, issuedAt, nonce);
+    return {
+        deviceId,
+        publicKeySpki: identity.publicKeySpki,
+        keyThumbprint: identity.keyThumbprint,
+        issuedAt,
+        nonce,
+        signature: identity.signMessage(message),
+    };
+}
+function identityFromPrivateKey(privateKeyPem) {
+    const privateKey = createPrivateKey(privateKeyPem);
+    const publicDer = createPublicKey(privateKey).export({ type: "spki", format: "der" });
+    const publicKeySpki = Buffer.from(publicDer).toString("base64url");
+    const keyThumbprint = createHash("sha256").update(publicDer).digest("base64url");
+    return {
+        publicKeySpki,
+        keyThumbprint,
+        signMessage(message) {
+            return sign(null, Buffer.from(message, "utf8"), privateKey).toString("base64url");
+        },
+    };
+}
+//# sourceMappingURL=identity.js.map