pinomad 0.3.0 → 0.4.0

package/dist/{chunk-n60kkf1m.js → chunk-17p6bfvy.js}

@@ -2,14 +2,14 @@
 import {
   restartService,
   serviceManager
-} from "./chunk-t9y2wfk5.js";
+} from "./chunk-akgxwg8f.js";
 import {
   globalPrefixOf,
   packageDir,
   packagedVersion
-} from "./chunk-3tf23vjq.js";
-import"./chunk-bggesvnj.js";
-import"./chunk-c155p0t0.js";
+} from "./chunk-fgx2sh7d.js";
+import"./chunk-374zqx5h.js";
+import"./chunk-myjp910s.js";
 import"./chunk-cjfmfyjb.js";
 import"./chunk-df32avw6.js";
 

package/dist/chunk-302y6by9.js

@@ -0,0 +1,50 @@
+// apps/host/src/server-config.ts
+import { randomBytes } from "node:crypto";
+import { readFile, rename, rm, writeFile } from "node:fs/promises";
+import { join } from "node:path";
+var SERVER_CONFIG_FILE = "server.json";
+var normalizeOrigin = (origin) => origin.replace(/\/+$/, "");
+async function readServerConfig(dataDir) {
+  let text;
+  try {
+    text = await readFile(join(dataDir, SERVER_CONFIG_FILE), "utf8");
+  } catch (error) {
+    if (error.code === "ENOENT")
+      return;
+    throw error;
+  }
+  let value;
+  try {
+    value = JSON.parse(text);
+  } catch {
+    throw new Error(`${join(dataDir, SERVER_CONFIG_FILE)} is not valid JSON — delete it or run \`pinomad leave\``);
+  }
+  const origin = value?.origin;
+  if (typeof origin !== "string" || origin.trim() === "") {
+    throw new Error(`${join(dataDir, SERVER_CONFIG_FILE)} is missing a string "origin"`);
+  }
+  const binding = value.binding;
+  return {
+    origin,
+    ...typeof binding === "string" && binding !== "" ? { binding } : {}
+  };
+}
+async function writeServerConfig(dataDir, config) {
+  const path = join(dataDir, SERVER_CONFIG_FILE);
+  const tmp = `${path}.tmp-${process.pid}`;
+  await writeFile(tmp, `${JSON.stringify({ origin: normalizeOrigin(config.origin), binding: randomBytes(16).toString("base64url") })}
+`, { mode: 384 });
+  await rename(tmp, path);
+}
+var removeServerConfig = (dataDir) => rm(join(dataDir, SERVER_CONFIG_FILE), { force: true });
+async function readServerBinding(dataDir) {
+  return (await readServerConfig(dataDir))?.binding;
+}
+function resolveRelayOrigin(flag, config) {
+  if (flag !== undefined && config !== undefined && normalizeOrigin(flag) !== normalizeOrigin(config.origin)) {
+    throw new Error(`--relay ${flag} disagrees with ${SERVER_CONFIG_FILE} (${config.origin}) — remove one`);
+  }
+  return flag ?? config?.origin;
+}
+
+export { normalizeOrigin, readServerConfig, writeServerConfig, removeServerConfig, readServerBinding, resolveRelayOrigin };

package/dist/{chunk-bggesvnj.js → chunk-374zqx5h.js}

@@ -3,105 +3,19 @@ import {
   INVALID_FRAME_CLOSE_CODE,
   PROTOCOL,
   UNAUTHORIZED_CLOSE_CODE,
+  checkoutOf,
   conversationStream,
   docStream,
+  homeOf,
   hostStreams,
   hostSupportsCall,
-  hostSupportsFeature
-} from "./chunk-c155p0t0.js";
+  hostSupportsFeature,
+  organize
+} from "./chunk-myjp910s.js";
 
 // packages/protocol/src/remote-durable.ts
 import { applyImmutable } from "@earendil-works/chord/delta";
 
-// packages/protocol/src/organization.ts
-function organize(index, summaries) {
-  const summaryById = new Map(summaries.map((summary) => [summary.id, summary]));
-  const nodes = new Map;
-  const topLevel = new Map;
-  for (const entry of index.conversations) {
-    if (entry.archived === true)
-      continue;
-    const home = entry.home;
-    if (home.kind === "project" && !index.projects.some((project) => project.path === home.path))
-      continue;
-    const summary = summaryById.get(entry.id);
-    if (summary === undefined)
-      continue;
-    topLevel.set(entry.id, entry);
-    nodes.set(entry.id, { summary, children: [] });
-  }
-  for (const summary of summaries) {
-    const chain = [summary];
-    let current = summary;
-    while (!topLevel.has(current.id)) {
-      const parent = current.parent === undefined ? undefined : summaryById.get(current.parent);
-      if (parent === undefined || chain.includes(parent))
-        break;
-      chain.push(parent);
-      current = parent;
-    }
-    if (!topLevel.has(current.id))
-      continue;
-    for (let i = chain.length - 1;i >= 0; i--) {
-      const member = chain[i];
-      if (!nodes.has(member.id))
-        nodes.set(member.id, { summary: member, children: [] });
-      if (i < chain.length - 1) {
-        const parent = nodes.get(chain[i + 1].id);
-        const child = nodes.get(member.id);
-        if (!parent.children.includes(child))
-          parent.children.push(child);
-      }
-    }
-  }
-  const byIdAscending = (a, b) => a.summary.id - b.summary.id;
-  const nodeList = (entry) => sortChildren(nodes.get(entry.id));
-  const sortChildren = (node) => ({
-    summary: node.summary,
-    children: [...node.children].sort(byIdAscending).map(sortChildren)
-  });
-  const entries = [...topLevel.values()].sort((a, b) => b.createdAt - a.createdAt);
-  return {
-    chats: entries.filter((entry) => entry.home.kind === "chat").map(nodeList),
-    projects: [...index.projects].sort((a, b) => b.addedAt - a.addedAt).map((project) => ({
-      project,
-      conversations: entries.filter((entry) => entry.home.kind === "project" && entry.home.path === project.path).map(nodeList)
-    }))
-  };
-}
-function checkoutOf(index, summaries, id) {
-  const record = index.checkouts?.find((checkout) => checkout.conversationId === id);
-  if (record !== undefined)
-    return record;
-  const summaryById = new Map(summaries.map((summary) => [summary.id, summary]));
-  const seen = new Set;
-  let current = summaryById.get(id);
-  while (current !== undefined && !seen.has(current.id)) {
-    seen.add(current.id);
-    const ancestor = index.checkouts?.find((checkout) => checkout.conversationId === current.id);
-    if (ancestor !== undefined)
-      return ancestor;
-    current = current.parent === undefined ? undefined : summaryById.get(current.parent);
-  }
-  return;
-}
-function homeOf(index, summaries, id) {
-  const entry = index.conversations.find((candidate) => candidate.id === id);
-  if (entry !== undefined)
-    return entry.home;
-  const summaryById = new Map(summaries.map((summary) => [summary.id, summary]));
-  const seen = new Set;
-  let current = summaryById.get(id);
-  while (current !== undefined && !seen.has(current.id)) {
-    seen.add(current.id);
-    const ancestor = index.conversations.find((candidate) => candidate.id === current.id);
-    if (ancestor !== undefined)
-      return ancestor.home;
-    current = current.parent === undefined ? undefined : summaryById.get(current.parent);
-  }
-  return;
-}
-
 // packages/protocol/src/transport.ts
 function webSocketTransport(url, token) {
   return {
@@ -338,7 +252,7 @@ class RemoteClient {
     Promise.all(hostStreams(hostMinor).map((stream) => this.#snapshot(stream))).then(() => {
       this.#state = {
         session: hello.session,
-        organized: { chats: [], projects: [] },
+        organized: { chats: [], projects: [], archived: [] },
         models: this.#host("models") ?? hello.models,
         defaults: this.#effectiveDefaults(hello.defaults ?? {}),
         notices: [],
@@ -608,6 +522,9 @@ class RemoteClient {
         if (!hostSupportsCall(this.#hostMinor, "updateSettings")) {
           throw new Error("The host is too old for this (needs protocol 5.2); run `pinomad upgrade` on the host");
         }
+        if (patch.acceptAccountDevices !== undefined && !hostSupportsFeature(this.#hostMinor, "acceptAccountDevices")) {
+          throw new Error("The host is too old for this (needs protocol 5.8); run `pinomad upgrade` on the host");
+        }
         return this.#call("updateSettings", { patch });
       }),
       createAgent: (role) => this.#request(async () => {
@@ -627,6 +544,12 @@ class RemoteClient {
           throw new Error("The host is too old for this (needs protocol 5.6); run `pinomad upgrade` on the host");
         }
         await this.#call("deleteAgent", { name });
+      }),
+      setPushToken: (token) => this.#request(async () => {
+        if (!hostSupportsCall(this.#hostMinor, "setPushToken")) {
+          throw new Error("The host is too old for this (needs protocol 5.7); run `pinomad upgrade` on the host");
+        }
+        await this.#call("setPushToken", { token });
       })
     };
   }

package/dist/chunk-5785kwej.js

@@ -0,0 +1,128 @@
+import {
+  relayWsBase
+} from "./chunk-knaw1a9g.js";
+import {
+  RELAY_CLOSE,
+  decodeRelayToHost,
+  encodeRelayFrame,
+  relayHostId,
+  signRelayChallenge,
+  signRelayChallengeV2,
+  toBase64Url
+} from "./chunk-7gmkgyaz.js";
+
+// apps/host/src/cli/server-ops.ts
+import { WebSocket } from "ws";
+
+// packages/client/src/account.ts
+var fallbackFetch = (url, init) => fetch(url, init);
+async function probeAccounts(origin, fetchImpl = fallbackFetch) {
+  const timeout = new AbortController;
+  const timer = setTimeout(() => timeout.abort(), 5000);
+  try {
+    const response = await fetchImpl(`${origin.replace(/\/+$/, "")}/api/me`, { signal: timeout.signal });
+    if (response.status === 401)
+      return "enabled";
+    if (response.status === 200) {
+      const text = await response.text();
+      let body;
+      try {
+        body = JSON.parse(text);
+      } catch {
+        return "disabled";
+      }
+      return typeof body?.user === "object" && body.user !== null ? "enabled" : "disabled";
+    }
+    return response.status === 404 ? "disabled" : "unreachable";
+  } catch {
+    return "unreachable";
+  } finally {
+    clearTimeout(timer);
+  }
+}
+function isSecureServerOrigin(origin) {
+  let url;
+  try {
+    url = new URL(origin);
+  } catch {
+    return false;
+  }
+  const host = url.hostname;
+  const loopback = host === "localhost" || host.endsWith(".localhost") || host.startsWith("127.") || host === "::1" || host === "[::1]";
+  return url.protocol === "https:" || url.protocol === "http:" && loopback;
+}
+
+// apps/host/src/cli/server-ops.ts
+function assertSecureServerOrigin(origin) {
+  try {
+    new URL(origin);
+  } catch {
+    throw new Error(`not a URL: ${origin}`);
+  }
+  if (isSecureServerOrigin(origin))
+    return;
+  throw new Error(`account operations need an https origin (loopback http allowed for development) — got ${origin}`);
+}
+var probeServerAccounts = (origin, fetchImpl = fetch) => probeAccounts(origin, fetchImpl);
+var closeReason = (code, origin) => {
+  switch (code) {
+    case RELAY_CLOSE.badSignature:
+      return `the server rejected this host's registration signature (${code})`;
+    case RELAY_CLOSE.hostNotAllowed:
+      return `the server does not know this host (${code}) — a pre-accounts server can't do join/leave; upgrade it first`;
+    default:
+      return `the connection to ${origin} closed (${code})`;
+  }
+};
+async function runServerOperation(options) {
+  const origin = options.origin.replace(/\/+$/, "");
+  assertSecureServerOrigin(origin);
+  const hostId = relayHostId(options.signingKey.publicKey);
+  const timeoutMs = options.timeoutMs ?? 1e4;
+  const socket = new WebSocket(`${relayWsBase(origin)}/host`, { handshakeTimeout: timeoutMs });
+  return await new Promise((resolve, reject) => {
+    const finish = (done) => {
+      clearTimeout(timer);
+      socket.close();
+      done();
+    };
+    const timer = setTimeout(() => finish(() => reject(new Error(`no answer from ${origin} within ${timeoutMs / 1000}s`))), timeoutMs);
+    socket.once("error", () => {});
+    socket.once("close", (code) => finish(() => reject(new Error(closeReason(code, origin)))));
+    socket.on("message", (data, isBinary) => {
+      let frame;
+      try {
+        if (isBinary)
+          throw new Error("binary frame");
+        frame = decodeRelayToHost(data.toString());
+      } catch {
+        finish(() => reject(new Error(`${origin} is not speaking the pinomad relay protocol`)));
+        return;
+      }
+      if (frame.t === "challenge") {
+        const noisePublicKey = toBase64Url(options.noisePublicKey);
+        const challenge = { relayOrigin: origin, hostId, nonce: frame.nonce };
+        socket.send(encodeRelayFrame({
+          t: "register",
+          hostId,
+          signature: signRelayChallenge(options.signingKey.secretKey, challenge),
+          signatureV2: signRelayChallengeV2(options.signingKey.secretKey, { ...challenge, noisePublicKey }),
+          noisePublicKey,
+          op: options.op,
+          ...options.joinToken === undefined ? {} : { joinToken: options.joinToken },
+          ...options.name === undefined ? {} : { name: options.name }
+        }));
+        return;
+      }
+      if (frame.t === "registered") {
+        finish(() => reject(new Error(`${origin} ignored the operation — the server is too old for accounts; upgrade it first`)));
+        return;
+      }
+      if (frame.t === "incoming" || frame.t === "pairing-request")
+        return;
+      finish(() => resolve(frame));
+    });
+  });
+}
+
+export { assertSecureServerOrigin, probeServerAccounts, runServerOperation };

package/dist/{chunk-z4x88s0q.js → chunk-7gmkgyaz.js}

@@ -290,6 +290,7 @@ function encodeRelayFrame(frame) {
   return JSON.stringify(frame);
 }
 var isString2 = (value) => typeof value === "string";
+var isBoundedString = (value, max = 64) => isString2(value) && value.length > 0 && value.length <= max;
 function decodeJson2(text) {
   try {
     return JSON.parse(text);
@@ -310,16 +311,71 @@ function decodeRelayToHost(text) {
       if (!isString2(value.connId))
         throw new Error("malformed incoming");
       return { t: "incoming", connId: value.connId };
+    case "pairing-request":
+      if (!isBoundedString(value.requestId))
+        throw new Error("malformed pairing-request");
+      return { t: "pairing-request", requestId: value.requestId };
+    case "joined":
+      if (!isString2(value.username))
+        throw new Error("malformed joined");
+      return { t: "joined", username: value.username };
+    case "left":
+      return { t: "left" };
+    case "refused":
+      if (!isString2(value.reason))
+        throw new Error("malformed refused");
+      return { t: "refused", reason: value.reason };
     default:
       throw new Error("unknown relay frame");
   }
 }
 function decodeHostToRelay(text) {
   const value = decodeJson2(text);
-  if (value?.t !== "register" || !isString2(value.hostId) || !isString2(value.signature)) {
+  switch (value?.t) {
+    case "register":
+      return decodeRegister(value);
+    case "pairing":
+      if (!isBoundedString(value.requestId) || !isBoundedString(value.secret) || typeof value.expiresAt !== "number" || !Number.isFinite(value.expiresAt)) {
+        throw new Error("malformed pairing");
+      }
+      return { t: "pairing", requestId: value.requestId, secret: value.secret, expiresAt: value.expiresAt };
+    case "pairing-refused":
+      if (!isBoundedString(value.requestId) || !isBoundedString(value.reason)) {
+        throw new Error("malformed pairing-refused");
+      }
+      return { t: "pairing-refused", requestId: value.requestId, reason: value.reason };
+    default:
+      throw new Error("unknown host frame");
+  }
+}
+function decodeRegister(value) {
+  if (value.t !== "register" || !isString2(value.hostId) || !isString2(value.signature)) {
+    throw new Error("malformed register");
+  }
+  if (value.op !== undefined && value.op !== "join" && value.op !== "leave")
+    throw new Error("malformed register");
+  if (value.signatureV2 !== undefined && !isString2(value.signatureV2))
+    throw new Error("malformed register");
+  if (value.noisePublicKey !== undefined && !isString2(value.noisePublicKey))
+    throw new Error("malformed register");
+  if (value.joinToken !== undefined && !isString2(value.joinToken))
+    throw new Error("malformed register");
+  if (value.name !== undefined && !isString2(value.name))
+    throw new Error("malformed register");
+  if (value.features !== undefined && (!Array.isArray(value.features) || value.features.length > 16 || !value.features.every((feature) => isString2(feature) && feature.length <= 64))) {
     throw new Error("malformed register");
   }
-  return { t: "register", hostId: value.hostId, signature: value.signature };
+  return {
+    t: "register",
+    hostId: value.hostId,
+    signature: value.signature,
+    ...value.signatureV2 === undefined ? {} : { signatureV2: value.signatureV2 },
+    ...value.noisePublicKey === undefined ? {} : { noisePublicKey: value.noisePublicKey },
+    ...value.op === undefined ? {} : { op: value.op },
+    ...value.joinToken === undefined ? {} : { joinToken: value.joinToken },
+    ...value.name === undefined ? {} : { name: value.name },
+    ...value.features === undefined ? {} : { features: value.features }
+  };
 }
 function relayHostId(publicKey) {
   if (publicKey.length !== 32)
@@ -343,5 +399,22 @@ function verifyRelayChallenge(signature, args) {
     return false;
   }
 }
+function relayChallengeMessageV2(args) {
+  return utf82.encode(`pinomad-relay/2
+${args.relayOrigin}
+${args.hostId}
+${args.nonce}
+${args.noisePublicKey}`);
+}
+function signRelayChallengeV2(secretKey, args) {
+  return toBase64Url(ed25519.sign(relayChallengeMessageV2(args), secretKey));
+}
+function verifyRelayChallengeV2(signature, args) {
+  try {
+    return ed25519.verify(fromBase64Url(signature), relayChallengeMessageV2(args), fromBase64Url(args.hostId));
+  } catch {
+    return false;
+  }
+}
 
-export { generateKeyPair, keyPairFromPrivate, respondIK, SECURE_PROLOGUE, encodeHostHello, decodeClientHello, toBase64Url, fromBase64Url, SecureSession, RELAY_CLOSE, encodeRelayFrame, decodeRelayToHost, decodeHostToRelay, relayHostId, signRelayChallenge, verifyRelayChallenge };
+export { generateKeyPair, keyPairFromPrivate, respondIK, SECURE_PROLOGUE, encodeHostHello, decodeClientHello, toBase64Url, fromBase64Url, SecureSession, RELAY_CLOSE, encodeRelayFrame, decodeRelayToHost, decodeHostToRelay, relayHostId, signRelayChallenge, verifyRelayChallenge, signRelayChallengeV2, verifyRelayChallengeV2 };

package/dist/chunk-837gh8nr.js

@@ -0,0 +1,138 @@
+import {
+  fromBase64Url,
+  generateKeyPair,
+  keyPairFromPrivate,
+  toBase64Url
+} from "./chunk-7gmkgyaz.js";
+
+// apps/host/src/devices.ts
+import { readFile, writeFile } from "node:fs/promises";
+import { join } from "node:path";
+import { randomBytes, timingSafeEqual } from "node:crypto";
+import { ed25519 } from "@noble/curves/ed25519.js";
+import { defineDoc } from "@earendil-works/pi-durable";
+var DevicesDoc = defineDoc({
+  kind: "pinomad.devices",
+  version: 1,
+  scope: "session",
+  initial: () => ({ devices: [] })
+});
+async function ensureDevices(harness, context) {
+  await harness.commit(async (tx) => void await tx.doc(DevicesDoc), context);
+}
+var RevocationsDoc = defineDoc({
+  kind: "pinomad.revocations",
+  version: 1,
+  scope: "session",
+  initial: () => ({ revoked: [] })
+});
+async function admitDevice(harness, input, context) {
+  return await harness.commit(async (tx) => {
+    const devices = await tx.doc(DevicesDoc);
+    if (devices.devices.some((entry2) => entry2.publicKey === input.publicKey)) {
+      return { outcome: "registered" };
+    }
+    if (input.pair === undefined)
+      return { outcome: "refused" };
+    const offer = input.offers.consume(input.pair.secret);
+    if (offer === undefined)
+      return { outcome: "refused" };
+    const revocations = await tx.doc(RevocationsDoc);
+    if (offer.source === "account") {
+      const binding = await input.serverBinding();
+      if (revocations.revoked.includes(input.publicKey) || binding === undefined || offer.binding !== binding || !input.acceptAccountDevices()) {
+        return { outcome: "refused" };
+      }
+    }
+    const name = input.pair.name.trim().slice(0, 64) || "Unknown device";
+    const entry = { publicKey: input.publicKey, name, pairedAt: Date.now(), source: offer.source };
+    devices.devices.push(entry);
+    if (revocations.revoked.includes(input.publicKey)) {
+      revocations.revoked = revocations.revoked.filter((key) => key !== input.publicKey);
+    }
+    return { outcome: "admitted", entry };
+  }, context);
+}
+async function loadHostKey(dataDir) {
+  const path = join(dataDir, "host-key");
+  try {
+    const text = (await readFile(path, "utf8")).trim();
+    return keyPairFromPrivate(fromBase64Url(text));
+  } catch (error) {
+    if (error.code !== "ENOENT")
+      throw error;
+    const pair = generateKeyPair();
+    try {
+      await writeFile(path, `${toBase64Url(pair.privateKey)}
+`, { flag: "wx", mode: 384 });
+    } catch (race) {
+      if (race.code !== "EEXIST")
+        throw race;
+      return loadHostKey(dataDir);
+    }
+    return pair;
+  }
+}
+async function loadRelayKey(dataDir) {
+  const path = join(dataDir, "relay-key");
+  try {
+    const secretKey = fromBase64Url((await readFile(path, "utf8")).trim());
+    if (secretKey.length !== 32)
+      throw new Error(`bad relay key in ${path}`);
+    return { secretKey, publicKey: ed25519.getPublicKey(secretKey) };
+  } catch (error) {
+    if (error.code !== "ENOENT")
+      throw error;
+    const { secretKey, publicKey } = ed25519.keygen();
+    try {
+      await writeFile(path, `${toBase64Url(secretKey)}
+`, { flag: "wx", mode: 384 });
+    } catch (race) {
+      if (race.code !== "EEXIST")
+        throw race;
+      return loadRelayKey(dataDir);
+    }
+    return { secretKey, publicKey };
+  }
+}
+function pairingOffers(ttlMs = 5 * 60 * 1000) {
+  const live = new Map;
+  const prune = () => {
+    const now = Date.now();
+    for (const [secret, offer] of live)
+      if (offer.expiresAt <= now)
+        live.delete(secret);
+  };
+  const mint = (offer) => {
+    prune();
+    const secret = toBase64Url(randomBytes(16));
+    const expiresAt = Date.now() + ttlMs;
+    live.set(secret, { expiresAt, ...offer });
+    return { secret, expiresAt };
+  };
+  return {
+    create: (source) => mint({ source }),
+    createAccount: (binding) => mint({ source: "account", binding }),
+    consume(secret) {
+      prune();
+      const candidate = Buffer.from(secret);
+      for (const [key, offer] of live) {
+        const offerBytes = Buffer.from(key);
+        if (offerBytes.length !== candidate.length)
+          continue;
+        if (timingSafeEqual(offerBytes, candidate)) {
+          live.delete(key);
+          return offer;
+        }
+      }
+      return;
+    },
+    revokeAccount() {
+      for (const [key, offer] of live)
+        if (offer.source === "account")
+          live.delete(key);
+    }
+  };
+}
+
+export { DevicesDoc, ensureDevices, RevocationsDoc, admitDevice, loadHostKey, loadRelayKey, pairingOffers };