pinomad 0.9.1 → 0.11.0

package/dist/chunk-n1m1tjrk.js

@@ -0,0 +1,214 @@
+#!/usr/bin/env node
+import {
+  joinServer,
+  openServiceSlot,
+  writeService
+} from "./chunk-gtdpjqa3.js";
+import"./chunk-ncbqa8jk.js";
+import"./chunk-44pnts98.js";
+import"./chunk-t91zt5f0.js";
+import {
+  normalizeOrigin,
+  readServerConfig
+} from "./chunk-etf7ef97.js";
+import"./chunk-y127fe1a.js";
+import {
+  argValue,
+  serviceManager,
+  withoutArg,
+  withoutRelayArgs
+} from "./chunk-vvj9b1gc.js";
+import"./chunk-jt34g8st.js";
+import"./chunk-kzbzacz9.js";
+import"./chunk-xqycs43g.js";
+import"./chunk-pqe7q1s7.js";
+import {
+  DEFAULT_DATA_DIR
+} from "./chunk-ngf1zatm.js";
+import {
+  commandHint
+} from "./chunk-sd5fkxjj.js";
+import"./chunk-df32avw6.js";
+
+// apps/host/src/cli/up.ts
+import { resolve } from "node:path";
+import { createInterface } from "node:readline/promises";
+import { parseArgs } from "node:util";
+var OFFICIAL_SERVER_ORIGIN = "https://app.pinomad.si";
+var DEFAULT_REMOTE_PORT = "7422";
+var message = (error) => error instanceof Error ? error.message : String(error);
+function resolveReach(flags, current) {
+  if (flags.server === undefined && flags.lan === undefined)
+    return;
+  if (current !== undefined)
+    return { server: flags.server ?? current.server, lan: flags.lan ?? current.lan };
+  return { server: flags.server ?? !flags.lan, lan: flags.lan ?? !flags.server };
+}
+async function currentReach(dataDir, deps) {
+  const slot = await openServiceSlot(dataDir, deps?.manager ?? serviceManager());
+  const config = await readServerConfig(dataDir);
+  if (config === undefined && !slot.state.installed)
+    return;
+  return {
+    server: config !== undefined,
+    lan: argValue(slot.previous?.hostArgs ?? [], "--remote-port") !== undefined
+  };
+}
+function withLan(hostArgs, port) {
+  if (port === undefined)
+    return withoutArg(withoutArg(hostArgs, "--remote-port"), "--public-url");
+  if (argValue(hostArgs, "--remote-port") === port)
+    return hostArgs;
+  return [...withoutArg(hostArgs, "--remote-port"), "--remote-port", port];
+}
+async function upHost(args, deps) {
+  const dataDir = resolve(args.dataDir);
+  const { reach } = args;
+  if (!reach.server && !reach.lan)
+    throw new Error("nothing to set up: choose the server, the LAN, or both");
+  const port = args.remotePort;
+  if (port !== undefined && !(/^\d+$/.test(port) && Number(port) >= 1 && Number(port) <= 65535)) {
+    throw new Error(`--remote-port must be a port number from 1 to 65535, got ${port}`);
+  }
+  const manager = deps?.manager ?? serviceManager();
+  const slot = await openServiceSlot(dataDir, manager);
+  const config = await readServerConfig(dataDir);
+  const origin = normalizeOrigin(args.origin ?? config?.origin ?? OFFICIAL_SERVER_ORIGIN);
+  if (reach.server && config !== undefined && normalizeOrigin(config.origin) !== origin) {
+    throw new Error(`this host is joined to ${config.origin} — run \`${commandHint("leave")}\` first to join ${origin}, ` + `or leave out --origin to stay`);
+  }
+  const lanPort = reach.lan ? args.remotePort ?? argValue(slot.previous?.hostArgs ?? [], "--remote-port") ?? DEFAULT_REMOTE_PORT : undefined;
+  const lan = (hostArgs) => withLan(hostArgs, lanPort);
+  const notes = [];
+  if (reach.server && config === undefined) {
+    const joined = await joinServer({ origin, dataDir, editHostArgs: lan }, { ...deps, manager });
+    return {
+      joined: { origin: joined.origin, username: joined.username, fresh: true },
+      ...lanPort === undefined ? {} : { lanPort },
+      service: joined.service,
+      notes
+    };
+  }
+  const edit = reach.server ? (hostArgs) => lan(withoutRelayArgs(hostArgs)) : lan;
+  const service = await writeService(slot, edit, { changed: reach.server });
+  if (!reach.server && config !== undefined) {
+    notes.push(`still joined to ${config.origin} — run \`${commandHint("leave")}\` to leave it`);
+  }
+  return {
+    ...reach.server && config !== undefined ? { joined: { origin: config.origin, ...config.username === undefined ? {} : { username: config.username }, fresh: false } } : {},
+    ...lanPort === undefined ? {} : { lanPort },
+    service,
+    notes
+  };
+}
+async function askOnTerminal(question) {
+  const terminal = createInterface({ input: process.stdin, output: process.stdout });
+  try {
+    return await terminal.question(question);
+  } finally {
+    terminal.close();
+  }
+}
+var CHOICES = [
+  { server: true, lan: false },
+  { server: false, lan: true },
+  { server: true, lan: true }
+];
+async function askReach(origin, fallback, ask) {
+  const preset = CHOICES.findIndex((choice) => choice.server === fallback.server && choice.lan === fallback.lan) + 1;
+  let question = `How should your other devices reach this host?
+` + `  1) Through ${origin}: from anywhere, with push notifications
+` + `  2) Only on your local network and tailnet
+` + `  3) Both
+` + `Choose 1, 2 or 3 [${preset}]: `;
+  for (;; ) {
+    const answer = (await ask(question)).trim();
+    if (answer === "")
+      return CHOICES[preset - 1];
+    const picked = CHOICES[Number(answer) - 1];
+    if (/^[123]$/.test(answer) && picked !== undefined)
+      return picked;
+    question = "Choose 1, 2 or 3: ";
+  }
+}
+var FLAGS = `choose with flags:
+  --server [--origin URL]   through a PiNomad server (default ${OFFICIAL_SERVER_ORIGIN})
+  --lan [--remote-port N]   only on the local network and tailnet (default port ${DEFAULT_REMOTE_PORT})
+  --server --lan            both
+  --yes                     keep what this host has, or the server on a new host`;
+async function main(argv, deps) {
+  const { values } = parseArgs({
+    args: [...argv],
+    allowNegative: true,
+    options: {
+      server: { type: "boolean" },
+      lan: { type: "boolean" },
+      yes: { type: "boolean", short: "y" },
+      origin: { type: "string" },
+      "remote-port": { type: "string" },
+      "data-dir": { type: "string" }
+    }
+  });
+  const log = deps?.log ?? ((line) => console.log(line));
+  try {
+    const dataDir = resolve(values["data-dir"] ?? DEFAULT_DATA_DIR);
+    const origin = normalizeOrigin(values.origin ?? (await readServerConfig(dataDir))?.origin ?? OFFICIAL_SERVER_ORIGIN);
+    const current = await currentReach(dataDir, deps);
+    let reach = resolveReach({ server: values.server, lan: values.lan }, current);
+    if (reach === undefined) {
+      const fallback = current !== undefined && (current.server || current.lan) ? current : { server: true, lan: false };
+      if (values.yes === true) {
+        reach = fallback;
+      } else if (!(deps?.interactive ?? (process.stdin.isTTY && process.stdout.isTTY))) {
+        console.error(`${commandHint("up")}: no terminal to ask how other devices reach this host — ${FLAGS}`);
+        process.exitCode = 2;
+        return;
+      } else {
+        reach = await askReach(origin, fallback, deps?.ask ?? askOnTerminal);
+      }
+    }
+    if (!reach.server && !reach.lan) {
+      console.error(`${commandHint("up")}: neither the server nor the LAN would be on — ` + `\`${commandHint("service")} install\` runs a host only this machine can reach`);
+      process.exitCode = 2;
+      return;
+    }
+    const outcome = await upHost({
+      dataDir,
+      origin,
+      reach,
+      ...values["remote-port"] === undefined ? {} : { remotePort: values["remote-port"] }
+    }, deps);
+    if (outcome.joined !== undefined) {
+      const who = outcome.joined.username ?? "an account";
+      log(outcome.joined.fresh ? `joined ${who} at ${outcome.joined.origin}` : `already joined ${who} at ${outcome.joined.origin}`);
+      log(`Sign in at ${outcome.joined.origin} on your other devices; they pair with this host on their own.`);
+    }
+    if (outcome.lanPort !== undefined) {
+      log(`LAN and tailnet: port ${outcome.lanPort}. Pair a device with \`${commandHint("pair")}\`.`);
+    }
+    for (const note of outcome.notes)
+      log(`note: ${note}`);
+    if (outcome.service === "installed")
+      log("service installed and started");
+    else if (outcome.service === "updated")
+      log("service updated; host restarted when idle");
+    else if (outcome.service === "unchanged")
+      log("service already running with these settings");
+    else {
+      console.error(`the service restart did not finish — check \`${commandHint("status")}\``);
+      process.exitCode = 1;
+    }
+  } catch (error) {
+    console.error(message(error));
+    process.exitCode = 1;
+  }
+}
+if (false)
+  ;
+export {
+  upHost,
+  resolveReach,
+  main,
+  OFFICIAL_SERVER_ORIGIN,
+  DEFAULT_REMOTE_PORT
+};

package/dist/{chunk-3p1eysm9.js → chunk-ncbqa8jk.js}

@@ -6,10 +6,10 @@ import {
   relayWsBase,
   signRelayChallenge,
   signRelayChallengeV2
-} from "./chunk-khcpv54k.js";
+} from "./chunk-y127fe1a.js";
 import {
   toBase64Url
-} from "./chunk-sygeb9qb.js";
+} from "./chunk-pqe7q1s7.js";
 
 // apps/host/src/cli/server-ops.ts
 import { WebSocket } from "ws";
@@ -55,6 +55,7 @@ function isSecureServerOrigin(origin) {
   const loopback = host === "localhost" || host.endsWith(".localhost") || ipv4Loopback || host === "::1" || host === "[::1]";
   return url.protocol === "https:" || url.protocol === "http:" && loopback;
 }
+var DEVICE_HOST_STATES = new Set(["registered", "revoking", "revoked"]);
 
 // apps/host/src/cli/server-ops.ts
 function assertSecureServerOrigin(origin) {
@@ -122,11 +123,11 @@ async function runServerOperation(options) {
         finish(() => reject(new Error(`${origin} ignored the operation — the server is too old for accounts; upgrade it first`)));
         return;
       }
-      if (frame.t === "incoming" || frame.t === "pairing-request" || frame.t === "push-result")
+      if (frame.t === "incoming" || frame.t === "pairing-request" || frame.t === "push-result" || frame.t === "revoke-device")
         return;
       finish(() => resolve(frame));
     });
   });
 }
 
-export { assertSecureServerOrigin, probeServerAccounts, runServerOperation };
+export { isSecureServerOrigin, assertSecureServerOrigin, probeServerAccounts, runServerOperation };

package/dist/{chunk-sygeb9qb.js → chunk-pqe7q1s7.js}

@@ -427,4 +427,4 @@ function concatParts(parts) {
   return out;
 }
 
-export { ENDPOINT_SET_SCHEMA_VERSION, MAX_HOST_ENDPOINT_URL_LENGTH, isLoopbackUrl, parseEndpointSet, encodeEndpointSetParam, HOST_SETTING_KEYS, THINKING_LEVELS, isThinkingLevel, isQueueMode, HOST_NAME_MAX_UNITS, cleanHostName, normalizeHostName, generateKeyPair, keyPairFromPrivate, initiateIK, respondIK, SECURE_PROLOGUE, SIGNAL_PROLOGUE, encodeClientHello, encodeHostHello, decodeClientHello, decodeHostHello, toBase64Url, fromBase64Url, SecureSession };
+export { ENDPOINT_SET_SCHEMA_VERSION, MAX_HOST_ENDPOINT_URL_LENGTH, isLoopbackUrl, parseEndpointSet, encodeEndpointSetParam, generateKeyPair, keyPairFromPrivate, initiateIK, respondIK, SECURE_PROLOGUE, SIGNAL_PROLOGUE, encodeClientHello, encodeHostHello, decodeClientHello, decodeHostHello, toBase64Url, fromBase64Url, SecureSession, HOST_SETTING_KEYS, THINKING_LEVELS, isThinkingLevel, isQueueMode, HOST_NAME_MAX_UNITS, cleanHostName, normalizeHostName };

package/dist/{chunk-fqgvf8v0.js → chunk-sd5fkxjj.js}

@@ -1,6 +1,6 @@
 // apps/host/src/distribution.ts
 import { fileURLToPath } from "node:url";
-var packagedVersion = "0.9.1";
+var packagedVersion = "0.11.0";
 var webRoot = fileURLToPath(new URL(packagedVersion === undefined ? "../../web/dist" : "../web/", import.meta.url));
 var hostEntry = packagedVersion === undefined ? { script: fileURLToPath(new URL("./main.ts", import.meta.url)), args: [] } : { script: fileURLToPath(new URL("./pinomad.js", import.meta.url)), args: ["host"] };
 var commandHint = (name) => packagedVersion === undefined ? `bun run ${name}` : `pinomad ${name}`;

package/dist/{chunk-5gp9svzs.js → chunk-t91zt5f0.js}

@@ -3,7 +3,7 @@ import {
   generateKeyPair,
   keyPairFromPrivate,
   toBase64Url
-} from "./chunk-sygeb9qb.js";
+} from "./chunk-pqe7q1s7.js";
 
 // apps/host/src/devices.ts
 import { link, readFile, unlink, writeFile } from "node:fs/promises";
@@ -52,7 +52,7 @@ async function admitDevice(harness, input, context) {
     if (revocations.revoked.includes(input.publicKey)) {
       revocations.revoked = revocations.revoked.filter((key) => key !== input.publicKey);
     }
-    return { outcome: "admitted", entry };
+    return { outcome: "admitted", entry, ...offer.requestId === undefined ? {} : { requestId: offer.requestId } };
   }, context);
 }
 async function loadHostKey(dataDir) {
@@ -117,7 +117,7 @@ function pairingOffers(ttlMs = 5 * 60 * 1000) {
   };
   return {
     create: (source) => mint({ source }),
-    createAccount: (binding) => mint({ source: "account", binding }),
+    createAccount: (binding, requestId) => mint({ source: "account", binding, ...requestId === undefined ? {} : { requestId } }),
     consume(secret) {
       prune();
       const candidate = Buffer.from(secret);
@@ -140,53 +140,4 @@ function pairingOffers(ttlMs = 5 * 60 * 1000) {
   };
 }
 
-// apps/host/src/server-config.ts
-import { randomBytes as randomBytes2 } from "node:crypto";
-import { readFile as readFile2, rename, rm, writeFile as writeFile2 } from "node:fs/promises";
-import { join as join2 } from "node:path";
-var SERVER_CONFIG_FILE = "server.json";
-var normalizeOrigin = (origin) => origin.replace(/\/+$/, "");
-async function readServerConfig(dataDir) {
-  let text;
-  try {
-    text = await readFile2(join2(dataDir, SERVER_CONFIG_FILE), "utf8");
-  } catch (error) {
-    if (error.code === "ENOENT")
-      return;
-    throw error;
-  }
-  let value;
-  try {
-    value = JSON.parse(text);
-  } catch {
-    throw new Error(`${join2(dataDir, SERVER_CONFIG_FILE)} is not valid JSON — delete it or run \`pinomad leave\``);
-  }
-  const origin = value?.origin;
-  if (typeof origin !== "string" || origin.trim() === "") {
-    throw new Error(`${join2(dataDir, SERVER_CONFIG_FILE)} is missing a string "origin"`);
-  }
-  const binding = value.binding;
-  return {
-    origin,
-    ...typeof binding === "string" && binding !== "" ? { binding } : {}
-  };
-}
-async function writeServerConfig(dataDir, config) {
-  const path = join2(dataDir, SERVER_CONFIG_FILE);
-  const tmp = `${path}.tmp-${process.pid}`;
-  await writeFile2(tmp, `${JSON.stringify({ origin: normalizeOrigin(config.origin), binding: randomBytes2(16).toString("base64url") })}
-`, { mode: 384 });
-  await rename(tmp, path);
-}
-var removeServerConfig = (dataDir) => rm(join2(dataDir, SERVER_CONFIG_FILE), { force: true });
-async function readServerBinding(dataDir) {
-  return (await readServerConfig(dataDir))?.binding;
-}
-function resolveRelayOrigin(flag, config) {
-  if (flag !== undefined && config !== undefined && normalizeOrigin(flag) !== normalizeOrigin(config.origin)) {
-    throw new Error(`--relay ${flag} disagrees with ${SERVER_CONFIG_FILE} (${config.origin}) — remove one`);
-  }
-  return flag ?? config?.origin;
-}
-
-export { DevicesDoc, ensureDevices, RevocationsDoc, admitDevice, loadHostKey, loadRelayKey, pairingOffers, normalizeOrigin, readServerConfig, writeServerConfig, removeServerConfig, readServerBinding, resolveRelayOrigin };
+export { DevicesDoc, ensureDevices, RevocationsDoc, admitDevice, loadHostKey, loadRelayKey, pairingOffers };

package/dist/{chunk-vax4zspw.js → chunk-tj57aqav.js}

@@ -1,10 +1,10 @@
 import {
   connectRemoteDurable
-} from "./chunk-4sepcfpy.js";
-import"./chunk-jgd38rna.js";
+} from "./chunk-jt34g8st.js";
+import"./chunk-xqycs43g.js";
 import {
   isLoopbackUrl
-} from "./chunk-sygeb9qb.js";
+} from "./chunk-pqe7q1s7.js";
 import {
   hostAddress
 } from "./chunk-ngf1zatm.js";

package/dist/{chunk-32g3m2h0.js → chunk-vvj9b1gc.js}

@@ -1,19 +1,19 @@
-import {
-  isParseArgsError
-} from "./chunk-kzbzacz9.js";
-import {
-  commandHint,
-  hostEntry,
-  packagedVersion
-} from "./chunk-fqgvf8v0.js";
 import {
   ProtocolMismatchError,
   connectRemoteDurable
-} from "./chunk-4sepcfpy.js";
+} from "./chunk-jt34g8st.js";
+import {
+  isParseArgsError
+} from "./chunk-kzbzacz9.js";
 import {
   DEFAULT_DATA_DIR,
   hostAddress
 } from "./chunk-ngf1zatm.js";
+import {
+  commandHint,
+  hostEntry,
+  packagedVersion
+} from "./chunk-sd5fkxjj.js";
 
 // apps/host/src/cli/service.ts
 import { execFile as execFile2 } from "node:child_process";
@@ -81,20 +81,21 @@ function argValue(args, flag) {
   }
   return value;
 }
-function withoutRelayArgs(args) {
+function withoutArg(args, flag) {
   const out = [];
   for (let i = 0;i < args.length; i += 1) {
     const arg = args[i];
-    if (arg === "--relay") {
+    if (arg === flag) {
       i += 1;
       continue;
     }
-    if (arg.startsWith("--relay="))
+    if (arg.startsWith(`${flag}=`))
       continue;
     out.push(arg);
   }
   return out;
 }
+var withoutRelayArgs = (args) => withoutArg(args, "--relay");
 var unescapeExec = (value) => value.replace(/\\(.)/g, "$1");
 var unspecify = (value) => value.replace(/%%/g, "%").replace(/\$\$/g, "$");
 var xmlUnescape = (value) => value.replace(/&quot;/g, '"').replace(/&apos;/g, "'").replace(/&lt;/g, "<").replace(/&gt;/g, ">").replace(/&amp;/g, "&");
@@ -409,15 +410,13 @@ async function install(argv) {
   console.log(`data dir: ${spec.dataDir}`);
   console.log(`browser link: ${commandHint("link")}    pairing QR: ${commandHint("pair")}`);
 }
-async function status(argv) {
-  const state = await serviceManager().state();
-  console.log(`service: ${state.installed ? state.detail : "not installed"}`);
-  if (packagedVersion === undefined) {
-    const head = await run2("git", ["rev-parse", "--short", "HEAD"], { cwd: repoRoot }).then(({ stdout }) => stdout.trim(), () => "unknown");
-    console.log(`checkout: ${head}`);
-  } else {
-    console.log(`version: ${packagedVersion}`);
-  }
+async function versionLine() {
+  if (packagedVersion !== undefined)
+    return `version: ${packagedVersion}`;
+  const head = await run2("git", ["rev-parse", "--short", "HEAD"], { cwd: repoRoot }).then(({ stdout }) => stdout.trim(), () => "unknown");
+  return `checkout: ${head}`;
+}
+async function reachabilityLine(argv) {
   try {
     const { url, token } = await hostAddress(argv);
     const remote = await connectToHost(url, token);
@@ -425,14 +424,20 @@ async function status(argv) {
       await remote.controller.toggleTasks();
     const tasks = remote.view.current().tasks;
     const count = tasks === undefined ? 0 : Object.keys(tasks.tasks).length;
-    console.log(`host: reachable at ${url}, ${count} live task${count === 1 ? "" : "s"}`);
     remote.close();
+    return `host: reachable at ${url}, ${count} live task${count === 1 ? "" : "s"}`;
   } catch (error) {
     if (isParseArgsError(error))
       throw error;
-    console.log(`host: unreachable (${message(error)})`);
+    return `host: unreachable (${message(error)})`;
   }
 }
+async function status(argv) {
+  const state = await serviceManager().state();
+  console.log(`service: ${state.installed ? state.detail : "not installed"}`);
+  console.log(await versionLine());
+  console.log(await reachabilityLine(argv));
+}
 async function restartService({
   force,
   argv,
@@ -536,4 +541,4 @@ async function main(argv) {
 }
 if (false) {}
 
-export { installSpec, argValue, withoutRelayArgs, serviceManager, restartService, main };
+export { installSpec, argValue, withoutArg, withoutRelayArgs, serviceManager, versionLine, reachabilityLine, restartService, main };