very-happy-cli 0.2.159 → 0.2.161

package/dist/auth-x4CEoysH.cjs

@@ -0,0 +1,220 @@
+'use strict';
+
+var chalk = require('chalk');
+var persistence = require('./persistence-CBNMzSa8.cjs');
+var auth = require('./auth-Bt4ceBBy.cjs');
+var configuration = require('./configuration-v9f8LM9T.cjs');
+var node_fs = require('node:fs');
+var node_readline = require('node:readline');
+var controlClient = require('./controlClient-fEHE85bH.cjs');
+var logger = require('./logger-Bc8-u1w0.cjs');
+var os = require('node:os');
+var authRelay = require('./authRelay-BdYkC1Po.cjs');
+require('node:fs/promises');
+require('zod');
+require('node:path');
+require('./package-Cl5BEP5x.cjs');
+require('node:crypto');
+require('tweetnacl');
+require('node:util');
+require('axios');
+require('./time-CNRE4ChD.cjs');
+require('./browser-BDOlKWYe.cjs');
+require('open');
+
+function localMachineIdentityStatus(machineId) {
+  if (machineId) {
+    return {
+      configured: true,
+      label: "Local machine identity configured (relay registration not checked)"
+    };
+  }
+  return {
+    configured: false,
+    label: "Local machine identity missing",
+    nextStep: 'Run "very-happy auth login --force" to create and register one'
+  };
+}
+
+const DEFAULT_SERVER_URL = "https://veryhappy.dev";
+async function handleAuthCommand(args) {
+  const subcommand = args[0];
+  if (!subcommand || subcommand === "help" || subcommand === "--help" || subcommand === "-h") {
+    showAuthHelp();
+    return;
+  }
+  switch (subcommand) {
+    case "login":
+      await handleAuthLogin(args.slice(1));
+      break;
+    case "logout":
+      await handleAuthLogout();
+      break;
+    case "status":
+      await handleAuthStatus();
+      break;
+    default:
+      console.error(chalk.red(`Unknown auth subcommand: ${subcommand}`));
+      showAuthHelp();
+      process.exit(1);
+  }
+}
+function showAuthHelp() {
+  console.log(`
+${chalk.bold("very-happy auth")} - Authentication management
+
+${chalk.bold("Usage:")}
+  very-happy auth login [--force]    Authenticate with Very Happy
+  very-happy auth logout             Remove authentication and machine data
+  very-happy auth status             Show authentication status
+  very-happy auth help               Show this help message
+
+${chalk.bold("Options:")}
+  --force    Clear credentials, machine ID, and stop daemon before re-auth
+
+${chalk.gray("Security: the configured Very Happy server is a trusted relay and account service.")}
+${chalk.gray("It can recover account material, access relayed content, and act through capabilities")}
+${chalk.gray("exposed by an online daemon. Use a server you trust.")}
+`);
+}
+function printDaemonNextStep() {
+  console.log(chalk.bold("\nNext: start the machine daemon"));
+  if (process.env.HAPPY_SERVER_URL || process.env.HAPPY_WEBAPP_URL) {
+    console.log(chalk.yellow("  Keep the same HAPPY_SERVER_URL and HAPPY_WEBAPP_URL environment when starting it."));
+  }
+  console.log(`  ${chalk.cyan("very-happy daemon start")}`);
+  console.log(chalk.gray("  It starts in the background and keeps this machine available in Web."));
+}
+async function handleAuthLogin(args) {
+  const forceAuth = args.includes("--force") || args.includes("-f");
+  if (forceAuth) {
+    console.log(chalk.yellow("Force authentication requested."));
+    console.log(chalk.gray("This will:"));
+    console.log(chalk.gray("  \u2022 Clear existing credentials"));
+    console.log(chalk.gray("  \u2022 Clear machine ID"));
+    console.log(chalk.gray("  \u2022 Stop daemon if running"));
+    console.log(chalk.gray("  \u2022 Re-authenticate and register machine\n"));
+    try {
+      logger.logger.debug("Stopping daemon for force auth...");
+      await controlClient.stopDaemon();
+      console.log(chalk.gray("\u2713 Stopped daemon"));
+    } catch (error) {
+      logger.logger.debug("Daemon was not running or failed to stop:", error);
+    }
+    await persistence.clearCredentials();
+    console.log(chalk.gray("\u2713 Cleared credentials"));
+    await persistence.clearMachineId();
+    console.log(chalk.gray("\u2713 Cleared machine ID"));
+    console.log("");
+  }
+  if (!forceAuth) {
+    const existingCreds = await persistence.readCredentials();
+    const settings = await persistence.readSettings();
+    if (existingCreds && settings?.machineId) {
+      const relayProblem = authRelay.credentialRelayProblem(existingCreds.authServerUrl, configuration.configuration.serverUrl);
+      if (relayProblem) {
+        console.log(chalk.red(`\u2717 ${relayProblem}`));
+        console.log(chalk.yellow("  Use a separate HAPPY_HOME_DIR for each relay (recommended),"));
+        console.log(chalk.yellow("  or run 'very-happy auth login --force' to replace this home's credentials."));
+        process.exitCode = 1;
+        return;
+      }
+      console.log(chalk.green("\u2713 Already authenticated"));
+      console.log(chalk.gray(`  Machine ID: ${settings.machineId}`));
+      console.log(chalk.gray(`  Host: ${os.hostname()}`));
+      console.log(chalk.gray(`  Use 'very-happy auth login --force' to re-authenticate`));
+      printDaemonNextStep();
+      return;
+    } else if (existingCreds && !settings?.machineId) {
+      console.log(chalk.yellow("\u26A0\uFE0F  Credentials exist but machine ID is missing"));
+      console.log(chalk.gray("  This can happen if --auth flag was used previously"));
+      console.log(chalk.gray("  Fixing by setting up machine...\n"));
+    }
+  }
+  try {
+    const result = await auth.authAndSetupMachineIfNeeded();
+    console.log(chalk.green("\n\u2713 Authentication successful"));
+    console.log(chalk.gray(`  Machine ID: ${result.machineId}`));
+    printDaemonNextStep();
+  } catch (error) {
+    console.error(chalk.red("Authentication failed:"), error instanceof Error ? error.message : "Unknown error");
+    process.exit(1);
+  }
+}
+async function handleAuthLogout() {
+  const happyDir = configuration.configuration.happyHomeDir;
+  const credentials = await persistence.readCredentials();
+  if (!credentials) {
+    console.log(chalk.yellow("Not currently authenticated"));
+    return;
+  }
+  console.log(chalk.blue("This will log you out of Happy"));
+  console.log(chalk.yellow("\u26A0\uFE0F  You will need to re-authenticate to use Happy again"));
+  const rl = node_readline.createInterface({
+    input: process.stdin,
+    output: process.stdout
+  });
+  const answer = await new Promise((resolve) => {
+    rl.question(chalk.yellow("Are you sure you want to log out? (y/N): "), resolve);
+  });
+  rl.close();
+  if (answer.toLowerCase() === "y" || answer.toLowerCase() === "yes") {
+    try {
+      try {
+        await controlClient.stopDaemon();
+        console.log(chalk.gray("Stopped daemon"));
+      } catch {
+      }
+      if (node_fs.existsSync(happyDir)) {
+        node_fs.rmSync(happyDir, { recursive: true, force: true });
+      }
+      console.log(chalk.green("\u2713 Successfully logged out"));
+      console.log(chalk.gray('  Run "very-happy auth login" to authenticate again'));
+    } catch (error) {
+      throw new Error(`Failed to logout: ${error instanceof Error ? error.message : "Unknown error"}`);
+    }
+  } else {
+    console.log(chalk.blue("Logout cancelled"));
+  }
+}
+async function handleAuthStatus() {
+  const credentials = await persistence.readCredentials();
+  const settings = await persistence.readSettings();
+  console.log(chalk.bold("\nAuthentication Status\n"));
+  if (!credentials) {
+    console.log(chalk.red("\u2717 Not authenticated"));
+    console.log(chalk.gray('  Run "very-happy auth login" to authenticate'));
+    return;
+  }
+  const relayProblem = authRelay.credentialRelayProblem(credentials.authServerUrl, configuration.configuration.serverUrl);
+  if (relayProblem) {
+    console.log(chalk.red(`\u2717 Credentials found, but not valid for the configured relay: ${relayProblem}`));
+    console.log(chalk.gray("  Use another HAPPY_HOME_DIR or run 'very-happy auth login --force'."));
+  } else {
+    console.log(chalk.green("\u2713 Authenticated to the configured relay"));
+    console.log(chalk.gray(`  Relay: ${credentials.authServerUrl ?? DEFAULT_SERVER_URL}`));
+  }
+  const machineIdentity = localMachineIdentityStatus(settings?.machineId);
+  if (machineIdentity.configured) {
+    console.log(chalk.green(`\u2713 ${machineIdentity.label}`));
+    console.log(chalk.gray(`  Machine ID: ${settings.machineId}`));
+    console.log(chalk.gray(`  Host: ${os.hostname()}`));
+  } else {
+    console.log(chalk.yellow(`\u26A0\uFE0F  ${machineIdentity.label}`));
+    console.log(chalk.gray(`  ${machineIdentity.nextStep}`));
+  }
+  console.log(chalk.gray(`
+  Data directory: ${configuration.configuration.happyHomeDir}`));
+  try {
+    const running = await controlClient.checkIfDaemonRunningAndCleanupStaleState();
+    if (running) {
+      console.log(chalk.green("\u2713 Daemon running"));
+    } else {
+      console.log(chalk.gray("\u2717 Daemon not running"));
+    }
+  } catch {
+    console.log(chalk.gray("\u2717 Daemon not running"));
+  }
+}
+
+exports.handleAuthCommand = handleAuthCommand;

package/dist/authRelay-BdYkC1Po.cjs

@@ -0,0 +1,156 @@
+'use strict';
+
+var node_crypto = require('node:crypto');
+var tweetnacl = require('tweetnacl');
+
+function encodeBase64(buffer, variant = "base64") {
+  if (variant === "base64url") {
+    return encodeBase64Url(buffer);
+  }
+  return Buffer.from(buffer).toString("base64");
+}
+function encodeBase64Url(buffer) {
+  return Buffer.from(buffer).toString("base64").replaceAll("+", "-").replaceAll("/", "_").replaceAll("=", "");
+}
+function decodeBase64(base64, variant = "base64") {
+  if (variant === "base64url") {
+    const base64Standard = base64.replaceAll("-", "+").replaceAll("_", "/") + "=".repeat((4 - base64.length % 4) % 4);
+    return new Uint8Array(Buffer.from(base64Standard, "base64"));
+  }
+  return new Uint8Array(Buffer.from(base64, "base64"));
+}
+function getRandomBytes(size) {
+  return new Uint8Array(node_crypto.randomBytes(size));
+}
+function libsodiumPublicKeyFromSecretKey(seed) {
+  const hashedSeed = new Uint8Array(node_crypto.createHash("sha512").update(seed).digest());
+  const secretKey = hashedSeed.slice(0, 32);
+  return new Uint8Array(tweetnacl.box.keyPair.fromSecretKey(secretKey).publicKey);
+}
+function libsodiumEncryptForPublicKey(data, recipientPublicKey) {
+  const ephemeralKeyPair = tweetnacl.box.keyPair();
+  const nonce = getRandomBytes(tweetnacl.box.nonceLength);
+  const encrypted = tweetnacl.box(data, nonce, recipientPublicKey, ephemeralKeyPair.secretKey);
+  const result = new Uint8Array(ephemeralKeyPair.publicKey.length + nonce.length + encrypted.length);
+  result.set(ephemeralKeyPair.publicKey, 0);
+  result.set(nonce, ephemeralKeyPair.publicKey.length);
+  result.set(encrypted, ephemeralKeyPair.publicKey.length + nonce.length);
+  return result;
+}
+function encryptLegacy(data, secret) {
+  const nonce = getRandomBytes(tweetnacl.secretbox.nonceLength);
+  const encrypted = tweetnacl.secretbox(new TextEncoder().encode(JSON.stringify(data)), nonce, secret);
+  const result = new Uint8Array(nonce.length + encrypted.length);
+  result.set(nonce);
+  result.set(encrypted, nonce.length);
+  return result;
+}
+function decryptLegacy(data, secret) {
+  const nonce = data.slice(0, tweetnacl.secretbox.nonceLength);
+  const encrypted = data.slice(tweetnacl.secretbox.nonceLength);
+  const decrypted = tweetnacl.secretbox.open(encrypted, nonce, secret);
+  if (!decrypted) {
+    return null;
+  }
+  return JSON.parse(new TextDecoder().decode(decrypted));
+}
+function decryptBlob(bundle, key) {
+  if (bundle.length < tweetnacl.secretbox.nonceLength + 16) {
+    return null;
+  }
+  const nonce = bundle.slice(0, tweetnacl.secretbox.nonceLength);
+  const ciphertext = bundle.slice(tweetnacl.secretbox.nonceLength);
+  const decrypted = tweetnacl.secretbox.open(ciphertext, nonce, key);
+  if (!decrypted) {
+    return null;
+  }
+  return new Uint8Array(decrypted);
+}
+function encryptWithDataKey(data, dataKey) {
+  const nonce = getRandomBytes(12);
+  const cipher = node_crypto.createCipheriv("aes-256-gcm", dataKey, nonce);
+  const plaintext = new TextEncoder().encode(JSON.stringify(data));
+  const encrypted = Buffer.concat([
+    cipher.update(plaintext),
+    cipher.final()
+  ]);
+  const authTag = cipher.getAuthTag();
+  const bundle = new Uint8Array(12 + encrypted.length + 16 + 1);
+  bundle.set([0], 0);
+  bundle.set(nonce, 1);
+  bundle.set(new Uint8Array(encrypted), 13);
+  bundle.set(new Uint8Array(authTag), 13 + encrypted.length);
+  return bundle;
+}
+function decryptWithDataKey(bundle, dataKey) {
+  if (bundle.length < 1) {
+    return null;
+  }
+  if (bundle[0] !== 0) {
+    return null;
+  }
+  if (bundle.length < 12 + 16 + 1) {
+    return null;
+  }
+  const nonce = bundle.slice(1, 13);
+  const authTag = bundle.slice(bundle.length - 16);
+  const ciphertext = bundle.slice(13, bundle.length - 16);
+  try {
+    const decipher = node_crypto.createDecipheriv("aes-256-gcm", dataKey, nonce);
+    decipher.setAuthTag(authTag);
+    const decrypted = Buffer.concat([
+      decipher.update(ciphertext),
+      decipher.final()
+    ]);
+    return JSON.parse(new TextDecoder().decode(decrypted));
+  } catch (error) {
+    return null;
+  }
+}
+function encrypt(key, variant, data) {
+  if (variant === "legacy") {
+    return encryptLegacy(data, key);
+  } else {
+    return encryptWithDataKey(data, key);
+  }
+}
+function decrypt(key, variant, data) {
+  if (variant === "legacy") {
+    return decryptLegacy(data, key);
+  } else {
+    return decryptWithDataKey(data, key);
+  }
+}
+
+const DEFAULT_SERVER_URL = "https://veryhappy.dev";
+const LEGACY_CLOUD_SERVER_URL = "https://happy.mereith.com";
+const CLOUD_SERVER_URLS = [DEFAULT_SERVER_URL, LEGACY_CLOUD_SERVER_URL];
+function sameRelay(left, right) {
+  try {
+    return new URL(left).origin === new URL(right).origin;
+  } catch {
+    return left.replace(/\/+$/, "") === right.replace(/\/+$/, "");
+  }
+}
+function credentialRelayProblem(credentialServerUrl, configuredServerUrl) {
+  if (credentialServerUrl) {
+    return sameRelay(credentialServerUrl, configuredServerUrl) ? void 0 : `Credentials belong to ${credentialServerUrl}, but the active relay is ${configuredServerUrl}.`;
+  }
+  if (CLOUD_SERVER_URLS.some((cloudUrl) => sameRelay(configuredServerUrl, cloudUrl))) {
+    return void 0;
+  }
+  return `These credentials predate relay tracking, so they cannot be safely reused with ${configuredServerUrl}.`;
+}
+
+exports.credentialRelayProblem = credentialRelayProblem;
+exports.decodeBase64 = decodeBase64;
+exports.decrypt = decrypt;
+exports.decryptBlob = decryptBlob;
+exports.decryptLegacy = decryptLegacy;
+exports.decryptWithDataKey = decryptWithDataKey;
+exports.encodeBase64 = encodeBase64;
+exports.encodeBase64Url = encodeBase64Url;
+exports.encrypt = encrypt;
+exports.getRandomBytes = getRandomBytes;
+exports.libsodiumEncryptForPublicKey = libsodiumEncryptForPublicKey;
+exports.libsodiumPublicKeyFromSecretKey = libsodiumPublicKeyFromSecretKey;

package/dist/authRelay-DSAvg1uv.mjs

@@ -0,0 +1,143 @@
+import { randomBytes, createCipheriv, createDecipheriv, createHash } from 'node:crypto';
+import tweetnacl from 'tweetnacl';
+
+function encodeBase64(buffer, variant = "base64") {
+  if (variant === "base64url") {
+    return encodeBase64Url(buffer);
+  }
+  return Buffer.from(buffer).toString("base64");
+}
+function encodeBase64Url(buffer) {
+  return Buffer.from(buffer).toString("base64").replaceAll("+", "-").replaceAll("/", "_").replaceAll("=", "");
+}
+function decodeBase64(base64, variant = "base64") {
+  if (variant === "base64url") {
+    const base64Standard = base64.replaceAll("-", "+").replaceAll("_", "/") + "=".repeat((4 - base64.length % 4) % 4);
+    return new Uint8Array(Buffer.from(base64Standard, "base64"));
+  }
+  return new Uint8Array(Buffer.from(base64, "base64"));
+}
+function getRandomBytes(size) {
+  return new Uint8Array(randomBytes(size));
+}
+function libsodiumPublicKeyFromSecretKey(seed) {
+  const hashedSeed = new Uint8Array(createHash("sha512").update(seed).digest());
+  const secretKey = hashedSeed.slice(0, 32);
+  return new Uint8Array(tweetnacl.box.keyPair.fromSecretKey(secretKey).publicKey);
+}
+function libsodiumEncryptForPublicKey(data, recipientPublicKey) {
+  const ephemeralKeyPair = tweetnacl.box.keyPair();
+  const nonce = getRandomBytes(tweetnacl.box.nonceLength);
+  const encrypted = tweetnacl.box(data, nonce, recipientPublicKey, ephemeralKeyPair.secretKey);
+  const result = new Uint8Array(ephemeralKeyPair.publicKey.length + nonce.length + encrypted.length);
+  result.set(ephemeralKeyPair.publicKey, 0);
+  result.set(nonce, ephemeralKeyPair.publicKey.length);
+  result.set(encrypted, ephemeralKeyPair.publicKey.length + nonce.length);
+  return result;
+}
+function encryptLegacy(data, secret) {
+  const nonce = getRandomBytes(tweetnacl.secretbox.nonceLength);
+  const encrypted = tweetnacl.secretbox(new TextEncoder().encode(JSON.stringify(data)), nonce, secret);
+  const result = new Uint8Array(nonce.length + encrypted.length);
+  result.set(nonce);
+  result.set(encrypted, nonce.length);
+  return result;
+}
+function decryptLegacy(data, secret) {
+  const nonce = data.slice(0, tweetnacl.secretbox.nonceLength);
+  const encrypted = data.slice(tweetnacl.secretbox.nonceLength);
+  const decrypted = tweetnacl.secretbox.open(encrypted, nonce, secret);
+  if (!decrypted) {
+    return null;
+  }
+  return JSON.parse(new TextDecoder().decode(decrypted));
+}
+function decryptBlob(bundle, key) {
+  if (bundle.length < tweetnacl.secretbox.nonceLength + 16) {
+    return null;
+  }
+  const nonce = bundle.slice(0, tweetnacl.secretbox.nonceLength);
+  const ciphertext = bundle.slice(tweetnacl.secretbox.nonceLength);
+  const decrypted = tweetnacl.secretbox.open(ciphertext, nonce, key);
+  if (!decrypted) {
+    return null;
+  }
+  return new Uint8Array(decrypted);
+}
+function encryptWithDataKey(data, dataKey) {
+  const nonce = getRandomBytes(12);
+  const cipher = createCipheriv("aes-256-gcm", dataKey, nonce);
+  const plaintext = new TextEncoder().encode(JSON.stringify(data));
+  const encrypted = Buffer.concat([
+    cipher.update(plaintext),
+    cipher.final()
+  ]);
+  const authTag = cipher.getAuthTag();
+  const bundle = new Uint8Array(12 + encrypted.length + 16 + 1);
+  bundle.set([0], 0);
+  bundle.set(nonce, 1);
+  bundle.set(new Uint8Array(encrypted), 13);
+  bundle.set(new Uint8Array(authTag), 13 + encrypted.length);
+  return bundle;
+}
+function decryptWithDataKey(bundle, dataKey) {
+  if (bundle.length < 1) {
+    return null;
+  }
+  if (bundle[0] !== 0) {
+    return null;
+  }
+  if (bundle.length < 12 + 16 + 1) {
+    return null;
+  }
+  const nonce = bundle.slice(1, 13);
+  const authTag = bundle.slice(bundle.length - 16);
+  const ciphertext = bundle.slice(13, bundle.length - 16);
+  try {
+    const decipher = createDecipheriv("aes-256-gcm", dataKey, nonce);
+    decipher.setAuthTag(authTag);
+    const decrypted = Buffer.concat([
+      decipher.update(ciphertext),
+      decipher.final()
+    ]);
+    return JSON.parse(new TextDecoder().decode(decrypted));
+  } catch (error) {
+    return null;
+  }
+}
+function encrypt(key, variant, data) {
+  if (variant === "legacy") {
+    return encryptLegacy(data, key);
+  } else {
+    return encryptWithDataKey(data, key);
+  }
+}
+function decrypt(key, variant, data) {
+  if (variant === "legacy") {
+    return decryptLegacy(data, key);
+  } else {
+    return decryptWithDataKey(data, key);
+  }
+}
+
+const DEFAULT_SERVER_URL = "https://veryhappy.dev";
+const LEGACY_CLOUD_SERVER_URL = "https://happy.mereith.com";
+const CLOUD_SERVER_URLS = [DEFAULT_SERVER_URL, LEGACY_CLOUD_SERVER_URL];
+function sameRelay(left, right) {
+  try {
+    return new URL(left).origin === new URL(right).origin;
+  } catch {
+    return left.replace(/\/+$/, "") === right.replace(/\/+$/, "");
+  }
+}
+function credentialRelayProblem(credentialServerUrl, configuredServerUrl) {
+  if (credentialServerUrl) {
+    return sameRelay(credentialServerUrl, configuredServerUrl) ? void 0 : `Credentials belong to ${credentialServerUrl}, but the active relay is ${configuredServerUrl}.`;
+  }
+  if (CLOUD_SERVER_URLS.some((cloudUrl) => sameRelay(configuredServerUrl, cloudUrl))) {
+    return void 0;
+  }
+  return `These credentials predate relay tracking, so they cannot be safely reused with ${configuredServerUrl}.`;
+}
+
+export { decryptWithDataKey as a, decryptLegacy as b, credentialRelayProblem as c, decodeBase64 as d, encodeBase64 as e, encodeBase64Url as f, encrypt as g, decrypt as h, decryptBlob as i, libsodiumPublicKeyFromSecretKey as j, getRandomBytes as k, libsodiumEncryptForPublicKey as l };