waterplane 0.0.1 → 0.1.6

package/node_modules/@waterplane/shared/dist/ctxwindow.js

@@ -0,0 +1,107 @@
+/**
+ * How big a model's context window is — the number every context graph calls
+ * 100%.
+ *
+ * The conversation log records the model on every assistant turn but never the
+ * window it was given, and the TUI prints the window only sometimes. So the one
+ * thing that makes every session's graph COMPARABLE — a y axis where 100% means
+ * the same on every chart — has to be resolved from what we do have.
+ *
+ * ── Why this is not a table keyed on the model id ───────────────────────────
+ *
+ * That was the first design, and it is wrong. It rested on the CLI's `[1m]`
+ * suffix marking the long-context variant, which is true of the id you LAUNCH
+ * with and not of the id that ends up in the log: measured across one machine's
+ * conversation logs, `claude-opus-5` reached **998,242** tokens of context and
+ * `claude-opus-4-8` reached **994,851** — both plainly 1M windows, both written
+ * to the log with no suffix at all. A 200k table would have drawn those
+ * sessions at 500% and, far worse, drawn a fresh one at five times its real
+ * fullness with nothing on screen saying so. Two of the same machine's other
+ * models also exceeded 200k (`claude-opus-4-7` at 335,928, `claude-fable-5` at
+ * 263,800), so it is not one model's exception either.
+ *
+ * ── What replaces it ────────────────────────────────────────────────────────
+ *
+ * A MEASUREMENT, snapped to the ladder of windows that actually exist. A
+ * conversation that provably held 346k tokens was not running in a 200k window
+ * — that is evidence, not a guess, and it is evidence this app already reads on
+ * every turn. The host keeps the high-water mark per model (`host/ctxwindow.ts`)
+ * so the answer survives restarts and applies to a session that has not got
+ * there yet, and `resolveContextWindow` is the ONE place the sources are
+ * ordered. `windowFrom` travels with the number so a screen can say which of
+ * them answered, and `"none"` stays a visible state with its own sentence
+ * rather than a silent fall back to a per-session axis.
+ */
+/**
+ * The windows that exist, smallest first.
+ *
+ * A measurement is snapped UP to one of these rather than used raw: a series
+ * that peaked at 346k did not have a 346k window, and an axis whose top is the
+ * highest number this conversation happened to reach is exactly the per-series
+ * axis the shared scale exists to replace.
+ */
+export const WINDOW_LADDER = [200_000, 1_000_000];
+/** Every Claude model, absent any evidence to the contrary. */
+export const DEFAULT_WINDOW_TOK = WINDOW_LADDER[0];
+/** What an explicit `[1m]` on a LAUNCH id means. */
+export const LONG_WINDOW_TOK = WINDOW_LADDER[WINDOW_LADDER.length - 1];
+/** The `[1m]` variant marker, in the two spellings the CLI has used. Present on
+ *  a launch id; usually absent from the id the log records. */
+const LONG_RE = /(\[1m\]|-1m)$/i;
+/** Whether an id is a Claude model at all — a full id or a launch alias.
+ *  `<synthetic>`, the model the CLI stamps on its own usage-wall turns, is
+ *  deliberately not one. */
+export function isClaudeModel(model) {
+    if (!model)
+        return false;
+    const base = model.trim().toLowerCase().replace(LONG_RE, "");
+    if (!base)
+        return false;
+    return /^claude-/.test(base) || ["opus", "sonnet", "haiku", "fable"].includes(base);
+}
+/** The smallest window on the ladder that holds `tok`, or the largest when
+ *  nothing does — a reading past the top rung means the ladder is out of date,
+ *  and the biggest window we know of is a better answer than none. */
+export function windowContaining(tok) {
+    for (const w of WINDOW_LADDER)
+        if (tok <= w)
+            return w;
+    return LONG_WINDOW_TOK;
+}
+/**
+ * The window for a model id ALONE, or null when we do not recognise it.
+ *
+ * Only the id — no evidence. This is the weakest of the three sources and is
+ * kept honest about it: it is right for a 200k model, right for a launch id
+ * carrying `[1m]`, and wrong for a 1M conversation whose log dropped the
+ * suffix, which is why `resolveContextWindow` prefers a measurement over it.
+ */
+export function contextWindowFor(model) {
+    if (!isClaudeModel(model))
+        return null;
+    return LONG_RE.test(model.trim()) ? LONG_WINDOW_TOK : DEFAULT_WINDOW_TOK;
+}
+/**
+ * The window, and which source answered — the one ordering.
+ *
+ * Screen first: it is a direct statement about this session rather than an
+ * inference. Then the measurement, snapped to the ladder. Then the id alone.
+ * Then nothing, and the caller says so instead of inventing an axis.
+ */
+export function resolveContextWindow(ev) {
+    if (ev.screenTok && ev.screenTok > 0)
+        return { tok: ev.screenTok, from: "screen" };
+    if (ev.observedTok && ev.observedTok > 0 && isClaudeModel(ev.model)) {
+        return { tok: windowContaining(ev.observedTok), from: "measured" };
+    }
+    const byId = contextWindowFor(ev.model);
+    return byId != null ? { tok: byId, from: "model" } : { tok: null, from: "none" };
+}
+/** Percent of the window a reading used, or null when the window is unknown.
+ *  Not clamped: a reading over 100% is a fact worth drawing, not one to hide. */
+export function contextPct(tok, windowTok) {
+    if (!windowTok || windowTok <= 0)
+        return null;
+    return (tok / windowTok) * 100;
+}
+//# sourceMappingURL=ctxwindow.js.map

package/node_modules/@waterplane/shared/dist/ctxwindow.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ctxwindow.js","sourceRoot":"","sources":["../src/ctxwindow.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AAEH;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,OAAO,EAAE,SAAS,CAAU,CAAC;AAE3D,+DAA+D;AAC/D,MAAM,CAAC,MAAM,kBAAkB,GAAG,aAAa,CAAC,CAAC,CAAC,CAAC;AACnD,oDAAoD;AACpD,MAAM,CAAC,MAAM,eAAe,GAAG,aAAa,CAAC,aAAa,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;AAEvE;+DAC+D;AAC/D,MAAM,OAAO,GAAG,gBAAgB,CAAC;AAEjC;;4BAE4B;AAC5B,MAAM,UAAU,aAAa,CAAC,KAAgC;IAC5D,IAAI,CAAC,KAAK;QAAE,OAAO,KAAK,CAAC;IACzB,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;IAC7D,IAAI,CAAC,IAAI;QAAE,OAAO,KAAK,CAAC;IACxB,OAAO,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;AACtF,CAAC;AAED;;sEAEsE;AACtE,MAAM,UAAU,gBAAgB,CAAC,GAAW;IAC1C,KAAK,MAAM,CAAC,IAAI,aAAa;QAAE,IAAI,GAAG,IAAI,CAAC;YAAE,OAAO,CAAC,CAAC;IACtD,OAAO,eAAe,CAAC;AACzB,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,gBAAgB,CAAC,KAAgC;IAC/D,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACvC,OAAO,OAAO,CAAC,IAAI,CAAC,KAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,kBAAkB,CAAC;AAC5E,CAAC;AAkBD;;;;;;GAMG;AACH,MAAM,UAAU,oBAAoB,CAAC,EAAkB;IACrD,IAAI,EAAE,CAAC,SAAS,IAAI,EAAE,CAAC,SAAS,GAAG,CAAC;QAAE,OAAO,EAAE,GAAG,EAAE,EAAE,CAAC,SAAS,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;IACnF,IAAI,EAAE,CAAC,WAAW,IAAI,EAAE,CAAC,WAAW,GAAG,CAAC,IAAI,aAAa,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC;QACpE,OAAO,EAAE,GAAG,EAAE,gBAAgB,CAAC,EAAE,CAAC,WAAW,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;IACrE,CAAC;IACD,MAAM,IAAI,GAAG,gBAAgB,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC;IACxC,OAAO,IAAI,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;AACnF,CAAC;AAED;iFACiF;AACjF,MAAM,UAAU,UAAU,CAAC,GAAW,EAAE,SAAwB;IAC9D,IAAI,CAAC,SAAS,IAAI,SAAS,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAC9C,OAAO,CAAC,GAAG,GAAG,SAAS,CAAC,GAAG,GAAG,CAAC;AACjC,CAAC"}

package/node_modules/@waterplane/shared/dist/deskstorage.d.ts

@@ -0,0 +1,170 @@
+/**
+ * What the DESKTOP is holding, as the phone reads it — the two shapes and
+ * every sentence said about them.
+ *
+ * `sweep.ts` clears ONE repo's transport directory, and the phone's own
+ * `storagePlan.ts` asks the same question about the device. Between them sat
+ * two gaps this module closes:
+ *
+ *  1. **Which repo.** Measured here: 7.5 GB across fourteen repos, 4.5 GB of it
+ *     in one and 2.5 GB in a second. The per-repo sweep is reached from one
+ *     repo's gallery, so using it means already knowing which repo is fat —
+ *     fourteen trips to find out. `TransportSurvey` is that ranking.
+ *  2. **The daemon's own store.** The state dir under the root (`BRAND.stateDirName`) is 28 MB on this desktop, and
+ *     almost all of it is already bounded by whoever writes it (rings, row
+ *     caps, a size rotation, a boot sweep behind a 7-day gate). `HostStoreReport`
+ *     says so per row — the reading is the point, because it is what identifies
+ *     the two or three things that are NOT bounded.
+ *
+ * ── Why the sentences live here and not on the phone ────────────────────────
+ *
+ * The host CLASSIFIES (`host/hoststore.ts` knows which file is which) and the
+ * phone DRAWS. If the phone kept its own table of what a kind means, the two
+ * would word "this is a cache" and "this is a ledger you cannot delete" apart
+ * the first time a store changed hands — and one of those sentences is the only
+ * thing standing between a person and a delete they cannot undo.
+ *
+ * ── The rules ───────────────────────────────────────────────────────────────
+ *
+ *  - **A reading degrades to ABSENT, never to a wrong number** (CLAUDE.md).
+ *    Every byte figure here is nullable, and a `null` poisons the total it
+ *    belongs to rather than being folded in as zero. A survey that walked past
+ *    its budget reports `null` for that repo — a lower bound printed as a total
+ *    is the one lie a screen about deleting must not tell.
+ *  - **A count on a control is a filter.** A survey row's outbox figure opens
+ *    exactly that repo's outbox sweep, which is why the two scopes are separate
+ *    fields and separate tap targets and there is deliberately no combined
+ *    "transport bytes" number to tap.
+ *  - **Nothing applies itself.** Nothing here decides, schedules, or deletes;
+ *    it is two DTOs and the words for them.
+ *
+ * Pure: no fs, no clock of its own (`at` is passed in by whoever measured).
+ * `shared/test/deskstorage.test.mjs`.
+ */
+import { type SweepTally } from "./sweep.js";
+/** One discovered worktree and what its two transport directories hold. */
+export interface TransportSurveyRow {
+    /** `targetId(worktreePath)` — what the per-repo sweep routes take. */
+    repoId: string;
+    repoName: string;
+    branch: string;
+    isPrimary: boolean;
+    /**
+     * What the outbox holds, or **null when it could not be counted** — the walk
+     * hit its entry budget, or the directory was unreadable. Null is not zero:
+     * one means "this repo is clean", the other means "this screen does not
+     * know", and only the first is a reason to skip it.
+     */
+    outbox: SweepTally | null;
+    /** Same, for the inbox. Separate from `outbox` because they are opposite
+     *  directions and the sweep refuses to treat them as one thing: an outbox is
+     *  re-derivable by running the build again, an inbox may be a photo's only
+     *  copy. */
+    inbox: SweepTally | null;
+}
+export interface TransportSurvey {
+    /** When the walk ran, by the desktop's clock. Every row is from this instant
+     *  — a survey stitched from two moments would rank repos against each other
+     *  using numbers taken at different times. */
+    at: number;
+    /** Ranked, biggest first. A repo with nothing in either directory is still a
+     *  row: "this one is clean" is an answer, and a missing row reads as a repo
+     *  the survey failed to see. */
+    repos: TransportSurveyRow[];
+    /** Every repo's bytes, or null when any row is uncounted. */
+    total: SweepTally | null;
+    /** True when at least one row could not be counted — the flag that lets a
+     *  screen say "at least this much" instead of quietly under-reporting. */
+    partial: boolean;
+}
+/** A row's two directories together, or null when either is unknown. Used for
+ *  the RANKING only — never drawn as a tap target, because tapping it could not
+ *  say which scope it meant. */
+export declare function rowBytes(r: TransportSurveyRow): number | null;
+/**
+ * Rank the rows and total them, in one place so the order and the sum cannot
+ * come from two different readings.
+ *
+ * Uncounted rows sort LAST — a row with no number cannot claim a place in a
+ * ranking of numbers — and any of them turns the total null.
+ */
+export declare function summarizeSurvey(rows: readonly TransportSurveyRow[]): {
+    repos: TransportSurveyRow[];
+    total: SweepTally | null;
+    partial: boolean;
+};
+/** The line above the list. Says the total AND, when anything is uncounted,
+ *  that it is a floor rather than a figure. */
+export declare function surveyHeadText(s: TransportSurvey): string;
+/** What one scope's chip says. A count and its bytes, never one without the
+ *  other, and "not counted" said as itself. */
+export declare function scopeChipText(t: SweepTally | null): string;
+/**
+ * What kind of thing a file under the root's state dir is — which decides whether a
+ * phone may remove it, and what the row says when it may not.
+ *
+ * `cache` — re-made on demand by whoever owns it. The only kind that is free.
+ * `rollback` — a one-time copy taken by a migration, kept in case the migration
+ *   was wrong. Useful for as long as the thing it shadows has not moved on.
+ * `ledger` — an append-only record. Deleting it is a loss of HISTORY, not a
+ *   cache miss, so it is reported and never offered.
+ * `live` — state the daemon is using right now (the intent ledger, the ack
+ *   memory, session stores). Removing one is not slow, it is wrong.
+ * `unknown` — a file this catalogue does not name. Reported with its bytes,
+ *   never touched: a sweep that removes what it cannot identify is a sweep that
+ *   removes the next feature's store.
+ */
+export type HostStoreKind = "cache" | "rollback" | "ledger" | "live" | "unknown";
+export declare const HOST_STORE_KIND_LABEL: Record<HostStoreKind, string>;
+/** One entry of the store, as a row. Structurally the phone's own `StoreUse`
+ *  where it overlaps, so `StorageSheet` draws both with one component. */
+export interface HostStoreRow {
+    /** Catalogue id — and the ONLY thing a clear request carries. No path from a
+     *  client ever reaches the filesystem here (`host/hoststore.ts` states the
+     *  full guard). */
+    id: string;
+    label: string;
+    kind: HostStoreKind;
+    count: number;
+    /** Bytes, or null when it could not be measured. Never 0 for an unknown. */
+    bytes: number | null;
+    /** What removing it would cost — required, even for a cache. */
+    cost: string;
+    /** Why there is no clear button. A blocked verb is a sentence, never a dimmed
+     *  control; for a bounded ledger this names the bound, which is the fact that
+     *  makes the row readable as "already handled". */
+    cant?: string;
+}
+export interface HostStoreReport {
+    at: number;
+    /** The directory itself, so the screen can say WHERE this is — a person
+     *  reading it on a phone has no other way to know. */
+    dir: string;
+    rows: HostStoreRow[];
+    total: number | null;
+    partial: boolean;
+}
+/** The rows a phone may actually act on — one predicate, so the count on the
+ *  section header and the buttons below it cannot disagree. */
+export declare function clearableRows(rows: readonly HostStoreRow[]): HostStoreRow[];
+/** Sum what is on the report, or null if anything is unmeasured. */
+export declare function hostStoreTotal(rows: readonly HostStoreRow[]): {
+    total: number | null;
+    partial: boolean;
+};
+/** What a clear button says — the whole decision restated, `sweepButtonText`'s
+ *  rule. */
+export declare function hostStoreButtonText(r: HostStoreRow): string;
+/** What a clear DID. `SweepOutcome`'s shape and `sweepResultText`'s split:
+ *  "already gone" is the clear succeeding by another route, "could not be
+ *  removed" is bytes still on disk under a message that says done. */
+export interface HostStoreOutcome {
+    deleted: number;
+    bytes: number;
+    /** Files the clear refused or could not unlink. Named, never counted alone. */
+    failed: number;
+    /** A refusal of the whole request — an unknown id, a kind that is never
+     *  clearable. Said in words, and then nothing was touched. */
+    refused?: string;
+}
+export declare function hostStoreResultText(label: string, o: HostStoreOutcome): string;

package/node_modules/@waterplane/shared/dist/deskstorage.js

@@ -0,0 +1,140 @@
+/**
+ * What the DESKTOP is holding, as the phone reads it — the two shapes and
+ * every sentence said about them.
+ *
+ * `sweep.ts` clears ONE repo's transport directory, and the phone's own
+ * `storagePlan.ts` asks the same question about the device. Between them sat
+ * two gaps this module closes:
+ *
+ *  1. **Which repo.** Measured here: 7.5 GB across fourteen repos, 4.5 GB of it
+ *     in one and 2.5 GB in a second. The per-repo sweep is reached from one
+ *     repo's gallery, so using it means already knowing which repo is fat —
+ *     fourteen trips to find out. `TransportSurvey` is that ranking.
+ *  2. **The daemon's own store.** The state dir under the root (`BRAND.stateDirName`) is 28 MB on this desktop, and
+ *     almost all of it is already bounded by whoever writes it (rings, row
+ *     caps, a size rotation, a boot sweep behind a 7-day gate). `HostStoreReport`
+ *     says so per row — the reading is the point, because it is what identifies
+ *     the two or three things that are NOT bounded.
+ *
+ * ── Why the sentences live here and not on the phone ────────────────────────
+ *
+ * The host CLASSIFIES (`host/hoststore.ts` knows which file is which) and the
+ * phone DRAWS. If the phone kept its own table of what a kind means, the two
+ * would word "this is a cache" and "this is a ledger you cannot delete" apart
+ * the first time a store changed hands — and one of those sentences is the only
+ * thing standing between a person and a delete they cannot undo.
+ *
+ * ── The rules ───────────────────────────────────────────────────────────────
+ *
+ *  - **A reading degrades to ABSENT, never to a wrong number** (CLAUDE.md).
+ *    Every byte figure here is nullable, and a `null` poisons the total it
+ *    belongs to rather than being folded in as zero. A survey that walked past
+ *    its budget reports `null` for that repo — a lower bound printed as a total
+ *    is the one lie a screen about deleting must not tell.
+ *  - **A count on a control is a filter.** A survey row's outbox figure opens
+ *    exactly that repo's outbox sweep, which is why the two scopes are separate
+ *    fields and separate tap targets and there is deliberately no combined
+ *    "transport bytes" number to tap.
+ *  - **Nothing applies itself.** Nothing here decides, schedules, or deletes;
+ *    it is two DTOs and the words for them.
+ *
+ * Pure: no fs, no clock of its own (`at` is passed in by whoever measured).
+ * `shared/test/deskstorage.test.mjs`.
+ */
+import { fmtBytes } from "./sweep.js";
+/** A row's two directories together, or null when either is unknown. Used for
+ *  the RANKING only — never drawn as a tap target, because tapping it could not
+ *  say which scope it meant. */
+export function rowBytes(r) {
+    if (!r.outbox || !r.inbox)
+        return null;
+    return r.outbox.bytes + r.inbox.bytes;
+}
+/**
+ * Rank the rows and total them, in one place so the order and the sum cannot
+ * come from two different readings.
+ *
+ * Uncounted rows sort LAST — a row with no number cannot claim a place in a
+ * ranking of numbers — and any of them turns the total null.
+ */
+export function summarizeSurvey(rows) {
+    const sorted = [...rows].sort((a, b) => (rowBytes(b) ?? -1) - (rowBytes(a) ?? -1));
+    let count = 0;
+    let bytes = 0;
+    let partial = false;
+    for (const r of sorted) {
+        if (!r.outbox || !r.inbox) {
+            partial = true;
+            continue;
+        }
+        count += r.outbox.count + r.inbox.count;
+        bytes += r.outbox.bytes + r.inbox.bytes;
+    }
+    return { repos: sorted, total: partial ? null : { count, bytes }, partial };
+}
+/** The line above the list. Says the total AND, when anything is uncounted,
+ *  that it is a floor rather than a figure. */
+export function surveyHeadText(s) {
+    const n = s.repos.length;
+    const repos = `${n} repo${n === 1 ? "" : "s"}`;
+    if (!s.total) {
+        return `${repos}. Some directories could not be counted, so there is no total — the rows that answered are below.`;
+    }
+    if (!s.total.count)
+        return `${repos}, and nothing in any transport directory.`;
+    return `${s.total.count} file${s.total.count === 1 ? "" : "s"} · ${fmtBytes(s.total.bytes)} across ${repos}.`;
+}
+/** What one scope's chip says. A count and its bytes, never one without the
+ *  other, and "not counted" said as itself. */
+export function scopeChipText(t) {
+    if (!t)
+        return "not counted";
+    if (!t.count)
+        return "empty";
+    return `${t.count} · ${fmtBytes(t.bytes)}`;
+}
+export const HOST_STORE_KIND_LABEL = {
+    cache: "cache — re-made when it is next needed",
+    rollback: "migration leftover — a copy kept in case the upgrade was wrong",
+    ledger: "record — history, not a cache",
+    live: "in use — the daemon is reading this now",
+    unknown: "not in this app's catalogue",
+};
+/** The rows a phone may actually act on — one predicate, so the count on the
+ *  section header and the buttons below it cannot disagree. */
+export function clearableRows(rows) {
+    return rows.filter((r) => !r.cant && r.count > 0);
+}
+/** Sum what is on the report, or null if anything is unmeasured. */
+export function hostStoreTotal(rows) {
+    let total = 0;
+    let partial = false;
+    for (const r of rows) {
+        if (r.bytes == null)
+            partial = true;
+        else
+            total += r.bytes;
+    }
+    return { total: partial ? null : total, partial };
+}
+/** What a clear button says — the whole decision restated, `sweepButtonText`'s
+ *  rule. */
+export function hostStoreButtonText(r) {
+    if (!r.count)
+        return `Nothing in ${r.label}`;
+    return r.bytes == null
+        ? `Clear ${r.label} · ${r.count}`
+        : `Clear ${r.label} · ${r.count} · ${fmtBytes(r.bytes)}`;
+}
+export function hostStoreResultText(label, o) {
+    if (o.refused)
+        return o.refused;
+    const parts = [];
+    parts.push(o.deleted
+        ? `Cleared ${o.deleted} file${o.deleted === 1 ? "" : "s"} · ${fmtBytes(o.bytes)} from ${label}.`
+        : `${label} was already empty.`);
+    if (o.failed)
+        parts.push(`${o.failed} could not be removed — still on disk.`);
+    return parts.join(" ");
+}
+//# sourceMappingURL=deskstorage.js.map

package/node_modules/@waterplane/shared/dist/deskstorage.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"deskstorage.js","sourceRoot":"","sources":["../src/deskstorage.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0CG;AACH,OAAO,EAAE,QAAQ,EAAmB,MAAM,YAAY,CAAC;AAyCvD;;gCAEgC;AAChC,MAAM,UAAU,QAAQ,CAAC,CAAqB;IAC5C,IAAI,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACvC,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC;AACxC,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,eAAe,CAAC,IAAmC;IACjE,MAAM,MAAM,GAAG,CAAC,GAAG,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IACnF,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;QACvB,IAAI,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC;YAAC,OAAO,GAAG,IAAI,CAAC;YAAC,SAAS;QAAC,CAAC;QACxD,KAAK,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC;QACxC,KAAK,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC;IAC1C,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,CAAC;AAC9E,CAAC;AAED;+CAC+C;AAC/C,MAAM,UAAU,cAAc,CAAC,CAAkB;IAC/C,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC;IACzB,MAAM,KAAK,GAAG,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC;IAC/C,IAAI,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC;QACb,OAAO,GAAG,KAAK,mGAAmG,CAAC;IACrH,CAAC;IACD,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK;QAAE,OAAO,GAAG,KAAK,2CAA2C,CAAC;IAC/E,OAAO,GAAG,CAAC,CAAC,KAAK,CAAC,KAAK,QAAQ,CAAC,CAAC,KAAK,CAAC,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,MAAM,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,WAAW,KAAK,GAAG,CAAC;AAChH,CAAC;AAED;+CAC+C;AAC/C,MAAM,UAAU,aAAa,CAAC,CAAoB;IAChD,IAAI,CAAC,CAAC;QAAE,OAAO,aAAa,CAAC;IAC7B,IAAI,CAAC,CAAC,CAAC,KAAK;QAAE,OAAO,OAAO,CAAC;IAC7B,OAAO,GAAG,CAAC,CAAC,KAAK,MAAM,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;AAC7C,CAAC;AAqBD,MAAM,CAAC,MAAM,qBAAqB,GAAkC;IAClE,KAAK,EAAE,wCAAwC;IAC/C,QAAQ,EAAE,gEAAgE;IAC1E,MAAM,EAAE,+BAA+B;IACvC,IAAI,EAAE,yCAAyC;IAC/C,OAAO,EAAE,6BAA6B;CACvC,CAAC;AAgCF;+DAC+D;AAC/D,MAAM,UAAU,aAAa,CAAC,IAA6B;IACzD,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;AACpD,CAAC;AAED,oEAAoE;AACpE,MAAM,UAAU,cAAc,CAAC,IAA6B;IAC1D,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;QACrB,IAAI,CAAC,CAAC,KAAK,IAAI,IAAI;YAAE,OAAO,GAAG,IAAI,CAAC;;YAC/B,KAAK,IAAI,CAAC,CAAC,KAAK,CAAC;IACxB,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,EAAE,OAAO,EAAE,CAAC;AACpD,CAAC;AAED;YACY;AACZ,MAAM,UAAU,mBAAmB,CAAC,CAAe;IACjD,IAAI,CAAC,CAAC,CAAC,KAAK;QAAE,OAAO,cAAc,CAAC,CAAC,KAAK,EAAE,CAAC;IAC7C,OAAO,CAAC,CAAC,KAAK,IAAI,IAAI;QACpB,CAAC,CAAC,SAAS,CAAC,CAAC,KAAK,MAAM,CAAC,CAAC,KAAK,EAAE;QACjC,CAAC,CAAC,SAAS,CAAC,CAAC,KAAK,MAAM,CAAC,CAAC,KAAK,MAAM,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;AAC7D,CAAC;AAeD,MAAM,UAAU,mBAAmB,CAAC,KAAa,EAAE,CAAmB;IACpE,IAAI,CAAC,CAAC,OAAO;QAAE,OAAO,CAAC,CAAC,OAAO,CAAC;IAChC,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO;QAClB,CAAC,CAAC,WAAW,CAAC,CAAC,OAAO,QAAQ,CAAC,CAAC,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,MAAM,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,KAAK,GAAG;QAChG,CAAC,CAAC,GAAG,KAAK,qBAAqB,CAAC,CAAC;IACnC,IAAI,CAAC,CAAC,MAAM;QAAE,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,wCAAwC,CAAC,CAAC;IAC9E,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACzB,CAAC"}

package/node_modules/@waterplane/shared/dist/devices.d.ts

@@ -0,0 +1,52 @@
+/**
+ * The paired-device ledger: which phones hold a token for this desktop.
+ *
+ * The host keeps one row per device (`.waterplane/devices.json`, token hashed at
+ * rest); these are the rows as the phone sees them — never the hash. Revoking a
+ * row kills its token at once. `lastSeenAt` is written at most once per
+ * `DEVICE_SEEN_THROTTLE_MS` per device, so it is "seen within the last minute",
+ * not a live presence.
+ */
+import type { PeerKind } from "./wire/messages.js";
+export declare const DEVICE_NAME_MAX = 40;
+export declare const DEVICE_SEEN_THROTTLE_MS = 60000;
+export interface DeviceRow {
+    id: string;
+    name: string;
+    createdAt: number;
+    lastSeenAt: number;
+    /** The route the device last came in on; `null` when never recorded. */
+    lastKind: PeerKind | null;
+    /** The device making this request. */
+    current?: boolean;
+    /** `"passive"`: the kids'-phone scope — app updates only, everything else
+     *  refused by the host until a PIN unlocks it (`passive.ts`). Absent = full. */
+    scope?: DeviceScope;
+}
+/** A token's scope. Only `"passive"` is ever stored; absent means full. */
+export type DeviceScope = "passive";
+/** `GET /api/devices` → */
+export interface DeviceListResponse {
+    devices: DeviceRow[];
+}
+export interface DeviceRevokeResponse {
+    ok: boolean;
+    /** `false` when no such row existed (already revoked). */
+    revoked: boolean;
+    /** Live sockets of that device closed by the revoke. */
+    closedSockets?: number;
+}
+export interface DeviceTokenResponse {
+    token: string;
+    deviceId: string;
+}
+export declare function isDeviceId(s: unknown): s is string;
+/** A device name as typed or as the phone reports it; `null` when empty. */
+export declare function normalizeDeviceName(raw: unknown): string | null;
+/** One row read off disk or the wire, or `null`. A row with no creation time
+ *  cannot say when it was paired and is dropped rather than dated now. */
+export declare function cleanDeviceRow(raw: unknown): DeviceRow | null;
+/** This phone first, then most recently seen. */
+export declare function sortDevices(rows: readonly DeviceRow[]): DeviceRow[];
+/** Should `lastSeenAt` be written now? */
+export declare function deviceSeenDue(lastSeenAt: number, now: number): boolean;

package/node_modules/@waterplane/shared/dist/devices.js

@@ -0,0 +1,53 @@
+/**
+ * The paired-device ledger: which phones hold a token for this desktop.
+ *
+ * The host keeps one row per device (`.waterplane/devices.json`, token hashed at
+ * rest); these are the rows as the phone sees them — never the hash. Revoking a
+ * row kills its token at once. `lastSeenAt` is written at most once per
+ * `DEVICE_SEEN_THROTTLE_MS` per device, so it is "seen within the last minute",
+ * not a live presence.
+ */
+import { cleanLabel } from "./hosts.js";
+export const DEVICE_NAME_MAX = 40;
+export const DEVICE_SEEN_THROTTLE_MS = 60_000;
+export function isDeviceId(s) {
+    return typeof s === "string" && /^[A-Za-z0-9_-]{6,64}$/.test(s);
+}
+/** A device name as typed or as the phone reports it; `null` when empty. */
+export function normalizeDeviceName(raw) {
+    return cleanLabel(raw, DEVICE_NAME_MAX);
+}
+const PEER_KINDS = ["loopback", "tailscale", "lan", "public", "unknown"];
+function finiteTime(v) {
+    return typeof v === "number" && Number.isFinite(v) && v > 0 ? v : null;
+}
+/** One row read off disk or the wire, or `null`. A row with no creation time
+ *  cannot say when it was paired and is dropped rather than dated now. */
+export function cleanDeviceRow(raw) {
+    if (!raw || typeof raw !== "object")
+        return null;
+    const r = raw;
+    if (!isDeviceId(r.id))
+        return null;
+    const name = normalizeDeviceName(r.name);
+    const createdAt = finiteTime(r.createdAt);
+    if (!name || createdAt == null)
+        return null;
+    const lastSeenAt = finiteTime(r.lastSeenAt) ?? createdAt;
+    const lastKind = PEER_KINDS.includes(r.lastKind) ? r.lastKind : null;
+    const row = { id: r.id, name, createdAt, lastSeenAt, lastKind };
+    if (r.current === true)
+        row.current = true;
+    if (r.scope === "passive")
+        row.scope = "passive";
+    return row;
+}
+/** This phone first, then most recently seen. */
+export function sortDevices(rows) {
+    return [...rows].sort((a, b) => Number(!!b.current) - Number(!!a.current) || b.lastSeenAt - a.lastSeenAt);
+}
+/** Should `lastSeenAt` be written now? */
+export function deviceSeenDue(lastSeenAt, now) {
+    return now - lastSeenAt >= DEVICE_SEEN_THROTTLE_MS;
+}
+//# sourceMappingURL=devices.js.map

package/node_modules/@waterplane/shared/dist/devices.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"devices.js","sourceRoot":"","sources":["../src/devices.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAGH,OAAO,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAExC,MAAM,CAAC,MAAM,eAAe,GAAG,EAAE,CAAC;AAClC,MAAM,CAAC,MAAM,uBAAuB,GAAG,MAAM,CAAC;AAqC9C,MAAM,UAAU,UAAU,CAAC,CAAU;IACnC,OAAO,OAAO,CAAC,KAAK,QAAQ,IAAI,uBAAuB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClE,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,mBAAmB,CAAC,GAAY;IAC9C,OAAO,UAAU,CAAC,GAAG,EAAE,eAAe,CAAC,CAAC;AAC1C,CAAC;AAED,MAAM,UAAU,GAAwB,CAAC,UAAU,EAAE,WAAW,EAAE,KAAK,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC;AAE9F,SAAS,UAAU,CAAC,CAAU;IAC5B,OAAO,OAAO,CAAC,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AACzE,CAAC;AAED;0EAC0E;AAC1E,MAAM,UAAU,cAAc,CAAC,GAAY;IACzC,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACjD,MAAM,CAAC,GAAG,GAA8B,CAAC;IACzC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC;QAAE,OAAO,IAAI,CAAC;IACnC,MAAM,IAAI,GAAG,mBAAmB,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IACzC,MAAM,SAAS,GAAG,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IAC1C,IAAI,CAAC,IAAI,IAAI,SAAS,IAAI,IAAI;QAAE,OAAO,IAAI,CAAC;IAC5C,MAAM,UAAU,GAAG,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,SAAS,CAAC;IACzD,MAAM,QAAQ,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAoB,CAAC,CAAC,CAAC,CAAE,CAAC,CAAC,QAAqB,CAAC,CAAC,CAAC,IAAI,CAAC;IAC/F,MAAM,GAAG,GAAc,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,UAAU,EAAE,QAAQ,EAAE,CAAC;IAC3E,IAAI,CAAC,CAAC,OAAO,KAAK,IAAI;QAAE,GAAG,CAAC,OAAO,GAAG,IAAI,CAAC;IAC3C,IAAI,CAAC,CAAC,KAAK,KAAK,SAAS;QAAE,GAAG,CAAC,KAAK,GAAG,SAAS,CAAC;IACjD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,iDAAiD;AACjD,MAAM,UAAU,WAAW,CAAC,IAA0B;IACpD,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,UAAU,GAAG,CAAC,CAAC,UAAU,CAAC,CAAC;AAC5G,CAAC;AAED,0CAA0C;AAC1C,MAAM,UAAU,aAAa,CAAC,UAAkB,EAAE,GAAW;IAC3D,OAAO,GAAG,GAAG,UAAU,IAAI,uBAAuB,CAAC;AACrD,CAAC"}