waterplane 0.1.17 → 0.1.19

package/packages/host/dist/turnagents.js

@@ -32,11 +32,11 @@
  * that cannot be placed withholds every running total, because a total missing
  * it would read as complete.
  */
-import { readdirSync, statSync } from "node:fs";
+import { statSync } from "node:fs";
 import { join } from "node:path";
 import { AGENT_LIVE_MS, normalizeModel } from "@waterplane/shared";
 import { agentUsage } from "./ctxlog.js";
-import { readMeta } from "./agents.js";
+import { agentLogId, agentLogs, agentLogWorkflow, PARENT_TAIL, readMeta, readTail, readWorkflowJournal } from "./agents.js";
 /** Per-directory ledgers, kept so a poll re-reads only the agent logs that
  *  grew — `agentUsage` is incremental given its previous result. */
 const cache = new Map();
@@ -52,15 +52,13 @@ export function agentsMtime(logPath) {
     const dir = subagentsDirOf(logPath);
     let names;
     try {
-        names = readdirSync(dir);
+        names = agentLogs(dir);
     }
     catch {
         return 0;
     }
     let max = 0;
     for (const n of names) {
-        if (!n.startsWith("agent-") || !n.endsWith(".jsonl"))
-            continue;
         try {
             max = Math.max(max, statSync(join(dir, n)).mtimeMs);
         }
@@ -85,13 +83,31 @@ export function noteRetired(line, at, into) {
         }
     }
 }
+/**
+ * `wf_… → the Workflow call that launched it`, off the launch's own tool_result
+ * record. A workflow's agents name no `toolUseId` in their meta files, so this
+ * is the lookup that puts them on a turn. Read off the structured `toolUseResult`
+ * and never the text: a tool result that merely quotes a launch receipt is not one.
+ */
+export function noteWorkflowLaunch(rec, into) {
+    const r = rec;
+    const runId = r?.toolUseResult?.runId;
+    if (typeof runId !== "string" || !runId.startsWith("wf_"))
+        return;
+    const content = r?.message?.content;
+    if (!Array.isArray(content))
+        return;
+    const res = content.find((b) => b?.type === "tool_result" && typeof b.tool_use_id === "string");
+    if (res)
+        into.set(runId, res.tool_use_id);
+}
 /**
  * Put each agent's spend on the turn that started it, in place.
  *
  * `partial`: the parent log was tail-read, so earlier turns — and the calls of
  * agents started there — are missing; no running total is published.
  */
-export function attachAgentSpend(turns, logPath, retired, partial, now = Date.now()) {
+export function attachAgentSpend(turns, logPath, retired, partial, now = Date.now(), workflows = new Map()) {
     const dir = subagentsDirOf(logPath);
     const use = agentUsage(dir, cache.get(dir) ?? null);
     if (!use)
@@ -107,17 +123,31 @@ export function attachAgentSpend(turns, logPath, retired, partial, now = Date.no
         for (const b of t.blocks) {
             if (b.kind !== "tool")
                 continue;
-            if (b.name === "Task" || b.name === "Agent")
+            if (b.name === "Task" || b.name === "Agent" || b.name === "Workflow")
                 turnOfCall.set(b.id, t);
             if (b.ok !== undefined)
                 answered.add(b.id);
         }
     }
     const metas = new Map();
-    for (const name of use.files.keys()) {
-        const id = name.slice("agent-".length, -".jsonl".length);
-        metas.set(id, readMeta(join(dir, `agent-${id}.meta.json`)));
+    const fileOf = new Map();
+    for (const [name, f] of use.files) {
+        const id = agentLogId(name);
+        metas.set(id, readMeta(join(dir, `${name.slice(0, -".jsonl".length)}.meta.json`)));
+        fileOf.set(id, f);
     }
+    /** A workflow's agent gets no notification of its own: its journal says when
+     *  it ended, and only an agent still writing is worth reading one for. */
+    const journals = new Map();
+    const workflowEnded = (wf, id) => {
+        let j = journals.get(wf);
+        if (!j) {
+            j = readWorkflowJournal(readTail(join(dir, "workflows", wf, "journal.jsonl"), PARENT_TAIL));
+            journals.set(wf, j);
+        }
+        const key = j.agentKey.get(id);
+        return key !== undefined && j.ended.has(key);
+    };
     /** The top-level agent an agent descends from; itself when it is one. Null
      *  on a broken or cyclic chain. */
     const rootOf = (id) => {
@@ -147,9 +177,10 @@ export function attachAgentSpend(turns, logPath, retired, partial, now = Date.no
     const perTurn = new Array(turns.length).fill(0);
     const seenCalls = new Set();
     for (const [name, f] of use.files) {
-        const id = name.slice("agent-".length, -".jsonl".length);
+        const id = agentLogId(name);
+        const wf = agentLogWorkflow(name);
         const root = rootOf(id);
-        const call = root ? metas.get(root)?.toolUseId : undefined;
+        const call = wf ? workflows.get(wf) : root ? metas.get(root)?.toolUseId : undefined;
         const t = call ? turnOfCall.get(call) : undefined;
         if (!t || !root) {
             if (f.tok > 0)
@@ -158,10 +189,12 @@ export function attachAgentSpend(turns, logPath, retired, partial, now = Date.no
         }
         if (call)
             seenCalls.add(call);
-        const rootFile = use.files.get(`agent-${root}.jsonl`);
-        const live = root === id
-            ? runningTop(id, f.mtime)
-            : now - f.mtime <= AGENT_LIVE_MS && !!rootFile && runningTop(root, Math.max(rootFile.mtime, f.mtime));
+        const rootFile = fileOf.get(root);
+        const live = wf
+            ? now - f.mtime <= AGENT_LIVE_MS && !workflowEnded(wf, id)
+            : root === id
+                ? runningTop(id, f.mtime)
+                : now - f.mtime <= AGENT_LIVE_MS && !!rootFile && runningTop(root, Math.max(rootFile.mtime, f.mtime));
         if (live)
             t.agentsRunning = (t.agentsRunning ?? 0) + 1;
         if (f.cost.total > 0) {

package/packages/host/dist/turnagents.js.map

@@ -1 +1 @@
-{"version":3,"file":"turnagents.js","sourceRoot":"","sources":["../src/turnagents.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,OAAO,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAChD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,aAAa,EAAE,cAAc,EAAuB,MAAM,oBAAoB,CAAC;AACxF,OAAO,EAAE,UAAU,EAAmB,MAAM,aAAa,CAAC;AAC1D,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAEvC;oEACoE;AACpE,MAAM,KAAK,GAAG,IAAI,GAAG,EAAsB,CAAC;AAC5C,MAAM,SAAS,GAAG,EAAE,CAAC;AAErB,2DAA2D;AAC3D,MAAM,UAAU,cAAc,CAAC,OAAe;IAC5C,OAAO,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,EAAE,WAAW,CAAC,CAAC;AAC5D,CAAC;AAED;;6BAE6B;AAC7B,MAAM,UAAU,WAAW,CAAC,OAAe;IACzC,MAAM,GAAG,GAAG,cAAc,CAAC,OAAO,CAAC,CAAC;IACpC,IAAI,KAAe,CAAC;IACpB,IAAI,CAAC;QAAC,KAAK,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,CAAC,CAAC;IAAC,CAAC;IACrD,IAAI,GAAG,GAAG,CAAC,CAAC;IACZ,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC;YAAE,SAAS;QAC/D,IAAI,CAAC;YAAC,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC,CAAC,cAAc,CAAC,CAAC;IACvF,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,UAAU,GAAG,uCAAuC,CAAC;AAC3D,MAAM,YAAY,GAAG,+CAA+C,CAAC;AAErE;mDACmD;AACnD,MAAM,UAAU,WAAW,CAAC,IAAY,EAAE,EAAU,EAAE,IAAyB;IAC7E,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,sBAAsB,CAAC;QAAE,OAAO;IAClF,KAAK,MAAM,EAAE,IAAI,CAAC,UAAU,EAAE,YAAY,CAAC,EAAE,CAAC;QAC5C,EAAE,CAAC,SAAS,GAAG,CAAC,CAAC;QACjB,IAAI,CAAyB,CAAC;QAC9B,OAAO,CAAC,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;YAC3B,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YAC5B,IAAI,IAAI,KAAK,SAAS,IAAI,EAAE,GAAG,IAAI;gBAAE,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAC1D,CAAC;IACH,CAAC;AACH,CAAC;AAID;;;;;GAKG;AACH,MAAM,UAAU,gBAAgB,CAC9B,KAAuB,EACvB,OAAe,EACf,OAA4B,EAC5B,OAAgB,EAChB,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE;IAEhB,MAAM,GAAG,GAAG,cAAc,CAAC,OAAO,CAAC,CAAC;IACpC,MAAM,GAAG,GAAG,UAAU,CAAC,GAAG,EAAE,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,CAAC;IACpD,IAAI,CAAC,GAAG;QAAE,OAAO,CAAC,uDAAuD;IACzE,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAClB,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IACpB,IAAI,KAAK,CAAC,IAAI,GAAG,SAAS;QAAE,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC,KAAM,CAAC,CAAC;IAErE,qEAAqE;IACrE,MAAM,UAAU,GAAG,IAAI,GAAG,EAA0B,CAAC;IACrD,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAU,CAAC;IACnC,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC;YACzB,IAAI,CAAC,CAAC,IAAI,KAAK,MAAM;gBAAE,SAAS;YAChC,IAAI,CAAC,CAAC,IAAI,KAAK,MAAM,IAAI,CAAC,CAAC,IAAI,KAAK,OAAO;gBAAE,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;YACrE,IAAI,CAAC,CAAC,EAAE,KAAK,SAAS;gBAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAC7C,CAAC;IACH,CAAC;IAED,MAAM,KAAK,GAAG,IAAI,GAAG,EAAgB,CAAC;IACtC,KAAK,MAAM,IAAI,IAAI,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC;QACpC,MAAM,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QACzD,KAAK,CAAC,GAAG,CAAC,EAAE,EAAE,QAAQ,CAAC,IAAI,CAAC,GAAG,EAAE,SAAS,EAAE,YAAY,CAAC,CAAS,CAAC,CAAC;IACtE,CAAC;IACD;uCACmC;IACnC,MAAM,MAAM,GAAG,CAAC,EAAU,EAAiB,EAAE;QAC3C,IAAI,GAAG,GAAG,EAAE,CAAC;QACb,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;YAC3B,MAAM,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,aAAa,CAAC;YACxC,IAAI,CAAC,CAAC;gBAAE,OAAO,GAAG,CAAC;YACnB,GAAG,GAAG,CAAC,CAAC;QACV,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC,CAAC;IACF,MAAM,UAAU,GAAG,CAAC,EAAU,EAAE,SAAiB,EAAW,EAAE;QAC5D,IAAI,GAAG,GAAG,SAAS,GAAG,aAAa;YAAE,OAAO,KAAK,CAAC;QAClD,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC7B,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,IAAI,SAAS;YAAE,OAAO,KAAK,CAAC;QAC1D,MAAM,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACxB,IAAI,CAAC,EAAE,YAAY,KAAK,YAAY,IAAI,CAAC,EAAE,SAAS,IAAI,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;YAAE,OAAO,KAAK,CAAC;QAChG,OAAO,IAAI,CAAC;IACd,CAAC,CAAC;IAEF,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,MAAM,SAAS,GAAG,IAAI,GAAG,EAA0B,CAAC,CAAC,sCAAsC;IAC3F,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAC7C,MAAM,OAAO,GAAG,IAAI,KAAK,CAAS,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACxD,MAAM,SAAS,GAAG,IAAI,GAAG,EAAU,CAAC;IACpC,KAAK,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,GAAG,CAAC,KAAK,EAAE,CAAC;QAClC,MAAM,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QACzD,MAAM,IAAI,GAAG,MAAM,CAAC,EAAE,CAAC,CAAC;QACxB,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;QAC3D,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAClD,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;YAAC,IAAI,CAAC,CAAC,GAAG,GAAG,CAAC;gBAAE,QAAQ,GAAG,IAAI,CAAC;YAAC,SAAS;QAAC,CAAC;QAC9D,IAAI,IAAI;YAAE,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC9B,MAAM,QAAQ,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,SAAS,IAAI,QAAQ,CAAC,CAAC;QACtD,MAAM,IAAI,GAAG,IAAI,KAAK,EAAE;YACtB,CAAC,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC;YACzB,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,KAAK,IAAI,aAAa,IAAI,CAAC,CAAC,QAAQ,IAAI,UAAU,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;QACxG,IAAI,IAAI;YAAE,CAAC,CAAC,aAAa,GAAG,CAAC,CAAC,CAAC,aAAa,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;QACvD,IAAI,CAAC,CAAC,IAAI,CAAC,KAAK,GAAG,CAAC,EAAE,CAAC;YACrB,CAAC,CAAC,YAAY,GAAG,CAAC,CAAC,CAAC,YAAY,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC;YACtD,OAAO,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAE,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC;QAC7C,CAAC;QACD,IAAI,CAAC,CAAC,QAAQ,GAAG,CAAC;YAAE,CAAC,CAAC,gBAAgB,GAAG,CAAC,CAAC,CAAC,gBAAgB,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC;QAChF,IAAI,CAAC,CAAC,GAAG,GAAG,CAAC,EAAE,CAAC;YACd,MAAM,GAAG,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,WAAW,CAAC;YACvE,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,GAAG,CAAC,CAAC;YACzD,IAAI,CAAC,CAAC,EAAE,CAAC;gBAAC,CAAC,GAAG,EAAE,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC;gBAAC,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAAC,CAAC;YAC3D,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC;YACf,IAAI,CAAC,CAAC,IAAI,CAAC,KAAK,GAAG,CAAC;gBAAE,CAAC,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC;QACpE,CAAC;IACH,CAAC;IACD,2EAA2E;IAC3E,+EAA+E;IAC/E,KAAK,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,UAAU,EAAE,CAAC;QACnC,IAAI,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,SAAS;QACxD,sEAAsE;QACtE,+DAA+D;QAC/D,IAAI,GAAG,GAAG,CAAC,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,GAAG,aAAa;YAAE,SAAS;QACjE,CAAC,CAAC,aAAa,GAAG,CAAC,CAAC,CAAC,aAAa,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;IAC/C,CAAC;IAED,IAAI,OAAO,IAAI,QAAQ;QAAE,OAAO;IAChC,IAAI,GAAG,GAAG,CAAC,CAAC;IACZ,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;QACrB,GAAG,IAAI,OAAO,CAAC,CAAC,CAAC,CAAC;QAClB,IAAI,CAAC,CAAC,UAAU,IAAI,IAAI;YAAE,CAAC,CAAC,eAAe,GAAG,GAAG,CAAC;IACpD,CAAC,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"turnagents.js","sourceRoot":"","sources":["../src/turnagents.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACnC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,aAAa,EAAE,cAAc,EAAuB,MAAM,oBAAoB,CAAC;AACxF,OAAO,EAAE,UAAU,EAAmC,MAAM,aAAa,CAAC;AAC1E,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,gBAAgB,EAAE,WAAW,EAAE,QAAQ,EAAE,QAAQ,EAAE,mBAAmB,EAAwB,MAAM,aAAa,CAAC;AAElJ;oEACoE;AACpE,MAAM,KAAK,GAAG,IAAI,GAAG,EAAsB,CAAC;AAC5C,MAAM,SAAS,GAAG,EAAE,CAAC;AAErB,2DAA2D;AAC3D,MAAM,UAAU,cAAc,CAAC,OAAe;IAC5C,OAAO,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,EAAE,WAAW,CAAC,CAAC;AAC5D,CAAC;AAED;;6BAE6B;AAC7B,MAAM,UAAU,WAAW,CAAC,OAAe;IACzC,MAAM,GAAG,GAAG,cAAc,CAAC,OAAO,CAAC,CAAC;IACpC,IAAI,KAAe,CAAC;IACpB,IAAI,CAAC;QAAC,KAAK,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,CAAC,CAAC;IAAC,CAAC;IACnD,IAAI,GAAG,GAAG,CAAC,CAAC;IACZ,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,IAAI,CAAC;YAAC,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC,CAAC,cAAc,CAAC,CAAC;IACvF,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,UAAU,GAAG,uCAAuC,CAAC;AAC3D,MAAM,YAAY,GAAG,+CAA+C,CAAC;AAErE;mDACmD;AACnD,MAAM,UAAU,WAAW,CAAC,IAAY,EAAE,EAAU,EAAE,IAAyB;IAC7E,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,sBAAsB,CAAC;QAAE,OAAO;IAClF,KAAK,MAAM,EAAE,IAAI,CAAC,UAAU,EAAE,YAAY,CAAC,EAAE,CAAC;QAC5C,EAAE,CAAC,SAAS,GAAG,CAAC,CAAC;QACjB,IAAI,CAAyB,CAAC;QAC9B,OAAO,CAAC,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;YAC3B,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YAC5B,IAAI,IAAI,KAAK,SAAS,IAAI,EAAE,GAAG,IAAI;gBAAE,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAC1D,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB,CAAC,GAAY,EAAE,IAAyB;IACxE,MAAM,CAAC,GAAG,GAAsF,CAAC;IACjG,MAAM,KAAK,GAAG,CAAC,EAAE,aAAa,EAAE,KAAK,CAAC;IACtC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC;QAAE,OAAO;IAClE,MAAM,OAAO,GAAG,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC;IACpC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC;QAAE,OAAO;IACpC,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,KAAK,aAAa,IAAI,OAAO,CAAC,CAAC,WAAW,KAAK,QAAQ,CAAC,CAAC;IAChG,IAAI,GAAG;QAAE,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,WAAW,CAAC,CAAC;AAC5C,CAAC;AAID;;;;;GAKG;AACH,MAAM,UAAU,gBAAgB,CAC9B,KAAuB,EACvB,OAAe,EACf,OAA4B,EAC5B,OAAgB,EAChB,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,EAChB,YAAiC,IAAI,GAAG,EAAE;IAE1C,MAAM,GAAG,GAAG,cAAc,CAAC,OAAO,CAAC,CAAC;IACpC,MAAM,GAAG,GAAG,UAAU,CAAC,GAAG,EAAE,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,CAAC;IACpD,IAAI,CAAC,GAAG;QAAE,OAAO,CAAC,uDAAuD;IACzE,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAClB,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IACpB,IAAI,KAAK,CAAC,IAAI,GAAG,SAAS;QAAE,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC,KAAM,CAAC,CAAC;IAErE,qEAAqE;IACrE,MAAM,UAAU,GAAG,IAAI,GAAG,EAA0B,CAAC;IACrD,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAU,CAAC;IACnC,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC;YACzB,IAAI,CAAC,CAAC,IAAI,KAAK,MAAM;gBAAE,SAAS;YAChC,IAAI,CAAC,CAAC,IAAI,KAAK,MAAM,IAAI,CAAC,CAAC,IAAI,KAAK,OAAO,IAAI,CAAC,CAAC,IAAI,KAAK,UAAU;gBAAE,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;YAC9F,IAAI,CAAC,CAAC,EAAE,KAAK,SAAS;gBAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAC7C,CAAC;IACH,CAAC;IAED,MAAM,KAAK,GAAG,IAAI,GAAG,EAAgB,CAAC;IACtC,MAAM,MAAM,GAAG,IAAI,GAAG,EAAqB,CAAC;IAC5C,KAAK,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,GAAG,CAAC,KAAK,EAAE,CAAC;QAClC,MAAM,EAAE,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC;QAC5B,KAAK,CAAC,GAAG,CAAC,EAAE,EAAE,QAAQ,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,YAAY,CAAC,CAAS,CAAC,CAAC;QAC3F,MAAM,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;IACpB,CAAC;IACD;8EAC0E;IAC1E,MAAM,QAAQ,GAAG,IAAI,GAAG,EAA2B,CAAC;IACpD,MAAM,aAAa,GAAG,CAAC,EAAU,EAAE,EAAU,EAAW,EAAE;QACxD,IAAI,CAAC,GAAG,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACzB,IAAI,CAAC,CAAC,EAAE,CAAC;YACP,CAAC,GAAG,mBAAmB,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,EAAE,WAAW,EAAE,EAAE,EAAE,eAAe,CAAC,EAAE,WAAW,CAAC,CAAC,CAAC;YAC5F,QAAQ,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;QACtB,CAAC;QACD,MAAM,GAAG,GAAG,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC/B,OAAO,GAAG,KAAK,SAAS,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC/C,CAAC,CAAC;IACF;uCACmC;IACnC,MAAM,MAAM,GAAG,CAAC,EAAU,EAAiB,EAAE;QAC3C,IAAI,GAAG,GAAG,EAAE,CAAC;QACb,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;YAC3B,MAAM,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,aAAa,CAAC;YACxC,IAAI,CAAC,CAAC;gBAAE,OAAO,GAAG,CAAC;YACnB,GAAG,GAAG,CAAC,CAAC;QACV,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC,CAAC;IACF,MAAM,UAAU,GAAG,CAAC,EAAU,EAAE,SAAiB,EAAW,EAAE;QAC5D,IAAI,GAAG,GAAG,SAAS,GAAG,aAAa;YAAE,OAAO,KAAK,CAAC;QAClD,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC7B,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,IAAI,SAAS;YAAE,OAAO,KAAK,CAAC;QAC1D,MAAM,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACxB,IAAI,CAAC,EAAE,YAAY,KAAK,YAAY,IAAI,CAAC,EAAE,SAAS,IAAI,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;YAAE,OAAO,KAAK,CAAC;QAChG,OAAO,IAAI,CAAC;IACd,CAAC,CAAC;IAEF,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,MAAM,SAAS,GAAG,IAAI,GAAG,EAA0B,CAAC,CAAC,sCAAsC;IAC3F,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAC7C,MAAM,OAAO,GAAG,IAAI,KAAK,CAAS,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACxD,MAAM,SAAS,GAAG,IAAI,GAAG,EAAU,CAAC;IACpC,KAAK,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,GAAG,CAAC,KAAK,EAAE,CAAC;QAClC,MAAM,EAAE,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC;QAC5B,MAAM,EAAE,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;QAClC,MAAM,IAAI,GAAG,MAAM,CAAC,EAAE,CAAC,CAAC;QACxB,MAAM,IAAI,GAAG,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;QACpF,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAClD,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;YAAC,IAAI,CAAC,CAAC,GAAG,GAAG,CAAC;gBAAE,QAAQ,GAAG,IAAI,CAAC;YAAC,SAAS;QAAC,CAAC;QAC9D,IAAI,IAAI;YAAE,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC9B,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAClC,MAAM,IAAI,GAAG,EAAE;YACb,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,KAAK,IAAI,aAAa,IAAI,CAAC,aAAa,CAAC,EAAE,EAAE,EAAE,CAAC;YAC1D,CAAC,CAAC,IAAI,KAAK,EAAE;gBACb,CAAC,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC;gBACzB,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,KAAK,IAAI,aAAa,IAAI,CAAC,CAAC,QAAQ,IAAI,UAAU,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;QACxG,IAAI,IAAI;YAAE,CAAC,CAAC,aAAa,GAAG,CAAC,CAAC,CAAC,aAAa,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;QACvD,IAAI,CAAC,CAAC,IAAI,CAAC,KAAK,GAAG,CAAC,EAAE,CAAC;YACrB,CAAC,CAAC,YAAY,GAAG,CAAC,CAAC,CAAC,YAAY,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC;YACtD,OAAO,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAE,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC;QAC7C,CAAC;QACD,IAAI,CAAC,CAAC,QAAQ,GAAG,CAAC;YAAE,CAAC,CAAC,gBAAgB,GAAG,CAAC,CAAC,CAAC,gBAAgB,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC;QAChF,IAAI,CAAC,CAAC,GAAG,GAAG,CAAC,EAAE,CAAC;YACd,MAAM,GAAG,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,WAAW,CAAC;YACvE,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,GAAG,CAAC,CAAC;YACzD,IAAI,CAAC,CAAC,EAAE,CAAC;gBAAC,CAAC,GAAG,EAAE,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC;gBAAC,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAAC,CAAC;YAC3D,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC;YACf,IAAI,CAAC,CAAC,IAAI,CAAC,KAAK,GAAG,CAAC;gBAAE,CAAC,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC;QACpE,CAAC;IACH,CAAC;IACD,2EAA2E;IAC3E,+EAA+E;IAC/E,KAAK,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,UAAU,EAAE,CAAC;QACnC,IAAI,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,SAAS;QACxD,sEAAsE;QACtE,+DAA+D;QAC/D,IAAI,GAAG,GAAG,CAAC,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,GAAG,aAAa;YAAE,SAAS;QACjE,CAAC,CAAC,aAAa,GAAG,CAAC,CAAC,CAAC,aAAa,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;IAC/C,CAAC;IAED,IAAI,OAAO,IAAI,QAAQ;QAAE,OAAO;IAChC,IAAI,GAAG,GAAG,CAAC,CAAC;IACZ,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;QACrB,GAAG,IAAI,OAAO,CAAC,CAAC,CAAC,CAAC;QAClB,IAAI,CAAC,CAAC,UAAU,IAAI,IAAI;YAAE,CAAC,CAAC,eAAe,GAAG,GAAG,CAAC;IACpD,CAAC,CAAC,CAAC;AACL,CAAC"}

package/packages/host/dist/updatekey.d.ts

@@ -0,0 +1,22 @@
+/** What the signature covers, beside `hostId` and `gen`, which this file adds. */
+export interface UpdateBody {
+    buildId: string;
+    total: number;
+    files: {
+        path: string;
+        size: number;
+        sha256: string;
+    }[];
+}
+/** `signed`: base64 of the JSON a phone reads. `sig`: base64 P1363 `r‖s` over those decoded bytes. */
+export interface UpdateSignature {
+    signed: string;
+    sig: string;
+}
+export declare function updateKeyFile(root: string): string;
+/** base64 SPKI DER of this desktop's update key, or undefined when there is none to give. */
+export declare function updatePublicKey(root: string): string | undefined;
+/** Sign one build. Undefined means serve it unsigned: never throws, the reason is logged. */
+export declare function signUpdate(root: string, body: UpdateBody): UpdateSignature | undefined;
+/** For tests: forget what is held for `root`, as a restart would. */
+export declare function forgetUpdateKey(root: string): void;

package/packages/host/dist/updatekey.js

@@ -0,0 +1,140 @@
+/**
+ * This desktop's update signing key: what lets a phone tell a web bundle this
+ * desktop published from one a relay on the Wi-Fi made up.
+ *
+ * The manifest's hashes arrive in the same answer as the rest of it, so whoever
+ * can change the files can change the hashes. A phone that pinned `updateKey`
+ * over a protected route can check `sig` over `signed` instead, and a relay has
+ * no way to produce one. The key is per desktop, not per project, because people
+ * build their own bundles and a private key shipped to every desktop is no key.
+ * P-256, not Ed25519: `minSdk` is 24 and old WebViews lack Ed25519.
+ *
+ * `<state dir>/update-key.json`, mode 0600, created the first time anything asks:
+ * the private key (PKCS#8 DER, base64), `gen` and `lastBuildId`.
+ *
+ * `gen` is what stops an old signed bundle being replayed: it moves up by one
+ * only when the served build id differs from `lastBuildId`, so a poll or a
+ * restart leaves it alone, and a real revert to an older build gets a higher
+ * number than the build it replaces. It reaches the disk before anything is
+ * signed with it, so a crash can never hand out the same number twice.
+ *
+ * Degrade, never break. A file that cannot be read is moved aside and a new key
+ * made, which each phone asks about once. When the disk refuses, `signUpdate`
+ * and `updatePublicKey` answer undefined, the reason goes to the console once,
+ * and the bundle is served unsigned.
+ */
+import { createPrivateKey, createPublicKey, generateKeyPairSync, sign } from "node:crypto";
+import { chmodSync, renameSync } from "node:fs";
+import { join } from "node:path";
+import { logTag } from "@waterplane/shared";
+import { hostStateDir } from "./branddirs.js";
+import { corruptPathFor, readJsonGuardedDetail, writeJsonAtomic } from "./jsonstore.js";
+import { lanIdentity } from "./lanid.js";
+const held = new Map();
+/** Reasons already on the console, so a phone polling a broken disk logs each one once. */
+const said = new Set();
+export function updateKeyFile(root) {
+    return join(hostStateDir(root), "update-key.json");
+}
+function privateKeyOf(key) {
+    try {
+        const k = createPrivateKey({ key: Buffer.from(key, "base64"), format: "der", type: "pkcs8" });
+        return k.asymmetricKeyDetails?.namedCurve === "prime256v1" ? k : null;
+    }
+    catch {
+        return null;
+    }
+}
+function isStoredKey(v) {
+    const j = v;
+    return typeof j?.key === "string" && privateKeyOf(j.key) !== null
+        && Number.isSafeInteger(j.gen) && j.gen >= 0
+        && (j.lastBuildId === null || typeof j.lastBuildId === "string");
+}
+function hold(s) {
+    const privateKey = privateKeyOf(s.key);
+    if (!privateKey)
+        throw new Error("update key is not a P-256 key");
+    const publicKey = createPublicKey(privateKey).export({ format: "der", type: "spki" }).toString("base64");
+    return { key: s.key, gen: s.gen, lastBuildId: s.lastBuildId, privateKey, publicKey };
+}
+function save(file, s) {
+    writeJsonAtomic(file, { key: s.key, gen: s.gen, lastBuildId: s.lastBuildId }, { mode: 0o600 });
+}
+/** The key of `root`: held, else read, else made. Throws only when the disk refuses a new one. */
+function load(root) {
+    const hit = held.get(root);
+    if (hit)
+        return hit;
+    const file = updateKeyFile(root);
+    const read = readJsonGuardedDetail(file, null, isStoredKey);
+    if (read.value) {
+        try {
+            chmodSync(file, 0o600);
+        }
+        catch { /* best effort on odd filesystems */ }
+        const k = hold(read.value);
+        held.set(root, k);
+        return k;
+    }
+    if (read.corrupt) {
+        // jsonstore leaves a file it could not open where it is. A rename needs no
+        // read access, and the next write must never land on the only copy.
+        const movedTo = read.corrupt.movedTo ?? corruptPathFor(file);
+        if (!read.corrupt.movedTo)
+            renameSync(file, movedTo);
+        console.error(`${logTag} update signing key could not be read (${read.corrupt.error}); kept as ${movedTo}. Making a new key: each phone asks once before it trusts it.`);
+    }
+    const key = generateKeyPairSync("ec", { namedCurve: "prime256v1" }).privateKey.export({ format: "der", type: "pkcs8" }).toString("base64");
+    const k = hold({ key, gen: 0, lastBuildId: null });
+    save(file, k);
+    held.set(root, k);
+    return k;
+}
+/** `gen` for this build: the same one for the same build, and on disk before it is returned. */
+function advance(root, k, buildId) {
+    if (k.lastBuildId === buildId)
+        return k.gen;
+    save(updateKeyFile(root), { key: k.key, gen: k.gen + 1, lastBuildId: buildId });
+    k.gen += 1;
+    k.lastBuildId = buildId;
+    return k.gen;
+}
+function refused(root, what, e) {
+    const why = `${what}: ${e?.message ?? e}`;
+    if (!said.has(`${root}\0${why}`))
+        console.error(`${logTag} ${why}`);
+    said.add(`${root}\0${why}`);
+    return undefined;
+}
+/** base64 SPKI DER of this desktop's update key, or undefined when there is none to give. */
+export function updatePublicKey(root) {
+    try {
+        return load(root).publicKey;
+    }
+    catch (e) {
+        return refused(root, "no update signing key", e);
+    }
+}
+/** Sign one build. Undefined means serve it unsigned: never throws, the reason is logged. */
+export function signUpdate(root, body) {
+    try {
+        const { hostId } = lanIdentity(root);
+        const k = load(root);
+        const gen = advance(root, k, body.buildId);
+        const files = body.files.map(({ path, size, sha256 }) => ({ path, size, sha256 }));
+        const bytes = Buffer.from(JSON.stringify({ v: 1, hostId, buildId: body.buildId, gen, total: body.total, files }), "utf8");
+        const sig = sign("sha256", bytes, { key: k.privateKey, dsaEncoding: "ieee-p1363" });
+        said.clear();
+        return { signed: bytes.toString("base64"), sig: sig.toString("base64") };
+    }
+    catch (e) {
+        return refused(root, "web bundle served unsigned", e);
+    }
+}
+/** For tests: forget what is held for `root`, as a restart would. */
+export function forgetUpdateKey(root) {
+    held.delete(root);
+    said.clear();
+}
+//# sourceMappingURL=updatekey.js.map

package/packages/host/dist/updatekey.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"updatekey.js","sourceRoot":"","sources":["../src/updatekey.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,OAAO,EAAE,gBAAgB,EAAE,eAAe,EAAE,mBAAmB,EAAE,IAAI,EAAkB,MAAM,aAAa,CAAC;AAC3G,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAChD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAC5C,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAC9C,OAAO,EAAE,cAAc,EAAE,qBAAqB,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AACxF,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AA2BzC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAmB,CAAC;AACxC,2FAA2F;AAC3F,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;AAE/B,MAAM,UAAU,aAAa,CAAC,IAAY;IACxC,OAAO,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,EAAE,iBAAiB,CAAC,CAAC;AACrD,CAAC;AAED,SAAS,YAAY,CAAC,GAAW;IAC/B,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,gBAAgB,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;QAC9F,OAAO,CAAC,CAAC,oBAAoB,EAAE,UAAU,KAAK,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACxE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,WAAW,CAAC,CAAU;IAC7B,MAAM,CAAC,GAAG,CAA8B,CAAC;IACzC,OAAO,OAAO,CAAC,EAAE,GAAG,KAAK,QAAQ,IAAI,YAAY,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,IAAI;WAC5D,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,GAAG,CAAC,IAAK,CAAC,CAAC,GAAc,IAAI,CAAC;WACrD,CAAC,CAAC,CAAC,WAAW,KAAK,IAAI,IAAI,OAAO,CAAC,CAAC,WAAW,KAAK,QAAQ,CAAC,CAAC;AACrE,CAAC;AAED,SAAS,IAAI,CAAC,CAAY;IACxB,MAAM,UAAU,GAAG,YAAY,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IACvC,IAAI,CAAC,UAAU;QAAE,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;IAClE,MAAM,SAAS,GAAG,eAAe,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACzG,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,WAAW,EAAE,CAAC,CAAC,WAAW,EAAE,UAAU,EAAE,SAAS,EAAE,CAAC;AACvF,CAAC;AAED,SAAS,IAAI,CAAC,IAAY,EAAE,CAAY;IACtC,eAAe,CAAC,IAAI,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,WAAW,EAAE,CAAC,CAAC,WAAW,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;AACjG,CAAC;AAED,kGAAkG;AAClG,SAAS,IAAI,CAAC,IAAY;IACxB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC3B,IAAI,GAAG;QAAE,OAAO,GAAG,CAAC;IACpB,MAAM,IAAI,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;IACjC,MAAM,IAAI,GAAG,qBAAqB,CAAmB,IAAI,EAAE,IAAI,EAAE,WAAW,CAAC,CAAC;IAC9E,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;QACf,IAAI,CAAC;YAAC,SAAS,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC,CAAC,oCAAoC,CAAC,CAAC;QAC9E,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC3B,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;QAClB,OAAO,CAAC,CAAC;IACX,CAAC;IACD,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;QACjB,2EAA2E;QAC3E,oEAAoE;QACpE,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,IAAI,cAAc,CAAC,IAAI,CAAC,CAAC;QAC7D,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO;YAAE,UAAU,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QACrD,OAAO,CAAC,KAAK,CAAC,GAAG,MAAM,0CAA0C,IAAI,CAAC,OAAO,CAAC,KAAK,cAAc,OAAO,+DAA+D,CAAC,CAAC;IAC3K,CAAC;IACD,MAAM,GAAG,GAAG,mBAAmB,CAAC,IAAI,EAAE,EAAE,UAAU,EAAE,YAAY,EAAE,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAC3I,MAAM,CAAC,GAAG,IAAI,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC;IACnD,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IACd,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IAClB,OAAO,CAAC,CAAC;AACX,CAAC;AAED,gGAAgG;AAChG,SAAS,OAAO,CAAC,IAAY,EAAE,CAAU,EAAE,OAAe;IACxD,IAAI,CAAC,CAAC,WAAW,KAAK,OAAO;QAAE,OAAO,CAAC,CAAC,GAAG,CAAC;IAC5C,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,GAAG,CAAC,EAAE,WAAW,EAAE,OAAO,EAAE,CAAC,CAAC;IAChF,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;IACX,CAAC,CAAC,WAAW,GAAG,OAAO,CAAC;IACxB,OAAO,CAAC,CAAC,GAAG,CAAC;AACf,CAAC;AAED,SAAS,OAAO,CAAC,IAAY,EAAE,IAAY,EAAE,CAAU;IACrD,MAAM,GAAG,GAAG,GAAG,IAAI,KAAM,CAAW,EAAE,OAAO,IAAI,CAAC,EAAE,CAAC;IACrD,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,IAAI,KAAK,GAAG,EAAE,CAAC;QAAE,OAAO,CAAC,KAAK,CAAC,GAAG,MAAM,IAAI,GAAG,EAAE,CAAC,CAAC;IACpE,IAAI,CAAC,GAAG,CAAC,GAAG,IAAI,KAAK,GAAG,EAAE,CAAC,CAAC;IAC5B,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,6FAA6F;AAC7F,MAAM,UAAU,eAAe,CAAC,IAAY;IAC1C,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC;IAC9B,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO,OAAO,CAAC,IAAI,EAAE,uBAAuB,EAAE,CAAC,CAAC,CAAC;IACnD,CAAC;AACH,CAAC;AAED,6FAA6F;AAC7F,MAAM,UAAU,UAAU,CAAC,IAAY,EAAE,IAAgB;IACvD,IAAI,CAAC;QACH,MAAM,EAAE,MAAM,EAAE,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC;QACrC,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC;QACrB,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;QAC3C,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;QACnF,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,KAAK,EAAE,CAAC,EAAE,MAAM,CAAC,CAAC;QAC1H,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,EAAE,KAAK,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC,UAAU,EAAE,WAAW,EAAE,YAAY,EAAE,CAAC,CAAC;QACpF,IAAI,CAAC,KAAK,EAAE,CAAC;QACb,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,GAAG,EAAE,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;IAC3E,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO,OAAO,CAAC,IAAI,EAAE,4BAA4B,EAAE,CAAC,CAAC,CAAC;IACxD,CAAC;AACH,CAAC;AAED,qEAAqE;AACrE,MAAM,UAAU,eAAe,CAAC,IAAY;IAC1C,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAClB,IAAI,CAAC,KAAK,EAAE,CAAC;AACf,CAAC"}

package/packages/host/dist/webbundle.d.ts

@@ -23,15 +23,24 @@ export interface BundleManifest {
     total: number;
     /** Present when `ok` is false — safe to show to the user. */
     reason?: string;
+    /** base64 of the JSON this manifest's signature covers. A new client reads
+     *  only this, so nothing has to be put in a canonical form. Old clients ignore it. */
+    signed?: string;
+    /** base64 P1363 `r‖s`, ECDSA P-256 SHA-256 over the decoded `signed` bytes. */
+    sig?: string;
 }
 /**
- * The manifest for the bundle currently on disk.
- *
- * Hashes are cached against a paths+sizes+mtimes fingerprint: the phone polls
- * this, and re-reading ~1 MB per poll to produce a value that changes a few
- * times a day is waste. A rebuild moves an mtime, so the cache cannot go stale.
+ * The manifest for the bundle currently on disk, signed with the key of `root`.
+ * With no `root` there is no state dir to keep a key in, so it stays unsigned.
+ */
+export declare function webBundleManifest(root?: string): BundleManifest;
+/**
+ * `base` with `signed` and `sig`, or `base` itself when it cannot be signed. Signs
+ * once per manifest object: the phone polls this, and `hashedManifest` hands back
+ * the same object until the tree changes. A refused manifest describes no build
+ * and is never signed.
  */
-export declare function webBundleManifest(): BundleManifest;
+export declare function signedManifest(base: BundleManifest, root: string): BundleManifest;
 /**
  * Resolve one bundle-relative path to a real file, or null.
  *

package/packages/host/dist/webbundle.js

@@ -20,18 +20,27 @@
  *    id that changed per build would have the phone re-downloading ~900 KB over
  *    a roaming link to arrive at a byte-identical bundle.
  *  - **Per-file `sha256`**, so the client can verify each piece before it
- *    replaces a working app. This guards against a truncated transfer on a bad
- *    link — it is NOT a defence against a hostile host, which is already able to
- *    run arbitrary code on your machine (see SECURITY.md); the bundle is only
- *    ever fetched from the host the user paired with.
+ *    replaces a working app. This catches a truncated transfer on a bad link and
+ *    nothing more: the hashes come in the same answer as the rest of the
+ *    manifest, so whoever can change one can change the other.
+ *  - **`signed` + `sig` are the defence.** `signed` carries the build id, the
+ *    file list, this desktop's `hostId` and a rising `gen`; `sig` is this
+ *    desktop's own P-256 key over those bytes (`updatekey.ts`). A phone that
+ *    pinned the key over a protected route reads only what is inside `signed`,
+ *    so a relay on the Wi-Fi can neither change a bundle nor replay an older
+ *    one. It does nothing for a phone with no pin, and nothing against a hostile
+ *    desktop, which holds the key and can already run arbitrary code on your
+ *    machine (see SECURITY.md).
  *  - **Degrade, never break.** No `dist`, no `build-id.txt`, or a bundle past the
  *    caps ⇒ `ok: false` with a reason, and the shell simply says updating is
- *    unavailable and keeps running what it has.
+ *    unavailable and keeps running what it has. No usable signing key ⇒ the same
+ *    manifest with no `signed`, and the reason on the console.
  */
 import { createHash } from "node:crypto";
 import { readFileSync, readdirSync, statSync } from "node:fs";
 import { join, relative, resolve, sep } from "node:path";
 import { BRAND } from "@waterplane/shared";
+import { signUpdate } from "./updatekey.js";
 /** Why a dist with no `build-id.txt` is refused, and what to do in either kind
  *  of install: a checkout builds it; a release tarball ships it, so one without
  *  it is a damaged install. */
@@ -49,14 +58,42 @@ const MAX_TOTAL = 64 * 1024 * 1024;
 /** Cheap fingerprint of the tree (paths + sizes + mtimes), to skip re-hashing. */
 let cacheKey = "";
 let cached = null;
+/** The signed copy of one cached manifest. A failed signing is not kept, so the next poll tries again. */
+let signedCopy = null;
 /**
- * The manifest for the bundle currently on disk.
+ * The manifest for the bundle currently on disk, signed with the key of `root`.
+ * With no `root` there is no state dir to keep a key in, so it stays unsigned.
+ */
+export function webBundleManifest(root) {
+    const base = hashedManifest();
+    return root === undefined ? base : signedManifest(base, root);
+}
+/**
+ * `base` with `signed` and `sig`, or `base` itself when it cannot be signed. Signs
+ * once per manifest object: the phone polls this, and `hashedManifest` hands back
+ * the same object until the tree changes. A refused manifest describes no build
+ * and is never signed.
+ */
+export function signedManifest(base, root) {
+    if (!base.ok || !base.buildId)
+        return base;
+    if (signedCopy?.base === base && signedCopy.root === root)
+        return signedCopy.out;
+    const sig = signUpdate(root, { buildId: base.buildId, total: base.total, files: base.files });
+    if (!sig)
+        return base;
+    const out = { ...base, ...sig };
+    signedCopy = { base, root, out };
+    return out;
+}
+/**
+ * The hashed manifest of the tree.
  *
  * Hashes are cached against a paths+sizes+mtimes fingerprint: the phone polls
  * this, and re-reading ~1 MB per poll to produce a value that changes a few
  * times a day is waste. A rebuild moves an mtime, so the cache cannot go stale.
  */
-export function webBundleManifest() {
+function hashedManifest() {
     let files;
     try {
         files = walk(WEB_DIST).sort();

package/packages/host/dist/webbundle.js.map

@@ -1 +1 @@
-{"version":3,"file":"webbundle.js","sourceRoot":"","sources":["../src/webbundle.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAC9D,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AACzD,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAE3C;;+BAE+B;AAC/B,MAAM,CAAC,MAAM,kBAAkB,GAC7B,mFAAmF;IACnF,yEAAyE,KAAK,CAAC,IAAI,YAAY,CAAC;AAElG;;;;GAIG;AACH,MAAM,CAAC,MAAM,QAAQ,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,gBAAgB,CAAC,CAAC;AAEvE,mFAAmF;AACnF,MAAM,SAAS,GAAG,GAAG,CAAC;AACtB,MAAM,SAAS,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;AAoBnC,kFAAkF;AAClF,IAAI,QAAQ,GAAG,EAAE,CAAC;AAClB,IAAI,MAAM,GAA0B,IAAI,CAAC;AAEzC;;;;;;GAMG;AACH,MAAM,UAAU,iBAAiB;IAC/B,IAAI,KAAe,CAAC;IACpB,IAAI,CAAC;QACH,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,CAAC,IAAI,EAAE,CAAC;IAChC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,MAAM,EAAE,0BAA0B,EAAE,CAAC;IAC/F,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;QAClB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,MAAM,EAAE,0BAA0B,EAAE,CAAC;IAC/F,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,GAAG,SAAS,EAAE,CAAC;QAC7B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,MAAM,EAAE,cAAc,KAAK,CAAC,MAAM,eAAe,SAAS,GAAG,EAAE,CAAC;IAC1H,CAAC;IAED,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;QAC5B,MAAM,CAAC,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;QACtB,OAAO,EAAE,GAAG,EAAE,CAAC,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC;IACnE,CAAC,CAAC,CAAC;IACH,MAAM,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IACpD,IAAI,KAAK,GAAG,SAAS,EAAE,CAAC;QACtB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,GAAG,CAAC,YAAY,IAAI,CAAC,KAAK,CAAC,SAAS,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC;IACnJ,CAAC;IAED,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACtF,IAAI,GAAG,KAAK,QAAQ,IAAI,MAAM;QAAE,OAAO,MAAM,CAAC;IAE9C,IAAI,OAAO,GAAkB,IAAI,CAAC;IAClC,IAAI,CAAC;QACH,OAAO,GAAG,YAAY,CAAC,IAAI,CAAC,QAAQ,EAAE,cAAc,CAAC,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,IAAI,IAAI,CAAC;IAChF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,GAAG,IAAI,CAAC;IACjB,CAAC;IACD,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,yEAAyE;QACzE,uEAAuE;QACvE,uEAAuE;QACvE,MAAM,GAAG,GAAmB,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAC;QACvG,QAAQ,GAAG,GAAG,CAAC;QACf,MAAM,GAAG,GAAG,CAAC;QACb,OAAO,GAAG,CAAC;IACb,CAAC;IAED,MAAM,GAAG,GAAmB;QAC1B,EAAE,EAAE,IAAI;QACR,OAAO;QACP,KAAK;QACL,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACvB,IAAI,EAAE,CAAC,CAAC,GAAG;YACX,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,MAAM,EAAE,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;SACvE,CAAC,CAAC;KACJ,CAAC;IACF,QAAQ,GAAG,GAAG,CAAC;IACf,MAAM,GAAG,GAAG,CAAC;IACb,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,aAAa,CAAC,OAAe;IAC3C,MAAM,GAAG,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACnC,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACnE,MAAM,GAAG,GAAG,OAAO,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;IACnC,IAAI,GAAG,KAAK,QAAQ,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,QAAQ,GAAG,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACrE,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;QACxB,IAAI,CAAC,CAAC,CAAC,MAAM,EAAE;YAAE,OAAO,IAAI,CAAC;QAC7B,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC;IACnD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,GAAG,CAAC,GAAW;IACtB,OAAO,QAAQ,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACtD,CAAC;AAED,SAAS,IAAI,CAAC,GAAW;IACvB,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,KAAK,MAAM,CAAC,IAAI,WAAW,CAAC,GAAG,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;QAC1D,MAAM,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;QAC5B,4EAA4E;QAC5E,mEAAmE;QACnE,IAAI,CAAC,CAAC,WAAW,EAAE;YAAE,GAAG,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;aACrC,IAAI,CAAC,CAAC,MAAM,EAAE;YAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACnC,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC"}
+{"version":3,"file":"webbundle.js","sourceRoot":"","sources":["../src/webbundle.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAC9D,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AACzD,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAC3C,OAAO,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAE5C;;+BAE+B;AAC/B,MAAM,CAAC,MAAM,kBAAkB,GAC7B,mFAAmF;IACnF,yEAAyE,KAAK,CAAC,IAAI,YAAY,CAAC;AAElG;;;;GAIG;AACH,MAAM,CAAC,MAAM,QAAQ,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,gBAAgB,CAAC,CAAC;AAEvE,mFAAmF;AACnF,MAAM,SAAS,GAAG,GAAG,CAAC;AACtB,MAAM,SAAS,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;AAyBnC,kFAAkF;AAClF,IAAI,QAAQ,GAAG,EAAE,CAAC;AAClB,IAAI,MAAM,GAA0B,IAAI,CAAC;AACzC,0GAA0G;AAC1G,IAAI,UAAU,GAAuE,IAAI,CAAC;AAE1F;;;GAGG;AACH,MAAM,UAAU,iBAAiB,CAAC,IAAa;IAC7C,MAAM,IAAI,GAAG,cAAc,EAAE,CAAC;IAC9B,OAAO,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,cAAc,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;AAChE,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,cAAc,CAAC,IAAoB,EAAE,IAAY;IAC/D,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAC3C,IAAI,UAAU,EAAE,IAAI,KAAK,IAAI,IAAI,UAAU,CAAC,IAAI,KAAK,IAAI;QAAE,OAAO,UAAU,CAAC,GAAG,CAAC;IACjF,MAAM,GAAG,GAAG,UAAU,CAAC,IAAI,EAAE,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;IAC9F,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IACtB,MAAM,GAAG,GAAG,EAAE,GAAG,IAAI,EAAE,GAAG,GAAG,EAAE,CAAC;IAChC,UAAU,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC;IACjC,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;;GAMG;AACH,SAAS,cAAc;IACrB,IAAI,KAAe,CAAC;IACpB,IAAI,CAAC;QACH,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,CAAC,IAAI,EAAE,CAAC;IAChC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,MAAM,EAAE,0BAA0B,EAAE,CAAC;IAC/F,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;QAClB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,MAAM,EAAE,0BAA0B,EAAE,CAAC;IAC/F,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,GAAG,SAAS,EAAE,CAAC;QAC7B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,MAAM,EAAE,cAAc,KAAK,CAAC,MAAM,eAAe,SAAS,GAAG,EAAE,CAAC;IAC1H,CAAC;IAED,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;QAC5B,MAAM,CAAC,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;QACtB,OAAO,EAAE,GAAG,EAAE,CAAC,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC;IACnE,CAAC,CAAC,CAAC;IACH,MAAM,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IACpD,IAAI,KAAK,GAAG,SAAS,EAAE,CAAC;QACtB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,GAAG,CAAC,YAAY,IAAI,CAAC,KAAK,CAAC,SAAS,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC;IACnJ,CAAC;IAED,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACtF,IAAI,GAAG,KAAK,QAAQ,IAAI,MAAM;QAAE,OAAO,MAAM,CAAC;IAE9C,IAAI,OAAO,GAAkB,IAAI,CAAC;IAClC,IAAI,CAAC;QACH,OAAO,GAAG,YAAY,CAAC,IAAI,CAAC,QAAQ,EAAE,cAAc,CAAC,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,IAAI,IAAI,CAAC;IAChF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,GAAG,IAAI,CAAC;IACjB,CAAC;IACD,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,yEAAyE;QACzE,uEAAuE;QACvE,uEAAuE;QACvE,MAAM,GAAG,GAAmB,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAC;QACvG,QAAQ,GAAG,GAAG,CAAC;QACf,MAAM,GAAG,GAAG,CAAC;QACb,OAAO,GAAG,CAAC;IACb,CAAC;IAED,MAAM,GAAG,GAAmB;QAC1B,EAAE,EAAE,IAAI;QACR,OAAO;QACP,KAAK;QACL,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACvB,IAAI,EAAE,CAAC,CAAC,GAAG;YACX,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,MAAM,EAAE,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;SACvE,CAAC,CAAC;KACJ,CAAC;IACF,QAAQ,GAAG,GAAG,CAAC;IACf,MAAM,GAAG,GAAG,CAAC;IACb,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,aAAa,CAAC,OAAe;IAC3C,MAAM,GAAG,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACnC,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACnE,MAAM,GAAG,GAAG,OAAO,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;IACnC,IAAI,GAAG,KAAK,QAAQ,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,QAAQ,GAAG,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACrE,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;QACxB,IAAI,CAAC,CAAC,CAAC,MAAM,EAAE;YAAE,OAAO,IAAI,CAAC;QAC7B,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC;IACnD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,GAAG,CAAC,GAAW;IACtB,OAAO,QAAQ,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACtD,CAAC;AAED,SAAS,IAAI,CAAC,GAAW;IACvB,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,KAAK,MAAM,CAAC,IAAI,WAAW,CAAC,GAAG,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;QAC1D,MAAM,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;QAC5B,4EAA4E;QAC5E,mEAAmE;QACnE,IAAI,CAAC,CAAC,WAAW,EAAE;YAAE,GAAG,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;aACrC,IAAI,CAAC,CAAC,MAAM,EAAE;YAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACnC,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC"}

package/packages/host/dist/wincpu.d.ts

@@ -0,0 +1,13 @@
+export declare const WIN_CPU_STALE_MS = 15000;
+/** One line of the child's output → percent busy, or null. Accepts `12.5`; a
+ *  comma decimal, text, blank or an out-of-range value is null. Utility may
+ *  exceed 100 on a turbo-boosted core, so up to 200 is clamped, beyond is null. */
+export declare function parseCpuLine(line: string): number | null;
+/** Stop the child (shutdown). */
+export declare function stopWindowsCpu(): void;
+/** The newest Windows-wide reading, or null (not WSL, interop missing, child
+ *  dead, or reading stale). Starts the child lazily on first call. */
+export declare function windowsCpuNow(now?: number): {
+    pct: number;
+    at: number;
+} | null;

package/packages/host/dist/wincpu.js

@@ -0,0 +1,101 @@
+/**
+ * Windows-wide CPU for a host that runs inside WSL2.
+ *
+ * Inside the VM `/proc/stat` (and so `os.cpus()` and the load average) only
+ * describes the VM's own load; Task Manager shows the whole machine, so the
+ * phone read far LOWER than the desktop beside it. Here ONE long-running
+ * `powershell.exe` (WSL interop) prints the machine's utilisation every
+ * couple of seconds; we keep the newest line. No process is spawned per poll.
+ *
+ * It reads the WMI perf class (`Win32_PerfFormattedData_*`), whose class and
+ * property names are English on every locale — unlike `typeperf`'s counter
+ * paths, which are localised. `Processor Information` `PercentProcessorUtility`
+ * is what Task Manager's CPU graph uses; the older `PercentProcessorTime` is
+ * the fallback. A line that is not a number in range is DROPPED, and a reading
+ * older than STALE_MS is ABSENT: the caller then falls back to the VM's own
+ * figure and says so. Never a wrong number.
+ */
+import { spawn } from "node:child_process";
+import { isWsl } from "./ocrlocal.js";
+export const WIN_CPU_STALE_MS = 15_000;
+const RETRY_MS = 60_000;
+const INTERVAL_S = 2;
+/** One line of the child's output → percent busy, or null. Accepts `12.5`; a
+ *  comma decimal, text, blank or an out-of-range value is null. Utility may
+ *  exceed 100 on a turbo-boosted core, so up to 200 is clamped, beyond is null. */
+export function parseCpuLine(line) {
+    const s = line.trim();
+    if (!/^\d{1,3}(\.\d+)?$/.test(s))
+        return null;
+    const n = Number(s);
+    if (!Number.isFinite(n) || n < 0 || n > 200)
+        return null;
+    return Math.min(100, n);
+}
+const SCRIPT = [
+    "$ErrorActionPreference='SilentlyContinue';",
+    "$c=[cultureinfo]::InvariantCulture;",
+    "while($true){",
+    "$v=$null;",
+    "$u=Get-CimInstance Win32_PerfFormattedData_Counters_ProcessorInformation -Filter \"Name='_Total'\";",
+    "if($u -and $u.PercentProcessorUtility -ne $null){$v=$u.PercentProcessorUtility}",
+    "else{$p=Get-CimInstance Win32_PerfFormattedData_PerfOS_Processor -Filter \"Name='_Total'\";if($p){$v=$p.PercentProcessorTime}}",
+    "if($v -ne $null){[Console]::Out.WriteLine(([double]$v).ToString('0.0',$c))}",
+    `Start-Sleep -Seconds ${INTERVAL_S}}`,
+].join("");
+let latest = null;
+let child = null;
+let failedAt = 0;
+let wsl = null;
+const detectWsl = () => (wsl ??= process.platform === "linux" && isWsl());
+function start() {
+    try {
+        let buf = "";
+        const c = spawn("powershell.exe", ["-NoProfile", "-NonInteractive", "-Command", SCRIPT], {
+            stdio: ["ignore", "pipe", "ignore"], windowsHide: true,
+        });
+        child = c;
+        c.stdout.setEncoding("utf8");
+        c.stdout.on("data", (d) => {
+            buf += d;
+            let i;
+            while ((i = buf.indexOf("\n")) >= 0) {
+                const pct = parseCpuLine(buf.slice(0, i));
+                buf = buf.slice(i + 1);
+                if (pct !== null)
+                    latest = { pct, at: Date.now() };
+            }
+        });
+        const dead = () => { if (child === c) {
+            child = null;
+            failedAt = Date.now();
+        } };
+        c.on("error", dead);
+        c.on("exit", dead);
+    }
+    catch {
+        failedAt = Date.now();
+    }
+}
+/** Stop the child (shutdown). */
+export function stopWindowsCpu() {
+    const c = child;
+    child = null;
+    try {
+        c?.kill();
+    }
+    catch { /* already gone */ }
+}
+process.on("exit", stopWindowsCpu);
+/** The newest Windows-wide reading, or null (not WSL, interop missing, child
+ *  dead, or reading stale). Starts the child lazily on first call. */
+export function windowsCpuNow(now = Date.now()) {
+    if (!detectWsl())
+        return null;
+    if (!child && now - failedAt >= RETRY_MS)
+        start();
+    if (!latest || now - latest.at > WIN_CPU_STALE_MS)
+        return null;
+    return latest;
+}
+//# sourceMappingURL=wincpu.js.map

package/packages/host/dist/wincpu.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"wincpu.js","sourceRoot":"","sources":["../src/wincpu.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AACH,OAAO,EAAE,KAAK,EAAqB,MAAM,oBAAoB,CAAC;AAC9D,OAAO,EAAE,KAAK,EAAE,MAAM,eAAe,CAAC;AAEtC,MAAM,CAAC,MAAM,gBAAgB,GAAG,MAAM,CAAC;AACvC,MAAM,QAAQ,GAAG,MAAM,CAAC;AACxB,MAAM,UAAU,GAAG,CAAC,CAAC;AAErB;;mFAEmF;AACnF,MAAM,UAAU,YAAY,CAAC,IAAY;IACvC,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;IACtB,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAC9C,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;IACpB,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,GAAG;QAAE,OAAO,IAAI,CAAC;IACzD,OAAO,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;AAC1B,CAAC;AAED,MAAM,MAAM,GAAG;IACb,4CAA4C;IAC5C,qCAAqC;IACrC,eAAe;IACf,WAAW;IACX,qGAAqG;IACrG,iFAAiF;IACjF,gIAAgI;IAChI,6EAA6E;IAC7E,wBAAwB,UAAU,GAAG;CACtC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AAEX,IAAI,MAAM,GAAuC,IAAI,CAAC;AACtD,IAAI,KAAK,GAAwB,IAAI,CAAC;AACtC,IAAI,QAAQ,GAAG,CAAC,CAAC;AACjB,IAAI,GAAG,GAAmB,IAAI,CAAC;AAE/B,MAAM,SAAS,GAAG,GAAY,EAAE,CAAC,CAAC,GAAG,KAAK,OAAO,CAAC,QAAQ,KAAK,OAAO,IAAI,KAAK,EAAE,CAAC,CAAC;AAEnF,SAAS,KAAK;IACZ,IAAI,CAAC;QACH,IAAI,GAAG,GAAG,EAAE,CAAC;QACb,MAAM,CAAC,GAAG,KAAK,CAAC,gBAAgB,EAAE,CAAC,YAAY,EAAE,iBAAiB,EAAE,UAAU,EAAE,MAAM,CAAC,EAAE;YACvF,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,WAAW,EAAE,IAAI;SACvD,CAAC,CAAC;QACH,KAAK,GAAG,CAAC,CAAC;QACV,CAAC,CAAC,MAAO,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;QAC9B,CAAC,CAAC,MAAO,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,CAAS,EAAE,EAAE;YACjC,GAAG,IAAI,CAAC,CAAC;YACT,IAAI,CAAS,CAAC;YACd,OAAO,CAAC,CAAC,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;gBACpC,MAAM,GAAG,GAAG,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;gBAC1C,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;gBACvB,IAAI,GAAG,KAAK,IAAI;oBAAE,MAAM,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;YACrD,CAAC;QACH,CAAC,CAAC,CAAC;QACH,MAAM,IAAI,GAAG,GAAG,EAAE,GAAG,IAAI,KAAK,KAAK,CAAC,EAAE,CAAC;YAAC,KAAK,GAAG,IAAI,CAAC;YAAC,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAAC,CAAC,CAAC,CAAC,CAAC;QACjF,CAAC,CAAC,EAAE,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QACpB,CAAC,CAAC,EAAE,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IACrB,CAAC;IAAC,MAAM,CAAC;QACP,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACxB,CAAC;AACH,CAAC;AAED,iCAAiC;AACjC,MAAM,UAAU,cAAc;IAC5B,MAAM,CAAC,GAAG,KAAK,CAAC;IAChB,KAAK,GAAG,IAAI,CAAC;IACb,IAAI,CAAC;QAAC,CAAC,EAAE,IAAI,EAAE,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC,CAAC,kBAAkB,CAAC,CAAC;AACjD,CAAC;AAED,OAAO,CAAC,EAAE,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;AAEnC;sEACsE;AACtE,MAAM,UAAU,aAAa,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE;IAC5C,IAAI,CAAC,SAAS,EAAE;QAAE,OAAO,IAAI,CAAC;IAC9B,IAAI,CAAC,KAAK,IAAI,GAAG,GAAG,QAAQ,IAAI,QAAQ;QAAE,KAAK,EAAE,CAAC;IAClD,IAAI,CAAC,MAAM,IAAI,GAAG,GAAG,MAAM,CAAC,EAAE,GAAG,gBAAgB;QAAE,OAAO,IAAI,CAAC;IAC/D,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/packages/host/package.json

@@ -11,6 +11,7 @@
     "start": "node dist/main.js"
   },
   "dependencies": {
+    "@noble/curves": "2.4.0",
     "@waterplane/shared": "*",
     "@xterm/headless": "^5.5.0",
     "node-pty": "1.2.0-beta.15",
@@ -18,7 +19,7 @@
     "ws": "^8.22.0"
   },
   "devDependencies": {
-    "@types/node": "^22.10.0",
+    "@types/node": "^22.20.5",
     "@types/web-push": "^3.6.4",
     "@types/ws": "^8.18.2",
     "tsx": "^4.23.15"