config

type Cloudflare struct {
	// Token is the API token setup verified. Never logged, never echoed into
	// an error, never carried by any endpoint response — reads of this file
	// hand it to the Cloudflare API and nowhere else.
	Token string `json:"token"`
	// AccountID and AccountName are the account the relay was deployed into,
	// recorded so the UI can say where the relay lives and so an update needs
	// no account picker.
	AccountID   string `json:"account_id"`
	AccountName string `json:"account_name,omitempty"`
}

type Relay struct {
	// URL is the bare wss:// address of the relay — host only, no path. The
	// transport appends /daemon/<machine id> itself, so the file never holds a
	// path that could disagree with the id beside it.
	URL    string `json:"url"`
	Origin string `json:"origin"`

	// Secret is the relay's shared DAEMON_SECRET: the deploy set it on the
	// user's own Worker, and the daemon presents it on every dial. Never
	// logged, and the reason this file is 0600. It does ride argv exactly
	// once — `flue relay join --secret`, the hand-off line setup prints —
	// and that is deliberate: argv and the shell history that keeps it are
	// the accepted cost of moving the secret to the next machine
	// (docs/RELAY.md says so where the line is printed).
	Secret string `json:"secret,omitempty"`

	// FleetSeed is the fleet key's Ed25519 seed, unpadded base64url —
	// exactly the value `flue relay join --fleet` was given, minted by
	// `flue relay setup` alongside the secret (spec/fleet-trust.md and
	// internal/fleet own its meaning; this package only stores the string).
	// It is the one credential in this file the Worker never holds: the
	// secret's other copy lives on Cloudflare, the fleet key's copies live
	// only in the fleet's relay.json files and the join line that carried
	// it between them. Never logged, never sent anywhere, and the second
	// reason this file is 0600 — a leaked seed signs device certs every
	// machine in the fleet honours.
	//
	// It rides argv exactly once, beside the secret and for the same
	// reason: `flue relay join --fleet` is the deliberate hand-off. The
	// cost is the same shell history, and the consequence is larger, which
	// is why docs/RELAY.md states it where it teaches the line rather than
	// leaving it to be inferred from the secret's warning.
	FleetSeed string `json:"fleet_seed,omitempty"`

	// MachineCert is this machine's fleet machine certificate — the signed
	// blob internal/fleet produces over {id, name, this daemon's Noise
	// static public key, iat} — minted by whichever command wrote this file
	// (`flue relay setup`, `flue relay join`, the Remote screen's deploy) and
	// published to the relay's fleet directory by the daemon when it
	// connects. It is a public artifact: it is signed, not secret, and every
	// browser in the fleet reads it out of the directory to learn which Noise
	// key to pin for this machine (spec/fleet-trust.md).
	//
	// It is stored rather than minted at startup because the directory is
	// content-addressed: a cert re-minted on every boot would carry a fresh
	// `iat`, hash to a fresh key, and spend one of the directory's 512
	// entries per daemon restart. Stored, it is one entry forever.
	//
	// Empty means "this machine publishes no machine cert" — a relay.json
	// written before this field, or one whose fleet key could not sign. The
	// daemon says so once and carries on: a machine missing from the
	// directory is one browsers cannot auto-discover, not one that stops
	// working for the devices paired to it directly.
	MachineCert []byte `json:"machine_cert,omitempty"`

	// MachineID is the slot this machine holds on the relay: the <id> in the
	// /daemon/<id> leg the daemon dials and the /client/<id> URLs browsers
	// open. Minted by `flue relay setup` and `flue relay join` (MintMachineID),
	// never typed by hand — which is why it is a slug and the name below is
	// not.
	MachineID string `json:"machine_id"`
	// MachineName is the human label for this machine — free text, shown in
	// machine lists; it rides the pairing link's query (`n=`, so the pairing
	// browser can label the machine), never any path the relay routes on.
	MachineName string `json:"machine_name"`

	// Worker is the Cloudflare script name the relay was deployed under —
	// `flue relay setup --worker`, or the default. `flue relay update` reads
	// it back so a redeploy names the same script without re-deriving it from
	// the URL. Empty in files written by `flue relay join` (join deploys
	// nothing and does not know) and in files from before the field existed;
	// readers must treat empty as "derive or ask", never as a name.
	Worker string `json:"worker,omitempty"`
}