daemon

type ConnMeta struct {
	Peer     string // resolved peer identity, for the audit log
	Origin   string // absolute origin pairing URLs may be built from
	DeviceID string // paired device id; "" on the local transport

	// DeviceKey is the device's static public key — the thing the handshake
	// actually proved, and the identity every registry lookup that decides
	// something should be made against. Nil on the local transport, which
	// authenticates a machine-local session token rather than a device.
	//
	// It rides alongside DeviceID rather than replacing it because the two
	// answer different questions. The id is a 48-bit digest of these bytes and
	// is what the log lines, the Devices screen and the connection buckets
	// speak in; the bytes are what crypto.FindByKey compares, for the reason
	// that function spells out at length — Add deliberately permits two
	// devices with colliding digests, so an id alone can name more than one
	// key.
	DeviceKey []byte
}

type DirectoryCounts struct {
	Connected   bool `json:"connected"`
	Entries     int  `json:"entries"`
	Verified    int  `json:"verified"`
	Machines    int  `json:"machines"`
	Devices     int  `json:"devices"`
	Revocations int  `json:"revocations"`
}

type FleetPublisher interface {
	PublishFleetBlob(blob []byte)
}

type Identity struct {
	Key     noise.DHKey
	Devices *crypto.DeviceStore

	// Fleet is the fleet key from relay.json (spec/fleet-trust.md), and the
	// zero value means this daemon has none — a daemon that never joined a
	// relay, or joined one from before the key existed. With it, a pairing
	// ceremony also mints a fleet device cert and a revocation also mints
	// the signed record that keeps the key dead fleet-wide; without it,
	// both paths run exactly as they always did, minus the signing.
	Fleet fleet.Key
}

type MessageConn interface {
	// Read blocks until the next message arrives. The implementation is
	// responsible for bounding what it will accept: the WebSocket transport
	// sets readLimit on the socket at accept, and a relay's reader has to bound
	// its own frames, because nothing past this seam does.
	Read(ctx context.Context) (text bool, data []byte, err error)
	Write(ctx context.Context, text bool, data []byte) error
	// Close ends the stream. It must be safe to call more than once and
	// safe to call concurrently with Read/Write. It need not interrupt a Read
	// already in flight — cancel the connection's context for that.
	Close() error
}

type PairOutcome struct {
	Status int
	Body   []byte
}

type RelayUI interface {
	Status(ctx context.Context) RelayUIStatus
	Provision(ctx context.Context, req RelayUIDeployRequest) (RelayUIDeployResult, error)
	Update(ctx context.Context, req RelayUIDeployRequest) (RelayUIDeployResult, error)
	// JoinCommand rebuilds the hand-off line from relay.json; ok is false
	// when no relay is configured.
	JoinCommand(ctx context.Context) (cmd string, ok bool, err error)
	// SetAddress repoints relay.json at a new host for the same Worker — the
	// custom-domain move. It returns the new origin; the transport follows
	// on the next daemon start, which the result must say.
	SetAddress(ctx context.Context, address string) (RelayUIDeployResult, error)
}

type RelayUIAccount struct {
	ID   string `json:"id"`
	Name string `json:"name"`
}

type RelayUIDeployRequest struct {
	Token     string `json:"token"`
	AccountID string `json:"account_id,omitempty"`
	Worker    string `json:"worker,omitempty"`
}

type RelayUIDeployResult struct {
	NeedsAccount bool             `json:"needs_account,omitempty"`
	Accounts     []RelayUIAccount `json:"accounts,omitempty"`

	// Steps are the ✓ lines, in order — the same sentences the CLI prints.
	Steps  []string `json:"steps,omitempty"`
	Origin string   `json:"origin,omitempty"`
	// JoinCommand is the hand-off line for other machines, carrying both of
	// the credentials a machine needs to join: the daemon secret and the
	// fleet key's seed. Shown once, like the CLI's; it is not retrievable
	// from Status — RelayJoinPath rebuilds it, behind a click, for the same
	// reason.
	JoinCommand string `json:"join_command,omitempty"`
	// RestartNeeded is true when a relay transport was already running in
	// this daemon: the new relay.json takes effect on the next restart, and
	// the UI must say so instead of pretending.
	RestartNeeded bool `json:"restart_needed,omitempty"`
}

type RelayUIStatus struct {
	// Configured says relay.json exists and parsed.
	Configured bool   `json:"configured"`
	Origin     string `json:"origin,omitempty"`
	Worker     string `json:"worker,omitempty"`
	// Problems are the faults that stop this daemon dialling the relay.json
	// it has — the same list, in the same words, `flue status` and `flue
	// relay status` print. Empty for a healthy file and for a machine with
	// no relay at all.
	//
	// It exists because Configured answers a narrower question than the
	// screen is asking. A file that parses is configured; a file the
	// transport refuses is not *usable*; and reporting the first as though
	// it were the second is exactly how an upgrade that silently ended
	// remote access looked from every surface flue has — one stderr warning
	// at startup, and three status reports all saying it was fine.
	Problems []string `json:"problems,omitempty"`
	// CanDeploy is false in a dev build, which embeds no Worker; Reason is
	// the sentence the UI shows instead of a button.
	CanDeploy       bool   `json:"can_deploy"`
	CanDeployReason string `json:"can_deploy_reason,omitempty"`
	// Version is this binary's; DeployedVersion is what the relay serves.
	// Normally that is what its /api/health reported — empty when
	// unreachable or unstamped — except right after a deploy this daemon
	// performed, when it is the stamp the daemon shipped: the edge keeps
	// serving the previous Worker for a while after the API accepts a new
	// one, and a health read taken in that window would re-offer an update
	// that just succeeded. The UI offers an update when the two differ.
	Version         string `json:"version"`
	DeployedVersion string `json:"deployed_version,omitempty"`
	// HasToken says a Cloudflare token is stored (config/cloudflare.json), so
	// deploy and update need no token in the request; AccountName is the
	// account it deploys into. The token itself is never in any response.
	HasToken    bool   `json:"has_token"`
	AccountName string `json:"account_name,omitempty"`

	// Transport and TransportOrigin are the relay leg's live state, straight
	// from the daemon (SetRelayStatus) rather than from any config file. They
	// exist because the welcome's relay snapshot is per-connection: a tab
	// greeted while the daemon was still dialling never hears "connected" on
	// that socket, and polling this is how the Remote screen and the Pair
	// gate catch up without a reconnect. Filled by the handler, not the
	// service — the handler is the one on the Server that holds the state.
	Transport       string `json:"transport,omitempty"`
	TransportOrigin string `json:"transport_origin,omitempty"`

	// Directory is the fleet directory as this daemon last saw it, or nil on a
	// daemon that is not reading one (no relay, or a relay from before the
	// directory existed). It is the second half of the answer to "is my fleet
	// wired up": Transport says this machine can be *reached*, and this says
	// it can hear what the other machines have signed — which is what a
	// revocation travels on.
	Directory *DirectoryCounts `json:"directory,omitempty"`
}

type ReleaseChecker interface {
	// Release answers from cache and refreshes out of band. It must not block
	// on the network: this is behind a page load.
	Release(ctx context.Context) ReleaseStatus
}

type ReleaseStatus struct {
	// Current is this daemon's own version — "dev" for a source build.
	Current string `json:"current"`
	// Latest is the newest published release, without its leading v.
	Latest string `json:"latest,omitempty"`
	// URL is that release's page, for a reader who wants the notes.
	URL string `json:"url,omitempty"`
	// Update says Latest is genuinely newer than Current. A build ahead of
	// the newest tag — anything from main — is not behind, and neither is a
	// "dev" build, which corresponds to no release and so cannot be compared
	// to one.
	Update bool `json:"update"`
}

type Server struct {
	// contains filtered or unexported fields
}