Decompose architecture into 35 atomic tasks across 10 generations for implementation

tasks/napi/connect-function.md

@@ -0,0 +1,47 @@
+---
+id: napi/connect-function
+name: Implement NAPI connect() — single SSH channel as Duplex stream
+status: pending
+depends_on:
+  - napi/project-setup
+  - client/channel-manager
+scope: moderate
+risk: high
+impact: component
+level: implementation
+---
+
+## Description
+
+Implement the NAPI `connect()` function per ADR-007. This is fundamentally different from CLI `wraith connect`:
+
+- **NAPI `connect()`**: Opens a single SSH channel and returns it as a Node.js `Duplex` stream. No SOCKS5 server, no port forwarding. The caller reads and writes bytes directly.
+- **CLI `wraith connect`**: Full SSH client session with SOCKS5 server and port forwarding.
+
+The function accepts `WraithConnectOptions` and returns `Promise<Duplex>`. The NAPI layer handles transport selection, SSH authentication, and channel setup, then hands the caller a stream.
+
+## Acceptance Criteria
+
+- [ ] `#[napi]` function `connect(options: WraithConnectOptions) -> Result<DuplexStream>` in `crates/wraith-napi/src/connect.rs`
+- [ ] `WraithConnectOptions` struct with napi fields: `server`, `peer`, `transport`, `identity`, `tlsServerName`, `insecure`, `irohRelay`, `proxy`
+- [ ] Transport creation from options (tcp, tls, iroh) — same logic as CLI but programmatic
+- [ ] SSH client connection: create transport stream, authenticate, open single `direct_tcpip` channel
+- [ ] Channel returned as `napi::DuplexStream` for JavaScript consumption
+- [ ] Key material: `identity` field accepts file path (string) or `Buffer` (in-memory data) per ADR-011
+- [ ] Error marshalling: Rust errors become JavaScript exceptions with descriptive messages
+- [ ] TypeScript type: `(options: WraithConnectOptions) => Promise<Duplex>`
+- [ ] Integration test from JS: connect to a test server, write/receive bytes through stream
+
+## References
+
+- docs/architecture/napi-and-pubsub.md — NAPI connect() spec, TypeScript interfaces
+- docs/architecture/decisions/007-napi-single-stream.md — single duplex stream rationale
+- docs/architecture/decisions/016-napi-expose-connect-and-serve.md — both connect() and serve()
+
+## Notes
+
+> To be filled by implementation agent
+
+## Summary
+
+> To be filled on completion

tasks/napi/project-setup.md

@@ -0,0 +1,45 @@
+---
+id: napi/project-setup
+name: Set up wraith-napi project with napi-rs build tooling and TypeScript types
+status: pending
+depends_on:
+  - setup/project-init
+scope: moderate
+risk: low
+impact: component
+level: implementation
+---
+
+## Description
+
+Set up the napi-rs project for the `@alkdev/wraith` Node.js native addon. This includes the napi-rs build configuration, TypeScript type definitions, and the package structure.
+
+Per ADR-015 and ADR-016: napi-rs is the FFI bridge, and the wrapper exposes `connect()` and `serve()` functions. The NAPI layer is transport-agnostic — it doesn't know about pubsub's `EventEnvelope`.
+
+The Cargo.toml skeleton was created in setup/project-init. This task configures the actual napi-rs build pipeline, TypeScript types, and verifies the build works.
+
+## Acceptance Criteria
+
+- [ ] `crates/wraith-napi/` has `Cargo.toml` with `crate-type = ["cdylib"]`, `napi` and `napi-derive` dependencies
+- [ ] `crates/wraith-napi/src/lib.rs` with napi module registration
+- [ ] `packages/wraith-napi/` directory (or similar) with `package.json` named `@alkdev/wraith`
+- [ ] `packages/wraith-napi/tsconfig.json` for TypeScript type generation
+- [ ] TypeScript type definitions for `WraithConnectOptions`, `WraithServeOptions`, `WraithServer`, `ConnectionInfo` matching napi-and-pubsub.md interfaces
+- [ ] `napi.config.js` or `NapiRs.config` with correct cargo path, module name
+- [ ] Build command: `npm run build` builds the native addon
+- [ ] Feature flags: `iroh` feature optional; base package includes tcp + tls
+- [ ] `npm install` and initial build succeed
+
+## References
+
+- docs/architecture/napi-and-pubsub.md — NAPI Wrapper section, TypeScript interfaces
+- docs/architecture/decisions/015-napi-rs-for-ffi-bridge.md — napi-rs choice
+- docs/architecture/decisions/016-napi-expose-connect-and-serve.md — both connect() and serve()
+
+## Notes
+
+> To be filled by implementation agent
+
+## Summary
+
+> To be filled on completion

tasks/napi/serve-function.md

@@ -0,0 +1,45 @@
+---
+id: napi/serve-function
+name: Implement NAPI serve() — server with connection events returning Duplex streams
+status: pending
+depends_on:
+  - napi/project-setup
+  - server/serve-loop
+scope: moderate
+risk: high
+impact: component
+level: implementation
+---
+
+## Description
+
+Implement the NAPI `serve()` function per ADR-016. Returns a `WraithServer` object with a `close()` method and `onConnection` event emitter. Each incoming SSH connection produces a `Duplex` stream.
+
+The function accepts `WraithServeOptions` and returns `Promise<WraithServer>`. The NAPI layer handles transport binding, SSH server setup, and connection handling.
+
+## Acceptance Criteria
+
+- [ ] `#[napi]` function `serve(options: WraithServeOptions) -> Result<WraithServer>` in `crates/wraith-napi/src/serve.rs`
+- [ ] `WraithServeOptions` struct with napi fields: `transport`, `hostKey`, `authorizedKeys`, `certAuthority`, `tlsCert`, `tlsKey`, `acmeDomain`, `listen`, `irohRelay`
+- [ ] `WraithServer` napi class with `close() -> Promise<void>` and `onConnection(callback)` event registration
+- [ ] Each incoming connection produces a `Duplex` stream via the `onConnection` callback
+- [ ] `ConnectionInfo` struct passed with each connection: `remoteAddr`, `transportKind`
+- [ ] Key material: `hostKey`, `authorizedKeys` accept file path (string) or `Buffer` (in-memory)
+- [ ] Server starts transport acceptor, authenticates connections, emits stream events
+- [ ] `close()` triggers graceful shutdown
+- [ ] TypeScript type matches napi-and-pubsub.md spec
+- [ ] Integration test: JS serve() + connect() round-trip works
+
+## References
+
+- docs/architecture/napi-and-pubsub.md — NAPI serve() spec, WraithServer interface
+- docs/architecture/decisions/016-napi-expose-connect-and-serve.md — both connect() and serve()
+- docs/architecture/server.md — server configuration
+
+## Notes
+
+> To be filled by implementation agent
+
+## Summary
+
+> To be filled on completion