@absolutejs/absolute 0.19.0-beta.1024 → 0.19.0-beta.1026

package/dist/angular/components/core/streamingSlotRegistrar.js

@@ -1,7 +1,7 @@
 // @bun
 var __require = import.meta.require;
 
-// .angular-partial-tmp-NzO1xY/src/core/streamingSlotRegistrar.ts
+// .angular-partial-tmp-aiDi6P/src/core/streamingSlotRegistrar.ts
 var STREAMING_SLOT_REGISTRAR_KEY = Symbol.for("absolutejs.streamingSlotRegistrar");
 var STREAMING_SLOT_WARNING_STORAGE_KEY = Symbol.for("absolutejs.streamingSlotWarningController");
 var STREAMING_SLOT_COLLECTION_STORAGE_KEY = Symbol.for("absolutejs.streamingSlotCollectionController");

package/dist/angular/components/core/streamingSlotRegistry.js

@@ -1,7 +1,7 @@
 // @bun
 var __require = import.meta.require;
 
-// .angular-partial-tmp-NzO1xY/src/core/streamingSlotRegistrar.ts
+// .angular-partial-tmp-aiDi6P/src/core/streamingSlotRegistrar.ts
 var STREAMING_SLOT_REGISTRAR_KEY = Symbol.for("absolutejs.streamingSlotRegistrar");
 var STREAMING_SLOT_WARNING_STORAGE_KEY = Symbol.for("absolutejs.streamingSlotWarningController");
 var STREAMING_SLOT_COLLECTION_STORAGE_KEY = Symbol.for("absolutejs.streamingSlotCollectionController");
@@ -48,7 +48,7 @@ var warnMissingStreamingSlotCollector = (primitiveName) => {
   getWarningController()?.maybeWarn(primitiveName);
 };
 
-// .angular-partial-tmp-NzO1xY/src/core/streamingSlotRegistry.ts
+// .angular-partial-tmp-aiDi6P/src/core/streamingSlotRegistry.ts
 var STREAMING_SLOT_STORAGE_KEY = Symbol.for("absolutejs.streamingSlotAsyncLocalStorage");
 var isObjectRecord2 = (value) => Boolean(value) && typeof value === "object";
 var isAsyncLocalStorage = (value) => isObjectRecord2(value) && ("getStore" in value) && typeof value.getStore === "function" && ("run" in value) && typeof value.run === "function";

package/dist/cli/index.js

@@ -55,6 +55,16 @@ var init_constants = __esm(() => {
   TWO_THIRDS = 2 / 3;
 });
 
+// src/dev/tunnel/protocol.ts
+var TUNNEL_CONTROL_PATH = "/__abs_tunnel/control", TUNNEL_FORWARDED_HOST_HEADER = "x-absolute-tunnel-host", decodeTunnelMessage = (raw) => {
+  try {
+    const parsed = JSON.parse(raw);
+    return parsed;
+  } catch {
+    return null;
+  }
+}, encodeTunnelMessage = (message) => JSON.stringify(message);
+
 // src/utils/getDurationString.ts
 var getDurationString = (duration) => {
   let durationString;
@@ -172658,14 +172668,337 @@ var init_typecheck = __esm(() => {
   ];
 });
 
+// src/dev/tunnel/relay.ts
+var DEFAULT_RELAY_PORT = 8787, DEFAULT_REQUEST_TIMEOUT_MS = 30000, headersToObject = (headers) => {
+  const out = {};
+  headers.forEach((value, key) => {
+    out[key] = value;
+  });
+  return out;
+}, startTunnelRelay = (options) => {
+  const port = options.port ?? (Number(process.env.PORT) || DEFAULT_RELAY_PORT);
+  const requestTimeoutMs = options.requestTimeoutMs ?? DEFAULT_REQUEST_TIMEOUT_MS;
+  let client = null;
+  const pending = new Map;
+  const publicSockets = new Map;
+  const resolvePublicUrl = (request) => {
+    if (options.publicUrl)
+      return options.publicUrl.replace(/\/$/, "");
+    const url = new URL(request.url);
+    const host = request.headers.get("x-forwarded-host") ?? url.host;
+    const proto = request.headers.get("x-forwarded-proto") ?? url.protocol.replace(":", "");
+    return `${proto}://${host}`;
+  };
+  const isWebSocketUpgrade = (request) => request.headers.get("upgrade")?.toLowerCase() === "websocket";
+  const server2 = Bun.serve({
+    port,
+    websocket: {
+      close(ws) {
+        if (ws.data.control) {
+          if (client === ws)
+            client = null;
+          return;
+        }
+        publicSockets.delete(ws.data.id);
+        client?.send(encodeTunnelMessage({ id: ws.data.id, type: "ws_close" }));
+      },
+      message(ws, raw) {
+        if (!ws.data.control) {
+          const binary = typeof raw !== "string";
+          const bytes = typeof raw === "string" ? Buffer.from(raw, "utf8") : Buffer.from(raw);
+          client?.send(encodeTunnelMessage({
+            binary,
+            dataBase64: bytes.toString("base64"),
+            id: ws.data.id,
+            type: "ws_data"
+          }));
+          return;
+        }
+        const message = decodeTunnelMessage(typeof raw === "string" ? raw : raw.toString());
+        if (!message)
+          return;
+        switch (message.type) {
+          case "ping":
+            ws.send(encodeTunnelMessage({ type: "pong" }));
+            break;
+          case "response":
+          case "error":
+            pending.get(message.id)?.(message);
+            break;
+          case "ws_open_ack":
+            if (!message.ok)
+              publicSockets.get(message.id)?.close();
+            break;
+          case "ws_data": {
+            const target = publicSockets.get(message.id);
+            const bytes = Buffer.from(message.dataBase64, "base64");
+            target?.send(message.binary ? bytes : bytes.toString("utf8"));
+            break;
+          }
+          case "ws_close":
+            publicSockets.get(message.id)?.close(message.code, message.reason);
+            publicSockets.delete(message.id);
+            break;
+          default:
+            break;
+        }
+      },
+      open(ws) {
+        if (ws.data.control) {
+          client = ws;
+          ws.send(encodeTunnelMessage({ publicUrl: options.publicUrl ?? "", type: "ready" }));
+          return;
+        }
+        publicSockets.set(ws.data.id, ws);
+        client?.send(encodeTunnelMessage({
+          headers: ws.data.headers,
+          id: ws.data.id,
+          type: "ws_open",
+          url: ws.data.url
+        }));
+      }
+    },
+    async fetch(request, srv) {
+      const url = new URL(request.url);
+      if (url.pathname === TUNNEL_CONTROL_PATH) {
+        if (url.searchParams.get("token") !== options.token) {
+          return new Response("Forbidden", { status: 403 });
+        }
+        const upgraded = srv.upgrade(request, { data: { control: true } });
+        return upgraded ? undefined : new Response("Upgrade failed", { status: 426 });
+      }
+      if (!client) {
+        return new Response("Tunnel offline: no dev client connected.", { status: 503 });
+      }
+      if (isWebSocketUpgrade(request)) {
+        const id2 = crypto.randomUUID();
+        const upgraded = srv.upgrade(request, {
+          data: {
+            control: false,
+            headers: headersToObject(request.headers),
+            id: id2,
+            url: url.pathname + url.search
+          }
+        });
+        return upgraded ? undefined : new Response("Upgrade failed", { status: 426 });
+      }
+      const id = crypto.randomUUID();
+      const bodyBytes = ["GET", "HEAD"].includes(request.method) ? null : new Uint8Array(await request.arrayBuffer());
+      const headers = headersToObject(request.headers);
+      headers[TUNNEL_FORWARDED_HOST_HEADER] = resolvePublicUrl(request);
+      const message = {
+        headers,
+        id,
+        method: request.method,
+        type: "request",
+        url: url.pathname + url.search,
+        ...bodyBytes && bodyBytes.length > 0 ? { bodyBase64: Buffer.from(bodyBytes).toString("base64") } : {}
+      };
+      const responsePromise = new Promise((resolve14) => {
+        pending.set(id, resolve14);
+      });
+      client.send(encodeTunnelMessage(message));
+      const timeout = new Promise((resolve14) => setTimeout(() => resolve14({ id, message: "timeout", type: "error" }), requestTimeoutMs));
+      const result = await Promise.race([responsePromise, timeout]);
+      pending.delete(id);
+      if (result.type === "error") {
+        return new Response(`Tunnel error: ${result.message}`, { status: 504 });
+      }
+      if (result.type !== "response") {
+        return new Response("Tunnel protocol error", { status: 502 });
+      }
+      return new Response(result.bodyBase64 ? Buffer.from(result.bodyBase64, "base64") : null, { headers: result.headers, status: result.status });
+    }
+  });
+  console.info(`[tunnel-relay] listening on :${server2.port} (control ${TUNNEL_CONTROL_PATH})`);
+  return server2;
+};
+var init_relay = () => {};
+
+// src/cli/scripts/tunnelRelay.ts
+var exports_tunnelRelay = {};
+__export(exports_tunnelRelay, {
+  tunnelRelay: () => tunnelRelay
+});
+var tunnelRelay = () => {
+  const token = process.env.ABSOLUTE_TUNNEL_TOKEN;
+  if (!token) {
+    console.error("[tunnel-relay] ABSOLUTE_TUNNEL_TOKEN is required.");
+    process.exit(1);
+  }
+  startTunnelRelay({
+    port: Number(process.env.PORT) || undefined,
+    publicUrl: process.env.ABSOLUTE_TUNNEL_PUBLIC_URL,
+    token
+  });
+};
+var init_tunnelRelay = __esm(() => {
+  init_relay();
+});
+
 // src/cli/scripts/dev.ts
 init_constants();
-init_startupBanner();
 var {$: $2, env } = globalThis.Bun;
 import { spawn as nodeSpawn } from "child_process";
 import { createWriteStream, existsSync as existsSync5, readFileSync as readFileSync7 } from "fs";
 import { resolve as resolve3 } from "path";
 
+// src/dev/tunnel/client.ts
+var RECONNECT_DELAY_MS = 2000;
+var controlSocketUrl = (relayUrl, token) => {
+  const url = new URL(relayUrl);
+  url.protocol = url.protocol === "https:" ? "wss:" : "ws:";
+  url.pathname = TUNNEL_CONTROL_PATH;
+  url.search = `?token=${encodeURIComponent(token)}`;
+  return url.toString();
+};
+var STRIPPED_REQUEST_HEADERS = new Set(["host", "connection", "content-length", TUNNEL_FORWARDED_HOST_HEADER]);
+var startTunnelClient = (options) => {
+  const publicUrl = options.relayUrl.replace(/\/$/, "");
+  const localWsOrigin = options.localOrigin.replace(/^http/, "ws");
+  let socket = null;
+  let closed = false;
+  let reconnectTimer = null;
+  const localSockets = new Map;
+  const sendFrameToRelay = (id, data, binary) => {
+    const bytes = typeof data === "string" ? Buffer.from(data, "utf8") : data;
+    const message = {
+      binary,
+      dataBase64: bytes.toString("base64"),
+      id,
+      type: "ws_data"
+    };
+    socket?.send(encodeTunnelMessage(message));
+  };
+  const openLocalWs = (id, url) => {
+    const local = new WebSocket(`${localWsOrigin}${url}`);
+    local.binaryType = "arraybuffer";
+    const entry = { pending: [], ready: false, ws: local };
+    localSockets.set(id, entry);
+    local.addEventListener("open", () => {
+      entry.ready = true;
+      socket?.send(encodeTunnelMessage({ id, ok: true, type: "ws_open_ack" }));
+      for (const frame of entry.pending) {
+        local.send(frame.binary ? frame.bytes : frame.bytes.toString("utf8"));
+      }
+      entry.pending = [];
+    });
+    local.addEventListener("message", (event) => {
+      if (typeof event.data === "string") {
+        sendFrameToRelay(id, event.data, false);
+      } else if (event.data instanceof ArrayBuffer) {
+        sendFrameToRelay(id, Buffer.from(event.data), true);
+      }
+    });
+    local.addEventListener("close", (event) => {
+      localSockets.delete(id);
+      socket?.send(encodeTunnelMessage({ code: event.code, id, type: "ws_close" }));
+    });
+    local.addEventListener("error", () => {
+      if (!entry.ready) {
+        socket?.send(encodeTunnelMessage({ error: "local ws failed", id, ok: false, type: "ws_open_ack" }));
+      }
+    });
+  };
+  const forwardFrameToLocal = (message) => {
+    const entry = localSockets.get(message.id);
+    if (!entry)
+      return;
+    const bytes = Buffer.from(message.dataBase64, "base64");
+    if (!entry.ready) {
+      entry.pending.push({ binary: message.binary, bytes });
+      return;
+    }
+    entry.ws.send(message.binary ? bytes : bytes.toString("utf8"));
+  };
+  const handleRequest = async (message) => {
+    const headers = {};
+    for (const [key, value] of Object.entries(message.headers)) {
+      if (!STRIPPED_REQUEST_HEADERS.has(key.toLowerCase()))
+        headers[key] = value;
+    }
+    try {
+      const response = await fetch(`${options.localOrigin}${message.url}`, {
+        body: message.bodyBase64 ? Buffer.from(message.bodyBase64, "base64") : undefined,
+        headers,
+        method: message.method,
+        redirect: "manual"
+      });
+      const bodyBytes = new Uint8Array(await response.arrayBuffer());
+      const responseHeaders = {};
+      response.headers.forEach((value, key) => {
+        responseHeaders[key] = value;
+      });
+      const reply = {
+        headers: responseHeaders,
+        id: message.id,
+        status: response.status,
+        type: "response",
+        ...bodyBytes.length > 0 ? { bodyBase64: Buffer.from(bodyBytes).toString("base64") } : {}
+      };
+      socket?.send(encodeTunnelMessage(reply));
+    } catch (error) {
+      socket?.send(encodeTunnelMessage({
+        id: message.id,
+        message: error instanceof Error ? error.message : String(error),
+        type: "error"
+      }));
+    }
+  };
+  const connect = () => {
+    if (closed)
+      return;
+    socket = new WebSocket(controlSocketUrl(options.relayUrl, options.token));
+    socket.addEventListener("message", (event) => {
+      const message = decodeTunnelMessage(String(event.data));
+      if (!message)
+        return;
+      switch (message.type) {
+        case "request":
+          handleRequest(message);
+          break;
+        case "ready":
+          options.onReady?.(publicUrl);
+          break;
+        case "ping":
+          socket?.send(encodeTunnelMessage({ type: "pong" }));
+          break;
+        case "ws_open":
+          openLocalWs(message.id, message.url);
+          break;
+        case "ws_data":
+          forwardFrameToLocal(message);
+          break;
+        case "ws_close":
+          localSockets.get(message.id)?.ws.close();
+          localSockets.delete(message.id);
+          break;
+        default:
+          break;
+      }
+    });
+    socket.addEventListener("close", () => {
+      if (closed)
+        return;
+      reconnectTimer = setTimeout(connect, RECONNECT_DELAY_MS);
+    });
+    socket.addEventListener("error", () => {});
+  };
+  connect();
+  return {
+    publicUrl,
+    close() {
+      closed = true;
+      if (reconnectTimer)
+        clearTimeout(reconnectTimer);
+      socket?.close();
+    }
+  };
+};
+
+// src/cli/scripts/dev.ts
+init_startupBanner();
+
 // src/cli/interactive.ts
 init_constants();
 import { openSync } from "fs";
@@ -173037,13 +173370,18 @@ var setupHttpsCert = async () => {
   }
   await setupCertWithPrompt(ensureDevCert2, setupMkcert2);
 };
-var resolveDevConfig = (configDev) => ({
-  port: Number(env.ABSOLUTE_PORT) || Number(env.PORT) || configDev?.port || DEFAULT_PORT,
-  portRange: Number(env.ABSOLUTE_PORT_RANGE) || configDev?.portRange || DEFAULT_PORT_RANGE,
-  strictPort: env.ABSOLUTE_STRICT_PORT === "true" || configDev?.strictPort === true,
-  host: env.ABSOLUTE_HOST ?? configDev?.host ?? "localhost",
-  https: env.ABSOLUTE_HTTPS === "true" || configDev?.https === true
-});
+var resolveDevConfig = (configDev) => {
+  const relay = env.ABSOLUTE_TUNNEL_RELAY ?? configDev?.tunnel?.relay;
+  const token = env.ABSOLUTE_TUNNEL_TOKEN ?? configDev?.tunnel?.token;
+  return {
+    host: env.ABSOLUTE_HOST ?? configDev?.host ?? "localhost",
+    https: env.ABSOLUTE_HTTPS === "true" || configDev?.https === true,
+    port: Number(env.ABSOLUTE_PORT) || Number(env.PORT) || configDev?.port || DEFAULT_PORT,
+    portRange: Number(env.ABSOLUTE_PORT_RANGE) || configDev?.portRange || DEFAULT_PORT_RANGE,
+    strictPort: env.ABSOLUTE_STRICT_PORT === "true" || configDev?.strictPort === true,
+    ...relay && token ? { tunnel: { relay, token } } : {}
+  };
+};
 var dev = async (serverEntry, configPath2) => {
   let httpsEnabled = false;
   let resolvedDev;
@@ -173078,7 +173416,7 @@ var dev = async (serverEntry, configPath2) => {
     console.error(cliTag("\x1B[31m", String(err.message ?? err)));
     process.exit(1);
   });
-  let port = initialPortProbe.port;
+  let { port } = initialPortProbe;
   if (initialPortProbe.fellBack) {
     const displayHost = resolvedDev.host === "0.0.0.0" ? "localhost" : resolvedDev.host;
     console.log(cliTag("\x1B[33m", `Port ${resolvedDev.port} is in use, trying another one... \u2192 http://${displayHost}:${port}/`));
@@ -173123,11 +173461,24 @@ var dev = async (serverEntry, configPath2) => {
   let cleaning = false;
   let interactive = null;
   let serverReady = false;
+  let tunnelClient = null;
+  const startTunnelIfConfigured = () => {
+    if (tunnelClient || !resolvedDev.tunnel)
+      return;
+    tunnelClient = startTunnelClient({
+      localOrigin: `http://localhost:${port}`,
+      relayUrl: resolvedDev.tunnel.relay,
+      token: resolvedDev.tunnel.token,
+      onReady: (publicUrl) => process.stdout.write(`  \x1B[32m\u279C\x1B[0m  \x1B[1mPublic:\x1B[0m  ${publicUrl}/
+`)
+    });
+  };
   const checkServerReady = (value) => {
     const chunk = value.toString();
     if (!chunk.includes("Local:"))
       return;
     serverReady = true;
+    startTunnelIfConfigured();
     interactive?.showPrompt();
   };
   const RESTART_MARKER = "[abs:restart]";
@@ -173391,6 +173742,7 @@ var dev = async (serverEntry, configPath2) => {
     });
     if (interactive)
       interactive.dispose();
+    tunnelClient?.close();
     if (paused)
       sendSignal("SIGCONT");
     killChildTree("SIGTERM");
@@ -175905,6 +176257,10 @@ if (command === "dev") {
   sendTelemetryEvent("cli:command", { command });
   const { setupMkcert: setupMkcert2 } = await Promise.resolve().then(() => (init_devCert(), exports_devCert));
   setupMkcert2();
+} else if (command === "tunnel-relay") {
+  sendTelemetryEvent("cli:command", { command });
+  const { tunnelRelay: tunnelRelay2 } = await Promise.resolve().then(() => (init_tunnelRelay(), exports_tunnelRelay));
+  tunnelRelay2();
 } else {
   const message = command ? `Unknown command: ${command}` : "No command specified";
   console.error(message);
@@ -175922,5 +176278,6 @@ if (command === "dev") {
   console.error("  prettier      Run Prettier check (cached)");
   console.error("  typecheck     Run type checkers for all frameworks");
   console.error("  telemetry     Manage anonymous telemetry");
+  console.error("  tunnel-relay  Run the public reverse-tunnel relay (for webhook dev)");
   process.exit(1);
 }

package/dist/src/cli/scripts/tunnelRelay.d.ts

@@ -0,0 +1,9 @@
+/**
+ * `absolute tunnel-relay` — run the public reverse-tunnel relay (typically on a
+ * small always-on host like a DO App Platform service). Dev machines connect to
+ * it with `dev: { tunnel: { relay, token } }`. Reads:
+ *   - PORT (App Platform injects this; default 8787)
+ *   - ABSOLUTE_TUNNEL_TOKEN (required shared secret)
+ *   - ABSOLUTE_TUNNEL_PUBLIC_URL (optional; the relay's public base URL)
+ */
+export declare const tunnelRelay: () => void;

package/dist/src/dev/tunnel/client.d.ts

@@ -0,0 +1,20 @@
+type TunnelClientOptions = {
+    /** Public relay base URL, e.g. `https://my-relay.ondigitalocean.app`. */
+    relayUrl: string;
+    /** Shared secret matching the relay's token. */
+    token: string;
+    /** Local app origin to replay requests against, e.g. `http://localhost:3000`. */
+    localOrigin: string;
+    /** Called once the relay confirms the public URL is live. */
+    onReady?: (publicUrl: string) => void;
+};
+/**
+ * Start the dev-side tunnel client. Dials the relay's control socket and
+ * replays each forwarded request against the local app, streaming responses
+ * back. Auto-reconnects so an HMR restart or a relay blip self-heals.
+ */
+export declare const startTunnelClient: (options: TunnelClientOptions) => {
+    publicUrl: string;
+    close(): void;
+};
+export {};

package/dist/src/dev/tunnel/protocol.d.ts

@@ -0,0 +1,85 @@
+/**
+ * Reverse-tunnel wire protocol (pure Bun, no third-party deps).
+ *
+ * A dev machine behind NAT cannot accept inbound connections, so the dev
+ * `client` dials OUT to a public `relay` over a single control WebSocket. The
+ * relay receives public HTTP requests and forwards each one down that socket;
+ * the client replays it against the local app and sends the response back.
+ *
+ * Stage 1 covers HTTP request/response (webhooks). WebSocket passthrough for
+ * telephony media streams is layered on later with additional message types.
+ */
+/** Control-channel path the client connects to on the relay. */
+export declare const TUNNEL_CONTROL_PATH = "/__abs_tunnel/control";
+/** Header the relay strips/sets; lets the app know its public origin. */
+export declare const TUNNEL_FORWARDED_HOST_HEADER = "x-absolute-tunnel-host";
+/** A forwarded HTTP request (relay → client). Body is base64 (binary-safe). */
+export type TunnelRequestMessage = {
+    type: 'request';
+    id: string;
+    method: string;
+    /** Path + query, e.g. `/v1/sms/intake?x=1`. */
+    url: string;
+    headers: Record<string, string>;
+    bodyBase64?: string;
+};
+/** The client's response to a forwarded request (client → relay). */
+export type TunnelResponseMessage = {
+    type: 'response';
+    id: string;
+    status: number;
+    headers: Record<string, string>;
+    bodyBase64?: string;
+};
+/** Client could not produce a response (local app down, fetch threw). */
+export type TunnelErrorMessage = {
+    type: 'error';
+    id: string;
+    message: string;
+};
+/** Sent by the relay right after a successful auth handshake. */
+export type TunnelReadyMessage = {
+    type: 'ready';
+    /** Public base URL the relay is reachable at, e.g. `https://x.app`. */
+    publicUrl: string;
+};
+/** A public WS connection opened; client should dial the local app (relay → client). */
+export type TunnelWsOpenMessage = {
+    type: 'ws_open';
+    id: string;
+    /** Path + query of the upgraded request. */
+    url: string;
+    headers: Record<string, string>;
+};
+/** Result of the client opening the local WS (client → relay). */
+export type TunnelWsOpenAckMessage = {
+    type: 'ws_open_ack';
+    id: string;
+    ok: boolean;
+    error?: string;
+};
+/** One WS frame, either direction. Binary frames are base64. */
+export type TunnelWsDataMessage = {
+    type: 'ws_data';
+    id: string;
+    dataBase64: string;
+    binary: boolean;
+};
+/** A WS closed, either direction. */
+export type TunnelWsCloseMessage = {
+    type: 'ws_close';
+    id: string;
+    code?: number;
+    reason?: string;
+};
+/** App-level keepalive (either direction). */
+export type TunnelPingMessage = {
+    type: 'ping';
+};
+export type TunnelPongMessage = {
+    type: 'pong';
+};
+export type TunnelClientMessage = TunnelResponseMessage | TunnelErrorMessage | TunnelWsOpenAckMessage | TunnelWsDataMessage | TunnelWsCloseMessage | TunnelPongMessage | TunnelPingMessage;
+export type TunnelServerMessage = TunnelRequestMessage | TunnelReadyMessage | TunnelWsOpenMessage | TunnelWsDataMessage | TunnelWsCloseMessage | TunnelPingMessage | TunnelPongMessage;
+export declare const decodeTunnelMessage: (raw: string) => TunnelRequestMessage | TunnelResponseMessage | TunnelErrorMessage | TunnelReadyMessage | TunnelWsOpenMessage | TunnelWsOpenAckMessage | TunnelWsDataMessage | TunnelWsCloseMessage | TunnelPingMessage | TunnelPongMessage | null;
+export declare const encodeTunnelMessage: (message: TunnelClientMessage | TunnelServerMessage) => string;

package/dist/src/dev/tunnel/relay.d.ts

@@ -0,0 +1,28 @@
+type RelayOptions = {
+    /** Port the relay listens on (App Platform injects PORT). */
+    port?: number;
+    /** Shared secret the dev client must present (?token=). */
+    token: string;
+    /** Public base URL the relay is reachable at. Falls back to the request
+     *  origin when omitted (App Platform: set APP_URL or pass explicitly). */
+    publicUrl?: string;
+    /** How long to wait for the dev client to answer a forwarded request. */
+    requestTimeoutMs?: number;
+};
+type ControlSocketData = {
+    control: true;
+};
+type PublicSocketData = {
+    control: false;
+    id: string;
+    url: string;
+    headers: Record<string, string>;
+};
+type SocketData = ControlSocketData | PublicSocketData;
+/**
+ * Start the public reverse-tunnel relay. Holds one dev-client control socket
+ * and forwards every other inbound HTTP request — and public WebSocket — down
+ * it. Single-tenant: the shared `token` gates the control channel.
+ */
+export declare const startTunnelRelay: (options: RelayOptions) => Bun.Server<SocketData>;
+export {};

package/dist/src/utils/loadConfig.d.ts

@@ -35,6 +35,10 @@ export declare const loadConfig: (configPath?: string) => Promise<{
         host?: string;
         https?: boolean;
         watchDirs?: string[];
+        tunnel?: {
+            relay?: string;
+            token?: string;
+        };
         devtools?: {
             projectRoot?: string;
             uuid?: string;

package/dist/types/build.d.ts

@@ -183,6 +183,17 @@ export type BaseBuildConfig = {
          *  conventional source dirs (`src/`, `db/`, `assets/`, `styles/`),
          *  and these `watchDirs` is implicitly ignored. */
         watchDirs?: string[];
+        /** Expose the dev server to the public internet through a self-hosted
+         *  AbsoluteJS reverse-tunnel relay (for webhooks: Twilio, Stripe, OAuth).
+         *  Run the relay with `absolute tunnel-relay` on a public host; point a
+         *  dev client at it here. Prints a `Public:` URL on start. */
+        tunnel?: {
+            /** Relay base URL, e.g. `https://my-relay.ondigitalocean.app`
+             *  (env: ABSOLUTE_TUNNEL_RELAY). */
+            relay?: string;
+            /** Shared secret matching the relay's token (env: ABSOLUTE_TUNNEL_TOKEN). */
+            token?: string;
+        };
         devtools?: {
             projectRoot?: string;
             uuid?: string;

package/package.json

@@ -269,8 +269,7 @@
 		"svelte": "^5.35.2",
 		"tailwindcss": "^4.1.0",
 		"typescript": "^5.9.3",
-		"vue": "^3.5.27",
-		"zone.js": "^0.15.0"
+		"vue": "^3.5.27"
 	},
 	"peerDependenciesMeta": {
 		"@angular/animations": {
@@ -338,9 +337,6 @@
 		},
 		"vue": {
 			"optional": true
-		},
-		"zone.js": {
-			"optional": true
 		}
 	},
 	"repository": {
@@ -409,5 +405,5 @@
 			]
 		}
 	},
-	"version": "0.19.0-beta.1024"
+	"version": "0.19.0-beta.1026"
 }