@agimon-ai/doompi-core 0.0.1-alpha.100

package/dist/src/services/tunnelOutput/index.mjs

@@ -0,0 +1,54 @@
+//#region src/services/tunnelOutput/index.ts
+/**
+* A trycloudflare hostname, and nothing that merely ends near one.
+*
+* The trailing lookahead is the whole point. Without it,
+* `https://evil.trycloudflare.com.attacker.tld` printed by a confused or
+* hostile process would match, and the extracted value becomes the origin the
+* guard then trusts for every subsequent request.
+*/
+const QUICK_TUNNEL_URL = /https:\/\/[a-z0-9][a-z0-9-]*(?:\.[a-z0-9-]+)*\.trycloudflare\.com(?![a-z0-9.-])/iu;
+/** Cloudflare reports a connection registered; readiness waits for this as well as a URL. */
+const CONNECTION_READY = /registered tunnel connection|connection .* registered/iu;
+function tunnelTarget(port) {
+	return `http://127.0.0.1:${String(port)}`;
+}
+/**
+* The cloudflared argument vector.
+*
+* `--url` is a flag on the `tunnel` command rather than on `run`, so it comes
+* before the subcommand in both shapes. `--token-file` belongs to `run`.
+*
+* Flag placement here follows cloudflared's documented usage and local help.
+*/
+function tunnelArgs(config, port, tokenFile) {
+	const args = ["tunnel", "--no-autoupdate"];
+	if (config.kind === "named" && config.configFile !== void 0) args.push("--config", config.configFile);
+	args.push("--url", tunnelTarget(port));
+	if (config.kind === "quick") return args;
+	args.push("run");
+	if (tokenFile !== void 0 && tokenFile !== "") args.push("--token-file", tokenFile);
+	if (config.name !== void 0) args.push(config.name);
+	return args;
+}
+/** The public origin a quick tunnel announced, or undefined if this output does not carry one. */
+function extractTunnelUrl(text) {
+	return QUICK_TUNNEL_URL.exec(text)?.[0].toLowerCase();
+}
+function mentionsRegisteredConnection(text) {
+	return CONNECTION_READY.test(text);
+}
+/** Operator-facing copy for a failure, with the cause appended by the caller. */
+function describeTunnelFailure(failure) {
+	switch (failure) {
+		case "not_installed": return "cloudflared is not installed. Install it (brew install cloudflared) or set DOOMPI_CLOUDFLARED.";
+		case "spawn_failed": return "cloudflared could not be started.";
+		case "timeout": return "cloudflared did not report a public URL in time.";
+		case "self_test_failed": return "The tunnel came up unguarded and was closed immediately.";
+		case "exited": return "cloudflared stopped on its own.";
+	}
+}
+//#endregion
+export { describeTunnelFailure, extractTunnelUrl, mentionsRegisteredConnection, tunnelArgs, tunnelTarget };
+
+//# sourceMappingURL=index.mjs.map

package/dist/src/services/tunnelOutput/index.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.mjs","names":[],"sources":["../../../../src/services/tunnelOutput/index.ts"],"sourcesContent":["/**\n * Turning a tunnel configuration into a command line, and cloudflared's output\n * back into a public origin.\n *\n * The parsing half only exists for quick tunnels. A named tunnel is configured\n * with its hostname, so nothing has to be scraped and the origin is known\n * before the process starts. That difference is the strongest practical\n * argument for named mode: the banner cloudflared prints is an undocumented\n * detail of its logging, and a release that reformats it breaks quick mode\n * until the readiness deadline fires.\n */\n\nimport type { TunnelConfig, TunnelFailure } from '../../types/remote';\n\n/**\n * A trycloudflare hostname, and nothing that merely ends near one.\n *\n * The trailing lookahead is the whole point. Without it,\n * `https://evil.trycloudflare.com.attacker.tld` printed by a confused or\n * hostile process would match, and the extracted value becomes the origin the\n * guard then trusts for every subsequent request.\n */\nconst QUICK_TUNNEL_URL = /https:\\/\\/[a-z0-9][a-z0-9-]*(?:\\.[a-z0-9-]+)*\\.trycloudflare\\.com(?![a-z0-9.-])/iu;\n\n/** Cloudflare reports a connection registered; readiness waits for this as well as a URL. */\nconst CONNECTION_READY = /registered tunnel connection|connection .* registered/iu;\n\nexport function tunnelTarget(port: number): string {\n  return `http://127.0.0.1:${String(port)}`;\n}\n\n/**\n * The cloudflared argument vector.\n *\n * `--url` is a flag on the `tunnel` command rather than on `run`, so it comes\n * before the subcommand in both shapes. `--token-file` belongs to `run`.\n *\n * Flag placement here follows cloudflared's documented usage and local help.\n */\nexport function tunnelArgs(config: TunnelConfig, port: number, tokenFile?: string): string[] {\n  const args = ['tunnel', '--no-autoupdate'];\n  if (config.kind === 'named' && config.configFile !== undefined) args.push('--config', config.configFile);\n  args.push('--url', tunnelTarget(port));\n  if (config.kind === 'quick') return args;\n  args.push('run');\n  if (tokenFile !== undefined && tokenFile !== '') args.push('--token-file', tokenFile);\n  if (config.name !== undefined) args.push(config.name);\n  return args;\n}\n\n/** The public origin a quick tunnel announced, or undefined if this output does not carry one. */\nexport function extractTunnelUrl(text: string): string | undefined {\n  return QUICK_TUNNEL_URL.exec(text)?.[0].toLowerCase();\n}\n\nexport function mentionsRegisteredConnection(text: string): boolean {\n  return CONNECTION_READY.test(text);\n}\n\n/** Operator-facing copy for a failure, with the cause appended by the caller. */\nexport function describeTunnelFailure(failure: TunnelFailure): string {\n  switch (failure) {\n    case 'not_installed':\n      return 'cloudflared is not installed. Install it (brew install cloudflared) or set DOOMPI_CLOUDFLARED.';\n    case 'spawn_failed':\n      return 'cloudflared could not be started.';\n    case 'timeout':\n      return 'cloudflared did not report a public URL in time.';\n    case 'self_test_failed':\n      return 'The tunnel came up unguarded and was closed immediately.';\n    case 'exited':\n      return 'cloudflared stopped on its own.';\n  }\n}\n"],"mappings":";;;;;;;;;AAsBA,MAAM,mBAAmB;;AAGzB,MAAM,mBAAmB;AAEzB,SAAgB,aAAa,MAAsB;CACjD,OAAO,oBAAoB,OAAO,IAAI;AACxC;;;;;;;;;AAUA,SAAgB,WAAW,QAAsB,MAAc,WAA8B;CAC3F,MAAM,OAAO,CAAC,UAAU,iBAAiB;CACzC,IAAI,OAAO,SAAS,WAAW,OAAO,eAAe,KAAA,GAAW,KAAK,KAAK,YAAY,OAAO,UAAU;CACvG,KAAK,KAAK,SAAS,aAAa,IAAI,CAAC;CACrC,IAAI,OAAO,SAAS,SAAS,OAAO;CACpC,KAAK,KAAK,KAAK;CACf,IAAI,cAAc,KAAA,KAAa,cAAc,IAAI,KAAK,KAAK,gBAAgB,SAAS;CACpF,IAAI,OAAO,SAAS,KAAA,GAAW,KAAK,KAAK,OAAO,IAAI;CACpD,OAAO;AACT;;AAGA,SAAgB,iBAAiB,MAAkC;CACjE,OAAO,iBAAiB,KAAK,IAAI,CAAC,GAAG,EAAE,CAAC,YAAY;AACtD;AAEA,SAAgB,6BAA6B,MAAuB;CAClE,OAAO,iBAAiB,KAAK,IAAI;AACnC;;AAGA,SAAgB,sBAAsB,SAAgC;CACpE,QAAQ,SAAR;EACE,KAAK,iBACH,OAAO;EACT,KAAK,gBACH,OAAO;EACT,KAAK,WACH,OAAO;EACT,KAAK,oBACH,OAAO;EACT,KAAK,UACH,OAAO;CACX;AACF"}

package/dist/src/services/tunnelProcess/index.cjs

@@ -0,0 +1,487 @@
+const require_runtime = require("../../../_virtual/_rolldown/runtime.cjs");
+const require_remote = require("../../constants/remote.cjs");
+require("../pairingPage/index.cjs");
+const require_index$1 = require("../tunnelOutput/index.cjs");
+let node_fs = require("node:fs");
+node_fs = require_runtime.__toESM(node_fs, 1);
+let node_path = require("node:path");
+node_path = require_runtime.__toESM(node_path, 1);
+let node_child_process = require("node:child_process");
+//#region src/services/tunnelProcess/index.ts
+/** Explicit binary path, ahead of a PATH scan. */
+const CLOUDFLARED_ENV = "DOOMPI_CLOUDFLARED";
+const START_TIMEOUT_MS = 45e3;
+const TERMINATE_GRACE_MS = 2e3;
+const SELF_TEST_ATTEMPTS = 10;
+const SELF_TEST_RETRY_MS = 500;
+const NAMED_RESTART_ATTEMPTS = 3;
+const NAMED_RESTART_BASE_DELAY_MS = 500;
+const NAMED_RESTART_MAX_DELAY_MS = 4e3;
+const NAMED_RESTART_STABLE_MS = 6e4;
+const UNAUTHORIZED = 401;
+/** Cloudflare has the DNS route but no connector has registered yet. */
+const EDGE_TUNNEL_UNAVAILABLE = 530;
+const OK = 200;
+const PID_FILE = "tunnel.pid";
+const TOKEN_FILE = "tunnel.token";
+const FILE_MODE = 384;
+/** A pid file older than this is stale beyond usefulness and the pid has likely been recycled. */
+const PID_FILE_MAX_AGE_MS = 6048e5;
+/**
+* Finds cloudflared without a shell.
+*
+* A manual scan rather than `which`: spawning a shell to locate a binary is a
+* quoting hazard for no benefit, and this also works the same on every platform.
+*/
+function findCloudflared(env = process.env) {
+	const names = process.platform === "win32" ? ["cloudflared.exe", "cloudflared"] : ["cloudflared"];
+	for (const directory of (env.PATH ?? "").split(node_path.default.delimiter)) {
+		if (directory === "") continue;
+		for (const name of names) {
+			const candidate = node_path.default.join(directory, name);
+			try {
+				node_fs.default.accessSync(candidate, node_fs.default.constants.X_OK);
+				return candidate;
+			} catch {}
+		}
+	}
+}
+async function defaultProbe(url, signal) {
+	const response = await fetch(url, {
+		redirect: "manual",
+		signal
+	});
+	return {
+		status: response.status,
+		body: await response.text()
+	};
+}
+function validPid(value) {
+	return typeof value === "number" && Number.isSafeInteger(value) && value > 0;
+}
+/** Only ESRCH proves the owner is gone; permission and platform errors fail safe. */
+function ownerMayBeAlive(pid) {
+	try {
+		process.kill(pid, 0);
+		return true;
+	} catch (error) {
+		return error.code !== "ESRCH";
+	}
+}
+function reapStaleTunnel(stateDir, onNotice) {
+	const pidPath = node_path.default.join(stateDir, PID_FILE);
+	const tokenPath = node_path.default.join(stateDir, TOKEN_FILE);
+	let raw;
+	try {
+		raw = node_fs.default.readFileSync(pidPath, "utf8");
+	} catch (error) {
+		if (error.code === "ENOENT") node_fs.default.rmSync(tokenPath, { force: true });
+		return;
+	}
+	let parsed;
+	try {
+		parsed = JSON.parse(raw);
+	} catch {
+		return;
+	}
+	if (typeof parsed !== "object" || parsed === null) return;
+	const record = parsed;
+	if (Object.hasOwn(record, "ownerPid")) {
+		if (!validPid(record.ownerPid) || ownerMayBeAlive(record.ownerPid)) return;
+	}
+	node_fs.default.rmSync(tokenPath, { force: true });
+	node_fs.default.rmSync(pidPath, { force: true });
+	const pid = validPid(record.pid) ? record.pid : void 0;
+	const startedAt = typeof record.startedAt === "number" ? record.startedAt : 0;
+	if (pid === void 0 || Date.now() - startedAt > PID_FILE_MAX_AGE_MS) return;
+	if (process.platform === "linux") try {
+		if (!node_fs.default.readFileSync(`/proc/${String(pid)}/cmdline`, "utf8").includes("cloudflared")) return;
+	} catch {
+		return;
+	}
+	try {
+		process.kill(pid, "SIGTERM");
+		onNotice(`stopped a tunnel left running by a previous hub (pid ${String(pid)})`);
+	} catch {}
+}
+function tailOf(lines) {
+	return lines.slice(-20).join("").trim();
+}
+/** Copies a named tunnel token to a private runtime file understood by cloudflared. */
+function writeTokenFile(config, stateDir) {
+	if (config.kind !== "named" || config.tokenFile === void 0) return void 0;
+	let token;
+	let sourcePath;
+	try {
+		sourcePath = node_fs.default.realpathSync(config.tokenFile);
+		token = node_fs.default.readFileSync(sourcePath, "utf8").trim();
+	} catch {
+		return;
+	}
+	if (token === "") return void 0;
+	node_fs.default.mkdirSync(stateDir, {
+		recursive: true,
+		mode: 448
+	});
+	const tokenPath = node_path.default.join(stateDir, TOKEN_FILE);
+	let existingTarget;
+	try {
+		existingTarget = node_fs.default.realpathSync(tokenPath);
+	} catch {}
+	if (sourcePath === node_path.default.resolve(tokenPath) || sourcePath === existingTarget) throw new Error("The configured tunnel token file cannot also be DoomPi runtime token storage.");
+	node_fs.default.rmSync(tokenPath, { force: true });
+	node_fs.default.writeFileSync(tokenPath, token, { mode: FILE_MODE });
+	node_fs.default.chmodSync(tokenPath, FILE_MODE);
+	return tokenPath;
+}
+function createTunnelLauncher(options) {
+	const notice = options.onNotice ?? (() => {});
+	const restartBaseDelayMs = options.restartBaseDelayMs ?? NAMED_RESTART_BASE_DELAY_MS;
+	const restartStableMs = options.restartStableMs ?? NAMED_RESTART_STABLE_MS;
+	return async function launch(input) {
+		let stopped = false;
+		let activeStop;
+		let stopPromise;
+		let recoveryPromise;
+		let pendingExit;
+		let restartCount = 0;
+		let lastReadyAt = 0;
+		const recoveryAbort = new AbortController();
+		const signal = input.signal === void 0 ? recoveryAbort.signal : AbortSignal.any([input.signal, recoveryAbort.signal]);
+		const supervisedInput = {
+			...input,
+			signal
+		};
+		function queueUnexpectedExit(message) {
+			if (stopped) return;
+			if (input.config.kind === "quick") {
+				options.onExit?.(message);
+				return;
+			}
+			if (recoveryPromise !== void 0) {
+				pendingExit = message;
+				return;
+			}
+			beginRecovery(message);
+		}
+		const single = createSingleTunnelLauncher({
+			...options,
+			onExit: queueUnexpectedExit
+		});
+		async function waitForRestart(attempt) {
+			if (recoveryAbort.signal.aborted) return;
+			const delayMs = Math.min(restartBaseDelayMs * 2 ** (attempt - 1), NAMED_RESTART_MAX_DELAY_MS);
+			await new Promise((resolve) => {
+				let timer;
+				const done = () => {
+					clearTimeout(timer);
+					recoveryAbort.signal.removeEventListener("abort", done);
+					resolve();
+				};
+				timer = setTimeout(done, delayMs);
+				recoveryAbort.signal.addEventListener("abort", done, { once: true });
+				if (recoveryAbort.signal.aborted) done();
+			});
+		}
+		async function recover(initialMessage) {
+			if (Date.now() - lastReadyAt >= restartStableMs) restartCount = 0;
+			let lastFailure = initialMessage;
+			while (!stopped && restartCount < NAMED_RESTART_ATTEMPTS) {
+				restartCount += 1;
+				notice(`cloudflared stopped; restarting named tunnel (attempt ${String(restartCount)} of ${String(NAMED_RESTART_ATTEMPTS)})`);
+				await waitForRestart(restartCount);
+				if (stopped) return;
+				const outcome = await single(supervisedInput);
+				if (stopped) {
+					if (outcome.ok) await outcome.stop().catch(() => void 0);
+					return;
+				}
+				if (!outcome.ok) {
+					lastFailure = outcome.message;
+					continue;
+				}
+				activeStop = outcome.stop;
+				lastReadyAt = Date.now();
+				notice(`named tunnel recovered at ${outcome.publicOrigin}`);
+				return;
+			}
+			if (!stopped) options.onExit?.(`${initialMessage}\nNamed tunnel recovery failed after ${String(NAMED_RESTART_ATTEMPTS)} attempts. Last failure: ${lastFailure}`);
+		}
+		function beginRecovery(message) {
+			recoveryPromise = recover(message).catch((error) => {
+				if (!stopped) {
+					const cause = error instanceof Error ? error.message : String(error);
+					options.onExit?.(`${message}\nNamed tunnel recovery failed: ${cause}`);
+				}
+			}).finally(() => {
+				recoveryPromise = void 0;
+				const queued = pendingExit;
+				pendingExit = void 0;
+				if (queued !== void 0 && !stopped) beginRecovery(queued);
+			});
+		}
+		const initial = await single(supervisedInput);
+		if (!initial.ok) {
+			stopped = true;
+			recoveryAbort.abort();
+			return initial;
+		}
+		activeStop = initial.stop;
+		lastReadyAt = Date.now();
+		const stop = async () => {
+			if (stopPromise !== void 0) return await stopPromise;
+			stopped = true;
+			recoveryAbort.abort();
+			const recovering = recoveryPromise;
+			stopPromise = (async () => {
+				await activeStop?.().catch(() => void 0);
+				await recovering?.catch(() => void 0);
+				node_fs.default.rmSync(node_path.default.join(options.stateDir, PID_FILE), { force: true });
+				node_fs.default.rmSync(node_path.default.join(options.stateDir, TOKEN_FILE), { force: true });
+			})();
+			return await stopPromise;
+		};
+		return {
+			ok: true,
+			publicOrigin: initial.publicOrigin,
+			stop
+		};
+	};
+}
+/** Starts one cloudflared child; the exported launcher supervises successive named-tunnel children. */
+function createSingleTunnelLauncher(options) {
+	const notice = options.onNotice ?? (() => {});
+	const spawnProcess = options.spawnProcess ?? node_child_process.spawn;
+	const probe = options.probe ?? defaultProbe;
+	const selfTestRetryMs = options.selfTestRetryMs ?? SELF_TEST_RETRY_MS;
+	const startTimeoutMs = options.startTimeoutMs ?? START_TIMEOUT_MS;
+	const pidPath = node_path.default.join(options.stateDir, PID_FILE);
+	const runtimeTokenPath = node_path.default.join(options.stateDir, TOKEN_FILE);
+	return async function launch(input) {
+		if (input.signal?.aborted === true) return {
+			ok: false,
+			failure: "exited",
+			message: "Tunnel startup was cancelled."
+		};
+		const binary = options.cloudflaredPath ?? process.env["DOOMPI_CLOUDFLARED"] ?? findCloudflared();
+		if (binary === void 0 || binary === "") return {
+			ok: false,
+			failure: "not_installed",
+			message: require_index$1.describeTunnelFailure("not_installed")
+		};
+		let tokenPath;
+		try {
+			tokenPath = writeTokenFile(input.config, options.stateDir);
+		} catch (error) {
+			const cause = error instanceof Error ? error.message : String(error);
+			return {
+				ok: false,
+				failure: "spawn_failed",
+				message: `${require_index$1.describeTunnelFailure("spawn_failed")} ${cause}`
+			};
+		}
+		const args = require_index$1.tunnelArgs(input.config, input.port, tokenPath);
+		let child;
+		try {
+			child = spawnProcess(binary, args, {
+				detached: false,
+				stdio: [
+					"ignore",
+					"pipe",
+					"pipe"
+				]
+			});
+		} catch (error) {
+			node_fs.default.rmSync(runtimeTokenPath, { force: true });
+			const cause = error instanceof Error ? error.message : String(error);
+			return {
+				ok: false,
+				failure: "spawn_failed",
+				message: `${require_index$1.describeTunnelFailure("spawn_failed")} ${cause}`
+			};
+		}
+		const lines = [];
+		let stopped = false;
+		let settle;
+		let selfTestStarted = false;
+		const selfTestAbort = new AbortController();
+		const killTree = () => {
+			try {
+				child.kill("SIGTERM");
+			} catch {}
+		};
+		const onProcessExit = () => {
+			node_fs.default.rmSync(runtimeTokenPath, { force: true });
+			try {
+				if (child.pid !== void 0) process.kill(child.pid, "SIGKILL");
+			} catch {}
+		};
+		process.once("exit", onProcessExit);
+		const stop = async () => {
+			if (stopped) return;
+			stopped = true;
+			if (child.exitCode !== null || child.signalCode !== null) {
+				process.off("exit", onProcessExit);
+				node_fs.default.rmSync(pidPath, { force: true });
+				node_fs.default.rmSync(runtimeTokenPath, { force: true });
+				return;
+			}
+			await new Promise((resolve) => {
+				const escalate = setTimeout(() => {
+					try {
+						child.kill("SIGKILL");
+					} catch {}
+				}, TERMINATE_GRACE_MS);
+				child.once("exit", () => {
+					clearTimeout(escalate);
+					resolve();
+				});
+				killTree();
+			});
+			process.off("exit", onProcessExit);
+			node_fs.default.rmSync(pidPath, { force: true });
+			node_fs.default.rmSync(runtimeTokenPath, { force: true });
+		};
+		try {
+			node_fs.default.mkdirSync(options.stateDir, {
+				recursive: true,
+				mode: 448
+			});
+			node_fs.default.writeFileSync(pidPath, JSON.stringify({
+				pid: child.pid,
+				ownerPid: process.pid,
+				startedAt: Date.now(),
+				command: binary
+			}), { mode: FILE_MODE });
+		} catch {}
+		let seenUrl = input.config.kind === "named" ? `https://${input.config.hostname}` : void 0;
+		let seenConnection = false;
+		const waitToRetry = async () => {
+			if (selfTestRetryMs <= 0) return;
+			await new Promise((resolve) => {
+				const done = () => {
+					clearTimeout(timer);
+					selfTestAbort.signal.removeEventListener("abort", done);
+					resolve();
+				};
+				const timer = setTimeout(done, selfTestRetryMs);
+				selfTestAbort.signal.addEventListener("abort", done, { once: true });
+			});
+		};
+		/** Proves end to end that pairing is reachable and that everything else is not. */
+		const runSelfTest = async (origin) => {
+			let pairResponse;
+			let healthResponse;
+			let cause = "fetch failed";
+			for (let attempt = 0; attempt < SELF_TEST_ATTEMPTS && !selfTestAbort.signal.aborted; attempt += 1) {
+				try {
+					pairResponse = await probe(`${origin}${require_remote.PAIRING_PAGE_ROUTE}`, selfTestAbort.signal);
+					healthResponse = await probe(`${origin}/api/health`, selfTestAbort.signal);
+					if (pairResponse.status !== EDGE_TUNNEL_UNAVAILABLE && healthResponse.status !== EDGE_TUNNEL_UNAVAILABLE) break;
+					cause = `Cloudflare edge answered ${String(healthResponse.status)} before the connector registered`;
+				} catch (error) {
+					cause = error instanceof Error ? error.message : String(error);
+				}
+				if (attempt + 1 < SELF_TEST_ATTEMPTS && !selfTestAbort.signal.aborted) await waitToRetry();
+			}
+			if (pairResponse === void 0 || healthResponse === void 0) return {
+				ok: false,
+				failure: "self_test_failed",
+				message: `The tunnel did not answer: ${cause}`
+			};
+			if (healthResponse.status !== UNAUTHORIZED) {
+				const message = `${require_index$1.describeTunnelFailure("self_test_failed")} /api/health answered ${String(healthResponse.status)} through the tunnel.`;
+				notice(message);
+				return {
+					ok: false,
+					failure: "self_test_failed",
+					message
+				};
+			}
+			if (pairResponse.status !== OK || !pairResponse.body.includes("doompi-pairing-page")) {
+				const message = `The pairing page answered ${String(pairResponse.status)} through the tunnel.`;
+				notice(message);
+				return {
+					ok: false,
+					failure: "self_test_failed",
+					message
+				};
+			}
+			notice(`tunnel ready at ${origin}`);
+			return {
+				ok: true,
+				publicOrigin: origin,
+				stop
+			};
+		};
+		const consider = (chunk) => {
+			lines.push(chunk);
+			if (settle === void 0 || selfTestStarted) return;
+			seenUrl ??= require_index$1.extractTunnelUrl(chunk);
+			seenConnection ||= require_index$1.mentionsRegisteredConnection(chunk);
+			if (seenUrl === void 0 || !seenConnection) return;
+			selfTestStarted = true;
+			input.acceptOrigin?.(seenUrl);
+			runSelfTest(seenUrl).then((result) => settle?.(result));
+		};
+		child.stdout?.on("data", (data) => consider(data.toString()));
+		child.stderr?.on("data", (data) => consider(data.toString()));
+		return await new Promise((resolve) => {
+			let deadline;
+			const finish = (result, stopProcess = !result.ok) => {
+				if (settle === void 0) return;
+				settle = void 0;
+				clearTimeout(deadline);
+				input.signal?.removeEventListener("abort", cancel);
+				selfTestAbort.abort();
+				if (stopProcess) stop().then(() => resolve(result));
+				else resolve(result);
+			};
+			const cancel = () => {
+				finish({
+					ok: false,
+					failure: "exited",
+					message: "Tunnel startup was cancelled."
+				});
+			};
+			settle = (result) => finish(result);
+			deadline = setTimeout(() => {
+				finish({
+					ok: false,
+					failure: "timeout",
+					message: `${require_index$1.describeTunnelFailure("timeout")}\n${tailOf(lines)}`
+				});
+			}, startTimeoutMs);
+			input.signal?.addEventListener("abort", cancel, { once: true });
+			child.once("error", (error) => {
+				finish({
+					ok: false,
+					failure: "spawn_failed",
+					message: `${require_index$1.describeTunnelFailure("spawn_failed")} ${error.message}`
+				});
+			});
+			child.once("exit", (code) => {
+				process.off("exit", onProcessExit);
+				node_fs.default.rmSync(runtimeTokenPath, { force: true });
+				const message = `${require_index$1.describeTunnelFailure("exited")} (code ${String(code)})\n${tailOf(lines)}`;
+				if (settle !== void 0) {
+					finish({
+						ok: false,
+						failure: "exited",
+						message
+					}, false);
+					return;
+				}
+				if (!stopped) options.onExit?.(message);
+			});
+			if (input.signal?.aborted === true) cancel();
+		});
+	};
+}
+//#endregion
+exports.CLOUDFLARED_ENV = CLOUDFLARED_ENV;
+exports.createTunnelLauncher = createTunnelLauncher;
+exports.findCloudflared = findCloudflared;
+exports.reapStaleTunnel = reapStaleTunnel;
+
+//# sourceMappingURL=index.cjs.map

package/dist/src/services/tunnelProcess/index.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.cjs","names":["path","fs","spawn","describeTunnelFailure","tunnelArgs","PAIRING_PAGE_ROUTE","extractTunnelUrl","mentionsRegisteredConnection"],"sources":["../../../../src/services/tunnelProcess/index.ts"],"sourcesContent":["import { type ChildProcess, spawn } from 'node:child_process';\nimport fs from 'node:fs';\nimport path from 'node:path';\n\nimport { PAIRING_PAGE_ROUTE } from '../../constants/remote';\nimport {\n  type TunnelConfig,\n  type TunnelLauncher,\n  type TunnelStartInput,\n  type TunnelStartResult,\n} from '../../types/remote';\nimport { PAIRING_PAGE_MARKER } from '../pairingPage';\nimport { describeTunnelFailure, extractTunnelUrl, mentionsRegisteredConnection, tunnelArgs } from '../tunnelOutput';\n\n/** Explicit binary path, ahead of a PATH scan. */\nexport const CLOUDFLARED_ENV = 'DOOMPI_CLOUDFLARED';\nconst START_TIMEOUT_MS = 45_000;\nconst TERMINATE_GRACE_MS = 2000;\nconst SELF_TEST_ATTEMPTS = 10;\nconst SELF_TEST_RETRY_MS = 500;\nconst NAMED_RESTART_ATTEMPTS = 3;\nconst NAMED_RESTART_BASE_DELAY_MS = 500;\nconst NAMED_RESTART_MAX_DELAY_MS = 4000;\nconst NAMED_RESTART_STABLE_MS = 60_000;\n/** Lines of process output kept for a failure report. */\nconst LOG_TAIL = 20;\nconst UNAUTHORIZED = 401;\n/** Cloudflare has the DNS route but no connector has registered yet. */\nconst EDGE_TUNNEL_UNAVAILABLE = 530;\nconst OK = 200;\nconst PID_FILE = 'tunnel.pid';\nconst TOKEN_FILE = 'tunnel.token';\nconst FILE_MODE = 0o600;\n/** A pid file older than this is stale beyond usefulness and the pid has likely been recycled. */\nconst PID_FILE_MAX_AGE_MS = 7 * 24 * 60 * 60 * 1000;\n\nexport interface ProbeResult {\n  status: number;\n  body: string;\n}\n\nexport interface TunnelProcessOptions {\n  /** Explicit binary, ahead of the env var and the PATH scan. */\n  cloudflaredPath?: string;\n  stateDir: string;\n  onNotice?: (message: string) => void;\n  /** Test seam: stands in for node:child_process.spawn. */\n  spawnProcess?: typeof spawn;\n  /** Test seam: reaches the tunnel from outside, so the self-test needs no network. */\n  probe?: (url: string, signal: AbortSignal) => Promise<ProbeResult>;\n  /** Test seam: production waits briefly for a new public hostname to propagate. */\n  selfTestRetryMs?: number;\n  /** Test seam: production bounds the complete startup, including its self-test. */\n  startTimeoutMs?: number;\n  /** Test seam: production backs named-tunnel restarts off from 500 ms. */\n  restartBaseDelayMs?: number;\n  /** Test seam: production resets the rapid-crash budget after one stable minute. */\n  restartStableMs?: number;\n  /** Called after a quick tunnel exits, or after named-tunnel recovery is exhausted. */\n  onExit?: (message: string) => void;\n}\n\n/**\n * Finds cloudflared without a shell.\n *\n * A manual scan rather than `which`: spawning a shell to locate a binary is a\n * quoting hazard for no benefit, and this also works the same on every platform.\n */\nexport function findCloudflared(env: NodeJS.ProcessEnv = process.env): string | undefined {\n  const names = process.platform === 'win32' ? ['cloudflared.exe', 'cloudflared'] : ['cloudflared'];\n  for (const directory of (env.PATH ?? '').split(path.delimiter)) {\n    if (directory === '') continue;\n    for (const name of names) {\n      const candidate = path.join(directory, name);\n      try {\n        fs.accessSync(candidate, fs.constants.X_OK);\n        return candidate;\n      } catch {\n        // Not here, or not executable; keep looking.\n      }\n    }\n  }\n  return undefined;\n}\n\nasync function defaultProbe(url: string, signal: AbortSignal): Promise<ProbeResult> {\n  const response = await fetch(url, { redirect: 'manual', signal });\n  return { status: response.status, body: await response.text() };\n}\n\n/**\n * Kills a tunnel left behind by a hub that could not clean up after itself.\n *\n * A SIGKILLed hub never runs its exit handler, and the child is not detached so\n * it is reparented rather than killed. It then holds the tunnel open against a\n * dead port. This is the sweep on the next start.\n *\n * The residual risk is pid reuse after a reboot. The age window narrows it and\n * on Linux the command line is checked; macOS has no equally cheap check, so\n * there the window stands.\n */\ninterface TunnelPidRecord {\n  pid?: unknown;\n  ownerPid?: unknown;\n  startedAt?: unknown;\n}\n\nfunction validPid(value: unknown): value is number {\n  return typeof value === 'number' && Number.isSafeInteger(value) && value > 0;\n}\n\n/** Only ESRCH proves the owner is gone; permission and platform errors fail safe. */\nfunction ownerMayBeAlive(pid: number): boolean {\n  try {\n    process.kill(pid, 0);\n    return true;\n  } catch (error) {\n    return (error as NodeJS.ErrnoException).code !== 'ESRCH';\n  }\n}\n\nexport function reapStaleTunnel(stateDir: string, onNotice: (message: string) => void): void {\n  const pidPath = path.join(stateDir, PID_FILE);\n  const tokenPath = path.join(stateDir, TOKEN_FILE);\n  let raw: string;\n  try {\n    raw = fs.readFileSync(pidPath, 'utf8');\n  } catch (error) {\n    if ((error as NodeJS.ErrnoException).code === 'ENOENT') fs.rmSync(tokenPath, { force: true });\n    return; // No pid file is the normal case; other read failures are unsafe to guess through.\n  }\n  let parsed: unknown;\n  try {\n    parsed = JSON.parse(raw);\n  } catch {\n    return; // A malformed record cannot prove that its owner is gone.\n  }\n  if (typeof parsed !== 'object' || parsed === null) return;\n  const record = parsed as TunnelPidRecord;\n  if (Object.hasOwn(record, 'ownerPid')) {\n    if (!validPid(record.ownerPid) || ownerMayBeAlive(record.ownerPid)) return;\n  }\n\n  fs.rmSync(tokenPath, { force: true });\n  fs.rmSync(pidPath, { force: true });\n  const pid = validPid(record.pid) ? record.pid : undefined;\n  const startedAt = typeof record.startedAt === 'number' ? record.startedAt : 0;\n  if (pid === undefined || Date.now() - startedAt > PID_FILE_MAX_AGE_MS) return;\n  if (process.platform === 'linux') {\n    try {\n      if (!fs.readFileSync(`/proc/${String(pid)}/cmdline`, 'utf8').includes('cloudflared')) return;\n    } catch {\n      return; // The process is gone.\n    }\n  }\n  try {\n    process.kill(pid, 'SIGTERM');\n    onNotice(`stopped a tunnel left running by a previous hub (pid ${String(pid)})`);\n  } catch {\n    // Already gone, which is the outcome we wanted.\n  }\n}\n\nfunction tailOf(lines: readonly string[]): string {\n  return lines.slice(-LOG_TAIL).join('').trim();\n}\n\n/** Copies a named tunnel token to a private runtime file understood by cloudflared. */\nfunction writeTokenFile(config: TunnelConfig, stateDir: string): string | undefined {\n  if (config.kind !== 'named' || config.tokenFile === undefined) return undefined;\n  let token: string;\n  let sourcePath: string;\n  try {\n    sourcePath = fs.realpathSync(config.tokenFile);\n    token = fs.readFileSync(sourcePath, 'utf8').trim();\n  } catch {\n    return undefined;\n  }\n  if (token === '') return undefined;\n  fs.mkdirSync(stateDir, { recursive: true, mode: 0o700 });\n  const tokenPath = path.join(stateDir, TOKEN_FILE);\n  let existingTarget: string | undefined;\n  try {\n    existingTarget = fs.realpathSync(tokenPath);\n  } catch {\n    // Missing is the normal state before launch.\n  }\n  if (sourcePath === path.resolve(tokenPath) || sourcePath === existingTarget) {\n    throw new Error('The configured tunnel token file cannot also be DoomPi runtime token storage.');\n  }\n  fs.rmSync(tokenPath, { force: true });\n  fs.writeFileSync(tokenPath, token, { mode: FILE_MODE });\n  fs.chmodSync(tokenPath, FILE_MODE);\n  return tokenPath;\n}\n\nexport function createTunnelLauncher(options: TunnelProcessOptions): TunnelLauncher {\n  const notice = options.onNotice ?? ((): void => {});\n  const restartBaseDelayMs = options.restartBaseDelayMs ?? NAMED_RESTART_BASE_DELAY_MS;\n  const restartStableMs = options.restartStableMs ?? NAMED_RESTART_STABLE_MS;\n\n  return async function launch(input: TunnelStartInput): Promise<TunnelStartResult> {\n    let stopped = false;\n    let activeStop: (() => Promise<void>) | undefined;\n    let stopPromise: Promise<void> | undefined;\n    let recoveryPromise: Promise<void> | undefined;\n    let pendingExit: string | undefined;\n    let restartCount = 0;\n    let lastReadyAt = 0;\n    const recoveryAbort = new AbortController();\n    const signal =\n      input.signal === undefined ? recoveryAbort.signal : AbortSignal.any([input.signal, recoveryAbort.signal]);\n    const supervisedInput: TunnelStartInput = { ...input, signal };\n\n    function queueUnexpectedExit(message: string): void {\n      if (stopped) return;\n      if (input.config.kind === 'quick') {\n        options.onExit?.(message);\n        return;\n      }\n      if (recoveryPromise !== undefined) {\n        pendingExit = message;\n        return;\n      }\n      beginRecovery(message);\n    }\n\n    const single = createSingleTunnelLauncher({ ...options, onExit: queueUnexpectedExit });\n\n    async function waitForRestart(attempt: number): Promise<void> {\n      if (recoveryAbort.signal.aborted) return;\n      const delayMs = Math.min(restartBaseDelayMs * 2 ** (attempt - 1), NAMED_RESTART_MAX_DELAY_MS);\n      await new Promise<void>((resolve) => {\n        let timer: ReturnType<typeof setTimeout>;\n        const done = (): void => {\n          clearTimeout(timer);\n          recoveryAbort.signal.removeEventListener('abort', done);\n          resolve();\n        };\n        timer = setTimeout(done, delayMs);\n        recoveryAbort.signal.addEventListener('abort', done, { once: true });\n        if (recoveryAbort.signal.aborted) done();\n      });\n    }\n\n    async function recover(initialMessage: string): Promise<void> {\n      if (Date.now() - lastReadyAt >= restartStableMs) restartCount = 0;\n      let lastFailure = initialMessage;\n      while (!stopped && restartCount < NAMED_RESTART_ATTEMPTS) {\n        restartCount += 1;\n        notice(\n          `cloudflared stopped; restarting named tunnel (attempt ${String(restartCount)} of ${String(NAMED_RESTART_ATTEMPTS)})`,\n        );\n        await waitForRestart(restartCount);\n        if (stopped) return;\n\n        const outcome = await single(supervisedInput);\n        if (stopped) {\n          if (outcome.ok) await outcome.stop().catch(() => undefined);\n          return;\n        }\n        if (!outcome.ok) {\n          lastFailure = outcome.message;\n          continue;\n        }\n        activeStop = outcome.stop;\n        lastReadyAt = Date.now();\n        notice(`named tunnel recovered at ${outcome.publicOrigin}`);\n        return;\n      }\n\n      if (!stopped) {\n        options.onExit?.(\n          `${initialMessage}\\nNamed tunnel recovery failed after ${String(NAMED_RESTART_ATTEMPTS)} attempts. Last failure: ${lastFailure}`,\n        );\n      }\n    }\n\n    function beginRecovery(message: string): void {\n      recoveryPromise = recover(message)\n        .catch((error: unknown) => {\n          if (!stopped) {\n            const cause = error instanceof Error ? error.message : String(error);\n            options.onExit?.(`${message}\\nNamed tunnel recovery failed: ${cause}`);\n          }\n        })\n        .finally(() => {\n          recoveryPromise = undefined;\n          const queued = pendingExit;\n          pendingExit = undefined;\n          if (queued !== undefined && !stopped) beginRecovery(queued);\n        });\n    }\n\n    const initial = await single(supervisedInput);\n    if (!initial.ok) {\n      stopped = true;\n      recoveryAbort.abort();\n      return initial;\n    }\n    activeStop = initial.stop;\n    lastReadyAt = Date.now();\n\n    const stop = async (): Promise<void> => {\n      if (stopPromise !== undefined) return await stopPromise;\n      stopped = true;\n      recoveryAbort.abort();\n      const recovering = recoveryPromise;\n      stopPromise = (async () => {\n        await activeStop?.().catch(() => undefined);\n        await recovering?.catch(() => undefined);\n        fs.rmSync(path.join(options.stateDir, PID_FILE), { force: true });\n        fs.rmSync(path.join(options.stateDir, TOKEN_FILE), { force: true });\n      })();\n      return await stopPromise;\n    };\n\n    return { ok: true, publicOrigin: initial.publicOrigin, stop };\n  };\n}\n\n/** Starts one cloudflared child; the exported launcher supervises successive named-tunnel children. */\nfunction createSingleTunnelLauncher(options: TunnelProcessOptions): TunnelLauncher {\n  const notice = options.onNotice ?? ((): void => {});\n  const spawnProcess = options.spawnProcess ?? spawn;\n  const probe = options.probe ?? defaultProbe;\n  const selfTestRetryMs = options.selfTestRetryMs ?? SELF_TEST_RETRY_MS;\n  const startTimeoutMs = options.startTimeoutMs ?? START_TIMEOUT_MS;\n  const pidPath = path.join(options.stateDir, PID_FILE);\n  const runtimeTokenPath = path.join(options.stateDir, TOKEN_FILE);\n\n  return async function launch(input: TunnelStartInput): Promise<TunnelStartResult> {\n    if (input.signal?.aborted === true) {\n      return { ok: false, failure: 'exited', message: 'Tunnel startup was cancelled.' };\n    }\n    const binary = options.cloudflaredPath ?? process.env[CLOUDFLARED_ENV] ?? findCloudflared();\n    if (binary === undefined || binary === '') {\n      return { ok: false, failure: 'not_installed', message: describeTunnelFailure('not_installed') };\n    }\n\n    let tokenPath: string | undefined;\n    try {\n      tokenPath = writeTokenFile(input.config, options.stateDir);\n    } catch (error) {\n      const cause = error instanceof Error ? error.message : String(error);\n      return { ok: false, failure: 'spawn_failed', message: `${describeTunnelFailure('spawn_failed')} ${cause}` };\n    }\n    const args = tunnelArgs(input.config, input.port, tokenPath);\n    let child: ChildProcess;\n    try {\n      // Never detached and never unref'd. A detached child becomes a process\n      // group leader that survives the terminal's SIGINT, which is exactly the\n      // orphaned public tunnel this must avoid. Contrast serverSpawner.ts,\n      // which detaches on purpose because sessions outlive the hub.\n      child = spawnProcess(binary, args, { detached: false, stdio: ['ignore', 'pipe', 'pipe'] });\n    } catch (error) {\n      fs.rmSync(runtimeTokenPath, { force: true });\n      const cause = error instanceof Error ? error.message : String(error);\n      return { ok: false, failure: 'spawn_failed', message: `${describeTunnelFailure('spawn_failed')} ${cause}` };\n    }\n\n    const lines: string[] = [];\n    let stopped = false;\n    let settle: ((result: TunnelStartResult) => void) | undefined;\n    let selfTestStarted = false;\n    const selfTestAbort = new AbortController();\n\n    const killTree = (): void => {\n      try {\n        child.kill('SIGTERM');\n      } catch {\n        // Already gone.\n      }\n    };\n    const onProcessExit = (): void => {\n      // Synchronous on purpose: async work in an 'exit' handler never runs.\n      // This is the net under process.exit(), an uncaught exception, and an\n      // unhandled rejection, none of which reach the graceful close path.\n      fs.rmSync(runtimeTokenPath, { force: true });\n      try {\n        if (child.pid !== undefined) process.kill(child.pid, 'SIGKILL');\n      } catch {\n        // Already gone.\n      }\n    };\n    process.once('exit', onProcessExit);\n\n    const stop = async (): Promise<void> => {\n      if (stopped) return;\n      stopped = true;\n      if (child.exitCode !== null || child.signalCode !== null) {\n        process.off('exit', onProcessExit);\n        fs.rmSync(pidPath, { force: true });\n        fs.rmSync(runtimeTokenPath, { force: true });\n        return;\n      }\n      await new Promise<void>((resolve) => {\n        const escalate = setTimeout(() => {\n          try {\n            child.kill('SIGKILL');\n          } catch {\n            // Already gone.\n          }\n        }, TERMINATE_GRACE_MS);\n        child.once('exit', () => {\n          clearTimeout(escalate);\n          resolve();\n        });\n        killTree();\n      });\n      process.off('exit', onProcessExit);\n      fs.rmSync(pidPath, { force: true });\n      fs.rmSync(runtimeTokenPath, { force: true });\n    };\n\n    try {\n      fs.mkdirSync(options.stateDir, { recursive: true, mode: 0o700 });\n      fs.writeFileSync(\n        pidPath,\n        JSON.stringify({ pid: child.pid, ownerPid: process.pid, startedAt: Date.now(), command: binary }),\n        { mode: FILE_MODE },\n      );\n    } catch {\n      // The reaper is a safety net, not a requirement; losing it does not stop\n      // the tunnel from coming up.\n    }\n\n    const configuredOrigin = input.config.kind === 'named' ? `https://${input.config.hostname}` : undefined;\n    let seenUrl = configuredOrigin;\n    let seenConnection = false;\n\n    const waitToRetry = async (): Promise<void> => {\n      if (selfTestRetryMs <= 0) return;\n      await new Promise<void>((resolve) => {\n        const done = (): void => {\n          clearTimeout(timer);\n          selfTestAbort.signal.removeEventListener('abort', done);\n          resolve();\n        };\n        const timer = setTimeout(done, selfTestRetryMs);\n        selfTestAbort.signal.addEventListener('abort', done, { once: true });\n      });\n    };\n\n    /** Proves end to end that pairing is reachable and that everything else is not. */\n    const runSelfTest = async (origin: string): Promise<TunnelStartResult> => {\n      let pairResponse: ProbeResult | undefined;\n      let healthResponse: ProbeResult | undefined;\n      let cause = 'fetch failed';\n      for (let attempt = 0; attempt < SELF_TEST_ATTEMPTS && !selfTestAbort.signal.aborted; attempt += 1) {\n        try {\n          pairResponse = await probe(`${origin}${PAIRING_PAGE_ROUTE}`, selfTestAbort.signal);\n          healthResponse = await probe(`${origin}/api/health`, selfTestAbort.signal);\n          if (pairResponse.status !== EDGE_TUNNEL_UNAVAILABLE && healthResponse.status !== EDGE_TUNNEL_UNAVAILABLE)\n            break;\n          cause = `Cloudflare edge answered ${String(healthResponse.status)} before the connector registered`;\n        } catch (error) {\n          cause = error instanceof Error ? error.message : String(error);\n        }\n        if (attempt + 1 < SELF_TEST_ATTEMPTS && !selfTestAbort.signal.aborted) await waitToRetry();\n      }\n      if (pairResponse === undefined || healthResponse === undefined) {\n        return { ok: false, failure: 'self_test_failed', message: `The tunnel did not answer: ${cause}` };\n      }\n      if (healthResponse.status !== UNAUTHORIZED) {\n        // The agent would be on the public internet unauthenticated. This is\n        // the one failure worth an automatic abort rather than a warning.\n        const message = `${describeTunnelFailure('self_test_failed')} /api/health answered ${String(healthResponse.status)} through the tunnel.`;\n        notice(message);\n        return { ok: false, failure: 'self_test_failed', message };\n      }\n      if (pairResponse.status !== OK || !pairResponse.body.includes(PAIRING_PAGE_MARKER)) {\n        const message = `The pairing page answered ${String(pairResponse.status)} through the tunnel.`;\n        notice(message);\n        return { ok: false, failure: 'self_test_failed', message };\n      }\n      notice(`tunnel ready at ${origin}`);\n      return { ok: true, publicOrigin: origin, stop };\n    };\n\n    const consider = (chunk: string): void => {\n      lines.push(chunk);\n      if (settle === undefined || selfTestStarted) return;\n      seenUrl ??= extractTunnelUrl(chunk);\n      seenConnection ||= mentionsRegisteredConnection(chunk);\n      if (seenUrl === undefined || !seenConnection) return;\n      selfTestStarted = true;\n      input.acceptOrigin?.(seenUrl);\n      void runSelfTest(seenUrl).then((result) => settle?.(result));\n    };\n\n    child.stdout?.on('data', (data: Buffer) => consider(data.toString()));\n    child.stderr?.on('data', (data: Buffer) => consider(data.toString()));\n\n    return await new Promise<TunnelStartResult>((resolve) => {\n      let deadline: ReturnType<typeof setTimeout>;\n      const finish = (result: TunnelStartResult, stopProcess = !result.ok): void => {\n        if (settle === undefined) return;\n        settle = undefined;\n        clearTimeout(deadline);\n        input.signal?.removeEventListener('abort', cancel);\n        selfTestAbort.abort();\n        if (stopProcess) {\n          void stop().then(() => resolve(result));\n        } else {\n          resolve(result);\n        }\n      };\n      const cancel = (): void => {\n        finish({ ok: false, failure: 'exited', message: 'Tunnel startup was cancelled.' });\n      };\n      settle = (result) => finish(result);\n      deadline = setTimeout(() => {\n        finish({\n          ok: false,\n          failure: 'timeout',\n          message: `${describeTunnelFailure('timeout')}\\n${tailOf(lines)}`,\n        });\n      }, startTimeoutMs);\n      input.signal?.addEventListener('abort', cancel, { once: true });\n\n      child.once('error', (error) => {\n        finish({\n          ok: false,\n          failure: 'spawn_failed',\n          message: `${describeTunnelFailure('spawn_failed')} ${error.message}`,\n        });\n      });\n\n      child.once('exit', (code) => {\n        process.off('exit', onProcessExit);\n        fs.rmSync(runtimeTokenPath, { force: true });\n        const message = `${describeTunnelFailure('exited')} (code ${String(code)})\\n${tailOf(lines)}`;\n        if (settle !== undefined) {\n          finish({ ok: false, failure: 'exited', message }, false);\n          return;\n        }\n        // It came up and then died: network loss, an edge rejection, or a\n        // self-update. The supervisor either replaces a named connector or tells\n        // the host to fail closed rather than leave an unreachable cockpit enabled.\n        if (!stopped) options.onExit?.(message);\n      });\n\n      // A named tunnel already knows its hostname, but it still waits for\n      // cloudflared to register an edge connection before probing the public URL.\n      if (input.signal?.aborted === true) cancel();\n    });\n  };\n}\n"],"mappings":";;;;;;;;;;;AAeA,MAAa,kBAAkB;AAC/B,MAAM,mBAAmB;AACzB,MAAM,qBAAqB;AAC3B,MAAM,qBAAqB;AAC3B,MAAM,qBAAqB;AAC3B,MAAM,yBAAyB;AAC/B,MAAM,8BAA8B;AACpC,MAAM,6BAA6B;AACnC,MAAM,0BAA0B;AAGhC,MAAM,eAAe;;AAErB,MAAM,0BAA0B;AAChC,MAAM,KAAK;AACX,MAAM,WAAW;AACjB,MAAM,aAAa;AACnB,MAAM,YAAY;;AAElB,MAAM,sBAAsB;;;;;;;AAkC5B,SAAgB,gBAAgB,MAAyB,QAAQ,KAAyB;CACxF,MAAM,QAAQ,QAAQ,aAAa,UAAU,CAAC,mBAAmB,aAAa,IAAI,CAAC,aAAa;CAChG,KAAK,MAAM,cAAc,IAAI,QAAQ,GAAA,CAAI,MAAMA,UAAAA,QAAK,SAAS,GAAG;EAC9D,IAAI,cAAc,IAAI;EACtB,KAAK,MAAM,QAAQ,OAAO;GACxB,MAAM,YAAYA,UAAAA,QAAK,KAAK,WAAW,IAAI;GAC3C,IAAI;IACF,QAAA,QAAG,WAAW,WAAWC,QAAAA,QAAG,UAAU,IAAI;IAC1C,OAAO;GACT,QAAQ,CAER;EACF;CACF;AAEF;AAEA,eAAe,aAAa,KAAa,QAA2C;CAClF,MAAM,WAAW,MAAM,MAAM,KAAK;EAAE,UAAU;EAAU;CAAO,CAAC;CAChE,OAAO;EAAE,QAAQ,SAAS;EAAQ,MAAM,MAAM,SAAS,KAAK;CAAE;AAChE;AAmBA,SAAS,SAAS,OAAiC;CACjD,OAAO,OAAO,UAAU,YAAY,OAAO,cAAc,KAAK,KAAK,QAAQ;AAC7E;;AAGA,SAAS,gBAAgB,KAAsB;CAC7C,IAAI;EACF,QAAQ,KAAK,KAAK,CAAC;EACnB,OAAO;CACT,SAAS,OAAO;EACd,OAAQ,MAAgC,SAAS;CACnD;AACF;AAEA,SAAgB,gBAAgB,UAAkB,UAA2C;CAC3F,MAAM,UAAUD,UAAAA,QAAK,KAAK,UAAU,QAAQ;CAC5C,MAAM,YAAYA,UAAAA,QAAK,KAAK,UAAU,UAAU;CAChD,IAAI;CACJ,IAAI;EACF,MAAMC,QAAAA,QAAG,aAAa,SAAS,MAAM;CACvC,SAAS,OAAO;EACd,IAAK,MAAgC,SAAS,UAAU,QAAA,QAAG,OAAO,WAAW,EAAE,OAAO,KAAK,CAAC;EAC5F;CACF;CACA,IAAI;CACJ,IAAI;EACF,SAAS,KAAK,MAAM,GAAG;CACzB,QAAQ;EACN;CACF;CACA,IAAI,OAAO,WAAW,YAAY,WAAW,MAAM;CACnD,MAAM,SAAS;CACf,IAAI,OAAO,OAAO,QAAQ,UAAU,GAC9B;MAAA,CAAC,SAAS,OAAO,QAAQ,KAAK,gBAAgB,OAAO,QAAQ,GAAG;CAAA;CAGtE,QAAA,QAAG,OAAO,WAAW,EAAE,OAAO,KAAK,CAAC;CACpC,QAAA,QAAG,OAAO,SAAS,EAAE,OAAO,KAAK,CAAC;CAClC,MAAM,MAAM,SAAS,OAAO,GAAG,IAAI,OAAO,MAAM,KAAA;CAChD,MAAM,YAAY,OAAO,OAAO,cAAc,WAAW,OAAO,YAAY;CAC5E,IAAI,QAAQ,KAAA,KAAa,KAAK,IAAI,IAAI,YAAY,qBAAqB;CACvE,IAAI,QAAQ,aAAa,SACvB,IAAI;EACF,IAAI,CAACA,QAAAA,QAAG,aAAa,SAAS,OAAO,GAAG,EAAE,WAAW,MAAM,CAAC,CAAC,SAAS,aAAa,GAAG;CACxF,QAAQ;EACN;CACF;CAEF,IAAI;EACF,QAAQ,KAAK,KAAK,SAAS;EAC3B,SAAS,wDAAwD,OAAO,GAAG,EAAE,EAAE;CACjF,QAAQ,CAER;AACF;AAEA,SAAS,OAAO,OAAkC;CAChD,OAAO,MAAM,MAAM,GAAS,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,KAAK;AAC9C;;AAGA,SAAS,eAAe,QAAsB,UAAsC;CAClF,IAAI,OAAO,SAAS,WAAW,OAAO,cAAc,KAAA,GAAW,OAAO,KAAA;CACtE,IAAI;CACJ,IAAI;CACJ,IAAI;EACF,aAAaA,QAAAA,QAAG,aAAa,OAAO,SAAS;EAC7C,QAAQA,QAAAA,QAAG,aAAa,YAAY,MAAM,CAAC,CAAC,KAAK;CACnD,QAAQ;EACN;CACF;CACA,IAAI,UAAU,IAAI,OAAO,KAAA;CACzB,QAAA,QAAG,UAAU,UAAU;EAAE,WAAW;EAAM,MAAM;CAAM,CAAC;CACvD,MAAM,YAAYD,UAAAA,QAAK,KAAK,UAAU,UAAU;CAChD,IAAI;CACJ,IAAI;EACF,iBAAiBC,QAAAA,QAAG,aAAa,SAAS;CAC5C,QAAQ,CAER;CACA,IAAI,eAAeD,UAAAA,QAAK,QAAQ,SAAS,KAAK,eAAe,gBAC3D,MAAM,IAAI,MAAM,+EAA+E;CAEjG,QAAA,QAAG,OAAO,WAAW,EAAE,OAAO,KAAK,CAAC;CACpC,QAAA,QAAG,cAAc,WAAW,OAAO,EAAE,MAAM,UAAU,CAAC;CACtD,QAAA,QAAG,UAAU,WAAW,SAAS;CACjC,OAAO;AACT;AAEA,SAAgB,qBAAqB,SAA+C;CAClF,MAAM,SAAS,QAAQ,mBAAyB,CAAC;CACjD,MAAM,qBAAqB,QAAQ,sBAAsB;CACzD,MAAM,kBAAkB,QAAQ,mBAAmB;CAEnD,OAAO,eAAe,OAAO,OAAqD;EAChF,IAAI,UAAU;EACd,IAAI;EACJ,IAAI;EACJ,IAAI;EACJ,IAAI;EACJ,IAAI,eAAe;EACnB,IAAI,cAAc;EAClB,MAAM,gBAAgB,IAAI,gBAAgB;EAC1C,MAAM,SACJ,MAAM,WAAW,KAAA,IAAY,cAAc,SAAS,YAAY,IAAI,CAAC,MAAM,QAAQ,cAAc,MAAM,CAAC;EAC1G,MAAM,kBAAoC;GAAE,GAAG;GAAO;EAAO;EAE7D,SAAS,oBAAoB,SAAuB;GAClD,IAAI,SAAS;GACb,IAAI,MAAM,OAAO,SAAS,SAAS;IACjC,QAAQ,SAAS,OAAO;IACxB;GACF;GACA,IAAI,oBAAoB,KAAA,GAAW;IACjC,cAAc;IACd;GACF;GACA,cAAc,OAAO;EACvB;EAEA,MAAM,SAAS,2BAA2B;GAAE,GAAG;GAAS,QAAQ;EAAoB,CAAC;EAErF,eAAe,eAAe,SAAgC;GAC5D,IAAI,cAAc,OAAO,SAAS;GAClC,MAAM,UAAU,KAAK,IAAI,qBAAqB,MAAM,UAAU,IAAI,0BAA0B;GAC5F,MAAM,IAAI,SAAe,YAAY;IACnC,IAAI;IACJ,MAAM,aAAmB;KACvB,aAAa,KAAK;KAClB,cAAc,OAAO,oBAAoB,SAAS,IAAI;KACtD,QAAQ;IACV;IACA,QAAQ,WAAW,MAAM,OAAO;IAChC,cAAc,OAAO,iBAAiB,SAAS,MAAM,EAAE,MAAM,KAAK,CAAC;IACnE,IAAI,cAAc,OAAO,SAAS,KAAK;GACzC,CAAC;EACH;EAEA,eAAe,QAAQ,gBAAuC;GAC5D,IAAI,KAAK,IAAI,IAAI,eAAe,iBAAiB,eAAe;GAChE,IAAI,cAAc;GAClB,OAAO,CAAC,WAAW,eAAe,wBAAwB;IACxD,gBAAgB;IAChB,OACE,yDAAyD,OAAO,YAAY,EAAE,MAAM,OAAO,sBAAsB,EAAE,EACrH;IACA,MAAM,eAAe,YAAY;IACjC,IAAI,SAAS;IAEb,MAAM,UAAU,MAAM,OAAO,eAAe;IAC5C,IAAI,SAAS;KACX,IAAI,QAAQ,IAAI,MAAM,QAAQ,KAAK,CAAC,CAAC,YAAY,KAAA,CAAS;KAC1D;IACF;IACA,IAAI,CAAC,QAAQ,IAAI;KACf,cAAc,QAAQ;KACtB;IACF;IACA,aAAa,QAAQ;IACrB,cAAc,KAAK,IAAI;IACvB,OAAO,6BAA6B,QAAQ,cAAc;IAC1D;GACF;GAEA,IAAI,CAAC,SACH,QAAQ,SACN,GAAG,eAAe,uCAAuC,OAAO,sBAAsB,EAAE,2BAA2B,aACrH;EAEJ;EAEA,SAAS,cAAc,SAAuB;GAC5C,kBAAkB,QAAQ,OAAO,CAAC,CAC/B,OAAO,UAAmB;IACzB,IAAI,CAAC,SAAS;KACZ,MAAM,QAAQ,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;KACnE,QAAQ,SAAS,GAAG,QAAQ,kCAAkC,OAAO;IACvE;GACF,CAAC,CAAC,CACD,cAAc;IACb,kBAAkB,KAAA;IAClB,MAAM,SAAS;IACf,cAAc,KAAA;IACd,IAAI,WAAW,KAAA,KAAa,CAAC,SAAS,cAAc,MAAM;GAC5D,CAAC;EACL;EAEA,MAAM,UAAU,MAAM,OAAO,eAAe;EAC5C,IAAI,CAAC,QAAQ,IAAI;GACf,UAAU;GACV,cAAc,MAAM;GACpB,OAAO;EACT;EACA,aAAa,QAAQ;EACrB,cAAc,KAAK,IAAI;EAEvB,MAAM,OAAO,YAA2B;GACtC,IAAI,gBAAgB,KAAA,GAAW,OAAO,MAAM;GAC5C,UAAU;GACV,cAAc,MAAM;GACpB,MAAM,aAAa;GACnB,eAAe,YAAY;IACzB,MAAM,aAAa,CAAC,CAAC,YAAY,KAAA,CAAS;IAC1C,MAAM,YAAY,YAAY,KAAA,CAAS;IACvC,QAAA,QAAG,OAAOA,UAAAA,QAAK,KAAK,QAAQ,UAAU,QAAQ,GAAG,EAAE,OAAO,KAAK,CAAC;IAChE,QAAA,QAAG,OAAOA,UAAAA,QAAK,KAAK,QAAQ,UAAU,UAAU,GAAG,EAAE,OAAO,KAAK,CAAC;GACpE,EAAA,CAAG;GACH,OAAO,MAAM;EACf;EAEA,OAAO;GAAE,IAAI;GAAM,cAAc,QAAQ;GAAc;EAAK;CAC9D;AACF;;AAGA,SAAS,2BAA2B,SAA+C;CACjF,MAAM,SAAS,QAAQ,mBAAyB,CAAC;CACjD,MAAM,eAAe,QAAQ,gBAAgBE,mBAAAA;CAC7C,MAAM,QAAQ,QAAQ,SAAS;CAC/B,MAAM,kBAAkB,QAAQ,mBAAmB;CACnD,MAAM,iBAAiB,QAAQ,kBAAkB;CACjD,MAAM,UAAUF,UAAAA,QAAK,KAAK,QAAQ,UAAU,QAAQ;CACpD,MAAM,mBAAmBA,UAAAA,QAAK,KAAK,QAAQ,UAAU,UAAU;CAE/D,OAAO,eAAe,OAAO,OAAqD;EAChF,IAAI,MAAM,QAAQ,YAAY,MAC5B,OAAO;GAAE,IAAI;GAAO,SAAS;GAAU,SAAS;EAAgC;EAElF,MAAM,SAAS,QAAQ,mBAAmB,QAAQ,IAAA,yBAAwB,gBAAgB;EAC1F,IAAI,WAAW,KAAA,KAAa,WAAW,IACrC,OAAO;GAAE,IAAI;GAAO,SAAS;GAAiB,SAASG,gBAAAA,sBAAsB,eAAe;EAAE;EAGhG,IAAI;EACJ,IAAI;GACF,YAAY,eAAe,MAAM,QAAQ,QAAQ,QAAQ;EAC3D,SAAS,OAAO;GACd,MAAM,QAAQ,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;GACnE,OAAO;IAAE,IAAI;IAAO,SAAS;IAAgB,SAAS,GAAGA,gBAAAA,sBAAsB,cAAc,EAAE,GAAG;GAAQ;EAC5G;EACA,MAAM,OAAOC,gBAAAA,WAAW,MAAM,QAAQ,MAAM,MAAM,SAAS;EAC3D,IAAI;EACJ,IAAI;GAKF,QAAQ,aAAa,QAAQ,MAAM;IAAE,UAAU;IAAO,OAAO;KAAC;KAAU;KAAQ;IAAM;GAAE,CAAC;EAC3F,SAAS,OAAO;GACd,QAAA,QAAG,OAAO,kBAAkB,EAAE,OAAO,KAAK,CAAC;GAC3C,MAAM,QAAQ,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;GACnE,OAAO;IAAE,IAAI;IAAO,SAAS;IAAgB,SAAS,GAAGD,gBAAAA,sBAAsB,cAAc,EAAE,GAAG;GAAQ;EAC5G;EAEA,MAAM,QAAkB,CAAC;EACzB,IAAI,UAAU;EACd,IAAI;EACJ,IAAI,kBAAkB;EACtB,MAAM,gBAAgB,IAAI,gBAAgB;EAE1C,MAAM,iBAAuB;GAC3B,IAAI;IACF,MAAM,KAAK,SAAS;GACtB,QAAQ,CAER;EACF;EACA,MAAM,sBAA4B;GAIhC,QAAA,QAAG,OAAO,kBAAkB,EAAE,OAAO,KAAK,CAAC;GAC3C,IAAI;IACF,IAAI,MAAM,QAAQ,KAAA,GAAW,QAAQ,KAAK,MAAM,KAAK,SAAS;GAChE,QAAQ,CAER;EACF;EACA,QAAQ,KAAK,QAAQ,aAAa;EAElC,MAAM,OAAO,YAA2B;GACtC,IAAI,SAAS;GACb,UAAU;GACV,IAAI,MAAM,aAAa,QAAQ,MAAM,eAAe,MAAM;IACxD,QAAQ,IAAI,QAAQ,aAAa;IACjC,QAAA,QAAG,OAAO,SAAS,EAAE,OAAO,KAAK,CAAC;IAClC,QAAA,QAAG,OAAO,kBAAkB,EAAE,OAAO,KAAK,CAAC;IAC3C;GACF;GACA,MAAM,IAAI,SAAe,YAAY;IACnC,MAAM,WAAW,iBAAiB;KAChC,IAAI;MACF,MAAM,KAAK,SAAS;KACtB,QAAQ,CAER;IACF,GAAG,kBAAkB;IACrB,MAAM,KAAK,cAAc;KACvB,aAAa,QAAQ;KACrB,QAAQ;IACV,CAAC;IACD,SAAS;GACX,CAAC;GACD,QAAQ,IAAI,QAAQ,aAAa;GACjC,QAAA,QAAG,OAAO,SAAS,EAAE,OAAO,KAAK,CAAC;GAClC,QAAA,QAAG,OAAO,kBAAkB,EAAE,OAAO,KAAK,CAAC;EAC7C;EAEA,IAAI;GACF,QAAA,QAAG,UAAU,QAAQ,UAAU;IAAE,WAAW;IAAM,MAAM;GAAM,CAAC;GAC/D,QAAA,QAAG,cACD,SACA,KAAK,UAAU;IAAE,KAAK,MAAM;IAAK,UAAU,QAAQ;IAAK,WAAW,KAAK,IAAI;IAAG,SAAS;GAAO,CAAC,GAChG,EAAE,MAAM,UAAU,CACpB;EACF,QAAQ,CAGR;EAGA,IAAI,UADqB,MAAM,OAAO,SAAS,UAAU,WAAW,MAAM,OAAO,aAAa,KAAA;EAE9F,IAAI,iBAAiB;EAErB,MAAM,cAAc,YAA2B;GAC7C,IAAI,mBAAmB,GAAG;GAC1B,MAAM,IAAI,SAAe,YAAY;IACnC,MAAM,aAAmB;KACvB,aAAa,KAAK;KAClB,cAAc,OAAO,oBAAoB,SAAS,IAAI;KACtD,QAAQ;IACV;IACA,MAAM,QAAQ,WAAW,MAAM,eAAe;IAC9C,cAAc,OAAO,iBAAiB,SAAS,MAAM,EAAE,MAAM,KAAK,CAAC;GACrE,CAAC;EACH;;EAGA,MAAM,cAAc,OAAO,WAA+C;GACxE,IAAI;GACJ,IAAI;GACJ,IAAI,QAAQ;GACZ,KAAK,IAAI,UAAU,GAAG,UAAU,sBAAsB,CAAC,cAAc,OAAO,SAAS,WAAW,GAAG;IACjG,IAAI;KACF,eAAe,MAAM,MAAM,GAAG,SAASE,eAAAA,sBAAsB,cAAc,MAAM;KACjF,iBAAiB,MAAM,MAAM,GAAG,OAAO,cAAc,cAAc,MAAM;KACzE,IAAI,aAAa,WAAW,2BAA2B,eAAe,WAAW,yBAC/E;KACF,QAAQ,4BAA4B,OAAO,eAAe,MAAM,EAAE;IACpE,SAAS,OAAO;KACd,QAAQ,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;IAC/D;IACA,IAAI,UAAU,IAAI,sBAAsB,CAAC,cAAc,OAAO,SAAS,MAAM,YAAY;GAC3F;GACA,IAAI,iBAAiB,KAAA,KAAa,mBAAmB,KAAA,GACnD,OAAO;IAAE,IAAI;IAAO,SAAS;IAAoB,SAAS,8BAA8B;GAAQ;GAElG,IAAI,eAAe,WAAW,cAAc;IAG1C,MAAM,UAAU,GAAGF,gBAAAA,sBAAsB,kBAAkB,EAAE,wBAAwB,OAAO,eAAe,MAAM,EAAE;IACnH,OAAO,OAAO;IACd,OAAO;KAAE,IAAI;KAAO,SAAS;KAAoB;IAAQ;GAC3D;GACA,IAAI,aAAa,WAAW,MAAM,CAAC,aAAa,KAAK,SAAA,qBAA4B,GAAG;IAClF,MAAM,UAAU,6BAA6B,OAAO,aAAa,MAAM,EAAE;IACzE,OAAO,OAAO;IACd,OAAO;KAAE,IAAI;KAAO,SAAS;KAAoB;IAAQ;GAC3D;GACA,OAAO,mBAAmB,QAAQ;GAClC,OAAO;IAAE,IAAI;IAAM,cAAc;IAAQ;GAAK;EAChD;EAEA,MAAM,YAAY,UAAwB;GACxC,MAAM,KAAK,KAAK;GAChB,IAAI,WAAW,KAAA,KAAa,iBAAiB;GAC7C,YAAYG,gBAAAA,iBAAiB,KAAK;GAClC,mBAAmBC,gBAAAA,6BAA6B,KAAK;GACrD,IAAI,YAAY,KAAA,KAAa,CAAC,gBAAgB;GAC9C,kBAAkB;GAClB,MAAM,eAAe,OAAO;GAC5B,YAAiB,OAAO,CAAC,CAAC,MAAM,WAAW,SAAS,MAAM,CAAC;EAC7D;EAEA,MAAM,QAAQ,GAAG,SAAS,SAAiB,SAAS,KAAK,SAAS,CAAC,CAAC;EACpE,MAAM,QAAQ,GAAG,SAAS,SAAiB,SAAS,KAAK,SAAS,CAAC,CAAC;EAEpE,OAAO,MAAM,IAAI,SAA4B,YAAY;GACvD,IAAI;GACJ,MAAM,UAAU,QAA2B,cAAc,CAAC,OAAO,OAAa;IAC5E,IAAI,WAAW,KAAA,GAAW;IAC1B,SAAS,KAAA;IACT,aAAa,QAAQ;IACrB,MAAM,QAAQ,oBAAoB,SAAS,MAAM;IACjD,cAAc,MAAM;IACpB,IAAI,aACF,KAAU,CAAC,CAAC,WAAW,QAAQ,MAAM,CAAC;SAEtC,QAAQ,MAAM;GAElB;GACA,MAAM,eAAqB;IACzB,OAAO;KAAE,IAAI;KAAO,SAAS;KAAU,SAAS;IAAgC,CAAC;GACnF;GACA,UAAU,WAAW,OAAO,MAAM;GAClC,WAAW,iBAAiB;IAC1B,OAAO;KACL,IAAI;KACJ,SAAS;KACT,SAAS,GAAGJ,gBAAAA,sBAAsB,SAAS,EAAE,IAAI,OAAO,KAAK;IAC/D,CAAC;GACH,GAAG,cAAc;GACjB,MAAM,QAAQ,iBAAiB,SAAS,QAAQ,EAAE,MAAM,KAAK,CAAC;GAE9D,MAAM,KAAK,UAAU,UAAU;IAC7B,OAAO;KACL,IAAI;KACJ,SAAS;KACT,SAAS,GAAGA,gBAAAA,sBAAsB,cAAc,EAAE,GAAG,MAAM;IAC7D,CAAC;GACH,CAAC;GAED,MAAM,KAAK,SAAS,SAAS;IAC3B,QAAQ,IAAI,QAAQ,aAAa;IACjC,QAAA,QAAG,OAAO,kBAAkB,EAAE,OAAO,KAAK,CAAC;IAC3C,MAAM,UAAU,GAAGA,gBAAAA,sBAAsB,QAAQ,EAAE,SAAS,OAAO,IAAI,EAAE,KAAK,OAAO,KAAK;IAC1F,IAAI,WAAW,KAAA,GAAW;KACxB,OAAO;MAAE,IAAI;MAAO,SAAS;MAAU;KAAQ,GAAG,KAAK;KACvD;IACF;IAIA,IAAI,CAAC,SAAS,QAAQ,SAAS,OAAO;GACxC,CAAC;GAID,IAAI,MAAM,QAAQ,YAAY,MAAM,OAAO;EAC7C,CAAC;CACH;AACF"}