@agimon-ai/doompi-web 0.0.1-alpha.1 → 0.0.1-alpha.10

package/README.md

@@ -26,27 +26,31 @@ npm install -g @agimon-ai/doompi-web
 doompi-web
 ```
 
-Open `http://127.0.0.1:7433`. With no flags, the hub watches `~/.doompi/run`, attaches to registered sessions, and can start new sessions from the page. Sessions started by the cockpit use the server and agent from the same installation.
+Open `http://127.0.0.1:7433`. With no flags, the hub watches `~/.doompi/run`, attaches to registered sessions, and resolves the union of their synchronized cockpit compositions from `~/.pi/.doom/sync/registrations`. The directory that launches `doompi-web` does not select the bundle. Sessions started by the cockpit use the server and agent from the same installation.
 
-If a hub already answers on the port, a second `doompi-web` process prints its URL and exits.
+If `~/.pi/.doom` does not exist, the command runs its bundled `doompi init` before starting. If a hub already answers on the port, a second `doompi-web` process prints its URL and exits.
 
-To run this repository's build:
+To run this repository's build with its composition pinned and watched:
 
 ```bash
-pnpm cockpit
+pnpm cockpit:build
+pnpm doompi-web --dir=<PWD>
 ```
 
-The command builds the required packages and starts the hub on port 7433. Sessions created from the page use this checkout's builds.
-
-| Flag              | Default         | Meaning                                          |
-| ----------------- | --------------- | ------------------------------------------------ |
-| `--registry-dir`  | `~/.doompi/run` | Registry to watch (also `DOOMPI_RUNTIME_DIR`)    |
-| `--spawn-command` | this install    | Command launching sessions created from the page |
-| `--port`          | `7433`          | HTTP port                                        |
-| `--host`          | `127.0.0.1`     | Bind address                                     |
-| `--assets`        | bundled         | Override the built SPA directory                 |
-| `--state-dir`     | `~/.doompi/web` | Remote-access settings and the tunnel pid file   |
-| `--cloudflared`   | from `PATH`     | Tunnel binary (also `DOOMPI_CLOUDFLARED`)        |
+`--dir` accepts `--dir <path>` too. It synchronizes that repository before launch and watches it for development rebuilds.
+
+| Flag              | Default                  | Meaning                                          |
+| ----------------- | ------------------------ | ------------------------------------------------ |
+| `--dir`           | live-session union       | Pin, sync, and watch one repository composition  |
+| `--registry-dir`  | `~/.doompi/run`          | Registry to watch (also `DOOMPI_RUNTIME_DIR`)    |
+| `--spawn-command` | this install             | Command launching sessions created from the page |
+| `--port`          | `7433`                   | HTTP port                                        |
+| `--host`          | `127.0.0.1`              | Bind address                                     |
+| `--assets`        | synchronized or packaged | Override the built SPA directory                 |
+| `--state-dir`     | `~/.doompi/web`          | Remote-access settings and cockpit cache         |
+| `--cloudflared`   | from `PATH`              | Tunnel binary (also `DOOMPI_CLOUDFLARED`)        |
+| `-h`, `--help`    |                          | Print command help                               |
+| `-v`, `--version` |                          | Print the installed package version              |
 
 Install [doompi-server](https://www.npmjs.com/package/@agimon-ai/doompi-server) when you also want to run a session server directly. The hub does not require `doompi-server` on `PATH` to create sessions.
 
@@ -120,8 +124,27 @@ perform the handshake itself: `attach` frames sent from the browser are refused.
   them.
 - Subagent, workflow, and runner surfaces report summaries only; per-run detail has no RPC source
   to render from yet.
-- Browser notifications require a live, connected page. There is no service worker, Web Push, replay,
-  or durable queue, so notifications emitted while every page is closed are not delivered later.
+- Open pages show full live browser notifications. An installed paired PWA can also receive a generic
+  zero-TTL Web Push alert while closed. There is no durable subscription database, outbox, replay, or
+  historical delivery.
+
+## iPhone Home Screen app
+
+Use a stable named HTTPS tunnel such as `doompi.agimon.win`. Quick-tunnel hostnames rotate, so they cannot
+provide durable PWA identity, passkeys, or reliable Push subscriptions. Open `/pair` in Safari, add it to the
+Home Screen, then launch the installed app and scan the QR shown by the host.
+
+The install shell, scanner, manifest, and verifier worker are package-owned. The QR pins the host signing key
+and minimum bundle revision. The worker verifies every host and plugin asset before committing it to the
+active cache, and the host never serves its SPA directly. A failed update keeps the last-known-good bundle.
+Signer loss, signer rotation, or a host/container transition requires explicit fingerprint confirmation and
+re-pairing. Session file previews remain sealed `no-store` HTTP Blob URLs and never enter the application
+cache, IndexedDB, a signed manifest, or a Push payload.
+
+Closed-app alerts are opt-in under settings. The server keeps subscriptions only in memory and sends fixed
+generic copy with `TTL: 0` only when the device has no connected cockpit socket. Opening the app after a host
+restart re-registers the browser subscription. Disabling alerts, revoking or expiring the device, switching
+off remote access, or rotating process credentials removes it.
 
 ## Remote access
 
@@ -137,12 +160,13 @@ so the socket a connection arrived on is the only thing about it that cannot be
 
 Pairing takes **two** things, not one:
 
-1. The host shows a QR encoding `https://<tunnel-host>/pair#c=<code>`. The code rides in the URL
-   fragment, which no browser sends to any server, so it never reaches Cloudflare's logs, this
-   process's log, or a `Referer`.
-2. Scanning it raises an approve or deny prompt **on the host**. Nothing is paired until someone at
-   the machine answers. A screen is visible over a shoulder and in a screenshare, so the code alone
-   is one factor for a credential that ends in shell access.
+1. The host shows a QR encoding `https://<tunnel-host>/pair#c=<code>&k=<channel-key>&s=<signer>&r=<revision>`.
+   Every value rides in the URL fragment, which no browser sends to a server, so the relay cannot replace the
+   channel or bundle key without changing what was shown on the host. Manual pairing requires comparing the
+   signing-key fingerprint shown on both devices.
+2. Scanning raises an approve or deny prompt **on the host**. Nothing is paired until someone at the machine
+   answers. A screen is visible over a shoulder and in a screenshare, so the code alone is one factor for a
+   credential that ends in shell access.
 
 A paired device then has the same powers as the person at the keyboard, with one exception: it
 cannot mint pairing codes, approve devices, or change these settings. A device able to approve
@@ -160,18 +184,24 @@ setting in force at the moment of the check rather than stamped onto a session w
 Turning expiry on therefore drops sessions that are already idle, and turning it off brings them
 back.
 
-With both off, the only expiry is you: a tunnel stays up until it is closed or the hub restarts, and
-a paired device keeps its session until it is revoked or remote access is switched off. Switching
-remote access off always revokes every paired session, and that is not a toggle.
+With both off, a paired device keeps its session until it is revoked, remote access is switched off, or
+the hub restarts. Switching remote access off always revokes every paired session, and that is not a
+toggle.
 
 Before reporting success, the tunnel is **self-tested through its own public URL**: the pairing page
 must answer 200 and `/api/health` must answer 401. Anything else means the agent is on the public
 internet unguarded, so the tunnel is killed immediately rather than warned about.
 
-Requires `cloudflared` on `PATH` (`brew install cloudflared`). A quick tunnel needs no account but
-gets a new hostname on every start, so every restart means scanning again, and Cloudflare does not
-support SSE on quick tunnels, which breaks the workflow and runner-log plugin surfaces. A named
-tunnel on your own domain has neither problem and is the mode to use if you do this daily.
+Requires `cloudflared` on `PATH` (`brew install cloudflared`). A quick tunnel needs no account but gets a new
+hostname on every start. It does not provide a durable PWA, passkey, or Push identity, and Cloudflare does not
+support SSE on quick tunnels, which breaks workflow and runner-log plugin surfaces. Use a stable named tunnel
+for the Home Screen app.
+
+If a named tunnel's connector exits unexpectedly, the hub makes three backoff restart attempts and
+self-tests every replacement. The existing listener and paired sessions stay valid while recovery is
+in progress. A quick tunnel cannot recover transparently because its origin changes, so it still fails
+closed immediately. Exhausting named-tunnel recovery also switches remote access off and revokes the
+paired sessions.
 
 ### Passkeys and step-up
 
@@ -187,18 +217,20 @@ so rather than letting the ceremony fail in the browser.
 
 ### Tunnel-provider trust and payload privacy
 
-Cloudflare is a trusted delivery boundary. It terminates TLS and delivers both the pairing page and the
-cockpit SPA. A browser cannot independently verify its first executable page against the same edge that
-served it: a malicious replacement could omit any in-page verifier, read the QR fragment, and control a
-paired agent. DoomPi therefore does not claim that browser-side bundle signing protects against a
-compromised Cloudflare edge.
+Cloudflare terminates TLS and delivers the package-owned pairing and verifier bootstrap. A browser cannot
+independently authenticate that first executable shell against the same edge that served it: a malicious
+replacement could omit the worker and steal a QR fragment. DoomPi does not claim protection from a malicious
+code-delivery edge.
+
+After that bootstrap, **bundle signing is mandatory**. The QR pins the host ECDSA key and revision floor. The
+worker verifies the signed manifest plus every raw asset before any host JavaScript executes, serves only the
+atomically committed verified cache, and retains the last-known-good revision on failure. Cloudflare may
+alter the raw bytes, but altered bytes do not execute.
 
-Within that trust model, **the payload is sealed**. A QR carries an ephemeral P-256 public key alongside the
-pairing code, in the URL fragment, which no browser sends to any server. A returning device that proves a
-passkey receives the current public key in the successful authentication response instead. Both paths then
-complete ECDH and derive AES-256-GCM keys, separate per direction. Socket frames and API bodies travel as
-ciphertext. This limits routine relay visibility, but it still depends on Cloudflare delivering the intended
-pairing page and SPA.
+**The payload is also sealed.** A QR carries an ephemeral P-256 public key in the fragment. A returning
+passkey device restores its channel only after the pinned bundle worker accepts the same signer. Both paths
+complete ECDH and derive separate AES-256-GCM keys per direction. Socket frames and API bodies travel as
+ciphertext.
 
 The channel implementation lives in `@agimon-ai/doompi-web-security`, which ships the envelope contract,
 a `node:crypto` half, and a WebCrypto half. **A web plugin that calls `fetch` directly sends plaintext to
@@ -340,14 +372,17 @@ package declares a `doompiWeb` block in its package.json naming a client entry (
 definition: tab, panel, badge, session data channels, tool renderers for the timeline cards of
 the tools the package registers, slots it opens for other plugins, fills into slots others open,
 and the host's own slot contributions) and an optional hub entry (`webHubChannels` plus its built
-dist). This package's own bundle carries no plugins; the full set is assembled on your machine:
-`doompi sync` discovers the installed composition's manifests, generates the import entries, and
-rebuilds the SPA through the `./bundler` subpath into `~/.doompi/web/current`, which the server
-prefers over the packaged bundle (`--assets` and `DOOMPI_WEB_DIST` override it). The synced bundle
-carries `webPlugins.server.json` naming each plugin's built hub entry, imported lazily: a missing
-plugin package logs a notice and its tab shows an empty state. The subagents tab in
-`@agimon-ai/doompi-team` is the reference plugin; the workflows tab ships with
-`@agimon-ai/doompi-workflow`. Contracts come from `@agimon-ai/doompi-web-contracts`.
+dist). This package's own bundle carries no plugins; the full set is assembled on your machine.
+`doompi sync` discovers the installed composition's manifests, generates the import entries, and builds
+the SPA through the `./bundler` subpath inside the repository/worktree's immutable sync generation.
+The shared server uses the validated registration for its startup repository. `--assets` and
+`DOOMPI_WEB_DIST` override registered assets, then packaged assets provide the fallback. Server-only
+`webPlugins.server.json` sits beside the public `web/` directory, never inside the signed or served
+bundle. It names each plugin's built hub entry, imported lazily. A missing plugin package logs a notice
+and its tab is omitted. Session package API routes use the session `cwd` registration, while
+`DOOMPI_API_DIR` remains the explicit API override. `@agimon-ai/doompi-team` is the reference plugin;
+the workflows tab ships with `@agimon-ai/doompi-workflow`. Contracts come from
+`@agimon-ai/doompi-web-contracts`.
 
 A tool call's timeline item belongs to the plugin that registers the tool: its `toolRenderers`
 entry names the tool (or claims it with `matches` when the name is only known at runtime) and

package/dist/bin/serve.cjs

@@ -1,3 +1,3 @@
 #!/usr/bin/env node
-const e=require("../_virtual/_rolldown/runtime.cjs"),t=require("../src/services/registryStore.cjs"),n=require("../src/adapters/remoteAccessStore.cjs"),r=require("../src/adapters/httpServer.cjs"),i=require("../src/services/serveOptions.cjs"),a=require("../src/adapters/cockpitContainer.cjs"),o=require("../src/adapters/cockpitHandoff.cjs"),s=require("../src/adapters/hubProbe.cjs"),c=require("../src/adapters/sessionRelaunch.cjs");let l=require("node:os");l=e.__toESM(l,1);function u(e){process.stderr.write(`[doompi-web] ${e}\n`)}async function d(){let e=i.parseServeOptions(process.argv.slice(2)),o=`http://${e.host}:${String(e.port)}`,c=e.stateDir??n.defaultRemoteStateDir(),d=a.createCockpitContainer({stateDir:c,onNotice:u});if(await d.reapStale(),i.isLoopbackHost(e.host)||(u(`WARNING: --host ${e.host} is not loopback, so the cockpit is reachable without pairing.`),u(`WARNING: turn on remote access in settings instead, which requires a paired device.`)),await s.hubAnswers(e.host,e.port)){u(`cockpit already running at ${o}`);return}let p=async()=>{},m=async()=>{let n=await r.serveWeb({port:e.port,host:e.host,assetsDir:e.assetsDir,registryDir:t.resolveRegistryDir({flagValue:e.registryDir,envValue:process.env[t.REGISTRY_DIR_ENV],homeDir:l.default.homedir()}),spawnCommand:e.spawnCommand,remoteStateDir:c,cloudflaredPath:e.cloudflaredPath,onNotice:u,onHandover:t=>{f({serving:n,restart:m,container:d,handover:t,port:e.port,host:e.host,adopt:e=>{p=e}})}});return p=async()=>{await n.close()},n};try{await m()}catch(t){if(t.code!==`EADDRINUSE`)throw t;if(await s.hubAnswers(e.host,e.port)){u(`cockpit already running at ${o}`);return}throw Error(`Port ${String(e.port)} is taken by something that is not a DoomPi cockpit; pass --port.`)}let h=()=>{p().then(()=>{process.exit(0)})};process.on(`SIGINT`,h),process.on(`SIGTERM`,h)}async function f(e){await e.serving.close();let t=await e.container.start({workspaces:e.handover.settings.sandbox.workspaces.map(e=>({path:e})),port:e.port,onProgress:u});if(!t.ok){u(`the cockpit could not move into a container: ${t.error}`),u(`serving from the host again`),await e.restart(),await c.relaunchSessions({port:e.port,host:e.host,sessions:e.handover.sessions,onNotice:u});return}e.adopt(async()=>{await t.container.stop()}),await o.handOffRemoteAccess({port:e.port,settings:e.handover.settings,onNotice:u}),await c.relaunchSessions({port:e.port,sessions:e.handover.sessions,onNotice:u}),u(`supervising the cockpit container; Ctrl-C stops it`),await t.container.supervise()}d().catch(e=>{u(e instanceof Error?e.message:String(e)),process.exitCode=1});
+const e=require("../_virtual/_rolldown/runtime.cjs"),t=require("../src/services/registryStore.cjs"),n=require("../src/adapters/remoteAccessStore.cjs"),r=require("../src/adapters/httpServer.cjs"),i=require("../src/services/serveOptions.cjs"),a=require("../src/adapters/cockpitContainer.cjs"),o=require("../src/adapters/cockpitHandoff.cjs"),s=require("../src/adapters/doomInitialization.cjs"),c=require("../src/adapters/hubProbe.cjs"),l=require("../src/adapters/sessionRelaunch.cjs");let u=require("node:os");u=e.__toESM(u,1);function d(e){process.stderr.write(`[doompi-web] ${e}\n`)}async function f(e,t,n){try{process.kill(e,`SIGTERM`)}catch{}let r=Date.now()+1e4;for(;Date.now()<r;)if(await new Promise(e=>setTimeout(e,100)),!await c.hubAnswers(t,n))return!0;return!1}async function p(){let e=i.parseServeOptions(process.argv.slice(2));if(e.help){process.stdout.write(i.serveHelp());return}if(e.version){process.stdout.write(`${r.packagedVersion()}\n`);return}await s.ensureDoomInitialized({homeDirectory:u.default.homedir(),onNotice:d});let o=`http://${e.host}:${String(e.port)}`,l=e.stateDir??n.defaultRemoteStateDir(),p=a.createCockpitContainer({stateDir:l,onNotice:d});await p.reapStale(),i.isLoopbackHost(e.host)||(d(`WARNING: --host ${e.host} is not loopback, so the cockpit is reachable without pairing.`),d(`WARNING: turn on remote access in settings instead, which requires a paired device.`));let h=await c.probeHub(e.host,e.port);if(h!==void 0){let t=r.packagedVersion(),n=h.version??`an older build`;if(h.version===t){d(`cockpit already running at ${o}`);return}if(h.sessions>0){d(`WARNING: ${n} is already running at ${o} with ${String(h.sessions)} live session(s).`),d(`WARNING: stop it and run again to serve ${t}; refusing to interrupt running work.`);return}if(h.pid===void 0||!i.isLoopbackHost(e.host)){d(`WARNING: ${n} is already running at ${o} and cannot be replaced automatically.`),d(`WARNING: stop it and run again to serve ${t}.`);return}if(d(`replacing ${n} at ${o} with ${t}`),!await f(h.pid,e.host,e.port)){d(`WARNING: the hub at ${o} did not stop; serve ${t} on another port with --port.`);return}}let g=async()=>{},_=async()=>{let n=await r.serveWeb({port:e.port,host:e.host,assetsDir:e.assetsDir,compositionDir:e.directory,registryDir:t.resolveRegistryDir({flagValue:e.registryDir,envValue:process.env[t.REGISTRY_DIR_ENV],homeDir:u.default.homedir()}),spawnCommand:e.spawnCommand,remoteStateDir:l,cloudflaredPath:e.cloudflaredPath,onNotice:d,onHandover:t=>{m({serving:n,restart:_,container:p,handover:t,port:e.port,host:e.host,adopt:e=>{g=e}})}});return g=async()=>{await n.close()},n};try{await _()}catch(t){if(t.code!==`EADDRINUSE`)throw t;if(await c.hubAnswers(e.host,e.port)){d(`cockpit already running at ${o}`);return}throw Error(`Port ${String(e.port)} is taken by something that is not a DoomPi cockpit; pass --port.`)}let v=()=>{g().then(()=>{process.exit(0)})};process.on(`SIGINT`,v),process.on(`SIGTERM`,v)}async function m(e){await e.serving.close();let t=await e.container.start({workspaces:e.handover.settings.sandbox.workspaces.map(e=>({path:e})),port:e.port,onProgress:d});if(!t.ok){d(`the cockpit could not move into a container: ${t.error}`),d(`serving from the host again`),await e.restart(),await l.relaunchSessions({port:e.port,host:e.host,sessions:e.handover.sessions,onNotice:d});return}e.adopt(async()=>{await t.container.stop()}),await o.handOffRemoteAccess({port:e.port,settings:e.handover.settings,onNotice:d}),await l.relaunchSessions({port:e.port,sessions:e.handover.sessions,onNotice:d}),d(`supervising the cockpit container; Ctrl-C stops it`),await t.container.supervise()}p().catch(e=>{d(e instanceof Error?e.message:String(e)),process.exitCode=1});
 //# sourceMappingURL=serve.cjs.map

package/dist/bin/serve.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"serve.cjs","names":["parseServeOptions","defaultRemoteStateDir","createCockpitContainer","isLoopbackHost","hubAnswers","serveWeb","resolveRegistryDir","REGISTRY_DIR_ENV","os","relaunchSessions","handOffRemoteAccess"],"sources":["../../src/bin/serve.ts"],"sourcesContent":["#!/usr/bin/env node\n\nimport os from 'node:os';\nimport { createCockpitContainer } from '../adapters/cockpitContainer.ts';\nimport { handOffRemoteAccess } from '../adapters/cockpitHandoff.ts';\nimport { hubAnswers } from '../adapters/hubProbe.ts';\nimport { serveWeb } from '../adapters/httpServer.ts';\nimport { defaultRemoteStateDir } from '../adapters/remoteAccessStore.ts';\nimport { relaunchSessions } from '../adapters/sessionRelaunch.ts';\nimport { REGISTRY_DIR_ENV, resolveRegistryDir } from '../services/registryStore.ts';\nimport { isLoopbackHost, parseServeOptions } from '../services/serveOptions.ts';\nimport type { WebServer } from '../types/bridge.ts';\nimport type { MigratingSession, RemoteAccessSettings } from '../types/remoteAccess.ts';\n\nconst ADDRESS_IN_USE = 'EADDRINUSE';\n\nfunction notice(message: string): void {\n  process.stderr.write(`[doompi-web] ${message}\\n`);\n}\n\nasync function main(): Promise<void> {\n  const options = parseServeOptions(process.argv.slice(2));\n  const url = `http://${options.host}:${String(options.port)}`;\n  const stateDir = options.stateDir ?? defaultRemoteStateDir();\n  const container = createCockpitContainer({ stateDir, onNotice: notice });\n  // A cockpit that was killed rather than closed leaves its container holding\n  // the published port, so the next start would fail to bind for a reason\n  // nothing explains.\n  await container.reapStale();\n\n  // Binding off loopback publishes an unauthenticated cockpit to whoever can\n  // reach the address. Remote access exists so nobody has to do this; a warning\n  // rather than a refusal, because an existing setup should not break today.\n  if (!isLoopbackHost(options.host)) {\n    notice(`WARNING: --host ${options.host} is not loopback, so the cockpit is reachable without pairing.`);\n    notice('WARNING: turn on remote access in settings instead, which requires a paired device.');\n  }\n\n  // One hub serves every session, so a second start is a request to use the\n  // running one, not an error worth a stack trace.\n  if (await hubAnswers(options.host, options.port)) {\n    notice(`cockpit already running at ${url}`);\n    return;\n  }\n\n  /**\n   * What Ctrl-C stops, which is not the same thing throughout the run.\n   *\n   * A single indirection rather than swapping signal handlers, so the handover\n   * never has to reach for `removeAllListeners` and take out whatever else this\n   * process has registered.\n   */\n  let shutDown: () => Promise<void> = async () => {};\n\n  const start = async (): Promise<WebServer> => {\n    const server = await serveWeb({\n      port: options.port,\n      host: options.host,\n      assetsDir: options.assetsDir,\n      registryDir: resolveRegistryDir({\n        flagValue: options.registryDir,\n        envValue: process.env[REGISTRY_DIR_ENV],\n        homeDir: os.homedir(),\n      }),\n      spawnCommand: options.spawnCommand,\n      remoteStateDir: stateDir,\n      cloudflaredPath: options.cloudflaredPath,\n      onNotice: notice,\n      // Already deferred past its own response by the route that asked, so by\n      // the time this runs the caller has its answer and the server can go.\n      onHandover: (handover) => {\n        void handOver({\n          serving: server,\n          restart: start,\n          container,\n          handover,\n          port: options.port,\n          host: options.host,\n          adopt: (next) => {\n            shutDown = next;\n          },\n        });\n      },\n    });\n    shutDown = async () => {\n      await server.close();\n    };\n    return server;\n  };\n\n  try {\n    await start();\n  } catch (error) {\n    // Two cockpits starting together can both find the port free; the loser\n    // settles for the winner rather than reporting a clash nobody caused.\n    if ((error as NodeJS.ErrnoException).code !== ADDRESS_IN_USE) throw error;\n    if (await hubAnswers(options.host, options.port)) {\n      notice(`cockpit already running at ${url}`);\n      return;\n    }\n    throw new Error(`Port ${String(options.port)} is taken by something that is not a DoomPi cockpit; pass --port.`);\n  }\n\n  const stop = (): void => {\n    void shutDown().then(() => {\n      process.exit(0);\n    });\n  };\n  process.on('SIGINT', stop);\n  process.on('SIGTERM', stop);\n}\n\n/**\n * Hands this cockpit over to one running in a container.\n *\n * The port has to be free before the container can publish onto it, so the\n * order is: stop serving, start the container, and put the host cockpit back if\n * the container does not come up. Leaving the user with nothing listening would\n * be the worst outcome of the three, which is why the rollback also recreates\n * the sessions that were stopped in preparation for a move that did not happen.\n */\nasync function handOver(input: {\n  serving: WebServer;\n  restart: () => Promise<WebServer>;\n  container: ReturnType<typeof createCockpitContainer>;\n  handover: { settings: RemoteAccessSettings; sessions: readonly MigratingSession[] };\n  port: number;\n  host: string;\n  adopt: (shutDown: () => Promise<void>) => void;\n}): Promise<void> {\n  await input.serving.close();\n  const started = await input.container.start({\n    workspaces: input.handover.settings.sandbox.workspaces.map((workspace) => ({ path: workspace })),\n    port: input.port,\n    onProgress: notice,\n  });\n  if (!started.ok) {\n    notice(`the cockpit could not move into a container: ${started.error}`);\n    notice('serving from the host again');\n    await input.restart();\n    await relaunchSessions({\n      port: input.port,\n      host: input.host,\n      sessions: input.handover.sessions,\n      onNotice: notice,\n    });\n    return;\n  }\n  input.adopt(async () => {\n    await started.container.stop();\n  });\n  // The container answers its own health probe before `start` resolves, so its\n  // hub is already there to take the settings and the sessions.\n  await handOffRemoteAccess({ port: input.port, settings: input.handover.settings, onNotice: notice });\n  await relaunchSessions({ port: input.port, sessions: input.handover.sessions, onNotice: notice });\n  // Nothing else holds this process open now that its server is closed, and a\n  // supervisor that exits leaves a container nobody will ever stop.\n  notice('supervising the cockpit container; Ctrl-C stops it');\n  await started.container.supervise();\n}\n\nmain().catch((error: unknown) => {\n  notice(error instanceof Error ? error.message : String(error));\n  process.exitCode = 1;\n});\n"],"mappings":";wdAgBA,SAAS,EAAO,EAAuB,CACrC,QAAQ,OAAO,MAAM,gBAAgB,EAAQ,GAAG,CAClD,CAEA,eAAe,GAAsB,CACnC,IAAM,EAAUA,EAAAA,kBAAkB,QAAQ,KAAK,MAAM,CAAC,CAAC,EACjD,EAAM,UAAU,EAAQ,KAAK,GAAG,OAAO,EAAQ,IAAI,IACnD,EAAW,EAAQ,UAAYC,EAAAA,sBAAsB,EACrD,EAAYC,EAAAA,uBAAuB,CAAE,WAAU,SAAU,CAAO,CAAC,EAgBvE,GAZA,MAAM,EAAU,UAAU,EAKrBC,EAAAA,eAAe,EAAQ,IAAI,IAC9B,EAAO,mBAAmB,EAAQ,KAAK,+DAA+D,EACtG,EAAO,qFAAqF,GAK1F,MAAMC,EAAAA,WAAW,EAAQ,KAAM,EAAQ,IAAI,EAAG,CAChD,EAAO,8BAA8B,GAAK,EAC1C,MACF,CASA,IAAI,EAAgC,SAAY,CAAC,EAE3C,EAAQ,SAAgC,CAC5C,IAAM,EAAS,MAAMC,EAAAA,SAAS,CAC5B,KAAM,EAAQ,KACd,KAAM,EAAQ,KACd,UAAW,EAAQ,UACnB,YAAaC,EAAAA,mBAAmB,CAC9B,UAAW,EAAQ,YACnB,SAAU,QAAQ,IAAIC,EAAAA,kBACtB,QAASC,EAAAA,QAAG,QAAQ,CACtB,CAAC,EACD,aAAc,EAAQ,aACtB,eAAgB,EAChB,gBAAiB,EAAQ,gBACzB,SAAU,EAGV,WAAa,GAAa,CACxB,EAAc,CACZ,QAAS,EACT,QAAS,EACT,YACA,WACA,KAAM,EAAQ,KACd,KAAM,EAAQ,KACd,MAAQ,GAAS,CACf,EAAW,CACb,CACF,CAAC,CACH,CACF,CAAC,EAID,MAHA,GAAW,SAAY,CACrB,MAAM,EAAO,MAAM,CACrB,EACO,CACT,EAEA,GAAI,CACF,MAAM,EAAM,CACd,OAAS,EAAO,CAGd,GAAK,EAAgC,OAAS,aAAgB,MAAM,EACpE,GAAI,MAAMJ,EAAAA,WAAW,EAAQ,KAAM,EAAQ,IAAI,EAAG,CAChD,EAAO,8BAA8B,GAAK,EAC1C,MACF,CACA,MAAU,MAAM,QAAQ,OAAO,EAAQ,IAAI,EAAE,kEAAkE,CACjH,CAEA,IAAM,MAAmB,CACvB,EAAc,CAAC,CAAC,SAAW,CACzB,QAAQ,KAAK,CAAC,CAChB,CAAC,CACH,EACA,QAAQ,GAAG,SAAU,CAAI,EACzB,QAAQ,GAAG,UAAW,CAAI,CAC5B,CAWA,eAAe,EAAS,EAQN,CAChB,MAAM,EAAM,QAAQ,MAAM,EAC1B,IAAM,EAAU,MAAM,EAAM,UAAU,MAAM,CAC1C,WAAY,EAAM,SAAS,SAAS,QAAQ,WAAW,IAAK,IAAe,CAAE,KAAM,CAAU,EAAE,EAC/F,KAAM,EAAM,KACZ,WAAY,CACd,CAAC,EACD,GAAI,CAAC,EAAQ,GAAI,CACf,EAAO,gDAAgD,EAAQ,OAAO,EACtE,EAAO,6BAA6B,EACpC,MAAM,EAAM,QAAQ,EACpB,MAAMK,EAAAA,iBAAiB,CACrB,KAAM,EAAM,KACZ,KAAM,EAAM,KACZ,SAAU,EAAM,SAAS,SACzB,SAAU,CACZ,CAAC,EACD,MACF,CACA,EAAM,MAAM,SAAY,CACtB,MAAM,EAAQ,UAAU,KAAK,CAC/B,CAAC,EAGD,MAAMC,EAAAA,oBAAoB,CAAE,KAAM,EAAM,KAAM,SAAU,EAAM,SAAS,SAAU,SAAU,CAAO,CAAC,EACnG,MAAMD,EAAAA,iBAAiB,CAAE,KAAM,EAAM,KAAM,SAAU,EAAM,SAAS,SAAU,SAAU,CAAO,CAAC,EAGhG,EAAO,oDAAoD,EAC3D,MAAM,EAAQ,UAAU,UAAU,CACpC,CAEA,EAAK,CAAC,CAAC,MAAO,GAAmB,CAC/B,EAAO,aAAiB,MAAQ,EAAM,QAAU,OAAO,CAAK,CAAC,EAC7D,QAAQ,SAAW,CACrB,CAAC"}
+{"version":3,"file":"serve.cjs","names":["hubAnswers","parseServeOptions","serveHelp","packagedVersion","ensureDoomInitialized","os","defaultRemoteStateDir","createCockpitContainer","isLoopbackHost","probeHub","serveWeb","resolveRegistryDir","REGISTRY_DIR_ENV","relaunchSessions","handOffRemoteAccess"],"sources":["../../src/bin/serve.ts"],"sourcesContent":["#!/usr/bin/env node\n\nimport os from 'node:os';\nimport { createCockpitContainer } from '../adapters/cockpitContainer.ts';\nimport { handOffRemoteAccess } from '../adapters/cockpitHandoff.ts';\nimport { ensureDoomInitialized } from '../adapters/doomInitialization.ts';\nimport { hubAnswers, probeHub } from '../adapters/hubProbe.ts';\nimport { packagedVersion, serveWeb } from '../adapters/httpServer.ts';\nimport { defaultRemoteStateDir } from '../adapters/remoteAccessStore.ts';\nimport { relaunchSessions } from '../adapters/sessionRelaunch.ts';\nimport { REGISTRY_DIR_ENV, resolveRegistryDir } from '../services/registryStore.ts';\nimport { isLoopbackHost, parseServeOptions, serveHelp } from '../services/serveOptions.ts';\nimport type { WebServer } from '../types/bridge.ts';\nimport type { MigratingSession, RemoteAccessSettings } from '../types/remoteAccess.ts';\n\nconst ADDRESS_IN_USE = 'EADDRINUSE';\nconst STOP_POLL_MS = 100;\nconst STOP_TIMEOUT_MS = 10_000;\n\nfunction notice(message: string): void {\n  process.stderr.write(`[doompi-web] ${message}\\n`);\n}\n\n/**\n * Signals the running hub and waits for the address to go quiet.\n *\n * Only ever called for a loopback address, because the pid on the other end of\n * the probe is only this machine's pid when the hub is on this machine.\n */\nasync function stopRunningHub(pid: number, host: string, port: number): Promise<boolean> {\n  try {\n    process.kill(pid, 'SIGTERM');\n  } catch {\n    // Already gone, or not ours to signal. The probe below settles it either way.\n  }\n  const deadline = Date.now() + STOP_TIMEOUT_MS;\n  while (Date.now() < deadline) {\n    await new Promise((resolve) => setTimeout(resolve, STOP_POLL_MS));\n    if (!(await hubAnswers(host, port))) return true;\n  }\n  return false;\n}\n\nasync function main(): Promise<void> {\n  const options = parseServeOptions(process.argv.slice(2));\n  if (options.help) {\n    process.stdout.write(serveHelp());\n    return;\n  }\n  if (options.version) {\n    process.stdout.write(`${packagedVersion()}\\n`);\n    return;\n  }\n  await ensureDoomInitialized({ homeDirectory: os.homedir(), onNotice: notice });\n  const url = `http://${options.host}:${String(options.port)}`;\n  const stateDir = options.stateDir ?? defaultRemoteStateDir();\n  const container = createCockpitContainer({ stateDir, onNotice: notice });\n  // A cockpit that was killed rather than closed leaves its container holding\n  // the published port, so the next start would fail to bind for a reason\n  // nothing explains.\n  await container.reapStale();\n\n  // Binding off loopback publishes an unauthenticated cockpit to whoever can\n  // reach the address. Remote access exists so nobody has to do this; a warning\n  // rather than a refusal, because an existing setup should not break today.\n  if (!isLoopbackHost(options.host)) {\n    notice(`WARNING: --host ${options.host} is not loopback, so the cockpit is reachable without pairing.`);\n    notice('WARNING: turn on remote access in settings instead, which requires a paired device.');\n  }\n\n  // One hub serves every session, so a second start is normally a request to\n  // use the running one. A second start from a *different* version is not: a\n  // long-lived hub signs its asset directory once, so handing back to it would\n  // serve the older cockpit for as long as it lives, and a browser that already\n  // verified that bundle would never be offered a newer one.\n  const running = await probeHub(options.host, options.port);\n  if (running !== undefined) {\n    const mine = packagedVersion();\n    const theirs = running.version ?? 'an older build';\n    if (running.version === mine) {\n      notice(`cockpit already running at ${url}`);\n      return;\n    }\n    if (running.sessions > 0) {\n      notice(`WARNING: ${theirs} is already running at ${url} with ${String(running.sessions)} live session(s).`);\n      notice(`WARNING: stop it and run again to serve ${mine}; refusing to interrupt running work.`);\n      return;\n    }\n    if (running.pid === undefined || !isLoopbackHost(options.host)) {\n      notice(`WARNING: ${theirs} is already running at ${url} and cannot be replaced automatically.`);\n      notice(`WARNING: stop it and run again to serve ${mine}.`);\n      return;\n    }\n    notice(`replacing ${theirs} at ${url} with ${mine}`);\n    if (!(await stopRunningHub(running.pid, options.host, options.port))) {\n      notice(`WARNING: the hub at ${url} did not stop; serve ${mine} on another port with --port.`);\n      return;\n    }\n  }\n\n  /**\n   * What Ctrl-C stops, which is not the same thing throughout the run.\n   *\n   * A single indirection rather than swapping signal handlers, so the handover\n   * never has to reach for `removeAllListeners` and take out whatever else this\n   * process has registered.\n   */\n  let shutDown: () => Promise<void> = async () => {};\n\n  const start = async (): Promise<WebServer> => {\n    const server = await serveWeb({\n      port: options.port,\n      host: options.host,\n      assetsDir: options.assetsDir,\n      compositionDir: options.directory,\n      registryDir: resolveRegistryDir({\n        flagValue: options.registryDir,\n        envValue: process.env[REGISTRY_DIR_ENV],\n        homeDir: os.homedir(),\n      }),\n      spawnCommand: options.spawnCommand,\n      remoteStateDir: stateDir,\n      cloudflaredPath: options.cloudflaredPath,\n      onNotice: notice,\n      // Already deferred past its own response by the route that asked, so by\n      // the time this runs the caller has its answer and the server can go.\n      onHandover: (handover) => {\n        void handOver({\n          serving: server,\n          restart: start,\n          container,\n          handover,\n          port: options.port,\n          host: options.host,\n          adopt: (next) => {\n            shutDown = next;\n          },\n        });\n      },\n    });\n    shutDown = async () => {\n      await server.close();\n    };\n    return server;\n  };\n\n  try {\n    await start();\n  } catch (error) {\n    // Two cockpits starting together can both find the port free; the loser\n    // settles for the winner rather than reporting a clash nobody caused.\n    if ((error as NodeJS.ErrnoException).code !== ADDRESS_IN_USE) throw error;\n    if (await hubAnswers(options.host, options.port)) {\n      notice(`cockpit already running at ${url}`);\n      return;\n    }\n    throw new Error(`Port ${String(options.port)} is taken by something that is not a DoomPi cockpit; pass --port.`);\n  }\n\n  const stop = (): void => {\n    void shutDown().then(() => {\n      process.exit(0);\n    });\n  };\n  process.on('SIGINT', stop);\n  process.on('SIGTERM', stop);\n}\n\n/**\n * Hands this cockpit over to one running in a container.\n *\n * The port has to be free before the container can publish onto it, so the\n * order is: stop serving, start the container, and put the host cockpit back if\n * the container does not come up. Leaving the user with nothing listening would\n * be the worst outcome of the three, which is why the rollback also recreates\n * the sessions that were stopped in preparation for a move that did not happen.\n */\nasync function handOver(input: {\n  serving: WebServer;\n  restart: () => Promise<WebServer>;\n  container: ReturnType<typeof createCockpitContainer>;\n  handover: { settings: RemoteAccessSettings; sessions: readonly MigratingSession[] };\n  port: number;\n  host: string;\n  adopt: (shutDown: () => Promise<void>) => void;\n}): Promise<void> {\n  await input.serving.close();\n  const started = await input.container.start({\n    workspaces: input.handover.settings.sandbox.workspaces.map((workspace) => ({ path: workspace })),\n    port: input.port,\n    onProgress: notice,\n  });\n  if (!started.ok) {\n    notice(`the cockpit could not move into a container: ${started.error}`);\n    notice('serving from the host again');\n    await input.restart();\n    await relaunchSessions({\n      port: input.port,\n      host: input.host,\n      sessions: input.handover.sessions,\n      onNotice: notice,\n    });\n    return;\n  }\n  input.adopt(async () => {\n    await started.container.stop();\n  });\n  // The container answers its own health probe before `start` resolves, so its\n  // hub is already there to take the settings and the sessions.\n  await handOffRemoteAccess({ port: input.port, settings: input.handover.settings, onNotice: notice });\n  await relaunchSessions({ port: input.port, sessions: input.handover.sessions, onNotice: notice });\n  // Nothing else holds this process open now that its server is closed, and a\n  // supervisor that exits leaves a container nobody will ever stop.\n  notice('supervising the cockpit container; Ctrl-C stops it');\n  await started.container.supervise();\n}\n\nmain().catch((error: unknown) => {\n  notice(error instanceof Error ? error.message : String(error));\n  process.exitCode = 1;\n});\n"],"mappings":";4gBAmBA,SAAS,EAAO,EAAuB,CACrC,QAAQ,OAAO,MAAM,gBAAgB,EAAQ,GAAG,CAClD,CAQA,eAAe,EAAe,EAAa,EAAc,EAAgC,CACvF,GAAI,CACF,QAAQ,KAAK,EAAK,SAAS,CAC7B,MAAQ,CAER,CACA,IAAM,EAAW,KAAK,IAAI,EAAI,IAC9B,KAAO,KAAK,IAAI,EAAI,GAElB,GADA,MAAM,IAAI,QAAS,GAAY,WAAW,EAAS,GAAY,CAAC,EAC5D,CAAE,MAAMA,EAAAA,WAAW,EAAM,CAAI,EAAI,MAAO,GAE9C,MAAO,EACT,CAEA,eAAe,GAAsB,CACnC,IAAM,EAAUC,EAAAA,kBAAkB,QAAQ,KAAK,MAAM,CAAC,CAAC,EACvD,GAAI,EAAQ,KAAM,CAChB,QAAQ,OAAO,MAAMC,EAAAA,UAAU,CAAC,EAChC,MACF,CACA,GAAI,EAAQ,QAAS,CACnB,QAAQ,OAAO,MAAM,GAAGC,EAAAA,gBAAgB,EAAE,GAAG,EAC7C,MACF,CACA,MAAMC,EAAAA,sBAAsB,CAAE,cAAeC,EAAAA,QAAG,QAAQ,EAAG,SAAU,CAAO,CAAC,EAC7E,IAAM,EAAM,UAAU,EAAQ,KAAK,GAAG,OAAO,EAAQ,IAAI,IACnD,EAAW,EAAQ,UAAYC,EAAAA,sBAAsB,EACrD,EAAYC,EAAAA,uBAAuB,CAAE,WAAU,SAAU,CAAO,CAAC,EAIvE,MAAM,EAAU,UAAU,EAKrBC,EAAAA,eAAe,EAAQ,IAAI,IAC9B,EAAO,mBAAmB,EAAQ,KAAK,+DAA+D,EACtG,EAAO,qFAAqF,GAQ9F,IAAM,EAAU,MAAMC,EAAAA,SAAS,EAAQ,KAAM,EAAQ,IAAI,EACzD,GAAI,IAAY,IAAA,GAAW,CACzB,IAAM,EAAON,EAAAA,gBAAgB,EACvB,EAAS,EAAQ,SAAW,iBAClC,GAAI,EAAQ,UAAY,EAAM,CAC5B,EAAO,8BAA8B,GAAK,EAC1C,MACF,CACA,GAAI,EAAQ,SAAW,EAAG,CACxB,EAAO,YAAY,EAAO,yBAAyB,EAAI,QAAQ,OAAO,EAAQ,QAAQ,EAAE,kBAAkB,EAC1G,EAAO,2CAA2C,EAAK,sCAAsC,EAC7F,MACF,CACA,GAAI,EAAQ,MAAQ,IAAA,IAAa,CAACK,EAAAA,eAAe,EAAQ,IAAI,EAAG,CAC9D,EAAO,YAAY,EAAO,yBAAyB,EAAI,uCAAuC,EAC9F,EAAO,2CAA2C,EAAK,EAAE,EACzD,MACF,CAEA,GADA,EAAO,aAAa,EAAO,MAAM,EAAI,QAAQ,GAAM,EAC/C,CAAE,MAAM,EAAe,EAAQ,IAAK,EAAQ,KAAM,EAAQ,IAAI,EAAI,CACpE,EAAO,uBAAuB,EAAI,uBAAuB,EAAK,8BAA8B,EAC5F,MACF,CACF,CASA,IAAI,EAAgC,SAAY,CAAC,EAE3C,EAAQ,SAAgC,CAC5C,IAAM,EAAS,MAAME,EAAAA,SAAS,CAC5B,KAAM,EAAQ,KACd,KAAM,EAAQ,KACd,UAAW,EAAQ,UACnB,eAAgB,EAAQ,UACxB,YAAaC,EAAAA,mBAAmB,CAC9B,UAAW,EAAQ,YACnB,SAAU,QAAQ,IAAIC,EAAAA,kBACtB,QAASP,EAAAA,QAAG,QAAQ,CACtB,CAAC,EACD,aAAc,EAAQ,aACtB,eAAgB,EAChB,gBAAiB,EAAQ,gBACzB,SAAU,EAGV,WAAa,GAAa,CACxB,EAAc,CACZ,QAAS,EACT,QAAS,EACT,YACA,WACA,KAAM,EAAQ,KACd,KAAM,EAAQ,KACd,MAAQ,GAAS,CACf,EAAW,CACb,CACF,CAAC,CACH,CACF,CAAC,EAID,MAHA,GAAW,SAAY,CACrB,MAAM,EAAO,MAAM,CACrB,EACO,CACT,EAEA,GAAI,CACF,MAAM,EAAM,CACd,OAAS,EAAO,CAGd,GAAK,EAAgC,OAAS,aAAgB,MAAM,EACpE,GAAI,MAAML,EAAAA,WAAW,EAAQ,KAAM,EAAQ,IAAI,EAAG,CAChD,EAAO,8BAA8B,GAAK,EAC1C,MACF,CACA,MAAU,MAAM,QAAQ,OAAO,EAAQ,IAAI,EAAE,kEAAkE,CACjH,CAEA,IAAM,MAAmB,CACvB,EAAc,CAAC,CAAC,SAAW,CACzB,QAAQ,KAAK,CAAC,CAChB,CAAC,CACH,EACA,QAAQ,GAAG,SAAU,CAAI,EACzB,QAAQ,GAAG,UAAW,CAAI,CAC5B,CAWA,eAAe,EAAS,EAQN,CAChB,MAAM,EAAM,QAAQ,MAAM,EAC1B,IAAM,EAAU,MAAM,EAAM,UAAU,MAAM,CAC1C,WAAY,EAAM,SAAS,SAAS,QAAQ,WAAW,IAAK,IAAe,CAAE,KAAM,CAAU,EAAE,EAC/F,KAAM,EAAM,KACZ,WAAY,CACd,CAAC,EACD,GAAI,CAAC,EAAQ,GAAI,CACf,EAAO,gDAAgD,EAAQ,OAAO,EACtE,EAAO,6BAA6B,EACpC,MAAM,EAAM,QAAQ,EACpB,MAAMa,EAAAA,iBAAiB,CACrB,KAAM,EAAM,KACZ,KAAM,EAAM,KACZ,SAAU,EAAM,SAAS,SACzB,SAAU,CACZ,CAAC,EACD,MACF,CACA,EAAM,MAAM,SAAY,CACtB,MAAM,EAAQ,UAAU,KAAK,CAC/B,CAAC,EAGD,MAAMC,EAAAA,oBAAoB,CAAE,KAAM,EAAM,KAAM,SAAU,EAAM,SAAS,SAAU,SAAU,CAAO,CAAC,EACnG,MAAMD,EAAAA,iBAAiB,CAAE,KAAM,EAAM,KAAM,SAAU,EAAM,SAAS,SAAU,SAAU,CAAO,CAAC,EAGhG,EAAO,oDAAoD,EAC3D,MAAM,EAAQ,UAAU,UAAU,CACpC,CAEA,EAAK,CAAC,CAAC,MAAO,GAAmB,CAC/B,EAAO,aAAiB,MAAQ,EAAM,QAAU,OAAO,CAAK,CAAC,EAC7D,QAAQ,SAAW,CACrB,CAAC"}

package/dist/bin/serve.mjs

@@ -1,3 +1,3 @@
 #!/usr/bin/env node
-import{REGISTRY_DIR_ENV as e,resolveRegistryDir as t}from"../src/services/registryStore.mjs";import{defaultRemoteStateDir as n}from"../src/adapters/remoteAccessStore.mjs";import{serveWeb as r}from"../src/adapters/httpServer.mjs";import{isLoopbackHost as i,parseServeOptions as a}from"../src/services/serveOptions.mjs";import{createCockpitContainer as o}from"../src/adapters/cockpitContainer.mjs";import{handOffRemoteAccess as s}from"../src/adapters/cockpitHandoff.mjs";import{hubAnswers as c}from"../src/adapters/hubProbe.mjs";import{relaunchSessions as l}from"../src/adapters/sessionRelaunch.mjs";import u from"node:os";function d(e){process.stderr.write(`[doompi-web] ${e}\n`)}async function f(){let s=a(process.argv.slice(2)),l=`http://${s.host}:${String(s.port)}`,f=s.stateDir??n(),m=o({stateDir:f,onNotice:d});if(await m.reapStale(),i(s.host)||(d(`WARNING: --host ${s.host} is not loopback, so the cockpit is reachable without pairing.`),d(`WARNING: turn on remote access in settings instead, which requires a paired device.`)),await c(s.host,s.port)){d(`cockpit already running at ${l}`);return}let h=async()=>{},g=async()=>{let n=await r({port:s.port,host:s.host,assetsDir:s.assetsDir,registryDir:t({flagValue:s.registryDir,envValue:process.env[e],homeDir:u.homedir()}),spawnCommand:s.spawnCommand,remoteStateDir:f,cloudflaredPath:s.cloudflaredPath,onNotice:d,onHandover:e=>{p({serving:n,restart:g,container:m,handover:e,port:s.port,host:s.host,adopt:e=>{h=e}})}});return h=async()=>{await n.close()},n};try{await g()}catch(e){if(e.code!==`EADDRINUSE`)throw e;if(await c(s.host,s.port)){d(`cockpit already running at ${l}`);return}throw Error(`Port ${String(s.port)} is taken by something that is not a DoomPi cockpit; pass --port.`)}let _=()=>{h().then(()=>{process.exit(0)})};process.on(`SIGINT`,_),process.on(`SIGTERM`,_)}async function p(e){await e.serving.close();let t=await e.container.start({workspaces:e.handover.settings.sandbox.workspaces.map(e=>({path:e})),port:e.port,onProgress:d});if(!t.ok){d(`the cockpit could not move into a container: ${t.error}`),d(`serving from the host again`),await e.restart(),await l({port:e.port,host:e.host,sessions:e.handover.sessions,onNotice:d});return}e.adopt(async()=>{await t.container.stop()}),await s({port:e.port,settings:e.handover.settings,onNotice:d}),await l({port:e.port,sessions:e.handover.sessions,onNotice:d}),d(`supervising the cockpit container; Ctrl-C stops it`),await t.container.supervise()}f().catch(e=>{d(e instanceof Error?e.message:String(e)),process.exitCode=1});export{};
+import{REGISTRY_DIR_ENV as e,resolveRegistryDir as t}from"../src/services/registryStore.mjs";import{defaultRemoteStateDir as n}from"../src/adapters/remoteAccessStore.mjs";import{packagedVersion as r,serveWeb as i}from"../src/adapters/httpServer.mjs";import{isLoopbackHost as a,parseServeOptions as o,serveHelp as s}from"../src/services/serveOptions.mjs";import{createCockpitContainer as c}from"../src/adapters/cockpitContainer.mjs";import{handOffRemoteAccess as l}from"../src/adapters/cockpitHandoff.mjs";import{ensureDoomInitialized as u}from"../src/adapters/doomInitialization.mjs";import{hubAnswers as d,probeHub as f}from"../src/adapters/hubProbe.mjs";import{relaunchSessions as p}from"../src/adapters/sessionRelaunch.mjs";import m from"node:os";function h(e){process.stderr.write(`[doompi-web] ${e}\n`)}async function g(e,t,n){try{process.kill(e,`SIGTERM`)}catch{}let r=Date.now()+1e4;for(;Date.now()<r;)if(await new Promise(e=>setTimeout(e,100)),!await d(t,n))return!0;return!1}async function _(){let l=o(process.argv.slice(2));if(l.help){process.stdout.write(s());return}if(l.version){process.stdout.write(`${r()}\n`);return}await u({homeDirectory:m.homedir(),onNotice:h});let p=`http://${l.host}:${String(l.port)}`,_=l.stateDir??n(),y=c({stateDir:_,onNotice:h});await y.reapStale(),a(l.host)||(h(`WARNING: --host ${l.host} is not loopback, so the cockpit is reachable without pairing.`),h(`WARNING: turn on remote access in settings instead, which requires a paired device.`));let b=await f(l.host,l.port);if(b!==void 0){let e=r(),t=b.version??`an older build`;if(b.version===e){h(`cockpit already running at ${p}`);return}if(b.sessions>0){h(`WARNING: ${t} is already running at ${p} with ${String(b.sessions)} live session(s).`),h(`WARNING: stop it and run again to serve ${e}; refusing to interrupt running work.`);return}if(b.pid===void 0||!a(l.host)){h(`WARNING: ${t} is already running at ${p} and cannot be replaced automatically.`),h(`WARNING: stop it and run again to serve ${e}.`);return}if(h(`replacing ${t} at ${p} with ${e}`),!await g(b.pid,l.host,l.port)){h(`WARNING: the hub at ${p} did not stop; serve ${e} on another port with --port.`);return}}let x=async()=>{},S=async()=>{let n=await i({port:l.port,host:l.host,assetsDir:l.assetsDir,compositionDir:l.directory,registryDir:t({flagValue:l.registryDir,envValue:process.env[e],homeDir:m.homedir()}),spawnCommand:l.spawnCommand,remoteStateDir:_,cloudflaredPath:l.cloudflaredPath,onNotice:h,onHandover:e=>{v({serving:n,restart:S,container:y,handover:e,port:l.port,host:l.host,adopt:e=>{x=e}})}});return x=async()=>{await n.close()},n};try{await S()}catch(e){if(e.code!==`EADDRINUSE`)throw e;if(await d(l.host,l.port)){h(`cockpit already running at ${p}`);return}throw Error(`Port ${String(l.port)} is taken by something that is not a DoomPi cockpit; pass --port.`)}let C=()=>{x().then(()=>{process.exit(0)})};process.on(`SIGINT`,C),process.on(`SIGTERM`,C)}async function v(e){await e.serving.close();let t=await e.container.start({workspaces:e.handover.settings.sandbox.workspaces.map(e=>({path:e})),port:e.port,onProgress:h});if(!t.ok){h(`the cockpit could not move into a container: ${t.error}`),h(`serving from the host again`),await e.restart(),await p({port:e.port,host:e.host,sessions:e.handover.sessions,onNotice:h});return}e.adopt(async()=>{await t.container.stop()}),await l({port:e.port,settings:e.handover.settings,onNotice:h}),await p({port:e.port,sessions:e.handover.sessions,onNotice:h}),h(`supervising the cockpit container; Ctrl-C stops it`),await t.container.supervise()}_().catch(e=>{h(e instanceof Error?e.message:String(e)),process.exitCode=1});export{};
 //# sourceMappingURL=serve.mjs.map

package/dist/bin/serve.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"serve.mjs","names":[],"sources":["../../src/bin/serve.ts"],"sourcesContent":["#!/usr/bin/env node\n\nimport os from 'node:os';\nimport { createCockpitContainer } from '../adapters/cockpitContainer.ts';\nimport { handOffRemoteAccess } from '../adapters/cockpitHandoff.ts';\nimport { hubAnswers } from '../adapters/hubProbe.ts';\nimport { serveWeb } from '../adapters/httpServer.ts';\nimport { defaultRemoteStateDir } from '../adapters/remoteAccessStore.ts';\nimport { relaunchSessions } from '../adapters/sessionRelaunch.ts';\nimport { REGISTRY_DIR_ENV, resolveRegistryDir } from '../services/registryStore.ts';\nimport { isLoopbackHost, parseServeOptions } from '../services/serveOptions.ts';\nimport type { WebServer } from '../types/bridge.ts';\nimport type { MigratingSession, RemoteAccessSettings } from '../types/remoteAccess.ts';\n\nconst ADDRESS_IN_USE = 'EADDRINUSE';\n\nfunction notice(message: string): void {\n  process.stderr.write(`[doompi-web] ${message}\\n`);\n}\n\nasync function main(): Promise<void> {\n  const options = parseServeOptions(process.argv.slice(2));\n  const url = `http://${options.host}:${String(options.port)}`;\n  const stateDir = options.stateDir ?? defaultRemoteStateDir();\n  const container = createCockpitContainer({ stateDir, onNotice: notice });\n  // A cockpit that was killed rather than closed leaves its container holding\n  // the published port, so the next start would fail to bind for a reason\n  // nothing explains.\n  await container.reapStale();\n\n  // Binding off loopback publishes an unauthenticated cockpit to whoever can\n  // reach the address. Remote access exists so nobody has to do this; a warning\n  // rather than a refusal, because an existing setup should not break today.\n  if (!isLoopbackHost(options.host)) {\n    notice(`WARNING: --host ${options.host} is not loopback, so the cockpit is reachable without pairing.`);\n    notice('WARNING: turn on remote access in settings instead, which requires a paired device.');\n  }\n\n  // One hub serves every session, so a second start is a request to use the\n  // running one, not an error worth a stack trace.\n  if (await hubAnswers(options.host, options.port)) {\n    notice(`cockpit already running at ${url}`);\n    return;\n  }\n\n  /**\n   * What Ctrl-C stops, which is not the same thing throughout the run.\n   *\n   * A single indirection rather than swapping signal handlers, so the handover\n   * never has to reach for `removeAllListeners` and take out whatever else this\n   * process has registered.\n   */\n  let shutDown: () => Promise<void> = async () => {};\n\n  const start = async (): Promise<WebServer> => {\n    const server = await serveWeb({\n      port: options.port,\n      host: options.host,\n      assetsDir: options.assetsDir,\n      registryDir: resolveRegistryDir({\n        flagValue: options.registryDir,\n        envValue: process.env[REGISTRY_DIR_ENV],\n        homeDir: os.homedir(),\n      }),\n      spawnCommand: options.spawnCommand,\n      remoteStateDir: stateDir,\n      cloudflaredPath: options.cloudflaredPath,\n      onNotice: notice,\n      // Already deferred past its own response by the route that asked, so by\n      // the time this runs the caller has its answer and the server can go.\n      onHandover: (handover) => {\n        void handOver({\n          serving: server,\n          restart: start,\n          container,\n          handover,\n          port: options.port,\n          host: options.host,\n          adopt: (next) => {\n            shutDown = next;\n          },\n        });\n      },\n    });\n    shutDown = async () => {\n      await server.close();\n    };\n    return server;\n  };\n\n  try {\n    await start();\n  } catch (error) {\n    // Two cockpits starting together can both find the port free; the loser\n    // settles for the winner rather than reporting a clash nobody caused.\n    if ((error as NodeJS.ErrnoException).code !== ADDRESS_IN_USE) throw error;\n    if (await hubAnswers(options.host, options.port)) {\n      notice(`cockpit already running at ${url}`);\n      return;\n    }\n    throw new Error(`Port ${String(options.port)} is taken by something that is not a DoomPi cockpit; pass --port.`);\n  }\n\n  const stop = (): void => {\n    void shutDown().then(() => {\n      process.exit(0);\n    });\n  };\n  process.on('SIGINT', stop);\n  process.on('SIGTERM', stop);\n}\n\n/**\n * Hands this cockpit over to one running in a container.\n *\n * The port has to be free before the container can publish onto it, so the\n * order is: stop serving, start the container, and put the host cockpit back if\n * the container does not come up. Leaving the user with nothing listening would\n * be the worst outcome of the three, which is why the rollback also recreates\n * the sessions that were stopped in preparation for a move that did not happen.\n */\nasync function handOver(input: {\n  serving: WebServer;\n  restart: () => Promise<WebServer>;\n  container: ReturnType<typeof createCockpitContainer>;\n  handover: { settings: RemoteAccessSettings; sessions: readonly MigratingSession[] };\n  port: number;\n  host: string;\n  adopt: (shutDown: () => Promise<void>) => void;\n}): Promise<void> {\n  await input.serving.close();\n  const started = await input.container.start({\n    workspaces: input.handover.settings.sandbox.workspaces.map((workspace) => ({ path: workspace })),\n    port: input.port,\n    onProgress: notice,\n  });\n  if (!started.ok) {\n    notice(`the cockpit could not move into a container: ${started.error}`);\n    notice('serving from the host again');\n    await input.restart();\n    await relaunchSessions({\n      port: input.port,\n      host: input.host,\n      sessions: input.handover.sessions,\n      onNotice: notice,\n    });\n    return;\n  }\n  input.adopt(async () => {\n    await started.container.stop();\n  });\n  // The container answers its own health probe before `start` resolves, so its\n  // hub is already there to take the settings and the sessions.\n  await handOffRemoteAccess({ port: input.port, settings: input.handover.settings, onNotice: notice });\n  await relaunchSessions({ port: input.port, sessions: input.handover.sessions, onNotice: notice });\n  // Nothing else holds this process open now that its server is closed, and a\n  // supervisor that exits leaves a container nobody will ever stop.\n  notice('supervising the cockpit container; Ctrl-C stops it');\n  await started.container.supervise();\n}\n\nmain().catch((error: unknown) => {\n  notice(error instanceof Error ? error.message : String(error));\n  process.exitCode = 1;\n});\n"],"mappings":";6mBAgBA,SAAS,EAAO,EAAuB,CACrC,QAAQ,OAAO,MAAM,gBAAgB,EAAQ,GAAG,CAClD,CAEA,eAAe,GAAsB,CACnC,IAAM,EAAU,EAAkB,QAAQ,KAAK,MAAM,CAAC,CAAC,EACjD,EAAM,UAAU,EAAQ,KAAK,GAAG,OAAO,EAAQ,IAAI,IACnD,EAAW,EAAQ,UAAY,EAAsB,EACrD,EAAY,EAAuB,CAAE,WAAU,SAAU,CAAO,CAAC,EAgBvE,GAZA,MAAM,EAAU,UAAU,EAKrB,EAAe,EAAQ,IAAI,IAC9B,EAAO,mBAAmB,EAAQ,KAAK,+DAA+D,EACtG,EAAO,qFAAqF,GAK1F,MAAM,EAAW,EAAQ,KAAM,EAAQ,IAAI,EAAG,CAChD,EAAO,8BAA8B,GAAK,EAC1C,MACF,CASA,IAAI,EAAgC,SAAY,CAAC,EAE3C,EAAQ,SAAgC,CAC5C,IAAM,EAAS,MAAM,EAAS,CAC5B,KAAM,EAAQ,KACd,KAAM,EAAQ,KACd,UAAW,EAAQ,UACnB,YAAa,EAAmB,CAC9B,UAAW,EAAQ,YACnB,SAAU,QAAQ,IAAI,GACtB,QAAS,EAAG,QAAQ,CACtB,CAAC,EACD,aAAc,EAAQ,aACtB,eAAgB,EAChB,gBAAiB,EAAQ,gBACzB,SAAU,EAGV,WAAa,GAAa,CACxB,EAAc,CACZ,QAAS,EACT,QAAS,EACT,YACA,WACA,KAAM,EAAQ,KACd,KAAM,EAAQ,KACd,MAAQ,GAAS,CACf,EAAW,CACb,CACF,CAAC,CACH,CACF,CAAC,EAID,MAHA,GAAW,SAAY,CACrB,MAAM,EAAO,MAAM,CACrB,EACO,CACT,EAEA,GAAI,CACF,MAAM,EAAM,CACd,OAAS,EAAO,CAGd,GAAK,EAAgC,OAAS,aAAgB,MAAM,EACpE,GAAI,MAAM,EAAW,EAAQ,KAAM,EAAQ,IAAI,EAAG,CAChD,EAAO,8BAA8B,GAAK,EAC1C,MACF,CACA,MAAU,MAAM,QAAQ,OAAO,EAAQ,IAAI,EAAE,kEAAkE,CACjH,CAEA,IAAM,MAAmB,CACvB,EAAc,CAAC,CAAC,SAAW,CACzB,QAAQ,KAAK,CAAC,CAChB,CAAC,CACH,EACA,QAAQ,GAAG,SAAU,CAAI,EACzB,QAAQ,GAAG,UAAW,CAAI,CAC5B,CAWA,eAAe,EAAS,EAQN,CAChB,MAAM,EAAM,QAAQ,MAAM,EAC1B,IAAM,EAAU,MAAM,EAAM,UAAU,MAAM,CAC1C,WAAY,EAAM,SAAS,SAAS,QAAQ,WAAW,IAAK,IAAe,CAAE,KAAM,CAAU,EAAE,EAC/F,KAAM,EAAM,KACZ,WAAY,CACd,CAAC,EACD,GAAI,CAAC,EAAQ,GAAI,CACf,EAAO,gDAAgD,EAAQ,OAAO,EACtE,EAAO,6BAA6B,EACpC,MAAM,EAAM,QAAQ,EACpB,MAAM,EAAiB,CACrB,KAAM,EAAM,KACZ,KAAM,EAAM,KACZ,SAAU,EAAM,SAAS,SACzB,SAAU,CACZ,CAAC,EACD,MACF,CACA,EAAM,MAAM,SAAY,CACtB,MAAM,EAAQ,UAAU,KAAK,CAC/B,CAAC,EAGD,MAAM,EAAoB,CAAE,KAAM,EAAM,KAAM,SAAU,EAAM,SAAS,SAAU,SAAU,CAAO,CAAC,EACnG,MAAM,EAAiB,CAAE,KAAM,EAAM,KAAM,SAAU,EAAM,SAAS,SAAU,SAAU,CAAO,CAAC,EAGhG,EAAO,oDAAoD,EAC3D,MAAM,EAAQ,UAAU,UAAU,CACpC,CAEA,EAAK,CAAC,CAAC,MAAO,GAAmB,CAC/B,EAAO,aAAiB,MAAQ,EAAM,QAAU,OAAO,CAAK,CAAC,EAC7D,QAAQ,SAAW,CACrB,CAAC"}
+{"version":3,"file":"serve.mjs","names":[],"sources":["../../src/bin/serve.ts"],"sourcesContent":["#!/usr/bin/env node\n\nimport os from 'node:os';\nimport { createCockpitContainer } from '../adapters/cockpitContainer.ts';\nimport { handOffRemoteAccess } from '../adapters/cockpitHandoff.ts';\nimport { ensureDoomInitialized } from '../adapters/doomInitialization.ts';\nimport { hubAnswers, probeHub } from '../adapters/hubProbe.ts';\nimport { packagedVersion, serveWeb } from '../adapters/httpServer.ts';\nimport { defaultRemoteStateDir } from '../adapters/remoteAccessStore.ts';\nimport { relaunchSessions } from '../adapters/sessionRelaunch.ts';\nimport { REGISTRY_DIR_ENV, resolveRegistryDir } from '../services/registryStore.ts';\nimport { isLoopbackHost, parseServeOptions, serveHelp } from '../services/serveOptions.ts';\nimport type { WebServer } from '../types/bridge.ts';\nimport type { MigratingSession, RemoteAccessSettings } from '../types/remoteAccess.ts';\n\nconst ADDRESS_IN_USE = 'EADDRINUSE';\nconst STOP_POLL_MS = 100;\nconst STOP_TIMEOUT_MS = 10_000;\n\nfunction notice(message: string): void {\n  process.stderr.write(`[doompi-web] ${message}\\n`);\n}\n\n/**\n * Signals the running hub and waits for the address to go quiet.\n *\n * Only ever called for a loopback address, because the pid on the other end of\n * the probe is only this machine's pid when the hub is on this machine.\n */\nasync function stopRunningHub(pid: number, host: string, port: number): Promise<boolean> {\n  try {\n    process.kill(pid, 'SIGTERM');\n  } catch {\n    // Already gone, or not ours to signal. The probe below settles it either way.\n  }\n  const deadline = Date.now() + STOP_TIMEOUT_MS;\n  while (Date.now() < deadline) {\n    await new Promise((resolve) => setTimeout(resolve, STOP_POLL_MS));\n    if (!(await hubAnswers(host, port))) return true;\n  }\n  return false;\n}\n\nasync function main(): Promise<void> {\n  const options = parseServeOptions(process.argv.slice(2));\n  if (options.help) {\n    process.stdout.write(serveHelp());\n    return;\n  }\n  if (options.version) {\n    process.stdout.write(`${packagedVersion()}\\n`);\n    return;\n  }\n  await ensureDoomInitialized({ homeDirectory: os.homedir(), onNotice: notice });\n  const url = `http://${options.host}:${String(options.port)}`;\n  const stateDir = options.stateDir ?? defaultRemoteStateDir();\n  const container = createCockpitContainer({ stateDir, onNotice: notice });\n  // A cockpit that was killed rather than closed leaves its container holding\n  // the published port, so the next start would fail to bind for a reason\n  // nothing explains.\n  await container.reapStale();\n\n  // Binding off loopback publishes an unauthenticated cockpit to whoever can\n  // reach the address. Remote access exists so nobody has to do this; a warning\n  // rather than a refusal, because an existing setup should not break today.\n  if (!isLoopbackHost(options.host)) {\n    notice(`WARNING: --host ${options.host} is not loopback, so the cockpit is reachable without pairing.`);\n    notice('WARNING: turn on remote access in settings instead, which requires a paired device.');\n  }\n\n  // One hub serves every session, so a second start is normally a request to\n  // use the running one. A second start from a *different* version is not: a\n  // long-lived hub signs its asset directory once, so handing back to it would\n  // serve the older cockpit for as long as it lives, and a browser that already\n  // verified that bundle would never be offered a newer one.\n  const running = await probeHub(options.host, options.port);\n  if (running !== undefined) {\n    const mine = packagedVersion();\n    const theirs = running.version ?? 'an older build';\n    if (running.version === mine) {\n      notice(`cockpit already running at ${url}`);\n      return;\n    }\n    if (running.sessions > 0) {\n      notice(`WARNING: ${theirs} is already running at ${url} with ${String(running.sessions)} live session(s).`);\n      notice(`WARNING: stop it and run again to serve ${mine}; refusing to interrupt running work.`);\n      return;\n    }\n    if (running.pid === undefined || !isLoopbackHost(options.host)) {\n      notice(`WARNING: ${theirs} is already running at ${url} and cannot be replaced automatically.`);\n      notice(`WARNING: stop it and run again to serve ${mine}.`);\n      return;\n    }\n    notice(`replacing ${theirs} at ${url} with ${mine}`);\n    if (!(await stopRunningHub(running.pid, options.host, options.port))) {\n      notice(`WARNING: the hub at ${url} did not stop; serve ${mine} on another port with --port.`);\n      return;\n    }\n  }\n\n  /**\n   * What Ctrl-C stops, which is not the same thing throughout the run.\n   *\n   * A single indirection rather than swapping signal handlers, so the handover\n   * never has to reach for `removeAllListeners` and take out whatever else this\n   * process has registered.\n   */\n  let shutDown: () => Promise<void> = async () => {};\n\n  const start = async (): Promise<WebServer> => {\n    const server = await serveWeb({\n      port: options.port,\n      host: options.host,\n      assetsDir: options.assetsDir,\n      compositionDir: options.directory,\n      registryDir: resolveRegistryDir({\n        flagValue: options.registryDir,\n        envValue: process.env[REGISTRY_DIR_ENV],\n        homeDir: os.homedir(),\n      }),\n      spawnCommand: options.spawnCommand,\n      remoteStateDir: stateDir,\n      cloudflaredPath: options.cloudflaredPath,\n      onNotice: notice,\n      // Already deferred past its own response by the route that asked, so by\n      // the time this runs the caller has its answer and the server can go.\n      onHandover: (handover) => {\n        void handOver({\n          serving: server,\n          restart: start,\n          container,\n          handover,\n          port: options.port,\n          host: options.host,\n          adopt: (next) => {\n            shutDown = next;\n          },\n        });\n      },\n    });\n    shutDown = async () => {\n      await server.close();\n    };\n    return server;\n  };\n\n  try {\n    await start();\n  } catch (error) {\n    // Two cockpits starting together can both find the port free; the loser\n    // settles for the winner rather than reporting a clash nobody caused.\n    if ((error as NodeJS.ErrnoException).code !== ADDRESS_IN_USE) throw error;\n    if (await hubAnswers(options.host, options.port)) {\n      notice(`cockpit already running at ${url}`);\n      return;\n    }\n    throw new Error(`Port ${String(options.port)} is taken by something that is not a DoomPi cockpit; pass --port.`);\n  }\n\n  const stop = (): void => {\n    void shutDown().then(() => {\n      process.exit(0);\n    });\n  };\n  process.on('SIGINT', stop);\n  process.on('SIGTERM', stop);\n}\n\n/**\n * Hands this cockpit over to one running in a container.\n *\n * The port has to be free before the container can publish onto it, so the\n * order is: stop serving, start the container, and put the host cockpit back if\n * the container does not come up. Leaving the user with nothing listening would\n * be the worst outcome of the three, which is why the rollback also recreates\n * the sessions that were stopped in preparation for a move that did not happen.\n */\nasync function handOver(input: {\n  serving: WebServer;\n  restart: () => Promise<WebServer>;\n  container: ReturnType<typeof createCockpitContainer>;\n  handover: { settings: RemoteAccessSettings; sessions: readonly MigratingSession[] };\n  port: number;\n  host: string;\n  adopt: (shutDown: () => Promise<void>) => void;\n}): Promise<void> {\n  await input.serving.close();\n  const started = await input.container.start({\n    workspaces: input.handover.settings.sandbox.workspaces.map((workspace) => ({ path: workspace })),\n    port: input.port,\n    onProgress: notice,\n  });\n  if (!started.ok) {\n    notice(`the cockpit could not move into a container: ${started.error}`);\n    notice('serving from the host again');\n    await input.restart();\n    await relaunchSessions({\n      port: input.port,\n      host: input.host,\n      sessions: input.handover.sessions,\n      onNotice: notice,\n    });\n    return;\n  }\n  input.adopt(async () => {\n    await started.container.stop();\n  });\n  // The container answers its own health probe before `start` resolves, so its\n  // hub is already there to take the settings and the sessions.\n  await handOffRemoteAccess({ port: input.port, settings: input.handover.settings, onNotice: notice });\n  await relaunchSessions({ port: input.port, sessions: input.handover.sessions, onNotice: notice });\n  // Nothing else holds this process open now that its server is closed, and a\n  // supervisor that exits leaves a container nobody will ever stop.\n  notice('supervising the cockpit container; Ctrl-C stops it');\n  await started.container.supervise();\n}\n\nmain().catch((error: unknown) => {\n  notice(error instanceof Error ? error.message : String(error));\n  process.exitCode = 1;\n});\n"],"mappings":";8uBAmBA,SAAS,EAAO,EAAuB,CACrC,QAAQ,OAAO,MAAM,gBAAgB,EAAQ,GAAG,CAClD,CAQA,eAAe,EAAe,EAAa,EAAc,EAAgC,CACvF,GAAI,CACF,QAAQ,KAAK,EAAK,SAAS,CAC7B,MAAQ,CAER,CACA,IAAM,EAAW,KAAK,IAAI,EAAI,IAC9B,KAAO,KAAK,IAAI,EAAI,GAElB,GADA,MAAM,IAAI,QAAS,GAAY,WAAW,EAAS,GAAY,CAAC,EAC5D,CAAE,MAAM,EAAW,EAAM,CAAI,EAAI,MAAO,GAE9C,MAAO,EACT,CAEA,eAAe,GAAsB,CACnC,IAAM,EAAU,EAAkB,QAAQ,KAAK,MAAM,CAAC,CAAC,EACvD,GAAI,EAAQ,KAAM,CAChB,QAAQ,OAAO,MAAM,EAAU,CAAC,EAChC,MACF,CACA,GAAI,EAAQ,QAAS,CACnB,QAAQ,OAAO,MAAM,GAAG,EAAgB,EAAE,GAAG,EAC7C,MACF,CACA,MAAM,EAAsB,CAAE,cAAe,EAAG,QAAQ,EAAG,SAAU,CAAO,CAAC,EAC7E,IAAM,EAAM,UAAU,EAAQ,KAAK,GAAG,OAAO,EAAQ,IAAI,IACnD,EAAW,EAAQ,UAAY,EAAsB,EACrD,EAAY,EAAuB,CAAE,WAAU,SAAU,CAAO,CAAC,EAIvE,MAAM,EAAU,UAAU,EAKrB,EAAe,EAAQ,IAAI,IAC9B,EAAO,mBAAmB,EAAQ,KAAK,+DAA+D,EACtG,EAAO,qFAAqF,GAQ9F,IAAM,EAAU,MAAM,EAAS,EAAQ,KAAM,EAAQ,IAAI,EACzD,GAAI,IAAY,IAAA,GAAW,CACzB,IAAM,EAAO,EAAgB,EACvB,EAAS,EAAQ,SAAW,iBAClC,GAAI,EAAQ,UAAY,EAAM,CAC5B,EAAO,8BAA8B,GAAK,EAC1C,MACF,CACA,GAAI,EAAQ,SAAW,EAAG,CACxB,EAAO,YAAY,EAAO,yBAAyB,EAAI,QAAQ,OAAO,EAAQ,QAAQ,EAAE,kBAAkB,EAC1G,EAAO,2CAA2C,EAAK,sCAAsC,EAC7F,MACF,CACA,GAAI,EAAQ,MAAQ,IAAA,IAAa,CAAC,EAAe,EAAQ,IAAI,EAAG,CAC9D,EAAO,YAAY,EAAO,yBAAyB,EAAI,uCAAuC,EAC9F,EAAO,2CAA2C,EAAK,EAAE,EACzD,MACF,CAEA,GADA,EAAO,aAAa,EAAO,MAAM,EAAI,QAAQ,GAAM,EAC/C,CAAE,MAAM,EAAe,EAAQ,IAAK,EAAQ,KAAM,EAAQ,IAAI,EAAI,CACpE,EAAO,uBAAuB,EAAI,uBAAuB,EAAK,8BAA8B,EAC5F,MACF,CACF,CASA,IAAI,EAAgC,SAAY,CAAC,EAE3C,EAAQ,SAAgC,CAC5C,IAAM,EAAS,MAAM,EAAS,CAC5B,KAAM,EAAQ,KACd,KAAM,EAAQ,KACd,UAAW,EAAQ,UACnB,eAAgB,EAAQ,UACxB,YAAa,EAAmB,CAC9B,UAAW,EAAQ,YACnB,SAAU,QAAQ,IAAI,GACtB,QAAS,EAAG,QAAQ,CACtB,CAAC,EACD,aAAc,EAAQ,aACtB,eAAgB,EAChB,gBAAiB,EAAQ,gBACzB,SAAU,EAGV,WAAa,GAAa,CACxB,EAAc,CACZ,QAAS,EACT,QAAS,EACT,YACA,WACA,KAAM,EAAQ,KACd,KAAM,EAAQ,KACd,MAAQ,GAAS,CACf,EAAW,CACb,CACF,CAAC,CACH,CACF,CAAC,EAID,MAHA,GAAW,SAAY,CACrB,MAAM,EAAO,MAAM,CACrB,EACO,CACT,EAEA,GAAI,CACF,MAAM,EAAM,CACd,OAAS,EAAO,CAGd,GAAK,EAAgC,OAAS,aAAgB,MAAM,EACpE,GAAI,MAAM,EAAW,EAAQ,KAAM,EAAQ,IAAI,EAAG,CAChD,EAAO,8BAA8B,GAAK,EAC1C,MACF,CACA,MAAU,MAAM,QAAQ,OAAO,EAAQ,IAAI,EAAE,kEAAkE,CACjH,CAEA,IAAM,MAAmB,CACvB,EAAc,CAAC,CAAC,SAAW,CACzB,QAAQ,KAAK,CAAC,CAChB,CAAC,CACH,EACA,QAAQ,GAAG,SAAU,CAAI,EACzB,QAAQ,GAAG,UAAW,CAAI,CAC5B,CAWA,eAAe,EAAS,EAQN,CAChB,MAAM,EAAM,QAAQ,MAAM,EAC1B,IAAM,EAAU,MAAM,EAAM,UAAU,MAAM,CAC1C,WAAY,EAAM,SAAS,SAAS,QAAQ,WAAW,IAAK,IAAe,CAAE,KAAM,CAAU,EAAE,EAC/F,KAAM,EAAM,KACZ,WAAY,CACd,CAAC,EACD,GAAI,CAAC,EAAQ,GAAI,CACf,EAAO,gDAAgD,EAAQ,OAAO,EACtE,EAAO,6BAA6B,EACpC,MAAM,EAAM,QAAQ,EACpB,MAAM,EAAiB,CACrB,KAAM,EAAM,KACZ,KAAM,EAAM,KACZ,SAAU,EAAM,SAAS,SACzB,SAAU,CACZ,CAAC,EACD,MACF,CACA,EAAM,MAAM,SAAY,CACtB,MAAM,EAAQ,UAAU,KAAK,CAC/B,CAAC,EAGD,MAAM,EAAoB,CAAE,KAAM,EAAM,KAAM,SAAU,EAAM,SAAS,SAAU,SAAU,CAAO,CAAC,EACnG,MAAM,EAAiB,CAAE,KAAM,EAAM,KAAM,SAAU,EAAM,SAAS,SAAU,SAAU,CAAO,CAAC,EAGhG,EAAO,oDAAoD,EAC3D,MAAM,EAAQ,UAAU,UAAU,CACpC,CAEA,EAAK,CAAC,CAAC,MAAO,GAAmB,CAC/B,EAAO,aAAiB,MAAQ,EAAM,QAAU,OAAO,CAAK,CAAC,EAC7D,QAAQ,SAAW,CACrB,CAAC"}

package/dist/index.d.cts

@@ -1,7 +1,7 @@
 import { BridgeState, BridgeStatusFrame, SessionFrame } from "./src/types/session.cjs";
 import { SessionAttachment, WebServer, WebServerOptions } from "./src/types/bridge.cjs";
-import { serveWeb } from "./src/adapters/httpServer.cjs";
-import { ServeOptions, parseServeOptions } from "./src/services/serveOptions.cjs";
 import { HUB_PROTOCOL_VERSION, HUB_ROLE, SESSIONS_API_ROUTE, SessionPhase, SessionSummary } from "./src/types/hub.cjs";
 import { SESSION_RECORD_VERSION, SessionRecord } from "./src/types/registry.cjs";
+import { serveWeb } from "./src/adapters/httpServer.cjs";
+import { ServeOptions, parseServeOptions } from "./src/services/serveOptions.cjs";
 export { type BridgeState, type BridgeStatusFrame, HUB_PROTOCOL_VERSION, HUB_ROLE, SESSIONS_API_ROUTE, SESSION_RECORD_VERSION, type ServeOptions, type SessionAttachment, type SessionFrame, type SessionPhase, type SessionRecord, type SessionSummary, type WebServer, type WebServerOptions, parseServeOptions, serveWeb };

package/dist/index.d.mts

@@ -1,7 +1,7 @@
 import { BridgeState, BridgeStatusFrame, SessionFrame } from "./src/types/session.mjs";
 import { SessionAttachment, WebServer, WebServerOptions } from "./src/types/bridge.mjs";
-import { serveWeb } from "./src/adapters/httpServer.mjs";
-import { ServeOptions, parseServeOptions } from "./src/services/serveOptions.mjs";
 import { HUB_PROTOCOL_VERSION, HUB_ROLE, SESSIONS_API_ROUTE, SessionPhase, SessionSummary } from "./src/types/hub.mjs";
 import { SESSION_RECORD_VERSION, SessionRecord } from "./src/types/registry.mjs";
+import { serveWeb } from "./src/adapters/httpServer.mjs";
+import { ServeOptions, parseServeOptions } from "./src/services/serveOptions.mjs";
 export { type BridgeState, type BridgeStatusFrame, HUB_PROTOCOL_VERSION, HUB_ROLE, SESSIONS_API_ROUTE, SESSION_RECORD_VERSION, type ServeOptions, type SessionAttachment, type SessionFrame, type SessionPhase, type SessionRecord, type SessionSummary, type WebServer, type WebServerOptions, parseServeOptions, serveWeb };

package/dist/pwa/index.html

@@ -0,0 +1,104 @@
+<!doctype html>
+<html lang="en">
+  <head>
+    <meta charset="UTF-8" />
+    <meta name="viewport" content="width=device-width, initial-scale=1, viewport-fit=cover" />
+    <meta name="theme-color" content="#14161a" />
+    <meta name="apple-mobile-web-app-capable" content="yes" />
+    <meta name="apple-mobile-web-app-status-bar-style" content="black-translucent" />
+    <meta name="robots" content="noindex, nofollow" />
+    <link rel="manifest" href="/pwa/manifest.webmanifest" />
+    <link rel="apple-touch-icon" href="/pwa/icon-192.png" />
+    <title>Pair with DoomPi</title>
+    <style>
+      :root {
+        color-scheme: dark;
+      }
+      * {
+        box-sizing: border-box;
+      }
+      body {
+        margin: 0;
+        min-height: 100vh;
+        min-height: 100dvh;
+        display: grid;
+        place-items: center;
+        padding: max(1.25rem, env(safe-area-inset-top)) max(1.25rem, env(safe-area-inset-right))
+          max(1.25rem, env(safe-area-inset-bottom)) max(1.25rem, env(safe-area-inset-left));
+        background: #14161a;
+        color: #e6e8ec;
+        font:
+          16px/1.5 ui-sans-serif,
+          system-ui,
+          -apple-system,
+          sans-serif;
+      }
+      main {
+        width: min(32rem, 100%);
+        text-align: center;
+      }
+      h1 {
+        margin: 0 0 0.5rem;
+        font-size: 1.35rem;
+      }
+      p {
+        margin: 0 0 1rem;
+        color: #a2a8b4;
+      }
+      #pwa-status[data-tone='good'] {
+        color: #6bd68a;
+      }
+      #pwa-status[data-tone='bad'] {
+        color: #ff7b7b;
+      }
+      video {
+        width: 100%;
+        max-height: 24rem;
+        margin: 0.75rem 0;
+        border: 1px solid #2c313a;
+        border-radius: 0.75rem;
+        background: #090a0c;
+        object-fit: cover;
+      }
+      .actions {
+        display: flex;
+        gap: 0.75rem;
+        margin-top: 1.25rem;
+      }
+      button {
+        flex: 1;
+        min-height: 3rem;
+        border: 1px solid #2f6feb;
+        border-radius: 0.6rem;
+        background: #2f6feb;
+        color: #fff;
+        font: inherit;
+        font-weight: 650;
+      }
+      button.secondary {
+        border-color: #2c313a;
+        background: #1b1e24;
+      }
+      button:disabled {
+        opacity: 0.55;
+      }
+      [hidden] {
+        display: none !important;
+      }
+    </style>
+    <script type="module" crossorigin src="/pwa/pwa.js"></script>
+  </head>
+  <body data-marker="doompi-pwa-shell">
+    <main>
+      <h1>Pair this device</h1>
+      <p>This cockpit can run shell commands on the host. Pair only with your own DoomPi.</p>
+      <p id="pwa-status" role="status">Checking browser support.</p>
+      <video id="camera" playsinline muted hidden></video>
+      <div class="actions">
+        <button id="scan" type="button">Scan pairing QR</button>
+        <button id="cancel" class="secondary" type="button" hidden>Cancel</button>
+      </div>
+      <noscript><p>Pairing needs JavaScript.</p></noscript>
+    </main>
+  </body>
+</html>

package/dist/pwa/manifest.webmanifest

@@ -0,0 +1,23 @@
+{
+  "id": "/pair",
+  "name": "DoomPi Cockpit",
+  "short_name": "DoomPi",
+  "description": "Securely pair with and open your DoomPi cockpit.",
+  "start_url": "/",
+  "scope": "/",
+  "display": "standalone",
+  "background_color": "#14161a",
+  "theme_color": "#14161a",
+  "icons": [
+    {
+      "src": "/pwa/icon-192.png",
+      "sizes": "192x192",
+      "type": "image/png"
+    },
+    {
+      "src": "/pwa/icon-512.png",
+      "sizes": "512x512",
+      "type": "image/png"
+    }
+  ]
+}