@agimon-ai/po-core 0.0.0-alpha.0

package/dist/src/services/tunnelOutput/index.cjs

@@ -0,0 +1,58 @@
+//#region src/services/tunnelOutput/index.ts
+/**
+* A trycloudflare hostname, and nothing that merely ends near one.
+*
+* The trailing lookahead is the whole point. Without it,
+* `https://evil.trycloudflare.com.attacker.tld` printed by a confused or
+* hostile process would match, and the extracted value becomes the origin the
+* guard then trusts for every subsequent request.
+*/
+const QUICK_TUNNEL_URL = /https:\/\/[a-z0-9][a-z0-9-]*(?:\.[a-z0-9-]+)*\.trycloudflare\.com(?![a-z0-9.-])/iu;
+/** Cloudflare reports a connection registered; readiness waits for this as well as a URL. */
+const CONNECTION_READY = /registered tunnel connection|connection .* registered/iu;
+function tunnelTarget(port) {
+	return `http://127.0.0.1:${String(port)}`;
+}
+/**
+* The cloudflared argument vector.
+*
+* `--url` is a flag on the `tunnel` command rather than on `run`, so it comes
+* before the subcommand in both shapes. `--token-file` belongs to `run`.
+*
+* Flag placement here follows cloudflared's documented usage and local help.
+*/
+function tunnelArgs(config, port, tokenFile) {
+	const args = ["tunnel", "--no-autoupdate"];
+	if (config.kind === "named" && config.configFile !== void 0) args.push("--config", config.configFile);
+	args.push("--url", tunnelTarget(port));
+	if (config.kind === "quick") return args;
+	args.push("run");
+	if (tokenFile !== void 0 && tokenFile !== "") args.push("--token-file", tokenFile);
+	if (config.name !== void 0) args.push(config.name);
+	return args;
+}
+/** The public origin a quick tunnel announced, or undefined if this output does not carry one. */
+function extractTunnelUrl(text) {
+	return QUICK_TUNNEL_URL.exec(text)?.[0].toLowerCase();
+}
+function mentionsRegisteredConnection(text) {
+	return CONNECTION_READY.test(text);
+}
+/** Operator-facing copy for a failure, with the cause appended by the caller. */
+function describeTunnelFailure(failure) {
+	switch (failure) {
+		case "not_installed": return "cloudflared is not installed. Install it (brew install cloudflared) or set PO_CLOUDFLARED.";
+		case "spawn_failed": return "cloudflared could not be started.";
+		case "timeout": return "cloudflared did not report a public URL in time.";
+		case "self_test_failed": return "The tunnel came up unguarded and was closed immediately.";
+		case "exited": return "cloudflared stopped on its own.";
+	}
+}
+//#endregion
+exports.describeTunnelFailure = describeTunnelFailure;
+exports.extractTunnelUrl = extractTunnelUrl;
+exports.mentionsRegisteredConnection = mentionsRegisteredConnection;
+exports.tunnelArgs = tunnelArgs;
+exports.tunnelTarget = tunnelTarget;
+
+//# sourceMappingURL=index.cjs.map

package/dist/src/services/tunnelOutput/index.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.cjs","names":[],"sources":["../../../../src/services/tunnelOutput/index.ts"],"sourcesContent":["/**\n * Turning a tunnel configuration into a command line, and cloudflared's output\n * back into a public origin.\n *\n * The parsing half only exists for quick tunnels. A named tunnel is configured\n * with its hostname, so nothing has to be scraped and the origin is known\n * before the process starts. That difference is the strongest practical\n * argument for named mode: the banner cloudflared prints is an undocumented\n * detail of its logging, and a release that reformats it breaks quick mode\n * until the readiness deadline fires.\n */\n\nimport type { TunnelConfig, TunnelFailure } from '../../types/remote';\n\n/**\n * A trycloudflare hostname, and nothing that merely ends near one.\n *\n * The trailing lookahead is the whole point. Without it,\n * `https://evil.trycloudflare.com.attacker.tld` printed by a confused or\n * hostile process would match, and the extracted value becomes the origin the\n * guard then trusts for every subsequent request.\n */\nconst QUICK_TUNNEL_URL = /https:\\/\\/[a-z0-9][a-z0-9-]*(?:\\.[a-z0-9-]+)*\\.trycloudflare\\.com(?![a-z0-9.-])/iu;\n\n/** Cloudflare reports a connection registered; readiness waits for this as well as a URL. */\nconst CONNECTION_READY = /registered tunnel connection|connection .* registered/iu;\n\nexport function tunnelTarget(port: number): string {\n  return `http://127.0.0.1:${String(port)}`;\n}\n\n/**\n * The cloudflared argument vector.\n *\n * `--url` is a flag on the `tunnel` command rather than on `run`, so it comes\n * before the subcommand in both shapes. `--token-file` belongs to `run`.\n *\n * Flag placement here follows cloudflared's documented usage and local help.\n */\nexport function tunnelArgs(config: TunnelConfig, port: number, tokenFile?: string): string[] {\n  const args = ['tunnel', '--no-autoupdate'];\n  if (config.kind === 'named' && config.configFile !== undefined) args.push('--config', config.configFile);\n  args.push('--url', tunnelTarget(port));\n  if (config.kind === 'quick') return args;\n  args.push('run');\n  if (tokenFile !== undefined && tokenFile !== '') args.push('--token-file', tokenFile);\n  if (config.name !== undefined) args.push(config.name);\n  return args;\n}\n\n/** The public origin a quick tunnel announced, or undefined if this output does not carry one. */\nexport function extractTunnelUrl(text: string): string | undefined {\n  return QUICK_TUNNEL_URL.exec(text)?.[0].toLowerCase();\n}\n\nexport function mentionsRegisteredConnection(text: string): boolean {\n  return CONNECTION_READY.test(text);\n}\n\n/** Operator-facing copy for a failure, with the cause appended by the caller. */\nexport function describeTunnelFailure(failure: TunnelFailure): string {\n  switch (failure) {\n    case 'not_installed':\n      return 'cloudflared is not installed. Install it (brew install cloudflared) or set PO_CLOUDFLARED.';\n    case 'spawn_failed':\n      return 'cloudflared could not be started.';\n    case 'timeout':\n      return 'cloudflared did not report a public URL in time.';\n    case 'self_test_failed':\n      return 'The tunnel came up unguarded and was closed immediately.';\n    case 'exited':\n      return 'cloudflared stopped on its own.';\n  }\n}\n"],"mappings":";;;;;;;;;AAsBA,MAAM,mBAAmB;;AAGzB,MAAM,mBAAmB;AAEzB,SAAgB,aAAa,MAAsB;CACjD,OAAO,oBAAoB,OAAO,IAAI;AACxC;;;;;;;;;AAUA,SAAgB,WAAW,QAAsB,MAAc,WAA8B;CAC3F,MAAM,OAAO,CAAC,UAAU,iBAAiB;CACzC,IAAI,OAAO,SAAS,WAAW,OAAO,eAAe,KAAA,GAAW,KAAK,KAAK,YAAY,OAAO,UAAU;CACvG,KAAK,KAAK,SAAS,aAAa,IAAI,CAAC;CACrC,IAAI,OAAO,SAAS,SAAS,OAAO;CACpC,KAAK,KAAK,KAAK;CACf,IAAI,cAAc,KAAA,KAAa,cAAc,IAAI,KAAK,KAAK,gBAAgB,SAAS;CACpF,IAAI,OAAO,SAAS,KAAA,GAAW,KAAK,KAAK,OAAO,IAAI;CACpD,OAAO;AACT;;AAGA,SAAgB,iBAAiB,MAAkC;CACjE,OAAO,iBAAiB,KAAK,IAAI,CAAC,GAAG,EAAE,CAAC,YAAY;AACtD;AAEA,SAAgB,6BAA6B,MAAuB;CAClE,OAAO,iBAAiB,KAAK,IAAI;AACnC;;AAGA,SAAgB,sBAAsB,SAAgC;CACpE,QAAQ,SAAR;EACE,KAAK,iBACH,OAAO;EACT,KAAK,gBACH,OAAO;EACT,KAAK,WACH,OAAO;EACT,KAAK,oBACH,OAAO;EACT,KAAK,UACH,OAAO;CACX;AACF"}

package/dist/src/services/tunnelOutput/index.mjs

@@ -0,0 +1,54 @@
+//#region src/services/tunnelOutput/index.ts
+/**
+* A trycloudflare hostname, and nothing that merely ends near one.
+*
+* The trailing lookahead is the whole point. Without it,
+* `https://evil.trycloudflare.com.attacker.tld` printed by a confused or
+* hostile process would match, and the extracted value becomes the origin the
+* guard then trusts for every subsequent request.
+*/
+const QUICK_TUNNEL_URL = /https:\/\/[a-z0-9][a-z0-9-]*(?:\.[a-z0-9-]+)*\.trycloudflare\.com(?![a-z0-9.-])/iu;
+/** Cloudflare reports a connection registered; readiness waits for this as well as a URL. */
+const CONNECTION_READY = /registered tunnel connection|connection .* registered/iu;
+function tunnelTarget(port) {
+	return `http://127.0.0.1:${String(port)}`;
+}
+/**
+* The cloudflared argument vector.
+*
+* `--url` is a flag on the `tunnel` command rather than on `run`, so it comes
+* before the subcommand in both shapes. `--token-file` belongs to `run`.
+*
+* Flag placement here follows cloudflared's documented usage and local help.
+*/
+function tunnelArgs(config, port, tokenFile) {
+	const args = ["tunnel", "--no-autoupdate"];
+	if (config.kind === "named" && config.configFile !== void 0) args.push("--config", config.configFile);
+	args.push("--url", tunnelTarget(port));
+	if (config.kind === "quick") return args;
+	args.push("run");
+	if (tokenFile !== void 0 && tokenFile !== "") args.push("--token-file", tokenFile);
+	if (config.name !== void 0) args.push(config.name);
+	return args;
+}
+/** The public origin a quick tunnel announced, or undefined if this output does not carry one. */
+function extractTunnelUrl(text) {
+	return QUICK_TUNNEL_URL.exec(text)?.[0].toLowerCase();
+}
+function mentionsRegisteredConnection(text) {
+	return CONNECTION_READY.test(text);
+}
+/** Operator-facing copy for a failure, with the cause appended by the caller. */
+function describeTunnelFailure(failure) {
+	switch (failure) {
+		case "not_installed": return "cloudflared is not installed. Install it (brew install cloudflared) or set PO_CLOUDFLARED.";
+		case "spawn_failed": return "cloudflared could not be started.";
+		case "timeout": return "cloudflared did not report a public URL in time.";
+		case "self_test_failed": return "The tunnel came up unguarded and was closed immediately.";
+		case "exited": return "cloudflared stopped on its own.";
+	}
+}
+//#endregion
+export { describeTunnelFailure, extractTunnelUrl, mentionsRegisteredConnection, tunnelArgs, tunnelTarget };
+
+//# sourceMappingURL=index.mjs.map

package/dist/src/services/tunnelOutput/index.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.mjs","names":[],"sources":["../../../../src/services/tunnelOutput/index.ts"],"sourcesContent":["/**\n * Turning a tunnel configuration into a command line, and cloudflared's output\n * back into a public origin.\n *\n * The parsing half only exists for quick tunnels. A named tunnel is configured\n * with its hostname, so nothing has to be scraped and the origin is known\n * before the process starts. That difference is the strongest practical\n * argument for named mode: the banner cloudflared prints is an undocumented\n * detail of its logging, and a release that reformats it breaks quick mode\n * until the readiness deadline fires.\n */\n\nimport type { TunnelConfig, TunnelFailure } from '../../types/remote';\n\n/**\n * A trycloudflare hostname, and nothing that merely ends near one.\n *\n * The trailing lookahead is the whole point. Without it,\n * `https://evil.trycloudflare.com.attacker.tld` printed by a confused or\n * hostile process would match, and the extracted value becomes the origin the\n * guard then trusts for every subsequent request.\n */\nconst QUICK_TUNNEL_URL = /https:\\/\\/[a-z0-9][a-z0-9-]*(?:\\.[a-z0-9-]+)*\\.trycloudflare\\.com(?![a-z0-9.-])/iu;\n\n/** Cloudflare reports a connection registered; readiness waits for this as well as a URL. */\nconst CONNECTION_READY = /registered tunnel connection|connection .* registered/iu;\n\nexport function tunnelTarget(port: number): string {\n  return `http://127.0.0.1:${String(port)}`;\n}\n\n/**\n * The cloudflared argument vector.\n *\n * `--url` is a flag on the `tunnel` command rather than on `run`, so it comes\n * before the subcommand in both shapes. `--token-file` belongs to `run`.\n *\n * Flag placement here follows cloudflared's documented usage and local help.\n */\nexport function tunnelArgs(config: TunnelConfig, port: number, tokenFile?: string): string[] {\n  const args = ['tunnel', '--no-autoupdate'];\n  if (config.kind === 'named' && config.configFile !== undefined) args.push('--config', config.configFile);\n  args.push('--url', tunnelTarget(port));\n  if (config.kind === 'quick') return args;\n  args.push('run');\n  if (tokenFile !== undefined && tokenFile !== '') args.push('--token-file', tokenFile);\n  if (config.name !== undefined) args.push(config.name);\n  return args;\n}\n\n/** The public origin a quick tunnel announced, or undefined if this output does not carry one. */\nexport function extractTunnelUrl(text: string): string | undefined {\n  return QUICK_TUNNEL_URL.exec(text)?.[0].toLowerCase();\n}\n\nexport function mentionsRegisteredConnection(text: string): boolean {\n  return CONNECTION_READY.test(text);\n}\n\n/** Operator-facing copy for a failure, with the cause appended by the caller. */\nexport function describeTunnelFailure(failure: TunnelFailure): string {\n  switch (failure) {\n    case 'not_installed':\n      return 'cloudflared is not installed. Install it (brew install cloudflared) or set PO_CLOUDFLARED.';\n    case 'spawn_failed':\n      return 'cloudflared could not be started.';\n    case 'timeout':\n      return 'cloudflared did not report a public URL in time.';\n    case 'self_test_failed':\n      return 'The tunnel came up unguarded and was closed immediately.';\n    case 'exited':\n      return 'cloudflared stopped on its own.';\n  }\n}\n"],"mappings":";;;;;;;;;AAsBA,MAAM,mBAAmB;;AAGzB,MAAM,mBAAmB;AAEzB,SAAgB,aAAa,MAAsB;CACjD,OAAO,oBAAoB,OAAO,IAAI;AACxC;;;;;;;;;AAUA,SAAgB,WAAW,QAAsB,MAAc,WAA8B;CAC3F,MAAM,OAAO,CAAC,UAAU,iBAAiB;CACzC,IAAI,OAAO,SAAS,WAAW,OAAO,eAAe,KAAA,GAAW,KAAK,KAAK,YAAY,OAAO,UAAU;CACvG,KAAK,KAAK,SAAS,aAAa,IAAI,CAAC;CACrC,IAAI,OAAO,SAAS,SAAS,OAAO;CACpC,KAAK,KAAK,KAAK;CACf,IAAI,cAAc,KAAA,KAAa,cAAc,IAAI,KAAK,KAAK,gBAAgB,SAAS;CACpF,IAAI,OAAO,SAAS,KAAA,GAAW,KAAK,KAAK,OAAO,IAAI;CACpD,OAAO;AACT;;AAGA,SAAgB,iBAAiB,MAAkC;CACjE,OAAO,iBAAiB,KAAK,IAAI,CAAC,GAAG,EAAE,CAAC,YAAY;AACtD;AAEA,SAAgB,6BAA6B,MAAuB;CAClE,OAAO,iBAAiB,KAAK,IAAI;AACnC;;AAGA,SAAgB,sBAAsB,SAAgC;CACpE,QAAQ,SAAR;EACE,KAAK,iBACH,OAAO;EACT,KAAK,gBACH,OAAO;EACT,KAAK,WACH,OAAO;EACT,KAAK,oBACH,OAAO;EACT,KAAK,UACH,OAAO;CACX;AACF"}

package/dist/src/services/tunnelProcess/index.cjs

@@ -0,0 +1,487 @@
+const require_runtime = require("../../../_virtual/_rolldown/runtime.cjs");
+const require_remote = require("../../constants/remote.cjs");
+require("../pairingPage/index.cjs");
+const require_index$1 = require("../tunnelOutput/index.cjs");
+let node_fs = require("node:fs");
+node_fs = require_runtime.__toESM(node_fs, 1);
+let node_path = require("node:path");
+node_path = require_runtime.__toESM(node_path, 1);
+let node_child_process = require("node:child_process");
+//#region src/services/tunnelProcess/index.ts
+/** Explicit binary path, ahead of a PATH scan. */
+const CLOUDFLARED_ENV = "PO_CLOUDFLARED";
+const START_TIMEOUT_MS = 45e3;
+const TERMINATE_GRACE_MS = 2e3;
+const SELF_TEST_ATTEMPTS = 10;
+const SELF_TEST_RETRY_MS = 500;
+const NAMED_RESTART_ATTEMPTS = 3;
+const NAMED_RESTART_BASE_DELAY_MS = 500;
+const NAMED_RESTART_MAX_DELAY_MS = 4e3;
+const NAMED_RESTART_STABLE_MS = 6e4;
+const UNAUTHORIZED = 401;
+/** Cloudflare has the DNS route but no connector has registered yet. */
+const EDGE_TUNNEL_UNAVAILABLE = 530;
+const OK = 200;
+const PID_FILE = "tunnel.pid";
+const TOKEN_FILE = "tunnel.token";
+const FILE_MODE = 384;
+/** A pid file older than this is stale beyond usefulness and the pid has likely been recycled. */
+const PID_FILE_MAX_AGE_MS = 6048e5;
+/**
+* Finds cloudflared without a shell.
+*
+* A manual scan rather than `which`: spawning a shell to locate a binary is a
+* quoting hazard for no benefit, and this also works the same on every platform.
+*/
+function findCloudflared(env = process.env) {
+	const names = process.platform === "win32" ? ["cloudflared.exe", "cloudflared"] : ["cloudflared"];
+	for (const directory of (env.PATH ?? "").split(node_path.default.delimiter)) {
+		if (directory === "") continue;
+		for (const name of names) {
+			const candidate = node_path.default.join(directory, name);
+			try {
+				node_fs.default.accessSync(candidate, node_fs.default.constants.X_OK);
+				return candidate;
+			} catch {}
+		}
+	}
+}
+async function defaultProbe(url, signal) {
+	const response = await fetch(url, {
+		redirect: "manual",
+		signal
+	});
+	return {
+		status: response.status,
+		body: await response.text()
+	};
+}
+function validPid(value) {
+	return typeof value === "number" && Number.isSafeInteger(value) && value > 0;
+}
+/** Only ESRCH proves the owner is gone; permission and platform errors fail safe. */
+function ownerMayBeAlive(pid) {
+	try {
+		process.kill(pid, 0);
+		return true;
+	} catch (error) {
+		return error.code !== "ESRCH";
+	}
+}
+function reapStaleTunnel(stateDir, onNotice) {
+	const pidPath = node_path.default.join(stateDir, PID_FILE);
+	const tokenPath = node_path.default.join(stateDir, TOKEN_FILE);
+	let raw;
+	try {
+		raw = node_fs.default.readFileSync(pidPath, "utf8");
+	} catch (error) {
+		if (error.code === "ENOENT") node_fs.default.rmSync(tokenPath, { force: true });
+		return;
+	}
+	let parsed;
+	try {
+		parsed = JSON.parse(raw);
+	} catch {
+		return;
+	}
+	if (typeof parsed !== "object" || parsed === null) return;
+	const record = parsed;
+	if (Object.hasOwn(record, "ownerPid")) {
+		if (!validPid(record.ownerPid) || ownerMayBeAlive(record.ownerPid)) return;
+	}
+	node_fs.default.rmSync(tokenPath, { force: true });
+	node_fs.default.rmSync(pidPath, { force: true });
+	const pid = validPid(record.pid) ? record.pid : void 0;
+	const startedAt = typeof record.startedAt === "number" ? record.startedAt : 0;
+	if (pid === void 0 || Date.now() - startedAt > PID_FILE_MAX_AGE_MS) return;
+	if (process.platform === "linux") try {
+		if (!node_fs.default.readFileSync(`/proc/${String(pid)}/cmdline`, "utf8").includes("cloudflared")) return;
+	} catch {
+		return;
+	}
+	try {
+		process.kill(pid, "SIGTERM");
+		onNotice(`stopped a tunnel left running by a previous hub (pid ${String(pid)})`);
+	} catch {}
+}
+function tailOf(lines) {
+	return lines.slice(-20).join("").trim();
+}
+/** Copies a named tunnel token to a private runtime file understood by cloudflared. */
+function writeTokenFile(config, stateDir) {
+	if (config.kind !== "named" || config.tokenFile === void 0) return void 0;
+	let token;
+	let sourcePath;
+	try {
+		sourcePath = node_fs.default.realpathSync(config.tokenFile);
+		token = node_fs.default.readFileSync(sourcePath, "utf8").trim();
+	} catch {
+		return;
+	}
+	if (token === "") return void 0;
+	node_fs.default.mkdirSync(stateDir, {
+		recursive: true,
+		mode: 448
+	});
+	const tokenPath = node_path.default.join(stateDir, TOKEN_FILE);
+	let existingTarget;
+	try {
+		existingTarget = node_fs.default.realpathSync(tokenPath);
+	} catch {}
+	if (sourcePath === node_path.default.resolve(tokenPath) || sourcePath === existingTarget) throw new Error("The configured tunnel token file cannot also be Po runtime token storage.");
+	node_fs.default.rmSync(tokenPath, { force: true });
+	node_fs.default.writeFileSync(tokenPath, token, { mode: FILE_MODE });
+	node_fs.default.chmodSync(tokenPath, FILE_MODE);
+	return tokenPath;
+}
+function createTunnelLauncher(options) {
+	const notice = options.onNotice ?? (() => {});
+	const restartBaseDelayMs = options.restartBaseDelayMs ?? NAMED_RESTART_BASE_DELAY_MS;
+	const restartStableMs = options.restartStableMs ?? NAMED_RESTART_STABLE_MS;
+	return async function launch(input) {
+		let stopped = false;
+		let activeStop;
+		let stopPromise;
+		let recoveryPromise;
+		let pendingExit;
+		let restartCount = 0;
+		let lastReadyAt = 0;
+		const recoveryAbort = new AbortController();
+		const signal = input.signal === void 0 ? recoveryAbort.signal : AbortSignal.any([input.signal, recoveryAbort.signal]);
+		const supervisedInput = {
+			...input,
+			signal
+		};
+		function queueUnexpectedExit(message) {
+			if (stopped) return;
+			if (input.config.kind === "quick") {
+				options.onExit?.(message);
+				return;
+			}
+			if (recoveryPromise !== void 0) {
+				pendingExit = message;
+				return;
+			}
+			beginRecovery(message);
+		}
+		const single = createSingleTunnelLauncher({
+			...options,
+			onExit: queueUnexpectedExit
+		});
+		async function waitForRestart(attempt) {
+			if (recoveryAbort.signal.aborted) return;
+			const delayMs = Math.min(restartBaseDelayMs * 2 ** (attempt - 1), NAMED_RESTART_MAX_DELAY_MS);
+			await new Promise((resolve) => {
+				let timer;
+				const done = () => {
+					clearTimeout(timer);
+					recoveryAbort.signal.removeEventListener("abort", done);
+					resolve();
+				};
+				timer = setTimeout(done, delayMs);
+				recoveryAbort.signal.addEventListener("abort", done, { once: true });
+				if (recoveryAbort.signal.aborted) done();
+			});
+		}
+		async function recover(initialMessage) {
+			if (Date.now() - lastReadyAt >= restartStableMs) restartCount = 0;
+			let lastFailure = initialMessage;
+			while (!stopped && restartCount < NAMED_RESTART_ATTEMPTS) {
+				restartCount += 1;
+				notice(`cloudflared stopped; restarting named tunnel (attempt ${String(restartCount)} of ${String(NAMED_RESTART_ATTEMPTS)})`);
+				await waitForRestart(restartCount);
+				if (stopped) return;
+				const outcome = await single(supervisedInput);
+				if (stopped) {
+					if (outcome.ok) await outcome.stop().catch(() => void 0);
+					return;
+				}
+				if (!outcome.ok) {
+					lastFailure = outcome.message;
+					continue;
+				}
+				activeStop = outcome.stop;
+				lastReadyAt = Date.now();
+				notice(`named tunnel recovered at ${outcome.publicOrigin}`);
+				return;
+			}
+			if (!stopped) options.onExit?.(`${initialMessage}\nNamed tunnel recovery failed after ${String(NAMED_RESTART_ATTEMPTS)} attempts. Last failure: ${lastFailure}`);
+		}
+		function beginRecovery(message) {
+			recoveryPromise = recover(message).catch((error) => {
+				if (!stopped) {
+					const cause = error instanceof Error ? error.message : String(error);
+					options.onExit?.(`${message}\nNamed tunnel recovery failed: ${cause}`);
+				}
+			}).finally(() => {
+				recoveryPromise = void 0;
+				const queued = pendingExit;
+				pendingExit = void 0;
+				if (queued !== void 0 && !stopped) beginRecovery(queued);
+			});
+		}
+		const initial = await single(supervisedInput);
+		if (!initial.ok) {
+			stopped = true;
+			recoveryAbort.abort();
+			return initial;
+		}
+		activeStop = initial.stop;
+		lastReadyAt = Date.now();
+		const stop = async () => {
+			if (stopPromise !== void 0) return await stopPromise;
+			stopped = true;
+			recoveryAbort.abort();
+			const recovering = recoveryPromise;
+			stopPromise = (async () => {
+				await activeStop?.().catch(() => void 0);
+				await recovering?.catch(() => void 0);
+				node_fs.default.rmSync(node_path.default.join(options.stateDir, PID_FILE), { force: true });
+				node_fs.default.rmSync(node_path.default.join(options.stateDir, TOKEN_FILE), { force: true });
+			})();
+			return await stopPromise;
+		};
+		return {
+			ok: true,
+			publicOrigin: initial.publicOrigin,
+			stop
+		};
+	};
+}
+/** Starts one cloudflared child; the exported launcher supervises successive named-tunnel children. */
+function createSingleTunnelLauncher(options) {
+	const notice = options.onNotice ?? (() => {});
+	const spawnProcess = options.spawnProcess ?? node_child_process.spawn;
+	const probe = options.probe ?? defaultProbe;
+	const selfTestRetryMs = options.selfTestRetryMs ?? SELF_TEST_RETRY_MS;
+	const startTimeoutMs = options.startTimeoutMs ?? START_TIMEOUT_MS;
+	const pidPath = node_path.default.join(options.stateDir, PID_FILE);
+	const runtimeTokenPath = node_path.default.join(options.stateDir, TOKEN_FILE);
+	return async function launch(input) {
+		if (input.signal?.aborted === true) return {
+			ok: false,
+			failure: "exited",
+			message: "Tunnel startup was cancelled."
+		};
+		const binary = options.cloudflaredPath ?? process.env["PO_CLOUDFLARED"] ?? findCloudflared();
+		if (binary === void 0 || binary === "") return {
+			ok: false,
+			failure: "not_installed",
+			message: require_index$1.describeTunnelFailure("not_installed")
+		};
+		let tokenPath;
+		try {
+			tokenPath = writeTokenFile(input.config, options.stateDir);
+		} catch (error) {
+			const cause = error instanceof Error ? error.message : String(error);
+			return {
+				ok: false,
+				failure: "spawn_failed",
+				message: `${require_index$1.describeTunnelFailure("spawn_failed")} ${cause}`
+			};
+		}
+		const args = require_index$1.tunnelArgs(input.config, input.port, tokenPath);
+		let child;
+		try {
+			child = spawnProcess(binary, args, {
+				detached: false,
+				stdio: [
+					"ignore",
+					"pipe",
+					"pipe"
+				]
+			});
+		} catch (error) {
+			node_fs.default.rmSync(runtimeTokenPath, { force: true });
+			const cause = error instanceof Error ? error.message : String(error);
+			return {
+				ok: false,
+				failure: "spawn_failed",
+				message: `${require_index$1.describeTunnelFailure("spawn_failed")} ${cause}`
+			};
+		}
+		const lines = [];
+		let stopped = false;
+		let settle;
+		let selfTestStarted = false;
+		const selfTestAbort = new AbortController();
+		const killTree = () => {
+			try {
+				child.kill("SIGTERM");
+			} catch {}
+		};
+		const onProcessExit = () => {
+			node_fs.default.rmSync(runtimeTokenPath, { force: true });
+			try {
+				if (child.pid !== void 0) process.kill(child.pid, "SIGKILL");
+			} catch {}
+		};
+		process.once("exit", onProcessExit);
+		const stop = async () => {
+			if (stopped) return;
+			stopped = true;
+			if (child.exitCode !== null || child.signalCode !== null) {
+				process.off("exit", onProcessExit);
+				node_fs.default.rmSync(pidPath, { force: true });
+				node_fs.default.rmSync(runtimeTokenPath, { force: true });
+				return;
+			}
+			await new Promise((resolve) => {
+				const escalate = setTimeout(() => {
+					try {
+						child.kill("SIGKILL");
+					} catch {}
+				}, TERMINATE_GRACE_MS);
+				child.once("exit", () => {
+					clearTimeout(escalate);
+					resolve();
+				});
+				killTree();
+			});
+			process.off("exit", onProcessExit);
+			node_fs.default.rmSync(pidPath, { force: true });
+			node_fs.default.rmSync(runtimeTokenPath, { force: true });
+		};
+		try {
+			node_fs.default.mkdirSync(options.stateDir, {
+				recursive: true,
+				mode: 448
+			});
+			node_fs.default.writeFileSync(pidPath, JSON.stringify({
+				pid: child.pid,
+				ownerPid: process.pid,
+				startedAt: Date.now(),
+				command: binary
+			}), { mode: FILE_MODE });
+		} catch {}
+		let seenUrl = input.config.kind === "named" ? `https://${input.config.hostname}` : void 0;
+		let seenConnection = false;
+		const waitToRetry = async () => {
+			if (selfTestRetryMs <= 0) return;
+			await new Promise((resolve) => {
+				const done = () => {
+					clearTimeout(timer);
+					selfTestAbort.signal.removeEventListener("abort", done);
+					resolve();
+				};
+				const timer = setTimeout(done, selfTestRetryMs);
+				selfTestAbort.signal.addEventListener("abort", done, { once: true });
+			});
+		};
+		/** Proves end to end that pairing is reachable and that everything else is not. */
+		const runSelfTest = async (origin) => {
+			let pairResponse;
+			let healthResponse;
+			let cause = "fetch failed";
+			for (let attempt = 0; attempt < SELF_TEST_ATTEMPTS && !selfTestAbort.signal.aborted; attempt += 1) {
+				try {
+					pairResponse = await probe(`${origin}${require_remote.PAIRING_PAGE_ROUTE}`, selfTestAbort.signal);
+					healthResponse = await probe(`${origin}/api/health`, selfTestAbort.signal);
+					if (pairResponse.status !== EDGE_TUNNEL_UNAVAILABLE && healthResponse.status !== EDGE_TUNNEL_UNAVAILABLE) break;
+					cause = `Cloudflare edge answered ${String(healthResponse.status)} before the connector registered`;
+				} catch (error) {
+					cause = error instanceof Error ? error.message : String(error);
+				}
+				if (attempt + 1 < SELF_TEST_ATTEMPTS && !selfTestAbort.signal.aborted) await waitToRetry();
+			}
+			if (pairResponse === void 0 || healthResponse === void 0) return {
+				ok: false,
+				failure: "self_test_failed",
+				message: `The tunnel did not answer: ${cause}`
+			};
+			if (healthResponse.status !== UNAUTHORIZED) {
+				const message = `${require_index$1.describeTunnelFailure("self_test_failed")} /api/health answered ${String(healthResponse.status)} through the tunnel.`;
+				notice(message);
+				return {
+					ok: false,
+					failure: "self_test_failed",
+					message
+				};
+			}
+			if (pairResponse.status !== OK || !pairResponse.body.includes("po-pairing-page")) {
+				const message = `The pairing page answered ${String(pairResponse.status)} through the tunnel.`;
+				notice(message);
+				return {
+					ok: false,
+					failure: "self_test_failed",
+					message
+				};
+			}
+			notice(`tunnel ready at ${origin}`);
+			return {
+				ok: true,
+				publicOrigin: origin,
+				stop
+			};
+		};
+		const consider = (chunk) => {
+			lines.push(chunk);
+			if (settle === void 0 || selfTestStarted) return;
+			seenUrl ??= require_index$1.extractTunnelUrl(chunk);
+			seenConnection ||= require_index$1.mentionsRegisteredConnection(chunk);
+			if (seenUrl === void 0 || !seenConnection) return;
+			selfTestStarted = true;
+			input.acceptOrigin?.(seenUrl);
+			runSelfTest(seenUrl).then((result) => settle?.(result));
+		};
+		child.stdout?.on("data", (data) => consider(data.toString()));
+		child.stderr?.on("data", (data) => consider(data.toString()));
+		return await new Promise((resolve) => {
+			let deadline;
+			const finish = (result, stopProcess = !result.ok) => {
+				if (settle === void 0) return;
+				settle = void 0;
+				clearTimeout(deadline);
+				input.signal?.removeEventListener("abort", cancel);
+				selfTestAbort.abort();
+				if (stopProcess) stop().then(() => resolve(result));
+				else resolve(result);
+			};
+			const cancel = () => {
+				finish({
+					ok: false,
+					failure: "exited",
+					message: "Tunnel startup was cancelled."
+				});
+			};
+			settle = (result) => finish(result);
+			deadline = setTimeout(() => {
+				finish({
+					ok: false,
+					failure: "timeout",
+					message: `${require_index$1.describeTunnelFailure("timeout")}\n${tailOf(lines)}`
+				});
+			}, startTimeoutMs);
+			input.signal?.addEventListener("abort", cancel, { once: true });
+			child.once("error", (error) => {
+				finish({
+					ok: false,
+					failure: "spawn_failed",
+					message: `${require_index$1.describeTunnelFailure("spawn_failed")} ${error.message}`
+				});
+			});
+			child.once("exit", (code) => {
+				process.off("exit", onProcessExit);
+				node_fs.default.rmSync(runtimeTokenPath, { force: true });
+				const message = `${require_index$1.describeTunnelFailure("exited")} (code ${String(code)})\n${tailOf(lines)}`;
+				if (settle !== void 0) {
+					finish({
+						ok: false,
+						failure: "exited",
+						message
+					}, false);
+					return;
+				}
+				if (!stopped) options.onExit?.(message);
+			});
+			if (input.signal?.aborted === true) cancel();
+		});
+	};
+}
+//#endregion
+exports.CLOUDFLARED_ENV = CLOUDFLARED_ENV;
+exports.createTunnelLauncher = createTunnelLauncher;
+exports.findCloudflared = findCloudflared;
+exports.reapStaleTunnel = reapStaleTunnel;
+
+//# sourceMappingURL=index.cjs.map