@ait-co/devtools 0.1.117 → 0.1.119

package/dist/test-runner/relay-factory.js

@@ -0,0 +1,69 @@
+//#region src/test-runner/relay-factory.ts
+/**
+* Builds a {@link RelayConnectionFactory} that opens a standalone env3 relay
+* connection.
+*
+* `open()` performs the full attach lifecycle and BLOCKS for tens of seconds (up
+* to `timeoutMs`) while a human scans the rendered QR with their phone — there
+* is no way around the manual scan for env3. It resolves with the live
+* `CdpConnection` once a matching page attaches; `close()` tears the relay
+* family down.
+*
+* The factory holds the booted relay family in a closure so `close()` can stop
+* it. A second `open()` on the same factory boots a fresh family (the previous
+* one should have been `close()`d first).
+*/
+function createRelayConnectionFactory(opts) {
+	const projectRoot = opts.projectRoot ?? process.cwd();
+	const timeoutMs = opts.timeoutMs ?? 6e5;
+	const headless = opts.headless === true;
+	let family;
+	return {
+		async open() {
+			const { prepareAttach, renderAndMaybeWait } = await import("../attach-orchestrator-DEJfLm7V.js");
+			const { injectDebugIndicator, injectGlobals } = await import("../cell-Cv3e_qwn.js");
+			const { loadRelaySecretReadOnly } = await import("../relay-secret-store-DNPJKHNs.js");
+			const { bootRelayFamily, buildRelayVerifyAuth } = await import("../debug-server-Buc8yoa7.js");
+			await loadRelaySecretReadOnly({ projectRoot });
+			const booted = await bootRelayFamily({ verifyAuth: buildRelayVerifyAuth() });
+			family = booted;
+			const attachDeps = {
+				getTunnelStatus: booted.getTunnelStatus ?? (() => ({
+					up: false,
+					wssUrl: null
+				})),
+				getTotpSecret: () => process.env.AIT_DEBUG_TOTP_SECRET,
+				qrHttpServer: void 0,
+				onAttachUrlBuilt: void 0,
+				canOpenBrowser: () => !headless
+			};
+			const prep = await prepareAttach(attachDeps, "relay-dev", { scheme_url: opts.schemeUrl }, booted.connection);
+			if (!prep.ok) {
+				booted.stop();
+				family = void 0;
+				throw new Error("createRelayConnectionFactory: attach preparation failed — check the scheme_url and that the relay tunnel is up");
+			}
+			const waitResult = await renderAndMaybeWait(attachDeps, prep, true, timeoutMs, booted.connection);
+			if (waitResult.isError) {
+				booted.stop();
+				family = void 0;
+				const timeoutSec = Math.round(timeoutMs / 1e3);
+				throw new Error(`createRelayConnectionFactory: attach timed out after ${timeoutSec}s — phone did not scan the QR within the timeout`);
+			}
+			const qrChunks = waitResult.content.filter((c) => c.type === "text").map((c) => c.text);
+			opts.onQrContent(qrChunks);
+			await injectDebugIndicator(booted.connection);
+			if (opts.cell !== void 0) await injectGlobals(booted.connection, { __AIT_CELL__: opts.cell });
+			await booted.connection.enableDomains();
+			return booted.connection;
+		},
+		async close(_connection) {
+			family?.stop();
+			family = void 0;
+		}
+	};
+}
+//#endregion
+export { createRelayConnectionFactory };
+
+//# sourceMappingURL=relay-factory.js.map

package/dist/test-runner/relay-factory.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"relay-factory.js","names":[],"sources":["../../src/test-runner/relay-factory.ts"],"sourcesContent":["/**\n * Relay connection factory for the Vitest custom pool (devtools#696).\n *\n * The Vitest pool (`pool.ts`) takes a {@link RelayConnectionFactory} that knows\n * how to `open()` a live CDP relay connection (boot relay → QR → phone scan →\n * cell inject → enableDomains) and `close()` it. Before this module that exact\n * assembly lived only inside the `devtools-test` CLI's `main()`; the standalone\n * CLI and the Vitest pool would otherwise each hand-roll it and drift.\n *\n * This is the single source of that assembly. `cli.ts` is refactored to call\n * `createRelayConnectionFactory(...).open()`, and `definePhoneVitestConfig`\n * (config.ts) exposes it so a downstream `vitest.config.ts` can wire the pool:\n *\n *   import { createRelayConnectionFactory } from '@ait-co/devtools/test-runner';\n *   const connection = createRelayConnectionFactory({\n *     schemeUrl,\n *     cell,\n *     // REQUIRED — own the stdout decision (the chunks carry the relay wss +\n *     // TOTP code). Suppress on non-interactive stdout; print otherwise.\n *     onQrContent: (chunks) => {\n *       if (!process.stdout.isTTY) return;\n *       for (const c of chunks) process.stdout.write(`${c}\\n`);\n *     },\n *   });\n *   export default defineConfig({ test: definePhoneVitestConfig({ connection }) });\n *\n * The heavy boot graph (chii relay, cloudflared, ws, debug-server) is pulled via\n * DYNAMIC import inside `open()` — so merely importing this module (or the\n * `@ait-co/devtools/test-runner` barrel) does NOT statically drag that graph in.\n *\n * SECRET-HANDLING: relay wss URLs, scheme URLs, and the TOTP secret/code are\n * never logged. `open()` reads the project-local `.ait_relay` secret read-only\n * (never mints) and the minted TOTP code rides only inside the QR `at=` param.\n *\n * Node-only. react-free (CdpConnection + lazily-imported MCP boot helpers only).\n */\n\nimport type { AttachDeps } from '../mcp/attach-orchestrator.js';\nimport type { CdpConnection } from '../mcp/cdp-connection.js';\nimport type { RelayConnectionFactory } from './pool.js';\n\n// NOTE: every value import below is a DYNAMIC import inside `open()`. This module\n// keeps ONLY type-level static imports so that re-exporting it from the\n// `@ait-co/devtools/test-runner` barrel (config.ts) does NOT statically drag the\n// heavy MCP graph (cell.ts → attach-orchestrator.ts → tools.ts → server-lock,\n// plus chii/cloudflared via debug-server) onto that Node-config entry.\n\n/** Options for {@link createRelayConnectionFactory}. */\nexport interface RelayConnectionFactoryOptions {\n  /**\n   * intoss-private:// scheme URL from `ait deploy --scheme-only` (env3). The\n   * phone cold-loads the candidate bundle this URL points at. SECRET-HANDLING:\n   * never logged.\n   */\n  schemeUrl: string;\n  /**\n   * Project root for the `.ait_relay` secret lookup (read-only). Defaults to\n   * `process.cwd()`.\n   */\n  projectRoot?: string;\n  /**\n   * Attach wait timeout in ms — how long `open()` waits for the phone to scan\n   * the QR and attach. Defaults to 600 000 (10 min) to give time for a manual\n   * scan. (The per-file evaluate timeout is separate, passed via the pool's\n   * `run` options.)\n   */\n  timeoutMs?: number;\n  /** Disable browser auto-open of the QR dashboard (text QR only). */\n  headless?: boolean;\n  /**\n   * Cell axes injected as `__AIT_CELL__` before the first test bundle runs, so\n   * sdk-example's capture picks up the correct sdkLine/platform. Optional — when\n   * omitted no cell is injected. The values are not secrets.\n   */\n  cell?: { sdkLine: string; platform: string };\n  /**\n   * Receives the QR/attach render content (text chunks) from\n   * `renderAndMaybeWait`, so the caller decides whether to print them — e.g.\n   * suppress on non-interactive stdout.\n   *\n   * REQUIRED (not optional) on purpose: these chunks contain the QR payload\n   * (which encodes the relay wss + TOTP `at=` code) and the attach JSON block.\n   * Making the hook mandatory means the factory never falls back to printing\n   * them itself — a downstream `vitest.config.ts` consumer that wires this via\n   * the `@ait-co/devtools/test-runner` barrel is forced to make an explicit\n   * stdout decision rather than silently leaking the secret-bearing block.\n   *\n   * SECRET-HANDLING: when a non-interactive caller is detected the hook MUST\n   * suppress the WHOLE chunk (not just `attachUrl`), since `relayUrl` rides in\n   * the same block.\n   */\n  onQrContent: (textChunks: string[]) => void;\n}\n\n/**\n * Builds a {@link RelayConnectionFactory} that opens a standalone env3 relay\n * connection.\n *\n * `open()` performs the full attach lifecycle and BLOCKS for tens of seconds (up\n * to `timeoutMs`) while a human scans the rendered QR with their phone — there\n * is no way around the manual scan for env3. It resolves with the live\n * `CdpConnection` once a matching page attaches; `close()` tears the relay\n * family down.\n *\n * The factory holds the booted relay family in a closure so `close()` can stop\n * it. A second `open()` on the same factory boots a fresh family (the previous\n * one should have been `close()`d first).\n */\nexport function createRelayConnectionFactory(\n  opts: RelayConnectionFactoryOptions,\n): RelayConnectionFactory {\n  const projectRoot = opts.projectRoot ?? process.cwd();\n  const timeoutMs = opts.timeoutMs ?? 600_000;\n  const headless = opts.headless === true;\n\n  // Captured so close() can stop the family that open() booted.\n  let family: { connection: CdpConnection; stop(): void } | undefined;\n\n  return {\n    async open(): Promise<CdpConnection> {\n      // Dynamic imports: keep the chii/cloudflared/debug-server graph OFF the\n      // static import graph of this module (and the test-runner config barrel).\n      const { prepareAttach, renderAndMaybeWait } = await import('../mcp/attach-orchestrator.js');\n      const { injectDebugIndicator, injectGlobals } = await import('./cell.js');\n      const { loadRelaySecretReadOnly } = await import('../mcp/relay-secret-store.js');\n      const { bootRelayFamily, buildRelayVerifyAuth } = await import('../mcp/debug-server.js');\n\n      // Load the project-local .ait_relay secret into AIT_DEBUG_TOTP_SECRET\n      // BEFORE booting the relay so assertRelayAuthConfigured()/buildRelayVerifyAuth()\n      // at the boot site see it. Read-only — never mints. SECRET-HANDLING: the\n      // value is never logged here.\n      await loadRelaySecretReadOnly({ projectRoot });\n\n      const booted = await bootRelayFamily({ verifyAuth: buildRelayVerifyAuth() });\n      family = booted;\n\n      // Assemble AttachDeps with no dashboard/SSE (CLI/pool is not the daemon).\n      const attachDeps: AttachDeps = {\n        getTunnelStatus: booted.getTunnelStatus ?? (() => ({ up: false, wssUrl: null })),\n        getTotpSecret: () => process.env.AIT_DEBUG_TOTP_SECRET,\n        qrHttpServer: undefined,\n        onAttachUrlBuilt: undefined,\n        canOpenBrowser: () => !headless,\n      };\n\n      const prep = await prepareAttach(\n        attachDeps,\n        'relay-dev',\n        { scheme_url: opts.schemeUrl },\n        booted.connection,\n      );\n      if (!prep.ok) {\n        booted.stop();\n        family = undefined;\n        // SECRET-HANDLING: do NOT surface `prep.error.content` in the thrown\n        // message. Some prep error paths build their text from attach\n        // components, and the CLI catch writes `e.message` to stderr — embedding\n        // that text risks leaking the scheme/relay wss URL. The detailed\n        // diagnostic is the daemon/dashboard's job; the factory throws a\n        // secret-free message only.\n        throw new Error(\n          'createRelayConnectionFactory: attach preparation failed — check the scheme_url and that the relay tunnel is up',\n        );\n      }\n\n      // Render the QR + wait for the phone to attach. SECRET-HANDLING: this\n      // function never logs scheme/wss/TOTP values.\n      const waitResult = await renderAndMaybeWait(\n        attachDeps,\n        prep,\n        true,\n        timeoutMs,\n        booted.connection,\n      );\n      if (waitResult.isError) {\n        booted.stop();\n        family = undefined;\n        // SECRET-HANDLING (BLOCKER fix): `waitResult.content` is the timeout\n        // result built from `buildTimeoutError(baseText, ...)`, and `baseText`\n        // is `JSON.stringify({ attachUrl, relayUrl, ... })` — `attachUrl` carries\n        // the TOTP `at=` code and `relayUrl` is the relay `wss://` URL. The CLI\n        // catch writes `e.message` to stderr, so extracting that text here would\n        // leak the relay wss + TOTP code on every timeout. Throw a secret-free\n        // message with only the timeout duration.\n        const timeoutSec = Math.round(timeoutMs / 1000);\n        throw new Error(\n          `createRelayConnectionFactory: attach timed out after ${timeoutSec}s — phone did not scan the QR within the timeout`,\n        );\n      }\n\n      // Surface the QR/attach render content to the caller, which owns the\n      // stdout decision (suppress on non-interactive stdout). There is no\n      // fallback that prints here itself: `onQrContent` is a required option so\n      // the secret-bearing block (attachUrl TOTP + relayUrl wss) can never be\n      // emitted without an explicit caller decision. SECRET-HANDLING.\n      const qrChunks = waitResult.content\n        .filter((c): c is { type: 'text'; text: string } => c.type === 'text')\n        .map((c) => c.text);\n      opts.onQrContent(qrChunks);\n\n      // Debugger attached — show the on-phone \"Debugger Connected\" badge.\n      await injectDebugIndicator(booted.connection);\n\n      // Inject the cell globals before any test bundle runs (session-global).\n      if (opts.cell !== undefined) {\n        await injectGlobals(booted.connection, { __AIT_CELL__: opts.cell });\n      }\n\n      // Open the CDP client websocket + enable domains so the first run's\n      // Runtime.evaluate and console stream are live. enableDomains is\n      // idempotent; runTestFilesOverRelay also calls it defensively.\n      await booted.connection.enableDomains();\n\n      return booted.connection;\n    },\n\n    async close(_connection: CdpConnection): Promise<void> {\n      // family.stop() is synchronous best-effort: closes the CDP connection and\n      // shuts down the relay + cloudflared child.\n      family?.stop();\n      family = undefined;\n    },\n  };\n}\n"],"mappings":";;;;;;;;;;;;;;;AA4GA,SAAgB,6BACd,MACwB;CACxB,MAAM,cAAc,KAAK,eAAe,QAAQ,KAAK;CACrD,MAAM,YAAY,KAAK,aAAa;CACpC,MAAM,WAAW,KAAK,aAAa;CAGnC,IAAI;AAEJ,QAAO;EACL,MAAM,OAA+B;GAGnC,MAAM,EAAE,eAAe,uBAAuB,MAAM,OAAO;GAC3D,MAAM,EAAE,sBAAsB,kBAAkB,MAAM,OAAO;GAC7D,MAAM,EAAE,4BAA4B,MAAM,OAAO;GACjD,MAAM,EAAE,iBAAiB,yBAAyB,MAAM,OAAO;AAM/D,SAAM,wBAAwB,EAAE,aAAa,CAAC;GAE9C,MAAM,SAAS,MAAM,gBAAgB,EAAE,YAAY,sBAAsB,EAAE,CAAC;AAC5E,YAAS;GAGT,MAAM,aAAyB;IAC7B,iBAAiB,OAAO,2BAA2B;KAAE,IAAI;KAAO,QAAQ;KAAM;IAC9E,qBAAqB,QAAQ,IAAI;IACjC,cAAc,KAAA;IACd,kBAAkB,KAAA;IAClB,sBAAsB,CAAC;IACxB;GAED,MAAM,OAAO,MAAM,cACjB,YACA,aACA,EAAE,YAAY,KAAK,WAAW,EAC9B,OAAO,WACR;AACD,OAAI,CAAC,KAAK,IAAI;AACZ,WAAO,MAAM;AACb,aAAS,KAAA;AAOT,UAAM,IAAI,MACR,iHACD;;GAKH,MAAM,aAAa,MAAM,mBACvB,YACA,MACA,MACA,WACA,OAAO,WACR;AACD,OAAI,WAAW,SAAS;AACtB,WAAO,MAAM;AACb,aAAS,KAAA;IAQT,MAAM,aAAa,KAAK,MAAM,YAAY,IAAK;AAC/C,UAAM,IAAI,MACR,wDAAwD,WAAW,kDACpE;;GAQH,MAAM,WAAW,WAAW,QACzB,QAAQ,MAA2C,EAAE,SAAS,OAAO,CACrE,KAAK,MAAM,EAAE,KAAK;AACrB,QAAK,YAAY,SAAS;AAG1B,SAAM,qBAAqB,OAAO,WAAW;AAG7C,OAAI,KAAK,SAAS,KAAA,EAChB,OAAM,cAAc,OAAO,YAAY,EAAE,cAAc,KAAK,MAAM,CAAC;AAMrE,SAAM,OAAO,WAAW,eAAe;AAEvC,UAAO,OAAO;;EAGhB,MAAM,MAAM,aAA2C;AAGrD,WAAQ,MAAM;AACd,YAAS,KAAA;;EAEZ"}

package/dist/test-runner/relay-worker.d.ts

@@ -1,2 +1,2 @@
-import { a as runTestFilesOverRelay, i as flattenResults, n as RelayRunOptions, r as RelayRunReport, t as FileResult } from "../relay-worker-DWW4vZxU.js";
+import { a as runTestFilesOverRelay, i as flattenResults, n as RelayRunOptions, r as RelayRunReport, t as FileResult } from "../relay-worker-D-3aAyDO.js";
 export { FileResult, RelayRunOptions, RelayRunReport, flattenResults, runTestFilesOverRelay };

package/dist/test-runner/relay-worker.js

@@ -1,4 +1,5 @@
 import { bundleTestFile } from "./bundle.js";
+import { parseCaptureLines } from "./capture.js";
 import { injectAndRunBundle } from "./rpc.js";
 //#region src/test-runner/relay-worker.ts
 /**
@@ -26,27 +27,45 @@ async function runTestFilesOverRelay(connection, files, opts) {
 	const wallStart = Date.now();
 	const startedAt = new Date(wallStart).toISOString();
 	const fileResults = [];
-	for (const file of files) {
-		let fileEntry;
-		try {
-			const { code } = await bundleTestFile(file, opts?.bundleOptions);
-			const rpcResult = await injectAndRunBundle(connection, code, opts?.timeoutMs);
-			if (rpcResult.ok) fileEntry = {
-				file,
-				result: rpcResult.report
-			};
-			else fileEntry = {
-				file,
-				result: { error: rpcResult.error }
-			};
-		} catch (e) {
-			fileEntry = {
-				file,
-				result: { error: e instanceof Error ? e.message : String(e) }
-			};
+	let domainsEnabled = false;
+	try {
+		await connection.enableDomains();
+		domainsEnabled = true;
+	} catch (e) {
+		process.stderr.write(`relay-worker: enableDomains() failed before run — console capture may be empty (${e instanceof Error ? e.message : String(e)})\n`);
+	}
+	const collectCaptures = opts?.collectCaptures === true;
+	const liveConsole = [];
+	let unsubscribeConsole;
+	if (collectCaptures && domainsEnabled) unsubscribeConsole = connection.on("Runtime.consoleAPICalled", (event) => {
+		liveConsole.push(event);
+	});
+	try {
+		for (const file of files) {
+			let fileEntry;
+			try {
+				const { code } = await bundleTestFile(file, opts?.bundleOptions);
+				const rpcResult = await injectAndRunBundle(connection, code, opts?.timeoutMs);
+				if (rpcResult.ok) fileEntry = {
+					file,
+					result: rpcResult.report
+				};
+				else fileEntry = {
+					file,
+					result: { error: rpcResult.error }
+				};
+			} catch (e) {
+				fileEntry = {
+					file,
+					result: { error: e instanceof Error ? e.message : String(e) }
+				};
+			}
+			fileResults.push(fileEntry);
 		}
-		fileResults.push(fileEntry);
+	} finally {
+		unsubscribeConsole?.();
 	}
+	const captures = collectCaptures ? parseCaptureLines(liveConsole.map((e) => ({ text: renderConsoleLineText(e) }))) : [];
 	const totals = fileResults.reduce((acc, { result }) => {
 		if ("error" in result) {
 			acc.failed += 1;
@@ -68,10 +87,37 @@ async function runTestFilesOverRelay(connection, files, opts) {
 		startedAt,
 		duration: Date.now() - wallStart,
 		files: fileResults,
-		totals
+		totals,
+		captures
 	};
 }
 /**
+* Renders one `Runtime.consoleAPICalled` event to a single line of text, the
+* same way `tools.ts#normalizeConsoleMessage` does (args rendered + space-
+* joined). Inlined here (≈8 lines) so this module avoids importing `tools.ts`,
+* which would drag the heavy MCP/Node graph (server-lock, parent-watcher, …)
+* onto the test-runner entry.
+*
+* SECRET-HANDLING: this only stringifies console args; the caller's
+* allowlist-prefix parser then discards everything that is not a genuine
+* `__AIT_CAPTURE__` line.
+*/
+function renderConsoleLineText(event) {
+	return event.args.map((arg) => {
+		if (arg.value !== void 0) {
+			if (typeof arg.value === "string") return arg.value;
+			try {
+				return JSON.stringify(arg.value);
+			} catch {
+				return String(arg.value);
+			}
+		}
+		if (arg.description !== void 0) return arg.description;
+		if (arg.className !== void 0) return arg.className;
+		return arg.subtype ?? arg.type;
+	}).join(" ");
+}
+/**
 * Flattens all test results from a `RelayRunReport` into a single array.
 * Files that errored during bundle/inject produce a synthetic failed entry.
 */

package/dist/test-runner/relay-worker.js.map

@@ -1 +1 @@
-{"version":3,"file":"relay-worker.js","names":[],"sources":["../../src/test-runner/relay-worker.ts"],"sourcesContent":["/**\n * Orchestrator: runs a list of test files sequentially over a CDP relay.\n *\n * Each file goes through: bundle → inject → run → collect.\n * This is the transport layer: it does NOT integrate with Vitest's pool or the\n * MCP surface. The Vitest custom pool (`pool.ts`) and the `run_tests` MCP tool\n * are separate callers that build on this orchestrator.\n *\n * Single-attach constraint: only one page is active at a time. Files run\n * sequentially; parallel execution across targets is out of scope.\n *\n * The 30-second per-file timeout is inherited from `injectAndRunBundle`.\n * For suites that exceed it, split the file into smaller pieces.\n *\n * SECRET-HANDLING: file paths are surfaced in reports; relay URLs are not.\n */\n\nimport type { CdpConnection } from '../mcp/cdp-connection.js';\nimport { type BundleOptions, bundleTestFile } from './bundle.js';\nimport { injectAndRunBundle } from './rpc.js';\nimport type { RunReport, TestResult } from './runtime.js';\n\n/** Per-file result in the aggregate `RunReport`. */\nexport interface FileResult {\n  /** Absolute or relative path to the test file. */\n  file: string;\n  /** Full run report for this file, or an error if bundling/injection failed. */\n  result: RunReport | { error: string };\n}\n\n/** Aggregate report returned by `runTestFilesOverRelay`. */\nexport interface RelayRunReport {\n  /** ISO timestamp of when the run started. */\n  startedAt: string;\n  /** Total elapsed wall-clock milliseconds. */\n  duration: number;\n  /** Per-file results in execution order. */\n  files: FileResult[];\n  /** Flattened totals across all files. */\n  totals: {\n    passed: number;\n    failed: number;\n    skipped: number;\n    total: number;\n  };\n}\n\n/** Options for `runTestFilesOverRelay`. */\nexport interface RelayRunOptions {\n  /**\n   * Options forwarded to `bundleTestFile` for each file.\n   */\n  bundleOptions?: BundleOptions;\n  /**\n   * Per-file evaluate timeout in milliseconds. Defaults to 30 000.\n   * Increase for long-running suites or split the file.\n   */\n  timeoutMs?: number;\n}\n\n/**\n * Runs all `files` sequentially over the given CDP `connection`.\n *\n * For each file:\n *   1. Bundle with esbuild (includes SDK shim + runtime).\n *   2. Inject into the attached page via `Runtime.evaluate`.\n *   3. Await the `RunReport` JSON response.\n *   4. Accumulate results.\n *\n * Returns a `RelayRunReport` with per-file results and flattened totals.\n *\n * This function does NOT open or manage the relay connection — the caller\n * is responsible for attaching and closing it.\n *\n * TODO (#645): implement the Vitest `PoolRunnerInitializer` interface here\n * so that `runTestFilesOverRelay` can be used as a Vitest pool entry.\n *\n * @param connection - Active CDP connection (relay or local kind).\n * @param files      - Absolute paths to test files, run in order.\n * @param opts       - Optional per-run overrides.\n */\nexport async function runTestFilesOverRelay(\n  connection: CdpConnection,\n  files: string[],\n  opts?: RelayRunOptions,\n): Promise<RelayRunReport> {\n  const wallStart = Date.now();\n  const startedAt = new Date(wallStart).toISOString();\n  const fileResults: FileResult[] = [];\n\n  for (const file of files) {\n    let fileEntry: FileResult;\n    try {\n      const { code } = await bundleTestFile(file, opts?.bundleOptions);\n      const rpcResult = await injectAndRunBundle(connection, code, opts?.timeoutMs);\n      if (rpcResult.ok) {\n        fileEntry = { file, result: rpcResult.report };\n      } else {\n        fileEntry = { file, result: { error: rpcResult.error } };\n      }\n    } catch (e) {\n      // Capture bundle/inject errors per-file so subsequent files still run.\n      fileEntry = {\n        file,\n        result: {\n          error: e instanceof Error ? e.message : String(e),\n        },\n      };\n    }\n    fileResults.push(fileEntry);\n  }\n\n  const totals = fileResults.reduce(\n    (acc, { result }) => {\n      if ('error' in result) {\n        // Treat whole-file errors as a single failure.\n        acc.failed += 1;\n        acc.total += 1;\n      } else {\n        acc.passed += result.passed;\n        acc.failed += result.failed;\n        acc.skipped += result.skipped;\n        acc.total += result.passed + result.failed + result.skipped;\n      }\n      return acc;\n    },\n    { passed: 0, failed: 0, skipped: 0, total: 0 },\n  );\n\n  return {\n    startedAt,\n    duration: Date.now() - wallStart,\n    files: fileResults,\n    totals,\n  };\n}\n\n/**\n * Flattens all test results from a `RelayRunReport` into a single array.\n * Files that errored during bundle/inject produce a synthetic failed entry.\n */\nexport function flattenResults(report: RelayRunReport): Array<TestResult & { file: string }> {\n  const out: Array<TestResult & { file: string }> = [];\n  for (const { file, result } of report.files) {\n    if ('error' in result) {\n      out.push({\n        file,\n        name: `<bundle/inject error>`,\n        status: 'fail',\n        duration: 0,\n        error: result.error,\n      });\n    } else {\n      for (const t of result.tests) {\n        out.push({ ...t, file });\n      }\n    }\n  }\n  return out;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;AAiFA,eAAsB,sBACpB,YACA,OACA,MACyB;CACzB,MAAM,YAAY,KAAK,KAAK;CAC5B,MAAM,YAAY,IAAI,KAAK,UAAU,CAAC,aAAa;CACnD,MAAM,cAA4B,EAAE;AAEpC,MAAK,MAAM,QAAQ,OAAO;EACxB,IAAI;AACJ,MAAI;GACF,MAAM,EAAE,SAAS,MAAM,eAAe,MAAM,MAAM,cAAc;GAChE,MAAM,YAAY,MAAM,mBAAmB,YAAY,MAAM,MAAM,UAAU;AAC7E,OAAI,UAAU,GACZ,aAAY;IAAE;IAAM,QAAQ,UAAU;IAAQ;OAE9C,aAAY;IAAE;IAAM,QAAQ,EAAE,OAAO,UAAU,OAAO;IAAE;WAEnD,GAAG;AAEV,eAAY;IACV;IACA,QAAQ,EACN,OAAO,aAAa,QAAQ,EAAE,UAAU,OAAO,EAAE,EAClD;IACF;;AAEH,cAAY,KAAK,UAAU;;CAG7B,MAAM,SAAS,YAAY,QACxB,KAAK,EAAE,aAAa;AACnB,MAAI,WAAW,QAAQ;AAErB,OAAI,UAAU;AACd,OAAI,SAAS;SACR;AACL,OAAI,UAAU,OAAO;AACrB,OAAI,UAAU,OAAO;AACrB,OAAI,WAAW,OAAO;AACtB,OAAI,SAAS,OAAO,SAAS,OAAO,SAAS,OAAO;;AAEtD,SAAO;IAET;EAAE,QAAQ;EAAG,QAAQ;EAAG,SAAS;EAAG,OAAO;EAAG,CAC/C;AAED,QAAO;EACL;EACA,UAAU,KAAK,KAAK,GAAG;EACvB,OAAO;EACP;EACD;;;;;;AAOH,SAAgB,eAAe,QAA8D;CAC3F,MAAM,MAA4C,EAAE;AACpD,MAAK,MAAM,EAAE,MAAM,YAAY,OAAO,MACpC,KAAI,WAAW,OACb,KAAI,KAAK;EACP;EACA,MAAM;EACN,QAAQ;EACR,UAAU;EACV,OAAO,OAAO;EACf,CAAC;KAEF,MAAK,MAAM,KAAK,OAAO,MACrB,KAAI,KAAK;EAAE,GAAG;EAAG;EAAM,CAAC;AAI9B,QAAO"}
+{"version":3,"file":"relay-worker.js","names":[],"sources":["../../src/test-runner/relay-worker.ts"],"sourcesContent":["/**\n * Orchestrator: runs a list of test files sequentially over a CDP relay.\n *\n * Each file goes through: bundle → inject → run → collect.\n * This is the transport layer: it does NOT integrate with Vitest's pool or the\n * MCP surface. The Vitest custom pool (`pool.ts`) and the `run_tests` MCP tool\n * are separate callers that build on this orchestrator.\n *\n * Single-attach constraint: only one page is active at a time. Files run\n * sequentially; parallel execution across targets is out of scope.\n *\n * The 30-second per-file timeout is inherited from `injectAndRunBundle`.\n * For suites that exceed it, split the file into smaller pieces.\n *\n * SECRET-HANDLING: file paths are surfaced in reports; relay URLs are not.\n */\n\nimport type { CdpConnection, ConsoleApiCalledEvent } from '../mcp/cdp-connection.js';\nimport { type BundleOptions, bundleTestFile } from './bundle.js';\nimport { type AitCaptureLine, parseCaptureLines } from './capture.js';\nimport { injectAndRunBundle } from './rpc.js';\nimport type { RunReport, TestResult } from './runtime.js';\n\n/** Per-file result in the aggregate `RunReport`. */\nexport interface FileResult {\n  /** Absolute or relative path to the test file. */\n  file: string;\n  /** Full run report for this file, or an error if bundling/injection failed. */\n  result: RunReport | { error: string };\n}\n\n/** Aggregate report returned by `runTestFilesOverRelay`. */\nexport interface RelayRunReport {\n  /** ISO timestamp of when the run started. */\n  startedAt: string;\n  /** Total elapsed wall-clock milliseconds. */\n  duration: number;\n  /** Per-file results in execution order. */\n  files: FileResult[];\n  /** Flattened totals across all files. */\n  totals: {\n    passed: number;\n    failed: number;\n    skipped: number;\n    total: number;\n  };\n  /**\n   * `__AIT_CAPTURE__` lines harvested from the page console during the run\n   * (additive field, devtools#696). Empty unless `collectCaptures` was set.\n   * Each entry is opaque (`{ category, json }`) — devtools does not interpret\n   * the record shape, only forwards it for downstream 2.x↔3.0 diffing.\n   *\n   * SECRET-HANDLING: only lines matching the `__AIT_CAPTURE__ ` allowlist\n   * prefix reach here; relay/wss/scheme noise lines are dropped in\n   * `parseCaptureLines`.\n   */\n  captures: AitCaptureLine[];\n}\n\n/** Options for `runTestFilesOverRelay`. */\nexport interface RelayRunOptions {\n  /**\n   * Options forwarded to `bundleTestFile` for each file.\n   */\n  bundleOptions?: BundleOptions;\n  /**\n   * Per-file evaluate timeout in milliseconds. Defaults to 30 000.\n   * Increase for long-running suites or split the file.\n   */\n  timeoutMs?: number;\n  /**\n   * When `true`, registers a live `Runtime.consoleAPICalled` listener for the\n   * duration of the run and harvests `__AIT_CAPTURE__` lines into\n   * `RelayRunReport.captures`. Defaults to **false** so the build-only\n   * eval/e2e path (and the Vitest pool) pay no listener/state overhead —\n   * `captures` is then an empty array.\n   *\n   * The listener is registered just BEFORE the first file runs and removed in a\n   * `finally` so it never accumulates across runs (no ring-buffer drain — the\n   * default 500-entry buffer would silently drop lines via `shift`).\n   */\n  collectCaptures?: boolean;\n}\n\n/**\n * Runs all `files` sequentially over the given CDP `connection`.\n *\n * For each file:\n *   1. Bundle with esbuild (includes SDK shim + runtime).\n *   2. Inject into the attached page via `Runtime.evaluate`.\n *   3. Await the `RunReport` JSON response.\n *   4. Accumulate results.\n *\n * Returns a `RelayRunReport` with per-file results and flattened totals.\n *\n * This function does NOT open or manage the relay connection — the caller\n * is responsible for attaching and closing it.\n *\n * TODO (#645): implement the Vitest `PoolRunnerInitializer` interface here\n * so that `runTestFilesOverRelay` can be used as a Vitest pool entry.\n *\n * @param connection - Active CDP connection (relay or local kind).\n * @param files      - Absolute paths to test files, run in order.\n * @param opts       - Optional per-run overrides.\n */\nexport async function runTestFilesOverRelay(\n  connection: CdpConnection,\n  files: string[],\n  opts?: RelayRunOptions,\n): Promise<RelayRunReport> {\n  const wallStart = Date.now();\n  const startedAt = new Date(wallStart).toISOString();\n  const fileResults: FileResult[] = [];\n\n  // Enable CDP domains ONCE up front. Without this the relay connection has not\n  // opened its client websocket, so the very first `Runtime.evaluate` (in\n  // `injectAndRunBundle`) explodes AND `Runtime.consoleAPICalled` never streams\n  // — the console capture harvest would be structurally 0. `enableDomains()` is\n  // idempotent (see chii-connection: early-returns when the ws is already OPEN,\n  // and shares an in-flight promise), so calling it here is safe even when a\n  // caller (the MCP `run_tests` path) already enabled it.\n  //\n  // Failure here (e.g. no target attached yet) must NOT throw the whole run: the\n  // per-file inject below produces a structured error result instead. We warn on\n  // stderr (secret-free) and continue. SECRET-HANDLING: the message names the\n  // failure only — no relay/wss URL.\n  let domainsEnabled = false;\n  try {\n    await connection.enableDomains();\n    domainsEnabled = true;\n  } catch (e) {\n    process.stderr.write(\n      `relay-worker: enableDomains() failed before run — console capture may be empty (${\n        e instanceof Error ? e.message : String(e)\n      })\\n`,\n    );\n  }\n\n  // Live console capture (#696): when requested, accumulate every\n  // `Runtime.consoleAPICalled` event into a local array via a LIVE listener\n  // registered just before the run. We deliberately do NOT drain\n  // `getBufferedEvents` after the fact — that ring buffer caps at 500 and\n  // `shift()`s older entries, so a chatty run would silently lose capture lines.\n  // The listener is removed in `finally` so it never bleeds into the next run.\n  //\n  // Gate the listener on `domainsEnabled`: if enableDomains() soft-failed, the\n  // client ws never opened so `Runtime.consoleAPICalled` cannot stream —\n  // registering would only add a dead listener that never fires. (The `finally`\n  // unsubscribe is an undefined no-op in that case, so this stays safe.)\n  const collectCaptures = opts?.collectCaptures === true;\n  const liveConsole: ConsoleApiCalledEvent[] = [];\n  let unsubscribeConsole: (() => void) | undefined;\n  if (collectCaptures && domainsEnabled) {\n    unsubscribeConsole = connection.on('Runtime.consoleAPICalled', (event) => {\n      liveConsole.push(event);\n    });\n  }\n\n  try {\n    for (const file of files) {\n      let fileEntry: FileResult;\n      try {\n        const { code } = await bundleTestFile(file, opts?.bundleOptions);\n        const rpcResult = await injectAndRunBundle(connection, code, opts?.timeoutMs);\n        if (rpcResult.ok) {\n          fileEntry = { file, result: rpcResult.report };\n        } else {\n          fileEntry = { file, result: { error: rpcResult.error } };\n        }\n      } catch (e) {\n        // Capture bundle/inject errors per-file so subsequent files still run.\n        fileEntry = {\n          file,\n          result: {\n            error: e instanceof Error ? e.message : String(e),\n          },\n        };\n      }\n      fileResults.push(fileEntry);\n    }\n  } finally {\n    // Always remove the live listener — leaking it would accumulate across runs\n    // on a reused connection (the Vitest pool keeps one connection for the whole\n    // run; the MCP daemon keeps one for the session).\n    unsubscribeConsole?.();\n  }\n\n  // Convert the accumulated console events to `__AIT_CAPTURE__` lines. Each\n  // event's args are rendered to a single line text (inlined console rendering —\n  // no tools.ts import, to keep this module off the heavy MCP graph), then the\n  // allowlist-prefix parser keeps only genuine capture lines.\n  const captures = collectCaptures\n    ? parseCaptureLines(liveConsole.map((e) => ({ text: renderConsoleLineText(e) })))\n    : [];\n\n  const totals = fileResults.reduce(\n    (acc, { result }) => {\n      if ('error' in result) {\n        // Treat whole-file errors as a single failure.\n        acc.failed += 1;\n        acc.total += 1;\n      } else {\n        acc.passed += result.passed;\n        acc.failed += result.failed;\n        acc.skipped += result.skipped;\n        acc.total += result.passed + result.failed + result.skipped;\n      }\n      return acc;\n    },\n    { passed: 0, failed: 0, skipped: 0, total: 0 },\n  );\n\n  return {\n    startedAt,\n    duration: Date.now() - wallStart,\n    files: fileResults,\n    totals,\n    captures,\n  };\n}\n\n/**\n * Renders one `Runtime.consoleAPICalled` event to a single line of text, the\n * same way `tools.ts#normalizeConsoleMessage` does (args rendered + space-\n * joined). Inlined here (≈8 lines) so this module avoids importing `tools.ts`,\n * which would drag the heavy MCP/Node graph (server-lock, parent-watcher, …)\n * onto the test-runner entry.\n *\n * SECRET-HANDLING: this only stringifies console args; the caller's\n * allowlist-prefix parser then discards everything that is not a genuine\n * `__AIT_CAPTURE__` line.\n */\nfunction renderConsoleLineText(event: ConsoleApiCalledEvent): string {\n  return event.args\n    .map((arg) => {\n      if (arg.value !== undefined) {\n        if (typeof arg.value === 'string') return arg.value;\n        try {\n          return JSON.stringify(arg.value);\n        } catch {\n          return String(arg.value);\n        }\n      }\n      if (arg.description !== undefined) return arg.description;\n      if (arg.className !== undefined) return arg.className;\n      return arg.subtype ?? arg.type;\n    })\n    .join(' ');\n}\n\n/**\n * Flattens all test results from a `RelayRunReport` into a single array.\n * Files that errored during bundle/inject produce a synthetic failed entry.\n */\nexport function flattenResults(report: RelayRunReport): Array<TestResult & { file: string }> {\n  const out: Array<TestResult & { file: string }> = [];\n  for (const { file, result } of report.files) {\n    if ('error' in result) {\n      out.push({\n        file,\n        name: `<bundle/inject error>`,\n        status: 'fail',\n        duration: 0,\n        error: result.error,\n      });\n    } else {\n      for (const t of result.tests) {\n        out.push({ ...t, file });\n      }\n    }\n  }\n  return out;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;AAyGA,eAAsB,sBACpB,YACA,OACA,MACyB;CACzB,MAAM,YAAY,KAAK,KAAK;CAC5B,MAAM,YAAY,IAAI,KAAK,UAAU,CAAC,aAAa;CACnD,MAAM,cAA4B,EAAE;CAcpC,IAAI,iBAAiB;AACrB,KAAI;AACF,QAAM,WAAW,eAAe;AAChC,mBAAiB;UACV,GAAG;AACV,UAAQ,OAAO,MACb,mFACE,aAAa,QAAQ,EAAE,UAAU,OAAO,EAAE,CAC3C,KACF;;CAcH,MAAM,kBAAkB,MAAM,oBAAoB;CAClD,MAAM,cAAuC,EAAE;CAC/C,IAAI;AACJ,KAAI,mBAAmB,eACrB,sBAAqB,WAAW,GAAG,6BAA6B,UAAU;AACxE,cAAY,KAAK,MAAM;GACvB;AAGJ,KAAI;AACF,OAAK,MAAM,QAAQ,OAAO;GACxB,IAAI;AACJ,OAAI;IACF,MAAM,EAAE,SAAS,MAAM,eAAe,MAAM,MAAM,cAAc;IAChE,MAAM,YAAY,MAAM,mBAAmB,YAAY,MAAM,MAAM,UAAU;AAC7E,QAAI,UAAU,GACZ,aAAY;KAAE;KAAM,QAAQ,UAAU;KAAQ;QAE9C,aAAY;KAAE;KAAM,QAAQ,EAAE,OAAO,UAAU,OAAO;KAAE;YAEnD,GAAG;AAEV,gBAAY;KACV;KACA,QAAQ,EACN,OAAO,aAAa,QAAQ,EAAE,UAAU,OAAO,EAAE,EAClD;KACF;;AAEH,eAAY,KAAK,UAAU;;WAErB;AAIR,wBAAsB;;CAOxB,MAAM,WAAW,kBACb,kBAAkB,YAAY,KAAK,OAAO,EAAE,MAAM,sBAAsB,EAAE,EAAE,EAAE,CAAC,GAC/E,EAAE;CAEN,MAAM,SAAS,YAAY,QACxB,KAAK,EAAE,aAAa;AACnB,MAAI,WAAW,QAAQ;AAErB,OAAI,UAAU;AACd,OAAI,SAAS;SACR;AACL,OAAI,UAAU,OAAO;AACrB,OAAI,UAAU,OAAO;AACrB,OAAI,WAAW,OAAO;AACtB,OAAI,SAAS,OAAO,SAAS,OAAO,SAAS,OAAO;;AAEtD,SAAO;IAET;EAAE,QAAQ;EAAG,QAAQ;EAAG,SAAS;EAAG,OAAO;EAAG,CAC/C;AAED,QAAO;EACL;EACA,UAAU,KAAK,KAAK,GAAG;EACvB,OAAO;EACP;EACA;EACD;;;;;;;;;;;;;AAcH,SAAS,sBAAsB,OAAsC;AACnE,QAAO,MAAM,KACV,KAAK,QAAQ;AACZ,MAAI,IAAI,UAAU,KAAA,GAAW;AAC3B,OAAI,OAAO,IAAI,UAAU,SAAU,QAAO,IAAI;AAC9C,OAAI;AACF,WAAO,KAAK,UAAU,IAAI,MAAM;WAC1B;AACN,WAAO,OAAO,IAAI,MAAM;;;AAG5B,MAAI,IAAI,gBAAgB,KAAA,EAAW,QAAO,IAAI;AAC9C,MAAI,IAAI,cAAc,KAAA,EAAW,QAAO,IAAI;AAC5C,SAAO,IAAI,WAAW,IAAI;GAC1B,CACD,KAAK,IAAI;;;;;;AAOd,SAAgB,eAAe,QAA8D;CAC3F,MAAM,MAA4C,EAAE;AACpD,MAAK,MAAM,EAAE,MAAM,YAAY,OAAO,MACpC,KAAI,WAAW,OACb,KAAI,KAAK;EACP;EACA,MAAM;EACN,QAAQ;EACR,UAAU;EACV,OAAO,OAAO;EACf,CAAC;KAEF,MAAK,MAAM,KAAK,OAAO,MACrB,KAAI,KAAK;EAAE,GAAG;EAAG;EAAM,CAAC;AAI9B,QAAO"}

package/dist/test-runner/report.d.ts

@@ -0,0 +1,106 @@
+import { t as AitCaptureLine } from "../capture-BmK_cBqQ.js";
+import { n as TestResult } from "../runtime-D57Rtnsd.js";
+import { r as RelayRunReport } from "../relay-worker-D-3aAyDO.js";
+
+//#region src/test-runner/report.d.ts
+/** The cell axes a report is stamped with — the test-matrix coordinates. */
+interface ReportCellMeta {
+  /** SDK line under test (e.g. `'2.x'` / `'3.x'`). */
+  sdkLine: string;
+  /** Platform under test (e.g. `'ios'` / `'android'` / `'mock'`). */
+  platform: string;
+  /**
+   * Project root the run was launched from. Used ONLY to relativise file paths
+   * out of the serialised report — never stored in the output. SECRET-HANDLING:
+   * absolute project paths must not leak into artifacts.
+   */
+  projectRoot: string;
+}
+/** Per-file slice of a {@link RunnerAgnosticReport}. */
+interface RunnerAgnosticFileReport {
+  /**
+   * Test file path, RELATIVE to `projectRoot`. Never absolute — `path.relative`
+   * strips the machine-specific prefix so the artifact is portable and leaks no
+   * local filesystem layout.
+   */
+  file: string;
+  /** Whole-file bundle/inject error (matcher message only), when the file failed. */
+  error?: string;
+  /** In-page run duration (ms) for this file, when it ran. */
+  duration?: number;
+  passed?: number;
+  failed?: number;
+  skipped?: number;
+  /** Per-test results, when the file ran. Error strings are matcher messages only. */
+  tests?: TestResult[];
+}
+/**
+ * The runner-neutral, secret-free report written to disk. There are
+ * intentionally NO wss/scheme/TOTP/relayUrl fields on this type — the absence is
+ * load-bearing (SECRET-HANDLING) and must not be "completed" by a future edit.
+ */
+interface RunnerAgnosticReport {
+  /** Cell axes this run belongs to — baked into the body for portability. */
+  cell: {
+    sdkLine: string;
+    platform: string;
+  };
+  /** ISO timestamp of when the run started (from the core report). */
+  startedAt: string;
+  /** Total wall-clock ms (bundling + sequential injection). */
+  duration: number;
+  /** Flattened totals across all files. */
+  totals: RelayRunReport['totals'];
+  /** Per-file results with projectRoot-relative paths. */
+  files: RunnerAgnosticFileReport[];
+}
+/**
+ * Serialises a {@link RelayRunReport} into the runner-agnostic, secret-free
+ * on-disk shape. Pure — no IO; testable with a plain report + meta.
+ *
+ * @param report - The core relay run report.
+ * @param meta   - Cell axes + projectRoot (projectRoot is consumed, not stored).
+ */
+declare function serializeRelayReport(report: RelayRunReport, meta: ReportCellMeta): RunnerAgnosticReport;
+/**
+ * Writes the serialised report to `<dir>/<sdkLine>.<platform>.json`, creating
+ * `dir` if needed. Returns the absolute path written.
+ *
+ * The cell-suffixed filename keeps 2.x and 3.0 (and per-platform) runs as
+ * distinct artifacts in the same directory; the same cell metadata is also baked
+ * into the body so a renamed/moved file still carries its provenance.
+ *
+ * SECRET-HANDLING: the written body contains no relay/secret fields (the schema
+ * has none). `dir`/`projectRoot` are local filesystem paths, never logged here.
+ *
+ * @param report - The core relay run report.
+ * @param dir    - Output directory (created recursively if missing).
+ * @param meta   - Cell axes + projectRoot.
+ * @returns The absolute path of the written file.
+ */
+declare function writeReportArtifact(report: RelayRunReport, dir: string, meta: ReportCellMeta): Promise<string>;
+/**
+ * Writes harvested `__AIT_CAPTURE__` lines to per-category files under `dir`,
+ * named `<category>.<sdkLine>.<platform>.json` — the SAME convention
+ * sdk-example's env1 `flushCapture` uses on the filesystem, so env1 and env3
+ * capture artifacts line up for diffing.
+ *
+ * Each line's `json` payload is an opaque JSON array of capture records. Lines
+ * sharing a category are concatenated into one array, in harvest order.
+ *
+ * SECRET-HANDLING: only allowlist-prefixed capture lines reach here (the parser
+ * dropped wss/scheme noise); the `json` payload is written verbatim but is a
+ * capture record array, not a relay/secret.
+ *
+ * @param captures - Parsed capture lines (from `RelayRunReport.captures`).
+ * @param dir      - Output directory (created recursively if missing).
+ * @param cell     - Cell axes for the filename suffix.
+ * @returns The absolute paths written (one per category), in category order.
+ */
+declare function writeCaptureArtifacts(captures: ReadonlyArray<AitCaptureLine>, dir: string, cell: {
+  sdkLine: string;
+  platform: string;
+}): Promise<string[]>;
+//#endregion
+export { ReportCellMeta, RunnerAgnosticFileReport, RunnerAgnosticReport, serializeRelayReport, writeCaptureArtifacts, writeReportArtifact };
+//# sourceMappingURL=report.d.ts.map

package/dist/test-runner/report.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"report.d.ts","names":[],"sources":["../../src/test-runner/report.ts"],"mappings":";;;;;;UA+BiB,cAAA;EAqCA;EAnCf,OAAA;;EAEA,QAAA;EAmCA;;;;;EA7BA,WAAA;AAAA;;UAIe,wBAAA;EAiCgB;;AA4BjC;;;EAvDE,IAAA;EAyDM;EAvDN,KAAA;EAwDqB;EAtDrB,QAAA;EACA,MAAA;EACA,MAAA;EACA,OAAA;EAkDA;EAhDA,KAAA,GAAQ,UAAA;AAAA;;AA0FV;;;;UAlFiB,oBAAA;EAsFd;EApFD,IAAA;IAAQ,OAAA;IAAiB,QAAA;EAAA;EAkFzB;EAhFA,SAAA;EAiFA;EA/EA,QAAA;EAgFQ;EA9ER,MAAA,EAAQ,cAAA;EAwGY;EAtGpB,KAAA,EAAO,wBAAA;AAAA;;;;;;;;iBA4BO,oBAAA,CACd,MAAA,EAAQ,cAAA,EACR,IAAA,EAAM,cAAA,GACL,oBAAA;;;;;;;;;;;;;;;;;iBAyCmB,mBAAA,CACpB,MAAA,EAAQ,cAAA,EACR,GAAA,UACA,IAAA,EAAM,cAAA,GACL,OAAA;;;;;;;;;;;;;;;;;;;iBA0BmB,qBAAA,CACpB,QAAA,EAAU,aAAA,CAAc,cAAA,GACxB,GAAA,UACA,IAAA;EAAQ,OAAA;EAAiB,QAAA;AAAA,IACxB,OAAA"}

package/dist/test-runner/report.js

@@ -0,0 +1,139 @@
+import { mkdir, writeFile } from "node:fs/promises";
+import path from "node:path";
+//#region src/test-runner/report.ts
+/**
+* Runner-agnostic report serialisation for env3 test runs (devtools#696).
+*
+* Both env3 execution paths — the Vitest custom pool (`pool.ts`) and the
+* standalone `devtools-test` CLI (`cli.ts`) — call the same core
+* `runTestFilesOverRelay` and so produce the same {@link RelayRunReport}. This
+* module is the single, runner-neutral place that turns that in-memory report
+* into a stable on-disk artifact so a 2.x run and a 3.0 run can be diffed
+* cell-by-cell after the fact.
+*
+* The serialised schema is deliberately MINIMAL and secret-free:
+*
+*   - file paths are stored RELATIVE to `projectRoot` (no absolute `/Users/...`
+*     leakage — see {@link RunnerAgnosticReport.files});
+*   - the cell metadata (sdkLine/platform) is baked INTO the body, not only the
+*     filename, so a moved artifact never loses its provenance;
+*   - NO relay wss / scheme / TOTP / relayUrl fields exist in the schema at all
+*     (enforced by the type + this comment) — error strings are the matcher
+*     message only, inherited from rpc.ts which already strips expression/value.
+*
+* react-free — depends only on the type-level `RelayRunReport` and `node:fs` /
+* `node:path`. Safe to bundle without pulling the chii/cloudflared graph.
+*/
+/**
+* Converts an absolute (or already-relative) file path to a projectRoot-relative
+* one. `path.relative` returns `''` when the paths are equal — guard that to the
+* basename so the field is never empty.
+*
+* SECRET-HANDLING: this is the single choke point that strips absolute project
+* paths from the artifact.
+*/
+function relativise(projectRoot, file) {
+	const rel = path.relative(projectRoot, file);
+	if (rel === "" || rel.startsWith("..") || path.isAbsolute(rel)) return path.basename(file);
+	return rel;
+}
+/**
+* Serialises a {@link RelayRunReport} into the runner-agnostic, secret-free
+* on-disk shape. Pure — no IO; testable with a plain report + meta.
+*
+* @param report - The core relay run report.
+* @param meta   - Cell axes + projectRoot (projectRoot is consumed, not stored).
+*/
+function serializeRelayReport(report, meta) {
+	return {
+		cell: {
+			sdkLine: meta.sdkLine,
+			platform: meta.platform
+		},
+		startedAt: report.startedAt,
+		duration: report.duration,
+		totals: report.totals,
+		files: report.files.map((f) => {
+			const file = relativise(meta.projectRoot, f.file);
+			if ("error" in f.result) return {
+				file,
+				error: f.result.error
+			};
+			return {
+				file,
+				duration: f.result.duration,
+				passed: f.result.passed,
+				failed: f.result.failed,
+				skipped: f.result.skipped,
+				tests: f.result.tests
+			};
+		})
+	};
+}
+/**
+* Writes the serialised report to `<dir>/<sdkLine>.<platform>.json`, creating
+* `dir` if needed. Returns the absolute path written.
+*
+* The cell-suffixed filename keeps 2.x and 3.0 (and per-platform) runs as
+* distinct artifacts in the same directory; the same cell metadata is also baked
+* into the body so a renamed/moved file still carries its provenance.
+*
+* SECRET-HANDLING: the written body contains no relay/secret fields (the schema
+* has none). `dir`/`projectRoot` are local filesystem paths, never logged here.
+*
+* @param report - The core relay run report.
+* @param dir    - Output directory (created recursively if missing).
+* @param meta   - Cell axes + projectRoot.
+* @returns The absolute path of the written file.
+*/
+async function writeReportArtifact(report, dir, meta) {
+	const serialised = serializeRelayReport(report, meta);
+	await mkdir(dir, { recursive: true });
+	const outFile = path.join(dir, `${meta.sdkLine}.${meta.platform}.json`);
+	await writeFile(outFile, `${JSON.stringify(serialised, null, 2)}\n`, "utf8");
+	return outFile;
+}
+/**
+* Writes harvested `__AIT_CAPTURE__` lines to per-category files under `dir`,
+* named `<category>.<sdkLine>.<platform>.json` — the SAME convention
+* sdk-example's env1 `flushCapture` uses on the filesystem, so env1 and env3
+* capture artifacts line up for diffing.
+*
+* Each line's `json` payload is an opaque JSON array of capture records. Lines
+* sharing a category are concatenated into one array, in harvest order.
+*
+* SECRET-HANDLING: only allowlist-prefixed capture lines reach here (the parser
+* dropped wss/scheme noise); the `json` payload is written verbatim but is a
+* capture record array, not a relay/secret.
+*
+* @param captures - Parsed capture lines (from `RelayRunReport.captures`).
+* @param dir      - Output directory (created recursively if missing).
+* @param cell     - Cell axes for the filename suffix.
+* @returns The absolute paths written (one per category), in category order.
+*/
+async function writeCaptureArtifacts(captures, dir, cell) {
+	if (captures.length === 0) return [];
+	const byCategory = /* @__PURE__ */ new Map();
+	for (const { category, json } of captures) {
+		let merged = byCategory.get(category);
+		if (!merged) {
+			merged = [];
+			byCategory.set(category, merged);
+		}
+		const parsed = JSON.parse(json);
+		if (Array.isArray(parsed)) merged.push(...parsed);
+		else merged.push(parsed);
+	}
+	await mkdir(dir, { recursive: true });
+	const written = [];
+	for (const [category, records] of byCategory) {
+		const outFile = path.join(dir, `${category}.${cell.sdkLine}.${cell.platform}.json`);
+		await writeFile(outFile, `${JSON.stringify(records, null, 2)}\n`, "utf8");
+		written.push(outFile);
+	}
+	return written;
+}
+//#endregion
+export { serializeRelayReport, writeCaptureArtifacts, writeReportArtifact };
+
+//# sourceMappingURL=report.js.map

package/dist/test-runner/report.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"report.js","names":[],"sources":["../../src/test-runner/report.ts"],"sourcesContent":["/**\n * Runner-agnostic report serialisation for env3 test runs (devtools#696).\n *\n * Both env3 execution paths — the Vitest custom pool (`pool.ts`) and the\n * standalone `devtools-test` CLI (`cli.ts`) — call the same core\n * `runTestFilesOverRelay` and so produce the same {@link RelayRunReport}. This\n * module is the single, runner-neutral place that turns that in-memory report\n * into a stable on-disk artifact so a 2.x run and a 3.0 run can be diffed\n * cell-by-cell after the fact.\n *\n * The serialised schema is deliberately MINIMAL and secret-free:\n *\n *   - file paths are stored RELATIVE to `projectRoot` (no absolute `/Users/...`\n *     leakage — see {@link RunnerAgnosticReport.files});\n *   - the cell metadata (sdkLine/platform) is baked INTO the body, not only the\n *     filename, so a moved artifact never loses its provenance;\n *   - NO relay wss / scheme / TOTP / relayUrl fields exist in the schema at all\n *     (enforced by the type + this comment) — error strings are the matcher\n *     message only, inherited from rpc.ts which already strips expression/value.\n *\n * react-free — depends only on the type-level `RelayRunReport` and `node:fs` /\n * `node:path`. Safe to bundle without pulling the chii/cloudflared graph.\n */\n\nimport { mkdir, writeFile } from 'node:fs/promises';\nimport path from 'node:path';\nimport type { AitCaptureLine } from './capture.js';\nimport type { RelayRunReport } from './relay-worker.js';\nimport type { TestResult } from './runtime.js';\n\n/** The cell axes a report is stamped with — the test-matrix coordinates. */\nexport interface ReportCellMeta {\n  /** SDK line under test (e.g. `'2.x'` / `'3.x'`). */\n  sdkLine: string;\n  /** Platform under test (e.g. `'ios'` / `'android'` / `'mock'`). */\n  platform: string;\n  /**\n   * Project root the run was launched from. Used ONLY to relativise file paths\n   * out of the serialised report — never stored in the output. SECRET-HANDLING:\n   * absolute project paths must not leak into artifacts.\n   */\n  projectRoot: string;\n}\n\n/** Per-file slice of a {@link RunnerAgnosticReport}. */\nexport interface RunnerAgnosticFileReport {\n  /**\n   * Test file path, RELATIVE to `projectRoot`. Never absolute — `path.relative`\n   * strips the machine-specific prefix so the artifact is portable and leaks no\n   * local filesystem layout.\n   */\n  file: string;\n  /** Whole-file bundle/inject error (matcher message only), when the file failed. */\n  error?: string;\n  /** In-page run duration (ms) for this file, when it ran. */\n  duration?: number;\n  passed?: number;\n  failed?: number;\n  skipped?: number;\n  /** Per-test results, when the file ran. Error strings are matcher messages only. */\n  tests?: TestResult[];\n}\n\n/**\n * The runner-neutral, secret-free report written to disk. There are\n * intentionally NO wss/scheme/TOTP/relayUrl fields on this type — the absence is\n * load-bearing (SECRET-HANDLING) and must not be \"completed\" by a future edit.\n */\nexport interface RunnerAgnosticReport {\n  /** Cell axes this run belongs to — baked into the body for portability. */\n  cell: { sdkLine: string; platform: string };\n  /** ISO timestamp of when the run started (from the core report). */\n  startedAt: string;\n  /** Total wall-clock ms (bundling + sequential injection). */\n  duration: number;\n  /** Flattened totals across all files. */\n  totals: RelayRunReport['totals'];\n  /** Per-file results with projectRoot-relative paths. */\n  files: RunnerAgnosticFileReport[];\n}\n\n/**\n * Converts an absolute (or already-relative) file path to a projectRoot-relative\n * one. `path.relative` returns `''` when the paths are equal — guard that to the\n * basename so the field is never empty.\n *\n * SECRET-HANDLING: this is the single choke point that strips absolute project\n * paths from the artifact.\n */\nfunction relativise(projectRoot: string, file: string): string {\n  const rel = path.relative(projectRoot, file);\n  if (rel === '' || rel.startsWith('..') || path.isAbsolute(rel)) {\n    // Outside the project root (or equal) — fall back to the basename rather\n    // than emitting an absolute or `../../..` traversal path.\n    return path.basename(file);\n  }\n  return rel;\n}\n\n/**\n * Serialises a {@link RelayRunReport} into the runner-agnostic, secret-free\n * on-disk shape. Pure — no IO; testable with a plain report + meta.\n *\n * @param report - The core relay run report.\n * @param meta   - Cell axes + projectRoot (projectRoot is consumed, not stored).\n */\nexport function serializeRelayReport(\n  report: RelayRunReport,\n  meta: ReportCellMeta,\n): RunnerAgnosticReport {\n  return {\n    cell: { sdkLine: meta.sdkLine, platform: meta.platform },\n    startedAt: report.startedAt,\n    duration: report.duration,\n    totals: report.totals,\n    files: report.files.map((f): RunnerAgnosticFileReport => {\n      const file = relativise(meta.projectRoot, f.file);\n      if ('error' in f.result) {\n        // Matcher/inject error message only — rpc.ts already stripped the\n        // expression/value upstream.\n        return { file, error: f.result.error };\n      }\n      return {\n        file,\n        duration: f.result.duration,\n        passed: f.result.passed,\n        failed: f.result.failed,\n        skipped: f.result.skipped,\n        tests: f.result.tests,\n      };\n    }),\n  };\n}\n\n/**\n * Writes the serialised report to `<dir>/<sdkLine>.<platform>.json`, creating\n * `dir` if needed. Returns the absolute path written.\n *\n * The cell-suffixed filename keeps 2.x and 3.0 (and per-platform) runs as\n * distinct artifacts in the same directory; the same cell metadata is also baked\n * into the body so a renamed/moved file still carries its provenance.\n *\n * SECRET-HANDLING: the written body contains no relay/secret fields (the schema\n * has none). `dir`/`projectRoot` are local filesystem paths, never logged here.\n *\n * @param report - The core relay run report.\n * @param dir    - Output directory (created recursively if missing).\n * @param meta   - Cell axes + projectRoot.\n * @returns The absolute path of the written file.\n */\nexport async function writeReportArtifact(\n  report: RelayRunReport,\n  dir: string,\n  meta: ReportCellMeta,\n): Promise<string> {\n  const serialised = serializeRelayReport(report, meta);\n  await mkdir(dir, { recursive: true });\n  const outFile = path.join(dir, `${meta.sdkLine}.${meta.platform}.json`);\n  await writeFile(outFile, `${JSON.stringify(serialised, null, 2)}\\n`, 'utf8');\n  return outFile;\n}\n\n/**\n * Writes harvested `__AIT_CAPTURE__` lines to per-category files under `dir`,\n * named `<category>.<sdkLine>.<platform>.json` — the SAME convention\n * sdk-example's env1 `flushCapture` uses on the filesystem, so env1 and env3\n * capture artifacts line up for diffing.\n *\n * Each line's `json` payload is an opaque JSON array of capture records. Lines\n * sharing a category are concatenated into one array, in harvest order.\n *\n * SECRET-HANDLING: only allowlist-prefixed capture lines reach here (the parser\n * dropped wss/scheme noise); the `json` payload is written verbatim but is a\n * capture record array, not a relay/secret.\n *\n * @param captures - Parsed capture lines (from `RelayRunReport.captures`).\n * @param dir      - Output directory (created recursively if missing).\n * @param cell     - Cell axes for the filename suffix.\n * @returns The absolute paths written (one per category), in category order.\n */\nexport async function writeCaptureArtifacts(\n  captures: ReadonlyArray<AitCaptureLine>,\n  dir: string,\n  cell: { sdkLine: string; platform: string },\n): Promise<string[]> {\n  if (captures.length === 0) return [];\n\n  // Group payloads by category, preserving harvest order. Each payload is an\n  // opaque JSON array string; concatenate parsed arrays under the same category.\n  const byCategory = new Map<string, unknown[]>();\n  for (const { category, json } of captures) {\n    let merged = byCategory.get(category);\n    if (!merged) {\n      merged = [];\n      byCategory.set(category, merged);\n    }\n    // The parser already validated `json` parses; an array payload is expected.\n    const parsed = JSON.parse(json) as unknown;\n    if (Array.isArray(parsed)) {\n      merged.push(...parsed);\n    } else {\n      merged.push(parsed);\n    }\n  }\n\n  await mkdir(dir, { recursive: true });\n  const written: string[] = [];\n  for (const [category, records] of byCategory) {\n    const outFile = path.join(dir, `${category}.${cell.sdkLine}.${cell.platform}.json`);\n    await writeFile(outFile, `${JSON.stringify(records, null, 2)}\\n`, 'utf8');\n    written.push(outFile);\n  }\n  return written;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAyFA,SAAS,WAAW,aAAqB,MAAsB;CAC7D,MAAM,MAAM,KAAK,SAAS,aAAa,KAAK;AAC5C,KAAI,QAAQ,MAAM,IAAI,WAAW,KAAK,IAAI,KAAK,WAAW,IAAI,CAG5D,QAAO,KAAK,SAAS,KAAK;AAE5B,QAAO;;;;;;;;;AAUT,SAAgB,qBACd,QACA,MACsB;AACtB,QAAO;EACL,MAAM;GAAE,SAAS,KAAK;GAAS,UAAU,KAAK;GAAU;EACxD,WAAW,OAAO;EAClB,UAAU,OAAO;EACjB,QAAQ,OAAO;EACf,OAAO,OAAO,MAAM,KAAK,MAAgC;GACvD,MAAM,OAAO,WAAW,KAAK,aAAa,EAAE,KAAK;AACjD,OAAI,WAAW,EAAE,OAGf,QAAO;IAAE;IAAM,OAAO,EAAE,OAAO;IAAO;AAExC,UAAO;IACL;IACA,UAAU,EAAE,OAAO;IACnB,QAAQ,EAAE,OAAO;IACjB,QAAQ,EAAE,OAAO;IACjB,SAAS,EAAE,OAAO;IAClB,OAAO,EAAE,OAAO;IACjB;IACD;EACH;;;;;;;;;;;;;;;;;;AAmBH,eAAsB,oBACpB,QACA,KACA,MACiB;CACjB,MAAM,aAAa,qBAAqB,QAAQ,KAAK;AACrD,OAAM,MAAM,KAAK,EAAE,WAAW,MAAM,CAAC;CACrC,MAAM,UAAU,KAAK,KAAK,KAAK,GAAG,KAAK,QAAQ,GAAG,KAAK,SAAS,OAAO;AACvE,OAAM,UAAU,SAAS,GAAG,KAAK,UAAU,YAAY,MAAM,EAAE,CAAC,KAAK,OAAO;AAC5E,QAAO;;;;;;;;;;;;;;;;;;;;AAqBT,eAAsB,sBACpB,UACA,KACA,MACmB;AACnB,KAAI,SAAS,WAAW,EAAG,QAAO,EAAE;CAIpC,MAAM,6BAAa,IAAI,KAAwB;AAC/C,MAAK,MAAM,EAAE,UAAU,UAAU,UAAU;EACzC,IAAI,SAAS,WAAW,IAAI,SAAS;AACrC,MAAI,CAAC,QAAQ;AACX,YAAS,EAAE;AACX,cAAW,IAAI,UAAU,OAAO;;EAGlC,MAAM,SAAS,KAAK,MAAM,KAAK;AAC/B,MAAI,MAAM,QAAQ,OAAO,CACvB,QAAO,KAAK,GAAG,OAAO;MAEtB,QAAO,KAAK,OAAO;;AAIvB,OAAM,MAAM,KAAK,EAAE,WAAW,MAAM,CAAC;CACrC,MAAM,UAAoB,EAAE;AAC5B,MAAK,MAAM,CAAC,UAAU,YAAY,YAAY;EAC5C,MAAM,UAAU,KAAK,KAAK,KAAK,GAAG,SAAS,GAAG,KAAK,QAAQ,GAAG,KAAK,SAAS,OAAO;AACnF,QAAM,UAAU,SAAS,GAAG,KAAK,UAAU,SAAS,MAAM,EAAE,CAAC,KAAK,OAAO;AACzE,UAAQ,KAAK,QAAQ;;AAEvB,QAAO"}

package/dist/test-runner/rpc.d.ts

@@ -1,5 +1,5 @@
-import { t as CdpConnection } from "../cdp-connection-C0AP0tH2.js";
-import { t as RunReport } from "../runtime-BU-iMHz6.js";
+import { t as CdpConnection } from "../cdp-connection-DB2zgthr.js";
+import { t as RunReport } from "../runtime-D57Rtnsd.js";
 
 //#region src/test-runner/rpc.d.ts
 /**

package/dist/test-runner/runtime.d.ts

@@ -1,2 +1,2 @@
-import { i as runtimeGlobals, n as TestResult, r as runTestModule, t as RunReport } from "../runtime-BU-iMHz6.js";
+import { i as runtimeGlobals, n as TestResult, r as runTestModule, t as RunReport } from "../runtime-D57Rtnsd.js";
 export { RunReport, TestResult, runTestModule, runtimeGlobals };

package/dist/test-runner/task-graph.d.ts

@@ -1,4 +1,4 @@
-import { t as RunReport } from "../runtime-BU-iMHz6.js";
+import { t as RunReport } from "../runtime-D57Rtnsd.js";
 import { File, TaskEventPack, TaskResultPack } from "@vitest/runner";
 
 //#region src/test-runner/task-graph.d.ts

package/dist/{totp-D70zD5tJ.js → totp-0bvlo9Yb.js}

@@ -187,4 +187,4 @@ function buildRelayVerifyAuth(env = process.env) {
 //#endregion
 export { isValidRelayAuthSecret as a, generateTotp as i, assertRelayAuthConfigured as n, verifyTotp as o, buildRelayVerifyAuth as r, RELAY_AUTH_SECRET_MISSING_MESSAGE as t };
 
-//# sourceMappingURL=totp-D70zD5tJ.js.map
+//# sourceMappingURL=totp-0bvlo9Yb.js.map

package/dist/{totp-D70zD5tJ.js.map → totp-0bvlo9Yb.js.map}

@@ -1 +1 @@
-{"version":3,"file":"totp-D70zD5tJ.js","names":[],"sources":["../src/mcp/totp.ts"],"sourcesContent":["/**\n * RFC 6238 TOTP implementation (Node.js, node:crypto only).\n *\n * External TOTP libraries (otplib, speakeasy, …) are intentionally NOT used\n * to keep the dependency surface minimal. This hand-roll is ~30 lines and\n * covers exactly what relay-side auth needs.\n *\n * Algorithm summary (RFC 6238 + RFC 4226):\n *   T  = floor(now / 30)          — 30-second time step counter\n *   K  = Buffer.from(secret, 'hex') — shared secret (raw bytes, hex-encoded)\n *   MAC = HMAC-SHA1(K, T as 8-byte big-endian uint64)\n *   offset = MAC[19] & 0x0f\n *   code = (MAC[offset..offset+4] & 0x7fffffff) % 10^6  — 6 digits\n *\n * Security note (keep this comment accurate):\n *   The baked-in secret in a dog-food build is extractable from the bundle by a\n *   determined reverse engineer. This mechanism raises the bar from\n *   \"anyone with the URL\" to \"URL + bundle extraction + live TOTP calculation\".\n *   Casual URL leaks (Slack paste, QR screenshot, shoulder-surfing) are\n *   blocked; deliberate reverse engineering is not. See threat model in\n *   src/mcp/chii-relay.ts and umbrella CLAUDE.md §4.\n *\n * SECRET-HANDLING: secret values and computed codes MUST NOT appear in any\n * log, error message, or string visible outside this module. Only boolean\n * pass/fail and reason enum values are safe to surface.\n */\n\nimport { createHmac, timingSafeEqual } from 'node:crypto';\n\n/** Time step window in seconds (RFC 6238 default). */\nconst TIME_STEP = 30;\n\n/** Number of digits in the generated code. */\nconst DIGITS = 6;\n\n/**\n * Derives a 6-digit TOTP code from a hex-encoded secret at the given wall-\n * clock time.\n *\n * @param secret - The shared secret as a hex string (e.g. 64 hex chars = 32\n *   bytes). Must be the output of `generateAttachToken()` or compatible.\n * @param when - Unix timestamp in milliseconds. Defaults to `Date.now()`.\n * @returns A zero-padded 6-digit decimal string, e.g. `\"042193\"`.\n */\nexport function generateTotp(secret: string, when: number = Date.now()): string {\n  const key = Buffer.from(secret, 'hex');\n  // Clamp to 0 so negative timestamps (e.g. in ±skew checks near epoch) do not\n  // produce a negative counter, which would cause writeUInt32BE to throw.\n  const counter = Math.max(0, Math.floor(when / 1000 / TIME_STEP));\n\n  // Encode counter as 8-byte big-endian unsigned integer.\n  const counterBuf = Buffer.alloc(8);\n  // JavaScript numbers are safe integers up to 2^53; counter is ~7.5×10^10 at\n  // year 9999 — well within safe range so standard bitwise ops are fine.\n  const hi = Math.floor(counter / 0x100000000);\n  const lo = counter >>> 0;\n  counterBuf.writeUInt32BE(hi, 0);\n  counterBuf.writeUInt32BE(lo, 4);\n\n  const mac = createHmac('sha1', key).update(counterBuf).digest();\n\n  // Dynamic truncation (RFC 4226 §5.4).\n  const offset = mac[19] & 0x0f;\n  const binCode =\n    ((mac[offset] & 0x7f) << 24) |\n    ((mac[offset + 1] & 0xff) << 16) |\n    ((mac[offset + 2] & 0xff) << 8) |\n    (mac[offset + 3] & 0xff);\n\n  const otp = binCode % 10 ** DIGITS;\n  return otp.toString().padStart(DIGITS, '0');\n}\n\n/**\n * Verifies a TOTP code against the secret, accepting ±`skew` time steps to\n * tolerate clock drift between the relay host and the client device.\n *\n * Uses `timingSafeEqual` for constant-time comparison to prevent timing\n * side-channel attacks.\n *\n * @param secret - Hex-encoded shared secret.\n * @param code - The 6-digit code to verify (string or numeric).\n * @param when - Unix timestamp in milliseconds. Defaults to `Date.now()`.\n * @param skew - Number of adjacent steps to accept on either side. Default 1\n *   (accepts T-1, T, T+1 — a 90-second acceptance window).\n * @returns `true` if the code matches any accepted step, `false` otherwise.\n */\nexport function verifyTotp(\n  secret: string,\n  code: string,\n  when: number = Date.now(),\n  skew: number = 1,\n): boolean {\n  const normalised = String(code).padStart(DIGITS, '0');\n  if (normalised.length !== DIGITS || !/^\\d{6}$/.test(normalised)) {\n    return false;\n  }\n\n  const candidateBuf = Buffer.from(normalised, 'utf8');\n\n  for (let delta = -skew; delta <= skew; delta++) {\n    const stepWhen = when + delta * TIME_STEP * 1000;\n    const expected = generateTotp(secret, stepWhen);\n    const expectedBuf = Buffer.from(expected, 'utf8');\n    if (timingSafeEqual(expectedBuf, candidateBuf)) {\n      return true;\n    }\n  }\n\n  return false;\n}\n\n/**\n * Minimum length (in hex characters) accepted for `AIT_DEBUG_TOTP_SECRET`.\n *\n * The secret is hex-encoded (see {@link generateTotp} — `Buffer.from(secret,\n * 'hex')`). 32 hex chars = 16 bytes = 128 bits, the floor for an HMAC-SHA1 key\n * we are willing to gate a public relay behind. `generateAttachToken()` emits\n * 64 hex chars (32 bytes), comfortably above this bar.\n */\nconst MIN_SECRET_HEX_CHARS = 32;\n\n/** Hex string: one or more hex digits, case-insensitive (RFC 4648 base16). */\nconst HEX_RE = /^[0-9a-fA-F]+$/;\n\n/**\n * Human-facing guidance printed when {@link assertRelayAuthConfigured} fails.\n *\n * SECRET-HANDLING: this message states only the REQUIREMENT (≥32 hex chars) and\n * how to mint one. It NEVER echoes the configured value, its length, or any\n * fragment derived from it — see {@link assertRelayAuthConfigured}.\n *\n * Note on encoding: the secret is hex (base16), not base32 — `generateTotp`\n * decodes it with `Buffer.from(secret, 'hex')`. A base32 string would be\n * silently mis-decoded and every TOTP code would fail to match, so the minting\n * command emits hex.\n */\nexport const RELAY_AUTH_SECRET_MISSING_MESSAGE = [\n  '[ait-debug] AIT_DEBUG_TOTP_SECRET이 필수입니다. 32자 이상 16진수(hex) 문자열을 설정하세요.',\n  '발급: openssl rand -hex 32',\n  '데몬은 start_debug의 projectRoot 인자로 받은 디렉토리에서 .ait_relay 파일을 읽어 이 시크릿을 채웁니다.',\n  '프로젝트에서 pnpm dev:phone:cdp를 한 번 띄우면 unplugin이 .ait_relay를 자동 생성하니(tunnel.cdp 옵션 필요), projectRoot를 전달하세요.',\n  '자세히: https://docs.aitc.dev/guides/relay-auth-totp',\n].join('\\n');\n\n/**\n * Whether `secret` is a well-formed relay-auth TOTP secret: a hex string of at\n * least {@link MIN_SECRET_HEX_CHARS} characters with an even length (an odd\n * length would have its trailing nibble silently dropped by `Buffer.from(...,\n * 'hex')`, weakening the key without warning).\n *\n * Pure predicate so callers can test the validation independently of the\n * fail-fast side effect in {@link assertRelayAuthConfigured}.\n *\n * SECRET-HANDLING: returns only a boolean — the input value is never returned,\n * logged, or echoed.\n */\nexport function isValidRelayAuthSecret(secret: string | undefined): secret is string {\n  if (secret === undefined || secret === '') return false;\n  if (secret.length < MIN_SECRET_HEX_CHARS) return false;\n  if (secret.length % 2 !== 0) return false;\n  return HEX_RE.test(secret);\n}\n\n/**\n * Fail-fast guard enforcing that a relay-auth TOTP secret is configured before\n * a public-internet-exposed relay is booted (issue #250).\n *\n * Relay-auth (the §4 Layer C TOTP gate) is the only fail-fast layer that closes\n * the real gap: a leaked `wss://…trycloudflare.com` URL otherwise lets a third\n * party attach a debugger to a dog-food/live mini-app. Without a secret the relay\n * comes up unauthenticated, so this guard is called at every relay-boot site —\n * `bootRelayFamily` (intoss env 3/4) and `bootExternalRelayFamily` (env-2 PWA),\n * both eager and lazy. Local-only sessions never boot a relay and so never reach\n * this guard, matching the issue's exemption for non-relay debugging.\n *\n * Throws when the secret is unset, empty, too short, or not a valid hex string.\n * The thrown message is the bin entry's fatal stderr (see `cli.ts` `main().catch`)\n * — the same fatal model as the missing-`AIT_RELAY_BASE_URL` path.\n *\n * SECRET-HANDLING: the env value is read once, passed ONLY to the boolean\n * predicate, and never logged. The thrown message names the requirement, never\n * the value, its length, or any derived fragment.\n *\n * @param env - Environment to read from. Defaults to `process.env`; injectable\n *   for tests so they never mutate the real process environment.\n */\nexport function assertRelayAuthConfigured(env: NodeJS.ProcessEnv = process.env): void {\n  if (!isValidRelayAuthSecret(env.AIT_DEBUG_TOTP_SECRET)) {\n    throw new Error(RELAY_AUTH_SECRET_MISSING_MESSAGE);\n  }\n}\n\n/**\n * Gate-specific skew for the relay WebSocket upgrade TOTP check.\n *\n * Rationale (why 6, not the RFC default of 1):\n *   - Each step is 30 s, so ±6 steps = past 6 steps accepted = 180–210 s of\n *     backwards acceptance. This means a code generated at issuance time is\n *     guaranteed valid for at least 3 minutes (180 s) after it was minted.\n *   - The real-world attach flow (QR issued on desktop → developer picks up\n *     phone → camera scan → launcher PWA loads → attach) routinely exceeds\n *     the 90 s window of the RFC default (skew=1), especially when the launcher\n *     PWA needs to reinstall or when the phone is not immediately at hand.\n *   - Expanding to ~3.5 min reachability is acceptable under the §4 threat\n *     model: the adversary we guard against is \"someone who got the URL but\n *     does NOT have the secret\". Without the secret they cannot compute a TOTP\n *     code regardless of the window size — security theater is explicitly\n *     forbidden by the project principle. An attacker WITH the secret (bundle\n *     extractor) is out of scope per CLAUDE.md §4.\n *\n * `verifyTotp`'s own default (skew=1) is deliberately left unchanged — it is\n * the RFC primitive. Only this relay-gate call site is widened.\n */\nexport const RELAY_VERIFY_SKEW_STEPS = 6;\n\n/**\n * Reads `AIT_DEBUG_TOTP_SECRET` from `process.env` at runtime and builds a\n * `verifyAuth` predicate for the Chii relay's WebSocket upgrade gate.\n *\n * The predicate checks the `at` query parameter against the current and\n * adjacent TOTP time steps (±{@link RELAY_VERIFY_SKEW_STEPS} skew) using\n * {@link verifyTotp}. This gives the issued code a minimum validity of ~3\n * minutes, which is enough to cover the QR-scan → launcher-attach flow even\n * when the launcher PWA needs to load or reinstall (#490).\n *\n * Returns `undefined` when the env var is not set — callers treat that as\n * \"auth disabled\" (no predicate registered on the relay). Note that since\n * issue #250 the secret is MANDATORY at every relay-boot site (enforced by\n * {@link assertRelayAuthConfigured} BEFORE the relay starts), so in production\n * this never returns `undefined` for a relay that actually boots; the\n * `undefined` branch only matters for the no-relay local path and tests.\n *\n * Lives here (not in the MCP server) so the unplugin's env-2 relay can wire the\n * same gate without importing the heavy MCP server module graph. Re-exported\n * from `debug-server.ts` for back-compat.\n *\n * SECRET-HANDLING: The secret value read from env is captured in a closure and\n * is NEVER written to any log, error message, or process output.\n */\nexport function buildRelayVerifyAuth(\n  env: NodeJS.ProcessEnv = process.env,\n): ((req: import('node:http').IncomingMessage) => boolean) | undefined {\n  const secret = env.AIT_DEBUG_TOTP_SECRET;\n  if (!secret) return undefined;\n\n  return (req) => {\n    // Parse the `at` query param from the upgrade request URL.\n    // req.url is the raw request path + query, e.g. `/client/id?target=…&at=123456`\n    const rawUrl = req.url ?? '';\n    const qIndex = rawUrl.indexOf('?');\n    const queryStr = qIndex === -1 ? '' : rawUrl.slice(qIndex + 1);\n    const params = new URLSearchParams(queryStr);\n    const code = params.get('at') ?? '';\n\n    // Do NOT log `code`, `secret`, or any derived value here.\n    // Use RELAY_VERIFY_SKEW_STEPS (±6) for a ~3-minute acceptance window (#490).\n    // verifyTotp's own default (skew=1) is unchanged — only this call site is widened.\n    return verifyTotp(secret, code, undefined, RELAY_VERIFY_SKEW_STEPS);\n  };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA8BA,MAAM,YAAY;;AAGlB,MAAM,SAAS;;;;;;;;;;AAWf,SAAgB,aAAa,QAAgB,OAAe,KAAK,KAAK,EAAU;CAC9E,MAAM,MAAM,OAAO,KAAK,QAAQ,MAAM;CAGtC,MAAM,UAAU,KAAK,IAAI,GAAG,KAAK,MAAM,OAAO,MAAO,UAAU,CAAC;CAGhE,MAAM,aAAa,OAAO,MAAM,EAAE;CAGlC,MAAM,KAAK,KAAK,MAAM,UAAU,WAAY;CAC5C,MAAM,KAAK,YAAY;AACvB,YAAW,cAAc,IAAI,EAAE;AAC/B,YAAW,cAAc,IAAI,EAAE;CAE/B,MAAM,MAAM,WAAW,QAAQ,IAAI,CAAC,OAAO,WAAW,CAAC,QAAQ;CAG/D,MAAM,SAAS,IAAI,MAAM;AAQzB,WANI,IAAI,UAAU,QAAS,MACvB,IAAI,SAAS,KAAK,QAAS,MAC3B,IAAI,SAAS,KAAK,QAAS,IAC5B,IAAI,SAAS,KAAK,OAEC,MAAM,QACjB,UAAU,CAAC,SAAS,QAAQ,IAAI;;;;;;;;;;;;;;;;AAiB7C,SAAgB,WACd,QACA,MACA,OAAe,KAAK,KAAK,EACzB,OAAe,GACN;CACT,MAAM,aAAa,OAAO,KAAK,CAAC,SAAS,QAAQ,IAAI;AACrD,KAAI,WAAW,WAAW,UAAU,CAAC,UAAU,KAAK,WAAW,CAC7D,QAAO;CAGT,MAAM,eAAe,OAAO,KAAK,YAAY,OAAO;AAEpD,MAAK,IAAI,QAAQ,CAAC,MAAM,SAAS,MAAM,SAAS;EAE9C,MAAM,WAAW,aAAa,QADb,OAAO,QAAQ,YAAY,IACG;AAE/C,MAAI,gBADgB,OAAO,KAAK,UAAU,OAAO,EAChB,aAAa,CAC5C,QAAO;;AAIX,QAAO;;;;;;;;;;AAWT,MAAM,uBAAuB;;AAG7B,MAAM,SAAS;;;;;;;;;;;;;AAcf,MAAa,oCAAoC;CAC/C;CACA;CACA;CACA;CACA;CACD,CAAC,KAAK,KAAK;;;;;;;;;;;;;AAcZ,SAAgB,uBAAuB,QAA8C;AACnF,KAAI,WAAW,KAAA,KAAa,WAAW,GAAI,QAAO;AAClD,KAAI,OAAO,SAAS,qBAAsB,QAAO;AACjD,KAAI,OAAO,SAAS,MAAM,EAAG,QAAO;AACpC,QAAO,OAAO,KAAK,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;AA0B5B,SAAgB,0BAA0B,MAAyB,QAAQ,KAAW;AACpF,KAAI,CAAC,uBAAuB,IAAI,sBAAsB,CACpD,OAAM,IAAI,MAAM,kCAAkC;;;;;;;;;;;;;;;;;;;;;;;;;;AAmDtD,SAAgB,qBACd,MAAyB,QAAQ,KACoC;CACrE,MAAM,SAAS,IAAI;AACnB,KAAI,CAAC,OAAQ,QAAO,KAAA;AAEpB,SAAQ,QAAQ;EAGd,MAAM,SAAS,IAAI,OAAO;EAC1B,MAAM,SAAS,OAAO,QAAQ,IAAI;EAClC,MAAM,WAAW,WAAW,KAAK,KAAK,OAAO,MAAM,SAAS,EAAE;AAO9D,SAAO,WAAW,QANH,IAAI,gBAAgB,SAAS,CACxB,IAAI,KAAK,IAAI,IAKD,KAAA,GAAA,EAAmC"}
+{"version":3,"file":"totp-0bvlo9Yb.js","names":[],"sources":["../src/mcp/totp.ts"],"sourcesContent":["/**\n * RFC 6238 TOTP implementation (Node.js, node:crypto only).\n *\n * External TOTP libraries (otplib, speakeasy, …) are intentionally NOT used\n * to keep the dependency surface minimal. This hand-roll is ~30 lines and\n * covers exactly what relay-side auth needs.\n *\n * Algorithm summary (RFC 6238 + RFC 4226):\n *   T  = floor(now / 30)          — 30-second time step counter\n *   K  = Buffer.from(secret, 'hex') — shared secret (raw bytes, hex-encoded)\n *   MAC = HMAC-SHA1(K, T as 8-byte big-endian uint64)\n *   offset = MAC[19] & 0x0f\n *   code = (MAC[offset..offset+4] & 0x7fffffff) % 10^6  — 6 digits\n *\n * Security note (keep this comment accurate):\n *   The baked-in secret in a dog-food build is extractable from the bundle by a\n *   determined reverse engineer. This mechanism raises the bar from\n *   \"anyone with the URL\" to \"URL + bundle extraction + live TOTP calculation\".\n *   Casual URL leaks (Slack paste, QR screenshot, shoulder-surfing) are\n *   blocked; deliberate reverse engineering is not. See threat model in\n *   src/mcp/chii-relay.ts and umbrella CLAUDE.md §4.\n *\n * SECRET-HANDLING: secret values and computed codes MUST NOT appear in any\n * log, error message, or string visible outside this module. Only boolean\n * pass/fail and reason enum values are safe to surface.\n */\n\nimport { createHmac, timingSafeEqual } from 'node:crypto';\n\n/** Time step window in seconds (RFC 6238 default). */\nconst TIME_STEP = 30;\n\n/** Number of digits in the generated code. */\nconst DIGITS = 6;\n\n/**\n * Derives a 6-digit TOTP code from a hex-encoded secret at the given wall-\n * clock time.\n *\n * @param secret - The shared secret as a hex string (e.g. 64 hex chars = 32\n *   bytes). Must be the output of `generateAttachToken()` or compatible.\n * @param when - Unix timestamp in milliseconds. Defaults to `Date.now()`.\n * @returns A zero-padded 6-digit decimal string, e.g. `\"042193\"`.\n */\nexport function generateTotp(secret: string, when: number = Date.now()): string {\n  const key = Buffer.from(secret, 'hex');\n  // Clamp to 0 so negative timestamps (e.g. in ±skew checks near epoch) do not\n  // produce a negative counter, which would cause writeUInt32BE to throw.\n  const counter = Math.max(0, Math.floor(when / 1000 / TIME_STEP));\n\n  // Encode counter as 8-byte big-endian unsigned integer.\n  const counterBuf = Buffer.alloc(8);\n  // JavaScript numbers are safe integers up to 2^53; counter is ~7.5×10^10 at\n  // year 9999 — well within safe range so standard bitwise ops are fine.\n  const hi = Math.floor(counter / 0x100000000);\n  const lo = counter >>> 0;\n  counterBuf.writeUInt32BE(hi, 0);\n  counterBuf.writeUInt32BE(lo, 4);\n\n  const mac = createHmac('sha1', key).update(counterBuf).digest();\n\n  // Dynamic truncation (RFC 4226 §5.4).\n  const offset = mac[19] & 0x0f;\n  const binCode =\n    ((mac[offset] & 0x7f) << 24) |\n    ((mac[offset + 1] & 0xff) << 16) |\n    ((mac[offset + 2] & 0xff) << 8) |\n    (mac[offset + 3] & 0xff);\n\n  const otp = binCode % 10 ** DIGITS;\n  return otp.toString().padStart(DIGITS, '0');\n}\n\n/**\n * Verifies a TOTP code against the secret, accepting ±`skew` time steps to\n * tolerate clock drift between the relay host and the client device.\n *\n * Uses `timingSafeEqual` for constant-time comparison to prevent timing\n * side-channel attacks.\n *\n * @param secret - Hex-encoded shared secret.\n * @param code - The 6-digit code to verify (string or numeric).\n * @param when - Unix timestamp in milliseconds. Defaults to `Date.now()`.\n * @param skew - Number of adjacent steps to accept on either side. Default 1\n *   (accepts T-1, T, T+1 — a 90-second acceptance window).\n * @returns `true` if the code matches any accepted step, `false` otherwise.\n */\nexport function verifyTotp(\n  secret: string,\n  code: string,\n  when: number = Date.now(),\n  skew: number = 1,\n): boolean {\n  const normalised = String(code).padStart(DIGITS, '0');\n  if (normalised.length !== DIGITS || !/^\\d{6}$/.test(normalised)) {\n    return false;\n  }\n\n  const candidateBuf = Buffer.from(normalised, 'utf8');\n\n  for (let delta = -skew; delta <= skew; delta++) {\n    const stepWhen = when + delta * TIME_STEP * 1000;\n    const expected = generateTotp(secret, stepWhen);\n    const expectedBuf = Buffer.from(expected, 'utf8');\n    if (timingSafeEqual(expectedBuf, candidateBuf)) {\n      return true;\n    }\n  }\n\n  return false;\n}\n\n/**\n * Minimum length (in hex characters) accepted for `AIT_DEBUG_TOTP_SECRET`.\n *\n * The secret is hex-encoded (see {@link generateTotp} — `Buffer.from(secret,\n * 'hex')`). 32 hex chars = 16 bytes = 128 bits, the floor for an HMAC-SHA1 key\n * we are willing to gate a public relay behind. `generateAttachToken()` emits\n * 64 hex chars (32 bytes), comfortably above this bar.\n */\nconst MIN_SECRET_HEX_CHARS = 32;\n\n/** Hex string: one or more hex digits, case-insensitive (RFC 4648 base16). */\nconst HEX_RE = /^[0-9a-fA-F]+$/;\n\n/**\n * Human-facing guidance printed when {@link assertRelayAuthConfigured} fails.\n *\n * SECRET-HANDLING: this message states only the REQUIREMENT (≥32 hex chars) and\n * how to mint one. It NEVER echoes the configured value, its length, or any\n * fragment derived from it — see {@link assertRelayAuthConfigured}.\n *\n * Note on encoding: the secret is hex (base16), not base32 — `generateTotp`\n * decodes it with `Buffer.from(secret, 'hex')`. A base32 string would be\n * silently mis-decoded and every TOTP code would fail to match, so the minting\n * command emits hex.\n */\nexport const RELAY_AUTH_SECRET_MISSING_MESSAGE = [\n  '[ait-debug] AIT_DEBUG_TOTP_SECRET이 필수입니다. 32자 이상 16진수(hex) 문자열을 설정하세요.',\n  '발급: openssl rand -hex 32',\n  '데몬은 start_debug의 projectRoot 인자로 받은 디렉토리에서 .ait_relay 파일을 읽어 이 시크릿을 채웁니다.',\n  '프로젝트에서 pnpm dev:phone:cdp를 한 번 띄우면 unplugin이 .ait_relay를 자동 생성하니(tunnel.cdp 옵션 필요), projectRoot를 전달하세요.',\n  '자세히: https://docs.aitc.dev/guides/relay-auth-totp',\n].join('\\n');\n\n/**\n * Whether `secret` is a well-formed relay-auth TOTP secret: a hex string of at\n * least {@link MIN_SECRET_HEX_CHARS} characters with an even length (an odd\n * length would have its trailing nibble silently dropped by `Buffer.from(...,\n * 'hex')`, weakening the key without warning).\n *\n * Pure predicate so callers can test the validation independently of the\n * fail-fast side effect in {@link assertRelayAuthConfigured}.\n *\n * SECRET-HANDLING: returns only a boolean — the input value is never returned,\n * logged, or echoed.\n */\nexport function isValidRelayAuthSecret(secret: string | undefined): secret is string {\n  if (secret === undefined || secret === '') return false;\n  if (secret.length < MIN_SECRET_HEX_CHARS) return false;\n  if (secret.length % 2 !== 0) return false;\n  return HEX_RE.test(secret);\n}\n\n/**\n * Fail-fast guard enforcing that a relay-auth TOTP secret is configured before\n * a public-internet-exposed relay is booted (issue #250).\n *\n * Relay-auth (the §4 Layer C TOTP gate) is the only fail-fast layer that closes\n * the real gap: a leaked `wss://…trycloudflare.com` URL otherwise lets a third\n * party attach a debugger to a dog-food/live mini-app. Without a secret the relay\n * comes up unauthenticated, so this guard is called at every relay-boot site —\n * `bootRelayFamily` (intoss env 3/4) and `bootExternalRelayFamily` (env-2 PWA),\n * both eager and lazy. Local-only sessions never boot a relay and so never reach\n * this guard, matching the issue's exemption for non-relay debugging.\n *\n * Throws when the secret is unset, empty, too short, or not a valid hex string.\n * The thrown message is the bin entry's fatal stderr (see `cli.ts` `main().catch`)\n * — the same fatal model as the missing-`AIT_RELAY_BASE_URL` path.\n *\n * SECRET-HANDLING: the env value is read once, passed ONLY to the boolean\n * predicate, and never logged. The thrown message names the requirement, never\n * the value, its length, or any derived fragment.\n *\n * @param env - Environment to read from. Defaults to `process.env`; injectable\n *   for tests so they never mutate the real process environment.\n */\nexport function assertRelayAuthConfigured(env: NodeJS.ProcessEnv = process.env): void {\n  if (!isValidRelayAuthSecret(env.AIT_DEBUG_TOTP_SECRET)) {\n    throw new Error(RELAY_AUTH_SECRET_MISSING_MESSAGE);\n  }\n}\n\n/**\n * Gate-specific skew for the relay WebSocket upgrade TOTP check.\n *\n * Rationale (why 6, not the RFC default of 1):\n *   - Each step is 30 s, so ±6 steps = past 6 steps accepted = 180–210 s of\n *     backwards acceptance. This means a code generated at issuance time is\n *     guaranteed valid for at least 3 minutes (180 s) after it was minted.\n *   - The real-world attach flow (QR issued on desktop → developer picks up\n *     phone → camera scan → launcher PWA loads → attach) routinely exceeds\n *     the 90 s window of the RFC default (skew=1), especially when the launcher\n *     PWA needs to reinstall or when the phone is not immediately at hand.\n *   - Expanding to ~3.5 min reachability is acceptable under the §4 threat\n *     model: the adversary we guard against is \"someone who got the URL but\n *     does NOT have the secret\". Without the secret they cannot compute a TOTP\n *     code regardless of the window size — security theater is explicitly\n *     forbidden by the project principle. An attacker WITH the secret (bundle\n *     extractor) is out of scope per CLAUDE.md §4.\n *\n * `verifyTotp`'s own default (skew=1) is deliberately left unchanged — it is\n * the RFC primitive. Only this relay-gate call site is widened.\n */\nexport const RELAY_VERIFY_SKEW_STEPS = 6;\n\n/**\n * Reads `AIT_DEBUG_TOTP_SECRET` from `process.env` at runtime and builds a\n * `verifyAuth` predicate for the Chii relay's WebSocket upgrade gate.\n *\n * The predicate checks the `at` query parameter against the current and\n * adjacent TOTP time steps (±{@link RELAY_VERIFY_SKEW_STEPS} skew) using\n * {@link verifyTotp}. This gives the issued code a minimum validity of ~3\n * minutes, which is enough to cover the QR-scan → launcher-attach flow even\n * when the launcher PWA needs to load or reinstall (#490).\n *\n * Returns `undefined` when the env var is not set — callers treat that as\n * \"auth disabled\" (no predicate registered on the relay). Note that since\n * issue #250 the secret is MANDATORY at every relay-boot site (enforced by\n * {@link assertRelayAuthConfigured} BEFORE the relay starts), so in production\n * this never returns `undefined` for a relay that actually boots; the\n * `undefined` branch only matters for the no-relay local path and tests.\n *\n * Lives here (not in the MCP server) so the unplugin's env-2 relay can wire the\n * same gate without importing the heavy MCP server module graph. Re-exported\n * from `debug-server.ts` for back-compat.\n *\n * SECRET-HANDLING: The secret value read from env is captured in a closure and\n * is NEVER written to any log, error message, or process output.\n */\nexport function buildRelayVerifyAuth(\n  env: NodeJS.ProcessEnv = process.env,\n): ((req: import('node:http').IncomingMessage) => boolean) | undefined {\n  const secret = env.AIT_DEBUG_TOTP_SECRET;\n  if (!secret) return undefined;\n\n  return (req) => {\n    // Parse the `at` query param from the upgrade request URL.\n    // req.url is the raw request path + query, e.g. `/client/id?target=…&at=123456`\n    const rawUrl = req.url ?? '';\n    const qIndex = rawUrl.indexOf('?');\n    const queryStr = qIndex === -1 ? '' : rawUrl.slice(qIndex + 1);\n    const params = new URLSearchParams(queryStr);\n    const code = params.get('at') ?? '';\n\n    // Do NOT log `code`, `secret`, or any derived value here.\n    // Use RELAY_VERIFY_SKEW_STEPS (±6) for a ~3-minute acceptance window (#490).\n    // verifyTotp's own default (skew=1) is unchanged — only this call site is widened.\n    return verifyTotp(secret, code, undefined, RELAY_VERIFY_SKEW_STEPS);\n  };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA8BA,MAAM,YAAY;;AAGlB,MAAM,SAAS;;;;;;;;;;AAWf,SAAgB,aAAa,QAAgB,OAAe,KAAK,KAAK,EAAU;CAC9E,MAAM,MAAM,OAAO,KAAK,QAAQ,MAAM;CAGtC,MAAM,UAAU,KAAK,IAAI,GAAG,KAAK,MAAM,OAAO,MAAO,UAAU,CAAC;CAGhE,MAAM,aAAa,OAAO,MAAM,EAAE;CAGlC,MAAM,KAAK,KAAK,MAAM,UAAU,WAAY;CAC5C,MAAM,KAAK,YAAY;AACvB,YAAW,cAAc,IAAI,EAAE;AAC/B,YAAW,cAAc,IAAI,EAAE;CAE/B,MAAM,MAAM,WAAW,QAAQ,IAAI,CAAC,OAAO,WAAW,CAAC,QAAQ;CAG/D,MAAM,SAAS,IAAI,MAAM;AAQzB,WANI,IAAI,UAAU,QAAS,MACvB,IAAI,SAAS,KAAK,QAAS,MAC3B,IAAI,SAAS,KAAK,QAAS,IAC5B,IAAI,SAAS,KAAK,OAEC,MAAM,QACjB,UAAU,CAAC,SAAS,QAAQ,IAAI;;;;;;;;;;;;;;;;AAiB7C,SAAgB,WACd,QACA,MACA,OAAe,KAAK,KAAK,EACzB,OAAe,GACN;CACT,MAAM,aAAa,OAAO,KAAK,CAAC,SAAS,QAAQ,IAAI;AACrD,KAAI,WAAW,WAAW,UAAU,CAAC,UAAU,KAAK,WAAW,CAC7D,QAAO;CAGT,MAAM,eAAe,OAAO,KAAK,YAAY,OAAO;AAEpD,MAAK,IAAI,QAAQ,CAAC,MAAM,SAAS,MAAM,SAAS;EAE9C,MAAM,WAAW,aAAa,QADb,OAAO,QAAQ,YAAY,IACG;AAE/C,MAAI,gBADgB,OAAO,KAAK,UAAU,OAAO,EAChB,aAAa,CAC5C,QAAO;;AAIX,QAAO;;;;;;;;;;AAWT,MAAM,uBAAuB;;AAG7B,MAAM,SAAS;;;;;;;;;;;;;AAcf,MAAa,oCAAoC;CAC/C;CACA;CACA;CACA;CACA;CACD,CAAC,KAAK,KAAK;;;;;;;;;;;;;AAcZ,SAAgB,uBAAuB,QAA8C;AACnF,KAAI,WAAW,KAAA,KAAa,WAAW,GAAI,QAAO;AAClD,KAAI,OAAO,SAAS,qBAAsB,QAAO;AACjD,KAAI,OAAO,SAAS,MAAM,EAAG,QAAO;AACpC,QAAO,OAAO,KAAK,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;AA0B5B,SAAgB,0BAA0B,MAAyB,QAAQ,KAAW;AACpF,KAAI,CAAC,uBAAuB,IAAI,sBAAsB,CACpD,OAAM,IAAI,MAAM,kCAAkC;;;;;;;;;;;;;;;;;;;;;;;;;;AAmDtD,SAAgB,qBACd,MAAyB,QAAQ,KACoC;CACrE,MAAM,SAAS,IAAI;AACnB,KAAI,CAAC,OAAQ,QAAO,KAAA;AAEpB,SAAQ,QAAQ;EAGd,MAAM,SAAS,IAAI,OAAO;EAC1B,MAAM,SAAS,OAAO,QAAQ,IAAI;EAClC,MAAM,WAAW,WAAW,KAAK,KAAK,OAAO,MAAM,SAAS,EAAE;AAO9D,SAAO,WAAW,QANH,IAAI,gBAAgB,SAAS,CACxB,IAAI,KAAK,IAAI,IAKD,KAAA,GAAA,EAAmC"}