@ait-co/devtools 0.1.64 → 0.1.66

package/dist/qr-http-server-CQwQumPJ.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"qr-http-server-CQwQumPJ.cjs","names":[],"sources":["../src/i18n/en.ts","../src/i18n/ko.ts","../src/i18n/index.ts","../src/mcp/dashboard.generated.ts","../src/mcp/qr-http-server.ts"],"sourcesContent":["import type { StringKey } from './ko.js';\n\n// English translations. Mirrors every key in `ko.ts`; missing keys fall back to\n// the key string at runtime (see `t()` in index.ts), but the `Record<StringKey,\n// string>` type below means a missing key will typecheck-fail.\n\nexport const en: Record<StringKey, string> = {\n  // Panel chrome\n  'panel.title': 'AIT DevTools',\n  'panel.toggle.title': 'AIT DevTools',\n  'panel.close': 'Close',\n  'panel.editMode.on': 'EDIT',\n  'panel.editMode.off': 'READ-ONLY',\n  'panel.editMode.toggleTitle': 'Toggle panel edit mode',\n  'panel.tabError': 'Error rendering \"{tab}\" tab.',\n\n  // Tab names\n  'panel.tab.env': 'Environment',\n  'panel.tab.presets': 'Presets',\n  'panel.tab.viewport': 'Viewport',\n  'panel.tab.permissions': 'Permissions',\n  'panel.tab.notifications': 'Notifications',\n  'panel.tab.location': 'Location',\n  'panel.tab.device': 'Device',\n  'panel.tab.iap': 'IAP',\n  'panel.tab.ads': 'Ads',\n  'panel.tab.events': 'Events',\n  'panel.tab.analytics': 'Analytics',\n  'panel.tab.storage': 'Storage',\n\n  // Common\n  'common.readOnly': 'Read-only — mock responses are controlled at build time.',\n\n  // Consent toast\n  'toast.consent.title': 'Send anonymous usage stats?',\n  'toast.consent.body':\n    'We collect anonymous events only, to improve the tool. You can turn this off anytime in the Environment tab.',\n  'toast.consent.learnMore': 'Learn more',\n  'toast.consent.accept': 'Yes, send',\n  'toast.consent.deny': 'No, thanks',\n\n  // Environment tab\n  'env.section.platform': 'Platform',\n  'env.row.os': 'OS',\n  'env.row.appVersion': 'App Version',\n  'env.row.environment': 'Environment',\n  'env.row.locale': 'Locale',\n  'env.section.network': 'Network',\n  'env.row.networkStatus': 'Status',\n  'env.section.safeArea': 'Safe Area Insets',\n  'env.row.safeArea.top': 'Top',\n  'env.row.safeArea.bottom': 'Bottom',\n  'env.section.navigation': 'Navigation',\n  'env.row.iosSwipeGesture': 'iOS swipe-back',\n  'env.value.iosSwipeGesture.unset': 'not called',\n  'env.value.iosSwipeGesture.enabled': 'enabled',\n  'env.value.iosSwipeGesture.disabled': 'disabled',\n  'env.hint.iosSwipeGesture':\n    'Last value passed to setIosSwipeGestureEnabled. Switching Environment to toss lets a toss-gated guard toggle this.',\n\n  // Environment > Telemetry section\n  'env.telemetry.section': 'Telemetry',\n  // Tier 0 — opt-out anonymous signal\n  'env.telemetry.t0Row': 'Anonymous usage signal (Tier 0)',\n  'env.telemetry.t0On': 'On',\n  'env.telemetry.t0Off': 'Off',\n  'env.telemetry.t0TurnOn': 'Turn on',\n  'env.telemetry.t0TurnOff': 'Turn off',\n  'env.telemetry.t0Desc': 'Version + date only, no PII. Once per day. Helps improve the package.',\n  // Tier 1 — opt-in extended telemetry\n  'env.telemetry.row': 'Extended telemetry (Tier 1)',\n  'env.telemetry.on': 'On',\n  'env.telemetry.off': 'Off',\n  'env.telemetry.turnOn': 'Turn on',\n  'env.telemetry.turnOff': 'Turn off',\n  'env.telemetry.anonIdLabel': 'anon_id: {value}',\n  'env.telemetry.anonIdNotSet': '(not yet set)',\n  'env.telemetry.anonIdCopyTitle': 'Click to copy full anon_id',\n  'env.telemetry.deleteBtn': 'Delete my data',\n  'env.telemetry.deleting': 'Deleting…',\n  'env.telemetry.deleted': 'Deleted',\n  'env.telemetry.deleteFailedRetry': 'Delete failed (please retry)',\n  'env.telemetry.deleteFailed': 'Delete failed',\n  'env.telemetry.privacyLink': 'Privacy policy →',\n\n  // Environment > Language toggle (new)\n  'env.section.language': 'Language',\n  'env.language.row': 'Language',\n  'env.language.ko': '한국어',\n  'env.language.en': 'English',\n\n  // Permissions tab\n  'permissions.section.device': 'Device Permissions',\n\n  // Location tab\n  'location.section.current': 'Current Location',\n  'location.row.latitude': 'Latitude',\n  'location.row.longitude': 'Longitude',\n  'location.row.accuracy': 'Accuracy',\n\n  // Device tab\n  'device.section.modes': 'Device API Modes',\n  'device.row.camera': 'Camera',\n  'device.row.photos': 'Photos',\n  'device.row.location': 'Location',\n  'device.row.network': 'Network',\n  'device.row.clipboard': 'Clipboard',\n  'device.section.mockImages': 'Mock Images ({count})',\n  'device.btn.add': '+ Add',\n  'device.btn.useDefaults': 'Use defaults',\n  'device.btn.clear': 'Clear',\n  'device.prompt.camera.title': 'Camera Prompt — Select an image',\n  'device.prompt.photos.title': 'Photos Prompt — Select images',\n  'device.prompt.location.title': 'Location Prompt — Enter coordinates',\n  'device.prompt.locationUpdate.title': 'Location Update — Send coordinates',\n  'device.prompt.fallbackTitle': 'Prompt: {type}',\n  'device.prompt.label.lat': 'Lat',\n  'device.prompt.label.lng': 'Lng',\n  'device.prompt.send': 'Send',\n  'device.prompt.cancel': 'Cancel',\n\n  // Device tab — Haptic section\n  'device.section.haptic': 'Haptic',\n  'device.haptic.lastCall': 'Last haptic',\n  'device.haptic.noneYet': '(none yet)',\n  'device.haptic.trigger': 'Trigger haptic',\n\n  // Viewport tab\n  'viewport.section.device': 'Device',\n  'viewport.row.preset': 'Preset',\n  'viewport.row.orientation': 'Orientation',\n  'viewport.row.notchSide': 'Notch side',\n  'viewport.section.custom': 'Custom size',\n  'viewport.row.width': 'Width (px)',\n  'viewport.row.height': 'Height (px)',\n  'viewport.section.appearance': 'Appearance',\n  'viewport.row.showFrame': 'Show frame',\n  'viewport.row.showAitNavBar': 'Show Apps in Toss nav bar',\n  'viewport.row.navBarType': 'Nav bar type',\n  'viewport.status.noConstraint': 'No viewport constraint — body fills the window.',\n  'viewport.status.cssPhysical': 'CSS / physical',\n  'viewport.status.safeArea': 'Safe area',\n  'viewport.status.aitNavBar': 'AIT nav bar',\n  'viewport.status.aitNavBarValue': '{height}px → SafeArea top · {type}',\n  'viewport.orientation.autoSuffix': '{orient} (auto)',\n\n  // IAP tab\n  'iap.section.simulator': 'IAP Simulator',\n  'iap.row.nextResult': 'Next Purchase Result',\n  'iap.section.tossPay': 'TossPay',\n  'iap.row.tossPayResult': 'Next Payment Result',\n  'iap.section.pending': 'Pending Orders ({count})',\n  'iap.empty.pending': '(no pending orders)',\n  'iap.section.completed': 'Completed Orders ({count})',\n  'iap.empty.completed': '(no completed orders)',\n  'iap.btn.complete': 'Complete',\n  'iap.label.pending': 'PENDING',\n\n  // Events tab\n  'events.section.navigation': 'Navigation Events',\n  'events.btn.triggerBack': 'Trigger Back Event',\n  'events.btn.triggerHome': 'Trigger Home Event',\n  'events.section.login': 'Login',\n  'events.row.loggedIn': 'Logged In',\n  'events.row.tossLoginIntegrated': 'Toss Login Integrated',\n\n  // Analytics tab\n  'analytics.section.log': 'Analytics Log ({count})',\n  'analytics.btn.clear': 'Clear',\n  'analytics.calls.section': 'SDK Calls ({count})',\n  'analytics.calls.btn.clear': 'Clear',\n  'analytics.calls.empty': '(no SDK calls yet)',\n\n  // Storage tab\n  'storage.section.title': 'Storage ({count} items)',\n  'storage.btn.clearAll': 'Clear All',\n  'storage.empty': 'No items in storage',\n\n  // Presets tab\n  'presets.section.builtIn': 'Built-in scenarios',\n  'presets.section.saved': 'Saved presets ({count})',\n  'presets.section.save': 'Save',\n  'presets.save.description': 'Capture network / permissions / auth / IAP / ads / payment slices.',\n  'presets.btn.saveCurrent': 'Save current as preset',\n  'presets.btn.apply': 'Apply',\n  'presets.btn.reApply': 'Re-apply',\n  'presets.btn.delete': 'Delete',\n  'presets.empty.saved': 'No saved presets yet.',\n  'presets.empty.builtIn': 'No built-in presets.',\n  'presets.prompt.label': 'Preset label?',\n  'presets.confirm.delete': 'Delete preset \"{label}\"?',\n\n  // Ads tab\n  'ads.section.state': 'Ads State',\n  'ads.row.isLoaded': 'isLoaded',\n  'ads.row.forceNoFill': 'Force \"no fill\"',\n  'ads.empty.events': 'No events yet',\n  'ads.section.googleAdMob': 'GoogleAdMob',\n  'ads.section.tossAds': 'TossAds',\n  'ads.section.fullScreenAd': 'FullScreenAd',\n  'ads.btn.load': 'Load',\n  'ads.btn.show': 'Show',\n  'ads.section.tossAdsBanner': 'TossAds Banner',\n  'ads.row.rewardUnitType': 'Reward unit type',\n  'ads.row.rewardAmount': 'Reward amount',\n  'ads.btn.render': 'Render',\n  'ads.btn.noFill': 'No-fill',\n  'ads.btn.click': 'Click',\n  'ads.btn.destroy': 'Destroy',\n\n  // Notifications tab\n  'notifications.section.title': 'requestNotificationAgreement',\n  'notifications.option.newAgreement': 'newAgreement (first-time agree)',\n  'notifications.option.alreadyAgreed': 'alreadyAgreed (already opted-in)',\n  'notifications.option.agreementRejected': 'agreementRejected (user declined)',\n\n  // qr-http-server — lang switcher (dashboard / attach pages)\n  'dashboard.lang.ko': '한국어',\n  'dashboard.lang.en': 'English',\n\n  // qr-http-server — dashboard page (server-side, Node, per-request)\n  'dashboard.title': 'AIT Debug Dashboard',\n  'dashboard.updated': 'Last updated: {ts}',\n  'dashboard.tunnel.section': 'Tunnel status',\n  'dashboard.tunnel.up': 'Connected',\n  'dashboard.tunnel.down': 'Disconnected',\n  'dashboard.attach.section': 'Attach QR',\n  'dashboard.attach.hint': 'Call the build_attach_url MCP tool to show the QR here.',\n  'dashboard.pages.section': 'Connected Pages',\n  'dashboard.pages.empty': 'No attached pages',\n\n  // qr-http-server — attach page (server-side, Node, per-request)\n  'attach.title': 'AIT Debug Session — QR Scan',\n  'attach.deployment': 'deployment: {label}',\n  'attach.steps.section': 'How to scan',\n  'attach.step1': 'Open the Toss app.',\n  'attach.step2': 'Scan the QR code with your phone camera app.',\n  'attach.step3': 'Tap <strong>\"Open in Toss\"</strong> when the popup appears.',\n  'attach.step4': 'The mini-app opens and the debug session attaches automatically.',\n  'attach.faq.section': 'Troubleshooting checklist',\n  'attach.faq.appNotOpen':\n    '<strong>Toss app does not open</strong> — check app version; scan with the system camera app (not the Toss in-app QR reader)',\n  'attach.faq.prepare':\n    '<strong>Mini-app stuck in PREPARE state</strong> — verify the deep-link has a <code>_deploymentId</code> parameter',\n  'attach.faq.chii':\n    '<strong>Chii injection failure / console is empty</strong> — verify the mini-app bundle has an <code>in-app</code> debug import',\n  'attach.faq.totp':\n    '<strong>TOTP gate Layer C is inactive</strong> — check that <code>AIT_DEBUG_TOTP_SECRET</code> is set on the relay server',\n  'attach.url.section': 'URL (fallback)',\n\n  // Launcher PWA\n  'launcher.title': 'AITC DevTools Launcher',\n  'launcher.description': 'Scan the terminal QR code or paste the tunnel URL.',\n  'launcher.installCta': 'Install launcher to your phone',\n  'launcher.urlPlaceholder': 'https://example.trycloudflare.com',\n  'launcher.openBtn': 'Open',\n  'launcher.scanBtn': 'Scan QR with camera',\n  'launcher.rescanBtn': 'Rescan',\n  'launcher.noCamera': 'No camera available — paste the URL instead.',\n  'launcher.cameraError': 'Could not access the camera — paste the URL instead.',\n  'launcher.invalidUrlHttps': 'Enter a valid https:// URL (the tunnel URL from your terminal).',\n  'launcher.invalidUrl': 'Enter a valid http(s):// URL.',\n  'launcher.debugAuthFailed': 'Debug connection authentication failed',\n  'launcher.debugAuthFailedHint': 'The QR code may have expired. Scan a fresh QR code.',\n  'launcher.debugAuthRescanCta': 'Scan a new QR',\n};\n","// Korean string catalog (source of truth — keys are typed from this file).\n// Keys follow `<area>.<purpose>` convention. Variable interpolation uses\n// `{name}` placeholders resolved by `t(key, { name: value })`.\n//\n// Some chrome (button labels like \"Load\", \"Show\", \"Clear\", \"Apply\") is left as\n// English in both locales because the panel is an internal devtools surface\n// and these terms are universally recognised by developers in both locales.\n\nexport const ko = {\n  // Panel chrome\n  'panel.title': 'AIT DevTools',\n  'panel.toggle.title': 'AIT DevTools',\n  'panel.close': 'Close',\n  'panel.editMode.on': 'EDIT',\n  'panel.editMode.off': 'READ-ONLY',\n  'panel.editMode.toggleTitle': '패널 편집 모드 전환',\n  'panel.tabError': '\"{tab}\" 탭 렌더링 중 오류가 발생했습니다.',\n\n  // Tab names\n  'panel.tab.env': 'Environment',\n  'panel.tab.presets': 'Presets',\n  'panel.tab.viewport': 'Viewport',\n  'panel.tab.permissions': 'Permissions',\n  'panel.tab.notifications': 'Notifications',\n  'panel.tab.location': 'Location',\n  'panel.tab.device': 'Device',\n  'panel.tab.iap': 'IAP',\n  'panel.tab.ads': 'Ads',\n  'panel.tab.events': 'Events',\n  'panel.tab.analytics': 'Analytics',\n  'panel.tab.storage': 'Storage',\n\n  // Common\n  'common.readOnly': '읽기 전용 — mock 응답은 빌드 타임에 고정됩니다.',\n\n  // Consent toast\n  'toast.consent.title': '익명 사용 통계를 보낼까요?',\n  'toast.consent.body': '도구 개선을 위해 익명 이벤트만 수집해요. 언제든 환경 탭에서 끌 수 있어요.',\n  'toast.consent.learnMore': '더 알아보기',\n  'toast.consent.accept': '네, 보낼게요',\n  'toast.consent.deny': '아니요',\n\n  // Environment tab\n  'env.section.platform': 'Platform',\n  'env.row.os': 'OS',\n  'env.row.appVersion': 'App Version',\n  'env.row.environment': 'Environment',\n  'env.row.locale': 'Locale',\n  'env.section.network': 'Network',\n  'env.row.networkStatus': 'Status',\n  'env.section.safeArea': 'Safe Area Insets',\n  'env.row.safeArea.top': 'Top',\n  'env.row.safeArea.bottom': 'Bottom',\n  'env.section.navigation': 'Navigation',\n  'env.row.iosSwipeGesture': 'iOS swipe-back',\n  'env.value.iosSwipeGesture.unset': '미호출',\n  'env.value.iosSwipeGesture.enabled': 'enabled',\n  'env.value.iosSwipeGesture.disabled': 'disabled',\n  'env.hint.iosSwipeGesture':\n    'setIosSwipeGestureEnabled의 마지막 호출값. Environment를 toss로 바꾸면 toss-gated 가드가 이 값을 토글합니다.',\n\n  // Environment > Telemetry section\n  'env.telemetry.section': 'Telemetry',\n  // Tier 0 — opt-out anonymous signal\n  'env.telemetry.t0Row': '익명 사용 신호 (Tier 0)',\n  'env.telemetry.t0On': 'On',\n  'env.telemetry.t0Off': 'Off',\n  'env.telemetry.t0TurnOn': 'Turn on',\n  'env.telemetry.t0TurnOff': 'Turn off',\n  'env.telemetry.t0Desc': '버전·날짜만 수집, PII 없음. 하루 1회. 패키지 개선에 사용됩니다.',\n  // Tier 1 — opt-in extended telemetry\n  'env.telemetry.row': '확장 텔레메트리 (Tier 1)',\n  'env.telemetry.on': 'On',\n  'env.telemetry.off': 'Off',\n  'env.telemetry.turnOn': 'Turn on',\n  'env.telemetry.turnOff': 'Turn off',\n  'env.telemetry.anonIdLabel': 'anon_id: {value}',\n  'env.telemetry.anonIdNotSet': '(not yet set)',\n  'env.telemetry.anonIdCopyTitle': '전체 anon_id 복사',\n  'env.telemetry.deleteBtn': '내 데이터 삭제',\n  'env.telemetry.deleting': '삭제 중…',\n  'env.telemetry.deleted': '삭제 완료',\n  'env.telemetry.deleteFailedRetry': '삭제 실패 (다시 시도해주세요)',\n  'env.telemetry.deleteFailed': '삭제 실패',\n  'env.telemetry.privacyLink': '개인정보 처리방침 →',\n\n  // Environment > Language toggle (new)\n  'env.section.language': 'Language',\n  'env.language.row': 'Language',\n  'env.language.ko': '한국어',\n  'env.language.en': 'English',\n\n  // Permissions tab\n  'permissions.section.device': 'Device Permissions',\n\n  // Location tab\n  'location.section.current': 'Current Location',\n  'location.row.latitude': 'Latitude',\n  'location.row.longitude': 'Longitude',\n  'location.row.accuracy': 'Accuracy',\n\n  // Device tab\n  'device.section.modes': 'Device API Modes',\n  'device.row.camera': 'Camera',\n  'device.row.photos': 'Photos',\n  'device.row.location': 'Location',\n  'device.row.network': 'Network',\n  'device.row.clipboard': 'Clipboard',\n  'device.section.mockImages': 'Mock Images ({count})',\n  'device.btn.add': '+ Add',\n  'device.btn.useDefaults': 'Use defaults',\n  'device.btn.clear': 'Clear',\n  'device.prompt.camera.title': 'Camera Prompt — 이미지를 선택하세요',\n  'device.prompt.photos.title': 'Photos Prompt — 이미지를 선택하세요',\n  'device.prompt.location.title': 'Location Prompt — 좌표 입력',\n  'device.prompt.locationUpdate.title': 'Location Update — 좌표 전송',\n  'device.prompt.fallbackTitle': 'Prompt: {type}',\n  'device.prompt.label.lat': 'Lat',\n  'device.prompt.label.lng': 'Lng',\n  'device.prompt.send': 'Send',\n  'device.prompt.cancel': 'Cancel',\n\n  // Device tab — Haptic section\n  'device.section.haptic': 'Haptic',\n  'device.haptic.lastCall': '마지막 haptic',\n  'device.haptic.noneYet': '(아직 없음)',\n  'device.haptic.trigger': 'Haptic 트리거',\n\n  // Viewport tab\n  'viewport.section.device': 'Device',\n  'viewport.row.preset': 'Preset',\n  'viewport.row.orientation': 'Orientation',\n  'viewport.row.notchSide': 'Notch side',\n  'viewport.section.custom': 'Custom size',\n  'viewport.row.width': 'Width (px)',\n  'viewport.row.height': 'Height (px)',\n  'viewport.section.appearance': 'Appearance',\n  'viewport.row.showFrame': 'Show frame',\n  'viewport.row.showAitNavBar': 'Apps in Toss 내비게이션 바 표시',\n  'viewport.row.navBarType': 'Nav bar type',\n  'viewport.status.noConstraint': '뷰포트 제약 없음 — body가 창을 가득 채웁니다.',\n  'viewport.status.cssPhysical': 'CSS / physical',\n  'viewport.status.safeArea': 'Safe area',\n  'viewport.status.aitNavBar': 'AIT nav bar',\n  'viewport.status.aitNavBarValue': '{height}px → SafeArea top · {type}',\n  'viewport.orientation.autoSuffix': '{orient} (auto)',\n\n  // IAP tab\n  'iap.section.simulator': 'IAP Simulator',\n  'iap.row.nextResult': 'Next Purchase Result',\n  'iap.section.tossPay': 'TossPay',\n  'iap.row.tossPayResult': 'Next Payment Result',\n  'iap.section.pending': 'Pending Orders ({count})',\n  'iap.empty.pending': '(대기 중인 주문 없음)',\n  'iap.section.completed': 'Completed Orders ({count})',\n  'iap.empty.completed': '(완료된 주문 없음)',\n  'iap.btn.complete': 'Complete',\n  'iap.label.pending': 'PENDING',\n\n  // Events tab\n  'events.section.navigation': 'Navigation Events',\n  'events.btn.triggerBack': 'Back 이벤트 발생',\n  'events.btn.triggerHome': 'Home 이벤트 발생',\n  'events.section.login': 'Login',\n  'events.row.loggedIn': 'Logged In',\n  'events.row.tossLoginIntegrated': 'Toss Login Integrated',\n\n  // Analytics tab\n  'analytics.section.log': 'Analytics Log ({count})',\n  'analytics.btn.clear': 'Clear',\n  'analytics.calls.section': 'SDK Calls ({count})',\n  'analytics.calls.btn.clear': 'Clear',\n  'analytics.calls.empty': '(아직 SDK 호출 없음)',\n\n  // Storage tab\n  'storage.section.title': 'Storage ({count} items)',\n  'storage.btn.clearAll': 'Clear All',\n  'storage.empty': '저장된 항목이 없습니다',\n\n  // Presets tab\n  'presets.section.builtIn': 'Built-in scenarios',\n  'presets.section.saved': 'Saved presets ({count})',\n  'presets.section.save': 'Save',\n  'presets.save.description':\n    'network / permissions / auth / IAP / ads / payment 슬라이스를 캡처합니다.',\n  'presets.btn.saveCurrent': '현재 상태를 프리셋으로 저장',\n  'presets.btn.apply': 'Apply',\n  'presets.btn.reApply': 'Re-apply',\n  'presets.btn.delete': 'Delete',\n  'presets.empty.saved': '저장된 프리셋이 아직 없습니다.',\n  'presets.empty.builtIn': '내장 프리셋이 없습니다.',\n  'presets.prompt.label': '프리셋 라벨을 입력하세요',\n  'presets.confirm.delete': '\"{label}\" 프리셋을 삭제할까요?',\n\n  // Ads tab\n  'ads.section.state': 'Ads State',\n  'ads.row.isLoaded': 'isLoaded',\n  'ads.row.forceNoFill': '강제 \"no fill\"',\n  'ads.empty.events': '아직 이벤트가 없습니다',\n  'ads.section.googleAdMob': 'GoogleAdMob',\n  'ads.section.tossAds': 'TossAds',\n  'ads.section.fullScreenAd': 'FullScreenAd',\n  'ads.btn.load': 'Load',\n  'ads.btn.show': 'Show',\n  'ads.section.tossAdsBanner': 'TossAds 배너',\n  'ads.row.rewardUnitType': '리워드 단위 타입',\n  'ads.row.rewardAmount': '리워드 수량',\n  'ads.btn.render': 'Render',\n  'ads.btn.noFill': 'No-fill',\n  'ads.btn.click': 'Click',\n  'ads.btn.destroy': 'Destroy',\n\n  // Notifications tab\n  'notifications.section.title': 'requestNotificationAgreement',\n  'notifications.option.newAgreement': 'newAgreement (최초 동의)',\n  'notifications.option.alreadyAgreed': 'alreadyAgreed (이미 동의됨)',\n  'notifications.option.agreementRejected': 'agreementRejected (사용자 거절)',\n\n  // qr-http-server — lang switcher (dashboard / attach pages)\n  'dashboard.lang.ko': '한국어',\n  'dashboard.lang.en': 'English',\n\n  // qr-http-server — dashboard page (server-side, Node, per-request)\n  'dashboard.title': 'AIT 디버그 Dashboard',\n  'dashboard.updated': '마지막 갱신: {ts}',\n  'dashboard.tunnel.section': '터널 상태',\n  'dashboard.tunnel.up': '연결됨',\n  'dashboard.tunnel.down': '끊어짐',\n  'dashboard.attach.section': 'Attach QR',\n  'dashboard.attach.hint': 'build_attach_url MCP tool을 호출하면 QR이 여기에 표시됩니다.',\n  'dashboard.pages.section': '연결된 Pages',\n  'dashboard.pages.empty': 'attach된 페이지 없음',\n\n  // qr-http-server — attach page (server-side, Node, per-request)\n  'attach.title': 'AIT 디버그 세션 — QR 스캔',\n  'attach.deployment': 'deployment: {label}',\n  'attach.steps.section': '스캔 절차',\n  'attach.step1': '토스 앱을 실행하세요.',\n  'attach.step2': '폰 카메라 앱으로 QR 코드를 스캔하세요.',\n  'attach.step3': '팝업이 뜨면 <strong>\"토스로 열기\"</strong>를 탭하세요.',\n  'attach.step4': '미니앱이 열리고 디버그 세션이 자동으로 attach됩니다.',\n  'attach.faq.section': '진단 체크리스트',\n  'attach.faq.appNotOpen':\n    '<strong>토스 앱이 안 열리는 경우</strong> — 앱 버전 확인, 카메라 앱으로 스캔 (토스 앱 내 QR 리더 X)',\n  'attach.faq.prepare':\n    '<strong>미니앱이 PREPARE 상태에서 멈추는 경우</strong> — deep-link에 <code>_deploymentId</code> 파라미터가 있는지 확인',\n  'attach.faq.chii':\n    '<strong>Chii 주입 실패 / 콘솔이 비어 있는 경우</strong> — 미니앱 번들에 <code>in-app</code> debug import가 있는지 확인',\n  'attach.faq.totp':\n    '<strong>TOTP gate Layer C가 비활성인 경우</strong> — relay 서버에 <code>AIT_DEBUG_TOTP_SECRET</code>이 설정돼 있는지 확인',\n  'attach.url.section': 'URL (fallback)',\n\n  // Launcher PWA\n  'launcher.title': 'AITC DevTools Launcher',\n  'launcher.description': '터미널 QR을 스캔하거나 URL을 입력하세요.',\n  'launcher.installCta': '폰에 런처 설치하기',\n  'launcher.urlPlaceholder': 'https://example.trycloudflare.com',\n  'launcher.openBtn': 'Open',\n  'launcher.scanBtn': 'QR 카메라로 스캔',\n  'launcher.rescanBtn': 'Rescan',\n  'launcher.noCamera': '카메라를 사용할 수 없습니다 — URL을 직접 붙여넣으세요.',\n  'launcher.cameraError': '카메라에 접근할 수 없습니다 — URL을 직접 붙여넣으세요.',\n  'launcher.invalidUrlHttps': '올바른 https:// URL을 입력하세요 (터미널의 터널 URL).',\n  'launcher.invalidUrl': '올바른 http(s):// URL을 입력하세요.',\n  'launcher.debugAuthFailed': '디버그 연결 인증 실패',\n  'launcher.debugAuthFailedHint': 'QR 코드가 만료되었을 수 있어요. 새 QR을 다시 스캔하세요.',\n  'launcher.debugAuthRescanCta': '새 QR 스캔하기',\n} as const;\n\nexport type StringKey = keyof typeof ko;\n","/**\n * Vanilla TS i18n for the floating DevTools panel.\n *\n * Public surface:\n *   - `t(key, vars?)` — look up a UI string, with `{name}` placeholder\n *     interpolation. Falls back to the key itself if a translation is missing.\n *   - `getLocale()` / `setLocale(locale)` — read/persist the active locale.\n *     `setLocale` dispatches `__ait:localechange` so the panel can remount.\n *   - `detectLocale()` — first-run heuristic from `navigator.language`.\n *\n * `ko` is the source of truth (keys are typed from it). `en` is also a full\n * `Record<StringKey, string>` (devtools is developer-facing, en is a real\n * audience). The `Partial` lookup table preserves the runtime `?? key` safety\n * net even though we ship complete catalogs today.\n */\n\nimport { en } from './en.js';\nimport { ko, type StringKey } from './ko.js';\n\nexport type Locale = 'ko' | 'en';\n\nconst LOCALE_STORAGE_KEY = '__ait_locale';\nconst LOCALE_CHANGE_EVENT = '__ait:localechange';\n\nconst tables: Record<Locale, Partial<Record<StringKey, string>>> = { ko, en };\n\nlet currentLocale: Locale | null = null;\n\nfunction safeReadStorage(): Locale | null {\n  if (typeof localStorage === 'undefined') return null;\n  try {\n    const raw = localStorage.getItem(LOCALE_STORAGE_KEY);\n    if (raw === 'ko' || raw === 'en') return raw;\n  } catch {\n    /* localStorage can throw in privacy modes — fall back silently */\n  }\n  return null;\n}\n\nfunction safeWriteStorage(locale: Locale): void {\n  if (typeof localStorage === 'undefined') return;\n  try {\n    localStorage.setItem(LOCALE_STORAGE_KEY, locale);\n  } catch {\n    /* ignore quota / privacy errors */\n  }\n}\n\n/**\n * Decide a locale from a BCP-47 language tag. `ko` (and `ko-*`) → `'ko'`,\n * everything else → `'en'`. Shared by the browser (`navigator.language`) and\n * Node (`Accept-Language` header) paths so both resolve identically.\n */\nfunction localeFromLanguageTag(lang: string): Locale {\n  return /^ko\\b/i.test(lang) ? 'ko' : 'en';\n}\n\n/**\n * Read `navigator.language` and decide a locale. `ko` (and `ko-*`) → `'ko'`,\n * everything else → `'en'`. Pure function; does not touch storage.\n */\nexport function detectLocale(): Locale {\n  if (typeof navigator === 'undefined') return 'en';\n  return localeFromLanguageTag(navigator.language ?? '');\n}\n\n/**\n * Decide a locale from an HTTP `Accept-Language` header value. The Node-served\n * surfaces (e.g. the qr-http-server dashboard) have no `navigator`, so the\n * request header is the only language signal. Reads the FIRST language tag\n * (highest priority, ignoring `q=` weights — good enough for ko/en) and feeds\n * it through the same `ko`-vs-`en` heuristic `detectLocale` uses. Returns `'ko'`\n * for an empty/missing header (ko is the primary locale).\n */\nexport function parseAcceptLanguage(header: string | undefined | null): Locale {\n  if (!header) return 'ko';\n  const first = header.split(',')[0]?.trim().split(';')[0]?.trim() ?? '';\n  return localeFromLanguageTag(first);\n}\n\n/**\n * A locale-bound string resolver for surfaces that can't use the in-memory\n * `getLocale()` cache — notably the Node HTTP server, which resolves locale\n * per-request from `Accept-Language` rather than from a process-global. Returns\n * a `t`-compatible closure over the SAME `ko`/`en` tables (single source of\n * truth), so the dashboard/attach HTML shares the exact 169-key catalog the\n * browser surfaces use. The `key: StringKey` signature keeps compile-time key\n * safety on the Node path identical to `t()`.\n */\nexport function resolveLocaleStrings(\n  locale: Locale,\n): (key: StringKey, vars?: Record<string, string | number>) => string {\n  const table = tables[locale];\n  return (key, vars) => {\n    const raw = table[key] ?? key;\n    if (!vars) return raw;\n    return raw.replace(/\\{(\\w+)\\}/g, (match, name: string) => {\n      const value = vars[name];\n      return value === undefined ? match : String(value);\n    });\n  };\n}\n\n/**\n * Resolve the active locale, in order:\n *   1. previously set in-memory value (set by `setLocale`)\n *   2. localStorage `__ait_locale`\n *   3. `detectLocale()` from navigator\n */\nexport function getLocale(): Locale {\n  if (currentLocale) return currentLocale;\n  const stored = safeReadStorage();\n  currentLocale = stored ?? detectLocale();\n  return currentLocale;\n}\n\n/**\n * Persist a locale choice and notify listeners. The panel listens for\n * `__ait:localechange` and re-mounts so every string re-evaluates.\n */\nexport function setLocale(locale: Locale): void {\n  currentLocale = locale;\n  safeWriteStorage(locale);\n  if (typeof window !== 'undefined') {\n    window.dispatchEvent(new CustomEvent(LOCALE_CHANGE_EVENT));\n  }\n}\n\n/**\n * Look up a UI string for the current locale. Falls back to the key if missing,\n * so a forgotten key surfaces visibly rather than rendering empty.\n */\nexport function t(key: StringKey, vars?: Record<string, string | number>): string {\n  const raw = tables[getLocale()][key] ?? key;\n  if (!vars) return raw;\n  return raw.replace(/\\{(\\w+)\\}/g, (match, name: string) => {\n    const value = vars[name];\n    return value === undefined ? match : String(value);\n  });\n}\n\nexport type { StringKey };\nexport { LOCALE_CHANGE_EVENT, LOCALE_STORAGE_KEY };\n\n/**\n * Test-only escape hatch — resets the cached in-memory locale so subsequent\n * `getLocale()` calls re-read storage / re-detect. Production code never needs\n * this; tests use it between cases.\n */\nexport function _resetLocaleCacheForTests(): void {\n  currentLocale = null;\n}\n","/**\n * dashboard.generated.ts\n *\n * AUTO-GENERATED by scripts/build-dashboard-html.ts — DO NOT EDIT BY HAND.\n * Regenerate: pnpm build:dashboard-html\n *\n * Exports precompiled HTML chrome strings for each locale. Per-request\n * dynamic values are inserted by qr-http-server.ts at runtime via simple\n * string replacement of __PLACEHOLDER__ tokens.\n *\n * Token map (dashboard chrome):\n *   __TUNNEL_CLASS__    CSS class: \"status-up\" | \"status-down\"\n *   __TUNNEL_STATUS__   localised tunnel status label\n *   __ATTACH_SECTION__  QR img+url-box HTML, or hint text\n *   __PAGES_SECTION__   pages <section> block, or empty string\n *   __NOW__             ISO timestamp of current render\n *   __LANG_SWITCHER__   ko/en toggle links (href preserves existing query params)\n *\n * Token map (attach chrome):\n *   __QR_DATA_URL__     base64 data URL for the QR image\n *   __SAFE_LABEL__      HTML-escaped deploymentId label\n *   __SAFE_ATTACH_URL__ HTML-escaped attach URL\n *   __LANG_SWITCHER__   ko/en toggle links (href preserves existing query params)\n *\n * SECRET-HANDLING: wssUrl MUST NOT appear here. If it does, the build script's\n *   assertion would have caught it — this file should be react-free and secret-free.\n */\n\nimport type { Locale } from '../i18n/index.js';\n\n// ── locale: ko ──────────────────────────────────────────────────────\n\nexport const dashboardChromeHtmlKo =\n`<!DOCTYPE html>\n<html lang=\"ko\"><head><meta charSet=\"utf-8\"/><meta name=\"viewport\" content=\"width=device-width, initial-scale=1\"/><title>AIT 디버그 Dashboard</title><style>\n*, *::before, *::after { box-sizing: border-box; }\nbody {\n  font-family: -apple-system, BlinkMacSystemFont, \"Segoe UI\", sans-serif;\n  background: #0d1117; color: #c9d1d9;\n  display: flex; flex-direction: column; align-items: center;\n  min-height: 100vh; margin: 0; padding: 2rem 1rem;\n  gap: 1.5rem;\n}\nh1 { font-size: 1.25rem; font-weight: 600; color: #e6edf3; margin: 0; text-align: center; }\n.updated { font-size: 0.75rem; opacity: 0.4; font-family: monospace; margin: 0; }\nsection { width: 100%; max-width: 520px; }\nh2 { font-size: 1rem; font-weight: 600; color: #e6edf3; margin: 0 0 0.5rem; }\n.status { display: inline-block; padding: 0.25rem 0.75rem; border-radius: 999px; font-size: 0.8rem; font-weight: 600; }\n.status-up { background: #238636; color: #fff; }\n.status-down { background: #6e7681; color: #fff; }\nimg.qr {\n  width: min(80vw, 300px); height: auto;\n  image-rendering: pixelated;\n  background: #fff; padding: 0.75rem; border-radius: 10px;\n  display: block; margin: 0.5rem auto;\n}\n.url-box {\n  font-family: monospace; font-size: 0.7rem;\n  word-break: break-all; opacity: 0.45;\n  background: #161b22; padding: 0.6rem 0.85rem;\n  border-radius: 6px; border: 1px solid #30363d; margin: 0.5rem 0 0;\n}\n.hint { font-size: 0.85rem; opacity: 0.5; margin: 0.25rem 0 0; }\nul { margin: 0; padding-left: 1.25rem; }\nli { margin-bottom: 0.35rem; font-size: 0.85rem; line-height: 1.5; }\nli.empty { opacity: 0.4; list-style: none; padding-left: 0; }\n.page-id { font-family: monospace; font-size: 0.75rem; opacity: 0.5; margin-right: 0.4rem; }\n.page-url { word-break: break-all; }\nhr { border: none; border-top: 1px solid #21262d; width: 100%; margin: 0; }\n.lang-switcher { display: flex; gap: 0.5rem; font-size: 0.75rem; }\n.lang-switcher a { color: #58a6ff; text-decoration: none; opacity: 0.6; }\n.lang-switcher a.active { font-weight: 700; text-decoration: underline; opacity: 1; }\n</style></head><body><h1>AIT 디버그 Dashboard</h1>__LANG_SWITCHER__<p class=\"updated\" id=\"updated\">마지막 갱신: __NOW__</p><section><h2>터널 상태</h2><span class=\"status __TUNNEL_CLASS__\" id=\"tunnel-status\">__TUNNEL_STATUS__</span></section><hr/><section><h2>Attach QR</h2><div id=\"attach-section\">__ATTACH_SECTION__</div></section>__PAGES_SECTION__</body></html>`;\n\nexport const attachChromeHtmlKo =\n`<!DOCTYPE html>\n<html lang=\"ko\"><head><meta charSet=\"utf-8\"/><meta name=\"viewport\" content=\"width=device-width, initial-scale=1\"/><link rel=\"preload\" as=\"image\" href=\"__QR_DATA_URL__\"/><title>AIT 디버그 세션 — QR 스캔</title><style>\n*, *::before, *::after { box-sizing: border-box; }\nbody {\n  font-family: -apple-system, BlinkMacSystemFont, \"Segoe UI\", sans-serif;\n  background: #0d1117; color: #c9d1d9;\n  display: flex; flex-direction: column; align-items: center;\n  min-height: 100vh; margin: 0; padding: 2rem 1rem;\n  gap: 1.5rem;\n}\nh1 { font-size: 1.25rem; font-weight: 600; color: #e6edf3; margin: 0; text-align: center; }\n.label { font-size: 0.8rem; opacity: 0.5; font-family: monospace; margin: 0; }\nimg.qr {\n  width: min(90vw, 360px); height: auto;\n  image-rendering: pixelated;\n  background: #fff; padding: 1rem; border-radius: 12px;\n  display: block; margin: 0 auto;\n}\nsection { width: 100%; max-width: 480px; }\nh2 { font-size: 1rem; font-weight: 600; color: #e6edf3; margin: 0 0 0.5rem; }\nol, ul { margin: 0; padding-left: 1.25rem; }\nli { margin-bottom: 0.4rem; font-size: 0.9rem; line-height: 1.5; }\n.url-box {\n  font-family: monospace; font-size: 0.72rem;\n  word-break: break-all; opacity: 0.4;\n  background: #161b22; padding: 0.75rem 1rem;\n  border-radius: 6px; border: 1px solid #30363d;\n}\nhr { border: none; border-top: 1px solid #21262d; width: 100%; margin: 0.5rem 0; }\n.lang-switcher { display: flex; gap: 0.5rem; font-size: 0.75rem; }\n.lang-switcher a { color: #58a6ff; text-decoration: none; opacity: 0.6; }\n.lang-switcher a.active { font-weight: 700; text-decoration: underline; opacity: 1; }\n</style></head><body><h1>AIT 디버그 세션 — QR 스캔</h1>__LANG_SWITCHER__<p class=\"label\">deployment: __SAFE_LABEL__</p><div id=\"attach-section\"><img class=\"qr\" src=\"__QR_DATA_URL__\" alt=\"attach QR\"/></div><section><h2>스캔 절차</h2><ol><li>토스 앱을 실행하세요.</li><li>폰 카메라 앱으로 QR 코드를 스캔하세요.</li><li>팝업이 뜨면 <strong>\"토스로 열기\"</strong>를 탭하세요.</li><li>미니앱이 열리고 디버그 세션이 자동으로 attach됩니다.</li></ol></section><hr/><section><h2>진단 체크리스트</h2><ul><li><strong>토스 앱이 안 열리는 경우</strong> — 앱 버전 확인, 카메라 앱으로 스캔 (토스 앱 내 QR 리더 X)</li><li><strong>미니앱이 PREPARE 상태에서 멈추는 경우</strong> — deep-link에 <code>_deploymentId</code> 파라미터가 있는지 확인</li><li><strong>Chii 주입 실패 / 콘솔이 비어 있는 경우</strong> — 미니앱 번들에 <code>in-app</code> debug import가 있는지 확인</li><li><strong>TOTP gate Layer C가 비활성인 경우</strong> — relay 서버에 <code>AIT_DEBUG_TOTP_SECRET</code>이 설정돼 있는지 확인</li></ul></section><hr/><section><h2>URL (fallback)</h2><p class=\"url-box\">__SAFE_ATTACH_URL__</p></section></body></html>`;\n\n// ── locale: en ──────────────────────────────────────────────────────\n\nexport const dashboardChromeHtmlEn =\n`<!DOCTYPE html>\n<html lang=\"en\"><head><meta charSet=\"utf-8\"/><meta name=\"viewport\" content=\"width=device-width, initial-scale=1\"/><title>AIT Debug Dashboard</title><style>\n*, *::before, *::after { box-sizing: border-box; }\nbody {\n  font-family: -apple-system, BlinkMacSystemFont, \"Segoe UI\", sans-serif;\n  background: #0d1117; color: #c9d1d9;\n  display: flex; flex-direction: column; align-items: center;\n  min-height: 100vh; margin: 0; padding: 2rem 1rem;\n  gap: 1.5rem;\n}\nh1 { font-size: 1.25rem; font-weight: 600; color: #e6edf3; margin: 0; text-align: center; }\n.updated { font-size: 0.75rem; opacity: 0.4; font-family: monospace; margin: 0; }\nsection { width: 100%; max-width: 520px; }\nh2 { font-size: 1rem; font-weight: 600; color: #e6edf3; margin: 0 0 0.5rem; }\n.status { display: inline-block; padding: 0.25rem 0.75rem; border-radius: 999px; font-size: 0.8rem; font-weight: 600; }\n.status-up { background: #238636; color: #fff; }\n.status-down { background: #6e7681; color: #fff; }\nimg.qr {\n  width: min(80vw, 300px); height: auto;\n  image-rendering: pixelated;\n  background: #fff; padding: 0.75rem; border-radius: 10px;\n  display: block; margin: 0.5rem auto;\n}\n.url-box {\n  font-family: monospace; font-size: 0.7rem;\n  word-break: break-all; opacity: 0.45;\n  background: #161b22; padding: 0.6rem 0.85rem;\n  border-radius: 6px; border: 1px solid #30363d; margin: 0.5rem 0 0;\n}\n.hint { font-size: 0.85rem; opacity: 0.5; margin: 0.25rem 0 0; }\nul { margin: 0; padding-left: 1.25rem; }\nli { margin-bottom: 0.35rem; font-size: 0.85rem; line-height: 1.5; }\nli.empty { opacity: 0.4; list-style: none; padding-left: 0; }\n.page-id { font-family: monospace; font-size: 0.75rem; opacity: 0.5; margin-right: 0.4rem; }\n.page-url { word-break: break-all; }\nhr { border: none; border-top: 1px solid #21262d; width: 100%; margin: 0; }\n.lang-switcher { display: flex; gap: 0.5rem; font-size: 0.75rem; }\n.lang-switcher a { color: #58a6ff; text-decoration: none; opacity: 0.6; }\n.lang-switcher a.active { font-weight: 700; text-decoration: underline; opacity: 1; }\n</style></head><body><h1>AIT Debug Dashboard</h1>__LANG_SWITCHER__<p class=\"updated\" id=\"updated\">Last updated: __NOW__</p><section><h2>Tunnel status</h2><span class=\"status __TUNNEL_CLASS__\" id=\"tunnel-status\">__TUNNEL_STATUS__</span></section><hr/><section><h2>Attach QR</h2><div id=\"attach-section\">__ATTACH_SECTION__</div></section>__PAGES_SECTION__</body></html>`;\n\nexport const attachChromeHtmlEn =\n`<!DOCTYPE html>\n<html lang=\"en\"><head><meta charSet=\"utf-8\"/><meta name=\"viewport\" content=\"width=device-width, initial-scale=1\"/><link rel=\"preload\" as=\"image\" href=\"__QR_DATA_URL__\"/><title>AIT Debug Session — QR Scan</title><style>\n*, *::before, *::after { box-sizing: border-box; }\nbody {\n  font-family: -apple-system, BlinkMacSystemFont, \"Segoe UI\", sans-serif;\n  background: #0d1117; color: #c9d1d9;\n  display: flex; flex-direction: column; align-items: center;\n  min-height: 100vh; margin: 0; padding: 2rem 1rem;\n  gap: 1.5rem;\n}\nh1 { font-size: 1.25rem; font-weight: 600; color: #e6edf3; margin: 0; text-align: center; }\n.label { font-size: 0.8rem; opacity: 0.5; font-family: monospace; margin: 0; }\nimg.qr {\n  width: min(90vw, 360px); height: auto;\n  image-rendering: pixelated;\n  background: #fff; padding: 1rem; border-radius: 12px;\n  display: block; margin: 0 auto;\n}\nsection { width: 100%; max-width: 480px; }\nh2 { font-size: 1rem; font-weight: 600; color: #e6edf3; margin: 0 0 0.5rem; }\nol, ul { margin: 0; padding-left: 1.25rem; }\nli { margin-bottom: 0.4rem; font-size: 0.9rem; line-height: 1.5; }\n.url-box {\n  font-family: monospace; font-size: 0.72rem;\n  word-break: break-all; opacity: 0.4;\n  background: #161b22; padding: 0.75rem 1rem;\n  border-radius: 6px; border: 1px solid #30363d;\n}\nhr { border: none; border-top: 1px solid #21262d; width: 100%; margin: 0.5rem 0; }\n.lang-switcher { display: flex; gap: 0.5rem; font-size: 0.75rem; }\n.lang-switcher a { color: #58a6ff; text-decoration: none; opacity: 0.6; }\n.lang-switcher a.active { font-weight: 700; text-decoration: underline; opacity: 1; }\n</style></head><body><h1>AIT Debug Session — QR Scan</h1>__LANG_SWITCHER__<p class=\"label\">deployment: __SAFE_LABEL__</p><div id=\"attach-section\"><img class=\"qr\" src=\"__QR_DATA_URL__\" alt=\"attach QR\"/></div><section><h2>How to scan</h2><ol><li>Open the Toss app.</li><li>Scan the QR code with your phone camera app.</li><li>Tap <strong>\"Open in Toss\"</strong> when the popup appears.</li><li>The mini-app opens and the debug session attaches automatically.</li></ol></section><hr/><section><h2>Troubleshooting checklist</h2><ul><li><strong>Toss app does not open</strong> — check app version; scan with the system camera app (not the Toss in-app QR reader)</li><li><strong>Mini-app stuck in PREPARE state</strong> — verify the deep-link has a <code>_deploymentId</code> parameter</li><li><strong>Chii injection failure / console is empty</strong> — verify the mini-app bundle has an <code>in-app</code> debug import</li><li><strong>TOTP gate Layer C is inactive</strong> — check that <code>AIT_DEBUG_TOTP_SECRET</code> is set on the relay server</li></ul></section><hr/><section><h2>URL (fallback)</h2><p class=\"url-box\">__SAFE_ATTACH_URL__</p></section></body></html>`;\n\n/** Map from Locale to the precompiled dashboard chrome string. */\nexport const dashboardChromeByLocale: Record<Locale, string> = {\n  ko: dashboardChromeHtmlKo,\n  en: dashboardChromeHtmlEn,\n};\n\n/** Map from Locale to the precompiled attach page chrome string. */\nexport const attachChromeByLocale: Record<Locale, string> = {\n  ko: attachChromeHtmlKo,\n  en: attachChromeHtmlEn,\n};\n","/**\n * 로컬 HTTP 서버 — QR 페이지를 `http://127.0.0.1:<port>` 에서 서빙한다.\n *\n * file:// origin 대신 HTTP origin을 쓰는 이유: 브라우저 보안 정책상 file://에서\n * 로드된 페이지는 외부 fetch/script가 전부 차단되며, file:// 절대 경로를 <img src>에\n * 넣으면 브라우저에 따라 빈 화면이 된다. 127.0.0.1 HTTP는 modern 브라우저가 fully trust.\n *\n * INSTALL-GRAPH INVARIANT:\n *   이 모듈은 react/react-dom을 절대 import하지 않는다. dashboard/attach HTML은\n *   scripts/build-dashboard-html.ts가 빌드 타임에 precompile해 dashboard.generated.ts\n *   (plain string exports)로 커밋한다. 이 모듈은 그 생성된 string만 import한다.\n *   check-mcp-react-free.sh 가드가 dist/mcp/cli.js·server.js의 react 유입을 기계적으로 검증.\n *\n * HTML 조립 전략 (token-fill vs runtime builder):\n *   - static chrome (head/style/섹션 레이블) → 빌드타임 precompile, dashboard.generated.ts\n *   - 동적 부분 → 런타임 string 조립:\n *       __NOW__             : per-request ISO timestamp\n *       __TUNNEL_CLASS__    : \"status-up\" | \"status-down\"\n *       __TUNNEL_STATUS__   : 로컬라이즈된 tunnel 상태 레이블\n *       __ATTACH_SECTION__  : QR img+url-box, 또는 hint 텍스트\n *       __PAGES_SECTION__   : pages <section> 블록, 또는 빈 문자열 (null → '')\n *   - inline SSE <script> → 런타임 suffix로 append (localised string 포함)\n *\n * i18n:\n *   GET / 와 GET /attach 라우트에서 req.headers['accept-language']를 읽어\n *   parseAcceptLanguage()로 locale 결정. resolveLocaleStrings()로 동적 부분의\n *   localised 문자열을 해결. navigator 없음, React hook 없음 (Node 표면).\n *\n * SECRET-HANDLING:\n *   - 127.0.0.1 바인딩만 — 외부 노출 0.\n *   - attachUrl은 HTML 본문과 /qr.png query에만 들어간다 (의도된 전달 경로).\n *   - wssUrl은 dashboard HTML에 절대 들어가지 않는다. tunnel.up boolean만 사용.\n *   - stdout/stderr/로그에 별도 출력하지 않는다.\n *   - tmp 파일 만들지 않음 — 모든 응답을 메모리에서 생성.\n *   - TOTP at= 코드는 attachUrl 캡슐 안에서만 노출 — SSE payload나 page 목록 등\n *     다른 필드에 TOTP 코드를 평문으로 싣지 않는다.\n */\n\nimport type { IncomingMessage, Server, ServerResponse } from 'node:http';\nimport { createServer } from 'node:http';\nimport { parseAcceptLanguage, resolveLocaleStrings } from '../i18n/index.js';\nimport { attachChromeByLocale, dashboardChromeByLocale } from './dashboard.generated.js';\n\n/** dashboard에 노출되는 현재 상태 스냅샷. */\nexport interface DashboardState {\n  /** 현재 터널 상태 — up/down + wssUrl. SECRET: wssUrl은 로그 출력 금지. */\n  tunnel: { up: boolean; wssUrl: string | null };\n  /**\n   * 현재 연결된 page 목록 (id/url만).\n   *\n   * - `Array<…>` — env 3/4(MCP): relay에 attach된 페이지를 라이브 조회한 목록.\n   *   빈 배열 `[]`은 \"attach된 페이지 없음\"으로 정직하게 표시한다.\n   * - `null` — env 2(unplugin 터널): 플러그인 핸들이 connected target을 노출하지\n   *   않아 라이브 page 목록을 알 수 없다. 거짓 빈 목록을 보여주느니 \"연결된 Pages\"\n   *   섹션 자체를 숨긴다(#411). 정적 렌더와 SSE 갱신 양쪽에서 섹션이 사라진다.\n   */\n  pages: Array<{ id: string; url: string }> | null;\n  /** 마지막으로 생성된 attachUrl (없으면 null). TOTP at= 코드는 이 안에 캡슐화. */\n  attachUrl: string | null;\n}\n\nexport interface QrHttpServer {\n  port: number;\n  /** `http://127.0.0.1:<port>/attach?u=<encoded>` URL 생성 헬퍼. */\n  buildAttachPageUrl(attachUrl: string): string;\n  /**\n   * 상태 변경 시 호출 — SSE 구독자에게 최신 상태를 push한다.\n   * `getDashboardState`가 주입돼 있지 않으면 no-op.\n   */\n  notifyStateChange(): void;\n  close(): Promise<void>;\n}\n\n/** HTML 특수문자를 이스케이프한다. */\nfunction escapeHtml(s: string): string {\n  return s.replace(/[<>&\"']/g, (c) => `&#${c.charCodeAt(0)};`);\n}\n\n/**\n * 현재 path+query에서 lang 파라미터만 교체한 ko/en 토글 링크를 생성한다.\n *\n * SECRET-HANDLING: u= (attachUrl, TOTP at= 캡슐 포함) 등 기존 query를 보존한다.\n * lang= 만 덮어쓴다. 링크 href에 at= 코드가 들어가는 건 의도된 전달 경로.\n */\nfunction buildLangSwitcher(\n  path: string,\n  existingParams: URLSearchParams,\n  locale: 'ko' | 'en',\n  s: ReturnType<typeof resolveLocaleStrings>,\n): string {\n  function switcherHref(targetLang: 'ko' | 'en'): string {\n    const p = new URLSearchParams(existingParams);\n    p.set('lang', targetLang);\n    return `${escapeHtml(path)}?${p.toString()}`;\n  }\n  const koLabel = escapeHtml(s('dashboard.lang.ko'));\n  const enLabel = escapeHtml(s('dashboard.lang.en'));\n  const koClass = locale === 'ko' ? 'active' : '';\n  const enClass = locale === 'en' ? 'active' : '';\n  return `<div class=\"lang-switcher\"><a href=\"${switcherHref('ko')}\" class=\"${koClass}\">${koLabel}</a><a href=\"${switcherHref('en')}\" class=\"${enClass}\">${enLabel}</a></div>`;\n}\n\n/**\n * Dashboard HTML — precompiled chrome에 per-request 동적 값을 채워 완성한다.\n *\n * 토큰 채우기 순서:\n *   1. chrome string(locale별 precompile)을 가져온다.\n *   2. 동적 부분을 단순 replaceAll로 채운다 (토큰이 HTML context 밖에 있으므로 안전).\n *   3. inline SSE <script>를 </body> 직전에 주입한다.\n *\n * 동적 파트 분류:\n *   - \"token-fill\": 단일 값 교체 (__NOW__, __TUNNEL_CLASS__, __TUNNEL_STATUS__,\n *     __ATTACH_SECTION__)\n *   - \"runtime builder\": 가변 길이 구조 (__PAGES_SECTION__ — 조건부 렌더 + 가변 rows)\n *   - \"suffix\": inline SSE <script> (빌드 파이프라인 없는 클라이언트 스크립트, locale\n *     aware 문자열 포함)\n *\n * SECRET-HANDLING:\n *   - attachUrl은 url-box 안에서만 노출 (TOTP at= 코드 캡슐 그대로).\n *   - tunnel wssUrl은 \"터널 연결됨\" 상태 표시에서 UP/DOWN만 노출.\n *     wssUrl 값 자체는 dashboard HTML에 넣지 않는다.\n */\nfunction buildDashboardHtml(\n  state: DashboardState,\n  qrDataUrl: string | null,\n  locale: 'ko' | 'en',\n  path = '/',\n  params = new URLSearchParams(),\n): string {\n  const s = resolveLocaleStrings(locale);\n  const now = new Date().toISOString();\n\n  const tunnelStatus = state.tunnel.up ? s('dashboard.tunnel.up') : s('dashboard.tunnel.down');\n  const tunnelClass = state.tunnel.up ? 'status-up' : 'status-down';\n\n  // attachSection: QR img + url-box, or hint\n  let attachSection: string;\n  if (qrDataUrl && state.attachUrl) {\n    const safeAttachUrl = escapeHtml(state.attachUrl);\n    attachSection = `<img class=\"qr\" src=\"${qrDataUrl}\" alt=\"attach QR\" /><p class=\"url-box\">${safeAttachUrl}</p>`;\n  } else {\n    attachSection = `<p class=\"hint\">${escapeHtml(s('dashboard.attach.hint'))}</p>`;\n  }\n\n  // pagesSection — \"연결된 Pages\" 섹션: env 3/4(pages: Array)에서만 렌더한다.\n  // env 2(pages: null)는 라이브 page 목록을 알 수 없어 섹션 자체를 숨긴다(#411).\n  // runtime builder: 조건부 블록 + 가변 row 목록이라 token-fill로는 불충분.\n  const pagesSection =\n    state.pages === null\n      ? ''\n      : `<hr /><section id=\"pages-section\"><h2>${escapeHtml(s('dashboard.pages.section'))}</h2><ul id=\"pages-list\">${\n          state.pages.length > 0\n            ? state.pages\n                .map((p) => {\n                  const safeId = escapeHtml(p.id);\n                  const safeUrl = escapeHtml(p.url.slice(0, 120));\n                  return `<li><span class=\"page-id\">${safeId}</span> <span class=\"page-url\">${safeUrl}</span></li>`;\n                })\n                .join('\\n')\n            : `<li class=\"empty\">${escapeHtml(s('dashboard.pages.empty'))}</li>`\n        }</ul></section>`;\n\n  // locale-aware strings for the inline SSE client script\n  const sseStrings = {\n    tunnelUp: JSON.stringify(s('dashboard.tunnel.up')),\n    tunnelDown: JSON.stringify(s('dashboard.tunnel.down')),\n    pagesEmpty: JSON.stringify(s('dashboard.pages.empty')),\n    attachHint: JSON.stringify(s('dashboard.attach.hint')),\n  };\n\n  const langSwitcher = buildLangSwitcher(path, params, locale, s);\n\n  // Fill token placeholders in the precompiled chrome.\n  // replaceAll is safe because these __TOKEN__ strings cannot appear in\n  // any legitimate user-facing value (they are sentinel strings).\n  const chrome = dashboardChromeByLocale[locale];\n  const filled = chrome\n    .replaceAll('__LANG_SWITCHER__', langSwitcher)\n    .replaceAll('__NOW__', escapeHtml(now))\n    .replaceAll('__TUNNEL_CLASS__', tunnelClass)\n    .replaceAll('__TUNNEL_STATUS__', escapeHtml(tunnelStatus))\n    .replaceAll('__ATTACH_SECTION__', attachSection)\n    .replaceAll('__PAGES_SECTION__', pagesSection);\n\n  // Append the inline SSE <script> suffix directly before </body>.\n  // This keeps the client script out of the precompiled chrome (it references\n  // locale-aware strings resolved per-request) while staying self-contained.\n  const sseScript = buildSseScript(sseStrings);\n  return filled.replace('</body>', `${sseScript}\\n</body>`);\n}\n\ninterface SseScriptStrings {\n  tunnelUp: string;\n  tunnelDown: string;\n  pagesEmpty: string;\n  attachHint: string;\n}\n\n/**\n * Inline SSE client <script> — injected into the dashboard HTML at runtime.\n *\n * Subscribes to /events and updates the DOM without a build pipeline.\n * client side: attachUrl은 DOM에 렌더링, wssUrl은 절대 렌더링하지 않는다.\n * pages === null 이면 섹션을 건드리지 않는다 (#411).\n *\n * 문자열 인자는 빌드타임에 ko/en 테이블에서 가져와 JSON.stringify로 이미 escape됨.\n */\nfunction buildSseScript(strings: SseScriptStrings): string {\n  return `<script>\n    // SSE — /events 구독해 상태 자동 갱신. 빌드 파이프라인 없는 인라인 스크립트.\n    (function () {\n      var TUNNEL_UP = ${strings.tunnelUp};\n      var TUNNEL_DOWN = ${strings.tunnelDown};\n      var PAGES_EMPTY = ${strings.pagesEmpty};\n      var ATTACH_HINT = ${strings.attachHint};\n      var src = new EventSource('/events');\n      src.onmessage = function (e) {\n        try {\n          var s = JSON.parse(e.data);\n          // 터널 상태 갱신\n          var el = document.getElementById('tunnel-status');\n          if (el) {\n            el.textContent = s.tunnel && s.tunnel.up ? TUNNEL_UP : TUNNEL_DOWN;\n            el.className = 'status ' + (s.tunnel && s.tunnel.up ? 'status-up' : 'status-down');\n          }\n          // page 목록 갱신 — pages === null(env 2)이면 섹션 자체를 숨긴 채 둔다.\n          // 정적 렌더가 #pages-section을 아예 안 그렸으므로 여기서도 손대지 않아\n          // SSE push 때 섹션이 되살아나지 않는다(#411). 배열일 때만 목록을 채운다.\n          if (s.pages !== null && s.pages !== undefined) {\n            var ul = document.getElementById('pages-list');\n            if (ul) {\n              if (s.pages.length === 0) {\n                ul.innerHTML = '<li class=\"empty\">' + PAGES_EMPTY + '</li>';\n              } else {\n                ul.innerHTML = s.pages.map(function (p) {\n                  var sid = String(p.id || '').slice(0, 36).replace(/[<>&\"']/g, function (c) { return '&#' + c.charCodeAt(0) + ';'; });\n                  var su = String(p.url || '').slice(0, 120).replace(/[<>&\"']/g, function (c) { return '&#' + c.charCodeAt(0) + ';'; });\n                  return '<li><span class=\"page-id\">' + sid + '</span> <span class=\"page-url\">' + su + '</span></li>';\n                }).join('');\n              }\n            }\n          }\n          // attachUrl QR 갱신 — attachUrl이 없으면 hint 표시.\n          var sec = document.getElementById('attach-section');\n          if (sec) {\n            if (s.attachUrl) {\n              // QR은 서버에서 새로 렌더한 /qr.png?u= 로 img src 교체.\n              // TOTP at= 코드는 attachUrl 안에 캡슐화 — 별도 노출 없음.\n              // wssUrl은 절대 DOM에 렌더하지 않는다 (SECRET-HANDLING).\n              var encoded = encodeURIComponent(s.attachUrl);\n              var safeUrl = String(s.attachUrl).slice(0, 2000).replace(/[<>&\"']/g, function (c) { return '&#' + c.charCodeAt(0) + ';'; });\n              sec.innerHTML =\n                '<img class=\"qr\" src=\"/qr.png?u=' + encoded + '\" alt=\"attach QR\" />' +\n                '<p class=\"url-box\">' + safeUrl + '</p>';\n            } else {\n              sec.innerHTML = '<p class=\"hint\">' + ATTACH_HINT + '</p>';\n            }\n          }\n          // 갱신 시각\n          var upd = document.getElementById('updated');\n          if (upd) upd.textContent = upd.textContent.replace(/[^ ]+$/, new Date().toISOString());\n        } catch (_) { /* 파싱 오류 무시 */ }\n      };\n      src.onerror = function () {\n        // 재연결은 EventSource가 자동 처리 (spec 기본 동작).\n      };\n    })();\n  </script>`;\n}\n\n/**\n * Attach 페이지 HTML — precompiled chrome에 per-request 동적 값을 채워 완성한다.\n *\n * 동적 파트:\n *   - __QR_DATA_URL__     : base64 data URL (QR 이미지)\n *   - __SAFE_LABEL__      : HTML-escaped deploymentId label\n *   - __SAFE_ATTACH_URL__ : HTML-escaped attach URL (TOTP at= 코드 포함 — 의도된 전달)\n *\n * SSE 스크립트도 주입 — `#attach-section` hook이 있으면 `/events` push 때 QR이\n * `/qr.png?u=<fresh attachUrl>`로 자동 갱신된다. `#tunnel-status`·`#pages-list` 등\n * 나머지 selector는 /attach 페이지에 없으므로 null-guard로 no-op.\n *\n * SECRET-HANDLING: TOTP at= 코드는 attachUrl 캡슐 안에서만 노출 — 의도된 transport.\n */\nfunction buildAttachHtml(\n  qrDataUrl: string,\n  safeLabel: string,\n  safeAttachUrl: string,\n  locale: 'ko' | 'en',\n  path = '/attach',\n  params = new URLSearchParams(),\n): string {\n  const s = resolveLocaleStrings(locale);\n  const langSwitcher = buildLangSwitcher(path, params, locale, s);\n  const chrome = attachChromeByLocale[locale];\n  const filled = chrome\n    .replaceAll('__LANG_SWITCHER__', langSwitcher)\n    .replaceAll('__QR_DATA_URL__', qrDataUrl)\n    .replaceAll('__SAFE_LABEL__', safeLabel)\n    .replaceAll('__SAFE_ATTACH_URL__', safeAttachUrl);\n\n  // Inject SSE script so QR auto-refreshes on each /events push.\n  // `#attach-section` is the only selector present on /attach — other selectors\n  // (#tunnel-status, #pages-list, #updated) are null-guarded and are no-ops here.\n  const sseStrings = {\n    tunnelUp: JSON.stringify(s('dashboard.tunnel.up')),\n    tunnelDown: JSON.stringify(s('dashboard.tunnel.down')),\n    pagesEmpty: JSON.stringify(s('dashboard.pages.empty')),\n    attachHint: JSON.stringify(s('dashboard.attach.hint')),\n  };\n  const sseScript = buildSseScript(sseStrings);\n  return filled.replace('</body>', `${sseScript}\\n</body>`);\n}\n\n/**\n * 로컬 HTTP 서버를 127.0.0.1 random port(또는 `AIT_DEBUG_HTTP_PORT` env)로 시작한다.\n * MCP debug server 생애주기에 묶어 사용 — `runDebugServer` shutdown 시 `close()`로 정리.\n *\n * @param getDashboardState - dashboard 상태를 반환하는 클로저. 주입 시 `GET /` dashboard와\n *   `GET /events` SSE 스트림이 활성화된다. 미주입 시 두 라우트는 204/서비스 없음으로 응답.\n */\nexport async function startQrHttpServer(\n  getDashboardState?: () => DashboardState,\n): Promise<QrHttpServer> {\n  const { default: QRCode } = await import('qrcode');\n\n  /** SSE 활성 연결 목록 — `notifyStateChange()` 시 전체 push. */\n  const sseClients: ServerResponse[] = [];\n\n  /** SSE 연결 하나에 상태 이벤트를 flush한다. */\n  function pushStateToClient(res: ServerResponse, state: DashboardState): void {\n    const payload = JSON.stringify({\n      tunnel: { up: state.tunnel.up, wssUrl: state.tunnel.wssUrl },\n      pages: state.pages,\n      // attachUrl은 캡슐 그대로 전달 — TOTP at= 코드 분리 없음 (의도된 설계).\n      attachUrl: state.attachUrl,\n    });\n    // SSE frame: \"data: <json>\\n\\n\"\n    res.write(`data: ${payload}\\n\\n`);\n  }\n\n  const server: Server = createServer(async (req: IncomingMessage, res: ServerResponse) => {\n    const rawUrl = req.url ?? '/';\n    const [path, query = ''] = rawUrl.split('?', 2) as [string, string | undefined];\n    const params = new URLSearchParams(query ?? '');\n\n    // per-request locale — ?lang= query param이 있으면 우선 적용, 없으면 Accept-Language header에서 결정.\n    const langParam = params.get('lang');\n    const locale =\n      langParam === 'ko' || langParam === 'en'\n        ? langParam\n        : parseAcceptLanguage(req.headers['accept-language']);\n\n    // ── GET / — dashboard 루트 ─────────────────────────────────────────────\n    if (path === '/') {\n      if (!getDashboardState) {\n        res.writeHead(204, { 'Content-Type': 'text/plain; charset=utf-8' });\n        res.end();\n        return;\n      }\n      const state = getDashboardState();\n      let qrDataUrl: string | null = null;\n      if (state.attachUrl) {\n        try {\n          qrDataUrl = await QRCode.toDataURL(state.attachUrl, {\n            type: 'image/png',\n            errorCorrectionLevel: 'M',\n          });\n        } catch {\n          // QR 생성 실패 시 null 유지 — dashboard는 텍스트 fallback 표시\n        }\n      }\n      const html = buildDashboardHtml(state, qrDataUrl, locale, path, params);\n      res.writeHead(200, {\n        'Content-Type': 'text/html; charset=utf-8',\n        'Cache-Control': 'no-store',\n      });\n      res.end(html);\n      return;\n    }\n\n    // ── GET /events — SSE 스트림 ──────────────────────────────────────────\n    if (path === '/events') {\n      if (!getDashboardState) {\n        res.writeHead(204, { 'Content-Type': 'text/plain; charset=utf-8' });\n        res.end();\n        return;\n      }\n      res.writeHead(200, {\n        'Content-Type': 'text/event-stream',\n        'Cache-Control': 'no-cache',\n        Connection: 'keep-alive',\n        'X-Accel-Buffering': 'no',\n      });\n      // 즉시 현재 상태를 한 번 push — 페이지 로드 시 최신 상태 보장.\n      const initialState = getDashboardState();\n      pushStateToClient(res, initialState);\n\n      sseClients.push(res);\n\n      // 연결 끊기면 목록에서 제거.\n      req.once('close', () => {\n        const idx = sseClients.indexOf(res);\n        if (idx !== -1) sseClients.splice(idx, 1);\n      });\n      return;\n    }\n\n    if (path === '/attach') {\n      const encodedU = params.get('u') ?? '';\n      let attachUrl: string;\n      try {\n        attachUrl = decodeURIComponent(encodedU);\n      } catch {\n        res.writeHead(400, { 'Content-Type': 'text/plain; charset=utf-8' });\n        res.end('잘못된 u 파라미터입니다.');\n        return;\n      }\n\n      // deploymentId 라벨 — attachUrl에서 _deploymentId 파라미터만 추출 (at= 노출 방지).\n      let deploymentIdLabel = 'attach';\n      try {\n        const dpMatch = attachUrl.match(/[?&]_deploymentId=([^&]+)/);\n        if (dpMatch?.[1]) {\n          deploymentIdLabel = decodeURIComponent(dpMatch[1]).slice(0, 36);\n        }\n      } catch {\n        // best-effort\n      }\n\n      // QR을 base64 data URL로 인라인 생성 — 외부 fetch 없이 self-contained HTML.\n      QRCode.toDataURL(attachUrl, { type: 'image/png', errorCorrectionLevel: 'M' })\n        .then((dataUrl: string) => {\n          const safeLabel = escapeHtml(deploymentIdLabel);\n          const safeAttachUrl = escapeHtml(attachUrl);\n          const html = buildAttachHtml(dataUrl, safeLabel, safeAttachUrl, locale, path, params);\n          res.writeHead(200, {\n            'Content-Type': 'text/html; charset=utf-8',\n            'Cache-Control': 'no-store',\n          });\n          res.end(html);\n        })\n        .catch(() => {\n          res.writeHead(500, { 'Content-Type': 'text/plain; charset=utf-8' });\n          res.end('QR 생성에 실패했습니다.');\n        });\n      return;\n    }\n\n    if (path === '/qr.png') {\n      const encodedU = params.get('u') ?? '';\n      let attachUrl: string;\n      try {\n        attachUrl = decodeURIComponent(encodedU);\n      } catch {\n        res.writeHead(400, { 'Content-Type': 'text/plain; charset=utf-8' });\n        res.end('잘못된 u 파라미터입니다.');\n        return;\n      }\n\n      QRCode.toBuffer(attachUrl, { type: 'png', errorCorrectionLevel: 'M' })\n        .then((buf: Buffer) => {\n          res.writeHead(200, {\n            'Content-Type': 'image/png',\n            'Cache-Control': 'no-store',\n            'Content-Length': String(buf.length),\n          });\n          res.end(buf);\n        })\n        .catch(() => {\n          res.writeHead(500, { 'Content-Type': 'text/plain; charset=utf-8' });\n          res.end('QR PNG 생성에 실패했습니다.');\n        });\n      return;\n    }\n\n    res.writeHead(404, { 'Content-Type': 'text/plain; charset=utf-8' });\n    res.end('Not Found');\n  });\n\n  const listenPort = Number(process.env.AIT_DEBUG_HTTP_PORT ?? 0);\n\n  await new Promise<void>((resolve, reject) => {\n    server.listen(listenPort, '127.0.0.1', () => resolve());\n    server.once('error', reject);\n  });\n\n  const address = server.address();\n  if (!address || typeof address === 'string') {\n    throw new Error('qr-http-server: server.address()가 예상하지 못한 형태입니다.');\n  }\n  const port = address.port;\n\n  return {\n    port,\n    buildAttachPageUrl(attachUrl: string): string {\n      return `http://127.0.0.1:${port}/attach?u=${encodeURIComponent(attachUrl)}`;\n    },\n    notifyStateChange(): void {\n      if (!getDashboardState) return;\n      const state = getDashboardState();\n      for (const client of sseClients) {\n        try {\n          pushStateToClient(client, state);\n        } catch {\n          // 연결이 이미 끊어진 경우 — 무시 (close 핸들러가 목록에서 제거함).\n        }\n      }\n    },\n    close(): Promise<void> {\n      return new Promise((resolve, reject) => {\n        server.close((err) => (err ? reject(err) : resolve()));\n      });\n    },\n  };\n}\n"],"mappings":";;AAMA,MAAa,KAAgC;CAE3C,eAAe;CACf,sBAAsB;CACtB,eAAe;CACf,qBAAqB;CACrB,sBAAsB;CACtB,8BAA8B;CAC9B,kBAAkB;CAGlB,iBAAiB;CACjB,qBAAqB;CACrB,sBAAsB;CACtB,yBAAyB;CACzB,2BAA2B;CAC3B,sBAAsB;CACtB,oBAAoB;CACpB,iBAAiB;CACjB,iBAAiB;CACjB,oBAAoB;CACpB,uBAAuB;CACvB,qBAAqB;CAGrB,mBAAmB;CAGnB,uBAAuB;CACvB,sBACE;CACF,2BAA2B;CAC3B,wBAAwB;CACxB,sBAAsB;CAGtB,wBAAwB;CACxB,cAAc;CACd,sBAAsB;CACtB,uBAAuB;CACvB,kBAAkB;CAClB,uBAAuB;CACvB,yBAAyB;CACzB,wBAAwB;CACxB,wBAAwB;CACxB,2BAA2B;CAC3B,0BAA0B;CAC1B,2BAA2B;CAC3B,mCAAmC;CACnC,qCAAqC;CACrC,sCAAsC;CACtC,4BACE;CAGF,yBAAyB;CAEzB,uBAAuB;CACvB,sBAAsB;CACtB,uBAAuB;CACvB,0BAA0B;CAC1B,2BAA2B;CAC3B,wBAAwB;CAExB,qBAAqB;CACrB,oBAAoB;CACpB,qBAAqB;CACrB,wBAAwB;CACxB,yBAAyB;CACzB,6BAA6B;CAC7B,8BAA8B;CAC9B,iCAAiC;CACjC,2BAA2B;CAC3B,0BAA0B;CAC1B,yBAAyB;CACzB,mCAAmC;CACnC,8BAA8B;CAC9B,6BAA6B;CAG7B,wBAAwB;CACxB,oBAAoB;CACpB,mBAAmB;CACnB,mBAAmB;CAGnB,8BAA8B;CAG9B,4BAA4B;CAC5B,yBAAyB;CACzB,0BAA0B;CAC1B,yBAAyB;CAGzB,wBAAwB;CACxB,qBAAqB;CACrB,qBAAqB;CACrB,uBAAuB;CACvB,sBAAsB;CACtB,wBAAwB;CACxB,6BAA6B;CAC7B,kBAAkB;CAClB,0BAA0B;CAC1B,oBAAoB;CACpB,8BAA8B;CAC9B,8BAA8B;CAC9B,gCAAgC;CAChC,sCAAsC;CACtC,+BAA+B;CAC/B,2BAA2B;CAC3B,2BAA2B;CAC3B,sBAAsB;CACtB,wBAAwB;CAGxB,yBAAyB;CACzB,0BAA0B;CAC1B,yBAAyB;CACzB,yBAAyB;CAGzB,2BAA2B;CAC3B,uBAAuB;CACvB,4BAA4B;CAC5B,0BAA0B;CAC1B,2BAA2B;CAC3B,sBAAsB;CACtB,uBAAuB;CACvB,+BAA+B;CAC/B,0BAA0B;CAC1B,8BAA8B;CAC9B,2BAA2B;CAC3B,gCAAgC;CAChC,+BAA+B;CAC/B,4BAA4B;CAC5B,6BAA6B;CAC7B,kCAAkC;CAClC,mCAAmC;CAGnC,yBAAyB;CACzB,sBAAsB;CACtB,uBAAuB;CACvB,yBAAyB;CACzB,uBAAuB;CACvB,qBAAqB;CACrB,yBAAyB;CACzB,uBAAuB;CACvB,oBAAoB;CACpB,qBAAqB;CAGrB,6BAA6B;CAC7B,0BAA0B;CAC1B,0BAA0B;CAC1B,wBAAwB;CACxB,uBAAuB;CACvB,kCAAkC;CAGlC,yBAAyB;CACzB,uBAAuB;CACvB,2BAA2B;CAC3B,6BAA6B;CAC7B,yBAAyB;CAGzB,yBAAyB;CACzB,wBAAwB;CACxB,iBAAiB;CAGjB,2BAA2B;CAC3B,yBAAyB;CACzB,wBAAwB;CACxB,4BAA4B;CAC5B,2BAA2B;CAC3B,qBAAqB;CACrB,uBAAuB;CACvB,sBAAsB;CACtB,uBAAuB;CACvB,yBAAyB;CACzB,wBAAwB;CACxB,0BAA0B;CAG1B,qBAAqB;CACrB,oBAAoB;CACpB,uBAAuB;CACvB,oBAAoB;CACpB,2BAA2B;CAC3B,uBAAuB;CACvB,4BAA4B;CAC5B,gBAAgB;CAChB,gBAAgB;CAChB,6BAA6B;CAC7B,0BAA0B;CAC1B,wBAAwB;CACxB,kBAAkB;CAClB,kBAAkB;CAClB,iBAAiB;CACjB,mBAAmB;CAGnB,+BAA+B;CAC/B,qCAAqC;CACrC,sCAAsC;CACtC,0CAA0C;CAG1C,qBAAqB;CACrB,qBAAqB;CAGrB,mBAAmB;CACnB,qBAAqB;CACrB,4BAA4B;CAC5B,uBAAuB;CACvB,yBAAyB;CACzB,4BAA4B;CAC5B,yBAAyB;CACzB,2BAA2B;CAC3B,yBAAyB;CAGzB,gBAAgB;CAChB,qBAAqB;CACrB,wBAAwB;CACxB,gBAAgB;CAChB,gBAAgB;CAChB,gBAAgB;CAChB,gBAAgB;CAChB,sBAAsB;CACtB,yBACE;CACF,sBACE;CACF,mBACE;CACF,mBACE;CACF,sBAAsB;CAGtB,kBAAkB;CAClB,wBAAwB;CACxB,uBAAuB;CACvB,2BAA2B;CAC3B,oBAAoB;CACpB,oBAAoB;CACpB,sBAAsB;CACtB,qBAAqB;CACrB,wBAAwB;CACxB,4BAA4B;CAC5B,uBAAuB;CACvB,4BAA4B;CAC5B,gCAAgC;CAChC,+BAA+B;CAChC;;;;;;;;;;;;;;;;;;AEjPD,MAAM,SAA6D;CAAE,IDhBnD;EAEhB,eAAe;EACf,sBAAsB;EACtB,eAAe;EACf,qBAAqB;EACrB,sBAAsB;EACtB,8BAA8B;EAC9B,kBAAkB;EAGlB,iBAAiB;EACjB,qBAAqB;EACrB,sBAAsB;EACtB,yBAAyB;EACzB,2BAA2B;EAC3B,sBAAsB;EACtB,oBAAoB;EACpB,iBAAiB;EACjB,iBAAiB;EACjB,oBAAoB;EACpB,uBAAuB;EACvB,qBAAqB;EAGrB,mBAAmB;EAGnB,uBAAuB;EACvB,sBAAsB;EACtB,2BAA2B;EAC3B,wBAAwB;EACxB,sBAAsB;EAGtB,wBAAwB;EACxB,cAAc;EACd,sBAAsB;EACtB,uBAAuB;EACvB,kBAAkB;EAClB,uBAAuB;EACvB,yBAAyB;EACzB,wBAAwB;EACxB,wBAAwB;EACxB,2BAA2B;EAC3B,0BAA0B;EAC1B,2BAA2B;EAC3B,mCAAmC;EACnC,qCAAqC;EACrC,sCAAsC;EACtC,4BACE;EAGF,yBAAyB;EAEzB,uBAAuB;EACvB,sBAAsB;EACtB,uBAAuB;EACvB,0BAA0B;EAC1B,2BAA2B;EAC3B,wBAAwB;EAExB,qBAAqB;EACrB,oBAAoB;EACpB,qBAAqB;EACrB,wBAAwB;EACxB,yBAAyB;EACzB,6BAA6B;EAC7B,8BAA8B;EAC9B,iCAAiC;EACjC,2BAA2B;EAC3B,0BAA0B;EAC1B,yBAAyB;EACzB,mCAAmC;EACnC,8BAA8B;EAC9B,6BAA6B;EAG7B,wBAAwB;EACxB,oBAAoB;EACpB,mBAAmB;EACnB,mBAAmB;EAGnB,8BAA8B;EAG9B,4BAA4B;EAC5B,yBAAyB;EACzB,0BAA0B;EAC1B,yBAAyB;EAGzB,wBAAwB;EACxB,qBAAqB;EACrB,qBAAqB;EACrB,uBAAuB;EACvB,sBAAsB;EACtB,wBAAwB;EACxB,6BAA6B;EAC7B,kBAAkB;EAClB,0BAA0B;EAC1B,oBAAoB;EACpB,8BAA8B;EAC9B,8BAA8B;EAC9B,gCAAgC;EAChC,sCAAsC;EACtC,+BAA+B;EAC/B,2BAA2B;EAC3B,2BAA2B;EAC3B,sBAAsB;EACtB,wBAAwB;EAGxB,yBAAyB;EACzB,0BAA0B;EAC1B,yBAAyB;EACzB,yBAAyB;EAGzB,2BAA2B;EAC3B,uBAAuB;EACvB,4BAA4B;EAC5B,0BAA0B;EAC1B,2BAA2B;EAC3B,sBAAsB;EACtB,uBAAuB;EACvB,+BAA+B;EAC/B,0BAA0B;EAC1B,8BAA8B;EAC9B,2BAA2B;EAC3B,gCAAgC;EAChC,+BAA+B;EAC/B,4BAA4B;EAC5B,6BAA6B;EAC7B,kCAAkC;EAClC,mCAAmC;EAGnC,yBAAyB;EACzB,sBAAsB;EACtB,uBAAuB;EACvB,yBAAyB;EACzB,uBAAuB;EACvB,qBAAqB;EACrB,yBAAyB;EACzB,uBAAuB;EACvB,oBAAoB;EACpB,qBAAqB;EAGrB,6BAA6B;EAC7B,0BAA0B;EAC1B,0BAA0B;EAC1B,wBAAwB;EACxB,uBAAuB;EACvB,kCAAkC;EAGlC,yBAAyB;EACzB,uBAAuB;EACvB,2BAA2B;EAC3B,6BAA6B;EAC7B,yBAAyB;EAGzB,yBAAyB;EACzB,wBAAwB;EACxB,iBAAiB;EAGjB,2BAA2B;EAC3B,yBAAyB;EACzB,wBAAwB;EACxB,4BACE;EACF,2BAA2B;EAC3B,qBAAqB;EACrB,uBAAuB;EACvB,sBAAsB;EACtB,uBAAuB;EACvB,yBAAyB;EACzB,wBAAwB;EACxB,0BAA0B;EAG1B,qBAAqB;EACrB,oBAAoB;EACpB,uBAAuB;EACvB,oBAAoB;EACpB,2BAA2B;EAC3B,uBAAuB;EACvB,4BAA4B;EAC5B,gBAAgB;EAChB,gBAAgB;EAChB,6BAA6B;EAC7B,0BAA0B;EAC1B,wBAAwB;EACxB,kBAAkB;EAClB,kBAAkB;EAClB,iBAAiB;EACjB,mBAAmB;EAGnB,+BAA+B;EAC/B,qCAAqC;EACrC,sCAAsC;EACtC,0CAA0C;EAG1C,qBAAqB;EACrB,qBAAqB;EAGrB,mBAAmB;EACnB,qBAAqB;EACrB,4BAA4B;EAC5B,uBAAuB;EACvB,yBAAyB;EACzB,4BAA4B;EAC5B,yBAAyB;EACzB,2BAA2B;EAC3B,yBAAyB;EAGzB,gBAAgB;EAChB,qBAAqB;EACrB,wBAAwB;EACxB,gBAAgB;EAChB,gBAAgB;EAChB,gBAAgB;EAChB,gBAAgB;EAChB,sBAAsB;EACtB,yBACE;EACF,sBACE;EACF,mBACE;EACF,mBACE;EACF,sBAAsB;EAGtB,kBAAkB;EAClB,wBAAwB;EACxB,uBAAuB;EACvB,2BAA2B;EAC3B,oBAAoB;EACpB,oBAAoB;EACpB,sBAAsB;EACtB,qBAAqB;EACrB,wBAAwB;EACxB,4BAA4B;EAC5B,uBAAuB;EACvB,4BAA4B;EAC5B,gCAAgC;EAChC,+BAA+B;EAChC;CCnPwE;CAAI;;;;;;AA6B7E,SAAS,sBAAsB,MAAsB;AACnD,QAAO,SAAS,KAAK,KAAK,GAAG,OAAO;;;;;;;;;;AAoBtC,SAAgB,oBAAoB,QAA2C;AAC7E,KAAI,CAAC,OAAQ,QAAO;AAEpB,QAAO,sBADO,OAAO,MAAM,IAAI,CAAC,IAAI,MAAM,CAAC,MAAM,IAAI,CAAC,IAAI,MAAM,IAAI,GACjC;;;;;;;;;;;AAYrC,SAAgB,qBACd,QACoE;CACpE,MAAM,QAAQ,OAAO;AACrB,SAAQ,KAAK,SAAS;EACpB,MAAM,MAAM,MAAM,QAAQ;AAC1B,MAAI,CAAC,KAAM,QAAO;AAClB,SAAO,IAAI,QAAQ,eAAe,OAAO,SAAiB;GACxD,MAAM,QAAQ,KAAK;AACnB,UAAO,UAAU,KAAA,IAAY,QAAQ,OAAO,MAAM;IAClD;;;;;ACnEN,MAAa,wBACb;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAyCA,MAAa,qBACb;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAoCA,MAAa,wBACb;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAyCA,MAAa,qBACb;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAmCA,MAAa,0BAAkD;CAC7D,IAAI;CACJ,IAAI;CACL;;AAGD,MAAa,uBAA+C;CAC1D,IAAI;CACJ,IAAI;CACL;;;;AC5HD,SAAS,WAAW,GAAmB;AACrC,QAAO,EAAE,QAAQ,aAAa,MAAM,KAAK,EAAE,WAAW,EAAE,CAAC,GAAG;;;;;;;;AAS9D,SAAS,kBACP,MACA,gBACA,QACA,GACQ;CACR,SAAS,aAAa,YAAiC;EACrD,MAAM,IAAI,IAAI,gBAAgB,eAAe;AAC7C,IAAE,IAAI,QAAQ,WAAW;AACzB,SAAO,GAAG,WAAW,KAAK,CAAC,GAAG,EAAE,UAAU;;CAE5C,MAAM,UAAU,WAAW,EAAE,oBAAoB,CAAC;CAClD,MAAM,UAAU,WAAW,EAAE,oBAAoB,CAAC;CAClD,MAAM,UAAU,WAAW,OAAO,WAAW;CAC7C,MAAM,UAAU,WAAW,OAAO,WAAW;AAC7C,QAAO,uCAAuC,aAAa,KAAK,CAAC,WAAW,QAAQ,IAAI,QAAQ,eAAe,aAAa,KAAK,CAAC,WAAW,QAAQ,IAAI,QAAQ;;;;;;;;;;;;;;;;;;;;;;AAuBnK,SAAS,mBACP,OACA,WACA,QACA,OAAO,KACP,SAAS,IAAI,iBAAiB,EACtB;CACR,MAAM,IAAI,qBAAqB,OAAO;CACtC,MAAM,uBAAM,IAAI,MAAM,EAAC,aAAa;CAEpC,MAAM,eAAe,MAAM,OAAO,KAAK,EAAE,sBAAsB,GAAG,EAAE,wBAAwB;CAC5F,MAAM,cAAc,MAAM,OAAO,KAAK,cAAc;CAGpD,IAAI;AACJ,KAAI,aAAa,MAAM,UAErB,iBAAgB,wBAAwB,UAAU,yCAD5B,WAAW,MAAM,UAAU,CACwD;KAEzG,iBAAgB,mBAAmB,WAAW,EAAE,wBAAwB,CAAC,CAAC;CAM5E,MAAM,eACJ,MAAM,UAAU,OACZ,KACA,yCAAyC,WAAW,EAAE,0BAA0B,CAAC,CAAC,2BAChF,MAAM,MAAM,SAAS,IACjB,MAAM,MACH,KAAK,MAAM;AAGV,SAAO,6BAFQ,WAAW,EAAE,GAAG,CAEY,iCAD3B,WAAW,EAAE,IAAI,MAAM,GAAG,IAAI,CAAC,CACqC;GACpF,CACD,KAAK,KAAK,GACb,qBAAqB,WAAW,EAAE,wBAAwB,CAAC,CAAC,OACjE;CAGP,MAAM,aAAa;EACjB,UAAU,KAAK,UAAU,EAAE,sBAAsB,CAAC;EAClD,YAAY,KAAK,UAAU,EAAE,wBAAwB,CAAC;EACtD,YAAY,KAAK,UAAU,EAAE,wBAAwB,CAAC;EACtD,YAAY,KAAK,UAAU,EAAE,wBAAwB,CAAC;EACvD;CAED,MAAM,eAAe,kBAAkB,MAAM,QAAQ,QAAQ,EAAE;CAM/D,MAAM,SADS,wBAAwB,QAEpC,WAAW,qBAAqB,aAAa,CAC7C,WAAW,WAAW,WAAW,IAAI,CAAC,CACtC,WAAW,oBAAoB,YAAY,CAC3C,WAAW,qBAAqB,WAAW,aAAa,CAAC,CACzD,WAAW,sBAAsB,cAAc,CAC/C,WAAW,qBAAqB,aAAa;CAKhD,MAAM,YAAY,eAAe,WAAW;AAC5C,QAAO,OAAO,QAAQ,WAAW,GAAG,UAAU,WAAW;;;;;;;;;;;AAmB3D,SAAS,eAAe,SAAmC;AACzD,QAAO;;;wBAGe,QAAQ,SAAS;0BACf,QAAQ,WAAW;0BACnB,QAAQ,WAAW;0BACnB,QAAQ,WAAW;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAsE7C,SAAS,gBACP,WACA,WACA,eACA,QACA,OAAO,WACP,SAAS,IAAI,iBAAiB,EACtB;CACR,MAAM,IAAI,qBAAqB,OAAO;CACtC,MAAM,eAAe,kBAAkB,MAAM,QAAQ,QAAQ,EAAE;CAE/D,MAAM,SADS,qBAAqB,QAEjC,WAAW,qBAAqB,aAAa,CAC7C,WAAW,mBAAmB,UAAU,CACxC,WAAW,kBAAkB,UAAU,CACvC,WAAW,uBAAuB,cAAc;CAWnD,MAAM,YAAY,eANC;EACjB,UAAU,KAAK,UAAU,EAAE,sBAAsB,CAAC;EAClD,YAAY,KAAK,UAAU,EAAE,wBAAwB,CAAC;EACtD,YAAY,KAAK,UAAU,EAAE,wBAAwB,CAAC;EACtD,YAAY,KAAK,UAAU,EAAE,wBAAwB,CAAC;EACvD,CAC2C;AAC5C,QAAO,OAAO,QAAQ,WAAW,GAAG,UAAU,WAAW;;;;;;;;;AAU3D,eAAsB,kBACpB,mBACuB;CACvB,MAAM,EAAE,SAAS,WAAW,MAAM,OAAO;;CAGzC,MAAM,aAA+B,EAAE;;CAGvC,SAAS,kBAAkB,KAAqB,OAA6B;EAC3E,MAAM,UAAU,KAAK,UAAU;GAC7B,QAAQ;IAAE,IAAI,MAAM,OAAO;IAAI,QAAQ,MAAM,OAAO;IAAQ;GAC5D,OAAO,MAAM;GAEb,WAAW,MAAM;GAClB,CAAC;AAEF,MAAI,MAAM,SAAS,QAAQ,MAAM;;CAGnC,MAAM,UAAA,GAAA,UAAA,cAA8B,OAAO,KAAsB,QAAwB;EAEvF,MAAM,CAAC,MAAM,QAAQ,OADN,IAAI,OAAO,KACQ,MAAM,KAAK,EAAE;EAC/C,MAAM,SAAS,IAAI,gBAAgB,SAAS,GAAG;EAG/C,MAAM,YAAY,OAAO,IAAI,OAAO;EACpC,MAAM,SACJ,cAAc,QAAQ,cAAc,OAChC,YACA,oBAAoB,IAAI,QAAQ,mBAAmB;AAGzD,MAAI,SAAS,KAAK;AAChB,OAAI,CAAC,mBAAmB;AACtB,QAAI,UAAU,KAAK,EAAE,gBAAgB,6BAA6B,CAAC;AACnE,QAAI,KAAK;AACT;;GAEF,MAAM,QAAQ,mBAAmB;GACjC,IAAI,YAA2B;AAC/B,OAAI,MAAM,UACR,KAAI;AACF,gBAAY,MAAM,OAAO,UAAU,MAAM,WAAW;KAClD,MAAM;KACN,sBAAsB;KACvB,CAAC;WACI;GAIV,MAAM,OAAO,mBAAmB,OAAO,WAAW,QAAQ,MAAM,OAAO;AACvE,OAAI,UAAU,KAAK;IACjB,gBAAgB;IAChB,iBAAiB;IAClB,CAAC;AACF,OAAI,IAAI,KAAK;AACb;;AAIF,MAAI,SAAS,WAAW;AACtB,OAAI,CAAC,mBAAmB;AACtB,QAAI,UAAU,KAAK,EAAE,gBAAgB,6BAA6B,CAAC;AACnE,QAAI,KAAK;AACT;;AAEF,OAAI,UAAU,KAAK;IACjB,gBAAgB;IAChB,iBAAiB;IACjB,YAAY;IACZ,qBAAqB;IACtB,CAAC;AAGF,qBAAkB,KADG,mBAAmB,CACJ;AAEpC,cAAW,KAAK,IAAI;AAGpB,OAAI,KAAK,eAAe;IACtB,MAAM,MAAM,WAAW,QAAQ,IAAI;AACnC,QAAI,QAAQ,GAAI,YAAW,OAAO,KAAK,EAAE;KACzC;AACF;;AAGF,MAAI,SAAS,WAAW;GACtB,MAAM,WAAW,OAAO,IAAI,IAAI,IAAI;GACpC,IAAI;AACJ,OAAI;AACF,gBAAY,mBAAmB,SAAS;WAClC;AACN,QAAI,UAAU,KAAK,EAAE,gBAAgB,6BAA6B,CAAC;AACnE,QAAI,IAAI,iBAAiB;AACzB;;GAIF,IAAI,oBAAoB;AACxB,OAAI;IACF,MAAM,UAAU,UAAU,MAAM,4BAA4B;AAC5D,QAAI,UAAU,GACZ,qBAAoB,mBAAmB,QAAQ,GAAG,CAAC,MAAM,GAAG,GAAG;WAE3D;AAKR,UAAO,UAAU,WAAW;IAAE,MAAM;IAAa,sBAAsB;IAAK,CAAC,CAC1E,MAAM,YAAoB;IAGzB,MAAM,OAAO,gBAAgB,SAFX,WAAW,kBAAkB,EACzB,WAAW,UAAU,EACqB,QAAQ,MAAM,OAAO;AACrF,QAAI,UAAU,KAAK;KACjB,gBAAgB;KAChB,iBAAiB;KAClB,CAAC;AACF,QAAI,IAAI,KAAK;KACb,CACD,YAAY;AACX,QAAI,UAAU,KAAK,EAAE,gBAAgB,6BAA6B,CAAC;AACnE,QAAI,IAAI,iBAAiB;KACzB;AACJ;;AAGF,MAAI,SAAS,WAAW;GACtB,MAAM,WAAW,OAAO,IAAI,IAAI,IAAI;GACpC,IAAI;AACJ,OAAI;AACF,gBAAY,mBAAmB,SAAS;WAClC;AACN,QAAI,UAAU,KAAK,EAAE,gBAAgB,6BAA6B,CAAC;AACnE,QAAI,IAAI,iBAAiB;AACzB;;AAGF,UAAO,SAAS,WAAW;IAAE,MAAM;IAAO,sBAAsB;IAAK,CAAC,CACnE,MAAM,QAAgB;AACrB,QAAI,UAAU,KAAK;KACjB,gBAAgB;KAChB,iBAAiB;KACjB,kBAAkB,OAAO,IAAI,OAAO;KACrC,CAAC;AACF,QAAI,IAAI,IAAI;KACZ,CACD,YAAY;AACX,QAAI,UAAU,KAAK,EAAE,gBAAgB,6BAA6B,CAAC;AACnE,QAAI,IAAI,qBAAqB;KAC7B;AACJ;;AAGF,MAAI,UAAU,KAAK,EAAE,gBAAgB,6BAA6B,CAAC;AACnE,MAAI,IAAI,YAAY;GACpB;CAEF,MAAM,aAAa,OAAO,QAAQ,IAAI,uBAAuB,EAAE;AAE/D,OAAM,IAAI,SAAe,SAAS,WAAW;AAC3C,SAAO,OAAO,YAAY,mBAAmB,SAAS,CAAC;AACvD,SAAO,KAAK,SAAS,OAAO;GAC5B;CAEF,MAAM,UAAU,OAAO,SAAS;AAChC,KAAI,CAAC,WAAW,OAAO,YAAY,SACjC,OAAM,IAAI,MAAM,mDAAmD;CAErE,MAAM,OAAO,QAAQ;AAErB,QAAO;EACL;EACA,mBAAmB,WAA2B;AAC5C,UAAO,oBAAoB,KAAK,YAAY,mBAAmB,UAAU;;EAE3E,oBAA0B;AACxB,OAAI,CAAC,kBAAmB;GACxB,MAAM,QAAQ,mBAAmB;AACjC,QAAK,MAAM,UAAU,WACnB,KAAI;AACF,sBAAkB,QAAQ,MAAM;WAC1B;;EAKZ,QAAuB;AACrB,UAAO,IAAI,SAAS,SAAS,WAAW;AACtC,WAAO,OAAO,QAAS,MAAM,OAAO,IAAI,GAAG,SAAS,CAAE;KACtD;;EAEL"}

package/dist/{tunnel-H7VujZz5.cjs → tunnel-BpllDsRw.cjs}

@@ -126,7 +126,7 @@ async function startTunnelDashboard(opts) {
 	if (opts.qr === false) return void 0;
 	const { isAutoDevtoolsDisabled } = await Promise.resolve().then(() => require("./devtools-opener-Bp671YXu.cjs"));
 	if (!(opts.shouldOpen ?? (() => !isAutoDevtoolsDisabled() && canOpenBrowser()))()) return void 0;
-	const { startQrHttpServer } = await Promise.resolve().then(() => require("./qr-http-server-CR4p9Y2d.cjs"));
+	const { startQrHttpServer } = await Promise.resolve().then(() => require("./qr-http-server-CQwQumPJ.cjs"));
 	const { buildLauncherAttachUrl } = await Promise.resolve().then(() => require("./deeplink-BONXxWEO.cjs"));
 	const { generateTotp } = await Promise.resolve().then(() => require("./totp-DA8vjAi7.cjs"));
 	const getDashboardState = () => {
@@ -260,4 +260,4 @@ exports.printTunnelBanner = printTunnelBanner;
 exports.startQuickTunnel = startQuickTunnel;
 exports.startTunnelDashboard = startTunnelDashboard;
 
-//# sourceMappingURL=tunnel-H7VujZz5.cjs.map
+//# sourceMappingURL=tunnel-BpllDsRw.cjs.map

package/dist/{tunnel-H7VujZz5.cjs.map → tunnel-BpllDsRw.cjs.map}

@@ -1 +1 @@
-{"version":3,"file":"tunnel-H7VujZz5.cjs","names":[],"sources":["../src/unplugin/tunnel.ts"],"sourcesContent":["/**\n * Cloudflare quick-tunnel helper for the devtools unplugin.\n *\n * Loaded lazily (`await import('./tunnel.js')`) only when the `tunnel` option is\n * on, so `cloudflared` / `qrcode-terminal` are never pulled in for the common\n * case. This is the one place in `@ait-co/devtools` that depends on Node-only\n * APIs (`child_process` via the `cloudflared` wrapper) — keep it thin and out of\n * jsdom unit tests; the spawn path is verified by hand / e2e (same spirit as the\n * \"web 모드는 e2e\" rule in CLAUDE.md). The pure helpers below\n * (`parseTrycloudflareUrl`, `printTunnelBanner`) are unit-tested.\n */\n\nimport { existsSync } from 'node:fs';\nimport { mkdir } from 'node:fs/promises';\nimport { dirname } from 'node:path';\n\n/** Matches the public URL cloudflared prints for an unauthenticated quick tunnel. */\nconst TRYCLOUDFLARE_RE = /https:\\/\\/[a-z0-9-]+\\.trycloudflare\\.com/i;\n\n/**\n * Extract the `https://<sub>.trycloudflare.com` URL from a line of cloudflared\n * output, or `null` if the line doesn't contain one. Pulled out as a pure\n * function so it can be unit-tested without spawning anything.\n */\nexport function parseTrycloudflareUrl(line: string): string | null {\n  const m = line.match(TRYCLOUDFLARE_RE);\n  return m ? m[0] : null;\n}\n\nexport interface PrintTunnelBannerOptions {\n  /** Print an ASCII QR encoding the tunnel URL (default: true). */\n  qr?: boolean;\n  /** Sink for the banner text (default: `console.log`). Injected for testing. */\n  log?: (msg: string) => void;\n  /**\n   * The `wss://` relay URL of the env-2 CDP tunnel, if `tunnel.cdp` is on. When\n   * present the QR deep-link additionally carries `&debug=1&relay=<wss>` so the\n   * framed PWA passes the in-app debug gate and attaches a Chii target — the\n   * same single scan opens screen preview *and* CDP debugging.\n   */\n  relayWssUrl?: string;\n}\n\nconst LAUNCHER_URL = 'https://devtools.aitc.dev/launcher/';\n\n/**\n * Build the deep-link URL that QR codes encode: when the launcher PWA is\n * already on the phone's home screen, scanning this opens it directly into the\n * live view for `tunnelUrl` (the launcher consumes `?url=` and clears it).\n * Plain-text raw URL is no longer enough — the launcher gates its setup UI to\n * the installed PWA, so a raw tunnel URL opened in a normal browser tab would\n * land on a \"please install\" screen.\n *\n * When `relayWssUrl` is given (env-2 CDP wiring), the deep-link also carries\n * `&debug=1&relay=<wss>`; the launcher folds those onto the framed tunnel URL so\n * the in-app debug gate's Layer C (`debug=1` opt-in + `relay=<wss>`) is met and\n * a Chii target.js is injected into the live view.\n */\nexport function buildLauncherDeepLink(tunnelUrl: string, relayWssUrl?: string): string {\n  const base = `${LAUNCHER_URL}?url=${encodeURIComponent(tunnelUrl)}`;\n  if (!relayWssUrl) return base;\n  return `${base}&debug=1&relay=${encodeURIComponent(relayWssUrl)}`;\n}\n\n/**\n * Print the terminal banner announcing the live tunnel: the public URL, an ASCII\n * QR encoding a launcher deep-link, and a one-line note that quick tunnels are\n * ephemeral, unauthenticated and not for production. Pure w.r.t. side effects\n * other than the injected `log` sink and `qrcode-terminal` — unit-tested.\n */\nexport async function printTunnelBanner(\n  url: string,\n  opts: PrintTunnelBannerOptions = {},\n): Promise<void> {\n  const log = opts.log ?? ((m: string) => console.log(m));\n  const deepLink = buildLauncherDeepLink(url, opts.relayWssUrl);\n  const lines: string[] = [\n    '',\n    '  ┌─ @ait-co/devtools · live tunnel ────────────────────────────',\n    `  │  ${url}`,\n    '  │',\n    `  │  Install the launcher PWA once:  ${LAUNCHER_URL}`,\n    '  │  Then scan the QR below — it opens the launcher directly',\n    '  │  into this tunnel URL (no manual paste needed).',\n    ...(opts.relayWssUrl\n      ? [\n          '  │  The same scan also attaches CDP — connect your AI host',\n          '  │  to the relay and debug the live view on-device.',\n        ]\n      : []),\n    '  │  Quick tunnels are unauthenticated, change every run, and are',\n    '  │  not for production use.',\n    '  └──────────────────────────────────────────────────────────────',\n    '',\n  ];\n  log(lines.join('\\n'));\n\n  if (opts.qr !== false) {\n    // qrcode-terminal is only pulled in on this code path (ambient types live\n    // in src/qrcode-terminal.d.ts).\n    const qrcode = (await import('qrcode-terminal')).default;\n    await new Promise<void>((resolve) => {\n      qrcode.generate(deepLink, { small: true }, (out) => {\n        log(out);\n        resolve();\n      });\n    });\n  }\n}\n\n/**\n * Heuristic: can this process open a GUI browser? Mirrors `canOpenBrowser` in\n * `src/mcp/tools.ts` but is re-declared here (not imported) so the tunnel path\n * does not statically pull the heavy MCP `tools.ts` module graph into the lazy\n * `import('./tunnel.js')` chunk. Kept in sync with the MCP copy.\n *\n *   - macOS / Windows → assume yes (env-2 dev normally runs on the user's Mac).\n *   - Linux → require `DISPLAY` or `WAYLAND_DISPLAY`.\n *   - CI (`CI=true`/`CI=1`) → no.\n */\nfunction canOpenBrowser(): boolean {\n  if (process.env.CI === 'true' || process.env.CI === '1') return false;\n  const platform = process.platform;\n  if (platform === 'darwin' || platform === 'win32') return true;\n  if (platform === 'linux') {\n    return Boolean(process.env.DISPLAY ?? process.env.WAYLAND_DISPLAY);\n  }\n  return false;\n}\n\n/** Handle returned by {@link startTunnelDashboard}. */\nexport interface TunnelDashboard {\n  /** `http://127.0.0.1:<port>` — the local dashboard URL opened in the browser. */\n  url: string;\n  /** Tear down the local HTTP server. Idempotent via the underlying server. */\n  close: () => Promise<void>;\n}\n\nexport interface StartTunnelDashboardOptions {\n  /** The public `https://*.trycloudflare.com` app tunnel URL the launcher frames. */\n  tunnelUrl: string;\n  /** The `wss://` relay URL of the env-2 CDP tunnel. REQUIRED — the dashboard is a CDP-only UX. */\n  relayWssUrl: string;\n  /** Mirror of `tunnel.qr` — when `false` the dashboard is skipped (no browser open). */\n  qr?: boolean;\n  /**\n   * Override the GUI/opt-out gate (testing only). When omitted the real\n   * `canOpenBrowser()` + `AIT_AUTO_DEVTOOLS` checks decide.\n   */\n  shouldOpen?: () => boolean;\n  /** Sink for the one-line \"opened in browser\" note (default: `console.log`). Injected for testing. */\n  log?: (msg: string) => void;\n}\n\n/**\n * Env-2 UX parity with env 3/4 (issue #408): when CDP wiring is on and a GUI is\n * available, start the SAME `127.0.0.1` HTML dashboard (QR image + connect steps\n * + FAQ) that the MCP `build_attach_url` path serves, and auto-open it in the\n * browser. headless / opt-out falls back to the terminal ASCII QR (printed\n * separately by {@link printTunnelBanner}).\n *\n * Every part the install-graph invariant depends on (`qrcode`, the MCP HTTP\n * server, the opener) is reached only through dynamic `import()` here, inside\n * the already-lazy `tunnel.js` chunk — nothing is added to the common build\n * graph or the MCP-only install graph.\n *\n * TOTP encapsulation: the dashboard's `getDashboardState` closure mints a FRESH\n * TOTP `at=` code on every call via `generateTotp(secret, Date.now())` and folds\n * it into a fresh `buildLauncherAttachUrl(...)`. Because the QR is re-rendered on\n * each SSE push / page reload from this closure, the code a phone scans is always\n * within its 30 s window — no stale code is baked into static HTML.\n *\n * SECRET-HANDLING: the tunnel host, relay wssUrl, TOTP code, and `.ait_relay`\n * value/path are NEVER written to stdout/stderr/logs here. They live only inside\n * the attach URL (HTML body + `/qr.png` query, per qr-http-server's invariant).\n * The only thing opened/logged is `http://127.0.0.1:<port>` (local, safe).\n *\n * @returns the dashboard handle when it started (caller wires `close()` into the\n *   tunnel cleanup), or `undefined` when skipped (no relay, `qr:false`, headless,\n *   opt-out, or a start failure) — in which case ASCII QR fallback stands alone.\n */\nexport async function startTunnelDashboard(\n  opts: StartTunnelDashboardOptions,\n): Promise<TunnelDashboard | undefined> {\n  const log = opts.log ?? ((m: string) => console.log(m));\n\n  // Gate: dashboard is a CDP-only UX (needs a relay to attach to).\n  if (!opts.relayWssUrl) return undefined;\n  // Opt-out via `tunnel.qr:false` (same toggle that suppresses the ASCII QR).\n  if (opts.qr === false) return undefined;\n\n  // GUI + AIT_AUTO_DEVTOOLS gate. Reuse the MCP opener's opt-out predicate so\n  // the env-2 path honours the same `AIT_AUTO_DEVTOOLS=0` switch as env 3/4.\n  const { isAutoDevtoolsDisabled } = await import('../mcp/devtools-opener.js');\n  const gateOpen = opts.shouldOpen ?? (() => !isAutoDevtoolsDisabled() && canOpenBrowser());\n  if (!gateOpen()) return undefined;\n\n  const { startQrHttpServer } = await import('../mcp/qr-http-server.js');\n  const { buildLauncherAttachUrl } = await import('../mcp/deeplink.js');\n  const { generateTotp } = await import('../mcp/totp.js');\n\n  // getDashboardState — mints a fresh TOTP + attach URL on every call so the QR\n  // the dashboard renders (on load and on each SSE push) is never expired.\n  // SECRET-HANDLING: the secret is read from env AT CALL TIME (it was injected\n  // by ensureRelaySecret in the same CDP block) and is used only to compute the\n  // at= code folded into attachUrl. tunnel.up is always true here — the relay\n  // tunnel is already up by the time this runs.\n  const getDashboardState = () => {\n    const secret = process.env.AIT_DEBUG_TOTP_SECRET;\n    const totpCode = secret ? generateTotp(secret, Date.now()) : undefined;\n    const attachUrl = buildLauncherAttachUrl(opts.tunnelUrl, opts.relayWssUrl, totpCode);\n    // pages: null — env 2(unplugin)는 데몬이 아니라 vite 플러그인 안이라\n    // startChiiRelay 핸들이 connected target을 노출하지 않는다. 라이브 page 목록을\n    // 알 수 없으므로 거짓 빈 목록 대신 \"연결된 Pages\" 섹션 자체를 숨긴다(#411).\n    // env 3/4(debug-server.ts)는 router.active.listTargets()로 실제 목록을 채운다.\n    return { tunnel: { up: true, wssUrl: opts.relayWssUrl }, pages: null, attachUrl };\n  };\n\n  let server: Awaited<ReturnType<typeof startQrHttpServer>>;\n  try {\n    server = await startQrHttpServer(getDashboardState);\n  } catch {\n    // SECRET-HANDLING: do not surface the error (could embed paths/hosts). The\n    // ASCII QR printed by printTunnelBanner stays as the fallback.\n    return undefined;\n  }\n\n  // TOTP periodic refresh timer — pushes a fresh at= code to SSE clients every\n  // 20 s so a page left open never stales past the 90 s acceptance window (#448).\n  // tunnel.ts always has relayWssUrl available here (gated above), so no\n  // lastAttachParts guard is needed — getDashboardState mints a fresh TOTP on\n  // every call unconditionally.\n  // SECRET-HANDLING: callback is a plain trigger only — TOTP value and at= code\n  // must never be logged or written to stdout.\n  const TOTP_REFRESH_INTERVAL_MS = 20_000;\n  let totpRefreshHandle: ReturnType<typeof setInterval> | null = setInterval(() => {\n    server.notifyStateChange();\n  }, TOTP_REFRESH_INTERVAL_MS);\n  totpRefreshHandle.unref();\n\n  const dashboardUrl = `http://127.0.0.1:${server.port}`;\n\n  const { openUrlInBrowser } = await import('../mcp/devtools-opener.js');\n  const opened = openUrlInBrowser(dashboardUrl);\n  // SECRET-HANDLING: only the local 127.0.0.1 URL is logged — never the tunnel\n  // host, relay wssUrl, or TOTP code.\n  log(\n    opened\n      ? `  │  Opened a QR dashboard in your browser: ${dashboardUrl}`\n      : `  │  Open this QR dashboard in your browser: ${dashboardUrl}`,\n  );\n\n  return {\n    url: dashboardUrl,\n    close: () => {\n      if (totpRefreshHandle) {\n        clearInterval(totpRefreshHandle);\n        totpRefreshHandle = null;\n      }\n      return server.close();\n    },\n  };\n}\n\nexport interface QuickTunnel {\n  /** The public `https://*.trycloudflare.com` URL. */\n  url: string;\n  /** Stop the underlying `cloudflared` process. Idempotent. */\n  stop: () => void;\n}\n\n/**\n * Sanitize cloudflared stderr output for error diagnostics (#421).\n *\n * Masks `*.trycloudflare.com` hostnames and full `https://` / `wss://` URLs\n * that carry those hostnames so tunnel host values never appear in error\n * messages. Diagnostic content (error codes, reasons, JSON blobs) is preserved.\n *\n * SECRET-HANDLING: tunnel host is SECRET-class per harness policy — only\n * placeholder text is emitted.\n */\nexport function sanitizeCloudflaredOutput(line: string): string {\n  // Full URL forms: https://xxx.trycloudflare.com/… and wss://xxx.trycloudflare.com/…\n  let s = line.replace(/(?:https?|wss?):\\/\\/[a-z0-9-]+\\.trycloudflare\\.com(?:\\/[^\\s]*)*/gi, (m) =>\n    m.replace(/[a-z0-9-]+\\.trycloudflare\\.com/i, '<HOST>.trycloudflare.com'),\n  );\n  // Bare hostname without scheme (e.g. printed in cloudflared JSON logs)\n  s = s.replace(/[a-z0-9-]+\\.trycloudflare\\.com/gi, '<HOST>.trycloudflare.com');\n  return s;\n}\n\nconst URL_TIMEOUT_MS = 20_000;\n\n/**\n * Start an unauthenticated Cloudflare quick tunnel to `http://localhost:<port>`\n * and resolve once the public URL is known. Downloads the `cloudflared` binary\n * on first use if it is not already installed. Rejects with a friendly error if\n * no URL appears within {@link URL_TIMEOUT_MS}.\n */\nexport async function startQuickTunnel(port: number): Promise<QuickTunnel> {\n  const cloudflared = await import('cloudflared');\n  const { bin, install, Tunnel } = cloudflared;\n\n  if (!existsSync(bin)) {\n    await mkdir(dirname(bin), { recursive: true });\n    await install(bin);\n  }\n\n  const tunnel = Tunnel.quick(`http://localhost:${port}`);\n  let stopped = false;\n  const stop = () => {\n    if (stopped) return;\n    stopped = true;\n    try {\n      tunnel.stop();\n    } catch {\n      // process may already be gone\n    }\n  };\n\n  return new Promise<QuickTunnel>((resolve, reject) => {\n    // #421: accumulate stderr to attach as diagnostics on failure.\n    // SECRET-HANDLING: lines are sanitized before inclusion in error messages.\n    const stderrLines: string[] = [];\n\n    /**\n     * Format the last `n` sanitized stderr lines as a diagnostic appendix.\n     * Returns an empty string when no lines have been collected.\n     */\n    const stderrTail = (n = 15): string => {\n      if (stderrLines.length === 0) return '';\n      const tail = stderrLines.slice(-n).map(sanitizeCloudflaredOutput).join('');\n      return `\\ncloudflared 출력 (마지막 ${Math.min(n, stderrLines.length)}줄):\\n${tail}`;\n    };\n\n    const timer = setTimeout(() => {\n      cleanup();\n      stop();\n      reject(\n        new Error(\n          `[@ait-co/devtools] cloudflared did not report a tunnel URL within ${\n            URL_TIMEOUT_MS / 1000\n          }s. Check your network connection, or run \\`cloudflared tunnel --url http://localhost:${port}\\` manually.${stderrTail()}`,\n        ),\n      );\n    }, URL_TIMEOUT_MS);\n\n    const onUrl = (line: string) => {\n      const found = parseTrycloudflareUrl(line);\n      if (!found) return;\n      clearTimeout(timer);\n      // Stop scanning further output once we have the URL.\n      cleanup();\n      resolve({ url: found, stop });\n    };\n\n    // Accumulate stderr lines for diagnostics (#421). Named so it can be\n    // removed from the listener list when cleanup() runs.\n    const pushStderr = (line: string) => {\n      stderrLines.push(line);\n    };\n\n    const cleanup = () => {\n      tunnel.off('stdout', onUrl);\n      tunnel.off('stderr', onUrl);\n      tunnel.off('stderr', pushStderr);\n    };\n\n    // The library emits a parsed `url` event; we also scan raw stdout/stderr in\n    // case the output format shifts.\n    tunnel.once('url', onUrl);\n    tunnel.on('stdout', onUrl);\n    tunnel.on('stderr', onUrl);\n    // Second stderr listener: accumulate all lines for error diagnostics.\n    tunnel.on('stderr', pushStderr);\n    tunnel.once('error', (err: Error) => {\n      clearTimeout(timer);\n      cleanup();\n      stop();\n      reject(err);\n    });\n    tunnel.once('exit', (code: number | null) => {\n      if (stopped) return;\n      clearTimeout(timer);\n      cleanup();\n      reject(\n        new Error(\n          `[@ait-co/devtools] cloudflared exited (code ${code ?? 'null'}) before reporting a tunnel URL.${stderrTail()}`,\n        ),\n      );\n    });\n  });\n}\n"],"mappings":";;;;;;;;;;;;;;;;AAiBA,MAAM,mBAAmB;;;;;;AAOzB,SAAgB,sBAAsB,MAA6B;CACjE,MAAM,IAAI,KAAK,MAAM,iBAAiB;AACtC,QAAO,IAAI,EAAE,KAAK;;AAiBpB,MAAM,eAAe;;;;;;;;;;;;;;AAerB,SAAgB,sBAAsB,WAAmB,aAA8B;CACrF,MAAM,OAAO,GAAG,aAAa,OAAO,mBAAmB,UAAU;AACjE,KAAI,CAAC,YAAa,QAAO;AACzB,QAAO,GAAG,KAAK,iBAAiB,mBAAmB,YAAY;;;;;;;;AASjE,eAAsB,kBACpB,KACA,OAAiC,EAAE,EACpB;CACf,MAAM,MAAM,KAAK,SAAS,MAAc,QAAQ,IAAI,EAAE;CACtD,MAAM,WAAW,sBAAsB,KAAK,KAAK,YAAY;AAoB7D,KAnBwB;EACtB;EACA;EACA,QAAQ;EACR;EACA,wCAAwC;EACxC;EACA;EACA,GAAI,KAAK,cACL,CACE,+DACA,uDACD,GACD,EAAE;EACN;EACA;EACA;EACA;EACD,CACS,KAAK,KAAK,CAAC;AAErB,KAAI,KAAK,OAAO,OAAO;EAGrB,MAAM,UAAU,MAAM,OAAO,oBAAoB;AACjD,QAAM,IAAI,SAAe,YAAY;AACnC,UAAO,SAAS,UAAU,EAAE,OAAO,MAAM,GAAG,QAAQ;AAClD,QAAI,IAAI;AACR,aAAS;KACT;IACF;;;;;;;;;;;;;AAcN,SAAS,iBAA0B;AACjC,KAAI,QAAQ,IAAI,OAAO,UAAU,QAAQ,IAAI,OAAO,IAAK,QAAO;CAChE,MAAM,WAAW,QAAQ;AACzB,KAAI,aAAa,YAAY,aAAa,QAAS,QAAO;AAC1D,KAAI,aAAa,QACf,QAAO,QAAQ,QAAQ,IAAI,WAAW,QAAQ,IAAI,gBAAgB;AAEpE,QAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAsDT,eAAsB,qBACpB,MACsC;CACtC,MAAM,MAAM,KAAK,SAAS,MAAc,QAAQ,IAAI,EAAE;AAGtD,KAAI,CAAC,KAAK,YAAa,QAAO,KAAA;AAE9B,KAAI,KAAK,OAAO,MAAO,QAAO,KAAA;CAI9B,MAAM,EAAE,2BAA2B,MAAA,QAAA,SAAA,CAAA,WAAA,QAAM,iCAAA,CAAA;AAEzC,KAAI,EADa,KAAK,qBAAqB,CAAC,wBAAwB,IAAI,gBAAgB,IACzE,CAAE,QAAO,KAAA;CAExB,MAAM,EAAE,sBAAsB,MAAA,QAAA,SAAA,CAAA,WAAA,QAAM,gCAAA,CAAA;CACpC,MAAM,EAAE,2BAA2B,MAAA,QAAA,SAAA,CAAA,WAAA,QAAM,0BAAA,CAAA;CACzC,MAAM,EAAE,iBAAiB,MAAA,QAAA,SAAA,CAAA,WAAA,QAAM,sBAAA,CAAA;CAQ/B,MAAM,0BAA0B;EAC9B,MAAM,SAAS,QAAQ,IAAI;EAC3B,MAAM,WAAW,SAAS,aAAa,QAAQ,KAAK,KAAK,CAAC,GAAG,KAAA;EAC7D,MAAM,YAAY,uBAAuB,KAAK,WAAW,KAAK,aAAa,SAAS;AAKpF,SAAO;GAAE,QAAQ;IAAE,IAAI;IAAM,QAAQ,KAAK;IAAa;GAAE,OAAO;GAAM;GAAW;;CAGnF,IAAI;AACJ,KAAI;AACF,WAAS,MAAM,kBAAkB,kBAAkB;SAC7C;AAGN;;CAWF,IAAI,oBAA2D,kBAAkB;AAC/E,SAAO,mBAAmB;IAFK,IAGL;AAC5B,mBAAkB,OAAO;CAEzB,MAAM,eAAe,oBAAoB,OAAO;CAEhD,MAAM,EAAE,qBAAqB,MAAA,QAAA,SAAA,CAAA,WAAA,QAAM,iCAAA,CAAA;AAInC,KAHe,iBAAiB,aAAa,GAKvC,+CAA+C,iBAC/C,gDAAgD,eACrD;AAED,QAAO;EACL,KAAK;EACL,aAAa;AACX,OAAI,mBAAmB;AACrB,kBAAc,kBAAkB;AAChC,wBAAoB;;AAEtB,UAAO,OAAO,OAAO;;EAExB;;;;;;;;;;;;AAoBH,SAAgB,0BAA0B,MAAsB;CAE9D,IAAI,IAAI,KAAK,QAAQ,sEAAsE,MACzF,EAAE,QAAQ,mCAAmC,2BAA2B,CACzE;AAED,KAAI,EAAE,QAAQ,oCAAoC,2BAA2B;AAC7E,QAAO;;AAGT,MAAM,iBAAiB;;;;;;;AAQvB,eAAsB,iBAAiB,MAAoC;CAEzE,MAAM,EAAE,KAAK,SAAS,WADF,MAAM,OAAO;AAGjC,KAAI,EAAA,GAAA,QAAA,YAAY,IAAI,EAAE;AACpB,SAAA,GAAA,iBAAA,QAAA,GAAA,UAAA,SAAoB,IAAI,EAAE,EAAE,WAAW,MAAM,CAAC;AAC9C,QAAM,QAAQ,IAAI;;CAGpB,MAAM,SAAS,OAAO,MAAM,oBAAoB,OAAO;CACvD,IAAI,UAAU;CACd,MAAM,aAAa;AACjB,MAAI,QAAS;AACb,YAAU;AACV,MAAI;AACF,UAAO,MAAM;UACP;;AAKV,QAAO,IAAI,SAAsB,SAAS,WAAW;EAGnD,MAAM,cAAwB,EAAE;;;;;EAMhC,MAAM,cAAc,IAAI,OAAe;AACrC,OAAI,YAAY,WAAW,EAAG,QAAO;GACrC,MAAM,OAAO,YAAY,MAAM,CAAC,EAAE,CAAC,IAAI,0BAA0B,CAAC,KAAK,GAAG;AAC1E,UAAO,yBAAyB,KAAK,IAAI,GAAG,YAAY,OAAO,CAAC,OAAO;;EAGzE,MAAM,QAAQ,iBAAiB;AAC7B,YAAS;AACT,SAAM;AACN,0BACE,IAAI,MACF,qEACE,iBAAiB,IAClB,uFAAuF,KAAK,cAAc,YAAY,GACxH,CACF;KACA,eAAe;EAElB,MAAM,SAAS,SAAiB;GAC9B,MAAM,QAAQ,sBAAsB,KAAK;AACzC,OAAI,CAAC,MAAO;AACZ,gBAAa,MAAM;AAEnB,YAAS;AACT,WAAQ;IAAE,KAAK;IAAO;IAAM,CAAC;;EAK/B,MAAM,cAAc,SAAiB;AACnC,eAAY,KAAK,KAAK;;EAGxB,MAAM,gBAAgB;AACpB,UAAO,IAAI,UAAU,MAAM;AAC3B,UAAO,IAAI,UAAU,MAAM;AAC3B,UAAO,IAAI,UAAU,WAAW;;AAKlC,SAAO,KAAK,OAAO,MAAM;AACzB,SAAO,GAAG,UAAU,MAAM;AAC1B,SAAO,GAAG,UAAU,MAAM;AAE1B,SAAO,GAAG,UAAU,WAAW;AAC/B,SAAO,KAAK,UAAU,QAAe;AACnC,gBAAa,MAAM;AACnB,YAAS;AACT,SAAM;AACN,UAAO,IAAI;IACX;AACF,SAAO,KAAK,SAAS,SAAwB;AAC3C,OAAI,QAAS;AACb,gBAAa,MAAM;AACnB,YAAS;AACT,0BACE,IAAI,MACF,+CAA+C,QAAQ,OAAO,kCAAkC,YAAY,GAC7G,CACF;IACD;GACF"}
+{"version":3,"file":"tunnel-BpllDsRw.cjs","names":[],"sources":["../src/unplugin/tunnel.ts"],"sourcesContent":["/**\n * Cloudflare quick-tunnel helper for the devtools unplugin.\n *\n * Loaded lazily (`await import('./tunnel.js')`) only when the `tunnel` option is\n * on, so `cloudflared` / `qrcode-terminal` are never pulled in for the common\n * case. This is the one place in `@ait-co/devtools` that depends on Node-only\n * APIs (`child_process` via the `cloudflared` wrapper) — keep it thin and out of\n * jsdom unit tests; the spawn path is verified by hand / e2e (same spirit as the\n * \"web 모드는 e2e\" rule in CLAUDE.md). The pure helpers below\n * (`parseTrycloudflareUrl`, `printTunnelBanner`) are unit-tested.\n */\n\nimport { existsSync } from 'node:fs';\nimport { mkdir } from 'node:fs/promises';\nimport { dirname } from 'node:path';\n\n/** Matches the public URL cloudflared prints for an unauthenticated quick tunnel. */\nconst TRYCLOUDFLARE_RE = /https:\\/\\/[a-z0-9-]+\\.trycloudflare\\.com/i;\n\n/**\n * Extract the `https://<sub>.trycloudflare.com` URL from a line of cloudflared\n * output, or `null` if the line doesn't contain one. Pulled out as a pure\n * function so it can be unit-tested without spawning anything.\n */\nexport function parseTrycloudflareUrl(line: string): string | null {\n  const m = line.match(TRYCLOUDFLARE_RE);\n  return m ? m[0] : null;\n}\n\nexport interface PrintTunnelBannerOptions {\n  /** Print an ASCII QR encoding the tunnel URL (default: true). */\n  qr?: boolean;\n  /** Sink for the banner text (default: `console.log`). Injected for testing. */\n  log?: (msg: string) => void;\n  /**\n   * The `wss://` relay URL of the env-2 CDP tunnel, if `tunnel.cdp` is on. When\n   * present the QR deep-link additionally carries `&debug=1&relay=<wss>` so the\n   * framed PWA passes the in-app debug gate and attaches a Chii target — the\n   * same single scan opens screen preview *and* CDP debugging.\n   */\n  relayWssUrl?: string;\n}\n\nconst LAUNCHER_URL = 'https://devtools.aitc.dev/launcher/';\n\n/**\n * Build the deep-link URL that QR codes encode: when the launcher PWA is\n * already on the phone's home screen, scanning this opens it directly into the\n * live view for `tunnelUrl` (the launcher consumes `?url=` and clears it).\n * Plain-text raw URL is no longer enough — the launcher gates its setup UI to\n * the installed PWA, so a raw tunnel URL opened in a normal browser tab would\n * land on a \"please install\" screen.\n *\n * When `relayWssUrl` is given (env-2 CDP wiring), the deep-link also carries\n * `&debug=1&relay=<wss>`; the launcher folds those onto the framed tunnel URL so\n * the in-app debug gate's Layer C (`debug=1` opt-in + `relay=<wss>`) is met and\n * a Chii target.js is injected into the live view.\n */\nexport function buildLauncherDeepLink(tunnelUrl: string, relayWssUrl?: string): string {\n  const base = `${LAUNCHER_URL}?url=${encodeURIComponent(tunnelUrl)}`;\n  if (!relayWssUrl) return base;\n  return `${base}&debug=1&relay=${encodeURIComponent(relayWssUrl)}`;\n}\n\n/**\n * Print the terminal banner announcing the live tunnel: the public URL, an ASCII\n * QR encoding a launcher deep-link, and a one-line note that quick tunnels are\n * ephemeral, unauthenticated and not for production. Pure w.r.t. side effects\n * other than the injected `log` sink and `qrcode-terminal` — unit-tested.\n */\nexport async function printTunnelBanner(\n  url: string,\n  opts: PrintTunnelBannerOptions = {},\n): Promise<void> {\n  const log = opts.log ?? ((m: string) => console.log(m));\n  const deepLink = buildLauncherDeepLink(url, opts.relayWssUrl);\n  const lines: string[] = [\n    '',\n    '  ┌─ @ait-co/devtools · live tunnel ────────────────────────────',\n    `  │  ${url}`,\n    '  │',\n    `  │  Install the launcher PWA once:  ${LAUNCHER_URL}`,\n    '  │  Then scan the QR below — it opens the launcher directly',\n    '  │  into this tunnel URL (no manual paste needed).',\n    ...(opts.relayWssUrl\n      ? [\n          '  │  The same scan also attaches CDP — connect your AI host',\n          '  │  to the relay and debug the live view on-device.',\n        ]\n      : []),\n    '  │  Quick tunnels are unauthenticated, change every run, and are',\n    '  │  not for production use.',\n    '  └──────────────────────────────────────────────────────────────',\n    '',\n  ];\n  log(lines.join('\\n'));\n\n  if (opts.qr !== false) {\n    // qrcode-terminal is only pulled in on this code path (ambient types live\n    // in src/qrcode-terminal.d.ts).\n    const qrcode = (await import('qrcode-terminal')).default;\n    await new Promise<void>((resolve) => {\n      qrcode.generate(deepLink, { small: true }, (out) => {\n        log(out);\n        resolve();\n      });\n    });\n  }\n}\n\n/**\n * Heuristic: can this process open a GUI browser? Mirrors `canOpenBrowser` in\n * `src/mcp/tools.ts` but is re-declared here (not imported) so the tunnel path\n * does not statically pull the heavy MCP `tools.ts` module graph into the lazy\n * `import('./tunnel.js')` chunk. Kept in sync with the MCP copy.\n *\n *   - macOS / Windows → assume yes (env-2 dev normally runs on the user's Mac).\n *   - Linux → require `DISPLAY` or `WAYLAND_DISPLAY`.\n *   - CI (`CI=true`/`CI=1`) → no.\n */\nfunction canOpenBrowser(): boolean {\n  if (process.env.CI === 'true' || process.env.CI === '1') return false;\n  const platform = process.platform;\n  if (platform === 'darwin' || platform === 'win32') return true;\n  if (platform === 'linux') {\n    return Boolean(process.env.DISPLAY ?? process.env.WAYLAND_DISPLAY);\n  }\n  return false;\n}\n\n/** Handle returned by {@link startTunnelDashboard}. */\nexport interface TunnelDashboard {\n  /** `http://127.0.0.1:<port>` — the local dashboard URL opened in the browser. */\n  url: string;\n  /** Tear down the local HTTP server. Idempotent via the underlying server. */\n  close: () => Promise<void>;\n}\n\nexport interface StartTunnelDashboardOptions {\n  /** The public `https://*.trycloudflare.com` app tunnel URL the launcher frames. */\n  tunnelUrl: string;\n  /** The `wss://` relay URL of the env-2 CDP tunnel. REQUIRED — the dashboard is a CDP-only UX. */\n  relayWssUrl: string;\n  /** Mirror of `tunnel.qr` — when `false` the dashboard is skipped (no browser open). */\n  qr?: boolean;\n  /**\n   * Override the GUI/opt-out gate (testing only). When omitted the real\n   * `canOpenBrowser()` + `AIT_AUTO_DEVTOOLS` checks decide.\n   */\n  shouldOpen?: () => boolean;\n  /** Sink for the one-line \"opened in browser\" note (default: `console.log`). Injected for testing. */\n  log?: (msg: string) => void;\n}\n\n/**\n * Env-2 UX parity with env 3/4 (issue #408): when CDP wiring is on and a GUI is\n * available, start the SAME `127.0.0.1` HTML dashboard (QR image + connect steps\n * + FAQ) that the MCP `build_attach_url` path serves, and auto-open it in the\n * browser. headless / opt-out falls back to the terminal ASCII QR (printed\n * separately by {@link printTunnelBanner}).\n *\n * Every part the install-graph invariant depends on (`qrcode`, the MCP HTTP\n * server, the opener) is reached only through dynamic `import()` here, inside\n * the already-lazy `tunnel.js` chunk — nothing is added to the common build\n * graph or the MCP-only install graph.\n *\n * TOTP encapsulation: the dashboard's `getDashboardState` closure mints a FRESH\n * TOTP `at=` code on every call via `generateTotp(secret, Date.now())` and folds\n * it into a fresh `buildLauncherAttachUrl(...)`. Because the QR is re-rendered on\n * each SSE push / page reload from this closure, the code a phone scans is always\n * within its 30 s window — no stale code is baked into static HTML.\n *\n * SECRET-HANDLING: the tunnel host, relay wssUrl, TOTP code, and `.ait_relay`\n * value/path are NEVER written to stdout/stderr/logs here. They live only inside\n * the attach URL (HTML body + `/qr.png` query, per qr-http-server's invariant).\n * The only thing opened/logged is `http://127.0.0.1:<port>` (local, safe).\n *\n * @returns the dashboard handle when it started (caller wires `close()` into the\n *   tunnel cleanup), or `undefined` when skipped (no relay, `qr:false`, headless,\n *   opt-out, or a start failure) — in which case ASCII QR fallback stands alone.\n */\nexport async function startTunnelDashboard(\n  opts: StartTunnelDashboardOptions,\n): Promise<TunnelDashboard | undefined> {\n  const log = opts.log ?? ((m: string) => console.log(m));\n\n  // Gate: dashboard is a CDP-only UX (needs a relay to attach to).\n  if (!opts.relayWssUrl) return undefined;\n  // Opt-out via `tunnel.qr:false` (same toggle that suppresses the ASCII QR).\n  if (opts.qr === false) return undefined;\n\n  // GUI + AIT_AUTO_DEVTOOLS gate. Reuse the MCP opener's opt-out predicate so\n  // the env-2 path honours the same `AIT_AUTO_DEVTOOLS=0` switch as env 3/4.\n  const { isAutoDevtoolsDisabled } = await import('../mcp/devtools-opener.js');\n  const gateOpen = opts.shouldOpen ?? (() => !isAutoDevtoolsDisabled() && canOpenBrowser());\n  if (!gateOpen()) return undefined;\n\n  const { startQrHttpServer } = await import('../mcp/qr-http-server.js');\n  const { buildLauncherAttachUrl } = await import('../mcp/deeplink.js');\n  const { generateTotp } = await import('../mcp/totp.js');\n\n  // getDashboardState — mints a fresh TOTP + attach URL on every call so the QR\n  // the dashboard renders (on load and on each SSE push) is never expired.\n  // SECRET-HANDLING: the secret is read from env AT CALL TIME (it was injected\n  // by ensureRelaySecret in the same CDP block) and is used only to compute the\n  // at= code folded into attachUrl. tunnel.up is always true here — the relay\n  // tunnel is already up by the time this runs.\n  const getDashboardState = () => {\n    const secret = process.env.AIT_DEBUG_TOTP_SECRET;\n    const totpCode = secret ? generateTotp(secret, Date.now()) : undefined;\n    const attachUrl = buildLauncherAttachUrl(opts.tunnelUrl, opts.relayWssUrl, totpCode);\n    // pages: null — env 2(unplugin)는 데몬이 아니라 vite 플러그인 안이라\n    // startChiiRelay 핸들이 connected target을 노출하지 않는다. 라이브 page 목록을\n    // 알 수 없으므로 거짓 빈 목록 대신 \"연결된 Pages\" 섹션 자체를 숨긴다(#411).\n    // env 3/4(debug-server.ts)는 router.active.listTargets()로 실제 목록을 채운다.\n    return { tunnel: { up: true, wssUrl: opts.relayWssUrl }, pages: null, attachUrl };\n  };\n\n  let server: Awaited<ReturnType<typeof startQrHttpServer>>;\n  try {\n    server = await startQrHttpServer(getDashboardState);\n  } catch {\n    // SECRET-HANDLING: do not surface the error (could embed paths/hosts). The\n    // ASCII QR printed by printTunnelBanner stays as the fallback.\n    return undefined;\n  }\n\n  // TOTP periodic refresh timer — pushes a fresh at= code to SSE clients every\n  // 20 s so a page left open never stales past the 90 s acceptance window (#448).\n  // tunnel.ts always has relayWssUrl available here (gated above), so no\n  // lastAttachParts guard is needed — getDashboardState mints a fresh TOTP on\n  // every call unconditionally.\n  // SECRET-HANDLING: callback is a plain trigger only — TOTP value and at= code\n  // must never be logged or written to stdout.\n  const TOTP_REFRESH_INTERVAL_MS = 20_000;\n  let totpRefreshHandle: ReturnType<typeof setInterval> | null = setInterval(() => {\n    server.notifyStateChange();\n  }, TOTP_REFRESH_INTERVAL_MS);\n  totpRefreshHandle.unref();\n\n  const dashboardUrl = `http://127.0.0.1:${server.port}`;\n\n  const { openUrlInBrowser } = await import('../mcp/devtools-opener.js');\n  const opened = openUrlInBrowser(dashboardUrl);\n  // SECRET-HANDLING: only the local 127.0.0.1 URL is logged — never the tunnel\n  // host, relay wssUrl, or TOTP code.\n  log(\n    opened\n      ? `  │  Opened a QR dashboard in your browser: ${dashboardUrl}`\n      : `  │  Open this QR dashboard in your browser: ${dashboardUrl}`,\n  );\n\n  return {\n    url: dashboardUrl,\n    close: () => {\n      if (totpRefreshHandle) {\n        clearInterval(totpRefreshHandle);\n        totpRefreshHandle = null;\n      }\n      return server.close();\n    },\n  };\n}\n\nexport interface QuickTunnel {\n  /** The public `https://*.trycloudflare.com` URL. */\n  url: string;\n  /** Stop the underlying `cloudflared` process. Idempotent. */\n  stop: () => void;\n}\n\n/**\n * Sanitize cloudflared stderr output for error diagnostics (#421).\n *\n * Masks `*.trycloudflare.com` hostnames and full `https://` / `wss://` URLs\n * that carry those hostnames so tunnel host values never appear in error\n * messages. Diagnostic content (error codes, reasons, JSON blobs) is preserved.\n *\n * SECRET-HANDLING: tunnel host is SECRET-class per harness policy — only\n * placeholder text is emitted.\n */\nexport function sanitizeCloudflaredOutput(line: string): string {\n  // Full URL forms: https://xxx.trycloudflare.com/… and wss://xxx.trycloudflare.com/…\n  let s = line.replace(/(?:https?|wss?):\\/\\/[a-z0-9-]+\\.trycloudflare\\.com(?:\\/[^\\s]*)*/gi, (m) =>\n    m.replace(/[a-z0-9-]+\\.trycloudflare\\.com/i, '<HOST>.trycloudflare.com'),\n  );\n  // Bare hostname without scheme (e.g. printed in cloudflared JSON logs)\n  s = s.replace(/[a-z0-9-]+\\.trycloudflare\\.com/gi, '<HOST>.trycloudflare.com');\n  return s;\n}\n\nconst URL_TIMEOUT_MS = 20_000;\n\n/**\n * Start an unauthenticated Cloudflare quick tunnel to `http://localhost:<port>`\n * and resolve once the public URL is known. Downloads the `cloudflared` binary\n * on first use if it is not already installed. Rejects with a friendly error if\n * no URL appears within {@link URL_TIMEOUT_MS}.\n */\nexport async function startQuickTunnel(port: number): Promise<QuickTunnel> {\n  const cloudflared = await import('cloudflared');\n  const { bin, install, Tunnel } = cloudflared;\n\n  if (!existsSync(bin)) {\n    await mkdir(dirname(bin), { recursive: true });\n    await install(bin);\n  }\n\n  const tunnel = Tunnel.quick(`http://localhost:${port}`);\n  let stopped = false;\n  const stop = () => {\n    if (stopped) return;\n    stopped = true;\n    try {\n      tunnel.stop();\n    } catch {\n      // process may already be gone\n    }\n  };\n\n  return new Promise<QuickTunnel>((resolve, reject) => {\n    // #421: accumulate stderr to attach as diagnostics on failure.\n    // SECRET-HANDLING: lines are sanitized before inclusion in error messages.\n    const stderrLines: string[] = [];\n\n    /**\n     * Format the last `n` sanitized stderr lines as a diagnostic appendix.\n     * Returns an empty string when no lines have been collected.\n     */\n    const stderrTail = (n = 15): string => {\n      if (stderrLines.length === 0) return '';\n      const tail = stderrLines.slice(-n).map(sanitizeCloudflaredOutput).join('');\n      return `\\ncloudflared 출력 (마지막 ${Math.min(n, stderrLines.length)}줄):\\n${tail}`;\n    };\n\n    const timer = setTimeout(() => {\n      cleanup();\n      stop();\n      reject(\n        new Error(\n          `[@ait-co/devtools] cloudflared did not report a tunnel URL within ${\n            URL_TIMEOUT_MS / 1000\n          }s. Check your network connection, or run \\`cloudflared tunnel --url http://localhost:${port}\\` manually.${stderrTail()}`,\n        ),\n      );\n    }, URL_TIMEOUT_MS);\n\n    const onUrl = (line: string) => {\n      const found = parseTrycloudflareUrl(line);\n      if (!found) return;\n      clearTimeout(timer);\n      // Stop scanning further output once we have the URL.\n      cleanup();\n      resolve({ url: found, stop });\n    };\n\n    // Accumulate stderr lines for diagnostics (#421). Named so it can be\n    // removed from the listener list when cleanup() runs.\n    const pushStderr = (line: string) => {\n      stderrLines.push(line);\n    };\n\n    const cleanup = () => {\n      tunnel.off('stdout', onUrl);\n      tunnel.off('stderr', onUrl);\n      tunnel.off('stderr', pushStderr);\n    };\n\n    // The library emits a parsed `url` event; we also scan raw stdout/stderr in\n    // case the output format shifts.\n    tunnel.once('url', onUrl);\n    tunnel.on('stdout', onUrl);\n    tunnel.on('stderr', onUrl);\n    // Second stderr listener: accumulate all lines for error diagnostics.\n    tunnel.on('stderr', pushStderr);\n    tunnel.once('error', (err: Error) => {\n      clearTimeout(timer);\n      cleanup();\n      stop();\n      reject(err);\n    });\n    tunnel.once('exit', (code: number | null) => {\n      if (stopped) return;\n      clearTimeout(timer);\n      cleanup();\n      reject(\n        new Error(\n          `[@ait-co/devtools] cloudflared exited (code ${code ?? 'null'}) before reporting a tunnel URL.${stderrTail()}`,\n        ),\n      );\n    });\n  });\n}\n"],"mappings":";;;;;;;;;;;;;;;;AAiBA,MAAM,mBAAmB;;;;;;AAOzB,SAAgB,sBAAsB,MAA6B;CACjE,MAAM,IAAI,KAAK,MAAM,iBAAiB;AACtC,QAAO,IAAI,EAAE,KAAK;;AAiBpB,MAAM,eAAe;;;;;;;;;;;;;;AAerB,SAAgB,sBAAsB,WAAmB,aAA8B;CACrF,MAAM,OAAO,GAAG,aAAa,OAAO,mBAAmB,UAAU;AACjE,KAAI,CAAC,YAAa,QAAO;AACzB,QAAO,GAAG,KAAK,iBAAiB,mBAAmB,YAAY;;;;;;;;AASjE,eAAsB,kBACpB,KACA,OAAiC,EAAE,EACpB;CACf,MAAM,MAAM,KAAK,SAAS,MAAc,QAAQ,IAAI,EAAE;CACtD,MAAM,WAAW,sBAAsB,KAAK,KAAK,YAAY;AAoB7D,KAnBwB;EACtB;EACA;EACA,QAAQ;EACR;EACA,wCAAwC;EACxC;EACA;EACA,GAAI,KAAK,cACL,CACE,+DACA,uDACD,GACD,EAAE;EACN;EACA;EACA;EACA;EACD,CACS,KAAK,KAAK,CAAC;AAErB,KAAI,KAAK,OAAO,OAAO;EAGrB,MAAM,UAAU,MAAM,OAAO,oBAAoB;AACjD,QAAM,IAAI,SAAe,YAAY;AACnC,UAAO,SAAS,UAAU,EAAE,OAAO,MAAM,GAAG,QAAQ;AAClD,QAAI,IAAI;AACR,aAAS;KACT;IACF;;;;;;;;;;;;;AAcN,SAAS,iBAA0B;AACjC,KAAI,QAAQ,IAAI,OAAO,UAAU,QAAQ,IAAI,OAAO,IAAK,QAAO;CAChE,MAAM,WAAW,QAAQ;AACzB,KAAI,aAAa,YAAY,aAAa,QAAS,QAAO;AAC1D,KAAI,aAAa,QACf,QAAO,QAAQ,QAAQ,IAAI,WAAW,QAAQ,IAAI,gBAAgB;AAEpE,QAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAsDT,eAAsB,qBACpB,MACsC;CACtC,MAAM,MAAM,KAAK,SAAS,MAAc,QAAQ,IAAI,EAAE;AAGtD,KAAI,CAAC,KAAK,YAAa,QAAO,KAAA;AAE9B,KAAI,KAAK,OAAO,MAAO,QAAO,KAAA;CAI9B,MAAM,EAAE,2BAA2B,MAAA,QAAA,SAAA,CAAA,WAAA,QAAM,iCAAA,CAAA;AAEzC,KAAI,EADa,KAAK,qBAAqB,CAAC,wBAAwB,IAAI,gBAAgB,IACzE,CAAE,QAAO,KAAA;CAExB,MAAM,EAAE,sBAAsB,MAAA,QAAA,SAAA,CAAA,WAAA,QAAM,gCAAA,CAAA;CACpC,MAAM,EAAE,2BAA2B,MAAA,QAAA,SAAA,CAAA,WAAA,QAAM,0BAAA,CAAA;CACzC,MAAM,EAAE,iBAAiB,MAAA,QAAA,SAAA,CAAA,WAAA,QAAM,sBAAA,CAAA;CAQ/B,MAAM,0BAA0B;EAC9B,MAAM,SAAS,QAAQ,IAAI;EAC3B,MAAM,WAAW,SAAS,aAAa,QAAQ,KAAK,KAAK,CAAC,GAAG,KAAA;EAC7D,MAAM,YAAY,uBAAuB,KAAK,WAAW,KAAK,aAAa,SAAS;AAKpF,SAAO;GAAE,QAAQ;IAAE,IAAI;IAAM,QAAQ,KAAK;IAAa;GAAE,OAAO;GAAM;GAAW;;CAGnF,IAAI;AACJ,KAAI;AACF,WAAS,MAAM,kBAAkB,kBAAkB;SAC7C;AAGN;;CAWF,IAAI,oBAA2D,kBAAkB;AAC/E,SAAO,mBAAmB;IAFK,IAGL;AAC5B,mBAAkB,OAAO;CAEzB,MAAM,eAAe,oBAAoB,OAAO;CAEhD,MAAM,EAAE,qBAAqB,MAAA,QAAA,SAAA,CAAA,WAAA,QAAM,iCAAA,CAAA;AAInC,KAHe,iBAAiB,aAAa,GAKvC,+CAA+C,iBAC/C,gDAAgD,eACrD;AAED,QAAO;EACL,KAAK;EACL,aAAa;AACX,OAAI,mBAAmB;AACrB,kBAAc,kBAAkB;AAChC,wBAAoB;;AAEtB,UAAO,OAAO,OAAO;;EAExB;;;;;;;;;;;;AAoBH,SAAgB,0BAA0B,MAAsB;CAE9D,IAAI,IAAI,KAAK,QAAQ,sEAAsE,MACzF,EAAE,QAAQ,mCAAmC,2BAA2B,CACzE;AAED,KAAI,EAAE,QAAQ,oCAAoC,2BAA2B;AAC7E,QAAO;;AAGT,MAAM,iBAAiB;;;;;;;AAQvB,eAAsB,iBAAiB,MAAoC;CAEzE,MAAM,EAAE,KAAK,SAAS,WADF,MAAM,OAAO;AAGjC,KAAI,EAAA,GAAA,QAAA,YAAY,IAAI,EAAE;AACpB,SAAA,GAAA,iBAAA,QAAA,GAAA,UAAA,SAAoB,IAAI,EAAE,EAAE,WAAW,MAAM,CAAC;AAC9C,QAAM,QAAQ,IAAI;;CAGpB,MAAM,SAAS,OAAO,MAAM,oBAAoB,OAAO;CACvD,IAAI,UAAU;CACd,MAAM,aAAa;AACjB,MAAI,QAAS;AACb,YAAU;AACV,MAAI;AACF,UAAO,MAAM;UACP;;AAKV,QAAO,IAAI,SAAsB,SAAS,WAAW;EAGnD,MAAM,cAAwB,EAAE;;;;;EAMhC,MAAM,cAAc,IAAI,OAAe;AACrC,OAAI,YAAY,WAAW,EAAG,QAAO;GACrC,MAAM,OAAO,YAAY,MAAM,CAAC,EAAE,CAAC,IAAI,0BAA0B,CAAC,KAAK,GAAG;AAC1E,UAAO,yBAAyB,KAAK,IAAI,GAAG,YAAY,OAAO,CAAC,OAAO;;EAGzE,MAAM,QAAQ,iBAAiB;AAC7B,YAAS;AACT,SAAM;AACN,0BACE,IAAI,MACF,qEACE,iBAAiB,IAClB,uFAAuF,KAAK,cAAc,YAAY,GACxH,CACF;KACA,eAAe;EAElB,MAAM,SAAS,SAAiB;GAC9B,MAAM,QAAQ,sBAAsB,KAAK;AACzC,OAAI,CAAC,MAAO;AACZ,gBAAa,MAAM;AAEnB,YAAS;AACT,WAAQ;IAAE,KAAK;IAAO;IAAM,CAAC;;EAK/B,MAAM,cAAc,SAAiB;AACnC,eAAY,KAAK,KAAK;;EAGxB,MAAM,gBAAgB;AACpB,UAAO,IAAI,UAAU,MAAM;AAC3B,UAAO,IAAI,UAAU,MAAM;AAC3B,UAAO,IAAI,UAAU,WAAW;;AAKlC,SAAO,KAAK,OAAO,MAAM;AACzB,SAAO,GAAG,UAAU,MAAM;AAC1B,SAAO,GAAG,UAAU,MAAM;AAE1B,SAAO,GAAG,UAAU,WAAW;AAC/B,SAAO,KAAK,UAAU,QAAe;AACnC,gBAAa,MAAM;AACnB,YAAS;AACT,SAAM;AACN,UAAO,IAAI;IACX;AACF,SAAO,KAAK,SAAS,SAAwB;AAC3C,OAAI,QAAS;AACb,gBAAa,MAAM;AACnB,YAAS;AACT,0BACE,IAAI,MACF,+CAA+C,QAAQ,OAAO,kCAAkC,YAAY,GAC7G,CACF;IACD;GACF"}

package/dist/{tunnel-CIc0oSit.js → tunnel-fm4hDfV-.js}

@@ -126,7 +126,7 @@ async function startTunnelDashboard(opts) {
 	if (opts.qr === false) return void 0;
 	const { isAutoDevtoolsDisabled } = await import("./devtools-opener-BbUXBzgA.js");
 	if (!(opts.shouldOpen ?? (() => !isAutoDevtoolsDisabled() && canOpenBrowser()))()) return void 0;
-	const { startQrHttpServer } = await import("./qr-http-server-DBgh4rxe.js");
+	const { startQrHttpServer } = await import("./qr-http-server-CLtsKfPF.js");
 	const { buildLauncherAttachUrl } = await import("./deeplink-CaO6hZVG.js");
 	const { generateTotp } = await import("./totp-BjtKFt88.js");
 	const getDashboardState = () => {
@@ -258,4 +258,4 @@ async function startQuickTunnel(port) {
 //#endregion
 export { printTunnelBanner, startQuickTunnel, startTunnelDashboard };
 
-//# sourceMappingURL=tunnel-CIc0oSit.js.map
+//# sourceMappingURL=tunnel-fm4hDfV-.js.map

package/dist/{tunnel-CIc0oSit.js.map → tunnel-fm4hDfV-.js.map}

@@ -1 +1 @@
-{"version":3,"file":"tunnel-CIc0oSit.js","names":[],"sources":["../src/unplugin/tunnel.ts"],"sourcesContent":["/**\n * Cloudflare quick-tunnel helper for the devtools unplugin.\n *\n * Loaded lazily (`await import('./tunnel.js')`) only when the `tunnel` option is\n * on, so `cloudflared` / `qrcode-terminal` are never pulled in for the common\n * case. This is the one place in `@ait-co/devtools` that depends on Node-only\n * APIs (`child_process` via the `cloudflared` wrapper) — keep it thin and out of\n * jsdom unit tests; the spawn path is verified by hand / e2e (same spirit as the\n * \"web 모드는 e2e\" rule in CLAUDE.md). The pure helpers below\n * (`parseTrycloudflareUrl`, `printTunnelBanner`) are unit-tested.\n */\n\nimport { existsSync } from 'node:fs';\nimport { mkdir } from 'node:fs/promises';\nimport { dirname } from 'node:path';\n\n/** Matches the public URL cloudflared prints for an unauthenticated quick tunnel. */\nconst TRYCLOUDFLARE_RE = /https:\\/\\/[a-z0-9-]+\\.trycloudflare\\.com/i;\n\n/**\n * Extract the `https://<sub>.trycloudflare.com` URL from a line of cloudflared\n * output, or `null` if the line doesn't contain one. Pulled out as a pure\n * function so it can be unit-tested without spawning anything.\n */\nexport function parseTrycloudflareUrl(line: string): string | null {\n  const m = line.match(TRYCLOUDFLARE_RE);\n  return m ? m[0] : null;\n}\n\nexport interface PrintTunnelBannerOptions {\n  /** Print an ASCII QR encoding the tunnel URL (default: true). */\n  qr?: boolean;\n  /** Sink for the banner text (default: `console.log`). Injected for testing. */\n  log?: (msg: string) => void;\n  /**\n   * The `wss://` relay URL of the env-2 CDP tunnel, if `tunnel.cdp` is on. When\n   * present the QR deep-link additionally carries `&debug=1&relay=<wss>` so the\n   * framed PWA passes the in-app debug gate and attaches a Chii target — the\n   * same single scan opens screen preview *and* CDP debugging.\n   */\n  relayWssUrl?: string;\n}\n\nconst LAUNCHER_URL = 'https://devtools.aitc.dev/launcher/';\n\n/**\n * Build the deep-link URL that QR codes encode: when the launcher PWA is\n * already on the phone's home screen, scanning this opens it directly into the\n * live view for `tunnelUrl` (the launcher consumes `?url=` and clears it).\n * Plain-text raw URL is no longer enough — the launcher gates its setup UI to\n * the installed PWA, so a raw tunnel URL opened in a normal browser tab would\n * land on a \"please install\" screen.\n *\n * When `relayWssUrl` is given (env-2 CDP wiring), the deep-link also carries\n * `&debug=1&relay=<wss>`; the launcher folds those onto the framed tunnel URL so\n * the in-app debug gate's Layer C (`debug=1` opt-in + `relay=<wss>`) is met and\n * a Chii target.js is injected into the live view.\n */\nexport function buildLauncherDeepLink(tunnelUrl: string, relayWssUrl?: string): string {\n  const base = `${LAUNCHER_URL}?url=${encodeURIComponent(tunnelUrl)}`;\n  if (!relayWssUrl) return base;\n  return `${base}&debug=1&relay=${encodeURIComponent(relayWssUrl)}`;\n}\n\n/**\n * Print the terminal banner announcing the live tunnel: the public URL, an ASCII\n * QR encoding a launcher deep-link, and a one-line note that quick tunnels are\n * ephemeral, unauthenticated and not for production. Pure w.r.t. side effects\n * other than the injected `log` sink and `qrcode-terminal` — unit-tested.\n */\nexport async function printTunnelBanner(\n  url: string,\n  opts: PrintTunnelBannerOptions = {},\n): Promise<void> {\n  const log = opts.log ?? ((m: string) => console.log(m));\n  const deepLink = buildLauncherDeepLink(url, opts.relayWssUrl);\n  const lines: string[] = [\n    '',\n    '  ┌─ @ait-co/devtools · live tunnel ────────────────────────────',\n    `  │  ${url}`,\n    '  │',\n    `  │  Install the launcher PWA once:  ${LAUNCHER_URL}`,\n    '  │  Then scan the QR below — it opens the launcher directly',\n    '  │  into this tunnel URL (no manual paste needed).',\n    ...(opts.relayWssUrl\n      ? [\n          '  │  The same scan also attaches CDP — connect your AI host',\n          '  │  to the relay and debug the live view on-device.',\n        ]\n      : []),\n    '  │  Quick tunnels are unauthenticated, change every run, and are',\n    '  │  not for production use.',\n    '  └──────────────────────────────────────────────────────────────',\n    '',\n  ];\n  log(lines.join('\\n'));\n\n  if (opts.qr !== false) {\n    // qrcode-terminal is only pulled in on this code path (ambient types live\n    // in src/qrcode-terminal.d.ts).\n    const qrcode = (await import('qrcode-terminal')).default;\n    await new Promise<void>((resolve) => {\n      qrcode.generate(deepLink, { small: true }, (out) => {\n        log(out);\n        resolve();\n      });\n    });\n  }\n}\n\n/**\n * Heuristic: can this process open a GUI browser? Mirrors `canOpenBrowser` in\n * `src/mcp/tools.ts` but is re-declared here (not imported) so the tunnel path\n * does not statically pull the heavy MCP `tools.ts` module graph into the lazy\n * `import('./tunnel.js')` chunk. Kept in sync with the MCP copy.\n *\n *   - macOS / Windows → assume yes (env-2 dev normally runs on the user's Mac).\n *   - Linux → require `DISPLAY` or `WAYLAND_DISPLAY`.\n *   - CI (`CI=true`/`CI=1`) → no.\n */\nfunction canOpenBrowser(): boolean {\n  if (process.env.CI === 'true' || process.env.CI === '1') return false;\n  const platform = process.platform;\n  if (platform === 'darwin' || platform === 'win32') return true;\n  if (platform === 'linux') {\n    return Boolean(process.env.DISPLAY ?? process.env.WAYLAND_DISPLAY);\n  }\n  return false;\n}\n\n/** Handle returned by {@link startTunnelDashboard}. */\nexport interface TunnelDashboard {\n  /** `http://127.0.0.1:<port>` — the local dashboard URL opened in the browser. */\n  url: string;\n  /** Tear down the local HTTP server. Idempotent via the underlying server. */\n  close: () => Promise<void>;\n}\n\nexport interface StartTunnelDashboardOptions {\n  /** The public `https://*.trycloudflare.com` app tunnel URL the launcher frames. */\n  tunnelUrl: string;\n  /** The `wss://` relay URL of the env-2 CDP tunnel. REQUIRED — the dashboard is a CDP-only UX. */\n  relayWssUrl: string;\n  /** Mirror of `tunnel.qr` — when `false` the dashboard is skipped (no browser open). */\n  qr?: boolean;\n  /**\n   * Override the GUI/opt-out gate (testing only). When omitted the real\n   * `canOpenBrowser()` + `AIT_AUTO_DEVTOOLS` checks decide.\n   */\n  shouldOpen?: () => boolean;\n  /** Sink for the one-line \"opened in browser\" note (default: `console.log`). Injected for testing. */\n  log?: (msg: string) => void;\n}\n\n/**\n * Env-2 UX parity with env 3/4 (issue #408): when CDP wiring is on and a GUI is\n * available, start the SAME `127.0.0.1` HTML dashboard (QR image + connect steps\n * + FAQ) that the MCP `build_attach_url` path serves, and auto-open it in the\n * browser. headless / opt-out falls back to the terminal ASCII QR (printed\n * separately by {@link printTunnelBanner}).\n *\n * Every part the install-graph invariant depends on (`qrcode`, the MCP HTTP\n * server, the opener) is reached only through dynamic `import()` here, inside\n * the already-lazy `tunnel.js` chunk — nothing is added to the common build\n * graph or the MCP-only install graph.\n *\n * TOTP encapsulation: the dashboard's `getDashboardState` closure mints a FRESH\n * TOTP `at=` code on every call via `generateTotp(secret, Date.now())` and folds\n * it into a fresh `buildLauncherAttachUrl(...)`. Because the QR is re-rendered on\n * each SSE push / page reload from this closure, the code a phone scans is always\n * within its 30 s window — no stale code is baked into static HTML.\n *\n * SECRET-HANDLING: the tunnel host, relay wssUrl, TOTP code, and `.ait_relay`\n * value/path are NEVER written to stdout/stderr/logs here. They live only inside\n * the attach URL (HTML body + `/qr.png` query, per qr-http-server's invariant).\n * The only thing opened/logged is `http://127.0.0.1:<port>` (local, safe).\n *\n * @returns the dashboard handle when it started (caller wires `close()` into the\n *   tunnel cleanup), or `undefined` when skipped (no relay, `qr:false`, headless,\n *   opt-out, or a start failure) — in which case ASCII QR fallback stands alone.\n */\nexport async function startTunnelDashboard(\n  opts: StartTunnelDashboardOptions,\n): Promise<TunnelDashboard | undefined> {\n  const log = opts.log ?? ((m: string) => console.log(m));\n\n  // Gate: dashboard is a CDP-only UX (needs a relay to attach to).\n  if (!opts.relayWssUrl) return undefined;\n  // Opt-out via `tunnel.qr:false` (same toggle that suppresses the ASCII QR).\n  if (opts.qr === false) return undefined;\n\n  // GUI + AIT_AUTO_DEVTOOLS gate. Reuse the MCP opener's opt-out predicate so\n  // the env-2 path honours the same `AIT_AUTO_DEVTOOLS=0` switch as env 3/4.\n  const { isAutoDevtoolsDisabled } = await import('../mcp/devtools-opener.js');\n  const gateOpen = opts.shouldOpen ?? (() => !isAutoDevtoolsDisabled() && canOpenBrowser());\n  if (!gateOpen()) return undefined;\n\n  const { startQrHttpServer } = await import('../mcp/qr-http-server.js');\n  const { buildLauncherAttachUrl } = await import('../mcp/deeplink.js');\n  const { generateTotp } = await import('../mcp/totp.js');\n\n  // getDashboardState — mints a fresh TOTP + attach URL on every call so the QR\n  // the dashboard renders (on load and on each SSE push) is never expired.\n  // SECRET-HANDLING: the secret is read from env AT CALL TIME (it was injected\n  // by ensureRelaySecret in the same CDP block) and is used only to compute the\n  // at= code folded into attachUrl. tunnel.up is always true here — the relay\n  // tunnel is already up by the time this runs.\n  const getDashboardState = () => {\n    const secret = process.env.AIT_DEBUG_TOTP_SECRET;\n    const totpCode = secret ? generateTotp(secret, Date.now()) : undefined;\n    const attachUrl = buildLauncherAttachUrl(opts.tunnelUrl, opts.relayWssUrl, totpCode);\n    // pages: null — env 2(unplugin)는 데몬이 아니라 vite 플러그인 안이라\n    // startChiiRelay 핸들이 connected target을 노출하지 않는다. 라이브 page 목록을\n    // 알 수 없으므로 거짓 빈 목록 대신 \"연결된 Pages\" 섹션 자체를 숨긴다(#411).\n    // env 3/4(debug-server.ts)는 router.active.listTargets()로 실제 목록을 채운다.\n    return { tunnel: { up: true, wssUrl: opts.relayWssUrl }, pages: null, attachUrl };\n  };\n\n  let server: Awaited<ReturnType<typeof startQrHttpServer>>;\n  try {\n    server = await startQrHttpServer(getDashboardState);\n  } catch {\n    // SECRET-HANDLING: do not surface the error (could embed paths/hosts). The\n    // ASCII QR printed by printTunnelBanner stays as the fallback.\n    return undefined;\n  }\n\n  // TOTP periodic refresh timer — pushes a fresh at= code to SSE clients every\n  // 20 s so a page left open never stales past the 90 s acceptance window (#448).\n  // tunnel.ts always has relayWssUrl available here (gated above), so no\n  // lastAttachParts guard is needed — getDashboardState mints a fresh TOTP on\n  // every call unconditionally.\n  // SECRET-HANDLING: callback is a plain trigger only — TOTP value and at= code\n  // must never be logged or written to stdout.\n  const TOTP_REFRESH_INTERVAL_MS = 20_000;\n  let totpRefreshHandle: ReturnType<typeof setInterval> | null = setInterval(() => {\n    server.notifyStateChange();\n  }, TOTP_REFRESH_INTERVAL_MS);\n  totpRefreshHandle.unref();\n\n  const dashboardUrl = `http://127.0.0.1:${server.port}`;\n\n  const { openUrlInBrowser } = await import('../mcp/devtools-opener.js');\n  const opened = openUrlInBrowser(dashboardUrl);\n  // SECRET-HANDLING: only the local 127.0.0.1 URL is logged — never the tunnel\n  // host, relay wssUrl, or TOTP code.\n  log(\n    opened\n      ? `  │  Opened a QR dashboard in your browser: ${dashboardUrl}`\n      : `  │  Open this QR dashboard in your browser: ${dashboardUrl}`,\n  );\n\n  return {\n    url: dashboardUrl,\n    close: () => {\n      if (totpRefreshHandle) {\n        clearInterval(totpRefreshHandle);\n        totpRefreshHandle = null;\n      }\n      return server.close();\n    },\n  };\n}\n\nexport interface QuickTunnel {\n  /** The public `https://*.trycloudflare.com` URL. */\n  url: string;\n  /** Stop the underlying `cloudflared` process. Idempotent. */\n  stop: () => void;\n}\n\n/**\n * Sanitize cloudflared stderr output for error diagnostics (#421).\n *\n * Masks `*.trycloudflare.com` hostnames and full `https://` / `wss://` URLs\n * that carry those hostnames so tunnel host values never appear in error\n * messages. Diagnostic content (error codes, reasons, JSON blobs) is preserved.\n *\n * SECRET-HANDLING: tunnel host is SECRET-class per harness policy — only\n * placeholder text is emitted.\n */\nexport function sanitizeCloudflaredOutput(line: string): string {\n  // Full URL forms: https://xxx.trycloudflare.com/… and wss://xxx.trycloudflare.com/…\n  let s = line.replace(/(?:https?|wss?):\\/\\/[a-z0-9-]+\\.trycloudflare\\.com(?:\\/[^\\s]*)*/gi, (m) =>\n    m.replace(/[a-z0-9-]+\\.trycloudflare\\.com/i, '<HOST>.trycloudflare.com'),\n  );\n  // Bare hostname without scheme (e.g. printed in cloudflared JSON logs)\n  s = s.replace(/[a-z0-9-]+\\.trycloudflare\\.com/gi, '<HOST>.trycloudflare.com');\n  return s;\n}\n\nconst URL_TIMEOUT_MS = 20_000;\n\n/**\n * Start an unauthenticated Cloudflare quick tunnel to `http://localhost:<port>`\n * and resolve once the public URL is known. Downloads the `cloudflared` binary\n * on first use if it is not already installed. Rejects with a friendly error if\n * no URL appears within {@link URL_TIMEOUT_MS}.\n */\nexport async function startQuickTunnel(port: number): Promise<QuickTunnel> {\n  const cloudflared = await import('cloudflared');\n  const { bin, install, Tunnel } = cloudflared;\n\n  if (!existsSync(bin)) {\n    await mkdir(dirname(bin), { recursive: true });\n    await install(bin);\n  }\n\n  const tunnel = Tunnel.quick(`http://localhost:${port}`);\n  let stopped = false;\n  const stop = () => {\n    if (stopped) return;\n    stopped = true;\n    try {\n      tunnel.stop();\n    } catch {\n      // process may already be gone\n    }\n  };\n\n  return new Promise<QuickTunnel>((resolve, reject) => {\n    // #421: accumulate stderr to attach as diagnostics on failure.\n    // SECRET-HANDLING: lines are sanitized before inclusion in error messages.\n    const stderrLines: string[] = [];\n\n    /**\n     * Format the last `n` sanitized stderr lines as a diagnostic appendix.\n     * Returns an empty string when no lines have been collected.\n     */\n    const stderrTail = (n = 15): string => {\n      if (stderrLines.length === 0) return '';\n      const tail = stderrLines.slice(-n).map(sanitizeCloudflaredOutput).join('');\n      return `\\ncloudflared 출력 (마지막 ${Math.min(n, stderrLines.length)}줄):\\n${tail}`;\n    };\n\n    const timer = setTimeout(() => {\n      cleanup();\n      stop();\n      reject(\n        new Error(\n          `[@ait-co/devtools] cloudflared did not report a tunnel URL within ${\n            URL_TIMEOUT_MS / 1000\n          }s. Check your network connection, or run \\`cloudflared tunnel --url http://localhost:${port}\\` manually.${stderrTail()}`,\n        ),\n      );\n    }, URL_TIMEOUT_MS);\n\n    const onUrl = (line: string) => {\n      const found = parseTrycloudflareUrl(line);\n      if (!found) return;\n      clearTimeout(timer);\n      // Stop scanning further output once we have the URL.\n      cleanup();\n      resolve({ url: found, stop });\n    };\n\n    // Accumulate stderr lines for diagnostics (#421). Named so it can be\n    // removed from the listener list when cleanup() runs.\n    const pushStderr = (line: string) => {\n      stderrLines.push(line);\n    };\n\n    const cleanup = () => {\n      tunnel.off('stdout', onUrl);\n      tunnel.off('stderr', onUrl);\n      tunnel.off('stderr', pushStderr);\n    };\n\n    // The library emits a parsed `url` event; we also scan raw stdout/stderr in\n    // case the output format shifts.\n    tunnel.once('url', onUrl);\n    tunnel.on('stdout', onUrl);\n    tunnel.on('stderr', onUrl);\n    // Second stderr listener: accumulate all lines for error diagnostics.\n    tunnel.on('stderr', pushStderr);\n    tunnel.once('error', (err: Error) => {\n      clearTimeout(timer);\n      cleanup();\n      stop();\n      reject(err);\n    });\n    tunnel.once('exit', (code: number | null) => {\n      if (stopped) return;\n      clearTimeout(timer);\n      cleanup();\n      reject(\n        new Error(\n          `[@ait-co/devtools] cloudflared exited (code ${code ?? 'null'}) before reporting a tunnel URL.${stderrTail()}`,\n        ),\n      );\n    });\n  });\n}\n"],"mappings":";;;;;;;;;;;;;;;;AAiBA,MAAM,mBAAmB;;;;;;AAOzB,SAAgB,sBAAsB,MAA6B;CACjE,MAAM,IAAI,KAAK,MAAM,iBAAiB;AACtC,QAAO,IAAI,EAAE,KAAK;;AAiBpB,MAAM,eAAe;;;;;;;;;;;;;;AAerB,SAAgB,sBAAsB,WAAmB,aAA8B;CACrF,MAAM,OAAO,GAAG,aAAa,OAAO,mBAAmB,UAAU;AACjE,KAAI,CAAC,YAAa,QAAO;AACzB,QAAO,GAAG,KAAK,iBAAiB,mBAAmB,YAAY;;;;;;;;AASjE,eAAsB,kBACpB,KACA,OAAiC,EAAE,EACpB;CACf,MAAM,MAAM,KAAK,SAAS,MAAc,QAAQ,IAAI,EAAE;CACtD,MAAM,WAAW,sBAAsB,KAAK,KAAK,YAAY;AAoB7D,KAnBwB;EACtB;EACA;EACA,QAAQ;EACR;EACA,wCAAwC;EACxC;EACA;EACA,GAAI,KAAK,cACL,CACE,+DACA,uDACD,GACD,EAAE;EACN;EACA;EACA;EACA;EACD,CACS,KAAK,KAAK,CAAC;AAErB,KAAI,KAAK,OAAO,OAAO;EAGrB,MAAM,UAAU,MAAM,OAAO,oBAAoB;AACjD,QAAM,IAAI,SAAe,YAAY;AACnC,UAAO,SAAS,UAAU,EAAE,OAAO,MAAM,GAAG,QAAQ;AAClD,QAAI,IAAI;AACR,aAAS;KACT;IACF;;;;;;;;;;;;;AAcN,SAAS,iBAA0B;AACjC,KAAI,QAAQ,IAAI,OAAO,UAAU,QAAQ,IAAI,OAAO,IAAK,QAAO;CAChE,MAAM,WAAW,QAAQ;AACzB,KAAI,aAAa,YAAY,aAAa,QAAS,QAAO;AAC1D,KAAI,aAAa,QACf,QAAO,QAAQ,QAAQ,IAAI,WAAW,QAAQ,IAAI,gBAAgB;AAEpE,QAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAsDT,eAAsB,qBACpB,MACsC;CACtC,MAAM,MAAM,KAAK,SAAS,MAAc,QAAQ,IAAI,EAAE;AAGtD,KAAI,CAAC,KAAK,YAAa,QAAO,KAAA;AAE9B,KAAI,KAAK,OAAO,MAAO,QAAO,KAAA;CAI9B,MAAM,EAAE,2BAA2B,MAAM,OAAO;AAEhD,KAAI,EADa,KAAK,qBAAqB,CAAC,wBAAwB,IAAI,gBAAgB,IACzE,CAAE,QAAO,KAAA;CAExB,MAAM,EAAE,sBAAsB,MAAM,OAAO;CAC3C,MAAM,EAAE,2BAA2B,MAAM,OAAO;CAChD,MAAM,EAAE,iBAAiB,MAAM,OAAO;CAQtC,MAAM,0BAA0B;EAC9B,MAAM,SAAS,QAAQ,IAAI;EAC3B,MAAM,WAAW,SAAS,aAAa,QAAQ,KAAK,KAAK,CAAC,GAAG,KAAA;EAC7D,MAAM,YAAY,uBAAuB,KAAK,WAAW,KAAK,aAAa,SAAS;AAKpF,SAAO;GAAE,QAAQ;IAAE,IAAI;IAAM,QAAQ,KAAK;IAAa;GAAE,OAAO;GAAM;GAAW;;CAGnF,IAAI;AACJ,KAAI;AACF,WAAS,MAAM,kBAAkB,kBAAkB;SAC7C;AAGN;;CAWF,IAAI,oBAA2D,kBAAkB;AAC/E,SAAO,mBAAmB;IAFK,IAGL;AAC5B,mBAAkB,OAAO;CAEzB,MAAM,eAAe,oBAAoB,OAAO;CAEhD,MAAM,EAAE,qBAAqB,MAAM,OAAO;AAI1C,KAHe,iBAAiB,aAAa,GAKvC,+CAA+C,iBAC/C,gDAAgD,eACrD;AAED,QAAO;EACL,KAAK;EACL,aAAa;AACX,OAAI,mBAAmB;AACrB,kBAAc,kBAAkB;AAChC,wBAAoB;;AAEtB,UAAO,OAAO,OAAO;;EAExB;;;;;;;;;;;;AAoBH,SAAgB,0BAA0B,MAAsB;CAE9D,IAAI,IAAI,KAAK,QAAQ,sEAAsE,MACzF,EAAE,QAAQ,mCAAmC,2BAA2B,CACzE;AAED,KAAI,EAAE,QAAQ,oCAAoC,2BAA2B;AAC7E,QAAO;;AAGT,MAAM,iBAAiB;;;;;;;AAQvB,eAAsB,iBAAiB,MAAoC;CAEzE,MAAM,EAAE,KAAK,SAAS,WADF,MAAM,OAAO;AAGjC,KAAI,CAAC,WAAW,IAAI,EAAE;AACpB,QAAM,MAAM,QAAQ,IAAI,EAAE,EAAE,WAAW,MAAM,CAAC;AAC9C,QAAM,QAAQ,IAAI;;CAGpB,MAAM,SAAS,OAAO,MAAM,oBAAoB,OAAO;CACvD,IAAI,UAAU;CACd,MAAM,aAAa;AACjB,MAAI,QAAS;AACb,YAAU;AACV,MAAI;AACF,UAAO,MAAM;UACP;;AAKV,QAAO,IAAI,SAAsB,SAAS,WAAW;EAGnD,MAAM,cAAwB,EAAE;;;;;EAMhC,MAAM,cAAc,IAAI,OAAe;AACrC,OAAI,YAAY,WAAW,EAAG,QAAO;GACrC,MAAM,OAAO,YAAY,MAAM,CAAC,EAAE,CAAC,IAAI,0BAA0B,CAAC,KAAK,GAAG;AAC1E,UAAO,yBAAyB,KAAK,IAAI,GAAG,YAAY,OAAO,CAAC,OAAO;;EAGzE,MAAM,QAAQ,iBAAiB;AAC7B,YAAS;AACT,SAAM;AACN,0BACE,IAAI,MACF,qEACE,iBAAiB,IAClB,uFAAuF,KAAK,cAAc,YAAY,GACxH,CACF;KACA,eAAe;EAElB,MAAM,SAAS,SAAiB;GAC9B,MAAM,QAAQ,sBAAsB,KAAK;AACzC,OAAI,CAAC,MAAO;AACZ,gBAAa,MAAM;AAEnB,YAAS;AACT,WAAQ;IAAE,KAAK;IAAO;IAAM,CAAC;;EAK/B,MAAM,cAAc,SAAiB;AACnC,eAAY,KAAK,KAAK;;EAGxB,MAAM,gBAAgB;AACpB,UAAO,IAAI,UAAU,MAAM;AAC3B,UAAO,IAAI,UAAU,MAAM;AAC3B,UAAO,IAAI,UAAU,WAAW;;AAKlC,SAAO,KAAK,OAAO,MAAM;AACzB,SAAO,GAAG,UAAU,MAAM;AAC1B,SAAO,GAAG,UAAU,MAAM;AAE1B,SAAO,GAAG,UAAU,WAAW;AAC/B,SAAO,KAAK,UAAU,QAAe;AACnC,gBAAa,MAAM;AACnB,YAAS;AACT,SAAM;AACN,UAAO,IAAI;IACX;AACF,SAAO,KAAK,SAAS,SAAwB;AAC3C,OAAI,QAAS;AACb,gBAAa,MAAM;AACnB,YAAS;AACT,0BACE,IAAI,MACF,+CAA+C,QAAQ,OAAO,kCAAkC,YAAY,GAC7G,CACF;IACD;GACF"}
+{"version":3,"file":"tunnel-fm4hDfV-.js","names":[],"sources":["../src/unplugin/tunnel.ts"],"sourcesContent":["/**\n * Cloudflare quick-tunnel helper for the devtools unplugin.\n *\n * Loaded lazily (`await import('./tunnel.js')`) only when the `tunnel` option is\n * on, so `cloudflared` / `qrcode-terminal` are never pulled in for the common\n * case. This is the one place in `@ait-co/devtools` that depends on Node-only\n * APIs (`child_process` via the `cloudflared` wrapper) — keep it thin and out of\n * jsdom unit tests; the spawn path is verified by hand / e2e (same spirit as the\n * \"web 모드는 e2e\" rule in CLAUDE.md). The pure helpers below\n * (`parseTrycloudflareUrl`, `printTunnelBanner`) are unit-tested.\n */\n\nimport { existsSync } from 'node:fs';\nimport { mkdir } from 'node:fs/promises';\nimport { dirname } from 'node:path';\n\n/** Matches the public URL cloudflared prints for an unauthenticated quick tunnel. */\nconst TRYCLOUDFLARE_RE = /https:\\/\\/[a-z0-9-]+\\.trycloudflare\\.com/i;\n\n/**\n * Extract the `https://<sub>.trycloudflare.com` URL from a line of cloudflared\n * output, or `null` if the line doesn't contain one. Pulled out as a pure\n * function so it can be unit-tested without spawning anything.\n */\nexport function parseTrycloudflareUrl(line: string): string | null {\n  const m = line.match(TRYCLOUDFLARE_RE);\n  return m ? m[0] : null;\n}\n\nexport interface PrintTunnelBannerOptions {\n  /** Print an ASCII QR encoding the tunnel URL (default: true). */\n  qr?: boolean;\n  /** Sink for the banner text (default: `console.log`). Injected for testing. */\n  log?: (msg: string) => void;\n  /**\n   * The `wss://` relay URL of the env-2 CDP tunnel, if `tunnel.cdp` is on. When\n   * present the QR deep-link additionally carries `&debug=1&relay=<wss>` so the\n   * framed PWA passes the in-app debug gate and attaches a Chii target — the\n   * same single scan opens screen preview *and* CDP debugging.\n   */\n  relayWssUrl?: string;\n}\n\nconst LAUNCHER_URL = 'https://devtools.aitc.dev/launcher/';\n\n/**\n * Build the deep-link URL that QR codes encode: when the launcher PWA is\n * already on the phone's home screen, scanning this opens it directly into the\n * live view for `tunnelUrl` (the launcher consumes `?url=` and clears it).\n * Plain-text raw URL is no longer enough — the launcher gates its setup UI to\n * the installed PWA, so a raw tunnel URL opened in a normal browser tab would\n * land on a \"please install\" screen.\n *\n * When `relayWssUrl` is given (env-2 CDP wiring), the deep-link also carries\n * `&debug=1&relay=<wss>`; the launcher folds those onto the framed tunnel URL so\n * the in-app debug gate's Layer C (`debug=1` opt-in + `relay=<wss>`) is met and\n * a Chii target.js is injected into the live view.\n */\nexport function buildLauncherDeepLink(tunnelUrl: string, relayWssUrl?: string): string {\n  const base = `${LAUNCHER_URL}?url=${encodeURIComponent(tunnelUrl)}`;\n  if (!relayWssUrl) return base;\n  return `${base}&debug=1&relay=${encodeURIComponent(relayWssUrl)}`;\n}\n\n/**\n * Print the terminal banner announcing the live tunnel: the public URL, an ASCII\n * QR encoding a launcher deep-link, and a one-line note that quick tunnels are\n * ephemeral, unauthenticated and not for production. Pure w.r.t. side effects\n * other than the injected `log` sink and `qrcode-terminal` — unit-tested.\n */\nexport async function printTunnelBanner(\n  url: string,\n  opts: PrintTunnelBannerOptions = {},\n): Promise<void> {\n  const log = opts.log ?? ((m: string) => console.log(m));\n  const deepLink = buildLauncherDeepLink(url, opts.relayWssUrl);\n  const lines: string[] = [\n    '',\n    '  ┌─ @ait-co/devtools · live tunnel ────────────────────────────',\n    `  │  ${url}`,\n    '  │',\n    `  │  Install the launcher PWA once:  ${LAUNCHER_URL}`,\n    '  │  Then scan the QR below — it opens the launcher directly',\n    '  │  into this tunnel URL (no manual paste needed).',\n    ...(opts.relayWssUrl\n      ? [\n          '  │  The same scan also attaches CDP — connect your AI host',\n          '  │  to the relay and debug the live view on-device.',\n        ]\n      : []),\n    '  │  Quick tunnels are unauthenticated, change every run, and are',\n    '  │  not for production use.',\n    '  └──────────────────────────────────────────────────────────────',\n    '',\n  ];\n  log(lines.join('\\n'));\n\n  if (opts.qr !== false) {\n    // qrcode-terminal is only pulled in on this code path (ambient types live\n    // in src/qrcode-terminal.d.ts).\n    const qrcode = (await import('qrcode-terminal')).default;\n    await new Promise<void>((resolve) => {\n      qrcode.generate(deepLink, { small: true }, (out) => {\n        log(out);\n        resolve();\n      });\n    });\n  }\n}\n\n/**\n * Heuristic: can this process open a GUI browser? Mirrors `canOpenBrowser` in\n * `src/mcp/tools.ts` but is re-declared here (not imported) so the tunnel path\n * does not statically pull the heavy MCP `tools.ts` module graph into the lazy\n * `import('./tunnel.js')` chunk. Kept in sync with the MCP copy.\n *\n *   - macOS / Windows → assume yes (env-2 dev normally runs on the user's Mac).\n *   - Linux → require `DISPLAY` or `WAYLAND_DISPLAY`.\n *   - CI (`CI=true`/`CI=1`) → no.\n */\nfunction canOpenBrowser(): boolean {\n  if (process.env.CI === 'true' || process.env.CI === '1') return false;\n  const platform = process.platform;\n  if (platform === 'darwin' || platform === 'win32') return true;\n  if (platform === 'linux') {\n    return Boolean(process.env.DISPLAY ?? process.env.WAYLAND_DISPLAY);\n  }\n  return false;\n}\n\n/** Handle returned by {@link startTunnelDashboard}. */\nexport interface TunnelDashboard {\n  /** `http://127.0.0.1:<port>` — the local dashboard URL opened in the browser. */\n  url: string;\n  /** Tear down the local HTTP server. Idempotent via the underlying server. */\n  close: () => Promise<void>;\n}\n\nexport interface StartTunnelDashboardOptions {\n  /** The public `https://*.trycloudflare.com` app tunnel URL the launcher frames. */\n  tunnelUrl: string;\n  /** The `wss://` relay URL of the env-2 CDP tunnel. REQUIRED — the dashboard is a CDP-only UX. */\n  relayWssUrl: string;\n  /** Mirror of `tunnel.qr` — when `false` the dashboard is skipped (no browser open). */\n  qr?: boolean;\n  /**\n   * Override the GUI/opt-out gate (testing only). When omitted the real\n   * `canOpenBrowser()` + `AIT_AUTO_DEVTOOLS` checks decide.\n   */\n  shouldOpen?: () => boolean;\n  /** Sink for the one-line \"opened in browser\" note (default: `console.log`). Injected for testing. */\n  log?: (msg: string) => void;\n}\n\n/**\n * Env-2 UX parity with env 3/4 (issue #408): when CDP wiring is on and a GUI is\n * available, start the SAME `127.0.0.1` HTML dashboard (QR image + connect steps\n * + FAQ) that the MCP `build_attach_url` path serves, and auto-open it in the\n * browser. headless / opt-out falls back to the terminal ASCII QR (printed\n * separately by {@link printTunnelBanner}).\n *\n * Every part the install-graph invariant depends on (`qrcode`, the MCP HTTP\n * server, the opener) is reached only through dynamic `import()` here, inside\n * the already-lazy `tunnel.js` chunk — nothing is added to the common build\n * graph or the MCP-only install graph.\n *\n * TOTP encapsulation: the dashboard's `getDashboardState` closure mints a FRESH\n * TOTP `at=` code on every call via `generateTotp(secret, Date.now())` and folds\n * it into a fresh `buildLauncherAttachUrl(...)`. Because the QR is re-rendered on\n * each SSE push / page reload from this closure, the code a phone scans is always\n * within its 30 s window — no stale code is baked into static HTML.\n *\n * SECRET-HANDLING: the tunnel host, relay wssUrl, TOTP code, and `.ait_relay`\n * value/path are NEVER written to stdout/stderr/logs here. They live only inside\n * the attach URL (HTML body + `/qr.png` query, per qr-http-server's invariant).\n * The only thing opened/logged is `http://127.0.0.1:<port>` (local, safe).\n *\n * @returns the dashboard handle when it started (caller wires `close()` into the\n *   tunnel cleanup), or `undefined` when skipped (no relay, `qr:false`, headless,\n *   opt-out, or a start failure) — in which case ASCII QR fallback stands alone.\n */\nexport async function startTunnelDashboard(\n  opts: StartTunnelDashboardOptions,\n): Promise<TunnelDashboard | undefined> {\n  const log = opts.log ?? ((m: string) => console.log(m));\n\n  // Gate: dashboard is a CDP-only UX (needs a relay to attach to).\n  if (!opts.relayWssUrl) return undefined;\n  // Opt-out via `tunnel.qr:false` (same toggle that suppresses the ASCII QR).\n  if (opts.qr === false) return undefined;\n\n  // GUI + AIT_AUTO_DEVTOOLS gate. Reuse the MCP opener's opt-out predicate so\n  // the env-2 path honours the same `AIT_AUTO_DEVTOOLS=0` switch as env 3/4.\n  const { isAutoDevtoolsDisabled } = await import('../mcp/devtools-opener.js');\n  const gateOpen = opts.shouldOpen ?? (() => !isAutoDevtoolsDisabled() && canOpenBrowser());\n  if (!gateOpen()) return undefined;\n\n  const { startQrHttpServer } = await import('../mcp/qr-http-server.js');\n  const { buildLauncherAttachUrl } = await import('../mcp/deeplink.js');\n  const { generateTotp } = await import('../mcp/totp.js');\n\n  // getDashboardState — mints a fresh TOTP + attach URL on every call so the QR\n  // the dashboard renders (on load and on each SSE push) is never expired.\n  // SECRET-HANDLING: the secret is read from env AT CALL TIME (it was injected\n  // by ensureRelaySecret in the same CDP block) and is used only to compute the\n  // at= code folded into attachUrl. tunnel.up is always true here — the relay\n  // tunnel is already up by the time this runs.\n  const getDashboardState = () => {\n    const secret = process.env.AIT_DEBUG_TOTP_SECRET;\n    const totpCode = secret ? generateTotp(secret, Date.now()) : undefined;\n    const attachUrl = buildLauncherAttachUrl(opts.tunnelUrl, opts.relayWssUrl, totpCode);\n    // pages: null — env 2(unplugin)는 데몬이 아니라 vite 플러그인 안이라\n    // startChiiRelay 핸들이 connected target을 노출하지 않는다. 라이브 page 목록을\n    // 알 수 없으므로 거짓 빈 목록 대신 \"연결된 Pages\" 섹션 자체를 숨긴다(#411).\n    // env 3/4(debug-server.ts)는 router.active.listTargets()로 실제 목록을 채운다.\n    return { tunnel: { up: true, wssUrl: opts.relayWssUrl }, pages: null, attachUrl };\n  };\n\n  let server: Awaited<ReturnType<typeof startQrHttpServer>>;\n  try {\n    server = await startQrHttpServer(getDashboardState);\n  } catch {\n    // SECRET-HANDLING: do not surface the error (could embed paths/hosts). The\n    // ASCII QR printed by printTunnelBanner stays as the fallback.\n    return undefined;\n  }\n\n  // TOTP periodic refresh timer — pushes a fresh at= code to SSE clients every\n  // 20 s so a page left open never stales past the 90 s acceptance window (#448).\n  // tunnel.ts always has relayWssUrl available here (gated above), so no\n  // lastAttachParts guard is needed — getDashboardState mints a fresh TOTP on\n  // every call unconditionally.\n  // SECRET-HANDLING: callback is a plain trigger only — TOTP value and at= code\n  // must never be logged or written to stdout.\n  const TOTP_REFRESH_INTERVAL_MS = 20_000;\n  let totpRefreshHandle: ReturnType<typeof setInterval> | null = setInterval(() => {\n    server.notifyStateChange();\n  }, TOTP_REFRESH_INTERVAL_MS);\n  totpRefreshHandle.unref();\n\n  const dashboardUrl = `http://127.0.0.1:${server.port}`;\n\n  const { openUrlInBrowser } = await import('../mcp/devtools-opener.js');\n  const opened = openUrlInBrowser(dashboardUrl);\n  // SECRET-HANDLING: only the local 127.0.0.1 URL is logged — never the tunnel\n  // host, relay wssUrl, or TOTP code.\n  log(\n    opened\n      ? `  │  Opened a QR dashboard in your browser: ${dashboardUrl}`\n      : `  │  Open this QR dashboard in your browser: ${dashboardUrl}`,\n  );\n\n  return {\n    url: dashboardUrl,\n    close: () => {\n      if (totpRefreshHandle) {\n        clearInterval(totpRefreshHandle);\n        totpRefreshHandle = null;\n      }\n      return server.close();\n    },\n  };\n}\n\nexport interface QuickTunnel {\n  /** The public `https://*.trycloudflare.com` URL. */\n  url: string;\n  /** Stop the underlying `cloudflared` process. Idempotent. */\n  stop: () => void;\n}\n\n/**\n * Sanitize cloudflared stderr output for error diagnostics (#421).\n *\n * Masks `*.trycloudflare.com` hostnames and full `https://` / `wss://` URLs\n * that carry those hostnames so tunnel host values never appear in error\n * messages. Diagnostic content (error codes, reasons, JSON blobs) is preserved.\n *\n * SECRET-HANDLING: tunnel host is SECRET-class per harness policy — only\n * placeholder text is emitted.\n */\nexport function sanitizeCloudflaredOutput(line: string): string {\n  // Full URL forms: https://xxx.trycloudflare.com/… and wss://xxx.trycloudflare.com/…\n  let s = line.replace(/(?:https?|wss?):\\/\\/[a-z0-9-]+\\.trycloudflare\\.com(?:\\/[^\\s]*)*/gi, (m) =>\n    m.replace(/[a-z0-9-]+\\.trycloudflare\\.com/i, '<HOST>.trycloudflare.com'),\n  );\n  // Bare hostname without scheme (e.g. printed in cloudflared JSON logs)\n  s = s.replace(/[a-z0-9-]+\\.trycloudflare\\.com/gi, '<HOST>.trycloudflare.com');\n  return s;\n}\n\nconst URL_TIMEOUT_MS = 20_000;\n\n/**\n * Start an unauthenticated Cloudflare quick tunnel to `http://localhost:<port>`\n * and resolve once the public URL is known. Downloads the `cloudflared` binary\n * on first use if it is not already installed. Rejects with a friendly error if\n * no URL appears within {@link URL_TIMEOUT_MS}.\n */\nexport async function startQuickTunnel(port: number): Promise<QuickTunnel> {\n  const cloudflared = await import('cloudflared');\n  const { bin, install, Tunnel } = cloudflared;\n\n  if (!existsSync(bin)) {\n    await mkdir(dirname(bin), { recursive: true });\n    await install(bin);\n  }\n\n  const tunnel = Tunnel.quick(`http://localhost:${port}`);\n  let stopped = false;\n  const stop = () => {\n    if (stopped) return;\n    stopped = true;\n    try {\n      tunnel.stop();\n    } catch {\n      // process may already be gone\n    }\n  };\n\n  return new Promise<QuickTunnel>((resolve, reject) => {\n    // #421: accumulate stderr to attach as diagnostics on failure.\n    // SECRET-HANDLING: lines are sanitized before inclusion in error messages.\n    const stderrLines: string[] = [];\n\n    /**\n     * Format the last `n` sanitized stderr lines as a diagnostic appendix.\n     * Returns an empty string when no lines have been collected.\n     */\n    const stderrTail = (n = 15): string => {\n      if (stderrLines.length === 0) return '';\n      const tail = stderrLines.slice(-n).map(sanitizeCloudflaredOutput).join('');\n      return `\\ncloudflared 출력 (마지막 ${Math.min(n, stderrLines.length)}줄):\\n${tail}`;\n    };\n\n    const timer = setTimeout(() => {\n      cleanup();\n      stop();\n      reject(\n        new Error(\n          `[@ait-co/devtools] cloudflared did not report a tunnel URL within ${\n            URL_TIMEOUT_MS / 1000\n          }s. Check your network connection, or run \\`cloudflared tunnel --url http://localhost:${port}\\` manually.${stderrTail()}`,\n        ),\n      );\n    }, URL_TIMEOUT_MS);\n\n    const onUrl = (line: string) => {\n      const found = parseTrycloudflareUrl(line);\n      if (!found) return;\n      clearTimeout(timer);\n      // Stop scanning further output once we have the URL.\n      cleanup();\n      resolve({ url: found, stop });\n    };\n\n    // Accumulate stderr lines for diagnostics (#421). Named so it can be\n    // removed from the listener list when cleanup() runs.\n    const pushStderr = (line: string) => {\n      stderrLines.push(line);\n    };\n\n    const cleanup = () => {\n      tunnel.off('stdout', onUrl);\n      tunnel.off('stderr', onUrl);\n      tunnel.off('stderr', pushStderr);\n    };\n\n    // The library emits a parsed `url` event; we also scan raw stdout/stderr in\n    // case the output format shifts.\n    tunnel.once('url', onUrl);\n    tunnel.on('stdout', onUrl);\n    tunnel.on('stderr', onUrl);\n    // Second stderr listener: accumulate all lines for error diagnostics.\n    tunnel.on('stderr', pushStderr);\n    tunnel.once('error', (err: Error) => {\n      clearTimeout(timer);\n      cleanup();\n      stop();\n      reject(err);\n    });\n    tunnel.once('exit', (code: number | null) => {\n      if (stopped) return;\n      clearTimeout(timer);\n      cleanup();\n      reject(\n        new Error(\n          `[@ait-co/devtools] cloudflared exited (code ${code ?? 'null'}) before reporting a tunnel URL.${stderrTail()}`,\n        ),\n      );\n    });\n  });\n}\n"],"mappings":";;;;;;;;;;;;;;;;AAiBA,MAAM,mBAAmB;;;;;;AAOzB,SAAgB,sBAAsB,MAA6B;CACjE,MAAM,IAAI,KAAK,MAAM,iBAAiB;AACtC,QAAO,IAAI,EAAE,KAAK;;AAiBpB,MAAM,eAAe;;;;;;;;;;;;;;AAerB,SAAgB,sBAAsB,WAAmB,aAA8B;CACrF,MAAM,OAAO,GAAG,aAAa,OAAO,mBAAmB,UAAU;AACjE,KAAI,CAAC,YAAa,QAAO;AACzB,QAAO,GAAG,KAAK,iBAAiB,mBAAmB,YAAY;;;;;;;;AASjE,eAAsB,kBACpB,KACA,OAAiC,EAAE,EACpB;CACf,MAAM,MAAM,KAAK,SAAS,MAAc,QAAQ,IAAI,EAAE;CACtD,MAAM,WAAW,sBAAsB,KAAK,KAAK,YAAY;AAoB7D,KAnBwB;EACtB;EACA;EACA,QAAQ;EACR;EACA,wCAAwC;EACxC;EACA;EACA,GAAI,KAAK,cACL,CACE,+DACA,uDACD,GACD,EAAE;EACN;EACA;EACA;EACA;EACD,CACS,KAAK,KAAK,CAAC;AAErB,KAAI,KAAK,OAAO,OAAO;EAGrB,MAAM,UAAU,MAAM,OAAO,oBAAoB;AACjD,QAAM,IAAI,SAAe,YAAY;AACnC,UAAO,SAAS,UAAU,EAAE,OAAO,MAAM,GAAG,QAAQ;AAClD,QAAI,IAAI;AACR,aAAS;KACT;IACF;;;;;;;;;;;;;AAcN,SAAS,iBAA0B;AACjC,KAAI,QAAQ,IAAI,OAAO,UAAU,QAAQ,IAAI,OAAO,IAAK,QAAO;CAChE,MAAM,WAAW,QAAQ;AACzB,KAAI,aAAa,YAAY,aAAa,QAAS,QAAO;AAC1D,KAAI,aAAa,QACf,QAAO,QAAQ,QAAQ,IAAI,WAAW,QAAQ,IAAI,gBAAgB;AAEpE,QAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAsDT,eAAsB,qBACpB,MACsC;CACtC,MAAM,MAAM,KAAK,SAAS,MAAc,QAAQ,IAAI,EAAE;AAGtD,KAAI,CAAC,KAAK,YAAa,QAAO,KAAA;AAE9B,KAAI,KAAK,OAAO,MAAO,QAAO,KAAA;CAI9B,MAAM,EAAE,2BAA2B,MAAM,OAAO;AAEhD,KAAI,EADa,KAAK,qBAAqB,CAAC,wBAAwB,IAAI,gBAAgB,IACzE,CAAE,QAAO,KAAA;CAExB,MAAM,EAAE,sBAAsB,MAAM,OAAO;CAC3C,MAAM,EAAE,2BAA2B,MAAM,OAAO;CAChD,MAAM,EAAE,iBAAiB,MAAM,OAAO;CAQtC,MAAM,0BAA0B;EAC9B,MAAM,SAAS,QAAQ,IAAI;EAC3B,MAAM,WAAW,SAAS,aAAa,QAAQ,KAAK,KAAK,CAAC,GAAG,KAAA;EAC7D,MAAM,YAAY,uBAAuB,KAAK,WAAW,KAAK,aAAa,SAAS;AAKpF,SAAO;GAAE,QAAQ;IAAE,IAAI;IAAM,QAAQ,KAAK;IAAa;GAAE,OAAO;GAAM;GAAW;;CAGnF,IAAI;AACJ,KAAI;AACF,WAAS,MAAM,kBAAkB,kBAAkB;SAC7C;AAGN;;CAWF,IAAI,oBAA2D,kBAAkB;AAC/E,SAAO,mBAAmB;IAFK,IAGL;AAC5B,mBAAkB,OAAO;CAEzB,MAAM,eAAe,oBAAoB,OAAO;CAEhD,MAAM,EAAE,qBAAqB,MAAM,OAAO;AAI1C,KAHe,iBAAiB,aAAa,GAKvC,+CAA+C,iBAC/C,gDAAgD,eACrD;AAED,QAAO;EACL,KAAK;EACL,aAAa;AACX,OAAI,mBAAmB;AACrB,kBAAc,kBAAkB;AAChC,wBAAoB;;AAEtB,UAAO,OAAO,OAAO;;EAExB;;;;;;;;;;;;AAoBH,SAAgB,0BAA0B,MAAsB;CAE9D,IAAI,IAAI,KAAK,QAAQ,sEAAsE,MACzF,EAAE,QAAQ,mCAAmC,2BAA2B,CACzE;AAED,KAAI,EAAE,QAAQ,oCAAoC,2BAA2B;AAC7E,QAAO;;AAGT,MAAM,iBAAiB;;;;;;;AAQvB,eAAsB,iBAAiB,MAAoC;CAEzE,MAAM,EAAE,KAAK,SAAS,WADF,MAAM,OAAO;AAGjC,KAAI,CAAC,WAAW,IAAI,EAAE;AACpB,QAAM,MAAM,QAAQ,IAAI,EAAE,EAAE,WAAW,MAAM,CAAC;AAC9C,QAAM,QAAQ,IAAI;;CAGpB,MAAM,SAAS,OAAO,MAAM,oBAAoB,OAAO;CACvD,IAAI,UAAU;CACd,MAAM,aAAa;AACjB,MAAI,QAAS;AACb,YAAU;AACV,MAAI;AACF,UAAO,MAAM;UACP;;AAKV,QAAO,IAAI,SAAsB,SAAS,WAAW;EAGnD,MAAM,cAAwB,EAAE;;;;;EAMhC,MAAM,cAAc,IAAI,OAAe;AACrC,OAAI,YAAY,WAAW,EAAG,QAAO;GACrC,MAAM,OAAO,YAAY,MAAM,CAAC,EAAE,CAAC,IAAI,0BAA0B,CAAC,KAAK,GAAG;AAC1E,UAAO,yBAAyB,KAAK,IAAI,GAAG,YAAY,OAAO,CAAC,OAAO;;EAGzE,MAAM,QAAQ,iBAAiB;AAC7B,YAAS;AACT,SAAM;AACN,0BACE,IAAI,MACF,qEACE,iBAAiB,IAClB,uFAAuF,KAAK,cAAc,YAAY,GACxH,CACF;KACA,eAAe;EAElB,MAAM,SAAS,SAAiB;GAC9B,MAAM,QAAQ,sBAAsB,KAAK;AACzC,OAAI,CAAC,MAAO;AACZ,gBAAa,MAAM;AAEnB,YAAS;AACT,WAAQ;IAAE,KAAK;IAAO;IAAM,CAAC;;EAK/B,MAAM,cAAc,SAAiB;AACnC,eAAY,KAAK,KAAK;;EAGxB,MAAM,gBAAgB;AACpB,UAAO,IAAI,UAAU,MAAM;AAC3B,UAAO,IAAI,UAAU,MAAM;AAC3B,UAAO,IAAI,UAAU,WAAW;;AAKlC,SAAO,KAAK,OAAO,MAAM;AACzB,SAAO,GAAG,UAAU,MAAM;AAC1B,SAAO,GAAG,UAAU,MAAM;AAE1B,SAAO,GAAG,UAAU,WAAW;AAC/B,SAAO,KAAK,UAAU,QAAe;AACnC,gBAAa,MAAM;AACnB,YAAS;AACT,SAAM;AACN,UAAO,IAAI;IACX;AACF,SAAO,KAAK,SAAS,SAAwB;AAC3C,OAAI,QAAS;AACb,gBAAa,MAAM;AACnB,YAAS;AACT,0BACE,IAAI,MACF,+CAA+C,QAAQ,OAAO,kCAAkC,YAAY,GAC7G,CACF;IACD;GACF"}

package/dist/unplugin/index.cjs

@@ -224,7 +224,7 @@ const aitDevtoolsPlugin = (0, unplugin.createUnplugin)((options) => {
 							console.warn("[@ait-co/devtools] tunnel: could not determine the dev server port; skipping.");
 							return;
 						}
-						Promise.resolve().then(() => require("../tunnel-H7VujZz5.cjs")).then(async ({ startQuickTunnel, printTunnelBanner, startTunnelDashboard }) => {
+						Promise.resolve().then(() => require("../tunnel-BpllDsRw.cjs")).then(async ({ startQuickTunnel, printTunnelBanner, startTunnelDashboard }) => {
 							const t = await startQuickTunnel(port);
 							tunnel = t;
 							let relayWssUrl;

package/dist/unplugin/index.js

@@ -220,7 +220,7 @@ const aitDevtoolsPlugin = createUnplugin((options) => {
 							console.warn("[@ait-co/devtools] tunnel: could not determine the dev server port; skipping.");
 							return;
 						}
-						import("../tunnel-CIc0oSit.js").then(async ({ startQuickTunnel, printTunnelBanner, startTunnelDashboard }) => {
+						import("../tunnel-fm4hDfV-.js").then(async ({ startQuickTunnel, printTunnelBanner, startTunnelDashboard }) => {
 							const t = await startQuickTunnel(port);
 							tunnel = t;
 							let relayWssUrl;

package/dist/unplugin/tunnel.cjs

@@ -127,7 +127,7 @@ async function startTunnelDashboard(opts) {
 	if (opts.qr === false) return void 0;
 	const { isAutoDevtoolsDisabled } = await Promise.resolve().then(() => require("../devtools-opener-h6A-UjzC.cjs"));
 	if (!(opts.shouldOpen ?? (() => !isAutoDevtoolsDisabled() && canOpenBrowser()))()) return void 0;
-	const { startQrHttpServer } = await Promise.resolve().then(() => require("../qr-http-server-C34O140J.cjs"));
+	const { startQrHttpServer } = await Promise.resolve().then(() => require("../qr-http-server-CMJmKkb8.cjs"));
 	const { buildLauncherAttachUrl } = await Promise.resolve().then(() => require("../deeplink-CCGiyoHq.cjs"));
 	const { generateTotp } = await Promise.resolve().then(() => require("../totp-D9rndqg_.cjs"));
 	const getDashboardState = () => {

package/dist/unplugin/tunnel.js

@@ -126,7 +126,7 @@ async function startTunnelDashboard(opts) {
 	if (opts.qr === false) return void 0;
 	const { isAutoDevtoolsDisabled } = await import("../devtools-opener-D84kZFtR.js");
 	if (!(opts.shouldOpen ?? (() => !isAutoDevtoolsDisabled() && canOpenBrowser()))()) return void 0;
-	const { startQrHttpServer } = await import("../qr-http-server-Dp3a1AMl.js");
+	const { startQrHttpServer } = await import("../qr-http-server-BuyQnaS6.js");
 	const { buildLauncherAttachUrl } = await import("../deeplink-Cqli4qzm.js");
 	const { generateTotp } = await import("../totp-BxtxuEt4.js");
 	const getDashboardState = () => {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ait-co/devtools",
-  "version": "0.1.64",
+  "version": "0.1.66",
   "description": "Development tools for Apps in Toss mini-apps — mock SDK, floating devtools panel, and universal bundler plugin",
   "type": "module",
   "engines": {