@alfe.ai/openclaw-sync 0.3.13 → 0.3.15

package/dist/plugin.d.cts.map

@@ -1 +1 @@
-{"version":3,"file":"plugin.d.cts","names":[],"sources":["../src/plugin.ts"],"mappings":";;;AAkEsB;;;;;AAWA;;;;;;;;;;AAqCtB,UAhDU,YAAA,CAgDuB;EAyjB3B,IAAA,CAAA,GAAA,EAiWL,MAAA,CAAA,EAAA,IAAA;EAAA,IAAA,CAAA,GAAA,EAAA,MAAA,CAAA,EAAA,IAAA;OA1Ve,CAAA,GAAA,EAAA,MAAA,CAAA,EAAA,IAAA;OAyQQ,CAAA,GAAA,EAAA,MAAA,CAAA,EAAA,IAAA;;UAl3Bd,oBAAA,CA05Ba;QAAmB,EAz5BhC,MAy5BgC,CAAA,MAAA,EAAA,OAAA,CAAA;cAAgB,CAAA,EAAA,MAAA;EAAA,QAAA,EAAA,MAAA;UAt5BhD;;UAGA,SAAA;UACA;;WAEC;wDAC6C;;;iBAGvC,gCAAgC;iBAChC,gCAAgC;;;UA0BhC,gBAAA;;;;;;;;;;;;cAyjBX;;;;;gBAOU;kBAyQQ,YAAS;iBAwCV,mBAAmB,mBAAgB"}
+{"version":3,"file":"plugin.d.cts","names":[],"sources":["../src/plugin.ts"],"mappings":";;AAkEA;AAuCA;AAaC;AA8CqB;;;;;AAWA;;;;;;;;AAW2B,iBAxHjC,mBAAA,CAwHiC,KAAA,EAAA;EAAO,MAAA,EAAA,MAAA;EA0BvC,aAAA,CAAA,EAAA,MAAgB;EA6jB3B,cAuWL,CAAA,EAAA,MAAA;EAAA,WAAA,EAAA,OAAA;UAhWe;;AA+QiB,iBA97BjB,wBAAA,CA87BiB,OAAA,EAAA,MAAA,CAAA,EAAA,OAAA;UAn4BvB,YAAA,CA26Ba;MAAmB,CAAA,GAAA,EAAA,MAAA,CAAA,EAAA,IAAA;MAAgB,CAAA,GAAA,EAAA,MAAA,CAAA,EAAA,IAAA;EAAA,KAAA,CAAA,GAAA,EAAA,MAAA,CAAA,EAAA,IAAA;;;UAp6BhD,oBAAA;UACA;;;UAGA;;UAGA,SAAA;UACA;;WAEC;wDAC6C;;;iBAGvC,gCAAgC;iBAChC,gCAAgC;;;UA0BhC,gBAAA;;;;;;;;;;;;cA6jBX;;;;;gBAOU;kBA+QQ,YAAS;iBAwCV,mBAAmB,mBAAgB"}

package/dist/plugin.d.ts

@@ -16,6 +16,14 @@
  *
  * Registers gateway RPC methods: `sync.now`, `sync.status`.
  */
+declare function resolveSyncRelayUrl(input: {
+  apiUrl: string;
+  configuredUrl?: string;
+  environmentUrl?: string;
+  privateMode: boolean;
+}): string;
+/** Only RFC1918 IPv4 and unique-local IPv6 addresses are valid VPC relay targets. */
+declare function isVpcPrivateRelayAddress(address: string): boolean;
 interface PluginLogger {
   info(msg: string): void;
   warn(msg: string): void;
@@ -61,5 +69,5 @@ declare const plugin: {
   configure(api: PluginApi, config: SyncPluginConfig): Promise<void>;
 };
 //#endregion
-export { SyncPluginConfig, plugin as default };
+export { SyncPluginConfig, plugin as default, isVpcPrivateRelayAddress, resolveSyncRelayUrl };
 //# sourceMappingURL=plugin.d.ts.map

package/dist/plugin.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"plugin.d.ts","names":[],"sources":["../src/plugin.ts"],"mappings":";;;AAkEsB;;;;;AAWA;;;;;;;;;;AAqCtB,UAhDU,YAAA,CAgDuB;EAyjB3B,IAAA,CAAA,GAAA,EAiWL,MAAA,CAAA,EAAA,IAAA;EAAA,IAAA,CAAA,GAAA,EAAA,MAAA,CAAA,EAAA,IAAA;OA1Ve,CAAA,GAAA,EAAA,MAAA,CAAA,EAAA,IAAA;OAyQQ,CAAA,GAAA,EAAA,MAAA,CAAA,EAAA,IAAA;;UAl3Bd,oBAAA,CA05Ba;QAAmB,EAz5BhC,MAy5BgC,CAAA,MAAA,EAAA,OAAA,CAAA;cAAgB,CAAA,EAAA,MAAA;EAAA,QAAA,EAAA,MAAA;UAt5BhD;;UAGA,SAAA;UACA;;WAEC;wDAC6C;;;iBAGvC,gCAAgC;iBAChC,gCAAgC;;;UA0BhC,gBAAA;;;;;;;;;;;;cAyjBX;;;;;gBAOU;kBAyQQ,YAAS;iBAwCV,mBAAmB,mBAAgB"}
+{"version":3,"file":"plugin.d.ts","names":[],"sources":["../src/plugin.ts"],"mappings":";;AAkEA;AAuCA;AAaC;AA8CqB;;;;;AAWA;;;;;;;;AAW2B,iBAxHjC,mBAAA,CAwHiC,KAAA,EAAA;EAAO,MAAA,EAAA,MAAA;EA0BvC,aAAA,CAAA,EAAA,MAAgB;EA6jB3B,cAuWL,CAAA,EAAA,MAAA;EAAA,WAAA,EAAA,OAAA;UAhWe;;AA+QiB,iBA97BjB,wBAAA,CA87BiB,OAAA,EAAA,MAAA,CAAA,EAAA,OAAA;UAn4BvB,YAAA,CA26Ba;MAAmB,CAAA,GAAA,EAAA,MAAA,CAAA,EAAA,IAAA;MAAgB,CAAA,GAAA,EAAA,MAAA,CAAA,EAAA,IAAA;EAAA,KAAA,CAAA,GAAA,EAAA,MAAA,CAAA,EAAA,IAAA;;;UAp6BhD,oBAAA;UACA;;;UAGA;;UAGA,SAAA;UACA;;WAEC;wDAC6C;;;iBAGvC,gCAAgC;iBAChC,gCAAgC;;;UA0BhC,gBAAA;;;;;;;;;;;;cA6jBX;;;;;gBAOU;kBA+QQ,YAAS;iBAwCV,mBAAmB,mBAAgB"}

package/dist/plugin.js

@@ -1,2 +1,2 @@
-import { t as plugin } from "./plugin2.js";
-export { plugin as default };
+import { n as plugin, r as resolveSyncRelayUrl, t as isVpcPrivateRelayAddress } from "./plugin2.js";
+export { plugin as default, isVpcPrivateRelayAddress, resolveSyncRelayUrl };

package/dist/plugin2.cjs

@@ -8,6 +8,8 @@ let node_module = require("node:module");
 let _alfe_ai_config = require("@alfe.ai/config");
 let _alfe_ai_openclaw_plugin_kit = require("@alfe.ai/openclaw-plugin-kit");
 let _alfe_ai_agent_api_client = require("@alfe.ai/agent-api-client");
+let node_dns = require("node:dns");
+let node_net = require("node:net");
 //#region src/watcher.ts
 /**
 * AlfeSync watcher — recursive file watcher with debounce and ignore support.
@@ -447,6 +449,64 @@ const SYNC_RELAY_DEBOUNCE_MS = 500;
 const SYNC_RELAY_MAX_MESSAGE_BYTES = 64 * 1024;
 const SYNC_RELAY_HANDSHAKE_TIMEOUT_MS = 1e4;
 const REMOTE_DELETE_SUPPRESSION_MS = 3e4;
+function resolveSyncRelayUrl(input) {
+	if (input.privateMode) {
+		const regionalUrl = input.environmentUrl?.trim();
+		if (!regionalUrl) throw new Error("ALFE_SYNC_RELAY_WS_URL is required in AWS-private mode");
+		let parsed;
+		try {
+			parsed = new URL(regionalUrl);
+		} catch {
+			throw new Error("AWS-private sync relay URL must be valid");
+		}
+		if (parsed.protocol !== "ws:" || !parsed.hostname.endsWith(".local") && !parsed.hostname.endsWith(".sst") || parsed.pathname !== "/ws" || parsed.username !== "" || parsed.password !== "" || parsed.search !== "" || parsed.hash !== "") throw new Error("AWS-private sync relay URL must be a canonical VPC-local service URL");
+		return parsed.toString();
+	}
+	const configuredUrl = input.configuredUrl?.trim();
+	const environmentUrl = input.environmentUrl?.trim();
+	if (configuredUrl && configuredUrl.length > 0) return configuredUrl;
+	if (environmentUrl && environmentUrl.length > 0) return environmentUrl;
+	return (0, _alfe_ai_config.deriveServiceWsUrl)(input.apiUrl, "sync");
+}
+/** Only RFC1918 IPv4 and unique-local IPv6 addresses are valid VPC relay targets. */
+function isVpcPrivateRelayAddress(address) {
+	const family = (0, node_net.isIP)(address);
+	if (family === 4) {
+		const [first, second] = address.split(".").map(Number);
+		return first === 10 || first === 172 && second >= 16 && second <= 31 || first === 192 && second === 168;
+	}
+	if (family === 6) {
+		const firstHextet = Number.parseInt(address.split(":", 1)[0] ?? "", 16);
+		return Number.isFinite(firstHextet) && (firstHextet & 65024) === 64512;
+	}
+	return false;
+}
+const vpcPrivateRelayLookup = (hostname, options, callback) => {
+	(0, node_dns.lookup)(hostname, {
+		all: true,
+		verbatim: true
+	}, (error, addresses) => {
+		if (error) {
+			callback(error, "", 4);
+			return;
+		}
+		if (addresses.length === 0 || addresses.some(({ address }) => !isVpcPrivateRelayAddress(address))) {
+			callback(Object.assign(/* @__PURE__ */ new Error("private sync relay resolved outside the VPC address space"), { code: "EACCES" }), "", 4);
+			return;
+		}
+		const family = typeof options.family === "number" ? options.family : 0;
+		const selected = family === 0 ? addresses[0] : addresses.find((candidate) => candidate.family === family);
+		if (!selected) {
+			callback(Object.assign(/* @__PURE__ */ new Error("private sync relay has no address in the requested family"), { code: "EADDRNOTAVAIL" }), "", family || 4);
+			return;
+		}
+		if (options.all) {
+			callback(null, addresses);
+			return;
+		}
+		callback(null, selected.address, selected.family);
+	});
+};
 let client = null;
 let agentId = null;
 let syncEngine = null;
@@ -679,10 +739,13 @@ async function connectToSyncRelay(relayUrl, token, agentIdForSubscribe, log, gen
 	try {
 		const { default: WebSocket } = await import("ws");
 		if (!syncRelayActive || generation !== syncRelayGeneration) return null;
+		const relayHost = new URL(relayUrl).hostname;
+		const privateRelay = relayHost.endsWith(".local") || relayHost.endsWith(".sst");
 		const ws = new WebSocket(relayUrl, {
 			headers: { Authorization: `Bearer ${token}` },
 			handshakeTimeout: SYNC_RELAY_HANDSHAKE_TIMEOUT_MS,
-			maxPayload: SYNC_RELAY_MAX_MESSAGE_BYTES
+			maxPayload: SYNC_RELAY_MAX_MESSAGE_BYTES,
+			...privateRelay ? { lookup: vpcPrivateRelayLookup } : {}
 		});
 		ws.on("open", () => {
 			if (!syncRelayActive || generation !== syncRelayGeneration) {
@@ -897,7 +960,14 @@ const plugin = {
 						log.debug(`Shared sync engine skipped: ${err instanceof Error ? err.message : String(err)}`);
 					}
 					try {
-						const relayUrl = pluginConfig.syncRelayUrl ?? (0, _alfe_ai_config.deriveServiceWsUrl)(syncCfg.apiUrl, "sync");
+						const configuredRelayUrl = pluginConfig.syncRelayUrl?.trim();
+						const environmentRelayUrl = process.env.ALFE_SYNC_RELAY_WS_URL?.trim();
+						const relayUrl = resolveSyncRelayUrl({
+							apiUrl: syncCfg.apiUrl,
+							configuredUrl: configuredRelayUrl,
+							environmentUrl: environmentRelayUrl,
+							privateMode: process.env.ALFE_PRIVATE_DATA_PLANE === "true"
+						});
 						syncRelayActive = true;
 						const relayGeneration = ++syncRelayGeneration;
 						syncRelayWs = await connectToSyncRelay(relayUrl, syncCfg.apiKey, registered.agentId, log, relayGeneration);
@@ -1061,12 +1131,24 @@ Object.defineProperty(exports, "createSharedSyncEngine", {
 		return createSharedSyncEngine;
 	}
 });
+Object.defineProperty(exports, "isVpcPrivateRelayAddress", {
+	enumerable: true,
+	get: function() {
+		return isVpcPrivateRelayAddress;
+	}
+});
 Object.defineProperty(exports, "plugin", {
 	enumerable: true,
 	get: function() {
 		return plugin;
 	}
 });
+Object.defineProperty(exports, "resolveSyncRelayUrl", {
+	enumerable: true,
+	get: function() {
+		return resolveSyncRelayUrl;
+	}
+});
 Object.defineProperty(exports, "startWatcher", {
 	enumerable: true,
 	get: function() {

package/dist/plugin2.js

@@ -8,6 +8,8 @@ import { watch } from "chokidar";
 import { DEFAULT_SOCKET_PATH, DEFAULT_WORKSPACE_PATH, configExists, deriveServiceWsUrl, resolveConfig } from "@alfe.ai/config";
 import { connectToDaemon, getActivationKey, guardedStart, resetActivation } from "@alfe.ai/openclaw-plugin-kit";
 import { AgentApiClient } from "@alfe.ai/agent-api-client";
+import { lookup } from "node:dns";
+import { isIP } from "node:net";
 //#region src/watcher.ts
 /**
 * AlfeSync watcher — recursive file watcher with debounce and ignore support.
@@ -447,6 +449,64 @@ const SYNC_RELAY_DEBOUNCE_MS = 500;
 const SYNC_RELAY_MAX_MESSAGE_BYTES = 64 * 1024;
 const SYNC_RELAY_HANDSHAKE_TIMEOUT_MS = 1e4;
 const REMOTE_DELETE_SUPPRESSION_MS = 3e4;
+function resolveSyncRelayUrl(input) {
+	if (input.privateMode) {
+		const regionalUrl = input.environmentUrl?.trim();
+		if (!regionalUrl) throw new Error("ALFE_SYNC_RELAY_WS_URL is required in AWS-private mode");
+		let parsed;
+		try {
+			parsed = new URL(regionalUrl);
+		} catch {
+			throw new Error("AWS-private sync relay URL must be valid");
+		}
+		if (parsed.protocol !== "ws:" || !parsed.hostname.endsWith(".local") && !parsed.hostname.endsWith(".sst") || parsed.pathname !== "/ws" || parsed.username !== "" || parsed.password !== "" || parsed.search !== "" || parsed.hash !== "") throw new Error("AWS-private sync relay URL must be a canonical VPC-local service URL");
+		return parsed.toString();
+	}
+	const configuredUrl = input.configuredUrl?.trim();
+	const environmentUrl = input.environmentUrl?.trim();
+	if (configuredUrl && configuredUrl.length > 0) return configuredUrl;
+	if (environmentUrl && environmentUrl.length > 0) return environmentUrl;
+	return deriveServiceWsUrl(input.apiUrl, "sync");
+}
+/** Only RFC1918 IPv4 and unique-local IPv6 addresses are valid VPC relay targets. */
+function isVpcPrivateRelayAddress(address) {
+	const family = isIP(address);
+	if (family === 4) {
+		const [first, second] = address.split(".").map(Number);
+		return first === 10 || first === 172 && second >= 16 && second <= 31 || first === 192 && second === 168;
+	}
+	if (family === 6) {
+		const firstHextet = Number.parseInt(address.split(":", 1)[0] ?? "", 16);
+		return Number.isFinite(firstHextet) && (firstHextet & 65024) === 64512;
+	}
+	return false;
+}
+const vpcPrivateRelayLookup = (hostname, options, callback) => {
+	lookup(hostname, {
+		all: true,
+		verbatim: true
+	}, (error, addresses) => {
+		if (error) {
+			callback(error, "", 4);
+			return;
+		}
+		if (addresses.length === 0 || addresses.some(({ address }) => !isVpcPrivateRelayAddress(address))) {
+			callback(Object.assign(/* @__PURE__ */ new Error("private sync relay resolved outside the VPC address space"), { code: "EACCES" }), "", 4);
+			return;
+		}
+		const family = typeof options.family === "number" ? options.family : 0;
+		const selected = family === 0 ? addresses[0] : addresses.find((candidate) => candidate.family === family);
+		if (!selected) {
+			callback(Object.assign(/* @__PURE__ */ new Error("private sync relay has no address in the requested family"), { code: "EADDRNOTAVAIL" }), "", family || 4);
+			return;
+		}
+		if (options.all) {
+			callback(null, addresses);
+			return;
+		}
+		callback(null, selected.address, selected.family);
+	});
+};
 let client = null;
 let agentId = null;
 let syncEngine = null;
@@ -679,10 +739,13 @@ async function connectToSyncRelay(relayUrl, token, agentIdForSubscribe, log, gen
 	try {
 		const { default: WebSocket } = await import("ws");
 		if (!syncRelayActive || generation !== syncRelayGeneration) return null;
+		const relayHost = new URL(relayUrl).hostname;
+		const privateRelay = relayHost.endsWith(".local") || relayHost.endsWith(".sst");
 		const ws = new WebSocket(relayUrl, {
 			headers: { Authorization: `Bearer ${token}` },
 			handshakeTimeout: SYNC_RELAY_HANDSHAKE_TIMEOUT_MS,
-			maxPayload: SYNC_RELAY_MAX_MESSAGE_BYTES
+			maxPayload: SYNC_RELAY_MAX_MESSAGE_BYTES,
+			...privateRelay ? { lookup: vpcPrivateRelayLookup } : {}
 		});
 		ws.on("open", () => {
 			if (!syncRelayActive || generation !== syncRelayGeneration) {
@@ -897,7 +960,14 @@ const plugin = {
 						log.debug(`Shared sync engine skipped: ${err instanceof Error ? err.message : String(err)}`);
 					}
 					try {
-						const relayUrl = pluginConfig.syncRelayUrl ?? deriveServiceWsUrl(syncCfg.apiUrl, "sync");
+						const configuredRelayUrl = pluginConfig.syncRelayUrl?.trim();
+						const environmentRelayUrl = process.env.ALFE_SYNC_RELAY_WS_URL?.trim();
+						const relayUrl = resolveSyncRelayUrl({
+							apiUrl: syncCfg.apiUrl,
+							configuredUrl: configuredRelayUrl,
+							environmentUrl: environmentRelayUrl,
+							privateMode: process.env.ALFE_PRIVATE_DATA_PLANE === "true"
+						});
 						syncRelayActive = true;
 						const relayGeneration = ++syncRelayGeneration;
 						syncRelayWs = await connectToSyncRelay(relayUrl, syncCfg.apiKey, registered.agentId, log, relayGeneration);
@@ -1055,6 +1125,6 @@ const plugin = {
 	}
 };
 //#endregion
-export { createSharedSyncEngine as n, startWatcher as r, plugin as t };
+export { startWatcher as a, createSharedSyncEngine as i, plugin as n, resolveSyncRelayUrl as r, isVpcPrivateRelayAddress as t };
 
 //# sourceMappingURL=plugin2.js.map