@bd7pil/ocrc 0.9.0

package/dist/cli/uninstall.js

@@ -0,0 +1,75 @@
+import { existsSync, readFileSync, writeFileSync, rmSync } from 'node:fs';
+import { join, resolve, dirname } from 'node:path';
+import { homedir } from 'node:os';
+import { fileURLToPath } from 'node:url';
+const REPO_ROOT = resolve(dirname(fileURLToPath(import.meta.url)), '..', '..');
+const OPENCODE_CONFIG_DIR = process.env.OPENCODE_CONFIG_DIR ?? join(homedir(), '.config', 'opencode');
+const BRIDGE_FILE = join(OPENCODE_CONFIG_DIR, 'plugins', 'ocrc.js');
+const GLOBAL_OPENCODE_JSON = join(OPENCODE_CONFIG_DIR, 'opencode.json');
+/** Remove any legacy directory-path / package entry from opencode.json. */
+function removeLegacyEntry() {
+    if (!existsSync(GLOBAL_OPENCODE_JSON))
+        return false;
+    let config;
+    try {
+        config = JSON.parse(readFileSync(GLOBAL_OPENCODE_JSON, 'utf-8'));
+    }
+    catch {
+        return false;
+    }
+    const plugins = config.plugin ?? [];
+    const filtered = plugins.filter((e) => {
+        const name = Array.isArray(e) ? e[0] : e;
+        return !(name === REPO_ROOT || name.startsWith('opencode-remote-control'));
+    });
+    if (filtered.length === plugins.length)
+        return false;
+    if (filtered.length > 0)
+        config.plugin = filtered;
+    else
+        delete config.plugin;
+    writeFileSync(GLOBAL_OPENCODE_JSON, JSON.stringify(config, null, 2) + '\n');
+    return true;
+}
+export async function runUninstall() {
+    let removed = false;
+    if (existsSync(BRIDGE_FILE)) {
+        rmSync(BRIDGE_FILE);
+        console.log(`Removed plugin bridge: ${BRIDGE_FILE}`);
+        removed = true;
+    }
+    if (removeLegacyEntry()) {
+        console.log(`Removed legacy plugin entry from ${GLOBAL_OPENCODE_JSON}`);
+        removed = true;
+    }
+    if (!removed) {
+        console.log('opencode-remote-control was not installed (no bridge or config entry found).');
+        return;
+    }
+    console.log('\nUninstalled. Restart opencode to apply.');
+    console.log(`(Your .env at ${join(REPO_ROOT, '.env')} was left untouched.)`);
+}
+export async function main() {
+    if (process.argv.includes('--help') || process.argv.includes('-h')) {
+        console.log(`
+opencode-remote-control uninstall (opencode 1.17+)
+
+USAGE:
+  node dist/cli/uninstall.js
+
+WHAT IT DOES:
+  - Removes the plugin bridge from ~/.config/opencode/plugins/
+  - Removes any legacy directory-path entry from opencode.json
+  - Leaves your .env untouched
+`);
+        return;
+    }
+    await runUninstall();
+}
+if (process.argv[1]?.endsWith('uninstall.js') || process.argv[1]?.endsWith('uninstall.ts')) {
+    main().catch((err) => {
+        console.error(err);
+        process.exit(1);
+    });
+}
+//# sourceMappingURL=uninstall.js.map

package/dist/cli/uninstall.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"uninstall.js","sourceRoot":"","sources":["../../src/cli/uninstall.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,EAAE,MAAM,SAAS,CAAA;AACzE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AAClD,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAA;AACjC,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAA;AAExC,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,CAAA;AAC9E,MAAM,mBAAmB,GAAG,OAAO,CAAC,GAAG,CAAC,mBAAmB,IAAI,IAAI,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,UAAU,CAAC,CAAA;AACrG,MAAM,WAAW,GAAG,IAAI,CAAC,mBAAmB,EAAE,SAAS,EAAE,SAAS,CAAC,CAAA;AACnE,MAAM,oBAAoB,GAAG,IAAI,CAAC,mBAAmB,EAAE,eAAe,CAAC,CAAA;AAIvE,2EAA2E;AAC3E,SAAS,iBAAiB;IACxB,IAAI,CAAC,UAAU,CAAC,oBAAoB,CAAC;QAAE,OAAO,KAAK,CAAA;IACnD,IAAI,MAA2B,CAAA;IAC/B,IAAI,CAAC;QAAC,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,oBAAoB,EAAE,OAAO,CAAC,CAAC,CAAA;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,KAAK,CAAA;IAAC,CAAC;IAC/F,MAAM,OAAO,GAAkB,MAAM,CAAC,MAAM,IAAI,EAAE,CAAA;IAClD,MAAM,QAAQ,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE;QACpC,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;QACxC,OAAO,CAAC,CAAC,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,UAAU,CAAC,yBAAyB,CAAC,CAAC,CAAA;IAC5E,CAAC,CAAC,CAAA;IACF,IAAI,QAAQ,CAAC,MAAM,KAAK,OAAO,CAAC,MAAM;QAAE,OAAO,KAAK,CAAA;IACpD,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC;QAAE,MAAM,CAAC,MAAM,GAAG,QAAQ,CAAA;;QAC5C,OAAO,MAAM,CAAC,MAAM,CAAA;IACzB,aAAa,CAAC,oBAAoB,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAA;IAC3E,OAAO,IAAI,CAAA;AACb,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY;IAChC,IAAI,OAAO,GAAG,KAAK,CAAA;IAEnB,IAAI,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;QAC5B,MAAM,CAAC,WAAW,CAAC,CAAA;QACnB,OAAO,CAAC,GAAG,CAAC,0BAA0B,WAAW,EAAE,CAAC,CAAA;QACpD,OAAO,GAAG,IAAI,CAAA;IAChB,CAAC;IAED,IAAI,iBAAiB,EAAE,EAAE,CAAC;QACxB,OAAO,CAAC,GAAG,CAAC,oCAAoC,oBAAoB,EAAE,CAAC,CAAA;QACvE,OAAO,GAAG,IAAI,CAAA;IAChB,CAAC;IAED,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,CAAC,GAAG,CAAC,8EAA8E,CAAC,CAAA;QAC3F,OAAM;IACR,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,2CAA2C,CAAC,CAAA;IACxD,OAAO,CAAC,GAAG,CAAC,iBAAiB,IAAI,CAAC,SAAS,EAAE,MAAM,CAAC,uBAAuB,CAAC,CAAA;AAC9E,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,IAAI;IACxB,IAAI,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QACnE,OAAO,CAAC,GAAG,CAAC;;;;;;;;;;CAUf,CAAC,CAAA;QACE,OAAM;IACR,CAAC;IACD,MAAM,YAAY,EAAE,CAAA;AACtB,CAAC;AAED,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC,cAAc,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC;IAC3F,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;QACnB,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;QAClB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACjB,CAAC,CAAC,CAAA;AACJ,CAAC"}

package/dist/connectivity/auth/cf-access.js

@@ -0,0 +1,20 @@
+import { createRemoteJWKSet } from 'jose';
+import { cfAccessMiddleware, verifyUpgradeJwt } from '../../transport/web/middleware/cf-access.js';
+import { createLogger } from '../../utils/logger.js';
+const log = createLogger('auth-cf-access');
+/** Wrap the existing Cloudflare Access middleware/verifier as an AuthStrategy. */
+export function createCfAccessAuth(opts) {
+    if (opts.devBypass) {
+        log.warn('⚠ CF Access devBypass is ON — requests from a loopback peer skip authentication entirely. ' +
+            'If cloudflared (or any same-host tunnel/proxy) fronts this server, ALL remote traffic arrives ' +
+            'from 127.0.0.1 and is let through UNAUTHENTICATED. Never combine devBypass with a tunnel.');
+    }
+    const jwks = opts.team
+        ? createRemoteJWKSet(new URL(`https://${opts.team}.cloudflareaccess.com/cdn-cgi/access/certs`))
+        : undefined;
+    return {
+        httpMiddleware: () => cfAccessMiddleware(opts),
+        verifyUpgrade: (req) => verifyUpgradeJwt(req, opts, jwks),
+    };
+}
+//# sourceMappingURL=cf-access.js.map

package/dist/connectivity/auth/cf-access.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cf-access.js","sourceRoot":"","sources":["../../../src/connectivity/auth/cf-access.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,kBAAkB,EAAE,MAAM,MAAM,CAAA;AACzC,OAAO,EAAE,kBAAkB,EAAE,gBAAgB,EAAqB,MAAM,6CAA6C,CAAA;AACrH,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAA;AAEpD,MAAM,GAAG,GAAG,YAAY,CAAC,gBAAgB,CAAC,CAAA;AAE1C,kFAAkF;AAClF,MAAM,UAAU,kBAAkB,CAAC,IAAkB;IACnD,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;QACnB,GAAG,CAAC,IAAI,CACN,4FAA4F;YAC5F,gGAAgG;YAChG,2FAA2F,CAC5F,CAAA;IACH,CAAC;IACD,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI;QACpB,CAAC,CAAC,kBAAkB,CAAC,IAAI,GAAG,CAAC,WAAW,IAAI,CAAC,IAAI,4CAA4C,CAAC,CAAC;QAC/F,CAAC,CAAC,SAAS,CAAA;IACb,OAAO;QACL,cAAc,EAAE,GAAG,EAAE,CAAC,kBAAkB,CAAC,IAAI,CAAC;QAC9C,aAAa,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,gBAAgB,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,CAAC;KAC1D,CAAA;AACH,CAAC"}

package/dist/connectivity/auth/index.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=index.js.map

package/dist/connectivity/auth/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/connectivity/auth/index.ts"],"names":[],"mappings":""}

package/dist/connectivity/auth/select.js

@@ -0,0 +1,19 @@
+import { createTokenAuth } from './token.js';
+import { createCfAccessAuth } from './cf-access.js';
+export function selectAuthStrategy(sel) {
+    if (sel.mode === 'cf-access') {
+        const cf = sel.cfAccess;
+        if (!cf?.team || !cf?.aud) {
+            throw new Error('WEB_AUTH=cf-access requires WEB_CF_ACCESS_TEAM and WEB_CF_ACCESS_AUD to be set');
+        }
+        return createCfAccessAuth(cf);
+    }
+    return createTokenAuth({
+        token: sel.token,
+        tokenPath: sel.tokenPath,
+        devEmail: sel.devEmail,
+        devBypass: sel.devBypass,
+        host: sel.host,
+    });
+}
+//# sourceMappingURL=select.js.map

package/dist/connectivity/auth/select.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"select.js","sourceRoot":"","sources":["../../../src/connectivity/auth/select.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,eAAe,EAAE,MAAM,YAAY,CAAA;AAC5C,OAAO,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAA;AAanD,MAAM,UAAU,kBAAkB,CAAC,GAAkB;IACnD,IAAI,GAAG,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;QAC7B,MAAM,EAAE,GAAG,GAAG,CAAC,QAAQ,CAAA;QACvB,IAAI,CAAC,EAAE,EAAE,IAAI,IAAI,CAAC,EAAE,EAAE,GAAG,EAAE,CAAC;YAC1B,MAAM,IAAI,KAAK,CAAC,gFAAgF,CAAC,CAAA;QACnG,CAAC;QACD,OAAO,kBAAkB,CAAC,EAAE,CAAC,CAAA;IAC/B,CAAC;IACD,OAAO,eAAe,CAAC;QACrB,KAAK,EAAE,GAAG,CAAC,KAAK;QAChB,SAAS,EAAE,GAAG,CAAC,SAAS;QACxB,QAAQ,EAAE,GAAG,CAAC,QAAQ;QACtB,SAAS,EAAE,GAAG,CAAC,SAAS;QACxB,IAAI,EAAE,GAAG,CAAC,IAAI;KACf,CAAC,CAAA;AACJ,CAAC"}

package/dist/connectivity/auth/token.js

@@ -0,0 +1,157 @@
+import { randomBytes, timingSafeEqual } from 'node:crypto';
+import { readFileSync, writeFileSync, existsSync, mkdirSync, chmodSync } from 'node:fs';
+import { join, dirname } from 'node:path';
+import { createLogger } from '../../utils/logger.js';
+import { ocrcHome, legacyOpencodeHome } from '../../utils/paths.js';
+const log = createLogger('auth-token');
+const COOKIE = 'ocrc_token';
+function defaultTokenPath() {
+    return join(ocrcHome(), 'token');
+}
+/** One-time migration: a token persisted by the pre-fork build at
+ *  ${OPENCODE_CONFIG_DIR ?? ~/.opencode}/oprc-token is adopted so an upstream
+ *  install keeps its paired devices after upgrading to ocrc. */
+function adoptLegacyToken() {
+    const legacy = join(legacyOpencodeHome(), 'oprc-token');
+    try {
+        if (!existsSync(legacy))
+            return null;
+        const t = readFileSync(legacy, 'utf-8').trim();
+        if (!t)
+            return null;
+        const dest = defaultTokenPath();
+        mkdirSync(dirname(dest), { recursive: true });
+        writeFileSync(dest, t, { mode: 0o600 });
+        chmodSync(dest, 0o600);
+        log.info(`adopted legacy token from ${legacy} → ${dest}`);
+        return t;
+    }
+    catch {
+        return null;
+    }
+}
+/** Resolve the web token: explicit > existing file > legacy migration > freshly generated (persisted 0600). */
+export function loadOrCreateToken(opts = {}) {
+    if (opts.token && opts.token.trim())
+        return opts.token.trim();
+    const path = opts.tokenPath ?? defaultTokenPath();
+    try {
+        if (existsSync(path)) {
+            const t = readFileSync(path, 'utf-8').trim();
+            if (t)
+                return t;
+        }
+    }
+    catch {
+        /* fall through to generate */
+    }
+    const adopted = adoptLegacyToken();
+    if (adopted)
+        return adopted;
+    const token = randomBytes(32).toString('base64url');
+    try {
+        mkdirSync(dirname(path), { recursive: true });
+        writeFileSync(path, token, { mode: 0o600 });
+        try {
+            chmodSync(path, 0o600);
+        }
+        catch {
+            /* best effort */
+        }
+        log.info(`generated web token at ${path}`);
+    }
+    catch (err) {
+        log.warn(`could not persist token: ${err.message}`);
+    }
+    return token;
+}
+function isLoopbackAddr(addr) {
+    if (!addr)
+        return false;
+    const clean = addr.replace(/^::ffff:/, '').split('%')[0];
+    return clean === '127.0.0.1' || clean === '::1';
+}
+function tokenMatches(candidate, expected) {
+    if (!candidate)
+        return false;
+    const a = Buffer.from(candidate);
+    const b = Buffer.from(expected);
+    if (a.length !== b.length)
+        return false;
+    return timingSafeEqual(a, b);
+}
+function extractToken(headers, url) {
+    const auth = headers['authorization'];
+    if (typeof auth === 'string' && auth.startsWith('Bearer '))
+        return auth.slice(7).trim();
+    // Query-string tokens are accepted ONLY for the WS upgrade path (/ws) — the
+    // caller decides by passing `url`. Browsers can't set headers on a WebSocket,
+    // but a ?token= on a normal URL would leak into history/referer logs.
+    if (url && url.startsWith('/ws') && url.includes('?')) {
+        const q = new URLSearchParams(url.split('?')[1]);
+        const t = q.get('token');
+        if (t)
+            return t;
+    }
+    const cookie = headers['cookie'];
+    if (typeof cookie === 'string') {
+        const m = cookie.match(new RegExp(`(?:^|;\\s*)${COOKIE}=([^;]+)`));
+        if (m)
+            return decodeURIComponent(m[1]);
+    }
+    return undefined;
+}
+export function createTokenAuth(opts) {
+    const expected = loadOrCreateToken(opts);
+    const user = { email: opts.devEmail ?? 'you@local', sub: 'token' };
+    if (opts.devBypass) {
+        log.warn('⚠ token-auth devBypass is ON — requests from a loopback peer skip the token check entirely. ' +
+            'If cloudflared (or any same-host tunnel/proxy) fronts this server, ALL remote traffic arrives ' +
+            'from 127.0.0.1 and is let through UNAUTHENTICATED. Never combine devBypass with a tunnel.');
+    }
+    const bypass = (peer) => {
+        if (!opts.devBypass)
+            return false;
+        const peerKnown = peer !== undefined && peer !== '';
+        return peerKnown ? isLoopbackAddr(peer) : isLoopbackAddr(opts.host);
+    };
+    return {
+        httpMiddleware() {
+            return async (c, next) => {
+                // c.env.incoming is the Node IncomingMessage (set by @hono/node-server); c.req.raw is the web-standard Request. Peer may be undefined under some adapters → bypass() then falls back to host.
+                const peer = (() => {
+                    try {
+                        return (c.env?.incoming ?? c.req?.raw)?.socket?.remoteAddress;
+                    }
+                    catch {
+                        return undefined;
+                    }
+                })();
+                if (bypass(peer)) {
+                    c.set('user', user);
+                    return next();
+                }
+                const raw = c.req.raw;
+                const rawHeaders = {};
+                try {
+                    for (const [k, v] of (raw?.headers ?? new Headers()).entries())
+                        rawHeaders[k] = v;
+                }
+                catch { /* ignore */ }
+                const candidate = extractToken(rawHeaders);
+                if (tokenMatches(candidate, expected)) {
+                    c.set('user', user);
+                    return next();
+                }
+                return c.json({ error: 'Unauthorized' }, 401);
+            };
+        },
+        async verifyUpgrade(req) {
+            if (bypass(req.socket?.remoteAddress))
+                return user;
+            const candidate = extractToken(req.headers, req.url);
+            return tokenMatches(candidate, expected) ? user : null;
+        },
+    };
+}
+//# sourceMappingURL=token.js.map

package/dist/connectivity/auth/token.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"token.js","sourceRoot":"","sources":["../../../src/connectivity/auth/token.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,aAAa,CAAA;AAC1D,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,UAAU,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,SAAS,CAAA;AACvF,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AAGzC,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAA;AACpD,OAAO,EAAE,QAAQ,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAA;AAEnE,MAAM,GAAG,GAAG,YAAY,CAAC,YAAY,CAAC,CAAA;AACtC,MAAM,MAAM,GAAG,YAAY,CAAA;AAgB3B,SAAS,gBAAgB;IACvB,OAAO,IAAI,CAAC,QAAQ,EAAE,EAAE,OAAO,CAAC,CAAA;AAClC,CAAC;AAED;;gEAEgE;AAChE,SAAS,gBAAgB;IACvB,MAAM,MAAM,GAAG,IAAI,CAAC,kBAAkB,EAAE,EAAE,YAAY,CAAC,CAAA;IACvD,IAAI,CAAC;QACH,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC;YAAE,OAAO,IAAI,CAAA;QACpC,MAAM,CAAC,GAAG,YAAY,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,IAAI,EAAE,CAAA;QAC9C,IAAI,CAAC,CAAC;YAAE,OAAO,IAAI,CAAA;QACnB,MAAM,IAAI,GAAG,gBAAgB,EAAE,CAAA;QAC/B,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;QAC7C,aAAa,CAAC,IAAI,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;QACvC,SAAS,CAAC,IAAI,EAAE,KAAK,CAAC,CAAA;QACtB,GAAG,CAAC,IAAI,CAAC,6BAA6B,MAAM,MAAM,IAAI,EAAE,CAAC,CAAA;QACzD,OAAO,CAAC,CAAA;IACV,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAA;IACb,CAAC;AACH,CAAC;AAED,+GAA+G;AAC/G,MAAM,UAAU,iBAAiB,CAAC,OAAyB,EAAE;IAC3D,IAAI,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE;QAAE,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAA;IAC7D,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,IAAI,gBAAgB,EAAE,CAAA;IACjD,IAAI,CAAC;QACH,IAAI,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YACrB,MAAM,CAAC,GAAG,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,IAAI,EAAE,CAAA;YAC5C,IAAI,CAAC;gBAAE,OAAO,CAAC,CAAA;QACjB,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,8BAA8B;IAChC,CAAC;IACD,MAAM,OAAO,GAAG,gBAAgB,EAAE,CAAA;IAClC,IAAI,OAAO;QAAE,OAAO,OAAO,CAAA;IAC3B,MAAM,KAAK,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAA;IACnD,IAAI,CAAC;QACH,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;QAC7C,aAAa,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;QAC3C,IAAI,CAAC;YACH,SAAS,CAAC,IAAI,EAAE,KAAK,CAAC,CAAA;QACxB,CAAC;QAAC,MAAM,CAAC;YACP,iBAAiB;QACnB,CAAC;QACD,GAAG,CAAC,IAAI,CAAC,0BAA0B,IAAI,EAAE,CAAC,CAAA;IAC5C,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,GAAG,CAAC,IAAI,CAAC,4BAA6B,GAAa,CAAC,OAAO,EAAE,CAAC,CAAA;IAChE,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC;AAED,SAAS,cAAc,CAAC,IAAa;IACnC,IAAI,CAAC,IAAI;QAAE,OAAO,KAAK,CAAA;IACvB,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAA;IACxD,OAAO,KAAK,KAAK,WAAW,IAAI,KAAK,KAAK,KAAK,CAAA;AACjD,CAAC;AAED,SAAS,YAAY,CAAC,SAA6B,EAAE,QAAgB;IACnE,IAAI,CAAC,SAAS;QAAE,OAAO,KAAK,CAAA;IAC5B,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;IAChC,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;IAC/B,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM;QAAE,OAAO,KAAK,CAAA;IACvC,OAAO,eAAe,CAAC,CAAC,EAAE,CAAC,CAAC,CAAA;AAC9B,CAAC;AAED,SAAS,YAAY,CACnB,OAAsD,EACtD,GAAY;IAEZ,MAAM,IAAI,GAAG,OAAO,CAAC,eAAe,CAAC,CAAA;IACrC,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC;QAAE,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAA;IACvF,4EAA4E;IAC5E,8EAA8E;IAC9E,sEAAsE;IACtE,IAAI,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QACtD,MAAM,CAAC,GAAG,IAAI,eAAe,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;QAChD,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;QACxB,IAAI,CAAC;YAAE,OAAO,CAAC,CAAA;IACjB,CAAC;IACD,MAAM,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAA;IAChC,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;QAC/B,MAAM,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,cAAc,MAAM,UAAU,CAAC,CAAC,CAAA;QAClE,IAAI,CAAC;YAAE,OAAO,kBAAkB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;IACxC,CAAC;IACD,OAAO,SAAS,CAAA;AAClB,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,IAAsB;IACpD,MAAM,QAAQ,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAA;IACxC,MAAM,IAAI,GAAa,EAAE,KAAK,EAAE,IAAI,CAAC,QAAQ,IAAI,WAAW,EAAE,GAAG,EAAE,OAAO,EAAE,CAAA;IAC5E,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;QACnB,GAAG,CAAC,IAAI,CACN,8FAA8F;YAC9F,gGAAgG;YAChG,2FAA2F,CAC5F,CAAA;IACH,CAAC;IACD,MAAM,MAAM,GAAG,CAAC,IAAwB,EAAW,EAAE;QACnD,IAAI,CAAC,IAAI,CAAC,SAAS;YAAE,OAAO,KAAK,CAAA;QACjC,MAAM,SAAS,GAAG,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,EAAE,CAAA;QACnD,OAAO,SAAS,CAAC,CAAC,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IACrE,CAAC,CAAA;IAED,OAAO;QACL,cAAc;YACZ,OAAO,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;gBACvB,8LAA8L;gBAC9L,MAAM,IAAI,GAAG,CAAC,GAAuB,EAAE;oBACrC,IAAI,CAAC;wBACH,OAAO,CAAE,CAAC,CAAC,GAAW,EAAE,QAAQ,IAAK,CAAC,CAAC,GAAW,EAAE,GAAG,CAAC,EAAE,MAAM,EAAE,aAAa,CAAA;oBACjF,CAAC;oBAAC,MAAM,CAAC;wBACP,OAAO,SAAS,CAAA;oBAClB,CAAC;gBACH,CAAC,CAAC,EAAE,CAAA;gBACJ,IAAI,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;oBAAC,CAAC,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;oBAAC,OAAO,IAAI,EAAE,CAAA;gBAAC,CAAC;gBACxD,MAAM,GAAG,GAAI,CAAC,CAAC,GAAW,CAAC,GAA0B,CAAA;gBACrD,MAAM,UAAU,GAAuC,EAAE,CAAA;gBACzD,IAAI,CAAC;oBACH,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,OAAO,IAAI,IAAI,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;wBAAE,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,CAAA;gBACnF,CAAC;gBAAC,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC;gBACxB,MAAM,SAAS,GAAG,YAAY,CAAC,UAAU,CAAC,CAAA;gBAC1C,IAAI,YAAY,CAAC,SAAS,EAAE,QAAQ,CAAC,EAAE,CAAC;oBAAC,CAAC,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;oBAAC,OAAO,IAAI,EAAE,CAAA;gBAAC,CAAC;gBAC7E,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE,GAAG,CAAC,CAAA;YAC/C,CAAC,CAAA;QACH,CAAC;QACD,KAAK,CAAC,aAAa,CAAC,GAAG;YACrB,IAAI,MAAM,CAAC,GAAG,CAAC,MAAM,EAAE,aAAa,CAAC;gBAAE,OAAO,IAAI,CAAA;YAClD,MAAM,SAAS,GAAG,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,GAAG,CAAC,CAAA;YACpD,OAAO,YAAY,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAA;QACxD,CAAC;KACF,CAAA;AACH,CAAC"}

package/dist/connectivity/exposure/cloudflared.js

@@ -0,0 +1,77 @@
+import { readdirSync, readFileSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { join } from 'node:path';
+function applyKv(item, text) {
+    const m = text.match(/^(hostname|service)\s*:\s*(.+?)\s*$/);
+    if (!m)
+        return;
+    const val = m[2].replace(/^["']|["']$/g, '');
+    if (m[1] === 'hostname')
+        item.hostname = val;
+    else
+        item.service = val;
+}
+function serviceMatchesPort(service, port) {
+    if (!service)
+        return false;
+    // Anchor on a non-digit (or end) after the port so 17081 ≠ 170810.
+    return new RegExp(`^https?://(localhost|127\\.0\\.0\\.1):${port}(?:[/?#]|$)`).test(service.trim());
+}
+/** Return the ingress hostname mapped to http(s)://localhost:<port>, if any. */
+export function parseCloudflaredIngress(yamlText, port) {
+    const lines = yamlText.split(/\r?\n/);
+    let i = lines.findIndex((l) => /^\s*ingress\s*:\s*$/.test(l));
+    if (i < 0)
+        return undefined;
+    const ingressIndent = lines[i].match(/^(\s*)/)[1].length;
+    const items = [];
+    let cur = null;
+    for (i = i + 1; i < lines.length; i++) {
+        const line = lines[i];
+        if (line.trim() === '' || /^\s*#/.test(line))
+            continue;
+        const indent = line.match(/^(\s*)/)[1].length;
+        if (indent <= ingressIndent)
+            break; // dedented out of the ingress block
+        const dash = line.match(/^\s*-\s+(.*)$/);
+        if (dash) {
+            cur = {};
+            items.push(cur);
+            applyKv(cur, dash[1]);
+        }
+        else if (cur) {
+            applyKv(cur, line.trim());
+        }
+    }
+    return items.find((it) => it.hostname && serviceMatchesPort(it.service, port))?.hostname;
+}
+/** Scan ~/.cloudflared/*.{yml,yaml} for a tunnel hostname mapped to the web port. */
+export function detectCloudflaredHostname(port, opts = {}) {
+    const dir = opts.configDir ?? join(homedir(), '.cloudflared');
+    const readDir = opts.readDir ?? ((d) => { try {
+        return readdirSync(d);
+    }
+    catch {
+        return [];
+    } });
+    const readFile = opts.readFile ?? ((p) => { try {
+        return readFileSync(p, 'utf8');
+    }
+    catch {
+        return '';
+    } });
+    let files;
+    try {
+        files = readDir(dir).filter((f) => /\.ya?ml$/i.test(f));
+    }
+    catch {
+        return undefined;
+    }
+    for (const f of files) {
+        const host = parseCloudflaredIngress(readFile(join(dir, f)), port);
+        if (host)
+            return host;
+    }
+    return undefined;
+}
+//# sourceMappingURL=cloudflared.js.map

package/dist/connectivity/exposure/cloudflared.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cloudflared.js","sourceRoot":"","sources":["../../../src/connectivity/exposure/cloudflared.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,SAAS,CAAA;AACnD,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAA;AACjC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAUhC,SAAS,OAAO,CAAC,IAAiB,EAAE,IAAY;IAC9C,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,qCAAqC,CAAC,CAAA;IAC3D,IAAI,CAAC,CAAC;QAAE,OAAM;IACd,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC,CAAA;IAC5C,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,UAAU;QAAE,IAAI,CAAC,QAAQ,GAAG,GAAG,CAAA;;QACvC,IAAI,CAAC,OAAO,GAAG,GAAG,CAAA;AACzB,CAAC;AAED,SAAS,kBAAkB,CAAC,OAA2B,EAAE,IAAY;IACnE,IAAI,CAAC,OAAO;QAAE,OAAO,KAAK,CAAA;IAC1B,mEAAmE;IACnE,OAAO,IAAI,MAAM,CAAC,yCAAyC,IAAI,aAAa,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAA;AACpG,CAAC;AAED,gFAAgF;AAChF,MAAM,UAAU,uBAAuB,CAAC,QAAgB,EAAE,IAAY;IACpE,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;IACrC,IAAI,CAAC,GAAG,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,qBAAqB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAA;IAC7D,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,SAAS,CAAA;IAC3B,MAAM,aAAa,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAE,CAAC,CAAC,CAAC,CAAC,MAAM,CAAA;IAEzD,MAAM,KAAK,GAAkB,EAAE,CAAA;IAC/B,IAAI,GAAG,GAAuB,IAAI,CAAA;IAClC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAA;QACrB,IAAI,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,SAAQ;QACtD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAE,CAAC,CAAC,CAAC,CAAC,MAAM,CAAA;QAC9C,IAAI,MAAM,IAAI,aAAa;YAAE,MAAK,CAAC,oCAAoC;QACvE,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,CAAA;QACxC,IAAI,IAAI,EAAE,CAAC;YACT,GAAG,GAAG,EAAE,CAAA;YACR,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;YACf,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,CAAA;QACvB,CAAC;aAAM,IAAI,GAAG,EAAE,CAAC;YACf,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAA;QAC3B,CAAC;IACH,CAAC;IAED,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,QAAQ,IAAI,kBAAkB,CAAC,EAAE,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,EAAE,QAAQ,CAAA;AAC1F,CAAC;AAWD,qFAAqF;AACrF,MAAM,UAAU,yBAAyB,CAAC,IAAY,EAAE,OAAsB,EAAE;IAC9E,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,OAAO,EAAE,EAAE,cAAc,CAAC,CAAA;IAC7D,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,GAAG,IAAI,CAAC;QAAC,OAAO,WAAW,CAAC,CAAC,CAAC,CAAA;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,EAAE,CAAA;IAAC,CAAC,CAAC,CAAC,CAAC,CAAA;IAC9F,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,GAAG,IAAI,CAAC;QAAC,OAAO,YAAY,CAAC,CAAC,EAAE,MAAM,CAAC,CAAA;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,EAAE,CAAA;IAAC,CAAC,CAAC,CAAC,CAAC,CAAA;IAEzG,IAAI,KAAe,CAAA;IACnB,IAAI,CAAC;QACH,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAA;IACzD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,MAAM,IAAI,GAAG,uBAAuB,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAA;QAClE,IAAI,IAAI;YAAE,OAAO,IAAI,CAAA;IACvB,CAAC;IACD,OAAO,SAAS,CAAA;AAClB,CAAC"}

package/dist/connectivity/exposure/index.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=index.js.map

package/dist/connectivity/exposure/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/connectivity/exposure/index.ts"],"names":[],"mappings":""}

package/dist/connectivity/exposure/providers.js

@@ -0,0 +1,49 @@
+import { networkInterfaces } from 'node:os';
+import { detectCloudflaredHostname } from './cloudflared.js';
+function firstLanIpv4() {
+    const ifaces = networkInterfaces();
+    const skip = /^(utun|tun|tap|docker|br-|bridge|veth|vmnet|llw|awdl)/i;
+    const ipv4 = (name) => {
+        for (const ni of ifaces[name] ?? []) {
+            if (ni.family === 'IPv4' && !ni.internal)
+                return ni.address;
+        }
+        return undefined;
+    };
+    const names = Object.keys(ifaces);
+    // Prefer physical LAN interfaces (en*/eth*), then any non-virtual interface.
+    const preferred = names.filter((n) => /^(en|eth)/i.test(n));
+    for (const n of [...preferred, ...names]) {
+        if (!preferred.includes(n) && skip.test(n))
+            continue;
+        const ip = ipv4(n);
+        if (ip)
+            return ip;
+    }
+    return undefined;
+}
+/**
+ * Resolve the best public base URL:
+ * explicit publicUrl > auto-detected cloudflared hostname > LAN IP > loopback.
+ */
+export async function resolvePublicUrl(opts) {
+    return (await resolveExposure(opts)).url;
+}
+export async function resolveExposure(opts) {
+    if (opts.publicUrl && opts.publicUrl.trim()) {
+        let u = opts.publicUrl.trim().replace(/\/+$/, '');
+        if (!/^https?:\/\//i.test(u))
+            u = `https://${u}`;
+        return { url: u, provider: 'cf-tunnel' };
+    }
+    // No explicit URL: if a local cloudflared tunnel already maps a hostname to
+    // this port, prefer that reachable HTTPS URL over an unreachable LAN IP.
+    const cfHost = (opts.cloudflaredResolver ?? (() => detectCloudflaredHostname(opts.port)))();
+    if (cfHost)
+        return { url: `https://${cfHost.replace(/\/+$/, '')}`, provider: 'cf-tunnel' };
+    const lan = (opts.lanIpResolver ?? firstLanIpv4)();
+    if (lan)
+        return { url: `http://${lan}:${opts.port}`, provider: 'lan' };
+    return { url: `http://127.0.0.1:${opts.port}`, provider: 'loopback' };
+}
+//# sourceMappingURL=providers.js.map

package/dist/connectivity/exposure/providers.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"providers.js","sourceRoot":"","sources":["../../../src/connectivity/exposure/providers.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,SAAS,CAAA;AAE3C,OAAO,EAAE,yBAAyB,EAAE,MAAM,kBAAkB,CAAA;AAa5D,SAAS,YAAY;IACnB,MAAM,MAAM,GAAG,iBAAiB,EAAE,CAAA;IAClC,MAAM,IAAI,GAAG,wDAAwD,CAAA;IACrE,MAAM,IAAI,GAAG,CAAC,IAAY,EAAsB,EAAE;QAChD,KAAK,MAAM,EAAE,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC;YACpC,IAAI,EAAE,CAAC,MAAM,KAAK,MAAM,IAAI,CAAC,EAAE,CAAC,QAAQ;gBAAE,OAAO,EAAE,CAAC,OAAO,CAAA;QAC7D,CAAC;QACD,OAAO,SAAS,CAAA;IAClB,CAAC,CAAA;IACD,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;IACjC,6EAA6E;IAC7E,MAAM,SAAS,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAA;IAC3D,KAAK,MAAM,CAAC,IAAI,CAAC,GAAG,SAAS,EAAE,GAAG,KAAK,CAAC,EAAE,CAAC;QACzC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;YAAE,SAAQ;QACpD,MAAM,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,CAAA;QAClB,IAAI,EAAE;YAAE,OAAO,EAAE,CAAA;IACnB,CAAC;IACD,OAAO,SAAS,CAAA;AAClB,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,IAAoB;IACzD,OAAO,CAAC,MAAM,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAA;AAC1C,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,IAAoB;IACxD,IAAI,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,EAAE,CAAC;QAC5C,IAAI,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAA;QACjD,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC;YAAE,CAAC,GAAG,WAAW,CAAC,EAAE,CAAA;QAChD,OAAO,EAAE,GAAG,EAAE,CAAC,EAAE,QAAQ,EAAE,WAAW,EAAE,CAAA;IAC1C,CAAC;IACD,4EAA4E;IAC5E,yEAAyE;IACzE,MAAM,MAAM,GAAG,CAAC,IAAI,CAAC,mBAAmB,IAAI,CAAC,GAAG,EAAE,CAAC,yBAAyB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAA;IAC3F,IAAI,MAAM;QAAE,OAAO,EAAE,GAAG,EAAE,WAAW,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,EAAE,EAAE,QAAQ,EAAE,WAAW,EAAE,CAAA;IAC1F,MAAM,GAAG,GAAG,CAAC,IAAI,CAAC,aAAa,IAAI,YAAY,CAAC,EAAE,CAAA;IAClD,IAAI,GAAG;QAAE,OAAO,EAAE,GAAG,EAAE,UAAU,GAAG,IAAI,IAAI,CAAC,IAAI,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAA;IACtE,OAAO,EAAE,GAAG,EAAE,oBAAoB,IAAI,CAAC,IAAI,EAAE,EAAE,QAAQ,EAAE,UAAU,EAAE,CAAA;AACvE,CAAC"}

package/dist/connectivity/pairing.js

@@ -0,0 +1,29 @@
+import QRCode from 'qrcode';
+import { loadOrCreateToken } from './auth/token.js';
+import { resolvePublicUrl } from './exposure/providers.js';
+/** Build the pairing URL with the token in the fragment (never the query, so it
+ * isn't logged by proxies; the PWA reads it client-side then stores it). */
+export function buildPairUrl(base, token) {
+    return `${base.replace(/\/+$/, '')}/#token=${encodeURIComponent(token)}`;
+}
+export async function buildPairCard(base, token) {
+    const url = buildPairUrl(base, token);
+    const qr = await QRCode.toString(url, { type: 'terminal', small: true });
+    const lines = [
+        'Scan to pair this device with opencode-remote-control:',
+        '',
+        url,
+        '',
+        'The token is stored on the device after the first open.',
+    ];
+    return { url, qr, lines };
+}
+/** Resolve the current pairing token + best public URL from env (shared by the
+ * CLI `ocrc pair` and the Telegram `/pair` command). */
+export async function buildPairContext() {
+    const port = Number(process.env.OCRC_WEB_PORT ?? process.env.WEB_PORT ?? 4099);
+    const token = loadOrCreateToken({ token: process.env.WEB_TOKEN });
+    const url = await resolvePublicUrl({ publicUrl: process.env.WEB_PUBLIC_URL, port });
+    return { token, url };
+}
+//# sourceMappingURL=pairing.js.map

package/dist/connectivity/pairing.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pairing.js","sourceRoot":"","sources":["../../src/connectivity/pairing.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,QAAQ,CAAA;AAC3B,OAAO,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAA;AACnD,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAA;AAE1D;4EAC4E;AAC5E,MAAM,UAAU,YAAY,CAAC,IAAY,EAAE,KAAa;IACtD,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,WAAW,kBAAkB,CAAC,KAAK,CAAC,EAAE,CAAA;AAC1E,CAAC;AAUD,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,IAAY,EAAE,KAAa;IAC7D,MAAM,GAAG,GAAG,YAAY,CAAC,IAAI,EAAE,KAAK,CAAC,CAAA;IACrC,MAAM,EAAE,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;IACxE,MAAM,KAAK,GAAG;QACZ,wDAAwD;QACxD,EAAE;QACF,GAAG;QACH,EAAE;QACF,yDAAyD;KAC1D,CAAA;IACD,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,KAAK,EAAE,CAAA;AAC3B,CAAC;AAOD;wDACwD;AACxD,MAAM,CAAC,KAAK,UAAU,gBAAgB;IACpC,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,IAAI,IAAI,CAAC,CAAA;IAC9E,MAAM,KAAK,GAAG,iBAAiB,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC,CAAA;IACjE,MAAM,GAAG,GAAG,MAAM,gBAAgB,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,GAAG,CAAC,cAAc,EAAE,IAAI,EAAE,CAAC,CAAA;IACnF,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,CAAA;AACvB,CAAC"}