@cimplify/cli 0.13.3 → 0.13.5

package/dist/chunk-KNTFZ6LD.mjs

@@ -1,2090 +0,0 @@
-#!/usr/bin/env node
-import { info, dim } from './chunk-ZPVN6UXL.mjs';
-import { promises, watch } from 'fs';
-import path2 from 'path';
-import http from 'http';
-import { spawn } from 'child_process';
-import { createHash } from 'crypto';
-
-var TUNNEL_URL_ENV = "CIMPLIFY_TUNNEL_URL";
-var TUNNEL_TOKEN_ENV = "CIMPLIFY_TUNNEL_TOKEN";
-var TUNNEL_LOCAL_PORT_ENV = "CIMPLIFY_TUNNEL_LOCAL_PORT";
-var TUNNEL_CONFIG_DIR = ".cimplify";
-var TUNNEL_CONFIG_FILE = "tunnel.json";
-var DEFAULT_DEV_SERVER_PORT = 3e3;
-function tunnelConfigPath(cwd) {
-  return path2.join(cwd, TUNNEL_CONFIG_DIR, TUNNEL_CONFIG_FILE);
-}
-async function readTunnelConfig(cwd, env = process.env) {
-  const url = env[TUNNEL_URL_ENV];
-  const token = env[TUNNEL_TOKEN_ENV];
-  if (url && token) {
-    return { url, token, localPort: envPort(env) ?? DEFAULT_DEV_SERVER_PORT };
-  }
-  return readTunnelConfigFile(cwd);
-}
-function envPort(env) {
-  const raw = env[TUNNEL_LOCAL_PORT_ENV];
-  if (!raw) return null;
-  const port = Number.parseInt(raw, 10);
-  return Number.isInteger(port) && port > 0 && port < 65536 ? port : null;
-}
-async function readTunnelConfigFile(cwd) {
-  let raw;
-  try {
-    raw = await promises.readFile(tunnelConfigPath(cwd), "utf8");
-  } catch {
-    return null;
-  }
-  let parsed;
-  try {
-    parsed = JSON.parse(raw);
-  } catch {
-    return null;
-  }
-  if (typeof parsed !== "object" || parsed === null) return null;
-  const record = parsed;
-  if (typeof record.url !== "string" || record.url.length === 0) return null;
-  if (typeof record.token !== "string" || record.token.length === 0) return null;
-  const localPort = typeof record.port === "number" && Number.isInteger(record.port) && record.port > 0 ? record.port : DEFAULT_DEV_SERVER_PORT;
-  return { url: record.url, token: record.token, localPort };
-}
-function sameTunnelConfig(a, b) {
-  if (a === null || b === null) return a === b;
-  return a.url === b.url && a.token === b.token && a.localPort === b.localPort;
-}
-function sameTunnelEndpoint(a, b) {
-  return a.url === b.url && a.localPort === b.localPort;
-}
-
-// src/tunnel/v2/codec.ts
-var HEADER_LEN = 9;
-var SUBPROTOCOL_V2 = "cimplify-tunnel.v2";
-var DEFAULT_MAX_FRAME_PAYLOAD = 65536;
-var DEFAULT_INITIAL_STREAM_WINDOW = 262144;
-var DEFAULT_CONNECTION_WINDOW = 4194304;
-var DEFAULT_MAX_CONCURRENT_STREAMS = 256;
-var MAX_HEAD_BYTES = 65536;
-var FRAME_TYPE_V2 = {
-  HELLO: 1,
-  OPEN: 2,
-  ACCEPT: 3,
-  DATA: 4,
-  END: 5,
-  CLOSE: 6,
-  RST: 7,
-  WINDOW_UPDATE: 8,
-  PING: 9,
-  PONG: 10,
-  GOAWAY: 11
-};
-var ERROR_CODE = {
-  PROTOCOL_ERROR: 1,
-  FLOW_CONTROL_ERROR: 3,
-  STREAM_CLOSED: 4,
-  REFUSED: 5,
-  UNSUPPORTED: 6};
-var WS_DATA_PREFIX = {
-  TEXT: 0,
-  BINARY: 1,
-  TEXT_CONT: 2,
-  BINARY_CONT: 3
-};
-var CodecV2Error = class extends Error {
-};
-function encodeFrameV2(frame) {
-  const bytes = new Uint8Array(HEADER_LEN + frame.payload.length);
-  const view = new DataView(bytes.buffer);
-  view.setUint32(0, frame.streamId);
-  view.setUint8(4, frame.frameType);
-  view.setUint32(5, frame.payload.length);
-  bytes.set(frame.payload, HEADER_LEN);
-  return bytes;
-}
-function decodeFrameV2(bytes, maxPayload = DEFAULT_MAX_FRAME_PAYLOAD) {
-  if (bytes.length < HEADER_LEN) {
-    throw new CodecV2Error(`frame truncated: ${bytes.length} bytes`);
-  }
-  const view = new DataView(bytes.buffer, bytes.byteOffset, bytes.byteLength);
-  const streamId = view.getUint32(0);
-  const frameType = view.getUint8(4);
-  const declared = view.getUint32(5);
-  if (declared > maxPayload) {
-    throw new CodecV2Error(`payload length ${declared} exceeds negotiated max ${maxPayload}`);
-  }
-  const actual = bytes.length - HEADER_LEN;
-  if (declared !== actual) {
-    throw new CodecV2Error(`payload length field ${declared} does not match remaining ${actual} bytes`);
-  }
-  return { streamId, frameType, payload: bytes.subarray(HEADER_LEN) };
-}
-function payloadU32(frame) {
-  if (frame.payload.length !== 4) return null;
-  return new DataView(frame.payload.buffer, frame.payload.byteOffset, 4).getUint32(0);
-}
-function rstFrame(streamId, code) {
-  const payload = new Uint8Array(4);
-  new DataView(payload.buffer).setUint32(0, code);
-  return { streamId, frameType: FRAME_TYPE_V2.RST, payload };
-}
-function windowUpdateFrame(streamId, credit) {
-  const payload = new Uint8Array(4);
-  new DataView(payload.buffer).setUint32(0, credit);
-  return { streamId, frameType: FRAME_TYPE_V2.WINDOW_UPDATE, payload };
-}
-function defaultHello(build) {
-  return {
-    version: 2,
-    initial_stream_window: DEFAULT_INITIAL_STREAM_WINDOW,
-    connection_window: DEFAULT_CONNECTION_WINDOW,
-    max_frame_payload: DEFAULT_MAX_FRAME_PAYLOAD,
-    max_concurrent_streams: DEFAULT_MAX_CONCURRENT_STREAMS,
-    capabilities: ["http", "ws", "control"],
-    ...{}
-  };
-}
-function parseHello(payload) {
-  const raw = JSON.parse(new TextDecoder().decode(payload));
-  if (typeof raw.version !== "number") {
-    throw new CodecV2Error("HELLO missing version");
-  }
-  return {
-    version: raw.version,
-    initial_stream_window: raw.initial_stream_window ?? DEFAULT_INITIAL_STREAM_WINDOW,
-    connection_window: raw.connection_window ?? DEFAULT_CONNECTION_WINDOW,
-    max_frame_payload: raw.max_frame_payload ?? DEFAULT_MAX_FRAME_PAYLOAD,
-    max_concurrent_streams: raw.max_concurrent_streams ?? DEFAULT_MAX_CONCURRENT_STREAMS,
-    capabilities: raw.capabilities ?? [],
-    ...raw.build ? { build: raw.build } : {}
-  };
-}
-
-// src/tunnel/v2/ws-framing.ts
-var textEncoder = new TextEncoder();
-var textDecoder = new TextDecoder();
-function encodeWsMessage(message, maxPayload) {
-  const body = message.type === "text" ? textEncoder.encode(message.data) : message.data;
-  const contPrefix = message.type === "text" ? WS_DATA_PREFIX.TEXT_CONT : WS_DATA_PREFIX.BINARY_CONT;
-  const finalPrefix = message.type === "text" ? WS_DATA_PREFIX.TEXT : WS_DATA_PREFIX.BINARY;
-  const chunkSize = Math.max(1, maxPayload - 1);
-  const frames = [];
-  if (body.length === 0) {
-    return [Uint8Array.of(finalPrefix)];
-  }
-  for (let offset = 0; offset < body.length; offset += chunkSize) {
-    const chunk = body.subarray(offset, offset + chunkSize);
-    const isLast = offset + chunkSize >= body.length;
-    const framed = new Uint8Array(chunk.length + 1);
-    framed[0] = isLast ? finalPrefix : contPrefix;
-    framed.set(chunk, 1);
-    frames.push(framed);
-  }
-  return frames;
-}
-var WsReassembler = class {
-  buffer = [];
-  bufferedType = null;
-  /** Feed one DATA payload; returns a completed message, or null mid-fragment. */
-  push(payload) {
-    if (payload.length === 0) return null;
-    const prefix = payload[0];
-    const chunk = payload.subarray(1);
-    switch (prefix) {
-      case WS_DATA_PREFIX.TEXT_CONT:
-        this.startOrAppend("text", chunk);
-        return null;
-      case WS_DATA_PREFIX.BINARY_CONT:
-        this.startOrAppend("binary", chunk);
-        return null;
-      case WS_DATA_PREFIX.TEXT:
-        return this.finish("text", chunk);
-      case WS_DATA_PREFIX.BINARY:
-        return this.finish("binary", chunk);
-      default:
-        return null;
-    }
-  }
-  startOrAppend(type, chunk) {
-    if (this.bufferedType === null) this.bufferedType = type;
-    this.buffer.push(chunk);
-  }
-  finish(type, chunk) {
-    if (this.buffer.length === 0) {
-      return this.materialize(type, [chunk]);
-    }
-    const resolvedType = this.bufferedType ?? type;
-    this.buffer.push(chunk);
-    const parts = this.buffer;
-    this.buffer = [];
-    this.bufferedType = null;
-    return this.materialize(resolvedType, parts);
-  }
-  materialize(type, parts) {
-    const total = parts.reduce((sum, p) => sum + p.length, 0);
-    const joined = new Uint8Array(total);
-    let offset = 0;
-    for (const part of parts) {
-      joined.set(part, offset);
-      offset += part.length;
-    }
-    return type === "text" ? { type: "text", data: textDecoder.decode(joined) } : { type: "binary", data: joined };
-  }
-};
-
-// src/tunnel/v2/agent-kinds.ts
-var LOCAL_HOST = "127.0.0.1";
-var HEADER_SEC_WS_PROTOCOL = "sec-websocket-protocol";
-var HOP_BY_HOP_HEADERS = /* @__PURE__ */ new Set([
-  "connection",
-  "keep-alive",
-  "proxy-authenticate",
-  "proxy-authorization",
-  "te",
-  "trailer",
-  "transfer-encoding",
-  "upgrade"
-]);
-var textEncoder2 = new TextEncoder();
-var AgentDispatcher = class {
-  kinds = /* @__PURE__ */ new Map();
-  register(kind) {
-    this.kinds.set(kind.kind, kind);
-    return this;
-  }
-  dispatch(incoming) {
-    const handler = this.kinds.get(incoming.kind);
-    if (!handler) {
-      void incoming.stream.rst(ERROR_CODE.UNSUPPORTED);
-      return;
-    }
-    handler.handle(incoming);
-  }
-};
-var HttpProxyKind = class {
-  constructor(ctx) {
-    this.ctx = ctx;
-  }
-  ctx;
-  kind = "http";
-  handle(incoming) {
-    void this.proxy(incoming);
-  }
-  async proxy(incoming) {
-    const head = incoming.head;
-    const request = http.request({
-      host: LOCAL_HOST,
-      port: this.ctx.localPort,
-      method: head.method,
-      path: head.path,
-      headers: toNodeHeaders(head.headers)
-    });
-    request.on("response", (response) => void this.pumpResponse(incoming.stream, response));
-    request.on("error", (error) => void this.answerError(incoming.stream, error));
-    void this.pumpRequestBody(incoming.stream, request);
-  }
-  async pumpRequestBody(stream, request) {
-    for (; ; ) {
-      const event = await stream.recv();
-      if (event === null) {
-        request.destroy();
-        return;
-      }
-      if (event.type === "data") {
-        request.write(Buffer.from(event.payload));
-      } else if (event.type === "end") {
-        request.end();
-        return;
-      } else {
-        request.destroy();
-        return;
-      }
-    }
-  }
-  async pumpResponse(stream, response) {
-    const headers = [];
-    for (let i = 0; i + 1 < response.rawHeaders.length; i += 2) {
-      headers.push([response.rawHeaders[i].toLowerCase(), response.rawHeaders[i + 1]]);
-    }
-    await stream.accept({ status: response.statusCode ?? 502, headers });
-    for await (const chunk of response) {
-      await stream.data(new Uint8Array(chunk));
-    }
-    await stream.end();
-  }
-  async answerError(stream, error) {
-    try {
-      await stream.accept({
-        status: 502,
-        headers: [["content-type", "text/plain; charset=utf-8"]]
-      });
-      await stream.data(textEncoder2.encode(`dev server unreachable: ${error.message}`));
-      await stream.end();
-    } catch {
-    }
-  }
-};
-var WsSpliceKind = class {
-  constructor(ctx) {
-    this.ctx = ctx;
-  }
-  ctx;
-  kind = "ws";
-  handle(incoming) {
-    void this.splice(incoming);
-  }
-  async splice(incoming) {
-    const head = incoming.head;
-    const protocols = head.headers.filter(([name]) => name === HEADER_SEC_WS_PROTOCOL).flatMap(([, value]) => value.split(",")).map((value) => value.trim()).filter((value) => value.length > 0);
-    const local = this.ctx.createLocalSocket(
-      `ws://${LOCAL_HOST}:${this.ctx.localPort}${head.path}`,
-      protocols
-    );
-    local.binaryType = "arraybuffer";
-    let opened = false;
-    const reassembler = new WsReassembler();
-    local.addEventListener("open", () => {
-      opened = true;
-      const headers = local.protocol ? [[HEADER_SEC_WS_PROTOCOL, local.protocol]] : [];
-      void incoming.stream.accept({ status: 101, headers });
-    });
-    local.addEventListener("message", (event) => {
-      const message = toWsMessage(event.data);
-      if (!message) return;
-      for (const frame of encodeWsMessage(message, this.ctx.maxFramePayload)) {
-        void incoming.stream.data(frame);
-      }
-    });
-    local.addEventListener("close", (event) => {
-      void incoming.stream.close({ code: sendableCloseCode(event.code), reason: event.reason });
-    });
-    local.addEventListener("error", () => {
-      if (opened) return;
-      void this.refuse(incoming.stream);
-    });
-    for (; ; ) {
-      const event = await incoming.stream.recv();
-      if (event === null) return;
-      if (event.type === "data") {
-        const message = reassembler.push(event.payload);
-        if (message) {
-          local.send(message.type === "text" ? message.data : message.data);
-        }
-      } else if (event.type === "close") {
-        const info2 = event.info;
-        local.close(sendableCloseCode(info2?.code), info2?.reason);
-        return;
-      } else if (event.type === "end" || event.type === "rst") {
-        local.close();
-        return;
-      }
-    }
-  }
-  async refuse(stream) {
-    try {
-      await stream.accept({
-        status: 502,
-        headers: [["content-type", "text/plain; charset=utf-8"]]
-      });
-      await stream.data(textEncoder2.encode("dev server refused the websocket"));
-      await stream.end();
-    } catch {
-    }
-  }
-};
-function toNodeHeaders(pairs) {
-  const out = {};
-  for (const [name, value] of pairs) {
-    if (HOP_BY_HOP_HEADERS.has(name)) continue;
-    const existing = out[name];
-    if (existing === void 0) out[name] = value;
-    else if (Array.isArray(existing)) existing.push(value);
-    else out[name] = [existing, value];
-  }
-  return out;
-}
-function toWsMessage(data) {
-  if (typeof data === "string") return { type: "text", data };
-  if (data instanceof ArrayBuffer) return { type: "binary", data: new Uint8Array(data) };
-  if (data instanceof Uint8Array) return { type: "binary", data };
-  return null;
-}
-function sendableCloseCode(code) {
-  if (code === void 0) return void 0;
-  const legal = code >= 1e3 && code <= 1003 || code >= 1007 && code <= 1014 || code >= 3e3 && code <= 4999;
-  return legal ? code : void 0;
-}
-
-// src/tunnel/v2/control-protocol.ts
-var CONTROL_KIND = "control";
-var LENGTH_PREFIX_BYTES = 4;
-var MAX_MESSAGE_BYTES = 32 * 1024 * 1024;
-var CONTROL_OP = {
-  READ: "read",
-  WRITE: "write",
-  DELETE: "delete",
-  LIST: "list",
-  LIST_TREE: "list_tree",
-  STAT: "stat",
-  MKDIR: "mkdir",
-  RENAME: "rename",
-  WATCH_START: "watch_start",
-  WATCH_STOP: "watch_stop",
-  EXEC: "exec"
-};
-var CONTROL_ERROR = {
-  NOT_FOUND: "not_found",
-  INVALID_PATH: "invalid_path",
-  PERMISSION_DENIED: "permission_denied",
-  IO: "io",
-  UNSUPPORTED: "unsupported"};
-var WATCH_EVENT = {
-  ADD: "add",
-  CHANGE: "change",
-  REMOVE: "remove",
-  RESYNC: "resync"
-};
-var ENCODING = {
-  UTF8: "utf8",
-  BASE64: "base64"
-};
-var ControlProtocolError = class extends Error {
-};
-var textEncoder3 = new TextEncoder();
-var textDecoder2 = new TextDecoder();
-function encodeMessage(message) {
-  const json = textEncoder3.encode(JSON.stringify(message));
-  if (json.length > MAX_MESSAGE_BYTES) {
-    throw new ControlProtocolError(`control message ${json.length} exceeds ${MAX_MESSAGE_BYTES}`);
-  }
-  const framed = new Uint8Array(LENGTH_PREFIX_BYTES + json.length);
-  new DataView(framed.buffer).setUint32(0, json.length);
-  framed.set(json, LENGTH_PREFIX_BYTES);
-  return framed;
-}
-function isRequest(message) {
-  return typeof message.op === "string";
-}
-var MessageFramer = class {
-  // Annotated Uint8Array (ArrayBufferLike) so concat/subarray/slice results
-  // assign back cleanly under TS 5.7's Uint8Array<ArrayBuffer> generic.
-  buffer = new Uint8Array(0);
-  push(bytes) {
-    this.buffer = concat(this.buffer, bytes);
-    const messages = [];
-    for (; ; ) {
-      if (this.buffer.length < LENGTH_PREFIX_BYTES) break;
-      const length = new DataView(
-        this.buffer.buffer,
-        this.buffer.byteOffset,
-        LENGTH_PREFIX_BYTES
-      ).getUint32(0);
-      if (length > MAX_MESSAGE_BYTES) {
-        throw new ControlProtocolError(`framed length ${length} exceeds ${MAX_MESSAGE_BYTES}`);
-      }
-      if (this.buffer.length < LENGTH_PREFIX_BYTES + length) break;
-      const jsonBytes = this.buffer.subarray(LENGTH_PREFIX_BYTES, LENGTH_PREFIX_BYTES + length);
-      messages.push(JSON.parse(textDecoder2.decode(jsonBytes)));
-      this.buffer = this.buffer.subarray(LENGTH_PREFIX_BYTES + length);
-    }
-    if (this.buffer.byteOffset > 0) this.buffer = this.buffer.slice();
-    return messages;
-  }
-};
-function concat(a, b) {
-  if (a.length === 0) return b;
-  if (b.length === 0) return a;
-  const out = new Uint8Array(a.length + b.length);
-  out.set(a, 0);
-  out.set(b, a.length);
-  return out;
-}
-
-// src/tunnel/v2/control-agent.ts
-var DEFAULT_IGNORED = /* @__PURE__ */ new Set([
-  "node_modules",
-  ".git",
-  ".next",
-  "dist",
-  "build",
-  ".turbo",
-  ".cache",
-  ".cimplify"
-]);
-var ControlFsError = class extends Error {
-  constructor(code, message) {
-    super(message);
-    this.code = code;
-  }
-  code;
-};
-var ControlKind = class {
-  constructor(deps) {
-    this.deps = deps;
-  }
-  deps;
-  kind = CONTROL_KIND;
-  handle(incoming) {
-    void new ControlSession(incoming.stream, this.deps).run();
-  }
-};
-var ControlSession = class {
-  constructor(stream, deps) {
-    this.stream = stream;
-    this.deps = deps;
-  }
-  stream;
-  deps;
-  framer = new MessageFramer();
-  watch = null;
-  epoch = 0;
-  seq = 0;
-  // Serialize all writes so message bytes never interleave and event order
-  // (which carries seq) is preserved.
-  sending = Promise.resolve();
-  async run() {
-    try {
-      for (; ; ) {
-        const event = await this.stream.recv();
-        if (event === null) return;
-        if (event.type === "data") {
-          for (const message of this.framer.push(event.payload)) {
-            if (isRequest(message)) void this.dispatch(message);
-          }
-        } else if (event.type === "end") {
-          continue;
-        } else {
-          return;
-        }
-      }
-    } finally {
-      this.watch?.stop();
-    }
-  }
-  send(message) {
-    const bytes = encodeMessage(message);
-    this.sending = this.sending.then(() => this.stream.data(bytes).catch(() => {
-    }));
-  }
-  async dispatch(request) {
-    try {
-      const data = await this.execute(request);
-      this.send({ id: request.id, ok: true, data });
-    } catch (error) {
-      const code = error instanceof ControlFsError ? error.code : CONTROL_ERROR.IO;
-      const message = error instanceof Error ? error.message : String(error);
-      this.send({ id: request.id, ok: false, error: { code, message } });
-    }
-  }
-  async execute(request) {
-    const { fs: backend } = this.deps;
-    switch (request.op) {
-      case CONTROL_OP.READ:
-        return backend.read(str(request, FIELD.PATH));
-      case CONTROL_OP.WRITE:
-        await backend.write(str(request, FIELD.PATH), str(request, FIELD.CONTENT), enc(request));
-        return {};
-      case CONTROL_OP.DELETE:
-        await backend.delete(str(request, FIELD.PATH), request.recursive === true);
-        return {};
-      case CONTROL_OP.LIST:
-        return { entries: await backend.list(str(request, FIELD.PATH)) };
-      case CONTROL_OP.LIST_TREE:
-        return { paths: await backend.listTree() };
-      case CONTROL_OP.STAT:
-        return await backend.stat(str(request, FIELD.PATH));
-      case CONTROL_OP.MKDIR:
-        await backend.mkdir(str(request, FIELD.PATH));
-        return {};
-      case CONTROL_OP.RENAME:
-        await backend.rename(str(request, FIELD.FROM), str(request, FIELD.TO));
-        return {};
-      case CONTROL_OP.WATCH_START:
-        return this.startWatch(request);
-      case CONTROL_OP.WATCH_STOP:
-        this.watch?.stop();
-        this.watch = null;
-        return {};
-      case CONTROL_OP.EXEC:
-        return this.deps.exec.run(execCommand(request));
-      default:
-        throw new ControlFsError(CONTROL_ERROR.UNSUPPORTED, `unknown op ${request.op}`);
-    }
-  }
-  startWatch(request) {
-    this.watch?.stop();
-    this.epoch += 1;
-    this.seq = 0;
-    const epoch = this.epoch;
-    const paths = Array.isArray(request.paths) ? request.paths : [WORKSPACE_ROOT];
-    this.watch = this.deps.watcher.start(
-      paths,
-      (type, changed, hashes) => {
-        if (this.epoch !== epoch) return;
-        this.seq += 1;
-        this.send({
-          event: type,
-          paths: changed,
-          ...hashes ? { hashes } : {},
-          seq: this.seq,
-          epoch
-        });
-      },
-      () => {
-        if (this.epoch !== epoch) return;
-        this.send({ event: WATCH_EVENT.RESYNC, epoch });
-      }
-    );
-    return { epoch };
-  }
-};
-var WORKSPACE_ROOT = ".";
-var FIELD = {
-  PATH: "path",
-  CONTENT: "content",
-  FROM: "from",
-  TO: "to"
-};
-function str(request, field) {
-  const value = request[field];
-  if (typeof value !== "string") {
-    throw new ControlFsError(CONTROL_ERROR.INVALID_PATH, `missing string field '${field}'`);
-  }
-  return value;
-}
-function enc(request) {
-  return request.encoding === ENCODING.BASE64 ? ENCODING.BASE64 : ENCODING.UTF8;
-}
-function execCommand(request) {
-  const command = request.command;
-  if (typeof command === "string") return command;
-  if (Array.isArray(command) && command.every((part) => typeof part === "string")) {
-    return command;
-  }
-  throw new ControlFsError(CONTROL_ERROR.INVALID_PATH, "exec requires a command");
-}
-function resolveInRoot(root, rel) {
-  const resolved = path2.resolve(root, rel);
-  const rootWithSep = root.endsWith(path2.sep) ? root : root + path2.sep;
-  if (resolved !== root && !resolved.startsWith(rootWithSep)) {
-    throw new ControlFsError(CONTROL_ERROR.INVALID_PATH, `path escapes workspace: ${rel}`);
-  }
-  return resolved;
-}
-function isIgnored(rel) {
-  return rel.split(/[\\/]/).some((segment) => DEFAULT_IGNORED.has(segment));
-}
-var NodeControlFs = class {
-  constructor(root) {
-    this.root = root;
-  }
-  root;
-  async read(rel) {
-    const abs = resolveInRoot(this.root, rel);
-    const bytes = await promises.readFile(abs).catch(rethrow(rel));
-    const text = tryDecodeUtf8(bytes);
-    return text !== null ? { content: text, encoding: ENCODING.UTF8 } : { content: Buffer.from(bytes).toString("base64"), encoding: ENCODING.BASE64 };
-  }
-  async write(rel, content, encoding) {
-    const abs = resolveInRoot(this.root, rel);
-    await promises.mkdir(path2.dirname(abs), { recursive: true });
-    const bytes = encoding === ENCODING.BASE64 ? Buffer.from(content, "base64") : Buffer.from(content, "utf8");
-    await promises.writeFile(abs, bytes).catch(rethrow(rel));
-  }
-  async delete(rel, recursive) {
-    const abs = resolveInRoot(this.root, rel);
-    await promises.rm(abs, { recursive, force: true });
-  }
-  async list(rel) {
-    const abs = resolveInRoot(this.root, rel);
-    const dirents = await promises.readdir(abs, { withFileTypes: true }).catch(rethrow(rel));
-    return dirents.filter((d) => !DEFAULT_IGNORED.has(d.name)).map((d) => ({ name: d.name, dir: d.isDirectory() }));
-  }
-  async listTree() {
-    const out = [];
-    const walk = async (dir) => {
-      const dirents = await promises.readdir(path2.join(this.root, dir), { withFileTypes: true });
-      for (const dirent of dirents) {
-        if (DEFAULT_IGNORED.has(dirent.name)) continue;
-        const rel = dir ? `${dir}/${dirent.name}` : dirent.name;
-        if (dirent.isDirectory()) await walk(rel);
-        else out.push(rel);
-      }
-    };
-    await walk("");
-    return out;
-  }
-  async stat(rel) {
-    const abs = resolveInRoot(this.root, rel);
-    const stat = await promises.stat(abs).catch(rethrow(rel));
-    return {
-      kind: stat.isDirectory() ? "dir" : "file",
-      size: stat.size,
-      mtimeMs: Math.floor(stat.mtimeMs)
-    };
-  }
-  async mkdir(rel) {
-    await promises.mkdir(resolveInRoot(this.root, rel), { recursive: true });
-  }
-  async rename(from, to) {
-    const absFrom = resolveInRoot(this.root, from);
-    const absTo = resolveInRoot(this.root, to);
-    await promises.mkdir(path2.dirname(absTo), { recursive: true });
-    await promises.rename(absFrom, absTo).catch(rethrow(from));
-  }
-};
-var WATCH_DEBOUNCE_MS = 60;
-var MAX_WATCH_PENDING_PATHS = 4096;
-var MAX_WATCH_TRACKED_PATHS = 1e5;
-var CONTENT_HASH_ALGORITHM = "sha256";
-var CONTENT_HASH_ENCODING = "hex";
-var NodeControlWatcher = class {
-  constructor(root) {
-    this.root = root;
-  }
-  root;
-  start(_relPaths, onEvent, onResync) {
-    let watcher;
-    const pending = /* @__PURE__ */ new Map();
-    const versions = /* @__PURE__ */ new Map();
-    const observed = /* @__PURE__ */ new Map();
-    let stopped = false;
-    const clearTracking = () => {
-      for (const timer of pending.values()) clearTimeout(timer);
-      pending.clear();
-      versions.clear();
-      observed.clear();
-    };
-    const requestResync = () => {
-      clearTracking();
-      if (!stopped) onResync();
-    };
-    const flush = async (rel, version) => {
-      pending.delete(rel);
-      try {
-        const absolute = path2.join(this.root, rel);
-        const stat = await promises.stat(absolute);
-        if (stat.isDirectory()) return;
-        const bytes = await promises.readFile(absolute);
-        if (stopped || versions.get(rel) !== version) return;
-        const hash = createHash(CONTENT_HASH_ALGORITHM).update(bytes).digest(CONTENT_HASH_ENCODING);
-        if (observed.get(rel) === hash) return;
-        observed.set(rel, hash);
-        onEvent(WATCH_EVENT.CHANGE, [rel], { [rel]: hash });
-      } catch (error) {
-        if (stopped || versions.get(rel) !== version) return;
-        if (error.code === "ENOENT") {
-          if (observed.get(rel) === null) return;
-          observed.set(rel, null);
-          onEvent(WATCH_EVENT.REMOVE, [rel]);
-        } else {
-          requestResync();
-        }
-      }
-      if (observed.size > MAX_WATCH_TRACKED_PATHS) {
-        requestResync();
-      }
-    };
-    try {
-      watcher = watch(this.root, { recursive: true }, (_type, filename) => {
-        if (filename === null) {
-          requestResync();
-          return;
-        }
-        const rel = filename.toString().split(path2.sep).join("/");
-        if (isIgnored(rel)) return;
-        const existing = pending.get(rel);
-        if (existing) clearTimeout(existing);
-        if (!existing && pending.size >= MAX_WATCH_PENDING_PATHS) {
-          requestResync();
-          return;
-        }
-        const version = (versions.get(rel) ?? 0) + 1;
-        versions.set(rel, version);
-        if (versions.size > MAX_WATCH_TRACKED_PATHS) {
-          requestResync();
-          return;
-        }
-        pending.set(
-          rel,
-          setTimeout(() => void flush(rel, version), WATCH_DEBOUNCE_MS)
-        );
-      });
-    } catch (error) {
-      throw new ControlFsError(
-        CONTROL_ERROR.IO,
-        `failed to start workspace watcher: ${error instanceof Error ? error.message : String(error)}`
-      );
-    }
-    watcher.on("error", () => {
-      requestResync();
-    });
-    return {
-      stop: () => {
-        stopped = true;
-        clearTracking();
-        watcher.close();
-      }
-    };
-  }
-};
-var EXEC_MAX_BUFFER = 8 * 1024 * 1024;
-var NodeControlExec = class {
-  constructor(root) {
-    this.root = root;
-  }
-  root;
-  run(command) {
-    const [file, args, shell] = Array.isArray(command) ? [command[0], command.slice(1), false] : [command, [], true];
-    return new Promise((resolve) => {
-      const child = spawn(file, args, { cwd: this.root, shell, env: process.env });
-      let stdout = "";
-      let stderr = "";
-      let truncated = false;
-      const cap = (existing, chunk) => {
-        if (existing.length >= EXEC_MAX_BUFFER) {
-          truncated = true;
-          return existing;
-        }
-        return existing + chunk.toString("utf8");
-      };
-      child.stdout?.on("data", (chunk) => stdout = cap(stdout, chunk));
-      child.stderr?.on("data", (chunk) => stderr = cap(stderr, chunk));
-      child.on("error", (error) => resolve({ stdout, stderr: error.message, exitCode: 127 }));
-      child.on("close", (code) => {
-        if (truncated) stderr += "\n[output truncated]";
-        resolve({ stdout, stderr, exitCode: code ?? 0 });
-      });
-    });
-  }
-};
-function tryDecodeUtf8(bytes) {
-  try {
-    const text = new TextDecoder("utf8", { fatal: true }).decode(bytes);
-    return text;
-  } catch {
-    return null;
-  }
-}
-function rethrow(rel) {
-  return (error) => {
-    if (error.code === "ENOENT")
-      throw new ControlFsError(CONTROL_ERROR.NOT_FOUND, `not found: ${rel}`);
-    if (error.code === "EACCES") throw new ControlFsError(CONTROL_ERROR.PERMISSION_DENIED, rel);
-    throw new ControlFsError(CONTROL_ERROR.IO, error.message);
-  };
-}
-
-// src/tunnel/protocol.ts
-var MAX_PAYLOAD = 262144;
-var HEADER_LEN2 = 9;
-var SUBPROTOCOL = "cimplify-tunnel.v1";
-var CONNECT_PATH = "/__cimplify/connect";
-var FRAME_TYPE = {
-  OPEN_HTTP: 1,
-  OPEN_WS: 2,
-  RESP_HEAD: 3,
-  BODY: 4,
-  END: 5,
-  WS_TEXT: 6,
-  WS_BIN: 7,
-  CLOSE: 8
-};
-var KNOWN_FRAME_TYPES = new Set(Object.values(FRAME_TYPE));
-var TunnelProtocolError = class extends Error {
-};
-function encodeFrame(frame) {
-  if (frame.payload.length > MAX_PAYLOAD) {
-    throw new TunnelProtocolError(`payload length ${frame.payload.length} exceeds ${MAX_PAYLOAD}`);
-  }
-  const bytes = new Uint8Array(HEADER_LEN2 + frame.payload.length);
-  const view = new DataView(bytes.buffer);
-  view.setUint32(0, frame.streamId);
-  view.setUint8(4, frame.frameType);
-  view.setUint32(5, frame.payload.length);
-  bytes.set(frame.payload, HEADER_LEN2);
-  return bytes;
-}
-function decodeFrame(bytes) {
-  if (bytes.length < HEADER_LEN2) {
-    throw new TunnelProtocolError(`frame truncated: ${bytes.length} bytes`);
-  }
-  const view = new DataView(bytes.buffer, bytes.byteOffset, bytes.byteLength);
-  const streamId = view.getUint32(0);
-  const rawType = view.getUint8(4);
-  if (!KNOWN_FRAME_TYPES.has(rawType)) {
-    throw new TunnelProtocolError(`unknown frame type 0x${rawType.toString(16).padStart(2, "0")}`);
-  }
-  const declared = view.getUint32(5);
-  if (declared > MAX_PAYLOAD) {
-    throw new TunnelProtocolError(`payload length ${declared} exceeds ${MAX_PAYLOAD}`);
-  }
-  const actual = bytes.length - HEADER_LEN2;
-  if (declared !== actual) {
-    throw new TunnelProtocolError(
-      `payload length field ${declared} does not match remaining ${actual} bytes`
-    );
-  }
-  return { streamId, frameType: rawType, payload: bytes.subarray(HEADER_LEN2) };
-}
-var textEncoder4 = new TextEncoder();
-var textDecoder3 = new TextDecoder();
-function encodeJsonPayload(value) {
-  return textEncoder4.encode(JSON.stringify(value));
-}
-function decodeJsonPayload(payload) {
-  return JSON.parse(textDecoder3.decode(payload));
-}
-function* chunkPayload(bytes) {
-  if (bytes.length === 0) {
-    return;
-  }
-  for (let offset = 0; offset < bytes.length; offset += MAX_PAYLOAD) {
-    yield bytes.subarray(offset, Math.min(offset + MAX_PAYLOAD, bytes.length));
-  }
-}
-
-// src/tunnel/client.ts
-var LOCAL_HOST2 = "127.0.0.1";
-var SEND_HIGH_WATER_BYTES = 4 * 1024 * 1024;
-var BACKPRESSURE_POLL_MS = 25;
-var EMPTY_PAYLOAD = new Uint8Array(0);
-var HEADER_SEC_WS_PROTOCOL2 = "sec-websocket-protocol";
-var HEADER_CONTENT_TYPE_TEXT = ["content-type", "text/plain; charset=utf-8"];
-var WS_CLOSE_NORMAL = 1e3;
-var HOP_BY_HOP_HEADERS2 = /* @__PURE__ */ new Set([
-  "connection",
-  "keep-alive",
-  "proxy-authenticate",
-  "proxy-authorization",
-  "te",
-  "trailer",
-  "transfer-encoding",
-  "upgrade"
-]);
-var textEncoder5 = new TextEncoder();
-var textDecoder4 = new TextDecoder();
-function defaultSocketFactory(url, protocols) {
-  const ctor = globalThis.WebSocket;
-  if (!ctor) {
-    throw new Error("global WebSocket is unavailable; the preview tunnel requires Bun or Node 22+");
-  }
-  return new ctor(url, protocols);
-}
-function connectUrl(baseUrl, token) {
-  return `${baseUrl.replace(/\/+$/, "")}${CONNECT_PATH}?token=${encodeURIComponent(token)}`;
-}
-var TunnelClient = class {
-  constructor(options) {
-    this.options = options;
-  }
-  options;
-  streams = /* @__PURE__ */ new Map();
-  socket = null;
-  closed = false;
-  start() {
-    const factory = this.options.createSocket ?? defaultSocketFactory;
-    const socket = factory(connectUrl(this.options.url, this.options.token), [SUBPROTOCOL]);
-    socket.binaryType = "arraybuffer";
-    this.socket = socket;
-    socket.addEventListener("open", () => {
-      if (!this.closed) this.options.events?.onConnected?.();
-    });
-    socket.addEventListener("message", (event) => this.handleMessage(event.data));
-    socket.addEventListener(
-      "close",
-      (event) => this.teardown(`connection closed (${event.code ?? "unknown"})`, event.code)
-    );
-    socket.addEventListener("error", () => this.teardown("connection error"));
-    if (this.options.socketAlreadyOpen && !this.closed) this.options.events?.onConnected?.();
-  }
-  stop() {
-    if (this.closed) return;
-    try {
-      this.socket?.close(WS_CLOSE_NORMAL);
-    } catch {
-    }
-    this.teardown("stopped");
-  }
-  teardown(reason, closeCode) {
-    if (this.closed) return;
-    this.closed = true;
-    for (const handler of this.streams.values()) {
-      handler.abort();
-    }
-    this.streams.clear();
-    this.socket = null;
-    this.options.events?.onClosed?.(reason, closeCode);
-  }
-  handleMessage(data) {
-    if (this.closed) return;
-    let bytes;
-    if (data instanceof ArrayBuffer) {
-      bytes = new Uint8Array(data);
-    } else if (data instanceof Uint8Array) {
-      bytes = data;
-    } else {
-      this.failConnection("non-binary message violates the tunnel protocol");
-      return;
-    }
-    let frame;
-    try {
-      frame = decodeFrame(bytes);
-    } catch (err) {
-      this.failConnection(`undecodable frame: ${err.message}`);
-      return;
-    }
-    this.dispatch(frame);
-  }
-  dispatch(frame) {
-    const handler = this.streams.get(frame.streamId);
-    if (handler) {
-      if (frame.frameType === FRAME_TYPE.CLOSE) this.streams.delete(frame.streamId);
-      handler.handleFrame(frame);
-      return;
-    }
-    switch (frame.frameType) {
-      case FRAME_TYPE.OPEN_HTTP:
-        this.openHttp(frame);
-        break;
-      case FRAME_TYPE.OPEN_WS:
-        this.openWs(frame);
-        break;
-      case FRAME_TYPE.CLOSE:
-        break;
-      default:
-        this.sendClose(frame.streamId);
-    }
-  }
-  openHttp(frame) {
-    let head;
-    try {
-      head = decodeJsonPayload(frame.payload);
-    } catch {
-      this.sendClose(frame.streamId);
-      return;
-    }
-    this.streams.set(
-      frame.streamId,
-      new HttpProxyStream(this.contextFor(frame.streamId), head, this.options.localPort)
-    );
-  }
-  openWs(frame) {
-    let head;
-    try {
-      head = decodeJsonPayload(frame.payload);
-    } catch {
-      this.sendClose(frame.streamId);
-      return;
-    }
-    const factory = this.options.createLocalSocket ?? defaultSocketFactory;
-    this.streams.set(
-      frame.streamId,
-      new WsProxyStream(this.contextFor(frame.streamId), head, this.options.localPort, factory)
-    );
-  }
-  contextFor(streamId) {
-    return {
-      send: (frameType, payload) => this.sendFrame({ streamId, frameType, payload }),
-      sendJson: (frameType, value) => this.sendFrame({ streamId, frameType, payload: encodeJsonPayload(value) }),
-      finish: () => {
-        this.streams.delete(streamId);
-      },
-      fail: (info2) => {
-        this.streams.delete(streamId);
-        this.sendClose(streamId, info2);
-      },
-      bufferedAmount: () => this.socket?.bufferedAmount ?? 0
-    };
-  }
-  sendClose(streamId, info2) {
-    const payload = info2 && (info2.code !== void 0 || info2.reason !== void 0) ? encodeJsonPayload(info2) : EMPTY_PAYLOAD;
-    this.sendFrame({ streamId, frameType: FRAME_TYPE.CLOSE, payload });
-  }
-  sendFrame(frame) {
-    if (this.closed || !this.socket) return false;
-    try {
-      this.socket.send(encodeFrame(frame));
-      return true;
-    } catch {
-      return false;
-    }
-  }
-  failConnection(reason) {
-    try {
-      this.socket?.close(WS_CLOSE_NORMAL);
-    } catch {
-    }
-    this.teardown(reason);
-  }
-};
-var HttpProxyStream = class {
-  constructor(ctx, head, localPort) {
-    this.ctx = ctx;
-    this.request = http.request({
-      host: LOCAL_HOST2,
-      port: localPort,
-      method: head.method,
-      path: head.path,
-      headers: toNodeHeaders2(head.headers)
-    });
-    this.request.on("response", (response) => this.pumpResponse(response));
-    this.request.on("error", (err) => this.handleRequestError(err));
-  }
-  ctx;
-  request;
-  responded = false;
-  done = false;
-  handleFrame(frame) {
-    switch (frame.frameType) {
-      case FRAME_TYPE.BODY:
-        this.request.write(Buffer.from(frame.payload));
-        break;
-      case FRAME_TYPE.END:
-        this.request.end();
-        break;
-      case FRAME_TYPE.CLOSE:
-        this.abort();
-        break;
-      default:
-        this.ctx.fail();
-        this.abort();
-    }
-  }
-  abort() {
-    this.done = true;
-    this.request.destroy();
-  }
-  pumpResponse(response) {
-    this.responded = true;
-    const headers = [];
-    for (let i = 0; i + 1 < response.rawHeaders.length; i += 2) {
-      headers.push([response.rawHeaders[i].toLowerCase(), response.rawHeaders[i + 1]]);
-    }
-    const head = { status: response.statusCode ?? 502, headers };
-    if (!this.ctx.sendJson(FRAME_TYPE.RESP_HEAD, head)) {
-      this.abort();
-      return;
-    }
-    response.on("data", (chunk) => {
-      for (const piece of chunkPayload(chunk)) {
-        if (!this.ctx.send(FRAME_TYPE.BODY, piece)) {
-          this.abort();
-          return;
-        }
-      }
-      this.applyBackpressure(response);
-    });
-    response.on("end", () => {
-      if (this.done) return;
-      this.done = true;
-      this.ctx.send(FRAME_TYPE.END, EMPTY_PAYLOAD);
-      this.ctx.finish();
-    });
-    response.on("error", () => {
-      if (this.done) return;
-      this.done = true;
-      this.ctx.fail();
-    });
-  }
-  /** The mux socket has no stream-level flow control; pause the local read
-   * side when the shared connection's send buffer backs up. */
-  applyBackpressure(response) {
-    if (this.ctx.bufferedAmount() <= SEND_HIGH_WATER_BYTES) return;
-    response.pause();
-    const poll = () => {
-      if (this.done) return;
-      if (this.ctx.bufferedAmount() <= SEND_HIGH_WATER_BYTES) {
-        response.resume();
-      } else {
-        setTimeout(poll, BACKPRESSURE_POLL_MS);
-      }
-    };
-    setTimeout(poll, BACKPRESSURE_POLL_MS);
-  }
-  handleRequestError(err) {
-    if (this.done) return;
-    this.done = true;
-    if (this.responded) {
-      this.ctx.fail();
-      return;
-    }
-    this.ctx.sendJson(FRAME_TYPE.RESP_HEAD, {
-      status: 502,
-      headers: [HEADER_CONTENT_TYPE_TEXT]
-    });
-    this.ctx.send(FRAME_TYPE.BODY, textEncoder5.encode(`dev server unreachable: ${err.message}`));
-    this.ctx.send(FRAME_TYPE.END, EMPTY_PAYLOAD);
-    this.ctx.finish();
-  }
-};
-var WsProxyStream = class {
-  constructor(ctx, head, localPort, factory) {
-    this.ctx = ctx;
-    const protocols = head.headers.filter(([name]) => name === HEADER_SEC_WS_PROTOCOL2).flatMap(([, value]) => value.split(",")).map((value) => value.trim()).filter((value) => value.length > 0);
-    this.local = factory(`ws://${LOCAL_HOST2}:${localPort}${head.path}`, protocols);
-    this.local.binaryType = "arraybuffer";
-    this.local.addEventListener("open", () => {
-      this.opened = true;
-      const headers = this.local.protocol ? [[HEADER_SEC_WS_PROTOCOL2, this.local.protocol]] : [];
-      if (!this.ctx.sendJson(FRAME_TYPE.RESP_HEAD, { status: 101, headers })) {
-        this.abort();
-      }
-    });
-    this.local.addEventListener("message", (event) => this.forward(event.data));
-    this.local.addEventListener("close", (event) => {
-      if (this.done) return;
-      this.done = true;
-      this.ctx.fail({ code: sendableCloseCode2(event.code), reason: event.reason || void 0 });
-    });
-    this.local.addEventListener("error", () => {
-      if (this.done || this.opened) return;
-      this.done = true;
-      this.ctx.sendJson(FRAME_TYPE.RESP_HEAD, {
-        status: 502,
-        headers: [HEADER_CONTENT_TYPE_TEXT]
-      });
-      this.ctx.send(FRAME_TYPE.BODY, textEncoder5.encode("dev server refused the websocket"));
-      this.ctx.send(FRAME_TYPE.END, EMPTY_PAYLOAD);
-      this.ctx.finish();
-    });
-  }
-  ctx;
-  local;
-  opened = false;
-  done = false;
-  handleFrame(frame) {
-    switch (frame.frameType) {
-      case FRAME_TYPE.WS_TEXT:
-        this.local.send(textDecoder4.decode(frame.payload));
-        break;
-      case FRAME_TYPE.WS_BIN:
-        this.local.send(frame.payload);
-        break;
-      case FRAME_TYPE.CLOSE: {
-        this.done = true;
-        const info2 = parseCloseInfo(frame.payload);
-        this.local.close(sanitizeCloseCode(info2.code), info2.reason);
-        break;
-      }
-      default:
-        this.ctx.fail();
-        this.abort();
-    }
-  }
-  abort() {
-    this.done = true;
-    try {
-      this.local.close();
-    } catch {
-    }
-  }
-  forward(data) {
-    if (this.done) return;
-    let payload;
-    let frameType;
-    if (typeof data === "string") {
-      payload = textEncoder5.encode(data);
-      frameType = FRAME_TYPE.WS_TEXT;
-    } else if (data instanceof ArrayBuffer) {
-      payload = new Uint8Array(data);
-      frameType = FRAME_TYPE.WS_BIN;
-    } else if (data instanceof Uint8Array) {
-      payload = data;
-      frameType = FRAME_TYPE.WS_BIN;
-    } else {
-      return;
-    }
-    if (payload.length > MAX_PAYLOAD) {
-      this.done = true;
-      this.ctx.fail({ reason: "message exceeds tunnel frame cap" });
-      this.abort();
-      return;
-    }
-    if (!this.ctx.send(frameType, payload)) this.abort();
-  }
-};
-function toNodeHeaders2(pairs) {
-  const out = {};
-  for (const [name, value] of pairs) {
-    if (HOP_BY_HOP_HEADERS2.has(name)) continue;
-    const existing = out[name];
-    if (existing === void 0) {
-      out[name] = value;
-    } else if (Array.isArray(existing)) {
-      existing.push(value);
-    } else {
-      out[name] = [existing, value];
-    }
-  }
-  return out;
-}
-function parseCloseInfo(payload) {
-  if (payload.length === 0) return {};
-  try {
-    return decodeJsonPayload(payload);
-  } catch {
-    return {};
-  }
-}
-function sanitizeCloseCode(code) {
-  if (code === void 0) return void 0;
-  return code === WS_CLOSE_NORMAL || code >= 3e3 && code <= 4999 ? code : void 0;
-}
-function sendableCloseCode2(code) {
-  if (code === void 0) return void 0;
-  const legal = code >= 1e3 && code <= 1003 || code >= 1007 && code <= 1014 || code >= 3e3 && code <= 4999;
-  return legal ? code : void 0;
-}
-
-// src/tunnel/v2/flow.ts
-var SendWindow = class {
-  available;
-  constructor(initial) {
-    this.available = initial;
-  }
-  get availableCredit() {
-    return this.available;
-  }
-  grantable(wanted) {
-    return this.available <= 0 ? 0 : Math.min(this.available, wanted);
-  }
-  consume(n) {
-    this.available = Math.max(0, this.available - n);
-  }
-  /** Returns false on overflow past Number.MAX_SAFE_INTEGER (protocol error). */
-  increase(credit) {
-    const next = this.available + credit;
-    if (next > Number.MAX_SAFE_INTEGER) return false;
-    this.available = next;
-    return true;
-  }
-};
-var RecvWindow = class {
-  constructor(window) {
-    this.window = window;
-  }
-  window;
-  consumed = 0;
-  /** Credit to emit as WINDOW_UPDATE once half the window is consumed, else 0. */
-  recordConsumed(n) {
-    this.consumed += n;
-    if (this.window === 0 || this.consumed < Math.ceil(this.window / 2)) return 0;
-    const credit = this.consumed;
-    this.consumed = 0;
-    return credit;
-  }
-  outstandingCapacity() {
-    return Math.max(0, this.window - this.consumed);
-  }
-};
-
-// src/tunnel/v2/session.ts
-var SessionV2Error = class extends Error {
-};
-var StreamHandleV2 = class {
-  constructor(session, streamId) {
-    this.session = session;
-    this.streamId = streamId;
-  }
-  session;
-  streamId;
-  accept(head) {
-    return this.session.sendHead(this.streamId, FRAME_TYPE_V2.ACCEPT, head);
-  }
-  data(bytes) {
-    return this.session.queueData(this.streamId, bytes);
-  }
-  end() {
-    return this.session.sendEnd(this.streamId);
-  }
-  close(info2) {
-    return this.session.closeStream(this.streamId, info2);
-  }
-  rst(code) {
-    return this.session.rstStream(this.streamId, code);
-  }
-  /** Next event; null when the stream is gone. Reads drive window replenish. */
-  recv() {
-    return this.session.nextEvent(this.streamId);
-  }
-};
-var CONNECTION_STREAM_ID = 0;
-var LIVENESS_PING_INTERVAL_MS = 15e3;
-var LIVENESS_TIMEOUT_MS = 45e3;
-var FROZEN_TICK_GAP_MS = 6e4;
-var textEncoder6 = new TextEncoder();
-var textDecoder5 = new TextDecoder();
-var SessionV2 = class {
-  constructor(transport, options) {
-    this.transport = transport;
-    this.options = options;
-    this.nextStreamId = options.role === "service" ? 1 : 2;
-    this.connectionSend = new SendWindow(0);
-    this.connectionRecv = new RecvWindow(options.local.connection_window);
-    this.lastInboundAt = Date.now();
-    this.lastTickAt = Date.now();
-    this.livenessTimer = setInterval(() => this.onLivenessTick(), LIVENESS_PING_INTERVAL_MS);
-    this.livenessTimer.unref?.();
-    transport.onMessage((bytes) => this.onMessage(bytes));
-    transport.onClose((reason) => this.teardown(reason));
-  }
-  transport;
-  options;
-  streams = /* @__PURE__ */ new Map();
-  ready = [];
-  connectionSend;
-  connectionRecv;
-  peer = null;
-  nextStreamId;
-  draining = false;
-  closed = false;
-  sending = Promise.resolve();
-  lastInboundAt;
-  lastTickAt;
-  livenessTimer;
-  onLivenessTick() {
-    if (this.closed) return;
-    const now = Date.now();
-    const tickGap = now - this.lastTickAt;
-    this.lastTickAt = now;
-    if (tickGap < 0 || now < this.lastInboundAt) {
-      this.lastInboundAt = now;
-      return;
-    }
-    if (tickGap > FROZEN_TICK_GAP_MS) {
-      this.abort(`process froze ${Math.round(tickGap / 1e3)}s (suspend/resume); redialing`);
-      return;
-    }
-    if (now - this.lastInboundAt > LIVENESS_TIMEOUT_MS) {
-      this.abort(`no inbound frames for ${Math.round((now - this.lastInboundAt) / 1e3)}s`);
-      return;
-    }
-    void this.enqueueSend({
-      streamId: CONNECTION_STREAM_ID,
-      frameType: FRAME_TYPE_V2.PING,
-      payload: new Uint8Array(0)
-    });
-  }
-  /** Presumed-dead teardown: no farewell frames — the socket is a zombie. */
-  abort(reason) {
-    this.teardown(reason);
-    this.transport.close(1001, reason.slice(0, 100));
-  }
-  /** Send our HELLO; the peer's must arrive as its first frame. */
-  async start() {
-    const payload = textEncoder6.encode(JSON.stringify(this.options.local));
-    await this.transport.send(
-      encodeFrameV2({ streamId: CONNECTION_STREAM_ID, frameType: FRAME_TYPE_V2.HELLO, payload })
-    );
-  }
-  get peerHello() {
-    return this.peer;
-  }
-  async open(kind, head) {
-    if (this.closed || this.draining) throw new SessionV2Error("session closed or draining");
-    const peer = this.requirePeer();
-    if (!peer.capabilities.includes(kind)) throw new SessionV2Error(`peer lacks ${kind}`);
-    const streamId = this.nextStreamId;
-    this.nextStreamId += 2;
-    this.registerStream(streamId);
-    await this.sendHead(streamId, FRAME_TYPE_V2.OPEN, { kind, head });
-    return new StreamHandleV2(this, streamId);
-  }
-  async goAway(code, reason) {
-    this.draining = true;
-    await this.sendHead(CONNECTION_STREAM_ID, FRAME_TYPE_V2.GOAWAY, {
-      code,
-      last_stream_id: this.nextStreamId,
-      ...reason ? { reason } : {}
-    });
-  }
-  requirePeer() {
-    if (!this.peer) throw new SessionV2Error("handshake incomplete");
-    return this.peer;
-  }
-  registerStream(streamId) {
-    const peer = this.requirePeer();
-    const state = {
-      events: [],
-      waiter: null,
-      sendWindow: new SendWindow(peer.initial_stream_window),
-      recvWindow: new RecvWindow(this.options.local.initial_stream_window),
-      pending: [],
-      localEnded: false,
-      remoteEnded: false,
-      finished: false
-    };
-    this.streams.set(streamId, state);
-    return state;
-  }
-  onMessage(bytes) {
-    if (this.closed) return;
-    let frame;
-    try {
-      frame = decodeFrameV2(bytes, this.options.local.max_frame_payload);
-    } catch (error) {
-      this.fail(`undecodable frame: ${error.message}`);
-      return;
-    }
-    this.lastInboundAt = Date.now();
-    if (!this.peer) {
-      this.onHandshakeFrame(frame);
-      return;
-    }
-    void this.dispatch(frame);
-  }
-  onHandshakeFrame(frame) {
-    if (frame.frameType !== FRAME_TYPE_V2.HELLO || frame.streamId !== CONNECTION_STREAM_ID) {
-      this.fail("first frame was not HELLO");
-      return;
-    }
-    try {
-      const peer = parseHello(frame.payload);
-      if (peer.version !== this.options.local.version) {
-        this.fail(`peer version ${peer.version}`);
-        return;
-      }
-      this.peer = peer;
-      this.connectionSend = new SendWindow(peer.connection_window);
-    } catch (error) {
-      this.fail(error.message);
-    }
-  }
-  async dispatch(frame) {
-    switch (frame.frameType) {
-      case FRAME_TYPE_V2.HELLO:
-        this.fail("HELLO after handshake");
-        return;
-      case FRAME_TYPE_V2.OPEN:
-        this.onOpen(frame);
-        return;
-      case FRAME_TYPE_V2.ACCEPT:
-        this.deliver(frame.streamId, { type: "accepted", head: parseJson(frame.payload) });
-        return;
-      case FRAME_TYPE_V2.DATA:
-        this.onData(frame);
-        return;
-      case FRAME_TYPE_V2.END:
-        this.onEnd(frame.streamId);
-        return;
-      case FRAME_TYPE_V2.CLOSE:
-        this.finishStream(frame.streamId, { type: "close", info: parseJson(frame.payload) });
-        return;
-      case FRAME_TYPE_V2.RST:
-        this.finishStream(frame.streamId, {
-          type: "rst",
-          code: payloadU32(frame) ?? ERROR_CODE.PROTOCOL_ERROR
-        });
-        return;
-      case FRAME_TYPE_V2.WINDOW_UPDATE:
-        this.onWindowUpdate(frame);
-        return;
-      case FRAME_TYPE_V2.PING:
-        this.enqueueSend({ streamId: 0, frameType: FRAME_TYPE_V2.PONG, payload: frame.payload });
-        return;
-      case FRAME_TYPE_V2.GOAWAY:
-        this.draining = true;
-        return;
-      default:
-        return;
-    }
-  }
-  onOpen(frame) {
-    const streamId = frame.streamId;
-    const allocatesLocally = this.options.role === "service" ? streamId % 2 === 1 : streamId % 2 === 0;
-    if (streamId === CONNECTION_STREAM_ID || allocatesLocally || this.streams.has(streamId)) {
-      this.fail(`peer opened stream ${streamId}`);
-      return;
-    }
-    if (this.streams.size >= this.options.local.max_concurrent_streams || this.draining) {
-      this.enqueueSend(rstFrame(streamId, ERROR_CODE.REFUSED));
-      return;
-    }
-    const open = parseJson(frame.payload);
-    if (!open || typeof open.kind !== "string") {
-      this.enqueueSend(rstFrame(streamId, ERROR_CODE.PROTOCOL_ERROR));
-      return;
-    }
-    if (!this.options.local.capabilities.includes(open.kind)) {
-      this.enqueueSend(rstFrame(streamId, ERROR_CODE.UNSUPPORTED));
-      return;
-    }
-    this.registerStream(streamId);
-    this.options.onIncoming({
-      kind: open.kind,
-      head: open.head ?? null,
-      stream: new StreamHandleV2(this, streamId)
-    });
-  }
-  onData(frame) {
-    const len = frame.payload.length;
-    if (len > this.connectionRecv.outstandingCapacity()) {
-      this.fail("connection window overrun");
-      return;
-    }
-    const state = this.streams.get(frame.streamId);
-    if (!state) {
-      this.enqueueSend(rstFrame(frame.streamId, ERROR_CODE.STREAM_CLOSED));
-      return;
-    }
-    if (len > state.recvWindow.outstandingCapacity()) {
-      this.enqueueSend(rstFrame(frame.streamId, ERROR_CODE.FLOW_CONTROL_ERROR));
-      this.dropStream(frame.streamId);
-      return;
-    }
-    this.deliver(frame.streamId, { type: "data", payload: frame.payload });
-  }
-  onEnd(streamId) {
-    const state = this.streams.get(streamId);
-    if (!state) return;
-    state.remoteEnded = true;
-    this.deliver(streamId, { type: "end" });
-    if (state.localEnded) this.dropStream(streamId);
-  }
-  onWindowUpdate(frame) {
-    const credit = payloadU32(frame);
-    if (!credit) {
-      this.fail("bad WINDOW_UPDATE");
-      return;
-    }
-    const grew = frame.streamId === CONNECTION_STREAM_ID ? this.connectionSend.increase(credit) : this.streams.get(frame.streamId)?.sendWindow.increase(credit) ?? true;
-    if (!grew) {
-      this.fail("window overflow");
-      return;
-    }
-    this.drainReady();
-  }
-  // --- outbound path -------------------------------------------------------
-  queueData(streamId, bytes) {
-    const state = this.streams.get(streamId);
-    if (!state || this.closed) return Promise.reject(new SessionV2Error("stream closed"));
-    return new Promise((resolve, reject) => {
-      state.pending.push({ bytes, resolve, reject });
-      if (!this.ready.includes(streamId)) this.ready.push(streamId);
-      this.drainReady();
-    });
-  }
-  /** Round-robin: one window-and-frame-capped chunk per ready stream per turn. */
-  drainReady() {
-    const peer = this.peer;
-    if (!peer) return;
-    let turns = this.ready.length;
-    while (turns > 0) {
-      turns -= 1;
-      const streamId = this.ready.shift();
-      if (streamId === void 0) break;
-      const state = this.streams.get(streamId);
-      if (!state) continue;
-      const item = state.pending[0];
-      if (!item) continue;
-      const wanted = Math.min(item.bytes.length, peer.max_frame_payload);
-      const grant = this.connectionSend.grantable(state.sendWindow.grantable(wanted));
-      if (grant === 0) {
-        this.ready.push(streamId);
-        if (this.connectionSend.availableCredit <= 0) break;
-        continue;
-      }
-      const chunk = item.bytes.subarray(0, grant);
-      item.bytes = item.bytes.subarray(grant);
-      state.sendWindow.consume(grant);
-      this.connectionSend.consume(grant);
-      const finished = item.bytes.length === 0;
-      if (finished) state.pending.shift();
-      if (state.pending.length > 0) {
-        this.ready.push(streamId);
-        turns += 1;
-      }
-      this.enqueueSend({ streamId, frameType: FRAME_TYPE_V2.DATA, payload: chunk });
-      if (finished) item.resolve();
-    }
-  }
-  sendHead(streamId, frameType, value) {
-    const payload = textEncoder6.encode(JSON.stringify(value ?? null));
-    if (payload.length > MAX_HEAD_BYTES) {
-      return Promise.reject(new SessionV2Error("head exceeds MAX_HEAD_BYTES"));
-    }
-    return this.enqueueSend({ streamId, frameType, payload });
-  }
-  sendEnd(streamId) {
-    const state = this.streams.get(streamId);
-    const result = this.enqueueSend({
-      streamId,
-      frameType: FRAME_TYPE_V2.END,
-      payload: new Uint8Array(0)
-    });
-    if (state) {
-      state.localEnded = true;
-      if (state.remoteEnded) this.dropStream(streamId);
-    }
-    return result;
-  }
-  async closeStream(streamId, info2) {
-    await this.sendHead(streamId, FRAME_TYPE_V2.CLOSE, info2);
-    this.dropStream(streamId);
-  }
-  async rstStream(streamId, code) {
-    await this.enqueueSend(rstFrame(streamId, code));
-    this.dropStream(streamId);
-  }
-  /** Serialize transport writes so frames never interleave mid-encode. */
-  enqueueSend(frame) {
-    const encoded = encodeFrameV2(frame);
-    const next = this.sending.then(() => this.transport.send(encoded));
-    this.sending = next.catch(() => {
-    });
-    return next;
-  }
-  // --- delivery ------------------------------------------------------------
-  nextEvent(streamId) {
-    const state = this.streams.get(streamId);
-    if (!state) return Promise.resolve(null);
-    const queued = state.events.shift();
-    if (queued) {
-      this.recordConsumption(streamId, queued);
-      if (state.finished && state.events.length === 0) this.streams.delete(streamId);
-      return Promise.resolve(queued);
-    }
-    if (state.finished) {
-      this.streams.delete(streamId);
-      return Promise.resolve(null);
-    }
-    return new Promise((resolve) => {
-      state.waiter = (event) => {
-        if (event) this.recordConsumption(streamId, event);
-        resolve(event);
-      };
-    });
-  }
-  recordConsumption(streamId, event) {
-    if (event.type !== "data") return;
-    const bytes = event.payload.length;
-    const connectionCredit = this.connectionRecv.recordConsumed(bytes);
-    if (connectionCredit > 0) {
-      this.enqueueSend(windowUpdateFrame(CONNECTION_STREAM_ID, connectionCredit));
-    }
-    const state = this.streams.get(streamId);
-    if (state) {
-      const streamCredit = state.recvWindow.recordConsumed(bytes);
-      if (streamCredit > 0) this.enqueueSend(windowUpdateFrame(streamId, streamCredit));
-    }
-  }
-  deliver(streamId, event) {
-    const state = this.streams.get(streamId);
-    if (!state) return;
-    if (state.waiter) {
-      const waiter = state.waiter;
-      state.waiter = null;
-      waiter(event);
-    } else {
-      state.events.push(event);
-    }
-  }
-  finishStream(streamId, event) {
-    this.deliver(streamId, event);
-    this.dropStream(streamId);
-  }
-  dropStream(streamId) {
-    const state = this.streams.get(streamId);
-    if (!state) return;
-    state.finished = true;
-    for (const pending of state.pending) {
-      pending.reject(new SessionV2Error("stream closed"));
-    }
-    state.pending = [];
-    const readyIndex = this.ready.indexOf(streamId);
-    if (readyIndex !== -1) this.ready.splice(readyIndex, 1);
-    if (state.waiter) {
-      const waiter = state.waiter;
-      state.waiter = null;
-      this.streams.delete(streamId);
-      waiter(null);
-    } else if (state.events.length === 0) {
-      this.streams.delete(streamId);
-    }
-  }
-  fail(reason) {
-    void this.sendHead(CONNECTION_STREAM_ID, FRAME_TYPE_V2.GOAWAY, {
-      code: ERROR_CODE.PROTOCOL_ERROR,
-      last_stream_id: this.nextStreamId,
-      reason
-    });
-    this.teardown(reason);
-    this.transport.close(1002, "protocol error");
-  }
-  teardown(reason) {
-    if (this.closed) return;
-    this.closed = true;
-    clearInterval(this.livenessTimer);
-    for (const streamId of this.streams.keys()) {
-      this.dropStream(streamId);
-    }
-    this.options.onClosed?.(reason);
-  }
-};
-function parseJson(payload) {
-  if (payload.length === 0) return null;
-  try {
-    return JSON.parse(textDecoder5.decode(payload));
-  } catch {
-    return null;
-  }
-}
-
-// src/tunnel/v2/ws-transport.ts
-var WsTransportV2 = class {
-  constructor(socket) {
-    this.socket = socket;
-    socket.binaryType = "arraybuffer";
-    socket.addEventListener("message", (event) => {
-      const data = event.data;
-      if (data instanceof ArrayBuffer) {
-        this.messageListener?.(new Uint8Array(data));
-      } else if (data instanceof Uint8Array) {
-        this.messageListener?.(data);
-      }
-    });
-    socket.addEventListener(
-      "close",
-      (event) => this.closeListener?.(`connection closed (${event.code ?? "unknown"})`)
-    );
-    socket.addEventListener("error", () => this.closeListener?.("connection error"));
-  }
-  socket;
-  messageListener = null;
-  closeListener = null;
-  send(frame) {
-    this.socket.send(frame);
-    return Promise.resolve();
-  }
-  onMessage(listener) {
-    this.messageListener = listener;
-  }
-  onClose(listener) {
-    this.closeListener = listener;
-  }
-  close(code, reason) {
-    try {
-      this.socket.close(code, reason);
-    } catch {
-    }
-  }
-};
-
-// src/tunnel/negotiating-client.ts
-var NegotiatingAgentClient = class {
-  constructor(options) {
-    this.options = options;
-  }
-  options;
-  socket = null;
-  driver = null;
-  closed = false;
-  start() {
-    const factory = this.options.createSocket ?? defaultSocketFactory;
-    const socket = factory(connectUrl(this.options.url, this.options.token), [
-      SUBPROTOCOL_V2,
-      SUBPROTOCOL
-    ]);
-    socket.binaryType = "arraybuffer";
-    this.socket = socket;
-    socket.addEventListener("open", () => {
-      if (this.closed || this.driver) return;
-      this.driver = socket.protocol === SUBPROTOCOL_V2 ? this.startV2(socket) : this.startV1(socket);
-    });
-    socket.addEventListener(
-      "close",
-      (event) => this.teardown(`connection closed (${event.code ?? "unknown"})`, event.code)
-    );
-    socket.addEventListener("error", () => this.teardown("connection error"));
-  }
-  stop() {
-    if (this.closed) return;
-    this.closed = true;
-    this.driver?.stop();
-    this.driver = null;
-    try {
-      this.socket?.close(1e3);
-    } catch {
-    }
-    this.socket = null;
-  }
-  teardown(reason, closeCode) {
-    if (this.closed) return;
-    this.closed = true;
-    this.driver?.stop();
-    this.driver = null;
-    this.socket = null;
-    this.options.events?.onClosed?.(reason, closeCode);
-  }
-  startV2(socket) {
-    const hello = defaultHello();
-    const transport = new WsTransportV2(socket);
-    const createLocalSocket = this.options.createLocalSocket ?? defaultSocketFactory;
-    const dispatcher = new AgentDispatcher().register(new HttpProxyKind(makeAgentContext(this.options.localPort, hello, createLocalSocket))).register(new WsSpliceKind(makeAgentContext(this.options.localPort, hello, createLocalSocket))).register(
-      new ControlKind({
-        fs: new NodeControlFs(this.options.workspaceRoot),
-        watcher: new NodeControlWatcher(this.options.workspaceRoot),
-        exec: new NodeControlExec(this.options.workspaceRoot)
-      })
-    );
-    const session = new SessionV2(transport, {
-      role: "agent",
-      local: hello,
-      onIncoming: (incoming) => dispatcher.dispatch(incoming),
-      onClosed: (reason) => this.teardown(`v2 session closed \u2014 ${reason}`)
-    });
-    void session.start();
-    this.options.events?.onConnected?.();
-    return { stop: () => transport.close(1e3, "stopped") };
-  }
-  startV1(socket) {
-    const client = new TunnelClient({
-      url: this.options.url,
-      token: this.options.token,
-      localPort: this.options.localPort,
-      createSocket: () => socket,
-      createLocalSocket: this.options.createLocalSocket,
-      events: this.options.events,
-      socketAlreadyOpen: true
-    });
-    client.start();
-    return { stop: () => client.stop() };
-  }
-};
-function makeAgentContext(localPort, hello, createLocalSocket) {
-  return {
-    localPort,
-    maxFramePayload: hello.max_frame_payload,
-    createLocalSocket: (url, protocols) => createLocalSocket(url, protocols)
-  };
-}
-
-// src/tunnel/manager.ts
-var CONFIG_POLL_MS = 2e3;
-var RECONNECT_MIN_MS = 1e3;
-var RECONNECT_MAX_MS = 3e4;
-var STAND_DOWN_RETRY_MS = 5 * 6e4;
-var CLOSE_CODE_REPLACED = 4e3;
-function makeDefaultCreateClient(workspaceRoot) {
-  return (config, events) => new NegotiatingAgentClient({
-    url: config.url,
-    token: config.token,
-    localPort: config.localPort,
-    workspaceRoot,
-    events
-  });
-}
-function startTunnelRuntime(cwd, options = {}) {
-  const pollIntervalMs = options.pollIntervalMs ?? CONFIG_POLL_MS;
-  const createClient = options.createClient ?? makeDefaultCreateClient(cwd);
-  const onStatus = options.onStatus ?? ((message) => info(dim(message)));
-  let stopped = false;
-  let generation = 0;
-  let activeConfig = null;
-  let activeClient = null;
-  let reconnectDelay = RECONNECT_MIN_MS;
-  let reconnectTimer = null;
-  let polling = false;
-  let connected = false;
-  let standDown = false;
-  const clearReconnect = () => {
-    if (reconnectTimer !== null) {
-      clearTimeout(reconnectTimer);
-      reconnectTimer = null;
-    }
-  };
-  let backoffResetTimer = null;
-  const startClient = (config) => {
-    generation += 1;
-    standDown = false;
-    const myGeneration = generation;
-    const client = createClient(config, {
-      onConnected: () => {
-        if (stopped || myGeneration !== generation) return;
-        connected = true;
-        if (backoffResetTimer) clearTimeout(backoffResetTimer);
-        backoffResetTimer = setTimeout(() => {
-          backoffResetTimer = null;
-          if (!stopped && connected && myGeneration === generation) {
-            reconnectDelay = RECONNECT_MIN_MS;
-          }
-        }, 1e4);
-        backoffResetTimer.unref?.();
-        onStatus("(preview tunnel: connected)");
-      },
-      onClosed: (reason, closeCode) => {
-        if (stopped || myGeneration !== generation) return;
-        connected = false;
-        if (closeCode === CLOSE_CODE_REPLACED) {
-          standDown = true;
-          onStatus("(preview tunnel: replaced by a newer agent; standing down)");
-          reconnectDelay = STAND_DOWN_RETRY_MS;
-          scheduleReconnect();
-          return;
-        }
-        onStatus(`(preview tunnel: disconnected \u2014 ${reason})`);
-        scheduleReconnect();
-      }
-    });
-    activeConfig = config;
-    activeClient = client;
-    client.start();
-  };
-  const retireClient = () => {
-    generation += 1;
-    activeClient?.stop();
-    activeClient = null;
-  };
-  const scheduleReconnect = () => {
-    if (reconnectTimer !== null) return;
-    const delay = reconnectDelay + Math.floor(Math.random() * (reconnectDelay / 4));
-    reconnectDelay = Math.min(reconnectDelay * 2, RECONNECT_MAX_MS);
-    reconnectTimer = setTimeout(() => {
-      reconnectTimer = null;
-      if (stopped || activeConfig === null) return;
-      retireClient();
-      startClient(activeConfig);
-    }, delay);
-  };
-  const stopClient = () => {
-    clearReconnect();
-    retireClient();
-    activeConfig = null;
-    connected = false;
-  };
-  const poll = async () => {
-    if (polling || stopped) return;
-    polling = true;
-    try {
-      const config = await readTunnelConfig(cwd, options.env);
-      if (stopped || sameTunnelConfig(config, activeConfig)) return;
-      if (config === null) {
-        stopClient();
-        onStatus("(preview tunnel: credentials removed, stopped)");
-        return;
-      }
-      if (activeConfig && sameTunnelEndpoint(config, activeConfig) && connected && !standDown) {
-        activeConfig = config;
-        return;
-      }
-      stopClient();
-      onStatus("(preview tunnel: credentials found, connecting)");
-      reconnectDelay = RECONNECT_MIN_MS;
-      startClient(config);
-    } finally {
-      polling = false;
-    }
-  };
-  const interval = setInterval(() => {
-    void poll();
-  }, pollIntervalMs);
-  void poll();
-  return () => {
-    if (stopped) return;
-    stopped = true;
-    clearInterval(interval);
-    stopClient();
-  };
-}
-
-export { TUNNEL_URL_ENV, startTunnelRuntime };