@creezio/electron-shell 0.22.0

package/dist/host/sandbox/os-sandbox.js

@@ -0,0 +1,98 @@
+/**
+ * Politique « OS desktop Creezio » — périmètre d'exécution strict.
+ *
+ * Principe : un build packagé ne doit JAMAIS résoudre un binaire via le PATH
+ * utilisateur, ni accepter un override d'environnement pointant hors du
+ * sandbox. Les seuls exécutables légitimes sont :
+ *   - ceux packagés sous `process.resourcesPath` (Node, Meili, git, cloudflared…)
+ *   - ceux installés par desktop sous `{userData}` (venv Hermes, npm-cli…)
+ *   - les utilitaires système FONDAMENTAUX de l'OS, résolus par CHEMIN ABSOLU
+ *     connu (jamais par nom sur le PATH) : PowerShell, tar, cmd, bash.
+ *
+ * Aucun import Electron ici : module pur, testable depuis Node.
+ */
+import fs from "node:fs";
+import path from "node:path";
+/**
+ * Les overrides `{PREFIX}_*_BIN`, `HERMES_BIN`, `TF2_USER_DATA_OVERRIDE`, etc. ne sont
+ * honorés qu'en build NON packagé (dev / CI / tests). En prod ils sont ignorés :
+ * un malware ou un raccourci piégé ne doit pas pouvoir détourner un spawn.
+ */
+export function overridesAllowed(isPackaged) {
+    return !isPackaged;
+}
+/**
+ * Répertoires système où un binaire OS fondamental est acceptable, par nom.
+ * Retourne le premier chemin absolu existant, ou null.
+ */
+export function resolveSystemBinary(name, opts) {
+    const platform = opts?.platform || process.platform;
+    const env = opts?.env || process.env;
+    const exists = opts?.existsSync || fs.existsSync;
+    if (platform === "win32") {
+        const sysRoot = (env.SystemRoot || env.windir || "C:\\Windows").replace(/[\\/]+$/, "");
+        const sys32 = path.win32.join(sysRoot, "System32");
+        const candidates = {
+            powershell: [
+                path.win32.join(sys32, "WindowsPowerShell", "v1.0", "powershell.exe"),
+            ],
+            cmd: [path.win32.join(sys32, "cmd.exe")],
+            // tar.exe (bsdtar) livré avec Windows 10 build 17063+.
+            tar: [path.win32.join(sys32, "tar.exe")],
+            taskkill: [path.win32.join(sys32, "taskkill.exe")],
+            // Git bash (rare) — resources MinGit géré ailleurs ; pas de fallback OS.
+            bash: [],
+        };
+        for (const c of candidates[name] || []) {
+            if (exists(c))
+                return c;
+        }
+        return null;
+    }
+    // POSIX (dev Linux / mac lab) : chemins standards.
+    const posix = {
+        bash: ["/bin/bash", "/usr/bin/bash"],
+        tar: ["/bin/tar", "/usr/bin/tar"],
+        cmd: [],
+        powershell: [],
+        taskkill: [],
+    };
+    for (const c of posix[name] || []) {
+        if (exists(c))
+            return c;
+    }
+    return null;
+}
+/**
+ * PATH minimal pour un process enfant confiné : uniquement les dossiers
+ * desktop (Node, binaires runtime) + le System32 de l'OS (pour que les
+ * utilitaires fondamentaux résolus en absolu trouvent leurs DLL). JAMAIS le
+ * PATH utilisateur complet — pas de résolution d'outils tiers installés.
+ */
+export function buildConfinedPath(opts) {
+    const env = opts.env || {};
+    const sep = opts.platform === "win32" ? ";" : ":";
+    const dirs = [...opts.toolDirs];
+    if (opts.platform === "win32") {
+        const sysRoot = (env.SystemRoot || env.windir || "C:\\Windows").replace(/[\\/]+$/, "");
+        dirs.push(path.win32.join(sysRoot, "System32"), sysRoot, path.win32.join(sysRoot, "System32", "Wbem"), path.win32.join(sysRoot, "System32", "WindowsPowerShell", "v1.0"));
+    }
+    else {
+        // Minimal POSIX : chemins système de base, pas ~/.local/bin ni brew.
+        dirs.push("/usr/bin", "/bin");
+    }
+    // Dédup en conservant l'ordre.
+    const seen = new Set();
+    const out = [];
+    for (const d of dirs) {
+        if (!d)
+            continue;
+        const norm = d;
+        if (seen.has(norm))
+            continue;
+        seen.add(norm);
+        out.push(norm);
+    }
+    return out.join(sep);
+}
+//# sourceMappingURL=os-sandbox.js.map

package/dist/host/sandbox/os-sandbox.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"os-sandbox.js","sourceRoot":"","sources":["../../../src/host/sandbox/os-sandbox.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAAC,UAAmB;IAClD,OAAO,CAAC,UAAU,CAAC;AACrB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,mBAAmB,CACjC,IAKc,EACd,IAIC;IAED,MAAM,QAAQ,GAAG,IAAI,EAAE,QAAQ,IAAI,OAAO,CAAC,QAAQ,CAAC;IACpD,MAAM,GAAG,GAAG,IAAI,EAAE,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;IACrC,MAAM,MAAM,GAAG,IAAI,EAAE,UAAU,IAAI,EAAE,CAAC,UAAU,CAAC;IAEjD,IAAI,QAAQ,KAAK,OAAO,EAAE,CAAC;QACzB,MAAM,OAAO,GAAG,CAAC,GAAG,CAAC,UAAU,IAAI,GAAG,CAAC,MAAM,IAAI,aAAa,CAAC,CAAC,OAAO,CACrE,SAAS,EACT,EAAE,CACH,CAAC;QACF,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;QACnD,MAAM,UAAU,GAA6B;YAC3C,UAAU,EAAE;gBACV,IAAI,CAAC,KAAK,CAAC,IAAI,CACb,KAAK,EACL,mBAAmB,EACnB,MAAM,EACN,gBAAgB,CACjB;aACF;YACD,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;YACxC,uDAAuD;YACvD,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;YACxC,QAAQ,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE,cAAc,CAAC,CAAC;YAClD,yEAAyE;YACzE,IAAI,EAAE,EAAE;SACT,CAAC;QACF,KAAK,MAAM,CAAC,IAAI,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC;YACvC,IAAI,MAAM,CAAC,CAAC,CAAC;gBAAE,OAAO,CAAC,CAAC;QAC1B,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,mDAAmD;IACnD,MAAM,KAAK,GAA6B;QACtC,IAAI,EAAE,CAAC,WAAW,EAAE,eAAe,CAAC;QACpC,GAAG,EAAE,CAAC,UAAU,EAAE,cAAc,CAAC;QACjC,GAAG,EAAE,EAAE;QACP,UAAU,EAAE,EAAE;QACd,QAAQ,EAAE,EAAE;KACb,CAAC;IACF,KAAK,MAAM,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC;QAClC,IAAI,MAAM,CAAC,CAAC,CAAC;YAAE,OAAO,CAAC,CAAC;IAC1B,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB,CAAC,IAKjC;IACC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,EAAE,CAAC;IAC3B,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;IAClD,MAAM,IAAI,GAAG,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,CAAC;IAEhC,IAAI,IAAI,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QAC9B,MAAM,OAAO,GAAG,CAAC,GAAG,CAAC,UAAU,IAAI,GAAG,CAAC,MAAM,IAAI,aAAa,CAAC,CAAC,OAAO,CACrE,SAAS,EACT,EAAE,CACH,CAAC;QACF,IAAI,CAAC,IAAI,CACP,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,UAAU,CAAC,EACpC,OAAO,EACP,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,UAAU,EAAE,MAAM,CAAC,EAC5C,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,UAAU,EAAE,mBAAmB,EAAE,MAAM,CAAC,CAClE,CAAC;IACJ,CAAC;SAAM,CAAC;QACN,qEAAqE;QACrE,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;IAChC,CAAC;IAED,+BAA+B;IAC/B,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;QACrB,IAAI,CAAC,CAAC;YAAE,SAAS;QACjB,MAAM,IAAI,GAAG,CAAC,CAAC;QACf,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,SAAS;QAC7B,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACf,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACjB,CAAC;IACD,OAAO,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACvB,CAAC"}

package/dist/host/server-env.d.ts

@@ -0,0 +1,50 @@
+/**
+ * Contrats / helpers pour le lancement du serveur Next embarqué.
+ * Le spawn complet (node-runtime, secrets local-config) reste branché
+ * par l'app marque — ici le noyau brand-agnostic.
+ */
+import type { ChildProcess } from "node:child_process";
+import type { AppManifest } from "@creezio/brand-config";
+import { findFreePort, waitForHealth, type BindHost } from "@creezio/platform-core";
+export type RunningServer = {
+    port: number;
+    baseUrl: string;
+    child: ChildProcess;
+    stop: () => void;
+};
+export type StartServerPaths = {
+    dbPath: string;
+    assistantDbPath: string;
+    uploadsDir: string;
+    nextServerEntry: string;
+    nodeBinary: string;
+};
+export type StartServerCoreOptions = {
+    manifest: AppManifest;
+    paths: StartServerPaths;
+    bindHost?: BindHost;
+    preferredPort?: number;
+    meiliHost?: string | null;
+    meiliMasterKey?: string | null;
+    authSecret?: string;
+    mcpJwtSecret?: string;
+    extraEnv?: Record<string, string>;
+    log?: (line: string) => void;
+    /**
+     * Spawn effectif — fourni par l'app (isole node-runtime / sandbox).
+     * Reçoit port + env déjà construits.
+     */
+    spawnServer: (opts: {
+        port: number;
+        hostname: string;
+        env: Record<string, string>;
+        entry: string;
+        nodeBinary: string;
+    }) => ChildProcess;
+};
+/**
+ * Alloue un port, construit l'env Next, spawn via callback, attend /health.
+ */
+export declare function startNextServerCore(opts: StartServerCoreOptions): Promise<RunningServer>;
+export { findFreePort, waitForHealth };
+//# sourceMappingURL=server-env.d.ts.map

package/dist/host/server-env.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"server-env.d.ts","sourceRoot":"","sources":["../../src/host/server-env.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AACvD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AACzD,OAAO,EAEL,YAAY,EACZ,aAAa,EACb,KAAK,QAAQ,EACd,MAAM,wBAAwB,CAAC;AAEhC,MAAM,MAAM,aAAa,GAAG;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,YAAY,CAAC;IACpB,IAAI,EAAE,MAAM,IAAI,CAAC;CAClB,CAAC;AAEF,MAAM,MAAM,gBAAgB,GAAG;IAC7B,MAAM,EAAE,MAAM,CAAC;IACf,eAAe,EAAE,MAAM,CAAC;IACxB,UAAU,EAAE,MAAM,CAAC;IACnB,eAAe,EAAE,MAAM,CAAC;IACxB,UAAU,EAAE,MAAM,CAAC;CACpB,CAAC;AAEF,MAAM,MAAM,sBAAsB,GAAG;IACnC,QAAQ,EAAE,WAAW,CAAC;IACtB,KAAK,EAAE,gBAAgB,CAAC;IACxB,QAAQ,CAAC,EAAE,QAAQ,CAAC;IACpB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAClC,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC7B;;;OAGG;IACH,WAAW,EAAE,CAAC,IAAI,EAAE;QAClB,IAAI,EAAE,MAAM,CAAC;QACb,QAAQ,EAAE,MAAM,CAAC;QACjB,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAC5B,KAAK,EAAE,MAAM,CAAC;QACd,UAAU,EAAE,MAAM,CAAC;KACpB,KAAK,YAAY,CAAC;CACpB,CAAC;AAEF;;GAEG;AACH,wBAAsB,mBAAmB,CACvC,IAAI,EAAE,sBAAsB,GAC3B,OAAO,CAAC,aAAa,CAAC,CAwDxB;AAED,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,CAAC"}

package/dist/host/server-env.js

@@ -0,0 +1,64 @@
+/**
+ * Contrats / helpers pour le lancement du serveur Next embarqué.
+ * Le spawn complet (node-runtime, secrets local-config) reste branché
+ * par l'app marque — ici le noyau brand-agnostic.
+ */
+import { buildNextHostEnv, findFreePort, waitForHealth, } from "@creezio/platform-core";
+/**
+ * Alloue un port, construit l'env Next, spawn via callback, attend /health.
+ */
+export async function startNextServerCore(opts) {
+    const log = opts.log ?? ((l) => console.log(`[server] ${l}`));
+    const bindHost = opts.bindHost ?? "127.0.0.1";
+    const port = await findFreePort(opts.preferredPort, bindHost);
+    const hostname = bindHost === "0.0.0.0" ? "0.0.0.0" : "127.0.0.1";
+    const baseUrl = bindHost === "0.0.0.0"
+        ? `http://127.0.0.1:${port}`
+        : `http://${hostname}:${port}`;
+    const env = buildNextHostEnv({
+        manifest: opts.manifest,
+        port,
+        hostname,
+        dbPath: opts.paths.dbPath,
+        assistantDbPath: opts.paths.assistantDbPath,
+        uploadsDir: opts.paths.uploadsDir,
+        meiliHost: opts.meiliHost,
+        meiliMasterKey: opts.meiliMasterKey,
+        authSecret: opts.authSecret,
+        mcpJwtSecret: opts.mcpJwtSecret,
+        extra: opts.extraEnv,
+    });
+    log(`spawn Next sur ${baseUrl} (entry ${opts.paths.nextServerEntry})`);
+    const mergedEnv = {};
+    for (const [k, v] of Object.entries({ ...process.env, ...env })) {
+        if (typeof v === "string")
+            mergedEnv[k] = v;
+    }
+    const child = opts.spawnServer({
+        port,
+        hostname,
+        env: mergedEnv,
+        entry: opts.paths.nextServerEntry,
+        nodeBinary: opts.paths.nodeBinary,
+    });
+    child.on("error", (e) => {
+        log(`spawn error: ${e.message}`);
+    });
+    await waitForHealth(baseUrl);
+    log(`serveur local prêt sur ${baseUrl}`);
+    return {
+        port,
+        baseUrl,
+        child,
+        stop: () => {
+            try {
+                child.kill();
+            }
+            catch {
+                /* ignore */
+            }
+        },
+    };
+}
+export { findFreePort, waitForHealth };
+//# sourceMappingURL=server-env.js.map

package/dist/host/server-env.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"server-env.js","sourceRoot":"","sources":["../../src/host/server-env.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAIH,OAAO,EACL,gBAAgB,EAChB,YAAY,EACZ,aAAa,GAEd,MAAM,wBAAwB,CAAC;AAyChC;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,IAA4B;IAE5B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC,CAAS,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC,CAAC;IACtE,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,WAAW,CAAC;IAC9C,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,IAAI,CAAC,aAAa,EAAE,QAAQ,CAAC,CAAC;IAC9D,MAAM,QAAQ,GAAG,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC;IAClE,MAAM,OAAO,GACX,QAAQ,KAAK,SAAS;QACpB,CAAC,CAAC,oBAAoB,IAAI,EAAE;QAC5B,CAAC,CAAC,UAAU,QAAQ,IAAI,IAAI,EAAE,CAAC;IAEnC,MAAM,GAAG,GAAG,gBAAgB,CAAC;QAC3B,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,IAAI;QACJ,QAAQ;QACR,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM;QACzB,eAAe,EAAE,IAAI,CAAC,KAAK,CAAC,eAAe;QAC3C,UAAU,EAAE,IAAI,CAAC,KAAK,CAAC,UAAU;QACjC,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,cAAc,EAAE,IAAI,CAAC,cAAc;QACnC,UAAU,EAAE,IAAI,CAAC,UAAU;QAC3B,YAAY,EAAE,IAAI,CAAC,YAAY;QAC/B,KAAK,EAAE,IAAI,CAAC,QAAQ;KACrB,CAAC,CAAC;IAEH,GAAG,CAAC,kBAAkB,OAAO,WAAW,IAAI,CAAC,KAAK,CAAC,eAAe,GAAG,CAAC,CAAC;IACvE,MAAM,SAAS,GAA2B,EAAE,CAAC;IAC7C,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,GAAG,GAAG,EAAE,CAAC,EAAE,CAAC;QAChE,IAAI,OAAO,CAAC,KAAK,QAAQ;YAAE,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IAC9C,CAAC;IACD,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,CAAC;QAC7B,IAAI;QACJ,QAAQ;QACR,GAAG,EAAE,SAAS;QACd,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,eAAe;QACjC,UAAU,EAAE,IAAI,CAAC,KAAK,CAAC,UAAU;KAClC,CAAC,CAAC;IAEH,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE;QACtB,GAAG,CAAC,gBAAgB,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;IACnC,CAAC,CAAC,CAAC;IAEH,MAAM,aAAa,CAAC,OAAO,CAAC,CAAC;IAC7B,GAAG,CAAC,0BAA0B,OAAO,EAAE,CAAC,CAAC;IAEzC,OAAO;QACL,IAAI;QACJ,OAAO;QACP,KAAK;QACL,IAAI,EAAE,GAAG,EAAE;YACT,IAAI,CAAC;gBACH,KAAK,CAAC,IAAI,EAAE,CAAC;YACf,CAAC;YAAC,MAAM,CAAC;gBACP,YAAY;YACd,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC;AAED,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,CAAC"}

package/dist/host/server-launcher.d.ts

@@ -0,0 +1,49 @@
+/**
+ * Spawn serveur Next standalone — wrapper marque autour de `startNextServerCore` (N2).
+ * Secrets / ports / paths / spawn injectés (plus de hardcode TF2_*).
+ */
+import type { ChildProcess } from "node:child_process";
+import type { AppManifest } from "@creezio/brand-config";
+import { type RunningServer, type StartServerCoreOptions, type StartServerPaths } from "./server-env.js";
+export type { RunningServer } from "./server-env.js";
+export type { BindHost } from "@creezio/platform-core";
+export { findFreePort, waitForHealth } from "./server-env.js";
+export type BrandServerLauncherDeps = {
+    manifest: AppManifest;
+    paths: StartServerPaths;
+    preferredPort: number;
+    ensureAuthSecret: () => string;
+    ensureMcpJwtSecret: () => string;
+    getLocalAuth: () => {
+        authUser: string;
+        authPassword: string;
+    } | null;
+    getLlmKeys: () => Record<string, string | undefined>;
+    /** Env additionnels (crash endpoint, plugins dir, …). */
+    buildExtraEnv?: () => Record<string, string>;
+    /**
+     * Spawn effectif (node isolé / sandbox marque).
+     * Requis — le kit ne spawn pas lui-même sans ce hook.
+     */
+    spawnServer: StartServerCoreOptions["spawnServer"];
+};
+export type StartBrandServerOptions = {
+    meiliHost?: string | null;
+    meiliMasterKey?: string | null;
+    extraEnv?: Record<string, string>;
+    onLog?: (line: string) => void;
+    bindHost?: "127.0.0.1" | "0.0.0.0";
+};
+/**
+ * Démarre Next via le noyau kit + injection marque.
+ */
+export declare function startBrandNextServer(deps: BrandServerLauncherDeps, opts?: StartBrandServerOptions): Promise<RunningServer>;
+/** Helper typé pour les marques qui re-exportent le spawn. */
+export type ServerSpawnFn = (opts: {
+    port: number;
+    hostname: string;
+    env: Record<string, string>;
+    entry: string;
+    nodeBinary: string;
+}) => ChildProcess;
+//# sourceMappingURL=server-launcher.d.ts.map

package/dist/host/server-launcher.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"server-launcher.d.ts","sourceRoot":"","sources":["../../src/host/server-launcher.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAGH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AACvD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AACzD,OAAO,EAEL,KAAK,aAAa,EAClB,KAAK,sBAAsB,EAC3B,KAAK,gBAAgB,EACtB,MAAM,iBAAiB,CAAC;AAEzB,YAAY,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AACrD,YAAY,EAAE,QAAQ,EAAE,MAAM,wBAAwB,CAAC;AACvD,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAE9D,MAAM,MAAM,uBAAuB,GAAG;IACpC,QAAQ,EAAE,WAAW,CAAC;IACtB,KAAK,EAAE,gBAAgB,CAAC;IACxB,aAAa,EAAE,MAAM,CAAC;IACtB,gBAAgB,EAAE,MAAM,MAAM,CAAC;IAC/B,kBAAkB,EAAE,MAAM,MAAM,CAAC;IACjC,YAAY,EAAE,MAAM;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;IACtE,UAAU,EAAE,MAAM,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC;IACrD,yDAAyD;IACzD,aAAa,CAAC,EAAE,MAAM,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC7C;;;OAGG;IACH,WAAW,EAAE,sBAAsB,CAAC,aAAa,CAAC,CAAC;CACpD,CAAC;AAEF,MAAM,MAAM,uBAAuB,GAAG;IACpC,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAClC,KAAK,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC/B,QAAQ,CAAC,EAAE,WAAW,GAAG,SAAS,CAAC;CACpC,CAAC;AAEF;;GAEG;AACH,wBAAsB,oBAAoB,CACxC,IAAI,EAAE,uBAAuB,EAC7B,IAAI,GAAE,uBAA4B,GACjC,OAAO,CAAC,aAAa,CAAC,CAgCxB;AAED,8DAA8D;AAC9D,MAAM,MAAM,aAAa,GAAG,CAAC,IAAI,EAAE;IACjC,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC5B,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,MAAM,CAAC;CACpB,KAAK,YAAY,CAAC"}

package/dist/host/server-launcher.js

@@ -0,0 +1,43 @@
+/**
+ * Spawn serveur Next standalone — wrapper marque autour de `startNextServerCore` (N2).
+ * Secrets / ports / paths / spawn injectés (plus de hardcode TF2_*).
+ */
+import fs from "node:fs";
+import { startNextServerCore, } from "./server-env.js";
+export { findFreePort, waitForHealth } from "./server-env.js";
+/**
+ * Démarre Next via le noyau kit + injection marque.
+ */
+export async function startBrandNextServer(deps, opts = {}) {
+    const entry = deps.paths.nextServerEntry;
+    if (!fs.existsSync(entry)) {
+        throw new Error(`Serveur Next standalone introuvable : ${entry}\n` +
+            `Lancer d'abord : npm run build && npm run electron:server`);
+    }
+    const auth = deps.getLocalAuth();
+    const llm = deps.getLlmKeys();
+    const extra = {
+        AUTH_USER: auth?.authUser ?? "",
+        AUTH_PASSWORD: auth?.authPassword ?? "",
+        ...(deps.buildExtraEnv?.() || {}),
+        ...(opts.extraEnv || {}),
+    };
+    for (const [k, v] of Object.entries(llm)) {
+        if (v)
+            extra[k] = v;
+    }
+    return startNextServerCore({
+        manifest: deps.manifest,
+        paths: deps.paths,
+        bindHost: opts.bindHost,
+        preferredPort: deps.preferredPort,
+        meiliHost: opts.meiliHost,
+        meiliMasterKey: opts.meiliMasterKey,
+        authSecret: deps.ensureAuthSecret(),
+        mcpJwtSecret: deps.ensureMcpJwtSecret(),
+        extraEnv: extra,
+        log: opts.onLog,
+        spawnServer: deps.spawnServer,
+    });
+}
+//# sourceMappingURL=server-launcher.js.map

package/dist/host/server-launcher.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"server-launcher.js","sourceRoot":"","sources":["../../src/host/server-launcher.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,MAAM,SAAS,CAAC;AAGzB,OAAO,EACL,mBAAmB,GAIpB,MAAM,iBAAiB,CAAC;AAIzB,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AA2B9D;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,IAA6B,EAC7B,OAAgC,EAAE;IAElC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC;IACzC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CACb,yCAAyC,KAAK,IAAI;YAChD,2DAA2D,CAC9D,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,GAAG,IAAI,CAAC,YAAY,EAAE,CAAC;IACjC,MAAM,GAAG,GAAG,IAAI,CAAC,UAAU,EAAE,CAAC;IAC9B,MAAM,KAAK,GAA2B;QACpC,SAAS,EAAE,IAAI,EAAE,QAAQ,IAAI,EAAE;QAC/B,aAAa,EAAE,IAAI,EAAE,YAAY,IAAI,EAAE;QACvC,GAAG,CAAC,IAAI,CAAC,aAAa,EAAE,EAAE,IAAI,EAAE,CAAC;QACjC,GAAG,CAAC,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAC;KACzB,CAAC;IACF,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACzC,IAAI,CAAC;YAAE,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IACtB,CAAC;IACD,OAAO,mBAAmB,CAAC;QACzB,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,aAAa,EAAE,IAAI,CAAC,aAAa;QACjC,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,cAAc,EAAE,IAAI,CAAC,cAAc;QACnC,UAAU,EAAE,IAAI,CAAC,gBAAgB,EAAE;QACnC,YAAY,EAAE,IAAI,CAAC,kBAAkB,EAAE;QACvC,QAAQ,EAAE,KAAK;QACf,GAAG,EAAE,IAAI,CAAC,KAAK;QACf,WAAW,EAAE,IAAI,CAAC,WAAW;KAC9B,CAAC,CAAC;AACL,CAAC"}

package/dist/host/tunnel/cloudflared-respawn.d.ts

@@ -0,0 +1,58 @@
+/**
+ * Politique de respawn borné pour cloudflared in-process.
+ *
+ * Sans superviseur, un process QUIC mort laisse le hostname public en 525
+ * alors que localhost reste 200 (recette / demo / admin, 15-16/08).
+ * Le respawn réutilise le token / tunnel id persisté — jamais de POST
+ * `cfd_tunnel` ici (`ensureCfTunnel` reste le seul chemin de (re)création).
+ */
+export declare const CLOUDFLARED_RESPAWN: {
+    /** Respawn consécutifs max avant abandon (jusqu'au prochain `start`). */
+    readonly maxAttempts: 8;
+    readonly initialDelayMs: 1000;
+    readonly maxDelayMs: 30000;
+    readonly factor: 2;
+    /** Uptime sain après lequel le compteur de pannes est remis à zéro. */
+    readonly healthyResetMs: 60000;
+};
+export type CloudflaredRespawnPolicy = {
+    maxAttempts: number;
+    initialDelayMs: number;
+    maxDelayMs: number;
+    factor: number;
+    healthyResetMs: number;
+};
+export type CloudflaredExitInfo = {
+    code: number | null;
+    signal: NodeJS.Signals | string | null;
+};
+export type CloudflaredRespawnDecision = {
+    action: "ignore";
+} | {
+    action: "give-up";
+    attempt: number;
+    reason: string;
+} | {
+    action: "respawn";
+    attempt: number;
+    delayMs: number;
+    reason: string;
+};
+/** Overrides ops/tests : `CREEZIO_CLOUDFLARED_RESPAWN_{MAX,DELAY_MS,MAX_DELAY_MS,HEALTHY_MS}`. */
+export declare function resolveCloudflaredRespawnPolicy(env?: NodeJS.ProcessEnv, base?: CloudflaredRespawnPolicy): CloudflaredRespawnPolicy;
+/** Backoff exponentiel borné — `attempt` est 1-based. */
+export declare function cloudflaredRespawnDelayMs(attempt: number, policy?: CloudflaredRespawnPolicy): number;
+export declare function describeCloudflaredExit(exit: CloudflaredExitInfo): string;
+/**
+ * Décide ignore (stop volontaire) / respawn / abandon.
+ * Une mort après `healthyResetMs` d'uptime remet le compteur à zéro.
+ */
+export declare function shouldRespawnCloudflared(opts: {
+    stopping: boolean;
+    consecutiveFailures: number;
+    startedAtMs: number | null;
+    exit: CloudflaredExitInfo;
+    nowMs?: number;
+    policy?: CloudflaredRespawnPolicy;
+}): CloudflaredRespawnDecision;
+//# sourceMappingURL=cloudflared-respawn.d.ts.map

package/dist/host/tunnel/cloudflared-respawn.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cloudflared-respawn.d.ts","sourceRoot":"","sources":["../../../src/host/tunnel/cloudflared-respawn.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,eAAO,MAAM,mBAAmB;IAC9B,yEAAyE;;;;;IAKzE,uEAAuE;;CAE/D,CAAC;AAEX,MAAM,MAAM,wBAAwB,GAAG;IACrC,WAAW,EAAE,MAAM,CAAC;IACpB,cAAc,EAAE,MAAM,CAAC;IACvB,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,cAAc,EAAE,MAAM,CAAC;CACxB,CAAC;AAEF,MAAM,MAAM,mBAAmB,GAAG;IAChC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,MAAM,EAAE,MAAM,CAAC,OAAO,GAAG,MAAM,GAAG,IAAI,CAAC;CACxC,CAAC;AAEF,MAAM,MAAM,0BAA0B,GAClC;IAAE,MAAM,EAAE,QAAQ,CAAA;CAAE,GACpB;IAAE,MAAM,EAAE,SAAS,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GACtD;IACE,MAAM,EAAE,SAAS,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;CAChB,CAAC;AAcN,kGAAkG;AAClG,wBAAgB,+BAA+B,CAC7C,GAAG,GAAE,MAAM,CAAC,UAAwB,EACpC,IAAI,GAAE,wBAA8C,GACnD,wBAAwB,CA4B1B;AAED,yDAAyD;AACzD,wBAAgB,yBAAyB,CACvC,OAAO,EAAE,MAAM,EACf,MAAM,GAAE,wBAA8C,GACrD,MAAM,CAIR;AAED,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,mBAAmB,GAAG,MAAM,CAKzE;AAED;;;GAGG;AACH,wBAAgB,wBAAwB,CAAC,IAAI,EAAE;IAC7C,QAAQ,EAAE,OAAO,CAAC;IAClB,mBAAmB,EAAE,MAAM,CAAC;IAC5B,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,IAAI,EAAE,mBAAmB,CAAC;IAC1B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,wBAAwB,CAAC;CACnC,GAAG,0BAA0B,CAkB7B"}

package/dist/host/tunnel/cloudflared-respawn.js

@@ -0,0 +1,73 @@
+/**
+ * Politique de respawn borné pour cloudflared in-process.
+ *
+ * Sans superviseur, un process QUIC mort laisse le hostname public en 525
+ * alors que localhost reste 200 (recette / demo / admin, 15-16/08).
+ * Le respawn réutilise le token / tunnel id persisté — jamais de POST
+ * `cfd_tunnel` ici (`ensureCfTunnel` reste le seul chemin de (re)création).
+ */
+export const CLOUDFLARED_RESPAWN = {
+    /** Respawn consécutifs max avant abandon (jusqu'au prochain `start`). */
+    maxAttempts: 8,
+    initialDelayMs: 1_000,
+    maxDelayMs: 30_000,
+    factor: 2,
+    /** Uptime sain après lequel le compteur de pannes est remis à zéro. */
+    healthyResetMs: 60_000,
+};
+function envInt(env, key, fallback, min) {
+    const raw = String(env[key] || "").trim();
+    if (!raw)
+        return fallback;
+    const n = Number(raw);
+    return Number.isFinite(n) && n >= min ? Math.floor(n) : fallback;
+}
+/** Overrides ops/tests : `CREEZIO_CLOUDFLARED_RESPAWN_{MAX,DELAY_MS,MAX_DELAY_MS,HEALTHY_MS}`. */
+export function resolveCloudflaredRespawnPolicy(env = process.env, base = CLOUDFLARED_RESPAWN) {
+    return {
+        maxAttempts: envInt(env, "CREEZIO_CLOUDFLARED_RESPAWN_MAX", base.maxAttempts, 1),
+        initialDelayMs: envInt(env, "CREEZIO_CLOUDFLARED_RESPAWN_DELAY_MS", base.initialDelayMs, 0),
+        maxDelayMs: envInt(env, "CREEZIO_CLOUDFLARED_RESPAWN_MAX_DELAY_MS", base.maxDelayMs, 0),
+        factor: base.factor,
+        healthyResetMs: envInt(env, "CREEZIO_CLOUDFLARED_RESPAWN_HEALTHY_MS", base.healthyResetMs, 0),
+    };
+}
+/** Backoff exponentiel borné — `attempt` est 1-based. */
+export function cloudflaredRespawnDelayMs(attempt, policy = CLOUDFLARED_RESPAWN) {
+    const exp = Math.max(0, attempt - 1);
+    const raw = policy.initialDelayMs * policy.factor ** exp;
+    return Math.min(policy.maxDelayMs, Math.max(0, Math.round(raw)));
+}
+export function describeCloudflaredExit(exit) {
+    if (exit.signal)
+        return `signal ${exit.signal}`;
+    if (exit.code === 0)
+        return "exit 0 (inattendu)";
+    if (exit.code == null)
+        return "mort inattendue";
+    return `exit ${exit.code}`;
+}
+/**
+ * Décide ignore (stop volontaire) / respawn / abandon.
+ * Une mort après `healthyResetMs` d'uptime remet le compteur à zéro.
+ */
+export function shouldRespawnCloudflared(opts) {
+    if (opts.stopping)
+        return { action: "ignore" };
+    const policy = opts.policy ?? CLOUDFLARED_RESPAWN;
+    const now = opts.nowMs ?? Date.now();
+    const healthy = opts.startedAtMs != null &&
+        now - opts.startedAtMs >= policy.healthyResetMs;
+    const attempt = (healthy ? 0 : opts.consecutiveFailures) + 1;
+    const reason = describeCloudflaredExit(opts.exit);
+    if (attempt > policy.maxAttempts) {
+        return { action: "give-up", attempt, reason };
+    }
+    return {
+        action: "respawn",
+        attempt,
+        delayMs: cloudflaredRespawnDelayMs(attempt, policy),
+        reason,
+    };
+}
+//# sourceMappingURL=cloudflared-respawn.js.map

package/dist/host/tunnel/cloudflared-respawn.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cloudflared-respawn.js","sourceRoot":"","sources":["../../../src/host/tunnel/cloudflared-respawn.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,MAAM,CAAC,MAAM,mBAAmB,GAAG;IACjC,yEAAyE;IACzE,WAAW,EAAE,CAAC;IACd,cAAc,EAAE,KAAK;IACrB,UAAU,EAAE,MAAM;IAClB,MAAM,EAAE,CAAC;IACT,uEAAuE;IACvE,cAAc,EAAE,MAAM;CACd,CAAC;AAyBX,SAAS,MAAM,CACb,GAAsB,EACtB,GAAW,EACX,QAAgB,EAChB,GAAW;IAEX,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAC1C,IAAI,CAAC,GAAG;QAAE,OAAO,QAAQ,CAAC;IAC1B,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;IACtB,OAAO,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;AACnE,CAAC;AAED,kGAAkG;AAClG,MAAM,UAAU,+BAA+B,CAC7C,MAAyB,OAAO,CAAC,GAAG,EACpC,OAAiC,mBAAmB;IAEpD,OAAO;QACL,WAAW,EAAE,MAAM,CACjB,GAAG,EACH,iCAAiC,EACjC,IAAI,CAAC,WAAW,EAChB,CAAC,CACF;QACD,cAAc,EAAE,MAAM,CACpB,GAAG,EACH,sCAAsC,EACtC,IAAI,CAAC,cAAc,EACnB,CAAC,CACF;QACD,UAAU,EAAE,MAAM,CAChB,GAAG,EACH,0CAA0C,EAC1C,IAAI,CAAC,UAAU,EACf,CAAC,CACF;QACD,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,cAAc,EAAE,MAAM,CACpB,GAAG,EACH,wCAAwC,EACxC,IAAI,CAAC,cAAc,EACnB,CAAC,CACF;KACF,CAAC;AACJ,CAAC;AAED,yDAAyD;AACzD,MAAM,UAAU,yBAAyB,CACvC,OAAe,EACf,SAAmC,mBAAmB;IAEtD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,GAAG,CAAC,CAAC,CAAC;IACrC,MAAM,GAAG,GAAG,MAAM,CAAC,cAAc,GAAG,MAAM,CAAC,MAAM,IAAI,GAAG,CAAC;IACzD,OAAO,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,UAAU,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;AACnE,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,IAAyB;IAC/D,IAAI,IAAI,CAAC,MAAM;QAAE,OAAO,UAAU,IAAI,CAAC,MAAM,EAAE,CAAC;IAChD,IAAI,IAAI,CAAC,IAAI,KAAK,CAAC;QAAE,OAAO,oBAAoB,CAAC;IACjD,IAAI,IAAI,CAAC,IAAI,IAAI,IAAI;QAAE,OAAO,iBAAiB,CAAC;IAChD,OAAO,QAAQ,IAAI,CAAC,IAAI,EAAE,CAAC;AAC7B,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,wBAAwB,CAAC,IAOxC;IACC,IAAI,IAAI,CAAC,QAAQ;QAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;IAC/C,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,mBAAmB,CAAC;IAClD,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;IACrC,MAAM,OAAO,GACX,IAAI,CAAC,WAAW,IAAI,IAAI;QACxB,GAAG,GAAG,IAAI,CAAC,WAAW,IAAI,MAAM,CAAC,cAAc,CAAC;IAClD,MAAM,OAAO,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,mBAAmB,CAAC,GAAG,CAAC,CAAC;IAC7D,MAAM,MAAM,GAAG,uBAAuB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAClD,IAAI,OAAO,GAAG,MAAM,CAAC,WAAW,EAAE,CAAC;QACjC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;IAChD,CAAC;IACD,OAAO;QACL,MAAM,EAAE,SAAS;QACjB,OAAO;QACP,OAAO,EAAE,yBAAyB,CAAC,OAAO,EAAE,MAAM,CAAC;QACnD,MAAM;KACP,CAAC;AACJ,CAAC"}

package/dist/host/tunnel/tunnel.d.ts

@@ -0,0 +1,72 @@
+/**
+ * Cloudflare Tunnel — service brand-agnostic.
+ *
+ * Auto-provisioning par l'instance elle-même via l'API Cloudflare (client
+ * `@creezio/platform-core` : tunnel-cf / tunnel-cf-client) — le provisioner
+ * VPS et le sidecar cloudflared sont supprimés (0.10.0, D3) : cloudflared
+ * tourne in-process, mode unique, **supervisé** (respawn borné si exit ≠ 0
+ * ou mort inattendue ; même tunnel id persisté). Contrat d'env : `CREEZIO_CF_API_TOKEN` /
+ * `CREEZIO_CF_ACCOUNT_ID` / `CREEZIO_CF_ZONE_ID` (+ variantes marque),
+ * arrivant au conteneur via `cf.env` (chmod 600) généré par le CLI.
+ */
+import { buildTunnelPublicUrls, deriveTunnelServiceUrl, type TunnelEmbedService, type TunnelPublicUrls } from "@creezio/platform-core";
+import type { HostRuntimeContext } from "../context.js";
+import type { LocalConfigStore, TunnelConfig } from "../local-config.js";
+export type TunnelRuntimeStatus = {
+    configured: boolean;
+    slug: string | null;
+    hostname: string | null;
+    publicUrl: string | null;
+    publicUrls: TunnelPublicUrls | null;
+    online: boolean;
+    error: string | null;
+    pcMustBeOn: true;
+};
+export type TunnelIngressPorts = {
+    crmPort: number;
+    n8nPort?: number | null;
+    hermesPort?: number | null;
+};
+export type TunnelService = {
+    getTunnelStatus: () => TunnelRuntimeStatus;
+    checkTunnelSlug: (slug: string) => Promise<{
+        available: boolean;
+        reason?: string;
+        hostname?: string;
+    }>;
+    reserveTunnel: (slug: string, localPort: number) => Promise<{
+        ok: true;
+        hostname: string;
+        publicUrl: string;
+    } | {
+        ok: false;
+        error: string;
+    }>;
+    configureTunnelIngress: (ports: TunnelIngressPorts) => Promise<void>;
+    /**
+     * Surface publique locale (sans Cloudflare) — MCP = `{publicUrl}/mcp`.
+     * Utilisé quand l'auto-provisioning CF n'est pas configuré / en harness.
+     */
+    enableLocalPublicSurface: (opts: {
+        localPort: number;
+        slug?: string;
+    }) => {
+        ok: true;
+        publicUrl: string;
+        publicMcp: string;
+    };
+    /** CRM public URL + `/mcp` (tunnel réel ou surface locale). */
+    publicMcpUrl: () => string | null;
+    publicUrlForEmbedService: (service: TunnelEmbedService) => string | null;
+    startCloudflared: () => Promise<void>;
+    stopCloudflared: () => void;
+    forgetTunnel: () => void;
+    publicUrlForServer: () => string | null;
+};
+export declare function createTunnelService(opts: {
+    ctx: HostRuntimeContext;
+    store: LocalConfigStore;
+}): TunnelService;
+export { buildTunnelPublicUrls, deriveTunnelServiceUrl };
+export type { TunnelConfig };
+//# sourceMappingURL=tunnel.d.ts.map

package/dist/host/tunnel/tunnel.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tunnel.d.ts","sourceRoot":"","sources":["../../../src/host/tunnel/tunnel.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAKH,OAAO,EACL,qBAAqB,EACrB,sBAAsB,EAWtB,KAAK,kBAAkB,EAEvB,KAAK,gBAAgB,EACtB,MAAM,wBAAwB,CAAC;AAChC,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAGxD,OAAO,KAAK,EAAE,gBAAgB,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAOzE,MAAM,MAAM,mBAAmB,GAAG;IAChC,UAAU,EAAE,OAAO,CAAC;IACpB,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,UAAU,EAAE,gBAAgB,GAAG,IAAI,CAAC;IACpC,MAAM,EAAE,OAAO,CAAC;IAChB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,UAAU,EAAE,IAAI,CAAC;CAClB,CAAC;AAEF,MAAM,MAAM,kBAAkB,GAAG;IAC/B,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC5B,CAAC;AAEF,MAAM,MAAM,aAAa,GAAG;IAC1B,eAAe,EAAE,MAAM,mBAAmB,CAAC;IAC3C,eAAe,EAAE,CACf,IAAI,EAAE,MAAM,KACT,OAAO,CAAC;QAAE,SAAS,EAAE,OAAO,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACzE,aAAa,EAAE,CACb,IAAI,EAAE,MAAM,EACZ,SAAS,EAAE,MAAM,KACd,OAAO,CACR;QAAE,EAAE,EAAE,IAAI,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,GACjD;QAAE,EAAE,EAAE,KAAK,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAC/B,CAAC;IACF,sBAAsB,EAAE,CAAC,KAAK,EAAE,kBAAkB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACrE;;;OAGG;IACH,wBAAwB,EAAE,CAAC,IAAI,EAAE;QAC/B,SAAS,EAAE,MAAM,CAAC;QAClB,IAAI,CAAC,EAAE,MAAM,CAAC;KACf,KAAK;QAAE,EAAE,EAAE,IAAI,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC;IACzD,+DAA+D;IAC/D,YAAY,EAAE,MAAM,MAAM,GAAG,IAAI,CAAC;IAClC,wBAAwB,EAAE,CAAC,OAAO,EAAE,kBAAkB,KAAK,MAAM,GAAG,IAAI,CAAC;IACzE,gBAAgB,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IACtC,eAAe,EAAE,MAAM,IAAI,CAAC;IAC5B,YAAY,EAAE,MAAM,IAAI,CAAC;IACzB,kBAAkB,EAAE,MAAM,MAAM,GAAG,IAAI,CAAC;CACzC,CAAC;AA0BF,wBAAgB,mBAAmB,CAAC,IAAI,EAAE;IACxC,GAAG,EAAE,kBAAkB,CAAC;IACxB,KAAK,EAAE,gBAAgB,CAAC;CACzB,GAAG,aAAa,CA8chB;AAED,OAAO,EAAE,qBAAqB,EAAE,sBAAsB,EAAE,CAAC;AACzD,YAAY,EAAE,YAAY,EAAE,CAAC"}