@crouton-kit/crouter 0.3.34 → 0.3.35

package/dist/hearth/wake-proxy/public-source-gate.d.ts

@@ -1,9 +0,0 @@
-import type { IncomingMessage, ServerResponse } from 'node:http';
-import { runGuestSource } from './guest-source.js';
-import type { HearthWakeProxyRuntime } from './types.js';
-export declare const PUBLIC_SOURCE_FILE_READ_SCRIPT = "import { constants } from 'node:fs';\nimport { open, realpath } from 'node:fs/promises';\nimport { posix as path } from 'node:path';\n\nconst blocked = () => {\n  console.log(JSON.stringify({ ok: false, status: 403, error: 'canvas artifact path is not allowed' }));\n  process.exit(0);\n};\n\nconst raw = await new Promise((resolve, reject) => {\n  let value = '';\n  process.stdin.setEncoding('utf8');\n  process.stdin.on('data', (chunk) => { value += chunk; });\n  process.stdin.on('end', () => resolve(value));\n  process.stdin.on('error', reject);\n});\n\nlet input;\ntry {\n  input = JSON.parse(raw);\n} catch {\n  blocked();\n}\nif (input === null || typeof input !== 'object' || Array.isArray(input)) {\n  blocked();\n}\nconst canvasHome = typeof input.canvasHome === 'string' ? input.canvasHome.trim() : '';\nconst piAgentDir = typeof input.piAgentDir === 'string' ? input.piAgentDir.trim() : '';\nconst requestedPath = typeof input.path === 'string' ? input.path.trim() : '';\nif (canvasHome === '' || piAgentDir === '' || requestedPath === '') {\n  blocked();\n}\nconst normalizedPath = path.normalize(requestedPath);\nif (normalizedPath !== requestedPath || !path.isAbsolute(normalizedPath) || normalizedPath.includes('\\\\')) {\n  blocked();\n}\nconst realCanvasHome = await realpath(canvasHome);\nconst allowedNodesPrefix = realCanvasHome + '/nodes/';\nif (!normalizedPath.startsWith(allowedNodesPrefix)) {\n  blocked();\n}\nconst relative = normalizedPath.slice(allowedNodesPrefix.length);\nconst segments = relative.split('/');\nconst nodeId = segments.shift() ?? '';\nconst rootKind = segments.shift() ?? '';\nconst fileRemainder = segments.join('/');\nif (nodeId === '' || (rootKind !== 'context' && rootKind !== 'reports') || fileRemainder === '' || fileRemainder.includes('..')) {\n  blocked();\n}\nconst targetReal = await realpath(normalizedPath);\nif (targetReal !== normalizedPath) {\n  blocked();\n}\nlet privateAgentReal = null;\ntry {\n  privateAgentReal = await realpath(piAgentDir);\n} catch {\n  privateAgentReal = null;\n}\nif (privateAgentReal !== null && (targetReal === privateAgentReal || targetReal.startsWith(privateAgentReal + '/'))) {\n  blocked();\n}\nconst fd = await open(targetReal, constants.O_RDONLY | constants.O_NOFOLLOW);\ntry {\n  const stats = await fd.stat();\n  if (!stats.isFile() || stats.nlink !== 1) {\n    blocked();\n  }\n  const text = await fd.readFile('utf8');\n  console.log(JSON.stringify({ ok: true, stdout: text }));\n} finally {\n  await fd.close();\n}\n";
-export interface PublicSourceGateDeps {
-    guestSource?: typeof runGuestSource;
-    now?: () => number;
-}
-export declare function handlePublicSourceRequest(req: IncomingMessage, res: ServerResponse, runtime: HearthWakeProxyRuntime, deps?: PublicSourceGateDeps): Promise<boolean>;

package/dist/hearth/wake-proxy/public-source-gate.js

@@ -1,409 +0,0 @@
-import { posix as pathPosix } from 'node:path';
-import { general } from '../../core/errors.js';
-import { guestEnv } from '../../core/hearth/guest-env.js';
-import { ensureProxyState, loadProxyState } from './state.js';
-import { resolveOwnerWriteAuth } from './auth.js';
-import { redactWakeProxyMessage } from './redact.js';
-import { requireSuccessfulExec, runGuestSource } from './guest-source.js';
-const SOURCE_PATH = '/__crtr/source';
-const BODY_LIMIT_BYTES = 64 * 1024;
-const EXEC_STDIN_LIMIT_BYTES = 16 * 1024;
-export const PUBLIC_SOURCE_FILE_READ_SCRIPT = `import { constants } from 'node:fs';
-import { open, realpath } from 'node:fs/promises';
-import { posix as path } from 'node:path';
-
-const blocked = () => {
-  console.log(JSON.stringify({ ok: false, status: 403, error: 'canvas artifact path is not allowed' }));
-  process.exit(0);
-};
-
-const raw = await new Promise((resolve, reject) => {
-  let value = '';
-  process.stdin.setEncoding('utf8');
-  process.stdin.on('data', (chunk) => { value += chunk; });
-  process.stdin.on('end', () => resolve(value));
-  process.stdin.on('error', reject);
-});
-
-let input;
-try {
-  input = JSON.parse(raw);
-} catch {
-  blocked();
-}
-if (input === null || typeof input !== 'object' || Array.isArray(input)) {
-  blocked();
-}
-const canvasHome = typeof input.canvasHome === 'string' ? input.canvasHome.trim() : '';
-const piAgentDir = typeof input.piAgentDir === 'string' ? input.piAgentDir.trim() : '';
-const requestedPath = typeof input.path === 'string' ? input.path.trim() : '';
-if (canvasHome === '' || piAgentDir === '' || requestedPath === '') {
-  blocked();
-}
-const normalizedPath = path.normalize(requestedPath);
-if (normalizedPath !== requestedPath || !path.isAbsolute(normalizedPath) || normalizedPath.includes('\\\\')) {
-  blocked();
-}
-const realCanvasHome = await realpath(canvasHome);
-const allowedNodesPrefix = realCanvasHome + '/nodes/';
-if (!normalizedPath.startsWith(allowedNodesPrefix)) {
-  blocked();
-}
-const relative = normalizedPath.slice(allowedNodesPrefix.length);
-const segments = relative.split('/');
-const nodeId = segments.shift() ?? '';
-const rootKind = segments.shift() ?? '';
-const fileRemainder = segments.join('/');
-if (nodeId === '' || (rootKind !== 'context' && rootKind !== 'reports') || fileRemainder === '' || fileRemainder.includes('..')) {
-  blocked();
-}
-const targetReal = await realpath(normalizedPath);
-if (targetReal !== normalizedPath) {
-  blocked();
-}
-let privateAgentReal = null;
-try {
-  privateAgentReal = await realpath(piAgentDir);
-} catch {
-  privateAgentReal = null;
-}
-if (privateAgentReal !== null && (targetReal === privateAgentReal || targetReal.startsWith(privateAgentReal + '/'))) {
-  blocked();
-}
-const fd = await open(targetReal, constants.O_RDONLY | constants.O_NOFOLLOW);
-try {
-  const stats = await fd.stat();
-  if (!stats.isFile() || stats.nlink !== 1) {
-    blocked();
-  }
-  const text = await fd.readFile('utf8');
-  console.log(JSON.stringify({ ok: true, stdout: text }));
-} finally {
-  await fd.close();
-}
-`;
-function currentState(runtime) {
-    return loadProxyState(runtime.proxy.statePath) ?? ensureProxyState(runtime.proxy);
-}
-function requestPathname(req) {
-    return new URL(req.url ?? '/', 'http://127.0.0.1').pathname;
-}
-function respondJson(res, statusCode, value) {
-    const body = `${JSON.stringify(value, null, 2)}\n`;
-    res.writeHead(statusCode, {
-        'content-type': 'application/json; charset=utf-8',
-        'content-length': Buffer.byteLength(body),
-        'cache-control': 'no-store',
-    });
-    res.end(body);
-}
-function respondText(res, statusCode, message) {
-    const body = `${redactWakeProxyMessage(message)}\n`;
-    res.writeHead(statusCode, {
-        'content-type': 'text/plain; charset=utf-8',
-        'content-length': Buffer.byteLength(body),
-        'cache-control': 'no-store',
-    });
-    res.end(body);
-}
-async function readJsonBody(req, limitBytes) {
-    return await new Promise((resolve, reject) => {
-        const chunks = [];
-        let bytes = 0;
-        const cleanup = () => {
-            req.off('data', onData);
-            req.off('end', onEnd);
-            req.off('error', onError);
-            req.off('aborted', onAbort);
-        };
-        const onData = (chunk) => {
-            bytes += chunk.byteLength;
-            if (bytes > limitBytes) {
-                cleanup();
-                req.destroy();
-                reject(general('request body too large', { limitBytes }));
-                return;
-            }
-            chunks.push(chunk);
-        };
-        const onEnd = () => {
-            cleanup();
-            try {
-                const text = Buffer.concat(chunks).toString('utf8');
-                resolve(text === '' ? {} : JSON.parse(text));
-            }
-            catch (error) {
-                reject(error);
-            }
-        };
-        const onError = (error) => {
-            cleanup();
-            reject(error instanceof Error ? error : new Error(String(error)));
-        };
-        const onAbort = () => {
-            cleanup();
-            reject(general('request aborted while reading body'));
-        };
-        req.on('data', onData);
-        req.once('end', onEnd);
-        req.once('error', onError);
-        req.once('aborted', onAbort);
-    });
-}
-function isPlainObject(value) {
-    return value !== null && typeof value === 'object' && !Array.isArray(value);
-}
-function parseExecRequest(body) {
-    if (body.kind !== 'exec')
-        return null;
-    const keys = Object.keys(body);
-    if (!keys.every((key) => key === 'kind' || key === 'bin' || key === 'args' || key === 'cwd' || key === 'stdin'))
-        return null;
-    if (typeof body.bin !== 'string' || !Array.isArray(body.args) || body.args.some((arg) => typeof arg !== 'string'))
-        return null;
-    if ('cwd' in body)
-        return null;
-    const request = {
-        kind: 'exec',
-        bin: body.bin,
-        args: body.args,
-    };
-    if ('stdin' in body) {
-        if (typeof body.stdin !== 'string' || Buffer.byteLength(body.stdin, 'utf8') > EXEC_STDIN_LIMIT_BYTES || !isAllowedCrtrWriteExec(request))
-            return null;
-        request.stdin = body.stdin;
-    }
-    return request;
-}
-function parseFileRequest(body) {
-    if (body.kind !== 'file')
-        return null;
-    if (Object.keys(body).some((key) => key !== 'kind' && key !== 'path'))
-        return null;
-    if (typeof body.path !== 'string' || body.path.trim() === '')
-        return null;
-    return { kind: 'file', path: body.path };
-}
-function isValidBrowserCanvasArtifactPath(canvasHome, piAgentDir, requestedPath) {
-    const normalizedCanvasHome = pathPosix.resolve(canvasHome);
-    const normalizedPiAgentDir = pathPosix.resolve(piAgentDir);
-    const normalizedPath = pathPosix.normalize(requestedPath);
-    if (normalizedPath !== requestedPath || !pathPosix.isAbsolute(normalizedPath) || normalizedPath.includes('\\'))
-        return false;
-    const allowedNodesPrefix = `${normalizedCanvasHome}/nodes/`;
-    const privateAgentPrefix = `${normalizedPiAgentDir}/`;
-    if (!normalizedPath.startsWith(allowedNodesPrefix) || normalizedPath.startsWith(privateAgentPrefix))
-        return false;
-    const relative = normalizedPath.slice(allowedNodesPrefix.length);
-    const segments = relative.split('/');
-    const nodeId = segments.shift() ?? '';
-    const rootKind = segments.shift() ?? '';
-    const fileRemainder = segments.join('/');
-    return nodeId !== '' && (rootKind === 'context' || rootKind === 'reports') && fileRemainder !== '' && !fileRemainder.includes('..');
-}
-function isSafeNodeId(nodeId) {
-    return nodeId.trim() !== '' && !nodeId.includes('/') && !nodeId.includes('\\') && !nodeId.includes('..');
-}
-function isAllowedCrtrWriteExec(req) {
-    if (req.bin !== 'crtr')
-        return false;
-    if (req.args.length < 3 || req.args[req.args.length - 1] !== '--json')
-        return false;
-    const args = req.args;
-    switch (args[0]) {
-        case 'node':
-            switch (args[1]) {
-                case 'new':
-                    return true;
-                case 'msg':
-                    return args.length >= 4 && isSafeNodeId(args[2] ?? '');
-                default:
-                    return false;
-            }
-        default:
-            return false;
-    }
-}
-function isAllowedCrtrExec(req) {
-    if (req.bin !== 'crtr')
-        return false;
-    if (req.args.length < 3 || req.args[req.args.length - 1] !== '--json')
-        return false;
-    const args = req.args;
-    switch (args[0]) {
-        case 'canvas':
-            switch (args[1]) {
-                case 'snapshot':
-                    return args.length === 3;
-                case 'revive':
-                    return (args.length === 4 || args.length === 5) && isSafeNodeId(args[2] ?? '') && (args.length === 4 || args[3] === '--fresh');
-                default:
-                    return false;
-            }
-        case 'node':
-            switch (args[1]) {
-                case 'inspect':
-                    return args.length === 5 && args[2] === 'show' && isSafeNodeId(args[3] ?? '');
-                case 'snapshot':
-                    return args.length === 4 && isSafeNodeId(args[2] ?? '');
-                case 'new':
-                    return args.length >= 3;
-                case 'msg':
-                    return args.length >= 4 && isSafeNodeId(args[2] ?? '');
-                case 'close':
-                    return args.length === 5 && args[2] === '--node' && isSafeNodeId(args[3] ?? '');
-                default:
-                    return false;
-            }
-        case 'view':
-            return args.length === 3 && args[1] === 'list';
-        default:
-            return false;
-    }
-}
-function parseRawHelperResult(stdout) {
-    try {
-        const parsed = JSON.parse(stdout);
-        if (!isPlainObject(parsed))
-            return null;
-        if (typeof parsed.ok !== 'boolean')
-            return null;
-        if (parsed.ok === true) {
-            if (typeof parsed.stdout !== 'string')
-                return null;
-            return { ok: true, stdout: parsed.stdout };
-        }
-        if (typeof parsed.status !== 'number' || typeof parsed.error !== 'string')
-            return null;
-        return { ok: false, status: parsed.status, error: parsed.error };
-    }
-    catch {
-        return null;
-    }
-}
-async function handleAllowedExec(req, tenantId, runtime, deps) {
-    const raw = await (deps.guestSource ?? runGuestSource)(tenantId, req, {
-        now: deps.now,
-        wakeTimeoutMs: runtime.proxy.wakeTimeoutMs,
-        bridgeTimeoutMs: runtime.proxy.wakeTimeoutMs,
-    });
-    return raw;
-}
-async function handleCanvasArtifactRead(req, tenantId, runtime, deps) {
-    const env = guestEnv(runtime.m0);
-    const canvasHome = env.CRTR_HOME;
-    const piAgentDir = env.PI_CODING_AGENT_DIR;
-    if (!isValidBrowserCanvasArtifactPath(canvasHome, piAgentDir, req.path)) {
-        return { status: 403, body: null };
-    }
-    const helperRequest = {
-        kind: 'exec',
-        bin: 'node',
-        args: ['--input-type=module', '-e', PUBLIC_SOURCE_FILE_READ_SCRIPT],
-        stdin: JSON.stringify({ canvasHome, piAgentDir, path: req.path }),
-    };
-    try {
-        const raw = await (deps.guestSource ?? runGuestSource)(tenantId, helperRequest, {
-            now: deps.now,
-            wakeTimeoutMs: runtime.proxy.wakeTimeoutMs,
-            bridgeTimeoutMs: runtime.proxy.wakeTimeoutMs,
-        });
-        const successful = requireSuccessfulExec(raw, 'read canvas artifact');
-        const parsed = parseRawHelperResult(successful.stdout);
-        if (parsed === null) {
-            throw general('canvas artifact read helper returned invalid data');
-        }
-        if (!parsed.ok) {
-            return { status: parsed.status ?? 403, body: null };
-        }
-        return { status: 200, body: { ok: true, stdout: parsed.stdout ?? '', stderr: '', exitCode: 0 } };
-    }
-    catch (error) {
-        const message = error instanceof Error ? error.message : String(error);
-        throw general(redactWakeProxyMessage(message));
-    }
-}
-function authResultFromRequest(req, runtime) {
-    try {
-        const state = currentState(runtime);
-        const auth = resolveOwnerWriteAuth(req, runtime.proxy, state);
-        if (auth === null)
-            return null;
-        return { tenantId: auth.tenantId };
-    }
-    catch (error) {
-        throw error instanceof Error ? error : new Error(String(error));
-    }
-}
-export async function handlePublicSourceRequest(req, res, runtime, deps = {}) {
-    if (requestPathname(req) !== SOURCE_PATH)
-        return false;
-    if (req.method !== 'POST') {
-        respondText(res, 405, 'method not allowed');
-        return true;
-    }
-    let auth;
-    try {
-        auth = authResultFromRequest(req, runtime);
-    }
-    catch {
-        respondText(res, 403, 'forbidden');
-        return true;
-    }
-    if (auth === null) {
-        respondText(res, 401, 'owner token required');
-        return true;
-    }
-    let body;
-    try {
-        body = await readJsonBody(req, BODY_LIMIT_BYTES);
-    }
-    catch (error) {
-        respondText(res, 400, error instanceof Error ? error.message : String(error));
-        return true;
-    }
-    if (!isPlainObject(body)) {
-        respondText(res, 400, 'source request must be a JSON object');
-        return true;
-    }
-    if (body.kind === 'http') {
-        respondText(res, 403, 'forbidden');
-        return true;
-    }
-    if (body.kind === 'exec') {
-        const request = parseExecRequest(body);
-        if (request === null || !isAllowedCrtrExec(request)) {
-            respondText(res, 403, 'forbidden');
-            return true;
-        }
-        try {
-            const raw = await handleAllowedExec(request, auth.tenantId, runtime, deps);
-            respondJson(res, 200, raw);
-        }
-        catch (error) {
-            respondJson(res, 502, { ok: false, stdout: '', stderr: redactWakeProxyMessage(error instanceof Error ? error.message : String(error)) });
-        }
-        return true;
-    }
-    if (body.kind === 'file') {
-        const request = parseFileRequest(body);
-        if (request === null) {
-            respondText(res, 403, 'forbidden');
-            return true;
-        }
-        try {
-            const result = await handleCanvasArtifactRead(request, auth.tenantId, runtime, deps);
-            if (result.body === null) {
-                respondText(res, result.status, 'forbidden');
-                return true;
-            }
-            respondJson(res, result.status, result.body);
-        }
-        catch (error) {
-            respondJson(res, 502, { ok: false, stdout: '', stderr: redactWakeProxyMessage(error instanceof Error ? error.message : String(error)) });
-        }
-        return true;
-    }
-    respondText(res, 403, 'forbidden');
-    return true;
-}

package/dist/hearth/wake-proxy/redact.d.ts

@@ -1 +0,0 @@
-export declare function redactWakeProxyMessage(message: string): string;

package/dist/hearth/wake-proxy/redact.js

@@ -1,17 +0,0 @@
-import { ownerAuthRedactedMessage } from './auth.js';
-const REDIRECT_URL_RE = /https?:\/\/localhost:53692\/callback[^\s"'`<>)]*/gi;
-const BEARER_RE = /\bBearer\s+[A-Za-z0-9._~+\/-]+=?=?/gi;
-const CODE_PARAM_RE = /([?&](?:code|state|code_verifier)=)[^&#\s]+/gi;
-const JSON_TOKEN_RE = /("(?:access_token|refresh_token|access|refresh|code|state|code_verifier)"\s*:\s*")[^"]+(")/gi;
-const ASSIGN_TOKEN_RE = /\b(?:access_token|refresh_token|access|refresh|code|state|code_verifier)\s*[:=]\s*[^\s,&}]+/gi;
-const AUTH_JSON_RE = /\bauth\.json\b/gi;
-export function redactWakeProxyMessage(message) {
-    return ownerAuthRedactedMessage(message)
-        .replace(REDIRECT_URL_RE, '[redacted redirect url]')
-        .replace(BEARER_RE, 'Bearer [redacted]')
-        .replace(CODE_PARAM_RE, '$1[redacted]')
-        .replace(JSON_TOKEN_RE, '$1[redacted]$2')
-        .replace(ASSIGN_TOKEN_RE, (value) => value.replace(/[:=]\s*[^\s,&}]+$/, ': [redacted]'))
-        .replace(AUTH_JSON_RE, '[redacted auth.json]')
-        .replace(/\bsha256:[0-9a-f]{64}\b/gi, 'sha256:[redacted]');
-}

package/dist/hearth/wake-proxy/server.d.ts

@@ -1,11 +0,0 @@
-import { type IncomingMessage, type Server as HttpServer, type ServerResponse } from 'node:http';
-import { type ModelAuthRouteDeps } from './model-auth.js';
-import { type PublicSourceGateDeps } from './public-source-gate.js';
-import { type HearthStatusDeps } from './hearth-status.js';
-import type { HearthWakeProxyRuntime } from './types.js';
-export declare function routeRequest(req: IncomingMessage, res: ServerResponse, runtime: HearthWakeProxyRuntime, deps?: {
-    modelAuth?: ModelAuthRouteDeps;
-    sourceGate?: PublicSourceGateDeps;
-    status?: HearthStatusDeps;
-}): Promise<void>;
-export declare function createWakeProxyServer(runtime: HearthWakeProxyRuntime): HttpServer;

package/dist/hearth/wake-proxy/server.js

@@ -1,142 +0,0 @@
-import { createServer } from 'node:http';
-import { general } from '../../core/errors.js';
-import { ensureProxyState, loadProxyState, readTenantHome } from './state.js';
-import { resolveOwnerAuth, setOwnerCookie } from './auth.js';
-import { handleModelAuthRequest } from './model-auth.js';
-import { handlePublicSourceRequest } from './public-source-gate.js';
-import { loadHearthStatus } from './hearth-status.js';
-import { proxyHttpRequest, proxyUpgrade } from './proxy.js';
-function currentState(runtime) {
-    return loadProxyState(runtime.proxy.statePath) ?? ensureProxyState(runtime.proxy);
-}
-function requestUrl(req) {
-    return new URL(req.url ?? '/', 'http://127.0.0.1');
-}
-function sendJson(res, statusCode, value) {
-    const body = `${JSON.stringify(value, null, 2)}\n`;
-    res.writeHead(statusCode, {
-        'content-type': 'application/json; charset=utf-8',
-        'content-length': Buffer.byteLength(body),
-    });
-    res.end(body);
-}
-function sendText(res, statusCode, body) {
-    res.writeHead(statusCode, {
-        'content-type': 'text/plain; charset=utf-8',
-        'content-length': Buffer.byteLength(body),
-    });
-    res.end(body);
-}
-function redirectChat(res, nodeId) {
-    res.writeHead(302, {
-        location: `/views/chat?target=${encodeURIComponent(nodeId)}`,
-        'cache-control': 'no-store',
-        'referrer-policy': 'no-referrer',
-    });
-    res.end();
-}
-function renderOwnerPrompt() {
-    return `<!doctype html><meta charset="utf-8"><title>Hearth</title><form method="GET"><label>Owner token <input name="token" type="password" autofocus></label> <button type="submit">Open chat</button></form>`;
-}
-function respondRoot(req, res, runtime) {
-    let auth;
-    try {
-        const state = currentState(runtime);
-        auth = resolveOwnerAuth(req, runtime.proxy, state);
-    }
-    catch {
-        res.writeHead(403, {
-            'content-type': 'text/plain; charset=utf-8',
-            'cache-control': 'no-store',
-            'referrer-policy': 'no-referrer',
-        });
-        res.end('forbidden\n');
-        return;
-    }
-    if (auth !== null) {
-        const home = readTenantHome(runtime.proxy, auth.tenantId);
-        if (home === null || typeof home.nodeId !== 'string' || home.nodeId.trim() === '') {
-            throw general('wake proxy home is missing nodeId — run the existing M0 provision/bootstrap flow', { tenantId: auth.tenantId });
-        }
-        if (auth.source !== 'cookie') {
-            setOwnerCookie(res, auth.token, runtime.proxy);
-        }
-        redirectChat(res, home.nodeId);
-        return;
-    }
-    res.writeHead(401, {
-        'content-type': 'text/html; charset=utf-8',
-        'cache-control': 'no-store',
-        'referrer-policy': 'no-referrer',
-    });
-    res.end(renderOwnerPrompt());
-}
-async function respondStatus(req, res, runtime, deps = {}) {
-    const state = currentState(runtime);
-    let auth;
-    try {
-        auth = resolveOwnerAuth(req, runtime.proxy, state);
-    }
-    catch {
-        sendText(res, 403, 'forbidden\n');
-        return;
-    }
-    if (auth === null) {
-        sendText(res, 401, 'owner token required\n');
-        return;
-    }
-    const statusData = await loadHearthStatus(auth.tenantId, runtime, deps);
-    sendJson(res, 200, statusData);
-}
-function respondHealthz(res) {
-    sendText(res, 200, 'ok\n');
-}
-export async function routeRequest(req, res, runtime, deps = {}) {
-    const url = requestUrl(req);
-    if (req.method === 'GET' && url.pathname === '/__hearth/healthz') {
-        respondHealthz(res);
-        return;
-    }
-    if (req.method === 'GET' && url.pathname === '/__hearth/status') {
-        await respondStatus(req, res, runtime, deps.status);
-        return;
-    }
-    if (req.method === 'GET' && url.pathname === '/') {
-        respondRoot(req, res, runtime);
-        return;
-    }
-    if (url.pathname.startsWith('/__hearth/model-auth/anthropic/')) {
-        await handleModelAuthRequest(req, res, runtime, deps.modelAuth);
-        return;
-    }
-    if (url.pathname === '/__crtr/source') {
-        await handlePublicSourceRequest(req, res, runtime, deps.sourceGate);
-        return;
-    }
-    await proxyHttpRequest(req, res, runtime);
-}
-export function createWakeProxyServer(runtime) {
-    const server = createServer((req, res) => {
-        void routeRequest(req, res, runtime).catch((error) => {
-            const message = error instanceof Error ? error.message : String(error);
-            if (!res.headersSent) {
-                sendText(res, 500, `${message}\n`);
-            }
-            else {
-                res.destroy();
-            }
-        });
-    });
-    server.on('connect', (_req, socket) => {
-        socket.end('HTTP/1.1 405 Method Not Allowed\r\nConnection: close\r\n\r\n');
-    });
-    server.on('upgrade', (req, socket, head) => {
-        try {
-            proxyUpgrade(req, socket, head, runtime);
-        }
-        catch {
-            socket.destroy();
-        }
-    });
-    return server;
-}

package/dist/hearth/wake-proxy/state.d.ts

@@ -1,18 +0,0 @@
-import type { HomeRecord, M0Config, TenantId } from '../../core/hearth/types.js';
-import type { ActivityHandle, ActivityKind, HearthProxyConfig, HearthProxyState, HearthProxyTenantState, TenantActivitySnapshot } from './types.js';
-export declare function loadProxyState(statePath: string): HearthProxyState | null;
-export declare function saveProxyState(statePath: string, state: HearthProxyState): HearthProxyState;
-export declare function ensureProxyState(config: HearthProxyConfig): HearthProxyState;
-export declare function getTenantState(state: HearthProxyState, tenantId: TenantId): HearthProxyTenantState | null;
-export declare function updateTenantState(config: HearthProxyConfig, tenantId: TenantId, mutate: (tenant: HearthProxyTenantState) => HearthProxyTenantState | void): HearthProxyTenantState;
-export declare function touchTenantActivity(config: HearthProxyConfig, tenantId: TenantId): HearthProxyTenantState;
-export declare function touchTenantWake(config: HearthProxyConfig, tenantId: TenantId): HearthProxyTenantState;
-export declare function touchTenantPause(config: HearthProxyConfig, tenantId: TenantId): HearthProxyTenantState;
-export declare function withTenantLock<T>(tenantId: TenantId, fn: () => Promise<T> | T): Promise<T>;
-export declare function beginActivity(config: HearthProxyConfig, tenantId: TenantId, kind: ActivityKind): ActivityHandle;
-export declare function endActivity(handle: ActivityHandle): TenantActivitySnapshot;
-export declare function getTenantActivitySnapshot(tenantId: TenantId): TenantActivitySnapshot;
-export declare function setTenantIdleTimer(tenantId: TenantId, deadlineAt: string, timer: NodeJS.Timeout): void;
-export declare function clearTenantIdleTimer(tenantId: TenantId): void;
-export declare function readTenantHome(config: HearthProxyConfig, tenantId: TenantId): HomeRecord | null;
-export declare function ensureSeededM0Registry(config: HearthProxyConfig, m0Config: M0Config): HomeRecord;