@drisp/cli 0.5.23 → 0.5.26

package/dist/{chunk-BTY7MYYT.js → chunk-3U37HT4T.js}

@@ -475,13 +475,10 @@ function writeGatewayTrace(message) {
   process.stderr.write(line);
 }
 
-// src/gateway/transport/types.ts
-var TransportUnreachableError = class extends Error {
-  constructor(message) {
-    super(message);
-    this.name = "TransportUnreachableError";
-  }
-};
+// src/gateway/transport/uds.ts
+import fs4 from "fs";
+import net from "net";
+import path3 from "path";
 
 // src/gateway/transport/trace.ts
 function traceGatewayFrame(transport, peer, direction, frame) {
@@ -504,12 +501,55 @@ function redactFrame(value) {
   return out;
 }
 
-// src/gateway/transport/uds.ts
-import fs4 from "fs";
-import net from "net";
-import path3 from "path";
+// src/gateway/transport/framedConnection.ts
+function createFramedConnection(peer, channel) {
+  const frameHandlers = /* @__PURE__ */ new Set();
+  const closeHandlers = /* @__PURE__ */ new Set();
+  const errorHandlers = /* @__PURE__ */ new Set();
+  channel.onMessage((text) => {
+    let parsed;
+    try {
+      parsed = JSON.parse(text);
+    } catch {
+      channel.close();
+      return;
+    }
+    traceGatewayFrame(channel.traceTag, peer, "in", parsed);
+    for (const handler of frameHandlers) handler(parsed);
+  });
+  channel.onError((err) => {
+    for (const handler of errorHandlers) handler(err);
+  });
+  channel.onClose(() => {
+    for (const handler of closeHandlers) handler();
+  });
+  return {
+    kind: channel.kind,
+    peer,
+    send: (frame) => {
+      if (!channel.isOpen()) return;
+      traceGatewayFrame(channel.traceTag, peer, "out", frame);
+      channel.writeFrame(frame);
+    },
+    close: () => channel.close(),
+    onFrame: (cb) => {
+      frameHandlers.add(cb);
+      return () => frameHandlers.delete(cb);
+    },
+    onClose: (cb) => {
+      closeHandlers.add(cb);
+      return () => closeHandlers.delete(cb);
+    },
+    onError: (cb) => {
+      errorHandlers.add(cb);
+      return () => errorHandlers.delete(cb);
+    }
+  };
+}
 
 // src/gateway/transport/framing.ts
+import { Buffer as Buffer2 } from "buffer";
+import { StringDecoder } from "string_decoder";
 var DEFAULT_MAX_LINE_BYTES = 1024 * 1024;
 var LineReaderOverflowError = class extends Error {
   constructor(limit) {
@@ -519,14 +559,18 @@ var LineReaderOverflowError = class extends Error {
 };
 var LineReader = class {
   buffer = "";
+  // Streams UTF-8 across chunk boundaries: a multi-byte sequence split by a
+  // stream `data` event is buffered here until complete, never truncated to
+  // U+FFFD the way a per-chunk `Buffer.toString('utf-8')` would.
+  decoder = new StringDecoder("utf8");
   maxBytes;
   constructor(maxBytes = DEFAULT_MAX_LINE_BYTES) {
     this.maxBytes = maxBytes;
   }
   push(chunk) {
-    const incoming = typeof chunk === "string" ? chunk : chunk.toString("utf-8");
-    if (this.buffer.length + incoming.length > this.maxBytes) {
-      this.buffer = "";
+    const incoming = typeof chunk === "string" ? chunk : this.decoder.write(chunk);
+    if (Buffer2.byteLength(this.buffer) + Buffer2.byteLength(incoming) > this.maxBytes) {
+      this.reset();
       throw new LineReaderOverflowError(this.maxBytes);
     }
     this.buffer += incoming;
@@ -541,21 +585,29 @@ var LineReader = class {
     }
     return lines;
   }
-  flush() {
-    const remainder = this.buffer.trim();
+  reset() {
     this.buffer = "";
-    return remainder.length > 0 ? [remainder] : [];
+    this.decoder = new StringDecoder("utf8");
   }
 };
 function encodeLine(value) {
   return JSON.stringify(value) + "\n";
 }
 
+// src/gateway/transport/types.ts
+var TransportUnreachableError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "TransportUnreachableError";
+  }
+};
+
 // src/gateway/transport/uds.ts
 function createUdsServerTransport(opts) {
   return {
     kind: "uds",
-    listen: (onConnection) => listenUds(opts, onConnection)
+    listen: (onConnection) => listenUds(opts, onConnection),
+    describe: () => ({ kind: "uds", socketPath: opts.socketPath })
   };
 }
 function createUdsClientTransport(opts) {
@@ -663,64 +715,322 @@ async function unlinkIfStale(socketPath) {
   }
 }
 function createSocketConnection(socket, peer, logError) {
+  return createFramedConnection(peer, udsRawChannel(socket, logError));
+}
+function udsRawChannel(socket, logError) {
   const reader = new LineReader();
-  const frameHandlers = /* @__PURE__ */ new Set();
-  const closeHandlers = /* @__PURE__ */ new Set();
-  const errorHandlers = /* @__PURE__ */ new Set();
-  socket.on("data", (chunk) => {
-    let lines;
-    try {
-      lines = reader.push(chunk);
-    } catch (err) {
-      if (err instanceof LineReaderOverflowError) {
-        logError?.(`gateway: control connection overflow \u2014 closing`);
-        socket.destroy();
-        return;
-      }
-      throw err;
-    }
-    for (const line of lines) {
-      let parsed;
-      try {
-        parsed = JSON.parse(line);
-      } catch {
-        socket.destroy();
-        return;
-      }
-      traceGatewayFrame("uds", peer, "in", parsed);
-      for (const handler of frameHandlers) handler(parsed);
-    }
-  });
-  socket.on("error", (err) => {
-    for (const handler of errorHandlers) handler(err);
-  });
-  socket.on("close", () => {
-    for (const handler of closeHandlers) handler();
-  });
   return {
     kind: "uds",
-    peer,
-    send: (frame) => {
-      if (!socket.writable) return;
-      traceGatewayFrame("uds", peer, "out", frame);
-      socket.write(encodeLine(frame));
-    },
+    traceTag: "uds",
+    isOpen: () => socket.writable,
+    writeFrame: (frame) => socket.write(encodeLine(frame)),
     close: () => socket.destroy(),
-    onFrame: (cb) => {
-      frameHandlers.add(cb);
-      return () => frameHandlers.delete(cb);
+    onMessage: (cb) => {
+      socket.on("data", (chunk) => {
+        let lines;
+        try {
+          lines = reader.push(chunk);
+        } catch (err) {
+          if (err instanceof LineReaderOverflowError) {
+            logError?.(`gateway: control connection overflow \u2014 closing`);
+          } else {
+            const detail = err instanceof Error ? err.message : String(err);
+            logError?.(
+              `gateway: control connection error \u2014 closing: ${detail}`
+            );
+          }
+          socket.destroy();
+          return;
+        }
+        for (const line of lines) cb(line);
+      });
     },
     onClose: (cb) => {
-      closeHandlers.add(cb);
-      return () => closeHandlers.delete(cb);
+      socket.on("close", cb);
     },
     onError: (cb) => {
-      errorHandlers.add(cb);
-      return () => errorHandlers.delete(cb);
+      socket.on("error", cb);
     }
   };
 }
 
+// src/gateway/transport/ws.ts
+import { WebSocketServer, WebSocket } from "ws";
+import { createServer as createHttpsServer } from "https";
+import { readFileSync } from "fs";
+
+// src/gateway/transport/wsChannel.ts
+function createWsConnection(ws, peer, traceTag) {
+  return createFramedConnection(peer, wsRawChannel(ws, traceTag));
+}
+function wsRawChannel(ws, traceTag) {
+  return {
+    kind: "ws",
+    traceTag,
+    isOpen: () => ws.readyState === ws.OPEN,
+    writeFrame: (frame) => ws.send(JSON.stringify(frame)),
+    close: () => ws.close(),
+    onMessage: (cb) => {
+      ws.on("message", (data) => cb(data.toString()));
+    },
+    onClose: (cb) => {
+      ws.on("close", cb);
+    },
+    onError: (cb) => {
+      ws.on("error", cb);
+    }
+  };
+}
+
+// src/gateway/transport/ws.ts
+function createWsServerTransport(opts) {
+  if (!opts.allowNonLoopback && !isLoopbackHost(opts.host)) {
+    throw new Error(`gateway: refusing non-loopback bind without --insecure`);
+  }
+  let endpoint = null;
+  const scheme = opts.tls ? "wss" : "ws";
+  const rateLimit = createConnectRateLimiter(opts.rateLimitPerMin ?? 10);
+  const readEndpoint = () => {
+    if (!endpoint) {
+      throw new Error("gateway: WS transport has not started listening");
+    }
+    return endpoint;
+  };
+  return {
+    kind: "ws",
+    endpoint: readEndpoint,
+    describe: () => {
+      const ep = readEndpoint();
+      return {
+        kind: "ws",
+        host: ep.host,
+        port: ep.port,
+        url: ep.url,
+        tls: Boolean(opts.tls)
+      };
+    },
+    listen: (onConnection) => new Promise((resolve, reject) => {
+      const verifyClient = (info) => rateLimit.allow(info.req.socket.remoteAddress ?? "unknown");
+      const { wss, httpsServer } = createWss({
+        host: opts.host,
+        port: opts.port,
+        tls: opts.tls,
+        verifyClient
+      });
+      const onError = (err) => reject(err);
+      wss.once("error", onError);
+      if (httpsServer) httpsServer.once("error", onError);
+      const onListening = () => {
+        wss.off("error", onError);
+        if (httpsServer) httpsServer.off("error", onError);
+        const addr = httpsServer ? httpsServer.address() : wss.address();
+        if (typeof addr === "string" || addr === null) {
+          wss.close();
+          httpsServer?.close();
+          reject(
+            new Error("gateway: WS listener did not expose TCP address")
+          );
+          return;
+        }
+        endpoint = {
+          host: opts.host,
+          port: addr.port,
+          url: `${scheme}://${opts.host}:${addr.port}`
+        };
+        resolve({
+          close: () => new Promise((closeResolve) => {
+            for (const client2 of wss.clients) client2.terminate();
+            wss.close(() => {
+              if (httpsServer) httpsServer.close(() => closeResolve());
+              else closeResolve();
+            });
+          })
+        });
+      };
+      if (httpsServer) httpsServer.once("listening", onListening);
+      else wss.once("listening", onListening);
+      const pingIntervalMs = opts.pingIntervalMs ?? 15e3;
+      const pongTimeoutMs = opts.pongTimeoutMs ?? 3e4;
+      wss.on("connection", (ws) => {
+        attachHeartbeat(ws, pingIntervalMs, pongTimeoutMs);
+        onConnection(createWsConnection(ws, `${scheme}:${opts.host}`, "ws"));
+      });
+    })
+  };
+}
+function loadTlsOptions(tls) {
+  return {
+    cert: readFileSync(tls.certPath),
+    key: readFileSync(tls.keyPath)
+  };
+}
+function createWss(input) {
+  if (input.tls) {
+    const httpsServer = createHttpsServer(loadTlsOptions(input.tls));
+    httpsServer.listen({ host: input.host, port: input.port });
+    return {
+      wss: new WebSocketServer({
+        server: httpsServer,
+        verifyClient: input.verifyClient
+      }),
+      httpsServer
+    };
+  }
+  return {
+    wss: new WebSocketServer({
+      host: input.host,
+      port: input.port,
+      verifyClient: input.verifyClient
+    }),
+    httpsServer: null
+  };
+}
+function createConnectRateLimiter(maxPerMin) {
+  if (maxPerMin <= 0) return { allow: () => true };
+  const buckets = /* @__PURE__ */ new Map();
+  let pruneCountdown = 256;
+  const prune = (cutoff) => {
+    for (const [ip, arr] of buckets) {
+      const fresh = arr.filter((t) => t > cutoff);
+      if (fresh.length === 0) buckets.delete(ip);
+      else if (fresh.length !== arr.length) buckets.set(ip, fresh);
+    }
+  };
+  return {
+    allow(ip) {
+      const now = Date.now();
+      const cutoff = now - 6e4;
+      pruneCountdown -= 1;
+      if (pruneCountdown <= 0) {
+        prune(cutoff);
+        pruneCountdown = 256;
+      }
+      const recent = (buckets.get(ip) ?? []).filter((t) => t > cutoff);
+      if (recent.length >= maxPerMin) {
+        buckets.set(ip, recent);
+        return false;
+      }
+      recent.push(now);
+      buckets.set(ip, recent);
+      return true;
+    }
+  };
+}
+function attachHeartbeat(ws, pingIntervalMs, pongTimeoutMs) {
+  if (pingIntervalMs <= 0) return;
+  let pongTimer = null;
+  const clearPongTimer = () => {
+    if (pongTimer) {
+      clearTimeout(pongTimer);
+      pongTimer = null;
+    }
+  };
+  ws.on("pong", clearPongTimer);
+  const interval = setInterval(() => {
+    if (ws.readyState !== ws.OPEN) return;
+    try {
+      ws.ping();
+    } catch {
+      return;
+    }
+    if (!pongTimer) {
+      pongTimer = setTimeout(() => ws.terminate(), pongTimeoutMs);
+    }
+  }, pingIntervalMs);
+  const stop = () => {
+    clearInterval(interval);
+    clearPongTimer();
+  };
+  ws.on("close", stop);
+  ws.on("error", stop);
+}
+function createWsClientTransport(opts) {
+  return {
+    kind: "ws",
+    connect: () => connectWs(opts)
+  };
+}
+function wsClientOptionsForEndpoint(input) {
+  return {
+    url: input.url,
+    ...input.timeoutMs !== void 0 ? { timeoutMs: input.timeoutMs } : {},
+    ...input.tlsCaPath !== void 0 ? { tlsCaPath: input.tlsCaPath } : {}
+  };
+}
+async function connectWs(opts) {
+  const timeoutMs = opts.timeoutMs ?? 5e3;
+  const wsOpts = opts.tlsCaPath ? { ca: readFileSync(opts.tlsCaPath) } : {};
+  const ws = new WebSocket(opts.url, wsOpts);
+  await new Promise((resolve, reject) => {
+    const timer = setTimeout(() => {
+      ws.close();
+      reject(
+        new TransportUnreachableError(`connect timed out after ${timeoutMs}ms`)
+      );
+    }, timeoutMs);
+    ws.once("open", () => {
+      clearTimeout(timer);
+      resolve();
+    });
+    ws.once("error", (err) => {
+      clearTimeout(timer);
+      reject(
+        new TransportUnreachableError(
+          `gateway not reachable at ${opts.url}: ${err.message}`
+        )
+      );
+    });
+  });
+  return createWsConnection(ws, opts.url, "ws-client");
+}
+
+// src/infra/db/openVersionedDb.ts
+import fs5 from "fs";
+import path4 from "path";
+import Database from "better-sqlite3";
+function migrateVersionedSchema(db, schema) {
+  db.exec(
+    "CREATE TABLE IF NOT EXISTS schema_version (version INTEGER NOT NULL)"
+  );
+  const existing = db.prepare("SELECT version FROM schema_version").get();
+  if (existing && existing.version > schema.version) {
+    throw schema.onNewerVersion?.(existing.version, schema.version) ?? new Error(
+      `Database has newer schema version ${existing.version} (expected <= ${schema.version}).`
+    );
+  }
+  db.transaction(() => {
+    schema.migrate(db, existing?.version);
+    if (!existing) {
+      db.prepare("INSERT INTO schema_version (version) VALUES (?)").run(
+        schema.version
+      );
+    }
+  })();
+}
+function openVersionedDb(dbPath, options) {
+  if (options.ensureDir && dbPath !== ":memory:") {
+    fs5.mkdirSync(path4.dirname(dbPath), {
+      recursive: true,
+      ...options.dirMode !== void 0 ? { mode: options.dirMode } : {}
+    });
+  }
+  const db = new Database(dbPath);
+  db.exec("PRAGMA journal_mode = WAL");
+  if (options.foreignKeys) {
+    db.exec("PRAGMA foreign_keys = ON");
+  }
+  if (options.version === void 0) {
+    options.migrate(db, void 0);
+  } else {
+    migrateVersionedSchema(db, {
+      version: options.version,
+      migrate: options.migrate,
+      ...options.onNewerVersion ? { onNewerVersion: options.onNewerVersion } : {}
+    });
+  }
+  return db;
+}
+
 // src/shared/gateway-protocol/channelRequestId.ts
 import { randomInt } from "crypto";
 var ALPHABET = "abcdefghijkmnopqrstuvwxyz";
@@ -744,13 +1054,16 @@ export {
   readDashboardClientConfig,
   writeDashboardClientConfig,
   removeDashboardClientConfig,
+  openVersionedDb,
   TransportUnreachableError,
-  traceGatewayFrame,
   createUdsServerTransport,
   createUdsClientTransport,
   resolveGatewayPaths,
   resolveListenSpec,
   isLoopbackHost,
+  createWsServerTransport,
+  createWsClientTransport,
+  wsClientOptionsForEndpoint,
   CHANNEL_REQUEST_ID_REGEX,
   generateChannelRequestId,
   isValidChannelRequestId,
@@ -772,4 +1085,4 @@ export {
   trackSetupCompleted,
   refreshDashboardAccessToken
 };
-//# sourceMappingURL=chunk-BTY7MYYT.js.map
+//# sourceMappingURL=chunk-3U37HT4T.js.map

package/dist/{chunk-MRAM6EYI.js → chunk-4NX4WFPB.js}

@@ -1,6 +1,6 @@
 import {
   isLoopbackHost
-} from "./chunk-BTY7MYYT.js";
+} from "./chunk-3U37HT4T.js";
 
 // src/gateway/auth.ts
 import crypto from "crypto";
@@ -73,4 +73,4 @@ export {
   timingSafeTokenEqual,
   requireTokenForBind
 };
-//# sourceMappingURL=chunk-MRAM6EYI.js.map
+//# sourceMappingURL=chunk-4NX4WFPB.js.map