@hyperdrive.bot/fleet-server 0.3.99

package/dist/server/server/push/vapid-keys.js

@@ -0,0 +1,52 @@
+import { chmodSync, existsSync, mkdirSync, readFileSync, renameSync, writeFileSync } from "node:fs";
+import { dirname } from "node:path";
+import webpush from "web-push";
+const DEFAULT_SUBJECT = "mailto:paseo@local";
+export function loadOrGenerateVapidKeys(filePath, logger) {
+    const persisted = readPersistedKeys(filePath);
+    if (persisted) {
+        return {
+            publicKey: persisted.publicKey,
+            privateKey: persisted.privateKey,
+            subject: persisted.subject ?? DEFAULT_SUBJECT,
+        };
+    }
+    const generated = webpush.generateVAPIDKeys();
+    const keys = {
+        publicKey: generated.publicKey,
+        privateKey: generated.privateKey,
+        subject: DEFAULT_SUBJECT,
+    };
+    writeKeys(filePath, keys);
+    logger?.info({ filePath }, "Generated new VAPID key pair");
+    return keys;
+}
+function readPersistedKeys(filePath) {
+    if (!existsSync(filePath))
+        return null;
+    try {
+        const raw = readFileSync(filePath, "utf-8");
+        const parsed = JSON.parse(raw);
+        if (typeof parsed.publicKey !== "string" || parsed.publicKey.length === 0)
+            return null;
+        if (typeof parsed.privateKey !== "string" || parsed.privateKey.length === 0)
+            return null;
+        return {
+            publicKey: parsed.publicKey,
+            privateKey: parsed.privateKey,
+            subject: typeof parsed.subject === "string" ? parsed.subject : undefined,
+        };
+    }
+    catch {
+        return null;
+    }
+}
+function writeKeys(filePath, keys) {
+    mkdirSync(dirname(filePath), { recursive: true });
+    const tmpPath = `${filePath}.tmp`;
+    const payload = JSON.stringify({ ...keys }, null, 2) + "\n";
+    writeFileSync(tmpPath, payload, { mode: 0o600 });
+    renameSync(tmpPath, filePath);
+    chmodSync(filePath, 0o600);
+}
+//# sourceMappingURL=vapid-keys.js.map

package/dist/server/server/push/web-worker.d.ts

@@ -0,0 +1,44 @@
+import type pino from "pino";
+import type { PushTriggerEmitter } from "./triggers.js";
+import type { PushSubscriptionStore, WebPushSubscriptionJSON } from "./subscriptions.js";
+import type { VapidKeys } from "./vapid-keys.js";
+/**
+ * Story PASEO-CHAT-ACTIONS-V1-story-1.004 — Web Push delivery worker.
+ *
+ * Subscribes to the pushTrigger emitter (Story 1.1) and fans out to every
+ * registered Web Push subscription (Story 1.2). VAPID-signed via the keys
+ * from vapid-keys.ts. Honors PASEO_PUSH_ENABLED=false as the kill switch
+ * (mirrors expo-worker). Never crashes on dispatch failure.
+ */
+export interface WebSubscriptionStore {
+    list(): {
+        type: string;
+    }[];
+    removeWebSubscription(endpoint: string): void;
+}
+export interface WebWorkerEnv {
+    PASEO_PUSH_ENABLED?: string;
+}
+export interface WebPushClient {
+    sendNotification(subscription: WebPushSubscriptionJSON, payload: string, options: {
+        vapidDetails: {
+            subject: string;
+            publicKey: string;
+            privateKey: string;
+        };
+    }): Promise<unknown>;
+}
+export interface StartWebPushWorkerOptions {
+    pushTrigger: PushTriggerEmitter;
+    subscriptionStore: PushSubscriptionStore;
+    vapidKeys: VapidKeys;
+    logger: pino.Logger;
+    env?: WebWorkerEnv;
+    /** Override for tests. Production uses the `web-push` library default. */
+    client?: WebPushClient;
+}
+export interface WebPushWorker {
+    stop(): void;
+}
+export declare function startWebPushWorker(options: StartWebPushWorkerOptions): WebPushWorker;
+//# sourceMappingURL=web-worker.d.ts.map

package/dist/server/server/push/web-worker.js

@@ -0,0 +1,99 @@
+import webpush, { WebPushError } from "web-push";
+const TITLE_BY_KIND = {
+    completed: "Agent finished",
+    permission_needed: "Agent needs permission",
+    input_required: "Agent waiting for input",
+};
+export function startWebPushWorker(options) {
+    const { pushTrigger, subscriptionStore, vapidKeys, logger } = options;
+    const env = options.env ?? process.env;
+    const workerLogger = logger.child({ component: "web-push-worker" });
+    if (env.PASEO_PUSH_ENABLED === "false") {
+        workerLogger.info("web push worker disabled by PASEO_PUSH_ENABLED=false");
+        return { stop() { } };
+    }
+    const client = options.client ?? {
+        sendNotification: (sub, payload, opts) => webpush.sendNotification(sub, payload, opts),
+    };
+    workerLogger.info("web push worker started");
+    const unsubscribe = pushTrigger.on((payload) => {
+        void dispatch(payload).catch((err) => {
+            workerLogger.error({ err, sessionId: payload.sessionId, kind: payload.kind }, "web push dispatch failed");
+        });
+    });
+    async function dispatch(payload) {
+        const subs = subscriptionStore.list().filter((s) => s.type === "web");
+        if (subs.length === 0)
+            return;
+        const messageJson = JSON.stringify({
+            title: TITLE_BY_KIND[payload.kind],
+            body: payload.agentTitle,
+            data: {
+                deepLink: payload.deepLink,
+                webPath: payload.webPath,
+                serverId: payload.serverId,
+                kind: payload.kind,
+                agentId: payload.agentId,
+                sessionId: payload.sessionId,
+            },
+        });
+        await Promise.all(subs.map((sub) => sendOne(sub.subscription, messageJson, payload)));
+    }
+    async function sendOne(subscription, messageJson, payload) {
+        try {
+            await client.sendNotification(subscription, messageJson, {
+                vapidDetails: {
+                    subject: vapidKeys.subject,
+                    publicKey: vapidKeys.publicKey,
+                    privateKey: vapidKeys.privateKey,
+                },
+            });
+            workerLogger.debug({
+                vendor: vendorFromEndpoint(subscription.endpoint),
+                sessionId: payload.sessionId,
+                kind: payload.kind,
+            }, "[web-push] dispatched");
+        }
+        catch (error) {
+            handleSendError(error, subscription.endpoint, payload);
+        }
+    }
+    function handleSendError(error, endpoint, payload) {
+        const vendor = vendorFromEndpoint(endpoint);
+        const status = error instanceof WebPushError ? error.statusCode : undefined;
+        if (status === 404 || status === 410) {
+            subscriptionStore.removeWebSubscription(endpoint);
+            workerLogger.warn({ vendor, status, sessionId: payload.sessionId, kind: payload.kind }, "[web-push] subscription gone — removed from store");
+            return;
+        }
+        workerLogger.error({
+            err: error,
+            vendor,
+            status,
+            sessionId: payload.sessionId,
+            kind: payload.kind,
+        }, "[web-push] dispatch error");
+    }
+    return {
+        stop() {
+            unsubscribe();
+            workerLogger.info("web push worker stopped");
+        },
+    };
+}
+function vendorFromEndpoint(endpoint) {
+    try {
+        const host = new URL(endpoint).host;
+        if (host.includes("fcm.googleapis.com"))
+            return "chrome";
+        if (host.includes("web.push.apple.com"))
+            return "safari";
+        if (host.includes("mozilla.com"))
+            return "firefox";
+        return host;
+    }
+    catch {
+        return "unknown";
+    }
+}
+//# sourceMappingURL=web-worker.js.map

package/dist/server/server/reference-enricher.d.ts

@@ -0,0 +1,41 @@
+import { type SessionReference } from "@hyperdrive.bot/fleet-protocol/session-references";
+import type { ReferenceEnrichment } from "@hyperdrive.bot/fleet-protocol/messages";
+export interface ReferenceEnricherEnv {
+    /** GitLab PAT with `read_api`. Only ever sent to a host in PASEO_GITLAB_HOSTS. */
+    PASEO_GITLAB_TOKEN?: string;
+    GITLAB_TOKEN?: string;
+    /** Comma-separated GitLab hosts this token may be sent to. Default: gitlab.com. */
+    PASEO_GITLAB_HOSTS?: string;
+    /** Comma-separated Jira sites the Jira credentials may be sent to. No default. */
+    PASEO_JIRA_HOSTS?: string;
+    /** GitHub token with `repo` read. */
+    PASEO_GITHUB_TOKEN?: string;
+    GITHUB_TOKEN?: string;
+    /** Jira: an account email plus an API token, Basic-auth'd together. */
+    PASEO_JIRA_EMAIL?: string;
+    PASEO_JIRA_TOKEN?: string;
+    /**
+     * argv prefix for reading a WhatsApp thread. Unset means WhatsApp cards
+     * render from the classifier alone and say so. See whatsapp-bridge.ts.
+     */
+    PASEO_WHATSAPP_READ_CMD?: string;
+}
+export interface ReferenceEnricherDeps {
+    env: ReferenceEnricherEnv;
+    fetch: typeof globalThis.fetch;
+    now: () => Date;
+    /**
+     * WhatsApp is a subprocess, not a fetch, so it needs its own seam. Injected
+     * in tests; undefined means the real spawn. See whatsapp-bridge.ts.
+     */
+    runWhatsAppCommand?: (command: string, args: string[]) => Promise<string | null>;
+}
+/** Enrich one already-classified reference. Never throws. */
+export declare function enrichReference(reference: SessionReference, deps: ReferenceEnricherDeps): Promise<ReferenceEnrichment>;
+/**
+ * Enrich a batch of URLs. Unparseable strings are dropped rather than returned
+ * as broken cards, and the rest run concurrently -- a slow Jira must not hold
+ * up the pipeline card the user is actually watching.
+ */
+export declare function enrichReferences(urls: readonly string[], deps: ReferenceEnricherDeps): Promise<ReferenceEnrichment[]>;
+//# sourceMappingURL=reference-enricher.d.ts.map

package/dist/server/server/reference-enricher.js

@@ -0,0 +1,392 @@
+import { classifySessionReference, isEnrichableReference, } from "@hyperdrive.bot/fleet-protocol/session-references";
+import { readWhatsAppThread } from "./whatsapp-bridge.js";
+/**
+ * Reference enrichment -- turning "here is a GitLab pipeline URL" into "that
+ * pipeline is running, 12 of 14 jobs done".
+ *
+ * This lives on the daemon rather than in the app for one reason: it needs
+ * provider credentials. The app sends URLs and gets back status; a GitLab or
+ * Jira token never leaves this process. See docs/session-context-rail.md.
+ *
+ * Every fetcher is allowed to fail. A missing token, a private project, a host
+ * that is not reachable from this machine -- all of those are normal, and the
+ * result is an enrichment carrying `unavailableReason` so the card says what it
+ * could not see instead of spinning forever.
+ */
+/**
+ * Hosts a credential may be sent to, and the reason this exists.
+ *
+ * The URLs enriched here come from a session's digest, and the context hook
+ * writes that digest by scraping URLs out of tool output. Tool output is
+ * untrusted: a page an agent fetched, a file it read, a command's stdout. So a
+ * URL shaped like `https://attacker.example/a/b/-/pipelines/1` classifies as a
+ * perfectly good GitLab pipeline, and an enricher that trusts the host would
+ * put a `PRIVATE-TOKEN` header carrying a real GitLab PAT on a request to the
+ * attacker's server.
+ *
+ * The allowlist is therefore not hardening, it is the difference between this
+ * feature and a credential exfiltration primitive. A host that is not on it is
+ * never contacted with a credential at all.
+ *
+ * GitHub needs no equivalent: its API host is the constant `api.github.com`,
+ * and the URL only ever contributes an owner/repo path.
+ */
+const DEFAULT_GITLAB_HOSTS = ["gitlab.com"];
+function allowedHosts(raw, fallback) {
+    const configured = (raw ?? "")
+        .split(",")
+        .map((host) => host.trim().toLowerCase())
+        .filter((host) => host.length > 0);
+    return configured.length > 0 ? configured : [...fallback];
+}
+function isHostAllowed(host, allowed) {
+    return allowed.includes(host.toLowerCase());
+}
+/** Nothing here is worth blocking a rail render on. */
+const FETCH_TIMEOUT_MS = 6000;
+function neutral(reference, unavailableReason) {
+    return {
+        url: reference.url,
+        kind: reference.kind,
+        status: null,
+        state: "neutral",
+        title: null,
+        detail: null,
+        progress: null,
+        updatedAt: null,
+        unavailableReason,
+        live: false,
+    };
+}
+async function fetchJson(deps, url, headers) {
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), FETCH_TIMEOUT_MS);
+    try {
+        const response = await deps.fetch(url, {
+            headers: { Accept: "application/json", ...headers },
+            signal: controller.signal,
+        });
+        if (!response.ok) {
+            return null;
+        }
+        return (await response.json());
+    }
+    catch {
+        return null;
+    }
+    finally {
+        clearTimeout(timer);
+    }
+}
+function readString(source, ...path) {
+    let cursor = source;
+    for (const key of path) {
+        if (typeof cursor !== "object" || cursor === null) {
+            return null;
+        }
+        cursor = cursor[key];
+    }
+    return typeof cursor === "string" && cursor.length > 0 ? cursor : null;
+}
+/**
+ * GitLab pipeline states, mapped to the five buckets the UI colors on. The app
+ * never parses the raw status, so a state GitLab adds tomorrow degrades to
+ * `neutral` instead of rendering as a lie.
+ */
+function gitlabPipelineState(status) {
+    switch (status) {
+        case "running":
+        case "pending":
+        case "preparing":
+        case "waiting_for_resource":
+        case "scheduled":
+            return "running";
+        case "success":
+            return "success";
+        case "failed":
+            return "failed";
+        case "canceled":
+        case "canceling":
+        case "skipped":
+        case "manual":
+            return "blocked";
+        default:
+            return "neutral";
+    }
+}
+function gitlabToken(env) {
+    return env.PASEO_GITLAB_TOKEN ?? env.GITLAB_TOKEN ?? null;
+}
+/**
+ * Returns an enrichment explaining why this GitLab reference will not be
+ * contacted, or null when it is safe to send the token.
+ */
+function gitlabDenial(reference, deps) {
+    if (!gitlabToken(deps.env)) {
+        return neutral(reference, "No GitLab token on the daemon (set PASEO_GITLAB_TOKEN).");
+    }
+    const allowed = allowedHosts(deps.env.PASEO_GITLAB_HOSTS, DEFAULT_GITLAB_HOSTS);
+    if (!isHostAllowed(reference.host, allowed)) {
+        return neutral(reference, `${reference.host} is not in PASEO_GITLAB_HOSTS, so no token was sent to it.`);
+    }
+    return null;
+}
+function gitlabApiBase(reference) {
+    return `https://${reference.host}/api/v4/projects/${encodeURIComponent(reference.project ?? "")}`;
+}
+async function enrichGitLabPipeline(reference, deps) {
+    const denial = gitlabDenial(reference, deps);
+    if (denial) {
+        return denial;
+    }
+    const headers = { "PRIVATE-TOKEN": gitlabToken(deps.env) };
+    const pipeline = await fetchJson(deps, `${gitlabApiBase(reference)}/pipelines/${reference.id}`, headers);
+    if (!pipeline) {
+        return neutral(reference, "GitLab did not answer for this pipeline.");
+    }
+    const status = readString(pipeline, "status");
+    const state = gitlabPipelineState(status);
+    const jobs = await fetchJson(deps, `${gitlabApiBase(reference)}/pipelines/${reference.id}/jobs?per_page=100`, headers);
+    return {
+        url: reference.url,
+        kind: reference.kind,
+        status,
+        state,
+        title: `Pipeline ${reference.id}`,
+        detail: readString(pipeline, "ref"),
+        progress: summarizeJobs(jobs),
+        updatedAt: readString(pipeline, "updated_at"),
+        unavailableReason: null,
+        live: state === "running",
+    };
+}
+/**
+ * "12/14 jobs" beats a spinner, because it distinguishes a pipeline that is
+ * moving from one that is wedged behind a single-slot runner.
+ */
+function summarizeJobs(jobs) {
+    if (!Array.isArray(jobs) || jobs.length === 0) {
+        return null;
+    }
+    const finished = jobs.filter((job) => {
+        const status = readString(job, "status");
+        return status === "success" || status === "failed" || status === "canceled";
+    }).length;
+    return `${finished}/${jobs.length} jobs`;
+}
+function gitlabMergeRequestState(state, pipelineStatus) {
+    if (state === "merged") {
+        return "success";
+    }
+    if (state === "closed") {
+        return "blocked";
+    }
+    return gitlabPipelineState(pipelineStatus);
+}
+async function enrichGitLabMergeRequest(reference, deps) {
+    const denial = gitlabDenial(reference, deps);
+    if (denial) {
+        return denial;
+    }
+    const mr = await fetchJson(deps, `${gitlabApiBase(reference)}/merge_requests/${reference.id}`, {
+        "PRIVATE-TOKEN": gitlabToken(deps.env),
+    });
+    if (!mr) {
+        return neutral(reference, "GitLab did not answer for this merge request.");
+    }
+    const state = readString(mr, "state");
+    const pipelineStatus = readString(mr, "head_pipeline", "status");
+    return {
+        url: reference.url,
+        kind: reference.kind,
+        status: state,
+        state: gitlabMergeRequestState(state, pipelineStatus),
+        title: readString(mr, "title"),
+        detail: readString(mr, "author", "name"),
+        progress: pipelineStatus ? `pipeline ${pipelineStatus}` : null,
+        updatedAt: readString(mr, "updated_at"),
+        unavailableReason: null,
+        live: state === "opened" && gitlabPipelineState(pipelineStatus) === "running",
+    };
+}
+/**
+ * A merged PR reads as success even though GitHub also calls it "closed"; a
+ * closed-unmerged one is blocked, not failed, because nothing broke.
+ */
+function githubPullRequestState(merged, state) {
+    if (merged) {
+        return "success";
+    }
+    return state === "closed" ? "blocked" : "running";
+}
+async function enrichGitHubPullRequest(reference, deps) {
+    const token = deps.env.PASEO_GITHUB_TOKEN ?? deps.env.GITHUB_TOKEN ?? null;
+    const pr = await fetchJson(deps, `https://api.github.com/repos/${reference.project}/pulls/${reference.id}`, token ? { Authorization: `Bearer ${token}` } : {});
+    if (!pr) {
+        return neutral(reference, token ? "GitHub did not answer for this pull request." : "No GitHub token on the daemon.");
+    }
+    const merged = readString(pr, "merged_at") !== null;
+    const state = readString(pr, "state");
+    return {
+        url: reference.url,
+        kind: reference.kind,
+        status: merged ? "merged" : state,
+        state: githubPullRequestState(merged, state),
+        title: readString(pr, "title"),
+        detail: readString(pr, "user", "login"),
+        progress: null,
+        updatedAt: readString(pr, "updated_at"),
+        unavailableReason: null,
+        live: !merged && state === "open",
+    };
+}
+/**
+ * Jira has no universal status vocabulary -- every project renames its columns
+ * -- so the bucket comes from the `statusCategory` key, which does not move.
+ */
+function jiraState(categoryKey) {
+    switch (categoryKey) {
+        case "done":
+            return "success";
+        case "indeterminate":
+            return "running";
+        case "new":
+            return "neutral";
+        default:
+            return "neutral";
+    }
+}
+async function enrichJiraIssue(reference, deps) {
+    const email = deps.env.PASEO_JIRA_EMAIL;
+    const token = deps.env.PASEO_JIRA_TOKEN;
+    if (!email || !token) {
+        return neutral(reference, "No Jira credentials on the daemon (PASEO_JIRA_EMAIL + _TOKEN).");
+    }
+    // No default allowlist for Jira. `*.atlassian.net` is NOT a safe wildcard:
+    // anyone can register a free site and get one, so a scraped URL could name a
+    // site the attacker controls.
+    if (!isHostAllowed(reference.host, allowedHosts(deps.env.PASEO_JIRA_HOSTS, []))) {
+        return neutral(reference, `${reference.host} is not in PASEO_JIRA_HOSTS, so no credentials were sent to it.`);
+    }
+    const basic = Buffer.from(`${email}:${token}`).toString("base64");
+    const issue = await fetchJson(deps, `https://${reference.host}/rest/api/3/issue/${reference.id}?fields=summary,status,assignee,updated`, { Authorization: `Basic ${basic}` });
+    if (!issue) {
+        return neutral(reference, "Jira did not answer for this issue.");
+    }
+    const categoryKey = readString(issue, "fields", "status", "statusCategory", "key");
+    const assignee = readString(issue, "fields", "assignee", "displayName");
+    return {
+        url: reference.url,
+        kind: reference.kind,
+        status: readString(issue, "fields", "status", "name"),
+        state: jiraState(categoryKey),
+        title: readString(issue, "fields", "summary"),
+        detail: assignee ? `Assigned to ${assignee}` : "Unassigned",
+        progress: null,
+        updatedAt: readString(issue, "fields", "updated"),
+        // A ticket is not a build. Nothing about it changes second to second, so it
+        // is never marked live -- polling it would be pure noise on the wire.
+        live: false,
+        unavailableReason: null,
+    };
+}
+/**
+ * How many messages the card holds. Well under
+ * `MAX_ENRICHMENT_PREVIEW_LINES` (20), because that zod cap REJECTS an
+ * over-long array rather than truncating it, which would drop every enrichment
+ * in the batch and not just this one.
+ */
+const WHATSAPP_PREVIEW_LIMIT = 8;
+const WHATSAPP_PREVIEW_LINE_MAX = 400;
+function previewLine(message) {
+    const who = message.fromMe ? "me" : message.sender;
+    const line = `${who}: ${message.text}`;
+    return line.length > WHATSAPP_PREVIEW_LINE_MAX
+        ? `${line.slice(0, WHATSAPP_PREVIEW_LINE_MAX - 1)}…`
+        : line;
+}
+/**
+ * A WhatsApp thread card.
+ *
+ * The privacy stance differs from every other kind here, deliberately. A
+ * pipeline status is fine on a screenshared rail; the last messages of a
+ * private conversation are not. So the visible part is metadata only (chat
+ * name, group or DM, how many messages, when it last moved) and the message
+ * text goes in `sensitivePreview`, which the app renders only behind the same
+ * tap-to-reveal a masked credential uses.
+ *
+ * Never `live`: polling someone's inbox every five seconds because a rail is
+ * open is surveillance, not a status widget. It refreshes on the idle cadence
+ * like a Jira card.
+ */
+async function enrichWhatsAppChat(reference, deps) {
+    const chatId = reference.id;
+    if (!chatId) {
+        return neutral(reference, "No chat id on this WhatsApp reference.");
+    }
+    if (!deps.env.PASEO_WHATSAPP_READ_CMD) {
+        return neutral(reference, "No WhatsApp bridge configured (set PASEO_WHATSAPP_READ_CMD).");
+    }
+    const thread = await readWhatsAppThread(chatId, WHATSAPP_PREVIEW_LIMIT, {
+        env: deps.env,
+        run: deps.runWhatsAppCommand,
+    });
+    if (!thread) {
+        return neutral(reference, "The WhatsApp bridge returned nothing for this chat.");
+    }
+    const count = thread.messages.length;
+    const latest = thread.messages[0] ?? null;
+    const isGroup = reference.project === "group";
+    return {
+        url: reference.url,
+        kind: reference.kind,
+        status: null,
+        state: "neutral",
+        title: thread.chatName ?? reference.label,
+        detail: count === 0
+            ? `${isGroup ? "Group" : "Chat"}, no recent messages`
+            : `${isGroup ? "Group" : "Chat"}, ${count} recent message${count === 1 ? "" : "s"}`,
+        progress: null,
+        updatedAt: latest?.timestamp ?? null,
+        unavailableReason: null,
+        live: false,
+        sensitivePreview: thread.messages.map(previewLine),
+    };
+}
+/** Enrich one already-classified reference. Never throws. */
+export async function enrichReference(reference, deps) {
+    if (!isEnrichableReference(reference)) {
+        return neutral(reference, null);
+    }
+    try {
+        switch (reference.kind) {
+            case "gitlab-pipeline":
+                return await enrichGitLabPipeline(reference, deps);
+            case "gitlab-merge-request":
+                return await enrichGitLabMergeRequest(reference, deps);
+            case "github-pull-request":
+                return await enrichGitHubPullRequest(reference, deps);
+            case "jira-issue":
+                return await enrichJiraIssue(reference, deps);
+            case "whatsapp-chat":
+                return await enrichWhatsAppChat(reference, deps);
+            default:
+                return neutral(reference, null);
+        }
+    }
+    catch {
+        return neutral(reference, "Enrichment failed.");
+    }
+}
+/**
+ * Enrich a batch of URLs. Unparseable strings are dropped rather than returned
+ * as broken cards, and the rest run concurrently -- a slow Jira must not hold
+ * up the pipeline card the user is actually watching.
+ */
+export async function enrichReferences(urls, deps) {
+    const references = urls
+        .map((url) => classifySessionReference(url))
+        .filter((reference) => reference !== null);
+    return Promise.all(references.map((reference) => enrichReference(reference, deps)));
+}
+//# sourceMappingURL=reference-enricher.js.map

package/dist/server/server/relay-transport.d.ts

@@ -0,0 +1,31 @@
+import type pino from "pino";
+import { type KeyPair } from "@hyperdrive.bot/fleet-relay/e2ee";
+import type { ExternalSocketMetadata } from "./websocket-server.js";
+interface RelayTransportOptions {
+    logger: pino.Logger;
+    attachSocket: (ws: RelaySocketLike, metadata?: ExternalSocketMetadata) => Promise<void>;
+    relayEndpoint: string;
+    relayUseTls: boolean;
+    serverId: string;
+    daemonKeyPair?: KeyPair;
+    createWebSocket?: RelayWebSocketFactory;
+}
+export interface RelayTransportController {
+    stop: () => Promise<void>;
+}
+interface RelaySocketLike {
+    readyState: number;
+    send: (data: string | Uint8Array | ArrayBuffer) => void;
+    close: (code?: number, reason?: string) => void;
+    on: (event: "message" | "close" | "error", listener: (...args: unknown[]) => void) => void;
+    once: (event: "close" | "error", listener: (...args: unknown[]) => void) => void;
+}
+interface RelayWebSocketLike extends RelaySocketLike {
+    terminate: () => void;
+    ping: () => void;
+    on: (event: "open" | "message" | "close" | "error" | "pong", listener: (...args: unknown[]) => void) => void;
+}
+type RelayWebSocketFactory = (url: string) => RelayWebSocketLike;
+export declare function startRelayTransport({ logger, attachSocket, relayEndpoint, relayUseTls, serverId, daemonKeyPair, createWebSocket, }: RelayTransportOptions): RelayTransportController;
+export {};
+//# sourceMappingURL=relay-transport.d.ts.map