@linkshell/gateway 0.5.3 → 0.6.0

package/src/serve.ts

@@ -0,0 +1,130 @@
+import { mkdirSync } from "node:fs";
+import { createServer, type IncomingMessage, type ServerResponse } from "node:http";
+import { createRequire } from "node:module";
+import { dirname } from "node:path";
+import { RELAY_PATH } from "@linkshell/wire";
+import type { VerifyToken } from "./accounts.js";
+import { clientIp, isLoopback, RateLimiter, trustedProxySet } from "./rate-limit.js";
+import { Gateway, type GatewayOptions } from "./relay.js";
+
+export interface StartGatewayOptions {
+  port: number;
+  /** The interface to listen on; all of them when omitted. */
+  host?: string;
+  /** SQLite file holding pairings and peers' public keys. Losing it unpairs every phone. */
+  databasePath: string;
+  /** What `/healthz` reports; this package's version when omitted. */
+  version?: string;
+  log?: (message: string) => void;
+  /** Validates account tokens; without it, accounts are off and only pairing works. */
+  verifyToken?: VerifyToken;
+  admit?: GatewayOptions["admit"];
+  /** Addresses of the reverse proxies in front, whose X-Forwarded-For is believed. */
+  trustedProxies?: readonly string[];
+  /** Connections one address may open per window (default 20 a minute). */
+  wsConnectLimit?: { max: number; windowMs: number };
+}
+
+export interface RunningGateway {
+  port: number;
+  relay: Gateway;
+  close(): Promise<void>;
+}
+
+/**
+ * The gateway as it is deployed: one HTTP server with the relay on
+ * `RELAY_PATH` and a health check on `/healthz`. Nothing else is served.
+ */
+export async function startGateway(options: StartGatewayOptions): Promise<RunningGateway> {
+  mkdirSync(dirname(options.databasePath), { recursive: true });
+  const relay = new Gateway({
+    port: 0,
+    databasePath: options.databasePath,
+    verifyToken: options.verifyToken,
+    admit: options.admit,
+    log: options.log,
+  });
+  const version = options.version ?? packageVersion();
+  const trustedProxies = trustedProxySet(options.trustedProxies ?? []);
+  const limit = options.wsConnectLimit ?? { max: 20, windowMs: 60_000 };
+  const connectLimiter = new RateLimiter(limit.max, limit.windowMs);
+
+  const server = createServer((request, response) => {
+    if (request.method === "GET" && pathOf(request) === "/healthz") {
+      // memoryMb: what the process holds, to watch against the container's limit.
+      json(response, 200, { ok: true, version, relay: relay.connected, memoryMb: Math.round(process.memoryUsage.rss() / 1048576) });
+      return;
+    }
+    json(response, 404, { error: "not_found" });
+  });
+
+  server.on("upgrade", (request, socket, head) => {
+    if (pathOf(request) !== RELAY_PATH) {
+      socket.destroy();
+      return;
+    }
+    const ip = clientIp(request, trustedProxies);
+    if (!isLoopback(ip) && !connectLimiter.allow(ip)) {
+      socket.write("HTTP/1.1 429 Too Many Requests\r\n\r\n");
+      socket.destroy();
+      return;
+    }
+    relay.handleUpgrade(request, socket, head);
+  });
+
+  try {
+    await new Promise<void>((resolve, reject) => {
+      server.once("error", reject);
+      server.listen(options.port, options.host, () => {
+        server.off("error", reject);
+        resolve();
+      });
+    });
+  } catch (error) {
+    connectLimiter.destroy();
+    await relay.stop();
+    throw error;
+  }
+  relay.attach();
+
+  const address = server.address();
+  return {
+    port: typeof address === "object" && address ? address.port : options.port,
+    relay,
+    close: async () => {
+      connectLimiter.destroy();
+      // The relay drops its peers first: the server only finishes closing once their sockets are gone.
+      await relay.stop();
+      await new Promise<void>((resolve) => server.close(() => resolve()));
+    },
+  };
+}
+
+/** The request's path; undefined for a target that doesn't parse, which then matches nothing. */
+function pathOf(request: IncomingMessage): string | undefined {
+  try {
+    return new URL(request.url ?? "/", "http://gateway").pathname;
+  } catch {
+    return undefined;
+  }
+}
+
+function json(response: ServerResponse, status: number, body: unknown): void {
+  response.writeHead(status, { "content-type": "application/json" });
+  response.end(JSON.stringify(body));
+}
+
+/** This package's version, so `/healthz` says which build is deployed. */
+export function packageVersion(): string {
+  const require = createRequire(import.meta.url);
+  // package.json is one level up from src/ and three up from dist/gateway/src/.
+  for (const path of ["../package.json", "../../../package.json"]) {
+    try {
+      const manifest = require(path) as { name?: string; version?: string };
+      if (manifest.name === "@linkshell/gateway" && manifest.version) return manifest.version;
+    } catch {
+      // Not at this depth.
+    }
+  }
+  return "unknown";
+}

package/src/store.ts

@@ -0,0 +1,135 @@
+import { DatabaseSync } from "node:sqlite";
+import type { PeerRole } from "@linkshell/wire";
+
+// What the gateway remembers: peers' public keys and account, and which
+// devices are paired with which machines. No content, ever.
+
+export interface PeerRecord {
+  id: string;
+  role: PeerRole;
+  signKey: string;
+  boxKey: string;
+  name: string;
+  platform?: string;
+  userId?: string;
+  lastSeen: number;
+}
+
+export class GatewayStore {
+  private readonly db: DatabaseSync;
+
+  constructor(path: string) {
+    this.db = new DatabaseSync(path);
+    this.db.exec(`
+      PRAGMA journal_mode = WAL;
+      CREATE TABLE IF NOT EXISTS peers (
+        id TEXT PRIMARY KEY,
+        role TEXT NOT NULL,
+        sign_key TEXT NOT NULL,
+        box_key TEXT NOT NULL,
+        name TEXT NOT NULL,
+        platform TEXT,
+        user_id TEXT,
+        last_seen INTEGER NOT NULL
+      );
+      CREATE INDEX IF NOT EXISTS peers_by_user ON peers (user_id);
+      CREATE TABLE IF NOT EXISTS links (
+        machine_id TEXT NOT NULL,
+        device_id TEXT NOT NULL,
+        created_at INTEGER NOT NULL,
+        PRIMARY KEY (machine_id, device_id)
+      ) WITHOUT ROWID;
+      CREATE INDEX IF NOT EXISTS links_by_device ON links (device_id);
+    `);
+  }
+
+  close(): void {
+    this.db.close();
+  }
+
+  peer(id: string): PeerRecord | undefined {
+    const row = this.db.prepare("SELECT * FROM peers WHERE id = ?").get(id) as Record<string, unknown> | undefined;
+    return row ? toPeer(row) : undefined;
+  }
+
+  upsertPeer(peer: PeerRecord): void {
+    this.db
+      .prepare(
+        `INSERT INTO peers (id, role, sign_key, box_key, name, platform, user_id, last_seen)
+         VALUES (?, ?, ?, ?, ?, ?, ?, ?)
+         ON CONFLICT(id) DO UPDATE SET box_key = excluded.box_key, name = excluded.name,
+           platform = excluded.platform, user_id = excluded.user_id, last_seen = excluded.last_seen`,
+      )
+      .run(peer.id, peer.role, peer.signKey, peer.boxKey, peer.name, peer.platform ?? null, peer.userId ?? null, peer.lastSeen);
+  }
+
+  touch(id: string, at = Date.now()): void {
+    this.db.prepare("UPDATE peers SET last_seen = ? WHERE id = ?").run(at, id);
+  }
+
+  link(machineId: string, deviceId: string, at = Date.now()): void {
+    this.db.prepare("INSERT OR IGNORE INTO links (machine_id, device_id, created_at) VALUES (?, ?, ?)").run(machineId, deviceId, at);
+  }
+
+  unlink(machineId: string, deviceId: string): boolean {
+    return this.db.prepare("DELETE FROM links WHERE machine_id = ? AND device_id = ?").run(machineId, deviceId).changes > 0;
+  }
+
+  /**
+   * Takes a peer off its account: the account's other peers no longer reach it, or list it. Its
+   * keys and pairings stay, and signing in again puts it back.
+   */
+  disown(id: string): boolean {
+    return this.db.prepare("UPDATE peers SET user_id = NULL WHERE id = ? AND user_id IS NOT NULL").run(id).changes > 0;
+  }
+
+  linkedAt(machineId: string, deviceId: string): number | undefined {
+    const row = this.db.prepare("SELECT created_at FROM links WHERE machine_id = ? AND device_id = ?").get(machineId, deviceId) as
+      | { created_at: number }
+      | undefined;
+    return row?.created_at;
+  }
+
+  /** Peers of the other role that `id` may reach: linked, or owned by the same account. */
+  reachable(id: string): { peer: PeerRecord; via: "paired" | "account"; pairedAt?: number }[] {
+    const self = this.peer(id);
+    if (!self) return [];
+    const other = self.role === "machine" ? "device" : "machine";
+    const linked = (
+      self.role === "machine"
+        ? this.db.prepare("SELECT p.*, l.created_at AS paired_at FROM links l JOIN peers p ON p.id = l.device_id WHERE l.machine_id = ?").all(id)
+        : this.db.prepare("SELECT p.*, l.created_at AS paired_at FROM links l JOIN peers p ON p.id = l.machine_id WHERE l.device_id = ?").all(id)
+    ) as Record<string, unknown>[];
+    const out = new Map<string, { peer: PeerRecord; via: "paired" | "account"; pairedAt?: number }>();
+    for (const row of linked) out.set(String(row.id), { peer: toPeer(row), via: "paired", pairedAt: Number(row.paired_at) });
+    if (self.userId) {
+      const owned = this.db.prepare("SELECT * FROM peers WHERE user_id = ? AND role = ?").all(self.userId, other) as Record<string, unknown>[];
+      for (const row of owned) if (!out.has(String(row.id))) out.set(String(row.id), { peer: toPeer(row), via: "account" });
+    }
+    return [...out.values()];
+  }
+
+  /** How `from` may reach `to`, or undefined when it may not. */
+  route(from: string, to: string): "paired" | "account" | undefined {
+    const a = this.peer(from);
+    const b = this.peer(to);
+    if (!a || !b || a.role === b.role) return undefined;
+    const [machine, device] = a.role === "machine" ? [a, b] : [b, a];
+    if (this.linkedAt(machine.id, device.id) !== undefined) return "paired";
+    if (a.userId && a.userId === b.userId) return "account";
+    return undefined;
+  }
+}
+
+function toPeer(row: Record<string, unknown>): PeerRecord {
+  return {
+    id: String(row.id),
+    role: row.role as PeerRole,
+    signKey: String(row.sign_key),
+    boxKey: String(row.box_key),
+    name: String(row.name),
+    platform: row.platform ? String(row.platform) : undefined,
+    userId: row.user_id ? String(row.user_id) : undefined,
+    lastSeen: Number(row.last_seen),
+  };
+}

package/src/subscription.ts

@@ -0,0 +1,51 @@
+import type { GatewayOptions } from "./relay.js";
+
+// The official gateway is a subscription service. Whether an account is Pro is
+// read from iTool's `profiles` table, with the service-role key: the gateway
+// asks on its own behalf, not with the user's token.
+
+export interface SubscriptionCheck {
+  /** "unknown": the lookup itself failed, which says nothing about the account. */
+  status: "active" | "inactive" | "unknown";
+  reason?: string;
+}
+
+export type CheckSubscription = (userId: string) => Promise<SubscriptionCheck>;
+
+export function supabaseSubscriptions(supabase: { url: string; anonKey: string; serviceRoleKey: string }): CheckSubscription {
+  return async (userId) => {
+    if (!supabase.url || !supabase.anonKey) return { status: "unknown", reason: "missing_supabase_config" };
+    if (!supabase.serviceRoleKey) return { status: "unknown", reason: "missing_service_role_key" };
+    try {
+      const response = await fetch(`${supabase.url}/rest/v1/profiles?id=eq.${userId}&select=plan,plan_expires_at&limit=1`, {
+        headers: { Authorization: `Bearer ${supabase.serviceRoleKey}`, apikey: supabase.anonKey },
+        signal: AbortSignal.timeout(5_000),
+      });
+      if (!response.ok) return { status: "unknown", reason: `profile_lookup_http_${response.status}` };
+      const profiles = (await response.json()) as { plan: string; plan_expires_at: string | null }[];
+      const profile = profiles[0];
+      if (!profile) return { status: "unknown", reason: "profile_not_found" };
+      const active = profile.plan === "pro" && !!profile.plan_expires_at && new Date(profile.plan_expires_at) > new Date();
+      return { status: active ? "active" : "inactive" };
+    } catch {
+      return { status: "unknown", reason: "profile_lookup_failed" };
+    }
+  };
+}
+
+/**
+ * The official gateway's rule for who may connect: a computer needs an active
+ * Pro account. Devices only reach computers they're paired with or share an
+ * account with, so they need nothing more.
+ */
+export function requirePro(check: CheckSubscription, warn: (message: string) => void): NonNullable<GatewayOptions["admit"]> {
+  return async ({ role, userId }) => {
+    if (role !== "machine") return undefined;
+    if (!userId) return "官方网关需要登录 Pro 账号：在电脑上运行 linkshell login";
+    const subscription = await check(userId);
+    // A lookup failure isn't a lapsed subscription; don't lock people out over it.
+    if (subscription.status === "inactive") return "官方网关需要 Pro 订阅：https://itool.tech";
+    if (subscription.status === "unknown") warn(`subscription check unavailable (${subscription.reason}); admitting ${userId}`);
+    return undefined;
+  };
+}

package/dist/gateway/src/auth-middleware.d.ts

@@ -1,44 +0,0 @@
-import type { IncomingMessage, ServerResponse } from "node:http";
-declare const SUPABASE_URL: string;
-declare const SUPABASE_ANON_KEY: string;
-declare const SUPABASE_SERVICE_ROLE_KEY: string;
-declare const AUTH_REQUIRED: boolean;
-export { AUTH_REQUIRED, SUPABASE_URL, SUPABASE_ANON_KEY, SUPABASE_SERVICE_ROLE_KEY };
-export interface AuthResult {
-    authenticated: boolean;
-    userId?: string;
-    email?: string;
-    plan?: string;
-    subscribed?: boolean;
-}
-export interface SubscriptionCheckResult {
-    status: "active" | "inactive" | "unknown";
-    reason?: string;
-}
-export declare function canReadSessionDetail(input: {
-    authRequired: boolean;
-    authenticatedUserId?: string;
-    sessionUserId?: string;
-    tokenOwns: boolean;
-}): boolean;
-/**
- * Server-side subscription check using service role key (no user JWT needed).
- * Returns "unknown" for configuration or network failures so active sessions
- * are not disconnected because of a transient verification problem.
- */
-export declare function checkSubscriptionByUserId(userId: string): Promise<SubscriptionCheckResult>;
-export declare function extractAuthToken(req: IncomingMessage): string | null;
-/**
- * Validate token and return auth result (exported for /sessions/mine).
- */
-export declare function validateRequest(req: IncomingMessage): Promise<AuthResult | null>;
-/**
- * Auth middleware for premium gateway HTTP endpoints.
- * Rejects non-subscribers with a message pointing to itool.tech.
- */
-export declare function requireAuth(req: IncomingMessage, res: ServerResponse): Promise<AuthResult | null>;
-/**
- * Check auth for WebSocket upgrade requests.
- * Returns AuthResult or null if unauthorized.
- */
-export declare function checkWsAuth(req: IncomingMessage): Promise<AuthResult | null>;

package/dist/gateway/src/auth-middleware.js

@@ -1,204 +0,0 @@
-const SUPABASE_URL = process.env.SUPABASE_URL ?? "";
-const SUPABASE_ANON_KEY = process.env.SUPABASE_ANON_KEY ?? "";
-const SUPABASE_SERVICE_ROLE_KEY = process.env.SUPABASE_SERVICE_ROLE_KEY ?? "";
-const AUTH_REQUIRED = process.env.AUTH_REQUIRED === "true";
-export { AUTH_REQUIRED, SUPABASE_URL, SUPABASE_ANON_KEY, SUPABASE_SERVICE_ROLE_KEY };
-export function canReadSessionDetail(input) {
-    if (input.tokenOwns)
-        return true;
-    return Boolean(input.authRequired &&
-        input.authenticatedUserId &&
-        input.sessionUserId &&
-        input.authenticatedUserId === input.sessionUserId);
-}
-const tokenAuthCache = new Map();
-const TOKEN_CACHE_TTL = 45_000; // 45s
-function getCachedAuth(token) {
-    const entry = tokenAuthCache.get(token);
-    if (!entry)
-        return null;
-    if (Date.now() > entry.expiresAt) {
-        tokenAuthCache.delete(token);
-        return null;
-    }
-    return entry.result;
-}
-function setCachedAuth(token, result) {
-    // Only cache successful authentications — never pin a failure.
-    if (!result.authenticated)
-        return;
-    tokenAuthCache.set(token, { result, expiresAt: Date.now() + TOKEN_CACHE_TTL });
-    if (tokenAuthCache.size > 1000) {
-        const now = Date.now();
-        for (const [k, v] of tokenAuthCache) {
-            if (now > v.expiresAt)
-                tokenAuthCache.delete(k);
-        }
-    }
-}
-/**
- * Validate a Supabase JWT and check subscription via iTool's profiles table.
- */
-async function validateToken(token) {
-    if (!SUPABASE_URL || !SUPABASE_ANON_KEY) {
-        return { authenticated: false };
-    }
-    const cached = getCachedAuth(token);
-    if (cached)
-        return cached;
-    try {
-        const res = await fetch(`${SUPABASE_URL}/auth/v1/user`, {
-            headers: {
-                Authorization: `Bearer ${token}`,
-                apikey: SUPABASE_ANON_KEY,
-            },
-            signal: AbortSignal.timeout(5_000),
-        });
-        if (!res.ok)
-            return { authenticated: false };
-        const user = (await res.json());
-        // Check subscription from iTool's profiles table
-        let plan = "free";
-        let subscribed = false;
-        try {
-            const profileRes = await fetch(`${SUPABASE_URL}/rest/v1/profiles?id=eq.${user.id}&select=plan,plan_expires_at&limit=1`, {
-                headers: {
-                    Authorization: `Bearer ${token}`,
-                    apikey: SUPABASE_ANON_KEY,
-                },
-                signal: AbortSignal.timeout(5_000),
-            });
-            if (profileRes.ok) {
-                const profiles = (await profileRes.json());
-                if (profiles.length > 0) {
-                    const p = profiles[0];
-                    plan = p.plan;
-                    subscribed =
-                        p.plan === "pro" &&
-                            !!p.plan_expires_at &&
-                            new Date(p.plan_expires_at) > new Date();
-                }
-            }
-        }
-        catch { }
-        const authResult = {
-            authenticated: true,
-            userId: user.id,
-            email: user.email,
-            plan,
-            subscribed,
-        };
-        setCachedAuth(token, authResult);
-        return authResult;
-    }
-    catch {
-        return { authenticated: false };
-    }
-}
-/**
- * Server-side subscription check using service role key (no user JWT needed).
- * Returns "unknown" for configuration or network failures so active sessions
- * are not disconnected because of a transient verification problem.
- */
-export async function checkSubscriptionByUserId(userId) {
-    if (!SUPABASE_URL || !SUPABASE_ANON_KEY) {
-        return { status: "unknown", reason: "missing_supabase_config" };
-    }
-    if (!SUPABASE_SERVICE_ROLE_KEY) {
-        return { status: "unknown", reason: "missing_service_role_key" };
-    }
-    try {
-        const res = await fetch(`${SUPABASE_URL}/rest/v1/profiles?id=eq.${userId}&select=plan,plan_expires_at&limit=1`, {
-            headers: {
-                Authorization: `Bearer ${SUPABASE_SERVICE_ROLE_KEY}`,
-                apikey: SUPABASE_ANON_KEY,
-            },
-            signal: AbortSignal.timeout(5_000),
-        });
-        if (!res.ok)
-            return { status: "unknown", reason: `profile_lookup_http_${res.status}` };
-        const profiles = (await res.json());
-        if (profiles.length === 0)
-            return { status: "unknown", reason: "profile_not_found" };
-        const p = profiles[0];
-        const active = p.plan === "pro" &&
-            !!p.plan_expires_at &&
-            new Date(p.plan_expires_at) > new Date();
-        return { status: active ? "active" : "inactive" };
-    }
-    catch {
-        return { status: "unknown", reason: "profile_lookup_failed" };
-    }
-}
-export function extractAuthToken(req) {
-    const url = new URL(req.url ?? "/", "http://localhost");
-    const token = url.searchParams.get("auth_token");
-    if (token)
-        return token;
-    const auth = req.headers.authorization;
-    if (auth) {
-        const match = auth.match(/^Bearer\s+(.+)$/i);
-        if (match?.[1])
-            return match[1];
-    }
-    return null;
-}
-/**
- * Validate token and return auth result (exported for /sessions/mine).
- */
-export async function validateRequest(req) {
-    const token = extractAuthToken(req);
-    if (!token)
-        return null;
-    const result = await validateToken(token);
-    return result.authenticated ? result : null;
-}
-/**
- * Auth middleware for premium gateway HTTP endpoints.
- * Rejects non-subscribers with a message pointing to itool.tech.
- */
-export async function requireAuth(req, res) {
-    if (!AUTH_REQUIRED) {
-        return { authenticated: true };
-    }
-    const token = extractAuthToken(req);
-    if (!token) {
-        res.writeHead(401, { "Content-Type": "application/json" });
-        res.end(JSON.stringify({ error: "auth_required", message: "Authentication required" }));
-        return null;
-    }
-    const result = await validateToken(token);
-    if (!result.authenticated) {
-        res.writeHead(401, { "Content-Type": "application/json" });
-        res.end(JSON.stringify({ error: "invalid_token", message: "Invalid or expired token" }));
-        return null;
-    }
-    if (!result.subscribed) {
-        res.writeHead(403, { "Content-Type": "application/json" });
-        res.end(JSON.stringify({
-            error: "subscription_required",
-            message: "Pro subscription required. Subscribe at https://itool.tech",
-        }));
-        return null;
-    }
-    return result;
-}
-/**
- * Check auth for WebSocket upgrade requests.
- * Returns AuthResult or null if unauthorized.
- */
-export async function checkWsAuth(req) {
-    if (!AUTH_REQUIRED) {
-        return { authenticated: true };
-    }
-    const token = extractAuthToken(req);
-    if (!token)
-        return null;
-    const result = await validateToken(token);
-    if (!result.authenticated)
-        return null;
-    if (!result.subscribed)
-        return null;
-    return result;
-}
-//# sourceMappingURL=auth-middleware.js.map

package/dist/gateway/src/auth-middleware.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"auth-middleware.js","sourceRoot":"","sources":["../../../src/auth-middleware.ts"],"names":[],"mappings":"AAEA,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,IAAI,EAAE,CAAC;AACpD,MAAM,iBAAiB,GAAG,OAAO,CAAC,GAAG,CAAC,iBAAiB,IAAI,EAAE,CAAC;AAC9D,MAAM,yBAAyB,GAAG,OAAO,CAAC,GAAG,CAAC,yBAAyB,IAAI,EAAE,CAAC;AAC9E,MAAM,aAAa,GAAG,OAAO,CAAC,GAAG,CAAC,aAAa,KAAK,MAAM,CAAC;AAE3D,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,iBAAiB,EAAE,yBAAyB,EAAE,CAAC;AAerF,MAAM,UAAU,oBAAoB,CAAC,KAKpC;IACC,IAAI,KAAK,CAAC,SAAS;QAAE,OAAO,IAAI,CAAC;IACjC,OAAO,OAAO,CACZ,KAAK,CAAC,YAAY;QAClB,KAAK,CAAC,mBAAmB;QACzB,KAAK,CAAC,aAAa;QACnB,KAAK,CAAC,mBAAmB,KAAK,KAAK,CAAC,aAAa,CAClD,CAAC;AACJ,CAAC;AAWD,MAAM,cAAc,GAAG,IAAI,GAAG,EAAsB,CAAC;AACrD,MAAM,eAAe,GAAG,MAAM,CAAC,CAAC,MAAM;AAEtC,SAAS,aAAa,CAAC,KAAa;IAClC,MAAM,KAAK,GAAG,cAAc,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACxC,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACxB,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,SAAS,EAAE,CAAC;QACjC,cAAc,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAC7B,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,KAAK,CAAC,MAAM,CAAC;AACtB,CAAC;AAED,SAAS,aAAa,CAAC,KAAa,EAAE,MAAkB;IACtD,+DAA+D;IAC/D,IAAI,CAAC,MAAM,CAAC,aAAa;QAAE,OAAO;IAClC,cAAc,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,eAAe,EAAE,CAAC,CAAC;IAC/E,IAAI,cAAc,CAAC,IAAI,GAAG,IAAI,EAAE,CAAC;QAC/B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,cAAc,EAAE,CAAC;YACpC,IAAI,GAAG,GAAG,CAAC,CAAC,SAAS;gBAAE,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QAClD,CAAC;IACH,CAAC;AACH,CAAC;AAED;;GAEG;AACH,KAAK,UAAU,aAAa,CAAC,KAAa;IACxC,IAAI,CAAC,YAAY,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACxC,OAAO,EAAE,aAAa,EAAE,KAAK,EAAE,CAAC;IAClC,CAAC;IAED,MAAM,MAAM,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;IACpC,IAAI,MAAM;QAAE,OAAO,MAAM,CAAC;IAE1B,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,YAAY,eAAe,EAAE;YACtD,OAAO,EAAE;gBACP,aAAa,EAAE,UAAU,KAAK,EAAE;gBAChC,MAAM,EAAE,iBAAiB;aAC1B;YACD,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,KAAK,CAAC;SACnC,CAAC,CAAC;QAEH,IAAI,CAAC,GAAG,CAAC,EAAE;YAAE,OAAO,EAAE,aAAa,EAAE,KAAK,EAAE,CAAC;QAE7C,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAmC,CAAC;QAElE,iDAAiD;QACjD,IAAI,IAAI,GAAG,MAAM,CAAC;QAClB,IAAI,UAAU,GAAG,KAAK,CAAC;QACvB,IAAI,CAAC;YACH,MAAM,UAAU,GAAG,MAAM,KAAK,CAC5B,GAAG,YAAY,2BAA2B,IAAI,CAAC,EAAE,sCAAsC,EACvF;gBACE,OAAO,EAAE;oBACP,aAAa,EAAE,UAAU,KAAK,EAAE;oBAChC,MAAM,EAAE,iBAAiB;iBAC1B;gBACD,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,KAAK,CAAC;aACnC,CACF,CAAC;YACF,IAAI,UAAU,CAAC,EAAE,EAAE,CAAC;gBAClB,MAAM,QAAQ,GAAG,CAAC,MAAM,UAAU,CAAC,IAAI,EAAE,CAGtC,CAAC;gBACJ,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oBACxB,MAAM,CAAC,GAAG,QAAQ,CAAC,CAAC,CAAE,CAAC;oBACvB,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC;oBACd,UAAU;wBACR,CAAC,CAAC,IAAI,KAAK,KAAK;4BAChB,CAAC,CAAC,CAAC,CAAC,eAAe;4BACnB,IAAI,IAAI,CAAC,CAAC,CAAC,eAAe,CAAC,GAAG,IAAI,IAAI,EAAE,CAAC;gBAC7C,CAAC;YACH,CAAC;QACH,CAAC;QAAC,MAAM,CAAC,CAAA,CAAC;QAEV,MAAM,UAAU,GAAe;YAC7B,aAAa,EAAE,IAAI;YACnB,MAAM,EAAE,IAAI,CAAC,EAAE;YACf,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,IAAI;YACJ,UAAU;SACX,CAAC;QACF,aAAa,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;QACjC,OAAO,UAAU,CAAC;IACpB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,aAAa,EAAE,KAAK,EAAE,CAAC;IAClC,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,MAAc;IAEd,IAAI,CAAC,YAAY,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACxC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,yBAAyB,EAAE,CAAC;IAClE,CAAC;IACD,IAAI,CAAC,yBAAyB,EAAE,CAAC;QAC/B,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,0BAA0B,EAAE,CAAC;IACnE,CAAC;IAED,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,KAAK,CACrB,GAAG,YAAY,2BAA2B,MAAM,sCAAsC,EACtF;YACE,OAAO,EAAE;gBACP,aAAa,EAAE,UAAU,yBAAyB,EAAE;gBACpD,MAAM,EAAE,iBAAiB;aAC1B;YACD,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,KAAK,CAAC;SACnC,CACF,CAAC;QACF,IAAI,CAAC,GAAG,CAAC,EAAE;YAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,uBAAuB,GAAG,CAAC,MAAM,EAAE,EAAE,CAAC;QACvF,MAAM,QAAQ,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAG/B,CAAC;QACJ,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC;QACrF,MAAM,CAAC,GAAG,QAAQ,CAAC,CAAC,CAAE,CAAC;QACvB,MAAM,MAAM,GACV,CAAC,CAAC,IAAI,KAAK,KAAK;YAChB,CAAC,CAAC,CAAC,CAAC,eAAe;YACnB,IAAI,IAAI,CAAC,CAAC,CAAC,eAAe,CAAC,GAAG,IAAI,IAAI,EAAE,CAAC;QAC3C,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC;IACpD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,uBAAuB,EAAE,CAAC;IAChE,CAAC;AACH,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,GAAoB;IACnD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,EAAE,kBAAkB,CAAC,CAAC;IACxD,MAAM,KAAK,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;IACjD,IAAI,KAAK;QAAE,OAAO,KAAK,CAAC;IACxB,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC;IACvC,IAAI,IAAI,EAAE,CAAC;QACT,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC;QAC7C,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC;YAAE,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC;IAClC,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,GAAoB;IAEpB,MAAM,KAAK,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;IACpC,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACxB,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,KAAK,CAAC,CAAC;IAC1C,OAAO,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;AAC9C,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,GAAoB,EACpB,GAAmB;IAEnB,IAAI,CAAC,aAAa,EAAE,CAAC;QACnB,OAAO,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC;IACjC,CAAC;IAED,MAAM,KAAK,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;IACpC,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;QAC3D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,eAAe,EAAE,OAAO,EAAE,yBAAyB,EAAE,CAAC,CAAC,CAAC;QACxF,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,KAAK,CAAC,CAAC;IAC1C,IAAI,CAAC,MAAM,CAAC,aAAa,EAAE,CAAC;QAC1B,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;QAC3D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,eAAe,EAAE,OAAO,EAAE,0BAA0B,EAAE,CAAC,CAAC,CAAC;QACzF,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC;QACvB,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;QAC3D,GAAG,CAAC,GAAG,CACL,IAAI,CAAC,SAAS,CAAC;YACb,KAAK,EAAE,uBAAuB;YAC9B,OAAO,EAAE,4DAA4D;SACtE,CAAC,CACH,CAAC;QACF,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,GAAoB;IAEpB,IAAI,CAAC,aAAa,EAAE,CAAC;QACnB,OAAO,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC;IACjC,CAAC;IAED,MAAM,KAAK,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;IACpC,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IAExB,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,KAAK,CAAC,CAAC;IAC1C,IAAI,CAAC,MAAM,CAAC,aAAa;QAAE,OAAO,IAAI,CAAC;IACvC,IAAI,CAAC,MAAM,CAAC,UAAU;QAAE,OAAO,IAAI,CAAC;IAEpC,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/gateway/src/cors.d.ts

@@ -1,2 +0,0 @@
-import type { ServerResponse } from "node:http";
-export declare function setCors(res: ServerResponse): void;

package/dist/gateway/src/cors.js

@@ -1,7 +0,0 @@
-export function setCors(res) {
-    res.setHeader("Access-Control-Allow-Origin", "*");
-    res.setHeader("Access-Control-Allow-Methods", "GET, POST, DELETE, OPTIONS");
-    res.setHeader("Access-Control-Allow-Headers", "Content-Type, Authorization");
-    res.setHeader("Access-Control-Max-Age", "86400");
-}
-//# sourceMappingURL=cors.js.map

package/dist/gateway/src/cors.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"cors.js","sourceRoot":"","sources":["../../../src/cors.ts"],"names":[],"mappings":"AAEA,MAAM,UAAU,OAAO,CAAC,GAAmB;IACzC,GAAG,CAAC,SAAS,CAAC,6BAA6B,EAAE,GAAG,CAAC,CAAC;IAClD,GAAG,CAAC,SAAS,CAAC,8BAA8B,EAAE,4BAA4B,CAAC,CAAC;IAC5E,GAAG,CAAC,SAAS,CAAC,8BAA8B,EAAE,6BAA6B,CAAC,CAAC;IAC7E,GAAG,CAAC,SAAS,CAAC,wBAAwB,EAAE,OAAO,CAAC,CAAC;AACnD,CAAC"}

package/dist/gateway/src/embedded.d.ts

@@ -1,21 +0,0 @@
-export interface EmbeddedGatewayOptions {
-    port?: number;
-    logLevel?: "debug" | "info" | "warn" | "error";
-    silent?: boolean;
-    /**
-     * Also serve the v2 relay (end-to-end encrypted, at /v2/connect), keeping its
-     * pairings in SQLite here. Needs Node.js 22.13+ (node:sqlite).
-     */
-    relayDataPath?: string;
-}
-export interface EmbeddedGateway {
-    port: number;
-    httpUrl: string;
-    wsUrl: string;
-    close: () => Promise<void>;
-}
-/**
- * Start an embedded gateway. Returns a handle to get URLs and close it.
- * Used by CLI when no external --gateway is provided.
- */
-export declare function startEmbeddedGateway(options?: EmbeddedGatewayOptions): Promise<EmbeddedGateway>;