@opendatalabs/personal-server-ts-server 0.0.1-canary.016adf9 → 0.0.1-canary.052d47e

package/dist/sync-cursor.js

@@ -0,0 +1,110 @@
+import { mkdir, readFile, rename, writeFile } from "node:fs/promises";
+import { dirname, basename } from "node:path";
+import { loadConfig } from "./config/index.js";
+async function readCursorFile(cursorPath) {
+    try {
+        const raw = await readFile(cursorPath, "utf8");
+        const parsed = JSON.parse(raw);
+        return typeof parsed.lastProcessedTimestamp === "string"
+            ? parsed.lastProcessedTimestamp
+            : null;
+    }
+    catch (err) {
+        if (err instanceof Error &&
+            "code" in err &&
+            err.code === "ENOENT") {
+            return null;
+        }
+        throw err;
+    }
+}
+async function writeCursorFile(cursorPath, timestamp) {
+    await mkdir(dirname(cursorPath), { recursive: true });
+    const tmpPath = `${cursorPath}.tmp`;
+    const state = {
+        version: 1,
+        lastProcessedTimestamp: timestamp,
+    };
+    await writeFile(tmpPath, `${JSON.stringify(state, null, 2)}\n`);
+    await rename(tmpPath, cursorPath);
+}
+function createLegacyConfigCursor(configPath) {
+    return {
+        async read() {
+            const config = await loadConfig({ configPath });
+            return config.sync.lastProcessedTimestamp;
+        },
+        // Write only the sync cursor field through a raw read/merge/atomic-rename
+        // so we preserve every other field exactly as it lives on disk. The
+        // previous implementation round-tripped the whole config through
+        // loadConfig + saveConfig, which applies zod schema defaults (notably
+        // `storage.backend = "local"`) and silently clobbered runtime overrides
+        // like `storage.backend = "vana"` set via
+        // startPersonalServer({ configDefaults }). The result was that any
+        // consumer relying on configDefaults to set a non-default backend would
+        // silently revert to local storage after the first sync tick.
+        async write(timestamp) {
+            let raw = "{}";
+            try {
+                raw = await readFile(configPath, "utf8");
+            }
+            catch (err) {
+                if (!(err instanceof Error &&
+                    "code" in err &&
+                    err.code === "ENOENT")) {
+                    throw err;
+                }
+            }
+            let parsed;
+            try {
+                const candidate = JSON.parse(raw);
+                parsed =
+                    typeof candidate === "object" && candidate !== null
+                        ? candidate
+                        : {};
+            }
+            catch {
+                parsed = {};
+            }
+            const existingSync = typeof parsed.sync === "object" && parsed.sync !== null
+                ? parsed.sync
+                : {};
+            const next = {
+                ...parsed,
+                sync: { ...existingSync, lastProcessedTimestamp: timestamp },
+            };
+            await mkdir(dirname(configPath), { recursive: true });
+            const tmpPath = `${configPath}.tmp`;
+            await writeFile(tmpPath, `${JSON.stringify(next, null, 2)}\n`);
+            await rename(tmpPath, configPath);
+        },
+    };
+}
+/**
+ * Creates a cursor backed by a separate JSON state file.
+ * Passing config.json without options preserves the legacy config-backed API.
+ */
+export function createSyncCursor(cursorPath, options = {}) {
+    if (!options.legacyConfigPath && basename(cursorPath) === "config.json") {
+        return createLegacyConfigCursor(cursorPath);
+    }
+    return {
+        async read() {
+            const cursor = await readCursorFile(cursorPath);
+            if (cursor !== null) {
+                return cursor;
+            }
+            if (options.legacyConfigPath) {
+                const config = await loadConfig({
+                    configPath: options.legacyConfigPath,
+                });
+                return config.sync.lastProcessedTimestamp;
+            }
+            return null;
+        },
+        async write(timestamp) {
+            await writeCursorFile(cursorPath, timestamp);
+        },
+    };
+}
+//# sourceMappingURL=sync-cursor.js.map

package/dist/sync-cursor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sync-cursor.js","sourceRoot":"","sources":["../src/sync-cursor.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AACtE,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AAC9C,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAmB/C,KAAK,UAAU,cAAc,CAAC,UAAkB;IAC9C,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;QAC/C,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAA6B,CAAC;QAC3D,OAAO,OAAO,MAAM,CAAC,sBAAsB,KAAK,QAAQ;YACtD,CAAC,CAAC,MAAM,CAAC,sBAAsB;YAC/B,CAAC,CAAC,IAAI,CAAC;IACX,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IACE,GAAG,YAAY,KAAK;YACpB,MAAM,IAAI,GAAG;YACZ,GAA6B,CAAC,IAAI,KAAK,QAAQ,EAChD,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC;AAED,KAAK,UAAU,eAAe,CAC5B,UAAkB,EAClB,SAAiB;IAEjB,MAAM,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACtD,MAAM,OAAO,GAAG,GAAG,UAAU,MAAM,CAAC;IACpC,MAAM,KAAK,GAAoB;QAC7B,OAAO,EAAE,CAAC;QACV,sBAAsB,EAAE,SAAS;KAClC,CAAC;IACF,MAAM,SAAS,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;IAChE,MAAM,MAAM,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;AACpC,CAAC;AAED,SAAS,wBAAwB,CAAC,UAAkB;IAClD,OAAO;QACL,KAAK,CAAC,IAAI;YACR,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC;YAChD,OAAO,MAAM,CAAC,IAAI,CAAC,sBAAsB,CAAC;QAC5C,CAAC;QAED,0EAA0E;QAC1E,oEAAoE;QACpE,iEAAiE;QACjE,sEAAsE;QACtE,wEAAwE;QACxE,0CAA0C;QAC1C,mEAAmE;QACnE,wEAAwE;QACxE,8DAA8D;QAC9D,KAAK,CAAC,KAAK,CAAC,SAAS;YACnB,IAAI,GAAG,GAAG,IAAI,CAAC;YACf,IAAI,CAAC;gBACH,GAAG,GAAG,MAAM,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;YAC3C,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAI,CAAC,CACH,GAAG,YAAY,KAAK;oBACpB,MAAM,IAAI,GAAG;oBACZ,GAA6B,CAAC,IAAI,KAAK,QAAQ,CACjD,EAAE,CAAC;oBACF,MAAM,GAAG,CAAC;gBACZ,CAAC;YACH,CAAC;YACD,IAAI,MAA+B,CAAC;YACpC,IAAI,CAAC;gBACH,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAY,CAAC;gBAC7C,MAAM;oBACJ,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,KAAK,IAAI;wBACjD,CAAC,CAAE,SAAqC;wBACxC,CAAC,CAAC,EAAE,CAAC;YACX,CAAC;YAAC,MAAM,CAAC;gBACP,MAAM,GAAG,EAAE,CAAC;YACd,CAAC;YACD,MAAM,YAAY,GAChB,OAAO,MAAM,CAAC,IAAI,KAAK,QAAQ,IAAI,MAAM,CAAC,IAAI,KAAK,IAAI;gBACrD,CAAC,CAAE,MAAM,CAAC,IAAgC;gBAC1C,CAAC,CAAC,EAAE,CAAC;YACT,MAAM,IAAI,GAAG;gBACX,GAAG,MAAM;gBACT,IAAI,EAAE,EAAE,GAAG,YAAY,EAAE,sBAAsB,EAAE,SAAS,EAAE;aAC7D,CAAC;YACF,MAAM,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YACtD,MAAM,OAAO,GAAG,GAAG,UAAU,MAAM,CAAC;YACpC,MAAM,SAAS,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;YAC/D,MAAM,MAAM,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;QACpC,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAC9B,UAAkB,EAClB,UAA6B,EAAE;IAE/B,IAAI,CAAC,OAAO,CAAC,gBAAgB,IAAI,QAAQ,CAAC,UAAU,CAAC,KAAK,aAAa,EAAE,CAAC;QACxE,OAAO,wBAAwB,CAAC,UAAU,CAAC,CAAC;IAC9C,CAAC;IAED,OAAO;QACL,KAAK,CAAC,IAAI;YACR,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,UAAU,CAAC,CAAC;YAChD,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;gBACpB,OAAO,MAAM,CAAC;YAChB,CAAC;YACD,IAAI,OAAO,CAAC,gBAAgB,EAAE,CAAC;gBAC7B,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC;oBAC9B,UAAU,EAAE,OAAO,CAAC,gBAAgB;iBACrC,CAAC,CAAC;gBACH,OAAO,MAAM,CAAC,IAAI,CAAC,sBAAsB,CAAC;YAC5C,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QAED,KAAK,CAAC,KAAK,CAAC,SAAS;YACnB,MAAM,eAAe,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC;QAC/C,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/token-store.d.ts

@@ -0,0 +1,22 @@
+/**
+ * Persistent token store — manages Personal Server session tokens on disk.
+ *
+ * Tokens are stored in a JSON file (tokens.json) in the PS data directory
+ * so they survive restarts. Supports multiple concurrent tokens.
+ */
+import type { Logger } from "pino";
+export interface AddTokenOptions {
+    expiresAt?: string | Date | null;
+}
+export interface TokenStore {
+    /** All currently valid tokens. */
+    getTokens(): Promise<string[]>;
+    /** Check if a token is valid. */
+    isValid(token: string): Promise<boolean>;
+    /** Add a new token and persist to disk. */
+    addToken(token: string, options?: AddTokenOptions): Promise<void>;
+    /** Remove a token and persist to disk. */
+    removeToken(token: string): Promise<void>;
+}
+export declare function createTokenStore(filePath: string, logger: Logger): TokenStore;
+//# sourceMappingURL=token-store.d.ts.map

package/dist/token-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"token-store.d.ts","sourceRoot":"","sources":["../src/token-store.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAIH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,MAAM,CAAC;AAEnC,MAAM,WAAW,eAAe;IAC9B,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI,CAAC;CAClC;AAED,MAAM,WAAW,UAAU;IACzB,kCAAkC;IAClC,SAAS,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IAC/B,iCAAiC;IACjC,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACzC,2CAA2C;IAC3C,QAAQ,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAClE,0CAA0C;IAC1C,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC3C;AAOD,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,UAAU,CA6H7E"}

package/dist/token-store.js

@@ -0,0 +1,120 @@
+/**
+ * Persistent token store — manages Personal Server session tokens on disk.
+ *
+ * Tokens are stored in a JSON file (tokens.json) in the PS data directory
+ * so they survive restarts. Supports multiple concurrent tokens.
+ */
+import { readFile, writeFile, mkdir } from "node:fs/promises";
+import { dirname } from "node:path";
+export function createTokenStore(filePath, logger) {
+    const tokens = new Map();
+    let loaded = false;
+    function normalizeExpiresAt(value) {
+        if (value == null)
+            return null;
+        const date = value instanceof Date ? value : new Date(value);
+        if (Number.isNaN(date.getTime())) {
+            throw new Error("Invalid token expiry");
+        }
+        return date.toISOString();
+    }
+    function isExpired(expiresAt) {
+        if (!expiresAt)
+            return false;
+        return new Date(expiresAt).getTime() <= Date.now();
+    }
+    function purgeExpired() {
+        let removed = false;
+        for (const [token, expiresAt] of tokens.entries()) {
+            if (isExpired(expiresAt)) {
+                tokens.delete(token);
+                removed = true;
+            }
+        }
+        return removed;
+    }
+    async function loadFromDisk() {
+        if (loaded)
+            return;
+        try {
+            const raw = await readFile(filePath, "utf-8");
+            const data = JSON.parse(raw);
+            if (Array.isArray(data.tokens)) {
+                for (const entry of data.tokens) {
+                    if (typeof entry === "string" && entry.length > 0) {
+                        tokens.set(entry, null);
+                        continue;
+                    }
+                    if (typeof entry === "object" &&
+                        entry !== null &&
+                        typeof entry.token === "string" &&
+                        entry.token.length > 0) {
+                        const expiresAt = normalizeExpiresAt(entry.expiresAt);
+                        if (!isExpired(expiresAt)) {
+                            tokens.set(entry.token, expiresAt);
+                        }
+                    }
+                }
+            }
+            purgeExpired();
+            logger.info({ count: tokens.size }, "Loaded Personal Server session tokens from disk");
+        }
+        catch (err) {
+            if (err.code !== "ENOENT") {
+                logger.warn({ err }, "Failed to read tokens file");
+            }
+        }
+        loaded = true;
+    }
+    async function saveToDisk() {
+        purgeExpired();
+        const data = {
+            version: 1,
+            tokens: Array.from(tokens.entries()).map(([token, expiresAt]) => expiresAt ? { token, expiresAt } : token),
+        };
+        try {
+            await mkdir(dirname(filePath), { recursive: true });
+            await writeFile(filePath, JSON.stringify(data, null, 2), {
+                mode: 0o600,
+            });
+        }
+        catch (err) {
+            logger.error({ err }, "Failed to persist tokens file");
+        }
+    }
+    // Load eagerly on first access
+    const ready = loadFromDisk();
+    return {
+        async getTokens() {
+            await ready;
+            if (purgeExpired()) {
+                await saveToDisk();
+            }
+            return Array.from(tokens.keys());
+        },
+        async isValid(token) {
+            await ready;
+            const expiresAt = tokens.get(token);
+            if (expiresAt === undefined) {
+                return false;
+            }
+            if (isExpired(expiresAt)) {
+                tokens.delete(token);
+                await saveToDisk();
+                return false;
+            }
+            return true;
+        },
+        async addToken(token, options) {
+            await ready;
+            tokens.set(token, normalizeExpiresAt(options?.expiresAt));
+            await saveToDisk();
+        },
+        async removeToken(token) {
+            await ready;
+            tokens.delete(token);
+            await saveToDisk();
+        },
+    };
+}
+//# sourceMappingURL=token-store.js.map

package/dist/token-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"token-store.js","sourceRoot":"","sources":["../src/token-store.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AAC9D,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAuBpC,MAAM,UAAU,gBAAgB,CAAC,QAAgB,EAAE,MAAc;IAC/D,MAAM,MAAM,GAAG,IAAI,GAAG,EAAyB,CAAC;IAChD,IAAI,MAAM,GAAG,KAAK,CAAC;IAEnB,SAAS,kBAAkB,CACzB,KAAuC;QAEvC,IAAI,KAAK,IAAI,IAAI;YAAE,OAAO,IAAI,CAAC;QAC/B,MAAM,IAAI,GAAG,KAAK,YAAY,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC;QAC7D,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC;YACjC,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;QAC1C,CAAC;QACD,OAAO,IAAI,CAAC,WAAW,EAAE,CAAC;IAC5B,CAAC;IAED,SAAS,SAAS,CAAC,SAAoC;QACrD,IAAI,CAAC,SAAS;YAAE,OAAO,KAAK,CAAC;QAC7B,OAAO,IAAI,IAAI,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;IACrD,CAAC;IAED,SAAS,YAAY;QACnB,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,KAAK,MAAM,CAAC,KAAK,EAAE,SAAS,CAAC,IAAI,MAAM,CAAC,OAAO,EAAE,EAAE,CAAC;YAClD,IAAI,SAAS,CAAC,SAAS,CAAC,EAAE,CAAC;gBACzB,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;gBACrB,OAAO,GAAG,IAAI,CAAC;YACjB,CAAC;QACH,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,KAAK,UAAU,YAAY;QACzB,IAAI,MAAM;YAAE,OAAO;QACnB,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;YAC9C,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAe,CAAC;YAC3C,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC/B,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;oBAChC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;wBAClD,MAAM,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;wBACxB,SAAS;oBACX,CAAC;oBAED,IACE,OAAO,KAAK,KAAK,QAAQ;wBACzB,KAAK,KAAK,IAAI;wBACd,OAAO,KAAK,CAAC,KAAK,KAAK,QAAQ;wBAC/B,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,EACtB,CAAC;wBACD,MAAM,SAAS,GAAG,kBAAkB,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;wBACtD,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,EAAE,CAAC;4BAC1B,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;wBACrC,CAAC;oBACH,CAAC;gBACH,CAAC;YACH,CAAC;YACD,YAAY,EAAE,CAAC;YACf,MAAM,CAAC,IAAI,CACT,EAAE,KAAK,EAAE,MAAM,CAAC,IAAI,EAAE,EACtB,iDAAiD,CAClD,CAAC;QACJ,CAAC;QAAC,OAAO,GAAY,EAAE,CAAC;YACtB,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBACrD,MAAM,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,EAAE,4BAA4B,CAAC,CAAC;YACrD,CAAC;QACH,CAAC;QACD,MAAM,GAAG,IAAI,CAAC;IAChB,CAAC;IAED,KAAK,UAAU,UAAU;QACvB,YAAY,EAAE,CAAC;QACf,MAAM,IAAI,GAAe;YACvB,OAAO,EAAE,CAAC;YACV,MAAM,EAAE,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,EAAE,SAAS,CAAC,EAAE,EAAE,CAC9D,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,KAAK,CACzC;SACF,CAAC;QACF,IAAI,CAAC;YACH,MAAM,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YACpD,MAAM,SAAS,CAAC,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE;gBACvD,IAAI,EAAE,KAAK;aACZ,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,EAAE,+BAA+B,CAAC,CAAC;QACzD,CAAC;IACH,CAAC;IAED,+BAA+B;IAC/B,MAAM,KAAK,GAAG,YAAY,EAAE,CAAC;IAE7B,OAAO;QACL,KAAK,CAAC,SAAS;YACb,MAAM,KAAK,CAAC;YACZ,IAAI,YAAY,EAAE,EAAE,CAAC;gBACnB,MAAM,UAAU,EAAE,CAAC;YACrB,CAAC;YACD,OAAO,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;QACnC,CAAC;QAED,KAAK,CAAC,OAAO,CAAC,KAAa;YACzB,MAAM,KAAK,CAAC;YACZ,MAAM,SAAS,GAAG,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;YACpC,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;gBAC5B,OAAO,KAAK,CAAC;YACf,CAAC;YACD,IAAI,SAAS,CAAC,SAAS,CAAC,EAAE,CAAC;gBACzB,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;gBACrB,MAAM,UAAU,EAAE,CAAC;gBACnB,OAAO,KAAK,CAAC;YACf,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QAED,KAAK,CAAC,QAAQ,CAAC,KAAa,EAAE,OAAyB;YACrD,MAAM,KAAK,CAAC;YACZ,MAAM,CAAC,GAAG,CAAC,KAAK,EAAE,kBAAkB,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC;YAC1D,MAAM,UAAU,EAAE,CAAC;QACrB,CAAC;QAED,KAAK,CAAC,WAAW,CAAC,KAAa;YAC7B,MAAM,KAAK,CAAC;YACZ,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACrB,MAAM,UAAU,EAAE,CAAC;QACrB,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/tunnel/auth.d.ts

@@ -11,6 +11,9 @@ export interface SignedClaim {
     claim: string;
     sig: string;
 }
+export interface TunnelClaimSigner {
+    signMessage(message: string): Promise<`0x${string}`>;
+}
 export interface ClaimPayload {
     aud: string;
     iat: number;
@@ -25,6 +28,7 @@ export interface ClaimConfig {
     walletAddress: string;
     runId: string;
     serverKeypair: ServerAccount;
+    signer?: TunnelClaimSigner;
 }
 /** Encode a UTF-8 string to base64url (no padding). */
 export declare function base64urlEncode(input: string): string;

package/dist/tunnel/auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../src/tunnel/auth.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,4CAA4C,CAAC;AAEhF,kEAAkE;AAClE,eAAO,MAAM,iBAAiB,MAAM,CAAC;AAErC,MAAM,WAAW,WAAW;IAC1B,KAAK,EAAE,MAAM,CAAC;IACd,GAAG,EAAE,MAAM,CAAC;CACb;AAED,MAAM,WAAW,YAAY;IAC3B,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,WAAW;IAC1B,YAAY,EAAE,MAAM,CAAC;IACrB,aAAa,EAAE,MAAM,CAAC;IACtB,KAAK,EAAE,MAAM,CAAC;IACd,aAAa,EAAE,aAAa,CAAC;CAC9B;AAED,uDAAuD;AACvD,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAMrD;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAsB,mBAAmB,CACvC,MAAM,EAAE,WAAW,GAClB,OAAO,CAAC,WAAW,CAAC,CAiBtB"}
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../src/tunnel/auth.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,4CAA4C,CAAC;AAEhF,kEAAkE;AAClE,eAAO,MAAM,iBAAiB,MAAM,CAAC;AAErC,MAAM,WAAW,WAAW;IAC1B,KAAK,EAAE,MAAM,CAAC;IACd,GAAG,EAAE,MAAM,CAAC;CACb;AAED,MAAM,WAAW,iBAAiB;IAChC,WAAW,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,KAAK,MAAM,EAAE,CAAC,CAAC;CACtD;AAED,MAAM,WAAW,YAAY;IAC3B,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,WAAW;IAC1B,YAAY,EAAE,MAAM,CAAC;IACrB,aAAa,EAAE,MAAM,CAAC;IACtB,KAAK,EAAE,MAAM,CAAC;IACd,aAAa,EAAE,aAAa,CAAC;IAC7B,MAAM,CAAC,EAAE,iBAAiB,CAAC;CAC5B;AAED,uDAAuD;AACvD,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAMrD;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAsB,mBAAmB,CACvC,MAAM,EAAE,WAAW,GAClB,OAAO,CAAC,WAAW,CAAC,CAkBtB"}

package/dist/tunnel/auth.js

@@ -40,7 +40,8 @@ export async function generateSignedClaim(config) {
         runId: config.runId,
     };
     const claim = base64urlEncode(JSON.stringify(payload));
-    const sig = await config.serverKeypair.signMessage(claim);
+    const signer = config.signer ?? config.serverKeypair;
+    const sig = await signer.signMessage(claim);
     return { claim, sig };
 }
 //# sourceMappingURL=auth.js.map

package/dist/tunnel/auth.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../src/tunnel/auth.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAIH,kEAAkE;AAClE,MAAM,CAAC,MAAM,iBAAiB,GAAG,GAAG,CAAC;AAwBrC,uDAAuD;AACvD,MAAM,UAAU,eAAe,CAAC,KAAa;IAC3C,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,OAAO,CAAC;SAC/B,QAAQ,CAAC,QAAQ,CAAC;SAClB,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;SACnB,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;SACnB,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AACxB,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,MAAmB;IAEnB,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IAE1C,MAAM,OAAO,GAAiB;QAC5B,GAAG,EAAE,yBAAyB;QAC9B,GAAG,EAAE,GAAG;QACR,GAAG,EAAE,GAAG,GAAG,iBAAiB;QAC5B,KAAK,EAAE,MAAM,CAAC,YAAY;QAC1B,MAAM,EAAE,MAAM,CAAC,aAAa;QAC5B,SAAS,EAAE,MAAM,CAAC,aAAa,CAAC,WAAW,EAAE;QAC7C,KAAK,EAAE,MAAM,CAAC,KAAK;KACpB,CAAC;IAEF,MAAM,KAAK,GAAG,eAAe,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC;IACvD,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;IAE1D,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC;AACxB,CAAC"}
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../src/tunnel/auth.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAIH,kEAAkE;AAClE,MAAM,CAAC,MAAM,iBAAiB,GAAG,GAAG,CAAC;AA6BrC,uDAAuD;AACvD,MAAM,UAAU,eAAe,CAAC,KAAa;IAC3C,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,OAAO,CAAC;SAC/B,QAAQ,CAAC,QAAQ,CAAC;SAClB,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;SACnB,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;SACnB,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AACxB,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,MAAmB;IAEnB,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IAE1C,MAAM,OAAO,GAAiB;QAC5B,GAAG,EAAE,yBAAyB;QAC9B,GAAG,EAAE,GAAG;QACR,GAAG,EAAE,GAAG,GAAG,iBAAiB;QAC5B,KAAK,EAAE,MAAM,CAAC,YAAY;QAC1B,MAAM,EAAE,MAAM,CAAC,aAAa;QAC5B,SAAS,EAAE,MAAM,CAAC,aAAa,CAAC,WAAW,EAAE;QAC7C,KAAK,EAAE,MAAM,CAAC,KAAK;KACpB,CAAC;IAEF,MAAM,KAAK,GAAG,eAAe,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC;IACvD,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,aAAa,CAAC;IACrD,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;IAE5C,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC;AACxB,CAAC"}

package/dist/tunnel/config.d.ts

@@ -7,6 +7,7 @@ export interface FrpcConfigOptions {
     serverAddr: string;
     serverPort: number;
     localPort: number;
+    proxyName?: string;
     subdomain: string;
     walletAddress: string;
     ownerAddress: string;

package/dist/tunnel/config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../src/tunnel/config.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,MAAM,WAAW,iBAAiB;IAChC,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,aAAa,EAAE,MAAM,CAAC;IACtB,YAAY,EAAE,MAAM,CAAC;IACrB,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED;;;;;;;;GAQG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,iBAAiB,GAAG,MAAM,CAsBrE"}
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../src/tunnel/config.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,MAAM,WAAW,iBAAiB;IAChC,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,aAAa,EAAE,MAAM,CAAC;IACtB,YAAY,EAAE,MAAM,CAAC;IACrB,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED;;;;;;;;GAQG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,iBAAiB,GAAG,MAAM,CAsBrE"}

package/dist/tunnel/config.js

@@ -28,7 +28,7 @@ metadatas.auth_claim = "${options.authClaim}"
 metadatas.auth_sig = "${options.authSig}"
 
 [[proxies]]
-name = "personal-server"
+name = "${options.proxyName ?? `personal-server-${options.subdomain.toLowerCase()}`}"
 type = "http"
 localIP = "127.0.0.1"
 localPort = ${options.localPort}

package/dist/tunnel/config.js.map

@@ -1 +1 @@
-{"version":3,"file":"config.js","sourceRoot":"","sources":["../../src/tunnel/config.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAcH;;;;;;;;GAQG;AACH,MAAM,UAAU,kBAAkB,CAAC,OAA0B;IAC3D,OAAO;;;gBAGO,OAAO,CAAC,UAAU;eACnB,OAAO,CAAC,UAAU;;;;sBAIX,OAAO,CAAC,aAAa;qBACtB,OAAO,CAAC,YAAY;sBACnB,OAAO,CAAC,KAAK;0BACT,OAAO,CAAC,SAAS;wBACnB,OAAO,CAAC,OAAO;;;;;;cAMzB,OAAO,CAAC,SAAS;eAChB,OAAO,CAAC,SAAS;CAC/B,CAAC;AACF,CAAC"}
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../../src/tunnel/config.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAeH;;;;;;;;GAQG;AACH,MAAM,UAAU,kBAAkB,CAAC,OAA0B;IAC3D,OAAO;;;gBAGO,OAAO,CAAC,UAAU;eACnB,OAAO,CAAC,UAAU;;;;sBAIX,OAAO,CAAC,aAAa;qBACtB,OAAO,CAAC,YAAY;sBACnB,OAAO,CAAC,KAAK;0BACT,OAAO,CAAC,SAAS;wBACnB,OAAO,CAAC,OAAO;;;UAG7B,OAAO,CAAC,SAAS,IAAI,mBAAmB,OAAO,CAAC,SAAS,CAAC,WAAW,EAAE,EAAE;;;cAGrE,OAAO,CAAC,SAAS;eAChB,OAAO,CAAC,SAAS;CAC/B,CAAC;AACF,CAAC"}

package/dist/tunnel/manager.d.ts

@@ -9,18 +9,22 @@
  * - Provide status for health endpoint
  */
 import type { ServerAccount } from "@opendatalabs/personal-server-ts-core/keys";
+import { type TunnelClaimSigner } from "./auth.js";
 export type TunnelStatus = "stopped" | "starting" | "connected" | "disconnected" | "error";
 export interface TunnelStatusInfo {
     enabled: boolean;
     status: TunnelStatus;
     publicUrl: string | null;
     connectedSince: string | null;
+    routable?: boolean;
+    warning?: string;
     error?: string;
 }
 export interface TunnelConfig {
     walletAddress: string;
     ownerAddress: string;
     serverKeypair: ServerAccount;
+    tunnelSigner?: TunnelClaimSigner;
     runId: string;
     serverAddr: string;
     serverPort: number;
@@ -33,16 +37,32 @@ export declare class TunnelManager {
     private publicUrl;
     private connectedSince;
     private lastError;
+    private routable;
+    private routeWarning;
     private config;
     private binaryPath;
     private refreshTimer;
     private refreshing;
     constructor(storageRoot: string);
     /**
-     * Start the frpc process with the given configuration.
+     * Reserve the tunnel's public URL without starting frpc. The URL is
+     * deterministic (wallet-derived subdomain), so callers can register the
+     * server with the gateway before any tunnel traffic is attempted. Dialing
+     * the relay pre-registration is what poisoned its delegation cache and
+     * caused the ~70s "Signer is not a registered server" window (BUI-611).
+     */
+    reserve(config: TunnelConfig, binaryPath: string): string;
+    /**
+     * Start the frpc process for a previously reserved tunnel.
      * Returns the public URL once the tunnel is established.
      * Automatically schedules periodic claim refresh.
      */
+    connect(): Promise<string>;
+    /**
+     * Reserve and immediately connect. Prefer reserve() + connect() gated on
+     * server registration; this remains for callers that are already
+     * registered.
+     */
     start(config: TunnelConfig, binaryPath: string): Promise<string>;
     /**
      * Stop the frpc process gracefully.

package/dist/tunnel/manager.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"manager.d.ts","sourceRoot":"","sources":["../../src/tunnel/manager.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAKH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,4CAA4C,CAAC;AAKhF,MAAM,MAAM,YAAY,GACpB,SAAS,GACT,UAAU,GACV,WAAW,GACX,cAAc,GACd,OAAO,CAAC;AAEZ,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,YAAY,CAAC;IACrB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,YAAY;IAC3B,aAAa,EAAE,MAAM,CAAC;IACtB,YAAY,EAAE,MAAM,CAAC;IACrB,aAAa,EAAE,aAAa,CAAC;IAC7B,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;CACnB;AAQD,qBAAa,aAAa;IACxB,OAAO,CAAC,WAAW,CAAS;IAC5B,OAAO,CAAC,OAAO,CAA6B;IAC5C,OAAO,CAAC,MAAM,CAA2B;IACzC,OAAO,CAAC,SAAS,CAAuB;IACxC,OAAO,CAAC,cAAc,CAAqB;IAC3C,OAAO,CAAC,SAAS,CAAuB;IACxC,OAAO,CAAC,MAAM,CAA6B;IAC3C,OAAO,CAAC,UAAU,CAAuB;IACzC,OAAO,CAAC,YAAY,CAA8C;IAClE,OAAO,CAAC,UAAU,CAAS;gBAEf,WAAW,EAAE,MAAM;IAI/B;;;;OAIG;IACG,KAAK,CAAC,MAAM,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAkCtE;;OAEG;IACG,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IA8B3B;;OAEG;IACH,SAAS,IAAI,OAAO;IAIpB;;OAEG;IACH,WAAW,CAAC,SAAS,EAAE,OAAO,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI;IAUrD;;OAEG;IACH,SAAS,IAAI,gBAAgB;IAU7B;;OAEG;IACH,YAAY,IAAI,MAAM,GAAG,IAAI;IAQ7B;;OAEG;YACW,gBAAgB;IA8B9B;;;OAGG;YACW,YAAY;IAkE1B;;OAEG;YACW,WAAW;IAsBzB,OAAO,CAAC,eAAe;IAQvB,OAAO,CAAC,iBAAiB;IAOzB;;;OAGG;YACW,YAAY;CA0B3B"}
+{"version":3,"file":"manager.d.ts","sourceRoot":"","sources":["../../src/tunnel/manager.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAKH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,4CAA4C,CAAC;AAChF,OAAO,EAGL,KAAK,iBAAiB,EACvB,MAAM,WAAW,CAAC;AAInB,MAAM,MAAM,YAAY,GACtB,SAAS,GAAG,UAAU,GAAG,WAAW,GAAG,cAAc,GAAG,OAAO,CAAC;AAElE,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,YAAY,CAAC;IACrB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,YAAY;IAC3B,aAAa,EAAE,MAAM,CAAC;IACtB,YAAY,EAAE,MAAM,CAAC;IACrB,aAAa,EAAE,aAAa,CAAC;IAC7B,YAAY,CAAC,EAAE,iBAAiB,CAAC;IACjC,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;CACnB;AAQD,qBAAa,aAAa;IACxB,OAAO,CAAC,WAAW,CAAS;IAC5B,OAAO,CAAC,OAAO,CAA6B;IAC5C,OAAO,CAAC,MAAM,CAA2B;IACzC,OAAO,CAAC,SAAS,CAAuB;IACxC,OAAO,CAAC,cAAc,CAAqB;IAC3C,OAAO,CAAC,SAAS,CAAuB;IACxC,OAAO,CAAC,QAAQ,CAAsB;IACtC,OAAO,CAAC,YAAY,CAAuB;IAC3C,OAAO,CAAC,MAAM,CAA6B;IAC3C,OAAO,CAAC,UAAU,CAAuB;IACzC,OAAO,CAAC,YAAY,CAA8C;IAClE,OAAO,CAAC,UAAU,CAAS;gBAEf,WAAW,EAAE,MAAM;IAI/B;;;;;;OAMG;IACH,OAAO,CAAC,MAAM,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,GAAG,MAAM;IAYzD;;;;OAIG;IACG,OAAO,IAAI,OAAO,CAAC,MAAM,CAAC;IAsChC;;;;OAIG;IACG,KAAK,CAAC,MAAM,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAKtE;;OAEG;IACG,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IAgC3B;;OAEG;IACH,SAAS,IAAI,OAAO;IAIpB;;OAEG;IACH,WAAW,CAAC,SAAS,EAAE,OAAO,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI;IAOrD;;OAEG;IACH,SAAS,IAAI,gBAAgB;IAY7B;;OAEG;IACH,YAAY,IAAI,MAAM,GAAG,IAAI;IAQ7B;;OAEG;YACW,gBAAgB;IA+B9B;;;OAGG;YACW,YAAY;IA0F1B;;OAEG;YACW,WAAW;IAsBzB,OAAO,CAAC,eAAe;IAQvB,OAAO,CAAC,iBAAiB;IAOzB;;;OAGG;YACW,YAAY;CA0B3B"}

package/dist/tunnel/manager.js

@@ -11,7 +11,7 @@
 import { spawn } from "node:child_process";
 import { writeFile, mkdir, chmod, access, constants } from "node:fs/promises";
 import { join } from "node:path";
-import { generateSignedClaim, CLAIM_TTL_SECONDS } from "./auth.js";
+import { generateSignedClaim, CLAIM_TTL_SECONDS, } from "./auth.js";
 import { generateFrpcConfig } from "./config.js";
 import { buildTunnelUrl } from "./verify.js";
 /** Refresh at 80% of TTL to leave buffer before expiry. */
@@ -25,6 +25,8 @@ export class TunnelManager {
     publicUrl = null;
     connectedSince = null;
     lastError = null;
+    routable;
+    routeWarning = null;
     config = null;
     binaryPath = null;
     refreshTimer = null;
@@ -33,18 +35,40 @@ export class TunnelManager {
         this.storageRoot = storageRoot;
     }
     /**
-     * Start the frpc process with the given configuration.
-     * Returns the public URL once the tunnel is established.
-     * Automatically schedules periodic claim refresh.
+     * Reserve the tunnel's public URL without starting frpc. The URL is
+     * deterministic (wallet-derived subdomain), so callers can register the
+     * server with the gateway before any tunnel traffic is attempted. Dialing
+     * the relay pre-registration is what poisoned its delegation cache and
+     * caused the ~70s "Signer is not a registered server" window (BUI-611).
      */
-    async start(config, binaryPath) {
+    reserve(config, binaryPath) {
         if (this.process) {
             throw new Error("Tunnel already running");
         }
         this.config = config;
         this.binaryPath = binaryPath;
+        const subdomain = config.walletAddress.toLowerCase();
+        this.publicUrl = buildTunnelUrl(subdomain, config.serverAddr);
+        return this.publicUrl;
+    }
+    /**
+     * Start the frpc process for a previously reserved tunnel.
+     * Returns the public URL once the tunnel is established.
+     * Automatically schedules periodic claim refresh.
+     */
+    async connect() {
+        if (this.process) {
+            throw new Error("Tunnel already running");
+        }
+        const config = this.config;
+        const binaryPath = this.binaryPath;
+        if (!config || !binaryPath || !this.publicUrl) {
+            throw new Error("Tunnel not reserved");
+        }
         this.status = "starting";
         this.lastError = null;
+        this.routable = undefined;
+        this.routeWarning = null;
         // Verify binary exists and is executable
         try {
             await access(binaryPath, constants.X_OK);
@@ -57,13 +81,20 @@ export class TunnelManager {
                 throw new Error(`frpc binary not found or not executable: ${binaryPath}`);
             }
         }
-        const subdomain = config.walletAddress.toLowerCase();
-        this.publicUrl = buildTunnelUrl(subdomain, config.serverAddr);
-        const configPath = await this.writeFreshConfig(subdomain);
+        const configPath = await this.writeFreshConfig(config.walletAddress.toLowerCase());
         await this.spawnProcess(configPath);
         this.scheduleRefresh();
         return this.publicUrl;
     }
+    /**
+     * Reserve and immediately connect. Prefer reserve() + connect() gated on
+     * server registration; this remains for callers that are already
+     * registered.
+     */
+    async start(config, binaryPath) {
+        this.reserve(config, binaryPath);
+        return this.connect();
+    }
     /**
      * Stop the frpc process gracefully.
      */
@@ -85,6 +116,8 @@ export class TunnelManager {
                 this.status = "stopped";
                 this.publicUrl = null;
                 this.connectedSince = null;
+                this.routable = undefined;
+                this.routeWarning = null;
                 resolve();
             });
             // Send SIGTERM for graceful shutdown
@@ -101,14 +134,10 @@ export class TunnelManager {
      * Update status based on external verification of the tunnel URL.
      */
     setVerified(reachable, error) {
-        if (reachable) {
-            this.status = "connected";
-            this.lastError = null;
-        }
-        else {
-            this.status = "error";
-            this.lastError = error ?? "Tunnel URL not reachable";
-        }
+        this.routable = reachable;
+        this.routeWarning = reachable
+            ? null
+            : (error ?? "Tunnel URL not reachable");
     }
     /**
      * Get the current tunnel status.
@@ -119,6 +148,8 @@ export class TunnelManager {
             status: this.status,
             publicUrl: this.publicUrl,
             connectedSince: this.connectedSince?.toISOString() ?? null,
+            routable: this.routable,
+            warning: this.routeWarning ?? undefined,
             error: this.lastError ?? undefined,
         };
     }
@@ -141,6 +172,7 @@ export class TunnelManager {
             walletAddress: config.walletAddress,
             runId: config.runId,
             serverKeypair: config.serverKeypair,
+            signer: config.tunnelSigner,
         });
         const frpcConfig = generateFrpcConfig({
             serverAddr: config.serverAddr,
@@ -171,15 +203,30 @@ export class TunnelManager {
             this.process = proc;
             let startupOutput = "";
             let resolved = false;
+            const cleanMessage = (message) => message.replace(/\x1b\[[0-9;]*m/g, "").trim();
+            const markRetrying = (message) => {
+                const warning = cleanMessage(message);
+                this.routeWarning = warning || "Waiting for tunnel connection";
+            };
             const onData = (data) => {
                 const text = data.toString();
                 startupOutput += text;
-                if (text.includes("start proxy success") ||
-                    text.includes("login to server success")) {
+                if (text.includes("start error:") ||
+                    text.includes("connect to server error:")) {
+                    markRetrying(startupOutput);
+                    if (!resolved) {
+                        resolved = true;
+                        resolve();
+                    }
+                    return;
+                }
+                if (text.includes("start proxy success")) {
+                    this.status = "connected";
+                    this.connectedSince ??= new Date();
+                    this.routable = undefined;
+                    this.routeWarning = null;
                     if (!resolved) {
                         resolved = true;
-                        this.status = "connected";
-                        this.connectedSince = new Date();
                         resolve();
                     }
                 }
@@ -208,13 +255,21 @@ export class TunnelManager {
                 else if (this.status === "connected") {
                     this.status = "disconnected";
                 }
+                else if (code !== 0) {
+                    this.status = "error";
+                    this.lastError = `frpc exited with code ${code}: ${startupOutput}`;
+                }
+                else {
+                    this.status = "disconnected";
+                }
             });
-            // Timeout for startup — resolve optimistically
+            // Timeout for startup — resolve optimistically. frpc is generated with
+            // loginFailExit=false, so auth/registration/network failures can recover
+            // after the server is registered or connectivity returns.
             setTimeout(() => {
                 if (!resolved) {
                     resolved = true;
-                    this.status = "connected";
-                    this.connectedSince = new Date();
+                    markRetrying(startupOutput || "Waiting for proxy startup");
                     resolve();
                 }
             }, 10_000);