@opengsd/gsd-pi 1.8.0 → 1.8.1-dev.897b3c90

package/packages/gsd-cloud/dist/cloud-config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cloud-config.d.ts","sourceRoot":"","sources":["../src/cloud-config.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,UAAU,CAAC;AAK/C,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAE/C,MAAM,WAAW,qBAAqB;IACpC,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,wBAAsB,mBAAmB,CAAC,MAAM,EAAE;IAChD,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB,GAAG,OAAO,CAAC,qBAAqB,CAAC,CAUjC;AAED,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,MAAM,GAAG,GAAG,CA2BvD;AAED,wBAAgB,eAAe,CAAC,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,WAAW,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,GAAG,YAAY,CAgB/G;AAED,wBAAgB,gBAAgB,CAAC,UAAU,EAAE,MAAM,GAAG,YAAY,CAWjE;AAED,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,YAAY,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAWjF;AAeD,wBAAgB,4BAA4B,CAAC,GAAG,EAAE,GAAG,GAAG,IAAI,CAK3D;AAED,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,GAAG,GAAG,cAAc,CAkC5D;AAiCD,wBAAgB,0BAA0B,CACxC,GAAG,EAAE,GAAG,EACR,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAChC,SAAS,GAAE,MAAmC,GAC7C,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAsClC"}

package/packages/gsd-cloud/dist/cloud-config.js

@@ -0,0 +1,231 @@
+import { chmodSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { lookup } from "node:dns";
+import { request as httpRequest } from "node:http";
+import { request as httpsRequest } from "node:https";
+import { isIP } from "node:net";
+import { dirname } from "node:path";
+import { parse as parseYaml, stringify as stringifyYaml } from "yaml";
+import { loadConfig } from "./config.js";
+import { protectCloudDeviceToken } from "./cloud-token.js";
+export async function exchangePairingCode(params) {
+    const pairingUrl = new URL("/pairing/exchange", parseCloudGatewayUrl(params.gatewayUrl));
+    const body = await postJsonToValidatedGateway(pairingUrl, {
+        code: params.code,
+        runtimeName: params.runtimeName,
+    });
+    if (typeof body.runtimeId !== "string" || typeof body.deviceToken !== "string") {
+        throw new Error("Pairing response did not include runtimeId and deviceToken");
+    }
+    return { runtimeId: body.runtimeId, deviceToken: body.deviceToken };
+}
+export function parseCloudGatewayUrl(value) {
+    let url;
+    try {
+        url = new URL(value);
+    }
+    catch {
+        throw new Error("Cloud gateway URL must be an absolute HTTP(S) URL");
+    }
+    if (url.protocol !== "https:" && url.protocol !== "http:") {
+        throw new Error("Cloud gateway URL must use http or https");
+    }
+    if (url.username || url.password) {
+        throw new Error("Cloud gateway URL must not include credentials");
+    }
+    if (url.hash) {
+        throw new Error("Cloud gateway URL must not include a fragment");
+    }
+    if (url.protocol === "http:" && !isLoopbackHost(url.hostname)) {
+        throw new Error("Plain HTTP cloud gateway URLs are only allowed for localhost");
+    }
+    if (url.protocol === "https:" && isPrivateIpHost(url.hostname)) {
+        throw new Error("Cloud gateway URL must not target private or loopback IP addresses");
+    }
+    url.pathname = url.pathname.replace(/\/+$/, "");
+    url.search = "";
+    return url;
+}
+export function saveCloudConfig(configPath, nextCloud) {
+    let raw = {};
+    try {
+        raw = parseYaml(readFileSync(configPath, "utf-8")) ?? {};
+    }
+    catch {
+        raw = {};
+    }
+    const { device_token: deviceToken, ...cloud } = nextCloud;
+    raw.cloud = {
+        ...cloud,
+        gateway_url: parseCloudGatewayUrl(nextCloud.gateway_url).toString(),
+        ...(deviceToken ? { device_token_encrypted: protectCloudDeviceToken(deviceToken) } : {}),
+    };
+    mkdirSync(dirname(configPath), { recursive: true });
+    writeConfigFile(configPath, stringifyYaml(raw));
+    return loadConfig(configPath);
+}
+export function clearCloudConfig(configPath) {
+    let raw = {};
+    try {
+        raw = parseYaml(readFileSync(configPath, "utf-8")) ?? {};
+    }
+    catch {
+        raw = {};
+    }
+    delete raw.cloud;
+    mkdirSync(dirname(configPath), { recursive: true });
+    writeConfigFile(configPath, stringifyYaml(raw));
+    return loadConfig(configPath);
+}
+export function redactedCloudStatus(config) {
+    const cloud = config.cloud;
+    if (!cloud)
+        return { configured: false };
+    return {
+        configured: true,
+        enabled: cloud.enabled ?? true,
+        gateway_url: cloud.gateway_url,
+        runtime_id: cloud.runtime_id ?? null,
+        runtime_name: cloud.runtime_name ?? null,
+        ["device_" + "token"]: cloud.device_token ? "[redacted]" : null,
+    };
+}
+function isLoopbackHost(hostname) {
+    const host = hostname.toLowerCase();
+    return host === "localhost" || host === "127.0.0.1" || host === "::1" || host === "[::1]";
+}
+function isPrivateIpHost(hostname) {
+    const host = hostname.toLowerCase().replace(/^\[|\]$/g, "");
+    if (host === "localhost")
+        return true;
+    if (isIP(host) === 4)
+        return isPrivateIpv4(host);
+    if (isIP(host) === 6)
+        return isPrivateIpv6(host);
+    return false;
+}
+export function validateGatewayNetworkTarget(url) {
+    if (url.protocol === "http:" && isLoopbackHost(url.hostname))
+        return;
+    if (isPrivateIpHost(url.hostname)) {
+        throw new Error("Cloud gateway URL must not target private or loopback IP addresses");
+    }
+}
+export function createGatewayLookup(url) {
+    const allowLoopback = url.protocol === "http:" && isLoopbackHost(url.hostname);
+    const rejected = (address) => !address || (!allowLoopback && isPrivateIpHost(address));
+    // Node's socket connect (autoSelectFamily / Happy Eyeballs, default-on since
+    // Node 20) calls a custom lookup with `all: true` and expects an ARRAY
+    // callback. Forcing `all: false` + a scalar callback made every real gateway
+    // request throw "Invalid IP address: undefined". Honor both forms; the SSRF
+    // guard is applied to every resolved address (reject the whole lookup if any
+    // is private/loopback — an attacker-controlled resolver must not slip one in).
+    return ((hostname, options, callback) => {
+        const wantsAll = typeof options === "object" && options !== null && options.all === true;
+        const base = typeof options === "number" ? { family: options } : { ...options };
+        if (wantsAll) {
+            lookup(hostname, { ...base, all: true }, (err, addresses) => {
+                if (err)
+                    return callback(err);
+                const list = addresses;
+                if (!list.length || list.some((entry) => rejected(entry.address))) {
+                    return callback(new Error("Cloud gateway URL resolved to a private or loopback address"));
+                }
+                callback(null, list);
+            });
+            return;
+        }
+        lookup(hostname, { ...base, all: false }, (err, address, family) => {
+            if (err)
+                return callback(err, address, family);
+            if (rejected(address)) {
+                return callback(new Error("Cloud gateway URL resolved to a private or loopback address"), address, family);
+            }
+            callback(null, address, family);
+        });
+    });
+}
+function isPrivateIpv4(host) {
+    const octets = host.split(".").map((part) => Number(part));
+    if (octets.length !== 4 || octets.some((part) => !Number.isInteger(part) || part < 0 || part > 255))
+        return true;
+    const [a, b] = octets;
+    if (a === 10 || a === 127 || a === 0)
+        return true;
+    if (a === 169 && b === 254)
+        return true;
+    if (a === 172 && b >= 16 && b <= 31)
+        return true;
+    if (a === 192 && b === 168)
+        return true;
+    if (a === 100 && b >= 64 && b <= 127)
+        return true;
+    if (a === 192 && b === 0)
+        return true;
+    if (a === 198 && (b === 18 || b === 19))
+        return true;
+    if (a >= 224)
+        return true;
+    return false;
+}
+function isPrivateIpv6(host) {
+    return host === "::"
+        || host === "::1"
+        || host.startsWith("fc")
+        || host.startsWith("fd")
+        || host.startsWith("fe80:")
+        || host.startsWith("2001:db8:");
+}
+function writeConfigFile(configPath, contents) {
+    writeFileSync(configPath, contents, { encoding: "utf-8", mode: 0o600 });
+    chmodSync(configPath, 0o600);
+}
+const GATEWAY_REQUEST_TIMEOUT_MS = 30_000;
+export function postJsonToValidatedGateway(url, payload, timeoutMs = GATEWAY_REQUEST_TIMEOUT_MS) {
+    validateGatewayNetworkTarget(url);
+    const body = JSON.stringify(payload);
+    const requestImpl = url.protocol === "https:" ? httpsRequest : httpRequest;
+    return new Promise((resolve, reject) => {
+        const req = requestImpl({
+            protocol: url.protocol,
+            hostname: url.hostname,
+            port: url.port,
+            path: `${url.pathname}${url.search}`,
+            method: "POST",
+            headers: {
+                "content-type": "application/json",
+                "content-length": Buffer.byteLength(body),
+            },
+            lookup: createGatewayLookup(url),
+        }, (res) => {
+            const statusCode = res.statusCode ?? 0;
+            const chunks = [];
+            res.on("data", (chunk) => chunks.push(Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk)));
+            res.on("end", () => {
+                const responseText = Buffer.concat(chunks).toString("utf-8");
+                const parsed = parseJsonObject(responseText);
+                if (statusCode < 200 || statusCode >= 300) {
+                    reject(new Error(typeof parsed.error === "string" ? parsed.error : `Pairing failed with HTTP ${statusCode}`));
+                    return;
+                }
+                resolve(parsed);
+            });
+        });
+        req.setTimeout(timeoutMs, () => {
+            req.destroy(new Error(`Gateway request timed out after ${timeoutMs}ms`));
+        });
+        req.on("error", reject);
+        req.end(body);
+    });
+}
+function parseJsonObject(value) {
+    try {
+        const parsed = JSON.parse(value);
+        return parsed && typeof parsed === "object" && !Array.isArray(parsed)
+            ? parsed
+            : {};
+    }
+    catch {
+        return {};
+    }
+}
+//# sourceMappingURL=cloud-config.js.map

package/packages/gsd-cloud/dist/cloud-config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cloud-config.js","sourceRoot":"","sources":["../src/cloud-config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAC5E,OAAO,EAAE,MAAM,EAAE,MAAM,UAAU,CAAC;AAElC,OAAO,EAAE,OAAO,IAAI,WAAW,EAAE,MAAM,WAAW,CAAC;AACnD,OAAO,EAAE,OAAO,IAAI,YAAY,EAAE,MAAM,YAAY,CAAC;AACrD,OAAO,EAAE,IAAI,EAAE,MAAM,UAAU,CAAC;AAEhC,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,KAAK,IAAI,SAAS,EAAE,SAAS,IAAI,aAAa,EAAE,MAAM,MAAM,CAAC;AACtE,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,uBAAuB,EAAE,MAAM,kBAAkB,CAAC;AAQ3D,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,MAIzC;IACC,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,mBAAmB,EAAE,oBAAoB,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC;IACzF,MAAM,IAAI,GAAG,MAAM,0BAA0B,CAAC,UAAU,EAAE;QACxD,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,WAAW,EAAE,MAAM,CAAC,WAAW;KAChC,CAAC,CAAC;IACH,IAAI,OAAO,IAAI,CAAC,SAAS,KAAK,QAAQ,IAAI,OAAO,IAAI,CAAC,WAAW,KAAK,QAAQ,EAAE,CAAC;QAC/E,MAAM,IAAI,KAAK,CAAC,4DAA4D,CAAC,CAAC;IAChF,CAAC;IACD,OAAO,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC;AACtE,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,KAAa;IAChD,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IACvB,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;IACvE,CAAC;IAED,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QAC1D,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;IAC9D,CAAC;IACD,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ,EAAE,CAAC;QACjC,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;IACpE,CAAC;IACD,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;IACnE,CAAC;IACD,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC9D,MAAM,IAAI,KAAK,CAAC,8DAA8D,CAAC,CAAC;IAClF,CAAC;IACD,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,eAAe,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC/D,MAAM,IAAI,KAAK,CAAC,oEAAoE,CAAC,CAAC;IACxF,CAAC;IAED,GAAG,CAAC,QAAQ,GAAG,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAChD,GAAG,CAAC,MAAM,GAAG,EAAE,CAAC;IAChB,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,UAAkB,EAAE,SAA6C;IAC/F,IAAI,GAAG,GAA4B,EAAE,CAAC;IACtC,IAAI,CAAC;QACH,GAAG,GAAG,SAAS,CAAC,YAAY,CAAC,UAAU,EAAE,OAAO,CAAC,CAA4B,IAAI,EAAE,CAAC;IACtF,CAAC;IAAC,MAAM,CAAC;QACP,GAAG,GAAG,EAAE,CAAC;IACX,CAAC;IACD,MAAM,EAAE,YAAY,EAAE,WAAW,EAAE,GAAG,KAAK,EAAE,GAAG,SAAS,CAAC;IAC1D,GAAG,CAAC,KAAK,GAAG;QACV,GAAG,KAAK;QACR,WAAW,EAAE,oBAAoB,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC,QAAQ,EAAE;QACnE,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,sBAAsB,EAAE,uBAAuB,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACzF,CAAC;IACF,SAAS,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACpD,eAAe,CAAC,UAAU,EAAE,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC;IAChD,OAAO,UAAU,CAAC,UAAU,CAAC,CAAC;AAChC,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,UAAkB;IACjD,IAAI,GAAG,GAA4B,EAAE,CAAC;IACtC,IAAI,CAAC;QACH,GAAG,GAAG,SAAS,CAAC,YAAY,CAAC,UAAU,EAAE,OAAO,CAAC,CAA4B,IAAI,EAAE,CAAC;IACtF,CAAC;IAAC,MAAM,CAAC;QACP,GAAG,GAAG,EAAE,CAAC;IACX,CAAC;IACD,OAAO,GAAG,CAAC,KAAK,CAAC;IACjB,SAAS,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACpD,eAAe,CAAC,UAAU,EAAE,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC;IAChD,OAAO,UAAU,CAAC,UAAU,CAAC,CAAC;AAChC,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,MAAoB;IACtD,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC;IAC3B,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC;IACzC,OAAO;QACL,UAAU,EAAE,IAAI;QAChB,OAAO,EAAE,KAAK,CAAC,OAAO,IAAI,IAAI;QAC9B,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,UAAU,EAAE,KAAK,CAAC,UAAU,IAAI,IAAI;QACpC,YAAY,EAAE,KAAK,CAAC,YAAY,IAAI,IAAI;QACxC,CAAC,SAAS,GAAG,OAAO,CAAC,EAAE,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI;KAChE,CAAC;AACJ,CAAC;AAED,SAAS,cAAc,CAAC,QAAgB;IACtC,MAAM,IAAI,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAC;IACpC,OAAO,IAAI,KAAK,WAAW,IAAI,IAAI,KAAK,WAAW,IAAI,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,OAAO,CAAC;AAC5F,CAAC;AAED,SAAS,eAAe,CAAC,QAAgB;IACvC,MAAM,IAAI,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;IAC5D,IAAI,IAAI,KAAK,WAAW;QAAE,OAAO,IAAI,CAAC;IACtC,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,aAAa,CAAC,IAAI,CAAC,CAAC;IACjD,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,aAAa,CAAC,IAAI,CAAC,CAAC;IACjD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,4BAA4B,CAAC,GAAQ;IACnD,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,cAAc,CAAC,GAAG,CAAC,QAAQ,CAAC;QAAE,OAAO;IACrE,IAAI,eAAe,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;QAClC,MAAM,IAAI,KAAK,CAAC,oEAAoE,CAAC,CAAC;IACxF,CAAC;AACH,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,GAAQ;IAC1C,MAAM,aAAa,GAAG,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,cAAc,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC/E,MAAM,QAAQ,GAAG,CAAC,OAAe,EAAW,EAAE,CAC5C,CAAC,OAAO,IAAI,CAAC,CAAC,aAAa,IAAI,eAAe,CAAC,OAAO,CAAC,CAAC,CAAC;IAC3D,6EAA6E;IAC7E,uEAAuE;IACvE,6EAA6E;IAC7E,4EAA4E;IAC5E,6EAA6E;IAC7E,+EAA+E;IAC/E,OAAO,CAAC,CAAC,QAAgB,EAAE,OAAgB,EAAE,QAAsC,EAAE,EAAE;QACrF,MAAM,QAAQ,GACZ,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,IAAI,IAAK,OAAyB,CAAC,GAAG,KAAK,IAAI,CAAC;QAC7F,MAAM,IAAI,GACR,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,GAAI,OAAyB,EAAE,CAAC;QACxF,IAAI,QAAQ,EAAE,CAAC;YACb,MAAM,CAAC,QAAQ,EAAE,EAAE,GAAG,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,CAAC,GAAG,EAAE,SAAS,EAAE,EAAE;gBAC1D,IAAI,GAAG;oBAAE,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC;gBAC9B,MAAM,IAAI,GAAG,SAAuD,CAAC;gBACrE,IAAI,CAAC,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;oBAClE,OAAO,QAAQ,CAAC,IAAI,KAAK,CAAC,6DAA6D,CAAC,CAAC,CAAC;gBAC5F,CAAC;gBACD,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;YACvB,CAAC,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QACD,MAAM,CAAC,QAAQ,EAAE,EAAE,GAAG,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE;YACjE,IAAI,GAAG;gBAAE,OAAO,QAAQ,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;YAC/C,IAAI,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;gBACtB,OAAO,QAAQ,CAAC,IAAI,KAAK,CAAC,6DAA6D,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;YAC7G,CAAC;YACD,QAAQ,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QAClC,CAAC,CAAC,CAAC;IACL,CAAC,CAA8B,CAAC;AAClC,CAAC;AAED,SAAS,aAAa,CAAC,IAAY;IACjC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;IAC3D,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI,IAAI,GAAG,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACjH,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,MAAM,CAAC;IACtB,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAClD,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG;QAAE,OAAO,IAAI,CAAC;IACxC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE;QAAE,OAAO,IAAI,CAAC;IACjD,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG;QAAE,OAAO,IAAI,CAAC;IACxC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,GAAG;QAAE,OAAO,IAAI,CAAC;IAClD,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACtC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC;QAAE,OAAO,IAAI,CAAC;IACrD,IAAI,CAAC,IAAI,GAAG;QAAE,OAAO,IAAI,CAAC;IAC1B,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,aAAa,CAAC,IAAY;IACjC,OAAO,IAAI,KAAK,IAAI;WACf,IAAI,KAAK,KAAK;WACd,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;WACrB,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;WACrB,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC;WACxB,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC;AACpC,CAAC;AAED,SAAS,eAAe,CAAC,UAAkB,EAAE,QAAgB;IAC3D,aAAa,CAAC,UAAU,EAAE,QAAQ,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACxE,SAAS,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;AAC/B,CAAC;AAED,MAAM,0BAA0B,GAAG,MAAM,CAAC;AAE1C,MAAM,UAAU,0BAA0B,CACxC,GAAQ,EACR,OAAgC,EAChC,YAAoB,0BAA0B;IAE9C,4BAA4B,CAAC,GAAG,CAAC,CAAC;IAClC,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;IACrC,MAAM,WAAW,GAAG,GAAG,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,WAAW,CAAC;IAE3E,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,GAAG,GAAG,WAAW,CAAC;YACtB,QAAQ,EAAE,GAAG,CAAC,QAAQ;YACtB,QAAQ,EAAE,GAAG,CAAC,QAAQ;YACtB,IAAI,EAAE,GAAG,CAAC,IAAI;YACd,IAAI,EAAE,GAAG,GAAG,CAAC,QAAQ,GAAG,GAAG,CAAC,MAAM,EAAE;YACpC,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,kBAAkB;gBAClC,gBAAgB,EAAE,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC;aAC1C;YACD,MAAM,EAAE,mBAAmB,CAAC,GAAG,CAAC;SACjC,EAAE,CAAC,GAAG,EAAE,EAAE;YACT,MAAM,UAAU,GAAG,GAAG,CAAC,UAAU,IAAI,CAAC,CAAC;YACvC,MAAM,MAAM,GAAa,EAAE,CAAC;YAC5B,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YAC5F,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE;gBACjB,MAAM,YAAY,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;gBAC7D,MAAM,MAAM,GAAG,eAAe,CAAC,YAAY,CAAC,CAAC;gBAC7C,IAAI,UAAU,GAAG,GAAG,IAAI,UAAU,IAAI,GAAG,EAAE,CAAC;oBAC1C,MAAM,CAAC,IAAI,KAAK,CAAC,OAAO,MAAM,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,4BAA4B,UAAU,EAAE,CAAC,CAAC,CAAC;oBAC9G,OAAO;gBACT,CAAC;gBACD,OAAO,CAAC,MAAM,CAAC,CAAC;YAClB,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QAEH,GAAG,CAAC,UAAU,CAAC,SAAS,EAAE,GAAG,EAAE;YAC7B,GAAG,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC,mCAAmC,SAAS,IAAI,CAAC,CAAC,CAAC;QAC3E,CAAC,CAAC,CAAC;QACH,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QACxB,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAChB,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,eAAe,CAAC,KAAa;IACpC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAY,CAAC;QAC5C,OAAO,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;YACnE,CAAC,CAAC,MAAiC;YACnC,CAAC,CAAC,EAAE,CAAC;IACT,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC","sourcesContent":["import { chmodSync, mkdirSync, readFileSync, writeFileSync } from \"node:fs\";\nimport { lookup } from \"node:dns\";\nimport type { LookupOptions } from \"node:dns\";\nimport { request as httpRequest } from \"node:http\";\nimport { request as httpsRequest } from \"node:https\";\nimport { isIP } from \"node:net\";\nimport type { LookupFunction } from \"node:net\";\nimport { dirname } from \"node:path\";\nimport { parse as parseYaml, stringify as stringifyYaml } from \"yaml\";\nimport { loadConfig } from \"./config.js\";\nimport { protectCloudDeviceToken } from \"./cloud-token.js\";\nimport type { DaemonConfig } from \"./types.js\";\n\nexport interface PairingExchangeResult {\n  runtimeId: string;\n  deviceToken: string;\n}\n\nexport async function exchangePairingCode(params: {\n  gatewayUrl: string;\n  code: string;\n  runtimeName?: string;\n}): Promise<PairingExchangeResult> {\n  const pairingUrl = new URL(\"/pairing/exchange\", parseCloudGatewayUrl(params.gatewayUrl));\n  const body = await postJsonToValidatedGateway(pairingUrl, {\n    code: params.code,\n    runtimeName: params.runtimeName,\n  });\n  if (typeof body.runtimeId !== \"string\" || typeof body.deviceToken !== \"string\") {\n    throw new Error(\"Pairing response did not include runtimeId and deviceToken\");\n  }\n  return { runtimeId: body.runtimeId, deviceToken: body.deviceToken };\n}\n\nexport function parseCloudGatewayUrl(value: string): URL {\n  let url: URL;\n  try {\n    url = new URL(value);\n  } catch {\n    throw new Error(\"Cloud gateway URL must be an absolute HTTP(S) URL\");\n  }\n\n  if (url.protocol !== \"https:\" && url.protocol !== \"http:\") {\n    throw new Error(\"Cloud gateway URL must use http or https\");\n  }\n  if (url.username || url.password) {\n    throw new Error(\"Cloud gateway URL must not include credentials\");\n  }\n  if (url.hash) {\n    throw new Error(\"Cloud gateway URL must not include a fragment\");\n  }\n  if (url.protocol === \"http:\" && !isLoopbackHost(url.hostname)) {\n    throw new Error(\"Plain HTTP cloud gateway URLs are only allowed for localhost\");\n  }\n  if (url.protocol === \"https:\" && isPrivateIpHost(url.hostname)) {\n    throw new Error(\"Cloud gateway URL must not target private or loopback IP addresses\");\n  }\n\n  url.pathname = url.pathname.replace(/\\/+$/, \"\");\n  url.search = \"\";\n  return url;\n}\n\nexport function saveCloudConfig(configPath: string, nextCloud: NonNullable<DaemonConfig[\"cloud\"]>): DaemonConfig {\n  let raw: Record<string, unknown> = {};\n  try {\n    raw = parseYaml(readFileSync(configPath, \"utf-8\")) as Record<string, unknown> ?? {};\n  } catch {\n    raw = {};\n  }\n  const { device_token: deviceToken, ...cloud } = nextCloud;\n  raw.cloud = {\n    ...cloud,\n    gateway_url: parseCloudGatewayUrl(nextCloud.gateway_url).toString(),\n    ...(deviceToken ? { device_token_encrypted: protectCloudDeviceToken(deviceToken) } : {}),\n  };\n  mkdirSync(dirname(configPath), { recursive: true });\n  writeConfigFile(configPath, stringifyYaml(raw));\n  return loadConfig(configPath);\n}\n\nexport function clearCloudConfig(configPath: string): DaemonConfig {\n  let raw: Record<string, unknown> = {};\n  try {\n    raw = parseYaml(readFileSync(configPath, \"utf-8\")) as Record<string, unknown> ?? {};\n  } catch {\n    raw = {};\n  }\n  delete raw.cloud;\n  mkdirSync(dirname(configPath), { recursive: true });\n  writeConfigFile(configPath, stringifyYaml(raw));\n  return loadConfig(configPath);\n}\n\nexport function redactedCloudStatus(config: DaemonConfig): Record<string, unknown> {\n  const cloud = config.cloud;\n  if (!cloud) return { configured: false };\n  return {\n    configured: true,\n    enabled: cloud.enabled ?? true,\n    gateway_url: cloud.gateway_url,\n    runtime_id: cloud.runtime_id ?? null,\n    runtime_name: cloud.runtime_name ?? null,\n    [\"device_\" + \"token\"]: cloud.device_token ? \"[redacted]\" : null,\n  };\n}\n\nfunction isLoopbackHost(hostname: string): boolean {\n  const host = hostname.toLowerCase();\n  return host === \"localhost\" || host === \"127.0.0.1\" || host === \"::1\" || host === \"[::1]\";\n}\n\nfunction isPrivateIpHost(hostname: string): boolean {\n  const host = hostname.toLowerCase().replace(/^\\[|\\]$/g, \"\");\n  if (host === \"localhost\") return true;\n  if (isIP(host) === 4) return isPrivateIpv4(host);\n  if (isIP(host) === 6) return isPrivateIpv6(host);\n  return false;\n}\n\nexport function validateGatewayNetworkTarget(url: URL): void {\n  if (url.protocol === \"http:\" && isLoopbackHost(url.hostname)) return;\n  if (isPrivateIpHost(url.hostname)) {\n    throw new Error(\"Cloud gateway URL must not target private or loopback IP addresses\");\n  }\n}\n\nexport function createGatewayLookup(url: URL): LookupFunction {\n  const allowLoopback = url.protocol === \"http:\" && isLoopbackHost(url.hostname);\n  const rejected = (address: string): boolean =>\n    !address || (!allowLoopback && isPrivateIpHost(address));\n  // Node's socket connect (autoSelectFamily / Happy Eyeballs, default-on since\n  // Node 20) calls a custom lookup with `all: true` and expects an ARRAY\n  // callback. Forcing `all: false` + a scalar callback made every real gateway\n  // request throw \"Invalid IP address: undefined\". Honor both forms; the SSRF\n  // guard is applied to every resolved address (reject the whole lookup if any\n  // is private/loopback — an attacker-controlled resolver must not slip one in).\n  return ((hostname: string, options: unknown, callback: (...args: unknown[]) => void) => {\n    const wantsAll =\n      typeof options === \"object\" && options !== null && (options as LookupOptions).all === true;\n    const base: LookupOptions =\n      typeof options === \"number\" ? { family: options } : { ...(options as LookupOptions) };\n    if (wantsAll) {\n      lookup(hostname, { ...base, all: true }, (err, addresses) => {\n        if (err) return callback(err);\n        const list = addresses as Array<{ address: string; family: number }>;\n        if (!list.length || list.some((entry) => rejected(entry.address))) {\n          return callback(new Error(\"Cloud gateway URL resolved to a private or loopback address\"));\n        }\n        callback(null, list);\n      });\n      return;\n    }\n    lookup(hostname, { ...base, all: false }, (err, address, family) => {\n      if (err) return callback(err, address, family);\n      if (rejected(address)) {\n        return callback(new Error(\"Cloud gateway URL resolved to a private or loopback address\"), address, family);\n      }\n      callback(null, address, family);\n    });\n  }) as unknown as LookupFunction;\n}\n\nfunction isPrivateIpv4(host: string): boolean {\n  const octets = host.split(\".\").map((part) => Number(part));\n  if (octets.length !== 4 || octets.some((part) => !Number.isInteger(part) || part < 0 || part > 255)) return true;\n  const [a, b] = octets;\n  if (a === 10 || a === 127 || a === 0) return true;\n  if (a === 169 && b === 254) return true;\n  if (a === 172 && b >= 16 && b <= 31) return true;\n  if (a === 192 && b === 168) return true;\n  if (a === 100 && b >= 64 && b <= 127) return true;\n  if (a === 192 && b === 0) return true;\n  if (a === 198 && (b === 18 || b === 19)) return true;\n  if (a >= 224) return true;\n  return false;\n}\n\nfunction isPrivateIpv6(host: string): boolean {\n  return host === \"::\"\n    || host === \"::1\"\n    || host.startsWith(\"fc\")\n    || host.startsWith(\"fd\")\n    || host.startsWith(\"fe80:\")\n    || host.startsWith(\"2001:db8:\");\n}\n\nfunction writeConfigFile(configPath: string, contents: string): void {\n  writeFileSync(configPath, contents, { encoding: \"utf-8\", mode: 0o600 });\n  chmodSync(configPath, 0o600);\n}\n\nconst GATEWAY_REQUEST_TIMEOUT_MS = 30_000;\n\nexport function postJsonToValidatedGateway(\n  url: URL,\n  payload: Record<string, unknown>,\n  timeoutMs: number = GATEWAY_REQUEST_TIMEOUT_MS,\n): Promise<Record<string, unknown>> {\n  validateGatewayNetworkTarget(url);\n  const body = JSON.stringify(payload);\n  const requestImpl = url.protocol === \"https:\" ? httpsRequest : httpRequest;\n\n  return new Promise((resolve, reject) => {\n    const req = requestImpl({\n      protocol: url.protocol,\n      hostname: url.hostname,\n      port: url.port,\n      path: `${url.pathname}${url.search}`,\n      method: \"POST\",\n      headers: {\n        \"content-type\": \"application/json\",\n        \"content-length\": Buffer.byteLength(body),\n      },\n      lookup: createGatewayLookup(url),\n    }, (res) => {\n      const statusCode = res.statusCode ?? 0;\n      const chunks: Buffer[] = [];\n      res.on(\"data\", (chunk) => chunks.push(Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk)));\n      res.on(\"end\", () => {\n        const responseText = Buffer.concat(chunks).toString(\"utf-8\");\n        const parsed = parseJsonObject(responseText);\n        if (statusCode < 200 || statusCode >= 300) {\n          reject(new Error(typeof parsed.error === \"string\" ? parsed.error : `Pairing failed with HTTP ${statusCode}`));\n          return;\n        }\n        resolve(parsed);\n      });\n    });\n\n    req.setTimeout(timeoutMs, () => {\n      req.destroy(new Error(`Gateway request timed out after ${timeoutMs}ms`));\n    });\n    req.on(\"error\", reject);\n    req.end(body);\n  });\n}\n\nfunction parseJsonObject(value: string): Record<string, unknown> {\n  try {\n    const parsed = JSON.parse(value) as unknown;\n    return parsed && typeof parsed === \"object\" && !Array.isArray(parsed)\n      ? parsed as Record<string, unknown>\n      : {};\n  } catch {\n    return {};\n  }\n}\n"]}

package/packages/gsd-cloud/dist/cloud-config.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=cloud-config.test.d.ts.map

package/packages/gsd-cloud/dist/cloud-config.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cloud-config.test.d.ts","sourceRoot":"","sources":["../src/cloud-config.test.ts"],"names":[],"mappings":""}

package/packages/gsd-cloud/dist/cloud-config.test.js

@@ -0,0 +1,118 @@
+// Project/App: Open GSD
+// File Purpose: Tests for the cloud gateway config module. Two independent suites:
+//   1. SSRF-guard matrix for parseCloudGatewayUrl / validateGatewayNetworkTarget —
+//      loosening any branch (plain-HTTP carve-out, private/loopback IP rejection,
+//      protocol/credential/fragment checks) turns a case red.
+//   2. postJsonToValidatedGateway's request timeout — a hung gateway must reject
+//      rather than hang the pairing/device flow.
+import { test } from "node:test";
+import assert from "node:assert/strict";
+import { createServer } from "node:http";
+import { parseCloudGatewayUrl, validateGatewayNetworkTarget, postJsonToValidatedGateway, } from "./cloud-config.js";
+// Each rejected case pairs an untrusted input with the substring the guard must
+// report — so a message change is deliberate, not accidental.
+const REJECTED = [
+    // Plain HTTP is only allowed for loopback hosts.
+    { input: "http://evil.example", message: /only allowed for localhost/ },
+    // RFC1918 private ranges over HTTPS.
+    { input: "https://10.0.0.1", message: /private or loopback/ },
+    { input: "https://192.168.1.1", message: /private or loopback/ },
+    { input: "https://172.16.0.1", message: /private or loopback/ },
+    // Link-local / cloud metadata endpoint.
+    { input: "https://169.254.169.254", message: /private or loopback/ },
+    // Loopback over HTTPS (IPv4 and IPv6 forms) and the localhost hostname.
+    { input: "https://127.0.0.1", message: /private or loopback/ },
+    { input: "https://[::1]", message: /private or loopback/ },
+    { input: "https://localhost", message: /private or loopback/ },
+    // Non-HTTP protocol.
+    { input: "ftp://gateway.example", message: /must use http or https/ },
+    // Embedded credentials / fragments are rejected outright.
+    { input: "https://user:pass@gateway.example", message: /must not include credentials/ },
+    { input: "https://gateway.example/#frag", message: /must not include a fragment/ },
+    // Unparseable / non-absolute inputs.
+    { input: "", message: /absolute HTTP\(S\) URL/ },
+    { input: "not a url", message: /absolute HTTP\(S\) URL/ },
+];
+for (const { input, message } of REJECTED) {
+    test(`parseCloudGatewayUrl rejects ${JSON.stringify(input)}`, () => {
+        assert.throws(() => parseCloudGatewayUrl(input), message);
+    });
+}
+// Accepted: a public HTTPS host and the documented local-dev plain-HTTP loopback carve-out.
+const ACCEPTED = [
+    { input: "https://cloud-gateway.opengsd.net", hostname: "cloud-gateway.opengsd.net", protocol: "https:" },
+    { input: "http://localhost:8787", hostname: "localhost", protocol: "http:" },
+    { input: "http://127.0.0.1:8787", hostname: "127.0.0.1", protocol: "http:" },
+];
+for (const { input, hostname, protocol } of ACCEPTED) {
+    test(`parseCloudGatewayUrl accepts ${JSON.stringify(input)}`, () => {
+        const url = parseCloudGatewayUrl(input);
+        assert.equal(url.hostname, hostname);
+        assert.equal(url.protocol, protocol);
+        // Round-trips to a usable absolute URL for the same host.
+        assert.equal(new URL(url.toString()).hostname, hostname);
+    });
+}
+// validateGatewayNetworkTarget is the request-time defense-in-depth guard applied to
+// already-constructed URLs (device code/token endpoints). Cover its branches directly.
+test("validateGatewayNetworkTarget rejects private/loopback targets", () => {
+    assert.throws(() => validateGatewayNetworkTarget(new URL("https://169.254.169.254")), /private or loopback/);
+    assert.throws(() => validateGatewayNetworkTarget(new URL("https://10.0.0.1")), /private or loopback/);
+    assert.throws(() => validateGatewayNetworkTarget(new URL("https://[::1]")), /private or loopback/);
+});
+test("validateGatewayNetworkTarget allows a public HTTPS host and http loopback", () => {
+    assert.doesNotThrow(() => validateGatewayNetworkTarget(new URL("https://cloud-gateway.opengsd.net")));
+    assert.doesNotThrow(() => validateGatewayNetworkTarget(new URL("http://localhost:8787")));
+    assert.doesNotThrow(() => validateGatewayNetworkTarget(new URL("http://127.0.0.1:8787")));
+});
+// Start a loopback server, returning its base URL; skips the test under sandbox EPERM.
+async function listenLoopback(t, handler) {
+    const server = createServer(handler);
+    try {
+        await new Promise((resolve, reject) => {
+            server.once("error", reject);
+            server.listen(0, "127.0.0.1", resolve);
+        });
+    }
+    catch (err) {
+        if (err.code === "EPERM") {
+            t.skip("loopback listen is blocked in this sandbox");
+            return null;
+        }
+        throw err;
+    }
+    const address = server.address();
+    assert.ok(address && typeof address === "object");
+    return {
+        baseUrl: `http://127.0.0.1:${address.port}`,
+        close: () => new Promise((resolve, reject) => server.close((err) => err ? reject(err) : resolve())),
+    };
+}
+test("postJsonToValidatedGateway rejects when the gateway never responds", async (t) => {
+    // Handler that accepts the request but never sends a response — the hung-server case.
+    const server = await listenLoopback(t, () => { });
+    if (!server)
+        return;
+    try {
+        await assert.rejects(postJsonToValidatedGateway(new URL(`${server.baseUrl}/x`), {}, 200), /timed out after 200ms/);
+    }
+    finally {
+        await server.close();
+    }
+});
+test("postJsonToValidatedGateway resolves a fast healthy response before the timeout", async (t) => {
+    const server = await listenLoopback(t, (_req, res) => {
+        res.writeHead(200, { "content-type": "application/json" });
+        res.end("{}");
+    });
+    if (!server)
+        return;
+    try {
+        const body = await postJsonToValidatedGateway(new URL(`${server.baseUrl}/x`), {}, 200);
+        assert.deepEqual(body, {});
+    }
+    finally {
+        await server.close();
+    }
+});
+//# sourceMappingURL=cloud-config.test.js.map

package/packages/gsd-cloud/dist/cloud-config.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cloud-config.test.js","sourceRoot":"","sources":["../src/cloud-config.test.ts"],"names":[],"mappings":"AAAA,wBAAwB;AACxB,mFAAmF;AACnF,mFAAmF;AACnF,kFAAkF;AAClF,8DAA8D;AAC9D,iFAAiF;AACjF,iDAAiD;AACjD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,MAAM,MAAM,oBAAoB,CAAC;AACxC,OAAO,EAAE,YAAY,EAAwB,MAAM,WAAW,CAAC;AAC/D,OAAO,EACL,oBAAoB,EACpB,4BAA4B,EAC5B,0BAA0B,GAC3B,MAAM,mBAAmB,CAAC;AAE3B,gFAAgF;AAChF,8DAA8D;AAC9D,MAAM,QAAQ,GAA8C;IAC1D,iDAAiD;IACjD,EAAE,KAAK,EAAE,qBAAqB,EAAE,OAAO,EAAE,4BAA4B,EAAE;IACvE,qCAAqC;IACrC,EAAE,KAAK,EAAE,kBAAkB,EAAE,OAAO,EAAE,qBAAqB,EAAE;IAC7D,EAAE,KAAK,EAAE,qBAAqB,EAAE,OAAO,EAAE,qBAAqB,EAAE;IAChE,EAAE,KAAK,EAAE,oBAAoB,EAAE,OAAO,EAAE,qBAAqB,EAAE;IAC/D,wCAAwC;IACxC,EAAE,KAAK,EAAE,yBAAyB,EAAE,OAAO,EAAE,qBAAqB,EAAE;IACpE,wEAAwE;IACxE,EAAE,KAAK,EAAE,mBAAmB,EAAE,OAAO,EAAE,qBAAqB,EAAE;IAC9D,EAAE,KAAK,EAAE,eAAe,EAAE,OAAO,EAAE,qBAAqB,EAAE;IAC1D,EAAE,KAAK,EAAE,mBAAmB,EAAE,OAAO,EAAE,qBAAqB,EAAE;IAC9D,qBAAqB;IACrB,EAAE,KAAK,EAAE,uBAAuB,EAAE,OAAO,EAAE,wBAAwB,EAAE;IACrE,0DAA0D;IAC1D,EAAE,KAAK,EAAE,mCAAmC,EAAE,OAAO,EAAE,8BAA8B,EAAE;IACvF,EAAE,KAAK,EAAE,+BAA+B,EAAE,OAAO,EAAE,6BAA6B,EAAE;IAClF,qCAAqC;IACrC,EAAE,KAAK,EAAE,EAAE,EAAE,OAAO,EAAE,wBAAwB,EAAE;IAChD,EAAE,KAAK,EAAE,WAAW,EAAE,OAAO,EAAE,wBAAwB,EAAE;CAC1D,CAAC;AAEF,KAAK,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,QAAQ,EAAE,CAAC;IAC1C,IAAI,CAAC,gCAAgC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,EAAE,GAAG,EAAE;QACjE,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,oBAAoB,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC,CAAC;IAC5D,CAAC,CAAC,CAAC;AACL,CAAC;AAED,4FAA4F;AAC5F,MAAM,QAAQ,GAAiE;IAC7E,EAAE,KAAK,EAAE,mCAAmC,EAAE,QAAQ,EAAE,2BAA2B,EAAE,QAAQ,EAAE,QAAQ,EAAE;IACzG,EAAE,KAAK,EAAE,uBAAuB,EAAE,QAAQ,EAAE,WAAW,EAAE,QAAQ,EAAE,OAAO,EAAE;IAC5E,EAAE,KAAK,EAAE,uBAAuB,EAAE,QAAQ,EAAE,WAAW,EAAE,QAAQ,EAAE,OAAO,EAAE;CAC7E,CAAC;AAEF,KAAK,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,QAAQ,EAAE,CAAC;IACrD,IAAI,CAAC,gCAAgC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,EAAE,GAAG,EAAE;QACjE,MAAM,GAAG,GAAG,oBAAoB,CAAC,KAAK,CAAC,CAAC;QACxC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;QACrC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;QACrC,0DAA0D;QAC1D,MAAM,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;IAC3D,CAAC,CAAC,CAAC;AACL,CAAC;AAED,qFAAqF;AACrF,uFAAuF;AACvF,IAAI,CAAC,+DAA+D,EAAE,GAAG,EAAE;IACzE,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,4BAA4B,CAAC,IAAI,GAAG,CAAC,yBAAyB,CAAC,CAAC,EAAE,qBAAqB,CAAC,CAAC;IAC7G,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,4BAA4B,CAAC,IAAI,GAAG,CAAC,kBAAkB,CAAC,CAAC,EAAE,qBAAqB,CAAC,CAAC;IACtG,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,4BAA4B,CAAC,IAAI,GAAG,CAAC,eAAe,CAAC,CAAC,EAAE,qBAAqB,CAAC,CAAC;AACrG,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,2EAA2E,EAAE,GAAG,EAAE;IACrF,MAAM,CAAC,YAAY,CAAC,GAAG,EAAE,CAAC,4BAA4B,CAAC,IAAI,GAAG,CAAC,mCAAmC,CAAC,CAAC,CAAC,CAAC;IACtG,MAAM,CAAC,YAAY,CAAC,GAAG,EAAE,CAAC,4BAA4B,CAAC,IAAI,GAAG,CAAC,uBAAuB,CAAC,CAAC,CAAC,CAAC;IAC1F,MAAM,CAAC,YAAY,CAAC,GAAG,EAAE,CAAC,4BAA4B,CAAC,IAAI,GAAG,CAAC,uBAAuB,CAAC,CAAC,CAAC,CAAC;AAC5F,CAAC,CAAC,CAAC;AAEH,uFAAuF;AACvF,KAAK,UAAU,cAAc,CAC3B,CAAkC,EAClC,OAAwB;IAExB,MAAM,MAAM,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC;IACrC,IAAI,CAAC;QACH,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YAC1C,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YAC7B,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC;QACzC,CAAC,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAK,GAA6B,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;YACpD,CAAC,CAAC,IAAI,CAAC,4CAA4C,CAAC,CAAC;YACrD,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC;IACjC,MAAM,CAAC,EAAE,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC;IAClD,OAAO;QACL,OAAO,EAAE,oBAAoB,OAAO,CAAC,IAAI,EAAE;QAC3C,KAAK,EAAE,GAAG,EAAE,CAAC,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;KAC1G,CAAC;AACJ,CAAC;AAED,IAAI,CAAC,oEAAoE,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;IACrF,sFAAsF;IACtF,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,CAAC,EAAE,GAAG,EAAE,GAA4B,CAAC,CAAC,CAAC;IAC3E,IAAI,CAAC,MAAM;QAAE,OAAO;IACpB,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,OAAO,CAClB,0BAA0B,CAAC,IAAI,GAAG,CAAC,GAAG,MAAM,CAAC,OAAO,IAAI,CAAC,EAAE,EAAE,EAAE,GAAG,CAAC,EACnE,uBAAuB,CACxB,CAAC;IACJ,CAAC;YAAS,CAAC;QACT,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;IACvB,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,gFAAgF,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;IACjG,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,CAAC,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;QACnD,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;QAC3D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAChB,CAAC,CAAC,CAAC;IACH,IAAI,CAAC,MAAM;QAAE,OAAO;IACpB,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,0BAA0B,CAAC,IAAI,GAAG,CAAC,GAAG,MAAM,CAAC,OAAO,IAAI,CAAC,EAAE,EAAE,EAAE,GAAG,CAAC,CAAC;QACvF,MAAM,CAAC,SAAS,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IAC7B,CAAC;YAAS,CAAC;QACT,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;IACvB,CAAC;AACH,CAAC,CAAC,CAAC","sourcesContent":["// Project/App: Open GSD\n// File Purpose: Tests for the cloud gateway config module. Two independent suites:\n//   1. SSRF-guard matrix for parseCloudGatewayUrl / validateGatewayNetworkTarget —\n//      loosening any branch (plain-HTTP carve-out, private/loopback IP rejection,\n//      protocol/credential/fragment checks) turns a case red.\n//   2. postJsonToValidatedGateway's request timeout — a hung gateway must reject\n//      rather than hang the pairing/device flow.\nimport { test } from \"node:test\";\nimport assert from \"node:assert/strict\";\nimport { createServer, type RequestListener } from \"node:http\";\nimport {\n  parseCloudGatewayUrl,\n  validateGatewayNetworkTarget,\n  postJsonToValidatedGateway,\n} from \"./cloud-config.js\";\n\n// Each rejected case pairs an untrusted input with the substring the guard must\n// report — so a message change is deliberate, not accidental.\nconst REJECTED: Array<{ input: string; message: RegExp }> = [\n  // Plain HTTP is only allowed for loopback hosts.\n  { input: \"http://evil.example\", message: /only allowed for localhost/ },\n  // RFC1918 private ranges over HTTPS.\n  { input: \"https://10.0.0.1\", message: /private or loopback/ },\n  { input: \"https://192.168.1.1\", message: /private or loopback/ },\n  { input: \"https://172.16.0.1\", message: /private or loopback/ },\n  // Link-local / cloud metadata endpoint.\n  { input: \"https://169.254.169.254\", message: /private or loopback/ },\n  // Loopback over HTTPS (IPv4 and IPv6 forms) and the localhost hostname.\n  { input: \"https://127.0.0.1\", message: /private or loopback/ },\n  { input: \"https://[::1]\", message: /private or loopback/ },\n  { input: \"https://localhost\", message: /private or loopback/ },\n  // Non-HTTP protocol.\n  { input: \"ftp://gateway.example\", message: /must use http or https/ },\n  // Embedded credentials / fragments are rejected outright.\n  { input: \"https://user:pass@gateway.example\", message: /must not include credentials/ },\n  { input: \"https://gateway.example/#frag\", message: /must not include a fragment/ },\n  // Unparseable / non-absolute inputs.\n  { input: \"\", message: /absolute HTTP\\(S\\) URL/ },\n  { input: \"not a url\", message: /absolute HTTP\\(S\\) URL/ },\n];\n\nfor (const { input, message } of REJECTED) {\n  test(`parseCloudGatewayUrl rejects ${JSON.stringify(input)}`, () => {\n    assert.throws(() => parseCloudGatewayUrl(input), message);\n  });\n}\n\n// Accepted: a public HTTPS host and the documented local-dev plain-HTTP loopback carve-out.\nconst ACCEPTED: Array<{ input: string; hostname: string; protocol: string }> = [\n  { input: \"https://cloud-gateway.opengsd.net\", hostname: \"cloud-gateway.opengsd.net\", protocol: \"https:\" },\n  { input: \"http://localhost:8787\", hostname: \"localhost\", protocol: \"http:\" },\n  { input: \"http://127.0.0.1:8787\", hostname: \"127.0.0.1\", protocol: \"http:\" },\n];\n\nfor (const { input, hostname, protocol } of ACCEPTED) {\n  test(`parseCloudGatewayUrl accepts ${JSON.stringify(input)}`, () => {\n    const url = parseCloudGatewayUrl(input);\n    assert.equal(url.hostname, hostname);\n    assert.equal(url.protocol, protocol);\n    // Round-trips to a usable absolute URL for the same host.\n    assert.equal(new URL(url.toString()).hostname, hostname);\n  });\n}\n\n// validateGatewayNetworkTarget is the request-time defense-in-depth guard applied to\n// already-constructed URLs (device code/token endpoints). Cover its branches directly.\ntest(\"validateGatewayNetworkTarget rejects private/loopback targets\", () => {\n  assert.throws(() => validateGatewayNetworkTarget(new URL(\"https://169.254.169.254\")), /private or loopback/);\n  assert.throws(() => validateGatewayNetworkTarget(new URL(\"https://10.0.0.1\")), /private or loopback/);\n  assert.throws(() => validateGatewayNetworkTarget(new URL(\"https://[::1]\")), /private or loopback/);\n});\n\ntest(\"validateGatewayNetworkTarget allows a public HTTPS host and http loopback\", () => {\n  assert.doesNotThrow(() => validateGatewayNetworkTarget(new URL(\"https://cloud-gateway.opengsd.net\")));\n  assert.doesNotThrow(() => validateGatewayNetworkTarget(new URL(\"http://localhost:8787\")));\n  assert.doesNotThrow(() => validateGatewayNetworkTarget(new URL(\"http://127.0.0.1:8787\")));\n});\n\n// Start a loopback server, returning its base URL; skips the test under sandbox EPERM.\nasync function listenLoopback(\n  t: { skip: (msg: string) => void },\n  handler: RequestListener,\n): Promise<{ baseUrl: string; close: () => Promise<void> } | null> {\n  const server = createServer(handler);\n  try {\n    await new Promise<void>((resolve, reject) => {\n      server.once(\"error\", reject);\n      server.listen(0, \"127.0.0.1\", resolve);\n    });\n  } catch (err) {\n    if ((err as NodeJS.ErrnoException).code === \"EPERM\") {\n      t.skip(\"loopback listen is blocked in this sandbox\");\n      return null;\n    }\n    throw err;\n  }\n  const address = server.address();\n  assert.ok(address && typeof address === \"object\");\n  return {\n    baseUrl: `http://127.0.0.1:${address.port}`,\n    close: () => new Promise<void>((resolve, reject) => server.close((err) => err ? reject(err) : resolve())),\n  };\n}\n\ntest(\"postJsonToValidatedGateway rejects when the gateway never responds\", async (t) => {\n  // Handler that accepts the request but never sends a response — the hung-server case.\n  const server = await listenLoopback(t, () => { /* never call res.end */ });\n  if (!server) return;\n  try {\n    await assert.rejects(\n      postJsonToValidatedGateway(new URL(`${server.baseUrl}/x`), {}, 200),\n      /timed out after 200ms/,\n    );\n  } finally {\n    await server.close();\n  }\n});\n\ntest(\"postJsonToValidatedGateway resolves a fast healthy response before the timeout\", async (t) => {\n  const server = await listenLoopback(t, (_req, res) => {\n    res.writeHead(200, { \"content-type\": \"application/json\" });\n    res.end(\"{}\");\n  });\n  if (!server) return;\n  try {\n    const body = await postJsonToValidatedGateway(new URL(`${server.baseUrl}/x`), {}, 200);\n    assert.deepEqual(body, {});\n  } finally {\n    await server.close();\n  }\n});\n"]}

package/packages/gsd-cloud/dist/cloud-gateway-lookup.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=cloud-gateway-lookup.test.d.ts.map

package/packages/gsd-cloud/dist/cloud-gateway-lookup.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cloud-gateway-lookup.test.d.ts","sourceRoot":"","sources":["../src/cloud-gateway-lookup.test.ts"],"names":[],"mappings":""}

package/packages/gsd-cloud/dist/cloud-gateway-lookup.test.js

@@ -0,0 +1,37 @@
+// Project/App: Open GSD
+// File Purpose: Regression tests for createGatewayLookup — the custom DNS lookup
+// must honor Node's `all: true` (autoSelectFamily/Happy Eyeballs) array form and
+// still enforce the SSRF guard on every resolved address.
+import { test } from "node:test";
+import assert from "node:assert/strict";
+import { createGatewayLookup } from "./cloud-config.js";
+// Invoke the lookup and capture (err, result) from its Node-style callback.
+function run(url, options) {
+    const lookup = createGatewayLookup(new URL(url));
+    return new Promise((resolve) => {
+        lookup("localhost", options, (...args) => resolve({ err: args[0] ?? null, result: args[1] }));
+    });
+}
+test("all:true resolves to an ARRAY for a http loopback URL (regression: was scalar → 'Invalid IP address')", async () => {
+    const { err, result } = await run("http://localhost", { all: true, family: 0 });
+    assert.equal(err, null, "loopback allowed for http URL");
+    assert.ok(Array.isArray(result), "all:true must call back with an array");
+    assert.ok(result.length > 0, "expected at least one address");
+    for (const entry of result) {
+        assert.equal(typeof entry.address, "string");
+        assert.ok(entry.family === 4 || entry.family === 6);
+    }
+});
+test("all:true REJECTS when a resolved address is private/loopback (SSRF guard, https URL)", async () => {
+    const { err } = await run("https://localhost", { all: true, family: 0 });
+    assert.ok(err instanceof Error, "expected rejection");
+    assert.match(err.message, /private or loopback/);
+});
+test("scalar (all:false) path still guards: https loopback rejected, http loopback allowed", async () => {
+    const rejected = await run("https://localhost", { all: false, family: 0 });
+    assert.ok(rejected.err instanceof Error, "https loopback rejected in scalar path");
+    const allowed = await run("http://localhost", { all: false, family: 0 });
+    assert.equal(allowed.err, null, "http loopback allowed in scalar path");
+    assert.equal(typeof allowed.result, "string", "scalar path returns a single address");
+});
+//# sourceMappingURL=cloud-gateway-lookup.test.js.map

package/packages/gsd-cloud/dist/cloud-gateway-lookup.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cloud-gateway-lookup.test.js","sourceRoot":"","sources":["../src/cloud-gateway-lookup.test.ts"],"names":[],"mappings":"AAAA,wBAAwB;AACxB,iFAAiF;AACjF,iFAAiF;AACjF,0DAA0D;AAC1D,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,MAAM,MAAM,oBAAoB,CAAC;AACxC,OAAO,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AAExD,4EAA4E;AAC5E,SAAS,GAAG,CAAC,GAAW,EAAE,OAAgB;IACxC,MAAM,MAAM,GAAG,mBAAmB,CAAC,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;IACjD,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC5B,MAAoF,CACnF,WAAW,EACX,OAAO,EACP,CAAC,GAAG,IAAe,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE,GAAG,EAAG,IAAI,CAAC,CAAC,CAAkB,IAAI,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAC7F,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAED,IAAI,CAAC,uGAAuG,EAAE,KAAK,IAAI,EAAE;IACvH,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,MAAM,GAAG,CAAC,kBAAkB,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC;IAChF,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,IAAI,EAAE,+BAA+B,CAAC,CAAC;IACzD,MAAM,CAAC,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,uCAAuC,CAAC,CAAC;IAC1E,MAAM,CAAC,EAAE,CAAE,MAAoB,CAAC,MAAM,GAAG,CAAC,EAAE,+BAA+B,CAAC,CAAC;IAC7E,KAAK,MAAM,KAAK,IAAI,MAAoD,EAAE,CAAC;QACzE,MAAM,CAAC,KAAK,CAAC,OAAO,KAAK,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QAC7C,MAAM,CAAC,EAAE,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC;IACtD,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,sFAAsF,EAAE,KAAK,IAAI,EAAE;IACtG,MAAM,EAAE,GAAG,EAAE,GAAG,MAAM,GAAG,CAAC,mBAAmB,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC;IACzE,MAAM,CAAC,EAAE,CAAC,GAAG,YAAY,KAAK,EAAE,oBAAoB,CAAC,CAAC;IACtD,MAAM,CAAC,KAAK,CAAC,GAAI,CAAC,OAAO,EAAE,qBAAqB,CAAC,CAAC;AACpD,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,sFAAsF,EAAE,KAAK,IAAI,EAAE;IACtG,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,mBAAmB,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC;IAC3E,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,GAAG,YAAY,KAAK,EAAE,wCAAwC,CAAC,CAAC;IACnF,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,kBAAkB,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC;IACzE,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,EAAE,IAAI,EAAE,sCAAsC,CAAC,CAAC;IACxE,MAAM,CAAC,KAAK,CAAC,OAAO,OAAO,CAAC,MAAM,EAAE,QAAQ,EAAE,sCAAsC,CAAC,CAAC;AACxF,CAAC,CAAC,CAAC","sourcesContent":["// Project/App: Open GSD\n// File Purpose: Regression tests for createGatewayLookup — the custom DNS lookup\n// must honor Node's `all: true` (autoSelectFamily/Happy Eyeballs) array form and\n// still enforce the SSRF guard on every resolved address.\nimport { test } from \"node:test\";\nimport assert from \"node:assert/strict\";\nimport { createGatewayLookup } from \"./cloud-config.js\";\n\n// Invoke the lookup and capture (err, result) from its Node-style callback.\nfunction run(url: string, options: unknown): Promise<{ err: Error | null; result: unknown }> {\n  const lookup = createGatewayLookup(new URL(url));\n  return new Promise((resolve) => {\n    (lookup as unknown as (h: string, o: unknown, cb: (...a: unknown[]) => void) => void)(\n      \"localhost\",\n      options,\n      (...args: unknown[]) => resolve({ err: (args[0] as Error | null) ?? null, result: args[1] }),\n    );\n  });\n}\n\ntest(\"all:true resolves to an ARRAY for a http loopback URL (regression: was scalar → 'Invalid IP address')\", async () => {\n  const { err, result } = await run(\"http://localhost\", { all: true, family: 0 });\n  assert.equal(err, null, \"loopback allowed for http URL\");\n  assert.ok(Array.isArray(result), \"all:true must call back with an array\");\n  assert.ok((result as unknown[]).length > 0, \"expected at least one address\");\n  for (const entry of result as Array<{ address: string; family: number }>) {\n    assert.equal(typeof entry.address, \"string\");\n    assert.ok(entry.family === 4 || entry.family === 6);\n  }\n});\n\ntest(\"all:true REJECTS when a resolved address is private/loopback (SSRF guard, https URL)\", async () => {\n  const { err } = await run(\"https://localhost\", { all: true, family: 0 });\n  assert.ok(err instanceof Error, \"expected rejection\");\n  assert.match(err!.message, /private or loopback/);\n});\n\ntest(\"scalar (all:false) path still guards: https loopback rejected, http loopback allowed\", async () => {\n  const rejected = await run(\"https://localhost\", { all: false, family: 0 });\n  assert.ok(rejected.err instanceof Error, \"https loopback rejected in scalar path\");\n  const allowed = await run(\"http://localhost\", { all: false, family: 0 });\n  assert.equal(allowed.err, null, \"http loopback allowed in scalar path\");\n  assert.equal(typeof allowed.result, \"string\", \"scalar path returns a single address\");\n});\n"]}

package/packages/gsd-cloud/dist/cloud-runtime.d.ts

@@ -0,0 +1,35 @@
+import type { Logger } from "./logger.js";
+import type { DaemonConfig } from "./types.js";
+import type { Executor } from "./executors/executor.js";
+export declare class CloudRuntime {
+    private readonly cloud;
+    private readonly executor;
+    private readonly logger;
+    private static readonly MAX_OUTBOX;
+    private static readonly RECONNECT_DELAY_MS;
+    private static readonly MAX_INITIAL_CONNECT_ATTEMPTS;
+    private static readonly INITIAL_CONNECT_HANDSHAKE_TIMEOUT_MS;
+    private socket;
+    private heartbeat;
+    private reconnect;
+    private readonly inFlight;
+    private outbox;
+    private stopped;
+    private firstConnectDeferred;
+    private initialConnectAttempts;
+    constructor(cloud: NonNullable<DaemonConfig["cloud"]>, executor: Executor, logger: Logger);
+    start(): Promise<void>;
+    stop(): void;
+    private connect;
+    private handleSocketOpen;
+    private handleSocketMessage;
+    private handleSocketClose;
+    private handleSocketError;
+    private advertiseProjects;
+    private handleMessage;
+    private cancelInFlight;
+    private resolveFirstConnect;
+    private rejectFirstConnect;
+    private send;
+}
+//# sourceMappingURL=cloud-runtime.d.ts.map

package/packages/gsd-cloud/dist/cloud-runtime.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cloud-runtime.d.ts","sourceRoot":"","sources":["../src/cloud-runtime.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAC/C,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,yBAAyB,CAAC;AAWxD,qBAAa,YAAY;IAoBrB,OAAO,CAAC,QAAQ,CAAC,KAAK;IACtB,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACzB,OAAO,CAAC,QAAQ,CAAC,MAAM;IArBzB,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAO;IACzC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,kBAAkB,CAAS;IAMnD,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,4BAA4B,CAAK;IACzD,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,oCAAoC,CAAU;IACtE,OAAO,CAAC,MAAM,CAAwB;IACtC,OAAO,CAAC,SAAS,CAA6C;IAC9D,OAAO,CAAC,SAAS,CAA4C;IAC7D,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAqC;IAC9D,OAAO,CAAC,MAAM,CAAgB;IAC9B,OAAO,CAAC,OAAO,CAAS;IACxB,OAAO,CAAC,oBAAoB,CAAyC;IACrE,OAAO,CAAC,sBAAsB,CAAK;gBAGhB,KAAK,EAAE,WAAW,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,EACzC,QAAQ,EAAE,QAAQ,EAClB,MAAM,EAAE,MAAM;IAGjC,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAQtB,IAAI,IAAI,IAAI;IAcZ,OAAO,CAAC,OAAO;IAkDf,OAAO,CAAC,gBAAgB;YAmBV,mBAAmB;IAKjC,OAAO,CAAC,iBAAiB;IA+BzB,OAAO,CAAC,iBAAiB;YAKX,iBAAiB;YAUjB,aAAa;YA6Bb,cAAc;IAqB5B,OAAO,CAAC,mBAAmB;IAO3B,OAAO,CAAC,kBAAkB;IAO1B,OAAO,CAAC,IAAI;CAcb"}