@opengsd/gsd-pi 1.8.1 → 1.9.0-dev.5c1a3ff2

package/packages/gsd-cloud/dist/config.js

@@ -0,0 +1,146 @@
+import { readFileSync, existsSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { resolve } from 'node:path';
+import { parse as parseYaml } from 'yaml';
+import { unprotectCloudDeviceToken } from './cloud-token.js';
+const VALID_LOG_LEVELS = new Set(['debug', 'info', 'warn', 'error']);
+/** Expand leading ~ to the user's home directory. */
+function expandTilde(p) {
+    if (p.startsWith('~/') || p === '~') {
+        return resolve(homedir(), p.slice(2) || '.');
+    }
+    return p;
+}
+/** Default config values when no file is present or fields are missing. */
+function defaults() {
+    return {
+        cloud: undefined,
+        discord: undefined,
+        projects: { scan_roots: [] },
+        log: {
+            file: resolve(homedir(), '.gsd', 'daemon.log'),
+            level: 'info',
+            max_size_mb: 50,
+        },
+    };
+}
+/**
+ * Resolve the config file path.
+ * Priority: explicit CLI arg → GSD_DAEMON_CONFIG env → ~/.gsd/daemon.yaml
+ */
+export function resolveConfigPath(cliPath) {
+    if (cliPath)
+        return expandTilde(cliPath);
+    const envPath = process.env['GSD_DAEMON_CONFIG'];
+    if (envPath)
+        return expandTilde(envPath);
+    return resolve(homedir(), '.gsd', 'daemon.yaml');
+}
+/**
+ * Validate and normalise a raw parsed object into a DaemonConfig.
+ * Missing/invalid fields are filled with defaults. Invalid log level falls back to 'info'.
+ */
+export function validateConfig(raw) {
+    const def = defaults();
+    if (raw == null || typeof raw !== 'object')
+        return def;
+    const obj = raw;
+    // --- cloud ---
+    let cloud = undefined;
+    if (obj['cloud'] != null && typeof obj['cloud'] === 'object') {
+        const c = obj['cloud'];
+        const encryptedDeviceToken = typeof c['device_token_encrypted'] === 'string'
+            ? unprotectCloudDeviceToken(c['device_token_encrypted'])
+            : undefined;
+        const deviceToken = typeof c['device_token'] === 'string' ? c['device_token'] : encryptedDeviceToken;
+        cloud = {
+            gateway_url: typeof c['gateway_url'] === 'string' ? c['gateway_url'] : '',
+            ...(deviceToken ? { device_token: deviceToken } : {}),
+            ...(typeof c['runtime_id'] === 'string' ? { runtime_id: c['runtime_id'] } : {}),
+            ...(typeof c['runtime_name'] === 'string' ? { runtime_name: c['runtime_name'] } : {}),
+            ...(typeof c['enabled'] === 'boolean' ? { enabled: c['enabled'] } : {}),
+        };
+    }
+    // --- discord ---
+    let discord = undefined;
+    if (obj['discord'] != null && typeof obj['discord'] === 'object') {
+        const d = obj['discord'];
+        discord = {
+            token: typeof d['token'] === 'string' ? d['token'] : '',
+            guild_id: typeof d['guild_id'] === 'string' ? d['guild_id'] : '',
+            owner_id: typeof d['owner_id'] === 'string' ? d['owner_id'] : '',
+            ...(typeof d['dm_on_blocker'] === 'boolean' ? { dm_on_blocker: d['dm_on_blocker'] } : {}),
+            ...(typeof d['control_channel_id'] === 'string' ? { control_channel_id: d['control_channel_id'] } : {}),
+        };
+        // Parse orchestrator sub-block
+        if (d['orchestrator'] != null && typeof d['orchestrator'] === 'object') {
+            const orc = d['orchestrator'];
+            discord.orchestrator = {
+                ...(typeof orc['model'] === 'string' ? { model: orc['model'] } : {}),
+                ...(typeof orc['max_tokens'] === 'number' && orc['max_tokens'] > 0 ? { max_tokens: orc['max_tokens'] } : {}),
+            };
+        }
+    }
+    // --- projects ---
+    let scanRoots = [];
+    if (obj['projects'] != null && typeof obj['projects'] === 'object') {
+        const p = obj['projects'];
+        if (Array.isArray(p['scan_roots'])) {
+            scanRoots = p['scan_roots']
+                .filter((s) => typeof s === 'string')
+                .map(expandTilde);
+        }
+    }
+    // --- log ---
+    let logFile = def.log.file;
+    let logLevel = def.log.level;
+    let maxSizeMb = def.log.max_size_mb;
+    if (obj['log'] != null && typeof obj['log'] === 'object') {
+        const l = obj['log'];
+        if (typeof l['file'] === 'string')
+            logFile = expandTilde(l['file']);
+        if (typeof l['level'] === 'string') {
+            logLevel = VALID_LOG_LEVELS.has(l['level']) ? l['level'] : 'info';
+        }
+        if (typeof l['max_size_mb'] === 'number' && l['max_size_mb'] > 0) {
+            maxSizeMb = l['max_size_mb'];
+        }
+    }
+    // --- env override: DISCORD_BOT_TOKEN ---
+    const envToken = process.env['DISCORD_BOT_TOKEN'];
+    if (envToken) {
+        if (!discord) {
+            discord = { token: envToken, guild_id: '', owner_id: '' };
+        }
+        else {
+            discord = { ...discord, token: envToken };
+        }
+    }
+    return {
+        cloud,
+        discord,
+        projects: { scan_roots: scanRoots },
+        log: { file: logFile, level: logLevel, max_size_mb: maxSizeMb },
+    };
+}
+/**
+ * Load and validate a DaemonConfig from a YAML file.
+ * If the file doesn't exist, returns defaults. If the file is malformed YAML, throws.
+ */
+export function loadConfig(configPath) {
+    if (!existsSync(configPath)) {
+        // Still apply env-var overrides even when file is missing
+        return validateConfig(null);
+    }
+    const raw = readFileSync(configPath, 'utf-8');
+    let parsed;
+    try {
+        parsed = parseYaml(raw);
+    }
+    catch (err) {
+        const msg = err instanceof Error ? err.message : String(err);
+        throw new Error(`Failed to parse YAML config at ${configPath}: ${msg}`);
+    }
+    return validateConfig(parsed);
+}
+//# sourceMappingURL=config.js.map

package/packages/gsd-cloud/dist/config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,KAAK,IAAI,SAAS,EAAE,MAAM,MAAM,CAAC;AAC1C,OAAO,EAAE,yBAAyB,EAAE,MAAM,kBAAkB,CAAC;AAG7D,MAAM,gBAAgB,GAAwB,IAAI,GAAG,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;AAE1F,qDAAqD;AACrD,SAAS,WAAW,CAAC,CAAS;IAC5B,IAAI,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;QACpC,OAAO,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC;IAC/C,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC;AAED,2EAA2E;AAC3E,SAAS,QAAQ;IACf,OAAO;QACL,KAAK,EAAE,SAAS;QAChB,OAAO,EAAE,SAAS;QAClB,QAAQ,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE;QAC5B,GAAG,EAAE;YACH,IAAI,EAAE,OAAO,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,YAAY,CAAC;YAC9C,KAAK,EAAE,MAAM;YACb,WAAW,EAAE,EAAE;SAChB;KACF,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,iBAAiB,CAAC,OAAgB;IAChD,IAAI,OAAO;QAAE,OAAO,WAAW,CAAC,OAAO,CAAC,CAAC;IACzC,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC;IACjD,IAAI,OAAO;QAAE,OAAO,WAAW,CAAC,OAAO,CAAC,CAAC;IACzC,OAAO,OAAO,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,aAAa,CAAC,CAAC;AACnD,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,cAAc,CAAC,GAAY;IACzC,MAAM,GAAG,GAAG,QAAQ,EAAE,CAAC;IAEvB,IAAI,GAAG,IAAI,IAAI,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,GAAG,CAAC;IACvD,MAAM,GAAG,GAAG,GAA8B,CAAC;IAE3C,gBAAgB;IAChB,IAAI,KAAK,GAA0B,SAAS,CAAC;IAC7C,IAAI,GAAG,CAAC,OAAO,CAAC,IAAI,IAAI,IAAI,OAAO,GAAG,CAAC,OAAO,CAAC,KAAK,QAAQ,EAAE,CAAC;QAC7D,MAAM,CAAC,GAAG,GAAG,CAAC,OAAO,CAA4B,CAAC;QAClD,MAAM,oBAAoB,GAAG,OAAO,CAAC,CAAC,wBAAwB,CAAC,KAAK,QAAQ;YAC1E,CAAC,CAAC,yBAAyB,CAAC,CAAC,CAAC,wBAAwB,CAAC,CAAC;YACxD,CAAC,CAAC,SAAS,CAAC;QACd,MAAM,WAAW,GAAG,OAAO,CAAC,CAAC,cAAc,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,oBAAoB,CAAC;QACrG,KAAK,GAAG;YACN,WAAW,EAAE,OAAO,CAAC,CAAC,aAAa,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,EAAE;YACzE,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACrD,GAAG,CAAC,OAAO,CAAC,CAAC,YAAY,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC/E,GAAG,CAAC,OAAO,CAAC,CAAC,cAAc,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,cAAc,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACrF,GAAG,CAAC,OAAO,CAAC,CAAC,SAAS,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACxE,CAAC;IACJ,CAAC;IAED,kBAAkB;IAClB,IAAI,OAAO,GAA4B,SAAS,CAAC;IACjD,IAAI,GAAG,CAAC,SAAS,CAAC,IAAI,IAAI,IAAI,OAAO,GAAG,CAAC,SAAS,CAAC,KAAK,QAAQ,EAAE,CAAC;QACjE,MAAM,CAAC,GAAG,GAAG,CAAC,SAAS,CAA4B,CAAC;QACpD,OAAO,GAAG;YACR,KAAK,EAAE,OAAO,CAAC,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE;YACvD,QAAQ,EAAE,OAAO,CAAC,CAAC,UAAU,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,EAAE;YAChE,QAAQ,EAAE,OAAO,CAAC,CAAC,UAAU,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,EAAE;YAChE,GAAG,CAAC,OAAO,CAAC,CAAC,eAAe,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC,eAAe,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACzF,GAAG,CAAC,OAAO,CAAC,CAAC,oBAAoB,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,kBAAkB,EAAE,CAAC,CAAC,oBAAoB,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACxG,CAAC;QAEF,+BAA+B;QAC/B,IAAI,CAAC,CAAC,cAAc,CAAC,IAAI,IAAI,IAAI,OAAO,CAAC,CAAC,cAAc,CAAC,KAAK,QAAQ,EAAE,CAAC;YACvE,MAAM,GAAG,GAAG,CAAC,CAAC,cAAc,CAA4B,CAAC;YACzD,OAAO,CAAC,YAAY,GAAG;gBACrB,GAAG,CAAC,OAAO,GAAG,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACpE,GAAG,CAAC,OAAO,GAAG,CAAC,YAAY,CAAC,KAAK,QAAQ,IAAI,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,GAAG,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC7G,CAAC;QACJ,CAAC;IACH,CAAC;IAED,mBAAmB;IACnB,IAAI,SAAS,GAAa,EAAE,CAAC;IAC7B,IAAI,GAAG,CAAC,UAAU,CAAC,IAAI,IAAI,IAAI,OAAO,GAAG,CAAC,UAAU,CAAC,KAAK,QAAQ,EAAE,CAAC;QACnE,MAAM,CAAC,GAAG,GAAG,CAAC,UAAU,CAA4B,CAAC;QACrD,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,EAAE,CAAC;YACnC,SAAS,GAAI,CAAC,CAAC,YAAY,CAAe;iBACvC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC;iBACjD,GAAG,CAAC,WAAW,CAAC,CAAC;QACtB,CAAC;IACH,CAAC;IAED,cAAc;IACd,IAAI,OAAO,GAAG,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC;IAC3B,IAAI,QAAQ,GAAa,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC;IACvC,IAAI,SAAS,GAAG,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC;IAEpC,IAAI,GAAG,CAAC,KAAK,CAAC,IAAI,IAAI,IAAI,OAAO,GAAG,CAAC,KAAK,CAAC,KAAK,QAAQ,EAAE,CAAC;QACzD,MAAM,CAAC,GAAG,GAAG,CAAC,KAAK,CAA4B,CAAC;QAChD,IAAI,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,QAAQ;YAAE,OAAO,GAAG,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;QACpE,IAAI,OAAO,CAAC,CAAC,OAAO,CAAC,KAAK,QAAQ,EAAE,CAAC;YACnC,QAAQ,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAE,CAAC,CAAC,OAAO,CAAc,CAAC,CAAC,CAAC,MAAM,CAAC;QAClF,CAAC;QACD,IAAI,OAAO,CAAC,CAAC,aAAa,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,aAAa,CAAC,GAAG,CAAC,EAAE,CAAC;YACjE,SAAS,GAAG,CAAC,CAAC,aAAa,CAAC,CAAC;QAC/B,CAAC;IACH,CAAC;IAED,0CAA0C;IAC1C,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC;IAClD,IAAI,QAAQ,EAAE,CAAC;QACb,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,GAAG,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;QAC5D,CAAC;aAAM,CAAC;YACN,OAAO,GAAG,EAAE,GAAG,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC;QAC5C,CAAC;IACH,CAAC;IAED,OAAO;QACL,KAAK;QACL,OAAO;QACP,QAAQ,EAAE,EAAE,UAAU,EAAE,SAAS,EAAE;QACnC,GAAG,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,WAAW,EAAE,SAAS,EAAE;KAChE,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,UAAU,CAAC,UAAkB;IAC3C,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QAC5B,0DAA0D;QAC1D,OAAO,cAAc,CAAC,IAAI,CAAC,CAAC;IAC9B,CAAC;IAED,MAAM,GAAG,GAAG,YAAY,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;IAC9C,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC;IAC1B,CAAC;IAAC,OAAO,GAAY,EAAE,CAAC;QACtB,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC7D,MAAM,IAAI,KAAK,CAAC,kCAAkC,UAAU,KAAK,GAAG,EAAE,CAAC,CAAC;IAC1E,CAAC;IAED,OAAO,cAAc,CAAC,MAAM,CAAC,CAAC;AAChC,CAAC","sourcesContent":["import { readFileSync, existsSync } from 'node:fs';\nimport { homedir } from 'node:os';\nimport { resolve } from 'node:path';\nimport { parse as parseYaml } from 'yaml';\nimport { unprotectCloudDeviceToken } from './cloud-token.js';\nimport type { DaemonConfig, LogLevel } from './types.js';\n\nconst VALID_LOG_LEVELS: ReadonlySet<string> = new Set(['debug', 'info', 'warn', 'error']);\n\n/** Expand leading ~ to the user's home directory. */\nfunction expandTilde(p: string): string {\n  if (p.startsWith('~/') || p === '~') {\n    return resolve(homedir(), p.slice(2) || '.');\n  }\n  return p;\n}\n\n/** Default config values when no file is present or fields are missing. */\nfunction defaults(): DaemonConfig {\n  return {\n    cloud: undefined,\n    discord: undefined,\n    projects: { scan_roots: [] },\n    log: {\n      file: resolve(homedir(), '.gsd', 'daemon.log'),\n      level: 'info',\n      max_size_mb: 50,\n    },\n  };\n}\n\n/**\n * Resolve the config file path.\n * Priority: explicit CLI arg → GSD_DAEMON_CONFIG env → ~/.gsd/daemon.yaml\n */\nexport function resolveConfigPath(cliPath?: string): string {\n  if (cliPath) return expandTilde(cliPath);\n  const envPath = process.env['GSD_DAEMON_CONFIG'];\n  if (envPath) return expandTilde(envPath);\n  return resolve(homedir(), '.gsd', 'daemon.yaml');\n}\n\n/**\n * Validate and normalise a raw parsed object into a DaemonConfig.\n * Missing/invalid fields are filled with defaults. Invalid log level falls back to 'info'.\n */\nexport function validateConfig(raw: unknown): DaemonConfig {\n  const def = defaults();\n\n  if (raw == null || typeof raw !== 'object') return def;\n  const obj = raw as Record<string, unknown>;\n\n  // --- cloud ---\n  let cloud: DaemonConfig['cloud'] = undefined;\n  if (obj['cloud'] != null && typeof obj['cloud'] === 'object') {\n    const c = obj['cloud'] as Record<string, unknown>;\n    const encryptedDeviceToken = typeof c['device_token_encrypted'] === 'string'\n      ? unprotectCloudDeviceToken(c['device_token_encrypted'])\n      : undefined;\n    const deviceToken = typeof c['device_token'] === 'string' ? c['device_token'] : encryptedDeviceToken;\n    cloud = {\n      gateway_url: typeof c['gateway_url'] === 'string' ? c['gateway_url'] : '',\n      ...(deviceToken ? { device_token: deviceToken } : {}),\n      ...(typeof c['runtime_id'] === 'string' ? { runtime_id: c['runtime_id'] } : {}),\n      ...(typeof c['runtime_name'] === 'string' ? { runtime_name: c['runtime_name'] } : {}),\n      ...(typeof c['enabled'] === 'boolean' ? { enabled: c['enabled'] } : {}),\n    };\n  }\n\n  // --- discord ---\n  let discord: DaemonConfig['discord'] = undefined;\n  if (obj['discord'] != null && typeof obj['discord'] === 'object') {\n    const d = obj['discord'] as Record<string, unknown>;\n    discord = {\n      token: typeof d['token'] === 'string' ? d['token'] : '',\n      guild_id: typeof d['guild_id'] === 'string' ? d['guild_id'] : '',\n      owner_id: typeof d['owner_id'] === 'string' ? d['owner_id'] : '',\n      ...(typeof d['dm_on_blocker'] === 'boolean' ? { dm_on_blocker: d['dm_on_blocker'] } : {}),\n      ...(typeof d['control_channel_id'] === 'string' ? { control_channel_id: d['control_channel_id'] } : {}),\n    };\n\n    // Parse orchestrator sub-block\n    if (d['orchestrator'] != null && typeof d['orchestrator'] === 'object') {\n      const orc = d['orchestrator'] as Record<string, unknown>;\n      discord.orchestrator = {\n        ...(typeof orc['model'] === 'string' ? { model: orc['model'] } : {}),\n        ...(typeof orc['max_tokens'] === 'number' && orc['max_tokens'] > 0 ? { max_tokens: orc['max_tokens'] } : {}),\n      };\n    }\n  }\n\n  // --- projects ---\n  let scanRoots: string[] = [];\n  if (obj['projects'] != null && typeof obj['projects'] === 'object') {\n    const p = obj['projects'] as Record<string, unknown>;\n    if (Array.isArray(p['scan_roots'])) {\n      scanRoots = (p['scan_roots'] as unknown[])\n        .filter((s): s is string => typeof s === 'string')\n        .map(expandTilde);\n    }\n  }\n\n  // --- log ---\n  let logFile = def.log.file;\n  let logLevel: LogLevel = def.log.level;\n  let maxSizeMb = def.log.max_size_mb;\n\n  if (obj['log'] != null && typeof obj['log'] === 'object') {\n    const l = obj['log'] as Record<string, unknown>;\n    if (typeof l['file'] === 'string') logFile = expandTilde(l['file']);\n    if (typeof l['level'] === 'string') {\n      logLevel = VALID_LOG_LEVELS.has(l['level']) ? (l['level'] as LogLevel) : 'info';\n    }\n    if (typeof l['max_size_mb'] === 'number' && l['max_size_mb'] > 0) {\n      maxSizeMb = l['max_size_mb'];\n    }\n  }\n\n  // --- env override: DISCORD_BOT_TOKEN ---\n  const envToken = process.env['DISCORD_BOT_TOKEN'];\n  if (envToken) {\n    if (!discord) {\n      discord = { token: envToken, guild_id: '', owner_id: '' };\n    } else {\n      discord = { ...discord, token: envToken };\n    }\n  }\n\n  return {\n    cloud,\n    discord,\n    projects: { scan_roots: scanRoots },\n    log: { file: logFile, level: logLevel, max_size_mb: maxSizeMb },\n  };\n}\n\n/**\n * Load and validate a DaemonConfig from a YAML file.\n * If the file doesn't exist, returns defaults. If the file is malformed YAML, throws.\n */\nexport function loadConfig(configPath: string): DaemonConfig {\n  if (!existsSync(configPath)) {\n    // Still apply env-var overrides even when file is missing\n    return validateConfig(null);\n  }\n\n  const raw = readFileSync(configPath, 'utf-8');\n  let parsed: unknown;\n  try {\n    parsed = parseYaml(raw);\n  } catch (err: unknown) {\n    const msg = err instanceof Error ? err.message : String(err);\n    throw new Error(`Failed to parse YAML config at ${configPath}: ${msg}`);\n  }\n\n  return validateConfig(parsed);\n}\n"]}

package/packages/gsd-cloud/dist/device-flow.d.ts

@@ -0,0 +1,24 @@
+export interface DeviceFlowResult {
+    deviceToken: string;
+    runtimeId: string;
+    /**
+     * Resolved relay/gateway URL: the server-returned `gateway_url` from the approved
+     * token-poll response when present AND valid, else the `gatewayUrl` the caller passed
+     * (D-02 backward-compat — existing single-host `--gateway` users are unaffected).
+     */
+    gatewayUrl: string;
+}
+export interface DeviceFlowParams {
+    gatewayUrl: string;
+    configPath: string;
+    runtimeName?: string;
+    binaryName: string;
+}
+/**
+ * Run the full RFC 8628 device authorization flow.
+ * Requests a device code, displays the verification URL and user code in the terminal,
+ * polls for approval with a spinner, and returns the device token on success.
+ * Calls process.exit(1) on denial (D-12) or timeout (D-11).
+ */
+export declare function runDeviceFlow(params: DeviceFlowParams): Promise<DeviceFlowResult>;
+//# sourceMappingURL=device-flow.d.ts.map

package/packages/gsd-cloud/dist/device-flow.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"device-flow.d.ts","sourceRoot":"","sources":["../src/device-flow.ts"],"names":[],"mappings":"AAUA,MAAM,WAAW,gBAAgB;IAC/B,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB;;;;OAIG;IACH,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,gBAAgB;IAC/B,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;CACpB;AAKD;;;;;GAKG;AACH,wBAAsB,aAAa,CAAC,MAAM,EAAE,gBAAgB,GAAG,OAAO,CAAC,gBAAgB,CAAC,CA+HvF"}

package/packages/gsd-cloud/dist/device-flow.js

@@ -0,0 +1,128 @@
+// Device flow handler: code request, terminal display, polling loop, config save.
+// Implements RFC 8628 device authorization grant for the `gsd-cloud login` command.
+import { hostname as osHostname } from "node:os";
+import { cursorTo, clearLine } from "node:readline";
+import { parseCloudGatewayUrl, postJsonToValidatedGateway, validateGatewayNetworkTarget } from "./cloud-config.js";
+const SPINNER_FRAMES = ["⠋", "⠙", "⠹", "⠸", "⠼", "⠴", "⠦", "⠧", "⠇", "⠏"];
+const DEFAULT_POLL_INTERVAL_MS = 5_000;
+const SLOW_DOWN_INCREMENT_MS = 5_000;
+/** Simple sleep helper. */
+const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
+/**
+ * Run the full RFC 8628 device authorization flow.
+ * Requests a device code, displays the verification URL and user code in the terminal,
+ * polls for approval with a spinner, and returns the device token on success.
+ * Calls process.exit(1) on denial (D-12) or timeout (D-11).
+ */
+export async function runDeviceFlow(params) {
+    const base = parseCloudGatewayUrl(params.gatewayUrl);
+    // ---- Step 1: Request device code (D-01, DEVF-01) ----
+    const codeUrl = new URL(base.pathname.replace(/\/+$/, "") + "/api/device/code", base);
+    const codeResponse = await postJsonToValidatedGateway(codeUrl, {
+        hostname: osHostname(),
+        os: process.platform,
+        ...(params.runtimeName !== undefined ? { runtimeName: params.runtimeName } : {}),
+    });
+    const userCode = typeof codeResponse["userCode"] === "string" ? codeResponse["userCode"] : "";
+    const deviceCode = typeof codeResponse["deviceCode"] === "string" ? codeResponse["deviceCode"] : "";
+    const verificationUriComplete = typeof codeResponse["verificationUriComplete"] === "string"
+        ? codeResponse["verificationUriComplete"]
+        : "";
+    const expiresIn = typeof codeResponse["expiresIn"] === "number" ? codeResponse["expiresIn"] : 600;
+    if (!userCode || !deviceCode) {
+        throw new Error("Device code response missing userCode or deviceCode");
+    }
+    // ---- Step 2: Display to user (D-02) ----
+    process.stdout.write(`\n${params.binaryName}: Cloud Login\n`);
+    process.stdout.write(`\nTo authorize this machine, open the following URL in your browser:\n`);
+    process.stdout.write(`\n  ${verificationUriComplete}\n`);
+    process.stdout.write(`\nOr visit the gateway and enter the code manually:\n`);
+    process.stdout.write(`\n  ${base.origin}\n`);
+    process.stdout.write(`\nYour code:  ${userCode}\n\n`);
+    // ---- Step 3: Polling loop (D-10, D-11, D-12) ----
+    const tokenUrl = new URL(base.pathname.replace(/\/+$/, "") + "/api/device/token", base);
+    const expiresAt = Date.now() + expiresIn * 1_000;
+    let pollIntervalMs = DEFAULT_POLL_INTERVAL_MS;
+    let spinnerIndex = 0;
+    const spinnerInterval = setInterval(() => {
+        const frame = SPINNER_FRAMES[spinnerIndex % SPINNER_FRAMES.length] ?? "⠋";
+        spinnerIndex++;
+        const remaining = Math.max(0, Math.ceil((expiresAt - Date.now()) / 1_000));
+        cursorTo(process.stdout, 0);
+        clearLine(process.stdout, 0);
+        process.stdout.write(`  ${frame} Waiting for approval... (expires in ${remaining}s)`);
+    }, 100);
+    try {
+        while (Date.now() < expiresAt) {
+            await sleep(pollIntervalMs);
+            if (Date.now() >= expiresAt)
+                break;
+            let tokenResponse;
+            try {
+                tokenResponse = await postJsonToValidatedGateway(tokenUrl, { deviceCode });
+            }
+            catch {
+                // Network errors during polling are transient — keep trying until expiry.
+                continue;
+            }
+            const status = typeof tokenResponse["status"] === "string" ? tokenResponse["status"] : "";
+            if (status === "approved") {
+                clearInterval(spinnerInterval);
+                cursorTo(process.stdout, 0);
+                clearLine(process.stdout, 0);
+                process.stdout.write(`${params.binaryName}: Authorization approved!\n`);
+                const deviceToken = typeof tokenResponse["token"] === "string" ? tokenResponse["token"] : "";
+                const runtimeId = typeof tokenResponse["runtimeId"] === "string" ? tokenResponse["runtimeId"] : "";
+                if (!deviceToken || !runtimeId) {
+                    throw new Error("Approval response missing token or runtimeId");
+                }
+                // Resolve the relay/gateway URL in exactly ONE place (D-02, D-03).
+                // Default to the caller-supplied gateway; if the server sent a valid
+                // `gateway_url`, use that instead. The server value is UNTRUSTED input —
+                // re-validate it through the same SSRF guards applied to `--gateway`.
+                let gatewayUrl = params.gatewayUrl;
+                const serverGatewayUrl = typeof tokenResponse["gateway_url"] === "string"
+                    ? tokenResponse["gateway_url"]
+                    : undefined;
+                if (serverGatewayUrl) {
+                    try {
+                        const parsed = parseCloudGatewayUrl(serverGatewayUrl);
+                        validateGatewayNetworkTarget(parsed);
+                        gatewayUrl = parsed.toString();
+                    }
+                    catch (err) {
+                        // Fail loud-but-non-fatal: a bad server-supplied relay URL must not
+                        // crash login. Warn and fall back to the configured `--gateway`.
+                        const reason = err instanceof Error ? err.message : String(err);
+                        process.stderr.write(`${params.binaryName}: ignoring invalid server-supplied relay URL (${reason}); using configured --gateway instead.\n`);
+                    }
+                }
+                return { deviceToken, runtimeId, gatewayUrl };
+            }
+            if (status === "denied") {
+                clearInterval(spinnerInterval);
+                cursorTo(process.stdout, 0);
+                clearLine(process.stdout, 0);
+                process.stdout.write(`${params.binaryName}: Device request denied by user.\n`);
+                process.exit(1);
+            }
+            if (status === "expired") {
+                break;
+            }
+            if (status === "slow_down") {
+                pollIntervalMs += SLOW_DOWN_INCREMENT_MS;
+                continue;
+            }
+            // status === "pending" or unknown — keep polling
+        }
+    }
+    finally {
+        clearInterval(spinnerInterval);
+    }
+    // Timeout path (D-11)
+    cursorTo(process.stdout, 0);
+    clearLine(process.stdout, 0);
+    process.stdout.write(`${params.binaryName}: Authorization request timed out. Please run login again.\n`);
+    process.exit(1);
+}
+//# sourceMappingURL=device-flow.js.map

package/packages/gsd-cloud/dist/device-flow.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"device-flow.js","sourceRoot":"","sources":["../src/device-flow.ts"],"names":[],"mappings":"AAAA,kFAAkF;AAClF,oFAAoF;AACpF,OAAO,EAAE,QAAQ,IAAI,UAAU,EAAE,MAAM,SAAS,CAAC;AACjD,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AACpD,OAAO,EAAE,oBAAoB,EAAE,0BAA0B,EAAE,4BAA4B,EAAE,MAAM,mBAAmB,CAAC;AAEnH,MAAM,cAAc,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;AAC1E,MAAM,wBAAwB,GAAG,KAAK,CAAC;AACvC,MAAM,sBAAsB,GAAG,KAAK,CAAC;AAoBrC,2BAA2B;AAC3B,MAAM,KAAK,GAAG,CAAC,EAAU,EAAiB,EAAE,CAAC,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;AAEnF;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,MAAwB;IAC1D,MAAM,IAAI,GAAG,oBAAoB,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;IAErD,wDAAwD;IACxD,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,GAAG,kBAAkB,EAAE,IAAI,CAAC,CAAC;IACtF,MAAM,YAAY,GAAG,MAAM,0BAA0B,CAAC,OAAO,EAAE;QAC7D,QAAQ,EAAE,UAAU,EAAE;QACtB,EAAE,EAAE,OAAO,CAAC,QAAQ;QACpB,GAAG,CAAC,MAAM,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACjF,CAAC,CAAC;IAEH,MAAM,QAAQ,GAAG,OAAO,YAAY,CAAC,UAAU,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,YAAY,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC9F,MAAM,UAAU,GAAG,OAAO,YAAY,CAAC,YAAY,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,YAAY,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACpG,MAAM,uBAAuB,GAAG,OAAO,YAAY,CAAC,yBAAyB,CAAC,KAAK,QAAQ;QACzF,CAAC,CAAC,YAAY,CAAC,yBAAyB,CAAC;QACzC,CAAC,CAAC,EAAE,CAAC;IACP,MAAM,SAAS,GAAG,OAAO,YAAY,CAAC,WAAW,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,YAAY,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;IAElG,IAAI,CAAC,QAAQ,IAAI,CAAC,UAAU,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;IACzE,CAAC;IAED,2CAA2C;IAC3C,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,MAAM,CAAC,UAAU,iBAAiB,CAAC,CAAC;IAC9D,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,wEAAwE,CAAC,CAAC;IAC/F,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,uBAAuB,IAAI,CAAC,CAAC;IACzD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,uDAAuD,CAAC,CAAC;IAC9E,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,IAAI,CAAC,MAAM,IAAI,CAAC,CAAC;IAC7C,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,iBAAiB,QAAQ,MAAM,CAAC,CAAC;IAEtD,oDAAoD;IACpD,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,GAAG,mBAAmB,EAAE,IAAI,CAAC,CAAC;IACxF,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,GAAG,KAAK,CAAC;IACjD,IAAI,cAAc,GAAG,wBAAwB,CAAC;IAC9C,IAAI,YAAY,GAAG,CAAC,CAAC;IAErB,MAAM,eAAe,GAAG,WAAW,CAAC,GAAG,EAAE;QACvC,MAAM,KAAK,GAAG,cAAc,CAAC,YAAY,GAAG,cAAc,CAAC,MAAM,CAAC,IAAI,GAAG,CAAC;QAC1E,YAAY,EAAE,CAAC;QACf,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC;QAC3E,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;QAC5B,SAAS,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;QAC7B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,KAAK,wCAAwC,SAAS,IAAI,CAAC,CAAC;IACxF,CAAC,EAAE,GAAG,CAAC,CAAC;IAER,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,EAAE,CAAC;YAC9B,MAAM,KAAK,CAAC,cAAc,CAAC,CAAC;YAE5B,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,SAAS;gBAAE,MAAM;YAEnC,IAAI,aAAsC,CAAC;YAC3C,IAAI,CAAC;gBACH,aAAa,GAAG,MAAM,0BAA0B,CAAC,QAAQ,EAAE,EAAE,UAAU,EAAE,CAAC,CAAC;YAC7E,CAAC;YAAC,MAAM,CAAC;gBACP,0EAA0E;gBAC1E,SAAS;YACX,CAAC;YAED,MAAM,MAAM,GAAG,OAAO,aAAa,CAAC,QAAQ,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAE1F,IAAI,MAAM,KAAK,UAAU,EAAE,CAAC;gBAC1B,aAAa,CAAC,eAAe,CAAC,CAAC;gBAC/B,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;gBAC5B,SAAS,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;gBAC7B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,MAAM,CAAC,UAAU,6BAA6B,CAAC,CAAC;gBAExE,MAAM,WAAW,GAAG,OAAO,aAAa,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC7F,MAAM,SAAS,GAAG,OAAO,aAAa,CAAC,WAAW,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,aAAa,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;gBACnG,IAAI,CAAC,WAAW,IAAI,CAAC,SAAS,EAAE,CAAC;oBAC/B,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;gBAClE,CAAC;gBAED,mEAAmE;gBACnE,qEAAqE;gBACrE,yEAAyE;gBACzE,sEAAsE;gBACtE,IAAI,UAAU,GAAG,MAAM,CAAC,UAAU,CAAC;gBACnC,MAAM,gBAAgB,GAAG,OAAO,aAAa,CAAC,aAAa,CAAC,KAAK,QAAQ;oBACvE,CAAC,CAAC,aAAa,CAAC,aAAa,CAAC;oBAC9B,CAAC,CAAC,SAAS,CAAC;gBACd,IAAI,gBAAgB,EAAE,CAAC;oBACrB,IAAI,CAAC;wBACH,MAAM,MAAM,GAAG,oBAAoB,CAAC,gBAAgB,CAAC,CAAC;wBACtD,4BAA4B,CAAC,MAAM,CAAC,CAAC;wBACrC,UAAU,GAAG,MAAM,CAAC,QAAQ,EAAE,CAAC;oBACjC,CAAC;oBAAC,OAAO,GAAG,EAAE,CAAC;wBACb,oEAAoE;wBACpE,iEAAiE;wBACjE,MAAM,MAAM,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;wBAChE,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,GAAG,MAAM,CAAC,UAAU,iDAAiD,MAAM,0CAA0C,CACtH,CAAC;oBACJ,CAAC;gBACH,CAAC;gBAED,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,UAAU,EAAE,CAAC;YAChD,CAAC;YAED,IAAI,MAAM,KAAK,QAAQ,EAAE,CAAC;gBACxB,aAAa,CAAC,eAAe,CAAC,CAAC;gBAC/B,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;gBAC5B,SAAS,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;gBAC7B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,MAAM,CAAC,UAAU,oCAAoC,CAAC,CAAC;gBAC/E,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAClB,CAAC;YAED,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;gBACzB,MAAM;YACR,CAAC;YAED,IAAI,MAAM,KAAK,WAAW,EAAE,CAAC;gBAC3B,cAAc,IAAI,sBAAsB,CAAC;gBACzC,SAAS;YACX,CAAC;YAED,iDAAiD;QACnD,CAAC;IACH,CAAC;YAAS,CAAC;QACT,aAAa,CAAC,eAAe,CAAC,CAAC;IACjC,CAAC;IAED,sBAAsB;IACtB,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IAC5B,SAAS,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IAC7B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,MAAM,CAAC,UAAU,8DAA8D,CAAC,CAAC;IACzG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC","sourcesContent":["// Device flow handler: code request, terminal display, polling loop, config save.\n// Implements RFC 8628 device authorization grant for the `gsd-cloud login` command.\nimport { hostname as osHostname } from \"node:os\";\nimport { cursorTo, clearLine } from \"node:readline\";\nimport { parseCloudGatewayUrl, postJsonToValidatedGateway, validateGatewayNetworkTarget } from \"./cloud-config.js\";\n\nconst SPINNER_FRAMES = [\"⠋\", \"⠙\", \"⠹\", \"⠸\", \"⠼\", \"⠴\", \"⠦\", \"⠧\", \"⠇\", \"⠏\"];\nconst DEFAULT_POLL_INTERVAL_MS = 5_000;\nconst SLOW_DOWN_INCREMENT_MS = 5_000;\n\nexport interface DeviceFlowResult {\n  deviceToken: string;\n  runtimeId: string;\n  /**\n   * Resolved relay/gateway URL: the server-returned `gateway_url` from the approved\n   * token-poll response when present AND valid, else the `gatewayUrl` the caller passed\n   * (D-02 backward-compat — existing single-host `--gateway` users are unaffected).\n   */\n  gatewayUrl: string;\n}\n\nexport interface DeviceFlowParams {\n  gatewayUrl: string;\n  configPath: string;\n  runtimeName?: string;\n  binaryName: string;\n}\n\n/** Simple sleep helper. */\nconst sleep = (ms: number): Promise<void> => new Promise((r) => setTimeout(r, ms));\n\n/**\n * Run the full RFC 8628 device authorization flow.\n * Requests a device code, displays the verification URL and user code in the terminal,\n * polls for approval with a spinner, and returns the device token on success.\n * Calls process.exit(1) on denial (D-12) or timeout (D-11).\n */\nexport async function runDeviceFlow(params: DeviceFlowParams): Promise<DeviceFlowResult> {\n  const base = parseCloudGatewayUrl(params.gatewayUrl);\n\n  // ---- Step 1: Request device code (D-01, DEVF-01) ----\n  const codeUrl = new URL(base.pathname.replace(/\\/+$/, \"\") + \"/api/device/code\", base);\n  const codeResponse = await postJsonToValidatedGateway(codeUrl, {\n    hostname: osHostname(),\n    os: process.platform,\n    ...(params.runtimeName !== undefined ? { runtimeName: params.runtimeName } : {}),\n  });\n\n  const userCode = typeof codeResponse[\"userCode\"] === \"string\" ? codeResponse[\"userCode\"] : \"\";\n  const deviceCode = typeof codeResponse[\"deviceCode\"] === \"string\" ? codeResponse[\"deviceCode\"] : \"\";\n  const verificationUriComplete = typeof codeResponse[\"verificationUriComplete\"] === \"string\"\n    ? codeResponse[\"verificationUriComplete\"]\n    : \"\";\n  const expiresIn = typeof codeResponse[\"expiresIn\"] === \"number\" ? codeResponse[\"expiresIn\"] : 600;\n\n  if (!userCode || !deviceCode) {\n    throw new Error(\"Device code response missing userCode or deviceCode\");\n  }\n\n  // ---- Step 2: Display to user (D-02) ----\n  process.stdout.write(`\\n${params.binaryName}: Cloud Login\\n`);\n  process.stdout.write(`\\nTo authorize this machine, open the following URL in your browser:\\n`);\n  process.stdout.write(`\\n  ${verificationUriComplete}\\n`);\n  process.stdout.write(`\\nOr visit the gateway and enter the code manually:\\n`);\n  process.stdout.write(`\\n  ${base.origin}\\n`);\n  process.stdout.write(`\\nYour code:  ${userCode}\\n\\n`);\n\n  // ---- Step 3: Polling loop (D-10, D-11, D-12) ----\n  const tokenUrl = new URL(base.pathname.replace(/\\/+$/, \"\") + \"/api/device/token\", base);\n  const expiresAt = Date.now() + expiresIn * 1_000;\n  let pollIntervalMs = DEFAULT_POLL_INTERVAL_MS;\n  let spinnerIndex = 0;\n\n  const spinnerInterval = setInterval(() => {\n    const frame = SPINNER_FRAMES[spinnerIndex % SPINNER_FRAMES.length] ?? \"⠋\";\n    spinnerIndex++;\n    const remaining = Math.max(0, Math.ceil((expiresAt - Date.now()) / 1_000));\n    cursorTo(process.stdout, 0);\n    clearLine(process.stdout, 0);\n    process.stdout.write(`  ${frame} Waiting for approval... (expires in ${remaining}s)`);\n  }, 100);\n\n  try {\n    while (Date.now() < expiresAt) {\n      await sleep(pollIntervalMs);\n\n      if (Date.now() >= expiresAt) break;\n\n      let tokenResponse: Record<string, unknown>;\n      try {\n        tokenResponse = await postJsonToValidatedGateway(tokenUrl, { deviceCode });\n      } catch {\n        // Network errors during polling are transient — keep trying until expiry.\n        continue;\n      }\n\n      const status = typeof tokenResponse[\"status\"] === \"string\" ? tokenResponse[\"status\"] : \"\";\n\n      if (status === \"approved\") {\n        clearInterval(spinnerInterval);\n        cursorTo(process.stdout, 0);\n        clearLine(process.stdout, 0);\n        process.stdout.write(`${params.binaryName}: Authorization approved!\\n`);\n\n        const deviceToken = typeof tokenResponse[\"token\"] === \"string\" ? tokenResponse[\"token\"] : \"\";\n        const runtimeId = typeof tokenResponse[\"runtimeId\"] === \"string\" ? tokenResponse[\"runtimeId\"] : \"\";\n        if (!deviceToken || !runtimeId) {\n          throw new Error(\"Approval response missing token or runtimeId\");\n        }\n\n        // Resolve the relay/gateway URL in exactly ONE place (D-02, D-03).\n        // Default to the caller-supplied gateway; if the server sent a valid\n        // `gateway_url`, use that instead. The server value is UNTRUSTED input —\n        // re-validate it through the same SSRF guards applied to `--gateway`.\n        let gatewayUrl = params.gatewayUrl;\n        const serverGatewayUrl = typeof tokenResponse[\"gateway_url\"] === \"string\"\n          ? tokenResponse[\"gateway_url\"]\n          : undefined;\n        if (serverGatewayUrl) {\n          try {\n            const parsed = parseCloudGatewayUrl(serverGatewayUrl);\n            validateGatewayNetworkTarget(parsed);\n            gatewayUrl = parsed.toString();\n          } catch (err) {\n            // Fail loud-but-non-fatal: a bad server-supplied relay URL must not\n            // crash login. Warn and fall back to the configured `--gateway`.\n            const reason = err instanceof Error ? err.message : String(err);\n            process.stderr.write(\n              `${params.binaryName}: ignoring invalid server-supplied relay URL (${reason}); using configured --gateway instead.\\n`,\n            );\n          }\n        }\n\n        return { deviceToken, runtimeId, gatewayUrl };\n      }\n\n      if (status === \"denied\") {\n        clearInterval(spinnerInterval);\n        cursorTo(process.stdout, 0);\n        clearLine(process.stdout, 0);\n        process.stdout.write(`${params.binaryName}: Device request denied by user.\\n`);\n        process.exit(1);\n      }\n\n      if (status === \"expired\") {\n        break;\n      }\n\n      if (status === \"slow_down\") {\n        pollIntervalMs += SLOW_DOWN_INCREMENT_MS;\n        continue;\n      }\n\n      // status === \"pending\" or unknown — keep polling\n    }\n  } finally {\n    clearInterval(spinnerInterval);\n  }\n\n  // Timeout path (D-11)\n  cursorTo(process.stdout, 0);\n  clearLine(process.stdout, 0);\n  process.stdout.write(`${params.binaryName}: Authorization request timed out. Please run login again.\\n`);\n  process.exit(1);\n}\n"]}

package/packages/gsd-cloud/dist/device-flow.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=device-flow.test.d.ts.map

package/packages/gsd-cloud/dist/device-flow.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"device-flow.test.d.ts","sourceRoot":"","sources":["../src/device-flow.test.ts"],"names":[],"mappings":""}

package/packages/gsd-cloud/dist/device-flow.test.js

@@ -0,0 +1,155 @@
+// Project/App: Open GSD
+// File Purpose: Drive runDeviceFlow against a loopback HTTP server to cover the RFC 8628
+// poll state machine (pending→approved), the missing-token guard, and re-validation of the
+// UNTRUSTED server-supplied gateway_url (valid wins / invalid falls back without crashing).
+//
+// The denied and expired paths are intentionally NOT tested here: runDeviceFlow calls
+// process.exit(1) on both (D-11/D-12), which an in-process node:test cannot survive.
+import { test } from "node:test";
+import assert from "node:assert/strict";
+import { createServer } from "node:http";
+import { runDeviceFlow } from "./device-flow.js";
+import { parseCloudGatewayUrl } from "./cloud-config.js";
+// runDeviceFlow requires a configPath but never reads it (saving is the caller's job),
+// so a constant avoids pointless per-test tmp-dir I/O.
+const CONFIG_PATH = "unused-by-runDeviceFlow.yaml";
+/**
+ * Stand up a loopback HTTP server implementing both device-flow endpoints. Counts token
+ * POSTs so the poll loop's progression can be asserted; `tokenResponder` shapes each reply.
+ */
+function startDeviceServer(tokenResponder) {
+    let tokenCalls = 0;
+    const server = createServer((req, res) => {
+        req.setEncoding("utf8");
+        req.on("data", () => { });
+        req.on("end", () => {
+            if (req.url === "/api/device/code") {
+                res.writeHead(200, { "content-type": "application/json" });
+                res.end(JSON.stringify({
+                    userCode: "ABCD-1234",
+                    deviceCode: "device-code-fixture",
+                    verificationUriComplete: "https://example.test/verify",
+                    // Short-lived so the timeout path is bounded if a test ever fails to approve.
+                    expiresIn: 30,
+                }));
+                return;
+            }
+            if (req.url === "/api/device/token") {
+                tokenCalls += 1;
+                res.writeHead(200, { "content-type": "application/json" });
+                res.end(JSON.stringify(tokenResponder(tokenCalls)));
+                return;
+            }
+            res.writeHead(404, { "content-type": "application/json" });
+            res.end(JSON.stringify({ error: "not found" }));
+        });
+    });
+    return new Promise((resolve, reject) => {
+        server.once("error", reject);
+        server.listen(0, "127.0.0.1", () => {
+            const address = server.address();
+            if (!address || typeof address !== "object") {
+                reject(new Error("failed to bind loopback test server"));
+                return;
+            }
+            resolve({ server, baseUrl: `http://127.0.0.1:${address.port}`, tokenCalls: () => tokenCalls });
+        });
+    });
+}
+function closeServer(server) {
+    return new Promise((resolve, reject) => server.close((err) => (err ? reject(err) : resolve())));
+}
+/** Silence spinner stdout noise and capture stderr so the invalid-URL warning can be asserted. */
+function silenceOutput() {
+    const originalOut = process.stdout.write.bind(process.stdout);
+    const originalErr = process.stderr.write.bind(process.stderr);
+    let capturedErr = "";
+    process.stdout.write = (() => true);
+    process.stderr.write = ((chunk) => {
+        capturedErr += typeof chunk === "string" ? chunk : String(chunk);
+        return true;
+    });
+    return {
+        restore: () => {
+            process.stdout.write = originalOut;
+            process.stderr.write = originalErr;
+        },
+        stderr: () => capturedErr,
+    };
+}
+/** Run the flow against a server, always silencing output and closing the server. */
+async function drive(tokenResponder, assertResult, t) {
+    let started;
+    try {
+        started = await startDeviceServer(tokenResponder);
+    }
+    catch (err) {
+        if (err.code === "EPERM") {
+            t.skip("loopback listen is blocked in this sandbox");
+            return;
+        }
+        throw err;
+    }
+    const out = silenceOutput();
+    try {
+        const result = await runDeviceFlow({
+            gatewayUrl: started.baseUrl,
+            configPath: CONFIG_PATH,
+            binaryName: "gsd",
+        });
+        out.restore();
+        assertResult(result, { baseUrl: started.baseUrl, tokenCalls: started.tokenCalls, stderr: out.stderr() });
+    }
+    finally {
+        out.restore();
+        await closeServer(started.server);
+    }
+}
+test("immediate approval resolves with token, runtimeId, and the passed --gateway", async (t) => {
+    await drive(() => ({ status: "approved", token: "tok", runtimeId: "rt" }), (result, ctx) => {
+        assert.equal(result.deviceToken, "tok");
+        assert.equal(result.runtimeId, "rt");
+        assert.equal(result.gatewayUrl, ctx.baseUrl);
+    }, t);
+});
+test("pending then approved keeps polling until approval", async (t) => {
+    await drive((call) => (call < 2 ? { status: "pending" } : { status: "approved", token: "tok", runtimeId: "rt" }), (result, ctx) => {
+        assert.equal(result.deviceToken, "tok");
+        assert.ok(ctx.tokenCalls() >= 2, `expected >=2 token polls, saw ${ctx.tokenCalls()}`);
+    }, t);
+});
+test("a VALID server-supplied gateway_url wins over the passed --gateway", async (t) => {
+    const serverGateway = "https://relay.opengsd.net";
+    await drive(() => ({ status: "approved", token: "tok", runtimeId: "rt", gateway_url: serverGateway }), (result) => {
+        // Mirror the code's own resolution: parse + toString normalization.
+        assert.equal(result.gatewayUrl, parseCloudGatewayUrl(serverGateway).toString());
+    }, t);
+});
+test("an INVALID server-supplied gateway_url falls back to --gateway without throwing", async (t) => {
+    await drive(() => ({ status: "approved", token: "tok", runtimeId: "rt", gateway_url: "https://169.254.169.254" }), (result, ctx) => {
+        assert.equal(result.gatewayUrl, ctx.baseUrl);
+        assert.match(ctx.stderr, /ignoring invalid server-supplied relay URL/);
+    }, t);
+});
+test("approval missing token/runtimeId rejects", async (t) => {
+    let started;
+    try {
+        started = await startDeviceServer(() => ({ status: "approved", runtimeId: "rt" }));
+    }
+    catch (err) {
+        if (err.code === "EPERM") {
+            t.skip("loopback listen is blocked in this sandbox");
+            return;
+        }
+        throw err;
+    }
+    const out = silenceOutput();
+    try {
+        await assert.rejects(runDeviceFlow({ gatewayUrl: started.baseUrl, configPath: CONFIG_PATH, binaryName: "gsd" }), /missing token or runtimeId/);
+    }
+    finally {
+        out.restore();
+        await closeServer(started.server);
+    }
+});
+//# sourceMappingURL=device-flow.test.js.map

package/packages/gsd-cloud/dist/device-flow.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"device-flow.test.js","sourceRoot":"","sources":["../src/device-flow.test.ts"],"names":[],"mappings":"AAAA,wBAAwB;AACxB,yFAAyF;AACzF,2FAA2F;AAC3F,4FAA4F;AAC5F,EAAE;AACF,sFAAsF;AACtF,qFAAqF;AACrF,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,MAAM,MAAM,oBAAoB,CAAC;AACxC,OAAO,EAAE,YAAY,EAAe,MAAM,WAAW,CAAC;AACtD,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACjD,OAAO,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AAEzD,uFAAuF;AACvF,uDAAuD;AACvD,MAAM,WAAW,GAAG,8BAA8B,CAAC;AAKnD;;;GAGG;AACH,SAAS,iBAAiB,CAAC,cAA8B;IACvD,IAAI,UAAU,GAAG,CAAC,CAAC;IACnB,MAAM,MAAM,GAAG,YAAY,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;QACvC,GAAG,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;QACxB,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,GAAG,EAAE,GAAiD,CAAC,CAAC,CAAC;QACxE,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE;YACjB,IAAI,GAAG,CAAC,GAAG,KAAK,kBAAkB,EAAE,CAAC;gBACnC,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;gBAC3D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC;oBACrB,QAAQ,EAAE,WAAW;oBACrB,UAAU,EAAE,qBAAqB;oBACjC,uBAAuB,EAAE,6BAA6B;oBACtD,8EAA8E;oBAC9E,SAAS,EAAE,EAAE;iBACd,CAAC,CAAC,CAAC;gBACJ,OAAO;YACT,CAAC;YACD,IAAI,GAAG,CAAC,GAAG,KAAK,mBAAmB,EAAE,CAAC;gBACpC,UAAU,IAAI,CAAC,CAAC;gBAChB,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;gBAC3D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,cAAc,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;gBACpD,OAAO;YACT,CAAC;YACD,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;YAC3D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC;QAClD,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC7B,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,WAAW,EAAE,GAAG,EAAE;YACjC,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC;YACjC,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;gBAC5C,MAAM,CAAC,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC,CAAC;gBACzD,OAAO;YACT,CAAC;YACD,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,oBAAoB,OAAO,CAAC,IAAI,EAAE,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,UAAU,EAAE,CAAC,CAAC;QACjG,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,WAAW,CAAC,MAAc;IACjC,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC;AAClG,CAAC;AAED,kGAAkG;AAClG,SAAS,aAAa;IACpB,MAAM,WAAW,GAAG,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAC9D,MAAM,WAAW,GAAG,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAC9D,IAAI,WAAW,GAAG,EAAE,CAAC;IACpB,OAAO,CAAC,MAA4D,CAAC,KAAK,GAAG,CAAC,GAAG,EAAE,CAAC,IAAI,CAAgC,CAAC;IACzH,OAAO,CAAC,MAA4D,CAAC,KAAK,GAAG,CAAC,CAAC,KAAc,EAAE,EAAE;QAChG,WAAW,IAAI,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACjE,OAAO,IAAI,CAAC;IACd,CAAC,CAAgC,CAAC;IAClC,OAAO;QACL,OAAO,EAAE,GAAG,EAAE;YACX,OAAO,CAAC,MAA4D,CAAC,KAAK,GAAG,WAAW,CAAC;YACzF,OAAO,CAAC,MAA4D,CAAC,KAAK,GAAG,WAAW,CAAC;QAC5F,CAAC;QACD,MAAM,EAAE,GAAG,EAAE,CAAC,WAAW;KAC1B,CAAC;AACJ,CAAC;AAED,qFAAqF;AACrF,KAAK,UAAU,KAAK,CAClB,cAA8B,EAC9B,YAA6I,EAC7I,CAAkC;IAElC,IAAI,OAAsE,CAAC;IAC3E,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,iBAAiB,CAAC,cAAc,CAAC,CAAC;IACpD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAK,GAA6B,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;YACpD,CAAC,CAAC,IAAI,CAAC,4CAA4C,CAAC,CAAC;YACrD,OAAO;QACT,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;IACD,MAAM,GAAG,GAAG,aAAa,EAAE,CAAC;IAC5B,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC;YACjC,UAAU,EAAE,OAAO,CAAC,OAAO;YAC3B,UAAU,EAAE,WAAW;YACvB,UAAU,EAAE,KAAK;SAClB,CAAC,CAAC;QACH,GAAG,CAAC,OAAO,EAAE,CAAC;QACd,YAAY,CAAC,MAAM,EAAE,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAC3G,CAAC;YAAS,CAAC;QACT,GAAG,CAAC,OAAO,EAAE,CAAC;QACd,MAAM,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACpC,CAAC;AACH,CAAC;AAED,IAAI,CAAC,6EAA6E,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;IAC9F,MAAM,KAAK,CACT,GAAG,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,EAC7D,CAAC,MAAM,EAAE,GAAG,EAAE,EAAE;QACd,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC;QACxC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;QACrC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,UAAU,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;IAC/C,CAAC,EACD,CAAC,CACF,CAAC;AACJ,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,oDAAoD,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;IACrE,MAAM,KAAK,CACT,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,EACpG,CAAC,MAAM,EAAE,GAAG,EAAE,EAAE;QACd,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC;QACxC,MAAM,CAAC,EAAE,CAAC,GAAG,CAAC,UAAU,EAAE,IAAI,CAAC,EAAE,iCAAiC,GAAG,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;IACxF,CAAC,EACD,CAAC,CACF,CAAC;AACJ,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,oEAAoE,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;IACrF,MAAM,aAAa,GAAG,2BAA2B,CAAC;IAClD,MAAM,KAAK,CACT,GAAG,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,WAAW,EAAE,aAAa,EAAE,CAAC,EACzF,CAAC,MAAM,EAAE,EAAE;QACT,oEAAoE;QACpE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,UAAU,EAAE,oBAAoB,CAAC,aAAa,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC;IAClF,CAAC,EACD,CAAC,CACF,CAAC;AACJ,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,iFAAiF,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;IAClG,MAAM,KAAK,CACT,GAAG,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,WAAW,EAAE,yBAAyB,EAAE,CAAC,EACrG,CAAC,MAAM,EAAE,GAAG,EAAE,EAAE;QACd,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,UAAU,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;QAC7C,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,EAAE,4CAA4C,CAAC,CAAC;IACzE,CAAC,EACD,CAAC,CACF,CAAC;AACJ,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,0CAA0C,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;IAC3D,IAAI,OAAsE,CAAC;IAC3E,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,iBAAiB,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;IACrF,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAK,GAA6B,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;YACpD,CAAC,CAAC,IAAI,CAAC,4CAA4C,CAAC,CAAC;YACrD,OAAO;QACT,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;IACD,MAAM,GAAG,GAAG,aAAa,EAAE,CAAC;IAC5B,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,OAAO,CAClB,aAAa,CAAC,EAAE,UAAU,EAAE,OAAO,CAAC,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC,EAC1F,4BAA4B,CAC7B,CAAC;IACJ,CAAC;YAAS,CAAC;QACT,GAAG,CAAC,OAAO,EAAE,CAAC;QACd,MAAM,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACpC,CAAC;AACH,CAAC,CAAC,CAAC","sourcesContent":["// Project/App: Open GSD\n// File Purpose: Drive runDeviceFlow against a loopback HTTP server to cover the RFC 8628\n// poll state machine (pending→approved), the missing-token guard, and re-validation of the\n// UNTRUSTED server-supplied gateway_url (valid wins / invalid falls back without crashing).\n//\n// The denied and expired paths are intentionally NOT tested here: runDeviceFlow calls\n// process.exit(1) on both (D-11/D-12), which an in-process node:test cannot survive.\nimport { test } from \"node:test\";\nimport assert from \"node:assert/strict\";\nimport { createServer, type Server } from \"node:http\";\nimport { runDeviceFlow } from \"./device-flow.js\";\nimport { parseCloudGatewayUrl } from \"./cloud-config.js\";\n\n// runDeviceFlow requires a configPath but never reads it (saving is the caller's job),\n// so a constant avoids pointless per-test tmp-dir I/O.\nconst CONFIG_PATH = \"unused-by-runDeviceFlow.yaml\";\n\n/** Returns the JSON body /api/device/token should answer with on POST number `callCount` (1-based). */\ntype TokenResponder = (callCount: number) => Record<string, unknown>;\n\n/**\n * Stand up a loopback HTTP server implementing both device-flow endpoints. Counts token\n * POSTs so the poll loop's progression can be asserted; `tokenResponder` shapes each reply.\n */\nfunction startDeviceServer(tokenResponder: TokenResponder): Promise<{ server: Server; baseUrl: string; tokenCalls: () => number }> {\n  let tokenCalls = 0;\n  const server = createServer((req, res) => {\n    req.setEncoding(\"utf8\");\n    req.on(\"data\", () => { /* body drained; contents are not asserted */ });\n    req.on(\"end\", () => {\n      if (req.url === \"/api/device/code\") {\n        res.writeHead(200, { \"content-type\": \"application/json\" });\n        res.end(JSON.stringify({\n          userCode: \"ABCD-1234\",\n          deviceCode: \"device-code-fixture\",\n          verificationUriComplete: \"https://example.test/verify\",\n          // Short-lived so the timeout path is bounded if a test ever fails to approve.\n          expiresIn: 30,\n        }));\n        return;\n      }\n      if (req.url === \"/api/device/token\") {\n        tokenCalls += 1;\n        res.writeHead(200, { \"content-type\": \"application/json\" });\n        res.end(JSON.stringify(tokenResponder(tokenCalls)));\n        return;\n      }\n      res.writeHead(404, { \"content-type\": \"application/json\" });\n      res.end(JSON.stringify({ error: \"not found\" }));\n    });\n  });\n\n  return new Promise((resolve, reject) => {\n    server.once(\"error\", reject);\n    server.listen(0, \"127.0.0.1\", () => {\n      const address = server.address();\n      if (!address || typeof address !== \"object\") {\n        reject(new Error(\"failed to bind loopback test server\"));\n        return;\n      }\n      resolve({ server, baseUrl: `http://127.0.0.1:${address.port}`, tokenCalls: () => tokenCalls });\n    });\n  });\n}\n\nfunction closeServer(server: Server): Promise<void> {\n  return new Promise((resolve, reject) => server.close((err) => (err ? reject(err) : resolve())));\n}\n\n/** Silence spinner stdout noise and capture stderr so the invalid-URL warning can be asserted. */\nfunction silenceOutput(): { restore: () => void; stderr: () => string } {\n  const originalOut = process.stdout.write.bind(process.stdout);\n  const originalErr = process.stderr.write.bind(process.stderr);\n  let capturedErr = \"\";\n  (process.stdout as unknown as { write: typeof process.stdout.write }).write = (() => true) as typeof process.stdout.write;\n  (process.stderr as unknown as { write: typeof process.stderr.write }).write = ((chunk: unknown) => {\n    capturedErr += typeof chunk === \"string\" ? chunk : String(chunk);\n    return true;\n  }) as typeof process.stderr.write;\n  return {\n    restore: () => {\n      (process.stdout as unknown as { write: typeof process.stdout.write }).write = originalOut;\n      (process.stderr as unknown as { write: typeof process.stderr.write }).write = originalErr;\n    },\n    stderr: () => capturedErr,\n  };\n}\n\n/** Run the flow against a server, always silencing output and closing the server. */\nasync function drive(\n  tokenResponder: TokenResponder,\n  assertResult: (result: Awaited<ReturnType<typeof runDeviceFlow>>, ctx: { baseUrl: string; tokenCalls: () => number; stderr: string }) => void,\n  t: { skip: (msg: string) => void },\n): Promise<void> {\n  let started: { server: Server; baseUrl: string; tokenCalls: () => number };\n  try {\n    started = await startDeviceServer(tokenResponder);\n  } catch (err) {\n    if ((err as NodeJS.ErrnoException).code === \"EPERM\") {\n      t.skip(\"loopback listen is blocked in this sandbox\");\n      return;\n    }\n    throw err;\n  }\n  const out = silenceOutput();\n  try {\n    const result = await runDeviceFlow({\n      gatewayUrl: started.baseUrl,\n      configPath: CONFIG_PATH,\n      binaryName: \"gsd\",\n    });\n    out.restore();\n    assertResult(result, { baseUrl: started.baseUrl, tokenCalls: started.tokenCalls, stderr: out.stderr() });\n  } finally {\n    out.restore();\n    await closeServer(started.server);\n  }\n}\n\ntest(\"immediate approval resolves with token, runtimeId, and the passed --gateway\", async (t) => {\n  await drive(\n    () => ({ status: \"approved\", token: \"tok\", runtimeId: \"rt\" }),\n    (result, ctx) => {\n      assert.equal(result.deviceToken, \"tok\");\n      assert.equal(result.runtimeId, \"rt\");\n      assert.equal(result.gatewayUrl, ctx.baseUrl);\n    },\n    t,\n  );\n});\n\ntest(\"pending then approved keeps polling until approval\", async (t) => {\n  await drive(\n    (call) => (call < 2 ? { status: \"pending\" } : { status: \"approved\", token: \"tok\", runtimeId: \"rt\" }),\n    (result, ctx) => {\n      assert.equal(result.deviceToken, \"tok\");\n      assert.ok(ctx.tokenCalls() >= 2, `expected >=2 token polls, saw ${ctx.tokenCalls()}`);\n    },\n    t,\n  );\n});\n\ntest(\"a VALID server-supplied gateway_url wins over the passed --gateway\", async (t) => {\n  const serverGateway = \"https://relay.opengsd.net\";\n  await drive(\n    () => ({ status: \"approved\", token: \"tok\", runtimeId: \"rt\", gateway_url: serverGateway }),\n    (result) => {\n      // Mirror the code's own resolution: parse + toString normalization.\n      assert.equal(result.gatewayUrl, parseCloudGatewayUrl(serverGateway).toString());\n    },\n    t,\n  );\n});\n\ntest(\"an INVALID server-supplied gateway_url falls back to --gateway without throwing\", async (t) => {\n  await drive(\n    () => ({ status: \"approved\", token: \"tok\", runtimeId: \"rt\", gateway_url: \"https://169.254.169.254\" }),\n    (result, ctx) => {\n      assert.equal(result.gatewayUrl, ctx.baseUrl);\n      assert.match(ctx.stderr, /ignoring invalid server-supplied relay URL/);\n    },\n    t,\n  );\n});\n\ntest(\"approval missing token/runtimeId rejects\", async (t) => {\n  let started: { server: Server; baseUrl: string; tokenCalls: () => number };\n  try {\n    started = await startDeviceServer(() => ({ status: \"approved\", runtimeId: \"rt\" }));\n  } catch (err) {\n    if ((err as NodeJS.ErrnoException).code === \"EPERM\") {\n      t.skip(\"loopback listen is blocked in this sandbox\");\n      return;\n    }\n    throw err;\n  }\n  const out = silenceOutput();\n  try {\n    await assert.rejects(\n      runDeviceFlow({ gatewayUrl: started.baseUrl, configPath: CONFIG_PATH, binaryName: \"gsd\" }),\n      /missing token or runtimeId/,\n    );\n  } finally {\n    out.restore();\n    await closeServer(started.server);\n  }\n});\n"]}

package/packages/gsd-cloud/dist/executors/claude-executor.d.ts

@@ -0,0 +1,6 @@
+import type { AdvertisedProject, Executor } from "./executor.js";
+export declare class ClaudeExecutor implements Executor {
+    execute(): Promise<unknown>;
+    advertisedProjects(): Promise<AdvertisedProject[]>;
+}
+//# sourceMappingURL=claude-executor.d.ts.map

package/packages/gsd-cloud/dist/executors/claude-executor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"claude-executor.d.ts","sourceRoot":"","sources":["../../src/executors/claude-executor.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,iBAAiB,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAEjE,qBAAa,cAAe,YAAW,QAAQ;IAC7C,OAAO,IAAI,OAAO,CAAC,OAAO,CAAC;IAI3B,kBAAkB,IAAI,OAAO,CAAC,iBAAiB,EAAE,CAAC;CAGnD"}

package/packages/gsd-cloud/dist/executors/claude-executor.js

@@ -0,0 +1,15 @@
+// Project/App: Open GSD
+// File Purpose: Placeholder Executor adapter for the Claude CLI (`claude -p`).
+//
+// TODO: Implement by driving `claude -p` headlessly. The behaviour is
+// intentionally NOT invented here — how claude exposes GSD workflow tools, the
+// print-mode invocation shape, and result mapping must be designed first.
+export class ClaudeExecutor {
+    execute() {
+        throw new Error("claude executor not yet implemented");
+    }
+    advertisedProjects() {
+        throw new Error("claude executor not yet implemented");
+    }
+}
+//# sourceMappingURL=claude-executor.js.map

package/packages/gsd-cloud/dist/executors/claude-executor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"claude-executor.js","sourceRoot":"","sources":["../../src/executors/claude-executor.ts"],"names":[],"mappings":"AAAA,wBAAwB;AACxB,+EAA+E;AAC/E,EAAE;AACF,sEAAsE;AACtE,+EAA+E;AAC/E,0EAA0E;AAI1E,MAAM,OAAO,cAAc;IACzB,OAAO;QACL,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;IACzD,CAAC;IAED,kBAAkB;QAChB,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;IACzD,CAAC;CACF","sourcesContent":["// Project/App: Open GSD\n// File Purpose: Placeholder Executor adapter for the Claude CLI (`claude -p`).\n//\n// TODO: Implement by driving `claude -p` headlessly. The behaviour is\n// intentionally NOT invented here — how claude exposes GSD workflow tools, the\n// print-mode invocation shape, and result mapping must be designed first.\n\nimport type { AdvertisedProject, Executor } from \"./executor.js\";\n\nexport class ClaudeExecutor implements Executor {\n  execute(): Promise<unknown> {\n    throw new Error(\"claude executor not yet implemented\");\n  }\n\n  advertisedProjects(): Promise<AdvertisedProject[]> {\n    throw new Error(\"claude executor not yet implemented\");\n  }\n}\n"]}

package/packages/gsd-cloud/dist/executors/codex-executor.d.ts

@@ -0,0 +1,6 @@
+import type { AdvertisedProject, Executor } from "./executor.js";
+export declare class CodexExecutor implements Executor {
+    execute(): Promise<unknown>;
+    advertisedProjects(): Promise<AdvertisedProject[]>;
+}
+//# sourceMappingURL=codex-executor.d.ts.map

package/packages/gsd-cloud/dist/executors/codex-executor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"codex-executor.d.ts","sourceRoot":"","sources":["../../src/executors/codex-executor.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,iBAAiB,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAEjE,qBAAa,aAAc,YAAW,QAAQ;IAC5C,OAAO,IAAI,OAAO,CAAC,OAAO,CAAC;IAI3B,kBAAkB,IAAI,OAAO,CAAC,iBAAiB,EAAE,CAAC;CAGnD"}

package/packages/gsd-cloud/dist/executors/codex-executor.js

@@ -0,0 +1,15 @@
+// Project/App: Open GSD
+// File Purpose: Placeholder Executor adapter for OpenAI Codex CLI.
+//
+// TODO: Implement by driving `codex` headlessly. The behaviour is intentionally
+// NOT invented here — the wiring (how codex exposes GSD workflow tools, its
+// invocation shape, and result mapping) must be designed before this ships.
+export class CodexExecutor {
+    execute() {
+        throw new Error("codex executor not yet implemented");
+    }
+    advertisedProjects() {
+        throw new Error("codex executor not yet implemented");
+    }
+}
+//# sourceMappingURL=codex-executor.js.map

package/packages/gsd-cloud/dist/executors/codex-executor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"codex-executor.js","sourceRoot":"","sources":["../../src/executors/codex-executor.ts"],"names":[],"mappings":"AAAA,wBAAwB;AACxB,mEAAmE;AACnE,EAAE;AACF,gFAAgF;AAChF,4EAA4E;AAC5E,4EAA4E;AAI5E,MAAM,OAAO,aAAa;IACxB,OAAO;QACL,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;IACxD,CAAC;IAED,kBAAkB;QAChB,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;IACxD,CAAC;CACF","sourcesContent":["// Project/App: Open GSD\n// File Purpose: Placeholder Executor adapter for OpenAI Codex CLI.\n//\n// TODO: Implement by driving `codex` headlessly. The behaviour is intentionally\n// NOT invented here — the wiring (how codex exposes GSD workflow tools, its\n// invocation shape, and result mapping) must be designed before this ships.\n\nimport type { AdvertisedProject, Executor } from \"./executor.js\";\n\nexport class CodexExecutor implements Executor {\n  execute(): Promise<unknown> {\n    throw new Error(\"codex executor not yet implemented\");\n  }\n\n  advertisedProjects(): Promise<AdvertisedProject[]> {\n    throw new Error(\"codex executor not yet implemented\");\n  }\n}\n"]}