@pellux/goodvibes-sdk 0.18.14 → 0.18.15

package/dist/_internal/platform/runtime/network/inbound.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"inbound.d.ts","sourceRoot":"","sources":["../../../../../src/_internal/platform/runtime/network/inbound.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AAG7D,MAAM,MAAM,cAAc,GAAG,KAAK,GAAG,OAAO,GAAG,QAAQ,CAAC;AACxD,MAAM,MAAM,oBAAoB,GAAG,cAAc,GAAG,cAAc,CAAC;AAEnE,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,OAAO,EAAE,oBAAoB,CAAC;IACvC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAC;IAC9B,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC;IAClC,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC;IAC7B,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,iBAAiB,EAAE,OAAO,CAAC;IACpC,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IACxB,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,QAAQ,CAAC,cAAc,CAAC,EAAE;QACxB,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;QAC5B,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC;QACxB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;KACxB,CAAC;CACH;AAED,MAAM,WAAW,yBAA0B,SAAQ,kBAAkB;IACnE,QAAQ,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC,UAAU,CAAC;CAC/B;AA4CD,wBAAgB,iBAAiB,CAAC,aAAa,EAAE,aAAa,EAAE,OAAO,EAAE,oBAAoB,GAAG,kBAAkB,CAyCjH;AAED,wBAAgB,wBAAwB,CAAC,aAAa,EAAE,aAAa,EAAE,OAAO,EAAE,oBAAoB,GAAG,yBAAyB,CAe/H"}

package/dist/_internal/platform/runtime/network/inbound.js

@@ -0,0 +1,90 @@
+import { existsSync } from 'node:fs';
+import { getDefaultInboundCertPaths, inspectPrivateKeyPermissions, resolvePathFromGoodVibesRoot } from './shared.js';
+function readMode(configManager, surface) {
+    return surface === 'controlPlane'
+        ? configManager.get('controlPlane.tls.mode')
+        : configManager.get('httpListener.tls.mode');
+}
+function readTrustProxy(configManager, surface) {
+    return surface === 'controlPlane'
+        ? Boolean(configManager.get('controlPlane.trustProxy'))
+        : Boolean(configManager.get('httpListener.trustProxy'));
+}
+function readHost(configManager, surface) {
+    return String(surface === 'controlPlane'
+        ? configManager.get('controlPlane.host')
+        : configManager.get('httpListener.host'));
+}
+function readPort(configManager, surface) {
+    return Number(surface === 'controlPlane'
+        ? configManager.get('controlPlane.port')
+        : configManager.get('httpListener.port'));
+}
+function readConfiguredCertPath(configManager, surface) {
+    return resolvePathFromGoodVibesRoot(surface === 'controlPlane'
+        ? configManager.get('controlPlane.tls.certFile')
+        : configManager.get('httpListener.tls.certFile'), configManager);
+}
+function readConfiguredKeyPath(configManager, surface) {
+    return resolvePathFromGoodVibesRoot(surface === 'controlPlane'
+        ? configManager.get('controlPlane.tls.keyFile')
+        : configManager.get('httpListener.tls.keyFile'), configManager);
+}
+export function inspectInboundTls(configManager, surface) {
+    const mode = readMode(configManager, surface);
+    const trustProxy = readTrustProxy(configManager, surface);
+    const host = readHost(configManager, surface);
+    const port = readPort(configManager, surface);
+    if (mode !== 'direct') {
+        return {
+            surface,
+            host,
+            port,
+            mode,
+            scheme: mode === 'proxy' ? 'https' : 'http',
+            trustProxy,
+            usingDefaultPaths: false,
+            ready: true,
+            errors: [],
+        };
+    }
+    const defaults = getDefaultInboundCertPaths(configManager);
+    const certFile = readConfiguredCertPath(configManager, surface) ?? defaults.certFile;
+    const keyFile = readConfiguredKeyPath(configManager, surface) ?? defaults.keyFile;
+    const usingDefaultPaths = certFile === defaults.certFile && keyFile === defaults.keyFile;
+    const errors = [];
+    if (!existsSync(certFile))
+        errors.push(`Certificate file not found: ${certFile}`);
+    if (!existsSync(keyFile))
+        errors.push(`Private key file not found: ${keyFile}`);
+    const keyPermissions = inspectPrivateKeyPermissions(keyFile);
+    return {
+        surface,
+        host,
+        port,
+        mode,
+        scheme: 'https',
+        trustProxy,
+        certFile,
+        keyFile,
+        usingDefaultPaths,
+        ready: errors.length === 0,
+        errors,
+        keyPermissions,
+    };
+}
+export function resolveInboundTlsContext(configManager, surface) {
+    const snapshot = inspectInboundTls(configManager, surface);
+    if (snapshot.mode !== 'direct')
+        return snapshot;
+    if (!snapshot.ready || !snapshot.certFile || !snapshot.keyFile) {
+        throw new Error(`${surface} direct TLS is enabled but certificate files are not ready: ${snapshot.errors.join('; ')}`);
+    }
+    return {
+        ...snapshot,
+        tls: {
+            cert: Bun.file(snapshot.certFile),
+            key: Bun.file(snapshot.keyFile),
+        },
+    };
+}

package/dist/_internal/platform/runtime/network/index.d.ts

@@ -0,0 +1,6 @@
+export type { InboundServerSurface, InboundTlsMode, InboundTlsSnapshot, ResolvedInboundTlsContext, } from './inbound.js';
+export { inspectInboundTls, resolveInboundTlsContext, } from './inbound.js';
+export type { OutboundTlsSnapshot, OutboundTrustMode, } from './outbound.js';
+export { applyOutboundTlsToFetchInit, createNetworkFetch, GlobalNetworkTransportInstaller, inspectOutboundTls, } from './outbound.js';
+export { extractForwardedClientIp, getDefaultCertDirectory, getDefaultInboundCertPaths, getGoodVibesRootDir, inspectPrivateKeyPermissions, isLocalHostname, readPemEntriesFromDirectory, resolvePathFromGoodVibesRoot, } from './shared.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/_internal/platform/runtime/network/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../src/_internal/platform/runtime/network/index.ts"],"names":[],"mappings":"AAAA,YAAY,EACV,oBAAoB,EACpB,cAAc,EACd,kBAAkB,EAClB,yBAAyB,GAC1B,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,iBAAiB,EACjB,wBAAwB,GACzB,MAAM,cAAc,CAAC;AACtB,YAAY,EACV,mBAAmB,EACnB,iBAAiB,GAClB,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,2BAA2B,EAC3B,kBAAkB,EAClB,+BAA+B,EAC/B,kBAAkB,GACnB,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,wBAAwB,EACxB,uBAAuB,EACvB,0BAA0B,EAC1B,mBAAmB,EACnB,4BAA4B,EAC5B,eAAe,EACf,2BAA2B,EAC3B,4BAA4B,GAC7B,MAAM,aAAa,CAAC"}

package/dist/_internal/platform/runtime/network/index.js

@@ -0,0 +1,3 @@
+export { inspectInboundTls, resolveInboundTlsContext, } from './inbound.js';
+export { applyOutboundTlsToFetchInit, createNetworkFetch, GlobalNetworkTransportInstaller, inspectOutboundTls, } from './outbound.js';
+export { extractForwardedClientIp, getDefaultCertDirectory, getDefaultInboundCertPaths, getGoodVibesRootDir, inspectPrivateKeyPermissions, isLocalHostname, readPemEntriesFromDirectory, resolvePathFromGoodVibesRoot, } from './shared.js';

package/dist/_internal/platform/runtime/network/outbound.d.ts

@@ -0,0 +1,28 @@
+import type { ConfigManager } from '../../config/manager.js';
+export type OutboundTrustMode = 'bundled' | 'bundled+custom' | 'custom';
+type FetchTlsOptions = Bun.TLSOptions & {
+    checkServerIdentity?: NonNullable<import('node:tls').ConnectionOptions['checkServerIdentity']>;
+};
+type FetchInitWithTls = RequestInit & {
+    tls?: FetchTlsOptions;
+};
+export interface OutboundTlsSnapshot {
+    readonly mode: OutboundTrustMode;
+    readonly allowInsecureLocalhost: boolean;
+    readonly customCaFile?: string;
+    readonly customCaDir?: string;
+    readonly customCaEntryCount: number;
+    readonly effectiveCaStrategy: 'bun-default' | 'bundled+custom' | 'custom';
+    readonly errors: readonly string[];
+}
+export declare function inspectOutboundTls(configManager: ConfigManager): OutboundTlsSnapshot;
+export declare function applyOutboundTlsToFetchInit(input: RequestInfo | URL, init: RequestInit | undefined, configManager: ConfigManager): FetchInitWithTls;
+export declare function createNetworkFetch(fetchImpl: typeof globalThis.fetch, configManager: ConfigManager): typeof globalThis.fetch;
+export declare class GlobalNetworkTransportInstaller {
+    private originalFetchRef;
+    private configManager;
+    setConfigManager(configManager: ConfigManager): void;
+    install(configManager: ConfigManager): void;
+}
+export {};
+//# sourceMappingURL=outbound.d.ts.map

package/dist/_internal/platform/runtime/network/outbound.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"outbound.d.ts","sourceRoot":"","sources":["../../../../../src/_internal/platform/runtime/network/outbound.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AAK7D,MAAM,MAAM,iBAAiB,GAAG,SAAS,GAAG,gBAAgB,GAAG,QAAQ,CAAC;AAExE,KAAK,eAAe,GAAG,GAAG,CAAC,UAAU,GAAG;IACtC,mBAAmB,CAAC,EAAE,WAAW,CAAC,OAAO,UAAU,EAAE,iBAAiB,CAAC,qBAAqB,CAAC,CAAC,CAAC;CAChG,CAAC;AAEF,KAAK,gBAAgB,GAAG,WAAW,GAAG;IACpC,GAAG,CAAC,EAAE,eAAe,CAAC;CACvB,CAAC;AAEF,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,IAAI,EAAE,iBAAiB,CAAC;IACjC,QAAQ,CAAC,sBAAsB,EAAE,OAAO,CAAC;IACzC,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;IACpC,QAAQ,CAAC,mBAAmB,EAAE,aAAa,GAAG,gBAAgB,GAAG,QAAQ,CAAC;IAC1E,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;CACpC;AAwED,wBAAgB,kBAAkB,CAAC,aAAa,EAAE,aAAa,GAAG,mBAAmB,CAiBpF;AAqGD,wBAAgB,2BAA2B,CACzC,KAAK,EAAE,WAAW,GAAG,GAAG,EACxB,IAAI,EAAE,WAAW,GAAG,SAAS,EAC7B,aAAa,EAAE,aAAa,GAC3B,gBAAgB,CA8BlB;AAED,wBAAgB,kBAAkB,CAChC,SAAS,EAAE,OAAO,UAAU,CAAC,KAAK,EAClC,aAAa,EAAE,aAAa,GAC3B,OAAO,UAAU,CAAC,KAAK,CAKzB;AAED,qBAAa,+BAA+B;IAC1C,OAAO,CAAC,gBAAgB,CAAwC;IAChE,OAAO,CAAC,aAAa,CAA8B;IAEnD,gBAAgB,CAAC,aAAa,EAAE,aAAa,GAAG,IAAI;IAIpD,OAAO,CAAC,aAAa,EAAE,aAAa,GAAG,IAAI;CAsB5C"}

package/dist/_internal/platform/runtime/network/outbound.js

@@ -0,0 +1,222 @@
+import { existsSync, readFileSync } from 'node:fs';
+import { getCACertificates } from 'node:tls';
+import { logger } from '@pellux/goodvibes-sdk/platform/utils/logger';
+import { isLocalHostname, readPemEntriesFromDirectory, resolvePathFromGoodVibesRoot } from './shared.js';
+import { summarizeError } from '@pellux/goodvibes-sdk/platform/utils/error-display';
+const NETWORK_FETCH_WRAPPER = Symbol.for('goodvibes.network.fetch-wrapper');
+const NETWORK_FETCH_MANAGER = Symbol.for('goodvibes.network.fetch-manager');
+function readMode(configManager) {
+    return configManager.get('network.outboundTls.mode');
+}
+function readAllowInsecureLocalhost(configManager) {
+    return Boolean(configManager.get('network.outboundTls.allowInsecureLocalhost'));
+}
+function readCustomCaFile(configManager) {
+    return resolvePathFromGoodVibesRoot(configManager.get('network.outboundTls.customCaFile'), configManager);
+}
+function readCustomCaDir(configManager) {
+    return resolvePathFromGoodVibesRoot(configManager.get('network.outboundTls.customCaDir'), configManager);
+}
+function loadCustomCaEntries(configManager) {
+    const errors = [];
+    const entries = [];
+    const customCaFile = readCustomCaFile(configManager);
+    const customCaDir = readCustomCaDir(configManager);
+    if (customCaFile) {
+        if (existsSync(customCaFile)) {
+            entries.push(readFileSync(customCaFile, 'utf-8'));
+        }
+        else {
+            errors.push(`Custom CA file not found: ${customCaFile}`);
+        }
+    }
+    if (customCaDir) {
+        if (existsSync(customCaDir)) {
+            for (const path of readPemEntriesFromDirectory(customCaDir)) {
+                entries.push(readFileSync(path, 'utf-8'));
+            }
+        }
+        else {
+            errors.push(`Custom CA directory not found: ${customCaDir}`);
+        }
+    }
+    return {
+        entries,
+        errors,
+        ...(customCaFile ? { customCaFile } : {}),
+        ...(customCaDir ? { customCaDir } : {}),
+    };
+}
+function getBundledCaEntries() {
+    return getCACertificates('bundled');
+}
+export function inspectOutboundTls(configManager) {
+    const mode = readMode(configManager);
+    const allowInsecureLocalhost = readAllowInsecureLocalhost(configManager);
+    const custom = loadCustomCaEntries(configManager);
+    return {
+        mode,
+        allowInsecureLocalhost,
+        ...(custom.customCaFile ? { customCaFile: custom.customCaFile } : {}),
+        ...(custom.customCaDir ? { customCaDir: custom.customCaDir } : {}),
+        customCaEntryCount: custom.entries.length,
+        effectiveCaStrategy: mode === 'bundled'
+            ? 'bun-default'
+            : mode === 'bundled+custom'
+                ? 'bundled+custom'
+                : 'custom',
+        errors: custom.errors,
+    };
+}
+function resolveOutboundTlsContext(configManager) {
+    const snapshot = inspectOutboundTls(configManager);
+    const custom = loadCustomCaEntries(configManager);
+    const caEntries = snapshot.mode === 'bundled'
+        ? undefined
+        : snapshot.mode === 'bundled+custom'
+            ? [...getBundledCaEntries(), ...custom.entries]
+            : [...custom.entries];
+    return { snapshot, ...(caEntries ? { caEntries } : {}) };
+}
+function extractRequestUrl(input) {
+    try {
+        if (typeof input === 'string')
+            return new URL(input);
+        if (input instanceof URL)
+            return input;
+        if (typeof Request !== 'undefined' && input instanceof Request)
+            return new URL(input.url);
+        return null;
+    }
+    catch {
+        return null;
+    }
+}
+function extractRequestMethod(input, init) {
+    if (init?.method)
+        return init.method.toUpperCase();
+    if (typeof Request !== 'undefined' && input instanceof Request)
+        return input.method.toUpperCase();
+    return 'GET';
+}
+function extractHeaderValue(headers, name) {
+    if (!headers)
+        return undefined;
+    if (headers instanceof Headers)
+        return headers.get(name) ?? undefined;
+    if (Array.isArray(headers)) {
+        const loweredName = name.toLowerCase();
+        const match = headers.find(([key]) => key.toLowerCase() === loweredName);
+        return match?.[1];
+    }
+    for (const [key, value] of Object.entries(headers)) {
+        if (key.toLowerCase() !== name.toLowerCase())
+            continue;
+        if (Array.isArray(value))
+            return value.join(', ');
+        return value;
+    }
+    return undefined;
+}
+function shouldTraceProviderRequest(url, method) {
+    if (method !== 'POST')
+        return false;
+    return (url.pathname.endsWith('/chat/completions') ||
+        url.pathname.endsWith('/responses') ||
+        url.pathname.endsWith('/messages'));
+}
+async function executeNetworkFetch(fetchImpl, input, init, configManager) {
+    const nextInit = applyOutboundTlsToFetchInit(input, init, configManager);
+    const url = extractRequestUrl(input);
+    const method = extractRequestMethod(input, nextInit);
+    const shouldTrace = url ? shouldTraceProviderRequest(url, method) : false;
+    if (shouldTrace && url) {
+        logger.debug('Outbound provider request', {
+            method,
+            host: url.host,
+            path: url.pathname,
+            contentType: extractHeaderValue(nextInit.headers, 'content-type'),
+            contentLength: extractHeaderValue(nextInit.headers, 'content-length'),
+        });
+    }
+    try {
+        const response = await fetchImpl(input, nextInit);
+        if (shouldTrace && url) {
+            logger.debug('Outbound provider response', {
+                method,
+                host: url.host,
+                path: url.pathname,
+                status: response.status,
+                requestId: response.headers.get('x-request-id') ?? response.headers.get('request-id') ?? undefined,
+            });
+        }
+        return response;
+    }
+    catch (error) {
+        if (shouldTrace && url) {
+            logger.error('Outbound provider request failed', {
+                method,
+                host: url.host,
+                path: url.pathname,
+                error: summarizeError(error),
+            });
+        }
+        throw error;
+    }
+}
+export function applyOutboundTlsToFetchInit(input, init, configManager) {
+    const url = extractRequestUrl(input);
+    const nextInit = { ...(init ?? {}) };
+    if (!url || url.protocol !== 'https:')
+        return nextInit;
+    const context = resolveOutboundTlsContext(configManager);
+    const existingTls = nextInit.tls ?? {};
+    const nextTls = { ...existingTls };
+    if (context.snapshot.mode === 'custom' && !nextTls.ca && (!context.caEntries || context.caEntries.length === 0)) {
+        throw new Error('network.outboundTls.mode is custom, but no custom CA entries were loaded. Configure network.outboundTls.customCaFile or network.outboundTls.customCaDir.');
+    }
+    if (!nextTls.ca && context.caEntries && context.caEntries.length > 0) {
+        nextTls.ca = [...context.caEntries];
+    }
+    if (context.snapshot.allowInsecureLocalhost
+        && nextTls.rejectUnauthorized === undefined
+        && isLocalHostname(url.hostname)) {
+        nextTls.rejectUnauthorized = false;
+    }
+    return Object.keys(nextTls).length > 0
+        ? { ...nextInit, tls: nextTls }
+        : nextInit;
+}
+export function createNetworkFetch(fetchImpl, configManager) {
+    const wrapped = (async (input, init) => executeNetworkFetch(fetchImpl, input, init, configManager));
+    Object.assign(wrapped, fetchImpl);
+    return wrapped;
+}
+export class GlobalNetworkTransportInstaller {
+    originalFetchRef = null;
+    configManager = null;
+    setConfigManager(configManager) {
+        this.configManager = configManager;
+    }
+    install(configManager) {
+        const currentFetch = globalThis.fetch;
+        if (currentFetch[NETWORK_FETCH_MANAGER]) {
+            currentFetch[NETWORK_FETCH_MANAGER].setConfigManager(configManager);
+            logger.debug('Updated global network transport', { ...inspectOutboundTls(configManager) });
+            return;
+        }
+        this.configManager = configManager;
+        this.originalFetchRef = globalThis.fetch.bind(globalThis);
+        const wrapped = (async (input, init) => {
+            if (!this.originalFetchRef || !this.configManager) {
+                throw new Error('Global network transport is not initialized correctly.');
+            }
+            return executeNetworkFetch(this.originalFetchRef, input, init, this.configManager);
+        });
+        Object.assign(wrapped, globalThis.fetch);
+        wrapped[NETWORK_FETCH_WRAPPER] = true;
+        wrapped[NETWORK_FETCH_MANAGER] = this;
+        globalThis.fetch = wrapped;
+        logger.debug('Installed global network transport', { ...inspectOutboundTls(configManager) });
+    }
+}

package/dist/_internal/platform/runtime/network/shared.d.ts

@@ -0,0 +1,19 @@
+import type { ConfigManager } from '../../config/manager.js';
+type NetworkRootConfig = Pick<ConfigManager, 'getControlPlaneConfigDir'>;
+export declare function getGoodVibesRootDir(configManager: NetworkRootConfig): string;
+export declare function getDefaultCertDirectory(configManager: NetworkRootConfig): string;
+export declare function getDefaultInboundCertPaths(configManager: NetworkRootConfig): {
+    readonly certFile: string;
+    readonly keyFile: string;
+};
+export declare function resolvePathFromGoodVibesRoot(value: string | null | undefined, configManager: NetworkRootConfig): string | null;
+export declare function readPemEntriesFromDirectory(path: string): string[];
+export declare function isLocalHostname(hostname: string): boolean;
+export declare function extractForwardedClientIp(req: Request, trustProxy: boolean): string | undefined;
+export declare function inspectPrivateKeyPermissions(path: string): {
+    readonly available: boolean;
+    readonly safe?: boolean;
+    readonly mode?: string;
+};
+export {};
+//# sourceMappingURL=shared.d.ts.map

package/dist/_internal/platform/runtime/network/shared.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"shared.d.ts","sourceRoot":"","sources":["../../../../../src/_internal/platform/runtime/network/shared.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AAI7D,KAAK,iBAAiB,GAAG,IAAI,CAAC,aAAa,EAAE,0BAA0B,CAAC,CAAC;AAEzE,wBAAgB,mBAAmB,CAAC,aAAa,EAAE,iBAAiB,GAAG,MAAM,CAG5E;AAED,wBAAgB,uBAAuB,CAAC,aAAa,EAAE,iBAAiB,GAAG,MAAM,CAEhF;AAED,wBAAgB,0BAA0B,CAAC,aAAa,EAAE,iBAAiB,GAAG;IAC5E,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B,CAMA;AAED,wBAAgB,4BAA4B,CAC1C,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EAChC,aAAa,EAAE,iBAAiB,GAC/B,MAAM,GAAG,IAAI,CAMf;AAED,wBAAgB,2BAA2B,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,CAMlE;AAED,wBAAgB,eAAe,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAMzD;AAED,wBAAgB,wBAAwB,CAAC,GAAG,EAAE,OAAO,EAAE,UAAU,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,CAS9F;AAED,wBAAgB,4BAA4B,CAAC,IAAI,EAAE,MAAM,GAAG;IAC1D,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;IAC5B,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC;IACxB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;CACxB,CAWA"}

package/dist/_internal/platform/runtime/network/shared.js

@@ -0,0 +1,64 @@
+import { existsSync, readdirSync, statSync } from 'node:fs';
+import { basename, dirname, extname, isAbsolute, join, resolve } from 'node:path';
+const PEM_EXTENSIONS = new Set(['.pem', '.crt', '.cer']);
+export function getGoodVibesRootDir(configManager) {
+    const configuredDir = configManager.getControlPlaneConfigDir();
+    return resolve(configuredDir);
+}
+export function getDefaultCertDirectory(configManager) {
+    return join(getGoodVibesRootDir(configManager), 'certs');
+}
+export function getDefaultInboundCertPaths(configManager) {
+    const certDir = getDefaultCertDirectory(configManager);
+    return {
+        certFile: join(certDir, 'fullchain.pem'),
+        keyFile: join(certDir, 'privkey.pem'),
+    };
+}
+export function resolvePathFromGoodVibesRoot(value, configManager) {
+    const trimmed = value?.trim();
+    if (!trimmed)
+        return null;
+    return isAbsolute(trimmed)
+        ? trimmed
+        : resolve(getGoodVibesRootDir(configManager), trimmed);
+}
+export function readPemEntriesFromDirectory(path) {
+    if (!existsSync(path))
+        return [];
+    return readdirSync(path, { withFileTypes: true })
+        .filter((entry) => entry.isFile() && PEM_EXTENSIONS.has(extname(entry.name).toLowerCase()))
+        .map((entry) => join(path, entry.name))
+        .sort((a, b) => a.localeCompare(b));
+}
+export function isLocalHostname(hostname) {
+    const normalized = hostname.trim().toLowerCase();
+    return normalized === 'localhost'
+        || normalized === '127.0.0.1'
+        || normalized === '::1'
+        || normalized === '[::1]';
+}
+export function extractForwardedClientIp(req, trustProxy) {
+    if (!trustProxy)
+        return undefined;
+    const forwarded = req.headers.get('x-forwarded-for');
+    if (forwarded) {
+        const first = forwarded.split(',').map((value) => value.trim()).find(Boolean);
+        if (first)
+            return first;
+    }
+    const realIp = req.headers.get('x-real-ip')?.trim();
+    return realIp ? realIp : undefined;
+}
+export function inspectPrivateKeyPermissions(path) {
+    if (!existsSync(path) || process.platform === 'win32') {
+        return { available: false };
+    }
+    const stat = statSync(path);
+    const mode = stat.mode & 0o777;
+    return {
+        available: true,
+        safe: (mode & 0o077) === 0,
+        mode: `0${mode.toString(8)}`,
+    };
+}

package/dist/_internal/platform/runtime/operator-client.d.ts

@@ -0,0 +1,87 @@
+import type { ControlPlaneRecentEvent, SharedApprovalRecord, SharedSessionInputRecord, SharedSessionMessage, SharedSessionRecord, SharedSessionSubmission, SteerSharedSessionMessageInput, SubmitSharedSessionMessageInput } from '../control-plane/index.js';
+import type { RequestSharedApprovalInput } from '../control-plane/index.js';
+import type { PermissionPromptDecision } from '../permissions/prompt.js';
+import { type AuthInspectionSnapshot } from './auth/inspection.js';
+import { type ProviderAccountSnapshot } from './provider-accounts/registry.js';
+import type { ProviderRuntimeSnapshot, ProviderUsageSnapshot } from '../providers/runtime-snapshot.js';
+import type { OperatorClientServices } from './foundation-services.js';
+import type { RuntimeTask } from '@pellux/goodvibes-sdk/platform/runtime/store/domains/tasks';
+import type { UiControlPlaneSnapshot, UiSessionSnapshot, UiTasksSnapshot } from './ui-read-models.js';
+import type { UiRuntimeEvents } from './ui-events.js';
+import type { ShellPathService } from '@pellux/goodvibes-sdk/platform/runtime/shell-paths';
+export interface OperatorControlPlaneSnapshot extends UiControlPlaneSnapshot {
+}
+export interface OperatorProvidersSnapshot {
+    readonly providerIds: readonly string[];
+    readonly runtimeSnapshots: readonly ProviderRuntimeSnapshot[];
+    readonly accountSnapshot: ProviderAccountSnapshot;
+    readonly authInspection: AuthInspectionSnapshot;
+}
+export interface OperatorSessionsClient {
+    current(): UiSessionSnapshot;
+    list(limit?: number): readonly SharedSessionRecord[];
+    get(sessionId: string): SharedSessionRecord | null;
+    messages(sessionId: string, limit?: number): readonly SharedSessionMessage[];
+    inputs(sessionId: string, limit?: number): readonly SharedSessionInputRecord[];
+    ensureSession(input?: OperatorSessionEnsureInput): Promise<SharedSessionRecord>;
+    close(sessionId: string): Promise<SharedSessionRecord | null>;
+    reopen(sessionId: string): Promise<SharedSessionRecord | null>;
+    bindAgent(sessionId: string, agentId: string): Promise<SharedSessionRecord | null>;
+    submitMessage(input: SubmitSharedSessionMessageInput): Promise<SharedSessionSubmission>;
+    steerMessage(input: SteerSharedSessionMessageInput): Promise<SharedSessionSubmission>;
+    followUpMessage(input: SubmitSharedSessionMessageInput): Promise<SharedSessionSubmission>;
+    cancelInput(sessionId: string, inputId: string): Promise<SharedSessionInputRecord | null>;
+}
+export interface OperatorTasksClient {
+    snapshot(): UiTasksSnapshot;
+    list(limit?: number): readonly RuntimeTask[];
+    get(taskId: string): RuntimeTask | null;
+    running(): readonly RuntimeTask[];
+}
+export interface OperatorApprovalsClient {
+    list(limit?: number): readonly SharedApprovalRecord[];
+    get(approvalId: string): SharedApprovalRecord | null;
+    request(input: RequestSharedApprovalInput): Promise<PermissionPromptDecision>;
+    claim(approvalId: string, actor: string, actorSurface?: string, note?: string): Promise<SharedApprovalRecord | null>;
+    resolve(approvalId: string, input: {
+        readonly approved: boolean;
+        readonly remember?: boolean;
+        readonly actor: string;
+        readonly actorSurface?: string;
+        readonly note?: string;
+    }): Promise<SharedApprovalRecord | null>;
+    approve(approvalId: string, actor: string, actorSurface?: string, note?: string): Promise<SharedApprovalRecord | null>;
+    deny(approvalId: string, actor: string, actorSurface?: string, note?: string): Promise<SharedApprovalRecord | null>;
+    cancel(approvalId: string, actor: string, actorSurface?: string, note?: string): Promise<SharedApprovalRecord | null>;
+    update(approvalId: string, input: {
+        readonly actor: string;
+        readonly actorSurface?: string;
+        readonly note?: string;
+        readonly metadata?: Record<string, unknown>;
+    }): Promise<SharedApprovalRecord | null>;
+}
+export type OperatorSessionEnsureInput = NonNullable<Parameters<OperatorClientServices['sessionBroker']['ensureSession']>[0]>;
+export interface OperatorProvidersClient {
+    listIds(): readonly string[];
+    runtimeSnapshots(): Promise<readonly ProviderRuntimeSnapshot[]>;
+    runtimeSnapshot(providerId: string): Promise<ProviderRuntimeSnapshot | null>;
+    usageSnapshot(providerId: string): Promise<ProviderUsageSnapshot | null>;
+    snapshot(): Promise<OperatorProvidersSnapshot>;
+    accountSnapshot(): Promise<ProviderAccountSnapshot>;
+    authInspection(): Promise<AuthInspectionSnapshot>;
+}
+export interface OperatorControlPlaneClient {
+    snapshot(): OperatorControlPlaneSnapshot;
+    recentEvents(limit?: number): readonly ControlPlaneRecentEvent[];
+}
+export interface OperatorClient {
+    readonly sessions: OperatorSessionsClient;
+    readonly tasks: OperatorTasksClient;
+    readonly approvals: OperatorApprovalsClient;
+    readonly providers: OperatorProvidersClient;
+    readonly controlPlane: OperatorControlPlaneClient;
+    readonly events: UiRuntimeEvents;
+    readonly shellPaths: ShellPathService;
+}
+export declare function createOperatorClient(services: OperatorClientServices): OperatorClient;
+//# sourceMappingURL=operator-client.d.ts.map

package/dist/_internal/platform/runtime/operator-client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"operator-client.d.ts","sourceRoot":"","sources":["../../../../src/_internal/platform/runtime/operator-client.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,uBAAuB,EACvB,oBAAoB,EACpB,wBAAwB,EACxB,oBAAoB,EACpB,mBAAmB,EACnB,uBAAuB,EACvB,8BAA8B,EAC9B,+BAA+B,EAChC,MAAM,2BAA2B,CAAC;AACnC,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,2BAA2B,CAAC;AAC5E,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,0BAA0B,CAAC;AACzE,OAAO,EAA+B,KAAK,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AAChG,OAAO,EAAgC,KAAK,uBAAuB,EAAE,MAAM,iCAAiC,CAAC;AAC7G,OAAO,KAAK,EAAE,uBAAuB,EAAE,qBAAqB,EAAE,MAAM,kCAAkC,CAAC;AAEvG,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,0BAA0B,CAAC;AACvE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,4DAA4D,CAAC;AAC9F,OAAO,KAAK,EAAE,sBAAsB,EAAE,iBAAiB,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AACtG,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AACtD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,oDAAoD,CAAC;AAE3F,MAAM,WAAW,4BAA6B,SAAQ,sBAAsB;CAAG;AAE/E,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,WAAW,EAAE,SAAS,MAAM,EAAE,CAAC;IACxC,QAAQ,CAAC,gBAAgB,EAAE,SAAS,uBAAuB,EAAE,CAAC;IAC9D,QAAQ,CAAC,eAAe,EAAE,uBAAuB,CAAC;IAClD,QAAQ,CAAC,cAAc,EAAE,sBAAsB,CAAC;CACjD;AAED,MAAM,WAAW,sBAAsB;IACrC,OAAO,IAAI,iBAAiB,CAAC;IAC7B,IAAI,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,mBAAmB,EAAE,CAAC;IACrD,GAAG,CAAC,SAAS,EAAE,MAAM,GAAG,mBAAmB,GAAG,IAAI,CAAC;IACnD,QAAQ,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,oBAAoB,EAAE,CAAC;IAC7E,MAAM,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,wBAAwB,EAAE,CAAC;IAC/E,aAAa,CAAC,KAAK,CAAC,EAAE,0BAA0B,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAAC;IAChF,KAAK,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,GAAG,IAAI,CAAC,CAAC;IAC9D,MAAM,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,GAAG,IAAI,CAAC,CAAC;IAC/D,SAAS,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,GAAG,IAAI,CAAC,CAAC;IACnF,aAAa,CAAC,KAAK,EAAE,+BAA+B,GAAG,OAAO,CAAC,uBAAuB,CAAC,CAAC;IACxF,YAAY,CAAC,KAAK,EAAE,8BAA8B,GAAG,OAAO,CAAC,uBAAuB,CAAC,CAAC;IACtF,eAAe,CAAC,KAAK,EAAE,+BAA+B,GAAG,OAAO,CAAC,uBAAuB,CAAC,CAAC;IAC1F,WAAW,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,wBAAwB,GAAG,IAAI,CAAC,CAAC;CAC3F;AAED,MAAM,WAAW,mBAAmB;IAClC,QAAQ,IAAI,eAAe,CAAC;IAC5B,IAAI,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,WAAW,EAAE,CAAC;IAC7C,GAAG,CAAC,MAAM,EAAE,MAAM,GAAG,WAAW,GAAG,IAAI,CAAC;IACxC,OAAO,IAAI,SAAS,WAAW,EAAE,CAAC;CACnC;AAED,MAAM,WAAW,uBAAuB;IACtC,IAAI,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,oBAAoB,EAAE,CAAC;IACtD,GAAG,CAAC,UAAU,EAAE,MAAM,GAAG,oBAAoB,GAAG,IAAI,CAAC;IACrD,OAAO,CAAC,KAAK,EAAE,0BAA0B,GAAG,OAAO,CAAC,wBAAwB,CAAC,CAAC;IAC9E,KAAK,CAAC,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,YAAY,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,GAAG,IAAI,CAAC,CAAC;IACrH,OAAO,CACL,UAAU,EAAE,MAAM,EAClB,KAAK,EAAE;QACL,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;QAC3B,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC;QAC5B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QACvB,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;QAC/B,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;KACxB,GACA,OAAO,CAAC,oBAAoB,GAAG,IAAI,CAAC,CAAC;IACxC,OAAO,CAAC,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,YAAY,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,GAAG,IAAI,CAAC,CAAC;IACvH,IAAI,CAAC,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,YAAY,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,GAAG,IAAI,CAAC,CAAC;IACpH,MAAM,CAAC,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,YAAY,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,GAAG,IAAI,CAAC,CAAC;IACtH,MAAM,CACJ,UAAU,EAAE,MAAM,EAClB,KAAK,EAAE;QACL,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QACvB,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;QAC/B,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QACvB,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;KAC7C,GACA,OAAO,CAAC,oBAAoB,GAAG,IAAI,CAAC,CAAC;CACzC;AAED,MAAM,MAAM,0BAA0B,GAAG,WAAW,CAAC,UAAU,CAAC,sBAAsB,CAAC,eAAe,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAE9H,MAAM,WAAW,uBAAuB;IACtC,OAAO,IAAI,SAAS,MAAM,EAAE,CAAC;IAC7B,gBAAgB,IAAI,OAAO,CAAC,SAAS,uBAAuB,EAAE,CAAC,CAAC;IAChE,eAAe,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,uBAAuB,GAAG,IAAI,CAAC,CAAC;IAC7E,aAAa,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,qBAAqB,GAAG,IAAI,CAAC,CAAC;IACzE,QAAQ,IAAI,OAAO,CAAC,yBAAyB,CAAC,CAAC;IAC/C,eAAe,IAAI,OAAO,CAAC,uBAAuB,CAAC,CAAC;IACpD,cAAc,IAAI,OAAO,CAAC,sBAAsB,CAAC,CAAC;CACnD;AAED,MAAM,WAAW,0BAA0B;IACzC,QAAQ,IAAI,4BAA4B,CAAC;IACzC,YAAY,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,uBAAuB,EAAE,CAAC;CAClE;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,QAAQ,EAAE,sBAAsB,CAAC;IAC1C,QAAQ,CAAC,KAAK,EAAE,mBAAmB,CAAC;IACpC,QAAQ,CAAC,SAAS,EAAE,uBAAuB,CAAC;IAC5C,QAAQ,CAAC,SAAS,EAAE,uBAAuB,CAAC;IAC5C,QAAQ,CAAC,YAAY,EAAE,0BAA0B,CAAC;IAClD,QAAQ,CAAC,MAAM,EAAE,eAAe,CAAC;IACjC,QAAQ,CAAC,UAAU,EAAE,gBAAgB,CAAC;CACvC;AAeD,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,sBAAsB,GAAG,cAAc,CA+GrF"}