@spinabot/brigade 1.7.0 → 1.9.0

package/dist/core/tunnel/auth-proxy.d.ts

@@ -0,0 +1,55 @@
+/**
+ * Token-checking reverse proxy that fronts the gateway for `brigade expose`.
+ *
+ * WHY THIS EXISTS — the gateway WebSocket is UNAUTHENTICATED: every connection
+ * is granted full `operator.admin` scope (see `core/server.ts` connection
+ * handler). The only thing protecting it today is the hard localhost-bind
+ * guard in `startServer`. Tunnelling the raw gateway to the internet would
+ * therefore publish full agent control to anyone who learns the URL.
+ *
+ * Rather than bolt auth onto the security-sensitive gateway connection path
+ * (and force every local client to start sending a token), `expose` keeps the
+ * gateway exactly as-is and publishes THIS proxy instead. The proxy:
+ *   1. binds to 127.0.0.1 on an ephemeral port,
+ *   2. requires a bearer token on every HTTP request AND every WS upgrade,
+ *   3. forwards authed traffic to 127.0.0.1:<gatewayPort>.
+ *
+ * The tunnel client connects to this proxy; the gateway never sees an
+ * unauthenticated remote. This is precisely the "front the gateway with a
+ * reverse-proxy that adds your own auth" path the gateway's own guard
+ * recommends.
+ *
+ * Token may arrive three ways (so browsers, CLIs, and WS clients all work):
+ *   - `Authorization: Bearer <token>`
+ *   - `x-brigade-token: <token>` header
+ *   - `?token=<token>` query string  (the form the printed public URL uses)
+ *
+ * When started WITHOUT a token (`brigade expose --insecure`) the proxy is a
+ * plain pass-through — every byte reaches the gateway. That mode is gated
+ * behind an explicit flag + a loud warning in the CLI.
+ */
+export interface AuthProxyOptions {
+    /** Gateway host to forward to (loopback). */
+    gatewayHost: string;
+    /** Gateway port to forward to. */
+    gatewayPort: number;
+    /** Required bearer token. `undefined`/empty → pass-through (insecure). */
+    token?: string;
+    /** Sink for proxy diagnostics. */
+    onLog?: (line: string) => void;
+}
+export interface AuthProxyHandle {
+    /** Loopback port the proxy is listening on. */
+    port: number;
+    /** Whether a token gate is active. */
+    secured: boolean;
+    /** Stop accepting connections and close the listener. Idempotent. */
+    stop(): Promise<void>;
+}
+/**
+ * Start the auth-proxy. Resolves once it is listening; the returned handle
+ * carries the chosen port. The proxy lives until `stop()` (or the process
+ * exits).
+ */
+export declare function startAuthProxy(opts: AuthProxyOptions): Promise<AuthProxyHandle>;
+//# sourceMappingURL=auth-proxy.d.ts.map

package/dist/core/tunnel/auth-proxy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-proxy.d.ts","sourceRoot":"","sources":["../../../src/core/tunnel/auth-proxy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAOH,MAAM,WAAW,gBAAgB;IAC/B,6CAA6C;IAC7C,WAAW,EAAE,MAAM,CAAC;IACpB,kCAAkC;IAClC,WAAW,EAAE,MAAM,CAAC;IACpB,0EAA0E;IAC1E,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,kCAAkC;IAClC,KAAK,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;CAChC;AAED,MAAM,WAAW,eAAe;IAC9B,+CAA+C;IAC/C,IAAI,EAAE,MAAM,CAAC;IACb,sCAAsC;IACtC,OAAO,EAAE,OAAO,CAAC;IACjB,qEAAqE;IACrE,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACvB;AA8BD;;;;GAIG;AACH,wBAAsB,cAAc,CAAC,IAAI,EAAE,gBAAgB,GAAG,OAAO,CAAC,eAAe,CAAC,CA6GrF"}

package/dist/core/tunnel/auth-proxy.js

@@ -0,0 +1,179 @@
+/**
+ * Token-checking reverse proxy that fronts the gateway for `brigade expose`.
+ *
+ * WHY THIS EXISTS — the gateway WebSocket is UNAUTHENTICATED: every connection
+ * is granted full `operator.admin` scope (see `core/server.ts` connection
+ * handler). The only thing protecting it today is the hard localhost-bind
+ * guard in `startServer`. Tunnelling the raw gateway to the internet would
+ * therefore publish full agent control to anyone who learns the URL.
+ *
+ * Rather than bolt auth onto the security-sensitive gateway connection path
+ * (and force every local client to start sending a token), `expose` keeps the
+ * gateway exactly as-is and publishes THIS proxy instead. The proxy:
+ *   1. binds to 127.0.0.1 on an ephemeral port,
+ *   2. requires a bearer token on every HTTP request AND every WS upgrade,
+ *   3. forwards authed traffic to 127.0.0.1:<gatewayPort>.
+ *
+ * The tunnel client connects to this proxy; the gateway never sees an
+ * unauthenticated remote. This is precisely the "front the gateway with a
+ * reverse-proxy that adds your own auth" path the gateway's own guard
+ * recommends.
+ *
+ * Token may arrive three ways (so browsers, CLIs, and WS clients all work):
+ *   - `Authorization: Bearer <token>`
+ *   - `x-brigade-token: <token>` header
+ *   - `?token=<token>` query string  (the form the printed public URL uses)
+ *
+ * When started WITHOUT a token (`brigade expose --insecure`) the proxy is a
+ * plain pass-through — every byte reaches the gateway. That mode is gated
+ * behind an explicit flag + a loud warning in the CLI.
+ */
+import * as http from "node:http";
+import * as net from "node:net";
+import { timingSafeEqual } from "node:crypto";
+/** Constant-time token comparison that never throws on length mismatch. */
+function tokenMatches(expected, provided) {
+    if (!provided)
+        return false;
+    const a = Buffer.from(expected, "utf8");
+    const b = Buffer.from(provided, "utf8");
+    if (a.length !== b.length)
+        return false;
+    return timingSafeEqual(a, b);
+}
+/** Pull a candidate token from headers or the request URL. */
+function extractToken(reqUrl, headers) {
+    const auth = headers["authorization"];
+    if (typeof auth === "string" && auth.toLowerCase().startsWith("bearer ")) {
+        return auth.slice(7).trim();
+    }
+    const hdr = headers["x-brigade-token"];
+    if (typeof hdr === "string" && hdr.length > 0)
+        return hdr;
+    if (reqUrl) {
+        const qIdx = reqUrl.indexOf("?");
+        if (qIdx >= 0) {
+            const params = new URLSearchParams(reqUrl.slice(qIdx + 1));
+            const t = params.get("token");
+            if (t)
+                return t;
+        }
+    }
+    return undefined;
+}
+/**
+ * Start the auth-proxy. Resolves once it is listening; the returned handle
+ * carries the chosen port. The proxy lives until `stop()` (or the process
+ * exits).
+ */
+export async function startAuthProxy(opts) {
+    const { gatewayHost, gatewayPort, token, onLog } = opts;
+    const secured = typeof token === "string" && token.length > 0;
+    const sockets = new Set();
+    const authorize = (reqUrl, headers) => {
+        if (!secured)
+            return true;
+        return tokenMatches(token, extractToken(reqUrl, headers));
+    };
+    const server = http.createServer((req, res) => {
+        // Plain HTTP request path. The gateway is WS-first, but a few HTTP routes
+        // exist (plugin httpRoutes, health). Gate then forward verbatim.
+        if (!authorize(req.url, req.headers)) {
+            res.writeHead(401, { "content-type": "text/plain", "www-authenticate": "Bearer" });
+            res.end("401 Unauthorized — append ?token=<token> or send Authorization: Bearer <token>\n");
+            return;
+        }
+        const upstream = http.request({
+            host: gatewayHost,
+            port: gatewayPort,
+            method: req.method,
+            path: req.url,
+            headers: req.headers,
+        }, (upRes) => {
+            res.writeHead(upRes.statusCode ?? 502, upRes.headers);
+            upRes.pipe(res);
+        });
+        upstream.on("error", (err) => {
+            onLog?.(`http upstream error: ${err.message}`);
+            if (!res.headersSent)
+                res.writeHead(502, { "content-type": "text/plain" });
+            res.end("502 Bad Gateway\n");
+        });
+        req.pipe(upstream);
+    });
+    // WebSocket (and any other Upgrade) path — the primary traffic. We can't use
+    // the parsed `req` to forward, so reconstruct the raw HTTP upgrade request
+    // from `req.rawHeaders` and pipe both directions at the socket level.
+    server.on("upgrade", (req, clientSocket, head) => {
+        sockets.add(clientSocket);
+        clientSocket.on("close", () => sockets.delete(clientSocket));
+        if (!authorize(req.url, req.headers)) {
+            clientSocket.write("HTTP/1.1 401 Unauthorized\r\n" +
+                "Connection: close\r\n" +
+                "WWW-Authenticate: Bearer\r\n" +
+                "Content-Length: 0\r\n\r\n");
+            clientSocket.destroy();
+            return;
+        }
+        const upstream = net.connect(gatewayPort, gatewayHost, () => {
+            // Replay the upgrade request line + headers, then any buffered head.
+            const lines = [`${req.method} ${req.url} HTTP/${req.httpVersion}`];
+            for (let i = 0; i < req.rawHeaders.length; i += 2) {
+                lines.push(`${req.rawHeaders[i]}: ${req.rawHeaders[i + 1]}`);
+            }
+            upstream.write(lines.join("\r\n") + "\r\n\r\n");
+            if (head && head.length > 0)
+                upstream.write(head);
+            clientSocket.pipe(upstream);
+            upstream.pipe(clientSocket);
+        });
+        const teardown = () => {
+            try {
+                clientSocket.destroy();
+            }
+            catch { /* ignore */ }
+            try {
+                upstream.destroy();
+            }
+            catch { /* ignore */ }
+        };
+        upstream.on("error", (err) => {
+            onLog?.(`ws upstream error: ${err.message}`);
+            teardown();
+        });
+        clientSocket.on("error", teardown);
+    });
+    await new Promise((resolve, reject) => {
+        const onError = (err) => reject(err);
+        server.once("error", onError);
+        // Port 0 → OS assigns an ephemeral port. Bound to loopback only.
+        server.listen(0, "127.0.0.1", () => {
+            server.removeListener("error", onError);
+            resolve();
+        });
+    });
+    const address = server.address();
+    const port = typeof address === "object" && address ? address.port : 0;
+    if (!port)
+        throw new Error("auth-proxy failed to acquire a local port");
+    onLog?.(`auth-proxy listening on 127.0.0.1:${port} → ${gatewayHost}:${gatewayPort} (${secured ? "token-gated" : "OPEN/insecure"})`);
+    let stopped = false;
+    return {
+        port,
+        secured,
+        async stop() {
+            if (stopped)
+                return;
+            stopped = true;
+            for (const s of sockets) {
+                try {
+                    s.destroy();
+                }
+                catch { /* ignore */ }
+            }
+            sockets.clear();
+            await new Promise((resolve) => server.close(() => resolve()));
+        },
+    };
+}
+//# sourceMappingURL=auth-proxy.js.map

package/dist/core/tunnel/auth-proxy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-proxy.js","sourceRoot":"","sources":["../../../src/core/tunnel/auth-proxy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAEH,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,KAAK,GAAG,MAAM,UAAU,CAAC;AAEhC,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAsB9C,2EAA2E;AAC3E,SAAS,YAAY,CAAC,QAAgB,EAAE,QAA4B;IAClE,IAAI,CAAC,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC5B,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IACxC,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IACxC,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IACxC,OAAO,eAAe,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AAC/B,CAAC;AAED,8DAA8D;AAC9D,SAAS,YAAY,CAAC,MAA0B,EAAE,OAAiC;IACjF,MAAM,IAAI,GAAG,OAAO,CAAC,eAAe,CAAC,CAAC;IACtC,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QACzE,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAC9B,CAAC;IACD,MAAM,GAAG,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAAC;IACvC,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,GAAG,CAAC;IAC1D,IAAI,MAAM,EAAE,CAAC;QACX,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACjC,IAAI,IAAI,IAAI,CAAC,EAAE,CAAC;YACd,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC;YAC3D,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YAC9B,IAAI,CAAC;gBAAE,OAAO,CAAC,CAAC;QAClB,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,IAAsB;IACzD,MAAM,EAAE,WAAW,EAAE,WAAW,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,IAAI,CAAC;IACxD,MAAM,OAAO,GAAG,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC;IAC9D,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAElC,MAAM,SAAS,GAAG,CAAC,MAA0B,EAAE,OAAiC,EAAW,EAAE;QAC3F,IAAI,CAAC,OAAO;YAAE,OAAO,IAAI,CAAC;QAC1B,OAAO,YAAY,CAAC,KAAe,EAAE,YAAY,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IACtE,CAAC,CAAC;IAEF,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;QAC5C,0EAA0E;QAC1E,iEAAiE;QACjE,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;YACrC,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,YAAY,EAAE,kBAAkB,EAAE,QAAQ,EAAE,CAAC,CAAC;YACnF,GAAG,CAAC,GAAG,CAAC,kFAAkF,CAAC,CAAC;YAC5F,OAAO;QACT,CAAC;QACD,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAC3B;YACE,IAAI,EAAE,WAAW;YACjB,IAAI,EAAE,WAAW;YACjB,MAAM,EAAE,GAAG,CAAC,MAAM;YAClB,IAAI,EAAE,GAAG,CAAC,GAAG;YACb,OAAO,EAAE,GAAG,CAAC,OAAO;SACrB,EACD,CAAC,KAAK,EAAE,EAAE;YACR,GAAG,CAAC,SAAS,CAAC,KAAK,CAAC,UAAU,IAAI,GAAG,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;YACtD,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAClB,CAAC,CACF,CAAC;QACF,QAAQ,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;YAC3B,KAAK,EAAE,CAAC,wBAAwB,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;YAC/C,IAAI,CAAC,GAAG,CAAC,WAAW;gBAAE,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,YAAY,EAAE,CAAC,CAAC;YAC3E,GAAG,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC;QAC/B,CAAC,CAAC,CAAC;QACH,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACrB,CAAC,CAAC,CAAC;IAEH,6EAA6E;IAC7E,2EAA2E;IAC3E,sEAAsE;IACtE,MAAM,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC,GAAG,EAAE,YAAY,EAAE,IAAI,EAAE,EAAE;QAC/C,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QAC1B,YAAY,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC;QAE7D,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;YACrC,YAAY,CAAC,KAAK,CAChB,+BAA+B;gBAC7B,uBAAuB;gBACvB,8BAA8B;gBAC9B,2BAA2B,CAC9B,CAAC;YACF,YAAY,CAAC,OAAO,EAAE,CAAC;YACvB,OAAO;QACT,CAAC;QAED,MAAM,QAAQ,GAAG,GAAG,CAAC,OAAO,CAAC,WAAW,EAAE,WAAW,EAAE,GAAG,EAAE;YAC1D,qEAAqE;YACrE,MAAM,KAAK,GAAG,CAAC,GAAG,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,GAAG,SAAS,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC;YACnE,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,UAAU,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;gBAClD,KAAK,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,UAAU,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC;YAC/D,CAAC;YACD,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,UAAU,CAAC,CAAC;YAChD,IAAI,IAAI,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC;gBAAE,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YAClD,YAAY,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YAC5B,QAAQ,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QAC9B,CAAC,CAAC,CAAC;QAEH,MAAM,QAAQ,GAAG,GAAS,EAAE;YAC1B,IAAI,CAAC;gBAAC,YAAY,CAAC,OAAO,EAAE,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC;YACtD,IAAI,CAAC;gBAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC;QACpD,CAAC,CAAC;QACF,QAAQ,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;YAC3B,KAAK,EAAE,CAAC,sBAAsB,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;YAC7C,QAAQ,EAAE,CAAC;QACb,CAAC,CAAC,CAAC;QACH,YAAY,CAAC,EAAE,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IACrC,CAAC,CAAC,CAAC;IAEH,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QAC1C,MAAM,OAAO,GAAG,CAAC,GAAU,EAAQ,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAClD,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAC9B,iEAAiE;QACjE,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,WAAW,EAAE,GAAG,EAAE;YACjC,MAAM,CAAC,cAAc,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YACxC,OAAO,EAAE,CAAC;QACZ,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC;IACjC,MAAM,IAAI,GAAG,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IACvE,IAAI,CAAC,IAAI;QAAE,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;IACxE,KAAK,EAAE,CAAC,qCAAqC,IAAI,MAAM,WAAW,IAAI,WAAW,KAAK,OAAO,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,eAAe,GAAG,CAAC,CAAC;IAEpI,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,OAAO;QACL,IAAI;QACJ,OAAO;QACP,KAAK,CAAC,IAAI;YACR,IAAI,OAAO;gBAAE,OAAO;YACpB,OAAO,GAAG,IAAI,CAAC;YACf,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;gBACxB,IAAI,CAAC;oBAAC,CAAC,CAAC,OAAO,EAAE,CAAC;gBAAC,CAAC;gBAAC,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC;YAC7C,CAAC;YACD,OAAO,CAAC,KAAK,EAAE,CAAC;YAChB,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;QACtE,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/core/tunnel/manager.d.ts

@@ -0,0 +1,42 @@
+/**
+ * Tunnel manager — wires the auth-proxy + a provider into one running tunnel
+ * and records its state.
+ *
+ * Flow:
+ *   1. start the token-checking auth-proxy in front of the gateway
+ *   2. start the chosen provider, pointing it at the auth-proxy's local port
+ *   3. compose the public URL (with `?token=` when secured) + persist state
+ *
+ * `stop()` tears down provider then proxy and clears the state file. The
+ * gateway is never touched — it keeps running localhost-only.
+ */
+export interface StartTunnelOptions {
+    /** Provider name (resolved through the registry). */
+    provider: string;
+    /** Gateway host/port the auth-proxy forwards to. */
+    gatewayHost: string;
+    gatewayPort: number;
+    /** Bearer token gating the public URL. `undefined` → insecure pass-through. */
+    token?: string;
+    /** Self-hosted relay (`bore` / `custom`). */
+    relay?: string;
+    /** `custom` provider command template. */
+    command?: string;
+    /** Log sink for proxy + provider diagnostics. */
+    onLog?: (line: string) => void;
+}
+export interface RunningTunnel {
+    provider: string;
+    /** Public URL without the token. */
+    url: string;
+    /** Public URL with `?token=` appended when secured (else identical to `url`). */
+    urlWithToken: string;
+    /** Local auth-proxy port. */
+    proxyPort: number;
+    /** Whether the token gate is active. */
+    secured: boolean;
+    /** Tear everything down. Idempotent. */
+    stop(): Promise<void>;
+}
+export declare function startTunnel(opts: StartTunnelOptions): Promise<RunningTunnel>;
+//# sourceMappingURL=manager.d.ts.map

package/dist/core/tunnel/manager.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"manager.d.ts","sourceRoot":"","sources":["../../../src/core/tunnel/manager.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAOH,MAAM,WAAW,kBAAkB;IACjC,qDAAqD;IACrD,QAAQ,EAAE,MAAM,CAAC;IACjB,oDAAoD;IACpD,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,+EAA+E;IAC/E,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,6CAA6C;IAC7C,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,0CAA0C;IAC1C,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,iDAAiD;IACjD,KAAK,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;CAChC;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,EAAE,MAAM,CAAC;IACjB,oCAAoC;IACpC,GAAG,EAAE,MAAM,CAAC;IACZ,iFAAiF;IACjF,YAAY,EAAE,MAAM,CAAC;IACrB,6BAA6B;IAC7B,SAAS,EAAE,MAAM,CAAC;IAClB,wCAAwC;IACxC,OAAO,EAAE,OAAO,CAAC;IACjB,wCAAwC;IACxC,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACvB;AAQD,wBAAsB,WAAW,CAAC,IAAI,EAAE,kBAAkB,GAAG,OAAO,CAAC,aAAa,CAAC,CAwElF"}

package/dist/core/tunnel/manager.js

@@ -0,0 +1,102 @@
+/**
+ * Tunnel manager — wires the auth-proxy + a provider into one running tunnel
+ * and records its state.
+ *
+ * Flow:
+ *   1. start the token-checking auth-proxy in front of the gateway
+ *   2. start the chosen provider, pointing it at the auth-proxy's local port
+ *   3. compose the public URL (with `?token=` when secured) + persist state
+ *
+ * `stop()` tears down provider then proxy and clears the state file. The
+ * gateway is never touched — it keeps running localhost-only.
+ */
+import { startAuthProxy } from "./auth-proxy.js";
+import { getProvider } from "./registry.js";
+import { clearTunnelState, writeTunnelState } from "./state.js";
+/** Append the token as a query param without clobbering an existing query. */
+function withToken(url, token) {
+    const sep = url.includes("?") ? "&" : "?";
+    return `${url}${sep}token=${encodeURIComponent(token)}`;
+}
+export async function startTunnel(opts) {
+    const provider = getProvider(opts.provider);
+    // Fail fast on a provider that can't run (missing binary, missing command)
+    // BEFORE we open the proxy.
+    const avail = await provider.isAvailable({
+        localHost: opts.gatewayHost,
+        localPort: opts.gatewayPort,
+        relay: opts.relay,
+        command: opts.command,
+        onLog: opts.onLog,
+    });
+    if (!avail.ok) {
+        throw new Error(`tunnel provider "${opts.provider}" is unavailable: ${avail.reason ?? "unknown reason"}`);
+    }
+    let proxy;
+    let handle;
+    try {
+        proxy = await startAuthProxy({
+            gatewayHost: opts.gatewayHost,
+            gatewayPort: opts.gatewayPort,
+            token: opts.token,
+            onLog: opts.onLog,
+        });
+        handle = await provider.start({
+            localHost: "127.0.0.1",
+            localPort: proxy.port,
+            relay: opts.relay,
+            command: opts.command,
+            onLog: opts.onLog,
+        });
+        const secured = proxy.secured;
+        const url = handle.url;
+        const urlWithToken = secured && opts.token ? withToken(url, opts.token) : url;
+        await writeTunnelState({
+            url,
+            urlWithToken,
+            provider: opts.provider,
+            pid: process.pid,
+            proxyPort: proxy.port,
+            gatewayPort: opts.gatewayPort,
+            secured,
+            startedAt: Date.now(),
+        });
+        const proxyRef = proxy;
+        const handleRef = handle;
+        let stopped = false;
+        return {
+            provider: opts.provider,
+            url,
+            urlWithToken,
+            proxyPort: proxy.port,
+            secured,
+            async stop() {
+                if (stopped)
+                    return;
+                stopped = true;
+                try {
+                    await handleRef.stop();
+                }
+                catch { /* ignore */ }
+                try {
+                    await proxyRef.stop();
+                }
+                catch { /* ignore */ }
+                await clearTunnelState().catch(() => { });
+            },
+        };
+    }
+    catch (err) {
+        // Roll back partial startup so we never leak a proxy/provider process.
+        try {
+            await handle?.stop();
+        }
+        catch { /* ignore */ }
+        try {
+            await proxy?.stop();
+        }
+        catch { /* ignore */ }
+        throw err;
+    }
+}
+//# sourceMappingURL=manager.js.map

package/dist/core/tunnel/manager.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"manager.js","sourceRoot":"","sources":["../../../src/core/tunnel/manager.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,cAAc,EAAwB,MAAM,iBAAiB,CAAC;AACvE,OAAO,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAC5C,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAiChE,8EAA8E;AAC9E,SAAS,SAAS,CAAC,GAAW,EAAE,KAAa;IAC3C,MAAM,GAAG,GAAG,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;IAC1C,OAAO,GAAG,GAAG,GAAG,GAAG,SAAS,kBAAkB,CAAC,KAAK,CAAC,EAAE,CAAC;AAC1D,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,IAAwB;IACxD,MAAM,QAAQ,GAAG,WAAW,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAE5C,2EAA2E;IAC3E,4BAA4B;IAC5B,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,WAAW,CAAC;QACvC,SAAS,EAAE,IAAI,CAAC,WAAW;QAC3B,SAAS,EAAE,IAAI,CAAC,WAAW;QAC3B,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,KAAK,EAAE,IAAI,CAAC,KAAK;KAClB,CAAC,CAAC;IACH,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC;QACd,MAAM,IAAI,KAAK,CAAC,oBAAoB,IAAI,CAAC,QAAQ,qBAAqB,KAAK,CAAC,MAAM,IAAI,gBAAgB,EAAE,CAAC,CAAC;IAC5G,CAAC;IAED,IAAI,KAAkC,CAAC;IACvC,IAAI,MAAgC,CAAC;IACrC,IAAI,CAAC;QACH,KAAK,GAAG,MAAM,cAAc,CAAC;YAC3B,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,KAAK,EAAE,IAAI,CAAC,KAAK;SAClB,CAAC,CAAC;QAEH,MAAM,GAAG,MAAM,QAAQ,CAAC,KAAK,CAAC;YAC5B,SAAS,EAAE,WAAW;YACtB,SAAS,EAAE,KAAK,CAAC,IAAI;YACrB,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,KAAK,EAAE,IAAI,CAAC,KAAK;SAClB,CAAC,CAAC;QAEH,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC;QAC9B,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC;QACvB,MAAM,YAAY,GAAG,OAAO,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;QAE9E,MAAM,gBAAgB,CAAC;YACrB,GAAG;YACH,YAAY;YACZ,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,GAAG,EAAE,OAAO,CAAC,GAAG;YAChB,SAAS,EAAE,KAAK,CAAC,IAAI;YACrB,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,OAAO;YACP,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;SACtB,CAAC,CAAC;QAEH,MAAM,QAAQ,GAAG,KAAK,CAAC;QACvB,MAAM,SAAS,GAAG,MAAM,CAAC;QACzB,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,OAAO;YACL,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,GAAG;YACH,YAAY;YACZ,SAAS,EAAE,KAAK,CAAC,IAAI;YACrB,OAAO;YACP,KAAK,CAAC,IAAI;gBACR,IAAI,OAAO;oBAAE,OAAO;gBACpB,OAAO,GAAG,IAAI,CAAC;gBACf,IAAI,CAAC;oBAAC,MAAM,SAAS,CAAC,IAAI,EAAE,CAAC;gBAAC,CAAC;gBAAC,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC;gBACtD,IAAI,CAAC;oBAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;gBAAC,CAAC;gBAAC,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC;gBACrD,MAAM,gBAAgB,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;YAC3C,CAAC;SACF,CAAC;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,uEAAuE;QACvE,IAAI,CAAC;YAAC,MAAM,MAAM,EAAE,IAAI,EAAE,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC;QACpD,IAAI,CAAC;YAAC,MAAM,KAAK,EAAE,IAAI,EAAE,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC;QACnD,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC"}

package/dist/core/tunnel/providers/bore.d.ts

@@ -0,0 +1,18 @@
+/**
+ * bore provider — the OSS `bore` client (https://github.com/ekzhang/bore, MIT).
+ *
+ * A tiny TCP tunnel. WebSocket + HTTP pass through transparently because bore
+ * forwards raw TCP. The public relay `bore.pub` is anonymous; for a private
+ * relay the operator runs `bore server` on their own box and passes
+ * `--relay <host>` (or `cfg.gateway.tunnel.relay`) + sets `BORE_SECRET`.
+ *
+ * Trade-off vs cloudflare: bore gives `host:port` with NO TLS and no
+ * subdomain — the public URL is `http://<relay>:<port>` (ws over the same).
+ * That's the cost of a fully self-hostable, dependency-light OSS path.
+ *
+ * The `bore` binary is NOT auto-downloaded (it's a Rust release, and this is
+ * the "advanced / self-host" path). Resolve order: `$BRIGADE_BORE_BIN` → PATH.
+ */
+import type { TunnelProvider } from "../types.js";
+export declare const boreProvider: TunnelProvider;
+//# sourceMappingURL=bore.d.ts.map

package/dist/core/tunnel/providers/bore.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"bore.d.ts","sourceRoot":"","sources":["../../../../src/core/tunnel/providers/bore.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAKH,OAAO,KAAK,EAAoC,cAAc,EAAsB,MAAM,aAAa,CAAC;AAuBxG,eAAO,MAAM,YAAY,EAAE,cAsE1B,CAAC"}

package/dist/core/tunnel/providers/bore.js

@@ -0,0 +1,117 @@
+/**
+ * bore provider — the OSS `bore` client (https://github.com/ekzhang/bore, MIT).
+ *
+ * A tiny TCP tunnel. WebSocket + HTTP pass through transparently because bore
+ * forwards raw TCP. The public relay `bore.pub` is anonymous; for a private
+ * relay the operator runs `bore server` on their own box and passes
+ * `--relay <host>` (or `cfg.gateway.tunnel.relay`) + sets `BORE_SECRET`.
+ *
+ * Trade-off vs cloudflare: bore gives `host:port` with NO TLS and no
+ * subdomain — the public URL is `http://<relay>:<port>` (ws over the same).
+ * That's the cost of a fully self-hostable, dependency-light OSS path.
+ *
+ * The `bore` binary is NOT auto-downloaded (it's a Rust release, and this is
+ * the "advanced / self-host" path). Resolve order: `$BRIGADE_BORE_BIN` → PATH.
+ */
+import { spawn, spawnSync } from "node:child_process";
+import * as fs from "node:fs";
+const DEFAULT_RELAY = "bore.pub";
+// bore prints e.g. `listening at bore.pub:41734`.
+const BORE_PORT_RE = /listening at\s+([^\s:]+):(\d+)/i;
+const URL_WAIT_MS = 20_000;
+function resolveBoreBin() {
+    const envBin = process.env.BRIGADE_BORE_BIN?.trim();
+    if (envBin && fs.existsSync(envBin))
+        return envBin;
+    const probe = process.platform === "win32" ? "where" : "which";
+    try {
+        const res = spawnSync(probe, ["bore"], { encoding: "utf8" });
+        if (res.status === 0) {
+            const first = res.stdout.split(/\r?\n/).map((l) => l.trim()).find(Boolean);
+            if (first)
+                return process.platform === "win32" ? first : "bore";
+        }
+    }
+    catch {
+        // probe tool missing
+    }
+    return undefined;
+}
+export const boreProvider = {
+    name: "bore",
+    label: "bore (OSS TCP tunnel; self-hostable relay)",
+    async isAvailable() {
+        if (resolveBoreBin())
+            return { ok: true };
+        return {
+            ok: false,
+            reason: "the `bore` binary was not found. Install it (https://github.com/ekzhang/bore — `cargo install bore-cli` " +
+                "or download a release) and ensure it's on PATH, or set BRIGADE_BORE_BIN.",
+        };
+    },
+    async start(opts) {
+        const bin = resolveBoreBin();
+        if (!bin)
+            throw new Error("bore binary not found (set BRIGADE_BORE_BIN or install bore)");
+        const relay = opts.relay?.trim() || DEFAULT_RELAY;
+        const args = ["local", String(opts.localPort), "--to", relay];
+        const child = spawn(bin, args, { stdio: ["ignore", "pipe", "pipe"] });
+        const url = await new Promise((resolve, reject) => {
+            let settled = false;
+            const timer = setTimeout(() => {
+                if (settled)
+                    return;
+                settled = true;
+                try {
+                    child.kill();
+                }
+                catch { /* ignore */ }
+                reject(new Error(`bore did not report a public port within ${URL_WAIT_MS / 1000}s`));
+            }, URL_WAIT_MS);
+            const scan = (chunk) => {
+                const text = chunk.toString();
+                for (const line of text.split(/\r?\n/)) {
+                    if (line.trim())
+                        opts.onLog?.(line.trim());
+                }
+                const m = text.match(BORE_PORT_RE);
+                if (m && !settled) {
+                    settled = true;
+                    clearTimeout(timer);
+                    resolve(`http://${m[1]}:${m[2]}`);
+                }
+            };
+            child.stdout?.on("data", scan);
+            child.stderr?.on("data", scan);
+            child.on("error", (err) => {
+                if (settled)
+                    return;
+                settled = true;
+                clearTimeout(timer);
+                reject(err);
+            });
+            child.on("exit", (code) => {
+                if (settled)
+                    return;
+                settled = true;
+                clearTimeout(timer);
+                reject(new Error(`bore exited (code ${code ?? "?"}) before reporting a port`));
+            });
+        });
+        let stopped = false;
+        return {
+            provider: "bore",
+            url,
+            async stop() {
+                if (stopped)
+                    return;
+                stopped = true;
+                try {
+                    child.kill();
+                }
+                catch { /* ignore */ }
+            },
+        };
+    },
+};
+//# sourceMappingURL=bore.js.map

package/dist/core/tunnel/providers/bore.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bore.js","sourceRoot":"","sources":["../../../../src/core/tunnel/providers/bore.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAE,KAAK,EAAE,SAAS,EAAqB,MAAM,oBAAoB,CAAC;AACzE,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAI9B,MAAM,aAAa,GAAG,UAAU,CAAC;AACjC,kDAAkD;AAClD,MAAM,YAAY,GAAG,iCAAiC,CAAC;AACvD,MAAM,WAAW,GAAG,MAAM,CAAC;AAE3B,SAAS,cAAc;IACrB,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,gBAAgB,EAAE,IAAI,EAAE,CAAC;IACpD,IAAI,MAAM,IAAI,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC;QAAE,OAAO,MAAM,CAAC;IACnD,MAAM,KAAK,GAAG,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC;IAC/D,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,SAAS,CAAC,KAAK,EAAE,CAAC,MAAM,CAAC,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;QAC7D,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACrB,MAAM,KAAK,GAAG,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAC3E,IAAI,KAAK;gBAAE,OAAO,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC;QAClE,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,qBAAqB;IACvB,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,MAAM,CAAC,MAAM,YAAY,GAAmB;IAC1C,IAAI,EAAE,MAAM;IACZ,KAAK,EAAE,4CAA4C;IAEnD,KAAK,CAAC,WAAW;QACf,IAAI,cAAc,EAAE;YAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;QAC1C,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EACJ,0GAA0G;gBAC1G,0EAA0E;SAC7E,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,IAAwB;QAClC,MAAM,GAAG,GAAG,cAAc,EAAE,CAAC;QAC7B,IAAI,CAAC,GAAG;YAAE,MAAM,IAAI,KAAK,CAAC,8DAA8D,CAAC,CAAC;QAC1F,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,aAAa,CAAC;QAClD,MAAM,IAAI,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;QAE9D,MAAM,KAAK,GAAiB,KAAK,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;QAEpF,MAAM,GAAG,GAAG,MAAM,IAAI,OAAO,CAAS,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACxD,IAAI,OAAO,GAAG,KAAK,CAAC;YACpB,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;gBAC5B,IAAI,OAAO;oBAAE,OAAO;gBACpB,OAAO,GAAG,IAAI,CAAC;gBACf,IAAI,CAAC;oBAAC,KAAK,CAAC,IAAI,EAAE,CAAC;gBAAC,CAAC;gBAAC,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC;gBAC5C,MAAM,CAAC,IAAI,KAAK,CAAC,4CAA4C,WAAW,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC;YACvF,CAAC,EAAE,WAAW,CAAC,CAAC;YAEhB,MAAM,IAAI,GAAG,CAAC,KAAa,EAAQ,EAAE;gBACnC,MAAM,IAAI,GAAG,KAAK,CAAC,QAAQ,EAAE,CAAC;gBAC9B,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;oBACvC,IAAI,IAAI,CAAC,IAAI,EAAE;wBAAE,IAAI,CAAC,KAAK,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;gBAC7C,CAAC;gBACD,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;gBACnC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;oBAClB,OAAO,GAAG,IAAI,CAAC;oBACf,YAAY,CAAC,KAAK,CAAC,CAAC;oBACpB,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;gBACpC,CAAC;YACH,CAAC,CAAC;YACF,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;YAC/B,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;YAC/B,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;gBACxB,IAAI,OAAO;oBAAE,OAAO;gBACpB,OAAO,GAAG,IAAI,CAAC;gBACf,YAAY,CAAC,KAAK,CAAC,CAAC;gBACpB,MAAM,CAAC,GAAG,CAAC,CAAC;YACd,CAAC,CAAC,CAAC;YACH,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE;gBACxB,IAAI,OAAO;oBAAE,OAAO;gBACpB,OAAO,GAAG,IAAI,CAAC;gBACf,YAAY,CAAC,KAAK,CAAC,CAAC;gBACpB,MAAM,CAAC,IAAI,KAAK,CAAC,qBAAqB,IAAI,IAAI,GAAG,2BAA2B,CAAC,CAAC,CAAC;YACjF,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QAEH,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,OAAO;YACL,QAAQ,EAAE,MAAM;YAChB,GAAG;YACH,KAAK,CAAC,IAAI;gBACR,IAAI,OAAO;oBAAE,OAAO;gBACpB,OAAO,GAAG,IAAI,CAAC;gBACf,IAAI,CAAC;oBAAC,KAAK,CAAC,IAAI,EAAE,CAAC;gBAAC,CAAC;gBAAC,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC;YAC9C,CAAC;SACF,CAAC;IACJ,CAAC;CACF,CAAC"}

package/dist/core/tunnel/providers/cloudflared.d.ts

@@ -0,0 +1,24 @@
+/**
+ * Cloudflare provider — anonymous TryCloudflare quick tunnel.
+ *
+ * The default `brigade expose` backend. No account, no signup: cloudflared
+ * dials Cloudflare's edge and we get a random `https://<x>.trycloudflare.com`
+ * URL that terminates TLS at the edge and proxies straight to our local
+ * auth-proxy. WebSockets work by default (the gateway is WS-first).
+ *
+ * The `cloudflared` binary (Apache-2.0) is NOT a hard npm dependency — that
+ * would add a ~30 MB download to every Brigade install. Instead we resolve it
+ * lazily at expose time:
+ *   1. `$BRIGADE_CLOUDFLARED_BIN`
+ *   2. `cloudflared` on PATH (system install)
+ *   3. a Brigade-managed copy in the OS cache dir
+ *   4. download the official release into the cache dir (once)
+ *
+ * Caveat (documented in the research): TryCloudflare quick tunnels don't
+ * support SSE and cap in-flight requests; that's fine for a personal WS
+ * gateway. For a stable URL the operator can point a self-host provider at
+ * their own relay instead.
+ */
+import type { TunnelProvider } from "../types.js";
+export declare const cloudflareProvider: TunnelProvider;
+//# sourceMappingURL=cloudflared.d.ts.map

package/dist/core/tunnel/providers/cloudflared.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cloudflared.d.ts","sourceRoot":"","sources":["../../../../src/core/tunnel/providers/cloudflared.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAQH,OAAO,KAAK,EAAoC,cAAc,EAAsB,MAAM,aAAa,CAAC;AAqFxG,eAAO,MAAM,kBAAkB,EAAE,cAkEhC,CAAC"}