@studiometa/trafic-agent 0.1.38 → 0.1.40

package/dist/cli.js

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
-import { g as validateConfig, i as runPendingMigrations, m as loadConfig, n as setup, r as listMigrations, s as startIdleScheduler, t as audit } from "./setup-BFU-DlX3.js";
-import { E as exec, M as step, N as success, O as info, P as warn, h as closeDb, k as isRoot, n as startServer } from "./server-CvSztHW2.js";
+import { g as validateConfig, i as runPendingMigrations, m as loadConfig, n as setup, r as listMigrations, s as startIdleScheduler, t as audit } from "./setup-DxoFhMfT.js";
+import { L as step, N as info, P as isRoot, R as success, b as closeDb, j as exec, s as startServer, z as warn } from "./server-BAjHxgqh.js";
 import { readFileSync } from "node:fs";
 import { execSync, spawnSync } from "node:child_process";
 import { parseArgs } from "node:util";
@@ -92,6 +92,20 @@ function reExecNewBinary(args) {
 function restartAgentService(dryRun) {
 	exec("systemctl restart trafic-agent", { silent: !dryRun });
 }
+/** The real collaborators, used unless a caller passes their own. */
+function nodeUpgradeIo() {
+	return {
+		currentVersion: "0.1.40",
+		alreadyReExeced: process.env["TRAFIC_UPGRADE_REEXEC"] === "1",
+		isRoot,
+		fetchLatestVersion,
+		installLatestAgent,
+		getInstalledVersion,
+		reExecNewBinary,
+		restartAgentService,
+		runPendingMigrations
+	};
+}
 /**
 * Full upgrade sequence:
 *  1. Check for a new version on npm
@@ -100,34 +114,34 @@ function restartAgentService(dryRun) {
 *  3. Run pending migrations
 *  4. Restart the systemd service
 */
-function runUpgrade(dryRun = false, reExecArgs) {
-	if (!isRoot() && !dryRun) {
+function runUpgrade(dryRun = false, reExecArgs, io = nodeUpgradeIo()) {
+	if (!io.isRoot() && !dryRun) {
 		console.error("    \x1B[31m✗\x1B[0m This command must be run as root");
 		console.log("  Run: sudo trafic-agent upgrade");
 		process.exit(1);
 	}
-	const alreadyReExeced = process.env["TRAFIC_UPGRADE_REEXEC"] === "1";
+	const alreadyReExeced = io.alreadyReExeced;
 	step("Check for updates");
-	const current = "0.1.38";
+	const current = io.currentVersion;
 	info(`Current version: ${current}`);
-	const latest = fetchLatestVersion();
+	const latest = io.fetchLatestVersion();
 	if (!latest) warn("Could not reach npm registry — skipping version check");
 	else if (isNewer(current, latest)) {
 		success(`New version available: ${latest}`);
 		step("Install latest version");
-		installLatestAgent(dryRun);
+		io.installLatestAgent(dryRun);
 		if (!dryRun) {
-			const installedVersion = getInstalledVersion();
+			const installedVersion = io.getInstalledVersion();
 			if (!alreadyReExeced && installedVersion && isNewer(current, installedVersion)) {
 				success(`Installed @studiometa/trafic-agent@${installedVersion}`);
-				reExecNewBinary(reExecArgs ?? ["upgrade"]);
+				io.reExecNewBinary(reExecArgs ?? ["upgrade"]);
 			} else if (installedVersion) success(`Installed @studiometa/trafic-agent@${installedVersion}`);
 		}
 	} else success(`Already up to date (${current})`);
 	step("Run pending migrations");
-	runPendingMigrations(dryRun);
+	io.runPendingMigrations(dryRun);
 	step("Restart trafic-agent service");
-	restartAgentService(dryRun);
+	io.restartAgentService(dryRun);
 	if (!dryRun) success("Service restarted");
 }
 //#endregion
@@ -191,7 +205,7 @@ function printHelp() {
 	console.log(HELP.trim());
 }
 function printVersion() {
-	console.log("0.1.38");
+	console.log("0.1.40");
 }
 async function runStart(values) {
 	const config = loadConfig(values.config);

package/dist/cli.js.map

@@ -1 +1 @@
-{"version":3,"file":"cli.js","names":[],"sources":["../src/setup/upgrade.ts","../src/cli.ts"],"sourcesContent":["import { execSync, spawnSync } from \"node:child_process\";\nimport { readFileSync } from \"node:fs\";\nimport { step, success, info, warn, exec, isRoot } from \"./steps.js\";\nimport { runPendingMigrations } from \"./migrations/index.js\";\n\ndeclare const __VERSION__: string;\n\n/**\n * Fetch the latest published version of @studiometa/trafic-agent from the npm registry.\n * Returns null if the registry is unreachable.\n */\nexport function fetchLatestVersion(): string | null {\n  try {\n    return execSync(\"npm show @studiometa/trafic-agent version\", {\n      encoding: \"utf-8\",\n      stdio: \"pipe\",\n    }).trim();\n  } catch {\n    return null;\n  }\n}\n\n/**\n * Compare two semver strings. Returns true if `next` is strictly greater than `current`.\n * Handles simple MAJOR.MINOR.PATCH without pre-release suffixes.\n */\nexport function isNewer(current: string, next: string): boolean {\n  const parse = (v: string): [number, number, number] => {\n    const parts = v.replace(/^v/, \"\").split(\".\").map(Number);\n    return [parts[0] ?? 0, parts[1] ?? 0, parts[2] ?? 0];\n  };\n\n  const [cMaj, cMin, cPat] = parse(current);\n  const [nMaj, nMin, nPat] = parse(next);\n\n  if (nMaj !== cMaj) return nMaj > cMaj;\n  if (nMin !== cMin) return nMin > cMin;\n  return nPat > cPat;\n}\n\n/**\n * Install the latest version of @studiometa/trafic-agent globally via npm.\n * Uses --prefer-online to bypass the local npm cache and always fetch the\n * latest published tarball.\n */\nexport function installLatestAgent(dryRun: boolean): void {\n  exec(\"npm install -g @studiometa/trafic-agent@latest --prefer-online\", { silent: !dryRun });\n}\n\n/**\n * Read the actual installed version of @studiometa/trafic-agent from its\n * package.json on disk — not from __VERSION__ which is baked in at build time.\n *\n * Resolves the package root by walking up from the trafic-agent binary:\n *   /usr/bin/trafic-agent -> /usr/lib/node_modules/@studiometa/trafic-agent/dist/cli.js\n *   -> /usr/lib/node_modules/@studiometa/trafic-agent/package.json\n *\n * Returns null if the file can't be read.\n */\nexport function getInstalledVersion(): string | null {\n  try {\n    // Resolve the real path of the binary (follow symlinks)\n    const realBinary = execSync(\"readlink -f $(which trafic-agent)\", {\n      encoding: \"utf-8\",\n      stdio: \"pipe\",\n    }).trim();\n    // dist/cli.js -> up two dirs -> package root\n    const pkgJson = `${realBinary.replace(/\\/dist\\/cli\\.js$/, \"\")}/package.json`;\n    const pkg = JSON.parse(readFileSync(pkgJson, \"utf-8\")) as { version: string };\n    return pkg.version;\n  } catch {\n    return null;\n  }\n}\n\n/**\n * Re-exec the newly installed trafic-agent binary with the same arguments.\n * Used after a self-update so the new binary runs its own migrations.\n * This function never returns — it replaces the current process.\n */\nexport function reExecNewBinary(args: string[]): never {\n  const binary = execSync(\"which trafic-agent\", { encoding: \"utf-8\", stdio: \"pipe\" }).trim();\n  const result = spawnSync(binary, args, {\n    stdio: \"inherit\",\n    env: { ...process.env, TRAFIC_UPGRADE_REEXEC: \"1\" },\n  });\n  process.exit(result.status ?? 0);\n}\n\n/**\n * Restart the trafic-agent systemd service.\n */\nexport function restartAgentService(dryRun: boolean): void {\n  exec(\"systemctl restart trafic-agent\", { silent: !dryRun });\n}\n\n/**\n * Full upgrade sequence:\n *  1. Check for a new version on npm\n *  2. Install it globally if one is found — then re-exec the new binary\n *     so that steps 3 and 4 run with the new migration registry\n *  3. Run pending migrations\n *  4. Restart the systemd service\n */\nexport function runUpgrade(dryRun = false, reExecArgs?: string[]): void {\n  if (!isRoot() && !dryRun) {\n    console.error(\"    \\x1b[31m✗\\x1b[0m This command must be run as root\");\n    console.log(\"  Run: sudo trafic-agent upgrade\");\n    process.exit(1);\n  }\n\n  // Guard against infinite re-exec loops: only re-exec once per upgrade run.\n  const alreadyReExeced = process.env[\"TRAFIC_UPGRADE_REEXEC\"] === \"1\";\n\n  // ── Step 1: Check for updates ─────────────────────────────────────────────\n  step(\"Check for updates\");\n\n  const current = __VERSION__;\n  info(`Current version: ${current}`);\n\n  const latest = fetchLatestVersion();\n\n  if (!latest) {\n    warn(\"Could not reach npm registry — skipping version check\");\n  } else if (isNewer(current, latest)) {\n    success(`New version available: ${latest}`);\n\n    // ── Step 2: Install ───────────────────────────────────────────────────\n    step(\"Install latest version\");\n    installLatestAgent(dryRun);\n\n    if (!dryRun) {\n      // Verify the installed version actually changed before re-execing —\n      // npm can serve stale cache and leave the old binary in place.\n      const installedVersion = getInstalledVersion();\n\n      if (!alreadyReExeced && installedVersion && isNewer(current, installedVersion)) {\n        success(`Installed @studiometa/trafic-agent@${installedVersion}`);\n        // Re-exec the newly installed binary so steps 3 and 4 run with the\n        // new migration registry — the current process only knows about\n        // migrations that existed at the time it was compiled.\n        reExecNewBinary(reExecArgs ?? [\"upgrade\"]);\n      } else if (installedVersion) {\n        success(`Installed @studiometa/trafic-agent@${installedVersion}`);\n      }\n    }\n  } else {\n    success(`Already up to date (${current})`);\n  }\n\n  // ── Step 3: Run pending migrations ───────────────────────────────────────\n  step(\"Run pending migrations\");\n  runPendingMigrations(dryRun);\n\n  // ── Step 4: Restart service ───────────────────────────────────────────────\n  step(\"Restart trafic-agent service\");\n  restartAgentService(dryRun);\n  if (!dryRun) {\n    success(\"Service restarted\");\n  }\n}\n","#!/usr/bin/env node\n\nimport { parseArgs } from \"node:util\";\nimport { loadConfig, validateConfig } from \"./utils/config.js\";\nimport { startServer } from \"./server.js\";\nimport { startIdleScheduler } from \"./tasks/stop-idle.js\";\nimport { closeDb } from \"./utils/db.js\";\nimport { setup, audit } from \"./setup/index.js\";\nimport { listMigrations } from \"./setup/migrations/index.js\";\nimport { runUpgrade } from \"./setup/upgrade.js\";\n\ndeclare const __VERSION__: string;\n\nconst HELP = `\ntrafic-agent — Server agent for DDEV preview environments\n\nUsage:\n  trafic-agent <command> [options]\n\nCommands:\n  start                   Start the agent server\n  setup                   Setup a new server (Docker, DDEV, hardening)\n  upgrade                 Check for a new version, install it, run migrations, restart the service\n  update                  Alias for upgrade\n  audit                   Run security audit checks\n  version                 Show version\n  help                    Show this help\n\nStart options:\n  -c, --config <path>     Path to config file (default: /etc/trafic/config.toml)\n  -p, --port <port>       Override port from config\n\nSetup options:\n  --tld <domain>          TLD for DDEV projects (required on first run, reused from config on re-runs)\n  --email <email>         Email for Let's Encrypt certificates\n  --no-hardening          Skip server hardening steps\n  --no-root-ssh           Disable root SSH login (recovery via rescue mode only)\n  --no-docker             Skip Docker installation\n  --no-ddev               Skip DDEV installation\n  --ssh-users <users>     Comma-separated list of SSH users to allow (default: ddev)\n  --trusted-proxy-hops <n> Proxies in front of the agent (default: 1; 2 behind a CDN).\n                          Written to the generated config; ignored if one exists\n  --dry-run               Show what would be done without making changes\n\nUpgrade/update options:\n  --dry-run               Show what would be done without making changes\n  --list                  List all migrations and their status (no install or restart)\n\nExamples:\n  # Start the agent\n  trafic-agent start\n  trafic-agent start --config /path/to/config.toml\n\n  # Setup a new server\n  sudo trafic-agent setup --tld=previews.example.com\n  sudo trafic-agent setup --tld=previews.example.com --trusted-proxy-hops=2\n  sudo trafic-agent setup --tld=previews.example.com --email=admin@example.com\n  sudo trafic-agent setup --tld=previews.example.com --no-hardening --dry-run\n\n  # Upgrade: install latest version, run migrations, restart service\n  sudo trafic-agent upgrade\n  sudo trafic-agent upgrade --dry-run\n  trafic-agent upgrade --list\n  sudo trafic-agent update          # alias for upgrade\n\n  # Run security audit\n  trafic-agent audit\n`;\n\nfunction printHelp(): void {\n  console.log(HELP.trim());\n}\n\nfunction printVersion(): void {\n  console.log(__VERSION__);\n}\n\nasync function runStart(values: Record<string, unknown>): Promise<void> {\n  // Load config\n  const config = loadConfig(values.config as string | undefined);\n\n  // Override port if specified\n  if (values.port) {\n    config.port = parseInt(values.port as string, 10);\n  }\n\n  // Validate config\n  const errors = validateConfig(config);\n  if (errors.length > 0) {\n    console.error(\"Configuration errors:\");\n    for (const error of errors) {\n      console.error(`  - ${error}`);\n    }\n    process.exit(1);\n  }\n\n  // Graceful shutdown\n  const shutdown = (): void => {\n    console.log(\"\\nShutting down...\");\n    closeDb();\n    process.exit(0);\n  };\n\n  process.on(\"SIGINT\", shutdown);\n  process.on(\"SIGTERM\", shutdown);\n\n  // Start server and scheduler\n  startServer(config);\n  startIdleScheduler(config);\n}\n\nfunction handleUpgrade(values: Record<string, unknown>): void {\n  const dryRun = values[\"dry-run\"] as boolean | undefined;\n  const list = values.list as boolean | undefined;\n\n  if (list) {\n    const entries = listMigrations();\n    console.log(\"\\nMigrations:\\n\");\n\n    for (const { migration, status } of entries) {\n      const icon = status === \"applied\" ? \"\\x1b[32m✓\\x1b[0m\" : \"\\x1b[36m→\\x1b[0m\";\n      const label = status === \"applied\" ? \"\\x1b[90m(applied)\\x1b[0m\" : \"(pending)\";\n      console.log(`  ${icon} \\x1b[1m${migration.id.padEnd(30)}\\x1b[0m ${migration.description.padEnd(55)} ${label}`);\n    }\n\n    console.log(\"\");\n    return;\n  }\n\n  console.log(\"\\n\\x1b[1m🚦 Trafic Server Upgrade\\x1b[0m\\n\");\n\n  if (dryRun) {\n    console.log(\"\\x1b[33m⚠ Dry-run mode: no changes will be made\\x1b[0m\\n\");\n  }\n\n  // Build re-exec args so flags survive the binary swap after a self-update\n  const reExecArgs = [\"upgrade\", ...(dryRun ? [\"--dry-run\"] : [])];\n  runUpgrade(dryRun ?? false, reExecArgs);\n\n  if (!dryRun) {\n    console.log(\"\\n\\x1b[32m✓ Upgrade complete!\\x1b[0m\\n\");\n  }\n}\n\n/**\n * Parse --trusted-proxy-hops, failing loudly rather than writing a config\n * that would quietly break the IP allowlist.\n */\nfunction parseTrustedProxyHops(raw?: string): number | undefined {\n  if (raw === undefined) {\n    return undefined;\n  }\n\n  const hops = Number(raw);\n\n  if (!Number.isInteger(hops) || hops < 1) {\n    console.error(\n      `Error: --trusted-proxy-hops must be a whole number of 1 or more, got \"${raw}\"`,\n    );\n    console.error(\"  1 = ddev-router/Traefik alone, 2 = a CDN in front of it\");\n    process.exit(1);\n  }\n\n  return hops;\n}\n\nasync function runSetup(values: Record<string, unknown>): Promise<void> {\n  // Load existing config to use as defaults on re-runs\n  const existingConfig = loadConfig();\n  const tld = (values.tld as string | undefined) ?? (existingConfig.tld || undefined);\n\n  if (!tld) {\n    console.error(\"Error: --tld is required for setup\");\n    console.error(\"Example: trafic-agent setup --tld=previews.example.com\");\n    process.exit(1);\n  }\n\n  await setup({\n    tld,\n    trustedProxyHops: parseTrustedProxyHops(values[\"trusted-proxy-hops\"] as string | undefined),\n    email: values.email as string | undefined,\n    noHardening: values[\"no-hardening\"] as boolean | undefined,\n    noRootSsh: values[\"no-root-ssh\"] as boolean | undefined,\n    noDocker: values[\"no-docker\"] as boolean | undefined,\n    noDdev: values[\"no-ddev\"] as boolean | undefined,\n    sshUsers: values[\"ssh-users\"]\n      ? (values[\"ssh-users\"] as string).split(\",\").map((s) => s.trim())\n      : undefined,\n    dryRun: values[\"dry-run\"] as boolean | undefined,\n  });\n}\n\nasync function main(): Promise<void> {\n  const { values, positionals } = parseArgs({\n    allowPositionals: true,\n    options: {\n      // Common\n      help: { type: \"boolean\", short: \"h\" },\n\n      // Start options\n      config: { type: \"string\", short: \"c\" },\n      port: { type: \"string\", short: \"p\" },\n\n      // Setup options\n      tld: { type: \"string\" },\n      email: { type: \"string\" },\n      \"no-hardening\": { type: \"boolean\" },\n      \"no-root-ssh\": { type: \"boolean\" },\n      \"no-docker\": { type: \"boolean\" },\n      \"no-ddev\": { type: \"boolean\" },\n      \"ssh-users\": { type: \"string\" },\n      \"trusted-proxy-hops\": { type: \"string\" },\n      \"dry-run\": { type: \"boolean\" },\n\n      // Upgrade options\n      list: { type: \"boolean\" },\n    },\n  });\n\n  const command = positionals[0] ?? \"help\";\n\n  if (values.help) {\n    printHelp();\n    process.exit(0);\n  }\n\n  switch (command) {\n    case \"help\":\n      printHelp();\n      break;\n\n    case \"version\":\n      printVersion();\n      break;\n\n    case \"start\":\n      await runStart(values);\n      break;\n\n    case \"setup\":\n      await runSetup(values);\n      break;\n\n    case \"upgrade\":\n    case \"update\":\n      handleUpgrade(values);\n      break;\n\n    case \"audit\":\n      await audit();\n      break;\n\n    default:\n      console.error(`Unknown command: ${command}`);\n      printHelp();\n      process.exit(1);\n  }\n}\n\nmain().catch((error) => {\n  console.error(\"Fatal error:\", error);\n  process.exit(1);\n});\n"],"mappings":";;;;;;;;;;;AAWA,SAAgB,qBAAoC;CAClD,IAAI;EACF,OAAO,SAAS,6CAA6C;GAC3D,UAAU;GACV,OAAO;EACT,CAAC,CAAC,CAAC,KAAK;CACV,QAAQ;EACN,OAAO;CACT;AACF;;;;;AAMA,SAAgB,QAAQ,SAAiB,MAAuB;CAC9D,MAAM,SAAS,MAAwC;EACrD,MAAM,QAAQ,EAAE,QAAQ,MAAM,EAAE,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,IAAI,MAAM;EACvD,OAAO;GAAC,MAAM,MAAM;GAAG,MAAM,MAAM;GAAG,MAAM,MAAM;EAAC;CACrD;CAEA,MAAM,CAAC,MAAM,MAAM,QAAQ,MAAM,OAAO;CACxC,MAAM,CAAC,MAAM,MAAM,QAAQ,MAAM,IAAI;CAErC,IAAI,SAAS,MAAM,OAAO,OAAO;CACjC,IAAI,SAAS,MAAM,OAAO,OAAO;CACjC,OAAO,OAAO;AAChB;;;;;;AAOA,SAAgB,mBAAmB,QAAuB;CACxD,KAAK,kEAAkE,EAAE,QAAQ,CAAC,OAAO,CAAC;AAC5F;;;;;;;;;;;AAYA,SAAgB,sBAAqC;CACnD,IAAI;EAOF,MAAM,UAAU,GALG,SAAS,qCAAqC;GAC/D,UAAU;GACV,OAAO;EACT,CAAC,CAAC,CAAC,KAEgB,CAAA,CAAW,QAAQ,oBAAoB,EAAE,EAAE;EAE9D,OADY,KAAK,MAAM,aAAa,SAAS,OAAO,CAC7C,CAAA,CAAI;CACb,QAAQ;EACN,OAAO;CACT;AACF;;;;;;AAOA,SAAgB,gBAAgB,MAAuB;CACrD,MAAM,SAAS,SAAS,sBAAsB;EAAE,UAAU;EAAS,OAAO;CAAO,CAAC,CAAC,CAAC,KAAK;CACzF,MAAM,SAAS,UAAU,QAAQ,MAAM;EACrC,OAAO;EACP,KAAK;GAAE,GAAG,QAAQ;GAAK,uBAAuB;EAAI;CACpD,CAAC;CACD,QAAQ,KAAK,OAAO,UAAU,CAAC;AACjC;;;;AAKA,SAAgB,oBAAoB,QAAuB;CACzD,KAAK,kCAAkC,EAAE,QAAQ,CAAC,OAAO,CAAC;AAC5D;;;;;;;;;AAUA,SAAgB,WAAW,SAAS,OAAO,YAA6B;CACtE,IAAI,CAAC,OAAO,KAAK,CAAC,QAAQ;EACxB,QAAQ,MAAM,uDAAuD;EACrE,QAAQ,IAAI,kCAAkC;EAC9C,QAAQ,KAAK,CAAC;CAChB;CAGA,MAAM,kBAAkB,QAAQ,IAAI,6BAA6B;CAGjE,KAAK,mBAAmB;CAExB,MAAM,UAAA;CACN,KAAK,oBAAoB,SAAS;CAElC,MAAM,SAAS,mBAAmB;CAElC,IAAI,CAAC,QACH,KAAK,uDAAuD;MACvD,IAAI,QAAQ,SAAS,MAAM,GAAG;EACnC,QAAQ,0BAA0B,QAAQ;EAG1C,KAAK,wBAAwB;EAC7B,mBAAmB,MAAM;EAEzB,IAAI,CAAC,QAAQ;GAGX,MAAM,mBAAmB,oBAAoB;GAE7C,IAAI,CAAC,mBAAmB,oBAAoB,QAAQ,SAAS,gBAAgB,GAAG;IAC9E,QAAQ,sCAAsC,kBAAkB;IAIhE,gBAAgB,cAAc,CAAC,SAAS,CAAC;GAC3C,OAAO,IAAI,kBACT,QAAQ,sCAAsC,kBAAkB;EAEpE;CACF,OACE,QAAQ,uBAAuB,QAAQ,EAAE;CAI3C,KAAK,wBAAwB;CAC7B,qBAAqB,MAAM;CAG3B,KAAK,8BAA8B;CACnC,oBAAoB,MAAM;CAC1B,IAAI,CAAC,QACH,QAAQ,mBAAmB;AAE/B;;;ACnJA,IAAM,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAwDb,SAAS,YAAkB;CACzB,QAAQ,IAAI,KAAK,KAAK,CAAC;AACzB;AAEA,SAAS,eAAqB;CAC5B,QAAQ,IAAA,QAAe;AACzB;AAEA,eAAe,SAAS,QAAgD;CAEtE,MAAM,SAAS,WAAW,OAAO,MAA4B;CAG7D,IAAI,OAAO,MACT,OAAO,OAAO,SAAS,OAAO,MAAgB,EAAE;CAIlD,MAAM,SAAS,eAAe,MAAM;CACpC,IAAI,OAAO,SAAS,GAAG;EACrB,QAAQ,MAAM,uBAAuB;EACrC,KAAK,MAAM,SAAS,QAClB,QAAQ,MAAM,OAAO,OAAO;EAE9B,QAAQ,KAAK,CAAC;CAChB;CAGA,MAAM,iBAAuB;EAC3B,QAAQ,IAAI,oBAAoB;EAChC,QAAQ;EACR,QAAQ,KAAK,CAAC;CAChB;CAEA,QAAQ,GAAG,UAAU,QAAQ;CAC7B,QAAQ,GAAG,WAAW,QAAQ;CAG9B,YAAY,MAAM;CAClB,mBAAmB,MAAM;AAC3B;AAEA,SAAS,cAAc,QAAuC;CAC5D,MAAM,SAAS,OAAO;CAGtB,IAFa,OAAO,MAEV;EACR,MAAM,UAAU,eAAe;EAC/B,QAAQ,IAAI,iBAAiB;EAE7B,KAAK,MAAM,EAAE,WAAW,YAAY,SAAS;GAC3C,MAAM,OAAO,WAAW,YAAY,qBAAqB;GACzD,MAAM,QAAQ,WAAW,YAAY,6BAA6B;GAClE,QAAQ,IAAI,KAAK,KAAK,UAAU,UAAU,GAAG,OAAO,EAAE,EAAE,UAAU,UAAU,YAAY,OAAO,EAAE,EAAE,GAAG,OAAO;EAC/G;EAEA,QAAQ,IAAI,EAAE;EACd;CACF;CAEA,QAAQ,IAAI,4CAA4C;CAExD,IAAI,QACF,QAAQ,IAAI,0DAA0D;CAIxE,MAAM,aAAa,CAAC,WAAW,GAAI,SAAS,CAAC,WAAW,IAAI,CAAC,CAAE;CAC/D,WAAW,UAAU,OAAO,UAAU;CAEtC,IAAI,CAAC,QACH,QAAQ,IAAI,wCAAwC;AAExD;;;;;AAMA,SAAS,sBAAsB,KAAkC;CAC/D,IAAI,QAAQ,KAAA,GACV;CAGF,MAAM,OAAO,OAAO,GAAG;CAEvB,IAAI,CAAC,OAAO,UAAU,IAAI,KAAK,OAAO,GAAG;EACvC,QAAQ,MACN,yEAAyE,IAAI,EAC/E;EACA,QAAQ,MAAM,2DAA2D;EACzE,QAAQ,KAAK,CAAC;CAChB;CAEA,OAAO;AACT;AAEA,eAAe,SAAS,QAAgD;CAEtE,MAAM,iBAAiB,WAAW;CAClC,MAAM,MAAO,OAAO,QAA+B,eAAe,OAAO,KAAA;CAEzE,IAAI,CAAC,KAAK;EACR,QAAQ,MAAM,oCAAoC;EAClD,QAAQ,MAAM,wDAAwD;EACtE,QAAQ,KAAK,CAAC;CAChB;CAEA,MAAM,MAAM;EACV;EACA,kBAAkB,sBAAsB,OAAO,qBAA2C;EAC1F,OAAO,OAAO;EACd,aAAa,OAAO;EACpB,WAAW,OAAO;EAClB,UAAU,OAAO;EACjB,QAAQ,OAAO;EACf,UAAU,OAAO,eACZ,OAAO,YAAY,CAAY,MAAM,GAAG,CAAC,CAAC,KAAK,MAAM,EAAE,KAAK,CAAC,IAC9D,KAAA;EACJ,QAAQ,OAAO;CACjB,CAAC;AACH;AAEA,eAAe,OAAsB;CACnC,MAAM,EAAE,QAAQ,gBAAgB,UAAU;EACxC,kBAAkB;EAClB,SAAS;GAEP,MAAM;IAAE,MAAM;IAAW,OAAO;GAAI;GAGpC,QAAQ;IAAE,MAAM;IAAU,OAAO;GAAI;GACrC,MAAM;IAAE,MAAM;IAAU,OAAO;GAAI;GAGnC,KAAK,EAAE,MAAM,SAAS;GACtB,OAAO,EAAE,MAAM,SAAS;GACxB,gBAAgB,EAAE,MAAM,UAAU;GAClC,eAAe,EAAE,MAAM,UAAU;GACjC,aAAa,EAAE,MAAM,UAAU;GAC/B,WAAW,EAAE,MAAM,UAAU;GAC7B,aAAa,EAAE,MAAM,SAAS;GAC9B,sBAAsB,EAAE,MAAM,SAAS;GACvC,WAAW,EAAE,MAAM,UAAU;GAG7B,MAAM,EAAE,MAAM,UAAU;EAC1B;CACF,CAAC;CAED,MAAM,UAAU,YAAY,MAAM;CAElC,IAAI,OAAO,MAAM;EACf,UAAU;EACV,QAAQ,KAAK,CAAC;CAChB;CAEA,QAAQ,SAAR;EACE,KAAK;GACH,UAAU;GACV;EAEF,KAAK;GACH,aAAa;GACb;EAEF,KAAK;GACH,MAAM,SAAS,MAAM;GACrB;EAEF,KAAK;GACH,MAAM,SAAS,MAAM;GACrB;EAEF,KAAK;EACL,KAAK;GACH,cAAc,MAAM;GACpB;EAEF,KAAK;GACH,MAAM,MAAM;GACZ;EAEF;GACE,QAAQ,MAAM,oBAAoB,SAAS;GAC3C,UAAU;GACV,QAAQ,KAAK,CAAC;CAClB;AACF;AAEA,KAAK,CAAC,CAAC,OAAO,UAAU;CACtB,QAAQ,MAAM,gBAAgB,KAAK;CACnC,QAAQ,KAAK,CAAC;AAChB,CAAC"}
+{"version":3,"file":"cli.js","names":[],"sources":["../src/setup/upgrade.ts","../src/cli.ts"],"sourcesContent":["import { execSync, spawnSync } from \"node:child_process\";\nimport { readFileSync } from \"node:fs\";\nimport { step, success, info, warn, exec, isRoot } from \"./steps.js\";\nimport { runPendingMigrations } from \"./migrations/index.js\";\n\ndeclare const __VERSION__: string;\n\n/**\n * Fetch the latest published version of @studiometa/trafic-agent from the npm registry.\n * Returns null if the registry is unreachable.\n */\nexport function fetchLatestVersion(): string | null {\n  try {\n    return execSync(\"npm show @studiometa/trafic-agent version\", {\n      encoding: \"utf-8\",\n      stdio: \"pipe\",\n    }).trim();\n  } catch {\n    return null;\n  }\n}\n\n/**\n * Compare two semver strings. Returns true if `next` is strictly greater than `current`.\n * Handles simple MAJOR.MINOR.PATCH without pre-release suffixes.\n */\nexport function isNewer(current: string, next: string): boolean {\n  const parse = (v: string): [number, number, number] => {\n    const parts = v.replace(/^v/, \"\").split(\".\").map(Number);\n    return [parts[0] ?? 0, parts[1] ?? 0, parts[2] ?? 0];\n  };\n\n  const [cMaj, cMin, cPat] = parse(current);\n  const [nMaj, nMin, nPat] = parse(next);\n\n  if (nMaj !== cMaj) return nMaj > cMaj;\n  if (nMin !== cMin) return nMin > cMin;\n  return nPat > cPat;\n}\n\n/**\n * Install the latest version of @studiometa/trafic-agent globally via npm.\n * Uses --prefer-online to bypass the local npm cache and always fetch the\n * latest published tarball.\n */\nexport function installLatestAgent(dryRun: boolean): void {\n  exec(\"npm install -g @studiometa/trafic-agent@latest --prefer-online\", { silent: !dryRun });\n}\n\n/**\n * Read the actual installed version of @studiometa/trafic-agent from its\n * package.json on disk — not from __VERSION__ which is baked in at build time.\n *\n * Resolves the package root by walking up from the trafic-agent binary:\n *   /usr/bin/trafic-agent -> /usr/lib/node_modules/@studiometa/trafic-agent/dist/cli.js\n *   -> /usr/lib/node_modules/@studiometa/trafic-agent/package.json\n *\n * Returns null if the file can't be read.\n */\nexport function getInstalledVersion(): string | null {\n  try {\n    // Resolve the real path of the binary (follow symlinks)\n    const realBinary = execSync(\"readlink -f $(which trafic-agent)\", {\n      encoding: \"utf-8\",\n      stdio: \"pipe\",\n    }).trim();\n    // dist/cli.js -> up two dirs -> package root\n    const pkgJson = `${realBinary.replace(/\\/dist\\/cli\\.js$/, \"\")}/package.json`;\n    const pkg = JSON.parse(readFileSync(pkgJson, \"utf-8\")) as { version: string };\n    return pkg.version;\n  } catch {\n    return null;\n  }\n}\n\n/**\n * Re-exec the newly installed trafic-agent binary with the same arguments.\n * Used after a self-update so the new binary runs its own migrations.\n * This function never returns — it replaces the current process.\n */\nexport function reExecNewBinary(args: string[]): never {\n  const binary = execSync(\"which trafic-agent\", { encoding: \"utf-8\", stdio: \"pipe\" }).trim();\n  const result = spawnSync(binary, args, {\n    stdio: \"inherit\",\n    env: { ...process.env, TRAFIC_UPGRADE_REEXEC: \"1\" },\n  });\n  process.exit(result.status ?? 0);\n}\n\n/**\n * Restart the trafic-agent systemd service.\n */\nexport function restartAgentService(dryRun: boolean): void {\n  exec(\"systemctl restart trafic-agent\", { silent: !dryRun });\n}\n\n/**\n * What the upgrade sequence needs from the outside world.\n *\n * Injected so the orchestration can be tested without reaching npm, writing\n * to the filesystem or replacing the running process — the last of which is\n * why `reExecNewBinary` is here rather than called directly.\n */\nexport interface UpgradeIo {\n  /** The version of the process running the upgrade. */\n  currentVersion: string;\n  /** Whether an earlier run already re-execed, guarding against a loop. */\n  alreadyReExeced: boolean;\n  isRoot: () => boolean;\n  fetchLatestVersion: () => string | null;\n  installLatestAgent: (dryRun: boolean) => void;\n  getInstalledVersion: () => string | null;\n  reExecNewBinary: (args: string[]) => never;\n  restartAgentService: (dryRun: boolean) => void;\n  runPendingMigrations: (dryRun: boolean) => void;\n}\n\n/** The real collaborators, used unless a caller passes their own. */\nexport function nodeUpgradeIo(): UpgradeIo {\n  return {\n    currentVersion: __VERSION__,\n    alreadyReExeced: process.env[\"TRAFIC_UPGRADE_REEXEC\"] === \"1\",\n    isRoot,\n    fetchLatestVersion,\n    installLatestAgent,\n    getInstalledVersion,\n    reExecNewBinary,\n    restartAgentService,\n    runPendingMigrations,\n  };\n}\n\n/**\n * Full upgrade sequence:\n *  1. Check for a new version on npm\n *  2. Install it globally if one is found — then re-exec the new binary\n *     so that steps 3 and 4 run with the new migration registry\n *  3. Run pending migrations\n *  4. Restart the systemd service\n */\nexport function runUpgrade(\n  dryRun = false,\n  reExecArgs?: string[],\n  io: UpgradeIo = nodeUpgradeIo(),\n): void {\n  if (!io.isRoot() && !dryRun) {\n    console.error(\"    \\x1b[31m✗\\x1b[0m This command must be run as root\");\n    console.log(\"  Run: sudo trafic-agent upgrade\");\n    process.exit(1);\n  }\n\n  // Guard against infinite re-exec loops: only re-exec once per upgrade run.\n  const alreadyReExeced = io.alreadyReExeced;\n\n  // ── Step 1: Check for updates ─────────────────────────────────────────────\n  step(\"Check for updates\");\n\n  const current = io.currentVersion;\n  info(`Current version: ${current}`);\n\n  const latest = io.fetchLatestVersion();\n\n  if (!latest) {\n    warn(\"Could not reach npm registry — skipping version check\");\n  } else if (isNewer(current, latest)) {\n    success(`New version available: ${latest}`);\n\n    // ── Step 2: Install ───────────────────────────────────────────────────\n    step(\"Install latest version\");\n    io.installLatestAgent(dryRun);\n\n    if (!dryRun) {\n      // Verify the installed version actually changed before re-execing —\n      // npm can serve stale cache and leave the old binary in place.\n      const installedVersion = io.getInstalledVersion();\n\n      if (!alreadyReExeced && installedVersion && isNewer(current, installedVersion)) {\n        success(`Installed @studiometa/trafic-agent@${installedVersion}`);\n        // Re-exec the newly installed binary so steps 3 and 4 run with the\n        // new migration registry — the current process only knows about\n        // migrations that existed at the time it was compiled.\n        io.reExecNewBinary(reExecArgs ?? [\"upgrade\"]);\n      } else if (installedVersion) {\n        success(`Installed @studiometa/trafic-agent@${installedVersion}`);\n      }\n    }\n  } else {\n    success(`Already up to date (${current})`);\n  }\n\n  // ── Step 3: Run pending migrations ───────────────────────────────────────\n  step(\"Run pending migrations\");\n  io.runPendingMigrations(dryRun);\n\n  // ── Step 4: Restart service ───────────────────────────────────────────────\n  step(\"Restart trafic-agent service\");\n  io.restartAgentService(dryRun);\n  if (!dryRun) {\n    success(\"Service restarted\");\n  }\n}\n","#!/usr/bin/env node\n\nimport { parseArgs } from \"node:util\";\nimport { loadConfig, validateConfig } from \"./utils/config.js\";\nimport { startServer } from \"./server.js\";\nimport { startIdleScheduler } from \"./tasks/stop-idle.js\";\nimport { closeDb } from \"./utils/db.js\";\nimport { setup, audit } from \"./setup/index.js\";\nimport { listMigrations } from \"./setup/migrations/index.js\";\nimport { runUpgrade } from \"./setup/upgrade.js\";\n\ndeclare const __VERSION__: string;\n\nconst HELP = `\ntrafic-agent — Server agent for DDEV preview environments\n\nUsage:\n  trafic-agent <command> [options]\n\nCommands:\n  start                   Start the agent server\n  setup                   Setup a new server (Docker, DDEV, hardening)\n  upgrade                 Check for a new version, install it, run migrations, restart the service\n  update                  Alias for upgrade\n  audit                   Run security audit checks\n  version                 Show version\n  help                    Show this help\n\nStart options:\n  -c, --config <path>     Path to config file (default: /etc/trafic/config.toml)\n  -p, --port <port>       Override port from config\n\nSetup options:\n  --tld <domain>          TLD for DDEV projects (required on first run, reused from config on re-runs)\n  --email <email>         Email for Let's Encrypt certificates\n  --no-hardening          Skip server hardening steps\n  --no-root-ssh           Disable root SSH login (recovery via rescue mode only)\n  --no-docker             Skip Docker installation\n  --no-ddev               Skip DDEV installation\n  --ssh-users <users>     Comma-separated list of SSH users to allow (default: ddev)\n  --trusted-proxy-hops <n> Proxies in front of the agent (default: 1; 2 behind a CDN).\n                          Written to the generated config; ignored if one exists\n  --dry-run               Show what would be done without making changes\n\nUpgrade/update options:\n  --dry-run               Show what would be done without making changes\n  --list                  List all migrations and their status (no install or restart)\n\nExamples:\n  # Start the agent\n  trafic-agent start\n  trafic-agent start --config /path/to/config.toml\n\n  # Setup a new server\n  sudo trafic-agent setup --tld=previews.example.com\n  sudo trafic-agent setup --tld=previews.example.com --trusted-proxy-hops=2\n  sudo trafic-agent setup --tld=previews.example.com --email=admin@example.com\n  sudo trafic-agent setup --tld=previews.example.com --no-hardening --dry-run\n\n  # Upgrade: install latest version, run migrations, restart service\n  sudo trafic-agent upgrade\n  sudo trafic-agent upgrade --dry-run\n  trafic-agent upgrade --list\n  sudo trafic-agent update          # alias for upgrade\n\n  # Run security audit\n  trafic-agent audit\n`;\n\nfunction printHelp(): void {\n  console.log(HELP.trim());\n}\n\nfunction printVersion(): void {\n  console.log(__VERSION__);\n}\n\nasync function runStart(values: Record<string, unknown>): Promise<void> {\n  // Load config\n  const config = loadConfig(values.config as string | undefined);\n\n  // Override port if specified\n  if (values.port) {\n    config.port = parseInt(values.port as string, 10);\n  }\n\n  // Validate config\n  const errors = validateConfig(config);\n  if (errors.length > 0) {\n    console.error(\"Configuration errors:\");\n    for (const error of errors) {\n      console.error(`  - ${error}`);\n    }\n    process.exit(1);\n  }\n\n  // Graceful shutdown\n  const shutdown = (): void => {\n    console.log(\"\\nShutting down...\");\n    closeDb();\n    process.exit(0);\n  };\n\n  process.on(\"SIGINT\", shutdown);\n  process.on(\"SIGTERM\", shutdown);\n\n  // Start server and scheduler\n  startServer(config);\n  startIdleScheduler(config);\n}\n\nfunction handleUpgrade(values: Record<string, unknown>): void {\n  const dryRun = values[\"dry-run\"] as boolean | undefined;\n  const list = values.list as boolean | undefined;\n\n  if (list) {\n    const entries = listMigrations();\n    console.log(\"\\nMigrations:\\n\");\n\n    for (const { migration, status } of entries) {\n      const icon = status === \"applied\" ? \"\\x1b[32m✓\\x1b[0m\" : \"\\x1b[36m→\\x1b[0m\";\n      const label = status === \"applied\" ? \"\\x1b[90m(applied)\\x1b[0m\" : \"(pending)\";\n      console.log(`  ${icon} \\x1b[1m${migration.id.padEnd(30)}\\x1b[0m ${migration.description.padEnd(55)} ${label}`);\n    }\n\n    console.log(\"\");\n    return;\n  }\n\n  console.log(\"\\n\\x1b[1m🚦 Trafic Server Upgrade\\x1b[0m\\n\");\n\n  if (dryRun) {\n    console.log(\"\\x1b[33m⚠ Dry-run mode: no changes will be made\\x1b[0m\\n\");\n  }\n\n  // Build re-exec args so flags survive the binary swap after a self-update\n  const reExecArgs = [\"upgrade\", ...(dryRun ? [\"--dry-run\"] : [])];\n  runUpgrade(dryRun ?? false, reExecArgs);\n\n  if (!dryRun) {\n    console.log(\"\\n\\x1b[32m✓ Upgrade complete!\\x1b[0m\\n\");\n  }\n}\n\n/**\n * Parse --trusted-proxy-hops, failing loudly rather than writing a config\n * that would quietly break the IP allowlist.\n */\nfunction parseTrustedProxyHops(raw?: string): number | undefined {\n  if (raw === undefined) {\n    return undefined;\n  }\n\n  const hops = Number(raw);\n\n  if (!Number.isInteger(hops) || hops < 1) {\n    console.error(\n      `Error: --trusted-proxy-hops must be a whole number of 1 or more, got \"${raw}\"`,\n    );\n    console.error(\"  1 = ddev-router/Traefik alone, 2 = a CDN in front of it\");\n    process.exit(1);\n  }\n\n  return hops;\n}\n\nasync function runSetup(values: Record<string, unknown>): Promise<void> {\n  // Load existing config to use as defaults on re-runs\n  const existingConfig = loadConfig();\n  const tld = (values.tld as string | undefined) ?? (existingConfig.tld || undefined);\n\n  if (!tld) {\n    console.error(\"Error: --tld is required for setup\");\n    console.error(\"Example: trafic-agent setup --tld=previews.example.com\");\n    process.exit(1);\n  }\n\n  await setup({\n    tld,\n    trustedProxyHops: parseTrustedProxyHops(values[\"trusted-proxy-hops\"] as string | undefined),\n    email: values.email as string | undefined,\n    noHardening: values[\"no-hardening\"] as boolean | undefined,\n    noRootSsh: values[\"no-root-ssh\"] as boolean | undefined,\n    noDocker: values[\"no-docker\"] as boolean | undefined,\n    noDdev: values[\"no-ddev\"] as boolean | undefined,\n    sshUsers: values[\"ssh-users\"]\n      ? (values[\"ssh-users\"] as string).split(\",\").map((s) => s.trim())\n      : undefined,\n    dryRun: values[\"dry-run\"] as boolean | undefined,\n  });\n}\n\nasync function main(): Promise<void> {\n  const { values, positionals } = parseArgs({\n    allowPositionals: true,\n    options: {\n      // Common\n      help: { type: \"boolean\", short: \"h\" },\n\n      // Start options\n      config: { type: \"string\", short: \"c\" },\n      port: { type: \"string\", short: \"p\" },\n\n      // Setup options\n      tld: { type: \"string\" },\n      email: { type: \"string\" },\n      \"no-hardening\": { type: \"boolean\" },\n      \"no-root-ssh\": { type: \"boolean\" },\n      \"no-docker\": { type: \"boolean\" },\n      \"no-ddev\": { type: \"boolean\" },\n      \"ssh-users\": { type: \"string\" },\n      \"trusted-proxy-hops\": { type: \"string\" },\n      \"dry-run\": { type: \"boolean\" },\n\n      // Upgrade options\n      list: { type: \"boolean\" },\n    },\n  });\n\n  const command = positionals[0] ?? \"help\";\n\n  if (values.help) {\n    printHelp();\n    process.exit(0);\n  }\n\n  switch (command) {\n    case \"help\":\n      printHelp();\n      break;\n\n    case \"version\":\n      printVersion();\n      break;\n\n    case \"start\":\n      await runStart(values);\n      break;\n\n    case \"setup\":\n      await runSetup(values);\n      break;\n\n    case \"upgrade\":\n    case \"update\":\n      handleUpgrade(values);\n      break;\n\n    case \"audit\":\n      await audit();\n      break;\n\n    default:\n      console.error(`Unknown command: ${command}`);\n      printHelp();\n      process.exit(1);\n  }\n}\n\nmain().catch((error) => {\n  console.error(\"Fatal error:\", error);\n  process.exit(1);\n});\n"],"mappings":";;;;;;;;;;;AAWA,SAAgB,qBAAoC;CAClD,IAAI;EACF,OAAO,SAAS,6CAA6C;GAC3D,UAAU;GACV,OAAO;EACT,CAAC,CAAC,CAAC,KAAK;CACV,QAAQ;EACN,OAAO;CACT;AACF;;;;;AAMA,SAAgB,QAAQ,SAAiB,MAAuB;CAC9D,MAAM,SAAS,MAAwC;EACrD,MAAM,QAAQ,EAAE,QAAQ,MAAM,EAAE,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,IAAI,MAAM;EACvD,OAAO;GAAC,MAAM,MAAM;GAAG,MAAM,MAAM;GAAG,MAAM,MAAM;EAAC;CACrD;CAEA,MAAM,CAAC,MAAM,MAAM,QAAQ,MAAM,OAAO;CACxC,MAAM,CAAC,MAAM,MAAM,QAAQ,MAAM,IAAI;CAErC,IAAI,SAAS,MAAM,OAAO,OAAO;CACjC,IAAI,SAAS,MAAM,OAAO,OAAO;CACjC,OAAO,OAAO;AAChB;;;;;;AAOA,SAAgB,mBAAmB,QAAuB;CACxD,KAAK,kEAAkE,EAAE,QAAQ,CAAC,OAAO,CAAC;AAC5F;;;;;;;;;;;AAYA,SAAgB,sBAAqC;CACnD,IAAI;EAOF,MAAM,UAAU,GALG,SAAS,qCAAqC;GAC/D,UAAU;GACV,OAAO;EACT,CAAC,CAAC,CAAC,KAEgB,CAAA,CAAW,QAAQ,oBAAoB,EAAE,EAAE;EAE9D,OADY,KAAK,MAAM,aAAa,SAAS,OAAO,CAC7C,CAAA,CAAI;CACb,QAAQ;EACN,OAAO;CACT;AACF;;;;;;AAOA,SAAgB,gBAAgB,MAAuB;CACrD,MAAM,SAAS,SAAS,sBAAsB;EAAE,UAAU;EAAS,OAAO;CAAO,CAAC,CAAC,CAAC,KAAK;CACzF,MAAM,SAAS,UAAU,QAAQ,MAAM;EACrC,OAAO;EACP,KAAK;GAAE,GAAG,QAAQ;GAAK,uBAAuB;EAAI;CACpD,CAAC;CACD,QAAQ,KAAK,OAAO,UAAU,CAAC;AACjC;;;;AAKA,SAAgB,oBAAoB,QAAuB;CACzD,KAAK,kCAAkC,EAAE,QAAQ,CAAC,OAAO,CAAC;AAC5D;;AAwBA,SAAgB,gBAA2B;CACzC,OAAO;EACL,gBAAA;EACA,iBAAiB,QAAQ,IAAI,6BAA6B;EAC1D;EACA;EACA;EACA;EACA;EACA;EACA;CACF;AACF;;;;;;;;;AAUA,SAAgB,WACd,SAAS,OACT,YACA,KAAgB,cAAc,GACxB;CACN,IAAI,CAAC,GAAG,OAAO,KAAK,CAAC,QAAQ;EAC3B,QAAQ,MAAM,uDAAuD;EACrE,QAAQ,IAAI,kCAAkC;EAC9C,QAAQ,KAAK,CAAC;CAChB;CAGA,MAAM,kBAAkB,GAAG;CAG3B,KAAK,mBAAmB;CAExB,MAAM,UAAU,GAAG;CACnB,KAAK,oBAAoB,SAAS;CAElC,MAAM,SAAS,GAAG,mBAAmB;CAErC,IAAI,CAAC,QACH,KAAK,uDAAuD;MACvD,IAAI,QAAQ,SAAS,MAAM,GAAG;EACnC,QAAQ,0BAA0B,QAAQ;EAG1C,KAAK,wBAAwB;EAC7B,GAAG,mBAAmB,MAAM;EAE5B,IAAI,CAAC,QAAQ;GAGX,MAAM,mBAAmB,GAAG,oBAAoB;GAEhD,IAAI,CAAC,mBAAmB,oBAAoB,QAAQ,SAAS,gBAAgB,GAAG;IAC9E,QAAQ,sCAAsC,kBAAkB;IAIhE,GAAG,gBAAgB,cAAc,CAAC,SAAS,CAAC;GAC9C,OAAO,IAAI,kBACT,QAAQ,sCAAsC,kBAAkB;EAEpE;CACF,OACE,QAAQ,uBAAuB,QAAQ,EAAE;CAI3C,KAAK,wBAAwB;CAC7B,GAAG,qBAAqB,MAAM;CAG9B,KAAK,8BAA8B;CACnC,GAAG,oBAAoB,MAAM;CAC7B,IAAI,CAAC,QACH,QAAQ,mBAAmB;AAE/B;;;AC3LA,IAAM,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAwDb,SAAS,YAAkB;CACzB,QAAQ,IAAI,KAAK,KAAK,CAAC;AACzB;AAEA,SAAS,eAAqB;CAC5B,QAAQ,IAAA,QAAe;AACzB;AAEA,eAAe,SAAS,QAAgD;CAEtE,MAAM,SAAS,WAAW,OAAO,MAA4B;CAG7D,IAAI,OAAO,MACT,OAAO,OAAO,SAAS,OAAO,MAAgB,EAAE;CAIlD,MAAM,SAAS,eAAe,MAAM;CACpC,IAAI,OAAO,SAAS,GAAG;EACrB,QAAQ,MAAM,uBAAuB;EACrC,KAAK,MAAM,SAAS,QAClB,QAAQ,MAAM,OAAO,OAAO;EAE9B,QAAQ,KAAK,CAAC;CAChB;CAGA,MAAM,iBAAuB;EAC3B,QAAQ,IAAI,oBAAoB;EAChC,QAAQ;EACR,QAAQ,KAAK,CAAC;CAChB;CAEA,QAAQ,GAAG,UAAU,QAAQ;CAC7B,QAAQ,GAAG,WAAW,QAAQ;CAG9B,YAAY,MAAM;CAClB,mBAAmB,MAAM;AAC3B;AAEA,SAAS,cAAc,QAAuC;CAC5D,MAAM,SAAS,OAAO;CAGtB,IAFa,OAAO,MAEV;EACR,MAAM,UAAU,eAAe;EAC/B,QAAQ,IAAI,iBAAiB;EAE7B,KAAK,MAAM,EAAE,WAAW,YAAY,SAAS;GAC3C,MAAM,OAAO,WAAW,YAAY,qBAAqB;GACzD,MAAM,QAAQ,WAAW,YAAY,6BAA6B;GAClE,QAAQ,IAAI,KAAK,KAAK,UAAU,UAAU,GAAG,OAAO,EAAE,EAAE,UAAU,UAAU,YAAY,OAAO,EAAE,EAAE,GAAG,OAAO;EAC/G;EAEA,QAAQ,IAAI,EAAE;EACd;CACF;CAEA,QAAQ,IAAI,4CAA4C;CAExD,IAAI,QACF,QAAQ,IAAI,0DAA0D;CAIxE,MAAM,aAAa,CAAC,WAAW,GAAI,SAAS,CAAC,WAAW,IAAI,CAAC,CAAE;CAC/D,WAAW,UAAU,OAAO,UAAU;CAEtC,IAAI,CAAC,QACH,QAAQ,IAAI,wCAAwC;AAExD;;;;;AAMA,SAAS,sBAAsB,KAAkC;CAC/D,IAAI,QAAQ,KAAA,GACV;CAGF,MAAM,OAAO,OAAO,GAAG;CAEvB,IAAI,CAAC,OAAO,UAAU,IAAI,KAAK,OAAO,GAAG;EACvC,QAAQ,MACN,yEAAyE,IAAI,EAC/E;EACA,QAAQ,MAAM,2DAA2D;EACzE,QAAQ,KAAK,CAAC;CAChB;CAEA,OAAO;AACT;AAEA,eAAe,SAAS,QAAgD;CAEtE,MAAM,iBAAiB,WAAW;CAClC,MAAM,MAAO,OAAO,QAA+B,eAAe,OAAO,KAAA;CAEzE,IAAI,CAAC,KAAK;EACR,QAAQ,MAAM,oCAAoC;EAClD,QAAQ,MAAM,wDAAwD;EACtE,QAAQ,KAAK,CAAC;CAChB;CAEA,MAAM,MAAM;EACV;EACA,kBAAkB,sBAAsB,OAAO,qBAA2C;EAC1F,OAAO,OAAO;EACd,aAAa,OAAO;EACpB,WAAW,OAAO;EAClB,UAAU,OAAO;EACjB,QAAQ,OAAO;EACf,UAAU,OAAO,eACZ,OAAO,YAAY,CAAY,MAAM,GAAG,CAAC,CAAC,KAAK,MAAM,EAAE,KAAK,CAAC,IAC9D,KAAA;EACJ,QAAQ,OAAO;CACjB,CAAC;AACH;AAEA,eAAe,OAAsB;CACnC,MAAM,EAAE,QAAQ,gBAAgB,UAAU;EACxC,kBAAkB;EAClB,SAAS;GAEP,MAAM;IAAE,MAAM;IAAW,OAAO;GAAI;GAGpC,QAAQ;IAAE,MAAM;IAAU,OAAO;GAAI;GACrC,MAAM;IAAE,MAAM;IAAU,OAAO;GAAI;GAGnC,KAAK,EAAE,MAAM,SAAS;GACtB,OAAO,EAAE,MAAM,SAAS;GACxB,gBAAgB,EAAE,MAAM,UAAU;GAClC,eAAe,EAAE,MAAM,UAAU;GACjC,aAAa,EAAE,MAAM,UAAU;GAC/B,WAAW,EAAE,MAAM,UAAU;GAC7B,aAAa,EAAE,MAAM,SAAS;GAC9B,sBAAsB,EAAE,MAAM,SAAS;GACvC,WAAW,EAAE,MAAM,UAAU;GAG7B,MAAM,EAAE,MAAM,UAAU;EAC1B;CACF,CAAC;CAED,MAAM,UAAU,YAAY,MAAM;CAElC,IAAI,OAAO,MAAM;EACf,UAAU;EACV,QAAQ,KAAK,CAAC;CAChB;CAEA,QAAQ,SAAR;EACE,KAAK;GACH,UAAU;GACV;EAEF,KAAK;GACH,aAAa;GACb;EAEF,KAAK;GACH,MAAM,SAAS,MAAM;GACrB;EAEF,KAAK;GACH,MAAM,SAAS,MAAM;GACrB;EAEF,KAAK;EACL,KAAK;GACH,cAAc,MAAM;GACpB;EAEF,KAAK;GACH,MAAM,MAAM;GACZ;EAEF;GACE,QAAQ,MAAM,oBAAoB,SAAS;GAC3C,UAAU;GACV,QAAQ,KAAK,CAAC;CAClB;AACF;AAEA,KAAK,CAAC,CAAC,OAAO,UAAU;CACtB,QAAQ,MAAM,gBAAgB,KAAK;CACnC,QAAQ,KAAK,CAAC;AAChB,CAAC"}

package/dist/index.js

@@ -1,3 +1,3 @@
-import { a as printAuditResults, c as stopIdleProjects, d as buildDockerFirewallScript, f as buildDockerFirewallUnit, g as validateConfig, h as parseDuration, l as DOCKER_FIREWALL_SCRIPT, m as loadConfig, n as setup, o as runAudit, p as configureDockerFirewall, s as startIdleScheduler, t as audit, u as DOCKER_FIREWALL_UNIT } from "./setup-BFU-DlX3.js";
-import { B as startProject, C as updateProjectAccess, F as buildHostnameIndex, G as matchIp, H as watchProjectList, I as getProjectFromHostname, K as parseBasicAuth, L as getProjectInfo, R as listProjects, S as setProjectStatus, U as checkAuth, V as stopProject, W as matchHostname, _ as getDb, b as initDb, d as getIdleTimeoutMs, f as loadProjectConfig, g as getAccessLogs, h as closeDb, m as cleanOldLogs, n as startServer, p as shouldNeverStop, q as parseBearerToken, v as getIdleProjects, x as logAccess, y as getProject, z as loadProjectList } from "./server-CvSztHW2.js";
+import { a as printAuditResults, c as stopIdleProjects, d as buildDockerFirewallScript, f as buildDockerFirewallUnit, g as validateConfig, h as parseDuration, l as DOCKER_FIREWALL_SCRIPT, m as loadConfig, n as setup, o as runAudit, p as configureDockerFirewall, s as startIdleScheduler, t as audit, u as DOCKER_FIREWALL_UNIT } from "./setup-DxoFhMfT.js";
+import { B as buildHostnameIndex, C as getIdleProjects, D as setProjectStatus, E as logAccess, G as startProject, H as getProjectInfo, J as checkAuth, K as stopProject, O as updateProjectAccess, Q as parseBearerToken, S as getDb, T as initDb, U as listProjects, V as getProjectFromHostname, W as loadProjectList, X as matchIp, Y as matchHostname, Z as parseBasicAuth, _ as loadProjectConfig, b as closeDb, g as getIdleTimeoutMs, q as watchProjectList, s as startServer, v as shouldNeverStop, w as getProject, x as getAccessLogs, y as cleanOldLogs } from "./server-BAjHxgqh.js";
 export { DOCKER_FIREWALL_SCRIPT, DOCKER_FIREWALL_UNIT, audit, buildDockerFirewallScript, buildDockerFirewallUnit, buildHostnameIndex, checkAuth, cleanOldLogs, closeDb, configureDockerFirewall, getAccessLogs, getDb, getIdleProjects, getIdleTimeoutMs, getProject, getProjectFromHostname, getProjectInfo, initDb, listProjects, loadConfig, loadProjectConfig, loadProjectList, logAccess, matchHostname, matchIp, parseBasicAuth, parseBearerToken, parseDuration, printAuditResults, runAudit, setProjectStatus, setup, shouldNeverStop, startIdleScheduler, startProject, startServer, stopIdleProjects, stopProject, updateProjectAccess, validateConfig, watchProjectList };

package/dist/{server-CvSztHW2.js → server-BAjHxgqh.js}

@@ -294,42 +294,31 @@ function watchProjectList(projectListPath, onChange) {
 		if (eventType === "change") onChange();
 	});
 }
-/**
-* Run a ddev command without blocking the event loop.
-*
-* The agent is single-threaded and serves forward auth for every project, so
-* an `execSync` here stops the whole server for the duration of the command.
-* `ddev start` takes over a minute, which froze auth for every unrelated
-* project and produced request timeouts on a live server. Nothing about
-* "background" work with setTimeout helps: the timer callback still runs on
-* the same thread.
-*/
-function ddev(args, timeoutMs) {
-	return new Promise((resolve) => {
-		execFile("ddev", args, {
-			encoding: "utf-8",
-			timeout: timeoutMs
-		}, (error, stdout) => {
-			if (error) {
-				console.error(`ddev ${args.join(" ")} failed:`, error.message);
-				resolve({
-					ok: false,
-					stdout: stdout ?? ""
-				});
-				return;
-			}
+/** The real runner, used unless a caller passes its own. */
+var nodeDdevRunner = (args, timeoutMs) => new Promise((resolve) => {
+	execFile("ddev", args, {
+		encoding: "utf-8",
+		timeout: timeoutMs
+	}, (error, stdout) => {
+		if (error) {
+			console.error(`ddev ${args.join(" ")} failed:`, error.message);
 			resolve({
-				ok: true,
+				ok: false,
 				stdout: stdout ?? ""
 			});
+			return;
+		}
+		resolve({
+			ok: true,
+			stdout: stdout ?? ""
 		});
 	});
-}
+});
 /**
 * Get detailed project info using ddev describe
 */
-async function getProjectInfo(name) {
-	const { ok, stdout } = await ddev([
+async function getProjectInfo(name, run = nodeDdevRunner) {
+	const { ok, stdout } = await run([
 		"describe",
 		name,
 		"-j"
@@ -359,15 +348,15 @@ async function getProjectInfo(name) {
 * Resolves when the project is up. Callers in the request path must not await
 * it — respond first, then let this settle and record the outcome.
 */
-async function startProject(name) {
-	const { ok } = await ddev(["start", name], 12e4);
+async function startProject(name, run = nodeDdevRunner) {
+	const { ok } = await run(["start", name], 12e4);
 	return ok;
 }
 /**
 * Stop a DDEV project
 */
-async function stopProject(name) {
-	const { ok } = await ddev(["stop", name], 6e4);
+async function stopProject(name, run = nodeDdevRunner) {
+	const { ok } = await run(["stop", name], 6e4);
 	return ok;
 }
 /**
@@ -520,6 +509,8 @@ var nodeIo = {
 };
 //#endregion
 //#region src/utils/db.ts
+/** The real clock, used unless a caller passes its own. */
+var systemClock = () => Date.now();
 var db = null;
 /**
 * Initialize the database connection and schema
@@ -567,12 +558,12 @@ function closeDb() {
 /**
 * Update project last access time
 */
-function updateProjectAccess(name) {
+function updateProjectAccess(name, now = systemClock) {
 	getDb().prepare(`
     INSERT INTO projects (name, last_access, status)
     VALUES (?, ?, 'running')
     ON CONFLICT(name) DO UPDATE SET last_access = excluded.last_access
-  `).run(name, Date.now());
+  `).run(name, now());
 }
 /**
 * Get project record
@@ -583,19 +574,19 @@ function getProject(name) {
 /**
 * Set project status
 */
-function setProjectStatus(name, status) {
+function setProjectStatus(name, status, now = systemClock) {
 	getDb().prepare(`
     INSERT INTO projects (name, last_access, status)
     VALUES (?, ?, ?)
     ON CONFLICT(name) DO UPDATE SET status = excluded.status
-  `).run(name, Date.now(), status);
+  `).run(name, now(), status);
 }
 /**
 * Get idle projects (last access older than threshold)
 */
-function getIdleProjects(thresholdMs) {
+function getIdleProjects(thresholdMs, now = systemClock) {
 	const database = getDb();
-	const cutoff = Date.now() - thresholdMs;
+	const cutoff = now() - thresholdMs;
 	return database.prepare(`
     SELECT name, last_access as lastAccess, status
     FROM projects
@@ -626,9 +617,9 @@ function getAccessLogs(project, limit = 100) {
 /**
 * Clean old access logs (older than given days)
 */
-function cleanOldLogs(days) {
+function cleanOldLogs(days, now = systemClock) {
 	const database = getDb();
-	const cutoff = Date.now() - days * 24 * 60 * 60 * 1e3;
+	const cutoff = now() - days * 24 * 60 * 60 * 1e3;
 	const result = database.prepare("DELETE FROM access_logs WHERE timestamp < ?").run(cutoff);
 	return Number(result.changes);
 }
@@ -1028,12 +1019,12 @@ function loadTemplate(name) {
 /**
 * Get effective auth config for a project (merges global + per-project)
 */
-function getEffectiveAuthConfig(projectName) {
-	if (!projectName) return config.auth;
-	const projectConfig = projectConfigs.get(projectName);
-	if (!projectConfig?.auth_policy) return config.auth;
+function getEffectiveAuthConfig(projectName, deps) {
+	if (!projectName) return deps.auth;
+	const projectConfig = deps.projectConfigs.get(projectName);
+	if (!projectConfig?.auth_policy) return deps.auth;
 	return {
-		...config.auth,
+		...deps.auth,
 		defaultPolicy: projectConfig.auth_policy
 	};
 }
@@ -1041,14 +1032,14 @@ function getEffectiveAuthConfig(projectName) {
 * Handle forward auth requests from Traefik
 * Traefik sends the original request headers, we return 200 (allow) or 401 (deny)
 */
-function handleAuth(req, res) {
+function handleAuth(req, res, deps) {
 	const hostname = req.headers["x-forwarded-host"] ?? "";
 	const socketIp = req.socket.remoteAddress ?? "";
 	const forwardedFor = req.headers["x-forwarded-for"];
 	const authorization = req.headers["authorization"];
 	const path = req.headers["x-forwarded-uri"] ?? "/";
-	const projectName = hostnameIndex.get(hostname);
-	const authConfig = getEffectiveAuthConfig(projectName);
+	const projectName = deps.hostnameIndex.get(hostname);
+	const authConfig = getEffectiveAuthConfig(projectName, deps);
 	const clientIp = resolveClientIp(socketIp, forwardedFor, authConfig.trustedProxyHops);
 	if (checkAuth({
 		hostname,
@@ -1057,8 +1048,8 @@ function handleAuth(req, res) {
 		forwardedFor
 	}, authConfig).allowed) {
 		if (projectName) {
-			updateProjectAccess(projectName);
-			logAccess({
+			deps.updateProjectAccess(projectName);
+			deps.logAccess({
 				project: projectName,
 				timestamp: Date.now(),
 				ip: clientIp,
@@ -1077,17 +1068,17 @@ function handleAuth(req, res) {
 * Handle errors middleware requests (502 from Traefik)
 * When a project is stopped, Traefik returns 502. We show a waiting page and start the project.
 */
-async function handleErrors(req, res) {
+async function handleErrors(req, res, deps) {
 	const hostname = req.headers["x-forwarded-host"] ?? req.headers.host ?? "";
-	const projectName = hostnameIndex.get(hostname);
+	const projectName = deps.hostnameIndex.get(hostname);
 	if (!projectName) {
-		const template = loadTemplate("error");
+		const template = deps.loadTemplate("error");
 		res.writeHead(404, { "Content-Type": "text/html" });
 		res.end(template.replace("{{message}}", "Project not found"));
 		return;
 	}
-	if (getProject(projectName)?.status === "starting") {
-		const template = loadTemplate("wait");
+	if (deps.getProject(projectName)?.status === "starting") {
+		const template = deps.loadTemplate("wait");
 		res.writeHead(503, {
 			"Content-Type": "text/html",
 			"Retry-After": "5"
@@ -1095,32 +1086,32 @@ async function handleErrors(req, res) {
 		res.end(template.replace(/\{\{project\}\}/g, projectName).replace(/\{\{hostname\}\}/g, hostname));
 		return;
 	}
-	setProjectStatus(projectName, "starting");
-	const template = loadTemplate("wait");
+	deps.setProjectStatus(projectName, "starting");
+	const template = deps.loadTemplate("wait");
 	res.writeHead(503, {
 		"Content-Type": "text/html",
 		"Retry-After": "5"
 	});
 	res.end(template.replace(/\{\{project\}\}/g, projectName).replace(/\{\{hostname\}\}/g, hostname));
-	startProject(projectName).then((success) => {
-		setProjectStatus(projectName, success ? "running" : "stopped");
+	deps.startProject(projectName).then((success) => {
+		deps.setProjectStatus(projectName, success ? "running" : "stopped");
 	}).catch((error) => {
-		setProjectStatus(projectName, "stopped");
+		deps.setProjectStatus(projectName, "stopped");
 		console.error(`Could not start ${projectName}:`, error);
 	});
 }
 /**
 * Handle status polling requests
 */
-async function handleStatus(req, res) {
+async function handleStatus(req, res, deps) {
 	const projectName = new URL(req.url ?? "/", `http://${req.headers.host}`).searchParams.get("project");
 	if (!projectName) {
 		res.writeHead(400, { "Content-Type": "application/json" });
 		res.end(JSON.stringify({ error: "Missing project parameter" }));
 		return;
 	}
-	const info = await getProjectInfo(projectName);
-	const record = getProject(projectName);
+	const info = await deps.getProjectInfo(projectName);
+	const record = deps.getProject(projectName);
 	res.writeHead(200, { "Content-Type": "application/json" });
 	res.end(JSON.stringify({
 		name: projectName,
@@ -1148,18 +1139,18 @@ function routePath(target) {
 /**
 * Request handler
 */
-async function handleRequest(req, res) {
+async function handleRequest(req, res, deps) {
 	const path = routePath(req.url);
 	try {
-		if (path === "/__auth__" || path.startsWith("/__auth__/")) handleAuth(req, res);
-		else if (path === "/__status__" || path.startsWith("/__status__/")) await handleStatus(req, res);
+		if (path === "/__auth__" || path.startsWith("/__auth__/")) handleAuth(req, res, deps);
+		else if (path === "/__status__" || path.startsWith("/__status__/")) await handleStatus(req, res, deps);
 		else if (path === "/__health__") {
 			res.writeHead(200, { "Content-Type": "application/json" });
 			res.end(JSON.stringify({
 				status: "ok",
 				version: "__VERSION__"
 			}));
-		} else await handleErrors(req, res);
+		} else await handleErrors(req, res, deps);
 	} catch (error) {
 		console.error("Request error:", error);
 		res.writeHead(500, { "Content-Type": "text/plain" });
@@ -1194,8 +1185,20 @@ function startServer(agentConfig) {
 		console.log("Project list changed, reloading...");
 		reloadProjects();
 	});
+	const deps = () => ({
+		auth: config.auth,
+		hostnameIndex,
+		projectConfigs,
+		loadTemplate,
+		updateProjectAccess,
+		logAccess,
+		getProject,
+		setProjectStatus,
+		startProject,
+		getProjectInfo
+	});
 	createServer((req, res) => {
-		handleRequest(req, res).catch((error) => {
+		handleRequest(req, res, deps()).catch((error) => {
 			console.error("Unhandled error:", error);
 			if (!res.headersSent) {
 				res.writeHead(500);
@@ -1209,6 +1212,6 @@ function startServer(agentConfig) {
 	});
 }
 //#endregion
-export { resetSteps as A, startProject as B, updateProjectAccess as C, execSilent as D, exec as E, buildHostnameIndex as F, matchIp as G, watchProjectList as H, getProjectFromHostname as I, parseBasicAuth as K, getProjectInfo as L, step as M, success as N, info as O, warn as P, listProjects as R, setProjectStatus as S, error as T, checkAuth as U, stopProject as V, matchHostname as W, getDb as _, configureTraefik as a, initDb as b, installSystemDeps as c, getIdleTimeoutMs as d, loadProjectConfig as f, getAccessLogs as g, closeDb as h, configureDdev as i, setDryRun as j, isRoot as k, purgeTraefikAcmeStorage as l, cleanOldLogs as m, startServer as n, getDockerGatewayIp as o, shouldNeverStop as p, parseBearerToken as q, addDdevAptRepo as r, installDdev as s, routePath as t, readToolPorts as u, getIdleProjects as v, nodeIo as w, logAccess as x, getProject as y, loadProjectList as z };
+export { error as A, buildHostnameIndex as B, getIdleProjects as C, setProjectStatus as D, logAccess as E, resetSteps as F, startProject as G, getProjectInfo as H, setDryRun as I, checkAuth as J, stopProject as K, step as L, execSilent as M, info as N, updateProjectAccess as O, isRoot as P, parseBearerToken as Q, success as R, getDb as S, initDb as T, listProjects as U, getProjectFromHostname as V, loadProjectList as W, matchIp as X, matchHostname as Y, parseBasicAuth as Z, loadProjectConfig as _, handleStatus as a, closeDb as b, addDdevAptRepo as c, getDockerGatewayIp as d, installDdev as f, getIdleTimeoutMs as g, readToolPorts as h, handleRequest as i, exec as j, nodeIo as k, configureDdev as l, purgeTraefikAcmeStorage as m, handleAuth as n, routePath as o, installSystemDeps as p, watchProjectList as q, handleErrors as r, startServer as s, getEffectiveAuthConfig as t, configureTraefik as u, shouldNeverStop as v, getProject as w, getAccessLogs as x, cleanOldLogs as y, warn as z };
 
-//# sourceMappingURL=server-CvSztHW2.js.map
+//# sourceMappingURL=server-BAjHxgqh.js.map