@tomflow/proflow-dev-tunnel 0.1.1 → 0.1.3

package/CHANGELOG.md

@@ -1,5 +1,17 @@
 # @tomflow/proflow-dev-tunnel
 
+## 0.1.3
+
+### Patch Changes
+
+- Bind production dev-tunnel verification to an explicit evidence file for the frozen file-relay and 429/5xx proofs, while retaining live HTTPS/TLS/latency/size checks.
+
+## 0.1.2
+
+### Patch Changes
+
+- Real-1 final remediation and black-box release closure
+
 ## 0.1.1
 
 ### Patch Changes

package/dist/deployment/adapter.d.ts

@@ -1,5 +1,14 @@
 import type { ModuleOperationResult } from "@tomflow/proflow-module-contract";
 import type { DevTunnelRuntime, ErrorSemanticsProof, FileRelayProof } from "../src/resource-adapter.ts";
+type DevTunnelVerificationEvidence = {
+    contract: "proflow.dev-tunnel-verification.v1";
+    moduleVersion: string;
+    publicBaseUrl: string;
+    observedAt: string;
+    fileRelay: FileRelayProof;
+    errorSemantics: ErrorSemanticsProof;
+};
+export declare function readDevTunnelVerificationEvidence(file: string | undefined, publicBaseUrl: string): Promise<DevTunnelVerificationEvidence | undefined>;
 export declare function createBehaviorAdapter(input?: {
     runtime: DevTunnelRuntime;
     verifyErrorSemantics?: () => Promise<ErrorSemanticsProof>;
@@ -128,3 +137,4 @@ export declare function createProductionBinding(input: {
 }): Promise<{
     behaviorAdapter: Record<string, unknown>;
 } | undefined>;
+export {};

package/dist/deployment/adapter.js

@@ -1,3 +1,4 @@
+import { readFile } from "node:fs/promises";
 import { verifyPublicIngress } from "../src/resource-adapter.js";
 import { descriptor } from "./descriptor.js";
 const success = (data) => ({
@@ -16,6 +17,32 @@ const actionRequired = (action, description) => ({
     moduleVersion: descriptor.moduleVersion,
     actionRequired: { action, description },
 });
+export async function readDevTunnelVerificationEvidence(file, publicBaseUrl) {
+    if (!file)
+        return undefined;
+    try {
+        const raw = JSON.parse(await readFile(file, "utf8"));
+        if (raw.contract !== "proflow.dev-tunnel-verification.v1" ||
+            raw.moduleVersion !== descriptor.moduleVersion ||
+            raw.publicBaseUrl !== publicBaseUrl ||
+            typeof raw.observedAt !== "string" ||
+            Number.isNaN(Date.parse(raw.observedAt)) ||
+            typeof raw.fileRelay !== "object" ||
+            raw.fileRelay === null ||
+            typeof raw.fileRelay.verified !== "boolean" ||
+            typeof raw.fileRelay.message !== "string" ||
+            typeof raw.errorSemantics !== "object" ||
+            raw.errorSemantics === null ||
+            typeof raw.errorSemantics.rateLimit429Verified !== "boolean" ||
+            typeof raw.errorSemantics.server5xxVerified !== "boolean" ||
+            typeof raw.errorSemantics.message !== "string")
+            return undefined;
+        return raw;
+    }
+    catch {
+        return undefined;
+    }
+}
 export function createBehaviorAdapter(input) {
     return {
         describe: () => ({
@@ -191,7 +218,9 @@ export function createBehaviorAdapter(input) {
         uninstall: async () => {
             if (!input) {
                 return {
-                    result: actionRequired("configure-tunnel", "No bound dev-tunnel resource to stop before package removal"),
+                    // No bound tunnel means there is no managed external resource to
+                    // stop. Whole-instance uninstall must remain idempotent.
+                    result: success(),
                     observedEffects: [],
                 };
             }
@@ -255,12 +284,22 @@ export async function createProductionBinding(input) {
     if (!publicBaseUrl)
         return undefined;
     const { createDevTunnelRuntime } = await import("../src/resource-adapter.js");
+    const readEvidence = () => readDevTunnelVerificationEvidence(input.config.verificationEvidenceFile, publicBaseUrl);
     return {
         behaviorAdapter: createBehaviorAdapter({
             runtime: createDevTunnelRuntime({
                 publicBaseUrl,
                 ...(input.config.tunnelId ? { tunnelId: input.config.tunnelId } : {}),
             }),
+            verifyFileRelay: async () => (await readEvidence())?.fileRelay ?? {
+                verified: false,
+                message: "dev-tunnel verification evidence is missing, stale, or invalid",
+            },
+            verifyErrorSemantics: async () => (await readEvidence())?.errorSemantics ?? {
+                rateLimit429Verified: false,
+                server5xxVerified: false,
+                message: "dev-tunnel verification evidence is missing, stale, or invalid",
+            },
         }),
     };
 }

package/dist/deployment/descriptor.d.ts

@@ -3,7 +3,7 @@ export declare const descriptor: {
     readonly contractVersion: "1.0.0";
     readonly moduleRef: "dev-tunnel";
     readonly packageName: "@tomflow/proflow-dev-tunnel";
-    readonly moduleVersion: "0.1.1";
+    readonly moduleVersion: "0.1.3";
     readonly kind: "external-resource";
     readonly templateVersion: "1.0.0";
     readonly platformCompatibility: ">=1.0.0 <2.0.0";
@@ -31,6 +31,11 @@ export declare const descriptor: {
         readonly type: "string";
         readonly required: false;
         readonly description: "Persistent Microsoft Dev Tunnel identifier used when this adapter owns lifecycle start/stop";
+    }, {
+        readonly key: "verificationEvidenceFile";
+        readonly type: "path";
+        readonly required: false;
+        readonly description: "JSON evidence for real file-relay and 429/5xx verification behind the configured public ingress";
     }];
     readonly lifecycle: {
         readonly supported: readonly ["describe", "preflight", "status", "verify", "doctor", "start", "stop", "restart", "uninstall"];

package/dist/deployment/descriptor.js

@@ -3,7 +3,7 @@ export const descriptor = {
     contractVersion: "1.0.0",
     moduleRef: "dev-tunnel",
     packageName: "@tomflow/proflow-dev-tunnel",
-    moduleVersion: "0.1.1",
+    moduleVersion: "0.1.3",
     kind: "external-resource",
     templateVersion: "1.0.0",
     platformCompatibility: ">=1.0.0 <2.0.0",
@@ -34,6 +34,12 @@ export const descriptor = {
             required: false,
             description: "Persistent Microsoft Dev Tunnel identifier used when this adapter owns lifecycle start/stop",
         },
+        {
+            key: "verificationEvidenceFile",
+            type: "path",
+            required: false,
+            description: "JSON evidence for real file-relay and 429/5xx verification behind the configured public ingress",
+        },
     ],
     lifecycle: {
         supported: [

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tomflow/proflow-dev-tunnel",
-  "version": "0.1.1",
+  "version": "0.1.3",
   "type": "module",
   "publishConfig": {
     "access": "public"

package/proflow.module.json

@@ -3,7 +3,7 @@
 	"contractVersion": "1.0.0",
 	"moduleRef": "dev-tunnel",
 	"packageName": "@tomflow/proflow-dev-tunnel",
-	"moduleVersion": "0.1.1",
+	"moduleVersion": "0.1.3",
 	"kind": "external-resource",
 	"templateVersion": "1.0.0",
 	"platformCompatibility": ">=1.0.0 <2.0.0",
@@ -36,6 +36,12 @@
 			"type": "string",
 			"required": false,
 			"description": "Persistent Microsoft Dev Tunnel identifier used when this adapter owns lifecycle start/stop"
+		},
+		{
+			"key": "verificationEvidenceFile",
+			"type": "path",
+			"required": false,
+			"description": "JSON evidence for real file-relay and 429/5xx verification behind the configured public ingress"
 		}
 	],
 	"lifecycle": {