@tomflow/proflow-dev-tunnel 0.1.14 → 0.1.15

package/dist/src/resource-adapter.js

@@ -2,10 +2,34 @@ import { execFile, spawn } from "node:child_process";
 import { mkdir, readFile, rename, rm, writeFile } from "node:fs/promises";
 import { dirname } from "node:path";
 import { connect } from "node:tls";
-const LOGIN_ARGS = ["user", "show"];
-const LOGIN_TIMEOUT_MS = 10_000;
+import { z } from "zod";
+const LOGIN_ARGS = ["user", "show", "--json"];
+const LOGIN_TIMEOUT_MS = 30_000;
+const REMOTE_COMMAND_TIMEOUT_MS = 30_000;
 const START_CONFIRM_MS = 500;
 function defaultCommandRunner(command, args, options) {
+    if (options?.interactive) {
+        return new Promise((resolve) => {
+            const child = spawn(command, args, { stdio: "inherit" });
+            let timedOut = false;
+            const timer = setTimeout(() => {
+                timedOut = true;
+                child.kill("SIGTERM");
+            }, options.timeoutMs ?? 600_000);
+            child.once("error", (error) => {
+                clearTimeout(timer);
+                resolve({ exitCode: null, stdout: "", stderr: error.message });
+            });
+            child.once("exit", (code) => {
+                clearTimeout(timer);
+                resolve({
+                    exitCode: timedOut ? null : code,
+                    stdout: "",
+                    stderr: timedOut ? "command timed out" : "",
+                });
+            });
+        });
+    }
     return new Promise((resolve) => {
         execFile(command, args, { timeout: options?.timeoutMs ?? 10_000 }, (error, stdout, stderr) => {
             if (error) {
@@ -33,6 +57,244 @@ function defaultCommandRunner(command, args, options) {
         });
     });
 }
+const loginStatusSchema = z.object({ status: z.string().min(1) }).passthrough();
+const tunnelPortSchema = z
+    .object({
+    portNumber: z.number().int().min(1).max(65_535),
+    protocol: z.string().min(1).optional(),
+    portForwardingUris: z.array(z.string()).optional(),
+    portUri: z.string().optional(),
+    clientConnections: z.number().int().min(0).optional(),
+})
+    .passthrough();
+const tunnelPayloadSchema = z
+    .object({
+    tunnelId: z.string().min(1),
+    endpoints: z.array(z.unknown()).optional(),
+    hostConnections: z.number().int().min(0).optional(),
+    ports: z.array(tunnelPortSchema).optional(),
+})
+    .passthrough();
+function parseTunnel(input) {
+    const direct = tunnelPayloadSchema.safeParse(input);
+    if (direct.success)
+        return direct.data;
+    return z.object({ tunnel: tunnelPayloadSchema }).passthrough().parse(input)
+        .tunnel;
+}
+function parseJson(text, label) {
+    try {
+        return JSON.parse(text);
+    }
+    catch {
+        throw new Error(`${label} returned malformed JSON`);
+    }
+}
+function parsePorts(input) {
+    if (Array.isArray(input))
+        return z.array(tunnelPortSchema).parse(input);
+    if (typeof input === "object" && input !== null) {
+        const ports = Reflect.get(input, "ports");
+        if (Array.isArray(ports))
+            return z.array(tunnelPortSchema).parse(ports);
+        const tunnel = Reflect.get(input, "tunnel");
+        if (typeof tunnel === "object" && tunnel !== null) {
+            const tunnelPorts = Reflect.get(tunnel, "ports");
+            if (Array.isArray(tunnelPorts))
+                return z.array(tunnelPortSchema).parse(tunnelPorts);
+        }
+        const port = Reflect.get(input, "port");
+        if (port !== undefined)
+            return [tunnelPortSchema.parse(port)];
+        const one = tunnelPortSchema.safeParse(input);
+        if (one.success)
+            return [one.data];
+    }
+    throw new Error("devtunnel port JSON does not contain a valid port list");
+}
+export function parseDevTunnelLoginStatus(input) {
+    const parsed = loginStatusSchema.safeParse(input);
+    if (!parsed.success)
+        return "UNKNOWN";
+    const status = parsed.data.status.trim().toLowerCase();
+    if (/(expired|not logged|login required|sign[ -]?in required|not authenticated)/.test(status))
+        return "NOT_LOGGED_IN";
+    if (/(logged in|authenticated)/.test(status))
+        return "LOGGED_IN";
+    return "UNKNOWN";
+}
+export function discoverPublicBaseUrl(input, port) {
+    const matching = parsePorts(input).filter((item) => item.portNumber === port);
+    if (matching.length !== 1)
+        throw new Error("devtunnel JSON does not identify exactly one current Gateway port");
+    const current = matching[0];
+    const uris = [
+        ...(current?.portUri ? [current.portUri] : []),
+        ...(current?.portForwardingUris ?? []),
+    ];
+    const httpsUris = uris.flatMap((raw) => {
+        try {
+            const url = new URL(raw);
+            return url.protocol === "https:" &&
+                (url.port === "" || url.port === "443")
+                ? [url.href]
+                : [];
+        }
+        catch {
+            return [];
+        }
+    });
+    if (httpsUris.length === 0)
+        throw new Error("current Gateway port has no valid HTTPS forwarding URI");
+    return httpsUris[0];
+}
+function commandText(result) {
+    return `${result.stdout}\n${result.stderr}`;
+}
+function assertCommandSucceeded(result, label) {
+    if (result.exitCode !== 0)
+        throw new Error(`${label} failed${result.exitCode === null ? " or timed out" : ""}`);
+}
+export function createDevTunnelAutomation(input) {
+    const command = input?.command ?? "devtunnel";
+    const run = input?.runCommand ?? defaultCommandRunner;
+    const loginStatus = async () => {
+        let result;
+        try {
+            result = await run(command, ["user", "show", "--json"], {
+                timeoutMs: LOGIN_TIMEOUT_MS,
+            });
+        }
+        catch {
+            return "UNKNOWN";
+        }
+        if (result.exitCode === null)
+            return "UNKNOWN";
+        try {
+            return parseDevTunnelLoginStatus(parseJson(result.stdout, "devtunnel user show --json"));
+        }
+        catch {
+            return "UNKNOWN";
+        }
+    };
+    return {
+        async ensureLogin() {
+            const before = await loginStatus();
+            if (before === "LOGGED_IN")
+                return before;
+            if (before === "UNKNOWN")
+                throw new Error("Dev Tunnel login status is UNKNOWN");
+            const login = await run(command, ["user", "login", "--github", "--use-browser-auth"], { timeoutMs: 600_000, interactive: true });
+            assertCommandSucceeded(login, "GitHub browser authentication");
+            const after = await loginStatus();
+            if (after !== "LOGGED_IN")
+                throw new Error("Dev Tunnel login was not confirmed after authentication");
+            return after;
+        },
+        async inspectTunnel(tunnelId) {
+            const result = await run(command, ["show", tunnelId, "--json"], {
+                timeoutMs: REMOTE_COMMAND_TIMEOUT_MS,
+            });
+            if (result.exitCode !== 0) {
+                return /not found|does not exist|could not be found/i.test(commandText(result))
+                    ? { state: "MISSING", hostState: "UNKNOWN" }
+                    : { state: "UNKNOWN", hostState: "UNKNOWN" };
+            }
+            try {
+                const tunnel = parseTunnel(parseJson(result.stdout, "devtunnel show --json"));
+                if (tunnel.tunnelId !== tunnelId)
+                    return { state: "UNKNOWN", hostState: "UNKNOWN" };
+                const hostState = tunnel.hostConnections !== undefined
+                    ? tunnel.hostConnections > 0
+                        ? "RUNNING"
+                        : "STOPPED"
+                    : tunnel.endpoints === undefined
+                        ? "UNKNOWN"
+                        : tunnel.endpoints.length === 0
+                            ? "STOPPED"
+                            : "RUNNING";
+                return { state: "EXISTS", hostState };
+            }
+            catch {
+                return { state: "UNKNOWN", hostState: "UNKNOWN" };
+            }
+        },
+        async createTunnel() {
+            const result = await run(command, ["create", "--allow-anonymous", "--json"], { timeoutMs: REMOTE_COMMAND_TIMEOUT_MS });
+            assertCommandSucceeded(result, "devtunnel create --json");
+            const tunnel = parseTunnel(parseJson(result.stdout, "devtunnel create --json"));
+            return tunnel.tunnelId;
+        },
+        async ensurePort(tunnelId, port) {
+            const listed = await run(command, ["port", "list", tunnelId, "--json"], {
+                timeoutMs: REMOTE_COMMAND_TIMEOUT_MS,
+            });
+            assertCommandSucceeded(listed, "devtunnel port list --json");
+            const existing = parsePorts(parseJson(listed.stdout, "devtunnel port list --json")).find((item) => item.portNumber === port);
+            if (existing?.protocol?.toLowerCase() === "http")
+                return "REUSED";
+            if (existing) {
+                const removed = await run(command, ["port", "delete", tunnelId, "--port-number", String(port), "--json"], { timeoutMs: REMOTE_COMMAND_TIMEOUT_MS });
+                assertCommandSucceeded(removed, "devtunnel port delete --json");
+            }
+            const mutation = await run(command, [
+                "port",
+                "create",
+                tunnelId,
+                "--port-number",
+                String(port),
+                "--protocol",
+                "http",
+                "--json",
+            ], { timeoutMs: REMOTE_COMMAND_TIMEOUT_MS });
+            assertCommandSucceeded(mutation, "devtunnel port create --json");
+            const confirmed = parsePorts(parseJson(mutation.stdout, "devtunnel port create --json"))[0];
+            if (confirmed === undefined ||
+                confirmed.portNumber !== port ||
+                confirmed.protocol?.toLowerCase() !== "http")
+                throw new Error("Dev Tunnel port mutation did not confirm the Gateway port");
+            return existing ? "UPDATED" : "CREATED";
+        },
+        async discoverPublicBaseUrl(tunnelId, port) {
+            let lastError;
+            for (let attempt = 0; attempt < 3; attempt += 1) {
+                const shown = await run(command, ["show", tunnelId, "--json"], {
+                    timeoutMs: REMOTE_COMMAND_TIMEOUT_MS,
+                });
+                assertCommandSucceeded(shown, "devtunnel show --json");
+                try {
+                    return discoverPublicBaseUrl(parseJson(shown.stdout, "devtunnel show --json"), port);
+                }
+                catch (error) {
+                    lastError = error;
+                    if (attempt < 2)
+                        await new Promise((resolve) => setTimeout(resolve, 250));
+                }
+            }
+            throw lastError instanceof Error
+                ? lastError
+                : new Error("publicBaseUrl discovery failed");
+        },
+    };
+}
+export async function verifyProvisionedPublicBaseUrl(publicBaseUrl, timeoutMs = 10_000) {
+    const url = new URL(publicBaseUrl);
+    const port = url.port === "" ? 443 : Number(url.port);
+    if (url.protocol !== "https:" || port !== 443)
+        throw new Error("publicBaseUrl must use HTTPS on port 443");
+    const protocol = await probeTlsProtocol(url.hostname, port, timeoutMs);
+    if (protocol === undefined || !tlsProtocolAtLeast(protocol, "TLSv1.2"))
+        throw new Error("publicBaseUrl did not negotiate TLS 1.2 or newer");
+    try {
+        await fetch(url, {
+            method: "GET",
+            signal: AbortSignal.timeout(timeoutMs),
+        });
+    }
+    catch {
+        throw new Error("publicBaseUrl is not reachable over HTTPS");
+    }
+}
 async function readProcessRecord(file) {
     if (!file)
         return undefined;
@@ -120,10 +382,14 @@ export function createDevTunnelRuntime(input) {
         catch {
             return "UNKNOWN";
         }
-        if (result.exitCode === 0) {
-            return result.stdout.trim().length > 0 ? "LOGGED_IN" : "NOT_LOGGED_IN";
+        if (result.exitCode === null)
+            return "UNKNOWN";
+        try {
+            return parseDevTunnelLoginStatus(parseJson(result.stdout, "devtunnel user show --json"));
+        }
+        catch {
+            return "UNKNOWN";
         }
-        return result.exitCode === null ? "UNKNOWN" : "NOT_LOGGED_IN";
     };
     const observe = async (state) => {
         const login = await observeLogin();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tomflow/proflow-dev-tunnel",
-  "version": "0.1.14",
+  "version": "0.1.15",
   "type": "module",
   "publishConfig": {
     "access": "public"
@@ -22,10 +22,11 @@
     "SETUP.md"
   ],
   "dependencies": {
-    "@tomflow/proflow-module-contract": "^0.1.12"
+    "zod": "4.1.12",
+    "@tomflow/proflow-module-contract": "^0.1.13"
   },
   "devDependencies": {
-    "@tomflow/proflow-deployment-conformance": "^0.1.10"
+    "@tomflow/proflow-deployment-conformance": "^0.1.11"
   },
   "description": "Governs the Microsoft Dev Tunnel public HTTPS ingress resource and its managed local host process.",
   "keywords": [

package/proflow.module.json

@@ -3,7 +3,7 @@
 	"contractVersion": "1.0.0",
 	"moduleRef": "dev-tunnel",
 	"packageName": "@tomflow/proflow-dev-tunnel",
-	"moduleVersion": "0.1.14",
+	"moduleVersion": "0.1.15",
 	"kind": "external-resource",
 	"templateVersion": "1.0.0",
 	"platformCompatibility": ">=1.0.0 <2.0.0",
@@ -25,7 +25,7 @@
 		},
 		{
 			"kind": "human",
-			"action": "Complete Microsoft Dev Tunnel login when required"
+			"action": "Complete GitHub browser authorization when login is required"
 		}
 	],
 	"configSlots": [],