@tomflow/proflow-dev-tunnel 0.1.2 → 0.1.4

package/CHANGELOG.md

@@ -1,5 +1,17 @@
 # @tomflow/proflow-dev-tunnel
 
+## 0.1.4
+
+### Patch Changes
+
+- Detach the managed dev-tunnel host from the short-lived Platform CLI process and persist an ownership-checked process record so later status/stop/restart invocations can manage the same tunnel without turning `platform start` into a daemon.
+
+## 0.1.3
+
+### Patch Changes
+
+- Bind production dev-tunnel verification to an explicit evidence file for the frozen file-relay and 429/5xx proofs, while retaining live HTTPS/TLS/latency/size checks.
+
 ## 0.1.2
 
 ### Patch Changes

package/dist/deployment/adapter.d.ts

@@ -1,5 +1,14 @@
 import type { ModuleOperationResult } from "@tomflow/proflow-module-contract";
 import type { DevTunnelRuntime, ErrorSemanticsProof, FileRelayProof } from "../src/resource-adapter.ts";
+type DevTunnelVerificationEvidence = {
+    contract: "proflow.dev-tunnel-verification.v1";
+    moduleVersion: string;
+    publicBaseUrl: string;
+    observedAt: string;
+    fileRelay: FileRelayProof;
+    errorSemantics: ErrorSemanticsProof;
+};
+export declare function readDevTunnelVerificationEvidence(file: string | undefined, publicBaseUrl: string): Promise<DevTunnelVerificationEvidence | undefined>;
 export declare function createBehaviorAdapter(input?: {
     runtime: DevTunnelRuntime;
     verifyErrorSemantics?: () => Promise<ErrorSemanticsProof>;
@@ -125,6 +134,8 @@ export declare const behaviorAdapter: {
 export declare function createProductionBinding(input: {
     moduleRef: string;
     config: Record<string, string>;
+    workspaceRoot: string;
 }): Promise<{
     behaviorAdapter: Record<string, unknown>;
 } | undefined>;
+export {};

package/dist/deployment/adapter.js

@@ -1,3 +1,5 @@
+import { readFile } from "node:fs/promises";
+import { join } from "node:path";
 import { verifyPublicIngress } from "../src/resource-adapter.js";
 import { descriptor } from "./descriptor.js";
 const success = (data) => ({
@@ -16,6 +18,32 @@ const actionRequired = (action, description) => ({
     moduleVersion: descriptor.moduleVersion,
     actionRequired: { action, description },
 });
+export async function readDevTunnelVerificationEvidence(file, publicBaseUrl) {
+    if (!file)
+        return undefined;
+    try {
+        const raw = JSON.parse(await readFile(file, "utf8"));
+        if (raw.contract !== "proflow.dev-tunnel-verification.v1" ||
+            raw.moduleVersion !== descriptor.moduleVersion ||
+            raw.publicBaseUrl !== publicBaseUrl ||
+            typeof raw.observedAt !== "string" ||
+            Number.isNaN(Date.parse(raw.observedAt)) ||
+            typeof raw.fileRelay !== "object" ||
+            raw.fileRelay === null ||
+            typeof raw.fileRelay.verified !== "boolean" ||
+            typeof raw.fileRelay.message !== "string" ||
+            typeof raw.errorSemantics !== "object" ||
+            raw.errorSemantics === null ||
+            typeof raw.errorSemantics.rateLimit429Verified !== "boolean" ||
+            typeof raw.errorSemantics.server5xxVerified !== "boolean" ||
+            typeof raw.errorSemantics.message !== "string")
+            return undefined;
+        return raw;
+    }
+    catch {
+        return undefined;
+    }
+}
 export function createBehaviorAdapter(input) {
     return {
         describe: () => ({
@@ -257,12 +285,23 @@ export async function createProductionBinding(input) {
     if (!publicBaseUrl)
         return undefined;
     const { createDevTunnelRuntime } = await import("../src/resource-adapter.js");
+    const readEvidence = () => readDevTunnelVerificationEvidence(input.config.verificationEvidenceFile, publicBaseUrl);
     return {
         behaviorAdapter: createBehaviorAdapter({
             runtime: createDevTunnelRuntime({
                 publicBaseUrl,
                 ...(input.config.tunnelId ? { tunnelId: input.config.tunnelId } : {}),
+                processStateFile: join(input.workspaceRoot, ".proflow", "runtime", "external-resources", "dev-tunnel", "process.json"),
             }),
+            verifyFileRelay: async () => (await readEvidence())?.fileRelay ?? {
+                verified: false,
+                message: "dev-tunnel verification evidence is missing, stale, or invalid",
+            },
+            verifyErrorSemantics: async () => (await readEvidence())?.errorSemantics ?? {
+                rateLimit429Verified: false,
+                server5xxVerified: false,
+                message: "dev-tunnel verification evidence is missing, stale, or invalid",
+            },
         }),
     };
 }

package/dist/deployment/descriptor.d.ts

@@ -3,7 +3,7 @@ export declare const descriptor: {
     readonly contractVersion: "1.0.0";
     readonly moduleRef: "dev-tunnel";
     readonly packageName: "@tomflow/proflow-dev-tunnel";
-    readonly moduleVersion: "0.1.2";
+    readonly moduleVersion: "0.1.4";
     readonly kind: "external-resource";
     readonly templateVersion: "1.0.0";
     readonly platformCompatibility: ">=1.0.0 <2.0.0";
@@ -31,6 +31,11 @@ export declare const descriptor: {
         readonly type: "string";
         readonly required: false;
         readonly description: "Persistent Microsoft Dev Tunnel identifier used when this adapter owns lifecycle start/stop";
+    }, {
+        readonly key: "verificationEvidenceFile";
+        readonly type: "path";
+        readonly required: false;
+        readonly description: "JSON evidence for real file-relay and 429/5xx verification behind the configured public ingress";
     }];
     readonly lifecycle: {
         readonly supported: readonly ["describe", "preflight", "status", "verify", "doctor", "start", "stop", "restart", "uninstall"];

package/dist/deployment/descriptor.js

@@ -3,7 +3,7 @@ export const descriptor = {
     contractVersion: "1.0.0",
     moduleRef: "dev-tunnel",
     packageName: "@tomflow/proflow-dev-tunnel",
-    moduleVersion: "0.1.2",
+    moduleVersion: "0.1.4",
     kind: "external-resource",
     templateVersion: "1.0.0",
     platformCompatibility: ">=1.0.0 <2.0.0",
@@ -34,6 +34,12 @@ export const descriptor = {
             required: false,
             description: "Persistent Microsoft Dev Tunnel identifier used when this adapter owns lifecycle start/stop",
         },
+        {
+            key: "verificationEvidenceFile",
+            type: "path",
+            required: false,
+            description: "JSON evidence for real file-relay and 429/5xx verification behind the configured public ingress",
+        },
     ],
     lifecycle: {
         supported: [

package/dist/src/resource-adapter.d.ts

@@ -27,6 +27,7 @@ export declare function createDevTunnelRuntime(input: {
     tunnelId?: string;
     publicBaseUrl?: string;
     runCommand?: CommandRunner;
+    processStateFile?: string;
 }): DevTunnelRuntime;
 export interface IngressCheck {
     id: string;

package/dist/src/resource-adapter.js

@@ -1,4 +1,6 @@
 import { execFile, spawn } from "node:child_process";
+import { mkdir, readFile, rename, rm, writeFile } from "node:fs/promises";
+import { dirname } from "node:path";
 import { connect } from "node:tls";
 const LOGIN_ARGS = ["user", "show"];
 const LOGIN_TIMEOUT_MS = 10_000;
@@ -31,10 +33,83 @@ function defaultCommandRunner(command, args, options) {
         });
     });
 }
+async function readProcessRecord(file) {
+    if (!file)
+        return undefined;
+    try {
+        const raw = JSON.parse(await readFile(file, "utf8"));
+        if (raw.contract !== "proflow.dev-tunnel-process.v1" ||
+            typeof raw.pid !== "number" ||
+            !Number.isInteger(raw.pid) ||
+            raw.pid <= 0 ||
+            typeof raw.command !== "string" ||
+            raw.command.length === 0 ||
+            typeof raw.tunnelId !== "string" ||
+            raw.tunnelId.length === 0 ||
+            typeof raw.startedAt !== "string" ||
+            Number.isNaN(Date.parse(raw.startedAt)))
+            return undefined;
+        return raw;
+    }
+    catch {
+        return undefined;
+    }
+}
+async function writeProcessRecord(file, record) {
+    await mkdir(dirname(file), { recursive: true });
+    const temporary = `${file}.${process.pid}.tmp`;
+    await writeFile(temporary, `${JSON.stringify(record, null, 2)}\n`, {
+        encoding: "utf8",
+        mode: 0o600,
+    });
+    await rename(temporary, file);
+}
+function processAlive(pid) {
+    try {
+        process.kill(pid, 0);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+function processCommandLine(pid) {
+    return new Promise((resolve) => {
+        const command = process.platform === "win32" ? "powershell.exe" : "ps";
+        const args = process.platform === "win32"
+            ? [
+                "-NoProfile",
+                "-Command",
+                `(Get-CimInstance Win32_Process -Filter "ProcessId = ${pid}").CommandLine`,
+            ]
+            : ["-p", String(pid), "-o", "command="];
+        execFile(command, args, { timeout: 2_000 }, (error, stdout) => {
+            resolve(error ? undefined : String(stdout));
+        });
+    });
+}
+async function processRecordIsOwned(record, command, tunnelId) {
+    if (record.command !== command ||
+        record.tunnelId !== tunnelId ||
+        !processAlive(record.pid))
+        return false;
+    const commandLine = await processCommandLine(record.pid);
+    return (commandLine?.includes(command) === true && commandLine.includes(tunnelId));
+}
+async function waitForProcessExit(pid, timeoutMs = 2_000) {
+    const deadline = Date.now() + timeoutMs;
+    while (Date.now() < deadline) {
+        if (!processAlive(pid))
+            return true;
+        await new Promise((resolve) => setTimeout(resolve, 50));
+    }
+    return !processAlive(pid);
+}
 export function createDevTunnelRuntime(input) {
     const command = input.command ?? "devtunnel";
     const tunnelId = input.tunnelId;
     const publicBaseUrl = input.publicBaseUrl;
+    const processStateFile = input.processStateFile;
     const run = input.runCommand ?? defaultCommandRunner;
     let child;
     const observeLogin = async () => {
@@ -58,12 +133,26 @@ export function createDevTunnelRuntime(input) {
             ...(publicBaseUrl === undefined ? {} : { publicBaseUrl }),
         };
     };
+    const ownedPersistedPid = async () => {
+        if (!processStateFile || !tunnelId)
+            return undefined;
+        const record = await readProcessRecord(processStateFile);
+        if (!record)
+            return undefined;
+        if (await processRecordIsOwned(record, command, tunnelId))
+            return record.pid;
+        await rm(processStateFile, { force: true });
+        return undefined;
+    };
     return {
         command,
-        // A live owned child is RUNNING; without one we cannot prove the
-        // external tunnel has stopped, so we report UNKNOWN rather than a
-        // deterministic STOPPED.
-        status: () => observe(child ? "RUNNING" : "UNKNOWN"),
+        async status() {
+            if (await ownedPersistedPid())
+                return observe("RUNNING");
+            if (child?.pid && processAlive(child.pid))
+                return observe("RUNNING");
+            return observe("UNKNOWN");
+        },
         loginStatus: () => observeLogin(),
         publicBaseUrl: () => publicBaseUrl,
         async start() {
@@ -73,20 +162,24 @@ export function createDevTunnelRuntime(input) {
             if (tunnelId === undefined) {
                 throw new TypeError("tunnelId is required to host the configured persistent tunnel");
             }
-            if (child)
+            if (await ownedPersistedPid())
+                return observe("RUNNING");
+            if (child?.pid && processAlive(child.pid))
                 return observe("RUNNING");
-            child = spawn(command, ["host", tunnelId], { stdio: "ignore" });
+            const spawned = spawn(command, ["host", tunnelId], {
+                stdio: "ignore",
+                detached: true,
+            });
             const confirmed = await new Promise((resolve) => {
                 let settled = false;
                 const fail = () => {
                     if (settled)
                         return;
                     settled = true;
-                    child = undefined;
                     resolve("FAILED");
                 };
-                child?.once("error", fail);
-                child?.once("exit", fail);
+                spawned.once("error", fail);
+                spawned.once("exit", fail);
                 setTimeout(() => {
                     if (settled)
                         return;
@@ -94,18 +187,56 @@ export function createDevTunnelRuntime(input) {
                     resolve("RUNNING");
                 }, START_CONFIRM_MS);
             });
-            if (confirmed === "FAILED") {
+            if (confirmed === "FAILED" || spawned.pid === undefined) {
                 throw new Error("devtunnel host process failed to start");
             }
+            child = spawned;
+            spawned.once("exit", () => {
+                if (child === spawned)
+                    child = undefined;
+                if (processStateFile)
+                    void rm(processStateFile, { force: true });
+            });
+            if (processStateFile) {
+                try {
+                    await writeProcessRecord(processStateFile, {
+                        contract: "proflow.dev-tunnel-process.v1",
+                        pid: spawned.pid,
+                        command,
+                        tunnelId,
+                        startedAt: new Date().toISOString(),
+                    });
+                }
+                catch (error) {
+                    spawned.kill();
+                    child = undefined;
+                    throw error;
+                }
+            }
+            spawned.unref();
             return observe("RUNNING");
         },
         async stop() {
-            if (child) {
-                child.kill();
+            const persistedPid = await ownedPersistedPid();
+            const pid = persistedPid ?? child?.pid;
+            if (!pid || !processAlive(pid)) {
+                if (processStateFile)
+                    await rm(processStateFile, { force: true });
                 child = undefined;
-                return observe("STOPPED");
+                return observe("UNKNOWN");
             }
-            return observe("UNKNOWN");
+            try {
+                process.kill(pid, "SIGTERM");
+            }
+            catch {
+                return observe("UNKNOWN");
+            }
+            if (!(await waitForProcessExit(pid)))
+                return observe("UNKNOWN");
+            if (processStateFile)
+                await rm(processStateFile, { force: true });
+            child = undefined;
+            return observe("STOPPED");
         },
         async restart() {
             const stopped = await this.stop();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tomflow/proflow-dev-tunnel",
-  "version": "0.1.2",
+  "version": "0.1.4",
   "type": "module",
   "publishConfig": {
     "access": "public"

package/proflow.module.json

@@ -3,7 +3,7 @@
 	"contractVersion": "1.0.0",
 	"moduleRef": "dev-tunnel",
 	"packageName": "@tomflow/proflow-dev-tunnel",
-	"moduleVersion": "0.1.2",
+	"moduleVersion": "0.1.4",
 	"kind": "external-resource",
 	"templateVersion": "1.0.0",
 	"platformCompatibility": ">=1.0.0 <2.0.0",
@@ -36,6 +36,12 @@
 			"type": "string",
 			"required": false,
 			"description": "Persistent Microsoft Dev Tunnel identifier used when this adapter owns lifecycle start/stop"
+		},
+		{
+			"key": "verificationEvidenceFile",
+			"type": "path",
+			"required": false,
+			"description": "JSON evidence for real file-relay and 429/5xx verification behind the configured public ingress"
 		}
 	],
 	"lifecycle": {