@withbuddi/buddi 0.1.0-pre.36 → 0.1.0-pre.38

package/packages/gateway/dist/tips/rules.js.map

@@ -1 +1 @@
-{"version":3,"file":"rules.js","sourceRoot":"","sources":["../../src/tips/rules.ts"],"names":[],"mappings":"AAmCA,4FAA4F;AAC5F,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,SAAS,EAAE,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,UAAU,CAAU,CAAC;AAElG,MAAM,CAAC,MAAM,IAAI,GAAuB;IACtC;QACE,EAAE,EAAE,cAAc;QAClB,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,CAAC,gBAAgB,IAAI,CAAC;QACpD,YAAY,EAAE,CAAC;QACf,IAAI,EAAE,oHAAoH;QAC1H,MAAM,EAAE,EAAE,KAAK,EAAE,gBAAgB,EAAE,KAAK,EAAE,UAAU,EAAE;QACtD,YAAY,EAAE,CAAC;KAChB;IACD;QACE,EAAE,EAAE,YAAY;QAChB,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC;QAC5C,YAAY,EAAE,CAAC;QACf,IAAI,EAAE,iHAAiH;QACvH,MAAM,EAAE,EAAE,KAAK,EAAE,cAAc,EAAE,KAAK,EAAE,kBAAkB,EAAE;QAC5D,YAAY,EAAE,CAAC;KAChB;IACD;QACE,EAAE,EAAE,aAAa;QACjB,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,IAAI,CAAC,CAAC,CAAC,SAAS;QACzC,YAAY,EAAE,CAAC;QACf,IAAI,EAAE,2GAA2G;QACjH,MAAM,EAAE,EAAE,KAAK,EAAE,kBAAkB,EAAE,KAAK,EAAE,6BAA6B,EAAE;QAC3E,YAAY,EAAE,CAAC;QACf,MAAM,EAAE,OAAO;KAChB;IACD;QACE,EAAE,EAAE,YAAY;QAChB,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,eAAe,IAAI,CAAC,CAAC,CAAC,SAAS;QAC9C,YAAY,EAAE,CAAC;QACf,IAAI,EAAE,yFAAyF;QAC/F,MAAM,EAAE,EAAE,KAAK,EAAE,mBAAmB,EAAE,KAAK,EAAE,QAAQ,EAAE;QACvD,YAAY,EAAE,CAAC;QACf,MAAM,EAAE,QAAQ;KACjB;IACD;QACE,EAAE,EAAE,eAAe;QACnB,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,CAAC,IAAI,CAAC,CAAC,gBAAgB,IAAI,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC;QACrF,YAAY,EAAE,CAAC;QACf,IAAI,EAAE,uFAAuF;QAC7F,MAAM,EAAE,EAAE,KAAK,EAAE,iCAAiC,EAAE,KAAK,EAAE,gBAAgB,EAAE;QAC7E,YAAY,EAAE,CAAC;KAChB;IACD;QACE,EAAE,EAAE,cAAc;QAClB,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,WAAW,IAAI,CAAC,CAAC,gBAAgB,IAAI,CAAC;QACtD,YAAY,EAAE,CAAC;QACf,IAAI,EAAE,+FAA+F;QACrG,MAAM,EAAE,EAAE,KAAK,EAAE,6BAA6B,EAAE,KAAK,EAAE,QAAQ,EAAE;QACjE,YAAY,EAAE,CAAC;QACf,MAAM,EAAE,SAAS;KAClB;IACD;QACE,EAAE,EAAE,cAAc;QAClB,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC;QACpC,YAAY,EAAE,CAAC;QACf,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE;YACV,MAAM,KAAK,GAAG,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;YAC9B,IAAI,CAAC,KAAK;gBAAE,OAAO,gGAAgG,CAAC;YACpH,OAAO,OAAO,KAAK,CAAC,MAAM,wDAAwD,KAAK,CAAC,IAAI,IAAI,4BAA4B,EAAE,CAAC;QACjI,CAAC;QACD,MAAM,EAAE,CAAC,CAAC,EAAE,EAAE;YACZ,MAAM,KAAK,GAAG,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;YAC9B,OAAO,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,UAAU,KAAK,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC;QAC9I,CAAC;QACD,YAAY,EAAE,CAAC;KAChB;IACD;QACE,sEAAsE;QACtE,wEAAwE;QACxE,EAAE,EAAE,UAAU;QACd,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC,YAAY,IAAI,CAAC,CAAC,UAAU,IAAI,CAAC,CAAC,gBAAgB,IAAI,CAAC,CAAC,gBAAgB,IAAI,CAAC,CAAC;QAC3G,YAAY,EAAE,CAAC;QACf,IAAI,EAAE,mHAAmH;QACzH,MAAM,EAAE,EAAE,KAAK,EAAE,uBAAuB,EAAE,KAAK,EAAE,iBAAiB,EAAE;QACpE,YAAY,EAAE,MAAM;KACrB;IACD;QACE,EAAE,EAAE,qBAAqB;QACzB,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,gBAAgB,IAAI,CAAC,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAChG,YAAY,EAAE,CAAC;QACf,IAAI,EAAE,8IAA8I;QACpJ,MAAM,EAAE,EAAE,KAAK,EAAE,gBAAgB,EAAE,KAAK,EAAE,+BAA+B,EAAE;QAC3E,YAAY,EAAE,EAAE;KACjB;CACF,CAAC"}
+{"version":3,"file":"rules.js","sourceRoot":"","sources":["../../src/tips/rules.ts"],"names":[],"mappings":"AAmCA,4FAA4F;AAC5F,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,SAAS,EAAE,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,UAAU,CAAU,CAAC;AAElG,8FAA8F;AAC9F,MAAM,CAAC,MAAM,qBAAqB,GAAG,uDAAuD,CAAC;AAE7F,MAAM,CAAC,MAAM,IAAI,GAAuB;IACtC;QACE,0EAA0E;QAC1E,sEAAsE;QACtE,gEAAgE;QAChE,EAAE,EAAE,iBAAiB;QACrB,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,iBAAiB;QAChC,YAAY,EAAE,CAAC;QACf,IAAI,EAAE,wEAAwE;QAC9E,MAAM,EAAE,EAAE,KAAK,EAAE,6BAA6B,EAAE,KAAK,EAAE,qBAAqB,EAAE;QAC9E,YAAY,EAAE,MAAM;QACpB,MAAM,EAAE,UAAU;QAClB,QAAQ,EAAE,IAAI;KACf;IACD;QACE,yEAAyE;QACzE,6EAA6E;QAC7E,EAAE,EAAE,aAAa;QACjB,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU;QACzB,YAAY,EAAE,CAAC;QACf,IAAI,EAAE,6IAA6I;QACnJ,MAAM,EAAE,EAAE,KAAK,EAAE,sBAAsB,EAAE,KAAK,EAAE,qBAAqB,EAAE;QACvE,YAAY,EAAE,CAAC;KAChB;IACD;QACE,EAAE,EAAE,cAAc;QAClB,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,CAAC,gBAAgB,IAAI,CAAC;QACpD,YAAY,EAAE,CAAC;QACf,IAAI,EAAE,oHAAoH;QAC1H,MAAM,EAAE,EAAE,KAAK,EAAE,gBAAgB,EAAE,KAAK,EAAE,UAAU,EAAE;QACtD,YAAY,EAAE,CAAC;KAChB;IACD;QACE,EAAE,EAAE,YAAY;QAChB,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC;QAC5C,YAAY,EAAE,CAAC;QACf,IAAI,EAAE,iHAAiH;QACvH,MAAM,EAAE,EAAE,KAAK,EAAE,cAAc,EAAE,KAAK,EAAE,kBAAkB,EAAE;QAC5D,YAAY,EAAE,CAAC;KAChB;IACD;QACE,EAAE,EAAE,aAAa;QACjB,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,IAAI,CAAC,CAAC,CAAC,SAAS;QACzC,YAAY,EAAE,CAAC;QACf,IAAI,EAAE,2GAA2G;QACjH,MAAM,EAAE,EAAE,KAAK,EAAE,kBAAkB,EAAE,KAAK,EAAE,6BAA6B,EAAE;QAC3E,YAAY,EAAE,CAAC;QACf,MAAM,EAAE,OAAO;KAChB;IACD;QACE,EAAE,EAAE,YAAY;QAChB,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,eAAe,IAAI,CAAC,CAAC,CAAC,SAAS;QAC9C,YAAY,EAAE,CAAC;QACf,IAAI,EAAE,yFAAyF;QAC/F,MAAM,EAAE,EAAE,KAAK,EAAE,mBAAmB,EAAE,KAAK,EAAE,QAAQ,EAAE;QACvD,YAAY,EAAE,CAAC;QACf,MAAM,EAAE,QAAQ;KACjB;IACD;QACE,EAAE,EAAE,eAAe;QACnB,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,CAAC,IAAI,CAAC,CAAC,gBAAgB,IAAI,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC;QACrF,YAAY,EAAE,CAAC;QACf,IAAI,EAAE,uFAAuF;QAC7F,MAAM,EAAE,EAAE,KAAK,EAAE,iCAAiC,EAAE,KAAK,EAAE,gBAAgB,EAAE;QAC7E,YAAY,EAAE,CAAC;KAChB;IACD;QACE,EAAE,EAAE,cAAc;QAClB,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,WAAW,IAAI,CAAC,CAAC,gBAAgB,IAAI,CAAC;QACtD,YAAY,EAAE,CAAC;QACf,IAAI,EAAE,+FAA+F;QACrG,MAAM,EAAE,EAAE,KAAK,EAAE,6BAA6B,EAAE,KAAK,EAAE,QAAQ,EAAE;QACjE,YAAY,EAAE,CAAC;QACf,MAAM,EAAE,SAAS;KAClB;IACD;QACE,EAAE,EAAE,cAAc;QAClB,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC;QACpC,YAAY,EAAE,CAAC;QACf,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE;YACV,MAAM,KAAK,GAAG,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;YAC9B,IAAI,CAAC,KAAK;gBAAE,OAAO,gGAAgG,CAAC;YACpH,OAAO,OAAO,KAAK,CAAC,MAAM,wDAAwD,KAAK,CAAC,IAAI,IAAI,4BAA4B,EAAE,CAAC;QACjI,CAAC;QACD,MAAM,EAAE,CAAC,CAAC,EAAE,EAAE;YACZ,MAAM,KAAK,GAAG,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;YAC9B,OAAO,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,UAAU,KAAK,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC;QAC9I,CAAC;QACD,YAAY,EAAE,CAAC;KAChB;IACD;QACE,sEAAsE;QACtE,wEAAwE;QACxE,EAAE,EAAE,UAAU;QACd,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC,YAAY,IAAI,CAAC,CAAC,UAAU,IAAI,CAAC,CAAC,gBAAgB,IAAI,CAAC,CAAC,gBAAgB,IAAI,CAAC,CAAC;QAC3G,YAAY,EAAE,CAAC;QACf,IAAI,EAAE,mHAAmH;QACzH,MAAM,EAAE,EAAE,KAAK,EAAE,uBAAuB,EAAE,KAAK,EAAE,iBAAiB,EAAE;QACpE,YAAY,EAAE,MAAM;KACrB;IACD;QACE,EAAE,EAAE,qBAAqB;QACzB,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,gBAAgB,IAAI,CAAC,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAChG,YAAY,EAAE,CAAC;QACf,IAAI,EAAE,8IAA8I;QACpJ,MAAM,EAAE,EAAE,KAAK,EAAE,gBAAgB,EAAE,KAAK,EAAE,+BAA+B,EAAE;QAC3E,YAAY,EAAE,EAAE;KACjB;CACF,CAAC"}

package/packages/gateway/dist/web/access/arrival.d.ts

@@ -0,0 +1,24 @@
+/**
+ * How a request reached the gateway: decided by *where it was accepted*, never
+ * by what it says (specs/trusted-access.md §3.3, §7.5).
+ *
+ * - `main`: the dashboard's own listener (127.0.0.1:4317). Local unless proxy
+ *   metadata downgrades it, as it always was. Tailscale Serve points here.
+ * - `ingress`: the loopback listener a this-machine proxy other than Tailscale
+ *   points at (cloudflared). Everything on it is remote, whatever its headers
+ *   or `Host` say, and it never passes a loopback-only check, although its
+ *   socket is a loopback one.
+ * - `relay`: a request handed over in-process by the withbuddi relay client
+ *   (provider 3, not built yet). No socket and no loopback address at all.
+ *
+ * The tag lives on the socket (or the request) in a WeakMap, set by the code
+ * that accepted it. Nothing a client sends can set or clear it.
+ */
+import type { IncomingMessage } from 'node:http';
+export type Arrival = 'main' | 'ingress' | 'relay';
+/** Tag every request on this socket. Called from the ingress listener's `connection` event. */
+export declare function markSocketArrival(socket: object, arrival: Exclude<Arrival, 'main'>): void;
+/** Tag one request handed to the handler without a socket of its own (the relay). */
+export declare function markRequestArrival(req: object, arrival: Exclude<Arrival, 'main'>): void;
+export declare function arrivalOf(req: IncomingMessage): Arrival;
+//# sourceMappingURL=arrival.d.ts.map

package/packages/gateway/dist/web/access/arrival.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"arrival.d.ts","sourceRoot":"","sources":["../../../src/web/access/arrival.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AAEjD,MAAM,MAAM,OAAO,GAAG,MAAM,GAAG,SAAS,GAAG,OAAO,CAAC;AAKnD,+FAA+F;AAC/F,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,MAAM,CAAC,GAAG,IAAI,CAEzF;AAED,qFAAqF;AACrF,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,MAAM,CAAC,GAAG,IAAI,CAEvF;AAED,wBAAgB,SAAS,CAAC,GAAG,EAAE,eAAe,GAAG,OAAO,CAKvD"}

package/packages/gateway/dist/web/access/arrival.js

@@ -0,0 +1,18 @@
+const bySocket = new WeakMap();
+const byRequest = new WeakMap();
+/** Tag every request on this socket. Called from the ingress listener's `connection` event. */
+export function markSocketArrival(socket, arrival) {
+    bySocket.set(socket, arrival);
+}
+/** Tag one request handed to the handler without a socket of its own (the relay). */
+export function markRequestArrival(req, arrival) {
+    byRequest.set(req, arrival);
+}
+export function arrivalOf(req) {
+    const tagged = byRequest.get(req);
+    if (tagged)
+        return tagged;
+    const socket = req.socket;
+    return (socket && bySocket.get(socket)) || 'main';
+}
+//# sourceMappingURL=arrival.js.map

package/packages/gateway/dist/web/access/arrival.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"arrival.js","sourceRoot":"","sources":["../../../src/web/access/arrival.ts"],"names":[],"mappings":"AAoBA,MAAM,QAAQ,GAAG,IAAI,OAAO,EAAoC,CAAC;AACjE,MAAM,SAAS,GAAG,IAAI,OAAO,EAAoC,CAAC;AAElE,+FAA+F;AAC/F,MAAM,UAAU,iBAAiB,CAAC,MAAc,EAAE,OAAiC;IACjF,QAAQ,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAChC,CAAC;AAED,qFAAqF;AACrF,MAAM,UAAU,kBAAkB,CAAC,GAAW,EAAE,OAAiC;IAC/E,SAAS,CAAC,GAAG,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;AAC9B,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,GAAoB;IAC5C,MAAM,MAAM,GAAG,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAClC,IAAI,MAAM;QAAE,OAAO,MAAM,CAAC;IAC1B,MAAM,MAAM,GAAI,GAAkC,CAAC,MAAM,CAAC;IAC1D,OAAO,CAAC,MAAM,IAAI,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,MAAM,CAAC;AACpD,CAAC"}

package/packages/gateway/dist/web/access/cloudflare-api.d.ts

@@ -0,0 +1,124 @@
+/**
+ * The few calls of Cloudflare's REST API (v4) that "Set it up for me" makes
+ * (slate jxtBIbNaS-): zones, the Zero Trust organization (the team domain),
+ * tunnels and their configuration, DNS records, Access applications and
+ * reusable Access policies.
+ *
+ * Every call goes through the gateway's outbound transport with the owner's
+ * API token as a bearer header. The token is never logged, never put in an
+ * error, and never echoed: a failure is a `CloudflareApiError` whose sentence
+ * is built from what was asked and Cloudflare's own error codes, and names the
+ * token permission a 403 says is missing.
+ */
+import { type HttpTransport } from '@buddi/runtime';
+export declare const CLOUDFLARE_API = "https://api.cloudflare.com/client/v4";
+/** The token permissions the setup needs, as Cloudflare's token page names them. */
+export declare const CLOUDFLARE_PERMISSIONS: {
+    readonly tunnel: "Account · Cloudflare Tunnel · Edit";
+    readonly access: "Account · Access: Apps and Policies · Edit";
+    readonly organization: "Account · Access: Organizations, Identity Providers, and Groups · Read";
+    readonly dns: "Zone · DNS · Edit";
+};
+export type CloudflarePermission = keyof typeof CLOUDFLARE_PERMISSIONS;
+/** In the order the form lists them. */
+export declare const CLOUDFLARE_PERMISSION_LINES: readonly string[];
+/**
+ * Cloudflare's token page, pre-filled with the four permissions (its template
+ * URL: the form opens configured, the owner still names and creates the token).
+ * `zoneId=all` is the only documented value; the owner may narrow it on the form.
+ */
+export declare const CLOUDFLARE_TOKEN_URL: string;
+/**
+ * What a tunnel connector token looks like (base64url-ish, long): the token
+ * goes into the `sudo cloudflared service install <token>` line the owner
+ * copies, so nothing a shell would read as more ever gets there.
+ */
+export declare const CONNECTOR_TOKEN: RegExp;
+export declare class CloudflareApiError extends Error {
+    readonly status: number;
+    /** Cloudflare's error codes, when it gave any. */
+    readonly codes: number[];
+    /** The permission a 403 says the token lacks. */
+    readonly permission?: CloudflarePermission | undefined;
+    constructor(message: string, status: number, 
+    /** Cloudflare's error codes, when it gave any. */
+    codes: number[], 
+    /** The permission a 403 says the token lacks. */
+    permission?: CloudflarePermission | undefined);
+}
+export interface CfZone {
+    id: string;
+    name: string;
+    account: {
+        id: string;
+        name?: string;
+    };
+}
+export interface CfTunnel {
+    id: string;
+    name: string;
+    status?: string;
+    deleted_at?: string | null;
+}
+export interface CfDnsRecord {
+    id: string;
+    type: string;
+    name: string;
+    content: string;
+    comment?: string | null;
+    proxied?: boolean;
+}
+export interface CfAccessPolicy {
+    id: string;
+    name: string;
+    decision: string;
+    include?: unknown[];
+}
+export interface CfAccessApp {
+    id: string;
+    name: string;
+    domain: string;
+    aud: string;
+    type?: string;
+    policies?: Array<{
+        id: string;
+        precedence?: number;
+    }>;
+}
+export interface CloudflareApi {
+    verifyToken(): Promise<'active' | 'inactive' | 'unknown'>;
+    zones(): Promise<CfZone[]>;
+    teamDomain(accountId: string): Promise<string>;
+    findTunnel(accountId: string, name: string): Promise<CfTunnel | null>;
+    createTunnel(accountId: string, name: string): Promise<CfTunnel>;
+    tunnel(accountId: string, id: string): Promise<CfTunnel>;
+    tunnelToken(accountId: string, id: string): Promise<string>;
+    putTunnelConfig(accountId: string, id: string, hostname: string, service: string): Promise<void>;
+    deleteTunnel(accountId: string, id: string): Promise<void>;
+    dnsRecords(zoneId: string, name: string): Promise<CfDnsRecord[]>;
+    createCname(zoneId: string, name: string, target: string, comment: string): Promise<CfDnsRecord>;
+    deleteDnsRecord(zoneId: string, id: string): Promise<void>;
+    policies(accountId: string): Promise<CfAccessPolicy[]>;
+    createPolicy(accountId: string, name: string, email: string): Promise<CfAccessPolicy>;
+    updatePolicy(accountId: string, id: string, name: string, email: string): Promise<CfAccessPolicy>;
+    deletePolicy(accountId: string, id: string): Promise<void>;
+    apps(accountId: string): Promise<CfAccessApp[]>;
+    createApp(accountId: string, input: {
+        name: string;
+        domain: string;
+        policyId: string;
+    }): Promise<CfAccessApp>;
+    updateApp(accountId: string, id: string, input: {
+        name: string;
+        domain: string;
+        policyId: string;
+    }): Promise<CfAccessApp>;
+    deleteApp(accountId: string, id: string): Promise<void>;
+}
+export declare function createCloudflareApi(deps: {
+    token: string;
+    transport?: HttpTransport | undefined;
+    /** `https://api.cloudflare.com/client/v4`, or a test's fake. */
+    baseUrl?: string | undefined;
+}): CloudflareApi;
+//# sourceMappingURL=cloudflare-api.d.ts.map

package/packages/gateway/dist/web/access/cloudflare-api.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cloudflare-api.d.ts","sourceRoot":"","sources":["../../../src/web/access/cloudflare-api.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,OAAO,EAAwB,KAAK,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAE1E,eAAO,MAAM,cAAc,yCAAyC,CAAC;AAErE,oFAAoF;AACpF,eAAO,MAAM,sBAAsB;;;;;CAKzB,CAAC;AACX,MAAM,MAAM,oBAAoB,GAAG,MAAM,OAAO,sBAAsB,CAAC;AAEvE,wCAAwC;AACxC,eAAO,MAAM,2BAA2B,EAAE,SAAS,MAAM,EAKxD,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,oBAAoB,QAUpB,CAAC;AAEd;;;;GAIG;AACH,eAAO,MAAM,eAAe,QAA4B,CAAC;AAEzD,qBAAa,kBAAmB,SAAQ,KAAK;IAGzC,QAAQ,CAAC,MAAM,EAAE,MAAM;IACvB,kDAAkD;IAClD,QAAQ,CAAC,KAAK,EAAE,MAAM,EAAE;IACxB,iDAAiD;IACjD,QAAQ,CAAC,UAAU,CAAC,EAAE,oBAAoB,GAAG,SAAS;gBALtD,OAAO,EAAE,MAAM,EACN,MAAM,EAAE,MAAM;IACvB,kDAAkD;IACzC,KAAK,EAAE,MAAM,EAAE;IACxB,iDAAiD;IACxC,UAAU,CAAC,EAAE,oBAAoB,GAAG,SAAS;CAKzD;AAED,MAAM,WAAW,MAAM;IAAG,EAAE,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,CAAA;CAAE;AAC5F,MAAM,WAAW,QAAQ;IAAG,EAAE,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE;AACnG,MAAM,WAAW,WAAW;IAAG,EAAE,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,OAAO,CAAC,EAAE,OAAO,CAAA;CAAE;AACpI,MAAM,WAAW,cAAc;IAAG,EAAE,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,OAAO,EAAE,CAAA;CAAE;AACnG,MAAM,WAAW,WAAW;IAAG,EAAE,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,KAAK,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;CAAE;AAE5J,MAAM,WAAW,aAAa;IAC5B,WAAW,IAAI,OAAO,CAAC,QAAQ,GAAG,UAAU,GAAG,SAAS,CAAC,CAAC;IAC1D,KAAK,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IAC3B,UAAU,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAC/C,UAAU,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAAC;IACtE,YAAY,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IACjE,MAAM,CAAC,SAAS,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IACzD,WAAW,CAAC,SAAS,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAC5D,eAAe,CAAC,SAAS,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACjG,YAAY,CAAC,SAAS,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3D,UAAU,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC;IACjE,WAAW,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;IACjG,eAAe,CAAC,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3D,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,EAAE,CAAC,CAAC;IACvD,YAAY,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;IACtF,YAAY,CAAC,SAAS,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;IAClG,YAAY,CAAC,SAAS,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3D,IAAI,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC;IAChD,SAAS,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;IAC9G,SAAS,CAAC,SAAS,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;IAC1H,SAAS,CAAC,SAAS,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACzD;AAuBD,wBAAgB,mBAAmB,CAAC,IAAI,EAAE;IACxC,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,CAAC,EAAE,aAAa,GAAG,SAAS,CAAC;IACtC,gEAAgE;IAChE,OAAO,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC9B,GAAG,aAAa,CA6HhB"}

package/packages/gateway/dist/web/access/cloudflare-api.js

@@ -0,0 +1,206 @@
+/**
+ * The few calls of Cloudflare's REST API (v4) that "Set it up for me" makes
+ * (slate jxtBIbNaS-): zones, the Zero Trust organization (the team domain),
+ * tunnels and their configuration, DNS records, Access applications and
+ * reusable Access policies.
+ *
+ * Every call goes through the gateway's outbound transport with the owner's
+ * API token as a bearer header. The token is never logged, never put in an
+ * error, and never echoed: a failure is a `CloudflareApiError` whose sentence
+ * is built from what was asked and Cloudflare's own error codes, and names the
+ * token permission a 403 says is missing.
+ */
+import { defaultHttpTransport } from '@buddi/runtime';
+export const CLOUDFLARE_API = 'https://api.cloudflare.com/client/v4';
+/** The token permissions the setup needs, as Cloudflare's token page names them. */
+export const CLOUDFLARE_PERMISSIONS = {
+    tunnel: 'Account · Cloudflare Tunnel · Edit',
+    access: 'Account · Access: Apps and Policies · Edit',
+    organization: 'Account · Access: Organizations, Identity Providers, and Groups · Read',
+    dns: 'Zone · DNS · Edit',
+};
+/** In the order the form lists them. */
+export const CLOUDFLARE_PERMISSION_LINES = [
+    CLOUDFLARE_PERMISSIONS.tunnel,
+    CLOUDFLARE_PERMISSIONS.access,
+    CLOUDFLARE_PERMISSIONS.organization,
+    `${CLOUDFLARE_PERMISSIONS.dns} — on the zone of your hostname`,
+];
+/**
+ * Cloudflare's token page, pre-filled with the four permissions (its template
+ * URL: the form opens configured, the owner still names and creates the token).
+ * `zoneId=all` is the only documented value; the owner may narrow it on the form.
+ */
+export const CLOUDFLARE_TOKEN_URL = 'https://dash.cloudflare.com/profile/api-tokens?' + new URLSearchParams({
+    permissionGroupKeys: JSON.stringify([
+        { key: 'argotunnel', type: 'edit' },
+        { key: 'access', type: 'edit' },
+        { key: 'access_acct', type: 'read' },
+        { key: 'dns', type: 'edit' },
+    ]),
+    accountId: '*',
+    zoneId: 'all',
+    name: 'buddi',
+}).toString();
+/**
+ * What a tunnel connector token looks like (base64url-ish, long): the token
+ * goes into the `sudo cloudflared service install <token>` line the owner
+ * copies, so nothing a shell would read as more ever gets there.
+ */
+export const CONNECTOR_TOKEN = /^[A-Za-z0-9+/=_-]{20,}$/;
+export class CloudflareApiError extends Error {
+    status;
+    codes;
+    permission;
+    constructor(message, status, 
+    /** Cloudflare's error codes, when it gave any. */
+    codes, 
+    /** The permission a 403 says the token lacks. */
+    permission) {
+        super(message);
+        this.status = status;
+        this.codes = codes;
+        this.permission = permission;
+        this.name = 'CloudflareApiError';
+    }
+}
+/** Cloudflare's codes for "this token may not do that". */
+const FORBIDDEN_CODES = new Set([9109, 10000]);
+function sentenceFor(status, codes, purpose) {
+    if (status === 401 || codes.includes(1000) || codes.includes(6003) || codes.includes(6111)) {
+        return { text: 'Cloudflare doesn’t accept this API token. Check that it was pasted whole and has not expired.' };
+    }
+    if ((status === 403 || codes.some((c) => FORBIDDEN_CODES.has(c))) && purpose.permission) {
+        return {
+            text: `The token can’t ${purpose.doing}. Add ${CLOUDFLARE_PERMISSIONS[purpose.permission]} to it in Cloudflare (My Profile → API Tokens → Edit), then try again.`,
+            permission: purpose.permission,
+        };
+    }
+    if (status === 429)
+        return { text: `Cloudflare asked buddi to slow down while trying to ${purpose.doing}. Try again in a minute.` };
+    if (status >= 500)
+        return { text: `Cloudflare had a problem while buddi tried to ${purpose.doing} (${status}). Try again in a moment.` };
+    return { text: `Cloudflare refused to ${purpose.doing} (${status}${codes.length ? `, code ${codes.join(', ')}` : ''}).` };
+}
+export function createCloudflareApi(deps) {
+    const transport = deps.transport ?? defaultHttpTransport;
+    const base = (deps.baseUrl ?? CLOUDFLARE_API).replace(/\/+$/, '');
+    async function call(method, path, purpose, body) {
+        let res;
+        try {
+            res = await transport(`${base}${path}`, {
+                method,
+                headers: {
+                    authorization: `Bearer ${deps.token}`,
+                    accept: 'application/json',
+                    ...(body === undefined ? {} : { 'content-type': 'application/json' }),
+                },
+                ...(body === undefined ? {} : { body: JSON.stringify(body) }),
+                idleTimeoutMs: 20_000,
+                maxBytes: 4_000_000,
+            });
+        }
+        catch {
+            // A transport error can carry the request; say only what was being done.
+            throw new CloudflareApiError(`Cloudflare could not be reached while buddi tried to ${purpose.doing}. Check this computer’s connection.`, 0, []);
+        }
+        const parsed = (await res.json().catch(() => null));
+        const codes = (parsed?.errors ?? []).map((e) => Number(e?.code)).filter((c) => Number.isFinite(c));
+        if (!res.ok || parsed?.success === false) {
+            const said = sentenceFor(res.status, codes, purpose);
+            throw new CloudflareApiError(said.text, res.status, codes, said.permission);
+        }
+        return (parsed?.result ?? null);
+    }
+    const q = encodeURIComponent;
+    const policyBody = (name, email) => ({
+        name,
+        decision: 'allow',
+        include: [{ email: { email } }],
+        session_duration: '24h',
+    });
+    const appBody = (input) => ({
+        name: input.name,
+        domain: input.domain,
+        type: 'self_hosted',
+        session_duration: '24h',
+        app_launcher_visible: false,
+        policies: [{ id: input.policyId, precedence: 1 }],
+    });
+    return {
+        async verifyToken() {
+            try {
+                const result = await call('GET', '/user/tokens/verify', { doing: 'check itself' });
+                return result?.status === 'active' ? 'active' : 'inactive';
+            }
+            catch (error) {
+                // An account-owned token cannot verify itself here; only a flat
+                // refusal of the token is an answer.
+                if (error instanceof CloudflareApiError && error.status === 401)
+                    throw error;
+                return 'unknown';
+            }
+        },
+        async zones() {
+            const all = [];
+            for (let page = 1; page <= 10; page++) {
+                const batch = await call('GET', `/zones?per_page=50&page=${page}`, { doing: 'list your domains', permission: 'dns' });
+                all.push(...(batch ?? []));
+                if (!batch || batch.length < 50)
+                    break;
+            }
+            return all;
+        },
+        async teamDomain(accountId) {
+            const org = await call('GET', `/accounts/${q(accountId)}/access/organizations`, { doing: 'read your Zero Trust team domain', permission: 'organization' });
+            return (org?.auth_domain ?? '').trim().toLowerCase();
+        },
+        async findTunnel(accountId, name) {
+            const list = await call('GET', `/accounts/${q(accountId)}/cfd_tunnel?is_deleted=false&name=${q(name)}`, { doing: 'list tunnels', permission: 'tunnel' });
+            return (list ?? []).find((t) => t.name === name && !t.deleted_at) ?? null;
+        },
+        createTunnel: (accountId, name) => call('POST', `/accounts/${q(accountId)}/cfd_tunnel`, { doing: 'create a tunnel', permission: 'tunnel' }, { name, config_src: 'cloudflare' }),
+        tunnel: (accountId, id) => call('GET', `/accounts/${q(accountId)}/cfd_tunnel/${q(id)}`, { doing: 'read the tunnel', permission: 'tunnel' }),
+        async tunnelToken(accountId, id) {
+            const token = await call('GET', `/accounts/${q(accountId)}/cfd_tunnel/${q(id)}/token`, { doing: 'read the tunnel’s connector token', permission: 'tunnel' });
+            if (typeof token !== 'string' || !CONNECTOR_TOKEN.test(token))
+                throw new CloudflareApiError('Cloudflare answered without the tunnel’s connector token.', 200, []);
+            return token;
+        },
+        async putTunnelConfig(accountId, id, hostname, service) {
+            await call('PUT', `/accounts/${q(accountId)}/cfd_tunnel/${q(id)}/configurations`, { doing: 'route the hostname through the tunnel', permission: 'tunnel' }, {
+                config: { ingress: [{ hostname, service }, { service: 'http_status:404' }] },
+            });
+        },
+        async deleteTunnel(accountId, id) {
+            // A tunnel with a connector still attached is refused; its stale
+            // connections go first.
+            await call('DELETE', `/accounts/${q(accountId)}/cfd_tunnel/${q(id)}/connections`, { doing: 'disconnect the tunnel', permission: 'tunnel' }).catch(() => undefined);
+            await call('DELETE', `/accounts/${q(accountId)}/cfd_tunnel/${q(id)}`, { doing: 'delete the tunnel', permission: 'tunnel' });
+        },
+        async dnsRecords(zoneId, name) {
+            return (await call('GET', `/zones/${q(zoneId)}/dns_records?name=${q(name)}&per_page=50`, { doing: 'read your DNS records', permission: 'dns' })) ?? [];
+        },
+        createCname: (zoneId, name, target, comment) => call('POST', `/zones/${q(zoneId)}/dns_records`, { doing: 'add a DNS record', permission: 'dns' }, { type: 'CNAME', name, content: target, proxied: true, ttl: 1, comment }),
+        async deleteDnsRecord(zoneId, id) {
+            await call('DELETE', `/zones/${q(zoneId)}/dns_records/${q(id)}`, { doing: 'delete the DNS record', permission: 'dns' });
+        },
+        async policies(accountId) {
+            return (await call('GET', `/accounts/${q(accountId)}/access/policies?per_page=100`, { doing: 'list Access policies', permission: 'access' })) ?? [];
+        },
+        createPolicy: (accountId, name, email) => call('POST', `/accounts/${q(accountId)}/access/policies`, { doing: 'create an Access policy', permission: 'access' }, policyBody(name, email)),
+        updatePolicy: (accountId, id, name, email) => call('PUT', `/accounts/${q(accountId)}/access/policies/${q(id)}`, { doing: 'update the Access policy', permission: 'access' }, policyBody(name, email)),
+        async deletePolicy(accountId, id) {
+            await call('DELETE', `/accounts/${q(accountId)}/access/policies/${q(id)}`, { doing: 'delete the Access policy', permission: 'access' });
+        },
+        async apps(accountId) {
+            return (await call('GET', `/accounts/${q(accountId)}/access/apps?per_page=100`, { doing: 'list Access applications', permission: 'access' })) ?? [];
+        },
+        createApp: (accountId, input) => call('POST', `/accounts/${q(accountId)}/access/apps`, { doing: 'create Access applications', permission: 'access' }, appBody(input)),
+        updateApp: (accountId, id, input) => call('PUT', `/accounts/${q(accountId)}/access/apps/${q(id)}`, { doing: 'update the Access application', permission: 'access' }, appBody(input)),
+        async deleteApp(accountId, id) {
+            await call('DELETE', `/accounts/${q(accountId)}/access/apps/${q(id)}`, { doing: 'delete the Access application', permission: 'access' });
+        },
+    };
+}
+//# sourceMappingURL=cloudflare-api.js.map

package/packages/gateway/dist/web/access/cloudflare-api.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cloudflare-api.js","sourceRoot":"","sources":["../../../src/web/access/cloudflare-api.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,OAAO,EAAE,oBAAoB,EAAsB,MAAM,gBAAgB,CAAC;AAE1E,MAAM,CAAC,MAAM,cAAc,GAAG,sCAAsC,CAAC;AAErE,oFAAoF;AACpF,MAAM,CAAC,MAAM,sBAAsB,GAAG;IACpC,MAAM,EAAE,oCAAoC;IAC5C,MAAM,EAAE,4CAA4C;IACpD,YAAY,EAAE,wEAAwE;IACtF,GAAG,EAAE,mBAAmB;CAChB,CAAC;AAGX,wCAAwC;AACxC,MAAM,CAAC,MAAM,2BAA2B,GAAsB;IAC5D,sBAAsB,CAAC,MAAM;IAC7B,sBAAsB,CAAC,MAAM;IAC7B,sBAAsB,CAAC,YAAY;IACnC,GAAG,sBAAsB,CAAC,GAAG,iCAAiC;CAC/D,CAAC;AAEF;;;;GAIG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,iDAAiD,GAAG,IAAI,eAAe,CAAC;IAC1G,mBAAmB,EAAE,IAAI,CAAC,SAAS,CAAC;QAClC,EAAE,GAAG,EAAE,YAAY,EAAE,IAAI,EAAE,MAAM,EAAE;QACnC,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE;QAC/B,EAAE,GAAG,EAAE,aAAa,EAAE,IAAI,EAAE,MAAM,EAAE;QACpC,EAAE,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE;KAC7B,CAAC;IACF,SAAS,EAAE,GAAG;IACd,MAAM,EAAE,KAAK;IACb,IAAI,EAAE,OAAO;CACd,CAAC,CAAC,QAAQ,EAAE,CAAC;AAEd;;;;GAIG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,yBAAyB,CAAC;AAEzD,MAAM,OAAO,kBAAmB,SAAQ,KAAK;IAGhC;IAEA;IAEA;IANX,YACE,OAAe,EACN,MAAc;IACvB,kDAAkD;IACzC,KAAe;IACxB,iDAAiD;IACxC,UAA6C;QAEtD,KAAK,CAAC,OAAO,CAAC,CAAC;QANN,WAAM,GAAN,MAAM,CAAQ;QAEd,UAAK,GAAL,KAAK,CAAU;QAEf,eAAU,GAAV,UAAU,CAAmC;QAGtD,IAAI,CAAC,IAAI,GAAG,oBAAoB,CAAC;IACnC,CAAC;CACF;AAkCD,2DAA2D;AAC3D,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC;AAE/C,SAAS,WAAW,CAAC,MAAc,EAAE,KAAe,EAAE,OAAgB;IACpE,IAAI,MAAM,KAAK,GAAG,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QAC3F,OAAO,EAAE,IAAI,EAAE,+FAA+F,EAAE,CAAC;IACnH,CAAC;IACD,IAAI,CAAC,MAAM,KAAK,GAAG,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC;QACxF,OAAO;YACL,IAAI,EAAE,mBAAmB,OAAO,CAAC,KAAK,SAAS,sBAAsB,CAAC,OAAO,CAAC,UAAU,CAAC,wEAAwE;YACjK,UAAU,EAAE,OAAO,CAAC,UAAU;SAC/B,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,KAAK,GAAG;QAAE,OAAO,EAAE,IAAI,EAAE,uDAAuD,OAAO,CAAC,KAAK,0BAA0B,EAAE,CAAC;IACpI,IAAI,MAAM,IAAI,GAAG;QAAE,OAAO,EAAE,IAAI,EAAE,iDAAiD,OAAO,CAAC,KAAK,KAAK,MAAM,2BAA2B,EAAE,CAAC;IACzI,OAAO,EAAE,IAAI,EAAE,yBAAyB,OAAO,CAAC,KAAK,KAAK,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,UAAU,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC;AAC5H,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,IAKnC;IACC,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,oBAAoB,CAAC;IACzD,MAAM,IAAI,GAAG,CAAC,IAAI,CAAC,OAAO,IAAI,cAAc,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAElE,KAAK,UAAU,IAAI,CAAI,MAAc,EAAE,IAAY,EAAE,OAAgB,EAAE,IAAc;QACnF,IAAI,GAAG,CAAC;QACR,IAAI,CAAC;YACH,GAAG,GAAG,MAAM,SAAS,CAAC,GAAG,IAAI,GAAG,IAAI,EAAE,EAAE;gBACtC,MAAM;gBACN,OAAO,EAAE;oBACP,aAAa,EAAE,UAAU,IAAI,CAAC,KAAK,EAAE;oBACrC,MAAM,EAAE,kBAAkB;oBAC1B,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC;iBACtE;gBACD,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC7D,aAAa,EAAE,MAAM;gBACrB,QAAQ,EAAE,SAAS;aACpB,CAAC,CAAC;QACL,CAAC;QAAC,MAAM,CAAC;YACP,yEAAyE;YACzE,MAAM,IAAI,kBAAkB,CAAC,wDAAwD,OAAO,CAAC,KAAK,qCAAqC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QAClJ,CAAC;QACD,MAAM,MAAM,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAuF,CAAC;QAC1I,MAAM,KAAK,GAAG,CAAC,MAAM,EAAE,MAAM,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;QACnG,IAAI,CAAC,GAAG,CAAC,EAAE,IAAI,MAAM,EAAE,OAAO,KAAK,KAAK,EAAE,CAAC;YACzC,MAAM,IAAI,GAAG,WAAW,CAAC,GAAG,CAAC,MAAM,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;YACrD,MAAM,IAAI,kBAAkB,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,MAAM,EAAE,KAAK,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;QAC9E,CAAC;QACD,OAAO,CAAC,MAAM,EAAE,MAAM,IAAI,IAAI,CAAM,CAAC;IACvC,CAAC;IAED,MAAM,CAAC,GAAG,kBAAkB,CAAC;IAC7B,MAAM,UAAU,GAAG,CAAC,IAAY,EAAE,KAAa,EAAE,EAAE,CAAC,CAAC;QACnD,IAAI;QACJ,QAAQ,EAAE,OAAO;QACjB,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,CAAC;QAC/B,gBAAgB,EAAE,KAAK;KACxB,CAAC,CAAC;IACH,MAAM,OAAO,GAAG,CAAC,KAAyD,EAAE,EAAE,CAAC,CAAC;QAC9E,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,IAAI,EAAE,aAAa;QACnB,gBAAgB,EAAE,KAAK;QACvB,oBAAoB,EAAE,KAAK;QAC3B,QAAQ,EAAE,CAAC,EAAE,EAAE,EAAE,KAAK,CAAC,QAAQ,EAAE,UAAU,EAAE,CAAC,EAAE,CAAC;KAClD,CAAC,CAAC;IAEH,OAAO;QACL,KAAK,CAAC,WAAW;YACf,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAA6B,KAAK,EAAE,qBAAqB,EAAE,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC;gBAC/G,OAAO,MAAM,EAAE,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC;YAC7D,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,gEAAgE;gBAChE,qCAAqC;gBACrC,IAAI,KAAK,YAAY,kBAAkB,IAAI,KAAK,CAAC,MAAM,KAAK,GAAG;oBAAE,MAAM,KAAK,CAAC;gBAC7E,OAAO,SAAS,CAAC;YACnB,CAAC;QACH,CAAC;QACD,KAAK,CAAC,KAAK;YACT,MAAM,GAAG,GAAa,EAAE,CAAC;YACzB,KAAK,IAAI,IAAI,GAAG,CAAC,EAAE,IAAI,IAAI,EAAE,EAAE,IAAI,EAAE,EAAE,CAAC;gBACtC,MAAM,KAAK,GAAG,MAAM,IAAI,CAAW,KAAK,EAAE,2BAA2B,IAAI,EAAE,EAAE,EAAE,KAAK,EAAE,mBAAmB,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC,CAAC;gBAChI,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC;gBAC3B,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,MAAM,GAAG,EAAE;oBAAE,MAAM;YACzC,CAAC;YACD,OAAO,GAAG,CAAC;QACb,CAAC;QACD,KAAK,CAAC,UAAU,CAAC,SAAS;YACxB,MAAM,GAAG,GAAG,MAAM,IAAI,CAAkC,KAAK,EAAE,aAAa,CAAC,CAAC,SAAS,CAAC,uBAAuB,EAAE,EAAE,KAAK,EAAE,kCAAkC,EAAE,UAAU,EAAE,cAAc,EAAE,CAAC,CAAC;YAC5L,OAAO,CAAC,GAAG,EAAE,WAAW,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QACvD,CAAC;QACD,KAAK,CAAC,UAAU,CAAC,SAAS,EAAE,IAAI;YAC9B,MAAM,IAAI,GAAG,MAAM,IAAI,CAAa,KAAK,EAAE,aAAa,CAAC,CAAC,SAAS,CAAC,qCAAqC,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,cAAc,EAAE,UAAU,EAAE,QAAQ,EAAE,CAAC,CAAC;YACrK,OAAO,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,IAAI,CAAC;QAC5E,CAAC;QACD,YAAY,EAAE,CAAC,SAAS,EAAE,IAAI,EAAE,EAAE,CAChC,IAAI,CAAW,MAAM,EAAE,aAAa,CAAC,CAAC,SAAS,CAAC,aAAa,EAAE,EAAE,KAAK,EAAE,iBAAiB,EAAE,UAAU,EAAE,QAAQ,EAAE,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,YAAY,EAAE,CAAC;QACxJ,MAAM,EAAE,CAAC,SAAS,EAAE,EAAE,EAAE,EAAE,CACxB,IAAI,CAAW,KAAK,EAAE,aAAa,CAAC,CAAC,SAAS,CAAC,eAAe,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,iBAAiB,EAAE,UAAU,EAAE,QAAQ,EAAE,CAAC;QAC5H,KAAK,CAAC,WAAW,CAAC,SAAS,EAAE,EAAE;YAC7B,MAAM,KAAK,GAAG,MAAM,IAAI,CAAU,KAAK,EAAE,aAAa,CAAC,CAAC,SAAS,CAAC,eAAe,CAAC,CAAC,EAAE,CAAC,QAAQ,EAAE,EAAE,KAAK,EAAE,mCAAmC,EAAE,UAAU,EAAE,QAAQ,EAAE,CAAC,CAAC;YACtK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC;gBAAE,MAAM,IAAI,kBAAkB,CAAC,2DAA2D,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;YAClK,OAAO,KAAK,CAAC;QACf,CAAC;QACD,KAAK,CAAC,eAAe,CAAC,SAAS,EAAE,EAAE,EAAE,QAAQ,EAAE,OAAO;YACpD,MAAM,IAAI,CAAC,KAAK,EAAE,aAAa,CAAC,CAAC,SAAS,CAAC,eAAe,CAAC,CAAC,EAAE,CAAC,iBAAiB,EAAE,EAAE,KAAK,EAAE,uCAAuC,EAAE,UAAU,EAAE,QAAQ,EAAE,EAAE;gBAC1J,MAAM,EAAE,EAAE,OAAO,EAAE,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,EAAE,EAAE,OAAO,EAAE,iBAAiB,EAAE,CAAC,EAAE;aAC7E,CAAC,CAAC;QACL,CAAC;QACD,KAAK,CAAC,YAAY,CAAC,SAAS,EAAE,EAAE;YAC9B,iEAAiE;YACjE,wBAAwB;YACxB,MAAM,IAAI,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAC,SAAS,CAAC,eAAe,CAAC,CAAC,EAAE,CAAC,cAAc,EAAE,EAAE,KAAK,EAAE,uBAAuB,EAAE,UAAU,EAAE,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;YACnK,MAAM,IAAI,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAC,SAAS,CAAC,eAAe,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,mBAAmB,EAAE,UAAU,EAAE,QAAQ,EAAE,CAAC,CAAC;QAC9H,CAAC;QACD,KAAK,CAAC,UAAU,CAAC,MAAM,EAAE,IAAI;YAC3B,OAAO,CAAC,MAAM,IAAI,CAAgB,KAAK,EAAE,UAAU,CAAC,CAAC,MAAM,CAAC,qBAAqB,CAAC,CAAC,IAAI,CAAC,cAAc,EAAE,EAAE,KAAK,EAAE,uBAAuB,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QACxK,CAAC;QACD,WAAW,EAAE,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,CAC7C,IAAI,CAAc,MAAM,EAAE,UAAU,CAAC,CAAC,MAAM,CAAC,cAAc,EAAE,EAAE,KAAK,EAAE,kBAAkB,EAAE,UAAU,EAAE,KAAK,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC;QAC1L,KAAK,CAAC,eAAe,CAAC,MAAM,EAAE,EAAE;YAC9B,MAAM,IAAI,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,uBAAuB,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC,CAAC;QAC1H,CAAC;QACD,KAAK,CAAC,QAAQ,CAAC,SAAS;YACtB,OAAO,CAAC,MAAM,IAAI,CAAmB,KAAK,EAAE,aAAa,CAAC,CAAC,SAAS,CAAC,+BAA+B,EAAE,EAAE,KAAK,EAAE,sBAAsB,EAAE,UAAU,EAAE,QAAQ,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QACxK,CAAC;QACD,YAAY,EAAE,CAAC,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,CACvC,IAAI,CAAiB,MAAM,EAAE,aAAa,CAAC,CAAC,SAAS,CAAC,kBAAkB,EAAE,EAAE,KAAK,EAAE,yBAAyB,EAAE,UAAU,EAAE,QAAQ,EAAE,EAAE,UAAU,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QAChK,YAAY,EAAE,CAAC,SAAS,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,CAC3C,IAAI,CAAiB,KAAK,EAAE,aAAa,CAAC,CAAC,SAAS,CAAC,oBAAoB,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,0BAA0B,EAAE,UAAU,EAAE,QAAQ,EAAE,EAAE,UAAU,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QACzK,KAAK,CAAC,YAAY,CAAC,SAAS,EAAE,EAAE;YAC9B,MAAM,IAAI,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAC,SAAS,CAAC,oBAAoB,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,0BAA0B,EAAE,UAAU,EAAE,QAAQ,EAAE,CAAC,CAAC;QAC1I,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,SAAS;YAClB,OAAO,CAAC,MAAM,IAAI,CAAgB,KAAK,EAAE,aAAa,CAAC,CAAC,SAAS,CAAC,2BAA2B,EAAE,EAAE,KAAK,EAAE,0BAA0B,EAAE,UAAU,EAAE,QAAQ,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QACrK,CAAC;QACD,SAAS,EAAE,CAAC,SAAS,EAAE,KAAK,EAAE,EAAE,CAC9B,IAAI,CAAc,MAAM,EAAE,aAAa,CAAC,CAAC,SAAS,CAAC,cAAc,EAAE,EAAE,KAAK,EAAE,4BAA4B,EAAE,UAAU,EAAE,QAAQ,EAAE,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;QACnJ,SAAS,EAAE,CAAC,SAAS,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,CAClC,IAAI,CAAc,KAAK,EAAE,aAAa,CAAC,CAAC,SAAS,CAAC,gBAAgB,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,+BAA+B,EAAE,UAAU,EAAE,QAAQ,EAAE,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;QAC9J,KAAK,CAAC,SAAS,CAAC,SAAS,EAAE,EAAE;YAC3B,MAAM,IAAI,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAC,SAAS,CAAC,gBAAgB,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,+BAA+B,EAAE,UAAU,EAAE,QAAQ,EAAE,CAAC,CAAC;QAC3I,CAAC;KACF,CAAC;AACJ,CAAC"}

package/packages/gateway/dist/web/access/cloudflare-setup.d.ts

@@ -0,0 +1,163 @@
+/**
+ * Cloudflare Access, "Set it up for me" (slate jxtBIbNaS-).
+ *
+ * With one scoped API token buddi makes, through Cloudflare's REST API, what
+ * the five manual steps ask the owner to click: a tunnel named
+ * `buddi-<host>`, its ingress (`<host>` → the ingress listener), a proxied
+ * CNAME, a reusable Allow policy for the owner's email and a self-hosted
+ * Access application for the hostname. It reads the application's AUD tag and
+ * the team domain, fills in `access.cloudflare`, shows the one command buddi
+ * never runs itself (`sudo cloudflared service install <token>`), waits for
+ * the tunnel to report healthy and runs Test my setup.
+ *
+ * Idempotent: the ids of what buddi made are kept in the setup record, so a
+ * second run after a failure picks up where the first stopped. An object of
+ * buddi's name that the record doesn't hold (someone else's, or a lost
+ * record's) is never taken silently: the run stops with `adoptable` and the
+ * owner may say "Use it anyway" (`adopt: true`, `--adopt`). Remove deletes
+ * only the ids the record holds, and keeps going past a failure so one stuck
+ * object does not strand the others.
+ *
+ * One operation at a time in a process (`claimSetupOperation`): a setup, its
+ * stop and a removal never overlap, from the panel or the CLI.
+ *
+ * The same engine runs behind the panel (server.ts) and `buddi access
+ * cloudflare setup` (the CLI): only the token store and the progress sink
+ * differ.
+ */
+import type { CloudflareApi } from './cloudflare-api.js';
+import { type CloudflareAccessSetting } from './cloudflare.js';
+/** Where the record of what buddi made lives (a web setting). Ids only, never a token. */
+export declare const CLOUDFLARE_SETUP_KEY = "access.cloudflare.setup";
+/** The owner secret holding the API token. */
+export declare const CLOUDFLARE_TOKEN_SECRET = "CLOUDFLARE_API_TOKEN";
+export declare const tunnelNameFor: (host: string) => string;
+export declare const policyNameFor: (host: string) => string;
+export declare const appNameFor: (host: string) => string;
+/** The DNS record's comment: buddi's tag on it. */
+/** After the Done line: a new Access application takes a minute or two to reach Cloudflare's sign-in page. */
+export declare const SETUP_PROPAGATION = "Cloudflare needs a minute or two before the first sign-in works; if its page says it can\u2019t find the application, reload.";
+export declare const DNS_COMMENT = "Made by buddi for Sign in from elsewhere. Remove it from buddi.";
+/** How often the tunnel's health is asked, and for how long. */
+export declare const HEALTH_POLL_MS = 5000;
+export declare const HEALTH_WAIT_MS: number;
+export type SetupStepId = 'token' | 'tunnel' | 'route' | 'dns' | 'access' | 'save' | 'connector' | 'healthy' | 'test';
+export type SetupStepState = 'next' | 'now' | 'done' | 'failed';
+export interface SetupStep {
+    id: SetupStepId;
+    state: SetupStepState;
+    /** The line the checklist shows. */
+    text: string;
+    /** Why it failed, in a sentence. */
+    why?: string | undefined;
+}
+export interface SetupInstall {
+    /** The one line to run. Holds the tunnel's connector token: shown to the owner, never logged. */
+    command: string;
+    /** What to say beside it: the brew path on a Mac, the package on Linux. */
+    note: string;
+}
+export interface SetupProgress {
+    state: 'idle' | 'running' | 'waiting' | 'done' | 'failed' | 'stopped' | 'removing' | 'removed';
+    host: string;
+    email: string;
+    steps: SetupStep[];
+    install: SetupInstall | null;
+    /** The sentence for a failure, a stop or a partial removal. */
+    error: string | null;
+    /** The address, once it is set up. */
+    url: string | null;
+    /** What Remove deleted, in words. */
+    removed: string[];
+    /** The line that removes the connector from this computer. */
+    uninstall: string | null;
+    /** It stopped at an object of buddi's name that buddi didn't make: "Use it anyway" runs again with adopt. */
+    adoptable: boolean;
+}
+export interface SetupRecord {
+    host: string;
+    email: string;
+    zone: {
+        id: string;
+        name: string;
+    };
+    accountId: string;
+    teamDomain: string;
+    /** The ids of what buddi made (or was told to use anyway). Remove deletes these and nothing else. */
+    tunnelId?: string | undefined;
+    dnsRecordId?: string | undefined;
+    policyId?: string | undefined;
+    appId?: string | undefined;
+    aud?: string | undefined;
+    at: string;
+}
+export interface SetupInput {
+    host: string;
+    email: string;
+    zone?: string | undefined;
+    /** "Use it anyway": take over an object of buddi's name that buddi didn't make. */
+    adopt?: boolean | undefined;
+}
+export interface SetupDeps {
+    api: CloudflareApi;
+    /** The ingress listener's port: what cloudflared points at. */
+    ingressPort: number;
+    platform: NodeJS.Platform;
+    readSetting: () => Promise<CloudflareAccessSetting>;
+    saveSetting: (value: CloudflareAccessSetting) => Promise<void>;
+    readRecord: () => Promise<SetupRecord | null>;
+    saveRecord: (record: SetupRecord | null) => Promise<void>;
+    /** Test my setup: fetch the team's signing keys. */
+    test: (teamDomain: string) => Promise<{
+        ok: boolean;
+        keys: number;
+        error?: string | undefined;
+    }>;
+    sleep?: ((ms: number, signal?: AbortSignal) => Promise<void>) | undefined;
+    now?: (() => Date) | undefined;
+    pollMs?: number | undefined;
+    waitMs?: number | undefined;
+    signal?: AbortSignal | undefined;
+    /**
+     * The operation lock the caller already holds (the server claims it before
+     * its first await). Without one, the run claims its own and lets it go.
+     */
+    lease?: SetupLease | undefined;
+}
+export type SetupOperation = 'setup' | 'remove';
+export interface SetupLease {
+    readonly kind: SetupOperation;
+    release(): void;
+}
+/** Claim the one operation slot, synchronously; null when another holds it. */
+export declare function claimSetupOperation(kind: SetupOperation): SetupLease | null;
+/** What holds the slot, or null. */
+export declare const setupOperation: () => SetupOperation | null;
+/** The sentence for a second caller, by what is going. */
+export declare function setupBusySentence(kind: SetupOperation | null): string;
+/** A hostname, lower case, or null. */
+export declare function normalizeHost(raw: string): string | null;
+/** The input checked: what is wrong with it, or null. */
+export declare function checkSetupInput(input: SetupInput): string | null;
+/** The line to run, for this platform. */
+export declare function installFor(token: string, platform: NodeJS.Platform): SetupInstall;
+export declare function uninstallFor(platform: NodeJS.Platform): string;
+export declare function freshProgress(host?: string, email?: string): SetupProgress;
+/**
+ * Run the setup. Never throws: the progress it ends on says how it went.
+ * `onProgress` gets a copy at every change.
+ */
+export declare function runCloudflareSetup(input: SetupInput, deps: SetupDeps, onProgress?: (p: SetupProgress) => void): Promise<SetupProgress>;
+/**
+ * Remove what buddi made: the Access application and policy, the DNS record
+ * and the tunnel whose ids the setup record holds, and nothing found by name.
+ * Each id leaves the record as its object goes, so Remove again retries only
+ * what is left. Turns signing in through Cloudflare off when the setting is
+ * the one setup filled in, and forgets the record. Never throws.
+ */
+export declare function removeCloudflareSetup(deps: Pick<SetupDeps, 'api' | 'platform' | 'readSetting' | 'saveSetting' | 'readRecord' | 'saveRecord' | 'lease'> & {
+    host?: string | undefined;
+}, onProgress?: (p: SetupProgress) => void): Promise<SetupProgress>;
+/** "a, b and c". */
+export declare function removedInWords(items: string[]): string;
+//# sourceMappingURL=cloudflare-setup.d.ts.map

package/packages/gateway/dist/web/access/cloudflare-setup.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cloudflare-setup.d.ts","sourceRoot":"","sources":["../../../src/web/access/cloudflare-setup.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,OAAO,KAAK,EAAE,aAAa,EAA4B,MAAM,qBAAqB,CAAC;AAEnF,OAAO,EAA2C,KAAK,uBAAuB,EAAE,MAAM,iBAAiB,CAAC;AAExG,0FAA0F;AAC1F,eAAO,MAAM,oBAAoB,4BAA4B,CAAC;AAC9D,8CAA8C;AAC9C,eAAO,MAAM,uBAAuB,yBAAyB,CAAC;AAE9D,eAAO,MAAM,aAAa,GAAI,MAAM,MAAM,KAAG,MAAyB,CAAC;AACvE,eAAO,MAAM,aAAa,GAAI,MAAM,MAAM,KAAG,MAA2B,CAAC;AACzE,eAAO,MAAM,UAAU,GAAI,MAAM,MAAM,KAAG,MAA2B,CAAC;AACtE,mDAAmD;AACnD,8GAA8G;AAC9G,eAAO,MAAM,iBAAiB,kIAA6H,CAAC;AAC5J,eAAO,MAAM,WAAW,oEAAoE,CAAC;AAG7F,gEAAgE;AAChE,eAAO,MAAM,cAAc,OAAQ,CAAC;AACpC,eAAO,MAAM,cAAc,QAAc,CAAC;AAE1C,MAAM,MAAM,WAAW,GAAG,OAAO,GAAG,QAAQ,GAAG,OAAO,GAAG,KAAK,GAAG,QAAQ,GAAG,MAAM,GAAG,WAAW,GAAG,SAAS,GAAG,MAAM,CAAC;AACtH,MAAM,MAAM,cAAc,GAAG,MAAM,GAAG,KAAK,GAAG,MAAM,GAAG,QAAQ,CAAC;AAEhE,MAAM,WAAW,SAAS;IACxB,EAAE,EAAE,WAAW,CAAC;IAChB,KAAK,EAAE,cAAc,CAAC;IACtB,oCAAoC;IACpC,IAAI,EAAE,MAAM,CAAC;IACb,oCAAoC;IACpC,GAAG,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC1B;AAED,MAAM,WAAW,YAAY;IAC3B,iGAAiG;IACjG,OAAO,EAAE,MAAM,CAAC;IAChB,2EAA2E;IAC3E,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,aAAa;IAC5B,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,SAAS,GAAG,MAAM,GAAG,QAAQ,GAAG,SAAS,GAAG,UAAU,GAAG,SAAS,CAAC;IAC/F,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,SAAS,EAAE,CAAC;IACnB,OAAO,EAAE,YAAY,GAAG,IAAI,CAAC;IAC7B,+DAA+D;IAC/D,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,sCAAsC;IACtC,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IACnB,qCAAqC;IACrC,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,8DAA8D;IAC9D,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,6GAA6G;IAC7G,SAAS,EAAE,OAAO,CAAC;CACpB;AAED,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IACnC,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,qGAAqG;IACrG,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC9B,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACjC,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC9B,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC3B,GAAG,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACzB,EAAE,EAAE,MAAM,CAAC;CACZ;AAED,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC1B,mFAAmF;IACnF,KAAK,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;CAC7B;AAED,MAAM,WAAW,SAAS;IACxB,GAAG,EAAE,aAAa,CAAC;IACnB,+DAA+D;IAC/D,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC;IAC1B,WAAW,EAAE,MAAM,OAAO,CAAC,uBAAuB,CAAC,CAAC;IACpD,WAAW,EAAE,CAAC,KAAK,EAAE,uBAAuB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/D,UAAU,EAAE,MAAM,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAAC;IAC9C,UAAU,EAAE,CAAC,MAAM,EAAE,WAAW,GAAG,IAAI,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1D,oDAAoD;IACpD,IAAI,EAAE,CAAC,UAAU,EAAE,MAAM,KAAK,OAAO,CAAC;QAAE,EAAE,EAAE,OAAO,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;KAAE,CAAC,CAAC;IACjG,KAAK,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,WAAW,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC,GAAG,SAAS,CAAC;IAC1E,GAAG,CAAC,EAAE,CAAC,MAAM,IAAI,CAAC,GAAG,SAAS,CAAC;IAC/B,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC5B,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC5B,MAAM,CAAC,EAAE,WAAW,GAAG,SAAS,CAAC;IACjC;;;OAGG;IACH,KAAK,CAAC,EAAE,UAAU,GAAG,SAAS,CAAC;CAChC;AAED,MAAM,MAAM,cAAc,GAAG,OAAO,GAAG,QAAQ,CAAC;AAChD,MAAM,WAAW,UAAU;IAAG,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAC;IAAC,OAAO,IAAI,IAAI,CAAA;CAAE;AAK9E,+EAA+E;AAC/E,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,cAAc,GAAG,UAAU,GAAG,IAAI,CAK3E;AAED,oCAAoC;AACpC,eAAO,MAAM,cAAc,QAAO,cAAc,GAAG,IAA+B,CAAC;AAEnF,0DAA0D;AAC1D,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,cAAc,GAAG,IAAI,GAAG,MAAM,CAIrE;AAED,uCAAuC;AACvC,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAIxD;AAED,yDAAyD;AACzD,wBAAgB,eAAe,CAAC,KAAK,EAAE,UAAU,GAAG,MAAM,GAAG,IAAI,CAKhE;AAED,0CAA0C;AAC1C,wBAAgB,UAAU,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,GAAG,YAAY,CAgBjF;AAED,wBAAgB,YAAY,CAAC,QAAQ,EAAE,MAAM,CAAC,QAAQ,GAAG,MAAM,CAE9D;AAeD,wBAAgB,aAAa,CAAC,IAAI,SAAK,EAAE,KAAK,SAAK,GAAG,aAAa,CAMlE;AAeD;;;GAGG;AACH,wBAAsB,kBAAkB,CAAC,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE,SAAS,EAAE,UAAU,GAAE,CAAC,CAAC,EAAE,aAAa,KAAK,IAAe,GAAG,OAAO,CAAC,aAAa,CAAC,CActJ;AAoND;;;;;;GAMG;AACH,wBAAsB,qBAAqB,CACzC,IAAI,EAAE,IAAI,CAAC,SAAS,EAAE,KAAK,GAAG,UAAU,GAAG,aAAa,GAAG,aAAa,GAAG,YAAY,GAAG,YAAY,GAAG,OAAO,CAAC,GAAG;IAAE,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;CAAE,EACjJ,UAAU,GAAE,CAAC,CAAC,EAAE,aAAa,KAAK,IAAe,GAChD,OAAO,CAAC,aAAa,CAAC,CAcxB;AA+DD,oBAAoB;AACpB,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,MAAM,CAItD"}