@withbuddi/buddi 0.1.0-pre.43 → 0.1.0-pre.45

package/packages/gateway/dist/tips/route.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"route.d.ts","sourceRoot":"","sources":["../../src/tips/route.ts"],"names":[],"mappings":"AAgBA,OAAO,EAA6B,KAAK,KAAK,EAAE,KAAK,aAAa,EAAE,MAAM,YAAY,CAAC;AACvF,OAAO,EAAQ,KAAK,OAAO,EAAE,MAAM,YAAY,CAAC;AAEhD,eAAO,MAAM,cAAc,eAAe,CAAC;AAC3C,eAAO,MAAM,gBAAgB,iBAAiB,CAAC;AAE/C,MAAM,WAAW,aAAa;IAC5B,KAAK,EAAE,aAAa,CAAC;IACrB,KAAK,EAAE,MAAM,OAAO,CAAC,KAAK,CAAC,CAAC;IAC5B,GAAG,EAAE,MAAM,IAAI,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,sDAAsD;IACtD,KAAK,CAAC,EAAE,SAAS,OAAO,EAAE,CAAC;CAC5B;AAED,MAAM,WAAW,SAAS;IACxB,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,OAAO,CAAC;CACf;AAOD,mEAAmE;AACnE,wBAAsB,WAAW,CAAC,KAAK,EAAE,aAAa,GAAG,OAAO,CAAC,OAAO,CAAC,CAGxE;AAED,wBAAsB,SAAS,CAC7B,IAAI,EAAE,aAAa,EACnB,OAAO,EAAE;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,GACjG,OAAO,CAAC,SAAS,CAAC,CA6DpB"}
+{"version":3,"file":"route.d.ts","sourceRoot":"","sources":["../../src/tips/route.ts"],"names":[],"mappings":"AAoBA,OAAO,EAA6B,KAAK,KAAK,EAAE,KAAK,aAAa,EAAE,MAAM,YAAY,CAAC;AACvF,OAAO,EAAQ,KAAK,OAAO,EAAE,MAAM,YAAY,CAAC;AAEhD,eAAO,MAAM,cAAc,eAAe,CAAC;AAE3C,MAAM,WAAW,aAAa;IAC5B,KAAK,EAAE,aAAa,CAAC;IACrB,KAAK,EAAE,MAAM,OAAO,CAAC,KAAK,CAAC,CAAC;IAC5B,GAAG,EAAE,MAAM,IAAI,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,sDAAsD;IACtD,KAAK,CAAC,EAAE,SAAS,OAAO,EAAE,CAAC;CAC5B;AAED,MAAM,WAAW,SAAS;IACxB,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,OAAO,CAAC;CACf;AAOD,wBAAsB,SAAS,CAC7B,IAAI,EAAE,aAAa,EACnB,OAAO,EAAE;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,IAAI,CAAC,EAAE,OAAO,CAAA;CAAE,GACjH,OAAO,CAAC,SAAS,CAAC,CAuFpB"}

package/packages/gateway/dist/tips/route.js

@@ -1,54 +1,41 @@
 /**
  * The tips' routes (docs/dashboard.md, Home):
  *
- *   GET  /api/tips                 { tips: [...rows], enabled }   every rule and where it stands (the Tips list)
- *   GET  /api/tips/current         { tip | null, enabled }   today's tip, if any
+ *   GET  /api/tips                 { tips: [...rows] }   every rule and where it stands
+ *   GET  /api/tips/current         { tip | null }   today's tip, if any
+ *   GET  /api/tips/queue           { tips: [...], dismissed }   the bulb's stack: today's tip first, then every other
+ *                                  one that holds and is not dismissed, ready ones before those in their cooldown;
+ *                                  `dismissed` counts the dismissed ones that hold
+ *                                  (`?peek=1`: today's and the ready ones only, nothing marked shown: for the bulb's dot)
+ *   GET  /api/tips/dismissed       { tips: [...] }   the dismissed ones the queue counts, for "Bring back"
  *   POST /api/tips/:id/dismiss     "Not this again": never again
  *   POST /api/tips/:id/later       ×: not before its cooldown has passed
  *   POST /api/tips/:id/restore     "Bring back": forget a dismissal
  *   POST /api/tips/seen-page { page }   the dashboard opened a page (once a day each)
- *   GET  /api/tips/settings        { enabled }
- *   PUT  /api/tips/settings { enabled }   Settings → Notifications → Tips on Home
  *
- * State lives in `core.web_settings`: `tips.state` (the engine's), `tips.enabled`
- * (absent is on) and `tips.pages`.
+ * State lives in `core.web_settings`: `tips.state` (the engine's) and
+ * `tips.pages`. A `tips.enabled` left from the old "Tips on Home" switch is
+ * ignored: tips sit behind the bulb, which is the owner's choice to look.
  */
-import { dayIn, dismissTip, laterTip, listTips, pickTip, restoreTip, viewOf } from './engine.js';
+import { dayIn, dismissTip, laterTip, listDismissed, listTips, pickQueue, pickTip, restoreTip, viewOf } from './engine.js';
 import { PAGE_NAME, recordPageSeen } from './facts.js';
 import { TIPS } from './rules.js';
 export const TIPS_STATE_KEY = 'tips.state';
-export const TIPS_ENABLED_KEY = 'tips.enabled';
 async function readState(store) {
     const value = await store.read(TIPS_STATE_KEY).catch(() => null);
     return value && typeof value === 'object' && !Array.isArray(value) ? value : {};
 }
-/** Whether tips are on. Anything but an explicit `false` is on. */
-export async function tipsEnabled(store) {
-    const value = await store.read(TIPS_ENABLED_KEY).catch(() => null);
-    return value !== false;
-}
 export async function tipsRoute(deps, request) {
     const { method, path } = request;
     const body = request.body ?? {};
     const rules = deps.rules ?? TIPS;
     const today = dayIn(deps.now(), deps.timezone);
-    if (path === '/api/tips/settings') {
-        if (method === 'PUT') {
-            if (typeof body.enabled !== 'boolean')
-                return { status: 400, body: { error: '`enabled` must be true or false.' } };
-            await deps.store.write(TIPS_ENABLED_KEY, body.enabled);
-        }
-        else if (method !== 'GET') {
-            return { status: 405, body: { error: 'GET or PUT.' } };
-        }
-        return { status: 200, body: { enabled: await tipsEnabled(deps.store) } };
-    }
     if (path === '/api/tips') {
         if (method !== 'GET')
             return { status: 405, body: { error: 'GET only.' } };
-        // Reads only: listing never marks a tip shown. It reads while tips are off too.
+        // Reads only: listing never marks a tip shown.
         const tips = listTips(rules, await deps.facts(), await readState(deps.store), today);
-        return { status: 200, body: { tips, enabled: await tipsEnabled(deps.store) } };
+        return { status: 200, body: { tips } };
     }
     if (path === '/api/tips/current') {
         if (method !== 'GET')
@@ -59,16 +46,53 @@ export async function tipsRoute(deps, request) {
         if (preview !== null) {
             const rule = rules.find((r) => r.id === preview);
             return rule
-                ? { status: 200, body: { tip: viewOf(rule, await deps.facts()), enabled: true, preview: true } }
+                ? { status: 200, body: { tip: viewOf(rule, await deps.facts()), preview: true } }
                 : { status: 404, body: { error: `No tip called "${preview}". Known: ${rules.map((r) => r.id).join(', ')}.` } };
         }
-        if (!(await tipsEnabled(deps.store)))
-            return { status: 200, body: { tip: null, enabled: false } };
         const previous = await readState(deps.store);
         const { tip, state } = pickTip(rules, await deps.facts(), previous, today);
         if (JSON.stringify(state) !== JSON.stringify(previous))
             await deps.store.write(TIPS_STATE_KEY, state);
-        return { status: 200, body: { tip, enabled: true } };
+        return { status: 200, body: { tip } };
+    }
+    if (path === '/api/tips/queue') {
+        if (method !== 'GET')
+            return { status: 405, body: { error: 'GET only.' } };
+        // `?preview=a,b,c` stacks those rules' cards as they would look, touching no state.
+        const preview = request.preview ?? null;
+        if (preview !== null) {
+            const ids = preview.split(',').map((id) => id.trim()).filter(Boolean);
+            const unknown = ids.filter((id) => !rules.some((r) => r.id === id));
+            if (ids.length === 0 || unknown.length) {
+                return { status: 404, body: { error: `No tip called "${unknown[0] ?? preview}". Known: ${rules.map((r) => r.id).join(', ')}.` } };
+            }
+            const f = await deps.facts();
+            return { status: 200, body: { tips: ids.map((id) => viewOf(rules.find((r) => r.id === id), f)), preview: true } };
+        }
+        const previous = await readState(deps.store);
+        const { tips, state, dismissed } = pickQueue(rules, await deps.facts(), previous, today, { open: !request.peek });
+        // A peek keeps the holds counting but marks nothing shown: the owner has
+        // not opened the stack, so no tip's cooldown starts.
+        const front = tips[0]?.id;
+        if (request.peek && front && state[front]?.shownAt !== previous[front]?.shownAt) {
+            const before = previous[front]?.shownAt;
+            if (before)
+                state[front] = { ...state[front], shownAt: before };
+            else {
+                const { shownAt: _s, ...rest } = state[front];
+                state[front] = rest;
+            }
+        }
+        if (JSON.stringify(state) !== JSON.stringify(previous))
+            await deps.store.write(TIPS_STATE_KEY, state);
+        return { status: 200, body: { tips, dismissed } };
+    }
+    if (path === '/api/tips/dismissed') {
+        if (method !== 'GET')
+            return { status: 405, body: { error: 'GET only.' } };
+        // Reads only: the state is what the queue left it as.
+        const tips = listDismissed(rules, await deps.facts(), await readState(deps.store), today);
+        return { status: 200, body: { tips } };
     }
     if (path === '/api/tips/seen-page') {
         if (method !== 'POST')

package/packages/gateway/dist/tips/route.js.map

@@ -1 +1 @@
-{"version":3,"file":"route.js","sourceRoot":"","sources":["../../src/tips/route.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,EAAkB,MAAM,aAAa,CAAC;AACjH,OAAO,EAAE,SAAS,EAAE,cAAc,EAAkC,MAAM,YAAY,CAAC;AACvF,OAAO,EAAE,IAAI,EAAgB,MAAM,YAAY,CAAC;AAEhD,MAAM,CAAC,MAAM,cAAc,GAAG,YAAY,CAAC;AAC3C,MAAM,CAAC,MAAM,gBAAgB,GAAG,cAAc,CAAC;AAgB/C,KAAK,UAAU,SAAS,CAAC,KAAoB;IAC3C,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,IAAI,CAAY,cAAc,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;IAC5E,OAAO,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;AAClF,CAAC;AAED,mEAAmE;AACnE,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,KAAoB;IACpD,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,IAAI,CAAU,gBAAgB,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;IAC5E,OAAO,KAAK,KAAK,KAAK,CAAC;AACzB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,IAAmB,EACnB,OAAkG;IAElG,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,OAAO,CAAC;IACjC,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,EAAE,CAAC;IAChC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC;IACjC,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;IAE/C,IAAI,IAAI,KAAK,oBAAoB,EAAE,CAAC;QAClC,IAAI,MAAM,KAAK,KAAK,EAAE,CAAC;YACrB,IAAI,OAAO,IAAI,CAAC,OAAO,KAAK,SAAS;gBAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,kCAAkC,EAAE,EAAE,CAAC;YACnH,MAAM,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,gBAAgB,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;QACzD,CAAC;aAAM,IAAI,MAAM,KAAK,KAAK,EAAE,CAAC;YAC5B,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,aAAa,EAAE,EAAE,CAAC;QACzD,CAAC;QACD,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC;IAC3E,CAAC;IAED,IAAI,IAAI,KAAK,WAAW,EAAE,CAAC;QACzB,IAAI,MAAM,KAAK,KAAK;YAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE,CAAC;QAC3E,gFAAgF;QAChF,MAAM,IAAI,GAAG,QAAQ,CAAC,KAAK,EAAE,MAAM,IAAI,CAAC,KAAK,EAAE,EAAE,MAAM,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC,CAAC;QACrF,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC;IACjF,CAAC;IAED,IAAI,IAAI,KAAK,mBAAmB,EAAE,CAAC;QACjC,IAAI,MAAM,KAAK,KAAK;YAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE,CAAC;QAC3E,6EAA6E;QAC7E,0DAA0D;QAC1D,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,IAAI,CAAC;QACxC,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;YACrB,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,OAAO,CAAC,CAAC;YACjD,OAAO,IAAI;gBACT,CAAC,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,MAAM,CAAC,IAAI,EAAE,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE;gBAChG,CAAC,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,kBAAkB,OAAO,aAAa,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;QACnH,CAAC;QACD,IAAI,CAAC,CAAC,MAAM,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,CAAC;QAClG,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC7C,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,OAAO,CAAC,KAAK,EAAE,MAAM,IAAI,CAAC,KAAK,EAAE,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC;QAC3E,IAAI,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC;YAAE,MAAM,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,cAAc,EAAE,KAAK,CAAC,CAAC;QACtG,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,CAAC;IACvD,CAAC;IAED,IAAI,IAAI,KAAK,qBAAqB,EAAE,CAAC;QACnC,IAAI,MAAM,KAAK,MAAM;YAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,YAAY,EAAE,EAAE,CAAC;QAC7E,MAAM,IAAI,GAAG,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjF,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,0BAA0B,EAAE,EAAE,CAAC;QAC/F,MAAM,cAAc,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;QAC9C,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,CAAC;IAC7C,CAAC;IAED,MAAM,GAAG,GAAG,sDAAsD,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC9E,IAAI,GAAG,EAAE,CAAC;QACR,IAAI,MAAM,KAAK,MAAM;YAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,YAAY,EAAE,EAAE,CAAC;QAC7E,MAAM,EAAE,GAAG,GAAG,CAAC,CAAC,CAAE,CAAC;QACnB,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,CAAC;YAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,oBAAoB,EAAE,IAAI,EAAE,EAAE,CAAC;QAC/G,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC7C,MAAM,IAAI,GAAG,GAAG,CAAC,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC,QAAQ,EAAE,EAAE,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,EAAE,EAAE,EAAE,KAAK,CAAC,CAAC;QACtJ,MAAM,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,cAAc,EAAE,IAAI,CAAC,CAAC;QAC7C,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,CAAC;IAC7C,CAAC;IAED,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,qBAAqB,EAAE,EAAE,CAAC;AACjE,CAAC"}
+{"version":3,"file":"route.js","sourceRoot":"","sources":["../../src/tips/route.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AACH,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,QAAQ,EAAE,aAAa,EAAE,QAAQ,EAAE,SAAS,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,EAAkB,MAAM,aAAa,CAAC;AAC3I,OAAO,EAAE,SAAS,EAAE,cAAc,EAAkC,MAAM,YAAY,CAAC;AACvF,OAAO,EAAE,IAAI,EAAgB,MAAM,YAAY,CAAC;AAEhD,MAAM,CAAC,MAAM,cAAc,GAAG,YAAY,CAAC;AAgB3C,KAAK,UAAU,SAAS,CAAC,KAAoB;IAC3C,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,IAAI,CAAY,cAAc,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;IAC5E,OAAO,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;AAClF,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,IAAmB,EACnB,OAAkH;IAElH,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,OAAO,CAAC;IACjC,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,EAAE,CAAC;IAChC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC;IACjC,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;IAE/C,IAAI,IAAI,KAAK,WAAW,EAAE,CAAC;QACzB,IAAI,MAAM,KAAK,KAAK;YAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE,CAAC;QAC3E,+CAA+C;QAC/C,MAAM,IAAI,GAAG,QAAQ,CAAC,KAAK,EAAE,MAAM,IAAI,CAAC,KAAK,EAAE,EAAE,MAAM,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC,CAAC;QACrF,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,EAAE,CAAC;IACzC,CAAC;IAED,IAAI,IAAI,KAAK,mBAAmB,EAAE,CAAC;QACjC,IAAI,MAAM,KAAK,KAAK;YAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE,CAAC;QAC3E,6EAA6E;QAC7E,0DAA0D;QAC1D,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,IAAI,CAAC;QACxC,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;YACrB,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,OAAO,CAAC,CAAC;YACjD,OAAO,IAAI;gBACT,CAAC,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,MAAM,CAAC,IAAI,EAAE,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE;gBACjF,CAAC,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,kBAAkB,OAAO,aAAa,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;QACnH,CAAC;QACD,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC7C,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,OAAO,CAAC,KAAK,EAAE,MAAM,IAAI,CAAC,KAAK,EAAE,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC;QAC3E,IAAI,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC;YAAE,MAAM,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,cAAc,EAAE,KAAK,CAAC,CAAC;QACtG,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,EAAE,CAAC;IACxC,CAAC;IAED,IAAI,IAAI,KAAK,iBAAiB,EAAE,CAAC;QAC/B,IAAI,MAAM,KAAK,KAAK;YAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE,CAAC;QAC3E,oFAAoF;QACpF,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,IAAI,CAAC;QACxC,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;YACrB,MAAM,GAAG,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;YACtE,MAAM,OAAO,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;YACpE,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;gBACvC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,kBAAkB,OAAO,CAAC,CAAC,CAAC,IAAI,OAAO,aAAa,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;YACpI,CAAC;YACD,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC;YAC7B,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAE,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,CAAC;QACrH,CAAC;QACD,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC7C,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,SAAS,CAAC,KAAK,EAAE,MAAM,IAAI,CAAC,KAAK,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;QAClH,yEAAyE;QACzE,qDAAqD;QACrD,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;QAC1B,IAAI,OAAO,CAAC,IAAI,IAAI,KAAK,IAAI,KAAK,CAAC,KAAK,CAAC,EAAE,OAAO,KAAK,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,CAAC;YAChF,MAAM,MAAM,GAAG,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC;YACxC,IAAI,MAAM;gBAAE,KAAK,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;iBAC3D,CAAC;gBACJ,MAAM,EAAE,OAAO,EAAE,EAAE,EAAE,GAAG,IAAI,EAAE,GAAG,KAAK,CAAC,KAAK,CAAE,CAAC;gBAC/C,KAAK,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC;YACtB,CAAC;QACH,CAAC;QACD,IAAI,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC;YAAE,MAAM,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,cAAc,EAAE,KAAK,CAAC,CAAC;QACtG,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,CAAC;IACpD,CAAC;IAED,IAAI,IAAI,KAAK,qBAAqB,EAAE,CAAC;QACnC,IAAI,MAAM,KAAK,KAAK;YAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE,CAAC;QAC3E,sDAAsD;QACtD,MAAM,IAAI,GAAG,aAAa,CAAC,KAAK,EAAE,MAAM,IAAI,CAAC,KAAK,EAAE,EAAE,MAAM,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC,CAAC;QAC1F,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,EAAE,CAAC;IACzC,CAAC;IAED,IAAI,IAAI,KAAK,qBAAqB,EAAE,CAAC;QACnC,IAAI,MAAM,KAAK,MAAM;YAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,YAAY,EAAE,EAAE,CAAC;QAC7E,MAAM,IAAI,GAAG,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjF,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,0BAA0B,EAAE,EAAE,CAAC;QAC/F,MAAM,cAAc,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;QAC9C,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,CAAC;IAC7C,CAAC;IAED,MAAM,GAAG,GAAG,sDAAsD,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC9E,IAAI,GAAG,EAAE,CAAC;QACR,IAAI,MAAM,KAAK,MAAM;YAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,YAAY,EAAE,EAAE,CAAC;QAC7E,MAAM,EAAE,GAAG,GAAG,CAAC,CAAC,CAAE,CAAC;QACnB,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,CAAC;YAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,oBAAoB,EAAE,IAAI,EAAE,EAAE,CAAC;QAC/G,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC7C,MAAM,IAAI,GAAG,GAAG,CAAC,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC,QAAQ,EAAE,EAAE,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,EAAE,EAAE,EAAE,KAAK,CAAC,CAAC;QACtJ,MAAM,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,cAAc,EAAE,IAAI,CAAC,CAAC;QAC7C,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,CAAC;IAC7C,CAAC;IAED,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,qBAAqB,EAAE,EAAE,CAAC;AACjE,CAAC"}

package/packages/gateway/dist/web/access/cloudflare-connector.d.ts

@@ -0,0 +1,63 @@
+/**
+ * The gateway's half of the connector the supervisor runs (slate R73vdX4bOO).
+ *
+ * The tunnel's connector token is an owner secret, `CLOUDFLARE_TUNNEL_TOKEN`,
+ * bound pre-approved to the gateway's own `access.cloudflare` destination
+ * (target `connector`). "Set it up for me" keeps it there; the supervisor
+ * reads it at each spawn and hands it to cloudflared in its environment;
+ * Remove forgets it.
+ *
+ * Whether the connector should run is read from the database by the
+ * supervisor (`cloudflareConnectorPlan`): Cloudflare Access on, a tunnel in
+ * the setup record, a token kept, and the owner hasn't chosen Cloudflare's
+ * system service instead.
+ *
+ * The setup engine and the setting's Save reach the supervisor over its
+ * control socket (`supervisorConnector`): `POST /connector {action}`.
+ */
+import { type Vault } from '@buddi/core';
+import type { Pool } from 'pg';
+export declare const CONNECTOR_TOKEN_SECRET = "CLOUDFLARE_TUNNEL_TOKEN";
+export type ConnectorState = 'running' | 'starting' | 'stopped' | 'missing-binary' | 'system-daemon';
+/** What the supervisor answers on `/connector` (install's cloudflared.ts, ConnectorStatus). */
+export interface ConnectorView {
+    state: ConnectorState;
+    mode: 'buddi' | 'system';
+    systemDaemon: string | null;
+    binary: {
+        path: string;
+        source: 'path' | 'downloaded';
+    } | null;
+    detail?: string | undefined;
+    brew?: string | undefined;
+    pid: number | null;
+    log: string;
+    removedBinary?: boolean | undefined;
+}
+/** What the setup engine needs of the connector. */
+export interface ConnectorControl {
+    saveToken(token: string): Promise<void>;
+    forgetToken(): Promise<void>;
+    /** Ask the supervisor to match the setting now; its status after. */
+    sync(): Promise<ConnectorView>;
+    /** Stop it and delete the binary buddi downloaded. */
+    remove(): Promise<ConnectorView>;
+}
+export interface ConnectorTokenStore {
+    has(): Promise<boolean>;
+    put(value: string): Promise<void>;
+    use(): Promise<string | null>;
+    remove(): Promise<void>;
+}
+export declare function connectorTokenStore(pool: Pool, vault: Vault | undefined): ConnectorTokenStore;
+/** Should the supervisor run the connector, and for which tunnel? */
+export declare function cloudflareConnectorPlan(pool: Pool): Promise<{
+    wanted: boolean;
+    mode: 'buddi' | 'system';
+    tunnelId: string | null;
+}>;
+/** The supervisor's `/connector`, or throws when it can't be reached. */
+export declare function supervisorConnector(socket: string, tokens: ConnectorTokenStore): ConnectorControl;
+/** Is a supervisor answering on this socket? */
+export declare function supervisorAnswers(socket: string | undefined): Promise<boolean>;
+//# sourceMappingURL=cloudflare-connector.d.ts.map

package/packages/gateway/dist/web/access/cloudflare-connector.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cloudflare-connector.d.ts","sourceRoot":"","sources":["../../../src/web/access/cloudflare-connector.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AACH,OAAO,EAAiG,KAAK,KAAK,EAAE,MAAM,aAAa,CAAC;AACxI,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,IAAI,CAAC;AAM/B,eAAO,MAAM,sBAAsB,4BAA4B,CAAC;AAGhE,MAAM,MAAM,cAAc,GAAG,SAAS,GAAG,UAAU,GAAG,SAAS,GAAG,gBAAgB,GAAG,eAAe,CAAC;AAErG,+FAA+F;AAC/F,MAAM,WAAW,aAAa;IAC5B,KAAK,EAAE,cAAc,CAAC;IACtB,IAAI,EAAE,OAAO,GAAG,QAAQ,CAAC;IACzB,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,MAAM,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,GAAG,YAAY,CAAA;KAAE,GAAG,IAAI,CAAC;IAC/D,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC5B,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC1B,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IACnB,GAAG,EAAE,MAAM,CAAC;IACZ,aAAa,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;CACrC;AAED,oDAAoD;AACpD,MAAM,WAAW,gBAAgB;IAC/B,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACxC,WAAW,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7B,qEAAqE;IACrE,IAAI,IAAI,OAAO,CAAC,aAAa,CAAC,CAAC;IAC/B,sDAAsD;IACtD,MAAM,IAAI,OAAO,CAAC,aAAa,CAAC,CAAC;CAClC;AAED,MAAM,WAAW,mBAAmB;IAClC,GAAG,IAAI,OAAO,CAAC,OAAO,CAAC,CAAC;IACxB,GAAG,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAClC,GAAG,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAC9B,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACzB;AAED,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,GAAG,SAAS,GAAG,mBAAmB,CA+B7F;AAED,qEAAqE;AACrE,wBAAsB,uBAAuB,CAAC,IAAI,EAAE,IAAI,GAAG,OAAO,CAAC;IAAE,MAAM,EAAE,OAAO,CAAC;IAAC,IAAI,EAAE,OAAO,GAAG,QAAQ,CAAC;IAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,CAAC,CAQzI;AAED,yEAAyE;AACzE,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,mBAAmB,GAAG,gBAAgB,CAYjG;AAED,gDAAgD;AAChD,wBAAsB,iBAAiB,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,CAGpF"}

package/packages/gateway/dist/web/access/cloudflare-connector.js

@@ -0,0 +1,87 @@
+/**
+ * The gateway's half of the connector the supervisor runs (slate R73vdX4bOO).
+ *
+ * The tunnel's connector token is an owner secret, `CLOUDFLARE_TUNNEL_TOKEN`,
+ * bound pre-approved to the gateway's own `access.cloudflare` destination
+ * (target `connector`). "Set it up for me" keeps it there; the supervisor
+ * reads it at each spawn and hands it to cloudflared in its environment;
+ * Remove forgets it.
+ *
+ * Whether the connector should run is read from the database by the
+ * supervisor (`cloudflareConnectorPlan`): Cloudflare Access on, a tunnel in
+ * the setup record, a token kept, and the owner hasn't chosen Cloudflare's
+ * system service instead.
+ *
+ * The setup engine and the setting's Save reach the supervisor over its
+ * control socket (`supervisorConnector`): `POST /connector {action}`.
+ */
+import { deleteOwnerSecret, findSecret, putOwnerSecret, readWebSetting, useOwnerSecret } from '@buddi/core';
+import { supervisorCall } from '../service.js';
+import { CLOUDFLARE_SETTING_KEY, toCloudflareSetting } from './cloudflare.js';
+import { CLOUDFLARE_SETUP_KEY } from './cloudflare-setup.js';
+import { ACCESS_CLOUDFLARE_KIND, registerCloudflareTokenDestination } from './cloudflare-token.js';
+export const CONNECTOR_TOKEN_SECRET = 'CLOUDFLARE_TUNNEL_TOKEN';
+const TARGET = 'connector';
+export function connectorTokenStore(pool, vault) {
+    registerCloudflareTokenDestination();
+    return {
+        has: async () => (await findSecret(pool, CONNECTOR_TOKEN_SECRET)) !== null,
+        async put(value) {
+            if (!vault)
+                throw new Error('This installation has no vault, so the connector token cannot be kept.');
+            await putOwnerSecret(pool, vault, {
+                name: CONNECTOR_TOKEN_SECRET,
+                value: value.trim(),
+                bindings: [{ kind: ACCESS_CLOUDFLARE_KIND, target: TARGET, rule: 'pre-approved' }],
+            });
+        },
+        async use() {
+            let value = null;
+            const result = await useOwnerSecret({
+                pool,
+                vault,
+                plugin: 'access',
+                buddi: { version: '0.0', plugin: 'access' },
+                now: () => new Date(),
+                deliverInto: (delivered) => { value = delivered; },
+            }, { name: CONNECTOR_TOKEN_SECRET, kind: ACCESS_CLOUDFLARE_KIND, target: TARGET });
+            return 'done' in result ? value : null;
+        },
+        async remove() {
+            if (vault && (await findSecret(pool, CONNECTOR_TOKEN_SECRET)) !== null)
+                await deleteOwnerSecret(pool, vault, CONNECTOR_TOKEN_SECRET);
+        },
+    };
+}
+/** Should the supervisor run the connector, and for which tunnel? */
+export async function cloudflareConnectorPlan(pool) {
+    const setting = toCloudflareSetting(await readWebSetting(pool, CLOUDFLARE_SETTING_KEY));
+    const row = await readWebSetting(pool, CLOUDFLARE_SETUP_KEY);
+    const record = row && typeof row === 'object' && typeof row.host === 'string' ? row : null;
+    const mode = record?.connector === 'system' ? 'system' : 'buddi';
+    const tunnelId = record?.tunnelId ?? null;
+    const token = tunnelId ? (await findSecret(pool, CONNECTOR_TOKEN_SECRET)) !== null : false;
+    return { wanted: setting.enabled && tunnelId !== null && token, mode, tunnelId };
+}
+/** The supervisor's `/connector`, or throws when it can't be reached. */
+export function supervisorConnector(socket, tokens) {
+    const ask = async (action) => {
+        const reply = await supervisorCall(socket, '/connector', 'POST', { action }, 200_000);
+        if (reply.status !== 200)
+            throw new Error(reply.body?.error ?? `The supervisor answered ${reply.status}.`);
+        return reply.body;
+    };
+    return {
+        saveToken: (token) => tokens.put(token),
+        forgetToken: () => tokens.remove(),
+        sync: () => ask('sync'),
+        remove: () => ask('remove'),
+    };
+}
+/** Is a supervisor answering on this socket? */
+export async function supervisorAnswers(socket) {
+    if (!socket?.trim())
+        return false;
+    return supervisorCall(socket, '/status', 'GET', undefined, 3_000).then((r) => r.status === 200, () => false);
+}
+//# sourceMappingURL=cloudflare-connector.js.map

package/packages/gateway/dist/web/access/cloudflare-connector.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cloudflare-connector.js","sourceRoot":"","sources":["../../../src/web/access/cloudflare-connector.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AACH,OAAO,EAAE,iBAAiB,EAAE,UAAU,EAAE,cAAc,EAAE,cAAc,EAAE,cAAc,EAA8B,MAAM,aAAa,CAAC;AAExI,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAC/C,OAAO,EAAE,sBAAsB,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AAC9E,OAAO,EAAE,oBAAoB,EAAoB,MAAM,uBAAuB,CAAC;AAC/E,OAAO,EAAE,sBAAsB,EAAE,kCAAkC,EAAE,MAAM,uBAAuB,CAAC;AAEnG,MAAM,CAAC,MAAM,sBAAsB,GAAG,yBAAyB,CAAC;AAChE,MAAM,MAAM,GAAG,WAAW,CAAC;AAkC3B,MAAM,UAAU,mBAAmB,CAAC,IAAU,EAAE,KAAwB;IACtE,kCAAkC,EAAE,CAAC;IACrC,OAAO;QACL,GAAG,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,MAAM,UAAU,CAAC,IAAI,EAAE,sBAAsB,CAAC,CAAC,KAAK,IAAI;QAC1E,KAAK,CAAC,GAAG,CAAC,KAAK;YACb,IAAI,CAAC,KAAK;gBAAE,MAAM,IAAI,KAAK,CAAC,wEAAwE,CAAC,CAAC;YACtG,MAAM,cAAc,CAAC,IAAI,EAAE,KAAK,EAAE;gBAChC,IAAI,EAAE,sBAAsB;gBAC5B,KAAK,EAAE,KAAK,CAAC,IAAI,EAAE;gBACnB,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,sBAAsB,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC;aACnF,CAAC,CAAC;QACL,CAAC;QACD,KAAK,CAAC,GAAG;YACP,IAAI,KAAK,GAAkB,IAAI,CAAC;YAChC,MAAM,MAAM,GAAG,MAAM,cAAc,CACjC;gBACE,IAAI;gBACJ,KAAK;gBACL,MAAM,EAAE,QAAQ;gBAChB,KAAK,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAA0B;gBACnE,GAAG,EAAE,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE;gBACrB,WAAW,EAAE,CAAC,SAAS,EAAE,EAAE,GAAG,KAAK,GAAG,SAAS,CAAC,CAAC,CAAC;aACnD,EACD,EAAE,IAAI,EAAE,sBAAsB,EAAE,IAAI,EAAE,sBAAsB,EAAE,MAAM,EAAE,MAAM,EAAE,CAC/E,CAAC;YACF,OAAO,MAAM,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;QACzC,CAAC;QACD,KAAK,CAAC,MAAM;YACV,IAAI,KAAK,IAAI,CAAC,MAAM,UAAU,CAAC,IAAI,EAAE,sBAAsB,CAAC,CAAC,KAAK,IAAI;gBAAE,MAAM,iBAAiB,CAAC,IAAI,EAAE,KAAK,EAAE,sBAAsB,CAAC,CAAC;QACvI,CAAC;KACF,CAAC;AACJ,CAAC;AAED,qEAAqE;AACrE,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAAC,IAAU;IACtD,MAAM,OAAO,GAAG,mBAAmB,CAAC,MAAM,cAAc,CAAC,IAAI,EAAE,sBAAsB,CAAC,CAAC,CAAC;IACxF,MAAM,GAAG,GAAG,MAAM,cAAc,CAAc,IAAI,EAAE,oBAAoB,CAAC,CAAC;IAC1E,MAAM,MAAM,GAAG,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;IAC3F,MAAM,IAAI,GAAG,MAAM,EAAE,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC;IACjE,MAAM,QAAQ,GAAG,MAAM,EAAE,QAAQ,IAAI,IAAI,CAAC;IAC1C,MAAM,KAAK,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC,MAAM,UAAU,CAAC,IAAI,EAAE,sBAAsB,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC;IAC3F,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,OAAO,IAAI,QAAQ,KAAK,IAAI,IAAI,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;AACnF,CAAC;AAED,yEAAyE;AACzE,MAAM,UAAU,mBAAmB,CAAC,MAAc,EAAE,MAA2B;IAC7E,MAAM,GAAG,GAAG,KAAK,EAAE,MAAyB,EAA0B,EAAE;QACtE,MAAM,KAAK,GAAG,MAAM,cAAc,CAAC,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,EAAE,OAAO,CAAC,CAAC;QACtF,IAAI,KAAK,CAAC,MAAM,KAAK,GAAG;YAAE,MAAM,IAAI,KAAK,CAAE,KAAK,CAAC,IAAkC,EAAE,KAAK,IAAI,2BAA2B,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC;QAC1I,OAAO,KAAK,CAAC,IAAqB,CAAC;IACrC,CAAC,CAAC;IACF,OAAO;QACL,SAAS,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC;QACvC,WAAW,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,MAAM,EAAE;QAClC,IAAI,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC;QACvB,MAAM,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,QAAQ,CAAC;KAC5B,CAAC;AACJ,CAAC;AAED,gDAAgD;AAChD,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,MAA0B;IAChE,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE;QAAE,OAAO,KAAK,CAAC;IAClC,OAAO,cAAc,CAAC,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,GAAG,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC;AAC/G,CAAC"}

package/packages/gateway/dist/web/access/cloudflare-setup.d.ts

@@ -6,9 +6,13 @@
  * `buddi-<host>`, its ingress (`<host>` → the ingress listener), a proxied
  * CNAME, a reusable Allow policy for the owner's email and a self-hosted
  * Access application for the hostname. It reads the application's AUD tag and
- * the team domain, fills in `access.cloudflare`, shows the one command buddi
- * never runs itself (`sudo cloudflared service install <token>`), waits for
- * the tunnel to report healthy and runs Test my setup.
+ * the team domain, fills in `access.cloudflare`, keeps the tunnel's connector
+ * token as an owner secret and asks the supervisor to run cloudflared itself
+ * (install's cloudflared.ts; no command to copy), waits for the tunnel to
+ * report healthy and runs Test my setup. A system service from an earlier
+ * setup (`sudo cloudflared service install`) is named, with the one line that
+ * removes it, or used instead when the owner says so. Without a supervisor (a
+ * checkout's `buddi serve`) the step falls back to the line to run by hand.
  *
  * Idempotent: the ids of what buddi made are kept in the setup record, so a
  * second run after a failure picks up where the first stopped. An object of
@@ -27,6 +31,7 @@
  */
 import type { CloudflareApi } from './cloudflare-api.js';
 import { type CloudflareAccessSetting } from './cloudflare.js';
+import type { ConnectorControl, ConnectorState, ConnectorView } from './cloudflare-connector.js';
 /** Where the record of what buddi made lives (a web setting). Ids only, never a token. */
 export declare const CLOUDFLARE_SETUP_KEY = "access.cloudflare.setup";
 /** The owner secret holding the API token. */
@@ -57,12 +62,33 @@ export interface SetupInstall {
     /** What to say beside it: the brew path on a Mac, the package on Linux. */
     note: string;
 }
+/** The connector the supervisor runs, as the step shows it. */
+export interface SetupConnector {
+    state: ConnectorState;
+    mode: 'buddi' | 'system';
+    detail?: string | undefined;
+    /** The Homebrew line, when cloudflared is missing on a Mac with brew. */
+    brew?: string | undefined;
+    /** Cloudflare's system service is installed: the line that removes it, and why. */
+    systemDaemon?: {
+        file: string;
+        command: string;
+        why: string;
+    } | undefined;
+    /** Where cloudflared's lines go. */
+    log?: string | undefined;
+}
+/** Why a system service and buddi's own connector can't both run. */
+export declare const SYSTEM_DAEMON_WHY = "Cloudflare\u2019s system service from an earlier setup is installed on this computer. Two connectors for one tunnel fight over its connections, so buddi doesn\u2019t start its own while it is there. Remove it with this line, or use it instead.";
+export declare function connectorOf(view: ConnectorView, platform: NodeJS.Platform): SetupConnector;
 export interface SetupProgress {
     state: 'idle' | 'running' | 'waiting' | 'done' | 'failed' | 'stopped' | 'removing' | 'removed';
     host: string;
     email: string;
     steps: SetupStep[];
     install: SetupInstall | null;
+    /** The connector buddi runs (or the system service it uses), when a supervisor runs buddi. */
+    connector: SetupConnector | null;
     /** The sentence for a failure, a stop or a partial removal. */
     error: string | null;
     /** The address, once it is set up. */
@@ -89,6 +115,8 @@ export interface SetupRecord {
     policyId?: string | undefined;
     appId?: string | undefined;
     aud?: string | undefined;
+    /** Who runs the connector: buddi's supervisor (the default) or Cloudflare's system service. */
+    connector?: 'buddi' | 'system' | undefined;
     at: string;
 }
 export interface SetupInput {
@@ -97,6 +125,8 @@ export interface SetupInput {
     zone?: string | undefined;
     /** "Use it anyway": take over an object of buddi's name that buddi didn't make. */
     adopt?: boolean | undefined;
+    /** "Use Cloudflare’s system service instead": buddi starts no connector of its own. */
+    useSystemDaemon?: boolean | undefined;
 }
 export interface SetupDeps {
     api: CloudflareApi;
@@ -123,6 +153,11 @@ export interface SetupDeps {
      * its first await). Without one, the run claims its own and lets it go.
      */
     lease?: SetupLease | undefined;
+    /**
+     * The supervisor's connector. Absent (a checkout's `buddi serve`, a CLI
+     * with no supervisor answering), the step shows the line to run by hand.
+     */
+    connector?: ConnectorControl | undefined;
 }
 export type SetupOperation = 'setup' | 'remove';
 export interface SetupLease {
@@ -155,7 +190,7 @@ export declare function runCloudflareSetup(input: SetupInput, deps: SetupDeps, o
  * what is left. Turns signing in through Cloudflare off when the setting is
  * the one setup filled in, and forgets the record. Never throws.
  */
-export declare function removeCloudflareSetup(deps: Pick<SetupDeps, 'api' | 'platform' | 'readSetting' | 'saveSetting' | 'readRecord' | 'saveRecord' | 'lease'> & {
+export declare function removeCloudflareSetup(deps: Pick<SetupDeps, 'api' | 'platform' | 'readSetting' | 'saveSetting' | 'readRecord' | 'saveRecord' | 'lease' | 'connector'> & {
     host?: string | undefined;
 }, onProgress?: (p: SetupProgress) => void): Promise<SetupProgress>;
 /** "a, b and c". */

package/packages/gateway/dist/web/access/cloudflare-setup.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cloudflare-setup.d.ts","sourceRoot":"","sources":["../../../src/web/access/cloudflare-setup.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,OAAO,KAAK,EAAE,aAAa,EAA4B,MAAM,qBAAqB,CAAC;AAEnF,OAAO,EAA2C,KAAK,uBAAuB,EAAE,MAAM,iBAAiB,CAAC;AAExG,0FAA0F;AAC1F,eAAO,MAAM,oBAAoB,4BAA4B,CAAC;AAC9D,8CAA8C;AAC9C,eAAO,MAAM,uBAAuB,yBAAyB,CAAC;AAE9D,eAAO,MAAM,aAAa,GAAI,MAAM,MAAM,KAAG,MAAyB,CAAC;AACvE,eAAO,MAAM,aAAa,GAAI,MAAM,MAAM,KAAG,MAA2B,CAAC;AACzE,eAAO,MAAM,UAAU,GAAI,MAAM,MAAM,KAAG,MAA2B,CAAC;AACtE,mDAAmD;AACnD,8GAA8G;AAC9G,eAAO,MAAM,iBAAiB,kIAA6H,CAAC;AAC5J,eAAO,MAAM,WAAW,oEAAoE,CAAC;AAG7F,gEAAgE;AAChE,eAAO,MAAM,cAAc,OAAQ,CAAC;AACpC,eAAO,MAAM,cAAc,QAAc,CAAC;AAE1C,MAAM,MAAM,WAAW,GAAG,OAAO,GAAG,QAAQ,GAAG,OAAO,GAAG,KAAK,GAAG,QAAQ,GAAG,MAAM,GAAG,WAAW,GAAG,SAAS,GAAG,MAAM,CAAC;AACtH,MAAM,MAAM,cAAc,GAAG,MAAM,GAAG,KAAK,GAAG,MAAM,GAAG,QAAQ,CAAC;AAEhE,MAAM,WAAW,SAAS;IACxB,EAAE,EAAE,WAAW,CAAC;IAChB,KAAK,EAAE,cAAc,CAAC;IACtB,oCAAoC;IACpC,IAAI,EAAE,MAAM,CAAC;IACb,oCAAoC;IACpC,GAAG,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC1B;AAED,MAAM,WAAW,YAAY;IAC3B,iGAAiG;IACjG,OAAO,EAAE,MAAM,CAAC;IAChB,2EAA2E;IAC3E,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,aAAa;IAC5B,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,SAAS,GAAG,MAAM,GAAG,QAAQ,GAAG,SAAS,GAAG,UAAU,GAAG,SAAS,CAAC;IAC/F,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,SAAS,EAAE,CAAC;IACnB,OAAO,EAAE,YAAY,GAAG,IAAI,CAAC;IAC7B,+DAA+D;IAC/D,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,sCAAsC;IACtC,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IACnB,qCAAqC;IACrC,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,8DAA8D;IAC9D,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,6GAA6G;IAC7G,SAAS,EAAE,OAAO,CAAC;CACpB;AAED,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IACnC,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,qGAAqG;IACrG,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC9B,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACjC,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC9B,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC3B,GAAG,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACzB,EAAE,EAAE,MAAM,CAAC;CACZ;AAED,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC1B,mFAAmF;IACnF,KAAK,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;CAC7B;AAED,MAAM,WAAW,SAAS;IACxB,GAAG,EAAE,aAAa,CAAC;IACnB,+DAA+D;IAC/D,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC;IAC1B,WAAW,EAAE,MAAM,OAAO,CAAC,uBAAuB,CAAC,CAAC;IACpD,WAAW,EAAE,CAAC,KAAK,EAAE,uBAAuB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/D,UAAU,EAAE,MAAM,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAAC;IAC9C,UAAU,EAAE,CAAC,MAAM,EAAE,WAAW,GAAG,IAAI,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1D,oDAAoD;IACpD,IAAI,EAAE,CAAC,UAAU,EAAE,MAAM,KAAK,OAAO,CAAC;QAAE,EAAE,EAAE,OAAO,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;KAAE,CAAC,CAAC;IACjG,KAAK,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,WAAW,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC,GAAG,SAAS,CAAC;IAC1E,GAAG,CAAC,EAAE,CAAC,MAAM,IAAI,CAAC,GAAG,SAAS,CAAC;IAC/B,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC5B,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC5B,MAAM,CAAC,EAAE,WAAW,GAAG,SAAS,CAAC;IACjC;;;OAGG;IACH,KAAK,CAAC,EAAE,UAAU,GAAG,SAAS,CAAC;CAChC;AAED,MAAM,MAAM,cAAc,GAAG,OAAO,GAAG,QAAQ,CAAC;AAChD,MAAM,WAAW,UAAU;IAAG,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAC;IAAC,OAAO,IAAI,IAAI,CAAA;CAAE;AAK9E,+EAA+E;AAC/E,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,cAAc,GAAG,UAAU,GAAG,IAAI,CAK3E;AAED,oCAAoC;AACpC,eAAO,MAAM,cAAc,QAAO,cAAc,GAAG,IAA+B,CAAC;AAEnF,0DAA0D;AAC1D,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,cAAc,GAAG,IAAI,GAAG,MAAM,CAIrE;AAED,uCAAuC;AACvC,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAIxD;AAED,yDAAyD;AACzD,wBAAgB,eAAe,CAAC,KAAK,EAAE,UAAU,GAAG,MAAM,GAAG,IAAI,CAKhE;AAED,0CAA0C;AAC1C,wBAAgB,UAAU,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,GAAG,YAAY,CAgBjF;AAED,wBAAgB,YAAY,CAAC,QAAQ,EAAE,MAAM,CAAC,QAAQ,GAAG,MAAM,CAE9D;AAeD,wBAAgB,aAAa,CAAC,IAAI,SAAK,EAAE,KAAK,SAAK,GAAG,aAAa,CAMlE;AAeD;;;GAGG;AACH,wBAAsB,kBAAkB,CAAC,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE,SAAS,EAAE,UAAU,GAAE,CAAC,CAAC,EAAE,aAAa,KAAK,IAAe,GAAG,OAAO,CAAC,aAAa,CAAC,CActJ;AAoND;;;;;;GAMG;AACH,wBAAsB,qBAAqB,CACzC,IAAI,EAAE,IAAI,CAAC,SAAS,EAAE,KAAK,GAAG,UAAU,GAAG,aAAa,GAAG,aAAa,GAAG,YAAY,GAAG,YAAY,GAAG,OAAO,CAAC,GAAG;IAAE,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;CAAE,EACjJ,UAAU,GAAE,CAAC,CAAC,EAAE,aAAa,KAAK,IAAe,GAChD,OAAO,CAAC,aAAa,CAAC,CAcxB;AA+DD,oBAAoB;AACpB,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,MAAM,CAItD"}
+{"version":3,"file":"cloudflare-setup.d.ts","sourceRoot":"","sources":["../../../src/web/access/cloudflare-setup.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,OAAO,KAAK,EAAE,aAAa,EAA4B,MAAM,qBAAqB,CAAC;AAEnF,OAAO,EAA2C,KAAK,uBAAuB,EAAE,MAAM,iBAAiB,CAAC;AACxG,OAAO,KAAK,EAAE,gBAAgB,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAEjG,0FAA0F;AAC1F,eAAO,MAAM,oBAAoB,4BAA4B,CAAC;AAC9D,8CAA8C;AAC9C,eAAO,MAAM,uBAAuB,yBAAyB,CAAC;AAE9D,eAAO,MAAM,aAAa,GAAI,MAAM,MAAM,KAAG,MAAyB,CAAC;AACvE,eAAO,MAAM,aAAa,GAAI,MAAM,MAAM,KAAG,MAA2B,CAAC;AACzE,eAAO,MAAM,UAAU,GAAI,MAAM,MAAM,KAAG,MAA2B,CAAC;AACtE,mDAAmD;AACnD,8GAA8G;AAC9G,eAAO,MAAM,iBAAiB,kIAA6H,CAAC;AAC5J,eAAO,MAAM,WAAW,oEAAoE,CAAC;AAG7F,gEAAgE;AAChE,eAAO,MAAM,cAAc,OAAQ,CAAC;AACpC,eAAO,MAAM,cAAc,QAAc,CAAC;AAE1C,MAAM,MAAM,WAAW,GAAG,OAAO,GAAG,QAAQ,GAAG,OAAO,GAAG,KAAK,GAAG,QAAQ,GAAG,MAAM,GAAG,WAAW,GAAG,SAAS,GAAG,MAAM,CAAC;AACtH,MAAM,MAAM,cAAc,GAAG,MAAM,GAAG,KAAK,GAAG,MAAM,GAAG,QAAQ,CAAC;AAEhE,MAAM,WAAW,SAAS;IACxB,EAAE,EAAE,WAAW,CAAC;IAChB,KAAK,EAAE,cAAc,CAAC;IACtB,oCAAoC;IACpC,IAAI,EAAE,MAAM,CAAC;IACb,oCAAoC;IACpC,GAAG,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC1B;AAED,MAAM,WAAW,YAAY;IAC3B,iGAAiG;IACjG,OAAO,EAAE,MAAM,CAAC;IAChB,2EAA2E;IAC3E,IAAI,EAAE,MAAM,CAAC;CACd;AAED,+DAA+D;AAC/D,MAAM,WAAW,cAAc;IAC7B,KAAK,EAAE,cAAc,CAAC;IACtB,IAAI,EAAE,OAAO,GAAG,QAAQ,CAAC;IACzB,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC5B,yEAAyE;IACzE,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC1B,mFAAmF;IACnF,YAAY,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,GAAG,SAAS,CAAC;IAC1E,oCAAoC;IACpC,GAAG,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC1B;AAED,qEAAqE;AACrE,eAAO,MAAM,iBAAiB,wPAA8O,CAAC;AAE7Q,wBAAgB,WAAW,CAAC,IAAI,EAAE,aAAa,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,GAAG,cAAc,CAS1F;AAED,MAAM,WAAW,aAAa;IAC5B,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,SAAS,GAAG,MAAM,GAAG,QAAQ,GAAG,SAAS,GAAG,UAAU,GAAG,SAAS,CAAC;IAC/F,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,SAAS,EAAE,CAAC;IACnB,OAAO,EAAE,YAAY,GAAG,IAAI,CAAC;IAC7B,8FAA8F;IAC9F,SAAS,EAAE,cAAc,GAAG,IAAI,CAAC;IACjC,+DAA+D;IAC/D,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,sCAAsC;IACtC,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IACnB,qCAAqC;IACrC,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,8DAA8D;IAC9D,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,6GAA6G;IAC7G,SAAS,EAAE,OAAO,CAAC;CACpB;AAED,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IACnC,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,qGAAqG;IACrG,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC9B,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACjC,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC9B,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC3B,GAAG,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACzB,+FAA+F;IAC/F,SAAS,CAAC,EAAE,OAAO,GAAG,QAAQ,GAAG,SAAS,CAAC;IAC3C,EAAE,EAAE,MAAM,CAAC;CACZ;AAED,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC1B,mFAAmF;IACnF,KAAK,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IAC5B,uFAAuF;IACvF,eAAe,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;CACvC;AAED,MAAM,WAAW,SAAS;IACxB,GAAG,EAAE,aAAa,CAAC;IACnB,+DAA+D;IAC/D,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC;IAC1B,WAAW,EAAE,MAAM,OAAO,CAAC,uBAAuB,CAAC,CAAC;IACpD,WAAW,EAAE,CAAC,KAAK,EAAE,uBAAuB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/D,UAAU,EAAE,MAAM,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAAC;IAC9C,UAAU,EAAE,CAAC,MAAM,EAAE,WAAW,GAAG,IAAI,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1D,oDAAoD;IACpD,IAAI,EAAE,CAAC,UAAU,EAAE,MAAM,KAAK,OAAO,CAAC;QAAE,EAAE,EAAE,OAAO,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;KAAE,CAAC,CAAC;IACjG,KAAK,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,WAAW,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC,GAAG,SAAS,CAAC;IAC1E,GAAG,CAAC,EAAE,CAAC,MAAM,IAAI,CAAC,GAAG,SAAS,CAAC;IAC/B,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC5B,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC5B,MAAM,CAAC,EAAE,WAAW,GAAG,SAAS,CAAC;IACjC;;;OAGG;IACH,KAAK,CAAC,EAAE,UAAU,GAAG,SAAS,CAAC;IAC/B;;;OAGG;IACH,SAAS,CAAC,EAAE,gBAAgB,GAAG,SAAS,CAAC;CAC1C;AAED,MAAM,MAAM,cAAc,GAAG,OAAO,GAAG,QAAQ,CAAC;AAChD,MAAM,WAAW,UAAU;IAAG,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAC;IAAC,OAAO,IAAI,IAAI,CAAA;CAAE;AAK9E,+EAA+E;AAC/E,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,cAAc,GAAG,UAAU,GAAG,IAAI,CAK3E;AAED,oCAAoC;AACpC,eAAO,MAAM,cAAc,QAAO,cAAc,GAAG,IAA+B,CAAC;AAEnF,0DAA0D;AAC1D,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,cAAc,GAAG,IAAI,GAAG,MAAM,CAIrE;AAED,uCAAuC;AACvC,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAIxD;AAED,yDAAyD;AACzD,wBAAgB,eAAe,CAAC,KAAK,EAAE,UAAU,GAAG,MAAM,GAAG,IAAI,CAKhE;AAED,0CAA0C;AAC1C,wBAAgB,UAAU,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,GAAG,YAAY,CAgBjF;AAED,wBAAgB,YAAY,CAAC,QAAQ,EAAE,MAAM,CAAC,QAAQ,GAAG,MAAM,CAE9D;AAeD,wBAAgB,aAAa,CAAC,IAAI,SAAK,EAAE,KAAK,SAAK,GAAG,aAAa,CAMlE;AAeD;;;GAGG;AACH,wBAAsB,kBAAkB,CAAC,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE,SAAS,EAAE,UAAU,GAAE,CAAC,CAAC,EAAE,aAAa,KAAK,IAAe,GAAG,OAAO,CAAC,aAAa,CAAC,CActJ;AAgQD;;;;;;GAMG;AACH,wBAAsB,qBAAqB,CACzC,IAAI,EAAE,IAAI,CAAC,SAAS,EAAE,KAAK,GAAG,UAAU,GAAG,aAAa,GAAG,aAAa,GAAG,YAAY,GAAG,YAAY,GAAG,OAAO,GAAG,WAAW,CAAC,GAAG;IAAE,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;CAAE,EAC/J,UAAU,GAAE,CAAC,CAAC,EAAE,aAAa,KAAK,IAAe,GAChD,OAAO,CAAC,aAAa,CAAC,CAcxB;AA4ED,oBAAoB;AACpB,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,MAAM,CAItD"}

package/packages/gateway/dist/web/access/cloudflare-setup.js

@@ -15,6 +15,18 @@ const ownsRecord = (r) => (r.comment ?? '').startsWith('Made by buddi');
 /** How often the tunnel's health is asked, and for how long. */
 export const HEALTH_POLL_MS = 5_000;
 export const HEALTH_WAIT_MS = 30 * 60_000;
+/** Why a system service and buddi's own connector can't both run. */
+export const SYSTEM_DAEMON_WHY = 'Cloudflare’s system service from an earlier setup is installed on this computer. Two connectors for one tunnel fight over its connections, so buddi doesn’t start its own while it is there. Remove it with this line, or use it instead.';
+export function connectorOf(view, platform) {
+    return {
+        state: view.state,
+        mode: view.mode,
+        ...(view.detail ? { detail: view.detail } : {}),
+        ...(view.brew ? { brew: view.brew } : {}),
+        ...(view.systemDaemon ? { systemDaemon: { file: view.systemDaemon, command: uninstallFor(platform), why: SYSTEM_DAEMON_WHY } } : {}),
+        log: view.log,
+    };
+}
 /** In this process, the one setup or removal going, or null. */
 let operation = null;
 /** Claim the one operation slot, synchronously; null when another holds it. */
@@ -80,7 +92,7 @@ const LABELS = {
     dns: 'Adding the DNS record',
     access: 'Creating the Access application',
     save: 'Filling in buddi’s settings',
-    connector: 'Install the connector',
+    connector: 'Starting the connector…',
     healthy: 'Waiting for the tunnel to connect',
     test: 'Testing the setup',
 };
@@ -89,7 +101,7 @@ export function freshProgress(host = '', email = '') {
     return {
         state: 'idle', host, email,
         steps: ORDER.map((id) => ({ id, state: 'next', text: LABELS[id] })),
-        install: null, error: null, url: null, removed: [], uninstall: null, adoptable: false,
+        install: null, connector: null, error: null, url: null, removed: [], uninstall: null, adoptable: false,
     };
 }
 function sentence(error) {
@@ -284,12 +296,53 @@ async function setupRun(input, deps, onProgress) {
             throw new SetupError(checked.error);
         await deps.saveSetting(checked.value);
         finish('save', 'buddi’s settings filled in');
-        // 7. The one command buddi does not run.
+        // 7. The connector: the supervisor runs it, or (no supervisor) the owner does.
         at('connector');
-        p.install = installFor(await api.tunnelToken(accountId, tunnel.id), deps.platform);
+        const connectorToken = await api.tunnelToken(accountId, tunnel.id);
+        if (!CONNECTOR_TOKEN.test(connectorToken))
+            throw new CloudflareApiError('Cloudflare answered without the tunnel’s connector token.', 200, []);
+        const control = deps.connector;
+        const systemMode = input.useSystemDaemon === true;
+        let view = null;
+        const look = async () => {
+            if (!control)
+                return;
+            try {
+                view = await control.sync();
+            }
+            catch {
+                view = null;
+            }
+            p.connector = view ? connectorOf(view, deps.platform) : null;
+            const s = step('connector');
+            if (s.state === 'done')
+                return;
+            const v = view;
+            s.text = !v ? 'Starting the connector… (buddi’s supervisor isn’t answering)'
+                : v.mode === 'system' ? 'Using Cloudflare’s system service'
+                    : v.state === 'running' ? 'Connector running'
+                        : v.state === 'missing-binary' ? 'cloudflared isn’t on this computer'
+                            : v.state === 'system-daemon' ? 'Cloudflare’s system service is in the way'
+                                : 'Starting the connector…';
+            if (v?.state === 'running' && v.mode === 'buddi')
+                finish('connector', 'Connector running');
+        };
+        if (control) {
+            record.connector = systemMode ? 'system' : 'buddi';
+            await deps.saveRecord(record);
+            await control.saveToken(connectorToken);
+            // The system service runs whatever token it was installed with: the line, should it be another tunnel's.
+            if (systemMode)
+                p.install = { ...installFor(connectorToken, deps.platform), note: 'Only if the system service runs another tunnel: uninstall it (sudo cloudflared service uninstall), then install it again with this line.' };
+            await look();
+        }
+        else {
+            step('connector').text = 'Install the connector';
+            p.install = installFor(connectorToken, deps.platform);
+        }
         p.state = 'waiting';
         emit();
-        // 8. Wait for cloudflared to connect.
+        // 8. Wait for the tunnel to connect.
         const deadline = now().getTime() + (deps.waitMs ?? HEALTH_WAIT_MS);
         let healthy = false;
         let first = true;
@@ -307,19 +360,37 @@ async function setupRun(input, deps, onProgress) {
             if (now().getTime() >= deadline)
                 break;
             await sleep(deps.pollMs ?? HEALTH_POLL_MS, deps.signal);
+            if (!deps.signal?.aborted && control) {
+                await look();
+                emit();
+            }
         }
         if (!healthy) {
             if (deps.signal?.aborted) {
                 p.state = 'stopped';
-                p.error = 'Stopped waiting. Everything buddi made stays; run the command, then Set it up again to finish.';
+                p.error = control
+                    ? 'Stopped waiting. Everything buddi made stays; Set it up again to finish.'
+                    : 'Stopped waiting. Everything buddi made stays; run the command, then Set it up again to finish.';
                 emit();
                 return p;
             }
-            current = 'healthy';
-            throw new SetupError('The tunnel hasn’t connected yet. Run the command above on this computer, then try again.');
+            const v = view;
+            current = !control || v?.state === 'running' || v?.mode === 'system' ? 'healthy' : 'connector';
+            if (!control)
+                throw new SetupError('The tunnel hasn’t connected yet. Run the command above on this computer, then try again.');
+            if (!v)
+                throw new SetupError('buddi’s supervisor didn’t answer, so the connector isn’t running. Restart buddi, then Set it up again.');
+            if (v.mode === 'system')
+                throw new SetupError('The tunnel hasn’t connected through Cloudflare’s system service. Check that it runs this tunnel’s token, then Set it up again.');
+            if (v.state === 'system-daemon')
+                throw new SetupError('Cloudflare’s system service is still installed. Remove it (sudo cloudflared service uninstall) or use it instead, then Set it up again.');
+            if (v.state === 'missing-binary')
+                throw new SetupError(`cloudflared isn’t on this computer and buddi couldn’t download it. ${v.brew ? `Run ${v.brew}` : 'Install it from Cloudflare’s downloads page'}, then Set it up again.`);
+            throw new SetupError('The tunnel hasn’t connected yet. cloudflared’s own lines are in logs/cloudflared.log in buddi’s data folder.');
         }
-        finish('connector', 'Connector installed');
-        finish('healthy', 'Tunnel connected');
+        const v = view;
+        finish('connector', !control ? 'Connector installed' : v?.mode === 'system' ? 'Cloudflare’s system service connected' : 'Connector running');
+        finish('healthy', 'Connected');
         // 9. Test my setup.
         at('test');
         const tested = await deps.test(teamDomain);
@@ -403,6 +474,22 @@ async function removeRun(deps, onProgress) {
         record[key] = undefined;
         await deps.saveRecord(record).catch(() => undefined);
     };
+    // The connector first: its token forgotten (so nothing starts it again), the child stopped, a downloaded cloudflared deleted.
+    let systemDaemon = !deps.connector;
+    if (deps.connector) {
+        try {
+            await deps.connector.forgetToken();
+            const view = await deps.connector.remove();
+            if (view.removedBinary) {
+                p.removed.push('the cloudflared buddi downloaded');
+                emit();
+            }
+            systemDaemon = view.systemDaemon !== null;
+        }
+        catch {
+            failures.push('buddi’s connector could not be stopped; restart buddi to stop it.');
+        }
+    }
     const account = record.accountId;
     const zone = record.zone.id;
     await attempt('the Access application', 'appId', (id) => api.deleteApp(account, id));
@@ -422,7 +509,8 @@ async function removeRun(deps, onProgress) {
     if (failures.length === 0)
         await deps.saveRecord(null).catch(() => undefined);
     p.state = 'removed';
-    p.uninstall = uninstallFor(deps.platform);
+    // Cloudflare's system service is the owner's to remove: buddi never runs sudo.
+    p.uninstall = systemDaemon ? uninstallFor(deps.platform) : null;
     p.error = failures.length ? `Some of it is still there. ${failures.join(' ')} Try Remove again.` : null;
     emit();
     return p;