@xopcai/xopc 0.0.148 → 0.0.150

package/dist/src/tunnel/frpc-binary.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"frpc-binary.js","names":[],"sources":["../../../src/tunnel/frpc-binary.ts"],"sourcesContent":["import {\n  chmodSync,\n  createWriteStream,\n  existsSync,\n  mkdirSync,\n  rmSync,\n} from 'node:fs';\nimport { join } from 'node:path';\nimport { pipeline } from 'node:stream/promises';\nimport { Readable } from 'node:stream';\nimport { tmpdir } from 'node:os';\nimport { randomBytes } from 'node:crypto';\n\nimport { resolveBinDir } from '../config/paths.js';\nimport { createLogger } from '../utils/logger.js';\nimport {\n  extractFrpcFromReleaseArchive,\n  frpcReleaseArchiveExtension,\n  nodePlatformForFrpTarget,\n  type FrpcReleasePlatform,\n} from './frpc-extract.js';\nimport type { FrpcDownloadProgress } from './tunnel-types.js';\n\nconst log = createLogger('TunnelFrpc');\n\nexport const FRPC_VERSION = '0.62.1';\n\nexport type { FrpcDownloadProgress };\n\nexport type EnsureFrpcBinaryOptions = {\n  onProgress?: (progress: FrpcDownloadProgress) => void;\n};\n\nconst PLATFORM_MAP: Record<string, FrpcReleasePlatform> = {\n  darwin: 'darwin',\n  linux: 'linux',\n  win32: 'windows',\n};\n\nconst ARCH_MAP: Record<string, string> = {\n  x64: 'amd64',\n  arm64: 'arm64',\n  ia32: '386',\n};\n\nexport function buildFrpcReleaseBasename(\n  frpPlatform: FrpcReleasePlatform,\n  arch: string,\n  version = FRPC_VERSION,\n): string {\n  return `frp_${version}_${frpPlatform}_${arch}`;\n}\n\nexport function frpcDownloadUrlsForTarget(\n  frpPlatform: FrpcReleasePlatform,\n  arch: string,\n  version = FRPC_VERSION,\n): string[] {\n  const folder = buildFrpcReleaseBasename(frpPlatform, arch, version);\n  const ext = frpcReleaseArchiveExtension(frpPlatform);\n  return [\n    `https://frp.xopc.ai/bin/${folder}${ext}`,\n    `https://github.com/fatedier/frp/releases/download/v${version}/${folder}${ext}`,\n    `https://ghfast.top/https://github.com/fatedier/frp/releases/download/v${version}/${folder}${ext}`,\n  ];\n}\n\nfunction frpcPlatformArch(): { platform: FrpcReleasePlatform; arch: string; folder: string } {\n  const platform = PLATFORM_MAP[process.platform] ?? (process.platform as FrpcReleasePlatform);\n  const arch = ARCH_MAP[process.arch] ?? process.arch;\n  return { platform, arch, folder: buildFrpcReleaseBasename(platform, arch) };\n}\n\nfunction frpcDownloadUrls(): string[] {\n  const { platform, arch } = frpcPlatformArch();\n  return frpcDownloadUrlsForTarget(platform, arch);\n}\n\nasync function downloadToFile(\n  url: string,\n  destPath: string,\n  onProgress?: (progress: FrpcDownloadProgress) => void,\n): Promise<void> {\n  const res = await fetch(url);\n  if (!res.ok || !res.body) {\n    throw new Error(`Download failed: ${res.status} ${url}`);\n  }\n\n  const contentLength = res.headers.get('content-length');\n  const totalBytes =\n    contentLength && Number.isFinite(Number(contentLength)) ? Number(contentLength) : null;\n  let bytesReceived = 0;\n\n  const report = () => {\n    onProgress?.({\n      phase: 'downloading',\n      url,\n      bytesReceived,\n      totalBytes,\n      percent:\n        totalBytes && totalBytes > 0\n          ? Math.min(100, Math.round((bytesReceived / totalBytes) * 100))\n          : null,\n    });\n  };\n\n  report();\n\n  const nodeStream = Readable.fromWeb(res.body as Parameters<typeof Readable.fromWeb>[0]);\n  nodeStream.on('data', (chunk: Buffer | string) => {\n    bytesReceived += typeof chunk === 'string' ? Buffer.byteLength(chunk) : chunk.length;\n    report();\n  });\n\n  await pipeline(nodeStream, createWriteStream(destPath));\n  report();\n}\n\n/** Set after a successful tunnel start so subprocesses can resolve the same binary. */\nexport function publishFrpcPathForProcess(binPath: string): void {\n  process.env.XOPC_FRPC_PATH = binPath;\n}\n\n/** Clear runtime frpc path when the tunnel stops (no bundled Electron binary). */\nexport function clearFrpcPathForProcess(): void {\n  delete process.env.XOPC_FRPC_PATH;\n}\n\nexport async function ensureFrpcBinary(opts?: EnsureFrpcBinaryOptions): Promise<string> {\n  const onProgress = opts?.onProgress;\n  const ext = process.platform === 'win32' ? '.exe' : '';\n  const binName = `frpc${ext}`;\n\n  const fromEnv = process.env.XOPC_FRPC_PATH?.trim();\n  if (fromEnv && existsSync(fromEnv)) {\n    return fromEnv;\n  }\n\n  const cacheDir = resolveBinDir();\n  mkdirSync(cacheDir, { recursive: true });\n  const cachePath = join(cacheDir, binName);\n  if (existsSync(cachePath)) return cachePath;\n\n  const tmpBase = join(tmpdir(), `xopc-frpc-${randomBytes(6).toString('hex')}`);\n  mkdirSync(tmpBase, { recursive: true });\n  const { platform, arch, folder } = frpcPlatformArch();\n  const archiveExt = frpcReleaseArchiveExtension(platform);\n  const archivePath = join(tmpBase, `frpc${archiveExt}`);\n\n  const urls = frpcDownloadUrls();\n  let lastErr: unknown;\n  try {\n    for (const url of urls) {\n      try {\n        log.info({ url }, 'Downloading frpc');\n        await downloadToFile(url, archivePath, onProgress);\n        onProgress?.({ phase: 'extracting', url, bytesReceived: 0, totalBytes: null, percent: null });\n        await extractFrpcFromReleaseArchive(\n          archivePath,\n          cachePath,\n          folder,\n          nodePlatformForFrpTarget(platform),\n        );\n        if (process.platform !== 'win32') chmodSync(cachePath, 0o755);\n        return cachePath;\n      } catch (err) {\n        lastErr = err;\n        log.warn({ url, err }, 'frpc download attempt failed');\n      }\n    }\n  } finally {\n    rmSync(tmpBase, { recursive: true, force: true });\n  }\n\n  throw new Error(\n    `Failed to download frpc v${FRPC_VERSION} for ${platform}/${arch}: ${lastErr instanceof Error ? lastErr.message : String(lastErr)}`,\n  );\n}\n"],"mappings":";;;;;;;;;;;YAamD;aACD;AASlD,MAAM,MAAM,aAAa,aAAa;AAEtC,MAAa,eAAe;AAQ5B,MAAM,eAAoD;CACxD,QAAQ;CACR,OAAO;CACP,OAAO;CACR;AAED,MAAM,WAAmC;CACvC,KAAK;CACL,OAAO;CACP,MAAM;CACP;AAED,SAAgB,yBACd,aACA,MACA,UAAU,cACF;AACR,QAAO,OAAO,QAAQ,GAAG,YAAY,GAAG;;AAG1C,SAAgB,0BACd,aACA,MACA,UAAU,cACA;CACV,MAAM,SAAS,yBAAyB,aAAa,MAAM,QAAQ;CACnE,MAAM,MAAM,4BAA4B,YAAY;AACpD,QAAO;EACL,2BAA2B,SAAS;EACpC,sDAAsD,QAAQ,GAAG,SAAS;EAC1E,yEAAyE,QAAQ,GAAG,SAAS;EAC9F;;AAGH,SAAS,mBAAoF;CAC3F,MAAM,WAAW,aAAa,QAAQ,aAAc,QAAQ;CAC5D,MAAM,OAAO,SAAS,QAAQ,SAAS,QAAQ;AAC/C,QAAO;EAAE;EAAU;EAAM,QAAQ,yBAAyB,UAAU,KAAK;EAAE;;AAG7E,SAAS,mBAA6B;CACpC,MAAM,EAAE,UAAU,SAAS,kBAAkB;AAC7C,QAAO,0BAA0B,UAAU,KAAK;;AAGlD,eAAe,eACb,KACA,UACA,YACe;CACf,MAAM,MAAM,MAAM,MAAM,IAAI;AAC5B,KAAI,CAAC,IAAI,MAAM,CAAC,IAAI,KAClB,OAAM,IAAI,MAAM,oBAAoB,IAAI,OAAO,GAAG,MAAM;CAG1D,MAAM,gBAAgB,IAAI,QAAQ,IAAI,iBAAiB;CACvD,MAAM,aACJ,iBAAiB,OAAO,SAAS,OAAO,cAAc,CAAC,GAAG,OAAO,cAAc,GAAG;CACpF,IAAI,gBAAgB;CAEpB,MAAM,eAAe;AACnB,eAAa;GACX,OAAO;GACP;GACA;GACA;GACA,SACE,cAAc,aAAa,IACvB,KAAK,IAAI,KAAK,KAAK,MAAO,gBAAgB,aAAc,IAAI,CAAC,GAC7D;GACP,CAAC;;AAGJ,SAAQ;CAER,MAAM,aAAa,SAAS,QAAQ,IAAI,KAA+C;AACvF,YAAW,GAAG,SAAS,UAA2B;AAChD,mBAAiB,OAAO,UAAU,WAAW,OAAO,WAAW,MAAM,GAAG,MAAM;AAC9E,UAAQ;GACR;AAEF,OAAM,SAAS,YAAY,kBAAkB,SAAS,CAAC;AACvD,SAAQ;;;AAIV,SAAgB,0BAA0B,SAAuB;AAC/D,SAAQ,IAAI,iBAAiB;;;AAI/B,SAAgB,0BAAgC;AAC9C,QAAO,QAAQ,IAAI;;AAGrB,eAAsB,iBAAiB,MAAiD;CACtF,MAAM,aAAa,MAAM;CAEzB,MAAM,UAAU,OADJ,QAAQ,aAAa,UAAU,SAAS;CAGpD,MAAM,UAAU,QAAQ,IAAI,gBAAgB,MAAM;AAClD,KAAI,WAAW,WAAW,QAAQ,CAChC,QAAO;CAGT,MAAM,WAAW,eAAe;AAChC,WAAU,UAAU,EAAE,WAAW,MAAM,CAAC;CACxC,MAAM,YAAY,KAAK,UAAU,QAAQ;AACzC,KAAI,WAAW,UAAU,CAAE,QAAO;CAElC,MAAM,UAAU,KAAK,QAAQ,EAAE,aAAa,YAAY,EAAE,CAAC,SAAS,MAAM,GAAG;AAC7E,WAAU,SAAS,EAAE,WAAW,MAAM,CAAC;CACvC,MAAM,EAAE,UAAU,MAAM,WAAW,kBAAkB;CAErD,MAAM,cAAc,KAAK,SAAS,OADf,4BAA4B,SACI,GAAG;CAEtD,MAAM,OAAO,kBAAkB;CAC/B,IAAI;AACJ,KAAI;AACF,OAAK,MAAM,OAAO,KAChB,KAAI;AACF,OAAI,KAAK,EAAE,KAAK,EAAE,mBAAmB;AACrC,SAAM,eAAe,KAAK,aAAa,WAAW;AAClD,gBAAa;IAAE,OAAO;IAAc;IAAK,eAAe;IAAG,YAAY;IAAM,SAAS;IAAM,CAAC;AAC7F,SAAM,8BACJ,aACA,WACA,QACA,yBAAyB,SAAS,CACnC;AACD,OAAI,QAAQ,aAAa,QAAS,WAAU,WAAW,IAAM;AAC7D,UAAO;WACA,KAAK;AACZ,aAAU;AACV,OAAI,KAAK;IAAE;IAAK;IAAK,EAAE,+BAA+B;;WAGlD;AACR,SAAO,SAAS;GAAE,WAAW;GAAM,OAAO;GAAM,CAAC;;AAGnD,OAAM,IAAI,MACR,4BAA4B,aAAa,OAAO,SAAS,GAAG,KAAK,IAAI,mBAAmB,QAAQ,QAAQ,UAAU,OAAO,QAAQ,GAClI"}

package/dist/src/tunnel/frpc-config.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"frpc-config.js","names":[],"sources":["../../../src/tunnel/frpc-config.ts"],"sourcesContent":["import { mkdirSync, writeFileSync } from 'node:fs';\nimport { join } from 'node:path';\n\nimport { resolveStateDir } from '../config/paths.js';\nimport type { TunnelRegistration } from './tunnel-types.js';\n\nexport function resolveFrpcConfigPath(tunnelId: string): string {\n  const tmpDir = join(resolveStateDir(), 'tmp');\n  mkdirSync(tmpDir, { recursive: true });\n  return join(tmpDir, `frpc-${tunnelId}.toml`);\n}\n\nexport function writeFrpcConfig(\n  registration: TunnelRegistration,\n  localPort: number,\n  localHost = '127.0.0.1',\n  mode: 'http' | 'https' = 'http',\n): string {\n  const configPath = resolveFrpcConfigPath(registration.tunnelId);\n  const { frpc } = registration;\n  const toml = `# Auto-generated by xopc — do not edit\nserverAddr = \"${frpc.serverAddr}\"\nserverPort = ${frpc.serverPort}\nmetadatas.token = \"${frpc.authToken}\"\n\nloginFailExit = false\ntransport.heartbeatInterval = 10\ntransport.heartbeatTimeout = 30\n\n[[proxies]]\nname = \"${frpc.proxyName}\"\ntype = \"${mode}\"\nlocalIP = \"${localHost}\"\nlocalPort = ${localPort}\nsubdomain = \"${registration.subdomain}\"\n`;\n  writeFileSync(configPath, toml, 'utf8');\n  return configPath;\n}\n"],"mappings":";;;;;YAGqD;AAGrD,SAAgB,sBAAsB,UAA0B;CAC9D,MAAM,SAAS,KAAK,iBAAiB,EAAE,MAAM;AAC7C,WAAU,QAAQ,EAAE,WAAW,MAAM,CAAC;AACtC,QAAO,KAAK,QAAQ,QAAQ,SAAS,OAAO;;AAG9C,SAAgB,gBACd,cACA,WACA,YAAY,aACZ,OAAyB,QACjB;CACR,MAAM,aAAa,sBAAsB,aAAa,SAAS;CAC/D,MAAM,EAAE,SAAS;AAiBjB,eAAc,YAAY;gBAfZ,KAAK,WAAW;eACjB,KAAK,WAAW;qBACV,KAAK,UAAU;;;;;;;UAO1B,KAAK,UAAU;UACf,KAAK;aACF,UAAU;cACT,UAAU;eACT,aAAa,UAAU;GAEJ,OAAO;AACvC,QAAO"}

package/dist/src/tunnel/frpc-extract.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"frpc-extract.js","names":[],"sources":["../../../src/tunnel/frpc-extract.ts"],"sourcesContent":["import { spawn } from 'node:child_process';\nimport {\n  existsSync,\n  mkdirSync,\n  readFileSync,\n  rmSync,\n  writeFileSync,\n} from 'node:fs';\nimport { dirname, join } from 'node:path';\nimport { gunzipSync } from 'node:zlib';\n\nimport AdmZip from 'adm-zip';\n\nimport { createLogger } from '../utils/logger.js';\n\nconst log = createLogger('TunnelFrpcExtract');\n\nexport type FrpcReleasePlatform = 'darwin' | 'linux' | 'windows';\n\nexport function buildFrpcArchiveMemberPath(folder: string, platform: NodeJS.Platform): string {\n  const ext = platform === 'win32' ? '.exe' : '';\n  return `${folder}/frpc${ext}`.replace(/\\\\/g, '/');\n}\n\nexport function frpcReleaseArchiveExtension(frpPlatform: FrpcReleasePlatform): '.zip' | '.tar.gz' {\n  return frpPlatform === 'windows' ? '.zip' : '.tar.gz';\n}\n\nexport function nodePlatformForFrpTarget(frpPlatform: FrpcReleasePlatform): NodeJS.Platform {\n  if (frpPlatform === 'windows') return 'win32';\n  if (frpPlatform === 'darwin') return 'darwin';\n  return 'linux';\n}\n\n/** Resolve on-disk path after system tar extracts a POSIX member path. */\nexport function resolveExtractedMemberPath(extractDir: string, memberPath: string): string {\n  return join(extractDir, ...memberPath.replace(/\\\\/g, '/').split('/'));\n}\n\nfunction readTarField(header: Buffer, offset: number, length: number): string {\n  return header.subarray(offset, offset + length).toString('utf8').replace(/\\0.*$/, '').trim();\n}\n\nfunction parseTarEntryName(header: Buffer): string {\n  let name = readTarField(header, 0, 100);\n  const prefix = readTarField(header, 345, 155);\n  if (prefix) name = `${prefix}/${name}`;\n  return name.replace(/\\\\/g, '/').replace(/^\\.\\//, '');\n}\n\nfunction parseTarSize(header: Buffer): number {\n  const raw = readTarField(header, 124, 12);\n  if (!raw) return 0;\n  return parseInt(raw, 8) || 0;\n}\n\n/** Pure Node tar.gz member extract — no system `tar` (Windows / minimal Linux). */\nexport function extractTarGzMemberNode(\n  archivePath: string,\n  memberPath: string,\n  destPath: string,\n): void {\n  const target = memberPath.replace(/\\\\/g, '/').replace(/^\\.\\//, '');\n  const tar = gunzipSync(readFileSync(archivePath));\n\n  let offset = 0;\n  while (offset + 512 <= tar.length) {\n    const header = tar.subarray(offset, offset + 512);\n    if (header.every((b) => b === 0)) break;\n\n    const name = parseTarEntryName(header);\n    const size = parseTarSize(header);\n    offset += 512;\n\n    if (size < 0 || offset + size > tar.length) {\n      throw new Error('Corrupt tar archive');\n    }\n\n    const content = tar.subarray(offset, offset + size);\n    offset += size;\n    offset += (512 - (size % 512)) % 512;\n\n    if (name === target) {\n      mkdirSync(dirname(destPath), { recursive: true });\n      writeFileSync(destPath, content);\n      return;\n    }\n  }\n\n  throw new Error(`Archive missing expected path: ${target}`);\n}\n\nasync function extractTarGzMemberSystemTar(\n  archivePath: string,\n  memberPath: string,\n  destPath: string,\n  extractDir: string,\n): Promise<void> {\n  mkdirSync(extractDir, { recursive: true });\n  await new Promise<void>((resolve, reject) => {\n    let stderr = '';\n    const child = spawn('tar', ['xzf', archivePath, '-C', extractDir, memberPath], {\n      stdio: ['ignore', 'ignore', 'pipe'],\n    });\n    child.stderr?.on('data', (chunk: Buffer) => {\n      stderr += chunk.toString('utf8');\n    });\n    child.on('error', reject);\n    child.on('exit', (code) => {\n      if (code === 0) resolve();\n      else {\n        const detail = stderr.trim();\n        reject(\n          new Error(`tar exited with code ${code ?? 'unknown'}${detail ? `: ${detail}` : ''}`),\n        );\n      }\n    });\n  });\n\n  const extracted = resolveExtractedMemberPath(extractDir, memberPath);\n  if (!existsSync(extracted)) {\n    throw new Error(`Archive missing expected path: ${memberPath}`);\n  }\n\n  mkdirSync(dirname(destPath), { recursive: true });\n  writeFileSync(destPath, readFileSync(extracted));\n}\n\n/** Extract frpc from a Windows release zip (upstream publishes `.zip`, not `.tar.gz`). */\nexport function extractFrpcFromZipArchive(\n  archivePath: string,\n  destBin: string,\n  folder: string,\n  platform: NodeJS.Platform = process.platform,\n): void {\n  const memberPath = buildFrpcArchiveMemberPath(folder, platform);\n  const zip = new AdmZip(archivePath);\n  const entry = zip.getEntry(memberPath);\n  if (!entry || entry.isDirectory) {\n    throw new Error(`Archive missing expected path: ${memberPath}`);\n  }\n\n  mkdirSync(dirname(destBin), { recursive: true });\n  writeFileSync(destBin, entry.getData());\n  log.debug({ memberPath, method: 'adm-zip' }, 'Extracted frpc from archive');\n}\n\n/** Route to zip or tar.gz extraction based on archive extension. */\nexport async function extractFrpcFromReleaseArchive(\n  archivePath: string,\n  destBin: string,\n  folder: string,\n  platform: NodeJS.Platform = process.platform,\n): Promise<void> {\n  if (archivePath.endsWith('.zip')) {\n    extractFrpcFromZipArchive(archivePath, destBin, folder, platform);\n    return;\n  }\n  await extractFrpcFromTarGzArchive(archivePath, destBin, folder, platform);\n}\n\n/**\n * Extract frpc from a release tarball.\n * Tries system `tar` first; falls back to built-in Node parser (macOS BSD tar quirks, Windows without tar, etc.).\n */\nexport async function extractFrpcFromTarGzArchive(\n  archivePath: string,\n  destBin: string,\n  folder: string,\n  platform: NodeJS.Platform = process.platform,\n): Promise<void> {\n  const memberPath = buildFrpcArchiveMemberPath(folder, platform);\n  const extractDir = join(dirname(destBin), `_frpc-extract-${process.pid}-${Date.now()}`);\n  let systemErr: unknown;\n\n  try {\n    await extractTarGzMemberSystemTar(archivePath, memberPath, destBin, extractDir);\n    log.debug({ memberPath, method: 'system-tar' }, 'Extracted frpc from archive');\n    return;\n  } catch (err) {\n    systemErr = err;\n    log.debug(\n      { err, memberPath, phase: 'frpc_extract_system_tar' },\n      'System tar extract failed — trying Node fallback',\n    );\n  } finally {\n    rmSync(extractDir, { recursive: true, force: true });\n  }\n\n  try {\n    extractTarGzMemberNode(archivePath, memberPath, destBin);\n    log.debug({ memberPath, method: 'node-tar' }, 'Extracted frpc from archive');\n  } catch (nodeErr) {\n    const systemEm = systemErr instanceof Error ? systemErr.message : String(systemErr);\n    const nodeEm = nodeErr instanceof Error ? nodeErr.message : String(nodeErr);\n    throw new Error(`Failed to extract ${memberPath}: ${nodeEm} (system tar: ${systemEm})`);\n  }\n}\n"],"mappings":";;;;;;;;aAakD;AAElD,MAAM,MAAM,aAAa,oBAAoB;AAI7C,SAAgB,2BAA2B,QAAgB,UAAmC;AAE5F,QAAO,GAAG,OAAO,OADL,aAAa,UAAU,SAAS,KACd,QAAQ,OAAO,IAAI;;AAGnD,SAAgB,4BAA4B,aAAsD;AAChG,QAAO,gBAAgB,YAAY,SAAS;;AAG9C,SAAgB,yBAAyB,aAAmD;AAC1F,KAAI,gBAAgB,UAAW,QAAO;AACtC,KAAI,gBAAgB,SAAU,QAAO;AACrC,QAAO;;;AAIT,SAAgB,2BAA2B,YAAoB,YAA4B;AACzF,QAAO,KAAK,YAAY,GAAG,WAAW,QAAQ,OAAO,IAAI,CAAC,MAAM,IAAI,CAAC;;AAGvE,SAAS,aAAa,QAAgB,QAAgB,QAAwB;AAC5E,QAAO,OAAO,SAAS,QAAQ,SAAS,OAAO,CAAC,SAAS,OAAO,CAAC,QAAQ,SAAS,GAAG,CAAC,MAAM;;AAG9F,SAAS,kBAAkB,QAAwB;CACjD,IAAI,OAAO,aAAa,QAAQ,GAAG,IAAI;CACvC,MAAM,SAAS,aAAa,QAAQ,KAAK,IAAI;AAC7C,KAAI,OAAQ,QAAO,GAAG,OAAO,GAAG;AAChC,QAAO,KAAK,QAAQ,OAAO,IAAI,CAAC,QAAQ,SAAS,GAAG;;AAGtD,SAAS,aAAa,QAAwB;CAC5C,MAAM,MAAM,aAAa,QAAQ,KAAK,GAAG;AACzC,KAAI,CAAC,IAAK,QAAO;AACjB,QAAO,SAAS,KAAK,EAAE,IAAI;;;AAI7B,SAAgB,uBACd,aACA,YACA,UACM;CACN,MAAM,SAAS,WAAW,QAAQ,OAAO,IAAI,CAAC,QAAQ,SAAS,GAAG;CAClE,MAAM,MAAM,WAAW,aAAa,YAAY,CAAC;CAEjD,IAAI,SAAS;AACb,QAAO,SAAS,OAAO,IAAI,QAAQ;EACjC,MAAM,SAAS,IAAI,SAAS,QAAQ,SAAS,IAAI;AACjD,MAAI,OAAO,OAAO,MAAM,MAAM,EAAE,CAAE;EAElC,MAAM,OAAO,kBAAkB,OAAO;EACtC,MAAM,OAAO,aAAa,OAAO;AACjC,YAAU;AAEV,MAAI,OAAO,KAAK,SAAS,OAAO,IAAI,OAClC,OAAM,IAAI,MAAM,sBAAsB;EAGxC,MAAM,UAAU,IAAI,SAAS,QAAQ,SAAS,KAAK;AACnD,YAAU;AACV,aAAW,MAAO,OAAO,OAAQ;AAEjC,MAAI,SAAS,QAAQ;AACnB,aAAU,QAAQ,SAAS,EAAE,EAAE,WAAW,MAAM,CAAC;AACjD,iBAAc,UAAU,QAAQ;AAChC;;;AAIJ,OAAM,IAAI,MAAM,kCAAkC,SAAS;;AAG7D,eAAe,4BACb,aACA,YACA,UACA,YACe;AACf,WAAU,YAAY,EAAE,WAAW,MAAM,CAAC;AAC1C,OAAM,IAAI,SAAe,SAAS,WAAW;EAC3C,IAAI,SAAS;EACb,MAAM,QAAQ,MAAM,OAAO;GAAC;GAAO;GAAa;GAAM;GAAY;GAAW,EAAE,EAC7E,OAAO;GAAC;GAAU;GAAU;GAAO,EACpC,CAAC;AACF,QAAM,QAAQ,GAAG,SAAS,UAAkB;AAC1C,aAAU,MAAM,SAAS,OAAO;IAChC;AACF,QAAM,GAAG,SAAS,OAAO;AACzB,QAAM,GAAG,SAAS,SAAS;AACzB,OAAI,SAAS,EAAG,UAAS;QACpB;IACH,MAAM,SAAS,OAAO,MAAM;AAC5B,2BACE,IAAI,MAAM,wBAAwB,QAAQ,YAAY,SAAS,KAAK,WAAW,KAAK,CACrF;;IAEH;GACF;CAEF,MAAM,YAAY,2BAA2B,YAAY,WAAW;AACpE,KAAI,CAAC,WAAW,UAAU,CACxB,OAAM,IAAI,MAAM,kCAAkC,aAAa;AAGjE,WAAU,QAAQ,SAAS,EAAE,EAAE,WAAW,MAAM,CAAC;AACjD,eAAc,UAAU,aAAa,UAAU,CAAC;;;AAIlD,SAAgB,0BACd,aACA,SACA,QACA,WAA4B,QAAQ,UAC9B;CACN,MAAM,aAAa,2BAA2B,QAAQ,SAAS;CAE/D,MAAM,QAAQ,IADE,OAAO,YACN,CAAC,SAAS,WAAW;AACtC,KAAI,CAAC,SAAS,MAAM,YAClB,OAAM,IAAI,MAAM,kCAAkC,aAAa;AAGjE,WAAU,QAAQ,QAAQ,EAAE,EAAE,WAAW,MAAM,CAAC;AAChD,eAAc,SAAS,MAAM,SAAS,CAAC;AACvC,KAAI,MAAM;EAAE;EAAY,QAAQ;EAAW,EAAE,8BAA8B;;;AAI7E,eAAsB,8BACpB,aACA,SACA,QACA,WAA4B,QAAQ,UACrB;AACf,KAAI,YAAY,SAAS,OAAO,EAAE;AAChC,4BAA0B,aAAa,SAAS,QAAQ,SAAS;AACjE;;AAEF,OAAM,4BAA4B,aAAa,SAAS,QAAQ,SAAS;;;;;;AAO3E,eAAsB,4BACpB,aACA,SACA,QACA,WAA4B,QAAQ,UACrB;CACf,MAAM,aAAa,2BAA2B,QAAQ,SAAS;CAC/D,MAAM,aAAa,KAAK,QAAQ,QAAQ,EAAE,iBAAiB,QAAQ,IAAI,GAAG,KAAK,KAAK,GAAG;CACvF,IAAI;AAEJ,KAAI;AACF,QAAM,4BAA4B,aAAa,YAAY,SAAS,WAAW;AAC/E,MAAI,MAAM;GAAE;GAAY,QAAQ;GAAc,EAAE,8BAA8B;AAC9E;UACO,KAAK;AACZ,cAAY;AACZ,MAAI,MACF;GAAE;GAAK;GAAY,OAAO;GAA2B,EACrD,mDACD;WACO;AACR,SAAO,YAAY;GAAE,WAAW;GAAM,OAAO;GAAM,CAAC;;AAGtD,KAAI;AACF,yBAAuB,aAAa,YAAY,QAAQ;AACxD,MAAI,MAAM;GAAE;GAAY,QAAQ;GAAY,EAAE,8BAA8B;UACrE,SAAS;EAChB,MAAM,WAAW,qBAAqB,QAAQ,UAAU,UAAU,OAAO,UAAU;EACnF,MAAM,SAAS,mBAAmB,QAAQ,QAAQ,UAAU,OAAO,QAAQ;AAC3E,QAAM,IAAI,MAAM,qBAAqB,WAAW,IAAI,OAAO,gBAAgB,SAAS,GAAG"}

package/dist/src/tunnel/frpc-process.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"frpc-process.js","names":[],"sources":["../../../src/tunnel/frpc-process.ts"],"sourcesContent":["import { type ChildProcess, spawn } from 'node:child_process';\n\nimport { createLogger } from '../utils/logger.js';\n\nconst log = createLogger('TunnelFrpc');\n\nexport type FrpcProcessHandle = {\n  pid: number;\n  waitForLoginSuccess: Promise<void>;\n  onExit: (handler: (code: number | null, signal: NodeJS.Signals | null) => void) => void;\n  kill: (signal?: NodeJS.Signals) => Promise<void>;\n};\n\nconst LOGIN_SUCCESS_RE = /login to server success/i;\nconst RECONNECT_SUCCESS_RE = /reconnect success/i;\n\nexport function spawnFrpcProcess(frpcBin: string, configPath: string): FrpcProcessHandle {\n  const child: ChildProcess = spawn(frpcBin, ['-c', configPath], {\n    stdio: ['ignore', 'pipe', 'pipe'],\n  });\n\n  let loginResolve: (() => void) | undefined;\n  let loginReject: ((err: Error) => void) | undefined;\n  const waitForLoginSuccess = new Promise<void>((resolve, reject) => {\n    loginResolve = resolve;\n    loginReject = reject;\n    setTimeout(() => reject(new Error('frpc login timeout')), 60_000);\n  });\n\n  const exitHandlers: Array<(code: number | null, signal: NodeJS.Signals | null) => void> = [];\n\n  const onLine = (line: string) => {\n    if (LOGIN_SUCCESS_RE.test(line) || RECONNECT_SUCCESS_RE.test(line)) {\n      loginResolve?.();\n      loginResolve = undefined;\n      loginReject = undefined;\n    }\n  };\n\n  child.stdout?.on('data', (chunk: Buffer) => {\n    for (const line of chunk.toString('utf8').split('\\n')) {\n      if (line.trim()) log.debug({ line: line.trim() }, 'frpc stdout');\n      onLine(line);\n    }\n  });\n  child.stderr?.on('data', (chunk: Buffer) => {\n    for (const line of chunk.toString('utf8').split('\\n')) {\n      if (line.trim()) log.debug({ line: line.trim() }, 'frpc stderr');\n      onLine(line);\n    }\n  });\n\n  child.on('error', (err) => {\n    loginReject?.(err);\n    loginResolve = undefined;\n    loginReject = undefined;\n  });\n\n  child.on('exit', (code, signal) => {\n    for (const h of exitHandlers) h(code, signal);\n  });\n\n  if (!child.pid) {\n    throw new Error('Failed to spawn frpc process');\n  }\n\n  return {\n    pid: child.pid,\n    waitForLoginSuccess,\n    onExit: (handler) => {\n      exitHandlers.push(handler);\n    },\n    kill: async (signal = 'SIGTERM') => {\n      if (!child.pid || child.killed) return;\n      child.kill(signal);\n      await new Promise<void>((resolve) => {\n        const t = setTimeout(() => {\n          if (!child.killed) child.kill('SIGKILL');\n          resolve();\n        }, 3000);\n        child.once('exit', () => {\n          clearTimeout(t);\n          resolve();\n        });\n      });\n    },\n  };\n}\n"],"mappings":";;;;aAEkD;AAElD,MAAM,MAAM,aAAa,aAAa;AAStC,MAAM,mBAAmB;AACzB,MAAM,uBAAuB;AAE7B,SAAgB,iBAAiB,SAAiB,YAAuC;CACvF,MAAM,QAAsB,MAAM,SAAS,CAAC,MAAM,WAAW,EAAE,EAC7D,OAAO;EAAC;EAAU;EAAQ;EAAO,EAClC,CAAC;CAEF,IAAI;CACJ,IAAI;CACJ,MAAM,sBAAsB,IAAI,SAAe,SAAS,WAAW;AACjE,iBAAe;AACf,gBAAc;AACd,mBAAiB,uBAAO,IAAI,MAAM,qBAAqB,CAAC,EAAE,IAAO;GACjE;CAEF,MAAM,eAAoF,EAAE;CAE5F,MAAM,UAAU,SAAiB;AAC/B,MAAI,iBAAiB,KAAK,KAAK,IAAI,qBAAqB,KAAK,KAAK,EAAE;AAClE,mBAAgB;AAChB,kBAAe,KAAA;AACf,iBAAc,KAAA;;;AAIlB,OAAM,QAAQ,GAAG,SAAS,UAAkB;AAC1C,OAAK,MAAM,QAAQ,MAAM,SAAS,OAAO,CAAC,MAAM,KAAK,EAAE;AACrD,OAAI,KAAK,MAAM,CAAE,KAAI,MAAM,EAAE,MAAM,KAAK,MAAM,EAAE,EAAE,cAAc;AAChE,UAAO,KAAK;;GAEd;AACF,OAAM,QAAQ,GAAG,SAAS,UAAkB;AAC1C,OAAK,MAAM,QAAQ,MAAM,SAAS,OAAO,CAAC,MAAM,KAAK,EAAE;AACrD,OAAI,KAAK,MAAM,CAAE,KAAI,MAAM,EAAE,MAAM,KAAK,MAAM,EAAE,EAAE,cAAc;AAChE,UAAO,KAAK;;GAEd;AAEF,OAAM,GAAG,UAAU,QAAQ;AACzB,gBAAc,IAAI;AAClB,iBAAe,KAAA;AACf,gBAAc,KAAA;GACd;AAEF,OAAM,GAAG,SAAS,MAAM,WAAW;AACjC,OAAK,MAAM,KAAK,aAAc,GAAE,MAAM,OAAO;GAC7C;AAEF,KAAI,CAAC,MAAM,IACT,OAAM,IAAI,MAAM,+BAA+B;AAGjD,QAAO;EACL,KAAK,MAAM;EACX;EACA,SAAS,YAAY;AACnB,gBAAa,KAAK,QAAQ;;EAE5B,MAAM,OAAO,SAAS,cAAc;AAClC,OAAI,CAAC,MAAM,OAAO,MAAM,OAAQ;AAChC,SAAM,KAAK,OAAO;AAClB,SAAM,IAAI,SAAe,YAAY;IACnC,MAAM,IAAI,iBAAiB;AACzB,SAAI,CAAC,MAAM,OAAQ,OAAM,KAAK,UAAU;AACxC,cAAS;OACR,IAAK;AACR,UAAM,KAAK,cAAc;AACvB,kBAAa,EAAE;AACf,cAAS;MACT;KACF;;EAEL"}

package/dist/src/tunnel/gateway-lifecycle.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"gateway-lifecycle.js","names":[],"sources":["../../../src/tunnel/gateway-lifecycle.ts"],"sourcesContent":["import type { Config } from '../config/schema.js';\nimport { resolveGatewayEffectiveHost } from '../config/gateway-bind.js';\nimport { createLogger } from '../utils/logger.js';\nimport { hasValidTunnelConsent } from './consent.js';\nimport { resolveTunnelBrokerUrl, resolveTunnelRegistrationSecret } from './env.js';\nimport { getTunnelService } from './tunnel-service.js';\nimport { resolveFrpSubdomainHost } from './frp-subdomain-host.js';\nimport { fetchTunnelWellKnown } from './well-known.js';\n\nconst log = createLogger('Tunnel');\n\ntype TunnelEventSink = { emit(type: string, payload: unknown): void };\n\nlet tunnelSseWired = false;\n\n/** Publish `tunnel.status` on gateway SSE when tunnel lifecycle changes. */\nexport function wireTunnelEventsToGateway(service: TunnelEventSink): void {\n  if (tunnelSseWired) return;\n  tunnelSseWired = true;\n\n  const tunnel = getTunnelService();\n  const publish = () => {\n    service.emit('tunnel.status', tunnel.getStatus());\n  };\n\n  tunnel.on('tunnel:connecting', publish);\n  tunnel.on('tunnel:connected', publish);\n  tunnel.on('tunnel:disconnected', publish);\n  tunnel.on('tunnel:error', publish);\n  tunnel.on('tunnel:progress', publish);\n}\n\nexport type ConfigureTunnelFromGatewayConfigOptions = {\n  force?: boolean;\n  deferWellKnownFetch?: boolean;\n};\n\nfunction applyTunnelServiceFromGatewayConfig(config: Config, brokerUrl: string): void {\n  let registrationSecret: string;\n  try {\n    registrationSecret = resolveTunnelRegistrationSecret(\n      process.env,\n      brokerUrl,\n      config.tunnel?.registrationSecret,\n    );\n  } catch (err) {\n    const em = err instanceof Error ? err.message : String(err);\n    log.warn({ phase: 'tunnel_configure', errorMessage: em }, em);\n    throw err;\n  }\n\n  getTunnelService().configure({\n    brokerUrl,\n    registrationSecret,\n    autoStart: config.tunnel?.autoStart ?? false,\n    gatewayHost: resolveGatewayEffectiveHost(config),\n    frpSubdomainHost: resolveFrpSubdomainHost(brokerUrl),\n  });\n}\n\nasync function resolveBrokerUrlFromWellKnown(initialBrokerUrl: string): Promise<string> {\n  let brokerUrl = initialBrokerUrl;\n  try {\n    const wellKnown = await fetchTunnelWellKnown(brokerUrl);\n    if (wellKnown.brokerUrl?.trim()) {\n      brokerUrl = wellKnown.brokerUrl.trim();\n    }\n    if (wellKnown.transport?.tls === 'broker_terminated') {\n      log.debug({ brokerUrl, phase: 'tunnel_well_known' }, 'Broker uses wildcard TLS termination');\n    } else if (wellKnown.transport?.tls) {\n      log.warn(\n        { tls: wellKnown.transport.tls, phase: 'tunnel_well_known' },\n        'Unexpected broker transport mode — expect broker_terminated',\n      );\n    }\n  } catch (err) {\n    log.debug(\n      { err, brokerUrl, phase: 'tunnel_well_known' },\n      'Tunnel well-known fetch skipped (using config/env broker URL)',\n    );\n  }\n  return brokerUrl;\n}\n\nlet deferredWellKnownRefresh: Promise<void> | null = null;\n\nfunction scheduleDeferredWellKnownRefresh(config: Config, initialBrokerUrl: string): void {\n  if (deferredWellKnownRefresh) return;\n\n  deferredWellKnownRefresh = resolveBrokerUrlFromWellKnown(initialBrokerUrl)\n    .then((resolvedBrokerUrl) => {\n      if (resolvedBrokerUrl === initialBrokerUrl) return;\n      applyTunnelServiceFromGatewayConfig(config, resolvedBrokerUrl);\n    })\n    .catch((err) => {\n      const em = err instanceof Error ? err.message : String(err);\n      log.warn(\n        { err, phase: 'tunnel_well_known_deferred', errorMessage: em },\n        `Deferred tunnel well-known refresh failed: ${em}`,\n      );\n    })\n    .finally(() => {\n      deferredWellKnownRefresh = null;\n    });\n}\n\nexport async function configureTunnelFromGatewayConfig(\n  config: Config,\n  opts?: ConfigureTunnelFromGatewayConfigOptions,\n): Promise<void> {\n  if (!opts?.force && !config.tunnel?.enabled) return;\n\n  const initialBrokerUrl = resolveTunnelBrokerUrl(config.tunnel?.brokerUrl);\n\n  if (opts?.deferWellKnownFetch) {\n    applyTunnelServiceFromGatewayConfig(config, initialBrokerUrl);\n    scheduleDeferredWellKnownRefresh(config, initialBrokerUrl);\n    return;\n  }\n\n  if (deferredWellKnownRefresh) {\n    await deferredWellKnownRefresh;\n  }\n\n  const brokerUrl = await resolveBrokerUrlFromWellKnown(initialBrokerUrl);\n  applyTunnelServiceFromGatewayConfig(config, brokerUrl);\n}\n\nexport async function maybeAutoStartTunnelFromConfig(\n  config: Config,\n  gatewayToken: string | undefined,\n): Promise<void> {\n  if (!config.tunnel?.autoStart) return;\n\n  if (!hasValidTunnelConsent(config)) {\n    log.warn(\n      { phase: 'tunnel_autostart', consentVersion: config.tunnel?.consent?.version ?? null },\n      'tunnel.autoStart skipped: security consent required or outdated',\n    );\n    return;\n  }\n\n  if (config.tunnel.enabled !== true) {\n    log.debug(\n      { phase: 'tunnel_autostart' },\n      'tunnel.autoStart skipped: tunnel.enabled is false (start remote access once)',\n    );\n    return;\n  }\n\n  const gateway = config.gateway ?? {};\n  const port = gateway.port ?? 18790;\n  const host = resolveGatewayEffectiveHost(config);\n\n  await configureTunnelFromGatewayConfig(config);\n\n  if (!gatewayToken) {\n    log.warn(\n      { phase: 'tunnel_autostart' },\n      'tunnel.autoStart is enabled but gateway auth token is unavailable (auth mode may be none)',\n    );\n    return;\n  }\n\n  const tunnel = getTunnelService();\n  const { state } = tunnel.getStatus();\n  if (state === 'connected' || state === 'connecting' || state === 'reconnecting') {\n    log.debug({ phase: 'tunnel_autostart', state }, 'Tunnel already active — skip autostart');\n    return;\n  }\n\n  try {\n    await tunnel.start(port, gatewayToken);\n    log.info(\n      { phase: 'tunnel_autostart', host, port },\n      'Tunnel auto-started after gateway HTTP listen',\n    );\n  } catch (err) {\n    const em = err instanceof Error ? err.message : String(err);\n    log.error({ err, phase: 'tunnel_autostart', errorMessage: em }, `Tunnel autostart failed: ${em}`);\n  }\n}\n"],"mappings":";;;;;;;;;aAEkD;AAOlD,MAAM,MAAM,aAAa,SAAS;AAIlC,IAAI,iBAAiB;;AAGrB,SAAgB,0BAA0B,SAAgC;AACxE,KAAI,eAAgB;AACpB,kBAAiB;CAEjB,MAAM,SAAS,kBAAkB;CACjC,MAAM,gBAAgB;AACpB,UAAQ,KAAK,iBAAiB,OAAO,WAAW,CAAC;;AAGnD,QAAO,GAAG,qBAAqB,QAAQ;AACvC,QAAO,GAAG,oBAAoB,QAAQ;AACtC,QAAO,GAAG,uBAAuB,QAAQ;AACzC,QAAO,GAAG,gBAAgB,QAAQ;AAClC,QAAO,GAAG,mBAAmB,QAAQ;;AAQvC,SAAS,oCAAoC,QAAgB,WAAyB;CACpF,IAAI;AACJ,KAAI;AACF,uBAAqB,gCACnB,QAAQ,KACR,WACA,OAAO,QAAQ,mBAChB;UACM,KAAK;EACZ,MAAM,KAAK,eAAe,QAAQ,IAAI,UAAU,OAAO,IAAI;AAC3D,MAAI,KAAK;GAAE,OAAO;GAAoB,cAAc;GAAI,EAAE,GAAG;AAC7D,QAAM;;AAGR,mBAAkB,CAAC,UAAU;EAC3B;EACA;EACA,WAAW,OAAO,QAAQ,aAAa;EACvC,aAAa,4BAA4B,OAAO;EAChD,kBAAkB,wBAAwB,UAAU;EACrD,CAAC;;AAGJ,eAAe,8BAA8B,kBAA2C;CACtF,IAAI,YAAY;AAChB,KAAI;EACF,MAAM,YAAY,MAAM,qBAAqB,UAAU;AACvD,MAAI,UAAU,WAAW,MAAM,CAC7B,aAAY,UAAU,UAAU,MAAM;AAExC,MAAI,UAAU,WAAW,QAAQ,oBAC/B,KAAI,MAAM;GAAE;GAAW,OAAO;GAAqB,EAAE,uCAAuC;WACnF,UAAU,WAAW,IAC9B,KAAI,KACF;GAAE,KAAK,UAAU,UAAU;GAAK,OAAO;GAAqB,EAC5D,8DACD;UAEI,KAAK;AACZ,MAAI,MACF;GAAE;GAAK;GAAW,OAAO;GAAqB,EAC9C,gEACD;;AAEH,QAAO;;AAGT,IAAI,2BAAiD;AAErD,SAAS,iCAAiC,QAAgB,kBAAgC;AACxF,KAAI,yBAA0B;AAE9B,4BAA2B,8BAA8B,iBAAiB,CACvE,MAAM,sBAAsB;AAC3B,MAAI,sBAAsB,iBAAkB;AAC5C,sCAAoC,QAAQ,kBAAkB;GAC9D,CACD,OAAO,QAAQ;EACd,MAAM,KAAK,eAAe,QAAQ,IAAI,UAAU,OAAO,IAAI;AAC3D,MAAI,KACF;GAAE;GAAK,OAAO;GAA8B,cAAc;GAAI,EAC9D,8CAA8C,KAC/C;GACD,CACD,cAAc;AACb,6BAA2B;GAC3B;;AAGN,eAAsB,iCACpB,QACA,MACe;AACf,KAAI,CAAC,MAAM,SAAS,CAAC,OAAO,QAAQ,QAAS;CAE7C,MAAM,mBAAmB,uBAAuB,OAAO,QAAQ,UAAU;AAEzE,KAAI,MAAM,qBAAqB;AAC7B,sCAAoC,QAAQ,iBAAiB;AAC7D,mCAAiC,QAAQ,iBAAiB;AAC1D;;AAGF,KAAI,yBACF,OAAM;AAIR,qCAAoC,QAAQ,MADpB,8BAA8B,iBAAiB,CACjB;;AAGxD,eAAsB,+BACpB,QACA,cACe;AACf,KAAI,CAAC,OAAO,QAAQ,UAAW;AAE/B,KAAI,CAAC,sBAAsB,OAAO,EAAE;AAClC,MAAI,KACF;GAAE,OAAO;GAAoB,gBAAgB,OAAO,QAAQ,SAAS,WAAW;GAAM,EACtF,kEACD;AACD;;AAGF,KAAI,OAAO,OAAO,YAAY,MAAM;AAClC,MAAI,MACF,EAAE,OAAO,oBAAoB,EAC7B,+EACD;AACD;;CAIF,MAAM,QADU,OAAO,WAAW,EAAE,EACf,QAAQ;CAC7B,MAAM,OAAO,4BAA4B,OAAO;AAEhD,OAAM,iCAAiC,OAAO;AAE9C,KAAI,CAAC,cAAc;AACjB,MAAI,KACF,EAAE,OAAO,oBAAoB,EAC7B,4FACD;AACD;;CAGF,MAAM,SAAS,kBAAkB;CACjC,MAAM,EAAE,UAAU,OAAO,WAAW;AACpC,KAAI,UAAU,eAAe,UAAU,gBAAgB,UAAU,gBAAgB;AAC/E,MAAI,MAAM;GAAE,OAAO;GAAoB;GAAO,EAAE,yCAAyC;AACzF;;AAGF,KAAI;AACF,QAAM,OAAO,MAAM,MAAM,aAAa;AACtC,MAAI,KACF;GAAE,OAAO;GAAoB;GAAM;GAAM,EACzC,gDACD;UACM,KAAK;EACZ,MAAM,KAAK,eAAe,QAAQ,IAAI,UAAU,OAAO,IAAI;AAC3D,MAAI,MAAM;GAAE;GAAK,OAAO;GAAoB,cAAc;GAAI,EAAE,4BAA4B,KAAK"}

package/dist/src/tunnel/pair-context.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"pair-context.js","names":[],"sources":["../../../src/tunnel/pair-context.ts"],"sourcesContent":["import type { Config } from '../config/schema.js';\nimport type { GatewayBindMode } from '../config/schema.js';\nimport {\n  isNetworkAccessibleBindHost,\n  resolveGatewayBindMode,\n  resolveGatewayEffectiveHost,\n} from '../config/gateway-bind.js';\nimport { normalizePublicUrlOrNull } from '../config/public-url.js';\nimport { enumerateLanGatewayCandidates } from './tunnel-qr.js';\nimport { buildMobileConnectUrlOrder } from './pair-url.js';\n\nexport type MobilePairCandidateKind = 'lan' | 'tunnel' | 'reverse-proxy';\n\nexport type MobilePairBlockReason = 'GATEWAY_LOOPBACK_ONLY' | 'NO_REACHABLE_URL';\n\nexport type MobilePairCandidate = {\n  kind: MobilePairCandidateKind;\n  url: string;\n  label?: string;\n  reachable: boolean;\n  note?: string;\n};\n\nexport type MobilePairContext = {\n  port: number;\n  bindMode: GatewayBindMode;\n  listenHost: string;\n  pairingReady: boolean;\n  blockReason?: MobilePairBlockReason;\n  candidates: MobilePairCandidate[];\n  recommended: {\n    mode: MobilePairCandidateKind | null;\n    url: string | null;\n  };\n  /** Ordered URLs for mobile clients (LAN first when available, then tunnel). */\n  connectUrls: string[];\n};\n\nexport function buildMobilePairContext(params: {\n  config: Config;\n  tunnelPublicUrl?: string | null;\n  tunnelConnected?: boolean;\n  /**\n   * Optional override for `gateway.publicUrl`. Falls back to the configured\n   * value when omitted; useful for transient candidates (e.g. UI auto-detect\n   * from `window.location.origin` before the user persists the value).\n   */\n  reverseProxyPublicUrl?: string | null;\n}): MobilePairContext {\n  const port = params.config.gateway?.port ?? 18790;\n  const bindMode = resolveGatewayBindMode(params.config);\n  const listenHost = resolveGatewayEffectiveHost(params.config);\n  const lanListenReady = isNetworkAccessibleBindHost(listenHost);\n\n  const lanEnumerated = enumerateLanGatewayCandidates(port);\n  const candidates: MobilePairCandidate[] = lanEnumerated.map((entry) => ({\n    kind: 'lan',\n    url: entry.url,\n    label: entry.interfaceName,\n    reachable: lanListenReady,\n    ...(lanListenReady ? {} : { note: 'requires_lan_bind' }),\n  }));\n\n  const tunnelUrl = params.tunnelPublicUrl?.trim() || null;\n  const tunnelConnected = params.tunnelConnected === true && Boolean(tunnelUrl);\n  if (tunnelConnected && tunnelUrl) {\n    candidates.unshift({\n      kind: 'tunnel',\n      url: tunnelUrl,\n      reachable: true,\n    });\n  }\n\n  const configuredReverseProxy = normalizePublicUrlOrNull(params.config.gateway?.publicUrl);\n  const reverseProxyUrl =\n    params.reverseProxyPublicUrl !== undefined\n      ? normalizePublicUrlOrNull(params.reverseProxyPublicUrl)\n      : configuredReverseProxy;\n  if (reverseProxyUrl) {\n    candidates.unshift({\n      kind: 'reverse-proxy',\n      url: reverseProxyUrl,\n      reachable: true,\n    });\n  }\n\n  let recommended: MobilePairContext['recommended'] = { mode: null, url: null };\n  if (reverseProxyUrl) {\n    recommended = { mode: 'reverse-proxy', url: reverseProxyUrl };\n  } else if (tunnelConnected && tunnelUrl) {\n    recommended = { mode: 'tunnel', url: tunnelUrl };\n  } else if (lanListenReady && lanEnumerated[0]) {\n    recommended = { mode: 'lan', url: lanEnumerated[0].url };\n  } else if (lanEnumerated[0]) {\n    recommended = { mode: 'lan', url: lanEnumerated[0].url };\n  }\n\n  const pairingReady = Boolean(\n    reverseProxyUrl || tunnelConnected || (lanListenReady && lanEnumerated.length > 0),\n  );\n\n  let blockReason: MobilePairBlockReason | undefined;\n  if (!pairingReady) {\n    blockReason =\n      !lanListenReady && !tunnelConnected ? 'GATEWAY_LOOPBACK_ONLY' : 'NO_REACHABLE_URL';\n  }\n\n  const lanUrlForConnect =\n    lanListenReady && lanEnumerated[0] ? lanEnumerated[0].url : null;\n  // When reverse-proxy or tunnel is active, LAN is the secondary candidate.\n  // When only LAN is available, lanUrl IS the baseUrl (don't duplicate it).\n  const hasUpstream = Boolean(reverseProxyUrl) || tunnelConnected;\n  const baseUrlForConnect = reverseProxyUrl\n    ? reverseProxyUrl\n    : tunnelConnected && tunnelUrl\n      ? tunnelUrl\n      : lanListenReady && recommended.url\n        ? recommended.url\n        : null;\n  const connectUrls = buildMobileConnectUrlOrder({\n    reverseProxyUrl,\n    baseUrl: baseUrlForConnect,\n    lanUrl: hasUpstream ? lanUrlForConnect : null,\n    tunnelUrl: tunnelConnected ? tunnelUrl : null,\n  });\n\n  return {\n    port,\n    bindMode,\n    listenHost,\n    pairingReady,\n    ...(blockReason ? { blockReason } : {}),\n    candidates,\n    recommended,\n    connectUrls,\n  };\n}\n"],"mappings":";;;;;iBAOmE;AA+BnE,SAAgB,uBAAuB,QAUjB;CACpB,MAAM,OAAO,OAAO,OAAO,SAAS,QAAQ;CAC5C,MAAM,WAAW,uBAAuB,OAAO,OAAO;CACtD,MAAM,aAAa,4BAA4B,OAAO,OAAO;CAC7D,MAAM,iBAAiB,4BAA4B,WAAW;CAE9D,MAAM,gBAAgB,8BAA8B,KAAK;CACzD,MAAM,aAAoC,cAAc,KAAK,WAAW;EACtE,MAAM;EACN,KAAK,MAAM;EACX,OAAO,MAAM;EACb,WAAW;EACX,GAAI,iBAAiB,EAAE,GAAG,EAAE,MAAM,qBAAqB;EACxD,EAAE;CAEH,MAAM,YAAY,OAAO,iBAAiB,MAAM,IAAI;CACpD,MAAM,kBAAkB,OAAO,oBAAoB,QAAQ,QAAQ,UAAU;AAC7E,KAAI,mBAAmB,UACrB,YAAW,QAAQ;EACjB,MAAM;EACN,KAAK;EACL,WAAW;EACZ,CAAC;CAGJ,MAAM,yBAAyB,yBAAyB,OAAO,OAAO,SAAS,UAAU;CACzF,MAAM,kBACJ,OAAO,0BAA0B,KAAA,IAC7B,yBAAyB,OAAO,sBAAsB,GACtD;AACN,KAAI,gBACF,YAAW,QAAQ;EACjB,MAAM;EACN,KAAK;EACL,WAAW;EACZ,CAAC;CAGJ,IAAI,cAAgD;EAAE,MAAM;EAAM,KAAK;EAAM;AAC7E,KAAI,gBACF,eAAc;EAAE,MAAM;EAAiB,KAAK;EAAiB;UACpD,mBAAmB,UAC5B,eAAc;EAAE,MAAM;EAAU,KAAK;EAAW;UACvC,kBAAkB,cAAc,GACzC,eAAc;EAAE,MAAM;EAAO,KAAK,cAAc,GAAG;EAAK;UAC/C,cAAc,GACvB,eAAc;EAAE,MAAM;EAAO,KAAK,cAAc,GAAG;EAAK;CAG1D,MAAM,eAAe,QACnB,mBAAmB,mBAAoB,kBAAkB,cAAc,SAAS,EACjF;CAED,IAAI;AACJ,KAAI,CAAC,aACH,eACE,CAAC,kBAAkB,CAAC,kBAAkB,0BAA0B;CAGpE,MAAM,mBACJ,kBAAkB,cAAc,KAAK,cAAc,GAAG,MAAM;CAG9D,MAAM,cAAc,QAAQ,gBAAgB,IAAI;CAQhD,MAAM,cAAc,2BAA2B;EAC7C;EACA,SATwB,kBACtB,kBACA,mBAAmB,YACjB,YACA,kBAAkB,YAAY,MAC5B,YAAY,MACZ;EAIN,QAAQ,cAAc,mBAAmB;EACzC,WAAW,kBAAkB,YAAY;EAC1C,CAAC;AAEF,QAAO;EACL;EACA;EACA;EACA;EACA,GAAI,cAAc,EAAE,aAAa,GAAG,EAAE;EACtC;EACA;EACA;EACD"}

package/dist/src/tunnel/pair-url.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"pair-url.js","names":[],"sources":["../../../src/tunnel/pair-url.ts"],"sourcesContent":["import net from 'node:net';\n\nimport { isNetworkAccessibleBindHost, resolveGatewayEffectiveHost } from '../config/gateway-bind.js';\nimport type { Config } from '../config/schema.js';\nimport { enumerateLanGatewayCandidates } from './tunnel-qr.js';\n\nexport type MobilePairUrlValidationCode = 'INVALID_URL' | 'LOOPBACK_NOT_REACHABLE';\n\nexport type MobilePairUrlValidationResult =\n  | { ok: true; url: string; loopback: false }\n  | { ok: false; code: MobilePairUrlValidationCode; message: string };\n\n/** Normalize a gateway root URL (no trailing slash, no path). */\nexport function normalizeGatewayBaseUrl(raw: string): string | null {\n  const trimmed = raw.trim();\n  if (!trimmed) return null;\n  try {\n    const u = new URL(trimmed);\n    if (u.protocol !== 'http:' && u.protocol !== 'https:') {\n      return null;\n    }\n    if (u.username || u.password) return null;\n    if (u.pathname && u.pathname !== '/') return null;\n    if (u.search || u.hash) return null;\n    const portSuffix = u.port ? `:${u.port}` : '';\n    return `${u.protocol}//${u.hostname}${portSuffix}`;\n  } catch {\n    return null;\n  }\n}\n\n/** True when a phone on the network cannot reach this gateway root URL. */\nexport function isLoopbackGatewayBaseUrl(raw: string): boolean {\n  const normalized = normalizeGatewayBaseUrl(raw);\n  if (!normalized) return false;\n  try {\n    const u = new URL(normalized);\n    const host = u.hostname.trim().toLowerCase();\n    if (host === 'localhost' || host === '127.0.0.1' || host === '::1' || host === '[::1]') {\n      return true;\n    }\n    const ipVersion = net.isIP(host);\n    if (ipVersion === 4) {\n      const parts = host.split('.').map((p) => Number(p));\n      if (parts.length === 4 && parts.every((n) => Number.isInteger(n)) && parts[0] === 127) {\n        return true;\n      }\n    }\n    return false;\n  } catch {\n    return false;\n  }\n}\n\nexport function validateMobilePairBaseUrl(raw: string): MobilePairUrlValidationResult {\n  const url = normalizeGatewayBaseUrl(raw);\n  if (!url) {\n    return {\n      ok: false,\n      code: 'INVALID_URL',\n      message: 'Enter an absolute gateway URL starting with http:// or https:// (no path).',\n    };\n  }\n  if (isLoopbackGatewayBaseUrl(url)) {\n    return {\n      ok: false,\n      code: 'LOOPBACK_NOT_REACHABLE',\n      message:\n        '127.0.0.1 and localhost only work on the gateway machine. Use a LAN IP or tunnel URL instead.',\n    };\n  }\n  return { ok: true, url, loopback: false };\n}\n\nexport type ParsedMobileConnectDeepLink = {\n  baseUrl: string;\n  lanUrl: string | null;\n  pairingSecret: string;\n};\n\n/** Parse `xopc://gateway/mobile-connect?...` payloads from QR codes. */\nexport function parseMobileConnectDeepLink(raw: string): ParsedMobileConnectDeepLink | null {\n  const trimmed = raw.trim();\n  if (!trimmed) return null;\n  try {\n    const u = new URL(trimmed);\n    if (u.protocol !== 'xopc:' || u.hostname !== 'gateway' || u.pathname !== '/mobile-connect') {\n      return null;\n    }\n    const baseUrl = u.searchParams.get('baseUrl')?.trim() ?? '';\n    const psRaw = u.searchParams.get('ps')?.trim() ?? '';\n    let pairingSecret = psRaw;\n    if (psRaw) {\n      try {\n        pairingSecret = decodeURIComponent(psRaw);\n      } catch {\n        pairingSecret = psRaw;\n      }\n    }\n    if (!baseUrl || !pairingSecret) return null;\n    const lanRaw = u.searchParams.get('lanUrl')?.trim() ?? '';\n    const lanUrl = lanRaw ? normalizeGatewayBaseUrl(lanRaw) : null;\n    const normalizedBase = normalizeGatewayBaseUrl(baseUrl);\n    if (!normalizedBase) return null;\n    return {\n      baseUrl: normalizedBase,\n      lanUrl,\n      pairingSecret,\n    };\n  } catch {\n    return null;\n  }\n}\n\n/**\n * Ordered URLs for mobile clients. Priority:\n *   1. reverse-proxy public URL (user-deployed HTTPS, typically fastest + works on cellular)\n *   2. LAN URL (zero-RTT on same network)\n *   3. baseUrl (legacy: usually the FRP tunnel public URL, kept for callers that\n *      do not yet split reverseProxyUrl from tunnelUrl)\n *   4. tunnelUrl (explicit FRP tunnel URL, kept as a fallback even when a\n *      reverse-proxy URL is also configured)\n *\n * Loopback URLs are dropped (they only work on the gateway host) and\n * duplicates are de-duped while preserving first occurrence order.\n */\nexport function buildMobileConnectUrlOrder(params: {\n  baseUrl: string | null | undefined;\n  lanUrl: string | null | undefined;\n  reverseProxyUrl?: string | null | undefined;\n  tunnelUrl?: string | null | undefined;\n}): string[] {\n  const ordered: string[] = [];\n  const seen = new Set<string>();\n\n  const push = (raw: string | null | undefined) => {\n    const url = raw ? normalizeGatewayBaseUrl(raw) : null;\n    if (!url || isLoopbackGatewayBaseUrl(url) || seen.has(url)) return;\n    seen.add(url);\n    ordered.push(url);\n  };\n\n  push(params.reverseProxyUrl);\n  push(params.lanUrl);\n  push(params.baseUrl);\n  push(params.tunnelUrl);\n  return ordered;\n}\n\n/** First LAN URL when the gateway listens on a network-accessible bind host. */\nexport function resolveMobilePairLanUrl(config: Config): string | null {\n  const listenHost = resolveGatewayEffectiveHost(config);\n  if (!isNetworkAccessibleBindHost(listenHost)) return null;\n  const port = config.gateway?.port ?? 18790;\n  return enumerateLanGatewayCandidates(port)[0]?.url ?? null;\n}\n"],"mappings":";;;;;AAaA,SAAgB,wBAAwB,KAA4B;CAClE,MAAM,UAAU,IAAI,MAAM;AAC1B,KAAI,CAAC,QAAS,QAAO;AACrB,KAAI;EACF,MAAM,IAAI,IAAI,IAAI,QAAQ;AAC1B,MAAI,EAAE,aAAa,WAAW,EAAE,aAAa,SAC3C,QAAO;AAET,MAAI,EAAE,YAAY,EAAE,SAAU,QAAO;AACrC,MAAI,EAAE,YAAY,EAAE,aAAa,IAAK,QAAO;AAC7C,MAAI,EAAE,UAAU,EAAE,KAAM,QAAO;EAC/B,MAAM,aAAa,EAAE,OAAO,IAAI,EAAE,SAAS;AAC3C,SAAO,GAAG,EAAE,SAAS,IAAI,EAAE,WAAW;SAChC;AACN,SAAO;;;;AAKX,SAAgB,yBAAyB,KAAsB;CAC7D,MAAM,aAAa,wBAAwB,IAAI;AAC/C,KAAI,CAAC,WAAY,QAAO;AACxB,KAAI;EAEF,MAAM,OAAO,IADC,IAAI,WACJ,CAAC,SAAS,MAAM,CAAC,aAAa;AAC5C,MAAI,SAAS,eAAe,SAAS,eAAe,SAAS,SAAS,SAAS,QAC7E,QAAO;AAGT,MADkB,IAAI,KAAK,KACd,KAAK,GAAG;GACnB,MAAM,QAAQ,KAAK,MAAM,IAAI,CAAC,KAAK,MAAM,OAAO,EAAE,CAAC;AACnD,OAAI,MAAM,WAAW,KAAK,MAAM,OAAO,MAAM,OAAO,UAAU,EAAE,CAAC,IAAI,MAAM,OAAO,IAChF,QAAO;;AAGX,SAAO;SACD;AACN,SAAO;;;AAIX,SAAgB,0BAA0B,KAA4C;CACpF,MAAM,MAAM,wBAAwB,IAAI;AACxC,KAAI,CAAC,IACH,QAAO;EACL,IAAI;EACJ,MAAM;EACN,SAAS;EACV;AAEH,KAAI,yBAAyB,IAAI,CAC/B,QAAO;EACL,IAAI;EACJ,MAAM;EACN,SACE;EACH;AAEH,QAAO;EAAE,IAAI;EAAM;EAAK,UAAU;EAAO;;;AAU3C,SAAgB,2BAA2B,KAAiD;CAC1F,MAAM,UAAU,IAAI,MAAM;AAC1B,KAAI,CAAC,QAAS,QAAO;AACrB,KAAI;EACF,MAAM,IAAI,IAAI,IAAI,QAAQ;AAC1B,MAAI,EAAE,aAAa,WAAW,EAAE,aAAa,aAAa,EAAE,aAAa,kBACvE,QAAO;EAET,MAAM,UAAU,EAAE,aAAa,IAAI,UAAU,EAAE,MAAM,IAAI;EACzD,MAAM,QAAQ,EAAE,aAAa,IAAI,KAAK,EAAE,MAAM,IAAI;EAClD,IAAI,gBAAgB;AACpB,MAAI,MACF,KAAI;AACF,mBAAgB,mBAAmB,MAAM;UACnC;AACN,mBAAgB;;AAGpB,MAAI,CAAC,WAAW,CAAC,cAAe,QAAO;EACvC,MAAM,SAAS,EAAE,aAAa,IAAI,SAAS,EAAE,MAAM,IAAI;EACvD,MAAM,SAAS,SAAS,wBAAwB,OAAO,GAAG;EAC1D,MAAM,iBAAiB,wBAAwB,QAAQ;AACvD,MAAI,CAAC,eAAgB,QAAO;AAC5B,SAAO;GACL,SAAS;GACT;GACA;GACD;SACK;AACN,SAAO;;;;;;;;;;;;;;;AAgBX,SAAgB,2BAA2B,QAK9B;CACX,MAAM,UAAoB,EAAE;CAC5B,MAAM,uBAAO,IAAI,KAAa;CAE9B,MAAM,QAAQ,QAAmC;EAC/C,MAAM,MAAM,MAAM,wBAAwB,IAAI,GAAG;AACjD,MAAI,CAAC,OAAO,yBAAyB,IAAI,IAAI,KAAK,IAAI,IAAI,CAAE;AAC5D,OAAK,IAAI,IAAI;AACb,UAAQ,KAAK,IAAI;;AAGnB,MAAK,OAAO,gBAAgB;AAC5B,MAAK,OAAO,OAAO;AACnB,MAAK,OAAO,QAAQ;AACpB,MAAK,OAAO,UAAU;AACtB,QAAO;;;AAIT,SAAgB,wBAAwB,QAA+B;AAErE,KAAI,CAAC,4BADc,4BAA4B,OACJ,CAAC,CAAE,QAAO;AAErD,QAAO,8BADM,OAAO,SAAS,QAAQ,MACK,CAAC,IAAI,OAAO"}

package/dist/src/tunnel/pairing-rate-limit.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"pairing-rate-limit.js","names":[],"sources":["../../../src/tunnel/pairing-rate-limit.ts"],"sourcesContent":["import { buckets } from '../gateway/rate-limit/index.js';\n\nexport type PairingFailureLimitResult = {\n  allowed: boolean;\n  retryAfterMs: number;\n};\n\n/**\n * Records a failed pairing exchange and returns whether subsequent attempts\n * are still permitted. Called from the route handler on every invalid /\n * expired pairing secret — successful exchanges do NOT call this.\n */\nexport function consumePairingExchangeFailLimit(clientKey: string): PairingFailureLimitResult {\n  const fl = buckets.pairingExchange();\n  const key = clientKey.trim() || 'unknown';\n  fl.fail(key);\n  const status = fl.check(key);\n  if (status.blocked) {\n    return { allowed: false, retryAfterMs: status.retryAfterSec * 1000 };\n  }\n  return { allowed: true, retryAfterMs: 0 };\n}\n\n/** @internal */\nexport function resetPairingExchangeLimitsForTests(): void {\n  buckets.pairingExchange().resetForTests();\n}\n"],"mappings":";;;;;;;;AAYA,SAAgB,gCAAgC,WAA8C;CAC5F,MAAM,KAAK,QAAQ,iBAAiB;CACpC,MAAM,MAAM,UAAU,MAAM,IAAI;AAChC,IAAG,KAAK,IAAI;CACZ,MAAM,SAAS,GAAG,MAAM,IAAI;AAC5B,KAAI,OAAO,QACT,QAAO;EAAE,SAAS;EAAO,cAAc,OAAO,gBAAgB;EAAM;AAEtE,QAAO;EAAE,SAAS;EAAM,cAAc;EAAG;;;AAI3C,SAAgB,qCAA2C;AACzD,SAAQ,iBAAiB,CAAC,eAAe"}

package/dist/src/tunnel/pairing.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"pairing.js","names":[],"sources":["../../../src/tunnel/pairing.ts"],"sourcesContent":["import { randomBytes } from 'node:crypto';\n\nimport { createLogger } from '../utils/logger.js';\n\nconst log = createLogger('TunnelPairing');\n\nconst PAIRING_TTL_MS = 5 * 60_000;\nconst CLEANUP_INTERVAL_MS = 60_000;\n\ntype PairingSession = {\n  expiresAt: Date;\n  consumed: boolean;\n};\n\nconst sessions = new Map<string, PairingSession>();\n\nlet cleanupTimer: ReturnType<typeof setInterval> | null = null;\n\nfunction ensureCleanupTimer(): void {\n  if (cleanupTimer) return;\n  cleanupTimer = setInterval(() => {\n    const now = Date.now();\n    for (const [key, session] of sessions) {\n      if (now > session.expiresAt.getTime()) sessions.delete(key);\n    }\n  }, CLEANUP_INTERVAL_MS);\n  cleanupTimer.unref?.();\n}\n\nexport type PairingSecretResult = {\n  secret: string;\n  expiresAt: Date;\n};\n\nexport type PairingExchangePayload = {\n  token: string;\n  baseUrl: string | null;\n  lanUrl: string | null;\n  connectUrls: string[];\n};\n\nconst EXCHANGE_REPLAY_MS = 60_000;\nconst exchangeReplayCache = new Map<string, { expiresAt: number; payload: PairingExchangePayload }>();\n\nexport function cachePairingExchange(secret: string, payload: PairingExchangePayload): void {\n  exchangeReplayCache.set(secret, { expiresAt: Date.now() + EXCHANGE_REPLAY_MS, payload });\n}\n\nexport function getCachedPairingExchange(secret: string): PairingExchangePayload | null {\n  const entry = exchangeReplayCache.get(secret);\n  if (!entry) return null;\n  if (Date.now() > entry.expiresAt) {\n    exchangeReplayCache.delete(secret);\n    return null;\n  }\n  return entry.payload;\n}\n\nconst inflightExchanges = new Map<string, Promise<PairingExchangePayload | null>>();\n\n/**\n * Consume a pairing secret once and build the exchange payload.\n * Concurrent requests for the same secret share one in-flight exchange (mobile cold-start deeplink).\n */\nexport async function exchangePairingSecretOnce(\n  secret: string,\n  buildPayload: () => PairingExchangePayload,\n): Promise<PairingExchangePayload | null> {\n  const key = secret.trim();\n  if (!key) return null;\n\n  const replay = getCachedPairingExchange(key);\n  if (replay) return replay;\n\n  let inflight = inflightExchanges.get(key);\n  if (!inflight) {\n    inflight = (async (): Promise<PairingExchangePayload | null> => {\n      const cached = getCachedPairingExchange(key);\n      if (cached) return cached;\n      if (!consumePairingSecret(key)) {\n        return getCachedPairingExchange(key);\n      }\n      const payload = buildPayload();\n      cachePairingExchange(key, payload);\n      return payload;\n    })();\n    inflightExchanges.set(key, inflight);\n  }\n\n  try {\n    return await inflight;\n  } finally {\n    if (inflightExchanges.get(key) === inflight) inflightExchanges.delete(key);\n  }\n}\n\nexport function createPairingSecret(): PairingSecretResult {\n  ensureCleanupTimer();\n  const secret = randomBytes(32).toString('base64url');\n  const expiresAt = new Date(Date.now() + PAIRING_TTL_MS);\n  sessions.set(secret, { expiresAt, consumed: false });\n  log.info({ expiresAt: expiresAt.toISOString() }, 'Pairing session created');\n  return { secret, expiresAt };\n}\n\nexport function consumePairingSecret(secret: string): boolean {\n  if (!secret.trim()) return false;\n  const session = sessions.get(secret);\n  if (!session) return false;\n  if (session.consumed) return false;\n  if (Date.now() > session.expiresAt.getTime()) {\n    sessions.delete(secret);\n    return false;\n  }\n  session.consumed = true;\n  sessions.delete(secret);\n  log.info('Pairing session consumed');\n  return true;\n}\n\n/** @internal */\nexport function resetPairingSessionsForTests(): void {\n  sessions.clear();\n  exchangeReplayCache.clear();\n  inflightExchanges.clear();\n  if (cleanupTimer) {\n    clearInterval(cleanupTimer);\n    cleanupTimer = null;\n  }\n}\n"],"mappings":";;;;aAEkD;AAElD,MAAM,MAAM,aAAa,gBAAgB;AAEzC,MAAM,iBAAiB,IAAI;AAC3B,MAAM,sBAAsB;AAO5B,MAAM,2BAAW,IAAI,KAA6B;AAElD,IAAI,eAAsD;AAE1D,SAAS,qBAA2B;AAClC,KAAI,aAAc;AAClB,gBAAe,kBAAkB;EAC/B,MAAM,MAAM,KAAK,KAAK;AACtB,OAAK,MAAM,CAAC,KAAK,YAAY,SAC3B,KAAI,MAAM,QAAQ,UAAU,SAAS,CAAE,UAAS,OAAO,IAAI;IAE5D,oBAAoB;AACvB,cAAa,SAAS;;AAexB,MAAM,qBAAqB;AAC3B,MAAM,sCAAsB,IAAI,KAAqE;AAErG,SAAgB,qBAAqB,QAAgB,SAAuC;AAC1F,qBAAoB,IAAI,QAAQ;EAAE,WAAW,KAAK,KAAK,GAAG;EAAoB;EAAS,CAAC;;AAG1F,SAAgB,yBAAyB,QAA+C;CACtF,MAAM,QAAQ,oBAAoB,IAAI,OAAO;AAC7C,KAAI,CAAC,MAAO,QAAO;AACnB,KAAI,KAAK,KAAK,GAAG,MAAM,WAAW;AAChC,sBAAoB,OAAO,OAAO;AAClC,SAAO;;AAET,QAAO,MAAM;;AAGf,MAAM,oCAAoB,IAAI,KAAqD;;;;;AAMnF,eAAsB,0BACpB,QACA,cACwC;CACxC,MAAM,MAAM,OAAO,MAAM;AACzB,KAAI,CAAC,IAAK,QAAO;CAEjB,MAAM,SAAS,yBAAyB,IAAI;AAC5C,KAAI,OAAQ,QAAO;CAEnB,IAAI,WAAW,kBAAkB,IAAI,IAAI;AACzC,KAAI,CAAC,UAAU;AACb,cAAY,YAAoD;GAC9D,MAAM,SAAS,yBAAyB,IAAI;AAC5C,OAAI,OAAQ,QAAO;AACnB,OAAI,CAAC,qBAAqB,IAAI,CAC5B,QAAO,yBAAyB,IAAI;GAEtC,MAAM,UAAU,cAAc;AAC9B,wBAAqB,KAAK,QAAQ;AAClC,UAAO;MACL;AACJ,oBAAkB,IAAI,KAAK,SAAS;;AAGtC,KAAI;AACF,SAAO,MAAM;WACL;AACR,MAAI,kBAAkB,IAAI,IAAI,KAAK,SAAU,mBAAkB,OAAO,IAAI;;;AAI9E,SAAgB,sBAA2C;AACzD,qBAAoB;CACpB,MAAM,SAAS,YAAY,GAAG,CAAC,SAAS,YAAY;CACpD,MAAM,YAAY,IAAI,KAAK,KAAK,KAAK,GAAG,eAAe;AACvD,UAAS,IAAI,QAAQ;EAAE;EAAW,UAAU;EAAO,CAAC;AACpD,KAAI,KAAK,EAAE,WAAW,UAAU,aAAa,EAAE,EAAE,0BAA0B;AAC3E,QAAO;EAAE;EAAQ;EAAW;;AAG9B,SAAgB,qBAAqB,QAAyB;AAC5D,KAAI,CAAC,OAAO,MAAM,CAAE,QAAO;CAC3B,MAAM,UAAU,SAAS,IAAI,OAAO;AACpC,KAAI,CAAC,QAAS,QAAO;AACrB,KAAI,QAAQ,SAAU,QAAO;AAC7B,KAAI,KAAK,KAAK,GAAG,QAAQ,UAAU,SAAS,EAAE;AAC5C,WAAS,OAAO,OAAO;AACvB,SAAO;;AAET,SAAQ,WAAW;AACnB,UAAS,OAAO,OAAO;AACvB,KAAI,KAAK,2BAA2B;AACpC,QAAO;;;AAIT,SAAgB,+BAAqC;AACnD,UAAS,OAAO;AAChB,qBAAoB,OAAO;AAC3B,mBAAkB,OAAO;AACzB,KAAI,cAAc;AAChB,gBAAc,aAAa;AAC3B,iBAAe"}

package/dist/src/tunnel/tunnel-audit.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"tunnel-audit.js","names":[],"sources":["../../../src/tunnel/tunnel-audit.ts"],"sourcesContent":["import { createLogger } from '../utils/logger.js';\n\nconst log = createLogger('TunnelAudit');\n\nexport type TunnelAuditEvent =\n  | 'tunnel.consent'\n  | 'tunnel.start'\n  | 'tunnel.stop'\n  | 'tunnel.release'\n  | 'tunnel.start_denied'\n  | 'tunnel.pair'\n  | 'tunnel.exchange_token'\n  | 'tunnel.enable_lan_pairing';\n\nexport function logTunnelAudit(\n  event: TunnelAuditEvent,\n  fields: Record<string, unknown>,\n  message: string,\n): void {\n  log.info({ phase: event, ...fields }, message);\n}\n"],"mappings":";;;aAAkD;AAElD,MAAM,MAAM,aAAa,cAAc;AAYvC,SAAgB,eACd,OACA,QACA,SACM;AACN,KAAI,KAAK;EAAE,OAAO;EAAO,GAAG;EAAQ,EAAE,QAAQ"}

package/dist/src/tunnel/tunnel-config.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"tunnel-config.js","names":[],"sources":["../../../src/tunnel/tunnel-config.ts"],"sourcesContent":["import { z } from 'zod';\n\nimport type { Config } from '../config/schema.js';\nimport { TunnelConfigSchema, TunnelConsentSchema } from '../config/schema.js';\n\nimport {\n  assertTunnelAutoStartAllowed,\n  buildTunnelConsentRecord,\n  hasValidTunnelConsent,\n} from './consent.js';\nimport { isMaskedTunnelSecretPatchValue } from './env.js';\n\nconst TunnelConfigPatchSchema = z.object({\n  enabled: z.boolean().optional(),\n  brokerUrl: z.string().url().optional(),\n  registrationSecret: z.union([z.string(), z.null()]).optional(),\n  autoStart: z.boolean().optional(),\n  subdomain: z.string().optional(),\n  consent: TunnelConsentSchema.optional(),\n});\n\nexport function mergeTunnelConfigPatch(\n  config: Config,\n  patch: Record<string, unknown>,\n): { ok: true } | { ok: false; message: string } {\n  const parsed = TunnelConfigPatchSchema.safeParse(patch);\n  if (!parsed.success) {\n    return { ok: false, message: parsed.error.issues.map((i) => i.message).join('; ') };\n  }\n\n  const patchFields = { ...parsed.data };\n  if (parsed.data.registrationSecret !== undefined) {\n    if (parsed.data.registrationSecret === null) {\n      delete patchFields.registrationSecret;\n    } else {\n      const trimmed = parsed.data.registrationSecret.trim();\n      if (!trimmed || isMaskedTunnelSecretPatchValue(trimmed)) {\n        delete patchFields.registrationSecret;\n      } else {\n        patchFields.registrationSecret = trimmed;\n      }\n    }\n  }\n\n  const next = {\n    ...(config.tunnel ?? TunnelConfigSchema.parse({})),\n    ...patchFields,\n  };\n\n  if (parsed.data.registrationSecret === null) {\n    delete next.registrationSecret;\n  }\n\n  if (parsed.data.autoStart === true) {\n    const probeTunnel = TunnelConfigSchema.parse({ ...next, autoStart: true });\n    const probe: Config = { ...config, tunnel: probeTunnel };\n    try {\n      assertTunnelAutoStartAllowed(probe);\n    } catch (err) {\n      const em = err instanceof Error ? err.message : String(err);\n      return { ok: false, message: em };\n    }\n  }\n\n  if (\n    parsed.data.enabled === true &&\n    !hasValidTunnelConsent({ ...config, tunnel: TunnelConfigSchema.parse(next) })\n  ) {\n    return {\n      ok: false,\n      message:\n        'Cannot enable tunnel without accepting the security notice. Start remote access from settings or record consent first.',\n    };\n  }\n\n  config.tunnel = TunnelConfigSchema.parse(next);\n  return { ok: true };\n}\n\nexport function applyTunnelConsentToConfig(config: Config): void {\n  if (!config.tunnel) {\n    config.tunnel = TunnelConfigSchema.parse({});\n  }\n  config.tunnel.consent = buildTunnelConsentRecord();\n}\n\nexport function setTunnelEnabledInConfig(config: Config, enabled: boolean): void {\n  if (!config.tunnel) {\n    config.tunnel = TunnelConfigSchema.parse({});\n  }\n  config.tunnel.enabled = enabled;\n}\n\n/**\n * Clear stale tunnel flags when consent is missing or outdated (Phase 2: config/runtime alignment).\n * Returns true when `config.tunnel` was modified.\n */\nexport function sanitizeTunnelConfig(config: Config): boolean {\n  const tunnel = config.tunnel;\n  if (!tunnel) return false;\n  if (hasValidTunnelConsent(config)) return false;\n\n  let changed = false;\n  if (tunnel.enabled) {\n    tunnel.enabled = false;\n    changed = true;\n  }\n  if (tunnel.autoStart) {\n    tunnel.autoStart = false;\n    changed = true;\n  }\n  return changed;\n}\n"],"mappings":";;;;;aAG8E;AAS9E,MAAM,0BAA0B,EAAE,OAAO;CACvC,SAAS,EAAE,SAAS,CAAC,UAAU;CAC/B,WAAW,EAAE,QAAQ,CAAC,KAAK,CAAC,UAAU;CACtC,oBAAoB,EAAE,MAAM,CAAC,EAAE,QAAQ,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC,UAAU;CAC9D,WAAW,EAAE,SAAS,CAAC,UAAU;CACjC,WAAW,EAAE,QAAQ,CAAC,UAAU;CAChC,SAAS,oBAAoB,UAAU;CACxC,CAAC;AAEF,SAAgB,uBACd,QACA,OAC+C;CAC/C,MAAM,SAAS,wBAAwB,UAAU,MAAM;AACvD,KAAI,CAAC,OAAO,QACV,QAAO;EAAE,IAAI;EAAO,SAAS,OAAO,MAAM,OAAO,KAAK,MAAM,EAAE,QAAQ,CAAC,KAAK,KAAK;EAAE;CAGrF,MAAM,cAAc,EAAE,GAAG,OAAO,MAAM;AACtC,KAAI,OAAO,KAAK,uBAAuB,KAAA,EACrC,KAAI,OAAO,KAAK,uBAAuB,KACrC,QAAO,YAAY;MACd;EACL,MAAM,UAAU,OAAO,KAAK,mBAAmB,MAAM;AACrD,MAAI,CAAC,WAAW,+BAA+B,QAAQ,CACrD,QAAO,YAAY;MAEnB,aAAY,qBAAqB;;CAKvC,MAAM,OAAO;EACX,GAAI,OAAO,UAAU,mBAAmB,MAAM,EAAE,CAAC;EACjD,GAAG;EACJ;AAED,KAAI,OAAO,KAAK,uBAAuB,KACrC,QAAO,KAAK;AAGd,KAAI,OAAO,KAAK,cAAc,MAAM;EAClC,MAAM,cAAc,mBAAmB,MAAM;GAAE,GAAG;GAAM,WAAW;GAAM,CAAC;EAC1E,MAAM,QAAgB;GAAE,GAAG;GAAQ,QAAQ;GAAa;AACxD,MAAI;AACF,gCAA6B,MAAM;WAC5B,KAAK;AAEZ,UAAO;IAAE,IAAI;IAAO,SADT,eAAe,QAAQ,IAAI,UAAU,OAAO,IAAI;IAC1B;;;AAIrC,KACE,OAAO,KAAK,YAAY,QACxB,CAAC,sBAAsB;EAAE,GAAG;EAAQ,QAAQ,mBAAmB,MAAM,KAAK;EAAE,CAAC,CAE7E,QAAO;EACL,IAAI;EACJ,SACE;EACH;AAGH,QAAO,SAAS,mBAAmB,MAAM,KAAK;AAC9C,QAAO,EAAE,IAAI,MAAM;;AAGrB,SAAgB,2BAA2B,QAAsB;AAC/D,KAAI,CAAC,OAAO,OACV,QAAO,SAAS,mBAAmB,MAAM,EAAE,CAAC;AAE9C,QAAO,OAAO,UAAU,0BAA0B;;AAGpD,SAAgB,yBAAyB,QAAgB,SAAwB;AAC/E,KAAI,CAAC,OAAO,OACV,QAAO,SAAS,mBAAmB,MAAM,EAAE,CAAC;AAE9C,QAAO,OAAO,UAAU;;;;;;AAO1B,SAAgB,qBAAqB,QAAyB;CAC5D,MAAM,SAAS,OAAO;AACtB,KAAI,CAAC,OAAQ,QAAO;AACpB,KAAI,sBAAsB,OAAO,CAAE,QAAO;CAE1C,IAAI,UAAU;AACd,KAAI,OAAO,SAAS;AAClB,SAAO,UAAU;AACjB,YAAU;;AAEZ,KAAI,OAAO,WAAW;AACpB,SAAO,YAAY;AACnB,YAAU;;AAEZ,QAAO"}

package/dist/src/tunnel/tunnel-persist.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"tunnel-persist.js","names":[],"sources":["../../../src/tunnel/tunnel-persist.ts"],"sourcesContent":["import type { PersistedTunnelState, TunnelRegistration } from './tunnel-types.js';\n\nexport function persistedFromRegistration(registration: TunnelRegistration): PersistedTunnelState {\n  return {\n    tunnelId: registration.tunnelId,\n    tunnelToken: registration.tunnelToken,\n    subdomain: registration.subdomain,\n    publicUrl: registration.publicUrl,\n    frpcAuthToken: registration.frpc.authToken,\n    registeredAt: new Date().toISOString(),\n    enabled: true,\n    frpcServerAddr: registration.frpc.serverAddr,\n    frpcServerPort: registration.frpc.serverPort,\n    proxyName: registration.frpc.proxyName,\n    heartbeatIntervalMs: registration.heartbeatIntervalMs,\n  };\n}\n\n/** Rebuild registration from disk when Broker row is still valid (stop without deregister). */\nexport function registrationFromPersisted(\n  persisted: PersistedTunnelState,\n): TunnelRegistration | null {\n  if (\n    !persisted.frpcAuthToken ||\n    !persisted.frpcServerAddr ||\n    !persisted.frpcServerPort ||\n    !persisted.proxyName\n  ) {\n    return null;\n  }\n  return {\n    tunnelId: persisted.tunnelId,\n    tunnelToken: persisted.tunnelToken,\n    subdomain: persisted.subdomain,\n    publicUrl: persisted.publicUrl,\n    frpc: {\n      serverAddr: persisted.frpcServerAddr,\n      serverPort: persisted.frpcServerPort,\n      authToken: persisted.frpcAuthToken,\n      proxyName: persisted.proxyName,\n    },\n    expiresAt: '',\n    heartbeatIntervalMs: persisted.heartbeatIntervalMs ?? 30_000,\n  };\n}\n\nexport function canResumePersistedTunnel(persisted: PersistedTunnelState | null): persisted is PersistedTunnelState {\n  return Boolean(\n    persisted?.tunnelId &&\n      persisted.tunnelToken &&\n      persisted.subdomain &&\n      persisted.frpcAuthToken &&\n      registrationFromPersisted(persisted),\n  );\n}\n"],"mappings":";AAEA,SAAgB,0BAA0B,cAAwD;AAChG,QAAO;EACL,UAAU,aAAa;EACvB,aAAa,aAAa;EAC1B,WAAW,aAAa;EACxB,WAAW,aAAa;EACxB,eAAe,aAAa,KAAK;EACjC,+BAAc,IAAI,MAAM,EAAC,aAAa;EACtC,SAAS;EACT,gBAAgB,aAAa,KAAK;EAClC,gBAAgB,aAAa,KAAK;EAClC,WAAW,aAAa,KAAK;EAC7B,qBAAqB,aAAa;EACnC;;;AAIH,SAAgB,0BACd,WAC2B;AAC3B,KACE,CAAC,UAAU,iBACX,CAAC,UAAU,kBACX,CAAC,UAAU,kBACX,CAAC,UAAU,UAEX,QAAO;AAET,QAAO;EACL,UAAU,UAAU;EACpB,aAAa,UAAU;EACvB,WAAW,UAAU;EACrB,WAAW,UAAU;EACrB,MAAM;GACJ,YAAY,UAAU;GACtB,YAAY,UAAU;GACtB,WAAW,UAAU;GACrB,WAAW,UAAU;GACtB;EACD,WAAW;EACX,qBAAqB,UAAU,uBAAuB;EACvD;;AAGH,SAAgB,yBAAyB,WAA2E;AAClH,QAAO,QACL,WAAW,YACT,UAAU,eACV,UAAU,aACV,UAAU,iBACV,0BAA0B,UAAU,CACvC"}

package/dist/src/tunnel/tunnel-qr.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"tunnel-qr.js","names":[],"sources":["../../../src/tunnel/tunnel-qr.ts"],"sourcesContent":["import { networkInterfaces } from 'node:os';\n\nimport type { TunnelQrPayload } from './tunnel-types.js';\n\nfunction trimBase(raw: string): string {\n  return raw.trim().replace(/\\/+$/, '');\n}\n\nexport type LanGatewayCandidate = {\n  url: string;\n  address: string;\n  interfaceName: string;\n};\n\n/** Non-internal IPv4 addresses on this machine (independent of gateway bind mode). */\nexport function enumerateLanGatewayCandidates(port: number): LanGatewayCandidate[] {\n  const nets = networkInterfaces();\n  const seen = new Set<string>();\n  const out: LanGatewayCandidate[] = [];\n\n  for (const [interfaceName, addrs] of Object.entries(nets)) {\n    for (const addr of addrs ?? []) {\n      if (addr.family !== 'IPv4' || addr.internal) continue;\n      if (seen.has(addr.address)) continue;\n      seen.add(addr.address);\n      out.push({\n        address: addr.address,\n        interfaceName,\n        url: trimBase(`http://${addr.address}:${port}`),\n      });\n    }\n  }\n\n  return out;\n}\n\n/** First non-internal IPv4 suitable for LAN QR (when gateway listens on 0.0.0.0). */\nexport function resolveLanGatewayUrl(gatewayHost: string, gatewayPort: number): string | null {\n  const host = gatewayHost.trim().toLowerCase();\n  if (host === '127.0.0.1' || host === 'localhost' || host === '::1') {\n    return null;\n  }\n\n  let ip: string | undefined;\n  if (host === '0.0.0.0' || host === '::' || host === '') {\n    ip = enumerateLanGatewayCandidates(gatewayPort)[0]?.address;\n  } else if (!host.includes(':')) {\n    ip = host;\n  }\n\n  if (!ip) return null;\n  return trimBase(`http://${ip}:${gatewayPort}`);\n}\n\nexport function buildMobileConnectQrPayload(input: {\n  publicUrl: string;\n  lanUrl: string | null;\n  pairingSecret: string;\n  expiresAt?: string;\n}): TunnelQrPayload {\n  const params = new URLSearchParams();\n  params.set('baseUrl', input.publicUrl);\n  if (input.lanUrl) params.set('lanUrl', input.lanUrl);\n  if (input.pairingSecret) params.set('ps', input.pairingSecret);\n  const qrPayload = `xopc://gateway/mobile-connect?${params.toString()}`;\n  return {\n    qrPayload,\n    publicUrl: input.publicUrl,\n    lanUrl: input.lanUrl,\n    expiresAt: input.expiresAt,\n  };\n}\n"],"mappings":";;AAIA,SAAS,SAAS,KAAqB;AACrC,QAAO,IAAI,MAAM,CAAC,QAAQ,QAAQ,GAAG;;;AAUvC,SAAgB,8BAA8B,MAAqC;CACjF,MAAM,OAAO,mBAAmB;CAChC,MAAM,uBAAO,IAAI,KAAa;CAC9B,MAAM,MAA6B,EAAE;AAErC,MAAK,MAAM,CAAC,eAAe,UAAU,OAAO,QAAQ,KAAK,CACvD,MAAK,MAAM,QAAQ,SAAS,EAAE,EAAE;AAC9B,MAAI,KAAK,WAAW,UAAU,KAAK,SAAU;AAC7C,MAAI,KAAK,IAAI,KAAK,QAAQ,CAAE;AAC5B,OAAK,IAAI,KAAK,QAAQ;AACtB,MAAI,KAAK;GACP,SAAS,KAAK;GACd;GACA,KAAK,SAAS,UAAU,KAAK,QAAQ,GAAG,OAAO;GAChD,CAAC;;AAIN,QAAO;;;AAIT,SAAgB,qBAAqB,aAAqB,aAAoC;CAC5F,MAAM,OAAO,YAAY,MAAM,CAAC,aAAa;AAC7C,KAAI,SAAS,eAAe,SAAS,eAAe,SAAS,MAC3D,QAAO;CAGT,IAAI;AACJ,KAAI,SAAS,aAAa,SAAS,QAAQ,SAAS,GAClD,MAAK,8BAA8B,YAAY,CAAC,IAAI;UAC3C,CAAC,KAAK,SAAS,IAAI,CAC5B,MAAK;AAGP,KAAI,CAAC,GAAI,QAAO;AAChB,QAAO,SAAS,UAAU,GAAG,GAAG,cAAc;;AAGhD,SAAgB,4BAA4B,OAKxB;CAClB,MAAM,SAAS,IAAI,iBAAiB;AACpC,QAAO,IAAI,WAAW,MAAM,UAAU;AACtC,KAAI,MAAM,OAAQ,QAAO,IAAI,UAAU,MAAM,OAAO;AACpD,KAAI,MAAM,cAAe,QAAO,IAAI,MAAM,MAAM,cAAc;AAE9D,QAAO;EACL,WAAA,iCAFiD,OAAO,UAAU;EAGlE,WAAW,MAAM;EACjB,QAAQ,MAAM;EACd,WAAW,MAAM;EAClB"}

package/dist/src/tunnel/tunnel-rate-limit.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"tunnel-rate-limit.js","names":[],"sources":["../../../src/tunnel/tunnel-rate-limit.ts"],"sourcesContent":["import { createHash } from 'node:crypto';\n\nimport { buckets } from '../gateway/rate-limit/index.js';\nimport { createLogger } from '../utils/logger.js';\n\nconst log = createLogger('TunnelRateLimit');\n\nfunction tokenKey(token: string): string {\n  return createHash('sha256').update(token, 'utf8').digest('hex').slice(0, 16);\n}\n\nexport type TunnelMutationLimitResult = {\n  allowed: boolean;\n  retryAfterMs: number;\n};\n\nexport function consumeTunnelMutationLimit(token: string): TunnelMutationLimitResult {\n  const result = buckets.tunnelMutate().consume(tokenKey(token));\n  if (!result.allowed) {\n    log.warn(\n      {\n        tokenPrefix: token.slice(0, 8),\n        retryAfterSec: Math.ceil(result.retryAfterMs / 1000),\n        reason: 'tunnel_mutation_limit',\n      },\n      'Tunnel mutation rate limit exceeded',\n    );\n  }\n  return { allowed: result.allowed, retryAfterMs: result.retryAfterMs };\n}\n\n/** @internal */\nexport function resetTunnelMutationLimitsForTests(): void {\n  buckets.tunnelMutate().resetForTests();\n}\n"],"mappings":";;;;;;aAGkD;AAElD,MAAM,MAAM,aAAa,kBAAkB;AAE3C,SAAS,SAAS,OAAuB;AACvC,QAAO,WAAW,SAAS,CAAC,OAAO,OAAO,OAAO,CAAC,OAAO,MAAM,CAAC,MAAM,GAAG,GAAG;;AAQ9E,SAAgB,2BAA2B,OAA0C;CACnF,MAAM,SAAS,QAAQ,cAAc,CAAC,QAAQ,SAAS,MAAM,CAAC;AAC9D,KAAI,CAAC,OAAO,QACV,KAAI,KACF;EACE,aAAa,MAAM,MAAM,GAAG,EAAE;EAC9B,eAAe,KAAK,KAAK,OAAO,eAAe,IAAK;EACpD,QAAQ;EACT,EACD,sCACD;AAEH,QAAO;EAAE,SAAS,OAAO;EAAS,cAAc,OAAO;EAAc;;;AAIvE,SAAgB,oCAA0C;AACxD,SAAQ,cAAc,CAAC,eAAe"}

package/dist/src/tunnel/tunnel-service.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"tunnel-service.js","names":[],"sources":["../../../src/tunnel/tunnel-service.ts"],"sourcesContent":["import { createHash } from 'node:crypto';\nimport { EventEmitter } from 'node:events';\n\nimport { PACKAGE_VERSION } from '../package-version.js';\nimport { createLogger } from '../utils/logger.js';\nimport { TunnelBrokerClient, resolveBrokerApiBase } from './broker-client.js';\nimport { clearFrpcPathForProcess, ensureFrpcBinary, publishFrpcPathForProcess } from './frpc-binary.js';\nimport { writeFrpcConfig } from './frpc-config.js';\nimport { type FrpcProcessHandle, spawnFrpcProcess } from './frpc-process.js';\nimport { buildMobileConnectQrPayload, resolveLanGatewayUrl } from './tunnel-qr.js';\nimport { createPairingSecret } from './pairing.js';\nimport {\n  canResumePersistedTunnel,\n  persistedFromRegistration,\n  registrationFromPersisted,\n} from './tunnel-persist.js';\nimport { clearTunnelState, loadTunnelState, saveTunnelState, updateTunnelState } from './tunnel-state.js';\nimport { logTunnelAudit } from './tunnel-audit.js';\nimport type { PersistedTunnelState, TunnelQrPayload, TunnelRegistration, TunnelStatus } from './tunnel-types.js';\nimport type { FrpcDownloadProgress, TunnelStartPhase, TunnelStartProgress } from './tunnel-types.js';\n\nconst log = createLogger('Tunnel');\n\nexport type TunnelServiceConfig = {\n  brokerUrl: string;\n  registrationSecret: string;\n  autoStart: boolean;\n  gatewayHost: string;\n  frpSubdomainHost: string;\n};\n\nexport function hashGatewayToken(token: string): string {\n  return createHash('sha256').update(token, 'utf8').digest('hex');\n}\n\nfunction platformLabel(): string {\n  return `${process.platform}-${process.arch}`;\n}\n\nlet singleton: TunnelService | null = null;\n\nexport function getTunnelService(): TunnelService {\n  if (!singleton) singleton = new TunnelService();\n  return singleton;\n}\n\nexport class TunnelService extends EventEmitter {\n  private serviceConfig: TunnelServiceConfig | null = null;\n  private frpcHandle: FrpcProcessHandle | null = null;\n  private heartbeatTimer: ReturnType<typeof setInterval> | null = null;\n  private connectedSince: string | null = null;\n  private lastHeartbeatAt: string | null = null;\n  private lastError: string | null = null;\n  private state: TunnelStatus['state'] = 'disconnected';\n  private reconnectAttempt = 0;\n  private stopping = false;\n  private startContext: { gatewayPort: number; gatewayToken: string } | null = null;\n  private frpcDownload: FrpcDownloadProgress | null = null;\n  private startProgress: TunnelStartProgress | null = null;\n\n  configure(cfg: TunnelServiceConfig): void {\n    this.serviceConfig = cfg;\n  }\n\n  getStatus(): TunnelStatus {\n    const cfg = this.serviceConfig;\n    const persisted = loadTunnelState();\n    return {\n      enabled: this.state === 'connected' || this.state === 'connecting' || this.state === 'reconnecting',\n      state: this.state,\n      subdomain: persisted?.subdomain ?? null,\n      publicUrl: persisted?.publicUrl ?? null,\n      connectedSince: this.connectedSince,\n      frpcPid: this.frpcHandle?.pid ?? null,\n      lastHeartbeatAt: this.lastHeartbeatAt,\n      lastError: this.lastError,\n      frpcDownload: this.frpcDownload,\n      startProgress: this.startProgress,\n      config: {\n        autoStart: cfg?.autoStart ?? false,\n        brokerUrl: cfg?.brokerUrl ?? 'https://frp.xopc.ai/api',\n        transport: { tls: 'broker_terminated' },\n      },\n    };\n  }\n\n  private setStartPhase(phase: TunnelStartPhase, patch?: Partial<Pick<TunnelStartProgress, 'publicUrl'>>): void {\n    const prev = this.startProgress;\n    const samePhase = prev?.phase === phase;\n    this.startProgress = {\n      phase,\n      startedAt: samePhase && prev ? prev.startedAt : new Date().toISOString(),\n      publicUrl:\n        patch?.publicUrl !== undefined\n          ? patch.publicUrl\n          : samePhase\n            ? (prev?.publicUrl ?? null)\n            : (prev?.publicUrl ?? null),\n    };\n    this.emit('tunnel:progress');\n  }\n\n  private clearStartProgress(): void {\n    if (!this.startProgress) return;\n    this.startProgress = null;\n    this.emit('tunnel:progress');\n  }\n\n  async buildQr(gatewayPort: number, gatewayHost: string): Promise<TunnelQrPayload> {\n    const persisted = loadTunnelState();\n    const publicUrl = persisted?.publicUrl ?? null;\n    if (!publicUrl) {\n      return { qrPayload: '', publicUrl: null, lanUrl: null };\n    }\n    const { secret, expiresAt } = createPairingSecret();\n    return buildMobileConnectQrPayload({\n      publicUrl,\n      lanUrl: resolveLanGatewayUrl(gatewayHost, gatewayPort),\n      pairingSecret: secret,\n      expiresAt: expiresAt.toISOString(),\n    });\n  }\n\n  async start(gatewayPort: number, gatewayToken: string): Promise<TunnelQrPayload> {\n    const cfg = this.serviceConfig;\n    if (!cfg) throw new Error('Tunnel service not configured');\n\n    this.stopping = false;\n    this.startContext = { gatewayPort, gatewayToken };\n    this.state = 'connecting';\n    this.lastError = null;\n    this.frpcDownload = null;\n    this.startProgress = null;\n    this.setStartPhase('preparing_frpc');\n    this.emit('tunnel:connecting');\n\n    let frpcBin: string;\n    try {\n      frpcBin = await ensureFrpcBinary({\n        onProgress: (progress) => {\n          this.frpcDownload = progress;\n          this.setStartPhase('preparing_frpc');\n        },\n      });\n      this.frpcDownload = null;\n      this.emit('tunnel:progress');\n    } catch (err) {\n      this.frpcDownload = null;\n      this.clearStartProgress();\n      this.state = 'error';\n      this.lastError = err instanceof Error ? err.message : String(err);\n      this.emit('tunnel:error', this.lastError);\n      throw err;\n    }\n    publishFrpcPathForProcess(frpcBin);\n    const persisted = loadTunnelState();\n    const broker = new TunnelBrokerClient(resolveBrokerApiBase(cfg.brokerUrl));\n\n    let registration: TunnelRegistration;\n    try {\n      this.setStartPhase('registering');\n      registration = await this.resolveRegistration(broker, cfg, gatewayToken, persisted);\n    } catch (err) {\n      this.clearStartProgress();\n      this.state = 'error';\n      this.lastError = err instanceof Error ? err.message : String(err);\n      this.emit('tunnel:error', this.lastError);\n      throw err;\n    }\n\n    const state = persistedFromRegistration(registration);\n    saveTunnelState(state);\n    this.setStartPhase('registering', { publicUrl: registration.publicUrl });\n\n    try {\n      const configPath = writeFrpcConfig(registration, gatewayPort, '127.0.0.1', 'http');\n      this.setStartPhase('starting_frpc', { publicUrl: registration.publicUrl });\n      await this.spawnAndWait(frpcBin, configPath, broker, state, registration.heartbeatIntervalMs);\n    } catch (err) {\n      this.clearStartProgress();\n      this.state = 'error';\n      this.lastError = err instanceof Error ? err.message : String(err);\n      this.emit('tunnel:error', this.lastError);\n      throw err;\n    }\n\n    this.clearStartProgress();\n    this.state = 'connected';\n    this.connectedSince = new Date().toISOString();\n    this.reconnectAttempt = 0;\n    this.emit('tunnel:connected');\n\n    const qr = await this.buildQr(gatewayPort, cfg.gatewayHost);\n    logTunnelAudit(\n      'tunnel.start',\n      {\n        subdomain: registration.subdomain,\n        publicUrl: registration.publicUrl,\n        tunnelId: registration.tunnelId,\n        gatewayTokenHash: hashGatewayToken(gatewayToken).slice(0, 12),\n      },\n      'Remote access tunnel started',\n    );\n    return qr;\n  }\n\n  async stop(opts?: { release?: boolean }): Promise<{ released: boolean }> {\n    const release = opts?.release === true;\n    this.stopping = true;\n    this.clearHeartbeat();\n    if (this.frpcHandle) {\n      await this.frpcHandle.kill();\n      this.frpcHandle = null;\n    }\n    clearFrpcPathForProcess();\n\n    let released = false;\n    const persisted = loadTunnelState();\n    const cfg = this.serviceConfig;\n    if (release && persisted && cfg) {\n      const broker = new TunnelBrokerClient(resolveBrokerApiBase(cfg.brokerUrl));\n      try {\n        await broker.deregister(persisted.tunnelId, persisted.tunnelToken);\n        released = true;\n      } catch (err) {\n        const em = err instanceof Error ? err.message : String(err);\n        log.warn({ err, tunnelId: persisted.tunnelId, phase: 'tunnel_release' }, `Tunnel deregister failed: ${em}`);\n      }\n      clearTunnelState();\n      logTunnelAudit(\n        'tunnel.release',\n        { tunnelId: persisted.tunnelId, subdomain: persisted.subdomain },\n        'Released tunnel registration and cleared local credentials',\n      );\n    } else {\n      updateTunnelState({ enabled: false });\n      logTunnelAudit(\n        'tunnel.stop',\n        { tunnelId: persisted?.tunnelId ?? null, subdomain: persisted?.subdomain ?? null },\n        'Remote access tunnel stopped (registration retained)',\n      );\n    }\n\n    this.state = 'disconnected';\n    this.connectedSince = null;\n    this.startContext = null;\n    this.clearStartProgress();\n    this.emit('tunnel:disconnected');\n    return { released };\n  }\n\n  private async resolveRegistration(\n    broker: TunnelBrokerClient,\n    cfg: TunnelServiceConfig,\n    gatewayToken: string,\n    persisted: PersistedTunnelState | null,\n  ): Promise<TunnelRegistration> {\n    if (canResumePersistedTunnel(persisted)) {\n      try {\n        await broker.heartbeat(persisted.tunnelId, persisted.tunnelToken);\n        const resumed = registrationFromPersisted(persisted);\n        if (resumed) {\n          log.info(\n            { tunnelId: persisted.tunnelId, subdomain: persisted.subdomain, phase: 'tunnel_resume' },\n            'Resumed tunnel from persisted credentials',\n          );\n          return resumed;\n        }\n      } catch (err) {\n        log.info(\n          { err, tunnelId: persisted.tunnelId, phase: 'tunnel_resume' },\n          'Persisted tunnel not resumable — registering again',\n        );\n      }\n    }\n\n    return broker.register({\n      brokerUrl: resolveBrokerApiBase(cfg.brokerUrl),\n      registrationSecret: cfg.registrationSecret,\n      gatewayVersion: PACKAGE_VERSION,\n      platform: platformLabel(),\n      gatewayTokenHash: hashGatewayToken(gatewayToken),\n      preferredSubdomain: persisted?.subdomain,\n    });\n  }\n\n  private async spawnAndWait(\n    frpcBin: string,\n    configPath: string,\n    broker: TunnelBrokerClient,\n    state: PersistedTunnelState,\n    heartbeatIntervalMs: number,\n  ): Promise<void> {\n    if (this.frpcHandle) {\n      await this.frpcHandle.kill();\n      this.frpcHandle = null;\n    }\n\n    const handle = spawnFrpcProcess(frpcBin, configPath);\n    this.frpcHandle = handle;\n\n    handle.onExit((code, signal) => {\n      if (this.stopping) return;\n      log.warn({ code, signal, pid: handle.pid }, 'frpc process exited');\n      this.clearHeartbeat();\n      this.frpcHandle = null;\n      void this.scheduleReconnect(frpcBin, configPath, broker, state, heartbeatIntervalMs);\n    });\n\n    await handle.waitForLoginSuccess;\n    this.startHeartbeat(broker, state, heartbeatIntervalMs);\n  }\n\n  private async scheduleReconnect(\n    frpcBin: string,\n    configPath: string,\n    broker: TunnelBrokerClient,\n    state: PersistedTunnelState,\n    heartbeatIntervalMs: number,\n  ): Promise<void> {\n    if (this.stopping) return;\n    const maxAttempts = 5;\n    this.reconnectAttempt += 1;\n    if (this.reconnectAttempt > maxAttempts) {\n      this.state = 'error';\n      this.lastError = 'frpc reconnect failed after maximum attempts';\n      log.error({ attempts: maxAttempts }, this.lastError);\n      this.emit('tunnel:error', this.lastError);\n      return;\n    }\n\n    this.state = 'reconnecting';\n    this.setStartPhase('reconnecting_frpc', { publicUrl: state.publicUrl ?? null });\n    const delayMs = Math.min(16_000, 1000 * 2 ** (this.reconnectAttempt - 1));\n    log.info({ attempt: this.reconnectAttempt, delayMs }, 'Scheduling frpc reconnect');\n    await new Promise((r) => setTimeout(r, delayMs));\n    if (this.stopping) return;\n\n    try {\n      await this.spawnAndWait(frpcBin, configPath, broker, state, heartbeatIntervalMs);\n      this.clearStartProgress();\n      this.state = 'connected';\n      this.reconnectAttempt = 0;\n      this.emit('tunnel:connected');\n    } catch (err) {\n      this.lastError = err instanceof Error ? err.message : String(err);\n      void this.scheduleReconnect(frpcBin, configPath, broker, state, heartbeatIntervalMs);\n    }\n  }\n\n  private startHeartbeat(\n    broker: TunnelBrokerClient,\n    state: PersistedTunnelState,\n    intervalMs: number,\n  ): void {\n    this.clearHeartbeat();\n    const tick = async () => {\n      try {\n        await broker.heartbeat(state.tunnelId, state.tunnelToken);\n        this.lastHeartbeatAt = new Date().toISOString();\n      } catch (err) {\n        log.warn({ err, tunnelId: state.tunnelId }, 'Tunnel heartbeat failed');\n        if (this.stopping) return;\n        this.clearHeartbeat();\n        const ctx = this.startContext;\n        const cfg = this.serviceConfig;\n        if (!ctx || !cfg) return;\n        try {\n          const registration = await broker.register({\n            brokerUrl: resolveBrokerApiBase(cfg.brokerUrl),\n            registrationSecret: cfg.registrationSecret,\n            gatewayVersion: PACKAGE_VERSION,\n            platform: platformLabel(),\n            gatewayTokenHash: hashGatewayToken(ctx.gatewayToken),\n            preferredSubdomain: state.subdomain,\n          });\n          const next = persistedFromRegistration(registration);\n          saveTunnelState(next);\n          const frpcBin = await ensureFrpcBinary();\n          const configPath = writeFrpcConfig(registration, ctx.gatewayPort, '127.0.0.1', 'http');\n          await this.spawnAndWait(frpcBin, configPath, broker, next, registration.heartbeatIntervalMs);\n        } catch (reErr) {\n          this.lastError = reErr instanceof Error ? reErr.message : String(reErr);\n          this.state = 'error';\n          this.emit('tunnel:error', this.lastError);\n        }\n      }\n    };\n    void tick();\n    this.heartbeatTimer = setInterval(() => void tick(), intervalMs);\n  }\n\n  private clearHeartbeat(): void {\n    if (this.heartbeatTimer) {\n      clearInterval(this.heartbeatTimer);\n      this.heartbeatTimer = null;\n    }\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;sBAGwD;aACN;AAiBlD,MAAM,MAAM,aAAa,SAAS;AAUlC,SAAgB,iBAAiB,OAAuB;AACtD,QAAO,WAAW,SAAS,CAAC,OAAO,OAAO,OAAO,CAAC,OAAO,MAAM;;AAGjE,SAAS,gBAAwB;AAC/B,QAAO,GAAG,QAAQ,SAAS,GAAG,QAAQ;;AAGxC,IAAI,YAAkC;AAEtC,SAAgB,mBAAkC;AAChD,KAAI,CAAC,UAAW,aAAY,IAAI,eAAe;AAC/C,QAAO;;AAGT,IAAa,gBAAb,cAAmC,aAAa;CAC9C,gBAAoD;CACpD,aAA+C;CAC/C,iBAAgE;CAChE,iBAAwC;CACxC,kBAAyC;CACzC,YAAmC;CACnC,QAAuC;CACvC,mBAA2B;CAC3B,WAAmB;CACnB,eAA6E;CAC7E,eAAoD;CACpD,gBAAoD;CAEpD,UAAU,KAAgC;AACxC,OAAK,gBAAgB;;CAGvB,YAA0B;EACxB,MAAM,MAAM,KAAK;EACjB,MAAM,YAAY,iBAAiB;AACnC,SAAO;GACL,SAAS,KAAK,UAAU,eAAe,KAAK,UAAU,gBAAgB,KAAK,UAAU;GACrF,OAAO,KAAK;GACZ,WAAW,WAAW,aAAa;GACnC,WAAW,WAAW,aAAa;GACnC,gBAAgB,KAAK;GACrB,SAAS,KAAK,YAAY,OAAO;GACjC,iBAAiB,KAAK;GACtB,WAAW,KAAK;GAChB,cAAc,KAAK;GACnB,eAAe,KAAK;GACpB,QAAQ;IACN,WAAW,KAAK,aAAa;IAC7B,WAAW,KAAK,aAAa;IAC7B,WAAW,EAAE,KAAK,qBAAqB;IACxC;GACF;;CAGH,cAAsB,OAAyB,OAA+D;EAC5G,MAAM,OAAO,KAAK;EAClB,MAAM,YAAY,MAAM,UAAU;AAClC,OAAK,gBAAgB;GACnB;GACA,WAAW,aAAa,OAAO,KAAK,6BAAY,IAAI,MAAM,EAAC,aAAa;GACxE,WACE,OAAO,cAAc,KAAA,IACjB,MAAM,YACN,YACG,MAAM,aAAa,OACnB,MAAM,aAAa;GAC7B;AACD,OAAK,KAAK,kBAAkB;;CAG9B,qBAAmC;AACjC,MAAI,CAAC,KAAK,cAAe;AACzB,OAAK,gBAAgB;AACrB,OAAK,KAAK,kBAAkB;;CAG9B,MAAM,QAAQ,aAAqB,aAA+C;EAEhF,MAAM,YADY,iBACS,EAAE,aAAa;AAC1C,MAAI,CAAC,UACH,QAAO;GAAE,WAAW;GAAI,WAAW;GAAM,QAAQ;GAAM;EAEzD,MAAM,EAAE,QAAQ,cAAc,qBAAqB;AACnD,SAAO,4BAA4B;GACjC;GACA,QAAQ,qBAAqB,aAAa,YAAY;GACtD,eAAe;GACf,WAAW,UAAU,aAAa;GACnC,CAAC;;CAGJ,MAAM,MAAM,aAAqB,cAAgD;EAC/E,MAAM,MAAM,KAAK;AACjB,MAAI,CAAC,IAAK,OAAM,IAAI,MAAM,gCAAgC;AAE1D,OAAK,WAAW;AAChB,OAAK,eAAe;GAAE;GAAa;GAAc;AACjD,OAAK,QAAQ;AACb,OAAK,YAAY;AACjB,OAAK,eAAe;AACpB,OAAK,gBAAgB;AACrB,OAAK,cAAc,iBAAiB;AACpC,OAAK,KAAK,oBAAoB;EAE9B,IAAI;AACJ,MAAI;AACF,aAAU,MAAM,iBAAiB,EAC/B,aAAa,aAAa;AACxB,SAAK,eAAe;AACpB,SAAK,cAAc,iBAAiB;MAEvC,CAAC;AACF,QAAK,eAAe;AACpB,QAAK,KAAK,kBAAkB;WACrB,KAAK;AACZ,QAAK,eAAe;AACpB,QAAK,oBAAoB;AACzB,QAAK,QAAQ;AACb,QAAK,YAAY,eAAe,QAAQ,IAAI,UAAU,OAAO,IAAI;AACjE,QAAK,KAAK,gBAAgB,KAAK,UAAU;AACzC,SAAM;;AAER,4BAA0B,QAAQ;EAClC,MAAM,YAAY,iBAAiB;EACnC,MAAM,SAAS,IAAI,mBAAmB,qBAAqB,IAAI,UAAU,CAAC;EAE1E,IAAI;AACJ,MAAI;AACF,QAAK,cAAc,cAAc;AACjC,kBAAe,MAAM,KAAK,oBAAoB,QAAQ,KAAK,cAAc,UAAU;WAC5E,KAAK;AACZ,QAAK,oBAAoB;AACzB,QAAK,QAAQ;AACb,QAAK,YAAY,eAAe,QAAQ,IAAI,UAAU,OAAO,IAAI;AACjE,QAAK,KAAK,gBAAgB,KAAK,UAAU;AACzC,SAAM;;EAGR,MAAM,QAAQ,0BAA0B,aAAa;AACrD,kBAAgB,MAAM;AACtB,OAAK,cAAc,eAAe,EAAE,WAAW,aAAa,WAAW,CAAC;AAExE,MAAI;GACF,MAAM,aAAa,gBAAgB,cAAc,aAAa,aAAa,OAAO;AAClF,QAAK,cAAc,iBAAiB,EAAE,WAAW,aAAa,WAAW,CAAC;AAC1E,SAAM,KAAK,aAAa,SAAS,YAAY,QAAQ,OAAO,aAAa,oBAAoB;WACtF,KAAK;AACZ,QAAK,oBAAoB;AACzB,QAAK,QAAQ;AACb,QAAK,YAAY,eAAe,QAAQ,IAAI,UAAU,OAAO,IAAI;AACjE,QAAK,KAAK,gBAAgB,KAAK,UAAU;AACzC,SAAM;;AAGR,OAAK,oBAAoB;AACzB,OAAK,QAAQ;AACb,OAAK,kCAAiB,IAAI,MAAM,EAAC,aAAa;AAC9C,OAAK,mBAAmB;AACxB,OAAK,KAAK,mBAAmB;EAE7B,MAAM,KAAK,MAAM,KAAK,QAAQ,aAAa,IAAI,YAAY;AAC3D,iBACE,gBACA;GACE,WAAW,aAAa;GACxB,WAAW,aAAa;GACxB,UAAU,aAAa;GACvB,kBAAkB,iBAAiB,aAAa,CAAC,MAAM,GAAG,GAAG;GAC9D,EACD,+BACD;AACD,SAAO;;CAGT,MAAM,KAAK,MAA8D;EACvE,MAAM,UAAU,MAAM,YAAY;AAClC,OAAK,WAAW;AAChB,OAAK,gBAAgB;AACrB,MAAI,KAAK,YAAY;AACnB,SAAM,KAAK,WAAW,MAAM;AAC5B,QAAK,aAAa;;AAEpB,2BAAyB;EAEzB,IAAI,WAAW;EACf,MAAM,YAAY,iBAAiB;EACnC,MAAM,MAAM,KAAK;AACjB,MAAI,WAAW,aAAa,KAAK;GAC/B,MAAM,SAAS,IAAI,mBAAmB,qBAAqB,IAAI,UAAU,CAAC;AAC1E,OAAI;AACF,UAAM,OAAO,WAAW,UAAU,UAAU,UAAU,YAAY;AAClE,eAAW;YACJ,KAAK;IACZ,MAAM,KAAK,eAAe,QAAQ,IAAI,UAAU,OAAO,IAAI;AAC3D,QAAI,KAAK;KAAE;KAAK,UAAU,UAAU;KAAU,OAAO;KAAkB,EAAE,6BAA6B,KAAK;;AAE7G,qBAAkB;AAClB,kBACE,kBACA;IAAE,UAAU,UAAU;IAAU,WAAW,UAAU;IAAW,EAChE,6DACD;SACI;AACL,qBAAkB,EAAE,SAAS,OAAO,CAAC;AACrC,kBACE,eACA;IAAE,UAAU,WAAW,YAAY;IAAM,WAAW,WAAW,aAAa;IAAM,EAClF,uDACD;;AAGH,OAAK,QAAQ;AACb,OAAK,iBAAiB;AACtB,OAAK,eAAe;AACpB,OAAK,oBAAoB;AACzB,OAAK,KAAK,sBAAsB;AAChC,SAAO,EAAE,UAAU;;CAGrB,MAAc,oBACZ,QACA,KACA,cACA,WAC6B;AAC7B,MAAI,yBAAyB,UAAU,CACrC,KAAI;AACF,SAAM,OAAO,UAAU,UAAU,UAAU,UAAU,YAAY;GACjE,MAAM,UAAU,0BAA0B,UAAU;AACpD,OAAI,SAAS;AACX,QAAI,KACF;KAAE,UAAU,UAAU;KAAU,WAAW,UAAU;KAAW,OAAO;KAAiB,EACxF,4CACD;AACD,WAAO;;WAEF,KAAK;AACZ,OAAI,KACF;IAAE;IAAK,UAAU,UAAU;IAAU,OAAO;IAAiB,EAC7D,qDACD;;AAIL,SAAO,OAAO,SAAS;GACrB,WAAW,qBAAqB,IAAI,UAAU;GAC9C,oBAAoB,IAAI;GACxB,gBAAgB;GAChB,UAAU,eAAe;GACzB,kBAAkB,iBAAiB,aAAa;GAChD,oBAAoB,WAAW;GAChC,CAAC;;CAGJ,MAAc,aACZ,SACA,YACA,QACA,OACA,qBACe;AACf,MAAI,KAAK,YAAY;AACnB,SAAM,KAAK,WAAW,MAAM;AAC5B,QAAK,aAAa;;EAGpB,MAAM,SAAS,iBAAiB,SAAS,WAAW;AACpD,OAAK,aAAa;AAElB,SAAO,QAAQ,MAAM,WAAW;AAC9B,OAAI,KAAK,SAAU;AACnB,OAAI,KAAK;IAAE;IAAM;IAAQ,KAAK,OAAO;IAAK,EAAE,sBAAsB;AAClE,QAAK,gBAAgB;AACrB,QAAK,aAAa;AACb,QAAK,kBAAkB,SAAS,YAAY,QAAQ,OAAO,oBAAoB;IACpF;AAEF,QAAM,OAAO;AACb,OAAK,eAAe,QAAQ,OAAO,oBAAoB;;CAGzD,MAAc,kBACZ,SACA,YACA,QACA,OACA,qBACe;AACf,MAAI,KAAK,SAAU;EACnB,MAAM,cAAc;AACpB,OAAK,oBAAoB;AACzB,MAAI,KAAK,mBAAmB,aAAa;AACvC,QAAK,QAAQ;AACb,QAAK,YAAY;AACjB,OAAI,MAAM,EAAE,UAAU,aAAa,EAAE,KAAK,UAAU;AACpD,QAAK,KAAK,gBAAgB,KAAK,UAAU;AACzC;;AAGF,OAAK,QAAQ;AACb,OAAK,cAAc,qBAAqB,EAAE,WAAW,MAAM,aAAa,MAAM,CAAC;EAC/E,MAAM,UAAU,KAAK,IAAI,MAAQ,MAAO,MAAM,KAAK,mBAAmB,GAAG;AACzE,MAAI,KAAK;GAAE,SAAS,KAAK;GAAkB;GAAS,EAAE,4BAA4B;AAClF,QAAM,IAAI,SAAS,MAAM,WAAW,GAAG,QAAQ,CAAC;AAChD,MAAI,KAAK,SAAU;AAEnB,MAAI;AACF,SAAM,KAAK,aAAa,SAAS,YAAY,QAAQ,OAAO,oBAAoB;AAChF,QAAK,oBAAoB;AACzB,QAAK,QAAQ;AACb,QAAK,mBAAmB;AACxB,QAAK,KAAK,mBAAmB;WACtB,KAAK;AACZ,QAAK,YAAY,eAAe,QAAQ,IAAI,UAAU,OAAO,IAAI;AAC5D,QAAK,kBAAkB,SAAS,YAAY,QAAQ,OAAO,oBAAoB;;;CAIxF,eACE,QACA,OACA,YACM;AACN,OAAK,gBAAgB;EACrB,MAAM,OAAO,YAAY;AACvB,OAAI;AACF,UAAM,OAAO,UAAU,MAAM,UAAU,MAAM,YAAY;AACzD,SAAK,mCAAkB,IAAI,MAAM,EAAC,aAAa;YACxC,KAAK;AACZ,QAAI,KAAK;KAAE;KAAK,UAAU,MAAM;KAAU,EAAE,0BAA0B;AACtE,QAAI,KAAK,SAAU;AACnB,SAAK,gBAAgB;IACrB,MAAM,MAAM,KAAK;IACjB,MAAM,MAAM,KAAK;AACjB,QAAI,CAAC,OAAO,CAAC,IAAK;AAClB,QAAI;KACF,MAAM,eAAe,MAAM,OAAO,SAAS;MACzC,WAAW,qBAAqB,IAAI,UAAU;MAC9C,oBAAoB,IAAI;MACxB,gBAAgB;MAChB,UAAU,eAAe;MACzB,kBAAkB,iBAAiB,IAAI,aAAa;MACpD,oBAAoB,MAAM;MAC3B,CAAC;KACF,MAAM,OAAO,0BAA0B,aAAa;AACpD,qBAAgB,KAAK;KACrB,MAAM,UAAU,MAAM,kBAAkB;KACxC,MAAM,aAAa,gBAAgB,cAAc,IAAI,aAAa,aAAa,OAAO;AACtF,WAAM,KAAK,aAAa,SAAS,YAAY,QAAQ,MAAM,aAAa,oBAAoB;aACrF,OAAO;AACd,UAAK,YAAY,iBAAiB,QAAQ,MAAM,UAAU,OAAO,MAAM;AACvE,UAAK,QAAQ;AACb,UAAK,KAAK,gBAAgB,KAAK,UAAU;;;;AAI1C,QAAM;AACX,OAAK,iBAAiB,kBAAkB,KAAK,MAAM,EAAE,WAAW;;CAGlE,iBAA+B;AAC7B,MAAI,KAAK,gBAAgB;AACvB,iBAAc,KAAK,eAAe;AAClC,QAAK,iBAAiB"}

package/dist/src/tunnel/tunnel-state.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"tunnel-state.js","names":[],"sources":["../../../src/tunnel/tunnel-state.ts"],"sourcesContent":["import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';\nimport { join } from 'node:path';\n\nimport { resolveStateDir } from '../config/paths.js';\nimport type { PersistedTunnelState } from './tunnel-types.js';\n\nconst TUNNEL_STATE_FILE = 'tunnel.json';\n\nexport function resolveTunnelStatePath(): string {\n  return join(resolveStateDir(), TUNNEL_STATE_FILE);\n}\n\nexport function loadTunnelState(): PersistedTunnelState | null {\n  const path = resolveTunnelStatePath();\n  if (!existsSync(path)) return null;\n  try {\n    const raw = readFileSync(path, 'utf8');\n    const parsed = JSON.parse(raw) as PersistedTunnelState;\n    if (!parsed.tunnelId || !parsed.tunnelToken) return null;\n    return parsed;\n  } catch {\n    return null;\n  }\n}\n\nexport function saveTunnelState(state: PersistedTunnelState): void {\n  const path = resolveTunnelStatePath();\n  mkdirSync(resolveStateDir(), { recursive: true });\n  writeFileSync(path, `${JSON.stringify(state, null, 2)}\\n`, 'utf8');\n}\n\nexport function updateTunnelState(patch: Partial<PersistedTunnelState>): PersistedTunnelState | null {\n  const current = loadTunnelState();\n  if (!current) return null;\n  const next = { ...current, ...patch };\n  saveTunnelState(next);\n  return next;\n}\n\nexport function clearTunnelState(): void {\n  const path = resolveTunnelStatePath();\n  if (existsSync(path)) {\n    writeFileSync(path, '{}\\n', 'utf8');\n  }\n}\n"],"mappings":";;;;;YAGqD;AAGrD,MAAM,oBAAoB;AAE1B,SAAgB,yBAAiC;AAC/C,QAAO,KAAK,iBAAiB,EAAE,kBAAkB;;AAGnD,SAAgB,kBAA+C;CAC7D,MAAM,OAAO,wBAAwB;AACrC,KAAI,CAAC,WAAW,KAAK,CAAE,QAAO;AAC9B,KAAI;EACF,MAAM,MAAM,aAAa,MAAM,OAAO;EACtC,MAAM,SAAS,KAAK,MAAM,IAAI;AAC9B,MAAI,CAAC,OAAO,YAAY,CAAC,OAAO,YAAa,QAAO;AACpD,SAAO;SACD;AACN,SAAO;;;AAIX,SAAgB,gBAAgB,OAAmC;CACjE,MAAM,OAAO,wBAAwB;AACrC,WAAU,iBAAiB,EAAE,EAAE,WAAW,MAAM,CAAC;AACjD,eAAc,MAAM,GAAG,KAAK,UAAU,OAAO,MAAM,EAAE,CAAC,KAAK,OAAO;;AAGpE,SAAgB,kBAAkB,OAAmE;CACnG,MAAM,UAAU,iBAAiB;AACjC,KAAI,CAAC,QAAS,QAAO;CACrB,MAAM,OAAO;EAAE,GAAG;EAAS,GAAG;EAAO;AACrC,iBAAgB,KAAK;AACrB,QAAO;;AAGT,SAAgB,mBAAyB;CACvC,MAAM,OAAO,wBAAwB;AACrC,KAAI,WAAW,KAAK,CAClB,eAAc,MAAM,QAAQ,OAAO"}

package/dist/src/tunnel/well-known.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"well-known.js","names":[],"sources":["../../../src/tunnel/well-known.ts"],"sourcesContent":["import { createLogger } from '../utils/logger.js';\n\nconst log = createLogger('Tunnel');\n\nexport type TunnelWellKnownTransport = {\n  tls: 'broker_terminated' | string;\n  publicScheme?: string;\n};\n\nexport type TunnelWellKnownConfig = {\n  brokerUrl: string;\n  frp: {\n    serverAddr: string;\n    serverPort: number;\n    subdomainHost: string;\n  };\n  frpcVersion: string;\n  heartbeatIntervalMs: number;\n  transport?: TunnelWellKnownTransport;\n};\n\nlet cached: { origin: string; config: TunnelWellKnownConfig; fetchedAt: number } | null = null;\nconst CACHE_TTL_MS = 5 * 60_000;\n\nfunction brokerOrigin(brokerUrl: string): string {\n  const u = new URL(brokerUrl.replace(/\\/+$/, '').replace(/\\/api\\/?$/, '') || brokerUrl);\n  return u.origin;\n}\n\n/**\n * Fetch `/.well-known/tunnel-config` (broker URL, frp endpoints, frpc version).\n * Registration secret is never published here — use `XOPC_TUNNEL_REGISTRATION_SECRET`.\n */\nexport async function fetchTunnelWellKnown(brokerUrl: string): Promise<TunnelWellKnownConfig> {\n  const origin = brokerOrigin(brokerUrl);\n  if (cached && cached.origin === origin && Date.now() - cached.fetchedAt < CACHE_TTL_MS) {\n    return cached.config;\n  }\n\n  const url = `${origin}/.well-known/tunnel-config`;\n  const res = await fetch(url, { signal: AbortSignal.timeout(10_000) });\n  if (!res.ok) {\n    throw new Error(`Tunnel well-known fetch failed: ${res.status} ${res.statusText}`);\n  }\n  const body = (await res.json()) as TunnelWellKnownConfig;\n  cached = { origin, config: body, fetchedAt: Date.now() };\n  log.debug({ url, brokerUrl: body.brokerUrl, transport: body.transport?.tls }, 'Loaded tunnel well-known config');\n  return body;\n}\n\nexport async function pingTunnelBroker(brokerUrl: string): Promise<boolean> {\n  try {\n    await fetchTunnelWellKnown(brokerUrl);\n    return true;\n  } catch {\n    return false;\n  }\n}\n\nexport function clearTunnelWellKnownCache(): void {\n  cached = null;\n}\n"],"mappings":";;;aAAkD;AAElD,MAAM,MAAM,aAAa,SAAS;AAmBlC,IAAI,SAAsF;AAC1F,MAAM,eAAe,IAAI;AAEzB,SAAS,aAAa,WAA2B;AAE/C,QAAO,IADO,IAAI,UAAU,QAAQ,QAAQ,GAAG,CAAC,QAAQ,aAAa,GAAG,IAAI,UACpE,CAAC;;;;;;AAOX,eAAsB,qBAAqB,WAAmD;CAC5F,MAAM,SAAS,aAAa,UAAU;AACtC,KAAI,UAAU,OAAO,WAAW,UAAU,KAAK,KAAK,GAAG,OAAO,YAAY,aACxE,QAAO,OAAO;CAGhB,MAAM,MAAM,GAAG,OAAO;CACtB,MAAM,MAAM,MAAM,MAAM,KAAK,EAAE,QAAQ,YAAY,QAAQ,IAAO,EAAE,CAAC;AACrE,KAAI,CAAC,IAAI,GACP,OAAM,IAAI,MAAM,mCAAmC,IAAI,OAAO,GAAG,IAAI,aAAa;CAEpF,MAAM,OAAQ,MAAM,IAAI,MAAM;AAC9B,UAAS;EAAE;EAAQ,QAAQ;EAAM,WAAW,KAAK,KAAK;EAAE;AACxD,KAAI,MAAM;EAAE;EAAK,WAAW,KAAK;EAAW,WAAW,KAAK,WAAW;EAAK,EAAE,kCAAkC;AAChH,QAAO;;AAGT,eAAsB,iBAAiB,WAAqC;AAC1E,KAAI;AACF,QAAM,qBAAqB,UAAU;AACrC,SAAO;SACD;AACN,SAAO;;;AAIX,SAAgB,4BAAkC;AAChD,UAAS"}

package/dist/src/user-context/config.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"config.js","names":[],"sources":["../../../src/user-context/config.ts"],"sourcesContent":["import { z } from 'zod';\n\nexport const UserMemoryModeSchema = z.enum(['off', 'readOnly', 'confirmWrite', 'auto']);\n\nexport const UserMemoryConfigSchema = z\n  .object({\n    mode: UserMemoryModeSchema.default('off'),\n    sources: z\n      .array(z.enum(['session', 'userProfile', 'agentProfile', 'curated', 'workspace', 'connectedSources']))\n      .default(['session']),\n    writePolicy: z\n      .object({\n        userProfile: z.enum(['deny', 'confirm', 'allow']).optional(),\n        agentProfile: z.enum(['deny', 'confirm', 'allow']).optional(),\n        curated: z.enum(['deny', 'confirm', 'allow']).optional(),\n        workspace: z.enum(['deny', 'confirm', 'allow']).optional(),\n      })\n      .strict()\n      .optional(),\n    retention: z\n      .object({\n        compaction: z.boolean().default(true),\n        maxAgeDays: z.number().int().positive().optional(),\n        maxItems: z.number().int().positive().optional(),\n        maxChars: z.number().int().positive().optional(),\n      })\n      .strict()\n      .optional(),\n  })\n  .strict()\n  .default({ mode: 'off', sources: ['session'] });\n\nexport const UserUnderstandingConfigSchema = z\n  .object({\n    enabled: z.boolean().default(true),\n    adaptiveCadence: z.boolean().default(true),\n    reviewIntervalTurns: z.number().int().min(1).max(1_000).default(10),\n    maxHistoryMessages: z.number().int().min(1).max(200).default(80),\n    maxDurationMs: z.number().int().min(1_000).max(600_000).default(120_000),\n  })\n  .strict()\n  .default({\n    enabled: true,\n    adaptiveCadence: true,\n    reviewIntervalTurns: 10,\n    maxHistoryMessages: 80,\n    maxDurationMs: 120_000,\n  });\n\nexport const UserContextPrivacySchema = z\n  .object({\n    sensitiveWritePolicy: z.enum(['deny', 'confirm', 'allow']).default('confirm'),\n  })\n  .strict()\n  .default({ sensitiveWritePolicy: 'confirm' });\n\nexport const UserContextProviderRoutingSchema = z\n  .object({\n    searchStrategy: z\n      .enum(['local-first', 'external-first', 'fanout', 'local-only', 'external-only'])\n      .default('fanout'),\n    writeStrategy: z\n      .enum(['local-first', 'external-first', 'write-through', 'local-only', 'external-only'])\n      .default('local-first'),\n    allowExternalWrites: z.boolean().default(false),\n    allowedProviderIds: z.array(z.string().min(1)).optional(),\n    autoWriteKinds: z.array(z.string().min(1)).optional(),\n  })\n  .strict()\n  .default({\n    searchStrategy: 'fanout',\n    writeStrategy: 'local-first',\n    allowExternalWrites: false,\n  });\n\nconst DreamingPhaseSchema = z\n  .object({\n    enabled: z.boolean().optional(),\n    cron: z.string().min(1).optional(),\n  })\n  .strict();\n\nexport const UserContextDreamingSchema = z\n  .object({\n    enabled: z.boolean().default(false),\n    frequency: z.string().min(1).optional(),\n    timezone: z.string().optional(),\n    phases: z\n      .object({\n        light: DreamingPhaseSchema.extend({\n          lookbackDays: z.number().int().positive().optional(),\n          limit: z.number().int().nonnegative().optional(),\n          dedupeSimilarity: z.number().min(0).max(1).optional(),\n        }).strict().optional(),\n        deep: DreamingPhaseSchema.extend({\n          minScore: z.number().min(0).max(1).optional(),\n          minRecallCount: z.number().int().positive().optional(),\n          minUniqueQueries: z.number().int().positive().optional(),\n          limit: z.number().int().nonnegative().optional(),\n          recencyHalfLifeDays: z.number().positive().optional(),\n          maxAgeDays: z.number().positive().optional(),\n        }).strict().optional(),\n        rem: DreamingPhaseSchema.extend({\n          lookbackDays: z.number().int().positive().optional(),\n          limit: z.number().int().nonnegative().optional(),\n          minPatternStrength: z.number().min(0).max(1).optional(),\n        }).strict().optional(),\n      })\n      .strict()\n      .optional(),\n  })\n  .strict()\n  .default({ enabled: false });\n\nexport const UserContextConfigSchema = z\n  .object({\n    enabled: z.boolean().default(true),\n    memory: UserMemoryConfigSchema,\n    understanding: UserUnderstandingConfigSchema,\n    privacy: UserContextPrivacySchema,\n    providerRouting: UserContextProviderRoutingSchema,\n    dreaming: UserContextDreamingSchema,\n  })\n  .strict()\n  .default({\n    enabled: true,\n    memory: { mode: 'confirmWrite', sources: ['session', 'curated'], writePolicy: { curated: 'confirm' } },\n    understanding: {\n      enabled: true,\n      adaptiveCadence: true,\n      reviewIntervalTurns: 10,\n      maxHistoryMessages: 80,\n      maxDurationMs: 120_000,\n    },\n    privacy: { sensitiveWritePolicy: 'confirm' },\n    providerRouting: {\n      searchStrategy: 'fanout',\n      writeStrategy: 'local-first',\n      allowExternalWrites: false,\n    },\n    dreaming: { enabled: false },\n  });\n\nexport type UserContextConfig = z.infer<typeof UserContextConfigSchema>;\n"],"mappings":";;;;;AAEa,wBAAuB,EAAE,KAAK;EAAC;EAAO;EAAY;EAAgB;EAAO,CAAC;AAE1E,0BAAyB,EACnC,OAAO;EACN,MAAM,qBAAqB,QAAQ,MAAM;EACzC,SAAS,EACN,MAAM,EAAE,KAAK;GAAC;GAAW;GAAe;GAAgB;GAAW;GAAa;GAAmB,CAAC,CAAC,CACrG,QAAQ,CAAC,UAAU,CAAC;EACvB,aAAa,EACV,OAAO;GACN,aAAa,EAAE,KAAK;IAAC;IAAQ;IAAW;IAAQ,CAAC,CAAC,UAAU;GAC5D,cAAc,EAAE,KAAK;IAAC;IAAQ;IAAW;IAAQ,CAAC,CAAC,UAAU;GAC7D,SAAS,EAAE,KAAK;IAAC;IAAQ;IAAW;IAAQ,CAAC,CAAC,UAAU;GACxD,WAAW,EAAE,KAAK;IAAC;IAAQ;IAAW;IAAQ,CAAC,CAAC,UAAU;GAC3D,CAAC,CACD,QAAQ,CACR,UAAU;EACb,WAAW,EACR,OAAO;GACN,YAAY,EAAE,SAAS,CAAC,QAAQ,KAAK;GACrC,YAAY,EAAE,QAAQ,CAAC,KAAK,CAAC,UAAU,CAAC,UAAU;GAClD,UAAU,EAAE,QAAQ,CAAC,KAAK,CAAC,UAAU,CAAC,UAAU;GAChD,UAAU,EAAE,QAAQ,CAAC,KAAK,CAAC,UAAU,CAAC,UAAU;GACjD,CAAC,CACD,QAAQ,CACR,UAAU;EACd,CAAC,CACD,QAAQ,CACR,QAAQ;EAAE,MAAM;EAAO,SAAS,CAAC,UAAU;EAAE,CAAC;AAEpC,iCAAgC,EAC1C,OAAO;EACN,SAAS,EAAE,SAAS,CAAC,QAAQ,KAAK;EAClC,iBAAiB,EAAE,SAAS,CAAC,QAAQ,KAAK;EAC1C,qBAAqB,EAAE,QAAQ,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,IAAI,IAAM,CAAC,QAAQ,GAAG;EACnE,oBAAoB,EAAE,QAAQ,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,IAAI,IAAI,CAAC,QAAQ,GAAG;EAChE,eAAe,EAAE,QAAQ,CAAC,KAAK,CAAC,IAAI,IAAM,CAAC,IAAI,IAAQ,CAAC,QAAQ,KAAQ;EACzE,CAAC,CACD,QAAQ,CACR,QAAQ;EACP,SAAS;EACT,iBAAiB;EACjB,qBAAqB;EACrB,oBAAoB;EACpB,eAAe;EAChB,CAAC;AAES,4BAA2B,EACrC,OAAO,EACN,sBAAsB,EAAE,KAAK;EAAC;EAAQ;EAAW;EAAQ,CAAC,CAAC,QAAQ,UAAU,EAC9E,CAAC,CACD,QAAQ,CACR,QAAQ,EAAE,sBAAsB,WAAW,CAAC;AAElC,oCAAmC,EAC7C,OAAO;EACN,gBAAgB,EACb,KAAK;GAAC;GAAe;GAAkB;GAAU;GAAc;GAAgB,CAAC,CAChF,QAAQ,SAAS;EACpB,eAAe,EACZ,KAAK;GAAC;GAAe;GAAkB;GAAiB;GAAc;GAAgB,CAAC,CACvF,QAAQ,cAAc;EACzB,qBAAqB,EAAE,SAAS,CAAC,QAAQ,MAAM;EAC/C,oBAAoB,EAAE,MAAM,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,UAAU;EACzD,gBAAgB,EAAE,MAAM,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,UAAU;EACtD,CAAC,CACD,QAAQ,CACR,QAAQ;EACP,gBAAgB;EAChB,eAAe;EACf,qBAAqB;EACtB,CAAC;AAEE,uBAAsB,EACzB,OAAO;EACN,SAAS,EAAE,SAAS,CAAC,UAAU;EAC/B,MAAM,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC,UAAU;EACnC,CAAC,CACD,QAAQ;AAEE,6BAA4B,EACtC,OAAO;EACN,SAAS,EAAE,SAAS,CAAC,QAAQ,MAAM;EACnC,WAAW,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC,UAAU;EACvC,UAAU,EAAE,QAAQ,CAAC,UAAU;EAC/B,QAAQ,EACL,OAAO;GACN,OAAO,oBAAoB,OAAO;IAChC,cAAc,EAAE,QAAQ,CAAC,KAAK,CAAC,UAAU,CAAC,UAAU;IACpD,OAAO,EAAE,QAAQ,CAAC,KAAK,CAAC,aAAa,CAAC,UAAU;IAChD,kBAAkB,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC,UAAU;IACtD,CAAC,CAAC,QAAQ,CAAC,UAAU;GACtB,MAAM,oBAAoB,OAAO;IAC/B,UAAU,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC,UAAU;IAC7C,gBAAgB,EAAE,QAAQ,CAAC,KAAK,CAAC,UAAU,CAAC,UAAU;IACtD,kBAAkB,EAAE,QAAQ,CAAC,KAAK,CAAC,UAAU,CAAC,UAAU;IACxD,OAAO,EAAE,QAAQ,CAAC,KAAK,CAAC,aAAa,CAAC,UAAU;IAChD,qBAAqB,EAAE,QAAQ,CAAC,UAAU,CAAC,UAAU;IACrD,YAAY,EAAE,QAAQ,CAAC,UAAU,CAAC,UAAU;IAC7C,CAAC,CAAC,QAAQ,CAAC,UAAU;GACtB,KAAK,oBAAoB,OAAO;IAC9B,cAAc,EAAE,QAAQ,CAAC,KAAK,CAAC,UAAU,CAAC,UAAU;IACpD,OAAO,EAAE,QAAQ,CAAC,KAAK,CAAC,aAAa,CAAC,UAAU;IAChD,oBAAoB,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC,UAAU;IACxD,CAAC,CAAC,QAAQ,CAAC,UAAU;GACvB,CAAC,CACD,QAAQ,CACR,UAAU;EACd,CAAC,CACD,QAAQ,CACR,QAAQ,EAAE,SAAS,OAAO,CAAC;AAEjB,2BAA0B,EACpC,OAAO;EACN,SAAS,EAAE,SAAS,CAAC,QAAQ,KAAK;EAClC,QAAQ;EACR,eAAe;EACf,SAAS;EACT,iBAAiB;EACjB,UAAU;EACX,CAAC,CACD,QAAQ,CACR,QAAQ;EACP,SAAS;EACT,QAAQ;GAAE,MAAM;GAAgB,SAAS,CAAC,WAAW,UAAU;GAAE,aAAa,EAAE,SAAS,WAAW;GAAE;EACtG,eAAe;GACb,SAAS;GACT,iBAAiB;GACjB,qBAAqB;GACrB,oBAAoB;GACpB,eAAe;GAChB;EACD,SAAS,EAAE,sBAAsB,WAAW;EAC5C,iBAAiB;GACf,gBAAgB;GAChB,eAAe;GACf,qBAAqB;GACtB;EACD,UAAU,EAAE,SAAS,OAAO;EAC7B,CAAC"}

package/dist/src/user-context/import.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"import.js","names":[],"sources":["../../../src/user-context/import.ts"],"sourcesContent":["import type { MemoryRecord } from '../agent/memory/types.js';\nimport { isUserContextMemoryKind } from './projection.js';\n\nexport type PreparedUserContextImport = {\n  statement: string;\n  kind: MemoryRecord['kind'];\n  sensitivity: NonNullable<MemoryRecord['sensitivity']>;\n  durability: MemoryRecord['durability'];\n  disclosurePolicy: MemoryRecord['disclosurePolicy'];\n};\n\nexport function prepareUserContextImport(\n  candidates: unknown[],\n  existingStatements: Iterable<string>,\n): { imports: PreparedUserContextImport[]; skippedCount: number } {\n  const known = new Set(Array.from(existingStatements, (statement) => statement.trim().toLocaleLowerCase()));\n  const imports: PreparedUserContextImport[] = [];\n  let skippedCount = 0;\n\n  for (const candidate of candidates) {\n    if (!candidate || typeof candidate !== 'object' || Array.isArray(candidate)) {\n      skippedCount += 1;\n      continue;\n    }\n    const item = candidate as Record<string, unknown>;\n    const statement = typeof item.statement === 'string' ? item.statement.trim() : '';\n    const normalized = statement.toLocaleLowerCase();\n    if (\n      !statement\n      || statement.length > 5_000\n      || known.has(normalized)\n      || item.status === 'archived'\n      || item.status === 'rejected'\n    ) {\n      skippedCount += 1;\n      continue;\n    }\n    const kind = isUserContextMemoryKind(item.kind) ? item.kind : 'preference';\n    const sensitivity = typeof item.sensitivity === 'string'\n      && ['normal', 'personal', 'secret', 'regulated'].includes(item.sensitivity)\n      ? item.sensitivity as NonNullable<MemoryRecord['sensitivity']>\n      : 'normal';\n    const durability = typeof item.durability === 'string'\n      && ['ephemeral', 'durable', 'recurring'].includes(item.durability)\n      ? item.durability as MemoryRecord['durability']\n      : 'durable';\n    known.add(normalized);\n    const disclosurePolicy = typeof item.disclosurePolicy === 'string'\n      && ['silent', 'referenceable', 'ask_before_reference'].includes(item.disclosurePolicy)\n      ? item.disclosurePolicy as MemoryRecord['disclosurePolicy']\n      : 'referenceable';\n    imports.push({ statement, kind, sensitivity, durability, disclosurePolicy });\n  }\n\n  return { imports, skippedCount };\n}\n"],"mappings":";;AAWA,SAAgB,yBACd,YACA,oBACgE;CAChE,MAAM,QAAQ,IAAI,IAAI,MAAM,KAAK,qBAAqB,cAAc,UAAU,MAAM,CAAC,mBAAmB,CAAC,CAAC;CAC1G,MAAM,UAAuC,EAAE;CAC/C,IAAI,eAAe;AAEnB,MAAK,MAAM,aAAa,YAAY;AAClC,MAAI,CAAC,aAAa,OAAO,cAAc,YAAY,MAAM,QAAQ,UAAU,EAAE;AAC3E,mBAAgB;AAChB;;EAEF,MAAM,OAAO;EACb,MAAM,YAAY,OAAO,KAAK,cAAc,WAAW,KAAK,UAAU,MAAM,GAAG;EAC/E,MAAM,aAAa,UAAU,mBAAmB;AAChD,MACE,CAAC,aACE,UAAU,SAAS,OACnB,MAAM,IAAI,WAAW,IACrB,KAAK,WAAW,cAChB,KAAK,WAAW,YACnB;AACA,mBAAgB;AAChB;;EAEF,MAAM,OAAO,wBAAwB,KAAK,KAAK,GAAG,KAAK,OAAO;EAC9D,MAAM,cAAc,OAAO,KAAK,gBAAgB,YAC3C;GAAC;GAAU;GAAY;GAAU;GAAY,CAAC,SAAS,KAAK,YAAY,GACzE,KAAK,cACL;EACJ,MAAM,aAAa,OAAO,KAAK,eAAe,YACzC;GAAC;GAAa;GAAW;GAAY,CAAC,SAAS,KAAK,WAAW,GAChE,KAAK,aACL;AACJ,QAAM,IAAI,WAAW;EACrB,MAAM,mBAAmB,OAAO,KAAK,qBAAqB,YACrD;GAAC;GAAU;GAAiB;GAAuB,CAAC,SAAS,KAAK,iBAAiB,GACpF,KAAK,mBACL;AACJ,UAAQ,KAAK;GAAE;GAAW;GAAM;GAAa;GAAY;GAAkB,CAAC;;AAG9E,QAAO;EAAE;EAAS;EAAc"}

package/dist/src/user-context/owner.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"owner.js","names":[],"sources":["../../../src/user-context/owner.ts"],"sourcesContent":["export const LOCAL_USER_ID = 'local-owner';\n\nexport interface UserContextOwner {\n  userId: string;\n}\n\nexport function resolveLocalUserContextOwner(): UserContextOwner {\n  return { userId: LOCAL_USER_ID };\n}\n"],"mappings":";AAAA,MAAa,gBAAgB;AAM7B,SAAgB,+BAAiD;AAC/D,QAAO,EAAE,QAAQ,eAAe"}

package/dist/src/user-context/profile.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"profile.js","names":["os"],"sources":["../../../src/user-context/profile.ts"],"sourcesContent":["import { createHash } from 'node:crypto';\nimport * as os from 'node:os';\n\nimport type { Config } from '../config/schema.js';\n\nexport type UserProfileFields = {\n  callName: string;\n  pronouns: string;\n  timezone: string;\n  notes: string;\n};\n\nexport type UserProfileSuggestion = {\n  id: string;\n  value: string;\n  source: 'gateway_os';\n  confidence: 'medium';\n};\n\nexport type UserProfilePromptState = {\n  state: 'active' | 'snoozed';\n  suggestionHash?: string;\n  snoozedUntil?: string;\n  updatedAt?: string;\n};\n\nexport type UserProfileSetup = {\n  missing: Array<keyof UserProfileFields>;\n  shouldPrompt: boolean;\n  state: 'complete' | 'active' | 'snoozed';\n  callNameSuggestion?: UserProfileSuggestion;\n  snoozedUntil?: string;\n};\n\nconst EMPTY_PROFILE: UserProfileFields = {\n  callName: '',\n  pronouns: '',\n  timezone: '',\n  notes: '',\n};\n\nconst TECHNICAL_USER_NAMES = new Set([\n  'admin',\n  'administrator',\n  'app',\n  'daemon',\n  'defaultuser0',\n  'guest',\n  'nobody',\n  'node',\n  'owner',\n  'root',\n  'runner',\n  'service',\n  'system',\n  'ubuntu',\n  'user',\n  'wdagutilityaccount',\n  'www-data',\n  'xopc',\n]);\n\nfunction markdownField(line: string): { label: string; value: string } | undefined {\n  const match = line.match(/^[-*]\\s+\\*\\*(.+?):\\*\\*\\s*(.*)$/i);\n  if (!match) return undefined;\n  return { label: match[1]!.trim().toLowerCase(), value: match[2]!.trim() };\n}\n\nfunction contextSection(lines: string[]): { start: number; end: number } | undefined {\n  const heading = lines.findIndex((line) => /^##\\s+Context\\s*$/i.test(line.trim()));\n  if (heading < 0) return undefined;\n  const nextHeadingOffset = lines.slice(heading + 1).findIndex((line) => /^##\\s+/.test(line.trim()));\n  return {\n    start: heading,\n    end: nextHeadingOffset < 0 ? lines.length : heading + 1 + nextHeadingOffset,\n  };\n}\n\nexport function parseUserProfileMarkdown(content: string): UserProfileFields {\n  if (!content.trim()) return { ...EMPTY_PROFILE };\n  const profile = { ...EMPTY_PROFILE };\n  let nameFallback = '';\n  let preferredName = '';\n  const lines = content.replace(/\\r\\n/g, '\\n').split('\\n');\n  for (const line of lines) {\n    const field = markdownField(line);\n    if (!field) continue;\n    if (field.label === 'name') nameFallback = field.value;\n    if (field.label === 'what to call them') preferredName = field.value;\n    if (field.label === 'pronouns') profile.pronouns = field.value;\n    if (field.label === 'timezone') profile.timezone = field.value;\n    if (field.label === 'notes') profile.notes = field.value;\n  }\n  profile.callName = preferredName || nameFallback;\n  const context = contextSection(lines);\n  if (context && !profile.notes) {\n    profile.notes = lines\n      .slice(context.start + 1, context.end)\n      .join('\\n')\n      .replace(/^_\\(.*?\\)_\\s*$/gm, '')\n      .replace(/^---\\s*$/gm, '')\n      .trim();\n  }\n  return profile;\n}\n\nexport function serializeUserProfileMarkdown(profile: UserProfileFields): string {\n  const lines = [\n    '# PROFILE.md - About You',\n    '',\n    `- **Name:** ${profile.callName.trim()}`,\n    `- **Pronouns:** ${profile.pronouns.trim()}`,\n    `- **Timezone:** ${profile.timezone.trim()}`,\n    '',\n  ];\n  if (profile.notes.trim()) lines.push('## Context', '', profile.notes.trim(), '');\n  return lines.join('\\n');\n}\n\nfunction patchSimpleField(\n  lines: string[],\n  labels: string[],\n  insertLabel: string,\n  value: string,\n  updateEveryMatch = false,\n): void {\n  const matches = lines.flatMap((line, index) => {\n    const field = markdownField(line);\n    return field && labels.includes(field.label) ? [index] : [];\n  });\n  const targets = updateEveryMatch ? matches : matches.slice(-1);\n  if (targets.length > 0) {\n    for (const index of targets) {\n      const label = lines[index]!.match(/^[-*]\\s+\\*\\*(.+?):\\*\\*/i)?.[1] ?? insertLabel;\n      lines[index] = `- **${label}:** ${value}`;\n    }\n    return;\n  }\n  const context = contextSection(lines);\n  const insertAt = context?.start ?? lines.length;\n  lines.splice(insertAt, 0, `- **${insertLabel}:** ${value}`, '');\n}\n\nexport function patchUserProfileMarkdown(\n  content: string,\n  patch: Partial<UserProfileFields>,\n): string {\n  if (!content.trim()) return serializeUserProfileMarkdown({ ...EMPTY_PROFILE, ...patch });\n  const lines = content.replace(/\\r\\n/g, '\\n').split('\\n');\n  if (patch.callName !== undefined) {\n    const hasPreferred = lines.some((line) => markdownField(line)?.label === 'what to call them');\n    patchSimpleField(\n      lines,\n      hasPreferred ? ['what to call them'] : ['name'],\n      hasPreferred ? 'What to call them' : 'Name',\n      patch.callName.trim(),\n      patch.callName.trim().length === 0,\n    );\n    if (patch.callName.trim().length === 0 && hasPreferred) {\n      patchSimpleField(lines, ['name'], 'Name', '', true);\n    }\n  }\n  if (patch.pronouns !== undefined) {\n    patchSimpleField(lines, ['pronouns'], 'Pronouns', patch.pronouns.trim());\n  }\n  if (patch.timezone !== undefined) {\n    patchSimpleField(lines, ['timezone'], 'Timezone', patch.timezone.trim());\n  }\n  if (patch.notes !== undefined) {\n    const context = contextSection(lines);\n    const replacement = patch.notes.trim() ? ['## Context', '', patch.notes.trim(), ''] : [];\n    if (context) lines.splice(context.start, context.end - context.start, ...replacement);\n    else if (replacement.length > 0) lines.push('', ...replacement);\n  }\n  return lines.join('\\n').replace(/\\n{4,}/g, '\\n\\n\\n').trimEnd() + '\\n';\n}\n\nexport function normalizeGatewayUserName(raw: string): string | undefined {\n  const account = raw.trim().split(/[\\\\/]/).at(-1)?.split('@')[0]?.trim() ?? '';\n  if (!account || account.length < 2 || account.length > 40) return undefined;\n  const normalizedKey = account.toLowerCase();\n  if (TECHNICAL_USER_NAMES.has(normalizedKey) || account.endsWith('$')) return undefined;\n  if (/^\\d+$/.test(account) || /^[0-9a-f]{8,}$/i.test(account)) return undefined;\n  const digits = [...account].filter((character) => /\\d/.test(character)).length;\n  if (digits / account.length > 0.35) return undefined;\n  const friendly = account.replace(/[._-]+/g, ' ').replace(/\\s+/g, ' ').trim();\n  if (!friendly) return undefined;\n  return friendly.replace(/\\b[a-z]/g, (character) => character.toUpperCase());\n}\n\nexport function detectGatewayCallNameSuggestion(config: Config): UserProfileSuggestion | undefined {\n  if (config.gateway?.auth?.mode === 'trusted-proxy') return undefined;\n  try {\n    const value = normalizeGatewayUserName(os.userInfo().username);\n    if (!value) return undefined;\n    const id = createHash('sha256').update(`gateway_os:${value}`).digest('hex').slice(0, 16);\n    return { id, value, source: 'gateway_os', confidence: 'medium' };\n  } catch {\n    return undefined;\n  }\n}\n\nexport function buildUserProfileSetup(input: {\n  profile: UserProfileFields;\n  promptState: UserProfilePromptState;\n  config: Config;\n  now?: Date;\n}): UserProfileSetup {\n  const missing = (Object.keys(input.profile) as Array<keyof UserProfileFields>)\n    .filter((field) => !input.profile[field].trim());\n  if (!missing.includes('callName')) return { missing, shouldPrompt: false, state: 'complete' };\n  const now = input.now ?? new Date();\n  const snoozed = input.promptState.state === 'snoozed'\n    && Boolean(input.promptState.snoozedUntil)\n    && Date.parse(input.promptState.snoozedUntil!) > now.getTime();\n  const suggestion = detectGatewayCallNameSuggestion(input.config);\n  return {\n    missing,\n    shouldPrompt: !snoozed,\n    state: snoozed ? 'snoozed' : 'active',\n    callNameSuggestion: suggestion,\n    snoozedUntil: snoozed ? input.promptState.snoozedUntil : undefined,\n  };\n}\n"],"mappings":";;;AAkCA,MAAM,gBAAmC;CACvC,UAAU;CACV,UAAU;CACV,UAAU;CACV,OAAO;CACR;AAED,MAAM,uBAAuB,IAAI,IAAI;CACnC;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACD,CAAC;AAEF,SAAS,cAAc,MAA4D;CACjF,MAAM,QAAQ,KAAK,MAAM,kCAAkC;AAC3D,KAAI,CAAC,MAAO,QAAO,KAAA;AACnB,QAAO;EAAE,OAAO,MAAM,GAAI,MAAM,CAAC,aAAa;EAAE,OAAO,MAAM,GAAI,MAAM;EAAE;;AAG3E,SAAS,eAAe,OAA6D;CACnF,MAAM,UAAU,MAAM,WAAW,SAAS,qBAAqB,KAAK,KAAK,MAAM,CAAC,CAAC;AACjF,KAAI,UAAU,EAAG,QAAO,KAAA;CACxB,MAAM,oBAAoB,MAAM,MAAM,UAAU,EAAE,CAAC,WAAW,SAAS,SAAS,KAAK,KAAK,MAAM,CAAC,CAAC;AAClG,QAAO;EACL,OAAO;EACP,KAAK,oBAAoB,IAAI,MAAM,SAAS,UAAU,IAAI;EAC3D;;AAGH,SAAgB,yBAAyB,SAAoC;AAC3E,KAAI,CAAC,QAAQ,MAAM,CAAE,QAAO,EAAE,GAAG,eAAe;CAChD,MAAM,UAAU,EAAE,GAAG,eAAe;CACpC,IAAI,eAAe;CACnB,IAAI,gBAAgB;CACpB,MAAM,QAAQ,QAAQ,QAAQ,SAAS,KAAK,CAAC,MAAM,KAAK;AACxD,MAAK,MAAM,QAAQ,OAAO;EACxB,MAAM,QAAQ,cAAc,KAAK;AACjC,MAAI,CAAC,MAAO;AACZ,MAAI,MAAM,UAAU,OAAQ,gBAAe,MAAM;AACjD,MAAI,MAAM,UAAU,oBAAqB,iBAAgB,MAAM;AAC/D,MAAI,MAAM,UAAU,WAAY,SAAQ,WAAW,MAAM;AACzD,MAAI,MAAM,UAAU,WAAY,SAAQ,WAAW,MAAM;AACzD,MAAI,MAAM,UAAU,QAAS,SAAQ,QAAQ,MAAM;;AAErD,SAAQ,WAAW,iBAAiB;CACpC,MAAM,UAAU,eAAe,MAAM;AACrC,KAAI,WAAW,CAAC,QAAQ,MACtB,SAAQ,QAAQ,MACb,MAAM,QAAQ,QAAQ,GAAG,QAAQ,IAAI,CACrC,KAAK,KAAK,CACV,QAAQ,oBAAoB,GAAG,CAC/B,QAAQ,cAAc,GAAG,CACzB,MAAM;AAEX,QAAO;;AAGT,SAAgB,6BAA6B,SAAoC;CAC/E,MAAM,QAAQ;EACZ;EACA;EACA,eAAe,QAAQ,SAAS,MAAM;EACtC,mBAAmB,QAAQ,SAAS,MAAM;EAC1C,mBAAmB,QAAQ,SAAS,MAAM;EAC1C;EACD;AACD,KAAI,QAAQ,MAAM,MAAM,CAAE,OAAM,KAAK,cAAc,IAAI,QAAQ,MAAM,MAAM,EAAE,GAAG;AAChF,QAAO,MAAM,KAAK,KAAK;;AAGzB,SAAS,iBACP,OACA,QACA,aACA,OACA,mBAAmB,OACb;CACN,MAAM,UAAU,MAAM,SAAS,MAAM,UAAU;EAC7C,MAAM,QAAQ,cAAc,KAAK;AACjC,SAAO,SAAS,OAAO,SAAS,MAAM,MAAM,GAAG,CAAC,MAAM,GAAG,EAAE;GAC3D;CACF,MAAM,UAAU,mBAAmB,UAAU,QAAQ,MAAM,GAAG;AAC9D,KAAI,QAAQ,SAAS,GAAG;AACtB,OAAK,MAAM,SAAS,QAElB,OAAM,SAAS,OADD,MAAM,OAAQ,MAAM,0BAA0B,GAAG,MAAM,YACzC,MAAM;AAEpC;;CAGF,MAAM,WADU,eAAe,MACP,EAAE,SAAS,MAAM;AACzC,OAAM,OAAO,UAAU,GAAG,OAAO,YAAY,MAAM,SAAS,GAAG;;AAGjE,SAAgB,yBACd,SACA,OACQ;AACR,KAAI,CAAC,QAAQ,MAAM,CAAE,QAAO,6BAA6B;EAAE,GAAG;EAAe,GAAG;EAAO,CAAC;CACxF,MAAM,QAAQ,QAAQ,QAAQ,SAAS,KAAK,CAAC,MAAM,KAAK;AACxD,KAAI,MAAM,aAAa,KAAA,GAAW;EAChC,MAAM,eAAe,MAAM,MAAM,SAAS,cAAc,KAAK,EAAE,UAAU,oBAAoB;AAC7F,mBACE,OACA,eAAe,CAAC,oBAAoB,GAAG,CAAC,OAAO,EAC/C,eAAe,sBAAsB,QACrC,MAAM,SAAS,MAAM,EACrB,MAAM,SAAS,MAAM,CAAC,WAAW,EAClC;AACD,MAAI,MAAM,SAAS,MAAM,CAAC,WAAW,KAAK,aACxC,kBAAiB,OAAO,CAAC,OAAO,EAAE,QAAQ,IAAI,KAAK;;AAGvD,KAAI,MAAM,aAAa,KAAA,EACrB,kBAAiB,OAAO,CAAC,WAAW,EAAE,YAAY,MAAM,SAAS,MAAM,CAAC;AAE1E,KAAI,MAAM,aAAa,KAAA,EACrB,kBAAiB,OAAO,CAAC,WAAW,EAAE,YAAY,MAAM,SAAS,MAAM,CAAC;AAE1E,KAAI,MAAM,UAAU,KAAA,GAAW;EAC7B,MAAM,UAAU,eAAe,MAAM;EACrC,MAAM,cAAc,MAAM,MAAM,MAAM,GAAG;GAAC;GAAc;GAAI,MAAM,MAAM,MAAM;GAAE;GAAG,GAAG,EAAE;AACxF,MAAI,QAAS,OAAM,OAAO,QAAQ,OAAO,QAAQ,MAAM,QAAQ,OAAO,GAAG,YAAY;WAC5E,YAAY,SAAS,EAAG,OAAM,KAAK,IAAI,GAAG,YAAY;;AAEjE,QAAO,MAAM,KAAK,KAAK,CAAC,QAAQ,WAAW,SAAS,CAAC,SAAS,GAAG;;AAGnE,SAAgB,yBAAyB,KAAiC;CACxE,MAAM,UAAU,IAAI,MAAM,CAAC,MAAM,QAAQ,CAAC,GAAG,GAAG,EAAE,MAAM,IAAI,CAAC,IAAI,MAAM,IAAI;AAC3E,KAAI,CAAC,WAAW,QAAQ,SAAS,KAAK,QAAQ,SAAS,GAAI,QAAO,KAAA;CAClE,MAAM,gBAAgB,QAAQ,aAAa;AAC3C,KAAI,qBAAqB,IAAI,cAAc,IAAI,QAAQ,SAAS,IAAI,CAAE,QAAO,KAAA;AAC7E,KAAI,QAAQ,KAAK,QAAQ,IAAI,kBAAkB,KAAK,QAAQ,CAAE,QAAO,KAAA;AAErE,KADe,CAAC,GAAG,QAAQ,CAAC,QAAQ,cAAc,KAAK,KAAK,UAAU,CAAC,CAAC,SAC3D,QAAQ,SAAS,IAAM,QAAO,KAAA;CAC3C,MAAM,WAAW,QAAQ,QAAQ,WAAW,IAAI,CAAC,QAAQ,QAAQ,IAAI,CAAC,MAAM;AAC5E,KAAI,CAAC,SAAU,QAAO,KAAA;AACtB,QAAO,SAAS,QAAQ,aAAa,cAAc,UAAU,aAAa,CAAC;;AAG7E,SAAgB,gCAAgC,QAAmD;AACjG,KAAI,OAAO,SAAS,MAAM,SAAS,gBAAiB,QAAO,KAAA;AAC3D,KAAI;EACF,MAAM,QAAQ,yBAAyBA,KAAG,UAAU,CAAC,SAAS;AAC9D,MAAI,CAAC,MAAO,QAAO,KAAA;AAEnB,SAAO;GAAE,IADE,WAAW,SAAS,CAAC,OAAO,cAAc,QAAQ,CAAC,OAAO,MAAM,CAAC,MAAM,GAAG,GAC1E;GAAE;GAAO,QAAQ;GAAc,YAAY;GAAU;SAC1D;AACN;;;AAIJ,SAAgB,sBAAsB,OAKjB;CACnB,MAAM,UAAW,OAAO,KAAK,MAAM,QAAQ,CACxC,QAAQ,UAAU,CAAC,MAAM,QAAQ,OAAO,MAAM,CAAC;AAClD,KAAI,CAAC,QAAQ,SAAS,WAAW,CAAE,QAAO;EAAE;EAAS,cAAc;EAAO,OAAO;EAAY;CAC7F,MAAM,MAAM,MAAM,uBAAO,IAAI,MAAM;CACnC,MAAM,UAAU,MAAM,YAAY,UAAU,aACvC,QAAQ,MAAM,YAAY,aAAa,IACvC,KAAK,MAAM,MAAM,YAAY,aAAc,GAAG,IAAI,SAAS;CAChE,MAAM,aAAa,gCAAgC,MAAM,OAAO;AAChE,QAAO;EACL;EACA,cAAc,CAAC;EACf,OAAO,UAAU,YAAY;EAC7B,oBAAoB;EACpB,cAAc,UAAU,MAAM,YAAY,eAAe,KAAA;EAC1D"}

package/dist/src/user-context/projection.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"projection.js","names":[],"sources":["../../../src/user-context/projection.ts"],"sourcesContent":["import type { MemoryKind, MemoryRecord } from '../agent/memory/types.js';\nimport { effectiveMemoryStatus, resolveMemoryStability } from '../agent/memory/lifecycle.js';\nimport { classifyMemoryContextOrigin } from '../agent/memory/source-origin.js';\nimport type { ConnectorConnection, ConnectorDefinition, ConnectorInstance } from '../connectors/types.js';\nimport type { KnowledgeSourceItem, KnowledgeSyncRun } from '../knowledge/types.js';\n\nexport type UserContextFacet =\n  | 'basics'\n  | 'collaboration'\n  | 'boundaries'\n  | 'priorities'\n  | 'people'\n  | 'current';\n\nexport type UserContextOrigin = 'told_by_you' | 'observed' | 'inferred' | 'connected_source';\n\nconst ALWAYS_PERSONAL_KINDS = new Set<MemoryKind>([\n  'user_profile',\n  'preference',\n  'boundary',\n  'relationship',\n  'commitment',\n  'routine',\n  'personal_logistics',\n  'current_state',\n  'tool_preference',\n  'long_term_goal',\n]);\n\nconst CONTEXTUAL_USER_KINDS = new Set<MemoryKind>([\n  'project_context',\n  'open_question',\n  'milestone',\n  'derived_insight',\n  'task_lesson',\n]);\n\nexport function isUserContextRecord(record: MemoryRecord): boolean {\n  if (ALWAYS_PERSONAL_KINDS.has(record.kind)) return true;\n  return CONTEXTUAL_USER_KINDS.has(record.kind) && record.tags?.includes('user-understanding') === true;\n}\n\nexport function isUserContextMemoryKind(value: unknown): value is MemoryKind {\n  return typeof value === 'string'\n    && (ALWAYS_PERSONAL_KINDS.has(value as MemoryKind) || CONTEXTUAL_USER_KINDS.has(value as MemoryKind));\n}\n\nexport function facetForMemoryKind(kind: MemoryKind): UserContextFacet {\n  if (kind === 'user_profile' || kind === 'personal_logistics') return 'basics';\n  if (kind === 'preference' || kind === 'routine' || kind === 'tool_preference' || kind === 'task_lesson') {\n    return 'collaboration';\n  }\n  if (kind === 'boundary') return 'boundaries';\n  if (kind === 'relationship') return 'people';\n  if (kind === 'current_state' || kind === 'open_question') return 'current';\n  return 'priorities';\n}\n\nexport function originForMemoryRecord(record: MemoryRecord): UserContextOrigin {\n  const origin = classifyMemoryContextOrigin(record);\n  return origin === 'told_by_user' ? 'told_by_you' : origin;\n}\n\nexport function projectUserContextRecord(record: MemoryRecord) {\n  const lifecycle = resolveMemoryStability(record);\n  const latestEvidenceAt = record.evidence\n    ?.map((evidence) => evidence.observedAt)\n    .filter((value): value is string => Boolean(value))\n    .sort()\n    .at(-1);\n  return {\n    id: record.id,\n    statement: record.content,\n    facet: facetForMemoryKind(record.kind),\n    kind: record.kind,\n    status: effectiveMemoryStatus(record),\n    origin: originForMemoryRecord(record),\n    sourceName: record.source.provider ?? 'local',\n    updatedAt: record.updatedAt,\n    sensitivity: record.sensitivity ?? 'normal',\n    explicitness: record.explicitness,\n    durability: record.durability,\n    disclosurePolicy: record.disclosurePolicy,\n    stability: lifecycle.band,\n    stabilityScore: lifecycle.score,\n    reviewAt: lifecycle.reviewAt,\n    reviewDue: lifecycle.reviewDue,\n    evidenceCount: record.evidence?.length ?? 0,\n    sourcePath: record.source.path,\n    latestEvidenceAt,\n  };\n}\n\nexport function isPersonalContextConnector(definition: ConnectorDefinition): boolean {\n  return definition.capabilities.includes('context') || definition.capabilities.includes('memory_source');\n}\n\nexport function recordsDerivedFromPersonalContextSource(\n  records: MemoryRecord[],\n  sourceInstanceId: string,\n): MemoryRecord[] {\n  return records.filter((record) => (\n    record.source.sourceInstanceId === sourceInstanceId\n    && isUserContextRecord(record)\n  ));\n}\n\nexport function projectPersonalContextSources(\n  definitions: ConnectorDefinition[],\n  instances: ConnectorInstance[],\n  records: MemoryRecord[] = [],\n  knowledge: {\n    sourceItems?: KnowledgeSourceItem[];\n    syncRuns?: KnowledgeSyncRun[];\n    connections?: ConnectorConnection[];\n  } = {},\n) {\n  const instanceByConnector = new Map<string, ConnectorInstance[]>();\n  for (const instance of instances) {\n    const current = instanceByConnector.get(instance.connectorId) ?? [];\n    current.push(instance);\n    instanceByConnector.set(instance.connectorId, current);\n  }\n  return definitions\n    .filter(isPersonalContextConnector)\n    .flatMap((definition) => {\n      const connected = instanceByConnector.get(definition.id) ?? [];\n      const accounts = (knowledge.connections ?? []).filter((connection) => (\n        connection.provider === 'composio'\n        && connection.connectorId === definition.id\n        && connection.status !== 'revoked'\n      ));\n      const rows = accounts.length > 0\n        ? accounts.map((connection) => ({\n            instanceId: connection.id,\n            sourceInstanceId: `composio:${definition.id}:${connection.id}`,\n            accountLabel: connection.alias\n              ?? (typeof connection.identity.email === 'string' ? connection.identity.email : undefined)\n              ?? (typeof connection.identity.username === 'string' ? connection.identity.username : undefined),\n            enabled: connection.status === 'active',\n            status: connection.status,\n            lastConnectedAt: connection.connectedAt,\n            instances: connected,\n          }))\n        : connected.length > 0\n          ? connected.map((instance) => ({\n              instanceId: instance.instanceId,\n              sourceInstanceId: instance.instanceId,\n              accountLabel: undefined,\n              enabled: instance.enabled,\n              status: instance.status,\n              lastConnectedAt: instance.lastConnectedAt,\n              instances: [instance],\n            }))\n          : [{\n              instanceId: undefined,\n              sourceInstanceId: undefined,\n              accountLabel: undefined,\n              enabled: false,\n              status: 'not_installed',\n              lastConnectedAt: undefined,\n              instances: [] as ConnectorInstance[],\n            }];\n      return rows.map((row) => {\n      const relatedRecords = row.sourceInstanceId\n        ? records.filter((record) => record.source.sourceInstanceId === row.sourceInstanceId)\n        : [];\n      const sourceItems = row.sourceInstanceId\n        ? (knowledge.sourceItems ?? []).filter((item) => item.sourceInstanceId === row.sourceInstanceId)\n        : [];\n      const latestSync = (knowledge.syncRuns ?? [])\n        .filter((run) => run.sourceInstanceId === row.sourceInstanceId)\n        .sort((left, right) => Date.parse(right.startedAt) - Date.parse(left.startedAt))[0];\n      const latestHealth = row.instances\n        .filter((instance) => instance.usage.lastHealthCheckAt && instance.usage.lastHealthStatus)\n        .sort((left, right) => (\n          Date.parse(right.usage.lastHealthCheckAt!) - Date.parse(left.usage.lastHealthCheckAt!)\n        ))[0]?.usage;\n      const permissionDetails = definition.permissions?.data ?? [];\n      const canWrite = permissionDetails.some((permission) => (\n        /(?:^|[.:/_-])(write|create|update|delete|manage|send|admin)(?:$|[.:/_-])/i.test(permission)\n      ));\n      return {\n        id: definition.id,\n        accountLabel: row.accountLabel,\n        displayName: definition.displayName,\n        description: definition.description,\n        ...(definition.branding ? { branding: definition.branding } : {}),\n        category: definition.category,\n        capabilities: definition.capabilities.filter((capability) => (\n          capability === 'context' || capability === 'memory_source' || capability === 'tools' || capability === 'events'\n        )),\n        access: {\n          context: definition.capabilities.includes('context'),\n          memory: definition.capabilities.includes('memory_source'),\n          read: definition.capabilities.includes('context')\n            || definition.capabilities.includes('resources')\n            || definition.capabilities.includes('tools'),\n          write: canWrite,\n        },\n        permissionDetails,\n        installed: row.instanceId !== undefined,\n        enabled: row.enabled,\n        status: row.status,\n        instanceId: row.instanceId,\n        lastConnectedAt: row.lastConnectedAt,\n        lastHealthCheckAt: latestHealth?.lastHealthCheckAt,\n        lastHealthStatus: latestHealth?.lastHealthStatus,\n        lastActivityAt: [\n          ...row.instances.flatMap((instance) => [\n            instance.lastConnectedAt,\n            instance.usage.lastHealthCheckAt,\n            ...instance.audit.map((entry) => entry.at),\n          ]),\n          latestSync?.finishedAt,\n          latestSync?.startedAt,\n        ]\n          .filter((value): value is string => Boolean(value))\n          .sort()\n          .at(-1),\n        derivedUnderstandingCount: relatedRecords.length,\n        knowledgeItemCount: sourceItems.filter((item) => !item.deletedAt).length,\n        lastSyncAt: latestSync?.finishedAt ?? latestSync?.startedAt,\n        lastSyncStatus: latestSync?.status,\n        lastSyncError: latestSync?.error,\n      };\n      });\n    })\n    .sort((left, right) => {\n      if (left.installed !== right.installed) return left.installed ? -1 : 1;\n      return left.displayName.localeCompare(right.displayName);\n    });\n}\n"],"mappings":";;;AAgBA,MAAM,wBAAwB,IAAI,IAAgB;CAChD;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACD,CAAC;AAEF,MAAM,wBAAwB,IAAI,IAAgB;CAChD;CACA;CACA;CACA;CACA;CACD,CAAC;AAEF,SAAgB,oBAAoB,QAA+B;AACjE,KAAI,sBAAsB,IAAI,OAAO,KAAK,CAAE,QAAO;AACnD,QAAO,sBAAsB,IAAI,OAAO,KAAK,IAAI,OAAO,MAAM,SAAS,qBAAqB,KAAK;;AAGnG,SAAgB,wBAAwB,OAAqC;AAC3E,QAAO,OAAO,UAAU,aAClB,sBAAsB,IAAI,MAAoB,IAAI,sBAAsB,IAAI,MAAoB;;AAGxG,SAAgB,mBAAmB,MAAoC;AACrE,KAAI,SAAS,kBAAkB,SAAS,qBAAsB,QAAO;AACrE,KAAI,SAAS,gBAAgB,SAAS,aAAa,SAAS,qBAAqB,SAAS,cACxF,QAAO;AAET,KAAI,SAAS,WAAY,QAAO;AAChC,KAAI,SAAS,eAAgB,QAAO;AACpC,KAAI,SAAS,mBAAmB,SAAS,gBAAiB,QAAO;AACjE,QAAO;;AAGT,SAAgB,sBAAsB,QAAyC;CAC7E,MAAM,SAAS,4BAA4B,OAAO;AAClD,QAAO,WAAW,iBAAiB,gBAAgB;;AAGrD,SAAgB,yBAAyB,QAAsB;CAC7D,MAAM,YAAY,uBAAuB,OAAO;CAChD,MAAM,mBAAmB,OAAO,UAC5B,KAAK,aAAa,SAAS,WAAW,CACvC,QAAQ,UAA2B,QAAQ,MAAM,CAAC,CAClD,MAAM,CACN,GAAG,GAAG;AACT,QAAO;EACL,IAAI,OAAO;EACX,WAAW,OAAO;EAClB,OAAO,mBAAmB,OAAO,KAAK;EACtC,MAAM,OAAO;EACb,QAAQ,sBAAsB,OAAO;EACrC,QAAQ,sBAAsB,OAAO;EACrC,YAAY,OAAO,OAAO,YAAY;EACtC,WAAW,OAAO;EAClB,aAAa,OAAO,eAAe;EACnC,cAAc,OAAO;EACrB,YAAY,OAAO;EACnB,kBAAkB,OAAO;EACzB,WAAW,UAAU;EACrB,gBAAgB,UAAU;EAC1B,UAAU,UAAU;EACpB,WAAW,UAAU;EACrB,eAAe,OAAO,UAAU,UAAU;EAC1C,YAAY,OAAO,OAAO;EAC1B;EACD;;AAGH,SAAgB,2BAA2B,YAA0C;AACnF,QAAO,WAAW,aAAa,SAAS,UAAU,IAAI,WAAW,aAAa,SAAS,gBAAgB;;AAGzG,SAAgB,wCACd,SACA,kBACgB;AAChB,QAAO,QAAQ,QAAQ,WACrB,OAAO,OAAO,qBAAqB,oBAChC,oBAAoB,OAAO,CAC9B;;AAGJ,SAAgB,8BACd,aACA,WACA,UAA0B,EAAE,EAC5B,YAII,EAAE,EACN;CACA,MAAM,sCAAsB,IAAI,KAAkC;AAClE,MAAK,MAAM,YAAY,WAAW;EAChC,MAAM,UAAU,oBAAoB,IAAI,SAAS,YAAY,IAAI,EAAE;AACnE,UAAQ,KAAK,SAAS;AACtB,sBAAoB,IAAI,SAAS,aAAa,QAAQ;;AAExD,QAAO,YACJ,OAAO,2BAA2B,CAClC,SAAS,eAAe;EACvB,MAAM,YAAY,oBAAoB,IAAI,WAAW,GAAG,IAAI,EAAE;EAC9D,MAAM,YAAY,UAAU,eAAe,EAAE,EAAE,QAAQ,eACrD,WAAW,aAAa,cACrB,WAAW,gBAAgB,WAAW,MACtC,WAAW,WAAW,UACzB;AAgCF,UA/Ba,SAAS,SAAS,IAC3B,SAAS,KAAK,gBAAgB;GAC5B,YAAY,WAAW;GACvB,kBAAkB,YAAY,WAAW,GAAG,GAAG,WAAW;GAC1D,cAAc,WAAW,UACnB,OAAO,WAAW,SAAS,UAAU,WAAW,WAAW,SAAS,QAAQ,KAAA,OAC5E,OAAO,WAAW,SAAS,aAAa,WAAW,WAAW,SAAS,WAAW,KAAA;GACxF,SAAS,WAAW,WAAW;GAC/B,QAAQ,WAAW;GACnB,iBAAiB,WAAW;GAC5B,WAAW;GACZ,EAAE,GACH,UAAU,SAAS,IACjB,UAAU,KAAK,cAAc;GAC3B,YAAY,SAAS;GACrB,kBAAkB,SAAS;GAC3B,cAAc,KAAA;GACd,SAAS,SAAS;GAClB,QAAQ,SAAS;GACjB,iBAAiB,SAAS;GAC1B,WAAW,CAAC,SAAS;GACtB,EAAE,GACH,CAAC;GACC,YAAY,KAAA;GACZ,kBAAkB,KAAA;GAClB,cAAc,KAAA;GACd,SAAS;GACT,QAAQ;GACR,iBAAiB,KAAA;GACjB,WAAW,EAAE;GACd,CAAC,EACI,KAAK,QAAQ;GACzB,MAAM,iBAAiB,IAAI,mBACvB,QAAQ,QAAQ,WAAW,OAAO,OAAO,qBAAqB,IAAI,iBAAiB,GACnF,EAAE;GACN,MAAM,cAAc,IAAI,oBACnB,UAAU,eAAe,EAAE,EAAE,QAAQ,SAAS,KAAK,qBAAqB,IAAI,iBAAiB,GAC9F,EAAE;GACN,MAAM,cAAc,UAAU,YAAY,EAAE,EACzC,QAAQ,QAAQ,IAAI,qBAAqB,IAAI,iBAAiB,CAC9D,MAAM,MAAM,UAAU,KAAK,MAAM,MAAM,UAAU,GAAG,KAAK,MAAM,KAAK,UAAU,CAAC,CAAC;GACnF,MAAM,eAAe,IAAI,UACtB,QAAQ,aAAa,SAAS,MAAM,qBAAqB,SAAS,MAAM,iBAAiB,CACzF,MAAM,MAAM,UACX,KAAK,MAAM,MAAM,MAAM,kBAAmB,GAAG,KAAK,MAAM,KAAK,MAAM,kBAAmB,CACtF,CAAC,IAAI;GACT,MAAM,oBAAoB,WAAW,aAAa,QAAQ,EAAE;GAC5D,MAAM,WAAW,kBAAkB,MAAM,eACvC,4EAA4E,KAAK,WAAW,CAC5F;AACF,UAAO;IACL,IAAI,WAAW;IACf,cAAc,IAAI;IAClB,aAAa,WAAW;IACxB,aAAa,WAAW;IACxB,GAAI,WAAW,WAAW,EAAE,UAAU,WAAW,UAAU,GAAG,EAAE;IAChE,UAAU,WAAW;IACrB,cAAc,WAAW,aAAa,QAAQ,eAC5C,eAAe,aAAa,eAAe,mBAAmB,eAAe,WAAW,eAAe,SACvG;IACF,QAAQ;KACN,SAAS,WAAW,aAAa,SAAS,UAAU;KACpD,QAAQ,WAAW,aAAa,SAAS,gBAAgB;KACzD,MAAM,WAAW,aAAa,SAAS,UAAU,IAC5C,WAAW,aAAa,SAAS,YAAY,IAC7C,WAAW,aAAa,SAAS,QAAQ;KAC9C,OAAO;KACR;IACD;IACA,WAAW,IAAI,eAAe,KAAA;IAC9B,SAAS,IAAI;IACb,QAAQ,IAAI;IACZ,YAAY,IAAI;IAChB,iBAAiB,IAAI;IACrB,mBAAmB,cAAc;IACjC,kBAAkB,cAAc;IAChC,gBAAgB;KACd,GAAG,IAAI,UAAU,SAAS,aAAa;MACrC,SAAS;MACT,SAAS,MAAM;MACf,GAAG,SAAS,MAAM,KAAK,UAAU,MAAM,GAAG;MAC3C,CAAC;KACF,YAAY;KACZ,YAAY;KACb,CACE,QAAQ,UAA2B,QAAQ,MAAM,CAAC,CAClD,MAAM,CACN,GAAG,GAAG;IACT,2BAA2B,eAAe;IAC1C,oBAAoB,YAAY,QAAQ,SAAS,CAAC,KAAK,UAAU,CAAC;IAClE,YAAY,YAAY,cAAc,YAAY;IAClD,gBAAgB,YAAY;IAC5B,eAAe,YAAY;IAC5B;IACC;GACF,CACD,MAAM,MAAM,UAAU;AACrB,MAAI,KAAK,cAAc,MAAM,UAAW,QAAO,KAAK,YAAY,KAAK;AACrE,SAAO,KAAK,YAAY,cAAc,MAAM,YAAY;GACxD"}

package/dist/src/user-context/runtime.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"runtime.js","names":[],"sources":["../../../src/user-context/runtime.ts"],"sourcesContent":["import type { Config } from '../config/schema.js';\nimport { resolveUserDir } from '../config/paths.js';\nimport { BuiltinMemoryStore } from '../agent/memory/builtin-memory-store.js';\nimport { createMemoryManagerFromConfig } from '../agent/memory/create-memory-manager.js';\nimport { resolveBuiltinMemoryStoreConfig } from '../agent/memory/memory-config.js';\nimport type { MemoryManager } from '../agent/memory/manager.js';\nimport { createLogger } from '../utils/logger.js';\n\nconst log = createLogger('UserContextRuntimeRegistry');\n\nexport interface UserContextRuntime {\n  builtinMemoryStore: BuiltinMemoryStore;\n  memoryManager: MemoryManager;\n}\n\n/** Owns the process-wide user context runtime shared by every agent and workspace. */\nexport class UserContextRuntimeRegistry {\n  private runtime?: UserContextRuntime;\n\n  getOrCreate(config: Config): UserContextRuntime {\n    if (this.runtime) return this.runtime;\n    const userContextRoot = resolveUserDir();\n    const builtinMemoryStore = new BuiltinMemoryStore(\n      resolveBuiltinMemoryStoreConfig(userContextRoot, config),\n    );\n    this.runtime = {\n      builtinMemoryStore,\n      memoryManager: createMemoryManagerFromConfig(userContextRoot, builtinMemoryStore, config),\n    };\n    return this.runtime;\n  }\n\n  async clear(): Promise<void> {\n    const runtime = this.runtime;\n    this.runtime = undefined;\n    if (!runtime) return;\n    await runtime.memoryManager.shutdownAll().catch((err) => {\n      log.warn({ err }, 'Shared memory manager shutdown failed');\n    });\n  }\n}\n"],"mappings":";;;;;;;YACoD;aAKF;AAElD,MAAM,MAAM,aAAa,6BAA6B;;AAQtD,IAAa,6BAAb,MAAwC;CACtC;CAEA,YAAY,QAAoC;AAC9C,MAAI,KAAK,QAAS,QAAO,KAAK;EAC9B,MAAM,kBAAkB,gBAAgB;EACxC,MAAM,qBAAqB,IAAI,mBAC7B,gCAAgC,iBAAiB,OAAO,CACzD;AACD,OAAK,UAAU;GACb;GACA,eAAe,8BAA8B,iBAAiB,oBAAoB,OAAO;GAC1F;AACD,SAAO,KAAK;;CAGd,MAAM,QAAuB;EAC3B,MAAM,UAAU,KAAK;AACrB,OAAK,UAAU,KAAA;AACf,MAAI,CAAC,QAAS;AACd,QAAM,QAAQ,cAAc,aAAa,CAAC,OAAO,QAAQ;AACvD,OAAI,KAAK,EAAE,KAAK,EAAE,wCAAwC;IAC1D"}

package/dist/src/user-context/source-recommendations.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"source-recommendations.js","names":[],"sources":["../../../src/user-context/source-recommendations.ts"],"sourcesContent":["import type { ConnectorDefinition } from '../connectors/types.js';\n\ntype GoalSummary = { id: string; title: string; description?: string };\n\nconst DOMAINS = [\n  ['calendar', 'schedule', 'meeting', 'deadline', 'event', '日历', '日程', '会议', '截止', '预约'],\n  ['email', 'gmail', 'outlook', 'mail', 'inbox', '邮件', '邮箱', '收件箱'],\n  ['docs', 'document', 'notion', 'drive', 'knowledge', 'wiki', '文档', '知识库', '资料'],\n  ['github', 'gitlab', 'code', 'repository', 'issue', '代码', '仓库', '开发'],\n  ['slack', 'teams', 'chat', 'message', '消息', '群聊', '沟通'],\n] as const;\n\nexport function buildGoalSourceRecommendations(\n  definitions: ConnectorDefinition[],\n  installedConnectorIds: Set<string>,\n  goals: GoalSummary[],\n) {\n  const recommendations: Array<{\n    sourceId: string;\n    sourceName: string;\n    goalId: string;\n    goalTitle: string;\n    score: number;\n  }> = [];\n\n  for (const definition of definitions) {\n    if (installedConnectorIds.has(definition.id)) continue;\n    const sourceText = [definition.id, definition.displayName, definition.description, ...(definition.tags ?? [])]\n      .join(' ')\n      .toLowerCase();\n    for (const goal of goals) {\n      const goalText = `${goal.title} ${goal.description ?? ''}`.toLowerCase();\n      let score = 0;\n      for (const keywords of DOMAINS) {\n        if (keywords.some((keyword) => sourceText.includes(keyword)) && keywords.some((keyword) => goalText.includes(keyword))) {\n          score += 3;\n        }\n      }\n      const genericTerms = goalText.match(/[a-z][a-z0-9_-]{3,}/g) ?? [];\n      score += new Set(genericTerms.filter((term) => sourceText.includes(term))).size;\n      if (score > 0) {\n        recommendations.push({\n          sourceId: definition.id,\n          sourceName: definition.displayName,\n          goalId: goal.id,\n          goalTitle: goal.title,\n          score,\n        });\n      }\n    }\n  }\n\n  return recommendations\n    .sort((left, right) => right.score - left.score || left.sourceName.localeCompare(right.sourceName))\n    .filter((item, index, all) => all.findIndex((candidate) => candidate.sourceId === item.sourceId) === index)\n    .slice(0, 3)\n    .map(({ score: _score, ...item }) => item);\n}\n"],"mappings":";AAIA,MAAM,UAAU;CACd;EAAC;EAAY;EAAY;EAAW;EAAY;EAAS;EAAM;EAAM;EAAM;EAAM;EAAK;CACtF;EAAC;EAAS;EAAS;EAAW;EAAQ;EAAS;EAAM;EAAM;EAAM;CACjE;EAAC;EAAQ;EAAY;EAAU;EAAS;EAAa;EAAQ;EAAM;EAAO;EAAK;CAC/E;EAAC;EAAU;EAAU;EAAQ;EAAc;EAAS;EAAM;EAAM;EAAK;CACrE;EAAC;EAAS;EAAS;EAAQ;EAAW;EAAM;EAAM;EAAK;CACxD;AAED,SAAgB,+BACd,aACA,uBACA,OACA;CACA,MAAM,kBAMD,EAAE;AAEP,MAAK,MAAM,cAAc,aAAa;AACpC,MAAI,sBAAsB,IAAI,WAAW,GAAG,CAAE;EAC9C,MAAM,aAAa;GAAC,WAAW;GAAI,WAAW;GAAa,WAAW;GAAa,GAAI,WAAW,QAAQ,EAAE;GAAE,CAC3G,KAAK,IAAI,CACT,aAAa;AAChB,OAAK,MAAM,QAAQ,OAAO;GACxB,MAAM,WAAW,GAAG,KAAK,MAAM,GAAG,KAAK,eAAe,KAAK,aAAa;GACxE,IAAI,QAAQ;AACZ,QAAK,MAAM,YAAY,QACrB,KAAI,SAAS,MAAM,YAAY,WAAW,SAAS,QAAQ,CAAC,IAAI,SAAS,MAAM,YAAY,SAAS,SAAS,QAAQ,CAAC,CACpH,UAAS;GAGb,MAAM,eAAe,SAAS,MAAM,uBAAuB,IAAI,EAAE;AACjE,YAAS,IAAI,IAAI,aAAa,QAAQ,SAAS,WAAW,SAAS,KAAK,CAAC,CAAC,CAAC;AAC3E,OAAI,QAAQ,EACV,iBAAgB,KAAK;IACnB,UAAU,WAAW;IACrB,YAAY,WAAW;IACvB,QAAQ,KAAK;IACb,WAAW,KAAK;IAChB;IACD,CAAC;;;AAKR,QAAO,gBACJ,MAAM,MAAM,UAAU,MAAM,QAAQ,KAAK,SAAS,KAAK,WAAW,cAAc,MAAM,WAAW,CAAC,CAClG,QAAQ,MAAM,OAAO,QAAQ,IAAI,WAAW,cAAc,UAAU,aAAa,KAAK,SAAS,KAAK,MAAM,CAC1G,MAAM,GAAG,EAAE,CACX,KAAK,EAAE,OAAO,QAAQ,GAAG,WAAW,KAAK"}

package/dist/src/user-context/trust-policy.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"trust-policy.js","names":[],"sources":["../../../src/user-context/trust-policy.ts"],"sourcesContent":["export const USER_TRUST_LEVELS = ['observe', 'suggest', 'confirm', 'auto'] as const;\n\nexport type UserTrustLevel = typeof USER_TRUST_LEVELS[number];\n\nexport const DEFAULT_USER_TRUST_LEVEL: UserTrustLevel = 'confirm';\n\nexport type UserTrustPolicy = {\n  principalId: string;\n  defaultActionLevel: UserTrustLevel;\n  updatedAt?: string;\n};\n\nexport function isUserTrustLevel(value: unknown): value is UserTrustLevel {\n  return typeof value === 'string' && USER_TRUST_LEVELS.includes(value as UserTrustLevel);\n}\n\nexport function resolveAutomationSafetyForTrust(\n  level: UserTrustLevel,\n  requested: 'suggest_only' | 'ask_before_apply' | 'auto_apply' | undefined,\n): 'suggest_only' | 'ask_before_apply' | 'auto_apply' {\n  if (level === 'observe' || level === 'suggest') return 'suggest_only';\n  if (level === 'confirm') {\n    return requested === 'suggest_only' ? 'suggest_only' : 'ask_before_apply';\n  }\n  return requested ?? 'suggest_only';\n}\n\nexport function buildActionTrustPrompt(level: UserTrustLevel): string {\n  const shared = [\n    '## Action Trust Boundary',\n    `Current default: ${level}.`,\n    '- This controls agent-initiated or proactive actions. A direct user request in the current turn is explicit approval to carry out that request within existing safety and permission boundaries.',\n    '- Never expand connector permissions, workflow scope, credentials, or access because of this setting.',\n    '- Irreversible, destructive, financial, permission-expanding, or public external actions still require explicit confirmation.',\n  ];\n  const instruction = level === 'observe'\n    ? '- For proactive work, observe and build context only; do not prepare or initiate actions.'\n    : level === 'suggest'\n      ? '- For proactive work, explain the recommendation and rationale, then let the user decide whether to proceed.'\n      : level === 'confirm'\n        ? '- For proactive work, prepare the action, but request approval before executing any mutating or external step.'\n        : '- For proactive work, you may execute within already-authorized, recoverable boundaries without asking each time.';\n  return [...shared, instruction].join('\\n');\n}\n"],"mappings":";AAAA,MAAa,oBAAoB;CAAC;CAAW;CAAW;CAAW;CAAO;AAI1E,MAAa,2BAA2C;AAQxD,SAAgB,iBAAiB,OAAyC;AACxE,QAAO,OAAO,UAAU,YAAY,kBAAkB,SAAS,MAAwB;;AAGzF,SAAgB,gCACd,OACA,WACoD;AACpD,KAAI,UAAU,aAAa,UAAU,UAAW,QAAO;AACvD,KAAI,UAAU,UACZ,QAAO,cAAc,iBAAiB,iBAAiB;AAEzD,QAAO,aAAa;;AAGtB,SAAgB,uBAAuB,OAA+B;CACpE,MAAM,SAAS;EACb;EACA,oBAAoB,MAAM;EAC1B;EACA;EACA;EACD;CACD,MAAM,cAAc,UAAU,YAC1B,8FACA,UAAU,YACR,iHACA,UAAU,YACR,mHACA;AACR,QAAO,CAAC,GAAG,QAAQ,YAAY,CAAC,KAAK,KAAK"}

package/dist/src/utils/global-singleton.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"global-singleton.js","names":[],"sources":["../../../src/utils/global-singleton.ts"],"sourcesContent":["// Safe for process-local caches and registries that can tolerate helper-based\n// resolution. Do not use this for live mutable state that must survive split\n// runtime chunks; keep those on a direct globalThis[Symbol.for(...)] lookup.\nexport function resolveGlobalSingleton<T>(key: symbol, create: () => T): T {\n  const globalStore = globalThis as Record<PropertyKey, unknown>;\n  if (Object.prototype.hasOwnProperty.call(globalStore, key)) {\n    return globalStore[key] as T;\n  }\n  const created = create();\n  globalStore[key] = created;\n  return created;\n}\n\nexport function resolveGlobalMap<TKey, TValue>(key: symbol): Map<TKey, TValue> {\n  return resolveGlobalSingleton(key, () => new Map<TKey, TValue>());\n}\n"],"mappings":";AAGA,SAAgB,uBAA0B,KAAa,QAAoB;CACzE,MAAM,cAAc;AACpB,KAAI,OAAO,UAAU,eAAe,KAAK,aAAa,IAAI,CACxD,QAAO,YAAY;CAErB,MAAM,UAAU,QAAQ;AACxB,aAAY,OAAO;AACnB,QAAO;;AAGT,SAAgB,iBAA+B,KAAgC;AAC7E,QAAO,uBAAuB,2BAAW,IAAI,KAAmB,CAAC"}

package/dist/src/utils/helpers.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"helpers.js","names":[],"sources":["../../../src/utils/helpers.ts"],"sourcesContent":["import { resolve, isAbsolute } from 'path';\nimport { homedir } from 'os';\nimport { loadConfig } from '../config/loader.js';\nimport { resolveDefaultAgentId } from '../agent/agent-scope.js';\nimport { resolveAgentWorkspaceDir } from '../config/paths.js';\n\nexport function getWorkspacePath(customPath?: string): string {\n  if (customPath) {\n    return customPath.replace(/^~/, homedir());\n  }\n  const cfg = loadConfig();\n  return resolveAgentWorkspaceDir(cfg, resolveDefaultAgentId(cfg));\n}\n\nexport function createPathResolver(extensionDir: string, workspaceDir: string) {\n  return (input: string): string => {\n    if (input.startsWith('~')) {\n      return input.replace('~', process.env.HOME || '');\n    }\n    if (input.startsWith('.')) {\n      return resolve(extensionDir, input);\n    }\n    if (!isAbsolute(input)) {\n      return resolve(workspaceDir, input);\n    }\n    return input;\n  };\n}\n\n/**\n * Resolve a path to absolute, supporting ~ home directory and cwd-relative paths.\n */\nexport function resolveToCwd(path: string, cwd: string): string {\n  if (path.startsWith('~')) {\n    return path.replace(/^~/, process.env.HOME || process.env.USERPROFILE || '');\n  }\n  if (path.startsWith('/')) {\n    return path;\n  }\n  return `${cwd}/${path}`;\n}\n"],"mappings":";;;;;;aAEiD;kBACe;YACF;AAE9D,SAAgB,iBAAiB,YAA6B;AAC5D,KAAI,WACF,QAAO,WAAW,QAAQ,MAAM,SAAS,CAAC;CAE5C,MAAM,MAAM,YAAY;AACxB,QAAO,yBAAyB,KAAK,sBAAsB,IAAI,CAAC;;AAGlE,SAAgB,mBAAmB,cAAsB,cAAsB;AAC7E,SAAQ,UAA0B;AAChC,MAAI,MAAM,WAAW,IAAI,CACvB,QAAO,MAAM,QAAQ,KAAK,QAAQ,IAAI,QAAQ,GAAG;AAEnD,MAAI,MAAM,WAAW,IAAI,CACvB,QAAO,QAAQ,cAAc,MAAM;AAErC,MAAI,CAAC,WAAW,MAAM,CACpB,QAAO,QAAQ,cAAc,MAAM;AAErC,SAAO;;;;;;AAOX,SAAgB,aAAa,MAAc,KAAqB;AAC9D,KAAI,KAAK,WAAW,IAAI,CACtB,QAAO,KAAK,QAAQ,MAAM,QAAQ,IAAI,QAAQ,QAAQ,IAAI,eAAe,GAAG;AAE9E,KAAI,KAAK,WAAW,IAAI,CACtB,QAAO;AAET,QAAO,GAAG,IAAI,GAAG"}

package/dist/src/utils/index.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.js","names":[],"sources":["../../../src/utils/index.ts"],"sourcesContent":["export * from './helpers.js';\nexport * from './logger.js';\n"],"mappings":""}

package/dist/src/utils/is-record.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"is-record.js","names":[],"sources":["../../../src/utils/is-record.ts"],"sourcesContent":["export function isRecord(value: unknown): value is Record<string, unknown> {\n  return value !== null && typeof value === 'object' && !Array.isArray(value);\n}\n"],"mappings":";AAAA,SAAgB,SAAS,OAAkD;AACzE,QAAO,UAAU,QAAQ,OAAO,UAAU,YAAY,CAAC,MAAM,QAAQ,MAAM"}

package/dist/src/utils/logger/audit.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"audit.js","names":[],"sources":["../../../../src/utils/logger/audit.ts"],"sourcesContent":["/**\n * Audit Log\n * \n * Independent audit log stream for security-sensitive events:\n * - Authentication events (login, logout, token refresh)\n * - Configuration changes\n * - Permission changes\n * - Data access events\n */\n\nimport { appendFile } from 'fs/promises';\nimport { existsSync, mkdirSync } from 'fs';\nimport path from 'path';\nimport { getLogDir } from './config.js';\n\n// ============================================\n// Types\n// ============================================\n\nexport type AuditEventType =\n  | 'auth.login'\n  | 'auth.logout'\n  | 'auth.token_refresh'\n  | 'auth.failed'\n  | 'config.update'\n  | 'config.reload'\n  | 'permission.grant'\n  | 'permission.revoke'\n  | 'data.access'\n  | 'data.export'\n  | 'data.delete'\n  | 'admin.action';\n\nexport interface AuditEvent {\n  id: string;\n  timestamp: string;\n  type: AuditEventType;\n  actor: {\n    userId?: string;\n    sessionId?: string;\n    ip?: string;\n    userAgent?: string;\n  };\n  resource: {\n    type: string;\n    id?: string;\n    path?: string;\n  };\n  action: {\n    type: string;\n    result: 'success' | 'failure' | 'denied';\n    details?: Record<string, unknown>;\n  };\n  metadata?: {\n    requestId?: string;\n    location?: string;\n    reason?: string;\n  };\n}\n\nexport interface AuditLogConfig {\n  enabled: boolean;\n  logDir?: string;\n  retentionDays?: number;\n  logToConsole?: boolean;\n  sensitiveFields?: string[];\n}\n\n// ============================================\n// Configuration\n// ============================================\n\nconst DEFAULT_SENSITIVE_FIELDS = [\n  'password', 'token', 'apiKey', 'secret', 'credential',\n  'authorization', 'cookie', 'session',\n];\n\nlet auditConfig: AuditLogConfig = {\n  enabled: true,\n  retentionDays: 90,\n  logToConsole: false,\n  sensitiveFields: DEFAULT_SENSITIVE_FIELDS,\n};\n\nexport function configureAuditLog(config: Partial<AuditLogConfig>): void {\n  auditConfig = { ...auditConfig, ...config };\n}\n\nexport function getAuditConfig(): AuditLogConfig {\n  return { ...auditConfig };\n}\n\n// ============================================\n// Event Generation\n// ============================================\n\nlet seq = 0;\n\nfunction generateEventId(): string {\n  const timestamp = Date.now().toString(36);\n  const random = Math.random().toString(36).substring(2, 8);\n  const sequence = (++seq).toString(36).padStart(4, '0');\n  return `audit_${timestamp}_${sequence}_${random}`;\n}\n\nfunction redactSensitiveData(data: Record<string, unknown>): Record<string, unknown> {\n  if (!auditConfig.sensitiveFields) return data;\n  \n  const redacted: Record<string, unknown> = {};\n  for (const [key, value] of Object.entries(data)) {\n    const isSensitive = auditConfig.sensitiveFields.some(\n      field => key.toLowerCase().includes(field.toLowerCase())\n    );\n    \n    if (isSensitive) {\n      redacted[key] = '***REDACTED***';\n    } else if (value && typeof value === 'object' && !Array.isArray(value)) {\n      // Recursively redact nested objects\n      redacted[key] = redactSensitiveData(value as Record<string, unknown>);\n    } else if (Array.isArray(value)) {\n      // Handle arrays\n      redacted[key] = value.map(item => \n        (item && typeof item === 'object') \n          ? redactSensitiveData(item as Record<string, unknown>)\n          : item\n      );\n    } else {\n      redacted[key] = value;\n    }\n  }\n  return redacted;\n}\n\n/**\n * Redact sensitive fields from an audit event before writing\n */\nfunction redactEvent(event: AuditEvent): AuditEvent {\n  const redactedEvent = { ...event };\n  \n  // Redact actor fields\n  if (redactedEvent.actor) {\n    redactedEvent.actor = {\n      ...redactSensitiveData(redactedEvent.actor as Record<string, unknown>),\n    } as AuditEvent['actor'];\n  }\n  \n  // Redact action details\n  if (redactedEvent.action?.details) {\n    redactedEvent.action = {\n      ...redactedEvent.action,\n      details: redactSensitiveData(redactedEvent.action.details as Record<string, unknown>),\n    };\n  }\n  \n  // Redact resource fields\n  if (redactedEvent.resource) {\n    redactedEvent.resource = {\n      ...redactSensitiveData(redactedEvent.resource as Record<string, unknown>),\n    } as AuditEvent['resource'];\n  }\n  \n  // Redact metadata\n  if (redactedEvent.metadata) {\n    redactedEvent.metadata = {\n      ...redactSensitiveData(redactedEvent.metadata as Record<string, unknown>),\n    } as AuditEvent['metadata'];\n  }\n  \n  return redactedEvent;\n}\n\n// ============================================\n// Storage\n// ============================================\n\nfunction getAuditLogPath(date: Date = new Date()): string {\n  const dateStr = date.toISOString().split('T')[0];\n  const logDir = auditConfig.logDir || path.join(getLogDir(), 'audit');\n  \n  if (!existsSync(logDir)) {\n    mkdirSync(logDir, { recursive: true });\n  }\n  \n  return path.join(logDir, `audit-${dateStr}.log`);\n}\n\nasync function writeAuditEvent(event: AuditEvent): Promise<void> {\n  if (!auditConfig.enabled) return;\n\n  // Automatically redact sensitive data before writing\n  const redactedEvent = redactEvent(event);\n  const logLine = JSON.stringify(redactedEvent) + '\\n';\n  const logPath = getAuditLogPath();\n\n  try {\n    await appendFile(logPath, logLine, 'utf-8');\n    \n    if (auditConfig.logToConsole) {\n      console.log(`[AUDIT] ${event.type}: ${event.action.type} by ${event.actor.userId || 'anonymous'}`);\n    }\n  } catch (err) {\n    console.error('[AuditLog] Failed to write audit event:', err);\n  }\n}\n\n// ============================================\n// Public API\n// ============================================\n\nexport async function logAuditEvent(\n  type: AuditEventType,\n  params: {\n    actor?: AuditEvent['actor'];\n    resource: AuditEvent['resource'];\n    action: Omit<AuditEvent['action'], 'result'> & { result?: AuditEvent['action']['result'] };\n    metadata?: AuditEvent['metadata'];\n  }\n): Promise<AuditEvent> {\n  const event: AuditEvent = {\n    id: generateEventId(),\n    timestamp: new Date().toISOString(),\n    type,\n    actor: params.actor || {},\n    resource: params.resource,\n    action: {\n      result: 'success',\n      ...params.action,\n    },\n    metadata: params.metadata,\n  };\n\n  await writeAuditEvent(event);\n  return event;\n}\n\n// Convenience functions for common events\nexport async function logAuthEvent(\n  type: 'auth.login' | 'auth.logout' | 'auth.token_refresh' | 'auth.failed',\n  params: {\n    userId?: string;\n    sessionId?: string;\n    ip?: string;\n    userAgent?: string;\n    result: 'success' | 'failure' | 'denied';\n    reason?: string;\n  }\n): Promise<AuditEvent> {\n  return logAuditEvent(type, {\n    actor: {\n      userId: params.userId,\n      sessionId: params.sessionId,\n      ip: params.ip,\n      userAgent: params.userAgent,\n    },\n    resource: { type: 'auth' },\n    action: {\n      type: type.split('.')[1],\n      result: params.result,\n      details: params.reason ? { reason: params.reason } : undefined,\n    },\n  });\n}\n\nexport async function logConfigChange(\n  params: {\n    userId?: string;\n    section: string;\n    path: string;\n    oldValue?: unknown;\n    newValue?: unknown;\n    result: 'success' | 'failure';\n  }\n): Promise<AuditEvent> {\n  return logAuditEvent('config.update', {\n    actor: { userId: params.userId },\n    resource: {\n      type: 'config',\n      id: params.section,\n      path: params.path,\n    },\n    action: {\n      type: 'update',\n      result: params.result,\n      // Values will be automatically redacted by redactEvent()\n      details: {\n        oldValue: params.oldValue,\n        newValue: params.newValue,\n      },\n    },\n  });\n}\n\nexport async function logPermissionChange(\n  params: {\n    userId?: string;\n    targetUserId: string;\n    action: 'grant' | 'revoke';\n    permission: string;\n    resourceType: string;\n    resourceId?: string;\n    result: 'success' | 'failure';\n  }\n): Promise<AuditEvent> {\n  return logAuditEvent(\n    params.action === 'grant' ? 'permission.grant' : 'permission.revoke',\n    {\n      actor: { userId: params.userId },\n      resource: {\n        type: params.resourceType,\n        id: params.resourceId,\n      },\n      action: {\n        type: params.action,\n        result: params.result,\n        details: {\n          targetUserId: params.targetUserId,\n          permission: params.permission,\n        },\n      },\n    }\n  );\n}\n\nexport async function logDataAccess(\n  params: {\n    userId?: string;\n    sessionId?: string;\n    action: 'read' | 'write' | 'delete' | 'export';\n    resourceType: string;\n    resourceId?: string;\n    path?: string;\n    result: 'success' | 'failure' | 'denied';\n    metadata?: Record<string, unknown>;\n  }\n): Promise<AuditEvent> {\n  const typeMap: Record<string, AuditEventType> = {\n    read: 'data.access',\n    write: 'data.access',\n    delete: 'data.delete',\n    export: 'data.export',\n  };\n\n  return logAuditEvent(typeMap[params.action], {\n    actor: {\n      userId: params.userId,\n      sessionId: params.sessionId,\n    },\n    resource: {\n      type: params.resourceType,\n      id: params.resourceId,\n      path: params.path,\n    },\n    action: {\n      type: params.action,\n      result: params.result,\n      details: params.metadata,\n    },\n  });\n}\n"],"mappings":";;;;;;;;;;;;;;;AAoFA,SAAgB,kBAAkB,QAAuC;AACvE,eAAc;EAAE,GAAG;EAAa,GAAG;EAAQ;;AAG7C,SAAgB,iBAAiC;AAC/C,QAAO,EAAE,GAAG,aAAa;;AAS3B,SAAS,kBAA0B;CACjC,MAAM,YAAY,KAAK,KAAK,CAAC,SAAS,GAAG;CACzC,MAAM,SAAS,KAAK,QAAQ,CAAC,SAAS,GAAG,CAAC,UAAU,GAAG,EAAE;AAEzD,QAAO,SAAS,UAAU,IADR,EAAE,KAAK,SAAS,GAAG,CAAC,SAAS,GAAG,IACb,CAAC,GAAG;;AAG3C,SAAS,oBAAoB,MAAwD;AACnF,KAAI,CAAC,YAAY,gBAAiB,QAAO;CAEzC,MAAM,WAAoC,EAAE;AAC5C,MAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,KAAK,CAK7C,KAJoB,YAAY,gBAAgB,MAC9C,UAAS,IAAI,aAAa,CAAC,SAAS,MAAM,aAAa,CAAC,CAG3C,CACb,UAAS,OAAO;UACP,SAAS,OAAO,UAAU,YAAY,CAAC,MAAM,QAAQ,MAAM,CAEpE,UAAS,OAAO,oBAAoB,MAAiC;UAC5D,MAAM,QAAQ,MAAM,CAE7B,UAAS,OAAO,MAAM,KAAI,SACvB,QAAQ,OAAO,SAAS,WACrB,oBAAoB,KAAgC,GACpD,KACL;KAED,UAAS,OAAO;AAGpB,QAAO;;;;;AAMT,SAAS,YAAY,OAA+B;CAClD,MAAM,gBAAgB,EAAE,GAAG,OAAO;AAGlC,KAAI,cAAc,MAChB,eAAc,QAAQ,EACpB,GAAG,oBAAoB,cAAc,MAAiC,EACvE;AAIH,KAAI,cAAc,QAAQ,QACxB,eAAc,SAAS;EACrB,GAAG,cAAc;EACjB,SAAS,oBAAoB,cAAc,OAAO,QAAmC;EACtF;AAIH,KAAI,cAAc,SAChB,eAAc,WAAW,EACvB,GAAG,oBAAoB,cAAc,SAAoC,EAC1E;AAIH,KAAI,cAAc,SAChB,eAAc,WAAW,EACvB,GAAG,oBAAoB,cAAc,SAAoC,EAC1E;AAGH,QAAO;;AAOT,SAAS,gBAAgB,uBAAa,IAAI,MAAM,EAAU;CACxD,MAAM,UAAU,KAAK,aAAa,CAAC,MAAM,IAAI,CAAC;CAC9C,MAAM,SAAS,YAAY,UAAU,KAAK,KAAK,WAAW,EAAE,QAAQ;AAEpE,KAAI,CAAC,WAAW,OAAO,CACrB,WAAU,QAAQ,EAAE,WAAW,MAAM,CAAC;AAGxC,QAAO,KAAK,KAAK,QAAQ,SAAS,QAAQ,MAAM;;AAGlD,eAAe,gBAAgB,OAAkC;AAC/D,KAAI,CAAC,YAAY,QAAS;CAG1B,MAAM,gBAAgB,YAAY,MAAM;CACxC,MAAM,UAAU,KAAK,UAAU,cAAc,GAAG;CAChD,MAAM,UAAU,iBAAiB;AAEjC,KAAI;AACF,QAAM,WAAW,SAAS,SAAS,QAAQ;AAE3C,MAAI,YAAY,aACd,SAAQ,IAAI,WAAW,MAAM,KAAK,IAAI,MAAM,OAAO,KAAK,MAAM,MAAM,MAAM,UAAU,cAAc;UAE7F,KAAK;AACZ,UAAQ,MAAM,2CAA2C,IAAI;;;AAQjE,eAAsB,cACpB,MACA,QAMqB;CACrB,MAAM,QAAoB;EACxB,IAAI,iBAAiB;EACrB,4BAAW,IAAI,MAAM,EAAC,aAAa;EACnC;EACA,OAAO,OAAO,SAAS,EAAE;EACzB,UAAU,OAAO;EACjB,QAAQ;GACN,QAAQ;GACR,GAAG,OAAO;GACX;EACD,UAAU,OAAO;EAClB;AAED,OAAM,gBAAgB,MAAM;AAC5B,QAAO;;AAIT,eAAsB,aACpB,MACA,QAQqB;AACrB,QAAO,cAAc,MAAM;EACzB,OAAO;GACL,QAAQ,OAAO;GACf,WAAW,OAAO;GAClB,IAAI,OAAO;GACX,WAAW,OAAO;GACnB;EACD,UAAU,EAAE,MAAM,QAAQ;EAC1B,QAAQ;GACN,MAAM,KAAK,MAAM,IAAI,CAAC;GACtB,QAAQ,OAAO;GACf,SAAS,OAAO,SAAS,EAAE,QAAQ,OAAO,QAAQ,GAAG,KAAA;GACtD;EACF,CAAC;;AAGJ,eAAsB,gBACpB,QAQqB;AACrB,QAAO,cAAc,iBAAiB;EACpC,OAAO,EAAE,QAAQ,OAAO,QAAQ;EAChC,UAAU;GACR,MAAM;GACN,IAAI,OAAO;GACX,MAAM,OAAO;GACd;EACD,QAAQ;GACN,MAAM;GACN,QAAQ,OAAO;GAEf,SAAS;IACP,UAAU,OAAO;IACjB,UAAU,OAAO;IAClB;GACF;EACF,CAAC;;AAGJ,eAAsB,oBACpB,QASqB;AACrB,QAAO,cACL,OAAO,WAAW,UAAU,qBAAqB,qBACjD;EACE,OAAO,EAAE,QAAQ,OAAO,QAAQ;EAChC,UAAU;GACR,MAAM,OAAO;GACb,IAAI,OAAO;GACZ;EACD,QAAQ;GACN,MAAM,OAAO;GACb,QAAQ,OAAO;GACf,SAAS;IACP,cAAc,OAAO;IACrB,YAAY,OAAO;IACpB;GACF;EACF,CACF;;AAGH,eAAsB,cACpB,QAUqB;AAQrB,QAAO,cAAc;EANnB,MAAM;EACN,OAAO;EACP,QAAQ;EACR,QAAQ;EAGkB,CAAC,OAAO,SAAS;EAC3C,OAAO;GACL,QAAQ,OAAO;GACf,WAAW,OAAO;GACnB;EACD,UAAU;GACR,MAAM,OAAO;GACb,IAAI,OAAO;GACX,MAAM,OAAO;GACd;EACD,QAAQ;GACN,MAAM,OAAO;GACb,QAAQ,OAAO;GACf,SAAS,OAAO;GACjB;EACF,CAAC;;;;cAxVoC;AAgEpC,eAA8B;EAChC,SAAS;EACT,eAAe;EACf,cAAc;EACd,iBAAiB;GARjB;GAAY;GAAS;GAAU;GAAU;GACzC;GAAiB;GAAU;GAOc;EAC1C;AAcG,OAAM"}

package/dist/src/utils/logger/config.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"config.js","names":[],"sources":["../../../../src/utils/logger/config.ts"],"sourcesContent":["/**\n * Logger Configuration\n * Centralized configuration loading from environment variables\n */\n\nimport path from 'path';\nimport type { LoggerConfig, LogLevel } from './types.js';\n\nconst DEFAULT_CONFIG: LoggerConfig = {\n  level: 'info',\n  logDir: path.join(process.env.HOME || '.', '.xopc', 'logs'),\n  consoleOutput: true,\n  fileOutput: true,\n  errorFileOutput: true,\n  retentionDays: 7,\n  maxFileSizeMB: 100,\n  prettyPrint: false,\n};\n\n/**\n * Load configuration from environment variables\n */\nexport function loadConfig(): LoggerConfig {\n  const config: LoggerConfig = { ...DEFAULT_CONFIG };\n\n  // Log level\n  if (process.env.XOPC_LOG_LEVEL) {\n    config.level = process.env.XOPC_LOG_LEVEL.toLowerCase() as LogLevel;\n  }\n\n  // Log directory\n  if (process.env.XOPC_LOG_DIR) {\n    config.logDir = process.env.XOPC_LOG_DIR;\n  }\n\n  // Output options\n  if (process.env.XOPC_LOG_CONSOLE === 'false') {\n    config.consoleOutput = false;\n  }\n  if (process.env.XOPC_LOG_FILE === 'false') {\n    config.fileOutput = false;\n  }\n\n  // Retention\n  if (process.env.XOPC_LOG_RETENTION_DAYS) {\n    config.retentionDays = parseInt(process.env.XOPC_LOG_RETENTION_DAYS, 10);\n  }\n\n  // Pretty print for development\n  if (process.env.NODE_ENV === 'development' || process.env.XOPC_PRETTY_LOGS === 'true') {\n    config.prettyPrint = true;\n  }\n\n  return config;\n}\n\n// Singleton config instance\nexport const config = loadConfig();\n\n/**\n * Get current log directory\n */\nexport function getLogDir(): string {\n  return config.logDir;\n}\n\n/**\n * Get logger configuration\n */\nexport function getLoggerConfig(): Readonly<LoggerConfig> {\n  return { ...config };\n}\n"],"mappings":";;;;;;;;;;AAsBA,SAAgB,aAA2B;CACzC,MAAM,SAAuB,EAAE,GAAG,gBAAgB;AAGlD,KAAI,QAAQ,IAAI,eACd,QAAO,QAAQ,QAAQ,IAAI,eAAe,aAAa;AAIzD,KAAI,QAAQ,IAAI,aACd,QAAO,SAAS,QAAQ,IAAI;AAI9B,KAAI,QAAQ,IAAI,qBAAqB,QACnC,QAAO,gBAAgB;AAEzB,KAAI,QAAQ,IAAI,kBAAkB,QAChC,QAAO,aAAa;AAItB,KAAI,QAAQ,IAAI,wBACd,QAAO,gBAAgB,SAAS,QAAQ,IAAI,yBAAyB,GAAG;AAI1E,KAA8C,QAAQ,IAAI,qBAAqB,OAC7E,QAAO,cAAc;AAGvB,QAAO;;;;;AAST,SAAgB,YAAoB;AAClC,QAAO,OAAO;;;;;AAMhB,SAAgB,kBAA0C;AACxD,QAAO,EAAE,GAAG,QAAQ;;;;AA9DhB,kBAA+B;EACnC,OAAO;EACP,QAAQ,KAAK,KAAK,QAAQ,IAAI,QAAQ,KAAK,SAAS,OAAO;EAC3D,eAAe;EACf,YAAY;EACZ,iBAAiB;EACjB,eAAe;EACf,eAAe;EACf,aAAa;EACd;AAwCY,UAAS,YAAY"}

package/dist/src/utils/logger/context.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"context.js","names":[],"sources":["../../../../src/utils/logger/context.ts"],"sourcesContent":["/**\n * Logger Context\n * AsyncLocalStorage correlation for structured logging\n */\n\nimport { AsyncLocalStorage } from 'node:async_hooks';\n\nimport type { LogContext } from './types.js';\n\n/** Correlation fields merged into every log line while the store is active (via pino mixin). */\nconst ASYNC_LOG_CORRELATION_KEYS = ['requestId', 'sessionKey', 'sessionId', 'userId', 'correlationId'] as const;\n\ntype AsyncLogCorrelationKey = (typeof ASYNC_LOG_CORRELATION_KEYS)[number];\n\nconst logContextStorage = new AsyncLocalStorage<{ ctx: LogContext }>();\n\n/**\n * Run *fn* with merged async log context. Propagates through async/await (Node AsyncLocalStorage).\n * Nested calls merge over the parent context (shallow per key).\n */\nexport function runWithLogContext<T>(context: LogContext, fn: () => T): T {\n  const parent = logContextStorage.getStore();\n  const merged = parent ? mergeContext(parent.ctx, context) : { ...context };\n  return logContextStorage.run({ ctx: { ...merged } }, fn);\n}\n\n/** Current async log context, if any. */\nexport function getAsyncLogContext(): LogContext | undefined {\n  return logContextStorage.getStore()?.ctx;\n}\n\n/**\n * Shallow-merge fields into the current async log context (e.g. set session identifiers after parsing a body).\n * No-op when not inside {@link runWithLogContext}.\n */\nexport function updateAsyncLogContext(partial: LogContext): void {\n  const ref = logContextStorage.getStore();\n  if (ref) {\n    ref.ctx = mergeContext(ref.ctx, partial);\n  }\n}\n\n/** Keys injected from async context into log records (used by logger mixin). */\nexport function getAsyncLogCorrelationKeys(): readonly AsyncLogCorrelationKey[] {\n  return ASYNC_LOG_CORRELATION_KEYS;\n}\n\n/**\n * Fields to copy from ALS onto {@link InboundMessage.metadata} when the gateway enqueues\n * a message for the agent bus. Omits session identifiers so channel routing / session metadata stays\n * authoritative; the agent sets log sessionKey/sessionId after `routeMessage`.\n */\nconst INBOUND_METADATA_FROM_ASYNC: readonly (keyof LogContext)[] = [\n  'requestId',\n  'correlationId',\n  'userId',\n];\n\nexport function inboundCorrelationMetadataFromAsyncLogContext(): Record<string, unknown> | undefined {\n  const ctx = getAsyncLogContext();\n  if (!ctx) return undefined;\n  const meta: Record<string, unknown> = {};\n  for (const key of INBOUND_METADATA_FROM_ASYNC) {\n    const v = ctx[key];\n    if (v !== undefined && v !== '') {\n      meta[key] = v;\n    }\n  }\n  return Object.keys(meta).length > 0 ? meta : undefined;\n}\n\n/** Shallow-merge two log context objects. */\nexport function mergeContext(base: LogContext, additional: LogContext): LogContext {\n  return { ...base, ...additional };\n}\n"],"mappings":";;;;;;;;;;;AAoBA,SAAgB,kBAAqB,SAAqB,IAAgB;CACxE,MAAM,SAAS,kBAAkB,UAAU;CAC3C,MAAM,SAAS,SAAS,aAAa,OAAO,KAAK,QAAQ,GAAG,EAAE,GAAG,SAAS;AAC1E,QAAO,kBAAkB,IAAI,EAAE,KAAK,EAAE,GAAG,QAAQ,EAAE,EAAE,GAAG;;;AAI1D,SAAgB,qBAA6C;AAC3D,QAAO,kBAAkB,UAAU,EAAE;;;;;;AAOvC,SAAgB,sBAAsB,SAA2B;CAC/D,MAAM,MAAM,kBAAkB,UAAU;AACxC,KAAI,IACF,KAAI,MAAM,aAAa,IAAI,KAAK,QAAQ;;;AAK5C,SAAgB,6BAAgE;AAC9E,QAAO;;AAcT,SAAgB,gDAAqF;CACnG,MAAM,MAAM,oBAAoB;AAChC,KAAI,CAAC,IAAK,QAAO,KAAA;CACjB,MAAM,OAAgC,EAAE;AACxC,MAAK,MAAM,OAAO,6BAA6B;EAC7C,MAAM,IAAI,IAAI;AACd,MAAI,MAAM,KAAA,KAAa,MAAM,GAC3B,MAAK,OAAO;;AAGhB,QAAO,OAAO,KAAK,KAAK,CAAC,SAAS,IAAI,OAAO,KAAA;;;AAI/C,SAAgB,aAAa,MAAkB,YAAoC;AACjF,QAAO;EAAE,GAAG;EAAM,GAAG;EAAY;;;;AA/D7B,8BAA6B;EAAC;EAAa;EAAc;EAAa;EAAU;EAAgB;AAIhG,qBAAoB,IAAI,mBAAwC;AAsChE,+BAA6D;EACjE;EACA;EACA;EACD"}

package/dist/src/utils/logger/exporters.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"exporters.js","names":[],"sources":["../../../../src/utils/logger/exporters.ts"],"sourcesContent":["/**\n * Log Exporters\n * \n * Support for external log aggregation platforms:\n * - Loki (Grafana)\n * - ELK Stack (Elasticsearch)\n * - Datadog\n * - Custom HTTP endpoints\n */\n\nimport type { LogEntry, LogLevel } from './types.js';\n\n// ============================================\n// Types\n// ============================================\n\nexport interface LogExporter {\n  name: string;\n  enabled: boolean;\n  export(entry: LogEntry): Promise<void>;\n  flush(): Promise<void>;\n}\n\nexport interface LokiConfig {\n  type: 'loki';\n  url: string;\n  labels?: Record<string, string>;\n  batchSize?: number;\n  batchTimeoutMs?: number;\n}\n\nexport interface ElkConfig {\n  type: 'elk';\n  url: string;\n  index?: string;\n  apiKey?: string;\n  batchSize?: number;\n}\n\nexport interface DatadogConfig {\n  type: 'datadog';\n  apiKey: string;\n  site?: string; // datadoghq.com or datadoghq.eu\n  service?: string;\n  batchSize?: number;\n}\n\nexport interface WebhookConfig {\n  type: 'webhook';\n  url: string;\n  headers?: Record<string, string>;\n  filter?: LogLevel[];\n}\n\nexport type ExporterConfig = LokiConfig | ElkConfig | DatadogConfig | WebhookConfig;\n\n// ============================================\n// Loki Exporter\n// ============================================\n\nclass LokiExporter implements LogExporter {\n  name = 'loki';\n  enabled = true;\n  private url: string;\n  private labels: Record<string, string>;\n  private batch: LogEntry[] = [];\n  private batchSize: number;\n  private batchTimeoutMs: number;\n  private flushTimer: NodeJS.Timeout | null = null;\n\n  constructor(cfg: LokiConfig) {\n    this.url = cfg.url;\n    this.labels = cfg.labels || { service: 'xopc' };\n    this.batchSize = cfg.batchSize || 100;\n    this.batchTimeoutMs = cfg.batchTimeoutMs || 5000;\n  }\n\n  async export(entry: LogEntry): Promise<void> {\n    this.batch.push(entry);\n    \n    if (this.batch.length >= this.batchSize) {\n      await this.flush();\n    } else if (!this.flushTimer) {\n      this.flushTimer = setTimeout(() => this.flush(), this.batchTimeoutMs);\n    }\n  }\n\n  async flush(): Promise<void> {\n    if (this.batch.length === 0) return;\n    \n    if (this.flushTimer) {\n      clearTimeout(this.flushTimer);\n      this.flushTimer = null;\n    }\n\n    const streams = this.batch.map(entry => ({\n      stream: {\n        ...this.labels,\n        level: entry.level,\n      },\n      values: [\n        [String(new Date(entry.timestamp).getTime() * 1000000), JSON.stringify(entry)],\n      ],\n    }));\n\n    const payload = { streams };\n    const batchToSend = this.batch;\n    this.batch = [];\n\n    try {\n      const response = await fetch(`${this.url}/loki/api/v1/push`, {\n        method: 'POST',\n        headers: {\n          'Content-Type': 'application/json',\n        },\n        body: JSON.stringify(payload),\n      });\n\n      if (!response.ok) {\n        console.error(`[LokiExporter] Failed to send logs: ${response.status}`);\n        // Re-queue failed logs (optional)\n        this.batch.unshift(...batchToSend);\n      }\n    } catch (err) {\n      console.error(`[LokiExporter] Error sending logs: ${err}`);\n    }\n  }\n}\n\n// ============================================\n// ELK Exporter\n// ============================================\n\nclass ElkExporter implements LogExporter {\n  name = 'elk';\n  enabled = true;\n  private url: string;\n  private index: string;\n  private apiKey?: string;\n  private batch: LogEntry[] = [];\n  private batchSize: number;\n\n  constructor(cfg: ElkConfig) {\n    this.url = cfg.url;\n    this.index = cfg.index || 'xopc-logs';\n    this.apiKey = cfg.apiKey;\n    this.batchSize = cfg.batchSize || 100;\n  }\n\n  async export(entry: LogEntry): Promise<void> {\n    this.batch.push(entry);\n    if (this.batch.length >= this.batchSize) {\n      await this.flush();\n    }\n  }\n\n  async flush(): Promise<void> {\n    if (this.batch.length === 0) return;\n\n    const bulkBody = this.batch.flatMap(entry => [\n      JSON.stringify({ index: { _index: this.index } }),\n      JSON.stringify(entry),\n    ]);\n\n    const batchToSend = this.batch;\n    this.batch = [];\n\n    try {\n      const headers: Record<string, string> = {\n        'Content-Type': 'application/json',\n      };\n      if (this.apiKey) {\n        headers['Authorization'] = `ApiKey ${this.apiKey}`;\n      }\n\n      const response = await fetch(`${this.url}/_bulk`, {\n        method: 'POST',\n        headers,\n        body: bulkBody.join('\\n') + '\\n',\n      });\n\n      if (!response.ok) {\n        console.error(`[ElkExporter] Failed to send logs: ${response.status}`);\n        this.batch.unshift(...batchToSend);\n      }\n    } catch (err) {\n      console.error(`[ElkExporter] Error sending logs: ${err}`);\n    }\n  }\n}\n\n// ============================================\n// Datadog Exporter\n// ============================================\n\nclass DatadogExporter implements LogExporter {\n  name = 'datadog';\n  enabled = true;\n  private apiKey: string;\n  private site: string;\n  private service: string;\n  private batch: LogEntry[] = [];\n  private batchSize: number;\n\n  constructor(cfg: DatadogConfig) {\n    this.apiKey = cfg.apiKey;\n    this.site = cfg.site || 'datadoghq.com';\n    this.service = cfg.service || 'xopc';\n    this.batchSize = cfg.batchSize || 100;\n  }\n\n  async export(entry: LogEntry): Promise<void> {\n    this.batch.push({\n      ...entry,\n      service: this.service,\n    });\n    if (this.batch.length >= this.batchSize) {\n      await this.flush();\n    }\n  }\n\n  async flush(): Promise<void> {\n    if (this.batch.length === 0) return;\n\n    const batchToSend = this.batch;\n    this.batch = [];\n\n    try {\n      const response = await fetch(`https://http-intake.logs.${this.site}/v1/input`, {\n        method: 'POST',\n        headers: {\n          'Content-Type': 'application/json',\n          'DD-API-KEY': this.apiKey,\n        },\n        body: JSON.stringify(batchToSend),\n      });\n\n      if (!response.ok) {\n        console.error(`[DatadogExporter] Failed to send logs: ${response.status}`);\n      }\n    } catch (err) {\n      console.error(`[DatadogExporter] Error sending logs: ${err}`);\n    }\n  }\n}\n\n// ============================================\n// Webhook Exporter\n// ============================================\n\nclass WebhookExporter implements LogExporter {\n  name = 'webhook';\n  enabled = true;\n  private url: string;\n  private headers: Record<string, string>;\n  private filter?: LogLevel[];\n\n  constructor(cfg: WebhookConfig) {\n    this.url = cfg.url;\n    this.headers = cfg.headers || { 'Content-Type': 'application/json' };\n    this.filter = cfg.filter;\n  }\n\n  async export(entry: LogEntry): Promise<void> {\n    if (this.filter && !this.filter.includes(entry.level as LogLevel)) {\n      return;\n    }\n\n    try {\n      await fetch(this.url, {\n        method: 'POST',\n        headers: this.headers,\n        body: JSON.stringify(entry),\n      });\n    } catch (err) {\n      console.error(`[WebhookExporter] Error sending log: ${err}`);\n    }\n  }\n\n  async flush(): Promise<void> {\n    // Webhook sends immediately, no batching\n  }\n}\n\n// ============================================\n// Exporter Manager\n// ============================================\n\nconst exporters: LogExporter[] = [];\n\nexport function initializeExporters(configs: ExporterConfig[]): void {\n  for (const cfg of configs) {\n    switch (cfg.type) {\n      case 'loki':\n        exporters.push(new LokiExporter(cfg));\n        break;\n      case 'elk':\n        exporters.push(new ElkExporter(cfg));\n        break;\n      case 'datadog':\n        exporters.push(new DatadogExporter(cfg));\n        break;\n      case 'webhook':\n        exporters.push(new WebhookExporter(cfg));\n        break;\n    }\n  }\n}\n\nexport async function exportLog(entry: LogEntry): Promise<void> {\n  for (const exporter of exporters) {\n    if (exporter.enabled) {\n      try {\n        await exporter.export(entry);\n      } catch (err) {\n        console.error(`[Exporter:${exporter.name}] Failed to export:`, err);\n      }\n    }\n  }\n}\n\nexport async function flushExporters(): Promise<void> {\n  await Promise.all(exporters.map(e => e.flush()));\n}\n\nexport function getExporters(): LogExporter[] {\n  return [...exporters];\n}\n"],"mappings":";;AAkSA,SAAgB,oBAAoB,SAAiC;AACnE,MAAK,MAAM,OAAO,QAChB,SAAQ,IAAI,MAAZ;EACE,KAAK;AACH,aAAU,KAAK,IAAI,aAAa,IAAI,CAAC;AACrC;EACF,KAAK;AACH,aAAU,KAAK,IAAI,YAAY,IAAI,CAAC;AACpC;EACF,KAAK;AACH,aAAU,KAAK,IAAI,gBAAgB,IAAI,CAAC;AACxC;EACF,KAAK;AACH,aAAU,KAAK,IAAI,gBAAgB,IAAI,CAAC;AACxC;;;AAKR,eAAsB,UAAU,OAAgC;AAC9D,MAAK,MAAM,YAAY,UACrB,KAAI,SAAS,QACX,KAAI;AACF,QAAM,SAAS,OAAO,MAAM;UACrB,KAAK;AACZ,UAAQ,MAAM,aAAa,SAAS,KAAK,sBAAsB,IAAI;;;AAM3E,eAAsB,iBAAgC;AACpD,OAAM,QAAQ,IAAI,UAAU,KAAI,MAAK,EAAE,OAAO,CAAC,CAAC;;AAGlD,SAAgB,eAA8B;AAC5C,QAAO,CAAC,GAAG,UAAU;;;;AA1QjB,gBAAN,MAA0C;EACxC,OAAO;EACP,UAAU;EACV;EACA;EACA,QAA4B,EAAE;EAC9B;EACA;EACA,aAA4C;EAE5C,YAAY,KAAiB;AAC3B,QAAK,MAAM,IAAI;AACf,QAAK,SAAS,IAAI,UAAU,EAAE,SAAS,QAAQ;AAC/C,QAAK,YAAY,IAAI,aAAa;AAClC,QAAK,iBAAiB,IAAI,kBAAkB;;EAG9C,MAAM,OAAO,OAAgC;AAC3C,QAAK,MAAM,KAAK,MAAM;AAEtB,OAAI,KAAK,MAAM,UAAU,KAAK,UAC5B,OAAM,KAAK,OAAO;YACT,CAAC,KAAK,WACf,MAAK,aAAa,iBAAiB,KAAK,OAAO,EAAE,KAAK,eAAe;;EAIzE,MAAM,QAAuB;AAC3B,OAAI,KAAK,MAAM,WAAW,EAAG;AAE7B,OAAI,KAAK,YAAY;AACnB,iBAAa,KAAK,WAAW;AAC7B,SAAK,aAAa;;GAapB,MAAM,UAAU,EAAE,SAVF,KAAK,MAAM,KAAI,WAAU;IACvC,QAAQ;KACN,GAAG,KAAK;KACR,OAAO,MAAM;KACd;IACD,QAAQ,CACN,CAAC,OAAO,IAAI,KAAK,MAAM,UAAU,CAAC,SAAS,GAAG,IAAQ,EAAE,KAAK,UAAU,MAAM,CAAC,CAC/E;IACF,EAEwB,EAAE;GAC3B,MAAM,cAAc,KAAK;AACzB,QAAK,QAAQ,EAAE;AAEf,OAAI;IACF,MAAM,WAAW,MAAM,MAAM,GAAG,KAAK,IAAI,oBAAoB;KAC3D,QAAQ;KACR,SAAS,EACP,gBAAgB,oBACjB;KACD,MAAM,KAAK,UAAU,QAAQ;KAC9B,CAAC;AAEF,QAAI,CAAC,SAAS,IAAI;AAChB,aAAQ,MAAM,uCAAuC,SAAS,SAAS;AAEvE,UAAK,MAAM,QAAQ,GAAG,YAAY;;YAE7B,KAAK;AACZ,YAAQ,MAAM,sCAAsC,MAAM;;;;AAS1D,eAAN,MAAyC;EACvC,OAAO;EACP,UAAU;EACV;EACA;EACA;EACA,QAA4B,EAAE;EAC9B;EAEA,YAAY,KAAgB;AAC1B,QAAK,MAAM,IAAI;AACf,QAAK,QAAQ,IAAI,SAAS;AAC1B,QAAK,SAAS,IAAI;AAClB,QAAK,YAAY,IAAI,aAAa;;EAGpC,MAAM,OAAO,OAAgC;AAC3C,QAAK,MAAM,KAAK,MAAM;AACtB,OAAI,KAAK,MAAM,UAAU,KAAK,UAC5B,OAAM,KAAK,OAAO;;EAItB,MAAM,QAAuB;AAC3B,OAAI,KAAK,MAAM,WAAW,EAAG;GAE7B,MAAM,WAAW,KAAK,MAAM,SAAQ,UAAS,CAC3C,KAAK,UAAU,EAAE,OAAO,EAAE,QAAQ,KAAK,OAAO,EAAE,CAAC,EACjD,KAAK,UAAU,MAAM,CACtB,CAAC;GAEF,MAAM,cAAc,KAAK;AACzB,QAAK,QAAQ,EAAE;AAEf,OAAI;IACF,MAAM,UAAkC,EACtC,gBAAgB,oBACjB;AACD,QAAI,KAAK,OACP,SAAQ,mBAAmB,UAAU,KAAK;IAG5C,MAAM,WAAW,MAAM,MAAM,GAAG,KAAK,IAAI,SAAS;KAChD,QAAQ;KACR;KACA,MAAM,SAAS,KAAK,KAAK,GAAG;KAC7B,CAAC;AAEF,QAAI,CAAC,SAAS,IAAI;AAChB,aAAQ,MAAM,sCAAsC,SAAS,SAAS;AACtE,UAAK,MAAM,QAAQ,GAAG,YAAY;;YAE7B,KAAK;AACZ,YAAQ,MAAM,qCAAqC,MAAM;;;;AASzD,mBAAN,MAA6C;EAC3C,OAAO;EACP,UAAU;EACV;EACA;EACA;EACA,QAA4B,EAAE;EAC9B;EAEA,YAAY,KAAoB;AAC9B,QAAK,SAAS,IAAI;AAClB,QAAK,OAAO,IAAI,QAAQ;AACxB,QAAK,UAAU,IAAI,WAAW;AAC9B,QAAK,YAAY,IAAI,aAAa;;EAGpC,MAAM,OAAO,OAAgC;AAC3C,QAAK,MAAM,KAAK;IACd,GAAG;IACH,SAAS,KAAK;IACf,CAAC;AACF,OAAI,KAAK,MAAM,UAAU,KAAK,UAC5B,OAAM,KAAK,OAAO;;EAItB,MAAM,QAAuB;AAC3B,OAAI,KAAK,MAAM,WAAW,EAAG;GAE7B,MAAM,cAAc,KAAK;AACzB,QAAK,QAAQ,EAAE;AAEf,OAAI;IACF,MAAM,WAAW,MAAM,MAAM,4BAA4B,KAAK,KAAK,YAAY;KAC7E,QAAQ;KACR,SAAS;MACP,gBAAgB;MAChB,cAAc,KAAK;MACpB;KACD,MAAM,KAAK,UAAU,YAAY;KAClC,CAAC;AAEF,QAAI,CAAC,SAAS,GACZ,SAAQ,MAAM,0CAA0C,SAAS,SAAS;YAErE,KAAK;AACZ,YAAQ,MAAM,yCAAyC,MAAM;;;;AAS7D,mBAAN,MAA6C;EAC3C,OAAO;EACP,UAAU;EACV;EACA;EACA;EAEA,YAAY,KAAoB;AAC9B,QAAK,MAAM,IAAI;AACf,QAAK,UAAU,IAAI,WAAW,EAAE,gBAAgB,oBAAoB;AACpE,QAAK,SAAS,IAAI;;EAGpB,MAAM,OAAO,OAAgC;AAC3C,OAAI,KAAK,UAAU,CAAC,KAAK,OAAO,SAAS,MAAM,MAAkB,CAC/D;AAGF,OAAI;AACF,UAAM,MAAM,KAAK,KAAK;KACpB,QAAQ;KACR,SAAS,KAAK;KACd,MAAM,KAAK,UAAU,MAAM;KAC5B,CAAC;YACK,KAAK;AACZ,YAAQ,MAAM,wCAAwC,MAAM;;;EAIhE,MAAM,QAAuB;;AASzB,aAA2B,EAAE"}

package/dist/src/utils/logger/index.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.js","names":[],"sources":["../../../../src/utils/logger/index.ts"],"sourcesContent":["/**\n * Modular Logger System\n * \n * Production-grade logging with:\n * - Modular architecture\n * - Context tracking\n * - Statistics\n * - Graceful shutdown\n */\n\nimport pino from 'pino';\nimport type { Logger as PinoLogger } from 'pino';\nimport type { LogLevel, LogContext, ContextualLogger } from './types.js';\n\n// Internal modules\nimport { config, getLogDir, getLoggerConfig } from './config.js';\nimport { initializeStreams } from './streams.js';\nimport { incrementStats, getRuntimeLogStats } from './stats.js';\nimport { isLoggerShuttingDown, flushAndClose, setShuttingDown } from './shutdown.js';\nimport { rotateLogs, cleanOldLogs } from './rotation.js';\nimport { getAsyncLogContext, getAsyncLogCorrelationKeys, mergeContext } from './context.js';\nimport { redactLogRecord } from './redact.js';\nimport { PACKAGE_VERSION } from '../../package-version.js';\n\n// ============================================\n// Base Logger Creation\n// ============================================\n\nconst customLevels = {\n  trace: 10,\n  debug: 20,\n  info: 30,\n  warn: 40,\n  error: 50,\n  fatal: 60,\n};\n\nconst pinoOptions: pino.LoggerOptions = {\n  level: config.level,\n  base: {\n    service: 'xopc',\n    version: process.env.npm_package_version || PACKAGE_VERSION,\n  },\n  timestamp: pino.stdTimeFunctions.isoTime,\n  mixin(mergeObject, _level, logger) {\n    const ctx = getAsyncLogContext();\n    if (!ctx) return {};\n    const bindings =\n      logger && typeof logger.bindings === 'function'\n        ? (logger.bindings() as Record<string, unknown>)\n        : {};\n    const mo = mergeObject as Record<string, unknown>;\n    const out: Record<string, unknown> = {};\n    for (const key of getAsyncLogCorrelationKeys()) {\n      const v = ctx[key];\n      if (v === undefined || v === '') continue;\n      if (mo[key] !== undefined) continue;\n      if (bindings[key] !== undefined) continue;\n      out[key] = v;\n    }\n    return out;\n  },\n  formatters: {\n    level: (label) => ({ level: label }),\n    bindings: (bindings) => ({\n      pid: bindings.pid,\n      host: bindings.host,\n    }),\n    log: (object) => {\n      // Serialize errors with full stack trace\n      if (object.err && object.err instanceof Error) {\n        object.err = {\n          name: object.err.name,\n          message: object.err.message,\n          stack: object.err.stack,\n          cause: object.err.cause instanceof Error \n            ? { name: object.err.cause.name, message: object.err.cause.message, stack: object.err.cause.stack }\n            : object.err.cause,\n        };\n      }\n      for (const key of Object.keys(object)) {\n        if (object[key] instanceof Error) {\n          object[key] = {\n            name: object[key].name,\n            message: object[key].message,\n            stack: object[key].stack,\n          };\n        }\n      }\n      return redactLogRecord(object as Record<string, unknown>);\n    },\n  },\n  customLevels,\n};\n\n// Add pretty print for development\nif (config.prettyPrint) {\n  pinoOptions.transport = {\n    target: 'pino-pretty',\n    options: {\n      colorize: true,\n      translateTime: 'SYS:standard',\n      ignore: 'pid,host',\n    },\n  };\n}\n\nconst streams = initializeStreams();\nconst baseLogger = pino(pinoOptions, pino.multistream(streams));\n\n// ============================================\n// Contextual Logger\n// ============================================\n\nfunction wrapLogMethod(method: Function, defaultContext: LogContext, level: LogLevel) {\n  return function (data: unknown, msg?: string) {\n    // During shutdown, only allow error and fatal logs\n    if (isLoggerShuttingDown()) {\n      if (level !== 'error' && level !== 'fatal') {\n        return;\n      }\n    }\n    \n    const module = defaultContext.module as string | undefined;\n    incrementStats(level, module);\n    \n    return msg !== undefined ? method.call(this, data, msg) : method.call(this, data);\n  };\n}\n\nfunction createProxyLogger(logger: PinoLogger, defaultContext: LogContext = {}): ContextualLogger {\n  const proxy = new Proxy(logger, {\n    get(target, prop) {\n      const propKey = prop as string;\n      \n      if (prop === 'withContext') {\n        return (context: LogContext) => {\n          return createProxyLogger(target.child({ ...context }), mergeContext(defaultContext, context));\n        };\n      }\n      \n      const value = (target as unknown as Record<string, unknown>)[propKey];\n      if (typeof value === 'function') {\n        if (['trace', 'debug', 'info', 'warn', 'error', 'fatal'].includes(propKey)) {\n          return wrapLogMethod(value, defaultContext, propKey as LogLevel);\n        }\n      }\n      \n      return value;\n    },\n  });\n\n  return proxy as ContextualLogger;\n}\n\n// ============================================\n// Public API\n// ============================================\n\nexport const logger = createProxyLogger(baseLogger);\n\nexport function createLogger(module: string, context?: LogContext): ContextualLogger {\n  const child = baseLogger.child({ module });\n  return createProxyLogger(child, { module, ...context });\n}\n\nexport function createModuleLogger(moduleName: string, _modulePath?: string): ContextualLogger {\n  const child = baseLogger.child({ module: moduleName });\n  return createProxyLogger(child, { module: moduleName });\n}\n\nexport function createExtensionLogger(extensionName: string): ContextualLogger {\n  const child = baseLogger.child({ extension: extensionName });\n  return createProxyLogger(child, { extension: extensionName });\n}\n\nexport function createServiceLogger(serviceId: string): ContextualLogger {\n  const child = baseLogger.child({ service: 'cron', scope: serviceId });\n  return createProxyLogger(child, { service: 'cron', scope: serviceId });\n}\n\n// ============================================\n// Log Level Management\n// ============================================\n\nexport function setLogLevel(level: LogLevel): void {\n  baseLogger.level = level;\n}\n\nexport function getLogLevel(): LogLevel {\n  return baseLogger.level as LogLevel;\n}\n\nexport function withLogLevel<T>(level: LogLevel, fn: () => T): T {\n  const previous = baseLogger.level;\n  baseLogger.level = level;\n  try {\n    return fn();\n  } finally {\n    baseLogger.level = previous;\n  }\n}\n\nexport function isLevelEnabled(level: LogLevel): boolean {\n  const levelValues: Record<LogLevel, number> = {\n    trace: 10, debug: 20, info: 30, warn: 40, error: 50, fatal: 60, silent: Number.MAX_VALUE,\n  };\n  return levelValues[level] >= levelValues[getLogLevel()];\n}\n\n// ============================================\n// Re-exports\n// ============================================\n\nexport type {\n  LogLevel,\n  LogContext,\n  LogEntry,\n  LoggerConfig,\n  LogFileMeta,\n  LogQuery,\n  LogStats,\n  RotationResult,\n  ContextualLogger,\n} from './types.js';\n\nexport {\n  // Config\n  getLogDir,\n  getLoggerConfig,\n  \n  // Stats\n  getRuntimeLogStats,\n  \n  // Shutdown\n  isLoggerShuttingDown,\n  flushAndClose,\n  setShuttingDown,\n  \n  // Rotation\n  rotateLogs,\n  cleanOldLogs,\n};\n\n//  Exporters\nexport {\n  type LogExporter,\n  type ExporterConfig,\n  type LokiConfig,\n  type ElkConfig,\n  type DatadogConfig,\n  type WebhookConfig,\n  initializeExporters,\n  exportLog,\n  flushExporters,\n  getExporters,\n} from './exporters.js';\n\nexport {\n  redactSensitiveInfo,\n  redactObject,\n  redactPemBlock,\n  redactSecret,\n  isLogRedactionEnabled,\n} from './redact.js';\n\n//  Audit Log\nexport {\n  type AuditEvent,\n  type AuditEventType,\n  type AuditLogConfig,\n  logAuditEvent,\n  logAuthEvent,\n  logConfigChange,\n  logPermissionChange,\n  logDataAccess,\n  configureAuditLog,\n  getAuditConfig,\n} from './audit.js';\n\nexport { logger as baseLogger };\nexport { pino as Pino };\n\nexport {\n  runWithLogContext,\n  getAsyncLogContext,\n  updateAsyncLogContext,\n  inboundCorrelationMetadataFromAsyncLogContext,\n} from './context.js';\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;AAkHA,SAAS,cAAc,QAAkB,gBAA4B,OAAiB;AACpF,QAAO,SAAU,MAAe,KAAc;AAE5C,MAAI,sBAAsB;OACpB,UAAU,WAAW,UAAU,QACjC;;EAIJ,MAAM,SAAS,eAAe;AAC9B,iBAAe,OAAO,OAAO;AAE7B,SAAO,QAAQ,KAAA,IAAY,OAAO,KAAK,MAAM,MAAM,IAAI,GAAG,OAAO,KAAK,MAAM,KAAK;;;AAIrF,SAAS,kBAAkB,QAAoB,iBAA6B,EAAE,EAAoB;AAsBhG,QAAO,IArBW,MAAM,QAAQ,EAC9B,IAAI,QAAQ,MAAM;EAChB,MAAM,UAAU;AAEhB,MAAI,SAAS,cACX,SAAQ,YAAwB;AAC9B,UAAO,kBAAkB,OAAO,MAAM,EAAE,GAAG,SAAS,CAAC,EAAE,aAAa,gBAAgB,QAAQ,CAAC;;EAIjG,MAAM,QAAS,OAA8C;AAC7D,MAAI,OAAO,UAAU;OACf;IAAC;IAAS;IAAS;IAAQ;IAAQ;IAAS;IAAQ,CAAC,SAAS,QAAQ,CACxE,QAAO,cAAc,OAAO,gBAAgB,QAAoB;;AAIpE,SAAO;IAEV,CAEW;;AASd,SAAgB,aAAa,QAAgB,SAAwC;AAEnF,QAAO,kBADO,WAAW,MAAM,EAAE,QAAQ,CACX,EAAE;EAAE;EAAQ,GAAG;EAAS,CAAC;;AAGzD,SAAgB,mBAAmB,YAAoB,aAAwC;AAE7F,QAAO,kBADO,WAAW,MAAM,EAAE,QAAQ,YAAY,CACvB,EAAE,EAAE,QAAQ,YAAY,CAAC;;AAGzD,SAAgB,sBAAsB,eAAyC;AAE7E,QAAO,kBADO,WAAW,MAAM,EAAE,WAAW,eAAe,CAC7B,EAAE,EAAE,WAAW,eAAe,CAAC;;AAG/D,SAAgB,oBAAoB,WAAqC;AAEvE,QAAO,kBADO,WAAW,MAAM;EAAE,SAAS;EAAQ,OAAO;EAAW,CACtC,EAAE;EAAE,SAAS;EAAQ,OAAO;EAAW,CAAC;;AAOxE,SAAgB,YAAY,OAAuB;AACjD,YAAW,QAAQ;;AAGrB,SAAgB,cAAwB;AACtC,QAAO,WAAW;;AAGpB,SAAgB,aAAgB,OAAiB,IAAgB;CAC/D,MAAM,WAAW,WAAW;AAC5B,YAAW,QAAQ;AACnB,KAAI;AACF,SAAO,IAAI;WACH;AACR,aAAW,QAAQ;;;AAIvB,SAAgB,eAAe,OAA0B;CACvD,MAAM,cAAwC;EAC5C,OAAO;EAAI,OAAO;EAAI,MAAM;EAAI,MAAM;EAAI,OAAO;EAAI,OAAO;EAAI,QAAQ,OAAO;EAChF;AACD,QAAO,YAAY,UAAU,YAAY,aAAa;;;;cAhMS;eAChB;aACe;gBACqB;gBAC5B;eACmC;cAC9C;uBACa;iBA0OnC;aAsBJ;AAjPd,eAAkC;EACtC,OAAO,OAAO;EACd,MAAM;GACJ,SAAS;GACT,SAAS,QAAQ,IAAI,uBAAuB;GAC7C;EACD,WAAW,KAAK,iBAAiB;EACjC,MAAM,aAAa,QAAQ,QAAQ;GACjC,MAAM,MAAM,oBAAoB;AAChC,OAAI,CAAC,IAAK,QAAO,EAAE;GACnB,MAAM,WACJ,UAAU,OAAO,OAAO,aAAa,aAChC,OAAO,UAAU,GAClB,EAAE;GACR,MAAM,KAAK;GACX,MAAM,MAA+B,EAAE;AACvC,QAAK,MAAM,OAAO,4BAA4B,EAAE;IAC9C,MAAM,IAAI,IAAI;AACd,QAAI,MAAM,KAAA,KAAa,MAAM,GAAI;AACjC,QAAI,GAAG,SAAS,KAAA,EAAW;AAC3B,QAAI,SAAS,SAAS,KAAA,EAAW;AACjC,QAAI,OAAO;;AAEb,UAAO;;EAET,YAAY;GACV,QAAQ,WAAW,EAAE,OAAO,OAAO;GACnC,WAAW,cAAc;IACvB,KAAK,SAAS;IACd,MAAM,SAAS;IAChB;GACD,MAAM,WAAW;AAEf,QAAI,OAAO,OAAO,OAAO,eAAe,MACtC,QAAO,MAAM;KACX,MAAM,OAAO,IAAI;KACjB,SAAS,OAAO,IAAI;KACpB,OAAO,OAAO,IAAI;KAClB,OAAO,OAAO,IAAI,iBAAiB,QAC/B;MAAE,MAAM,OAAO,IAAI,MAAM;MAAM,SAAS,OAAO,IAAI,MAAM;MAAS,OAAO,OAAO,IAAI,MAAM;MAAO,GACjG,OAAO,IAAI;KAChB;AAEH,SAAK,MAAM,OAAO,OAAO,KAAK,OAAO,CACnC,KAAI,OAAO,gBAAgB,MACzB,QAAO,OAAO;KACZ,MAAM,OAAO,KAAK;KAClB,SAAS,OAAO,KAAK;KACrB,OAAO,OAAO,KAAK;KACpB;AAGL,WAAO,gBAAgB,OAAkC;;GAE5D;EACD,cAAA;GA/DA,OAAO;GACP,OAAO;GACP,MAAM;GACN,MAAM;GACN,OAAO;GACP,OAAO;GA0DK;EACb;AAGD,KAAI,OAAO,YACT,aAAY,YAAY;EACtB,QAAQ;EACR,SAAS;GACP,UAAU;GACV,eAAe;GACf,QAAQ;GACT;EACF;AAGG,WAAU,mBAAmB;AAC7B,cAAa,KAAK,aAAa,KAAK,YAAY,QAAQ,CAAC;AAmDlD,UAAS,kBAAkB,WAAW"}