@xopcai/xopc 0.0.222 → 0.0.223

package/dist/src/tunnel/index.js

@@ -1,7 +1,7 @@
 import { loadTunnelState, resolveTunnelStatePath, saveTunnelState } from "./tunnel-state.js";
 import { buildMobileConnectQrPayload, resolveLanGatewayUrl } from "./tunnel-qr.js";
 import { CURRENT_TUNNEL_CONSENT_VERSION, TUNNEL_CONSENT_REQUIRED_CODE, TUNNEL_RISK_SUMMARY_LINES, TunnelConsentError, assertTunnelMayStart, getTunnelConsentState, hasValidTunnelConsent } from "./consent.js";
-import { getTunnelRegistrationSecretMeta, isMaskedTunnelSecretPatchValue, isProductionTunnelBroker, resolveTunnelBrokerUrl, resolveTunnelRegistrationSecret } from "./env.js";
+import { TUNNEL_REGISTRATION_SECRET_REQUIRED_CODE, TunnelRegistrationSecretError, getTunnelRegistrationSecretMeta, isLocalDevelopmentTunnelBroker, isMaskedTunnelSecretPatchValue, resolveOptionalTunnelRegistrationSecret, resolveTunnelBrokerUrl, resolveTunnelRegistrationSecret, tunnelRegistrationSecretRequiredMessage } from "./env.js";
 import { TunnelBrokerClient, resolveBrokerApiBase } from "./broker-client.js";
 import { FRPC_VERSION, clearFrpcPathForProcess, ensureFrpcBinary, publishFrpcPathForProcess } from "./frpc-binary.js";
 import { consumePairingSecret, createPairingSecret, resetPairingSessionsForTests } from "./pairing.js";
@@ -12,4 +12,4 @@ import { clearTunnelWellKnownCache, fetchTunnelWellKnown } from "./well-known.js
 import { configureTunnelFromGatewayConfig, maybeAutoStartTunnelFromConfig, wireTunnelEventsToGateway } from "./gateway-lifecycle.js";
 import { applyTunnelConsentToConfig, mergeTunnelConfigPatch, sanitizeTunnelConfig, setTunnelEnabledInConfig } from "./tunnel-config.js";
 import { consumeTunnelMutationLimit, resetTunnelMutationLimitsForTests } from "./tunnel-rate-limit.js";
-export { CURRENT_TUNNEL_CONSENT_VERSION, FRPC_VERSION, TUNNEL_CONSENT_REQUIRED_CODE, TUNNEL_RISK_SUMMARY_LINES, TunnelBrokerClient, TunnelConsentError, TunnelService, applyTunnelConsentToConfig, assertTunnelMayStart, buildMobileConnectQrPayload, clearFrpcPathForProcess, clearTunnelWellKnownCache, configureTunnelFromGatewayConfig, consumePairingSecret, consumeTunnelMutationLimit, createPairingSecret, ensureFrpcBinary, fetchTunnelWellKnown, getTunnelConsentState, getTunnelRegistrationSecretMeta, getTunnelService, hasValidTunnelConsent, hashGatewayToken, isMaskedTunnelSecretPatchValue, isProductionTunnelBroker, loadTunnelState, logTunnelAudit, maybeAutoStartTunnelFromConfig, mergeTunnelConfigPatch, publishFrpcPathForProcess, resetPairingSessionsForTests, resetTunnelMutationLimitsForTests, resolveBrokerApiBase, resolveFrpSubdomainHost, resolveLanGatewayUrl, resolveTunnelBrokerUrl, resolveTunnelRegistrationSecret, resolveTunnelStatePath, sanitizeTunnelConfig, saveTunnelState, setTunnelEnabledInConfig, wireTunnelEventsToGateway };
+export { CURRENT_TUNNEL_CONSENT_VERSION, FRPC_VERSION, TUNNEL_CONSENT_REQUIRED_CODE, TUNNEL_REGISTRATION_SECRET_REQUIRED_CODE, TUNNEL_RISK_SUMMARY_LINES, TunnelBrokerClient, TunnelConsentError, TunnelRegistrationSecretError, TunnelService, applyTunnelConsentToConfig, assertTunnelMayStart, buildMobileConnectQrPayload, clearFrpcPathForProcess, clearTunnelWellKnownCache, configureTunnelFromGatewayConfig, consumePairingSecret, consumeTunnelMutationLimit, createPairingSecret, ensureFrpcBinary, fetchTunnelWellKnown, getTunnelConsentState, getTunnelRegistrationSecretMeta, getTunnelService, hasValidTunnelConsent, hashGatewayToken, isLocalDevelopmentTunnelBroker, isMaskedTunnelSecretPatchValue, loadTunnelState, logTunnelAudit, maybeAutoStartTunnelFromConfig, mergeTunnelConfigPatch, publishFrpcPathForProcess, resetPairingSessionsForTests, resetTunnelMutationLimitsForTests, resolveBrokerApiBase, resolveFrpSubdomainHost, resolveLanGatewayUrl, resolveOptionalTunnelRegistrationSecret, resolveTunnelBrokerUrl, resolveTunnelRegistrationSecret, resolveTunnelStatePath, sanitizeTunnelConfig, saveTunnelState, setTunnelEnabledInConfig, tunnelRegistrationSecretRequiredMessage, wireTunnelEventsToGateway };

package/dist/src/tunnel/tunnel-audit.d.ts

@@ -1,2 +1,2 @@
-export type TunnelAuditEvent = 'tunnel.consent' | 'tunnel.start' | 'tunnel.stop' | 'tunnel.release' | 'tunnel.start_denied' | 'tunnel.pair' | 'tunnel.exchange_token' | 'tunnel.enable_lan_pairing';
+export type TunnelAuditEvent = 'tunnel.consent' | 'tunnel.start' | 'tunnel.stop' | 'tunnel.release' | 'tunnel.start_denied' | 'tunnel.pair' | 'tunnel.exchange_token' | 'tunnel.registration_authorized' | 'tunnel.enable_lan_pairing';
 export declare function logTunnelAudit(event: TunnelAuditEvent, fields: Record<string, unknown>, message: string): void;

package/dist/src/tunnel/tunnel-config.d.ts

@@ -8,7 +8,7 @@ export declare function mergeTunnelConfigPatch(config: Config, patch: Record<str
 export declare function applyTunnelConsentToConfig(config: Config): void;
 export declare function setTunnelEnabledInConfig(config: Config, enabled: boolean): void;
 /**
- * Clear stale tunnel flags when consent is missing or outdated (Phase 2: config/runtime alignment).
+ * Clear stale tunnel flags when consent or broker credentials cannot support a start.
  * Returns true when `config.tunnel` was modified.
  */
 export declare function sanitizeTunnelConfig(config: Config): boolean;

package/dist/src/tunnel/tunnel-config.js

@@ -1,6 +1,6 @@
 import { TunnelConfigSchema, TunnelConsentSchema, init_schema } from "../config/schema.js";
 import { assertTunnelAutoStartAllowed, buildTunnelConsentRecord, hasValidTunnelConsent } from "./consent.js";
-import { isMaskedTunnelSecretPatchValue } from "./env.js";
+import { getTunnelRegistrationSecretMeta, isMaskedTunnelSecretPatchValue } from "./env.js";
 import { z } from "zod";
 //#region src/tunnel/tunnel-config.ts
 init_schema();
@@ -29,7 +29,11 @@ function mergeTunnelConfigPatch(config, patch) {
 		...config.tunnel ?? TunnelConfigSchema.parse({}),
 		...patchFields
 	};
-	if (parsed.data.registrationSecret === null) delete next.registrationSecret;
+	if (parsed.data.registrationSecret === null) {
+		delete next.registrationSecret;
+		next.enabled = false;
+		next.autoStart = false;
+	}
 	if (parsed.data.autoStart === true) {
 		const probeTunnel = TunnelConfigSchema.parse({
 			...next,
@@ -67,13 +71,14 @@ function setTunnelEnabledInConfig(config, enabled) {
 	config.tunnel.enabled = enabled;
 }
 /**
-* Clear stale tunnel flags when consent is missing or outdated (Phase 2: config/runtime alignment).
+* Clear stale tunnel flags when consent or broker credentials cannot support a start.
 * Returns true when `config.tunnel` was modified.
 */
 function sanitizeTunnelConfig(config) {
 	const tunnel = config.tunnel;
 	if (!tunnel) return false;
-	if (hasValidTunnelConsent(config)) return false;
+	const brokerReady = getTunnelRegistrationSecretMeta(config).configured;
+	if (hasValidTunnelConsent(config) && brokerReady) return false;
 	let changed = false;
 	if (tunnel.enabled) {
 		tunnel.enabled = false;

package/dist/src/tunnel/tunnel-service.d.ts

@@ -2,7 +2,7 @@ import { EventEmitter } from 'node:events';
 import type { TunnelQrPayload, TunnelStatus } from './tunnel-types.js';
 export type TunnelServiceConfig = {
     brokerUrl: string;
-    registrationSecret: string;
+    registrationSecret?: string;
     autoStart: boolean;
     gatewayHost: string;
     frpSubdomainHost: string;

package/dist/src/tunnel/tunnel-service.js

@@ -3,6 +3,7 @@ import { createLogger } from "../utils/logger/index.js";
 import { init_logger } from "../utils/logger.js";
 import { clearTunnelState, loadTunnelState, saveTunnelState, updateTunnelState } from "./tunnel-state.js";
 import { buildMobileConnectQrPayload, resolveLanGatewayUrl } from "./tunnel-qr.js";
+import { TunnelRegistrationSecretError } from "./env.js";
 import { TunnelBrokerClient, resolveBrokerApiBase } from "./broker-client.js";
 import { clearFrpcPathForProcess, ensureFrpcBinary, publishFrpcPathForProcess } from "./frpc-binary.js";
 import { writeFrpcConfig } from "./frpc-config.js";
@@ -230,6 +231,7 @@ var TunnelService = class extends EventEmitter {
 				phase: "tunnel_resume"
 			}, "Persisted tunnel not resumable — registering again");
 		}
+		if (!cfg.registrationSecret) throw new TunnelRegistrationSecretError(cfg.brokerUrl);
 		return broker.register({
 			brokerUrl: resolveBrokerApiBase(cfg.brokerUrl),
 			registrationSecret: cfg.registrationSecret,
@@ -319,6 +321,7 @@ var TunnelService = class extends EventEmitter {
 				const cfg = this.serviceConfig;
 				if (!ctx || !cfg) return;
 				try {
+					if (!cfg.registrationSecret) throw new TunnelRegistrationSecretError(cfg.brokerUrl);
 					const registration = await broker.register({
 						brokerUrl: resolveBrokerApiBase(cfg.brokerUrl),
 						registrationSecret: cfg.registrationSecret,

package/dist/src/tunnel/well-known.d.ts

@@ -15,7 +15,7 @@ export type TunnelWellKnownConfig = {
 };
 /**
  * Fetch `/.well-known/tunnel-config` (broker URL, frp endpoints, frpc version).
- * Registration secret is never published here — use `XOPC_TUNNEL_REGISTRATION_SECRET`.
+ * Registration secrets are never published here.
  */
 export declare function fetchTunnelWellKnown(brokerUrl: string): Promise<TunnelWellKnownConfig>;
 export declare function pingTunnelBroker(brokerUrl: string): Promise<boolean>;

package/dist/src/tunnel/well-known.js

@@ -10,7 +10,7 @@ function brokerOrigin(brokerUrl) {
 }
 /**
 * Fetch `/.well-known/tunnel-config` (broker URL, frp endpoints, frpc version).
-* Registration secret is never published here — use `XOPC_TUNNEL_REGISTRATION_SECRET`.
+* Registration secrets are never published here.
 */
 async function fetchTunnelWellKnown(brokerUrl) {
 	const origin = brokerOrigin(brokerUrl);

package/dist/src/tunnel/xopc-cloud-registration.d.ts

@@ -0,0 +1,9 @@
+type ProvisionOptions = {
+    fetchImpl?: typeof fetch;
+    routerUrl?: string;
+    resolveAccessToken?: () => Promise<string | null>;
+    deviceName?: string;
+};
+/** Exchange a narrowly scoped XOPC OAuth grant for a tunnel registration key. */
+export declare function provisionTunnelRegistrationKey(options?: ProvisionOptions): Promise<string>;
+export {};

package/dist/src/tunnel/xopc-cloud-registration.js

@@ -0,0 +1,42 @@
+import { CredentialResolver, init_credentials } from "../auth/credentials.js";
+import { init_xopc_cloud_config, resolveXopcModelRouterUrl } from "../providers/xopc-cloud-config.js";
+import { hostname } from "node:os";
+import { z } from "zod";
+//#region src/tunnel/xopc-cloud-registration.ts
+init_credentials();
+init_xopc_cloud_config();
+const registrationResponseSchema = z.object({ key: z.string().min(1) });
+function responseError(body, status) {
+	if (body && typeof body === "object") {
+		const error = body.error;
+		if (error && typeof error === "object") {
+			const message = error.message;
+			if (typeof message === "string" && message.trim()) return message;
+		}
+	}
+	return `Tunnel registration failed (${status})`;
+}
+/** Exchange a narrowly scoped XOPC OAuth grant for a tunnel registration key. */
+async function provisionTunnelRegistrationKey(options = {}) {
+	const accessToken = await (options.resolveAccessToken ?? (() => new CredentialResolver().resolveApiKey("xopc-tunnel")))();
+	if (!accessToken) throw new Error("Authorize XOPC Public Tunnel before creating a registration key");
+	const routerUrl = resolveXopcModelRouterUrl(options.routerUrl);
+	const deviceName = options.deviceName?.trim() || hostname() || "XOPC gateway";
+	const response = await (options.fetchImpl ?? fetch)(`${routerUrl}/tunnel/registration-key`, {
+		method: "POST",
+		headers: {
+			authorization: `Bearer ${accessToken}`,
+			accept: "application/json",
+			"content-type": "application/json"
+		},
+		body: JSON.stringify({ name: deviceName.slice(0, 64) }),
+		signal: AbortSignal.timeout(3e4)
+	});
+	const body = await response.json().catch(() => null);
+	if (!response.ok) throw new Error(responseError(body, response.status));
+	const parsed = registrationResponseSchema.safeParse(body);
+	if (!parsed.success) throw new Error("Tunnel registration returned an invalid response");
+	return parsed.data.key;
+}
+//#endregion
+export { provisionTunnelRegistrationKey };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@xopcai/xopc",
-  "version": "0.0.222",
+  "version": "0.0.223",
   "description": "Local-first personal AI assistant with reviewable user understanding, durable tasks, workflows, automations, and local or cloud models.",
   "type": "module",
   "main": "dist/src/index.js",
@@ -158,9 +158,9 @@
     "vitest": "4.1.5",
     "vue": "^3.5.35",
     "@xopcai/endpoint-tools-protocol": "0.0.0",
-    "@xopcai/realtime-protocol": "0.0.0",
     "@xopcai/gateway-contract": "0.0.0",
-    "@xopcai/realtime-client": "0.0.0"
+    "@xopcai/realtime-client": "0.0.0",
+    "@xopcai/realtime-protocol": "0.0.0"
   },
   "scripts": {
     "assets:brand": "node scripts/generate-brand-assets.mjs",