alink-cli 0.8.6 → 0.8.7

package/dist/bin.mjs

@@ -52350,6 +52350,7 @@ function isEnvelope(value) {
 //#endregion
 //#region src/tunnel/bridge.ts
 const TUNNEL_SCOPES = [AuthOrchestrationReadScope, AuthOrchestrationOperateScope];
+const hubFrameDecoder = new TextDecoder();
 const ResponseDefectEncoded = (cause) => ({
 	_tag: "Defect",
 	defect: cause instanceof Error ? {
@@ -52433,6 +52434,12 @@ const splitHubFrame = (text) => {
 		rest: text.slice(spaceAt + 1)
 	};
 };
+function isHttpTunnelRequestFrame(value) {
+	return typeof value === "object" && value !== null && value._tag === "HttpRequest" && typeof value.id === "string" && typeof value.method === "string" && typeof value.path === "string" && Array.isArray(value.headers) && (value.body === null || typeof value.body === "string");
+}
+function encodeHttpTunnelResponseFrame(frame) {
+	return JSON.stringify(frame);
+}
 const makeTunnelSocket = (input) => {
 	const runRaw = (handler, options) => scopedWith((scope) => gen(function* () {
 		const fiberSet = yield* make$62().pipe(provide$2(scope));
@@ -52478,7 +52485,7 @@ const runHubTunnel = (config) => gen(function* () {
 			const writeRaw = yield* socket.writer;
 			yield* forever(take$1(outbox).pipe(flatMap$1(writeRaw)));
 		}));
-		const attachTunnel = (tunnelId, live) => gen(function* () {
+		const attachRpcTunnel = (tunnelId, live) => gen(function* () {
 			yield* addFinalizer(() => sync(() => {
 				if (tunnels.get(tunnelId) !== live) return;
 				tunnels.delete(tunnelId);
@@ -52515,14 +52522,121 @@ const runHubTunnel = (config) => gen(function* () {
 				type: "tunnel_open",
 				tunnelId
 			}))) dropTunnel(tunnelId);
-			yield* logInfo("hub tunnel: attached", { tunnelId });
+			yield* logInfo("hub tunnel: attached", {
+				tunnelId,
+				purpose: live.purpose
+			});
 			yield* _await(live.closed);
 		}).pipe(catch_((error) => logWarning$1("hub tunnel: attach failed", {
 			tunnelId,
 			error
 		})));
-		yield* socket.runRaw((data) => {
-			if (typeof data !== "string") return;
+		const attachHttpTunnel = (tunnelId, live) => gen(function* () {
+			yield* addFinalizer(() => sync(() => {
+				if (tunnels.get(tunnelId) !== live) return;
+				tunnels.delete(tunnelId);
+				writeHub(JSON.stringify({
+					type: "tunnel_close",
+					tunnelId,
+					code: 1011,
+					reason: "daemon http tunnel ended"
+				}));
+			}));
+			const issued = yield* serverAuth.issueSession({
+				subject: "hub-tunnel-http",
+				label: "AgentLink hub tunnel HTTP proxy",
+				scopes: [...TUNNEL_SCOPES]
+			});
+			yield* addFinalizer(() => sessionsStore.markDisconnected(issued.sessionId).pipe(andThen(serverAuth.revokeSession(issued.sessionId)), ignore$1));
+			yield* sessionsStore.markConnected(issued.sessionId);
+			const serverConfig = yield* ServerConfig;
+			const httpClient = yield* HttpClient;
+			const localBaseUrl = `http://127.0.0.1:${serverConfig.port}`;
+			const sendEncrypted = (frame) => {
+				try {
+					const envelope = utf8ToEnvelope(config.enckey, encodeHttpTunnelResponseFrame(frame));
+					if (!writeHub(`${tunnelId} ${JSON.stringify(envelope)}`)) dropTunnel(tunnelId);
+				} catch {
+					dropTunnel(tunnelId);
+				}
+			};
+			live.onDecryptedFrame = (frame) => {
+				let requestFrame;
+				try {
+					const parsed = JSON.parse(frame);
+					if (!isHttpTunnelRequestFrame(parsed)) {
+						sendEncrypted({
+							_tag: "HttpResponse",
+							id: typeof parsed?.id === "string" ? parsed.id : "unknown",
+							status: 400,
+							statusText: "Bad Request",
+							headers: [["content-type", "text/plain"]],
+							body: Buffer.from("Invalid HTTP tunnel request frame").toString("base64")
+						});
+						return;
+					}
+					requestFrame = parsed;
+				} catch {
+					sendEncrypted({
+						_tag: "HttpResponse",
+						id: "unknown",
+						status: 400,
+						statusText: "Bad Request",
+						headers: [["content-type", "text/plain"]],
+						body: Buffer.from("Malformed HTTP tunnel request frame").toString("base64")
+					});
+					return;
+				}
+				runFork(gen(function* () {
+					const targetUrl = `${localBaseUrl}${requestFrame.path}`;
+					const headers = { authorization: `Bearer ${issued.token}` };
+					for (const [key, value] of requestFrame.headers) {
+						const lower = key.toLowerCase();
+						if (lower === "authorization" || lower === "cookie") continue;
+						headers[lower] = value;
+					}
+					let request = make$61(requestFrame.method)(targetUrl).pipe(setHeaders(headers));
+					if (requestFrame.body !== null) request = setBody(uint8Array(Buffer.from(requestFrame.body, "base64")))(request);
+					const response = yield* httpClient.execute(request);
+					const responseBody = yield* response.arrayBuffer;
+					const responseHeaders = [];
+					for (const [key, value] of Object.entries(response.headers)) if (typeof value === "string") responseHeaders.push([key, value]);
+					return {
+						_tag: "HttpResponse",
+						id: requestFrame.id,
+						status: response.status,
+						statusText: "",
+						headers: responseHeaders,
+						body: Buffer.from(responseBody).toString("base64")
+					};
+				}).pipe(match$2({
+					onFailure: (cause) => ({
+						_tag: "HttpResponse",
+						id: requestFrame.id,
+						status: 502,
+						statusText: "Bad Gateway",
+						headers: [["content-type", "text/plain"]],
+						body: Buffer.from(cause instanceof Error ? cause.message : String(cause)).toString("base64")
+					}),
+					onSuccess: (response) => response
+				}), tap((frame) => sync(() => sendEncrypted(frame)))));
+			};
+			if (!writeHub(JSON.stringify({
+				type: "tunnel_open",
+				tunnelId
+			}))) dropTunnel(tunnelId);
+			yield* logInfo("hub tunnel: attached", {
+				tunnelId,
+				purpose: live.purpose
+			});
+			yield* _await(live.closed);
+		}).pipe(catch_((error) => logWarning$1("hub tunnel: attach failed", {
+			tunnelId,
+			error
+		})));
+		yield* socket.runRaw((rawData) => {
+			const data = typeof rawData === "string" ? rawData : rawData instanceof Uint8Array ? hubFrameDecoder.decode(rawData) : null;
+			if (data === null) return;
 			if (data.startsWith("{")) {
 				let control;
 				try {
@@ -52534,13 +52648,16 @@ const runHubTunnel = (config) => gen(function* () {
 					const tunnelId = control.tunnelId;
 					if (tunnels.has(tunnelId)) return;
 					return gen(function* () {
+						const closed = yield* make$70();
+						const purpose = control.purpose === "http" ? "http" : "rpc";
 						const live = {
-							closed: yield* make$70(),
+							closed,
 							pendingFrames: [],
+							purpose,
 							onDecryptedFrame: null
 						};
 						tunnels.set(tunnelId, live);
-						yield* forkScoped(scoped(attachTunnel(tunnelId, live)));
+						yield* forkScoped(scoped((purpose === "http" ? attachHttpTunnel : attachRpcTunnel)(tunnelId, live)));
 					});
 				}
 				if (control.type === "tunnel_close" && typeof control.tunnelId === "string") dropTunnel(control.tunnelId);