daemora 1.0.0-alpha.0

package/dist/tools/registry.js

@@ -0,0 +1,73 @@
+/**
+ * ToolRegistry — central place tools register themselves.
+ *
+ * Two responsibilities:
+ *   1. Hold every known tool keyed by name (no duplicates allowed).
+ *   2. Build the model-facing tool list per request: always-on tools
+ *      + tools matched by skill discovery, with tools from disabled
+ *      integrations excluded.
+ */
+import { ValidationError } from "../util/errors.js";
+export class ToolRegistry {
+    byName = new Map();
+    register(def) {
+        if (this.byName.has(def.name)) {
+            throw new ValidationError(`Duplicate tool registration: "${def.name}"`, {
+                existing_source: this.byName.get(def.name).source,
+                new_source: def.source,
+            });
+        }
+        this.byName.set(def.name, def);
+    }
+    registerAll(defs) {
+        for (const d of defs)
+            this.register(d);
+    }
+    unregisterBySource(source) {
+        let removed = 0;
+        for (const [name, def] of this.byName) {
+            if (sameSource(def.source, source)) {
+                this.byName.delete(name);
+                removed++;
+            }
+        }
+        return removed;
+    }
+    has(name) {
+        return this.byName.has(name);
+    }
+    get(name) {
+        return this.byName.get(name);
+    }
+    list() {
+        return Array.from(this.byName.values());
+    }
+    /** Tools available given the user's currently-enabled integrations. */
+    available(enabledIntegrations) {
+        return this.list().filter((d) => {
+            if (d.source.kind === "integration")
+                return enabledIntegrations.has(d.source.id);
+            return true;
+        });
+    }
+    /**
+     * Build the tool list to send to the model on this turn.
+     * Includes:
+     *   - All `alwaysOn` tools (delegate, discoverTools, core io)
+     *   - Tools whose name appears in `skillMatchedTools`
+     * Excludes tools from disabled integrations entirely.
+     */
+    selectFor(filter) {
+        const matched = filter.skillMatchedTools ?? new Set();
+        return this.available(filter.enabledIntegrations).filter((d) => d.alwaysOn === true || matched.has(d.name));
+    }
+}
+function sameSource(a, b) {
+    if (a.kind !== b.kind)
+        return false;
+    if (a.kind === "core")
+        return true;
+    // narrowed: both are integration | crew with same kind
+    return a.id === b.id;
+}
+//# sourceMappingURL=registry.js.map

package/dist/tools/registry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"registry.js","sourceRoot":"","sources":["../../src/tools/registry.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAUpD,MAAM,OAAO,YAAY;IACN,MAAM,GAAG,IAAI,GAAG,EAAmB,CAAC;IAErD,QAAQ,CAAC,GAAY;QACnB,IAAI,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YAC9B,MAAM,IAAI,eAAe,CAAC,iCAAiC,GAAG,CAAC,IAAI,GAAG,EAAE;gBACtE,eAAe,EAAE,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAE,CAAC,MAAM;gBAClD,UAAU,EAAE,GAAG,CAAC,MAAM;aACvB,CAAC,CAAC;QACL,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IACjC,CAAC;IAED,WAAW,CAAC,IAAwB;QAClC,KAAK,MAAM,CAAC,IAAI,IAAI;YAAE,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;IACzC,CAAC;IAED,kBAAkB,CAAC,MAAyB;QAC1C,IAAI,OAAO,GAAG,CAAC,CAAC;QAChB,KAAK,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YACtC,IAAI,UAAU,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC;gBACnC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;gBACzB,OAAO,EAAE,CAAC;YACZ,CAAC;QACH,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,GAAG,CAAC,IAAY;QACd,OAAO,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC/B,CAAC;IAED,GAAG,CAAC,IAAY;QACd,OAAO,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC/B,CAAC;IAED,IAAI;QACF,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;IAC1C,CAAC;IAED,uEAAuE;IACvE,SAAS,CAAC,mBAAwC;QAChD,OAAO,IAAI,CAAC,IAAI,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE;YAC9B,IAAI,CAAC,CAAC,MAAM,CAAC,IAAI,KAAK,aAAa;gBAAE,OAAO,mBAAmB,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YACjF,OAAO,IAAI,CAAC;QACd,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;;;;;OAMG;IACH,SAAS,CAAC,MAAkB;QAC1B,MAAM,OAAO,GAAG,MAAM,CAAC,iBAAiB,IAAI,IAAI,GAAG,EAAU,CAAC;QAC9D,OAAO,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,mBAAmB,CAAC,CAAC,MAAM,CACtD,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,IAAI,IAAI,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAClD,CAAC;IACJ,CAAC;CACF;AAED,SAAS,UAAU,CAAC,CAAoB,EAAE,CAAoB;IAC5D,IAAI,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,IAAI;QAAE,OAAO,KAAK,CAAC;IACpC,IAAI,CAAC,CAAC,IAAI,KAAK,MAAM;QAAE,OAAO,IAAI,CAAC;IACnC,uDAAuD;IACvD,OAAQ,CAAoB,CAAC,EAAE,KAAM,CAAoB,CAAC,EAAE,CAAC;AAC/D,CAAC"}

package/dist/tools/types.d.ts

@@ -0,0 +1,50 @@
+/**
+ * Tool — a callable an agent can invoke from the model's tool-use loop.
+ *
+ * Wrapper around AI SDK's `tool()` so we add structured metadata
+ * (category, source, tags) for filtering + discovery without ever
+ * shipping these to the model.
+ */
+import { type Tool as AiTool } from "ai";
+import type { z, ZodType } from "zod";
+export type ToolCategory = "core" | "filesystem" | "shell" | "network" | "browser" | "search" | "ai" | "channel" | "media" | "data" | "system" | "agent";
+export interface ToolDef<TIn extends ZodType = ZodType, TOut = unknown> {
+    /** Stable name. The agent calls the tool by this. */
+    readonly name: string;
+    /** One-line description shown to the model. Keep under 140 chars. */
+    readonly description: string;
+    /** Zod schema for inputs. Auto-validated before execute(). */
+    readonly inputSchema: TIn;
+    /** Implementation. Receives parsed/validated input + abort signal. */
+    readonly execute: (input: z.infer<TIn>, ctx: ToolContext) => Promise<TOut>;
+    /** Bucketing for discovery. */
+    readonly category: ToolCategory;
+    /** Where this tool came from. Lets us drop integration tools when an integration is disabled. */
+    readonly source: {
+        kind: "core";
+    } | {
+        kind: "integration";
+        id: string;
+    } | {
+        kind: "crew";
+        id: string;
+    };
+    /** Free-form discovery keywords. Used by `discoverTools(query)`. */
+    readonly tags?: readonly string[];
+    /** If true, this tool is always sent to the model even when not skill-matched. */
+    readonly alwaysOn?: boolean;
+    /** If true, mutates state — caller may require explicit user confirmation. */
+    readonly destructive?: boolean;
+}
+export interface ToolContext {
+    readonly abortSignal: AbortSignal;
+    readonly taskId: string;
+    readonly logger: {
+        info: (msg: string, ctx?: object) => void;
+        warn: (msg: string, ctx?: object) => void;
+        error: (msg: string, ctx?: object) => void;
+    };
+}
+/** Convert our ToolDef → AI SDK Tool, baking in the abort signal. */
+export declare function toAiTool(def: ToolDef, ctxFactory: (signal: AbortSignal) => ToolContext): AiTool;
+//# sourceMappingURL=types.d.ts.map

package/dist/tools/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/tools/types.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAQ,KAAK,IAAI,IAAI,MAAM,EAAE,MAAM,IAAI,CAAC;AAC/C,OAAO,KAAK,EAAE,CAAC,EAAE,OAAO,EAAE,MAAM,KAAK,CAAC;AAEtC,MAAM,MAAM,YAAY,GACpB,MAAM,GACN,YAAY,GACZ,OAAO,GACP,SAAS,GACT,SAAS,GACT,QAAQ,GACR,IAAI,GACJ,SAAS,GACT,OAAO,GACP,MAAM,GACN,QAAQ,GACR,OAAO,CAAC;AAEZ,MAAM,WAAW,OAAO,CAAC,GAAG,SAAS,OAAO,GAAG,OAAO,EAAE,IAAI,GAAG,OAAO;IACpE,qDAAqD;IACrD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,qEAAqE;IACrE,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,8DAA8D;IAC9D,QAAQ,CAAC,WAAW,EAAE,GAAG,CAAC;IAC1B,sEAAsE;IACtE,QAAQ,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,GAAG,EAAE,WAAW,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3E,+BAA+B;IAC/B,QAAQ,CAAC,QAAQ,EAAE,YAAY,CAAC;IAChC,iGAAiG;IACjG,QAAQ,CAAC,MAAM,EAAE;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,GAAG;QAAE,IAAI,EAAE,aAAa,CAAC;QAAC,EAAE,EAAE,MAAM,CAAA;KAAE,GAAG;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC;IACvG,oEAAoE;IACpE,QAAQ,CAAC,IAAI,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAClC,kFAAkF;IAClF,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC;IAC5B,8EAA8E;IAC9E,QAAQ,CAAC,WAAW,CAAC,EAAE,OAAO,CAAC;CAChC;AAED,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,WAAW,EAAE,WAAW,CAAC;IAClC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,MAAM,EAAE;QAAE,IAAI,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,MAAM,KAAK,IAAI,CAAC;QAAC,IAAI,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,MAAM,KAAK,IAAI,CAAC;QAAC,KAAK,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,MAAM,KAAK,IAAI,CAAA;KAAE,CAAC;CACvJ;AAED,qEAAqE;AACrE,wBAAgB,QAAQ,CAAC,GAAG,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC,MAAM,EAAE,WAAW,KAAK,WAAW,GAAG,MAAM,CAS/F"}

package/dist/tools/types.js

@@ -0,0 +1,20 @@
+/**
+ * Tool — a callable an agent can invoke from the model's tool-use loop.
+ *
+ * Wrapper around AI SDK's `tool()` so we add structured metadata
+ * (category, source, tags) for filtering + discovery without ever
+ * shipping these to the model.
+ */
+import { tool } from "ai";
+/** Convert our ToolDef → AI SDK Tool, baking in the abort signal. */
+export function toAiTool(def, ctxFactory) {
+    return tool({
+        description: def.description,
+        inputSchema: def.inputSchema,
+        execute: async (input, { abortSignal }) => {
+            const ctx = ctxFactory(abortSignal ?? new AbortController().signal);
+            return def.execute(input, ctx);
+        },
+    });
+}
+//# sourceMappingURL=types.js.map

package/dist/tools/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/tools/types.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,IAAI,EAAuB,MAAM,IAAI,CAAC;AA4C/C,qEAAqE;AACrE,MAAM,UAAU,QAAQ,CAAC,GAAY,EAAE,UAAgD;IACrF,OAAO,IAAI,CAAC;QACV,WAAW,EAAE,GAAG,CAAC,WAAW;QAC5B,WAAW,EAAE,GAAG,CAAC,WAAW;QAC5B,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE;YACxC,MAAM,GAAG,GAAG,UAAU,CAAC,WAAW,IAAI,IAAI,eAAe,EAAE,CAAC,MAAM,CAAC,CAAC;YACpE,OAAO,GAAG,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QACjC,CAAC;KACF,CAAC,CAAC;AACL,CAAC"}

package/dist/tunnels/TunnelManager.d.ts

@@ -0,0 +1,52 @@
+/**
+ * TunnelManager — resolves a public URL for inbound webhooks.
+ *
+ * Resolution order (first match wins):
+ *   1. `PUBLIC_URL` setting      — user controls their own reverse proxy
+ *   2. cloudflared named tunnel  — user has `~/.cloudflared/<id>.json` + `config.yml`
+ *   3. cloudflared quick tunnel  — zero-config, URL rotates per run
+ *   4. Tailscale funnel           — user configured `tailscale serve --funnel`
+ *   5. fallback → localhost       — with a loud warning in logs
+ *
+ * Why cloudflared is the default: free, no signup for quick tunnels,
+ * real TLS, no browser interstitial (unlike ngrok's free tier), URL
+ * stability depends on the tunnel process staying alive. Named tunnels
+ * give a stable URL forever.
+ *
+ * We spawn the tunnel as a child process and parse its stdout for the
+ * URL. On shutdown, we SIGTERM the child.
+ */
+export type TunnelKind = "configured" | "cloudflared-named" | "cloudflared-quick" | "tailscale" | "none";
+export interface TunnelResult {
+    readonly url: string;
+    readonly kind: TunnelKind;
+}
+export interface TunnelOpts {
+    readonly port: number;
+    /** Honours user-configured `PUBLIC_URL` before spawning anything. */
+    readonly publicUrl?: string;
+    /**
+     * Control which auto-provisioning providers to try. Useful for tests
+     * or users who want to explicitly opt out (e.g. airgapped machines).
+     */
+    readonly providers?: readonly TunnelKind[];
+}
+export declare class TunnelManager {
+    private child;
+    private active;
+    /**
+     * Start (or resolve) a tunnel. Returns the public URL if one was
+     * obtained, or an empty string + kind="none" if nothing worked.
+     *
+     * Idempotent: repeated calls reuse the existing tunnel.
+     */
+    start(opts: TunnelOpts): Promise<TunnelResult>;
+    /** Stop the spawned tunnel child (no-op if we didn't spawn one). */
+    stop(): void;
+    current(): TunnelResult;
+    private tryProvider;
+    private tryCloudflaredNamed;
+    private tryCloudflaredQuick;
+    private tryTailscale;
+}
+//# sourceMappingURL=TunnelManager.d.ts.map

package/dist/tunnels/TunnelManager.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"TunnelManager.d.ts","sourceRoot":"","sources":["../../src/tunnels/TunnelManager.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAOH,MAAM,MAAM,UAAU,GAAG,YAAY,GAAG,mBAAmB,GAAG,mBAAmB,GAAG,WAAW,GAAG,MAAM,CAAC;AAEzG,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;CAC3B;AAED,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,qEAAqE;IACrE,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B;;;OAGG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,UAAU,EAAE,CAAC;CAC5C;AAQD,qBAAa,aAAa;IACxB,OAAO,CAAC,KAAK,CAA6B;IAC1C,OAAO,CAAC,MAAM,CAA2C;IAEzD;;;;;OAKG;IACG,KAAK,CAAC,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC,YAAY,CAAC;IA4BpD,oEAAoE;IACpE,IAAI,IAAI,IAAI;IAQZ,OAAO,IAAI,YAAY;YAMT,WAAW;YAOX,mBAAmB;IAuBjC,OAAO,CAAC,mBAAmB;YA+Cb,YAAY;CAqB3B"}

package/dist/tunnels/TunnelManager.js

@@ -0,0 +1,183 @@
+/**
+ * TunnelManager — resolves a public URL for inbound webhooks.
+ *
+ * Resolution order (first match wins):
+ *   1. `PUBLIC_URL` setting      — user controls their own reverse proxy
+ *   2. cloudflared named tunnel  — user has `~/.cloudflared/<id>.json` + `config.yml`
+ *   3. cloudflared quick tunnel  — zero-config, URL rotates per run
+ *   4. Tailscale funnel           — user configured `tailscale serve --funnel`
+ *   5. fallback → localhost       — with a loud warning in logs
+ *
+ * Why cloudflared is the default: free, no signup for quick tunnels,
+ * real TLS, no browser interstitial (unlike ngrok's free tier), URL
+ * stability depends on the tunnel process staying alive. Named tunnels
+ * give a stable URL forever.
+ *
+ * We spawn the tunnel as a child process and parse its stdout for the
+ * URL. On shutdown, we SIGTERM the child.
+ */
+import { spawn, spawnSync } from "node:child_process";
+import { createLogger } from "../util/logger.js";
+const log = createLogger("tunnel");
+const DEFAULT_PROVIDERS = [
+    "cloudflared-named",
+    "cloudflared-quick",
+    "tailscale",
+];
+export class TunnelManager {
+    child = null;
+    active = { url: "", kind: "none" };
+    /**
+     * Start (or resolve) a tunnel. Returns the public URL if one was
+     * obtained, or an empty string + kind="none" if nothing worked.
+     *
+     * Idempotent: repeated calls reuse the existing tunnel.
+     */
+    async start(opts) {
+        if (this.active.kind !== "none")
+            return this.active;
+        if (opts.publicUrl && opts.publicUrl.length > 0) {
+            this.active = { url: opts.publicUrl.replace(/\/$/, ""), kind: "configured" };
+            log.info({ url: this.active.url }, "using configured PUBLIC_URL (no tunnel spawned)");
+            return this.active;
+        }
+        const providers = opts.providers ?? DEFAULT_PROVIDERS;
+        for (const p of providers) {
+            try {
+                const result = await this.tryProvider(p, opts.port);
+                if (result) {
+                    this.active = result;
+                    log.info({ kind: result.kind, url: result.url }, "tunnel up");
+                    return result;
+                }
+            }
+            catch (e) {
+                log.warn({ provider: p, err: e.message }, "tunnel provider failed");
+            }
+        }
+        log.warn("no tunnel available — webhooks from external providers will fail. Install `cloudflared` or set PUBLIC_URL.");
+        return { url: "", kind: "none" };
+    }
+    /** Stop the spawned tunnel child (no-op if we didn't spawn one). */
+    stop() {
+        if (this.child && !this.child.killed) {
+            try {
+                this.child.kill("SIGTERM");
+            }
+            catch { /* ignore */ }
+        }
+        this.child = null;
+        this.active = { url: "", kind: "none" };
+    }
+    current() {
+        return this.active;
+    }
+    // ── Providers ──────────────────────────────────────────────────────────
+    async tryProvider(kind, port) {
+        if (kind === "cloudflared-named")
+            return this.tryCloudflaredNamed(port);
+        if (kind === "cloudflared-quick")
+            return this.tryCloudflaredQuick(port);
+        if (kind === "tailscale")
+            return this.tryTailscale();
+        return null;
+    }
+    async tryCloudflaredNamed(_port) {
+        // A named tunnel is identified by `config.yml` under ~/.cloudflared/.
+        // If absent, we can't spin one up automatically; quick-tunnel is the fallback.
+        if (!isCmdAvailable("cloudflared"))
+            return null;
+        const home = process.env["HOME"] ?? process.env["USERPROFILE"] ?? "";
+        if (!home)
+            return null;
+        const configPath = `${home}/.cloudflared/config.yml`;
+        const { existsSync, readFileSync } = await import("node:fs");
+        if (!existsSync(configPath))
+            return null;
+        // Read `hostname:` from the config — that's the stable URL.
+        const raw = readFileSync(configPath, "utf-8");
+        const hostnameMatch = /^\s*hostname:\s*["']?([^\s"']+)/m.exec(raw);
+        if (!hostnameMatch || !hostnameMatch[1])
+            return null;
+        const hostname = hostnameMatch[1].trim();
+        // Start the tunnel detached so we keep ownership of the child.
+        const proc = spawn("cloudflared", ["tunnel", "run"], { stdio: "ignore" });
+        proc.on("error", (err) => log.warn({ err: err.message }, "cloudflared named crashed"));
+        this.child = proc;
+        return { url: `https://${hostname}`, kind: "cloudflared-named" };
+    }
+    tryCloudflaredQuick(port) {
+        return new Promise((resolve) => {
+            if (!isCmdAvailable("cloudflared"))
+                return resolve(null);
+            const proc = spawn("cloudflared", [
+                "tunnel",
+                "--url", `http://localhost:${port}`,
+                "--no-autoupdate",
+            ], { stdio: ["ignore", "pipe", "pipe"] });
+            let settled = false;
+            const settle = (result) => {
+                if (settled)
+                    return;
+                settled = true;
+                resolve(result);
+            };
+            // Quick-tunnel URLs match `https://<random>.trycloudflare.com`.
+            const URL_RE = /https:\/\/[a-z0-9-]+\.trycloudflare\.com/;
+            const onData = (buf) => {
+                const text = buf.toString("utf-8");
+                const m = URL_RE.exec(text);
+                if (m)
+                    settle({ url: m[0], kind: "cloudflared-quick" });
+            };
+            proc.stderr.on("data", onData);
+            proc.stdout.on("data", onData);
+            proc.on("error", (err) => {
+                log.warn({ err: err.message }, "cloudflared-quick spawn failed");
+                settle(null);
+            });
+            proc.on("exit", (code) => {
+                if (!settled) {
+                    log.warn({ code }, "cloudflared-quick exited before URL detected");
+                    settle(null);
+                }
+            });
+            this.child = proc;
+            // Give it up to 20s to announce the URL. Cloudflare usually does in < 5s.
+            setTimeout(() => {
+                if (!settled) {
+                    log.warn("cloudflared-quick timeout (20s) — no URL detected");
+                    settle(null);
+                }
+            }, 20_000).unref();
+        });
+    }
+    async tryTailscale() {
+        if (!isCmdAvailable("tailscale"))
+            return null;
+        // `tailscale status --json` tells us whether funnel is configured
+        // for this machine. We don't try to configure funnel automatically —
+        // user must `tailscale serve --bg https:443 http://localhost:<port>`
+        // + `tailscale funnel 443 on` first. If both are set, we just
+        // surface the resulting `<host>.ts.net` URL.
+        const res = spawnSync("tailscale", ["status", "--json"], { encoding: "utf-8" });
+        if (res.status !== 0)
+            return null;
+        try {
+            const parsed = JSON.parse(res.stdout);
+            const dns = parsed.Self?.DNSName?.replace(/\.$/, "");
+            if (!dns)
+                return null;
+            return { url: `https://${dns}`, kind: "tailscale" };
+        }
+        catch {
+            return null;
+        }
+    }
+}
+function isCmdAvailable(bin) {
+    const which = process.platform === "win32" ? "where" : "which";
+    const res = spawnSync(which, [bin], { stdio: "ignore" });
+    return res.status === 0;
+}
+//# sourceMappingURL=TunnelManager.js.map

package/dist/tunnels/TunnelManager.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"TunnelManager.js","sourceRoot":"","sources":["../../src/tunnels/TunnelManager.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,EAAE,KAAK,EAAE,SAAS,EAAqB,MAAM,oBAAoB,CAAC;AACzE,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAEjD,MAAM,GAAG,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAC;AAoBnC,MAAM,iBAAiB,GAA0B;IAC/C,mBAAmB;IACnB,mBAAmB;IACnB,WAAW;CACZ,CAAC;AAEF,MAAM,OAAO,aAAa;IAChB,KAAK,GAAwB,IAAI,CAAC;IAClC,MAAM,GAAiB,EAAE,GAAG,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IAEzD;;;;;OAKG;IACH,KAAK,CAAC,KAAK,CAAC,IAAgB;QAC1B,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,MAAM;YAAE,OAAO,IAAI,CAAC,MAAM,CAAC;QAEpD,IAAI,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAChD,IAAI,CAAC,MAAM,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC;YAC7E,GAAG,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,EAAE,iDAAiD,CAAC,CAAC;YACtF,OAAO,IAAI,CAAC,MAAM,CAAC;QACrB,CAAC;QAED,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,iBAAiB,CAAC;QAEtD,KAAK,MAAM,CAAC,IAAI,SAAS,EAAE,CAAC;YAC1B,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;gBACpD,IAAI,MAAM,EAAE,CAAC;oBACX,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;oBACrB,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,EAAE,WAAW,CAAC,CAAC;oBAC9D,OAAO,MAAM,CAAC;gBAChB,CAAC;YACH,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,GAAG,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,GAAG,EAAG,CAAW,CAAC,OAAO,EAAE,EAAE,wBAAwB,CAAC,CAAC;YACjF,CAAC;QACH,CAAC;QAED,GAAG,CAAC,IAAI,CAAC,4GAA4G,CAAC,CAAC;QACvH,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IACnC,CAAC;IAED,oEAAoE;IACpE,IAAI;QACF,IAAI,IAAI,CAAC,KAAK,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;YACrC,IAAI,CAAC;gBAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC;QAC5D,CAAC;QACD,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC;QAClB,IAAI,CAAC,MAAM,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IAC1C,CAAC;IAED,OAAO;QACL,OAAO,IAAI,CAAC,MAAM,CAAC;IACrB,CAAC;IAED,0EAA0E;IAElE,KAAK,CAAC,WAAW,CAAC,IAAgB,EAAE,IAAY;QACtD,IAAI,IAAI,KAAK,mBAAmB;YAAE,OAAO,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC;QACxE,IAAI,IAAI,KAAK,mBAAmB;YAAE,OAAO,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC;QACxE,IAAI,IAAI,KAAK,WAAW;YAAE,OAAO,IAAI,CAAC,YAAY,EAAE,CAAC;QACrD,OAAO,IAAI,CAAC;IACd,CAAC;IAEO,KAAK,CAAC,mBAAmB,CAAC,KAAa;QAC7C,sEAAsE;QACtE,+EAA+E;QAC/E,IAAI,CAAC,cAAc,CAAC,aAAa,CAAC;YAAE,OAAO,IAAI,CAAC;QAChD,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,IAAI,EAAE,CAAC;QACrE,IAAI,CAAC,IAAI;YAAE,OAAO,IAAI,CAAC;QACvB,MAAM,UAAU,GAAG,GAAG,IAAI,0BAA0B,CAAC;QACrD,MAAM,EAAE,UAAU,EAAE,YAAY,EAAE,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,CAAC;QAC7D,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC;YAAE,OAAO,IAAI,CAAC;QAEzC,4DAA4D;QAC5D,MAAM,GAAG,GAAG,YAAY,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;QAC9C,MAAM,aAAa,GAAG,kCAAkC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACnE,IAAI,CAAC,aAAa,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;QACrD,MAAM,QAAQ,GAAG,aAAa,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAEzC,+DAA+D;QAC/D,MAAM,IAAI,GAAG,KAAK,CAAC,aAAa,EAAE,CAAC,QAAQ,EAAE,KAAK,CAAC,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC;QAC1E,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,GAAG,CAAC,OAAO,EAAE,EAAE,2BAA2B,CAAC,CAAC,CAAC;QACvF,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC;QAClB,OAAO,EAAE,GAAG,EAAE,WAAW,QAAQ,EAAE,EAAE,IAAI,EAAE,mBAAmB,EAAE,CAAC;IACnE,CAAC;IAEO,mBAAmB,CAAC,IAAY;QACtC,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;YAC7B,IAAI,CAAC,cAAc,CAAC,aAAa,CAAC;gBAAE,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC;YACzD,MAAM,IAAI,GAAG,KAAK,CAAC,aAAa,EAAE;gBAChC,QAAQ;gBACR,OAAO,EAAE,oBAAoB,IAAI,EAAE;gBACnC,iBAAiB;aAClB,EAAE,EAAE,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;YAE1C,IAAI,OAAO,GAAG,KAAK,CAAC;YACpB,MAAM,MAAM,GAAG,CAAC,MAA2B,EAAE,EAAE;gBAC7C,IAAI,OAAO;oBAAE,OAAO;gBACpB,OAAO,GAAG,IAAI,CAAC;gBACf,OAAO,CAAC,MAAM,CAAC,CAAC;YAClB,CAAC,CAAC;YAEF,gEAAgE;YAChE,MAAM,MAAM,GAAG,0CAA0C,CAAC;YAC1D,MAAM,MAAM,GAAG,CAAC,GAAW,EAAE,EAAE;gBAC7B,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;gBACnC,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBAC5B,IAAI,CAAC;oBAAE,MAAM,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,mBAAmB,EAAE,CAAC,CAAC;YAC1D,CAAC,CAAC;YACF,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;YAC/B,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;YAC/B,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;gBACvB,GAAG,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,GAAG,CAAC,OAAO,EAAE,EAAE,gCAAgC,CAAC,CAAC;gBACjE,MAAM,CAAC,IAAI,CAAC,CAAC;YACf,CAAC,CAAC,CAAC;YACH,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE;gBACvB,IAAI,CAAC,OAAO,EAAE,CAAC;oBACb,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,EAAE,8CAA8C,CAAC,CAAC;oBACnE,MAAM,CAAC,IAAI,CAAC,CAAC;gBACf,CAAC;YACH,CAAC,CAAC,CAAC;YACH,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC;YAElB,0EAA0E;YAC1E,UAAU,CAAC,GAAG,EAAE;gBACd,IAAI,CAAC,OAAO,EAAE,CAAC;oBACb,GAAG,CAAC,IAAI,CAAC,mDAAmD,CAAC,CAAC;oBAC9D,MAAM,CAAC,IAAI,CAAC,CAAC;gBACf,CAAC;YACH,CAAC,EAAE,MAAM,CAAC,CAAC,KAAK,EAAE,CAAC;QACrB,CAAC,CAAC,CAAC;IACL,CAAC;IAEO,KAAK,CAAC,YAAY;QACxB,IAAI,CAAC,cAAc,CAAC,WAAW,CAAC;YAAE,OAAO,IAAI,CAAC;QAC9C,kEAAkE;QAClE,qEAAqE;QACrE,qEAAqE;QACrE,8DAA8D;QAC9D,6CAA6C;QAC7C,MAAM,GAAG,GAAG,SAAS,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE,QAAQ,CAAC,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC;QAChF,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QAClC,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAGnC,CAAC;YACF,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;YACrD,IAAI,CAAC,GAAG;gBAAE,OAAO,IAAI,CAAC;YACtB,OAAO,EAAE,GAAG,EAAE,WAAW,GAAG,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;QACtD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;CACF;AAED,SAAS,cAAc,CAAC,GAAW;IACjC,MAAM,KAAK,GAAG,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC;IAC/D,MAAM,GAAG,GAAG,SAAS,CAAC,KAAK,EAAE,CAAC,GAAG,CAAC,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC;IACzD,OAAO,GAAG,CAAC,MAAM,KAAK,CAAC,CAAC;AAC1B,CAAC"}

package/dist/tunnels/urls.d.ts

@@ -0,0 +1,20 @@
+/**
+ * buildWebhookUrls — compose the registration URLs for a watcher.
+ *
+ * Returns the three URLs a user might need to paste into a provider
+ * dashboard:
+ *   - `generic`  — POST target for the generic handler (bearer or HMAC)
+ *   - `github`   — for repos' "Add webhook → Payload URL"
+ *   - `stripe`   — for dashboard.stripe.com webhooks destination
+ *
+ * `publicUrl` comes from the tunnel manager / PUBLIC_URL setting. If
+ * unset, falls back to `http://localhost:<port>` so the UI still shows
+ * SOMETHING — just with a warning upstream.
+ */
+export interface WebhookUrls {
+    readonly generic: string;
+    readonly github: string;
+    readonly stripe: string;
+}
+export declare function buildWebhookUrls(publicUrl: string, watcherId: string): WebhookUrls;
+//# sourceMappingURL=urls.d.ts.map

package/dist/tunnels/urls.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"urls.d.ts","sourceRoot":"","sources":["../../src/tunnels/urls.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED,wBAAgB,gBAAgB,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,WAAW,CAOlF"}

package/dist/tunnels/urls.js

@@ -0,0 +1,22 @@
+/**
+ * buildWebhookUrls — compose the registration URLs for a watcher.
+ *
+ * Returns the three URLs a user might need to paste into a provider
+ * dashboard:
+ *   - `generic`  — POST target for the generic handler (bearer or HMAC)
+ *   - `github`   — for repos' "Add webhook → Payload URL"
+ *   - `stripe`   — for dashboard.stripe.com webhooks destination
+ *
+ * `publicUrl` comes from the tunnel manager / PUBLIC_URL setting. If
+ * unset, falls back to `http://localhost:<port>` so the UI still shows
+ * SOMETHING — just with a warning upstream.
+ */
+export function buildWebhookUrls(publicUrl, watcherId) {
+    const base = publicUrl.replace(/\/$/, "");
+    return {
+        generic: `${base}/hooks/watch/${encodeURIComponent(watcherId)}`,
+        github: `${base}/hooks/github/${encodeURIComponent(watcherId)}`,
+        stripe: `${base}/hooks/stripe/${encodeURIComponent(watcherId)}`,
+    };
+}
+//# sourceMappingURL=urls.js.map

package/dist/tunnels/urls.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"urls.js","sourceRoot":"","sources":["../../src/tunnels/urls.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAQH,MAAM,UAAU,gBAAgB,CAAC,SAAiB,EAAE,SAAiB;IACnE,MAAM,IAAI,GAAG,SAAS,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAC1C,OAAO;QACL,OAAO,EAAE,GAAG,IAAI,gBAAgB,kBAAkB,CAAC,SAAS,CAAC,EAAE;QAC/D,MAAM,EAAE,GAAG,IAAI,iBAAiB,kBAAkB,CAAC,SAAS,CAAC,EAAE;QAC/D,MAAM,EAAE,GAAG,IAAI,iBAAiB,kBAAkB,CAAC,SAAS,CAAC,EAAE;KAChE,CAAC;AACJ,CAAC"}

package/dist/util/errors.d.ts

@@ -0,0 +1,54 @@
+/**
+ * Typed error hierarchy. Every error thrown across module boundaries
+ * should be one of these (or a subclass), never a plain Error.
+ *
+ * Each carries an HTTP status hint and a stable error_code so the UI
+ * can show actionable messages without parsing strings.
+ */
+export type ErrorCode = "config_error" | "validation_error" | "not_found" | "permission_denied" | "blocked_action" | "rate_limit" | "provider_error" | "provider_unavailable" | "timeout" | "cancelled" | "internal_error";
+export interface DaemoraErrorOptions {
+    readonly code: ErrorCode;
+    readonly status: number;
+    readonly cause?: unknown;
+    readonly context?: Record<string, unknown>;
+}
+export declare class DaemoraError extends Error {
+    readonly code: ErrorCode;
+    readonly status: number;
+    readonly context: Record<string, unknown>;
+    constructor(message: string, opts: DaemoraErrorOptions);
+    toJSON(): Record<string, unknown>;
+}
+export declare class ConfigError extends DaemoraError {
+    constructor(message: string, ctx?: Record<string, unknown>);
+}
+export declare class ValidationError extends DaemoraError {
+    constructor(message: string, ctx?: Record<string, unknown>);
+}
+export declare class NotFoundError extends DaemoraError {
+    constructor(message: string, ctx?: Record<string, unknown>);
+}
+export declare class PermissionDeniedError extends DaemoraError {
+    constructor(message: string, ctx?: Record<string, unknown>);
+}
+export declare class BlockedActionError extends DaemoraError {
+    constructor(message: string, ctx?: Record<string, unknown>);
+}
+export declare class RateLimitError extends DaemoraError {
+    constructor(message: string, retryAfterMs?: number);
+}
+export declare class ProviderError extends DaemoraError {
+    constructor(message: string, provider: string, cause?: unknown);
+}
+export declare class ProviderUnavailableError extends DaemoraError {
+    constructor(provider: string, missingKey?: string);
+}
+export declare class TimeoutError extends DaemoraError {
+    constructor(operation: string, timeoutMs: number);
+}
+export declare class CancelledError extends DaemoraError {
+    constructor(reason?: string);
+}
+/** Coerce any caught value into a DaemoraError for uniform handling. */
+export declare function toDaemoraError(e: unknown): DaemoraError;
+//# sourceMappingURL=errors.d.ts.map

package/dist/util/errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../src/util/errors.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,MAAM,MAAM,SAAS,GACjB,cAAc,GACd,kBAAkB,GAClB,WAAW,GACX,mBAAmB,GACnB,gBAAgB,GAChB,YAAY,GACZ,gBAAgB,GAChB,sBAAsB,GACtB,SAAS,GACT,WAAW,GACX,gBAAgB,CAAC;AAErB,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IACzB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC;IACzB,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC5C;AAED,qBAAa,YAAa,SAAQ,KAAK;IACrC,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IACzB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;gBAE9B,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,mBAAmB;IAQtD,MAAM,IAAI,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;CAQlC;AAED,qBAAa,WAAY,SAAQ,YAAY;gBAC/B,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;CAG3D;AAED,qBAAa,eAAgB,SAAQ,YAAY;gBACnC,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;CAG3D;AAED,qBAAa,aAAc,SAAQ,YAAY;gBACjC,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;CAG3D;AAED,qBAAa,qBAAsB,SAAQ,YAAY;gBACzC,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;CAG3D;AAED,qBAAa,kBAAmB,SAAQ,YAAY;gBACtC,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;CAG3D;AAED,qBAAa,cAAe,SAAQ,YAAY;gBAClC,OAAO,EAAE,MAAM,EAAE,YAAY,CAAC,EAAE,MAAM;CAOnD;AAED,qBAAa,aAAc,SAAQ,YAAY;gBACjC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,OAAO;CAQ/D;AAED,qBAAa,wBAAyB,SAAQ,YAAY;gBAC5C,QAAQ,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM;CAQlD;AAED,qBAAa,YAAa,SAAQ,YAAY;gBAChC,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM;CAOjD;AAED,qBAAa,cAAe,SAAQ,YAAY;gBAClC,MAAM,CAAC,EAAE,MAAM;CAG5B;AAED,wEAAwE;AACxE,wBAAgB,cAAc,CAAC,CAAC,EAAE,OAAO,GAAG,YAAY,CAMvD"}

package/dist/util/errors.js

@@ -0,0 +1,102 @@
+/**
+ * Typed error hierarchy. Every error thrown across module boundaries
+ * should be one of these (or a subclass), never a plain Error.
+ *
+ * Each carries an HTTP status hint and a stable error_code so the UI
+ * can show actionable messages without parsing strings.
+ */
+export class DaemoraError extends Error {
+    code;
+    status;
+    context;
+    constructor(message, opts) {
+        super(message, { cause: opts.cause });
+        this.name = this.constructor.name;
+        this.code = opts.code;
+        this.status = opts.status;
+        this.context = opts.context ?? {};
+    }
+    toJSON() {
+        return {
+            error_code: this.code,
+            message: this.message,
+            status: this.status,
+            ...(Object.keys(this.context).length > 0 ? { context: this.context } : {}),
+        };
+    }
+}
+export class ConfigError extends DaemoraError {
+    constructor(message, ctx) {
+        super(message, { code: "config_error", status: 500, ...(ctx ? { context: ctx } : {}) });
+    }
+}
+export class ValidationError extends DaemoraError {
+    constructor(message, ctx) {
+        super(message, { code: "validation_error", status: 400, ...(ctx ? { context: ctx } : {}) });
+    }
+}
+export class NotFoundError extends DaemoraError {
+    constructor(message, ctx) {
+        super(message, { code: "not_found", status: 404, ...(ctx ? { context: ctx } : {}) });
+    }
+}
+export class PermissionDeniedError extends DaemoraError {
+    constructor(message, ctx) {
+        super(message, { code: "permission_denied", status: 403, ...(ctx ? { context: ctx } : {}) });
+    }
+}
+export class BlockedActionError extends DaemoraError {
+    constructor(message, ctx) {
+        super(message, { code: "blocked_action", status: 403, ...(ctx ? { context: ctx } : {}) });
+    }
+}
+export class RateLimitError extends DaemoraError {
+    constructor(message, retryAfterMs) {
+        super(message, {
+            code: "rate_limit",
+            status: 429,
+            ...(retryAfterMs !== undefined ? { context: { retry_after_ms: retryAfterMs } } : {}),
+        });
+    }
+}
+export class ProviderError extends DaemoraError {
+    constructor(message, provider, cause) {
+        super(message, {
+            code: "provider_error",
+            status: 502,
+            ...(cause !== undefined ? { cause } : {}),
+            context: { provider },
+        });
+    }
+}
+export class ProviderUnavailableError extends DaemoraError {
+    constructor(provider, missingKey) {
+        super(missingKey
+            ? `Provider "${provider}" not configured — set ${missingKey} in your vault or environment.`
+            : `Provider "${provider}" is not available.`, { code: "provider_unavailable", status: 503, context: { provider, ...(missingKey ? { missing_key: missingKey } : {}) } });
+    }
+}
+export class TimeoutError extends DaemoraError {
+    constructor(operation, timeoutMs) {
+        super(`${operation} timed out after ${timeoutMs}ms`, {
+            code: "timeout",
+            status: 504,
+            context: { operation, timeout_ms: timeoutMs },
+        });
+    }
+}
+export class CancelledError extends DaemoraError {
+    constructor(reason) {
+        super(reason ?? "Operation was cancelled", { code: "cancelled", status: 499 });
+    }
+}
+/** Coerce any caught value into a DaemoraError for uniform handling. */
+export function toDaemoraError(e) {
+    if (e instanceof DaemoraError)
+        return e;
+    if (e instanceof Error) {
+        return new DaemoraError(e.message, { code: "internal_error", status: 500, cause: e });
+    }
+    return new DaemoraError(String(e), { code: "internal_error", status: 500 });
+}
+//# sourceMappingURL=errors.js.map

package/dist/util/errors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../../src/util/errors.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAsBH,MAAM,OAAO,YAAa,SAAQ,KAAK;IAC5B,IAAI,CAAY;IAChB,MAAM,CAAS;IACf,OAAO,CAA0B;IAE1C,YAAY,OAAe,EAAE,IAAyB;QACpD,KAAK,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;QACtC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC;QAClC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;QACtB,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;QAC1B,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC;IACpC,CAAC;IAED,MAAM;QACJ,OAAO;YACL,UAAU,EAAE,IAAI,CAAC,IAAI;YACrB,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC3E,CAAC;IACJ,CAAC;CACF;AAED,MAAM,OAAO,WAAY,SAAQ,YAAY;IAC3C,YAAY,OAAe,EAAE,GAA6B;QACxD,KAAK,CAAC,OAAO,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;IAC1F,CAAC;CACF;AAED,MAAM,OAAO,eAAgB,SAAQ,YAAY;IAC/C,YAAY,OAAe,EAAE,GAA6B;QACxD,KAAK,CAAC,OAAO,EAAE,EAAE,IAAI,EAAE,kBAAkB,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;IAC9F,CAAC;CACF;AAED,MAAM,OAAO,aAAc,SAAQ,YAAY;IAC7C,YAAY,OAAe,EAAE,GAA6B;QACxD,KAAK,CAAC,OAAO,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;IACvF,CAAC;CACF;AAED,MAAM,OAAO,qBAAsB,SAAQ,YAAY;IACrD,YAAY,OAAe,EAAE,GAA6B;QACxD,KAAK,CAAC,OAAO,EAAE,EAAE,IAAI,EAAE,mBAAmB,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;IAC/F,CAAC;CACF;AAED,MAAM,OAAO,kBAAmB,SAAQ,YAAY;IAClD,YAAY,OAAe,EAAE,GAA6B;QACxD,KAAK,CAAC,OAAO,EAAE,EAAE,IAAI,EAAE,gBAAgB,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;IAC5F,CAAC;CACF;AAED,MAAM,OAAO,cAAe,SAAQ,YAAY;IAC9C,YAAY,OAAe,EAAE,YAAqB;QAChD,KAAK,CAAC,OAAO,EAAE;YACb,IAAI,EAAE,YAAY;YAClB,MAAM,EAAE,GAAG;YACX,GAAG,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,YAAY,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACrF,CAAC,CAAC;IACL,CAAC;CACF;AAED,MAAM,OAAO,aAAc,SAAQ,YAAY;IAC7C,YAAY,OAAe,EAAE,QAAgB,EAAE,KAAe;QAC5D,KAAK,CAAC,OAAO,EAAE;YACb,IAAI,EAAE,gBAAgB;YACtB,MAAM,EAAE,GAAG;YACX,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACzC,OAAO,EAAE,EAAE,QAAQ,EAAE;SACtB,CAAC,CAAC;IACL,CAAC;CACF;AAED,MAAM,OAAO,wBAAyB,SAAQ,YAAY;IACxD,YAAY,QAAgB,EAAE,UAAmB;QAC/C,KAAK,CACH,UAAU;YACR,CAAC,CAAC,aAAa,QAAQ,0BAA0B,UAAU,gCAAgC;YAC3F,CAAC,CAAC,aAAa,QAAQ,qBAAqB,EAC9C,EAAE,IAAI,EAAE,sBAAsB,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,QAAQ,EAAE,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CACzH,CAAC;IACJ,CAAC;CACF;AAED,MAAM,OAAO,YAAa,SAAQ,YAAY;IAC5C,YAAY,SAAiB,EAAE,SAAiB;QAC9C,KAAK,CAAC,GAAG,SAAS,oBAAoB,SAAS,IAAI,EAAE;YACnD,IAAI,EAAE,SAAS;YACf,MAAM,EAAE,GAAG;YACX,OAAO,EAAE,EAAE,SAAS,EAAE,UAAU,EAAE,SAAS,EAAE;SAC9C,CAAC,CAAC;IACL,CAAC;CACF;AAED,MAAM,OAAO,cAAe,SAAQ,YAAY;IAC9C,YAAY,MAAe;QACzB,KAAK,CAAC,MAAM,IAAI,yBAAyB,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;IACjF,CAAC;CACF;AAED,wEAAwE;AACxE,MAAM,UAAU,cAAc,CAAC,CAAU;IACvC,IAAI,CAAC,YAAY,YAAY;QAAE,OAAO,CAAC,CAAC;IACxC,IAAI,CAAC,YAAY,KAAK,EAAE,CAAC;QACvB,OAAO,IAAI,YAAY,CAAC,CAAC,CAAC,OAAO,EAAE,EAAE,IAAI,EAAE,gBAAgB,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC;IACxF,CAAC;IACD,OAAO,IAAI,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,gBAAgB,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;AAC9E,CAAC"}