dsh-zen-remote 2.2.9 → 2.3.2

package/lib/wizard/binary.js

@@ -0,0 +1,138 @@
+/**
+ * Ingress binary arithmetic (GW-2): platform mapping, download-URL
+ * construction and install-path computation for the two binaries the
+ * gateway wizard manages — Caddy (custom build with the Cloudflare DNS
+ * module, for DNS-01 certificates) and cloudflared (the tunnel client).
+ *
+ * Pure by contract: URL strings, path strings and platform facts only —
+ * every touch of the filesystem or the network lives in binary-io.ts, and
+ * the routes layer reads both. `node:path`/`node:os` here are arithmetic,
+ * not I/O: the same discipline as virtual-id.ts's zero-dependency rule,
+ * relaxed one notch because path building is this module's whole job.
+ *
+ * Platform coverage mirrors what both upstream distribution points actually
+ * ship: darwin/linux/windows × amd64/arm64. macOS arm64's cloudflared asset
+ * is a `.tgz` (the only archive shape in the set) — binary-io unpacks it.
+ */
+import { join } from 'node:path';
+import { homedir } from 'node:os';
+/** This process's platform, mapped into the download points' naming. */
+export function currentPlatform() {
+    if (process.platform === 'win32')
+        return { os: 'windows', arch: 'amd64' };
+    const arch = process.arch === 'arm64' ? 'arm64' : 'amd64';
+    if (process.platform === 'darwin')
+        return { os: 'darwin', arch };
+    return { os: 'linux', arch };
+}
+/** Caddy's custom-build API, pinned to the Cloudflare DNS module the
+ * DNS-01 challenge needs (plain Caddy cannot write the TXT record). */
+export function caddyDownloadUrl(platform) {
+    return `https://caddyserver.com/api/download?os=${platform.os}&arch=${platform.arch}&p=github.com/caddy-dns/cloudflare`;
+}
+/**
+ * The Caddy asset the build API answers with, PLUS its archive shape —
+ * `caddyserver.com/api/download` returns a bare Mach-O/ELF binary on unix
+ * (`Content-Disposition: attachment; filename="caddy_<os>_<arch>_custom"`,
+ * `Content-Type: application/octet-stream`) and a bare `.exe` on Windows.
+ */
+export function caddyDownload(platform) {
+    return { url: caddyDownloadUrl(platform), archive: platform.os === 'windows' ? 'exe' : 'none' };
+}
+/** cloudflared's GitHub Releases asset for one platform, plus the archive
+ * shape the I/O half must unwrap (darwin assets are `.tgz`, windows ships
+ * a bare `.exe`, linux a bare binary). */
+export function cloudflaredDownload(platform) {
+    const base = 'https://github.com/cloudflare/cloudflared/releases/latest/download/';
+    if (platform.os === 'darwin')
+        return { url: `${base}cloudflared-darwin-${platform.arch}.tgz`, archive: 'tgz' };
+    if (platform.os === 'windows')
+        return { url: `${base}cloudflared-windows-amd64.exe`, archive: 'exe' };
+    return { url: `${base}cloudflared-linux-${platform.arch}`, archive: 'none' };
+}
+/** Both download URLs for one platform WITH their archive shapes, defaults
+ * to the running process's. The archive metadata — not a URL suffix — is
+ * what tells the I/O half how to unpack. */
+export function binaryUrls(platform = currentPlatform()) {
+    const caddy = caddyDownload(platform);
+    const cloudflared = cloudflaredDownload(platform);
+    return { caddy: caddy.url, caddyArchive: caddy.archive, cloudflared: cloudflared.url, cloudflaredArchive: cloudflared.archive };
+}
+/** Official manual-install pages, surfaced by the UI when a download fails. */
+export const MANUAL_INSTALL_LINKS = {
+    caddy: 'https://caddyserver.com/download',
+    cloudflared: 'https://developers.cloudflare.com/cloudflare-one/connections/connect-networks/downloads/',
+};
+/** Everything ingress lives under this one directory of DSH_HOME. */
+export const INGRESS_DIR_NAME = 'zen-remote-ingress';
+/** `<DSH_HOME>` as the rest of the plugin resolves it (config.ts's convention). */
+export function dshHomeDefault(env = process.env) {
+    return env.DSH_HOME ?? join(homedir(), '.dsh');
+}
+/** `<DSH_HOME>/zen-remote-ingress` — Caddyfile, data dir and bin/ sit here. */
+export function ingressDir(dshHome) {
+    return join(dshHome, INGRESS_DIR_NAME);
+}
+/** `<DSH_HOME>/zen-remote-ingress/bin` — both binaries install here. */
+export function binDir(dshHome) {
+    return join(ingressDir(dshHome), 'bin');
+}
+/** `<DSH_HOME>/zen-remote-ingress/Caddyfile` — generated, validated, then
+ * handed to `caddy run --config`. */
+export function caddyfilePath(dshHome) {
+    return join(ingressDir(dshHome), 'Caddyfile');
+}
+/** `<DSH_HOME>/zen-remote-ingress/caddy-data` — certificates and the ACME
+ * account live here, kept out of the default Caddy home. */
+export function caddyDataDir(dshHome) {
+    return join(ingressDir(dshHome), 'caddy-data');
+}
+/** The installed file name. Windows cannot spawn an extension-less image,
+ * so the `.exe` suffix is part of the install name there. */
+export function binaryFileName(tool, platform = currentPlatform()) {
+    if (platform.os === 'windows')
+        return tool === 'caddy' ? 'caddy.exe' : 'cloudflared.exe';
+    return tool;
+}
+/** The absolute install path for one binary (where downloadBinary puts it). */
+export function binaryInstallPath(dshHome, tool, platform = currentPlatform()) {
+    return join(binDir(dshHome), binaryFileName(tool, platform));
+}
+/** Prebuilt Caddy + `github.com/caddy-dns/cloudflare` release assets hosted
+ * on this repository's `caddy-cloudflare` GitHub Release (built by
+ * `.github/workflows/caddy-assets.yml`). Unlike `caddyserver.com/api/download`
+ * — which compiles on the fly and throttles downloads to ~13 KB/s — these
+ * static GitHub Release assets download in seconds and work with mainland
+ * China GitHub acceleration mirrors (`gh-proxy.com` / `ghfast.top`). */
+export function caddyPrebuiltDownload(platform) {
+    const base = 'https://github.com/KyoMio/dsh-zen-remote/releases/download/caddy-cloudflare/';
+    if (platform.os === 'windows')
+        return { url: `${base}caddy-windows-amd64.exe`, archive: 'exe' };
+    return { url: `${base}caddy-${platform.os}-${platform.arch}.tgz`, archive: 'tgz' };
+}
+/** Mainland China GitHub release acceleration mirrors, tried first when the
+ * host environment is detected as mainland China (or tried as fallbacks if
+ * direct GitHub times out). */
+export const GITHUB_MIRROR_PREFIXES = [
+    'https://gh-proxy.com/',
+    'https://ghfast.top/',
+];
+/** Ordered candidate downloads for one binary and platform:
+ * - When `preferCnMirror` is true, GitHub Release URLs through mainland
+ *   mirrors come first, followed by direct GitHub Release URL, and finally
+ *   (for Caddy) the upstream `caddyserver.com/api/download` fallback.
+ * - When `preferCnMirror` is false, direct GitHub Release comes first, then
+ *   mainland mirrors, then the upstream build API fallback. */
+export function binaryDownloadCandidates(tool, platform = currentPlatform(), preferCnMirror = false) {
+    const primary = tool === 'caddy' ? caddyPrebuiltDownload(platform) : cloudflaredDownload(platform);
+    const mirrored = GITHUB_MIRROR_PREFIXES.map((prefix) => ({
+        url: `${prefix}${primary.url}`,
+        archive: primary.archive,
+    }));
+    const ordered = preferCnMirror ? [...mirrored, primary] : [primary, ...mirrored];
+    if (tool === 'caddy') {
+        ordered.push(caddyDownload(platform));
+    }
+    return ordered;
+}
+//# sourceMappingURL=binary.js.map

package/lib/wizard/binary.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"binary.js","sourceRoot":"","sources":["../../src/wizard/binary.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAChC,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAA;AAwBjC,wEAAwE;AACxE,MAAM,UAAU,eAAe;IAC7B,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO;QAAE,OAAO,EAAE,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,EAAE,CAAA;IACzE,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAA;IACzD,IAAI,OAAO,CAAC,QAAQ,KAAK,QAAQ;QAAE,OAAO,EAAE,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAA;IAChE,OAAO,EAAE,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAA;AAC9B,CAAC;AAED;uEACuE;AACvE,MAAM,UAAU,gBAAgB,CAAC,QAAwB;IACvD,OAAO,2CAA2C,QAAQ,CAAC,EAAE,SAAS,QAAQ,CAAC,IAAI,oCAAoC,CAAA;AACzH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,aAAa,CAAC,QAAwB;IACpD,OAAO,EAAE,GAAG,EAAE,gBAAgB,CAAC,QAAQ,CAAC,EAAE,OAAO,EAAE,QAAQ,CAAC,EAAE,KAAK,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAA;AACjG,CAAC;AAED;;0CAE0C;AAC1C,MAAM,UAAU,mBAAmB,CAAC,QAAwB;IAC1D,MAAM,IAAI,GAAG,qEAAqE,CAAA;IAClF,IAAI,QAAQ,CAAC,EAAE,KAAK,QAAQ;QAAE,OAAO,EAAE,GAAG,EAAE,GAAG,IAAI,sBAAsB,QAAQ,CAAC,IAAI,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,CAAA;IAC9G,IAAI,QAAQ,CAAC,EAAE,KAAK,SAAS;QAAE,OAAO,EAAE,GAAG,EAAE,GAAG,IAAI,+BAA+B,EAAE,OAAO,EAAE,KAAK,EAAE,CAAA;IACrG,OAAO,EAAE,GAAG,EAAE,GAAG,IAAI,qBAAqB,QAAQ,CAAC,IAAI,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,CAAA;AAC9E,CAAC;AAED;;4CAE4C;AAC5C,MAAM,UAAU,UAAU,CACxB,WAA2B,eAAe,EAAE;IAE5C,MAAM,KAAK,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAA;IACrC,MAAM,WAAW,GAAG,mBAAmB,CAAC,QAAQ,CAAC,CAAA;IACjD,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,GAAG,EAAE,YAAY,EAAE,KAAK,CAAC,OAAO,EAAE,WAAW,EAAE,WAAW,CAAC,GAAG,EAAE,kBAAkB,EAAE,WAAW,CAAC,OAAO,EAAE,CAAA;AACjI,CAAC;AAED,+EAA+E;AAC/E,MAAM,CAAC,MAAM,oBAAoB,GAA4C;IAC3E,KAAK,EAAE,kCAAkC;IACzC,WAAW,EAAE,0FAA0F;CACxG,CAAA;AAED,qEAAqE;AACrE,MAAM,CAAC,MAAM,gBAAgB,GAAG,oBAAoB,CAAA;AAEpD,mFAAmF;AACnF,MAAM,UAAU,cAAc,CAAC,MAAyB,OAAO,CAAC,GAAG;IACjE,OAAO,GAAG,CAAC,QAAQ,IAAI,IAAI,CAAC,OAAO,EAAE,EAAE,MAAM,CAAC,CAAA;AAChD,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,UAAU,CAAC,OAAe;IACxC,OAAO,IAAI,CAAC,OAAO,EAAE,gBAAgB,CAAC,CAAA;AACxC,CAAC;AAED,wEAAwE;AACxE,MAAM,UAAU,MAAM,CAAC,OAAe;IACpC,OAAO,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,KAAK,CAAC,CAAA;AACzC,CAAC;AAED;qCACqC;AACrC,MAAM,UAAU,aAAa,CAAC,OAAe;IAC3C,OAAO,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,WAAW,CAAC,CAAA;AAC/C,CAAC;AAED;4DAC4D;AAC5D,MAAM,UAAU,YAAY,CAAC,OAAe;IAC1C,OAAO,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,YAAY,CAAC,CAAA;AAChD,CAAC;AAED;6DAC6D;AAC7D,MAAM,UAAU,cAAc,CAAC,IAAmB,EAAE,WAA2B,eAAe,EAAE;IAC9F,IAAI,QAAQ,CAAC,EAAE,KAAK,SAAS;QAAE,OAAO,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,iBAAiB,CAAA;IACxF,OAAO,IAAI,CAAA;AACb,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,iBAAiB,CAAC,OAAe,EAAE,IAAmB,EAAE,WAA2B,eAAe,EAAE;IAClH,OAAO,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,cAAc,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAA;AAC9D,CAAC;AAED;;;;;wEAKwE;AACxE,MAAM,UAAU,qBAAqB,CAAC,QAAwB;IAC5D,MAAM,IAAI,GAAG,8EAA8E,CAAA;IAC3F,IAAI,QAAQ,CAAC,EAAE,KAAK,SAAS;QAAE,OAAO,EAAE,GAAG,EAAE,GAAG,IAAI,yBAAyB,EAAE,OAAO,EAAE,KAAK,EAAE,CAAA;IAC/F,OAAO,EAAE,GAAG,EAAE,GAAG,IAAI,SAAS,QAAQ,CAAC,EAAE,IAAI,QAAQ,CAAC,IAAI,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,CAAA;AACpF,CAAC;AAED;;+BAE+B;AAC/B,MAAM,CAAC,MAAM,sBAAsB,GAAG;IACpC,uBAAuB;IACvB,qBAAqB;CACb,CAAA;AAEV;;;;;+DAK+D;AAC/D,MAAM,UAAU,wBAAwB,CACtC,IAAmB,EACnB,WAA2B,eAAe,EAAE,EAC5C,cAAc,GAAG,KAAK;IAEtB,MAAM,OAAO,GAAG,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,qBAAqB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,mBAAmB,CAAC,QAAQ,CAAC,CAAA;IAClG,MAAM,QAAQ,GAAG,sBAAsB,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QACvD,GAAG,EAAE,GAAG,MAAM,GAAG,OAAO,CAAC,GAAG,EAAE;QAC9B,OAAO,EAAE,OAAO,CAAC,OAAO;KACzB,CAAC,CAAC,CAAA;IACH,MAAM,OAAO,GAAG,cAAc,CAAC,CAAC,CAAC,CAAC,GAAG,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,GAAG,QAAQ,CAAC,CAAA;IAChF,IAAI,IAAI,KAAK,OAAO,EAAE,CAAC;QACrB,OAAO,CAAC,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC,CAAA;IACvC,CAAC;IACD,OAAO,OAAO,CAAA;AAChB,CAAC"}

package/lib/wizard/caddy-process.js

@@ -0,0 +1,162 @@
+/**
+ * Managed-Caddy process lifecycle (GW-3). The Caddyfile's content is
+ * caddy.ts's job; this module owns everything with a heartbeat:
+ *
+ *   start: ensureBinary (GW-2, cached after the first download) →
+ *          generateCaddyfile (typed refusals) → write the Caddyfile as a
+ *          `.part` sibling → `caddy validate --config <part> --adapter
+ *          caddyfile` → only on a clean validate rename it to the real
+ *          path → `caddy run --config <Caddyfile>`. The ticket's "validate
+ *          before write" is honored as validate-before-PUBLISH: the final
+ *          Caddyfile on disk only ever holds bytes Caddy accepted, and a
+ *          failed validate leaves neither a start nor a published file.
+ *
+ *   The Cloudflare API token travels in the child's ENVIRONMENT
+ *   (`CF_API_TOKEN`, what the generated `{env.CF_API_TOKEN}` placeholder
+ *   reads) — never in argv, which other processes on the machine can see.
+ *
+ *   Idempotency: start with a live process refuses (`already-running`) —
+ *   switching configuration stops first (design: 切换路时先停旧进程再启新的).
+ *   stop is idempotent; an exited child clears its own slot so a later
+ *   start works. The host wiring hands stop to ctx.effect, so the row's
+ *   disposal kills Caddy too.
+ *
+ * The subprocess service is structural (the tests feed a recorder), and
+ * `fetch` is injectable for the ensureBinary step.
+ */
+import { mkdirSync, renameSync, rmSync, writeFileSync } from 'node:fs';
+import { ensureBinary, BinaryDownloadError } from './binary-io.js';
+import { caddyDataDir, caddyfilePath, ingressDir } from './binary.js';
+import { generateCaddyfile } from './caddy.js';
+export function createCaddyManager(options) {
+    const { subprocess, dshHome } = options;
+    const maxLogBytes = options.maxLogBytes ?? 64 * 1024;
+    let handle = null;
+    let caddyfileArg;
+    let startedOnce = false;
+    // GW-fix-2/L3: a WHITELIST, not the host's full environment — the host
+    // process carries the relay secret and DSH's own credentials in env, and
+    // a child that only needs to reach the internet and the local disk has
+    // no business inheriting them. Include Windows system/profile variables so
+    // Go's TLS root-cert store and winsock initialize cleanly on Windows.
+    const childEnv = (cfToken) => {
+        const env = {};
+        for (const key of [
+            'PATH', 'HOME', 'TMPDIR', 'LANG', 'TZ',
+            'SystemRoot', 'SYSTEMROOT', 'windir', 'WINDIR',
+            'USERPROFILE', 'APPDATA', 'LOCALAPPDATA', 'PROGRAMDATA', 'TEMP', 'TMP',
+        ]) {
+            if (process.env[key] !== undefined)
+                env[key] = process.env[key];
+        }
+        // The one secret this child needs, by env only (the Caddyfile reads
+        // {env.CF_API_TOKEN}) — never argv.
+        env.CF_API_TOKEN = cfToken;
+        return env;
+    };
+    const spawnChild = (argv, env) => subprocess.spawn({
+        argv,
+        cwd: dshHome,
+        env,
+        stdio: {
+            stdin: 'ignore',
+            stdout: { maxBytes: maxLogBytes },
+            stderr: { maxBytes: maxLogBytes },
+        },
+        graceMs: 3000,
+    });
+    return {
+        async start(input) {
+            if (handle !== null)
+                return { ok: false, error: 'already-running' };
+            const cfToken = typeof input.cfToken === 'string' && input.cfToken.trim() !== '' ? input.cfToken : undefined;
+            if (cfToken === undefined)
+                return { ok: false, error: 'missing-token' };
+            const generated = generateCaddyfile({ ...input, storageDir: caddyDataDir(dshHome) });
+            if (!generated.ok)
+                return { ok: false, error: 'bad-config', detail: generated.error };
+            let binaryPath;
+            try {
+                binaryPath = (await ensureBinary(dshHome, 'caddy', {
+                    fetchImpl: options.fetchImpl,
+                    platform: options.platform,
+                    onProgress: options.onProgress,
+                })).path;
+            }
+            catch (error) {
+                if (error instanceof BinaryDownloadError) {
+                    return { ok: false, error: 'download-failed', detail: error.message, installUrl: error.installUrl };
+                }
+                return { ok: false, error: 'download-failed', detail: String(error?.message ?? error) };
+            }
+            // Write → validate → publish: the `.part` file carries the exact
+            // bytes under validation, so what lands at the real path is exactly
+            // what Caddy accepted.
+            const finalPath = caddyfilePath(dshHome);
+            const partPath = `${finalPath}.part`;
+            try {
+                mkdirSync(ingressDir(dshHome), { recursive: true });
+                writeFileSync(partPath, generated.caddyfile, { mode: 0o600 });
+                const validate = spawnChild([binaryPath, 'validate', '--config', partPath, '--adapter', 'caddyfile'], childEnv(cfToken));
+                const outcome = await validate.done;
+                if ((outcome.exitCode ?? 1) !== 0) {
+                    rmSync(partPath, { force: true });
+                    return { ok: false, error: 'validate-failed' };
+                }
+                renameSync(partPath, finalPath);
+            }
+            catch (error) {
+                rmSync(partPath, { force: true });
+                return { ok: false, error: 'spawn-failed', detail: String(error?.message ?? error) };
+            }
+            const env = childEnv(cfToken);
+            try {
+                const child = spawnChild([binaryPath, 'run', '--config', finalPath], env);
+                handle = child;
+                caddyfileArg = finalPath;
+                startedOnce = true;
+                // An exited child clears its own slot: isRunning() goes honest and
+                // a later start() works without a manual stop.
+                void child.done.then(() => {
+                    if (handle === child) {
+                        handle = null;
+                        caddyfileArg = undefined;
+                    }
+                }).catch(() => {
+                    if (handle === child) {
+                        handle = null;
+                        caddyfileArg = undefined;
+                    }
+                });
+                return { ok: true, binaryPath, caddyfile: finalPath, alreadyRunning: false };
+            }
+            catch (error) {
+                handle = null;
+                caddyfileArg = undefined;
+                return { ok: false, error: 'spawn-failed', detail: String(error?.message ?? error) };
+            }
+        },
+        stop() {
+            if (handle === null)
+                return;
+            const child = handle;
+            handle = null;
+            caddyfileArg = undefined;
+            try {
+                void child.terminate();
+            }
+            catch {
+                // A dead child's terminate is a no-op or a throw — either way done.
+            }
+        },
+        isRunning: () => handle !== null,
+        runningCaddyfile: () => caddyfileArg,
+        /** Whether a start has EVER succeeded in this row's lifetime — the
+         * three-state status needs it to tell 已退出 (degraded) from 未启动. */
+        hasStarted: () => startedOnce,
+    };
+}
+/** Re-exported so the wiring (and later the routes) need one import for
+ * the whole ingress-directory layout. */
+export { caddyDataDir, caddyfilePath, ingressDir };
+//# sourceMappingURL=caddy-process.js.map

package/lib/wizard/caddy-process.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"caddy-process.js","sourceRoot":"","sources":["../../src/wizard/caddy-process.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,SAAS,CAAA;AACtE,OAAO,EAAE,YAAY,EAAE,mBAAmB,EAAyB,MAAM,gBAAgB,CAAA;AACzF,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,UAAU,EAAuB,MAAM,aAAa,CAAA;AAC1F,OAAO,EAAE,iBAAiB,EAAuB,MAAM,YAAY,CAAA;AAkEnE,MAAM,UAAU,kBAAkB,CAAC,OAA4B;IAC7D,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,GAAG,OAAO,CAAA;IACvC,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,EAAE,GAAG,IAAI,CAAA;IACpD,IAAI,MAAM,GAAgC,IAAI,CAAA;IAC9C,IAAI,YAAgC,CAAA;IACpC,IAAI,WAAW,GAAG,KAAK,CAAA;IAEvB,uEAAuE;IACvE,yEAAyE;IACzE,uEAAuE;IACvE,2EAA2E;IAC3E,sEAAsE;IACtE,MAAM,QAAQ,GAAG,CAAC,OAAe,EAAqB,EAAE;QACtD,MAAM,GAAG,GAAsB,EAAE,CAAA;QACjC,KAAK,MAAM,GAAG,IAAI;YAChB,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI;YACtC,YAAY,EAAE,YAAY,EAAE,QAAQ,EAAE,QAAQ;YAC9C,aAAa,EAAE,SAAS,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,EAAE,KAAK;SACvE,EAAE,CAAC;YACF,IAAI,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,SAAS;gBAAE,GAAG,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;QACjE,CAAC;QACD,oEAAoE;QACpE,oCAAoC;QACpC,GAAG,CAAC,YAAY,GAAG,OAAO,CAAA;QAC1B,OAAO,GAAG,CAAA;IACZ,CAAC,CAAA;IAED,MAAM,UAAU,GAAG,CAAC,IAAc,EAAE,GAAsB,EAAwB,EAAE,CAClF,UAAU,CAAC,KAAK,CAAC;QACf,IAAI;QACJ,GAAG,EAAE,OAAO;QACZ,GAAG;QACH,KAAK,EAAE;YACL,KAAK,EAAE,QAAQ;YACf,MAAM,EAAE,EAAE,QAAQ,EAAE,WAAW,EAAE;YACjC,MAAM,EAAE,EAAE,QAAQ,EAAE,WAAW,EAAE;SAClC;QACD,OAAO,EAAE,IAAI;KACd,CAAC,CAAA;IAEJ,OAAO;QACL,KAAK,CAAC,KAAK,CAAC,KAAK;YACf,IAAI,MAAM,KAAK,IAAI;gBAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAAA;YACnE,MAAM,OAAO,GAAG,OAAO,KAAK,CAAC,OAAO,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAA;YAC5G,IAAI,OAAO,KAAK,SAAS;gBAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,eAAe,EAAE,CAAA;YACvE,MAAM,SAAS,GAAG,iBAAiB,CAAC,EAAE,GAAG,KAAK,EAAE,UAAU,EAAE,YAAY,CAAC,OAAO,CAAC,EAAE,CAAC,CAAA;YACpF,IAAI,CAAC,SAAS,CAAC,EAAE;gBAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,YAAY,EAAE,MAAM,EAAE,SAAS,CAAC,KAAK,EAAE,CAAA;YAErF,IAAI,UAAkB,CAAA;YACtB,IAAI,CAAC;gBACH,UAAU,GAAG,CAAC,MAAM,YAAY,CAAC,OAAO,EAAE,OAAO,EAAE;oBACjD,SAAS,EAAE,OAAO,CAAC,SAAS;oBAC5B,QAAQ,EAAE,OAAO,CAAC,QAAQ;oBAC1B,UAAU,EAAE,OAAO,CAAC,UAAU;iBAC/B,CAAC,CAAC,CAAC,IAAI,CAAA;YACV,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,KAAK,YAAY,mBAAmB,EAAE,CAAC;oBACzC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,iBAAiB,EAAE,MAAM,EAAE,KAAK,CAAC,OAAO,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,CAAA;gBACrG,CAAC;gBACD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,iBAAiB,EAAE,MAAM,EAAE,MAAM,CAAE,KAAe,EAAE,OAAO,IAAI,KAAK,CAAC,EAAE,CAAA;YACpG,CAAC;YAED,iEAAiE;YACjE,oEAAoE;YACpE,uBAAuB;YACvB,MAAM,SAAS,GAAG,aAAa,CAAC,OAAO,CAAC,CAAA;YACxC,MAAM,QAAQ,GAAG,GAAG,SAAS,OAAO,CAAA;YACpC,IAAI,CAAC;gBACH,SAAS,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;gBACnD,aAAa,CAAC,QAAQ,EAAE,SAAS,CAAC,SAAS,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;gBAC7D,MAAM,QAAQ,GAAG,UAAU,CAAC,CAAC,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,QAAQ,EAAE,WAAW,EAAE,WAAW,CAAC,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAA;gBACxH,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAA;gBACnC,IAAI,CAAC,OAAO,CAAC,QAAQ,IAAI,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;oBAClC,MAAM,CAAC,QAAQ,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;oBACjC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAAA;gBAChD,CAAC;gBACD,UAAU,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAA;YACjC,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,CAAC,QAAQ,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;gBACjC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,cAAc,EAAE,MAAM,EAAE,MAAM,CAAE,KAAe,EAAE,OAAO,IAAI,KAAK,CAAC,EAAE,CAAA;YACjG,CAAC;YAED,MAAM,GAAG,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAA;YAC7B,IAAI,CAAC;gBACH,MAAM,KAAK,GAAG,UAAU,CAAC,CAAC,UAAU,EAAE,KAAK,EAAE,UAAU,EAAE,SAAS,CAAC,EAAE,GAAG,CAAC,CAAA;gBACzE,MAAM,GAAG,KAAK,CAAA;gBACd,YAAY,GAAG,SAAS,CAAA;gBACxB,WAAW,GAAG,IAAI,CAAA;gBAClB,mEAAmE;gBACnE,+CAA+C;gBAC/C,KAAK,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE;oBACxB,IAAI,MAAM,KAAK,KAAK,EAAE,CAAC;wBACrB,MAAM,GAAG,IAAI,CAAA;wBACb,YAAY,GAAG,SAAS,CAAA;oBAC1B,CAAC;gBACH,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE;oBACZ,IAAI,MAAM,KAAK,KAAK,EAAE,CAAC;wBACrB,MAAM,GAAG,IAAI,CAAA;wBACb,YAAY,GAAG,SAAS,CAAA;oBAC1B,CAAC;gBACH,CAAC,CAAC,CAAA;gBACF,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,SAAS,EAAE,SAAS,EAAE,cAAc,EAAE,KAAK,EAAE,CAAA;YAC9E,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,GAAG,IAAI,CAAA;gBACb,YAAY,GAAG,SAAS,CAAA;gBACxB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,cAAc,EAAE,MAAM,EAAE,MAAM,CAAE,KAAe,EAAE,OAAO,IAAI,KAAK,CAAC,EAAE,CAAA;YACjG,CAAC;QACH,CAAC;QAED,IAAI;YACF,IAAI,MAAM,KAAK,IAAI;gBAAE,OAAM;YAC3B,MAAM,KAAK,GAAG,MAAM,CAAA;YACpB,MAAM,GAAG,IAAI,CAAA;YACb,YAAY,GAAG,SAAS,CAAA;YACxB,IAAI,CAAC;gBACH,KAAK,KAAK,CAAC,SAAS,EAAE,CAAA;YACxB,CAAC;YAAC,MAAM,CAAC;gBACP,oEAAoE;YACtE,CAAC;QACH,CAAC;QAED,SAAS,EAAE,GAAG,EAAE,CAAC,MAAM,KAAK,IAAI;QAChC,gBAAgB,EAAE,GAAG,EAAE,CAAC,YAAY;QACpC;0EACkE;QAClE,UAAU,EAAE,GAAG,EAAE,CAAC,WAAW;KAC9B,CAAA;AACH,CAAC;AAED;yCACyC;AACzC,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,UAAU,EAAE,CAAA"}

package/lib/wizard/caddy.js

@@ -0,0 +1,80 @@
+/**
+ * Caddyfile generation (GW-3), pure logic — every byte the managed Caddy
+ * will run comes out of {@link generateCaddyfile}, so the validation and
+ * the injection guards live HERE and the process half (caddy-process.ts)
+ * only writes, validates and spawns what this answered.
+ *
+ * Shape (design.md 路 A), with one deliberate correction to the design
+ * sketch: the global DNS-01 option in a real Caddyfile is `acme_dns
+ * <provider> <token-placeholder>` — the sketch's bare `dns cloudflare`
+ * line is site-block `tls` syntax and is not valid as a global option.
+ * The DNS-01 challenge itself is the point: the certificate is ordered
+ * through Cloudflare's API (the token rides the `CF_API_TOKEN`
+ * environment variable, never the file), so neither 80 nor 443 needs to
+ * be reachable from outside for issuance; only the HTTPS service port
+ * must be.
+ *
+ * Injection posture: every interpolated value passes a charset gate —
+ * the domain through config.ts's `hostOf` (the exact validator the row
+ * layer applies), the storage path free of control characters, quotes and
+ * braces (Caddyfile's block delimiters), the env-var name as a legal
+ * POSIX name. Nothing else from the outside world reaches the output.
+ */
+import { hostOf } from '../config.js';
+/** The default environment variable the Cloudflare token rides in on. */
+export const CF_TOKEN_ENV_DEFAULT = 'CF_API_TOKEN';
+/** Integers in [1, 65535] only. */
+function portOf(value) {
+    return typeof value === 'number' && Number.isInteger(value) && value >= 1 && value <= 65535 ? value : undefined;
+}
+/** Storage paths go into the Caddyfile quoted; anything that could break
+ * out of the quoting or forge a block delimiter is refused — control
+ * characters (newlines foremost), quotes, braces. */
+function storageDirOf(value) {
+    if (typeof value !== 'string' || value === '')
+        return undefined;
+    // eslint-disable-next-line no-control-regex
+    if (/[\u0000-\u001f\u007f"{}]/.test(value))
+        return undefined;
+    return value;
+}
+/** Env names: POSIX uppercase convention, strictly. */
+const ENV_NAME_PATTERN = /^[A-Z_][A-Z0-9_]*$/;
+/**
+ * Build the complete Caddyfile for the managed Caddy. Refuses (typed)
+ * instead of throwing so the caller can map each refusal to a form error.
+ */
+export function generateCaddyfile(input) {
+    const domain = hostOf(input.domain);
+    if (domain === undefined)
+        return { ok: false, error: 'bad-domain' };
+    const httpsPort = portOf(input.httpsPort);
+    if (httpsPort === undefined)
+        return { ok: false, error: 'bad-https-port' };
+    const gatewayPort = portOf(input.gatewayPort);
+    if (gatewayPort === undefined)
+        return { ok: false, error: 'bad-gateway-port' };
+    const storageDir = storageDirOf(input.storageDir);
+    if (storageDir === undefined)
+        return { ok: false, error: 'bad-storage' };
+    const tokenEnv = typeof input.cfTokenEnvName === 'string' && ENV_NAME_PATTERN.test(input.cfTokenEnvName)
+        ? input.cfTokenEnvName
+        : CF_TOKEN_ENV_DEFAULT;
+    if (input.cfTokenEnvName !== undefined && input.cfTokenEnvName !== '' && tokenEnv !== input.cfTokenEnvName) {
+        return { ok: false, error: 'bad-token-env' };
+    }
+    const caddyfile = [
+        '{',
+        `\tacme_dns cloudflare {env.${tokenEnv}}`,
+        `\tstorage file_system "${storageDir}"`,
+        '\tadmin off',
+        '}',
+        '',
+        `https://${domain}:${httpsPort} {`,
+        `\treverse_proxy 127.0.0.1:${gatewayPort}`,
+        '}',
+        '',
+    ].join('\n');
+    return { ok: true, caddyfile, domain, httpsPort, gatewayPort };
+}
+//# sourceMappingURL=caddy.js.map

package/lib/wizard/caddy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"caddy.js","sourceRoot":"","sources":["../../src/wizard/caddy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,EAAE,MAAM,EAAE,MAAM,cAAc,CAAA;AAErC,yEAAyE;AACzE,MAAM,CAAC,MAAM,oBAAoB,GAAG,cAAc,CAAA;AAoBlD,mCAAmC;AACnC,SAAS,MAAM,CAAC,KAAc;IAC5B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI,KAAK,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAA;AACjH,CAAC;AAED;;qDAEqD;AACrD,SAAS,YAAY,CAAC,KAAc;IAClC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,EAAE;QAAE,OAAO,SAAS,CAAA;IAC/D,4CAA4C;IAC5C,IAAI,0BAA0B,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,SAAS,CAAA;IAC5D,OAAO,KAAK,CAAA;AACd,CAAC;AAED,uDAAuD;AACvD,MAAM,gBAAgB,GAAG,oBAAoB,CAAA;AAE7C;;;GAGG;AACH,MAAM,UAAU,iBAAiB,CAAC,KAAqB;IACrD,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;IACnC,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,YAAY,EAAE,CAAA;IACnE,MAAM,SAAS,GAAG,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,CAAA;IACzC,IAAI,SAAS,KAAK,SAAS;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAA;IAC1E,MAAM,WAAW,GAAG,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC,CAAA;IAC7C,IAAI,WAAW,KAAK,SAAS;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAA;IAC9E,MAAM,UAAU,GAAG,YAAY,CAAC,KAAK,CAAC,UAAU,CAAC,CAAA;IACjD,IAAI,UAAU,KAAK,SAAS;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,aAAa,EAAE,CAAA;IACxE,MAAM,QAAQ,GAAG,OAAO,KAAK,CAAC,cAAc,KAAK,QAAQ,IAAI,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC;QACtG,CAAC,CAAC,KAAK,CAAC,cAAc;QACtB,CAAC,CAAC,oBAAoB,CAAA;IACxB,IAAI,KAAK,CAAC,cAAc,KAAK,SAAS,IAAI,KAAK,CAAC,cAAc,KAAK,EAAE,IAAI,QAAQ,KAAK,KAAK,CAAC,cAAc,EAAE,CAAC;QAC3G,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,eAAe,EAAE,CAAA;IAC9C,CAAC;IACD,MAAM,SAAS,GAAG;QAChB,GAAG;QACH,8BAA8B,QAAQ,GAAG;QACzC,0BAA0B,UAAU,GAAG;QACvC,aAAa;QACb,GAAG;QACH,EAAE;QACF,WAAW,MAAM,IAAI,SAAS,IAAI;QAClC,6BAA6B,WAAW,EAAE;QAC1C,GAAG;QACH,EAAE;KACH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IACZ,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,WAAW,EAAE,CAAA;AAChE,CAAC"}