factory-factory 0.3.5 → 0.3.7

package/dist/src/cli/proxy.js

@@ -0,0 +1,825 @@
+import { execFile, spawn } from 'node:child_process';
+import { randomBytes, randomInt } from 'node:crypto';
+import { existsSync } from 'node:fs';
+import { createServer as createHttpServer } from 'node:http';
+import { homedir } from 'node:os';
+import { join } from 'node:path';
+import { promisify } from 'node:util';
+import chalk from 'chalk';
+import * as QRCode from 'qrcode';
+import { runMigrations as runDbMigrations } from '../backend/migrate.js';
+import { appendBoundedOutputBuffer, authenticateRequest as authenticateProxyRequest, createSessionValue, createAuthCookie as createSharedAuthCookie, extractTryCloudflareUrl, matchesToken, mergeSetCookieValues, parseCookieHeader, proxyAuthenticatedHttpRequest, proxyAuthenticatedWebSocketUpgrade, signValue, startCloudflaredTunnel, toSafeRedirectPath, verifySessionValue, } from '../shared/proxy-utils.js';
+import { ensureDataDir, findAvailablePort, treeKillAsync, waitForPort } from './runtime-utils.js';
+const execFileAsync = promisify(execFile);
+const PASSWORD_CHARS = 'ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789';
+const PASSWORD_LENGTH = 6;
+const SESSION_COOKIE_NAME = 'ff_proxy_session';
+const LOGIN_PATH = '/__proxy_auth/login';
+const LOCAL_HOST = '127.0.0.1';
+const LOCKOUT_THRESHOLD_PER_IP = 5;
+const LOCKOUT_WINDOW_MS = 5 * 60 * 1000;
+const MAX_BRUTE_FORCE_TRACKED_IPS = 5000;
+function supportsTerminalQrRendering(stream = process.stdout, env = process.env) {
+    if (!stream.isTTY) {
+        return false;
+    }
+    const term = (env.TERM || '').toLowerCase();
+    return term !== '' && term !== 'dumb';
+}
+async function tryRenderTerminalQrCode(url, renderQrCode = (text, options) => QRCode.toString(text, options)) {
+    try {
+        const output = await renderQrCode(url, {
+            type: 'terminal',
+            margin: 1,
+            small: true,
+        });
+        return output.trim() ? output : null;
+    }
+    catch {
+        return null;
+    }
+}
+async function printDirectLinkQrCode(url) {
+    if (!supportsTerminalQrRendering()) {
+        return;
+    }
+    const qr = await tryRenderTerminalQrCode(url);
+    if (!qr) {
+        return;
+    }
+    console.log(chalk.green('📱 Scan direct link:'));
+    process.stdout.write(`${qr}\n`);
+}
+function generatePassword(length = PASSWORD_LENGTH) {
+    let output = '';
+    for (let i = 0; i < length; i += 1) {
+        const index = randomInt(PASSWORD_CHARS.length);
+        output += PASSWORD_CHARS[index] ?? PASSWORD_CHARS[0] ?? 'A';
+    }
+    return output;
+}
+function generateMagicToken() {
+    return randomBytes(16).toString('hex');
+}
+function escapeHtml(value) {
+    return value
+        .replaceAll('&', '&amp;')
+        .replaceAll('<', '&lt;')
+        .replaceAll('>', '&gt;')
+        .replaceAll('"', '&quot;')
+        .replaceAll("'", '&#39;');
+}
+function matchesMagicToken(candidate, expected) {
+    return matchesToken(candidate, expected);
+}
+function matchesPassword(candidate, expected) {
+    return matchesMagicToken(candidate, expected);
+}
+function getClientIp(req) {
+    const cfConnectingIp = req.headers['cf-connecting-ip'];
+    if (typeof cfConnectingIp === 'string' && cfConnectingIp.trim()) {
+        return cfConnectingIp.trim();
+    }
+    const xForwardedFor = req.headers['x-forwarded-for'];
+    if (typeof xForwardedFor === 'string' && xForwardedFor.trim()) {
+        return xForwardedFor.split(',')[0]?.trim() || 'unknown';
+    }
+    return req.socket.remoteAddress || 'unknown';
+}
+class BruteForceGuard {
+    attemptsByIp = new Map();
+    evictStaleEntries(nowMs) {
+        for (const [ip, state] of this.attemptsByIp.entries()) {
+            const lockExpired = state.lockedUntilMs <= nowMs;
+            const stale = nowMs - state.lastSeenMs > LOCKOUT_WINDOW_MS;
+            if (lockExpired && stale) {
+                this.attemptsByIp.delete(ip);
+            }
+        }
+        while (this.attemptsByIp.size > MAX_BRUTE_FORCE_TRACKED_IPS) {
+            const oldest = this.attemptsByIp.keys().next().value;
+            if (!oldest) {
+                break;
+            }
+            this.attemptsByIp.delete(oldest);
+        }
+    }
+    isLocked(ip, nowMs = Date.now()) {
+        this.evictStaleEntries(nowMs);
+        const state = this.attemptsByIp.get(ip);
+        if (!state || state.lockedUntilMs <= 0) {
+            return { locked: false, retryAfterSeconds: 0 };
+        }
+        if (state.lockedUntilMs <= nowMs) {
+            this.attemptsByIp.delete(ip);
+            return { locked: false, retryAfterSeconds: 0 };
+        }
+        return {
+            locked: true,
+            retryAfterSeconds: Math.max(1, Math.ceil((state.lockedUntilMs - nowMs) / 1000)),
+        };
+    }
+    registerFailure(ip, nowMs = Date.now()) {
+        this.evictStaleEntries(nowMs);
+        const current = this.attemptsByIp.get(ip) ?? { failures: 0, lockedUntilMs: 0, lastSeenMs: 0 };
+        const normalized = current.lockedUntilMs > 0 && current.lockedUntilMs <= nowMs
+            ? { failures: 0, lockedUntilMs: 0, lastSeenMs: nowMs }
+            : current;
+        const nextFailures = normalized.failures + 1;
+        const ipLocked = nextFailures >= LOCKOUT_THRESHOLD_PER_IP;
+        this.attemptsByIp.delete(ip);
+        this.attemptsByIp.set(ip, {
+            failures: ipLocked ? 0 : nextFailures,
+            lockedUntilMs: ipLocked ? nowMs + LOCKOUT_WINDOW_MS : 0,
+            lastSeenMs: nowMs,
+        });
+        return { ipLocked };
+    }
+}
+function getDefaultDatabasePath() {
+    return process.env.DATABASE_PATH || join(homedir(), 'factory-factory', 'data.db');
+}
+function runMigrations(projectRoot, databasePath) {
+    const migrationsPath = join(projectRoot, 'prisma', 'migrations');
+    runDbMigrations({
+        databasePath,
+        migrationsPath,
+        log: () => {
+        },
+    });
+}
+async function killProcessTree(proc) {
+    if (!proc.pid) {
+        return;
+    }
+    try {
+        await treeKillAsync(proc.pid, 'SIGTERM');
+    }
+    catch {
+    }
+}
+async function ensureCloudflaredInstalled() {
+    try {
+        await execFileAsync('cloudflared', ['--version'], { timeout: 5000 });
+    }
+    catch {
+        console.error(chalk.red('\n❌ cloudflared is not installed.\n'));
+        console.error('Install it:');
+        console.error('  macOS:    brew install cloudflared');
+        console.error('  Linux:    curl -L https://github.com/cloudflare/cloudflared/releases/latest/download/cloudflared-linux-amd64 -o /usr/local/bin/cloudflared && chmod +x /usr/local/bin/cloudflared');
+        console.error('  Windows:  winget install Cloudflare.cloudflared');
+        console.error('\nThen re-run this command.');
+        process.exit(1);
+    }
+}
+async function startFactoryFactoryServer(params) {
+    const frontendDist = join(params.projectRoot, 'dist', 'client');
+    const backendDist = join(params.projectRoot, 'dist', 'src', 'backend', 'index.js');
+    if (!existsSync(frontendDist)) {
+        throw new Error('Frontend not built. Run `ff build` or `pnpm build` first.');
+    }
+    if (!existsSync(backendDist)) {
+        throw new Error('Backend not built. Run `ff build` or `pnpm build` first.');
+    }
+    const backend = spawn('node', [backendDist], {
+        cwd: params.projectRoot,
+        env: {
+            ...process.env,
+            NODE_ENV: 'production',
+            DATABASE_PATH: params.databasePath,
+            BACKEND_PORT: params.requestedPort.toString(),
+            BACKEND_HOST: LOCAL_HOST,
+            FF_RUN_SCRIPT_PROXY_ENABLED: '1',
+            FRONTEND_STATIC_PATH: frontendDist,
+        },
+        stdio: ['ignore', 'pipe', 'pipe'],
+    });
+    backend.stderr?.on('data', (chunk) => {
+        const message = chunk.toString().trim();
+        if (!message) {
+            return;
+        }
+        process.stderr.write(chalk.red(`  [server] ${message}\n`));
+    });
+    let startupBuffer = '';
+    let actualPort;
+    try {
+        actualPort = await new Promise((resolve, reject) => {
+            const timeout = setTimeout(() => {
+                reject(new Error('Timed out waiting for server startup signal'));
+            }, 30_000);
+            timeout.unref?.();
+            const cleanup = () => {
+                clearTimeout(timeout);
+                backend.stdout?.off('data', onStdoutData);
+                backend.off('exit', onExit);
+                backend.off('error', onError);
+            };
+            const onStdoutData = (chunk) => {
+                startupBuffer += chunk.toString();
+                const match = startupBuffer.match(/BACKEND_PORT:(\d+)/);
+                if (match?.[1]) {
+                    const parsed = Number.parseInt(match[1], 10);
+                    if (Number.isNaN(parsed)) {
+                        cleanup();
+                        reject(new Error('Received invalid backend port from server startup'));
+                        return;
+                    }
+                    cleanup();
+                    resolve(parsed);
+                    return;
+                }
+                if (startupBuffer.length > 4096) {
+                    startupBuffer = startupBuffer.slice(-2048);
+                }
+            };
+            const onExit = (code, signal) => {
+                cleanup();
+                reject(new Error(`Server exited before startup completed (code: ${code ?? 'null'}, signal: ${signal ?? 'null'})`));
+            };
+            const onError = (error) => {
+                cleanup();
+                reject(new Error(`Failed to start backend server: ${error.message}`));
+            };
+            backend.stdout?.on('data', onStdoutData);
+            backend.once('exit', onExit);
+            backend.once('error', onError);
+        });
+        await waitForPort(actualPort, LOCAL_HOST);
+    }
+    catch (error) {
+        await killProcessTree(backend);
+        throw error;
+    }
+    return { process: backend, port: actualPort };
+}
+function createLoginPage(errorMessage) {
+    const escapedErrorMessage = errorMessage ? escapeHtml(errorMessage) : '';
+    const errorHtml = escapedErrorMessage
+        ? `<p style="color:#dc2626;font-family:system-ui, sans-serif;margin:0 0 16px 0;">${escapedErrorMessage}</p>`
+        : '';
+    return `<!doctype html>
+<html lang="en">
+<head>
+  <meta charset="utf-8" />
+  <meta name="viewport" content="width=device-width, initial-scale=1" />
+  <title>Factory Factory Proxy</title>
+  <style>
+    :root { color-scheme: light; }
+    body {
+      margin: 0;
+      min-height: 100vh;
+      display: grid;
+      place-items: center;
+      background: radial-gradient(circle at top, #f5f7ff, #eef2ff 45%, #e2e8f0 100%);
+      font-family: system-ui, sans-serif;
+      color: #0f172a;
+    }
+    .card {
+      width: min(420px, calc(100vw - 24px));
+      background: rgba(255, 255, 255, 0.95);
+      border: 1px solid rgba(15, 23, 42, 0.08);
+      border-radius: 18px;
+      padding: 24px;
+      box-shadow: 0 20px 45px rgba(15, 23, 42, 0.15);
+      box-sizing: border-box;
+    }
+    h1 {
+      margin: 0 0 8px 0;
+      font-size: 22px;
+      font-weight: 650;
+      letter-spacing: -0.02em;
+    }
+    p {
+      margin: 0 0 20px 0;
+      color: #334155;
+      line-height: 1.5;
+      font-size: 14px;
+    }
+    form {
+      display: grid;
+      gap: 18px;
+    }
+    .otp {
+      display: grid;
+      grid-template-columns: repeat(6, minmax(0, 1fr));
+      gap: 10px;
+    }
+    .otp input {
+      width: 100%;
+      min-width: 0;
+      aspect-ratio: 1 / 1;
+      border: 1px solid #cbd5e1;
+      border-radius: 10px;
+      text-align: center;
+      font-size: 24px;
+      font-weight: 700;
+      text-transform: uppercase;
+      background: #fff;
+      box-sizing: border-box;
+    }
+    .otp input:focus {
+      outline: 2px solid #3b82f6;
+      outline-offset: 1px;
+      border-color: #3b82f6;
+    }
+    button {
+      border: 0;
+      border-radius: 10px;
+      padding: 12px 14px;
+      font-size: 14px;
+      font-weight: 600;
+      background: #0f172a;
+      color: #fff;
+      cursor: pointer;
+    }
+    button:hover { background: #1e293b; }
+    @media (max-width: 420px) {
+      .card {
+        border-radius: 14px;
+        padding: 16px;
+      }
+      .otp {
+        gap: 6px;
+      }
+      .otp input {
+        font-size: 20px;
+      }
+    }
+  </style>
+</head>
+<body>
+  <main class="card">
+    <h1>Enter Access Code</h1>
+    <p>This Factory Factory demo is password-protected.</p>
+    ${errorHtml}
+    <form method="post" action="${LOGIN_PATH}" id="login-form">
+      <input type="hidden" name="password" id="password" />
+      <div class="otp" aria-label="Password fields">
+        <input inputmode="text" maxlength="1" autocomplete="one-time-code" />
+        <input inputmode="text" maxlength="1" autocomplete="one-time-code" />
+        <input inputmode="text" maxlength="1" autocomplete="one-time-code" />
+        <input inputmode="text" maxlength="1" autocomplete="one-time-code" />
+        <input inputmode="text" maxlength="1" autocomplete="one-time-code" />
+        <input inputmode="text" maxlength="1" autocomplete="one-time-code" />
+      </div>
+      <button type="submit">Continue</button>
+    </form>
+  </main>
+  <script>
+    const form = document.getElementById('login-form');
+    const hidden = document.getElementById('password');
+    const inputs = Array.from(form.querySelectorAll('.otp input'));
+
+    const normalize = (value) => value.replace(/[^a-z0-9]/gi, '').toUpperCase().slice(-1);
+
+    inputs.forEach((input, index) => {
+      input.addEventListener('input', () => {
+        input.value = normalize(input.value);
+        if (input.value && index < inputs.length - 1) {
+          inputs[index + 1].focus();
+        }
+      });
+
+      input.addEventListener('keydown', (event) => {
+        if (event.key === 'Backspace' && !input.value && index > 0) {
+          inputs[index - 1].focus();
+        }
+      });
+
+      input.addEventListener('paste', (event) => {
+        const pasted = (event.clipboardData || window.clipboardData).getData('text') || '';
+        const chars = pasted.replace(/[^a-z0-9]/gi, '').toUpperCase().slice(0, inputs.length).split('');
+        if (chars.length === 0) {
+          return;
+        }
+        event.preventDefault();
+        inputs.forEach((otpInput, otpIndex) => {
+          otpInput.value = chars[otpIndex] || '';
+        });
+        const nextIndex = Math.min(chars.length, inputs.length - 1);
+        inputs[nextIndex].focus();
+      });
+    });
+
+    form.addEventListener('submit', (event) => {
+      const value = inputs.map((input) => normalize(input.value)).join('');
+      hidden.value = value;
+      if (value.length !== inputs.length) {
+        event.preventDefault();
+        inputs.find((input) => !input.value)?.focus();
+      }
+    });
+
+    inputs[0].focus();
+  </script>
+</body>
+</html>`;
+}
+function parseFormBody(rawBody) {
+    const params = new URLSearchParams(rawBody);
+    const output = {};
+    for (const [key, value] of params.entries()) {
+        output[key] = value;
+    }
+    return output;
+}
+function writeRateLimitResponse(res, retryAfterSeconds) {
+    res.statusCode = 429;
+    res.setHeader('Content-Type', 'text/html; charset=utf-8');
+    res.end(createLoginPage(`Too many attempts. Try again in ${retryAfterSeconds} seconds.`));
+}
+function writeUnauthorizedResponse(res, message, ipLocked = false) {
+    res.statusCode = ipLocked ? 429 : 401;
+    res.setHeader('Content-Type', 'text/html; charset=utf-8');
+    res.end(createLoginPage(message));
+}
+function createAuthCookie(session) {
+    return createSharedAuthCookie(session, SESSION_COOKIE_NAME);
+}
+function authenticateRequest(params) {
+    return authenticateProxyRequest({
+        req: params.req,
+        cookieSecret: params.cookieSecret,
+        authToken: params.magicToken,
+        sessionCookieName: SESSION_COOKIE_NAME,
+    });
+}
+async function readRequestBody(req) {
+    const chunks = [];
+    for await (const chunk of req) {
+        const value = typeof chunk === 'string' ? Buffer.from(chunk) : chunk;
+        chunks.push(value);
+        const size = chunks.reduce((acc, current) => acc + current.length, 0);
+        if (size > 4096) {
+            throw new Error('Request body too large');
+        }
+    }
+    return Buffer.concat(chunks).toString('utf8');
+}
+function setSessionCookie(res, cookieSecret) {
+    const session = createSessionValue(cookieSecret);
+    res.setHeader('Set-Cookie', createAuthCookie(session));
+}
+function writeLoginPage(res) {
+    res.statusCode = 200;
+    res.setHeader('Content-Type', 'text/html; charset=utf-8');
+    res.end(createLoginPage());
+}
+function registerFailureAndRespond(params) {
+    const failure = params.guard.registerFailure(params.ip);
+    if (failure.ipLocked) {
+        const retry = params.guard.isLocked(params.ip);
+        writeUnauthorizedResponse(params.res, `Too many failed attempts. Try again in ${retry.retryAfterSeconds} seconds.`, true);
+        return 'handled';
+    }
+    writeUnauthorizedResponse(params.res, params.message);
+    return 'handled';
+}
+async function handleLoginSubmission(params) {
+    if (params.lockState.locked) {
+        writeRateLimitResponse(params.res, params.lockState.retryAfterSeconds);
+        return 'handled';
+    }
+    let submittedPassword = '';
+    try {
+        const body = await readRequestBody(params.req);
+        const form = parseFormBody(body);
+        submittedPassword = (form.password || '').trim().toUpperCase();
+    }
+    catch {
+        submittedPassword = '';
+    }
+    if (submittedPassword && matchesPassword(submittedPassword, params.password)) {
+        setSessionCookie(params.res, params.cookieSecret);
+        params.res.statusCode = 302;
+        params.res.setHeader('Location', '/');
+        params.res.end();
+        return 'handled';
+    }
+    return registerFailureAndRespond({
+        guard: params.guard,
+        ip: params.ip,
+        res: params.res,
+        message: 'Invalid password. Please try again.',
+    });
+}
+async function handleAuthHttpRequest(params) {
+    const ip = getClientIp(params.req);
+    const lockState = params.guard.isLocked(ip);
+    const isLoginPath = params.req.url?.startsWith(LOGIN_PATH) ?? false;
+    const isLoginSubmission = params.req.method === 'POST' && isLoginPath;
+    if (lockState.locked && !isLoginSubmission) {
+        writeRateLimitResponse(params.res, lockState.retryAfterSeconds);
+        return;
+    }
+    const auth = authenticateRequest({
+        req: params.req,
+        cookieSecret: params.cookieSecret,
+        magicToken: params.magicToken,
+    });
+    if (isLoginSubmission) {
+        await handleLoginSubmission({
+            req: params.req,
+            res: params.res,
+            lockState,
+            guard: params.guard,
+            ip,
+            password: params.password,
+            cookieSecret: params.cookieSecret,
+        });
+        return;
+    }
+    if (!auth.authenticated) {
+        if (auth.invalidToken) {
+            registerFailureAndRespond({
+                guard: params.guard,
+                ip,
+                res: params.res,
+                message: 'Invalid token. Please use the shared link again.',
+            });
+            return;
+        }
+        writeLoginPage(params.res);
+        return;
+    }
+    if (auth.viaToken) {
+        setSessionCookie(params.res, params.cookieSecret);
+    }
+    proxyAuthenticatedHttpRequest({
+        req: params.req,
+        res: params.res,
+        upstreamPort: params.upstreamPort,
+        path: auth.sanitizedPath,
+        sessionCookieName: SESSION_COOKIE_NAME,
+        localHost: LOCAL_HOST,
+    });
+}
+function createAuthProxy(params) {
+    const bruteForceGuard = new BruteForceGuard();
+    const cookieSecret = randomBytes(32);
+    const activeSockets = new Set();
+    const server = createHttpServer((req, res) => {
+        void handleAuthHttpRequest({
+            req,
+            res,
+            upstreamPort: params.upstreamPort,
+            password: params.password,
+            magicToken: params.magicToken,
+            cookieSecret,
+            guard: bruteForceGuard,
+        }).catch((error) => {
+            process.stderr.write(chalk.red(`  [proxy] ${error.message}\n`));
+            if (!res.headersSent) {
+                res.statusCode = 500;
+                res.end('Proxy error');
+            }
+        });
+    });
+    server.on('connection', (socket) => {
+        activeSockets.add(socket);
+        socket.once('close', () => {
+            activeSockets.delete(socket);
+        });
+    });
+    server.on('upgrade', (req, socket, head) => {
+        const ip = getClientIp(req);
+        const lockState = bruteForceGuard.isLocked(ip);
+        if (lockState.locked) {
+            socket.write('HTTP/1.1 429 Too Many Requests\r\nConnection: close\r\n\r\n');
+            socket.destroy();
+            return;
+        }
+        const auth = authenticateRequest({
+            req,
+            cookieSecret,
+            magicToken: params.magicToken,
+        });
+        if (!auth.authenticated) {
+            if (auth.invalidToken) {
+                bruteForceGuard.registerFailure(ip);
+            }
+            socket.write('HTTP/1.1 401 Unauthorized\r\nConnection: close\r\n\r\n');
+            socket.destroy();
+            return;
+        }
+        proxyAuthenticatedWebSocketUpgrade({
+            req,
+            socket,
+            head,
+            upstreamPort: params.upstreamPort,
+            sanitizedPath: auth.sanitizedPath,
+            sessionCookieName: SESSION_COOKIE_NAME,
+            localHost: LOCAL_HOST,
+        });
+    });
+    return new Promise((resolve, reject) => {
+        server.once('error', reject);
+        server.listen(0, LOCAL_HOST, () => {
+            const address = server.address();
+            if (!address || typeof address === 'string') {
+                reject(new Error('Could not determine auth proxy port'));
+                return;
+            }
+            resolve({
+                port: address.port,
+                close: async () => {
+                    await new Promise((closeResolve) => {
+                        const timeout = setTimeout(() => {
+                            closeResolve();
+                        }, 1000);
+                        timeout.unref?.();
+                        server.close(() => {
+                            clearTimeout(timeout);
+                            closeResolve();
+                        });
+                        for (const socket of activeSockets) {
+                            socket.destroy();
+                        }
+                    });
+                },
+            });
+        });
+    });
+}
+function createExitPromise(proc, name, shutdownState) {
+    return new Promise((resolve, reject) => {
+        proc.once('exit', (code, signal) => {
+            if (shutdownState.shuttingDown) {
+                resolve();
+                return;
+            }
+            reject(new Error(`${name} exited unexpectedly (code: ${code ?? 'null'}, signal: ${signal ?? 'null'})`));
+        });
+        proc.once('error', (error) => {
+            if (shutdownState.shuttingDown) {
+                resolve();
+                return;
+            }
+            reject(new Error(`${name} failed: ${error.message}`));
+        });
+    });
+}
+export async function runProxyCommand({ options, projectRoot, }) {
+    const usePrivateMode = options.private ?? false;
+    const shutdownState = { shuttingDown: false };
+    const processes = [];
+    let authProxyClose = null;
+    let signalHandlersAttached = false;
+    const shutdown = async (exitCode, message) => {
+        if (shutdownState.shuttingDown) {
+            return;
+        }
+        shutdownState.shuttingDown = true;
+        detachSignalHandlers();
+        if (message) {
+            if (exitCode === 0) {
+                console.log(chalk.yellow(`\n${message}`));
+            }
+            else {
+                console.error(chalk.red(`\n${message}`));
+            }
+        }
+        if (authProxyClose) {
+            try {
+                await authProxyClose();
+            }
+            catch {
+            }
+        }
+        await Promise.all(processes.map(async ({ proc }) => killProcessTree(proc)));
+        process.exit(exitCode);
+    };
+    const onSigint = () => {
+        void shutdown(0, 'SIGINT received, shutting down...');
+    };
+    const onSigterm = () => {
+        void shutdown(0, 'SIGTERM received, shutting down...');
+    };
+    const detachSignalHandlers = () => {
+        if (!signalHandlersAttached) {
+            return;
+        }
+        process.off('SIGINT', onSigint);
+        process.off('SIGTERM', onSigterm);
+        signalHandlersAttached = false;
+    };
+    const attachSignalHandlers = () => {
+        if (signalHandlersAttached) {
+            return;
+        }
+        process.on('SIGINT', onSigint);
+        process.on('SIGTERM', onSigterm);
+        signalHandlersAttached = true;
+    };
+    await ensureCloudflaredInstalled();
+    const databasePath = getDefaultDatabasePath();
+    ensureDataDir(databasePath);
+    try {
+        runMigrations(projectRoot, databasePath);
+    }
+    catch (error) {
+        console.error(chalk.red(`\n❌ Migration failed: ${error.message}`));
+        detachSignalHandlers();
+        process.exit(1);
+        return;
+    }
+    const requestedPort = await findAvailablePort(3001, { maxAttempts: 50 });
+    console.log(chalk.blue(`Starting server on port ${requestedPort}...`));
+    let backend;
+    attachSignalHandlers();
+    try {
+        backend = await startFactoryFactoryServer({
+            projectRoot,
+            databasePath,
+            requestedPort,
+        });
+    }
+    catch (error) {
+        console.error(chalk.red(`\n❌ ${error.message}`));
+        detachSignalHandlers();
+        process.exit(1);
+        return;
+    }
+    processes.push({ name: 'server', proc: backend.process });
+    let targetPort = backend.port;
+    let password = null;
+    let directToken = null;
+    if (usePrivateMode) {
+        password = generatePassword();
+        directToken = generateMagicToken();
+        let authProxy;
+        try {
+            authProxy = await createAuthProxy({
+                upstreamPort: backend.port,
+                password,
+                magicToken: directToken,
+            });
+        }
+        catch (error) {
+            await shutdown(1, `❌ ${error.message}`);
+            return;
+        }
+        targetPort = authProxy.port;
+        authProxyClose = authProxy.close;
+    }
+    console.log(chalk.blue('Starting tunnel...'));
+    let tunnel;
+    try {
+        tunnel = await startCloudflaredTunnel({
+            targetUrl: `http://${LOCAL_HOST}:${targetPort}`,
+            killProcess: (proc) => killProcessTree(proc),
+        });
+    }
+    catch (error) {
+        await shutdown(1, `❌ ${error.message}`);
+        return;
+    }
+    processes.push({ name: 'cloudflared', proc: tunnel.proc });
+    if (usePrivateMode && password && directToken) {
+        const directLink = `${tunnel.publicUrl}?token=${directToken}`;
+        console.log(chalk.green(`🌍 Public URL:  ${tunnel.publicUrl}`));
+        console.log(chalk.green(`🔑 Password:   ${password}`));
+        console.log(chalk.green(`🔗 Direct link: ${directLink}\n`));
+        await printDirectLinkQrCode(directLink);
+        console.log('Share the password or direct link with people you want to grant access.');
+        console.log('Press Ctrl+C to stop.');
+    }
+    else {
+        console.log(chalk.green(`🌍 Public URL:  ${tunnel.publicUrl}\n`));
+        console.log('Press Ctrl+C to stop.');
+    }
+    try {
+        await Promise.race([
+            createExitPromise(backend.process, 'Factory Factory server', shutdownState),
+            createExitPromise(tunnel.proc, 'cloudflared', shutdownState),
+        ]);
+    }
+    catch (error) {
+        await shutdown(1, `❌ ${error.message}`);
+        return;
+    }
+}
+export const proxyInternals = {
+    BruteForceGuard,
+    createSessionValue,
+    createAuthCookie,
+    authenticateRequest,
+    createLoginPage,
+    escapeHtml,
+    extractTryCloudflareUrl,
+    appendBoundedOutputBuffer,
+    generatePassword,
+    generateMagicToken,
+    mergeSetCookieValues,
+    matchesMagicToken,
+    matchesPassword,
+    createAuthProxy,
+    toSafeRedirectPath,
+    supportsTerminalQrRendering,
+    tryRenderTerminalQrCode,
+    parseCookieHeader,
+    signValue,
+    verifySessionValue,
+};
+//# sourceMappingURL=proxy.js.map