panopticon-cli 0.6.4 → 0.6.6

package/dist/{tracker-utils-CVU2W1sX.js → tracker-utils-ChQyut8w.js}

@@ -1,4 +1,5 @@
-import { g as loadProjectsConfig, p as init_projects, s as getIssuePrefix } from "./projects-CvLepaxC.js";
+import { i as parseIssueId, n as extractPrefix, r as init_issue_id, t as extractNumber } from "./issue-id-CAcekoIw.js";
+import { g as loadProjectsConfig, p as init_projects, s as getIssuePrefix } from "./projects-Bk-5QhFQ.js";
 import { existsSync, readFileSync } from "fs";
 import { join } from "path";
 import { homedir } from "os";
@@ -10,6 +11,7 @@ import { homedir } from "os";
 * Eliminates hardcoded prefix checks like `issueId.startsWith('PAN-')`.
 */
 init_projects();
+init_issue_id();
 /**
 * Parse GitHub repos from GITHUB_REPOS env var and projects.yaml.
 * Priority: GITHUB_REPOS env var first, then auto-derive from projects.yaml.
@@ -45,10 +47,12 @@ function parseGitHubRepos() {
 	return repos;
 }
 /**
-* Extract the prefix from an issue ID (e.g., "CLI" from "CLI-1", "PAN" from "PAN-42").
+* Extract the prefix from an issue ID (e.g., "CLI" from "CLI-1", "PAN" from "PAN-42", "F" from "F29698").
+* Uses unified parser to support standard, Rally, and custom formats.
+* @deprecated Use extractPrefix from issue-id.ts for unified parsing
 */
 function extractIssuePrefix(issueId) {
-	return issueId.split("-")[0].toUpperCase();
+	return extractPrefix(issueId) ?? issueId.split("-")[0].toUpperCase();
 }
 /**
 * Resolve an issue ID to its GitHub repo config, or determine it's not a GitHub issue.
@@ -60,8 +64,8 @@ function resolveGitHubIssue(issueId) {
 	const prefix = extractIssuePrefix(issueId);
 	const repos = parseGitHubRepos();
 	for (const repoConfig of repos) if (repoConfig.prefix === prefix) {
-		const number = parseInt(issueId.split("-")[1], 10);
-		if (!isNaN(number)) return {
+		const number = extractNumber(issueId);
+		if (number !== null) return {
 			isGitHub: true,
 			...repoConfig,
 			number
@@ -80,18 +84,36 @@ function isGitHubIssue(issueId) {
 *
 * Resolution order:
 * 1. GitHub — prefix matches a configured github_repo project
-* 2. Rally — prefix matches a project with rally_project but no linear_team / github_repo
+* 2. Rally — prefix matches a project with rally_project or tracker: 'rally'
 * 3. Linear — fallback (matches linear_team or unknown prefix)
 */
 function resolveTrackerType(issueId) {
 	if (resolveGitHubIssue(issueId).isGitHub) return "github";
-	const prefix = extractIssuePrefix(issueId);
+	const parsed = parseIssueId(issueId);
+	if (!parsed) return "linear";
 	try {
 		const { projects } = loadProjectsConfig();
-		for (const [key, project] of Object.entries(projects)) if ((getIssuePrefix(project) || key.toUpperCase().replace(/-/g, ""))?.toUpperCase() === prefix) {
-			if (project.github_repo) return "github";
-			if (project.rally_project) return "rally";
-			return "linear";
+		for (const [key, project] of Object.entries(projects)) {
+			const singlePrefix = getIssuePrefix(project);
+			if (singlePrefix?.toUpperCase() === parsed.prefix) {
+				if (project.tracker) return project.tracker;
+				if (project.github_repo) return "github";
+				if (project.rally_project) return "rally";
+				return "linear";
+			}
+			if (project.issue_prefixes?.some((p) => p.toUpperCase() === parsed.prefix)) {
+				if (project.tracker) return project.tracker;
+				if (project.rally_project) return "rally";
+				return "linear";
+			}
+			if (!singlePrefix && !project.issue_prefixes) {
+				if (key.toUpperCase().replace(/-/g, "") === parsed.prefix) {
+					if (project.tracker) return project.tracker;
+					if (project.github_repo) return "github";
+					if (project.rally_project) return "rally";
+					return "linear";
+				}
+			}
 		}
 	} catch {}
 	return "linear";
@@ -99,4 +121,4 @@ function resolveTrackerType(issueId) {
 //#endregion
 export { resolveGitHubIssue as n, resolveTrackerType as r, isGitHubIssue as t };
 
-//# sourceMappingURL=tracker-utils-CVU2W1sX.js.map
+//# sourceMappingURL=tracker-utils-ChQyut8w.js.map

package/dist/tracker-utils-ChQyut8w.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tracker-utils-ChQyut8w.js","names":[],"sources":["../src/lib/tracker-utils.ts"],"sourcesContent":["/**\n * Shared tracker utilities for resolving issue IDs to their tracker type\n * (GitHub or Linear) based on GITHUB_REPOS configuration.\n *\n * Eliminates hardcoded prefix checks like `issueId.startsWith('PAN-')`.\n */\n\nimport { readFileSync, existsSync } from 'fs';\nimport { join } from 'path';\nimport { homedir } from 'os';\nimport { loadProjectsConfig, getIssuePrefix } from './projects.js';\nimport { extractPrefix, extractNumber, parseIssueId } from './issue-id.js';\n\nexport interface GitHubRepoConfig {\n  owner: string;\n  repo: string;\n  prefix: string;\n}\n\nexport interface GitHubIssueResolution {\n  isGitHub: true;\n  owner: string;\n  repo: string;\n  prefix: string;\n  number: number;\n}\n\nexport interface NonGitHubResolution {\n  isGitHub: false;\n}\n\nexport type IssueResolution = GitHubIssueResolution | NonGitHubResolution;\n\n/**\n * Parse GitHub repos from GITHUB_REPOS env var and projects.yaml.\n * Priority: GITHUB_REPOS env var first, then auto-derive from projects.yaml.\n * Format for env var: \"owner/repo:PREFIX,owner2/repo2:PREFIX2\"\n */\nexport function parseGitHubRepos(): GitHubRepoConfig[] {\n  const repos: GitHubRepoConfig[] = [];\n\n  // 1. Check GITHUB_REPOS env var\n  const envFile = join(homedir(), '.panopticon.env');\n  if (existsSync(envFile)) {\n    const content = readFileSync(envFile, 'utf-8');\n    const reposMatch = content.match(/GITHUB_REPOS=(.+)/);\n    if (reposMatch) {\n      repos.push(...reposMatch[1].trim().split(',').map(r => {\n        const [repoPath, prefix] = r.trim().split(':');\n        const [owner, repo] = (repoPath || '').split('/');\n        return { owner: owner || '', repo: repo || '', prefix: (prefix || '').toUpperCase() };\n      }).filter(r => r.owner && r.repo && r.prefix));\n    }\n  }\n\n  // 2. Auto-derive from projects.yaml (if no explicit GITHUB_REPOS)\n  if (repos.length === 0) {\n    try {\n      const { projects } = loadProjectsConfig();\n      for (const [key, project] of Object.entries(projects)) {\n        if (project.github_repo) {\n          const [owner, repo] = project.github_repo.split('/');\n          // Derive prefix: linear_team if set, otherwise uppercase project key\n          const prefix = getIssuePrefix(project) || key.toUpperCase().replace(/-/g, '');\n          if (owner && repo && prefix) {\n            repos.push({ owner, repo, prefix: prefix.toUpperCase() });\n          }\n        }\n      }\n    } catch { /* ignore */ }\n  }\n\n  return repos;\n}\n\n/**\n * Extract the prefix from an issue ID (e.g., \"CLI\" from \"CLI-1\", \"PAN\" from \"PAN-42\", \"F\" from \"F29698\").\n * Uses unified parser to support standard, Rally, and custom formats.\n * @deprecated Use extractPrefix from issue-id.ts for unified parsing\n */\nexport function extractIssuePrefix(issueId: string): string {\n  return extractPrefix(issueId) ?? issueId.split('-')[0].toUpperCase();\n}\n\n/**\n * Resolve an issue ID to its GitHub repo config, or determine it's not a GitHub issue.\n *\n * Checks the issue prefix against all prefixes configured in GITHUB_REPOS.\n * Returns the matching repo config with parsed issue number, or { isGitHub: false }.\n */\nexport function resolveGitHubIssue(issueId: string): IssueResolution {\n  const prefix = extractIssuePrefix(issueId);\n  const repos = parseGitHubRepos();\n\n  for (const repoConfig of repos) {\n    if (repoConfig.prefix === prefix) {\n      const number = extractNumber(issueId);\n      if (number !== null) {\n        return { isGitHub: true, ...repoConfig, number };\n      }\n    }\n  }\n\n  return { isGitHub: false };\n}\n\n/**\n * Check if an issue ID belongs to a GitHub-tracked project.\n */\nexport function isGitHubIssue(issueId: string): boolean {\n  return resolveGitHubIssue(issueId).isGitHub;\n}\n\nexport type TrackerTypeResolution = 'github' | 'rally' | 'linear' | 'gitlab';\n\n/**\n * Resolve the tracker type for an issue ID by checking projects.yaml configuration.\n *\n * Resolution order:\n * 1. GitHub — prefix matches a configured github_repo project\n * 2. Rally — prefix matches a project with rally_project or tracker: 'rally'\n * 3. Linear — fallback (matches linear_team or unknown prefix)\n */\nexport function resolveTrackerType(issueId: string): TrackerTypeResolution {\n  // Check GitHub first (existing logic)\n  if (resolveGitHubIssue(issueId).isGitHub) {\n    return 'github';\n  }\n\n  // Check if the issue prefix matches a project with explicit tracker type\n  const parsed = parseIssueId(issueId);\n  if (!parsed) {\n    return 'linear'; // default for unparseable IDs\n  }\n\n  try {\n    const { projects } = loadProjectsConfig();\n    for (const [key, project] of Object.entries(projects)) {\n      // Check single issue_prefix\n      const singlePrefix = getIssuePrefix(project);\n      if (singlePrefix?.toUpperCase() === parsed.prefix) {\n        if (project.tracker) return project.tracker;\n        if (project.github_repo) return 'github';\n        if (project.rally_project) return 'rally';\n        return 'linear';\n      }\n\n      // Check issue_prefixes array (multiple prefixes per project)\n      if (project.issue_prefixes?.some(p => p.toUpperCase() === parsed.prefix)) {\n        if (project.tracker) return project.tracker;\n        if (project.rally_project) return 'rally';\n        return 'linear';\n      }\n\n      // Derive prefix from project key for projects without explicit prefixes\n      if (!singlePrefix && !project.issue_prefixes) {\n        const derivedPrefix = key.toUpperCase().replace(/-/g, '');\n        if (derivedPrefix === parsed.prefix) {\n          if (project.tracker) return project.tracker;\n          if (project.github_repo) return 'github';\n          if (project.rally_project) return 'rally';\n          return 'linear';\n        }\n      }\n    }\n  } catch { /* ignore config errors */ }\n\n  // Default to Linear for unknown prefixes\n  return 'linear';\n}\n"],"mappings":";;;;;;;;;;;;eAUmE;eACQ;;;;;;AA2B3E,SAAgB,mBAAuC;CACrD,MAAM,QAA4B,EAAE;CAGpC,MAAM,UAAU,KAAK,SAAS,EAAE,kBAAkB;AAClD,KAAI,WAAW,QAAQ,EAAE;EAEvB,MAAM,aADU,aAAa,SAAS,QAAQ,CACnB,MAAM,oBAAoB;AACrD,MAAI,WACF,OAAM,KAAK,GAAG,WAAW,GAAG,MAAM,CAAC,MAAM,IAAI,CAAC,KAAI,MAAK;GACrD,MAAM,CAAC,UAAU,UAAU,EAAE,MAAM,CAAC,MAAM,IAAI;GAC9C,MAAM,CAAC,OAAO,SAAS,YAAY,IAAI,MAAM,IAAI;AACjD,UAAO;IAAE,OAAO,SAAS;IAAI,MAAM,QAAQ;IAAI,SAAS,UAAU,IAAI,aAAa;IAAE;IACrF,CAAC,QAAO,MAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,OAAO,CAAC;;AAKlD,KAAI,MAAM,WAAW,EACnB,KAAI;EACF,MAAM,EAAE,aAAa,oBAAoB;AACzC,OAAK,MAAM,CAAC,KAAK,YAAY,OAAO,QAAQ,SAAS,CACnD,KAAI,QAAQ,aAAa;GACvB,MAAM,CAAC,OAAO,QAAQ,QAAQ,YAAY,MAAM,IAAI;GAEpD,MAAM,SAAS,eAAe,QAAQ,IAAI,IAAI,aAAa,CAAC,QAAQ,MAAM,GAAG;AAC7E,OAAI,SAAS,QAAQ,OACnB,OAAM,KAAK;IAAE;IAAO;IAAM,QAAQ,OAAO,aAAa;IAAE,CAAC;;SAIzD;AAGV,QAAO;;;;;;;AAQT,SAAgB,mBAAmB,SAAyB;AAC1D,QAAO,cAAc,QAAQ,IAAI,QAAQ,MAAM,IAAI,CAAC,GAAG,aAAa;;;;;;;;AAStE,SAAgB,mBAAmB,SAAkC;CACnE,MAAM,SAAS,mBAAmB,QAAQ;CAC1C,MAAM,QAAQ,kBAAkB;AAEhC,MAAK,MAAM,cAAc,MACvB,KAAI,WAAW,WAAW,QAAQ;EAChC,MAAM,SAAS,cAAc,QAAQ;AACrC,MAAI,WAAW,KACb,QAAO;GAAE,UAAU;GAAM,GAAG;GAAY;GAAQ;;AAKtD,QAAO,EAAE,UAAU,OAAO;;;;;AAM5B,SAAgB,cAAc,SAA0B;AACtD,QAAO,mBAAmB,QAAQ,CAAC;;;;;;;;;;AAarC,SAAgB,mBAAmB,SAAwC;AAEzE,KAAI,mBAAmB,QAAQ,CAAC,SAC9B,QAAO;CAIT,MAAM,SAAS,aAAa,QAAQ;AACpC,KAAI,CAAC,OACH,QAAO;AAGT,KAAI;EACF,MAAM,EAAE,aAAa,oBAAoB;AACzC,OAAK,MAAM,CAAC,KAAK,YAAY,OAAO,QAAQ,SAAS,EAAE;GAErD,MAAM,eAAe,eAAe,QAAQ;AAC5C,OAAI,cAAc,aAAa,KAAK,OAAO,QAAQ;AACjD,QAAI,QAAQ,QAAS,QAAO,QAAQ;AACpC,QAAI,QAAQ,YAAa,QAAO;AAChC,QAAI,QAAQ,cAAe,QAAO;AAClC,WAAO;;AAIT,OAAI,QAAQ,gBAAgB,MAAK,MAAK,EAAE,aAAa,KAAK,OAAO,OAAO,EAAE;AACxE,QAAI,QAAQ,QAAS,QAAO,QAAQ;AACpC,QAAI,QAAQ,cAAe,QAAO;AAClC,WAAO;;AAIT,OAAI,CAAC,gBAAgB,CAAC,QAAQ;QACN,IAAI,aAAa,CAAC,QAAQ,MAAM,GAAG,KACnC,OAAO,QAAQ;AACnC,SAAI,QAAQ,QAAS,QAAO,QAAQ;AACpC,SAAI,QAAQ,YAAa,QAAO;AAChC,SAAI,QAAQ,cAAe,QAAO;AAClC,YAAO;;;;SAIP;AAGR,QAAO"}

package/dist/{traefik-DHgBoWXX.js → traefik-C80EbDu_.js}

@@ -1,6 +1,6 @@
-import { B as TRAEFIK_CERTS_DIR, H as TRAEFIK_DYNAMIC_DIR, L as SOURCE_TRAEFIK_TEMPLATES, V as TRAEFIK_DIR, W as init_paths } from "./paths-lMaxrYtT.js";
-import { a as init_config, o as loadConfig } from "./config-CRzMQRgA.js";
-import { g as loadProjectsConfig, p as init_projects } from "./projects-CvLepaxC.js";
+import { B as TRAEFIK_CERTS_DIR, G as init_paths, H as TRAEFIK_DYNAMIC_DIR, L as SOURCE_TRAEFIK_TEMPLATES, V as TRAEFIK_DIR } from "./paths-CDJ_HsbN.js";
+import { a as init_config, o as loadConfig } from "./config-BQNKsi9G.js";
+import { g as loadProjectsConfig, p as init_projects } from "./projects-Bk-5QhFQ.js";
 import { existsSync, mkdirSync, readFileSync, readdirSync, unlinkSync, writeFileSync } from "fs";
 import { join } from "path";
 import { execSync } from "child_process";
@@ -146,4 +146,4 @@ function cleanupStaleTlsSections() {
 //#endregion
 export { generateTlsConfig as a, generatePanopticonTraefikConfig as i, cleanupTemplateFiles as n, ensureProjectCerts as r, cleanupStaleTlsSections as t };
 
-//# sourceMappingURL=traefik-DHgBoWXX.js.map
+//# sourceMappingURL=traefik-C80EbDu_.js.map

package/dist/{traefik-DHgBoWXX.js.map → traefik-C80EbDu_.js.map}

@@ -1 +1 @@
-{"version":3,"file":"traefik-DHgBoWXX.js","names":[],"sources":["../src/lib/traefik.ts"],"sourcesContent":["/**\n * Traefik Configuration Generator\n *\n * Generates the Panopticon dashboard Traefik routing config\n * from a template, substituting values from config.toml.\n * Also generates TLS certificate configuration from discovered certs.\n */\n\nimport { existsSync, readFileSync, writeFileSync, mkdirSync, unlinkSync, readdirSync } from 'fs';\nimport { join, basename } from 'path';\nimport { execSync } from 'child_process';\nimport { TRAEFIK_DYNAMIC_DIR, TRAEFIK_CERTS_DIR, TRAEFIK_DIR, SOURCE_TRAEFIK_TEMPLATES } from './paths.js';\nimport { loadConfig } from './config.js';\nimport { loadProjectsConfig } from './projects.js';\n\n/**\n * Generate panopticon.yml from template using current config values.\n * Safe to call multiple times (idempotent).\n * Returns true if file was written, false if template not found.\n */\nexport function generatePanopticonTraefikConfig(): boolean {\n  const templatePath = join(SOURCE_TRAEFIK_TEMPLATES, 'dynamic', 'panopticon.yml.template');\n  if (!existsSync(templatePath)) {\n    return false;\n  }\n\n  const config = loadConfig();\n  const placeholders: Record<string, string> = {\n    TRAEFIK_DOMAIN: config.traefik?.domain || 'pan.localhost',\n    DASHBOARD_PORT: String(config.dashboard.port),\n    DASHBOARD_API_PORT: String(config.dashboard.api_port),\n  };\n\n  let content = readFileSync(templatePath, 'utf-8');\n  for (const [key, value] of Object.entries(placeholders)) {\n    content = content.replace(new RegExp(`\\\\{\\\\{${key}\\\\}\\\\}`, 'g'), value);\n  }\n\n  mkdirSync(TRAEFIK_DYNAMIC_DIR, { recursive: true });\n  const outputPath = join(TRAEFIK_DYNAMIC_DIR, 'panopticon.yml');\n  writeFileSync(outputPath, content, 'utf-8');\n  return true;\n}\n\n/**\n * Remove any accidentally-copied .template files from the runtime Traefik dir.\n * Called after copyDirectoryRecursive in pan install.\n */\nexport function cleanupTemplateFiles(): void {\n  const copiedTemplate = join(TRAEFIK_DYNAMIC_DIR, 'panopticon.yml.template');\n  if (existsSync(copiedTemplate)) {\n    unlinkSync(copiedTemplate);\n  }\n}\n\n/**\n * Generate tls.yml from all discovered certificate files in the certs directory.\n *\n * Traefik v3 ignores `tls:` sections when they appear in the same dynamic config\n * file as `http:` routers/services. This function creates a dedicated tls.yml file\n * that Traefik's file provider will pick up separately.\n *\n * The first cert found (pan.localhost) is used as the default certificate.\n * All certs are listed in the certificates array for SNI matching.\n *\n * Safe to call multiple times (idempotent).\n * Returns true if file was written, false if no certs found.\n */\nexport function generateTlsConfig(): boolean {\n  if (!existsSync(TRAEFIK_CERTS_DIR)) {\n    return false;\n  }\n\n  // Scan for cert files (exclude -key.pem files)\n  const files = readdirSync(TRAEFIK_CERTS_DIR);\n  const certFiles = files.filter(f => f.endsWith('.pem') && !f.endsWith('-key.pem'));\n\n  if (certFiles.length === 0) {\n    return false;\n  }\n\n  // Pair each cert with its key file\n  const certPairs: Array<{ certFile: string; keyFile: string }> = [];\n  for (const certFile of certFiles) {\n    const keyFile = certFile.replace('.pem', '-key.pem');\n    if (files.includes(keyFile)) {\n      certPairs.push({\n        certFile: `/etc/traefik/certs/${certFile}`,\n        keyFile: `/etc/traefik/certs/${keyFile}`,\n      });\n    }\n  }\n\n  if (certPairs.length === 0) {\n    return false;\n  }\n\n  // Use the pan.localhost cert as default, fall back to first cert\n  const defaultCert = certPairs.find(p => p.certFile.includes('pan.localhost')) || certPairs[0];\n\n  // Build YAML content\n  let yaml = '# Auto-generated TLS configuration — do not edit manually\\n';\n  yaml += '# Generated by: pan up / pan install\\n';\n  yaml += '# Traefik v3 requires TLS config in a separate dynamic config file\\n\\n';\n  yaml += 'tls:\\n';\n  yaml += '  stores:\\n';\n  yaml += '    default:\\n';\n  yaml += '      defaultCertificate:\\n';\n  yaml += `        certFile: ${defaultCert.certFile}\\n`;\n  yaml += `        keyFile: ${defaultCert.keyFile}\\n`;\n  yaml += '  certificates:\\n';\n  for (const pair of certPairs) {\n    yaml += `    - certFile: ${pair.certFile}\\n`;\n    yaml += `      keyFile: ${pair.keyFile}\\n`;\n  }\n\n  mkdirSync(TRAEFIK_DYNAMIC_DIR, { recursive: true });\n  const outputPath = join(TRAEFIK_DYNAMIC_DIR, 'tls.yml');\n  writeFileSync(outputPath, yaml, 'utf-8');\n  return true;\n}\n\n/**\n * Ensure wildcard certificates exist for all registered projects that have DNS domains.\n *\n * Scans projects.yaml for projects with workspace.dns.domain, and generates\n * mkcert wildcard certs for any that don't already have certs in the Traefik\n * certs directory.\n *\n * Returns array of domains that had certs generated.\n */\nexport function ensureProjectCerts(): string[] {\n  // Check mkcert is available\n  try {\n    execSync('which mkcert', { stdio: 'pipe' });\n  } catch {\n    return [];\n  }\n\n  const projectsConfig = loadProjectsConfig();\n  const generated: string[] = [];\n\n  for (const [, project] of Object.entries(projectsConfig.projects)) {\n    const domain = project.workspace?.dns?.domain;\n    if (!domain) continue;\n\n    const certFile = join(TRAEFIK_CERTS_DIR, `_wildcard.${domain}.pem`);\n    const keyFile = join(TRAEFIK_CERTS_DIR, `_wildcard.${domain}-key.pem`);\n\n    if (existsSync(certFile) && existsSync(keyFile)) {\n      continue;\n    }\n\n    // Generate cert for this project's domain\n    mkdirSync(TRAEFIK_CERTS_DIR, { recursive: true });\n    try {\n      execSync(\n        `mkcert -cert-file \"${certFile}\" -key-file \"${keyFile}\" \"${domain}\" \"*.${domain}\" 2>/dev/null`,\n        { stdio: 'pipe' }\n      );\n      generated.push(domain);\n    } catch {\n      // mkcert failed — skip this domain\n    }\n  }\n\n  return generated;\n}\n\n/**\n * Remove stale `tls:` sections from runtime config files.\n *\n * Traefik v3 ignores tls: in static config (traefik.yml) and in dynamic\n * config files that also contain http: routers. This function strips those\n * dead sections to avoid confusion.\n *\n * Called during `pan up` to clean up configs from older Panopticon versions.\n */\nexport function cleanupStaleTlsSections(): void {\n  // Clean static config (traefik.yml)\n  const staticConfig = join(TRAEFIK_DIR, 'traefik.yml');\n  if (existsSync(staticConfig)) {\n    const content = readFileSync(staticConfig, 'utf-8');\n    // Remove tls: section at the end of the file\n    const cleaned = content.replace(/\\n# TLS Configuration\\ntls:\\n(?:  .*\\n)*/g, '\\n');\n    if (cleaned !== content) {\n      writeFileSync(staticConfig, cleaned, 'utf-8');\n    }\n  }\n\n  // Clean dynamic panopticon.yml (regenerated from template, but also clean runtime copy)\n  const dynamicConfig = join(TRAEFIK_DYNAMIC_DIR, 'panopticon.yml');\n  if (existsSync(dynamicConfig)) {\n    const content = readFileSync(dynamicConfig, 'utf-8');\n    // Remove standalone tls: section (not nested under http: routers)\n    const cleaned = content.replace(/\\ntls:\\n  (?:stores|certificates):\\n(?:    .*\\n)*/g, '\\n');\n    if (cleaned !== content) {\n      writeFileSync(dynamicConfig, cleaned, 'utf-8');\n    }\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;YAW2G;aAClE;eACU;;;;;;AAOnD,SAAgB,kCAA2C;CACzD,MAAM,eAAe,KAAK,0BAA0B,WAAW,0BAA0B;AACzF,KAAI,CAAC,WAAW,aAAa,CAC3B,QAAO;CAGT,MAAM,SAAS,YAAY;CAC3B,MAAM,eAAuC;EAC3C,gBAAgB,OAAO,SAAS,UAAU;EAC1C,gBAAgB,OAAO,OAAO,UAAU,KAAK;EAC7C,oBAAoB,OAAO,OAAO,UAAU,SAAS;EACtD;CAED,IAAI,UAAU,aAAa,cAAc,QAAQ;AACjD,MAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,aAAa,CACrD,WAAU,QAAQ,QAAQ,IAAI,OAAO,SAAS,IAAI,SAAS,IAAI,EAAE,MAAM;AAGzE,WAAU,qBAAqB,EAAE,WAAW,MAAM,CAAC;AAEnD,eADmB,KAAK,qBAAqB,iBAAiB,EACpC,SAAS,QAAQ;AAC3C,QAAO;;;;;;AAOT,SAAgB,uBAA6B;CAC3C,MAAM,iBAAiB,KAAK,qBAAqB,0BAA0B;AAC3E,KAAI,WAAW,eAAe,CAC5B,YAAW,eAAe;;;;;;;;;;;;;;;AAiB9B,SAAgB,oBAA6B;AAC3C,KAAI,CAAC,WAAW,kBAAkB,CAChC,QAAO;CAIT,MAAM,QAAQ,YAAY,kBAAkB;CAC5C,MAAM,YAAY,MAAM,QAAO,MAAK,EAAE,SAAS,OAAO,IAAI,CAAC,EAAE,SAAS,WAAW,CAAC;AAElF,KAAI,UAAU,WAAW,EACvB,QAAO;CAIT,MAAM,YAA0D,EAAE;AAClE,MAAK,MAAM,YAAY,WAAW;EAChC,MAAM,UAAU,SAAS,QAAQ,QAAQ,WAAW;AACpD,MAAI,MAAM,SAAS,QAAQ,CACzB,WAAU,KAAK;GACb,UAAU,sBAAsB;GAChC,SAAS,sBAAsB;GAChC,CAAC;;AAIN,KAAI,UAAU,WAAW,EACvB,QAAO;CAIT,MAAM,cAAc,UAAU,MAAK,MAAK,EAAE,SAAS,SAAS,gBAAgB,CAAC,IAAI,UAAU;CAG3F,IAAI,OAAO;AACX,SAAQ;AACR,SAAQ;AACR,SAAQ;AACR,SAAQ;AACR,SAAQ;AACR,SAAQ;AACR,SAAQ,qBAAqB,YAAY,SAAS;AAClD,SAAQ,oBAAoB,YAAY,QAAQ;AAChD,SAAQ;AACR,MAAK,MAAM,QAAQ,WAAW;AAC5B,UAAQ,mBAAmB,KAAK,SAAS;AACzC,UAAQ,kBAAkB,KAAK,QAAQ;;AAGzC,WAAU,qBAAqB,EAAE,WAAW,MAAM,CAAC;AAEnD,eADmB,KAAK,qBAAqB,UAAU,EAC7B,MAAM,QAAQ;AACxC,QAAO;;;;;;;;;;;AAYT,SAAgB,qBAA+B;AAE7C,KAAI;AACF,WAAS,gBAAgB,EAAE,OAAO,QAAQ,CAAC;SACrC;AACN,SAAO,EAAE;;CAGX,MAAM,iBAAiB,oBAAoB;CAC3C,MAAM,YAAsB,EAAE;AAE9B,MAAK,MAAM,GAAG,YAAY,OAAO,QAAQ,eAAe,SAAS,EAAE;EACjE,MAAM,SAAS,QAAQ,WAAW,KAAK;AACvC,MAAI,CAAC,OAAQ;EAEb,MAAM,WAAW,KAAK,mBAAmB,aAAa,OAAO,MAAM;EACnE,MAAM,UAAU,KAAK,mBAAmB,aAAa,OAAO,UAAU;AAEtE,MAAI,WAAW,SAAS,IAAI,WAAW,QAAQ,CAC7C;AAIF,YAAU,mBAAmB,EAAE,WAAW,MAAM,CAAC;AACjD,MAAI;AACF,YACE,sBAAsB,SAAS,eAAe,QAAQ,KAAK,OAAO,OAAO,OAAO,gBAChF,EAAE,OAAO,QAAQ,CAClB;AACD,aAAU,KAAK,OAAO;UAChB;;AAKV,QAAO;;;;;;;;;;;AAYT,SAAgB,0BAAgC;CAE9C,MAAM,eAAe,KAAK,aAAa,cAAc;AACrD,KAAI,WAAW,aAAa,EAAE;EAC5B,MAAM,UAAU,aAAa,cAAc,QAAQ;EAEnD,MAAM,UAAU,QAAQ,QAAQ,6CAA6C,KAAK;AAClF,MAAI,YAAY,QACd,eAAc,cAAc,SAAS,QAAQ;;CAKjD,MAAM,gBAAgB,KAAK,qBAAqB,iBAAiB;AACjE,KAAI,WAAW,cAAc,EAAE;EAC7B,MAAM,UAAU,aAAa,eAAe,QAAQ;EAEpD,MAAM,UAAU,QAAQ,QAAQ,sDAAsD,KAAK;AAC3F,MAAI,YAAY,QACd,eAAc,eAAe,SAAS,QAAQ"}
+{"version":3,"file":"traefik-C80EbDu_.js","names":[],"sources":["../src/lib/traefik.ts"],"sourcesContent":["/**\n * Traefik Configuration Generator\n *\n * Generates the Panopticon dashboard Traefik routing config\n * from a template, substituting values from config.toml.\n * Also generates TLS certificate configuration from discovered certs.\n */\n\nimport { existsSync, readFileSync, writeFileSync, mkdirSync, unlinkSync, readdirSync } from 'fs';\nimport { join, basename } from 'path';\nimport { execSync } from 'child_process';\nimport { TRAEFIK_DYNAMIC_DIR, TRAEFIK_CERTS_DIR, TRAEFIK_DIR, SOURCE_TRAEFIK_TEMPLATES } from './paths.js';\nimport { loadConfig } from './config.js';\nimport { loadProjectsConfig } from './projects.js';\n\n/**\n * Generate panopticon.yml from template using current config values.\n * Safe to call multiple times (idempotent).\n * Returns true if file was written, false if template not found.\n */\nexport function generatePanopticonTraefikConfig(): boolean {\n  const templatePath = join(SOURCE_TRAEFIK_TEMPLATES, 'dynamic', 'panopticon.yml.template');\n  if (!existsSync(templatePath)) {\n    return false;\n  }\n\n  const config = loadConfig();\n  const placeholders: Record<string, string> = {\n    TRAEFIK_DOMAIN: config.traefik?.domain || 'pan.localhost',\n    DASHBOARD_PORT: String(config.dashboard.port),\n    DASHBOARD_API_PORT: String(config.dashboard.api_port),\n  };\n\n  let content = readFileSync(templatePath, 'utf-8');\n  for (const [key, value] of Object.entries(placeholders)) {\n    content = content.replace(new RegExp(`\\\\{\\\\{${key}\\\\}\\\\}`, 'g'), value);\n  }\n\n  mkdirSync(TRAEFIK_DYNAMIC_DIR, { recursive: true });\n  const outputPath = join(TRAEFIK_DYNAMIC_DIR, 'panopticon.yml');\n  writeFileSync(outputPath, content, 'utf-8');\n  return true;\n}\n\n/**\n * Remove any accidentally-copied .template files from the runtime Traefik dir.\n * Called after copyDirectoryRecursive in pan install.\n */\nexport function cleanupTemplateFiles(): void {\n  const copiedTemplate = join(TRAEFIK_DYNAMIC_DIR, 'panopticon.yml.template');\n  if (existsSync(copiedTemplate)) {\n    unlinkSync(copiedTemplate);\n  }\n}\n\n/**\n * Generate tls.yml from all discovered certificate files in the certs directory.\n *\n * Traefik v3 ignores `tls:` sections when they appear in the same dynamic config\n * file as `http:` routers/services. This function creates a dedicated tls.yml file\n * that Traefik's file provider will pick up separately.\n *\n * The first cert found (pan.localhost) is used as the default certificate.\n * All certs are listed in the certificates array for SNI matching.\n *\n * Safe to call multiple times (idempotent).\n * Returns true if file was written, false if no certs found.\n */\nexport function generateTlsConfig(): boolean {\n  if (!existsSync(TRAEFIK_CERTS_DIR)) {\n    return false;\n  }\n\n  // Scan for cert files (exclude -key.pem files)\n  const files = readdirSync(TRAEFIK_CERTS_DIR);\n  const certFiles = files.filter(f => f.endsWith('.pem') && !f.endsWith('-key.pem'));\n\n  if (certFiles.length === 0) {\n    return false;\n  }\n\n  // Pair each cert with its key file\n  const certPairs: Array<{ certFile: string; keyFile: string }> = [];\n  for (const certFile of certFiles) {\n    const keyFile = certFile.replace('.pem', '-key.pem');\n    if (files.includes(keyFile)) {\n      certPairs.push({\n        certFile: `/etc/traefik/certs/${certFile}`,\n        keyFile: `/etc/traefik/certs/${keyFile}`,\n      });\n    }\n  }\n\n  if (certPairs.length === 0) {\n    return false;\n  }\n\n  // Use the pan.localhost cert as default, fall back to first cert\n  const defaultCert = certPairs.find(p => p.certFile.includes('pan.localhost')) || certPairs[0];\n\n  // Build YAML content\n  let yaml = '# Auto-generated TLS configuration — do not edit manually\\n';\n  yaml += '# Generated by: pan up / pan install\\n';\n  yaml += '# Traefik v3 requires TLS config in a separate dynamic config file\\n\\n';\n  yaml += 'tls:\\n';\n  yaml += '  stores:\\n';\n  yaml += '    default:\\n';\n  yaml += '      defaultCertificate:\\n';\n  yaml += `        certFile: ${defaultCert.certFile}\\n`;\n  yaml += `        keyFile: ${defaultCert.keyFile}\\n`;\n  yaml += '  certificates:\\n';\n  for (const pair of certPairs) {\n    yaml += `    - certFile: ${pair.certFile}\\n`;\n    yaml += `      keyFile: ${pair.keyFile}\\n`;\n  }\n\n  mkdirSync(TRAEFIK_DYNAMIC_DIR, { recursive: true });\n  const outputPath = join(TRAEFIK_DYNAMIC_DIR, 'tls.yml');\n  writeFileSync(outputPath, yaml, 'utf-8');\n  return true;\n}\n\n/**\n * Ensure wildcard certificates exist for all registered projects that have DNS domains.\n *\n * Scans projects.yaml for projects with workspace.dns.domain, and generates\n * mkcert wildcard certs for any that don't already have certs in the Traefik\n * certs directory.\n *\n * Returns array of domains that had certs generated.\n */\nexport function ensureProjectCerts(): string[] {\n  // Check mkcert is available\n  try {\n    execSync('which mkcert', { stdio: 'pipe' });\n  } catch {\n    return [];\n  }\n\n  const projectsConfig = loadProjectsConfig();\n  const generated: string[] = [];\n\n  for (const [, project] of Object.entries(projectsConfig.projects)) {\n    const domain = project.workspace?.dns?.domain;\n    if (!domain) continue;\n\n    const certFile = join(TRAEFIK_CERTS_DIR, `_wildcard.${domain}.pem`);\n    const keyFile = join(TRAEFIK_CERTS_DIR, `_wildcard.${domain}-key.pem`);\n\n    if (existsSync(certFile) && existsSync(keyFile)) {\n      continue;\n    }\n\n    // Generate cert for this project's domain\n    mkdirSync(TRAEFIK_CERTS_DIR, { recursive: true });\n    try {\n      execSync(\n        `mkcert -cert-file \"${certFile}\" -key-file \"${keyFile}\" \"${domain}\" \"*.${domain}\" 2>/dev/null`,\n        { stdio: 'pipe' }\n      );\n      generated.push(domain);\n    } catch {\n      // mkcert failed — skip this domain\n    }\n  }\n\n  return generated;\n}\n\n/**\n * Remove stale `tls:` sections from runtime config files.\n *\n * Traefik v3 ignores tls: in static config (traefik.yml) and in dynamic\n * config files that also contain http: routers. This function strips those\n * dead sections to avoid confusion.\n *\n * Called during `pan up` to clean up configs from older Panopticon versions.\n */\nexport function cleanupStaleTlsSections(): void {\n  // Clean static config (traefik.yml)\n  const staticConfig = join(TRAEFIK_DIR, 'traefik.yml');\n  if (existsSync(staticConfig)) {\n    const content = readFileSync(staticConfig, 'utf-8');\n    // Remove tls: section at the end of the file\n    const cleaned = content.replace(/\\n# TLS Configuration\\ntls:\\n(?:  .*\\n)*/g, '\\n');\n    if (cleaned !== content) {\n      writeFileSync(staticConfig, cleaned, 'utf-8');\n    }\n  }\n\n  // Clean dynamic panopticon.yml (regenerated from template, but also clean runtime copy)\n  const dynamicConfig = join(TRAEFIK_DYNAMIC_DIR, 'panopticon.yml');\n  if (existsSync(dynamicConfig)) {\n    const content = readFileSync(dynamicConfig, 'utf-8');\n    // Remove standalone tls: section (not nested under http: routers)\n    const cleaned = content.replace(/\\ntls:\\n  (?:stores|certificates):\\n(?:    .*\\n)*/g, '\\n');\n    if (cleaned !== content) {\n      writeFileSync(dynamicConfig, cleaned, 'utf-8');\n    }\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;YAW2G;aAClE;eACU;;;;;;AAOnD,SAAgB,kCAA2C;CACzD,MAAM,eAAe,KAAK,0BAA0B,WAAW,0BAA0B;AACzF,KAAI,CAAC,WAAW,aAAa,CAC3B,QAAO;CAGT,MAAM,SAAS,YAAY;CAC3B,MAAM,eAAuC;EAC3C,gBAAgB,OAAO,SAAS,UAAU;EAC1C,gBAAgB,OAAO,OAAO,UAAU,KAAK;EAC7C,oBAAoB,OAAO,OAAO,UAAU,SAAS;EACtD;CAED,IAAI,UAAU,aAAa,cAAc,QAAQ;AACjD,MAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,aAAa,CACrD,WAAU,QAAQ,QAAQ,IAAI,OAAO,SAAS,IAAI,SAAS,IAAI,EAAE,MAAM;AAGzE,WAAU,qBAAqB,EAAE,WAAW,MAAM,CAAC;AAEnD,eADmB,KAAK,qBAAqB,iBAAiB,EACpC,SAAS,QAAQ;AAC3C,QAAO;;;;;;AAOT,SAAgB,uBAA6B;CAC3C,MAAM,iBAAiB,KAAK,qBAAqB,0BAA0B;AAC3E,KAAI,WAAW,eAAe,CAC5B,YAAW,eAAe;;;;;;;;;;;;;;;AAiB9B,SAAgB,oBAA6B;AAC3C,KAAI,CAAC,WAAW,kBAAkB,CAChC,QAAO;CAIT,MAAM,QAAQ,YAAY,kBAAkB;CAC5C,MAAM,YAAY,MAAM,QAAO,MAAK,EAAE,SAAS,OAAO,IAAI,CAAC,EAAE,SAAS,WAAW,CAAC;AAElF,KAAI,UAAU,WAAW,EACvB,QAAO;CAIT,MAAM,YAA0D,EAAE;AAClE,MAAK,MAAM,YAAY,WAAW;EAChC,MAAM,UAAU,SAAS,QAAQ,QAAQ,WAAW;AACpD,MAAI,MAAM,SAAS,QAAQ,CACzB,WAAU,KAAK;GACb,UAAU,sBAAsB;GAChC,SAAS,sBAAsB;GAChC,CAAC;;AAIN,KAAI,UAAU,WAAW,EACvB,QAAO;CAIT,MAAM,cAAc,UAAU,MAAK,MAAK,EAAE,SAAS,SAAS,gBAAgB,CAAC,IAAI,UAAU;CAG3F,IAAI,OAAO;AACX,SAAQ;AACR,SAAQ;AACR,SAAQ;AACR,SAAQ;AACR,SAAQ;AACR,SAAQ;AACR,SAAQ,qBAAqB,YAAY,SAAS;AAClD,SAAQ,oBAAoB,YAAY,QAAQ;AAChD,SAAQ;AACR,MAAK,MAAM,QAAQ,WAAW;AAC5B,UAAQ,mBAAmB,KAAK,SAAS;AACzC,UAAQ,kBAAkB,KAAK,QAAQ;;AAGzC,WAAU,qBAAqB,EAAE,WAAW,MAAM,CAAC;AAEnD,eADmB,KAAK,qBAAqB,UAAU,EAC7B,MAAM,QAAQ;AACxC,QAAO;;;;;;;;;;;AAYT,SAAgB,qBAA+B;AAE7C,KAAI;AACF,WAAS,gBAAgB,EAAE,OAAO,QAAQ,CAAC;SACrC;AACN,SAAO,EAAE;;CAGX,MAAM,iBAAiB,oBAAoB;CAC3C,MAAM,YAAsB,EAAE;AAE9B,MAAK,MAAM,GAAG,YAAY,OAAO,QAAQ,eAAe,SAAS,EAAE;EACjE,MAAM,SAAS,QAAQ,WAAW,KAAK;AACvC,MAAI,CAAC,OAAQ;EAEb,MAAM,WAAW,KAAK,mBAAmB,aAAa,OAAO,MAAM;EACnE,MAAM,UAAU,KAAK,mBAAmB,aAAa,OAAO,UAAU;AAEtE,MAAI,WAAW,SAAS,IAAI,WAAW,QAAQ,CAC7C;AAIF,YAAU,mBAAmB,EAAE,WAAW,MAAM,CAAC;AACjD,MAAI;AACF,YACE,sBAAsB,SAAS,eAAe,QAAQ,KAAK,OAAO,OAAO,OAAO,gBAChF,EAAE,OAAO,QAAQ,CAClB;AACD,aAAU,KAAK,OAAO;UAChB;;AAKV,QAAO;;;;;;;;;;;AAYT,SAAgB,0BAAgC;CAE9C,MAAM,eAAe,KAAK,aAAa,cAAc;AACrD,KAAI,WAAW,aAAa,EAAE;EAC5B,MAAM,UAAU,aAAa,cAAc,QAAQ;EAEnD,MAAM,UAAU,QAAQ,QAAQ,6CAA6C,KAAK;AAClF,MAAI,YAAY,QACd,eAAc,cAAc,SAAS,QAAQ;;CAKjD,MAAM,gBAAgB,KAAK,qBAAqB,iBAAiB;AACjE,KAAI,WAAW,cAAc,EAAE;EAC7B,MAAM,UAAU,aAAa,eAAe,QAAQ;EAEpD,MAAM,UAAU,QAAQ,QAAQ,sDAAsD,KAAK;AAC3F,MAAI,YAAY,QACd,eAAc,eAAe,SAAS,QAAQ"}

package/dist/{traefik-BR-edbZv.js → traefik-CgHl7Bge.js}

@@ -1,2 +1,2 @@
-import { a as generateTlsConfig, i as generatePanopticonTraefikConfig, r as ensureProjectCerts, t as cleanupStaleTlsSections } from "./traefik-DHgBoWXX.js";
+import { a as generateTlsConfig, i as generatePanopticonTraefikConfig, r as ensureProjectCerts, t as cleanupStaleTlsSections } from "./traefik-C80EbDu_.js";
 export { cleanupStaleTlsSections, ensureProjectCerts, generatePanopticonTraefikConfig, generateTlsConfig };

package/dist/{tunnel-BZO9Q5oe.js → tunnel-DXOJ1wMM.js}

@@ -1,3 +1,3 @@
-import { n as init_tunnel, r as removeTunnelIngress } from "./tunnel-Bl1qNSyQ.js";
+import { n as init_tunnel, r as removeTunnelIngress } from "./tunnel-DzXEPwIc.js";
 init_tunnel();
 export { removeTunnelIngress };

package/dist/{tunnel-Bl1qNSyQ.js → tunnel-DzXEPwIc.js}

@@ -1,5 +1,5 @@
 import { t as __esmMin } from "./chunk-ruWRV7i3.js";
-import { n as init_workspace_config, r as replacePlaceholders } from "./workspace-config-CNXOpKuj.js";
+import { n as init_workspace_config, r as replacePlaceholders } from "./workspace-config-fUafvYMp.js";
 import { readFileSync } from "fs";
 import { resolve } from "path";
 import { homedir } from "os";
@@ -204,4 +204,4 @@ var init_tunnel = __esmMin((() => {
 //#endregion
 export { init_tunnel as n, removeTunnelIngress as r, addTunnelIngress as t };
 
-//# sourceMappingURL=tunnel-Bl1qNSyQ.js.map
+//# sourceMappingURL=tunnel-DzXEPwIc.js.map

package/dist/{tunnel-Bl1qNSyQ.js.map → tunnel-DzXEPwIc.js.map}

@@ -1 +1 @@
-{"version":3,"file":"tunnel-Bl1qNSyQ.js","names":[],"sources":["../src/lib/tunnel.ts"],"sourcesContent":["/**\n * Cloudflare Tunnel Management\n *\n * Manages tunnel ingress rules and DNS CNAME records for workspace lifecycle.\n * Called during workspace create (addTunnelIngress) and workspace remove/deep-wipe (removeTunnelIngress).\n */\n\nimport { readFileSync } from 'fs';\nimport { resolve } from 'path';\nimport { homedir } from 'os';\nimport { TunnelConfig, TunnelHostname, TemplatePlaceholders, replacePlaceholders } from './workspace-config.js';\n\nexport interface TunnelResult {\n  success: boolean;\n  steps: string[];\n}\n\ninterface CloudflareCredentials {\n  apiToken: string;\n  accountId: string;\n  zoneId: string;\n}\n\ninterface CloudflareIngressRule {\n  service: string;\n  hostname?: string;\n  originRequest?: Record<string, unknown>;\n}\n\ninterface CloudflareTunnelConfig {\n  config: {\n    ingress: CloudflareIngressRule[];\n  };\n}\n\nconst CF_API = 'https://api.cloudflare.com/client/v4';\nconst FETCH_TIMEOUT = 10_000;\n\n/**\n * Read API token from Cloudflare cert.pem file.\n * The cert.pem contains a PEM-wrapped base64 JSON blob with { zoneID, accountID, apiToken }.\n */\nfunction readCloudflareCredentials(certPath: string): CloudflareCredentials | null {\n  try {\n    const resolvedPath = certPath.replace(/^~/, homedir());\n    const pem = readFileSync(resolve(resolvedPath), 'utf-8');\n    // Strip PEM headers/trailers and decode\n    const b64 = pem\n      .split('\\n')\n      .filter(line => !line.startsWith('-----'))\n      .join('');\n    const json = JSON.parse(Buffer.from(b64, 'base64').toString('utf-8'));\n    return {\n      apiToken: json.apiToken,\n      accountId: json.accountID,\n      zoneId: json.zoneID,\n    };\n  } catch (err) {\n    return null;\n  }\n}\n\n/**\n * Make an authenticated Cloudflare API request.\n */\nasync function cfFetch(\n  path: string,\n  apiToken: string,\n  method: 'GET' | 'POST' | 'PUT' | 'DELETE' = 'GET',\n  body?: unknown,\n): Promise<{ ok: boolean; data: any; errors?: any[] }> {\n  const controller = new AbortController();\n  const timeout = setTimeout(() => controller.abort(), FETCH_TIMEOUT);\n\n  try {\n    const resp = await fetch(`${CF_API}${path}`, {\n      method,\n      headers: {\n        Authorization: `Bearer ${apiToken}`,\n        'Content-Type': 'application/json',\n      },\n      body: body ? JSON.stringify(body) : undefined,\n      signal: controller.signal,\n    });\n    const json = await resp.json() as any;\n    return { ok: json.success !== false, data: json.result, errors: json.errors };\n  } catch (err: any) {\n    return { ok: false, data: null, errors: [{ message: err.message }] };\n  } finally {\n    clearTimeout(timeout);\n  }\n}\n\n/**\n * Resolve hostnames from config, replacing template placeholders.\n */\nfunction resolveHostnames(\n  hostnames: TunnelHostname[],\n  placeholders: TemplatePlaceholders,\n): Array<{ hostname: string; httpHostHeader?: string; noTlsVerify: boolean }> {\n  return hostnames.map(h => ({\n    hostname: replacePlaceholders(h.pattern, placeholders),\n    httpHostHeader: h.http_host_header ? replacePlaceholders(h.http_host_header, placeholders) : undefined,\n    noTlsVerify: h.no_tls_verify !== false, // default true\n  }));\n}\n\n/**\n * Add tunnel ingress rules and DNS CNAME records for a workspace.\n * Called during workspace creation.\n */\nexport async function addTunnelIngress(\n  config: TunnelConfig,\n  placeholders: TemplatePlaceholders,\n): Promise<TunnelResult> {\n  const steps: string[] = [];\n  let allOk = true;\n\n  // Read credentials\n  const creds = readCloudflareCredentials(config.credentials_file);\n  if (!creds) {\n    return { success: false, steps: ['[tunnel] Failed to read Cloudflare credentials from ' + config.credentials_file] };\n  }\n  steps.push('[tunnel] Read Cloudflare credentials');\n\n  const resolved = resolveHostnames(config.hostnames, placeholders);\n\n  // Get current tunnel configuration\n  const tunnelPath = `/accounts/${creds.accountId}/cfd_tunnel/${config.tunnel_id}/configurations`;\n  const current = await cfFetch(tunnelPath, creds.apiToken);\n  if (!current.ok) {\n    return { success: false, steps: [...steps, `[tunnel] Failed to get tunnel config: ${JSON.stringify(current.errors)}`] };\n  }\n\n  const tunnelConfig: CloudflareTunnelConfig = current.data;\n  const ingress: CloudflareIngressRule[] = tunnelConfig.config?.ingress || [];\n  steps.push(`[tunnel] Current tunnel config has ${ingress.length} ingress rules`);\n\n  // Add new ingress rules (before the catch-all)\n  let modified = false;\n  for (const h of resolved) {\n    // Skip if rule already exists\n    if (ingress.some(r => r.hostname === h.hostname)) {\n      steps.push(`[tunnel] Ingress rule for ${h.hostname} already exists, skipping`);\n      continue;\n    }\n\n    const originRequest: Record<string, unknown> = {};\n    if (h.noTlsVerify) originRequest.noTLSVerify = true;\n    if (h.httpHostHeader) originRequest.httpHostHeader = h.httpHostHeader;\n\n    const newRule: CloudflareIngressRule = {\n      service: config.service_target,\n      hostname: h.hostname,\n      originRequest: Object.keys(originRequest).length > 0 ? originRequest : undefined,\n    };\n\n    // Insert before the last rule (catch-all has no hostname)\n    const catchAllIdx = ingress.findIndex(r => !r.hostname);\n    if (catchAllIdx >= 0) {\n      ingress.splice(catchAllIdx, 0, newRule);\n    } else {\n      ingress.push(newRule);\n    }\n    modified = true;\n    steps.push(`[tunnel] Added ingress rule for ${h.hostname}`);\n  }\n\n  // Push updated tunnel config\n  if (modified) {\n    const putResult = await cfFetch(tunnelPath, creds.apiToken, 'PUT', {\n      config: { ingress },\n    });\n    if (!putResult.ok) {\n      steps.push(`[tunnel] Failed to update tunnel config: ${JSON.stringify(putResult.errors)}`);\n      allOk = false;\n    } else {\n      steps.push('[tunnel] Updated tunnel ingress configuration');\n    }\n  }\n\n  // Create DNS CNAME records\n  for (const h of resolved) {\n    const dnsResult = await cfFetch(\n      `/zones/${creds.zoneId}/dns_records`,\n      creds.apiToken,\n      'POST',\n      {\n        type: 'CNAME',\n        name: h.hostname,\n        content: `${config.tunnel_id}.cfargotunnel.com`,\n        proxied: true,\n      },\n    );\n    if (!dnsResult.ok) {\n      const errMsg = dnsResult.errors?.map((e: any) => e.message).join(', ') || 'unknown error';\n      // Record already exists is not a failure\n      if (errMsg.includes('already exists') || errMsg.includes('already been taken')) {\n        steps.push(`[tunnel] DNS CNAME for ${h.hostname} already exists`);\n      } else {\n        steps.push(`[tunnel] Failed to create DNS CNAME for ${h.hostname}: ${errMsg}`);\n        allOk = false;\n      }\n    } else {\n      steps.push(`[tunnel] Created DNS CNAME: ${h.hostname} → ${config.tunnel_id}.cfargotunnel.com`);\n    }\n  }\n\n  return { success: allOk, steps };\n}\n\n/**\n * Remove tunnel ingress rules and DNS CNAME records for a workspace.\n * Called during workspace removal and deep-wipe.\n */\nexport async function removeTunnelIngress(\n  config: TunnelConfig,\n  placeholders: TemplatePlaceholders,\n): Promise<TunnelResult> {\n  const steps: string[] = [];\n  let allOk = true;\n\n  // Read credentials\n  const creds = readCloudflareCredentials(config.credentials_file);\n  if (!creds) {\n    return { success: false, steps: ['[tunnel] Failed to read Cloudflare credentials from ' + config.credentials_file] };\n  }\n  steps.push('[tunnel] Read Cloudflare credentials');\n\n  const resolved = resolveHostnames(config.hostnames, placeholders);\n  const hostnameSet = new Set(resolved.map(h => h.hostname));\n\n  // Get current tunnel configuration\n  const tunnelPath = `/accounts/${creds.accountId}/cfd_tunnel/${config.tunnel_id}/configurations`;\n  const current = await cfFetch(tunnelPath, creds.apiToken);\n  if (!current.ok) {\n    steps.push(`[tunnel] Failed to get tunnel config: ${JSON.stringify(current.errors)}`);\n    // Continue to attempt DNS cleanup even if tunnel config read fails\n    allOk = false;\n  } else {\n    const tunnelConfig: CloudflareTunnelConfig = current.data;\n    const ingress: CloudflareIngressRule[] = tunnelConfig.config?.ingress || [];\n    const originalCount = ingress.length;\n\n    // Filter out matching ingress rules\n    const filtered = ingress.filter(r => !r.hostname || !hostnameSet.has(r.hostname));\n\n    if (filtered.length < originalCount) {\n      const putResult = await cfFetch(tunnelPath, creds.apiToken, 'PUT', {\n        config: { ingress: filtered },\n      });\n      if (!putResult.ok) {\n        steps.push(`[tunnel] Failed to update tunnel config: ${JSON.stringify(putResult.errors)}`);\n        allOk = false;\n      } else {\n        steps.push(`[tunnel] Removed ${originalCount - filtered.length} ingress rule(s)`);\n      }\n    } else {\n      steps.push('[tunnel] No matching ingress rules found to remove');\n    }\n  }\n\n  // Remove DNS CNAME records\n  for (const h of resolved) {\n    // Find the DNS record\n    const listResult = await cfFetch(\n      `/zones/${creds.zoneId}/dns_records?name=${encodeURIComponent(h.hostname)}&type=CNAME`,\n      creds.apiToken,\n    );\n    if (!listResult.ok) {\n      steps.push(`[tunnel] Failed to look up DNS record for ${h.hostname}: ${JSON.stringify(listResult.errors)}`);\n      allOk = false;\n      continue;\n    }\n\n    const records = Array.isArray(listResult.data) ? listResult.data : [];\n    if (records.length === 0) {\n      steps.push(`[tunnel] No DNS CNAME record found for ${h.hostname}`);\n      continue;\n    }\n\n    for (const record of records) {\n      const delResult = await cfFetch(\n        `/zones/${creds.zoneId}/dns_records/${record.id}`,\n        creds.apiToken,\n        'DELETE',\n      );\n      if (!delResult.ok) {\n        steps.push(`[tunnel] Failed to delete DNS record ${record.id} for ${h.hostname}: ${JSON.stringify(delResult.errors)}`);\n        allOk = false;\n      } else {\n        steps.push(`[tunnel] Deleted DNS CNAME for ${h.hostname}`);\n      }\n    }\n  }\n\n  return { success: allOk, steps };\n}\n"],"mappings":";;;;;;;;;;;;;;;;AA0CA,SAAS,0BAA0B,UAAgD;AACjF,KAAI;EAIF,MAAM,MAFM,aAAa,QADJ,SAAS,QAAQ,MAAM,SAAS,CAAC,CACR,EAAE,QAAQ,CAGrD,MAAM,KAAK,CACX,QAAO,SAAQ,CAAC,KAAK,WAAW,QAAQ,CAAC,CACzC,KAAK,GAAG;EACX,MAAM,OAAO,KAAK,MAAM,OAAO,KAAK,KAAK,SAAS,CAAC,SAAS,QAAQ,CAAC;AACrE,SAAO;GACL,UAAU,KAAK;GACf,WAAW,KAAK;GAChB,QAAQ,KAAK;GACd;UACM,KAAK;AACZ,SAAO;;;;;;AAOX,eAAe,QACb,MACA,UACA,SAA4C,OAC5C,MACqD;CACrD,MAAM,aAAa,IAAI,iBAAiB;CACxC,MAAM,UAAU,iBAAiB,WAAW,OAAO,EAAE,cAAc;AAEnE,KAAI;EAUF,MAAM,OAAO,OATA,MAAM,MAAM,GAAG,SAAS,QAAQ;GAC3C;GACA,SAAS;IACP,eAAe,UAAU;IACzB,gBAAgB;IACjB;GACD,MAAM,OAAO,KAAK,UAAU,KAAK,GAAG,KAAA;GACpC,QAAQ,WAAW;GACpB,CAAC,EACsB,MAAM;AAC9B,SAAO;GAAE,IAAI,KAAK,YAAY;GAAO,MAAM,KAAK;GAAQ,QAAQ,KAAK;GAAQ;UACtE,KAAU;AACjB,SAAO;GAAE,IAAI;GAAO,MAAM;GAAM,QAAQ,CAAC,EAAE,SAAS,IAAI,SAAS,CAAC;GAAE;WAC5D;AACR,eAAa,QAAQ;;;;;;AAOzB,SAAS,iBACP,WACA,cAC4E;AAC5E,QAAO,UAAU,KAAI,OAAM;EACzB,UAAU,oBAAoB,EAAE,SAAS,aAAa;EACtD,gBAAgB,EAAE,mBAAmB,oBAAoB,EAAE,kBAAkB,aAAa,GAAG,KAAA;EAC7F,aAAa,EAAE,kBAAkB;EAClC,EAAE;;;;;;AAOL,eAAsB,iBACpB,QACA,cACuB;CACvB,MAAM,QAAkB,EAAE;CAC1B,IAAI,QAAQ;CAGZ,MAAM,QAAQ,0BAA0B,OAAO,iBAAiB;AAChE,KAAI,CAAC,MACH,QAAO;EAAE,SAAS;EAAO,OAAO,CAAC,yDAAyD,OAAO,iBAAiB;EAAE;AAEtH,OAAM,KAAK,uCAAuC;CAElD,MAAM,WAAW,iBAAiB,OAAO,WAAW,aAAa;CAGjE,MAAM,aAAa,aAAa,MAAM,UAAU,cAAc,OAAO,UAAU;CAC/E,MAAM,UAAU,MAAM,QAAQ,YAAY,MAAM,SAAS;AACzD,KAAI,CAAC,QAAQ,GACX,QAAO;EAAE,SAAS;EAAO,OAAO,CAAC,GAAG,OAAO,yCAAyC,KAAK,UAAU,QAAQ,OAAO,GAAG;EAAE;CAIzH,MAAM,UADuC,QAAQ,KACC,QAAQ,WAAW,EAAE;AAC3E,OAAM,KAAK,sCAAsC,QAAQ,OAAO,gBAAgB;CAGhF,IAAI,WAAW;AACf,MAAK,MAAM,KAAK,UAAU;AAExB,MAAI,QAAQ,MAAK,MAAK,EAAE,aAAa,EAAE,SAAS,EAAE;AAChD,SAAM,KAAK,6BAA6B,EAAE,SAAS,2BAA2B;AAC9E;;EAGF,MAAM,gBAAyC,EAAE;AACjD,MAAI,EAAE,YAAa,eAAc,cAAc;AAC/C,MAAI,EAAE,eAAgB,eAAc,iBAAiB,EAAE;EAEvD,MAAM,UAAiC;GACrC,SAAS,OAAO;GAChB,UAAU,EAAE;GACZ,eAAe,OAAO,KAAK,cAAc,CAAC,SAAS,IAAI,gBAAgB,KAAA;GACxE;EAGD,MAAM,cAAc,QAAQ,WAAU,MAAK,CAAC,EAAE,SAAS;AACvD,MAAI,eAAe,EACjB,SAAQ,OAAO,aAAa,GAAG,QAAQ;MAEvC,SAAQ,KAAK,QAAQ;AAEvB,aAAW;AACX,QAAM,KAAK,mCAAmC,EAAE,WAAW;;AAI7D,KAAI,UAAU;EACZ,MAAM,YAAY,MAAM,QAAQ,YAAY,MAAM,UAAU,OAAO,EACjE,QAAQ,EAAE,SAAS,EACpB,CAAC;AACF,MAAI,CAAC,UAAU,IAAI;AACjB,SAAM,KAAK,4CAA4C,KAAK,UAAU,UAAU,OAAO,GAAG;AAC1F,WAAQ;QAER,OAAM,KAAK,gDAAgD;;AAK/D,MAAK,MAAM,KAAK,UAAU;EACxB,MAAM,YAAY,MAAM,QACtB,UAAU,MAAM,OAAO,eACvB,MAAM,UACN,QACA;GACE,MAAM;GACN,MAAM,EAAE;GACR,SAAS,GAAG,OAAO,UAAU;GAC7B,SAAS;GACV,CACF;AACD,MAAI,CAAC,UAAU,IAAI;GACjB,MAAM,SAAS,UAAU,QAAQ,KAAK,MAAW,EAAE,QAAQ,CAAC,KAAK,KAAK,IAAI;AAE1E,OAAI,OAAO,SAAS,iBAAiB,IAAI,OAAO,SAAS,qBAAqB,CAC5E,OAAM,KAAK,0BAA0B,EAAE,SAAS,iBAAiB;QAC5D;AACL,UAAM,KAAK,2CAA2C,EAAE,SAAS,IAAI,SAAS;AAC9E,YAAQ;;QAGV,OAAM,KAAK,+BAA+B,EAAE,SAAS,KAAK,OAAO,UAAU,mBAAmB;;AAIlG,QAAO;EAAE,SAAS;EAAO;EAAO;;;;;;AAOlC,eAAsB,oBACpB,QACA,cACuB;CACvB,MAAM,QAAkB,EAAE;CAC1B,IAAI,QAAQ;CAGZ,MAAM,QAAQ,0BAA0B,OAAO,iBAAiB;AAChE,KAAI,CAAC,MACH,QAAO;EAAE,SAAS;EAAO,OAAO,CAAC,yDAAyD,OAAO,iBAAiB;EAAE;AAEtH,OAAM,KAAK,uCAAuC;CAElD,MAAM,WAAW,iBAAiB,OAAO,WAAW,aAAa;CACjE,MAAM,cAAc,IAAI,IAAI,SAAS,KAAI,MAAK,EAAE,SAAS,CAAC;CAG1D,MAAM,aAAa,aAAa,MAAM,UAAU,cAAc,OAAO,UAAU;CAC/E,MAAM,UAAU,MAAM,QAAQ,YAAY,MAAM,SAAS;AACzD,KAAI,CAAC,QAAQ,IAAI;AACf,QAAM,KAAK,yCAAyC,KAAK,UAAU,QAAQ,OAAO,GAAG;AAErF,UAAQ;QACH;EAEL,MAAM,UADuC,QAAQ,KACC,QAAQ,WAAW,EAAE;EAC3E,MAAM,gBAAgB,QAAQ;EAG9B,MAAM,WAAW,QAAQ,QAAO,MAAK,CAAC,EAAE,YAAY,CAAC,YAAY,IAAI,EAAE,SAAS,CAAC;AAEjF,MAAI,SAAS,SAAS,eAAe;GACnC,MAAM,YAAY,MAAM,QAAQ,YAAY,MAAM,UAAU,OAAO,EACjE,QAAQ,EAAE,SAAS,UAAU,EAC9B,CAAC;AACF,OAAI,CAAC,UAAU,IAAI;AACjB,UAAM,KAAK,4CAA4C,KAAK,UAAU,UAAU,OAAO,GAAG;AAC1F,YAAQ;SAER,OAAM,KAAK,oBAAoB,gBAAgB,SAAS,OAAO,kBAAkB;QAGnF,OAAM,KAAK,qDAAqD;;AAKpE,MAAK,MAAM,KAAK,UAAU;EAExB,MAAM,aAAa,MAAM,QACvB,UAAU,MAAM,OAAO,oBAAoB,mBAAmB,EAAE,SAAS,CAAC,cAC1E,MAAM,SACP;AACD,MAAI,CAAC,WAAW,IAAI;AAClB,SAAM,KAAK,6CAA6C,EAAE,SAAS,IAAI,KAAK,UAAU,WAAW,OAAO,GAAG;AAC3G,WAAQ;AACR;;EAGF,MAAM,UAAU,MAAM,QAAQ,WAAW,KAAK,GAAG,WAAW,OAAO,EAAE;AACrE,MAAI,QAAQ,WAAW,GAAG;AACxB,SAAM,KAAK,0CAA0C,EAAE,WAAW;AAClE;;AAGF,OAAK,MAAM,UAAU,SAAS;GAC5B,MAAM,YAAY,MAAM,QACtB,UAAU,MAAM,OAAO,eAAe,OAAO,MAC7C,MAAM,UACN,SACD;AACD,OAAI,CAAC,UAAU,IAAI;AACjB,UAAM,KAAK,wCAAwC,OAAO,GAAG,OAAO,EAAE,SAAS,IAAI,KAAK,UAAU,UAAU,OAAO,GAAG;AACtH,YAAQ;SAER,OAAM,KAAK,kCAAkC,EAAE,WAAW;;;AAKhE,QAAO;EAAE,SAAS;EAAO;EAAO;;;;wBA9R8E;AAyB1G,UAAS;AACT,iBAAgB"}
+{"version":3,"file":"tunnel-DzXEPwIc.js","names":[],"sources":["../src/lib/tunnel.ts"],"sourcesContent":["/**\n * Cloudflare Tunnel Management\n *\n * Manages tunnel ingress rules and DNS CNAME records for workspace lifecycle.\n * Called during workspace create (addTunnelIngress) and workspace remove/deep-wipe (removeTunnelIngress).\n */\n\nimport { readFileSync } from 'fs';\nimport { resolve } from 'path';\nimport { homedir } from 'os';\nimport { TunnelConfig, TunnelHostname, TemplatePlaceholders, replacePlaceholders } from './workspace-config.js';\n\nexport interface TunnelResult {\n  success: boolean;\n  steps: string[];\n}\n\ninterface CloudflareCredentials {\n  apiToken: string;\n  accountId: string;\n  zoneId: string;\n}\n\ninterface CloudflareIngressRule {\n  service: string;\n  hostname?: string;\n  originRequest?: Record<string, unknown>;\n}\n\ninterface CloudflareTunnelConfig {\n  config: {\n    ingress: CloudflareIngressRule[];\n  };\n}\n\nconst CF_API = 'https://api.cloudflare.com/client/v4';\nconst FETCH_TIMEOUT = 10_000;\n\n/**\n * Read API token from Cloudflare cert.pem file.\n * The cert.pem contains a PEM-wrapped base64 JSON blob with { zoneID, accountID, apiToken }.\n */\nfunction readCloudflareCredentials(certPath: string): CloudflareCredentials | null {\n  try {\n    const resolvedPath = certPath.replace(/^~/, homedir());\n    const pem = readFileSync(resolve(resolvedPath), 'utf-8');\n    // Strip PEM headers/trailers and decode\n    const b64 = pem\n      .split('\\n')\n      .filter(line => !line.startsWith('-----'))\n      .join('');\n    const json = JSON.parse(Buffer.from(b64, 'base64').toString('utf-8'));\n    return {\n      apiToken: json.apiToken,\n      accountId: json.accountID,\n      zoneId: json.zoneID,\n    };\n  } catch (err) {\n    return null;\n  }\n}\n\n/**\n * Make an authenticated Cloudflare API request.\n */\nasync function cfFetch(\n  path: string,\n  apiToken: string,\n  method: 'GET' | 'POST' | 'PUT' | 'DELETE' = 'GET',\n  body?: unknown,\n): Promise<{ ok: boolean; data: any; errors?: any[] }> {\n  const controller = new AbortController();\n  const timeout = setTimeout(() => controller.abort(), FETCH_TIMEOUT);\n\n  try {\n    const resp = await fetch(`${CF_API}${path}`, {\n      method,\n      headers: {\n        Authorization: `Bearer ${apiToken}`,\n        'Content-Type': 'application/json',\n      },\n      body: body ? JSON.stringify(body) : undefined,\n      signal: controller.signal,\n    });\n    const json = await resp.json() as any;\n    return { ok: json.success !== false, data: json.result, errors: json.errors };\n  } catch (err: any) {\n    return { ok: false, data: null, errors: [{ message: err.message }] };\n  } finally {\n    clearTimeout(timeout);\n  }\n}\n\n/**\n * Resolve hostnames from config, replacing template placeholders.\n */\nfunction resolveHostnames(\n  hostnames: TunnelHostname[],\n  placeholders: TemplatePlaceholders,\n): Array<{ hostname: string; httpHostHeader?: string; noTlsVerify: boolean }> {\n  return hostnames.map(h => ({\n    hostname: replacePlaceholders(h.pattern, placeholders),\n    httpHostHeader: h.http_host_header ? replacePlaceholders(h.http_host_header, placeholders) : undefined,\n    noTlsVerify: h.no_tls_verify !== false, // default true\n  }));\n}\n\n/**\n * Add tunnel ingress rules and DNS CNAME records for a workspace.\n * Called during workspace creation.\n */\nexport async function addTunnelIngress(\n  config: TunnelConfig,\n  placeholders: TemplatePlaceholders,\n): Promise<TunnelResult> {\n  const steps: string[] = [];\n  let allOk = true;\n\n  // Read credentials\n  const creds = readCloudflareCredentials(config.credentials_file);\n  if (!creds) {\n    return { success: false, steps: ['[tunnel] Failed to read Cloudflare credentials from ' + config.credentials_file] };\n  }\n  steps.push('[tunnel] Read Cloudflare credentials');\n\n  const resolved = resolveHostnames(config.hostnames, placeholders);\n\n  // Get current tunnel configuration\n  const tunnelPath = `/accounts/${creds.accountId}/cfd_tunnel/${config.tunnel_id}/configurations`;\n  const current = await cfFetch(tunnelPath, creds.apiToken);\n  if (!current.ok) {\n    return { success: false, steps: [...steps, `[tunnel] Failed to get tunnel config: ${JSON.stringify(current.errors)}`] };\n  }\n\n  const tunnelConfig: CloudflareTunnelConfig = current.data;\n  const ingress: CloudflareIngressRule[] = tunnelConfig.config?.ingress || [];\n  steps.push(`[tunnel] Current tunnel config has ${ingress.length} ingress rules`);\n\n  // Add new ingress rules (before the catch-all)\n  let modified = false;\n  for (const h of resolved) {\n    // Skip if rule already exists\n    if (ingress.some(r => r.hostname === h.hostname)) {\n      steps.push(`[tunnel] Ingress rule for ${h.hostname} already exists, skipping`);\n      continue;\n    }\n\n    const originRequest: Record<string, unknown> = {};\n    if (h.noTlsVerify) originRequest.noTLSVerify = true;\n    if (h.httpHostHeader) originRequest.httpHostHeader = h.httpHostHeader;\n\n    const newRule: CloudflareIngressRule = {\n      service: config.service_target,\n      hostname: h.hostname,\n      originRequest: Object.keys(originRequest).length > 0 ? originRequest : undefined,\n    };\n\n    // Insert before the last rule (catch-all has no hostname)\n    const catchAllIdx = ingress.findIndex(r => !r.hostname);\n    if (catchAllIdx >= 0) {\n      ingress.splice(catchAllIdx, 0, newRule);\n    } else {\n      ingress.push(newRule);\n    }\n    modified = true;\n    steps.push(`[tunnel] Added ingress rule for ${h.hostname}`);\n  }\n\n  // Push updated tunnel config\n  if (modified) {\n    const putResult = await cfFetch(tunnelPath, creds.apiToken, 'PUT', {\n      config: { ingress },\n    });\n    if (!putResult.ok) {\n      steps.push(`[tunnel] Failed to update tunnel config: ${JSON.stringify(putResult.errors)}`);\n      allOk = false;\n    } else {\n      steps.push('[tunnel] Updated tunnel ingress configuration');\n    }\n  }\n\n  // Create DNS CNAME records\n  for (const h of resolved) {\n    const dnsResult = await cfFetch(\n      `/zones/${creds.zoneId}/dns_records`,\n      creds.apiToken,\n      'POST',\n      {\n        type: 'CNAME',\n        name: h.hostname,\n        content: `${config.tunnel_id}.cfargotunnel.com`,\n        proxied: true,\n      },\n    );\n    if (!dnsResult.ok) {\n      const errMsg = dnsResult.errors?.map((e: any) => e.message).join(', ') || 'unknown error';\n      // Record already exists is not a failure\n      if (errMsg.includes('already exists') || errMsg.includes('already been taken')) {\n        steps.push(`[tunnel] DNS CNAME for ${h.hostname} already exists`);\n      } else {\n        steps.push(`[tunnel] Failed to create DNS CNAME for ${h.hostname}: ${errMsg}`);\n        allOk = false;\n      }\n    } else {\n      steps.push(`[tunnel] Created DNS CNAME: ${h.hostname} → ${config.tunnel_id}.cfargotunnel.com`);\n    }\n  }\n\n  return { success: allOk, steps };\n}\n\n/**\n * Remove tunnel ingress rules and DNS CNAME records for a workspace.\n * Called during workspace removal and deep-wipe.\n */\nexport async function removeTunnelIngress(\n  config: TunnelConfig,\n  placeholders: TemplatePlaceholders,\n): Promise<TunnelResult> {\n  const steps: string[] = [];\n  let allOk = true;\n\n  // Read credentials\n  const creds = readCloudflareCredentials(config.credentials_file);\n  if (!creds) {\n    return { success: false, steps: ['[tunnel] Failed to read Cloudflare credentials from ' + config.credentials_file] };\n  }\n  steps.push('[tunnel] Read Cloudflare credentials');\n\n  const resolved = resolveHostnames(config.hostnames, placeholders);\n  const hostnameSet = new Set(resolved.map(h => h.hostname));\n\n  // Get current tunnel configuration\n  const tunnelPath = `/accounts/${creds.accountId}/cfd_tunnel/${config.tunnel_id}/configurations`;\n  const current = await cfFetch(tunnelPath, creds.apiToken);\n  if (!current.ok) {\n    steps.push(`[tunnel] Failed to get tunnel config: ${JSON.stringify(current.errors)}`);\n    // Continue to attempt DNS cleanup even if tunnel config read fails\n    allOk = false;\n  } else {\n    const tunnelConfig: CloudflareTunnelConfig = current.data;\n    const ingress: CloudflareIngressRule[] = tunnelConfig.config?.ingress || [];\n    const originalCount = ingress.length;\n\n    // Filter out matching ingress rules\n    const filtered = ingress.filter(r => !r.hostname || !hostnameSet.has(r.hostname));\n\n    if (filtered.length < originalCount) {\n      const putResult = await cfFetch(tunnelPath, creds.apiToken, 'PUT', {\n        config: { ingress: filtered },\n      });\n      if (!putResult.ok) {\n        steps.push(`[tunnel] Failed to update tunnel config: ${JSON.stringify(putResult.errors)}`);\n        allOk = false;\n      } else {\n        steps.push(`[tunnel] Removed ${originalCount - filtered.length} ingress rule(s)`);\n      }\n    } else {\n      steps.push('[tunnel] No matching ingress rules found to remove');\n    }\n  }\n\n  // Remove DNS CNAME records\n  for (const h of resolved) {\n    // Find the DNS record\n    const listResult = await cfFetch(\n      `/zones/${creds.zoneId}/dns_records?name=${encodeURIComponent(h.hostname)}&type=CNAME`,\n      creds.apiToken,\n    );\n    if (!listResult.ok) {\n      steps.push(`[tunnel] Failed to look up DNS record for ${h.hostname}: ${JSON.stringify(listResult.errors)}`);\n      allOk = false;\n      continue;\n    }\n\n    const records = Array.isArray(listResult.data) ? listResult.data : [];\n    if (records.length === 0) {\n      steps.push(`[tunnel] No DNS CNAME record found for ${h.hostname}`);\n      continue;\n    }\n\n    for (const record of records) {\n      const delResult = await cfFetch(\n        `/zones/${creds.zoneId}/dns_records/${record.id}`,\n        creds.apiToken,\n        'DELETE',\n      );\n      if (!delResult.ok) {\n        steps.push(`[tunnel] Failed to delete DNS record ${record.id} for ${h.hostname}: ${JSON.stringify(delResult.errors)}`);\n        allOk = false;\n      } else {\n        steps.push(`[tunnel] Deleted DNS CNAME for ${h.hostname}`);\n      }\n    }\n  }\n\n  return { success: allOk, steps };\n}\n"],"mappings":";;;;;;;;;;;;;;;;AA0CA,SAAS,0BAA0B,UAAgD;AACjF,KAAI;EAIF,MAAM,MAFM,aAAa,QADJ,SAAS,QAAQ,MAAM,SAAS,CAAC,CACR,EAAE,QAAQ,CAGrD,MAAM,KAAK,CACX,QAAO,SAAQ,CAAC,KAAK,WAAW,QAAQ,CAAC,CACzC,KAAK,GAAG;EACX,MAAM,OAAO,KAAK,MAAM,OAAO,KAAK,KAAK,SAAS,CAAC,SAAS,QAAQ,CAAC;AACrE,SAAO;GACL,UAAU,KAAK;GACf,WAAW,KAAK;GAChB,QAAQ,KAAK;GACd;UACM,KAAK;AACZ,SAAO;;;;;;AAOX,eAAe,QACb,MACA,UACA,SAA4C,OAC5C,MACqD;CACrD,MAAM,aAAa,IAAI,iBAAiB;CACxC,MAAM,UAAU,iBAAiB,WAAW,OAAO,EAAE,cAAc;AAEnE,KAAI;EAUF,MAAM,OAAO,OATA,MAAM,MAAM,GAAG,SAAS,QAAQ;GAC3C;GACA,SAAS;IACP,eAAe,UAAU;IACzB,gBAAgB;IACjB;GACD,MAAM,OAAO,KAAK,UAAU,KAAK,GAAG,KAAA;GACpC,QAAQ,WAAW;GACpB,CAAC,EACsB,MAAM;AAC9B,SAAO;GAAE,IAAI,KAAK,YAAY;GAAO,MAAM,KAAK;GAAQ,QAAQ,KAAK;GAAQ;UACtE,KAAU;AACjB,SAAO;GAAE,IAAI;GAAO,MAAM;GAAM,QAAQ,CAAC,EAAE,SAAS,IAAI,SAAS,CAAC;GAAE;WAC5D;AACR,eAAa,QAAQ;;;;;;AAOzB,SAAS,iBACP,WACA,cAC4E;AAC5E,QAAO,UAAU,KAAI,OAAM;EACzB,UAAU,oBAAoB,EAAE,SAAS,aAAa;EACtD,gBAAgB,EAAE,mBAAmB,oBAAoB,EAAE,kBAAkB,aAAa,GAAG,KAAA;EAC7F,aAAa,EAAE,kBAAkB;EAClC,EAAE;;;;;;AAOL,eAAsB,iBACpB,QACA,cACuB;CACvB,MAAM,QAAkB,EAAE;CAC1B,IAAI,QAAQ;CAGZ,MAAM,QAAQ,0BAA0B,OAAO,iBAAiB;AAChE,KAAI,CAAC,MACH,QAAO;EAAE,SAAS;EAAO,OAAO,CAAC,yDAAyD,OAAO,iBAAiB;EAAE;AAEtH,OAAM,KAAK,uCAAuC;CAElD,MAAM,WAAW,iBAAiB,OAAO,WAAW,aAAa;CAGjE,MAAM,aAAa,aAAa,MAAM,UAAU,cAAc,OAAO,UAAU;CAC/E,MAAM,UAAU,MAAM,QAAQ,YAAY,MAAM,SAAS;AACzD,KAAI,CAAC,QAAQ,GACX,QAAO;EAAE,SAAS;EAAO,OAAO,CAAC,GAAG,OAAO,yCAAyC,KAAK,UAAU,QAAQ,OAAO,GAAG;EAAE;CAIzH,MAAM,UADuC,QAAQ,KACC,QAAQ,WAAW,EAAE;AAC3E,OAAM,KAAK,sCAAsC,QAAQ,OAAO,gBAAgB;CAGhF,IAAI,WAAW;AACf,MAAK,MAAM,KAAK,UAAU;AAExB,MAAI,QAAQ,MAAK,MAAK,EAAE,aAAa,EAAE,SAAS,EAAE;AAChD,SAAM,KAAK,6BAA6B,EAAE,SAAS,2BAA2B;AAC9E;;EAGF,MAAM,gBAAyC,EAAE;AACjD,MAAI,EAAE,YAAa,eAAc,cAAc;AAC/C,MAAI,EAAE,eAAgB,eAAc,iBAAiB,EAAE;EAEvD,MAAM,UAAiC;GACrC,SAAS,OAAO;GAChB,UAAU,EAAE;GACZ,eAAe,OAAO,KAAK,cAAc,CAAC,SAAS,IAAI,gBAAgB,KAAA;GACxE;EAGD,MAAM,cAAc,QAAQ,WAAU,MAAK,CAAC,EAAE,SAAS;AACvD,MAAI,eAAe,EACjB,SAAQ,OAAO,aAAa,GAAG,QAAQ;MAEvC,SAAQ,KAAK,QAAQ;AAEvB,aAAW;AACX,QAAM,KAAK,mCAAmC,EAAE,WAAW;;AAI7D,KAAI,UAAU;EACZ,MAAM,YAAY,MAAM,QAAQ,YAAY,MAAM,UAAU,OAAO,EACjE,QAAQ,EAAE,SAAS,EACpB,CAAC;AACF,MAAI,CAAC,UAAU,IAAI;AACjB,SAAM,KAAK,4CAA4C,KAAK,UAAU,UAAU,OAAO,GAAG;AAC1F,WAAQ;QAER,OAAM,KAAK,gDAAgD;;AAK/D,MAAK,MAAM,KAAK,UAAU;EACxB,MAAM,YAAY,MAAM,QACtB,UAAU,MAAM,OAAO,eACvB,MAAM,UACN,QACA;GACE,MAAM;GACN,MAAM,EAAE;GACR,SAAS,GAAG,OAAO,UAAU;GAC7B,SAAS;GACV,CACF;AACD,MAAI,CAAC,UAAU,IAAI;GACjB,MAAM,SAAS,UAAU,QAAQ,KAAK,MAAW,EAAE,QAAQ,CAAC,KAAK,KAAK,IAAI;AAE1E,OAAI,OAAO,SAAS,iBAAiB,IAAI,OAAO,SAAS,qBAAqB,CAC5E,OAAM,KAAK,0BAA0B,EAAE,SAAS,iBAAiB;QAC5D;AACL,UAAM,KAAK,2CAA2C,EAAE,SAAS,IAAI,SAAS;AAC9E,YAAQ;;QAGV,OAAM,KAAK,+BAA+B,EAAE,SAAS,KAAK,OAAO,UAAU,mBAAmB;;AAIlG,QAAO;EAAE,SAAS;EAAO;EAAO;;;;;;AAOlC,eAAsB,oBACpB,QACA,cACuB;CACvB,MAAM,QAAkB,EAAE;CAC1B,IAAI,QAAQ;CAGZ,MAAM,QAAQ,0BAA0B,OAAO,iBAAiB;AAChE,KAAI,CAAC,MACH,QAAO;EAAE,SAAS;EAAO,OAAO,CAAC,yDAAyD,OAAO,iBAAiB;EAAE;AAEtH,OAAM,KAAK,uCAAuC;CAElD,MAAM,WAAW,iBAAiB,OAAO,WAAW,aAAa;CACjE,MAAM,cAAc,IAAI,IAAI,SAAS,KAAI,MAAK,EAAE,SAAS,CAAC;CAG1D,MAAM,aAAa,aAAa,MAAM,UAAU,cAAc,OAAO,UAAU;CAC/E,MAAM,UAAU,MAAM,QAAQ,YAAY,MAAM,SAAS;AACzD,KAAI,CAAC,QAAQ,IAAI;AACf,QAAM,KAAK,yCAAyC,KAAK,UAAU,QAAQ,OAAO,GAAG;AAErF,UAAQ;QACH;EAEL,MAAM,UADuC,QAAQ,KACC,QAAQ,WAAW,EAAE;EAC3E,MAAM,gBAAgB,QAAQ;EAG9B,MAAM,WAAW,QAAQ,QAAO,MAAK,CAAC,EAAE,YAAY,CAAC,YAAY,IAAI,EAAE,SAAS,CAAC;AAEjF,MAAI,SAAS,SAAS,eAAe;GACnC,MAAM,YAAY,MAAM,QAAQ,YAAY,MAAM,UAAU,OAAO,EACjE,QAAQ,EAAE,SAAS,UAAU,EAC9B,CAAC;AACF,OAAI,CAAC,UAAU,IAAI;AACjB,UAAM,KAAK,4CAA4C,KAAK,UAAU,UAAU,OAAO,GAAG;AAC1F,YAAQ;SAER,OAAM,KAAK,oBAAoB,gBAAgB,SAAS,OAAO,kBAAkB;QAGnF,OAAM,KAAK,qDAAqD;;AAKpE,MAAK,MAAM,KAAK,UAAU;EAExB,MAAM,aAAa,MAAM,QACvB,UAAU,MAAM,OAAO,oBAAoB,mBAAmB,EAAE,SAAS,CAAC,cAC1E,MAAM,SACP;AACD,MAAI,CAAC,WAAW,IAAI;AAClB,SAAM,KAAK,6CAA6C,EAAE,SAAS,IAAI,KAAK,UAAU,WAAW,OAAO,GAAG;AAC3G,WAAQ;AACR;;EAGF,MAAM,UAAU,MAAM,QAAQ,WAAW,KAAK,GAAG,WAAW,OAAO,EAAE;AACrE,MAAI,QAAQ,WAAW,GAAG;AACxB,SAAM,KAAK,0CAA0C,EAAE,WAAW;AAClE;;AAGF,OAAK,MAAM,UAAU,SAAS;GAC5B,MAAM,YAAY,MAAM,QACtB,UAAU,MAAM,OAAO,eAAe,OAAO,MAC7C,MAAM,UACN,SACD;AACD,OAAI,CAAC,UAAU,IAAI;AACjB,UAAM,KAAK,wCAAwC,OAAO,GAAG,OAAO,EAAE,SAAS,IAAI,KAAK,UAAU,UAAU,OAAO,GAAG;AACtH,YAAQ;SAER,OAAM,KAAK,kCAAkC,EAAE,WAAW;;;AAKhE,QAAO;EAAE,SAAS;EAAO;EAAO;;;;wBA9R8E;AAyB1G,UAAS;AACT,iBAAgB"}

package/dist/{types-DewGdaIP.js → types-BhJj1SP1.js}

@@ -52,4 +52,4 @@ function getLinearApiKey() {
 //#endregion
 export { stepSkipped as i, stepFailed as n, stepOk as r, getLinearApiKey as t };
 
-//# sourceMappingURL=types-DewGdaIP.js.map
+//# sourceMappingURL=types-BhJj1SP1.js.map

package/dist/{types-DewGdaIP.js.map → types-BhJj1SP1.js.map}

@@ -1 +1 @@
-{"version":3,"file":"types-DewGdaIP.js","names":[],"sources":["../src/lib/lifecycle/types.ts"],"sourcesContent":["/**\n * Shared types for lifecycle operations.\n *\n * Every atomic operation returns a StepResult. Workflows compose\n * multiple operations and return a WorkflowResult.\n */\n\nimport { existsSync, readFileSync } from 'fs';\nimport { join } from 'path';\nimport { homedir } from 'os';\n\nexport interface StepResult {\n  step: string;\n  success: boolean;\n  skipped: boolean;     // true if operation was a no-op (idempotent)\n  error?: string;\n  details?: string[];   // human-readable log of what was done\n}\n\nexport interface WorkflowResult {\n  workflow: 'approve' | 'close' | 'close-out' | 'deep-wipe';\n  issueId: string;\n  success: boolean;     // true only if ALL non-skipped steps succeeded\n  steps: StepResult[];\n  duration: number;     // ms\n}\n\n/** Context shared across lifecycle operations */\nexport interface LifecycleContext {\n  issueId: string;\n  projectPath: string;\n  /** Project name (for Docker compose project naming + placeholders) */\n  projectName?: string;\n  /** GitHub issue metadata (populated for PAN- issues) */\n  github?: {\n    owner: string;\n    repo: string;\n    number: number;\n  };\n  /** Rally configuration (populated for Rally-tracked issues) */\n  rally?: {\n    apiKey: string;\n    server?: string;\n    workspace?: string;\n    project?: string;\n  };\n}\n\n/** Options for teardown-workspace */\nexport interface TeardownOptions {\n  /** Delete feature branches (local + remote). Default: false */\n  deleteBranches?: boolean;\n  /** Skip Docker container cleanup. Default: false */\n  skipDocker?: boolean;\n  /** Delete workspace directory (worktree + files). Default: true */\n  deleteWorkspace?: boolean;\n  /** Clear beads for this issue from project root. Default: false.\n   *  Only set to true for destructive wipe — normal completion should preserve beads. */\n  clearBeads?: boolean;\n  /** Project-specific workspace config for tunnel/Hume cleanup */\n  workspaceConfig?: {\n    tunnel?: any;\n    hume?: any;\n    dns?: { domain?: string };\n  };\n  /** Project name (for Docker compose project naming + placeholders) */\n  projectName?: string;\n}\n\n/** Options for archive-planning */\nexport interface ArchiveOptions {\n  /** Push git commits to remote after archiving. Default: true */\n  pushToRemote?: boolean;\n}\n\n/** Options for the approve workflow */\nexport interface ApproveOptions {\n  /** Skip the merge step (e.g. if already merged). Default: false */\n  skipMerge?: boolean;\n  /** Skip beads compaction. Default: false */\n  skipBeadsCompaction?: boolean;\n}\n\n/** Options for the deep-wipe workflow */\n/** Progress event emitted during deep-wipe. */\nexport interface DeepWipeProgress {\n  step: number;\n  total: number;\n  label: string;\n  detail: string;\n  status: 'active' | 'complete' | 'error';\n}\n\nexport interface DeepWipeOptions {\n  /** Delete workspace directory. Default: true */\n  deleteWorkspace?: boolean;\n  /** Delete git branches (local + remote). Default: true */\n  deleteBranches?: boolean;\n  /** Reset issue to backlog/open state. Default: true */\n  resetIssue?: boolean;\n  /** Project-specific workspace config for tunnel/Hume cleanup */\n  workspaceConfig?: {\n    tunnel?: any;\n    hume?: any;\n    dns?: { domain?: string };\n  };\n  /** Project name (for Docker compose project naming + placeholders) */\n  projectName?: string;\n  /** Optional callback for streaming progress events to the client. */\n  onProgress?: (event: DeepWipeProgress) => void;\n}\n\n/** Helper to create a successful step result */\nexport function stepOk(step: string, details?: string[]): StepResult {\n  return { step, success: true, skipped: false, details };\n}\n\n/** Helper to create a skipped step result */\nexport function stepSkipped(step: string, details?: string[]): StepResult {\n  return { step, success: true, skipped: true, details };\n}\n\n/** Helper to create a failed step result */\nexport function stepFailed(step: string, error: string, details?: string[]): StepResult {\n  return { step, success: false, skipped: false, error, details };\n}\n\n/**\n * Get LINEAR_API_KEY from environment or .panopticon.env.\n * Shared across lifecycle modules.\n */\nexport function getLinearApiKey(): string | null {\n  if (process.env.LINEAR_API_KEY) return process.env.LINEAR_API_KEY;\n  const envFile = join(homedir(), '.panopticon.env');\n  if (existsSync(envFile)) {\n    const content = readFileSync(envFile, 'utf-8');\n    const match = content.match(/LINEAR_API_KEY=(.+)/);\n    if (match) return match[1].trim();\n  }\n  return null;\n}\n"],"mappings":";;;;;;;;;;;AAiHA,SAAgB,OAAO,MAAc,SAAgC;AACnE,QAAO;EAAE;EAAM,SAAS;EAAM,SAAS;EAAO;EAAS;;;AAIzD,SAAgB,YAAY,MAAc,SAAgC;AACxE,QAAO;EAAE;EAAM,SAAS;EAAM,SAAS;EAAM;EAAS;;;AAIxD,SAAgB,WAAW,MAAc,OAAe,SAAgC;AACtF,QAAO;EAAE;EAAM,SAAS;EAAO,SAAS;EAAO;EAAO;EAAS;;;;;;AAOjE,SAAgB,kBAAiC;AAC/C,KAAI,QAAQ,IAAI,eAAgB,QAAO,QAAQ,IAAI;CACnD,MAAM,UAAU,KAAK,SAAS,EAAE,kBAAkB;AAClD,KAAI,WAAW,QAAQ,EAAE;EAEvB,MAAM,QADU,aAAa,SAAS,QAAQ,CACxB,MAAM,sBAAsB;AAClD,MAAI,MAAO,QAAO,MAAM,GAAG,MAAM;;AAEnC,QAAO"}
+{"version":3,"file":"types-BhJj1SP1.js","names":[],"sources":["../src/lib/lifecycle/types.ts"],"sourcesContent":["/**\n * Shared types for lifecycle operations.\n *\n * Every atomic operation returns a StepResult. Workflows compose\n * multiple operations and return a WorkflowResult.\n */\n\nimport { existsSync, readFileSync } from 'fs';\nimport { join } from 'path';\nimport { homedir } from 'os';\n\nexport interface StepResult {\n  step: string;\n  success: boolean;\n  skipped: boolean;     // true if operation was a no-op (idempotent)\n  error?: string;\n  details?: string[];   // human-readable log of what was done\n}\n\nexport interface WorkflowResult {\n  workflow: 'approve' | 'close' | 'close-out' | 'deep-wipe';\n  issueId: string;\n  success: boolean;     // true only if ALL non-skipped steps succeeded\n  steps: StepResult[];\n  duration: number;     // ms\n}\n\n/** Context shared across lifecycle operations */\nexport interface LifecycleContext {\n  issueId: string;\n  projectPath: string;\n  /** Project name (for Docker compose project naming + placeholders) */\n  projectName?: string;\n  /** GitHub issue metadata (populated for PAN- issues) */\n  github?: {\n    owner: string;\n    repo: string;\n    number: number;\n  };\n  /** Rally configuration (populated for Rally-tracked issues) */\n  rally?: {\n    apiKey: string;\n    server?: string;\n    workspace?: string;\n    project?: string;\n  };\n}\n\n/** Options for teardown-workspace */\nexport interface TeardownOptions {\n  /** Delete feature branches (local + remote). Default: false */\n  deleteBranches?: boolean;\n  /** Skip Docker container cleanup. Default: false */\n  skipDocker?: boolean;\n  /** Delete workspace directory (worktree + files). Default: true */\n  deleteWorkspace?: boolean;\n  /** Clear beads for this issue from project root. Default: false.\n   *  Only set to true for destructive wipe — normal completion should preserve beads. */\n  clearBeads?: boolean;\n  /** Project-specific workspace config for tunnel/Hume cleanup */\n  workspaceConfig?: {\n    tunnel?: any;\n    hume?: any;\n    dns?: { domain?: string };\n  };\n  /** Project name (for Docker compose project naming + placeholders) */\n  projectName?: string;\n}\n\n/** Options for archive-planning */\nexport interface ArchiveOptions {\n  /** Push git commits to remote after archiving. Default: true */\n  pushToRemote?: boolean;\n}\n\n/** Options for the approve workflow */\nexport interface ApproveOptions {\n  /** Skip the merge step (e.g. if already merged). Default: false */\n  skipMerge?: boolean;\n  /** Skip beads compaction. Default: false */\n  skipBeadsCompaction?: boolean;\n}\n\n/** Options for the deep-wipe workflow */\n/** Progress event emitted during deep-wipe. */\nexport interface DeepWipeProgress {\n  step: number;\n  total: number;\n  label: string;\n  detail: string;\n  status: 'active' | 'complete' | 'error';\n}\n\nexport interface DeepWipeOptions {\n  /** Delete workspace directory. Default: true */\n  deleteWorkspace?: boolean;\n  /** Delete git branches (local + remote). Default: true */\n  deleteBranches?: boolean;\n  /** Reset issue to backlog/open state. Default: true */\n  resetIssue?: boolean;\n  /** Project-specific workspace config for tunnel/Hume cleanup */\n  workspaceConfig?: {\n    tunnel?: any;\n    hume?: any;\n    dns?: { domain?: string };\n  };\n  /** Project name (for Docker compose project naming + placeholders) */\n  projectName?: string;\n  /** Optional callback for streaming progress events to the client. */\n  onProgress?: (event: DeepWipeProgress) => void;\n}\n\n/** Helper to create a successful step result */\nexport function stepOk(step: string, details?: string[]): StepResult {\n  return { step, success: true, skipped: false, details };\n}\n\n/** Helper to create a skipped step result */\nexport function stepSkipped(step: string, details?: string[]): StepResult {\n  return { step, success: true, skipped: true, details };\n}\n\n/** Helper to create a failed step result */\nexport function stepFailed(step: string, error: string, details?: string[]): StepResult {\n  return { step, success: false, skipped: false, error, details };\n}\n\n/**\n * Get LINEAR_API_KEY from environment or .panopticon.env.\n * Shared across lifecycle modules.\n */\nexport function getLinearApiKey(): string | null {\n  if (process.env.LINEAR_API_KEY) return process.env.LINEAR_API_KEY;\n  const envFile = join(homedir(), '.panopticon.env');\n  if (existsSync(envFile)) {\n    const content = readFileSync(envFile, 'utf-8');\n    const match = content.match(/LINEAR_API_KEY=(.+)/);\n    if (match) return match[1].trim();\n  }\n  return null;\n}\n"],"mappings":";;;;;;;;;;;AAiHA,SAAgB,OAAO,MAAc,SAAgC;AACnE,QAAO;EAAE;EAAM,SAAS;EAAM,SAAS;EAAO;EAAS;;;AAIzD,SAAgB,YAAY,MAAc,SAAgC;AACxE,QAAO;EAAE;EAAM,SAAS;EAAM,SAAS;EAAM;EAAS;;;AAIxD,SAAgB,WAAW,MAAc,OAAe,SAAgC;AACtF,QAAO;EAAE;EAAM,SAAS;EAAO,SAAS;EAAO;EAAO;EAAS;;;;;;AAOjE,SAAgB,kBAAiC;AAC/C,KAAI,QAAQ,IAAI,eAAgB,QAAO,QAAQ,IAAI;CACnD,MAAM,UAAU,KAAK,SAAS,EAAE,kBAAkB;AAClD,KAAI,WAAW,QAAQ,EAAE;EAEvB,MAAM,QADU,aAAa,SAAS,QAAQ,CACxB,MAAM,sBAAsB;AAClD,MAAI,MAAO,QAAO,MAAM,GAAG,MAAM;;AAEnC,QAAO"}

package/dist/{work-type-router-CS2BB1vS.js → work-type-router-CHjciPyS.js}

@@ -1,6 +1,6 @@
 import { t as __esmMin } from "./chunk-ruWRV7i3.js";
-import { W as init_paths, t as AGENTS_DIR } from "./paths-lMaxrYtT.js";
-import { a as getModelCapability, i as MODEL_CAPABILITIES, n as init_config_yaml, o as init_model_capabilities, r as loadConfig } from "./config-yaml-BgOACZAB.js";
+import { G as init_paths, t as AGENTS_DIR } from "./paths-CDJ_HsbN.js";
+import { a as getModelCapability, i as MODEL_CAPABILITIES, n as init_config_yaml, o as init_model_capabilities, r as loadConfig } from "./config-yaml-DGbLSMCa.js";
 import { existsSync, mkdirSync, readFileSync, readdirSync, writeFileSync } from "fs";
 import { join } from "path";
 //#region src/lib/hooks.ts
@@ -926,4 +926,4 @@ var init_work_type_router = __esmMin((() => {
 //#endregion
 export { generateFixedPointPrompt as a, popFromHook as c, clearHook as i, pushToHook as l, init_work_type_router as n, initHook as o, checkHook as r, init_hooks as s, getModelId as t, sendMail as u };
 
-//# sourceMappingURL=work-type-router-CS2BB1vS.js.map
+//# sourceMappingURL=work-type-router-CHjciPyS.js.map