skydive-cli 0.5.0-beta.31 → 0.5.0-beta.33

package/dist/js/{rest-CgfbKXst.mjs → rest-C6E4mS2A.mjs}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
-import { t as HttpError } from "./http-error-DzyrsLAZ.mjs";
-import { a as billingBlockedOutcomeSchema } from "./billing-blocked-2wju4gC_.mjs";
+import { t as HttpError } from "./http-error-UHH3mVBF.mjs";
+import { a as billingBlockedOutcomeSchema } from "./billing-blocked-D3l5kJlX.mjs";
 import { z } from "zod";
 import { createParser } from "eventsource-parser";
 

package/dist/js/rest-CaWUSrnH.mjs

@@ -0,0 +1,6 @@
+#!/usr/bin/env node
+import { t as HttpError } from "./http-error-UHH3mVBF.mjs";
+import { n as errorDetail, r as sendErrorMessage, t as createRestClient } from "./rest-C6E4mS2A.mjs";
+import "./billing-blocked-D3l5kJlX.mjs";
+
+export { createRestClient };

package/dist/js/tls-cert-CLgSQALB.mjs

@@ -0,0 +1,4 @@
+#!/usr/bin/env node
+import { n as envTlsCertSource, r as warnOnRebindProtection, t as defaultTlsCertSource } from "./tls-cert-CV-pwxVN.mjs";
+
+export { defaultTlsCertSource };

package/dist/js/tls-cert-CV-pwxVN.mjs

@@ -0,0 +1,67 @@
+#!/usr/bin/env node
+import { readFile } from "node:fs/promises";
+import dns from "node:dns";
+
+//#region ../portal-daemon/src/tls-cert.ts
+/**
+* File-backed cert source, configured by environment:
+* SKYDIVE_PORTAL_TLS_KEY / SKYDIVE_PORTAL_TLS_CERT (PEM file paths) and
+* SKYDIVE_PORTAL_TLS_HOST (the name the cert covers). All three or nothing —
+* a partial configuration is reported once and treated as absent, so a typo
+* degrades to today's behavior instead of a crash loop.
+*/
+function envTlsCertSource(env, log) {
+	return async () => {
+		const keyPath = env.SKYDIVE_PORTAL_TLS_KEY;
+		const certPath = env.SKYDIVE_PORTAL_TLS_CERT;
+		const hostname = env.SKYDIVE_PORTAL_TLS_HOST;
+		if (!keyPath && !certPath && !hostname) return null;
+		if (!keyPath || !certPath || !hostname) {
+			log("forward: SKYDIVE_PORTAL_TLS_KEY, SKYDIVE_PORTAL_TLS_CERT and SKYDIVE_PORTAL_TLS_HOST must all be set to enable the TLS origin; continuing with http only");
+			return null;
+		}
+		try {
+			const [key, cert] = await Promise.all([readFile(keyPath, "utf8"), readFile(certPath, "utf8")]);
+			return {
+				key,
+				cert,
+				hostname
+			};
+		} catch (err) {
+			log(`forward: could not read TLS key/cert (${err instanceof Error ? err.message : String(err)}); continuing with http only`);
+			return null;
+		}
+	};
+}
+/**
+* The default cert source for both tunnel surfaces: an explicit env/file
+* configuration wins (BYO cert — also the escape hatch for machines where the
+* trust prompt is unwanted, e.g. CI), otherwise the fully automatic
+* devcert-backed localhost source.
+*/
+function defaultTlsCertSource(env, log) {
+	const fromEnv = envTlsCertSource(env, log);
+	return async () => {
+		if (env.SKYDIVE_PORTAL_TLS_KEY || env.SKYDIVE_PORTAL_TLS_CERT || env.SKYDIVE_PORTAL_TLS_HOST) return fromEnv();
+		const { localhostCertSource } = await import("./localhost-cert-Bn-UBUmj.mjs");
+		return localhostCertSource(log)();
+	};
+}
+/**
+* Detect resolver-level DNS rebind protection: some routers/resolvers refuse
+* public names that answer with loopback addresses (Plex documents this exact
+* failure for *.plex.direct). The https origin simply won't resolve for such
+* users — warn with the cause, and leave the http origin (unaffected) as the
+* fallback. Never fatal: the browser may use a different resolver than the
+* OS, so we start the listener regardless.
+*/
+async function warnOnRebindProtection(hostname, log) {
+	try {
+		if (!(await dns.promises.lookup(hostname, { all: true })).some((a) => a.address === "127.0.0.1" || a.address === "::1")) log(`forward: ${hostname} did not resolve to 127.0.0.1 — a resolver on this network may block public names pointing at loopback (DNS rebind protection). The https origin may not work here; http://localhost is unaffected.`);
+	} catch (error) {
+		log(`forward: ${hostname} did not resolve (${error instanceof Error ? error.message : String(error)}) — a resolver on this network may block public names pointing at loopback (DNS rebind protection). The https origin may not work here; http://localhost is unaffected.`);
+	}
+}
+
+//#endregion
+export { envTlsCertSource as n, warnOnRebindProtection as r, defaultTlsCertSource as t };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "skydive-cli",
-  "version": "0.5.0-beta.31",
+  "version": "0.5.0-beta.33",
   "description": "Skydive CLI — cloud agents from the command line",
   "homepage": "https://skydive.com",
   "license": "MIT",

package/dist/js/api-DG5W6iwx.mjs

@@ -1,131 +0,0 @@
-#!/usr/bin/env node
-import { t as HttpError } from "./http-error-DzyrsLAZ.mjs";
-import { z } from "zod";
-
-//#region ../portal-daemon/src/api.ts
-/**
-* The portal's session-authed REST surface, shared by `PortalClient` (the
-* TUI/`portal open` connection) and the `skydive portal` management
-* commands, so the endpoint contracts and response schemas live in exactly
-* one place.
-*/
-const deviceSchema = z.object({
-	id: z.string(),
-	machineName: z.string(),
-	friendlyName: z.string(),
-	connected: z.boolean(),
-	lastSeen: z.string().nullable(),
-	grantedAgentIds: z.array(z.string())
-});
-const devicesResponseSchema = z.object({
-	devices: z.array(deviceSchema),
-	agents: z.array(z.object({
-		id: z.string(),
-		name: z.string()
-	}))
-});
-const deviceTokenSchema = z.object({ token: z.string().min(1) });
-async function portalFetch(auth, path, init) {
-	const res = await fetch(`${auth.appUrl}${path}`, {
-		method: init.method,
-		headers: {
-			authorization: `Bearer ${auth.sessionToken}`,
-			accept: "application/json",
-			...init.body ? { "content-type": "application/json" } : {}
-		},
-		...init.body ? { body: init.body } : {}
-	});
-	if (!res.ok) {
-		const body = await res.text().catch(() => "");
-		throw new HttpError(res.status, body);
-	}
-	return res.json();
-}
-async function fetchPortalDevices(auth) {
-	const json = await portalFetch(auth, "/api/v1/portal/devices", { method: "GET" });
-	return devicesResponseSchema.parse(json);
-}
-const registerResponseSchema = z.object({ device: z.object({ id: z.string() }) });
-/**
-* Register this machine's device row without connecting. Connecting registers
-* as a side effect; this covers granting an agent on a machine that has never
-* shared yet (the grant references the device row).
-*/
-async function registerPortalDevice(auth, { machineName, friendlyName }) {
-	const json = await portalFetch(auth, "/api/v1/portal/devices", {
-		method: "POST",
-		body: JSON.stringify({
-			machineName,
-			friendlyName
-		})
-	});
-	return registerResponseSchema.parse(json).device;
-}
-/** Short-lived token the machine presents when dialing the portal WebSocket. */
-async function mintPortalDeviceToken(auth) {
-	const json = await portalFetch(auth, "/api/v1/portal/device-token", { method: "POST" });
-	return deviceTokenSchema.parse(json).token;
-}
-const forwardTargetSchema = z.object({
-	daemonOrigin: z.string().min(1),
-	token: z.string().min(1),
-	expiresInSeconds: z.number()
-});
-/**
-* Everything `portal forward` needs to dial an agent's sandbox daemon through
-* the agent-webserver edge Worker: the daemon's stable public origin and a
-* daemon auth token (canUse-gated server-side).
-*/
-async function fetchForwardTarget(auth, agentId) {
-	const json = await portalFetch(auth, "/api/v1/portal/forward-target", {
-		method: "POST",
-		body: JSON.stringify({ agentId })
-	});
-	return forwardTargetSchema.parse(json);
-}
-async function grantPortalAccess(auth, { deviceId, agentId, conversationId }) {
-	await portalFetch(auth, `/api/v1/portal/devices/${encodeURIComponent(deviceId)}/grants`, {
-		method: "POST",
-		body: JSON.stringify({
-			agentId,
-			conversationId
-		})
-	});
-}
-async function revokePortalAccess(auth, { deviceId, agentId }) {
-	await portalFetch(auth, `/api/v1/portal/devices/${encodeURIComponent(deviceId)}/grants/${encodeURIComponent(agentId)}`, { method: "DELETE" });
-}
-/**
-* The device row for a given machine identity. Matching is by `machineName`
-* equality — the stable handle the machine registers under, not the display
-* label.
-*/
-function findThisDevice(devices, machineName) {
-	return devices.find((device) => device.machineName === machineName) ?? null;
-}
-/**
-* One-time grant migration onto the merged device. Earlier CLI builds
-* registered a separate `<machineName>-cli` device, so a user's existing
-* approvals hang off that row; the merged device would start with zero grants
-* and every already-authorized agent would ask again. Copy any grant the
-* merged device is missing (the grant endpoint upserts, so re-runs are
-* no-ops). The legacy row is left in place — an old CLI build may still
-* connect under it. Returns how many grants were copied.
-*/
-async function unifyLegacyCliGrants(auth, machineName) {
-	const { devices } = await fetchPortalDevices(auth);
-	const merged = findThisDevice(devices, machineName);
-	const legacy = findThisDevice(devices, `${machineName}-cli`);
-	if (!merged || !legacy) return 0;
-	const have = new Set(merged.grantedAgentIds);
-	const missing = legacy.grantedAgentIds.filter((id) => !have.has(id));
-	for (const agentId of missing) await grantPortalAccess(auth, {
-		deviceId: merged.id,
-		agentId,
-		conversationId: null
-	});
-	return missing.length;
-}
-
-//#endregion
-export { mintPortalDeviceToken as a, unifyLegacyCliGrants as c, grantPortalAccess as i, fetchPortalDevices as n, registerPortalDevice as o, findThisDevice as r, revokePortalAccess as s, fetchForwardTarget as t };

package/dist/js/client-hH2PJL8y.mjs

@@ -1,5 +0,0 @@
-#!/usr/bin/env node
-import { t as PortalClient } from "./client-DbqRBquD.mjs";
-import "./api-DG5W6iwx.mjs";
-
-export { PortalClient };

package/dist/js/daemon-SPQgtsbW.mjs

@@ -1,6 +0,0 @@
-#!/usr/bin/env node
-import "./client-DbqRBquD.mjs";
-import { a as runPortalDaemon, i as queryDaemonStatus, n as ensureDaemonRunning, o as startPortalDaemon, r as isDaemonListening, s as stopDaemon, t as PortalDaemon } from "./daemon-BTyg329O.mjs";
-import "./api-DG5W6iwx.mjs";
-
-export { runPortalDaemon };

package/dist/js/daemon-client-C7emKKlj.mjs

@@ -1,7 +0,0 @@
-#!/usr/bin/env node
-import "./client-DbqRBquD.mjs";
-import "./daemon-BTyg329O.mjs";
-import "./api-DG5W6iwx.mjs";
-import { t as PortalDaemonClient } from "./daemon-client--A_yMKq6.mjs";
-
-export { PortalDaemonClient };

package/dist/js/raw-pty-DmdUf4_w.mjs

@@ -1,5 +0,0 @@
-#!/usr/bin/env node
-import "./client-c4c5MmgN.mjs";
-import { t as runRawPtyPassthrough } from "./raw-pty-DY4KelZW.mjs";
-
-export { runRawPtyPassthrough };

package/dist/js/rest-VV5nc-Mn.mjs

@@ -1,6 +0,0 @@
-#!/usr/bin/env node
-import { t as HttpError } from "./http-error-DzyrsLAZ.mjs";
-import { n as errorDetail, r as sendErrorMessage, t as createRestClient } from "./rest-CgfbKXst.mjs";
-import "./billing-blocked-2wju4gC_.mjs";
-
-export { createRestClient };