sleev 0.0.12 → 0.0.13

package/dist/daemon/systemd.js

@@ -0,0 +1,181 @@
+// systemd --user backend (Linux): the daemon runs as a user service that
+// starts on login and (with linger) on boot, supervised without sleeved.
+// This is the product path on Linux.
+import { spawn } from "node:child_process";
+import fs from "node:fs/promises";
+import os from "node:os";
+import path from "node:path";
+import { writeGatewayConfig } from "./config.js";
+import { probeHealth } from "./health.js";
+import { resolveGatewayBinary } from "./start.js";
+const UNIT_NAME = "sleeve-gateway.service";
+const defaultRun = (cmd, args) => new Promise((resolve) => {
+    const child = spawn(cmd, args, { stdio: ["ignore", "pipe", "pipe"] });
+    let stdout = "";
+    let stderr = "";
+    child.stdout?.on("data", (d) => (stdout += d.toString()));
+    child.stderr?.on("data", (d) => (stderr += d.toString()));
+    child.once("error", () => resolve({ code: 127, stdout, stderr: "spawn failed" }));
+    child.once("exit", (code) => resolve({ code: code ?? 1, stdout, stderr }));
+});
+export async function systemctlAvailable(run = defaultRun) {
+    if (os.platform() !== "linux")
+        return false;
+    const { code } = await run("systemctl", ["--user", "--version"]);
+    return code === 0;
+}
+function userUnitPath(env) {
+    const base = env.XDG_CONFIG_HOME?.trim() || path.join(os.homedir(), ".config");
+    return path.join(base, "systemd", "user", UNIT_NAME);
+}
+// Pure: the unit file content. Paths are quoted so spaces survive systemd's
+// ExecStart tokenisation.
+export function renderUnit(binPath, configPath, host, port) {
+    const exec = [
+        q(binPath),
+        "--local-installation",
+        "--config",
+        q(configPath),
+        "--host",
+        host,
+        "--port",
+        String(port),
+    ].join(" ");
+    return [
+        "[Unit]",
+        "Description=Sleeve local gateway",
+        "After=network-online.target",
+        "Wants=network-online.target",
+        "",
+        "[Service]",
+        "Type=simple",
+        `ExecStart=${exec}`,
+        "Restart=on-failure",
+        "RestartSec=2",
+        "",
+        "[Install]",
+        "WantedBy=default.target",
+        "",
+    ].join("\n");
+}
+function q(value) {
+    return `"${value.replace(/"/g, '\\"')}"`;
+}
+const defaultSleep = (ms) => new Promise((r) => setTimeout(r, ms));
+export class SystemdUserController {
+    backend = "systemd";
+    config;
+    env;
+    run;
+    fetchImpl;
+    sleep;
+    readinessTimeoutMs;
+    constructor(config, env = process.env, deps = {}) {
+        this.config = config;
+        this.env = env;
+        this.run = deps.run ?? defaultRun;
+        this.fetchImpl = deps.fetchImpl ?? fetch;
+        this.sleep = deps.sleep ?? defaultSleep;
+        this.readinessTimeoutMs = deps.readinessTimeoutMs ?? 10_000;
+    }
+    get address() {
+        return `http://${this.config.proxy.host}:${this.config.proxy.port}`;
+    }
+    async sc(args) {
+        return this.run("systemctl", ["--user", ...args]);
+    }
+    // Writes the unit + the gateway config, then reloads systemd. The unit
+    // is regenerated every time so a changed binary path/port is picked up.
+    async install() {
+        const binPath = resolveGatewayBinary(this.config, this.env);
+        const configPath = await writeGatewayConfig(this.config);
+        const unitPath = userUnitPath(this.env);
+        await fs.mkdir(path.dirname(unitPath), { recursive: true });
+        await fs.writeFile(unitPath, renderUnit(binPath, configPath, this.config.proxy.host, this.config.proxy.port), { mode: 0o644 });
+        await this.sc(["daemon-reload"]);
+    }
+    async waitHealthy() {
+        const deadline = Date.now() + this.readinessTimeoutMs;
+        while (Date.now() < deadline) {
+            await this.sleep(250);
+            const health = await probeHealth(this.config.proxy.host, this.config.proxy.port, 1000, this.fetchImpl);
+            if (health)
+                return;
+        }
+        const { stdout } = await this.sc(["is-active", UNIT_NAME]).catch(() => ({ stdout: "", code: 1, stderr: "" }));
+        throw new Error(`Gateway service did not become healthy within ` +
+            `${this.readinessTimeoutMs}ms (unit ${stdout.trim() || "inactive"}).`);
+    }
+    async start() {
+        const existing = await this.status();
+        if (existing.healthy)
+            return existing;
+        await this.install();
+        // enable --now: start immediately and on every login. Linger lets
+        // it also start at boot before any login; best-effort because it
+        // can require elevated privileges.
+        const enabled = await this.sc(["enable", "--now", UNIT_NAME]);
+        if (enabled.code !== 0) {
+            throw new Error(`systemctl --user enable --now failed: ${enabled.stderr.trim()}`);
+        }
+        await this.run("loginctl", [
+            "enable-linger",
+            os.userInfo().username,
+        ]).catch(() => undefined);
+        await this.waitHealthy();
+        return this.status();
+    }
+    async stop() {
+        await this.sc(["stop", UNIT_NAME]);
+        return this.status();
+    }
+    async restart() {
+        // Reinstall first so a changed config/binary/port is applied.
+        await this.install();
+        const r = await this.sc(["restart", UNIT_NAME]);
+        if (r.code !== 0) {
+            throw new Error(`systemctl --user restart failed: ${r.stderr.trim()}`);
+        }
+        await this.waitHealthy();
+        return this.status();
+    }
+    async status() {
+        const active = await this.sc(["is-active", UNIT_NAME]);
+        const running = active.stdout.trim() === "active";
+        const health = await probeHealth(this.config.proxy.host, this.config.proxy.port, 1500, this.fetchImpl);
+        let pid = null;
+        const show = await this.sc([
+            "show",
+            "-p",
+            "MainPID",
+            "--value",
+            UNIT_NAME,
+        ]);
+        const parsed = Number.parseInt(show.stdout.trim(), 10);
+        if (Number.isInteger(parsed) && parsed > 0)
+            pid = parsed;
+        return {
+            backend: this.backend,
+            running: running || health !== null,
+            healthy: health !== null,
+            configured: health?.configured ?? null,
+            version: health?.version ?? null,
+            pid,
+            address: this.address,
+            detail: health !== null
+                ? null
+                : `unit ${active.stdout.trim() || "inactive"}`,
+        };
+    }
+    async teardown() {
+        await this.sc(["disable", "--now", UNIT_NAME]);
+        try {
+            await fs.unlink(userUnitPath(this.env));
+        }
+        catch {
+            /* already gone */
+        }
+        await this.sc(["daemon-reload"]);
+    }
+}
+//# sourceMappingURL=systemd.js.map

package/dist/daemon/systemd.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"systemd.js","sourceRoot":"","sources":["../../src/daemon/systemd.ts"],"names":[],"mappings":"AAAA,yEAAyE;AACzE,yEAAyE;AACzE,qCAAqC;AACrC,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAC3C,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAClC,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAEjD,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AAElD,MAAM,SAAS,GAAG,wBAAwB,CAAC;AAQ3C,MAAM,UAAU,GAAkB,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,CAC5C,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;IACpB,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;IACtE,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC;IAClE,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC;IAClE,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,CACrB,OAAO,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC,CACzD,CAAC;IACF,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,CACxB,OAAO,CAAC,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAC/C,CAAC;AACN,CAAC,CAAC,CAAC;AAEP,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACpC,MAAqB,UAAU;IAE/B,IAAI,EAAE,CAAC,QAAQ,EAAE,KAAK,OAAO;QAAE,OAAO,KAAK,CAAC;IAC5C,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,GAAG,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC,CAAC;IACjE,OAAO,IAAI,KAAK,CAAC,CAAC;AACtB,CAAC;AAED,SAAS,YAAY,CAAC,GAAsB;IACxC,MAAM,IAAI,GACN,GAAG,CAAC,eAAe,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,SAAS,CAAC,CAAC;IACtE,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC;AACzD,CAAC;AAED,4EAA4E;AAC5E,0BAA0B;AAC1B,MAAM,UAAU,UAAU,CACtB,OAAe,EACf,UAAkB,EAClB,IAAY,EACZ,IAAY;IAEZ,MAAM,IAAI,GAAG;QACT,CAAC,CAAC,OAAO,CAAC;QACV,sBAAsB;QACtB,UAAU;QACV,CAAC,CAAC,UAAU,CAAC;QACb,QAAQ;QACR,IAAI;QACJ,QAAQ;QACR,MAAM,CAAC,IAAI,CAAC;KACf,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACZ,OAAO;QACH,QAAQ;QACR,kCAAkC;QAClC,6BAA6B;QAC7B,6BAA6B;QAC7B,EAAE;QACF,WAAW;QACX,aAAa;QACb,aAAa,IAAI,EAAE;QACnB,oBAAoB;QACpB,cAAc;QACd,EAAE;QACF,WAAW;QACX,yBAAyB;QACzB,EAAE;KACL,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACjB,CAAC;AAED,SAAS,CAAC,CAAC,KAAa;IACpB,OAAO,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,GAAG,CAAC;AAC7C,CAAC;AASD,MAAM,YAAY,GAAG,CAAC,EAAU,EAAiB,EAAE,CAC/C,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;AAE1C,MAAM,OAAO,qBAAqB;IACrB,OAAO,GAAG,SAAkB,CAAC;IACrB,MAAM,CAAgB;IACtB,GAAG,CAAoB;IACvB,GAAG,CAAgB;IACnB,SAAS,CAAe;IACxB,KAAK,CAAgC;IACrC,kBAAkB,CAAS;IAE5C,YACI,MAAqB,EACrB,MAAyB,OAAO,CAAC,GAAG,EACpC,OAAoB,EAAE;QAEtB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,GAAG,GAAG,GAAG,CAAC;QACf,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,UAAU,CAAC;QAClC,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,KAAK,CAAC;QACzC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,YAAY,CAAC;QACxC,IAAI,CAAC,kBAAkB,GAAG,IAAI,CAAC,kBAAkB,IAAI,MAAM,CAAC;IAChE,CAAC;IAED,IAAY,OAAO;QACf,OAAO,UAAU,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,IAAI,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;IACxE,CAAC;IAEO,KAAK,CAAC,EAAE,CAAC,IAAc;QAC3B,OAAO,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC;IACtD,CAAC;IAED,uEAAuE;IACvE,wEAAwE;IAChE,KAAK,CAAC,OAAO;QACjB,MAAM,OAAO,GAAG,oBAAoB,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;QAC5D,MAAM,UAAU,GAAG,MAAM,kBAAkB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACzD,MAAM,QAAQ,GAAG,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACxC,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC5D,MAAM,EAAE,CAAC,SAAS,CACd,QAAQ,EACR,UAAU,CACN,OAAO,EACP,UAAU,EACV,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,EACtB,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CACzB,EACD,EAAE,IAAI,EAAE,KAAK,EAAE,CAClB,CAAC;QACF,MAAM,IAAI,CAAC,EAAE,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC;IACrC,CAAC;IAEO,KAAK,CAAC,WAAW;QACrB,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,kBAAkB,CAAC;QACtD,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,EAAE,CAAC;YAC3B,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YACtB,MAAM,MAAM,GAAG,MAAM,WAAW,CAC5B,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,EACtB,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,EACtB,IAAI,EACJ,IAAI,CAAC,SAAS,CACjB,CAAC;YACF,IAAI,MAAM;gBAAE,OAAO;QACvB,CAAC;QACD,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,EAAE,CAAC,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC,CAAC,KAAK,CAC5D,GAAG,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,CAC9C,CAAC;QACF,MAAM,IAAI,KAAK,CACX,gDAAgD;YAC5C,GAAG,IAAI,CAAC,kBAAkB,YAAY,MAAM,CAAC,IAAI,EAAE,IAAI,UAAU,IAAI,CAC5E,CAAC;IACN,CAAC;IAED,KAAK,CAAC,KAAK;QACP,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,MAAM,EAAE,CAAC;QACrC,IAAI,QAAQ,CAAC,OAAO;YAAE,OAAO,QAAQ,CAAC;QACtC,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;QACrB,kEAAkE;QAClE,iEAAiE;QACjE,mCAAmC;QACnC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC;QAC9D,IAAI,OAAO,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;YACrB,MAAM,IAAI,KAAK,CACX,yCAAyC,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CACnE,CAAC;QACN,CAAC;QACD,MAAM,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE;YACvB,eAAe;YACf,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ;SACzB,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QAC1B,MAAM,IAAI,CAAC,WAAW,EAAE,CAAC;QACzB,OAAO,IAAI,CAAC,MAAM,EAAE,CAAC;IACzB,CAAC;IAED,KAAK,CAAC,IAAI;QACN,MAAM,IAAI,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC;QACnC,OAAO,IAAI,CAAC,MAAM,EAAE,CAAC;IACzB,CAAC;IAED,KAAK,CAAC,OAAO;QACT,8DAA8D;QAC9D,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;QACrB,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,EAAE,CAAC,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC,CAAC;QAChD,IAAI,CAAC,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CACX,oCAAoC,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CACxD,CAAC;QACN,CAAC;QACD,MAAM,IAAI,CAAC,WAAW,EAAE,CAAC;QACzB,OAAO,IAAI,CAAC,MAAM,EAAE,CAAC;IACzB,CAAC;IAED,KAAK,CAAC,MAAM;QACR,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,EAAE,CAAC,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC,CAAC;QACvD,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,QAAQ,CAAC;QAClD,MAAM,MAAM,GAAG,MAAM,WAAW,CAC5B,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,EACtB,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,EACtB,IAAI,EACJ,IAAI,CAAC,SAAS,CACjB,CAAC;QACF,IAAI,GAAG,GAAkB,IAAI,CAAC;QAC9B,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,EAAE,CAAC;YACvB,MAAM;YACN,IAAI;YACJ,SAAS;YACT,SAAS;YACT,SAAS;SACZ,CAAC,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;QACvD,IAAI,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,MAAM,GAAG,CAAC;YAAE,GAAG,GAAG,MAAM,CAAC;QAEzD,OAAO;YACH,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,OAAO,EAAE,OAAO,IAAI,MAAM,KAAK,IAAI;YACnC,OAAO,EAAE,MAAM,KAAK,IAAI;YACxB,UAAU,EAAE,MAAM,EAAE,UAAU,IAAI,IAAI;YACtC,OAAO,EAAE,MAAM,EAAE,OAAO,IAAI,IAAI;YAChC,GAAG;YACH,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,MAAM,EACF,MAAM,KAAK,IAAI;gBACX,CAAC,CAAC,IAAI;gBACN,CAAC,CAAC,QAAQ,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,UAAU,EAAE;SACzD,CAAC;IACN,CAAC;IAED,KAAK,CAAC,QAAQ;QACV,MAAM,IAAI,CAAC,EAAE,CAAC,CAAC,SAAS,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC;QAC/C,IAAI,CAAC;YACD,MAAM,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;QAC5C,CAAC;QAAC,MAAM,CAAC;YACL,kBAAkB;QACtB,CAAC;QACD,MAAM,IAAI,CAAC,EAAE,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC;IACrC,CAAC;CACJ"}

package/dist/gateway/acquire.d.ts

@@ -0,0 +1,14 @@
+import { type GatewayPlatform } from "./platform.js";
+export type InstalledGateway = {
+    binPath: string;
+    version: string;
+    platform: GatewayPlatform;
+};
+export type AcquireDeps = {
+    fetchImpl?: typeof fetch;
+    extract?: (archive: string, destDir: string, kind: "tar.gz" | "zip") => Promise<void>;
+    currentVersion?: string | null;
+    platform?: GatewayPlatform;
+    env?: NodeJS.ProcessEnv;
+};
+export declare function acquireGateway(deps?: AcquireDeps): Promise<InstalledGateway>;

package/dist/gateway/acquire.js

@@ -0,0 +1,112 @@
+// Downloads, verifies, and installs the packaged gateway binary the channel
+// manifest points at. The CLI never builds from source; this is how the
+// `SLEEVE_GATEWAY_BIN`-shaped seam gets populated for real users.
+import { createHash } from "node:crypto";
+import { spawn } from "node:child_process";
+import fs from "node:fs/promises";
+import os from "node:os";
+import path from "node:path";
+import { resolveSleevedPaths } from "../config/paths.js";
+import { archivedBinaryCandidates, archiveExtension, currentPlatformKey, installedBinaryName, } from "./platform.js";
+import { resolveLatestRelease, } from "./manifest.js";
+function gatewayInstallDir(version) {
+    return path.join(resolveSleevedPaths().dataDir, "gateway", version);
+}
+async function pathExists(p) {
+    try {
+        await fs.access(p);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+async function defaultExtract(archive, destDir, _kind) {
+    // `tar` extracts both gzip tarballs and (via libarchive/bsdtar, present
+    // on macOS and Windows 10+) zips. Linux ships GNU tar but only ever
+    // receives .tar.gz, so this is safe across the three built targets.
+    //
+    // Defense-in-depth: the archive is integrity-pinned upstream, but it is
+    // still attacker-influenced if the manifest is compromised. GNU tar (and
+    // bsdtar) already strip a leading `/` and refuse `..` members by default,
+    // so extraction cannot escape destDir without an explicit -P/--absolute-
+    // names; we never pass one. (An earlier `--no-absolute-filenames` flag
+    // was not a real GNU tar option — tar rejected it with exit 64 before
+    // extracting anything.)
+    await new Promise((resolve, reject) => {
+        const child = spawn("tar", ["-xf", archive, "-C", destDir], {
+            stdio: "ignore",
+        });
+        child.once("error", reject);
+        child.once("exit", (code) => code === 0
+            ? resolve()
+            : reject(new Error(`tar exited with code ${code ?? "null"}`)));
+    });
+}
+function sha256(buffer) {
+    return createHash("sha256").update(buffer).digest("hex");
+}
+// Resolves latest, and unless it's already installed, downloads + verifies +
+// installs it. Returns the path the daemon should be launched from.
+export async function acquireGateway(deps = {}) {
+    const fetchImpl = deps.fetchImpl ?? fetch;
+    const extract = deps.extract ?? defaultExtract;
+    const platform = deps.platform ?? currentPlatformKey();
+    const release = await resolveLatestRelease({
+        fetchImpl,
+        platform,
+        env: deps.env,
+    });
+    const binPath = path.join(gatewayInstallDir(release.version), installedBinaryName(platform));
+    // Skip when the resolved version is already installed and present.
+    if (deps.currentVersion === release.version &&
+        (await pathExists(binPath))) {
+        return { binPath, version: release.version, platform };
+    }
+    await installArtifact(release.artifact, {
+        fetchImpl,
+        extract,
+        archiveKind: archiveExtension(platform),
+        archivedNames: archivedBinaryCandidates(platform),
+        binPath,
+    });
+    return { binPath, version: release.version, platform };
+}
+async function installArtifact(artifact, opts) {
+    const response = await opts.fetchImpl(artifact.url);
+    if (!response.ok) {
+        throw new Error(`Failed to download gateway binary (${artifact.url}): HTTP ${response.status}.`);
+    }
+    const buffer = Buffer.from(await response.arrayBuffer());
+    if (buffer.byteLength !== artifact.size) {
+        throw new Error(`Downloaded gateway archive size ${buffer.byteLength} != expected ${artifact.size}.`);
+    }
+    const digest = sha256(buffer);
+    if (digest !== artifact.sha256) {
+        throw new Error(`Downloaded gateway archive sha256 mismatch (got ${digest}).`);
+    }
+    const work = await fs.mkdtemp(path.join(os.tmpdir(), "sleeve-gw-"));
+    try {
+        const archivePath = path.join(work, `archive.${opts.archiveKind === "zip" ? "zip" : "tar.gz"}`);
+        await fs.writeFile(archivePath, buffer);
+        await opts.extract(archivePath, work, opts.archiveKind);
+        let extracted = null;
+        for (const name of opts.archivedNames) {
+            const candidate = path.join(work, name);
+            if (await pathExists(candidate)) {
+                extracted = candidate;
+                break;
+            }
+        }
+        if (extracted === null) {
+            throw new Error(`Gateway archive did not contain any of: ${opts.archivedNames.join(", ")}.`);
+        }
+        await fs.mkdir(path.dirname(opts.binPath), { recursive: true });
+        await fs.copyFile(extracted, opts.binPath);
+        await fs.chmod(opts.binPath, 0o755);
+    }
+    finally {
+        await fs.rm(work, { recursive: true, force: true });
+    }
+}
+//# sourceMappingURL=acquire.js.map

package/dist/gateway/acquire.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"acquire.js","sourceRoot":"","sources":["../../src/gateway/acquire.ts"],"names":[],"mappings":"AAAA,4EAA4E;AAC5E,wEAAwE;AACxE,kEAAkE;AAClE,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAC3C,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAClC,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AACzD,OAAO,EACH,wBAAwB,EACxB,gBAAgB,EAChB,kBAAkB,EAClB,mBAAmB,GAEtB,MAAM,eAAe,CAAC;AACvB,OAAO,EACH,oBAAoB,GAGvB,MAAM,eAAe,CAAC;AAsBvB,SAAS,iBAAiB,CAAC,OAAe;IACtC,OAAO,IAAI,CAAC,IAAI,CAAC,mBAAmB,EAAE,CAAC,OAAO,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;AACxE,CAAC;AAED,KAAK,UAAU,UAAU,CAAC,CAAS;IAC/B,IAAI,CAAC;QACD,MAAM,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QACnB,OAAO,IAAI,CAAC;IAChB,CAAC;IAAC,MAAM,CAAC;QACL,OAAO,KAAK,CAAC;IACjB,CAAC;AACL,CAAC;AAED,KAAK,UAAU,cAAc,CACzB,OAAe,EACf,OAAe,EACf,KAAuB;IAEvB,wEAAwE;IACxE,oEAAoE;IACpE,oEAAoE;IACpE,EAAE;IACF,wEAAwE;IACxE,yEAAyE;IACzE,0EAA0E;IAC1E,yEAAyE;IACzE,uEAAuE;IACvE,sEAAsE;IACtE,wBAAwB;IACxB,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACxC,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,CAAC,EAAE;YACxD,KAAK,EAAE,QAAQ;SAClB,CAAC,CAAC;QACH,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC5B,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,CACxB,IAAI,KAAK,CAAC;YACN,CAAC,CAAC,OAAO,EAAE;YACX,CAAC,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,wBAAwB,IAAI,IAAI,MAAM,EAAE,CAAC,CAAC,CACpE,CAAC;IACN,CAAC,CAAC,CAAC;AACP,CAAC;AAED,SAAS,MAAM,CAAC,MAAc;IAC1B,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC7D,CAAC;AAED,6EAA6E;AAC7E,oEAAoE;AACpE,MAAM,CAAC,KAAK,UAAU,cAAc,CAChC,OAAoB,EAAE;IAEtB,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,KAAK,CAAC;IAC1C,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,cAAc,CAAC;IAC/C,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,kBAAkB,EAAE,CAAC;IAEvD,MAAM,OAAO,GAAoB,MAAM,oBAAoB,CAAC;QACxD,SAAS;QACT,QAAQ;QACR,GAAG,EAAE,IAAI,CAAC,GAAG;KAChB,CAAC,CAAC;IAEH,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CACrB,iBAAiB,CAAC,OAAO,CAAC,OAAO,CAAC,EAClC,mBAAmB,CAAC,QAAQ,CAAC,CAChC,CAAC;IAEF,mEAAmE;IACnE,IACI,IAAI,CAAC,cAAc,KAAK,OAAO,CAAC,OAAO;QACvC,CAAC,MAAM,UAAU,CAAC,OAAO,CAAC,CAAC,EAC7B,CAAC;QACC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,QAAQ,EAAE,CAAC;IAC3D,CAAC;IAED,MAAM,eAAe,CAAC,OAAO,CAAC,QAAQ,EAAE;QACpC,SAAS;QACT,OAAO;QACP,WAAW,EAAE,gBAAgB,CAAC,QAAQ,CAAC;QACvC,aAAa,EAAE,wBAAwB,CAAC,QAAQ,CAAC;QACjD,OAAO;KACV,CAAC,CAAC;IAEH,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,QAAQ,EAAE,CAAC;AAC3D,CAAC;AAED,KAAK,UAAU,eAAe,CAC1B,QAAqB,EACrB,IAUC;IAED,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;IACpD,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CACX,sCAAsC,QAAQ,CAAC,GAAG,WAAW,QAAQ,CAAC,MAAM,GAAG,CAClF,CAAC;IACN,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,QAAQ,CAAC,WAAW,EAAE,CAAC,CAAC;IAEzD,IAAI,MAAM,CAAC,UAAU,KAAK,QAAQ,CAAC,IAAI,EAAE,CAAC;QACtC,MAAM,IAAI,KAAK,CACX,mCAAmC,MAAM,CAAC,UAAU,gBAAgB,QAAQ,CAAC,IAAI,GAAG,CACvF,CAAC;IACN,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC;IAC9B,IAAI,MAAM,KAAK,QAAQ,CAAC,MAAM,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CACX,mDAAmD,MAAM,IAAI,CAChE,CAAC;IACN,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,YAAY,CAAC,CAAC,CAAC;IACpE,IAAI,CAAC;QACD,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CACzB,IAAI,EACJ,WAAW,IAAI,CAAC,WAAW,KAAK,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,EAAE,CAC7D,CAAC;QACF,MAAM,EAAE,CAAC,SAAS,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;QACxC,MAAM,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,IAAI,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;QAExD,IAAI,SAAS,GAAkB,IAAI,CAAC;QACpC,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;YACpC,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;YACxC,IAAI,MAAM,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;gBAC9B,SAAS,GAAG,SAAS,CAAC;gBACtB,MAAM;YACV,CAAC;QACL,CAAC;QACD,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;YACrB,MAAM,IAAI,KAAK,CACX,2CAA2C,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAC9E,CAAC;QACN,CAAC;QAED,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAChE,MAAM,EAAE,CAAC,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;QAC3C,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IACxC,CAAC;YAAS,CAAC;QACP,MAAM,EAAE,CAAC,EAAE,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACxD,CAAC;AACL,CAAC"}

package/dist/gateway/manifest.d.ts

@@ -0,0 +1,26 @@
+import { type GatewayPlatform } from "./platform.js";
+export type ArtifactRef = {
+    url: string;
+    sha256: string;
+    size: number;
+};
+export type ReleaseManifest = {
+    channel: string;
+    version: string;
+    commit: string;
+    publishedAt: string;
+    artifacts: Partial<Record<GatewayPlatform, ArtifactRef>>;
+};
+export declare function manifestUrl(base: string, channel: string): string;
+export declare function parseManifest(value: unknown): ReleaseManifest;
+export type ResolvedRelease = {
+    version: string;
+    platform: GatewayPlatform;
+    artifact: ArtifactRef;
+};
+export declare function resolveLatestRelease(deps?: {
+    fetchImpl?: typeof fetch;
+    platform?: GatewayPlatform;
+    env?: NodeJS.ProcessEnv;
+}): Promise<ResolvedRelease>;
+export declare function assertTrustedArtifactUrl(artifactUrl: string, baseUrl: string): void;

package/dist/gateway/manifest.js

@@ -0,0 +1,98 @@
+// Reads the channel manifest — the always-latest pointer published by the
+// gateway release workflow at <base>/gateway/<channel>.json.
+import { gatewayUpdates } from "../product.js";
+import { currentPlatformKey } from "./platform.js";
+export function manifestUrl(base, channel) {
+    return `${base.replace(/\/+$/, "")}/gateway/${channel}.json`;
+}
+// Strict parse: the manifest is remote input, so validate every field we
+// rely on rather than trusting its shape.
+export function parseManifest(value) {
+    if (!isRecord(value)) {
+        throw new Error("Gateway manifest is not a JSON object.");
+    }
+    const channel = str(value.channel, "channel");
+    const version = str(value.version, "version");
+    const commit = str(value.commit, "commit");
+    const publishedAt = str(value.publishedAt, "publishedAt");
+    if (!isRecord(value.artifacts)) {
+        throw new Error("Gateway manifest is missing 'artifacts'.");
+    }
+    const artifacts = {};
+    for (const platform of ["linux-x64"]) {
+        const entry = value.artifacts[platform];
+        if (entry === undefined)
+            continue;
+        if (!isRecord(entry)) {
+            throw new Error(`Gateway manifest artifact ${platform} is invalid.`);
+        }
+        const size = entry.size;
+        if (typeof size !== "number" || !Number.isInteger(size) || size <= 0) {
+            throw new Error(`Gateway manifest artifact ${platform} has an invalid size.`);
+        }
+        artifacts[platform] = {
+            url: str(entry.url, `artifacts.${platform}.url`),
+            sha256: str(entry.sha256, `artifacts.${platform}.sha256`),
+            size,
+        };
+    }
+    return { channel, version, commit, publishedAt, artifacts };
+}
+// Fetches the channel manifest and resolves the artifact for this host.
+export async function resolveLatestRelease(deps = {}) {
+    const fetchImpl = deps.fetchImpl ?? fetch;
+    const platform = deps.platform ?? currentPlatformKey();
+    const { baseUrl, channel } = gatewayUpdates(deps.env);
+    const url = manifestUrl(baseUrl, channel);
+    const response = await fetchImpl(url);
+    if (!response.ok) {
+        throw new Error(`Could not fetch gateway manifest (${url}): HTTP ${response.status}.`);
+    }
+    const manifest = parseManifest(await response.json().catch(() => null));
+    const artifact = manifest.artifacts[platform];
+    if (!artifact) {
+        throw new Error(`Gateway release ${manifest.version} has no ${platform} build.`);
+    }
+    // The manifest is remote input and the artifact it points at is later
+    // executed. size/sha256 come from the same manifest, so that check is
+    // self-referential — pin the download to the trusted release base so a
+    // tampered manifest cannot redirect it off-origin.
+    assertTrustedArtifactUrl(artifact.url, baseUrl);
+    return { version: manifest.version, platform, artifact };
+}
+// Throws unless `artifactUrl` lives under `baseUrl`: same origin, same
+// scheme, and within the base path. URL parsing normalizes `..`/`.`
+// segments, so a path-traversal pathname fails the prefix check.
+export function assertTrustedArtifactUrl(artifactUrl, baseUrl) {
+    let artifact;
+    try {
+        artifact = new URL(artifactUrl);
+    }
+    catch {
+        throw new Error(`Gateway manifest artifact URL is not a valid URL: ${artifactUrl}.`);
+    }
+    // baseUrl is already validated by gatewayUpdates(); http is only its
+    // scheme for a local dev override.
+    const base = new URL(baseUrl);
+    if (base.protocol === "https:" && artifact.protocol !== "https:") {
+        throw new Error(`Gateway manifest artifact URL must use https: ${artifactUrl}.`);
+    }
+    const basePath = base.pathname.replace(/\/+$/, "");
+    const withinBase = artifact.origin === base.origin &&
+        (artifact.pathname === basePath ||
+            artifact.pathname.startsWith(`${basePath}/`));
+    if (!withinBase) {
+        throw new Error(`Gateway manifest artifact URL ${artifactUrl} is not under the ` +
+            `trusted release base ${baseUrl}.`);
+    }
+}
+function isRecord(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function str(value, field) {
+    if (typeof value !== "string" || !value) {
+        throw new Error(`Gateway manifest field '${field}' is missing.`);
+    }
+    return value;
+}
+//# sourceMappingURL=manifest.js.map

package/dist/gateway/manifest.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"manifest.js","sourceRoot":"","sources":["../../src/gateway/manifest.ts"],"names":[],"mappings":"AAAA,0EAA0E;AAC1E,6DAA6D;AAC7D,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAC/C,OAAO,EAAE,kBAAkB,EAAwB,MAAM,eAAe,CAAC;AAgBzE,MAAM,UAAU,WAAW,CAAC,IAAY,EAAE,OAAe;IACrD,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,YAAY,OAAO,OAAO,CAAC;AACjE,CAAC;AAED,yEAAyE;AACzE,0CAA0C;AAC1C,MAAM,UAAU,aAAa,CAAC,KAAc;IACxC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACnB,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;IAC9D,CAAC;IACD,MAAM,OAAO,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;IAC9C,MAAM,OAAO,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;IAC9C,MAAM,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IAC3C,MAAM,WAAW,GAAG,GAAG,CAAC,KAAK,CAAC,WAAW,EAAE,aAAa,CAAC,CAAC;IAC1D,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;IAChE,CAAC;IAED,MAAM,SAAS,GAAkD,EAAE,CAAC;IACpE,KAAK,MAAM,QAAQ,IAAI,CAAC,WAAW,CAAU,EAAE,CAAC;QAC5C,MAAM,KAAK,GAAG,KAAK,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;QACxC,IAAI,KAAK,KAAK,SAAS;YAAE,SAAS;QAClC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;YACnB,MAAM,IAAI,KAAK,CACX,6BAA6B,QAAQ,cAAc,CACtD,CAAC;QACN,CAAC;QACD,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC;QACxB,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,EAAE,CAAC;YACnE,MAAM,IAAI,KAAK,CACX,6BAA6B,QAAQ,uBAAuB,CAC/D,CAAC;QACN,CAAC;QACD,SAAS,CAAC,QAAQ,CAAC,GAAG;YAClB,GAAG,EAAE,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,aAAa,QAAQ,MAAM,CAAC;YAChD,MAAM,EAAE,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,aAAa,QAAQ,SAAS,CAAC;YACzD,IAAI;SACP,CAAC;IACN,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,SAAS,EAAE,CAAC;AAChE,CAAC;AAQD,wEAAwE;AACxE,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACtC,OAII,EAAE;IAEN,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,KAAK,CAAC;IAC1C,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,kBAAkB,EAAE,CAAC;IACvD,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAEtD,MAAM,GAAG,GAAG,WAAW,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAC1C,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,GAAG,CAAC,CAAC;IACtC,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CACX,qCAAqC,GAAG,WAAW,QAAQ,CAAC,MAAM,GAAG,CACxE,CAAC;IACN,CAAC;IACD,MAAM,QAAQ,GAAG,aAAa,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC;IACxE,MAAM,QAAQ,GAAG,QAAQ,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;IAC9C,IAAI,CAAC,QAAQ,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CACX,mBAAmB,QAAQ,CAAC,OAAO,WAAW,QAAQ,SAAS,CAClE,CAAC;IACN,CAAC;IACD,sEAAsE;IACtE,sEAAsE;IACtE,uEAAuE;IACvE,mDAAmD;IACnD,wBAAwB,CAAC,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IAChD,OAAO,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC;AAC7D,CAAC;AAED,uEAAuE;AACvE,oEAAoE;AACpE,iEAAiE;AACjE,MAAM,UAAU,wBAAwB,CACpC,WAAmB,EACnB,OAAe;IAEf,IAAI,QAAa,CAAC;IAClB,IAAI,CAAC;QACD,QAAQ,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC;IACpC,CAAC;IAAC,MAAM,CAAC;QACL,MAAM,IAAI,KAAK,CACX,qDAAqD,WAAW,GAAG,CACtE,CAAC;IACN,CAAC;IACD,qEAAqE;IACrE,mCAAmC;IACnC,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC;IAC9B,IAAI,IAAI,CAAC,QAAQ,KAAK,QAAQ,IAAI,QAAQ,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC/D,MAAM,IAAI,KAAK,CACX,iDAAiD,WAAW,GAAG,CAClE,CAAC;IACN,CAAC;IACD,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACnD,MAAM,UAAU,GACZ,QAAQ,CAAC,MAAM,KAAK,IAAI,CAAC,MAAM;QAC/B,CAAC,QAAQ,CAAC,QAAQ,KAAK,QAAQ;YAC3B,QAAQ,CAAC,QAAQ,CAAC,UAAU,CAAC,GAAG,QAAQ,GAAG,CAAC,CAAC,CAAC;IACtD,IAAI,CAAC,UAAU,EAAE,CAAC;QACd,MAAM,IAAI,KAAK,CACX,iCAAiC,WAAW,oBAAoB;YAC5D,wBAAwB,OAAO,GAAG,CACzC,CAAC;IACN,CAAC;AACL,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC5B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAChF,CAAC;AAED,SAAS,GAAG,CAAC,KAAc,EAAE,KAAa;IACtC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,EAAE,CAAC;QACtC,MAAM,IAAI,KAAK,CAAC,2BAA2B,KAAK,eAAe,CAAC,CAAC;IACrE,CAAC;IACD,OAAO,KAAK,CAAC;AACjB,CAAC"}

package/dist/gateway/platform.d.ts

@@ -0,0 +1,5 @@
+export type GatewayPlatform = "linux-x64";
+export declare function currentPlatformKey(platform?: NodeJS.Platform, arch?: string): GatewayPlatform;
+export declare function archiveExtension(_platform: GatewayPlatform): "tar.gz";
+export declare function archivedBinaryCandidates(platform: GatewayPlatform): string[];
+export declare function installedBinaryName(_platform: GatewayPlatform): string;

package/dist/gateway/platform.js

@@ -0,0 +1,27 @@
+// Maps the host to a published gateway artifact. Linux-only for now: the
+// release workflow builds just linux-x64. macOS/Windows are planned; until
+// then non-Linux hosts fail clearly rather than silently mis-resolving.
+import os from "node:os";
+export function currentPlatformKey(platform = os.platform(), arch = os.arch()) {
+    if (platform === "linux" && arch === "x64")
+        return "linux-x64";
+    throw new Error(`No Sleeve gateway binary is available for ${platform}-${arch}. ` +
+        "Only linux-x64 is supported right now (macOS/Windows planned).");
+}
+// Archive container the workflow publishes (tar.gz on Linux).
+export function archiveExtension(_platform) {
+    return "tar.gz";
+}
+// Candidate names of the executable *inside* the archive, in priority order.
+// Releases publish `sleeve-gateway-linux-x64` going forward; older published
+// releases still contain `sleeve-proxy-linux-x64` (the channel manifest only
+// ever points at the latest, but we stay tolerant across the rename so
+// acquisition keeps working during the transition).
+export function archivedBinaryCandidates(platform) {
+    return [`sleeve-gateway-${platform}`, `sleeve-proxy-${platform}`];
+}
+// Installed executable filename (platform-stable; version lives in the path).
+export function installedBinaryName(_platform) {
+    return "sleeve-gateway";
+}
+//# sourceMappingURL=platform.js.map

package/dist/gateway/platform.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"platform.js","sourceRoot":"","sources":["../../src/gateway/platform.ts"],"names":[],"mappings":"AAAA,yEAAyE;AACzE,2EAA2E;AAC3E,wEAAwE;AACxE,OAAO,EAAE,MAAM,SAAS,CAAC;AAIzB,MAAM,UAAU,kBAAkB,CAC9B,WAA4B,EAAE,CAAC,QAAQ,EAAE,EACzC,OAAe,EAAE,CAAC,IAAI,EAAE;IAExB,IAAI,QAAQ,KAAK,OAAO,IAAI,IAAI,KAAK,KAAK;QAAE,OAAO,WAAW,CAAC;IAC/D,MAAM,IAAI,KAAK,CACX,6CAA6C,QAAQ,IAAI,IAAI,IAAI;QAC7D,gEAAgE,CACvE,CAAC;AACN,CAAC;AAED,8DAA8D;AAC9D,MAAM,UAAU,gBAAgB,CAAC,SAA0B;IACvD,OAAO,QAAQ,CAAC;AACpB,CAAC;AAED,6EAA6E;AAC7E,6EAA6E;AAC7E,6EAA6E;AAC7E,uEAAuE;AACvE,oDAAoD;AACpD,MAAM,UAAU,wBAAwB,CAAC,QAAyB;IAC9D,OAAO,CAAC,kBAAkB,QAAQ,EAAE,EAAE,gBAAgB,QAAQ,EAAE,CAAC,CAAC;AACtE,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,mBAAmB,CAAC,SAA0B;IAC1D,OAAO,gBAAgB,CAAC;AAC5B,CAAC"}

package/dist/harness/claude.d.ts

@@ -0,0 +1,8 @@
+import type { HarnessAuth } from "./types.js";
+export type ClaudePatchResult = {
+    path: string;
+};
+export declare function setupClaude(auth: HarnessAuth, path?: string): Promise<ClaudePatchResult>;
+export declare function patchClaude(auth: HarnessAuth, path?: string): Promise<ClaudePatchResult>;
+export declare function unpatchClaude(path?: string): Promise<void>;
+export declare function claudePath(env?: NodeJS.ProcessEnv): string;

package/dist/{apps → harness}/claude.js

@@ -1,17 +1,13 @@
 // Claude Code setup owns global settings patching for the Anthropic-compatible proxy.
-import { chmod, mkdir, readFile, writeFile } from 'node:fs/promises';
-import { homedir } from 'node:os';
-import { dirname, join } from 'node:path';
-import { field, success } from '../terminal.js';
-const BASE = 'ANTHROPIC_BASE_URL';
-const CUSTOM = 'ANTHROPIC_CUSTOM_HEADERS';
-const HARNESS = 'claude code';
-const OLD_HARNESS = 'claude-code';
+import { chmod, mkdir, readFile, writeFile } from "node:fs/promises";
+import { homedir } from "node:os";
+import { dirname, join } from "node:path";
+const BASE = "ANTHROPIC_BASE_URL";
+const CUSTOM = "ANTHROPIC_CUSTOM_HEADERS";
+const HARNESS = "claude code";
+const OLD_HARNESS = "claude-code";
 export async function setupClaude(auth, path = claudePath()) {
-    const result = await patchClaude(auth, path);
-    success(process.stdout, 'Configured Claude Code');
-    field(process.stdout, 'config', result.path);
-    return result;
+    return patchClaude(auth, path);
 }
 export async function patchClaude(auth, path = claudePath()) {
     const existing = await readJson(path);
@@ -24,14 +20,14 @@ export async function unpatchClaude(path = claudePath()) {
     if (!existing)
         return;
     const env = object(existing.env);
-    if (typeof env.ANTHROPIC_CUSTOM_HEADERS !== 'string')
+    if (typeof env.ANTHROPIC_CUSTOM_HEADERS !== "string")
         return;
     if (!patched(env))
         return;
     await writeJson(path, removeBackup({ ...existing, env: restoreEnv(env, backup(existing)) }));
 }
 export function claudePath(env = process.env) {
-    return join(env.CLAUDE_CONFIG_DIR || join(homedir(), '.claude'), 'settings.json');
+    return join(env.CLAUDE_CONFIG_DIR || join(homedir(), ".claude"), "settings.json");
 }
 function patchConfig(input, auth) {
     const env = object(input.env);
@@ -48,14 +44,14 @@ function patchConfig(input, auth) {
 function headers(auth) {
     return [
         `sleeve-token: ${auth.token}`,
-        'sleeve-provider: anthropic',
+        "sleeve-provider: anthropic",
         `sleeve-harness: ${HARNESS}`,
-    ].join('\n');
+    ].join("\n");
 }
 function backup(input) {
     const sleev = object(input.sleev);
     const claude = object(sleev.claudeCode);
-    if (!('previousEnv' in claude))
+    if (!("previousEnv" in claude))
         return null;
     return object(claude.previousEnv);
 }
@@ -102,50 +98,54 @@ function restoreEnv(env, previous) {
 }
 function patched(env) {
     const value = env[CUSTOM];
-    if (typeof value !== 'string')
+    if (typeof value !== "string")
         return false;
-    return value.includes(`sleeve-harness: ${HARNESS}`) || value.includes(`sleeve-harness: ${OLD_HARNESS}`);
+    return (value.includes(`sleeve-harness: ${HARNESS}`) ||
+        value.includes(`sleeve-harness: ${OLD_HARNESS}`));
 }
 async function writeJson(path, config) {
     await mkdir(dirname(path), { recursive: true, mode: 0o700 });
-    await writeFile(path, `${JSON.stringify(config, null, 2)}\n`, { mode: 0o600 });
+    await writeFile(path, `${JSON.stringify(config, null, 2)}\n`, {
+        mode: 0o600,
+    });
     await chmod(path, 0o600);
 }
 async function readJson(path) {
     try {
-        const raw = await readFile(path, 'utf8');
+        const raw = await readFile(path, "utf8");
         const parsed = JSON.parse(raw);
         return object(parsed);
     }
     catch (err) {
-        if (code(err) === 'ENOENT')
+        if (code(err) === "ENOENT")
             return {};
         throw err;
     }
 }
 async function readExistingJson(path) {
     try {
-        const raw = await readFile(path, 'utf8');
+        const raw = await readFile(path, "utf8");
         const parsed = JSON.parse(raw);
         return object(parsed);
     }
     catch (err) {
-        if (code(err) === 'ENOENT')
+        if (code(err) === "ENOENT")
             return null;
         throw err;
     }
 }
 function object(value) {
-    if (typeof value !== 'object' || value === null || Array.isArray(value))
+    if (typeof value !== "object" || value === null || Array.isArray(value))
         return {};
     return value;
 }
 function trim(url) {
-    return url.replace(/\/+$/, '');
+    return url.replace(/\/+$/, "");
 }
 function code(err) {
-    if (typeof err !== 'object' || err === null || !('code' in err))
+    if (typeof err !== "object" || err === null || !("code" in err))
         return undefined;
     const value = err.code;
-    return typeof value === 'string' ? value : undefined;
+    return typeof value === "string" ? value : undefined;
 }
+//# sourceMappingURL=claude.js.map