svamp-cli 0.2.268 → 0.2.269

package/dist/serveManager-CswGKYKJ.mjs

@@ -1,902 +0,0 @@
-import { spawn, execSync } from 'child_process';
-import * as crypto from 'crypto';
-import * as fs from 'fs';
-import * as http from 'http';
-import * as net from 'net';
-import * as path from 'path';
-import { serveStaticMount } from './staticFileServer-CbYnj2bH.mjs';
-import { j as getHyphaServerUrl, S as ServeAuth, k as hasCookieToken } from './run-BtoxvDlh.mjs';
-import 'os';
-import 'fs/promises';
-import 'url';
-import 'node:crypto';
-import 'node:fs';
-import 'node:child_process';
-import 'util';
-import 'node:os';
-import 'node:path';
-import 'node:events';
-import '@agentclientprotocol/sdk';
-import 'node:readline';
-import 'node:fs/promises';
-import 'node:util';
-import 'yaml';
-
-function generateLinkToken() {
-  return crypto.randomBytes(11).toString("hex");
-}
-const DNS_LABEL_MAX = 63;
-function buildLinkSubdomain(subdomainSafe, linkToken) {
-  const prefix = "static-";
-  const room = Math.max(1, DNS_LABEL_MAX - prefix.length - 1 - linkToken.length);
-  const namePart = subdomainSafe.slice(0, room).replace(/-+$/, "") || "s";
-  return `${prefix}${namePart}-${linkToken}`;
-}
-function findFreePort() {
-  return new Promise((resolve, reject) => {
-    const srv = net.createServer();
-    srv.listen(0, "127.0.0.1", () => {
-      const addr = srv.address();
-      srv.close(() => resolve(addr.port));
-    });
-    srv.on("error", reject);
-  });
-}
-async function tryReservePort(preferred) {
-  if (!preferred || preferred <= 0) return findFreePort();
-  return new Promise((resolve) => {
-    const srv = net.createServer();
-    srv.once("error", () => {
-      resolve(findFreePort());
-    });
-    srv.listen(preferred, "127.0.0.1", () => {
-      srv.close(() => resolve(preferred));
-    });
-  });
-}
-function killOrphanedCaddy(log) {
-  if (process.platform === "win32") return;
-  try {
-    const out = execSync("ps -axo pid=,command=", { encoding: "utf-8" });
-    const pids = [];
-    for (const line of out.split("\n")) {
-      const m = /^\s*(\d+)\s+(.*)$/.exec(line);
-      if (!m) continue;
-      const [, pid, cmd] = m;
-      if (cmd.includes(".svamp/bin/caddy") && pid !== String(process.pid)) pids.push(pid);
-    }
-    for (const pid of pids) {
-      try {
-        process.kill(Number(pid), "SIGKILL");
-      } catch {
-      }
-    }
-    if (pids.length) log(`Reaped ${pids.length} orphaned Caddy process(es) \u2014 retired in favor of the native file server (#0358).`);
-  } catch {
-  }
-}
-const MOUNT_NAME_RE = /^[a-zA-Z0-9][a-zA-Z0-9._-]*$/;
-function validateMountName(name) {
-  if (!name || name.length > 128) {
-    throw new Error("Mount name must be 1\u2013128 characters");
-  }
-  if (!MOUNT_NAME_RE.test(name)) {
-    throw new Error("Mount name must start with alphanumeric and contain only alphanumeric, hyphens, dots, or underscores");
-  }
-}
-class ServeManager {
-  mounts = /* @__PURE__ */ new Map();
-  port = 0;
-  // public HTTP server port (serves static files natively — #0358)
-  /** Last-used port loaded from disk — used as the preferred value on next start
-   *  so external configs (tunnels, cron, bookmarks) survive daemon restarts. */
-  persistedPort;
-  /** Per-mount frpc tunnel — each mount gets its own subdomain `static-<name>-<hash>`. */
-  mountTunnels = /* @__PURE__ */ new Map();
-  /** hostname (lowercased, no port) → mount name. Updated when tunnels connect. */
-  hostToMount = /* @__PURE__ */ new Map();
-  proxyServer = null;
-  auth = null;
-  /** Live child processes for managed mounts. Keyed by mount name. */
-  managedProcs = /* @__PURE__ */ new Map();
-  /** Single timer that scans managed mounts every 30s for idle eviction. */
-  idleTimer = null;
-  persistFile;
-  log;
-  hyphaServerUrl;
-  constructor(svampHome, logger, hyphaServerUrl) {
-    this.persistFile = path.join(svampHome, "serve-mounts.json");
-    this.log = logger || ((msg) => console.log(`[SERVE] ${msg}`));
-    const resolvedServerUrl = hyphaServerUrl || getHyphaServerUrl();
-    if (!resolvedServerUrl) {
-      throw new Error("ServeManager requires a Hypha server URL \u2014 set HYPHA_SERVER_URL.");
-    }
-    this.hyphaServerUrl = resolvedServerUrl;
-    this.auth = new ServeAuth({ hyphaServerUrl: this.hyphaServerUrl });
-  }
-  // ── Public API ───────────────────────────────────────────────────────
-  /**
-   * Add a static mount (backward-compatible thin wrapper around applyMount).
-   * Throws if a mount with the same name already exists, preserving the
-   * pre-existing semantics that callers may depend on.
-   */
-  async addMount(name, directory, sessionId, access = "link", ownerEmail) {
-    if (this.mounts.has(name)) {
-      throw new Error(`Mount '${name}' already exists. Remove it first or choose a different name.`);
-    }
-    return this.applyMount({ name, directory, sessionId, access, ownerEmail });
-  }
-  /**
-   * Apply a mount declaratively. Unifies static and managed-process mounts:
-   * pass `directory` for static, `process` for managed (or both — `process`
-   * takes precedence for routing). Replaces an existing mount with the same
-   * name (idempotent), so repeated `svamp serve apply` is safe.
-   *
-   * Backward-compatible: existing `addMount(name, directory, ...)` callers
-   * still work and produce the same result as `applyMount({name, directory, ...})`.
-   */
-  async applyMount(spec) {
-    validateMountName(spec.name);
-    if (!spec.directory && !spec.process) {
-      throw new Error(`Mount '${spec.name}': must specify either directory (static) or process (managed)`);
-    }
-    if (spec.process) {
-      if (!spec.process.command) {
-        throw new Error(`Mount '${spec.name}': process.command is required`);
-      }
-      if (!spec.process.port || spec.process.port <= 0) {
-        throw new Error(`Mount '${spec.name}': process.port must be a positive integer`);
-      }
-    }
-    const resolvedDir = spec.directory ? path.resolve(spec.directory) : void 0;
-    if (resolvedDir && !fs.existsSync(resolvedDir)) {
-      throw new Error(`Path does not exist: ${resolvedDir}`);
-    }
-    if (this.mounts.has(spec.name)) {
-      await this.removeMount(spec.name);
-    }
-    const access = spec.access ?? "link";
-    if (access === "owner" && !spec.ownerEmail) {
-      this.log(`\u26A0 Mount '${spec.name}': access='owner' but no owner email could be resolved \u2014 NO ONE will be able to sign in. Use an explicit email allowlist instead, e.g. access: ["you@example.com"].`);
-    }
-    const mount = {
-      name: spec.name,
-      directory: resolvedDir,
-      process: spec.process,
-      sessionId: spec.sessionId,
-      ownerEmail: spec.ownerEmail,
-      access,
-      // Generate a capability token if access is 'link' and we don't
-      // already have one from persisted state (token is stable across
-      // restarts).
-      linkToken: access === "link" ? spec.linkToken || generateLinkToken() : void 0,
-      addedAt: Date.now()
-    };
-    this.mounts.set(spec.name, mount);
-    await this.ensureRunning();
-    await this.startMountTunnel(spec.name);
-    if (spec.process && !spec.process.wakeOnRequest) {
-      try {
-        await this.ensureManagedRunning(spec.name);
-      } catch (err) {
-        this.log(`Mount '${spec.name}': initial process start failed: ${err.message}`);
-      }
-    }
-    this.ensureIdleTimer();
-    this.persist();
-    const url = this.getMountUrl(spec.name);
-    const what = spec.process ? `${spec.process.command}${spec.process.args?.length ? " " + spec.process.args.join(" ") : ""} (port ${spec.process.port})` : resolvedDir;
-    this.log(`Mount applied: ${spec.name} \u2192 ${what} (${url ?? "tunnel pending"})`);
-    return { url: url || "", mount };
-  }
-  /**
-   * Remove a mount. If no mounts remain, stop Caddy + auth proxy.
-   */
-  async removeMount(name) {
-    if (!this.mounts.has(name)) {
-      throw new Error(`Mount '${name}' not found`);
-    }
-    this.mounts.delete(name);
-    await this.stopManagedProcess(name).catch(() => {
-    });
-    const tunnel = this.mountTunnels.get(name);
-    if (tunnel) {
-      try {
-        tunnel.destroy();
-      } catch {
-      }
-      this.mountTunnels.delete(name);
-    }
-    for (const [host, mountName] of this.hostToMount.entries()) {
-      if (mountName === name) this.hostToMount.delete(host);
-    }
-    this.persist();
-    this.log(`Mount removed: ${name}`);
-    if (this.mounts.size === 0) {
-      await this.shutdown();
-    }
-  }
-  /**
-   * List mounts, optionally filtered by sessionId.
-   */
-  listMounts(sessionId) {
-    const all = Array.from(this.mounts.values());
-    if (sessionId) {
-      return all.filter((m) => m.sessionId === sessionId);
-    }
-    return all;
-  }
-  /**
-   * Get server info — each mount has its own URL (per-mount subdomain).
-   */
-  getInfo() {
-    const running = this.proxyServer != null;
-    const firstMount = this.mounts.values().next().value;
-    const firstUrl = firstMount ? this.getMountUrl(firstMount.name) : null;
-    return {
-      url: firstUrl,
-      port: running ? this.port : 0,
-      authProxyPort: running ? this.port : 0,
-      running,
-      mountCount: this.mounts.size,
-      mounts: Array.from(this.mounts.values()).map((m) => ({
-        ...m,
-        url: this.getMountUrl(m.name) || void 0
-      }))
-    };
-  }
-  /**
-   * Restore mounts from disk and restart if there are persisted mounts.
-   * Called during daemon startup.
-   */
-  async restore() {
-    try {
-      if (!fs.existsSync(this.persistFile)) return;
-      const raw = JSON.parse(fs.readFileSync(this.persistFile, "utf-8"));
-      this.persistedPort = raw.port;
-      if (!raw.mounts || raw.mounts.length === 0) return;
-      let restoredCount = 0;
-      for (const m of raw.mounts) {
-        if (m.directory && !fs.existsSync(m.directory)) {
-          this.log(`Skipping mount '${m.name}': directory no longer exists (${m.directory})`);
-          continue;
-        }
-        if (!m.directory && !m.process) {
-          this.log(`Skipping mount '${m.name}': neither directory nor process configured`);
-          continue;
-        }
-        this.mounts.set(m.name, m);
-        restoredCount++;
-      }
-      if (restoredCount > 0) {
-        this.log(`Restoring ${restoredCount} mount(s)...`);
-        await this.ensureRunning();
-        const mountList = Array.from(this.mounts.values());
-        const mountConcurrency = Math.max(1, parseInt(process.env.SVAMP_RESTORE_CONCURRENCY || "8", 10) || 8);
-        const restoreOneMount = async (m) => {
-          try {
-            await this.startMountTunnel(m.name);
-          } catch (err) {
-            this.log(`Failed to start tunnel for restored mount '${m.name}': ${err.message}`);
-          }
-          if (m.process && !m.process.wakeOnRequest) {
-            try {
-              await this.ensureManagedRunning(m.name);
-            } catch (err) {
-              this.log(`Restored managed process '${m.name}' failed to start: ${err.message}`);
-            }
-          }
-        };
-        let mountCursor = 0;
-        const mountWorker = async () => {
-          while (mountCursor < mountList.length) {
-            await restoreOneMount(mountList[mountCursor++]);
-          }
-        };
-        const mt0 = Date.now();
-        await Promise.all(
-          Array.from({ length: Math.min(mountConcurrency, mountList.length) }, () => mountWorker())
-        );
-        this.log(`Restored ${mountList.length} mount(s) in ${Date.now() - mt0}ms (concurrency ${mountConcurrency})`);
-        this.ensureIdleTimer();
-        this.persist();
-      }
-    } catch (err) {
-      this.log(`Error restoring serve state: ${err.message}`);
-    }
-  }
-  /**
-   * Shut down auth proxy + Caddy + all per-mount frpc tunnels + all
-   * managed processes.
-   */
-  async shutdown() {
-    for (const name of Array.from(this.managedProcs.keys())) {
-      await this.stopManagedProcess(name).catch(() => {
-      });
-    }
-    if (this.idleTimer) {
-      clearInterval(this.idleTimer);
-      this.idleTimer = null;
-    }
-    for (const [name, tunnel] of this.mountTunnels.entries()) {
-      try {
-        tunnel.destroy();
-      } catch {
-      }
-      this.log(`frpc tunnel for '${name}' stopped`);
-    }
-    this.mountTunnels.clear();
-    this.hostToMount.clear();
-    if (this.proxyServer) {
-      await new Promise((resolve) => this.proxyServer.close(() => resolve()));
-      this.proxyServer = null;
-    }
-    this.auth?.destroy();
-  }
-  // ── Managed-process lifecycle ─────────────────────────────────────────
-  /**
-   * Ensure the managed process for a mount is running and warm. If a warmup
-   * is already in flight, awaits the same promise (no duplicate spawns).
-   * Throws if warmup probe never returns 200/3xx within warmupTimeoutMs.
-   */
-  async ensureManagedRunning(name) {
-    const mount = this.mounts.get(name);
-    if (!mount?.process) return;
-    const handle = this.managedProcs.get(name);
-    if (handle && handle.warmupPromise) {
-      return handle.warmupPromise;
-    }
-    if (handle && handle.child.exitCode === null && !handle.child.killed) {
-      handle.lastRequestAt = Date.now();
-      return;
-    }
-    const cfg = mount.process;
-    const child = spawn(cfg.command, cfg.args ?? [], {
-      cwd: cfg.workdir ?? process.cwd(),
-      env: { ...process.env, ...cfg.env ?? {} },
-      stdio: ["ignore", "pipe", "pipe"],
-      detached: false
-    });
-    child.stdout?.on("data", (d) => {
-      const line = d.toString().trimEnd();
-      if (line) this.log(`[${name}] ${line}`);
-    });
-    child.stderr?.on("data", (d) => {
-      const line = d.toString().trimEnd();
-      if (line) this.log(`[${name}] ${line}`);
-    });
-    child.on("exit", (code, signal) => {
-      this.log(`Managed process '${name}' exited (code=${code}, signal=${signal})`);
-      const h = this.managedProcs.get(name);
-      if (h && h.child === child) this.managedProcs.delete(name);
-    });
-    const warmupPath = cfg.warmupPath ?? "/";
-    const warmupTimeoutMs = cfg.warmupTimeoutMs ?? 3e4;
-    const warmupPromise = this.warmupProbe(`http://127.0.0.1:${cfg.port}${warmupPath}`, warmupTimeoutMs).then(() => {
-      const h = this.managedProcs.get(name);
-      if (h) {
-        h.warmupPromise = null;
-        h.lastRequestAt = Date.now();
-      }
-      this.log(`Managed process '${name}' ready on 127.0.0.1:${cfg.port}`);
-    }).catch((err) => {
-      this.log(`Managed process '${name}' warmup failed: ${err.message}`);
-      try {
-        child.kill("SIGTERM");
-      } catch {
-      }
-      this.managedProcs.delete(name);
-      throw err;
-    });
-    const newHandle = {
-      child,
-      pid: child.pid ?? 0,
-      lastRequestAt: Date.now(),
-      warmupPromise
-    };
-    this.managedProcs.set(name, newHandle);
-    this.log(`Managed process '${name}' starting: ${cfg.command} ${(cfg.args ?? []).join(" ")} (port ${cfg.port})`);
-    return warmupPromise;
-  }
-  /** Poll a URL until it returns <500 or the deadline passes. */
-  async warmupProbe(url, timeoutMs) {
-    const deadline = Date.now() + timeoutMs;
-    let lastErr;
-    while (Date.now() < deadline) {
-      try {
-        const ctrl = new AbortController();
-        const t = setTimeout(() => ctrl.abort(), 2e3);
-        let resp;
-        try {
-          resp = await fetch(url, {
-            method: "GET",
-            signal: ctrl.signal,
-            redirect: "manual"
-          });
-        } finally {
-          clearTimeout(t);
-        }
-        if (resp.status < 500) return;
-        lastErr = new Error(`status ${resp.status}`);
-      } catch (err) {
-        lastErr = err;
-      }
-      await new Promise((r) => setTimeout(r, 500));
-    }
-    throw new Error(`warmup probe ${url} did not respond within ${timeoutMs}ms (${lastErr?.message || "no response"})`);
-  }
-  /** Stop a managed process (SIGTERM + SIGKILL after 5s). */
-  async stopManagedProcess(name) {
-    const h = this.managedProcs.get(name);
-    if (!h) return;
-    this.managedProcs.delete(name);
-    try {
-      h.child.kill("SIGTERM");
-    } catch {
-    }
-    const child = h.child;
-    await new Promise((resolve) => {
-      const t = setTimeout(() => {
-        try {
-          child.kill("SIGKILL");
-        } catch {
-        }
-        resolve();
-      }, 5e3);
-      child.once("exit", () => {
-        clearTimeout(t);
-        resolve();
-      });
-    });
-    this.log(`Managed process '${name}' stopped`);
-  }
-  /** Idle eviction loop — stops processes that have been idle longer than configured. */
-  ensureIdleTimer() {
-    if (this.idleTimer) return;
-    this.idleTimer = setInterval(() => {
-      const now = Date.now();
-      for (const [name, mount] of this.mounts) {
-        const cfg = mount.process;
-        if (!cfg || !cfg.idleTimeoutSec || cfg.idleTimeoutSec <= 0) continue;
-        const h = this.managedProcs.get(name);
-        if (!h || h.warmupPromise) continue;
-        if (now - h.lastRequestAt >= cfg.idleTimeoutSec * 1e3) {
-          this.log(`Idle eviction: stopping '${name}' (idle ${Math.round((now - h.lastRequestAt) / 1e3)}s \u2265 ${cfg.idleTimeoutSec}s)`);
-          this.stopManagedProcess(name).catch(() => {
-          });
-        }
-      }
-    }, 3e4);
-  }
-  // ── Internal ─────────────────────────────────────────────────────────
-  /**
-   * Get the public URL for a mount (mount-specific subdomain).
-   * For `access: 'link'` mounts, the subdomain itself carries the capability —
-   * the tunnel registers a long random suffix (~128 bits of entropy), so the
-   * URL is identical in shape to other tiers, just longer. Content serves
-   * from the root, so HTML with absolute paths (`/style.css`, `/app.js`)
-   * works unchanged.
-   */
-  getMountUrl(name) {
-    const tunnel = this.mountTunnels.get(name);
-    const tunnelUrl = tunnel?.getUrls().get(this.port);
-    if (tunnelUrl) return `${tunnelUrl}/`;
-    if (this.port) return `http://127.0.0.1:${this.port}/${name}/`;
-    return null;
-  }
-  persist() {
-    const state = {
-      mounts: Array.from(this.mounts.values()),
-      ...this.port > 0 ? { port: this.port } : {}
-    };
-    try {
-      fs.writeFileSync(this.persistFile, JSON.stringify(state, null, 2));
-    } catch (err) {
-      this.log(`Error persisting serve state: ${err.message}`);
-    }
-  }
-  /** Start auth proxy + Caddy if not already running. Per-mount tunnels are started separately. */
-  async ensureRunning() {
-    if (this.proxyServer) return;
-    killOrphanedCaddy((m) => this.log(m));
-    this.port = await tryReservePort(this.persistedPort);
-    if (this.persistedPort && this.port !== this.persistedPort) {
-      this.log(`\u26A0 Previous serve port ${this.persistedPort} unavailable \u2014 using ${this.port}. Downstream configs referencing the old port will need updating.`);
-    }
-    await this.startAuthProxy();
-    this.log(`Static file server started on 127.0.0.1:${this.port}`);
-  }
-  /** Minimal mount-listing page for the server root (replaces Caddy's root route). */
-  mountListHtml() {
-    const esc = (s) => s.replace(/[&<>"']/g, (c) => ({ "&": "&amp;", "<": "&lt;", ">": "&gt;", '"': "&quot;", "'": "&#39;" })[c]);
-    const items = Array.from(this.mounts.values()).filter((m) => m.directory).map((m) => `<li><a href="/${esc(m.name)}/">${esc(m.name)}</a> \u2014 ${esc(m.directory || "")}</li>`).join("\n");
-    return `<!DOCTYPE html><html><head><meta charset="utf-8"><title>Svamp File Server</title>
-<style>body{font-family:system-ui,sans-serif;max-width:700px;margin:40px auto;padding:0 20px;color:#333}
-h1{font-size:1.3rem}ul{list-style:none;padding:0}li{padding:8px 0;border-bottom:1px solid #eee}
-a{color:#0969da;text-decoration:none;font-weight:500}a:hover{text-decoration:underline}</style></head>
-<body><h1>Svamp File Server</h1><ul>${items || "<li>No mounts registered.</li>"}</ul></body></html>`;
-  }
-  /** Start a lightweight Node.js HTTP proxy with auth + upload support. */
-  startAuthProxy() {
-    return new Promise((resolve, reject) => {
-      const server = http.createServer(async (req, res) => {
-        const url = new URL(req.url || "/", `http://127.0.0.1:${this.port}`);
-        const incomingHost = (req.headers.host || "").split(":")[0].toLowerCase();
-        const hostMount = this.hostToMount.get(incomingHost);
-        let mountName;
-        let mountResolvedByHost = false;
-        let basePath;
-        if (hostMount && this.mounts.has(hostMount)) {
-          mountName = hostMount;
-          mountResolvedByHost = true;
-          basePath = url.pathname;
-        } else {
-          mountName = url.pathname.split("/").filter(Boolean)[0];
-          basePath = mountName ? url.pathname.slice(`/${mountName}`.length) || "/" : url.pathname;
-        }
-        const mount = mountName ? this.mounts.get(mountName) : void 0;
-        if (basePath === "/__svamp_health" || url.pathname === "/__svamp_health") {
-          res.writeHead(200, {
-            "Content-Type": "application/json",
-            "Cache-Control": "no-store"
-          });
-          res.end(JSON.stringify({
-            ok: true,
-            mount: mountName || null,
-            ts: Date.now()
-          }));
-          return;
-        }
-        if (basePath === "/__login__" || url.pathname === "/__login__") {
-          const returnUrl = url.searchParams.get("return") || "/";
-          const isSameOriginPath = returnUrl.startsWith("/") && !returnUrl.startsWith("//") && !returnUrl.startsWith("/__login__");
-          const safeReturn = isSameOriginPath ? returnUrl : "/";
-          const html = this.auth ? this.auth.getLoginPageHtml(safeReturn) : "<h1>Auth not configured</h1>";
-          res.writeHead(200, {
-            "Content-Type": "text/html; charset=utf-8",
-            "Cache-Control": "no-store"
-          });
-          res.end(html);
-          return;
-        }
-        if (mount && mount.access !== "public" && mount.access !== "link") {
-          const userEmail = this.auth ? await this.auth.authenticate(req).catch(() => null) : null;
-          if (mount.access === "owner" && !mount.ownerEmail) {
-            this.log(`Auth DENY '${mountName}': owner-only mount but ownerEmail is empty (misconfigured \u2014 the daemon's token has no email claim). Set access to an explicit email allowlist. requester=${userEmail || "anonymous"}`);
-            const html = this.auth ? this.auth.getAccessDeniedHtml({ email: userEmail, access: mount.access, ownerEmail: mount.ownerEmail, misconfigured: true, returnUrl: req.url || "/" }) : "Access denied (misconfigured owner mount).";
-            res.writeHead(403, { "Content-Type": "text/html; charset=utf-8", "Cache-Control": "no-store" });
-            res.end(html);
-            return;
-          }
-          const allowed = this.auth ? this.auth.isAuthorized(userEmail, mount.access, mount.ownerEmail) : false;
-          if (!allowed) {
-            if (!userEmail) {
-              this.log(`Auth: '${mountName}' requires sign-in (no valid token) \u2014 redirecting to /__login__`);
-              const loginUrl = `/__login__?return=${encodeURIComponent(req.url || "/")}`;
-              const headers = { Location: loginUrl };
-              if (hasCookieToken(req)) {
-                headers["Set-Cookie"] = "svamp_serve_token=; Path=/; Max-Age=0; SameSite=Lax";
-              }
-              res.writeHead(302, headers);
-              res.end();
-              return;
-            }
-            const need = mount.access === "owner" ? `owner (${mount.ownerEmail || "unset"})` : `one of [${mount.access.join(", ")}]`;
-            this.log(`Auth DENY '${mountName}': '${userEmail}' is not authorized (requires ${need})`);
-            const html = this.auth ? this.auth.getAccessDeniedHtml({ email: userEmail, access: mount.access, ownerEmail: mount.ownerEmail, returnUrl: req.url || "/" }) : `Access denied for ${userEmail}.`;
-            res.writeHead(403, { "Content-Type": "text/html; charset=utf-8", "Cache-Control": "no-store" });
-            res.end(html);
-            return;
-          }
-          this.log(`Auth OK '${mountName}': ${userEmail}`);
-        }
-        const resolveContained = () => {
-          const base = path.resolve(mount.directory);
-          const fp = path.resolve(path.join(base, basePath));
-          if (fp !== base && !fp.startsWith(base + path.sep)) return null;
-          try {
-            const realRoot = fs.realpathSync(base);
-            let ancestor = fp;
-            while (!fs.existsSync(ancestor) && path.dirname(ancestor) !== ancestor) {
-              ancestor = path.dirname(ancestor);
-            }
-            const realAncestor = fs.realpathSync(ancestor);
-            if (realAncestor !== realRoot && !realAncestor.startsWith(realRoot + path.sep)) return null;
-            if (fs.existsSync(fp) && fs.lstatSync(fp).isSymbolicLink()) {
-              const realTarget = fs.realpathSync(fp);
-              if (realTarget !== realRoot && !realTarget.startsWith(realRoot + path.sep)) return null;
-            }
-          } catch {
-            return null;
-          }
-          return fp;
-        };
-        if ((req.method === "PUT" || req.method === "DELETE") && mount && mount.directory) {
-          if (mount.access === "public") {
-            this.log(`Write DENY '${mountName}': ${req.method} not allowed on a public (unauthenticated) mount`);
-            res.writeHead(403, { "Content-Type": "text/plain" });
-            res.end("Write access denied: public mounts are read-only.");
-            return;
-          }
-          const filePath = resolveContained();
-          if (!filePath) {
-            this.log(`Write DENY '${mountName}': path escapes mount root (${basePath})`);
-            res.writeHead(403, { "Content-Type": "text/plain" });
-            res.end("Forbidden: path escapes mount root.");
-            return;
-          }
-          if (req.method === "PUT") {
-            fs.mkdirSync(path.dirname(filePath), { recursive: true });
-            const ws = fs.createWriteStream(filePath);
-            req.pipe(ws);
-            ws.on("finish", () => {
-              res.writeHead(201);
-              res.end();
-            });
-            ws.on("error", (err) => {
-              res.writeHead(500);
-              res.end(err.message);
-            });
-            return;
-          }
-          try {
-            fs.unlinkSync(filePath);
-            res.writeHead(204);
-            res.end();
-          } catch (err) {
-            res.writeHead(err.code === "ENOENT" ? 404 : 500);
-            res.end(err.message);
-          }
-          return;
-        }
-        if (mount && mount.process) {
-          const cfg = mount.process;
-          if (cfg.wakeOnRequest || !this.managedProcs.has(mount.name)) {
-            try {
-              await this.ensureManagedRunning(mount.name);
-            } catch (err) {
-              res.writeHead(503, { "Content-Type": "text/plain" });
-              res.end(`Backend not ready: ${err?.message || err}`);
-              return;
-            }
-          }
-          const handle = this.managedProcs.get(mount.name);
-          if (handle) handle.lastRequestAt = Date.now();
-          const targetPath = mountResolvedByHost ? req.url || "/" : (basePath || "/") + (url.search || "");
-          const proxyReq = http.request({
-            hostname: "127.0.0.1",
-            port: cfg.port,
-            path: targetPath,
-            method: req.method,
-            headers: req.headers
-          }, (proxyRes) => {
-            res.writeHead(proxyRes.statusCode || 200, proxyRes.headers);
-            proxyRes.pipe(res);
-          });
-          proxyReq.on("error", (err) => {
-            if (!res.headersSent) {
-              res.writeHead(502);
-              res.end(`Backend error: ${err.message}`);
-            }
-          });
-          const abortUpstream = () => {
-            if (!proxyReq.destroyed) proxyReq.destroy();
-          };
-          req.on("aborted", abortUpstream);
-          res.on("close", () => {
-            if (!res.writableFinished) abortUpstream();
-          });
-          proxyReq.setTimeout(12e4, abortUpstream);
-          req.pipe(proxyReq);
-          return;
-        }
-        if (mount && mount.directory) {
-          serveStaticMount(req, res, {
-            rootDir: mount.directory,
-            relPath: basePath || "/",
-            // Path-based access is prefixed with /<mountName>; host-based has no prefix.
-            mountUrlPrefix: mountResolvedByHost ? "" : `/${mountName}`,
-            browse: true});
-          return;
-        }
-        const cors = { "Access-Control-Allow-Origin": "*", "Access-Control-Allow-Methods": "GET, HEAD, OPTIONS", "Access-Control-Allow-Headers": "*" };
-        if (url.pathname === "/" || basePath === "/") {
-          res.writeHead(200, { ...cors, "Content-Type": "text/html; charset=utf-8", "Cache-Control": "no-store" });
-          res.end(this.mountListHtml());
-        } else {
-          res.writeHead(404, { ...cors, "Content-Type": "text/plain" });
-          res.end("Not found");
-        }
-      });
-      server.on("upgrade", (req, clientSocket, head) => {
-        const deny = (code, reason) => {
-          try {
-            clientSocket.write(`HTTP/1.1 ${code} ${reason}\r
-Connection: close\r
-\r
-`);
-          } catch {
-          }
-          try {
-            clientSocket.destroy();
-          } catch {
-          }
-        };
-        void (async () => {
-          try {
-            const url = new URL(req.url || "/", `http://127.0.0.1:${this.port}`);
-            const incomingHost = (req.headers.host || "").split(":")[0].toLowerCase();
-            const hostMount = this.hostToMount.get(incomingHost);
-            let mountName;
-            let mountResolvedByHost = false;
-            if (hostMount && this.mounts.has(hostMount)) {
-              mountName = hostMount;
-              mountResolvedByHost = true;
-            } else {
-              mountName = url.pathname.split("/").filter(Boolean)[0];
-            }
-            const mount = mountName ? this.mounts.get(mountName) : void 0;
-            if (!mount || !mount.process) {
-              deny(404, "Not Found");
-              return;
-            }
-            if (mount.access !== "public" && mount.access !== "link") {
-              if (mount.access === "owner" && !mount.ownerEmail) {
-                deny(403, "Forbidden");
-                return;
-              }
-              const userEmail = this.auth ? await this.auth.authenticate(req).catch(() => null) : null;
-              const allowed = userEmail && this.auth ? this.auth.isAuthorized(userEmail, mount.access, mount.ownerEmail) : false;
-              if (!allowed) {
-                deny(userEmail ? 403 : 401, userEmail ? "Forbidden" : "Unauthorized");
-                return;
-              }
-            }
-            const cfg = mount.process;
-            if (cfg.wakeOnRequest || !this.managedProcs.has(mount.name)) {
-              try {
-                await this.ensureManagedRunning(mount.name);
-              } catch {
-                deny(503, "Backend Not Ready");
-                return;
-              }
-            }
-            const handle = this.managedProcs.get(mount.name);
-            if (handle) handle.lastRequestAt = Date.now();
-            const targetPath = mountResolvedByHost ? req.url || "/" : (url.pathname.slice(`/${mountName}`.length) || "/") + (url.search || "");
-            const upstream = net.connect(cfg.port, "127.0.0.1", () => {
-              const lines = [`${req.method} ${targetPath} HTTP/1.1`];
-              for (let i = 0; i < req.rawHeaders.length; i += 2) {
-                lines.push(`${req.rawHeaders[i]}: ${req.rawHeaders[i + 1]}`);
-              }
-              upstream.write(lines.join("\r\n") + "\r\n\r\n");
-              if (head && head.length) upstream.write(head);
-              upstream.pipe(clientSocket);
-              clientSocket.pipe(upstream);
-            });
-            const teardown = () => {
-              try {
-                upstream.destroy();
-              } catch {
-              }
-              try {
-                clientSocket.destroy();
-              } catch {
-              }
-            };
-            upstream.on("error", teardown);
-            clientSocket.on("error", teardown);
-            upstream.on("close", () => {
-              try {
-                clientSocket.destroy();
-              } catch {
-              }
-            });
-            clientSocket.on("close", () => {
-              try {
-                upstream.destroy();
-              } catch {
-              }
-            });
-          } catch {
-            deny(500, "Internal Server Error");
-          }
-        })();
-      });
-      this.proxyServer = server;
-      server.listen(this.port, "127.0.0.1", () => resolve());
-      server.on("error", reject);
-    });
-  }
-  /** Get aggregate health: returns the status of the worst-failing per-mount tunnel. */
-  getTunnelHealth() {
-    if (this.mountTunnels.size === 0) return null;
-    let worst = null;
-    for (const t of this.mountTunnels.values()) {
-      const s = t.status;
-      if (worst === null) {
-        worst = s;
-        continue;
-      }
-      if (s.failingDurationMs > worst.failingDurationMs) worst = s;
-    }
-    return worst;
-  }
-  /** Destroy and recreate all per-mount tunnels with fresh configs. */
-  async recreateTunnel() {
-    this.log("Recreating all per-mount frpc tunnels (persistent failure detected)...");
-    const names = Array.from(this.mountTunnels.keys());
-    for (const name of names) {
-      const t = this.mountTunnels.get(name);
-      if (t) {
-        try {
-          t.destroy();
-        } catch {
-        }
-      }
-      this.mountTunnels.delete(name);
-    }
-    this.hostToMount.clear();
-    for (const name of names) {
-      try {
-        await this.startMountTunnel(name);
-      } catch (err) {
-        this.log(`Failed to restart tunnel for '${name}': ${err.message}`);
-      }
-    }
-  }
-  /** Start a per-mount frpc tunnel pointing the auth-proxy port to a dedicated subdomain. */
-  async startMountTunnel(mountName) {
-    if (this.mountTunnels.has(mountName)) return;
-    if (!this.port) throw new Error("Auth proxy not running \u2014 call ensureRunning() first");
-    const subdomainSafe = mountName.toLowerCase().replace(/[^a-z0-9-]/g, "-");
-    const tunnelName = `static-${subdomainSafe}`;
-    const mount = this.mounts.get(mountName);
-    const subdomainOverride = mount?.access === "link" && mount.linkToken ? /* @__PURE__ */ new Map([[this.port, buildLinkSubdomain(subdomainSafe, mount.linkToken)]]) : void 0;
-    try {
-      const { FrpcTunnel } = await import('./frpc-DR9BQXat.mjs');
-      let tunnel;
-      tunnel = new FrpcTunnel({
-        name: tunnelName,
-        ports: [this.port],
-        subdomains: subdomainOverride,
-        // End-to-end probe: the daemon's health loop watches probe.ok
-        // to detect ghosted tunnel registrations (frpc says "connected"
-        // but no traffic actually flows). The sentinel route is served
-        // by the auth proxy without auth.
-        probePath: "/__svamp_health",
-        probeIntervalMs: 3e4,
-        onError: (err) => this.log(`frpc error [${mountName}]: ${err.message}`),
-        onConnect: () => {
-          const url2 = tunnel.getUrls().get(this.port);
-          if (url2) {
-            try {
-              const host = new URL(url2).hostname.toLowerCase();
-              this.hostToMount.set(host, mountName);
-            } catch {
-            }
-            this.log(`frpc tunnel connected for '${mountName}'. URL: ${url2}/`);
-          }
-        },
-        onDisconnect: () => this.log(`frpc tunnel for '${mountName}' disconnected, will auto-reconnect...`),
-        onProbeFail: (err) => this.log(`probe fail [${mountName}]: ${err.message}`)
-      });
-      await tunnel.connect();
-      this.mountTunnels.set(mountName, tunnel);
-      const url = tunnel.getUrls().get(this.port);
-      if (url) {
-        try {
-          const host = new URL(url).hostname.toLowerCase();
-          this.hostToMount.set(host, mountName);
-        } catch {
-        }
-        this.log(`frpc tunnel started for '${mountName}'. URL: ${url}/`);
-      }
-    } catch (err) {
-      this.log(`Warning: could not expose mount '${mountName}' externally: ${err.message}`);
-      this.log(`Mount '${mountName}' available locally at http://127.0.0.1:${this.port}/${mountName}/`);
-    }
-  }
-}
-
-export { ServeManager, buildLinkSubdomain };