tinybeeai 0.0.0-stage → 0.16.1

package/dist/connect/store.js

@@ -0,0 +1,283 @@
+// Connection store (KAT-66): settings saved from the Setup page, encrypted at rest, with an audit row
+// per change. Keys are env var names (GITHUB_TOKEN, LINEAR_API_KEY, ...), so every client reads them
+// through liveEnv in config.ts and the environment always wins. Secrets never leave this module in
+// clear text except through liveEnv; the API view carries "set", the last 4 characters, and who/when.
+import { config, emitSettingsChange, setStoredResolver } from '../config.js';
+import { db } from '../db.js';
+import { decrypt, encrypt, loadMasterKey } from './crypto.js';
+const VALUES = 'connect_values';
+const AUDIT = 'connect_audit';
+const META_PREFIX = '@meta:';
+const cache = new Map();
+/** Values that live only while the process runs, such as a quick tunnel URL. They win over stored ones. */
+const runtime = new Map();
+let key;
+let ready = false;
+function masterKey() {
+    key ??= loadMasterKey(process.env, config.dataDir);
+    return key;
+}
+export function last4(v) {
+    return v.length <= 8 ? '' : v.slice(-4);
+}
+/** Creates the tables, loads and decrypts every row, and installs the liveEnv resolver. Idempotent. */
+export function initConnectStore() {
+    if (ready)
+        return;
+    db.exec(`CREATE TABLE IF NOT EXISTS ${VALUES} (key TEXT PRIMARY KEY, provider TEXT NOT NULL, enc TEXT NOT NULL, secret INTEGER NOT NULL, last4 TEXT, updatedAt TEXT NOT NULL, updatedBy TEXT)`);
+    db.exec(`CREATE TABLE IF NOT EXISTS ${AUDIT} (id INTEGER PRIMARY KEY AUTOINCREMENT, at TEXT NOT NULL, provider TEXT NOT NULL, key TEXT NOT NULL, action TEXT NOT NULL, actor TEXT, last4 TEXT)`);
+    cache.clear();
+    masterKey();
+    migrateLegacyKeys();
+    const rows = db.prepare(`SELECT key, provider, enc, secret, last4, updatedAt, updatedBy FROM ${VALUES}`).all();
+    for (const r of rows) {
+        const v = { provider: r.provider, secret: r.secret === 1, updatedAt: r.updatedAt };
+        if (r.last4)
+            v.last4 = r.last4;
+        if (r.updatedBy)
+            v.updatedBy = r.updatedBy;
+        try {
+            v.value = decrypt(masterKey(), r.enc, r.key);
+        }
+        catch {
+            v.error = 'Saved value cannot be read with the current secret key. Connect again.';
+        }
+        cache.set(r.key, v);
+    }
+    setStoredResolver({
+        get: (k) => (k.startsWith('@') ? undefined : (runtime.get(k) ?? cache.get(k)?.value)),
+        keys: () => [...new Set([...runtime.keys(), ...[...cache.keys()].filter((k) => !k.startsWith('@'))])],
+    });
+    ready = true;
+}
+/**
+ * Settings QA Dots saved are keyed QADOTS_*. Each row moves to its LOCALDOST_* name (the key is bound into the
+ * ciphertext, so the value is re-encrypted) unless a LOCALDOST_* row already exists. Unreadable rows are left alone.
+ */
+function migrateLegacyKeys() {
+    const rows = db.prepare(`SELECT key, provider, enc, secret, last4, updatedAt, updatedBy FROM ${VALUES} WHERE key LIKE 'QADOTS\\_%' ESCAPE '\\'`).all();
+    for (const r of rows) {
+        const next = `LOCALDOST_${r.key.slice('QADOTS_'.length)}`;
+        let value;
+        try {
+            value = decrypt(masterKey(), r.enc, r.key);
+        }
+        catch {
+            continue;
+        }
+        const taken = db.prepare(`SELECT 1 FROM ${VALUES} WHERE key = ?`).get(next);
+        if (!taken) {
+            db.prepare(`INSERT INTO ${VALUES} (key, provider, enc, secret, last4, updatedAt, updatedBy) VALUES (?, ?, ?, ?, ?, ?, ?)`).run(next, r.provider, encrypt(masterKey(), value, next), r.secret, r.last4, r.updatedAt, r.updatedBy);
+        }
+        db.prepare(`DELETE FROM ${VALUES} WHERE key = ?`).run(r.key);
+    }
+}
+function ensure() {
+    if (!ready)
+        initConnectStore();
+}
+export function storedValue(k) {
+    ensure();
+    return cache.get(k);
+}
+export function runtimeValue(k) {
+    return runtime.get(k);
+}
+/** Keys stored for a provider (meta excluded). */
+export function storedKeys(provider) {
+    ensure();
+    return [...cache.entries()].filter(([k, v]) => v.provider === provider && !k.startsWith('@')).map(([k]) => k);
+}
+function audit(provider, k, action, actor, l4) {
+    db.prepare(`INSERT INTO ${AUDIT} (at, provider, key, action, actor, last4) VALUES (?, ?, ?, ?, ?, ?)`).run(new Date().toISOString(), provider, k, action, actor ?? null, l4 ?? null);
+}
+/**
+ * Secrets that belong to the address saved under another key (KAT-119). The origin (scheme, host,
+ * port) of that address is recorded when the secret is saved; saving an address with another origin
+ * clears the secret, so it is entered again for the new server. The gate that reads this binding is
+ * aivisionTokenFor in aivision-token.ts.
+ */
+const BOUND_SECRETS = { AIVISION_INTERNAL_TOKEN: 'AIVISION_SERVER_URL' };
+const BIND_PREFIX = '@bind:';
+/** Bind row value for a secret saved while no address was set. */
+const NO_ADDRESS = 'none';
+function httpOrigin(raw) {
+    try {
+        const u = new URL((raw ?? '').trim());
+        if ((u.protocol !== 'http:' && u.protocol !== 'https:') || u.username || u.password)
+            return undefined;
+        return u.origin;
+    }
+    catch {
+        return undefined;
+    }
+}
+/** Origin of the address the user chose: the environment, then the saved value. Never a runtime (detected) value. */
+export function userAddressOrigin(addrKey) {
+    ensure();
+    const fromEnv = process.env[addrKey];
+    return httpOrigin(fromEnv !== undefined && fromEnv !== '' ? fromEnv : cache.get(addrKey)?.value);
+}
+/**
+ * The origin a saved secret belongs to, or undefined when it belongs to no address. A secret saved
+ * before bindings existed belongs to the address saved with it or before it, never to one saved later.
+ */
+export function boundOrigin(secretKey) {
+    ensure();
+    const addrKey = BOUND_SECRETS[secretKey];
+    const secret = cache.get(secretKey);
+    if (!addrKey || !secret?.value)
+        return undefined;
+    const row = cache.get(`${BIND_PREFIX}${secretKey}`)?.value;
+    if (row !== undefined)
+        return row === NO_ADDRESS ? undefined : row;
+    const addr = cache.get(addrKey);
+    return addr?.value && addr.updatedAt <= secret.updatedAt ? httpOrigin(addr.value) : undefined;
+}
+function putRow(provider, k, v, secret, now, actor) {
+    const l4 = secret ? last4(v) : '';
+    db.prepare(`INSERT INTO ${VALUES} (key, provider, enc, secret, last4, updatedAt, updatedBy) VALUES (?, ?, ?, ?, ?, ?, ?)
+     ON CONFLICT(key) DO UPDATE SET provider = excluded.provider, enc = excluded.enc, secret = excluded.secret,
+     last4 = excluded.last4, updatedAt = excluded.updatedAt, updatedBy = excluded.updatedBy`).run(k, provider, encrypt(masterKey(), v, k), secret ? 1 : 0, l4 || null, now, actor ?? null);
+    const next = { provider, secret, value: v, updatedAt: now };
+    if (l4)
+        next.last4 = l4;
+    if (actor)
+        next.updatedBy = actor;
+    cache.set(k, next);
+    return next;
+}
+function dropRow(k) {
+    db.prepare(`DELETE FROM ${VALUES} WHERE key = ?`).run(k);
+    cache.delete(k);
+}
+/**
+ * Saves or clears values for one provider. A null or empty value clears the key. Only keys whose value
+ * changed are written and audited. A saved value also drops the runtime value of that key. Emits one
+ * settings change with the changed keys.
+ */
+export function saveValues(provider, values, opts = {}) {
+    ensure();
+    const secrets = new Set(opts.secretKeys ?? []);
+    const changed = [];
+    const now = new Date().toISOString();
+    // Each bound secret's origin before this save, to compare a new address against.
+    const priorBound = Object.fromEntries(Object.keys(BOUND_SECRETS).map((k) => [k, boundOrigin(k)]));
+    for (const [k, raw] of Object.entries(values)) {
+        if (raw === undefined)
+            continue;
+        const cur = cache.get(k);
+        const v = raw === null ? '' : String(raw);
+        if (!v) {
+            if (!cur)
+                continue;
+            dropRow(k);
+            audit(provider, k, 'clear', opts.actor);
+            changed.push(k);
+            continue;
+        }
+        // A value the user saves replaces one localdost found at runtime (a detected server, for example).
+        const hadRuntime = runtime.delete(k);
+        const secret = secrets.has(k);
+        if (cur && cur.value === v && cur.secret === secret && cur.provider === provider) {
+            if (hadRuntime)
+                changed.push(k);
+            continue;
+        }
+        const l4 = putRow(provider, k, v, secret, now, opts.actor).last4;
+        if (!k.startsWith('@'))
+            audit(provider, k, 'set', opts.actor, l4);
+        changed.push(k);
+    }
+    for (const [secretKey, addrKey] of Object.entries(BOUND_SECRETS)) {
+        const bindKey = `${BIND_PREFIX}${secretKey}`;
+        const secret = cache.get(secretKey);
+        const typed = values[secretKey];
+        if (!secret) {
+            if (cache.has(bindKey))
+                dropRow(bindKey);
+        }
+        else if (typed) {
+            // Entered now: it belongs to the address the user has after this save.
+            putRow(secret.provider, bindKey, userAddressOrigin(addrKey) ?? NO_ADDRESS, false, now, opts.actor);
+        }
+        else if (values[addrKey] !== undefined && userAddressOrigin(addrKey) !== priorBound[secretKey]) {
+            // A new address without the secret: the old server's secret never goes to the new one.
+            dropRow(secretKey);
+            dropRow(bindKey);
+            audit(secret.provider, secretKey, 'clear', opts.actor);
+            changed.push(secretKey);
+        }
+    }
+    const visible = changed.filter((k) => !k.startsWith('@'));
+    if (visible.length)
+        emitSettingsChange(visible);
+    return changed;
+}
+/** Removes every stored value and the meta of a provider. */
+export function clearProvider(provider, actor) {
+    const keys = storedKeys(provider);
+    const cleared = saveValues(provider, Object.fromEntries([...keys, `${META_PREFIX}${provider}`].map((k) => [k, null])), { actor });
+    return cleared.filter((k) => !k.startsWith('@'));
+}
+/** Sets a process-only value (null removes it) and announces the change. */
+export function setRuntimeValue(k, value) {
+    ensure();
+    if (value === null) {
+        if (!runtime.delete(k))
+            return;
+    }
+    else {
+        if (runtime.get(k) === value)
+            return;
+        runtime.set(k, value);
+    }
+    emitSettingsChange([k]);
+}
+export function getMeta(provider) {
+    ensure();
+    const raw = cache.get(`${META_PREFIX}${provider}`)?.value;
+    if (!raw)
+        return {};
+    try {
+        const parsed = JSON.parse(raw);
+        return parsed && typeof parsed === 'object' ? parsed : {};
+    }
+    catch {
+        return {};
+    }
+}
+/** Merges into the provider meta. A null field removes it. */
+export function setMeta(provider, patch, actor) {
+    const next = { ...getMeta(provider) };
+    for (const [k, v] of Object.entries(patch)) {
+        if (v === null || v === undefined)
+            delete next[k];
+        else
+            next[k] = v;
+    }
+    saveValues(provider, { [`${META_PREFIX}${provider}`]: Object.keys(next).length ? JSON.stringify(next) : null }, { actor });
+    return next;
+}
+export function auditLog(provider, limit = 50) {
+    ensure();
+    const sql = `SELECT id, at, provider, key, action, actor, last4 FROM ${AUDIT}${provider ? ' WHERE provider = ?' : ''} ORDER BY id DESC LIMIT ?`;
+    const rows = (provider ? db.prepare(sql).all(provider, limit) : db.prepare(sql).all(limit));
+    return rows.map((r) => {
+        const out = { id: Number(r.id), at: r.at, provider: r.provider, key: r.key, action: r.action };
+        if (r.actor)
+            out.actor = r.actor;
+        if (r.last4)
+            out.last4 = r.last4;
+        return out;
+    });
+}
+/** Test hook: forget the cached master key and rows so the next call reloads from disk. */
+export function reloadConnectStore() {
+    ready = false;
+    key = undefined;
+    runtime.clear();
+    initConnectStore();
+}
+initConnectStore();
+//# sourceMappingURL=store.js.map

package/dist/connect/store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"store.js","sourceRoot":"","sources":["../../src/connect/store.ts"],"names":[],"mappings":"AAAA,sGAAsG;AACtG,qGAAqG;AACrG,mGAAmG;AACnG,sGAAsG;AACtG,OAAO,EAAE,MAAM,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AAC7E,OAAO,EAAE,EAAE,EAAE,MAAM,UAAU,CAAC;AAC9B,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAiC9D,MAAM,MAAM,GAAG,gBAAgB,CAAC;AAChC,MAAM,KAAK,GAAG,eAAe,CAAC;AAC9B,MAAM,WAAW,GAAG,QAAQ,CAAC;AAE7B,MAAM,KAAK,GAAG,IAAI,GAAG,EAAuB,CAAC;AAC7C,2GAA2G;AAC3G,MAAM,OAAO,GAAG,IAAI,GAAG,EAAkB,CAAC;AAC1C,IAAI,GAAuB,CAAC;AAC5B,IAAI,KAAK,GAAG,KAAK,CAAC;AAElB,SAAS,SAAS;IAChB,GAAG,KAAK,aAAa,CAAC,OAAO,CAAC,GAAG,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;IACnD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,UAAU,KAAK,CAAC,CAAS;IAC7B,OAAO,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;AAC1C,CAAC;AAED,uGAAuG;AACvG,MAAM,UAAU,gBAAgB;IAC9B,IAAI,KAAK;QAAE,OAAO;IAClB,EAAE,CAAC,IAAI,CACL,8BAA8B,MAAM,kJAAkJ,CACvL,CAAC;IACF,EAAE,CAAC,IAAI,CACL,8BAA8B,KAAK,oJAAoJ,CACxL,CAAC;IACF,KAAK,CAAC,KAAK,EAAE,CAAC;IACd,SAAS,EAAE,CAAC;IACZ,iBAAiB,EAAE,CAAC;IACpB,MAAM,IAAI,GAAG,EAAE,CAAC,OAAO,CAAC,uEAAuE,MAAM,EAAE,CAAC,CAAC,GAAG,EAQzG,CAAC;IACJ,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;QACrB,MAAM,CAAC,GAAgB,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,EAAE,CAAC;QAChG,IAAI,CAAC,CAAC,KAAK;YAAE,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC;QAC/B,IAAI,CAAC,CAAC,SAAS;YAAE,CAAC,CAAC,SAAS,GAAG,CAAC,CAAC,SAAS,CAAC;QAC3C,IAAI,CAAC;YACH,CAAC,CAAC,KAAK,GAAG,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC;QAC/C,CAAC;QAAC,MAAM,CAAC;YACP,CAAC,CAAC,KAAK,GAAG,wEAAwE,CAAC;QACrF,CAAC;QACD,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;IACtB,CAAC;IACD,iBAAiB,CAAC;QAChB,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;QACrF,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,OAAO,CAAC,IAAI,EAAE,EAAE,GAAG,CAAC,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;KACtG,CAAC,CAAC;IACH,KAAK,GAAG,IAAI,CAAC;AACf,CAAC;AAED;;;GAGG;AACH,SAAS,iBAAiB;IACxB,MAAM,IAAI,GAAG,EAAE,CAAC,OAAO,CAAC,uEAAuE,MAAM,0CAA0C,CAAC,CAAC,GAAG,EAQjJ,CAAC;IACJ,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;QACrB,MAAM,IAAI,GAAG,aAAa,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC;QAC1D,IAAI,KAAa,CAAC;QAClB,IAAI,CAAC;YACH,KAAK,GAAG,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC;QAC7C,CAAC;QAAC,MAAM,CAAC;YACP,SAAS;QACX,CAAC;QACD,MAAM,KAAK,GAAG,EAAE,CAAC,OAAO,CAAC,iBAAiB,MAAM,gBAAgB,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC5E,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,EAAE,CAAC,OAAO,CAAC,eAAe,MAAM,yFAAyF,CAAC,CAAC,GAAG,CAC5H,IAAI,EACJ,CAAC,CAAC,QAAQ,EACV,OAAO,CAAC,SAAS,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,EACjC,CAAC,CAAC,MAAM,EACR,CAAC,CAAC,KAAK,EACP,CAAC,CAAC,SAAS,EACX,CAAC,CAAC,SAAS,CACZ,CAAC;QACJ,CAAC;QACD,EAAE,CAAC,OAAO,CAAC,eAAe,MAAM,gBAAgB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IAC/D,CAAC;AACH,CAAC;AAED,SAAS,MAAM;IACb,IAAI,CAAC,KAAK;QAAE,gBAAgB,EAAE,CAAC;AACjC,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,CAAS;IACnC,MAAM,EAAE,CAAC;IACT,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;AACtB,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,CAAS;IACpC,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;AACxB,CAAC;AAED,kDAAkD;AAClD,MAAM,UAAU,UAAU,CAAC,QAAgB;IACzC,MAAM,EAAE,CAAC;IACT,OAAO,CAAC,GAAG,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;AAChH,CAAC;AAED,SAAS,KAAK,CAAC,QAAgB,EAAE,CAAS,EAAE,MAAuB,EAAE,KAAc,EAAE,EAAW;IAC9F,EAAE,CAAC,OAAO,CAAC,eAAe,KAAK,sEAAsE,CAAC,CAAC,GAAG,CACxG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EACxB,QAAQ,EACR,CAAC,EACD,MAAM,EACN,KAAK,IAAI,IAAI,EACb,EAAE,IAAI,IAAI,CACX,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,aAAa,GAA2B,EAAE,uBAAuB,EAAE,qBAAqB,EAAE,CAAC;AACjG,MAAM,WAAW,GAAG,QAAQ,CAAC;AAC7B,kEAAkE;AAClE,MAAM,UAAU,GAAG,MAAM,CAAC;AAE1B,SAAS,UAAU,CAAC,GAAuB;IACzC,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QACtC,IAAI,CAAC,CAAC,CAAC,QAAQ,KAAK,OAAO,IAAI,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC,IAAI,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,QAAQ;YAAE,OAAO,SAAS,CAAC;QACtG,OAAO,CAAC,CAAC,MAAM,CAAC;IAClB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,qHAAqH;AACrH,MAAM,UAAU,iBAAiB,CAAC,OAAe;IAC/C,MAAM,EAAE,CAAC;IACT,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IACrC,OAAO,UAAU,CAAC,OAAO,KAAK,SAAS,IAAI,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,KAAK,CAAC,CAAC;AACnG,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,WAAW,CAAC,SAAiB;IAC3C,MAAM,EAAE,CAAC;IACT,MAAM,OAAO,GAAG,aAAa,CAAC,SAAS,CAAC,CAAC;IACzC,MAAM,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IACpC,IAAI,CAAC,OAAO,IAAI,CAAC,MAAM,EAAE,KAAK;QAAE,OAAO,SAAS,CAAC;IACjD,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC,GAAG,WAAW,GAAG,SAAS,EAAE,CAAC,EAAE,KAAK,CAAC;IAC3D,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,GAAG,KAAK,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC;IACnE,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IAChC,OAAO,IAAI,EAAE,KAAK,IAAI,IAAI,CAAC,SAAS,IAAI,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAChG,CAAC;AAED,SAAS,MAAM,CAAC,QAAgB,EAAE,CAAS,EAAE,CAAS,EAAE,MAAe,EAAE,GAAW,EAAE,KAAc;IAClG,MAAM,EAAE,GAAG,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAClC,EAAE,CAAC,OAAO,CACR,eAAe,MAAM;;4FAEmE,CACzF,CAAC,GAAG,CAAC,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,IAAI,IAAI,EAAE,GAAG,EAAE,KAAK,IAAI,IAAI,CAAC,CAAC;IAC/F,MAAM,IAAI,GAAgB,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC;IACzE,IAAI,EAAE;QAAE,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;IACxB,IAAI,KAAK;QAAE,IAAI,CAAC,SAAS,GAAG,KAAK,CAAC;IAClC,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;IACnB,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,OAAO,CAAC,CAAS;IACxB,EAAE,CAAC,OAAO,CAAC,eAAe,MAAM,gBAAgB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IACzD,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,UAAU,CACxB,QAAgB,EAChB,MAAiD,EACjD,OAA0D,EAAE;IAE5D,MAAM,EAAE,CAAC;IACT,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC;IAC/C,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACrC,iFAAiF;IACjF,MAAM,UAAU,GAAG,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAClG,KAAK,MAAM,CAAC,CAAC,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAC9C,IAAI,GAAG,KAAK,SAAS;YAAE,SAAS;QAChC,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QACzB,MAAM,CAAC,GAAG,GAAG,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC1C,IAAI,CAAC,CAAC,EAAE,CAAC;YACP,IAAI,CAAC,GAAG;gBAAE,SAAS;YACnB,OAAO,CAAC,CAAC,CAAC,CAAC;YACX,KAAK,CAAC,QAAQ,EAAE,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;YACxC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAChB,SAAS;QACX,CAAC;QACD,mGAAmG;QACnG,MAAM,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QACrC,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QAC9B,IAAI,GAAG,IAAI,GAAG,CAAC,KAAK,KAAK,CAAC,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;YACjF,IAAI,UAAU;gBAAE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAChC,SAAS;QACX,CAAC;QACD,MAAM,EAAE,GAAG,MAAM,CAAC,QAAQ,EAAE,CAAC,EAAE,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC;QACjE,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,KAAK,CAAC,QAAQ,EAAE,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QAClE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,KAAK,MAAM,CAAC,SAAS,EAAE,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,aAAa,CAAC,EAAE,CAAC;QACjE,MAAM,OAAO,GAAG,GAAG,WAAW,GAAG,SAAS,EAAE,CAAC;QAC7C,MAAM,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACpC,MAAM,KAAK,GAAG,MAAM,CAAC,SAAS,CAAC,CAAC;QAChC,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,IAAI,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC;gBAAE,OAAO,CAAC,OAAO,CAAC,CAAC;QAC3C,CAAC;aAAM,IAAI,KAAK,EAAE,CAAC;YACjB,uEAAuE;YACvE,MAAM,CAAC,MAAM,CAAC,QAAQ,EAAE,OAAO,EAAE,iBAAiB,CAAC,OAAO,CAAC,IAAI,UAAU,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;QACrG,CAAC;aAAM,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,SAAS,IAAI,iBAAiB,CAAC,OAAO,CAAC,KAAK,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YACjG,uFAAuF;YACvF,OAAO,CAAC,SAAS,CAAC,CAAC;YACnB,OAAO,CAAC,OAAO,CAAC,CAAC;YACjB,KAAK,CAAC,MAAM,CAAC,QAAQ,EAAE,SAAS,EAAE,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;YACvD,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAC1B,CAAC;IACH,CAAC;IACD,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1D,IAAI,OAAO,CAAC,MAAM;QAAE,kBAAkB,CAAC,OAAO,CAAC,CAAC;IAChD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,6DAA6D;AAC7D,MAAM,UAAU,aAAa,CAAC,QAAgB,EAAE,KAAc;IAC5D,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;IAClC,MAAM,OAAO,GAAG,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,WAAW,CAAC,CAAC,GAAG,IAAI,EAAE,GAAG,WAAW,GAAG,QAAQ,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;IAClI,OAAO,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC;AACnD,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,eAAe,CAAC,CAAS,EAAE,KAAoB;IAC7D,MAAM,EAAE,CAAC;IACT,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QACnB,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;YAAE,OAAO;IACjC,CAAC;SAAM,CAAC;QACN,IAAI,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,KAAK;YAAE,OAAO;QACrC,OAAO,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;IACxB,CAAC;IACD,kBAAkB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC1B,CAAC;AAED,MAAM,UAAU,OAAO,CAAC,QAAgB;IACtC,MAAM,EAAE,CAAC;IACT,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC,GAAG,WAAW,GAAG,QAAQ,EAAE,CAAC,EAAE,KAAK,CAAC;IAC1D,IAAI,CAAC,GAAG;QAAE,OAAO,EAAE,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAY,CAAC;QAC1C,OAAO,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAE,MAAuB,CAAC,CAAC,CAAC,EAAE,CAAC;IAC9E,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,8DAA8D;AAC9D,MAAM,UAAU,OAAO,CAAC,QAAgB,EAAE,KAA8B,EAAE,KAAc;IACtF,MAAM,IAAI,GAA4B,EAAE,GAAG,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;IAC/D,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAC3C,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,SAAS;YAAE,OAAO,IAAI,CAAC,CAAC,CAAC,CAAC;;YAC7C,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IACnB,CAAC;IACD,UAAU,CAAC,QAAQ,EAAE,EAAE,CAAC,GAAG,WAAW,GAAG,QAAQ,EAAE,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;IAC3H,OAAO,IAAoB,CAAC;AAC9B,CAAC;AAED,MAAM,UAAU,QAAQ,CAAC,QAAiB,EAAE,KAAK,GAAG,EAAE;IACpD,MAAM,EAAE,CAAC;IACT,MAAM,GAAG,GAAG,2DAA2D,KAAK,GAAG,QAAQ,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,EAAE,2BAA2B,CAAC;IAChJ,MAAM,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAGtF,CAAC;IACL,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;QACpB,MAAM,GAAG,GAAa,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;QACzG,IAAI,CAAC,CAAC,KAAK;YAAE,GAAG,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC;QACjC,IAAI,CAAC,CAAC,KAAK;YAAE,GAAG,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC;QACjC,OAAO,GAAG,CAAC;IACb,CAAC,CAAC,CAAC;AACL,CAAC;AAED,2FAA2F;AAC3F,MAAM,UAAU,kBAAkB;IAChC,KAAK,GAAG,KAAK,CAAC;IACd,GAAG,GAAG,SAAS,CAAC;IAChB,OAAO,CAAC,KAAK,EAAE,CAAC;IAChB,gBAAgB,EAAE,CAAC;AACrB,CAAC;AAED,gBAAgB,EAAE,CAAC"}

package/dist/connect/tunnel.js

@@ -0,0 +1,134 @@
+// Cloudflare quick tunnel (KAT-66): `cloudflared tunnel --url http://127.0.0.1:<port>` gives this server a
+// public https://<words>.trycloudflare.com address with no account. The URL lives only while the child
+// runs, so it is a runtime value: it never lands in the database, and a restart drops it.
+// Without LOCALDOST_TOKEN the API still answers loopback Host names only, so the tunnel exposes the
+// webhooks and the app shell, never the API.
+import { spawn } from 'node:child_process';
+import { config, log } from '../config.js';
+import { deps } from './deps.js';
+import { setRuntimeValue } from './store.js';
+let spawner = (bin, args) => spawn(bin, args, { stdio: ['ignore', 'pipe', 'pipe'] });
+export function setTunnelSpawner(fn) {
+    spawner = fn ?? ((bin, args) => spawn(bin, args, { stdio: ['ignore', 'pipe', 'pipe'] }));
+}
+const URL_RE = /https:\/\/[a-z0-9-]+\.trycloudflare\.com/i;
+let child;
+let url;
+let starting;
+let exitHook = false;
+export function tunnelState() {
+    return url ? { running: true, url } : { running: false };
+}
+/** Finds the trycloudflare URL in cloudflared output. */
+export function parseTunnelUrl(text) {
+    return URL_RE.exec(text)?.[0];
+}
+export function startTunnel(port = config.port, timeoutMs = 30_000) {
+    if (child && url)
+        return Promise.resolve({ url });
+    if (starting)
+        return starting;
+    const bin = deps.which('cloudflared');
+    if (!bin)
+        return Promise.reject(new Error('cloudflared is not installed on this server. Install it, or paste a public URL instead.'));
+    starting = new Promise((resolve, reject) => {
+        const c = spawner(bin, ['tunnel', '--no-autoupdate', '--url', `http://127.0.0.1:${port}`]);
+        let settled = false;
+        let seen = '';
+        const timer = setTimeout(() => fail(new Error('cloudflared did not print a tunnel URL within 30 seconds.')), timeoutMs);
+        const fail = (err) => {
+            if (settled)
+                return;
+            settled = true;
+            clearTimeout(timer);
+            try {
+                c.kill('SIGTERM');
+            }
+            catch {
+                /* already gone */
+            }
+            reject(err);
+        };
+        const onData = (d) => {
+            if (settled)
+                return;
+            seen = (seen + String(d)).slice(-8000);
+            const found = parseTunnelUrl(seen);
+            if (!found)
+                return;
+            settled = true;
+            clearTimeout(timer);
+            child = c;
+            url = found;
+            setRuntimeValue('LOCALDOST_PUBLIC_URL', found);
+            log.info(`tunnel: ${found} -> http://127.0.0.1:${port}`);
+            resolve({ url: found });
+        };
+        c.stdout?.on('data', onData);
+        c.stderr?.on('data', onData);
+        c.on('error', (err) => fail(err));
+        c.on('exit', (code) => {
+            if (!settled)
+                fail(new Error(`cloudflared exited (code ${code ?? 'none'}) before the tunnel was ready.`));
+            if (child === c) {
+                child = undefined;
+                url = undefined;
+                setRuntimeValue('LOCALDOST_PUBLIC_URL', null);
+                log.warn('tunnel: cloudflared stopped');
+            }
+        });
+    }).finally(() => {
+        starting = undefined;
+    });
+    if (!exitHook) {
+        exitHook = true;
+        process.once('exit', () => {
+            try {
+                child?.kill('SIGTERM');
+            }
+            catch {
+                /* exiting anyway */
+            }
+        });
+    }
+    return starting;
+}
+/**
+ * Stops cloudflared and waits for it to exit. A child that ignores SIGTERM for `graceMs` gets SIGKILL;
+ * one that still runs after that makes the call throw, so the UI never says stopped while the URL lives.
+ */
+export async function stopTunnel(graceMs = 5_000) {
+    const c = child;
+    child = undefined;
+    url = undefined;
+    setRuntimeValue('LOCALDOST_PUBLIC_URL', null);
+    if (!c)
+        return;
+    let exited = false;
+    const gone = new Promise((resolve) => {
+        c.on('exit', () => {
+            exited = true;
+            resolve();
+        });
+    });
+    const waitExit = (ms) => Promise.race([gone, new Promise((r) => setTimeout(r, ms).unref?.())]);
+    const send = (sig) => {
+        try {
+            return c.kill(sig);
+        }
+        catch {
+            return false;
+        }
+    };
+    if (!send('SIGTERM'))
+        return; // no such process: it is already gone
+    await waitExit(graceMs);
+    if (exited)
+        return;
+    log.warn('tunnel: cloudflared ignored SIGTERM, sending SIGKILL');
+    send('SIGKILL');
+    await waitExit(2_000);
+    if (!exited)
+        throw new Error('cloudflared did not stop. End the process by hand.');
+}
+//# sourceMappingURL=tunnel.js.map

package/dist/connect/tunnel.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tunnel.js","sourceRoot":"","sources":["../../src/connect/tunnel.ts"],"names":[],"mappings":"AAAA,2GAA2G;AAC3G,uGAAuG;AACvG,0FAA0F;AAC1F,oGAAoG;AACpG,6CAA6C;AAC7C,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAC3C,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,cAAc,CAAC;AAC3C,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAY7C,IAAI,OAAO,GAAkB,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;AAEpG,MAAM,UAAU,gBAAgB,CAAC,EAAkB;IACjD,OAAO,GAAG,EAAE,IAAI,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;AAC3F,CAAC;AAED,MAAM,MAAM,GAAG,2CAA2C,CAAC;AAE3D,IAAI,KAA8B,CAAC;AACnC,IAAI,GAAuB,CAAC;AAC5B,IAAI,QAA8C,CAAC;AACnD,IAAI,QAAQ,GAAG,KAAK,CAAC;AAErB,MAAM,UAAU,WAAW;IACzB,OAAO,GAAG,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;AAC3D,CAAC;AAED,yDAAyD;AACzD,MAAM,UAAU,cAAc,CAAC,IAAY;IACzC,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;AAChC,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,IAAI,GAAG,MAAM,CAAC,IAAI,EAAE,SAAS,GAAG,MAAM;IAChE,IAAI,KAAK,IAAI,GAAG;QAAE,OAAO,OAAO,CAAC,OAAO,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC;IAClD,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAC;IAC9B,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;IACtC,IAAI,CAAC,GAAG;QAAE,OAAO,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,yFAAyF,CAAC,CAAC,CAAC;IACtI,QAAQ,GAAG,IAAI,OAAO,CAAkB,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QAC1D,MAAM,CAAC,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,iBAAiB,EAAE,OAAO,EAAE,oBAAoB,IAAI,EAAE,CAAC,CAAC,CAAC;QAC3F,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,IAAI,IAAI,GAAG,EAAE,CAAC;QACd,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,2DAA2D,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;QACxH,MAAM,IAAI,GAAG,CAAC,GAAU,EAAE,EAAE;YAC1B,IAAI,OAAO;gBAAE,OAAO;YACpB,OAAO,GAAG,IAAI,CAAC;YACf,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,IAAI,CAAC;gBACH,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YACpB,CAAC;YAAC,MAAM,CAAC;gBACP,kBAAkB;YACpB,CAAC;YACD,MAAM,CAAC,GAAG,CAAC,CAAC;QACd,CAAC,CAAC;QACF,MAAM,MAAM,GAAG,CAAC,CAAkB,EAAE,EAAE;YACpC,IAAI,OAAO;gBAAE,OAAO;YACpB,IAAI,GAAG,CAAC,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC;YACvC,MAAM,KAAK,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;YACnC,IAAI,CAAC,KAAK;gBAAE,OAAO;YACnB,OAAO,GAAG,IAAI,CAAC;YACf,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,KAAK,GAAG,CAAC,CAAC;YACV,GAAG,GAAG,KAAK,CAAC;YACZ,eAAe,CAAC,sBAAsB,EAAE,KAAK,CAAC,CAAC;YAC/C,GAAG,CAAC,IAAI,CAAC,WAAW,KAAK,wBAAwB,IAAI,EAAE,CAAC,CAAC;YACzD,OAAO,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC;QAC1B,CAAC,CAAC;QACF,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAC7B,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAC7B,CAAC,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;QAClC,CAAC,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE;YACpB,IAAI,CAAC,OAAO;gBAAE,IAAI,CAAC,IAAI,KAAK,CAAC,4BAA4B,IAAI,IAAI,MAAM,gCAAgC,CAAC,CAAC,CAAC;YAC1G,IAAI,KAAK,KAAK,CAAC,EAAE,CAAC;gBAChB,KAAK,GAAG,SAAS,CAAC;gBAClB,GAAG,GAAG,SAAS,CAAC;gBAChB,eAAe,CAAC,sBAAsB,EAAE,IAAI,CAAC,CAAC;gBAC9C,GAAG,CAAC,IAAI,CAAC,6BAA6B,CAAC,CAAC;YAC1C,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE;QACd,QAAQ,GAAG,SAAS,CAAC;IACvB,CAAC,CAAC,CAAC;IACH,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,QAAQ,GAAG,IAAI,CAAC;QAChB,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE;YACxB,IAAI,CAAC;gBACH,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;YACzB,CAAC;YAAC,MAAM,CAAC;gBACP,oBAAoB;YACtB,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,OAAO,GAAG,KAAK;IAC9C,MAAM,CAAC,GAAG,KAAK,CAAC;IAChB,KAAK,GAAG,SAAS,CAAC;IAClB,GAAG,GAAG,SAAS,CAAC;IAChB,eAAe,CAAC,sBAAsB,EAAE,IAAI,CAAC,CAAC;IAC9C,IAAI,CAAC,CAAC;QAAE,OAAO;IACf,IAAI,MAAM,GAAG,KAAK,CAAC;IACnB,MAAM,IAAI,GAAG,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE;QACzC,CAAC,CAAC,EAAE,CAAC,MAAM,EAAE,GAAG,EAAE;YAChB,MAAM,GAAG,IAAI,CAAC;YACd,OAAO,EAAE,CAAC;QACZ,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IACH,MAAM,QAAQ,GAAG,CAAC,EAAU,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,IAAI,OAAO,CAAO,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;IAC7G,MAAM,IAAI,GAAG,CAAC,GAAmB,EAAE,EAAE;QACnC,IAAI,CAAC;YACH,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACrB,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC,CAAC;IACF,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC;QAAE,OAAO,CAAC,sCAAsC;IACpE,MAAM,QAAQ,CAAC,OAAO,CAAC,CAAC;IACxB,IAAI,MAAM;QAAE,OAAO;IACnB,GAAG,CAAC,IAAI,CAAC,sDAAsD,CAAC,CAAC;IACjE,IAAI,CAAC,SAAS,CAAC,CAAC;IAChB,MAAM,QAAQ,CAAC,KAAK,CAAC,CAAC;IACtB,IAAI,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;AACrF,CAAC"}

package/dist/connect/types.js

@@ -0,0 +1,8 @@
+export class ConnectError extends Error {
+    status;
+    constructor(status, message) {
+        super(message);
+        this.status = status;
+    }
+}
+//# sourceMappingURL=types.js.map

package/dist/connect/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/connect/types.ts"],"names":[],"mappings":"AAyHA,MAAM,OAAO,YAAa,SAAQ,KAAK;IAE1B;IADX,YACW,MAAc,EACvB,OAAe;QAEf,KAAK,CAAC,OAAO,CAAC,CAAC;QAHN,WAAM,GAAN,MAAM,CAAQ;IAIzB,CAAC;CACF"}

package/dist/connections/index.js

@@ -0,0 +1,5 @@
+export { createConnection, deleteConnection, getConnection, initConnectionStore, listConnections, publicView, updateConnection, } from './store.js';
+export { callTool, closeAllConnections, disconnect, readSecrets, refreshConnection, setTransportFactory, summarizeResult, MAX_TOOLS, } from './manager.js';
+export { bindingsFor, callConnectionTool, callPresetTool, executeMcpTool, presetToolName, isMcpToolName, toolsForWatch, MCP_PREFIX, } from './tools.js';
+export { PRESETS, connectionFromPreset, getPreset, listPresets, presetHintsForWatch } from './presets.js';
+//# sourceMappingURL=index.js.map

package/dist/connections/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/connections/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,gBAAgB,EAChB,gBAAgB,EAChB,aAAa,EACb,mBAAmB,EACnB,eAAe,EACf,UAAU,EACV,gBAAgB,GAIjB,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,QAAQ,EACR,mBAAmB,EACnB,UAAU,EACV,WAAW,EACX,iBAAiB,EACjB,mBAAmB,EACnB,eAAe,EACf,SAAS,GAGV,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,WAAW,EACX,kBAAkB,EAClB,cAAc,EACd,cAAc,EACd,cAAc,EACd,aAAa,EACb,aAAa,EACb,UAAU,GAGX,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,OAAO,EAAE,oBAAoB,EAAE,SAAS,EAAE,WAAW,EAAE,mBAAmB,EAA0C,MAAM,cAAc,CAAC"}