@agimon-ai/doompi-core 0.0.1-alpha.100

package/dist/src/web/services/apiClient/index.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.mjs","names":[],"sources":["../../../../../src/web/services/apiClient/index.ts"],"sourcesContent":["/**\n * The typed call surface a cockpit plugin reaches its own API through.\n *\n * A route is declared once as data, and the build supplies the two facts the\n * declaration deliberately omits: which scopes the package mounts at, and under\n * which base path. So a page names a route and a session, never a URL.\n *\n * The shape is dictated by the transport rather than by taste. Over a tunnel\n * every request is resealed and relayed, and the relay honours only a method, a\n * set of headers and a buffered body against a root-relative target. Anything\n * this surface accepted beyond that would be silently discarded at exactly the\n * moment it mattered, so it accepts nothing beyond that.\n */\n\nimport { type ApiParams, type ApiQuery, type ApiScopeAddress, pluginApiUrl } from '../apiPaths';\n\n/** Scope names a package API can mount at. */\nexport type ApiScopeName = ApiScopeAddress['scope'];\n\n/** Methods a declared route may use. */\nexport type ApiRouteMethod = 'GET' | 'POST' | 'PUT' | 'PATCH' | 'DELETE' | 'HEAD' | 'OPTIONS';\n\ndeclare const RESPONSE_TYPE: unique symbol;\n\n/** Carries a route's response type through the declaration. Erased at runtime. */\nexport interface ApiResponseOf<T> {\n  readonly [RESPONSE_TYPE]: T;\n}\n\n/** Names the type a route answers with. Returns nothing; only its type is read. */\nexport function apiResponse<T>(): ApiResponseOf<T> {\n  return undefined as unknown as ApiResponseOf<T>;\n}\n\n/**\n * One route, as the package declares it.\n *\n * No scope and no base path: both are mount identity, the build reads them off\n * the folder tree, and restating them here is how they came to disagree in the\n * first place.\n */\nexport interface ApiRouteSpec<T = void> {\n  readonly method: ApiRouteMethod;\n  /** Below the mount, leading slash. Exactly '/' addresses the mount itself. */\n  readonly path: string;\n  /** Query parameter names this route reads, for documentation and review. */\n  readonly query?: readonly string[];\n  /** A host-owned route: it hangs off the scope root rather than under /plugins/. */\n  readonly host?: true;\n  /**\n   * Answers `text/event-stream`.\n   *\n   * A streaming route gets a URL and no call method. Its consumer is the\n   * browser's own `EventSource`, which does not go through the sealed\n   * transport, and a relayed request buffers the whole response before\n   * returning, so calling one over a tunnel would never return at all.\n   */\n  readonly stream?: true;\n  /**\n   * Answers bytes rather than JSON.\n   *\n   * The body is left unread, so `data` is undefined and the caller takes\n   * `result.response` and reads it however it needs: `arrayBuffer`, `blob`,\n   * `text`. Without this the client would consume the body to parse it, and\n   * hand back a `Response` that throws on the second read.\n   */\n  readonly raw?: true;\n  readonly response?: ApiResponseOf<T>;\n}\n\nexport type ApiRoutes = Readonly<Record<string, ApiRouteSpec<unknown>>>;\n\ntype ResponseOf<TSpec> = TSpec extends { readonly response: ApiResponseOf<infer T> } ? T : void;\n\n/**\n * What a call may carry.\n *\n * No `cache`, `credentials`, `redirect` or `mode`. The sealed transport copies\n * only the method, the headers and the body, so those four would be discarded\n * on every remote session and honoured on no one's.\n *\n * `signal` is here because it is the one of the five that is not always a lie.\n * On loopback the transport is a plain `fetch` pass-through and cancellation\n * works, which callers already rely on to drop a superseded refresh. Over a\n * tunnel the request is resealed and relayed, and the signal goes no further\n * than this process: the call still settles, so a caller that treats an abort\n * as \"no answer is coming\" stays correct, but the work at the far end is not\n * stopped. Refusing the field outright would have regressed every caller that\n * cancels today, which is a worse trade than describing the limit.\n */\nexport interface ApiCallInit {\n  /** Values for the route's `:name` path segments. */\n  readonly params?: ApiParams;\n  readonly query?: ApiQuery;\n  readonly headers?: Readonly<Record<string, string>>;\n  /** JSON-encoded unless it is already a string, Blob, buffer or URLSearchParams. */\n  readonly body?: unknown;\n  /** Honoured on loopback; dropped when the session is remote. */\n  readonly signal?: AbortSignal;\n}\n\n/**\n * What a route answered.\n *\n * `status` and the raw `response` are always present on an answered call,\n * because status and headers carry protocol state across this codebase: a 409\n * returns the hash the file actually has, a 204 plus a header says a recording\n * is sealed, and the file route reports a digest. A client that returned only a\n * parsed body would lose all three.\n *\n * `status: 0` with no `response` is the one case the transport never answered.\n * A relay failure arrives as a synthetic 502 and is reported as 502, because\n * this layer cannot tell it from the real thing.\n */\nexport type ApiResult<T> =\n  | { readonly ok: true; readonly status: number; readonly data: T; readonly response: Response }\n  | {\n      readonly ok: false;\n      readonly status: number;\n      readonly error: string;\n      readonly data: unknown;\n      readonly response?: Response;\n    };\n\n/** Issues a request. The same shape as `fetch`, so the sealed transport and the step-up wrapper both fit. */\nexport type ApiTransport = (input: string, init?: RequestInit) => Promise<Response>;\n\nexport interface ApiMethod<T> {\n  (init?: ApiCallInit): Promise<ApiResult<T>>;\n  /** The absolute URL, for an `EventSource`, an `<img src>`, or a download. */\n  url(init?: Pick<ApiCallInit, 'query' | 'params'>): string;\n  readonly spec: ApiRouteSpec<unknown>;\n}\n\n/** A streaming route: addressable, not callable. */\nexport interface ApiStreamMethod {\n  url(init?: Pick<ApiCallInit, 'query' | 'params'>): string;\n  readonly spec: ApiRouteSpec<unknown>;\n}\n\nexport type ApiScopeClient<TRoutes extends ApiRoutes> = {\n  readonly [K in keyof TRoutes]: TRoutes[K] extends { readonly stream: true }\n    ? ApiStreamMethod\n    : ApiMethod<ResponseOf<TRoutes[K]>>;\n};\n\ninterface ApiScopeAccessors<TRoutes extends ApiRoutes> {\n  readonly global: ApiScopeClient<TRoutes>;\n  readonly workspace: (workspaceId: string) => ApiScopeClient<TRoutes>;\n  readonly session: (sessionId: string) => ApiScopeClient<TRoutes>;\n}\n\n/**\n * The client, carrying an accessor only for the scopes the package mounts at.\n *\n * A package serving sessions has `session` and nothing else, so addressing it\n * globally is a missing property rather than a 404 discovered at runtime. This\n * is the whole of the scope guarantee, and it costs no test.\n */\nexport type ApiClient<TScopes extends ApiScopeName, TRoutes extends ApiRoutes> = Pick<\n  ApiScopeAccessors<TRoutes>,\n  TScopes\n>;\n\n/** Identity with inference, so a route table keeps its literal types. */\nexport function defineApiRoutes<const TRoutes extends ApiRoutes>(routes: TRoutes): TRoutes {\n  return routes;\n}\n\nfunction isRecord(value: unknown): value is Record<string, unknown> {\n  return typeof value === 'object' && value !== null && !Array.isArray(value);\n}\n\n/** The body a route answered, or undefined when it sent none or sent non-JSON. */\nasync function readBody(response: Response): Promise<unknown> {\n  const text = await response.text();\n  if (text === '') return undefined;\n  try {\n    return JSON.parse(text) as unknown;\n  } catch {\n    return undefined;\n  }\n}\n\n/**\n * The message a route reported, or an empty string.\n *\n * Empty rather than invented: callers own the words their users read, and a\n * generic sentence from here would appear in a dozen packages that each already\n * have their own.\n */\nfunction errorOf(data: unknown): string {\n  return isRecord(data) && typeof data.error === 'string' ? data.error : '';\n}\n\n/**\n * What the sealed relay can carry verbatim.\n *\n * Named here rather than borrowed from `BodyInit`, which the node build has no\n * lib for, and which is anyway wider than the truth: `FormData` and a\n * `ReadableStream` are both refused when a session is remote.\n */\nexport type ApiRequestBody = string | Blob | ArrayBuffer | ArrayBufferView | URLSearchParams;\n\n/** Anything the sealed transport can carry verbatim; everything else becomes JSON. */\nfunction encodeBody(body: unknown): { body?: ApiRequestBody; contentType?: string } {\n  if (body === undefined) return {};\n  if (\n    typeof body === 'string' ||\n    body instanceof Blob ||\n    body instanceof ArrayBuffer ||\n    ArrayBuffer.isView(body) ||\n    body instanceof URLSearchParams\n  ) {\n    return { body };\n  }\n  return { body: JSON.stringify(body), contentType: 'application/json' };\n}\n\nexport interface ApiClientOptions<TScopes extends ApiScopeName> {\n  /** Scopes the package's routed api/ tree actually mounts at. The build supplies these. */\n  readonly scopes: readonly TScopes[];\n  /** The mount segment. The build reads it off the api/<base-path>/ folder. */\n  readonly basePath: string;\n  readonly transport: ApiTransport;\n  /** Resolves which workspace owns a session; the host binds it from its own summaries. */\n  readonly sessionAddress: (sessionId: string) => ApiScopeAddress;\n}\n\n/**\n * One route, as the page calls it.\n *\n * A streaming route is returned as a plain object with no call signature, not\n * merely typed as one. The type stops an author; the missing function stops a\n * cast, a JavaScript caller, and a generic helper that iterates the client.\n * Calling one over a tunnel would buffer forever rather than fail, and that is\n * too quiet a way to lose an afternoon.\n */\nfunction methodFor(\n  spec: ApiRouteSpec<unknown>,\n  address: ApiScopeAddress,\n  options: ApiClientOptions<ApiScopeName>,\n): ApiMethod<unknown> | ApiStreamMethod {\n  const basePath = spec.host === true ? undefined : options.basePath;\n  const url = (init?: Pick<ApiCallInit, 'query' | 'params'>): string =>\n    pluginApiUrl(address, basePath, spec.path, init?.query, init?.params);\n\n  const call = async (init?: ApiCallInit): Promise<ApiResult<unknown>> => {\n    const encoded = encodeBody(init?.body);\n    const headers = {\n      ...(encoded.contentType === undefined ? {} : { 'content-type': encoded.contentType }),\n      ...init?.headers,\n    };\n    let response: Response;\n    try {\n      response = await options.transport(url(init), {\n        method: spec.method,\n        ...(init?.signal === undefined ? {} : { signal: init.signal }),\n        ...(Object.keys(headers).length === 0 ? {} : { headers }),\n        // Cast because the node build's `BodyInit` enumerates concrete typed\n        // arrays rather than accepting `ArrayBufferView`. Every value reaching\n        // here is one fetch already carries; the two libs disagree about the\n        // type, not the runtime.\n        ...(encoded.body === undefined ? {} : { body: encoded.body as RequestInit['body'] }),\n      });\n    } catch {\n      return { ok: false, status: 0, error: '', data: undefined };\n    }\n    // A raw route's body belongs to the caller, and reading it here to look\n    // for an `error` would spend the one read it gets.\n    if (spec.raw === true) {\n      if (!response.ok) return { ok: false, status: response.status, error: '', data: undefined, response };\n      return { ok: true, status: response.status, data: undefined, response };\n    }\n    const data = await readBody(response);\n    if (!response.ok) return { ok: false, status: response.status, error: errorOf(data), data, response };\n    return { ok: true, status: response.status, data, response };\n  };\n\n  if (spec.stream === true) return { url, spec };\n  return Object.assign(call, { url, spec });\n}\n\nfunction scopeClient<TRoutes extends ApiRoutes>(\n  routes: TRoutes,\n  address: ApiScopeAddress,\n  options: ApiClientOptions<ApiScopeName>,\n): ApiScopeClient<TRoutes> {\n  const client: Record<string, ApiMethod<unknown> | ApiStreamMethod> = {};\n  for (const [key, spec] of Object.entries(routes)) client[key] = methodFor(spec, address, options);\n  return client as ApiScopeClient<TRoutes>;\n}\n\n/**\n * Binds a route table to one package's mount.\n *\n * Only the scopes named in `options.scopes` get an accessor, so the returned\n * value describes exactly what this package serves and nothing else.\n */\nexport function createApiClient<const TScopes extends ApiScopeName, const TRoutes extends ApiRoutes>(\n  routes: TRoutes,\n  options: ApiClientOptions<TScopes>,\n): ApiClient<TScopes, TRoutes> {\n  const wide = options as ApiClientOptions<ApiScopeName>;\n  const accessors: { -readonly [K in keyof ApiScopeAccessors<TRoutes>]?: ApiScopeAccessors<TRoutes>[K] } = {};\n  for (const scope of options.scopes) {\n    if (scope === 'global') accessors.global = scopeClient(routes, { scope: 'global' }, wide);\n    if (scope === 'workspace') {\n      accessors.workspace = (workspaceId: string) => scopeClient(routes, { scope: 'workspace', workspaceId }, wide);\n    }\n    if (scope === 'session') {\n      accessors.session = (sessionId: string) => scopeClient(routes, wide.sessionAddress(sessionId), wide);\n    }\n  }\n  return accessors as ApiClient<TScopes, TRoutes>;\n}\n"],"mappings":";;;;;;;;;;;;;;;;AA8BA,SAAgB,cAAmC,CAEnD;;AAqIA,SAAgB,gBAAiD,QAA0B;CACzF,OAAO;AACT;AAEA,SAAS,SAAS,OAAkD;CAClE,OAAO,OAAO,UAAU,YAAY,UAAU,QAAQ,CAAC,MAAM,QAAQ,KAAK;AAC5E;;AAGA,eAAe,SAAS,UAAsC;CAC5D,MAAM,OAAO,MAAM,SAAS,KAAK;CACjC,IAAI,SAAS,IAAI,OAAO,KAAA;CACxB,IAAI;EACF,OAAO,KAAK,MAAM,IAAI;CACxB,QAAQ;EACN;CACF;AACF;;;;;;;;AASA,SAAS,QAAQ,MAAuB;CACtC,OAAO,SAAS,IAAI,KAAK,OAAO,KAAK,UAAU,WAAW,KAAK,QAAQ;AACzE;;AAYA,SAAS,WAAW,MAAgE;CAClF,IAAI,SAAS,KAAA,GAAW,OAAO,CAAC;CAChC,IACE,OAAO,SAAS,YAChB,gBAAgB,QAChB,gBAAgB,eAChB,YAAY,OAAO,IAAI,KACvB,gBAAgB,iBAEhB,OAAO,EAAE,KAAK;CAEhB,OAAO;EAAE,MAAM,KAAK,UAAU,IAAI;EAAG,aAAa;CAAmB;AACvE;;;;;;;;;;AAqBA,SAAS,UACP,MACA,SACA,SACsC;CACtC,MAAM,WAAW,KAAK,SAAS,OAAO,KAAA,IAAY,QAAQ;CAC1D,MAAM,OAAO,SACX,aAAa,SAAS,UAAU,KAAK,MAAM,MAAM,OAAO,MAAM,MAAM;CAEtE,MAAM,OAAO,OAAO,SAAoD;EACtE,MAAM,UAAU,WAAW,MAAM,IAAI;EACrC,MAAM,UAAU;GACd,GAAI,QAAQ,gBAAgB,KAAA,IAAY,CAAC,IAAI,EAAE,gBAAgB,QAAQ,YAAY;GACnF,GAAG,MAAM;EACX;EACA,IAAI;EACJ,IAAI;GACF,WAAW,MAAM,QAAQ,UAAU,IAAI,IAAI,GAAG;IAC5C,QAAQ,KAAK;IACb,GAAI,MAAM,WAAW,KAAA,IAAY,CAAC,IAAI,EAAE,QAAQ,KAAK,OAAO;IAC5D,GAAI,OAAO,KAAK,OAAO,CAAC,CAAC,WAAW,IAAI,CAAC,IAAI,EAAE,QAAQ;IAKvD,GAAI,QAAQ,SAAS,KAAA,IAAY,CAAC,IAAI,EAAE,MAAM,QAAQ,KAA4B;GACpF,CAAC;EACH,QAAQ;GACN,OAAO;IAAE,IAAI;IAAO,QAAQ;IAAG,OAAO;IAAI,MAAM,KAAA;GAAU;EAC5D;EAGA,IAAI,KAAK,QAAQ,MAAM;GACrB,IAAI,CAAC,SAAS,IAAI,OAAO;IAAE,IAAI;IAAO,QAAQ,SAAS;IAAQ,OAAO;IAAI,MAAM,KAAA;IAAW;GAAS;GACpG,OAAO;IAAE,IAAI;IAAM,QAAQ,SAAS;IAAQ,MAAM,KAAA;IAAW;GAAS;EACxE;EACA,MAAM,OAAO,MAAM,SAAS,QAAQ;EACpC,IAAI,CAAC,SAAS,IAAI,OAAO;GAAE,IAAI;GAAO,QAAQ,SAAS;GAAQ,OAAO,QAAQ,IAAI;GAAG;GAAM;EAAS;EACpG,OAAO;GAAE,IAAI;GAAM,QAAQ,SAAS;GAAQ;GAAM;EAAS;CAC7D;CAEA,IAAI,KAAK,WAAW,MAAM,OAAO;EAAE;EAAK;CAAK;CAC7C,OAAO,OAAO,OAAO,MAAM;EAAE;EAAK;CAAK,CAAC;AAC1C;AAEA,SAAS,YACP,QACA,SACA,SACyB;CACzB,MAAM,SAA+D,CAAC;CACtE,KAAK,MAAM,CAAC,KAAK,SAAS,OAAO,QAAQ,MAAM,GAAG,OAAO,OAAO,UAAU,MAAM,SAAS,OAAO;CAChG,OAAO;AACT;;;;;;;AAQA,SAAgB,gBACd,QACA,SAC6B;CAC7B,MAAM,OAAO;CACb,MAAM,YAAmG,CAAC;CAC1G,KAAK,MAAM,SAAS,QAAQ,QAAQ;EAClC,IAAI,UAAU,UAAU,UAAU,SAAS,YAAY,QAAQ,EAAE,OAAO,SAAS,GAAG,IAAI;EACxF,IAAI,UAAU,aACZ,UAAU,aAAa,gBAAwB,YAAY,QAAQ;GAAE,OAAO;GAAa;EAAY,GAAG,IAAI;EAE9G,IAAI,UAAU,WACZ,UAAU,WAAW,cAAsB,YAAY,QAAQ,KAAK,eAAe,SAAS,GAAG,IAAI;CAEvG;CACA,OAAO;AACT"}

package/dist/src/web/services/apiPaths/index.cjs

@@ -0,0 +1,83 @@
+//#region src/web/services/apiPaths/index.ts
+/** The base path the host reserves for its own settings API, mounted outside /plugins/. */
+const SETTINGS_BASE_PATH = "settings";
+/** The scope's own resource root: what a host-owned route hangs off. */
+function scopeApiRoot(address) {
+	if (address.scope === "global") return "/api";
+	const workspace = `/api/workspaces/${encodeURIComponent(address.workspaceId)}`;
+	if (address.scope === "workspace") return workspace;
+	return `${workspace}/sessions/${encodeURIComponent(address.sessionId)}`;
+}
+/**
+* The mount one package API answers on.
+*
+* `basePath` is omitted for a host-owned route, which the contract schema
+* already spells that way, so the session file-bytes route and a plugin route
+* are the same construction with one field different rather than two code
+* paths. `settings` is the host's own API and sits beside `/plugins`, not
+* under it.
+*/
+function pluginApiBase(address, basePath) {
+	const root = scopeApiRoot(address);
+	if (basePath === void 0) return root;
+	if (basePath === "settings") return `${root}/${SETTINGS_BASE_PATH}`;
+	return `${root}/plugins/${basePath}`;
+}
+/**
+* The query string, `encodeURIComponent` per pair rather than `URLSearchParams`.
+*
+* `URLSearchParams` writes a space as `+`, which only decodes back to a space
+* under form-urlencoded rules; `%20` decodes to a space everywhere. The
+* cockpit already relied on that difference in both directions, so picking the
+* unambiguous one is what lets a single encoder serve every route.
+*/
+function apiQueryString(query) {
+	if (query === void 0) return "";
+	const pairs = [];
+	for (const [key, value] of Object.entries(query)) {
+		if (value === void 0) continue;
+		pairs.push(`${encodeURIComponent(key)}=${encodeURIComponent(String(value))}`);
+	}
+	return pairs.length === 0 ? "" : `?${pairs.join("&")}`;
+}
+/**
+* The absolute, root-relative URL for one route.
+*
+* Root-relative on purpose: the sealed transport refuses anything else, because
+* a remote session relays its requests through a gateway that will not forward
+* an arbitrary origin.
+*
+* A route whose path is exactly '/' addresses the mount itself, so the slash is
+* dropped rather than doubled.
+*/
+function pluginApiUrl(address, basePath, path, query, params) {
+	const resolved = applyPathParams(path, params);
+	return `${pluginApiBase(address, basePath)}${resolved === "/" ? "" : resolved}${apiQueryString(query)}`;
+}
+/**
+* Substitutes a route's `:name` segments, as Hono spells them.
+*
+* Encoded per segment, so a value containing a slash names one segment rather
+* than inventing another. A declared parameter with no value is left as the
+* literal `:name`, which fails visibly at the route instead of silently
+* addressing the collection above it.
+*/
+function applyPathParams(path, params) {
+	if (params === void 0 || !path.includes(":")) return path;
+	return path.split("/").map((segment) => {
+		if (!segment.startsWith(":")) return segment;
+		const catchAll = segment.endsWith("}");
+		const value = params[catchAll ? segment.slice(1, segment.indexOf("{")) : segment.slice(1)];
+		if (value === void 0) return segment;
+		return catchAll ? value.split("/").map(encodeURIComponent).join("/") : encodeURIComponent(value);
+	}).join("/");
+}
+//#endregion
+exports.SETTINGS_BASE_PATH = SETTINGS_BASE_PATH;
+exports.apiQueryString = apiQueryString;
+exports.applyPathParams = applyPathParams;
+exports.pluginApiBase = pluginApiBase;
+exports.pluginApiUrl = pluginApiUrl;
+exports.scopeApiRoot = scopeApiRoot;
+
+//# sourceMappingURL=index.cjs.map

package/dist/src/web/services/apiPaths/index.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.cjs","names":[],"sources":["../../../../../src/web/services/apiPaths/index.ts"],"sourcesContent":["/**\n * The byte shape of every URL the browser addresses a package API with.\n *\n * One implementation, because the alternative is what the cockpit had: twelve\n * packages each concatenating `${sessionApiPath(id)}/plugins/${base}${path}` by\n * hand, three of them spelling the prefix a fourth way, and one rewriting it\n * with `String.replace`. A route that moves by one character is answered by the\n * service worker out of the signed bundle cache instead of the network, so the\n * failure is a 404 nowhere near its cause.\n *\n * The host builds the same strings from `doomApiMountPath` and, for OpenAPI\n * templating, from `createApiDocuments`. Those live in the node half of this\n * package and cannot be imported here: `src/web` is a separate tree that reads\n * neither `src/schemas` nor `src/services`. The three are held together by the\n * agreement test instead of by a call, which is the guarantee that matters.\n */\n\n/**\n * Who a request is addressed to. Ids are supplied decoded and encoded here, so\n * a caller never double-encodes and a workspace with a slash in its name cannot\n * forge a path segment.\n */\nexport type ApiScopeAddress =\n  | { readonly scope: 'global' }\n  | { readonly scope: 'workspace'; readonly workspaceId: string }\n  | { readonly scope: 'session'; readonly workspaceId: string; readonly sessionId: string };\n\n/** Path parameter values, substituted into a route's `:name` segments. */\nexport type ApiParams = Readonly<Record<string, string>>;\n\n/** Query values a route may carry. `undefined` drops the parameter rather than sending 'undefined'. */\nexport type ApiQuery = Readonly<Record<string, string | number | boolean | undefined>>;\n\n/** The base path the host reserves for its own settings API, mounted outside /plugins/. */\nexport const SETTINGS_BASE_PATH = 'settings';\n\n/** The scope's own resource root: what a host-owned route hangs off. */\nexport function scopeApiRoot(address: ApiScopeAddress): string {\n  if (address.scope === 'global') return '/api';\n  const workspace = `/api/workspaces/${encodeURIComponent(address.workspaceId)}`;\n  if (address.scope === 'workspace') return workspace;\n  return `${workspace}/sessions/${encodeURIComponent(address.sessionId)}`;\n}\n\n/**\n * The mount one package API answers on.\n *\n * `basePath` is omitted for a host-owned route, which the contract schema\n * already spells that way, so the session file-bytes route and a plugin route\n * are the same construction with one field different rather than two code\n * paths. `settings` is the host's own API and sits beside `/plugins`, not\n * under it.\n */\nexport function pluginApiBase(address: ApiScopeAddress, basePath: string | undefined): string {\n  const root = scopeApiRoot(address);\n  if (basePath === undefined) return root;\n  if (basePath === SETTINGS_BASE_PATH) return `${root}/${SETTINGS_BASE_PATH}`;\n  return `${root}/plugins/${basePath}`;\n}\n\n/**\n * The query string, `encodeURIComponent` per pair rather than `URLSearchParams`.\n *\n * `URLSearchParams` writes a space as `+`, which only decodes back to a space\n * under form-urlencoded rules; `%20` decodes to a space everywhere. The\n * cockpit already relied on that difference in both directions, so picking the\n * unambiguous one is what lets a single encoder serve every route.\n */\nexport function apiQueryString(query: ApiQuery | undefined): string {\n  if (query === undefined) return '';\n  const pairs: string[] = [];\n  for (const [key, value] of Object.entries(query)) {\n    if (value === undefined) continue;\n    pairs.push(`${encodeURIComponent(key)}=${encodeURIComponent(String(value))}`);\n  }\n  return pairs.length === 0 ? '' : `?${pairs.join('&')}`;\n}\n\n/**\n * The absolute, root-relative URL for one route.\n *\n * Root-relative on purpose: the sealed transport refuses anything else, because\n * a remote session relays its requests through a gateway that will not forward\n * an arbitrary origin.\n *\n * A route whose path is exactly '/' addresses the mount itself, so the slash is\n * dropped rather than doubled.\n */\nexport function pluginApiUrl(\n  address: ApiScopeAddress,\n  basePath: string | undefined,\n  path: string,\n  query?: ApiQuery,\n  params?: ApiParams,\n): string {\n  const resolved = applyPathParams(path, params);\n  return `${pluginApiBase(address, basePath)}${resolved === '/' ? '' : resolved}${apiQueryString(query)}`;\n}\n\n/**\n * Substitutes a route's `:name` segments, as Hono spells them.\n *\n * Encoded per segment, so a value containing a slash names one segment rather\n * than inventing another. A declared parameter with no value is left as the\n * literal `:name`, which fails visibly at the route instead of silently\n * addressing the collection above it.\n */\nexport function applyPathParams(path: string, params: ApiParams | undefined): string {\n  if (params === undefined || !path.includes(':')) return path;\n  return path\n    .split('/')\n    .map((segment) => {\n      if (!segment.startsWith(':')) return segment;\n      // Hono writes a multi-segment parameter as `:name{.+}`. Its value is a\n      // relative path, so the slashes inside it are structure the route means\n      // to keep; encoding them would address one oddly-named file instead of a\n      // nested one. Each piece is still escaped on its own.\n      const catchAll = segment.endsWith('}');\n      const name = catchAll ? segment.slice(1, segment.indexOf('{')) : segment.slice(1);\n      const value = params[name];\n      if (value === undefined) return segment;\n      return catchAll ? value.split('/').map(encodeURIComponent).join('/') : encodeURIComponent(value);\n    })\n    .join('/');\n}\n"],"mappings":";;AAkCA,MAAa,qBAAqB;;AAGlC,SAAgB,aAAa,SAAkC;CAC7D,IAAI,QAAQ,UAAU,UAAU,OAAO;CACvC,MAAM,YAAY,mBAAmB,mBAAmB,QAAQ,WAAW;CAC3E,IAAI,QAAQ,UAAU,aAAa,OAAO;CAC1C,OAAO,GAAG,UAAU,YAAY,mBAAmB,QAAQ,SAAS;AACtE;;;;;;;;;;AAWA,SAAgB,cAAc,SAA0B,UAAsC;CAC5F,MAAM,OAAO,aAAa,OAAO;CACjC,IAAI,aAAa,KAAA,GAAW,OAAO;CACnC,IAAI,aAAA,YAAiC,OAAO,GAAG,KAAK,GAAG;CACvD,OAAO,GAAG,KAAK,WAAW;AAC5B;;;;;;;;;AAUA,SAAgB,eAAe,OAAqC;CAClE,IAAI,UAAU,KAAA,GAAW,OAAO;CAChC,MAAM,QAAkB,CAAC;CACzB,KAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,KAAK,GAAG;EAChD,IAAI,UAAU,KAAA,GAAW;EACzB,MAAM,KAAK,GAAG,mBAAmB,GAAG,EAAE,GAAG,mBAAmB,OAAO,KAAK,CAAC,GAAG;CAC9E;CACA,OAAO,MAAM,WAAW,IAAI,KAAK,IAAI,MAAM,KAAK,GAAG;AACrD;;;;;;;;;;;AAYA,SAAgB,aACd,SACA,UACA,MACA,OACA,QACQ;CACR,MAAM,WAAW,gBAAgB,MAAM,MAAM;CAC7C,OAAO,GAAG,cAAc,SAAS,QAAQ,IAAI,aAAa,MAAM,KAAK,WAAW,eAAe,KAAK;AACtG;;;;;;;;;AAUA,SAAgB,gBAAgB,MAAc,QAAuC;CACnF,IAAI,WAAW,KAAA,KAAa,CAAC,KAAK,SAAS,GAAG,GAAG,OAAO;CACxD,OAAO,KACJ,MAAM,GAAG,CAAC,CACV,KAAK,YAAY;EAChB,IAAI,CAAC,QAAQ,WAAW,GAAG,GAAG,OAAO;EAKrC,MAAM,WAAW,QAAQ,SAAS,GAAG;EAErC,MAAM,QAAQ,OADD,WAAW,QAAQ,MAAM,GAAG,QAAQ,QAAQ,GAAG,CAAC,IAAI,QAAQ,MAAM,CAAC;EAEhF,IAAI,UAAU,KAAA,GAAW,OAAO;EAChC,OAAO,WAAW,MAAM,MAAM,GAAG,CAAC,CAAC,IAAI,kBAAkB,CAAC,CAAC,KAAK,GAAG,IAAI,mBAAmB,KAAK;CACjG,CAAC,CAAC,CACD,KAAK,GAAG;AACb"}

package/dist/src/web/services/apiPaths/index.d.mts

@@ -0,0 +1,81 @@
+//#region src/web/services/apiPaths/index.d.ts
+/**
+ * The byte shape of every URL the browser addresses a package API with.
+ *
+ * One implementation, because the alternative is what the cockpit had: twelve
+ * packages each concatenating `${sessionApiPath(id)}/plugins/${base}${path}` by
+ * hand, three of them spelling the prefix a fourth way, and one rewriting it
+ * with `String.replace`. A route that moves by one character is answered by the
+ * service worker out of the signed bundle cache instead of the network, so the
+ * failure is a 404 nowhere near its cause.
+ *
+ * The host builds the same strings from `doomApiMountPath` and, for OpenAPI
+ * templating, from `createApiDocuments`. Those live in the node half of this
+ * package and cannot be imported here: `src/web` is a separate tree that reads
+ * neither `src/schemas` nor `src/services`. The three are held together by the
+ * agreement test instead of by a call, which is the guarantee that matters.
+ */
+/**
+ * Who a request is addressed to. Ids are supplied decoded and encoded here, so
+ * a caller never double-encodes and a workspace with a slash in its name cannot
+ * forge a path segment.
+ */
+export type ApiScopeAddress = {
+  readonly scope: 'global';
+} | {
+  readonly scope: 'workspace';
+  readonly workspaceId: string;
+} | {
+  readonly scope: 'session';
+  readonly workspaceId: string;
+  readonly sessionId: string;
+};
+/** Path parameter values, substituted into a route's `:name` segments. */
+export type ApiParams = Readonly<Record<string, string>>;
+/** Query values a route may carry. `undefined` drops the parameter rather than sending 'undefined'. */
+export type ApiQuery = Readonly<Record<string, string | number | boolean | undefined>>;
+/** The base path the host reserves for its own settings API, mounted outside /plugins/. */
+export declare const SETTINGS_BASE_PATH = "settings";
+/** The scope's own resource root: what a host-owned route hangs off. */
+export declare function scopeApiRoot(address: ApiScopeAddress): string;
+/**
+ * The mount one package API answers on.
+ *
+ * `basePath` is omitted for a host-owned route, which the contract schema
+ * already spells that way, so the session file-bytes route and a plugin route
+ * are the same construction with one field different rather than two code
+ * paths. `settings` is the host's own API and sits beside `/plugins`, not
+ * under it.
+ */
+export declare function pluginApiBase(address: ApiScopeAddress, basePath: string | undefined): string;
+/**
+ * The query string, `encodeURIComponent` per pair rather than `URLSearchParams`.
+ *
+ * `URLSearchParams` writes a space as `+`, which only decodes back to a space
+ * under form-urlencoded rules; `%20` decodes to a space everywhere. The
+ * cockpit already relied on that difference in both directions, so picking the
+ * unambiguous one is what lets a single encoder serve every route.
+ */
+export declare function apiQueryString(query: ApiQuery | undefined): string;
+/**
+ * The absolute, root-relative URL for one route.
+ *
+ * Root-relative on purpose: the sealed transport refuses anything else, because
+ * a remote session relays its requests through a gateway that will not forward
+ * an arbitrary origin.
+ *
+ * A route whose path is exactly '/' addresses the mount itself, so the slash is
+ * dropped rather than doubled.
+ */
+export declare function pluginApiUrl(address: ApiScopeAddress, basePath: string | undefined, path: string, query?: ApiQuery, params?: ApiParams): string;
+/**
+ * Substitutes a route's `:name` segments, as Hono spells them.
+ *
+ * Encoded per segment, so a value containing a slash names one segment rather
+ * than inventing another. A declared parameter with no value is left as the
+ * literal `:name`, which fails visibly at the route instead of silently
+ * addressing the collection above it.
+ */
+export declare function applyPathParams(path: string, params: ApiParams | undefined): string;
+//#endregion
+//# sourceMappingURL=index.d.mts.map

package/dist/src/web/services/apiPaths/index.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.mts","names":[],"sources":["../../../../../src/web/services/apiPaths/index.ts"],"mappings":";;;;;;;;;;;;;;;;;;;;;;YAsBY;WACG;;WACA;WAA6B;;WAC7B;WAA2B;WAA8B;;;YAG5D,YAAY,SAAS;;YAGrB,WAAW,SAAS;;qBAGnB;;wBAGG,aAAa,SAAS;;;;;;;;;;wBAgBtB,cAAc,SAAS,iBAAiB;;;;;;;;;wBAexC,eAAe,OAAO;;;;;;;;;;;wBAoBtB,aACd,SAAS,iBACT,8BACA,cACA,QAAQ,UACR,SAAS;;;;;;;;;wBAcK,gBAAgB,cAAc,QAAQ"}

package/dist/src/web/services/apiPaths/index.mjs

@@ -0,0 +1,78 @@
+//#region src/web/services/apiPaths/index.ts
+/** The base path the host reserves for its own settings API, mounted outside /plugins/. */
+const SETTINGS_BASE_PATH = "settings";
+/** The scope's own resource root: what a host-owned route hangs off. */
+function scopeApiRoot(address) {
+	if (address.scope === "global") return "/api";
+	const workspace = `/api/workspaces/${encodeURIComponent(address.workspaceId)}`;
+	if (address.scope === "workspace") return workspace;
+	return `${workspace}/sessions/${encodeURIComponent(address.sessionId)}`;
+}
+/**
+* The mount one package API answers on.
+*
+* `basePath` is omitted for a host-owned route, which the contract schema
+* already spells that way, so the session file-bytes route and a plugin route
+* are the same construction with one field different rather than two code
+* paths. `settings` is the host's own API and sits beside `/plugins`, not
+* under it.
+*/
+function pluginApiBase(address, basePath) {
+	const root = scopeApiRoot(address);
+	if (basePath === void 0) return root;
+	if (basePath === "settings") return `${root}/${SETTINGS_BASE_PATH}`;
+	return `${root}/plugins/${basePath}`;
+}
+/**
+* The query string, `encodeURIComponent` per pair rather than `URLSearchParams`.
+*
+* `URLSearchParams` writes a space as `+`, which only decodes back to a space
+* under form-urlencoded rules; `%20` decodes to a space everywhere. The
+* cockpit already relied on that difference in both directions, so picking the
+* unambiguous one is what lets a single encoder serve every route.
+*/
+function apiQueryString(query) {
+	if (query === void 0) return "";
+	const pairs = [];
+	for (const [key, value] of Object.entries(query)) {
+		if (value === void 0) continue;
+		pairs.push(`${encodeURIComponent(key)}=${encodeURIComponent(String(value))}`);
+	}
+	return pairs.length === 0 ? "" : `?${pairs.join("&")}`;
+}
+/**
+* The absolute, root-relative URL for one route.
+*
+* Root-relative on purpose: the sealed transport refuses anything else, because
+* a remote session relays its requests through a gateway that will not forward
+* an arbitrary origin.
+*
+* A route whose path is exactly '/' addresses the mount itself, so the slash is
+* dropped rather than doubled.
+*/
+function pluginApiUrl(address, basePath, path, query, params) {
+	const resolved = applyPathParams(path, params);
+	return `${pluginApiBase(address, basePath)}${resolved === "/" ? "" : resolved}${apiQueryString(query)}`;
+}
+/**
+* Substitutes a route's `:name` segments, as Hono spells them.
+*
+* Encoded per segment, so a value containing a slash names one segment rather
+* than inventing another. A declared parameter with no value is left as the
+* literal `:name`, which fails visibly at the route instead of silently
+* addressing the collection above it.
+*/
+function applyPathParams(path, params) {
+	if (params === void 0 || !path.includes(":")) return path;
+	return path.split("/").map((segment) => {
+		if (!segment.startsWith(":")) return segment;
+		const catchAll = segment.endsWith("}");
+		const value = params[catchAll ? segment.slice(1, segment.indexOf("{")) : segment.slice(1)];
+		if (value === void 0) return segment;
+		return catchAll ? value.split("/").map(encodeURIComponent).join("/") : encodeURIComponent(value);
+	}).join("/");
+}
+//#endregion
+export { SETTINGS_BASE_PATH, apiQueryString, applyPathParams, pluginApiBase, pluginApiUrl, scopeApiRoot };
+
+//# sourceMappingURL=index.mjs.map

package/dist/src/web/services/apiPaths/index.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.mjs","names":[],"sources":["../../../../../src/web/services/apiPaths/index.ts"],"sourcesContent":["/**\n * The byte shape of every URL the browser addresses a package API with.\n *\n * One implementation, because the alternative is what the cockpit had: twelve\n * packages each concatenating `${sessionApiPath(id)}/plugins/${base}${path}` by\n * hand, three of them spelling the prefix a fourth way, and one rewriting it\n * with `String.replace`. A route that moves by one character is answered by the\n * service worker out of the signed bundle cache instead of the network, so the\n * failure is a 404 nowhere near its cause.\n *\n * The host builds the same strings from `doomApiMountPath` and, for OpenAPI\n * templating, from `createApiDocuments`. Those live in the node half of this\n * package and cannot be imported here: `src/web` is a separate tree that reads\n * neither `src/schemas` nor `src/services`. The three are held together by the\n * agreement test instead of by a call, which is the guarantee that matters.\n */\n\n/**\n * Who a request is addressed to. Ids are supplied decoded and encoded here, so\n * a caller never double-encodes and a workspace with a slash in its name cannot\n * forge a path segment.\n */\nexport type ApiScopeAddress =\n  | { readonly scope: 'global' }\n  | { readonly scope: 'workspace'; readonly workspaceId: string }\n  | { readonly scope: 'session'; readonly workspaceId: string; readonly sessionId: string };\n\n/** Path parameter values, substituted into a route's `:name` segments. */\nexport type ApiParams = Readonly<Record<string, string>>;\n\n/** Query values a route may carry. `undefined` drops the parameter rather than sending 'undefined'. */\nexport type ApiQuery = Readonly<Record<string, string | number | boolean | undefined>>;\n\n/** The base path the host reserves for its own settings API, mounted outside /plugins/. */\nexport const SETTINGS_BASE_PATH = 'settings';\n\n/** The scope's own resource root: what a host-owned route hangs off. */\nexport function scopeApiRoot(address: ApiScopeAddress): string {\n  if (address.scope === 'global') return '/api';\n  const workspace = `/api/workspaces/${encodeURIComponent(address.workspaceId)}`;\n  if (address.scope === 'workspace') return workspace;\n  return `${workspace}/sessions/${encodeURIComponent(address.sessionId)}`;\n}\n\n/**\n * The mount one package API answers on.\n *\n * `basePath` is omitted for a host-owned route, which the contract schema\n * already spells that way, so the session file-bytes route and a plugin route\n * are the same construction with one field different rather than two code\n * paths. `settings` is the host's own API and sits beside `/plugins`, not\n * under it.\n */\nexport function pluginApiBase(address: ApiScopeAddress, basePath: string | undefined): string {\n  const root = scopeApiRoot(address);\n  if (basePath === undefined) return root;\n  if (basePath === SETTINGS_BASE_PATH) return `${root}/${SETTINGS_BASE_PATH}`;\n  return `${root}/plugins/${basePath}`;\n}\n\n/**\n * The query string, `encodeURIComponent` per pair rather than `URLSearchParams`.\n *\n * `URLSearchParams` writes a space as `+`, which only decodes back to a space\n * under form-urlencoded rules; `%20` decodes to a space everywhere. The\n * cockpit already relied on that difference in both directions, so picking the\n * unambiguous one is what lets a single encoder serve every route.\n */\nexport function apiQueryString(query: ApiQuery | undefined): string {\n  if (query === undefined) return '';\n  const pairs: string[] = [];\n  for (const [key, value] of Object.entries(query)) {\n    if (value === undefined) continue;\n    pairs.push(`${encodeURIComponent(key)}=${encodeURIComponent(String(value))}`);\n  }\n  return pairs.length === 0 ? '' : `?${pairs.join('&')}`;\n}\n\n/**\n * The absolute, root-relative URL for one route.\n *\n * Root-relative on purpose: the sealed transport refuses anything else, because\n * a remote session relays its requests through a gateway that will not forward\n * an arbitrary origin.\n *\n * A route whose path is exactly '/' addresses the mount itself, so the slash is\n * dropped rather than doubled.\n */\nexport function pluginApiUrl(\n  address: ApiScopeAddress,\n  basePath: string | undefined,\n  path: string,\n  query?: ApiQuery,\n  params?: ApiParams,\n): string {\n  const resolved = applyPathParams(path, params);\n  return `${pluginApiBase(address, basePath)}${resolved === '/' ? '' : resolved}${apiQueryString(query)}`;\n}\n\n/**\n * Substitutes a route's `:name` segments, as Hono spells them.\n *\n * Encoded per segment, so a value containing a slash names one segment rather\n * than inventing another. A declared parameter with no value is left as the\n * literal `:name`, which fails visibly at the route instead of silently\n * addressing the collection above it.\n */\nexport function applyPathParams(path: string, params: ApiParams | undefined): string {\n  if (params === undefined || !path.includes(':')) return path;\n  return path\n    .split('/')\n    .map((segment) => {\n      if (!segment.startsWith(':')) return segment;\n      // Hono writes a multi-segment parameter as `:name{.+}`. Its value is a\n      // relative path, so the slashes inside it are structure the route means\n      // to keep; encoding them would address one oddly-named file instead of a\n      // nested one. Each piece is still escaped on its own.\n      const catchAll = segment.endsWith('}');\n      const name = catchAll ? segment.slice(1, segment.indexOf('{')) : segment.slice(1);\n      const value = params[name];\n      if (value === undefined) return segment;\n      return catchAll ? value.split('/').map(encodeURIComponent).join('/') : encodeURIComponent(value);\n    })\n    .join('/');\n}\n"],"mappings":";;AAkCA,MAAa,qBAAqB;;AAGlC,SAAgB,aAAa,SAAkC;CAC7D,IAAI,QAAQ,UAAU,UAAU,OAAO;CACvC,MAAM,YAAY,mBAAmB,mBAAmB,QAAQ,WAAW;CAC3E,IAAI,QAAQ,UAAU,aAAa,OAAO;CAC1C,OAAO,GAAG,UAAU,YAAY,mBAAmB,QAAQ,SAAS;AACtE;;;;;;;;;;AAWA,SAAgB,cAAc,SAA0B,UAAsC;CAC5F,MAAM,OAAO,aAAa,OAAO;CACjC,IAAI,aAAa,KAAA,GAAW,OAAO;CACnC,IAAI,aAAA,YAAiC,OAAO,GAAG,KAAK,GAAG;CACvD,OAAO,GAAG,KAAK,WAAW;AAC5B;;;;;;;;;AAUA,SAAgB,eAAe,OAAqC;CAClE,IAAI,UAAU,KAAA,GAAW,OAAO;CAChC,MAAM,QAAkB,CAAC;CACzB,KAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,KAAK,GAAG;EAChD,IAAI,UAAU,KAAA,GAAW;EACzB,MAAM,KAAK,GAAG,mBAAmB,GAAG,EAAE,GAAG,mBAAmB,OAAO,KAAK,CAAC,GAAG;CAC9E;CACA,OAAO,MAAM,WAAW,IAAI,KAAK,IAAI,MAAM,KAAK,GAAG;AACrD;;;;;;;;;;;AAYA,SAAgB,aACd,SACA,UACA,MACA,OACA,QACQ;CACR,MAAM,WAAW,gBAAgB,MAAM,MAAM;CAC7C,OAAO,GAAG,cAAc,SAAS,QAAQ,IAAI,aAAa,MAAM,KAAK,WAAW,eAAe,KAAK;AACtG;;;;;;;;;AAUA,SAAgB,gBAAgB,MAAc,QAAuC;CACnF,IAAI,WAAW,KAAA,KAAa,CAAC,KAAK,SAAS,GAAG,GAAG,OAAO;CACxD,OAAO,KACJ,MAAM,GAAG,CAAC,CACV,KAAK,YAAY;EAChB,IAAI,CAAC,QAAQ,WAAW,GAAG,GAAG,OAAO;EAKrC,MAAM,WAAW,QAAQ,SAAS,GAAG;EAErC,MAAM,QAAQ,OADD,WAAW,QAAQ,MAAM,GAAG,QAAQ,QAAQ,GAAG,CAAC,IAAI,QAAQ,MAAM,CAAC;EAEhF,IAAI,UAAU,KAAA,GAAW,OAAO;EAChC,OAAO,WAAW,MAAM,MAAM,GAAG,CAAC,CAAC,IAAI,kBAAkB,CAAC,CAAC,KAAK,GAAG,IAAI,mBAAmB,KAAK;CACjG,CAAC,CAAC,CACD,KAAK,GAAG;AACb"}

package/dist/src/web/services/apiRoutes/index.cjs

@@ -0,0 +1,47 @@
+const require_index = require("../apiPaths/index.cjs");
+//#region src/web/services/apiRoutes/index.ts
+let resolveWorkspace;
+/** The host owns session summaries; package clients use the same ownership lookup. */
+function bindSessionApiWorkspace(resolve) {
+	resolveWorkspace = resolve;
+}
+/** Canonical global resource. */
+function globalApiPath() {
+	return require_index.scopeApiRoot({ scope: "global" });
+}
+/** Canonical workspace resource. */
+function workspaceApiPath(workspaceId) {
+	return require_index.scopeApiRoot({
+		scope: "workspace",
+		workspaceId
+	});
+}
+/**
+* Who a session id names, resolved through the host's ownership lookup.
+*
+* A generated client takes a session id and nothing else, because a page knows
+* which session it is showing and must not be trusted to say which workspace
+* owns it. Unknown ownership throws rather than guessing, since guessing would
+* address a different scope.
+*/
+function sessionApiAddress(sessionId) {
+	const workspaceId = resolveWorkspace?.(sessionId);
+	if (!workspaceId) throw new Error(`Workspace is unavailable for session '${sessionId}'.`);
+	return {
+		scope: "session",
+		workspaceId,
+		sessionId
+	};
+}
+/** Canonical session resource. Unknown ownership must never select a different scope. */
+function sessionApiPath(sessionId) {
+	return require_index.scopeApiRoot(sessionApiAddress(sessionId));
+}
+//#endregion
+exports.bindSessionApiWorkspace = bindSessionApiWorkspace;
+exports.globalApiPath = globalApiPath;
+exports.sessionApiAddress = sessionApiAddress;
+exports.sessionApiPath = sessionApiPath;
+exports.workspaceApiPath = workspaceApiPath;
+
+//# sourceMappingURL=index.cjs.map

package/dist/src/web/services/apiRoutes/index.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.cjs","names":["scopeApiRoot"],"sources":["../../../../../src/web/services/apiRoutes/index.ts"],"sourcesContent":["import { type ApiScopeAddress, scopeApiRoot } from '../apiPaths';\n\nlet resolveWorkspace: ((sessionId: string) => string | undefined) | undefined;\n\n/** The host owns session summaries; package clients use the same ownership lookup. */\nexport function bindSessionApiWorkspace(resolve: (sessionId: string) => string | undefined): void {\n  resolveWorkspace = resolve;\n}\n\n/** Canonical global resource. */\nexport function globalApiPath(): string {\n  return scopeApiRoot({ scope: 'global' });\n}\n\n/** Canonical workspace resource. */\nexport function workspaceApiPath(workspaceId: string): string {\n  return scopeApiRoot({ scope: 'workspace', workspaceId });\n}\n\n/**\n * Who a session id names, resolved through the host's ownership lookup.\n *\n * A generated client takes a session id and nothing else, because a page knows\n * which session it is showing and must not be trusted to say which workspace\n * owns it. Unknown ownership throws rather than guessing, since guessing would\n * address a different scope.\n */\nexport function sessionApiAddress(sessionId: string): ApiScopeAddress {\n  const workspaceId = resolveWorkspace?.(sessionId);\n  if (!workspaceId) throw new Error(`Workspace is unavailable for session '${sessionId}'.`);\n  return { scope: 'session', workspaceId, sessionId };\n}\n\n/** Canonical session resource. Unknown ownership must never select a different scope. */\nexport function sessionApiPath(sessionId: string): string {\n  return scopeApiRoot(sessionApiAddress(sessionId));\n}\n"],"mappings":";;AAEA,IAAI;;AAGJ,SAAgB,wBAAwB,SAA0D;CAChG,mBAAmB;AACrB;;AAGA,SAAgB,gBAAwB;CACtC,OAAOA,cAAAA,aAAa,EAAE,OAAO,SAAS,CAAC;AACzC;;AAGA,SAAgB,iBAAiB,aAA6B;CAC5D,OAAOA,cAAAA,aAAa;EAAE,OAAO;EAAa;CAAY,CAAC;AACzD;;;;;;;;;AAUA,SAAgB,kBAAkB,WAAoC;CACpE,MAAM,cAAc,mBAAmB,SAAS;CAChD,IAAI,CAAC,aAAa,MAAM,IAAI,MAAM,yCAAyC,UAAU,GAAG;CACxF,OAAO;EAAE,OAAO;EAAW;EAAa;CAAU;AACpD;;AAGA,SAAgB,eAAe,WAA2B;CACxD,OAAOA,cAAAA,aAAa,kBAAkB,SAAS,CAAC;AAClD"}

package/dist/src/web/services/apiRoutes/index.d.mts

@@ -0,0 +1,21 @@
+import { ApiScopeAddress } from "../apiPaths/index.mjs";
+//#region src/web/services/apiRoutes/index.d.ts
+/** The host owns session summaries; package clients use the same ownership lookup. */
+export declare function bindSessionApiWorkspace(resolve: (sessionId: string) => string | undefined): void;
+/** Canonical global resource. */
+export declare function globalApiPath(): string;
+/** Canonical workspace resource. */
+export declare function workspaceApiPath(workspaceId: string): string;
+/**
+ * Who a session id names, resolved through the host's ownership lookup.
+ *
+ * A generated client takes a session id and nothing else, because a page knows
+ * which session it is showing and must not be trusted to say which workspace
+ * owns it. Unknown ownership throws rather than guessing, since guessing would
+ * address a different scope.
+ */
+export declare function sessionApiAddress(sessionId: string): ApiScopeAddress;
+/** Canonical session resource. Unknown ownership must never select a different scope. */
+export declare function sessionApiPath(sessionId: string): string;
+//#endregion
+//# sourceMappingURL=index.d.mts.map

package/dist/src/web/services/apiRoutes/index.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.mts","names":[],"sources":["../../../../../src/web/services/apiRoutes/index.ts"],"mappings":";;;wBAKgB,wBAAwB,UAAU;;wBAKlC;;wBAKA,iBAAiB;;;;;;;;;wBAYjB,kBAAkB,oBAAoB;;wBAOtC,eAAe"}

package/dist/src/web/services/apiRoutes/index.mjs

@@ -0,0 +1,43 @@
+import { scopeApiRoot } from "../apiPaths/index.mjs";
+//#region src/web/services/apiRoutes/index.ts
+let resolveWorkspace;
+/** The host owns session summaries; package clients use the same ownership lookup. */
+function bindSessionApiWorkspace(resolve) {
+	resolveWorkspace = resolve;
+}
+/** Canonical global resource. */
+function globalApiPath() {
+	return scopeApiRoot({ scope: "global" });
+}
+/** Canonical workspace resource. */
+function workspaceApiPath(workspaceId) {
+	return scopeApiRoot({
+		scope: "workspace",
+		workspaceId
+	});
+}
+/**
+* Who a session id names, resolved through the host's ownership lookup.
+*
+* A generated client takes a session id and nothing else, because a page knows
+* which session it is showing and must not be trusted to say which workspace
+* owns it. Unknown ownership throws rather than guessing, since guessing would
+* address a different scope.
+*/
+function sessionApiAddress(sessionId) {
+	const workspaceId = resolveWorkspace?.(sessionId);
+	if (!workspaceId) throw new Error(`Workspace is unavailable for session '${sessionId}'.`);
+	return {
+		scope: "session",
+		workspaceId,
+		sessionId
+	};
+}
+/** Canonical session resource. Unknown ownership must never select a different scope. */
+function sessionApiPath(sessionId) {
+	return scopeApiRoot(sessionApiAddress(sessionId));
+}
+//#endregion
+export { bindSessionApiWorkspace, globalApiPath, sessionApiAddress, sessionApiPath, workspaceApiPath };
+
+//# sourceMappingURL=index.mjs.map

package/dist/src/web/services/apiRoutes/index.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.mjs","names":[],"sources":["../../../../../src/web/services/apiRoutes/index.ts"],"sourcesContent":["import { type ApiScopeAddress, scopeApiRoot } from '../apiPaths';\n\nlet resolveWorkspace: ((sessionId: string) => string | undefined) | undefined;\n\n/** The host owns session summaries; package clients use the same ownership lookup. */\nexport function bindSessionApiWorkspace(resolve: (sessionId: string) => string | undefined): void {\n  resolveWorkspace = resolve;\n}\n\n/** Canonical global resource. */\nexport function globalApiPath(): string {\n  return scopeApiRoot({ scope: 'global' });\n}\n\n/** Canonical workspace resource. */\nexport function workspaceApiPath(workspaceId: string): string {\n  return scopeApiRoot({ scope: 'workspace', workspaceId });\n}\n\n/**\n * Who a session id names, resolved through the host's ownership lookup.\n *\n * A generated client takes a session id and nothing else, because a page knows\n * which session it is showing and must not be trusted to say which workspace\n * owns it. Unknown ownership throws rather than guessing, since guessing would\n * address a different scope.\n */\nexport function sessionApiAddress(sessionId: string): ApiScopeAddress {\n  const workspaceId = resolveWorkspace?.(sessionId);\n  if (!workspaceId) throw new Error(`Workspace is unavailable for session '${sessionId}'.`);\n  return { scope: 'session', workspaceId, sessionId };\n}\n\n/** Canonical session resource. Unknown ownership must never select a different scope. */\nexport function sessionApiPath(sessionId: string): string {\n  return scopeApiRoot(sessionApiAddress(sessionId));\n}\n"],"mappings":";;AAEA,IAAI;;AAGJ,SAAgB,wBAAwB,SAA0D;CAChG,mBAAmB;AACrB;;AAGA,SAAgB,gBAAwB;CACtC,OAAO,aAAa,EAAE,OAAO,SAAS,CAAC;AACzC;;AAGA,SAAgB,iBAAiB,aAA6B;CAC5D,OAAO,aAAa;EAAE,OAAO;EAAa;CAAY,CAAC;AACzD;;;;;;;;;AAUA,SAAgB,kBAAkB,WAAoC;CACpE,MAAM,cAAc,mBAAmB,SAAS;CAChD,IAAI,CAAC,aAAa,MAAM,IAAI,MAAM,yCAAyC,UAAU,GAAG;CACxF,OAAO;EAAE,OAAO;EAAW;EAAa;CAAU;AACpD;;AAGA,SAAgB,eAAe,WAA2B;CACxD,OAAO,aAAa,kBAAkB,SAAS,CAAC;AAClD"}

package/dist/src/web/services/mcpWidget.cjs

@@ -0,0 +1,9 @@
+//#region src/web/services/mcpWidget.ts
+/** Types one package-owned MCP widget without coupling the route to the composed host. */
+function defineMcpWidget(widget) {
+	return widget;
+}
+//#endregion
+exports.defineMcpWidget = defineMcpWidget;
+
+//# sourceMappingURL=mcpWidget.cjs.map

package/dist/src/web/services/mcpWidget.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcpWidget.cjs","names":[],"sources":["../../../../src/web/services/mcpWidget.ts"],"sourcesContent":["import type { DoomMcpWidgetProps } from '../types/mcpWidget';\n\n/** Types one package-owned MCP widget without coupling the route to the composed host. */\nexport function defineMcpWidget<T extends (props: DoomMcpWidgetProps) => unknown>(widget: T): T {\n  return widget;\n}\n"],"mappings":";;AAGA,SAAgB,gBAAkE,QAAc;CAC9F,OAAO;AACT"}

package/dist/src/web/services/mcpWidget.d.mts

@@ -0,0 +1,6 @@
+import { DoomMcpWidgetProps } from "../types/mcpWidget.mjs";
+//#region src/web/services/mcpWidget.d.ts
+/** Types one package-owned MCP widget without coupling the route to the composed host. */
+export declare function defineMcpWidget<T extends (props: DoomMcpWidgetProps) => unknown>(widget: T): T;
+//#endregion
+//# sourceMappingURL=mcpWidget.d.mts.map

package/dist/src/web/services/mcpWidget.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcpWidget.d.mts","names":[],"sources":["../../../../src/web/services/mcpWidget.ts"],"mappings":";;;wBAGgB,gBAAgB,WAAW,OAAO,gCAAgC,QAAQ,IAAI"}

package/dist/src/web/services/mcpWidget.mjs

@@ -0,0 +1,9 @@
+//#region src/web/services/mcpWidget.ts
+/** Types one package-owned MCP widget without coupling the route to the composed host. */
+function defineMcpWidget(widget) {
+	return widget;
+}
+//#endregion
+export { defineMcpWidget };
+
+//# sourceMappingURL=mcpWidget.mjs.map

package/dist/src/web/services/mcpWidget.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcpWidget.mjs","names":[],"sources":["../../../../src/web/services/mcpWidget.ts"],"sourcesContent":["import type { DoomMcpWidgetProps } from '../types/mcpWidget';\n\n/** Types one package-owned MCP widget without coupling the route to the composed host. */\nexport function defineMcpWidget<T extends (props: DoomMcpWidgetProps) => unknown>(widget: T): T {\n  return widget;\n}\n"],"mappings":";;AAGA,SAAgB,gBAAkE,QAAc;CAC9F,OAAO;AACT"}

package/dist/src/web/services/sessionRegistry/index.cjs

@@ -0,0 +1,70 @@
+//#region src/web/services/sessionRegistry/index.ts
+/** Overrides the runtime directory the hub and its session servers share. */
+const REGISTRY_DIR_ENV = "DOOMPI_RUNTIME_DIR";
+/** The version a hub advertisement must carry to be read at all. */
+const HUB_ADVERTISEMENT_VERSION = 1;
+const DEFAULT_RUN_DIR_SEGMENT = ".doompi/run";
+const HUB_ADVERTISEMENT_FILE = "hub.json";
+/**
+* The single definition of where the session registry lives.
+*
+* The hub, the session server, and any package that spawns a session must land
+* on the same directory or a spawned session never appears in the rail. This
+* used to be copied into each of them; it lives here so there is one answer.
+*/
+function resolveRegistryDir(input) {
+	if (input.flagValue) return input.flagValue;
+	if (input.envValue) return input.envValue;
+	return `${input.homeDir}/${DEFAULT_RUN_DIR_SEGMENT}`;
+}
+/** Where the hub publishes its local address, at the registry root. */
+function hubAdvertisementPath(registryDir) {
+	return `${registryDir}/${HUB_ADVERTISEMENT_FILE}`;
+}
+/**
+* Reads a hub advertisement's contents.
+*
+* Like the lineage sidecar, every failure collapses to "no hub advertised",
+* because a caller can do nothing different with a torn write than with a
+* missing file. The url is required to be a loopback http origin: this file is
+* a discovery hint for local processes, and honouring an arbitrary address out
+* of it would let anything that can write the registry directory redirect a
+* session-create call to a host of its choosing.
+*/
+function parseHubAdvertisement(raw) {
+	let parsed;
+	try {
+		parsed = JSON.parse(raw);
+	} catch {
+		return;
+	}
+	if (typeof parsed !== "object" || parsed === null) return void 0;
+	const record = parsed;
+	if (record.version !== 1) return void 0;
+	if (typeof record.url !== "string" || !isLoopbackHttpUrl(record.url)) return void 0;
+	if (typeof record.pid !== "number" || !Number.isInteger(record.pid) || record.pid <= 0) return void 0;
+	return {
+		version: 1,
+		url: record.url,
+		pid: record.pid
+	};
+}
+/** Whether a url is plain http to this machine, which is all this file may name. */
+function isLoopbackHttpUrl(value) {
+	let url;
+	try {
+		url = new URL(value);
+	} catch {
+		return false;
+	}
+	if (url.protocol !== "http:") return false;
+	return url.hostname === "127.0.0.1" || url.hostname === "localhost" || url.hostname === "[::1]" || url.hostname === "::1";
+}
+//#endregion
+exports.HUB_ADVERTISEMENT_VERSION = HUB_ADVERTISEMENT_VERSION;
+exports.REGISTRY_DIR_ENV = REGISTRY_DIR_ENV;
+exports.hubAdvertisementPath = hubAdvertisementPath;
+exports.parseHubAdvertisement = parseHubAdvertisement;
+exports.resolveRegistryDir = resolveRegistryDir;
+
+//# sourceMappingURL=index.cjs.map

package/dist/src/web/services/sessionRegistry/index.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.cjs","names":[],"sources":["../../../../../src/web/services/sessionRegistry/index.ts"],"sourcesContent":["import type { HubAdvertisement, RegistryDirInput } from '../../types/sessionRegistry';\n\n/** Overrides the runtime directory the hub and its session servers share. */\nexport const REGISTRY_DIR_ENV = 'DOOMPI_RUNTIME_DIR';\n\n/** The version a hub advertisement must carry to be read at all. */\nexport const HUB_ADVERTISEMENT_VERSION = 1;\n\nconst DEFAULT_RUN_DIR_SEGMENT = '.doompi/run';\nconst HUB_ADVERTISEMENT_FILE = 'hub.json';\n\n/**\n * The single definition of where the session registry lives.\n *\n * The hub, the session server, and any package that spawns a session must land\n * on the same directory or a spawned session never appears in the rail. This\n * used to be copied into each of them; it lives here so there is one answer.\n */\nexport function resolveRegistryDir(input: RegistryDirInput): string {\n  if (input.flagValue) return input.flagValue;\n  if (input.envValue) return input.envValue;\n  return `${input.homeDir}/${DEFAULT_RUN_DIR_SEGMENT}`;\n}\n\n/** Where the hub publishes its local address, at the registry root. */\nexport function hubAdvertisementPath(registryDir: string): string {\n  return `${registryDir}/${HUB_ADVERTISEMENT_FILE}`;\n}\n\n/**\n * Reads a hub advertisement's contents.\n *\n * Like the lineage sidecar, every failure collapses to \"no hub advertised\",\n * because a caller can do nothing different with a torn write than with a\n * missing file. The url is required to be a loopback http origin: this file is\n * a discovery hint for local processes, and honouring an arbitrary address out\n * of it would let anything that can write the registry directory redirect a\n * session-create call to a host of its choosing.\n */\nexport function parseHubAdvertisement(raw: string): HubAdvertisement | undefined {\n  let parsed: unknown;\n  try {\n    parsed = JSON.parse(raw);\n  } catch {\n    return undefined;\n  }\n  if (typeof parsed !== 'object' || parsed === null) return undefined;\n  const record = parsed as Partial<HubAdvertisement>;\n  if (record.version !== HUB_ADVERTISEMENT_VERSION) return undefined;\n  if (typeof record.url !== 'string' || !isLoopbackHttpUrl(record.url)) return undefined;\n  if (typeof record.pid !== 'number' || !Number.isInteger(record.pid) || record.pid <= 0) return undefined;\n  return { version: HUB_ADVERTISEMENT_VERSION, url: record.url, pid: record.pid };\n}\n\n/** Whether a url is plain http to this machine, which is all this file may name. */\nfunction isLoopbackHttpUrl(value: string): boolean {\n  let url: URL;\n  try {\n    url = new URL(value);\n  } catch {\n    return false;\n  }\n  if (url.protocol !== 'http:') return false;\n  return (\n    url.hostname === '127.0.0.1' || url.hostname === 'localhost' || url.hostname === '[::1]' || url.hostname === '::1'\n  );\n}\n"],"mappings":";;AAGA,MAAa,mBAAmB;;AAGhC,MAAa,4BAA4B;AAEzC,MAAM,0BAA0B;AAChC,MAAM,yBAAyB;;;;;;;;AAS/B,SAAgB,mBAAmB,OAAiC;CAClE,IAAI,MAAM,WAAW,OAAO,MAAM;CAClC,IAAI,MAAM,UAAU,OAAO,MAAM;CACjC,OAAO,GAAG,MAAM,QAAQ,GAAG;AAC7B;;AAGA,SAAgB,qBAAqB,aAA6B;CAChE,OAAO,GAAG,YAAY,GAAG;AAC3B;;;;;;;;;;;AAYA,SAAgB,sBAAsB,KAA2C;CAC/E,IAAI;CACJ,IAAI;EACF,SAAS,KAAK,MAAM,GAAG;CACzB,QAAQ;EACN;CACF;CACA,IAAI,OAAO,WAAW,YAAY,WAAW,MAAM,OAAO,KAAA;CAC1D,MAAM,SAAS;CACf,IAAI,OAAO,YAAA,GAAuC,OAAO,KAAA;CACzD,IAAI,OAAO,OAAO,QAAQ,YAAY,CAAC,kBAAkB,OAAO,GAAG,GAAG,OAAO,KAAA;CAC7E,IAAI,OAAO,OAAO,QAAQ,YAAY,CAAC,OAAO,UAAU,OAAO,GAAG,KAAK,OAAO,OAAO,GAAG,OAAO,KAAA;CAC/F,OAAO;EAAE,SAAA;EAAoC,KAAK,OAAO;EAAK,KAAK,OAAO;CAAI;AAChF;;AAGA,SAAS,kBAAkB,OAAwB;CACjD,IAAI;CACJ,IAAI;EACF,MAAM,IAAI,IAAI,KAAK;CACrB,QAAQ;EACN,OAAO;CACT;CACA,IAAI,IAAI,aAAa,SAAS,OAAO;CACrC,OACE,IAAI,aAAa,eAAe,IAAI,aAAa,eAAe,IAAI,aAAa,WAAW,IAAI,aAAa;AAEjH"}

package/dist/src/web/services/sessionRegistry/index.d.mts

@@ -0,0 +1,29 @@
+import { HubAdvertisement, RegistryDirInput } from "../../types/sessionRegistry.mjs";
+//#region src/web/services/sessionRegistry/index.d.ts
+/** Overrides the runtime directory the hub and its session servers share. */
+export declare const REGISTRY_DIR_ENV = "DOOMPI_RUNTIME_DIR";
+/** The version a hub advertisement must carry to be read at all. */
+export declare const HUB_ADVERTISEMENT_VERSION = 1;
+/**
+ * The single definition of where the session registry lives.
+ *
+ * The hub, the session server, and any package that spawns a session must land
+ * on the same directory or a spawned session never appears in the rail. This
+ * used to be copied into each of them; it lives here so there is one answer.
+ */
+export declare function resolveRegistryDir(input: RegistryDirInput): string;
+/** Where the hub publishes its local address, at the registry root. */
+export declare function hubAdvertisementPath(registryDir: string): string;
+/**
+ * Reads a hub advertisement's contents.
+ *
+ * Like the lineage sidecar, every failure collapses to "no hub advertised",
+ * because a caller can do nothing different with a torn write than with a
+ * missing file. The url is required to be a loopback http origin: this file is
+ * a discovery hint for local processes, and honouring an arbitrary address out
+ * of it would let anything that can write the registry directory redirect a
+ * session-create call to a host of its choosing.
+ */
+export declare function parseHubAdvertisement(raw: string): HubAdvertisement | undefined;
+//#endregion
+//# sourceMappingURL=index.d.mts.map

package/dist/src/web/services/sessionRegistry/index.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.mts","names":[],"sources":["../../../../../src/web/services/sessionRegistry/index.ts"],"mappings":";;;qBAGa;;qBAGA;;;;;;;;wBAYG,mBAAmB,OAAO;;wBAO1B,qBAAqB;;;;;;;;;;;wBAcrB,sBAAsB,cAAc"}