@agimon-ai/doompi-core 0.0.1-alpha.100

package/dist/src/services/bundlePublication/index.mjs

@@ -0,0 +1,85 @@
+import fs from "node:fs";
+import path from "node:path";
+import { createBundleSigner } from "@agimon-ai/doompi-web-security/node";
+//#region src/services/bundlePublication/index.ts
+/**
+* Signs synchronized plugin generations without replacing the stable shell publication.
+*
+* Publications are retained by the exact identity and revision advertised to pages, so
+* a concurrent sync cannot pair an old manifest with bytes from a new generation.
+*/
+function createPluginBundlePublication(stateDir, onNotice = () => {}) {
+	let signer;
+	try {
+		signer = createBundleSigner(stateDir, onNotice);
+	} catch (error) {
+		onNotice(`plugin compositions could not be signed: ${error instanceof Error ? error.message : String(error)}`);
+	}
+	const byComposition = /* @__PURE__ */ new Map();
+	const byRoute = /* @__PURE__ */ new Map();
+	const publicationRoot = signer === void 0 ? void 0 : fs.mkdtempSync(path.join(stateDir, "plugin-publications-"));
+	let closed = false;
+	const routeKey = (compositionId, revision) => `${compositionId}:${String(revision)}`;
+	const publish = (compositionId, assetsDir) => {
+		if (closed) return void 0;
+		const existing = byComposition.get(compositionId);
+		if (existing !== void 0) return existing;
+		if (signer === void 0 || publicationRoot === void 0) return void 0;
+		const stagingRoot = fs.mkdtempSync(path.join(publicationRoot, ".staging-"));
+		const snapshot = path.join(stagingRoot, "assets");
+		try {
+			fs.cpSync(assetsDir, snapshot, { recursive: true });
+			const signed = signer.sign(snapshot);
+			if (signed === void 0) {
+				onNotice(`plugin composition '${compositionId}' is empty and cannot be published`);
+				return;
+			}
+			const retainedDirectory = path.join(publicationRoot, `${compositionId}-${String(signed.manifest.revision)}`);
+			fs.renameSync(snapshot, retainedDirectory);
+			const published = {
+				signed,
+				assetsDir: retainedDirectory
+			};
+			byComposition.set(compositionId, published);
+			byRoute.set(routeKey(compositionId, signed.manifest.revision), published);
+			return published;
+		} catch (error) {
+			onNotice(`plugin composition '${compositionId}' could not be signed: ${error instanceof Error ? error.message : String(error)}`);
+			return;
+		} finally {
+			fs.rmSync(stagingRoot, {
+				recursive: true,
+				force: true
+			});
+		}
+	};
+	return {
+		publish,
+		release(compositionId) {
+			const bundle = byComposition.get(compositionId);
+			if (!bundle) return;
+			byComposition.delete(compositionId);
+			byRoute.delete(routeKey(compositionId, bundle.signed.manifest.revision));
+			fs.rmSync(bundle.assetsDir, {
+				recursive: true,
+				force: true
+			});
+		},
+		get: (compositionId, revision) => byRoute.get(routeKey(compositionId, revision)),
+		publicKey: () => signer?.publicKey(),
+		close: () => {
+			if (closed) return;
+			closed = true;
+			byComposition.clear();
+			byRoute.clear();
+			if (publicationRoot !== void 0) fs.rmSync(publicationRoot, {
+				recursive: true,
+				force: true
+			});
+		}
+	};
+}
+//#endregion
+export { createPluginBundlePublication };
+
+//# sourceMappingURL=index.mjs.map

package/dist/src/services/bundlePublication/index.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.mjs","names":[],"sources":["../../../../src/services/bundlePublication/index.ts"],"sourcesContent":["import fs from 'node:fs';\nimport path from 'node:path';\n\nimport type { SignedBundleManifest } from '@agimon-ai/doompi-web-security';\nimport { createBundleSigner, type BundleSigner } from '@agimon-ai/doompi-web-security/node';\n\nexport interface PublishedBundle {\n  signed: SignedBundleManifest;\n  assetsDir: string;\n}\n\nexport interface PluginBundlePublication {\n  publish(compositionId: string, assetsDir: string): PublishedBundle | undefined;\n  get(compositionId: string, revision: number): PublishedBundle | undefined;\n  publicKey(): string | undefined;\n  release(compositionId: string): void;\n  close(): void;\n}\n\n/**\n * Signs synchronized plugin generations without replacing the stable shell publication.\n *\n * Publications are retained by the exact identity and revision advertised to pages, so\n * a concurrent sync cannot pair an old manifest with bytes from a new generation.\n */\nexport function createPluginBundlePublication(\n  stateDir: string,\n  onNotice: (message: string) => void = () => {},\n): PluginBundlePublication {\n  let signer: BundleSigner | undefined;\n  try {\n    signer = createBundleSigner(stateDir, onNotice);\n  } catch (error) {\n    onNotice(`plugin compositions could not be signed: ${error instanceof Error ? error.message : String(error)}`);\n  }\n  const byComposition = new Map<string, PublishedBundle>();\n  const byRoute = new Map<string, PublishedBundle>();\n  const publicationRoot =\n    signer === undefined ? undefined : fs.mkdtempSync(path.join(stateDir, 'plugin-publications-'));\n  let closed = false;\n  const routeKey = (compositionId: string, revision: number): string => `${compositionId}:${String(revision)}`;\n  const publish = (compositionId: string, assetsDir: string): PublishedBundle | undefined => {\n    if (closed) return undefined;\n    const existing = byComposition.get(compositionId);\n    if (existing !== undefined) return existing;\n    if (signer === undefined || publicationRoot === undefined) return undefined;\n    const stagingRoot = fs.mkdtempSync(path.join(publicationRoot, '.staging-'));\n    const snapshot = path.join(stagingRoot, 'assets');\n    try {\n      fs.cpSync(assetsDir, snapshot, { recursive: true });\n      const signed = signer.sign(snapshot);\n      if (signed === undefined) {\n        onNotice(`plugin composition '${compositionId}' is empty and cannot be published`);\n        return undefined;\n      }\n      const retainedDirectory = path.join(publicationRoot, `${compositionId}-${String(signed.manifest.revision)}`);\n      fs.renameSync(snapshot, retainedDirectory);\n      const published = { signed, assetsDir: retainedDirectory };\n      byComposition.set(compositionId, published);\n      byRoute.set(routeKey(compositionId, signed.manifest.revision), published);\n      return published;\n    } catch (error) {\n      onNotice(\n        `plugin composition '${compositionId}' could not be signed: ${error instanceof Error ? error.message : String(error)}`,\n      );\n      return undefined;\n    } finally {\n      fs.rmSync(stagingRoot, { recursive: true, force: true });\n    }\n  };\n\n  return {\n    publish,\n    release(compositionId) {\n      const bundle = byComposition.get(compositionId);\n      if (!bundle) return;\n      byComposition.delete(compositionId);\n      byRoute.delete(routeKey(compositionId, bundle.signed.manifest.revision));\n      fs.rmSync(bundle.assetsDir, { recursive: true, force: true });\n    },\n    get: (compositionId, revision) => byRoute.get(routeKey(compositionId, revision)),\n    publicKey: () => signer?.publicKey(),\n    close: () => {\n      if (closed) return;\n      closed = true;\n      byComposition.clear();\n      byRoute.clear();\n      if (publicationRoot !== undefined) fs.rmSync(publicationRoot, { recursive: true, force: true });\n    },\n  };\n}\n"],"mappings":";;;;;;;;;;AAyBA,SAAgB,8BACd,UACA,iBAA4C,CAAC,GACpB;CACzB,IAAI;CACJ,IAAI;EACF,SAAS,mBAAmB,UAAU,QAAQ;CAChD,SAAS,OAAO;EACd,SAAS,4CAA4C,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,GAAG;CAC/G;CACA,MAAM,gCAAgB,IAAI,IAA6B;CACvD,MAAM,0BAAU,IAAI,IAA6B;CACjD,MAAM,kBACJ,WAAW,KAAA,IAAY,KAAA,IAAY,GAAG,YAAY,KAAK,KAAK,UAAU,sBAAsB,CAAC;CAC/F,IAAI,SAAS;CACb,MAAM,YAAY,eAAuB,aAA6B,GAAG,cAAc,GAAG,OAAO,QAAQ;CACzG,MAAM,WAAW,eAAuB,cAAmD;EACzF,IAAI,QAAQ,OAAO,KAAA;EACnB,MAAM,WAAW,cAAc,IAAI,aAAa;EAChD,IAAI,aAAa,KAAA,GAAW,OAAO;EACnC,IAAI,WAAW,KAAA,KAAa,oBAAoB,KAAA,GAAW,OAAO,KAAA;EAClE,MAAM,cAAc,GAAG,YAAY,KAAK,KAAK,iBAAiB,WAAW,CAAC;EAC1E,MAAM,WAAW,KAAK,KAAK,aAAa,QAAQ;EAChD,IAAI;GACF,GAAG,OAAO,WAAW,UAAU,EAAE,WAAW,KAAK,CAAC;GAClD,MAAM,SAAS,OAAO,KAAK,QAAQ;GACnC,IAAI,WAAW,KAAA,GAAW;IACxB,SAAS,uBAAuB,cAAc,mCAAmC;IACjF;GACF;GACA,MAAM,oBAAoB,KAAK,KAAK,iBAAiB,GAAG,cAAc,GAAG,OAAO,OAAO,SAAS,QAAQ,GAAG;GAC3G,GAAG,WAAW,UAAU,iBAAiB;GACzC,MAAM,YAAY;IAAE;IAAQ,WAAW;GAAkB;GACzD,cAAc,IAAI,eAAe,SAAS;GAC1C,QAAQ,IAAI,SAAS,eAAe,OAAO,SAAS,QAAQ,GAAG,SAAS;GACxE,OAAO;EACT,SAAS,OAAO;GACd,SACE,uBAAuB,cAAc,yBAAyB,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,GACrH;GACA;EACF,UAAU;GACR,GAAG,OAAO,aAAa;IAAE,WAAW;IAAM,OAAO;GAAK,CAAC;EACzD;CACF;CAEA,OAAO;EACL;EACA,QAAQ,eAAe;GACrB,MAAM,SAAS,cAAc,IAAI,aAAa;GAC9C,IAAI,CAAC,QAAQ;GACb,cAAc,OAAO,aAAa;GAClC,QAAQ,OAAO,SAAS,eAAe,OAAO,OAAO,SAAS,QAAQ,CAAC;GACvE,GAAG,OAAO,OAAO,WAAW;IAAE,WAAW;IAAM,OAAO;GAAK,CAAC;EAC9D;EACA,MAAM,eAAe,aAAa,QAAQ,IAAI,SAAS,eAAe,QAAQ,CAAC;EAC/E,iBAAiB,QAAQ,UAAU;EACnC,aAAa;GACX,IAAI,QAAQ;GACZ,SAAS;GACT,cAAc,MAAM;GACpB,QAAQ,MAAM;GACd,IAAI,oBAAoB,KAAA,GAAW,GAAG,OAAO,iBAAiB;IAAE,WAAW;IAAM,OAAO;GAAK,CAAC;EAChG;CACF;AACF"}

package/dist/src/services/contextApiUrls/index.cjs

@@ -0,0 +1,14 @@
+const require_contextApi = require("../../constants/contextApi.cjs");
+//#region src/services/contextApiUrls/index.ts
+/** The absolute URL a page reads one row's detail through. */
+function itemDetailUrl(sessionPath, itemKind, name) {
+	const search = new URLSearchParams({
+		[require_contextApi.KIND_QUERY_PARAM]: itemKind,
+		[require_contextApi.NAME_QUERY_PARAM]: name
+	});
+	return `${sessionPath}/plugins/${require_contextApi.API_BASE_PATH}${require_contextApi.ITEM_ROUTE}?${search.toString()}`;
+}
+//#endregion
+exports.itemDetailUrl = itemDetailUrl;
+
+//# sourceMappingURL=index.cjs.map

package/dist/src/services/contextApiUrls/index.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.cjs","names":["KIND_QUERY_PARAM","NAME_QUERY_PARAM","API_BASE_PATH","ITEM_ROUTE"],"sources":["../../../../src/services/contextApiUrls/index.ts"],"sourcesContent":["import { API_BASE_PATH, ITEM_ROUTE, NAME_QUERY_PARAM, KIND_QUERY_PARAM } from '../../constants/contextApi';\nimport type { ContextItemKind } from '../../types/contextApi';\n\n/** The absolute URL a page reads one row's detail through. */\nexport function itemDetailUrl(sessionPath: string, itemKind: ContextItemKind, name: string): string {\n  const search = new URLSearchParams({\n    [KIND_QUERY_PARAM]: itemKind,\n    [NAME_QUERY_PARAM]: name,\n  });\n  return `${sessionPath}/plugins/${API_BASE_PATH}${ITEM_ROUTE}?${search.toString()}`;\n}\n"],"mappings":";;;AAIA,SAAgB,cAAc,aAAqB,UAA2B,MAAsB;CAClG,MAAM,SAAS,IAAI,gBAAgB;GAChCA,mBAAAA,mBAAmB;GACnBC,mBAAAA,mBAAmB;CACtB,CAAC;CACD,OAAO,GAAG,YAAY,WAAWC,mBAAAA,gBAAgBC,mBAAAA,WAAW,GAAG,OAAO,SAAS;AACjF"}

package/dist/src/services/contextApiUrls/index.d.mts

@@ -0,0 +1,6 @@
+import { ContextItemKind } from "../../../typesContextApi.mjs";
+//#region src/services/contextApiUrls/index.d.ts
+/** The absolute URL a page reads one row's detail through. */
+export declare function itemDetailUrl(sessionPath: string, itemKind: ContextItemKind, name: string): string;
+//#endregion
+//# sourceMappingURL=index.d.mts.map

package/dist/src/services/contextApiUrls/index.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.mts","names":[],"sources":["../../../../src/services/contextApiUrls/index.ts"],"mappings":";;;wBAIgB,cAAc,qBAAqB,UAAU,iBAAiB"}

package/dist/src/services/contextApiUrls/index.mjs

@@ -0,0 +1,14 @@
+import { API_BASE_PATH, ITEM_ROUTE, KIND_QUERY_PARAM, NAME_QUERY_PARAM } from "../../constants/contextApi.mjs";
+//#region src/services/contextApiUrls/index.ts
+/** The absolute URL a page reads one row's detail through. */
+function itemDetailUrl(sessionPath, itemKind, name) {
+	const search = new URLSearchParams({
+		[KIND_QUERY_PARAM]: itemKind,
+		[NAME_QUERY_PARAM]: name
+	});
+	return `${sessionPath}/plugins/${API_BASE_PATH}${ITEM_ROUTE}?${search.toString()}`;
+}
+//#endregion
+export { itemDetailUrl };
+
+//# sourceMappingURL=index.mjs.map

package/dist/src/services/contextApiUrls/index.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.mjs","names":[],"sources":["../../../../src/services/contextApiUrls/index.ts"],"sourcesContent":["import { API_BASE_PATH, ITEM_ROUTE, NAME_QUERY_PARAM, KIND_QUERY_PARAM } from '../../constants/contextApi';\nimport type { ContextItemKind } from '../../types/contextApi';\n\n/** The absolute URL a page reads one row's detail through. */\nexport function itemDetailUrl(sessionPath: string, itemKind: ContextItemKind, name: string): string {\n  const search = new URLSearchParams({\n    [KIND_QUERY_PARAM]: itemKind,\n    [NAME_QUERY_PARAM]: name,\n  });\n  return `${sessionPath}/plugins/${API_BASE_PATH}${ITEM_ROUTE}?${search.toString()}`;\n}\n"],"mappings":";;;AAIA,SAAgB,cAAc,aAAqB,UAA2B,MAAsB;CAClG,MAAM,SAAS,IAAI,gBAAgB;GAChC,mBAAmB;GACnB,mBAAmB;CACtB,CAAC;CACD,OAAO,GAAG,YAAY,WAAW,gBAAgB,WAAW,GAAG,OAAO,SAAS;AACjF"}

package/dist/src/services/contextContributions/index.cjs

@@ -0,0 +1,79 @@
+//#region src/services/contextContributions/index.ts
+function compareContributions(left, right) {
+	const sourceOrder = left.source < right.source ? -1 : left.source > right.source ? 1 : 0;
+	const idOrder = left.id < right.id ? -1 : left.id > right.id ? 1 : 0;
+	return left.order - right.order || sourceOrder || idOrder;
+}
+function assertNonEmpty(value, field) {
+	if (value.trim().length === 0) throw new Error(`Doom context contribution ${field} must not be empty.`);
+}
+function contributionErrorMessage(error) {
+	return error instanceof Error ? error.message : String(error);
+}
+/** Creates the host-owned aggregation service for one Doom session generation. */
+function createDoomContextContributionsService(generation) {
+	if (!generation) throw new Error("Doom context contributions require a session generation.");
+	const contributions = /* @__PURE__ */ new Map();
+	return Object.freeze({
+		generation,
+		register(contribution) {
+			assertNonEmpty(contribution.source, "source");
+			assertNonEmpty(contribution.id, "id");
+			assertNonEmpty(contribution.label, "label");
+			if (!Number.isFinite(contribution.order)) throw new Error("Doom context contribution order must be a finite number.");
+			if (typeof contribution.snapshot !== "function") throw new Error("Doom context contribution snapshot must be a function.");
+			const key = JSON.stringify([contribution.source, contribution.id]);
+			if (contributions.has(key)) throw new Error(`Doom context contribution is already registered: ${contribution.source}/${contribution.id}.`);
+			const stored = Object.freeze({
+				key,
+				source: contribution.source,
+				id: contribution.id,
+				label: contribution.label,
+				order: contribution.order,
+				snapshot: () => contribution.snapshot()
+			});
+			contributions.set(key, stored);
+			let disposed = false;
+			return Object.freeze({ dispose() {
+				if (disposed) return;
+				disposed = true;
+				if (contributions.get(key) === stored) contributions.delete(key);
+			} });
+		},
+		snapshot() {
+			const entries = [];
+			const errors = [];
+			const ordered = [...contributions.values()].sort(compareContributions);
+			for (const contribution of ordered) {
+				const identity = {
+					source: contribution.source,
+					id: contribution.id,
+					label: contribution.label,
+					order: contribution.order
+				};
+				try {
+					const text = contribution.snapshot();
+					if (text === void 0) continue;
+					if (typeof text !== "string") throw new Error("Snapshot returned a non-string value.");
+					entries.push(Object.freeze({
+						...identity,
+						text
+					}));
+				} catch (error) {
+					errors.push(Object.freeze({
+						...identity,
+						message: contributionErrorMessage(error)
+					}));
+				}
+			}
+			return Object.freeze({
+				entries: Object.freeze(entries),
+				errors: Object.freeze(errors)
+			});
+		}
+	});
+}
+//#endregion
+exports.createDoomContextContributionsService = createDoomContextContributionsService;
+
+//# sourceMappingURL=index.cjs.map

package/dist/src/services/contextContributions/index.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.cjs","names":[],"sources":["../../../../src/services/contextContributions/index.ts"],"sourcesContent":["import type {\n  DoomContextContribution,\n  DoomContextContributionEntry,\n  DoomContextContributionError,\n  DoomContextContributionRegistration,\n  DoomContextContributionsService,\n  DoomContextContributionsSnapshot,\n} from '../../schemas/contextContributions';\n\ninterface StoredContribution extends DoomContextContribution {\n  readonly key: string;\n}\n\nfunction compareContributions(left: DoomContextContribution, right: DoomContextContribution): number {\n  const sourceOrder = left.source < right.source ? -1 : left.source > right.source ? 1 : 0;\n  const idOrder = left.id < right.id ? -1 : left.id > right.id ? 1 : 0;\n  return left.order - right.order || sourceOrder || idOrder;\n}\n\nfunction assertNonEmpty(value: string, field: string): void {\n  if (value.trim().length === 0) throw new Error(`Doom context contribution ${field} must not be empty.`);\n}\n\nfunction contributionErrorMessage(error: unknown): string {\n  return error instanceof Error ? error.message : String(error);\n}\n\n/** Creates the host-owned aggregation service for one Doom session generation. */\nexport function createDoomContextContributionsService(generation: string): DoomContextContributionsService {\n  if (!generation) throw new Error('Doom context contributions require a session generation.');\n\n  const contributions = new Map<string, StoredContribution>();\n  return Object.freeze({\n    generation,\n    register(contribution: DoomContextContribution): DoomContextContributionRegistration {\n      assertNonEmpty(contribution.source, 'source');\n      assertNonEmpty(contribution.id, 'id');\n      assertNonEmpty(contribution.label, 'label');\n      if (!Number.isFinite(contribution.order)) {\n        throw new Error('Doom context contribution order must be a finite number.');\n      }\n      if (typeof contribution.snapshot !== 'function') {\n        throw new Error('Doom context contribution snapshot must be a function.');\n      }\n\n      const key = JSON.stringify([contribution.source, contribution.id]);\n      if (contributions.has(key)) {\n        throw new Error(`Doom context contribution is already registered: ${contribution.source}/${contribution.id}.`);\n      }\n      const stored: StoredContribution = Object.freeze({\n        key,\n        source: contribution.source,\n        id: contribution.id,\n        label: contribution.label,\n        order: contribution.order,\n        snapshot: () => contribution.snapshot(),\n      });\n      contributions.set(key, stored);\n\n      let disposed = false;\n      return Object.freeze({\n        dispose(): void {\n          if (disposed) return;\n          disposed = true;\n          if (contributions.get(key) === stored) contributions.delete(key);\n        },\n      });\n    },\n    snapshot(): DoomContextContributionsSnapshot {\n      const entries: DoomContextContributionEntry[] = [];\n      const errors: DoomContextContributionError[] = [];\n      const ordered = [...contributions.values()].sort(compareContributions);\n\n      for (const contribution of ordered) {\n        const identity = {\n          source: contribution.source,\n          id: contribution.id,\n          label: contribution.label,\n          order: contribution.order,\n        };\n        try {\n          const text = contribution.snapshot();\n          if (text === undefined) continue;\n          if (typeof text !== 'string') throw new Error('Snapshot returned a non-string value.');\n          entries.push(Object.freeze({ ...identity, text }));\n        } catch (error) {\n          errors.push(Object.freeze({ ...identity, message: contributionErrorMessage(error) }));\n        }\n      }\n\n      return Object.freeze({ entries: Object.freeze(entries), errors: Object.freeze(errors) });\n    },\n  });\n}\n"],"mappings":";AAaA,SAAS,qBAAqB,MAA+B,OAAwC;CACnG,MAAM,cAAc,KAAK,SAAS,MAAM,SAAS,KAAK,KAAK,SAAS,MAAM,SAAS,IAAI;CACvF,MAAM,UAAU,KAAK,KAAK,MAAM,KAAK,KAAK,KAAK,KAAK,MAAM,KAAK,IAAI;CACnE,OAAO,KAAK,QAAQ,MAAM,SAAS,eAAe;AACpD;AAEA,SAAS,eAAe,OAAe,OAAqB;CAC1D,IAAI,MAAM,KAAK,CAAC,CAAC,WAAW,GAAG,MAAM,IAAI,MAAM,6BAA6B,MAAM,oBAAoB;AACxG;AAEA,SAAS,yBAAyB,OAAwB;CACxD,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AAC9D;;AAGA,SAAgB,sCAAsC,YAAqD;CACzG,IAAI,CAAC,YAAY,MAAM,IAAI,MAAM,0DAA0D;CAE3F,MAAM,gCAAgB,IAAI,IAAgC;CAC1D,OAAO,OAAO,OAAO;EACnB;EACA,SAAS,cAA4E;GACnF,eAAe,aAAa,QAAQ,QAAQ;GAC5C,eAAe,aAAa,IAAI,IAAI;GACpC,eAAe,aAAa,OAAO,OAAO;GAC1C,IAAI,CAAC,OAAO,SAAS,aAAa,KAAK,GACrC,MAAM,IAAI,MAAM,0DAA0D;GAE5E,IAAI,OAAO,aAAa,aAAa,YACnC,MAAM,IAAI,MAAM,wDAAwD;GAG1E,MAAM,MAAM,KAAK,UAAU,CAAC,aAAa,QAAQ,aAAa,EAAE,CAAC;GACjE,IAAI,cAAc,IAAI,GAAG,GACvB,MAAM,IAAI,MAAM,oDAAoD,aAAa,OAAO,GAAG,aAAa,GAAG,EAAE;GAE/G,MAAM,SAA6B,OAAO,OAAO;IAC/C;IACA,QAAQ,aAAa;IACrB,IAAI,aAAa;IACjB,OAAO,aAAa;IACpB,OAAO,aAAa;IACpB,gBAAgB,aAAa,SAAS;GACxC,CAAC;GACD,cAAc,IAAI,KAAK,MAAM;GAE7B,IAAI,WAAW;GACf,OAAO,OAAO,OAAO,EACnB,UAAgB;IACd,IAAI,UAAU;IACd,WAAW;IACX,IAAI,cAAc,IAAI,GAAG,MAAM,QAAQ,cAAc,OAAO,GAAG;GACjE,EACF,CAAC;EACH;EACA,WAA6C;GAC3C,MAAM,UAA0C,CAAC;GACjD,MAAM,SAAyC,CAAC;GAChD,MAAM,UAAU,CAAC,GAAG,cAAc,OAAO,CAAC,CAAC,CAAC,KAAK,oBAAoB;GAErE,KAAK,MAAM,gBAAgB,SAAS;IAClC,MAAM,WAAW;KACf,QAAQ,aAAa;KACrB,IAAI,aAAa;KACjB,OAAO,aAAa;KACpB,OAAO,aAAa;IACtB;IACA,IAAI;KACF,MAAM,OAAO,aAAa,SAAS;KACnC,IAAI,SAAS,KAAA,GAAW;KACxB,IAAI,OAAO,SAAS,UAAU,MAAM,IAAI,MAAM,uCAAuC;KACrF,QAAQ,KAAK,OAAO,OAAO;MAAE,GAAG;MAAU;KAAK,CAAC,CAAC;IACnD,SAAS,OAAO;KACd,OAAO,KAAK,OAAO,OAAO;MAAE,GAAG;MAAU,SAAS,yBAAyB,KAAK;KAAE,CAAC,CAAC;IACtF;GACF;GAEA,OAAO,OAAO,OAAO;IAAE,SAAS,OAAO,OAAO,OAAO;IAAG,QAAQ,OAAO,OAAO,MAAM;GAAE,CAAC;EACzF;CACF,CAAC;AACH"}

package/dist/src/services/contextContributions/index.d.mts

@@ -0,0 +1,6 @@
+import { DoomContextContributionsService } from "../../schemas/contextContributions.mjs";
+//#region src/services/contextContributions/index.d.ts
+/** Creates the host-owned aggregation service for one Doom session generation. */
+export declare function createDoomContextContributionsService(generation: string): DoomContextContributionsService;
+//#endregion
+//# sourceMappingURL=index.d.mts.map

package/dist/src/services/contextContributions/index.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.mts","names":[],"sources":["../../../../src/services/contextContributions/index.ts"],"mappings":";;;wBA4BgB,sCAAsC,qBAAqB"}

package/dist/src/services/contextContributions/index.mjs

@@ -0,0 +1,79 @@
+//#region src/services/contextContributions/index.ts
+function compareContributions(left, right) {
+	const sourceOrder = left.source < right.source ? -1 : left.source > right.source ? 1 : 0;
+	const idOrder = left.id < right.id ? -1 : left.id > right.id ? 1 : 0;
+	return left.order - right.order || sourceOrder || idOrder;
+}
+function assertNonEmpty(value, field) {
+	if (value.trim().length === 0) throw new Error(`Doom context contribution ${field} must not be empty.`);
+}
+function contributionErrorMessage(error) {
+	return error instanceof Error ? error.message : String(error);
+}
+/** Creates the host-owned aggregation service for one Doom session generation. */
+function createDoomContextContributionsService(generation) {
+	if (!generation) throw new Error("Doom context contributions require a session generation.");
+	const contributions = /* @__PURE__ */ new Map();
+	return Object.freeze({
+		generation,
+		register(contribution) {
+			assertNonEmpty(contribution.source, "source");
+			assertNonEmpty(contribution.id, "id");
+			assertNonEmpty(contribution.label, "label");
+			if (!Number.isFinite(contribution.order)) throw new Error("Doom context contribution order must be a finite number.");
+			if (typeof contribution.snapshot !== "function") throw new Error("Doom context contribution snapshot must be a function.");
+			const key = JSON.stringify([contribution.source, contribution.id]);
+			if (contributions.has(key)) throw new Error(`Doom context contribution is already registered: ${contribution.source}/${contribution.id}.`);
+			const stored = Object.freeze({
+				key,
+				source: contribution.source,
+				id: contribution.id,
+				label: contribution.label,
+				order: contribution.order,
+				snapshot: () => contribution.snapshot()
+			});
+			contributions.set(key, stored);
+			let disposed = false;
+			return Object.freeze({ dispose() {
+				if (disposed) return;
+				disposed = true;
+				if (contributions.get(key) === stored) contributions.delete(key);
+			} });
+		},
+		snapshot() {
+			const entries = [];
+			const errors = [];
+			const ordered = [...contributions.values()].sort(compareContributions);
+			for (const contribution of ordered) {
+				const identity = {
+					source: contribution.source,
+					id: contribution.id,
+					label: contribution.label,
+					order: contribution.order
+				};
+				try {
+					const text = contribution.snapshot();
+					if (text === void 0) continue;
+					if (typeof text !== "string") throw new Error("Snapshot returned a non-string value.");
+					entries.push(Object.freeze({
+						...identity,
+						text
+					}));
+				} catch (error) {
+					errors.push(Object.freeze({
+						...identity,
+						message: contributionErrorMessage(error)
+					}));
+				}
+			}
+			return Object.freeze({
+				entries: Object.freeze(entries),
+				errors: Object.freeze(errors)
+			});
+		}
+	});
+}
+//#endregion
+export { createDoomContextContributionsService };
+
+//# sourceMappingURL=index.mjs.map

package/dist/src/services/contextContributions/index.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.mjs","names":[],"sources":["../../../../src/services/contextContributions/index.ts"],"sourcesContent":["import type {\n  DoomContextContribution,\n  DoomContextContributionEntry,\n  DoomContextContributionError,\n  DoomContextContributionRegistration,\n  DoomContextContributionsService,\n  DoomContextContributionsSnapshot,\n} from '../../schemas/contextContributions';\n\ninterface StoredContribution extends DoomContextContribution {\n  readonly key: string;\n}\n\nfunction compareContributions(left: DoomContextContribution, right: DoomContextContribution): number {\n  const sourceOrder = left.source < right.source ? -1 : left.source > right.source ? 1 : 0;\n  const idOrder = left.id < right.id ? -1 : left.id > right.id ? 1 : 0;\n  return left.order - right.order || sourceOrder || idOrder;\n}\n\nfunction assertNonEmpty(value: string, field: string): void {\n  if (value.trim().length === 0) throw new Error(`Doom context contribution ${field} must not be empty.`);\n}\n\nfunction contributionErrorMessage(error: unknown): string {\n  return error instanceof Error ? error.message : String(error);\n}\n\n/** Creates the host-owned aggregation service for one Doom session generation. */\nexport function createDoomContextContributionsService(generation: string): DoomContextContributionsService {\n  if (!generation) throw new Error('Doom context contributions require a session generation.');\n\n  const contributions = new Map<string, StoredContribution>();\n  return Object.freeze({\n    generation,\n    register(contribution: DoomContextContribution): DoomContextContributionRegistration {\n      assertNonEmpty(contribution.source, 'source');\n      assertNonEmpty(contribution.id, 'id');\n      assertNonEmpty(contribution.label, 'label');\n      if (!Number.isFinite(contribution.order)) {\n        throw new Error('Doom context contribution order must be a finite number.');\n      }\n      if (typeof contribution.snapshot !== 'function') {\n        throw new Error('Doom context contribution snapshot must be a function.');\n      }\n\n      const key = JSON.stringify([contribution.source, contribution.id]);\n      if (contributions.has(key)) {\n        throw new Error(`Doom context contribution is already registered: ${contribution.source}/${contribution.id}.`);\n      }\n      const stored: StoredContribution = Object.freeze({\n        key,\n        source: contribution.source,\n        id: contribution.id,\n        label: contribution.label,\n        order: contribution.order,\n        snapshot: () => contribution.snapshot(),\n      });\n      contributions.set(key, stored);\n\n      let disposed = false;\n      return Object.freeze({\n        dispose(): void {\n          if (disposed) return;\n          disposed = true;\n          if (contributions.get(key) === stored) contributions.delete(key);\n        },\n      });\n    },\n    snapshot(): DoomContextContributionsSnapshot {\n      const entries: DoomContextContributionEntry[] = [];\n      const errors: DoomContextContributionError[] = [];\n      const ordered = [...contributions.values()].sort(compareContributions);\n\n      for (const contribution of ordered) {\n        const identity = {\n          source: contribution.source,\n          id: contribution.id,\n          label: contribution.label,\n          order: contribution.order,\n        };\n        try {\n          const text = contribution.snapshot();\n          if (text === undefined) continue;\n          if (typeof text !== 'string') throw new Error('Snapshot returned a non-string value.');\n          entries.push(Object.freeze({ ...identity, text }));\n        } catch (error) {\n          errors.push(Object.freeze({ ...identity, message: contributionErrorMessage(error) }));\n        }\n      }\n\n      return Object.freeze({ entries: Object.freeze(entries), errors: Object.freeze(errors) });\n    },\n  });\n}\n"],"mappings":";AAaA,SAAS,qBAAqB,MAA+B,OAAwC;CACnG,MAAM,cAAc,KAAK,SAAS,MAAM,SAAS,KAAK,KAAK,SAAS,MAAM,SAAS,IAAI;CACvF,MAAM,UAAU,KAAK,KAAK,MAAM,KAAK,KAAK,KAAK,KAAK,MAAM,KAAK,IAAI;CACnE,OAAO,KAAK,QAAQ,MAAM,SAAS,eAAe;AACpD;AAEA,SAAS,eAAe,OAAe,OAAqB;CAC1D,IAAI,MAAM,KAAK,CAAC,CAAC,WAAW,GAAG,MAAM,IAAI,MAAM,6BAA6B,MAAM,oBAAoB;AACxG;AAEA,SAAS,yBAAyB,OAAwB;CACxD,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AAC9D;;AAGA,SAAgB,sCAAsC,YAAqD;CACzG,IAAI,CAAC,YAAY,MAAM,IAAI,MAAM,0DAA0D;CAE3F,MAAM,gCAAgB,IAAI,IAAgC;CAC1D,OAAO,OAAO,OAAO;EACnB;EACA,SAAS,cAA4E;GACnF,eAAe,aAAa,QAAQ,QAAQ;GAC5C,eAAe,aAAa,IAAI,IAAI;GACpC,eAAe,aAAa,OAAO,OAAO;GAC1C,IAAI,CAAC,OAAO,SAAS,aAAa,KAAK,GACrC,MAAM,IAAI,MAAM,0DAA0D;GAE5E,IAAI,OAAO,aAAa,aAAa,YACnC,MAAM,IAAI,MAAM,wDAAwD;GAG1E,MAAM,MAAM,KAAK,UAAU,CAAC,aAAa,QAAQ,aAAa,EAAE,CAAC;GACjE,IAAI,cAAc,IAAI,GAAG,GACvB,MAAM,IAAI,MAAM,oDAAoD,aAAa,OAAO,GAAG,aAAa,GAAG,EAAE;GAE/G,MAAM,SAA6B,OAAO,OAAO;IAC/C;IACA,QAAQ,aAAa;IACrB,IAAI,aAAa;IACjB,OAAO,aAAa;IACpB,OAAO,aAAa;IACpB,gBAAgB,aAAa,SAAS;GACxC,CAAC;GACD,cAAc,IAAI,KAAK,MAAM;GAE7B,IAAI,WAAW;GACf,OAAO,OAAO,OAAO,EACnB,UAAgB;IACd,IAAI,UAAU;IACd,WAAW;IACX,IAAI,cAAc,IAAI,GAAG,MAAM,QAAQ,cAAc,OAAO,GAAG;GACjE,EACF,CAAC;EACH;EACA,WAA6C;GAC3C,MAAM,UAA0C,CAAC;GACjD,MAAM,SAAyC,CAAC;GAChD,MAAM,UAAU,CAAC,GAAG,cAAc,OAAO,CAAC,CAAC,CAAC,KAAK,oBAAoB;GAErE,KAAK,MAAM,gBAAgB,SAAS;IAClC,MAAM,WAAW;KACf,QAAQ,aAAa;KACrB,IAAI,aAAa;KACjB,OAAO,aAAa;KACpB,OAAO,aAAa;IACtB;IACA,IAAI;KACF,MAAM,OAAO,aAAa,SAAS;KACnC,IAAI,SAAS,KAAA,GAAW;KACxB,IAAI,OAAO,SAAS,UAAU,MAAM,IAAI,MAAM,uCAAuC;KACrF,QAAQ,KAAK,OAAO,OAAO;MAAE,GAAG;MAAU;KAAK,CAAC,CAAC;IACnD,SAAS,OAAO;KACd,OAAO,KAAK,OAAO,OAAO;MAAE,GAAG;MAAU,SAAS,yBAAyB,KAAK;KAAE,CAAC,CAAC;IACtF;GACF;GAEA,OAAO,OAAO,OAAO;IAAE,SAAS,OAAO,OAAO,OAAO;IAAG,QAAQ,OAAO,OAAO,MAAM;GAAE,CAAC;EACzF;CACF,CAAC;AACH"}

package/dist/src/services/contextUsage/index.cjs

@@ -0,0 +1,27 @@
+//#region src/services/contextUsage/index.ts
+function contextTokensOf(usage) {
+	return usage === void 0 ? null : usage.input + usage.cacheRead + usage.cacheWrite;
+}
+/** Undefined when the active model declares no window, the one case where no ratio exists. */
+function contextUsageOf(tokens, contextWindow) {
+	if (contextWindow === void 0) return void 0;
+	return {
+		tokens,
+		contextWindow,
+		percent: tokens === null ? null : Math.round(tokens / contextWindow * 100)
+	};
+}
+/** The newest assistant usage on a branch, for priming a live counter from persisted history. */
+function latestAssistantUsage(entries) {
+	for (let index = entries.length - 1; index >= 0; index -= 1) {
+		const entry = entries[index];
+		if (entry?.type !== "message" || entry.message.role !== "assistant") continue;
+		return entry.message.usage;
+	}
+}
+//#endregion
+exports.contextTokensOf = contextTokensOf;
+exports.contextUsageOf = contextUsageOf;
+exports.latestAssistantUsage = latestAssistantUsage;
+
+//# sourceMappingURL=index.cjs.map

package/dist/src/services/contextUsage/index.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.cjs","names":[],"sources":["../../../../src/services/contextUsage/index.ts"],"sourcesContent":["/**\n * How much of the model's window a conversation currently occupies.\n *\n * Occupancy is the last assistant turn's non-output tokens: input plus both\n * cache halves. Output tokens are already counted inside the next request's\n * input, so adding them would report the tail of the conversation twice.\n *\n * Two callers need this number and they reach it differently. The cockpit reads\n * the branch on demand; the Pi extension bridge tracks it from the message the\n * harness just finished. Both have to agree on what \"context tokens\" means, so\n * the definition lives here rather than at either call site.\n */\nimport type { Entry } from '@earendil-works/pi-agent-core';\nimport type { Usage } from '@earendil-works/pi-ai';\n\nexport interface ContextUsage {\n  /** Null while unknown: no assistant message has been measured against the current context yet. */\n  tokens: number | null;\n  contextWindow: number;\n  percent: number | null;\n}\n\nexport function contextTokensOf(usage: Usage | undefined): number | null {\n  return usage === undefined ? null : usage.input + usage.cacheRead + usage.cacheWrite;\n}\n\n/** Undefined when the active model declares no window, the one case where no ratio exists. */\nexport function contextUsageOf(tokens: number | null, contextWindow: number | undefined): ContextUsage | undefined {\n  if (contextWindow === undefined) return undefined;\n  return {\n    tokens,\n    contextWindow,\n    percent: tokens === null ? null : Math.round((tokens / contextWindow) * 100),\n  };\n}\n\n/** The newest assistant usage on a branch, for priming a live counter from persisted history. */\nexport function latestAssistantUsage(entries: readonly Entry[]): Usage | undefined {\n  for (let index = entries.length - 1; index >= 0; index -= 1) {\n    const entry = entries[index];\n    if (entry?.type !== 'message' || entry.message.role !== 'assistant') continue;\n    return entry.message.usage;\n  }\n  return undefined;\n}\n"],"mappings":";AAsBA,SAAgB,gBAAgB,OAAyC;CACvE,OAAO,UAAU,KAAA,IAAY,OAAO,MAAM,QAAQ,MAAM,YAAY,MAAM;AAC5E;;AAGA,SAAgB,eAAe,QAAuB,eAA6D;CACjH,IAAI,kBAAkB,KAAA,GAAW,OAAO,KAAA;CACxC,OAAO;EACL;EACA;EACA,SAAS,WAAW,OAAO,OAAO,KAAK,MAAO,SAAS,gBAAiB,GAAG;CAC7E;AACF;;AAGA,SAAgB,qBAAqB,SAA8C;CACjF,KAAK,IAAI,QAAQ,QAAQ,SAAS,GAAG,SAAS,GAAG,SAAS,GAAG;EAC3D,MAAM,QAAQ,QAAQ;EACtB,IAAI,OAAO,SAAS,aAAa,MAAM,QAAQ,SAAS,aAAa;EACrE,OAAO,MAAM,QAAQ;CACvB;AAEF"}

package/dist/src/services/contextUsage/index.mjs

@@ -0,0 +1,25 @@
+//#region src/services/contextUsage/index.ts
+function contextTokensOf(usage) {
+	return usage === void 0 ? null : usage.input + usage.cacheRead + usage.cacheWrite;
+}
+/** Undefined when the active model declares no window, the one case where no ratio exists. */
+function contextUsageOf(tokens, contextWindow) {
+	if (contextWindow === void 0) return void 0;
+	return {
+		tokens,
+		contextWindow,
+		percent: tokens === null ? null : Math.round(tokens / contextWindow * 100)
+	};
+}
+/** The newest assistant usage on a branch, for priming a live counter from persisted history. */
+function latestAssistantUsage(entries) {
+	for (let index = entries.length - 1; index >= 0; index -= 1) {
+		const entry = entries[index];
+		if (entry?.type !== "message" || entry.message.role !== "assistant") continue;
+		return entry.message.usage;
+	}
+}
+//#endregion
+export { contextTokensOf, contextUsageOf, latestAssistantUsage };
+
+//# sourceMappingURL=index.mjs.map

package/dist/src/services/contextUsage/index.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.mjs","names":[],"sources":["../../../../src/services/contextUsage/index.ts"],"sourcesContent":["/**\n * How much of the model's window a conversation currently occupies.\n *\n * Occupancy is the last assistant turn's non-output tokens: input plus both\n * cache halves. Output tokens are already counted inside the next request's\n * input, so adding them would report the tail of the conversation twice.\n *\n * Two callers need this number and they reach it differently. The cockpit reads\n * the branch on demand; the Pi extension bridge tracks it from the message the\n * harness just finished. Both have to agree on what \"context tokens\" means, so\n * the definition lives here rather than at either call site.\n */\nimport type { Entry } from '@earendil-works/pi-agent-core';\nimport type { Usage } from '@earendil-works/pi-ai';\n\nexport interface ContextUsage {\n  /** Null while unknown: no assistant message has been measured against the current context yet. */\n  tokens: number | null;\n  contextWindow: number;\n  percent: number | null;\n}\n\nexport function contextTokensOf(usage: Usage | undefined): number | null {\n  return usage === undefined ? null : usage.input + usage.cacheRead + usage.cacheWrite;\n}\n\n/** Undefined when the active model declares no window, the one case where no ratio exists. */\nexport function contextUsageOf(tokens: number | null, contextWindow: number | undefined): ContextUsage | undefined {\n  if (contextWindow === undefined) return undefined;\n  return {\n    tokens,\n    contextWindow,\n    percent: tokens === null ? null : Math.round((tokens / contextWindow) * 100),\n  };\n}\n\n/** The newest assistant usage on a branch, for priming a live counter from persisted history. */\nexport function latestAssistantUsage(entries: readonly Entry[]): Usage | undefined {\n  for (let index = entries.length - 1; index >= 0; index -= 1) {\n    const entry = entries[index];\n    if (entry?.type !== 'message' || entry.message.role !== 'assistant') continue;\n    return entry.message.usage;\n  }\n  return undefined;\n}\n"],"mappings":";AAsBA,SAAgB,gBAAgB,OAAyC;CACvE,OAAO,UAAU,KAAA,IAAY,OAAO,MAAM,QAAQ,MAAM,YAAY,MAAM;AAC5E;;AAGA,SAAgB,eAAe,QAAuB,eAA6D;CACjH,IAAI,kBAAkB,KAAA,GAAW,OAAO,KAAA;CACxC,OAAO;EACL;EACA;EACA,SAAS,WAAW,OAAO,OAAO,KAAK,MAAO,SAAS,gBAAiB,GAAG;CAC7E;AACF;;AAGA,SAAgB,qBAAqB,SAA8C;CACjF,KAAK,IAAI,QAAQ,QAAQ,SAAS,GAAG,SAAS,GAAG,SAAS,GAAG;EAC3D,MAAM,QAAQ,QAAQ;EACtB,IAAI,OAAO,SAAS,aAAa,MAAM,QAAQ,SAAS,aAAa;EACrE,OAAO,MAAM,QAAQ;CACvB;AAEF"}

package/dist/src/services/devProxyPolicy/index.cjs

@@ -0,0 +1,168 @@
+const require_remote = require("../../constants/remote.cjs");
+//#region src/services/devProxyPolicy/index.ts
+/**
+* What the dev proxy will forward, and where.
+*
+* Pure, with no I/O, so the whole decision surface of a feature that reaches
+* loopback services can be read in one sitting and tested without a server.
+*
+* The upstream host is not a parameter anywhere in this module, and a target
+* is a port and nothing else. Accepting a hostname would mean resolving one,
+* and a resolver turns a fixed destination into an attacker-chosen one through
+* DNS rebinding, decimal and octal address spellings, and IPv4-mapped IPv6
+* forms. Refusing the parameter forecloses that family rather than filtering
+* it. Which of the two loopback literals actually answers is settled in
+* the loopbackAddress service, from the port alone.
+*/
+const MAX_NAME_LENGTH = 32;
+/**
+* Lowercase, digits and dashes, opening on an alphanumeric.
+*
+* The name is a path segment and it is also what the developer types into
+* `base: '/devproxy/<name>/'`, so it stays in the character set that needs no
+* escaping in either place.
+*/
+const TARGET_NAME = /^[a-z0-9][a-z0-9-]{0,31}$/u;
+const MIN_PORT = 1;
+const MAX_PORT = 65535;
+function validateTargetName(raw) {
+	if (typeof raw !== "string") return {
+		ok: false,
+		reason: "A target name must be text."
+	};
+	const name = raw.trim().toLowerCase();
+	if (name === "") return {
+		ok: false,
+		reason: "A target needs a name."
+	};
+	if (name.length > MAX_NAME_LENGTH) return {
+		ok: false,
+		reason: `A target name is at most ${String(MAX_NAME_LENGTH)} characters.`
+	};
+	if (!TARGET_NAME.test(name)) return {
+		ok: false,
+		reason: "A target name uses lowercase letters, digits and dashes, starting with a letter or digit."
+	};
+	return {
+		ok: true,
+		name
+	};
+}
+/**
+* Whether this port may be proxied.
+*
+* `reserved` is read fresh by the caller on every attempt rather than captured
+* once, because the cockpit's own ports are only known after it binds and the
+* tunnel port changes when remote access is toggled. A cached list would go
+* stale in exactly the direction that matters, letting the proxy point at the
+* cockpit itself.
+*/
+function validateTargetPort(raw, reserved) {
+	const port = typeof raw === "number" ? raw : Number(raw);
+	if (!Number.isSafeInteger(port)) return {
+		ok: false,
+		reason: "A port must be a whole number."
+	};
+	if (port < MIN_PORT || port > MAX_PORT) return {
+		ok: false,
+		reason: `A port is between ${String(MIN_PORT)} and ${String(MAX_PORT)}.`
+	};
+	if (reserved.includes(port)) return {
+		ok: false,
+		reason: "That port belongs to the cockpit itself."
+	};
+	return {
+		ok: true,
+		port
+	};
+}
+/**
+* Whether a path segment tries to climb out of the prefix.
+*
+* Checked before and after percent-decoding. A proxy that only checked the raw
+* form would forward `%2e%2e`, and an upstream that decodes before resolving
+* would then walk out of the tree the operator meant to expose.
+*/
+function escapesPrefix(upstreamPath) {
+	let decoded;
+	try {
+		decoded = decodeURIComponent(upstreamPath);
+	} catch {
+		return true;
+	}
+	for (const candidate of [upstreamPath, decoded]) for (const segment of candidate.split("/")) if (segment === "." || segment === "..") return true;
+	return false;
+}
+/**
+* Whether this path is one the dev proxy owns.
+*
+* The remote guard and the proxy handler must agree about this, and they do not
+* see the same string: Hono's router hands the guard a raw slice of the request
+* line, while the handler reads `new URL(...).pathname`, which resolves `..`
+* before anyone looks at it. So `/devproxy/x/../../api/health` can be a proxy
+* path to one and an API path to the other, and a guard that answered on the
+* prefix alone would grant an `/api/` request the direct, unsealed treatment.
+*
+* Refusing every dot segment removes the disagreement instead of trying to
+* predict it. A legitimate asset URL has no reason to carry one.
+*/
+function isDevProxyPath(path) {
+	if (!path.startsWith("/devproxy/")) return false;
+	return !escapesPrefix(path.slice(require_remote.DEV_PROXY_PREFIX.length));
+}
+/**
+* Identifies the target a proxied request belongs to.
+*
+* `upstreamPath` is the request path unchanged, prefix included. That is the
+* whole trick, and getting it wrong costs a redirect loop: the target is
+* configured with `base: '/devproxy/<name>/'`, so it believes it is serving
+* there and redirects anything at `/` back to its base. Stripping the prefix
+* would hand it `/`, take its redirect, and go round again. nginx draws the
+* same distinction between `proxy_pass http://host/` and `proxy_pass
+* http://host`; this is the second one.
+*
+* Reads the raw, still-encoded pathname. Hono routes and the remote guard both
+* work on the decoded value, so a request that only becomes `/devproxy/...`
+* after decoding would reach this handler, and passing the encoded form
+* through untouched is what makes a file named `a b.png` load.
+*/
+function parseProxyPath(rawPathname) {
+	if (!rawPathname.startsWith("/devproxy/")) return {
+		kind: "reject",
+		reason: "Not a proxied path."
+	};
+	const rest = rawPathname.slice(require_remote.DEV_PROXY_PREFIX.length);
+	const boundary = rest.indexOf("/");
+	if (boundary === -1) {
+		const verdict = validateTargetName(rest);
+		if (!verdict.ok) return {
+			kind: "reject",
+			reason: verdict.reason
+		};
+		return {
+			kind: "redirect",
+			location: `${require_remote.DEV_PROXY_PREFIX}${verdict.name}/`
+		};
+	}
+	const verdict = validateTargetName(rest.slice(0, boundary));
+	if (!verdict.ok) return {
+		kind: "reject",
+		reason: verdict.reason
+	};
+	if (escapesPrefix(rest.slice(boundary))) return {
+		kind: "reject",
+		reason: "That path leaves the proxied target."
+	};
+	return {
+		kind: "match",
+		name: verdict.name,
+		upstreamPath: rawPathname
+	};
+}
+//#endregion
+exports.isDevProxyPath = isDevProxyPath;
+exports.parseProxyPath = parseProxyPath;
+exports.validateTargetName = validateTargetName;
+exports.validateTargetPort = validateTargetPort;
+
+//# sourceMappingURL=index.cjs.map

package/dist/src/services/devProxyPolicy/index.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.cjs","names":["DEV_PROXY_PREFIX"],"sources":["../../../../src/services/devProxyPolicy/index.ts"],"sourcesContent":["/**\n * What the dev proxy will forward, and where.\n *\n * Pure, with no I/O, so the whole decision surface of a feature that reaches\n * loopback services can be read in one sitting and tested without a server.\n *\n * The upstream host is not a parameter anywhere in this module, and a target\n * is a port and nothing else. Accepting a hostname would mean resolving one,\n * and a resolver turns a fixed destination into an attacker-chosen one through\n * DNS rebinding, decimal and octal address spellings, and IPv4-mapped IPv6\n * forms. Refusing the parameter forecloses that family rather than filtering\n * it. Which of the two loopback literals actually answers is settled in\n * the loopbackAddress service, from the port alone.\n */\n\nimport { DEV_PROXY_PREFIX } from '../../constants/remote';\n\nconst MAX_NAME_LENGTH = 32;\n/**\n * Lowercase, digits and dashes, opening on an alphanumeric.\n *\n * The name is a path segment and it is also what the developer types into\n * `base: '/devproxy/<name>/'`, so it stays in the character set that needs no\n * escaping in either place.\n */\nconst TARGET_NAME = /^[a-z0-9][a-z0-9-]{0,31}$/u;\nconst MIN_PORT = 1;\nconst MAX_PORT = 65_535;\n\nexport type NameVerdict = { ok: true; name: string } | { ok: false; reason: string };\n\nexport type PortVerdict = { ok: true; port: number } | { ok: false; reason: string };\n\nexport type ProxyPathVerdict =\n  | { kind: 'match'; name: string; /** The path unchanged, prefix included. */ upstreamPath: string }\n  | { kind: 'redirect'; location: string }\n  | { kind: 'reject'; reason: string };\n\nexport function validateTargetName(raw: unknown): NameVerdict {\n  if (typeof raw !== 'string') return { ok: false, reason: 'A target name must be text.' };\n  const name = raw.trim().toLowerCase();\n  if (name === '') return { ok: false, reason: 'A target needs a name.' };\n  if (name.length > MAX_NAME_LENGTH) {\n    return { ok: false, reason: `A target name is at most ${String(MAX_NAME_LENGTH)} characters.` };\n  }\n  if (!TARGET_NAME.test(name)) {\n    return {\n      ok: false,\n      reason: 'A target name uses lowercase letters, digits and dashes, starting with a letter or digit.',\n    };\n  }\n  return { ok: true, name };\n}\n\n/**\n * Whether this port may be proxied.\n *\n * `reserved` is read fresh by the caller on every attempt rather than captured\n * once, because the cockpit's own ports are only known after it binds and the\n * tunnel port changes when remote access is toggled. A cached list would go\n * stale in exactly the direction that matters, letting the proxy point at the\n * cockpit itself.\n */\nexport function validateTargetPort(raw: unknown, reserved: readonly (number | undefined)[]): PortVerdict {\n  const port = typeof raw === 'number' ? raw : Number(raw);\n  if (!Number.isSafeInteger(port)) return { ok: false, reason: 'A port must be a whole number.' };\n  if (port < MIN_PORT || port > MAX_PORT) {\n    return { ok: false, reason: `A port is between ${String(MIN_PORT)} and ${String(MAX_PORT)}.` };\n  }\n  if (reserved.includes(port)) return { ok: false, reason: 'That port belongs to the cockpit itself.' };\n  return { ok: true, port };\n}\n\n/**\n * Whether a path segment tries to climb out of the prefix.\n *\n * Checked before and after percent-decoding. A proxy that only checked the raw\n * form would forward `%2e%2e`, and an upstream that decodes before resolving\n * would then walk out of the tree the operator meant to expose.\n */\nfunction escapesPrefix(upstreamPath: string): boolean {\n  let decoded: string;\n  try {\n    decoded = decodeURIComponent(upstreamPath);\n  } catch {\n    // A malformed percent sequence is not a path this proxy needs to serve.\n    return true;\n  }\n  for (const candidate of [upstreamPath, decoded]) {\n    for (const segment of candidate.split('/')) {\n      if (segment === '.' || segment === '..') return true;\n    }\n  }\n  return false;\n}\n\n/**\n * Whether this path is one the dev proxy owns.\n *\n * The remote guard and the proxy handler must agree about this, and they do not\n * see the same string: Hono's router hands the guard a raw slice of the request\n * line, while the handler reads `new URL(...).pathname`, which resolves `..`\n * before anyone looks at it. So `/devproxy/x/../../api/health` can be a proxy\n * path to one and an API path to the other, and a guard that answered on the\n * prefix alone would grant an `/api/` request the direct, unsealed treatment.\n *\n * Refusing every dot segment removes the disagreement instead of trying to\n * predict it. A legitimate asset URL has no reason to carry one.\n */\nexport function isDevProxyPath(path: string): boolean {\n  if (!path.startsWith(DEV_PROXY_PREFIX)) return false;\n  return !escapesPrefix(path.slice(DEV_PROXY_PREFIX.length));\n}\n/**\n * Identifies the target a proxied request belongs to.\n *\n * `upstreamPath` is the request path unchanged, prefix included. That is the\n * whole trick, and getting it wrong costs a redirect loop: the target is\n * configured with `base: '/devproxy/<name>/'`, so it believes it is serving\n * there and redirects anything at `/` back to its base. Stripping the prefix\n * would hand it `/`, take its redirect, and go round again. nginx draws the\n * same distinction between `proxy_pass http://host/` and `proxy_pass\n * http://host`; this is the second one.\n *\n * Reads the raw, still-encoded pathname. Hono routes and the remote guard both\n * work on the decoded value, so a request that only becomes `/devproxy/...`\n * after decoding would reach this handler, and passing the encoded form\n * through untouched is what makes a file named `a b.png` load.\n */\nexport function parseProxyPath(rawPathname: string): ProxyPathVerdict {\n  if (!rawPathname.startsWith(DEV_PROXY_PREFIX)) return { kind: 'reject', reason: 'Not a proxied path.' };\n  const rest = rawPathname.slice(DEV_PROXY_PREFIX.length);\n  const boundary = rest.indexOf('/');\n\n  if (boundary === -1) {\n    const verdict = validateTargetName(rest);\n    if (!verdict.ok) return { kind: 'reject', reason: verdict.reason };\n    // A dev server serving at its own root needs the trailing slash, or every\n    // relative URL on the page resolves one level too high. nginx answers the\n    // same way rather than guessing.\n    return { kind: 'redirect', location: `${DEV_PROXY_PREFIX}${verdict.name}/` };\n  }\n\n  const verdict = validateTargetName(rest.slice(0, boundary));\n  if (!verdict.ok) return { kind: 'reject', reason: verdict.reason };\n  if (escapesPrefix(rest.slice(boundary))) {\n    return { kind: 'reject', reason: 'That path leaves the proxied target.' };\n  }\n  return { kind: 'match', name: verdict.name, upstreamPath: rawPathname };\n}\n"],"mappings":";;;;;;;;;;;;;;;;AAiBA,MAAM,kBAAkB;;;;;;;;AAQxB,MAAM,cAAc;AACpB,MAAM,WAAW;AACjB,MAAM,WAAW;AAWjB,SAAgB,mBAAmB,KAA2B;CAC5D,IAAI,OAAO,QAAQ,UAAU,OAAO;EAAE,IAAI;EAAO,QAAQ;CAA8B;CACvF,MAAM,OAAO,IAAI,KAAK,CAAC,CAAC,YAAY;CACpC,IAAI,SAAS,IAAI,OAAO;EAAE,IAAI;EAAO,QAAQ;CAAyB;CACtE,IAAI,KAAK,SAAS,iBAChB,OAAO;EAAE,IAAI;EAAO,QAAQ,4BAA4B,OAAO,eAAe,EAAE;CAAc;CAEhG,IAAI,CAAC,YAAY,KAAK,IAAI,GACxB,OAAO;EACL,IAAI;EACJ,QAAQ;CACV;CAEF,OAAO;EAAE,IAAI;EAAM;CAAK;AAC1B;;;;;;;;;;AAWA,SAAgB,mBAAmB,KAAc,UAAwD;CACvG,MAAM,OAAO,OAAO,QAAQ,WAAW,MAAM,OAAO,GAAG;CACvD,IAAI,CAAC,OAAO,cAAc,IAAI,GAAG,OAAO;EAAE,IAAI;EAAO,QAAQ;CAAiC;CAC9F,IAAI,OAAO,YAAY,OAAO,UAC5B,OAAO;EAAE,IAAI;EAAO,QAAQ,qBAAqB,OAAO,QAAQ,EAAE,OAAO,OAAO,QAAQ,EAAE;CAAG;CAE/F,IAAI,SAAS,SAAS,IAAI,GAAG,OAAO;EAAE,IAAI;EAAO,QAAQ;CAA2C;CACpG,OAAO;EAAE,IAAI;EAAM;CAAK;AAC1B;;;;;;;;AASA,SAAS,cAAc,cAA+B;CACpD,IAAI;CACJ,IAAI;EACF,UAAU,mBAAmB,YAAY;CAC3C,QAAQ;EAEN,OAAO;CACT;CACA,KAAK,MAAM,aAAa,CAAC,cAAc,OAAO,GAC5C,KAAK,MAAM,WAAW,UAAU,MAAM,GAAG,GACvC,IAAI,YAAY,OAAO,YAAY,MAAM,OAAO;CAGpD,OAAO;AACT;;;;;;;;;;;;;;AAeA,SAAgB,eAAe,MAAuB;CACpD,IAAI,CAAC,KAAK,WAAA,YAA2B,GAAG,OAAO;CAC/C,OAAO,CAAC,cAAc,KAAK,MAAMA,eAAAA,iBAAiB,MAAM,CAAC;AAC3D;;;;;;;;;;;;;;;;;AAiBA,SAAgB,eAAe,aAAuC;CACpE,IAAI,CAAC,YAAY,WAAA,YAA2B,GAAG,OAAO;EAAE,MAAM;EAAU,QAAQ;CAAsB;CACtG,MAAM,OAAO,YAAY,MAAMA,eAAAA,iBAAiB,MAAM;CACtD,MAAM,WAAW,KAAK,QAAQ,GAAG;CAEjC,IAAI,aAAa,IAAI;EACnB,MAAM,UAAU,mBAAmB,IAAI;EACvC,IAAI,CAAC,QAAQ,IAAI,OAAO;GAAE,MAAM;GAAU,QAAQ,QAAQ;EAAO;EAIjE,OAAO;GAAE,MAAM;GAAY,UAAU,GAAGA,eAAAA,mBAAmB,QAAQ,KAAK;EAAG;CAC7E;CAEA,MAAM,UAAU,mBAAmB,KAAK,MAAM,GAAG,QAAQ,CAAC;CAC1D,IAAI,CAAC,QAAQ,IAAI,OAAO;EAAE,MAAM;EAAU,QAAQ,QAAQ;CAAO;CACjE,IAAI,cAAc,KAAK,MAAM,QAAQ,CAAC,GACpC,OAAO;EAAE,MAAM;EAAU,QAAQ;CAAuC;CAE1E,OAAO;EAAE,MAAM;EAAS,MAAM,QAAQ;EAAM,cAAc;CAAY;AACxE"}