@agimon-ai/doompi-core 0.0.1-alpha.70

package/dist/schemas/remoteApiContracts.cjs

@@ -0,0 +1,307 @@
+const require_httpApiContracts = require("./httpApiContracts.cjs");
+let typebox = require("typebox");
+//#region src/schemas/remoteApiContracts.ts
+const Text = typebox.Type.String();
+const NumberValue = typebox.Type.Number();
+const Optional = typebox.Type.Optional;
+const Flag = typebox.Type.Boolean();
+const JsonObject = typebox.Type.Record(Text, typebox.Type.Unknown({ description: "WebAuthn ceremony fields supplied and verified by the installed WebAuthn implementation." }));
+const Tunnel = typebox.Type.Union([typebox.Type.Object({ kind: typebox.Type.Literal("quick") }), typebox.Type.Object({
+	kind: typebox.Type.Literal("named"),
+	hostname: Text,
+	name: Optional(Text),
+	tokenFile: Optional(Text),
+	configFile: Optional(Text)
+})]);
+const Settings = typebox.Type.Object({
+	autoCloseEnabled: Flag,
+	autoCloseMinutes: NumberValue,
+	sessionExpiryEnabled: Flag,
+	idleMinutes: NumberValue,
+	absoluteHours: NumberValue,
+	tunnel: Tunnel,
+	sandbox: typebox.Type.Object({
+		enabled: Flag,
+		workspaces: typebox.Type.Array(Text)
+	})
+});
+const State = typebox.Type.Object({
+	status: typebox.Type.Union([
+		typebox.Type.Literal("off"),
+		typebox.Type.Literal("starting"),
+		typebox.Type.Literal("on"),
+		typebox.Type.Literal("failed")
+	]),
+	publicUrl: Optional(Text),
+	startedAt: Optional(Text),
+	closesAt: Optional(Text),
+	error: Optional(Text),
+	devices: typebox.Type.Array(typebox.Type.Object({
+		id: Text,
+		label: Text,
+		userAgent: Text,
+		createdAt: Text,
+		lastSeenAt: Text,
+		self: Flag
+	})),
+	pending: typebox.Type.Array(typebox.Type.Object({
+		id: Text,
+		userAgent: Text,
+		edgeIp: Text,
+		createdAt: Text,
+		expiresAt: Text
+	})),
+	settings: Settings
+});
+const StateResponse = typebox.Type.Object({
+	state: State,
+	handingOver: Optional(Flag)
+});
+const Trust = typebox.Type.Object({
+	publicKey: Text,
+	fingerprint: Text,
+	revision: NumberValue
+});
+const Begun = typebox.Type.Object({
+	ceremonyId: Text,
+	options: JsonObject
+});
+const Finish = typebox.Type.Object({
+	ceremonyId: Text,
+	response: JsonObject
+});
+const SealedEnvelopeSchema = typebox.Type.Object({
+	v: typebox.Type.Literal(1),
+	n: Text,
+	c: Text
+});
+const SealedHttpRequestSchema = typebox.Type.Object({
+	v: typebox.Type.Literal(1),
+	method: Text,
+	target: Text,
+	headers: typebox.Type.Array(typebox.Type.Tuple([Text, Text])),
+	body: Optional(Text)
+});
+const SealedHttpResponseSchema = typebox.Type.Object({
+	v: typebox.Type.Literal(1),
+	status: NumberValue,
+	headers: typebox.Type.Array(typebox.Type.Tuple([Text, Text])),
+	body: Text
+});
+const route = (id, path, method, result, input, extra = {}) => ({
+	id: `remote.${id}`,
+	path: `/api/remote${path}`,
+	method,
+	scope: "global",
+	authentication: "owner",
+	description: `Remote Control ${id}.`,
+	availability: "Global host provides Remote Control. Tunnel routes additionally enforce device, origin and step-up policy.",
+	responses: {
+		...require_httpApiContracts.jsonApiResponses(result),
+		"429": {
+			description: "Rate limit exceeded",
+			schema: require_httpApiContracts.ApiErrorSchema
+		}
+	},
+	...input ? { body: {
+		contentType: "application/json",
+		required: true,
+		schema: input
+	} } : {},
+	...extra
+});
+const direct = [
+	route("state", "", "GET", StateResponse),
+	route("enable", "/enable", "POST", StateResponse, void 0, { responses: {
+		...require_httpApiContracts.jsonApiResponses(StateResponse),
+		"202": {
+			description: "Container handover started",
+			schema: StateResponse
+		}
+	} }),
+	route("disable", "/disable", "POST", StateResponse, void 0, { responses: {
+		...require_httpApiContracts.jsonApiResponses(StateResponse),
+		"202": {
+			description: "Tunnel closing",
+			schema: typebox.Type.Object({ status: typebox.Type.Literal("closing") })
+		}
+	} }),
+	route("codes", "/codes", "POST", typebox.Type.Object({
+		...Trust.properties,
+		code: Text,
+		manualCode: Text,
+		pairUrl: Text,
+		expiresAt: Text
+	}), void 0, { responses: require_httpApiContracts.jsonApiResponses(typebox.Type.Object({
+		...Trust.properties,
+		code: Text,
+		manualCode: Text,
+		pairUrl: Text,
+		expiresAt: Text
+	}), 201) }),
+	route("approve", "/pairing/{id}/approve", "POST", StateResponse),
+	route("deny", "/pairing/{id}/deny", "POST", StateResponse),
+	route("revoke", "/devices/{id}", "DELETE", StateResponse),
+	route("settings", "/settings", "PUT", typebox.Type.Object({ settings: Settings }), typebox.Type.Partial(Settings)),
+	route("passkeys", "/passkeys", "GET", typebox.Type.Object({
+		support: typebox.Type.Union([typebox.Type.Object({
+			supported: typebox.Type.Literal(true),
+			rpId: Text
+		}), typebox.Type.Object({
+			supported: typebox.Type.Literal(false),
+			reason: Text
+		})]),
+		credentials: typebox.Type.Array(typebox.Type.Object({
+			id: Text,
+			label: Text,
+			createdAt: Text,
+			lastUsedAt: Text
+		}))
+	})),
+	route("passkeys.remove", "/passkeys/{id}", "DELETE", require_httpApiContracts.ApiOkSchema),
+	route("register.begin", "/passkeys/register/begin", "POST", Begun, void 0, { authentication: "device" }),
+	route("register.finish", "/passkeys/register/finish", "POST", typebox.Type.Object({ id: Text }), Finish, { authentication: "device" }),
+	route("authenticate.begin", "/passkeys/authenticate/begin", "POST", Begun, void 0, { authentication: "none" }),
+	route("authenticate.finish", "/passkeys/authenticate/finish", "POST", typebox.Type.Object({
+		ok: typebox.Type.Literal(true),
+		hostPublicKey: Text
+	}), Finish, { authentication: "none" }),
+	route("challenge", "/challenge", "POST", Begun, typebox.Type.Object({ action: Text }), { authentication: "device" }),
+	route("channel", "/channel", "POST", require_httpApiContracts.ApiOkSchema, typebox.Type.Object({
+		clientPublicKey: Text,
+		scope: typebox.Type.Union([
+			typebox.Type.Literal("session"),
+			typebox.Type.Literal("protocol"),
+			typebox.Type.Literal("http")
+		])
+	}), { authentication: "device" }),
+	route("request", "/request", "POST", SealedEnvelopeSchema, SealedEnvelopeSchema, {
+		authentication: "device",
+		description: "Sealed HTTP gateway. Decrypted requests/responses use the SealedHttpRequest and SealedHttpResponse envelopes."
+	}),
+	route("pair", "/pair", "POST", typebox.Type.Object({
+		requestId: Text,
+		status: typebox.Type.Literal("pending")
+	}), typebox.Type.Object({ code: typebox.Type.String({ minLength: 1 }) }), {
+		authentication: "none",
+		responses: {
+			...require_httpApiContracts.jsonApiResponses(typebox.Type.Object({
+				requestId: Text,
+				status: typebox.Type.Literal("pending")
+			}), 202),
+			"410": {
+				description: "Pairing code is no longer valid",
+				schema: require_httpApiContracts.ApiErrorSchema
+			}
+		}
+	}),
+	route("pair.status", "/pair/status", "GET", typebox.Type.Object({
+		status: typebox.Type.Union([
+			typebox.Type.Literal("pending"),
+			typebox.Type.Literal("approved"),
+			typebox.Type.Literal("denied"),
+			typebox.Type.Literal("expired"),
+			typebox.Type.Literal("consumed")
+		]),
+		bundleTrust: Optional(Trust),
+		hostPublicKey: Optional(Text)
+	}), void 0, {
+		authentication: "none",
+		parameters: [{
+			name: "request",
+			in: "query",
+			required: true,
+			schema: Text
+		}]
+	})
+];
+const remoteHttpContracts = [
+	route("frontend", "/frontend", "POST", require_httpApiContracts.ApiOkSchema, typebox.Type.Object({ origin: Text }), {
+		authentication: "owner",
+		availability: "Internal loopback frontend registration; blocked by the browser proxy.",
+		parameters: [{
+			name: "x-doompi-web-registration",
+			in: "header",
+			required: true,
+			schema: Text
+		}]
+	}),
+	...direct,
+	...direct.map((operation) => ({
+		...operation,
+		id: `${operation.id}.plugin`,
+		basePath: "remote",
+		path: operation.path.slice(11) || "/",
+		authentication: "owner",
+		availability: "Global Remote Control plugin mount, reached through the authenticated headless listener."
+	})),
+	{
+		id: "remote.pair.page",
+		scope: "global",
+		path: "/pair",
+		method: "GET",
+		authentication: "none",
+		availability: "Remote listener only",
+		description: "Pairing and passkey bootstrap page.",
+		responses: { "200": {
+			description: "Pairing page",
+			contentType: "text/html",
+			schema: Text
+		} }
+	}
+];
+const Asset = typebox.Type.Object({
+	path: Text,
+	sha256: typebox.Type.String({ pattern: "^[a-f0-9]{64}$" }),
+	byteLength: typebox.Type.Integer({ minimum: 0 }),
+	contentType: Text
+});
+const Signed = typebox.Type.Object({
+	manifest: typebox.Type.Object({
+		version: typebox.Type.Literal(2),
+		revision: typebox.Type.Integer({ minimum: 1 }),
+		builtAt: NumberValue,
+		assets: typebox.Type.Array(Asset)
+	}),
+	signature: Text,
+	publicKey: Text
+});
+const bundleHttpContracts = [...["/bundle-manifest.json", "/api/web-plugins/{id}/{revision}/manifest"].flatMap((path) => ["GET", "HEAD"].map((method) => ({
+	id: `bundle.${path}.${method}`,
+	scope: "global",
+	path,
+	method,
+	authentication: "owner",
+	availability: "Host publishes a web bundle",
+	description: "Read an immutable signed browser bundle manifest.",
+	responses: method === "HEAD" ? {
+		"200": { description: "Manifest response headers" },
+		"404": { description: "Bundle not published" }
+	} : require_httpApiContracts.jsonApiResponses(Signed)
+}))), ...["/bundle-assets/{revision}/{assetPath}", "/api/web-plugins/{id}/{revision}/assets/{assetPath}"].flatMap((path) => ["GET", "HEAD"].map((method) => ({
+	id: `asset.${path}.${method}`,
+	scope: "global",
+	path,
+	method,
+	authentication: "owner",
+	availability: "Host publishes a web bundle",
+	description: "Read an asset from the signed manifest. assetPath may contain multiple path segments.",
+	responses: {
+		"200": {
+			description: "Manifest-listed asset, original MIME type",
+			...method === "GET" ? {
+				contentType: "*/*",
+				schema: typebox.Type.String({ contentEncoding: "binary" })
+			} : {}
+		},
+		"404": { description: "Asset not published" }
+	}
+})))];
+//#endregion
+exports.SealedEnvelopeSchema = SealedEnvelopeSchema;
+exports.SealedHttpRequestSchema = SealedHttpRequestSchema;
+exports.SealedHttpResponseSchema = SealedHttpResponseSchema;
+exports.bundleHttpContracts = bundleHttpContracts;
+exports.remoteHttpContracts = remoteHttpContracts;
+
+//# sourceMappingURL=remoteApiContracts.cjs.map

package/dist/schemas/remoteApiContracts.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"remoteApiContracts.cjs","names":["Type","jsonApiResponses","ApiErrorSchema","ApiOkSchema"],"sources":["../../src/schemas/remoteApiContracts.ts"],"sourcesContent":["import { Type, type TSchema } from 'typebox';\n\nimport type { DoomHttpContract } from './apiContracts';\nimport { ApiErrorSchema, ApiOkSchema, jsonApiResponses } from './httpApiContracts';\n\nconst Text = Type.String();\nconst NumberValue = Type.Number();\nconst Optional = Type.Optional;\nconst Flag = Type.Boolean();\nconst JsonObject = Type.Record(\n  Text,\n  Type.Unknown({\n    description: 'WebAuthn ceremony fields supplied and verified by the installed WebAuthn implementation.',\n  }),\n);\nconst Tunnel = Type.Union([\n  Type.Object({ kind: Type.Literal('quick') }),\n  Type.Object({\n    kind: Type.Literal('named'),\n    hostname: Text,\n    name: Optional(Text),\n    tokenFile: Optional(Text),\n    configFile: Optional(Text),\n  }),\n]);\nconst Settings = Type.Object({\n  autoCloseEnabled: Flag,\n  autoCloseMinutes: NumberValue,\n  sessionExpiryEnabled: Flag,\n  idleMinutes: NumberValue,\n  absoluteHours: NumberValue,\n  tunnel: Tunnel,\n  sandbox: Type.Object({ enabled: Flag, workspaces: Type.Array(Text) }),\n});\nconst State = Type.Object({\n  status: Type.Union([Type.Literal('off'), Type.Literal('starting'), Type.Literal('on'), Type.Literal('failed')]),\n  publicUrl: Optional(Text),\n  startedAt: Optional(Text),\n  closesAt: Optional(Text),\n  error: Optional(Text),\n  devices: Type.Array(\n    Type.Object({ id: Text, label: Text, userAgent: Text, createdAt: Text, lastSeenAt: Text, self: Flag }),\n  ),\n  pending: Type.Array(Type.Object({ id: Text, userAgent: Text, edgeIp: Text, createdAt: Text, expiresAt: Text })),\n  settings: Settings,\n});\nconst StateResponse = Type.Object({ state: State, handingOver: Optional(Flag) });\nconst Trust = Type.Object({ publicKey: Text, fingerprint: Text, revision: NumberValue });\nconst Begun = Type.Object({ ceremonyId: Text, options: JsonObject });\nconst Finish = Type.Object({ ceremonyId: Text, response: JsonObject });\nexport const SealedEnvelopeSchema = Type.Object({ v: Type.Literal(1), n: Text, c: Text });\nexport const SealedHttpRequestSchema = Type.Object({\n  v: Type.Literal(1),\n  method: Text,\n  target: Text,\n  headers: Type.Array(Type.Tuple([Text, Text])),\n  body: Optional(Text),\n});\nexport const SealedHttpResponseSchema = Type.Object({\n  v: Type.Literal(1),\n  status: NumberValue,\n  headers: Type.Array(Type.Tuple([Text, Text])),\n  body: Text,\n});\nconst route = (\n  id: string,\n  path: string,\n  method: DoomHttpContract['method'],\n  result: TSchema,\n  input?: TSchema,\n  extra: Partial<DoomHttpContract> = {},\n): DoomHttpContract => ({\n  id: `remote.${id}`,\n  path: `/api/remote${path}`,\n  method,\n  scope: 'global',\n  authentication: 'owner',\n  description: `Remote Control ${id}.`,\n  availability:\n    'Global host provides Remote Control. Tunnel routes additionally enforce device, origin and step-up policy.',\n  responses: { ...jsonApiResponses(result), '429': { description: 'Rate limit exceeded', schema: ApiErrorSchema } },\n  ...(input ? { body: { contentType: 'application/json', required: true, schema: input } } : {}),\n  ...extra,\n});\nconst direct: DoomHttpContract[] = [\n  route('state', '', 'GET', StateResponse),\n  route('enable', '/enable', 'POST', StateResponse, undefined, {\n    responses: {\n      ...jsonApiResponses(StateResponse),\n      '202': { description: 'Container handover started', schema: StateResponse },\n    },\n  }),\n  route('disable', '/disable', 'POST', StateResponse, undefined, {\n    responses: {\n      ...jsonApiResponses(StateResponse),\n      '202': { description: 'Tunnel closing', schema: Type.Object({ status: Type.Literal('closing') }) },\n    },\n  }),\n  route(\n    'codes',\n    '/codes',\n    'POST',\n    Type.Object({ ...Trust.properties, code: Text, manualCode: Text, pairUrl: Text, expiresAt: Text }),\n    undefined,\n    {\n      responses: jsonApiResponses(\n        Type.Object({ ...Trust.properties, code: Text, manualCode: Text, pairUrl: Text, expiresAt: Text }),\n        201,\n      ),\n    },\n  ),\n  route('approve', '/pairing/{id}/approve', 'POST', StateResponse),\n  route('deny', '/pairing/{id}/deny', 'POST', StateResponse),\n  route('revoke', '/devices/{id}', 'DELETE', StateResponse),\n  route('settings', '/settings', 'PUT', Type.Object({ settings: Settings }), Type.Partial(Settings)),\n  route(\n    'passkeys',\n    '/passkeys',\n    'GET',\n    Type.Object({\n      support: Type.Union([\n        Type.Object({ supported: Type.Literal(true), rpId: Text }),\n        Type.Object({ supported: Type.Literal(false), reason: Text }),\n      ]),\n      credentials: Type.Array(Type.Object({ id: Text, label: Text, createdAt: Text, lastUsedAt: Text })),\n    }),\n  ),\n  route('passkeys.remove', '/passkeys/{id}', 'DELETE', ApiOkSchema),\n  route('register.begin', '/passkeys/register/begin', 'POST', Begun, undefined, { authentication: 'device' }),\n  route('register.finish', '/passkeys/register/finish', 'POST', Type.Object({ id: Text }), Finish, {\n    authentication: 'device',\n  }),\n  route('authenticate.begin', '/passkeys/authenticate/begin', 'POST', Begun, undefined, { authentication: 'none' }),\n  route(\n    'authenticate.finish',\n    '/passkeys/authenticate/finish',\n    'POST',\n    Type.Object({ ok: Type.Literal(true), hostPublicKey: Text }),\n    Finish,\n    { authentication: 'none' },\n  ),\n  route('challenge', '/challenge', 'POST', Begun, Type.Object({ action: Text }), { authentication: 'device' }),\n  route(\n    'channel',\n    '/channel',\n    'POST',\n    ApiOkSchema,\n    Type.Object({\n      clientPublicKey: Text,\n      scope: Type.Union([Type.Literal('session'), Type.Literal('protocol'), Type.Literal('http')]),\n    }),\n    { authentication: 'device' },\n  ),\n  route('request', '/request', 'POST', SealedEnvelopeSchema, SealedEnvelopeSchema, {\n    authentication: 'device',\n    description:\n      'Sealed HTTP gateway. Decrypted requests/responses use the SealedHttpRequest and SealedHttpResponse envelopes.',\n  }),\n  route(\n    'pair',\n    '/pair',\n    'POST',\n    Type.Object({ requestId: Text, status: Type.Literal('pending') }),\n    Type.Object({ code: Type.String({ minLength: 1 }) }),\n    {\n      authentication: 'none',\n      responses: {\n        ...jsonApiResponses(Type.Object({ requestId: Text, status: Type.Literal('pending') }), 202),\n        '410': { description: 'Pairing code is no longer valid', schema: ApiErrorSchema },\n      },\n    },\n  ),\n  route(\n    'pair.status',\n    '/pair/status',\n    'GET',\n    Type.Object({\n      status: Type.Union([\n        Type.Literal('pending'),\n        Type.Literal('approved'),\n        Type.Literal('denied'),\n        Type.Literal('expired'),\n        Type.Literal('consumed'),\n      ]),\n      bundleTrust: Optional(Trust),\n      hostPublicKey: Optional(Text),\n    }),\n    undefined,\n    { authentication: 'none', parameters: [{ name: 'request', in: 'query', required: true, schema: Text }] },\n  ),\n];\nexport const remoteHttpContracts: DoomHttpContract[] = [\n  route('frontend', '/frontend', 'POST', ApiOkSchema, Type.Object({ origin: Text }), {\n    authentication: 'owner',\n    availability: 'Internal loopback frontend registration; blocked by the browser proxy.',\n    parameters: [{ name: 'x-doompi-web-registration', in: 'header', required: true, schema: Text }],\n  }),\n  ...direct,\n  ...direct.map((operation) => ({\n    ...operation,\n    id: `${operation.id}.plugin`,\n    basePath: 'remote',\n    path: operation.path.slice('/api/remote'.length) || '/',\n    authentication: 'owner' as const,\n    availability: 'Global Remote Control plugin mount, reached through the authenticated headless listener.',\n  })),\n  {\n    id: 'remote.pair.page',\n    scope: 'global',\n    path: '/pair',\n    method: 'GET',\n    authentication: 'none',\n    availability: 'Remote listener only',\n    description: 'Pairing and passkey bootstrap page.',\n    responses: { '200': { description: 'Pairing page', contentType: 'text/html', schema: Text } },\n  },\n];\nconst Asset = Type.Object({\n  path: Text,\n  sha256: Type.String({ pattern: '^[a-f0-9]{64}$' }),\n  byteLength: Type.Integer({ minimum: 0 }),\n  contentType: Text,\n});\nconst Signed = Type.Object({\n  manifest: Type.Object({\n    version: Type.Literal(2),\n    revision: Type.Integer({ minimum: 1 }),\n    builtAt: NumberValue,\n    assets: Type.Array(Asset),\n  }),\n  signature: Text,\n  publicKey: Text,\n});\nexport const bundleHttpContracts: DoomHttpContract[] = [\n  ...['/bundle-manifest.json', '/api/web-plugins/{id}/{revision}/manifest'].flatMap((path) =>\n    (['GET', 'HEAD'] as const).map((method): DoomHttpContract => ({\n      id: `bundle.${path}.${method}`,\n      scope: 'global',\n      path,\n      method,\n      authentication: 'owner',\n      availability: 'Host publishes a web bundle',\n      description: 'Read an immutable signed browser bundle manifest.',\n      responses:\n        method === 'HEAD'\n          ? { '200': { description: 'Manifest response headers' }, '404': { description: 'Bundle not published' } }\n          : jsonApiResponses(Signed),\n    })),\n  ),\n  ...['/bundle-assets/{revision}/{assetPath}', '/api/web-plugins/{id}/{revision}/assets/{assetPath}'].flatMap((path) =>\n    (['GET', 'HEAD'] as const).map((method): DoomHttpContract => ({\n      id: `asset.${path}.${method}`,\n      scope: 'global',\n      path,\n      method,\n      authentication: 'owner',\n      availability: 'Host publishes a web bundle',\n      description: 'Read an asset from the signed manifest. assetPath may contain multiple path segments.',\n      responses: {\n        '200': {\n          description: 'Manifest-listed asset, original MIME type',\n          ...(method === 'GET' ? { contentType: '*/*', schema: Type.String({ contentEncoding: 'binary' }) } : {}),\n        },\n        '404': { description: 'Asset not published' },\n      },\n    })),\n  ),\n];\n"],"mappings":";;;AAKA,MAAM,OAAOA,QAAAA,KAAK,OAAO;AACzB,MAAM,cAAcA,QAAAA,KAAK,OAAO;AAChC,MAAM,WAAWA,QAAAA,KAAK;AACtB,MAAM,OAAOA,QAAAA,KAAK,QAAQ;AAC1B,MAAM,aAAaA,QAAAA,KAAK,OACtB,MACAA,QAAAA,KAAK,QAAQ,EACX,aAAa,2FACf,CAAC,CACH;AACA,MAAM,SAASA,QAAAA,KAAK,MAAM,CACxBA,QAAAA,KAAK,OAAO,EAAE,MAAMA,QAAAA,KAAK,QAAQ,OAAO,EAAE,CAAC,GAC3CA,QAAAA,KAAK,OAAO;CACV,MAAMA,QAAAA,KAAK,QAAQ,OAAO;CAC1B,UAAU;CACV,MAAM,SAAS,IAAI;CACnB,WAAW,SAAS,IAAI;CACxB,YAAY,SAAS,IAAI;AAC3B,CAAC,CACH,CAAC;AACD,MAAM,WAAWA,QAAAA,KAAK,OAAO;CAC3B,kBAAkB;CAClB,kBAAkB;CAClB,sBAAsB;CACtB,aAAa;CACb,eAAe;CACf,QAAQ;CACR,SAASA,QAAAA,KAAK,OAAO;EAAE,SAAS;EAAM,YAAYA,QAAAA,KAAK,MAAM,IAAI;CAAE,CAAC;AACtE,CAAC;AACD,MAAM,QAAQA,QAAAA,KAAK,OAAO;CACxB,QAAQA,QAAAA,KAAK,MAAM;EAACA,QAAAA,KAAK,QAAQ,KAAK;EAAGA,QAAAA,KAAK,QAAQ,UAAU;EAAGA,QAAAA,KAAK,QAAQ,IAAI;EAAGA,QAAAA,KAAK,QAAQ,QAAQ;CAAC,CAAC;CAC9G,WAAW,SAAS,IAAI;CACxB,WAAW,SAAS,IAAI;CACxB,UAAU,SAAS,IAAI;CACvB,OAAO,SAAS,IAAI;CACpB,SAASA,QAAAA,KAAK,MACZA,QAAAA,KAAK,OAAO;EAAE,IAAI;EAAM,OAAO;EAAM,WAAW;EAAM,WAAW;EAAM,YAAY;EAAM,MAAM;CAAK,CAAC,CACvG;CACA,SAASA,QAAAA,KAAK,MAAMA,QAAAA,KAAK,OAAO;EAAE,IAAI;EAAM,WAAW;EAAM,QAAQ;EAAM,WAAW;EAAM,WAAW;CAAK,CAAC,CAAC;CAC9G,UAAU;AACZ,CAAC;AACD,MAAM,gBAAgBA,QAAAA,KAAK,OAAO;CAAE,OAAO;CAAO,aAAa,SAAS,IAAI;AAAE,CAAC;AAC/E,MAAM,QAAQA,QAAAA,KAAK,OAAO;CAAE,WAAW;CAAM,aAAa;CAAM,UAAU;AAAY,CAAC;AACvF,MAAM,QAAQA,QAAAA,KAAK,OAAO;CAAE,YAAY;CAAM,SAAS;AAAW,CAAC;AACnE,MAAM,SAASA,QAAAA,KAAK,OAAO;CAAE,YAAY;CAAM,UAAU;AAAW,CAAC;AACrE,MAAa,uBAAuBA,QAAAA,KAAK,OAAO;CAAE,GAAGA,QAAAA,KAAK,QAAQ,CAAC;CAAG,GAAG;CAAM,GAAG;AAAK,CAAC;AACxF,MAAa,0BAA0BA,QAAAA,KAAK,OAAO;CACjD,GAAGA,QAAAA,KAAK,QAAQ,CAAC;CACjB,QAAQ;CACR,QAAQ;CACR,SAASA,QAAAA,KAAK,MAAMA,QAAAA,KAAK,MAAM,CAAC,MAAM,IAAI,CAAC,CAAC;CAC5C,MAAM,SAAS,IAAI;AACrB,CAAC;AACD,MAAa,2BAA2BA,QAAAA,KAAK,OAAO;CAClD,GAAGA,QAAAA,KAAK,QAAQ,CAAC;CACjB,QAAQ;CACR,SAASA,QAAAA,KAAK,MAAMA,QAAAA,KAAK,MAAM,CAAC,MAAM,IAAI,CAAC,CAAC;CAC5C,MAAM;AACR,CAAC;AACD,MAAM,SACJ,IACA,MACA,QACA,QACA,OACA,QAAmC,CAAC,OACd;CACtB,IAAI,UAAU;CACd,MAAM,cAAc;CACpB;CACA,OAAO;CACP,gBAAgB;CAChB,aAAa,kBAAkB,GAAG;CAClC,cACE;CACF,WAAW;EAAE,GAAGC,yBAAAA,iBAAiB,MAAM;EAAG,OAAO;GAAE,aAAa;GAAuB,QAAQC,yBAAAA;EAAe;CAAE;CAChH,GAAI,QAAQ,EAAE,MAAM;EAAE,aAAa;EAAoB,UAAU;EAAM,QAAQ;CAAM,EAAE,IAAI,CAAC;CAC5F,GAAG;AACL;AACA,MAAM,SAA6B;CACjC,MAAM,SAAS,IAAI,OAAO,aAAa;CACvC,MAAM,UAAU,WAAW,QAAQ,eAAe,KAAA,GAAW,EAC3D,WAAW;EACT,GAAGD,yBAAAA,iBAAiB,aAAa;EACjC,OAAO;GAAE,aAAa;GAA8B,QAAQ;EAAc;CAC5E,EACF,CAAC;CACD,MAAM,WAAW,YAAY,QAAQ,eAAe,KAAA,GAAW,EAC7D,WAAW;EACT,GAAGA,yBAAAA,iBAAiB,aAAa;EACjC,OAAO;GAAE,aAAa;GAAkB,QAAQD,QAAAA,KAAK,OAAO,EAAE,QAAQA,QAAAA,KAAK,QAAQ,SAAS,EAAE,CAAC;EAAE;CACnG,EACF,CAAC;CACD,MACE,SACA,UACA,QACAA,QAAAA,KAAK,OAAO;EAAE,GAAG,MAAM;EAAY,MAAM;EAAM,YAAY;EAAM,SAAS;EAAM,WAAW;CAAK,CAAC,GACjG,KAAA,GACA,EACE,WAAWC,yBAAAA,iBACTD,QAAAA,KAAK,OAAO;EAAE,GAAG,MAAM;EAAY,MAAM;EAAM,YAAY;EAAM,SAAS;EAAM,WAAW;CAAK,CAAC,GACjG,GACF,EACF,CACF;CACA,MAAM,WAAW,yBAAyB,QAAQ,aAAa;CAC/D,MAAM,QAAQ,sBAAsB,QAAQ,aAAa;CACzD,MAAM,UAAU,iBAAiB,UAAU,aAAa;CACxD,MAAM,YAAY,aAAa,OAAOA,QAAAA,KAAK,OAAO,EAAE,UAAU,SAAS,CAAC,GAAGA,QAAAA,KAAK,QAAQ,QAAQ,CAAC;CACjG,MACE,YACA,aACA,OACAA,QAAAA,KAAK,OAAO;EACV,SAASA,QAAAA,KAAK,MAAM,CAClBA,QAAAA,KAAK,OAAO;GAAE,WAAWA,QAAAA,KAAK,QAAQ,IAAI;GAAG,MAAM;EAAK,CAAC,GACzDA,QAAAA,KAAK,OAAO;GAAE,WAAWA,QAAAA,KAAK,QAAQ,KAAK;GAAG,QAAQ;EAAK,CAAC,CAC9D,CAAC;EACD,aAAaA,QAAAA,KAAK,MAAMA,QAAAA,KAAK,OAAO;GAAE,IAAI;GAAM,OAAO;GAAM,WAAW;GAAM,YAAY;EAAK,CAAC,CAAC;CACnG,CAAC,CACH;CACA,MAAM,mBAAmB,kBAAkB,UAAUG,yBAAAA,WAAW;CAChE,MAAM,kBAAkB,4BAA4B,QAAQ,OAAO,KAAA,GAAW,EAAE,gBAAgB,SAAS,CAAC;CAC1G,MAAM,mBAAmB,6BAA6B,QAAQH,QAAAA,KAAK,OAAO,EAAE,IAAI,KAAK,CAAC,GAAG,QAAQ,EAC/F,gBAAgB,SAClB,CAAC;CACD,MAAM,sBAAsB,gCAAgC,QAAQ,OAAO,KAAA,GAAW,EAAE,gBAAgB,OAAO,CAAC;CAChH,MACE,uBACA,iCACA,QACAA,QAAAA,KAAK,OAAO;EAAE,IAAIA,QAAAA,KAAK,QAAQ,IAAI;EAAG,eAAe;CAAK,CAAC,GAC3D,QACA,EAAE,gBAAgB,OAAO,CAC3B;CACA,MAAM,aAAa,cAAc,QAAQ,OAAOA,QAAAA,KAAK,OAAO,EAAE,QAAQ,KAAK,CAAC,GAAG,EAAE,gBAAgB,SAAS,CAAC;CAC3G,MACE,WACA,YACA,QACAG,yBAAAA,aACAH,QAAAA,KAAK,OAAO;EACV,iBAAiB;EACjB,OAAOA,QAAAA,KAAK,MAAM;GAACA,QAAAA,KAAK,QAAQ,SAAS;GAAGA,QAAAA,KAAK,QAAQ,UAAU;GAAGA,QAAAA,KAAK,QAAQ,MAAM;EAAC,CAAC;CAC7F,CAAC,GACD,EAAE,gBAAgB,SAAS,CAC7B;CACA,MAAM,WAAW,YAAY,QAAQ,sBAAsB,sBAAsB;EAC/E,gBAAgB;EAChB,aACE;CACJ,CAAC;CACD,MACE,QACA,SACA,QACAA,QAAAA,KAAK,OAAO;EAAE,WAAW;EAAM,QAAQA,QAAAA,KAAK,QAAQ,SAAS;CAAE,CAAC,GAChEA,QAAAA,KAAK,OAAO,EAAE,MAAMA,QAAAA,KAAK,OAAO,EAAE,WAAW,EAAE,CAAC,EAAE,CAAC,GACnD;EACE,gBAAgB;EAChB,WAAW;GACT,GAAGC,yBAAAA,iBAAiBD,QAAAA,KAAK,OAAO;IAAE,WAAW;IAAM,QAAQA,QAAAA,KAAK,QAAQ,SAAS;GAAE,CAAC,GAAG,GAAG;GAC1F,OAAO;IAAE,aAAa;IAAmC,QAAQE,yBAAAA;GAAe;EAClF;CACF,CACF;CACA,MACE,eACA,gBACA,OACAF,QAAAA,KAAK,OAAO;EACV,QAAQA,QAAAA,KAAK,MAAM;GACjBA,QAAAA,KAAK,QAAQ,SAAS;GACtBA,QAAAA,KAAK,QAAQ,UAAU;GACvBA,QAAAA,KAAK,QAAQ,QAAQ;GACrBA,QAAAA,KAAK,QAAQ,SAAS;GACtBA,QAAAA,KAAK,QAAQ,UAAU;EACzB,CAAC;EACD,aAAa,SAAS,KAAK;EAC3B,eAAe,SAAS,IAAI;CAC9B,CAAC,GACD,KAAA,GACA;EAAE,gBAAgB;EAAQ,YAAY,CAAC;GAAE,MAAM;GAAW,IAAI;GAAS,UAAU;GAAM,QAAQ;EAAK,CAAC;CAAE,CACzG;AACF;AACA,MAAa,sBAA0C;CACrD,MAAM,YAAY,aAAa,QAAQG,yBAAAA,aAAaH,QAAAA,KAAK,OAAO,EAAE,QAAQ,KAAK,CAAC,GAAG;EACjF,gBAAgB;EAChB,cAAc;EACd,YAAY,CAAC;GAAE,MAAM;GAA6B,IAAI;GAAU,UAAU;GAAM,QAAQ;EAAK,CAAC;CAChG,CAAC;CACD,GAAG;CACH,GAAG,OAAO,KAAK,eAAe;EAC5B,GAAG;EACH,IAAI,GAAG,UAAU,GAAG;EACpB,UAAU;EACV,MAAM,UAAU,KAAK,MAAM,EAAoB,KAAK;EACpD,gBAAgB;EAChB,cAAc;CAChB,EAAE;CACF;EACE,IAAI;EACJ,OAAO;EACP,MAAM;EACN,QAAQ;EACR,gBAAgB;EAChB,cAAc;EACd,aAAa;EACb,WAAW,EAAE,OAAO;GAAE,aAAa;GAAgB,aAAa;GAAa,QAAQ;EAAK,EAAE;CAC9F;AACF;AACA,MAAM,QAAQA,QAAAA,KAAK,OAAO;CACxB,MAAM;CACN,QAAQA,QAAAA,KAAK,OAAO,EAAE,SAAS,iBAAiB,CAAC;CACjD,YAAYA,QAAAA,KAAK,QAAQ,EAAE,SAAS,EAAE,CAAC;CACvC,aAAa;AACf,CAAC;AACD,MAAM,SAASA,QAAAA,KAAK,OAAO;CACzB,UAAUA,QAAAA,KAAK,OAAO;EACpB,SAASA,QAAAA,KAAK,QAAQ,CAAC;EACvB,UAAUA,QAAAA,KAAK,QAAQ,EAAE,SAAS,EAAE,CAAC;EACrC,SAAS;EACT,QAAQA,QAAAA,KAAK,MAAM,KAAK;CAC1B,CAAC;CACD,WAAW;CACX,WAAW;AACb,CAAC;AACD,MAAa,sBAA0C,CACrD,GAAG,CAAC,yBAAyB,2CAA2C,CAAC,CAAC,SAAS,SAChF,CAAC,OAAO,MAAM,CAAC,CAAW,KAAK,YAA8B;CAC5D,IAAI,UAAU,KAAK,GAAG;CACtB,OAAO;CACP;CACA;CACA,gBAAgB;CAChB,cAAc;CACd,aAAa;CACb,WACE,WAAW,SACP;EAAE,OAAO,EAAE,aAAa,4BAA4B;EAAG,OAAO,EAAE,aAAa,uBAAuB;CAAE,IACtGC,yBAAAA,iBAAiB,MAAM;AAC/B,EAAE,CACJ,GACA,GAAG,CAAC,yCAAyC,qDAAqD,CAAC,CAAC,SAAS,SAC1G,CAAC,OAAO,MAAM,CAAC,CAAW,KAAK,YAA8B;CAC5D,IAAI,SAAS,KAAK,GAAG;CACrB,OAAO;CACP;CACA;CACA,gBAAgB;CAChB,cAAc;CACd,aAAa;CACb,WAAW;EACT,OAAO;GACL,aAAa;GACb,GAAI,WAAW,QAAQ;IAAE,aAAa;IAAO,QAAQD,QAAAA,KAAK,OAAO,EAAE,iBAAiB,SAAS,CAAC;GAAE,IAAI,CAAC;EACvG;EACA,OAAO,EAAE,aAAa,sBAAsB;CAC9C;AACF,EAAE,CACJ,CACF"}

package/dist/schemas/remoteApiContracts.mjs

@@ -0,0 +1,303 @@
+import { ApiErrorSchema, ApiOkSchema, jsonApiResponses } from "./httpApiContracts.mjs";
+import { Type } from "typebox";
+//#region src/schemas/remoteApiContracts.ts
+const Text = Type.String();
+const NumberValue = Type.Number();
+const Optional = Type.Optional;
+const Flag = Type.Boolean();
+const JsonObject = Type.Record(Text, Type.Unknown({ description: "WebAuthn ceremony fields supplied and verified by the installed WebAuthn implementation." }));
+const Tunnel = Type.Union([Type.Object({ kind: Type.Literal("quick") }), Type.Object({
+	kind: Type.Literal("named"),
+	hostname: Text,
+	name: Optional(Text),
+	tokenFile: Optional(Text),
+	configFile: Optional(Text)
+})]);
+const Settings = Type.Object({
+	autoCloseEnabled: Flag,
+	autoCloseMinutes: NumberValue,
+	sessionExpiryEnabled: Flag,
+	idleMinutes: NumberValue,
+	absoluteHours: NumberValue,
+	tunnel: Tunnel,
+	sandbox: Type.Object({
+		enabled: Flag,
+		workspaces: Type.Array(Text)
+	})
+});
+const State = Type.Object({
+	status: Type.Union([
+		Type.Literal("off"),
+		Type.Literal("starting"),
+		Type.Literal("on"),
+		Type.Literal("failed")
+	]),
+	publicUrl: Optional(Text),
+	startedAt: Optional(Text),
+	closesAt: Optional(Text),
+	error: Optional(Text),
+	devices: Type.Array(Type.Object({
+		id: Text,
+		label: Text,
+		userAgent: Text,
+		createdAt: Text,
+		lastSeenAt: Text,
+		self: Flag
+	})),
+	pending: Type.Array(Type.Object({
+		id: Text,
+		userAgent: Text,
+		edgeIp: Text,
+		createdAt: Text,
+		expiresAt: Text
+	})),
+	settings: Settings
+});
+const StateResponse = Type.Object({
+	state: State,
+	handingOver: Optional(Flag)
+});
+const Trust = Type.Object({
+	publicKey: Text,
+	fingerprint: Text,
+	revision: NumberValue
+});
+const Begun = Type.Object({
+	ceremonyId: Text,
+	options: JsonObject
+});
+const Finish = Type.Object({
+	ceremonyId: Text,
+	response: JsonObject
+});
+const SealedEnvelopeSchema = Type.Object({
+	v: Type.Literal(1),
+	n: Text,
+	c: Text
+});
+const SealedHttpRequestSchema = Type.Object({
+	v: Type.Literal(1),
+	method: Text,
+	target: Text,
+	headers: Type.Array(Type.Tuple([Text, Text])),
+	body: Optional(Text)
+});
+const SealedHttpResponseSchema = Type.Object({
+	v: Type.Literal(1),
+	status: NumberValue,
+	headers: Type.Array(Type.Tuple([Text, Text])),
+	body: Text
+});
+const route = (id, path, method, result, input, extra = {}) => ({
+	id: `remote.${id}`,
+	path: `/api/remote${path}`,
+	method,
+	scope: "global",
+	authentication: "owner",
+	description: `Remote Control ${id}.`,
+	availability: "Global host provides Remote Control. Tunnel routes additionally enforce device, origin and step-up policy.",
+	responses: {
+		...jsonApiResponses(result),
+		"429": {
+			description: "Rate limit exceeded",
+			schema: ApiErrorSchema
+		}
+	},
+	...input ? { body: {
+		contentType: "application/json",
+		required: true,
+		schema: input
+	} } : {},
+	...extra
+});
+const direct = [
+	route("state", "", "GET", StateResponse),
+	route("enable", "/enable", "POST", StateResponse, void 0, { responses: {
+		...jsonApiResponses(StateResponse),
+		"202": {
+			description: "Container handover started",
+			schema: StateResponse
+		}
+	} }),
+	route("disable", "/disable", "POST", StateResponse, void 0, { responses: {
+		...jsonApiResponses(StateResponse),
+		"202": {
+			description: "Tunnel closing",
+			schema: Type.Object({ status: Type.Literal("closing") })
+		}
+	} }),
+	route("codes", "/codes", "POST", Type.Object({
+		...Trust.properties,
+		code: Text,
+		manualCode: Text,
+		pairUrl: Text,
+		expiresAt: Text
+	}), void 0, { responses: jsonApiResponses(Type.Object({
+		...Trust.properties,
+		code: Text,
+		manualCode: Text,
+		pairUrl: Text,
+		expiresAt: Text
+	}), 201) }),
+	route("approve", "/pairing/{id}/approve", "POST", StateResponse),
+	route("deny", "/pairing/{id}/deny", "POST", StateResponse),
+	route("revoke", "/devices/{id}", "DELETE", StateResponse),
+	route("settings", "/settings", "PUT", Type.Object({ settings: Settings }), Type.Partial(Settings)),
+	route("passkeys", "/passkeys", "GET", Type.Object({
+		support: Type.Union([Type.Object({
+			supported: Type.Literal(true),
+			rpId: Text
+		}), Type.Object({
+			supported: Type.Literal(false),
+			reason: Text
+		})]),
+		credentials: Type.Array(Type.Object({
+			id: Text,
+			label: Text,
+			createdAt: Text,
+			lastUsedAt: Text
+		}))
+	})),
+	route("passkeys.remove", "/passkeys/{id}", "DELETE", ApiOkSchema),
+	route("register.begin", "/passkeys/register/begin", "POST", Begun, void 0, { authentication: "device" }),
+	route("register.finish", "/passkeys/register/finish", "POST", Type.Object({ id: Text }), Finish, { authentication: "device" }),
+	route("authenticate.begin", "/passkeys/authenticate/begin", "POST", Begun, void 0, { authentication: "none" }),
+	route("authenticate.finish", "/passkeys/authenticate/finish", "POST", Type.Object({
+		ok: Type.Literal(true),
+		hostPublicKey: Text
+	}), Finish, { authentication: "none" }),
+	route("challenge", "/challenge", "POST", Begun, Type.Object({ action: Text }), { authentication: "device" }),
+	route("channel", "/channel", "POST", ApiOkSchema, Type.Object({
+		clientPublicKey: Text,
+		scope: Type.Union([
+			Type.Literal("session"),
+			Type.Literal("protocol"),
+			Type.Literal("http")
+		])
+	}), { authentication: "device" }),
+	route("request", "/request", "POST", SealedEnvelopeSchema, SealedEnvelopeSchema, {
+		authentication: "device",
+		description: "Sealed HTTP gateway. Decrypted requests/responses use the SealedHttpRequest and SealedHttpResponse envelopes."
+	}),
+	route("pair", "/pair", "POST", Type.Object({
+		requestId: Text,
+		status: Type.Literal("pending")
+	}), Type.Object({ code: Type.String({ minLength: 1 }) }), {
+		authentication: "none",
+		responses: {
+			...jsonApiResponses(Type.Object({
+				requestId: Text,
+				status: Type.Literal("pending")
+			}), 202),
+			"410": {
+				description: "Pairing code is no longer valid",
+				schema: ApiErrorSchema
+			}
+		}
+	}),
+	route("pair.status", "/pair/status", "GET", Type.Object({
+		status: Type.Union([
+			Type.Literal("pending"),
+			Type.Literal("approved"),
+			Type.Literal("denied"),
+			Type.Literal("expired"),
+			Type.Literal("consumed")
+		]),
+		bundleTrust: Optional(Trust),
+		hostPublicKey: Optional(Text)
+	}), void 0, {
+		authentication: "none",
+		parameters: [{
+			name: "request",
+			in: "query",
+			required: true,
+			schema: Text
+		}]
+	})
+];
+const remoteHttpContracts = [
+	route("frontend", "/frontend", "POST", ApiOkSchema, Type.Object({ origin: Text }), {
+		authentication: "owner",
+		availability: "Internal loopback frontend registration; blocked by the browser proxy.",
+		parameters: [{
+			name: "x-doompi-web-registration",
+			in: "header",
+			required: true,
+			schema: Text
+		}]
+	}),
+	...direct,
+	...direct.map((operation) => ({
+		...operation,
+		id: `${operation.id}.plugin`,
+		basePath: "remote",
+		path: operation.path.slice(11) || "/",
+		authentication: "owner",
+		availability: "Global Remote Control plugin mount, reached through the authenticated headless listener."
+	})),
+	{
+		id: "remote.pair.page",
+		scope: "global",
+		path: "/pair",
+		method: "GET",
+		authentication: "none",
+		availability: "Remote listener only",
+		description: "Pairing and passkey bootstrap page.",
+		responses: { "200": {
+			description: "Pairing page",
+			contentType: "text/html",
+			schema: Text
+		} }
+	}
+];
+const Asset = Type.Object({
+	path: Text,
+	sha256: Type.String({ pattern: "^[a-f0-9]{64}$" }),
+	byteLength: Type.Integer({ minimum: 0 }),
+	contentType: Text
+});
+const Signed = Type.Object({
+	manifest: Type.Object({
+		version: Type.Literal(2),
+		revision: Type.Integer({ minimum: 1 }),
+		builtAt: NumberValue,
+		assets: Type.Array(Asset)
+	}),
+	signature: Text,
+	publicKey: Text
+});
+const bundleHttpContracts = [...["/bundle-manifest.json", "/api/web-plugins/{id}/{revision}/manifest"].flatMap((path) => ["GET", "HEAD"].map((method) => ({
+	id: `bundle.${path}.${method}`,
+	scope: "global",
+	path,
+	method,
+	authentication: "owner",
+	availability: "Host publishes a web bundle",
+	description: "Read an immutable signed browser bundle manifest.",
+	responses: method === "HEAD" ? {
+		"200": { description: "Manifest response headers" },
+		"404": { description: "Bundle not published" }
+	} : jsonApiResponses(Signed)
+}))), ...["/bundle-assets/{revision}/{assetPath}", "/api/web-plugins/{id}/{revision}/assets/{assetPath}"].flatMap((path) => ["GET", "HEAD"].map((method) => ({
+	id: `asset.${path}.${method}`,
+	scope: "global",
+	path,
+	method,
+	authentication: "owner",
+	availability: "Host publishes a web bundle",
+	description: "Read an asset from the signed manifest. assetPath may contain multiple path segments.",
+	responses: {
+		"200": {
+			description: "Manifest-listed asset, original MIME type",
+			...method === "GET" ? {
+				contentType: "*/*",
+				schema: Type.String({ contentEncoding: "binary" })
+			} : {}
+		},
+		"404": { description: "Asset not published" }
+	}
+})))];
+//#endregion
+export { SealedEnvelopeSchema, SealedHttpRequestSchema, SealedHttpResponseSchema, bundleHttpContracts, remoteHttpContracts };
+
+//# sourceMappingURL=remoteApiContracts.mjs.map