@agimon-ai/doompi-core 0.0.1-alpha.70

package/dist/services/deviceSessions/index.cjs

@@ -0,0 +1,147 @@
+//#region src/services/deviceSessions/index.ts
+const MS_PER_MINUTE = 6e4;
+const MS_PER_HOUR = 36e5;
+const MS_PER_SECOND = 1e3;
+/** Long enough to tell an iPhone from a laptop, short enough not to be a fingerprint in a log. */
+const MAX_USER_AGENT = 200;
+/** Upper bound of the C0 block, and the bounds of C1. Codepoints rather than a character class:
+* a regex over control characters is unreadable, hard to review, and trips no-control-regex. */
+const C0_END = 31;
+const C1_START = 127;
+const C1_END = 159;
+const UNKNOWN_DEVICE = "unknown device";
+/** Whether this record still authorizes a request, under the settings in force right now. */
+function evaluateDevice(record, now, settings) {
+	if (record === void 0) return {
+		ok: false,
+		reason: "unknown"
+	};
+	if (!settings.sessionExpiryEnabled) return {
+		ok: true,
+		record
+	};
+	if (now - record.lastSeenAt >= settings.idleMinutes * MS_PER_MINUTE) return {
+		ok: false,
+		reason: "idle"
+	};
+	if (now - record.createdAt >= settings.absoluteHours * MS_PER_HOUR) return {
+		ok: false,
+		reason: "absolute"
+	};
+	return {
+		ok: true,
+		record
+	};
+}
+/** Exact deadline at which this device stops authorizing, or undefined while expiry is disabled. */
+function deviceExpiryAt(record, settings) {
+	if (!settings.sessionExpiryEnabled) return void 0;
+	return Math.min(record.lastSeenAt + settings.idleMinutes * MS_PER_MINUTE, record.createdAt + settings.absoluteHours * MS_PER_HOUR);
+}
+function touchDevice(record, now) {
+	return {
+		...record,
+		lastSeenAt: now
+	};
+}
+/** How long the cookie should live, so the browser forgets roughly when the server does. */
+function cookieMaxAgeSeconds(settings, ceilingSeconds) {
+	if (!settings.sessionExpiryEnabled) return ceilingSeconds;
+	return Math.min(ceilingSeconds, Math.round(settings.absoluteHours * MS_PER_HOUR / MS_PER_SECOND));
+}
+/** Replaces every C0 and C1 control character with a space; those are what could forge a log line. */
+function withoutControlCharacters(value) {
+	let out = "";
+	for (const character of value) {
+		const code = character.codePointAt(0) ?? 0;
+		out += code <= C0_END || code >= C1_START && code <= C1_END ? " " : character;
+	}
+	return out;
+}
+/**
+* Strips anything that could forge a second line in a log or a second element
+* in the approval dialog, then truncates.
+*
+* The user agent is attacker-supplied and lands in both `notice()` output and
+* the host's approval prompt, so control characters are the concern rather than
+* length.
+*/
+function sanitizeUserAgent(raw) {
+	if (raw === void 0) return UNKNOWN_DEVICE;
+	const stripped = withoutControlCharacters(raw).replaceAll(/\s+/gu, " ").trim();
+	if (stripped === "") return UNKNOWN_DEVICE;
+	return stripped.slice(0, MAX_USER_AGENT);
+}
+/**
+* The address Cloudflare's edge reported, reduced to a safe display and key value.
+*
+* It never authorizes a request. The tunnel route may use it only for abuse
+* throttling when Cloudflare is the trusted proxy. A local process can forge it,
+* but local processes are outside that public-internet boundary.
+*/
+function sanitizeEdgeIp(raw) {
+	if (raw === void 0) return "unknown";
+	const candidate = raw.split(",")[0]?.trim() ?? "";
+	return /^[0-9a-f:.]{1,45}$/iu.test(candidate) ? candidate : "unknown";
+}
+const DEVICE_HINTS = [
+	{
+		pattern: /iphone/iu,
+		label: "iPhone"
+	},
+	{
+		pattern: /ipad/iu,
+		label: "iPad"
+	},
+	{
+		pattern: /android/iu,
+		label: "Android"
+	},
+	{
+		pattern: /macintosh|mac os x/iu,
+		label: "Mac"
+	},
+	{
+		pattern: /windows/iu,
+		label: "Windows"
+	},
+	{
+		pattern: /linux/iu,
+		label: "Linux"
+	}
+];
+const BROWSER_HINTS = [
+	{
+		pattern: /edg\//iu,
+		label: "Edge"
+	},
+	{
+		pattern: /firefox\//iu,
+		label: "Firefox"
+	},
+	{
+		pattern: /chrome\/|crios\//iu,
+		label: "Chrome"
+	},
+	{
+		pattern: /safari\//iu,
+		label: "Safari"
+	}
+];
+/** A human label for the device list, best effort; the full user agent is shown alongside. */
+function deviceLabelFor(userAgent) {
+	const device = DEVICE_HINTS.find((hint) => hint.pattern.test(userAgent))?.label;
+	const browser = BROWSER_HINTS.find((hint) => hint.pattern.test(userAgent))?.label;
+	if (device !== void 0 && browser !== void 0) return `${device} · ${browser}`;
+	return device ?? browser ?? "paired device";
+}
+//#endregion
+exports.cookieMaxAgeSeconds = cookieMaxAgeSeconds;
+exports.deviceExpiryAt = deviceExpiryAt;
+exports.deviceLabelFor = deviceLabelFor;
+exports.evaluateDevice = evaluateDevice;
+exports.sanitizeEdgeIp = sanitizeEdgeIp;
+exports.sanitizeUserAgent = sanitizeUserAgent;
+exports.touchDevice = touchDevice;
+
+//# sourceMappingURL=index.cjs.map

package/dist/services/deviceSessions/index.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.cjs","names":[],"sources":["../../../src/services/deviceSessions/index.ts"],"sourcesContent":["/**\n * What makes a paired device's session still valid.\n *\n * Expiry is derived from the settings in force at the moment of the check,\n * never stamped onto the record when it was minted. That is what makes the\n * setting honest in both directions: switching expiry on has to invalidate a\n * session that is already idle, and switching it off has to bring it back. A\n * stored `expiresAt` would do neither.\n */\n\nimport type { RemoteAccessSettings } from '../../types/remote';\n\nconst MS_PER_MINUTE = 60_000;\nconst MS_PER_HOUR = 3_600_000;\nconst MS_PER_SECOND = 1000;\n/** Long enough to tell an iPhone from a laptop, short enough not to be a fingerprint in a log. */\nconst MAX_USER_AGENT = 200;\n/** Upper bound of the C0 block, and the bounds of C1. Codepoints rather than a character class:\n * a regex over control characters is unreadable, hard to review, and trips no-control-regex. */\nconst C0_END = 0x1f;\nconst C1_START = 0x7f;\nconst C1_END = 0x9f;\nconst UNKNOWN_DEVICE = 'unknown device';\n\nexport interface DeviceRecord {\n  /** Opaque, safe to display and to name in a revoke call. Never the secret. */\n  id: string;\n  /** SHA-256 of the session token. The token itself is never retained. */\n  tokenHash: string;\n  label: string;\n  userAgent: string;\n  /** Epoch milliseconds. */\n  createdAt: number;\n  /** Epoch milliseconds, bumped on every authenticated request. */\n  lastSeenAt: number;\n}\n\nexport type DeviceRejection = 'unknown' | 'idle' | 'absolute';\n\nexport type DeviceVerdict = { ok: true; record: DeviceRecord } | { ok: false; reason: DeviceRejection };\n\n/** Whether this record still authorizes a request, under the settings in force right now. */\nexport function evaluateDevice(\n  record: DeviceRecord | undefined,\n  now: number,\n  settings: RemoteAccessSettings,\n): DeviceVerdict {\n  if (record === undefined) return { ok: false, reason: 'unknown' };\n  if (!settings.sessionExpiryEnabled) return { ok: true, record };\n  if (now - record.lastSeenAt >= settings.idleMinutes * MS_PER_MINUTE) return { ok: false, reason: 'idle' };\n  if (now - record.createdAt >= settings.absoluteHours * MS_PER_HOUR) return { ok: false, reason: 'absolute' };\n  return { ok: true, record };\n}\n\n/** Exact deadline at which this device stops authorizing, or undefined while expiry is disabled. */\nexport function deviceExpiryAt(record: DeviceRecord, settings: RemoteAccessSettings): number | undefined {\n  if (!settings.sessionExpiryEnabled) return undefined;\n  return Math.min(\n    record.lastSeenAt + settings.idleMinutes * MS_PER_MINUTE,\n    record.createdAt + settings.absoluteHours * MS_PER_HOUR,\n  );\n}\n\nexport function touchDevice(record: DeviceRecord, now: number): DeviceRecord {\n  return { ...record, lastSeenAt: now };\n}\n\n/** How long the cookie should live, so the browser forgets roughly when the server does. */\nexport function cookieMaxAgeSeconds(settings: RemoteAccessSettings, ceilingSeconds: number): number {\n  if (!settings.sessionExpiryEnabled) return ceilingSeconds;\n  return Math.min(ceilingSeconds, Math.round((settings.absoluteHours * MS_PER_HOUR) / MS_PER_SECOND));\n}\n\n/** Replaces every C0 and C1 control character with a space; those are what could forge a log line. */\nfunction withoutControlCharacters(value: string): string {\n  let out = '';\n  for (const character of value) {\n    const code = character.codePointAt(0) ?? 0;\n    out += code <= C0_END || (code >= C1_START && code <= C1_END) ? ' ' : character;\n  }\n  return out;\n}\n\n/**\n * Strips anything that could forge a second line in a log or a second element\n * in the approval dialog, then truncates.\n *\n * The user agent is attacker-supplied and lands in both `notice()` output and\n * the host's approval prompt, so control characters are the concern rather than\n * length.\n */\nexport function sanitizeUserAgent(raw: string | undefined): string {\n  if (raw === undefined) return UNKNOWN_DEVICE;\n  const stripped = withoutControlCharacters(raw).replaceAll(/\\s+/gu, ' ').trim();\n  if (stripped === '') return UNKNOWN_DEVICE;\n  return stripped.slice(0, MAX_USER_AGENT);\n}\n\n/**\n * The address Cloudflare's edge reported, reduced to a safe display and key value.\n *\n * It never authorizes a request. The tunnel route may use it only for abuse\n * throttling when Cloudflare is the trusted proxy. A local process can forge it,\n * but local processes are outside that public-internet boundary.\n */\nexport function sanitizeEdgeIp(raw: string | undefined): string {\n  if (raw === undefined) return 'unknown';\n  const candidate = raw.split(',')[0]?.trim() ?? '';\n  return /^[0-9a-f:.]{1,45}$/iu.test(candidate) ? candidate : 'unknown';\n}\n\nconst DEVICE_HINTS: readonly { pattern: RegExp; label: string }[] = [\n  { pattern: /iphone/iu, label: 'iPhone' },\n  { pattern: /ipad/iu, label: 'iPad' },\n  { pattern: /android/iu, label: 'Android' },\n  { pattern: /macintosh|mac os x/iu, label: 'Mac' },\n  { pattern: /windows/iu, label: 'Windows' },\n  { pattern: /linux/iu, label: 'Linux' },\n];\n\nconst BROWSER_HINTS: readonly { pattern: RegExp; label: string }[] = [\n  // Order matters: every Chromium user agent also says Safari, and Edge says both.\n  { pattern: /edg\\//iu, label: 'Edge' },\n  { pattern: /firefox\\//iu, label: 'Firefox' },\n  { pattern: /chrome\\/|crios\\//iu, label: 'Chrome' },\n  { pattern: /safari\\//iu, label: 'Safari' },\n];\n\n/** A human label for the device list, best effort; the full user agent is shown alongside. */\nexport function deviceLabelFor(userAgent: string): string {\n  const device = DEVICE_HINTS.find((hint) => hint.pattern.test(userAgent))?.label;\n  const browser = BROWSER_HINTS.find((hint) => hint.pattern.test(userAgent))?.label;\n  if (device !== undefined && browser !== undefined) return `${device} · ${browser}`;\n  return device ?? browser ?? 'paired device';\n}\n"],"mappings":";AAYA,MAAM,gBAAgB;AACtB,MAAM,cAAc;AACpB,MAAM,gBAAgB;;AAEtB,MAAM,iBAAiB;;;AAGvB,MAAM,SAAS;AACf,MAAM,WAAW;AACjB,MAAM,SAAS;AACf,MAAM,iBAAiB;;AAoBvB,SAAgB,eACd,QACA,KACA,UACe;CACf,IAAI,WAAW,KAAA,GAAW,OAAO;EAAE,IAAI;EAAO,QAAQ;CAAU;CAChE,IAAI,CAAC,SAAS,sBAAsB,OAAO;EAAE,IAAI;EAAM;CAAO;CAC9D,IAAI,MAAM,OAAO,cAAc,SAAS,cAAc,eAAe,OAAO;EAAE,IAAI;EAAO,QAAQ;CAAO;CACxG,IAAI,MAAM,OAAO,aAAa,SAAS,gBAAgB,aAAa,OAAO;EAAE,IAAI;EAAO,QAAQ;CAAW;CAC3G,OAAO;EAAE,IAAI;EAAM;CAAO;AAC5B;;AAGA,SAAgB,eAAe,QAAsB,UAAoD;CACvG,IAAI,CAAC,SAAS,sBAAsB,OAAO,KAAA;CAC3C,OAAO,KAAK,IACV,OAAO,aAAa,SAAS,cAAc,eAC3C,OAAO,YAAY,SAAS,gBAAgB,WAC9C;AACF;AAEA,SAAgB,YAAY,QAAsB,KAA2B;CAC3E,OAAO;EAAE,GAAG;EAAQ,YAAY;CAAI;AACtC;;AAGA,SAAgB,oBAAoB,UAAgC,gBAAgC;CAClG,IAAI,CAAC,SAAS,sBAAsB,OAAO;CAC3C,OAAO,KAAK,IAAI,gBAAgB,KAAK,MAAO,SAAS,gBAAgB,cAAe,aAAa,CAAC;AACpG;;AAGA,SAAS,yBAAyB,OAAuB;CACvD,IAAI,MAAM;CACV,KAAK,MAAM,aAAa,OAAO;EAC7B,MAAM,OAAO,UAAU,YAAY,CAAC,KAAK;EACzC,OAAO,QAAQ,UAAW,QAAQ,YAAY,QAAQ,SAAU,MAAM;CACxE;CACA,OAAO;AACT;;;;;;;;;AAUA,SAAgB,kBAAkB,KAAiC;CACjE,IAAI,QAAQ,KAAA,GAAW,OAAO;CAC9B,MAAM,WAAW,yBAAyB,GAAG,CAAC,CAAC,WAAW,SAAS,GAAG,CAAC,CAAC,KAAK;CAC7E,IAAI,aAAa,IAAI,OAAO;CAC5B,OAAO,SAAS,MAAM,GAAG,cAAc;AACzC;;;;;;;;AASA,SAAgB,eAAe,KAAiC;CAC9D,IAAI,QAAQ,KAAA,GAAW,OAAO;CAC9B,MAAM,YAAY,IAAI,MAAM,GAAG,CAAC,CAAC,EAAE,EAAE,KAAK,KAAK;CAC/C,OAAO,uBAAuB,KAAK,SAAS,IAAI,YAAY;AAC9D;AAEA,MAAM,eAA8D;CAClE;EAAE,SAAS;EAAY,OAAO;CAAS;CACvC;EAAE,SAAS;EAAU,OAAO;CAAO;CACnC;EAAE,SAAS;EAAa,OAAO;CAAU;CACzC;EAAE,SAAS;EAAwB,OAAO;CAAM;CAChD;EAAE,SAAS;EAAa,OAAO;CAAU;CACzC;EAAE,SAAS;EAAW,OAAO;CAAQ;AACvC;AAEA,MAAM,gBAA+D;CAEnE;EAAE,SAAS;EAAW,OAAO;CAAO;CACpC;EAAE,SAAS;EAAe,OAAO;CAAU;CAC3C;EAAE,SAAS;EAAsB,OAAO;CAAS;CACjD;EAAE,SAAS;EAAc,OAAO;CAAS;AAC3C;;AAGA,SAAgB,eAAe,WAA2B;CACxD,MAAM,SAAS,aAAa,MAAM,SAAS,KAAK,QAAQ,KAAK,SAAS,CAAC,CAAC,EAAE;CAC1E,MAAM,UAAU,cAAc,MAAM,SAAS,KAAK,QAAQ,KAAK,SAAS,CAAC,CAAC,EAAE;CAC5E,IAAI,WAAW,KAAA,KAAa,YAAY,KAAA,GAAW,OAAO,GAAG,OAAO,KAAK;CACzE,OAAO,UAAU,WAAW;AAC9B"}

package/dist/services/deviceSessions/index.d.cts

@@ -0,0 +1,15 @@
+//#region src/services/deviceSessions/index.d.ts
+export interface DeviceRecord {
+  /** Opaque, safe to display and to name in a revoke call. Never the secret. */
+  id: string;
+  /** SHA-256 of the session token. The token itself is never retained. */
+  tokenHash: string;
+  label: string;
+  userAgent: string;
+  /** Epoch milliseconds. */
+  createdAt: number;
+  /** Epoch milliseconds, bumped on every authenticated request. */
+  lastSeenAt: number;
+}
+//#endregion
+//# sourceMappingURL=index.d.cts.map

package/dist/services/deviceSessions/index.d.cts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.cts","names":[],"sources":["../../../src/services/deviceSessions/index.ts"],"mappings":";iBAwBiB;;EAEf;;EAEA;EACA;EACA;;EAEA;;EAEA"}

package/dist/services/deviceSessions/index.d.mts

@@ -0,0 +1,15 @@
+//#region src/services/deviceSessions/index.d.ts
+export interface DeviceRecord {
+  /** Opaque, safe to display and to name in a revoke call. Never the secret. */
+  id: string;
+  /** SHA-256 of the session token. The token itself is never retained. */
+  tokenHash: string;
+  label: string;
+  userAgent: string;
+  /** Epoch milliseconds. */
+  createdAt: number;
+  /** Epoch milliseconds, bumped on every authenticated request. */
+  lastSeenAt: number;
+}
+//#endregion
+//# sourceMappingURL=index.d.mts.map

package/dist/services/deviceSessions/index.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.mts","names":[],"sources":["../../../src/services/deviceSessions/index.ts"],"mappings":";iBAwBiB;;EAEf;;EAEA;EACA;EACA;;EAEA;;EAEA"}

package/dist/services/deviceSessions/index.mjs

@@ -0,0 +1,141 @@
+//#region src/services/deviceSessions/index.ts
+const MS_PER_MINUTE = 6e4;
+const MS_PER_HOUR = 36e5;
+const MS_PER_SECOND = 1e3;
+/** Long enough to tell an iPhone from a laptop, short enough not to be a fingerprint in a log. */
+const MAX_USER_AGENT = 200;
+/** Upper bound of the C0 block, and the bounds of C1. Codepoints rather than a character class:
+* a regex over control characters is unreadable, hard to review, and trips no-control-regex. */
+const C0_END = 31;
+const C1_START = 127;
+const C1_END = 159;
+const UNKNOWN_DEVICE = "unknown device";
+/** Whether this record still authorizes a request, under the settings in force right now. */
+function evaluateDevice(record, now, settings) {
+	if (record === void 0) return {
+		ok: false,
+		reason: "unknown"
+	};
+	if (!settings.sessionExpiryEnabled) return {
+		ok: true,
+		record
+	};
+	if (now - record.lastSeenAt >= settings.idleMinutes * MS_PER_MINUTE) return {
+		ok: false,
+		reason: "idle"
+	};
+	if (now - record.createdAt >= settings.absoluteHours * MS_PER_HOUR) return {
+		ok: false,
+		reason: "absolute"
+	};
+	return {
+		ok: true,
+		record
+	};
+}
+/** Exact deadline at which this device stops authorizing, or undefined while expiry is disabled. */
+function deviceExpiryAt(record, settings) {
+	if (!settings.sessionExpiryEnabled) return void 0;
+	return Math.min(record.lastSeenAt + settings.idleMinutes * MS_PER_MINUTE, record.createdAt + settings.absoluteHours * MS_PER_HOUR);
+}
+function touchDevice(record, now) {
+	return {
+		...record,
+		lastSeenAt: now
+	};
+}
+/** How long the cookie should live, so the browser forgets roughly when the server does. */
+function cookieMaxAgeSeconds(settings, ceilingSeconds) {
+	if (!settings.sessionExpiryEnabled) return ceilingSeconds;
+	return Math.min(ceilingSeconds, Math.round(settings.absoluteHours * MS_PER_HOUR / MS_PER_SECOND));
+}
+/** Replaces every C0 and C1 control character with a space; those are what could forge a log line. */
+function withoutControlCharacters(value) {
+	let out = "";
+	for (const character of value) {
+		const code = character.codePointAt(0) ?? 0;
+		out += code <= C0_END || code >= C1_START && code <= C1_END ? " " : character;
+	}
+	return out;
+}
+/**
+* Strips anything that could forge a second line in a log or a second element
+* in the approval dialog, then truncates.
+*
+* The user agent is attacker-supplied and lands in both `notice()` output and
+* the host's approval prompt, so control characters are the concern rather than
+* length.
+*/
+function sanitizeUserAgent(raw) {
+	if (raw === void 0) return UNKNOWN_DEVICE;
+	const stripped = withoutControlCharacters(raw).replaceAll(/\s+/gu, " ").trim();
+	if (stripped === "") return UNKNOWN_DEVICE;
+	return stripped.slice(0, MAX_USER_AGENT);
+}
+/**
+* The address Cloudflare's edge reported, reduced to a safe display and key value.
+*
+* It never authorizes a request. The tunnel route may use it only for abuse
+* throttling when Cloudflare is the trusted proxy. A local process can forge it,
+* but local processes are outside that public-internet boundary.
+*/
+function sanitizeEdgeIp(raw) {
+	if (raw === void 0) return "unknown";
+	const candidate = raw.split(",")[0]?.trim() ?? "";
+	return /^[0-9a-f:.]{1,45}$/iu.test(candidate) ? candidate : "unknown";
+}
+const DEVICE_HINTS = [
+	{
+		pattern: /iphone/iu,
+		label: "iPhone"
+	},
+	{
+		pattern: /ipad/iu,
+		label: "iPad"
+	},
+	{
+		pattern: /android/iu,
+		label: "Android"
+	},
+	{
+		pattern: /macintosh|mac os x/iu,
+		label: "Mac"
+	},
+	{
+		pattern: /windows/iu,
+		label: "Windows"
+	},
+	{
+		pattern: /linux/iu,
+		label: "Linux"
+	}
+];
+const BROWSER_HINTS = [
+	{
+		pattern: /edg\//iu,
+		label: "Edge"
+	},
+	{
+		pattern: /firefox\//iu,
+		label: "Firefox"
+	},
+	{
+		pattern: /chrome\/|crios\//iu,
+		label: "Chrome"
+	},
+	{
+		pattern: /safari\//iu,
+		label: "Safari"
+	}
+];
+/** A human label for the device list, best effort; the full user agent is shown alongside. */
+function deviceLabelFor(userAgent) {
+	const device = DEVICE_HINTS.find((hint) => hint.pattern.test(userAgent))?.label;
+	const browser = BROWSER_HINTS.find((hint) => hint.pattern.test(userAgent))?.label;
+	if (device !== void 0 && browser !== void 0) return `${device} · ${browser}`;
+	return device ?? browser ?? "paired device";
+}
+//#endregion
+export { cookieMaxAgeSeconds, deviceExpiryAt, deviceLabelFor, evaluateDevice, sanitizeEdgeIp, sanitizeUserAgent, touchDevice };
+
+//# sourceMappingURL=index.mjs.map

package/dist/services/deviceSessions/index.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.mjs","names":[],"sources":["../../../src/services/deviceSessions/index.ts"],"sourcesContent":["/**\n * What makes a paired device's session still valid.\n *\n * Expiry is derived from the settings in force at the moment of the check,\n * never stamped onto the record when it was minted. That is what makes the\n * setting honest in both directions: switching expiry on has to invalidate a\n * session that is already idle, and switching it off has to bring it back. A\n * stored `expiresAt` would do neither.\n */\n\nimport type { RemoteAccessSettings } from '../../types/remote';\n\nconst MS_PER_MINUTE = 60_000;\nconst MS_PER_HOUR = 3_600_000;\nconst MS_PER_SECOND = 1000;\n/** Long enough to tell an iPhone from a laptop, short enough not to be a fingerprint in a log. */\nconst MAX_USER_AGENT = 200;\n/** Upper bound of the C0 block, and the bounds of C1. Codepoints rather than a character class:\n * a regex over control characters is unreadable, hard to review, and trips no-control-regex. */\nconst C0_END = 0x1f;\nconst C1_START = 0x7f;\nconst C1_END = 0x9f;\nconst UNKNOWN_DEVICE = 'unknown device';\n\nexport interface DeviceRecord {\n  /** Opaque, safe to display and to name in a revoke call. Never the secret. */\n  id: string;\n  /** SHA-256 of the session token. The token itself is never retained. */\n  tokenHash: string;\n  label: string;\n  userAgent: string;\n  /** Epoch milliseconds. */\n  createdAt: number;\n  /** Epoch milliseconds, bumped on every authenticated request. */\n  lastSeenAt: number;\n}\n\nexport type DeviceRejection = 'unknown' | 'idle' | 'absolute';\n\nexport type DeviceVerdict = { ok: true; record: DeviceRecord } | { ok: false; reason: DeviceRejection };\n\n/** Whether this record still authorizes a request, under the settings in force right now. */\nexport function evaluateDevice(\n  record: DeviceRecord | undefined,\n  now: number,\n  settings: RemoteAccessSettings,\n): DeviceVerdict {\n  if (record === undefined) return { ok: false, reason: 'unknown' };\n  if (!settings.sessionExpiryEnabled) return { ok: true, record };\n  if (now - record.lastSeenAt >= settings.idleMinutes * MS_PER_MINUTE) return { ok: false, reason: 'idle' };\n  if (now - record.createdAt >= settings.absoluteHours * MS_PER_HOUR) return { ok: false, reason: 'absolute' };\n  return { ok: true, record };\n}\n\n/** Exact deadline at which this device stops authorizing, or undefined while expiry is disabled. */\nexport function deviceExpiryAt(record: DeviceRecord, settings: RemoteAccessSettings): number | undefined {\n  if (!settings.sessionExpiryEnabled) return undefined;\n  return Math.min(\n    record.lastSeenAt + settings.idleMinutes * MS_PER_MINUTE,\n    record.createdAt + settings.absoluteHours * MS_PER_HOUR,\n  );\n}\n\nexport function touchDevice(record: DeviceRecord, now: number): DeviceRecord {\n  return { ...record, lastSeenAt: now };\n}\n\n/** How long the cookie should live, so the browser forgets roughly when the server does. */\nexport function cookieMaxAgeSeconds(settings: RemoteAccessSettings, ceilingSeconds: number): number {\n  if (!settings.sessionExpiryEnabled) return ceilingSeconds;\n  return Math.min(ceilingSeconds, Math.round((settings.absoluteHours * MS_PER_HOUR) / MS_PER_SECOND));\n}\n\n/** Replaces every C0 and C1 control character with a space; those are what could forge a log line. */\nfunction withoutControlCharacters(value: string): string {\n  let out = '';\n  for (const character of value) {\n    const code = character.codePointAt(0) ?? 0;\n    out += code <= C0_END || (code >= C1_START && code <= C1_END) ? ' ' : character;\n  }\n  return out;\n}\n\n/**\n * Strips anything that could forge a second line in a log or a second element\n * in the approval dialog, then truncates.\n *\n * The user agent is attacker-supplied and lands in both `notice()` output and\n * the host's approval prompt, so control characters are the concern rather than\n * length.\n */\nexport function sanitizeUserAgent(raw: string | undefined): string {\n  if (raw === undefined) return UNKNOWN_DEVICE;\n  const stripped = withoutControlCharacters(raw).replaceAll(/\\s+/gu, ' ').trim();\n  if (stripped === '') return UNKNOWN_DEVICE;\n  return stripped.slice(0, MAX_USER_AGENT);\n}\n\n/**\n * The address Cloudflare's edge reported, reduced to a safe display and key value.\n *\n * It never authorizes a request. The tunnel route may use it only for abuse\n * throttling when Cloudflare is the trusted proxy. A local process can forge it,\n * but local processes are outside that public-internet boundary.\n */\nexport function sanitizeEdgeIp(raw: string | undefined): string {\n  if (raw === undefined) return 'unknown';\n  const candidate = raw.split(',')[0]?.trim() ?? '';\n  return /^[0-9a-f:.]{1,45}$/iu.test(candidate) ? candidate : 'unknown';\n}\n\nconst DEVICE_HINTS: readonly { pattern: RegExp; label: string }[] = [\n  { pattern: /iphone/iu, label: 'iPhone' },\n  { pattern: /ipad/iu, label: 'iPad' },\n  { pattern: /android/iu, label: 'Android' },\n  { pattern: /macintosh|mac os x/iu, label: 'Mac' },\n  { pattern: /windows/iu, label: 'Windows' },\n  { pattern: /linux/iu, label: 'Linux' },\n];\n\nconst BROWSER_HINTS: readonly { pattern: RegExp; label: string }[] = [\n  // Order matters: every Chromium user agent also says Safari, and Edge says both.\n  { pattern: /edg\\//iu, label: 'Edge' },\n  { pattern: /firefox\\//iu, label: 'Firefox' },\n  { pattern: /chrome\\/|crios\\//iu, label: 'Chrome' },\n  { pattern: /safari\\//iu, label: 'Safari' },\n];\n\n/** A human label for the device list, best effort; the full user agent is shown alongside. */\nexport function deviceLabelFor(userAgent: string): string {\n  const device = DEVICE_HINTS.find((hint) => hint.pattern.test(userAgent))?.label;\n  const browser = BROWSER_HINTS.find((hint) => hint.pattern.test(userAgent))?.label;\n  if (device !== undefined && browser !== undefined) return `${device} · ${browser}`;\n  return device ?? browser ?? 'paired device';\n}\n"],"mappings":";AAYA,MAAM,gBAAgB;AACtB,MAAM,cAAc;AACpB,MAAM,gBAAgB;;AAEtB,MAAM,iBAAiB;;;AAGvB,MAAM,SAAS;AACf,MAAM,WAAW;AACjB,MAAM,SAAS;AACf,MAAM,iBAAiB;;AAoBvB,SAAgB,eACd,QACA,KACA,UACe;CACf,IAAI,WAAW,KAAA,GAAW,OAAO;EAAE,IAAI;EAAO,QAAQ;CAAU;CAChE,IAAI,CAAC,SAAS,sBAAsB,OAAO;EAAE,IAAI;EAAM;CAAO;CAC9D,IAAI,MAAM,OAAO,cAAc,SAAS,cAAc,eAAe,OAAO;EAAE,IAAI;EAAO,QAAQ;CAAO;CACxG,IAAI,MAAM,OAAO,aAAa,SAAS,gBAAgB,aAAa,OAAO;EAAE,IAAI;EAAO,QAAQ;CAAW;CAC3G,OAAO;EAAE,IAAI;EAAM;CAAO;AAC5B;;AAGA,SAAgB,eAAe,QAAsB,UAAoD;CACvG,IAAI,CAAC,SAAS,sBAAsB,OAAO,KAAA;CAC3C,OAAO,KAAK,IACV,OAAO,aAAa,SAAS,cAAc,eAC3C,OAAO,YAAY,SAAS,gBAAgB,WAC9C;AACF;AAEA,SAAgB,YAAY,QAAsB,KAA2B;CAC3E,OAAO;EAAE,GAAG;EAAQ,YAAY;CAAI;AACtC;;AAGA,SAAgB,oBAAoB,UAAgC,gBAAgC;CAClG,IAAI,CAAC,SAAS,sBAAsB,OAAO;CAC3C,OAAO,KAAK,IAAI,gBAAgB,KAAK,MAAO,SAAS,gBAAgB,cAAe,aAAa,CAAC;AACpG;;AAGA,SAAS,yBAAyB,OAAuB;CACvD,IAAI,MAAM;CACV,KAAK,MAAM,aAAa,OAAO;EAC7B,MAAM,OAAO,UAAU,YAAY,CAAC,KAAK;EACzC,OAAO,QAAQ,UAAW,QAAQ,YAAY,QAAQ,SAAU,MAAM;CACxE;CACA,OAAO;AACT;;;;;;;;;AAUA,SAAgB,kBAAkB,KAAiC;CACjE,IAAI,QAAQ,KAAA,GAAW,OAAO;CAC9B,MAAM,WAAW,yBAAyB,GAAG,CAAC,CAAC,WAAW,SAAS,GAAG,CAAC,CAAC,KAAK;CAC7E,IAAI,aAAa,IAAI,OAAO;CAC5B,OAAO,SAAS,MAAM,GAAG,cAAc;AACzC;;;;;;;;AASA,SAAgB,eAAe,KAAiC;CAC9D,IAAI,QAAQ,KAAA,GAAW,OAAO;CAC9B,MAAM,YAAY,IAAI,MAAM,GAAG,CAAC,CAAC,EAAE,EAAE,KAAK,KAAK;CAC/C,OAAO,uBAAuB,KAAK,SAAS,IAAI,YAAY;AAC9D;AAEA,MAAM,eAA8D;CAClE;EAAE,SAAS;EAAY,OAAO;CAAS;CACvC;EAAE,SAAS;EAAU,OAAO;CAAO;CACnC;EAAE,SAAS;EAAa,OAAO;CAAU;CACzC;EAAE,SAAS;EAAwB,OAAO;CAAM;CAChD;EAAE,SAAS;EAAa,OAAO;CAAU;CACzC;EAAE,SAAS;EAAW,OAAO;CAAQ;AACvC;AAEA,MAAM,gBAA+D;CAEnE;EAAE,SAAS;EAAW,OAAO;CAAO;CACpC;EAAE,SAAS;EAAe,OAAO;CAAU;CAC3C;EAAE,SAAS;EAAsB,OAAO;CAAS;CACjD;EAAE,SAAS;EAAc,OAAO;CAAS;AAC3C;;AAGA,SAAgB,eAAe,WAA2B;CACxD,MAAM,SAAS,aAAa,MAAM,SAAS,KAAK,QAAQ,KAAK,SAAS,CAAC,CAAC,EAAE;CAC1E,MAAM,UAAU,cAAc,MAAM,SAAS,KAAK,QAAQ,KAAK,SAAS,CAAC,CAAC,EAAE;CAC5E,IAAI,WAAW,KAAA,KAAa,YAAY,KAAA,GAAW,OAAO,GAAG,OAAO,KAAK;CACzE,OAAO,UAAU,WAAW;AAC9B"}

package/dist/services/headlessClient/index.cjs

@@ -0,0 +1,117 @@
+const require_notification = require("../../schemas/notification.cjs");
+require("../../notification.cjs");
+let node_crypto = require("node:crypto");
+//#region src/services/headlessClient/index.ts
+/** Explicit client interactions over the existing browser dialog protocol. */
+function createHeadlessClient(options) {
+	const pending = /* @__PURE__ */ new Map();
+	let disposed = false;
+	const advance = () => pending.values().next().value?.start();
+	return {
+		client: {
+			async notify(request) {
+				if (disposed) throw new Error("Headless client is closed");
+				const data = require_notification.createDoomNotificationEntryData(request);
+				if (!data) throw new Error("Invalid notification request");
+				await options.appendCustomEntry(require_notification.DOOM_NOTIFICATION_ENTRY_TYPE, data);
+			},
+			setStatus(source, text) {
+				if (disposed) throw new Error("Headless client is closed");
+				options.emitFrame({
+					type: "extension_ui_request",
+					method: "setStatus",
+					statusKey: source,
+					statusText: text
+				});
+			},
+			appendComposerText(text) {
+				if (disposed) throw new Error("Headless client is closed");
+				options.emitFrame({
+					type: "extension_ui_request",
+					method: "append_composer_text",
+					id: (0, node_crypto.randomUUID)(),
+					text
+				});
+			},
+			request(request, signal) {
+				if (disposed) return Promise.reject(/* @__PURE__ */ new Error("Headless client is closed"));
+				if (signal?.aborted) return Promise.resolve(void 0);
+				if (![
+					"confirm",
+					"select",
+					"input"
+				].includes(request.kind)) return Promise.reject(/* @__PURE__ */ new Error("Unsupported headless client request"));
+				const labels = request.options?.map((option) => option.label);
+				if (labels && new Set(labels).size !== labels.length) return Promise.reject(/* @__PURE__ */ new Error("Select option labels must be unique"));
+				const id = `headless-ui:${(0, node_crypto.randomUUID)()}`;
+				return new Promise((resolve, reject) => {
+					let started = false;
+					const finish = (outcome) => {
+						if (!pending.delete(id)) return;
+						signal?.removeEventListener("abort", abort);
+						try {
+							if (started) options.emitFrame({
+								type: "extension_ui_answered",
+								id
+							});
+							if ("error" in outcome) reject(outcome.error);
+							else resolve(outcome.value);
+						} catch (error) {
+							reject(error);
+						} finally {
+							advance();
+						}
+					};
+					const abort = () => finish({ value: void 0 });
+					pending.set(id, {
+						start() {
+							if (started || disposed) return;
+							started = true;
+							try {
+								options.emitFrame({
+									type: "extension_ui_request",
+									id,
+									method: request.kind === "input" && request.multiline ? "editor" : request.kind,
+									title: request.title,
+									message: request.message,
+									options: labels,
+									placeholder: request.message,
+									prefill: request.initialValue
+								});
+							} catch (error) {
+								finish({ error });
+							}
+						},
+						respond(frame) {
+							if (!started) return;
+							if (frame.cancelled === true) return finish({ value: void 0 });
+							if (request.kind === "confirm") {
+								if (typeof frame.confirmed === "boolean") finish({ value: frame.confirmed });
+							} else if (typeof frame.value === "string") {
+								const selected = request.options?.find((option) => option.label === frame.value);
+								finish({ value: selected?.value ?? frame.value });
+							}
+						},
+						close: () => finish({ error: /* @__PURE__ */ new Error("Headless client is closed") })
+					});
+					signal?.addEventListener("abort", abort, { once: true });
+					advance();
+				});
+			}
+		},
+		receive(frame) {
+			if (frame.type !== "extension_ui_response") return false;
+			if (typeof frame.id === "string") pending.get(frame.id)?.respond(frame);
+			return true;
+		},
+		dispose() {
+			if (disposed) return;
+			disposed = true;
+			for (const request of pending.values()) request.close();
+		}
+	};
+}
+//#endregion
+exports.createHeadlessClient = createHeadlessClient;
+
+//# sourceMappingURL=index.cjs.map

package/dist/services/headlessClient/index.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.cjs","names":["createDoomNotificationEntryData","DOOM_NOTIFICATION_ENTRY_TYPE","randomUUID"],"sources":["../../../src/services/headlessClient/index.ts"],"sourcesContent":["import { randomUUID } from 'node:crypto';\n\nimport { createDoomNotificationEntryData, DOOM_NOTIFICATION_ENTRY_TYPE } from '../../exports/notification';\nimport type {\n  HeadlessClientBridge,\n  HeadlessClientOptions,\n  PendingClientRequest,\n} from '../../types/server/headlessClient';\n\n/** Explicit client interactions over the existing browser dialog protocol. */\nexport function createHeadlessClient(options: HeadlessClientOptions): HeadlessClientBridge {\n  const pending = new Map<string, PendingClientRequest>();\n  let disposed = false;\n  const advance = (): void => pending.values().next().value?.start();\n\n  return {\n    client: {\n      async notify(request) {\n        if (disposed) throw new Error('Headless client is closed');\n        const data = createDoomNotificationEntryData(request);\n        if (!data) throw new Error('Invalid notification request');\n        await options.appendCustomEntry(DOOM_NOTIFICATION_ENTRY_TYPE, data);\n      },\n      setStatus(source, text) {\n        if (disposed) throw new Error('Headless client is closed');\n        options.emitFrame({ type: 'extension_ui_request', method: 'setStatus', statusKey: source, statusText: text });\n      },\n      appendComposerText(text) {\n        if (disposed) throw new Error('Headless client is closed');\n        options.emitFrame({ type: 'extension_ui_request', method: 'append_composer_text', id: randomUUID(), text });\n      },\n      request(request, signal) {\n        if (disposed) return Promise.reject(new Error('Headless client is closed'));\n        if (signal?.aborted) return Promise.resolve(undefined);\n        if (!['confirm', 'select', 'input'].includes(request.kind)) {\n          return Promise.reject(new Error('Unsupported headless client request'));\n        }\n        const labels = request.options?.map((option) => option.label);\n        if (labels && new Set(labels).size !== labels.length) {\n          return Promise.reject(new Error('Select option labels must be unique'));\n        }\n        const id = `headless-ui:${randomUUID()}`;\n        return new Promise((resolve, reject) => {\n          let started = false;\n          const finish = (outcome: { value: unknown } | { error: unknown }): void => {\n            if (!pending.delete(id)) return;\n            signal?.removeEventListener('abort', abort);\n            try {\n              if (started) options.emitFrame({ type: 'extension_ui_answered', id });\n              if ('error' in outcome) reject(outcome.error);\n              else resolve(outcome.value);\n            } catch (error) {\n              reject(error);\n            } finally {\n              advance();\n            }\n          };\n          const abort = (): void => finish({ value: undefined });\n          pending.set(id, {\n            start() {\n              if (started || disposed) return;\n              started = true;\n              try {\n                options.emitFrame({\n                  type: 'extension_ui_request',\n                  id,\n                  method: request.kind === 'input' && request.multiline ? 'editor' : request.kind,\n                  title: request.title,\n                  message: request.message,\n                  options: labels,\n                  placeholder: request.message,\n                  prefill: request.initialValue,\n                });\n              } catch (error) {\n                finish({ error });\n              }\n            },\n            respond(frame) {\n              if (!started) return;\n              if (frame.cancelled === true) return finish({ value: undefined });\n              if (request.kind === 'confirm') {\n                if (typeof frame.confirmed === 'boolean') finish({ value: frame.confirmed });\n              } else if (typeof frame.value === 'string') {\n                // Rich questionnaire clients return an encoded whole-answer envelope here.\n                const selected = request.options?.find((option) => option.label === frame.value);\n                finish({ value: selected?.value ?? frame.value });\n              }\n            },\n            close: () => finish({ error: new Error('Headless client is closed') }),\n          });\n          signal?.addEventListener('abort', abort, { once: true });\n          advance();\n        });\n      },\n    },\n    receive(frame) {\n      if (frame.type !== 'extension_ui_response') return false;\n      if (typeof frame.id === 'string') pending.get(frame.id)?.respond(frame);\n      return true;\n    },\n    dispose() {\n      if (disposed) return;\n      disposed = true;\n      for (const request of pending.values()) request.close();\n    },\n  };\n}\n"],"mappings":";;;;;AAUA,SAAgB,qBAAqB,SAAsD;CACzF,MAAM,0BAAU,IAAI,IAAkC;CACtD,IAAI,WAAW;CACf,MAAM,gBAAsB,QAAQ,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,OAAO,MAAM;CAEjE,OAAO;EACL,QAAQ;GACN,MAAM,OAAO,SAAS;IACpB,IAAI,UAAU,MAAM,IAAI,MAAM,2BAA2B;IACzD,MAAM,OAAOA,qBAAAA,gCAAgC,OAAO;IACpD,IAAI,CAAC,MAAM,MAAM,IAAI,MAAM,8BAA8B;IACzD,MAAM,QAAQ,kBAAkBC,qBAAAA,8BAA8B,IAAI;GACpE;GACA,UAAU,QAAQ,MAAM;IACtB,IAAI,UAAU,MAAM,IAAI,MAAM,2BAA2B;IACzD,QAAQ,UAAU;KAAE,MAAM;KAAwB,QAAQ;KAAa,WAAW;KAAQ,YAAY;IAAK,CAAC;GAC9G;GACA,mBAAmB,MAAM;IACvB,IAAI,UAAU,MAAM,IAAI,MAAM,2BAA2B;IACzD,QAAQ,UAAU;KAAE,MAAM;KAAwB,QAAQ;KAAwB,KAAA,GAAIC,YAAAA,WAAAA,CAAW;KAAG;IAAK,CAAC;GAC5G;GACA,QAAQ,SAAS,QAAQ;IACvB,IAAI,UAAU,OAAO,QAAQ,uBAAO,IAAI,MAAM,2BAA2B,CAAC;IAC1E,IAAI,QAAQ,SAAS,OAAO,QAAQ,QAAQ,KAAA,CAAS;IACrD,IAAI,CAAC;KAAC;KAAW;KAAU;IAAO,CAAC,CAAC,SAAS,QAAQ,IAAI,GACvD,OAAO,QAAQ,uBAAO,IAAI,MAAM,qCAAqC,CAAC;IAExE,MAAM,SAAS,QAAQ,SAAS,KAAK,WAAW,OAAO,KAAK;IAC5D,IAAI,UAAU,IAAI,IAAI,MAAM,CAAC,CAAC,SAAS,OAAO,QAC5C,OAAO,QAAQ,uBAAO,IAAI,MAAM,qCAAqC,CAAC;IAExE,MAAM,KAAK,gBAAA,GAAeA,YAAAA,WAAAA,CAAW;IACrC,OAAO,IAAI,SAAS,SAAS,WAAW;KACtC,IAAI,UAAU;KACd,MAAM,UAAU,YAA2D;MACzE,IAAI,CAAC,QAAQ,OAAO,EAAE,GAAG;MACzB,QAAQ,oBAAoB,SAAS,KAAK;MAC1C,IAAI;OACF,IAAI,SAAS,QAAQ,UAAU;QAAE,MAAM;QAAyB;OAAG,CAAC;OACpE,IAAI,WAAW,SAAS,OAAO,QAAQ,KAAK;YACvC,QAAQ,QAAQ,KAAK;MAC5B,SAAS,OAAO;OACd,OAAO,KAAK;MACd,UAAU;OACR,QAAQ;MACV;KACF;KACA,MAAM,cAAoB,OAAO,EAAE,OAAO,KAAA,EAAU,CAAC;KACrD,QAAQ,IAAI,IAAI;MACd,QAAQ;OACN,IAAI,WAAW,UAAU;OACzB,UAAU;OACV,IAAI;QACF,QAAQ,UAAU;SAChB,MAAM;SACN;SACA,QAAQ,QAAQ,SAAS,WAAW,QAAQ,YAAY,WAAW,QAAQ;SAC3E,OAAO,QAAQ;SACf,SAAS,QAAQ;SACjB,SAAS;SACT,aAAa,QAAQ;SACrB,SAAS,QAAQ;QACnB,CAAC;OACH,SAAS,OAAO;QACd,OAAO,EAAE,MAAM,CAAC;OAClB;MACF;MACA,QAAQ,OAAO;OACb,IAAI,CAAC,SAAS;OACd,IAAI,MAAM,cAAc,MAAM,OAAO,OAAO,EAAE,OAAO,KAAA,EAAU,CAAC;OAChE,IAAI,QAAQ,SAAS,WACf;YAAA,OAAO,MAAM,cAAc,WAAW,OAAO,EAAE,OAAO,MAAM,UAAU,CAAC;OAAA,OACtE,IAAI,OAAO,MAAM,UAAU,UAAU;QAE1C,MAAM,WAAW,QAAQ,SAAS,MAAM,WAAW,OAAO,UAAU,MAAM,KAAK;QAC/E,OAAO,EAAE,OAAO,UAAU,SAAS,MAAM,MAAM,CAAC;OAClD;MACF;MACA,aAAa,OAAO,EAAE,uBAAO,IAAI,MAAM,2BAA2B,EAAE,CAAC;KACvE,CAAC;KACD,QAAQ,iBAAiB,SAAS,OAAO,EAAE,MAAM,KAAK,CAAC;KACvD,QAAQ;IACV,CAAC;GACH;EACF;EACA,QAAQ,OAAO;GACb,IAAI,MAAM,SAAS,yBAAyB,OAAO;GACnD,IAAI,OAAO,MAAM,OAAO,UAAU,QAAQ,IAAI,MAAM,EAAE,CAAC,EAAE,QAAQ,KAAK;GACtE,OAAO;EACT;EACA,UAAU;GACR,IAAI,UAAU;GACd,WAAW;GACX,KAAK,MAAM,WAAW,QAAQ,OAAO,GAAG,QAAQ,MAAM;EACxD;CACF;AACF"}

package/dist/services/headlessClient/index.mjs

@@ -0,0 +1,117 @@
+import { DOOM_NOTIFICATION_ENTRY_TYPE, createDoomNotificationEntryData } from "../../schemas/notification.mjs";
+import "../../notification.mjs";
+import { randomUUID } from "node:crypto";
+//#region src/services/headlessClient/index.ts
+/** Explicit client interactions over the existing browser dialog protocol. */
+function createHeadlessClient(options) {
+	const pending = /* @__PURE__ */ new Map();
+	let disposed = false;
+	const advance = () => pending.values().next().value?.start();
+	return {
+		client: {
+			async notify(request) {
+				if (disposed) throw new Error("Headless client is closed");
+				const data = createDoomNotificationEntryData(request);
+				if (!data) throw new Error("Invalid notification request");
+				await options.appendCustomEntry(DOOM_NOTIFICATION_ENTRY_TYPE, data);
+			},
+			setStatus(source, text) {
+				if (disposed) throw new Error("Headless client is closed");
+				options.emitFrame({
+					type: "extension_ui_request",
+					method: "setStatus",
+					statusKey: source,
+					statusText: text
+				});
+			},
+			appendComposerText(text) {
+				if (disposed) throw new Error("Headless client is closed");
+				options.emitFrame({
+					type: "extension_ui_request",
+					method: "append_composer_text",
+					id: randomUUID(),
+					text
+				});
+			},
+			request(request, signal) {
+				if (disposed) return Promise.reject(/* @__PURE__ */ new Error("Headless client is closed"));
+				if (signal?.aborted) return Promise.resolve(void 0);
+				if (![
+					"confirm",
+					"select",
+					"input"
+				].includes(request.kind)) return Promise.reject(/* @__PURE__ */ new Error("Unsupported headless client request"));
+				const labels = request.options?.map((option) => option.label);
+				if (labels && new Set(labels).size !== labels.length) return Promise.reject(/* @__PURE__ */ new Error("Select option labels must be unique"));
+				const id = `headless-ui:${randomUUID()}`;
+				return new Promise((resolve, reject) => {
+					let started = false;
+					const finish = (outcome) => {
+						if (!pending.delete(id)) return;
+						signal?.removeEventListener("abort", abort);
+						try {
+							if (started) options.emitFrame({
+								type: "extension_ui_answered",
+								id
+							});
+							if ("error" in outcome) reject(outcome.error);
+							else resolve(outcome.value);
+						} catch (error) {
+							reject(error);
+						} finally {
+							advance();
+						}
+					};
+					const abort = () => finish({ value: void 0 });
+					pending.set(id, {
+						start() {
+							if (started || disposed) return;
+							started = true;
+							try {
+								options.emitFrame({
+									type: "extension_ui_request",
+									id,
+									method: request.kind === "input" && request.multiline ? "editor" : request.kind,
+									title: request.title,
+									message: request.message,
+									options: labels,
+									placeholder: request.message,
+									prefill: request.initialValue
+								});
+							} catch (error) {
+								finish({ error });
+							}
+						},
+						respond(frame) {
+							if (!started) return;
+							if (frame.cancelled === true) return finish({ value: void 0 });
+							if (request.kind === "confirm") {
+								if (typeof frame.confirmed === "boolean") finish({ value: frame.confirmed });
+							} else if (typeof frame.value === "string") {
+								const selected = request.options?.find((option) => option.label === frame.value);
+								finish({ value: selected?.value ?? frame.value });
+							}
+						},
+						close: () => finish({ error: /* @__PURE__ */ new Error("Headless client is closed") })
+					});
+					signal?.addEventListener("abort", abort, { once: true });
+					advance();
+				});
+			}
+		},
+		receive(frame) {
+			if (frame.type !== "extension_ui_response") return false;
+			if (typeof frame.id === "string") pending.get(frame.id)?.respond(frame);
+			return true;
+		},
+		dispose() {
+			if (disposed) return;
+			disposed = true;
+			for (const request of pending.values()) request.close();
+		}
+	};
+}
+//#endregion
+export { createHeadlessClient };
+
+//# sourceMappingURL=index.mjs.map

package/dist/services/headlessClient/index.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.mjs","names":[],"sources":["../../../src/services/headlessClient/index.ts"],"sourcesContent":["import { randomUUID } from 'node:crypto';\n\nimport { createDoomNotificationEntryData, DOOM_NOTIFICATION_ENTRY_TYPE } from '../../exports/notification';\nimport type {\n  HeadlessClientBridge,\n  HeadlessClientOptions,\n  PendingClientRequest,\n} from '../../types/server/headlessClient';\n\n/** Explicit client interactions over the existing browser dialog protocol. */\nexport function createHeadlessClient(options: HeadlessClientOptions): HeadlessClientBridge {\n  const pending = new Map<string, PendingClientRequest>();\n  let disposed = false;\n  const advance = (): void => pending.values().next().value?.start();\n\n  return {\n    client: {\n      async notify(request) {\n        if (disposed) throw new Error('Headless client is closed');\n        const data = createDoomNotificationEntryData(request);\n        if (!data) throw new Error('Invalid notification request');\n        await options.appendCustomEntry(DOOM_NOTIFICATION_ENTRY_TYPE, data);\n      },\n      setStatus(source, text) {\n        if (disposed) throw new Error('Headless client is closed');\n        options.emitFrame({ type: 'extension_ui_request', method: 'setStatus', statusKey: source, statusText: text });\n      },\n      appendComposerText(text) {\n        if (disposed) throw new Error('Headless client is closed');\n        options.emitFrame({ type: 'extension_ui_request', method: 'append_composer_text', id: randomUUID(), text });\n      },\n      request(request, signal) {\n        if (disposed) return Promise.reject(new Error('Headless client is closed'));\n        if (signal?.aborted) return Promise.resolve(undefined);\n        if (!['confirm', 'select', 'input'].includes(request.kind)) {\n          return Promise.reject(new Error('Unsupported headless client request'));\n        }\n        const labels = request.options?.map((option) => option.label);\n        if (labels && new Set(labels).size !== labels.length) {\n          return Promise.reject(new Error('Select option labels must be unique'));\n        }\n        const id = `headless-ui:${randomUUID()}`;\n        return new Promise((resolve, reject) => {\n          let started = false;\n          const finish = (outcome: { value: unknown } | { error: unknown }): void => {\n            if (!pending.delete(id)) return;\n            signal?.removeEventListener('abort', abort);\n            try {\n              if (started) options.emitFrame({ type: 'extension_ui_answered', id });\n              if ('error' in outcome) reject(outcome.error);\n              else resolve(outcome.value);\n            } catch (error) {\n              reject(error);\n            } finally {\n              advance();\n            }\n          };\n          const abort = (): void => finish({ value: undefined });\n          pending.set(id, {\n            start() {\n              if (started || disposed) return;\n              started = true;\n              try {\n                options.emitFrame({\n                  type: 'extension_ui_request',\n                  id,\n                  method: request.kind === 'input' && request.multiline ? 'editor' : request.kind,\n                  title: request.title,\n                  message: request.message,\n                  options: labels,\n                  placeholder: request.message,\n                  prefill: request.initialValue,\n                });\n              } catch (error) {\n                finish({ error });\n              }\n            },\n            respond(frame) {\n              if (!started) return;\n              if (frame.cancelled === true) return finish({ value: undefined });\n              if (request.kind === 'confirm') {\n                if (typeof frame.confirmed === 'boolean') finish({ value: frame.confirmed });\n              } else if (typeof frame.value === 'string') {\n                // Rich questionnaire clients return an encoded whole-answer envelope here.\n                const selected = request.options?.find((option) => option.label === frame.value);\n                finish({ value: selected?.value ?? frame.value });\n              }\n            },\n            close: () => finish({ error: new Error('Headless client is closed') }),\n          });\n          signal?.addEventListener('abort', abort, { once: true });\n          advance();\n        });\n      },\n    },\n    receive(frame) {\n      if (frame.type !== 'extension_ui_response') return false;\n      if (typeof frame.id === 'string') pending.get(frame.id)?.respond(frame);\n      return true;\n    },\n    dispose() {\n      if (disposed) return;\n      disposed = true;\n      for (const request of pending.values()) request.close();\n    },\n  };\n}\n"],"mappings":";;;;;AAUA,SAAgB,qBAAqB,SAAsD;CACzF,MAAM,0BAAU,IAAI,IAAkC;CACtD,IAAI,WAAW;CACf,MAAM,gBAAsB,QAAQ,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,OAAO,MAAM;CAEjE,OAAO;EACL,QAAQ;GACN,MAAM,OAAO,SAAS;IACpB,IAAI,UAAU,MAAM,IAAI,MAAM,2BAA2B;IACzD,MAAM,OAAO,gCAAgC,OAAO;IACpD,IAAI,CAAC,MAAM,MAAM,IAAI,MAAM,8BAA8B;IACzD,MAAM,QAAQ,kBAAkB,8BAA8B,IAAI;GACpE;GACA,UAAU,QAAQ,MAAM;IACtB,IAAI,UAAU,MAAM,IAAI,MAAM,2BAA2B;IACzD,QAAQ,UAAU;KAAE,MAAM;KAAwB,QAAQ;KAAa,WAAW;KAAQ,YAAY;IAAK,CAAC;GAC9G;GACA,mBAAmB,MAAM;IACvB,IAAI,UAAU,MAAM,IAAI,MAAM,2BAA2B;IACzD,QAAQ,UAAU;KAAE,MAAM;KAAwB,QAAQ;KAAwB,IAAI,WAAW;KAAG;IAAK,CAAC;GAC5G;GACA,QAAQ,SAAS,QAAQ;IACvB,IAAI,UAAU,OAAO,QAAQ,uBAAO,IAAI,MAAM,2BAA2B,CAAC;IAC1E,IAAI,QAAQ,SAAS,OAAO,QAAQ,QAAQ,KAAA,CAAS;IACrD,IAAI,CAAC;KAAC;KAAW;KAAU;IAAO,CAAC,CAAC,SAAS,QAAQ,IAAI,GACvD,OAAO,QAAQ,uBAAO,IAAI,MAAM,qCAAqC,CAAC;IAExE,MAAM,SAAS,QAAQ,SAAS,KAAK,WAAW,OAAO,KAAK;IAC5D,IAAI,UAAU,IAAI,IAAI,MAAM,CAAC,CAAC,SAAS,OAAO,QAC5C,OAAO,QAAQ,uBAAO,IAAI,MAAM,qCAAqC,CAAC;IAExE,MAAM,KAAK,eAAe,WAAW;IACrC,OAAO,IAAI,SAAS,SAAS,WAAW;KACtC,IAAI,UAAU;KACd,MAAM,UAAU,YAA2D;MACzE,IAAI,CAAC,QAAQ,OAAO,EAAE,GAAG;MACzB,QAAQ,oBAAoB,SAAS,KAAK;MAC1C,IAAI;OACF,IAAI,SAAS,QAAQ,UAAU;QAAE,MAAM;QAAyB;OAAG,CAAC;OACpE,IAAI,WAAW,SAAS,OAAO,QAAQ,KAAK;YACvC,QAAQ,QAAQ,KAAK;MAC5B,SAAS,OAAO;OACd,OAAO,KAAK;MACd,UAAU;OACR,QAAQ;MACV;KACF;KACA,MAAM,cAAoB,OAAO,EAAE,OAAO,KAAA,EAAU,CAAC;KACrD,QAAQ,IAAI,IAAI;MACd,QAAQ;OACN,IAAI,WAAW,UAAU;OACzB,UAAU;OACV,IAAI;QACF,QAAQ,UAAU;SAChB,MAAM;SACN;SACA,QAAQ,QAAQ,SAAS,WAAW,QAAQ,YAAY,WAAW,QAAQ;SAC3E,OAAO,QAAQ;SACf,SAAS,QAAQ;SACjB,SAAS;SACT,aAAa,QAAQ;SACrB,SAAS,QAAQ;QACnB,CAAC;OACH,SAAS,OAAO;QACd,OAAO,EAAE,MAAM,CAAC;OAClB;MACF;MACA,QAAQ,OAAO;OACb,IAAI,CAAC,SAAS;OACd,IAAI,MAAM,cAAc,MAAM,OAAO,OAAO,EAAE,OAAO,KAAA,EAAU,CAAC;OAChE,IAAI,QAAQ,SAAS,WACf;YAAA,OAAO,MAAM,cAAc,WAAW,OAAO,EAAE,OAAO,MAAM,UAAU,CAAC;OAAA,OACtE,IAAI,OAAO,MAAM,UAAU,UAAU;QAE1C,MAAM,WAAW,QAAQ,SAAS,MAAM,WAAW,OAAO,UAAU,MAAM,KAAK;QAC/E,OAAO,EAAE,OAAO,UAAU,SAAS,MAAM,MAAM,CAAC;OAClD;MACF;MACA,aAAa,OAAO,EAAE,uBAAO,IAAI,MAAM,2BAA2B,EAAE,CAAC;KACvE,CAAC;KACD,QAAQ,iBAAiB,SAAS,OAAO,EAAE,MAAM,KAAK,CAAC;KACvD,QAAQ;IACV,CAAC;GACH;EACF;EACA,QAAQ,OAAO;GACb,IAAI,MAAM,SAAS,yBAAyB,OAAO;GACnD,IAAI,OAAO,MAAM,OAAO,UAAU,QAAQ,IAAI,MAAM,EAAE,CAAC,EAAE,QAAQ,KAAK;GACtE,OAAO;EACT;EACA,UAAU;GACR,IAAI,UAAU;GACd,WAAW;GACX,KAAK,MAAM,WAAW,QAAQ,OAAO,GAAG,QAAQ,MAAM;EACxD;CACF;AACF"}