@agimon-ai/po-core 0.0.0-alpha.0

package/dist/src/web/services/apiClient/index.cjs

@@ -0,0 +1,156 @@
+const require_index = require("../apiPaths/index.cjs");
+//#region src/web/services/apiClient/index.ts
+/**
+* The typed call surface a cockpit plugin reaches its own API through.
+*
+* A route is declared once as data, and the build supplies the two facts the
+* declaration deliberately omits: which scopes the package mounts at, and under
+* which base path. So a page names a route and a session, never a URL.
+*
+* The shape is dictated by the transport rather than by taste. Over a tunnel
+* every request is resealed and relayed, and the relay honours only a method, a
+* set of headers and a buffered body against a root-relative target. Anything
+* this surface accepted beyond that would be silently discarded at exactly the
+* moment it mattered, so it accepts nothing beyond that.
+*/
+/** Names the type a route answers with. Returns nothing; only its type is read. */
+function apiResponse() {}
+/** Identity with inference, so a route table keeps its literal types. */
+function defineApiRoutes(routes) {
+	return routes;
+}
+function isRecord(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+/** The body a route answered, or undefined when it sent none or sent non-JSON. */
+async function readBody(response) {
+	const text = await response.text();
+	if (text === "") return void 0;
+	try {
+		return JSON.parse(text);
+	} catch {
+		return;
+	}
+}
+/**
+* The message a route reported, or an empty string.
+*
+* Empty rather than invented: callers own the words their users read, and a
+* generic sentence from here would appear in a dozen packages that each already
+* have their own.
+*/
+function errorOf(data) {
+	return isRecord(data) && typeof data.error === "string" ? data.error : "";
+}
+/** Anything the sealed transport can carry verbatim; everything else becomes JSON. */
+function encodeBody(body) {
+	if (body === void 0) return {};
+	if (typeof body === "string" || body instanceof Blob || body instanceof ArrayBuffer || ArrayBuffer.isView(body) || body instanceof URLSearchParams) return { body };
+	return {
+		body: JSON.stringify(body),
+		contentType: "application/json"
+	};
+}
+/**
+* One route, as the page calls it.
+*
+* A streaming route is returned as a plain object with no call signature, not
+* merely typed as one. The type stops an author; the missing function stops a
+* cast, a JavaScript caller, and a generic helper that iterates the client.
+* Calling one over a tunnel would buffer forever rather than fail, and that is
+* too quiet a way to lose an afternoon.
+*/
+function methodFor(spec, address, options) {
+	const basePath = spec.host === true ? void 0 : options.basePath;
+	const url = (init) => require_index.pluginApiUrl(address, basePath, spec.path, init?.query, init?.params);
+	const call = async (init) => {
+		const encoded = encodeBody(init?.body);
+		const headers = {
+			...encoded.contentType === void 0 ? {} : { "content-type": encoded.contentType },
+			...init?.headers
+		};
+		let response;
+		try {
+			response = await options.transport(url(init), {
+				method: spec.method,
+				...init?.signal === void 0 ? {} : { signal: init.signal },
+				...Object.keys(headers).length === 0 ? {} : { headers },
+				...encoded.body === void 0 ? {} : { body: encoded.body }
+			});
+		} catch {
+			return {
+				ok: false,
+				status: 0,
+				error: "",
+				data: void 0
+			};
+		}
+		if (spec.raw === true) {
+			if (!response.ok) return {
+				ok: false,
+				status: response.status,
+				error: "",
+				data: void 0,
+				response
+			};
+			return {
+				ok: true,
+				status: response.status,
+				data: void 0,
+				response
+			};
+		}
+		const data = await readBody(response);
+		if (!response.ok) return {
+			ok: false,
+			status: response.status,
+			error: errorOf(data),
+			data,
+			response
+		};
+		return {
+			ok: true,
+			status: response.status,
+			data,
+			response
+		};
+	};
+	if (spec.stream === true) return {
+		url,
+		spec
+	};
+	return Object.assign(call, {
+		url,
+		spec
+	});
+}
+function scopeClient(routes, address, options) {
+	const client = {};
+	for (const [key, spec] of Object.entries(routes)) client[key] = methodFor(spec, address, options);
+	return client;
+}
+/**
+* Binds a route table to one package's mount.
+*
+* Only the scopes named in `options.scopes` get an accessor, so the returned
+* value describes exactly what this package serves and nothing else.
+*/
+function createApiClient(routes, options) {
+	const wide = options;
+	const accessors = {};
+	for (const scope of options.scopes) {
+		if (scope === "global") accessors.global = scopeClient(routes, { scope: "global" }, wide);
+		if (scope === "workspace") accessors.workspace = (workspaceId) => scopeClient(routes, {
+			scope: "workspace",
+			workspaceId
+		}, wide);
+		if (scope === "session") accessors.session = (sessionId) => scopeClient(routes, wide.sessionAddress(sessionId), wide);
+	}
+	return accessors;
+}
+//#endregion
+exports.apiResponse = apiResponse;
+exports.createApiClient = createApiClient;
+exports.defineApiRoutes = defineApiRoutes;
+
+//# sourceMappingURL=index.cjs.map

package/dist/src/web/services/apiClient/index.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.cjs","names":["pluginApiUrl"],"sources":["../../../../../src/web/services/apiClient/index.ts"],"sourcesContent":["/**\n * The typed call surface a cockpit plugin reaches its own API through.\n *\n * A route is declared once as data, and the build supplies the two facts the\n * declaration deliberately omits: which scopes the package mounts at, and under\n * which base path. So a page names a route and a session, never a URL.\n *\n * The shape is dictated by the transport rather than by taste. Over a tunnel\n * every request is resealed and relayed, and the relay honours only a method, a\n * set of headers and a buffered body against a root-relative target. Anything\n * this surface accepted beyond that would be silently discarded at exactly the\n * moment it mattered, so it accepts nothing beyond that.\n */\n\nimport { type ApiParams, type ApiQuery, type ApiScopeAddress, pluginApiUrl } from '../apiPaths';\n\n/** Scope names a package API can mount at. */\nexport type ApiScopeName = ApiScopeAddress['scope'];\n\n/** Methods a declared route may use. */\nexport type ApiRouteMethod = 'GET' | 'POST' | 'PUT' | 'PATCH' | 'DELETE' | 'HEAD' | 'OPTIONS';\n\ndeclare const RESPONSE_TYPE: unique symbol;\n\n/** Carries a route's response type through the declaration. Erased at runtime. */\nexport interface ApiResponseOf<T> {\n  readonly [RESPONSE_TYPE]: T;\n}\n\n/** Names the type a route answers with. Returns nothing; only its type is read. */\nexport function apiResponse<T>(): ApiResponseOf<T> {\n  return undefined as unknown as ApiResponseOf<T>;\n}\n\n/**\n * One route, as the package declares it.\n *\n * No scope and no base path: both are mount identity, the build reads them off\n * the folder tree, and restating them here is how they came to disagree in the\n * first place.\n */\nexport interface ApiRouteSpec<T = void> {\n  readonly method: ApiRouteMethod;\n  /** Below the mount, leading slash. Exactly '/' addresses the mount itself. */\n  readonly path: string;\n  /** Query parameter names this route reads, for documentation and review. */\n  readonly query?: readonly string[];\n  /** A host-owned route: it hangs off the scope root rather than under /plugins/. */\n  readonly host?: true;\n  /**\n   * Answers `text/event-stream`.\n   *\n   * A streaming route gets a URL and no call method. Its consumer is the\n   * browser's own `EventSource`, which does not go through the sealed\n   * transport, and a relayed request buffers the whole response before\n   * returning, so calling one over a tunnel would never return at all.\n   */\n  readonly stream?: true;\n  /**\n   * Answers bytes rather than JSON.\n   *\n   * The body is left unread, so `data` is undefined and the caller takes\n   * `result.response` and reads it however it needs: `arrayBuffer`, `blob`,\n   * `text`. Without this the client would consume the body to parse it, and\n   * hand back a `Response` that throws on the second read.\n   */\n  readonly raw?: true;\n  readonly response?: ApiResponseOf<T>;\n}\n\nexport type ApiRoutes = Readonly<Record<string, ApiRouteSpec<unknown>>>;\n\ntype ResponseOf<TSpec> = TSpec extends { readonly response: ApiResponseOf<infer T> } ? T : void;\n\n/**\n * What a call may carry.\n *\n * No `cache`, `credentials`, `redirect` or `mode`. The sealed transport copies\n * only the method, the headers and the body, so those four would be discarded\n * on every remote session and honoured on no one's.\n *\n * `signal` is here because it is the one of the five that is not always a lie.\n * On loopback the transport is a plain `fetch` pass-through and cancellation\n * works, which callers already rely on to drop a superseded refresh. Over a\n * tunnel the request is resealed and relayed, and the signal goes no further\n * than this process: the call still settles, so a caller that treats an abort\n * as \"no answer is coming\" stays correct, but the work at the far end is not\n * stopped. Refusing the field outright would have regressed every caller that\n * cancels today, which is a worse trade than describing the limit.\n */\nexport interface ApiCallInit {\n  /** Values for the route's `:name` path segments. */\n  readonly params?: ApiParams;\n  readonly query?: ApiQuery;\n  readonly headers?: Readonly<Record<string, string>>;\n  /** JSON-encoded unless it is already a string, Blob, buffer or URLSearchParams. */\n  readonly body?: unknown;\n  /** Honoured on loopback; dropped when the session is remote. */\n  readonly signal?: AbortSignal;\n}\n\n/**\n * What a route answered.\n *\n * `status` and the raw `response` are always present on an answered call,\n * because status and headers carry protocol state across this codebase: a 409\n * returns the hash the file actually has, a 204 plus a header says a recording\n * is sealed, and the file route reports a digest. A client that returned only a\n * parsed body would lose all three.\n *\n * `status: 0` with no `response` is the one case the transport never answered.\n * A relay failure arrives as a synthetic 502 and is reported as 502, because\n * this layer cannot tell it from the real thing.\n */\nexport type ApiResult<T> =\n  | { readonly ok: true; readonly status: number; readonly data: T; readonly response: Response }\n  | {\n      readonly ok: false;\n      readonly status: number;\n      readonly error: string;\n      readonly data: unknown;\n      readonly response?: Response;\n    };\n\n/** Issues a request. The same shape as `fetch`, so the sealed transport and the step-up wrapper both fit. */\nexport type ApiTransport = (input: string, init?: RequestInit) => Promise<Response>;\n\nexport interface ApiMethod<T> {\n  (init?: ApiCallInit): Promise<ApiResult<T>>;\n  /** The absolute URL, for an `EventSource`, an `<img src>`, or a download. */\n  url(init?: Pick<ApiCallInit, 'query' | 'params'>): string;\n  readonly spec: ApiRouteSpec<unknown>;\n}\n\n/** A streaming route: addressable, not callable. */\nexport interface ApiStreamMethod {\n  url(init?: Pick<ApiCallInit, 'query' | 'params'>): string;\n  readonly spec: ApiRouteSpec<unknown>;\n}\n\nexport type ApiScopeClient<TRoutes extends ApiRoutes> = {\n  readonly [K in keyof TRoutes]: TRoutes[K] extends { readonly stream: true }\n    ? ApiStreamMethod\n    : ApiMethod<ResponseOf<TRoutes[K]>>;\n};\n\ninterface ApiScopeAccessors<TRoutes extends ApiRoutes> {\n  readonly global: ApiScopeClient<TRoutes>;\n  readonly workspace: (workspaceId: string) => ApiScopeClient<TRoutes>;\n  readonly session: (sessionId: string) => ApiScopeClient<TRoutes>;\n}\n\n/**\n * The client, carrying an accessor only for the scopes the package mounts at.\n *\n * A package serving sessions has `session` and nothing else, so addressing it\n * globally is a missing property rather than a 404 discovered at runtime. This\n * is the whole of the scope guarantee, and it costs no test.\n */\nexport type ApiClient<TScopes extends ApiScopeName, TRoutes extends ApiRoutes> = Pick<\n  ApiScopeAccessors<TRoutes>,\n  TScopes\n>;\n\n/** Identity with inference, so a route table keeps its literal types. */\nexport function defineApiRoutes<const TRoutes extends ApiRoutes>(routes: TRoutes): TRoutes {\n  return routes;\n}\n\nfunction isRecord(value: unknown): value is Record<string, unknown> {\n  return typeof value === 'object' && value !== null && !Array.isArray(value);\n}\n\n/** The body a route answered, or undefined when it sent none or sent non-JSON. */\nasync function readBody(response: Response): Promise<unknown> {\n  const text = await response.text();\n  if (text === '') return undefined;\n  try {\n    return JSON.parse(text) as unknown;\n  } catch {\n    return undefined;\n  }\n}\n\n/**\n * The message a route reported, or an empty string.\n *\n * Empty rather than invented: callers own the words their users read, and a\n * generic sentence from here would appear in a dozen packages that each already\n * have their own.\n */\nfunction errorOf(data: unknown): string {\n  return isRecord(data) && typeof data.error === 'string' ? data.error : '';\n}\n\n/**\n * What the sealed relay can carry verbatim.\n *\n * Named here rather than borrowed from `BodyInit`, which the node build has no\n * lib for, and which is anyway wider than the truth: `FormData` and a\n * `ReadableStream` are both refused when a session is remote.\n */\nexport type ApiRequestBody = string | Blob | ArrayBuffer | ArrayBufferView | URLSearchParams;\n\n/** Anything the sealed transport can carry verbatim; everything else becomes JSON. */\nfunction encodeBody(body: unknown): { body?: ApiRequestBody; contentType?: string } {\n  if (body === undefined) return {};\n  if (\n    typeof body === 'string' ||\n    body instanceof Blob ||\n    body instanceof ArrayBuffer ||\n    ArrayBuffer.isView(body) ||\n    body instanceof URLSearchParams\n  ) {\n    return { body };\n  }\n  return { body: JSON.stringify(body), contentType: 'application/json' };\n}\n\nexport interface ApiClientOptions<TScopes extends ApiScopeName> {\n  /** Scopes the package's routed api/ tree actually mounts at. The build supplies these. */\n  readonly scopes: readonly TScopes[];\n  /** The mount segment. The build reads it off the api/<base-path>/ folder. */\n  readonly basePath: string;\n  readonly transport: ApiTransport;\n  /** Resolves which workspace owns a session; the host binds it from its own summaries. */\n  readonly sessionAddress: (sessionId: string) => ApiScopeAddress;\n}\n\n/**\n * One route, as the page calls it.\n *\n * A streaming route is returned as a plain object with no call signature, not\n * merely typed as one. The type stops an author; the missing function stops a\n * cast, a JavaScript caller, and a generic helper that iterates the client.\n * Calling one over a tunnel would buffer forever rather than fail, and that is\n * too quiet a way to lose an afternoon.\n */\nfunction methodFor(\n  spec: ApiRouteSpec<unknown>,\n  address: ApiScopeAddress,\n  options: ApiClientOptions<ApiScopeName>,\n): ApiMethod<unknown> | ApiStreamMethod {\n  const basePath = spec.host === true ? undefined : options.basePath;\n  const url = (init?: Pick<ApiCallInit, 'query' | 'params'>): string =>\n    pluginApiUrl(address, basePath, spec.path, init?.query, init?.params);\n\n  const call = async (init?: ApiCallInit): Promise<ApiResult<unknown>> => {\n    const encoded = encodeBody(init?.body);\n    const headers = {\n      ...(encoded.contentType === undefined ? {} : { 'content-type': encoded.contentType }),\n      ...init?.headers,\n    };\n    let response: Response;\n    try {\n      response = await options.transport(url(init), {\n        method: spec.method,\n        ...(init?.signal === undefined ? {} : { signal: init.signal }),\n        ...(Object.keys(headers).length === 0 ? {} : { headers }),\n        // Cast because the node build's `BodyInit` enumerates concrete typed\n        // arrays rather than accepting `ArrayBufferView`. Every value reaching\n        // here is one fetch already carries; the two libs disagree about the\n        // type, not the runtime.\n        ...(encoded.body === undefined ? {} : { body: encoded.body as RequestInit['body'] }),\n      });\n    } catch {\n      return { ok: false, status: 0, error: '', data: undefined };\n    }\n    // A raw route's body belongs to the caller, and reading it here to look\n    // for an `error` would spend the one read it gets.\n    if (spec.raw === true) {\n      if (!response.ok) return { ok: false, status: response.status, error: '', data: undefined, response };\n      return { ok: true, status: response.status, data: undefined, response };\n    }\n    const data = await readBody(response);\n    if (!response.ok) return { ok: false, status: response.status, error: errorOf(data), data, response };\n    return { ok: true, status: response.status, data, response };\n  };\n\n  if (spec.stream === true) return { url, spec };\n  return Object.assign(call, { url, spec });\n}\n\nfunction scopeClient<TRoutes extends ApiRoutes>(\n  routes: TRoutes,\n  address: ApiScopeAddress,\n  options: ApiClientOptions<ApiScopeName>,\n): ApiScopeClient<TRoutes> {\n  const client: Record<string, ApiMethod<unknown> | ApiStreamMethod> = {};\n  for (const [key, spec] of Object.entries(routes)) client[key] = methodFor(spec, address, options);\n  return client as ApiScopeClient<TRoutes>;\n}\n\n/**\n * Binds a route table to one package's mount.\n *\n * Only the scopes named in `options.scopes` get an accessor, so the returned\n * value describes exactly what this package serves and nothing else.\n */\nexport function createApiClient<const TScopes extends ApiScopeName, const TRoutes extends ApiRoutes>(\n  routes: TRoutes,\n  options: ApiClientOptions<TScopes>,\n): ApiClient<TScopes, TRoutes> {\n  const wide = options as ApiClientOptions<ApiScopeName>;\n  const accessors: { -readonly [K in keyof ApiScopeAccessors<TRoutes>]?: ApiScopeAccessors<TRoutes>[K] } = {};\n  for (const scope of options.scopes) {\n    if (scope === 'global') accessors.global = scopeClient(routes, { scope: 'global' }, wide);\n    if (scope === 'workspace') {\n      accessors.workspace = (workspaceId: string) => scopeClient(routes, { scope: 'workspace', workspaceId }, wide);\n    }\n    if (scope === 'session') {\n      accessors.session = (sessionId: string) => scopeClient(routes, wide.sessionAddress(sessionId), wide);\n    }\n  }\n  return accessors as ApiClient<TScopes, TRoutes>;\n}\n"],"mappings":";;;;;;;;;;;;;;;;AA8BA,SAAgB,cAAmC,CAEnD;;AAqIA,SAAgB,gBAAiD,QAA0B;CACzF,OAAO;AACT;AAEA,SAAS,SAAS,OAAkD;CAClE,OAAO,OAAO,UAAU,YAAY,UAAU,QAAQ,CAAC,MAAM,QAAQ,KAAK;AAC5E;;AAGA,eAAe,SAAS,UAAsC;CAC5D,MAAM,OAAO,MAAM,SAAS,KAAK;CACjC,IAAI,SAAS,IAAI,OAAO,KAAA;CACxB,IAAI;EACF,OAAO,KAAK,MAAM,IAAI;CACxB,QAAQ;EACN;CACF;AACF;;;;;;;;AASA,SAAS,QAAQ,MAAuB;CACtC,OAAO,SAAS,IAAI,KAAK,OAAO,KAAK,UAAU,WAAW,KAAK,QAAQ;AACzE;;AAYA,SAAS,WAAW,MAAgE;CAClF,IAAI,SAAS,KAAA,GAAW,OAAO,CAAC;CAChC,IACE,OAAO,SAAS,YAChB,gBAAgB,QAChB,gBAAgB,eAChB,YAAY,OAAO,IAAI,KACvB,gBAAgB,iBAEhB,OAAO,EAAE,KAAK;CAEhB,OAAO;EAAE,MAAM,KAAK,UAAU,IAAI;EAAG,aAAa;CAAmB;AACvE;;;;;;;;;;AAqBA,SAAS,UACP,MACA,SACA,SACsC;CACtC,MAAM,WAAW,KAAK,SAAS,OAAO,KAAA,IAAY,QAAQ;CAC1D,MAAM,OAAO,SACXA,cAAAA,aAAa,SAAS,UAAU,KAAK,MAAM,MAAM,OAAO,MAAM,MAAM;CAEtE,MAAM,OAAO,OAAO,SAAoD;EACtE,MAAM,UAAU,WAAW,MAAM,IAAI;EACrC,MAAM,UAAU;GACd,GAAI,QAAQ,gBAAgB,KAAA,IAAY,CAAC,IAAI,EAAE,gBAAgB,QAAQ,YAAY;GACnF,GAAG,MAAM;EACX;EACA,IAAI;EACJ,IAAI;GACF,WAAW,MAAM,QAAQ,UAAU,IAAI,IAAI,GAAG;IAC5C,QAAQ,KAAK;IACb,GAAI,MAAM,WAAW,KAAA,IAAY,CAAC,IAAI,EAAE,QAAQ,KAAK,OAAO;IAC5D,GAAI,OAAO,KAAK,OAAO,CAAC,CAAC,WAAW,IAAI,CAAC,IAAI,EAAE,QAAQ;IAKvD,GAAI,QAAQ,SAAS,KAAA,IAAY,CAAC,IAAI,EAAE,MAAM,QAAQ,KAA4B;GACpF,CAAC;EACH,QAAQ;GACN,OAAO;IAAE,IAAI;IAAO,QAAQ;IAAG,OAAO;IAAI,MAAM,KAAA;GAAU;EAC5D;EAGA,IAAI,KAAK,QAAQ,MAAM;GACrB,IAAI,CAAC,SAAS,IAAI,OAAO;IAAE,IAAI;IAAO,QAAQ,SAAS;IAAQ,OAAO;IAAI,MAAM,KAAA;IAAW;GAAS;GACpG,OAAO;IAAE,IAAI;IAAM,QAAQ,SAAS;IAAQ,MAAM,KAAA;IAAW;GAAS;EACxE;EACA,MAAM,OAAO,MAAM,SAAS,QAAQ;EACpC,IAAI,CAAC,SAAS,IAAI,OAAO;GAAE,IAAI;GAAO,QAAQ,SAAS;GAAQ,OAAO,QAAQ,IAAI;GAAG;GAAM;EAAS;EACpG,OAAO;GAAE,IAAI;GAAM,QAAQ,SAAS;GAAQ;GAAM;EAAS;CAC7D;CAEA,IAAI,KAAK,WAAW,MAAM,OAAO;EAAE;EAAK;CAAK;CAC7C,OAAO,OAAO,OAAO,MAAM;EAAE;EAAK;CAAK,CAAC;AAC1C;AAEA,SAAS,YACP,QACA,SACA,SACyB;CACzB,MAAM,SAA+D,CAAC;CACtE,KAAK,MAAM,CAAC,KAAK,SAAS,OAAO,QAAQ,MAAM,GAAG,OAAO,OAAO,UAAU,MAAM,SAAS,OAAO;CAChG,OAAO;AACT;;;;;;;AAQA,SAAgB,gBACd,QACA,SAC6B;CAC7B,MAAM,OAAO;CACb,MAAM,YAAmG,CAAC;CAC1G,KAAK,MAAM,SAAS,QAAQ,QAAQ;EAClC,IAAI,UAAU,UAAU,UAAU,SAAS,YAAY,QAAQ,EAAE,OAAO,SAAS,GAAG,IAAI;EACxF,IAAI,UAAU,aACZ,UAAU,aAAa,gBAAwB,YAAY,QAAQ;GAAE,OAAO;GAAa;EAAY,GAAG,IAAI;EAE9G,IAAI,UAAU,WACZ,UAAU,WAAW,cAAsB,YAAY,QAAQ,KAAK,eAAe,SAAS,GAAG,IAAI;CAEvG;CACA,OAAO;AACT"}

package/dist/src/web/services/apiClient/index.d.mts

@@ -0,0 +1,152 @@
+import { ApiParams, ApiQuery, ApiScopeAddress } from "../apiPaths/index.mjs";
+//#region src/web/services/apiClient/index.d.ts
+/** Scope names a package API can mount at. */
+export type ApiScopeName = ApiScopeAddress['scope'];
+/** Methods a declared route may use. */
+export type ApiRouteMethod = 'GET' | 'POST' | 'PUT' | 'PATCH' | 'DELETE' | 'HEAD' | 'OPTIONS';
+declare const RESPONSE_TYPE: unique symbol;
+/** Carries a route's response type through the declaration. Erased at runtime. */
+export interface ApiResponseOf<T> {
+  readonly [RESPONSE_TYPE]: T;
+}
+/** Names the type a route answers with. Returns nothing; only its type is read. */
+export declare function apiResponse<T>(): ApiResponseOf<T>;
+/**
+ * One route, as the package declares it.
+ *
+ * No scope and no base path: both are mount identity, the build reads them off
+ * the folder tree, and restating them here is how they came to disagree in the
+ * first place.
+ */
+export interface ApiRouteSpec<T = void> {
+  readonly method: ApiRouteMethod;
+  /** Below the mount, leading slash. Exactly '/' addresses the mount itself. */
+  readonly path: string;
+  /** Query parameter names this route reads, for documentation and review. */
+  readonly query?: readonly string[];
+  /** A host-owned route: it hangs off the scope root rather than under /plugins/. */
+  readonly host?: true;
+  /**
+   * Answers `text/event-stream`.
+   *
+   * A streaming route gets a URL and no call method. Its consumer is the
+   * browser's own `EventSource`, which does not go through the sealed
+   * transport, and a relayed request buffers the whole response before
+   * returning, so calling one over a tunnel would never return at all.
+   */
+  readonly stream?: true;
+  /**
+   * Answers bytes rather than JSON.
+   *
+   * The body is left unread, so `data` is undefined and the caller takes
+   * `result.response` and reads it however it needs: `arrayBuffer`, `blob`,
+   * `text`. Without this the client would consume the body to parse it, and
+   * hand back a `Response` that throws on the second read.
+   */
+  readonly raw?: true;
+  readonly response?: ApiResponseOf<T>;
+}
+export type ApiRoutes = Readonly<Record<string, ApiRouteSpec<unknown>>>;
+type ResponseOf<TSpec> = TSpec extends {
+  readonly response: ApiResponseOf<infer T>;
+} ? T : void;
+/**
+ * What a call may carry.
+ *
+ * No `cache`, `credentials`, `redirect` or `mode`. The sealed transport copies
+ * only the method, the headers and the body, so those four would be discarded
+ * on every remote session and honoured on no one's.
+ *
+ * `signal` is here because it is the one of the five that is not always a lie.
+ * On loopback the transport is a plain `fetch` pass-through and cancellation
+ * works, which callers already rely on to drop a superseded refresh. Over a
+ * tunnel the request is resealed and relayed, and the signal goes no further
+ * than this process: the call still settles, so a caller that treats an abort
+ * as "no answer is coming" stays correct, but the work at the far end is not
+ * stopped. Refusing the field outright would have regressed every caller that
+ * cancels today, which is a worse trade than describing the limit.
+ */
+export interface ApiCallInit {
+  /** Values for the route's `:name` path segments. */
+  readonly params?: ApiParams;
+  readonly query?: ApiQuery;
+  readonly headers?: Readonly<Record<string, string>>;
+  /** JSON-encoded unless it is already a string, Blob, buffer or URLSearchParams. */
+  readonly body?: unknown;
+  /** Honoured on loopback; dropped when the session is remote. */
+  readonly signal?: AbortSignal;
+}
+/**
+ * What a route answered.
+ *
+ * `status` and the raw `response` are always present on an answered call,
+ * because status and headers carry protocol state across this codebase: a 409
+ * returns the hash the file actually has, a 204 plus a header says a recording
+ * is sealed, and the file route reports a digest. A client that returned only a
+ * parsed body would lose all three.
+ *
+ * `status: 0` with no `response` is the one case the transport never answered.
+ * A relay failure arrives as a synthetic 502 and is reported as 502, because
+ * this layer cannot tell it from the real thing.
+ */
+export type ApiResult<T> = {
+  readonly ok: true;
+  readonly status: number;
+  readonly data: T;
+  readonly response: Response;
+} | {
+  readonly ok: false;
+  readonly status: number;
+  readonly error: string;
+  readonly data: unknown;
+  readonly response?: Response;
+};
+/** Issues a request. The same shape as `fetch`, so the sealed transport and the step-up wrapper both fit. */
+export type ApiTransport = (input: string, init?: RequestInit) => Promise<Response>;
+export interface ApiMethod<T> {
+  (init?: ApiCallInit): Promise<ApiResult<T>>;
+  /** The absolute URL, for an `EventSource`, an `<img src>`, or a download. */
+  url(init?: Pick<ApiCallInit, 'query' | 'params'>): string;
+  readonly spec: ApiRouteSpec<unknown>;
+}
+/** A streaming route: addressable, not callable. */
+export interface ApiStreamMethod {
+  url(init?: Pick<ApiCallInit, 'query' | 'params'>): string;
+  readonly spec: ApiRouteSpec<unknown>;
+}
+export type ApiScopeClient<TRoutes extends ApiRoutes> = { readonly [K in keyof TRoutes]: TRoutes[K] extends {
+  readonly stream: true;
+} ? ApiStreamMethod : ApiMethod<ResponseOf<TRoutes[K]>>; };
+interface ApiScopeAccessors<TRoutes extends ApiRoutes> {
+  readonly global: ApiScopeClient<TRoutes>;
+  readonly workspace: (workspaceId: string) => ApiScopeClient<TRoutes>;
+  readonly session: (sessionId: string) => ApiScopeClient<TRoutes>;
+}
+/**
+ * The client, carrying an accessor only for the scopes the package mounts at.
+ *
+ * A package serving sessions has `session` and nothing else, so addressing it
+ * globally is a missing property rather than a 404 discovered at runtime. This
+ * is the whole of the scope guarantee, and it costs no test.
+ */
+export type ApiClient<TScopes extends ApiScopeName, TRoutes extends ApiRoutes> = Pick<ApiScopeAccessors<TRoutes>, TScopes>;
+/** Identity with inference, so a route table keeps its literal types. */
+export declare function defineApiRoutes<const TRoutes extends ApiRoutes>(routes: TRoutes): TRoutes;
+export interface ApiClientOptions<TScopes extends ApiScopeName> {
+  /** Scopes the package's routed api/ tree actually mounts at. The build supplies these. */
+  readonly scopes: readonly TScopes[];
+  /** The mount segment. The build reads it off the api/<base-path>/ folder. */
+  readonly basePath: string;
+  readonly transport: ApiTransport;
+  /** Resolves which workspace owns a session; the host binds it from its own summaries. */
+  readonly sessionAddress: (sessionId: string) => ApiScopeAddress;
+}
+/**
+ * Binds a route table to one package's mount.
+ *
+ * Only the scopes named in `options.scopes` get an accessor, so the returned
+ * value describes exactly what this package serves and nothing else.
+ */
+export declare function createApiClient<const TScopes extends ApiScopeName, const TRoutes extends ApiRoutes>(routes: TRoutes, options: ApiClientOptions<TScopes>): ApiClient<TScopes, TRoutes>;
+//#endregion
+//# sourceMappingURL=index.d.mts.map

package/dist/src/web/services/apiClient/index.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.mts","names":[],"sources":["../../../../../src/web/services/apiClient/index.ts"],"mappings":";;;YAiBY,eAAe;;YAGf;cAEE;;iBAGG,cAAc;YACnB,gBAAgB;;;wBAIZ,YAAY,MAAM,cAAc;;;;;;;;iBAW/B,aAAa;WACnB,QAAQ;;WAER;;WAEA;;WAEA;;;;;;;;;WASA;;;;;;;;;WASA;WACA,WAAW,cAAc;;YAGxB,YAAY,SAAS,eAAe;KAE3C,WAAW,SAAS;WAAyB,UAAU,oBAAoB;IAAO;;;;;;;;;;;;;;;;;iBAkBtE;;WAEN,SAAS;WACT,QAAQ;WACR,UAAU,SAAS;;WAEnB;;WAEA,SAAS;;;;;;;;;;;;;;;YAgBR,UAAU;WACP;WAAmB;WAAyB,MAAM;WAAY,UAAU;;WAExE;WACA;WACA;WACA;WACA,WAAW;;;YAId,gBAAgB,eAAe,OAAO,gBAAgB,QAAQ;iBAEzD,UAAU;GACxB,OAAO,cAAc,QAAQ,UAAU;;EAExC,IAAI,OAAO,KAAK;WACP,MAAM;;;iBAIA;EACf,IAAI,OAAO,KAAK;WACP,MAAM;;YAGL,eAAe,gBAAgB,yBAC/B,WAAW,UAAU,QAAQ;WAAsB;IACzD,kBACA,UAAU,WAAW,QAAQ;UAGzB,kBAAkB,gBAAgB;WACjC,QAAQ,eAAe;WACvB,YAAY,wBAAwB,eAAe;WACnD,UAAU,sBAAsB,eAAe;;;;;;;;;YAU9C,UAAU,gBAAgB,cAAc,gBAAgB,aAAa,KAC/E,kBAAkB,UAClB;;wBAIc,sBAAsB,gBAAgB,WAAW,QAAQ,UAAU;iBAsDlE,iBAAiB,gBAAgB;;WAEvC,iBAAiB;;WAEjB;WACA,WAAW;;WAEX,iBAAiB,sBAAsB;;;;;;;;wBAyElC,sBAAsB,gBAAgB,oBAAoB,gBAAgB,WACxF,QAAQ,SACR,SAAS,iBAAiB,WACzB,UAAU,SAAS"}

package/dist/src/web/services/apiClient/index.mjs

@@ -0,0 +1,154 @@
+import { pluginApiUrl } from "../apiPaths/index.mjs";
+//#region src/web/services/apiClient/index.ts
+/**
+* The typed call surface a cockpit plugin reaches its own API through.
+*
+* A route is declared once as data, and the build supplies the two facts the
+* declaration deliberately omits: which scopes the package mounts at, and under
+* which base path. So a page names a route and a session, never a URL.
+*
+* The shape is dictated by the transport rather than by taste. Over a tunnel
+* every request is resealed and relayed, and the relay honours only a method, a
+* set of headers and a buffered body against a root-relative target. Anything
+* this surface accepted beyond that would be silently discarded at exactly the
+* moment it mattered, so it accepts nothing beyond that.
+*/
+/** Names the type a route answers with. Returns nothing; only its type is read. */
+function apiResponse() {}
+/** Identity with inference, so a route table keeps its literal types. */
+function defineApiRoutes(routes) {
+	return routes;
+}
+function isRecord(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+/** The body a route answered, or undefined when it sent none or sent non-JSON. */
+async function readBody(response) {
+	const text = await response.text();
+	if (text === "") return void 0;
+	try {
+		return JSON.parse(text);
+	} catch {
+		return;
+	}
+}
+/**
+* The message a route reported, or an empty string.
+*
+* Empty rather than invented: callers own the words their users read, and a
+* generic sentence from here would appear in a dozen packages that each already
+* have their own.
+*/
+function errorOf(data) {
+	return isRecord(data) && typeof data.error === "string" ? data.error : "";
+}
+/** Anything the sealed transport can carry verbatim; everything else becomes JSON. */
+function encodeBody(body) {
+	if (body === void 0) return {};
+	if (typeof body === "string" || body instanceof Blob || body instanceof ArrayBuffer || ArrayBuffer.isView(body) || body instanceof URLSearchParams) return { body };
+	return {
+		body: JSON.stringify(body),
+		contentType: "application/json"
+	};
+}
+/**
+* One route, as the page calls it.
+*
+* A streaming route is returned as a plain object with no call signature, not
+* merely typed as one. The type stops an author; the missing function stops a
+* cast, a JavaScript caller, and a generic helper that iterates the client.
+* Calling one over a tunnel would buffer forever rather than fail, and that is
+* too quiet a way to lose an afternoon.
+*/
+function methodFor(spec, address, options) {
+	const basePath = spec.host === true ? void 0 : options.basePath;
+	const url = (init) => pluginApiUrl(address, basePath, spec.path, init?.query, init?.params);
+	const call = async (init) => {
+		const encoded = encodeBody(init?.body);
+		const headers = {
+			...encoded.contentType === void 0 ? {} : { "content-type": encoded.contentType },
+			...init?.headers
+		};
+		let response;
+		try {
+			response = await options.transport(url(init), {
+				method: spec.method,
+				...init?.signal === void 0 ? {} : { signal: init.signal },
+				...Object.keys(headers).length === 0 ? {} : { headers },
+				...encoded.body === void 0 ? {} : { body: encoded.body }
+			});
+		} catch {
+			return {
+				ok: false,
+				status: 0,
+				error: "",
+				data: void 0
+			};
+		}
+		if (spec.raw === true) {
+			if (!response.ok) return {
+				ok: false,
+				status: response.status,
+				error: "",
+				data: void 0,
+				response
+			};
+			return {
+				ok: true,
+				status: response.status,
+				data: void 0,
+				response
+			};
+		}
+		const data = await readBody(response);
+		if (!response.ok) return {
+			ok: false,
+			status: response.status,
+			error: errorOf(data),
+			data,
+			response
+		};
+		return {
+			ok: true,
+			status: response.status,
+			data,
+			response
+		};
+	};
+	if (spec.stream === true) return {
+		url,
+		spec
+	};
+	return Object.assign(call, {
+		url,
+		spec
+	});
+}
+function scopeClient(routes, address, options) {
+	const client = {};
+	for (const [key, spec] of Object.entries(routes)) client[key] = methodFor(spec, address, options);
+	return client;
+}
+/**
+* Binds a route table to one package's mount.
+*
+* Only the scopes named in `options.scopes` get an accessor, so the returned
+* value describes exactly what this package serves and nothing else.
+*/
+function createApiClient(routes, options) {
+	const wide = options;
+	const accessors = {};
+	for (const scope of options.scopes) {
+		if (scope === "global") accessors.global = scopeClient(routes, { scope: "global" }, wide);
+		if (scope === "workspace") accessors.workspace = (workspaceId) => scopeClient(routes, {
+			scope: "workspace",
+			workspaceId
+		}, wide);
+		if (scope === "session") accessors.session = (sessionId) => scopeClient(routes, wide.sessionAddress(sessionId), wide);
+	}
+	return accessors;
+}
+//#endregion
+export { apiResponse, createApiClient, defineApiRoutes };
+
+//# sourceMappingURL=index.mjs.map

package/dist/src/web/services/apiClient/index.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.mjs","names":[],"sources":["../../../../../src/web/services/apiClient/index.ts"],"sourcesContent":["/**\n * The typed call surface a cockpit plugin reaches its own API through.\n *\n * A route is declared once as data, and the build supplies the two facts the\n * declaration deliberately omits: which scopes the package mounts at, and under\n * which base path. So a page names a route and a session, never a URL.\n *\n * The shape is dictated by the transport rather than by taste. Over a tunnel\n * every request is resealed and relayed, and the relay honours only a method, a\n * set of headers and a buffered body against a root-relative target. Anything\n * this surface accepted beyond that would be silently discarded at exactly the\n * moment it mattered, so it accepts nothing beyond that.\n */\n\nimport { type ApiParams, type ApiQuery, type ApiScopeAddress, pluginApiUrl } from '../apiPaths';\n\n/** Scope names a package API can mount at. */\nexport type ApiScopeName = ApiScopeAddress['scope'];\n\n/** Methods a declared route may use. */\nexport type ApiRouteMethod = 'GET' | 'POST' | 'PUT' | 'PATCH' | 'DELETE' | 'HEAD' | 'OPTIONS';\n\ndeclare const RESPONSE_TYPE: unique symbol;\n\n/** Carries a route's response type through the declaration. Erased at runtime. */\nexport interface ApiResponseOf<T> {\n  readonly [RESPONSE_TYPE]: T;\n}\n\n/** Names the type a route answers with. Returns nothing; only its type is read. */\nexport function apiResponse<T>(): ApiResponseOf<T> {\n  return undefined as unknown as ApiResponseOf<T>;\n}\n\n/**\n * One route, as the package declares it.\n *\n * No scope and no base path: both are mount identity, the build reads them off\n * the folder tree, and restating them here is how they came to disagree in the\n * first place.\n */\nexport interface ApiRouteSpec<T = void> {\n  readonly method: ApiRouteMethod;\n  /** Below the mount, leading slash. Exactly '/' addresses the mount itself. */\n  readonly path: string;\n  /** Query parameter names this route reads, for documentation and review. */\n  readonly query?: readonly string[];\n  /** A host-owned route: it hangs off the scope root rather than under /plugins/. */\n  readonly host?: true;\n  /**\n   * Answers `text/event-stream`.\n   *\n   * A streaming route gets a URL and no call method. Its consumer is the\n   * browser's own `EventSource`, which does not go through the sealed\n   * transport, and a relayed request buffers the whole response before\n   * returning, so calling one over a tunnel would never return at all.\n   */\n  readonly stream?: true;\n  /**\n   * Answers bytes rather than JSON.\n   *\n   * The body is left unread, so `data` is undefined and the caller takes\n   * `result.response` and reads it however it needs: `arrayBuffer`, `blob`,\n   * `text`. Without this the client would consume the body to parse it, and\n   * hand back a `Response` that throws on the second read.\n   */\n  readonly raw?: true;\n  readonly response?: ApiResponseOf<T>;\n}\n\nexport type ApiRoutes = Readonly<Record<string, ApiRouteSpec<unknown>>>;\n\ntype ResponseOf<TSpec> = TSpec extends { readonly response: ApiResponseOf<infer T> } ? T : void;\n\n/**\n * What a call may carry.\n *\n * No `cache`, `credentials`, `redirect` or `mode`. The sealed transport copies\n * only the method, the headers and the body, so those four would be discarded\n * on every remote session and honoured on no one's.\n *\n * `signal` is here because it is the one of the five that is not always a lie.\n * On loopback the transport is a plain `fetch` pass-through and cancellation\n * works, which callers already rely on to drop a superseded refresh. Over a\n * tunnel the request is resealed and relayed, and the signal goes no further\n * than this process: the call still settles, so a caller that treats an abort\n * as \"no answer is coming\" stays correct, but the work at the far end is not\n * stopped. Refusing the field outright would have regressed every caller that\n * cancels today, which is a worse trade than describing the limit.\n */\nexport interface ApiCallInit {\n  /** Values for the route's `:name` path segments. */\n  readonly params?: ApiParams;\n  readonly query?: ApiQuery;\n  readonly headers?: Readonly<Record<string, string>>;\n  /** JSON-encoded unless it is already a string, Blob, buffer or URLSearchParams. */\n  readonly body?: unknown;\n  /** Honoured on loopback; dropped when the session is remote. */\n  readonly signal?: AbortSignal;\n}\n\n/**\n * What a route answered.\n *\n * `status` and the raw `response` are always present on an answered call,\n * because status and headers carry protocol state across this codebase: a 409\n * returns the hash the file actually has, a 204 plus a header says a recording\n * is sealed, and the file route reports a digest. A client that returned only a\n * parsed body would lose all three.\n *\n * `status: 0` with no `response` is the one case the transport never answered.\n * A relay failure arrives as a synthetic 502 and is reported as 502, because\n * this layer cannot tell it from the real thing.\n */\nexport type ApiResult<T> =\n  | { readonly ok: true; readonly status: number; readonly data: T; readonly response: Response }\n  | {\n      readonly ok: false;\n      readonly status: number;\n      readonly error: string;\n      readonly data: unknown;\n      readonly response?: Response;\n    };\n\n/** Issues a request. The same shape as `fetch`, so the sealed transport and the step-up wrapper both fit. */\nexport type ApiTransport = (input: string, init?: RequestInit) => Promise<Response>;\n\nexport interface ApiMethod<T> {\n  (init?: ApiCallInit): Promise<ApiResult<T>>;\n  /** The absolute URL, for an `EventSource`, an `<img src>`, or a download. */\n  url(init?: Pick<ApiCallInit, 'query' | 'params'>): string;\n  readonly spec: ApiRouteSpec<unknown>;\n}\n\n/** A streaming route: addressable, not callable. */\nexport interface ApiStreamMethod {\n  url(init?: Pick<ApiCallInit, 'query' | 'params'>): string;\n  readonly spec: ApiRouteSpec<unknown>;\n}\n\nexport type ApiScopeClient<TRoutes extends ApiRoutes> = {\n  readonly [K in keyof TRoutes]: TRoutes[K] extends { readonly stream: true }\n    ? ApiStreamMethod\n    : ApiMethod<ResponseOf<TRoutes[K]>>;\n};\n\ninterface ApiScopeAccessors<TRoutes extends ApiRoutes> {\n  readonly global: ApiScopeClient<TRoutes>;\n  readonly workspace: (workspaceId: string) => ApiScopeClient<TRoutes>;\n  readonly session: (sessionId: string) => ApiScopeClient<TRoutes>;\n}\n\n/**\n * The client, carrying an accessor only for the scopes the package mounts at.\n *\n * A package serving sessions has `session` and nothing else, so addressing it\n * globally is a missing property rather than a 404 discovered at runtime. This\n * is the whole of the scope guarantee, and it costs no test.\n */\nexport type ApiClient<TScopes extends ApiScopeName, TRoutes extends ApiRoutes> = Pick<\n  ApiScopeAccessors<TRoutes>,\n  TScopes\n>;\n\n/** Identity with inference, so a route table keeps its literal types. */\nexport function defineApiRoutes<const TRoutes extends ApiRoutes>(routes: TRoutes): TRoutes {\n  return routes;\n}\n\nfunction isRecord(value: unknown): value is Record<string, unknown> {\n  return typeof value === 'object' && value !== null && !Array.isArray(value);\n}\n\n/** The body a route answered, or undefined when it sent none or sent non-JSON. */\nasync function readBody(response: Response): Promise<unknown> {\n  const text = await response.text();\n  if (text === '') return undefined;\n  try {\n    return JSON.parse(text) as unknown;\n  } catch {\n    return undefined;\n  }\n}\n\n/**\n * The message a route reported, or an empty string.\n *\n * Empty rather than invented: callers own the words their users read, and a\n * generic sentence from here would appear in a dozen packages that each already\n * have their own.\n */\nfunction errorOf(data: unknown): string {\n  return isRecord(data) && typeof data.error === 'string' ? data.error : '';\n}\n\n/**\n * What the sealed relay can carry verbatim.\n *\n * Named here rather than borrowed from `BodyInit`, which the node build has no\n * lib for, and which is anyway wider than the truth: `FormData` and a\n * `ReadableStream` are both refused when a session is remote.\n */\nexport type ApiRequestBody = string | Blob | ArrayBuffer | ArrayBufferView | URLSearchParams;\n\n/** Anything the sealed transport can carry verbatim; everything else becomes JSON. */\nfunction encodeBody(body: unknown): { body?: ApiRequestBody; contentType?: string } {\n  if (body === undefined) return {};\n  if (\n    typeof body === 'string' ||\n    body instanceof Blob ||\n    body instanceof ArrayBuffer ||\n    ArrayBuffer.isView(body) ||\n    body instanceof URLSearchParams\n  ) {\n    return { body };\n  }\n  return { body: JSON.stringify(body), contentType: 'application/json' };\n}\n\nexport interface ApiClientOptions<TScopes extends ApiScopeName> {\n  /** Scopes the package's routed api/ tree actually mounts at. The build supplies these. */\n  readonly scopes: readonly TScopes[];\n  /** The mount segment. The build reads it off the api/<base-path>/ folder. */\n  readonly basePath: string;\n  readonly transport: ApiTransport;\n  /** Resolves which workspace owns a session; the host binds it from its own summaries. */\n  readonly sessionAddress: (sessionId: string) => ApiScopeAddress;\n}\n\n/**\n * One route, as the page calls it.\n *\n * A streaming route is returned as a plain object with no call signature, not\n * merely typed as one. The type stops an author; the missing function stops a\n * cast, a JavaScript caller, and a generic helper that iterates the client.\n * Calling one over a tunnel would buffer forever rather than fail, and that is\n * too quiet a way to lose an afternoon.\n */\nfunction methodFor(\n  spec: ApiRouteSpec<unknown>,\n  address: ApiScopeAddress,\n  options: ApiClientOptions<ApiScopeName>,\n): ApiMethod<unknown> | ApiStreamMethod {\n  const basePath = spec.host === true ? undefined : options.basePath;\n  const url = (init?: Pick<ApiCallInit, 'query' | 'params'>): string =>\n    pluginApiUrl(address, basePath, spec.path, init?.query, init?.params);\n\n  const call = async (init?: ApiCallInit): Promise<ApiResult<unknown>> => {\n    const encoded = encodeBody(init?.body);\n    const headers = {\n      ...(encoded.contentType === undefined ? {} : { 'content-type': encoded.contentType }),\n      ...init?.headers,\n    };\n    let response: Response;\n    try {\n      response = await options.transport(url(init), {\n        method: spec.method,\n        ...(init?.signal === undefined ? {} : { signal: init.signal }),\n        ...(Object.keys(headers).length === 0 ? {} : { headers }),\n        // Cast because the node build's `BodyInit` enumerates concrete typed\n        // arrays rather than accepting `ArrayBufferView`. Every value reaching\n        // here is one fetch already carries; the two libs disagree about the\n        // type, not the runtime.\n        ...(encoded.body === undefined ? {} : { body: encoded.body as RequestInit['body'] }),\n      });\n    } catch {\n      return { ok: false, status: 0, error: '', data: undefined };\n    }\n    // A raw route's body belongs to the caller, and reading it here to look\n    // for an `error` would spend the one read it gets.\n    if (spec.raw === true) {\n      if (!response.ok) return { ok: false, status: response.status, error: '', data: undefined, response };\n      return { ok: true, status: response.status, data: undefined, response };\n    }\n    const data = await readBody(response);\n    if (!response.ok) return { ok: false, status: response.status, error: errorOf(data), data, response };\n    return { ok: true, status: response.status, data, response };\n  };\n\n  if (spec.stream === true) return { url, spec };\n  return Object.assign(call, { url, spec });\n}\n\nfunction scopeClient<TRoutes extends ApiRoutes>(\n  routes: TRoutes,\n  address: ApiScopeAddress,\n  options: ApiClientOptions<ApiScopeName>,\n): ApiScopeClient<TRoutes> {\n  const client: Record<string, ApiMethod<unknown> | ApiStreamMethod> = {};\n  for (const [key, spec] of Object.entries(routes)) client[key] = methodFor(spec, address, options);\n  return client as ApiScopeClient<TRoutes>;\n}\n\n/**\n * Binds a route table to one package's mount.\n *\n * Only the scopes named in `options.scopes` get an accessor, so the returned\n * value describes exactly what this package serves and nothing else.\n */\nexport function createApiClient<const TScopes extends ApiScopeName, const TRoutes extends ApiRoutes>(\n  routes: TRoutes,\n  options: ApiClientOptions<TScopes>,\n): ApiClient<TScopes, TRoutes> {\n  const wide = options as ApiClientOptions<ApiScopeName>;\n  const accessors: { -readonly [K in keyof ApiScopeAccessors<TRoutes>]?: ApiScopeAccessors<TRoutes>[K] } = {};\n  for (const scope of options.scopes) {\n    if (scope === 'global') accessors.global = scopeClient(routes, { scope: 'global' }, wide);\n    if (scope === 'workspace') {\n      accessors.workspace = (workspaceId: string) => scopeClient(routes, { scope: 'workspace', workspaceId }, wide);\n    }\n    if (scope === 'session') {\n      accessors.session = (sessionId: string) => scopeClient(routes, wide.sessionAddress(sessionId), wide);\n    }\n  }\n  return accessors as ApiClient<TScopes, TRoutes>;\n}\n"],"mappings":";;;;;;;;;;;;;;;;AA8BA,SAAgB,cAAmC,CAEnD;;AAqIA,SAAgB,gBAAiD,QAA0B;CACzF,OAAO;AACT;AAEA,SAAS,SAAS,OAAkD;CAClE,OAAO,OAAO,UAAU,YAAY,UAAU,QAAQ,CAAC,MAAM,QAAQ,KAAK;AAC5E;;AAGA,eAAe,SAAS,UAAsC;CAC5D,MAAM,OAAO,MAAM,SAAS,KAAK;CACjC,IAAI,SAAS,IAAI,OAAO,KAAA;CACxB,IAAI;EACF,OAAO,KAAK,MAAM,IAAI;CACxB,QAAQ;EACN;CACF;AACF;;;;;;;;AASA,SAAS,QAAQ,MAAuB;CACtC,OAAO,SAAS,IAAI,KAAK,OAAO,KAAK,UAAU,WAAW,KAAK,QAAQ;AACzE;;AAYA,SAAS,WAAW,MAAgE;CAClF,IAAI,SAAS,KAAA,GAAW,OAAO,CAAC;CAChC,IACE,OAAO,SAAS,YAChB,gBAAgB,QAChB,gBAAgB,eAChB,YAAY,OAAO,IAAI,KACvB,gBAAgB,iBAEhB,OAAO,EAAE,KAAK;CAEhB,OAAO;EAAE,MAAM,KAAK,UAAU,IAAI;EAAG,aAAa;CAAmB;AACvE;;;;;;;;;;AAqBA,SAAS,UACP,MACA,SACA,SACsC;CACtC,MAAM,WAAW,KAAK,SAAS,OAAO,KAAA,IAAY,QAAQ;CAC1D,MAAM,OAAO,SACX,aAAa,SAAS,UAAU,KAAK,MAAM,MAAM,OAAO,MAAM,MAAM;CAEtE,MAAM,OAAO,OAAO,SAAoD;EACtE,MAAM,UAAU,WAAW,MAAM,IAAI;EACrC,MAAM,UAAU;GACd,GAAI,QAAQ,gBAAgB,KAAA,IAAY,CAAC,IAAI,EAAE,gBAAgB,QAAQ,YAAY;GACnF,GAAG,MAAM;EACX;EACA,IAAI;EACJ,IAAI;GACF,WAAW,MAAM,QAAQ,UAAU,IAAI,IAAI,GAAG;IAC5C,QAAQ,KAAK;IACb,GAAI,MAAM,WAAW,KAAA,IAAY,CAAC,IAAI,EAAE,QAAQ,KAAK,OAAO;IAC5D,GAAI,OAAO,KAAK,OAAO,CAAC,CAAC,WAAW,IAAI,CAAC,IAAI,EAAE,QAAQ;IAKvD,GAAI,QAAQ,SAAS,KAAA,IAAY,CAAC,IAAI,EAAE,MAAM,QAAQ,KAA4B;GACpF,CAAC;EACH,QAAQ;GACN,OAAO;IAAE,IAAI;IAAO,QAAQ;IAAG,OAAO;IAAI,MAAM,KAAA;GAAU;EAC5D;EAGA,IAAI,KAAK,QAAQ,MAAM;GACrB,IAAI,CAAC,SAAS,IAAI,OAAO;IAAE,IAAI;IAAO,QAAQ,SAAS;IAAQ,OAAO;IAAI,MAAM,KAAA;IAAW;GAAS;GACpG,OAAO;IAAE,IAAI;IAAM,QAAQ,SAAS;IAAQ,MAAM,KAAA;IAAW;GAAS;EACxE;EACA,MAAM,OAAO,MAAM,SAAS,QAAQ;EACpC,IAAI,CAAC,SAAS,IAAI,OAAO;GAAE,IAAI;GAAO,QAAQ,SAAS;GAAQ,OAAO,QAAQ,IAAI;GAAG;GAAM;EAAS;EACpG,OAAO;GAAE,IAAI;GAAM,QAAQ,SAAS;GAAQ;GAAM;EAAS;CAC7D;CAEA,IAAI,KAAK,WAAW,MAAM,OAAO;EAAE;EAAK;CAAK;CAC7C,OAAO,OAAO,OAAO,MAAM;EAAE;EAAK;CAAK,CAAC;AAC1C;AAEA,SAAS,YACP,QACA,SACA,SACyB;CACzB,MAAM,SAA+D,CAAC;CACtE,KAAK,MAAM,CAAC,KAAK,SAAS,OAAO,QAAQ,MAAM,GAAG,OAAO,OAAO,UAAU,MAAM,SAAS,OAAO;CAChG,OAAO;AACT;;;;;;;AAQA,SAAgB,gBACd,QACA,SAC6B;CAC7B,MAAM,OAAO;CACb,MAAM,YAAmG,CAAC;CAC1G,KAAK,MAAM,SAAS,QAAQ,QAAQ;EAClC,IAAI,UAAU,UAAU,UAAU,SAAS,YAAY,QAAQ,EAAE,OAAO,SAAS,GAAG,IAAI;EACxF,IAAI,UAAU,aACZ,UAAU,aAAa,gBAAwB,YAAY,QAAQ;GAAE,OAAO;GAAa;EAAY,GAAG,IAAI;EAE9G,IAAI,UAAU,WACZ,UAAU,WAAW,cAAsB,YAAY,QAAQ,KAAK,eAAe,SAAS,GAAG,IAAI;CAEvG;CACA,OAAO;AACT"}

package/dist/src/web/services/apiPaths/index.cjs

@@ -0,0 +1,83 @@
+//#region src/web/services/apiPaths/index.ts
+/** The base path the host reserves for its own settings API, mounted outside /plugins/. */
+const SETTINGS_BASE_PATH = "settings";
+/** The scope's own resource root: what a host-owned route hangs off. */
+function scopeApiRoot(address) {
+	if (address.scope === "global") return "/api";
+	const workspace = `/api/workspaces/${encodeURIComponent(address.workspaceId)}`;
+	if (address.scope === "workspace") return workspace;
+	return `${workspace}/sessions/${encodeURIComponent(address.sessionId)}`;
+}
+/**
+* The mount one package API answers on.
+*
+* `basePath` is omitted for a host-owned route, which the contract schema
+* already spells that way, so the session file-bytes route and a plugin route
+* are the same construction with one field different rather than two code
+* paths. `settings` is the host's own API and sits beside `/plugins`, not
+* under it.
+*/
+function pluginApiBase(address, basePath) {
+	const root = scopeApiRoot(address);
+	if (basePath === void 0) return root;
+	if (basePath === "settings") return `${root}/${SETTINGS_BASE_PATH}`;
+	return `${root}/plugins/${basePath}`;
+}
+/**
+* The query string, `encodeURIComponent` per pair rather than `URLSearchParams`.
+*
+* `URLSearchParams` writes a space as `+`, which only decodes back to a space
+* under form-urlencoded rules; `%20` decodes to a space everywhere. The
+* cockpit already relied on that difference in both directions, so picking the
+* unambiguous one is what lets a single encoder serve every route.
+*/
+function apiQueryString(query) {
+	if (query === void 0) return "";
+	const pairs = [];
+	for (const [key, value] of Object.entries(query)) {
+		if (value === void 0) continue;
+		pairs.push(`${encodeURIComponent(key)}=${encodeURIComponent(String(value))}`);
+	}
+	return pairs.length === 0 ? "" : `?${pairs.join("&")}`;
+}
+/**
+* The absolute, root-relative URL for one route.
+*
+* Root-relative on purpose: the sealed transport refuses anything else, because
+* a remote session relays its requests through a gateway that will not forward
+* an arbitrary origin.
+*
+* A route whose path is exactly '/' addresses the mount itself, so the slash is
+* dropped rather than doubled.
+*/
+function pluginApiUrl(address, basePath, path, query, params) {
+	const resolved = applyPathParams(path, params);
+	return `${pluginApiBase(address, basePath)}${resolved === "/" ? "" : resolved}${apiQueryString(query)}`;
+}
+/**
+* Substitutes a route's `:name` segments, as Hono spells them.
+*
+* Encoded per segment, so a value containing a slash names one segment rather
+* than inventing another. A declared parameter with no value is left as the
+* literal `:name`, which fails visibly at the route instead of silently
+* addressing the collection above it.
+*/
+function applyPathParams(path, params) {
+	if (params === void 0 || !path.includes(":")) return path;
+	return path.split("/").map((segment) => {
+		if (!segment.startsWith(":")) return segment;
+		const catchAll = segment.endsWith("}");
+		const value = params[catchAll ? segment.slice(1, segment.indexOf("{")) : segment.slice(1)];
+		if (value === void 0) return segment;
+		return catchAll ? value.split("/").map(encodeURIComponent).join("/") : encodeURIComponent(value);
+	}).join("/");
+}
+//#endregion
+exports.SETTINGS_BASE_PATH = SETTINGS_BASE_PATH;
+exports.apiQueryString = apiQueryString;
+exports.applyPathParams = applyPathParams;
+exports.pluginApiBase = pluginApiBase;
+exports.pluginApiUrl = pluginApiUrl;
+exports.scopeApiRoot = scopeApiRoot;
+
+//# sourceMappingURL=index.cjs.map

package/dist/src/web/services/apiPaths/index.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.cjs","names":[],"sources":["../../../../../src/web/services/apiPaths/index.ts"],"sourcesContent":["/**\n * The byte shape of every URL the browser addresses a package API with.\n *\n * One implementation, because the alternative is what the cockpit had: twelve\n * packages each concatenating `${sessionApiPath(id)}/plugins/${base}${path}` by\n * hand, three of them spelling the prefix a fourth way, and one rewriting it\n * with `String.replace`. A route that moves by one character is answered by the\n * service worker out of the signed bundle cache instead of the network, so the\n * failure is a 404 nowhere near its cause.\n *\n * The host builds the same strings from `doomApiMountPath` and, for OpenAPI\n * templating, from `createApiDocuments`. Those live in the node half of this\n * package and cannot be imported here: `src/web` is a separate tree that reads\n * neither `src/schemas` nor `src/services`. The three are held together by the\n * agreement test instead of by a call, which is the guarantee that matters.\n */\n\n/**\n * Who a request is addressed to. Ids are supplied decoded and encoded here, so\n * a caller never double-encodes and a workspace with a slash in its name cannot\n * forge a path segment.\n */\nexport type ApiScopeAddress =\n  | { readonly scope: 'global' }\n  | { readonly scope: 'workspace'; readonly workspaceId: string }\n  | { readonly scope: 'session'; readonly workspaceId: string; readonly sessionId: string };\n\n/** Path parameter values, substituted into a route's `:name` segments. */\nexport type ApiParams = Readonly<Record<string, string>>;\n\n/** Query values a route may carry. `undefined` drops the parameter rather than sending 'undefined'. */\nexport type ApiQuery = Readonly<Record<string, string | number | boolean | undefined>>;\n\n/** The base path the host reserves for its own settings API, mounted outside /plugins/. */\nexport const SETTINGS_BASE_PATH = 'settings';\n\n/** The scope's own resource root: what a host-owned route hangs off. */\nexport function scopeApiRoot(address: ApiScopeAddress): string {\n  if (address.scope === 'global') return '/api';\n  const workspace = `/api/workspaces/${encodeURIComponent(address.workspaceId)}`;\n  if (address.scope === 'workspace') return workspace;\n  return `${workspace}/sessions/${encodeURIComponent(address.sessionId)}`;\n}\n\n/**\n * The mount one package API answers on.\n *\n * `basePath` is omitted for a host-owned route, which the contract schema\n * already spells that way, so the session file-bytes route and a plugin route\n * are the same construction with one field different rather than two code\n * paths. `settings` is the host's own API and sits beside `/plugins`, not\n * under it.\n */\nexport function pluginApiBase(address: ApiScopeAddress, basePath: string | undefined): string {\n  const root = scopeApiRoot(address);\n  if (basePath === undefined) return root;\n  if (basePath === SETTINGS_BASE_PATH) return `${root}/${SETTINGS_BASE_PATH}`;\n  return `${root}/plugins/${basePath}`;\n}\n\n/**\n * The query string, `encodeURIComponent` per pair rather than `URLSearchParams`.\n *\n * `URLSearchParams` writes a space as `+`, which only decodes back to a space\n * under form-urlencoded rules; `%20` decodes to a space everywhere. The\n * cockpit already relied on that difference in both directions, so picking the\n * unambiguous one is what lets a single encoder serve every route.\n */\nexport function apiQueryString(query: ApiQuery | undefined): string {\n  if (query === undefined) return '';\n  const pairs: string[] = [];\n  for (const [key, value] of Object.entries(query)) {\n    if (value === undefined) continue;\n    pairs.push(`${encodeURIComponent(key)}=${encodeURIComponent(String(value))}`);\n  }\n  return pairs.length === 0 ? '' : `?${pairs.join('&')}`;\n}\n\n/**\n * The absolute, root-relative URL for one route.\n *\n * Root-relative on purpose: the sealed transport refuses anything else, because\n * a remote session relays its requests through a gateway that will not forward\n * an arbitrary origin.\n *\n * A route whose path is exactly '/' addresses the mount itself, so the slash is\n * dropped rather than doubled.\n */\nexport function pluginApiUrl(\n  address: ApiScopeAddress,\n  basePath: string | undefined,\n  path: string,\n  query?: ApiQuery,\n  params?: ApiParams,\n): string {\n  const resolved = applyPathParams(path, params);\n  return `${pluginApiBase(address, basePath)}${resolved === '/' ? '' : resolved}${apiQueryString(query)}`;\n}\n\n/**\n * Substitutes a route's `:name` segments, as Hono spells them.\n *\n * Encoded per segment, so a value containing a slash names one segment rather\n * than inventing another. A declared parameter with no value is left as the\n * literal `:name`, which fails visibly at the route instead of silently\n * addressing the collection above it.\n */\nexport function applyPathParams(path: string, params: ApiParams | undefined): string {\n  if (params === undefined || !path.includes(':')) return path;\n  return path\n    .split('/')\n    .map((segment) => {\n      if (!segment.startsWith(':')) return segment;\n      // Hono writes a multi-segment parameter as `:name{.+}`. Its value is a\n      // relative path, so the slashes inside it are structure the route means\n      // to keep; encoding them would address one oddly-named file instead of a\n      // nested one. Each piece is still escaped on its own.\n      const catchAll = segment.endsWith('}');\n      const name = catchAll ? segment.slice(1, segment.indexOf('{')) : segment.slice(1);\n      const value = params[name];\n      if (value === undefined) return segment;\n      return catchAll ? value.split('/').map(encodeURIComponent).join('/') : encodeURIComponent(value);\n    })\n    .join('/');\n}\n"],"mappings":";;AAkCA,MAAa,qBAAqB;;AAGlC,SAAgB,aAAa,SAAkC;CAC7D,IAAI,QAAQ,UAAU,UAAU,OAAO;CACvC,MAAM,YAAY,mBAAmB,mBAAmB,QAAQ,WAAW;CAC3E,IAAI,QAAQ,UAAU,aAAa,OAAO;CAC1C,OAAO,GAAG,UAAU,YAAY,mBAAmB,QAAQ,SAAS;AACtE;;;;;;;;;;AAWA,SAAgB,cAAc,SAA0B,UAAsC;CAC5F,MAAM,OAAO,aAAa,OAAO;CACjC,IAAI,aAAa,KAAA,GAAW,OAAO;CACnC,IAAI,aAAA,YAAiC,OAAO,GAAG,KAAK,GAAG;CACvD,OAAO,GAAG,KAAK,WAAW;AAC5B;;;;;;;;;AAUA,SAAgB,eAAe,OAAqC;CAClE,IAAI,UAAU,KAAA,GAAW,OAAO;CAChC,MAAM,QAAkB,CAAC;CACzB,KAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,KAAK,GAAG;EAChD,IAAI,UAAU,KAAA,GAAW;EACzB,MAAM,KAAK,GAAG,mBAAmB,GAAG,EAAE,GAAG,mBAAmB,OAAO,KAAK,CAAC,GAAG;CAC9E;CACA,OAAO,MAAM,WAAW,IAAI,KAAK,IAAI,MAAM,KAAK,GAAG;AACrD;;;;;;;;;;;AAYA,SAAgB,aACd,SACA,UACA,MACA,OACA,QACQ;CACR,MAAM,WAAW,gBAAgB,MAAM,MAAM;CAC7C,OAAO,GAAG,cAAc,SAAS,QAAQ,IAAI,aAAa,MAAM,KAAK,WAAW,eAAe,KAAK;AACtG;;;;;;;;;AAUA,SAAgB,gBAAgB,MAAc,QAAuC;CACnF,IAAI,WAAW,KAAA,KAAa,CAAC,KAAK,SAAS,GAAG,GAAG,OAAO;CACxD,OAAO,KACJ,MAAM,GAAG,CAAC,CACV,KAAK,YAAY;EAChB,IAAI,CAAC,QAAQ,WAAW,GAAG,GAAG,OAAO;EAKrC,MAAM,WAAW,QAAQ,SAAS,GAAG;EAErC,MAAM,QAAQ,OADD,WAAW,QAAQ,MAAM,GAAG,QAAQ,QAAQ,GAAG,CAAC,IAAI,QAAQ,MAAM,CAAC;EAEhF,IAAI,UAAU,KAAA,GAAW,OAAO;EAChC,OAAO,WAAW,MAAM,MAAM,GAAG,CAAC,CAAC,IAAI,kBAAkB,CAAC,CAAC,KAAK,GAAG,IAAI,mBAAmB,KAAK;CACjG,CAAC,CAAC,CACD,KAAK,GAAG;AACb"}