@agimon-ai/po-core 0.0.0-alpha.0

package/dist/web.cjs

@@ -0,0 +1,65 @@
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const require_bundleAssetPolicy = require("./src/web/schemas/bundleAssetPolicy.cjs");
+const require_webPlugin = require("./src/extensions/webPlugin.cjs");
+const require_globalStore = require("./src/web/models/globalStore.cjs");
+const require_sessionStore = require("./src/web/models/sessionStore.cjs");
+const require_workspaceStore = require("./src/web/models/workspaceStore.cjs");
+const require_index = require("./src/web/services/toolResult/index.cjs");
+const require_template = require("./src/web/schemas/template.cjs");
+const require_index$1 = require("./src/web/services/apiPaths/index.cjs");
+const require_index$2 = require("./src/web/services/apiRoutes/index.cjs");
+const require_index$3 = require("./src/web/services/apiClient/index.cjs");
+const require_index$4 = require("./src/web/services/sessionRegistry/index.cjs");
+const require_mcpWidget = require("./src/web/services/mcpWidget.cjs");
+exports.BUNDLE_ASSET_POLICY_PATH = require_bundleAssetPolicy.BUNDLE_ASSET_POLICY_PATH;
+exports.BUNDLE_ASSET_POLICY_VERSION = require_bundleAssetPolicy.BUNDLE_ASSET_POLICY_VERSION;
+exports.HUB_ADVERTISEMENT_VERSION = require_index$4.HUB_ADVERTISEMENT_VERSION;
+exports.REGISTRY_DIR_ENV = require_index$4.REGISTRY_DIR_ENV;
+exports.SETTINGS_BASE_PATH = require_index$1.SETTINGS_BASE_PATH;
+exports.apiQueryString = require_index$1.apiQueryString;
+exports.apiResponse = require_index$3.apiResponse;
+exports.applyPathParams = require_index$1.applyPathParams;
+exports.bindSessionApiWorkspace = require_index$2.bindSessionApiWorkspace;
+exports.createApiClient = require_index$3.createApiClient;
+exports.defineActivityGroup = require_webPlugin.defineActivityGroup;
+exports.defineApiRoutes = require_index$3.defineApiRoutes;
+exports.defineChannelFile = require_webPlugin.defineChannelFile;
+exports.defineContextAction = require_webPlugin.defineContextAction;
+exports.defineDockFace = require_webPlugin.defineDockFace;
+exports.defineFileLinks = require_webPlugin.defineFileLinks;
+exports.defineFill = require_webPlugin.defineFill;
+exports.defineGlobalStore = require_globalStore.defineGlobalStore;
+exports.defineLeaderBinding = require_webPlugin.defineLeaderBinding;
+exports.defineMcpWidget = require_mcpWidget.defineMcpWidget;
+exports.defineMinorModeFile = require_webPlugin.defineMinorModeFile;
+exports.definePaletteCommand = require_webPlugin.definePaletteCommand;
+exports.defineRepositorySettingsPanel = require_webPlugin.defineRepositorySettingsPanel;
+exports.defineSelectionAxis = require_webPlugin.defineSelectionAxis;
+exports.defineSessionChannel = require_webPlugin.defineSessionChannel;
+exports.defineSessionStore = require_sessionStore.defineSessionStore;
+exports.defineSettingsPanel = require_webPlugin.defineSettingsPanel;
+exports.defineSettingsSection = require_webPlugin.defineSettingsSection;
+exports.defineSlot = require_webPlugin.defineSlot;
+exports.defineSlotFile = require_webPlugin.defineSlotFile;
+exports.defineTab = require_webPlugin.defineTab;
+exports.defineToolRenderer = require_webPlugin.defineToolRenderer;
+exports.defineUserMessageAction = require_webPlugin.defineUserMessageAction;
+exports.defineWebLifecycle = require_webPlugin.defineWebLifecycle;
+exports.defineWebPlugin = require_webPlugin.defineWebPlugin;
+exports.defineWebTemplate = require_webPlugin.defineWebTemplate;
+exports.defineWorkspaceStore = require_workspaceStore.defineWorkspaceStore;
+exports.globalApiPath = require_index$2.globalApiPath;
+exports.hubAdvertisementPath = require_index$4.hubAdvertisementPath;
+exports.parseBundleAssetPolicy = require_bundleAssetPolicy.parseBundleAssetPolicy;
+exports.parseHubAdvertisement = require_index$4.parseHubAdvertisement;
+exports.parseNativeTemplate = require_template.parseNativeTemplate;
+exports.parseWebTemplate = require_template.parseWebTemplate;
+exports.pluginApiBase = require_index$1.pluginApiBase;
+exports.pluginApiUrl = require_index$1.pluginApiUrl;
+exports.resolveRegistryDir = require_index$4.resolveRegistryDir;
+exports.scopeApiRoot = require_index$1.scopeApiRoot;
+exports.sessionApiAddress = require_index$2.sessionApiAddress;
+exports.sessionApiPath = require_index$2.sessionApiPath;
+exports.toolResultText = require_index.toolResultText;
+exports.toolResultTextLines = require_index.toolResultTextLines;
+exports.workspaceApiPath = require_index$2.workspaceApiPath;

package/dist/web.d.mts

@@ -0,0 +1,20 @@
+import { BUNDLE_ASSET_POLICY_PATH, BUNDLE_ASSET_POLICY_VERSION, BundleAssetPolicy, parseBundleAssetPolicy } from "./src/web/schemas/bundleAssetPolicy.mjs";
+import { DoomMcpWidgetProps } from "./src/web/types/mcpWidget.mjs";
+import { WebTemplateContribution, WebTemplateHeaderOptions, WebTemplateRail, WebTemplateRailActions, WebTemplateRailDirectoryListing, WebTemplateRailPendingSetup, WebTemplateRailResult, WebTemplateRailSession, WebTemplateRailWorkspace } from "./src/web/types/template.mjs";
+import { NativeTemplateContribution, NativeTemplateScreens, NativeTemplateSessionsProps } from "./src/web/types/nativeTemplate.mjs";
+import { ModelContext, ModelContextAbortSignal, ModelContextBinding, ModelContextExecutionOptions, ModelContextRegistrationOptions, ModelContextTool, ModelContextToolChangeEvent, ModelContextToolChangeListener, ModelContextToolDescriptor } from "./src/web/types/modelContext.mjs";
+import { ActivityGroupContribution, CaptureStatusEvent, ComposerCapture, ComposerSubmission, ContextAction, ContextActionContribution, ContextActionRunContext, DockFaceContribution, FileLinkSource, GlobalStore, LeaderBindingContribution, LeaderKeyContribution, MinorModeContribution, PaletteCommandContext, PaletteCommandContribution, RepositorySettingsPanelContribution, RepositorySettingsPanelProps, RepositorySettingsRepository, SelectionAxisContribution, SessionChannelContribution, SessionFrameSender, SessionRecords, SessionStore, SessionStoreChannel, SettingsFieldContribution, SettingsFieldOption, SettingsPanelContribution, SettingsPanelProps, SettingsSectionContribution, SlotDataFill, SlotDeclaration, SlotFillContribution, SurfaceContribution, TabContribution, ThreadViewOptions, ToolCompletionEvent, ToolMessageRenderProps, ToolPromptContribution, ToolPromptDialog, ToolPromptRenderProps, ToolRendererContribution, ToolResultView, TransientTab, UserMessageActionContribution, UserMessageActionRunContext, WebPluginContextInventoryItem, WebPluginContextItem, WebPluginContributions, WebPluginDefinition, WebPluginMount, WebPluginNewSessionContext, WebPluginRuntime, WebPluginScope, WebPluginSessionContext, WebPluginSlotProps, WorkspaceRecords, WorkspaceStore } from "./src/web/types/webPlugin.mjs";
+import { ActivityGroupFile, ChannelFile, ContextActionFile, DockFaceFile, FillFile, LeaderBindingFile, MinorModeFile, PaletteCommandFile, SelectionAxisFile, SettingsPanelFile, SettingsSectionFile, SlotFile, TabFile, ToolRendererFile, UserMessageActionFile, WebTemplateFile } from "./src/web/types/extensionFile.mjs";
+import { defineActivityGroup, defineChannelFile, defineContextAction, defineDockFace, defineFileLinks, defineFill, defineLeaderBinding, defineMinorModeFile, definePaletteCommand, defineRepositorySettingsPanel, defineSelectionAxis, defineSessionChannel, defineSettingsPanel, defineSettingsSection, defineSlot, defineSlotFile, defineTab, defineToolRenderer, defineUserMessageAction, defineWebLifecycle, defineWebPlugin, defineWebTemplate } from "./src/extensions/webPlugin.mjs";
+import { defineGlobalStore } from "./src/web/models/globalStore.mjs";
+import { defineSessionStore } from "./src/web/models/sessionStore.mjs";
+import { defineWorkspaceStore } from "./src/web/models/workspaceStore.mjs";
+import { toolResultText, toolResultTextLines } from "./src/web/services/toolResult/index.mjs";
+import { parseNativeTemplate, parseWebTemplate } from "./src/web/schemas/template.mjs";
+import { ApiParams, ApiQuery, ApiScopeAddress, SETTINGS_BASE_PATH, apiQueryString, applyPathParams, pluginApiBase, pluginApiUrl, scopeApiRoot } from "./src/web/services/apiPaths/index.mjs";
+import { bindSessionApiWorkspace, globalApiPath, sessionApiAddress, sessionApiPath, workspaceApiPath } from "./src/web/services/apiRoutes/index.mjs";
+import { ApiCallInit, ApiClient, ApiClientOptions, ApiMethod, ApiResponseOf, ApiResult, ApiRouteMethod, ApiRouteSpec, ApiRoutes, ApiScopeClient, ApiScopeName, ApiStreamMethod, ApiTransport, apiResponse, createApiClient, defineApiRoutes } from "./src/web/services/apiClient/index.mjs";
+import { HubAdvertisement, RegistryDirInput } from "./src/web/types/sessionRegistry.mjs";
+import { HUB_ADVERTISEMENT_VERSION, REGISTRY_DIR_ENV, hubAdvertisementPath, parseHubAdvertisement, resolveRegistryDir } from "./src/web/services/sessionRegistry/index.mjs";
+import { defineMcpWidget } from "./src/web/services/mcpWidget.mjs";
+export { type ActivityGroupContribution, type ActivityGroupFile, type ApiCallInit, type ApiClient, type ApiClientOptions, type ApiMethod, type ApiParams, type ApiQuery, type ApiResponseOf, type ApiResult, type ApiRouteMethod, type ApiRouteSpec, type ApiRoutes, type ApiScopeAddress, type ApiScopeClient, type ApiScopeName, type ApiStreamMethod, type ApiTransport, BUNDLE_ASSET_POLICY_PATH, BUNDLE_ASSET_POLICY_VERSION, type BundleAssetPolicy, type CaptureStatusEvent, type ChannelFile, type ComposerCapture, type ComposerSubmission, type ContextAction, type ContextActionContribution, type ContextActionFile, type ContextActionRunContext, type DockFaceContribution, type DockFaceFile, type DoomMcpWidgetProps, type FileLinkSource, type FillFile, type GlobalStore, HUB_ADVERTISEMENT_VERSION, type HubAdvertisement, type LeaderBindingContribution, type LeaderBindingFile, type LeaderKeyContribution, type MinorModeContribution, type MinorModeFile, type ModelContext, type ModelContextAbortSignal, type ModelContextBinding, type ModelContextExecutionOptions, type ModelContextRegistrationOptions, type ModelContextTool, type ModelContextToolChangeEvent, type ModelContextToolChangeListener, type ModelContextToolDescriptor, type NativeTemplateContribution, type NativeTemplateScreens, type NativeTemplateSessionsProps, type PaletteCommandContext, type PaletteCommandContribution, type PaletteCommandFile, REGISTRY_DIR_ENV, type RegistryDirInput, type RepositorySettingsPanelContribution, type RepositorySettingsPanelProps, type RepositorySettingsRepository, SETTINGS_BASE_PATH, type SelectionAxisContribution, type SelectionAxisFile, type SessionChannelContribution, type SessionFrameSender, type SessionRecords, type SessionStore, type SessionStoreChannel, type SettingsFieldContribution, type SettingsFieldOption, type SettingsPanelContribution, type SettingsPanelFile, type SettingsPanelProps, type SettingsSectionContribution, type SettingsSectionFile, type SlotDataFill, type SlotDeclaration, type SlotFile, type SlotFillContribution, type SurfaceContribution, type TabContribution, type TabFile, type ThreadViewOptions, type ToolCompletionEvent, type ToolMessageRenderProps, type ToolPromptContribution, type ToolPromptDialog, type ToolPromptRenderProps, type ToolRendererContribution, type ToolRendererFile, type ToolResultView, type TransientTab, type UserMessageActionContribution, type UserMessageActionFile, type UserMessageActionRunContext, type WebPluginContextInventoryItem, type WebPluginContextItem, type WebPluginContributions, type WebPluginDefinition, type WebPluginMount, type WebPluginNewSessionContext, type WebPluginRuntime, type WebPluginScope, type WebPluginSessionContext, type WebPluginSlotProps, type WebTemplateContribution, type WebTemplateFile, type WebTemplateHeaderOptions, type WebTemplateRail, type WebTemplateRailActions, type WebTemplateRailDirectoryListing, type WebTemplateRailPendingSetup, type WebTemplateRailResult, type WebTemplateRailSession, type WebTemplateRailWorkspace, type WorkspaceRecords, type WorkspaceStore, apiQueryString, apiResponse, applyPathParams, bindSessionApiWorkspace, createApiClient, defineActivityGroup, defineApiRoutes, defineChannelFile, defineContextAction, defineDockFace, defineFileLinks, defineFill, defineGlobalStore, defineLeaderBinding, defineMcpWidget, defineMinorModeFile, definePaletteCommand, defineRepositorySettingsPanel, defineSelectionAxis, defineSessionChannel, defineSessionStore, defineSettingsPanel, defineSettingsSection, defineSlot, defineSlotFile, defineTab, defineToolRenderer, defineUserMessageAction, defineWebLifecycle, defineWebPlugin, defineWebTemplate, defineWorkspaceStore, globalApiPath, hubAdvertisementPath, parseBundleAssetPolicy, parseHubAdvertisement, parseNativeTemplate, parseWebTemplate, pluginApiBase, pluginApiUrl, resolveRegistryDir, scopeApiRoot, sessionApiAddress, sessionApiPath, toolResultText, toolResultTextLines, workspaceApiPath };

package/dist/web.mjs

@@ -0,0 +1,13 @@
+import { BUNDLE_ASSET_POLICY_PATH, BUNDLE_ASSET_POLICY_VERSION, parseBundleAssetPolicy } from "./src/web/schemas/bundleAssetPolicy.mjs";
+import { defineActivityGroup, defineChannelFile, defineContextAction, defineDockFace, defineFileLinks, defineFill, defineLeaderBinding, defineMinorModeFile, definePaletteCommand, defineRepositorySettingsPanel, defineSelectionAxis, defineSessionChannel, defineSettingsPanel, defineSettingsSection, defineSlot, defineSlotFile, defineTab, defineToolRenderer, defineUserMessageAction, defineWebLifecycle, defineWebPlugin, defineWebTemplate } from "./src/extensions/webPlugin.mjs";
+import { defineGlobalStore } from "./src/web/models/globalStore.mjs";
+import { defineSessionStore } from "./src/web/models/sessionStore.mjs";
+import { defineWorkspaceStore } from "./src/web/models/workspaceStore.mjs";
+import { toolResultText, toolResultTextLines } from "./src/web/services/toolResult/index.mjs";
+import { parseNativeTemplate, parseWebTemplate } from "./src/web/schemas/template.mjs";
+import { SETTINGS_BASE_PATH, apiQueryString, applyPathParams, pluginApiBase, pluginApiUrl, scopeApiRoot } from "./src/web/services/apiPaths/index.mjs";
+import { bindSessionApiWorkspace, globalApiPath, sessionApiAddress, sessionApiPath, workspaceApiPath } from "./src/web/services/apiRoutes/index.mjs";
+import { apiResponse, createApiClient, defineApiRoutes } from "./src/web/services/apiClient/index.mjs";
+import { HUB_ADVERTISEMENT_VERSION, REGISTRY_DIR_ENV, hubAdvertisementPath, parseHubAdvertisement, resolveRegistryDir } from "./src/web/services/sessionRegistry/index.mjs";
+import { defineMcpWidget } from "./src/web/services/mcpWidget.mjs";
+export { BUNDLE_ASSET_POLICY_PATH, BUNDLE_ASSET_POLICY_VERSION, HUB_ADVERTISEMENT_VERSION, REGISTRY_DIR_ENV, SETTINGS_BASE_PATH, apiQueryString, apiResponse, applyPathParams, bindSessionApiWorkspace, createApiClient, defineActivityGroup, defineApiRoutes, defineChannelFile, defineContextAction, defineDockFace, defineFileLinks, defineFill, defineGlobalStore, defineLeaderBinding, defineMcpWidget, defineMinorModeFile, definePaletteCommand, defineRepositorySettingsPanel, defineSelectionAxis, defineSessionChannel, defineSessionStore, defineSettingsPanel, defineSettingsSection, defineSlot, defineSlotFile, defineTab, defineToolRenderer, defineUserMessageAction, defineWebLifecycle, defineWebPlugin, defineWebTemplate, defineWorkspaceStore, globalApiPath, hubAdvertisementPath, parseBundleAssetPolicy, parseHubAdvertisement, parseNativeTemplate, parseWebTemplate, pluginApiBase, pluginApiUrl, resolveRegistryDir, scopeApiRoot, sessionApiAddress, sessionApiPath, toolResultText, toolResultTextLines, workspaceApiPath };

package/dist/webCompositions.cjs

@@ -0,0 +1,181 @@
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const require_runtime = require("./_virtual/_rolldown/runtime.cjs");
+const require_remote = require("./src/constants/remote.cjs");
+const require_index = require("./src/services/bundlePublication/index.cjs");
+let node_crypto = require("node:crypto");
+node_crypto = require_runtime.__toESM(node_crypto, 1);
+let node_fs = require("node:fs");
+node_fs = require_runtime.__toESM(node_fs, 1);
+let node_path = require("node:path");
+node_path = require_runtime.__toESM(node_path, 1);
+let _agimon_ai_po_web_security = require("@agimon-ai/po-web-security");
+//#region src/services/webCompositions/index.ts
+const absolute = (file) => file.startsWith("/") ? file : `/${file}`;
+/** The build's plugin copies for exactly the given slots, in slot order. */
+function slotPlugins(build, slots) {
+	return slots.flatMap((slot) => build.plugins.filter((plugin) => plugin.slot === slot));
+}
+/**
+* The stylesheets of exactly the given slots, each loaded once: the stylesheets their code
+* imports first, then each slot's own stylesheet in slot order.
+*/
+function mountStylePaths(build, slots) {
+	const paths = slots.map((slot) => build.pluginStyles[slot]).filter((style) => style !== void 0);
+	if (paths.length === 0 && build.baseStyle !== void 0) paths.push(build.baseStyle);
+	const imported = slotPlugins(build, slots).flatMap((plugin) => plugin.css);
+	return [...new Set([...imported, ...paths].map(absolute))];
+}
+/** Every file the given slots can load: their reachable files and static stylesheets, each once. */
+function mountAssetPaths(build, slots) {
+	return [...new Set(slotPlugins(build, slots).flatMap((plugin) => [...plugin.files, ...plugin.css]).map(absolute))];
+}
+const sha256 = (value) => node_crypto.default.createHash("sha256").update(value).digest("hex");
+/**
+* Signs the global build once and hands each mount a composition naming its own plugins.
+*
+* Every mount of one build shares a publication id, so the bytes are counted per mount and
+* released only when the last mount leaves or moves to another build.
+*/
+function createWebCompositions(stateDirectory, onNotice) {
+	const publication = require_index.createPluginBundlePublication(stateDirectory, onNotice);
+	let shell;
+	const mounts = /* @__PURE__ */ new Map();
+	const nativeMounts = /* @__PURE__ */ new Map();
+	const references = /* @__PURE__ */ new Map();
+	const keyOf = (mount) => mount.scope === "global" ? "global" : mount.scope === "workspace" ? `workspace:${mount.workspaceId}` : `session:${mount.sessionId}`;
+	const release = (id) => {
+		const count = (references.get(id) ?? 0) - 1;
+		if (count > 0) {
+			references.set(id, count);
+			return;
+		}
+		references.delete(id);
+		publication.release(id);
+	};
+	return {
+		publishShell(build) {
+			shell = publication.publish(sha256(`shell:${build.key}`), build.webDirectory);
+			if (!shell) throw new Error("Could not publish the global web shell.");
+		},
+		shellTrust: () => shell === void 0 ? void 0 : {
+			publicKey: shell.signed.publicKey,
+			revision: shell.signed.manifest.revision
+		},
+		publish(mount, build, channels, slots) {
+			const id = sha256(`plugins:${build.key}`);
+			const published = publication.publish(id, build.pluginsDirectory);
+			if (!published) throw new Error(`Could not publish ${keyOf(mount)} web composition.`);
+			const previous = mounts.get(keyOf(mount));
+			if (previous?.id !== id) references.set(id, (references.get(id) ?? 0) + 1);
+			const revision = published.signed.manifest.revision;
+			const base = `/api/web-plugins/${id}/${String(revision)}`;
+			const signedPaths = new Set(published.signed.manifest.assets.map((asset) => asset.path));
+			const composition = {
+				id,
+				scope: mount.scope,
+				revision,
+				manifestUrl: `${base}/manifest`,
+				rawAssetBaseUrl: `${base}/assets`,
+				verifiedAssetBaseUrl: `/verified-plugins/${id}/${String(revision)}`,
+				pluginEntries: slotPlugins(build, slots).map((plugin) => [plugin.slot, absolute(plugin.entry)]),
+				assetPaths: mountAssetPaths(build, slots).filter((file) => signedPaths.has(file)),
+				stylePaths: mountStylePaths(build, slots).filter((style) => signedPaths.has(style)),
+				channels: [...channels],
+				plugins: [...slots]
+			};
+			mounts.set(keyOf(mount), composition);
+			if (previous !== void 0 && previous.id !== id) release(previous.id);
+			return composition;
+		},
+		get: (mount) => mounts.get(keyOf(mount)),
+		remove: (mount) => {
+			const previous = mounts.get(keyOf(mount));
+			mounts.delete(keyOf(mount));
+			if (previous) release(previous.id);
+		},
+		/**
+		* Publishes the native composition for one mount. Signed under the `native` profile, so it can
+		* never be served or verified as a web bundle. Shares reference counting with web publications.
+		*/
+		publishNative(mount, build, channels, pluginIds) {
+			const id = sha256(`native:${build.key}`);
+			const published = publication.publish(id, build.pluginsDirectory, "native");
+			if (!published) throw new Error(`Could not publish ${keyOf(mount)} native composition.`);
+			const previous = nativeMounts.get(keyOf(mount));
+			if (previous?.id !== id) references.set(id, (references.get(id) ?? 0) + 1);
+			const revision = published.signed.manifest.revision;
+			const base = `/api/web-plugins/${id}/${String(revision)}`;
+			const composition = {
+				id,
+				scope: mount.scope,
+				revision,
+				manifestUrl: `${base}/manifest`,
+				rawAssetBaseUrl: `${base}/assets`,
+				entryPath: _agimon_ai_po_web_security.NATIVE_ENTRY_PATH,
+				channels: [...channels],
+				plugins: [...pluginIds]
+			};
+			nativeMounts.set(keyOf(mount), composition);
+			if (previous !== void 0 && previous.id !== id) release(previous.id);
+			return composition;
+		},
+		getNative: (mount) => nativeMounts.get(keyOf(mount)),
+		removeNative: (mount) => {
+			const previous = nativeMounts.get(keyOf(mount));
+			nativeMounts.delete(keyOf(mount));
+			if (previous) release(previous.id);
+		},
+		/**
+		* Signs `po/host-channel-key/v1` with the shell publication's signer, the key the pairing QR pins
+		* as `s`. Undefined until the shell is published.
+		*/
+		attestHost: (fields) => shell === void 0 ? void 0 : publication.attest(require_remote.HOST_CHANNEL_KEY_TAG, fields),
+		publicKey: () => publication.publicKey(),
+		async request(request) {
+			const url = new URL(request.url);
+			if ((url.pathname === "/bundle-manifest.json" || url.pathname.startsWith("/bundle-assets/")) && request.method !== "GET" && request.method !== "HEAD") return new Response(null, { status: 405 });
+			if (url.pathname === "/bundle-manifest.json") {
+				if (!shell) return new Response(null, { status: 404 });
+				return Response.json(shell.signed);
+			}
+			const shellAsset = /^\/bundle-assets\/(\d+)(\/.*)$/u.exec(url.pathname);
+			if (shellAsset) {
+				if (!shell || Number(shellAsset[1]) !== shell.signed.manifest.revision) return new Response(null, { status: 404 });
+				const asset = shell.signed.manifest.assets.find((entry) => entry.path === shellAsset[2]);
+				if (!asset) return new Response(null, { status: 404 });
+				const bytes = await node_fs.default.promises.readFile(node_path.default.join(shell.assetsDir, asset.path));
+				return new Response(request.method === "HEAD" ? null : bytes, { headers: {
+					"content-type": asset.contentType,
+					"x-content-type-options": "nosniff"
+				} });
+			}
+			const match = /^\/api\/web-plugins\/([a-f0-9]{64})\/(\d+)\/(manifest|assets(?:\/.*)?)$/u.exec(url.pathname);
+			if (!match) return void 0;
+			if (request.method !== "GET" && request.method !== "HEAD") return new Response(null, { status: 405 });
+			const bundle = publication.get(match[1], Number(match[2]));
+			if (!bundle) return Response.json({ error: "Plugin generation not found." }, { status: 404 });
+			if (match[3] === "manifest") return Response.json(bundle.signed);
+			const assetPath = match[3].slice(6);
+			const asset = bundle.signed.manifest.assets.find((candidate) => candidate.path === assetPath);
+			if (!asset) return Response.json({ error: "Plugin asset not found." }, { status: 404 });
+			const bytes = await node_fs.default.promises.readFile(node_path.default.join(bundle.assetsDir, asset.path));
+			return new Response(request.method === "HEAD" ? null : bytes, { headers: {
+				"content-type": asset.contentType,
+				"cache-control": "private, max-age=31536000, immutable",
+				"x-content-type-options": "nosniff"
+			} });
+		},
+		close() {
+			mounts.clear();
+			nativeMounts.clear();
+			references.clear();
+			publication.close();
+		}
+	};
+}
+//#endregion
+exports.createWebCompositions = createWebCompositions;
+exports.mountAssetPaths = mountAssetPaths;
+exports.mountStylePaths = mountStylePaths;
+
+//# sourceMappingURL=webCompositions.cjs.map

package/dist/webCompositions.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"webCompositions.cjs","names":["crypto","createPluginBundlePublication","NATIVE_ENTRY_PATH","HOST_CHANNEL_KEY_TAG","fs","path"],"sources":["../src/services/webCompositions/index.ts"],"sourcesContent":["import crypto from 'node:crypto';\nimport fs from 'node:fs';\nimport path from 'node:path';\n\nimport { NATIVE_ENTRY_PATH } from '@agimon-ai/po-web-security';\n\nimport { HOST_CHANNEL_KEY_TAG } from '../../constants/remote';\nimport type { DoomApiMount, DoomNativeComposition, DoomWebComposition } from '../../exports/packageApi';\nimport { createPluginBundlePublication, type PublishedBundle } from '../bundlePublication';\n\n/** One plugin copy in a global web build: its slot entry and the files that entry can load. */\nexport interface GlobalWebBuildPlugin {\n  pluginId: string;\n  /** The copy's identity: the pluginId for a host plugin, else the pluginId plus a package hash. */\n  slot: string;\n  packageDir: string;\n  isHost: boolean;\n  /** The slot entry module below `pluginsDirectory`. */\n  entry: string;\n  /** Every file below `pluginsDirectory` the entry reaches through static and dynamic imports, plus its stylesheet. */\n  files: readonly string[];\n  /** The stylesheets of the entry's static import closure. */\n  css: readonly string[];\n}\n\n/** One global web build: the shell, the shared plugin composition, and one stylesheet per plugin copy. */\nexport interface GlobalWebBuild {\n  /** Content key of the build; equal keys hold identical bytes. */\n  key: string;\n  /** Signed cockpit shell directory. */\n  webDirectory: string;\n  /** Shared plugin composition directory, published once for every mount. */\n  pluginsDirectory: string;\n  /** Every plugin copy in the build, in build order. */\n  plugins: readonly GlobalWebBuildPlugin[];\n  /** Content-hashed stylesheet paths below `pluginsDirectory`, keyed by slot. */\n  pluginStyles: Readonly<Record<string, string>>;\n  /** Stylesheet a mount without plugin styles still loads, for the host shell and fallback template. */\n  baseStyle?: string;\n}\n\n/** One global native build: a single signed CommonJS composition shared by every mount. */\nexport interface GlobalNativeBuild {\n  /** Content key of the build; equal keys hold identical bytes. */\n  key: string;\n  /** Directory holding exactly `/composition.js`. */\n  pluginsDirectory: string;\n}\n\nconst absolute = (file: string): string => (file.startsWith('/') ? file : `/${file}`);\n\n/** The build's plugin copies for exactly the given slots, in slot order. */\nfunction slotPlugins(build: GlobalWebBuild, slots: readonly string[]): GlobalWebBuildPlugin[] {\n  return slots.flatMap((slot) => build.plugins.filter((plugin) => plugin.slot === slot));\n}\n\n/**\n * The stylesheets of exactly the given slots, each loaded once: the stylesheets their code\n * imports first, then each slot's own stylesheet in slot order.\n */\nexport function mountStylePaths(build: GlobalWebBuild, slots: readonly string[]): string[] {\n  const paths = slots.map((slot) => build.pluginStyles[slot]).filter((style) => style !== undefined);\n  if (paths.length === 0 && build.baseStyle !== undefined) paths.push(build.baseStyle);\n  const imported = slotPlugins(build, slots).flatMap((plugin) => plugin.css);\n  return [...new Set([...imported, ...paths].map(absolute))];\n}\n\n/** Every file the given slots can load: their reachable files and static stylesheets, each once. */\nexport function mountAssetPaths(build: GlobalWebBuild, slots: readonly string[]): string[] {\n  return [\n    ...new Set(\n      slotPlugins(build, slots)\n        .flatMap((plugin) => [...plugin.files, ...plugin.css])\n        .map(absolute),\n    ),\n  ];\n}\n\nconst sha256 = (value: string): string => crypto.createHash('sha256').update(value).digest('hex');\n\n/**\n * Signs the global build once and hands each mount a composition naming its own plugins.\n *\n * Every mount of one build shares a publication id, so the bytes are counted per mount and\n * released only when the last mount leaves or moves to another build.\n */\nexport function createWebCompositions(stateDirectory: string, onNotice: (message: string) => void) {\n  const publication = createPluginBundlePublication(stateDirectory, onNotice);\n  let shell: PublishedBundle | undefined;\n  const mounts = new Map<string, DoomWebComposition>();\n  const nativeMounts = new Map<string, DoomNativeComposition>();\n  const references = new Map<string, number>();\n  const keyOf = (mount: DoomApiMount): string =>\n    mount.scope === 'global'\n      ? 'global'\n      : mount.scope === 'workspace'\n        ? `workspace:${mount.workspaceId}`\n        : `session:${mount.sessionId}`;\n  const release = (id: string): void => {\n    const count = (references.get(id) ?? 0) - 1;\n    if (count > 0) {\n      references.set(id, count);\n      return;\n    }\n    references.delete(id);\n    publication.release(id);\n  };\n  return {\n    publishShell(build: GlobalWebBuild): void {\n      shell = publication.publish(sha256(`shell:${build.key}`), build.webDirectory);\n      if (!shell) throw new Error('Could not publish the global web shell.');\n    },\n    shellTrust: () =>\n      shell === undefined ? undefined : { publicKey: shell.signed.publicKey, revision: shell.signed.manifest.revision },\n    publish(\n      mount: DoomApiMount,\n      build: GlobalWebBuild,\n      channels: readonly string[],\n      slots: readonly string[],\n    ): DoomWebComposition | undefined {\n      const id = sha256(`plugins:${build.key}`);\n      const published = publication.publish(id, build.pluginsDirectory);\n      if (!published) throw new Error(`Could not publish ${keyOf(mount)} web composition.`);\n      const previous = mounts.get(keyOf(mount));\n      if (previous?.id !== id) references.set(id, (references.get(id) ?? 0) + 1);\n      const revision = published.signed.manifest.revision;\n      const base = `/api/web-plugins/${id}/${String(revision)}`;\n      const signedPaths = new Set(published.signed.manifest.assets.map((asset) => asset.path));\n      const composition: DoomWebComposition = {\n        id,\n        scope: mount.scope,\n        revision,\n        manifestUrl: `${base}/manifest`,\n        rawAssetBaseUrl: `${base}/assets`,\n        verifiedAssetBaseUrl: `/verified-plugins/${id}/${String(revision)}`,\n        pluginEntries: slotPlugins(build, slots).map((plugin): [string, string] => [\n          plugin.slot,\n          absolute(plugin.entry),\n        ]),\n        assetPaths: mountAssetPaths(build, slots).filter((file) => signedPaths.has(file)),\n        stylePaths: mountStylePaths(build, slots).filter((style) => signedPaths.has(style)),\n        channels: [...channels],\n        plugins: [...slots],\n      };\n      mounts.set(keyOf(mount), composition);\n      if (previous !== undefined && previous.id !== id) release(previous.id);\n      return composition;\n    },\n    get: (mount: DoomApiMount) => mounts.get(keyOf(mount)),\n    remove: (mount: DoomApiMount) => {\n      const previous = mounts.get(keyOf(mount));\n      mounts.delete(keyOf(mount));\n      if (previous) release(previous.id);\n    },\n    /**\n     * Publishes the native composition for one mount. Signed under the `native` profile, so it can\n     * never be served or verified as a web bundle. Shares reference counting with web publications.\n     */\n    publishNative(\n      mount: DoomApiMount,\n      build: GlobalNativeBuild,\n      channels: readonly string[],\n      pluginIds: readonly string[],\n    ): DoomNativeComposition {\n      const id = sha256(`native:${build.key}`);\n      const published = publication.publish(id, build.pluginsDirectory, 'native');\n      if (!published) throw new Error(`Could not publish ${keyOf(mount)} native composition.`);\n      const previous = nativeMounts.get(keyOf(mount));\n      if (previous?.id !== id) references.set(id, (references.get(id) ?? 0) + 1);\n      const revision = published.signed.manifest.revision;\n      const base = `/api/web-plugins/${id}/${String(revision)}`;\n      const composition: DoomNativeComposition = {\n        id,\n        scope: mount.scope,\n        revision,\n        manifestUrl: `${base}/manifest`,\n        rawAssetBaseUrl: `${base}/assets`,\n        entryPath: NATIVE_ENTRY_PATH,\n        channels: [...channels],\n        plugins: [...pluginIds],\n      };\n      nativeMounts.set(keyOf(mount), composition);\n      if (previous !== undefined && previous.id !== id) release(previous.id);\n      return composition;\n    },\n    getNative: (mount: DoomApiMount) => nativeMounts.get(keyOf(mount)),\n    removeNative: (mount: DoomApiMount) => {\n      const previous = nativeMounts.get(keyOf(mount));\n      nativeMounts.delete(keyOf(mount));\n      if (previous) release(previous.id);\n    },\n    /**\n     * Signs `po/host-channel-key/v1` with the shell publication's signer, the key the pairing QR pins\n     * as `s`. Undefined until the shell is published.\n     */\n    attestHost: (fields: readonly string[]): string | undefined =>\n      shell === undefined ? undefined : publication.attest(HOST_CHANNEL_KEY_TAG, fields),\n    publicKey: () => publication.publicKey(),\n    async request(request: Request): Promise<Response | undefined> {\n      const url = new URL(request.url);\n      if (\n        (url.pathname === '/bundle-manifest.json' || url.pathname.startsWith('/bundle-assets/')) &&\n        request.method !== 'GET' &&\n        request.method !== 'HEAD'\n      )\n        return new Response(null, { status: 405 });\n      if (url.pathname === '/bundle-manifest.json') {\n        if (!shell) return new Response(null, { status: 404 });\n        return Response.json(shell.signed);\n      }\n      const shellAsset = /^\\/bundle-assets\\/(\\d+)(\\/.*)$/u.exec(url.pathname);\n      if (shellAsset) {\n        if (!shell || Number(shellAsset[1]) !== shell.signed.manifest.revision)\n          return new Response(null, { status: 404 });\n        const asset = shell.signed.manifest.assets.find((entry) => entry.path === shellAsset[2]);\n        if (!asset) return new Response(null, { status: 404 });\n        const bytes = await fs.promises.readFile(path.join(shell.assetsDir, asset.path));\n        return new Response(request.method === 'HEAD' ? null : bytes, {\n          headers: { 'content-type': asset.contentType, 'x-content-type-options': 'nosniff' },\n        });\n      }\n      const match = /^\\/api\\/web-plugins\\/([a-f0-9]{64})\\/(\\d+)\\/(manifest|assets(?:\\/.*)?)$/u.exec(url.pathname);\n      if (!match) return undefined;\n      if (request.method !== 'GET' && request.method !== 'HEAD') return new Response(null, { status: 405 });\n      const bundle = publication.get(match[1], Number(match[2]));\n      if (!bundle) return Response.json({ error: 'Plugin generation not found.' }, { status: 404 });\n      if (match[3] === 'manifest') return Response.json(bundle.signed);\n      const assetPath = match[3].slice('assets'.length);\n      const asset = bundle.signed.manifest.assets.find((candidate) => candidate.path === assetPath);\n      if (!asset) return Response.json({ error: 'Plugin asset not found.' }, { status: 404 });\n      const bytes = await fs.promises.readFile(path.join(bundle.assetsDir, asset.path));\n      return new Response(request.method === 'HEAD' ? null : bytes, {\n        headers: {\n          'content-type': asset.contentType,\n          'cache-control': 'private, max-age=31536000, immutable',\n          'x-content-type-options': 'nosniff',\n        },\n      });\n    },\n    close() {\n      mounts.clear();\n      nativeMounts.clear();\n      references.clear();\n      publication.close();\n    },\n  };\n}\n"],"mappings":";;;;;;;;;;;;AAiDA,MAAM,YAAY,SAA0B,KAAK,WAAW,GAAG,IAAI,OAAO,IAAI;;AAG9E,SAAS,YAAY,OAAuB,OAAkD;CAC5F,OAAO,MAAM,SAAS,SAAS,MAAM,QAAQ,QAAQ,WAAW,OAAO,SAAS,IAAI,CAAC;AACvF;;;;;AAMA,SAAgB,gBAAgB,OAAuB,OAAoC;CACzF,MAAM,QAAQ,MAAM,KAAK,SAAS,MAAM,aAAa,KAAK,CAAC,CAAC,QAAQ,UAAU,UAAU,KAAA,CAAS;CACjG,IAAI,MAAM,WAAW,KAAK,MAAM,cAAc,KAAA,GAAW,MAAM,KAAK,MAAM,SAAS;CACnF,MAAM,WAAW,YAAY,OAAO,KAAK,CAAC,CAAC,SAAS,WAAW,OAAO,GAAG;CACzE,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,UAAU,GAAG,KAAK,CAAC,CAAC,IAAI,QAAQ,CAAC,CAAC;AAC3D;;AAGA,SAAgB,gBAAgB,OAAuB,OAAoC;CACzF,OAAO,CACL,GAAG,IAAI,IACL,YAAY,OAAO,KAAK,CAAC,CACtB,SAAS,WAAW,CAAC,GAAG,OAAO,OAAO,GAAG,OAAO,GAAG,CAAC,CAAC,CACrD,IAAI,QAAQ,CACjB,CACF;AACF;AAEA,MAAM,UAAU,UAA0BA,YAAAA,QAAO,WAAW,QAAQ,CAAC,CAAC,OAAO,KAAK,CAAC,CAAC,OAAO,KAAK;;;;;;;AAQhG,SAAgB,sBAAsB,gBAAwB,UAAqC;CACjG,MAAM,cAAcC,cAAAA,8BAA8B,gBAAgB,QAAQ;CAC1E,IAAI;CACJ,MAAM,yBAAS,IAAI,IAAgC;CACnD,MAAM,+BAAe,IAAI,IAAmC;CAC5D,MAAM,6BAAa,IAAI,IAAoB;CAC3C,MAAM,SAAS,UACb,MAAM,UAAU,WACZ,WACA,MAAM,UAAU,cACd,aAAa,MAAM,gBACnB,WAAW,MAAM;CACzB,MAAM,WAAW,OAAqB;EACpC,MAAM,SAAS,WAAW,IAAI,EAAE,KAAK,KAAK;EAC1C,IAAI,QAAQ,GAAG;GACb,WAAW,IAAI,IAAI,KAAK;GACxB;EACF;EACA,WAAW,OAAO,EAAE;EACpB,YAAY,QAAQ,EAAE;CACxB;CACA,OAAO;EACL,aAAa,OAA6B;GACxC,QAAQ,YAAY,QAAQ,OAAO,SAAS,MAAM,KAAK,GAAG,MAAM,YAAY;GAC5E,IAAI,CAAC,OAAO,MAAM,IAAI,MAAM,yCAAyC;EACvE;EACA,kBACE,UAAU,KAAA,IAAY,KAAA,IAAY;GAAE,WAAW,MAAM,OAAO;GAAW,UAAU,MAAM,OAAO,SAAS;EAAS;EAClH,QACE,OACA,OACA,UACA,OACgC;GAChC,MAAM,KAAK,OAAO,WAAW,MAAM,KAAK;GACxC,MAAM,YAAY,YAAY,QAAQ,IAAI,MAAM,gBAAgB;GAChE,IAAI,CAAC,WAAW,MAAM,IAAI,MAAM,qBAAqB,MAAM,KAAK,EAAE,kBAAkB;GACpF,MAAM,WAAW,OAAO,IAAI,MAAM,KAAK,CAAC;GACxC,IAAI,UAAU,OAAO,IAAI,WAAW,IAAI,KAAK,WAAW,IAAI,EAAE,KAAK,KAAK,CAAC;GACzE,MAAM,WAAW,UAAU,OAAO,SAAS;GAC3C,MAAM,OAAO,oBAAoB,GAAG,GAAG,OAAO,QAAQ;GACtD,MAAM,cAAc,IAAI,IAAI,UAAU,OAAO,SAAS,OAAO,KAAK,UAAU,MAAM,IAAI,CAAC;GACvF,MAAM,cAAkC;IACtC;IACA,OAAO,MAAM;IACb;IACA,aAAa,GAAG,KAAK;IACrB,iBAAiB,GAAG,KAAK;IACzB,sBAAsB,qBAAqB,GAAG,GAAG,OAAO,QAAQ;IAChE,eAAe,YAAY,OAAO,KAAK,CAAC,CAAC,KAAK,WAA6B,CACzE,OAAO,MACP,SAAS,OAAO,KAAK,CACvB,CAAC;IACD,YAAY,gBAAgB,OAAO,KAAK,CAAC,CAAC,QAAQ,SAAS,YAAY,IAAI,IAAI,CAAC;IAChF,YAAY,gBAAgB,OAAO,KAAK,CAAC,CAAC,QAAQ,UAAU,YAAY,IAAI,KAAK,CAAC;IAClF,UAAU,CAAC,GAAG,QAAQ;IACtB,SAAS,CAAC,GAAG,KAAK;GACpB;GACA,OAAO,IAAI,MAAM,KAAK,GAAG,WAAW;GACpC,IAAI,aAAa,KAAA,KAAa,SAAS,OAAO,IAAI,QAAQ,SAAS,EAAE;GACrE,OAAO;EACT;EACA,MAAM,UAAwB,OAAO,IAAI,MAAM,KAAK,CAAC;EACrD,SAAS,UAAwB;GAC/B,MAAM,WAAW,OAAO,IAAI,MAAM,KAAK,CAAC;GACxC,OAAO,OAAO,MAAM,KAAK,CAAC;GAC1B,IAAI,UAAU,QAAQ,SAAS,EAAE;EACnC;;;;;EAKA,cACE,OACA,OACA,UACA,WACuB;GACvB,MAAM,KAAK,OAAO,UAAU,MAAM,KAAK;GACvC,MAAM,YAAY,YAAY,QAAQ,IAAI,MAAM,kBAAkB,QAAQ;GAC1E,IAAI,CAAC,WAAW,MAAM,IAAI,MAAM,qBAAqB,MAAM,KAAK,EAAE,qBAAqB;GACvF,MAAM,WAAW,aAAa,IAAI,MAAM,KAAK,CAAC;GAC9C,IAAI,UAAU,OAAO,IAAI,WAAW,IAAI,KAAK,WAAW,IAAI,EAAE,KAAK,KAAK,CAAC;GACzE,MAAM,WAAW,UAAU,OAAO,SAAS;GAC3C,MAAM,OAAO,oBAAoB,GAAG,GAAG,OAAO,QAAQ;GACtD,MAAM,cAAqC;IACzC;IACA,OAAO,MAAM;IACb;IACA,aAAa,GAAG,KAAK;IACrB,iBAAiB,GAAG,KAAK;IACzB,WAAWC,2BAAAA;IACX,UAAU,CAAC,GAAG,QAAQ;IACtB,SAAS,CAAC,GAAG,SAAS;GACxB;GACA,aAAa,IAAI,MAAM,KAAK,GAAG,WAAW;GAC1C,IAAI,aAAa,KAAA,KAAa,SAAS,OAAO,IAAI,QAAQ,SAAS,EAAE;GACrE,OAAO;EACT;EACA,YAAY,UAAwB,aAAa,IAAI,MAAM,KAAK,CAAC;EACjE,eAAe,UAAwB;GACrC,MAAM,WAAW,aAAa,IAAI,MAAM,KAAK,CAAC;GAC9C,aAAa,OAAO,MAAM,KAAK,CAAC;GAChC,IAAI,UAAU,QAAQ,SAAS,EAAE;EACnC;;;;;EAKA,aAAa,WACX,UAAU,KAAA,IAAY,KAAA,IAAY,YAAY,OAAOC,eAAAA,sBAAsB,MAAM;EACnF,iBAAiB,YAAY,UAAU;EACvC,MAAM,QAAQ,SAAiD;GAC7D,MAAM,MAAM,IAAI,IAAI,QAAQ,GAAG;GAC/B,KACG,IAAI,aAAa,2BAA2B,IAAI,SAAS,WAAW,iBAAiB,MACtF,QAAQ,WAAW,SACnB,QAAQ,WAAW,QAEnB,OAAO,IAAI,SAAS,MAAM,EAAE,QAAQ,IAAI,CAAC;GAC3C,IAAI,IAAI,aAAa,yBAAyB;IAC5C,IAAI,CAAC,OAAO,OAAO,IAAI,SAAS,MAAM,EAAE,QAAQ,IAAI,CAAC;IACrD,OAAO,SAAS,KAAK,MAAM,MAAM;GACnC;GACA,MAAM,aAAa,kCAAkC,KAAK,IAAI,QAAQ;GACtE,IAAI,YAAY;IACd,IAAI,CAAC,SAAS,OAAO,WAAW,EAAE,MAAM,MAAM,OAAO,SAAS,UAC5D,OAAO,IAAI,SAAS,MAAM,EAAE,QAAQ,IAAI,CAAC;IAC3C,MAAM,QAAQ,MAAM,OAAO,SAAS,OAAO,MAAM,UAAU,MAAM,SAAS,WAAW,EAAE;IACvF,IAAI,CAAC,OAAO,OAAO,IAAI,SAAS,MAAM,EAAE,QAAQ,IAAI,CAAC;IACrD,MAAM,QAAQ,MAAMC,QAAAA,QAAG,SAAS,SAASC,UAAAA,QAAK,KAAK,MAAM,WAAW,MAAM,IAAI,CAAC;IAC/E,OAAO,IAAI,SAAS,QAAQ,WAAW,SAAS,OAAO,OAAO,EAC5D,SAAS;KAAE,gBAAgB,MAAM;KAAa,0BAA0B;IAAU,EACpF,CAAC;GACH;GACA,MAAM,QAAQ,2EAA2E,KAAK,IAAI,QAAQ;GAC1G,IAAI,CAAC,OAAO,OAAO,KAAA;GACnB,IAAI,QAAQ,WAAW,SAAS,QAAQ,WAAW,QAAQ,OAAO,IAAI,SAAS,MAAM,EAAE,QAAQ,IAAI,CAAC;GACpG,MAAM,SAAS,YAAY,IAAI,MAAM,IAAI,OAAO,MAAM,EAAE,CAAC;GACzD,IAAI,CAAC,QAAQ,OAAO,SAAS,KAAK,EAAE,OAAO,+BAA+B,GAAG,EAAE,QAAQ,IAAI,CAAC;GAC5F,IAAI,MAAM,OAAO,YAAY,OAAO,SAAS,KAAK,OAAO,MAAM;GAC/D,MAAM,YAAY,MAAM,EAAE,CAAC,MAAM,CAAe;GAChD,MAAM,QAAQ,OAAO,OAAO,SAAS,OAAO,MAAM,cAAc,UAAU,SAAS,SAAS;GAC5F,IAAI,CAAC,OAAO,OAAO,SAAS,KAAK,EAAE,OAAO,0BAA0B,GAAG,EAAE,QAAQ,IAAI,CAAC;GACtF,MAAM,QAAQ,MAAMD,QAAAA,QAAG,SAAS,SAASC,UAAAA,QAAK,KAAK,OAAO,WAAW,MAAM,IAAI,CAAC;GAChF,OAAO,IAAI,SAAS,QAAQ,WAAW,SAAS,OAAO,OAAO,EAC5D,SAAS;IACP,gBAAgB,MAAM;IACtB,iBAAiB;IACjB,0BAA0B;GAC5B,EACF,CAAC;EACH;EACA,QAAQ;GACN,OAAO,MAAM;GACb,aAAa,MAAM;GACnB,WAAW,MAAM;GACjB,YAAY,MAAM;EACpB;CACF;AACF"}

package/dist/webCompositions.d.mts

@@ -0,0 +1,79 @@
+import { DoomApiMount, DoomNativeComposition, DoomWebComposition } from "./src/schemas/packageApi.mjs";
+import "./packageApi.mjs";
+//#region src/services/webCompositions/index.d.ts
+/** One plugin copy in a global web build: its slot entry and the files that entry can load. */
+export interface GlobalWebBuildPlugin {
+  pluginId: string;
+  /** The copy's identity: the pluginId for a host plugin, else the pluginId plus a package hash. */
+  slot: string;
+  packageDir: string;
+  isHost: boolean;
+  /** The slot entry module below `pluginsDirectory`. */
+  entry: string;
+  /** Every file below `pluginsDirectory` the entry reaches through static and dynamic imports, plus its stylesheet. */
+  files: readonly string[];
+  /** The stylesheets of the entry's static import closure. */
+  css: readonly string[];
+}
+/** One global web build: the shell, the shared plugin composition, and one stylesheet per plugin copy. */
+export interface GlobalWebBuild {
+  /** Content key of the build; equal keys hold identical bytes. */
+  key: string;
+  /** Signed cockpit shell directory. */
+  webDirectory: string;
+  /** Shared plugin composition directory, published once for every mount. */
+  pluginsDirectory: string;
+  /** Every plugin copy in the build, in build order. */
+  plugins: readonly GlobalWebBuildPlugin[];
+  /** Content-hashed stylesheet paths below `pluginsDirectory`, keyed by slot. */
+  pluginStyles: Readonly<Record<string, string>>;
+  /** Stylesheet a mount without plugin styles still loads, for the host shell and fallback template. */
+  baseStyle?: string;
+}
+/** One global native build: a single signed CommonJS composition shared by every mount. */
+export interface GlobalNativeBuild {
+  /** Content key of the build; equal keys hold identical bytes. */
+  key: string;
+  /** Directory holding exactly `/composition.js`. */
+  pluginsDirectory: string;
+}
+/**
+ * The stylesheets of exactly the given slots, each loaded once: the stylesheets their code
+ * imports first, then each slot's own stylesheet in slot order.
+ */
+export declare function mountStylePaths(build: GlobalWebBuild, slots: readonly string[]): string[];
+/** Every file the given slots can load: their reachable files and static stylesheets, each once. */
+export declare function mountAssetPaths(build: GlobalWebBuild, slots: readonly string[]): string[];
+/**
+ * Signs the global build once and hands each mount a composition naming its own plugins.
+ *
+ * Every mount of one build shares a publication id, so the bytes are counted per mount and
+ * released only when the last mount leaves or moves to another build.
+ */
+export declare function createWebCompositions(stateDirectory: string, onNotice: (message: string) => void): {
+  publishShell(build: GlobalWebBuild): void;
+  shellTrust: () => {
+    publicKey: string;
+    revision: number;
+  } | undefined;
+  publish(mount: DoomApiMount, build: GlobalWebBuild, channels: readonly string[], slots: readonly string[]): DoomWebComposition | undefined;
+  get: (mount: DoomApiMount) => DoomWebComposition | undefined;
+  remove: (mount: DoomApiMount) => void;
+  /**
+   * Publishes the native composition for one mount. Signed under the `native` profile, so it can
+   * never be served or verified as a web bundle. Shares reference counting with web publications.
+   */
+  publishNative(mount: DoomApiMount, build: GlobalNativeBuild, channels: readonly string[], pluginIds: readonly string[]): DoomNativeComposition;
+  getNative: (mount: DoomApiMount) => DoomNativeComposition | undefined;
+  removeNative: (mount: DoomApiMount) => void;
+  /**
+   * Signs `po/host-channel-key/v1` with the shell publication's signer, the key the pairing QR pins
+   * as `s`. Undefined until the shell is published.
+   */
+  attestHost: (fields: readonly string[]) => string | undefined;
+  publicKey: () => string | undefined;
+  request(request: Request): Promise<Response | undefined>;
+  close(): void;
+};
+//#endregion
+//# sourceMappingURL=webCompositions.d.mts.map

package/dist/webCompositions.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"webCompositions.d.mts","names":[],"sources":["../src/services/webCompositions/index.ts"],"mappings":";;;;iBAWiB;EACf;;EAEA;EACA;EACA;;EAEA;;EAEA;;EAEA;;;iBAIe;;EAEf;;EAEA;;EAEA;;EAEA,kBAAkB;;EAElB,cAAc,SAAS;;EAEvB;;;iBAIe;;EAEf;;EAEA;;;;;;wBAcc,gBAAgB,OAAO,gBAAgB;;wBAQvC,gBAAgB,OAAO,gBAAgB;;;;;;;wBAkBvC,sBAAsB,wBAAwB,WAAW;EAsBrE,aAAY,OAAQ;EAIpB;;;;EAEA,QAAO,OACE,cAAY,OACZ,gBAAc,6BACM,2BAE1B;EA6BH,MAAG,OAAU,iBAAY;EACzB,SAAM,OAAU;;;;;EAShB,cAAa,OACJ,cAAY,OACZ,mBAAiB,6BACG,+BAE1B;EAsBH,YAAS,OAAU,iBAAY;EAC/B,eAAY,OAAU;;;;;EAStB,aAAU;EAEV;EACM,QAAO,SAAU,UAAU,QAAQ;EAyCzC"}

package/dist/webCompositions.mjs

@@ -0,0 +1,174 @@
+import { HOST_CHANNEL_KEY_TAG } from "./src/constants/remote.mjs";
+import { createPluginBundlePublication } from "./src/services/bundlePublication/index.mjs";
+import crypto from "node:crypto";
+import fs from "node:fs";
+import path from "node:path";
+import { NATIVE_ENTRY_PATH } from "@agimon-ai/po-web-security";
+//#region src/services/webCompositions/index.ts
+const absolute = (file) => file.startsWith("/") ? file : `/${file}`;
+/** The build's plugin copies for exactly the given slots, in slot order. */
+function slotPlugins(build, slots) {
+	return slots.flatMap((slot) => build.plugins.filter((plugin) => plugin.slot === slot));
+}
+/**
+* The stylesheets of exactly the given slots, each loaded once: the stylesheets their code
+* imports first, then each slot's own stylesheet in slot order.
+*/
+function mountStylePaths(build, slots) {
+	const paths = slots.map((slot) => build.pluginStyles[slot]).filter((style) => style !== void 0);
+	if (paths.length === 0 && build.baseStyle !== void 0) paths.push(build.baseStyle);
+	const imported = slotPlugins(build, slots).flatMap((plugin) => plugin.css);
+	return [...new Set([...imported, ...paths].map(absolute))];
+}
+/** Every file the given slots can load: their reachable files and static stylesheets, each once. */
+function mountAssetPaths(build, slots) {
+	return [...new Set(slotPlugins(build, slots).flatMap((plugin) => [...plugin.files, ...plugin.css]).map(absolute))];
+}
+const sha256 = (value) => crypto.createHash("sha256").update(value).digest("hex");
+/**
+* Signs the global build once and hands each mount a composition naming its own plugins.
+*
+* Every mount of one build shares a publication id, so the bytes are counted per mount and
+* released only when the last mount leaves or moves to another build.
+*/
+function createWebCompositions(stateDirectory, onNotice) {
+	const publication = createPluginBundlePublication(stateDirectory, onNotice);
+	let shell;
+	const mounts = /* @__PURE__ */ new Map();
+	const nativeMounts = /* @__PURE__ */ new Map();
+	const references = /* @__PURE__ */ new Map();
+	const keyOf = (mount) => mount.scope === "global" ? "global" : mount.scope === "workspace" ? `workspace:${mount.workspaceId}` : `session:${mount.sessionId}`;
+	const release = (id) => {
+		const count = (references.get(id) ?? 0) - 1;
+		if (count > 0) {
+			references.set(id, count);
+			return;
+		}
+		references.delete(id);
+		publication.release(id);
+	};
+	return {
+		publishShell(build) {
+			shell = publication.publish(sha256(`shell:${build.key}`), build.webDirectory);
+			if (!shell) throw new Error("Could not publish the global web shell.");
+		},
+		shellTrust: () => shell === void 0 ? void 0 : {
+			publicKey: shell.signed.publicKey,
+			revision: shell.signed.manifest.revision
+		},
+		publish(mount, build, channels, slots) {
+			const id = sha256(`plugins:${build.key}`);
+			const published = publication.publish(id, build.pluginsDirectory);
+			if (!published) throw new Error(`Could not publish ${keyOf(mount)} web composition.`);
+			const previous = mounts.get(keyOf(mount));
+			if (previous?.id !== id) references.set(id, (references.get(id) ?? 0) + 1);
+			const revision = published.signed.manifest.revision;
+			const base = `/api/web-plugins/${id}/${String(revision)}`;
+			const signedPaths = new Set(published.signed.manifest.assets.map((asset) => asset.path));
+			const composition = {
+				id,
+				scope: mount.scope,
+				revision,
+				manifestUrl: `${base}/manifest`,
+				rawAssetBaseUrl: `${base}/assets`,
+				verifiedAssetBaseUrl: `/verified-plugins/${id}/${String(revision)}`,
+				pluginEntries: slotPlugins(build, slots).map((plugin) => [plugin.slot, absolute(plugin.entry)]),
+				assetPaths: mountAssetPaths(build, slots).filter((file) => signedPaths.has(file)),
+				stylePaths: mountStylePaths(build, slots).filter((style) => signedPaths.has(style)),
+				channels: [...channels],
+				plugins: [...slots]
+			};
+			mounts.set(keyOf(mount), composition);
+			if (previous !== void 0 && previous.id !== id) release(previous.id);
+			return composition;
+		},
+		get: (mount) => mounts.get(keyOf(mount)),
+		remove: (mount) => {
+			const previous = mounts.get(keyOf(mount));
+			mounts.delete(keyOf(mount));
+			if (previous) release(previous.id);
+		},
+		/**
+		* Publishes the native composition for one mount. Signed under the `native` profile, so it can
+		* never be served or verified as a web bundle. Shares reference counting with web publications.
+		*/
+		publishNative(mount, build, channels, pluginIds) {
+			const id = sha256(`native:${build.key}`);
+			const published = publication.publish(id, build.pluginsDirectory, "native");
+			if (!published) throw new Error(`Could not publish ${keyOf(mount)} native composition.`);
+			const previous = nativeMounts.get(keyOf(mount));
+			if (previous?.id !== id) references.set(id, (references.get(id) ?? 0) + 1);
+			const revision = published.signed.manifest.revision;
+			const base = `/api/web-plugins/${id}/${String(revision)}`;
+			const composition = {
+				id,
+				scope: mount.scope,
+				revision,
+				manifestUrl: `${base}/manifest`,
+				rawAssetBaseUrl: `${base}/assets`,
+				entryPath: NATIVE_ENTRY_PATH,
+				channels: [...channels],
+				plugins: [...pluginIds]
+			};
+			nativeMounts.set(keyOf(mount), composition);
+			if (previous !== void 0 && previous.id !== id) release(previous.id);
+			return composition;
+		},
+		getNative: (mount) => nativeMounts.get(keyOf(mount)),
+		removeNative: (mount) => {
+			const previous = nativeMounts.get(keyOf(mount));
+			nativeMounts.delete(keyOf(mount));
+			if (previous) release(previous.id);
+		},
+		/**
+		* Signs `po/host-channel-key/v1` with the shell publication's signer, the key the pairing QR pins
+		* as `s`. Undefined until the shell is published.
+		*/
+		attestHost: (fields) => shell === void 0 ? void 0 : publication.attest(HOST_CHANNEL_KEY_TAG, fields),
+		publicKey: () => publication.publicKey(),
+		async request(request) {
+			const url = new URL(request.url);
+			if ((url.pathname === "/bundle-manifest.json" || url.pathname.startsWith("/bundle-assets/")) && request.method !== "GET" && request.method !== "HEAD") return new Response(null, { status: 405 });
+			if (url.pathname === "/bundle-manifest.json") {
+				if (!shell) return new Response(null, { status: 404 });
+				return Response.json(shell.signed);
+			}
+			const shellAsset = /^\/bundle-assets\/(\d+)(\/.*)$/u.exec(url.pathname);
+			if (shellAsset) {
+				if (!shell || Number(shellAsset[1]) !== shell.signed.manifest.revision) return new Response(null, { status: 404 });
+				const asset = shell.signed.manifest.assets.find((entry) => entry.path === shellAsset[2]);
+				if (!asset) return new Response(null, { status: 404 });
+				const bytes = await fs.promises.readFile(path.join(shell.assetsDir, asset.path));
+				return new Response(request.method === "HEAD" ? null : bytes, { headers: {
+					"content-type": asset.contentType,
+					"x-content-type-options": "nosniff"
+				} });
+			}
+			const match = /^\/api\/web-plugins\/([a-f0-9]{64})\/(\d+)\/(manifest|assets(?:\/.*)?)$/u.exec(url.pathname);
+			if (!match) return void 0;
+			if (request.method !== "GET" && request.method !== "HEAD") return new Response(null, { status: 405 });
+			const bundle = publication.get(match[1], Number(match[2]));
+			if (!bundle) return Response.json({ error: "Plugin generation not found." }, { status: 404 });
+			if (match[3] === "manifest") return Response.json(bundle.signed);
+			const assetPath = match[3].slice(6);
+			const asset = bundle.signed.manifest.assets.find((candidate) => candidate.path === assetPath);
+			if (!asset) return Response.json({ error: "Plugin asset not found." }, { status: 404 });
+			const bytes = await fs.promises.readFile(path.join(bundle.assetsDir, asset.path));
+			return new Response(request.method === "HEAD" ? null : bytes, { headers: {
+				"content-type": asset.contentType,
+				"cache-control": "private, max-age=31536000, immutable",
+				"x-content-type-options": "nosniff"
+			} });
+		},
+		close() {
+			mounts.clear();
+			nativeMounts.clear();
+			references.clear();
+			publication.close();
+		}
+	};
+}
+//#endregion
+export { createWebCompositions, mountAssetPaths, mountStylePaths };
+
+//# sourceMappingURL=webCompositions.mjs.map

package/dist/webCompositions.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"webCompositions.mjs","names":[],"sources":["../src/services/webCompositions/index.ts"],"sourcesContent":["import crypto from 'node:crypto';\nimport fs from 'node:fs';\nimport path from 'node:path';\n\nimport { NATIVE_ENTRY_PATH } from '@agimon-ai/po-web-security';\n\nimport { HOST_CHANNEL_KEY_TAG } from '../../constants/remote';\nimport type { DoomApiMount, DoomNativeComposition, DoomWebComposition } from '../../exports/packageApi';\nimport { createPluginBundlePublication, type PublishedBundle } from '../bundlePublication';\n\n/** One plugin copy in a global web build: its slot entry and the files that entry can load. */\nexport interface GlobalWebBuildPlugin {\n  pluginId: string;\n  /** The copy's identity: the pluginId for a host plugin, else the pluginId plus a package hash. */\n  slot: string;\n  packageDir: string;\n  isHost: boolean;\n  /** The slot entry module below `pluginsDirectory`. */\n  entry: string;\n  /** Every file below `pluginsDirectory` the entry reaches through static and dynamic imports, plus its stylesheet. */\n  files: readonly string[];\n  /** The stylesheets of the entry's static import closure. */\n  css: readonly string[];\n}\n\n/** One global web build: the shell, the shared plugin composition, and one stylesheet per plugin copy. */\nexport interface GlobalWebBuild {\n  /** Content key of the build; equal keys hold identical bytes. */\n  key: string;\n  /** Signed cockpit shell directory. */\n  webDirectory: string;\n  /** Shared plugin composition directory, published once for every mount. */\n  pluginsDirectory: string;\n  /** Every plugin copy in the build, in build order. */\n  plugins: readonly GlobalWebBuildPlugin[];\n  /** Content-hashed stylesheet paths below `pluginsDirectory`, keyed by slot. */\n  pluginStyles: Readonly<Record<string, string>>;\n  /** Stylesheet a mount without plugin styles still loads, for the host shell and fallback template. */\n  baseStyle?: string;\n}\n\n/** One global native build: a single signed CommonJS composition shared by every mount. */\nexport interface GlobalNativeBuild {\n  /** Content key of the build; equal keys hold identical bytes. */\n  key: string;\n  /** Directory holding exactly `/composition.js`. */\n  pluginsDirectory: string;\n}\n\nconst absolute = (file: string): string => (file.startsWith('/') ? file : `/${file}`);\n\n/** The build's plugin copies for exactly the given slots, in slot order. */\nfunction slotPlugins(build: GlobalWebBuild, slots: readonly string[]): GlobalWebBuildPlugin[] {\n  return slots.flatMap((slot) => build.plugins.filter((plugin) => plugin.slot === slot));\n}\n\n/**\n * The stylesheets of exactly the given slots, each loaded once: the stylesheets their code\n * imports first, then each slot's own stylesheet in slot order.\n */\nexport function mountStylePaths(build: GlobalWebBuild, slots: readonly string[]): string[] {\n  const paths = slots.map((slot) => build.pluginStyles[slot]).filter((style) => style !== undefined);\n  if (paths.length === 0 && build.baseStyle !== undefined) paths.push(build.baseStyle);\n  const imported = slotPlugins(build, slots).flatMap((plugin) => plugin.css);\n  return [...new Set([...imported, ...paths].map(absolute))];\n}\n\n/** Every file the given slots can load: their reachable files and static stylesheets, each once. */\nexport function mountAssetPaths(build: GlobalWebBuild, slots: readonly string[]): string[] {\n  return [\n    ...new Set(\n      slotPlugins(build, slots)\n        .flatMap((plugin) => [...plugin.files, ...plugin.css])\n        .map(absolute),\n    ),\n  ];\n}\n\nconst sha256 = (value: string): string => crypto.createHash('sha256').update(value).digest('hex');\n\n/**\n * Signs the global build once and hands each mount a composition naming its own plugins.\n *\n * Every mount of one build shares a publication id, so the bytes are counted per mount and\n * released only when the last mount leaves or moves to another build.\n */\nexport function createWebCompositions(stateDirectory: string, onNotice: (message: string) => void) {\n  const publication = createPluginBundlePublication(stateDirectory, onNotice);\n  let shell: PublishedBundle | undefined;\n  const mounts = new Map<string, DoomWebComposition>();\n  const nativeMounts = new Map<string, DoomNativeComposition>();\n  const references = new Map<string, number>();\n  const keyOf = (mount: DoomApiMount): string =>\n    mount.scope === 'global'\n      ? 'global'\n      : mount.scope === 'workspace'\n        ? `workspace:${mount.workspaceId}`\n        : `session:${mount.sessionId}`;\n  const release = (id: string): void => {\n    const count = (references.get(id) ?? 0) - 1;\n    if (count > 0) {\n      references.set(id, count);\n      return;\n    }\n    references.delete(id);\n    publication.release(id);\n  };\n  return {\n    publishShell(build: GlobalWebBuild): void {\n      shell = publication.publish(sha256(`shell:${build.key}`), build.webDirectory);\n      if (!shell) throw new Error('Could not publish the global web shell.');\n    },\n    shellTrust: () =>\n      shell === undefined ? undefined : { publicKey: shell.signed.publicKey, revision: shell.signed.manifest.revision },\n    publish(\n      mount: DoomApiMount,\n      build: GlobalWebBuild,\n      channels: readonly string[],\n      slots: readonly string[],\n    ): DoomWebComposition | undefined {\n      const id = sha256(`plugins:${build.key}`);\n      const published = publication.publish(id, build.pluginsDirectory);\n      if (!published) throw new Error(`Could not publish ${keyOf(mount)} web composition.`);\n      const previous = mounts.get(keyOf(mount));\n      if (previous?.id !== id) references.set(id, (references.get(id) ?? 0) + 1);\n      const revision = published.signed.manifest.revision;\n      const base = `/api/web-plugins/${id}/${String(revision)}`;\n      const signedPaths = new Set(published.signed.manifest.assets.map((asset) => asset.path));\n      const composition: DoomWebComposition = {\n        id,\n        scope: mount.scope,\n        revision,\n        manifestUrl: `${base}/manifest`,\n        rawAssetBaseUrl: `${base}/assets`,\n        verifiedAssetBaseUrl: `/verified-plugins/${id}/${String(revision)}`,\n        pluginEntries: slotPlugins(build, slots).map((plugin): [string, string] => [\n          plugin.slot,\n          absolute(plugin.entry),\n        ]),\n        assetPaths: mountAssetPaths(build, slots).filter((file) => signedPaths.has(file)),\n        stylePaths: mountStylePaths(build, slots).filter((style) => signedPaths.has(style)),\n        channels: [...channels],\n        plugins: [...slots],\n      };\n      mounts.set(keyOf(mount), composition);\n      if (previous !== undefined && previous.id !== id) release(previous.id);\n      return composition;\n    },\n    get: (mount: DoomApiMount) => mounts.get(keyOf(mount)),\n    remove: (mount: DoomApiMount) => {\n      const previous = mounts.get(keyOf(mount));\n      mounts.delete(keyOf(mount));\n      if (previous) release(previous.id);\n    },\n    /**\n     * Publishes the native composition for one mount. Signed under the `native` profile, so it can\n     * never be served or verified as a web bundle. Shares reference counting with web publications.\n     */\n    publishNative(\n      mount: DoomApiMount,\n      build: GlobalNativeBuild,\n      channels: readonly string[],\n      pluginIds: readonly string[],\n    ): DoomNativeComposition {\n      const id = sha256(`native:${build.key}`);\n      const published = publication.publish(id, build.pluginsDirectory, 'native');\n      if (!published) throw new Error(`Could not publish ${keyOf(mount)} native composition.`);\n      const previous = nativeMounts.get(keyOf(mount));\n      if (previous?.id !== id) references.set(id, (references.get(id) ?? 0) + 1);\n      const revision = published.signed.manifest.revision;\n      const base = `/api/web-plugins/${id}/${String(revision)}`;\n      const composition: DoomNativeComposition = {\n        id,\n        scope: mount.scope,\n        revision,\n        manifestUrl: `${base}/manifest`,\n        rawAssetBaseUrl: `${base}/assets`,\n        entryPath: NATIVE_ENTRY_PATH,\n        channels: [...channels],\n        plugins: [...pluginIds],\n      };\n      nativeMounts.set(keyOf(mount), composition);\n      if (previous !== undefined && previous.id !== id) release(previous.id);\n      return composition;\n    },\n    getNative: (mount: DoomApiMount) => nativeMounts.get(keyOf(mount)),\n    removeNative: (mount: DoomApiMount) => {\n      const previous = nativeMounts.get(keyOf(mount));\n      nativeMounts.delete(keyOf(mount));\n      if (previous) release(previous.id);\n    },\n    /**\n     * Signs `po/host-channel-key/v1` with the shell publication's signer, the key the pairing QR pins\n     * as `s`. Undefined until the shell is published.\n     */\n    attestHost: (fields: readonly string[]): string | undefined =>\n      shell === undefined ? undefined : publication.attest(HOST_CHANNEL_KEY_TAG, fields),\n    publicKey: () => publication.publicKey(),\n    async request(request: Request): Promise<Response | undefined> {\n      const url = new URL(request.url);\n      if (\n        (url.pathname === '/bundle-manifest.json' || url.pathname.startsWith('/bundle-assets/')) &&\n        request.method !== 'GET' &&\n        request.method !== 'HEAD'\n      )\n        return new Response(null, { status: 405 });\n      if (url.pathname === '/bundle-manifest.json') {\n        if (!shell) return new Response(null, { status: 404 });\n        return Response.json(shell.signed);\n      }\n      const shellAsset = /^\\/bundle-assets\\/(\\d+)(\\/.*)$/u.exec(url.pathname);\n      if (shellAsset) {\n        if (!shell || Number(shellAsset[1]) !== shell.signed.manifest.revision)\n          return new Response(null, { status: 404 });\n        const asset = shell.signed.manifest.assets.find((entry) => entry.path === shellAsset[2]);\n        if (!asset) return new Response(null, { status: 404 });\n        const bytes = await fs.promises.readFile(path.join(shell.assetsDir, asset.path));\n        return new Response(request.method === 'HEAD' ? null : bytes, {\n          headers: { 'content-type': asset.contentType, 'x-content-type-options': 'nosniff' },\n        });\n      }\n      const match = /^\\/api\\/web-plugins\\/([a-f0-9]{64})\\/(\\d+)\\/(manifest|assets(?:\\/.*)?)$/u.exec(url.pathname);\n      if (!match) return undefined;\n      if (request.method !== 'GET' && request.method !== 'HEAD') return new Response(null, { status: 405 });\n      const bundle = publication.get(match[1], Number(match[2]));\n      if (!bundle) return Response.json({ error: 'Plugin generation not found.' }, { status: 404 });\n      if (match[3] === 'manifest') return Response.json(bundle.signed);\n      const assetPath = match[3].slice('assets'.length);\n      const asset = bundle.signed.manifest.assets.find((candidate) => candidate.path === assetPath);\n      if (!asset) return Response.json({ error: 'Plugin asset not found.' }, { status: 404 });\n      const bytes = await fs.promises.readFile(path.join(bundle.assetsDir, asset.path));\n      return new Response(request.method === 'HEAD' ? null : bytes, {\n        headers: {\n          'content-type': asset.contentType,\n          'cache-control': 'private, max-age=31536000, immutable',\n          'x-content-type-options': 'nosniff',\n        },\n      });\n    },\n    close() {\n      mounts.clear();\n      nativeMounts.clear();\n      references.clear();\n      publication.close();\n    },\n  };\n}\n"],"mappings":";;;;;;;AAiDA,MAAM,YAAY,SAA0B,KAAK,WAAW,GAAG,IAAI,OAAO,IAAI;;AAG9E,SAAS,YAAY,OAAuB,OAAkD;CAC5F,OAAO,MAAM,SAAS,SAAS,MAAM,QAAQ,QAAQ,WAAW,OAAO,SAAS,IAAI,CAAC;AACvF;;;;;AAMA,SAAgB,gBAAgB,OAAuB,OAAoC;CACzF,MAAM,QAAQ,MAAM,KAAK,SAAS,MAAM,aAAa,KAAK,CAAC,CAAC,QAAQ,UAAU,UAAU,KAAA,CAAS;CACjG,IAAI,MAAM,WAAW,KAAK,MAAM,cAAc,KAAA,GAAW,MAAM,KAAK,MAAM,SAAS;CACnF,MAAM,WAAW,YAAY,OAAO,KAAK,CAAC,CAAC,SAAS,WAAW,OAAO,GAAG;CACzE,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,UAAU,GAAG,KAAK,CAAC,CAAC,IAAI,QAAQ,CAAC,CAAC;AAC3D;;AAGA,SAAgB,gBAAgB,OAAuB,OAAoC;CACzF,OAAO,CACL,GAAG,IAAI,IACL,YAAY,OAAO,KAAK,CAAC,CACtB,SAAS,WAAW,CAAC,GAAG,OAAO,OAAO,GAAG,OAAO,GAAG,CAAC,CAAC,CACrD,IAAI,QAAQ,CACjB,CACF;AACF;AAEA,MAAM,UAAU,UAA0B,OAAO,WAAW,QAAQ,CAAC,CAAC,OAAO,KAAK,CAAC,CAAC,OAAO,KAAK;;;;;;;AAQhG,SAAgB,sBAAsB,gBAAwB,UAAqC;CACjG,MAAM,cAAc,8BAA8B,gBAAgB,QAAQ;CAC1E,IAAI;CACJ,MAAM,yBAAS,IAAI,IAAgC;CACnD,MAAM,+BAAe,IAAI,IAAmC;CAC5D,MAAM,6BAAa,IAAI,IAAoB;CAC3C,MAAM,SAAS,UACb,MAAM,UAAU,WACZ,WACA,MAAM,UAAU,cACd,aAAa,MAAM,gBACnB,WAAW,MAAM;CACzB,MAAM,WAAW,OAAqB;EACpC,MAAM,SAAS,WAAW,IAAI,EAAE,KAAK,KAAK;EAC1C,IAAI,QAAQ,GAAG;GACb,WAAW,IAAI,IAAI,KAAK;GACxB;EACF;EACA,WAAW,OAAO,EAAE;EACpB,YAAY,QAAQ,EAAE;CACxB;CACA,OAAO;EACL,aAAa,OAA6B;GACxC,QAAQ,YAAY,QAAQ,OAAO,SAAS,MAAM,KAAK,GAAG,MAAM,YAAY;GAC5E,IAAI,CAAC,OAAO,MAAM,IAAI,MAAM,yCAAyC;EACvE;EACA,kBACE,UAAU,KAAA,IAAY,KAAA,IAAY;GAAE,WAAW,MAAM,OAAO;GAAW,UAAU,MAAM,OAAO,SAAS;EAAS;EAClH,QACE,OACA,OACA,UACA,OACgC;GAChC,MAAM,KAAK,OAAO,WAAW,MAAM,KAAK;GACxC,MAAM,YAAY,YAAY,QAAQ,IAAI,MAAM,gBAAgB;GAChE,IAAI,CAAC,WAAW,MAAM,IAAI,MAAM,qBAAqB,MAAM,KAAK,EAAE,kBAAkB;GACpF,MAAM,WAAW,OAAO,IAAI,MAAM,KAAK,CAAC;GACxC,IAAI,UAAU,OAAO,IAAI,WAAW,IAAI,KAAK,WAAW,IAAI,EAAE,KAAK,KAAK,CAAC;GACzE,MAAM,WAAW,UAAU,OAAO,SAAS;GAC3C,MAAM,OAAO,oBAAoB,GAAG,GAAG,OAAO,QAAQ;GACtD,MAAM,cAAc,IAAI,IAAI,UAAU,OAAO,SAAS,OAAO,KAAK,UAAU,MAAM,IAAI,CAAC;GACvF,MAAM,cAAkC;IACtC;IACA,OAAO,MAAM;IACb;IACA,aAAa,GAAG,KAAK;IACrB,iBAAiB,GAAG,KAAK;IACzB,sBAAsB,qBAAqB,GAAG,GAAG,OAAO,QAAQ;IAChE,eAAe,YAAY,OAAO,KAAK,CAAC,CAAC,KAAK,WAA6B,CACzE,OAAO,MACP,SAAS,OAAO,KAAK,CACvB,CAAC;IACD,YAAY,gBAAgB,OAAO,KAAK,CAAC,CAAC,QAAQ,SAAS,YAAY,IAAI,IAAI,CAAC;IAChF,YAAY,gBAAgB,OAAO,KAAK,CAAC,CAAC,QAAQ,UAAU,YAAY,IAAI,KAAK,CAAC;IAClF,UAAU,CAAC,GAAG,QAAQ;IACtB,SAAS,CAAC,GAAG,KAAK;GACpB;GACA,OAAO,IAAI,MAAM,KAAK,GAAG,WAAW;GACpC,IAAI,aAAa,KAAA,KAAa,SAAS,OAAO,IAAI,QAAQ,SAAS,EAAE;GACrE,OAAO;EACT;EACA,MAAM,UAAwB,OAAO,IAAI,MAAM,KAAK,CAAC;EACrD,SAAS,UAAwB;GAC/B,MAAM,WAAW,OAAO,IAAI,MAAM,KAAK,CAAC;GACxC,OAAO,OAAO,MAAM,KAAK,CAAC;GAC1B,IAAI,UAAU,QAAQ,SAAS,EAAE;EACnC;;;;;EAKA,cACE,OACA,OACA,UACA,WACuB;GACvB,MAAM,KAAK,OAAO,UAAU,MAAM,KAAK;GACvC,MAAM,YAAY,YAAY,QAAQ,IAAI,MAAM,kBAAkB,QAAQ;GAC1E,IAAI,CAAC,WAAW,MAAM,IAAI,MAAM,qBAAqB,MAAM,KAAK,EAAE,qBAAqB;GACvF,MAAM,WAAW,aAAa,IAAI,MAAM,KAAK,CAAC;GAC9C,IAAI,UAAU,OAAO,IAAI,WAAW,IAAI,KAAK,WAAW,IAAI,EAAE,KAAK,KAAK,CAAC;GACzE,MAAM,WAAW,UAAU,OAAO,SAAS;GAC3C,MAAM,OAAO,oBAAoB,GAAG,GAAG,OAAO,QAAQ;GACtD,MAAM,cAAqC;IACzC;IACA,OAAO,MAAM;IACb;IACA,aAAa,GAAG,KAAK;IACrB,iBAAiB,GAAG,KAAK;IACzB,WAAW;IACX,UAAU,CAAC,GAAG,QAAQ;IACtB,SAAS,CAAC,GAAG,SAAS;GACxB;GACA,aAAa,IAAI,MAAM,KAAK,GAAG,WAAW;GAC1C,IAAI,aAAa,KAAA,KAAa,SAAS,OAAO,IAAI,QAAQ,SAAS,EAAE;GACrE,OAAO;EACT;EACA,YAAY,UAAwB,aAAa,IAAI,MAAM,KAAK,CAAC;EACjE,eAAe,UAAwB;GACrC,MAAM,WAAW,aAAa,IAAI,MAAM,KAAK,CAAC;GAC9C,aAAa,OAAO,MAAM,KAAK,CAAC;GAChC,IAAI,UAAU,QAAQ,SAAS,EAAE;EACnC;;;;;EAKA,aAAa,WACX,UAAU,KAAA,IAAY,KAAA,IAAY,YAAY,OAAO,sBAAsB,MAAM;EACnF,iBAAiB,YAAY,UAAU;EACvC,MAAM,QAAQ,SAAiD;GAC7D,MAAM,MAAM,IAAI,IAAI,QAAQ,GAAG;GAC/B,KACG,IAAI,aAAa,2BAA2B,IAAI,SAAS,WAAW,iBAAiB,MACtF,QAAQ,WAAW,SACnB,QAAQ,WAAW,QAEnB,OAAO,IAAI,SAAS,MAAM,EAAE,QAAQ,IAAI,CAAC;GAC3C,IAAI,IAAI,aAAa,yBAAyB;IAC5C,IAAI,CAAC,OAAO,OAAO,IAAI,SAAS,MAAM,EAAE,QAAQ,IAAI,CAAC;IACrD,OAAO,SAAS,KAAK,MAAM,MAAM;GACnC;GACA,MAAM,aAAa,kCAAkC,KAAK,IAAI,QAAQ;GACtE,IAAI,YAAY;IACd,IAAI,CAAC,SAAS,OAAO,WAAW,EAAE,MAAM,MAAM,OAAO,SAAS,UAC5D,OAAO,IAAI,SAAS,MAAM,EAAE,QAAQ,IAAI,CAAC;IAC3C,MAAM,QAAQ,MAAM,OAAO,SAAS,OAAO,MAAM,UAAU,MAAM,SAAS,WAAW,EAAE;IACvF,IAAI,CAAC,OAAO,OAAO,IAAI,SAAS,MAAM,EAAE,QAAQ,IAAI,CAAC;IACrD,MAAM,QAAQ,MAAM,GAAG,SAAS,SAAS,KAAK,KAAK,MAAM,WAAW,MAAM,IAAI,CAAC;IAC/E,OAAO,IAAI,SAAS,QAAQ,WAAW,SAAS,OAAO,OAAO,EAC5D,SAAS;KAAE,gBAAgB,MAAM;KAAa,0BAA0B;IAAU,EACpF,CAAC;GACH;GACA,MAAM,QAAQ,2EAA2E,KAAK,IAAI,QAAQ;GAC1G,IAAI,CAAC,OAAO,OAAO,KAAA;GACnB,IAAI,QAAQ,WAAW,SAAS,QAAQ,WAAW,QAAQ,OAAO,IAAI,SAAS,MAAM,EAAE,QAAQ,IAAI,CAAC;GACpG,MAAM,SAAS,YAAY,IAAI,MAAM,IAAI,OAAO,MAAM,EAAE,CAAC;GACzD,IAAI,CAAC,QAAQ,OAAO,SAAS,KAAK,EAAE,OAAO,+BAA+B,GAAG,EAAE,QAAQ,IAAI,CAAC;GAC5F,IAAI,MAAM,OAAO,YAAY,OAAO,SAAS,KAAK,OAAO,MAAM;GAC/D,MAAM,YAAY,MAAM,EAAE,CAAC,MAAM,CAAe;GAChD,MAAM,QAAQ,OAAO,OAAO,SAAS,OAAO,MAAM,cAAc,UAAU,SAAS,SAAS;GAC5F,IAAI,CAAC,OAAO,OAAO,SAAS,KAAK,EAAE,OAAO,0BAA0B,GAAG,EAAE,QAAQ,IAAI,CAAC;GACtF,MAAM,QAAQ,MAAM,GAAG,SAAS,SAAS,KAAK,KAAK,OAAO,WAAW,MAAM,IAAI,CAAC;GAChF,OAAO,IAAI,SAAS,QAAQ,WAAW,SAAS,OAAO,OAAO,EAC5D,SAAS;IACP,gBAAgB,MAAM;IACtB,iBAAiB;IACjB,0BAA0B;GAC5B,EACF,CAAC;EACH;EACA,QAAQ;GACN,OAAO,MAAM;GACb,aAAa,MAAM;GACnB,WAAW,MAAM;GACjB,YAAY,MAAM;EACpB;CACF;AACF"}