@agimon-ai/po-core 0.0.0-alpha.2 → 0.0.0-alpha.21

package/dist/src/services/poPackage/sync.mjs

@@ -0,0 +1,50 @@
+import { PACKAGE_MANIFEST, PO_PACKAGE_NAME, parseManifestName } from "./core.mjs";
+import fs from "node:fs";
+import path from "node:path";
+//#region src/services/poPackage/sync.ts
+/**
+* The `name` field of the manifest in a directory, when it has a readable one.
+*
+* @deprecated Node-only sync shim; use manifestNameAsync. Removed in M2.
+*/
+function manifestName(directory) {
+	let content;
+	try {
+		content = fs.readFileSync(path.join(directory, PACKAGE_MANIFEST), "utf8");
+	} catch {
+		return;
+	}
+	return parseManifestName(content);
+}
+/**
+* Name of the nearest package a path belongs to, walking upward from it.
+*
+* @deprecated Node-only sync shim; use enclosingPackageNameAsync. Removed in M2.
+*/
+function enclosingPackageName(target) {
+	let directory;
+	try {
+		directory = fs.statSync(target).isDirectory() ? target : path.dirname(target);
+	} catch {
+		return;
+	}
+	while (true) {
+		const name = manifestName(directory);
+		if (name !== void 0) return name;
+		const parent = path.dirname(directory);
+		if (parent === directory) return void 0;
+		directory = parent;
+	}
+}
+/**
+* True when a resolved path lives inside an installed Po package.
+*
+* @deprecated Node-only sync shim; use isPoPackagePathAsync. Removed in M2.
+*/
+function isPoPackagePath(target) {
+	return enclosingPackageName(target) === PO_PACKAGE_NAME;
+}
+//#endregion
+export { enclosingPackageName, isPoPackagePath, manifestName };
+
+//# sourceMappingURL=sync.mjs.map

package/dist/src/services/poPackage/sync.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"sync.mjs","names":[],"sources":["../../../../src/services/poPackage/sync.ts"],"sourcesContent":["import fs from 'node:fs';\nimport path from 'node:path';\n\nimport { PO_PACKAGE_NAME, PACKAGE_MANIFEST, parseManifestName } from './core';\n\n/**\n * The `name` field of the manifest in a directory, when it has a readable one.\n *\n * @deprecated Node-only sync shim; use manifestNameAsync. Removed in M2.\n */\nexport function manifestName(directory: string): string | undefined {\n  let content: string;\n  try {\n    content = fs.readFileSync(path.join(directory, PACKAGE_MANIFEST), 'utf8');\n  } catch {\n    // A directory with no readable manifest simply is not a package root.\n    return undefined;\n  }\n  return parseManifestName(content);\n}\n\n/**\n * Name of the nearest package a path belongs to, walking upward from it.\n *\n * @deprecated Node-only sync shim; use enclosingPackageNameAsync. Removed in M2.\n */\nexport function enclosingPackageName(target: string): string | undefined {\n  let directory: string;\n  try {\n    directory = fs.statSync(target).isDirectory() ? target : path.dirname(target);\n  } catch {\n    // Nothing at that path, so it names no package.\n    return undefined;\n  }\n\n  while (true) {\n    const name = manifestName(directory);\n    if (name !== undefined) return name;\n    const parent = path.dirname(directory);\n    if (parent === directory) return undefined;\n    directory = parent;\n  }\n}\n\n/**\n * True when a resolved path lives inside an installed Po package.\n *\n * @deprecated Node-only sync shim; use isPoPackagePathAsync. Removed in M2.\n */\nexport function isPoPackagePath(target: string): boolean {\n  return enclosingPackageName(target) === PO_PACKAGE_NAME;\n}\n"],"mappings":";;;;;;;;;AAUA,SAAgB,aAAa,WAAuC;CAClE,IAAI;CACJ,IAAI;EACF,UAAU,GAAG,aAAa,KAAK,KAAK,WAAW,gBAAgB,GAAG,MAAM;CAC1E,QAAQ;EAEN;CACF;CACA,OAAO,kBAAkB,OAAO;AAClC;;;;;;AAOA,SAAgB,qBAAqB,QAAoC;CACvE,IAAI;CACJ,IAAI;EACF,YAAY,GAAG,SAAS,MAAM,CAAC,CAAC,YAAY,IAAI,SAAS,KAAK,QAAQ,MAAM;CAC9E,QAAQ;EAEN;CACF;CAEA,OAAO,MAAM;EACX,MAAM,OAAO,aAAa,SAAS;EACnC,IAAI,SAAS,KAAA,GAAW,OAAO;EAC/B,MAAM,SAAS,KAAK,QAAQ,SAAS;EACrC,IAAI,WAAW,WAAW,OAAO,KAAA;EACjC,YAAY;CACd;AACF;;;;;;AAOA,SAAgB,gBAAgB,QAAyB;CACvD,OAAO,qBAAqB,MAAM,MAAM;AAC1C"}

package/dist/src/services/providerAuth/index.cjs

@@ -52,14 +52,18 @@ function createProviderAuth(options) {
 	};
 	const findProvider = (current, providerId) => current.getProviders().find((provider) => provider.id === providerId);
 	const runningFor = (providerId) => [...flows.values()].find((flow) => flow.providerId === providerId && flow.snapshot().status === "running");
+	const refreshed = async () => {
+		const current = await runtime();
+		try {
+			await current.refresh({ allowNetwork: false });
+		} catch (error) {
+			notice(`provider auth refresh failed: ${describe(error)}`);
+		}
+		return current;
+	};
 	return {
 		async listProviders() {
-			const current = await runtime();
-			try {
-				await current.refresh({ allowNetwork: false });
-			} catch (error) {
-				notice(`provider auth refresh failed: ${describe(error)}`);
-			}
+			const current = await refreshed();
 			return current.getProviders().map((provider) => summarize(current, provider)).sort((left, right) => left.name.localeCompare(right.name));
 		},
 		async startLogin(providerId, type, remote) {
@@ -138,7 +142,7 @@ function createProviderAuth(options) {
 			return { ok: true };
 		},
 		async listModels() {
-			const current = await runtime();
+			const current = await refreshed();
 			const providers = new Map(current.getProviders().map((provider) => [provider.id, provider.name]));
 			return current.getAvailableSnapshot().filter((model) => current.hasConfiguredAuth(model.provider)).map((model) => ({
 				value: `${model.provider}/${model.id}`,

package/dist/src/services/providerAuth/index.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"index.cjs","names":["createLoginFlow","crypto"],"sources":["../../../../src/services/providerAuth/index.ts"],"sourcesContent":["import crypto from 'node:crypto';\n\nimport type {\n  AuthMethodType,\n  AuthRuntime,\n  AuthRuntimeProvider,\n  LoginFlowSnapshot,\n  ProviderAuthMethod,\n  ProviderAuthSummary,\n} from '../../types/server/auth';\nimport { CHATGPT_AUTH_PROVIDER_ID } from '../chatgptAuth';\nimport { createLoginFlow, type LoginFlow } from '../loginFlow';\ninterface SettingsModel {\n  value: string;\n  label: string;\n  group: string;\n}\n\n/** Matches the timeout Pi's own /logout gives the credential store. */\nconst LOGOUT_TIMEOUT_MS = 15_000;\n\nexport type StartLoginOutcome =\n  | { ok: true; flow: LoginFlowSnapshot }\n  | { ok: false; code: 'unknown_provider' | 'unsupported_method' | 'busy'; error: string };\n\nexport type LogoutOutcome = { ok: true } | { ok: false; code: 'unknown_provider' | 'runtime'; error: string };\n\nexport type AnswerOutcome = 'answered' | 'unknown_flow' | 'not_waiting';\n\n/** Provider credentials as the settings page sees them, backed by one Pi runtime. */\nexport interface ProviderAuth {\n  /** Every provider Pi knows, with its current auth state; re-read from disk each call. */\n  listProviders(): Promise<ProviderAuthSummary[]>;\n  /**\n   * Starts a login. `remote` means the browser driving it is on another\n   * machine, which decides whether a redirect-free method is chosen for the\n   * user; it comes from the accepted socket, never from the request body.\n   */\n  startLogin(providerId: string, type: AuthMethodType, remote?: boolean): Promise<StartLoginOutcome>;\n  getLogin(flowId: string): LoginFlowSnapshot | undefined;\n  answerLogin(flowId: string, promptId: string, value: string): AnswerOutcome;\n  /** Cancels the flow and returns how it stands, or undefined for an unknown flow. */\n  cancelLogin(flowId: string): LoginFlowSnapshot | undefined;\n  logout(providerId: string): Promise<LogoutOutcome>;\n  /**\n   * Every model the machine can actually use, grouped by provider. Read from\n   * the same runtime the providers page uses, so the settings model pickers\n   * work with no session running.\n   */\n  listModels(): Promise<readonly SettingsModel[]>;\n  /** Abandons every running flow; the hub is shutting down. */\n  close(): void;\n}\n\nexport interface ProviderAuthOptions {\n  runtime: () => Promise<AuthRuntime>;\n  onNotice?: (message: string) => void;\n}\n\nfunction describe(error: unknown): string {\n  return error instanceof Error ? error.message : String(error);\n}\n\n/** The methods a page can start, in the order the TUI's selector lists them. */\nfunction methodsOf(provider: AuthRuntimeProvider): ProviderAuthMethod[] {\n  const methods: ProviderAuthMethod[] = [];\n  const { oauth, apiKey } = provider.auth;\n  if (oauth) methods.push({ type: 'oauth', label: oauth.loginLabel ?? oauth.name });\n  if (apiKey?.login) methods.push({ type: 'api_key', label: apiKey.name });\n  return methods;\n}\n\n/** Mirrors the status the TUI's login selector shows beside each provider. */\nfunction summarize(runtime: AuthRuntime, provider: AuthRuntimeProvider): ProviderAuthSummary {\n  const summary: ProviderAuthSummary = { id: provider.id, name: provider.name, methods: methodsOf(provider) };\n  if (provider.id === CHATGPT_AUTH_PROVIDER_ID) summary.kind = 'po-feature';\n  const status = runtime.getProviderAuthStatus(provider.id);\n  if (status.configured) {\n    summary.authenticated = {\n      type: runtime.isUsingOAuth(provider.id) ? 'oauth' : 'api_key',\n      source: status.label ?? status.source,\n    };\n  }\n  return summary;\n}\n\nexport function createProviderAuth(options: ProviderAuthOptions): ProviderAuth {\n  const notice = options.onNotice ?? ((): void => {});\n  const load = options.runtime;\n  const flows = new Map<string, LoginFlow>();\n  let loading: Promise<AuthRuntime> | undefined;\n\n  // A failed load is forgotten so the next request tries again rather than\n  // pinning the page on a startup error.\n  const runtime = (): Promise<AuthRuntime> => {\n    loading ??= load().catch((error: unknown) => {\n      loading = undefined;\n      throw error;\n    });\n    return loading;\n  };\n\n  const findProvider = (current: AuthRuntime, providerId: string): AuthRuntimeProvider | undefined =>\n    current.getProviders().find((provider) => provider.id === providerId);\n\n  const runningFor = (providerId: string): LoginFlow | undefined =>\n    [...flows.values()].find((flow) => flow.providerId === providerId && flow.snapshot().status === 'running');\n\n  return {\n    async listProviders() {\n      const current = await runtime();\n      // Another client may have stored a credential since the last look (a\n      // TUI /login, a hand-edited auth.json); the stale snapshot still lists\n      // on a failed refresh, which the notice explains.\n      try {\n        await current.refresh({ allowNetwork: false });\n      } catch (error) {\n        notice(`provider auth refresh failed: ${describe(error)}`);\n      }\n      return current\n        .getProviders()\n        .map((provider) => summarize(current, provider))\n        .sort((left, right) => left.name.localeCompare(right.name));\n    },\n\n    async startLogin(providerId, type, remote) {\n      const current = await runtime();\n      const provider = findProvider(current, providerId);\n      if (!provider) return { ok: false, code: 'unknown_provider', error: `Unknown provider: ${providerId}` };\n      if (!methodsOf(provider).some((method) => method.type === type)) {\n        return { ok: false, code: 'unsupported_method', error: `${provider.name} has no ${type} login.` };\n      }\n      if (runningFor(providerId)) {\n        return { ok: false, code: 'busy', error: `A login for ${provider.name} is already in progress.` };\n      }\n      // Finished flows live until the next start: long enough for the page to\n      // read how they ended, short enough that the map never grows.\n      for (const [id, flow] of flows) if (flow.snapshot().status !== 'running') flows.delete(id);\n\n      const flow = createLoginFlow({\n        id: crypto.randomUUID(),\n        providerId,\n        providerName: provider.name,\n        type,\n        ...(remote === true ? { remote: true } : {}),\n      });\n      flows.set(flow.id, flow);\n      current.login(providerId, type, flow.interaction).then(\n        () => {\n          flow.settle({ ok: true });\n          notice(`signed in to ${provider.name} (${type})`);\n        },\n        (error: unknown) => {\n          flow.settle({ ok: false, error: describe(error) });\n        },\n      );\n      return { ok: true, flow: flow.snapshot() };\n    },\n\n    getLogin(flowId) {\n      return flows.get(flowId)?.snapshot();\n    },\n\n    answerLogin(flowId, promptId, value) {\n      const flow = flows.get(flowId);\n      if (!flow) return 'unknown_flow';\n      return flow.answer(promptId, value) ? 'answered' : 'not_waiting';\n    },\n\n    cancelLogin(flowId) {\n      const flow = flows.get(flowId);\n      if (!flow) return undefined;\n      flow.cancel();\n      return flow.snapshot();\n    },\n\n    async logout(providerId) {\n      const current = await runtime();\n      const provider = findProvider(current, providerId);\n      if (!provider) return { ok: false, code: 'unknown_provider', error: `Unknown provider: ${providerId}` };\n      try {\n        await current.logout(providerId, { signal: AbortSignal.timeout(LOGOUT_TIMEOUT_MS) });\n      } catch (error) {\n        return { ok: false, code: 'runtime', error: describe(error) };\n      }\n      notice(`signed out of ${provider.name}`);\n      return { ok: true };\n    },\n\n    async listModels() {\n      const current = await runtime();\n      const providers = new Map(current.getProviders().map((provider) => [provider.id, provider.name]));\n      return current\n        .getAvailableSnapshot()\n        .filter((model) => current.hasConfiguredAuth(model.provider))\n        .map((model) => ({\n          value: `${model.provider}/${model.id}`,\n          label: model.id,\n          group: providers.get(model.provider) ?? model.provider,\n        }));\n    },\n\n    close() {\n      for (const flow of flows.values()) flow.cancel();\n      flows.clear();\n    },\n  };\n}\n"],"mappings":";;;;;;;AAmBA,MAAM,oBAAoB;AAwC1B,SAAS,SAAS,OAAwB;CACxC,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AAC9D;;AAGA,SAAS,UAAU,UAAqD;CACtE,MAAM,UAAgC,CAAC;CACvC,MAAM,EAAE,OAAO,WAAW,SAAS;CACnC,IAAI,OAAO,QAAQ,KAAK;EAAE,MAAM;EAAS,OAAO,MAAM,cAAc,MAAM;CAAK,CAAC;CAChF,IAAI,QAAQ,OAAO,QAAQ,KAAK;EAAE,MAAM;EAAW,OAAO,OAAO;CAAK,CAAC;CACvE,OAAO;AACT;;AAGA,SAAS,UAAU,SAAsB,UAAoD;CAC3F,MAAM,UAA+B;EAAE,IAAI,SAAS;EAAI,MAAM,SAAS;EAAM,SAAS,UAAU,QAAQ;CAAE;CAC1G,IAAI,SAAS,OAAA,cAAiC,QAAQ,OAAO;CAC7D,MAAM,SAAS,QAAQ,sBAAsB,SAAS,EAAE;CACxD,IAAI,OAAO,YACT,QAAQ,gBAAgB;EACtB,MAAM,QAAQ,aAAa,SAAS,EAAE,IAAI,UAAU;EACpD,QAAQ,OAAO,SAAS,OAAO;CACjC;CAEF,OAAO;AACT;AAEA,SAAgB,mBAAmB,SAA4C;CAC7E,MAAM,SAAS,QAAQ,mBAAyB,CAAC;CACjD,MAAM,OAAO,QAAQ;CACrB,MAAM,wBAAQ,IAAI,IAAuB;CACzC,IAAI;CAIJ,MAAM,gBAAsC;EAC1C,YAAY,KAAK,CAAC,CAAC,OAAO,UAAmB;GAC3C,UAAU,KAAA;GACV,MAAM;EACR,CAAC;EACD,OAAO;CACT;CAEA,MAAM,gBAAgB,SAAsB,eAC1C,QAAQ,aAAa,CAAC,CAAC,MAAM,aAAa,SAAS,OAAO,UAAU;CAEtE,MAAM,cAAc,eAClB,CAAC,GAAG,MAAM,OAAO,CAAC,CAAC,CAAC,MAAM,SAAS,KAAK,eAAe,cAAc,KAAK,SAAS,CAAC,CAAC,WAAW,SAAS;CAE3G,OAAO;EACL,MAAM,gBAAgB;GACpB,MAAM,UAAU,MAAM,QAAQ;GAI9B,IAAI;IACF,MAAM,QAAQ,QAAQ,EAAE,cAAc,MAAM,CAAC;GAC/C,SAAS,OAAO;IACd,OAAO,iCAAiC,SAAS,KAAK,GAAG;GAC3D;GACA,OAAO,QACJ,aAAa,CAAC,CACd,KAAK,aAAa,UAAU,SAAS,QAAQ,CAAC,CAAC,CAC/C,MAAM,MAAM,UAAU,KAAK,KAAK,cAAc,MAAM,IAAI,CAAC;EAC9D;EAEA,MAAM,WAAW,YAAY,MAAM,QAAQ;GACzC,MAAM,UAAU,MAAM,QAAQ;GAC9B,MAAM,WAAW,aAAa,SAAS,UAAU;GACjD,IAAI,CAAC,UAAU,OAAO;IAAE,IAAI;IAAO,MAAM;IAAoB,OAAO,qBAAqB;GAAa;GACtG,IAAI,CAAC,UAAU,QAAQ,CAAC,CAAC,MAAM,WAAW,OAAO,SAAS,IAAI,GAC5D,OAAO;IAAE,IAAI;IAAO,MAAM;IAAsB,OAAO,GAAG,SAAS,KAAK,UAAU,KAAK;GAAS;GAElG,IAAI,WAAW,UAAU,GACvB,OAAO;IAAE,IAAI;IAAO,MAAM;IAAQ,OAAO,eAAe,SAAS,KAAK;GAA0B;GAIlG,KAAK,MAAM,CAAC,IAAI,SAAS,OAAO,IAAI,KAAK,SAAS,CAAC,CAAC,WAAW,WAAW,MAAM,OAAO,EAAE;GAEzF,MAAM,OAAOA,gBAAAA,gBAAgB;IAC3B,IAAIC,YAAAA,QAAO,WAAW;IACtB;IACA,cAAc,SAAS;IACvB;IACA,GAAI,WAAW,OAAO,EAAE,QAAQ,KAAK,IAAI,CAAC;GAC5C,CAAC;GACD,MAAM,IAAI,KAAK,IAAI,IAAI;GACvB,QAAQ,MAAM,YAAY,MAAM,KAAK,WAAW,CAAC,CAAC,WAC1C;IACJ,KAAK,OAAO,EAAE,IAAI,KAAK,CAAC;IACxB,OAAO,gBAAgB,SAAS,KAAK,IAAI,KAAK,EAAE;GAClD,IACC,UAAmB;IAClB,KAAK,OAAO;KAAE,IAAI;KAAO,OAAO,SAAS,KAAK;IAAE,CAAC;GACnD,CACF;GACA,OAAO;IAAE,IAAI;IAAM,MAAM,KAAK,SAAS;GAAE;EAC3C;EAEA,SAAS,QAAQ;GACf,OAAO,MAAM,IAAI,MAAM,CAAC,EAAE,SAAS;EACrC;EAEA,YAAY,QAAQ,UAAU,OAAO;GACnC,MAAM,OAAO,MAAM,IAAI,MAAM;GAC7B,IAAI,CAAC,MAAM,OAAO;GAClB,OAAO,KAAK,OAAO,UAAU,KAAK,IAAI,aAAa;EACrD;EAEA,YAAY,QAAQ;GAClB,MAAM,OAAO,MAAM,IAAI,MAAM;GAC7B,IAAI,CAAC,MAAM,OAAO,KAAA;GAClB,KAAK,OAAO;GACZ,OAAO,KAAK,SAAS;EACvB;EAEA,MAAM,OAAO,YAAY;GACvB,MAAM,UAAU,MAAM,QAAQ;GAC9B,MAAM,WAAW,aAAa,SAAS,UAAU;GACjD,IAAI,CAAC,UAAU,OAAO;IAAE,IAAI;IAAO,MAAM;IAAoB,OAAO,qBAAqB;GAAa;GACtG,IAAI;IACF,MAAM,QAAQ,OAAO,YAAY,EAAE,QAAQ,YAAY,QAAQ,iBAAiB,EAAE,CAAC;GACrF,SAAS,OAAO;IACd,OAAO;KAAE,IAAI;KAAO,MAAM;KAAW,OAAO,SAAS,KAAK;IAAE;GAC9D;GACA,OAAO,iBAAiB,SAAS,MAAM;GACvC,OAAO,EAAE,IAAI,KAAK;EACpB;EAEA,MAAM,aAAa;GACjB,MAAM,UAAU,MAAM,QAAQ;GAC9B,MAAM,YAAY,IAAI,IAAI,QAAQ,aAAa,CAAC,CAAC,KAAK,aAAa,CAAC,SAAS,IAAI,SAAS,IAAI,CAAC,CAAC;GAChG,OAAO,QACJ,qBAAqB,CAAC,CACtB,QAAQ,UAAU,QAAQ,kBAAkB,MAAM,QAAQ,CAAC,CAAC,CAC5D,KAAK,WAAW;IACf,OAAO,GAAG,MAAM,SAAS,GAAG,MAAM;IAClC,OAAO,MAAM;IACb,OAAO,UAAU,IAAI,MAAM,QAAQ,KAAK,MAAM;GAChD,EAAE;EACN;EAEA,QAAQ;GACN,KAAK,MAAM,QAAQ,MAAM,OAAO,GAAG,KAAK,OAAO;GAC/C,MAAM,MAAM;EACd;CACF;AACF"}
+{"version":3,"file":"index.cjs","names":["createLoginFlow","crypto"],"sources":["../../../../src/services/providerAuth/index.ts"],"sourcesContent":["import crypto from 'node:crypto';\n\nimport type {\n  AuthMethodType,\n  AuthRuntime,\n  AuthRuntimeProvider,\n  LoginFlowSnapshot,\n  ProviderAuthMethod,\n  ProviderAuthSummary,\n} from '../../types/server/auth';\nimport { CHATGPT_AUTH_PROVIDER_ID } from '../chatgptAuth';\nimport { createLoginFlow, type LoginFlow } from '../loginFlow';\ninterface SettingsModel {\n  value: string;\n  label: string;\n  group: string;\n}\n\n/** Matches the timeout Pi's own /logout gives the credential store. */\nconst LOGOUT_TIMEOUT_MS = 15_000;\n\nexport type StartLoginOutcome =\n  | { ok: true; flow: LoginFlowSnapshot }\n  | { ok: false; code: 'unknown_provider' | 'unsupported_method' | 'busy'; error: string };\n\nexport type LogoutOutcome = { ok: true } | { ok: false; code: 'unknown_provider' | 'runtime'; error: string };\n\nexport type AnswerOutcome = 'answered' | 'unknown_flow' | 'not_waiting';\n\n/** Provider credentials as the settings page sees them, backed by one Pi runtime. */\nexport interface ProviderAuth {\n  /** Every provider Pi knows, with its current auth state; re-read from disk each call. */\n  listProviders(): Promise<ProviderAuthSummary[]>;\n  /**\n   * Starts a login. `remote` means the browser driving it is on another\n   * machine, which decides whether a redirect-free method is chosen for the\n   * user; it comes from the accepted socket, never from the request body.\n   */\n  startLogin(providerId: string, type: AuthMethodType, remote?: boolean): Promise<StartLoginOutcome>;\n  getLogin(flowId: string): LoginFlowSnapshot | undefined;\n  answerLogin(flowId: string, promptId: string, value: string): AnswerOutcome;\n  /** Cancels the flow and returns how it stands, or undefined for an unknown flow. */\n  cancelLogin(flowId: string): LoginFlowSnapshot | undefined;\n  logout(providerId: string): Promise<LogoutOutcome>;\n  /**\n   * Every model the machine can actually use, grouped by provider. Read from\n   * the same runtime the providers page uses, so the settings model pickers\n   * work with no session running.\n   */\n  listModels(): Promise<readonly SettingsModel[]>;\n  /** Abandons every running flow; the hub is shutting down. */\n  close(): void;\n}\n\nexport interface ProviderAuthOptions {\n  runtime: () => Promise<AuthRuntime>;\n  onNotice?: (message: string) => void;\n}\n\nfunction describe(error: unknown): string {\n  return error instanceof Error ? error.message : String(error);\n}\n\n/** The methods a page can start, in the order the TUI's selector lists them. */\nfunction methodsOf(provider: AuthRuntimeProvider): ProviderAuthMethod[] {\n  const methods: ProviderAuthMethod[] = [];\n  const { oauth, apiKey } = provider.auth;\n  if (oauth) methods.push({ type: 'oauth', label: oauth.loginLabel ?? oauth.name });\n  if (apiKey?.login) methods.push({ type: 'api_key', label: apiKey.name });\n  return methods;\n}\n\n/** Mirrors the status the TUI's login selector shows beside each provider. */\nfunction summarize(runtime: AuthRuntime, provider: AuthRuntimeProvider): ProviderAuthSummary {\n  const summary: ProviderAuthSummary = { id: provider.id, name: provider.name, methods: methodsOf(provider) };\n  if (provider.id === CHATGPT_AUTH_PROVIDER_ID) summary.kind = 'po-feature';\n  const status = runtime.getProviderAuthStatus(provider.id);\n  if (status.configured) {\n    summary.authenticated = {\n      type: runtime.isUsingOAuth(provider.id) ? 'oauth' : 'api_key',\n      source: status.label ?? status.source,\n    };\n  }\n  return summary;\n}\n\nexport function createProviderAuth(options: ProviderAuthOptions): ProviderAuth {\n  const notice = options.onNotice ?? ((): void => {});\n  const load = options.runtime;\n  const flows = new Map<string, LoginFlow>();\n  let loading: Promise<AuthRuntime> | undefined;\n\n  // A failed load is forgotten so the next request tries again rather than\n  // pinning the page on a startup error.\n  const runtime = (): Promise<AuthRuntime> => {\n    loading ??= load().catch((error: unknown) => {\n      loading = undefined;\n      throw error;\n    });\n    return loading;\n  };\n\n  const findProvider = (current: AuthRuntime, providerId: string): AuthRuntimeProvider | undefined =>\n    current.getProviders().find((provider) => provider.id === providerId);\n\n  const runningFor = (providerId: string): LoginFlow | undefined =>\n    [...flows.values()].find((flow) => flow.providerId === providerId && flow.snapshot().status === 'running');\n\n  // Another client may have stored a credential since the last look (a TUI\n  // /login, a hand-edited auth.json), and a provider registered by a Pi\n  // extension after the runtime was created is missing from the cached auth\n  // state until a refresh. The stale snapshot still lists on a failed refresh,\n  // which the notice explains.\n  const refreshed = async (): Promise<AuthRuntime> => {\n    const current = await runtime();\n    try {\n      await current.refresh({ allowNetwork: false });\n    } catch (error) {\n      notice(`provider auth refresh failed: ${describe(error)}`);\n    }\n    return current;\n  };\n\n  return {\n    async listProviders() {\n      const current = await refreshed();\n      return current\n        .getProviders()\n        .map((provider) => summarize(current, provider))\n        .sort((left, right) => left.name.localeCompare(right.name));\n    },\n\n    async startLogin(providerId, type, remote) {\n      const current = await runtime();\n      const provider = findProvider(current, providerId);\n      if (!provider) return { ok: false, code: 'unknown_provider', error: `Unknown provider: ${providerId}` };\n      if (!methodsOf(provider).some((method) => method.type === type)) {\n        return { ok: false, code: 'unsupported_method', error: `${provider.name} has no ${type} login.` };\n      }\n      if (runningFor(providerId)) {\n        return { ok: false, code: 'busy', error: `A login for ${provider.name} is already in progress.` };\n      }\n      // Finished flows live until the next start: long enough for the page to\n      // read how they ended, short enough that the map never grows.\n      for (const [id, flow] of flows) if (flow.snapshot().status !== 'running') flows.delete(id);\n\n      const flow = createLoginFlow({\n        id: crypto.randomUUID(),\n        providerId,\n        providerName: provider.name,\n        type,\n        ...(remote === true ? { remote: true } : {}),\n      });\n      flows.set(flow.id, flow);\n      current.login(providerId, type, flow.interaction).then(\n        () => {\n          flow.settle({ ok: true });\n          notice(`signed in to ${provider.name} (${type})`);\n        },\n        (error: unknown) => {\n          flow.settle({ ok: false, error: describe(error) });\n        },\n      );\n      return { ok: true, flow: flow.snapshot() };\n    },\n\n    getLogin(flowId) {\n      return flows.get(flowId)?.snapshot();\n    },\n\n    answerLogin(flowId, promptId, value) {\n      const flow = flows.get(flowId);\n      if (!flow) return 'unknown_flow';\n      return flow.answer(promptId, value) ? 'answered' : 'not_waiting';\n    },\n\n    cancelLogin(flowId) {\n      const flow = flows.get(flowId);\n      if (!flow) return undefined;\n      flow.cancel();\n      return flow.snapshot();\n    },\n\n    async logout(providerId) {\n      const current = await runtime();\n      const provider = findProvider(current, providerId);\n      if (!provider) return { ok: false, code: 'unknown_provider', error: `Unknown provider: ${providerId}` };\n      try {\n        await current.logout(providerId, { signal: AbortSignal.timeout(LOGOUT_TIMEOUT_MS) });\n      } catch (error) {\n        return { ok: false, code: 'runtime', error: describe(error) };\n      }\n      notice(`signed out of ${provider.name}`);\n      return { ok: true };\n    },\n\n    async listModels() {\n      const current = await refreshed();\n      const providers = new Map(current.getProviders().map((provider) => [provider.id, provider.name]));\n      return current\n        .getAvailableSnapshot()\n        .filter((model) => current.hasConfiguredAuth(model.provider))\n        .map((model) => ({\n          value: `${model.provider}/${model.id}`,\n          label: model.id,\n          group: providers.get(model.provider) ?? model.provider,\n        }));\n    },\n\n    close() {\n      for (const flow of flows.values()) flow.cancel();\n      flows.clear();\n    },\n  };\n}\n"],"mappings":";;;;;;;AAmBA,MAAM,oBAAoB;AAwC1B,SAAS,SAAS,OAAwB;CACxC,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AAC9D;;AAGA,SAAS,UAAU,UAAqD;CACtE,MAAM,UAAgC,CAAC;CACvC,MAAM,EAAE,OAAO,WAAW,SAAS;CACnC,IAAI,OAAO,QAAQ,KAAK;EAAE,MAAM;EAAS,OAAO,MAAM,cAAc,MAAM;CAAK,CAAC;CAChF,IAAI,QAAQ,OAAO,QAAQ,KAAK;EAAE,MAAM;EAAW,OAAO,OAAO;CAAK,CAAC;CACvE,OAAO;AACT;;AAGA,SAAS,UAAU,SAAsB,UAAoD;CAC3F,MAAM,UAA+B;EAAE,IAAI,SAAS;EAAI,MAAM,SAAS;EAAM,SAAS,UAAU,QAAQ;CAAE;CAC1G,IAAI,SAAS,OAAA,cAAiC,QAAQ,OAAO;CAC7D,MAAM,SAAS,QAAQ,sBAAsB,SAAS,EAAE;CACxD,IAAI,OAAO,YACT,QAAQ,gBAAgB;EACtB,MAAM,QAAQ,aAAa,SAAS,EAAE,IAAI,UAAU;EACpD,QAAQ,OAAO,SAAS,OAAO;CACjC;CAEF,OAAO;AACT;AAEA,SAAgB,mBAAmB,SAA4C;CAC7E,MAAM,SAAS,QAAQ,mBAAyB,CAAC;CACjD,MAAM,OAAO,QAAQ;CACrB,MAAM,wBAAQ,IAAI,IAAuB;CACzC,IAAI;CAIJ,MAAM,gBAAsC;EAC1C,YAAY,KAAK,CAAC,CAAC,OAAO,UAAmB;GAC3C,UAAU,KAAA;GACV,MAAM;EACR,CAAC;EACD,OAAO;CACT;CAEA,MAAM,gBAAgB,SAAsB,eAC1C,QAAQ,aAAa,CAAC,CAAC,MAAM,aAAa,SAAS,OAAO,UAAU;CAEtE,MAAM,cAAc,eAClB,CAAC,GAAG,MAAM,OAAO,CAAC,CAAC,CAAC,MAAM,SAAS,KAAK,eAAe,cAAc,KAAK,SAAS,CAAC,CAAC,WAAW,SAAS;CAO3G,MAAM,YAAY,YAAkC;EAClD,MAAM,UAAU,MAAM,QAAQ;EAC9B,IAAI;GACF,MAAM,QAAQ,QAAQ,EAAE,cAAc,MAAM,CAAC;EAC/C,SAAS,OAAO;GACd,OAAO,iCAAiC,SAAS,KAAK,GAAG;EAC3D;EACA,OAAO;CACT;CAEA,OAAO;EACL,MAAM,gBAAgB;GACpB,MAAM,UAAU,MAAM,UAAU;GAChC,OAAO,QACJ,aAAa,CAAC,CACd,KAAK,aAAa,UAAU,SAAS,QAAQ,CAAC,CAAC,CAC/C,MAAM,MAAM,UAAU,KAAK,KAAK,cAAc,MAAM,IAAI,CAAC;EAC9D;EAEA,MAAM,WAAW,YAAY,MAAM,QAAQ;GACzC,MAAM,UAAU,MAAM,QAAQ;GAC9B,MAAM,WAAW,aAAa,SAAS,UAAU;GACjD,IAAI,CAAC,UAAU,OAAO;IAAE,IAAI;IAAO,MAAM;IAAoB,OAAO,qBAAqB;GAAa;GACtG,IAAI,CAAC,UAAU,QAAQ,CAAC,CAAC,MAAM,WAAW,OAAO,SAAS,IAAI,GAC5D,OAAO;IAAE,IAAI;IAAO,MAAM;IAAsB,OAAO,GAAG,SAAS,KAAK,UAAU,KAAK;GAAS;GAElG,IAAI,WAAW,UAAU,GACvB,OAAO;IAAE,IAAI;IAAO,MAAM;IAAQ,OAAO,eAAe,SAAS,KAAK;GAA0B;GAIlG,KAAK,MAAM,CAAC,IAAI,SAAS,OAAO,IAAI,KAAK,SAAS,CAAC,CAAC,WAAW,WAAW,MAAM,OAAO,EAAE;GAEzF,MAAM,OAAOA,gBAAAA,gBAAgB;IAC3B,IAAIC,YAAAA,QAAO,WAAW;IACtB;IACA,cAAc,SAAS;IACvB;IACA,GAAI,WAAW,OAAO,EAAE,QAAQ,KAAK,IAAI,CAAC;GAC5C,CAAC;GACD,MAAM,IAAI,KAAK,IAAI,IAAI;GACvB,QAAQ,MAAM,YAAY,MAAM,KAAK,WAAW,CAAC,CAAC,WAC1C;IACJ,KAAK,OAAO,EAAE,IAAI,KAAK,CAAC;IACxB,OAAO,gBAAgB,SAAS,KAAK,IAAI,KAAK,EAAE;GAClD,IACC,UAAmB;IAClB,KAAK,OAAO;KAAE,IAAI;KAAO,OAAO,SAAS,KAAK;IAAE,CAAC;GACnD,CACF;GACA,OAAO;IAAE,IAAI;IAAM,MAAM,KAAK,SAAS;GAAE;EAC3C;EAEA,SAAS,QAAQ;GACf,OAAO,MAAM,IAAI,MAAM,CAAC,EAAE,SAAS;EACrC;EAEA,YAAY,QAAQ,UAAU,OAAO;GACnC,MAAM,OAAO,MAAM,IAAI,MAAM;GAC7B,IAAI,CAAC,MAAM,OAAO;GAClB,OAAO,KAAK,OAAO,UAAU,KAAK,IAAI,aAAa;EACrD;EAEA,YAAY,QAAQ;GAClB,MAAM,OAAO,MAAM,IAAI,MAAM;GAC7B,IAAI,CAAC,MAAM,OAAO,KAAA;GAClB,KAAK,OAAO;GACZ,OAAO,KAAK,SAAS;EACvB;EAEA,MAAM,OAAO,YAAY;GACvB,MAAM,UAAU,MAAM,QAAQ;GAC9B,MAAM,WAAW,aAAa,SAAS,UAAU;GACjD,IAAI,CAAC,UAAU,OAAO;IAAE,IAAI;IAAO,MAAM;IAAoB,OAAO,qBAAqB;GAAa;GACtG,IAAI;IACF,MAAM,QAAQ,OAAO,YAAY,EAAE,QAAQ,YAAY,QAAQ,iBAAiB,EAAE,CAAC;GACrF,SAAS,OAAO;IACd,OAAO;KAAE,IAAI;KAAO,MAAM;KAAW,OAAO,SAAS,KAAK;IAAE;GAC9D;GACA,OAAO,iBAAiB,SAAS,MAAM;GACvC,OAAO,EAAE,IAAI,KAAK;EACpB;EAEA,MAAM,aAAa;GACjB,MAAM,UAAU,MAAM,UAAU;GAChC,MAAM,YAAY,IAAI,IAAI,QAAQ,aAAa,CAAC,CAAC,KAAK,aAAa,CAAC,SAAS,IAAI,SAAS,IAAI,CAAC,CAAC;GAChG,OAAO,QACJ,qBAAqB,CAAC,CACtB,QAAQ,UAAU,QAAQ,kBAAkB,MAAM,QAAQ,CAAC,CAAC,CAC5D,KAAK,WAAW;IACf,OAAO,GAAG,MAAM,SAAS,GAAG,MAAM;IAClC,OAAO,MAAM;IACb,OAAO,UAAU,IAAI,MAAM,QAAQ,KAAK,MAAM;GAChD,EAAE;EACN;EAEA,QAAQ;GACN,KAAK,MAAM,QAAQ,MAAM,OAAO,GAAG,KAAK,OAAO;GAC/C,MAAM,MAAM;EACd;CACF;AACF"}

package/dist/src/services/providerAuth/index.mjs

@@ -50,14 +50,18 @@ function createProviderAuth(options) {
 	};
 	const findProvider = (current, providerId) => current.getProviders().find((provider) => provider.id === providerId);
 	const runningFor = (providerId) => [...flows.values()].find((flow) => flow.providerId === providerId && flow.snapshot().status === "running");
+	const refreshed = async () => {
+		const current = await runtime();
+		try {
+			await current.refresh({ allowNetwork: false });
+		} catch (error) {
+			notice(`provider auth refresh failed: ${describe(error)}`);
+		}
+		return current;
+	};
 	return {
 		async listProviders() {
-			const current = await runtime();
-			try {
-				await current.refresh({ allowNetwork: false });
-			} catch (error) {
-				notice(`provider auth refresh failed: ${describe(error)}`);
-			}
+			const current = await refreshed();
 			return current.getProviders().map((provider) => summarize(current, provider)).sort((left, right) => left.name.localeCompare(right.name));
 		},
 		async startLogin(providerId, type, remote) {
@@ -136,7 +140,7 @@ function createProviderAuth(options) {
 			return { ok: true };
 		},
 		async listModels() {
-			const current = await runtime();
+			const current = await refreshed();
 			const providers = new Map(current.getProviders().map((provider) => [provider.id, provider.name]));
 			return current.getAvailableSnapshot().filter((model) => current.hasConfiguredAuth(model.provider)).map((model) => ({
 				value: `${model.provider}/${model.id}`,

package/dist/src/services/providerAuth/index.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"index.mjs","names":[],"sources":["../../../../src/services/providerAuth/index.ts"],"sourcesContent":["import crypto from 'node:crypto';\n\nimport type {\n  AuthMethodType,\n  AuthRuntime,\n  AuthRuntimeProvider,\n  LoginFlowSnapshot,\n  ProviderAuthMethod,\n  ProviderAuthSummary,\n} from '../../types/server/auth';\nimport { CHATGPT_AUTH_PROVIDER_ID } from '../chatgptAuth';\nimport { createLoginFlow, type LoginFlow } from '../loginFlow';\ninterface SettingsModel {\n  value: string;\n  label: string;\n  group: string;\n}\n\n/** Matches the timeout Pi's own /logout gives the credential store. */\nconst LOGOUT_TIMEOUT_MS = 15_000;\n\nexport type StartLoginOutcome =\n  | { ok: true; flow: LoginFlowSnapshot }\n  | { ok: false; code: 'unknown_provider' | 'unsupported_method' | 'busy'; error: string };\n\nexport type LogoutOutcome = { ok: true } | { ok: false; code: 'unknown_provider' | 'runtime'; error: string };\n\nexport type AnswerOutcome = 'answered' | 'unknown_flow' | 'not_waiting';\n\n/** Provider credentials as the settings page sees them, backed by one Pi runtime. */\nexport interface ProviderAuth {\n  /** Every provider Pi knows, with its current auth state; re-read from disk each call. */\n  listProviders(): Promise<ProviderAuthSummary[]>;\n  /**\n   * Starts a login. `remote` means the browser driving it is on another\n   * machine, which decides whether a redirect-free method is chosen for the\n   * user; it comes from the accepted socket, never from the request body.\n   */\n  startLogin(providerId: string, type: AuthMethodType, remote?: boolean): Promise<StartLoginOutcome>;\n  getLogin(flowId: string): LoginFlowSnapshot | undefined;\n  answerLogin(flowId: string, promptId: string, value: string): AnswerOutcome;\n  /** Cancels the flow and returns how it stands, or undefined for an unknown flow. */\n  cancelLogin(flowId: string): LoginFlowSnapshot | undefined;\n  logout(providerId: string): Promise<LogoutOutcome>;\n  /**\n   * Every model the machine can actually use, grouped by provider. Read from\n   * the same runtime the providers page uses, so the settings model pickers\n   * work with no session running.\n   */\n  listModels(): Promise<readonly SettingsModel[]>;\n  /** Abandons every running flow; the hub is shutting down. */\n  close(): void;\n}\n\nexport interface ProviderAuthOptions {\n  runtime: () => Promise<AuthRuntime>;\n  onNotice?: (message: string) => void;\n}\n\nfunction describe(error: unknown): string {\n  return error instanceof Error ? error.message : String(error);\n}\n\n/** The methods a page can start, in the order the TUI's selector lists them. */\nfunction methodsOf(provider: AuthRuntimeProvider): ProviderAuthMethod[] {\n  const methods: ProviderAuthMethod[] = [];\n  const { oauth, apiKey } = provider.auth;\n  if (oauth) methods.push({ type: 'oauth', label: oauth.loginLabel ?? oauth.name });\n  if (apiKey?.login) methods.push({ type: 'api_key', label: apiKey.name });\n  return methods;\n}\n\n/** Mirrors the status the TUI's login selector shows beside each provider. */\nfunction summarize(runtime: AuthRuntime, provider: AuthRuntimeProvider): ProviderAuthSummary {\n  const summary: ProviderAuthSummary = { id: provider.id, name: provider.name, methods: methodsOf(provider) };\n  if (provider.id === CHATGPT_AUTH_PROVIDER_ID) summary.kind = 'po-feature';\n  const status = runtime.getProviderAuthStatus(provider.id);\n  if (status.configured) {\n    summary.authenticated = {\n      type: runtime.isUsingOAuth(provider.id) ? 'oauth' : 'api_key',\n      source: status.label ?? status.source,\n    };\n  }\n  return summary;\n}\n\nexport function createProviderAuth(options: ProviderAuthOptions): ProviderAuth {\n  const notice = options.onNotice ?? ((): void => {});\n  const load = options.runtime;\n  const flows = new Map<string, LoginFlow>();\n  let loading: Promise<AuthRuntime> | undefined;\n\n  // A failed load is forgotten so the next request tries again rather than\n  // pinning the page on a startup error.\n  const runtime = (): Promise<AuthRuntime> => {\n    loading ??= load().catch((error: unknown) => {\n      loading = undefined;\n      throw error;\n    });\n    return loading;\n  };\n\n  const findProvider = (current: AuthRuntime, providerId: string): AuthRuntimeProvider | undefined =>\n    current.getProviders().find((provider) => provider.id === providerId);\n\n  const runningFor = (providerId: string): LoginFlow | undefined =>\n    [...flows.values()].find((flow) => flow.providerId === providerId && flow.snapshot().status === 'running');\n\n  return {\n    async listProviders() {\n      const current = await runtime();\n      // Another client may have stored a credential since the last look (a\n      // TUI /login, a hand-edited auth.json); the stale snapshot still lists\n      // on a failed refresh, which the notice explains.\n      try {\n        await current.refresh({ allowNetwork: false });\n      } catch (error) {\n        notice(`provider auth refresh failed: ${describe(error)}`);\n      }\n      return current\n        .getProviders()\n        .map((provider) => summarize(current, provider))\n        .sort((left, right) => left.name.localeCompare(right.name));\n    },\n\n    async startLogin(providerId, type, remote) {\n      const current = await runtime();\n      const provider = findProvider(current, providerId);\n      if (!provider) return { ok: false, code: 'unknown_provider', error: `Unknown provider: ${providerId}` };\n      if (!methodsOf(provider).some((method) => method.type === type)) {\n        return { ok: false, code: 'unsupported_method', error: `${provider.name} has no ${type} login.` };\n      }\n      if (runningFor(providerId)) {\n        return { ok: false, code: 'busy', error: `A login for ${provider.name} is already in progress.` };\n      }\n      // Finished flows live until the next start: long enough for the page to\n      // read how they ended, short enough that the map never grows.\n      for (const [id, flow] of flows) if (flow.snapshot().status !== 'running') flows.delete(id);\n\n      const flow = createLoginFlow({\n        id: crypto.randomUUID(),\n        providerId,\n        providerName: provider.name,\n        type,\n        ...(remote === true ? { remote: true } : {}),\n      });\n      flows.set(flow.id, flow);\n      current.login(providerId, type, flow.interaction).then(\n        () => {\n          flow.settle({ ok: true });\n          notice(`signed in to ${provider.name} (${type})`);\n        },\n        (error: unknown) => {\n          flow.settle({ ok: false, error: describe(error) });\n        },\n      );\n      return { ok: true, flow: flow.snapshot() };\n    },\n\n    getLogin(flowId) {\n      return flows.get(flowId)?.snapshot();\n    },\n\n    answerLogin(flowId, promptId, value) {\n      const flow = flows.get(flowId);\n      if (!flow) return 'unknown_flow';\n      return flow.answer(promptId, value) ? 'answered' : 'not_waiting';\n    },\n\n    cancelLogin(flowId) {\n      const flow = flows.get(flowId);\n      if (!flow) return undefined;\n      flow.cancel();\n      return flow.snapshot();\n    },\n\n    async logout(providerId) {\n      const current = await runtime();\n      const provider = findProvider(current, providerId);\n      if (!provider) return { ok: false, code: 'unknown_provider', error: `Unknown provider: ${providerId}` };\n      try {\n        await current.logout(providerId, { signal: AbortSignal.timeout(LOGOUT_TIMEOUT_MS) });\n      } catch (error) {\n        return { ok: false, code: 'runtime', error: describe(error) };\n      }\n      notice(`signed out of ${provider.name}`);\n      return { ok: true };\n    },\n\n    async listModels() {\n      const current = await runtime();\n      const providers = new Map(current.getProviders().map((provider) => [provider.id, provider.name]));\n      return current\n        .getAvailableSnapshot()\n        .filter((model) => current.hasConfiguredAuth(model.provider))\n        .map((model) => ({\n          value: `${model.provider}/${model.id}`,\n          label: model.id,\n          group: providers.get(model.provider) ?? model.provider,\n        }));\n    },\n\n    close() {\n      for (const flow of flows.values()) flow.cancel();\n      flows.clear();\n    },\n  };\n}\n"],"mappings":";;;;;AAmBA,MAAM,oBAAoB;AAwC1B,SAAS,SAAS,OAAwB;CACxC,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AAC9D;;AAGA,SAAS,UAAU,UAAqD;CACtE,MAAM,UAAgC,CAAC;CACvC,MAAM,EAAE,OAAO,WAAW,SAAS;CACnC,IAAI,OAAO,QAAQ,KAAK;EAAE,MAAM;EAAS,OAAO,MAAM,cAAc,MAAM;CAAK,CAAC;CAChF,IAAI,QAAQ,OAAO,QAAQ,KAAK;EAAE,MAAM;EAAW,OAAO,OAAO;CAAK,CAAC;CACvE,OAAO;AACT;;AAGA,SAAS,UAAU,SAAsB,UAAoD;CAC3F,MAAM,UAA+B;EAAE,IAAI,SAAS;EAAI,MAAM,SAAS;EAAM,SAAS,UAAU,QAAQ;CAAE;CAC1G,IAAI,SAAS,OAAA,cAAiC,QAAQ,OAAO;CAC7D,MAAM,SAAS,QAAQ,sBAAsB,SAAS,EAAE;CACxD,IAAI,OAAO,YACT,QAAQ,gBAAgB;EACtB,MAAM,QAAQ,aAAa,SAAS,EAAE,IAAI,UAAU;EACpD,QAAQ,OAAO,SAAS,OAAO;CACjC;CAEF,OAAO;AACT;AAEA,SAAgB,mBAAmB,SAA4C;CAC7E,MAAM,SAAS,QAAQ,mBAAyB,CAAC;CACjD,MAAM,OAAO,QAAQ;CACrB,MAAM,wBAAQ,IAAI,IAAuB;CACzC,IAAI;CAIJ,MAAM,gBAAsC;EAC1C,YAAY,KAAK,CAAC,CAAC,OAAO,UAAmB;GAC3C,UAAU,KAAA;GACV,MAAM;EACR,CAAC;EACD,OAAO;CACT;CAEA,MAAM,gBAAgB,SAAsB,eAC1C,QAAQ,aAAa,CAAC,CAAC,MAAM,aAAa,SAAS,OAAO,UAAU;CAEtE,MAAM,cAAc,eAClB,CAAC,GAAG,MAAM,OAAO,CAAC,CAAC,CAAC,MAAM,SAAS,KAAK,eAAe,cAAc,KAAK,SAAS,CAAC,CAAC,WAAW,SAAS;CAE3G,OAAO;EACL,MAAM,gBAAgB;GACpB,MAAM,UAAU,MAAM,QAAQ;GAI9B,IAAI;IACF,MAAM,QAAQ,QAAQ,EAAE,cAAc,MAAM,CAAC;GAC/C,SAAS,OAAO;IACd,OAAO,iCAAiC,SAAS,KAAK,GAAG;GAC3D;GACA,OAAO,QACJ,aAAa,CAAC,CACd,KAAK,aAAa,UAAU,SAAS,QAAQ,CAAC,CAAC,CAC/C,MAAM,MAAM,UAAU,KAAK,KAAK,cAAc,MAAM,IAAI,CAAC;EAC9D;EAEA,MAAM,WAAW,YAAY,MAAM,QAAQ;GACzC,MAAM,UAAU,MAAM,QAAQ;GAC9B,MAAM,WAAW,aAAa,SAAS,UAAU;GACjD,IAAI,CAAC,UAAU,OAAO;IAAE,IAAI;IAAO,MAAM;IAAoB,OAAO,qBAAqB;GAAa;GACtG,IAAI,CAAC,UAAU,QAAQ,CAAC,CAAC,MAAM,WAAW,OAAO,SAAS,IAAI,GAC5D,OAAO;IAAE,IAAI;IAAO,MAAM;IAAsB,OAAO,GAAG,SAAS,KAAK,UAAU,KAAK;GAAS;GAElG,IAAI,WAAW,UAAU,GACvB,OAAO;IAAE,IAAI;IAAO,MAAM;IAAQ,OAAO,eAAe,SAAS,KAAK;GAA0B;GAIlG,KAAK,MAAM,CAAC,IAAI,SAAS,OAAO,IAAI,KAAK,SAAS,CAAC,CAAC,WAAW,WAAW,MAAM,OAAO,EAAE;GAEzF,MAAM,OAAO,gBAAgB;IAC3B,IAAI,OAAO,WAAW;IACtB;IACA,cAAc,SAAS;IACvB;IACA,GAAI,WAAW,OAAO,EAAE,QAAQ,KAAK,IAAI,CAAC;GAC5C,CAAC;GACD,MAAM,IAAI,KAAK,IAAI,IAAI;GACvB,QAAQ,MAAM,YAAY,MAAM,KAAK,WAAW,CAAC,CAAC,WAC1C;IACJ,KAAK,OAAO,EAAE,IAAI,KAAK,CAAC;IACxB,OAAO,gBAAgB,SAAS,KAAK,IAAI,KAAK,EAAE;GAClD,IACC,UAAmB;IAClB,KAAK,OAAO;KAAE,IAAI;KAAO,OAAO,SAAS,KAAK;IAAE,CAAC;GACnD,CACF;GACA,OAAO;IAAE,IAAI;IAAM,MAAM,KAAK,SAAS;GAAE;EAC3C;EAEA,SAAS,QAAQ;GACf,OAAO,MAAM,IAAI,MAAM,CAAC,EAAE,SAAS;EACrC;EAEA,YAAY,QAAQ,UAAU,OAAO;GACnC,MAAM,OAAO,MAAM,IAAI,MAAM;GAC7B,IAAI,CAAC,MAAM,OAAO;GAClB,OAAO,KAAK,OAAO,UAAU,KAAK,IAAI,aAAa;EACrD;EAEA,YAAY,QAAQ;GAClB,MAAM,OAAO,MAAM,IAAI,MAAM;GAC7B,IAAI,CAAC,MAAM,OAAO,KAAA;GAClB,KAAK,OAAO;GACZ,OAAO,KAAK,SAAS;EACvB;EAEA,MAAM,OAAO,YAAY;GACvB,MAAM,UAAU,MAAM,QAAQ;GAC9B,MAAM,WAAW,aAAa,SAAS,UAAU;GACjD,IAAI,CAAC,UAAU,OAAO;IAAE,IAAI;IAAO,MAAM;IAAoB,OAAO,qBAAqB;GAAa;GACtG,IAAI;IACF,MAAM,QAAQ,OAAO,YAAY,EAAE,QAAQ,YAAY,QAAQ,iBAAiB,EAAE,CAAC;GACrF,SAAS,OAAO;IACd,OAAO;KAAE,IAAI;KAAO,MAAM;KAAW,OAAO,SAAS,KAAK;IAAE;GAC9D;GACA,OAAO,iBAAiB,SAAS,MAAM;GACvC,OAAO,EAAE,IAAI,KAAK;EACpB;EAEA,MAAM,aAAa;GACjB,MAAM,UAAU,MAAM,QAAQ;GAC9B,MAAM,YAAY,IAAI,IAAI,QAAQ,aAAa,CAAC,CAAC,KAAK,aAAa,CAAC,SAAS,IAAI,SAAS,IAAI,CAAC,CAAC;GAChG,OAAO,QACJ,qBAAqB,CAAC,CACtB,QAAQ,UAAU,QAAQ,kBAAkB,MAAM,QAAQ,CAAC,CAAC,CAC5D,KAAK,WAAW;IACf,OAAO,GAAG,MAAM,SAAS,GAAG,MAAM;IAClC,OAAO,MAAM;IACb,OAAO,UAAU,IAAI,MAAM,QAAQ,KAAK,MAAM;GAChD,EAAE;EACN;EAEA,QAAQ;GACN,KAAK,MAAM,QAAQ,MAAM,OAAO,GAAG,KAAK,OAAO;GAC/C,MAAM,MAAM;EACd;CACF;AACF"}
+{"version":3,"file":"index.mjs","names":[],"sources":["../../../../src/services/providerAuth/index.ts"],"sourcesContent":["import crypto from 'node:crypto';\n\nimport type {\n  AuthMethodType,\n  AuthRuntime,\n  AuthRuntimeProvider,\n  LoginFlowSnapshot,\n  ProviderAuthMethod,\n  ProviderAuthSummary,\n} from '../../types/server/auth';\nimport { CHATGPT_AUTH_PROVIDER_ID } from '../chatgptAuth';\nimport { createLoginFlow, type LoginFlow } from '../loginFlow';\ninterface SettingsModel {\n  value: string;\n  label: string;\n  group: string;\n}\n\n/** Matches the timeout Pi's own /logout gives the credential store. */\nconst LOGOUT_TIMEOUT_MS = 15_000;\n\nexport type StartLoginOutcome =\n  | { ok: true; flow: LoginFlowSnapshot }\n  | { ok: false; code: 'unknown_provider' | 'unsupported_method' | 'busy'; error: string };\n\nexport type LogoutOutcome = { ok: true } | { ok: false; code: 'unknown_provider' | 'runtime'; error: string };\n\nexport type AnswerOutcome = 'answered' | 'unknown_flow' | 'not_waiting';\n\n/** Provider credentials as the settings page sees them, backed by one Pi runtime. */\nexport interface ProviderAuth {\n  /** Every provider Pi knows, with its current auth state; re-read from disk each call. */\n  listProviders(): Promise<ProviderAuthSummary[]>;\n  /**\n   * Starts a login. `remote` means the browser driving it is on another\n   * machine, which decides whether a redirect-free method is chosen for the\n   * user; it comes from the accepted socket, never from the request body.\n   */\n  startLogin(providerId: string, type: AuthMethodType, remote?: boolean): Promise<StartLoginOutcome>;\n  getLogin(flowId: string): LoginFlowSnapshot | undefined;\n  answerLogin(flowId: string, promptId: string, value: string): AnswerOutcome;\n  /** Cancels the flow and returns how it stands, or undefined for an unknown flow. */\n  cancelLogin(flowId: string): LoginFlowSnapshot | undefined;\n  logout(providerId: string): Promise<LogoutOutcome>;\n  /**\n   * Every model the machine can actually use, grouped by provider. Read from\n   * the same runtime the providers page uses, so the settings model pickers\n   * work with no session running.\n   */\n  listModels(): Promise<readonly SettingsModel[]>;\n  /** Abandons every running flow; the hub is shutting down. */\n  close(): void;\n}\n\nexport interface ProviderAuthOptions {\n  runtime: () => Promise<AuthRuntime>;\n  onNotice?: (message: string) => void;\n}\n\nfunction describe(error: unknown): string {\n  return error instanceof Error ? error.message : String(error);\n}\n\n/** The methods a page can start, in the order the TUI's selector lists them. */\nfunction methodsOf(provider: AuthRuntimeProvider): ProviderAuthMethod[] {\n  const methods: ProviderAuthMethod[] = [];\n  const { oauth, apiKey } = provider.auth;\n  if (oauth) methods.push({ type: 'oauth', label: oauth.loginLabel ?? oauth.name });\n  if (apiKey?.login) methods.push({ type: 'api_key', label: apiKey.name });\n  return methods;\n}\n\n/** Mirrors the status the TUI's login selector shows beside each provider. */\nfunction summarize(runtime: AuthRuntime, provider: AuthRuntimeProvider): ProviderAuthSummary {\n  const summary: ProviderAuthSummary = { id: provider.id, name: provider.name, methods: methodsOf(provider) };\n  if (provider.id === CHATGPT_AUTH_PROVIDER_ID) summary.kind = 'po-feature';\n  const status = runtime.getProviderAuthStatus(provider.id);\n  if (status.configured) {\n    summary.authenticated = {\n      type: runtime.isUsingOAuth(provider.id) ? 'oauth' : 'api_key',\n      source: status.label ?? status.source,\n    };\n  }\n  return summary;\n}\n\nexport function createProviderAuth(options: ProviderAuthOptions): ProviderAuth {\n  const notice = options.onNotice ?? ((): void => {});\n  const load = options.runtime;\n  const flows = new Map<string, LoginFlow>();\n  let loading: Promise<AuthRuntime> | undefined;\n\n  // A failed load is forgotten so the next request tries again rather than\n  // pinning the page on a startup error.\n  const runtime = (): Promise<AuthRuntime> => {\n    loading ??= load().catch((error: unknown) => {\n      loading = undefined;\n      throw error;\n    });\n    return loading;\n  };\n\n  const findProvider = (current: AuthRuntime, providerId: string): AuthRuntimeProvider | undefined =>\n    current.getProviders().find((provider) => provider.id === providerId);\n\n  const runningFor = (providerId: string): LoginFlow | undefined =>\n    [...flows.values()].find((flow) => flow.providerId === providerId && flow.snapshot().status === 'running');\n\n  // Another client may have stored a credential since the last look (a TUI\n  // /login, a hand-edited auth.json), and a provider registered by a Pi\n  // extension after the runtime was created is missing from the cached auth\n  // state until a refresh. The stale snapshot still lists on a failed refresh,\n  // which the notice explains.\n  const refreshed = async (): Promise<AuthRuntime> => {\n    const current = await runtime();\n    try {\n      await current.refresh({ allowNetwork: false });\n    } catch (error) {\n      notice(`provider auth refresh failed: ${describe(error)}`);\n    }\n    return current;\n  };\n\n  return {\n    async listProviders() {\n      const current = await refreshed();\n      return current\n        .getProviders()\n        .map((provider) => summarize(current, provider))\n        .sort((left, right) => left.name.localeCompare(right.name));\n    },\n\n    async startLogin(providerId, type, remote) {\n      const current = await runtime();\n      const provider = findProvider(current, providerId);\n      if (!provider) return { ok: false, code: 'unknown_provider', error: `Unknown provider: ${providerId}` };\n      if (!methodsOf(provider).some((method) => method.type === type)) {\n        return { ok: false, code: 'unsupported_method', error: `${provider.name} has no ${type} login.` };\n      }\n      if (runningFor(providerId)) {\n        return { ok: false, code: 'busy', error: `A login for ${provider.name} is already in progress.` };\n      }\n      // Finished flows live until the next start: long enough for the page to\n      // read how they ended, short enough that the map never grows.\n      for (const [id, flow] of flows) if (flow.snapshot().status !== 'running') flows.delete(id);\n\n      const flow = createLoginFlow({\n        id: crypto.randomUUID(),\n        providerId,\n        providerName: provider.name,\n        type,\n        ...(remote === true ? { remote: true } : {}),\n      });\n      flows.set(flow.id, flow);\n      current.login(providerId, type, flow.interaction).then(\n        () => {\n          flow.settle({ ok: true });\n          notice(`signed in to ${provider.name} (${type})`);\n        },\n        (error: unknown) => {\n          flow.settle({ ok: false, error: describe(error) });\n        },\n      );\n      return { ok: true, flow: flow.snapshot() };\n    },\n\n    getLogin(flowId) {\n      return flows.get(flowId)?.snapshot();\n    },\n\n    answerLogin(flowId, promptId, value) {\n      const flow = flows.get(flowId);\n      if (!flow) return 'unknown_flow';\n      return flow.answer(promptId, value) ? 'answered' : 'not_waiting';\n    },\n\n    cancelLogin(flowId) {\n      const flow = flows.get(flowId);\n      if (!flow) return undefined;\n      flow.cancel();\n      return flow.snapshot();\n    },\n\n    async logout(providerId) {\n      const current = await runtime();\n      const provider = findProvider(current, providerId);\n      if (!provider) return { ok: false, code: 'unknown_provider', error: `Unknown provider: ${providerId}` };\n      try {\n        await current.logout(providerId, { signal: AbortSignal.timeout(LOGOUT_TIMEOUT_MS) });\n      } catch (error) {\n        return { ok: false, code: 'runtime', error: describe(error) };\n      }\n      notice(`signed out of ${provider.name}`);\n      return { ok: true };\n    },\n\n    async listModels() {\n      const current = await refreshed();\n      const providers = new Map(current.getProviders().map((provider) => [provider.id, provider.name]));\n      return current\n        .getAvailableSnapshot()\n        .filter((model) => current.hasConfiguredAuth(model.provider))\n        .map((model) => ({\n          value: `${model.provider}/${model.id}`,\n          label: model.id,\n          group: providers.get(model.provider) ?? model.provider,\n        }));\n    },\n\n    close() {\n      for (const flow of flows.values()) flow.cancel();\n      flows.clear();\n    },\n  };\n}\n"],"mappings":";;;;;AAmBA,MAAM,oBAAoB;AAwC1B,SAAS,SAAS,OAAwB;CACxC,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AAC9D;;AAGA,SAAS,UAAU,UAAqD;CACtE,MAAM,UAAgC,CAAC;CACvC,MAAM,EAAE,OAAO,WAAW,SAAS;CACnC,IAAI,OAAO,QAAQ,KAAK;EAAE,MAAM;EAAS,OAAO,MAAM,cAAc,MAAM;CAAK,CAAC;CAChF,IAAI,QAAQ,OAAO,QAAQ,KAAK;EAAE,MAAM;EAAW,OAAO,OAAO;CAAK,CAAC;CACvE,OAAO;AACT;;AAGA,SAAS,UAAU,SAAsB,UAAoD;CAC3F,MAAM,UAA+B;EAAE,IAAI,SAAS;EAAI,MAAM,SAAS;EAAM,SAAS,UAAU,QAAQ;CAAE;CAC1G,IAAI,SAAS,OAAA,cAAiC,QAAQ,OAAO;CAC7D,MAAM,SAAS,QAAQ,sBAAsB,SAAS,EAAE;CACxD,IAAI,OAAO,YACT,QAAQ,gBAAgB;EACtB,MAAM,QAAQ,aAAa,SAAS,EAAE,IAAI,UAAU;EACpD,QAAQ,OAAO,SAAS,OAAO;CACjC;CAEF,OAAO;AACT;AAEA,SAAgB,mBAAmB,SAA4C;CAC7E,MAAM,SAAS,QAAQ,mBAAyB,CAAC;CACjD,MAAM,OAAO,QAAQ;CACrB,MAAM,wBAAQ,IAAI,IAAuB;CACzC,IAAI;CAIJ,MAAM,gBAAsC;EAC1C,YAAY,KAAK,CAAC,CAAC,OAAO,UAAmB;GAC3C,UAAU,KAAA;GACV,MAAM;EACR,CAAC;EACD,OAAO;CACT;CAEA,MAAM,gBAAgB,SAAsB,eAC1C,QAAQ,aAAa,CAAC,CAAC,MAAM,aAAa,SAAS,OAAO,UAAU;CAEtE,MAAM,cAAc,eAClB,CAAC,GAAG,MAAM,OAAO,CAAC,CAAC,CAAC,MAAM,SAAS,KAAK,eAAe,cAAc,KAAK,SAAS,CAAC,CAAC,WAAW,SAAS;CAO3G,MAAM,YAAY,YAAkC;EAClD,MAAM,UAAU,MAAM,QAAQ;EAC9B,IAAI;GACF,MAAM,QAAQ,QAAQ,EAAE,cAAc,MAAM,CAAC;EAC/C,SAAS,OAAO;GACd,OAAO,iCAAiC,SAAS,KAAK,GAAG;EAC3D;EACA,OAAO;CACT;CAEA,OAAO;EACL,MAAM,gBAAgB;GACpB,MAAM,UAAU,MAAM,UAAU;GAChC,OAAO,QACJ,aAAa,CAAC,CACd,KAAK,aAAa,UAAU,SAAS,QAAQ,CAAC,CAAC,CAC/C,MAAM,MAAM,UAAU,KAAK,KAAK,cAAc,MAAM,IAAI,CAAC;EAC9D;EAEA,MAAM,WAAW,YAAY,MAAM,QAAQ;GACzC,MAAM,UAAU,MAAM,QAAQ;GAC9B,MAAM,WAAW,aAAa,SAAS,UAAU;GACjD,IAAI,CAAC,UAAU,OAAO;IAAE,IAAI;IAAO,MAAM;IAAoB,OAAO,qBAAqB;GAAa;GACtG,IAAI,CAAC,UAAU,QAAQ,CAAC,CAAC,MAAM,WAAW,OAAO,SAAS,IAAI,GAC5D,OAAO;IAAE,IAAI;IAAO,MAAM;IAAsB,OAAO,GAAG,SAAS,KAAK,UAAU,KAAK;GAAS;GAElG,IAAI,WAAW,UAAU,GACvB,OAAO;IAAE,IAAI;IAAO,MAAM;IAAQ,OAAO,eAAe,SAAS,KAAK;GAA0B;GAIlG,KAAK,MAAM,CAAC,IAAI,SAAS,OAAO,IAAI,KAAK,SAAS,CAAC,CAAC,WAAW,WAAW,MAAM,OAAO,EAAE;GAEzF,MAAM,OAAO,gBAAgB;IAC3B,IAAI,OAAO,WAAW;IACtB;IACA,cAAc,SAAS;IACvB;IACA,GAAI,WAAW,OAAO,EAAE,QAAQ,KAAK,IAAI,CAAC;GAC5C,CAAC;GACD,MAAM,IAAI,KAAK,IAAI,IAAI;GACvB,QAAQ,MAAM,YAAY,MAAM,KAAK,WAAW,CAAC,CAAC,WAC1C;IACJ,KAAK,OAAO,EAAE,IAAI,KAAK,CAAC;IACxB,OAAO,gBAAgB,SAAS,KAAK,IAAI,KAAK,EAAE;GAClD,IACC,UAAmB;IAClB,KAAK,OAAO;KAAE,IAAI;KAAO,OAAO,SAAS,KAAK;IAAE,CAAC;GACnD,CACF;GACA,OAAO;IAAE,IAAI;IAAM,MAAM,KAAK,SAAS;GAAE;EAC3C;EAEA,SAAS,QAAQ;GACf,OAAO,MAAM,IAAI,MAAM,CAAC,EAAE,SAAS;EACrC;EAEA,YAAY,QAAQ,UAAU,OAAO;GACnC,MAAM,OAAO,MAAM,IAAI,MAAM;GAC7B,IAAI,CAAC,MAAM,OAAO;GAClB,OAAO,KAAK,OAAO,UAAU,KAAK,IAAI,aAAa;EACrD;EAEA,YAAY,QAAQ;GAClB,MAAM,OAAO,MAAM,IAAI,MAAM;GAC7B,IAAI,CAAC,MAAM,OAAO,KAAA;GAClB,KAAK,OAAO;GACZ,OAAO,KAAK,SAAS;EACvB;EAEA,MAAM,OAAO,YAAY;GACvB,MAAM,UAAU,MAAM,QAAQ;GAC9B,MAAM,WAAW,aAAa,SAAS,UAAU;GACjD,IAAI,CAAC,UAAU,OAAO;IAAE,IAAI;IAAO,MAAM;IAAoB,OAAO,qBAAqB;GAAa;GACtG,IAAI;IACF,MAAM,QAAQ,OAAO,YAAY,EAAE,QAAQ,YAAY,QAAQ,iBAAiB,EAAE,CAAC;GACrF,SAAS,OAAO;IACd,OAAO;KAAE,IAAI;KAAO,MAAM;KAAW,OAAO,SAAS,KAAK;IAAE;GAC9D;GACA,OAAO,iBAAiB,SAAS,MAAM;GACvC,OAAO,EAAE,IAAI,KAAK;EACpB;EAEA,MAAM,aAAa;GACjB,MAAM,UAAU,MAAM,UAAU;GAChC,MAAM,YAAY,IAAI,IAAI,QAAQ,aAAa,CAAC,CAAC,KAAK,aAAa,CAAC,SAAS,IAAI,SAAS,IAAI,CAAC,CAAC;GAChG,OAAO,QACJ,qBAAqB,CAAC,CACtB,QAAQ,UAAU,QAAQ,kBAAkB,MAAM,QAAQ,CAAC,CAAC,CAC5D,KAAK,WAAW;IACf,OAAO,GAAG,MAAM,SAAS,GAAG,MAAM;IAClC,OAAO,MAAM;IACb,OAAO,UAAU,IAAI,MAAM,QAAQ,KAAK,MAAM;GAChD,EAAE;EACN;EAEA,QAAQ;GACN,KAAK,MAAM,QAAQ,MAAM,OAAO,GAAG,KAAK,OAAO;GAC/C,MAAM,MAAM;EACd;CACF;AACF"}

package/dist/src/services/publicFileShares/index.cjs

@@ -96,7 +96,7 @@ function createPublicFileShares(options) {
 		async mint(request) {
 			const origin = options.publicOrigin();
 			const revision = options.publicOriginRevision();
-			if (origin === void 0) throw new Error(require_packageApi.DOOM_SHARE_FILE_REMOTE_OFF_MESSAGE);
+			if (origin === void 0) throw new Error(require_packageApi.PO_SHARE_FILE_REMOTE_OFF_MESSAGE);
 			const filePath = await resolveShareable(request, environment);
 			const opened = await openPinned(filePath);
 			if (opened === void 0) throw new Error(`"${request.path}" is not a regular file Po can share.`);

package/dist/src/services/publicFileShares/index.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"index.cjs","names":["fs","createHash","path","sessionAttachmentRoot","DOOM_SHARE_FILE_REMOTE_OFF_MESSAGE","randomBytes","SESSION_FILE_CONTENT_TYPES","Readable"],"sources":["../../../../src/services/publicFileShares/index.ts"],"sourcesContent":["import { createHash, randomBytes } from 'node:crypto';\nimport fs from 'node:fs';\nimport path from 'node:path';\nimport { Readable } from 'node:stream';\n\nimport {\n  MAX_SESSION_FILE_BYTES,\n  SESSION_FILE_CONTENT_TYPES,\n  SESSION_FILE_DEFAULT_CONTENT_TYPE,\n} from '../../constants/sessionFiles';\nimport { DOOM_SHARE_FILE_REMOTE_OFF_MESSAGE, type DoomSharedFile } from '../../schemas/packageApi';\nimport { sessionAttachmentRoot } from '../sessionAttachments';\n\n/**\n * Short-lived public links to one session file, so a remote MCP server can fetch\n * what the model was asked to hand it.\n *\n * The link is the only credential, so only its hash is kept, and every way a\n * link can fail answers the same 404. A file is pinned by identity when the\n * link is minted and reopened when it is served: a path that now names another\n * file, or reaches it through a new symlink, is refused rather than followed.\n */\n\n/** Public tunnel path prefix; the token is the only segment after it. */\nexport const PUBLIC_FILE_SHARE_PREFIX = '/mcp-file/';\n\nconst TOKEN_BYTES = 32;\nconst TOKEN_PATTERN = /^[A-Za-z0-9_-]{43}$/u;\nconst SHARE_TTL_MS = 10 * 60 * 1000;\nconst SHARE_DOWNLOADS = 3;\nconst MAX_LIVE_SHARES_PER_SESSION = 16;\nconst OPEN_FLAGS = fs.constants.O_RDONLY | fs.constants.O_NOFOLLOW;\n\nexport interface PublicFileShareRequest {\n  sessionId: string;\n  cwd: string;\n  /** Relative to cwd, or absolute. */\n  path: string;\n  /** Who the file is for, for the host's notice. */\n  label: string;\n}\n\nexport interface PublicFileShares {\n  mint(request: PublicFileShareRequest): Promise<DoomSharedFile>;\n  serve(token: string, method: string): Promise<Response>;\n}\n\nexport interface PublicFileSharesOptions {\n  publicOrigin(): string | undefined;\n  /** Bumped whenever the tunnel goes away; a link minted under another revision is dead. */\n  publicOriginRevision(): number;\n  /** Never receives a token or a link. */\n  onNotice(message: string): void;\n  /** Locates the attachment root; defaults to the process environment, as the upload route does. */\n  environment?: Readonly<Record<string, string | undefined>>;\n}\n\ninterface Share {\n  sessionId: string;\n  filePath: string;\n  fileName: string;\n  dev: number;\n  ino: number;\n  size: number;\n  mtimeMs: number;\n  revision: number;\n  expiresAt: number;\n  downloadsLeft: number;\n  revoked: boolean;\n}\n\nfunction tokenDigest(token: string): string {\n  return createHash('sha256').update(token).digest('base64url');\n}\n\nfunction notFound(): Response {\n  return Response.json({ error: 'Not found.' }, { status: 404 });\n}\n\n/** RFC 8187 value for `filename*`: encodeURIComponent leaves a few characters the grammar forbids. */\nfunction contentDispositionName(fileName: string): string {\n  return encodeURIComponent(fileName).replace(\n    /['()*]/gu,\n    (character) => `%${character.charCodeAt(0).toString(16).toUpperCase()}`,\n  );\n}\n\n/** True when filePath sits strictly below the real root with no segment that starts with a dot. */\nasync function containedIn(root: string, filePath: string): Promise<boolean> {\n  let realRoot: string;\n  try {\n    realRoot = await fs.promises.realpath(root);\n  } catch {\n    return false;\n  }\n  const relative = path.relative(realRoot, filePath);\n  return (\n    relative !== '' &&\n    !path.isAbsolute(relative) &&\n    relative.split(path.sep).every((segment) => !segment.startsWith('.'))\n  );\n}\n\n/** The real path of a shareable file: inside the session cwd or its attachment root, never through a dot segment. */\nasync function resolveShareable(\n  request: PublicFileShareRequest,\n  environment: Readonly<Record<string, string | undefined>>,\n): Promise<string> {\n  const refused = new Error(`\"${request.path}\" is not a file in this session's working directory or attachments.`);\n  if (\n    request.path === '' ||\n    request.path.includes('\\0') ||\n    request.path.split(/[\\\\/]/u).some((segment) => segment === '.' || segment === '..')\n  )\n    throw refused;\n  let filePath: string;\n  try {\n    filePath = await fs.promises.realpath(path.resolve(request.cwd, request.path));\n  } catch {\n    throw refused;\n  }\n  const roots = [request.cwd];\n  try {\n    roots.push(sessionAttachmentRoot(request.sessionId, environment));\n  } catch {\n    // An id that cannot hold attachments only has its working directory.\n  }\n  for (const root of roots) if (await containedIn(root, filePath)) return filePath;\n  throw refused;\n}\n\n/**\n * Opens a regular file without following a final symlink, then proves the handle is\n * still the file at that real path: a parent swapped for a symlink changes the real\n * path, and a replaced file changes the identity. Resolves undefined, with nothing\n * left open, when either check fails.\n */\nasync function openPinned(filePath: string): Promise<{ handle: fs.promises.FileHandle; stat: fs.Stats } | undefined> {\n  let handle: fs.promises.FileHandle;\n  try {\n    handle = await fs.promises.open(filePath, OPEN_FLAGS);\n  } catch {\n    return undefined;\n  }\n  try {\n    const stat = await handle.stat();\n    const named = await fs.promises.lstat(filePath);\n    if (\n      stat.isFile() &&\n      named.dev === stat.dev &&\n      named.ino === stat.ino &&\n      (await fs.promises.realpath(filePath)) === filePath\n    )\n      return { handle, stat };\n  } catch {\n    // Treated like a mismatch below.\n  }\n  await handle.close();\n  return undefined;\n}\n\nexport function createPublicFileShares(options: PublicFileSharesOptions): PublicFileShares {\n  const environment = options.environment ?? process.env;\n  const shares = new Map<string, Share>();\n\n  const authorized = (share: Share): boolean =>\n    !share.revoked &&\n    Date.now() < share.expiresAt &&\n    share.revision === options.publicOriginRevision() &&\n    options.publicOrigin() !== undefined;\n  const live = (share: Share): boolean => authorized(share) && share.downloadsLeft > 0;\n\n  return {\n    async mint(request) {\n      const origin = options.publicOrigin();\n      const revision = options.publicOriginRevision();\n      if (origin === undefined) throw new Error(DOOM_SHARE_FILE_REMOTE_OFF_MESSAGE);\n      const filePath = await resolveShareable(request, environment);\n      const opened = await openPinned(filePath);\n      if (opened === undefined) throw new Error(`\"${request.path}\" is not a regular file Po can share.`);\n      const { stat } = opened;\n      await opened.handle.close();\n      if (stat.size > MAX_SESSION_FILE_BYTES)\n        throw new Error(`\"${request.path}\" is larger than the 25 MB file sharing limit.`);\n      for (const [key, share] of shares) if (!live(share)) shares.delete(key);\n      if (\n        [...shares.values()].filter((share) => share.sessionId === request.sessionId).length >=\n        MAX_LIVE_SHARES_PER_SESSION\n      )\n        throw new Error(\n          `This session already shares ${String(MAX_LIVE_SHARES_PER_SESSION)} files. Retry after a tool call finishes.`,\n        );\n      const token = randomBytes(TOKEN_BYTES).toString('base64url');\n      const key = tokenDigest(token);\n      const fileName = path.basename(filePath);\n      const share: Share = {\n        sessionId: request.sessionId,\n        filePath,\n        fileName,\n        dev: stat.dev,\n        ino: stat.ino,\n        size: stat.size,\n        mtimeMs: stat.mtimeMs,\n        revision,\n        expiresAt: Date.now() + SHARE_TTL_MS,\n        downloadsLeft: SHARE_DOWNLOADS,\n        revoked: false,\n      };\n      shares.set(key, share);\n      options.onNotice(`file share: published \"${fileName}\" for ${request.label} on the remote-access tunnel.`);\n      return {\n        url: `${origin}${PUBLIC_FILE_SHARE_PREFIX}${token}`,\n        fileName,\n        mimeType: SESSION_FILE_CONTENT_TYPES[path.extname(fileName).toLowerCase()] ?? SESSION_FILE_DEFAULT_CONTENT_TYPE,\n        size: stat.size,\n        expiresAt: share.expiresAt,\n        maxDownloads: SHARE_DOWNLOADS,\n        revoke: () => {\n          share.revoked = true;\n          shares.delete(key);\n        },\n      };\n    },\n\n    async serve(token, method) {\n      if ((method !== 'GET' && method !== 'HEAD') || !TOKEN_PATTERN.test(token)) return notFound();\n      const key = tokenDigest(token);\n      const share = shares.get(key);\n      if (share === undefined) return notFound();\n      if (!live(share)) {\n        shares.delete(key);\n        return notFound();\n      }\n      // Counted before the first await, so concurrent downloads cannot outrun the limit.\n      if (method === 'GET') {\n        share.downloadsLeft -= 1;\n        if (share.downloadsLeft === 0) shares.delete(key);\n      }\n      const opened = await openPinned(share.filePath);\n      if (\n        opened === undefined ||\n        opened.stat.dev !== share.dev ||\n        opened.stat.ino !== share.ino ||\n        opened.stat.size !== share.size ||\n        opened.stat.mtimeMs !== share.mtimeMs\n      ) {\n        await opened?.handle.close();\n        shares.delete(key);\n        options.onNotice(`file share: refused \"${share.fileName}\" because the file changed after it was shared.`);\n        return notFound();\n      }\n      // Opening a file yields to revocation and tunnel changes. The download already\n      // reserved its allowance, so this check must not reject the final permitted GET.\n      if (!authorized(share)) {\n        await opened.handle.close();\n        shares.delete(key);\n        return notFound();\n      }\n      const headers = {\n        'content-type': 'application/octet-stream',\n        'content-length': String(share.size),\n        'content-disposition': `attachment; filename*=UTF-8''${contentDispositionName(share.fileName)}`,\n        'x-content-type-options': 'nosniff',\n        'content-security-policy': \"sandbox; default-src 'none'\",\n        'cross-origin-resource-policy': 'same-origin',\n        'cache-control': 'no-store, private',\n        'referrer-policy': 'no-referrer',\n        'accept-ranges': 'none',\n        'x-robots-tag': 'noindex',\n      };\n      if (method === 'HEAD' || share.size === 0) {\n        await opened.handle.close();\n        return new Response(method === 'HEAD' ? null : new Uint8Array(), { headers });\n      }\n      // The stream closes the handle when it ends, fails, or is cancelled. Bounded to the\n      // pinned size, so bytes appended after the identity check are never sent.\n      const body = Readable.toWeb(opened.handle.createReadStream({ start: 0, end: share.size - 1 }));\n      return new Response(body as ReadableStream<Uint8Array>, { headers });\n    },\n  };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;AAwBA,MAAa,2BAA2B;AAExC,MAAM,cAAc;AACpB,MAAM,gBAAgB;AACtB,MAAM,eAAe;AACrB,MAAM,kBAAkB;AACxB,MAAM,8BAA8B;AACpC,MAAM,aAAaA,QAAAA,QAAG,UAAU,WAAWA,QAAAA,QAAG,UAAU;AAwCxD,SAAS,YAAY,OAAuB;CAC1C,QAAA,GAAOC,YAAAA,WAAAA,CAAW,QAAQ,CAAC,CAAC,OAAO,KAAK,CAAC,CAAC,OAAO,WAAW;AAC9D;AAEA,SAAS,WAAqB;CAC5B,OAAO,SAAS,KAAK,EAAE,OAAO,aAAa,GAAG,EAAE,QAAQ,IAAI,CAAC;AAC/D;;AAGA,SAAS,uBAAuB,UAA0B;CACxD,OAAO,mBAAmB,QAAQ,CAAC,CAAC,QAClC,aACC,cAAc,IAAI,UAAU,WAAW,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,YAAY,GACtE;AACF;;AAGA,eAAe,YAAY,MAAc,UAAoC;CAC3E,IAAI;CACJ,IAAI;EACF,WAAW,MAAMD,QAAAA,QAAG,SAAS,SAAS,IAAI;CAC5C,QAAQ;EACN,OAAO;CACT;CACA,MAAM,WAAWE,UAAAA,QAAK,SAAS,UAAU,QAAQ;CACjD,OACE,aAAa,MACb,CAACA,UAAAA,QAAK,WAAW,QAAQ,KACzB,SAAS,MAAMA,UAAAA,QAAK,GAAG,CAAC,CAAC,OAAO,YAAY,CAAC,QAAQ,WAAW,GAAG,CAAC;AAExE;;AAGA,eAAe,iBACb,SACA,aACiB;CACjB,MAAM,0BAAU,IAAI,MAAM,IAAI,QAAQ,KAAK,oEAAoE;CAC/G,IACE,QAAQ,SAAS,MACjB,QAAQ,KAAK,SAAS,IAAI,KAC1B,QAAQ,KAAK,MAAM,QAAQ,CAAC,CAAC,MAAM,YAAY,YAAY,OAAO,YAAY,IAAI,GAElF,MAAM;CACR,IAAI;CACJ,IAAI;EACF,WAAW,MAAMF,QAAAA,QAAG,SAAS,SAASE,UAAAA,QAAK,QAAQ,QAAQ,KAAK,QAAQ,IAAI,CAAC;CAC/E,QAAQ;EACN,MAAM;CACR;CACA,MAAM,QAAQ,CAAC,QAAQ,GAAG;CAC1B,IAAI;EACF,MAAM,KAAKC,cAAAA,sBAAsB,QAAQ,WAAW,WAAW,CAAC;CAClE,QAAQ,CAER;CACA,KAAK,MAAM,QAAQ,OAAO,IAAI,MAAM,YAAY,MAAM,QAAQ,GAAG,OAAO;CACxE,MAAM;AACR;;;;;;;AAQA,eAAe,WAAW,UAA2F;CACnH,IAAI;CACJ,IAAI;EACF,SAAS,MAAMH,QAAAA,QAAG,SAAS,KAAK,UAAU,UAAU;CACtD,QAAQ;EACN;CACF;CACA,IAAI;EACF,MAAM,OAAO,MAAM,OAAO,KAAK;EAC/B,MAAM,QAAQ,MAAMA,QAAAA,QAAG,SAAS,MAAM,QAAQ;EAC9C,IACE,KAAK,OAAO,KACZ,MAAM,QAAQ,KAAK,OACnB,MAAM,QAAQ,KAAK,OAClB,MAAMA,QAAAA,QAAG,SAAS,SAAS,QAAQ,MAAO,UAE3C,OAAO;GAAE;GAAQ;EAAK;CAC1B,QAAQ,CAER;CACA,MAAM,OAAO,MAAM;AAErB;AAEA,SAAgB,uBAAuB,SAAoD;CACzF,MAAM,cAAc,QAAQ,eAAe,QAAQ;CACnD,MAAM,yBAAS,IAAI,IAAmB;CAEtC,MAAM,cAAc,UAClB,CAAC,MAAM,WACP,KAAK,IAAI,IAAI,MAAM,aACnB,MAAM,aAAa,QAAQ,qBAAqB,KAChD,QAAQ,aAAa,MAAM,KAAA;CAC7B,MAAM,QAAQ,UAA0B,WAAW,KAAK,KAAK,MAAM,gBAAgB;CAEnF,OAAO;EACL,MAAM,KAAK,SAAS;GAClB,MAAM,SAAS,QAAQ,aAAa;GACpC,MAAM,WAAW,QAAQ,qBAAqB;GAC9C,IAAI,WAAW,KAAA,GAAW,MAAM,IAAI,MAAMI,mBAAAA,kCAAkC;GAC5E,MAAM,WAAW,MAAM,iBAAiB,SAAS,WAAW;GAC5D,MAAM,SAAS,MAAM,WAAW,QAAQ;GACxC,IAAI,WAAW,KAAA,GAAW,MAAM,IAAI,MAAM,IAAI,QAAQ,KAAK,sCAAsC;GACjG,MAAM,EAAE,SAAS;GACjB,MAAM,OAAO,OAAO,MAAM;GAC1B,IAAI,KAAK,OAAA,UACP,MAAM,IAAI,MAAM,IAAI,QAAQ,KAAK,+CAA+C;GAClF,KAAK,MAAM,CAAC,KAAK,UAAU,QAAQ,IAAI,CAAC,KAAK,KAAK,GAAG,OAAO,OAAO,GAAG;GACtE,IACE,CAAC,GAAG,OAAO,OAAO,CAAC,CAAC,CAAC,QAAQ,UAAU,MAAM,cAAc,QAAQ,SAAS,CAAC,CAAC,UAC9E,6BAEA,MAAM,IAAI,MACR,+BAA+B,OAAO,2BAA2B,EAAE,0CACrE;GACF,MAAM,SAAA,GAAQC,YAAAA,YAAAA,CAAY,WAAW,CAAC,CAAC,SAAS,WAAW;GAC3D,MAAM,MAAM,YAAY,KAAK;GAC7B,MAAM,WAAWH,UAAAA,QAAK,SAAS,QAAQ;GACvC,MAAM,QAAe;IACnB,WAAW,QAAQ;IACnB;IACA;IACA,KAAK,KAAK;IACV,KAAK,KAAK;IACV,MAAM,KAAK;IACX,SAAS,KAAK;IACd;IACA,WAAW,KAAK,IAAI,IAAI;IACxB,eAAe;IACf,SAAS;GACX;GACA,OAAO,IAAI,KAAK,KAAK;GACrB,QAAQ,SAAS,0BAA0B,SAAS,QAAQ,QAAQ,MAAM,8BAA8B;GACxG,OAAO;IACL,KAAK,GAAG,SAAS,2BAA2B;IAC5C;IACA,UAAUI,qBAAAA,2BAA2BJ,UAAAA,QAAK,QAAQ,QAAQ,CAAC,CAAC,YAAY,MAAA;IACxE,MAAM,KAAK;IACX,WAAW,MAAM;IACjB,cAAc;IACd,cAAc;KACZ,MAAM,UAAU;KAChB,OAAO,OAAO,GAAG;IACnB;GACF;EACF;EAEA,MAAM,MAAM,OAAO,QAAQ;GACzB,IAAK,WAAW,SAAS,WAAW,UAAW,CAAC,cAAc,KAAK,KAAK,GAAG,OAAO,SAAS;GAC3F,MAAM,MAAM,YAAY,KAAK;GAC7B,MAAM,QAAQ,OAAO,IAAI,GAAG;GAC5B,IAAI,UAAU,KAAA,GAAW,OAAO,SAAS;GACzC,IAAI,CAAC,KAAK,KAAK,GAAG;IAChB,OAAO,OAAO,GAAG;IACjB,OAAO,SAAS;GAClB;GAEA,IAAI,WAAW,OAAO;IACpB,MAAM,iBAAiB;IACvB,IAAI,MAAM,kBAAkB,GAAG,OAAO,OAAO,GAAG;GAClD;GACA,MAAM,SAAS,MAAM,WAAW,MAAM,QAAQ;GAC9C,IACE,WAAW,KAAA,KACX,OAAO,KAAK,QAAQ,MAAM,OAC1B,OAAO,KAAK,QAAQ,MAAM,OAC1B,OAAO,KAAK,SAAS,MAAM,QAC3B,OAAO,KAAK,YAAY,MAAM,SAC9B;IACA,MAAM,QAAQ,OAAO,MAAM;IAC3B,OAAO,OAAO,GAAG;IACjB,QAAQ,SAAS,wBAAwB,MAAM,SAAS,gDAAgD;IACxG,OAAO,SAAS;GAClB;GAGA,IAAI,CAAC,WAAW,KAAK,GAAG;IACtB,MAAM,OAAO,OAAO,MAAM;IAC1B,OAAO,OAAO,GAAG;IACjB,OAAO,SAAS;GAClB;GACA,MAAM,UAAU;IACd,gBAAgB;IAChB,kBAAkB,OAAO,MAAM,IAAI;IACnC,uBAAuB,gCAAgC,uBAAuB,MAAM,QAAQ;IAC5F,0BAA0B;IAC1B,2BAA2B;IAC3B,gCAAgC;IAChC,iBAAiB;IACjB,mBAAmB;IACnB,iBAAiB;IACjB,gBAAgB;GAClB;GACA,IAAI,WAAW,UAAU,MAAM,SAAS,GAAG;IACzC,MAAM,OAAO,OAAO,MAAM;IAC1B,OAAO,IAAI,SAAS,WAAW,SAAS,uBAAO,IAAI,WAAW,GAAG,EAAE,QAAQ,CAAC;GAC9E;GAGA,MAAM,OAAOK,YAAAA,SAAS,MAAM,OAAO,OAAO,iBAAiB;IAAE,OAAO;IAAG,KAAK,MAAM,OAAO;GAAE,CAAC,CAAC;GAC7F,OAAO,IAAI,SAAS,MAAoC,EAAE,QAAQ,CAAC;EACrE;CACF;AACF"}
+{"version":3,"file":"index.cjs","names":["fs","createHash","path","sessionAttachmentRoot","PO_SHARE_FILE_REMOTE_OFF_MESSAGE","randomBytes","SESSION_FILE_CONTENT_TYPES","Readable"],"sources":["../../../../src/services/publicFileShares/index.ts"],"sourcesContent":["import { createHash, randomBytes } from 'node:crypto';\nimport fs from 'node:fs';\nimport path from 'node:path';\nimport { Readable } from 'node:stream';\n\nimport {\n  MAX_SESSION_FILE_BYTES,\n  SESSION_FILE_CONTENT_TYPES,\n  SESSION_FILE_DEFAULT_CONTENT_TYPE,\n} from '../../constants/sessionFiles';\nimport { PO_SHARE_FILE_REMOTE_OFF_MESSAGE, type PoSharedFile } from '../../schemas/packageApi';\nimport { sessionAttachmentRoot } from '../sessionAttachments';\n\n/**\n * Short-lived public links to one session file, so a remote MCP server can fetch\n * what the model was asked to hand it.\n *\n * The link is the only credential, so only its hash is kept, and every way a\n * link can fail answers the same 404. A file is pinned by identity when the\n * link is minted and reopened when it is served: a path that now names another\n * file, or reaches it through a new symlink, is refused rather than followed.\n */\n\n/** Public tunnel path prefix; the token is the only segment after it. */\nexport const PUBLIC_FILE_SHARE_PREFIX = '/mcp-file/';\n\nconst TOKEN_BYTES = 32;\nconst TOKEN_PATTERN = /^[A-Za-z0-9_-]{43}$/u;\nconst SHARE_TTL_MS = 10 * 60 * 1000;\nconst SHARE_DOWNLOADS = 3;\nconst MAX_LIVE_SHARES_PER_SESSION = 16;\nconst OPEN_FLAGS = fs.constants.O_RDONLY | fs.constants.O_NOFOLLOW;\n\nexport interface PublicFileShareRequest {\n  sessionId: string;\n  cwd: string;\n  /** Relative to cwd, or absolute. */\n  path: string;\n  /** Who the file is for, for the host's notice. */\n  label: string;\n}\n\nexport interface PublicFileShares {\n  mint(request: PublicFileShareRequest): Promise<PoSharedFile>;\n  serve(token: string, method: string): Promise<Response>;\n}\n\nexport interface PublicFileSharesOptions {\n  publicOrigin(): string | undefined;\n  /** Bumped whenever the tunnel goes away; a link minted under another revision is dead. */\n  publicOriginRevision(): number;\n  /** Never receives a token or a link. */\n  onNotice(message: string): void;\n  /** Locates the attachment root; defaults to the process environment, as the upload route does. */\n  environment?: Readonly<Record<string, string | undefined>>;\n}\n\ninterface Share {\n  sessionId: string;\n  filePath: string;\n  fileName: string;\n  dev: number;\n  ino: number;\n  size: number;\n  mtimeMs: number;\n  revision: number;\n  expiresAt: number;\n  downloadsLeft: number;\n  revoked: boolean;\n}\n\nfunction tokenDigest(token: string): string {\n  return createHash('sha256').update(token).digest('base64url');\n}\n\nfunction notFound(): Response {\n  return Response.json({ error: 'Not found.' }, { status: 404 });\n}\n\n/** RFC 8187 value for `filename*`: encodeURIComponent leaves a few characters the grammar forbids. */\nfunction contentDispositionName(fileName: string): string {\n  return encodeURIComponent(fileName).replace(\n    /['()*]/gu,\n    (character) => `%${character.charCodeAt(0).toString(16).toUpperCase()}`,\n  );\n}\n\n/** True when filePath sits strictly below the real root with no segment that starts with a dot. */\nasync function containedIn(root: string, filePath: string): Promise<boolean> {\n  let realRoot: string;\n  try {\n    realRoot = await fs.promises.realpath(root);\n  } catch {\n    return false;\n  }\n  const relative = path.relative(realRoot, filePath);\n  return (\n    relative !== '' &&\n    !path.isAbsolute(relative) &&\n    relative.split(path.sep).every((segment) => !segment.startsWith('.'))\n  );\n}\n\n/** The real path of a shareable file: inside the session cwd or its attachment root, never through a dot segment. */\nasync function resolveShareable(\n  request: PublicFileShareRequest,\n  environment: Readonly<Record<string, string | undefined>>,\n): Promise<string> {\n  const refused = new Error(`\"${request.path}\" is not a file in this session's working directory or attachments.`);\n  if (\n    request.path === '' ||\n    request.path.includes('\\0') ||\n    request.path.split(/[\\\\/]/u).some((segment) => segment === '.' || segment === '..')\n  )\n    throw refused;\n  let filePath: string;\n  try {\n    filePath = await fs.promises.realpath(path.resolve(request.cwd, request.path));\n  } catch {\n    throw refused;\n  }\n  const roots = [request.cwd];\n  try {\n    roots.push(sessionAttachmentRoot(request.sessionId, environment));\n  } catch {\n    // An id that cannot hold attachments only has its working directory.\n  }\n  for (const root of roots) if (await containedIn(root, filePath)) return filePath;\n  throw refused;\n}\n\n/**\n * Opens a regular file without following a final symlink, then proves the handle is\n * still the file at that real path: a parent swapped for a symlink changes the real\n * path, and a replaced file changes the identity. Resolves undefined, with nothing\n * left open, when either check fails.\n */\nasync function openPinned(filePath: string): Promise<{ handle: fs.promises.FileHandle; stat: fs.Stats } | undefined> {\n  let handle: fs.promises.FileHandle;\n  try {\n    handle = await fs.promises.open(filePath, OPEN_FLAGS);\n  } catch {\n    return undefined;\n  }\n  try {\n    const stat = await handle.stat();\n    const named = await fs.promises.lstat(filePath);\n    if (\n      stat.isFile() &&\n      named.dev === stat.dev &&\n      named.ino === stat.ino &&\n      (await fs.promises.realpath(filePath)) === filePath\n    )\n      return { handle, stat };\n  } catch {\n    // Treated like a mismatch below.\n  }\n  await handle.close();\n  return undefined;\n}\n\nexport function createPublicFileShares(options: PublicFileSharesOptions): PublicFileShares {\n  const environment = options.environment ?? process.env;\n  const shares = new Map<string, Share>();\n\n  const authorized = (share: Share): boolean =>\n    !share.revoked &&\n    Date.now() < share.expiresAt &&\n    share.revision === options.publicOriginRevision() &&\n    options.publicOrigin() !== undefined;\n  const live = (share: Share): boolean => authorized(share) && share.downloadsLeft > 0;\n\n  return {\n    async mint(request) {\n      const origin = options.publicOrigin();\n      const revision = options.publicOriginRevision();\n      if (origin === undefined) throw new Error(PO_SHARE_FILE_REMOTE_OFF_MESSAGE);\n      const filePath = await resolveShareable(request, environment);\n      const opened = await openPinned(filePath);\n      if (opened === undefined) throw new Error(`\"${request.path}\" is not a regular file Po can share.`);\n      const { stat } = opened;\n      await opened.handle.close();\n      if (stat.size > MAX_SESSION_FILE_BYTES)\n        throw new Error(`\"${request.path}\" is larger than the 25 MB file sharing limit.`);\n      for (const [key, share] of shares) if (!live(share)) shares.delete(key);\n      if (\n        [...shares.values()].filter((share) => share.sessionId === request.sessionId).length >=\n        MAX_LIVE_SHARES_PER_SESSION\n      )\n        throw new Error(\n          `This session already shares ${String(MAX_LIVE_SHARES_PER_SESSION)} files. Retry after a tool call finishes.`,\n        );\n      const token = randomBytes(TOKEN_BYTES).toString('base64url');\n      const key = tokenDigest(token);\n      const fileName = path.basename(filePath);\n      const share: Share = {\n        sessionId: request.sessionId,\n        filePath,\n        fileName,\n        dev: stat.dev,\n        ino: stat.ino,\n        size: stat.size,\n        mtimeMs: stat.mtimeMs,\n        revision,\n        expiresAt: Date.now() + SHARE_TTL_MS,\n        downloadsLeft: SHARE_DOWNLOADS,\n        revoked: false,\n      };\n      shares.set(key, share);\n      options.onNotice(`file share: published \"${fileName}\" for ${request.label} on the remote-access tunnel.`);\n      return {\n        url: `${origin}${PUBLIC_FILE_SHARE_PREFIX}${token}`,\n        fileName,\n        mimeType: SESSION_FILE_CONTENT_TYPES[path.extname(fileName).toLowerCase()] ?? SESSION_FILE_DEFAULT_CONTENT_TYPE,\n        size: stat.size,\n        expiresAt: share.expiresAt,\n        maxDownloads: SHARE_DOWNLOADS,\n        revoke: () => {\n          share.revoked = true;\n          shares.delete(key);\n        },\n      };\n    },\n\n    async serve(token, method) {\n      if ((method !== 'GET' && method !== 'HEAD') || !TOKEN_PATTERN.test(token)) return notFound();\n      const key = tokenDigest(token);\n      const share = shares.get(key);\n      if (share === undefined) return notFound();\n      if (!live(share)) {\n        shares.delete(key);\n        return notFound();\n      }\n      // Counted before the first await, so concurrent downloads cannot outrun the limit.\n      if (method === 'GET') {\n        share.downloadsLeft -= 1;\n        if (share.downloadsLeft === 0) shares.delete(key);\n      }\n      const opened = await openPinned(share.filePath);\n      if (\n        opened === undefined ||\n        opened.stat.dev !== share.dev ||\n        opened.stat.ino !== share.ino ||\n        opened.stat.size !== share.size ||\n        opened.stat.mtimeMs !== share.mtimeMs\n      ) {\n        await opened?.handle.close();\n        shares.delete(key);\n        options.onNotice(`file share: refused \"${share.fileName}\" because the file changed after it was shared.`);\n        return notFound();\n      }\n      // Opening a file yields to revocation and tunnel changes. The download already\n      // reserved its allowance, so this check must not reject the final permitted GET.\n      if (!authorized(share)) {\n        await opened.handle.close();\n        shares.delete(key);\n        return notFound();\n      }\n      const headers = {\n        'content-type': 'application/octet-stream',\n        'content-length': String(share.size),\n        'content-disposition': `attachment; filename*=UTF-8''${contentDispositionName(share.fileName)}`,\n        'x-content-type-options': 'nosniff',\n        'content-security-policy': \"sandbox; default-src 'none'\",\n        'cross-origin-resource-policy': 'same-origin',\n        'cache-control': 'no-store, private',\n        'referrer-policy': 'no-referrer',\n        'accept-ranges': 'none',\n        'x-robots-tag': 'noindex',\n      };\n      if (method === 'HEAD' || share.size === 0) {\n        await opened.handle.close();\n        return new Response(method === 'HEAD' ? null : new Uint8Array(), { headers });\n      }\n      // The stream closes the handle when it ends, fails, or is cancelled. Bounded to the\n      // pinned size, so bytes appended after the identity check are never sent.\n      const body = Readable.toWeb(opened.handle.createReadStream({ start: 0, end: share.size - 1 }));\n      return new Response(body as ReadableStream<Uint8Array>, { headers });\n    },\n  };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;AAwBA,MAAa,2BAA2B;AAExC,MAAM,cAAc;AACpB,MAAM,gBAAgB;AACtB,MAAM,eAAe;AACrB,MAAM,kBAAkB;AACxB,MAAM,8BAA8B;AACpC,MAAM,aAAaA,QAAAA,QAAG,UAAU,WAAWA,QAAAA,QAAG,UAAU;AAwCxD,SAAS,YAAY,OAAuB;CAC1C,QAAA,GAAOC,YAAAA,WAAAA,CAAW,QAAQ,CAAC,CAAC,OAAO,KAAK,CAAC,CAAC,OAAO,WAAW;AAC9D;AAEA,SAAS,WAAqB;CAC5B,OAAO,SAAS,KAAK,EAAE,OAAO,aAAa,GAAG,EAAE,QAAQ,IAAI,CAAC;AAC/D;;AAGA,SAAS,uBAAuB,UAA0B;CACxD,OAAO,mBAAmB,QAAQ,CAAC,CAAC,QAClC,aACC,cAAc,IAAI,UAAU,WAAW,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,YAAY,GACtE;AACF;;AAGA,eAAe,YAAY,MAAc,UAAoC;CAC3E,IAAI;CACJ,IAAI;EACF,WAAW,MAAMD,QAAAA,QAAG,SAAS,SAAS,IAAI;CAC5C,QAAQ;EACN,OAAO;CACT;CACA,MAAM,WAAWE,UAAAA,QAAK,SAAS,UAAU,QAAQ;CACjD,OACE,aAAa,MACb,CAACA,UAAAA,QAAK,WAAW,QAAQ,KACzB,SAAS,MAAMA,UAAAA,QAAK,GAAG,CAAC,CAAC,OAAO,YAAY,CAAC,QAAQ,WAAW,GAAG,CAAC;AAExE;;AAGA,eAAe,iBACb,SACA,aACiB;CACjB,MAAM,0BAAU,IAAI,MAAM,IAAI,QAAQ,KAAK,oEAAoE;CAC/G,IACE,QAAQ,SAAS,MACjB,QAAQ,KAAK,SAAS,IAAI,KAC1B,QAAQ,KAAK,MAAM,QAAQ,CAAC,CAAC,MAAM,YAAY,YAAY,OAAO,YAAY,IAAI,GAElF,MAAM;CACR,IAAI;CACJ,IAAI;EACF,WAAW,MAAMF,QAAAA,QAAG,SAAS,SAASE,UAAAA,QAAK,QAAQ,QAAQ,KAAK,QAAQ,IAAI,CAAC;CAC/E,QAAQ;EACN,MAAM;CACR;CACA,MAAM,QAAQ,CAAC,QAAQ,GAAG;CAC1B,IAAI;EACF,MAAM,KAAKC,cAAAA,sBAAsB,QAAQ,WAAW,WAAW,CAAC;CAClE,QAAQ,CAER;CACA,KAAK,MAAM,QAAQ,OAAO,IAAI,MAAM,YAAY,MAAM,QAAQ,GAAG,OAAO;CACxE,MAAM;AACR;;;;;;;AAQA,eAAe,WAAW,UAA2F;CACnH,IAAI;CACJ,IAAI;EACF,SAAS,MAAMH,QAAAA,QAAG,SAAS,KAAK,UAAU,UAAU;CACtD,QAAQ;EACN;CACF;CACA,IAAI;EACF,MAAM,OAAO,MAAM,OAAO,KAAK;EAC/B,MAAM,QAAQ,MAAMA,QAAAA,QAAG,SAAS,MAAM,QAAQ;EAC9C,IACE,KAAK,OAAO,KACZ,MAAM,QAAQ,KAAK,OACnB,MAAM,QAAQ,KAAK,OAClB,MAAMA,QAAAA,QAAG,SAAS,SAAS,QAAQ,MAAO,UAE3C,OAAO;GAAE;GAAQ;EAAK;CAC1B,QAAQ,CAER;CACA,MAAM,OAAO,MAAM;AAErB;AAEA,SAAgB,uBAAuB,SAAoD;CACzF,MAAM,cAAc,QAAQ,eAAe,QAAQ;CACnD,MAAM,yBAAS,IAAI,IAAmB;CAEtC,MAAM,cAAc,UAClB,CAAC,MAAM,WACP,KAAK,IAAI,IAAI,MAAM,aACnB,MAAM,aAAa,QAAQ,qBAAqB,KAChD,QAAQ,aAAa,MAAM,KAAA;CAC7B,MAAM,QAAQ,UAA0B,WAAW,KAAK,KAAK,MAAM,gBAAgB;CAEnF,OAAO;EACL,MAAM,KAAK,SAAS;GAClB,MAAM,SAAS,QAAQ,aAAa;GACpC,MAAM,WAAW,QAAQ,qBAAqB;GAC9C,IAAI,WAAW,KAAA,GAAW,MAAM,IAAI,MAAMI,mBAAAA,gCAAgC;GAC1E,MAAM,WAAW,MAAM,iBAAiB,SAAS,WAAW;GAC5D,MAAM,SAAS,MAAM,WAAW,QAAQ;GACxC,IAAI,WAAW,KAAA,GAAW,MAAM,IAAI,MAAM,IAAI,QAAQ,KAAK,sCAAsC;GACjG,MAAM,EAAE,SAAS;GACjB,MAAM,OAAO,OAAO,MAAM;GAC1B,IAAI,KAAK,OAAA,UACP,MAAM,IAAI,MAAM,IAAI,QAAQ,KAAK,+CAA+C;GAClF,KAAK,MAAM,CAAC,KAAK,UAAU,QAAQ,IAAI,CAAC,KAAK,KAAK,GAAG,OAAO,OAAO,GAAG;GACtE,IACE,CAAC,GAAG,OAAO,OAAO,CAAC,CAAC,CAAC,QAAQ,UAAU,MAAM,cAAc,QAAQ,SAAS,CAAC,CAAC,UAC9E,6BAEA,MAAM,IAAI,MACR,+BAA+B,OAAO,2BAA2B,EAAE,0CACrE;GACF,MAAM,SAAA,GAAQC,YAAAA,YAAAA,CAAY,WAAW,CAAC,CAAC,SAAS,WAAW;GAC3D,MAAM,MAAM,YAAY,KAAK;GAC7B,MAAM,WAAWH,UAAAA,QAAK,SAAS,QAAQ;GACvC,MAAM,QAAe;IACnB,WAAW,QAAQ;IACnB;IACA;IACA,KAAK,KAAK;IACV,KAAK,KAAK;IACV,MAAM,KAAK;IACX,SAAS,KAAK;IACd;IACA,WAAW,KAAK,IAAI,IAAI;IACxB,eAAe;IACf,SAAS;GACX;GACA,OAAO,IAAI,KAAK,KAAK;GACrB,QAAQ,SAAS,0BAA0B,SAAS,QAAQ,QAAQ,MAAM,8BAA8B;GACxG,OAAO;IACL,KAAK,GAAG,SAAS,2BAA2B;IAC5C;IACA,UAAUI,qBAAAA,2BAA2BJ,UAAAA,QAAK,QAAQ,QAAQ,CAAC,CAAC,YAAY,MAAA;IACxE,MAAM,KAAK;IACX,WAAW,MAAM;IACjB,cAAc;IACd,cAAc;KACZ,MAAM,UAAU;KAChB,OAAO,OAAO,GAAG;IACnB;GACF;EACF;EAEA,MAAM,MAAM,OAAO,QAAQ;GACzB,IAAK,WAAW,SAAS,WAAW,UAAW,CAAC,cAAc,KAAK,KAAK,GAAG,OAAO,SAAS;GAC3F,MAAM,MAAM,YAAY,KAAK;GAC7B,MAAM,QAAQ,OAAO,IAAI,GAAG;GAC5B,IAAI,UAAU,KAAA,GAAW,OAAO,SAAS;GACzC,IAAI,CAAC,KAAK,KAAK,GAAG;IAChB,OAAO,OAAO,GAAG;IACjB,OAAO,SAAS;GAClB;GAEA,IAAI,WAAW,OAAO;IACpB,MAAM,iBAAiB;IACvB,IAAI,MAAM,kBAAkB,GAAG,OAAO,OAAO,GAAG;GAClD;GACA,MAAM,SAAS,MAAM,WAAW,MAAM,QAAQ;GAC9C,IACE,WAAW,KAAA,KACX,OAAO,KAAK,QAAQ,MAAM,OAC1B,OAAO,KAAK,QAAQ,MAAM,OAC1B,OAAO,KAAK,SAAS,MAAM,QAC3B,OAAO,KAAK,YAAY,MAAM,SAC9B;IACA,MAAM,QAAQ,OAAO,MAAM;IAC3B,OAAO,OAAO,GAAG;IACjB,QAAQ,SAAS,wBAAwB,MAAM,SAAS,gDAAgD;IACxG,OAAO,SAAS;GAClB;GAGA,IAAI,CAAC,WAAW,KAAK,GAAG;IACtB,MAAM,OAAO,OAAO,MAAM;IAC1B,OAAO,OAAO,GAAG;IACjB,OAAO,SAAS;GAClB;GACA,MAAM,UAAU;IACd,gBAAgB;IAChB,kBAAkB,OAAO,MAAM,IAAI;IACnC,uBAAuB,gCAAgC,uBAAuB,MAAM,QAAQ;IAC5F,0BAA0B;IAC1B,2BAA2B;IAC3B,gCAAgC;IAChC,iBAAiB;IACjB,mBAAmB;IACnB,iBAAiB;IACjB,gBAAgB;GAClB;GACA,IAAI,WAAW,UAAU,MAAM,SAAS,GAAG;IACzC,MAAM,OAAO,OAAO,MAAM;IAC1B,OAAO,IAAI,SAAS,WAAW,SAAS,uBAAO,IAAI,WAAW,GAAG,EAAE,QAAQ,CAAC;GAC9E;GAGA,MAAM,OAAOK,YAAAA,SAAS,MAAM,OAAO,OAAO,iBAAiB;IAAE,OAAO;IAAG,KAAK,MAAM,OAAO;GAAE,CAAC,CAAC;GAC7F,OAAO,IAAI,SAAS,MAAoC,EAAE,QAAQ,CAAC;EACrE;CACF;AACF"}

package/dist/src/services/publicFileShares/index.d.mts

@@ -1,4 +1,4 @@
-import { DoomSharedFile } from "../../schemas/packageApi.mjs";
+import { PoSharedFile } from "../../schemas/packageApi.mjs";
 //#region src/services/publicFileShares/index.d.ts
 export interface PublicFileShareRequest {
   sessionId: string;
@@ -9,7 +9,7 @@ export interface PublicFileShareRequest {
   label: string;
 }
 export interface PublicFileShares {
-  mint(request: PublicFileShareRequest): Promise<DoomSharedFile>;
+  mint(request: PublicFileShareRequest): Promise<PoSharedFile>;
   serve(token: string, method: string): Promise<Response>;
 }
 //#endregion

package/dist/src/services/publicFileShares/index.mjs

@@ -1,4 +1,4 @@
-import { DOOM_SHARE_FILE_REMOTE_OFF_MESSAGE } from "../../schemas/packageApi.mjs";
+import { PO_SHARE_FILE_REMOTE_OFF_MESSAGE } from "../../schemas/packageApi.mjs";
 import { SESSION_FILE_CONTENT_TYPES } from "../../constants/sessionFiles.mjs";
 import { sessionAttachmentRoot } from "../sessionAttachments/index.mjs";
 import { createHash, randomBytes } from "node:crypto";
@@ -93,7 +93,7 @@ function createPublicFileShares(options) {
 		async mint(request) {
 			const origin = options.publicOrigin();
 			const revision = options.publicOriginRevision();
-			if (origin === void 0) throw new Error(DOOM_SHARE_FILE_REMOTE_OFF_MESSAGE);
+			if (origin === void 0) throw new Error(PO_SHARE_FILE_REMOTE_OFF_MESSAGE);
 			const filePath = await resolveShareable(request, environment);
 			const opened = await openPinned(filePath);
 			if (opened === void 0) throw new Error(`"${request.path}" is not a regular file Po can share.`);

package/dist/src/services/publicFileShares/index.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"index.mjs","names":[],"sources":["../../../../src/services/publicFileShares/index.ts"],"sourcesContent":["import { createHash, randomBytes } from 'node:crypto';\nimport fs from 'node:fs';\nimport path from 'node:path';\nimport { Readable } from 'node:stream';\n\nimport {\n  MAX_SESSION_FILE_BYTES,\n  SESSION_FILE_CONTENT_TYPES,\n  SESSION_FILE_DEFAULT_CONTENT_TYPE,\n} from '../../constants/sessionFiles';\nimport { DOOM_SHARE_FILE_REMOTE_OFF_MESSAGE, type DoomSharedFile } from '../../schemas/packageApi';\nimport { sessionAttachmentRoot } from '../sessionAttachments';\n\n/**\n * Short-lived public links to one session file, so a remote MCP server can fetch\n * what the model was asked to hand it.\n *\n * The link is the only credential, so only its hash is kept, and every way a\n * link can fail answers the same 404. A file is pinned by identity when the\n * link is minted and reopened when it is served: a path that now names another\n * file, or reaches it through a new symlink, is refused rather than followed.\n */\n\n/** Public tunnel path prefix; the token is the only segment after it. */\nexport const PUBLIC_FILE_SHARE_PREFIX = '/mcp-file/';\n\nconst TOKEN_BYTES = 32;\nconst TOKEN_PATTERN = /^[A-Za-z0-9_-]{43}$/u;\nconst SHARE_TTL_MS = 10 * 60 * 1000;\nconst SHARE_DOWNLOADS = 3;\nconst MAX_LIVE_SHARES_PER_SESSION = 16;\nconst OPEN_FLAGS = fs.constants.O_RDONLY | fs.constants.O_NOFOLLOW;\n\nexport interface PublicFileShareRequest {\n  sessionId: string;\n  cwd: string;\n  /** Relative to cwd, or absolute. */\n  path: string;\n  /** Who the file is for, for the host's notice. */\n  label: string;\n}\n\nexport interface PublicFileShares {\n  mint(request: PublicFileShareRequest): Promise<DoomSharedFile>;\n  serve(token: string, method: string): Promise<Response>;\n}\n\nexport interface PublicFileSharesOptions {\n  publicOrigin(): string | undefined;\n  /** Bumped whenever the tunnel goes away; a link minted under another revision is dead. */\n  publicOriginRevision(): number;\n  /** Never receives a token or a link. */\n  onNotice(message: string): void;\n  /** Locates the attachment root; defaults to the process environment, as the upload route does. */\n  environment?: Readonly<Record<string, string | undefined>>;\n}\n\ninterface Share {\n  sessionId: string;\n  filePath: string;\n  fileName: string;\n  dev: number;\n  ino: number;\n  size: number;\n  mtimeMs: number;\n  revision: number;\n  expiresAt: number;\n  downloadsLeft: number;\n  revoked: boolean;\n}\n\nfunction tokenDigest(token: string): string {\n  return createHash('sha256').update(token).digest('base64url');\n}\n\nfunction notFound(): Response {\n  return Response.json({ error: 'Not found.' }, { status: 404 });\n}\n\n/** RFC 8187 value for `filename*`: encodeURIComponent leaves a few characters the grammar forbids. */\nfunction contentDispositionName(fileName: string): string {\n  return encodeURIComponent(fileName).replace(\n    /['()*]/gu,\n    (character) => `%${character.charCodeAt(0).toString(16).toUpperCase()}`,\n  );\n}\n\n/** True when filePath sits strictly below the real root with no segment that starts with a dot. */\nasync function containedIn(root: string, filePath: string): Promise<boolean> {\n  let realRoot: string;\n  try {\n    realRoot = await fs.promises.realpath(root);\n  } catch {\n    return false;\n  }\n  const relative = path.relative(realRoot, filePath);\n  return (\n    relative !== '' &&\n    !path.isAbsolute(relative) &&\n    relative.split(path.sep).every((segment) => !segment.startsWith('.'))\n  );\n}\n\n/** The real path of a shareable file: inside the session cwd or its attachment root, never through a dot segment. */\nasync function resolveShareable(\n  request: PublicFileShareRequest,\n  environment: Readonly<Record<string, string | undefined>>,\n): Promise<string> {\n  const refused = new Error(`\"${request.path}\" is not a file in this session's working directory or attachments.`);\n  if (\n    request.path === '' ||\n    request.path.includes('\\0') ||\n    request.path.split(/[\\\\/]/u).some((segment) => segment === '.' || segment === '..')\n  )\n    throw refused;\n  let filePath: string;\n  try {\n    filePath = await fs.promises.realpath(path.resolve(request.cwd, request.path));\n  } catch {\n    throw refused;\n  }\n  const roots = [request.cwd];\n  try {\n    roots.push(sessionAttachmentRoot(request.sessionId, environment));\n  } catch {\n    // An id that cannot hold attachments only has its working directory.\n  }\n  for (const root of roots) if (await containedIn(root, filePath)) return filePath;\n  throw refused;\n}\n\n/**\n * Opens a regular file without following a final symlink, then proves the handle is\n * still the file at that real path: a parent swapped for a symlink changes the real\n * path, and a replaced file changes the identity. Resolves undefined, with nothing\n * left open, when either check fails.\n */\nasync function openPinned(filePath: string): Promise<{ handle: fs.promises.FileHandle; stat: fs.Stats } | undefined> {\n  let handle: fs.promises.FileHandle;\n  try {\n    handle = await fs.promises.open(filePath, OPEN_FLAGS);\n  } catch {\n    return undefined;\n  }\n  try {\n    const stat = await handle.stat();\n    const named = await fs.promises.lstat(filePath);\n    if (\n      stat.isFile() &&\n      named.dev === stat.dev &&\n      named.ino === stat.ino &&\n      (await fs.promises.realpath(filePath)) === filePath\n    )\n      return { handle, stat };\n  } catch {\n    // Treated like a mismatch below.\n  }\n  await handle.close();\n  return undefined;\n}\n\nexport function createPublicFileShares(options: PublicFileSharesOptions): PublicFileShares {\n  const environment = options.environment ?? process.env;\n  const shares = new Map<string, Share>();\n\n  const authorized = (share: Share): boolean =>\n    !share.revoked &&\n    Date.now() < share.expiresAt &&\n    share.revision === options.publicOriginRevision() &&\n    options.publicOrigin() !== undefined;\n  const live = (share: Share): boolean => authorized(share) && share.downloadsLeft > 0;\n\n  return {\n    async mint(request) {\n      const origin = options.publicOrigin();\n      const revision = options.publicOriginRevision();\n      if (origin === undefined) throw new Error(DOOM_SHARE_FILE_REMOTE_OFF_MESSAGE);\n      const filePath = await resolveShareable(request, environment);\n      const opened = await openPinned(filePath);\n      if (opened === undefined) throw new Error(`\"${request.path}\" is not a regular file Po can share.`);\n      const { stat } = opened;\n      await opened.handle.close();\n      if (stat.size > MAX_SESSION_FILE_BYTES)\n        throw new Error(`\"${request.path}\" is larger than the 25 MB file sharing limit.`);\n      for (const [key, share] of shares) if (!live(share)) shares.delete(key);\n      if (\n        [...shares.values()].filter((share) => share.sessionId === request.sessionId).length >=\n        MAX_LIVE_SHARES_PER_SESSION\n      )\n        throw new Error(\n          `This session already shares ${String(MAX_LIVE_SHARES_PER_SESSION)} files. Retry after a tool call finishes.`,\n        );\n      const token = randomBytes(TOKEN_BYTES).toString('base64url');\n      const key = tokenDigest(token);\n      const fileName = path.basename(filePath);\n      const share: Share = {\n        sessionId: request.sessionId,\n        filePath,\n        fileName,\n        dev: stat.dev,\n        ino: stat.ino,\n        size: stat.size,\n        mtimeMs: stat.mtimeMs,\n        revision,\n        expiresAt: Date.now() + SHARE_TTL_MS,\n        downloadsLeft: SHARE_DOWNLOADS,\n        revoked: false,\n      };\n      shares.set(key, share);\n      options.onNotice(`file share: published \"${fileName}\" for ${request.label} on the remote-access tunnel.`);\n      return {\n        url: `${origin}${PUBLIC_FILE_SHARE_PREFIX}${token}`,\n        fileName,\n        mimeType: SESSION_FILE_CONTENT_TYPES[path.extname(fileName).toLowerCase()] ?? SESSION_FILE_DEFAULT_CONTENT_TYPE,\n        size: stat.size,\n        expiresAt: share.expiresAt,\n        maxDownloads: SHARE_DOWNLOADS,\n        revoke: () => {\n          share.revoked = true;\n          shares.delete(key);\n        },\n      };\n    },\n\n    async serve(token, method) {\n      if ((method !== 'GET' && method !== 'HEAD') || !TOKEN_PATTERN.test(token)) return notFound();\n      const key = tokenDigest(token);\n      const share = shares.get(key);\n      if (share === undefined) return notFound();\n      if (!live(share)) {\n        shares.delete(key);\n        return notFound();\n      }\n      // Counted before the first await, so concurrent downloads cannot outrun the limit.\n      if (method === 'GET') {\n        share.downloadsLeft -= 1;\n        if (share.downloadsLeft === 0) shares.delete(key);\n      }\n      const opened = await openPinned(share.filePath);\n      if (\n        opened === undefined ||\n        opened.stat.dev !== share.dev ||\n        opened.stat.ino !== share.ino ||\n        opened.stat.size !== share.size ||\n        opened.stat.mtimeMs !== share.mtimeMs\n      ) {\n        await opened?.handle.close();\n        shares.delete(key);\n        options.onNotice(`file share: refused \"${share.fileName}\" because the file changed after it was shared.`);\n        return notFound();\n      }\n      // Opening a file yields to revocation and tunnel changes. The download already\n      // reserved its allowance, so this check must not reject the final permitted GET.\n      if (!authorized(share)) {\n        await opened.handle.close();\n        shares.delete(key);\n        return notFound();\n      }\n      const headers = {\n        'content-type': 'application/octet-stream',\n        'content-length': String(share.size),\n        'content-disposition': `attachment; filename*=UTF-8''${contentDispositionName(share.fileName)}`,\n        'x-content-type-options': 'nosniff',\n        'content-security-policy': \"sandbox; default-src 'none'\",\n        'cross-origin-resource-policy': 'same-origin',\n        'cache-control': 'no-store, private',\n        'referrer-policy': 'no-referrer',\n        'accept-ranges': 'none',\n        'x-robots-tag': 'noindex',\n      };\n      if (method === 'HEAD' || share.size === 0) {\n        await opened.handle.close();\n        return new Response(method === 'HEAD' ? null : new Uint8Array(), { headers });\n      }\n      // The stream closes the handle when it ends, fails, or is cancelled. Bounded to the\n      // pinned size, so bytes appended after the identity check are never sent.\n      const body = Readable.toWeb(opened.handle.createReadStream({ start: 0, end: share.size - 1 }));\n      return new Response(body as ReadableStream<Uint8Array>, { headers });\n    },\n  };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;AAwBA,MAAa,2BAA2B;AAExC,MAAM,cAAc;AACpB,MAAM,gBAAgB;AACtB,MAAM,eAAe;AACrB,MAAM,kBAAkB;AACxB,MAAM,8BAA8B;AACpC,MAAM,aAAa,GAAG,UAAU,WAAW,GAAG,UAAU;AAwCxD,SAAS,YAAY,OAAuB;CAC1C,OAAO,WAAW,QAAQ,CAAC,CAAC,OAAO,KAAK,CAAC,CAAC,OAAO,WAAW;AAC9D;AAEA,SAAS,WAAqB;CAC5B,OAAO,SAAS,KAAK,EAAE,OAAO,aAAa,GAAG,EAAE,QAAQ,IAAI,CAAC;AAC/D;;AAGA,SAAS,uBAAuB,UAA0B;CACxD,OAAO,mBAAmB,QAAQ,CAAC,CAAC,QAClC,aACC,cAAc,IAAI,UAAU,WAAW,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,YAAY,GACtE;AACF;;AAGA,eAAe,YAAY,MAAc,UAAoC;CAC3E,IAAI;CACJ,IAAI;EACF,WAAW,MAAM,GAAG,SAAS,SAAS,IAAI;CAC5C,QAAQ;EACN,OAAO;CACT;CACA,MAAM,WAAW,KAAK,SAAS,UAAU,QAAQ;CACjD,OACE,aAAa,MACb,CAAC,KAAK,WAAW,QAAQ,KACzB,SAAS,MAAM,KAAK,GAAG,CAAC,CAAC,OAAO,YAAY,CAAC,QAAQ,WAAW,GAAG,CAAC;AAExE;;AAGA,eAAe,iBACb,SACA,aACiB;CACjB,MAAM,0BAAU,IAAI,MAAM,IAAI,QAAQ,KAAK,oEAAoE;CAC/G,IACE,QAAQ,SAAS,MACjB,QAAQ,KAAK,SAAS,IAAI,KAC1B,QAAQ,KAAK,MAAM,QAAQ,CAAC,CAAC,MAAM,YAAY,YAAY,OAAO,YAAY,IAAI,GAElF,MAAM;CACR,IAAI;CACJ,IAAI;EACF,WAAW,MAAM,GAAG,SAAS,SAAS,KAAK,QAAQ,QAAQ,KAAK,QAAQ,IAAI,CAAC;CAC/E,QAAQ;EACN,MAAM;CACR;CACA,MAAM,QAAQ,CAAC,QAAQ,GAAG;CAC1B,IAAI;EACF,MAAM,KAAK,sBAAsB,QAAQ,WAAW,WAAW,CAAC;CAClE,QAAQ,CAER;CACA,KAAK,MAAM,QAAQ,OAAO,IAAI,MAAM,YAAY,MAAM,QAAQ,GAAG,OAAO;CACxE,MAAM;AACR;;;;;;;AAQA,eAAe,WAAW,UAA2F;CACnH,IAAI;CACJ,IAAI;EACF,SAAS,MAAM,GAAG,SAAS,KAAK,UAAU,UAAU;CACtD,QAAQ;EACN;CACF;CACA,IAAI;EACF,MAAM,OAAO,MAAM,OAAO,KAAK;EAC/B,MAAM,QAAQ,MAAM,GAAG,SAAS,MAAM,QAAQ;EAC9C,IACE,KAAK,OAAO,KACZ,MAAM,QAAQ,KAAK,OACnB,MAAM,QAAQ,KAAK,OAClB,MAAM,GAAG,SAAS,SAAS,QAAQ,MAAO,UAE3C,OAAO;GAAE;GAAQ;EAAK;CAC1B,QAAQ,CAER;CACA,MAAM,OAAO,MAAM;AAErB;AAEA,SAAgB,uBAAuB,SAAoD;CACzF,MAAM,cAAc,QAAQ,eAAe,QAAQ;CACnD,MAAM,yBAAS,IAAI,IAAmB;CAEtC,MAAM,cAAc,UAClB,CAAC,MAAM,WACP,KAAK,IAAI,IAAI,MAAM,aACnB,MAAM,aAAa,QAAQ,qBAAqB,KAChD,QAAQ,aAAa,MAAM,KAAA;CAC7B,MAAM,QAAQ,UAA0B,WAAW,KAAK,KAAK,MAAM,gBAAgB;CAEnF,OAAO;EACL,MAAM,KAAK,SAAS;GAClB,MAAM,SAAS,QAAQ,aAAa;GACpC,MAAM,WAAW,QAAQ,qBAAqB;GAC9C,IAAI,WAAW,KAAA,GAAW,MAAM,IAAI,MAAM,kCAAkC;GAC5E,MAAM,WAAW,MAAM,iBAAiB,SAAS,WAAW;GAC5D,MAAM,SAAS,MAAM,WAAW,QAAQ;GACxC,IAAI,WAAW,KAAA,GAAW,MAAM,IAAI,MAAM,IAAI,QAAQ,KAAK,sCAAsC;GACjG,MAAM,EAAE,SAAS;GACjB,MAAM,OAAO,OAAO,MAAM;GAC1B,IAAI,KAAK,OAAA,UACP,MAAM,IAAI,MAAM,IAAI,QAAQ,KAAK,+CAA+C;GAClF,KAAK,MAAM,CAAC,KAAK,UAAU,QAAQ,IAAI,CAAC,KAAK,KAAK,GAAG,OAAO,OAAO,GAAG;GACtE,IACE,CAAC,GAAG,OAAO,OAAO,CAAC,CAAC,CAAC,QAAQ,UAAU,MAAM,cAAc,QAAQ,SAAS,CAAC,CAAC,UAC9E,6BAEA,MAAM,IAAI,MACR,+BAA+B,OAAO,2BAA2B,EAAE,0CACrE;GACF,MAAM,QAAQ,YAAY,WAAW,CAAC,CAAC,SAAS,WAAW;GAC3D,MAAM,MAAM,YAAY,KAAK;GAC7B,MAAM,WAAW,KAAK,SAAS,QAAQ;GACvC,MAAM,QAAe;IACnB,WAAW,QAAQ;IACnB;IACA;IACA,KAAK,KAAK;IACV,KAAK,KAAK;IACV,MAAM,KAAK;IACX,SAAS,KAAK;IACd;IACA,WAAW,KAAK,IAAI,IAAI;IACxB,eAAe;IACf,SAAS;GACX;GACA,OAAO,IAAI,KAAK,KAAK;GACrB,QAAQ,SAAS,0BAA0B,SAAS,QAAQ,QAAQ,MAAM,8BAA8B;GACxG,OAAO;IACL,KAAK,GAAG,SAAS,2BAA2B;IAC5C;IACA,UAAU,2BAA2B,KAAK,QAAQ,QAAQ,CAAC,CAAC,YAAY,MAAA;IACxE,MAAM,KAAK;IACX,WAAW,MAAM;IACjB,cAAc;IACd,cAAc;KACZ,MAAM,UAAU;KAChB,OAAO,OAAO,GAAG;IACnB;GACF;EACF;EAEA,MAAM,MAAM,OAAO,QAAQ;GACzB,IAAK,WAAW,SAAS,WAAW,UAAW,CAAC,cAAc,KAAK,KAAK,GAAG,OAAO,SAAS;GAC3F,MAAM,MAAM,YAAY,KAAK;GAC7B,MAAM,QAAQ,OAAO,IAAI,GAAG;GAC5B,IAAI,UAAU,KAAA,GAAW,OAAO,SAAS;GACzC,IAAI,CAAC,KAAK,KAAK,GAAG;IAChB,OAAO,OAAO,GAAG;IACjB,OAAO,SAAS;GAClB;GAEA,IAAI,WAAW,OAAO;IACpB,MAAM,iBAAiB;IACvB,IAAI,MAAM,kBAAkB,GAAG,OAAO,OAAO,GAAG;GAClD;GACA,MAAM,SAAS,MAAM,WAAW,MAAM,QAAQ;GAC9C,IACE,WAAW,KAAA,KACX,OAAO,KAAK,QAAQ,MAAM,OAC1B,OAAO,KAAK,QAAQ,MAAM,OAC1B,OAAO,KAAK,SAAS,MAAM,QAC3B,OAAO,KAAK,YAAY,MAAM,SAC9B;IACA,MAAM,QAAQ,OAAO,MAAM;IAC3B,OAAO,OAAO,GAAG;IACjB,QAAQ,SAAS,wBAAwB,MAAM,SAAS,gDAAgD;IACxG,OAAO,SAAS;GAClB;GAGA,IAAI,CAAC,WAAW,KAAK,GAAG;IACtB,MAAM,OAAO,OAAO,MAAM;IAC1B,OAAO,OAAO,GAAG;IACjB,OAAO,SAAS;GAClB;GACA,MAAM,UAAU;IACd,gBAAgB;IAChB,kBAAkB,OAAO,MAAM,IAAI;IACnC,uBAAuB,gCAAgC,uBAAuB,MAAM,QAAQ;IAC5F,0BAA0B;IAC1B,2BAA2B;IAC3B,gCAAgC;IAChC,iBAAiB;IACjB,mBAAmB;IACnB,iBAAiB;IACjB,gBAAgB;GAClB;GACA,IAAI,WAAW,UAAU,MAAM,SAAS,GAAG;IACzC,MAAM,OAAO,OAAO,MAAM;IAC1B,OAAO,IAAI,SAAS,WAAW,SAAS,uBAAO,IAAI,WAAW,GAAG,EAAE,QAAQ,CAAC;GAC9E;GAGA,MAAM,OAAO,SAAS,MAAM,OAAO,OAAO,iBAAiB;IAAE,OAAO;IAAG,KAAK,MAAM,OAAO;GAAE,CAAC,CAAC;GAC7F,OAAO,IAAI,SAAS,MAAoC,EAAE,QAAQ,CAAC;EACrE;CACF;AACF"}
+{"version":3,"file":"index.mjs","names":[],"sources":["../../../../src/services/publicFileShares/index.ts"],"sourcesContent":["import { createHash, randomBytes } from 'node:crypto';\nimport fs from 'node:fs';\nimport path from 'node:path';\nimport { Readable } from 'node:stream';\n\nimport {\n  MAX_SESSION_FILE_BYTES,\n  SESSION_FILE_CONTENT_TYPES,\n  SESSION_FILE_DEFAULT_CONTENT_TYPE,\n} from '../../constants/sessionFiles';\nimport { PO_SHARE_FILE_REMOTE_OFF_MESSAGE, type PoSharedFile } from '../../schemas/packageApi';\nimport { sessionAttachmentRoot } from '../sessionAttachments';\n\n/**\n * Short-lived public links to one session file, so a remote MCP server can fetch\n * what the model was asked to hand it.\n *\n * The link is the only credential, so only its hash is kept, and every way a\n * link can fail answers the same 404. A file is pinned by identity when the\n * link is minted and reopened when it is served: a path that now names another\n * file, or reaches it through a new symlink, is refused rather than followed.\n */\n\n/** Public tunnel path prefix; the token is the only segment after it. */\nexport const PUBLIC_FILE_SHARE_PREFIX = '/mcp-file/';\n\nconst TOKEN_BYTES = 32;\nconst TOKEN_PATTERN = /^[A-Za-z0-9_-]{43}$/u;\nconst SHARE_TTL_MS = 10 * 60 * 1000;\nconst SHARE_DOWNLOADS = 3;\nconst MAX_LIVE_SHARES_PER_SESSION = 16;\nconst OPEN_FLAGS = fs.constants.O_RDONLY | fs.constants.O_NOFOLLOW;\n\nexport interface PublicFileShareRequest {\n  sessionId: string;\n  cwd: string;\n  /** Relative to cwd, or absolute. */\n  path: string;\n  /** Who the file is for, for the host's notice. */\n  label: string;\n}\n\nexport interface PublicFileShares {\n  mint(request: PublicFileShareRequest): Promise<PoSharedFile>;\n  serve(token: string, method: string): Promise<Response>;\n}\n\nexport interface PublicFileSharesOptions {\n  publicOrigin(): string | undefined;\n  /** Bumped whenever the tunnel goes away; a link minted under another revision is dead. */\n  publicOriginRevision(): number;\n  /** Never receives a token or a link. */\n  onNotice(message: string): void;\n  /** Locates the attachment root; defaults to the process environment, as the upload route does. */\n  environment?: Readonly<Record<string, string | undefined>>;\n}\n\ninterface Share {\n  sessionId: string;\n  filePath: string;\n  fileName: string;\n  dev: number;\n  ino: number;\n  size: number;\n  mtimeMs: number;\n  revision: number;\n  expiresAt: number;\n  downloadsLeft: number;\n  revoked: boolean;\n}\n\nfunction tokenDigest(token: string): string {\n  return createHash('sha256').update(token).digest('base64url');\n}\n\nfunction notFound(): Response {\n  return Response.json({ error: 'Not found.' }, { status: 404 });\n}\n\n/** RFC 8187 value for `filename*`: encodeURIComponent leaves a few characters the grammar forbids. */\nfunction contentDispositionName(fileName: string): string {\n  return encodeURIComponent(fileName).replace(\n    /['()*]/gu,\n    (character) => `%${character.charCodeAt(0).toString(16).toUpperCase()}`,\n  );\n}\n\n/** True when filePath sits strictly below the real root with no segment that starts with a dot. */\nasync function containedIn(root: string, filePath: string): Promise<boolean> {\n  let realRoot: string;\n  try {\n    realRoot = await fs.promises.realpath(root);\n  } catch {\n    return false;\n  }\n  const relative = path.relative(realRoot, filePath);\n  return (\n    relative !== '' &&\n    !path.isAbsolute(relative) &&\n    relative.split(path.sep).every((segment) => !segment.startsWith('.'))\n  );\n}\n\n/** The real path of a shareable file: inside the session cwd or its attachment root, never through a dot segment. */\nasync function resolveShareable(\n  request: PublicFileShareRequest,\n  environment: Readonly<Record<string, string | undefined>>,\n): Promise<string> {\n  const refused = new Error(`\"${request.path}\" is not a file in this session's working directory or attachments.`);\n  if (\n    request.path === '' ||\n    request.path.includes('\\0') ||\n    request.path.split(/[\\\\/]/u).some((segment) => segment === '.' || segment === '..')\n  )\n    throw refused;\n  let filePath: string;\n  try {\n    filePath = await fs.promises.realpath(path.resolve(request.cwd, request.path));\n  } catch {\n    throw refused;\n  }\n  const roots = [request.cwd];\n  try {\n    roots.push(sessionAttachmentRoot(request.sessionId, environment));\n  } catch {\n    // An id that cannot hold attachments only has its working directory.\n  }\n  for (const root of roots) if (await containedIn(root, filePath)) return filePath;\n  throw refused;\n}\n\n/**\n * Opens a regular file without following a final symlink, then proves the handle is\n * still the file at that real path: a parent swapped for a symlink changes the real\n * path, and a replaced file changes the identity. Resolves undefined, with nothing\n * left open, when either check fails.\n */\nasync function openPinned(filePath: string): Promise<{ handle: fs.promises.FileHandle; stat: fs.Stats } | undefined> {\n  let handle: fs.promises.FileHandle;\n  try {\n    handle = await fs.promises.open(filePath, OPEN_FLAGS);\n  } catch {\n    return undefined;\n  }\n  try {\n    const stat = await handle.stat();\n    const named = await fs.promises.lstat(filePath);\n    if (\n      stat.isFile() &&\n      named.dev === stat.dev &&\n      named.ino === stat.ino &&\n      (await fs.promises.realpath(filePath)) === filePath\n    )\n      return { handle, stat };\n  } catch {\n    // Treated like a mismatch below.\n  }\n  await handle.close();\n  return undefined;\n}\n\nexport function createPublicFileShares(options: PublicFileSharesOptions): PublicFileShares {\n  const environment = options.environment ?? process.env;\n  const shares = new Map<string, Share>();\n\n  const authorized = (share: Share): boolean =>\n    !share.revoked &&\n    Date.now() < share.expiresAt &&\n    share.revision === options.publicOriginRevision() &&\n    options.publicOrigin() !== undefined;\n  const live = (share: Share): boolean => authorized(share) && share.downloadsLeft > 0;\n\n  return {\n    async mint(request) {\n      const origin = options.publicOrigin();\n      const revision = options.publicOriginRevision();\n      if (origin === undefined) throw new Error(PO_SHARE_FILE_REMOTE_OFF_MESSAGE);\n      const filePath = await resolveShareable(request, environment);\n      const opened = await openPinned(filePath);\n      if (opened === undefined) throw new Error(`\"${request.path}\" is not a regular file Po can share.`);\n      const { stat } = opened;\n      await opened.handle.close();\n      if (stat.size > MAX_SESSION_FILE_BYTES)\n        throw new Error(`\"${request.path}\" is larger than the 25 MB file sharing limit.`);\n      for (const [key, share] of shares) if (!live(share)) shares.delete(key);\n      if (\n        [...shares.values()].filter((share) => share.sessionId === request.sessionId).length >=\n        MAX_LIVE_SHARES_PER_SESSION\n      )\n        throw new Error(\n          `This session already shares ${String(MAX_LIVE_SHARES_PER_SESSION)} files. Retry after a tool call finishes.`,\n        );\n      const token = randomBytes(TOKEN_BYTES).toString('base64url');\n      const key = tokenDigest(token);\n      const fileName = path.basename(filePath);\n      const share: Share = {\n        sessionId: request.sessionId,\n        filePath,\n        fileName,\n        dev: stat.dev,\n        ino: stat.ino,\n        size: stat.size,\n        mtimeMs: stat.mtimeMs,\n        revision,\n        expiresAt: Date.now() + SHARE_TTL_MS,\n        downloadsLeft: SHARE_DOWNLOADS,\n        revoked: false,\n      };\n      shares.set(key, share);\n      options.onNotice(`file share: published \"${fileName}\" for ${request.label} on the remote-access tunnel.`);\n      return {\n        url: `${origin}${PUBLIC_FILE_SHARE_PREFIX}${token}`,\n        fileName,\n        mimeType: SESSION_FILE_CONTENT_TYPES[path.extname(fileName).toLowerCase()] ?? SESSION_FILE_DEFAULT_CONTENT_TYPE,\n        size: stat.size,\n        expiresAt: share.expiresAt,\n        maxDownloads: SHARE_DOWNLOADS,\n        revoke: () => {\n          share.revoked = true;\n          shares.delete(key);\n        },\n      };\n    },\n\n    async serve(token, method) {\n      if ((method !== 'GET' && method !== 'HEAD') || !TOKEN_PATTERN.test(token)) return notFound();\n      const key = tokenDigest(token);\n      const share = shares.get(key);\n      if (share === undefined) return notFound();\n      if (!live(share)) {\n        shares.delete(key);\n        return notFound();\n      }\n      // Counted before the first await, so concurrent downloads cannot outrun the limit.\n      if (method === 'GET') {\n        share.downloadsLeft -= 1;\n        if (share.downloadsLeft === 0) shares.delete(key);\n      }\n      const opened = await openPinned(share.filePath);\n      if (\n        opened === undefined ||\n        opened.stat.dev !== share.dev ||\n        opened.stat.ino !== share.ino ||\n        opened.stat.size !== share.size ||\n        opened.stat.mtimeMs !== share.mtimeMs\n      ) {\n        await opened?.handle.close();\n        shares.delete(key);\n        options.onNotice(`file share: refused \"${share.fileName}\" because the file changed after it was shared.`);\n        return notFound();\n      }\n      // Opening a file yields to revocation and tunnel changes. The download already\n      // reserved its allowance, so this check must not reject the final permitted GET.\n      if (!authorized(share)) {\n        await opened.handle.close();\n        shares.delete(key);\n        return notFound();\n      }\n      const headers = {\n        'content-type': 'application/octet-stream',\n        'content-length': String(share.size),\n        'content-disposition': `attachment; filename*=UTF-8''${contentDispositionName(share.fileName)}`,\n        'x-content-type-options': 'nosniff',\n        'content-security-policy': \"sandbox; default-src 'none'\",\n        'cross-origin-resource-policy': 'same-origin',\n        'cache-control': 'no-store, private',\n        'referrer-policy': 'no-referrer',\n        'accept-ranges': 'none',\n        'x-robots-tag': 'noindex',\n      };\n      if (method === 'HEAD' || share.size === 0) {\n        await opened.handle.close();\n        return new Response(method === 'HEAD' ? null : new Uint8Array(), { headers });\n      }\n      // The stream closes the handle when it ends, fails, or is cancelled. Bounded to the\n      // pinned size, so bytes appended after the identity check are never sent.\n      const body = Readable.toWeb(opened.handle.createReadStream({ start: 0, end: share.size - 1 }));\n      return new Response(body as ReadableStream<Uint8Array>, { headers });\n    },\n  };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;AAwBA,MAAa,2BAA2B;AAExC,MAAM,cAAc;AACpB,MAAM,gBAAgB;AACtB,MAAM,eAAe;AACrB,MAAM,kBAAkB;AACxB,MAAM,8BAA8B;AACpC,MAAM,aAAa,GAAG,UAAU,WAAW,GAAG,UAAU;AAwCxD,SAAS,YAAY,OAAuB;CAC1C,OAAO,WAAW,QAAQ,CAAC,CAAC,OAAO,KAAK,CAAC,CAAC,OAAO,WAAW;AAC9D;AAEA,SAAS,WAAqB;CAC5B,OAAO,SAAS,KAAK,EAAE,OAAO,aAAa,GAAG,EAAE,QAAQ,IAAI,CAAC;AAC/D;;AAGA,SAAS,uBAAuB,UAA0B;CACxD,OAAO,mBAAmB,QAAQ,CAAC,CAAC,QAClC,aACC,cAAc,IAAI,UAAU,WAAW,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,YAAY,GACtE;AACF;;AAGA,eAAe,YAAY,MAAc,UAAoC;CAC3E,IAAI;CACJ,IAAI;EACF,WAAW,MAAM,GAAG,SAAS,SAAS,IAAI;CAC5C,QAAQ;EACN,OAAO;CACT;CACA,MAAM,WAAW,KAAK,SAAS,UAAU,QAAQ;CACjD,OACE,aAAa,MACb,CAAC,KAAK,WAAW,QAAQ,KACzB,SAAS,MAAM,KAAK,GAAG,CAAC,CAAC,OAAO,YAAY,CAAC,QAAQ,WAAW,GAAG,CAAC;AAExE;;AAGA,eAAe,iBACb,SACA,aACiB;CACjB,MAAM,0BAAU,IAAI,MAAM,IAAI,QAAQ,KAAK,oEAAoE;CAC/G,IACE,QAAQ,SAAS,MACjB,QAAQ,KAAK,SAAS,IAAI,KAC1B,QAAQ,KAAK,MAAM,QAAQ,CAAC,CAAC,MAAM,YAAY,YAAY,OAAO,YAAY,IAAI,GAElF,MAAM;CACR,IAAI;CACJ,IAAI;EACF,WAAW,MAAM,GAAG,SAAS,SAAS,KAAK,QAAQ,QAAQ,KAAK,QAAQ,IAAI,CAAC;CAC/E,QAAQ;EACN,MAAM;CACR;CACA,MAAM,QAAQ,CAAC,QAAQ,GAAG;CAC1B,IAAI;EACF,MAAM,KAAK,sBAAsB,QAAQ,WAAW,WAAW,CAAC;CAClE,QAAQ,CAER;CACA,KAAK,MAAM,QAAQ,OAAO,IAAI,MAAM,YAAY,MAAM,QAAQ,GAAG,OAAO;CACxE,MAAM;AACR;;;;;;;AAQA,eAAe,WAAW,UAA2F;CACnH,IAAI;CACJ,IAAI;EACF,SAAS,MAAM,GAAG,SAAS,KAAK,UAAU,UAAU;CACtD,QAAQ;EACN;CACF;CACA,IAAI;EACF,MAAM,OAAO,MAAM,OAAO,KAAK;EAC/B,MAAM,QAAQ,MAAM,GAAG,SAAS,MAAM,QAAQ;EAC9C,IACE,KAAK,OAAO,KACZ,MAAM,QAAQ,KAAK,OACnB,MAAM,QAAQ,KAAK,OAClB,MAAM,GAAG,SAAS,SAAS,QAAQ,MAAO,UAE3C,OAAO;GAAE;GAAQ;EAAK;CAC1B,QAAQ,CAER;CACA,MAAM,OAAO,MAAM;AAErB;AAEA,SAAgB,uBAAuB,SAAoD;CACzF,MAAM,cAAc,QAAQ,eAAe,QAAQ;CACnD,MAAM,yBAAS,IAAI,IAAmB;CAEtC,MAAM,cAAc,UAClB,CAAC,MAAM,WACP,KAAK,IAAI,IAAI,MAAM,aACnB,MAAM,aAAa,QAAQ,qBAAqB,KAChD,QAAQ,aAAa,MAAM,KAAA;CAC7B,MAAM,QAAQ,UAA0B,WAAW,KAAK,KAAK,MAAM,gBAAgB;CAEnF,OAAO;EACL,MAAM,KAAK,SAAS;GAClB,MAAM,SAAS,QAAQ,aAAa;GACpC,MAAM,WAAW,QAAQ,qBAAqB;GAC9C,IAAI,WAAW,KAAA,GAAW,MAAM,IAAI,MAAM,gCAAgC;GAC1E,MAAM,WAAW,MAAM,iBAAiB,SAAS,WAAW;GAC5D,MAAM,SAAS,MAAM,WAAW,QAAQ;GACxC,IAAI,WAAW,KAAA,GAAW,MAAM,IAAI,MAAM,IAAI,QAAQ,KAAK,sCAAsC;GACjG,MAAM,EAAE,SAAS;GACjB,MAAM,OAAO,OAAO,MAAM;GAC1B,IAAI,KAAK,OAAA,UACP,MAAM,IAAI,MAAM,IAAI,QAAQ,KAAK,+CAA+C;GAClF,KAAK,MAAM,CAAC,KAAK,UAAU,QAAQ,IAAI,CAAC,KAAK,KAAK,GAAG,OAAO,OAAO,GAAG;GACtE,IACE,CAAC,GAAG,OAAO,OAAO,CAAC,CAAC,CAAC,QAAQ,UAAU,MAAM,cAAc,QAAQ,SAAS,CAAC,CAAC,UAC9E,6BAEA,MAAM,IAAI,MACR,+BAA+B,OAAO,2BAA2B,EAAE,0CACrE;GACF,MAAM,QAAQ,YAAY,WAAW,CAAC,CAAC,SAAS,WAAW;GAC3D,MAAM,MAAM,YAAY,KAAK;GAC7B,MAAM,WAAW,KAAK,SAAS,QAAQ;GACvC,MAAM,QAAe;IACnB,WAAW,QAAQ;IACnB;IACA;IACA,KAAK,KAAK;IACV,KAAK,KAAK;IACV,MAAM,KAAK;IACX,SAAS,KAAK;IACd;IACA,WAAW,KAAK,IAAI,IAAI;IACxB,eAAe;IACf,SAAS;GACX;GACA,OAAO,IAAI,KAAK,KAAK;GACrB,QAAQ,SAAS,0BAA0B,SAAS,QAAQ,QAAQ,MAAM,8BAA8B;GACxG,OAAO;IACL,KAAK,GAAG,SAAS,2BAA2B;IAC5C;IACA,UAAU,2BAA2B,KAAK,QAAQ,QAAQ,CAAC,CAAC,YAAY,MAAA;IACxE,MAAM,KAAK;IACX,WAAW,MAAM;IACjB,cAAc;IACd,cAAc;KACZ,MAAM,UAAU;KAChB,OAAO,OAAO,GAAG;IACnB;GACF;EACF;EAEA,MAAM,MAAM,OAAO,QAAQ;GACzB,IAAK,WAAW,SAAS,WAAW,UAAW,CAAC,cAAc,KAAK,KAAK,GAAG,OAAO,SAAS;GAC3F,MAAM,MAAM,YAAY,KAAK;GAC7B,MAAM,QAAQ,OAAO,IAAI,GAAG;GAC5B,IAAI,UAAU,KAAA,GAAW,OAAO,SAAS;GACzC,IAAI,CAAC,KAAK,KAAK,GAAG;IAChB,OAAO,OAAO,GAAG;IACjB,OAAO,SAAS;GAClB;GAEA,IAAI,WAAW,OAAO;IACpB,MAAM,iBAAiB;IACvB,IAAI,MAAM,kBAAkB,GAAG,OAAO,OAAO,GAAG;GAClD;GACA,MAAM,SAAS,MAAM,WAAW,MAAM,QAAQ;GAC9C,IACE,WAAW,KAAA,KACX,OAAO,KAAK,QAAQ,MAAM,OAC1B,OAAO,KAAK,QAAQ,MAAM,OAC1B,OAAO,KAAK,SAAS,MAAM,QAC3B,OAAO,KAAK,YAAY,MAAM,SAC9B;IACA,MAAM,QAAQ,OAAO,MAAM;IAC3B,OAAO,OAAO,GAAG;IACjB,QAAQ,SAAS,wBAAwB,MAAM,SAAS,gDAAgD;IACxG,OAAO,SAAS;GAClB;GAGA,IAAI,CAAC,WAAW,KAAK,GAAG;IACtB,MAAM,OAAO,OAAO,MAAM;IAC1B,OAAO,OAAO,GAAG;IACjB,OAAO,SAAS;GAClB;GACA,MAAM,UAAU;IACd,gBAAgB;IAChB,kBAAkB,OAAO,MAAM,IAAI;IACnC,uBAAuB,gCAAgC,uBAAuB,MAAM,QAAQ;IAC5F,0BAA0B;IAC1B,2BAA2B;IAC3B,gCAAgC;IAChC,iBAAiB;IACjB,mBAAmB;IACnB,iBAAiB;IACjB,gBAAgB;GAClB;GACA,IAAI,WAAW,UAAU,MAAM,SAAS,GAAG;IACzC,MAAM,OAAO,OAAO,MAAM;IAC1B,OAAO,IAAI,SAAS,WAAW,SAAS,uBAAO,IAAI,WAAW,GAAG,EAAE,QAAQ,CAAC;GAC9E;GAGA,MAAM,OAAO,SAAS,MAAM,OAAO,OAAO,iBAAiB;IAAE,OAAO;IAAG,KAAK,MAAM,OAAO;GAAE,CAAC,CAAC;GAC7F,OAAO,IAAI,SAAS,MAAoC,EAAE,QAAQ,CAAC;EACrE;CACF;AACF"}

package/dist/src/services/remoteAccess/index.d.mts

@@ -2,6 +2,7 @@ import { BundlePairingTrust, DeviceTrustKind, PairingStatus, RemoteAccessSetting
 import { EnrolledDevice } from "../deviceAuth/index.mjs";
 import { PairingFlow } from "../pairingFlow/index.mjs";
 import { StepUpAction, StoredCredential } from "../webauthnPolicy/index.mjs";
+import "../remoteAccessStore/index.mjs";
 import { OriginPolicy } from "../remoteGuardPolicy/index.mjs";
 import { PasskeySupport, WebAuthn } from "../webauthn/index.mjs";
 import { SealedChannel } from "@agimon-ai/po-web-security/node";

package/dist/src/services/remoteAccess/index.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.mts","names":[],"sources":["../../../../src/services/remoteAccess/index.ts"],"mappings":";;;;;;;;iBA+FiB;EACf,MAAM,uBAAuB,2BAA2B;EACxD,YAAY;EACZ,eAAe,OAAO,QAAQ,wBAAwB;EACtD;;EAEA;;EAEA;EACA,gBAAgB;EAChB,UAAU;IAAU;;IAAe;IAAW;;;EAE9C;;EAEA;EACA,WAAW;;EAEX;IACO;IAAc;IAAoB;IAAiB;MAAsB;EAEhF,eAAe;EACf,MAAM;IACJ;IACA;IACA;IACA;MACE,WAAW;EACf,cAAc,oBAAoB;EAClC,QAAQ,oBAAoB,WAAW;EACvC,KAAK,oBAAoB,WAAW;;EAEpC,OAAO,qBAAqB;IAAmB;;EAC/C,UAAU;;EAEV,mBAAmB;;EAEnB,kBAAkB,gBAAgB;IAAmB;;EACrD;IACE,eAAe;IACf,qBAAqB;IACrB,mBAAmB;IACnB,oBAAoB;IACpB,qBAAqB;IACrB,sBAAsB;IACtB,aAAa;IACb,cAAc;IACd,SAAS;;;EAGX,sBACE,yBACA;IACG;IAAU;;IAA8B;IAAW;;;EAExD,gBAAgB;IACd;IACA;;IAEI;IAAU;IAAqB;IAAmB;IAAuB;;IACzE;IAAW;;;EAEjB,iBAAiB,iBAAiB;IAAmB;;EACrD,kBACE,yBACA,QAAQ;IACL;IAAoB;IAAmB;;EAC5C,mBAAmB,yBAAyB,QAAQ,cAAc,qBAAqB;;EAEvF,oBAAoB;EACpB,UAAU,mBAAmB;;;;;EAK7B,eAAe,QAAQ,cAAc;;EAErC;;EAEA,YAAY,kBAAkB,OAAO,oBAAoB;EACzD,WAAW,kBAAkB,OAAO,qBAAqB;EACzD,aAAa;EACb,kBAAkB;;EAElB,YAAY,kBAAkB,QAAQ,cAAc;EACpD,SAAS"}
+{"version":3,"file":"index.d.mts","names":[],"sources":["../../../../src/services/remoteAccess/index.ts"],"mappings":";;;;;;;;;iBA+FiB;EACf,MAAM,uBAAuB,2BAA2B;EACxD,YAAY;EACZ,eAAe,OAAO,QAAQ,wBAAwB;EACtD;;EAEA;;EAEA;EACA,gBAAgB;EAChB,UAAU;IAAU;;IAAe;IAAW;;;EAE9C;;EAEA;EACA,WAAW;;EAEX;IACO;IAAc;IAAoB;IAAiB;MAAsB;EAEhF,eAAe;EACf,MAAM;IACJ;IACA;IACA;IACA;MACE,WAAW;EACf,cAAc,oBAAoB;EAClC,QAAQ,oBAAoB,WAAW;EACvC,KAAK,oBAAoB,WAAW;;EAEpC,OAAO,qBAAqB;IAAmB;;EAC/C,UAAU;;EAEV,mBAAmB;;EAEnB,kBAAkB,gBAAgB;IAAmB;;EACrD;IACE,eAAe;IACf,qBAAqB;IACrB,mBAAmB;IACnB,oBAAoB;IACpB,qBAAqB;IACrB,sBAAsB;IACtB,aAAa;IACb,cAAc;IACd,SAAS;;;EAGX,sBACE,yBACA;IACG;IAAU;;IAA8B;IAAW;;;EAExD,gBAAgB;IACd;IACA;;IAEI;IAAU;IAAqB;IAAmB;IAAuB;;IACzE;IAAW;;;EAEjB,iBAAiB,iBAAiB;IAAmB;;EACrD,kBACE,yBACA,QAAQ;IACL;IAAoB;IAAmB;;EAC5C,mBAAmB,yBAAyB,QAAQ,cAAc,qBAAqB;;EAEvF,oBAAoB;EACpB,UAAU,mBAAmB;;;;;EAK7B,eAAe,QAAQ,cAAc;;EAErC;;EAEA,YAAY,kBAAkB,OAAO,oBAAoB;EACzD,WAAW,kBAAkB,OAAO,qBAAqB;EACzD,aAAa;EACb,kBAAkB;;EAElB,YAAY,kBAAkB,QAAQ,cAAc;EACpD,SAAS"}