@agimon-ai/po-core 0.0.0-alpha.2 → 0.0.0-alpha.21

package/dist/src/services/remoteAccessStore/remoteAccessRecords.mjs

@@ -0,0 +1,88 @@
+import { nodeHost } from "../nodeHost/index.mjs";
+import { poHomeDirectory } from "../piSettings/core.mjs";
+import "../../../runtimePiSettings.mjs";
+import "../../constants/remote.mjs";
+import { DEFAULT_REMOTE_SETTINGS, parseRemoteAccessSettings } from "../remoteAccessSettings/index.mjs";
+import path from "node:path";
+const SETTINGS_FILE = "remote-access.json";
+const CREDENTIALS_FILE = "credentials.json";
+const TRUSTED_DEVICES_FILE = "trusted-devices.json";
+const TRUSTED_DEVICE_PLATFORMS = /* @__PURE__ */ new Set(["ios", "android"]);
+const STORED_ID = /^[A-Za-z0-9_-]{1,64}$/u;
+const STORED_KEY = /^[A-Za-z0-9_-]{1,512}$/u;
+const MAX_STORED_LABEL = 200;
+function defaultRemoteStateDir(homeDir = nodeHost.homeDirectory()) {
+	return path.join(poHomeDirectory(homeDir), "web");
+}
+/** Whether a file mode lets another account read the file. */
+function isLooseMode(mode) {
+	return (mode & 63) !== 0;
+}
+/** Whether one parsed entry is a complete trusted-device record; anything else is dropped. */
+function isTrustedDeviceRecord(value) {
+	if (typeof value !== "object" || value === null || Array.isArray(value)) return false;
+	const record = value;
+	return typeof record.id === "string" && STORED_ID.test(record.id) && typeof record.identityPublicKey === "string" && STORED_KEY.test(record.identityPublicKey) && typeof record.stepUpPublicKey === "string" && STORED_KEY.test(record.stepUpPublicKey) && record.identityPublicKey !== record.stepUpPublicKey && typeof record.label === "string" && record.label.length <= MAX_STORED_LABEL && typeof record.platform === "string" && TRUSTED_DEVICE_PLATFORMS.has(record.platform) && Number.isFinite(record.createdAt) && Number.isFinite(record.lastSeenAt);
+}
+function parseSettingsFile(raw, settingsPath, notice) {
+	let parsed;
+	try {
+		parsed = JSON.parse(raw);
+	} catch {
+		notice(`remote access settings at ${settingsPath} are not valid JSON; using defaults`);
+		return DEFAULT_REMOTE_SETTINGS;
+	}
+	const outcome = parseRemoteAccessSettings(parsed);
+	for (const warning of outcome.warnings) notice(`remote access settings: ${warning}`);
+	return outcome.settings;
+}
+function parseCredentialsFile(raw, credentialsPath, notice) {
+	try {
+		const parsed = JSON.parse(raw);
+		return Array.isArray(parsed) ? parsed : [];
+	} catch {
+		notice(`registered passkeys at ${credentialsPath} are not valid JSON; none will load`);
+		return [];
+	}
+}
+function parseTrustedDevicesFile(raw, trustedDevicesPath, notice) {
+	let parsed;
+	try {
+		parsed = JSON.parse(raw);
+	} catch {
+		notice(`trusted devices at ${trustedDevicesPath} are not valid JSON; none will load`);
+		return [];
+	}
+	if (!Array.isArray(parsed)) {
+		notice(`trusted devices at ${trustedDevicesPath} are not a list; none will load`);
+		return [];
+	}
+	const loaded = [];
+	for (const entry of parsed) {
+		if (!isTrustedDeviceRecord(entry) || loaded.some((held) => held.id === entry.id)) {
+			notice(`dropped an invalid trusted device record from ${trustedDevicesPath}`);
+			continue;
+		}
+		if (loaded.length >= 32) {
+			notice(`dropped trusted devices beyond the limit of ${String(32)} from ${trustedDevicesPath}`);
+			break;
+		}
+		loaded.push({
+			id: entry.id,
+			identityPublicKey: entry.identityPublicKey,
+			stepUpPublicKey: entry.stepUpPublicKey,
+			label: entry.label,
+			platform: entry.platform,
+			createdAt: entry.createdAt,
+			lastSeenAt: entry.lastSeenAt
+		});
+	}
+	return loaded;
+}
+function serializeStateFile(body) {
+	return `${JSON.stringify(body, void 0, 2)}\n`;
+}
+//#endregion
+export { CREDENTIALS_FILE, SETTINGS_FILE, TRUSTED_DEVICES_FILE, defaultRemoteStateDir, isLooseMode, parseCredentialsFile, parseSettingsFile, parseTrustedDevicesFile, serializeStateFile };
+
+//# sourceMappingURL=remoteAccessRecords.mjs.map

package/dist/src/services/remoteAccessStore/remoteAccessRecords.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"remoteAccessRecords.mjs","names":[],"sources":["../../../../src/services/remoteAccessStore/remoteAccessRecords.ts"],"sourcesContent":["import path from 'node:path';\n\nimport { TRUSTED_DEVICE_LIMIT } from '../../constants/remote';\nimport type { RemoteAccessSettings, TrustedDeviceRecord } from '../../types/remote';\nimport { nodeHost } from '../nodeHost';\nimport { poHomeDirectory } from '../piSettings';\nimport { DEFAULT_REMOTE_SETTINGS, parseRemoteAccessSettings } from '../remoteAccessSettings';\nimport type { StoredCredential } from '../webauthnPolicy';\n\n/** Where the cockpit keeps machine-local state; `po sync` already writes its bundle here. */\nexport const STATE_DIRECTORY = 'web';\nexport const SETTINGS_FILE = 'remote-access.json';\nexport const CREDENTIALS_FILE = 'credentials.json';\nexport const TRUSTED_DEVICES_FILE = 'trusted-devices.json';\nconst TRUSTED_DEVICE_PLATFORMS: ReadonlySet<string> = new Set(['ios', 'android']);\nconst STORED_ID = /^[A-Za-z0-9_-]{1,64}$/u;\nconst STORED_KEY = /^[A-Za-z0-9_-]{1,512}$/u;\nconst MAX_STORED_LABEL = 200;\nexport const DIRECTORY_MODE = 0o700;\nexport const FILE_MODE = 0o600;\n/** Any bit set for group or other; a state file readable by another account is worth repairing. */\nexport const LOOSE_MODE_MASK = 0o077;\n\nexport interface RemoteAccessStoreOptions {\n  /** Overridden by --state-dir and by tests; the default is ~/.po/web. */\n  stateDir?: string;\n  onNotice?: (message: string) => void;\n}\n\nexport interface RemoteAccessStore {\n  readonly directory: string;\n  settings(): RemoteAccessSettings;\n  save(settings: RemoteAccessSettings): void;\n  /**\n   * Registered passkeys. Public keys only, so the file is not a bearer secret\n   * and losing it costs a re-enrolment rather than an account.\n   */\n  credentials(): readonly StoredCredential[];\n  saveCredential(credential: StoredCredential): void;\n  removeCredential(id: string): boolean;\n  /** Registered native devices. Public keys only, at most `TRUSTED_DEVICE_LIMIT`. */\n  trustedDevices(): readonly TrustedDeviceRecord[];\n  /** Adds or replaces one record by id. False when a new record would exceed the limit. */\n  saveTrustedDevice(record: TrustedDeviceRecord): boolean;\n  removeTrustedDevice(id: string): boolean;\n}\n\nexport function defaultRemoteStateDir(homeDir: string = nodeHost.homeDirectory()): string {\n  return path.join(poHomeDirectory(homeDir), STATE_DIRECTORY);\n}\n\n/** Whether a file mode lets another account read the file. */\nexport function isLooseMode(mode: number): boolean {\n  return (mode & LOOSE_MODE_MASK) !== 0;\n}\n\n/** Whether one parsed entry is a complete trusted-device record; anything else is dropped. */\nfunction isTrustedDeviceRecord(value: unknown): value is TrustedDeviceRecord {\n  if (typeof value !== 'object' || value === null || Array.isArray(value)) return false;\n  const record = value as Record<string, unknown>;\n  return (\n    typeof record.id === 'string' &&\n    STORED_ID.test(record.id) &&\n    typeof record.identityPublicKey === 'string' &&\n    STORED_KEY.test(record.identityPublicKey) &&\n    typeof record.stepUpPublicKey === 'string' &&\n    STORED_KEY.test(record.stepUpPublicKey) &&\n    record.identityPublicKey !== record.stepUpPublicKey &&\n    typeof record.label === 'string' &&\n    record.label.length <= MAX_STORED_LABEL &&\n    typeof record.platform === 'string' &&\n    TRUSTED_DEVICE_PLATFORMS.has(record.platform) &&\n    Number.isFinite(record.createdAt) &&\n    Number.isFinite(record.lastSeenAt)\n  );\n}\n\nexport function parseSettingsFile(\n  raw: string,\n  settingsPath: string,\n  notice: (message: string) => void,\n): RemoteAccessSettings {\n  let parsed: unknown;\n  try {\n    parsed = JSON.parse(raw);\n  } catch {\n    // Left in place rather than rewritten: silently overwriting a file\n    // somebody hand-edited is worse than ignoring it for this run.\n    notice(`remote access settings at ${settingsPath} are not valid JSON; using defaults`);\n    return DEFAULT_REMOTE_SETTINGS;\n  }\n  const outcome = parseRemoteAccessSettings(parsed);\n  for (const warning of outcome.warnings) notice(`remote access settings: ${warning}`);\n  return outcome.settings;\n}\n\nexport function parseCredentialsFile(\n  raw: string,\n  credentialsPath: string,\n  notice: (message: string) => void,\n): StoredCredential[] {\n  try {\n    const parsed: unknown = JSON.parse(raw);\n    return Array.isArray(parsed) ? (parsed as StoredCredential[]) : [];\n  } catch {\n    // Fails closed: a half-readable credential file means enrolling again,\n    // not guessing which entries survived.\n    notice(`registered passkeys at ${credentialsPath} are not valid JSON; none will load`);\n    return [];\n  }\n}\n\nexport function parseTrustedDevicesFile(\n  raw: string,\n  trustedDevicesPath: string,\n  notice: (message: string) => void,\n): TrustedDeviceRecord[] {\n  let parsed: unknown;\n  try {\n    parsed = JSON.parse(raw);\n  } catch {\n    // Fails closed like passkeys: a device signs in only from a record read whole.\n    notice(`trusted devices at ${trustedDevicesPath} are not valid JSON; none will load`);\n    return [];\n  }\n  if (!Array.isArray(parsed)) {\n    notice(`trusted devices at ${trustedDevicesPath} are not a list; none will load`);\n    return [];\n  }\n  const loaded: TrustedDeviceRecord[] = [];\n  for (const entry of parsed) {\n    if (!isTrustedDeviceRecord(entry) || loaded.some((held) => held.id === entry.id)) {\n      notice(`dropped an invalid trusted device record from ${trustedDevicesPath}`);\n      continue;\n    }\n    if (loaded.length >= TRUSTED_DEVICE_LIMIT) {\n      notice(`dropped trusted devices beyond the limit of ${String(TRUSTED_DEVICE_LIMIT)} from ${trustedDevicesPath}`);\n      break;\n    }\n    loaded.push({\n      id: entry.id,\n      identityPublicKey: entry.identityPublicKey,\n      stepUpPublicKey: entry.stepUpPublicKey,\n      label: entry.label,\n      platform: entry.platform,\n      createdAt: entry.createdAt,\n      lastSeenAt: entry.lastSeenAt,\n    });\n  }\n  return loaded;\n}\n\nexport function serializeStateFile(body: unknown): string {\n  return `${JSON.stringify(body, undefined, 2)}\\n`;\n}\n"],"mappings":";;;;;;AAWA,MAAa,gBAAgB;AAC7B,MAAa,mBAAmB;AAChC,MAAa,uBAAuB;AACpC,MAAM,2CAAgD,IAAI,IAAI,CAAC,OAAO,SAAS,CAAC;AAChF,MAAM,YAAY;AAClB,MAAM,aAAa;AACnB,MAAM,mBAAmB;AA8BzB,SAAgB,sBAAsB,UAAkB,SAAS,cAAc,GAAW;CACxF,OAAO,KAAK,KAAK,gBAAgB,OAAO,GAAA,KAAkB;AAC5D;;AAGA,SAAgB,YAAY,MAAuB;CACjD,QAAQ,OAAA,QAA4B;AACtC;;AAGA,SAAS,sBAAsB,OAA8C;CAC3E,IAAI,OAAO,UAAU,YAAY,UAAU,QAAQ,MAAM,QAAQ,KAAK,GAAG,OAAO;CAChF,MAAM,SAAS;CACf,OACE,OAAO,OAAO,OAAO,YACrB,UAAU,KAAK,OAAO,EAAE,KACxB,OAAO,OAAO,sBAAsB,YACpC,WAAW,KAAK,OAAO,iBAAiB,KACxC,OAAO,OAAO,oBAAoB,YAClC,WAAW,KAAK,OAAO,eAAe,KACtC,OAAO,sBAAsB,OAAO,mBACpC,OAAO,OAAO,UAAU,YACxB,OAAO,MAAM,UAAU,oBACvB,OAAO,OAAO,aAAa,YAC3B,yBAAyB,IAAI,OAAO,QAAQ,KAC5C,OAAO,SAAS,OAAO,SAAS,KAChC,OAAO,SAAS,OAAO,UAAU;AAErC;AAEA,SAAgB,kBACd,KACA,cACA,QACsB;CACtB,IAAI;CACJ,IAAI;EACF,SAAS,KAAK,MAAM,GAAG;CACzB,QAAQ;EAGN,OAAO,6BAA6B,aAAa,oCAAoC;EACrF,OAAO;CACT;CACA,MAAM,UAAU,0BAA0B,MAAM;CAChD,KAAK,MAAM,WAAW,QAAQ,UAAU,OAAO,2BAA2B,SAAS;CACnF,OAAO,QAAQ;AACjB;AAEA,SAAgB,qBACd,KACA,iBACA,QACoB;CACpB,IAAI;EACF,MAAM,SAAkB,KAAK,MAAM,GAAG;EACtC,OAAO,MAAM,QAAQ,MAAM,IAAK,SAAgC,CAAC;CACnE,QAAQ;EAGN,OAAO,0BAA0B,gBAAgB,oCAAoC;EACrF,OAAO,CAAC;CACV;AACF;AAEA,SAAgB,wBACd,KACA,oBACA,QACuB;CACvB,IAAI;CACJ,IAAI;EACF,SAAS,KAAK,MAAM,GAAG;CACzB,QAAQ;EAEN,OAAO,sBAAsB,mBAAmB,oCAAoC;EACpF,OAAO,CAAC;CACV;CACA,IAAI,CAAC,MAAM,QAAQ,MAAM,GAAG;EAC1B,OAAO,sBAAsB,mBAAmB,gCAAgC;EAChF,OAAO,CAAC;CACV;CACA,MAAM,SAAgC,CAAC;CACvC,KAAK,MAAM,SAAS,QAAQ;EAC1B,IAAI,CAAC,sBAAsB,KAAK,KAAK,OAAO,MAAM,SAAS,KAAK,OAAO,MAAM,EAAE,GAAG;GAChF,OAAO,iDAAiD,oBAAoB;GAC5E;EACF;EACA,IAAI,OAAO,UAAA,IAAgC;GACzC,OAAO,+CAA+C,OAAA,EAA2B,EAAE,QAAQ,oBAAoB;GAC/G;EACF;EACA,OAAO,KAAK;GACV,IAAI,MAAM;GACV,mBAAmB,MAAM;GACzB,iBAAiB,MAAM;GACvB,OAAO,MAAM;GACb,UAAU,MAAM;GAChB,WAAW,MAAM;GACjB,YAAY,MAAM;EACpB,CAAC;CACH;CACA,OAAO;AACT;AAEA,SAAgB,mBAAmB,MAAuB;CACxD,OAAO,GAAG,KAAK,UAAU,MAAM,KAAA,GAAW,CAAC,EAAE;AAC/C"}

package/dist/src/services/remoteAccessStore/sync.cjs

@@ -0,0 +1,111 @@
+const require_runtime = require("../../../_virtual/_rolldown/runtime.cjs");
+require("../../constants/remote.cjs");
+const require_index = require("../remoteAccessSettings/index.cjs");
+const require_remoteAccessRecords = require("./remoteAccessRecords.cjs");
+let node_fs = require("node:fs");
+node_fs = require_runtime.__toESM(node_fs, 1);
+let node_path = require("node:path");
+node_path = require_runtime.__toESM(node_path, 1);
+//#region src/services/remoteAccessStore/sync.ts
+/**
+* Repairs a state file another account can read.
+*
+* Cheap, and it catches the cases a fresh write never would: a file restored
+* from a backup, copied with a permissive umask, or checked out of somewhere it
+* should not have been.
+*/
+function tightenMode(filePath, notice) {
+	try {
+		if (!require_remoteAccessRecords.isLooseMode(node_fs.default.statSync(filePath).mode)) return;
+		node_fs.default.chmodSync(filePath, 384);
+		notice(`tightened permissions on ${filePath}`);
+	} catch {}
+}
+function readState(filePath, notice) {
+	let raw;
+	try {
+		raw = node_fs.default.readFileSync(filePath, "utf8");
+	} catch {
+		return;
+	}
+	tightenMode(filePath, notice);
+	return raw;
+}
+/**
+* Settings and passkeys on disk. Sessions deliberately not.
+*
+* A session is revoked when remote access is switched off, and a hub restart is
+* a switch-off, so persisting one would buy nothing while creating a bearer
+* secret worth stealing. A passkey is the opposite: surviving is its whole
+* point, and what is stored is a public key.
+*
+* @deprecated Node-only sync shim; use createRemoteAccessStoreAsync. Removed in M2.
+*/
+function createRemoteAccessStore(options = {}) {
+	const directory = options.stateDir ?? require_remoteAccessRecords.defaultRemoteStateDir();
+	const notice = options.onNotice ?? (() => {});
+	const settingsPath = node_path.default.join(directory, require_remoteAccessRecords.SETTINGS_FILE);
+	const credentialsPath = node_path.default.join(directory, require_remoteAccessRecords.CREDENTIALS_FILE);
+	const trustedDevicesPath = node_path.default.join(directory, require_remoteAccessRecords.TRUSTED_DEVICES_FILE);
+	const settingsRaw = readState(settingsPath, notice);
+	let current = settingsRaw === void 0 ? require_index.DEFAULT_REMOTE_SETTINGS : require_remoteAccessRecords.parseSettingsFile(settingsRaw, settingsPath, notice);
+	const credentialsRaw = readState(credentialsPath, notice);
+	let registered = credentialsRaw === void 0 ? [] : require_remoteAccessRecords.parseCredentialsFile(credentialsRaw, credentialsPath, notice);
+	const devicesRaw = readState(trustedDevicesPath, notice);
+	let trusted = devicesRaw === void 0 ? [] : require_remoteAccessRecords.parseTrustedDevicesFile(devicesRaw, trustedDevicesPath, notice);
+	function writeJson(target, body) {
+		const temporary = `${target}.${String(process.pid)}.tmp`;
+		try {
+			node_fs.default.mkdirSync(directory, {
+				recursive: true,
+				mode: 448
+			});
+			node_fs.default.writeFileSync(temporary, require_remoteAccessRecords.serializeStateFile(body), { mode: 384 });
+			node_fs.default.renameSync(temporary, target);
+		} catch (error) {
+			notice(`${target} could not be saved: ${error instanceof Error ? error.message : String(error)}`);
+			try {
+				node_fs.default.rmSync(temporary, { force: true });
+			} catch {}
+		}
+	}
+	return {
+		directory,
+		settings: () => current,
+		credentials: () => registered,
+		saveCredential(credential) {
+			registered = [...registered.filter((held) => held.id !== credential.id), credential];
+			writeJson(credentialsPath, registered);
+		},
+		removeCredential(id) {
+			const next = registered.filter((held) => held.id !== id);
+			if (next.length === registered.length) return false;
+			registered = next;
+			writeJson(credentialsPath, registered);
+			return true;
+		},
+		trustedDevices: () => trusted,
+		saveTrustedDevice(record) {
+			const others = trusted.filter((held) => held.id !== record.id);
+			if (others.length === trusted.length && trusted.length >= 32) return false;
+			trusted = [...others, record];
+			writeJson(trustedDevicesPath, trusted);
+			return true;
+		},
+		removeTrustedDevice(id) {
+			const next = trusted.filter((held) => held.id !== id);
+			if (next.length === trusted.length) return false;
+			trusted = next;
+			writeJson(trustedDevicesPath, trusted);
+			return true;
+		},
+		save(settings) {
+			current = settings;
+			writeJson(settingsPath, require_index.serializeRemoteAccessSettings(settings));
+		}
+	};
+}
+//#endregion
+exports.createRemoteAccessStore = createRemoteAccessStore;
+
+//# sourceMappingURL=sync.cjs.map

package/dist/src/services/remoteAccessStore/sync.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"sync.cjs","names":["isLooseMode","fs","defaultRemoteStateDir","path","SETTINGS_FILE","CREDENTIALS_FILE","TRUSTED_DEVICES_FILE","DEFAULT_REMOTE_SETTINGS","parseSettingsFile","parseCredentialsFile","parseTrustedDevicesFile","serializeStateFile","serializeRemoteAccessSettings"],"sources":["../../../../src/services/remoteAccessStore/sync.ts"],"sourcesContent":["import fs from 'node:fs';\nimport path from 'node:path';\n\nimport { TRUSTED_DEVICE_LIMIT } from '../../constants/remote';\nimport type { RemoteAccessSettings } from '../../types/remote';\nimport { DEFAULT_REMOTE_SETTINGS, serializeRemoteAccessSettings } from '../remoteAccessSettings';\nimport {\n  CREDENTIALS_FILE,\n  defaultRemoteStateDir,\n  DIRECTORY_MODE,\n  FILE_MODE,\n  isLooseMode,\n  parseCredentialsFile,\n  parseSettingsFile,\n  parseTrustedDevicesFile,\n  serializeStateFile,\n  SETTINGS_FILE,\n  TRUSTED_DEVICES_FILE,\n  type RemoteAccessStore,\n  type RemoteAccessStoreOptions,\n} from './remoteAccessRecords';\n\n/**\n * Repairs a state file another account can read.\n *\n * Cheap, and it catches the cases a fresh write never would: a file restored\n * from a backup, copied with a permissive umask, or checked out of somewhere it\n * should not have been.\n */\nfunction tightenMode(filePath: string, notice: (message: string) => void): void {\n  try {\n    if (!isLooseMode(fs.statSync(filePath).mode)) return;\n    fs.chmodSync(filePath, FILE_MODE);\n    notice(`tightened permissions on ${filePath}`);\n  } catch {\n    // The file is missing or unreadable; the caller's own read reports that.\n  }\n}\n\nfunction readState(filePath: string, notice: (message: string) => void): string | undefined {\n  let raw: string;\n  try {\n    raw = fs.readFileSync(filePath, 'utf8');\n  } catch {\n    // No file is the normal first run, so this is not worth a notice.\n    return undefined;\n  }\n  tightenMode(filePath, notice);\n  return raw;\n}\n\n/**\n * Settings and passkeys on disk. Sessions deliberately not.\n *\n * A session is revoked when remote access is switched off, and a hub restart is\n * a switch-off, so persisting one would buy nothing while creating a bearer\n * secret worth stealing. A passkey is the opposite: surviving is its whole\n * point, and what is stored is a public key.\n *\n * @deprecated Node-only sync shim; use createRemoteAccessStoreAsync. Removed in M2.\n */\nexport function createRemoteAccessStore(options: RemoteAccessStoreOptions = {}): RemoteAccessStore {\n  const directory = options.stateDir ?? defaultRemoteStateDir();\n  const notice = options.onNotice ?? ((): void => {});\n  const settingsPath = path.join(directory, SETTINGS_FILE);\n  const credentialsPath = path.join(directory, CREDENTIALS_FILE);\n  const trustedDevicesPath = path.join(directory, TRUSTED_DEVICES_FILE);\n\n  const settingsRaw = readState(settingsPath, notice);\n  let current: RemoteAccessSettings =\n    settingsRaw === undefined ? DEFAULT_REMOTE_SETTINGS : parseSettingsFile(settingsRaw, settingsPath, notice);\n  const credentialsRaw = readState(credentialsPath, notice);\n  let registered = credentialsRaw === undefined ? [] : parseCredentialsFile(credentialsRaw, credentialsPath, notice);\n  const devicesRaw = readState(trustedDevicesPath, notice);\n  let trusted = devicesRaw === undefined ? [] : parseTrustedDevicesFile(devicesRaw, trustedDevicesPath, notice);\n\n  function writeJson(target: string, body: unknown): void {\n    const temporary = `${target}.${String(process.pid)}.tmp`;\n    try {\n      fs.mkdirSync(directory, { recursive: true, mode: DIRECTORY_MODE });\n      fs.writeFileSync(temporary, serializeStateFile(body), { mode: FILE_MODE });\n      // Rename rather than write in place, so a crash mid-write leaves the\n      // previous contents rather than a truncated file.\n      fs.renameSync(temporary, target);\n    } catch (error) {\n      notice(`${target} could not be saved: ${error instanceof Error ? error.message : String(error)}`);\n      try {\n        fs.rmSync(temporary, { force: true });\n      } catch {\n        // Nothing further to do; the temp file is inert either way.\n      }\n    }\n  }\n\n  return {\n    directory,\n    settings: () => current,\n    credentials: () => registered,\n\n    saveCredential(credential) {\n      registered = [...registered.filter((held) => held.id !== credential.id), credential];\n      writeJson(credentialsPath, registered);\n    },\n\n    removeCredential(id) {\n      const next = registered.filter((held) => held.id !== id);\n      if (next.length === registered.length) return false;\n      registered = next;\n      writeJson(credentialsPath, registered);\n      return true;\n    },\n\n    trustedDevices: () => trusted,\n\n    saveTrustedDevice(record) {\n      const others = trusted.filter((held) => held.id !== record.id);\n      if (others.length === trusted.length && trusted.length >= TRUSTED_DEVICE_LIMIT) return false;\n      trusted = [...others, record];\n      writeJson(trustedDevicesPath, trusted);\n      return true;\n    },\n\n    removeTrustedDevice(id) {\n      const next = trusted.filter((held) => held.id !== id);\n      if (next.length === trusted.length) return false;\n      trusted = next;\n      writeJson(trustedDevicesPath, trusted);\n      return true;\n    },\n\n    save(settings) {\n      current = settings;\n      writeJson(settingsPath, serializeRemoteAccessSettings(settings));\n    },\n  };\n}\n"],"mappings":";;;;;;;;;;;;;;;;AA6BA,SAAS,YAAY,UAAkB,QAAyC;CAC9E,IAAI;EACF,IAAI,CAACA,4BAAAA,YAAYC,QAAAA,QAAG,SAAS,QAAQ,CAAC,CAAC,IAAI,GAAG;EAC9C,QAAA,QAAG,UAAU,UAAA,GAAmB;EAChC,OAAO,4BAA4B,UAAU;CAC/C,QAAQ,CAER;AACF;AAEA,SAAS,UAAU,UAAkB,QAAuD;CAC1F,IAAI;CACJ,IAAI;EACF,MAAMA,QAAAA,QAAG,aAAa,UAAU,MAAM;CACxC,QAAQ;EAEN;CACF;CACA,YAAY,UAAU,MAAM;CAC5B,OAAO;AACT;;;;;;;;;;;AAYA,SAAgB,wBAAwB,UAAoC,CAAC,GAAsB;CACjG,MAAM,YAAY,QAAQ,YAAYC,4BAAAA,sBAAsB;CAC5D,MAAM,SAAS,QAAQ,mBAAyB,CAAC;CACjD,MAAM,eAAeC,UAAAA,QAAK,KAAK,WAAWC,4BAAAA,aAAa;CACvD,MAAM,kBAAkBD,UAAAA,QAAK,KAAK,WAAWE,4BAAAA,gBAAgB;CAC7D,MAAM,qBAAqBF,UAAAA,QAAK,KAAK,WAAWG,4BAAAA,oBAAoB;CAEpE,MAAM,cAAc,UAAU,cAAc,MAAM;CAClD,IAAI,UACF,gBAAgB,KAAA,IAAYC,cAAAA,0BAA0BC,4BAAAA,kBAAkB,aAAa,cAAc,MAAM;CAC3G,MAAM,iBAAiB,UAAU,iBAAiB,MAAM;CACxD,IAAI,aAAa,mBAAmB,KAAA,IAAY,CAAC,IAAIC,4BAAAA,qBAAqB,gBAAgB,iBAAiB,MAAM;CACjH,MAAM,aAAa,UAAU,oBAAoB,MAAM;CACvD,IAAI,UAAU,eAAe,KAAA,IAAY,CAAC,IAAIC,4BAAAA,wBAAwB,YAAY,oBAAoB,MAAM;CAE5G,SAAS,UAAU,QAAgB,MAAqB;EACtD,MAAM,YAAY,GAAG,OAAO,GAAG,OAAO,QAAQ,GAAG,EAAE;EACnD,IAAI;GACF,QAAA,QAAG,UAAU,WAAW;IAAE,WAAW;IAAM,MAAA;GAAqB,CAAC;GACjE,QAAA,QAAG,cAAc,WAAWC,4BAAAA,mBAAmB,IAAI,GAAG,EAAE,MAAA,IAAgB,CAAC;GAGzE,QAAA,QAAG,WAAW,WAAW,MAAM;EACjC,SAAS,OAAO;GACd,OAAO,GAAG,OAAO,uBAAuB,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,GAAG;GAChG,IAAI;IACF,QAAA,QAAG,OAAO,WAAW,EAAE,OAAO,KAAK,CAAC;GACtC,QAAQ,CAER;EACF;CACF;CAEA,OAAO;EACL;EACA,gBAAgB;EAChB,mBAAmB;EAEnB,eAAe,YAAY;GACzB,aAAa,CAAC,GAAG,WAAW,QAAQ,SAAS,KAAK,OAAO,WAAW,EAAE,GAAG,UAAU;GACnF,UAAU,iBAAiB,UAAU;EACvC;EAEA,iBAAiB,IAAI;GACnB,MAAM,OAAO,WAAW,QAAQ,SAAS,KAAK,OAAO,EAAE;GACvD,IAAI,KAAK,WAAW,WAAW,QAAQ,OAAO;GAC9C,aAAa;GACb,UAAU,iBAAiB,UAAU;GACrC,OAAO;EACT;EAEA,sBAAsB;EAEtB,kBAAkB,QAAQ;GACxB,MAAM,SAAS,QAAQ,QAAQ,SAAS,KAAK,OAAO,OAAO,EAAE;GAC7D,IAAI,OAAO,WAAW,QAAQ,UAAU,QAAQ,UAAA,IAAgC,OAAO;GACvF,UAAU,CAAC,GAAG,QAAQ,MAAM;GAC5B,UAAU,oBAAoB,OAAO;GACrC,OAAO;EACT;EAEA,oBAAoB,IAAI;GACtB,MAAM,OAAO,QAAQ,QAAQ,SAAS,KAAK,OAAO,EAAE;GACpD,IAAI,KAAK,WAAW,QAAQ,QAAQ,OAAO;GAC3C,UAAU;GACV,UAAU,oBAAoB,OAAO;GACrC,OAAO;EACT;EAEA,KAAK,UAAU;GACb,UAAU;GACV,UAAU,cAAcC,cAAAA,8BAA8B,QAAQ,CAAC;EACjE;CACF;AACF"}

package/dist/src/services/remoteAccessStore/sync.mjs

@@ -0,0 +1,108 @@
+import "../../constants/remote.mjs";
+import { DEFAULT_REMOTE_SETTINGS, serializeRemoteAccessSettings } from "../remoteAccessSettings/index.mjs";
+import { CREDENTIALS_FILE, SETTINGS_FILE, TRUSTED_DEVICES_FILE, defaultRemoteStateDir, isLooseMode, parseCredentialsFile, parseSettingsFile, parseTrustedDevicesFile, serializeStateFile } from "./remoteAccessRecords.mjs";
+import fs from "node:fs";
+import path from "node:path";
+//#region src/services/remoteAccessStore/sync.ts
+/**
+* Repairs a state file another account can read.
+*
+* Cheap, and it catches the cases a fresh write never would: a file restored
+* from a backup, copied with a permissive umask, or checked out of somewhere it
+* should not have been.
+*/
+function tightenMode(filePath, notice) {
+	try {
+		if (!isLooseMode(fs.statSync(filePath).mode)) return;
+		fs.chmodSync(filePath, 384);
+		notice(`tightened permissions on ${filePath}`);
+	} catch {}
+}
+function readState(filePath, notice) {
+	let raw;
+	try {
+		raw = fs.readFileSync(filePath, "utf8");
+	} catch {
+		return;
+	}
+	tightenMode(filePath, notice);
+	return raw;
+}
+/**
+* Settings and passkeys on disk. Sessions deliberately not.
+*
+* A session is revoked when remote access is switched off, and a hub restart is
+* a switch-off, so persisting one would buy nothing while creating a bearer
+* secret worth stealing. A passkey is the opposite: surviving is its whole
+* point, and what is stored is a public key.
+*
+* @deprecated Node-only sync shim; use createRemoteAccessStoreAsync. Removed in M2.
+*/
+function createRemoteAccessStore(options = {}) {
+	const directory = options.stateDir ?? defaultRemoteStateDir();
+	const notice = options.onNotice ?? (() => {});
+	const settingsPath = path.join(directory, SETTINGS_FILE);
+	const credentialsPath = path.join(directory, CREDENTIALS_FILE);
+	const trustedDevicesPath = path.join(directory, TRUSTED_DEVICES_FILE);
+	const settingsRaw = readState(settingsPath, notice);
+	let current = settingsRaw === void 0 ? DEFAULT_REMOTE_SETTINGS : parseSettingsFile(settingsRaw, settingsPath, notice);
+	const credentialsRaw = readState(credentialsPath, notice);
+	let registered = credentialsRaw === void 0 ? [] : parseCredentialsFile(credentialsRaw, credentialsPath, notice);
+	const devicesRaw = readState(trustedDevicesPath, notice);
+	let trusted = devicesRaw === void 0 ? [] : parseTrustedDevicesFile(devicesRaw, trustedDevicesPath, notice);
+	function writeJson(target, body) {
+		const temporary = `${target}.${String(process.pid)}.tmp`;
+		try {
+			fs.mkdirSync(directory, {
+				recursive: true,
+				mode: 448
+			});
+			fs.writeFileSync(temporary, serializeStateFile(body), { mode: 384 });
+			fs.renameSync(temporary, target);
+		} catch (error) {
+			notice(`${target} could not be saved: ${error instanceof Error ? error.message : String(error)}`);
+			try {
+				fs.rmSync(temporary, { force: true });
+			} catch {}
+		}
+	}
+	return {
+		directory,
+		settings: () => current,
+		credentials: () => registered,
+		saveCredential(credential) {
+			registered = [...registered.filter((held) => held.id !== credential.id), credential];
+			writeJson(credentialsPath, registered);
+		},
+		removeCredential(id) {
+			const next = registered.filter((held) => held.id !== id);
+			if (next.length === registered.length) return false;
+			registered = next;
+			writeJson(credentialsPath, registered);
+			return true;
+		},
+		trustedDevices: () => trusted,
+		saveTrustedDevice(record) {
+			const others = trusted.filter((held) => held.id !== record.id);
+			if (others.length === trusted.length && trusted.length >= 32) return false;
+			trusted = [...others, record];
+			writeJson(trustedDevicesPath, trusted);
+			return true;
+		},
+		removeTrustedDevice(id) {
+			const next = trusted.filter((held) => held.id !== id);
+			if (next.length === trusted.length) return false;
+			trusted = next;
+			writeJson(trustedDevicesPath, trusted);
+			return true;
+		},
+		save(settings) {
+			current = settings;
+			writeJson(settingsPath, serializeRemoteAccessSettings(settings));
+		}
+	};
+}
+//#endregion
+export { createRemoteAccessStore };
+
+//# sourceMappingURL=sync.mjs.map

package/dist/src/services/remoteAccessStore/sync.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"sync.mjs","names":[],"sources":["../../../../src/services/remoteAccessStore/sync.ts"],"sourcesContent":["import fs from 'node:fs';\nimport path from 'node:path';\n\nimport { TRUSTED_DEVICE_LIMIT } from '../../constants/remote';\nimport type { RemoteAccessSettings } from '../../types/remote';\nimport { DEFAULT_REMOTE_SETTINGS, serializeRemoteAccessSettings } from '../remoteAccessSettings';\nimport {\n  CREDENTIALS_FILE,\n  defaultRemoteStateDir,\n  DIRECTORY_MODE,\n  FILE_MODE,\n  isLooseMode,\n  parseCredentialsFile,\n  parseSettingsFile,\n  parseTrustedDevicesFile,\n  serializeStateFile,\n  SETTINGS_FILE,\n  TRUSTED_DEVICES_FILE,\n  type RemoteAccessStore,\n  type RemoteAccessStoreOptions,\n} from './remoteAccessRecords';\n\n/**\n * Repairs a state file another account can read.\n *\n * Cheap, and it catches the cases a fresh write never would: a file restored\n * from a backup, copied with a permissive umask, or checked out of somewhere it\n * should not have been.\n */\nfunction tightenMode(filePath: string, notice: (message: string) => void): void {\n  try {\n    if (!isLooseMode(fs.statSync(filePath).mode)) return;\n    fs.chmodSync(filePath, FILE_MODE);\n    notice(`tightened permissions on ${filePath}`);\n  } catch {\n    // The file is missing or unreadable; the caller's own read reports that.\n  }\n}\n\nfunction readState(filePath: string, notice: (message: string) => void): string | undefined {\n  let raw: string;\n  try {\n    raw = fs.readFileSync(filePath, 'utf8');\n  } catch {\n    // No file is the normal first run, so this is not worth a notice.\n    return undefined;\n  }\n  tightenMode(filePath, notice);\n  return raw;\n}\n\n/**\n * Settings and passkeys on disk. Sessions deliberately not.\n *\n * A session is revoked when remote access is switched off, and a hub restart is\n * a switch-off, so persisting one would buy nothing while creating a bearer\n * secret worth stealing. A passkey is the opposite: surviving is its whole\n * point, and what is stored is a public key.\n *\n * @deprecated Node-only sync shim; use createRemoteAccessStoreAsync. Removed in M2.\n */\nexport function createRemoteAccessStore(options: RemoteAccessStoreOptions = {}): RemoteAccessStore {\n  const directory = options.stateDir ?? defaultRemoteStateDir();\n  const notice = options.onNotice ?? ((): void => {});\n  const settingsPath = path.join(directory, SETTINGS_FILE);\n  const credentialsPath = path.join(directory, CREDENTIALS_FILE);\n  const trustedDevicesPath = path.join(directory, TRUSTED_DEVICES_FILE);\n\n  const settingsRaw = readState(settingsPath, notice);\n  let current: RemoteAccessSettings =\n    settingsRaw === undefined ? DEFAULT_REMOTE_SETTINGS : parseSettingsFile(settingsRaw, settingsPath, notice);\n  const credentialsRaw = readState(credentialsPath, notice);\n  let registered = credentialsRaw === undefined ? [] : parseCredentialsFile(credentialsRaw, credentialsPath, notice);\n  const devicesRaw = readState(trustedDevicesPath, notice);\n  let trusted = devicesRaw === undefined ? [] : parseTrustedDevicesFile(devicesRaw, trustedDevicesPath, notice);\n\n  function writeJson(target: string, body: unknown): void {\n    const temporary = `${target}.${String(process.pid)}.tmp`;\n    try {\n      fs.mkdirSync(directory, { recursive: true, mode: DIRECTORY_MODE });\n      fs.writeFileSync(temporary, serializeStateFile(body), { mode: FILE_MODE });\n      // Rename rather than write in place, so a crash mid-write leaves the\n      // previous contents rather than a truncated file.\n      fs.renameSync(temporary, target);\n    } catch (error) {\n      notice(`${target} could not be saved: ${error instanceof Error ? error.message : String(error)}`);\n      try {\n        fs.rmSync(temporary, { force: true });\n      } catch {\n        // Nothing further to do; the temp file is inert either way.\n      }\n    }\n  }\n\n  return {\n    directory,\n    settings: () => current,\n    credentials: () => registered,\n\n    saveCredential(credential) {\n      registered = [...registered.filter((held) => held.id !== credential.id), credential];\n      writeJson(credentialsPath, registered);\n    },\n\n    removeCredential(id) {\n      const next = registered.filter((held) => held.id !== id);\n      if (next.length === registered.length) return false;\n      registered = next;\n      writeJson(credentialsPath, registered);\n      return true;\n    },\n\n    trustedDevices: () => trusted,\n\n    saveTrustedDevice(record) {\n      const others = trusted.filter((held) => held.id !== record.id);\n      if (others.length === trusted.length && trusted.length >= TRUSTED_DEVICE_LIMIT) return false;\n      trusted = [...others, record];\n      writeJson(trustedDevicesPath, trusted);\n      return true;\n    },\n\n    removeTrustedDevice(id) {\n      const next = trusted.filter((held) => held.id !== id);\n      if (next.length === trusted.length) return false;\n      trusted = next;\n      writeJson(trustedDevicesPath, trusted);\n      return true;\n    },\n\n    save(settings) {\n      current = settings;\n      writeJson(settingsPath, serializeRemoteAccessSettings(settings));\n    },\n  };\n}\n"],"mappings":";;;;;;;;;;;;;AA6BA,SAAS,YAAY,UAAkB,QAAyC;CAC9E,IAAI;EACF,IAAI,CAAC,YAAY,GAAG,SAAS,QAAQ,CAAC,CAAC,IAAI,GAAG;EAC9C,GAAG,UAAU,UAAA,GAAmB;EAChC,OAAO,4BAA4B,UAAU;CAC/C,QAAQ,CAER;AACF;AAEA,SAAS,UAAU,UAAkB,QAAuD;CAC1F,IAAI;CACJ,IAAI;EACF,MAAM,GAAG,aAAa,UAAU,MAAM;CACxC,QAAQ;EAEN;CACF;CACA,YAAY,UAAU,MAAM;CAC5B,OAAO;AACT;;;;;;;;;;;AAYA,SAAgB,wBAAwB,UAAoC,CAAC,GAAsB;CACjG,MAAM,YAAY,QAAQ,YAAY,sBAAsB;CAC5D,MAAM,SAAS,QAAQ,mBAAyB,CAAC;CACjD,MAAM,eAAe,KAAK,KAAK,WAAW,aAAa;CACvD,MAAM,kBAAkB,KAAK,KAAK,WAAW,gBAAgB;CAC7D,MAAM,qBAAqB,KAAK,KAAK,WAAW,oBAAoB;CAEpE,MAAM,cAAc,UAAU,cAAc,MAAM;CAClD,IAAI,UACF,gBAAgB,KAAA,IAAY,0BAA0B,kBAAkB,aAAa,cAAc,MAAM;CAC3G,MAAM,iBAAiB,UAAU,iBAAiB,MAAM;CACxD,IAAI,aAAa,mBAAmB,KAAA,IAAY,CAAC,IAAI,qBAAqB,gBAAgB,iBAAiB,MAAM;CACjH,MAAM,aAAa,UAAU,oBAAoB,MAAM;CACvD,IAAI,UAAU,eAAe,KAAA,IAAY,CAAC,IAAI,wBAAwB,YAAY,oBAAoB,MAAM;CAE5G,SAAS,UAAU,QAAgB,MAAqB;EACtD,MAAM,YAAY,GAAG,OAAO,GAAG,OAAO,QAAQ,GAAG,EAAE;EACnD,IAAI;GACF,GAAG,UAAU,WAAW;IAAE,WAAW;IAAM,MAAA;GAAqB,CAAC;GACjE,GAAG,cAAc,WAAW,mBAAmB,IAAI,GAAG,EAAE,MAAA,IAAgB,CAAC;GAGzE,GAAG,WAAW,WAAW,MAAM;EACjC,SAAS,OAAO;GACd,OAAO,GAAG,OAAO,uBAAuB,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,GAAG;GAChG,IAAI;IACF,GAAG,OAAO,WAAW,EAAE,OAAO,KAAK,CAAC;GACtC,QAAQ,CAER;EACF;CACF;CAEA,OAAO;EACL;EACA,gBAAgB;EAChB,mBAAmB;EAEnB,eAAe,YAAY;GACzB,aAAa,CAAC,GAAG,WAAW,QAAQ,SAAS,KAAK,OAAO,WAAW,EAAE,GAAG,UAAU;GACnF,UAAU,iBAAiB,UAAU;EACvC;EAEA,iBAAiB,IAAI;GACnB,MAAM,OAAO,WAAW,QAAQ,SAAS,KAAK,OAAO,EAAE;GACvD,IAAI,KAAK,WAAW,WAAW,QAAQ,OAAO;GAC9C,aAAa;GACb,UAAU,iBAAiB,UAAU;GACrC,OAAO;EACT;EAEA,sBAAsB;EAEtB,kBAAkB,QAAQ;GACxB,MAAM,SAAS,QAAQ,QAAQ,SAAS,KAAK,OAAO,OAAO,EAAE;GAC7D,IAAI,OAAO,WAAW,QAAQ,UAAU,QAAQ,UAAA,IAAgC,OAAO;GACvF,UAAU,CAAC,GAAG,QAAQ,MAAM;GAC5B,UAAU,oBAAoB,OAAO;GACrC,OAAO;EACT;EAEA,oBAAoB,IAAI;GACtB,MAAM,OAAO,QAAQ,QAAQ,SAAS,KAAK,OAAO,EAAE;GACpD,IAAI,KAAK,WAAW,QAAQ,QAAQ,OAAO;GAC3C,UAAU;GACV,UAAU,oBAAoB,OAAO;GACrC,OAAO;EACT;EAEA,KAAK,UAAU;GACb,UAAU;GACV,UAAU,cAAc,8BAA8B,QAAQ,CAAC;EACjE;CACF;AACF"}

package/dist/src/services/runtimeIdentity/sync.cjs

@@ -0,0 +1,23 @@
+const require_runtime = require("../../../_virtual/_rolldown/runtime.cjs");
+let node_fs = require("node:fs");
+node_fs = require_runtime.__toESM(node_fs, 1);
+let node_path = require("node:path");
+node_path = require_runtime.__toESM(node_path, 1);
+//#region src/services/runtimeIdentity/sync.ts
+/**
+* Canonical on-disk identity used for activation deduplication and fingerprints.
+*
+* @deprecated Node-only sync shim; use canonicalModulePathAsync. Removed in M2.
+*/
+function canonicalModulePath(target) {
+	const absolute = node_path.default.resolve(target);
+	let resolved = absolute;
+	try {
+		resolved = node_fs.default.realpathSync.native(absolute);
+	} catch {}
+	return resolved.split(node_path.default.sep).join("/");
+}
+//#endregion
+exports.canonicalModulePath = canonicalModulePath;
+
+//# sourceMappingURL=sync.cjs.map

package/dist/src/services/runtimeIdentity/sync.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"sync.cjs","names":["path","fs"],"sources":["../../../../src/services/runtimeIdentity/sync.ts"],"sourcesContent":["import fs from 'node:fs';\nimport path from 'node:path';\n\n/**\n * Canonical on-disk identity used for activation deduplication and fingerprints.\n *\n * @deprecated Node-only sync shim; use canonicalModulePathAsync. Removed in M2.\n */\nexport function canonicalModulePath(target: string): string {\n  const absolute = path.resolve(target);\n  let resolved = absolute;\n  try {\n    resolved = fs.realpathSync.native(absolute);\n  } catch {\n    // Missing synthetic/test paths still receive an absolute normalized identity.\n  }\n  return resolved.split(path.sep).join('/');\n}\n"],"mappings":";;;;;;;;;;;AAQA,SAAgB,oBAAoB,QAAwB;CAC1D,MAAM,WAAWA,UAAAA,QAAK,QAAQ,MAAM;CACpC,IAAI,WAAW;CACf,IAAI;EACF,WAAWC,QAAAA,QAAG,aAAa,OAAO,QAAQ;CAC5C,QAAQ,CAER;CACA,OAAO,SAAS,MAAMD,UAAAA,QAAK,GAAG,CAAC,CAAC,KAAK,GAAG;AAC1C"}

package/dist/src/services/runtimeIdentity/sync.d.mts

@@ -0,0 +1,9 @@
+//#region src/services/runtimeIdentity/sync.d.ts
+/**
+ * Canonical on-disk identity used for activation deduplication and fingerprints.
+ *
+ * @deprecated Node-only sync shim; use canonicalModulePathAsync. Removed in M2.
+ */
+export declare function canonicalModulePath(target: string): string;
+//#endregion
+//# sourceMappingURL=sync.d.mts.map

package/dist/src/services/runtimeIdentity/sync.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sync.d.mts","names":[],"sources":["../../../../src/services/runtimeIdentity/sync.ts"],"mappings":";;;;;;wBAQgB,oBAAoB"}

package/dist/src/services/runtimeIdentity/sync.mjs

@@ -0,0 +1,20 @@
+import fs from "node:fs";
+import path from "node:path";
+//#region src/services/runtimeIdentity/sync.ts
+/**
+* Canonical on-disk identity used for activation deduplication and fingerprints.
+*
+* @deprecated Node-only sync shim; use canonicalModulePathAsync. Removed in M2.
+*/
+function canonicalModulePath(target) {
+	const absolute = path.resolve(target);
+	let resolved = absolute;
+	try {
+		resolved = fs.realpathSync.native(absolute);
+	} catch {}
+	return resolved.split(path.sep).join("/");
+}
+//#endregion
+export { canonicalModulePath };
+
+//# sourceMappingURL=sync.mjs.map

package/dist/src/services/runtimeIdentity/sync.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"sync.mjs","names":[],"sources":["../../../../src/services/runtimeIdentity/sync.ts"],"sourcesContent":["import fs from 'node:fs';\nimport path from 'node:path';\n\n/**\n * Canonical on-disk identity used for activation deduplication and fingerprints.\n *\n * @deprecated Node-only sync shim; use canonicalModulePathAsync. Removed in M2.\n */\nexport function canonicalModulePath(target: string): string {\n  const absolute = path.resolve(target);\n  let resolved = absolute;\n  try {\n    resolved = fs.realpathSync.native(absolute);\n  } catch {\n    // Missing synthetic/test paths still receive an absolute normalized identity.\n  }\n  return resolved.split(path.sep).join('/');\n}\n"],"mappings":";;;;;;;;AAQA,SAAgB,oBAAoB,QAAwB;CAC1D,MAAM,WAAW,KAAK,QAAQ,MAAM;CACpC,IAAI,WAAW;CACf,IAAI;EACF,WAAW,GAAG,aAAa,OAAO,QAAQ;CAC5C,QAAQ,CAER;CACA,OAAO,SAAS,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,GAAG;AAC1C"}

package/dist/src/services/serialRunner/index.cjs

@@ -0,0 +1,25 @@
+//#region src/services/serialRunner/index.ts
+/** Runs operations one at a time in call order; a rejection reaches its caller and never stalls the queue. */
+function createSerialRunner() {
+	let tail = Promise.resolve();
+	const tails = /* @__PURE__ */ new Map();
+	const run = (operation) => {
+		const result = tail.then(operation);
+		tail = result.catch(() => void 0);
+		return result;
+	};
+	const forKey = (key) => (operation) => {
+		const result = (tails.get(key) ?? Promise.resolve()).then(operation);
+		const settled = result.catch(() => void 0);
+		tails.set(key, settled);
+		settled.then(() => {
+			if (tails.get(key) === settled) tails.delete(key);
+		});
+		return result;
+	};
+	return Object.assign(run, { forKey });
+}
+//#endregion
+exports.createSerialRunner = createSerialRunner;
+
+//# sourceMappingURL=index.cjs.map

package/dist/src/services/serialRunner/index.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.cjs","names":[],"sources":["../../../../src/services/serialRunner/index.ts"],"sourcesContent":["export type SerialTask = <T>(operation: () => Promise<T>) => Promise<T>;\n\nexport interface SerialRunner extends SerialTask {\n  /** A queue per key, so read-modify-write on one path never interleaves while other paths run freely. */\n  forKey(key: string): SerialTask;\n}\n\n/** Runs operations one at a time in call order; a rejection reaches its caller and never stalls the queue. */\nexport function createSerialRunner(): SerialRunner {\n  let tail: Promise<unknown> = Promise.resolve();\n  const tails = new Map<string, Promise<unknown>>();\n  const run = <T>(operation: () => Promise<T>): Promise<T> => {\n    const result = tail.then(operation);\n    // The caller owns `result` and its rejection; the tail only orders the next operation.\n    tail = result.catch(() => undefined);\n    return result;\n  };\n  const forKey =\n    (key: string): SerialTask =>\n    <T>(operation: () => Promise<T>): Promise<T> => {\n      const result = (tails.get(key) ?? Promise.resolve()).then(operation);\n      // As above: the rejection belongs to the caller; the stored tail only orders this key.\n      const settled = result.catch(() => undefined);\n      tails.set(key, settled);\n      void settled.then(() => {\n        if (tails.get(key) === settled) tails.delete(key);\n      });\n      return result;\n    };\n  return Object.assign(run, { forKey });\n}\n"],"mappings":";;AAQA,SAAgB,qBAAmC;CACjD,IAAI,OAAyB,QAAQ,QAAQ;CAC7C,MAAM,wBAAQ,IAAI,IAA8B;CAChD,MAAM,OAAU,cAA4C;EAC1D,MAAM,SAAS,KAAK,KAAK,SAAS;EAElC,OAAO,OAAO,YAAY,KAAA,CAAS;EACnC,OAAO;CACT;CACA,MAAM,UACH,SACG,cAA4C;EAC9C,MAAM,UAAU,MAAM,IAAI,GAAG,KAAK,QAAQ,QAAQ,EAAA,CAAG,KAAK,SAAS;EAEnE,MAAM,UAAU,OAAO,YAAY,KAAA,CAAS;EAC5C,MAAM,IAAI,KAAK,OAAO;EACtB,QAAa,WAAW;GACtB,IAAI,MAAM,IAAI,GAAG,MAAM,SAAS,MAAM,OAAO,GAAG;EAClD,CAAC;EACD,OAAO;CACT;CACF,OAAO,OAAO,OAAO,KAAK,EAAE,OAAO,CAAC;AACtC"}

package/dist/src/services/serialRunner/index.d.mts

@@ -0,0 +1,10 @@
+//#region src/services/serialRunner/index.d.ts
+export type SerialTask = <T>(operation: () => Promise<T>) => Promise<T>;
+export interface SerialRunner extends SerialTask {
+  /** A queue per key, so read-modify-write on one path never interleaves while other paths run freely. */
+  forKey(key: string): SerialTask;
+}
+/** Runs operations one at a time in call order; a rejection reaches its caller and never stalls the queue. */
+export declare function createSerialRunner(): SerialRunner;
+//#endregion
+//# sourceMappingURL=index.d.mts.map

package/dist/src/services/serialRunner/index.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.mts","names":[],"sources":["../../../../src/services/serialRunner/index.ts"],"mappings":";YAAY,cAAc,GAAG,iBAAiB,QAAQ,OAAO,QAAQ;iBAEpD,qBAAqB;;EAEpC,OAAO,cAAc;;;wBAIP,sBAAsB"}

package/dist/src/services/serialRunner/index.mjs

@@ -0,0 +1,25 @@
+//#region src/services/serialRunner/index.ts
+/** Runs operations one at a time in call order; a rejection reaches its caller and never stalls the queue. */
+function createSerialRunner() {
+	let tail = Promise.resolve();
+	const tails = /* @__PURE__ */ new Map();
+	const run = (operation) => {
+		const result = tail.then(operation);
+		tail = result.catch(() => void 0);
+		return result;
+	};
+	const forKey = (key) => (operation) => {
+		const result = (tails.get(key) ?? Promise.resolve()).then(operation);
+		const settled = result.catch(() => void 0);
+		tails.set(key, settled);
+		settled.then(() => {
+			if (tails.get(key) === settled) tails.delete(key);
+		});
+		return result;
+	};
+	return Object.assign(run, { forKey });
+}
+//#endregion
+export { createSerialRunner };
+
+//# sourceMappingURL=index.mjs.map

package/dist/src/services/serialRunner/index.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.mjs","names":[],"sources":["../../../../src/services/serialRunner/index.ts"],"sourcesContent":["export type SerialTask = <T>(operation: () => Promise<T>) => Promise<T>;\n\nexport interface SerialRunner extends SerialTask {\n  /** A queue per key, so read-modify-write on one path never interleaves while other paths run freely. */\n  forKey(key: string): SerialTask;\n}\n\n/** Runs operations one at a time in call order; a rejection reaches its caller and never stalls the queue. */\nexport function createSerialRunner(): SerialRunner {\n  let tail: Promise<unknown> = Promise.resolve();\n  const tails = new Map<string, Promise<unknown>>();\n  const run = <T>(operation: () => Promise<T>): Promise<T> => {\n    const result = tail.then(operation);\n    // The caller owns `result` and its rejection; the tail only orders the next operation.\n    tail = result.catch(() => undefined);\n    return result;\n  };\n  const forKey =\n    (key: string): SerialTask =>\n    <T>(operation: () => Promise<T>): Promise<T> => {\n      const result = (tails.get(key) ?? Promise.resolve()).then(operation);\n      // As above: the rejection belongs to the caller; the stored tail only orders this key.\n      const settled = result.catch(() => undefined);\n      tails.set(key, settled);\n      void settled.then(() => {\n        if (tails.get(key) === settled) tails.delete(key);\n      });\n      return result;\n    };\n  return Object.assign(run, { forKey });\n}\n"],"mappings":";;AAQA,SAAgB,qBAAmC;CACjD,IAAI,OAAyB,QAAQ,QAAQ;CAC7C,MAAM,wBAAQ,IAAI,IAA8B;CAChD,MAAM,OAAU,cAA4C;EAC1D,MAAM,SAAS,KAAK,KAAK,SAAS;EAElC,OAAO,OAAO,YAAY,KAAA,CAAS;EACnC,OAAO;CACT;CACA,MAAM,UACH,SACG,cAA4C;EAC9C,MAAM,UAAU,MAAM,IAAI,GAAG,KAAK,QAAQ,QAAQ,EAAA,CAAG,KAAK,SAAS;EAEnE,MAAM,UAAU,OAAO,YAAY,KAAA,CAAS;EAC5C,MAAM,IAAI,KAAK,OAAO;EACtB,QAAa,WAAW;GACtB,IAAI,MAAM,IAAI,GAAG,MAAM,SAAS,MAAM,OAAO,GAAG;EAClD,CAAC;EACD,OAAO;CACT;CACF,OAAO,OAAO,OAAO,KAAK,EAAE,OAAO,CAAC;AACtC"}

package/dist/src/services/{serverFacet → serverHost}/index.cjs

@@ -1,5 +1,5 @@
-//#region src/services/serverFacet/index.ts
-function createDoomServerHost(options) {
+//#region src/services/serverHost/index.ts
+function createPoServerHost(options) {
 	const { scope, context } = options;
 	const notice = (message) => context.onNotice(message);
 	const mounts = [];
@@ -18,7 +18,7 @@ function createDoomServerHost(options) {
 			return noop;
 		}
 		if (mounts.find((mount) => mount.basePath === api.basePath) !== void 0) {
-			notice(`package API '${api.basePath}' is skipped: another facet already claims it.`);
+			notice(`package API '${api.basePath}' is skipped: another package already claims it.`);
 			return noop;
 		}
 		let handler;
@@ -94,7 +94,7 @@ function createDoomServerHost(options) {
 			return noop;
 		}
 		if (channels.some((mount) => mount.channel.frameType === channel.frameType)) {
-			notice(`hub channel '${channel.frameType}' is skipped: another facet already claims it.`);
+			notice(`hub channel '${channel.frameType}' is skipped: another package already claims it.`);
 			return noop;
 		}
 		let source;
@@ -192,6 +192,6 @@ function createDoomServerHost(options) {
 	};
 }
 //#endregion
-exports.createDoomServerHost = createDoomServerHost;
+exports.createPoServerHost = createPoServerHost;
 
 //# sourceMappingURL=index.cjs.map

package/dist/src/services/serverHost/index.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.cjs","names":[],"sources":["../../../../src/services/serverHost/index.ts"],"sourcesContent":["/**\n * The server host a package registers through at one scope level.\n *\n * DESIGN PATTERNS:\n * - One mount table per level. Every package registers through this service, so\n *   the level has a single ordered record of what is mounted and under what.\n * - Base paths are first-come. A collision is reported and skipped, so one\n *   misdeclared package cannot take a server down.\n * - Handlers are started lazily on first mount and closed on dispose, so a\n *   package that registers and immediately unwinds leaves nothing running.\n *\n * AVOID:\n * - Letting a throwing `start` escape. A package whose API cannot start is\n *   reported and skipped; the remaining packages still mount.\n * - Reaching for node:*. The host owns the listener; this only owns the table.\n */\n\nimport type { PoHubChannel, PoHubChannelHost, PoHubChannelSource } from '../../schemas/hubChannel';\nimport type { PoApi, PoApiContext, PoApiHandler, PoApiScope } from '../../schemas/packageApi';\nimport type { PoPluginRegistry } from '../../schemas/pluginProtocol';\nimport type { PoServerHostService, PoServerRegistration } from '../../schemas/serverPlugin';\n\ninterface MountedApi {\n  readonly basePath: string;\n  readonly handler: PoApiHandler;\n}\n\ninterface MountedChannel {\n  readonly channel: PoHubChannel;\n  readonly source?: PoHubChannelSource;\n  readonly registration?: PoServerRegistration;\n}\n\nexport interface CreatePoServerHostOptions {\n  scope: PoApiScope;\n  context: PoApiContext;\n  /** Required when packages may register live channels. */\n  channelHost?: PoHubChannelHost;\n  /** Supplies a channel-specific host when one host serves multiple channels. */\n  channelHostFor?: (channel: PoHubChannel) => PoHubChannelHost;\n  /** Delegates channel mounting to an owner of the canonical channel table. */\n  mountChannel?: (channel: PoHubChannel) => PoServerRegistration;\n  /** Shared exact-scope dispatch table, owned by the server composition. */\n  pluginRegistry?: PoPluginRegistry;\n  /** Called when an API mount table entry appears or disappears. */\n  onChange?: (mounted: readonly string[]) => void;\n  /** Called when a channel mount table entry appears or disappears. */\n  onChannelsChange?: (mounted: readonly string[]) => void;\n}\n\n/** The mount table a server host exposes to its packages, plus the router's read side. */\nexport interface PoServerHost extends PoServerHostService {\n  /** The handler owning a base path, for the router that dispatches to it. */\n  handlerFor(basePath: string): PoApiHandler | undefined;\n  /** Close every mounted handler and empty the table. */\n  dispose(): void;\n}\n\nexport function createPoServerHost(options: CreatePoServerHostOptions): PoServerHost {\n  const { scope, context } = options;\n  const notice = (message: string): void => context.onNotice(message);\n  const mounts: MountedApi[] = [];\n  const channels: MountedChannel[] = [];\n  const methods = new Set<() => void>();\n  let disposed = false;\n\n  const changed = (): void => options.onChange?.(mounts.map((mount) => mount.basePath));\n  const channelsChanged = (): void => options.onChannelsChange?.(channels.map((mount) => mount.channel.frameType));\n\n  const noop: PoServerRegistration = { mounted: false, dispose: () => undefined };\n\n  const registerApi = (api: PoApi): PoServerRegistration => {\n    if (disposed) {\n      notice(`package API '${api.basePath}' is skipped: the server host is already disposed.`);\n      return noop;\n    }\n    const holder = mounts.find((mount) => mount.basePath === api.basePath);\n    if (holder !== undefined) {\n      notice(`package API '${api.basePath}' is skipped: another package already claims it.`);\n      return noop;\n    }\n    let handler: PoApiHandler;\n    try {\n      handler = api.start(context);\n    } catch (error) {\n      notice(`package API '${api.basePath}' did not start (${String(error)}); it is skipped.`);\n      return noop;\n    }\n    const mount: MountedApi = { basePath: api.basePath, handler };\n    mounts.push(mount);\n    changed();\n    let released = false;\n    return {\n      mounted: true,\n      dispose: () => {\n        if (released) return;\n        released = true;\n        const index = mounts.indexOf(mount);\n        if (index >= 0) mounts.splice(index, 1);\n        try {\n          handler.close();\n        } catch (error) {\n          notice(`package API '${mount.basePath}' did not close cleanly (${String(error)}).`);\n        }\n        changed();\n      },\n    };\n  };\n\n  const registerChannel = (channel: PoHubChannel): PoServerRegistration => {\n    if (disposed) {\n      notice(`hub channel '${channel.frameType}' is skipped: the server host is already disposed.`);\n      return noop;\n    }\n    if (options.mountChannel !== undefined) {\n      let registration: PoServerRegistration;\n      try {\n        registration = options.mountChannel(channel);\n      } catch (error) {\n        notice(`hub channel '${channel.frameType}' did not mount (${String(error)}); it is skipped.`);\n        return noop;\n      }\n      if (registration.mounted !== true) return registration;\n      const mount: MountedChannel = { channel, registration };\n      channels.push(mount);\n      channelsChanged();\n      let released = false;\n      return {\n        mounted: true,\n        dispose: () => {\n          if (released) return;\n          released = true;\n          const index = channels.indexOf(mount);\n          if (index >= 0) channels.splice(index, 1);\n          try {\n            registration.dispose();\n          } catch (error) {\n            notice(`hub channel '${channel.frameType}' did not close cleanly (${String(error)}).`);\n          }\n          channelsChanged();\n        },\n      };\n    }\n    const channelHost = options.channelHostFor?.(channel) ?? options.channelHost;\n    if (!channelHost) {\n      notice(`hub channel '${channel.frameType}' is skipped: this server host has no channel capability.`);\n      return noop;\n    }\n    if (channels.some((mount) => mount.channel.frameType === channel.frameType)) {\n      notice(`hub channel '${channel.frameType}' is skipped: another package already claims it.`);\n      return noop;\n    }\n    let source: PoHubChannelSource;\n    try {\n      source = channel.start(channelHost);\n    } catch (error) {\n      notice(`hub channel '${channel.frameType}' did not start (${String(error)}); it is skipped.`);\n      return noop;\n    }\n    const mount: MountedChannel = { channel, source };\n    channels.push(mount);\n    channelsChanged();\n    let released = false;\n    return {\n      mounted: true,\n      dispose: () => {\n        if (released) return;\n        released = true;\n        const index = channels.indexOf(mount);\n        if (index >= 0) channels.splice(index, 1);\n        try {\n          source.close();\n        } catch (error) {\n          notice(`hub channel '${channel.frameType}' did not close cleanly (${String(error)}).`);\n        }\n        channelsChanged();\n      },\n    };\n  };\n\n  const registerMethod: PoServerHostService['registerMethod'] = (definition, handler) => {\n    if (disposed || !options.pluginRegistry) {\n      notice(\n        `plugin method '${definition.service}.${definition.method}' is skipped: this host has no plugin dispatcher.`,\n      );\n      return noop;\n    }\n    const mount =\n      scope === 'global'\n        ? { scope: 'global' as const }\n        : scope === 'workspace' && context.workspaceId\n          ? { scope: 'workspace' as const, workspaceId: context.workspaceId }\n          : scope === 'session' && context.sessionId\n            ? { scope: 'session' as const, sessionId: context.sessionId }\n            : undefined;\n    if (!mount) {\n      notice(`plugin method '${definition.service}.${definition.method}' is skipped: this host has no mount identity.`);\n      return noop;\n    }\n    try {\n      const release = options.pluginRegistry.register(mount, definition, handler);\n      let released = false;\n      const dispose = () => {\n        if (released) return;\n        released = true;\n        methods.delete(dispose);\n        release();\n      };\n      methods.add(dispose);\n      return { mounted: true, dispose };\n    } catch (error) {\n      notice(`plugin method '${definition.service}.${definition.method}' did not mount (${String(error)}).`);\n      return noop;\n    }\n  };\n\n  return {\n    scope,\n    context,\n    registerApi,\n    registerChannel,\n    registerMethod,\n    mounted: () => mounts.map((mount) => mount.basePath),\n    mountedChannels: () => channels.map((mount) => mount.channel.frameType),\n    handlerFor: (basePath) => mounts.find((mount) => mount.basePath === basePath)?.handler,\n    dispose: () => {\n      if (disposed) return;\n      disposed = true;\n      for (const release of [...methods].reverse()) release();\n      for (const mount of channels.splice(0).reverse()) {\n        try {\n          if (mount.registration !== undefined) mount.registration.dispose();\n          else mount.source?.close();\n        } catch (error) {\n          notice(`hub channel '${mount.channel.frameType}' did not close cleanly (${String(error)}).`);\n        }\n      }\n      for (const mount of mounts.splice(0).reverse()) {\n        try {\n          mount.handler.close();\n        } catch (error) {\n          notice(`package API '${mount.basePath}' did not close cleanly (${String(error)}).`);\n        }\n      }\n      channelsChanged();\n      changed();\n    },\n  };\n}\n"],"mappings":";AA0DA,SAAgB,mBAAmB,SAAkD;CACnF,MAAM,EAAE,OAAO,YAAY;CAC3B,MAAM,UAAU,YAA0B,QAAQ,SAAS,OAAO;CAClE,MAAM,SAAuB,CAAC;CAC9B,MAAM,WAA6B,CAAC;CACpC,MAAM,0BAAU,IAAI,IAAgB;CACpC,IAAI,WAAW;CAEf,MAAM,gBAAsB,QAAQ,WAAW,OAAO,KAAK,UAAU,MAAM,QAAQ,CAAC;CACpF,MAAM,wBAA8B,QAAQ,mBAAmB,SAAS,KAAK,UAAU,MAAM,QAAQ,SAAS,CAAC;CAE/G,MAAM,OAA6B;EAAE,SAAS;EAAO,eAAe,KAAA;CAAU;CAE9E,MAAM,eAAe,QAAqC;EACxD,IAAI,UAAU;GACZ,OAAO,gBAAgB,IAAI,SAAS,mDAAmD;GACvF,OAAO;EACT;EAEA,IADe,OAAO,MAAM,UAAU,MAAM,aAAa,IAAI,QACpD,MAAM,KAAA,GAAW;GACxB,OAAO,gBAAgB,IAAI,SAAS,iDAAiD;GACrF,OAAO;EACT;EACA,IAAI;EACJ,IAAI;GACF,UAAU,IAAI,MAAM,OAAO;EAC7B,SAAS,OAAO;GACd,OAAO,gBAAgB,IAAI,SAAS,mBAAmB,OAAO,KAAK,EAAE,kBAAkB;GACvF,OAAO;EACT;EACA,MAAM,QAAoB;GAAE,UAAU,IAAI;GAAU;EAAQ;EAC5D,OAAO,KAAK,KAAK;EACjB,QAAQ;EACR,IAAI,WAAW;EACf,OAAO;GACL,SAAS;GACT,eAAe;IACb,IAAI,UAAU;IACd,WAAW;IACX,MAAM,QAAQ,OAAO,QAAQ,KAAK;IAClC,IAAI,SAAS,GAAG,OAAO,OAAO,OAAO,CAAC;IACtC,IAAI;KACF,QAAQ,MAAM;IAChB,SAAS,OAAO;KACd,OAAO,gBAAgB,MAAM,SAAS,2BAA2B,OAAO,KAAK,EAAE,GAAG;IACpF;IACA,QAAQ;GACV;EACF;CACF;CAEA,MAAM,mBAAmB,YAAgD;EACvE,IAAI,UAAU;GACZ,OAAO,gBAAgB,QAAQ,UAAU,mDAAmD;GAC5F,OAAO;EACT;EACA,IAAI,QAAQ,iBAAiB,KAAA,GAAW;GACtC,IAAI;GACJ,IAAI;IACF,eAAe,QAAQ,aAAa,OAAO;GAC7C,SAAS,OAAO;IACd,OAAO,gBAAgB,QAAQ,UAAU,mBAAmB,OAAO,KAAK,EAAE,kBAAkB;IAC5F,OAAO;GACT;GACA,IAAI,aAAa,YAAY,MAAM,OAAO;GAC1C,MAAM,QAAwB;IAAE;IAAS;GAAa;GACtD,SAAS,KAAK,KAAK;GACnB,gBAAgB;GAChB,IAAI,WAAW;GACf,OAAO;IACL,SAAS;IACT,eAAe;KACb,IAAI,UAAU;KACd,WAAW;KACX,MAAM,QAAQ,SAAS,QAAQ,KAAK;KACpC,IAAI,SAAS,GAAG,SAAS,OAAO,OAAO,CAAC;KACxC,IAAI;MACF,aAAa,QAAQ;KACvB,SAAS,OAAO;MACd,OAAO,gBAAgB,QAAQ,UAAU,2BAA2B,OAAO,KAAK,EAAE,GAAG;KACvF;KACA,gBAAgB;IAClB;GACF;EACF;EACA,MAAM,cAAc,QAAQ,iBAAiB,OAAO,KAAK,QAAQ;EACjE,IAAI,CAAC,aAAa;GAChB,OAAO,gBAAgB,QAAQ,UAAU,0DAA0D;GACnG,OAAO;EACT;EACA,IAAI,SAAS,MAAM,UAAU,MAAM,QAAQ,cAAc,QAAQ,SAAS,GAAG;GAC3E,OAAO,gBAAgB,QAAQ,UAAU,iDAAiD;GAC1F,OAAO;EACT;EACA,IAAI;EACJ,IAAI;GACF,SAAS,QAAQ,MAAM,WAAW;EACpC,SAAS,OAAO;GACd,OAAO,gBAAgB,QAAQ,UAAU,mBAAmB,OAAO,KAAK,EAAE,kBAAkB;GAC5F,OAAO;EACT;EACA,MAAM,QAAwB;GAAE;GAAS;EAAO;EAChD,SAAS,KAAK,KAAK;EACnB,gBAAgB;EAChB,IAAI,WAAW;EACf,OAAO;GACL,SAAS;GACT,eAAe;IACb,IAAI,UAAU;IACd,WAAW;IACX,MAAM,QAAQ,SAAS,QAAQ,KAAK;IACpC,IAAI,SAAS,GAAG,SAAS,OAAO,OAAO,CAAC;IACxC,IAAI;KACF,OAAO,MAAM;IACf,SAAS,OAAO;KACd,OAAO,gBAAgB,QAAQ,UAAU,2BAA2B,OAAO,KAAK,EAAE,GAAG;IACvF;IACA,gBAAgB;GAClB;EACF;CACF;CAEA,MAAM,kBAAyD,YAAY,YAAY;EACrF,IAAI,YAAY,CAAC,QAAQ,gBAAgB;GACvC,OACE,kBAAkB,WAAW,QAAQ,GAAG,WAAW,OAAO,kDAC5D;GACA,OAAO;EACT;EACA,MAAM,QACJ,UAAU,WACN,EAAE,OAAO,SAAkB,IAC3B,UAAU,eAAe,QAAQ,cAC/B;GAAE,OAAO;GAAsB,aAAa,QAAQ;EAAY,IAChE,UAAU,aAAa,QAAQ,YAC7B;GAAE,OAAO;GAAoB,WAAW,QAAQ;EAAU,IAC1D,KAAA;EACV,IAAI,CAAC,OAAO;GACV,OAAO,kBAAkB,WAAW,QAAQ,GAAG,WAAW,OAAO,+CAA+C;GAChH,OAAO;EACT;EACA,IAAI;GACF,MAAM,UAAU,QAAQ,eAAe,SAAS,OAAO,YAAY,OAAO;GAC1E,IAAI,WAAW;GACf,MAAM,gBAAgB;IACpB,IAAI,UAAU;IACd,WAAW;IACX,QAAQ,OAAO,OAAO;IACtB,QAAQ;GACV;GACA,QAAQ,IAAI,OAAO;GACnB,OAAO;IAAE,SAAS;IAAM;GAAQ;EAClC,SAAS,OAAO;GACd,OAAO,kBAAkB,WAAW,QAAQ,GAAG,WAAW,OAAO,mBAAmB,OAAO,KAAK,EAAE,GAAG;GACrG,OAAO;EACT;CACF;CAEA,OAAO;EACL;EACA;EACA;EACA;EACA;EACA,eAAe,OAAO,KAAK,UAAU,MAAM,QAAQ;EACnD,uBAAuB,SAAS,KAAK,UAAU,MAAM,QAAQ,SAAS;EACtE,aAAa,aAAa,OAAO,MAAM,UAAU,MAAM,aAAa,QAAQ,CAAC,EAAE;EAC/E,eAAe;GACb,IAAI,UAAU;GACd,WAAW;GACX,KAAK,MAAM,WAAW,CAAC,GAAG,OAAO,CAAC,CAAC,QAAQ,GAAG,QAAQ;GACtD,KAAK,MAAM,SAAS,SAAS,OAAO,CAAC,CAAC,CAAC,QAAQ,GAC7C,IAAI;IACF,IAAI,MAAM,iBAAiB,KAAA,GAAW,MAAM,aAAa,QAAQ;SAC5D,MAAM,QAAQ,MAAM;GAC3B,SAAS,OAAO;IACd,OAAO,gBAAgB,MAAM,QAAQ,UAAU,2BAA2B,OAAO,KAAK,EAAE,GAAG;GAC7F;GAEF,KAAK,MAAM,SAAS,OAAO,OAAO,CAAC,CAAC,CAAC,QAAQ,GAC3C,IAAI;IACF,MAAM,QAAQ,MAAM;GACtB,SAAS,OAAO;IACd,OAAO,gBAAgB,MAAM,SAAS,2BAA2B,OAAO,KAAK,EAAE,GAAG;GACpF;GAEF,gBAAgB;GAChB,QAAQ;EACV;CACF;AACF"}

package/dist/src/services/serverHost/index.d.mts

@@ -0,0 +1,31 @@
+import { PoHubChannel, PoHubChannelHost } from "../../schemas/hubChannel.mjs";
+import { PoApiContext, PoApiHandler, PoApiScope } from "../../schemas/packageApi.mjs";
+import { PoPluginRegistry } from "../../schemas/pluginProtocol.mjs";
+import { PoServerHostService, PoServerRegistration } from "../../schemas/serverPlugin.mjs";
+//#region src/services/serverHost/index.d.ts
+export interface CreatePoServerHostOptions {
+  scope: PoApiScope;
+  context: PoApiContext;
+  /** Required when packages may register live channels. */
+  channelHost?: PoHubChannelHost;
+  /** Supplies a channel-specific host when one host serves multiple channels. */
+  channelHostFor?: (channel: PoHubChannel) => PoHubChannelHost;
+  /** Delegates channel mounting to an owner of the canonical channel table. */
+  mountChannel?: (channel: PoHubChannel) => PoServerRegistration;
+  /** Shared exact-scope dispatch table, owned by the server composition. */
+  pluginRegistry?: PoPluginRegistry;
+  /** Called when an API mount table entry appears or disappears. */
+  onChange?: (mounted: readonly string[]) => void;
+  /** Called when a channel mount table entry appears or disappears. */
+  onChannelsChange?: (mounted: readonly string[]) => void;
+}
+/** The mount table a server host exposes to its packages, plus the router's read side. */
+export interface PoServerHost extends PoServerHostService {
+  /** The handler owning a base path, for the router that dispatches to it. */
+  handlerFor(basePath: string): PoApiHandler | undefined;
+  /** Close every mounted handler and empty the table. */
+  dispose(): void;
+}
+export declare function createPoServerHost(options: CreatePoServerHostOptions): PoServerHost;
+//#endregion
+//# sourceMappingURL=index.d.mts.map

package/dist/src/services/serverHost/index.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.mts","names":[],"sources":["../../../../src/services/serverHost/index.ts"],"mappings":";;;;;iBAiCiB;EACf,OAAO;EACP,SAAS;;EAET,cAAc;;EAEd,kBAAkB,SAAS,iBAAiB;;EAE5C,gBAAgB,SAAS,iBAAiB;;EAE1C,iBAAiB;;EAEjB,YAAY;;EAEZ,oBAAoB;;;iBAIL,qBAAqB;;EAEpC,WAAW,mBAAmB;;EAE9B;;wBAGc,mBAAmB,SAAS,4BAA4B"}