@aigne/afs-ui 1.11.0-beta.12

package/dist/web.cjs

@@ -0,0 +1,827 @@
+const require_tty = require('./tty.cjs');
+const require_web_page = require('./web-page.cjs');
+let ufo = require("ufo");
+let node_http = require("node:http");
+let ws = require("ws");
+
+//#region src/web.ts
+/**
+* WebBackend — HTTP + WebSocket based browser UI.
+*
+* Serves a web page and communicates with it via WebSocket.
+* For agent code, this behaves identically to TTYBackend — pure text I/O.
+*
+* For testing, accepts an inputSource/stdout to bypass WebSocket entirely.
+*/
+var WebBackend = class WebBackend {
+	type = "web";
+	supportedFormats = [
+		"text",
+		"html",
+		"markdown",
+		"component"
+	];
+	capabilities = [
+		"text",
+		"html",
+		"markdown",
+		"component"
+	];
+	static KNOWN_COMPONENTS = new Set([
+		"code-block",
+		"table",
+		"image"
+	]);
+	port;
+	host;
+	server = null;
+	wss = null;
+	clients = /* @__PURE__ */ new Set();
+	/** Track all TCP sockets so we can force-destroy on close */
+	sockets = /* @__PURE__ */ new Set();
+	/** Input queue — fed by WebSocket messages or test inputSource */
+	inputSource;
+	/** Output handler — sends to WebSocket clients or test stdout */
+	outputHandler;
+	/** Queue for messages sent before any client connects */
+	pendingMessages = [];
+	/** Pending prompt resolve — only one prompt at a time */
+	promptResolve = null;
+	/** Pending prompt message — re-sent on client reconnect */
+	pendingPromptMessage = null;
+	testMode;
+	_url = null;
+	/** Per-client session tracking */
+	sessionForClient = /* @__PURE__ */ new Map();
+	/** Per-client session token tracking */
+	sessionTokenForClient = /* @__PURE__ */ new Map();
+	createSessionCallback = null;
+	/** AUP event handler callback */
+	aupEventHandler = null;
+	/** Page resolver callback — returns page content for HTTP serving */
+	pageResolver = null;
+	/** Snapshot resolver callback — returns snapshot HTML for a sharing slug */
+	snapshotResolver = null;
+	/** AFS root instance — injected via setAFS() when provider is mounted */
+	afs = null;
+	/** Per-client AFS event subscriptions: ws → subId → unsubscribe */
+	clientSubscriptions = /* @__PURE__ */ new Map();
+	/** Live channel subscribers: channelId → set of viewer WebSockets */
+	channelSubscribers = /* @__PURE__ */ new Map();
+	/** Reverse map: ws → channelId (only for channel viewers) */
+	channelForClient = /* @__PURE__ */ new Map();
+	/** Callback invoked when a viewer joins a channel — provider sends snapshot */
+	channelJoinHandler = null;
+	/** Callback invoked when a client joins/reconnects a session — provider sends snapshot if stale */
+	sessionJoinHandler = null;
+	constructor(options = {}) {
+		this.port = options.port ?? 0;
+		this.host = options.host ?? "localhost";
+		if (options.inputSource) {
+			this.testMode = true;
+			this.inputSource = options.inputSource;
+			this.outputHandler = options.stdout ? (data) => {
+				options.stdout.write(data);
+			} : () => {};
+		} else {
+			this.testMode = false;
+			this.inputSource = require_tty.createMockInputSource();
+			this.outputHandler = (data) => this.broadcast(JSON.stringify({
+				type: "write",
+				content: data
+			}));
+		}
+	}
+	/** URL of the running server, or null if not started. */
+	get url() {
+		return this._url;
+	}
+	/** Register a factory that creates or reattaches a session for each new WebSocket client. */
+	setSessionFactory(fn) {
+		this.createSessionCallback = fn;
+	}
+	/** Broadcast a raw JSON-serializable message to all connected clients. */
+	broadcastRaw(msg) {
+		if (this.testMode) return;
+		this.broadcast(JSON.stringify(msg));
+	}
+	/** Send a raw JSON message to the client that owns a specific session. */
+	sendToSession(sessionId, msg) {
+		if (this.testMode) return;
+		const data = JSON.stringify(msg);
+		for (const [ws$1, sid] of this.sessionForClient) if (sid === sessionId && ws$1.readyState === 1) {
+			ws$1.send(data);
+			return;
+		}
+	}
+	/** Send a raw JSON message to all viewers of a live channel. */
+	sendToLiveChannel(channelId, msg) {
+		if (this.testMode) return;
+		const viewers = this.channelSubscribers.get(channelId);
+		if (!viewers) return;
+		const data = JSON.stringify(msg);
+		for (const ws$1 of viewers) if (ws$1.readyState === 1) ws$1.send(data);
+	}
+	/** Register a handler called when a viewer joins a channel (for snapshot delivery). */
+	setChannelJoinHandler(fn) {
+		this.channelJoinHandler = fn;
+	}
+	/** Register a handler called when a client joins/reconnects a session (for snapshot replay). */
+	setSessionJoinHandler(fn) {
+		this.sessionJoinHandler = fn;
+	}
+	/** Return the set of active channel IDs. */
+	getActiveChannelIds() {
+		return [...this.channelSubscribers.keys()];
+	}
+	/** Register a handler for AUP events from clients. */
+	setAupEventHandler(fn) {
+		this.aupEventHandler = fn;
+	}
+	/** Inject the AFS root for browser AFS proxy operations. */
+	setAFS(afs) {
+		this.afs = afs;
+	}
+	/** Register a resolver for serving pages via HTTP (/p/:id). */
+	setPageResolver(fn) {
+		this.pageResolver = fn;
+	}
+	/** Set the snapshot resolver for web sharing. */
+	setSnapshotResolver(fn) {
+		this.snapshotResolver = fn;
+	}
+	/** Start the HTTP + WebSocket server. */
+	async listen() {
+		return new Promise((resolve, reject) => {
+			const server = (0, node_http.createServer)((req, res) => {
+				const requestUrl = req.url ?? "";
+				const pathname = requestUrl.split("?")[0] ?? "";
+				if (pathname === "/" || pathname === "/index.html" || pathname.startsWith("/live/")) {
+					res.writeHead(200, { "Content-Type": "text/html; charset=utf-8" });
+					res.end(require_web_page.WEB_CLIENT_HTML);
+				} else if (requestUrl.startsWith("/p/")) this.handlePageRequest(requestUrl, res);
+				else if (pathname.startsWith("/s/") && this.snapshotResolver) this.handleSnapshotRequest(pathname, res);
+				else {
+					res.writeHead(404);
+					res.end("Not Found");
+				}
+			});
+			server.on("connection", (socket) => {
+				this.sockets.add(socket);
+				socket.on("close", () => this.sockets.delete(socket));
+			});
+			server.on("error", (err) => {
+				server.close();
+				reject(err);
+			});
+			const bindHost = this.host === "localhost" ? "127.0.0.1" : this.host;
+			server.listen({
+				port: this.port,
+				host: bindHost,
+				exclusive: true
+			}, () => {
+				this.server = server;
+				const addr = server.address();
+				if (typeof addr === "object" && addr) this.port = addr.port;
+				this._url = `http://127.0.0.1:${this.port}`;
+				this.wss = new ws.WebSocketServer({ server });
+				this.wss.on("connection", (ws$1, req) => this.onConnection(ws$1, req));
+				resolve({
+					port: this.port,
+					host: this.host
+				});
+			});
+		});
+	}
+	/** Shut down the server and disconnect all clients. */
+	async close() {
+		for (const ws$1 of this.clients) ws$1.terminate();
+		this.clients.clear();
+		this.sessionForClient.clear();
+		this.sessionTokenForClient.clear();
+		this.channelSubscribers.clear();
+		this.channelForClient.clear();
+		if (this.wss) {
+			this.wss.close();
+			this.wss = null;
+		}
+		if (this.server) {
+			this.server.close();
+			for (const socket of this.sockets) socket.destroy();
+			this.sockets.clear();
+			this.server = null;
+		}
+		this._url = null;
+	}
+	async write(content, options) {
+		const format = options?.format ?? "text";
+		if (!this.supportedFormats.includes(format)) throw new Error(`Web backend does not support format: ${format}`);
+		if (format === "component") {
+			if (!options?.component) throw new Error("format 'component' requires a component type");
+			if (!WebBackend.KNOWN_COMPONENTS.has(options.component)) throw new Error(`Unknown component type: ${options.component}`);
+		}
+		const sanitizedContent = format === "html" ? sanitizeHtml(content) : content;
+		if (this.testMode) {
+			this.outputHandler(sanitizedContent);
+			return;
+		}
+		const msg = {
+			type: "write",
+			content: sanitizedContent
+		};
+		if (format !== "text") msg.format = format;
+		if (options?.component) msg.component = options.component;
+		if (options?.componentProps) msg.componentProps = options.componentProps;
+		const payload = JSON.stringify(msg);
+		if (this.clients.size === 0) this.pendingMessages.push(payload);
+		else this.broadcast(payload);
+	}
+	async read(options) {
+		const timeout = options?.timeout ?? 0;
+		if (timeout > 0) return withTimeout(this.inputSource.readLine(), timeout);
+		return this.inputSource.readLine();
+	}
+	async prompt(options) {
+		if (this.testMode) return this.ttyStylePrompt(options);
+		const msg = JSON.stringify({
+			type: "prompt",
+			message: options.message,
+			promptType: options.type,
+			options: options.options
+		});
+		this.pendingPromptMessage = msg;
+		if (this.clients.size > 0) this.broadcast(msg);
+		else this.pendingMessages.push(msg);
+		return new Promise((resolve) => {
+			this.promptResolve = resolve;
+		});
+	}
+	async notify(message) {
+		if (this.testMode) {
+			this.outputHandler(`${message}\n`);
+			return;
+		}
+		this.broadcast(JSON.stringify({
+			type: "notify",
+			message
+		}));
+	}
+	async navigate(pageId, content, format, layout) {
+		const sanitizedContent = format === "html" ? sanitizeHtml(content) : content;
+		if (this.testMode) {
+			this.outputHandler(sanitizedContent);
+			return;
+		}
+		const msg = {
+			type: "navigate",
+			pageId,
+			content: sanitizedContent,
+			format: format ?? "html"
+		};
+		if (layout) msg.layout = layout;
+		this.broadcast(JSON.stringify(msg));
+	}
+	async clear() {
+		if (this.testMode) {
+			this.outputHandler("\x1B[2J\x1B[H");
+			return;
+		}
+		this.broadcast(JSON.stringify({ type: "clear" }));
+	}
+	hasPendingInput() {
+		return this.inputSource.hasPending();
+	}
+	getViewport() {
+		return {};
+	}
+	async dispose() {
+		await this.close();
+	}
+	onConnection(ws$1, req) {
+		const origin = req.headers.origin;
+		if (typeof origin === "string" && origin && !this.isAllowedWsOrigin(origin)) {
+			ws$1.close(1008, "Invalid origin");
+			return;
+		}
+		this.clients.add(ws$1);
+		let initialized = false;
+		ws$1.on("message", (data) => {
+			try {
+				const msg = JSON.parse(data.toString());
+				if (!initialized) {
+					initialized = true;
+					this.onHandshake(ws$1, msg);
+					return;
+				}
+				this.onMessage(msg, ws$1);
+			} catch {}
+		});
+		ws$1.on("close", () => {
+			this.clients.delete(ws$1);
+			this.sessionForClient.delete(ws$1);
+			this.sessionTokenForClient.delete(ws$1);
+			const channelId = this.channelForClient.get(ws$1);
+			if (channelId) {
+				this.channelForClient.delete(ws$1);
+				const viewers = this.channelSubscribers.get(channelId);
+				if (viewers) {
+					viewers.delete(ws$1);
+					if (viewers.size === 0) this.channelSubscribers.delete(channelId);
+				}
+			}
+			const subs = this.clientSubscriptions.get(ws$1);
+			if (subs) {
+				for (const unsub of subs.values()) unsub();
+				this.clientSubscriptions.delete(ws$1);
+			}
+		});
+	}
+	/** Handle the first WS message as a typed handshake. */
+	onHandshake(ws$1, msg) {
+		if (msg.type === "join_channel") {
+			const channelId = String(msg.channelId ?? "");
+			if (!channelId) {
+				ws$1.close(4e3, "channelId required");
+				return;
+			}
+			this.channelForClient.set(ws$1, channelId);
+			if (!this.channelSubscribers.has(channelId)) this.channelSubscribers.set(channelId, /* @__PURE__ */ new Set());
+			this.channelSubscribers.get(channelId).add(ws$1);
+			ws$1.send(JSON.stringify({
+				type: "channel",
+				channelId
+			}));
+			if (this.channelJoinHandler) this.channelJoinHandler(channelId, (m) => {
+				if (ws$1.readyState === 1) ws$1.send(JSON.stringify(m));
+			});
+		} else {
+			if (this.createSessionCallback) {
+				const requestedSid = msg.sessionId ? String(msg.sessionId) : void 0;
+				const requestedSessionToken = msg.sessionToken ? String(msg.sessionToken) : void 0;
+				const caps = msg.caps && typeof msg.caps === "object" && !Array.isArray(msg.caps) ? msg.caps : void 0;
+				const created = this.createSessionCallback(this.type, requestedSid, requestedSessionToken, caps);
+				const sessionId = created.sessionId;
+				this.sessionForClient.set(ws$1, sessionId);
+				if (created.sessionToken) this.sessionTokenForClient.set(ws$1, created.sessionToken);
+				ws$1.send(JSON.stringify({
+					type: "session",
+					sessionId,
+					sessionToken: created.sessionToken ?? null
+				}));
+				if (this.sessionJoinHandler) {
+					const clientVersion = typeof msg.treeVersion === "number" ? msg.treeVersion : 0;
+					this.sessionJoinHandler(sessionId, clientVersion, (m) => {
+						if (ws$1.readyState === 1) ws$1.send(JSON.stringify(m));
+					});
+				}
+			}
+			for (const m of this.pendingMessages) ws$1.send(m);
+			this.pendingMessages = [];
+			if (this.pendingPromptMessage && this.promptResolve) ws$1.send(this.pendingPromptMessage);
+			if (msg.type && msg.type !== "join_session") this.onMessage(msg, ws$1);
+		}
+	}
+	onMessage(msg, ws$1) {
+		switch (msg.type) {
+			case "input": {
+				const content = String(msg.content ?? "");
+				this.inputSource.push?.(content);
+				break;
+			}
+			case "prompt_response":
+				if (this.promptResolve) {
+					const resolve = this.promptResolve;
+					this.promptResolve = null;
+					this.pendingPromptMessage = null;
+					resolve(msg.value);
+				}
+				break;
+			case "aup_event":
+				if (this.aupEventHandler) {
+					const sessionId = this.sessionForClient.get(ws$1);
+					const channelId = this.channelForClient.get(ws$1);
+					const nodeId = String(msg.nodeId ?? "");
+					const event = String(msg.event ?? "");
+					const data = msg.data != null ? msg.data : void 0;
+					this.aupEventHandler({
+						nodeId,
+						event,
+						data
+					}, sessionId, channelId).then((result) => {
+						if (ws$1.readyState === 1) ws$1.send(JSON.stringify({
+							type: "aup_event_result",
+							nodeId,
+							event,
+							result
+						}));
+					}).catch((err) => {
+						if (ws$1.readyState === 1) ws$1.send(JSON.stringify({
+							type: "aup_event_result",
+							nodeId,
+							event,
+							error: err.message
+						}));
+					});
+				}
+				break;
+			case "navigate_request": {
+				const pageId = String(msg.pageId ?? "");
+				const afsNav = this.afs;
+				if (pageId && afsNav) {
+					const pagePath = (0, ufo.joinURL)("/ui/web/pages", pageId);
+					afsNav.read?.(pagePath)?.then((result) => {
+						if (result.data && ws$1.readyState === 1) {
+							const entry = result.data;
+							const content = String(entry.content?.content ?? entry.content ?? "");
+							ws$1.send(JSON.stringify({
+								type: "navigate",
+								pageId,
+								content,
+								format: entry.content?.format ?? "html"
+							}));
+						}
+					})?.catch(() => {});
+				}
+				break;
+			}
+			case "afs_read":
+			case "afs_list":
+			case "afs_write":
+			case "afs_exec":
+			case "afs_stat":
+			case "afs_subscribe":
+			case "afs_unsubscribe":
+				this.handleAfsMessage(msg, ws$1);
+				break;
+		}
+	}
+	/** Handle AFS proxy messages from browser clients. */
+	handleAfsMessage(msg, ws$1) {
+		const reqId = msg.reqId;
+		if (!reqId) return;
+		const sendResult = (data) => {
+			if (ws$1.readyState === 1) ws$1.send(JSON.stringify({
+				type: "afs_result",
+				reqId,
+				data
+			}));
+		};
+		const sendError = (error) => {
+			if (ws$1.readyState === 1) ws$1.send(JSON.stringify({
+				type: "afs_error",
+				reqId,
+				error
+			}));
+		};
+		if (!this.afs) {
+			sendError("AFS not available");
+			return;
+		}
+		const afs = this.afs;
+		const path = String(msg.path ?? "/");
+		switch (msg.type) {
+			case "afs_read":
+				if (!afs.read) {
+					sendError("read not supported");
+					return;
+				}
+				afs.read(path).then((r) => sendResult(r.data), (e) => sendError(e.message));
+				break;
+			case "afs_list": {
+				const listOptions = msg.options || {};
+				afs.list(path, listOptions).then((r) => sendResult({
+					data: r.data,
+					total: r.total
+				}), (e) => sendError(e.message));
+				break;
+			}
+			case "afs_stat":
+				if (!afs.stat) {
+					sendError("stat not supported");
+					return;
+				}
+				afs.stat(path).then((r) => sendResult(r.data), (e) => sendError(e.message));
+				break;
+			case "afs_write": {
+				if (!afs.write) {
+					sendError("write not supported");
+					return;
+				}
+				const payload = {};
+				if (msg.content !== void 0) payload.content = msg.content;
+				if (msg.meta !== void 0) payload.meta = msg.meta;
+				afs.write(path, payload).then((r) => sendResult(r.data), (e) => sendError(e.message));
+				break;
+			}
+			case "afs_exec": {
+				if (!afs.exec) {
+					sendError("exec not supported");
+					return;
+				}
+				const args = msg.args ?? {};
+				afs.exec(path, args, {}).then((r) => sendResult(r.data), (e) => sendError(e.message));
+				break;
+			}
+			case "afs_subscribe": {
+				const subId = String(msg.subId ?? "");
+				const filter = msg.filter ?? {};
+				if (!subId) {
+					sendError("subId is required for subscribe");
+					return;
+				}
+				if (!afs.subscribe) {
+					sendError("subscribe not supported");
+					return;
+				}
+				try {
+					const unsub = afs.subscribe(filter, (event) => {
+						if (ws$1.readyState === 1) ws$1.send(JSON.stringify({
+							type: "afs_event",
+							subId,
+							event
+						}));
+					});
+					if (!this.clientSubscriptions.has(ws$1)) this.clientSubscriptions.set(ws$1, /* @__PURE__ */ new Map());
+					this.clientSubscriptions.get(ws$1).set(subId, unsub);
+					sendResult(null);
+				} catch (e) {
+					sendError(e instanceof Error ? e.message : String(e));
+				}
+				break;
+			}
+			case "afs_unsubscribe": {
+				const subId = String(msg.subId ?? "");
+				const subs = this.clientSubscriptions.get(ws$1);
+				if (subs) {
+					const unsub = subs.get(subId);
+					if (unsub) {
+						unsub();
+						subs.delete(subId);
+					}
+				}
+				sendResult(null);
+				break;
+			}
+		}
+	}
+	/** Serve a page as standalone HTML via /p/:id[?sid=xxx][&st=xxx][&bridge=1] */
+	handlePageRequest(requestUrl, res) {
+		if (!this.pageResolver) {
+			res.writeHead(404);
+			res.end("Not Found");
+			return;
+		}
+		const url = new URL(requestUrl, "http://localhost");
+		const pathParts = url.pathname.split("/").filter(Boolean);
+		let pageId = "";
+		try {
+			pageId = decodeURIComponent(pathParts[1] ?? "");
+		} catch {
+			res.writeHead(400);
+			res.end("Bad Request: invalid page ID encoding");
+			return;
+		}
+		const sessionId = url.searchParams.get("sid") ?? void 0;
+		const sessionToken = url.searchParams.get("st") ?? void 0;
+		const wantBridge = url.searchParams.get("bridge") === "1";
+		if (!pageId) {
+			res.writeHead(400);
+			res.end("Bad Request: missing page ID");
+			return;
+		}
+		this.pageResolver(pageId, sessionId, sessionToken).then((result) => {
+			if (!result) {
+				res.writeHead(404);
+				res.end("Page not found");
+				return;
+			}
+			let html;
+			if (result.format === "html") html = result.content;
+			else html = `<!DOCTYPE html><html><head><meta charset="UTF-8"><meta name="viewport" content="width=device-width,initial-scale=1.0"></head><body><pre>${escapeHtmlForPage(result.content)}</pre></body></html>`;
+			html = injectPageBaseCSS(html);
+			if (wantBridge) {
+				const serverOrigin = `http://127.0.0.1:${this.port}`;
+				html = injectBridgeScript(html, serverOrigin);
+			}
+			res.writeHead(200, { "Content-Type": "text/html; charset=utf-8" });
+			res.end(html);
+		}).catch(() => {
+			res.writeHead(500);
+			res.end("Internal Server Error");
+		});
+	}
+	/** Handle HTTP GET /s/:slug — serve snapshot HTML for a sharing entry */
+	handleSnapshotRequest(pathname, res) {
+		if (!this.snapshotResolver) {
+			res.writeHead(404);
+			res.end("Not Found");
+			return;
+		}
+		const slug = pathname.slice(3);
+		if (!slug) {
+			res.writeHead(404);
+			res.end("Not Found");
+			return;
+		}
+		const html = this.snapshotResolver(slug);
+		if (!html) {
+			res.writeHead(404);
+			res.end("Not Found");
+			return;
+		}
+		res.writeHead(200, {
+			"Content-Type": "text/html; charset=utf-8",
+			"Cache-Control": "public, max-age=300"
+		});
+		res.end(html);
+	}
+	broadcast(data) {
+		for (const ws$1 of this.clients) if (ws$1.readyState === 1) ws$1.send(data);
+	}
+	isLoopbackHost(hostname) {
+		return hostname === "localhost" || hostname === "127.0.0.1" || hostname === "::1";
+	}
+	isAllowedWsOrigin(origin) {
+		try {
+			const u = new URL(origin);
+			return this.isLoopbackHost(u.hostname);
+		} catch {
+			return false;
+		}
+	}
+	/** TTY-style prompt for test mode (reuses TTYBackend logic) */
+	async ttyStylePrompt(options) {
+		const { message, type } = options;
+		switch (type) {
+			case "text":
+			case "password":
+				this.outputHandler(`${message} `);
+				return (await this.read()).trim();
+			case "confirm":
+				this.outputHandler(`${message} (y/n) `);
+				return (await this.read()).trim().toLowerCase().startsWith("y");
+			case "select": {
+				if (!options.options || options.options.length === 0) throw new Error("select prompt requires options");
+				this.outputHandler(`${message}\n`);
+				for (let i = 0; i < options.options.length; i++) this.outputHandler(`  ${i + 1}. ${options.options[i]}\n`);
+				this.outputHandler("Choice: ");
+				const input = await this.read();
+				const idx = Number.parseInt(input.trim(), 10) - 1;
+				if (idx >= 0 && idx < options.options.length) return options.options[idx];
+				return options.options[0];
+			}
+			case "multiselect":
+				if (!options.options || options.options.length === 0) throw new Error("multiselect prompt requires options");
+				this.outputHandler(`${message}\n`);
+				for (let i = 0; i < options.options.length; i++) this.outputHandler(`  ${i + 1}. ${options.options[i]}\n`);
+				this.outputHandler("Choices (comma-separated): ");
+				return (await this.read()).split(",").map((s) => Number.parseInt(s.trim(), 10) - 1).filter((i) => i >= 0 && i < options.options.length).map((i) => options.options[i]);
+			default: throw new Error(`Unknown prompt type: ${type}`);
+		}
+	}
+};
+/**
+* Strip dangerous HTML: <script> tags, on* event handlers, javascript: URLs.
+*/
+function sanitizeHtml(html) {
+	return html.replace(/<script\b[^>]*>[\s\S]*?<\/script>/gi, "").replace(/<script\b[^>]*\/?>/gi, "").replace(/\s+on\w+\s*=\s*(?:"[^"]*"|'[^']*'|[^\s>]+)/gi, "").replace(/(href|src|action)\s*=\s*(?:"javascript:[^"]*"|'javascript:[^']*')/gi, "$1=\"\"");
+}
+/** Escape HTML for embedding in a minimal page shell. */
+function escapeHtmlForPage(str) {
+	return str.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;");
+}
+/** AUP Bridge script (~2KB) — injected into iframe pages when bridge=1. */
+function buildBridgeScript(serverOrigin) {
+	return `<script>
+(function(){
+  var _msgId = 0;
+  var _parentOrigin = '${serverOrigin.replace(/\\/g, "\\\\").replace(/'/g, "\\'")}';
+
+  function _isTrustedParentMessage(e) {
+    if (e.source !== parent) return false;
+    if (e.origin !== _parentOrigin) return false;
+    return true;
+  }
+
+  function _bridgeRequest(type, params) {
+    return new Promise(function(resolve, reject) {
+      var id = 'b' + (++_msgId);
+      function handler(e) {
+        if (!_isTrustedParentMessage(e)) return;
+        if (e.data && e.data.type === 'aup_bridge_response' && e.data.id === id) {
+          window.removeEventListener('message', handler);
+          if (e.data.error) reject(new Error(e.data.error));
+          else resolve(e.data.payload);
+        }
+      }
+      window.addEventListener('message', handler);
+      parent.postMessage({ type: type, id: id, params: params }, _parentOrigin);
+    });
+  }
+
+  var _subs = {};
+  window.addEventListener('message', function(e) {
+    if (!_isTrustedParentMessage(e)) return;
+    if (e.data && e.data.type === 'aup_subscribe_event' && e.data.subId && _subs[e.data.subId]) {
+      _subs[e.data.subId](e.data.payload);
+    }
+  });
+
+  window.aup = {
+    emit: function(event, data) {
+      parent.postMessage({ type: 'aup_event', event: event, data: data }, _parentOrigin);
+    },
+    on: function(event, fn) {
+      window.addEventListener('message', function(e) {
+        if (!_isTrustedParentMessage(e)) return;
+        if (e.data && e.data.type === 'aup_data' && e.data.event === event) fn(e.data.payload);
+      });
+    },
+    navigate: function(path) {
+      parent.postMessage({ type: 'aup_navigate', path: path }, _parentOrigin);
+    },
+    toast: function(message, intent) {
+      parent.postMessage({ type: 'aup_toast', message: message, intent: intent || 'info' }, _parentOrigin);
+    },
+    fetch: function(path) {
+      return _bridgeRequest('aup_bridge_read', { path: path });
+    },
+    read: function(path) {
+      return _bridgeRequest('aup_bridge_read', { path: path });
+    },
+    list: function(path, options) {
+      return _bridgeRequest('aup_bridge_list', { path: path, options: options });
+    },
+    write: function(path, content, meta) {
+      return _bridgeRequest('aup_bridge_write', { path: path, content: content, meta: meta });
+    },
+    exec: function(path, args) {
+      return _bridgeRequest('aup_bridge_exec', { path: path, args: args || {} });
+    },
+    subscribe: function(filter, callback) {
+      var subId = 'bs' + (++_msgId);
+      _subs[subId] = callback;
+      parent.postMessage({ type: 'aup_bridge_subscribe', subId: subId, filter: filter }, _parentOrigin);
+      return function() {
+        delete _subs[subId];
+        parent.postMessage({ type: 'aup_bridge_unsubscribe', subId: subId }, _parentOrigin);
+      };
+    }
+  };
+})();
+<\/script>`;
+}
+/** Inject bridge script into HTML — inserts before </head> or at start of <body>. */
+const PAGE_BASE_CSS = `<style data-aup-base>
+*, *::before, *::after { margin: 0; padding: 0; box-sizing: border-box; }
+:root {
+  --bg: #0a0e14; --surface: #131820; --border: #1d2433;
+  --text: #b3b1ad; --dim: #626a73;
+  --accent: #e6b450; --accent-bg: #2a2000;
+  --font: "Manrope", -apple-system, "Segoe UI", sans-serif;
+  --font-mono: "JetBrains Mono", "Fira Code", monospace;
+  --radius: 8px;
+  color-scheme: dark;
+}
+@media (prefers-color-scheme: light) {
+  :root {
+    --bg: #f5f3ef; --surface: #fefdfb; --border: #e0dcd4;
+    --text: #2c2418; --dim: #8a7e6e;
+    --accent: #b8860b; --accent-bg: #fef7e5;
+    color-scheme: light;
+  }
+}
+html, body { min-height: 100vh; background: var(--bg); color: var(--text); font-family: var(--font); line-height: 1.6; -webkit-font-smoothing: antialiased; }
+a { color: var(--accent); }
+code, pre { font-family: var(--font-mono); }
+pre { background: var(--surface); border: 1px solid var(--border); border-radius: var(--radius); padding: 1em; overflow-x: auto; }
+img, video { max-width: 100%; height: auto; }
+</style>`;
+function injectPageBaseCSS(html) {
+	if (html.includes("</head>")) return html.replace("</head>", `${PAGE_BASE_CSS}\n</head>`);
+	const headMatch = html.match(/<head[^>]*>/i);
+	if (headMatch) return html.replace(headMatch[0], `${headMatch[0]}\n${PAGE_BASE_CSS}`);
+	return PAGE_BASE_CSS + html;
+}
+function injectBridgeScript(html, serverOrigin) {
+	const script = buildBridgeScript(serverOrigin);
+	if (html.includes("</head>")) return html.replace("</head>", `${script}\n</head>`);
+	const bodyMatch = html.match(/<body[^>]*>/i);
+	if (bodyMatch) return html.replace(bodyMatch[0], `${bodyMatch[0]}\n${script}`);
+	return script + html;
+}
+function withTimeout(promise, ms) {
+	return new Promise((resolve, reject) => {
+		const timer = setTimeout(() => reject(/* @__PURE__ */ new Error("Input timeout")), ms);
+		promise.then((val) => {
+			clearTimeout(timer);
+			resolve(val);
+		}, (err) => {
+			clearTimeout(timer);
+			reject(err);
+		});
+	});
+}
+
+//#endregion
+exports.WebBackend = WebBackend;