@aigne/aos 0.2.0-beta

package/dist/http/afs-raw.mjs

@@ -0,0 +1,264 @@
+import { createAfsRequestContext } from "./request-context.mjs";
+import { statusForError } from "./afs-rpc.mjs";
+import { verifyRawUrl } from "./raw-url.mjs";
+import { sanitizeAfsPath } from "@aigne/afs";
+import { detectMimeType } from "@aigne/afs-provider-utils";
+
+//#region src/http/afs-raw.ts
+/**
+* `GET /api/afs/raw` — raw-bytes endpoint (afs-preview T2.1, design §3).
+*
+* Lets `<img>` / `<iframe>` / `<video>` reference AFS content that is too
+* large to inline as a data URL. AFS-Only I/O: the handler speaks ONLY the
+* scoped AFS API (`stat` + `read`) — never CAS/R2/disk.
+*
+* TWO auth modes (afs-raw cookie mode):
+*   - SIGNED (sig query present): a bearer URL whose HMAC binds
+*     path+sid+caller+blocklet (raw-url.ts). The ONLY mode that can serve an
+*     anonymous caller or a cookie-less context — sandboxed PDF iframe (no
+*     `allow-same-origin` ⇒ null origin ⇒ no cookie), cross-origin embeds,
+*     public share links. Issued server-side because signing needs the secret.
+*   - COOKIE (no sig): a same-origin AUTHENTICATED GET — feed/list `<img>`
+*     cards. Identity is the verified session cookie (resolveCaller); the
+*     scoped `/user` overlay grants the SAME read authz as afs-rpc, so no
+*     bearer URL is minted. `SameSite=Lax` on the session cookie means a
+*     cross-site subresource (`<img>` from another origin) carries NO cookie ⇒
+*     401/403, so this can't be hotlinked/CSRF'd; and the only cross-site case
+*     Lax DOES allow (top-level nav) only ever exposes the caller's OWN `/user`
+*     space to themselves. Anonymous (no cookie) is refused here — an
+*     unauthenticated reader must use a signed URL. No per-render server
+*     pre-signing, no `exp` churn ⇒ the URL is stable (cacheable later).
+*
+* Processing order (the contract — every step fail-closed):
+*   1. method gate (GET) → 405
+*   2. signing secret present? → else 503 (no signing = no endpoint)
+*   3. cookie caller resolution (anonymous OK in SIGNED mode — symmetry is
+*      enforced by the signature, see raw-url.ts)
+*   4. auth: SIGNED → `verifyRawUrl` (sig/exp/caller-binding/anonymous-
+*      private-path) any failure → 403; COOKIE → require non-anonymous caller
+*      (else 403) + `?path=` (else 400)
+*   5. `sanitizeAfsPath` (single shared entry — no local normalize/reorder)
+*      → 400
+*   6. blocklet resolution (query/host alias/first-label) → 400
+*   7. scoped AFS via the shared request-context helper. SIGNED passes the
+*      EXPLICIT signature-verified sessionId (never a `rpc-<blocklet>`-style
+*      fallback); COOKIE passes null (the `/user` overlay keys on caller.did)
+*   8a. media-302 (preview-r2-direct): MEDIA (image/video/audio) over
+*       `RAW_REDIRECT_MIN_BYTES` with a presign-capable scoped AFS → 302 to a
+*       presigned R2 GET. Runs AFTER the size-validity check but BEFORE the
+*       `maxBytes` cap (cap-exempt — R2's ceiling is the object size); the
+*       worker never buffers these bytes. Falls through to 8b on null.
+*   8b. `afs.stat` size cap — over `maxBytes` → 413 BEFORE any read; size
+*      missing → conservative 413 (read-after-judge would defeat the memory
+*      guardrail)
+*   9. `afs.read` → bytes → response with `Content-Type` (meta.mimeType,
+*      fallback shared detectMimeType), `X-Content-Type-Options: nosniff`
+*      (mandatory — binary serving endpoint), `Cache-Control: private,
+*      no-store`. #818: a CLIENT-DECLARED browser-scriptable type
+*      (`isScriptableMimeType`: text/html, image/svg+xml, xml, JS variants) is
+*      NEVER served inline — forced to `application/octet-stream` +
+*      `Content-Disposition: attachment` + CSP sandbox + `X-Frame-Options: DENY`
+*      (nosniff alone can't stop a genuinely-declared scriptable type executing).
+*
+* Cache semantics: this handler owns its OWN request-context instance —
+* code shared with afs-rpc, runtime state (projection cache) NOT shared.
+*/
+/**
+* Default max served size — 100 MiB (413 above; streaming/Range is a separate
+* project). upload-limits Phase 6 (D4 interim): raised 50→100 MiB to ALIGN with
+* the grant upload cap (`AFS_DID_SPACE_UPLOAD_MAX_BYTES`, 100 MiB) so a file the
+* upload plane accepts can be raw-served, closing the G4 upload/serve asymmetry
+* for the worker-serve path. This is the NODE/default ceiling (Node can buffer
+* 100 MiB once). It is NOT runtime-uniform: the CF Worker passes a much smaller
+* `maxBytes` (~4 MiB, preview-r2-direct's runtime-aware clean-413) because a
+* one-shot read of ≳8 MiB OOMs the worker (Error 1102 → 503); CF non-media over
+* that gets a CLEAN 413 (never a crash), and CF MEDIA over the gate is exempt via
+* the 302→R2-direct path above. The 50→100 doubling of one-shot read memory on
+* Node is the known interim cost; true large serve needs streaming/Range.
+*/
+const RAW_MAX_BYTES_DEFAULT = 100 * 1024 * 1024;
+/**
+* Media over this size redirect (302) to a presigned object-store GET instead of
+* being served by the worker (preview-r2-direct §4 / Review-B). v1 = 32 KB, locked
+* equal to `PREVIEW_IMAGE_INLINE_MAX` (the user-locked "> 32 KB → R2-direct"
+* decision; maximizes worker-offload). The correctness floor is the worker cliff
+* (~4–8 MiB); anything below is a worker-offload-vs-first-byte-latency CHOICE, and
+* a future raise is a measurement-gated, OPTIONAL post-ship activity — NOT a gate.
+*/
+const RAW_REDIRECT_MIN_BYTES = 32 * 1024;
+/**
+* The 302 path is MEDIA-ONLY (preview-r2-direct §5 / Review-1): only `image/*`,
+* `video/*`, `audio/*` are script-safe to redirect cross-origin to R2 (the
+* presigned URL drops `nosniff`; a media element never executes mislabeled
+* bytes). SVG (`image/svg+xml`) matches `image/*` here but is EXCLUDED from the
+* redirect at the call site via `isScriptableMimeType` (#818 supersedes the old
+* Review-A "SVG rides image/*" behavior): a scripted SVG is browser-scriptable,
+* so it falls through to worker-serve, which forces a safe attachment. PDF/HTML/
+* text MUST stay on the worker (iframe `noSandbox`/`_isSameOriginUrl` depends on
+* same-origin + nosniff; text is client-rendered → `fetch` → CORS-gated).
+*/
+function isRedirectableMediaType(mime) {
+	const m = mime.toLowerCase();
+	return m.startsWith("image/") || m.startsWith("video/") || m.startsWith("audio/");
+}
+/**
+* Browser-scriptable MIME types (#818). `meta.mimeType` is CLIENT-CONTROLLED —
+* any writer can declare it, there is no write-side allowlist, and this endpoint
+* serves anonymous bearer URLs (public share links). If we echo a declared
+* scriptable type as an inline `Content-Type`, the bytes execute in the serving
+* origin → stored XSS. `X-Content-Type-Options: nosniff` does NOT help here: it
+* only stops sniffing of MIS-labeled bytes; a GENUINELY-declared `text/html`
+* (or scripted `image/svg+xml`) still runs. So at the serve boundary — the
+* provider-agnostic place — these are forced to a non-executing disposition
+* (octet-stream + `Content-Disposition: attachment`) and can never render inline.
+*
+* SVG is included: rendered inline (top-level nav / `<embed>`/`<object>`) a
+* scripted SVG executes same-origin. It is ALSO excluded from the 302→R2 media
+* redirect below (falls through to worker-serve, which forces attachment).
+*/
+const SCRIPTABLE_MIME_TYPES = new Set([
+	"text/html",
+	"application/xhtml+xml",
+	"image/svg+xml",
+	"text/xml",
+	"application/xml",
+	"text/javascript",
+	"application/javascript",
+	"application/x-javascript",
+	"text/ecmascript",
+	"application/ecmascript",
+	"application/x-ecmascript"
+]);
+/** True when a MIME type can execute script if rendered inline (#818). */
+function isScriptableMimeType(mime) {
+	const base = mime.toLowerCase().split(";", 1)[0]?.trim() ?? "";
+	return SCRIPTABLE_MIME_TYPES.has(base);
+}
+/**
+* A header-safe `filename` for `Content-Disposition: attachment` (#818). The
+* path is already `sanitizeAfsPath`-clean (no traversal), but strip quotes /
+* backslashes / CR-LF defensively so the value can never break out of the
+* header or inject a second directive.
+*/
+function attachmentFilename(path) {
+	return (path.split("/").pop() || "download").replace(/["\\\r\n]/g, "_") || "download";
+}
+const RAW_HEADERS_BASE = {
+	"X-Content-Type-Options": "nosniff",
+	"Cache-Control": "private, no-store"
+};
+function deny(status, text) {
+	return new Response(text, {
+		status,
+		headers: {
+			...RAW_HEADERS_BASE,
+			"Content-Type": "text/plain; charset=utf-8"
+		}
+	});
+}
+/** Normalize an AFS read result's content to raw bytes. Null = no bytes. */
+function contentToBytes(content, encoding) {
+	if (content instanceof Uint8Array) return content;
+	if (content instanceof ArrayBuffer) return new Uint8Array(content);
+	if (typeof content === "string") {
+		if (encoding === "base64") try {
+			return Uint8Array.from(atob(content), (c) => c.charCodeAt(0));
+		} catch {
+			return null;
+		}
+		return new TextEncoder().encode(content);
+	}
+	return null;
+}
+function createAfsRawHandler(options) {
+	const reqCtx = createAfsRequestContext(options);
+	const maxBytes = options.maxBytes ?? RAW_MAX_BYTES_DEFAULT;
+	return async function handleRaw(request) {
+		try {
+			return await handleInner(request);
+		} catch (err) {
+			return deny(statusForError(err), "Internal error");
+		}
+	};
+	async function handleInner(request) {
+		if (request.method !== "GET") return deny(405, "Method Not Allowed (use GET)");
+		const secret = options.rawUrlSecret;
+		if (!secret || typeof secret === "string" && secret.length === 0) return deny(503, "raw endpoint unavailable (signing key not configured)");
+		const caller = await reqCtx.resolveCaller(request);
+		const callerDid = caller?.did ?? null;
+		const url = new URL(request.url);
+		const hasSignature = url.searchParams.has("sig");
+		let rawPath;
+		let sessionId;
+		let signedBlocklet;
+		if (hasSignature) {
+			const verdict = await verifyRawUrl(request, callerDid, { secret });
+			if (!verdict.ok) return deny(403, "Forbidden");
+			rawPath = verdict.path;
+			sessionId = verdict.sessionId;
+			signedBlocklet = verdict.blocklet;
+		} else {
+			if (!callerDid) return deny(403, "Forbidden");
+			const qPath = url.searchParams.get("path");
+			if (!qPath) return deny(400, "Invalid path");
+			rawPath = qPath;
+			sessionId = null;
+			signedBlocklet = url.searchParams.get("blocklet");
+		}
+		const safePath = sanitizeAfsPath(rawPath);
+		if (safePath === null) return deny(400, "Invalid path");
+		const blocklet = await reqCtx.resolveBlocklet(request, signedBlocklet);
+		if (!blocklet) return deny(400, "Could not resolve blocklet");
+		const scoped = await reqCtx.resolveScoped(request, {
+			blocklet,
+			sessionId,
+			caller
+		});
+		if (!scoped.afs.stat || !scoped.afs.read) return deny(501, "stat/read not supported");
+		const statData = (await scoped.afs.stat(safePath, { context: scoped.context }))?.data ?? {};
+		const meta = statData.meta ?? {};
+		const size = typeof statData.size === "number" ? statData.size : typeof meta.size === "number" ? meta.size : void 0;
+		if (typeof size !== "number" || !Number.isFinite(size) || size < 0) return deny(413, "Content size unknown");
+		const statMimeType = typeof meta.mimeType === "string" && meta.mimeType || detectMimeType(safePath) || "application/octet-stream";
+		if (size > RAW_REDIRECT_MIN_BYTES && isRedirectableMediaType(statMimeType) && !isScriptableMimeType(statMimeType) && typeof scoped.afs.presignRead === "function") {
+			let grant = null;
+			try {
+				grant = await scoped.afs.presignRead(safePath, { responseContentType: statMimeType });
+			} catch {
+				grant = null;
+			}
+			if (grant) return new Response(null, {
+				status: 302,
+				headers: {
+					Location: grant.url,
+					"Cache-Control": "private, no-store",
+					"Referrer-Policy": "no-referrer"
+				}
+			});
+		}
+		if (size > maxBytes) return deny(413, "Content too large");
+		const data = (await scoped.afs.read(safePath, { context: scoped.context }))?.data ?? {};
+		const encoding = data.encoding ?? (data.meta?.contentType === "base64" || data.meta?.encoding === "base64" ? "base64" : void 0);
+		const bytes = contentToBytes(data.content, encoding);
+		if (!bytes) return deny(404, "No content");
+		const mimeType = typeof meta.mimeType === "string" && meta.mimeType || typeof data.meta?.mimeType === "string" && data.meta.mimeType || detectMimeType(safePath) || "application/octet-stream";
+		const headers = {
+			...RAW_HEADERS_BASE,
+			"Content-Length": String(bytes.length)
+		};
+		if (isScriptableMimeType(mimeType)) {
+			headers["Content-Type"] = "application/octet-stream";
+			headers["Content-Disposition"] = `attachment; filename="${attachmentFilename(safePath)}"`;
+			headers["Content-Security-Policy"] = "default-src 'none'; sandbox";
+			headers["X-Frame-Options"] = "DENY";
+		} else headers["Content-Type"] = mimeType;
+		return new Response(bytes, {
+			status: 200,
+			headers
+		});
+	}
+}
+
+//#endregion
+export { RAW_MAX_BYTES_DEFAULT, createAfsRawHandler };
+//# sourceMappingURL=afs-raw.mjs.map

package/dist/http/afs-raw.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"afs-raw.mjs","names":[],"sources":["../../src/http/afs-raw.ts"],"sourcesContent":["/**\n * `GET /api/afs/raw` — raw-bytes endpoint (afs-preview T2.1, design §3).\n *\n * Lets `<img>` / `<iframe>` / `<video>` reference AFS content that is too\n * large to inline as a data URL. AFS-Only I/O: the handler speaks ONLY the\n * scoped AFS API (`stat` + `read`) — never CAS/R2/disk.\n *\n * TWO auth modes (afs-raw cookie mode):\n *   - SIGNED (sig query present): a bearer URL whose HMAC binds\n *     path+sid+caller+blocklet (raw-url.ts). The ONLY mode that can serve an\n *     anonymous caller or a cookie-less context — sandboxed PDF iframe (no\n *     `allow-same-origin` ⇒ null origin ⇒ no cookie), cross-origin embeds,\n *     public share links. Issued server-side because signing needs the secret.\n *   - COOKIE (no sig): a same-origin AUTHENTICATED GET — feed/list `<img>`\n *     cards. Identity is the verified session cookie (resolveCaller); the\n *     scoped `/user` overlay grants the SAME read authz as afs-rpc, so no\n *     bearer URL is minted. `SameSite=Lax` on the session cookie means a\n *     cross-site subresource (`<img>` from another origin) carries NO cookie ⇒\n *     401/403, so this can't be hotlinked/CSRF'd; and the only cross-site case\n *     Lax DOES allow (top-level nav) only ever exposes the caller's OWN `/user`\n *     space to themselves. Anonymous (no cookie) is refused here — an\n *     unauthenticated reader must use a signed URL. No per-render server\n *     pre-signing, no `exp` churn ⇒ the URL is stable (cacheable later).\n *\n * Processing order (the contract — every step fail-closed):\n *   1. method gate (GET) → 405\n *   2. signing secret present? → else 503 (no signing = no endpoint)\n *   3. cookie caller resolution (anonymous OK in SIGNED mode — symmetry is\n *      enforced by the signature, see raw-url.ts)\n *   4. auth: SIGNED → `verifyRawUrl` (sig/exp/caller-binding/anonymous-\n *      private-path) any failure → 403; COOKIE → require non-anonymous caller\n *      (else 403) + `?path=` (else 400)\n *   5. `sanitizeAfsPath` (single shared entry — no local normalize/reorder)\n *      → 400\n *   6. blocklet resolution (query/host alias/first-label) → 400\n *   7. scoped AFS via the shared request-context helper. SIGNED passes the\n *      EXPLICIT signature-verified sessionId (never a `rpc-<blocklet>`-style\n *      fallback); COOKIE passes null (the `/user` overlay keys on caller.did)\n *   8a. media-302 (preview-r2-direct): MEDIA (image/video/audio) over\n *       `RAW_REDIRECT_MIN_BYTES` with a presign-capable scoped AFS → 302 to a\n *       presigned R2 GET. Runs AFTER the size-validity check but BEFORE the\n *       `maxBytes` cap (cap-exempt — R2's ceiling is the object size); the\n *       worker never buffers these bytes. Falls through to 8b on null.\n *   8b. `afs.stat` size cap — over `maxBytes` → 413 BEFORE any read; size\n *      missing → conservative 413 (read-after-judge would defeat the memory\n *      guardrail)\n *   9. `afs.read` → bytes → response with `Content-Type` (meta.mimeType,\n *      fallback shared detectMimeType), `X-Content-Type-Options: nosniff`\n *      (mandatory — binary serving endpoint), `Cache-Control: private,\n *      no-store`. #818: a CLIENT-DECLARED browser-scriptable type\n *      (`isScriptableMimeType`: text/html, image/svg+xml, xml, JS variants) is\n *      NEVER served inline — forced to `application/octet-stream` +\n *      `Content-Disposition: attachment` + CSP sandbox + `X-Frame-Options: DENY`\n *      (nosniff alone can't stop a genuinely-declared scriptable type executing).\n *\n * Cache semantics: this handler owns its OWN request-context instance —\n * code shared with afs-rpc, runtime state (projection cache) NOT shared.\n */\n\nimport { sanitizeAfsPath } from \"@aigne/afs\";\nimport { detectMimeType } from \"@aigne/afs-provider-utils\";\nimport { statusForError } from \"./afs-rpc.js\";\nimport { verifyRawUrl } from \"./raw-url.js\";\nimport { type AfsRequestContextOptions, createAfsRequestContext } from \"./request-context.js\";\n\n/**\n * Default max served size — 100 MiB (413 above; streaming/Range is a separate\n * project). upload-limits Phase 6 (D4 interim): raised 50→100 MiB to ALIGN with\n * the grant upload cap (`AFS_DID_SPACE_UPLOAD_MAX_BYTES`, 100 MiB) so a file the\n * upload plane accepts can be raw-served, closing the G4 upload/serve asymmetry\n * for the worker-serve path. This is the NODE/default ceiling (Node can buffer\n * 100 MiB once). It is NOT runtime-uniform: the CF Worker passes a much smaller\n * `maxBytes` (~4 MiB, preview-r2-direct's runtime-aware clean-413) because a\n * one-shot read of ≳8 MiB OOMs the worker (Error 1102 → 503); CF non-media over\n * that gets a CLEAN 413 (never a crash), and CF MEDIA over the gate is exempt via\n * the 302→R2-direct path above. The 50→100 doubling of one-shot read memory on\n * Node is the known interim cost; true large serve needs streaming/Range.\n */\nexport const RAW_MAX_BYTES_DEFAULT = 100 * 1024 * 1024;\n\n/**\n * Media over this size redirect (302) to a presigned object-store GET instead of\n * being served by the worker (preview-r2-direct §4 / Review-B). v1 = 32 KB, locked\n * equal to `PREVIEW_IMAGE_INLINE_MAX` (the user-locked \"> 32 KB → R2-direct\"\n * decision; maximizes worker-offload). The correctness floor is the worker cliff\n * (~4–8 MiB); anything below is a worker-offload-vs-first-byte-latency CHOICE, and\n * a future raise is a measurement-gated, OPTIONAL post-ship activity — NOT a gate.\n */\nexport const RAW_REDIRECT_MIN_BYTES = 32 * 1024;\n\n/**\n * The 302 path is MEDIA-ONLY (preview-r2-direct §5 / Review-1): only `image/*`,\n * `video/*`, `audio/*` are script-safe to redirect cross-origin to R2 (the\n * presigned URL drops `nosniff`; a media element never executes mislabeled\n * bytes). SVG (`image/svg+xml`) matches `image/*` here but is EXCLUDED from the\n * redirect at the call site via `isScriptableMimeType` (#818 supersedes the old\n * Review-A \"SVG rides image/*\" behavior): a scripted SVG is browser-scriptable,\n * so it falls through to worker-serve, which forces a safe attachment. PDF/HTML/\n * text MUST stay on the worker (iframe `noSandbox`/`_isSameOriginUrl` depends on\n * same-origin + nosniff; text is client-rendered → `fetch` → CORS-gated).\n */\nfunction isRedirectableMediaType(mime: string): boolean {\n  const m = mime.toLowerCase();\n  return m.startsWith(\"image/\") || m.startsWith(\"video/\") || m.startsWith(\"audio/\");\n}\n\n/**\n * Browser-scriptable MIME types (#818). `meta.mimeType` is CLIENT-CONTROLLED —\n * any writer can declare it, there is no write-side allowlist, and this endpoint\n * serves anonymous bearer URLs (public share links). If we echo a declared\n * scriptable type as an inline `Content-Type`, the bytes execute in the serving\n * origin → stored XSS. `X-Content-Type-Options: nosniff` does NOT help here: it\n * only stops sniffing of MIS-labeled bytes; a GENUINELY-declared `text/html`\n * (or scripted `image/svg+xml`) still runs. So at the serve boundary — the\n * provider-agnostic place — these are forced to a non-executing disposition\n * (octet-stream + `Content-Disposition: attachment`) and can never render inline.\n *\n * SVG is included: rendered inline (top-level nav / `<embed>`/`<object>`) a\n * scripted SVG executes same-origin. It is ALSO excluded from the 302→R2 media\n * redirect below (falls through to worker-serve, which forces attachment).\n */\nconst SCRIPTABLE_MIME_TYPES = new Set([\n  \"text/html\",\n  \"application/xhtml+xml\",\n  \"image/svg+xml\",\n  \"text/xml\",\n  \"application/xml\",\n  \"text/javascript\",\n  \"application/javascript\",\n  \"application/x-javascript\",\n  \"text/ecmascript\",\n  \"application/ecmascript\",\n  \"application/x-ecmascript\",\n]);\n\n/** True when a MIME type can execute script if rendered inline (#818). */\nfunction isScriptableMimeType(mime: string): boolean {\n  // Parse the base type: lowercase, drop any `; charset=…` parameter, trim.\n  const base = mime.toLowerCase().split(\";\", 1)[0]?.trim() ?? \"\";\n  return SCRIPTABLE_MIME_TYPES.has(base);\n}\n\n/**\n * A header-safe `filename` for `Content-Disposition: attachment` (#818). The\n * path is already `sanitizeAfsPath`-clean (no traversal), but strip quotes /\n * backslashes / CR-LF defensively so the value can never break out of the\n * header or inject a second directive.\n */\nfunction attachmentFilename(path: string): string {\n  const base = path.split(\"/\").pop() || \"download\";\n  return base.replace(/[\"\\\\\\r\\n]/g, \"_\") || \"download\";\n}\n\nexport interface AfsRawHandlerOptions extends AfsRequestContextOptions {\n  /**\n   * HMAC secret for signed raw URLs (Node: vault-derived; CF: env secret).\n   * ABSENT → every request answers 503 (fail-closed: no key, no endpoint —\n   * never an unsigned/degraded mode).\n   */\n  rawUrlSecret?: string | Uint8Array;\n  /** Size cap in bytes (default 50MB). */\n  maxBytes?: number;\n}\n\nconst RAW_HEADERS_BASE = {\n  // Mandatory (design §3): without nosniff, browsers may MIME-sniff\n  // mislabeled HTML content into executing as HTML/JS.\n  \"X-Content-Type-Options\": \"nosniff\",\n  \"Cache-Control\": \"private, no-store\",\n} as const;\n\nfunction deny(status: number, text: string): Response {\n  return new Response(text, {\n    status,\n    headers: { ...RAW_HEADERS_BASE, \"Content-Type\": \"text/plain; charset=utf-8\" },\n  });\n}\n\n/** Normalize an AFS read result's content to raw bytes. Null = no bytes. */\nfunction contentToBytes(content: unknown, encoding?: string): Uint8Array | null {\n  if (content instanceof Uint8Array) return content;\n  if (content instanceof ArrayBuffer) return new Uint8Array(content);\n  if (typeof content === \"string\") {\n    if (encoding === \"base64\") {\n      try {\n        return Uint8Array.from(atob(content), (c) => c.charCodeAt(0));\n      } catch {\n        return null;\n      }\n    }\n    return new TextEncoder().encode(content);\n  }\n  return null;\n}\n\nexport function createAfsRawHandler(\n  options: AfsRawHandlerOptions,\n): (request: Request) => Promise<Response> {\n  // Own instance — never share the rpc handler's projection cache (§3).\n  const reqCtx = createAfsRequestContext(options);\n  const maxBytes = options.maxBytes ?? RAW_MAX_BYTES_DEFAULT;\n\n  return async function handleRaw(request: Request): Promise<Response> {\n    try {\n      return await handleInner(request);\n    } catch (err) {\n      // workerd treats unhandled rejections as fatal isolate errors.\n      return deny(statusForError(err), \"Internal error\");\n    }\n  };\n\n  async function handleInner(request: Request): Promise<Response> {\n    if (request.method !== \"GET\") return deny(405, \"Method Not Allowed (use GET)\");\n\n    const secret = options.rawUrlSecret;\n    if (!secret || (typeof secret === \"string\" && secret.length === 0)) {\n      // Fail-closed: a deployment without the signing key serves nothing.\n      return deny(503, \"raw endpoint unavailable (signing key not configured)\");\n    }\n\n    // Cookie caller (anonymous allowed) — used by both auth modes.\n    const caller = await reqCtx.resolveCaller(request);\n    const callerDid = caller?.did ?? null;\n\n    // Two auth modes (see file header). SIGNED when a `sig` rides the URL;\n    // COOKIE otherwise (same-origin authenticated GET, identity = cookie).\n    const url = new URL(request.url);\n    const hasSignature = url.searchParams.has(\"sig\");\n\n    let rawPath: string;\n    let sessionId: string | null;\n    let signedBlocklet: string | null;\n\n    if (hasSignature) {\n      const verdict = await verifyRawUrl(request, callerDid, { secret });\n      if (!verdict.ok) {\n        // Uniform 403: no distinction between missing/tampered/expired/\n        // mismatched — reasons stay in logs/tests, not responses.\n        return deny(403, \"Forbidden\");\n      }\n      rawPath = verdict.path;\n      // EXPLICIT signature-verified sessionId — by construction non-null here,\n      // so no `?? \"rpc-<blocklet>\"`-style fallback can engage.\n      sessionId = verdict.sessionId;\n      // Signature-bound blocklet wins (the issuer baked the session's blocklet\n      // into the URL + HMAC); query/host resolution is the fallback below.\n      signedBlocklet = verdict.blocklet;\n    } else {\n      // COOKIE mode: an authenticated caller is mandatory — an anonymous reader\n      // gets nothing here (must use a signed URL). The scoped `/user` overlay\n      // (keyed on caller.did) enforces the SAME read authz as afs-rpc, so this\n      // grants no access the cookie didn't already have.\n      if (!callerDid) return deny(403, \"Forbidden\");\n      const qPath = url.searchParams.get(\"path\");\n      if (!qPath) return deny(400, \"Invalid path\");\n      rawPath = qPath;\n      sessionId = null;\n      signedBlocklet = url.searchParams.get(\"blocklet\");\n    }\n\n    // Single shared sanitizer entry — the handler must not normalize or\n    // reorder around it (design §2.3).\n    const safePath = sanitizeAfsPath(rawPath);\n    if (safePath === null) return deny(400, \"Invalid path\");\n\n    const blocklet = await reqCtx.resolveBlocklet(request, signedBlocklet);\n    if (!blocklet) return deny(400, \"Could not resolve blocklet\");\n\n    const scoped = await reqCtx.resolveScoped(request, {\n      blocklet,\n      sessionId,\n      caller,\n    });\n\n    if (!scoped.afs.stat || !scoped.afs.read) {\n      return deny(501, \"stat/read not supported\");\n    }\n\n    // stat-before-read: the size cap must hold BEFORE bytes are pulled.\n    const statResult = await scoped.afs.stat(safePath, { context: scoped.context });\n    const statData = (statResult?.data ?? {}) as {\n      size?: unknown;\n      meta?: Record<string, unknown>;\n    };\n    const meta = statData.meta ?? {};\n    const size =\n      typeof statData.size === \"number\"\n        ? statData.size\n        : typeof meta.size === \"number\"\n          ? (meta.size as number)\n          : undefined;\n    if (typeof size !== \"number\" || !Number.isFinite(size) || size < 0) {\n      // Conservative rejection (design §3): an unbounded read defeats the cap.\n      return deny(413, \"Content size unknown\");\n    }\n\n    // mimeType from stat (hoisted before read for the 302 decision, T2.3): the\n    // load-bearing input both for \"is this redirectable media\" and the signed\n    // `response-content-type` baked into the presigned URL (Review-1).\n    const statMimeType =\n      (typeof meta.mimeType === \"string\" && meta.mimeType) ||\n      detectMimeType(safePath) ||\n      \"application/octet-stream\";\n\n    // 302 → R2-direct (preview-r2-direct §2 / Review-1/5): MEDIA over the gate,\n    // when the scoped AFS can presign. This runs BEFORE the `size > maxBytes`\n    // 413 (Review-5) so large media (the exact thing the 302 exists for) is\n    // EXEMPT from the worker-serve cap — R2's ceiling is the object size. The\n    // worker NEVER buffers these bytes. presignRead returns null (no signer /\n    // non-CAS / meta / unresolved) → natural fall-through to worker-serve;\n    // wrapped defensively so a presign error can never 500 the handler.\n    if (\n      size > RAW_REDIRECT_MIN_BYTES &&\n      isRedirectableMediaType(statMimeType) &&\n      // #818: a scripted SVG rides the `image/*` branch — never redirect it\n      // (it falls through to worker-serve, which forces a safe attachment).\n      !isScriptableMimeType(statMimeType) &&\n      typeof scoped.afs.presignRead === \"function\"\n    ) {\n      let grant: { url: string; expiresAt: string } | null = null;\n      try {\n        grant = await scoped.afs.presignRead(safePath, { responseContentType: statMimeType });\n      } catch {\n        grant = null;\n      }\n      if (grant) {\n        return new Response(null, {\n          status: 302,\n          headers: {\n            Location: grant.url,\n            // Review-8: the 302 carries a BEARER presigned Location — don't let a\n            // shared/browser cache retain it, and don't leak the signed URL (with\n            // its X-Amz-Signature) via Referer on the redirected request. nosniff\n            // is irrelevant on a bodyless 302 (media safety lives in §5/Review-1).\n            \"Cache-Control\": \"private, no-store\",\n            \"Referrer-Policy\": \"no-referrer\",\n          },\n        });\n      }\n    }\n\n    if (size > maxBytes) return deny(413, \"Content too large\");\n\n    const readResult = await scoped.afs.read(safePath, { context: scoped.context });\n    const data = (readResult?.data ?? {}) as {\n      content?: unknown;\n      encoding?: string;\n      meta?: Record<string, unknown>;\n    };\n    // Base64 marker rides different fields per provider: wire-contract §5\n    // uses `encoding`, the fs provider uses `meta.contentType` (\"base64\").\n    const encoding =\n      data.encoding ??\n      (data.meta?.contentType === \"base64\" || data.meta?.encoding === \"base64\"\n        ? \"base64\"\n        : undefined);\n    const bytes = contentToBytes(data.content, encoding);\n    if (!bytes) return deny(404, \"No content\");\n\n    const mimeType =\n      (typeof meta.mimeType === \"string\" && meta.mimeType) ||\n      (typeof data.meta?.mimeType === \"string\" && (data.meta.mimeType as string)) ||\n      detectMimeType(safePath) ||\n      \"application/octet-stream\";\n\n    // #818: never render a client-declared scriptable type inline. Force it to a\n    // non-executing download (octet-stream + attachment) + defense-in-depth CSP /\n    // frame denial. Legit inline types (image except SVG, pdf, text/plain, video,\n    // audio) are untouched — including the sandboxed-PDF-iframe path (no\n    // X-Frame-Options is added to those, so same-origin embedding still works).\n    const headers: Record<string, string> = {\n      ...RAW_HEADERS_BASE,\n      \"Content-Length\": String(bytes.length),\n    };\n    if (isScriptableMimeType(mimeType)) {\n      headers[\"Content-Type\"] = \"application/octet-stream\";\n      headers[\"Content-Disposition\"] = `attachment; filename=\"${attachmentFilename(safePath)}\"`;\n      // Belt-and-suspenders: even if a client ignores the disposition, box it.\n      headers[\"Content-Security-Policy\"] = \"default-src 'none'; sandbox\";\n      headers[\"X-Frame-Options\"] = \"DENY\";\n    } else {\n      headers[\"Content-Type\"] = mimeType;\n    }\n\n    return new Response(bytes as unknown as BodyInit, {\n      status: 200,\n      headers,\n    });\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA8EA,MAAa,wBAAwB,MAAM,OAAO;;;;;;;;;AAUlD,MAAa,yBAAyB,KAAK;;;;;;;;;;;;AAa3C,SAAS,wBAAwB,MAAuB;CACtD,MAAM,IAAI,KAAK,aAAa;AAC5B,QAAO,EAAE,WAAW,SAAS,IAAI,EAAE,WAAW,SAAS,IAAI,EAAE,WAAW,SAAS;;;;;;;;;;;;;;;;;AAkBnF,MAAM,wBAAwB,IAAI,IAAI;CACpC;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACD,CAAC;;AAGF,SAAS,qBAAqB,MAAuB;CAEnD,MAAM,OAAO,KAAK,aAAa,CAAC,MAAM,KAAK,EAAE,CAAC,IAAI,MAAM,IAAI;AAC5D,QAAO,sBAAsB,IAAI,KAAK;;;;;;;;AASxC,SAAS,mBAAmB,MAAsB;AAEhD,SADa,KAAK,MAAM,IAAI,CAAC,KAAK,IAAI,YAC1B,QAAQ,cAAc,IAAI,IAAI;;AAc5C,MAAM,mBAAmB;CAGvB,0BAA0B;CAC1B,iBAAiB;CAClB;AAED,SAAS,KAAK,QAAgB,MAAwB;AACpD,QAAO,IAAI,SAAS,MAAM;EACxB;EACA,SAAS;GAAE,GAAG;GAAkB,gBAAgB;GAA6B;EAC9E,CAAC;;;AAIJ,SAAS,eAAe,SAAkB,UAAsC;AAC9E,KAAI,mBAAmB,WAAY,QAAO;AAC1C,KAAI,mBAAmB,YAAa,QAAO,IAAI,WAAW,QAAQ;AAClE,KAAI,OAAO,YAAY,UAAU;AAC/B,MAAI,aAAa,SACf,KAAI;AACF,UAAO,WAAW,KAAK,KAAK,QAAQ,GAAG,MAAM,EAAE,WAAW,EAAE,CAAC;UACvD;AACN,UAAO;;AAGX,SAAO,IAAI,aAAa,CAAC,OAAO,QAAQ;;AAE1C,QAAO;;AAGT,SAAgB,oBACd,SACyC;CAEzC,MAAM,SAAS,wBAAwB,QAAQ;CAC/C,MAAM,WAAW,QAAQ,YAAY;AAErC,QAAO,eAAe,UAAU,SAAqC;AACnE,MAAI;AACF,UAAO,MAAM,YAAY,QAAQ;WAC1B,KAAK;AAEZ,UAAO,KAAK,eAAe,IAAI,EAAE,iBAAiB;;;CAItD,eAAe,YAAY,SAAqC;AAC9D,MAAI,QAAQ,WAAW,MAAO,QAAO,KAAK,KAAK,+BAA+B;EAE9E,MAAM,SAAS,QAAQ;AACvB,MAAI,CAAC,UAAW,OAAO,WAAW,YAAY,OAAO,WAAW,EAE9D,QAAO,KAAK,KAAK,wDAAwD;EAI3E,MAAM,SAAS,MAAM,OAAO,cAAc,QAAQ;EAClD,MAAM,YAAY,QAAQ,OAAO;EAIjC,MAAM,MAAM,IAAI,IAAI,QAAQ,IAAI;EAChC,MAAM,eAAe,IAAI,aAAa,IAAI,MAAM;EAEhD,IAAI;EACJ,IAAI;EACJ,IAAI;AAEJ,MAAI,cAAc;GAChB,MAAM,UAAU,MAAM,aAAa,SAAS,WAAW,EAAE,QAAQ,CAAC;AAClE,OAAI,CAAC,QAAQ,GAGX,QAAO,KAAK,KAAK,YAAY;AAE/B,aAAU,QAAQ;AAGlB,eAAY,QAAQ;AAGpB,oBAAiB,QAAQ;SACpB;AAKL,OAAI,CAAC,UAAW,QAAO,KAAK,KAAK,YAAY;GAC7C,MAAM,QAAQ,IAAI,aAAa,IAAI,OAAO;AAC1C,OAAI,CAAC,MAAO,QAAO,KAAK,KAAK,eAAe;AAC5C,aAAU;AACV,eAAY;AACZ,oBAAiB,IAAI,aAAa,IAAI,WAAW;;EAKnD,MAAM,WAAW,gBAAgB,QAAQ;AACzC,MAAI,aAAa,KAAM,QAAO,KAAK,KAAK,eAAe;EAEvD,MAAM,WAAW,MAAM,OAAO,gBAAgB,SAAS,eAAe;AACtE,MAAI,CAAC,SAAU,QAAO,KAAK,KAAK,6BAA6B;EAE7D,MAAM,SAAS,MAAM,OAAO,cAAc,SAAS;GACjD;GACA;GACA;GACD,CAAC;AAEF,MAAI,CAAC,OAAO,IAAI,QAAQ,CAAC,OAAO,IAAI,KAClC,QAAO,KAAK,KAAK,0BAA0B;EAK7C,MAAM,YADa,MAAM,OAAO,IAAI,KAAK,UAAU,EAAE,SAAS,OAAO,SAAS,CAAC,GACjD,QAAQ,EAAE;EAIxC,MAAM,OAAO,SAAS,QAAQ,EAAE;EAChC,MAAM,OACJ,OAAO,SAAS,SAAS,WACrB,SAAS,OACT,OAAO,KAAK,SAAS,WAClB,KAAK,OACN;AACR,MAAI,OAAO,SAAS,YAAY,CAAC,OAAO,SAAS,KAAK,IAAI,OAAO,EAE/D,QAAO,KAAK,KAAK,uBAAuB;EAM1C,MAAM,eACH,OAAO,KAAK,aAAa,YAAY,KAAK,YAC3C,eAAe,SAAS,IACxB;AASF,MACE,OAAO,0BACP,wBAAwB,aAAa,IAGrC,CAAC,qBAAqB,aAAa,IACnC,OAAO,OAAO,IAAI,gBAAgB,YAClC;GACA,IAAI,QAAmD;AACvD,OAAI;AACF,YAAQ,MAAM,OAAO,IAAI,YAAY,UAAU,EAAE,qBAAqB,cAAc,CAAC;WAC/E;AACN,YAAQ;;AAEV,OAAI,MACF,QAAO,IAAI,SAAS,MAAM;IACxB,QAAQ;IACR,SAAS;KACP,UAAU,MAAM;KAKhB,iBAAiB;KACjB,mBAAmB;KACpB;IACF,CAAC;;AAIN,MAAI,OAAO,SAAU,QAAO,KAAK,KAAK,oBAAoB;EAG1D,MAAM,QADa,MAAM,OAAO,IAAI,KAAK,UAAU,EAAE,SAAS,OAAO,SAAS,CAAC,GACrD,QAAQ,EAAE;EAOpC,MAAM,WACJ,KAAK,aACJ,KAAK,MAAM,gBAAgB,YAAY,KAAK,MAAM,aAAa,WAC5D,WACA;EACN,MAAM,QAAQ,eAAe,KAAK,SAAS,SAAS;AACpD,MAAI,CAAC,MAAO,QAAO,KAAK,KAAK,aAAa;EAE1C,MAAM,WACH,OAAO,KAAK,aAAa,YAAY,KAAK,YAC1C,OAAO,KAAK,MAAM,aAAa,YAAa,KAAK,KAAK,YACvD,eAAe,SAAS,IACxB;EAOF,MAAM,UAAkC;GACtC,GAAG;GACH,kBAAkB,OAAO,MAAM,OAAO;GACvC;AACD,MAAI,qBAAqB,SAAS,EAAE;AAClC,WAAQ,kBAAkB;AAC1B,WAAQ,yBAAyB,yBAAyB,mBAAmB,SAAS,CAAC;AAEvF,WAAQ,6BAA6B;AACrC,WAAQ,qBAAqB;QAE7B,SAAQ,kBAAkB;AAG5B,SAAO,IAAI,SAAS,OAA8B;GAChD,QAAQ;GACR;GACD,CAAC"}

package/dist/http/afs-rest.cjs

@@ -0,0 +1,30 @@
+let _aigne_afs_http = require("@aigne/afs-http");
+
+//#region src/http/afs-rest.ts
+/** Delegating wrapper — Object.create doesn't work because AFS uses private class fields. */
+function createAFSModuleWrapper(afs, context) {
+	const withCtx = (options) => context ? Object.assign({}, options, { context }) : options;
+	return {
+		name: afs.name ?? "afs",
+		accessMode: "readwrite",
+		list: (path, options) => afs.list(path, withCtx(options)),
+		read: (path, options) => afs.read(path, withCtx(options)),
+		write: (path, content, options) => afs.write(path, content, withCtx(options)),
+		delete: (path, options) => afs.delete(path, withCtx(options)),
+		search: (path, query, options) => afs.search(path, query, withCtx(options)),
+		stat: (path, options) => afs.stat(path, withCtx(options)),
+		explain: (path, options) => afs.explain(path, withCtx(options)),
+		exec: (path, args, options) => afs.exec(path, args, withCtx(options)),
+		rename: (oldPath, newPath, options) => afs.rename(oldPath, newPath, withCtx(options))
+	};
+}
+function createAFSRestHandler(afs, options) {
+	return (0, _aigne_afs_http.createAFSHttpHandler)({
+		module: createAFSModuleWrapper(afs, options?.context),
+		token: options?.token,
+		maxBodySize: options?.maxBodySize
+	});
+}
+
+//#endregion
+exports.createAFSRestHandler = createAFSRestHandler;

package/dist/http/afs-rest.d.cts

@@ -0,0 +1,21 @@
+import { AFS, AFSContext } from "@aigne/afs";
+
+//#region src/http/afs-rest.d.ts
+interface AFSRestOptions {
+  token?: string;
+  /** Max request body size in bytes (default: 10MB) */
+  maxBodySize?: number;
+  /**
+   * Trusted op context forced onto every AFS call. The runtime sets this AFTER
+   * it has verified a network caller: it OVERRIDES any client-supplied
+   * `options.context`, so a caller can't forge caller / instanceDid /
+   * callerOrigin, and the stamped `callerOrigin: "network"` makes the exec-effect
+   * and write gates engage. Left unset for the loopback operator and in-process
+   * tests, where the client's options pass through unchanged.
+   */
+  context?: AFSContext;
+}
+declare function createAFSRestHandler(afs: AFS, options?: AFSRestOptions): (request: Request) => Promise<Response>;
+//#endregion
+export { AFSRestOptions, createAFSRestHandler };
+//# sourceMappingURL=afs-rest.d.cts.map

package/dist/http/afs-rest.d.cts.map

@@ -0,0 +1 @@
+{"version":3,"file":"afs-rest.d.cts","names":[],"sources":["../../src/http/afs-rest.ts"],"mappings":";;;UASiB,cAAA;EACf,KAAA;EAEA;EAAA,WAAA;EASU;;;AAyBZ;;;;;EAzBE,OAAA,GAAU,UAAA;AAAA;AAAA,iBAyBI,oBAAA,CACd,GAAA,EAAK,GAAA,EACL,OAAA,GAAU,cAAA,IACR,OAAA,EAAS,OAAA,KAAY,OAAA,CAAQ,QAAA"}

package/dist/http/afs-rest.d.mts

@@ -0,0 +1,21 @@
+import { AFS, AFSContext } from "@aigne/afs";
+
+//#region src/http/afs-rest.d.ts
+interface AFSRestOptions {
+  token?: string;
+  /** Max request body size in bytes (default: 10MB) */
+  maxBodySize?: number;
+  /**
+   * Trusted op context forced onto every AFS call. The runtime sets this AFTER
+   * it has verified a network caller: it OVERRIDES any client-supplied
+   * `options.context`, so a caller can't forge caller / instanceDid /
+   * callerOrigin, and the stamped `callerOrigin: "network"` makes the exec-effect
+   * and write gates engage. Left unset for the loopback operator and in-process
+   * tests, where the client's options pass through unchanged.
+   */
+  context?: AFSContext;
+}
+declare function createAFSRestHandler(afs: AFS, options?: AFSRestOptions): (request: Request) => Promise<Response>;
+//#endregion
+export { AFSRestOptions, createAFSRestHandler };
+//# sourceMappingURL=afs-rest.d.mts.map

package/dist/http/afs-rest.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"afs-rest.d.mts","names":[],"sources":["../../src/http/afs-rest.ts"],"mappings":";;;UASiB,cAAA;EACf,KAAA;EAEA;EAAA,WAAA;EASU;;;AAyBZ;;;;;EAzBE,OAAA,GAAU,UAAA;AAAA;AAAA,iBAyBI,oBAAA,CACd,GAAA,EAAK,GAAA,EACL,OAAA,GAAU,cAAA,IACR,OAAA,EAAS,OAAA,KAAY,OAAA,CAAQ,QAAA"}

package/dist/http/afs-rest.mjs

@@ -0,0 +1,31 @@
+import { createAFSHttpHandler } from "@aigne/afs-http";
+
+//#region src/http/afs-rest.ts
+/** Delegating wrapper — Object.create doesn't work because AFS uses private class fields. */
+function createAFSModuleWrapper(afs, context) {
+	const withCtx = (options) => context ? Object.assign({}, options, { context }) : options;
+	return {
+		name: afs.name ?? "afs",
+		accessMode: "readwrite",
+		list: (path, options) => afs.list(path, withCtx(options)),
+		read: (path, options) => afs.read(path, withCtx(options)),
+		write: (path, content, options) => afs.write(path, content, withCtx(options)),
+		delete: (path, options) => afs.delete(path, withCtx(options)),
+		search: (path, query, options) => afs.search(path, query, withCtx(options)),
+		stat: (path, options) => afs.stat(path, withCtx(options)),
+		explain: (path, options) => afs.explain(path, withCtx(options)),
+		exec: (path, args, options) => afs.exec(path, args, withCtx(options)),
+		rename: (oldPath, newPath, options) => afs.rename(oldPath, newPath, withCtx(options))
+	};
+}
+function createAFSRestHandler(afs, options) {
+	return createAFSHttpHandler({
+		module: createAFSModuleWrapper(afs, options?.context),
+		token: options?.token,
+		maxBodySize: options?.maxBodySize
+	});
+}
+
+//#endregion
+export { createAFSRestHandler };
+//# sourceMappingURL=afs-rest.mjs.map

package/dist/http/afs-rest.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"afs-rest.mjs","names":[],"sources":["../../src/http/afs-rest.ts"],"sourcesContent":["/**\n * AOS AFS REST Handler\n *\n * Bridges AFS to HTTP transport via @aigne/afs-http.\n */\n\nimport type { AFS, AFSContext, AFSModule } from \"@aigne/afs\";\nimport { createAFSHttpHandler } from \"@aigne/afs-http\";\n\nexport interface AFSRestOptions {\n  token?: string;\n  /** Max request body size in bytes (default: 10MB) */\n  maxBodySize?: number;\n  /**\n   * Trusted op context forced onto every AFS call. The runtime sets this AFTER\n   * it has verified a network caller: it OVERRIDES any client-supplied\n   * `options.context`, so a caller can't forge caller / instanceDid /\n   * callerOrigin, and the stamped `callerOrigin: \"network\"` makes the exec-effect\n   * and write gates engage. Left unset for the loopback operator and in-process\n   * tests, where the client's options pass through unchanged.\n   */\n  context?: AFSContext;\n}\n\n/** Delegating wrapper — Object.create doesn't work because AFS uses private class fields. */\nfunction createAFSModuleWrapper(afs: AFS, context?: AFSContext): AFSModule {\n  // When a trusted context is supplied (a verified network caller), force it\n  // onto every op so the client can't forge caller / instanceDid / callerOrigin;\n  // otherwise pass the caller's options through unchanged (loopback / tests).\n  const withCtx = <O>(options: O): O =>\n    context ? (Object.assign({}, options, { context }) as unknown as O) : options;\n  return {\n    name: afs.name ?? \"afs\",\n    accessMode: \"readwrite\",\n    list: (path, options) => afs.list(path, withCtx(options)),\n    read: (path, options) => afs.read(path, withCtx(options)),\n    write: (path, content, options) => afs.write(path, content, withCtx(options)),\n    delete: (path, options) => afs.delete(path, withCtx(options)),\n    search: (path, query, options) => afs.search(path, query, withCtx(options)),\n    stat: (path, options) => afs.stat(path, withCtx(options)),\n    explain: (path, options) => afs.explain(path, withCtx(options)),\n    exec: (path, args, options) => afs.exec(path, args, withCtx(options)),\n    rename: (oldPath, newPath, options) => afs.rename(oldPath, newPath, withCtx(options)),\n  };\n}\n\nexport function createAFSRestHandler(\n  afs: AFS,\n  options?: AFSRestOptions,\n): (request: Request) => Promise<Response> {\n  return createAFSHttpHandler({\n    module: createAFSModuleWrapper(afs, options?.context),\n    token: options?.token,\n    maxBodySize: options?.maxBodySize,\n  });\n}\n"],"mappings":";;;;AAyBA,SAAS,uBAAuB,KAAU,SAAiC;CAIzE,MAAM,WAAc,YAClB,UAAW,OAAO,OAAO,EAAE,EAAE,SAAS,EAAE,SAAS,CAAC,GAAoB;AACxE,QAAO;EACL,MAAM,IAAI,QAAQ;EAClB,YAAY;EACZ,OAAO,MAAM,YAAY,IAAI,KAAK,MAAM,QAAQ,QAAQ,CAAC;EACzD,OAAO,MAAM,YAAY,IAAI,KAAK,MAAM,QAAQ,QAAQ,CAAC;EACzD,QAAQ,MAAM,SAAS,YAAY,IAAI,MAAM,MAAM,SAAS,QAAQ,QAAQ,CAAC;EAC7E,SAAS,MAAM,YAAY,IAAI,OAAO,MAAM,QAAQ,QAAQ,CAAC;EAC7D,SAAS,MAAM,OAAO,YAAY,IAAI,OAAO,MAAM,OAAO,QAAQ,QAAQ,CAAC;EAC3E,OAAO,MAAM,YAAY,IAAI,KAAK,MAAM,QAAQ,QAAQ,CAAC;EACzD,UAAU,MAAM,YAAY,IAAI,QAAQ,MAAM,QAAQ,QAAQ,CAAC;EAC/D,OAAO,MAAM,MAAM,YAAY,IAAI,KAAK,MAAM,MAAM,QAAQ,QAAQ,CAAC;EACrE,SAAS,SAAS,SAAS,YAAY,IAAI,OAAO,SAAS,SAAS,QAAQ,QAAQ,CAAC;EACtF;;AAGH,SAAgB,qBACd,KACA,SACyC;AACzC,QAAO,qBAAqB;EAC1B,QAAQ,uBAAuB,KAAK,SAAS,QAAQ;EACrD,OAAO,SAAS;EAChB,aAAa,SAAS;EACvB,CAAC"}