@aigne/aos 0.2.0-beta

package/dist/http/request-context.d.mts

@@ -0,0 +1,76 @@
+import { BlockletScope } from "../scope/types.mjs";
+import { ResolveCallerFn, ResolveTrustedAfsContext } from "./auth-context.mjs";
+import { AFSRoot, CallerInfo } from "@aigne/afs";
+
+//#region src/http/request-context.d.ts
+interface AfsRequestContextOptions {
+  /** The runtime-global AFS (the projection's source). */
+  globalAFS: AFSRoot;
+  /** Roots passed to `extractBlockletFromHost` (e.g. `["afsd.io"]`). */
+  domainRoots?: string[];
+  /** Resolve a normalized Host hostname to a blocklet id (runtime alias map). */
+  resolveHostAlias?: (host: string) => Promise<string | undefined> | string | undefined;
+  /** Used when neither explicit value, query, nor Host header resolve a blocklet. */
+  fallbackBlocklet?: string;
+  /** Bound on how many distinct blocklet projections we keep in memory. */
+  projectionCacheLimit?: number;
+  /** Where the blocklet catalog lives in the global AFS. */
+  registryPath?: string;
+  /** Test seam / runtime adapter: override the projected-AFS factory. */
+  createBlockletAFS?: (blocklet: string, globalAFS: AFSRoot) => Promise<AFSRoot>;
+  /** Resolve a verified caller from the inbound request. */
+  resolveCaller?: ResolveCallerFn;
+  /** Resolve the trusted, host-controlled AFSContext slice. */
+  resolveTrustedAfsContext?: ResolveTrustedAfsContext;
+  /** Optional PER-REQUEST overlay (per-caller `/user`, per-session `/tmp`, …). */
+  overlayForRequest?: (baseAFS: AFSRoot, ctx: {
+    blocklet: string;
+    caller: CallerInfo | null;
+    sessionId: string | null;
+    scope: BlockletScope;
+    /**
+     * Host-resolved instanceDid (the trusted-context slice), present even for an
+     * ANONYMOUS caller. Use this — NOT `caller.instanceDid` — for the `/instance`
+     * partition key, so anonymous + bound-host reads land on the SAME tenant the
+     * WS / DO path uses (instance-resolve F-2).
+     */
+    instanceDid?: string;
+  }) => AFSRoot | Promise<AFSRoot>;
+}
+interface ScopedRequest {
+  blocklet: string;
+  scope: BlockletScope;
+  /** The per-request AFS view (cached base + uncached per-request overlay). */
+  afs: AFSRoot;
+  caller: CallerInfo | null;
+  /** Merged op context (caller + trusted slice + callerOrigin + requestId). */
+  context: Record<string, unknown>;
+}
+interface AfsRequestContext {
+  /**
+   * Resolve the target blocklet. The default treats explicitBlocklet as trusted
+   * (signed raw URLs); HTTP RPC passes explicitPriority:"fallback" so the
+   * server-resolved Host/alias wins over browser-provided hints.
+   */
+  resolveBlocklet(request: Request, explicitBlocklet?: string | null, opts?: {
+    explicitPriority?: "trusted" | "fallback";
+    queryPriority?: "trusted" | "fallback";
+  }): Promise<string | null>;
+  /**
+   * Build the per-request scoped view + op context. `sessionId` is the
+   * caller-supplied session identity (rpc: body.sessionId; raw: the
+   * signature-verified sid) — null means "no session".
+   */
+  resolveScoped(request: Request, args: {
+    blocklet: string;
+    sessionId: string | null;
+    caller: CallerInfo | null;
+    opOptions?: Record<string, unknown>;
+  }): Promise<ScopedRequest>;
+  /** Resolve the verified caller (or null when no resolver / anonymous). */
+  resolveCaller(request: Request): Promise<CallerInfo | null>;
+}
+declare function createAfsRequestContext(options: AfsRequestContextOptions): AfsRequestContext;
+//#endregion
+export { AfsRequestContext, AfsRequestContextOptions, ScopedRequest, createAfsRequestContext };
+//# sourceMappingURL=request-context.d.mts.map

package/dist/http/request-context.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"request-context.d.mts","names":[],"sources":["../../src/http/request-context.ts"],"mappings":";;;;;UAuDiB,wBAAA;EAcf;EAZA,SAAA,EAAW,OAAA;EAYuC;EAVlD,WAAA;EAU8D;EAR9D,gBAAA,IAAoB,IAAA,aAAiB,OAAA;EAUrC;EARA,gBAAA;EAUA;EARA,oBAAA;EAUA;EARA,YAAA;EASE;EAPF,iBAAA,IAAqB,QAAA,UAAkB,SAAA,EAAW,OAAA,KAAY,OAAA,CAAQ,OAAA;EAUlE;EARJ,aAAA,GAAgB,eAAA;EASZ;EAPJ,wBAAA,GAA2B,wBAAA;EAQhB;EANX,iBAAA,IACE,OAAA,EAAS,OAAA,EACT,GAAA;IACE,QAAA;IACA,MAAA,EAAQ,UAAA;IACR,SAAA;IACA,KAAA,EAAO,aAAA;IASmB;;AAGhC;;;;IALM,WAAA;EAAA,MAEC,OAAA,GAAU,OAAA,CAAQ,OAAA;AAAA;AAAA,UAGR,aAAA;EACf,QAAA;EACA,KAAA,EAAO,aAAA;EAAP;EAEA,GAAA,EAAK,OAAA;EACL,MAAA,EAAQ,UAAA;EADH;EAGL,OAAA,EAAS,MAAA;AAAA;AAAA,UAGM,iBAAA;EAHN;;;AAGX;;EAME,eAAA,CACE,OAAA,EAAS,OAAA,EACT,gBAAA,kBACA,IAAA;IACE,gBAAA;IACA,aAAA;EAAA,IAED,OAAA;EAWS;;;;;EALZ,aAAA,CACE,OAAA,EAAS,OAAA,EACT,IAAA;IACE,QAAA;IACA,SAAA;IACA,MAAA,EAAQ,UAAA;IACR,SAAA,GAAY,MAAA;EAAA,IAEb,OAAA,CAAQ,aAAA;EApBT;EAsBF,aAAA,CAAc,OAAA,EAAS,OAAA,GAAU,OAAA,CAAQ,UAAA;AAAA;AAAA,iBAiD3B,uBAAA,CAAwB,OAAA,EAAS,wBAAA,GAA2B,iBAAA"}

package/dist/http/request-context.mjs

@@ -0,0 +1,179 @@
+import { mergeCallerContext } from "./auth-context.mjs";
+import { readBlockletScope } from "../scope/read-blocklet-scope.mjs";
+import { joinURL } from "ufo";
+import { AFS, ProjectionProvider, extractBlockletFromHost, nsLog } from "@aigne/afs";
+import { getLogContext } from "@aigne/afs-logger";
+import { getTiming, time, timeMeta } from "@aigne/afs-timing";
+
+//#region src/http/request-context.ts
+/**
+* Shared HTTP request-context + scoped-AFS helper (afs-preview T2.0).
+*
+* `createAfsRpcHandler` historically封装ed blocklet/host resolution, the
+* per-blocklet projection cache, caller/trusted-context resolution, and the
+* per-request overlay inside one closure — unreachable for the raw-bytes
+* endpoint. This module extracts that pipeline so RPC and raw share ONE
+* implementation (copying an incomplete auth/overlay stack = permission
+* bypass; the HTTP/WS dual-overlay lesson).
+*
+* CACHE SEMANTICS (pinned, design §3): the projection cache is
+* PER-HELPER-INSTANCE. rpc and raw each instantiate their own helper —
+* shared code, NOT shared runtime state. raw must never reach into rpc's
+* cache.
+*
+* SESSION ID: `resolveScoped` takes an EXPLICIT `sessionId` parameter. The
+* raw endpoint passes the signature-verified sid; it never flows through
+* any `sessionId ?? "rpc-<blocklet>"` fallback (that fallback lives in the
+* CF rpc overlay closure and stays rpc-only).
+*/
+/** afs:auth structured logger (debug self-guards; off by default). */
+const authLog = nsLog("afs:auth");
+const DEFAULT_PROJECTION_CACHE_LIMIT = 32;
+const DEFAULT_REGISTRY_PATH = "/registry/blocklets";
+/**
+* Ops the default read-only blocklet projection allows through. Superset of
+* the request-type vocabulary: `query` is a read-class SEMANTIC op (judged by
+* `semanticOpForRootAction` when `/.actions/query` rides exec) but NOT a wire
+* op — requests still arrive as `type: "exec"` (zero protocol change,
+* design §3.1).
+*/
+const PROJECTION_READ_OPS = new Set([
+	"read",
+	"list",
+	"stat",
+	"search",
+	"exec",
+	"query"
+]);
+function makeDefaultBlockletAFSFactory(registryPath) {
+	return async function defaultCreateBlockletAFS(blocklet, globalAFS) {
+		if (await readBlockletScope(globalAFS, blocklet) === "root") return globalAFS;
+		const sessionAFS = new AFS();
+		await sessionAFS.mount(new ProjectionProvider({
+			name: blocklet,
+			globalAFS,
+			sourcePath: joinURL(registryPath, blocklet),
+			allowedOps: PROJECTION_READ_OPS
+		}), "/");
+		return sessionAFS;
+	};
+}
+function normalizeHostAliasCandidate(host) {
+	const value = host.trim().toLowerCase();
+	if (!value) return void 0;
+	for (let i = 0; i < value.length; i++) {
+		const code = value.charCodeAt(i);
+		if (code <= 32 || code === 127) return void 0;
+	}
+	if (value.includes("/") || value.includes("@") || value.includes("\\")) return void 0;
+	if (value.startsWith("[")) return void 0;
+	const colonCount = (value.match(/:/g) ?? []).length;
+	if (colonCount > 1) return void 0;
+	let hostname = value;
+	if (colonCount === 1) {
+		const [name, port] = value.split(":");
+		if (!name || !port || !/^\d+$/.test(port)) return void 0;
+		hostname = name;
+	}
+	hostname = hostname.replace(/\.$/, "");
+	return hostname || void 0;
+}
+function createAfsRequestContext(options) {
+	const cache = /* @__PURE__ */ new Map();
+	const cacheLimit = Math.max(1, options.projectionCacheLimit ?? DEFAULT_PROJECTION_CACHE_LIMIT);
+	const registryPath = options.registryPath ?? DEFAULT_REGISTRY_PATH;
+	const factory = options.createBlockletAFS ?? makeDefaultBlockletAFSFactory(registryPath);
+	async function getBlockletAFS(blocklet) {
+		const existing = cache.get(blocklet);
+		if (existing) {
+			cache.delete(blocklet);
+			cache.set(blocklet, existing);
+			timeMeta("bafs", "hit");
+			return existing;
+		}
+		const fresh = await time("bafs", () => factory(blocklet, options.globalAFS));
+		cache.set(blocklet, fresh);
+		while (cache.size > cacheLimit) {
+			const oldest = cache.keys().next().value;
+			if (oldest === void 0) break;
+			cache.delete(oldest);
+		}
+		return fresh;
+	}
+	async function resolveBlocklet(request, explicitBlocklet, opts) {
+		const explicit = typeof explicitBlocklet === "string" && explicitBlocklet ? explicitBlocklet : null;
+		if ((opts?.explicitPriority ?? "trusted") === "trusted" && explicit) return explicit;
+		const url = new URL(request.url);
+		const queryBlocklet = url.searchParams.get("blocklet");
+		if ((opts?.queryPriority ?? "trusted") === "trusted" && queryBlocklet) return queryBlocklet;
+		const host = request.headers.get("Host") ?? url.host;
+		const aliasHost = normalizeHostAliasCandidate(host);
+		if (options.resolveHostAlias && aliasHost) {
+			const aliased = await options.resolveHostAlias(aliasHost);
+			if (aliased) return aliased;
+		}
+		const fromHost = extractBlockletFromHost(host, options.domainRoots ? { domainRoots: options.domainRoots } : void 0);
+		if (fromHost) return fromHost;
+		if (explicit) return explicit;
+		if (queryBlocklet) return queryBlocklet;
+		return options.fallbackBlocklet ?? null;
+	}
+	async function resolveCaller(request) {
+		const caller = options.resolveCaller ? await time("auth", () => options.resolveCaller(request)) : null;
+		authLog.debug({
+			message: "caller resolved",
+			userDid: caller?.did ?? null,
+			authMethod: caller?.authMethod
+		});
+		return caller;
+	}
+	async function resolveScoped(request, args) {
+		const { blocklet, sessionId, caller } = args;
+		const scope = await readBlockletScope(options.globalAFS, blocklet);
+		let afs = await getBlockletAFS(blocklet);
+		const trusted = options.resolveTrustedAfsContext ? await options.resolveTrustedAfsContext(request, {
+			blocklet,
+			caller,
+			sessionId
+		}) : {
+			instanceDid: blocklet,
+			agentRunOrigin: "interactive"
+		};
+		trusted.callerOrigin = "network";
+		const context = mergeCallerContext(args.opOptions ?? {}, caller, trusted);
+		if (!context.requestId) {
+			const rid = getTiming()?.requestId;
+			if (rid) context.requestId = rid;
+		}
+		const identity = { blockletId: blocklet };
+		if (caller?.did) identity.userDid = caller.did;
+		if (trusted.instanceDid) identity.instanceDid = trusted.instanceDid;
+		if (sessionId) identity.sessionId = sessionId;
+		getLogContext()?.enrich(identity);
+		if (options.overlayForRequest && scope !== "root") try {
+			afs = await time("ovl", () => options.overlayForRequest(afs, {
+				blocklet,
+				caller,
+				sessionId,
+				scope,
+				instanceDid: trusted.instanceDid
+			}));
+		} catch {}
+		return {
+			blocklet,
+			scope,
+			afs,
+			caller,
+			context
+		};
+	}
+	return {
+		resolveBlocklet,
+		resolveScoped,
+		resolveCaller
+	};
+}
+
+//#endregion
+export { createAfsRequestContext };
+//# sourceMappingURL=request-context.mjs.map

package/dist/http/request-context.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"request-context.mjs","names":[],"sources":["../../src/http/request-context.ts"],"sourcesContent":["/**\n * Shared HTTP request-context + scoped-AFS helper (afs-preview T2.0).\n *\n * `createAfsRpcHandler` historically封装ed blocklet/host resolution, the\n * per-blocklet projection cache, caller/trusted-context resolution, and the\n * per-request overlay inside one closure — unreachable for the raw-bytes\n * endpoint. This module extracts that pipeline so RPC and raw share ONE\n * implementation (copying an incomplete auth/overlay stack = permission\n * bypass; the HTTP/WS dual-overlay lesson).\n *\n * CACHE SEMANTICS (pinned, design §3): the projection cache is\n * PER-HELPER-INSTANCE. rpc and raw each instantiate their own helper —\n * shared code, NOT shared runtime state. raw must never reach into rpc's\n * cache.\n *\n * SESSION ID: `resolveScoped` takes an EXPLICIT `sessionId` parameter. The\n * raw endpoint passes the signature-verified sid; it never flows through\n * any `sessionId ?? \"rpc-<blocklet>\"` fallback (that fallback lives in the\n * CF rpc overlay closure and stays rpc-only).\n */\n\nimport {\n  AFS,\n  type AFSContext,\n  type AFSRoot,\n  type CallerInfo,\n  extractBlockletFromHost,\n  nsLog,\n  ProjectionProvider,\n} from \"@aigne/afs\";\nimport { getLogContext } from \"@aigne/afs-logger\";\nimport { getTiming, time, timeMeta } from \"@aigne/afs-timing\";\nimport { joinURL } from \"ufo\";\nimport { readBlockletScope } from \"../scope/read-blocklet-scope.js\";\nimport type { BlockletScope } from \"../scope/types.js\";\nimport {\n  mergeCallerContext,\n  type ResolveCallerFn,\n  type ResolveTrustedAfsContext,\n} from \"./auth-context.js\";\n\n/** afs:auth structured logger (debug self-guards; off by default). */\nconst authLog = nsLog(\"afs:auth\");\n\nconst DEFAULT_PROJECTION_CACHE_LIMIT = 32;\nconst DEFAULT_REGISTRY_PATH = \"/registry/blocklets\";\n/**\n * Ops the default read-only blocklet projection allows through. Superset of\n * the request-type vocabulary: `query` is a read-class SEMANTIC op (judged by\n * `semanticOpForRootAction` when `/.actions/query` rides exec) but NOT a wire\n * op — requests still arrive as `type: \"exec\"` (zero protocol change,\n * design §3.1).\n */\nexport const PROJECTION_READ_OPS = new Set([\"read\", \"list\", \"stat\", \"search\", \"exec\", \"query\"]);\n\nexport interface AfsRequestContextOptions {\n  /** The runtime-global AFS (the projection's source). */\n  globalAFS: AFSRoot;\n  /** Roots passed to `extractBlockletFromHost` (e.g. `[\"afsd.io\"]`). */\n  domainRoots?: string[];\n  /** Resolve a normalized Host hostname to a blocklet id (runtime alias map). */\n  resolveHostAlias?: (host: string) => Promise<string | undefined> | string | undefined;\n  /** Used when neither explicit value, query, nor Host header resolve a blocklet. */\n  fallbackBlocklet?: string;\n  /** Bound on how many distinct blocklet projections we keep in memory. */\n  projectionCacheLimit?: number;\n  /** Where the blocklet catalog lives in the global AFS. */\n  registryPath?: string;\n  /** Test seam / runtime adapter: override the projected-AFS factory. */\n  createBlockletAFS?: (blocklet: string, globalAFS: AFSRoot) => Promise<AFSRoot>;\n  /** Resolve a verified caller from the inbound request. */\n  resolveCaller?: ResolveCallerFn;\n  /** Resolve the trusted, host-controlled AFSContext slice. */\n  resolveTrustedAfsContext?: ResolveTrustedAfsContext;\n  /** Optional PER-REQUEST overlay (per-caller `/user`, per-session `/tmp`, …). */\n  overlayForRequest?: (\n    baseAFS: AFSRoot,\n    ctx: {\n      blocklet: string;\n      caller: CallerInfo | null;\n      sessionId: string | null;\n      scope: BlockletScope;\n      /**\n       * Host-resolved instanceDid (the trusted-context slice), present even for an\n       * ANONYMOUS caller. Use this — NOT `caller.instanceDid` — for the `/instance`\n       * partition key, so anonymous + bound-host reads land on the SAME tenant the\n       * WS / DO path uses (instance-resolve F-2).\n       */\n      instanceDid?: string;\n    },\n  ) => AFSRoot | Promise<AFSRoot>;\n}\n\nexport interface ScopedRequest {\n  blocklet: string;\n  scope: BlockletScope;\n  /** The per-request AFS view (cached base + uncached per-request overlay). */\n  afs: AFSRoot;\n  caller: CallerInfo | null;\n  /** Merged op context (caller + trusted slice + callerOrigin + requestId). */\n  context: Record<string, unknown>;\n}\n\nexport interface AfsRequestContext {\n  /**\n   * Resolve the target blocklet. The default treats explicitBlocklet as trusted\n   * (signed raw URLs); HTTP RPC passes explicitPriority:\"fallback\" so the\n   * server-resolved Host/alias wins over browser-provided hints.\n   */\n  resolveBlocklet(\n    request: Request,\n    explicitBlocklet?: string | null,\n    opts?: {\n      explicitPriority?: \"trusted\" | \"fallback\";\n      queryPriority?: \"trusted\" | \"fallback\";\n    },\n  ): Promise<string | null>;\n  /**\n   * Build the per-request scoped view + op context. `sessionId` is the\n   * caller-supplied session identity (rpc: body.sessionId; raw: the\n   * signature-verified sid) — null means \"no session\".\n   */\n  resolveScoped(\n    request: Request,\n    args: {\n      blocklet: string;\n      sessionId: string | null;\n      caller: CallerInfo | null;\n      opOptions?: Record<string, unknown>;\n    },\n  ): Promise<ScopedRequest>;\n  /** Resolve the verified caller (or null when no resolver / anonymous). */\n  resolveCaller(request: Request): Promise<CallerInfo | null>;\n}\n\nfunction makeDefaultBlockletAFSFactory(\n  registryPath: string,\n): (blocklet: string, globalAFS: AFSRoot) => Promise<AFSRoot> {\n  return async function defaultCreateBlockletAFS(blocklet, globalAFS) {\n    // Honor blocklet.yaml `scope: root` — these blocklets need the full\n    // global topology, not a projection scoped to /registry/blocklets/<name>.\n    const scope = await readBlockletScope(globalAFS, blocklet);\n    if (scope === \"root\") return globalAFS;\n    const sessionAFS = new AFS();\n    await sessionAFS.mount(\n      new ProjectionProvider({\n        name: blocklet,\n        globalAFS,\n        sourcePath: joinURL(registryPath, blocklet),\n        allowedOps: PROJECTION_READ_OPS,\n      }),\n      \"/\",\n    );\n    return sessionAFS;\n  };\n}\n\nfunction normalizeHostAliasCandidate(host: string): string | undefined {\n  const value = host.trim().toLowerCase();\n  if (!value) return undefined;\n  for (let i = 0; i < value.length; i++) {\n    const code = value.charCodeAt(i);\n    if (code <= 0x20 || code === 0x7f) return undefined;\n  }\n  if (value.includes(\"/\") || value.includes(\"@\") || value.includes(\"\\\\\")) return undefined;\n  if (value.startsWith(\"[\")) return undefined;\n\n  const colonCount = (value.match(/:/g) ?? []).length;\n  if (colonCount > 1) return undefined;\n\n  let hostname = value;\n  if (colonCount === 1) {\n    const [name, port] = value.split(\":\");\n    if (!name || !port || !/^\\d+$/.test(port)) return undefined;\n    hostname = name;\n  }\n\n  hostname = hostname.replace(/\\.$/, \"\");\n  return hostname || undefined;\n}\n\nexport function createAfsRequestContext(options: AfsRequestContextOptions): AfsRequestContext {\n  const cache = new Map<string, AFSRoot>();\n  const cacheLimit = Math.max(1, options.projectionCacheLimit ?? DEFAULT_PROJECTION_CACHE_LIMIT);\n  const registryPath = options.registryPath ?? DEFAULT_REGISTRY_PATH;\n  const factory = options.createBlockletAFS ?? makeDefaultBlockletAFSFactory(registryPath);\n\n  async function getBlockletAFS(blocklet: string): Promise<AFSRoot> {\n    const existing = cache.get(blocklet);\n    if (existing) {\n      cache.delete(blocklet);\n      cache.set(blocklet, existing);\n      // LRU hit: record cache state, no build cost (dur≈0 is expected).\n      timeMeta(\"bafs\", \"hit\");\n      return existing;\n    }\n    const fresh = await time(\"bafs\", () => factory(blocklet, options.globalAFS));\n    cache.set(blocklet, fresh);\n    while (cache.size > cacheLimit) {\n      const oldest = cache.keys().next().value;\n      if (oldest === undefined) break;\n      cache.delete(oldest);\n    }\n    return fresh;\n  }\n\n  async function resolveBlocklet(\n    request: Request,\n    explicitBlocklet?: string | null,\n    opts?: {\n      explicitPriority?: \"trusted\" | \"fallback\";\n      queryPriority?: \"trusted\" | \"fallback\";\n    },\n  ): Promise<string | null> {\n    const explicit =\n      typeof explicitBlocklet === \"string\" && explicitBlocklet ? explicitBlocklet : null;\n    if ((opts?.explicitPriority ?? \"trusted\") === \"trusted\" && explicit) return explicit;\n    const url = new URL(request.url);\n    const queryBlocklet = url.searchParams.get(\"blocklet\");\n    if ((opts?.queryPriority ?? \"trusted\") === \"trusted\" && queryBlocklet) return queryBlocklet;\n\n    const host = request.headers.get(\"Host\") ?? url.host;\n    const aliasHost = normalizeHostAliasCandidate(host);\n\n    // 1. Caller-injected alias lookup — brand domains win over shorthand and\n    // over untrusted browser hints such as body.blocklet / ?blocklet=.\n    if (options.resolveHostAlias && aliasHost) {\n      const aliased = await options.resolveHostAlias(aliasHost);\n      if (aliased) return aliased;\n    }\n\n    // 2. First-label extraction — `showcase.afsd.io` → `showcase`.\n    const fromHost = extractBlockletFromHost(\n      host,\n      options.domainRoots ? { domainRoots: options.domainRoots } : undefined,\n    );\n    if (fromHost) return fromHost;\n\n    if (explicit) return explicit;\n    if (queryBlocklet) return queryBlocklet;\n\n    return options.fallbackBlocklet ?? null;\n  }\n\n  async function resolveCaller(request: Request): Promise<CallerInfo | null> {\n    const caller = options.resolveCaller\n      ? await time(\"auth\", () => options.resolveCaller!(request))\n      : null;\n    // afs:auth (P7): caller verify result (no token/secret material).\n    authLog.debug({\n      message: \"caller resolved\",\n      userDid: caller?.did ?? null,\n      authMethod: caller?.authMethod,\n    });\n    return caller;\n  }\n\n  async function resolveScoped(\n    request: Request,\n    args: {\n      blocklet: string;\n      sessionId: string | null;\n      caller: CallerInfo | null;\n      opOptions?: Record<string, unknown>;\n    },\n  ): Promise<ScopedRequest> {\n    const { blocklet, sessionId, caller } = args;\n    const scope = await readBlockletScope(options.globalAFS, blocklet);\n    let afs = await getBlockletAFS(blocklet);\n\n    // Host-resolved trusted context (instanceDid / agentRunOrigin). Defaults\n    // to the resolved blocklet as the Node compat instanceDid; CF wires\n    // resolveTrustedAfsContext for the real host instanceDid.\n    const trusted: Partial<AFSContext> = options.resolveTrustedAfsContext\n      ? await options.resolveTrustedAfsContext(request, { blocklet, caller, sessionId })\n      : { instanceDid: blocklet, agentRunOrigin: \"interactive\" };\n    // exec-auth-gate (1d): every call entered over the network — forced here\n    // so no runtime can forget the marker.\n    trusted.callerOrigin = \"network\";\n    const context = mergeCallerContext(args.opOptions ?? {}, caller, trusted);\n    // Thread the request id into the AFS context so logs correlate.\n    if (!context.requestId) {\n      const rid = getTiming()?.requestId;\n      if (rid) context.requestId = rid;\n    }\n\n    // runtime-logging P2 (T2.4): enrich the ALS correlation envelope with the\n    // resolved identity, so any ambient getLogger() deeper in this request (and\n    // contextLogger's ambient fallback — Path A) carries it. Best-effort and\n    // fail-soft: getLogContext() is undefined outside a runWithLogContext scope\n    // (→ no-op); only defined fields are merged (no userDid on anonymous calls).\n    const identity: Record<string, unknown> = { blockletId: blocklet };\n    if (caller?.did) identity.userDid = caller.did;\n    if (trusted.instanceDid) identity.instanceDid = trusted.instanceDid;\n    if (sessionId) identity.sessionId = sessionId;\n    getLogContext()?.enrich(identity);\n\n    // Apply the per-request overlay AFTER the per-blocklet base is cached and\n    // the caller is verified. Rebuilt every request — never cached — so\n    // per-caller / per-session views can't leak across requests.\n    //\n    // Skip root-scope blocklets: their base IS `globalAFS` (the factory returns\n    // it unchanged), and overlaying a per-caller `/user`/`/tmp` onto the host\n    // global topology is wrong. The previous identity check\n    // `afs !== options.globalAFS` ALSO caught any `scope: app` blocklet whose\n    // activator returned null (e.g. a daemon-resident provider routed to\n    // globalAFS as a fallback) — the overlay was silently dropped and every\n    // `/user/...` read/write 404'd because no per-caller overlay was applied.\n    // Decide by scope directly: only `scope: root` truly wants the bare global\n    // topology; everything else (`app`, `user`, undefined) gets the overlay\n    // regardless of whether the base happens to alias `globalAFS`.\n    if (options.overlayForRequest && scope !== \"root\") {\n      try {\n        afs = await time(\"ovl\", () =>\n          options.overlayForRequest!(afs, {\n            blocklet,\n            caller,\n            sessionId,\n            scope,\n            instanceDid: trusted.instanceDid,\n          }),\n        );\n      } catch {\n        // Best-effort — an overlay failure must not break reads.\n      }\n    }\n\n    return { blocklet, scope, afs, caller, context };\n  }\n\n  return { resolveBlocklet, resolveScoped, resolveCaller };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA0CA,MAAM,UAAU,MAAM,WAAW;AAEjC,MAAM,iCAAiC;AACvC,MAAM,wBAAwB;;;;;;;;AAQ9B,MAAa,sBAAsB,IAAI,IAAI;CAAC;CAAQ;CAAQ;CAAQ;CAAU;CAAQ;CAAQ,CAAC;AAkF/F,SAAS,8BACP,cAC4D;AAC5D,QAAO,eAAe,yBAAyB,UAAU,WAAW;AAIlE,MADc,MAAM,kBAAkB,WAAW,SAAS,KAC5C,OAAQ,QAAO;EAC7B,MAAM,aAAa,IAAI,KAAK;AAC5B,QAAM,WAAW,MACf,IAAI,mBAAmB;GACrB,MAAM;GACN;GACA,YAAY,QAAQ,cAAc,SAAS;GAC3C,YAAY;GACb,CAAC,EACF,IACD;AACD,SAAO;;;AAIX,SAAS,4BAA4B,MAAkC;CACrE,MAAM,QAAQ,KAAK,MAAM,CAAC,aAAa;AACvC,KAAI,CAAC,MAAO,QAAO;AACnB,MAAK,IAAI,IAAI,GAAG,IAAI,MAAM,QAAQ,KAAK;EACrC,MAAM,OAAO,MAAM,WAAW,EAAE;AAChC,MAAI,QAAQ,MAAQ,SAAS,IAAM,QAAO;;AAE5C,KAAI,MAAM,SAAS,IAAI,IAAI,MAAM,SAAS,IAAI,IAAI,MAAM,SAAS,KAAK,CAAE,QAAO;AAC/E,KAAI,MAAM,WAAW,IAAI,CAAE,QAAO;CAElC,MAAM,cAAc,MAAM,MAAM,KAAK,IAAI,EAAE,EAAE;AAC7C,KAAI,aAAa,EAAG,QAAO;CAE3B,IAAI,WAAW;AACf,KAAI,eAAe,GAAG;EACpB,MAAM,CAAC,MAAM,QAAQ,MAAM,MAAM,IAAI;AACrC,MAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,QAAQ,KAAK,KAAK,CAAE,QAAO;AAClD,aAAW;;AAGb,YAAW,SAAS,QAAQ,OAAO,GAAG;AACtC,QAAO,YAAY;;AAGrB,SAAgB,wBAAwB,SAAsD;CAC5F,MAAM,wBAAQ,IAAI,KAAsB;CACxC,MAAM,aAAa,KAAK,IAAI,GAAG,QAAQ,wBAAwB,+BAA+B;CAC9F,MAAM,eAAe,QAAQ,gBAAgB;CAC7C,MAAM,UAAU,QAAQ,qBAAqB,8BAA8B,aAAa;CAExF,eAAe,eAAe,UAAoC;EAChE,MAAM,WAAW,MAAM,IAAI,SAAS;AACpC,MAAI,UAAU;AACZ,SAAM,OAAO,SAAS;AACtB,SAAM,IAAI,UAAU,SAAS;AAE7B,YAAS,QAAQ,MAAM;AACvB,UAAO;;EAET,MAAM,QAAQ,MAAM,KAAK,cAAc,QAAQ,UAAU,QAAQ,UAAU,CAAC;AAC5E,QAAM,IAAI,UAAU,MAAM;AAC1B,SAAO,MAAM,OAAO,YAAY;GAC9B,MAAM,SAAS,MAAM,MAAM,CAAC,MAAM,CAAC;AACnC,OAAI,WAAW,OAAW;AAC1B,SAAM,OAAO,OAAO;;AAEtB,SAAO;;CAGT,eAAe,gBACb,SACA,kBACA,MAIwB;EACxB,MAAM,WACJ,OAAO,qBAAqB,YAAY,mBAAmB,mBAAmB;AAChF,OAAK,MAAM,oBAAoB,eAAe,aAAa,SAAU,QAAO;EAC5E,MAAM,MAAM,IAAI,IAAI,QAAQ,IAAI;EAChC,MAAM,gBAAgB,IAAI,aAAa,IAAI,WAAW;AACtD,OAAK,MAAM,iBAAiB,eAAe,aAAa,cAAe,QAAO;EAE9E,MAAM,OAAO,QAAQ,QAAQ,IAAI,OAAO,IAAI,IAAI;EAChD,MAAM,YAAY,4BAA4B,KAAK;AAInD,MAAI,QAAQ,oBAAoB,WAAW;GACzC,MAAM,UAAU,MAAM,QAAQ,iBAAiB,UAAU;AACzD,OAAI,QAAS,QAAO;;EAItB,MAAM,WAAW,wBACf,MACA,QAAQ,cAAc,EAAE,aAAa,QAAQ,aAAa,GAAG,OAC9D;AACD,MAAI,SAAU,QAAO;AAErB,MAAI,SAAU,QAAO;AACrB,MAAI,cAAe,QAAO;AAE1B,SAAO,QAAQ,oBAAoB;;CAGrC,eAAe,cAAc,SAA8C;EACzE,MAAM,SAAS,QAAQ,gBACnB,MAAM,KAAK,cAAc,QAAQ,cAAe,QAAQ,CAAC,GACzD;AAEJ,UAAQ,MAAM;GACZ,SAAS;GACT,SAAS,QAAQ,OAAO;GACxB,YAAY,QAAQ;GACrB,CAAC;AACF,SAAO;;CAGT,eAAe,cACb,SACA,MAMwB;EACxB,MAAM,EAAE,UAAU,WAAW,WAAW;EACxC,MAAM,QAAQ,MAAM,kBAAkB,QAAQ,WAAW,SAAS;EAClE,IAAI,MAAM,MAAM,eAAe,SAAS;EAKxC,MAAM,UAA+B,QAAQ,2BACzC,MAAM,QAAQ,yBAAyB,SAAS;GAAE;GAAU;GAAQ;GAAW,CAAC,GAChF;GAAE,aAAa;GAAU,gBAAgB;GAAe;AAG5D,UAAQ,eAAe;EACvB,MAAM,UAAU,mBAAmB,KAAK,aAAa,EAAE,EAAE,QAAQ,QAAQ;AAEzE,MAAI,CAAC,QAAQ,WAAW;GACtB,MAAM,MAAM,WAAW,EAAE;AACzB,OAAI,IAAK,SAAQ,YAAY;;EAQ/B,MAAM,WAAoC,EAAE,YAAY,UAAU;AAClE,MAAI,QAAQ,IAAK,UAAS,UAAU,OAAO;AAC3C,MAAI,QAAQ,YAAa,UAAS,cAAc,QAAQ;AACxD,MAAI,UAAW,UAAS,YAAY;AACpC,iBAAe,EAAE,OAAO,SAAS;AAgBjC,MAAI,QAAQ,qBAAqB,UAAU,OACzC,KAAI;AACF,SAAM,MAAM,KAAK,aACf,QAAQ,kBAAmB,KAAK;IAC9B;IACA;IACA;IACA;IACA,aAAa,QAAQ;IACtB,CAAC,CACH;UACK;AAKV,SAAO;GAAE;GAAU;GAAO;GAAK;GAAQ;GAAS;;AAGlD,QAAO;EAAE;EAAiB;EAAe;EAAe"}

package/dist/index.cjs

@@ -0,0 +1,197 @@
+const require_dsl_shared = require('./dsl-shared.cjs');
+const require_agent_dsl = require('./agent-dsl.cjs');
+const require_arc_compat = require('./arc-compat.cjs');
+const require_types = require('./auto-surface/types.cjs');
+const require_compiler = require('./auto-surface/compiler.cjs');
+const require_definition_dsl = require('./auto-surface/definition-dsl.cjs');
+const require_fragments = require('./auto-surface/fragments.cjs');
+const require_layering = require('./auto-surface/layering.cjs');
+const require_settings_shell = require('./auto-surface/projectors/settings-shell.cjs');
+const require_projection = require('./auto-surface/projection.cjs');
+const require_scenario = require('./auto-surface/scenario.cjs');
+const require_value_dsl = require('./auto-surface/value-dsl.cjs');
+const require_activation = require('./blocklet/activation.cjs');
+const require_registry = require('./blocklet/registry.cjs');
+const require_did_space_registry = require('./blocklet/did-space-registry.cjs');
+const require_handlers = require('./blocklet/handlers.cjs');
+const require_static_render = require('./blocklet/static-render.cjs');
+const require_chain = require('./devices/chain.cjs');
+const require_role_level = require('./session/role-level.cjs');
+const require_auth_context = require('./http/auth-context.cjs');
+const require_read_blocklet_scope = require('./scope/read-blocklet-scope.cjs');
+const require_request_context = require('./http/request-context.cjs');
+const require_afs_mcp = require('./http/afs-mcp.cjs');
+const require_afs_rpc_wire = require('./http/afs-rpc-wire.cjs');
+const require_csrf = require('./http/csrf.cjs');
+const require_afs_rpc = require('./http/afs-rpc.cjs');
+const require_replication_resolver = require('./session/replication-resolver.cjs');
+const require_settings_cascade = require('./session/settings-cascade.cjs');
+const require_settings_resolver = require('./session/settings-resolver.cjs');
+const require_session_user_afs = require('./session/session-user-afs.cjs');
+const require_raw_url = require('./http/raw-url.cjs');
+const require_afs_raw = require('./http/afs-raw.cjs');
+const require_afs_rest = require('./http/afs-rest.cjs');
+const require_afs_upload = require('./http/afs-upload.cjs');
+const require_aup_client = require('./http/aup-client.cjs');
+const require_aup_event = require('./http/aup-event.cjs');
+const require_handlers$1 = require('./http/handlers.cjs');
+const require_mount_config = require('./mount-config.cjs');
+const require_dsl_error = require('./scaffold/dsl-error.cjs');
+const require_manifest_dsl = require('./scaffold/manifest-dsl.cjs');
+const require_module_dsl = require('./scaffold/module-dsl.cjs');
+const require_shell_dsl = require('./scaffold/shell-dsl.cjs');
+const require_surface_dsl = require('./scaffold/surface-dsl.cjs');
+const require_workspace_dsl = require('./scaffold/workspace-dsl.cjs');
+const require_afs = require('./scaffold/afs.cjs');
+const require_composition = require('./scaffold/composition.cjs');
+const require_resolver = require('./scaffold/resolver.cjs');
+const require_surfaces = require('./scaffold/surfaces.cjs');
+const require_runtime = require('./scaffold/runtime.cjs');
+const require_resolve_scoped_afs = require('./scope/resolve-scoped-afs.cjs');
+const require_session_id = require('./session/session-id.cjs');
+const require_backends = require('./session/backends.cjs');
+const require_session_dir_providers = require('./session/session-dir-providers.cjs');
+const require_settings_schema_store = require('./session/settings-schema-store.cjs');
+const require_terminal_llm = require('./terminal-llm.cjs');
+const require_terminal_repl = require('./terminal-repl.cjs');
+const require_idle_timer = require('./transport/idle-timer.cjs');
+const require_web_component_dsl = require('./web-component-dsl.cjs');
+let _aigne_afs = require("@aigne/afs");
+
+exports.AgentDslCompileError = require_agent_dsl.AgentDslCompileError;
+exports.AutoSurfaceDefinitionDslCompileError = require_definition_dsl.AutoSurfaceDefinitionDslCompileError;
+exports.AutoSurfaceValueDslCompileError = require_value_dsl.AutoSurfaceValueDslCompileError;
+exports.BATCH_LIMITS_CF = require_afs_rpc_wire.BATCH_LIMITS_CF;
+exports.BATCH_LIMITS_NODE = require_afs_rpc_wire.BATCH_LIMITS_NODE;
+exports.BLOCKLET_BUNDLE_PATH = require_did_space_registry.BLOCKLET_BUNDLE_PATH;
+exports.BUILTIN_CHAIN_NETWORKS = require_chain.BUILTIN_CHAIN_NETWORKS;
+exports.CHAIN_DEVICE_PREFIX = require_chain.CHAIN_DEVICE_PREFIX;
+exports.DEFAULT_AUTO_SURFACE_DEFINITIONS_ROOT = require_fragments.DEFAULT_AUTO_SURFACE_DEFINITIONS_ROOT;
+exports.DEFAULT_AUTO_SURFACE_VALUES_ROOT = require_fragments.DEFAULT_AUTO_SURFACE_VALUES_ROOT;
+exports.DEFAULT_SCAFFOLD_ROOT = require_afs.DEFAULT_SCAFFOLD_ROOT;
+exports.IDLE_CLOSE_CODE = require_idle_timer.IDLE_CLOSE_CODE;
+exports.IDLE_CLOSE_REASON = require_idle_timer.IDLE_CLOSE_REASON;
+exports.MINIMAL_AUP_HTML = require_aup_client.MINIMAL_AUP_HTML;
+exports.RAW_MAX_BYTES_DEFAULT = require_afs_raw.RAW_MAX_BYTES_DEFAULT;
+exports.ReplicationResolver = require_replication_resolver.ReplicationResolver;
+exports.SESSION_OVERLAY_PREFIXES = require_session_user_afs.SESSION_OVERLAY_PREFIXES;
+exports.ScaffoldDslCompileError = require_dsl_error.ScaffoldDslCompileError;
+exports.SessionUserAFS = require_session_user_afs.SessionUserAFS;
+exports.SettingsResolver = require_settings_resolver.SettingsResolver;
+exports.TERMINAL_INDEX_FILES = require_registry.TERMINAL_INDEX_FILES;
+exports.WIRE_ERROR_CODES = require_afs_rpc_wire.WIRE_ERROR_CODES;
+exports.WebComponentDslCompileError = require_web_component_dsl.WebComponentDslCompileError;
+exports.activateBlocklet = require_activation.activateBlocklet;
+exports.apiHandler = require_handlers$1.apiHandler;
+exports.assertOverlayOrder = require_session_user_afs.assertOverlayOrder;
+exports.attachIdleClose = require_idle_timer.attachIdleClose;
+exports.blockletDetailHandler = require_handlers.blockletDetailHandler;
+exports.blockletListHandler = require_handlers.blockletListHandler;
+exports.cascade = require_settings_cascade.cascade;
+exports.chainNetworkToMountEntry = require_chain.chainNetworkToMountEntry;
+exports.checkArcVersionCompatibility = require_arc_compat.checkArcVersionCompatibility;
+exports.compareRole = require_role_level.compareRole;
+exports.compareSemver = require_arc_compat.compareSemver;
+exports.compileAgentDsl = require_agent_dsl.compileAgentDsl;
+exports.compileAutoSurfaceDefinitionDsl = require_definition_dsl.compileAutoSurfaceDefinitionDsl;
+exports.compileAutoSurfaceRegistry = require_compiler.compileAutoSurfaceRegistry;
+exports.compileAutoSurfaceValueDsl = require_value_dsl.compileAutoSurfaceValueDsl;
+exports.compileManifestDsl = require_manifest_dsl.compileManifestDsl;
+exports.compileModuleDsl = require_module_dsl.compileModuleDsl;
+exports.compileShellDsl = require_shell_dsl.compileShellDsl;
+exports.compileSurfaceDsl = require_surface_dsl.compileSurfaceDsl;
+exports.compileWebComponentDsl = require_web_component_dsl.compileWebComponentDsl;
+exports.compileWorkspaceDsl = require_workspace_dsl.compileWorkspaceDsl;
+exports.composeScaffoldApp = require_composition.composeScaffoldApp;
+exports.createAFSRestHandler = require_afs_rest.createAFSRestHandler;
+exports.createAfsBlockletReader = require_registry.createAfsBlockletReader;
+exports.createAfsBlockletRegistry = require_registry.createAfsBlockletRegistry;
+exports.createAfsMcpHandler = require_afs_mcp.createAfsMcpHandler;
+exports.createAfsRawHandler = require_afs_raw.createAfsRawHandler;
+exports.createAfsReplSession = require_terminal_repl.createAfsReplSession;
+exports.createAfsRequestContext = require_request_context.createAfsRequestContext;
+exports.createAfsRpcHandler = require_afs_rpc.createAfsRpcHandler;
+exports.createAfsUploadHandler = require_afs_upload.createAfsUploadHandler;
+exports.createAupClientResponder = require_aup_client.createAupClientResponder;
+exports.createAupEventHandler = require_aup_event.createAupEventHandler;
+exports.createBlockletStateProvider = require_session_dir_providers.createBlockletStateProvider;
+exports.createCompositeBlockletRegistry = require_did_space_registry.createCompositeBlockletRegistry;
+exports.createDidSpaceBlockletRegistry = require_did_space_registry.createDidSpaceBlockletRegistry;
+exports.createIdleTimer = require_idle_timer.createIdleTimer;
+exports.createLlmTerminalSession = require_terminal_llm.createLlmTerminalSession;
+exports.createMapBlockletReader = require_registry.createMapBlockletReader;
+exports.createPatternCache = require_registry.createPatternCache;
+exports.createSessionMessagesProvider = require_session_dir_providers.createSessionMessagesProvider;
+exports.createSessionMetaProvider = require_session_dir_providers.createSessionMetaProvider;
+exports.createSessionStateProvider = require_session_dir_providers.createSessionStateProvider;
+exports.createSessionTmpBackend = require_backends.createSessionTmpBackend;
+exports.createSessionView = require_session_user_afs.createSessionView;
+exports.createSettingsSchemaHandle = require_settings_schema_store.createSettingsSchemaHandle;
+exports.createStaticBlockletRegistry = require_registry.createStaticBlockletRegistry;
+exports.createUserDataBackend = require_backends.createUserDataBackend;
+exports.createUserSpaceRootBackend = require_backends.createUserSpaceRootBackend;
+exports.deactivateBlocklet = require_activation.deactivateBlocklet;
+exports.decodeContentBase64 = require_afs_rpc_wire.decodeContentBase64;
+exports.detectBlockletPattern = require_registry.detectBlockletPattern;
+exports.encodeContentBase64 = require_afs_rpc_wire.encodeContentBase64;
+exports.formatAgentDsl = require_agent_dsl.formatAgentDsl;
+exports.formatAutoSurfaceDefinitionDsl = require_definition_dsl.formatAutoSurfaceDefinitionDsl;
+exports.formatAutoSurfaceValueDsl = require_value_dsl.formatAutoSurfaceValueDsl;
+exports.formatManifestDsl = require_manifest_dsl.formatManifestDsl;
+exports.formatModuleDsl = require_module_dsl.formatModuleDsl;
+exports.formatShellDsl = require_shell_dsl.formatShellDsl;
+exports.formatSurfaceDsl = require_surface_dsl.formatSurfaceDsl;
+exports.formatWebComponentDsl = require_web_component_dsl.formatWebComponentDsl;
+exports.formatWorkspaceDsl = require_workspace_dsl.formatWorkspaceDsl;
+exports.guessContentType = require_static_render.guessContentType;
+exports.healthHandler = require_handlers$1.healthHandler;
+exports.infoHandler = require_handlers$1.infoHandler;
+exports.isControlPlaneAuthorized = require_auth_context.isControlPlaneAuthorized;
+exports.isConventionalAssetPath = require_static_render.isConventionalAssetPath;
+exports.isSessionPrivatePath = require_session_user_afs.isSessionPrivatePath;
+exports.isValidSessionId = require_session_id.isValidSessionId;
+exports.issueRawUrl = require_raw_url.issueRawUrl;
+exports.loadAutoSurfaceFragment = require_fragments.loadAutoSurfaceFragment;
+exports.loadAutoSurfaceRegistry = require_scenario.loadAutoSurfaceRegistry;
+exports.loadAutoSurfaceValueLayer = require_fragments.loadAutoSurfaceValueLayer;
+exports.loadAutoSurfaceValueLayers = require_scenario.loadAutoSurfaceValueLayers;
+exports.loadScaffoldDefinition = require_afs.loadScaffoldDefinition;
+exports.mergeCallerContext = require_auth_context.mergeCallerContext;
+exports.normalizeArcVersionRequirement = require_arc_compat.normalizeArcVersionRequirement;
+exports.normalizeAutoSurfaceScopes = require_types.normalizeAutoSurfaceScopes;
+exports.normalizeOrigin = require_csrf.normalizeOrigin;
+exports.normalizeRel = require_registry.normalizeRel;
+exports.parseBearerToken = require_afs_rpc_wire.parseBearerToken;
+Object.defineProperty(exports, 'parseBlockletManifest', {
+  enumerable: true,
+  get: function () {
+    return _aigne_afs.parseBlockletManifest;
+  }
+});
+exports.parseDeclaration = require_dsl_shared.parseDeclaration;
+exports.parseDslDeclaration = require_dsl_shared.parseDslDeclaration;
+exports.parseDslStringToken = require_dsl_shared.parseDslStringToken;
+exports.parseMountConfig = require_mount_config.parseMountConfig;
+exports.projectAutoSurface = require_projection.projectAutoSurface;
+exports.projectSettingsShell = require_settings_shell.projectSettingsShell;
+exports.readBlockletScope = require_read_blocklet_scope.readBlockletScope;
+exports.readWriteIfMatch = require_afs_rpc_wire.readWriteIfMatch;
+exports.renderArcBanner = require_terminal_repl.renderArcBanner;
+exports.renderStaticBlocklet = require_static_render.renderStaticBlocklet;
+exports.resolveAutoSurfaceScenario = require_scenario.resolveAutoSurfaceScenario;
+exports.resolveAutoSurfaceValues = require_layering.resolveAutoSurfaceValues;
+exports.resolveIdleTimeoutMs = require_idle_timer.resolveIdleTimeoutMs;
+exports.resolveScaffoldApp = require_runtime.resolveScaffoldApp;
+exports.resolveScaffoldDefinition = require_resolver.resolveScaffoldDefinition;
+exports.resolveScaffoldSurface = require_surfaces.resolveScaffoldSurface;
+exports.resolveScaffoldSurfaces = require_surfaces.resolveScaffoldSurfaces;
+exports.resolveScopedAFS = require_resolve_scoped_afs.resolveScopedAFS;
+exports.roleLevel = require_role_level.roleLevel;
+exports.scaffoldDslParseError = require_dsl_error.scaffoldDslParseError;
+exports.serveBlockletAsset = require_static_render.serveBlockletAsset;
+exports.validateAndDecodeWrite = require_afs_rpc_wire.validateAndDecodeWrite;
+exports.validateBatchBody = require_afs_rpc_wire.validateBatchBody;
+exports.validateChainNetworks = require_chain.validateChainNetworks;
+exports.validateWorkspaceManifest = require_workspace_dsl.validateWorkspaceManifest;
+exports.verifyRawUrl = require_raw_url.verifyRawUrl;
+exports.workspaceManifestFromDefinition = require_workspace_dsl.workspaceManifestFromDefinition;

package/dist/index.d.cts

@@ -0,0 +1,63 @@
+import { AgentDslCompileError, AgentDslCompileResult, AgentManifest, AgentTool, compileAgentDsl, formatAgentDsl } from "./agent-dsl.cjs";
+import { ArcCompatibilityResult, ArcVersionRequirement, checkArcVersionCompatibility, compareSemver, normalizeArcVersionRequirement } from "./arc-compat.cjs";
+import { AutoSurfaceBindingMap, AutoSurfaceCompileResult, AutoSurfaceDefinitionOwner, AutoSurfaceDiagnostic, AutoSurfaceFragment, AutoSurfaceLayer, AutoSurfaceLoadedRegistry, AutoSurfaceOption, AutoSurfacePolicy, AutoSurfacePresentations, AutoSurfaceProjectedField, AutoSurfaceProjectedGroup, AutoSurfaceProjectedPage, AutoSurfaceProjectedSection, AutoSurfaceProjection, AutoSurfaceProjectorName, AutoSurfaceRegistry, AutoSurfaceRegistryEntry, AutoSurfaceResolvedRegistry, AutoSurfaceResolvedResource, AutoSurfaceResolvedScenario, AutoSurfaceResourceDefinition, AutoSurfaceSettingsShellPresentation, AutoSurfaceSettingsShellProjection, AutoSurfaceValidationRule, AutoSurfaceValueLayers, AutoSurfaceValueSource, AutoSurfaceValueType, normalizeAutoSurfaceScopes } from "./auto-surface/types.cjs";
+import { compileAutoSurfaceRegistry } from "./auto-surface/compiler.cjs";
+import { AutoSurfaceDefinitionDslCompileError, AutoSurfaceDefinitionDslCompileResult, AutoSurfaceDefinitionDslField, AutoSurfaceDefinitionDslGroup, AutoSurfaceDefinitionDslPage, AutoSurfaceDefinitionDslSection, compileAutoSurfaceDefinitionDsl, formatAutoSurfaceDefinitionDsl } from "./auto-surface/definition-dsl.cjs";
+import { AutoSurfaceFragmentReader, DEFAULT_AUTO_SURFACE_DEFINITIONS_ROOT, DEFAULT_AUTO_SURFACE_VALUES_ROOT, LoadAutoSurfaceFragmentOptions, LoadAutoSurfaceValueLayerOptions, loadAutoSurfaceFragment, loadAutoSurfaceValueLayer } from "./auto-surface/fragments.cjs";
+import { resolveAutoSurfaceValues } from "./auto-surface/layering.cjs";
+import { ProjectAutoSurfaceOptions, projectAutoSurface } from "./auto-surface/projection.cjs";
+import { ProjectSettingsShellOptions, projectSettingsShell } from "./auto-surface/projectors/settings-shell.cjs";
+import { AutoSurfaceDefinitionSource, AutoSurfaceValueLayerSource, LoadAutoSurfaceRegistryOptions, LoadAutoSurfaceValueLayersOptions, ResolveAutoSurfaceScenarioOptions, loadAutoSurfaceRegistry, loadAutoSurfaceValueLayers, resolveAutoSurfaceScenario } from "./auto-surface/scenario.cjs";
+import { AutoSurfaceValueDslCompileError, AutoSurfaceValueDslCompileResult, AutoSurfaceValueDslEntry, compileAutoSurfaceValueDsl, formatAutoSurfaceValueDsl } from "./auto-surface/value-dsl.cjs";
+import { ActivatedBlocklet, ActivationHooks, BlockletCredentialStore, BlockletInfo, BlockletLoader, TriggerSpec } from "./blocklet/types.cjs";
+import { ActivateBlockletOptions, activateBlocklet, deactivateBlocklet } from "./blocklet/activation.cjs";
+import { AfsBlockletRegistryOptions, BlockletAfsReader, BlockletPattern, BlockletPatternCache, BlockletPatternKind, BlockletReader, BlockletRegistry, TERMINAL_INDEX_FILES, createAfsBlockletReader, createAfsBlockletRegistry, createMapBlockletReader, createPatternCache, createStaticBlockletRegistry, detectBlockletPattern, normalizeRel } from "./blocklet/registry.cjs";
+import { BLOCKLET_BUNDLE_PATH, BlockletResolveSource, DidSpaceBlockletRegistryDeps, createCompositeBlockletRegistry, createDidSpaceBlockletRegistry } from "./blocklet/did-space-registry.cjs";
+import { blockletDetailHandler, blockletListHandler } from "./blocklet/handlers.cjs";
+import { BlockletManifest, parseBlockletManifest } from "./blocklet/manifest.cjs";
+import { StaticRenderResult, guessContentType, isConventionalAssetPath, renderStaticBlocklet, serveBlockletAsset } from "./blocklet/static-render.cjs";
+import { MountConfig, MountEntry, ParseMountConfigResult, parseMountConfig } from "./mount-config.cjs";
+import { BUILTIN_CHAIN_NETWORKS, CHAIN_DEVICE_PREFIX, ChainNetworkConfig, chainNetworkToMountEntry, validateChainNetworks } from "./devices/chain.cjs";
+import { DslDeclaration, DslDeclarationSchema, DslField, DslToken, parseDeclaration, parseDslDeclaration, parseDslStringToken } from "./dsl-shared.cjs";
+import { BlockletScope, ResolveScopedAFSInput, ResolveScopedAFSResult, ScopeActivator } from "./scope/types.cjs";
+import { ResolveCallerFn, isControlPlaneAuthorized, mergeCallerContext } from "./http/auth-context.cjs";
+import { AfsRequestContext, AfsRequestContextOptions, ScopedRequest, createAfsRequestContext } from "./http/request-context.cjs";
+import { AfsMcpHandler, AfsMcpHandlerOptions, createAfsMcpHandler } from "./http/afs-mcp.cjs";
+import { AfsRawHandlerOptions, RAW_MAX_BYTES_DEFAULT, createAfsRawHandler } from "./http/afs-raw.cjs";
+import { AFSRestOptions, createAFSRestHandler } from "./http/afs-rest.cjs";
+import { BATCH_LIMITS_CF, BATCH_LIMITS_NODE, BatchDeleteWireEntry, BatchLimits, BatchReadWireEntry, BatchWriteWireEntry, RpcWriteBody, WIRE_ERROR_CODES, WireEncoding, WireValidation, decodeContentBase64, encodeContentBase64, parseBearerToken, readWriteIfMatch, validateAndDecodeWrite, validateBatchBody } from "./http/afs-rpc-wire.cjs";
+import { AfsRpcHandler, AfsRpcHandlerOptions, createAfsRpcHandler } from "./http/afs-rpc.cjs";
+import { AfsUploadHandler, AfsUploadHandlerOptions, UploadItem, createAfsUploadHandler } from "./http/afs-upload.cjs";
+import { MINIMAL_AUP_HTML, createAupClientResponder } from "./http/aup-client.cjs";
+import { AupEventHandler, AupEventHandlerOptions, createAupEventHandler } from "./http/aup-event.cjs";
+import { normalizeOrigin } from "./http/csrf.cjs";
+import { HealthConfig, InfoConfig, RouteDescriptor, apiHandler, healthHandler, infoHandler } from "./http/handlers.cjs";
+import { BlockletPackageIdentity, CreateSettingsSchemaHandleOptions, SettingsSchemaHandle, SettingsSchemaStoreLike, createSettingsSchemaHandle } from "./session/settings-schema-store.cjs";
+import { SESSION_OVERLAY_PREFIXES, SessionUserAFS, assertOverlayOrder, createSessionView, isSessionPrivatePath } from "./session/session-user-afs.cjs";
+import { IssueRawUrlParams, RawUrlCryptoOptions, VerifyRawUrlResult, issueRawUrl, verifyRawUrl } from "./http/raw-url.cjs";
+import { ResolvedScaffoldApp, ResolvedScaffoldDefinition, ResolvedScaffoldFooterLink, ResolvedScaffoldHeaderAction, ResolvedScaffoldMenuGroup, ResolvedScaffoldMenuItem, ResolvedScaffoldModule, ResolvedScaffoldShell, ResolvedScaffoldSurface, ResolvedScaffoldSurfaces, ResolvedScaffoldTarget, ResolvedScaffoldWorkspaceDefinition, ResolvedScaffoldWorkspaceSection, ScaffoldAgentModuleBinding, ScaffoldAupModuleBinding, ScaffoldBlockletModuleBinding, ScaffoldCompositionDiagnostic, ScaffoldDefinition, ScaffoldDiagnostic, ScaffoldFooterDefinition, ScaffoldFooterLink, ScaffoldHeaderDefinition, ScaffoldManifest, ScaffoldMenuDefinition, ScaffoldMenuGroup, ScaffoldMenuItem, ScaffoldMenuPlacement, ScaffoldModuleBinding, ScaffoldModuleDefinition, ScaffoldModuleKind, ScaffoldProviderKind, ScaffoldShellAction, ScaffoldShellDefinition, ScaffoldSurfaceDefinition, ScaffoldSurfaceRuntimeDiagnostic, ScaffoldTargetKind, ScaffoldTargetRef, ScaffoldWebModuleBinding, ScaffoldWorkspaceAgentDefinition, ScaffoldWorkspaceDefinition, ScaffoldWorkspaceRailItem, ScaffoldWorkspaceRoot, ScaffoldWorkspaceSection } from "./scaffold/types.cjs";
+import { DEFAULT_SCAFFOLD_ROOT, LoadScaffoldDefinitionOptions, ScaffoldAfsReader, loadScaffoldDefinition } from "./scaffold/afs.cjs";
+import { ComposeScaffoldAppOptions, composeScaffoldApp } from "./scaffold/composition.cjs";
+import { ScaffoldDslCompileError, scaffoldDslParseError } from "./scaffold/dsl-error.cjs";
+import { compileManifestDsl, formatManifestDsl } from "./scaffold/manifest-dsl.cjs";
+import { compileModuleDsl, formatModuleDsl } from "./scaffold/module-dsl.cjs";
+import { resolveScaffoldDefinition } from "./scaffold/resolver.cjs";
+import { ResolveScaffoldAutoSurfaceOptions, ResolveScaffoldSurfacesOptions, resolveScaffoldSurface, resolveScaffoldSurfaces } from "./scaffold/surfaces.cjs";
+import { ResolveScaffoldAppOptions, ResolvedScaffoldRuntime, resolveScaffoldApp } from "./scaffold/runtime.cjs";
+import { compileShellDsl, formatShellDsl } from "./scaffold/shell-dsl.cjs";
+import { compileSurfaceDsl, formatSurfaceDsl } from "./scaffold/surface-dsl.cjs";
+import { WorkspaceManifest, WorkspaceManifestAgent, WorkspaceManifestRoot, compileWorkspaceDsl, formatWorkspaceDsl, validateWorkspaceManifest, workspaceManifestFromDefinition } from "./scaffold/workspace-dsl.cjs";
+import { readBlockletScope } from "./scope/read-blocklet-scope.cjs";
+import { resolveScopedAFS } from "./scope/resolve-scoped-afs.cjs";
+import { createSessionTmpBackend, createUserDataBackend, createUserSpaceRootBackend } from "./session/backends.cjs";
+import { SettingsResolver, SettingsResolverOptions, SettingsScope } from "./session/settings-resolver.cjs";
+import { ReplicationResolver, ReplicationResolverOptions } from "./session/replication-resolver.cjs";
+import { compareRole, roleLevel } from "./session/role-level.cjs";
+import { createBlockletStateProvider, createSessionMessagesProvider, createSessionMetaProvider, createSessionStateProvider } from "./session/session-dir-providers.cjs";
+import { isValidSessionId } from "./session/session-id.cjs";
+import { EffectiveField, InstanceOverrideOnly, PackageFieldSchema, SettingsCascadeScope, UserOverrideOnly, cascade } from "./session/settings-cascade.cjs";
+import { LlmTerminalOptions, LlmTerminalResult, LlmTerminalSession, createLlmTerminalSession } from "./terminal-llm.cjs";
+import { AfsReplOptions, AfsReplResult, AfsReplSession, BannerOptions, createAfsReplSession, renderArcBanner } from "./terminal-repl.cjs";
+import { IDLE_CLOSE_CODE, IDLE_CLOSE_REASON, IdleCloseTarget, IdleTimer, IdleTimerOptions, attachIdleClose, createIdleTimer, resolveIdleTimeoutMs } from "./transport/idle-timer.cjs";
+import { WebComponentDslCompileError, WebComponentDslCompileResult, WebComponentManifest, WebComponentPropManifest, compileWebComponentDsl, formatWebComponentDsl } from "./web-component-dsl.cjs";
+export { type AFSRestOptions, type ActivateBlockletOptions, type ActivatedBlocklet, type ActivationHooks, type AfsBlockletRegistryOptions, type AfsMcpHandler, type AfsMcpHandlerOptions, type AfsRawHandlerOptions, type AfsReplOptions, type AfsReplResult, type AfsReplSession, type AfsRequestContext, type AfsRequestContextOptions, type AfsRpcHandler, type AfsRpcHandlerOptions, type AfsUploadHandler, type AfsUploadHandlerOptions, AgentDslCompileError, type AgentDslCompileResult, type AgentManifest, type AgentTool, type ArcCompatibilityResult, type ArcVersionRequirement, type AupEventHandler, type AupEventHandlerOptions, type AutoSurfaceBindingMap, type AutoSurfaceCompileResult, AutoSurfaceDefinitionDslCompileError, type AutoSurfaceDefinitionDslCompileResult, type AutoSurfaceDefinitionDslField, type AutoSurfaceDefinitionDslGroup, type AutoSurfaceDefinitionDslPage, type AutoSurfaceDefinitionDslSection, type AutoSurfaceDefinitionOwner, type AutoSurfaceDefinitionSource, type AutoSurfaceDiagnostic, type AutoSurfaceFragment, type AutoSurfaceFragmentReader, type AutoSurfaceLayer, type AutoSurfaceLoadedRegistry, type AutoSurfaceOption, type AutoSurfacePolicy, type AutoSurfacePresentations, type AutoSurfaceProjectedField, type AutoSurfaceProjectedGroup, type AutoSurfaceProjectedPage, type AutoSurfaceProjectedSection, type AutoSurfaceProjection, type AutoSurfaceProjectorName, type AutoSurfaceRegistry, type AutoSurfaceRegistryEntry, type AutoSurfaceResolvedRegistry, type AutoSurfaceResolvedResource, type AutoSurfaceResolvedScenario, type AutoSurfaceResourceDefinition, type AutoSurfaceSettingsShellPresentation, type AutoSurfaceSettingsShellProjection, type AutoSurfaceValidationRule, AutoSurfaceValueDslCompileError, type AutoSurfaceValueDslCompileResult, type AutoSurfaceValueDslEntry, type AutoSurfaceValueLayerSource, type AutoSurfaceValueLayers, type AutoSurfaceValueSource, type AutoSurfaceValueType, BATCH_LIMITS_CF, BATCH_LIMITS_NODE, BLOCKLET_BUNDLE_PATH, BUILTIN_CHAIN_NETWORKS, type BannerOptions, type BatchDeleteWireEntry, type BatchLimits, type BatchReadWireEntry, type BatchWriteWireEntry, type BlockletAfsReader, type BlockletCredentialStore, type BlockletInfo, type BlockletLoader, type BlockletManifest, type BlockletPackageIdentity, type BlockletPattern, type BlockletPatternCache, type BlockletPatternKind, type BlockletReader, type BlockletRegistry, type BlockletResolveSource, type BlockletScope, CHAIN_DEVICE_PREFIX, type ChainNetworkConfig, type ComposeScaffoldAppOptions, type CreateSettingsSchemaHandleOptions, DEFAULT_AUTO_SURFACE_DEFINITIONS_ROOT, DEFAULT_AUTO_SURFACE_VALUES_ROOT, DEFAULT_SCAFFOLD_ROOT, type DidSpaceBlockletRegistryDeps, type DslDeclaration, type DslDeclarationSchema, type DslField, type DslToken, type EffectiveField, type HealthConfig, IDLE_CLOSE_CODE, IDLE_CLOSE_REASON, type IdleCloseTarget, type IdleTimer, type IdleTimerOptions, type InfoConfig, type InstanceOverrideOnly, type IssueRawUrlParams, type LlmTerminalOptions, type LlmTerminalResult, type LlmTerminalSession, type LoadAutoSurfaceFragmentOptions, type LoadAutoSurfaceRegistryOptions, type LoadAutoSurfaceValueLayerOptions, type LoadAutoSurfaceValueLayersOptions, type LoadScaffoldDefinitionOptions, MINIMAL_AUP_HTML, type MountConfig, type MountEntry, type PackageFieldSchema, type ParseMountConfigResult, type ProjectAutoSurfaceOptions, type ProjectSettingsShellOptions, RAW_MAX_BYTES_DEFAULT, type RawUrlCryptoOptions, ReplicationResolver, type ReplicationResolverOptions, type ResolveAutoSurfaceScenarioOptions, type ResolveCallerFn, type ResolveScaffoldAppOptions, type ResolveScaffoldAutoSurfaceOptions, type ResolveScaffoldSurfacesOptions, type ResolveScopedAFSInput, type ResolveScopedAFSResult, type ResolvedScaffoldApp, type ResolvedScaffoldDefinition, type ResolvedScaffoldFooterLink, type ResolvedScaffoldHeaderAction, type ResolvedScaffoldMenuGroup, type ResolvedScaffoldMenuItem, type ResolvedScaffoldModule, type ResolvedScaffoldRuntime, type ResolvedScaffoldShell, type ResolvedScaffoldSurface, type ResolvedScaffoldSurfaces, type ResolvedScaffoldTarget, type ResolvedScaffoldWorkspaceDefinition, type ResolvedScaffoldWorkspaceSection, type RouteDescriptor, type RpcWriteBody, SESSION_OVERLAY_PREFIXES, type ScaffoldAfsReader, type ScaffoldAgentModuleBinding, type ScaffoldAupModuleBinding, type ScaffoldBlockletModuleBinding, type ScaffoldCompositionDiagnostic, type ScaffoldDefinition, type ScaffoldDiagnostic, ScaffoldDslCompileError, type ScaffoldFooterDefinition, type ScaffoldFooterLink, type ScaffoldHeaderDefinition, type ScaffoldManifest, type ScaffoldMenuDefinition, type ScaffoldMenuGroup, type ScaffoldMenuItem, type ScaffoldMenuPlacement, type ScaffoldModuleBinding, type ScaffoldModuleDefinition, type ScaffoldModuleKind, type ScaffoldProviderKind, type ScaffoldShellAction, type ScaffoldShellDefinition, type ScaffoldSurfaceDefinition, type ScaffoldSurfaceRuntimeDiagnostic, type ScaffoldTargetKind, type ScaffoldTargetRef, type ScaffoldWebModuleBinding, type ScaffoldWorkspaceAgentDefinition, type ScaffoldWorkspaceDefinition, type ScaffoldWorkspaceRailItem, type ScaffoldWorkspaceRoot, type ScaffoldWorkspaceSection, type ScopeActivator, type ScopedRequest, SessionUserAFS, type SettingsCascadeScope, SettingsResolver, type SettingsResolverOptions, type SettingsSchemaHandle, type SettingsSchemaStoreLike, type SettingsScope, type StaticRenderResult, TERMINAL_INDEX_FILES, type TriggerSpec, type UploadItem, type UserOverrideOnly, type VerifyRawUrlResult, WIRE_ERROR_CODES, WebComponentDslCompileError, type WebComponentDslCompileResult, type WebComponentManifest, type WebComponentPropManifest, type WireEncoding, type WireValidation, type WorkspaceManifest, type WorkspaceManifestAgent, type WorkspaceManifestRoot, activateBlocklet, apiHandler, assertOverlayOrder, attachIdleClose, blockletDetailHandler, blockletListHandler, cascade, chainNetworkToMountEntry, checkArcVersionCompatibility, compareRole, compareSemver, compileAgentDsl, compileAutoSurfaceDefinitionDsl, compileAutoSurfaceRegistry, compileAutoSurfaceValueDsl, compileManifestDsl, compileModuleDsl, compileShellDsl, compileSurfaceDsl, compileWebComponentDsl, compileWorkspaceDsl, composeScaffoldApp, createAFSRestHandler, createAfsBlockletReader, createAfsBlockletRegistry, createAfsMcpHandler, createAfsRawHandler, createAfsReplSession, createAfsRequestContext, createAfsRpcHandler, createAfsUploadHandler, createAupClientResponder, createAupEventHandler, createBlockletStateProvider, createCompositeBlockletRegistry, createDidSpaceBlockletRegistry, createIdleTimer, createLlmTerminalSession, createMapBlockletReader, createPatternCache, createSessionMessagesProvider, createSessionMetaProvider, createSessionStateProvider, createSessionTmpBackend, createSessionView, createSettingsSchemaHandle, createStaticBlockletRegistry, createUserDataBackend, createUserSpaceRootBackend, deactivateBlocklet, decodeContentBase64, detectBlockletPattern, encodeContentBase64, formatAgentDsl, formatAutoSurfaceDefinitionDsl, formatAutoSurfaceValueDsl, formatManifestDsl, formatModuleDsl, formatShellDsl, formatSurfaceDsl, formatWebComponentDsl, formatWorkspaceDsl, guessContentType, healthHandler, infoHandler, isControlPlaneAuthorized, isConventionalAssetPath, isSessionPrivatePath, isValidSessionId, issueRawUrl, loadAutoSurfaceFragment, loadAutoSurfaceRegistry, loadAutoSurfaceValueLayer, loadAutoSurfaceValueLayers, loadScaffoldDefinition, mergeCallerContext, normalizeArcVersionRequirement, normalizeAutoSurfaceScopes, normalizeOrigin, normalizeRel, parseBearerToken, parseBlockletManifest, parseDeclaration, parseDslDeclaration, parseDslStringToken, parseMountConfig, projectAutoSurface, projectSettingsShell, readBlockletScope, readWriteIfMatch, renderArcBanner, renderStaticBlocklet, resolveAutoSurfaceScenario, resolveAutoSurfaceValues, resolveIdleTimeoutMs, resolveScaffoldApp, resolveScaffoldDefinition, resolveScaffoldSurface, resolveScaffoldSurfaces, resolveScopedAFS, roleLevel, scaffoldDslParseError, serveBlockletAsset, validateAndDecodeWrite, validateBatchBody, validateChainNetworks, validateWorkspaceManifest, verifyRawUrl, workspaceManifestFromDefinition };