@aistrike-dev/ui-shell-dev 0.0.0 → 1.0.0

package/README.md

@@ -1,3 +1,69 @@
 # @aistrike-dev/ui-shell-dev
 
-Placeholder. This version contains no code; it only reserves the package name so releases can be published from CI by npm trusted publishing. Install 1.0.0 or later.
+Serves the AiStrike UI shell from your micro front-end's (MFE's) own Vite dev server, and mints dev tokens.
+
+## Setup
+
+Install it as a devDependency, next to `@aistrike-dev/ui-shell-sdk`, and add `shellDevHost()` after `mfe()`:
+
+```ts
+import { mfe } from '@aistrike-dev/ui-shell-sdk/vite';
+import { shellDevHost } from '@aistrike-dev/ui-shell-dev/vite';
+import { defineConfig } from 'vite';
+
+export default defineConfig({
+  plugins: [mfe({ id: 'hello' }), shellDevHost()],
+});
+```
+
+`vite` now serves the shell at `/` with a minted dev session, and your MFE at `/ui/latest/`, on one origin, with HMR.
+Other domains resolve by the profile's convention unless `shell.dev.json` overrides them.
+
+Keep Vite's `server.allowedHosts` at its default: the plugin derives your MFE's origin from the request's `Host`
+header, which is only safe while Vite rejects unknown hosts. With `server.https` Vite skips host validation, so the
+self-override trusts the `Host` header as-is.
+
+## `shell.dev.json`
+
+Read from the Vite root when present (or from the plugin's `devFile` option).
+
+```json
+{
+  "profile": "local",
+  "overrides": { "other": "http://127.0.0.1:5102" },
+  "domains": [{ "id": "other", "route": "/other", "nav": { "label": "Other" }, "devPort": 5102 }],
+  "idleTimeoutMs": 0,
+  "claims": { "permissions": ["hello:read"] }
+}
+```
+
+`profile` defaults to `local`, `overrides` point other domains at their own dev servers (bare origins, no path; your
+own domain is overridden automatically), `idleTimeoutMs` defaults to `0` (idle timeout off), and `claims` is merged
+over the default dev claims. The plugin's `claims`, `ttlMs` and `noToken` options win over the file.
+
+## Commands
+
+```
+aistrike-shell token [--claims <path>] [--ttl 30d|12h|45m|90s] [--out <path>] [--json]
+```
+
+`token` mints a dev token and prints it (or `{ token, session }` with `--json`), optionally writing it to `--out`.
+
+The package's own e2e (`pnpm nx e2e dev-host`) serves the settings MFE on port 5101 and fails loudly if a settings dev server already occupies it.
+
+Opening `/` in dev lands on your own MFE (the plugin injects `landing` with your domain id; `shell.dev.json` may set `landing` to another domain id; an id that is not in the shell's domain list falls back to `/home`). The other domains in the profile (for example `home` on port 5102) show as failed in the rail unless their dev servers are running too; that is expected.
+
+## Checking Fast Refresh (spike 1)
+
+This is a manual check; no automated test covers it. From the repository root:
+
+1. `pnpm nx build dev-host` once (builds the shell and copies it into the dev host package).
+2. `pnpm --filter @aistrike-dev/app-settings dev`.
+3. Open `http://localhost:5101/settings/profile`.
+4. Edit `apps/settings/src/ProfilePage.tsx` (for example, the `Profile` heading) and save.
+5. Confirm the page updates without a full reload: text typed into a field beforehand is still there.
+
+## The dev token
+
+The dev token is signed with a dev-only key stored under `~/.config/aistrike-shell/`. It exists so the shell has a
+session locally. Deployed environments never trust it.

package/bin/aistrike-shell.mjs

@@ -0,0 +1,5 @@
+#!/usr/bin/env node
+import process from 'node:process';
+
+const { main } = await import('../dist/cli.js');
+process.exitCode = await main(process.argv.slice(2));

package/dist/args.d.ts

@@ -0,0 +1,13 @@
+export declare const USAGE = "Usage: aistrike-shell token [options]\n\nMint a dev token for local back ends.\n  --claims <path>           JSON claims for the token\n  --ttl <30d|12h|45m|90s>   token lifetime (default 30d)\n  --out <path>              also write the token to a file (mode 0600)\n  --json                    print { token, session } instead of the bare token\n\nThe shell itself is served by shellDevHost() from @aistrike-dev/ui-shell-dev/vite:\nadd it to your MFE's vite.config.ts after mfe(), and \"vite\" serves the shell at /.\nShell settings (profile, overrides, domains, claims) live in shell.dev.json.\n";
+export declare const DOMAIN_ID: RegExp;
+export declare function parseTtl(text: string): number;
+/** `id=origin`. The origin must be a bare origin: scheme, host, optional port, nothing else (spec 4.5). */
+export declare function parseOverride(text: string): [string, string];
+export interface TokenArgs {
+    claims?: string;
+    ttl?: string;
+    out?: string;
+    json: boolean;
+    help: boolean;
+}
+export declare function parseTokenArgs(argv: string[]): TokenArgs;

package/dist/args.js

@@ -0,0 +1,83 @@
+export const USAGE = `Usage: aistrike-shell token [options]
+
+Mint a dev token for local back ends.
+  --claims <path>           JSON claims for the token
+  --ttl <30d|12h|45m|90s>   token lifetime (default 30d)
+  --out <path>              also write the token to a file (mode 0600)
+  --json                    print { token, session } instead of the bare token
+
+The shell itself is served by shellDevHost() from @aistrike-dev/ui-shell-dev/vite:
+add it to your MFE's vite.config.ts after mfe(), and "vite" serves the shell at /.
+Shell settings (profile, overrides, domains, claims) live in shell.dev.json.
+`;
+const TTL = /^(\d+)([dhms])$/;
+const UNIT_MS = { d: 86_400_000, h: 3_600_000, m: 60_000, s: 1000 };
+// Mirrors the contract's DNS-label rule for domain ids. Duplicated (not imported) so the dev host has no runtime dependencies.
+export const DOMAIN_ID = /^[a-z](?:[a-z0-9-]{0,61}[a-z0-9])?$/;
+const SCHEME = /^[a-z][a-z0-9+.-]*:\/\//i;
+export function parseTtl(text) {
+    const match = TTL.exec(text);
+    const amount = match ? Number(match[1]) : 0;
+    if (!match || amount <= 0) {
+        throw new Error(`invalid ttl "${text}": use <n>d, <n>h, <n>m or <n>s`);
+    }
+    return amount * (UNIT_MS[match[2]] ?? 0);
+}
+/** `id=origin`. The origin must be a bare origin: scheme, host, optional port, nothing else (spec 4.5). */
+export function parseOverride(text) {
+    const eq = text.indexOf('=');
+    if (eq === -1) {
+        throw new Error(`invalid override "${text}": expected id=origin`);
+    }
+    const id = text.slice(0, eq);
+    const raw = text.slice(eq + 1).replace(/\/+$/, '');
+    if (!DOMAIN_ID.test(id)) {
+        throw new Error(`invalid override id "${id}": must be a DNS label`);
+    }
+    if (!SCHEME.test(raw)) {
+        throw new Error(`invalid override origin "${raw}": must include a scheme, e.g. http://127.0.0.1:5102`);
+    }
+    let url;
+    try {
+        url = new URL(raw);
+    }
+    catch {
+        throw new Error(`invalid override origin "${raw}": not a valid URL`);
+    }
+    if (url.protocol !== 'http:' && url.protocol !== 'https:') {
+        throw new Error(`invalid override origin "${raw}": must be http or https`);
+    }
+    if (url.origin !== raw || url.origin === 'null') {
+        throw new Error(`invalid override origin "${raw}": must be a bare origin without a path`);
+    }
+    return [id, url.origin];
+}
+function takeValue(argv, index, flag) {
+    const value = argv[index + 1];
+    if (value === undefined || value.startsWith('--')) {
+        throw new Error(`${flag} needs a value`);
+    }
+    return value;
+}
+const TOKEN_VALUE_FLAGS = new Map([['--claims', 'claims'], ['--ttl', 'ttl'], ['--out', 'out']]);
+export function parseTokenArgs(argv) {
+    const args = { json: false, help: false };
+    for (let i = 0; i < argv.length; i += 1) {
+        const flag = argv[i];
+        const key = TOKEN_VALUE_FLAGS.get(flag);
+        if (flag === '--help') {
+            args.help = true;
+        }
+        else if (flag === '--json') {
+            args.json = true;
+        }
+        else if (key) {
+            args[key] = takeValue(argv, i, flag);
+            i += 1;
+        }
+        else {
+            throw new Error(`unknown option "${flag}"`);
+        }
+    }
+    return args;
+}

package/dist/cli.d.ts

@@ -0,0 +1,7 @@
+export interface CliIo {
+    stdout: (text: string) => void;
+    stderr: (text: string) => void;
+    cwd?: string;
+    keyDir?: string;
+}
+export declare function main(argv: string[], io?: CliIo): Promise<number>;

package/dist/cli.js

@@ -0,0 +1,65 @@
+import { existsSync, readFileSync, writeFileSync } from 'node:fs';
+import { resolve } from 'node:path';
+import process from 'node:process';
+import { USAGE, parseTokenArgs, parseTtl } from './args.js';
+import { assertClaimsInput } from './devfile.js';
+import { DEFAULT_TTL_MS, loadOrCreateKey, mintToken } from './token.js';
+const defaultIo = { stdout: (t) => process.stdout.write(t), stderr: (t) => process.stderr.write(t) };
+function readClaims(path, cwd, fallback) {
+    if (path === undefined) {
+        return fallback;
+    }
+    const file = resolve(cwd, path);
+    if (!existsSync(file)) {
+        throw new Error(`claims file not found: ${path}`);
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(readFileSync(file, 'utf8'));
+    }
+    catch (error) {
+        throw new Error(`claims file ${path} is not valid JSON: ${String(error)}`, { cause: error });
+    }
+    return assertClaimsInput(parsed, `--claims ${path}`);
+}
+function mint(io, claims, ttl) {
+    const key = loadOrCreateKey(io.keyDir);
+    return mintToken({ key, claims, ttlMs: ttl === undefined ? DEFAULT_TTL_MS : parseTtl(ttl) }).session;
+}
+function runToken(argv, io) {
+    const args = parseTokenArgs(argv);
+    if (args.help) {
+        io.stdout(USAGE);
+        return 0;
+    }
+    const cwd = io.cwd ?? process.cwd();
+    const session = mint(io, readClaims(args.claims, cwd, undefined), args.ttl);
+    const output = args.json ? `${JSON.stringify({ token: session.accessToken, session }, null, 2)}\n` : `${session.accessToken}\n`;
+    if (args.out !== undefined) {
+        // The token is a credential for local back ends: owner read/write only.
+        writeFileSync(resolve(cwd, args.out), output, { mode: 0o600 });
+    }
+    io.stdout(output);
+    return 0;
+}
+export async function main(argv, io = defaultIo) {
+    const [command, ...rest] = argv;
+    try {
+        switch (command) {
+            case undefined:
+            case '--help':
+            case 'help':
+                io.stdout(USAGE);
+                return 0;
+            case 'token':
+                return runToken(rest, io);
+            default:
+                io.stderr(`unknown command "${command}"\n\n${USAGE}`);
+                return 2;
+        }
+    }
+    catch (error) {
+        io.stderr(`${error instanceof Error ? error.message : String(error)}\n`);
+        return 2;
+    }
+}

package/dist/devfile.d.ts

@@ -0,0 +1,27 @@
+import type { DevConfig, DevDomain } from '@aistrike-dev/ui-shell-sdk/shell';
+import type { Session } from '@aistrike-dev/ui-shell-sdk';
+import type { DevClaimsInput } from './token.js';
+export declare const DEV_FILE = "shell.dev.json";
+export interface DevFile {
+    profile?: string;
+    overrides?: {
+        [id: string]: string;
+    };
+    domains?: DevDomain[];
+    idleTimeoutMs?: number;
+    landing?: string;
+    claims?: DevClaimsInput;
+}
+/** Dev claims must be a plain object of known keys; `iss`/`exp`/`iat` and friends cannot be smuggled into the token. */
+export declare function assertClaimsInput(value: unknown, source: string): DevClaimsInput;
+/** An explicit `--config` must exist; the default `shell.dev.json` is optional. */
+export declare function loadDevFile(path: string | undefined, cwd?: string): DevFile | null;
+export interface DevOverrides {
+    profile?: string;
+    landing?: string;
+    overrides: {
+        [id: string]: string;
+    };
+}
+/** Explicit overrides win over the file; the profile defaults to `local`; the idle timeout defaults to off for local work. */
+export declare function buildDevConfig(file: DevFile | null, args: DevOverrides, session: Session | undefined): DevConfig;

package/dist/devfile.js

@@ -0,0 +1,182 @@
+import { existsSync, readFileSync } from 'node:fs';
+import { resolve } from 'node:path';
+import process from 'node:process';
+import { DOMAIN_ID, parseOverride } from './args.js';
+export const DEV_FILE = 'shell.dev.json';
+const CLAIM_STRINGS = ['sub', 'name', 'defaultTenant'];
+const CLAIM_LISTS = ['permissions', 'modules', 'tenants'];
+/** Dev claims must be a plain object of known keys; `iss`/`exp`/`iat` and friends cannot be smuggled into the token. */
+export function assertClaimsInput(value, source) {
+    if (typeof value !== 'object' || value === null || Array.isArray(value)) {
+        throw new Error(`${source}: claims must be an object`);
+    }
+    for (const [key, entry] of Object.entries(value)) {
+        if (CLAIM_STRINGS.includes(key)) {
+            if (typeof entry !== 'string') {
+                throw new Error(`${source}: ${key} must be a string`);
+            }
+        }
+        else if (CLAIM_LISTS.includes(key)) {
+            if (!Array.isArray(entry) || !entry.every((item) => typeof item === 'string')) {
+                throw new Error(`${source}: ${key} must be an array of strings`);
+            }
+        }
+        else {
+            throw new Error(`${source}: unknown claim "${key}"`);
+        }
+    }
+    return value;
+}
+function normalizeOverrides(overrides) {
+    if (typeof overrides !== 'object' || overrides === null || Array.isArray(overrides)) {
+        throw new Error('overrides must be an object of id: origin');
+    }
+    const result = {};
+    for (const [id, origin] of Object.entries(overrides)) {
+        if (typeof origin !== 'string') {
+            throw new Error(`override "${id}" must be a string origin`);
+        }
+        const [, normalized] = parseOverride(`${id}=${origin}`);
+        result[id] = normalized;
+    }
+    return result;
+}
+const FILE_KEYS = ['profile', 'overrides', 'domains', 'idleTimeoutMs', 'landing', 'claims'];
+const DOMAIN_KEYS = ['id', 'route', 'nav', 'devPort'];
+const NAV_KEYS = ['label', 'icon'];
+const ROUTE = /^\/[a-z0-9-]+$/;
+function isPlainObject(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+function rejectUnknownKeys(value, allowed, path) {
+    for (const key of Object.keys(value)) {
+        if (!allowed.includes(key)) {
+            throw new Error(`unknown key "${key}"${path === '' ? '' : ` in ${path}`}`);
+        }
+    }
+}
+function validateNav(nav, path) {
+    if (!isPlainObject(nav)) {
+        throw new Error(`${path} must be an object`);
+    }
+    rejectUnknownKeys(nav, NAV_KEYS, path);
+    const { label, icon } = nav;
+    if (typeof label !== 'string') {
+        throw new Error(`${path}.label must be a string`);
+    }
+    if (icon === undefined) {
+        return { label };
+    }
+    if (typeof icon !== 'string') {
+        throw new Error(`${path}.icon must be a string`);
+    }
+    return { label, icon };
+}
+function isPort(value) {
+    return typeof value === 'number' && Number.isInteger(value) && value >= 1 && value <= 65535;
+}
+function validateDomain(value, path) {
+    if (!isPlainObject(value)) {
+        throw new Error(`${path} must be an object`);
+    }
+    rejectUnknownKeys(value, DOMAIN_KEYS, path);
+    const { id, route, nav, devPort } = value;
+    if (typeof id !== 'string' || !DOMAIN_ID.test(id)) {
+        throw new Error(`${path}.id must be a DNS label`);
+    }
+    if (typeof route !== 'string' || !ROUTE.test(route)) {
+        throw new Error(`${path}.route must look like /name`);
+    }
+    const validNav = validateNav(nav, `${path}.nav`);
+    if (!isPort(devPort)) {
+        throw new Error(`${path}.devPort must be an integer from 1 to 65535`);
+    }
+    return { id, route, nav: validNav, devPort };
+}
+function validateDomains(value) {
+    if (!Array.isArray(value)) {
+        throw new Error('domains must be an array');
+    }
+    return value.map((entry, index) => validateDomain(entry, `domains[${index}]`));
+}
+function validateIdle(value) {
+    if (typeof value !== 'number' || !Number.isFinite(value) || value < 0) {
+        throw new Error('idleTimeoutMs must be a finite number of at least 0');
+    }
+    return value;
+}
+function validateLanding(value) {
+    if (typeof value !== 'string' || value === '') {
+        throw new Error('landing must be a non-empty domain id');
+    }
+    return value;
+}
+function readExtras(parsed, result) {
+    if (parsed.idleTimeoutMs !== undefined) {
+        result.idleTimeoutMs = validateIdle(parsed.idleTimeoutMs);
+    }
+    if (parsed.landing !== undefined) {
+        result.landing = validateLanding(parsed.landing);
+    }
+    if (parsed.claims !== undefined) {
+        result.claims = assertClaimsInput(parsed.claims, 'claims');
+    }
+    return result;
+}
+function validateFile(parsed, name) {
+    try {
+        if (!isPlainObject(parsed)) {
+            throw new Error('must be a JSON object');
+        }
+        rejectUnknownKeys(parsed, FILE_KEYS, '');
+        const result = {};
+        if (parsed.profile !== undefined) {
+            if (typeof parsed.profile !== 'string') {
+                throw new Error('profile must be a string');
+            }
+            result.profile = parsed.profile;
+        }
+        if (parsed.overrides !== undefined) {
+            result.overrides = normalizeOverrides(parsed.overrides);
+        }
+        if (parsed.domains !== undefined) {
+            result.domains = validateDomains(parsed.domains);
+        }
+        return readExtras(parsed, result);
+    }
+    catch (error) {
+        throw new Error(`${name}: ${error instanceof Error ? error.message : String(error)}`, { cause: error });
+    }
+}
+/** An explicit `--config` must exist; the default `shell.dev.json` is optional. */
+export function loadDevFile(path, cwd = process.cwd()) {
+    const file = resolve(cwd, path ?? DEV_FILE);
+    if (!existsSync(file)) {
+        if (path === undefined) {
+            return null;
+        }
+        throw new Error(`dev file not found: ${path}`);
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(readFileSync(file, 'utf8'));
+    }
+    catch (error) {
+        throw new Error(`dev file ${path ?? DEV_FILE} is not valid JSON: ${String(error)}`, { cause: error });
+    }
+    return validateFile(parsed, path ?? DEV_FILE);
+}
+function landingOf(file, args) {
+    return args.landing ?? file?.landing;
+}
+/** Explicit overrides win over the file; the profile defaults to `local`; the idle timeout defaults to off for local work. */
+export function buildDevConfig(file, args, session) {
+    return {
+        profile: args.profile ?? file?.profile ?? 'local',
+        overrides: { ...(file?.overrides ?? {}), ...args.overrides },
+        domains: file?.domains ?? [],
+        idleTimeoutMs: file?.idleTimeoutMs ?? 0,
+        landing: landingOf(file, args),
+        session,
+    };
+}

package/dist/escape.d.ts

@@ -0,0 +1,2 @@
+/** Makes JSON safe to embed inside a <script> element; the result is still valid JSON. */
+export declare function escapeJsonForScript(json: string): string;

package/dist/escape.js

@@ -0,0 +1,12 @@
+/* eslint-disable @typescript-eslint/naming-convention -- keys are the literal characters being escaped */
+const REPLACEMENTS = {
+    '<': '\\u003c',
+    '>': '\\u003e',
+    '&': '\\u0026',
+    '\u2028': '\\u2028',
+    '\u2029': '\\u2029',
+};
+/** Makes JSON safe to embed inside a <script> element; the result is still valid JSON. */
+export function escapeJsonForScript(json) {
+    return json.replace(/[<>&\u2028\u2029]/g, (char) => REPLACEMENTS[char] ?? char);
+}

package/dist/index.d.ts

@@ -0,0 +1,9 @@
+export { DEFAULT_CLAIMS, DEFAULT_TTL_MS, DEV_AUDIENCE, DEV_ISSUER, configDir, decodeToken, loadOrCreateKey, mintToken, verifyToken, } from './token.js';
+export type { DevClaimsInput, DevKey, MintOptions, Minted } from './token.js';
+export { escapeJsonForScript } from './escape.js';
+export { main } from './cli.js';
+export type { CliIo } from './cli.js';
+export { buildDevConfig, loadDevFile } from './devfile.js';
+export type { DevFile, DevOverrides } from './devfile.js';
+export { parseOverride, parseTokenArgs, parseTtl } from './args.js';
+export type { TokenArgs } from './args.js';

package/dist/index.js

@@ -0,0 +1,5 @@
+export { DEFAULT_CLAIMS, DEFAULT_TTL_MS, DEV_AUDIENCE, DEV_ISSUER, configDir, decodeToken, loadOrCreateKey, mintToken, verifyToken, } from './token.js';
+export { escapeJsonForScript } from './escape.js';
+export { main } from './cli.js';
+export { buildDevConfig, loadDevFile } from './devfile.js';
+export { parseOverride, parseTokenArgs, parseTtl } from './args.js';

package/dist/inject.d.ts

@@ -0,0 +1,12 @@
+import type { ServerResponse } from 'node:http';
+import type { DevConfig } from '@aistrike-dev/ui-shell-sdk/shell';
+/** Mirrors the contract's DEV_CONFIG_GLOBAL (the contract is a devDependency, types only; a test asserts equality). */
+export declare const DEV_CONFIG_GLOBAL = "__AISTRIKE_SHELL_DEV__";
+export declare const CONTENT_TYPES: {
+    [ext: string]: string;
+};
+export declare function validateDevConfig(devConfig: DevConfig): void;
+/** Puts `window.__AISTRIKE_SHELL_DEV__ = <escaped json>` before the page's first module script. */
+export declare function injectDevConfig(html: string, devConfig: DevConfig, source: string): string;
+/** Streams a file with its content type and `no-store`, or answers 404. */
+export declare function sendFile(file: string, res: ServerResponse): void;

package/dist/inject.js

@@ -0,0 +1,55 @@
+/* eslint-disable @typescript-eslint/naming-convention -- file extensions and HTTP header names are fixed external keys */
+import { createReadStream, existsSync, statSync } from 'node:fs';
+import { extname } from 'node:path';
+import { escapeJsonForScript } from './escape.js';
+/** Mirrors the contract's DEV_CONFIG_GLOBAL (the contract is a devDependency, types only; a test asserts equality). */
+export const DEV_CONFIG_GLOBAL = '__AISTRIKE_SHELL_DEV__';
+export const CONTENT_TYPES = {
+    '.html': 'text/html; charset=utf-8',
+    '.js': 'text/javascript; charset=utf-8',
+    '.mjs': 'text/javascript; charset=utf-8',
+    '.css': 'text/css; charset=utf-8',
+    '.json': 'application/json; charset=utf-8',
+    '.svg': 'image/svg+xml',
+    '.png': 'image/png',
+    '.ico': 'image/x-icon',
+    '.woff2': 'font/woff2',
+    '.txt': 'text/plain; charset=utf-8',
+};
+export function validateDevConfig(devConfig) {
+    if (devConfig.profile === undefined || devConfig.profile === '') {
+        throw new Error('dev config must name a profile');
+    }
+    if (devConfig.session !== undefined && !(devConfig.session.expiresAt > Date.now())) {
+        throw new Error('dev session is already expired; mint a new token');
+    }
+}
+/** Puts `window.__AISTRIKE_SHELL_DEV__ = <escaped json>` before the page's first module script. */
+export function injectDevConfig(html, devConfig, source) {
+    const marker = '<script type="module"';
+    const at = html.indexOf(marker);
+    if (at === -1) {
+        throw new Error(`${source} has no module script to inject before`);
+    }
+    const tag = `<script>window.${DEV_CONFIG_GLOBAL} = ${escapeJsonForScript(JSON.stringify(devConfig))};</script>\n    `;
+    return `${html.slice(0, at)}${tag}${html.slice(at)}`;
+}
+/** Streams a file with its content type and `no-store`, or answers 404. */
+export function sendFile(file, res) {
+    if (!existsSync(file) || !statSync(file).isFile()) {
+        res.writeHead(404, { 'Content-Type': 'text/plain' });
+        res.end('not found');
+        return;
+    }
+    res.writeHead(200, { 'Content-Type': CONTENT_TYPES[extname(file)] ?? 'application/octet-stream', 'Cache-Control': 'no-store' });
+    createReadStream(file)
+        .on('error', () => {
+        if (res.headersSent) {
+            res.destroy();
+            return;
+        }
+        res.writeHead(500);
+        res.end('error');
+    })
+        .pipe(res);
+}

package/dist/token.d.ts

@@ -0,0 +1,44 @@
+import type { Session } from '@aistrike-dev/ui-shell-sdk';
+export declare const DEV_ISSUER = "aistrike-dev-host";
+export declare const DEV_AUDIENCE = "aistrike-dev";
+export declare const DEFAULT_TTL_MS: number;
+export interface DevKey {
+    kid: string;
+    privateKeyPem: string;
+    publicKeyPem: string;
+}
+export interface DevClaimsInput {
+    sub?: string;
+    name?: string;
+    permissions?: string[];
+    modules?: string[];
+    tenants?: string[];
+    defaultTenant?: string;
+}
+export declare const DEFAULT_CLAIMS: {
+    sub: string;
+    name: string;
+    permissions: string[];
+    modules: string[];
+    tenants: string[];
+    defaultTenant: string;
+};
+export declare function configDir(env?: NodeJS.ProcessEnv): string;
+/** One ES256 key per machine. No deployed environment trusts it; it exists so local back ends can verify if they want to. */
+export declare function loadOrCreateKey(dir?: string): DevKey;
+export interface MintOptions {
+    key: DevKey;
+    claims?: DevClaimsInput;
+    ttlMs?: number;
+    now?: number;
+}
+export interface Minted {
+    token: string;
+    session: Session;
+}
+export declare function mintToken({ key, claims, ttlMs, now }: MintOptions): Minted;
+export declare function decodeToken(token: string): {
+    header: unknown;
+    payload: unknown;
+};
+export declare function verifyToken(token: string, publicKeyPem: string): boolean;