@askdb/studio 0.2.0-beta.35 → 0.2.0-beta.36

package/dist/package-manager.js

@@ -0,0 +1,54 @@
+/**
+ * Package-manager helpers shared by the setup wizard (`setup.ts`) and the
+ * execute-driver install endpoint (`server.ts`).
+ *
+ * Only allowlisted package names ever reach these helpers — never
+ * browser-supplied strings — but {@link packageManagerSpawnSpec} re-checks
+ * every argument anyway because Windows needs `shell: true` (see below).
+ */
+import { existsSync } from "node:fs";
+import { join } from "node:path";
+/** The package manager implied by a lockfile directly inside `dir`, if any. */
+export function lockfilePackageManager(dir) {
+    if (existsSync(join(dir, "pnpm-lock.yaml")))
+        return "pnpm";
+    if (existsSync(join(dir, "bun.lockb")) || existsSync(join(dir, "bun.lock")))
+        return "bun";
+    if (existsSync(join(dir, "yarn.lock")))
+        return "yarn";
+    if (existsSync(join(dir, "package-lock.json")))
+        return "npm";
+    return null;
+}
+/** Arguments that add `packages` as dependencies with the given package manager. */
+export function packageManagerAddArgs(pm, packages) {
+    return pm === "npm" ? ["install", "--save", ...packages] : ["add", ...packages];
+}
+/** Human-readable install command, e.g. `pnpm add pg`. */
+export function formatInstallCommand(pm, packages) {
+    return [pm, ...packageManagerAddArgs(pm, packages)].join(" ");
+}
+// npm package names (optionally scoped, optionally with a version/range suffix)
+// and simple `--flag` arguments. Nothing a shell would interpret.
+const SAFE_ARG = /^(?:--[a-z][a-z-]*|(?:@[a-z0-9][a-z0-9._-]*\/)?[a-z0-9][a-z0-9._-]*(?:@[a-z0-9.^~<>=*_-]+)?|add|install)$/i;
+/**
+ * How to spawn a package manager on this platform.
+ *
+ * On Windows, package managers are `.cmd` shims, and Node refuses to spawn
+ * `.cmd`/`.bat` files without a shell (EINVAL since Node 18.20.2 / 20.12.2,
+ * CVE-2024-27980). So Windows gets `shell: true` with the bare command name.
+ * Arguments are validated against a strict allowlist pattern first, so the
+ * shell never sees anything it could interpret.
+ */
+export function packageManagerSpawnSpec(pm, args, platform = process.platform) {
+    for (const arg of args) {
+        if (!SAFE_ARG.test(arg)) {
+            throw new Error(`Refusing to pass unsafe argument to ${pm}: ${JSON.stringify(arg)}`);
+        }
+    }
+    if (platform === "win32") {
+        return { command: pm, args: [...args], shell: true };
+    }
+    return { command: pm, args: [...args], shell: false };
+}
+//# sourceMappingURL=package-manager.js.map

package/dist/package-manager.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"package-manager.js","sourceRoot":"","sources":["../src/package-manager.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAIjC,+EAA+E;AAC/E,MAAM,UAAU,sBAAsB,CAAC,GAAW;IAChD,IAAI,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,gBAAgB,CAAC,CAAC;QAAE,OAAO,MAAM,CAAC;IAC3D,IAAI,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC,IAAI,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IAC1F,IAAI,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;QAAE,OAAO,MAAM,CAAC;IACtD,IAAI,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,mBAAmB,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IAC7D,OAAO,IAAI,CAAC;AACd,CAAC;AAED,oFAAoF;AACpF,MAAM,UAAU,qBAAqB,CAAC,EAAkB,EAAE,QAA2B;IACnF,OAAO,EAAE,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,EAAE,QAAQ,EAAE,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE,GAAG,QAAQ,CAAC,CAAC;AAClF,CAAC;AAED,0DAA0D;AAC1D,MAAM,UAAU,oBAAoB,CAAC,EAAkB,EAAE,QAA2B;IAClF,OAAO,CAAC,EAAE,EAAE,GAAG,qBAAqB,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAChE,CAAC;AAQD,gFAAgF;AAChF,kEAAkE;AAClE,MAAM,QAAQ,GAAG,4GAA4G,CAAC;AAE9H;;;;;;;;GAQG;AACH,MAAM,UAAU,uBAAuB,CACrC,EAAkB,EAClB,IAAuB,EACvB,WAA4B,OAAO,CAAC,QAAQ;IAE5C,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YACxB,MAAM,IAAI,KAAK,CAAC,uCAAuC,EAAE,KAAK,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACvF,CAAC;IACH,CAAC;IACD,IAAI,QAAQ,KAAK,OAAO,EAAE,CAAC;QACzB,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,GAAG,IAAI,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;IACvD,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,GAAG,IAAI,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;AACxD,CAAC"}

package/dist/request-guard.d.ts

@@ -0,0 +1,44 @@
+import type { IncomingMessage } from "node:http";
+/**
+ * Request guard for the Studio local server.
+ *
+ * Studio's API can execute SQL against the configured database and write
+ * schema files, so it must not be drivable by arbitrary web pages the
+ * developer happens to visit. Three layers, applied before routing:
+ *
+ * 1. Host allowlist (every request, including static assets) — defeats DNS
+ *    rebinding: a page on `evil.example` that rebinds to 127.0.0.1 still sends
+ *    `Host: evil.example:<port>`.
+ * 2. Origin + content-type checks on state-changing `/api/*` requests —
+ *    cross-site `fetch`/form posts carry a foreign `Origin`, and requiring
+ *    `application/json` forces a CORS preflight that Studio never answers.
+ * 3. A per-launch random session token, embedded in the served `index.html`
+ *    and required on every `/api/*` request as `x-askdb-studio-token`. A
+ *    cross-origin page can't read `index.html`, so it can't learn the token.
+ */
+export declare const STUDIO_TOKEN_HEADER = "x-askdb-studio-token";
+export declare const STUDIO_TOKEN_META_NAME = "askdb-studio-token";
+export type GuardFailure = {
+    status: 403 | 415;
+    message: string;
+};
+export declare function createStudioSessionToken(): string;
+/** Hosts that mean "listen on every interface". */
+export declare function isWildcardHost(host: string | undefined): boolean;
+/** True for hosts only reachable from this machine. */
+export declare function isLoopbackHost(host: string | undefined): boolean;
+/**
+ * Host allowlist. Accepts `localhost`, `127.0.0.1`, `[::1]`, and the explicitly
+ * configured listen host (or, for wildcard binds, this machine's interface
+ * addresses) — and only on the port the connection actually arrived on.
+ */
+export declare function checkHost(req: IncomingMessage, listenHost: string | undefined): GuardFailure | null;
+/**
+ * `/api/*` checks: same-origin `Origin` on state-changing requests, the
+ * per-launch session token, and a JSON content type on requests with a body.
+ * Call after {@link checkHost} has passed.
+ */
+export declare function checkApiRequest(req: IncomingMessage, sessionToken: string): GuardFailure | null;
+/** Insert the session-token `<meta>` tag into the served `index.html`. */
+export declare function injectSessionToken(html: string, sessionToken: string): string;
+//# sourceMappingURL=request-guard.d.ts.map

package/dist/request-guard.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"request-guard.d.ts","sourceRoot":"","sources":["../src/request-guard.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AAGjD;;;;;;;;;;;;;;;;GAgBG;AAEH,eAAO,MAAM,mBAAmB,yBAAyB,CAAC;AAC1D,eAAO,MAAM,sBAAsB,uBAAuB,CAAC;AAE3D,MAAM,MAAM,YAAY,GAAG;IAAE,MAAM,EAAE,GAAG,GAAG,GAAG,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAElE,wBAAgB,wBAAwB,IAAI,MAAM,CAEjD;AAED,mDAAmD;AACnD,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAIhE;AAED,uDAAuD;AACvD,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAShE;AAgDD;;;;GAIG;AACH,wBAAgB,SAAS,CAAC,GAAG,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,GAAG,SAAS,GAAG,YAAY,GAAG,IAAI,CAenG;AAID;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,GAAG,YAAY,GAAG,IAAI,CA2B/F;AA4BD,0EAA0E;AAC1E,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,MAAM,CAG7E"}

package/dist/request-guard.js

@@ -0,0 +1,170 @@
+import { randomBytes, timingSafeEqual } from "node:crypto";
+import { networkInterfaces } from "node:os";
+/**
+ * Request guard for the Studio local server.
+ *
+ * Studio's API can execute SQL against the configured database and write
+ * schema files, so it must not be drivable by arbitrary web pages the
+ * developer happens to visit. Three layers, applied before routing:
+ *
+ * 1. Host allowlist (every request, including static assets) — defeats DNS
+ *    rebinding: a page on `evil.example` that rebinds to 127.0.0.1 still sends
+ *    `Host: evil.example:<port>`.
+ * 2. Origin + content-type checks on state-changing `/api/*` requests —
+ *    cross-site `fetch`/form posts carry a foreign `Origin`, and requiring
+ *    `application/json` forces a CORS preflight that Studio never answers.
+ * 3. A per-launch random session token, embedded in the served `index.html`
+ *    and required on every `/api/*` request as `x-askdb-studio-token`. A
+ *    cross-origin page can't read `index.html`, so it can't learn the token.
+ */
+export const STUDIO_TOKEN_HEADER = "x-askdb-studio-token";
+export const STUDIO_TOKEN_META_NAME = "askdb-studio-token";
+export function createStudioSessionToken() {
+    return randomBytes(32).toString("hex");
+}
+/** Hosts that mean "listen on every interface". */
+export function isWildcardHost(host) {
+    if (host === undefined)
+        return false;
+    const h = host.trim().toLowerCase();
+    return h === "" || h === "0.0.0.0" || h === "::" || h === "[::]";
+}
+/** True for hosts only reachable from this machine. */
+export function isLoopbackHost(host) {
+    if (host === undefined)
+        return true;
+    const h = host.trim().toLowerCase();
+    return (h === "localhost" ||
+        h === "::1" ||
+        h === "[::1]" ||
+        /^127(?:\.\d{1,3}){3}$/.test(h));
+}
+// A Host header is `hostname[:port]` — nothing else. Rejecting userinfo, paths,
+// and whitespace up front matters because `new URL("http://" + host)` would
+// happily parse `evil@127.0.0.1` as hostname 127.0.0.1.
+const HOST_HEADER_PATTERN = /^(?:[a-z0-9.-]+|\[[0-9a-f:.]+\])(?::\d{1,5})?$/i;
+/** Parse a Host header into its normalized `hostname` / `host` / numeric port. */
+function parseHostHeader(value) {
+    if (!HOST_HEADER_PATTERN.test(value))
+        return null;
+    try {
+        const url = new URL(`http://${value}`);
+        return { hostname: url.hostname, host: url.host, port: url.port === "" ? 80 : Number(url.port) };
+    }
+    catch {
+        return null;
+    }
+}
+/** Normalize a bare host/IP the same way `URL` normalizes a Host header's hostname. */
+function normalizeHostname(host) {
+    const trimmed = host.trim();
+    if (trimmed === "")
+        return null;
+    const bracketed = trimmed.includes(":") && !trimmed.startsWith("[") ? `[${trimmed}]` : trimmed;
+    try {
+        return new URL(`http://${bracketed}`).hostname;
+    }
+    catch {
+        return null;
+    }
+}
+const LOOPBACK_HOSTNAMES = new Set(["localhost", "127.0.0.1", "[::1]"]);
+function isAllowedHostname(hostname, listenHost) {
+    if (LOOPBACK_HOSTNAMES.has(hostname))
+        return true;
+    if (listenHost === undefined)
+        return false;
+    if (isWildcardHost(listenHost)) {
+        // Bound to every interface: accept this machine's own interface addresses
+        // (e.g. the LAN IP the CLI prints). IP literals can't be DNS-rebound.
+        for (const entries of Object.values(networkInterfaces())) {
+            for (const entry of entries ?? []) {
+                if (normalizeHostname(entry.address) === hostname)
+                    return true;
+            }
+        }
+        return false;
+    }
+    return normalizeHostname(listenHost) === hostname;
+}
+/**
+ * Host allowlist. Accepts `localhost`, `127.0.0.1`, `[::1]`, and the explicitly
+ * configured listen host (or, for wildcard binds, this machine's interface
+ * addresses) — and only on the port the connection actually arrived on.
+ */
+export function checkHost(req, listenHost) {
+    const raw = req.headers.host;
+    const parsed = typeof raw === "string" ? parseHostHeader(raw) : null;
+    if (!parsed ||
+        parsed.port !== req.socket.localPort ||
+        !isAllowedHostname(parsed.hostname, listenHost)) {
+        return {
+            status: 403,
+            message: "Studio rejected this request: unrecognized Host header. Open Studio via http://127.0.0.1:<port> or http://localhost:<port>.",
+        };
+    }
+    return null;
+}
+const SAFE_METHODS = new Set(["GET", "HEAD", "OPTIONS"]);
+/**
+ * `/api/*` checks: same-origin `Origin` on state-changing requests, the
+ * per-launch session token, and a JSON content type on requests with a body.
+ * Call after {@link checkHost} has passed.
+ */
+export function checkApiRequest(req, sessionToken) {
+    const method = (req.method ?? "GET").toUpperCase();
+    if (!SAFE_METHODS.has(method)) {
+        const origin = req.headers.origin;
+        if (origin !== undefined && !isSameOrigin(origin, req.headers.host)) {
+            return { status: 403, message: "Studio rejected this request: cross-origin requests are not allowed." };
+        }
+    }
+    if (!tokenMatches(req.headers[STUDIO_TOKEN_HEADER], sessionToken)) {
+        return {
+            status: 403,
+            message: "Studio rejected this request: missing or invalid session token. Reload Studio in the browser (the token changes every launch).",
+        };
+    }
+    if (!SAFE_METHODS.has(method) && (method !== "DELETE" || hasRequestBody(req))) {
+        const contentType = req.headers["content-type"];
+        const mediaType = typeof contentType === "string" ? contentType.split(";")[0].trim().toLowerCase() : "";
+        if (mediaType !== "application/json") {
+            return { status: 415, message: "Studio API requests must use Content-Type: application/json." };
+        }
+    }
+    return null;
+}
+function isSameOrigin(origin, hostHeader) {
+    if (typeof origin !== "string" || typeof hostHeader !== "string")
+        return false;
+    const host = parseHostHeader(hostHeader);
+    if (!host)
+        return false;
+    try {
+        const url = new URL(origin);
+        return url.protocol === "http:" && url.host === host.host;
+    }
+    catch {
+        // Includes `Origin: null` (sandboxed iframes, file://, some redirects).
+        return false;
+    }
+}
+function tokenMatches(provided, expected) {
+    if (typeof provided !== "string")
+        return false;
+    const a = Buffer.from(provided, "utf8");
+    const b = Buffer.from(expected, "utf8");
+    return a.length === b.length && timingSafeEqual(a, b);
+}
+function hasRequestBody(req) {
+    const length = req.headers["content-length"];
+    if (length !== undefined && Number(length) > 0)
+        return true;
+    return req.headers["transfer-encoding"] !== undefined;
+}
+/** Insert the session-token `<meta>` tag into the served `index.html`. */
+export function injectSessionToken(html, sessionToken) {
+    const tag = `<meta name="${STUDIO_TOKEN_META_NAME}" content="${sessionToken}" />`;
+    return html.includes("</head>") ? html.replace("</head>", `    ${tag}\n  </head>`) : `${tag}\n${html}`;
+}
+//# sourceMappingURL=request-guard.js.map

package/dist/request-guard.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"request-guard.js","sourceRoot":"","sources":["../src/request-guard.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAE3D,OAAO,EAAE,iBAAiB,EAAE,MAAM,SAAS,CAAC;AAE5C;;;;;;;;;;;;;;;;GAgBG;AAEH,MAAM,CAAC,MAAM,mBAAmB,GAAG,sBAAsB,CAAC;AAC1D,MAAM,CAAC,MAAM,sBAAsB,GAAG,oBAAoB,CAAC;AAI3D,MAAM,UAAU,wBAAwB;IACtC,OAAO,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AACzC,CAAC;AAED,mDAAmD;AACnD,MAAM,UAAU,cAAc,CAAC,IAAwB;IACrD,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IACrC,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACpC,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,SAAS,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,MAAM,CAAC;AACnE,CAAC;AAED,uDAAuD;AACvD,MAAM,UAAU,cAAc,CAAC,IAAwB;IACrD,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACpC,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACpC,OAAO,CACL,CAAC,KAAK,WAAW;QACjB,CAAC,KAAK,KAAK;QACX,CAAC,KAAK,OAAO;QACb,uBAAuB,CAAC,IAAI,CAAC,CAAC,CAAC,CAChC,CAAC;AACJ,CAAC;AAED,gFAAgF;AAChF,4EAA4E;AAC5E,wDAAwD;AACxD,MAAM,mBAAmB,GAAG,iDAAiD,CAAC;AAE9E,kFAAkF;AAClF,SAAS,eAAe,CAAC,KAAa;IACpC,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAClD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,UAAU,KAAK,EAAE,CAAC,CAAC;QACvC,OAAO,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;IACnG,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,uFAAuF;AACvF,SAAS,iBAAiB,CAAC,IAAY;IACrC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;IAC5B,IAAI,OAAO,KAAK,EAAE;QAAE,OAAO,IAAI,CAAC;IAChC,MAAM,SAAS,GAAG,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,OAAO,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC;IAC/F,IAAI,CAAC;QACH,OAAO,IAAI,GAAG,CAAC,UAAU,SAAS,EAAE,CAAC,CAAC,QAAQ,CAAC;IACjD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC,CAAC;AAExE,SAAS,iBAAiB,CAAC,QAAgB,EAAE,UAA8B;IACzE,IAAI,kBAAkB,CAAC,GAAG,CAAC,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC;IAClD,IAAI,UAAU,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IAC3C,IAAI,cAAc,CAAC,UAAU,CAAC,EAAE,CAAC;QAC/B,0EAA0E;QAC1E,sEAAsE;QACtE,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,MAAM,CAAC,iBAAiB,EAAE,CAAC,EAAE,CAAC;YACzD,KAAK,MAAM,KAAK,IAAI,OAAO,IAAI,EAAE,EAAE,CAAC;gBAClC,IAAI,iBAAiB,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,QAAQ;oBAAE,OAAO,IAAI,CAAC;YACjE,CAAC;QACH,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,iBAAiB,CAAC,UAAU,CAAC,KAAK,QAAQ,CAAC;AACpD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,SAAS,CAAC,GAAoB,EAAE,UAA8B;IAC5E,MAAM,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC;IAC7B,MAAM,MAAM,GAAG,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACrE,IACE,CAAC,MAAM;QACP,MAAM,CAAC,IAAI,KAAK,GAAG,CAAC,MAAM,CAAC,SAAS;QACpC,CAAC,iBAAiB,CAAC,MAAM,CAAC,QAAQ,EAAE,UAAU,CAAC,EAC/C,CAAC;QACD,OAAO;YACL,MAAM,EAAE,GAAG;YACX,OAAO,EACL,6HAA6H;SAChI,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC;AAEzD;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAAC,GAAoB,EAAE,YAAoB;IACxE,MAAM,MAAM,GAAG,CAAC,GAAG,CAAC,MAAM,IAAI,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC;IAEnD,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;QAC9B,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC;QAClC,IAAI,MAAM,KAAK,SAAS,IAAI,CAAC,YAAY,CAAC,MAAM,EAAE,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;YACpE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,sEAAsE,EAAE,CAAC;QAC1G,CAAC;IACH,CAAC;IAED,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,mBAAmB,CAAC,EAAE,YAAY,CAAC,EAAE,CAAC;QAClE,OAAO;YACL,MAAM,EAAE,GAAG;YACX,OAAO,EACL,gIAAgI;SACnI,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,KAAK,QAAQ,IAAI,cAAc,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;QAC9E,MAAM,WAAW,GAAG,GAAG,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;QAChD,MAAM,SAAS,GAAG,OAAO,WAAW,KAAK,QAAQ,CAAC,CAAC,CAAC,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAE,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACzG,IAAI,SAAS,KAAK,kBAAkB,EAAE,CAAC;YACrC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,8DAA8D,EAAE,CAAC;QAClG,CAAC;IACH,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,YAAY,CAAC,MAAyB,EAAE,UAA8B;IAC7E,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,OAAO,UAAU,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC/E,MAAM,IAAI,GAAG,eAAe,CAAC,UAAU,CAAC,CAAC;IACzC,IAAI,CAAC,IAAI;QAAE,OAAO,KAAK,CAAC;IACxB,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;QAC5B,OAAO,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,GAAG,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI,CAAC;IAC5D,CAAC;IAAC,MAAM,CAAC;QACP,wEAAwE;QACxE,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,SAAS,YAAY,CAAC,QAAuC,EAAE,QAAgB;IAC7E,IAAI,OAAO,QAAQ,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC/C,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IACxC,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IACxC,OAAO,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,IAAI,eAAe,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AACxD,CAAC;AAED,SAAS,cAAc,CAAC,GAAoB;IAC1C,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC;IAC7C,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAC5D,OAAO,GAAG,CAAC,OAAO,CAAC,mBAAmB,CAAC,KAAK,SAAS,CAAC;AACxD,CAAC;AAED,0EAA0E;AAC1E,MAAM,UAAU,kBAAkB,CAAC,IAAY,EAAE,YAAoB;IACnE,MAAM,GAAG,GAAG,eAAe,sBAAsB,cAAc,YAAY,MAAM,CAAC;IAClF,OAAO,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,OAAO,GAAG,aAAa,CAAC,CAAC,CAAC,CAAC,GAAG,GAAG,KAAK,IAAI,EAAE,CAAC;AACzG,CAAC"}

package/dist/server.d.ts

@@ -1,7 +1,9 @@
-import { createServer } from "node:http";
+import { type Server } from "node:http";
 import { createPgvectorStore } from "@askdb/rag";
 import { type Workspace } from "@askdb/enrich";
 import type { SetupReason, StudioWorkspaceDto } from "./shared/api.js";
+/** @internal Tests only — serve client assets from another directory. */
+export declare function setStudioClientDirForTests(dir: string | undefined): void;
 export type StudioOptions = {
     schema: string;
     host?: string;
@@ -14,8 +16,17 @@ export type StudioOptions = {
      */
     setupReason?: SetupReason | null;
 };
-export type StudioServer = ReturnType<typeof createServer>;
+export type StudioServer = Server & {
+    /**
+     * Per-launch session token. Every `/api/*` request must send it as the
+     * `x-askdb-studio-token` header; the browser app reads it from a `<meta>`
+     * tag injected into the served `index.html`.
+     */
+    readonly sessionToken: string;
+};
 export declare function setStudioPgvectorStoreFactoryForTests(factory: typeof createPgvectorStore | undefined): void;
 export declare function createStudioServer(options: StudioOptions): StudioServer;
 export declare function serializeWorkspace(workspace: Workspace): StudioWorkspaceDto;
+/** Largest JSON request body Studio accepts. */
+export declare const MAX_JSON_BODY_BYTES: number;
 //# sourceMappingURL=server.d.ts.map

package/dist/server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,YAAY,EAA6C,MAAM,WAAW,CAAC;AAgCpF,OAAO,EAOL,mBAAmB,EAOpB,MAAM,YAAY,CAAC;AACpB,OAAO,EAaL,KAAK,SAAS,EACf,MAAM,eAAe,CAAC;AACvB,OAAO,KAAK,EAYV,WAAW,EAKX,kBAAkB,EAGnB,MAAM,iBAAiB,CAAC;AAUzB,MAAM,MAAM,aAAa,GAAG;IAC1B,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;;;OAKG;IACH,WAAW,CAAC,EAAE,WAAW,GAAG,IAAI,CAAC;CAClC,CAAC;AAEF,MAAM,MAAM,YAAY,GAAG,UAAU,CAAC,OAAO,YAAY,CAAC,CAAC;AA0D3D,wBAAgB,qCAAqC,CACnD,OAAO,EAAE,OAAO,mBAAmB,GAAG,SAAS,GAC9C,IAAI,CAEN;AAED,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,aAAa,GAAG,YAAY,CAwJvE;AAED,wBAAgB,kBAAkB,CAAC,SAAS,EAAE,SAAS,GAAG,kBAAkB,CA8C3E"}
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAEA,OAAO,EAAsC,KAAK,MAAM,EAAuB,MAAM,WAAW,CAAC;AAwCjG,OAAO,EAOL,mBAAmB,EAOpB,MAAM,YAAY,CAAC;AACpB,OAAO,EAaL,KAAK,SAAS,EACf,MAAM,eAAe,CAAC;AACvB,OAAO,KAAK,EAYV,WAAW,EAKX,kBAAkB,EAGnB,MAAM,iBAAiB,CAAC;AA4BzB,yEAAyE;AACzE,wBAAgB,0BAA0B,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,CAExE;AAMD,MAAM,MAAM,aAAa,GAAG;IAC1B,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;;;OAKG;IACH,WAAW,CAAC,EAAE,WAAW,GAAG,IAAI,CAAC;CAClC,CAAC;AAEF,MAAM,MAAM,YAAY,GAAG,MAAM,GAAG;IAClC;;;;OAIG;IACH,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;CAC/B,CAAC;AA0DF,wBAAgB,qCAAqC,CACnD,OAAO,EAAE,OAAO,mBAAmB,GAAG,SAAS,GAC9C,IAAI,CAEN;AAED,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,aAAa,GAAG,YAAY,CAuKvE;AAED,wBAAgB,kBAAkB,CAAC,SAAS,EAAE,SAAS,GAAG,kBAAkB,CA+C3E;AAmnDD,gDAAgD;AAChD,eAAO,MAAM,mBAAmB,QAAc,CAAC"}