@assistant-ui/vscode 0.0.0-stage → 0.0.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 AgentbaseAI Inc.
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -1,3 +1,160 @@
-# Temporary Holding Version
+# @assistant-ui/vscode
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+Run [assistant-ui](https://www.assistant-ui.com/) inside a VS Code extension webview.
+
+```sh
+npm install @assistant-ui/vscode
+```
+
+Start a new extension with `npx assistant-ui@latest create my-extension -t vscode`, or follow the [VS Code guide](https://www.assistant-ui.com/docs/guides/vscode) to add it to an existing one.
+
+A webview cannot reach your backend with `fetch`, so this package tunnels `fetch` over the webview's `postMessage` channel. Your route handlers (`(req: Request) => Response`) run unchanged in the extension host, and their responses stream back to the webview.
+
+## Entry points
+
+- `@assistant-ui/vscode/host` runs in the extension host. It never imports the `vscode` module.
+- `@assistant-ui/vscode/webview` runs in the webview bundle.
+
+## Extension host
+
+```ts
+import { serveWebviewRoutes } from "@assistant-ui/vscode/host";
+import { POST } from "./api/chat";
+
+export function resolveWebviewView(view: vscode.WebviewView) {
+  view.webview.options = { enableScripts: true };
+  const server = serveWebviewRoutes(view.webview, {
+    "/api/chat": { POST },
+  });
+  view.onDidDispose(() => server.dispose());
+}
+```
+
+Unknown paths answer `404`, unsupported methods `405`, and a handler that throws `500`. Aborting the request in the webview aborts `req.signal` in the handler, and disposing the server rejects the requests still in flight. `vscodeFetch` only reaches these routes, so a URL on another `http:` or `https:` origin rejects with a `TypeError`, and the host answers a request for such a URL with an error instead of routing it. `serveWebviewRoutes` serves routes only: host calls from `installLinkInterceptor` or `createVSCodeStorage` reject in the webview, so use [`serveWebviewHost`](#host-services) when the webview uses them.
+
+## Webview
+
+When a reloaded page first acquires the VS Code API, it notifies the host to abort requests from the previous page, including response streams still in progress. Creating another fetch client in the same page does not cancel active requests.
+
+Pass `vscodeFetch` to any runtime that takes a `fetch`:
+
+```tsx
+import { useChatRuntime, AssistantChatTransport } from "@assistant-ui/ai-sdk";
+import { vscodeFetch } from "@assistant-ui/vscode/webview";
+
+const runtime = useChatRuntime({
+  transport: new AssistantChatTransport({ api: "/api/chat", fetch: vscodeFetch }),
+});
+```
+
+## Host services
+
+`serveWebviewHost` serves the same `routes` as `serveWebviewRoutes` and also answers the webview's calls into the host. Use it in place of `serveWebviewRoutes`:
+
+```ts
+import { serveWebviewHost } from "@assistant-ui/vscode/host";
+
+const host = serveWebviewHost(view.webview, {
+  routes: { "/api/chat": { POST } },
+  openExternal: (url) => vscode.env.openExternal(url as unknown as vscode.Uri),
+  storage: context.globalState,
+});
+view.onDidDispose(() => host.dispose());
+```
+
+### External links
+
+A webview cannot navigate away or open windows. `installLinkInterceptor()` catches clicks on absolute `http:`, `https:`, and `mailto:` links, plus `window.open` calls, and asks the host to open them with `openExternal`. The host checks the scheme again against `externalSchemes` before calling it. Keep `command:`, `vscode:`, and `file:` out of `externalSchemes`, because a link in model output could then run a command or open a local file. Relative links, `#anchors`, and clicks the app already `preventDefault`ed are left alone.
+
+Pass the URL string itself to `vscode.env.openExternal`, as above. VS Code opens a string as it is, but it re-encodes a `vscode.Uri.parse(url)` result, which decodes characters such as `%2B` and `%26` and breaks signed URLs.
+
+```ts
+import { installLinkInterceptor } from "@assistant-ui/vscode/webview";
+
+installLinkInterceptor();
+```
+
+### Thread persistence
+
+`createVSCodeStorage()` stores threads in the Memento passed as `storage` (`context.globalState` or `context.workspaceState`), so they survive reloading the window. Its keys are namespaced by `storagePrefix` (default `"@assistant-ui/vscode:"`).
+
+```tsx
+import { createLocalStorageAdapter } from "@assistant-ui/core/react";
+import { useRemoteThreadListRuntime } from "@assistant-ui/react";
+import { AssistantChatTransport, useChatRuntime } from "@assistant-ui/ai-sdk";
+import { createVSCodeStorage, vscodeFetch } from "@assistant-ui/vscode/webview";
+
+const threads = createLocalStorageAdapter({ storage: createVSCodeStorage() });
+const transport = new AssistantChatTransport({ api: "/api/chat", fetch: vscodeFetch });
+
+const runtime = useRemoteThreadListRuntime({
+  adapter: threads,
+  runtimeHook: function useThreadRuntime() {
+    return useChatRuntime({ transport });
+  },
+});
+```
+
+`acquireVsCodeApi()` may only be called once per webview. Use `getVSCodeApi()` wherever your webview code needs the API.
+
+## Webview HTML and Content Security Policy
+
+`renderWebviewHtml` returns the webview's HTML with a Content Security Policy, a fresh nonce on every script tag, and your bundle's URIs converted with `asWebviewUri`:
+
+```ts
+import { renderWebviewHtml } from "@assistant-ui/vscode/host";
+
+const dist = vscode.Uri.joinPath(context.extensionUri, "dist");
+view.webview.options = { enableScripts: true, localResourceRoots: [dist] };
+view.webview.html = renderWebviewHtml(view.webview, {
+  scripts: [vscode.Uri.joinPath(dist, "webview.js")],
+  styles: [vscode.Uri.joinPath(dist, "webview.css")],
+  title: "Chat",
+});
+```
+
+The strict policy (the default) is:
+
+```
+default-src 'none'; script-src 'nonce-…'; style-src <cspSource> 'nonce-…';
+img-src <cspSource> blob: data:; media-src <cspSource> blob: data:;
+font-src <cspSource> data:; connect-src <cspSource>; frame-src 'none'
+```
+
+- `csp: "relaxed"` replaces the style nonce with `'unsafe-inline'`, for libraries that inject `<style>` tags without a nonce. Browsers ignore `'unsafe-inline'` next to a nonce, so the nonce is dropped from `style-src`. `script-src` keeps it.
+- `connectSrc`, `frameSrc`, and `scriptSrc` append sources, one host or scheme per entry. Code-split chunks should need no `scriptSrc` entry, because a module script's imports, `import()` included, inherit its nonce. The VS Code test bed only covers a single classic bundle, so check the webview's developer tools for CSP errors if you split.
+- `imgSrc` and `mediaSrc` append sources to `img-src` and `media-src`. Remote images and media are blocked by default, because an image URL in model output loads as soon as the message renders and can carry chat data away. Allow the hosts you trust, such as `https://icons.duckduckgo.com` for the favicons of the `Sources` component (which falls back to an icon when they are blocked), or `"https:"` for every remote image.
+- `wasmUnsafeEval: true` adds `'wasm-unsafe-eval'` for WebAssembly. `'unsafe-eval'` is never added.
+- `surface` sets `data-aui-vscode-surface` on `<body>` for the theme, `rootId` names the mount element (`"root"`, or `null` for none), and `scriptType: "classic"` emits deferred classic scripts instead of modules.
+
+`createWebviewCsp(webview, { nonce })` returns only the policy, and `createCspNonce()` a nonce, if you write your own HTML.
+
+The nonce is also written to `<meta property="csp-nonce">`, the tag Vite reads. In the webview, `getCspNonce()` from `@assistant-ui/vscode/webview` returns it for libraries that inject tags at runtime.
+
+## Theme
+
+`@assistant-ui/vscode/theme.css` maps the shadcn tokens used by assistant-ui's components (`--background`, `--primary`, `--muted-foreground`, `--border`, `--ring`, `--sidebar-*`, `--chart-*`, `--radius`, and the rest) to VS Code's `--vscode-*` theme variables, so the webview restyles itself when the user switches colour theme. It also re-points Tailwind's `dark:` variant at VS Code's `vscode-dark` and dark high-contrast body classes, sets `color-scheme`, uses the VS Code UI and editor fonts for `font-sans` and `font-mono`, and adds contrast borders and focus outlines under high-contrast themes.
+
+`--muted` and `--secondary` mix 6% and 12% of `--foreground` into `--background`, because no VS Code variable stays distinct from every surface: `--vscode-input-background` equals the editor background in Light Modern, and `--vscode-button-secondaryBackground` is transparent in Dark Modern. Under high-contrast themes, `--primary` is `--vscode-textLink-foreground` with `--background` as its foreground, since Dark High Contrast sets `--vscode-button-background` to its black background, and user message bubbles, the composer quote, and the active thread in the thread list get a contrast outline.
+
+Import it after Tailwind:
+
+```css
+@import "tailwindcss";
+@import "tw-animate-css";
+@import "@assistant-ui/vscode/theme.css";
+```
+
+If you keep an existing `globals.css` (such as the one from the assistant-ui templates), import the theme at the end of the file instead. Tailwind keeps the last `@custom-variant dark` and the last `@theme` value for a key, so a theme imported above the template's own `@custom-variant dark (&:is(.dark *))` and `--font-sans` leaves those in charge. The colour tokens are set on `body`, so they override a template's `:root` values in either position.
+
+To override a token, set it on `body`:
+
+```css
+body {
+  --radius: 0.25rem;
+}
+```
+
+The background follows a webview view in the sidebar by default. Set `data-aui-vscode-surface` on `<html>` or `<body>` to `"editor"` for a webview panel in an editor tab, or to `"panel"` for a view in the bottom panel.
+
+VS Code injects a default stylesheet into every webview (body padding, link, `code`, `kbd` and block quote colours, focus outlines), unlayered in older releases and as `@layer vscode-default` in newer ones. The theme resets those properties in either case, so Tailwind's preflight and your utilities decide them.

package/dist/external-url.d.ts

@@ -0,0 +1,3 @@
+export declare const DEFAULT_EXTERNAL_SCHEMES: readonly string[];
+export declare const parseExternalUrl: (value: unknown, schemes: readonly string[]) => string | null;
+//# sourceMappingURL=external-url.d.ts.map

package/dist/external-url.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"external-url.d.ts","sourceRoot":"","sources":["../src/external-url.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,wBAAwB,EAAE,SAAS,MAAM,EAIrD,CAAC;AAEF,eAAO,MAAM,gBAAgB,GAC3B,OAAO,OAAO,EACd,SAAS,SAAS,MAAM,EAAE,KACzB,MAAM,GAAG,IASX,CAAC"}

package/dist/external-url.js

@@ -0,0 +1,19 @@
+// src/external-url.ts
+const DEFAULT_EXTERNAL_SCHEMES = [
+	"http:",
+	"https:",
+	"mailto:"
+];
+const parseExternalUrl = (value, schemes) => {
+	if (typeof value !== "string" && !(value instanceof URL)) return null;
+	let url;
+	try {
+		url = new URL(value);
+	} catch {
+		return null;
+	}
+	return schemes.includes(url.protocol) ? url.href : null;
+};
+export { DEFAULT_EXTERNAL_SCHEMES, parseExternalUrl };
+
+//# sourceMappingURL=external-url.js.map

package/dist/external-url.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"external-url.js","names":[],"sources":["../src/external-url.ts"],"sourcesContent":["export const DEFAULT_EXTERNAL_SCHEMES: readonly string[] = [\n  \"http:\",\n  \"https:\",\n  \"mailto:\",\n];\n\nexport const parseExternalUrl = (\n  value: unknown,\n  schemes: readonly string[],\n): string | null => {\n  if (typeof value !== \"string\" && !(value instanceof URL)) return null;\n  let url: URL;\n  try {\n    url = new URL(value);\n  } catch {\n    return null;\n  }\n  return schemes.includes(url.protocol) ? url.href : null;\n};\n"],"mappings":";AAAA,MAAa,2BAA8C;CACzD;CACA;CACA;AACF;AAEA,MAAa,oBACX,OACA,YACkB;CAClB,IAAI,OAAO,UAAU,YAAY,EAAE,iBAAiB,MAAM,OAAO;CACjE,IAAI;CACJ,IAAI;EACF,MAAM,IAAI,IAAI,KAAK;CACrB,QAAQ;EACN,OAAO;CACT;CACA,OAAO,QAAQ,SAAS,IAAI,QAAQ,IAAI,IAAI,OAAO;AACrD"}

package/dist/host/html.d.ts

@@ -0,0 +1,65 @@
+export type WebviewCspSource = {
+    /** A source list, such as VS Code's `'self' https://*.vscode-cdn.net`. */
+    readonly cspSource: string;
+};
+export type WebviewResourceLike<U> = WebviewCspSource & {
+    asWebviewUri(uri: U): {
+        toString(): string;
+    };
+};
+export type WebviewCspMode = "strict" | "relaxed";
+export type WebviewCspOptions = {
+    nonce: string;
+    /**
+     * `"relaxed"` swaps the style nonce for `'unsafe-inline'`, for libraries
+     * that inject `<style>` tags without a nonce.
+     */
+    csp?: WebviewCspMode;
+    /**
+     * Extra `script-src` sources, one host or scheme per entry. Code-split
+     * chunks need none: a module script's imports inherit its nonce.
+     */
+    scriptSrc?: readonly string[];
+    connectSrc?: readonly string[];
+    /**
+     * Extra `img-src` sources, such as `"https:"`. Remote images are blocked by
+     * default, because an image URL in model output can carry chat data away.
+     */
+    imgSrc?: readonly string[];
+    /** Extra `media-src` sources, blocked by default like `imgSrc`. */
+    mediaSrc?: readonly string[];
+    frameSrc?: readonly string[];
+    /** Adds `'wasm-unsafe-eval'` to `script-src` for WebAssembly modules. */
+    wasmUnsafeEval?: boolean;
+};
+export type WebviewSurface = "sidebar" | "editor" | "panel";
+export type RenderWebviewHtmlOptions<U> = Omit<WebviewCspOptions, "nonce"> & {
+    scripts: readonly U[];
+    styles?: readonly U[];
+    title?: string;
+    lang?: string;
+    /** Defaults to a fresh random nonce per render. */
+    nonce?: string;
+    /** Sets `data-aui-vscode-surface` for `@assistant-ui/vscode/theme.css`. */
+    surface?: WebviewSurface;
+    /** Id of the empty mount element; `null` omits it. */
+    rootId?: string | null;
+    /** `"module"` (default) or `"classic"` deferred scripts. */
+    scriptType?: "module" | "classic";
+    htmlAttributes?: Readonly<Record<string, string>>;
+    bodyAttributes?: Readonly<Record<string, string>>;
+};
+/** Returns a base64 nonce from 16 cryptographically random bytes. */
+export declare function createCspNonce(): string;
+/**
+ * Returns the Content-Security-Policy for a webview whose scripts carry
+ * `nonce` and whose other resources load through `asWebviewUri`.
+ */
+export declare function createWebviewCsp(webview: WebviewCspSource, options: WebviewCspOptions): string;
+/**
+ * Renders the HTML document for a webview: a CSP meta tag, the nonce in
+ * `<meta property="csp-nonce">` for `getCspNonce()`, the stylesheets, a mount
+ * element, and the scripts, each carrying the nonce.
+ */
+export declare function renderWebviewHtml<U>(webview: WebviewResourceLike<U>, options: RenderWebviewHtmlOptions<U>): string;
+//# sourceMappingURL=html.d.ts.map

package/dist/host/html.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"html.d.ts","sourceRoot":"","sources":["../../src/host/html.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,gBAAgB,GAAG;IAC7B,0EAA0E;IAC1E,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B,CAAC;AAEF,MAAM,MAAM,mBAAmB,CAAC,CAAC,IAAI,gBAAgB,GAAG;IACtD,YAAY,CAAC,GAAG,EAAE,CAAC,GAAG;QAAE,QAAQ,IAAI,MAAM,CAAA;KAAE,CAAC;CAC9C,CAAC;AAEF,MAAM,MAAM,cAAc,GAAG,QAAQ,GAAG,SAAS,CAAC;AAElD,MAAM,MAAM,iBAAiB,GAAG;IAC9B,KAAK,EAAE,MAAM,CAAC;IACd;;;OAGG;IACH,GAAG,CAAC,EAAE,cAAc,CAAC;IACrB;;;OAGG;IACH,SAAS,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC9B,UAAU,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC/B;;;OAGG;IACH,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC3B,mEAAmE;IACnE,QAAQ,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC7B,QAAQ,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC7B,yEAAyE;IACzE,cAAc,CAAC,EAAE,OAAO,CAAC;CAC1B,CAAC;AAEF,MAAM,MAAM,cAAc,GAAG,SAAS,GAAG,QAAQ,GAAG,OAAO,CAAC;AAE5D,MAAM,MAAM,wBAAwB,CAAC,CAAC,IAAI,IAAI,CAAC,iBAAiB,EAAE,OAAO,CAAC,GAAG;IAC3E,OAAO,EAAE,SAAS,CAAC,EAAE,CAAC;IACtB,MAAM,CAAC,EAAE,SAAS,CAAC,EAAE,CAAC;IACtB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,mDAAmD;IACnD,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,2EAA2E;IAC3E,OAAO,CAAC,EAAE,cAAc,CAAC;IACzB,sDAAsD;IACtD,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,4DAA4D;IAC5D,UAAU,CAAC,EAAE,QAAQ,GAAG,SAAS,CAAC;IAClC,cAAc,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAClD,cAAc,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;CACnD,CAAC;AAsDF,qEAAqE;AACrE,wBAAgB,cAAc,IAAI,MAAM,CASvC;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAC9B,OAAO,EAAE,gBAAgB,EACzB,OAAO,EAAE,iBAAiB,GACzB,MAAM,CA2CR;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,CAAC,EACjC,OAAO,EAAE,mBAAmB,CAAC,CAAC,CAAC,EAC/B,OAAO,EAAE,wBAAwB,CAAC,CAAC,CAAC,GACnC,MAAM,CA4CR"}

package/dist/host/html.js

@@ -0,0 +1,126 @@
+// src/host/html.ts
+const NONCE_PATTERN = /^[A-Za-z0-9+/_-]+={0,2}$/;
+const ATTRIBUTE_NAME_PATTERN = /^[A-Za-z_:][-A-Za-z0-9_:.]*$/;
+const INVALID_SOURCE_PATTERN = /[\s;,'"]/;
+const HTML_ESCAPES = {
+	"&": "&",
+	"<": "&lt;",
+	">": "&gt;",
+	"\"": "&quot;",
+	"'": "&#39;"
+};
+const escapeHtml = (value) => value.replace(/[&<>"']/g, (char) => HTML_ESCAPES[char] ?? char);
+const assertNonce = (nonce) => {
+	if (!NONCE_PATTERN.test(nonce)) throw new Error(`Invalid CSP nonce: ${JSON.stringify(nonce)}`);
+};
+const sources = (directive, values) => {
+	for (const value of values) if (value === "" || INVALID_SOURCE_PATTERN.test(value)) throw new Error(`Invalid ${directive} source: ${JSON.stringify(value)}. Pass one host or scheme source per entry.`);
+	return values;
+};
+const cspSourceList = (cspSource) => {
+	const list = cspSource.split(/\s+/).filter((value) => value !== "");
+	if (list.length === 0) throw new Error("Invalid cspSource: empty");
+	sources("cspSource", list.filter((value) => value !== "'self'"));
+	return list.join(" ");
+};
+const attributes = (values) => Object.entries(values).map(([name, value]) => {
+	if (!ATTRIBUTE_NAME_PATTERN.test(name)) throw new Error(`Invalid attribute name: ${JSON.stringify(name)}`);
+	return ` ${name}="${escapeHtml(value)}"`;
+}).join("");
+/** Returns a base64 nonce from 16 cryptographically random bytes. */
+function createCspNonce() {
+	const crypto = globalThis.crypto;
+	if (typeof crypto?.getRandomValues !== "function") throw new Error("createCspNonce() needs globalThis.crypto.getRandomValues (Node.js 19 or later).");
+	const bytes = crypto.getRandomValues(/* @__PURE__ */ new Uint8Array(16));
+	return btoa(String.fromCharCode(...bytes));
+}
+/**
+* Returns the Content-Security-Policy for a webview whose scripts carry
+* `nonce` and whose other resources load through `asWebviewUri`.
+*/
+function createWebviewCsp(webview, options) {
+	const { nonce, csp = "strict" } = options;
+	assertNonce(nonce);
+	const cspSource = cspSourceList(webview.cspSource);
+	const frameSrc = sources("frame-src", options.frameSrc ?? []);
+	return [
+		["default-src", "'none'"],
+		[
+			"script-src",
+			`'nonce-${nonce}'`,
+			...sources("script-src", options.scriptSrc ?? []),
+			...options.wasmUnsafeEval ? ["'wasm-unsafe-eval'"] : []
+		],
+		[
+			"style-src",
+			cspSource,
+			csp === "relaxed" ? "'unsafe-inline'" : `'nonce-${nonce}'`
+		],
+		[
+			"img-src",
+			cspSource,
+			"blob:",
+			"data:",
+			...sources("img-src", options.imgSrc ?? [])
+		],
+		[
+			"media-src",
+			cspSource,
+			"blob:",
+			"data:",
+			...sources("media-src", options.mediaSrc ?? [])
+		],
+		[
+			"font-src",
+			cspSource,
+			"data:"
+		],
+		[
+			"connect-src",
+			cspSource,
+			...sources("connect-src", options.connectSrc ?? [])
+		],
+		["frame-src", ...frameSrc.length > 0 ? frameSrc : ["'none'"]]
+	].map((directive) => directive.join(" ")).join("; ");
+}
+/**
+* Renders the HTML document for a webview: a CSP meta tag, the nonce in
+* `<meta property="csp-nonce">` for `getCspNonce()`, the stylesheets, a mount
+* element, and the scripts, each carrying the nonce.
+*/
+function renderWebviewHtml(webview, options) {
+	const { scripts, styles = [], title = "", lang = "en", nonce = createCspNonce(), surface, rootId = "root", scriptType = "module", htmlAttributes = {}, bodyAttributes = {}, ...cspOptions } = options;
+	const csp = createWebviewCsp(webview, {
+		...cspOptions,
+		nonce
+	});
+	const url = (uri) => escapeHtml(webview.asWebviewUri(uri).toString());
+	const scriptAttributes = scriptType === "module" ? " type=\"module\"" : " defer";
+	return [
+		"<!doctype html>",
+		`<html${attributes({
+			lang,
+			...htmlAttributes
+		})}>`,
+		"<head>",
+		"<meta charset=\"utf-8\">",
+		`<meta http-equiv="Content-Security-Policy" content="${escapeHtml(csp)}">`,
+		"<meta name=\"viewport\" content=\"width=device-width, initial-scale=1\">",
+		`<meta property="csp-nonce" nonce="${nonce}">`,
+		`<title>${escapeHtml(title)}</title>`,
+		...styles.map((uri) => `<link rel="stylesheet" href="${url(uri)}">`),
+		"</head>",
+		`<body${attributes({
+			...surface ? { "data-aui-vscode-surface": surface } : {},
+			...bodyAttributes
+		})}>`,
+		...rootId === null ? [] : [`<div id="${escapeHtml(rootId)}"></div>`],
+		...scripts.map((uri) => `<script${scriptAttributes} nonce="${nonce}" src="${url(uri)}"><\/script>`),
+		"</body>",
+		"</html>",
+		""
+	].join("\n");
+}
+export { createCspNonce, createWebviewCsp, renderWebviewHtml };
+
+//# sourceMappingURL=html.js.map

package/dist/host/html.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"html.js","names":[],"sources":["../../src/host/html.ts"],"sourcesContent":["export type WebviewCspSource = {\n  /** A source list, such as VS Code's `'self' https://*.vscode-cdn.net`. */\n  readonly cspSource: string;\n};\n\nexport type WebviewResourceLike<U> = WebviewCspSource & {\n  asWebviewUri(uri: U): { toString(): string };\n};\n\nexport type WebviewCspMode = \"strict\" | \"relaxed\";\n\nexport type WebviewCspOptions = {\n  nonce: string;\n  /**\n   * `\"relaxed\"` swaps the style nonce for `'unsafe-inline'`, for libraries\n   * that inject `<style>` tags without a nonce.\n   */\n  csp?: WebviewCspMode;\n  /**\n   * Extra `script-src` sources, one host or scheme per entry. Code-split\n   * chunks need none: a module script's imports inherit its nonce.\n   */\n  scriptSrc?: readonly string[];\n  connectSrc?: readonly string[];\n  /**\n   * Extra `img-src` sources, such as `\"https:\"`. Remote images are blocked by\n   * default, because an image URL in model output can carry chat data away.\n   */\n  imgSrc?: readonly string[];\n  /** Extra `media-src` sources, blocked by default like `imgSrc`. */\n  mediaSrc?: readonly string[];\n  frameSrc?: readonly string[];\n  /** Adds `'wasm-unsafe-eval'` to `script-src` for WebAssembly modules. */\n  wasmUnsafeEval?: boolean;\n};\n\nexport type WebviewSurface = \"sidebar\" | \"editor\" | \"panel\";\n\nexport type RenderWebviewHtmlOptions<U> = Omit<WebviewCspOptions, \"nonce\"> & {\n  scripts: readonly U[];\n  styles?: readonly U[];\n  title?: string;\n  lang?: string;\n  /** Defaults to a fresh random nonce per render. */\n  nonce?: string;\n  /** Sets `data-aui-vscode-surface` for `@assistant-ui/vscode/theme.css`. */\n  surface?: WebviewSurface;\n  /** Id of the empty mount element; `null` omits it. */\n  rootId?: string | null;\n  /** `\"module\"` (default) or `\"classic\"` deferred scripts. */\n  scriptType?: \"module\" | \"classic\";\n  htmlAttributes?: Readonly<Record<string, string>>;\n  bodyAttributes?: Readonly<Record<string, string>>;\n};\n\nconst NONCE_PATTERN = /^[A-Za-z0-9+/_-]+={0,2}$/;\nconst ATTRIBUTE_NAME_PATTERN = /^[A-Za-z_:][-A-Za-z0-9_:.]*$/;\nconst INVALID_SOURCE_PATTERN = /[\\s;,'\"]/;\n\nconst HTML_ESCAPES: Record<string, string> = {\n  \"&\": \"&amp;\",\n  \"<\": \"&lt;\",\n  \">\": \"&gt;\",\n  '\"': \"&quot;\",\n  \"'\": \"&#39;\",\n};\n\nconst escapeHtml = (value: string) =>\n  value.replace(/[&<>\"']/g, (char) => HTML_ESCAPES[char] ?? char);\n\nconst assertNonce = (nonce: string) => {\n  if (!NONCE_PATTERN.test(nonce)) {\n    throw new Error(`Invalid CSP nonce: ${JSON.stringify(nonce)}`);\n  }\n};\n\nconst sources = (directive: string, values: readonly string[]) => {\n  for (const value of values) {\n    if (value === \"\" || INVALID_SOURCE_PATTERN.test(value)) {\n      throw new Error(\n        `Invalid ${directive} source: ${JSON.stringify(value)}. Pass one host or scheme source per entry.`,\n      );\n    }\n  }\n  return values;\n};\n\nconst cspSourceList = (cspSource: string) => {\n  const list = cspSource.split(/\\s+/).filter((value) => value !== \"\");\n  if (list.length === 0) throw new Error(\"Invalid cspSource: empty\");\n  sources(\n    \"cspSource\",\n    list.filter((value) => value !== \"'self'\"),\n  );\n  return list.join(\" \");\n};\n\nconst attributes = (values: Readonly<Record<string, string>>) =>\n  Object.entries(values)\n    .map(([name, value]) => {\n      if (!ATTRIBUTE_NAME_PATTERN.test(name)) {\n        throw new Error(`Invalid attribute name: ${JSON.stringify(name)}`);\n      }\n      return ` ${name}=\"${escapeHtml(value)}\"`;\n    })\n    .join(\"\");\n\n/** Returns a base64 nonce from 16 cryptographically random bytes. */\nexport function createCspNonce(): string {\n  const crypto = globalThis.crypto;\n  if (typeof crypto?.getRandomValues !== \"function\") {\n    throw new Error(\n      \"createCspNonce() needs globalThis.crypto.getRandomValues (Node.js 19 or later).\",\n    );\n  }\n  const bytes = crypto.getRandomValues(new Uint8Array(16));\n  return btoa(String.fromCharCode(...bytes));\n}\n\n/**\n * Returns the Content-Security-Policy for a webview whose scripts carry\n * `nonce` and whose other resources load through `asWebviewUri`.\n */\nexport function createWebviewCsp(\n  webview: WebviewCspSource,\n  options: WebviewCspOptions,\n): string {\n  const { nonce, csp = \"strict\" } = options;\n  assertNonce(nonce);\n  const cspSource = cspSourceList(webview.cspSource);\n  const frameSrc = sources(\"frame-src\", options.frameSrc ?? []);\n\n  const directives: [string, ...string[]][] = [\n    [\"default-src\", \"'none'\"],\n    [\n      \"script-src\",\n      `'nonce-${nonce}'`,\n      ...sources(\"script-src\", options.scriptSrc ?? []),\n      ...(options.wasmUnsafeEval ? [\"'wasm-unsafe-eval'\"] : []),\n    ],\n    [\n      \"style-src\",\n      cspSource,\n      csp === \"relaxed\" ? \"'unsafe-inline'\" : `'nonce-${nonce}'`,\n    ],\n    [\n      \"img-src\",\n      cspSource,\n      \"blob:\",\n      \"data:\",\n      ...sources(\"img-src\", options.imgSrc ?? []),\n    ],\n    [\n      \"media-src\",\n      cspSource,\n      \"blob:\",\n      \"data:\",\n      ...sources(\"media-src\", options.mediaSrc ?? []),\n    ],\n    [\"font-src\", cspSource, \"data:\"],\n    [\n      \"connect-src\",\n      cspSource,\n      ...sources(\"connect-src\", options.connectSrc ?? []),\n    ],\n    [\"frame-src\", ...(frameSrc.length > 0 ? frameSrc : [\"'none'\"])],\n  ];\n\n  return directives.map((directive) => directive.join(\" \")).join(\"; \");\n}\n\n/**\n * Renders the HTML document for a webview: a CSP meta tag, the nonce in\n * `<meta property=\"csp-nonce\">` for `getCspNonce()`, the stylesheets, a mount\n * element, and the scripts, each carrying the nonce.\n */\nexport function renderWebviewHtml<U>(\n  webview: WebviewResourceLike<U>,\n  options: RenderWebviewHtmlOptions<U>,\n): string {\n  const {\n    scripts,\n    styles = [],\n    title = \"\",\n    lang = \"en\",\n    nonce = createCspNonce(),\n    surface,\n    rootId = \"root\",\n    scriptType = \"module\",\n    htmlAttributes = {},\n    bodyAttributes = {},\n    ...cspOptions\n  } = options;\n\n  const csp = createWebviewCsp(webview, { ...cspOptions, nonce });\n  const url = (uri: U) => escapeHtml(webview.asWebviewUri(uri).toString());\n  const scriptAttributes =\n    scriptType === \"module\" ? ' type=\"module\"' : \" defer\";\n\n  return [\n    \"<!doctype html>\",\n    `<html${attributes({ lang, ...htmlAttributes })}>`,\n    \"<head>\",\n    '<meta charset=\"utf-8\">',\n    `<meta http-equiv=\"Content-Security-Policy\" content=\"${escapeHtml(csp)}\">`,\n    '<meta name=\"viewport\" content=\"width=device-width, initial-scale=1\">',\n    `<meta property=\"csp-nonce\" nonce=\"${nonce}\">`,\n    `<title>${escapeHtml(title)}</title>`,\n    ...styles.map((uri) => `<link rel=\"stylesheet\" href=\"${url(uri)}\">`),\n    \"</head>\",\n    `<body${attributes({\n      ...(surface ? { \"data-aui-vscode-surface\": surface } : {}),\n      ...bodyAttributes,\n    })}>`,\n    ...(rootId === null ? [] : [`<div id=\"${escapeHtml(rootId)}\"></div>`]),\n    ...scripts.map(\n      (uri) =>\n        `<script${scriptAttributes} nonce=\"${nonce}\" src=\"${url(uri)}\"></script>`,\n    ),\n    \"</body>\",\n    \"</html>\",\n    \"\",\n  ].join(\"\\n\");\n}\n"],"mappings":";AAuDA,MAAM,gBAAgB;AACtB,MAAM,yBAAyB;AAC/B,MAAM,yBAAyB;AAE/B,MAAM,eAAuC;CAC3C,KAAK;CACL,KAAK;CACL,KAAK;CACL,MAAK;CACL,KAAK;AACP;AAEA,MAAM,cAAc,UAClB,MAAM,QAAQ,aAAa,SAAS,aAAa,SAAS,IAAI;AAEhE,MAAM,eAAe,UAAkB;CACrC,IAAI,CAAC,cAAc,KAAK,KAAK,GAC3B,MAAM,IAAI,MAAM,sBAAsB,KAAK,UAAU,KAAK,GAAG;AAEjE;AAEA,MAAM,WAAW,WAAmB,WAA8B;CAChE,KAAK,MAAM,SAAS,QAClB,IAAI,UAAU,MAAM,uBAAuB,KAAK,KAAK,GACnD,MAAM,IAAI,MACR,WAAW,UAAU,WAAW,KAAK,UAAU,KAAK,EAAE,4CACxD;CAGJ,OAAO;AACT;AAEA,MAAM,iBAAiB,cAAsB;CAC3C,MAAM,OAAO,UAAU,MAAM,KAAK,CAAC,CAAC,QAAQ,UAAU,UAAU,EAAE;CAClE,IAAI,KAAK,WAAW,GAAG,MAAM,IAAI,MAAM,0BAA0B;CACjE,QACE,aACA,KAAK,QAAQ,UAAU,UAAU,QAAQ,CAC3C;CACA,OAAO,KAAK,KAAK,GAAG;AACtB;AAEA,MAAM,cAAc,WAClB,OAAO,QAAQ,MAAM,CAAC,CACnB,KAAK,CAAC,MAAM,WAAW;CACtB,IAAI,CAAC,uBAAuB,KAAK,IAAI,GACnC,MAAM,IAAI,MAAM,2BAA2B,KAAK,UAAU,IAAI,GAAG;CAEnE,OAAO,IAAI,KAAK,IAAI,WAAW,KAAK,EAAE;AACxC,CAAC,CAAC,CACD,KAAK,EAAE;;AAGZ,SAAgB,iBAAyB;CACvC,MAAM,SAAS,WAAW;CAC1B,IAAI,OAAO,QAAQ,oBAAoB,YACrC,MAAM,IAAI,MACR,iFACF;CAEF,MAAM,QAAQ,OAAO,gCAAgB,IAAI,WAAW,EAAE,CAAC;CACvD,OAAO,KAAK,OAAO,aAAa,GAAG,KAAK,CAAC;AAC3C;;;;;AAMA,SAAgB,iBACd,SACA,SACQ;CACR,MAAM,EAAE,OAAO,MAAM,aAAa;CAClC,YAAY,KAAK;CACjB,MAAM,YAAY,cAAc,QAAQ,SAAS;CACjD,MAAM,WAAW,QAAQ,aAAa,QAAQ,YAAY,CAAC,CAAC;CAsC5D,OAAO;EAnCL,CAAC,eAAe,QAAQ;EACxB;GACE;GACA,UAAU,MAAM;GAChB,GAAG,QAAQ,cAAc,QAAQ,aAAa,CAAC,CAAC;GAChD,GAAI,QAAQ,iBAAiB,CAAC,oBAAoB,IAAI,CAAC;EACzD;EACA;GACE;GACA;GACA,QAAQ,YAAY,oBAAoB,UAAU,MAAM;EAC1D;EACA;GACE;GACA;GACA;GACA;GACA,GAAG,QAAQ,WAAW,QAAQ,UAAU,CAAC,CAAC;EAC5C;EACA;GACE;GACA;GACA;GACA;GACA,GAAG,QAAQ,aAAa,QAAQ,YAAY,CAAC,CAAC;EAChD;EACA;GAAC;GAAY;GAAW;EAAO;EAC/B;GACE;GACA;GACA,GAAG,QAAQ,eAAe,QAAQ,cAAc,CAAC,CAAC;EACpD;EACA,CAAC,aAAa,GAAI,SAAS,SAAS,IAAI,WAAW,CAAC,QAAQ,CAAE;CAGhD,CAAC,CAAC,KAAK,cAAc,UAAU,KAAK,GAAG,CAAC,CAAC,CAAC,KAAK,IAAI;AACrE;;;;;;AAOA,SAAgB,kBACd,SACA,SACQ;CACR,MAAM,EACJ,SACA,SAAS,CAAC,GACV,QAAQ,IACR,OAAO,MACP,QAAQ,eAAe,GACvB,SACA,SAAS,QACT,aAAa,UACb,iBAAiB,CAAC,GAClB,iBAAiB,CAAC,GAClB,GAAG,eACD;CAEJ,MAAM,MAAM,iBAAiB,SAAS;EAAE,GAAG;EAAY;CAAM,CAAC;CAC9D,MAAM,OAAO,QAAW,WAAW,QAAQ,aAAa,GAAG,CAAC,CAAC,SAAS,CAAC;CACvE,MAAM,mBACJ,eAAe,WAAW,qBAAmB;CAE/C,OAAO;EACL;EACA,QAAQ,WAAW;GAAE;GAAM,GAAG;EAAe,CAAC,EAAE;EAChD;EACA;EACA,uDAAuD,WAAW,GAAG,EAAE;EACvE;EACA,qCAAqC,MAAM;EAC3C,UAAU,WAAW,KAAK,EAAE;EAC5B,GAAG,OAAO,KAAK,QAAQ,gCAAgC,IAAI,GAAG,EAAE,GAAG;EACnE;EACA,QAAQ,WAAW;GACjB,GAAI,UAAU,EAAE,2BAA2B,QAAQ,IAAI,CAAC;GACxD,GAAG;EACL,CAAC,EAAE;EACH,GAAI,WAAW,OAAO,CAAC,IAAI,CAAC,YAAY,WAAW,MAAM,EAAE,SAAS;EACpE,GAAG,QAAQ,KACR,QACC,UAAU,iBAAiB,UAAU,MAAM,SAAS,IAAI,GAAG,EAAE,aACjE;EACA;EACA;EACA;CACF,CAAC,CAAC,KAAK,IAAI;AACb"}

package/dist/host/router.d.ts

@@ -0,0 +1,24 @@
+export type RouteHandler = (request: Request) => Response | Promise<Response>;
+export type HttpMethod = "GET" | "HEAD" | "POST" | "PUT" | "PATCH" | "DELETE" | "OPTIONS";
+export type RouteHandlers = {
+    [M in HttpMethod]?: RouteHandler;
+};
+export type WebviewRoutes = Record<string, RouteHandlers>;
+export type WebviewLike = {
+    postMessage(message: any): PromiseLike<boolean>;
+    onDidReceiveMessage(listener: (message: any) => unknown): {
+        dispose(): unknown;
+    };
+};
+export type ServeWebviewRoutesOptions = {
+    /** Milliseconds to coalesce response chunks before posting them. */
+    flushInterval?: number;
+    /** Buffered byte count that posts a chunk without waiting. */
+    flushSize?: number;
+    onError?: (error: unknown) => void;
+};
+export type Disposable = {
+    dispose(): void;
+};
+export declare function serveRoutes(webview: WebviewLike, routes: WebviewRoutes, { flushInterval, flushSize, onError, }?: ServeWebviewRoutesOptions): Disposable;
+//# sourceMappingURL=router.d.ts.map

package/dist/host/router.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"router.d.ts","sourceRoot":"","sources":["../../src/host/router.ts"],"names":[],"mappings":"AASA,MAAM,MAAM,YAAY,GAAG,CAAC,OAAO,EAAE,OAAO,KAAK,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;AAE9E,MAAM,MAAM,UAAU,GAClB,KAAK,GACL,MAAM,GACN,MAAM,GACN,KAAK,GACL,OAAO,GACP,QAAQ,GACR,SAAS,CAAC;AAEd,MAAM,MAAM,aAAa,GAAG;KAAG,CAAC,IAAI,UAAU,CAAC,CAAC,EAAE,YAAY;CAAE,CAAC;AAEjE,MAAM,MAAM,aAAa,GAAG,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;AAE1D,MAAM,MAAM,WAAW,GAAG;IACxB,WAAW,CAAC,OAAO,EAAE,GAAG,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC;IAChD,mBAAmB,CAAC,QAAQ,EAAE,CAAC,OAAO,EAAE,GAAG,KAAK,OAAO,GAAG;QACxD,OAAO,IAAI,OAAO,CAAC;KACpB,CAAC;CACH,CAAC;AAEF,MAAM,MAAM,yBAAyB,GAAG;IACtC,oEAAoE;IACpE,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,8DAA8D;IAC9D,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,IAAI,CAAC;CACpC,CAAC;AAEF,MAAM,MAAM,UAAU,GAAG;IAAE,OAAO,IAAI,IAAI,CAAA;CAAE,CAAC;AAiB7C,wBAAgB,WAAW,CACzB,OAAO,EAAE,WAAW,EACpB,MAAM,EAAE,aAAa,EACrB,EACE,aAAkB,EAClB,SAAqB,EACrB,OAAyC,GAC1C,GAAE,yBAA8B,GAChC,UAAU,CA4LZ"}

package/dist/host/router.js

@@ -0,0 +1,166 @@
+import { VSCODE_BRIDGE_CHANNEL, VSCODE_VIRTUAL_ORIGIN, isWebviewToHostMessage } from "../protocol.js";
+import { isForeignHttpUrl } from "../route-url.js";
+// src/host/router.ts
+const BODYLESS_METHODS = /* @__PURE__ */ new Set(["GET", "HEAD"]);
+const concat = (parts, size) => {
+	const out = new Uint8Array(size);
+	let offset = 0;
+	for (const part of parts) {
+		out.set(part, offset);
+		offset += part.byteLength;
+	}
+	return out;
+};
+const errorMessage = (error) => error instanceof Error ? error.message : String(error);
+function serveRoutes(webview, routes, { flushInterval = 16, flushSize = 65536, onError = (error) => console.error(error) } = {}) {
+	const inflight = /* @__PURE__ */ new Map();
+	const post = (message, controller) => {
+		Promise.resolve(webview.postMessage(message)).then((delivered) => {
+			if (!delivered) controller.abort();
+		}, () => controller.abort());
+	};
+	const dispatch = async (request, pathname) => {
+		const route = Object.hasOwn(routes, pathname) ? routes[pathname] : null;
+		if (!route) return new Response("Not Found", { status: 404 });
+		const handler = Object.hasOwn(route, request.method) ? route[request.method] : null;
+		if (!handler) return new Response("Method Not Allowed", {
+			status: 405,
+			headers: { Allow: Object.keys(route).join(", ") }
+		});
+		try {
+			return await handler(request);
+		} catch (error) {
+			if (request.signal.aborted) throw error;
+			onError(error);
+			return new Response("Internal Server Error", { status: 500 });
+		}
+	};
+	const pump = async (id, body, controller) => {
+		const { signal } = controller;
+		const reader = body.getReader();
+		const onAbort = () => {
+			reader.cancel(signal.reason).catch(() => void 0);
+		};
+		signal.addEventListener("abort", onAbort, { once: true });
+		let buffered = [];
+		let size = 0;
+		let timer;
+		const flush = () => {
+			if (timer !== void 0) clearTimeout(timer);
+			timer = void 0;
+			if (size === 0 || signal.aborted) return;
+			const chunk = concat(buffered, size);
+			buffered = [];
+			size = 0;
+			post({
+				channel: VSCODE_BRIDGE_CHANNEL,
+				kind: "fetch:chunk",
+				id,
+				chunk
+			}, controller);
+		};
+		try {
+			while (true) {
+				const { done, value } = await reader.read();
+				if (done || signal.aborted) break;
+				if (value.byteLength === 0) continue;
+				buffered.push(value);
+				size += value.byteLength;
+				if (size >= flushSize || flushInterval <= 0) flush();
+				else timer ??= setTimeout(flush, flushInterval);
+			}
+			flush();
+		} catch (error) {
+			flush();
+			throw error;
+		} finally {
+			if (timer !== void 0) clearTimeout(timer);
+			signal.removeEventListener("abort", onAbort);
+			reader.releaseLock();
+		}
+	};
+	const handle = async (message) => {
+		const { id } = message;
+		if (inflight.has(id)) {
+			onError(/* @__PURE__ */ new Error(`Ignored a request reusing the in-flight id ${id}`));
+			return;
+		}
+		const controller = new AbortController();
+		inflight.set(id, controller);
+		try {
+			const url = new URL(message.url);
+			if (isForeignHttpUrl(url)) throw new TypeError(`Refused a request for ${url.origin}`);
+			const requestUrl = new URL(VSCODE_VIRTUAL_ORIGIN);
+			requestUrl.pathname = url.pathname;
+			requestUrl.search = url.search;
+			const request = new Request(requestUrl, {
+				method: message.method,
+				headers: message.headers,
+				body: BODYLESS_METHODS.has(message.method.toUpperCase()) ? null : message.body,
+				signal: controller.signal
+			});
+			const response = await dispatch(request, url.pathname);
+			if (controller.signal.aborted) {
+				response.body?.cancel().catch(() => void 0);
+				return;
+			}
+			post({
+				channel: VSCODE_BRIDGE_CHANNEL,
+				kind: "fetch:head",
+				id,
+				status: response.status,
+				statusText: response.statusText,
+				headers: [...response.headers]
+			}, controller);
+			if (request.method === "HEAD") response.body?.cancel().catch(() => void 0);
+			else if (response.body) await pump(id, response.body, controller);
+			if (!controller.signal.aborted) post({
+				channel: VSCODE_BRIDGE_CHANNEL,
+				kind: "fetch:end",
+				id
+			}, controller);
+		} catch (error) {
+			if (controller.signal.aborted) return;
+			onError(error);
+			post({
+				channel: VSCODE_BRIDGE_CHANNEL,
+				kind: "fetch:error",
+				id,
+				message: errorMessage(error)
+			}, controller);
+		} finally {
+			if (inflight.get(id) === controller) inflight.delete(id);
+		}
+	};
+	const subscription = webview.onDidReceiveMessage((message) => {
+		if (!isWebviewToHostMessage(message)) return;
+		if (message.kind === "fetch:request") handle(message);
+		else if (message.kind === "fetch:reset") {
+			const controllers = [...inflight.values()];
+			inflight.clear();
+			for (const controller of controllers) controller.abort();
+		} else if (message.kind === "fetch:abort") {
+			const controller = inflight.get(message.id);
+			if (controller) {
+				inflight.delete(message.id);
+				controller.abort();
+			}
+		}
+	});
+	return { dispose: () => {
+		subscription.dispose();
+		for (const [id, controller] of inflight) {
+			post({
+				channel: VSCODE_BRIDGE_CHANNEL,
+				kind: "fetch:error",
+				id,
+				message: "Webview routes disposed"
+			}, controller);
+			controller.abort();
+		}
+		inflight.clear();
+	} };
+}
+export { serveRoutes };
+
+//# sourceMappingURL=router.js.map