@awiki/dsh-plugin 0.2.2 → 0.2.4

package/README.md

@@ -36,9 +36,16 @@ group administration, realtime push, or multiple attachments in one message.
 Install the official public npm package:
 
 ```bash
-pnpm add @awiki/dsh-plugin@latest
+dsh plugin --profile web add @awiki/dsh-plugin@latest
 ```
 
+The profile installer both adds the package and activates its bundle layer. A
+plain `npm i @awiki/dsh-plugin` in a DSH project only installs the package; it
+does not activate the bundle, so the profile command remains the recommended
+installation path. This release line targets the `0.1.0-rc.7` package family
+and pins every direct Host peer exactly, preventing npm from mixing prerelease
+families in a DSH root dependency tree.
+
 `@awiki/dsh-plugin` is the canonical package identity starting with
 `0.2.0-rc.4`. The former `@awiki/dsh` registry entry was unpublished and is
 not an installation source for this release line.
@@ -107,6 +114,37 @@ stale, without another model call, when newer messages arrive. The replaceable
 for one direct `ctx.llm.stream` request; it does not create an Agent or write an
 Agent session.
 
+## External HTTP ANP authentication
+
+Trusted same-process DSH Host plugins can authenticate an externally transported HTTP request
+without handling ANP signatures, access tokens, challenges, or retries themselves:
+
+```ts
+const response = await ctx.awiki.externalHttpAuth.dispatch(
+  new Request('https://api.example.com/orders', {
+    method: 'POST',
+    headers: { 'content-type': 'application/json' },
+    body: JSON.stringify({ productId: '123' }),
+  }),
+  request => fetch(request),
+)
+```
+
+The callback remains the only network transport owner. AWiki buffers at most 4 MiB of exact body
+bytes, forces manual redirects, asks Rust to select an origin-scoped in-memory Bearer token or a
+fresh HTTP Message Signature, observes only authentication response headers, and invokes the
+transport at most twice for one bounded `401` authentication retry. The final `Response` body is
+untouched. Transport rejections preserve their original error identity.
+
+The unsigned input must not contain `Authorization`, `Signature-Input`, `Signature`, or
+`Content-Digest`. Production targets require HTTPS; test-only loopback HTTP uses the existing
+`allowInsecureLoopbackForTesting` deployment gate. Tokens come only from successful
+`Authentication-Info` responses, are scoped to the current identity/signing key/origin, and are
+not persisted across Harness restarts.
+
+`externalHttpAuth` is deliberately absent from Browser Remote, Agent tools, Typert Remote, and the
+Web client bundle. Exposing it across an untrusted boundary would create a signing oracle.
+
 ## Development
 
 Requirements: Node.js 22.19+ (or 24+) and pnpm 11.7.
@@ -117,7 +155,7 @@ pnpm run verify
 pnpm pack --dry-run
 ```
 
-The production Host loads the exact `@awiki/im-core-node@0.1.2` runtime package;
+The production Host loads the exact `@awiki/im-core-node@0.1.3` runtime package;
 the platform-specific native addon is selected through its optional dependencies
 and remains external to the JavaScript bundle. Consumers do not need Rust or an
 `awiki-cli-rs2` checkout. See `THIRD_PARTY_NOTICES.md` for provenance and

package/README.zh.md

@@ -29,9 +29,14 @@ Rust 身份。
 安装公开发布的官方 npm 包：
 
 ```bash
-pnpm add @awiki/dsh-plugin@latest
+dsh plugin --profile web add @awiki/dsh-plugin@latest
 ```
 
+Profile 安装器会同时添加包并激活 bundle layer。在 DSH 项目根目录执行普通的
+`npm i @awiki/dsh-plugin` 只会安装依赖，不会激活 bundle，因此仍推荐使用上述
+Profile 命令。本发布线面向 `0.1.0-rc.7` 包族，并精确锁定所有直接 Host peer，
+防止 npm 在 DSH 根依赖树中混用不同的预发布版本族。
+
 从 `0.2.0-rc.4` 起，`@awiki/dsh-plugin` 是唯一规范包名。原
 `@awiki/dsh` registry 条目已被 unpublish，不再作为本发布线的安装来源。
 
@@ -87,6 +92,35 @@ MIME、大小和说明，不发送文件二进制；序列化后的对话内容
 调用模型。可替换的 `@awiki/dsh-plugin/summary-provider` 使用 Harness 当前默认 provider/model
 执行一次直接的 `ctx.llm.stream`，不会创建 Agent，也不会写入 Agent session。
 
+## 外部 HTTP ANP 身份认证
+
+可信的 DSH Host 同进程插件可以认证由外部 transport 发送的 HTTP 请求，而无需自行处理
+ANP 签名、Access Token、challenge 或重试：
+
+```ts
+const response = await ctx.awiki.externalHttpAuth.dispatch(
+  new Request('https://api.example.com/orders', {
+    method: 'POST',
+    headers: { 'content-type': 'application/json' },
+    body: JSON.stringify({ productId: '123' }),
+  }),
+  request => fetch(request),
+)
+```
+
+回调函数仍是唯一网络 transport owner。AWiki 最多缓冲 4 MiB 精确 body bytes，强制 manual
+redirect，由 Rust 自动选择当前 origin 的进程内 Bearer Token 或新 HTTP Message Signature，
+只观察认证相关响应头，并且每个逻辑请求最多调用 transport 两次，第二次只能是一次受限的
+`401` 认证重试。最终 `Response` 正文不会被读取；transport rejection 保留原始错误对象。
+
+输入请求不得自行携带 `Authorization`、`Signature-Input`、`Signature` 或
+`Content-Digest`。生产目标必须使用 HTTPS；测试用 loopback HTTP 复用现有
+`allowInsecureLoopbackForTesting` 部署开关。Token 只接受成功响应中的
+`Authentication-Info`，并按当前 identity、signing key 和 origin 隔离；Harness 重启后不保留。
+
+`externalHttpAuth` 不进入 Browser Remote、Agent tools、Typert Remote 或 Web client bundle，
+避免形成跨不可信边界的签名 oracle。
+
 ## 开发与验证
 
 需要 Node.js 22.19+（或 24+）以及 pnpm 11.7：
@@ -97,7 +131,7 @@ pnpm run verify
 pnpm pack --dry-run
 ```
 
-生产 Host 加载固定版本 `@awiki/im-core-node@0.1.2`；平台原生 addon 由它的
+生产 Host 加载固定版本 `@awiki/im-core-node@0.1.3`；平台原生 addon 由它的
 optional dependencies 选择，并保持在 JavaScript bundle 外。使用者无需安装 Rust，
 也无需检出 `awiki-cli-rs2`。来源与许可证见 `THIRD_PARTY_NOTICES.md`。
 

package/THIRD_PARTY_NOTICES.md

@@ -2,7 +2,7 @@
 
 ## AWiki Rust IM Core Node SDK
 
-`@awiki/im-core-node@0.1.2` and its target-specific optional package provide the
+`@awiki/im-core-node@0.1.3` and its target-specific optional package provide the
 Rust IM Core runtime used by the Host provider. These packages are distributed
 under AGPL-3.0-only. Each package carries its own `LICENSE`, `NOTICE.md`,
 `SOURCE.md`, CycloneDX SBOM, checksums, and build provenance. The corresponding

package/lib/index.js

@@ -1,4 +1,4 @@
-import { n as downloadedAttachment } from "./sdk-adapter-DPPZhs6p.mjs";
+import { n as downloadedAttachment } from "./sdk-adapter-DK6RqV-c.mjs";
 import "@deepseek-ai/cordis";
 import { homedir } from "node:os";
 import { join } from "node:path";
@@ -14,6 +14,178 @@ const AWIKI_LOGOUT_CONFIRMATION = "logout-awiki-session";
 /** Exact browser acknowledgement required before destructive local-state removal. */
 const AWIKI_CLEAR_LOCAL_DATA_CONFIRMATION = "clear-awiki-local-data";
 //#endregion
+//#region lib/types/external-http-auth.js
+/** Host-only dispatcher for externally transported ANP-authenticated HTTP. */
+const AWIKI_EXTERNAL_HTTP_MAX_BODY_BYTES = 4194304;
+const MANAGED_HEADERS = [
+	"authorization",
+	"signature-input",
+	"signature",
+	"content-digest"
+];
+const ERROR_MESSAGES = {
+	"not-registered": "A registered AWiki identity is required.",
+	"signed-out": "This installation is signed out of AWiki.",
+	"invalid-request": "The external HTTP request is invalid.",
+	"unsupported-body": "The external HTTP request body cannot be replayed safely.",
+	"body-too-large": "The external HTTP request body exceeds 4 MiB.",
+	"auth-state-unavailable": "AWiki external HTTP authentication is unavailable."
+};
+/** Stable Host-only failure without request, response, credential, or path detail. */
+var AwikiExternalHttpAuthError = class extends Error {
+	code;
+	name = "AwikiExternalHttpAuthError";
+	constructor(code) {
+		super(ERROR_MESSAGES[code]);
+		this.code = code;
+	}
+};
+function createAwikiExternalHttpAuth(acquire) {
+	return Object.freeze({ async dispatch(request, transport) {
+		validateDispatchInput(request, transport);
+		const session = await acquire();
+		await session.assertActive();
+		const body = await readReplayableBody(request);
+		await session.assertActive();
+		let attempt;
+		try {
+			attempt = await session.client.prepareExternalHttpRequest({
+				url: request.url,
+				method: request.method,
+				headers: requestHeaders(request),
+				...body === void 0 ? {} : { body }
+			});
+		} catch (error) {
+			throw mapProviderError(error);
+		}
+		await session.assertActive();
+		const response = await transport(authenticatedRequest(request, body, attempt));
+		const retry = await handleResponseWithoutChangingCompletedRequest(attempt, response);
+		if (retry === null) return response;
+		try {
+			await session.assertActive();
+		} catch {
+			return response;
+		}
+		const retriedResponse = await transport(authenticatedRequest(request, body, retry));
+		await handleResponseWithoutChangingCompletedRequest(retry, retriedResponse);
+		return retriedResponse;
+	} });
+}
+function externalHttpAuthError(code) {
+	return new AwikiExternalHttpAuthError(code);
+}
+function mapProviderError(error) {
+	if (error instanceof AwikiExternalHttpAuthError) return error;
+	try {
+		if (typeof error === "object" && error !== null) {
+			const value = error;
+			if (value.name === "AwikiSdkError") {
+				if (value.code === "not-registered") return externalHttpAuthError("not-registered");
+				if (value.code === "invalid-request") return externalHttpAuthError("invalid-request");
+			}
+		}
+	} catch {}
+	return externalHttpAuthError("auth-state-unavailable");
+}
+function validateDispatchInput(request, transport) {
+	if (!(request instanceof Request) || typeof transport !== "function" || request.bodyUsed) throw externalHttpAuthError("invalid-request");
+	for (const name of MANAGED_HEADERS) if (request.headers.has(name)) throw externalHttpAuthError("invalid-request");
+}
+async function readReplayableBody(request) {
+	if (request.body === null) return void 0;
+	let clone;
+	try {
+		clone = request.clone();
+	} catch {
+		throw externalHttpAuthError("unsupported-body");
+	}
+	const stream = clone.body;
+	if (stream === null) return /* @__PURE__ */ new Uint8Array();
+	const reader = stream.getReader();
+	const chunks = [];
+	let length = 0;
+	try {
+		while (true) {
+			const result = await reader.read();
+			if (result.done) break;
+			length += result.value.byteLength;
+			if (length > 4194304) {
+				reader.cancel().catch(() => {});
+				request.body?.cancel().catch(() => {});
+				throw externalHttpAuthError("body-too-large");
+			}
+			chunks.push(Uint8Array.from(result.value));
+		}
+	} catch (error) {
+		if (error instanceof AwikiExternalHttpAuthError) throw error;
+		throw externalHttpAuthError("unsupported-body");
+	} finally {
+		reader.releaseLock();
+	}
+	const bytes = new Uint8Array(length);
+	let offset = 0;
+	for (const chunk of chunks) {
+		bytes.set(chunk, offset);
+		offset += chunk.byteLength;
+	}
+	return bytes;
+}
+function requestHeaders(request) {
+	return [...request.headers].map(([name, value]) => ({
+		name,
+		value
+	}));
+}
+function authenticatedRequest(original, body, attempt) {
+	const headers = new Headers(original.headers);
+	for (const header of attempt.headerPatch) headers.set(header.name, header.value);
+	const init = {
+		method: attempt.method,
+		headers,
+		redirect: "manual",
+		signal: original.signal,
+		cache: original.cache,
+		credentials: original.credentials,
+		integrity: original.integrity,
+		keepalive: original.keepalive,
+		mode: original.mode,
+		referrer: original.referrer,
+		referrerPolicy: original.referrerPolicy,
+		...body === void 0 ? {} : { body: Uint8Array.from(body) }
+	};
+	try {
+		return new Request(attempt.targetUrl, init);
+	} catch {
+		throw externalHttpAuthError("invalid-request");
+	}
+}
+async function handleResponseWithoutChangingCompletedRequest(attempt, response) {
+	try {
+		return await attempt.handleResponse(responseMetadata(response));
+	} catch {
+		return null;
+	}
+}
+function responseMetadata(response) {
+	const headers = [];
+	for (const name of [
+		"authentication-info",
+		"www-authenticate",
+		"accept-signature"
+	]) {
+		const value = response.headers.get(name);
+		if (value !== null) headers.push({
+			name,
+			value
+		});
+	}
+	return {
+		statusCode: response.status,
+		headers
+	};
+}
+//#endregion
 //#region lib/types/tools.js
 /** Model-facing AWiki read and approved-send tools. */
 /** Model tool that reads the public deployment identity. */
@@ -288,7 +460,7 @@ function unavailable() {
 	return {
 		ok: false,
 		error: {
-			code: "settings-not-exposed",
+			code: "settings-rejected",
 			message: "AWiki settings are unavailable in this Host composition.",
 			details: { ns: AWIKI_SETTINGS_NAMESPACE }
 		}
@@ -1027,6 +1199,8 @@ let AwikiService = (() => {
 		sessionRevision = 0;
 		activeSummaryRequests = /* @__PURE__ */ new Set();
 		summaryProvider;
+		/** Trusted same-process external HTTP authentication dispatcher. Never Remote. */
+		externalHttpAuth;
 		/**
 		* @param ctx - owning Host context.
 		* @param config - service endpoints, SDK state path, and public limits.
@@ -1034,6 +1208,7 @@ let AwikiService = (() => {
 		constructor(ctx, config) {
 			super(ctx, "awiki");
 			this.resolved = resolveConfig(config);
+			this.externalHttpAuth = createAwikiExternalHttpAuth(() => this.acquireExternalHttpAuthSession());
 			this.sessionStore = new AwikiSessionStore(this.resolved.stateRoot);
 			this.startupUserServiceDomain = this.resolved.userServiceDomain;
 			ctx.inject(["settings"], (settingsCtx) => {
@@ -1470,6 +1645,38 @@ let AwikiService = (() => {
 			this.signedOut ??= await this.sessionStore.isSignedOut();
 			return this.signedOut;
 		}
+		/** Bind one external-auth dispatch to the current provider and session revision. */
+		async acquireExternalHttpAuthSession() {
+			let signedOut;
+			try {
+				signedOut = await this.isSignedOut();
+			} catch {
+				throw externalHttpAuthError("auth-state-unavailable");
+			}
+			if (signedOut) throw externalHttpAuthError("signed-out");
+			const revision = this.sessionRevision;
+			const provider = this.provider;
+			if (provider === void 0) throw externalHttpAuthError("auth-state-unavailable");
+			let identity;
+			try {
+				identity = await provider.client.getIdentity();
+			} catch (error) {
+				throw mapProviderError(error);
+			}
+			if (identity === null) throw externalHttpAuthError("not-registered");
+			return {
+				client: provider.client,
+				assertActive: async () => {
+					if (this.provider !== provider || this.sessionRevision !== revision) throw externalHttpAuthError("auth-state-unavailable");
+					try {
+						if (await this.isSignedOut()) throw externalHttpAuthError("signed-out");
+					} catch (error) {
+						if (error instanceof AwikiExternalHttpAuthError) throw error;
+						throw externalHttpAuthError("auth-state-unavailable");
+					}
+				}
+			};
+		}
 		/** Serialize sign-in, sign-out, and destructive clear transitions. */
 		mutateSession(operation) {
 			const pending = this.sessionMutation.then(operation, operation);
@@ -1494,4 +1701,4 @@ function containsUnexpectedBinary(value, seen) {
 	return false;
 }
 //#endregion
-export { AWIKI_CLEAR_LOCAL_DATA_CONFIRMATION, AWIKI_DOMAIN_FIELD, AWIKI_HISTORY_TOOL, AWIKI_IDENTITY_STATUS_TOOL, AWIKI_LIST_CONVERSATIONS_TOOL, AWIKI_LOGOUT_CONFIRMATION, AWIKI_SEND_ATTACHMENT_TOOL, AWIKI_SEND_MESSAGE_TOOL, AWIKI_SETTINGS_NAMESPACE, AwikiService, AwikiService as default, AwikiSettingsSchema, Config, DEFAULT_ATTACHMENT_MAX_BYTES, DEFAULT_AWIKI_DOMAIN, DEFAULT_AWIKI_MESSAGE_SERVICE_DID, DEFAULT_AWIKI_SERVICE_URL, DEFAULT_POLL_INTERVAL_MS, DEFAULT_SUMMARY_MAX_INPUT_BYTES, MAX_SUMMARY_MESSAGES, normalizeAwikiDomain, validateAwikiSettings };
+export { AWIKI_CLEAR_LOCAL_DATA_CONFIRMATION, AWIKI_DOMAIN_FIELD, AWIKI_EXTERNAL_HTTP_MAX_BODY_BYTES, AWIKI_HISTORY_TOOL, AWIKI_IDENTITY_STATUS_TOOL, AWIKI_LIST_CONVERSATIONS_TOOL, AWIKI_LOGOUT_CONFIRMATION, AWIKI_SEND_ATTACHMENT_TOOL, AWIKI_SEND_MESSAGE_TOOL, AWIKI_SETTINGS_NAMESPACE, AwikiExternalHttpAuthError, AwikiService, AwikiService as default, AwikiSettingsSchema, Config, DEFAULT_ATTACHMENT_MAX_BYTES, DEFAULT_AWIKI_DOMAIN, DEFAULT_AWIKI_MESSAGE_SERVICE_DID, DEFAULT_AWIKI_SERVICE_URL, DEFAULT_POLL_INTERVAL_MS, DEFAULT_SUMMARY_MAX_INPUT_BYTES, MAX_SUMMARY_MESSAGES, normalizeAwikiDomain, validateAwikiSettings };

package/lib/provider.js

@@ -1,4 +1,4 @@
-import { t as RustSdkAdapter } from "./sdk-adapter-DPPZhs6p.mjs";
+import { t as RustSdkAdapter } from "./sdk-adapter-DK6RqV-c.mjs";
 import { openImCoreNodeClient } from "@awiki/im-core-node";
 //#region lib/types/provider.js
 /** Production AWiki provider backed by the versioned Rust IM Core Node bridge. */
@@ -15,7 +15,8 @@ function apply(ctx) {
 		userServiceEndpoint: options.userServiceUrl,
 		messageServiceEndpoint: options.messageServiceUrl,
 		anpServiceEndpoint: options.messageServiceUrl,
-		anpServiceDid: options.messageServiceDid
+		anpServiceDid: options.messageServiceDid,
+		externalHttpAllowInsecureLoopbackForTesting: options.allowInsecureLoopbackForTesting
 	}))), "awiki Rust SDK client");
 }
 //#endregion

package/lib/{sdk-adapter-DPPZhs6p.mjs → sdk-adapter-DK6RqV-c.mjs}

@@ -111,6 +111,34 @@ function page(value, copy) {
 		hasMore: value.hasMore
 	};
 }
+function httpHeaders(headers) {
+	return headers.map((header) => ({
+		name: String(header.name),
+		value: String(header.value)
+	}));
+}
+function externalHttpAttempt(value) {
+	return {
+		targetUrl: String(value.targetUrl),
+		method: String(value.method),
+		headerPatch: httpHeaders(value.headerPatch),
+		retryCount: value.retryCount,
+		async handleResponse(response) {
+			try {
+				const retry = await value.handleResponse({
+					statusCode: response.statusCode,
+					headers: response.headers.map((header) => ({
+						name: header.name,
+						value: header.value
+					}))
+				});
+				return retry === null ? null : externalHttpAttempt(retry);
+			} catch (error) {
+				mapError(error);
+			}
+		}
+	};
+}
 /** Adapt the Rust Node bridge to the frozen Host provider interface. */
 var RustSdkAdapter = class {
 	client;
@@ -204,6 +232,17 @@ var RustSdkAdapter = class {
 		}
 		fail("not-found");
 	}
+	prepareExternalHttpRequest(request) {
+		return this.run(async (client) => externalHttpAttempt(await client.prepareExternalHttpRequest({
+			url: request.url,
+			method: request.method,
+			headers: request.headers.map((header) => ({
+				name: header.name,
+				value: header.value
+			})),
+			...request.body === void 0 ? {} : { body: Uint8Array.from(request.body) }
+		})));
+	}
 	getIdentity() {
 		return this.run(async (client) => {
 			const value = await client.getDefaultIdentity();

package/lib/types/external-http-auth.d.ts

@@ -0,0 +1,23 @@
+/** Host-only dispatcher for externally transported ANP-authenticated HTTP. */
+import type { AwikiSdkClient } from './provider-api.ts';
+export declare const AWIKI_EXTERNAL_HTTP_MAX_BODY_BYTES: number;
+export type AwikiExternalHttpAuthErrorCode = 'not-registered' | 'signed-out' | 'invalid-request' | 'unsupported-body' | 'body-too-large' | 'auth-state-unavailable';
+/** Stable Host-only failure without request, response, credential, or path detail. */
+export declare class AwikiExternalHttpAuthError extends Error {
+    readonly code: AwikiExternalHttpAuthErrorCode;
+    readonly name = "AwikiExternalHttpAuthError";
+    constructor(code: AwikiExternalHttpAuthErrorCode);
+}
+export type AwikiHttpTransport = (request: Request) => Promise<Response>;
+/** Trusted same-process API; never expose this interface through Remote or tools. */
+export interface AwikiExternalHttpAuth {
+    dispatch(request: Request, transport: AwikiHttpTransport): Promise<Response>;
+}
+export interface AwikiExternalHttpAuthSession {
+    readonly client: AwikiSdkClient;
+    assertActive(): Promise<void>;
+}
+export declare function createAwikiExternalHttpAuth(acquire: () => Promise<AwikiExternalHttpAuthSession>): AwikiExternalHttpAuth;
+export declare function externalHttpAuthError(code: AwikiExternalHttpAuthErrorCode): AwikiExternalHttpAuthError;
+export declare function mapProviderError(error: unknown): AwikiExternalHttpAuthError;
+//# sourceMappingURL=external-http-auth.d.ts.map

package/lib/types/external-http-auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"external-http-auth.d.ts","sourceRoot":"","sources":["../../src/external-http-auth.ts"],"names":[],"mappings":"AAAA,8EAA8E;AAE9E,OAAO,KAAK,EACV,cAAc,EAIf,MAAM,mBAAmB,CAAA;AAE1B,eAAO,MAAM,kCAAkC,QAAkB,CAAA;AASjE,MAAM,MAAM,8BAA8B,GACtC,gBAAgB,GAChB,YAAY,GACZ,iBAAiB,GACjB,kBAAkB,GAClB,gBAAgB,GAChB,wBAAwB,CAAA;AAW5B,sFAAsF;AACtF,qBAAa,0BAA2B,SAAQ,KAAK;aAGhB,IAAI,EAAE,8BAA8B;IAFvE,SAAgB,IAAI,gCAA+B;gBAEhB,IAAI,EAAE,8BAA8B;CAGxE;AAED,MAAM,MAAM,kBAAkB,GAAG,CAAC,OAAO,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAA;AAExE,qFAAqF;AACrF,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,kBAAkB,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAA;CAC7E;AAED,MAAM,WAAW,4BAA4B;IAC3C,QAAQ,CAAC,MAAM,EAAE,cAAc,CAAA;IAC/B,YAAY,IAAI,OAAO,CAAC,IAAI,CAAC,CAAA;CAC9B;AAED,wBAAgB,2BAA2B,CACzC,OAAO,EAAE,MAAM,OAAO,CAAC,4BAA4B,CAAC,GACnD,qBAAqB,CAmCvB;AAED,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,8BAA8B,GAAG,0BAA0B,CAEtG;AAED,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,OAAO,GAAG,0BAA0B,CAY3E"}

package/lib/types/external-http-auth.js

@@ -0,0 +1,185 @@
+/** Host-only dispatcher for externally transported ANP-authenticated HTTP. */
+export const AWIKI_EXTERNAL_HTTP_MAX_BODY_BYTES = 4 * 1024 * 1024;
+const MANAGED_HEADERS = [
+    'authorization',
+    'signature-input',
+    'signature',
+    'content-digest',
+];
+const ERROR_MESSAGES = {
+    'not-registered': 'A registered AWiki identity is required.',
+    'signed-out': 'This installation is signed out of AWiki.',
+    'invalid-request': 'The external HTTP request is invalid.',
+    'unsupported-body': 'The external HTTP request body cannot be replayed safely.',
+    'body-too-large': 'The external HTTP request body exceeds 4 MiB.',
+    'auth-state-unavailable': 'AWiki external HTTP authentication is unavailable.',
+};
+/** Stable Host-only failure without request, response, credential, or path detail. */
+export class AwikiExternalHttpAuthError extends Error {
+    code;
+    name = 'AwikiExternalHttpAuthError';
+    constructor(code) {
+        super(ERROR_MESSAGES[code]);
+        this.code = code;
+    }
+}
+export function createAwikiExternalHttpAuth(acquire) {
+    return Object.freeze({
+        async dispatch(request, transport) {
+            validateDispatchInput(request, transport);
+            const session = await acquire();
+            await session.assertActive();
+            const body = await readReplayableBody(request);
+            await session.assertActive();
+            let attempt;
+            try {
+                attempt = await session.client.prepareExternalHttpRequest({
+                    url: request.url,
+                    method: request.method,
+                    headers: requestHeaders(request),
+                    ...body === undefined ? {} : { body },
+                });
+            }
+            catch (error) {
+                throw mapProviderError(error);
+            }
+            await session.assertActive();
+            const response = await transport(authenticatedRequest(request, body, attempt));
+            const retry = await handleResponseWithoutChangingCompletedRequest(attempt, response);
+            if (retry === null)
+                return response;
+            try {
+                await session.assertActive();
+            }
+            catch {
+                return response;
+            }
+            const retriedResponse = await transport(authenticatedRequest(request, body, retry));
+            await handleResponseWithoutChangingCompletedRequest(retry, retriedResponse);
+            return retriedResponse;
+        },
+    });
+}
+export function externalHttpAuthError(code) {
+    return new AwikiExternalHttpAuthError(code);
+}
+export function mapProviderError(error) {
+    if (error instanceof AwikiExternalHttpAuthError)
+        return error;
+    try {
+        if (typeof error === 'object' && error !== null) {
+            const value = error;
+            if (value.name === 'AwikiSdkError') {
+                if (value.code === 'not-registered')
+                    return externalHttpAuthError('not-registered');
+                if (value.code === 'invalid-request')
+                    return externalHttpAuthError('invalid-request');
+            }
+        }
+    }
+    catch { }
+    return externalHttpAuthError('auth-state-unavailable');
+}
+function validateDispatchInput(request, transport) {
+    if (!(request instanceof Request) || typeof transport !== 'function' || request.bodyUsed) {
+        throw externalHttpAuthError('invalid-request');
+    }
+    for (const name of MANAGED_HEADERS) {
+        if (request.headers.has(name))
+            throw externalHttpAuthError('invalid-request');
+    }
+}
+async function readReplayableBody(request) {
+    if (request.body === null)
+        return undefined;
+    let clone;
+    try {
+        clone = request.clone();
+    }
+    catch {
+        throw externalHttpAuthError('unsupported-body');
+    }
+    const stream = clone.body;
+    if (stream === null)
+        return new Uint8Array();
+    const reader = stream.getReader();
+    const chunks = [];
+    let length = 0;
+    try {
+        while (true) {
+            const result = await reader.read();
+            if (result.done)
+                break;
+            length += result.value.byteLength;
+            if (length > AWIKI_EXTERNAL_HTTP_MAX_BODY_BYTES) {
+                void reader.cancel().catch(() => { });
+                void request.body?.cancel().catch(() => { });
+                throw externalHttpAuthError('body-too-large');
+            }
+            chunks.push(Uint8Array.from(result.value));
+        }
+    }
+    catch (error) {
+        if (error instanceof AwikiExternalHttpAuthError)
+            throw error;
+        throw externalHttpAuthError('unsupported-body');
+    }
+    finally {
+        reader.releaseLock();
+    }
+    const bytes = new Uint8Array(length);
+    let offset = 0;
+    for (const chunk of chunks) {
+        bytes.set(chunk, offset);
+        offset += chunk.byteLength;
+    }
+    return bytes;
+}
+function requestHeaders(request) {
+    return [...request.headers].map(([name, value]) => ({ name, value }));
+}
+function authenticatedRequest(original, body, attempt) {
+    const headers = new Headers(original.headers);
+    for (const header of attempt.headerPatch)
+        headers.set(header.name, header.value);
+    const init = {
+        method: attempt.method,
+        headers,
+        redirect: 'manual',
+        signal: original.signal,
+        cache: original.cache,
+        credentials: original.credentials,
+        integrity: original.integrity,
+        keepalive: original.keepalive,
+        mode: original.mode,
+        referrer: original.referrer,
+        referrerPolicy: original.referrerPolicy,
+        ...body === undefined ? {} : { body: Uint8Array.from(body) },
+    };
+    try {
+        return new Request(attempt.targetUrl, init);
+    }
+    catch {
+        throw externalHttpAuthError('invalid-request');
+    }
+}
+async function handleResponseWithoutChangingCompletedRequest(attempt, response) {
+    try {
+        return await attempt.handleResponse(responseMetadata(response));
+    }
+    catch {
+        // The transport has already completed and may have executed a non-idempotent
+        // operation. Never turn post-response auth bookkeeping into a replay signal.
+        return null;
+    }
+}
+function responseMetadata(response) {
+    const headers = [];
+    for (const name of ['authentication-info', 'www-authenticate', 'accept-signature']) {
+        const value = response.headers.get(name);
+        if (value !== null)
+            headers.push({ name, value });
+    }
+    return { statusCode: response.status, headers };
+}
+//# sourceMappingURL=external-http-auth.js.map