@camstack/types 1.2.430 → 1.2.432

package/CHANGELOG.md

@@ -7,6 +7,18 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [1.2.432] - 2026-10-28
+
+### Changed
+
+- The vendor login proxy is served on one shared vendor-login prefix that cannot shadow an addon's own routes
+
+## [1.2.431] - 2026-10-27
+
+### Changed
+
+- Addons can now offer a vendor sign-in that opens the vendor's login page through the hub and finishes on the CamStack result page.
+
 ## [1.2.430] - 2026-10-27
 
 ### Added

package/dist/index.d.ts

@@ -353,6 +353,7 @@ export { errMsg } from './utils/err-msg.js';
 export { hfModelUrl } from './utils/hf-url.js';
 export { asBoolean, asJsonArray, asJsonObject, asNumber, asString, parseJsonArray, parseJsonObject, parseJsonUnknown, } from './utils/json-safe.js';
 export { maskUrlCredentials } from './utils/mask-url.js';
+export { VendorLoginProxy, rewriteBody as rewriteLoginProxyBody, rewriteLocation as rewriteLoginProxyLocation, rewriteReferer as rewriteLoginProxyReferer, rewriteSetCookie as rewriteLoginProxySetCookie, type LoginProxyAttemptSpec, type LoginProxyResponseView, type LoginProxyRoute, type LoginProxyScheme, type LoginProxyUpstream, type LoginProxyVerdict, type VendorLoginProxyOptions, VENDOR_LOGIN_PROXY_PREFIX, } from './vendor-login-proxy/index.js';
 export { OAUTH_LANDING_PATH, OAUTH_LANDING_REASONS, isOauthLandingReason, oauthLandingUrl, parseOauthLandingFragment, type OauthLandingOutcome, type OauthLandingReason, } from './utils/oauth-landing.js';
 export { commitWatchdogRestart, DEFAULT_POOL_MEMORY_POLICY, evaluatePoolMemory, initialPoolMemoryState, type PoolMemoryAction, type PoolMemoryPolicy, type PoolMemoryState, type PoolMemoryTelemetry, type PoolMemoryVerdict, PoolMemoryWatchdog, type PoolMemoryWatchdogOptions, type ProcMemory, parseProcStatus, pickRestartCandidate, poolMemoryThreshold, type RestartCandidate, resetPoolBaseline, resolvePoolMemoryPolicy, } from './utils/pool-memory-watchdog.js';
 export { cellsToRects, type NormRect, rectsToCells } from './utils/privacy-grid-raster.js';

package/dist/index.js

@@ -43694,7 +43694,7 @@ function autoRankFor(role, endpoint) {
 	if (isPlausibleLan(endpoint)) return 3;
 	return null;
 }
-var LOOPBACK_HOSTS = new Set([
+var LOOPBACK_HOSTS$1 = new Set([
 	"localhost",
 	"0.0.0.0",
 	"::1",
@@ -43702,9 +43702,9 @@ var LOOPBACK_HOSTS = new Set([
 	"::",
 	"[::]"
 ]);
-function isLoopbackHost(hostname) {
+function isLoopbackHost$1(hostname) {
 	const h = hostname.toLowerCase();
-	if (LOOPBACK_HOSTS.has(h) || h.endsWith(".localhost")) return true;
+	if (LOOPBACK_HOSTS$1.has(h) || h.endsWith(".localhost")) return true;
 	return /^127\.\d{1,3}\.\d{1,3}\.\d{1,3}$/.test(h);
 }
 /**
@@ -43739,7 +43739,7 @@ function validateCustomAddress(raw) {
 		ok: false,
 		reason: "The address has no host."
 	};
-	if (isLoopbackHost(parsed.hostname)) return {
+	if (isLoopbackHost$1(parsed.hostname)) return {
 		ok: false,
 		reason: "A loopback address names whoever dials it, never this hub — use an address other machines reach."
 	};
@@ -117778,6 +117778,19 @@ function setNestedValue(obj, path, value) {
 	current[parts[parts.length - 1]] = value;
 }
 //#endregion
+//#region src/vendor-login-proxy/prefix.ts
+/**
+* The data-plane prefix every `VendorLoginProxy` is served under
+* (`/addon/<addonId>/vendor-login/<attemptId>/<vendorHost>/…`).
+*
+* The hub consults an addon's data-plane prefixes BEFORE its HTTP routes, so a
+* prefix equal to the first segment of a route the addon serves swallows that
+* route. A sign-in addon serves `/login/start|status|commit|cancel`; the proxy
+* therefore lives on a segment no addon route uses. One constant, so the entry
+* path, the mount and the docs cannot drift apart.
+*/
+var VENDOR_LOGIN_PROXY_PREFIX = "vendor-login";
+//#endregion
 //#region src/utils/oauth-landing.ts
 /**
 * Where an OAuth round-trip ends: the admin-ui completion route
@@ -117845,6 +117858,419 @@ function parseOauthLandingFragment(hash) {
 	};
 }
 //#endregion
+//#region src/vendor-login-proxy/url-rewrite.ts
+var LOOPBACK_HOSTS = new Set([
+	"127.0.0.1",
+	"localhost",
+	"[::1]"
+]);
+function hostWithoutPort(host) {
+	if (host.startsWith("[")) return host.slice(0, host.indexOf("]") + 1);
+	const colon = host.indexOf(":");
+	return colon === -1 ? host : host.slice(0, colon);
+}
+function isLoopbackHost(host) {
+	return LOOPBACK_HOSTS.has(hostWithoutPort(host.toLowerCase()));
+}
+/** An allow-list entry is valid when it is a bare host[:port] and `http` only targets loopback. */
+function isValidUpstream(upstream) {
+	if (upstream.host.length === 0 || !/^[a-z0-9.[\]:-]+$/.test(upstream.host)) return false;
+	return upstream.scheme === "https" || isLoopbackHost(upstream.host);
+}
+function findUpstream(route, host) {
+	const wanted = host.toLowerCase();
+	return route.upstreams.find((upstream) => upstream.host === wanted);
+}
+/** `<basePath>/<host><pathname><search>` — what the browser is sent to. */
+function proxyPathFor(route, host, pathname, search = "") {
+	return `${route.basePath}/${host}${pathname.startsWith("/") ? pathname : `/${pathname}`}${search}`;
+}
+/** Split `/<attemptId>/<host>/<rest…>[?query]` (the data-plane view of a request). */
+function parseProxyPath(rawUrl) {
+	const queryAt = rawUrl.indexOf("?");
+	const path = queryAt === -1 ? rawUrl : rawUrl.slice(0, queryAt);
+	const search = queryAt === -1 ? "" : rawUrl.slice(queryAt);
+	const match = /^\/([A-Za-z0-9_-]{8,128})\/([^/]+)(\/.*)?$/.exec(path);
+	if (match === null) return null;
+	const attemptId = match[1];
+	const host = match[2];
+	if (attemptId === void 0 || host === void 0) return null;
+	return {
+		attemptId,
+		host: host.toLowerCase(),
+		pathname: match[3] ?? "/",
+		search
+	};
+}
+/** The vendor URL a proxied request targets, or null when the host would not stay `host`. */
+function upstreamUrlFor(upstream, parsed) {
+	try {
+		const url = new URL(`${upstream.scheme}://${upstream.host}${parsed.pathname}${parsed.search}`);
+		return url.host.toLowerCase() === upstream.host ? url : null;
+	} catch {
+		return null;
+	}
+}
+function escapeRegex(value) {
+	return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+/** A Location (or any URL value) to a vendor host becomes a proxy path; anything else is unchanged. */
+function rewriteLocation(location, currentUpstream, route) {
+	let resolved;
+	try {
+		resolved = new URL(location, `${currentUpstream.scheme}://${currentUpstream.host}/`);
+	} catch {
+		return location;
+	}
+	if (resolved.protocol !== "https:" && resolved.protocol !== "http:") return location;
+	const target = findUpstream(route, resolved.host);
+	if (target === void 0) return location;
+	return `${proxyPathFor(route, target.host, resolved.pathname, resolved.search)}${resolved.hash}`;
+}
+/** Characters that may precede a URL that STARTS a value (never `=`, `?`, `&`, `%3D`). */
+var VALUE_START = String.raw`(?<=^|["'(\s>,\[{])`;
+/**
+* Rewrite vendor URLs in a text body: absolute (`https://host/…`), protocol-relative
+* (`//host/…`) and JSON-escaped (`https:\/\/host\/…`) when they start a value; and, in
+* HTML/CSS, root-relative references (`href="/x"`, `url(/x)`) which would otherwise
+* escape the proxy mount and land on the hub.
+*/
+function rewriteBody(body, kind, currentUpstream, route) {
+	let out = body;
+	for (const upstream of route.upstreams) {
+		const host = escapeRegex(upstream.host);
+		const plain = new RegExp(`${VALUE_START}(?:https?:)?//${host}(?=[/"'?#\\s)\\]},<]|$)`, "g");
+		out = out.replace(plain, `${route.basePath}/${upstream.host}`);
+		const escapedBase = `${route.basePath}/${upstream.host}`.replace(/\//g, "\\/");
+		const escaped = new RegExp(`${VALUE_START}(?:https?:)?\\\\/\\\\/${host}(?=\\\\/|["'?#\\s)\\]},<]|$)`, "g");
+		out = out.replace(escaped, escapedBase);
+	}
+	const current = `${route.basePath}/${currentUpstream.host}/`;
+	const notMounted = `(?!/)(?!${escapeRegex(route.basePath.slice(1))}/)`;
+	if (kind === "html") {
+		const attribute = String.raw`(\b(?:href|src|action|formaction|poster|data-href|data-src)\s*=\s*["'])/`;
+		out = out.replace(new RegExp(`${attribute}${notMounted}`, "gi"), `$1${current}`);
+	}
+	if (kind === "html" || kind === "css") {
+		const cssUrl = String.raw`(url\(\s*["']?)/`;
+		out = out.replace(new RegExp(`${cssUrl}${notMounted}`, "gi"), `$1${current}`);
+	}
+	return out;
+}
+/**
+* A vendor `Set-Cookie` for the browser: no `Domain` (the cookie belongs to the hub
+* origin), `Path` narrowed to this attempt's prefix, `Secure` kept (the hub is HTTPS).
+*/
+function rewriteSetCookie(cookie, route) {
+	const kept = cookie.split(";").map((part) => part.trim()).filter((part, index) => {
+		if (index === 0) return true;
+		const name = part.split("=")[0]?.trim().toLowerCase() ?? "";
+		return name !== "domain" && name !== "path";
+	});
+	kept.push(`Path=${route.basePath}/`);
+	return kept.join("; ");
+}
+/**
+* A browser `Referer` that points into this proxy, turned back into the vendor URL it
+* stands for. A Referer that is not ours is dropped (null): it names the hub.
+*/
+function rewriteReferer(referer, route) {
+	let url;
+	try {
+		url = new URL(referer, "http://hub.invalid");
+	} catch {
+		return null;
+	}
+	if (!url.pathname.startsWith(`${route.basePath}/`)) return null;
+	const rest = /^\/([^/]+)(\/.*)?$/.exec(url.pathname.slice(route.basePath.length));
+	const host = rest?.[1]?.toLowerCase();
+	if (host === void 0) return null;
+	const upstream = findUpstream(route, host);
+	if (upstream === void 0) return null;
+	return `${upstream.scheme}://${upstream.host}${rest?.[2] ?? "/"}${url.search}`;
+}
+/** Cookies the browser holds for the hub itself must never reach a vendor. */
+function filterForwardedCookies(cookieHeader) {
+	return cookieHeader.split(";").map((part) => part.trim()).filter((part) => part.length > 0 && !part.toLowerCase().startsWith("camstack_")).join("; ");
+}
+//#endregion
+//#region src/vendor-login-proxy/login-proxy.ts
+var MAX_REQUEST_BODY_BYTES = 2 * 1024 * 1024;
+var MAX_TEXT_BODY_BYTES = 4 * 1024 * 1024;
+/** Request headers that are never forwarded to the vendor. */
+var DROP_REQUEST_HEADERS = new Set([
+	"host",
+	"connection",
+	"keep-alive",
+	"proxy-authorization",
+	"proxy-connection",
+	"te",
+	"trailer",
+	"transfer-encoding",
+	"upgrade",
+	"content-length",
+	"accept-encoding",
+	"authorization",
+	"cookie",
+	"origin",
+	"referer",
+	"x-camstack-dataplane-secret",
+	"x-forwarded-for",
+	"x-forwarded-host",
+	"x-forwarded-proto",
+	"x-forwarded-prefix",
+	"x-real-ip",
+	"forwarded"
+]);
+/**
+* Response headers dropped: framing/CSP/HSTS that break a page under another origin, and
+* the ones that no longer describe the (decoded, possibly rewritten) body.
+*/
+var DROP_RESPONSE_HEADERS = new Set([
+	"content-security-policy",
+	"content-security-policy-report-only",
+	"x-frame-options",
+	"strict-transport-security",
+	"public-key-pins",
+	"report-to",
+	"nel",
+	"content-encoding",
+	"content-length",
+	"transfer-encoding",
+	"connection",
+	"keep-alive",
+	"set-cookie",
+	"location"
+]);
+function bodyKindOf(contentType) {
+	const type = contentType.toLowerCase();
+	if (type.includes("text/html") || type.includes("application/xhtml")) return "html";
+	if (type.includes("text/css")) return "css";
+	if (type.startsWith("text/") || type.includes("javascript") || type.includes("json") || type.includes("xml")) return "other";
+	return null;
+}
+function firstHeader(value) {
+	return Array.isArray(value) ? value[0] : value;
+}
+async function readRequestBody(req) {
+	const chunks = [];
+	let size = 0;
+	for await (const chunk of req) {
+		const buf = typeof chunk === "string" ? Buffer.from(chunk) : Buffer.from(chunk);
+		size += buf.length;
+		if (size > MAX_REQUEST_BODY_BYTES) return "too-large";
+		chunks.push(buf);
+	}
+	return Buffer.concat(chunks);
+}
+function sendPlain(res, status, text) {
+	res.writeHead(status, {
+		"content-type": "text/plain; charset=utf-8",
+		"cache-control": "no-store"
+	});
+	res.end(text);
+}
+var VendorLoginProxy = class {
+	#addonId;
+	#logger;
+	#now;
+	#fetch;
+	#attempts = /* @__PURE__ */ new Map();
+	constructor(options) {
+		this.#addonId = options.addonId;
+		this.#logger = options.logger;
+		this.#now = options.now ?? (() => Date.now());
+		this.#fetch = options.fetchFn ?? globalThis.fetch.bind(globalThis);
+	}
+	/** The `DataPlaneHandler` to pass to `ctx.dataPlane.serve({ prefix: VENDOR_LOGIN_PROXY_PREFIX, access: 'admin', … })`. */
+	handler = (req, res) => this.#handle(req, res);
+	/** Register an attempt. A one-shot capability: refused hosts are rejected up front. */
+	open(spec) {
+		for (const upstream of spec.upstreams) if (!isValidUpstream(upstream)) throw new Error(`vendor login proxy: upstream ${upstream.host} is not allowed`);
+		this.#attempts.set(spec.attemptId, {
+			expiresAtMs: spec.expiresAtMs,
+			upstreams: spec.upstreams,
+			evaluate: async (view) => {
+				const verdict = await spec.terminal(view);
+				if (verdict.kind === "continue") return verdict;
+				return {
+					kind: "done",
+					landing: await spec.onDone(verdict.payload)
+				};
+			}
+		});
+	}
+	close(attemptId) {
+		this.#attempts.delete(attemptId);
+	}
+	isOpen(attemptId) {
+		const attempt = this.#attempts.get(attemptId);
+		return attempt !== void 0 && this.#now() <= attempt.expiresAtMs;
+	}
+	/**
+	* The hub-relative path that opens `vendorUrl` through the proxy for this attempt:
+	* the URL the browser is sent to. Null when the host is not in the attempt's list.
+	*/
+	entryPath(attemptId, vendorUrl) {
+		const attempt = this.#attempts.get(attemptId);
+		if (attempt === void 0) return null;
+		const url = new URL(vendorUrl);
+		if (findUpstream({
+			basePath: "",
+			upstreams: attempt.upstreams
+		}, url.host) === void 0) return null;
+		return `/addon/${this.#addonId}/${VENDOR_LOGIN_PROXY_PREFIX}/${attemptId}/${url.host}${url.pathname}${url.search}`;
+	}
+	#routeFor(attemptId, attempt, forwardedPrefix) {
+		return {
+			basePath: `${forwardedPrefix}/addon/${this.#addonId}/${VENDOR_LOGIN_PROXY_PREFIX}/${attemptId}`,
+			upstreams: attempt.upstreams
+		};
+	}
+	async #handle(req, res) {
+		try {
+			await this.#serve(req, res);
+		} catch (err) {
+			this.#logger.warn("vendor login proxy: request failed", { meta: {
+				addonId: this.#addonId,
+				error: err instanceof Error ? err.name : "unknown"
+			} });
+			if (!res.headersSent) sendPlain(res, 502, "The sign-in page could not be reached.");
+			else res.end();
+		}
+	}
+	async #serve(req, res) {
+		const parsed = parseProxyPath(req.url ?? "/");
+		if (parsed === null) {
+			sendPlain(res, 404, "Not found");
+			return;
+		}
+		const forwardedPrefix = (firstHeader(req.headers["x-forwarded-prefix"]) ?? "").replace(/\/+$/, "");
+		const attempt = this.#attempts.get(parsed.attemptId);
+		if (attempt === void 0 || this.#now() > attempt.expiresAtMs) {
+			if (attempt !== void 0) this.#attempts.delete(parsed.attemptId);
+			this.#logger.info("vendor login proxy: attempt refused", { meta: {
+				addonId: this.#addonId,
+				reason: attempt === void 0 ? "missing" : "expired"
+			} });
+			this.#redirect(res, forwardedPrefix, {
+				status: "error",
+				addonId: this.#addonId,
+				reason: "invalid_state"
+			});
+			return;
+		}
+		const route = this.#routeFor(parsed.attemptId, attempt, forwardedPrefix);
+		const upstream = findUpstream(route, parsed.host);
+		const target = upstream === void 0 ? null : upstreamUrlFor(upstream, parsed);
+		if (upstream === void 0 || target === null) {
+			this.#logger.warn("vendor login proxy: host refused", { meta: {
+				addonId: this.#addonId,
+				host: parsed.host
+			} });
+			sendPlain(res, 404, "Not found");
+			return;
+		}
+		const method = (req.method ?? "GET").toUpperCase();
+		let body;
+		if (method !== "GET" && method !== "HEAD") {
+			const read = await readRequestBody(req);
+			if (read === "too-large") {
+				sendPlain(res, 413, "Request too large");
+				return;
+			}
+			body = read;
+		}
+		const headers = this.#requestHeaders(req, route, upstream);
+		const upstreamRes = await this.#fetch(target, {
+			method,
+			headers,
+			redirect: "manual",
+			...body !== void 0 && body.length > 0 ? { body: new Uint8Array(body) } : {}
+		});
+		const location = upstreamRes.headers.get("location");
+		const setCookies = upstreamRes.headers.getSetCookie();
+		const kind = bodyKindOf(upstreamRes.headers.get("content-type") ?? "");
+		const declaredLength = Number(upstreamRes.headers.get("content-length") ?? "0");
+		const text = kind !== null && !(declaredLength > MAX_TEXT_BODY_BYTES) && method !== "HEAD" ? await upstreamRes.text() : null;
+		this.#logger.debug("vendor login proxy: upstream answered", { meta: {
+			addonId: this.#addonId,
+			host: upstream.host,
+			status: upstreamRes.status,
+			method
+		} });
+		const settled = await attempt.evaluate({
+			status: upstreamRes.status,
+			url: target.toString(),
+			location,
+			setCookies,
+			bodyText: text
+		});
+		if (settled.kind === "done") {
+			this.#attempts.delete(parsed.attemptId);
+			this.#logger.info("vendor login proxy: sign-in finished", { meta: {
+				addonId: this.#addonId,
+				status: settled.landing.status
+			} });
+			this.#redirect(res, forwardedPrefix, settled.landing);
+			return;
+		}
+		const out = {};
+		upstreamRes.headers.forEach((value, name) => {
+			if (!DROP_RESPONSE_HEADERS.has(name.toLowerCase())) out[name] = value;
+		});
+		if (setCookies.length > 0) out["set-cookie"] = setCookies.map((c) => rewriteSetCookie(c, route));
+		if (location !== null) out["location"] = rewriteLocation(location, upstream, route);
+		out["cache-control"] = "no-store";
+		if (text !== null && kind !== null) {
+			const rewritten = rewriteBody(text, kind, upstream, route);
+			res.writeHead(upstreamRes.status, out);
+			res.end(rewritten);
+			return;
+		}
+		res.writeHead(upstreamRes.status, out);
+		await this.#pipeBody(upstreamRes, res);
+	}
+	#requestHeaders(req, route, upstream) {
+		const headers = {};
+		for (const [name, value] of Object.entries(req.headers)) {
+			const lower = name.toLowerCase();
+			if (DROP_REQUEST_HEADERS.has(lower) || value === void 0) continue;
+			headers[lower] = Array.isArray(value) ? value.join(", ") : value;
+		}
+		const cookie = filterForwardedCookies(firstHeader(req.headers["cookie"]) ?? "");
+		if (cookie.length > 0) headers["cookie"] = cookie;
+		if (req.headers["origin"] !== void 0) headers["origin"] = `${upstream.scheme}://${upstream.host}`;
+		const referer = firstHeader(req.headers["referer"]);
+		if (referer !== void 0) {
+			const back = rewriteReferer(referer, route);
+			if (back !== null) headers["referer"] = back;
+		}
+		return headers;
+	}
+	async #pipeBody(upstreamRes, res) {
+		if (upstreamRes.body === null) {
+			res.end();
+			return;
+		}
+		for await (const chunk of upstreamRes.body) {
+			if (!res.write(chunk)) await new Promise((resolve) => {
+				res.once("drain", resolve);
+				res.once("close", resolve);
+			});
+			if (res.destroyed) return;
+		}
+		res.end();
+	}
+	#redirect(res, forwardedPrefix, outcome) {
+		res.writeHead(302, {
+			location: `${forwardedPrefix}${oauthLandingUrl(null, outcome)}`,
+			"cache-control": "no-store"
+		});
+		res.end();
+	}
+};
+//#endregion
 //#region src/utils/pool-memory-watchdog.ts
 var MB = 1024 * 1024;
 var DEFAULT_POOL_MEMORY_POLICY = {
@@ -120925,6 +121351,7 @@ exports.UserRecordSchema = UserRecordSchema;
 exports.UserScopeSchema = UserScopeSchema;
 exports.UserSummarySchema = UserSummarySchema;
 exports.VECTOR_INDEX_DIM_CONFLICT = VECTOR_INDEX_DIM_CONFLICT;
+exports.VENDOR_LOGIN_PROXY_PREFIX = VENDOR_LOGIN_PROXY_PREFIX;
 exports.VIDEOCLIPS_MAX_OFFER_BYTES = VIDEOCLIPS_MAX_OFFER_BYTES;
 exports.VIDEOCLIPS_MAX_READ_BYTES = VIDEOCLIPS_MAX_READ_BYTES;
 exports.VIEWER_FEATURES = VIEWER_FEATURES;
@@ -120952,6 +121379,7 @@ exports.VectorStatsInputSchema = VectorStatsInputSchema;
 exports.VectorStatsResultSchema = VectorStatsResultSchema;
 exports.VectorUpsertInputSchema = VectorUpsertInputSchema;
 exports.VectorUpsertResultSchema = VectorUpsertResultSchema;
+exports.VendorLoginProxy = VendorLoginProxy;
 exports.VibrationStatusSchema = VibrationStatusSchema;
 exports.VideoEncodeSchema = VideoEncodeSchema;
 exports.ViewerDeviceAllowSchema = ViewerDeviceAllowSchema;
@@ -121849,6 +122277,10 @@ exports.resultCellKey = resultCellKey;
 exports.resultStandings = resultStandings;
 exports.retrainBoxIou = retrainBoxIou;
 exports.retrainRevisionConflictMessage = retrainRevisionConflictMessage;
+exports.rewriteLoginProxyBody = rewriteBody;
+exports.rewriteLoginProxyLocation = rewriteLocation;
+exports.rewriteLoginProxyReferer = rewriteReferer;
+exports.rewriteLoginProxySetCookie = rewriteSetCookie;
 exports.roleSpec = roleSpec;
 exports.rollingDurationMs = require_composition.rollingDurationMs;
 exports.roomCompositionExample = roomCompositionExample;