@jingyi0605/codingns4dsh 0.2.1-beta.12 → 0.2.1-beta.14

package/data/build/dist/dsh-capabilities/host/quick-app-credentials.js

@@ -0,0 +1,97 @@
+import { createHash, randomBytes, timingSafeEqual } from 'node:crypto';
+import { QUICK_APP_LIMITS } from '../../shared/contracts/quick-apps.js';
+import { quickAppBootstrapEn, quickAppBootstrapZh } from '../../shared/quick-apps-bootstrap-locale.js';
+const bootstrapPath = '/__quickapp/bootstrap';
+const exchangePath = '/__quickapp/exchange';
+const readyPath = '/__quickapp/ready';
+const hash = (value) => createHash('sha256').update(value).digest();
+/** Shared credential landing page; application files are never rewritten. */
+export function quickAppCredentials(origin, uiOrigin, cookieName) {
+    let active = true;
+    let activation;
+    let credentialDigest;
+    return {
+        async handle(request, response) {
+            const path = request.url;
+            if (path !== bootstrapPath && path !== exchangePath && path !== readyPath)
+                return false;
+            if (!active) {
+                endQuickAppResponse(response, 410);
+                return true;
+            }
+            if (path === bootstrapPath && request.method === 'GET') {
+                if (!activation || activation.expires <= Date.now()) {
+                    activation = undefined;
+                    endQuickAppResponse(response, 410);
+                    return true;
+                }
+                const nonce = randomBytes(18).toString('base64url');
+                const copy = /^zh(?:\b|-)/iu.test(request.headers['accept-language'] ?? '') ? quickAppBootstrapZh : quickAppBootstrapEn;
+                response.setHeader('Content-Type', 'text/html; charset=utf-8');
+                response.setHeader('Content-Security-Policy', `default-src 'none'; script-src 'nonce-${nonce}'; connect-src 'self'; frame-ancestors ${uiOrigin}; base-uri 'none'; form-action 'none'`);
+                response.end(`<!doctype html><meta name="viewport" content="width=device-width,initial-scale=1"><p id="status">${copy['quickApps.opening']}</p><script nonce="${nonce}">(async()=>{const ticket=location.hash.slice(1);history.replaceState(null,'',location.pathname);try{const r=await fetch('${exchangePath}',{method:'POST',headers:{'Content-Type':'text/plain'},body:ticket,credentials:'include'});if(!r.ok)throw 0;const next=await r.text();const ready=await fetch('${readyPath}',{credentials:'include'});if(!ready.ok)throw 0;location.replace(next)}catch{document.querySelector('#status').textContent=${JSON.stringify(copy['quickApps.bootstrapFailed'])}}})()</script>`);
+                return true;
+            }
+            if (path === exchangePath) {
+                if (request.method !== 'POST' || request.headers.origin !== origin || request.headers['content-type'] !== 'text/plain'
+                    || !activation || activation.expires <= Date.now()) {
+                    endQuickAppResponse(response, 403);
+                    return true;
+                }
+                const ticket = await readTicket(request);
+                if (!ticket || !active || !activation || !timingSafeEqual(activation.digest, hash(ticket))) {
+                    endQuickAppResponse(response, 403);
+                    return true;
+                }
+                const grant = activation;
+                activation = undefined;
+                credentialDigest = hash(grant.credential);
+                response.setHeader('Set-Cookie', `${cookieName}=${grant.credential}; Path=/; Secure; HttpOnly; SameSite=None; Partitioned; Max-Age=${QUICK_APP_LIMITS.lifetimeMs / 1000}`);
+                response.setHeader('Content-Type', 'text/plain; charset=utf-8');
+                response.end(grant.entryPath);
+                return true;
+            }
+            if (path === readyPath) {
+                const cookies = request.headers.cookie?.split(';').map(value => value.trim()).filter(value => value.startsWith(`${cookieName}=`)) ?? [];
+                const supplied = cookies.length === 1 ? cookies[0].slice(cookieName.length + 1) : '';
+                endQuickAppResponse(response, request.method === 'GET' && credentialDigest && timingSafeEqual(credentialDigest, hash(supplied)) ? 204 : 401);
+                return true;
+            }
+            endQuickAppResponse(response, 405);
+            return true;
+        },
+        async activate(credential, entryPath) {
+            if (!active || activation || credentialDigest || !/^\/(?!\/)/u.test(entryPath) || /[\r\n#?]/u.test(entryPath))
+                throw new Error('Invalid app activation.');
+            const ticket = randomBytes(32).toString('base64url');
+            activation = { digest: hash(ticket), credential, entryPath, expires: Date.now() + 60_000 };
+            return { url: `${origin}${bootstrapPath}#${ticket}` };
+        },
+        dispose() { active = false; activation = undefined; credentialDigest = undefined; },
+    };
+}
+export function endQuickAppResponse(response, status) {
+    if (response.headersSent) {
+        response.destroy();
+        return;
+    }
+    response.setHeader('Cache-Control', 'no-store');
+    response.writeHead(status);
+    response.end();
+}
+async function readTicket(request) {
+    if (Number(request.headers['content-length'] ?? 0) > 128) {
+        request.resume();
+        return undefined;
+    }
+    let body = '';
+    for await (const chunk of request.iterator({ destroyOnReturn: false })) {
+        body += String(chunk);
+        if (body.length > 128) {
+            request.resume();
+            return undefined;
+        }
+    }
+    return /^[A-Za-z0-9_-]{43}$/u.test(body) ? body : undefined;
+}
+//# sourceMappingURL=quick-app-credentials.js.map

package/data/build/dist/dsh-capabilities/host/quick-app-credentials.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"quick-app-credentials.js","sourceRoot":"","sources":["../../../../../src/dsh-capabilities/host/quick-app-credentials.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,aAAa,CAAA;AAEtE,OAAO,EAAE,gBAAgB,EAAE,MAAM,sCAAsC,CAAA;AACvE,OAAO,EAAE,mBAAmB,EAAE,mBAAmB,EAAE,MAAM,6CAA6C,CAAA;AAEtG,MAAM,aAAa,GAAG,uBAAuB,CAAA;AAC7C,MAAM,YAAY,GAAG,sBAAsB,CAAA;AAC3C,MAAM,SAAS,GAAG,mBAAmB,CAAA;AACrC,MAAM,IAAI,GAAG,CAAC,KAAa,EAAE,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,EAAE,CAAA;AAE3E,6EAA6E;AAC7E,MAAM,UAAU,mBAAmB,CAAC,MAAc,EAAE,QAAgB,EAAE,UAAkB;IACtF,IAAI,MAAM,GAAG,IAAI,CAAA;IACjB,IAAI,UAAkG,CAAA;IACtG,IAAI,gBAAoC,CAAA;IACxC,OAAO;QACL,KAAK,CAAC,MAAM,CAAC,OAAwB,EAAE,QAAwB;YAC7D,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAA;YACxB,IAAI,IAAI,KAAK,aAAa,IAAI,IAAI,KAAK,YAAY,IAAI,IAAI,KAAK,SAAS;gBAAE,OAAO,KAAK,CAAA;YACvF,IAAI,CAAC,MAAM,EAAE,CAAC;gBAAC,mBAAmB,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;gBAAC,OAAO,IAAI,CAAA;YAAC,CAAC;YAChE,IAAI,IAAI,KAAK,aAAa,IAAI,OAAO,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;gBACvD,IAAI,CAAC,UAAU,IAAI,UAAU,CAAC,OAAO,IAAI,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;oBAAC,UAAU,GAAG,SAAS,CAAC;oBAAC,mBAAmB,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;oBAAC,OAAO,IAAI,CAAA;gBAAC,CAAC;gBAChI,MAAM,KAAK,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAA;gBACnD,MAAM,IAAI,GAAG,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,iBAAiB,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,mBAAmB,CAAA;gBACvH,QAAQ,CAAC,SAAS,CAAC,cAAc,EAAE,0BAA0B,CAAC,CAAA;gBAC9D,QAAQ,CAAC,SAAS,CAAC,yBAAyB,EAAE,yCAAyC,KAAK,0CAA0C,QAAQ,uCAAuC,CAAC,CAAA;gBACtL,QAAQ,CAAC,GAAG,CAAC,oGAAoG,IAAI,CAAC,mBAAmB,CAAC,sBAAsB,KAAK,6HAA6H,YAAY,kKAAkK,SAAS,8HAA8H,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,2BAA2B,CAAC,CAAC,gBAAgB,CAAC,CAAA;gBACzpB,OAAO,IAAI,CAAA;YACb,CAAC;YACD,IAAI,IAAI,KAAK,YAAY,EAAE,CAAC;gBAC1B,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM,IAAI,OAAO,CAAC,OAAO,CAAC,MAAM,KAAK,MAAM,IAAI,OAAO,CAAC,OAAO,CAAC,cAAc,CAAC,KAAK,YAAY;uBACjH,CAAC,UAAU,IAAI,UAAU,CAAC,OAAO,IAAI,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;oBAAC,mBAAmB,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;oBAAC,OAAO,IAAI,CAAA;gBAAC,CAAC;gBACzG,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,OAAO,CAAC,CAAA;gBACxC,IAAI,CAAC,MAAM,IAAI,CAAC,MAAM,IAAI,CAAC,UAAU,IAAI,CAAC,eAAe,CAAC,UAAU,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;oBAAC,mBAAmB,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;oBAAC,OAAO,IAAI,CAAA;gBAAC,CAAC;gBAC/I,MAAM,KAAK,GAAG,UAAU,CAAC;gBAAC,UAAU,GAAG,SAAS,CAAA;gBAChD,gBAAgB,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,CAAA;gBACzC,QAAQ,CAAC,SAAS,CAAC,YAAY,EAAE,GAAG,UAAU,IAAI,KAAK,CAAC,UAAU,mEAAmE,gBAAgB,CAAC,UAAU,GAAG,IAAI,EAAE,CAAC,CAAA;gBAC1K,QAAQ,CAAC,SAAS,CAAC,cAAc,EAAE,2BAA2B,CAAC,CAAA;gBAC/D,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,CAAA;gBAC7B,OAAO,IAAI,CAAA;YACb,CAAC;YACD,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;gBACvB,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,UAAU,GAAG,CAAC,CAAC,IAAI,EAAE,CAAA;gBACvI,MAAM,QAAQ,GAAG,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAE,CAAC,KAAK,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;gBACrF,mBAAmB,CAAC,QAAQ,EAAE,OAAO,CAAC,MAAM,KAAK,KAAK,IAAI,gBAAgB,IAAI,eAAe,CAAC,gBAAgB,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAA;gBAC5I,OAAO,IAAI,CAAA;YACb,CAAC;YACD,mBAAmB,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAA;YAClC,OAAO,IAAI,CAAA;QACb,CAAC;QACD,KAAK,CAAC,QAAQ,CAAC,UAAkB,EAAE,SAAiB;YAClD,IAAI,CAAC,MAAM,IAAI,UAAU,IAAI,gBAAgB,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,WAAW,CAAC,IAAI,CAAC,SAAS,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAA;YACzJ,MAAM,MAAM,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAA;YACpD,UAAU,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,UAAU,EAAE,SAAS,EAAE,OAAO,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,EAAE,CAAA;YAC1F,OAAO,EAAE,GAAG,EAAE,GAAG,MAAM,GAAG,aAAa,IAAI,MAAM,EAAE,EAAE,CAAA;QACvD,CAAC;QACD,OAAO,KAAK,MAAM,GAAG,KAAK,CAAC,CAAC,UAAU,GAAG,SAAS,CAAC,CAAC,gBAAgB,GAAG,SAAS,CAAA,CAAC,CAAC;KACnF,CAAA;AACH,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,QAAwB,EAAE,MAAc;IAC1E,IAAI,QAAQ,CAAC,WAAW,EAAE,CAAC;QAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;QAAC,OAAM;IAAC,CAAC;IACxD,QAAQ,CAAC,SAAS,CAAC,eAAe,EAAE,UAAU,CAAC,CAAA;IAC/C,QAAQ,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IAAC,QAAQ,CAAC,GAAG,EAAE,CAAA;AAC5C,CAAC;AAED,KAAK,UAAU,UAAU,CAAC,OAAwB;IAChD,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,GAAG,GAAG,EAAE,CAAC;QAAC,OAAO,CAAC,MAAM,EAAE,CAAC;QAAC,OAAO,SAAS,CAAA;IAAC,CAAC;IAChG,IAAI,IAAI,GAAG,EAAE,CAAA;IACb,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,OAAO,CAAC,QAAQ,CAAC,EAAE,eAAe,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;QACvE,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,CAAA;QACrB,IAAI,IAAI,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;YAAC,OAAO,CAAC,MAAM,EAAE,CAAC;YAAC,OAAO,SAAS,CAAA;QAAC,CAAC;IAC/D,CAAC;IACD,OAAO,sBAAsB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAA;AAC7D,CAAC"}

package/data/build/dist/dsh-capabilities/host/quick-app-https-provider.d.ts

@@ -0,0 +1,36 @@
+import type { IncomingMessage, ServerResponse } from 'node:http';
+import type { QuickAppOriginLease, QuickAppOriginProvider } from './quick-app-origin-adapter.js';
+/** Operator-owned configuration, never settings mirrored to browsers or an RPC argument. */
+export interface QuickAppHttpsConfig {
+    readonly appDomain: string;
+    readonly uiOrigins: readonly string[];
+    readonly listenHost: string;
+    readonly listenPort: number;
+    readonly publicPort: number;
+    readonly certFile: string;
+    readonly keyFile: string;
+}
+export declare function parseQuickAppHttpsConfig(value: unknown): QuickAppHttpsConfig;
+/** No listener is started until an authenticated user opens an HTML app. */
+export declare function configuredQuickAppHttpsProvider(configPath?: string | undefined): Promise<QuickAppHttpsProvider | undefined>;
+export declare function boundedFile(path: string, limit: number): Promise<string>;
+/** Dedicated TLS virtual-host listener. It never serves or proxies privileged DSH routes. */
+export declare class QuickAppHttpsProvider implements QuickAppOriginProvider {
+    private readonly config;
+    private readonly tls;
+    private readonly routes;
+    private server;
+    private pending;
+    private stopped;
+    constructor(config: QuickAppHttpsConfig, tls: {
+        cert: string;
+        key: string;
+    });
+    available(uiOrigin?: string): boolean;
+    open(handler: (request: IncomingMessage, response: ServerResponse) => void, uiOrigin?: string): Promise<QuickAppOriginLease>;
+    dispose(): Promise<void>;
+    private listen;
+    private closeListener;
+    private serialize;
+}
+//# sourceMappingURL=quick-app-https-provider.d.ts.map

package/data/build/dist/dsh-capabilities/host/quick-app-https-provider.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"quick-app-https-provider.d.ts","sourceRoot":"","sources":["../../../../../src/dsh-capabilities/host/quick-app-https-provider.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,WAAW,CAAA;AAEhE,OAAO,KAAK,EAAE,mBAAmB,EAAE,sBAAsB,EAAE,MAAM,+BAA+B,CAAA;AAIhG,4FAA4F;AAC5F,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,SAAS,EAAE,SAAS,MAAM,EAAE,CAAA;IACrC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;CACzB;AAKD,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,OAAO,GAAG,mBAAmB,CAqB5E;AAED,4EAA4E;AAC5E,wBAAsB,+BAA+B,CAAC,UAAU,qBAA+C,GAAG,OAAO,CAAC,qBAAqB,GAAG,SAAS,CAAC,CAQ3J;AAED,wBAAsB,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAU9E;AAID,6FAA6F;AAC7F,qBAAa,qBAAsB,YAAW,sBAAsB;IAKtD,OAAO,CAAC,QAAQ,CAAC,MAAM;IAAuB,OAAO,CAAC,QAAQ,CAAC,GAAG;IAJ9E,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA2B;IAClD,OAAO,CAAC,MAAM,CAAoB;IAClC,OAAO,CAAC,OAAO,CAAmC;IAClD,OAAO,CAAC,OAAO,CAAQ;gBACM,MAAM,EAAE,mBAAmB,EAAmB,GAAG,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE;IAS7G,SAAS,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO;IACrC,IAAI,CAAC,OAAO,EAAE,CAAC,OAAO,EAAE,eAAe,EAAE,QAAQ,EAAE,cAAc,KAAK,IAAI,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,CAAC;IAwB5H,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;YAIV,MAAM;YAsBN,aAAa;IAM3B,OAAO,CAAC,SAAS;CAKlB"}

package/data/build/dist/dsh-capabilities/host/quick-app-https-provider.js

@@ -0,0 +1,164 @@
+import { randomBytes, X509Certificate } from 'node:crypto';
+import { isAbsolute } from 'node:path';
+import { isIP } from 'node:net';
+import { createServer } from 'node:https';
+import { QUICK_APP_LIMITS } from '../../shared/contracts/quick-apps.js';
+import { endQuickAppResponse as end, quickAppCredentials } from './quick-app-credentials.js';
+const cookieName = '__Host-quickapp';
+const unavailable = () => Object.assign(new Error('Quick Apps HTTPS configuration is unavailable or invalid.'), { code: 'QUICK_APP_ORIGIN_UNAVAILABLE' });
+export function parseQuickAppHttpsConfig(value) {
+    if (!value || typeof value !== 'object' || Array.isArray(value))
+        throw unavailable();
+    const config = value;
+    const keys = ['appDomain', 'uiOrigins', 'listenHost', 'listenPort', 'publicPort', 'certFile', 'keyFile'];
+    if (Object.keys(config).some(key => !keys.includes(key)) || typeof config.appDomain !== 'string'
+        || config.appDomain.length > 190 || !/^(?:[a-z0-9](?:[a-z0-9-]*[a-z0-9])?\.)+[a-z]{2,}$/u.test(config.appDomain)
+        || config.appDomain.split('.').some(label => label.length > 63)
+        || config.appDomain === 'localhost' || config.appDomain.endsWith('.localhost') || isIP(config.appDomain)
+        || !isIP(config.listenHost) || ![config.listenPort, config.publicPort].every(port => Number.isInteger(port) && port > 0 && port < 65536)
+        || ![config.certFile, config.keyFile].every(path => typeof path === 'string' && isAbsolute(path))
+        || !Array.isArray(config.uiOrigins) || config.uiOrigins.length < 1 || config.uiOrigins.length > 16)
+        throw unavailable();
+    for (const origin of config.uiOrigins) {
+        let ui;
+        try {
+            ui = new URL(origin);
+        }
+        catch {
+            throw unavailable();
+        }
+        if (ui.origin !== origin || !['http:', 'https:'].includes(ui.protocol) || ui.username || ui.password
+            || ui.hostname === config.appDomain || ui.hostname.endsWith(`.${config.appDomain}`)
+            // Conservatively reject even sibling sites under a multi-label public suffix.
+            // Different final two DNS labels ensure UI Domain cookies cannot reach app pages.
+            || ui.hostname.split('.').slice(-2).join('.') === config.appDomain.split('.').slice(-2).join('.'))
+            throw unavailable();
+    }
+    return structuredClone(config);
+}
+/** No listener is started until an authenticated user opens an HTML app. */
+export async function configuredQuickAppHttpsProvider(configPath = process.env.CODINGNS_QUICK_APPS_HTTPS_CONFIG) {
+    if (!configPath)
+        return undefined;
+    try {
+        if (!isAbsolute(configPath))
+            throw unavailable();
+        const config = parseQuickAppHttpsConfig(JSON.parse(await boundedFile(configPath, 32 * 1024)));
+        const [cert, key] = await Promise.all([boundedFile(config.certFile, 128 * 1024), boundedFile(config.keyFile, 64 * 1024)]);
+        return new QuickAppHttpsProvider(config, { cert, key });
+    }
+    catch {
+        throw unavailable();
+    }
+}
+export async function boundedFile(path, limit) {
+    const { open } = await import('node:fs/promises');
+    const file = await open(path, 'r');
+    try {
+        if (!(await file.stat()).isFile())
+            throw unavailable();
+        const bytes = Buffer.alloc(limit + 1);
+        const { bytesRead } = await file.read(bytes, 0, bytes.length, 0);
+        if (bytesRead > limit)
+            throw unavailable();
+        return bytes.subarray(0, bytesRead).toString('utf8');
+    }
+    finally {
+        await file.close();
+    }
+}
+/** Dedicated TLS virtual-host listener. It never serves or proxies privileged DSH routes. */
+export class QuickAppHttpsProvider {
+    config;
+    tls;
+    routes = new Map();
+    server;
+    pending = Promise.resolve();
+    stopped = false;
+    constructor(config, tls) {
+        this.config = config;
+        this.tls = tls;
+        parseQuickAppHttpsConfig(config);
+        const certificate = new X509Certificate(tls.cert);
+        if (!certificate.checkHost(`probe.${config.appDomain}`) || Date.parse(certificate.validTo) <= Date.now()
+            || Date.parse(certificate.validFrom) > Date.now())
+            throw unavailable();
+        // Validate the key pair before reporting the configured transport as available.
+        const probe = createServer({ ...tls, minVersion: 'TLSv1.2' });
+        probe.close();
+    }
+    available(uiOrigin) { return !this.stopped && typeof uiOrigin === 'string' && this.config.uiOrigins.includes(uiOrigin); }
+    open(handler, uiOrigin) {
+        return this.serialize(async () => {
+            if (!this.available(uiOrigin) || this.routes.size >= QUICK_APP_LIMITS.launches)
+                throw unavailable();
+            await this.listen();
+            // Random names are never reused, including across Host/module restarts.
+            const hostname = `${randomBytes(24).toString('hex')}.${this.config.appDomain}`;
+            const origin = `https://${hostname}${this.config.publicPort === 443 ? '' : `:${this.config.publicPort}`}`;
+            const host = new URL(origin).host;
+            const credentials = quickAppCredentials(origin, uiOrigin, cookieName);
+            const route = { host, handle: async (request, response) => {
+                    if (!await credentials.handle(request, response))
+                        handler(request, response);
+                } };
+            this.routes.set(hostname, route);
+            return {
+                origin, uiOrigin: uiOrigin, ownerHostId: 'local', remote: true, cookieName,
+                activate: credentials.activate,
+                dispose: () => this.serialize(async () => {
+                    credentials.dispose();
+                    this.routes.delete(hostname);
+                    if (this.routes.size === 0)
+                        await this.closeListener();
+                }),
+            };
+        });
+    }
+    dispose() {
+        this.stopped = true;
+        return this.serialize(async () => { this.routes.clear(); await this.closeListener(); });
+    }
+    async listen() {
+        if (this.server)
+            return;
+        const server = createServer({ ...this.tls, minVersion: 'TLSv1.2', handshakeTimeout: 10_000, maxHeaderSize: 16 * 1024 }, (request, response) => {
+            response.setHeader('Cache-Control', 'no-store');
+            response.setHeader('Referrer-Policy', 'no-referrer');
+            response.setHeader('X-Content-Type-Options', 'nosniff');
+            const sni = request.socket.servername;
+            const route = typeof sni === 'string' ? this.routes.get(sni) : undefined;
+            // Never trust forwarded Host/Origin headers; TLS terminates at this listener.
+            if (!route || request.headers.host !== route.host || request.rawHeaders.filter((_, i) => i % 2 === 0 && request.rawHeaders[i].toLowerCase() === 'host').length !== 1)
+                return end(response, 421);
+            void route.handle(request, response).catch(() => end(response, 400));
+        });
+        server.requestTimeout = 15_000;
+        server.headersTimeout = 10_000;
+        server.timeout = 30_000;
+        server.keepAliveTimeout = 5_000;
+        server.maxRequestsPerSocket = 100;
+        server.maxConnections = 256;
+        await new Promise((resolve, reject) => {
+            server.once('error', reject);
+            server.listen(this.config.listenPort, this.config.listenHost, () => { server.removeListener('error', reject); resolve(); });
+        }).catch(() => { server.close(); throw unavailable(); });
+        // Listener failures must not take down unrelated Host modules.
+        server.on('error', () => { void this.dispose(); });
+        this.server = server;
+    }
+    async closeListener() {
+        const server = this.server;
+        this.server = undefined;
+        if (!server)
+            return;
+        server.closeAllConnections();
+        await new Promise(resolve => server.close(() => resolve()));
+    }
+    serialize(operation) {
+        const result = this.pending.catch(() => undefined).then(operation);
+        this.pending = result.then(() => undefined, () => undefined);
+        return result;
+    }
+}
+//# sourceMappingURL=quick-app-https-provider.js.map

package/data/build/dist/dsh-capabilities/host/quick-app-https-provider.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"quick-app-https-provider.js","sourceRoot":"","sources":["../../../../../src/dsh-capabilities/host/quick-app-https-provider.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,aAAa,CAAA;AAC1D,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAA;AACtC,OAAO,EAAE,IAAI,EAAE,MAAM,UAAU,CAAA;AAC/B,OAAO,EAAE,YAAY,EAAe,MAAM,YAAY,CAAA;AAItD,OAAO,EAAE,gBAAgB,EAAE,MAAM,sCAAsC,CAAA;AACvE,OAAO,EAAE,mBAAmB,IAAI,GAAG,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAA;AAa5F,MAAM,UAAU,GAAG,iBAAiB,CAAA;AACpC,MAAM,WAAW,GAAG,GAAG,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,2DAA2D,CAAC,EAAE,EAAE,IAAI,EAAE,8BAA8B,EAAE,CAAC,CAAA;AAEzJ,MAAM,UAAU,wBAAwB,CAAC,KAAc;IACrD,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,MAAM,WAAW,EAAE,CAAA;IACpF,MAAM,MAAM,GAAG,KAA4B,CAAA;IAC3C,MAAM,IAAI,GAAG,CAAC,WAAW,EAAE,WAAW,EAAE,YAAY,EAAE,YAAY,EAAE,YAAY,EAAE,UAAU,EAAE,SAAS,CAAC,CAAA;IACxG,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,IAAI,OAAO,MAAM,CAAC,SAAS,KAAK,QAAQ;WAC3F,MAAM,CAAC,SAAS,CAAC,MAAM,GAAG,GAAG,IAAI,CAAC,oDAAoD,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC;WAC7G,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,MAAM,GAAG,EAAE,CAAC;WAC5D,MAAM,CAAC,SAAS,KAAK,WAAW,IAAI,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,YAAY,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC;WACrG,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,UAAU,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI,IAAI,GAAG,KAAK,CAAC;WACrI,CAAC,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,IAAI,UAAU,CAAC,IAAI,CAAC,CAAC;WAC9F,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,MAAM,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,IAAI,MAAM,CAAC,SAAS,CAAC,MAAM,GAAG,EAAE;QAAE,MAAM,WAAW,EAAE,CAAA;IACzH,KAAK,MAAM,MAAM,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;QACtC,IAAI,EAAO,CAAA;QACX,IAAI,CAAC;YAAC,EAAE,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAA;QAAC,CAAC;QAAC,MAAM,CAAC;YAAC,MAAM,WAAW,EAAE,CAAA;QAAC,CAAC;QAC1D,IAAI,EAAE,CAAC,MAAM,KAAK,MAAM,IAAI,CAAC,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,QAAQ,IAAI,EAAE,CAAC,QAAQ;eAC/F,EAAE,CAAC,QAAQ,KAAK,MAAM,CAAC,SAAS,IAAI,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;YACnF,8EAA8E;YAC9E,kFAAkF;eAC/E,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;YAAE,MAAM,WAAW,EAAE,CAAA;IAC1H,CAAC;IACD,OAAO,eAAe,CAAC,MAAM,CAAC,CAAA;AAChC,CAAC;AAED,4EAA4E;AAC5E,MAAM,CAAC,KAAK,UAAU,+BAA+B,CAAC,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,gCAAgC;IAC7G,IAAI,CAAC,UAAU;QAAE,OAAO,SAAS,CAAA;IACjC,IAAI,CAAC;QACH,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC;YAAE,MAAM,WAAW,EAAE,CAAA;QAChD,MAAM,MAAM,GAAG,wBAAwB,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,WAAW,CAAC,UAAU,EAAE,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,CAAA;QAC7F,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,WAAW,CAAC,MAAM,CAAC,QAAQ,EAAE,GAAG,GAAG,IAAI,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,OAAO,EAAE,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,CAAA;QACzH,OAAO,IAAI,qBAAqB,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,CAAA;IACzD,CAAC;IAAC,MAAM,CAAC;QAAC,MAAM,WAAW,EAAE,CAAA;IAAC,CAAC;AACjC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,IAAY,EAAE,KAAa;IAC3D,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,kBAAkB,CAAC,CAAA;IACjD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAA;IAClC,IAAI,CAAC;QACH,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;YAAE,MAAM,WAAW,EAAE,CAAA;QACtD,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAA;QACrC,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAA;QAChE,IAAI,SAAS,GAAG,KAAK;YAAE,MAAM,WAAW,EAAE,CAAA;QAC1C,OAAO,KAAK,CAAC,QAAQ,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAA;IACtD,CAAC;YAAS,CAAC;QAAC,MAAM,IAAI,CAAC,KAAK,EAAE,CAAA;IAAC,CAAC;AAClC,CAAC;AAID,6FAA6F;AAC7F,MAAM,OAAO,qBAAqB;IAKH;IAA8C;IAJ1D,MAAM,GAAG,IAAI,GAAG,EAAiB,CAAA;IAC1C,MAAM,CAAoB;IAC1B,OAAO,GAAkB,OAAO,CAAC,OAAO,EAAE,CAAA;IAC1C,OAAO,GAAG,KAAK,CAAA;IACvB,YAA6B,MAA2B,EAAmB,GAAkC;QAAhF,WAAM,GAAN,MAAM,CAAqB;QAAmB,QAAG,GAAH,GAAG,CAA+B;QAC3G,wBAAwB,CAAC,MAAM,CAAC,CAAA;QAChC,MAAM,WAAW,GAAG,IAAI,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;QACjD,IAAI,CAAC,WAAW,CAAC,SAAS,CAAC,SAAS,MAAM,CAAC,SAAS,EAAE,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,GAAG,EAAE;eACnG,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,SAAS,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE;YAAE,MAAM,WAAW,EAAE,CAAA;QACxE,gFAAgF;QAChF,MAAM,KAAK,GAAG,YAAY,CAAC,EAAE,GAAG,GAAG,EAAE,UAAU,EAAE,SAAS,EAAE,CAAC,CAAA;QAC7D,KAAK,CAAC,KAAK,EAAE,CAAA;IACf,CAAC;IACD,SAAS,CAAC,QAAiB,IAAa,OAAO,CAAC,IAAI,CAAC,OAAO,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAA,CAAC,CAAC;IAC1I,IAAI,CAAC,OAAqE,EAAE,QAAiB;QAC3F,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,IAAI,EAAE;YAC/B,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,IAAI,gBAAgB,CAAC,QAAQ;gBAAE,MAAM,WAAW,EAAE,CAAA;YACnG,MAAM,IAAI,CAAC,MAAM,EAAE,CAAA;YACnB,wEAAwE;YACxE,MAAM,QAAQ,GAAG,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,CAAA;YAC9E,MAAM,MAAM,GAAG,WAAW,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,UAAU,KAAK,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,EAAE,CAAA;YACzG,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAA;YACjC,MAAM,WAAW,GAAG,mBAAmB,CAAC,MAAM,EAAE,QAAS,EAAE,UAAU,CAAC,CAAA;YACtE,MAAM,KAAK,GAAU,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,EAAE;oBAC/D,IAAI,CAAC,MAAM,WAAW,CAAC,MAAM,CAAC,OAAO,EAAE,QAAQ,CAAC;wBAAE,OAAO,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAA;gBAC9E,CAAC,EAAE,CAAA;YACH,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAA;YAChC,OAAO;gBACL,MAAM,EAAE,QAAQ,EAAE,QAAS,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU;gBAC3E,QAAQ,EAAE,WAAW,CAAC,QAAQ;gBAC9B,OAAO,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,IAAI,EAAE;oBACvC,WAAW,CAAC,OAAO,EAAE,CAAA;oBACrB,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAA;oBAC5B,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC;wBAAE,MAAM,IAAI,CAAC,aAAa,EAAE,CAAA;gBACxD,CAAC,CAAC;aACH,CAAA;QACH,CAAC,CAAC,CAAA;IACJ,CAAC;IACD,OAAO;QACL,IAAI,CAAC,OAAO,GAAG,IAAI,CAAA;QACnB,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,IAAI,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,MAAM,IAAI,CAAC,aAAa,EAAE,CAAA,CAAC,CAAC,CAAC,CAAA;IACxF,CAAC;IACO,KAAK,CAAC,MAAM;QAClB,IAAI,IAAI,CAAC,MAAM;YAAE,OAAM;QACvB,MAAM,MAAM,GAAG,YAAY,CAAC,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,UAAU,EAAE,SAAS,EAAE,gBAAgB,EAAE,MAAM,EAAE,aAAa,EAAE,EAAE,GAAG,IAAI,EAAE,EAAE,CAAC,OAAO,EAAE,QAAQ,EAAE,EAAE;YAC5I,QAAQ,CAAC,SAAS,CAAC,eAAe,EAAE,UAAU,CAAC,CAAA;YAC/C,QAAQ,CAAC,SAAS,CAAC,iBAAiB,EAAE,aAAa,CAAC,CAAA;YACpD,QAAQ,CAAC,SAAS,CAAC,wBAAwB,EAAE,SAAS,CAAC,CAAA;YACvD,MAAM,GAAG,GAAI,OAAO,CAAC,MAAoB,CAAC,UAAU,CAAA;YACpD,MAAM,KAAK,GAAG,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;YACxE,8EAA8E;YAC9E,IAAI,CAAC,KAAK,IAAI,OAAO,CAAC,OAAO,CAAC,IAAI,KAAK,KAAK,CAAC,IAAI,IAAI,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,OAAO,CAAC,UAAU,CAAC,CAAC,CAAE,CAAC,WAAW,EAAE,KAAK,MAAM,CAAC,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO,GAAG,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAA;YAChM,KAAK,KAAK,CAAC,MAAM,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,CAAA;QACtE,CAAC,CAAC,CAAA;QACF,MAAM,CAAC,cAAc,GAAG,MAAM,CAAC;QAAC,MAAM,CAAC,cAAc,GAAG,MAAM,CAAC;QAAC,MAAM,CAAC,OAAO,GAAG,MAAM,CAAA;QACvF,MAAM,CAAC,gBAAgB,GAAG,KAAK,CAAC;QAAC,MAAM,CAAC,oBAAoB,GAAG,GAAG,CAAC;QAAC,MAAM,CAAC,cAAc,GAAG,GAAG,CAAA;QAC/F,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YAC1C,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;YAC5B,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,GAAG,EAAE,GAAG,MAAM,CAAC,cAAc,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,OAAO,EAAE,CAAA,CAAC,CAAC,CAAC,CAAA;QAC5H,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,MAAM,WAAW,EAAE,CAAA,CAAC,CAAC,CAAC,CAAA;QACvD,+DAA+D;QAC/D,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,GAAG,KAAK,IAAI,CAAC,OAAO,EAAE,CAAA,CAAC,CAAC,CAAC,CAAA;QACjD,IAAI,CAAC,MAAM,GAAG,MAAM,CAAA;IACtB,CAAC;IACO,KAAK,CAAC,aAAa;QACzB,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;QAAC,IAAI,CAAC,MAAM,GAAG,SAAS,CAAA;QACnD,IAAI,CAAC,MAAM;YAAE,OAAM;QACnB,MAAM,CAAC,mBAAmB,EAAE,CAAA;QAC5B,MAAM,IAAI,OAAO,CAAO,OAAO,CAAC,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC,CAAA;IACnE,CAAC;IACO,SAAS,CAAI,SAA2B;QAC9C,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;QAClE,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,SAAS,CAAC,CAAA;QAC5D,OAAO,MAAM,CAAA;IACf,CAAC;CACF"}

package/data/build/dist/dsh-capabilities/host/quick-app-lan-ports.d.ts

@@ -0,0 +1,44 @@
+import type { IncomingMessage, ServerResponse } from 'node:http';
+import { type QuickAppRuntimeReason } from '../../shared/contracts/quick-apps.js';
+import type { QuickAppLanTransport, QuickAppOriginLease, QuickAppOriginProvider } from './quick-app-origin-adapter.js';
+export interface QuickAppLanPortsConfig {
+    readonly transport: 'lan-ports';
+    readonly publicHost: string;
+    readonly uiOrigins: readonly string[];
+    readonly ports: readonly [number, number];
+    readonly stateDirectory: string;
+    readonly certFile: string;
+    readonly keyFile: string;
+}
+export declare function parseQuickAppLanPortsConfig(value: unknown): QuickAppLanPortsConfig;
+/** Browsers cannot forge these headers; they are an origin fence, never authentication. */
+export declare function sameBrowserOrigin(headers: Record<string, string | string[] | undefined>, origin: string): boolean;
+/** Dedicated app HTTPS ports on the existing LAN bind address; no DSH forwarding. */
+export declare class QuickAppLanPortsProvider implements QuickAppOriginProvider, QuickAppLanTransport {
+    private readonly tls;
+    readonly isolation: "lan-port";
+    private listenHost;
+    private stopped;
+    private pending;
+    private readonly active;
+    private readonly reserved;
+    private allocationFailure;
+    private generation;
+    private readonly config;
+    constructor(config: QuickAppLanPortsConfig, tls: {
+        cert: string;
+        key: string;
+    });
+    /** Read persistent reservations before availability is advertised. Never delete this history. */
+    initialize(): Promise<void>;
+    started(listenHost: string): void;
+    stopping(): Promise<void>;
+    dispose(): Promise<void>;
+    available(uiOrigin?: string): boolean;
+    protects(uiOrigin?: string): boolean;
+    diagnostic(uiOrigin?: string): QuickAppRuntimeReason | undefined;
+    permits(headers: Record<string, string>, method: string, path: string): boolean;
+    open(handler: (request: IncomingMessage, response: ServerResponse) => void, uiOrigin?: string): Promise<QuickAppOriginLease>;
+    private allocate;
+}
+//# sourceMappingURL=quick-app-lan-ports.d.ts.map

package/data/build/dist/dsh-capabilities/host/quick-app-lan-ports.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"quick-app-lan-ports.d.ts","sourceRoot":"","sources":["../../../../../src/dsh-capabilities/host/quick-app-lan-ports.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,WAAW,CAAA;AAEhE,OAAO,EAAgD,KAAK,qBAAqB,EAAE,MAAM,sCAAsC,CAAA;AAC/H,OAAO,KAAK,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,sBAAsB,EAAE,MAAM,+BAA+B,CAAA;AAGtH,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,SAAS,EAAE,WAAW,CAAA;IAC/B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,SAAS,EAAE,SAAS,MAAM,EAAE,CAAA;IACrC,QAAQ,CAAC,KAAK,EAAE,SAAS,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IACzC,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAA;IAC/B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;CACzB;AAED,wBAAgB,2BAA2B,CAAC,KAAK,EAAE,OAAO,GAAG,sBAAsB,CAiBlF;AAUD,2FAA2F;AAC3F,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,CAAC,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAOjH;AAMD,qFAAqF;AACrF,qBAAa,wBAAyB,YAAW,sBAAsB,EAAE,oBAAoB;IAW/C,OAAO,CAAC,QAAQ,CAAC,GAAG;IAVhE,QAAQ,CAAC,SAAS,EAAG,UAAU,CAAS;IACxC,OAAO,CAAC,UAAU,CAAoB;IACtC,OAAO,CAAC,OAAO,CAAQ;IACvB,OAAO,CAAC,OAAO,CAAmC;IAClD,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAiC;IACxD,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAoB;IAC7C,OAAO,CAAC,iBAAiB,CAAmC;IAC5D,OAAO,CAAC,UAAU,CAAI;IACtB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAwB;gBAEnC,MAAM,EAAE,sBAAsB,EAAmB,GAAG,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE;IAS/F,iGAAiG;IAC3F,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;IAOjC,OAAO,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI;IAC3B,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC;IAKzB,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;IAC9B,SAAS,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO;IACrC,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO;IACpC,UAAU,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,qBAAqB,GAAG,SAAS;IAQhE,OAAO,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO;IAe/E,IAAI,CAAC,OAAO,EAAE,CAAC,OAAO,EAAE,eAAe,EAAE,QAAQ,EAAE,cAAc,KAAK,IAAI,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,CAAC;YAM9G,QAAQ;CA2DvB"}

package/data/build/dist/dsh-capabilities/host/quick-app-lan-ports.js

@@ -0,0 +1,240 @@
+import { randomBytes, X509Certificate } from 'node:crypto';
+import { mkdir, readdir, writeFile } from 'node:fs/promises';
+import { createServer } from 'node:https';
+import { isIP } from 'node:net';
+import { isAbsolute, join } from 'node:path';
+import { QUICK_APP_LIMITS, quickAppTransportErrorCode } from '../../shared/contracts/quick-apps.js';
+import { endQuickAppResponse, quickAppCredentials } from './quick-app-credentials.js';
+export function parseQuickAppLanPortsConfig(value) {
+    if (!value || typeof value !== 'object' || Array.isArray(value))
+        throw unavailable('config-invalid');
+    const c = value;
+    if (Object.keys(c).some(key => !['transport', 'publicHost', 'uiOrigins', 'ports', 'stateDirectory', 'certFile', 'keyFile'].includes(key))
+        || c.transport !== 'lan-ports' || typeof c.publicHost !== 'string' || c.publicHost.length > 253
+        || !validHost(c.publicHost) || !Array.isArray(c.ports) || c.ports.length !== 2
+        || !c.ports.every(port => Number.isInteger(port) && port >= 1024 && port <= 65535)
+        || c.ports[0] > c.ports[1] || c.ports[1] - c.ports[0] >= 16384
+        || ![c.stateDirectory, c.certFile, c.keyFile].every(path => typeof path === 'string' && isAbsolute(path))
+        || !Array.isArray(c.uiOrigins) || c.uiOrigins.length < 1 || c.uiOrigins.length > 16)
+        throw unavailable('config-invalid');
+    for (const origin of c.uiOrigins) {
+        let url;
+        try {
+            url = new URL(origin);
+        }
+        catch {
+            throw unavailable('config-invalid');
+        }
+        if (url.origin !== origin || url.protocol !== 'https:' || url.username || url.password || !validHost(url.hostname)
+            || url.hostname === c.publicHost && Number(url.port || 443) >= c.ports[0] && Number(url.port || 443) <= c.ports[1])
+            throw unavailable('config-invalid');
+    }
+    return structuredClone(c);
+}
+function validHost(host) {
+    try {
+        if (new URL(`https://${host}`).hostname !== host)
+            return false;
+    }
+    catch {
+        return false;
+    }
+    const ip = host.replace(/^\[|\]$/gu, '');
+    if (isIP(ip))
+        return ip !== '0.0.0.0' && ip !== '::' && ip !== '::1' && !/^127\./u.test(ip) && !ip.startsWith('::ffff:');
+    return /^(?:[a-z0-9](?:[a-z0-9-]*[a-z0-9])?\.)+[a-z]{2,}$/u.test(host)
+        && host.split('.').every(label => label.length <= 63) && !host.endsWith('.localhost');
+}
+/** Browsers cannot forge these headers; they are an origin fence, never authentication. */
+export function sameBrowserOrigin(headers, origin) {
+    if (headers.origin !== undefined && headers.origin !== origin)
+        return false;
+    const site = headers['sec-fetch-site'];
+    if (site !== undefined && site !== 'same-origin')
+        return false;
+    if (headers.origin === origin || site === 'same-origin')
+        return true;
+    // A fallback for clients that omit Fetch Metadata. No-referrer clients fail closed.
+    try {
+        return typeof headers.referer === 'string' && new URL(headers.referer).origin === origin;
+    }
+    catch {
+        return false;
+    }
+}
+function unavailable(reason) {
+    return Object.assign(new Error(`Quick Apps transport unavailable: ${reason}.`), { code: quickAppTransportErrorCode(reason), reason });
+}
+/** Dedicated app HTTPS ports on the existing LAN bind address; no DSH forwarding. */
+export class QuickAppLanPortsProvider {
+    tls;
+    isolation = 'lan-port';
+    listenHost;
+    stopped = false;
+    pending = Promise.resolve();
+    active = new Set();
+    reserved = new Set();
+    allocationFailure;
+    generation = 0;
+    config;
+    constructor(config, tls) {
+        this.tls = tls;
+        this.config = parseQuickAppLanPortsConfig(config);
+        const cert = new X509Certificate(tls.cert);
+        const ip = config.publicHost.replace(/^\[|\]$/gu, '');
+        if (!(isIP(ip) ? cert.checkIP(ip) : cert.checkHost(config.publicHost))
+            || Date.parse(cert.validFrom) > Date.now() || Date.parse(cert.validTo) <= Date.now())
+            throw unavailable('config-invalid');
+        const probe = createServer({ ...tls, minVersion: 'TLSv1.2' });
+        probe.close();
+    }
+    /** Read persistent reservations before availability is advertised. Never delete this history. */
+    async initialize() {
+        await mkdir(this.config.stateDirectory, { recursive: true, mode: 0o700 });
+        for (const entry of await readdir(this.config.stateDirectory)) {
+            if (/^\d+\.json$/u.test(entry))
+                this.reserved.add(Number(entry.slice(0, -5)));
+        }
+    }
+    started(listenHost) { this.listenHost = listenHost; this.generation++; this.allocationFailure = undefined; }
+    async stopping() {
+        this.listenHost = undefined;
+        this.generation++;
+        await this.pending.catch(() => undefined);
+        await Promise.all([...this.active].map(dispose => dispose()));
+    }
+    async dispose() { this.stopped = true; await this.stopping(); }
+    available(uiOrigin) { return this.diagnostic(uiOrigin) === undefined; }
+    protects(uiOrigin) { return !this.stopped && Boolean(this.listenHost) && Boolean(uiOrigin && this.config.uiOrigins.includes(uiOrigin)); }
+    diagnostic(uiOrigin) {
+        if (this.stopped || !this.listenHost)
+            return 'lan-stopped';
+        if (!uiOrigin || !this.config.uiOrigins.includes(uiOrigin))
+            return 'ui-not-allowed';
+        if (this.allocationFailure)
+            return this.allocationFailure;
+        for (let port = this.config.ports[0]; port <= this.config.ports[1]; port++)
+            if (!this.reserved.has(port))
+                return undefined;
+        return 'ports-exhausted';
+    }
+    permits(headers, method, path) {
+        if ((method === 'GET' || method === 'HEAD') && path === '/' && !headers.upgrade
+            && headers['sec-fetch-mode'] === 'navigate' && headers['sec-fetch-dest'] === 'document')
+            return true;
+        // App configuration must not become an allowlist for ordinary DSH addresses.
+        // Block only origins owned by this app transport, including retired ports.
+        for (const value of [headers.origin, headers.referer]) {
+            if (value === undefined)
+                continue;
+            try {
+                const url = new URL(value);
+                if (url.hostname === this.config.publicHost && this.reserved.has(Number(url.port || 443)))
+                    return false;
+            }
+            catch {
+                if (value === 'null')
+                    return false;
+            }
+        }
+        return true;
+    }
+    open(handler, uiOrigin) {
+        const operation = this.pending.catch(() => undefined).then(() => this.allocate(handler, uiOrigin));
+        this.pending = operation.then(() => undefined, () => undefined);
+        return operation;
+    }
+    async allocate(handler, uiOrigin) {
+        const reason = this.diagnostic(uiOrigin);
+        if (reason)
+            throw unavailable(reason);
+        if (this.active.size >= QUICK_APP_LIMITS.launches)
+            throw unavailable('ports-busy');
+        const generation = this.generation;
+        let busy = false;
+        for (let port = this.config.ports[0]; port <= this.config.ports[1]; port++) {
+            if (this.reserved.has(port))
+                continue;
+            const origin = `https://${this.config.publicHost}:${port}`;
+            const cookieName = `__Host-quickapp-${randomBytes(16).toString('hex')}`;
+            const credentials = quickAppCredentials(origin, uiOrigin, cookieName);
+            let alive = true;
+            const server = createServer({ ...this.tls, minVersion: 'TLSv1.2', maxHeaderSize: 16 * 1024, handshakeTimeout: 10_000 }, (req, res) => {
+                res.setHeader('Cache-Control', 'no-store');
+                res.setHeader('Referrer-Policy', 'same-origin');
+                res.setHeader('X-Content-Type-Options', 'nosniff');
+                const sni = req.socket.servername;
+                if (!alive || generation !== this.generation)
+                    return endQuickAppResponse(res, 410);
+                if (req.headers.host !== new URL(origin).host || sni && sni !== this.config.publicHost
+                    || req.rawHeaders.filter((_, i) => i % 2 === 0 && req.rawHeaders[i].toLowerCase() === 'host').length !== 1)
+                    return endQuickAppResponse(res, 421);
+                // Only the one-use landing page accepts cross-origin navigation from the DSH viewer.
+                if (req.url !== '/__quickapp/bootstrap' && !sameBrowserOrigin(req.headers, origin))
+                    return endQuickAppResponse(res, 403);
+                // Browser cookies have no port scope. Strip every cookie except this launch's before
+                // passing the request to the application service; never forward general credentials.
+                const cookies = (req.headers.cookie ?? '').split(';').map(value => value.trim()).filter(value => value.startsWith(`${cookieName}=`));
+                req.headers.cookie = cookies.join('; ');
+                delete req.headers.authorization;
+                req.rawHeaders = req.rawHeaders.flatMap((value, i, headers) => i % 2 || ['cookie', 'authorization'].includes(value.toLowerCase()) ? [] : [value, headers[i + 1]]);
+                if (cookies.length)
+                    req.rawHeaders.push('Cookie', cookies.join('; '));
+                void credentials.handle(req, res).then(handled => { if (!handled && alive)
+                    handler(req, res); }).catch(() => endQuickAppResponse(res, 400));
+            });
+            server.requestTimeout = 15_000;
+            server.headersTimeout = 10_000;
+            server.timeout = 30_000;
+            server.keepAliveTimeout = 5_000;
+            server.maxConnections = 128;
+            server.maxRequestsPerSocket = 100;
+            const dispose = async () => {
+                if (!alive)
+                    return;
+                alive = false;
+                credentials.dispose();
+                this.active.delete(dispose);
+                await close(server);
+            };
+            try {
+                await new Promise((resolve, reject) => {
+                    server.once('error', reject);
+                    server.listen(port, this.listenHost, () => { server.removeListener('error', reject); resolve(); });
+                });
+                server.on('error', () => { void dispose(); });
+                // Atomic create makes independent Host instances sharing this history race safely.
+                await writeFile(join(this.config.stateDirectory, `${port}.json`), JSON.stringify({ origin, allocatedAt: new Date().toISOString() }), { flag: 'wx', mode: 0o600 });
+                this.reserved.add(port);
+                if (this.stopped || generation !== this.generation) {
+                    await dispose();
+                    throw unavailable('lan-stopped');
+                }
+                this.active.add(dispose);
+                return { origin, uiOrigin: uiOrigin, ownerHostId: 'local', remote: true, cookieName, isolation: 'lan-port', activate: credentials.activate, dispose };
+            }
+            catch (error) {
+                await dispose();
+                const code = error.code;
+                if (code === 'EEXIST') {
+                    this.reserved.add(port);
+                    continue;
+                }
+                if (code === 'EADDRINUSE') {
+                    busy = true;
+                    continue;
+                }
+                throw error;
+            }
+        }
+        if (!busy)
+            this.allocationFailure = 'ports-exhausted';
+        throw unavailable(busy ? 'ports-busy' : 'ports-exhausted');
+    }
+}
+async function close(server) {
+    server.closeAllConnections();
+    if (server.listening)
+        await new Promise(resolve => server.close(() => resolve()));
+}
+//# sourceMappingURL=quick-app-lan-ports.js.map