@jingyi0605/codingns4dsh 0.2.1-beta.9 → 0.2.1-rc.2

package/data/build/dist/dsh-capabilities/host/connection-peer-adapter.js

@@ -0,0 +1,34 @@
+/** Only Connection may derive identity from credentials. Never read it from an RPC payload. */
+export function admitCodingNsPeer(connection, headers) {
+    const service = connection;
+    const admission = typeof service.admit === 'function'
+        ? service.admit({ headers })
+        : (() => {
+            const rejection = service.requestRejection?.({ headers });
+            return rejection === undefined ? { peer: service.operator } : { rejection };
+        })();
+    if ('rejection' in admission)
+        return admission;
+    // Plugin settings and external agent controls have always been owner-only.
+    return isCodingNsOwnerPeer(connection, admission.peer) ? admission : { rejection: 403 };
+}
+export function isCodingNsOwnerPeer(connection, peer) {
+    const service = connection;
+    const candidate = peer;
+    if (candidate?.signal?.aborted || candidate?.authenticated === false || candidate?.authorized === false || candidate?.scope?.kind === 'session' || candidate?.kind === 'session')
+        return false;
+    if (service?.browserPeer !== undefined)
+        return candidate?.principal?.kind === 'owner';
+    return service?.operator === undefined || peer === service.operator;
+}
+/** Internal host calls borrow the host-owned peer; callers retain ownership of supplied peers. */
+export function nativeDispatchPeer(connection, caller) {
+    const service = connection;
+    const peer = caller ?? service?.browserPeer ?? service?.operator;
+    if (service?.browserPeer !== undefined && peer === undefined)
+        throw new Error('DSH requires a live peer');
+    const signal = peer?.signal;
+    signal?.throwIfAborted();
+    return peer;
+}
+//# sourceMappingURL=connection-peer-adapter.js.map

package/data/build/dist/dsh-capabilities/host/connection-peer-adapter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"connection-peer-adapter.js","sourceRoot":"","sources":["../../../../../src/dsh-capabilities/host/connection-peer-adapter.ts"],"names":[],"mappings":"AAOA,+FAA+F;AAC/F,MAAM,UAAU,iBAAiB,CAAC,UAAmB,EAAE,OAAgB;IACrE,MAAM,OAAO,GAAG,UAA6B,CAAA;IAC7C,MAAM,SAAS,GAAG,OAAO,OAAO,CAAC,KAAK,KAAK,UAAU;QACnD,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,CAAC;QAC5B,CAAC,CAAC,CAAC,GAAG,EAAE;YACN,MAAM,SAAS,GAAG,OAAO,CAAC,gBAAgB,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,CAAA;YACzD,OAAO,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAA;QAC7E,CAAC,CAAC,EAAE,CAAA;IACN,IAAI,WAAW,IAAI,SAAS;QAAE,OAAO,SAAS,CAAA;IAC9C,2EAA2E;IAC3E,OAAO,mBAAmB,CAAC,UAAU,EAAE,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,GAAG,EAAE,CAAA;AACzF,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,UAAmB,EAAE,IAAa;IACpE,MAAM,OAAO,GAAG,UAAyC,CAAA;IACzD,MAAM,SAAS,GAAG,IAAoK,CAAA;IACtL,IAAI,SAAS,EAAE,MAAM,EAAE,OAAO,IAAI,SAAS,EAAE,aAAa,KAAK,KAAK,IAAI,SAAS,EAAE,UAAU,KAAK,KAAK,IAAI,SAAS,EAAE,KAAK,EAAE,IAAI,KAAK,SAAS,IAAI,SAAS,EAAE,IAAI,KAAK,SAAS;QAAE,OAAO,KAAK,CAAA;IAC9L,IAAI,OAAO,EAAE,WAAW,KAAK,SAAS;QAAE,OAAO,SAAS,EAAE,SAAS,EAAE,IAAI,KAAK,OAAO,CAAA;IACrF,OAAO,OAAO,EAAE,QAAQ,KAAK,SAAS,IAAI,IAAI,KAAK,OAAO,CAAC,QAAQ,CAAA;AACrE,CAAC;AAED,kGAAkG;AAClG,MAAM,UAAU,kBAAkB,CAAC,UAAmB,EAAE,MAAgB;IACtE,MAAM,OAAO,GAAG,UAAyC,CAAA;IACzD,MAAM,IAAI,GAAG,MAAM,IAAI,OAAO,EAAE,WAAW,IAAI,OAAO,EAAE,QAAQ,CAAA;IAChE,IAAI,OAAO,EAAE,WAAW,KAAK,SAAS,IAAI,IAAI,KAAK,SAAS;QAAE,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAA;IACzG,MAAM,MAAM,GAAI,IAA6C,EAAE,MAAM,CAAA;IACrE,MAAM,EAAE,cAAc,EAAE,CAAA;IACxB,OAAO,IAAI,CAAA;AACb,CAAC"}

package/data/build/dist/dsh-capabilities/host/native-dispatch-adapter.d.ts

@@ -0,0 +1,21 @@
+interface GatewayRequest {
+    readonly namespace: string;
+    readonly method: string;
+    readonly args: Record<string, unknown>;
+    readonly signal?: AbortSignal;
+    readonly peer?: unknown;
+}
+export interface NativeGateway {
+    invoke(request: GatewayRequest): Promise<unknown>;
+    stream(request: GatewayRequest): AsyncIterable<unknown>;
+    readonly wireStream?: {
+        open(endpoint: string, payload: unknown, uplink: AsyncIterable<unknown>, peer: unknown, signal: AbortSignal): Promise<AsyncIterable<unknown>>;
+    };
+}
+/** Explicit peers work on both Gateway generations; legacy hosts may omit one. */
+export declare function nativePeerRequest(connection: unknown, caller?: unknown): {
+    peer?: unknown;
+};
+export declare function nativeSharedFetch(connection: unknown, request: Request, caller?: unknown): Promise<Response>;
+export {};
+//# sourceMappingURL=native-dispatch-adapter.d.ts.map

package/data/build/dist/dsh-capabilities/host/native-dispatch-adapter.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"native-dispatch-adapter.d.ts","sourceRoot":"","sources":["../../../../../src/dsh-capabilities/host/native-dispatch-adapter.ts"],"names":[],"mappings":"AAEA,UAAU,cAAc;IACtB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IACtC,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,CAAA;IAC7B,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,CAAA;CACxB;AAED,MAAM,WAAW,aAAa;IAC5B,MAAM,CAAC,OAAO,EAAE,cAAc,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;IACjD,MAAM,CAAC,OAAO,EAAE,cAAc,GAAG,aAAa,CAAC,OAAO,CAAC,CAAA;IACvD,QAAQ,CAAC,UAAU,CAAC,EAAE;QAAE,IAAI,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,aAAa,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,WAAW,GAAG,OAAO,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC,CAAA;KAAE,CAAA;CACxK;AAED,kFAAkF;AAClF,wBAAgB,iBAAiB,CAAC,UAAU,EAAE,OAAO,EAAE,MAAM,CAAC,EAAE,OAAO,GAAG;IAAE,IAAI,CAAC,EAAE,OAAO,CAAA;CAAE,CAG3F;AAED,wBAAgB,iBAAiB,CAAC,UAAU,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,CAG5G"}

package/data/build/dist/dsh-capabilities/host/native-dispatch-adapter.js

@@ -0,0 +1,11 @@
+import { nativeDispatchPeer } from './connection-peer-adapter.js';
+/** Explicit peers work on both Gateway generations; legacy hosts may omit one. */
+export function nativePeerRequest(connection, caller) {
+    const peer = nativeDispatchPeer(connection, caller);
+    return peer === undefined ? {} : { peer };
+}
+export function nativeSharedFetch(connection, request, caller) {
+    const service = connection;
+    return service.createSharedFetchHandler('/api').fetch(request, nativeDispatchPeer(connection, caller));
+}
+//# sourceMappingURL=native-dispatch-adapter.js.map

package/data/build/dist/dsh-capabilities/host/native-dispatch-adapter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"native-dispatch-adapter.js","sourceRoot":"","sources":["../../../../../src/dsh-capabilities/host/native-dispatch-adapter.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,MAAM,8BAA8B,CAAA;AAgBjE,kFAAkF;AAClF,MAAM,UAAU,iBAAiB,CAAC,UAAmB,EAAE,MAAgB;IACrE,MAAM,IAAI,GAAG,kBAAkB,CAAC,UAAU,EAAE,MAAM,CAAC,CAAA;IACnD,OAAO,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAA;AAC3C,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,UAAmB,EAAE,OAAgB,EAAE,MAAgB;IACvF,MAAM,OAAO,GAAG,UAA2H,CAAA;IAC3I,OAAO,OAAO,CAAC,wBAAwB,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,OAAO,EAAE,kBAAkB,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC,CAAA;AACxG,CAAC"}

package/data/build/dist/dsh-capabilities/host/quick-app-credentials.d.ts

@@ -0,0 +1,11 @@
+import type { IncomingMessage, ServerResponse } from 'node:http';
+/** Shared credential landing page; application files are never rewritten. */
+export declare function quickAppCredentials(origin: string, uiOrigin: string, cookieName: string): {
+    handle(request: IncomingMessage, response: ServerResponse): Promise<boolean>;
+    activate(credential: string, entryPath: string): Promise<{
+        url: string;
+    }>;
+    dispose(): void;
+};
+export declare function endQuickAppResponse(response: ServerResponse, status: number): void;
+//# sourceMappingURL=quick-app-credentials.d.ts.map

package/data/build/dist/dsh-capabilities/host/quick-app-credentials.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"quick-app-credentials.d.ts","sourceRoot":"","sources":["../../../../../src/dsh-capabilities/host/quick-app-credentials.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,WAAW,CAAA;AAShE,6EAA6E;AAC7E,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM;oBAK9D,eAAe,YAAY,cAAc,GAAG,OAAO,CAAC,OAAO,CAAC;yBAkCvD,MAAM,aAAa,MAAM,GAAG,OAAO,CAAC;QAAE,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC;;EAQlF;AAED,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,cAAc,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI,CAIlF"}

package/data/build/dist/dsh-capabilities/host/quick-app-credentials.js

@@ -0,0 +1,97 @@
+import { createHash, randomBytes, timingSafeEqual } from 'node:crypto';
+import { QUICK_APP_LIMITS } from '../../shared/contracts/quick-apps.js';
+import { quickAppBootstrapEn, quickAppBootstrapZh } from '../../shared/quick-apps-bootstrap-locale.js';
+const bootstrapPath = '/__quickapp/bootstrap';
+const exchangePath = '/__quickapp/exchange';
+const readyPath = '/__quickapp/ready';
+const hash = (value) => createHash('sha256').update(value).digest();
+/** Shared credential landing page; application files are never rewritten. */
+export function quickAppCredentials(origin, uiOrigin, cookieName) {
+    let active = true;
+    let activation;
+    let credentialDigest;
+    return {
+        async handle(request, response) {
+            const path = request.url;
+            if (path !== bootstrapPath && path !== exchangePath && path !== readyPath)
+                return false;
+            if (!active) {
+                endQuickAppResponse(response, 410);
+                return true;
+            }
+            if (path === bootstrapPath && request.method === 'GET') {
+                if (!activation || activation.expires <= Date.now()) {
+                    activation = undefined;
+                    endQuickAppResponse(response, 410);
+                    return true;
+                }
+                const nonce = randomBytes(18).toString('base64url');
+                const copy = /^zh(?:\b|-)/iu.test(request.headers['accept-language'] ?? '') ? quickAppBootstrapZh : quickAppBootstrapEn;
+                response.setHeader('Content-Type', 'text/html; charset=utf-8');
+                response.setHeader('Content-Security-Policy', `default-src 'none'; script-src 'nonce-${nonce}'; connect-src 'self'; frame-ancestors ${uiOrigin}; base-uri 'none'; form-action 'none'`);
+                response.end(`<!doctype html><meta name="viewport" content="width=device-width,initial-scale=1"><p id="status">${copy['quickApps.opening']}</p><script nonce="${nonce}">(async()=>{const ticket=location.hash.slice(1);history.replaceState(null,'',location.pathname);try{const r=await fetch('${exchangePath}',{method:'POST',headers:{'Content-Type':'text/plain'},body:ticket,credentials:'include'});if(!r.ok)throw 0;const next=await r.text();const ready=await fetch('${readyPath}',{credentials:'include'});if(!ready.ok)throw 0;location.replace(next)}catch{document.querySelector('#status').textContent=${JSON.stringify(copy['quickApps.bootstrapFailed'])}}})()</script>`);
+                return true;
+            }
+            if (path === exchangePath) {
+                if (request.method !== 'POST' || request.headers.origin !== origin || request.headers['content-type'] !== 'text/plain'
+                    || !activation || activation.expires <= Date.now()) {
+                    endQuickAppResponse(response, 403);
+                    return true;
+                }
+                const ticket = await readTicket(request);
+                if (!ticket || !active || !activation || !timingSafeEqual(activation.digest, hash(ticket))) {
+                    endQuickAppResponse(response, 403);
+                    return true;
+                }
+                const grant = activation;
+                activation = undefined;
+                credentialDigest = hash(grant.credential);
+                response.setHeader('Set-Cookie', `${cookieName}=${grant.credential}; Path=/; Secure; HttpOnly; SameSite=None; Partitioned; Max-Age=${QUICK_APP_LIMITS.lifetimeMs / 1000}`);
+                response.setHeader('Content-Type', 'text/plain; charset=utf-8');
+                response.end(grant.entryPath);
+                return true;
+            }
+            if (path === readyPath) {
+                const cookies = request.headers.cookie?.split(';').map(value => value.trim()).filter(value => value.startsWith(`${cookieName}=`)) ?? [];
+                const supplied = cookies.length === 1 ? cookies[0].slice(cookieName.length + 1) : '';
+                endQuickAppResponse(response, request.method === 'GET' && credentialDigest && timingSafeEqual(credentialDigest, hash(supplied)) ? 204 : 401);
+                return true;
+            }
+            endQuickAppResponse(response, 405);
+            return true;
+        },
+        async activate(credential, entryPath) {
+            if (!active || activation || credentialDigest || !/^\/(?!\/)/u.test(entryPath) || /[\r\n#?]/u.test(entryPath))
+                throw new Error('Invalid app activation.');
+            const ticket = randomBytes(32).toString('base64url');
+            activation = { digest: hash(ticket), credential, entryPath, expires: Date.now() + 60_000 };
+            return { url: `${origin}${bootstrapPath}#${ticket}` };
+        },
+        dispose() { active = false; activation = undefined; credentialDigest = undefined; },
+    };
+}
+export function endQuickAppResponse(response, status) {
+    if (response.headersSent) {
+        response.destroy();
+        return;
+    }
+    response.setHeader('Cache-Control', 'no-store');
+    response.writeHead(status);
+    response.end();
+}
+async function readTicket(request) {
+    if (Number(request.headers['content-length'] ?? 0) > 128) {
+        request.resume();
+        return undefined;
+    }
+    let body = '';
+    for await (const chunk of request.iterator({ destroyOnReturn: false })) {
+        body += String(chunk);
+        if (body.length > 128) {
+            request.resume();
+            return undefined;
+        }
+    }
+    return /^[A-Za-z0-9_-]{43}$/u.test(body) ? body : undefined;
+}
+//# sourceMappingURL=quick-app-credentials.js.map

package/data/build/dist/dsh-capabilities/host/quick-app-credentials.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"quick-app-credentials.js","sourceRoot":"","sources":["../../../../../src/dsh-capabilities/host/quick-app-credentials.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,aAAa,CAAA;AAEtE,OAAO,EAAE,gBAAgB,EAAE,MAAM,sCAAsC,CAAA;AACvE,OAAO,EAAE,mBAAmB,EAAE,mBAAmB,EAAE,MAAM,6CAA6C,CAAA;AAEtG,MAAM,aAAa,GAAG,uBAAuB,CAAA;AAC7C,MAAM,YAAY,GAAG,sBAAsB,CAAA;AAC3C,MAAM,SAAS,GAAG,mBAAmB,CAAA;AACrC,MAAM,IAAI,GAAG,CAAC,KAAa,EAAE,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,EAAE,CAAA;AAE3E,6EAA6E;AAC7E,MAAM,UAAU,mBAAmB,CAAC,MAAc,EAAE,QAAgB,EAAE,UAAkB;IACtF,IAAI,MAAM,GAAG,IAAI,CAAA;IACjB,IAAI,UAAkG,CAAA;IACtG,IAAI,gBAAoC,CAAA;IACxC,OAAO;QACL,KAAK,CAAC,MAAM,CAAC,OAAwB,EAAE,QAAwB;YAC7D,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAA;YACxB,IAAI,IAAI,KAAK,aAAa,IAAI,IAAI,KAAK,YAAY,IAAI,IAAI,KAAK,SAAS;gBAAE,OAAO,KAAK,CAAA;YACvF,IAAI,CAAC,MAAM,EAAE,CAAC;gBAAC,mBAAmB,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;gBAAC,OAAO,IAAI,CAAA;YAAC,CAAC;YAChE,IAAI,IAAI,KAAK,aAAa,IAAI,OAAO,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;gBACvD,IAAI,CAAC,UAAU,IAAI,UAAU,CAAC,OAAO,IAAI,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;oBAAC,UAAU,GAAG,SAAS,CAAC;oBAAC,mBAAmB,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;oBAAC,OAAO,IAAI,CAAA;gBAAC,CAAC;gBAChI,MAAM,KAAK,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAA;gBACnD,MAAM,IAAI,GAAG,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,iBAAiB,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,mBAAmB,CAAA;gBACvH,QAAQ,CAAC,SAAS,CAAC,cAAc,EAAE,0BAA0B,CAAC,CAAA;gBAC9D,QAAQ,CAAC,SAAS,CAAC,yBAAyB,EAAE,yCAAyC,KAAK,0CAA0C,QAAQ,uCAAuC,CAAC,CAAA;gBACtL,QAAQ,CAAC,GAAG,CAAC,oGAAoG,IAAI,CAAC,mBAAmB,CAAC,sBAAsB,KAAK,6HAA6H,YAAY,kKAAkK,SAAS,8HAA8H,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,2BAA2B,CAAC,CAAC,gBAAgB,CAAC,CAAA;gBACzpB,OAAO,IAAI,CAAA;YACb,CAAC;YACD,IAAI,IAAI,KAAK,YAAY,EAAE,CAAC;gBAC1B,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM,IAAI,OAAO,CAAC,OAAO,CAAC,MAAM,KAAK,MAAM,IAAI,OAAO,CAAC,OAAO,CAAC,cAAc,CAAC,KAAK,YAAY;uBACjH,CAAC,UAAU,IAAI,UAAU,CAAC,OAAO,IAAI,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;oBAAC,mBAAmB,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;oBAAC,OAAO,IAAI,CAAA;gBAAC,CAAC;gBACzG,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,OAAO,CAAC,CAAA;gBACxC,IAAI,CAAC,MAAM,IAAI,CAAC,MAAM,IAAI,CAAC,UAAU,IAAI,CAAC,eAAe,CAAC,UAAU,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;oBAAC,mBAAmB,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;oBAAC,OAAO,IAAI,CAAA;gBAAC,CAAC;gBAC/I,MAAM,KAAK,GAAG,UAAU,CAAC;gBAAC,UAAU,GAAG,SAAS,CAAA;gBAChD,gBAAgB,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,CAAA;gBACzC,QAAQ,CAAC,SAAS,CAAC,YAAY,EAAE,GAAG,UAAU,IAAI,KAAK,CAAC,UAAU,mEAAmE,gBAAgB,CAAC,UAAU,GAAG,IAAI,EAAE,CAAC,CAAA;gBAC1K,QAAQ,CAAC,SAAS,CAAC,cAAc,EAAE,2BAA2B,CAAC,CAAA;gBAC/D,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,CAAA;gBAC7B,OAAO,IAAI,CAAA;YACb,CAAC;YACD,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;gBACvB,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,UAAU,GAAG,CAAC,CAAC,IAAI,EAAE,CAAA;gBACvI,MAAM,QAAQ,GAAG,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAE,CAAC,KAAK,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;gBACrF,mBAAmB,CAAC,QAAQ,EAAE,OAAO,CAAC,MAAM,KAAK,KAAK,IAAI,gBAAgB,IAAI,eAAe,CAAC,gBAAgB,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAA;gBAC5I,OAAO,IAAI,CAAA;YACb,CAAC;YACD,mBAAmB,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAA;YAClC,OAAO,IAAI,CAAA;QACb,CAAC;QACD,KAAK,CAAC,QAAQ,CAAC,UAAkB,EAAE,SAAiB;YAClD,IAAI,CAAC,MAAM,IAAI,UAAU,IAAI,gBAAgB,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,WAAW,CAAC,IAAI,CAAC,SAAS,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAA;YACzJ,MAAM,MAAM,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAA;YACpD,UAAU,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,UAAU,EAAE,SAAS,EAAE,OAAO,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,EAAE,CAAA;YAC1F,OAAO,EAAE,GAAG,EAAE,GAAG,MAAM,GAAG,aAAa,IAAI,MAAM,EAAE,EAAE,CAAA;QACvD,CAAC;QACD,OAAO,KAAK,MAAM,GAAG,KAAK,CAAC,CAAC,UAAU,GAAG,SAAS,CAAC,CAAC,gBAAgB,GAAG,SAAS,CAAA,CAAC,CAAC;KACnF,CAAA;AACH,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,QAAwB,EAAE,MAAc;IAC1E,IAAI,QAAQ,CAAC,WAAW,EAAE,CAAC;QAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;QAAC,OAAM;IAAC,CAAC;IACxD,QAAQ,CAAC,SAAS,CAAC,eAAe,EAAE,UAAU,CAAC,CAAA;IAC/C,QAAQ,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IAAC,QAAQ,CAAC,GAAG,EAAE,CAAA;AAC5C,CAAC;AAED,KAAK,UAAU,UAAU,CAAC,OAAwB;IAChD,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,GAAG,GAAG,EAAE,CAAC;QAAC,OAAO,CAAC,MAAM,EAAE,CAAC;QAAC,OAAO,SAAS,CAAA;IAAC,CAAC;IAChG,IAAI,IAAI,GAAG,EAAE,CAAA;IACb,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,OAAO,CAAC,QAAQ,CAAC,EAAE,eAAe,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;QACvE,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,CAAA;QACrB,IAAI,IAAI,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;YAAC,OAAO,CAAC,MAAM,EAAE,CAAC;YAAC,OAAO,SAAS,CAAA;QAAC,CAAC;IAC/D,CAAC;IACD,OAAO,sBAAsB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAA;AAC7D,CAAC"}

package/data/build/dist/dsh-capabilities/host/quick-app-https-provider.d.ts

@@ -0,0 +1,36 @@
+import type { IncomingMessage, ServerResponse } from 'node:http';
+import type { QuickAppOriginLease, QuickAppOriginProvider } from './quick-app-origin-adapter.js';
+/** Operator-owned configuration, never settings mirrored to browsers or an RPC argument. */
+export interface QuickAppHttpsConfig {
+    readonly appDomain: string;
+    readonly uiOrigins: readonly string[];
+    readonly listenHost: string;
+    readonly listenPort: number;
+    readonly publicPort: number;
+    readonly certFile: string;
+    readonly keyFile: string;
+}
+export declare function parseQuickAppHttpsConfig(value: unknown): QuickAppHttpsConfig;
+/** No listener is started until an authenticated user opens an HTML app. */
+export declare function configuredQuickAppHttpsProvider(configPath?: string | undefined): Promise<QuickAppHttpsProvider | undefined>;
+export declare function boundedFile(path: string, limit: number): Promise<string>;
+/** Dedicated TLS virtual-host listener. It never serves or proxies privileged DSH routes. */
+export declare class QuickAppHttpsProvider implements QuickAppOriginProvider {
+    private readonly config;
+    private readonly tls;
+    private readonly routes;
+    private server;
+    private pending;
+    private stopped;
+    constructor(config: QuickAppHttpsConfig, tls: {
+        cert: string;
+        key: string;
+    });
+    available(uiOrigin?: string): boolean;
+    open(handler: (request: IncomingMessage, response: ServerResponse) => void, uiOrigin?: string): Promise<QuickAppOriginLease>;
+    dispose(): Promise<void>;
+    private listen;
+    private closeListener;
+    private serialize;
+}
+//# sourceMappingURL=quick-app-https-provider.d.ts.map

package/data/build/dist/dsh-capabilities/host/quick-app-https-provider.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"quick-app-https-provider.d.ts","sourceRoot":"","sources":["../../../../../src/dsh-capabilities/host/quick-app-https-provider.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,WAAW,CAAA;AAEhE,OAAO,KAAK,EAAE,mBAAmB,EAAE,sBAAsB,EAAE,MAAM,+BAA+B,CAAA;AAIhG,4FAA4F;AAC5F,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,SAAS,EAAE,SAAS,MAAM,EAAE,CAAA;IACrC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;CACzB;AAKD,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,OAAO,GAAG,mBAAmB,CAqB5E;AAED,4EAA4E;AAC5E,wBAAsB,+BAA+B,CAAC,UAAU,qBAA+C,GAAG,OAAO,CAAC,qBAAqB,GAAG,SAAS,CAAC,CAQ3J;AAED,wBAAsB,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAU9E;AAID,6FAA6F;AAC7F,qBAAa,qBAAsB,YAAW,sBAAsB;IAKtD,OAAO,CAAC,QAAQ,CAAC,MAAM;IAAuB,OAAO,CAAC,QAAQ,CAAC,GAAG;IAJ9E,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA2B;IAClD,OAAO,CAAC,MAAM,CAAoB;IAClC,OAAO,CAAC,OAAO,CAAmC;IAClD,OAAO,CAAC,OAAO,CAAQ;gBACM,MAAM,EAAE,mBAAmB,EAAmB,GAAG,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE;IAS7G,SAAS,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO;IACrC,IAAI,CAAC,OAAO,EAAE,CAAC,OAAO,EAAE,eAAe,EAAE,QAAQ,EAAE,cAAc,KAAK,IAAI,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,CAAC;IAwB5H,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;YAIV,MAAM;YAsBN,aAAa;IAM3B,OAAO,CAAC,SAAS;CAKlB"}

package/data/build/dist/dsh-capabilities/host/quick-app-https-provider.js

@@ -0,0 +1,164 @@
+import { randomBytes, X509Certificate } from 'node:crypto';
+import { isAbsolute } from 'node:path';
+import { isIP } from 'node:net';
+import { createServer } from 'node:https';
+import { QUICK_APP_LIMITS } from '../../shared/contracts/quick-apps.js';
+import { endQuickAppResponse as end, quickAppCredentials } from './quick-app-credentials.js';
+const cookieName = '__Host-quickapp';
+const unavailable = () => Object.assign(new Error('Quick Apps HTTPS configuration is unavailable or invalid.'), { code: 'QUICK_APP_ORIGIN_UNAVAILABLE' });
+export function parseQuickAppHttpsConfig(value) {
+    if (!value || typeof value !== 'object' || Array.isArray(value))
+        throw unavailable();
+    const config = value;
+    const keys = ['appDomain', 'uiOrigins', 'listenHost', 'listenPort', 'publicPort', 'certFile', 'keyFile'];
+    if (Object.keys(config).some(key => !keys.includes(key)) || typeof config.appDomain !== 'string'
+        || config.appDomain.length > 190 || !/^(?:[a-z0-9](?:[a-z0-9-]*[a-z0-9])?\.)+[a-z]{2,}$/u.test(config.appDomain)
+        || config.appDomain.split('.').some(label => label.length > 63)
+        || config.appDomain === 'localhost' || config.appDomain.endsWith('.localhost') || isIP(config.appDomain)
+        || !isIP(config.listenHost) || ![config.listenPort, config.publicPort].every(port => Number.isInteger(port) && port > 0 && port < 65536)
+        || ![config.certFile, config.keyFile].every(path => typeof path === 'string' && isAbsolute(path))
+        || !Array.isArray(config.uiOrigins) || config.uiOrigins.length < 1 || config.uiOrigins.length > 16)
+        throw unavailable();
+    for (const origin of config.uiOrigins) {
+        let ui;
+        try {
+            ui = new URL(origin);
+        }
+        catch {
+            throw unavailable();
+        }
+        if (ui.origin !== origin || !['http:', 'https:'].includes(ui.protocol) || ui.username || ui.password
+            || ui.hostname === config.appDomain || ui.hostname.endsWith(`.${config.appDomain}`)
+            // Conservatively reject even sibling sites under a multi-label public suffix.
+            // Different final two DNS labels ensure UI Domain cookies cannot reach app pages.
+            || ui.hostname.split('.').slice(-2).join('.') === config.appDomain.split('.').slice(-2).join('.'))
+            throw unavailable();
+    }
+    return structuredClone(config);
+}
+/** No listener is started until an authenticated user opens an HTML app. */
+export async function configuredQuickAppHttpsProvider(configPath = process.env.CODINGNS_QUICK_APPS_HTTPS_CONFIG) {
+    if (!configPath)
+        return undefined;
+    try {
+        if (!isAbsolute(configPath))
+            throw unavailable();
+        const config = parseQuickAppHttpsConfig(JSON.parse(await boundedFile(configPath, 32 * 1024)));
+        const [cert, key] = await Promise.all([boundedFile(config.certFile, 128 * 1024), boundedFile(config.keyFile, 64 * 1024)]);
+        return new QuickAppHttpsProvider(config, { cert, key });
+    }
+    catch {
+        throw unavailable();
+    }
+}
+export async function boundedFile(path, limit) {
+    const { open } = await import('node:fs/promises');
+    const file = await open(path, 'r');
+    try {
+        if (!(await file.stat()).isFile())
+            throw unavailable();
+        const bytes = Buffer.alloc(limit + 1);
+        const { bytesRead } = await file.read(bytes, 0, bytes.length, 0);
+        if (bytesRead > limit)
+            throw unavailable();
+        return bytes.subarray(0, bytesRead).toString('utf8');
+    }
+    finally {
+        await file.close();
+    }
+}
+/** Dedicated TLS virtual-host listener. It never serves or proxies privileged DSH routes. */
+export class QuickAppHttpsProvider {
+    config;
+    tls;
+    routes = new Map();
+    server;
+    pending = Promise.resolve();
+    stopped = false;
+    constructor(config, tls) {
+        this.config = config;
+        this.tls = tls;
+        parseQuickAppHttpsConfig(config);
+        const certificate = new X509Certificate(tls.cert);
+        if (!certificate.checkHost(`probe.${config.appDomain}`) || Date.parse(certificate.validTo) <= Date.now()
+            || Date.parse(certificate.validFrom) > Date.now())
+            throw unavailable();
+        // Validate the key pair before reporting the configured transport as available.
+        const probe = createServer({ ...tls, minVersion: 'TLSv1.2' });
+        probe.close();
+    }
+    available(uiOrigin) { return !this.stopped && typeof uiOrigin === 'string' && this.config.uiOrigins.includes(uiOrigin); }
+    open(handler, uiOrigin) {
+        return this.serialize(async () => {
+            if (!this.available(uiOrigin) || this.routes.size >= QUICK_APP_LIMITS.launches)
+                throw unavailable();
+            await this.listen();
+            // Random names are never reused, including across Host/module restarts.
+            const hostname = `${randomBytes(24).toString('hex')}.${this.config.appDomain}`;
+            const origin = `https://${hostname}${this.config.publicPort === 443 ? '' : `:${this.config.publicPort}`}`;
+            const host = new URL(origin).host;
+            const credentials = quickAppCredentials(origin, uiOrigin, cookieName);
+            const route = { host, handle: async (request, response) => {
+                    if (!await credentials.handle(request, response))
+                        handler(request, response);
+                } };
+            this.routes.set(hostname, route);
+            return {
+                origin, uiOrigin: uiOrigin, ownerHostId: 'local', remote: true, cookieName,
+                activate: credentials.activate,
+                dispose: () => this.serialize(async () => {
+                    credentials.dispose();
+                    this.routes.delete(hostname);
+                    if (this.routes.size === 0)
+                        await this.closeListener();
+                }),
+            };
+        });
+    }
+    dispose() {
+        this.stopped = true;
+        return this.serialize(async () => { this.routes.clear(); await this.closeListener(); });
+    }
+    async listen() {
+        if (this.server)
+            return;
+        const server = createServer({ ...this.tls, minVersion: 'TLSv1.2', handshakeTimeout: 10_000, maxHeaderSize: 16 * 1024 }, (request, response) => {
+            response.setHeader('Cache-Control', 'no-store');
+            response.setHeader('Referrer-Policy', 'no-referrer');
+            response.setHeader('X-Content-Type-Options', 'nosniff');
+            const sni = request.socket.servername;
+            const route = typeof sni === 'string' ? this.routes.get(sni) : undefined;
+            // Never trust forwarded Host/Origin headers; TLS terminates at this listener.
+            if (!route || request.headers.host !== route.host || request.rawHeaders.filter((_, i) => i % 2 === 0 && request.rawHeaders[i].toLowerCase() === 'host').length !== 1)
+                return end(response, 421);
+            void route.handle(request, response).catch(() => end(response, 400));
+        });
+        server.requestTimeout = 15_000;
+        server.headersTimeout = 10_000;
+        server.timeout = 30_000;
+        server.keepAliveTimeout = 5_000;
+        server.maxRequestsPerSocket = 100;
+        server.maxConnections = 256;
+        await new Promise((resolve, reject) => {
+            server.once('error', reject);
+            server.listen(this.config.listenPort, this.config.listenHost, () => { server.removeListener('error', reject); resolve(); });
+        }).catch(() => { server.close(); throw unavailable(); });
+        // Listener failures must not take down unrelated Host modules.
+        server.on('error', () => { void this.dispose(); });
+        this.server = server;
+    }
+    async closeListener() {
+        const server = this.server;
+        this.server = undefined;
+        if (!server)
+            return;
+        server.closeAllConnections();
+        await new Promise(resolve => server.close(() => resolve()));
+    }
+    serialize(operation) {
+        const result = this.pending.catch(() => undefined).then(operation);
+        this.pending = result.then(() => undefined, () => undefined);
+        return result;
+    }
+}
+//# sourceMappingURL=quick-app-https-provider.js.map

package/data/build/dist/dsh-capabilities/host/quick-app-https-provider.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"quick-app-https-provider.js","sourceRoot":"","sources":["../../../../../src/dsh-capabilities/host/quick-app-https-provider.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,aAAa,CAAA;AAC1D,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAA;AACtC,OAAO,EAAE,IAAI,EAAE,MAAM,UAAU,CAAA;AAC/B,OAAO,EAAE,YAAY,EAAe,MAAM,YAAY,CAAA;AAItD,OAAO,EAAE,gBAAgB,EAAE,MAAM,sCAAsC,CAAA;AACvE,OAAO,EAAE,mBAAmB,IAAI,GAAG,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAA;AAa5F,MAAM,UAAU,GAAG,iBAAiB,CAAA;AACpC,MAAM,WAAW,GAAG,GAAG,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,2DAA2D,CAAC,EAAE,EAAE,IAAI,EAAE,8BAA8B,EAAE,CAAC,CAAA;AAEzJ,MAAM,UAAU,wBAAwB,CAAC,KAAc;IACrD,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,MAAM,WAAW,EAAE,CAAA;IACpF,MAAM,MAAM,GAAG,KAA4B,CAAA;IAC3C,MAAM,IAAI,GAAG,CAAC,WAAW,EAAE,WAAW,EAAE,YAAY,EAAE,YAAY,EAAE,YAAY,EAAE,UAAU,EAAE,SAAS,CAAC,CAAA;IACxG,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,IAAI,OAAO,MAAM,CAAC,SAAS,KAAK,QAAQ;WAC3F,MAAM,CAAC,SAAS,CAAC,MAAM,GAAG,GAAG,IAAI,CAAC,oDAAoD,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC;WAC7G,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,MAAM,GAAG,EAAE,CAAC;WAC5D,MAAM,CAAC,SAAS,KAAK,WAAW,IAAI,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,YAAY,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC;WACrG,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,UAAU,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI,IAAI,GAAG,KAAK,CAAC;WACrI,CAAC,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,IAAI,UAAU,CAAC,IAAI,CAAC,CAAC;WAC9F,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,MAAM,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,IAAI,MAAM,CAAC,SAAS,CAAC,MAAM,GAAG,EAAE;QAAE,MAAM,WAAW,EAAE,CAAA;IACzH,KAAK,MAAM,MAAM,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;QACtC,IAAI,EAAO,CAAA;QACX,IAAI,CAAC;YAAC,EAAE,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAA;QAAC,CAAC;QAAC,MAAM,CAAC;YAAC,MAAM,WAAW,EAAE,CAAA;QAAC,CAAC;QAC1D,IAAI,EAAE,CAAC,MAAM,KAAK,MAAM,IAAI,CAAC,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,QAAQ,IAAI,EAAE,CAAC,QAAQ;eAC/F,EAAE,CAAC,QAAQ,KAAK,MAAM,CAAC,SAAS,IAAI,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;YACnF,8EAA8E;YAC9E,kFAAkF;eAC/E,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;YAAE,MAAM,WAAW,EAAE,CAAA;IAC1H,CAAC;IACD,OAAO,eAAe,CAAC,MAAM,CAAC,CAAA;AAChC,CAAC;AAED,4EAA4E;AAC5E,MAAM,CAAC,KAAK,UAAU,+BAA+B,CAAC,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,gCAAgC;IAC7G,IAAI,CAAC,UAAU;QAAE,OAAO,SAAS,CAAA;IACjC,IAAI,CAAC;QACH,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC;YAAE,MAAM,WAAW,EAAE,CAAA;QAChD,MAAM,MAAM,GAAG,wBAAwB,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,WAAW,CAAC,UAAU,EAAE,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,CAAA;QAC7F,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,WAAW,CAAC,MAAM,CAAC,QAAQ,EAAE,GAAG,GAAG,IAAI,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,OAAO,EAAE,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,CAAA;QACzH,OAAO,IAAI,qBAAqB,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,CAAA;IACzD,CAAC;IAAC,MAAM,CAAC;QAAC,MAAM,WAAW,EAAE,CAAA;IAAC,CAAC;AACjC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,IAAY,EAAE,KAAa;IAC3D,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,kBAAkB,CAAC,CAAA;IACjD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAA;IAClC,IAAI,CAAC;QACH,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;YAAE,MAAM,WAAW,EAAE,CAAA;QACtD,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAA;QACrC,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAA;QAChE,IAAI,SAAS,GAAG,KAAK;YAAE,MAAM,WAAW,EAAE,CAAA;QAC1C,OAAO,KAAK,CAAC,QAAQ,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAA;IACtD,CAAC;YAAS,CAAC;QAAC,MAAM,IAAI,CAAC,KAAK,EAAE,CAAA;IAAC,CAAC;AAClC,CAAC;AAID,6FAA6F;AAC7F,MAAM,OAAO,qBAAqB;IAKH;IAA8C;IAJ1D,MAAM,GAAG,IAAI,GAAG,EAAiB,CAAA;IAC1C,MAAM,CAAoB;IAC1B,OAAO,GAAkB,OAAO,CAAC,OAAO,EAAE,CAAA;IAC1C,OAAO,GAAG,KAAK,CAAA;IACvB,YAA6B,MAA2B,EAAmB,GAAkC;QAAhF,WAAM,GAAN,MAAM,CAAqB;QAAmB,QAAG,GAAH,GAAG,CAA+B;QAC3G,wBAAwB,CAAC,MAAM,CAAC,CAAA;QAChC,MAAM,WAAW,GAAG,IAAI,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;QACjD,IAAI,CAAC,WAAW,CAAC,SAAS,CAAC,SAAS,MAAM,CAAC,SAAS,EAAE,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,GAAG,EAAE;eACnG,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,SAAS,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE;YAAE,MAAM,WAAW,EAAE,CAAA;QACxE,gFAAgF;QAChF,MAAM,KAAK,GAAG,YAAY,CAAC,EAAE,GAAG,GAAG,EAAE,UAAU,EAAE,SAAS,EAAE,CAAC,CAAA;QAC7D,KAAK,CAAC,KAAK,EAAE,CAAA;IACf,CAAC;IACD,SAAS,CAAC,QAAiB,IAAa,OAAO,CAAC,IAAI,CAAC,OAAO,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAA,CAAC,CAAC;IAC1I,IAAI,CAAC,OAAqE,EAAE,QAAiB;QAC3F,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,IAAI,EAAE;YAC/B,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,IAAI,gBAAgB,CAAC,QAAQ;gBAAE,MAAM,WAAW,EAAE,CAAA;YACnG,MAAM,IAAI,CAAC,MAAM,EAAE,CAAA;YACnB,wEAAwE;YACxE,MAAM,QAAQ,GAAG,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,CAAA;YAC9E,MAAM,MAAM,GAAG,WAAW,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,UAAU,KAAK,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,EAAE,CAAA;YACzG,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAA;YACjC,MAAM,WAAW,GAAG,mBAAmB,CAAC,MAAM,EAAE,QAAS,EAAE,UAAU,CAAC,CAAA;YACtE,MAAM,KAAK,GAAU,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,EAAE;oBAC/D,IAAI,CAAC,MAAM,WAAW,CAAC,MAAM,CAAC,OAAO,EAAE,QAAQ,CAAC;wBAAE,OAAO,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAA;gBAC9E,CAAC,EAAE,CAAA;YACH,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAA;YAChC,OAAO;gBACL,MAAM,EAAE,QAAQ,EAAE,QAAS,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU;gBAC3E,QAAQ,EAAE,WAAW,CAAC,QAAQ;gBAC9B,OAAO,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,IAAI,EAAE;oBACvC,WAAW,CAAC,OAAO,EAAE,CAAA;oBACrB,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAA;oBAC5B,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC;wBAAE,MAAM,IAAI,CAAC,aAAa,EAAE,CAAA;gBACxD,CAAC,CAAC;aACH,CAAA;QACH,CAAC,CAAC,CAAA;IACJ,CAAC;IACD,OAAO;QACL,IAAI,CAAC,OAAO,GAAG,IAAI,CAAA;QACnB,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,IAAI,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,MAAM,IAAI,CAAC,aAAa,EAAE,CAAA,CAAC,CAAC,CAAC,CAAA;IACxF,CAAC;IACO,KAAK,CAAC,MAAM;QAClB,IAAI,IAAI,CAAC,MAAM;YAAE,OAAM;QACvB,MAAM,MAAM,GAAG,YAAY,CAAC,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,UAAU,EAAE,SAAS,EAAE,gBAAgB,EAAE,MAAM,EAAE,aAAa,EAAE,EAAE,GAAG,IAAI,EAAE,EAAE,CAAC,OAAO,EAAE,QAAQ,EAAE,EAAE;YAC5I,QAAQ,CAAC,SAAS,CAAC,eAAe,EAAE,UAAU,CAAC,CAAA;YAC/C,QAAQ,CAAC,SAAS,CAAC,iBAAiB,EAAE,aAAa,CAAC,CAAA;YACpD,QAAQ,CAAC,SAAS,CAAC,wBAAwB,EAAE,SAAS,CAAC,CAAA;YACvD,MAAM,GAAG,GAAI,OAAO,CAAC,MAAoB,CAAC,UAAU,CAAA;YACpD,MAAM,KAAK,GAAG,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;YACxE,8EAA8E;YAC9E,IAAI,CAAC,KAAK,IAAI,OAAO,CAAC,OAAO,CAAC,IAAI,KAAK,KAAK,CAAC,IAAI,IAAI,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,OAAO,CAAC,UAAU,CAAC,CAAC,CAAE,CAAC,WAAW,EAAE,KAAK,MAAM,CAAC,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO,GAAG,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAA;YAChM,KAAK,KAAK,CAAC,MAAM,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,CAAA;QACtE,CAAC,CAAC,CAAA;QACF,MAAM,CAAC,cAAc,GAAG,MAAM,CAAC;QAAC,MAAM,CAAC,cAAc,GAAG,MAAM,CAAC;QAAC,MAAM,CAAC,OAAO,GAAG,MAAM,CAAA;QACvF,MAAM,CAAC,gBAAgB,GAAG,KAAK,CAAC;QAAC,MAAM,CAAC,oBAAoB,GAAG,GAAG,CAAC;QAAC,MAAM,CAAC,cAAc,GAAG,GAAG,CAAA;QAC/F,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YAC1C,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;YAC5B,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,GAAG,EAAE,GAAG,MAAM,CAAC,cAAc,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,OAAO,EAAE,CAAA,CAAC,CAAC,CAAC,CAAA;QAC5H,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,MAAM,WAAW,EAAE,CAAA,CAAC,CAAC,CAAC,CAAA;QACvD,+DAA+D;QAC/D,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,GAAG,KAAK,IAAI,CAAC,OAAO,EAAE,CAAA,CAAC,CAAC,CAAC,CAAA;QACjD,IAAI,CAAC,MAAM,GAAG,MAAM,CAAA;IACtB,CAAC;IACO,KAAK,CAAC,aAAa;QACzB,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;QAAC,IAAI,CAAC,MAAM,GAAG,SAAS,CAAA;QACnD,IAAI,CAAC,MAAM;YAAE,OAAM;QACnB,MAAM,CAAC,mBAAmB,EAAE,CAAA;QAC5B,MAAM,IAAI,OAAO,CAAO,OAAO,CAAC,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC,CAAA;IACnE,CAAC;IACO,SAAS,CAAI,SAA2B;QAC9C,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;QAClE,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,SAAS,CAAC,CAAA;QAC5D,OAAO,MAAM,CAAA;IACf,CAAC;CACF"}

package/data/build/dist/dsh-capabilities/host/quick-app-lan-ports.d.ts

@@ -0,0 +1,44 @@
+import type { IncomingMessage, ServerResponse } from 'node:http';
+import { type QuickAppRuntimeReason } from '../../shared/contracts/quick-apps.js';
+import type { QuickAppLanTransport, QuickAppOriginLease, QuickAppOriginProvider } from './quick-app-origin-adapter.js';
+export interface QuickAppLanPortsConfig {
+    readonly transport: 'lan-ports';
+    readonly publicHost: string;
+    readonly uiOrigins: readonly string[];
+    readonly ports: readonly [number, number];
+    readonly stateDirectory: string;
+    readonly certFile: string;
+    readonly keyFile: string;
+}
+export declare function parseQuickAppLanPortsConfig(value: unknown): QuickAppLanPortsConfig;
+/** Browsers cannot forge these headers; they are an origin fence, never authentication. */
+export declare function sameBrowserOrigin(headers: Record<string, string | string[] | undefined>, origin: string): boolean;
+/** Dedicated app HTTPS ports on the existing LAN bind address; no DSH forwarding. */
+export declare class QuickAppLanPortsProvider implements QuickAppOriginProvider, QuickAppLanTransport {
+    private readonly tls;
+    readonly isolation: "lan-port";
+    private listenHost;
+    private stopped;
+    private pending;
+    private readonly active;
+    private readonly reserved;
+    private allocationFailure;
+    private generation;
+    private readonly config;
+    constructor(config: QuickAppLanPortsConfig, tls: {
+        cert: string;
+        key: string;
+    });
+    /** Read persistent reservations before availability is advertised. Never delete this history. */
+    initialize(): Promise<void>;
+    started(listenHost: string): void;
+    stopping(): Promise<void>;
+    dispose(): Promise<void>;
+    available(uiOrigin?: string): boolean;
+    protects(uiOrigin?: string): boolean;
+    diagnostic(uiOrigin?: string): QuickAppRuntimeReason | undefined;
+    permits(headers: Record<string, string>, method: string, path: string): boolean;
+    open(handler: (request: IncomingMessage, response: ServerResponse) => void, uiOrigin?: string): Promise<QuickAppOriginLease>;
+    private allocate;
+}
+//# sourceMappingURL=quick-app-lan-ports.d.ts.map

package/data/build/dist/dsh-capabilities/host/quick-app-lan-ports.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"quick-app-lan-ports.d.ts","sourceRoot":"","sources":["../../../../../src/dsh-capabilities/host/quick-app-lan-ports.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,WAAW,CAAA;AAEhE,OAAO,EAAgD,KAAK,qBAAqB,EAAE,MAAM,sCAAsC,CAAA;AAC/H,OAAO,KAAK,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,sBAAsB,EAAE,MAAM,+BAA+B,CAAA;AAGtH,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,SAAS,EAAE,WAAW,CAAA;IAC/B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,SAAS,EAAE,SAAS,MAAM,EAAE,CAAA;IACrC,QAAQ,CAAC,KAAK,EAAE,SAAS,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IACzC,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAA;IAC/B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;CACzB;AAED,wBAAgB,2BAA2B,CAAC,KAAK,EAAE,OAAO,GAAG,sBAAsB,CAiBlF;AAUD,2FAA2F;AAC3F,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,CAAC,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAOjH;AAMD,qFAAqF;AACrF,qBAAa,wBAAyB,YAAW,sBAAsB,EAAE,oBAAoB;IAW/C,OAAO,CAAC,QAAQ,CAAC,GAAG;IAVhE,QAAQ,CAAC,SAAS,EAAG,UAAU,CAAS;IACxC,OAAO,CAAC,UAAU,CAAoB;IACtC,OAAO,CAAC,OAAO,CAAQ;IACvB,OAAO,CAAC,OAAO,CAAmC;IAClD,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAiC;IACxD,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAoB;IAC7C,OAAO,CAAC,iBAAiB,CAAmC;IAC5D,OAAO,CAAC,UAAU,CAAI;IACtB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAwB;gBAEnC,MAAM,EAAE,sBAAsB,EAAmB,GAAG,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE;IAS/F,iGAAiG;IAC3F,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;IAOjC,OAAO,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI;IAC3B,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC;IAKzB,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;IAC9B,SAAS,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO;IACrC,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO;IACpC,UAAU,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,qBAAqB,GAAG,SAAS;IAQhE,OAAO,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO;IAe/E,IAAI,CAAC,OAAO,EAAE,CAAC,OAAO,EAAE,eAAe,EAAE,QAAQ,EAAE,cAAc,KAAK,IAAI,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,CAAC;YAM9G,QAAQ;CA2DvB"}