@jingyi0605/codingns4dsh 0.2.1-beta.9 → 0.2.1-rc.2

package/data/build/dist/host/modules/quick-apps/egress.js

@@ -0,0 +1,244 @@
+import { lookup } from 'node:dns/promises';
+import { request as httpRequest } from 'node:http';
+import { request as httpsRequest } from 'node:https';
+import { isIP } from 'node:net';
+import { QUICK_APP_LIMITS } from '../../../shared/contracts/quick-apps.js';
+import { quickAppAddressBlocked, quickAppAllowMatches, quickAppAllowMatchesName, quickAppFakeIpAddress } from '../../../shared/quick-app-network-allow.js';
+import { QuickAppError } from './errors.js';
+/** Host egress skips the browser's CORS and private-network checks, so non-public targets need an app allow entry. */
+const METHODS = new Set(['GET', 'HEAD', 'POST', 'PUT', 'PATCH', 'DELETE', 'OPTIONS']);
+const REQUEST_HEADERS = new Set(['authorization', 'content-type', 'accept', 'accept-language']);
+const RAW_LIMIT = 96 * 1024 * 1024;
+const BODY_LIMIT = 64 * 1024 * 1024;
+const EGRESS_TIMEOUT = 180_000;
+export function quickAppEgressAddressBlocked(address) {
+    const normalized = normalizeAddress(address);
+    return normalized === null || quickAppAddressBlocked(normalized.address, normalized.family);
+}
+export async function proxyQuickAppEgress(raw, signal, deps = {}) {
+    const request = parseEgressRequest(raw);
+    const resolve = deps.lookup ?? defaultLookup;
+    const deliver = deps.deliver ?? deliverQuickAppEgress;
+    const allow = deps.allow ?? [];
+    let method = request.method;
+    let body = request.body;
+    let headers = request.headers;
+    let current = request.url;
+    for (let hop = 0; hop <= 5; hop++) {
+        const pinned = await resolvePublic(current, resolve, allow);
+        const response = await deliver(hopRequest(current, method, headers, body, pinned), signal);
+        if (response.status < 300 || response.status >= 400 || request.redirect === 'manual')
+            return { status: response.status, contentType: response.contentType, body: response.body };
+        if (request.redirect === 'error')
+            throw failed(502, 'The network request was redirected.');
+        if (hop === 5 || !response.location)
+            throw failed(502, 'The network request was redirected too many times.');
+        const next = new URL(response.location, current);
+        if (next.host !== current.host)
+            headers = headers.filter(([name]) => name !== 'authorization');
+        if (response.status === 303 || ((response.status === 301 || response.status === 302) && method !== 'GET' && method !== 'HEAD')) {
+            method = 'GET';
+            body = Buffer.alloc(0);
+            headers = headers.filter(([name]) => name !== 'content-type');
+        }
+        current = next;
+    }
+    throw failed(502, 'The network request was redirected too many times.');
+}
+export async function deliverQuickAppEgress(hop, signal) {
+    const library = hop.protocol === 'https:' ? httpsRequest : httpRequest;
+    return new Promise((resolve, reject) => {
+        const fail = (error) => reject(error instanceof QuickAppError ? error : failed(signal.aborted ? 504 : 502, signal.aborted ? 'The network request timed out.' : 'The network request could not be completed.'));
+        const req = library({ host: hop.address, servername: hop.protocol === 'https:' ? hop.hostname : undefined, port: hop.port, method: hop.method, path: hop.path, headers: hop.headers, timeout: EGRESS_TIMEOUT, signal, family: hop.family, agent: false }, res => {
+            const chunks = [];
+            let size = 0;
+            let failedLimit = false;
+            res.on('data', chunk => {
+                size += chunk.length;
+                if (size > QUICK_APP_LIMITS.staticBytes) {
+                    failedLimit = true;
+                    res.destroy();
+                    reject(new QuickAppError(413, 'QUICK_APP_TOO_LARGE', 'The network response limit is 64 MiB.'));
+                }
+                else
+                    chunks.push(chunk);
+            });
+            res.on('error', fail);
+            res.on('end', () => {
+                if (failedLimit)
+                    return;
+                resolve({ status: statusOf(res), contentType: contentTypeOf(res.headers['content-type']), body: Buffer.concat(chunks), ...(typeof res.headers.location === 'string' ? { location: res.headers.location } : {}) });
+            });
+        });
+        req.setHeader('Host', hop.hostHeader);
+        req.on('error', fail);
+        req.on('timeout', () => req.destroy(failed(504, 'The network request timed out.')));
+        req.end(hop.body.byteLength ? hop.body : undefined);
+    });
+}
+export async function readEgressBody(req, signal) {
+    if (!/^text\/plain(?:;\s*charset=utf-8)?$/iu.test(req.headers['content-type'] ?? ''))
+        throw new QuickAppError(415, 'QUICK_APP_CONTENT_TYPE', 'Send UTF-8 text/plain content.');
+    if (Number(req.headers['content-length']) > RAW_LIMIT)
+        throw new QuickAppError(413, 'QUICK_APP_TOO_LARGE', 'The network request limit is 64 MiB.');
+    const chunks = [];
+    let length = 0;
+    const cancel = () => req.destroy();
+    signal.addEventListener('abort', cancel, { once: true });
+    try {
+        signal.throwIfAborted();
+        for await (const chunk of req.iterator({ destroyOnReturn: false })) {
+            signal.throwIfAborted();
+            length += chunk.length;
+            if (length > RAW_LIMIT)
+                throw new QuickAppError(413, 'QUICK_APP_TOO_LARGE', 'The network request limit is 64 MiB.');
+            chunks.push(Buffer.from(chunk));
+        }
+        try {
+            return new TextDecoder('utf-8', { fatal: true }).decode(Buffer.concat(chunks));
+        }
+        catch {
+            throw new QuickAppError(400, 'QUICK_APP_ENCODING', 'Send valid UTF-8 text.');
+        }
+    }
+    finally {
+        signal.removeEventListener('abort', cancel);
+    }
+}
+function parseEgressRequest(raw) {
+    if (Buffer.byteLength(raw) > RAW_LIMIT)
+        throw new QuickAppError(413, 'QUICK_APP_TOO_LARGE', 'The network request limit is 64 MiB.');
+    let value;
+    try {
+        value = JSON.parse(raw);
+    }
+    catch {
+        throw new QuickAppError(400, 'QUICK_APP_EGRESS_REQUEST', 'The network request is invalid.');
+    }
+    if (!value || typeof value !== 'object' || Array.isArray(value))
+        throw new QuickAppError(400, 'QUICK_APP_EGRESS_REQUEST', 'The network request is invalid.');
+    const record = value;
+    const method = typeof record.method === 'string' ? record.method.toUpperCase() : 'GET';
+    if (!METHODS.has(method))
+        throw new QuickAppError(400, 'QUICK_APP_EGRESS_REQUEST', 'The network request method is not supported.');
+    if (typeof record.url !== 'string' || record.url.length > 8192)
+        throw new QuickAppError(400, 'QUICK_APP_EGRESS_REQUEST', 'The network request URL is invalid.');
+    let url;
+    try {
+        url = new URL(record.url);
+    }
+    catch {
+        throw new QuickAppError(400, 'QUICK_APP_EGRESS_REQUEST', 'The network request URL is invalid.');
+    }
+    if ((url.protocol !== 'http:' && url.protocol !== 'https:') || url.username || url.password || !url.hostname)
+        throw new QuickAppError(400, 'QUICK_APP_EGRESS_REQUEST', 'The network request URL is invalid.');
+    const headers = normalizeHeaders(record.headers);
+    const body = decodeBody(record.body);
+    const redirect = record.redirect === undefined ? undefined : record.redirect === 'follow' || record.redirect === 'manual' || record.redirect === 'error' ? record.redirect : undefined;
+    if (record.redirect !== undefined && redirect === undefined)
+        throw new QuickAppError(400, 'QUICK_APP_EGRESS_REQUEST', 'The network request is invalid.');
+    return { method, url, headers, body, ...(redirect ? { redirect } : {}) };
+}
+function normalizeHeaders(value) {
+    if (value === undefined)
+        return [];
+    if (!Array.isArray(value) || value.length > 32)
+        throw new QuickAppError(400, 'QUICK_APP_EGRESS_REQUEST', 'The network request is invalid.');
+    return value.map(item => {
+        if (!Array.isArray(item) || item.length !== 2 || typeof item[0] !== 'string' || typeof item[1] !== 'string')
+            throw new QuickAppError(400, 'QUICK_APP_EGRESS_REQUEST', 'The network request is invalid.');
+        const name = item[0].toLowerCase();
+        if (!REQUEST_HEADERS.has(name) || item[1].length > 8192 || /[\r\n\0]/u.test(item[1]))
+            throw new QuickAppError(400, 'QUICK_APP_EGRESS_REQUEST', 'The network request is invalid.');
+        return [name, item[1]];
+    });
+}
+function decodeBody(value) {
+    if (value === undefined)
+        return Buffer.alloc(0);
+    if (typeof value !== 'string' || value.length > RAW_LIMIT || !/^[A-Za-z0-9+/]*={0,2}$/u.test(value))
+        throw new QuickAppError(400, 'QUICK_APP_EGRESS_REQUEST', 'The network request is invalid.');
+    const body = Buffer.from(value, 'base64');
+    if (body.byteLength > BODY_LIMIT)
+        throw new QuickAppError(413, 'QUICK_APP_TOO_LARGE', 'The network request limit is 64 MiB.');
+    return body;
+}
+async function resolvePublic(url, resolve, allow) {
+    const hostname = url.hostname.toLowerCase().replace(/\.$/u, '');
+    if (!hostname || hostname.length > 253 || /^\d+$/u.test(hostname))
+        throw denied();
+    const special = hostname === 'localhost' || hostname.endsWith('.localhost') || hostname.endsWith('.local');
+    const named = quickAppAllowMatchesName(allow, hostname);
+    const literal = isIP(hostname);
+    const records = literal ? [{ address: hostname, family: literal }] : await resolve(hostname).catch(() => { throw failed(502, 'The server address could not be resolved.'); });
+    if (!records.length)
+        throw failed(502, 'The server address could not be resolved.');
+    const usable = [];
+    const fakeIp = [];
+    for (const record of records) {
+        const normalized = normalizeAddress(record.address);
+        if (!normalized)
+            continue;
+        const blocked = quickAppAddressBlocked(normalized.address, normalized.family);
+        const allowed = named || quickAppAllowMatches(allow, hostname, normalized.address, normalized.family);
+        if (special) {
+            if (allowed)
+                usable.push(normalized);
+            continue;
+        }
+        if (!blocked || allowed) {
+            usable.push(normalized);
+            continue;
+        }
+        // A hostname that only resolves inside the benchmarking range is the system proxy's fake-ip table.
+        if (!literal && quickAppFakeIpAddress(normalized.address, normalized.family)) {
+            fakeIp.push(normalized);
+            continue;
+        }
+        throw denied();
+    }
+    const pinned = usable.length ? usable : fakeIp;
+    if (!pinned.length)
+        throw denied();
+    return pinned[0];
+}
+function hopRequest(url, method, headers, body, pinned) {
+    const outbound = Object.fromEntries(headers.filter(([name]) => method === 'GET' || method === 'HEAD' ? name !== 'content-type' : true));
+    return {
+        protocol: url.protocol === 'https:' ? 'https:' : 'http:', hostname: url.hostname, hostHeader: url.host, address: pinned.address, family: pinned.family,
+        port: url.port ? Number(url.port) : url.protocol === 'https:' ? 443 : 80, method, path: `${url.pathname}${url.search}`, headers: outbound, body: method === 'GET' || method === 'HEAD' ? Buffer.alloc(0) : body,
+    };
+}
+function normalizeAddress(address) {
+    const zone = address.split('%')[0] ?? address;
+    const dotted = /^::ffff:(\d{1,3}(?:\.\d{1,3}){3})$/iu.exec(zone);
+    if (dotted && isIP(dotted[1]) === 4)
+        return { address: dotted[1], family: 4 };
+    const hex = /^::ffff:([0-9a-f]{1,4}):([0-9a-f]{1,4})$/iu.exec(zone);
+    if (hex) {
+        const high = Number.parseInt(hex[1], 16);
+        const low = Number.parseInt(hex[2], 16);
+        return { address: `${high >> 8}.${high & 255}.${low >> 8}.${low & 255}`, family: 4 };
+    }
+    const family = isIP(zone);
+    if (family === 4 || family === 6)
+        return { address: zone, family };
+    return null;
+}
+async function defaultLookup(hostname) {
+    return lookup(hostname, { all: true, verbatim: true });
+}
+function statusOf(res) { return res.statusCode && res.statusCode >= 200 && res.statusCode <= 599 ? res.statusCode : 502; }
+function contentTypeOf(value) {
+    const raw = Array.isArray(value) ? value[0] : value;
+    if (!raw)
+        return 'application/octet-stream';
+    const type = raw.split(';')[0]?.trim().toLowerCase() ?? '';
+    if (!/^[a-z0-9!#$&^_.+-]+\/[a-z0-9!#$&^_.+-]+$/u.test(type))
+        return 'application/octet-stream';
+    const charset = /charset\s*=\s*"?([a-z0-9._-]+)"?/iu.exec(raw);
+    return charset ? `${type}; charset=${charset[1].toLowerCase()}` : type;
+}
+function denied() { return new QuickAppError(403, 'QUICK_APP_EGRESS_DENIED', 'Quick Apps can call public websites only.'); }
+function failed(status, message) { return new QuickAppError(status, 'QUICK_APP_EGRESS_FAILED', message); }
+//# sourceMappingURL=egress.js.map

package/data/build/dist/host/modules/quick-apps/egress.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"egress.js","sourceRoot":"","sources":["../../../../../../src/host/modules/quick-apps/egress.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAA;AAC1C,OAAO,EAAE,OAAO,IAAI,WAAW,EAAwB,MAAM,WAAW,CAAA;AACxE,OAAO,EAAE,OAAO,IAAI,YAAY,EAAE,MAAM,YAAY,CAAA;AACpD,OAAO,EAAE,IAAI,EAAE,MAAM,UAAU,CAAA;AAC/B,OAAO,EAAE,gBAAgB,EAAE,MAAM,yCAAyC,CAAA;AAC1E,OAAO,EAAE,sBAAsB,EAAE,oBAAoB,EAAE,wBAAwB,EAAE,qBAAqB,EAAE,MAAM,4CAA4C,CAAA;AAC1J,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAA;AAE3C,sHAAsH;AAEtH,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC,CAAA;AACrF,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC,CAAC,eAAe,EAAE,cAAc,EAAE,QAAQ,EAAE,iBAAiB,CAAC,CAAC,CAAA;AAC/F,MAAM,SAAS,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAA;AAClC,MAAM,UAAU,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAA;AACnC,MAAM,cAAc,GAAG,OAAO,CAAA;AAsB9B,MAAM,UAAU,4BAA4B,CAAC,OAAe;IAC1D,MAAM,UAAU,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAA;IAC5C,OAAO,UAAU,KAAK,IAAI,IAAI,sBAAsB,CAAC,UAAU,CAAC,OAAO,EAAE,UAAU,CAAC,MAAM,CAAC,CAAA;AAC7F,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,GAAW,EAAE,MAAmB,EAAE,OAA2B,EAAE;IACvG,MAAM,OAAO,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAA;IACvC,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,IAAI,aAAa,CAAA;IAC5C,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,qBAAqB,CAAA;IACrD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,EAAE,CAAA;IAC9B,IAAI,MAAM,GAAG,OAAO,CAAC,MAAM,CAAA;IAC3B,IAAI,IAAI,GAAG,OAAO,CAAC,IAAI,CAAA;IACvB,IAAI,OAAO,GAAG,OAAO,CAAC,OAAO,CAAA;IAC7B,IAAI,OAAO,GAAG,OAAO,CAAC,GAAG,CAAA;IACzB,KAAK,IAAI,GAAG,GAAG,CAAC,EAAE,GAAG,IAAI,CAAC,EAAE,GAAG,EAAE,EAAE,CAAC;QAClC,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,CAAC,CAAA;QAC3D,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,UAAU,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,CAAA;QAC1F,IAAI,QAAQ,CAAC,MAAM,GAAG,GAAG,IAAI,QAAQ,CAAC,MAAM,IAAI,GAAG,IAAI,OAAO,CAAC,QAAQ,KAAK,QAAQ;YAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,WAAW,EAAE,QAAQ,CAAC,WAAW,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAA;QAChL,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO;YAAE,MAAM,MAAM,CAAC,GAAG,EAAE,qCAAqC,CAAC,CAAA;QAC1F,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ;YAAE,MAAM,MAAM,CAAC,GAAG,EAAE,oDAAoD,CAAC,CAAA;QAC5G,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAA;QAChD,IAAI,IAAI,CAAC,IAAI,KAAK,OAAO,CAAC,IAAI;YAAE,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,IAAI,KAAK,eAAe,CAAC,CAAA;QAC9F,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,CAAC,IAAI,MAAM,KAAK,KAAK,IAAI,MAAM,KAAK,MAAM,CAAC,EAAE,CAAC;YAC/H,MAAM,GAAG,KAAK,CAAC;YAAC,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YAAC,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,IAAI,KAAK,cAAc,CAAC,CAAA;QACvG,CAAC;QACD,OAAO,GAAG,IAAI,CAAA;IAChB,CAAC;IACD,MAAM,MAAM,CAAC,GAAG,EAAE,oDAAoD,CAAC,CAAA;AACzE,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,GAAsB,EAAE,MAAmB;IACrF,MAAM,OAAO,GAAG,GAAG,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,WAAW,CAAA;IACtE,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,IAAI,GAAG,CAAC,KAAc,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,YAAY,aAAa,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,gCAAgC,CAAC,CAAC,CAAC,6CAA6C,CAAC,CAAC,CAAA;QACvN,MAAM,GAAG,GAAG,OAAO,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,OAAO,EAAE,UAAU,EAAE,GAAG,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,OAAO,EAAE,cAAc,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,GAAG,CAAC,EAAE;YAC9P,MAAM,MAAM,GAAa,EAAE,CAAC;YAAC,IAAI,IAAI,GAAG,CAAC,CAAC;YAAC,IAAI,WAAW,GAAG,KAAK,CAAA;YAClE,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE;gBACrB,IAAI,IAAI,KAAK,CAAC,MAAM,CAAA;gBACpB,IAAI,IAAI,GAAG,gBAAgB,CAAC,WAAW,EAAE,CAAC;oBAAC,WAAW,GAAG,IAAI,CAAC;oBAAC,GAAG,CAAC,OAAO,EAAE,CAAC;oBAAC,MAAM,CAAC,IAAI,aAAa,CAAC,GAAG,EAAE,qBAAqB,EAAE,uCAAuC,CAAC,CAAC,CAAA;gBAAC,CAAC;;oBACzK,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;YACzB,CAAC,CAAC,CAAA;YACF,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,IAAI,CAAC,CAAA;YACrB,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE;gBACjB,IAAI,WAAW;oBAAE,OAAM;gBACvB,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,CAAC,GAAG,CAAC,EAAE,WAAW,EAAE,aAAa,CAAC,GAAG,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,CAAC,OAAO,GAAG,CAAC,OAAO,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,GAAG,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAA;YACnN,CAAC,CAAC,CAAA;QACJ,CAAC,CAAC,CAAA;QACF,GAAG,CAAC,SAAS,CAAC,MAAM,EAAE,GAAG,CAAC,UAAU,CAAC,CAAA;QACrC,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,IAAI,CAAC,CAAA;QACrB,GAAG,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,EAAE,gCAAgC,CAAC,CAAC,CAAC,CAAA;QACnF,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAA;IACrD,CAAC,CAAC,CAAA;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,GAAoB,EAAE,MAAmB;IAC5E,IAAI,CAAC,uCAAuC,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC;QAAE,MAAM,IAAI,aAAa,CAAC,GAAG,EAAE,wBAAwB,EAAE,gCAAgC,CAAC,CAAA;IAC9K,IAAI,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC,GAAG,SAAS;QAAE,MAAM,IAAI,aAAa,CAAC,GAAG,EAAE,qBAAqB,EAAE,sCAAsC,CAAC,CAAA;IAClJ,MAAM,MAAM,GAAa,EAAE,CAAC;IAAC,IAAI,MAAM,GAAG,CAAC,CAAA;IAC3C,MAAM,MAAM,GAAG,GAAG,EAAE,CAAC,GAAG,CAAC,OAAO,EAAE,CAAA;IAClC,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAA;IACxD,IAAI,CAAC;QACH,MAAM,CAAC,cAAc,EAAE,CAAA;QACvB,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,GAAG,CAAC,QAAQ,CAAC,EAAE,eAAe,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;YACnE,MAAM,CAAC,cAAc,EAAE,CAAC;YAAC,MAAM,IAAI,KAAK,CAAC,MAAM,CAAA;YAC/C,IAAI,MAAM,GAAG,SAAS;gBAAE,MAAM,IAAI,aAAa,CAAC,GAAG,EAAE,qBAAqB,EAAE,sCAAsC,CAAC,CAAA;YACnH,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAA;QACjC,CAAC;QACD,IAAI,CAAC;YAAC,OAAO,IAAI,WAAW,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAA;QAAC,CAAC;QAAC,MAAM,CAAC;YAAC,MAAM,IAAI,aAAa,CAAC,GAAG,EAAE,oBAAoB,EAAE,wBAAwB,CAAC,CAAA;QAAC,CAAC;IAC/K,CAAC;YAAS,CAAC;QAAC,MAAM,CAAC,mBAAmB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;IAAC,CAAC;AAC3D,CAAC;AAED,SAAS,kBAAkB,CAAC,GAAW;IACrC,IAAI,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,SAAS;QAAE,MAAM,IAAI,aAAa,CAAC,GAAG,EAAE,qBAAqB,EAAE,sCAAsC,CAAC,CAAA;IACnI,IAAI,KAAc,CAAA;IAClB,IAAI,CAAC;QAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,MAAM,IAAI,aAAa,CAAC,GAAG,EAAE,0BAA0B,EAAE,iCAAiC,CAAC,CAAA;IAAC,CAAC;IACrI,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,aAAa,CAAC,GAAG,EAAE,0BAA0B,EAAE,iCAAiC,CAAC,CAAA;IAC5J,MAAM,MAAM,GAAG,KAAgC,CAAA;IAC/C,MAAM,MAAM,GAAG,OAAO,MAAM,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,KAAK,CAAA;IACtF,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC;QAAE,MAAM,IAAI,aAAa,CAAC,GAAG,EAAE,0BAA0B,EAAE,8CAA8C,CAAC,CAAA;IAClI,IAAI,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,IAAI,MAAM,CAAC,GAAG,CAAC,MAAM,GAAG,IAAI;QAAE,MAAM,IAAI,aAAa,CAAC,GAAG,EAAE,0BAA0B,EAAE,qCAAqC,CAAC,CAAA;IAC/J,IAAI,GAAQ,CAAA;IACZ,IAAI,CAAC;QAAC,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,MAAM,IAAI,aAAa,CAAC,GAAG,EAAE,0BAA0B,EAAE,qCAAqC,CAAC,CAAA;IAAC,CAAC;IAC3I,IAAI,CAAC,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,CAAC,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ,IAAI,CAAC,GAAG,CAAC,QAAQ;QAAE,MAAM,IAAI,aAAa,CAAC,GAAG,EAAE,0BAA0B,EAAE,qCAAqC,CAAC,CAAA;IAC7M,MAAM,OAAO,GAAG,gBAAgB,CAAC,MAAM,CAAC,OAAO,CAAC,CAAA;IAChD,MAAM,IAAI,GAAG,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;IACpC,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAA;IACtL,IAAI,MAAM,CAAC,QAAQ,KAAK,SAAS,IAAI,QAAQ,KAAK,SAAS;QAAE,MAAM,IAAI,aAAa,CAAC,GAAG,EAAE,0BAA0B,EAAE,iCAAiC,CAAC,CAAA;IACxJ,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAA;AAC1E,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAc;IACtC,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,EAAE,CAAA;IAClC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,EAAE;QAAE,MAAM,IAAI,aAAa,CAAC,GAAG,EAAE,0BAA0B,EAAE,iCAAiC,CAAC,CAAA;IAC3I,OAAO,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE;QACtB,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,OAAO,IAAI,CAAC,CAAC,CAAC,KAAK,QAAQ,IAAI,OAAO,IAAI,CAAC,CAAC,CAAC,KAAK,QAAQ;YAAE,MAAM,IAAI,aAAa,CAAC,GAAG,EAAE,0BAA0B,EAAE,iCAAiC,CAAC,CAAA;QACxM,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAA;QAClC,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,GAAG,IAAI,IAAI,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAAE,MAAM,IAAI,aAAa,CAAC,GAAG,EAAE,0BAA0B,EAAE,iCAAiC,CAAC,CAAA;QACjL,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,CAAqB,CAAA;IAC5C,CAAC,CAAC,CAAA;AACJ,CAAC;AAED,SAAS,UAAU,CAAC,KAAc;IAChC,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;IAC/C,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,SAAS,IAAI,CAAC,yBAAyB,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,aAAa,CAAC,GAAG,EAAE,0BAA0B,EAAE,iCAAiC,CAAC,CAAA;IAChM,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAA;IACzC,IAAI,IAAI,CAAC,UAAU,GAAG,UAAU;QAAE,MAAM,IAAI,aAAa,CAAC,GAAG,EAAE,qBAAqB,EAAE,sCAAsC,CAAC,CAAA;IAC7H,OAAO,IAAI,CAAA;AACb,CAAC;AAED,KAAK,UAAU,aAAa,CAAC,GAAQ,EAAE,OAAkD,EAAE,KAAwB;IACjH,MAAM,QAAQ,GAAG,GAAG,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAA;IAC/D,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,MAAM,GAAG,GAAG,IAAI,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC;QAAE,MAAM,MAAM,EAAE,CAAA;IACjF,MAAM,OAAO,GAAG,QAAQ,KAAK,WAAW,IAAI,QAAQ,CAAC,QAAQ,CAAC,YAAY,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAA;IAC1G,MAAM,KAAK,GAAG,wBAAwB,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAA;IACvD,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,CAAA;IAC9B,MAAM,OAAO,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,OAAO,CAAC,QAAQ,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,MAAM,MAAM,CAAC,GAAG,EAAE,2CAA2C,CAAC,CAAA,CAAC,CAAC,CAAC,CAAA;IAC5K,IAAI,CAAC,OAAO,CAAC,MAAM;QAAE,MAAM,MAAM,CAAC,GAAG,EAAE,2CAA2C,CAAC,CAAA;IACnF,MAAM,MAAM,GAAyC,EAAE,CAAA;IACvD,MAAM,MAAM,GAAyC,EAAE,CAAA;IACvD,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,MAAM,UAAU,GAAG,gBAAgB,CAAC,MAAM,CAAC,OAAO,CAAC,CAAA;QACnD,IAAI,CAAC,UAAU;YAAE,SAAQ;QACzB,MAAM,OAAO,GAAG,sBAAsB,CAAC,UAAU,CAAC,OAAO,EAAE,UAAU,CAAC,MAAM,CAAC,CAAA;QAC7E,MAAM,OAAO,GAAG,KAAK,IAAI,oBAAoB,CAAC,KAAK,EAAE,QAAQ,EAAE,UAAU,CAAC,OAAO,EAAE,UAAU,CAAC,MAAM,CAAC,CAAA;QACrG,IAAI,OAAO,EAAE,CAAC;YACZ,IAAI,OAAO;gBAAE,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;YACpC,SAAQ;QACV,CAAC;QACD,IAAI,CAAC,OAAO,IAAI,OAAO,EAAE,CAAC;YAAC,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;YAAC,SAAQ;QAAC,CAAC;QAC9D,mGAAmG;QACnG,IAAI,CAAC,OAAO,IAAI,qBAAqB,CAAC,UAAU,CAAC,OAAO,EAAE,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;YAAC,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;YAAC,SAAQ;QAAC,CAAC;QACnH,MAAM,MAAM,EAAE,CAAA;IAChB,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAA;IAC9C,IAAI,CAAC,MAAM,CAAC,MAAM;QAAE,MAAM,MAAM,EAAE,CAAA;IAClC,OAAO,MAAM,CAAC,CAAC,CAAE,CAAA;AACnB,CAAC;AAED,SAAS,UAAU,CAAC,GAAQ,EAAE,MAAc,EAAE,OAAoC,EAAE,IAAY,EAAE,MAA0C;IAC1I,MAAM,QAAQ,GAAG,MAAM,CAAC,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,MAAM,KAAK,KAAK,IAAI,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,IAAI,KAAK,cAAc,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAA;IACvI,OAAO;QACL,QAAQ,EAAE,GAAG,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,UAAU,EAAE,GAAG,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM;QACtJ,IAAI,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,GAAG,CAAC,QAAQ,GAAG,GAAG,CAAC,MAAM,EAAE,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,KAAK,KAAK,IAAI,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI;KAChN,CAAA;AACH,CAAC;AAED,SAAS,gBAAgB,CAAC,OAAe;IACvC,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,OAAO,CAAA;IAC7C,MAAM,MAAM,GAAG,sCAAsC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IAChE,IAAI,MAAM,IAAI,IAAI,CAAC,MAAM,CAAC,CAAC,CAAE,CAAC,KAAK,CAAC;QAAE,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC,CAAE,EAAE,MAAM,EAAE,CAAC,EAAE,CAAA;IAC/E,MAAM,GAAG,GAAG,4CAA4C,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IACnE,IAAI,GAAG,EAAE,CAAC;QACR,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAE,EAAE,EAAE,CAAC,CAAC;QAAC,MAAM,GAAG,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAE,EAAE,EAAE,CAAC,CAAA;QACnF,OAAO,EAAE,OAAO,EAAE,GAAG,IAAI,IAAI,CAAC,IAAI,IAAI,GAAG,GAAG,IAAI,GAAG,IAAI,CAAC,IAAI,GAAG,GAAG,GAAG,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,CAAA;IACtF,CAAC;IACD,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,CAAA;IACzB,IAAI,MAAM,KAAK,CAAC,IAAI,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAA;IAClE,OAAO,IAAI,CAAA;AACb,CAAC;AAED,KAAK,UAAU,aAAa,CAAC,QAAgB;IAC3C,OAAO,MAAM,CAAC,QAAQ,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAA;AACxD,CAAC;AAED,SAAS,QAAQ,CAAC,GAAoB,IAAY,OAAO,GAAG,CAAC,UAAU,IAAI,GAAG,CAAC,UAAU,IAAI,GAAG,IAAI,GAAG,CAAC,UAAU,IAAI,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,CAAA,CAAC,CAAC;AAClJ,SAAS,aAAa,CAAC,KAAoC;IACzD,MAAM,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAA;IACnD,IAAI,CAAC,GAAG;QAAE,OAAO,0BAA0B,CAAA;IAC3C,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,IAAI,EAAE,CAAA;IAC1D,IAAI,CAAC,2CAA2C,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,0BAA0B,CAAA;IAC9F,MAAM,OAAO,GAAG,oCAAoC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IAC9D,OAAO,OAAO,CAAC,CAAC,CAAC,GAAG,IAAI,aAAa,OAAO,CAAC,CAAC,CAAE,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAA;AACzE,CAAC;AACD,SAAS,MAAM,KAAoB,OAAO,IAAI,aAAa,CAAC,GAAG,EAAE,yBAAyB,EAAE,2CAA2C,CAAC,CAAA,CAAC,CAAC;AAC1I,SAAS,MAAM,CAAC,MAAc,EAAE,OAAe,IAAmB,OAAO,IAAI,aAAa,CAAC,MAAM,EAAE,yBAAyB,EAAE,OAAO,CAAC,CAAA,CAAC,CAAC"}

package/data/build/dist/host/modules/quick-apps/errors.d.ts

@@ -0,0 +1,8 @@
+import { CodingNsRpcError } from '../../rpc-table.js';
+export declare class QuickAppError extends CodingNsRpcError {
+    readonly status: number;
+    constructor(status: number, code: string, message: string);
+}
+export declare function deny(message?: string): never;
+export declare function conflict(): never;
+//# sourceMappingURL=errors.d.ts.map

package/data/build/dist/host/modules/quick-apps/errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../../../../../src/host/modules/quick-apps/errors.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAA;AAErD,qBAAa,aAAc,SAAQ,gBAAgB;IACrC,QAAQ,CAAC,MAAM,EAAE,MAAM;gBAAd,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM;CACnE;AAED,wBAAgB,IAAI,CAAC,OAAO,SAAqD,GAAG,KAAK,CAExF;AAED,wBAAgB,QAAQ,IAAI,KAAK,CAEhC"}

package/data/build/dist/host/modules/quick-apps/errors.js

@@ -0,0 +1,15 @@
+import { CodingNsRpcError } from '../../rpc-table.js';
+export class QuickAppError extends CodingNsRpcError {
+    status;
+    constructor(status, code, message) {
+        super(code, message);
+        this.status = status;
+    }
+}
+export function deny(message = 'The requested path or operation is not approved.') {
+    throw new QuickAppError(403, 'QUICK_APP_ACCESS_DENIED', message);
+}
+export function conflict() {
+    throw new QuickAppError(412, 'QUICK_APP_CONFLICT', 'The file or shortcut changed. Reload it before retrying.');
+}
+//# sourceMappingURL=errors.js.map

package/data/build/dist/host/modules/quick-apps/errors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../../../../../../src/host/modules/quick-apps/errors.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAA;AAErD,MAAM,OAAO,aAAc,SAAQ,gBAAgB;IAC5B;IAArB,YAAqB,MAAc,EAAE,IAAY,EAAE,OAAe;QAAI,KAAK,CAAC,IAAI,EAAE,OAAO,CAAC,CAAA;QAArE,WAAM,GAAN,MAAM,CAAQ;IAAwD,CAAC;CAC7F;AAED,MAAM,UAAU,IAAI,CAAC,OAAO,GAAG,kDAAkD;IAC/E,MAAM,IAAI,aAAa,CAAC,GAAG,EAAE,yBAAyB,EAAE,OAAO,CAAC,CAAA;AAClE,CAAC;AAED,MAAM,UAAU,QAAQ;IACtB,MAAM,IAAI,aAAa,CAAC,GAAG,EAAE,oBAAoB,EAAE,0DAA0D,CAAC,CAAA;AAChH,CAAC"}

package/data/build/dist/host/modules/quick-apps/file-api.d.ts

@@ -0,0 +1,30 @@
+import type { QuickAppLaunch, QuickAppLaunches } from './launches.js';
+export declare function readVersionedText(path: string): Promise<{
+    content: string;
+    version: string;
+}>;
+export declare function tooLarge(): never;
+/** Global physical-file ordering with per-service pending work for lifecycle cleanup. */
+export declare class QuickAppFileApi {
+    private readonly launches;
+    private readonly mutations;
+    constructor(launches: QuickAppLaunches);
+    private target;
+    read(launch: QuickAppLaunch, path: string): Promise<{
+        content: string;
+        version: string;
+    }>;
+    list(launch: QuickAppLaunch, path: string): Promise<{
+        items: readonly {
+            name: string;
+            kind: string;
+        }[];
+    }>;
+    mutate(launch: QuickAppLaunch, method: 'PUT' | 'DELETE', path: string, content: string, ifMatch?: string, ifNoneMatch?: string, signal?: AbortSignal): Promise<{
+        ok: true;
+        version?: string;
+    }>;
+    drain(): Promise<void>;
+    get pending(): number;
+}
+//# sourceMappingURL=file-api.d.ts.map

package/data/build/dist/host/modules/quick-apps/file-api.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"file-api.d.ts","sourceRoot":"","sources":["../../../../../../src/host/modules/quick-apps/file-api.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,cAAc,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAA;AAMrE,wBAAsB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC,CAqBnG;AAED,wBAAgB,QAAQ,IAAI,KAAK,CAAoF;AAErH,yFAAyF;AACzF,qBAAa,eAAe;IAEd,OAAO,CAAC,QAAQ,CAAC,QAAQ;IADrC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAA8B;gBAC3B,QAAQ,EAAE,gBAAgB;YAEzC,MAAM;IAQd,IAAI,CAAC,MAAM,EAAE,cAAc,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;IAKzF,IAAI,CAAC,MAAM,EAAE,cAAc,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,KAAK,EAAE,SAAS;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,IAAI,EAAE,MAAM,CAAA;SAAE,EAAE,CAAA;KAAE,CAAC;IAUzG,MAAM,CAAC,MAAM,EAAE,cAAc,EAAE,MAAM,EAAE,KAAK,GAAG,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,EAAE,WAAW,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC;QAAE,EAAE,EAAE,IAAI,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAgD9L,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAC5B,IAAI,OAAO,IAAI,MAAM,CAA+B;CACrD"}

package/data/build/dist/host/modules/quick-apps/file-api.js

@@ -0,0 +1,149 @@
+import { createHash, randomUUID } from 'node:crypto';
+import { constants } from 'node:fs';
+import { link, open, opendir, rename, stat, unlink } from 'node:fs/promises';
+import { basename, dirname, join } from 'node:path';
+import { QUICK_APP_LIMITS } from '../../../shared/contracts/quick-apps.js';
+import { appPath, publicPath, resolveAppPath, withinScope } from './paths.js';
+import { conflict, deny, QuickAppError } from './errors.js';
+import { serializeWorkspaceMutation } from '../../workspace-file-mutations.js';
+export async function readVersionedText(path) {
+    const file = await open(path, constants.O_RDONLY | constants.O_NOFOLLOW);
+    try {
+        const info = await file.stat();
+        if (!info.isFile())
+            deny('Only regular text files are supported.');
+        if (info.size > QUICK_APP_LIMITS.textBytes)
+            tooLarge();
+        const bytes = Buffer.alloc(QUICK_APP_LIMITS.textBytes + 1);
+        let length = 0;
+        while (length < bytes.length) {
+            const read = await file.read(bytes, length, bytes.length - length, length);
+            if (!read.bytesRead)
+                break;
+            length += read.bytesRead;
+        }
+        if (length > QUICK_APP_LIMITS.textBytes)
+            tooLarge();
+        const after = await file.stat();
+        if (after.mtimeMs !== info.mtimeMs || after.ctimeMs !== info.ctimeMs || after.size !== info.size)
+            conflict();
+        let content;
+        try {
+            content = new TextDecoder('utf-8', { fatal: true }).decode(bytes.subarray(0, length));
+        }
+        catch {
+            deny('The file is not UTF-8 text.');
+        }
+        const version = `"${createHash('sha256').update(bytes.subarray(0, length)).update(`${info.ino}:${info.mtimeMs}:${info.ctimeMs}`).digest('hex')}"`;
+        return { content, version };
+    }
+    finally {
+        await file.close();
+    }
+}
+export function tooLarge() { throw new QuickAppError(413, 'QUICK_APP_TOO_LARGE', 'The text limit is 4 MiB.'); }
+/** Global physical-file ordering with per-service pending work for lifecycle cleanup. */
+export class QuickAppFileApi {
+    launches;
+    mutations = new Set();
+    constructor(launches) {
+        this.launches = launches;
+    }
+    async target(launch, operation, path, missing = false) {
+        await this.launches.validateWorkspace(launch);
+        await launch.validateCode?.();
+        this.launches.authorize(launch);
+        const normalized = appPath(path);
+        if (!publicPath(normalized) || !launch.permissions[operation].some(scope => withinScope(scope, normalized)))
+            deny();
+        return resolveAppPath(launch.workspaceRoot, normalized, missing);
+    }
+    async read(launch, path) {
+        const result = await readVersionedText(await this.target(launch, 'read', path));
+        this.launches.authorize(launch);
+        return result;
+    }
+    async list(launch, path) {
+        const directory = await opendir(await this.target(launch, 'read', path));
+        const items = [];
+        for await (const item of directory) {
+            this.launches.authorize(launch);
+            if (items.length >= 1000)
+                throw new QuickAppError(413, 'QUICK_APP_TOO_LARGE', 'Directory listing exceeds 1000 entries.');
+            if (!item.isSymbolicLink() && publicPath(item.name) && (item.isFile() || item.isDirectory()))
+                items.push({ name: item.name, kind: item.isFile() ? 'file' : 'directory' });
+        }
+        return { items };
+    }
+    async mutate(launch, method, path, content, ifMatch, ifNoneMatch, signal) {
+        if (Buffer.byteLength(content) > QUICK_APP_LIMITS.textBytes)
+            tooLarge();
+        const create = method === 'PUT' && ifNoneMatch === '*';
+        if ((create && ifMatch !== undefined) || (!create && (!ifMatch || ifMatch === '*' || ifNoneMatch !== undefined))) {
+            throw new QuickAppError(428, 'QUICK_APP_PRECONDITION_REQUIRED', 'Use the exact If-Match version, or If-None-Match: * to create a new file.');
+        }
+        const operation = method === 'DELETE' ? 'delete' : 'write';
+        const key = await this.target(launch, operation, path, create);
+        const next = serializeWorkspaceMutation(key, async () => {
+            signal?.throwIfAborted();
+            const target = await this.target(launch, operation, path, create);
+            if (target !== key)
+                deny();
+            if (!create && (await readVersionedText(target)).version !== ifMatch)
+                conflict();
+            if (method === 'DELETE') {
+                await this.target(launch, operation, path);
+                if ((await readVersionedText(target)).version !== ifMatch)
+                    conflict();
+                signal?.throwIfAborted();
+                this.launches.authorize(launch);
+                await unlink(target);
+                return { ok: true };
+            }
+            // Parent directories must already exist. Never recursively create through an unvalidated ancestor.
+            const temporary = join(dirname(target), `.${basename(target)}.quickapp-${randomUUID()}`);
+            const mode = create ? 0o600 : (await stat(target)).mode & 0o777;
+            const file = await open(temporary, constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL | constants.O_NOFOLLOW, mode);
+            try {
+                await file.writeFile(content, 'utf8');
+                await file.sync();
+                await file.close();
+                await this.target(launch, operation, path, create);
+                if (!create && (await readVersionedText(target)).version !== ifMatch)
+                    conflict();
+                signal?.throwIfAborted();
+                this.launches.authorize(launch);
+                if (create) {
+                    try {
+                        await link(temporary, target);
+                    }
+                    catch (error) {
+                        if (error.code === 'EEXIST')
+                            conflict();
+                        throw error;
+                    }
+                    // Removing the temporary hard link changes ctime. Return the version only after that cleanup.
+                    await unlink(temporary);
+                }
+                else
+                    await rename(temporary, target);
+                return { ok: true, version: (await readVersionedText(target)).version };
+            }
+            finally {
+                await file.close().catch(() => undefined);
+                await unlink(temporary).catch(error => { if (error.code !== 'ENOENT')
+                    throw error; });
+            }
+        });
+        this.mutations.add(next);
+        try {
+            return await next;
+        }
+        finally {
+            this.mutations.delete(next);
+        }
+    }
+    async drain() { await Promise.allSettled(this.mutations); }
+    get pending() { return this.mutations.size; }
+}
+//# sourceMappingURL=file-api.js.map

package/data/build/dist/host/modules/quick-apps/file-api.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"file-api.js","sourceRoot":"","sources":["../../../../../../src/host/modules/quick-apps/file-api.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AACpD,OAAO,EAAE,SAAS,EAAE,MAAM,SAAS,CAAA;AACnC,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAA;AAC5E,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAEnD,OAAO,EAAE,gBAAgB,EAAE,MAAM,yCAAyC,CAAA;AAC1E,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,YAAY,CAAA;AAC7E,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,aAAa,CAAA;AAC3D,OAAO,EAAE,0BAA0B,EAAE,MAAM,mCAAmC,CAAA;AAE9E,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,IAAY;IAClD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,QAAQ,GAAG,SAAS,CAAC,UAAU,CAAC,CAAA;IACxE,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAA;QAC9B,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE;YAAE,IAAI,CAAC,wCAAwC,CAAC,CAAA;QAClE,IAAI,IAAI,CAAC,IAAI,GAAG,gBAAgB,CAAC,SAAS;YAAE,QAAQ,EAAE,CAAA;QACtD,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,gBAAgB,CAAC,SAAS,GAAG,CAAC,CAAC,CAAA;QAC1D,IAAI,MAAM,GAAG,CAAC,CAAA;QACd,OAAO,MAAM,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC;YAC7B,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,GAAG,MAAM,EAAE,MAAM,CAAC,CAAA;YAC1E,IAAI,CAAC,IAAI,CAAC,SAAS;gBAAE,MAAK;YAC1B,MAAM,IAAI,IAAI,CAAC,SAAS,CAAA;QAC1B,CAAC;QACD,IAAI,MAAM,GAAG,gBAAgB,CAAC,SAAS;YAAE,QAAQ,EAAE,CAAA;QACnD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAA;QAC/B,IAAI,KAAK,CAAC,OAAO,KAAK,IAAI,CAAC,OAAO,IAAI,KAAK,CAAC,OAAO,KAAK,IAAI,CAAC,OAAO,IAAI,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI;YAAE,QAAQ,EAAE,CAAA;QAC5G,IAAI,OAAe,CAAA;QACnB,IAAI,CAAC;YAAC,OAAO,GAAG,IAAI,WAAW,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAA;QAAC,CAAC;QAAC,MAAM,CAAC;YAAC,IAAI,CAAC,6BAA6B,CAAC,CAAA;QAAC,CAAC;QAC3I,MAAM,OAAO,GAAG,IAAI,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAA;QACjJ,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAA;IAC7B,CAAC;YAAS,CAAC;QAAC,MAAM,IAAI,CAAC,KAAK,EAAE,CAAA;IAAC,CAAC;AAClC,CAAC;AAED,MAAM,UAAU,QAAQ,KAAY,MAAM,IAAI,aAAa,CAAC,GAAG,EAAE,qBAAqB,EAAE,0BAA0B,CAAC,CAAA,CAAC,CAAC;AAErH,yFAAyF;AACzF,MAAM,OAAO,eAAe;IAEG;IADZ,SAAS,GAAG,IAAI,GAAG,EAAoB,CAAA;IACxD,YAA6B,QAA0B;QAA1B,aAAQ,GAAR,QAAQ,CAAkB;IAAG,CAAC;IAEnD,KAAK,CAAC,MAAM,CAAC,MAAsB,EAAE,SAAsC,EAAE,IAAY,EAAE,OAAO,GAAG,KAAK;QAChH,MAAM,IAAI,CAAC,QAAQ,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAA;QAC7C,MAAM,MAAM,CAAC,YAAY,EAAE,EAAE,CAAA;QAC7B,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,MAAM,CAAC,CAAA;QAC/B,MAAM,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;QAChC,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,WAAW,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;YAAE,IAAI,EAAE,CAAA;QACnH,OAAO,cAAc,CAAC,MAAM,CAAC,aAAa,EAAE,UAAU,EAAE,OAAO,CAAC,CAAA;IAClE,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,MAAsB,EAAE,IAAY;QAC7C,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC,CAAA;QAC/E,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,MAAM,CAAC,CAAA;QAC/B,OAAO,MAAM,CAAA;IACf,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,MAAsB,EAAE,IAAY;QAC7C,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC,CAAA;QACxE,MAAM,KAAK,GAAqC,EAAE,CAAA;QAClD,IAAI,KAAK,EAAE,MAAM,IAAI,IAAI,SAAS,EAAE,CAAC;YACnC,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,MAAM,CAAC,CAAA;YAC/B,IAAI,KAAK,CAAC,MAAM,IAAI,IAAI;gBAAE,MAAM,IAAI,aAAa,CAAC,GAAG,EAAE,qBAAqB,EAAE,yCAAyC,CAAC,CAAA;YACxH,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,IAAI,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;gBAAE,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAA;QAC3K,CAAC;QACD,OAAO,EAAE,KAAK,EAAE,CAAA;IAClB,CAAC;IACD,KAAK,CAAC,MAAM,CAAC,MAAsB,EAAE,MAAwB,EAAE,IAAY,EAAE,OAAe,EAAE,OAAgB,EAAE,WAAoB,EAAE,MAAoB;QACxJ,IAAI,MAAM,CAAC,UAAU,CAAC,OAAO,CAAC,GAAG,gBAAgB,CAAC,SAAS;YAAE,QAAQ,EAAE,CAAA;QACvE,MAAM,MAAM,GAAG,MAAM,KAAK,KAAK,IAAI,WAAW,KAAK,GAAG,CAAA;QACtD,IAAI,CAAC,MAAM,IAAI,OAAO,KAAK,SAAS,CAAC,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,OAAO,IAAI,OAAO,KAAK,GAAG,IAAI,WAAW,KAAK,SAAS,CAAC,CAAC,EAAE,CAAC;YACjH,MAAM,IAAI,aAAa,CAAC,GAAG,EAAE,iCAAiC,EAAE,2EAA2E,CAAC,CAAA;QAC9I,CAAC;QACD,MAAM,SAAS,GAAG,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAA;QAC1D,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,CAAC,CAAA;QAC9D,MAAM,IAAI,GAAG,0BAA0B,CAAC,GAAG,EAAE,KAAK,IAAI,EAAE;YACtD,MAAM,EAAE,cAAc,EAAE,CAAA;YACxB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,CAAC,CAAA;YACjE,IAAI,MAAM,KAAK,GAAG;gBAAE,IAAI,EAAE,CAAA;YAC1B,IAAI,CAAC,MAAM,IAAI,CAAC,MAAM,iBAAiB,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,KAAK,OAAO;gBAAE,QAAQ,EAAE,CAAA;YAChF,IAAI,MAAM,KAAK,QAAQ,EAAE,CAAC;gBACxB,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,EAAE,IAAI,CAAC,CAAA;gBAC1C,IAAI,CAAC,MAAM,iBAAiB,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,KAAK,OAAO;oBAAE,QAAQ,EAAE,CAAA;gBACrE,MAAM,EAAE,cAAc,EAAE,CAAA;gBACxB,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,MAAM,CAAC,CAAA;gBAC/B,MAAM,MAAM,CAAC,MAAM,CAAC,CAAA;gBACpB,OAAO,EAAE,EAAE,EAAE,IAAa,EAAE,CAAA;YAC9B,CAAC;YACD,mGAAmG;YACnG,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,IAAI,QAAQ,CAAC,MAAM,CAAC,aAAa,UAAU,EAAE,EAAE,CAAC,CAAA;YACxF,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,GAAG,KAAK,CAAA;YAC/D,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,SAAS,EAAE,SAAS,CAAC,QAAQ,GAAG,SAAS,CAAC,OAAO,GAAG,SAAS,CAAC,MAAM,GAAG,SAAS,CAAC,UAAU,EAAE,IAAI,CAAC,CAAA;YAC1H,IAAI,CAAC;gBACH,MAAM,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;gBACrC,MAAM,IAAI,CAAC,IAAI,EAAE,CAAA;gBACjB,MAAM,IAAI,CAAC,KAAK,EAAE,CAAA;gBAClB,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,CAAC,CAAA;gBAClD,IAAI,CAAC,MAAM,IAAI,CAAC,MAAM,iBAAiB,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,KAAK,OAAO;oBAAE,QAAQ,EAAE,CAAA;gBAChF,MAAM,EAAE,cAAc,EAAE,CAAA;gBACxB,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,MAAM,CAAC,CAAA;gBAC/B,IAAI,MAAM,EAAE,CAAC;oBACX,IAAI,CAAC;wBAAC,MAAM,IAAI,CAAC,SAAS,EAAE,MAAM,CAAC,CAAA;oBAAC,CAAC;oBAAC,OAAO,KAAK,EAAE,CAAC;wBAAC,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;4BAAE,QAAQ,EAAE,CAAC;wBAAC,MAAM,KAAK,CAAA;oBAAC,CAAC;oBACvI,8FAA8F;oBAC9F,MAAM,MAAM,CAAC,SAAS,CAAC,CAAA;gBACzB,CAAC;;oBACI,MAAM,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,CAAA;gBACpC,OAAO,EAAE,EAAE,EAAE,IAAa,EAAE,OAAO,EAAE,CAAC,MAAM,iBAAiB,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,EAAE,CAAA;YAClF,CAAC;oBAAS,CAAC;gBACT,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAA;gBACzC,MAAM,MAAM,CAAC,SAAS,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,GAAG,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;oBAAE,MAAM,KAAK,CAAA,CAAC,CAAC,CAAC,CAAA;YACjH,CAAC;QACH,CAAC,CAAC,CAAA;QACF,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;QACxB,IAAI,CAAC;YAAC,OAAO,MAAM,IAAI,CAAA;QAAC,CAAC;gBAAS,CAAC;YAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;QAAC,CAAC;IACnE,CAAC;IACD,KAAK,CAAC,KAAK,KAAoB,MAAM,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA,CAAC,CAAC;IACzE,IAAI,OAAO,KAAa,OAAO,IAAI,CAAC,SAAS,CAAC,IAAI,CAAA,CAAC,CAAC;CACrD"}

package/data/build/dist/host/modules/quick-apps/launches.d.ts

@@ -0,0 +1,35 @@
+import type { QuickApp, QuickAppPermissions } from '../../../shared/contracts/quick-apps.js';
+import { type QuickAppRegistry } from './registry.js';
+export interface QuickAppLaunch {
+    readonly id: string;
+    readonly app: QuickApp;
+    readonly principal: string;
+    readonly workspaceRoot: string;
+    readonly workspaceReference: string;
+    permissions: QuickAppPermissions;
+    readonly expiresAt: number;
+    readonly credentialDigest: Buffer;
+    readonly abort: AbortController;
+    dispose: () => Promise<void>;
+    validateCode?: () => Promise<void>;
+}
+export declare class QuickAppLaunches {
+    private readonly registry;
+    private readonly now;
+    private readonly launches;
+    private stopped;
+    constructor(registry: QuickAppRegistry, now?: () => number);
+    create(app: QuickApp, principal: string, permissions: QuickAppPermissions): Promise<{
+        launch: QuickAppLaunch;
+        credential: string;
+    }>;
+    authorize(launch: QuickAppLaunch, credential?: string): void;
+    validateWorkspace(launch: QuickAppLaunch): Promise<void>;
+    requireOwner(id: string, principal: string): QuickAppLaunch;
+    revoke(id: string): Promise<void>;
+    revokeApp(id: string): Promise<void>;
+    prune(): Promise<void>;
+    dispose(): Promise<void>;
+    get size(): number;
+}
+//# sourceMappingURL=launches.d.ts.map

package/data/build/dist/host/modules/quick-apps/launches.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"launches.d.ts","sourceRoot":"","sources":["../../../../../../src/host/modules/quick-apps/launches.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,QAAQ,EAAE,mBAAmB,EAAE,MAAM,yCAAyC,CAAA;AAE5F,OAAO,EAAyB,KAAK,gBAAgB,EAAE,MAAM,eAAe,CAAA;AAG5E,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,GAAG,EAAE,QAAQ,CAAA;IACtB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAA;IAC9B,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAA;IACnC,WAAW,EAAE,mBAAmB,CAAA;IAChC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAA;IACjC,QAAQ,CAAC,KAAK,EAAE,eAAe,CAAA;IAC/B,OAAO,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAA;IAC5B,YAAY,CAAC,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAA;CACnC;AAED,qBAAa,gBAAgB;IAGf,OAAO,CAAC,QAAQ,CAAC,QAAQ;IAAoB,OAAO,CAAC,QAAQ,CAAC,GAAG;IAF7E,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAoC;IAC7D,OAAO,CAAC,OAAO,CAAQ;gBACM,QAAQ,EAAE,gBAAgB,EAAmB,GAAG,eAAW;IAElF,MAAM,CAAC,GAAG,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,EAAE,WAAW,EAAE,mBAAmB,GAAG,OAAO,CAAC;QAAE,MAAM,EAAE,cAAc,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE,CAAC;IAazI,SAAS,CAAC,MAAM,EAAE,cAAc,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI;IActD,iBAAiB,CAAC,MAAM,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC;IAO9D,YAAY,CAAC,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,cAAc;IAKrD,MAAM,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAOjC,SAAS,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IACpC,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IACtB,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;IAC9B,IAAI,IAAI,IAAI,MAAM,CAA8B;CACjD"}

package/data/build/dist/host/modules/quick-apps/launches.js

@@ -0,0 +1,80 @@
+import { createHash, randomBytes, randomUUID, timingSafeEqual } from 'node:crypto';
+import { realpath } from 'node:fs/promises';
+import { QUICK_APP_LIMITS } from '../../../shared/contracts/quick-apps.js';
+import { quickAppDefinitionKey } from './registry.js';
+import { deny, QuickAppError } from './errors.js';
+export class QuickAppLaunches {
+    registry;
+    now;
+    launches = new Map();
+    stopped = false;
+    constructor(registry, now = Date.now) {
+        this.registry = registry;
+        this.now = now;
+    }
+    async create(app, principal, permissions) {
+        const workspaceReference = this.registry.root(app);
+        const workspaceRoot = await realpath(workspaceReference);
+        await this.prune();
+        if (this.stopped)
+            throw new QuickAppError(410, 'QUICK_APP_REVOKED', 'Quick Apps is disabled.');
+        if (this.launches.size >= QUICK_APP_LIMITS.launches)
+            throw new QuickAppError(429, 'QUICK_APP_LIMIT', 'Too many active launches.');
+        const credential = randomBytes(32).toString('base64url');
+        const launch = { id: randomUUID(), app: structuredClone(app), principal, workspaceRoot, workspaceReference,
+            permissions: structuredClone(permissions), expiresAt: this.now() + QUICK_APP_LIMITS.lifetimeMs,
+            credentialDigest: digest(credential), abort: new AbortController(), dispose: async () => undefined };
+        this.launches.set(launch.id, launch);
+        return { launch, credential };
+    }
+    authorize(launch, credential) {
+        if (credential !== undefined && !timingSafeEqual(launch.credentialDigest, digest(credential)))
+            throw new QuickAppError(401, 'QUICK_APP_UNAUTHENTICATED', 'App authentication required.');
+        if (this.stopped || this.launches.get(launch.id) !== launch || launch.abort.signal.aborted)
+            throw new QuickAppError(410, 'QUICK_APP_REVOKED', 'This launch has been revoked.');
+        if (launch.expiresAt <= this.now()) {
+            void this.revoke(launch.id).catch(() => undefined);
+            throw new QuickAppError(410, 'QUICK_APP_LAUNCH_EXPIRED', 'This launch has expired.');
+        }
+        let current;
+        try {
+            current = this.registry.get(launch.app.id);
+            this.registry.root(current);
+        }
+        catch {
+            void this.revoke(launch.id).catch(() => undefined);
+            throw new QuickAppError(410, 'QUICK_APP_REVOKED', 'The shortcut was removed.');
+        }
+        if (quickAppDefinitionKey(current) !== quickAppDefinitionKey(launch.app) || this.registry.root(current) !== launch.workspaceReference) {
+            void this.revoke(launch.id).catch(() => undefined);
+            throw new QuickAppError(410, 'QUICK_APP_REVOKED', 'The shortcut or workspace changed.');
+        }
+    }
+    async validateWorkspace(launch) {
+        this.authorize(launch);
+        if (await realpath(launch.workspaceReference) !== launch.workspaceRoot) {
+            void this.revoke(launch.id).catch(() => undefined);
+            throw new QuickAppError(410, 'QUICK_APP_REVOKED', 'The workspace location changed.');
+        }
+    }
+    requireOwner(id, principal) {
+        const launch = this.launches.get(id);
+        if (!launch || launch.principal !== principal)
+            deny();
+        return launch;
+    }
+    async revoke(id) {
+        const launch = this.launches.get(id);
+        if (!launch)
+            return;
+        this.launches.delete(id);
+        launch.abort.abort();
+        await launch.dispose();
+    }
+    async revokeApp(id) { await Promise.all([...this.launches.values()].filter(launch => launch.app.id === id).map(launch => this.revoke(launch.id))); }
+    async prune() { await Promise.all([...this.launches.values()].filter(launch => launch.expiresAt <= this.now()).map(launch => this.revoke(launch.id))); }
+    async dispose() { this.stopped = true; await Promise.all([...this.launches.keys()].map(id => this.revoke(id))); }
+    get size() { return this.launches.size; }
+}
+function digest(value) { return createHash('sha256').update(value).digest(); }
+//# sourceMappingURL=launches.js.map

package/data/build/dist/host/modules/quick-apps/launches.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"launches.js","sourceRoot":"","sources":["../../../../../../src/host/modules/quick-apps/launches.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,aAAa,CAAA;AAClF,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAA;AAE3C,OAAO,EAAE,gBAAgB,EAAE,MAAM,yCAAyC,CAAA;AAC1E,OAAO,EAAE,qBAAqB,EAAyB,MAAM,eAAe,CAAA;AAC5E,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,aAAa,CAAA;AAgBjD,MAAM,OAAO,gBAAgB;IAGE;IAA6C;IAFzD,QAAQ,GAAG,IAAI,GAAG,EAA0B,CAAA;IACrD,OAAO,GAAG,KAAK,CAAA;IACvB,YAA6B,QAA0B,EAAmB,MAAM,IAAI,CAAC,GAAG;QAA3D,aAAQ,GAAR,QAAQ,CAAkB;QAAmB,QAAG,GAAH,GAAG,CAAW;IAAG,CAAC;IAE5F,KAAK,CAAC,MAAM,CAAC,GAAa,EAAE,SAAiB,EAAE,WAAgC;QAC7E,MAAM,kBAAkB,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QAClD,MAAM,aAAa,GAAG,MAAM,QAAQ,CAAC,kBAAkB,CAAC,CAAA;QACxD,MAAM,IAAI,CAAC,KAAK,EAAE,CAAA;QAClB,IAAI,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,aAAa,CAAC,GAAG,EAAE,mBAAmB,EAAE,yBAAyB,CAAC,CAAA;QAC9F,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,IAAI,gBAAgB,CAAC,QAAQ;YAAE,MAAM,IAAI,aAAa,CAAC,GAAG,EAAE,iBAAiB,EAAE,2BAA2B,CAAC,CAAA;QACjI,MAAM,UAAU,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAA;QACxD,MAAM,MAAM,GAAmB,EAAE,EAAE,EAAE,UAAU,EAAE,EAAE,GAAG,EAAE,eAAe,CAAC,GAAG,CAAC,EAAE,SAAS,EAAE,aAAa,EAAE,kBAAkB;YACxH,WAAW,EAAE,eAAe,CAAC,WAAW,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,gBAAgB,CAAC,UAAU;YAC9F,gBAAgB,EAAE,MAAM,CAAC,UAAU,CAAC,EAAE,KAAK,EAAE,IAAI,eAAe,EAAE,EAAE,OAAO,EAAE,KAAK,IAAI,EAAE,CAAC,SAAS,EAAE,CAAA;QACtG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE,MAAM,CAAC,CAAA;QACpC,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,CAAA;IAC/B,CAAC;IACD,SAAS,CAAC,MAAsB,EAAE,UAAmB;QACnD,IAAI,UAAU,KAAK,SAAS,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,gBAAgB,EAAE,MAAM,CAAC,UAAU,CAAC,CAAC;YAAE,MAAM,IAAI,aAAa,CAAC,GAAG,EAAE,2BAA2B,EAAE,8BAA8B,CAAC,CAAA;QACxL,IAAI,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,KAAK,MAAM,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO;YAAE,MAAM,IAAI,aAAa,CAAC,GAAG,EAAE,mBAAmB,EAAE,+BAA+B,CAAC,CAAA;QAC9K,IAAI,MAAM,CAAC,SAAS,IAAI,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;YAAC,KAAK,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;YAAC,MAAM,IAAI,aAAa,CAAC,GAAG,EAAE,0BAA0B,EAAE,0BAA0B,CAAC,CAAA;QAAC,CAAC;QAChL,IAAI,OAAiB,CAAA;QACrB,IAAI,CAAC;YAAC,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;QAAC,CAAC;QAAC,MAAM,CAAC;YACrF,KAAK,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAA;YAClD,MAAM,IAAI,aAAa,CAAC,GAAG,EAAE,mBAAmB,EAAE,2BAA2B,CAAC,CAAA;QAChF,CAAC;QACD,IAAI,qBAAqB,CAAC,OAAO,CAAC,KAAK,qBAAqB,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,MAAM,CAAC,kBAAkB,EAAE,CAAC;YACtI,KAAK,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAA;YAClD,MAAM,IAAI,aAAa,CAAC,GAAG,EAAE,mBAAmB,EAAE,oCAAoC,CAAC,CAAA;QACzF,CAAC;IACH,CAAC;IACD,KAAK,CAAC,iBAAiB,CAAC,MAAsB;QAC5C,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAA;QACtB,IAAI,MAAM,QAAQ,CAAC,MAAM,CAAC,kBAAkB,CAAC,KAAK,MAAM,CAAC,aAAa,EAAE,CAAC;YACvE,KAAK,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAA;YAClD,MAAM,IAAI,aAAa,CAAC,GAAG,EAAE,mBAAmB,EAAE,iCAAiC,CAAC,CAAA;QACtF,CAAC;IACH,CAAC;IACD,YAAY,CAAC,EAAU,EAAE,SAAiB;QACxC,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;QACpC,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,SAAS,KAAK,SAAS;YAAE,IAAI,EAAE,CAAA;QACrD,OAAO,MAAM,CAAA;IACf,CAAC;IACD,KAAK,CAAC,MAAM,CAAC,EAAU;QACrB,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;QACpC,IAAI,CAAC,MAAM;YAAE,OAAM;QACnB,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,CAAA;QACxB,MAAM,CAAC,KAAK,CAAC,KAAK,EAAE,CAAA;QACpB,MAAM,MAAM,CAAC,OAAO,EAAE,CAAA;IACxB,CAAC;IACD,KAAK,CAAC,SAAS,CAAC,EAAU,IAAmB,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA,CAAC,CAAC;IAC1K,KAAK,CAAC,KAAK,KAAoB,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,SAAS,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA,CAAC,CAAC;IACtK,KAAK,CAAC,OAAO,KAAoB,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,CAAC,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA,CAAC,CAAC;IAC/H,IAAI,IAAI,KAAa,OAAO,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAA,CAAC,CAAC;CACjD;AAED,SAAS,MAAM,CAAC,KAAa,IAAY,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,EAAE,CAAA,CAAC,CAAC"}