@jsbot-tellus/core 2.5.0 → 2.6.0

package/dist/core/web/server/auth.js

@@ -0,0 +1,68 @@
+import { AuthManager } from '../auth.js';
+import { clearCookie, clientIp, parseCookies, readJsonBody, sendData, sendError, serializeCookie, } from '../http.js';
+import { HttpError } from '../http.js';
+export const SESSION_COOKIE = 'jsbot_webui';
+export function authenticate(auth, req) {
+    const cookies = parseCookies(req.headers.cookie);
+    return auth.authenticate(cookies[SESSION_COOKIE]);
+}
+export function tokenOf(req) {
+    const cookies = parseCookies(req.headers.cookie);
+    return cookies[SESSION_COOKIE];
+}
+export function isSecure(deps, req) {
+    if (!deps.getWebUiConfig().trustProxy)
+        return false;
+    const proto = req.headers['x-forwarded-proto'];
+    return typeof proto === 'string' && proto.split(',')[0]?.trim() === 'https';
+}
+export async function handleAuth(options) {
+    const { req, res, action, auth, deps, bodyLimit } = options;
+    const method = req.method ?? 'GET';
+    if (action === 'login' && method === 'POST') {
+        const body = await readJsonBody(req, bodyLimit);
+        const value = typeof body === 'object' && body !== null
+            ? body
+            : {};
+        const ip = clientIp(req, deps.getWebUiConfig().trustProxy);
+        const result = await auth.login(value['username'], value['password'], ip);
+        if (!result.ok || !result.session) {
+            const headers = {};
+            if (result.retryAfterSeconds !== undefined) {
+                headers['retry-after'] = String(result.retryAfterSeconds);
+            }
+            sendError(res, result.status, result.message ?? 'login failed', undefined, headers);
+            return;
+        }
+        res.setHeader('set-cookie', serializeCookie(SESSION_COOKIE, result.session.token, {
+            maxAgeSeconds: deps.getWebUiConfig().sessionTtlHours * 3600,
+            secure: isSecure(deps, req),
+        }));
+        sendData(res, result.status, {
+            username: result.session.username,
+            expiresAt: result.session.expiresAt,
+        });
+        return;
+    }
+    if (action === 'logout' && method === 'POST') {
+        const session = authenticate(auth, req);
+        auth.logout(tokenOf(req));
+        deps.logger.info(`webui logout: ${session?.username ?? 'unknown'}`);
+        res.setHeader('set-cookie', clearCookie(SESSION_COOKIE));
+        sendData(res, 200, { ok: true });
+        return;
+    }
+    if (action === 'me' && method === 'GET') {
+        const session = authenticate(auth, req);
+        if (session === null) {
+            throw new HttpError(401, '未登录或会话已过期');
+        }
+        sendData(res, 200, {
+            username: session.username,
+            expiresAt: session.expiresAt,
+        });
+        return;
+    }
+    throw new HttpError(404, `not found: ${method} /api/auth/${action ?? ''}`);
+}
+//# sourceMappingURL=auth.js.map

package/dist/core/web/server/auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../../../src/core/web/server/auth.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,WAAW,EAAoB,MAAM,YAAY,CAAA;AAC1D,OAAO,EACH,WAAW,EACX,QAAQ,EACR,YAAY,EACZ,YAAY,EACZ,QAAQ,EACR,SAAS,EACT,eAAe,GAClB,MAAM,YAAY,CAAA;AACnB,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAA;AAGtC,MAAM,CAAC,MAAM,cAAc,GAAG,aAAa,CAAA;AAE3C,MAAM,UAAU,YAAY,CACxB,IAAiB,EACjB,GAAoB;IAEpB,MAAM,OAAO,GAAG,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAA;IAEhD,OAAO,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,CAAA;AACrD,CAAC;AAED,MAAM,UAAU,OAAO,CAAC,GAAoB;IACxC,MAAM,OAAO,GAAG,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAA;IAEhD,OAAO,OAAO,CAAC,cAAc,CAAC,CAAA;AAClC,CAAC;AAED,MAAM,UAAU,QAAQ,CAAC,IAAe,EAAE,GAAoB;IAC1D,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC,UAAU;QAAE,OAAO,KAAK,CAAA;IAEnD,MAAM,KAAK,GAAG,GAAG,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAAA;IAE9C,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,OAAO,CAAA;AAC/E,CAAC;AAWD,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,OAA0B;IACvD,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,OAAO,CAAA;IAC3D,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,IAAI,KAAK,CAAA;IAElC,IAAI,MAAM,KAAK,OAAO,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;QAC1C,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,GAAG,EAAE,SAAS,CAAC,CAAA;QAC/C,MAAM,KAAK,GACP,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI;YACrC,CAAC,CAAE,IAAgC;YACnC,CAAC,CAAC,EAAE,CAAA;QACZ,MAAM,EAAE,GAAG,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC,cAAc,EAAE,CAAC,UAAU,CAAC,CAAA;QAC1D,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAC3B,KAAK,CAAC,UAAU,CAAC,EACjB,KAAK,CAAC,UAAU,CAAC,EACjB,EAAE,CACL,CAAA;QAED,IAAI,CAAC,MAAM,CAAC,EAAE,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YAChC,MAAM,OAAO,GAAuC,EAAE,CAAA;YAEtD,IAAI,MAAM,CAAC,iBAAiB,KAAK,SAAS,EAAE,CAAC;gBACzC,OAAO,CAAC,aAAa,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAA;YAC7D,CAAC;YAED,SAAS,CACL,GAAG,EACH,MAAM,CAAC,MAAM,EACb,MAAM,CAAC,OAAO,IAAI,cAAc,EAChC,SAAS,EACT,OAAO,CACV,CAAA;YAED,OAAM;QACV,CAAC;QAED,GAAG,CAAC,SAAS,CACT,YAAY,EACZ,eAAe,CAAC,cAAc,EAAE,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE;YAClD,aAAa,EAAE,IAAI,CAAC,cAAc,EAAE,CAAC,eAAe,GAAG,IAAI;YAC3D,MAAM,EAAE,QAAQ,CAAC,IAAI,EAAE,GAAG,CAAC;SAC9B,CAAC,CACL,CAAA;QACD,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE;YACzB,QAAQ,EAAE,MAAM,CAAC,OAAO,CAAC,QAAQ;YACjC,SAAS,EAAE,MAAM,CAAC,OAAO,CAAC,SAAS;SACtC,CAAC,CAAA;QAEF,OAAM;IACV,CAAC;IAED,IAAI,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;QAC3C,MAAM,OAAO,GAAG,YAAY,CAAC,IAAI,EAAE,GAAG,CAAC,CAAA;QAEvC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAA;QACzB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,iBAAiB,OAAO,EAAE,QAAQ,IAAI,SAAS,EAAE,CAAC,CAAA;QACnE,GAAG,CAAC,SAAS,CAAC,YAAY,EAAE,WAAW,CAAC,cAAc,CAAC,CAAC,CAAA;QACxD,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAA;QAEhC,OAAM;IACV,CAAC;IAED,IAAI,MAAM,KAAK,IAAI,IAAI,MAAM,KAAK,KAAK,EAAE,CAAC;QACtC,MAAM,OAAO,GAAG,YAAY,CAAC,IAAI,EAAE,GAAG,CAAC,CAAA;QAEvC,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;YACnB,MAAM,IAAI,SAAS,CAAC,GAAG,EAAE,WAAW,CAAC,CAAA;QACzC,CAAC;QAED,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE;YACf,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,SAAS,EAAE,OAAO,CAAC,SAAS;SAC/B,CAAC,CAAA;QAEF,OAAM;IACV,CAAC;IAED,MAAM,IAAI,SAAS,CAAC,GAAG,EAAE,cAAc,MAAM,cAAc,MAAM,IAAI,EAAE,EAAE,CAAC,CAAA;AAC9E,CAAC"}

package/dist/core/web/server/csp.d.ts

@@ -0,0 +1,11 @@
+/**
+ * CSP for the WebUI. webui/index.html ships a single authorized inline
+ * script (the no-flash appearance bootstrap for the first paint); its exact
+ * hash is derived from the built index.html on disk so editing the bootstrap
+ * only needs a rebuild, never a source edit. Every other inline script
+ * stays blocked.
+ */
+export declare function buildCsp(scriptSrc: string): string;
+/** Extracts the bootstrap script's sha256 from a built index.html. */
+export declare function cspForStaticDir(staticDir: string): string | null;
+//# sourceMappingURL=csp.d.ts.map

package/dist/core/web/server/csp.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"csp.d.ts","sourceRoot":"","sources":["../../../../src/core/web/server/csp.ts"],"names":[],"mappings":"AAIA;;;;;;GAMG;AACH,wBAAgB,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAElD;AAED,sEAAsE;AACtE,wBAAgB,eAAe,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAgBhE"}

package/dist/core/web/server/csp.js

@@ -0,0 +1,31 @@
+import { createHash } from 'node:crypto';
+import { readFileSync } from 'node:fs';
+import { join } from 'node:path';
+/**
+ * CSP for the WebUI. webui/index.html ships a single authorized inline
+ * script (the no-flash appearance bootstrap for the first paint); its exact
+ * hash is derived from the built index.html on disk so editing the bootstrap
+ * only needs a rebuild, never a source edit. Every other inline script
+ * stays blocked.
+ */
+export function buildCsp(scriptSrc) {
+    return `default-src 'self'; img-src 'self' data:; style-src 'self' 'unsafe-inline'; script-src ${scriptSrc}; connect-src 'self'; frame-ancestors 'none'; base-uri 'none'; form-action 'self'`;
+}
+/** Extracts the bootstrap script's sha256 from a built index.html. */
+export function cspForStaticDir(staticDir) {
+    try {
+        const html = readFileSync(join(staticDir, 'index.html'), 'utf8');
+        const match = /<script>([\s\S]*?)<\/script>/.exec(html);
+        const bootstrap = match?.[1];
+        if (bootstrap === undefined)
+            return null;
+        const hash = createHash('sha256')
+            .update(bootstrap, 'utf8')
+            .digest('base64');
+        return buildCsp(`'self' 'sha256-${hash}'`);
+    }
+    catch {
+        return null;
+    }
+}
+//# sourceMappingURL=csp.js.map

package/dist/core/web/server/csp.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"csp.js","sourceRoot":"","sources":["../../../../src/core/web/server/csp.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AACxC,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAA;AACtC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAEhC;;;;;;GAMG;AACH,MAAM,UAAU,QAAQ,CAAC,SAAiB;IACtC,OAAO,0FAA0F,SAAS,mFAAmF,CAAA;AACjM,CAAC;AAED,sEAAsE;AACtE,MAAM,UAAU,eAAe,CAAC,SAAiB;IAC7C,IAAI,CAAC;QACD,MAAM,IAAI,GAAG,YAAY,CAAC,IAAI,CAAC,SAAS,EAAE,YAAY,CAAC,EAAE,MAAM,CAAC,CAAA;QAChE,MAAM,KAAK,GAAG,8BAA8B,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QACvD,MAAM,SAAS,GAAG,KAAK,EAAE,CAAC,CAAC,CAAC,CAAA;QAE5B,IAAI,SAAS,KAAK,SAAS;YAAE,OAAO,IAAI,CAAA;QAExC,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC;aAC5B,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC;aACzB,MAAM,CAAC,QAAQ,CAAC,CAAA;QAErB,OAAO,QAAQ,CAAC,kBAAkB,IAAI,GAAG,CAAC,CAAA;IAC9C,CAAC;IAAC,MAAM,CAAC;QACL,OAAO,IAAI,CAAA;IACf,CAAC;AACL,CAAC"}

package/dist/core/web/server/request.d.ts

@@ -0,0 +1,6 @@
+import type { IncomingMessage } from 'node:http';
+import type { URLSearchParamsLike } from '../http.js';
+export declare function parseSearch(req: IncomingMessage): URLSearchParamsLike;
+export declare function segmentsOf(pathname: string): string[];
+export declare function pathnameOf(req: IncomingMessage): string;
+//# sourceMappingURL=request.d.ts.map

package/dist/core/web/server/request.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"request.d.ts","sourceRoot":"","sources":["../../../../src/core/web/server/request.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,WAAW,CAAA;AAChD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAA;AAErD,wBAAgB,WAAW,CAAC,GAAG,EAAE,eAAe,GAAG,mBAAmB,CAKrE;AAED,wBAAgB,UAAU,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,EAAE,CAWrD;AAED,wBAAgB,UAAU,CAAC,GAAG,EAAE,eAAe,GAAG,MAAM,CAcvD"}

package/dist/core/web/server/request.js

@@ -0,0 +1,33 @@
+export function parseSearch(req) {
+    const index = (req.url ?? '').indexOf('?');
+    const query = index >= 0 ? (req.url ?? '').slice(index + 1) : '';
+    return new URLSearchParams(query);
+}
+export function segmentsOf(pathname) {
+    return pathname
+        .split('/')
+        .filter((segment) => segment.length > 0)
+        .map((segment) => {
+        try {
+            return decodeURIComponent(segment);
+        }
+        catch {
+            return segment;
+        }
+    });
+}
+export function pathnameOf(req) {
+    const url = req.url ?? '/';
+    const index = url.indexOf('?');
+    const raw = index >= 0 ? url.slice(0, index) : url;
+    if (raw.includes('%')) {
+        try {
+            return decodeURIComponent(raw);
+        }
+        catch {
+            return raw;
+        }
+    }
+    return raw;
+}
+//# sourceMappingURL=request.js.map

package/dist/core/web/server/request.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"request.js","sourceRoot":"","sources":["../../../../src/core/web/server/request.ts"],"names":[],"mappings":"AAGA,MAAM,UAAU,WAAW,CAAC,GAAoB;IAC5C,MAAM,KAAK,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;IAC1C,MAAM,KAAK,GAAG,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;IAEhE,OAAO,IAAI,eAAe,CAAC,KAAK,CAAC,CAAA;AACrC,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,QAAgB;IACvC,OAAO,QAAQ;SACV,KAAK,CAAC,GAAG,CAAC;SACV,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC;SACvC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE;QACb,IAAI,CAAC;YACD,OAAO,kBAAkB,CAAC,OAAO,CAAC,CAAA;QACtC,CAAC;QAAC,MAAM,CAAC;YACL,OAAO,OAAO,CAAA;QAClB,CAAC;IACL,CAAC,CAAC,CAAA;AACV,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,GAAoB;IAC3C,MAAM,GAAG,GAAG,GAAG,CAAC,GAAG,IAAI,GAAG,CAAA;IAC1B,MAAM,KAAK,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;IAC9B,MAAM,GAAG,GAAG,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAA;IAElD,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QACpB,IAAI,CAAC;YACD,OAAO,kBAAkB,CAAC,GAAG,CAAC,CAAA;QAClC,CAAC;QAAC,MAAM,CAAC;YACL,OAAO,GAAG,CAAA;QACd,CAAC;IACL,CAAC;IAED,OAAO,GAAG,CAAA;AACd,CAAC"}

package/dist/core/web/server/security.d.ts

@@ -0,0 +1,4 @@
+import type { ServerResponse } from 'node:http';
+export declare const SECURITY_HEADERS: Record<string, string>;
+export declare function applySecurityHeaders(res: ServerResponse): void;
+//# sourceMappingURL=security.d.ts.map

package/dist/core/web/server/security.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"security.d.ts","sourceRoot":"","sources":["../../../../src/core/web/server/security.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,WAAW,CAAA;AAE/C,eAAO,MAAM,gBAAgB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAKnD,CAAA;AAED,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,cAAc,GAAG,IAAI,CAI9D"}

package/dist/core/web/server/security.js

@@ -0,0 +1,12 @@
+export const SECURITY_HEADERS = {
+    'x-content-type-options': 'nosniff',
+    'x-frame-options': 'DENY',
+    'referrer-policy': 'no-referrer',
+    'cross-origin-opener-policy': 'same-origin',
+};
+export function applySecurityHeaders(res) {
+    for (const [key, value] of Object.entries(SECURITY_HEADERS)) {
+        res.setHeader(key, value);
+    }
+}
+//# sourceMappingURL=security.js.map

package/dist/core/web/server/security.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"security.js","sourceRoot":"","sources":["../../../../src/core/web/server/security.ts"],"names":[],"mappings":"AAEA,MAAM,CAAC,MAAM,gBAAgB,GAA2B;IACpD,wBAAwB,EAAE,SAAS;IACnC,iBAAiB,EAAE,MAAM;IACzB,iBAAiB,EAAE,aAAa;IAChC,4BAA4B,EAAE,aAAa;CAC9C,CAAA;AAED,MAAM,UAAU,oBAAoB,CAAC,GAAmB;IACpD,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,gBAAgB,CAAC,EAAE,CAAC;QAC1D,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,KAAK,CAAC,CAAA;IAC7B,CAAC;AACL,CAAC"}

package/dist/core/web/server/sse.d.ts

@@ -0,0 +1,18 @@
+import type { IncomingMessage, ServerResponse } from 'node:http';
+export declare const SSE_HEARTBEAT_MS = 15000;
+export declare const DEFAULT_MAX_SSE_CLIENTS = 20;
+export declare const SSE_TIMEOUT_MS = 60000;
+export interface SseConnection {
+    res: ServerResponse;
+    close(): void;
+}
+export interface OpenSseOptions {
+    req: IncomingMessage;
+    res: ServerResponse;
+    subscribe: (listener: (entry: unknown) => void) => () => void;
+    openedAt: number;
+    maxClients: number;
+    connections: Set<SseConnection>;
+}
+export declare function openSse(options: OpenSseOptions): void;
+//# sourceMappingURL=sse.d.ts.map

package/dist/core/web/server/sse.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sse.d.ts","sourceRoot":"","sources":["../../../../src/core/web/server/sse.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,WAAW,CAAA;AAGhE,eAAO,MAAM,gBAAgB,QAAS,CAAA;AACtC,eAAO,MAAM,uBAAuB,KAAK,CAAA;AACzC,eAAO,MAAM,cAAc,QAAS,CAAA;AAEpC,MAAM,WAAW,aAAa;IAC1B,GAAG,EAAE,cAAc,CAAA;IACnB,KAAK,IAAI,IAAI,CAAA;CAChB;AAED,MAAM,WAAW,cAAc;IAC3B,GAAG,EAAE,eAAe,CAAA;IACpB,GAAG,EAAE,cAAc,CAAA;IACnB,SAAS,EAAE,CAAC,QAAQ,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,IAAI,KAAK,MAAM,IAAI,CAAA;IAC7D,QAAQ,EAAE,MAAM,CAAA;IAChB,UAAU,EAAE,MAAM,CAAA;IAClB,WAAW,EAAE,GAAG,CAAC,aAAa,CAAC,CAAA;CAClC;AAED,wBAAgB,OAAO,CAAC,OAAO,EAAE,cAAc,GAAG,IAAI,CAoDrD"}

package/dist/core/web/server/sse.js

@@ -0,0 +1,49 @@
+import { HttpError, safeStringify } from '../http.js';
+export const SSE_HEARTBEAT_MS = 15_000;
+export const DEFAULT_MAX_SSE_CLIENTS = 20;
+export const SSE_TIMEOUT_MS = 60_000;
+export function openSse(options) {
+    const { req, res, subscribe, openedAt, maxClients, connections } = options;
+    if (connections.size >= maxClients) {
+        throw new HttpError(503, '实时连接数量已达上限');
+    }
+    res.writeHead(200, {
+        'content-type': 'text/event-stream; charset=utf-8',
+        'cache-control': 'no-store, no-transform',
+        connection: 'keep-alive',
+    });
+    res.write(':ok\n\n');
+    const connection = {
+        res,
+        close: () => {
+            unsubscribe();
+            clearInterval(heartbeat);
+            connections.delete(connection);
+            try {
+                res.end();
+            }
+            catch {
+                // Already closed.
+            }
+        },
+    };
+    let closing = false;
+    const unsubscribe = subscribe((entry) => {
+        if (closing)
+            return;
+        res.write(`data: ${safeStringify(entry)}\n\n`);
+    });
+    const heartbeat = setInterval(() => {
+        res.write(`:keepalive ${Date.now() - openedAt}\n\n`);
+    }, SSE_HEARTBEAT_MS);
+    req.on('close', () => {
+        if (closing)
+            return;
+        closing = true;
+        unsubscribe();
+        clearInterval(heartbeat);
+        connections.delete(connection);
+    });
+    connections.add(connection);
+}
+//# sourceMappingURL=sse.js.map

package/dist/core/web/server/sse.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sse.js","sourceRoot":"","sources":["../../../../src/core/web/server/sse.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,YAAY,CAAA;AAErD,MAAM,CAAC,MAAM,gBAAgB,GAAG,MAAM,CAAA;AACtC,MAAM,CAAC,MAAM,uBAAuB,GAAG,EAAE,CAAA;AACzC,MAAM,CAAC,MAAM,cAAc,GAAG,MAAM,CAAA;AAgBpC,MAAM,UAAU,OAAO,CAAC,OAAuB;IAC3C,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,SAAS,EAAE,QAAQ,EAAE,UAAU,EAAE,WAAW,EAAE,GAAG,OAAO,CAAA;IAE1E,IAAI,WAAW,CAAC,IAAI,IAAI,UAAU,EAAE,CAAC;QACjC,MAAM,IAAI,SAAS,CAAC,GAAG,EAAE,YAAY,CAAC,CAAA;IAC1C,CAAC;IAED,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE;QACf,cAAc,EAAE,kCAAkC;QAClD,eAAe,EAAE,wBAAwB;QACzC,UAAU,EAAE,YAAY;KAC3B,CAAC,CAAA;IACF,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,CAAA;IAEpB,MAAM,UAAU,GAAkB;QAC9B,GAAG;QACH,KAAK,EAAE,GAAG,EAAE;YACR,WAAW,EAAE,CAAA;YACb,aAAa,CAAC,SAAS,CAAC,CAAA;YACxB,WAAW,CAAC,MAAM,CAAC,UAAU,CAAC,CAAA;YAE9B,IAAI,CAAC;gBACD,GAAG,CAAC,GAAG,EAAE,CAAA;YACb,CAAC;YAAC,MAAM,CAAC;gBACL,kBAAkB;YACtB,CAAC;QACL,CAAC;KACJ,CAAA;IAED,IAAI,OAAO,GAAG,KAAK,CAAA;IAEnB,MAAM,WAAW,GAAG,SAAS,CAAC,CAAC,KAAK,EAAE,EAAE;QACpC,IAAI,OAAO;YAAE,OAAM;QAEnB,GAAG,CAAC,KAAK,CAAC,SAAS,aAAa,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;IAClD,CAAC,CAAC,CAAA;IAEF,MAAM,SAAS,GAAG,WAAW,CAAC,GAAG,EAAE;QAC/B,GAAG,CAAC,KAAK,CAAC,cAAc,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,MAAM,CAAC,CAAA;IACxD,CAAC,EAAE,gBAAgB,CAAC,CAAA;IAEpB,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;QACjB,IAAI,OAAO;YAAE,OAAM;QAEnB,OAAO,GAAG,IAAI,CAAA;QAEd,WAAW,EAAE,CAAA;QACb,aAAa,CAAC,SAAS,CAAC,CAAA;QACxB,WAAW,CAAC,MAAM,CAAC,UAAU,CAAC,CAAA;IAClC,CAAC,CAAC,CAAA;IAEF,WAAW,CAAC,GAAG,CAAC,UAAU,CAAC,CAAA;AAC/B,CAAC"}

package/dist/core/web/server/static.d.ts

@@ -0,0 +1,16 @@
+import { stat } from 'node:fs/promises';
+import type { IncomingMessage, ServerResponse } from 'node:http';
+export interface FallbackPageOptions {
+    listening: string;
+}
+export declare const FALLBACK_BODY: (options: FallbackPageOptions) => string;
+export interface ServeStaticOptions {
+    req: IncomingMessage;
+    res: ServerResponse;
+    pathname: string;
+    staticDir: string | null;
+    fallbackBody: string;
+}
+export declare function serveStatic(options: ServeStaticOptions): Promise<void>;
+export declare function statOrNull(filePath: string): Promise<Awaited<ReturnType<typeof stat>> | null>;
+//# sourceMappingURL=static.d.ts.map

package/dist/core/web/server/static.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"static.d.ts","sourceRoot":"","sources":["../../../../src/core/web/server/static.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAA;AACvC,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,WAAW,CAAA;AAIhE,MAAM,WAAW,mBAAmB;IAChC,SAAS,EAAE,MAAM,CAAA;CACpB;AAED,eAAO,MAAM,aAAa,YACb,mBAAmB,KAC7B,MAWF,CAAA;AAED,MAAM,WAAW,kBAAkB;IAC/B,GAAG,EAAE,eAAe,CAAA;IACpB,GAAG,EAAE,cAAc,CAAA;IACnB,QAAQ,EAAE,MAAM,CAAA;IAChB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;IACxB,YAAY,EAAE,MAAM,CAAA;CACvB;AAED,wBAAsB,WAAW,CAAC,OAAO,EAAE,kBAAkB,GAAG,OAAO,CAAC,IAAI,CAAC,CAoE5E;AAED,wBAAsB,UAAU,CAC5B,QAAQ,EAAE,MAAM,GACjB,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,OAAO,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC,CAMlD"}

package/dist/core/web/server/static.js

@@ -0,0 +1,80 @@
+import { createReadStream } from 'node:fs';
+import { stat } from 'node:fs/promises';
+import { extname, join, resolve, sep } from 'node:path';
+import { HttpError, isImmutableAsset, mimeType, withTimeout } from '../http.js';
+export const FALLBACK_BODY = (options) => `<!doctype html>
+<html lang="zh-CN"><head><meta charset="utf-8">
+<title>JsBot WebUI</title>
+<style>body{font-family:system-ui,sans-serif;max-width:36em;margin:4rem auto;padding:0 1rem;color:#333}</style>
+</head><body>
+<h1>WebUI 前端未构建</h1>
+<p>管理 API 正常运行，但静态资源缺失。请在项目根目录执行：</p>
+<pre><code>npm run build:webui</code></pre>
+<p>然后重启进程，访问 <code>${options.listening}</code>。</p>
+<p>API 仍可通过 <code>/api/health</code>、登录和各接口访问。</p>
+</body></html>
+`;
+export async function serveStatic(options) {
+    const { req, res, pathname, staticDir, fallbackBody } = options;
+    if (req.method !== 'GET' && req.method !== 'HEAD') {
+        throw new HttpError(405, `method not allowed: ${req.method}`);
+    }
+    if (staticDir === null) {
+        res.setHeader('content-type', 'text/html; charset=utf-8');
+        res.setHeader('cache-control', 'no-store');
+        res.writeHead(503);
+        res.end(fallbackBody);
+        return;
+    }
+    const cleaned = pathname.replace(/\/+$/, '') || '/';
+    let filePath = cleaned === '/'
+        ? join(staticDir, 'index.html')
+        : resolve(staticDir, `.${cleaned}`);
+    if (!filePath.startsWith(staticDir + sep) && filePath !== staticDir) {
+        throw new HttpError(403, 'forbidden');
+    }
+    let fileStat = await statOrNull(filePath);
+    if (fileStat?.isDirectory()) {
+        filePath = join(filePath, 'index.html');
+        fileStat = await statOrNull(filePath);
+    }
+    if (fileStat === null) {
+        // SPA fallback: only routes without a file extension.
+        if (extname(cleaned) === '') {
+            filePath = join(staticDir, 'index.html');
+            fileStat = await statOrNull(filePath);
+        }
+        if (fileStat === null)
+            throw new HttpError(404, 'not found');
+    }
+    const cacheControl = isImmutableAsset(cleaned)
+        ? 'public, max-age=31536000, immutable'
+        : 'no-cache';
+    res.setHeader('content-type', mimeType(filePath));
+    res.setHeader('cache-control', cacheControl);
+    res.setHeader('content-length', String(fileStat.size));
+    res.writeHead(200);
+    if (req.method === 'HEAD') {
+        res.end();
+        return;
+    }
+    const stream = createReadStream(filePath);
+    stream.on('error', () => {
+        try {
+            res.end();
+        }
+        catch {
+            // Already closed.
+        }
+    });
+    stream.pipe(res);
+}
+export async function statOrNull(filePath) {
+    try {
+        return await withTimeout(stat(filePath), 1_000);
+    }
+    catch {
+        return null;
+    }
+}
+//# sourceMappingURL=static.js.map

package/dist/core/web/server/static.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"static.js","sourceRoot":"","sources":["../../../../src/core/web/server/static.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,SAAS,CAAA;AAC1C,OAAO,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAA;AAEvC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,WAAW,CAAA;AACvD,OAAO,EAAE,SAAS,EAAE,gBAAgB,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,YAAY,CAAA;AAM/E,MAAM,CAAC,MAAM,aAAa,GAAG,CACzB,OAA4B,EACtB,EAAE,CAAC;;;;;;;;qBAQQ,OAAO,CAAC,SAAS;;;CAGrC,CAAA;AAUD,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,OAA2B;IACzD,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,QAAQ,EAAE,SAAS,EAAE,YAAY,EAAE,GAAG,OAAO,CAAA;IAE/D,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;QAChD,MAAM,IAAI,SAAS,CAAC,GAAG,EAAE,uBAAuB,GAAG,CAAC,MAAM,EAAE,CAAC,CAAA;IACjE,CAAC;IAED,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;QACrB,GAAG,CAAC,SAAS,CAAC,cAAc,EAAE,0BAA0B,CAAC,CAAA;QACzD,GAAG,CAAC,SAAS,CAAC,eAAe,EAAE,UAAU,CAAC,CAAA;QAC1C,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAA;QAClB,GAAG,CAAC,GAAG,CAAC,YAAY,CAAC,CAAA;QAErB,OAAM;IACV,CAAC;IAED,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,GAAG,CAAA;IACnD,IAAI,QAAQ,GACR,OAAO,KAAK,GAAG;QACX,CAAC,CAAC,IAAI,CAAC,SAAS,EAAE,YAAY,CAAC;QAC/B,CAAC,CAAC,OAAO,CAAC,SAAS,EAAE,IAAI,OAAO,EAAE,CAAC,CAAA;IAE3C,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,SAAS,GAAG,GAAG,CAAC,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAClE,MAAM,IAAI,SAAS,CAAC,GAAG,EAAE,WAAW,CAAC,CAAA;IACzC,CAAC;IAED,IAAI,QAAQ,GAAG,MAAM,UAAU,CAAC,QAAQ,CAAC,CAAA;IAEzC,IAAI,QAAQ,EAAE,WAAW,EAAE,EAAE,CAAC;QAC1B,QAAQ,GAAG,IAAI,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAA;QACvC,QAAQ,GAAG,MAAM,UAAU,CAAC,QAAQ,CAAC,CAAA;IACzC,CAAC;IAED,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;QACpB,sDAAsD;QACtD,IAAI,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC;YAC1B,QAAQ,GAAG,IAAI,CAAC,SAAS,EAAE,YAAY,CAAC,CAAA;YACxC,QAAQ,GAAG,MAAM,UAAU,CAAC,QAAQ,CAAC,CAAA;QACzC,CAAC;QAED,IAAI,QAAQ,KAAK,IAAI;YAAE,MAAM,IAAI,SAAS,CAAC,GAAG,EAAE,WAAW,CAAC,CAAA;IAChE,CAAC;IAED,MAAM,YAAY,GAAG,gBAAgB,CAAC,OAAO,CAAC;QAC1C,CAAC,CAAC,qCAAqC;QACvC,CAAC,CAAC,UAAU,CAAA;IAEhB,GAAG,CAAC,SAAS,CAAC,cAAc,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAA;IACjD,GAAG,CAAC,SAAS,CAAC,eAAe,EAAE,YAAY,CAAC,CAAA;IAC5C,GAAG,CAAC,SAAS,CAAC,gBAAgB,EAAE,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAA;IACtD,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAA;IAElB,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;QACxB,GAAG,CAAC,GAAG,EAAE,CAAA;QAET,OAAM;IACV,CAAC;IAED,MAAM,MAAM,GAAG,gBAAgB,CAAC,QAAQ,CAAC,CAAA;IAEzC,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;QACpB,IAAI,CAAC;YACD,GAAG,CAAC,GAAG,EAAE,CAAA;QACb,CAAC;QAAC,MAAM,CAAC;YACL,kBAAkB;QACtB,CAAC;IACL,CAAC,CAAC,CAAA;IACF,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;AACpB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,UAAU,CAC5B,QAAgB;IAEhB,IAAI,CAAC;QACD,OAAO,MAAM,WAAW,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,KAAK,CAAC,CAAA;IACnD,CAAC;IAAC,MAAM,CAAC;QACL,OAAO,IAAI,CAAA;IACf,CAAC;AACL,CAAC"}

package/dist/core/web/server.d.ts

@@ -19,12 +19,5 @@ export declare class WebUiServer {
     invalidateSessions(): void;
     private applySecurityHeaders;
     private handleRequest;
-    private authenticate;
-    private handleAuth;
-    private tokenOf;
-    private isSecure;
-    private openSse;
-    private serveStatic;
-    private statOrNull;
 }
 //# sourceMappingURL=server.d.ts.map

package/dist/core/web/server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../../src/core/web/server.ts"],"names":[],"mappings":"AA+BA,OAAO,KAAK,EAAE,YAAY,EAAa,kBAAkB,EAAE,MAAM,YAAY,CAAA;AA6H7E,qBAAa,WAAW;IACpB,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAW;IAChC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAQ;IACtC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAQ;IAClC,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAoB;IACrD,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAoB;IAClD,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAa;IAClC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAA2B;IAC/C,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAQ;IAErC,OAAO,CAAC,UAAU,CAAsB;IACxC,OAAO,CAAC,SAAS,CAA4B;IAC7C,OAAO,CAAC,QAAQ,CAAsB;IAEtC,YAAY,OAAO,EAAE,kBAAkB,EAoBtC;IAED,IAAI,OAAO,IAAI,YAAY,GAAG,IAAI,CAEjC;IAEK,KAAK,CACP,MAAM,EAAE,kBAAkB,CAAC,QAAQ,CAAC,GACrC,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CA0C9B;IAED,IAAI,eAAe,IAAI,OAAO,CAE7B;IAEK,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,CAgB1B;IAED,kBAAkB,IAAI,IAAI,CAEzB;IAED,OAAO,CAAC,oBAAoB;YAkBd,aAAa;IAoF3B,OAAO,CAAC,YAAY;YAMN,UAAU;IAwFxB,OAAO,CAAC,OAAO;IAMf,OAAO,CAAC,QAAQ;IAUhB,OAAO,CAAC,OAAO;YAyDD,WAAW;YA0EX,UAAU;CAS3B"}
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../../src/core/web/server.ts"],"names":[],"mappings":"AAyBA,OAAO,KAAK,EAAE,YAAY,EAAa,kBAAkB,EAAE,MAAM,YAAY,CAAA;AAwB7E,qBAAa,WAAW;IACpB,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAW;IAChC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAQ;IACtC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAQ;IAClC,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAoB;IACrD,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAoB;IAClD,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAa;IAClC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAA2B;IAC/C,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAQ;IAErC,OAAO,CAAC,UAAU,CAAsB;IACxC,OAAO,CAAC,SAAS,CAA4B;IAC7C,OAAO,CAAC,QAAQ,CAAsB;IAEtC,YAAY,OAAO,EAAE,kBAAkB,EAoBtC;IAED,IAAI,OAAO,IAAI,YAAY,GAAG,IAAI,CAEjC;IAEK,KAAK,CACP,MAAM,EAAE,kBAAkB,CAAC,QAAQ,CAAC,GACrC,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CA0C9B;IAED,IAAI,eAAe,IAAI,OAAO,CAE7B;IAEK,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,CAgB1B;IAED,kBAAkB,IAAI,IAAI,CAEzB;IAED,OAAO,CAAC,oBAAoB;YAgBd,aAAa;CAqG9B"}