@kelloggt/dsh-program-agents 0.0.0-stage → 0.1.1

package/dist/app/mailbox.js

@@ -0,0 +1,173 @@
+import { randomBytes, randomUUID, timingSafeEqual } from 'node:crypto';
+import { chmodSync, mkdirSync } from 'node:fs';
+import { dirname, resolve } from 'node:path';
+import { DatabaseSync } from 'node:sqlite';
+import { setTimeout as delay } from 'node:timers/promises';
+import { assertJson, ProgramError } from '../runtime/protocol.js';
+/** Durable at-least-once queue. Acceptance is not app processing; only explicit ack records that. */
+export class MessageStore {
+    db;
+    maxPending;
+    maxMessages;
+    clock;
+    closed = false;
+    constructor(path, options = {}) {
+        if (!options || typeof options !== 'object' || Array.isArray(options) || options.clock !== undefined && typeof options.clock !== 'function')
+            throw new ProgramError('INVALID_CONFIG', 'Invalid message store options');
+        this.maxPending = options.maxPendingPerProgram === undefined ? 1000 : options.maxPendingPerProgram;
+        this.maxMessages = options.maxMessages === undefined ? 10_000 : options.maxMessages;
+        this.clock = options.clock ?? Date.now;
+        if (!Number.isSafeInteger(this.maxPending) || this.maxPending < 1 || this.maxPending > 10_000 || !Number.isSafeInteger(this.maxMessages) || this.maxMessages < this.maxPending || this.maxMessages > 100_000)
+            throw new ProgramError('INVALID_CONFIG', 'Invalid message store limits');
+        if (path !== ':memory:') {
+            path = resolve(path);
+            mkdirSync(dirname(path), { recursive: true, mode: 0o700 });
+        }
+        this.db = new DatabaseSync(path);
+        if (path !== ':memory:')
+            chmodSync(path, 0o600);
+        this.db.exec(`PRAGMA journal_mode = WAL; PRAGMA busy_timeout = 1000;
+      CREATE TABLE IF NOT EXISTS app_messages (
+        id TEXT PRIMARY KEY, owner_id TEXT NOT NULL, program TEXT NOT NULL,
+        sender TEXT NOT NULL, body TEXT NOT NULL, correlation_id TEXT,
+        created_at INTEGER NOT NULL, claimed_at INTEGER, acked_at INTEGER,
+        lease_until INTEGER, lease_token TEXT, claimant TEXT,
+        attempts INTEGER NOT NULL DEFAULT 0
+      );
+      CREATE INDEX IF NOT EXISTS app_messages_inbox ON app_messages(owner_id, program, acked_at, created_at);
+    `);
+    }
+    send(scope, message) {
+        this.checkScope(scope);
+        if (!message || typeof message !== 'object' || Array.isArray(message) || typeof message.from !== 'string' || !message.from || message.from.length > 1024 || message.correlationId !== undefined && (typeof message.correlationId !== 'string' || message.correlationId.length > 256))
+            throw new ProgramError('INVALID_INPUT', 'Invalid message metadata');
+        assertJson(message.body);
+        // Reserve framing space for id, receipt timestamps, and the opaque claim token.
+        // Never accept durable work that cannot later cross the bounded bridge.
+        if (Buffer.byteLength(JSON.stringify(message)) > 60 * 1024)
+            throw new ProgramError('LIMIT', 'Inbox message exceeds 60 KiB');
+        return this.transaction(() => {
+            const count = this.db.prepare('SELECT count(*) AS count FROM app_messages WHERE owner_id=? AND program=? AND acked_at IS NULL').get(scope.ownerId, scope.program);
+            if (count.count >= this.maxPending)
+                throw new ProgramError('BACKPRESSURE', 'Program inbox is full');
+            // Receipts are retained across restarts, but are a bounded operational history.
+            const total = this.db.prepare('SELECT count(*) AS count FROM app_messages').get().count;
+            if (total >= this.maxMessages)
+                this.db.prepare('DELETE FROM app_messages WHERE id IN (SELECT id FROM app_messages WHERE acked_at IS NOT NULL ORDER BY acked_at LIMIT ?)').run(total - this.maxMessages + 1);
+            if (this.db.prepare('SELECT count(*) AS count FROM app_messages').get().count >= this.maxMessages)
+                throw new ProgramError('BACKPRESSURE', 'Message store is full');
+            const id = randomUUID();
+            this.db.prepare('INSERT INTO app_messages (id,owner_id,program,sender,body,correlation_id,created_at) VALUES (?,?,?,?,?,?,?)').run(id, scope.ownerId, scope.program, message.from, JSON.stringify(message.body), message.correlationId ?? null, this.clock());
+            return this.receipt(scope, id);
+        });
+    }
+    async receive(scope, options = {}, signal) {
+        this.checkScope(scope);
+        if (!options || typeof options !== 'object' || Array.isArray(options))
+            throw new ProgramError('INVALID_INPUT', 'Invalid receive options');
+        const waitMs = this.bound(options.waitMs === undefined ? 0 : options.waitMs, 'waitMs', 0, 30_000);
+        const leaseMs = this.bound(options.leaseMs === undefined ? 60_000 : options.leaseMs, 'leaseMs', 1, 300_000);
+        const deadline = Date.now() + waitMs;
+        do {
+            if (signal?.aborted)
+                throw new ProgramError('CANCELLED', 'Inbox receive was cancelled');
+            this.checkScope(scope);
+            const found = this.transaction(() => {
+                const now = this.clock();
+                const row = this.db.prepare('SELECT * FROM app_messages WHERE owner_id=? AND program=? AND acked_at IS NULL AND (lease_until IS NULL OR lease_until<=?) ORDER BY created_at,rowid LIMIT 1').get(scope.ownerId, scope.program, now);
+                if (!row)
+                    return null;
+                const token = randomBytes(32).toString('base64url');
+                this.db.prepare('UPDATE app_messages SET claimed_at=?,lease_until=?,lease_token=?,claimant=?,attempts=attempts+1 WHERE id=?').run(now, now + leaseMs, token, scope.claimant ?? '', row.id);
+                return { id: row.id, from: row.sender, body: JSON.parse(row.body), createdAt: new Date(row.created_at).toISOString(), ...(row.correlation_id === null ? {} : { correlationId: row.correlation_id }), leaseToken: token, receipt: this.receipt(scope, row.id) };
+            });
+            if (found || Date.now() >= deadline)
+                return found;
+            try {
+                await delay(Math.min(100, Math.max(1, deadline - Date.now())), undefined, { signal });
+            }
+            catch {
+                throw new ProgramError('CANCELLED', 'Inbox receive was cancelled');
+            }
+        } while (true);
+    }
+    /** Extend only an unexpired claim belonging to this exact run and token. Never resurrect a lease. */
+    renew(scope, id, leaseToken, leaseMs) {
+        this.bound(leaseMs, 'leaseMs', 1, 300_000);
+        return this.transaction(() => {
+            const row = this.claim(scope, id, leaseToken);
+            this.db.prepare('UPDATE app_messages SET lease_until=? WHERE id=?').run(this.clock() + leaseMs, row.id);
+            return this.receipt(scope, id);
+        });
+    }
+    /** Low-level settlement. The exact live token is consumed; never retry an unknown ACK outcome. */
+    ack(scope, id, leaseToken) {
+        return this.transaction(() => {
+            const row = this.claim(scope, id, leaseToken);
+            this.db.prepare('UPDATE app_messages SET acked_at=?,lease_until=NULL,lease_token=NULL,claimant=NULL WHERE id=?').run(this.clock(), row.id);
+            return this.receipt(scope, id);
+        });
+    }
+    nack(scope, id, leaseToken) {
+        return this.transaction(() => {
+            const row = this.claim(scope, id, leaseToken);
+            this.db.prepare('UPDATE app_messages SET lease_until=NULL,lease_token=NULL,claimant=NULL WHERE id=?').run(row.id);
+            return this.receipt(scope, id);
+        });
+    }
+    receipt(scope, id) {
+        this.checkScope(scope);
+        const row = this.row(scope, id);
+        if (!row)
+            return null;
+        const active = row.lease_until !== null && row.lease_until > this.clock();
+        return { id: row.id, status: row.acked_at !== null ? 'acked' : active ? 'claimed' : 'accepted', acceptedAt: new Date(row.created_at).toISOString(), ...(row.claimed_at === null ? {} : { claimedAt: new Date(row.claimed_at).toISOString() }), ...(row.acked_at === null ? {} : { ackedAt: new Date(row.acked_at).toISOString() }), ...(!active ? {} : { leaseUntil: new Date(row.lease_until).toISOString() }), attempts: row.attempts };
+    }
+    /** Release only this revoked run's claims; namespace and unacked messages survive. */
+    releaseClaims(scope) {
+        this.checkScope(scope);
+        this.db.prepare('UPDATE app_messages SET lease_until=NULL,lease_token=NULL,claimant=NULL WHERE owner_id=? AND program=? AND claimant=? AND acked_at IS NULL').run(scope.ownerId, scope.program, scope.claimant ?? '');
+    }
+    close() { if (this.closed)
+        return; this.closed = true; this.db.close(); }
+    row(scope, id) {
+        if (typeof id !== 'string' || !id || id.length > 256)
+            throw new ProgramError('INVALID_INPUT', 'Invalid message id');
+        return this.db.prepare('SELECT * FROM app_messages WHERE owner_id=? AND program=? AND id=?').get(scope.ownerId, scope.program, id);
+    }
+    claim(scope, id, token) {
+        this.checkScope(scope);
+        const row = this.row(scope, id);
+        if (!row)
+            throw new ProgramError('NOT_FOUND', 'Message not found');
+        if (typeof token !== 'string' || !row.lease_token || Buffer.byteLength(token) !== Buffer.byteLength(row.lease_token) || !timingSafeEqual(Buffer.from(token), Buffer.from(row.lease_token)) || row.claimant !== (scope.claimant ?? '') || row.lease_until === null || row.lease_until <= this.clock() || row.acked_at !== null)
+            throw new ProgramError('LEASE_LOST', 'Claim lease is invalid, expired, or belongs to another run');
+        return row;
+    }
+    checkScope(scope) {
+        if (this.closed)
+            throw new ProgramError('DISPOSED', 'Message store is closed');
+        if (!scope || typeof scope.ownerId !== 'string' || !scope.ownerId || scope.ownerId.length > 1024 || typeof scope.program !== 'string' || !scope.program || scope.program.length > 256 || scope.claimant !== undefined && (typeof scope.claimant !== 'string' || scope.claimant.length > 2048))
+            throw new ProgramError('INVALID_INPUT', 'Invalid message namespace');
+    }
+    bound(value, name, min, max) {
+        if (!Number.isSafeInteger(value) || value < min || value > max)
+            throw new ProgramError('INVALID_INPUT', `${name} must be an integer from ${min} to ${max}`);
+        return value;
+    }
+    transaction(fn) {
+        if (this.closed)
+            throw new ProgramError('DISPOSED', 'Message store is closed');
+        this.db.exec('BEGIN IMMEDIATE');
+        try {
+            const result = fn();
+            this.db.exec('COMMIT');
+            return result;
+        }
+        catch (error) {
+            this.db.exec('ROLLBACK');
+            throw error;
+        }
+    }
+}
+//# sourceMappingURL=mailbox.js.map

package/dist/app/mailbox.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mailbox.js","sourceRoot":"","sources":["../../src/app/mailbox.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AACvE,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AAC/C,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,UAAU,IAAI,KAAK,EAAE,MAAM,sBAAsB,CAAC;AAE3D,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AA+BlE,qGAAqG;AACrG,MAAM,OAAO,YAAY;IACN,EAAE,CAAe;IACjB,UAAU,CAAS;IACnB,WAAW,CAAS;IACpB,KAAK,CAAe;IAC7B,MAAM,GAAG,KAAK,CAAC;IAEvB,YAAY,IAAY,EAAE,UAA+B,EAAE;QACzD,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,KAAK,KAAK,SAAS,IAAI,OAAO,OAAO,CAAC,KAAK,KAAK,UAAU;YAAE,MAAM,IAAI,YAAY,CAAC,gBAAgB,EAAE,+BAA+B,CAAC,CAAC;QACvN,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC,oBAAoB,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,oBAAoB,CAAC;QACnG,IAAI,CAAC,WAAW,GAAG,OAAO,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC;QACpF,IAAI,CAAC,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,IAAI,CAAC,GAAG,CAAC;QACvC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,IAAI,CAAC,UAAU,GAAG,CAAC,IAAI,IAAI,CAAC,UAAU,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,WAAW,GAAG,OAAO;YAAE,MAAM,IAAI,YAAY,CAAC,gBAAgB,EAAE,8BAA8B,CAAC,CAAC;QACvR,IAAI,IAAI,KAAK,UAAU,EAAE,CAAC;YACxB,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;YACrB,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAC7D,CAAC;QACD,IAAI,CAAC,EAAE,GAAG,IAAI,YAAY,CAAC,IAAI,CAAC,CAAC;QACjC,IAAI,IAAI,KAAK,UAAU;YAAE,SAAS,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QAChD,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC;;;;;;;;;KASZ,CAAC,CAAC;IACL,CAAC;IAED,IAAI,CAAC,KAAmB,EAAE,OAAkE;QAC1F,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;QACvB,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,OAAO,OAAO,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,MAAM,GAAG,IAAI,IAAI,OAAO,CAAC,aAAa,KAAK,SAAS,IAAI,CAAC,OAAO,OAAO,CAAC,aAAa,KAAK,QAAQ,IAAI,OAAO,CAAC,aAAa,CAAC,MAAM,GAAG,GAAG,CAAC;YAAE,MAAM,IAAI,YAAY,CAAC,eAAe,EAAE,0BAA0B,CAAC,CAAC;QAC1V,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACzB,gFAAgF;QAChF,wEAAwE;QACxE,IAAI,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,GAAG,IAAI;YAAE,MAAM,IAAI,YAAY,CAAC,OAAO,EAAE,8BAA8B,CAAC,CAAC;QAC5H,OAAO,IAAI,CAAC,WAAW,CAAC,GAAG,EAAE;YAC3B,MAAM,KAAK,GAAG,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,gGAAgG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,OAAO,CAAsB,CAAC;YACvL,IAAI,KAAK,CAAC,KAAK,IAAI,IAAI,CAAC,UAAU;gBAAE,MAAM,IAAI,YAAY,CAAC,cAAc,EAAE,uBAAuB,CAAC,CAAC;YACpG,gFAAgF;YAChF,MAAM,KAAK,GAAI,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,4CAA4C,CAAC,CAAC,GAAG,EAAwB,CAAC,KAAK,CAAC;YAC/G,IAAI,KAAK,IAAI,IAAI,CAAC,WAAW;gBAAE,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,yHAAyH,CAAC,CAAC,GAAG,CAAC,KAAK,GAAG,IAAI,CAAC,WAAW,GAAG,CAAC,CAAC,CAAC;YAC5M,IAAK,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,4CAA4C,CAAC,CAAC,GAAG,EAAwB,CAAC,KAAK,IAAI,IAAI,CAAC,WAAW;gBAAE,MAAM,IAAI,YAAY,CAAC,cAAc,EAAE,uBAAuB,CAAC,CAAC;YAC1L,MAAM,EAAE,GAAG,UAAU,EAAE,CAAC;YACxB,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,6GAA6G,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC,aAAa,IAAI,IAAI,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;YAC9P,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAE,CAAC;QAClC,CAAC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,KAAmB,EAAE,UAA0B,EAAE,EAAE,MAAoB;QACnF,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;QACvB,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC;YAAE,MAAM,IAAI,YAAY,CAAC,eAAe,EAAE,yBAAyB,CAAC,CAAC;QAC1I,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,QAAQ,EAAE,CAAC,EAAE,MAAM,CAAC,CAAC;QAClG,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,SAAS,EAAE,CAAC,EAAE,OAAO,CAAC,CAAC;QAC5G,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC;QACrC,GAAG,CAAC;YACF,IAAI,MAAM,EAAE,OAAO;gBAAE,MAAM,IAAI,YAAY,CAAC,WAAW,EAAE,6BAA6B,CAAC,CAAC;YACxF,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;YACvB,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,EAAE;gBAClC,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,EAAE,CAAC;gBACzB,MAAM,GAAG,GAAG,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,8JAA8J,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,GAAG,CAA+B,CAAC;gBACjQ,IAAI,CAAC,GAAG;oBAAE,OAAO,IAAI,CAAC;gBACtB,MAAM,KAAK,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;gBACpD,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,4GAA4G,CAAC,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,GAAG,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,QAAQ,IAAI,EAAE,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;gBAC3L,OAAO,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAc,EAAE,SAAS,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,WAAW,EAAE,EAAE,GAAG,CAAC,GAAG,CAAC,cAAc,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,GAAG,CAAC,cAAc,EAAE,CAAC,EAAE,UAAU,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,EAAE,CAAE,EAAE,CAAC;YAC/Q,CAAC,CAAC,CAAC;YACH,IAAI,KAAK,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,QAAQ;gBAAE,OAAO,KAAK,CAAC;YAClD,IAAI,CAAC;gBAAC,MAAM,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,SAAS,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;YAAC,CAAC;YAC9F,MAAM,CAAC;gBAAC,MAAM,IAAI,YAAY,CAAC,WAAW,EAAE,6BAA6B,CAAC,CAAC;YAAC,CAAC;QAC/E,CAAC,QAAQ,IAAI,EAAE;IACjB,CAAC;IAED,qGAAqG;IACrG,KAAK,CAAC,KAAmB,EAAE,EAAU,EAAE,UAAkB,EAAE,OAAe;QACxE,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,SAAS,EAAE,CAAC,EAAE,OAAO,CAAC,CAAC;QAC3C,OAAO,IAAI,CAAC,WAAW,CAAC,GAAG,EAAE;YAC3B,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,EAAE,EAAE,UAAU,CAAC,CAAC;YAC9C,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,kDAAkD,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,EAAE,GAAG,OAAO,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;YACxG,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAE,CAAC;QAClC,CAAC,CAAC,CAAC;IACL,CAAC;IAED,kGAAkG;IAClG,GAAG,CAAC,KAAmB,EAAE,EAAU,EAAE,UAAkB;QACrD,OAAO,IAAI,CAAC,WAAW,CAAC,GAAG,EAAE;YAC3B,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,EAAE,EAAE,UAAU,CAAC,CAAC;YAC9C,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,+FAA+F,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,EAAE,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;YAC3I,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAE,CAAC;QAClC,CAAC,CAAC,CAAC;IACL,CAAC;IAED,IAAI,CAAC,KAAmB,EAAE,EAAU,EAAE,UAAkB;QACtD,OAAO,IAAI,CAAC,WAAW,CAAC,GAAG,EAAE;YAC3B,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,EAAE,EAAE,UAAU,CAAC,CAAC;YAC9C,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,oFAAoF,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAClH,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAE,CAAC;QAClC,CAAC,CAAC,CAAC;IACL,CAAC;IAED,OAAO,CAAC,KAAmB,EAAE,EAAU;QACrC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;QACvB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QAChC,IAAI,CAAC,GAAG;YAAE,OAAO,IAAI,CAAC;QACtB,MAAM,MAAM,GAAG,GAAG,CAAC,WAAW,KAAK,IAAI,IAAI,GAAG,CAAC,WAAW,GAAG,IAAI,CAAC,KAAK,EAAE,CAAC;QAC1E,OAAO,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,QAAQ,KAAK,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,UAAU,EAAE,UAAU,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,WAAW,EAAE,EAAE,GAAG,CAAC,GAAG,CAAC,UAAU,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,EAAE,GAAG,CAAC,GAAG,CAAC,QAAQ,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,WAAY,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,CAAC;IAC7a,CAAC;IAED,sFAAsF;IACtF,aAAa,CAAC,KAAmB;QAC/B,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;QACvB,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,4IAA4I,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC;IACxN,CAAC;IAED,KAAK,KAAW,IAAI,IAAI,CAAC,MAAM;QAAE,OAAO,CAAC,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IAEvE,GAAG,CAAC,KAAmB,EAAE,EAAU;QACzC,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,MAAM,GAAG,GAAG;YAAE,MAAM,IAAI,YAAY,CAAC,eAAe,EAAE,oBAAoB,CAAC,CAAC;QACpH,OAAO,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,oEAAoE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,EAAE,CAA+B,CAAC;IACnK,CAAC;IACO,KAAK,CAAC,KAAmB,EAAE,EAAU,EAAE,KAAa;QAC1D,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;QACvB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QAChC,IAAI,CAAC,GAAG;YAAE,MAAM,IAAI,YAAY,CAAC,WAAW,EAAE,mBAAmB,CAAC,CAAC;QACnE,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,GAAG,CAAC,WAAW,IAAI,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,KAAK,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,IAAI,GAAG,CAAC,QAAQ,KAAK,CAAC,KAAK,CAAC,QAAQ,IAAI,EAAE,CAAC,IAAI,GAAG,CAAC,WAAW,KAAK,IAAI,IAAI,GAAG,CAAC,WAAW,IAAI,IAAI,CAAC,KAAK,EAAE,IAAI,GAAG,CAAC,QAAQ,KAAK,IAAI;YAAE,MAAM,IAAI,YAAY,CAAC,YAAY,EAAE,4DAA4D,CAAC,CAAC;QACla,OAAO,GAAG,CAAC;IACb,CAAC;IACO,UAAU,CAAC,KAAmB;QACpC,IAAI,IAAI,CAAC,MAAM;YAAE,MAAM,IAAI,YAAY,CAAC,UAAU,EAAE,yBAAyB,CAAC,CAAC;QAC/E,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,CAAC,OAAO,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,GAAG,IAAI,IAAI,OAAO,KAAK,CAAC,OAAO,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,GAAG,GAAG,IAAI,KAAK,CAAC,QAAQ,KAAK,SAAS,IAAI,CAAC,OAAO,KAAK,CAAC,QAAQ,KAAK,QAAQ,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,GAAG,IAAI,CAAC;YAAE,MAAM,IAAI,YAAY,CAAC,eAAe,EAAE,2BAA2B,CAAC,CAAC;IACtW,CAAC;IACO,KAAK,CAAC,KAAa,EAAE,IAAY,EAAE,GAAW,EAAE,GAAW;QACjE,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,GAAG,IAAI,KAAK,GAAG,GAAG;YAAE,MAAM,IAAI,YAAY,CAAC,eAAe,EAAE,GAAG,IAAI,4BAA4B,GAAG,OAAO,GAAG,EAAE,CAAC,CAAC;QAC5J,OAAO,KAAK,CAAC;IACf,CAAC;IACO,WAAW,CAAI,EAAW;QAChC,IAAI,IAAI,CAAC,MAAM;YAAE,MAAM,IAAI,YAAY,CAAC,UAAU,EAAE,yBAAyB,CAAC,CAAC;QAC/E,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;QAChC,IAAI,CAAC;YAAC,MAAM,MAAM,GAAG,EAAE,EAAE,CAAC;YAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YAAC,OAAO,MAAM,CAAC;QAAC,CAAC;QACnE,OAAO,KAAK,EAAE,CAAC;YAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;YAAC,MAAM,KAAK,CAAC;QAAC,CAAC;IAC1D,CAAC;CACF"}

package/dist/app/models.d.ts

@@ -0,0 +1,32 @@
+import type { JsonValue } from '../types.js';
+import type { CallOptions } from './index.js';
+import { type ModelsDeclaration, type ModelSelection, type ModelSlotView } from '../models.js';
+export type { ModelSelection, ModelSlotDeclaration, ModelsDeclaration, ModelSlotView } from '../models.js';
+export type ModelBridgeCall = <T = JsonValue>(method: string, input?: JsonValue, options?: CallOptions) => Promise<T>;
+export interface ModelCallControls {
+    prompt: string;
+    system?: string;
+    maxTokens?: number;
+}
+/** Slot calls use its complete selection; explicit calls remain independent. */
+export type ProgramModelCallInput = ModelCallControls & ({
+    slot: string;
+    provider?: never;
+    model?: never;
+    reasoningEffort?: never;
+} | (ModelSelection & {
+    slot?: never;
+}));
+export interface ProgramModels {
+    /** Publish a complete declaration snapshot without overwriting user overrides. */
+    declare(slots: ModelsDeclaration, options?: CallOptions): Promise<ModelSlotView[]>;
+    list(options?: CallOptions): Promise<ModelSlotView[]>;
+    /** Resolve the current preference at call time, across watch/run generations. */
+    resolve(slot: string, options?: CallOptions): Promise<ModelSelection>;
+    /** Alias of resolve: returns the route, not the slot's editable metadata. */
+    get(slot: string, options?: CallOptions): Promise<ModelSelection>;
+    /** Exactly one explicit model call. No inference, tools, or fallback loop is implicit. */
+    call<T = JsonValue>(input: ProgramModelCallInput | JsonValue, options?: CallOptions): Promise<T>;
+}
+/** The app face intentionally has no setter/resetter for human-owned preferences. */
+export declare function createProgramModels(call: ModelBridgeCall): ProgramModels;

package/dist/app/models.js

@@ -0,0 +1,13 @@
+import { parseModelsDeclaration, parseModelSlotId } from '../models.js';
+/** The app face intentionally has no setter/resetter for human-owned preferences. */
+export function createProgramModels(call) {
+    const resolve = (slot, options) => call('models.resolve', { slot: parseModelSlotId(slot) }, options);
+    return {
+        declare: (slots, options) => call('models.declare', { slots: parseModelsDeclaration(slots) }, options),
+        list: options => call('models.list', {}, options),
+        resolve,
+        get: resolve,
+        call: (input, options) => call('models.call', input, options),
+    };
+}
+//# sourceMappingURL=models.js.map

package/dist/app/models.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"models.js","sourceRoot":"","sources":["../../src/app/models.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,sBAAsB,EAAE,gBAAgB,EAAmE,MAAM,cAAc,CAAC;AAwBzI,qFAAqF;AACrF,MAAM,UAAU,mBAAmB,CAAC,IAAqB;IACvD,MAAM,OAAO,GAAG,CAAC,IAAY,EAAE,OAAqB,EAAE,EAAE,CAAC,IAAI,CAAiB,gBAAgB,EAAE,EAAE,IAAI,EAAE,gBAAgB,CAAC,IAAI,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;IAC3I,OAAO;QACL,OAAO,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE,CAAC,IAAI,CAAkB,gBAAgB,EAAE,EAAE,KAAK,EAAE,sBAAsB,CAAC,KAAK,CAAC,EAA0B,EAAE,OAAO,CAAC;QAC/I,IAAI,EAAE,OAAO,CAAC,EAAE,CAAC,IAAI,CAAkB,aAAa,EAAE,EAAE,EAAE,OAAO,CAAC;QAClE,OAAO;QACP,GAAG,EAAE,OAAO;QACZ,IAAI,EAAE,CAAgB,KAAwC,EAAE,OAAqB,EAAE,EAAE,CAAC,IAAI,CAAI,aAAa,EAAE,KAAkB,EAAE,OAAO,CAAC;KAC9I,CAAC;AACJ,CAAC"}

package/dist/app/server.d.ts

@@ -0,0 +1,36 @@
+import type { JsonValue, ProgramDefinition, ProgramSnapshot } from '../types.js';
+export interface AppBridgeContext {
+    run: ProgramSnapshot;
+    definition: ProgramDefinition;
+}
+export interface AppBridgeServerOptions {
+    handler(context: AppBridgeContext, method: string, input: JsonValue, signal: AbortSignal): Promise<JsonValue>;
+    streamHandler?(context: AppBridgeContext, method: string, input: JsonValue, signal: AbortSignal): AsyncIterable<JsonValue>;
+    /** Hard ceilings are 32 outstanding handlers and 120 seconds. */
+    maxOutstanding?: number;
+    timeoutMs?: number;
+}
+/** Parent-owned loopback bridge for trusted processes; this is not an OS sandbox. */
+export declare class AppBridgeServer {
+    private readonly options;
+    readonly ready: Promise<void>;
+    private readonly server;
+    private readonly registrations;
+    private readonly tokens;
+    private readonly maxOutstanding;
+    private readonly timeoutMs;
+    private outstanding;
+    private disposed;
+    private closing?;
+    private address?;
+    constructor(options: AppBridgeServerOptions);
+    register(run: ProgramSnapshot, definition: ProgramDefinition): {
+        env: Record<string, string>;
+    };
+    revoke(run: Pick<ProgramSnapshot, 'id' | 'generation'>): void;
+    dispose(): Promise<void>;
+    private handle;
+    private read;
+    private abortable;
+    private reply;
+}

package/dist/app/server.js

@@ -0,0 +1,233 @@
+import { randomBytes } from 'node:crypto';
+import { createServer } from 'node:http';
+import { assertJson, exactKeys, isRecord, jsonClone, ProgramError, safeError, validName } from '../runtime/protocol.js';
+import { writeProgramStream } from './stream-server.js';
+const MAX_BYTES = 64 * 1024;
+const key = (run) => `${run.id}:${run.generation}`;
+/** Parent-owned loopback bridge for trusted processes; this is not an OS sandbox. */
+export class AppBridgeServer {
+    options;
+    ready;
+    server;
+    registrations = new Map();
+    tokens = new Map();
+    maxOutstanding;
+    timeoutMs;
+    outstanding = 0;
+    disposed = false;
+    closing;
+    address;
+    constructor(options) {
+        this.options = options;
+        this.maxOutstanding = options.maxOutstanding ?? 32;
+        this.timeoutMs = options.timeoutMs ?? 120_000;
+        if (!Number.isSafeInteger(this.maxOutstanding) || this.maxOutstanding < 1 || this.maxOutstanding > 32 || !Number.isSafeInteger(this.timeoutMs) || this.timeoutMs < 1 || this.timeoutMs > 120_000)
+            throw new ProgramError('INVALID_CONFIG', 'Invalid bridge limits');
+        this.server = createServer({ maxHeaderSize: 16 * 1024 }, (request, response) => { void this.handle(request, response); });
+        this.server.maxConnections = 128;
+        this.server.headersTimeout = 10_000;
+        this.server.requestTimeout = 10_000;
+        this.server.keepAliveTimeout = 1000;
+        this.ready = new Promise((resolve, reject) => {
+            this.server.once('error', reject);
+            this.server.listen(0, '127.0.0.1', () => {
+                const address = this.server.address();
+                if (!address || typeof address === 'string') {
+                    reject(new ProgramError('UNAVAILABLE', 'Bridge did not bind loopback'));
+                    return;
+                }
+                this.address = `http://127.0.0.1:${address.port}`;
+                resolve();
+            });
+        });
+        void this.ready.catch(() => { });
+    }
+    register(run, definition) {
+        if (this.disposed || !this.address)
+            throw new ProgramError('UNAVAILABLE', 'Await bridge.ready before starting programs');
+        if (this.registrations.has(key(run)))
+            throw new ProgramError('BUSY', 'Program generation already has bridge credentials');
+        if (this.registrations.size >= 256)
+            throw new ProgramError('LIMIT', 'Bridge registration limit exceeded');
+        const token = randomBytes(32).toString('base64url');
+        const registration = { run: jsonClone(run), definition: structuredClone(definition), token, controllers: new Set() };
+        this.registrations.set(key(run), registration);
+        this.tokens.set(token, registration);
+        return { env: { DSH_PROGRAM_BRIDGE_URL: this.address, DSH_PROGRAM_BRIDGE_TOKEN: token, DSH_PROGRAM_RUN_ID: run.id, DSH_PROGRAM_GEN: String(run.generation) } };
+    }
+    revoke(run) {
+        const registration = this.registrations.get(key(run));
+        if (!registration)
+            return;
+        this.registrations.delete(key(run));
+        this.tokens.delete(registration.token);
+        for (const controller of registration.controllers)
+            controller.abort(new ProgramError('REVOKED', 'Program generation is no longer active; effect outcome may be unknown'));
+        registration.controllers.clear();
+    }
+    dispose() {
+        if (this.closing)
+            return this.closing;
+        this.disposed = true;
+        for (const registration of this.registrations.values())
+            this.revoke(registration.run);
+        this.closing = (async () => {
+            await this.ready.catch(() => { });
+            await new Promise((resolve) => {
+                this.server.close(() => resolve());
+                this.server.closeAllConnections();
+            });
+        })();
+        return this.closing;
+    }
+    async handle(request, response) {
+        let registration;
+        let controller;
+        let timer;
+        let reserved = false;
+        let handlerStarted = false;
+        const disconnect = () => controller?.abort(new ProgramError('CANCELLED', 'Caller disconnected; effect outcome may be unknown'));
+        try {
+            if (this.disposed)
+                throw new ProgramError('UNAVAILABLE', 'Bridge is closed');
+            const streaming = request.url === '/stream' && !!this.options.streamHandler;
+            if (request.method !== 'POST' || request.url !== '/call' && !streaming) {
+                this.reply(response, 404, { ok: false, error: { code: 'NOT_FOUND', message: 'Unknown bridge route' } });
+                return;
+            }
+            // Browser origins/cookies are not bridge credentials. No CORS or ambient auth.
+            if (request.headers.origin !== undefined || request.headers['sec-fetch-site'] !== undefined || request.headers.host !== new URL(this.address).host)
+                throw new ProgramError('FORBIDDEN', 'Bridge accepts direct loopback clients only');
+            const authorization = request.headers.authorization;
+            registration = typeof authorization === 'string' && authorization.startsWith('Bearer ') ? this.tokens.get(authorization.slice(7)) : undefined;
+            if (!registration)
+                throw new ProgramError('UNAUTHORIZED', 'Missing, invalid, or revoked program credentials');
+            if (this.outstanding >= this.maxOutstanding)
+                throw new ProgramError('BACKPRESSURE', 'Bridge outstanding call limit exceeded');
+            this.outstanding++;
+            reserved = true;
+            controller = new AbortController();
+            registration.controllers.add(controller);
+            timer = setTimeout(() => controller.abort(new ProgramError('TIMEOUT', 'Bridge deadline exceeded; effect outcome may be unknown')), this.timeoutMs);
+            request.once('aborted', disconnect);
+            response.once('close', disconnect);
+            const input = await this.read(request, controller.signal);
+            assertJson(input);
+            if (!isRecord(input) || !exactKeys(input, ['method', 'input']) || !validName(input.method))
+                throw new ProgramError('INVALID_INPUT', 'Expected {method,input}');
+            if (controller.signal.aborted)
+                throw controller.signal.reason;
+            const activeRegistration = registration;
+            const activeController = controller;
+            if (streaming) {
+                // Each connection is finite; reconnect reopens a native snapshot. Stops and
+                // old-generation revocations use the same controller as unary calls.
+                if (timer)
+                    clearTimeout(timer);
+                timer = setTimeout(() => activeController.abort(new ProgramError('STREAM_RECONNECT', 'Refresh conversation stream snapshot')), 120000);
+                const source = this.options.streamHandler({ run: jsonClone(activeRegistration.run), definition: structuredClone(activeRegistration.definition) }, input.method, input.input, activeController.signal);
+                handlerStarted = true;
+                try {
+                    await writeProgramStream(response, source, activeController);
+                }
+                finally {
+                    this.outstanding--;
+                }
+                return;
+            }
+            const pending = Promise.resolve().then(() => this.options.handler({ run: jsonClone(activeRegistration.run), definition: structuredClone(activeRegistration.definition) }, input.method, input.input, activeController.signal));
+            handlerStarted = true;
+            // The slot survives timeout/disconnection until the actual host handler settles.
+            // A handler ignoring AbortSignal cannot create unbounded detached work.
+            void pending.finally(() => { this.outstanding--; }).catch(() => { });
+            const output = await this.abortable(pending, controller.signal);
+            if (this.tokens.get(registration.token) !== registration)
+                throw new ProgramError('REVOKED', 'Program generation is no longer active');
+            assertJson(output);
+            this.reply(response, 200, { ok: true, result: output });
+        }
+        catch (error) {
+            const code = error instanceof ProgramError ? error.code : 'CALL_FAILED';
+            const status = code === 'UNAUTHORIZED' || code === 'REVOKED' ? 401 : code === 'FORBIDDEN' ? 403 : code === 'BACKPRESSURE' ? 429 : code === 'TIMEOUT' ? 504 : code === 'LIMIT' ? 413 : code === 'INVALID_INPUT' || code === 'INVALID_JSON' ? 400 : 500;
+            this.reply(response, status, { ok: false, error: { code, message: safeError(error) } });
+        }
+        finally {
+            if (reserved && !handlerStarted)
+                this.outstanding--;
+            if (timer)
+                clearTimeout(timer);
+            if (controller)
+                registration?.controllers.delete(controller);
+            request.removeListener('aborted', disconnect);
+            response.removeListener('close', disconnect);
+            // Drain rejected bodies without buffering them, allowing a bounded keep-alive.
+            if (!request.complete)
+                request.resume();
+        }
+    }
+    read(request, signal) {
+        return new Promise((resolve, reject) => {
+            const chunks = [];
+            let size = 0;
+            let done = false;
+            const finish = (error, value) => {
+                if (done)
+                    return;
+                done = true;
+                request.removeListener('data', data);
+                request.removeListener('end', end);
+                request.removeListener('error', failure);
+                signal.removeEventListener('abort', abort);
+                if (error)
+                    reject(error);
+                else
+                    resolve(value);
+            };
+            const failure = (error) => finish(error);
+            const abort = () => finish(signal.reason);
+            const data = (chunk) => {
+                size += chunk.length;
+                if (size > MAX_BYTES) {
+                    finish(new ProgramError('LIMIT', 'Bridge request exceeds 64 KiB'));
+                    return;
+                }
+                chunks.push(chunk);
+            };
+            const end = () => {
+                try {
+                    finish(undefined, JSON.parse(Buffer.concat(chunks).toString('utf8')));
+                }
+                catch {
+                    finish(new ProgramError('INVALID_JSON', 'Malformed bridge JSON'));
+                }
+            };
+            request.on('data', data);
+            request.once('end', end);
+            request.once('error', failure);
+            signal.addEventListener('abort', abort, { once: true });
+            if (signal.aborted)
+                abort();
+        });
+    }
+    abortable(promise, signal) {
+        return new Promise((resolve, reject) => {
+            const abort = () => reject(signal.reason);
+            signal.addEventListener('abort', abort, { once: true });
+            if (signal.aborted)
+                abort();
+            void promise.then(resolve, reject).finally(() => signal.removeEventListener('abort', abort));
+        });
+    }
+    reply(response, status, payload) {
+        if (response.destroyed || response.writableEnded)
+            return;
+        let body = JSON.stringify(payload);
+        if (Buffer.byteLength(body) > MAX_BYTES) {
+            status = 413;
+            body = JSON.stringify({ ok: false, error: { code: 'LIMIT', message: 'Bridge response exceeds 64 KiB' } });
+        }
+        response.writeHead(status, { 'Content-Type': 'application/json', 'Content-Length': Buffer.byteLength(body), 'Cache-Control': 'no-store', 'X-Content-Type-Options': 'nosniff' });
+        response.end(body);
+    }
+}
+//# sourceMappingURL=server.js.map

package/dist/app/server.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"server.js","sourceRoot":"","sources":["../../src/app/server.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,YAAY,EAA6C,MAAM,WAAW,CAAC;AAEpF,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,QAAQ,EAAE,SAAS,EAAE,YAAY,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,wBAAwB,CAAC;AACxH,OAAM,EAAC,kBAAkB,EAAC,MAAI,oBAAoB,CAAC;AAWnD,MAAM,SAAS,GAAG,EAAE,GAAG,IAAI,CAAC;AAC5B,MAAM,GAAG,GAAG,CAAC,GAA+C,EAAU,EAAE,CAAC,GAAG,GAAG,CAAC,EAAE,IAAI,GAAG,CAAC,UAAU,EAAE,CAAC;AAEvG,qFAAqF;AACrF,MAAM,OAAO,eAAe;IAYG;IAXpB,KAAK,CAAgB;IACb,MAAM,CAAC;IACP,aAAa,GAAG,IAAI,GAAG,EAAwB,CAAC;IAChD,MAAM,GAAG,IAAI,GAAG,EAAwB,CAAC;IACzC,cAAc,CAAS;IACvB,SAAS,CAAS;IAC3B,WAAW,GAAG,CAAC,CAAC;IAChB,QAAQ,GAAG,KAAK,CAAC;IACjB,OAAO,CAAiB;IACxB,OAAO,CAAU;IAEzB,YAA6B,OAA+B;QAA/B,YAAO,GAAP,OAAO,CAAwB;QAC1D,IAAI,CAAC,cAAc,GAAG,OAAO,CAAC,cAAc,IAAI,EAAE,CAAC;QACnD,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,OAAO,CAAC;QAC9C,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,cAAc,CAAC,IAAI,IAAI,CAAC,cAAc,GAAG,CAAC,IAAI,IAAI,CAAC,cAAc,GAAG,EAAE,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC,SAAS,GAAG,CAAC,IAAI,IAAI,CAAC,SAAS,GAAG,OAAO;YAAE,MAAM,IAAI,YAAY,CAAC,gBAAgB,EAAE,uBAAuB,CAAC,CAAC;QACpQ,IAAI,CAAC,MAAM,GAAG,YAAY,CAAC,EAAE,aAAa,EAAE,EAAE,GAAG,IAAI,EAAE,EAAE,CAAC,OAAO,EAAE,QAAQ,EAAE,EAAE,GAAG,KAAK,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC1H,IAAI,CAAC,MAAM,CAAC,cAAc,GAAG,GAAG,CAAC;QACjC,IAAI,CAAC,MAAM,CAAC,cAAc,GAAG,MAAM,CAAC;QACpC,IAAI,CAAC,MAAM,CAAC,cAAc,GAAG,MAAM,CAAC;QACpC,IAAI,CAAC,MAAM,CAAC,gBAAgB,GAAG,IAAI,CAAC;QACpC,IAAI,CAAC,KAAK,GAAG,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACjD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YAClC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,WAAW,EAAE,GAAG,EAAE;gBACtC,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;gBACtC,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;oBAAC,MAAM,CAAC,IAAI,YAAY,CAAC,aAAa,EAAE,8BAA8B,CAAC,CAAC,CAAC;oBAAC,OAAO;gBAAC,CAAC;gBACjI,IAAI,CAAC,OAAO,GAAG,oBAAoB,OAAO,CAAC,IAAI,EAAE,CAAC;gBAClD,OAAO,EAAE,CAAC;YACZ,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QACH,KAAK,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IAClC,CAAC;IAED,QAAQ,CAAC,GAAoB,EAAE,UAA6B;QAC1D,IAAI,IAAI,CAAC,QAAQ,IAAI,CAAC,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,YAAY,CAAC,aAAa,EAAE,6CAA6C,CAAC,CAAC;QACzH,IAAI,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YAAE,MAAM,IAAI,YAAY,CAAC,MAAM,EAAE,mDAAmD,CAAC,CAAC;QAC1H,IAAI,IAAI,CAAC,aAAa,CAAC,IAAI,IAAI,GAAG;YAAE,MAAM,IAAI,YAAY,CAAC,OAAO,EAAE,oCAAoC,CAAC,CAAC;QAC1G,MAAM,KAAK,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QACpD,MAAM,YAAY,GAAG,EAAE,GAAG,EAAE,SAAS,CAAC,GAAG,CAAC,EAAE,UAAU,EAAE,eAAe,CAAC,UAAU,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,IAAI,GAAG,EAAmB,EAAE,CAAC;QACtI,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,YAAY,CAAC,CAAC;QAC/C,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,EAAE,YAAY,CAAC,CAAC;QACrC,OAAO,EAAE,GAAG,EAAE,EAAE,sBAAsB,EAAE,IAAI,CAAC,OAAO,EAAE,wBAAwB,EAAE,KAAK,EAAE,kBAAkB,EAAE,GAAG,CAAC,EAAE,EAAE,eAAe,EAAE,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC;IACjK,CAAC;IAED,MAAM,CAAC,GAA+C;QACpD,MAAM,YAAY,GAAG,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;QACtD,IAAI,CAAC,YAAY;YAAE,OAAO;QAC1B,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;QACpC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC;QACvC,KAAK,MAAM,UAAU,IAAI,YAAY,CAAC,WAAW;YAAE,UAAU,CAAC,KAAK,CAAC,IAAI,YAAY,CAAC,SAAS,EAAE,uEAAuE,CAAC,CAAC,CAAC;QAC1K,YAAY,CAAC,WAAW,CAAC,KAAK,EAAE,CAAC;IACnC,CAAC;IAED,OAAO;QACL,IAAI,IAAI,CAAC,OAAO;YAAE,OAAO,IAAI,CAAC,OAAO,CAAC;QACtC,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC;QACrB,KAAK,MAAM,YAAY,IAAI,IAAI,CAAC,aAAa,CAAC,MAAM,EAAE;YAAE,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC;QACtF,IAAI,CAAC,OAAO,GAAG,CAAC,KAAK,IAAI,EAAE;YACzB,MAAM,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;YACjC,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE;gBAClC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC;gBACnC,IAAI,CAAC,MAAM,CAAC,mBAAmB,EAAE,CAAC;YACpC,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,EAAE,CAAC;QACL,OAAO,IAAI,CAAC,OAAO,CAAC;IACtB,CAAC;IAEO,KAAK,CAAC,MAAM,CAAC,OAAwB,EAAE,QAAwB;QACrE,IAAI,YAAsC,CAAC;QAC3C,IAAI,UAAuC,CAAC;QAC5C,IAAI,KAAiC,CAAC;QACtC,IAAI,QAAQ,GAAG,KAAK,CAAC;QACrB,IAAI,cAAc,GAAG,KAAK,CAAC;QAC3B,MAAM,UAAU,GAAG,GAAG,EAAE,CAAC,UAAU,EAAE,KAAK,CAAC,IAAI,YAAY,CAAC,WAAW,EAAE,oDAAoD,CAAC,CAAC,CAAC;QAChI,IAAI,CAAC;YACH,IAAI,IAAI,CAAC,QAAQ;gBAAE,MAAM,IAAI,YAAY,CAAC,aAAa,EAAE,kBAAkB,CAAC,CAAC;YAC7E,MAAM,SAAS,GAAC,OAAO,CAAC,GAAG,KAAG,SAAS,IAAE,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC;YACtE,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM,IAAI,OAAO,CAAC,GAAG,KAAK,OAAO,IAAE,CAAC,SAAS,EAAE,CAAC;gBAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,sBAAsB,EAAE,EAAE,CAAC,CAAC;gBAAC,OAAO;YAAC,CAAC;YAC1L,+EAA+E;YAC/E,IAAI,OAAO,CAAC,OAAO,CAAC,MAAM,KAAK,SAAS,IAAI,OAAO,CAAC,OAAO,CAAC,gBAAgB,CAAC,KAAK,SAAS,IAAI,OAAO,CAAC,OAAO,CAAC,IAAI,KAAK,IAAI,GAAG,CAAC,IAAI,CAAC,OAAQ,CAAC,CAAC,IAAI;gBAAE,MAAM,IAAI,YAAY,CAAC,WAAW,EAAE,6CAA6C,CAAC,CAAC;YACxO,MAAM,aAAa,GAAG,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC;YACpD,YAAY,GAAG,OAAO,aAAa,KAAK,QAAQ,IAAI,aAAa,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YAC9I,IAAI,CAAC,YAAY;gBAAE,MAAM,IAAI,YAAY,CAAC,cAAc,EAAE,kDAAkD,CAAC,CAAC;YAC9G,IAAI,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC,cAAc;gBAAE,MAAM,IAAI,YAAY,CAAC,cAAc,EAAE,wCAAwC,CAAC,CAAC;YAC9H,IAAI,CAAC,WAAW,EAAE,CAAC;YACnB,QAAQ,GAAG,IAAI,CAAC;YAChB,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;YACnC,YAAY,CAAC,WAAW,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;YACzC,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAW,CAAC,KAAK,CAAC,IAAI,YAAY,CAAC,SAAS,EAAE,yDAAyD,CAAC,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;YACpJ,OAAO,CAAC,IAAI,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC;YACpC,QAAQ,CAAC,IAAI,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;YACnC,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC;YAC1D,UAAU,CAAC,KAAK,CAAC,CAAC;YAClB,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,MAAM,CAAC;gBAAE,MAAM,IAAI,YAAY,CAAC,eAAe,EAAE,yBAAyB,CAAC,CAAC;YAC/J,IAAI,UAAU,CAAC,MAAM,CAAC,OAAO;gBAAE,MAAM,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC;YAC9D,MAAM,kBAAkB,GAAG,YAAY,CAAC;YACxC,MAAM,gBAAgB,GAAG,UAAU,CAAC;YACpC,IAAG,SAAS,EAAC,CAAC;gBACZ,4EAA4E;gBAC5E,qEAAqE;gBACrE,IAAG,KAAK;oBAAC,YAAY,CAAC,KAAK,CAAC,CAAC;gBAAA,KAAK,GAAC,UAAU,CAAC,GAAE,EAAE,CAAA,gBAAgB,CAAC,KAAK,CAAC,IAAI,YAAY,CAAC,kBAAkB,EAAC,sCAAsC,CAAC,CAAC,EAAC,MAAM,CAAC,CAAC;gBAC9J,MAAM,MAAM,GAAC,IAAI,CAAC,OAAO,CAAC,aAAc,CAAC,EAAC,GAAG,EAAC,SAAS,CAAC,kBAAkB,CAAC,GAAG,CAAC,EAAC,UAAU,EAAC,eAAe,CAAC,kBAAkB,CAAC,UAAU,CAAC,EAAC,EAAC,KAAK,CAAC,MAAgB,EAAC,KAAK,CAAC,KAAkB,EAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC;gBACpN,cAAc,GAAC,IAAI,CAAC;gBAAA,IAAG,CAAC;oBAAA,MAAM,kBAAkB,CAAC,QAAQ,EAAC,MAAM,EAAC,gBAAgB,CAAC,CAAC;gBAAA,CAAC;wBAAO,CAAC;oBAAA,IAAI,CAAC,WAAW,EAAE,CAAC;gBAAA,CAAC;gBAChH,OAAO;YACT,CAAC;YACD,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,GAAG,EAAE,SAAS,CAAC,kBAAkB,CAAC,GAAG,CAAC,EAAE,UAAU,EAAE,eAAe,CAAC,kBAAkB,CAAC,UAAU,CAAC,EAAE,EAAE,KAAK,CAAC,MAAgB,EAAE,KAAK,CAAC,KAAkB,EAAE,gBAAgB,CAAC,MAAM,CAAC,CAAC,CAAC;YACtP,cAAc,GAAG,IAAI,CAAC;YACtB,iFAAiF;YACjF,wEAAwE;YACxE,KAAK,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;YACpE,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC;YAChE,IAAI,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC,KAAK,CAAC,KAAK,YAAY;gBAAE,MAAM,IAAI,YAAY,CAAC,SAAS,EAAE,wCAAwC,CAAC,CAAC;YACtI,UAAU,CAAC,MAAM,CAAC,CAAC;YACnB,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;QAC1D,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,GAAG,KAAK,YAAY,YAAY,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,aAAa,CAAC;YACxE,MAAM,MAAM,GAAG,IAAI,KAAK,cAAc,IAAI,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,KAAK,WAAW,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,KAAK,cAAc,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,KAAK,eAAe,IAAI,IAAI,KAAK,cAAc,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;YACtP,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC;QAC1F,CAAC;gBAAS,CAAC;YACT,IAAI,QAAQ,IAAI,CAAC,cAAc;gBAAE,IAAI,CAAC,WAAW,EAAE,CAAC;YACpD,IAAI,KAAK;gBAAE,YAAY,CAAC,KAAK,CAAC,CAAC;YAC/B,IAAI,UAAU;gBAAE,YAAY,EAAE,WAAW,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;YAC7D,OAAO,CAAC,cAAc,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC;YAC9C,QAAQ,CAAC,cAAc,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;YAC7C,+EAA+E;YAC/E,IAAI,CAAC,OAAO,CAAC,QAAQ;gBAAE,OAAO,CAAC,MAAM,EAAE,CAAC;QAC1C,CAAC;IACH,CAAC;IAEO,IAAI,CAAC,OAAwB,EAAE,MAAmB;QACxD,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACrC,MAAM,MAAM,GAAa,EAAE,CAAC;YAC5B,IAAI,IAAI,GAAG,CAAC,CAAC;YACb,IAAI,IAAI,GAAG,KAAK,CAAC;YACjB,MAAM,MAAM,GAAG,CAAC,KAAe,EAAE,KAAe,EAAE,EAAE;gBAClD,IAAI,IAAI;oBAAE,OAAO;gBACjB,IAAI,GAAG,IAAI,CAAC;gBACZ,OAAO,CAAC,cAAc,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;gBACrC,OAAO,CAAC,cAAc,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;gBACnC,OAAO,CAAC,cAAc,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;gBACzC,MAAM,CAAC,mBAAmB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;gBAC3C,IAAI,KAAK;oBAAE,MAAM,CAAC,KAAK,CAAC,CAAC;;oBAAM,OAAO,CAAC,KAAK,CAAC,CAAC;YAChD,CAAC,CAAC;YACF,MAAM,OAAO,GAAG,CAAC,KAAc,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YAClD,MAAM,KAAK,GAAG,GAAG,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YAC1C,MAAM,IAAI,GAAG,CAAC,KAAa,EAAE,EAAE;gBAC7B,IAAI,IAAI,KAAK,CAAC,MAAM,CAAC;gBACrB,IAAI,IAAI,GAAG,SAAS,EAAE,CAAC;oBAAC,MAAM,CAAC,IAAI,YAAY,CAAC,OAAO,EAAE,+BAA+B,CAAC,CAAC,CAAC;oBAAC,OAAO;gBAAC,CAAC;gBACrG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACrB,CAAC,CAAC;YACF,MAAM,GAAG,GAAG,GAAG,EAAE;gBACf,IAAI,CAAC;oBAAC,MAAM,CAAC,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;gBAAC,CAAC;gBAC9E,MAAM,CAAC;oBAAC,MAAM,CAAC,IAAI,YAAY,CAAC,cAAc,EAAE,uBAAuB,CAAC,CAAC,CAAC;gBAAC,CAAC;YAC9E,CAAC,CAAC;YACF,OAAO,CAAC,EAAE,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;YACzB,OAAO,CAAC,IAAI,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YACzB,OAAO,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YAC/B,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;YACxD,IAAI,MAAM,CAAC,OAAO;gBAAE,KAAK,EAAE,CAAC;QAC9B,CAAC,CAAC,CAAC;IACL,CAAC;IAEO,SAAS,CAAI,OAAmB,EAAE,MAAmB;QAC3D,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACrC,MAAM,KAAK,GAAG,GAAG,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YAC1C,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;YACxD,IAAI,MAAM,CAAC,OAAO;gBAAE,KAAK,EAAE,CAAC;YAC5B,KAAK,OAAO,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,mBAAmB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC;QAC/F,CAAC,CAAC,CAAC;IACL,CAAC;IAEO,KAAK,CAAC,QAAwB,EAAE,MAAc,EAAE,OAAkB;QACxE,IAAI,QAAQ,CAAC,SAAS,IAAI,QAAQ,CAAC,aAAa;YAAE,OAAO;QACzD,IAAI,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;QACnC,IAAI,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,SAAS,EAAE,CAAC;YAAC,MAAM,GAAG,GAAG,CAAC;YAAC,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,gCAAgC,EAAE,EAAE,CAAC,CAAC;QAAC,CAAC;QACrK,QAAQ,CAAC,SAAS,CAAC,MAAM,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,eAAe,EAAE,UAAU,EAAE,wBAAwB,EAAE,SAAS,EAAE,CAAC,CAAC;QAChL,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACrB,CAAC;CACF"}

package/dist/app/stream-server.d.ts

@@ -0,0 +1,9 @@
+import type { ServerResponse } from 'node:http';
+import type { JsonValue } from '../types.js';
+/** Drain the native iterator independently of HTTP backpressure. Native DSH's
+ * follow queue must never become an unbounded slow-browser buffer. */
+export declare function writeProgramStream(response: ServerResponse, source: AsyncIterable<JsonValue>, controller: AbortController, options?: {
+    maxFrameBytes?: number;
+    maxQueueBytes?: number;
+    maxQueueFrames?: number;
+}): Promise<void>;

package/dist/app/stream-server.js

@@ -0,0 +1,77 @@
+import { assertJson, ProgramError } from '../runtime/protocol.js';
+/** Drain the native iterator independently of HTTP backpressure. Native DSH's
+ * follow queue must never become an unbounded slow-browser buffer. */
+export async function writeProgramStream(response, source, controller, options = {}) {
+    const maxFrame = options.maxFrameBytes ?? 512 * 1024, maxBytes = options.maxQueueBytes ?? 1024 * 1024, maxFrames = options.maxQueueFrames ?? 128;
+    const queue = [];
+    let bytes = 0, done = false, failure, wake;
+    const notify = () => { wake?.(); wake = undefined; };
+    const abort = () => { failure ??= controller.signal.reason; notify(); };
+    controller.signal.addEventListener('abort', abort, { once: true });
+    const iterator = source[Symbol.asyncIterator]();
+    let cleanup;
+    const pump = (async () => {
+        try {
+            while (!controller.signal.aborted) {
+                const item = await iterator.next();
+                if (item.done)
+                    break;
+                assertJson(item.value);
+                const line = Buffer.from(JSON.stringify(item.value) + '\n');
+                if (line.length > maxFrame || bytes + line.length > maxBytes || queue.length >= maxFrames)
+                    throw new ProgramError('STREAM_OVERFLOW', 'Conversation stream exceeded its bounded buffer; reconnect for a fresh native snapshot');
+                queue.push(line);
+                bytes += line.length;
+                notify();
+            }
+        }
+        catch (error) {
+            failure = error;
+            controller.abort(error);
+        }
+        finally {
+            done = true;
+            notify();
+        }
+    })();
+    void pump.catch(() => { });
+    response.writeHead(200, { 'Content-Type': 'application/x-ndjson; charset=utf-8', 'Cache-Control': 'no-store', 'X-Content-Type-Options': 'nosniff', 'X-Accel-Buffering': 'no' });
+    response.flushHeaders();
+    try {
+        while (!controller.signal.aborted) {
+            if (queue.length) {
+                const line = queue.shift();
+                bytes -= line.length;
+                if (!response.write(line))
+                    await new Promise((resolve, reject) => { const cleanup = () => { response.off('drain', drain); controller.signal.removeEventListener('abort', cancel); }; const drain = () => { cleanup(); resolve(); }, cancel = () => { cleanup(); reject(controller.signal.reason); }; response.once('drain', drain); controller.signal.addEventListener('abort', cancel, { once: true }); if (controller.signal.aborted)
+                        cancel(); });
+                continue;
+            }
+            if (done)
+                break;
+            await new Promise(resolve => { wake = resolve; if (done || controller.signal.aborted || queue.length)
+                notify(); });
+        }
+    }
+    catch (error) {
+        failure ??= error;
+    }
+    finally {
+        controller.signal.removeEventListener('abort', abort);
+        if (!controller.signal.aborted)
+            controller.abort(new Error('Stream completed'));
+        // A misbehaving iterator may ignore cancellation; retain the caller's resource
+        // slot until it actually settles. Never await unbounded cleanup for the socket.
+        cleanup = Promise.resolve().then(() => iterator.return?.()).catch(() => { });
+        if (!response.destroyed && !response.writableEnded) {
+            if (failure) {
+                const message = failure instanceof Error ? failure.message : 'Stream interrupted';
+                response.write(JSON.stringify({ type: 'stream-error', code: failure instanceof ProgramError ? failure.code : 'INTERRUPTED', message: message.slice(0, 512) }) + '\n');
+            }
+            response.end();
+        }
+    }
+    await pump;
+    await cleanup;
+}
+//# sourceMappingURL=stream-server.js.map

package/dist/app/stream-server.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"stream-server.js","sourceRoot":"","sources":["../../src/app/stream-server.ts"],"names":[],"mappings":"AAEA,OAAM,EAAC,UAAU,EAAC,YAAY,EAAC,MAAI,wBAAwB,CAAC;AAC5D;sEACsE;AACtE,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,QAAuB,EAAC,MAA+B,EAAC,UAA0B,EAAC,UAA6E,EAAE;IAC1M,MAAM,QAAQ,GAAC,OAAO,CAAC,aAAa,IAAE,GAAG,GAAC,IAAI,EAAC,QAAQ,GAAC,OAAO,CAAC,aAAa,IAAE,IAAI,GAAC,IAAI,EAAC,SAAS,GAAC,OAAO,CAAC,cAAc,IAAE,GAAG,CAAC;IAC/H,MAAM,KAAK,GAAU,EAAE,CAAC;IAAA,IAAI,KAAK,GAAC,CAAC,EAAC,IAAI,GAAC,KAAK,EAAC,OAAe,EAAC,IAAyB,CAAC;IACzF,MAAM,MAAM,GAAC,GAAE,EAAE,GAAC,IAAI,EAAE,EAAE,CAAC,CAAA,IAAI,GAAC,SAAS,CAAC,CAAA,CAAC,CAAC;IAAA,MAAM,KAAK,GAAC,GAAE,EAAE,GAAC,OAAO,KAAG,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA,MAAM,EAAE,CAAC,CAAA,CAAC,CAAC;IAAA,UAAU,CAAC,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAC,KAAK,EAAC,EAAC,IAAI,EAAC,IAAI,EAAC,CAAC,CAAC;IACzK,MAAM,QAAQ,GAAC,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,EAAE,CAAC;IAAA,IAAI,OAAkC,CAAC;IACrF,MAAM,IAAI,GAAC,CAAC,KAAK,IAAE,EAAE;QAAC,IAAG,CAAC;YAAA,OAAM,CAAC,UAAU,CAAC,MAAM,CAAC,OAAO,EAAC,CAAC;gBAAA,MAAM,IAAI,GAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;gBAAA,IAAG,IAAI,CAAC,IAAI;oBAAC,MAAM;gBAAA,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBAAA,MAAM,IAAI,GAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,GAAC,IAAI,CAAC,CAAC;gBAAA,IAAG,IAAI,CAAC,MAAM,GAAC,QAAQ,IAAE,KAAK,GAAC,IAAI,CAAC,MAAM,GAAC,QAAQ,IAAE,KAAK,CAAC,MAAM,IAAE,SAAS;oBAAC,MAAM,IAAI,YAAY,CAAC,iBAAiB,EAAC,wFAAwF,CAAC,CAAC;gBAAA,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBAAA,KAAK,IAAE,IAAI,CAAC,MAAM,CAAC;gBAAA,MAAM,EAAE,CAAC;YAAA,CAAC;QAAA,CAAC;QAC7b,OAAM,KAAK,EAAC,CAAC;YAAA,OAAO,GAAC,KAAK,CAAC;YAAA,UAAU,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAAA,CAAC;gBAAO,CAAC;YAAA,IAAI,GAAC,IAAI,CAAC;YAAA,MAAM,EAAE,CAAC;QAAA,CAAC;IAAA,CAAC,CAAC,EAAE,CAAC;IACtF,KAAK,IAAI,CAAC,KAAK,CAAC,GAAE,EAAE,GAAC,CAAC,CAAC,CAAC;IACxB,QAAQ,CAAC,SAAS,CAAC,GAAG,EAAC,EAAC,cAAc,EAAC,qCAAqC,EAAC,eAAe,EAAC,UAAU,EAAC,wBAAwB,EAAC,SAAS,EAAC,mBAAmB,EAAC,IAAI,EAAC,CAAC,CAAC;IAAA,QAAQ,CAAC,YAAY,EAAE,CAAC;IAC9L,IAAG,CAAC;QACH,OAAM,CAAC,UAAU,CAAC,MAAM,CAAC,OAAO,EAAC,CAAC;YAAA,IAAG,KAAK,CAAC,MAAM,EAAC,CAAC;gBAAA,MAAM,IAAI,GAAC,KAAK,CAAC,KAAK,EAAG,CAAC;gBAAA,KAAK,IAAE,IAAI,CAAC,MAAM,CAAC;gBAAA,IAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC;oBAAC,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAC,MAAM,EAAC,EAAE,GAAC,MAAM,OAAO,GAAC,GAAE,EAAE,GAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,EAAC,KAAK,CAAC,CAAC,CAAA,UAAU,CAAC,MAAM,CAAC,mBAAmB,CAAC,OAAO,EAAC,MAAM,CAAC,CAAC,CAAA,CAAC,CAAC,CAAA,MAAM,KAAK,GAAC,GAAE,EAAE,GAAC,OAAO,EAAE,CAAC,CAAA,OAAO,EAAE,CAAC,CAAA,CAAC,EAAC,MAAM,GAAC,GAAE,EAAE,GAAC,OAAO,EAAE,CAAC,CAAA,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAA,CAAC,CAAC,CAAA,QAAQ,CAAC,IAAI,CAAC,OAAO,EAAC,KAAK,CAAC,CAAC,CAAA,UAAU,CAAC,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAC,MAAM,EAAC,EAAC,IAAI,EAAC,IAAI,EAAC,CAAC,CAAC,CAAA,IAAG,UAAU,CAAC,MAAM,CAAC,OAAO;wBAAC,MAAM,EAAE,CAAC,CAAA,CAAC,CAAC,CAAC;gBAAA,SAAS;YAAA,CAAC;YAAA,IAAG,IAAI;gBAAC,MAAM;YAAA,MAAM,IAAI,OAAO,CAAO,OAAO,CAAA,EAAE,GAAC,IAAI,GAAC,OAAO,CAAC,CAAA,IAAG,IAAI,IAAE,UAAU,CAAC,MAAM,CAAC,OAAO,IAAE,KAAK,CAAC,MAAM;gBAAC,MAAM,EAAE,CAAC,CAAA,CAAC,CAAC,CAAC;QAAA,CAAC;IACtnB,CAAC;IAAA,OAAM,KAAK,EAAC,CAAC;QAAA,OAAO,KAAG,KAAK,CAAC;IAAA,CAAC;YACxB,CAAC;QACP,UAAU,CAAC,MAAM,CAAC,mBAAmB,CAAC,OAAO,EAAC,KAAK,CAAC,CAAC;QAAA,IAAG,CAAC,UAAU,CAAC,MAAM,CAAC,OAAO;YAAC,UAAU,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,kBAAkB,CAAC,CAAC,CAAC;QACnI,+EAA+E;QAC/E,gFAAgF;QAChF,OAAO,GAAC,OAAO,CAAC,OAAO,EAAE,CAAC,IAAI,CAAC,GAAE,EAAE,CAAA,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,GAAE,EAAE,GAAC,CAAC,CAAC,CAAC;QACtE,IAAG,CAAC,QAAQ,CAAC,SAAS,IAAE,CAAC,QAAQ,CAAC,aAAa,EAAC,CAAC;YAAA,IAAG,OAAO,EAAC,CAAC;gBAAA,MAAM,OAAO,GAAC,OAAO,YAAY,KAAK,CAAA,CAAC,CAAA,OAAO,CAAC,OAAO,CAAA,CAAC,CAAA,oBAAoB,CAAC;gBAAA,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,EAAC,IAAI,EAAC,cAAc,EAAC,IAAI,EAAC,OAAO,YAAY,YAAY,CAAA,CAAC,CAAA,OAAO,CAAC,IAAI,CAAA,CAAC,CAAA,aAAa,EAAC,OAAO,EAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAC,GAAG,CAAC,EAAC,CAAC,GAAC,IAAI,CAAC,CAAC;YAAA,CAAC;YAAA,QAAQ,CAAC,GAAG,EAAE,CAAC;QAAA,CAAC;IACnT,CAAC;IACD,MAAM,IAAI,CAAC;IAAA,MAAM,OAAO,CAAC;AAC1B,CAAC"}