@knpkv/codecommit-web 0.16.0 → 0.17.0

package/dist/tooling/authenticated-dev-proxy.js

@@ -1,19 +1,35 @@
 export const authenticatedDevBackendOrigin = "http://127.0.0.1:3000";
 export const authenticatedDevPublicOrigin = "http://localhost:5173";
 export const authenticatedDevPublicOriginEnvironment = `CODECOMMIT_WEB_PUBLIC_ORIGIN=${authenticatedDevPublicOrigin}`;
-export const setAuthenticatedDevProxyOrigin = (request) => {
-    request.setHeader("origin", authenticatedDevBackendOrigin);
+export const authenticatedDevServerOptions = {
+    port: 5173,
+    strictPort: true
 };
-const authenticatedProxy = () => ({
-    target: authenticatedDevBackendOrigin,
+export const authenticatedDevProxyOriginDecision = (origin) => origin === undefined || origin === authenticatedDevPublicOrigin ? "forward" : "reject";
+export const setAuthenticatedDevProxyOrigin = (request, backendOrigin = authenticatedDevBackendOrigin) => {
+    request.setHeader("origin", backendOrigin);
+};
+export const registerAuthenticatedDevProxyOrigin = (proxy, backendOrigin = authenticatedDevBackendOrigin) => {
+    proxy.on("proxyReq", (request) => setAuthenticatedDevProxyOrigin(request, backendOrigin));
+};
+const authenticatedProxy = (backendOrigin) => ({
+    target: backendOrigin,
     changeOrigin: true,
+    bypass(request, response) {
+        if (authenticatedDevProxyOriginDecision(request.headers.origin) === "reject") {
+            response?.writeHead(403).end();
+            return false;
+        }
+        return undefined;
+    },
     configure(proxy) {
-        proxy.on("proxyReq", setAuthenticatedDevProxyOrigin);
+        registerAuthenticatedDevProxyOrigin(proxy, backendOrigin);
     }
 });
 /** Dev-only proxy routes that preserve the backend's exact-origin authorization boundary. */
-export const authenticatedDevProxyConfig = {
-    "/api": authenticatedProxy(),
-    "/auth": authenticatedProxy()
-};
+export const makeAuthenticatedDevProxyConfig = (backendOrigin = authenticatedDevBackendOrigin) => ({
+    "/api": authenticatedProxy(backendOrigin),
+    "/auth": authenticatedProxy(backendOrigin)
+});
+export const authenticatedDevProxyConfig = makeAuthenticatedDevProxyConfig();
 //# sourceMappingURL=authenticated-dev-proxy.js.map

package/dist/tooling/authenticated-dev-proxy.js.map

@@ -1 +1 @@
-{"version":3,"file":"authenticated-dev-proxy.js","sourceRoot":"","sources":["../../src/tooling/authenticated-dev-proxy.ts"],"names":[],"mappings":"AAEA,MAAM,CAAC,MAAM,6BAA6B,GAAG,uBAAuB,CAAA;AACpE,MAAM,CAAC,MAAM,4BAA4B,GAAG,uBAAuB,CAAA;AACnE,MAAM,CAAC,MAAM,uCAAuC,GAAG,gCAAgC,4BAA4B,EAAE,CAAA;AAMrH,MAAM,CAAC,MAAM,8BAA8B,GAAG,CAAC,OAA4B,EAAQ,EAAE;IACnF,OAAO,CAAC,SAAS,CAAC,QAAQ,EAAE,6BAA6B,CAAC,CAAA;AAC5D,CAAC,CAAA;AAED,MAAM,kBAAkB,GAAG,GAAiB,EAAE,CAAC,CAAC;IAC9C,MAAM,EAAE,6BAA6B;IACrC,YAAY,EAAE,IAAI;IAClB,SAAS,CAAC,KAAK;QACb,KAAK,CAAC,EAAE,CAAC,UAAU,EAAE,8BAA8B,CAAC,CAAA;IACtD,CAAC;CACF,CAAC,CAAA;AAEF,6FAA6F;AAC7F,MAAM,CAAC,MAAM,2BAA2B,GAAG;IACzC,MAAM,EAAE,kBAAkB,EAAE;IAC5B,OAAO,EAAE,kBAAkB,EAAE;CACS,CAAA"}
+{"version":3,"file":"authenticated-dev-proxy.js","sourceRoot":"","sources":["../../src/tooling/authenticated-dev-proxy.ts"],"names":[],"mappings":"AAEA,MAAM,CAAC,MAAM,6BAA6B,GAAG,uBAAuB,CAAA;AACpE,MAAM,CAAC,MAAM,4BAA4B,GAAG,uBAAuB,CAAA;AACnE,MAAM,CAAC,MAAM,uCAAuC,GAAG,gCAAgC,4BAA4B,EAAE,CAAA;AACrH,MAAM,CAAC,MAAM,6BAA6B,GAAG;IAC3C,IAAI,EAAE,IAAI;IACV,UAAU,EAAE,IAAI;CACjB,CAAA;AAID,MAAM,CAAC,MAAM,mCAAmC,GAAG,CAAC,MAA0B,EAAuC,EAAE,CACrH,MAAM,KAAK,SAAS,IAAI,MAAM,KAAK,4BAA4B,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAA;AAaxF,MAAM,CAAC,MAAM,8BAA8B,GAAG,CAC5C,OAA4B,EAC5B,aAAa,GAAW,6BAA6B,EAC/C,EAAE;IACR,OAAO,CAAC,SAAS,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAA;AAC5C,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,mCAAmC,GAAG,CACjD,KAA0C,EAC1C,aAAa,GAAW,6BAA6B,EAC/C,EAAE;IACR,KAAK,CAAC,EAAE,CAAC,UAAU,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,8BAA8B,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC,CAAA;AAC3F,CAAC,CAAA;AAcD,MAAM,kBAAkB,GAAG,CAAC,aAAqB,EAA6B,EAAE,CAAC,CAAC;IAChF,MAAM,EAAE,aAAa;IACrB,YAAY,EAAE,IAAI;IAClB,MAAM,CAAC,OAAO,EAAE,QAAQ;QACtB,IAAI,mCAAmC,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,QAAQ,EAAE,CAAC;YAC7E,QAAQ,EAAE,SAAS,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAA;YAC9B,OAAO,KAAK,CAAA;QACd,CAAC;QACD,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,SAAS,CAAC,KAAK;QACb,mCAAmC,CAAC,KAAK,EAAE,aAAa,CAAC,CAAA;IAC3D,CAAC;CACF,CAAC,CAAA;AAEF,6FAA6F;AAC7F,MAAM,CAAC,MAAM,+BAA+B,GAAG,CAC7C,aAAa,GAAW,6BAA6B,EACxB,EAAE,CAAC,CAAC;IACjC,MAAM,EAAE,kBAAkB,CAAC,aAAa,CAAC;IACzC,OAAO,EAAE,kBAAkB,CAAC,aAAa,CAAC;CAC3C,CAAC,CAAA;AAEF,MAAM,CAAC,MAAM,2BAA2B,GAAG,+BAA+B,EAAE,CAAA"}

package/dist/tooling/authenticated-dev-proxy.test.js

@@ -1,9 +1,15 @@
 import { describe, expect, it, vi } from "@effect/vitest";
-import { Redacted } from "effect";
+import { CsrfToken, PairingCode, SessionToken } from "@knpkv/browser-pairing/schema";
+import { Effect, Redacted, Ref, Result, Schema } from "effect";
+import { IncomingMessage, ServerResponse } from "node:http";
+import { Socket } from "node:net";
 import packageJson from "../../package.json" with { type: "json" };
-import { ownerSessionUrlForOrigin } from "../server/internal/OwnerSessionSecurity.js";
-import { authenticatedDevBackendOrigin, authenticatedDevProxyConfig, authenticatedDevPublicOrigin, authenticatedDevPublicOriginEnvironment, setAuthenticatedDevProxyOrigin } from "./authenticated-dev-proxy.js";
+import { authorizeBootstrapRequest, ownerSessionOrigin, ownerSessionUrlForOrigin, requireLoopbackOrigin } from "../server/internal/OwnerSessionSecurity.js";
+import { authenticatedDevBackendOrigin, authenticatedDevProxyConfig, authenticatedDevProxyOriginDecision, authenticatedDevPublicOrigin, authenticatedDevPublicOriginEnvironment, authenticatedDevServerOptions, makeAuthenticatedDevProxyConfig, setAuthenticatedDevProxyOrigin } from "./authenticated-dev-proxy.js";
 describe("authenticated development proxy", () => {
+    it("pins Vite to the advertised development port", () => {
+        expect(authenticatedDevServerOptions).toEqual({ port: 5173, strictPort: true });
+    });
     it("proxies bootstrap and API traffic through one exact backend origin", () => {
         expect(Object.keys(authenticatedDevProxyConfig).sort()).toEqual(["/api", "/auth"]);
         for (const options of Object.values(authenticatedDevProxyConfig)) {
@@ -14,13 +20,98 @@ describe("authenticated development proxy", () => {
         setAuthenticatedDevProxyOrigin({ setHeader });
         expect(setHeader).toHaveBeenCalledWith("origin", authenticatedDevBackendOrigin);
     });
+    it("rejects foreign browser origins before the proxy rewrites them", () => {
+        expect(authenticatedDevProxyOriginDecision(authenticatedDevPublicOrigin)).toBe("forward");
+        expect(authenticatedDevProxyOriginDecision(undefined)).toBe("forward");
+        expect(authenticatedDevProxyOriginDecision("http://localhost:4000")).toBe("reject");
+        for (const options of Object.values(authenticatedDevProxyConfig)) {
+            expect(options.bypass).toBeTypeOf("function");
+            if (options.bypass === undefined)
+                continue;
+            const request = new IncomingMessage(new Socket());
+            request.headers.origin = "http://localhost:4000";
+            const response = new ServerResponse(request);
+            const writeHead = vi.spyOn(response, "writeHead").mockReturnValue(response);
+            const end = vi.spyOn(response, "end").mockReturnValue(response);
+            const result = options.bypass(request, response, options);
+            expect(result).toBe(false);
+            expect(writeHead).toHaveBeenCalledWith(403);
+            expect(end).toHaveBeenCalledOnce();
+        }
+    });
+    it("registers the origin rewrite on the proxy request event", () => {
+        const listeners = [];
+        const proxy = {
+            on: (_event, listener) => {
+                listeners.push(listener);
+            }
+        };
+        for (const options of Object.values(authenticatedDevProxyConfig))
+            options.configure(proxy, options);
+        expect(listeners).toHaveLength(2);
+        const setHeader = vi.fn();
+        for (const listener of listeners)
+            listener({ setHeader });
+        expect(setHeader).toHaveBeenCalledTimes(2);
+        expect(setHeader).toHaveBeenCalledWith("origin", authenticatedDevBackendOrigin);
+    });
+    it("retargets both proxy routes when the server retries on another port", () => {
+        const retryOrigin = "http://127.0.0.1:3001";
+        const config = makeAuthenticatedDevProxyConfig(retryOrigin);
+        for (const options of Object.values(config)) {
+            expect(options.target).toBe(retryOrigin);
+            expect(options.configure).toBeTypeOf("function");
+        }
+        const listeners = [];
+        const proxy = {
+            on: (_event, listener) => {
+                listeners.push(listener);
+            }
+        };
+        for (const options of Object.values(config))
+            options.configure(proxy, options);
+        const setHeader = vi.fn();
+        for (const listener of listeners)
+            listener({ setHeader });
+        expect(setHeader).toHaveBeenCalledTimes(2);
+        expect(setHeader).toHaveBeenCalledWith("origin", retryOrigin);
+    });
+    it.effect("accepts a bootstrap request after the proxy origin rewrite", () => Effect.gen(function* () {
+        const secrets = {
+            authorityOrigin: yield* requireLoopbackOrigin(ownerSessionOrigin("127.0.0.1", 3000)),
+            bootstrapAvailable: yield* Ref.make(true),
+            bootstrapAttemptState: yield* Ref.make({ failedAttempts: 0, inFlight: 0 }),
+            bootstrapExpiresAtMillis: yield* Ref.make(Number.MAX_SAFE_INTEGER),
+            bootstrapToken: Redacted.make(Schema.decodeSync(PairingCode)("ab".repeat(32))),
+            csrfToken: Redacted.make(Schema.decodeSync(CsrfToken)("cd".repeat(32))),
+            ownerToken: Redacted.make(Schema.decodeSync(SessionToken)("ef".repeat(32)))
+        };
+        const result = yield* Effect.result(authorizeBootstrapRequest({
+            authorization: `Bearer ${Redacted.value(secrets.bootstrapToken)}`,
+            host: "127.0.0.1:3000",
+            origin: authenticatedDevBackendOrigin
+        }, secrets));
+        expect(Result.isSuccess(result)).toBe(true);
+    }));
     it("advertises the token-bearing bootstrap URL on the Vite origin", () => {
         expect(packageJson.scripts.dev).toContain(authenticatedDevPublicOriginEnvironment);
+        const predev = packageJson.scripts.predev;
+        expect(predev).toContain("@knpkv/browser-pairing");
+        expect(predev).toContain("@knpkv/relay-product...");
+        expect(predev).toContain("@knpkv/review...");
+        expect(predev.endsWith("pnpm build")).toBe(true);
+        expect(predev.indexOf("@knpkv/browser-pairing")).toBeLessThan(predev.indexOf("@knpkv/relay-product..."));
+        expect(predev.indexOf("@knpkv/relay-product...")).toBeLessThan(predev.indexOf("@knpkv/review..."));
         const url = ownerSessionUrlForOrigin(authenticatedDevPublicOrigin, {
-            bootstrapToken: Redacted.make("bootstrap-secret")
+            bootstrapToken: Redacted.make(Schema.decodeSync(PairingCode)("ab".repeat(32)))
         });
-        expect(url).toBe("http://localhost:5173/#bootstrap_token=bootstrap-secret");
+        expect(url).toBe(`http://localhost:5173/#bootstrap_token=${"ab".repeat(32)}`);
         expect(url).not.toContain(authenticatedDevBackendOrigin);
     });
+    it("keeps the configured backend authority separate from the advertised Vite origin", () => {
+        expect(ownerSessionOrigin("127.0.0.1", 3000)).toBe(`${authenticatedDevBackendOrigin}/`);
+        expect(authenticatedDevPublicOrigin).not.toBe(authenticatedDevBackendOrigin);
+        expect(setAuthenticatedDevProxyOrigin).toBeTypeOf("function");
+    });
 });
 //# sourceMappingURL=authenticated-dev-proxy.test.js.map

package/dist/tooling/authenticated-dev-proxy.test.js.map

@@ -1 +1 @@
-{"version":3,"file":"authenticated-dev-proxy.test.js","sourceRoot":"","sources":["../../src/tooling/authenticated-dev-proxy.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,EAAE,MAAM,gBAAgB,CAAA;AACzD,OAAO,EAAE,QAAQ,EAAE,MAAM,QAAQ,CAAA;AACjC,OAAO,WAAW,MAAM,oBAAoB,CAAC,OAAO,IAAI,EAAE,MAAM,EAAE,CAAA;AAClE,OAAO,EAAE,wBAAwB,EAAE,MAAM,4CAA4C,CAAA;AACrF,OAAO,EACL,6BAA6B,EAC7B,2BAA2B,EAC3B,4BAA4B,EAC5B,uCAAuC,EACvC,8BAA8B,EAC/B,MAAM,8BAA8B,CAAA;AAErC,QAAQ,CAAC,iCAAiC,EAAE,GAAG,EAAE;IAC/C,EAAE,CAAC,oEAAoE,EAAE,GAAG,EAAE;QAC5E,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,2BAA2B,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAA;QAClF,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,MAAM,CAAC,2BAA2B,CAAC,EAAE,CAAC;YACjE,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,6BAA6B,CAAC,CAAA;YAC1D,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QACzC,CAAC;QAED,MAAM,SAAS,GAAG,EAAE,CAAC,EAAE,EAAE,CAAA;QACzB,8BAA8B,CAAC,EAAE,SAAS,EAAE,CAAC,CAAA;QAC7C,MAAM,CAAC,SAAS,CAAC,CAAC,oBAAoB,CAAC,QAAQ,EAAE,6BAA6B,CAAC,CAAA;IACjF,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,+DAA+D,EAAE,GAAG,EAAE;QACvE,MAAM,CAAC,WAAW,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,uCAAuC,CAAC,CAAA;QAClF,MAAM,GAAG,GAAG,wBAAwB,CAAC,4BAA4B,EAAE;YACjE,cAAc,EAAE,QAAQ,CAAC,IAAI,CAAC,kBAAkB,CAAC;SAClD,CAAC,CAAA;QACF,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,yDAAyD,CAAC,CAAA;QAC3E,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,6BAA6B,CAAC,CAAA;IAC1D,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA"}
+{"version":3,"file":"authenticated-dev-proxy.test.js","sourceRoot":"","sources":["../../src/tooling/authenticated-dev-proxy.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,EAAE,MAAM,gBAAgB,CAAA;AACzD,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,+BAA+B,CAAA;AACpF,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAA;AAC9D,OAAO,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,WAAW,CAAA;AAC3D,OAAO,EAAE,MAAM,EAAE,MAAM,UAAU,CAAA;AACjC,OAAO,WAAW,MAAM,oBAAoB,CAAC,OAAO,IAAI,EAAE,MAAM,EAAE,CAAA;AAClE,OAAO,EACL,yBAAyB,EACzB,kBAAkB,EAElB,wBAAwB,EACxB,qBAAqB,EACtB,MAAM,4CAA4C,CAAA;AACnD,OAAO,EACL,6BAA6B,EAC7B,2BAA2B,EAC3B,mCAAmC,EACnC,4BAA4B,EAC5B,uCAAuC,EACvC,6BAA6B,EAC7B,+BAA+B,EAC/B,8BAA8B,EAC/B,MAAM,8BAA8B,CAAA;AAErC,QAAQ,CAAC,iCAAiC,EAAE,GAAG,EAAE;IAC/C,EAAE,CAAC,8CAA8C,EAAE,GAAG,EAAE;QACtD,MAAM,CAAC,6BAA6B,CAAC,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAA;IACjF,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,oEAAoE,EAAE,GAAG,EAAE;QAC5E,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,2BAA2B,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAA;QAClF,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,MAAM,CAAC,2BAA2B,CAAC,EAAE,CAAC;YACjE,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,6BAA6B,CAAC,CAAA;YAC1D,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QACzC,CAAC;QAED,MAAM,SAAS,GAAG,EAAE,CAAC,EAAE,EAAE,CAAA;QACzB,8BAA8B,CAAC,EAAE,SAAS,EAAE,CAAC,CAAA;QAC7C,MAAM,CAAC,SAAS,CAAC,CAAC,oBAAoB,CAAC,QAAQ,EAAE,6BAA6B,CAAC,CAAA;IACjF,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,gEAAgE,EAAE,GAAG,EAAE;QACxE,MAAM,CAAC,mCAAmC,CAAC,4BAA4B,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;QACzF,MAAM,CAAC,mCAAmC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;QACtE,MAAM,CAAC,mCAAmC,CAAC,uBAAuB,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;QACnF,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,MAAM,CAAC,2BAA2B,CAAC,EAAE,CAAC;YACjE,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,UAAU,CAAC,UAAU,CAAC,CAAA;YAC7C,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS;gBAAE,SAAQ;YAC1C,MAAM,OAAO,GAAG,IAAI,eAAe,CAAC,IAAI,MAAM,EAAE,CAAC,CAAA;YACjD,OAAO,CAAC,OAAO,CAAC,MAAM,GAAG,uBAAuB,CAAA;YAChD,MAAM,QAAQ,GAAG,IAAI,cAAc,CAAC,OAAO,CAAC,CAAA;YAC5C,MAAM,SAAS,GAAG,EAAE,CAAC,KAAK,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAA;YAC3E,MAAM,GAAG,GAAG,EAAE,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAA;YAC/D,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,OAAO,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAA;YACzD,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;YAC1B,MAAM,CAAC,SAAS,CAAC,CAAC,oBAAoB,CAAC,GAAG,CAAC,CAAA;YAC3C,MAAM,CAAC,GAAG,CAAC,CAAC,oBAAoB,EAAE,CAAA;QACpC,CAAC;IACH,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,yDAAyD,EAAE,GAAG,EAAE;QACjE,MAAM,SAAS,GAA4F,EAAE,CAAA;QAC7G,MAAM,KAAK,GAAG;YACZ,EAAE,EAAE,CACF,MAAkB,EAClB,QAA0F,EAC1F,EAAE;gBACF,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;YAC1B,CAAC;SACF,CAAA;QACD,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,MAAM,CAAC,2BAA2B,CAAC;YAAE,OAAO,CAAC,SAAS,CAAC,KAAK,EAAE,OAAO,CAAC,CAAA;QACnG,MAAM,CAAC,SAAS,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAA;QACjC,MAAM,SAAS,GAAG,EAAE,CAAC,EAAE,EAAE,CAAA;QACzB,KAAK,MAAM,QAAQ,IAAI,SAAS;YAAE,QAAQ,CAAC,EAAE,SAAS,EAAE,CAAC,CAAA;QACzD,MAAM,CAAC,SAAS,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAA;QAC1C,MAAM,CAAC,SAAS,CAAC,CAAC,oBAAoB,CAAC,QAAQ,EAAE,6BAA6B,CAAC,CAAA;IACjF,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,qEAAqE,EAAE,GAAG,EAAE;QAC7E,MAAM,WAAW,GAAG,uBAAuB,CAAA;QAC3C,MAAM,MAAM,GAAG,+BAA+B,CAAC,WAAW,CAAC,CAAA;QAC3D,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;YAC5C,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAA;YACxC,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,UAAU,CAAC,UAAU,CAAC,CAAA;QAClD,CAAC;QACD,MAAM,SAAS,GAA4F,EAAE,CAAA;QAC7G,MAAM,KAAK,GAAG;YACZ,EAAE,EAAE,CACF,MAAkB,EAClB,QAA0F,EAC1F,EAAE;gBACF,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;YAC1B,CAAC;SACF,CAAA;QACD,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC;YAAE,OAAO,CAAC,SAAS,CAAC,KAAK,EAAE,OAAO,CAAC,CAAA;QAC9E,MAAM,SAAS,GAAG,EAAE,CAAC,EAAE,EAAE,CAAA;QACzB,KAAK,MAAM,QAAQ,IAAI,SAAS;YAAE,QAAQ,CAAC,EAAE,SAAS,EAAE,CAAC,CAAA;QACzD,MAAM,CAAC,SAAS,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAA;QAC1C,MAAM,CAAC,SAAS,CAAC,CAAC,oBAAoB,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAA;IAC/D,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,MAAM,CAAC,4DAA4D,EAAE,GAAG,EAAE,CAC3E,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;QAClB,MAAM,OAAO,GAAG;YACd,eAAe,EAAE,KAAK,CAAC,CAAC,qBAAqB,CAAC,kBAAkB,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;YACpF,kBAAkB,EAAE,KAAK,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC;YACzC,qBAAqB,EAAE,KAAK,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,cAAc,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC;YAC1E,wBAAwB,EAAE,KAAK,CAAC,CAAC,GAAG,CAAC,IAAI,CAAqB,MAAM,CAAC,gBAAgB,CAAC;YACtF,cAAc,EAAE,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;YAC9E,SAAS,EAAE,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;YACvE,UAAU,EAAE,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;SACtC,CAAA;QACvC,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,yBAAyB,CAAC;YAC5D,aAAa,EAAE,UAAU,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,cAAc,CAAC,EAAE;YACjE,IAAI,EAAE,gBAAgB;YACtB,MAAM,EAAE,6BAA6B;SACtC,EAAE,OAAO,CAAC,CAAC,CAAA;QACZ,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IAC7C,CAAC,CAAC,CAAC,CAAA;IAEL,EAAE,CAAC,+DAA+D,EAAE,GAAG,EAAE;QACvE,MAAM,CAAC,WAAW,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,uCAAuC,CAAC,CAAA;QAClF,MAAM,MAAM,GAAG,WAAW,CAAC,OAAO,CAAC,MAAM,CAAA;QACzC,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,wBAAwB,CAAC,CAAA;QAClD,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,yBAAyB,CAAC,CAAA;QACnD,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,kBAAkB,CAAC,CAAA;QAC5C,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QAChD,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,wBAAwB,CAAC,CAAC,CAAC,YAAY,CAAC,MAAM,CAAC,OAAO,CAAC,yBAAyB,CAAC,CAAC,CAAA;QACxG,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,yBAAyB,CAAC,CAAC,CAAC,YAAY,CAAC,MAAM,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAC,CAAA;QAClG,MAAM,GAAG,GAAG,wBAAwB,CAAC,4BAA4B,EAAE;YACjE,cAAc,EAAE,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;SAC/E,CAAC,CAAA;QACF,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,0CAA0C,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC,CAAA;QAC7E,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,6BAA6B,CAAC,CAAA;IAC1D,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,iFAAiF,EAAE,GAAG,EAAE;QACzF,MAAM,CAAC,kBAAkB,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,6BAA6B,GAAG,CAAC,CAAA;QACvF,MAAM,CAAC,4BAA4B,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,6BAA6B,CAAC,CAAA;QAC5E,MAAM,CAAC,8BAA8B,CAAC,CAAC,UAAU,CAAC,UAAU,CAAC,CAAA;IAC/D,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@knpkv/codecommit-web",
-  "version": "0.16.0",
+  "version": "0.17.0",
   "description": "Web server and frontend for CodeCommit PR browser",
   "type": "module",
   "main": "dist/index.js",
@@ -11,9 +11,9 @@
     "dist"
   ],
   "dependencies": {
-    "@effect/atom-react": "4.0.0-rc.109",
-    "@effect/platform-bun": "4.0.0-rc.109",
-    "@effect/platform-node": "4.0.0-rc.109",
+    "@effect/atom-react": "4.0.0",
+    "@effect/platform-bun": "4.0.0",
+    "@effect/platform-node": "4.0.0",
     "@fontsource-variable/geist": "^5.3.0",
     "@fontsource-variable/geist-mono": "^5.3.0",
     "@formkit/auto-animate": "^0.10.0",
@@ -23,45 +23,51 @@
     "clsx": "^2.1.1",
     "cmdk": "^1.1.1",
     "diff": "9.0.0",
-    "effect": "4.0.0-rc.109",
-    "lucide-react": "^1.31.0",
+    "effect": "4.0.0",
+    "lucide-react": "^1.50.0",
     "radix-ui": "^1.6.7",
-    "react": "^19.2.8",
-    "react-day-picker": "^10.0.1",
-    "react-dom": "^19.2.8",
+    "react": "^19.3.0",
+    "react-day-picker": "^10.0.2",
+    "react-dom": "^19.3.0",
     "react-markdown": "^10.1.0",
-    "react-router": "8.3.0",
+    "react-router": "8.4.0",
     "rehype-sanitize": "^6.0.0",
     "remark-gfm": "^4.0.1",
     "sonner": "^2.0.8",
-    "tailwind-merge": "^3.6.0",
+    "tailwind-merge": "^3.7.0",
     "tailwindcss": "^4.3.3",
     "tw-animate-css": "^1.4.0",
-    "@knpkv/ai-codex": "^0.4.0",
-    "@knpkv/review": "^0.2.1",
-    "@knpkv/codecommit-core": "^0.16.0",
-    "@knpkv/ai-claude": "^0.3.0",
-    "@knpkv/rly": "^0.5.1",
-    "@knpkv/relay-product": "^0.1.0"
+    "@knpkv/ai-claude": "^0.4.0",
+    "@knpkv/ai-codex": "^0.5.0",
+    "@knpkv/relay-product": "^0.2.0",
+    "@knpkv/codecommit-core": "^0.17.0",
+    "@knpkv/review": "^0.3.0",
+    "@knpkv/browser-pairing": "^0.2.0",
+    "@knpkv/rly": "^0.6.0"
   },
   "devDependencies": {
-    "@effect/vitest": "4.0.0-rc.109",
-    "@playwright/test": "1.62.1",
-    "@types/react": "^19.2.18",
-    "@types/react-dom": "^19.2.4",
-    "@vitejs/plugin-react": "^6.0.5",
+    "@effect/vitest": "4.0.0",
+    "@playwright/test": "1.63.0",
+    "@types/react": "^19.3.0",
+    "@types/react-dom": "^19.3.0",
+    "@vitejs/plugin-react": "^6.1.1",
     "typescript": "npm:@typescript/typescript6@^6.0.2",
-    "vite": "^8.2.1",
-    "vitest": "^4.1.10"
+    "vite": "^8.3.2",
+    "vitest": "^5.0.3"
   },
   "scripts": {
     "start": "bun run src/main.ts",
+    "predev": "pnpm --filter @knpkv/browser-pairing build && pnpm --filter \"@knpkv/relay-product...\" build && pnpm --filter \"@knpkv/review...\" build && pnpm build",
+    "prestart": "pnpm --filter @knpkv/browser-pairing build && pnpm --filter \"@knpkv/relay-product...\" build && pnpm --filter \"@knpkv/review...\" build && pnpm build",
     "dev": "CODECOMMIT_WEB_PUBLIC_ORIGIN=http://localhost:5173 bun run --watch src/main.ts & vite --clearScreen false",
+    "prebuild": "pnpm --filter @knpkv/browser-pairing build",
+    "precheck": "pnpm --filter @knpkv/browser-pairing build",
     "build": "tsc -b && vite build",
-    "check": "tsc -b tsconfig.json",
+    "check": "tsc -b tsconfig.json && tsc -p tsconfig.roles.json --noEmit",
+    "pretest": "pnpm --filter @knpkv/browser-pairing build",
     "test": "vitest",
     "test:relay-smoke:real": "vitest run --config vitest.real-smoke.config.ts",
-    "test:browser": "pnpm --filter \"@knpkv/relay-product...\" build && pnpm --filter \"@knpkv/review...\" build && pnpm build && playwright test --config playwright.config.ts",
+    "test:browser": "pnpm --filter \"@knpkv/browser-pairing\" build && pnpm --filter \"@knpkv/relay-product...\" build && pnpm --filter \"@knpkv/review...\" build && pnpm build && playwright test --config playwright.config.ts",
     "lint": "eslint \"{src,test,e2e}/**/*.{ts,tsx}\" playwright.config.ts",
     "docgen": "docgen"
   },