@knpkv/codecommit-web 0.16.0 → 0.18.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (83) hide show
  1. package/README.md +16 -0
  2. package/dist/client/assets/index-BQbzvlT7.js +90 -0
  3. package/dist/client/assets/index-Rg2HVfx7.css +1 -0
  4. package/dist/client/assets/pr-review-workspace-B7GX-PRi.js +23 -0
  5. package/dist/client/index.html +2 -2
  6. package/dist/pull-request-coordinates.d.ts.map +1 -1
  7. package/dist/pull-request-coordinates.js +5 -4
  8. package/dist/pull-request-coordinates.js.map +1 -1
  9. package/dist/server/Api.d.ts +286 -286
  10. package/dist/server/Api.d.ts.map +1 -1
  11. package/dist/server/Api.js +1 -1
  12. package/dist/server/Api.js.map +1 -1
  13. package/dist/server/Server.d.ts +11 -7
  14. package/dist/server/Server.d.ts.map +1 -1
  15. package/dist/server/Server.js +28 -21
  16. package/dist/server/Server.js.map +1 -1
  17. package/dist/server/handlers/accounts-live.d.ts +1 -1
  18. package/dist/server/handlers/accounts-live.d.ts.map +1 -1
  19. package/dist/server/handlers/accounts-live.js +1 -1
  20. package/dist/server/handlers/accounts-live.js.map +1 -1
  21. package/dist/server/handlers/audit-live.d.ts +1 -1
  22. package/dist/server/handlers/audit-live.d.ts.map +1 -1
  23. package/dist/server/handlers/audit-live.js +1 -1
  24. package/dist/server/handlers/audit-live.js.map +1 -1
  25. package/dist/server/handlers/config-live.d.ts +1 -1
  26. package/dist/server/handlers/config-live.d.ts.map +1 -1
  27. package/dist/server/handlers/config-live.js +2 -2
  28. package/dist/server/handlers/config-live.js.map +1 -1
  29. package/dist/server/handlers/events-live.d.ts +1 -1
  30. package/dist/server/handlers/events-live.d.ts.map +1 -1
  31. package/dist/server/handlers/events-live.js +26 -8
  32. package/dist/server/handlers/events-live.js.map +1 -1
  33. package/dist/server/handlers/notifications-live.d.ts +2 -2
  34. package/dist/server/handlers/notifications-live.d.ts.map +1 -1
  35. package/dist/server/handlers/notifications-live.js +2 -2
  36. package/dist/server/handlers/notifications-live.js.map +1 -1
  37. package/dist/server/handlers/permissions-live.d.ts +1 -1
  38. package/dist/server/handlers/permissions-live.d.ts.map +1 -1
  39. package/dist/server/handlers/permissions-live.js +1 -1
  40. package/dist/server/handlers/permissions-live.js.map +1 -1
  41. package/dist/server/handlers/prs-live.d.ts +3 -3
  42. package/dist/server/handlers/prs-live.d.ts.map +1 -1
  43. package/dist/server/handlers/prs-live.js +3 -3
  44. package/dist/server/handlers/prs-live.js.map +1 -1
  45. package/dist/server/handlers/sandbox-live.d.ts +1 -1
  46. package/dist/server/handlers/sandbox-live.d.ts.map +1 -1
  47. package/dist/server/handlers/sandbox-live.js +2 -2
  48. package/dist/server/handlers/sandbox-live.js.map +1 -1
  49. package/dist/server/handlers/stats-live.d.ts +1 -1
  50. package/dist/server/handlers/stats-live.d.ts.map +1 -1
  51. package/dist/server/handlers/stats-live.js +1 -1
  52. package/dist/server/handlers/stats-live.js.map +1 -1
  53. package/dist/server/handlers/subscriptions-live.d.ts +1 -1
  54. package/dist/server/handlers/subscriptions-live.d.ts.map +1 -1
  55. package/dist/server/handlers/subscriptions-live.js +1 -1
  56. package/dist/server/handlers/subscriptions-live.js.map +1 -1
  57. package/dist/server/internal/OwnerSession.d.ts +18 -0
  58. package/dist/server/internal/OwnerSession.d.ts.map +1 -0
  59. package/dist/server/internal/OwnerSession.js +27 -0
  60. package/dist/server/internal/OwnerSession.js.map +1 -0
  61. package/dist/server/internal/PublicOrigin.d.ts +6 -0
  62. package/dist/server/internal/PublicOrigin.d.ts.map +1 -0
  63. package/dist/server/internal/PublicOrigin.js +12 -0
  64. package/dist/server/internal/PublicOrigin.js.map +1 -0
  65. package/dist/server/review/PullRequestReview.d.ts +1 -1
  66. package/dist/server/review/PullRequestReview.d.ts.map +1 -1
  67. package/dist/server/review/PullRequestReview.js +1 -1
  68. package/dist/server/review/PullRequestReview.js.map +1 -1
  69. package/dist/server/review/ReviewSkillCatalog.js +2 -2
  70. package/dist/tooling/authenticated-dev-proxy.d.ts +20 -5
  71. package/dist/tooling/authenticated-dev-proxy.d.ts.map +1 -1
  72. package/dist/tooling/authenticated-dev-proxy.js +25 -9
  73. package/dist/tooling/authenticated-dev-proxy.js.map +1 -1
  74. package/dist/tooling/authenticated-dev-proxy.test.js +92 -7
  75. package/dist/tooling/authenticated-dev-proxy.test.js.map +1 -1
  76. package/package.json +32 -26
  77. package/dist/client/assets/index-DqzI_8bH.js +0 -90
  78. package/dist/client/assets/index-Ds8Muxxv.css +0 -1
  79. package/dist/client/assets/pr-review-workspace-Ca3Vmiye.js +0 -22
  80. package/dist/server/internal/OwnerSessionSecurity.d.ts +0 -46
  81. package/dist/server/internal/OwnerSessionSecurity.d.ts.map +0 -1
  82. package/dist/server/internal/OwnerSessionSecurity.js +0 -143
  83. package/dist/server/internal/OwnerSessionSecurity.js.map +0 -1
package/README.md ADDED
@@ -0,0 +1,16 @@
1
+ # CodeCommit web pairing boundary
2
+
3
+ CodeCommit web owns an ephemeral, process-scoped owner session. Each bind rotates
4
+ the owner, CSRF, and bootstrap credentials; the bootstrap credential is valid for
5
+ 60 seconds, single-use, and limited to five failed unauthenticated attempts. The
6
+ owner cookie is HttpOnly and SameSite=Strict. This intentionally differs from
7
+ Control Center's durable workspace session (12-hour idle and 30-day absolute
8
+ lifetimes). The policy is the shared single-operator Owner Session from
9
+ `@knpkv/browser-pairing/owner-session` (ADR-0008); CodeCommit web keeps its API
10
+ middleware, wire errors, `cc_owner` cookie name, and dev-proxy model.
11
+
12
+ Origin checks use the configured loopback authority captured at bind time. The
13
+ request `Host` header is not an authority source. Browser reads that Fetch
14
+ Metadata marks as cross-site, or as same-site/`none` without the bound Origin,
15
+ are refused; explicit clients without Fetch Metadata still need the owner
16
+ cookie.