@loomhelix/deptrail 0.1.0

package/dist/server/router.js

@@ -0,0 +1,474 @@
+import { ActionError } from "../actions/action-error.js";
+import { disabledActions } from "../actions/action-service.js";
+import { isObjectId } from "../git/git-commands.js";
+import { compareSources } from "../query/compare.js";
+import { BranchError, COMMIT_ACTIONS_REASON, COMMIT_RESOLVE_REASON } from "./branches.js";
+import { PLACEHOLDER_PREFIX } from "../model.js";
+import { decodeRootSegment } from "./root-segment.js";
+import { children } from "../query/children.js";
+import { decorations, issueCounts } from "../query/decorations.js";
+import { dependents } from "../query/dependents.js";
+import { duplicates } from "../query/duplicates.js";
+import { issuesByDirect, issuesByPackage } from "../query/issues.js";
+import { ALL_KINDS, findNode, UnknownNodeError } from "../query/lookup.js";
+import { packageInsight } from "../query/package-insight.js";
+import { search } from "../query/search.js";
+import { subgraph } from "../query/subgraph.js";
+const DEFAULT_DEPTH = 1;
+const DEFAULT_UP = 3;
+const DEFAULT_DOWN = 1;
+const DEFAULT_LIMIT = 300;
+const DEFAULT_GROUP_BY = 'package';
+export class BadRequestError extends Error {
+}
+function reply(status, body) {
+    return { status, body };
+}
+function failure(status, message) {
+    return reply(status, { error: message });
+}
+function importerSummaries(root) {
+    return root.importers.map(({ id, path, name, deps }) => ({ id, path, name, dependencyCount: deps.length }));
+}
+function summarizeRoot({ session, enrichment, actions }, root) {
+    const summary = {
+        id: root.id,
+        path: root.path,
+        manager: root.manager,
+        source: root.source,
+        status: root.status,
+        warnings: root.warnings,
+        importers: importerSummaries(root),
+        packageCount: [...root.packages.keys()].filter((id) => !id.startsWith(PLACEHOLDER_PREFIX)).length,
+        duplicateCount: duplicates(session.index, root.id).length,
+        hasAuth: root.config?.hasAuth ?? false,
+        actions: actions.summary(root),
+    };
+    if (root.error !== undefined)
+        summary.error = root.error;
+    if (root.status === 'ready')
+        summary.issueCounts = issueCounts(enrichment, root);
+    return summary;
+}
+function anyRootScanning(roots) {
+    return roots.some((root) => root.status === 'scanning');
+}
+export function summarizeScan(context) {
+    const { repoPath, scannedAt, roots } = context.session.scan;
+    return {
+        repoPath,
+        scannedAt,
+        roots: roots.map((root) => summarizeRoot(context, root)),
+        enrichment: context.enrichment.status(anyRootScanning(roots)),
+    };
+}
+function readyRoot(session, rootId) {
+    const root = session.root(rootId);
+    if (!root)
+        return { failure: failure(404, `Unknown root ${rootId}`) };
+    if (root.status !== 'ready')
+        return { failure: failure(409, `Root ${rootId} is ${root.status}`) };
+    return { root };
+}
+function integerParam(params, name, fallback, minimum) {
+    const raw = params.get(name);
+    if (raw === null)
+        return fallback;
+    const value = Number(raw);
+    if (raw.trim() === '' || !Number.isInteger(value) || value < minimum) {
+        throw new BadRequestError(`Invalid ${name}: expected an integer >= ${minimum}`);
+    }
+    return value;
+}
+function kindsParam(params) {
+    const raw = params.get('kinds');
+    if (raw === null)
+        return ALL_KINDS;
+    const requested = raw.split(',');
+    for (const kind of requested) {
+        if (!ALL_KINDS.has(kind))
+            throw new BadRequestError(`Unknown kind: ${kind}`);
+    }
+    return new Set(requested);
+}
+function groupByParam(params) {
+    const raw = params.get('groupBy') ?? DEFAULT_GROUP_BY;
+    if (raw !== 'package' && raw !== 'direct')
+        throw new BadRequestError('Invalid groupBy: expected package or direct');
+    return raw;
+}
+function monolithVersionsOf(session, root, nodeId) {
+    const node = findNode(root, nodeId);
+    if (!node)
+        return [];
+    return [...new Set((session.index.get(node.name) ?? []).map((entry) => entry.version))];
+}
+const NODE_HANDLERS = new Map(Object.entries({
+    actions: ({ actions }, root, nodeId, params) => actions.nodeActions(root.id, nodeId, kindsParam(params)),
+    children: (_context, root, nodeId, params) => children(root, nodeId, integerParam(params, 'depth', DEFAULT_DEPTH, 0), kindsParam(params)),
+    dependents: (_context, root, nodeId, params) => dependents(root, nodeId, integerParam(params, 'depth', DEFAULT_DEPTH, 0), kindsParam(params)),
+    subgraph: (_context, root, nodeId, params) => subgraph(root, nodeId, {
+        up: integerParam(params, 'up', DEFAULT_UP, 0),
+        down: integerParam(params, 'down', DEFAULT_DOWN, 0),
+        limit: integerParam(params, 'limit', DEFAULT_LIMIT, 1),
+        kinds: kindsParam(params),
+    }),
+    insight: ({ session, enrichment }, root, nodeId, params) => packageInsight(enrichment, root, nodeId, kindsParam(params), monolithVersionsOf(session, root, nodeId)),
+}));
+function runDetached(work, logError, context) {
+    work.catch((failure) => logError(context, failure));
+}
+function rootSegmentPosition(raw) {
+    if (raw[1] === 'roots')
+        return 2;
+    if (raw[1] === 'commits' && raw[3] === 'roots')
+        return 4;
+    return -1;
+}
+function decodeSegments(pathname) {
+    try {
+        const raw = pathname.split('/').slice(1);
+        const rootPosition = rootSegmentPosition(raw);
+        return raw.map((segment, position) => position === rootPosition ? decodeRootSegment(segment) : decodeURIComponent(segment));
+    }
+    catch {
+        return null;
+    }
+}
+async function handleNodeRoute(context, request, rootId, nodeId, action) {
+    const handler = NODE_HANDLERS.get(action);
+    if (!handler)
+        return failure(404, 'Not found');
+    if (request.method !== 'GET')
+        return failure(405, 'Method not allowed');
+    const lookup = readyRoot(context.session, rootId);
+    if (lookup.failure)
+        return lookup.failure;
+    return reply(200, await handler(context, lookup.root, nodeId, request.searchParams));
+}
+function handleDecorations(context, request, rootId) {
+    if (request.method !== 'GET')
+        return failure(405, 'Method not allowed');
+    const lookup = readyRoot(context.session, rootId);
+    if (lookup.failure)
+        return lookup.failure;
+    const { enrichment } = context;
+    const body = { revision: enrichment.revision, nodes: decorations(enrichment, lookup.root, kindsParam(request.searchParams)) };
+    return reply(200, body);
+}
+function invalidBody(expected) {
+    return new BadRequestError(`Invalid body: expected ${expected}`);
+}
+function isRecord(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+function isOptional(value, check) {
+    return value === undefined || check(value);
+}
+function isString(value) {
+    return typeof value === 'string';
+}
+function isStringArray(value) {
+    return Array.isArray(value) && value.every(isString);
+}
+const ADD_CHANGE_SHAPE = '{ nodeId: string, choice: string, version?: string, importers?: string[], kinds?: string[] }';
+const KINDS_SHAPE = '{ kinds?: string[] }';
+const INVALID_KINDS = 'Invalid kinds';
+const APPLY_SHAPE = '{ previewId: string, install: boolean }';
+function addChangeBody(body) {
+    if (!isRecord(body) ||
+        !isString(body.nodeId) ||
+        !isString(body.choice) ||
+        !isOptional(body.version, isString) ||
+        !isOptional(body.importers, isStringArray) ||
+        !isOptional(body.kinds, isStringArray)) {
+        throw invalidBody(ADD_CHANGE_SHAPE);
+    }
+    return body;
+}
+function kindsBody(body) {
+    if (body === undefined)
+        return ALL_KINDS;
+    if (!isRecord(body) || !isOptional(body.kinds, isStringArray))
+        throw invalidBody(KINDS_SHAPE);
+    if (body.kinds === undefined)
+        return ALL_KINDS;
+    if (body.kinds.length === 0)
+        throw new BadRequestError(INVALID_KINDS);
+    for (const kind of body.kinds) {
+        if (!ALL_KINDS.has(kind))
+            throw new BadRequestError(`Unknown kind: ${kind}`);
+    }
+    return new Set(body.kinds);
+}
+function applyBody(body) {
+    if (!isRecord(body) || !isString(body.previewId) || typeof body.install !== 'boolean')
+        throw invalidBody(APPLY_SHAPE);
+    return { previewId: body.previewId, install: body.install };
+}
+function fileIndex(segment) {
+    const value = Number(segment);
+    if (segment.trim() === '' || !Number.isInteger(value) || value < 0)
+        throw new BadRequestError('Invalid index: expected an integer >= 0');
+    return value;
+}
+function onlyMethod(request, method) {
+    if (request.method !== method)
+        throw new MethodNotAllowedError();
+}
+class MethodNotAllowedError extends Error {
+}
+function unknownRoot(rootId) {
+    return failure(404, `Unknown root ${rootId}`);
+}
+async function handleChangesRoute(context, request, rootId, rest) {
+    const { actions } = context;
+    if (rest.length === 1) {
+        if (request.method === 'GET')
+            return reply(200, await actions.changes(rootId));
+        if (request.method === 'POST')
+            return reply(201, await actions.addChange(rootId, addChangeBody(request.body)));
+        onlyMethod(request, 'DELETE');
+        actions.clearChanges(rootId);
+        return reply(204, null);
+    }
+    if (rest.length === 2 && rest[1] === 'recommended') {
+        onlyMethod(request, 'POST');
+        return reply(202, { jobId: actions.startCollect(rootId, kindsBody(request.body)).id });
+    }
+    if (rest.length === 2 && rest[1] === 'restore-cleared') {
+        onlyMethod(request, 'POST');
+        return reply(200, actions.restoreCleared(rootId));
+    }
+    if (rest.length === 2) {
+        if (request.method === 'PUT')
+            return reply(200, await actions.replaceChange(rootId, rest[1], addChangeBody(request.body)));
+        onlyMethod(request, 'DELETE');
+        actions.removeChange(rootId, rest[1]);
+        return reply(204, null);
+    }
+    return failure(404, 'Not found');
+}
+async function handleActionRoute(context, request, rootId, rest) {
+    const { actions } = context;
+    const [resource] = rest;
+    if (resource === 'changes')
+        return handleChangesRoute(context, request, rootId, rest);
+    if (resource === 'preview' && rest.length === 1) {
+        onlyMethod(request, 'POST');
+        return reply(202, { jobId: actions.startPreview(rootId).id });
+    }
+    if (resource === 'preview' && rest.length === 4 && rest[1] === 'files' && rest[3] === 'diff') {
+        onlyMethod(request, 'GET');
+        return reply(200, actions.previewFileDiff(rootId, fileIndex(rest[2])));
+    }
+    if (resource === 'apply' && rest.length === 1) {
+        onlyMethod(request, 'POST');
+        const { previewId, install } = applyBody(request.body);
+        return reply(202, { jobId: (await actions.startApply(rootId, previewId, install)).id });
+    }
+    if (resource === 'revert' && rest.length === 1) {
+        onlyMethod(request, 'POST');
+        return reply(202, { jobId: (await actions.startRevert(rootId)).id });
+    }
+    return undefined;
+}
+function handleJobRoute(context, request, rest) {
+    const { actions } = context;
+    if (rest.length === 1) {
+        onlyMethod(request, 'GET');
+        return reply(200, actions.job(rest[0], integerParam(request.searchParams, 'since', 0, 0)));
+    }
+    if (rest.length === 2 && rest[1] === 'cancel') {
+        onlyMethod(request, 'POST');
+        actions.cancelJob(rest[0]);
+        return reply(202, { accepted: true });
+    }
+    return failure(404, 'Not found');
+}
+const ACTION_RESOURCES = new Set(['changes', 'preview', 'apply', 'revert']);
+function handleRootRoute(context, request, rootId, rest, logError) {
+    const { session, actions } = context;
+    const root = session.root(rootId);
+    if (rest.length === 1 && rest[0] === 'importers') {
+        if (request.method !== 'GET')
+            return failure(405, 'Method not allowed');
+        if (!root)
+            return failure(404, `Unknown root ${rootId}`);
+        return reply(200, importerSummaries(root));
+    }
+    if (rest.length === 1 && rest[0] === 'resolve') {
+        if (request.method !== 'POST')
+            return failure(405, 'Method not allowed');
+        if (!root)
+            return failure(404, `Unknown root ${rootId}`);
+        if (context.resolveUnavailable !== undefined)
+            return failure(409, context.resolveUnavailable);
+        if (actions.isBusy(rootId))
+            return failure(409, `A change job is running for ${rootId}`);
+        runDetached(session.resolve(rootId), logError, `resolve ${rootId}`);
+        return reply(202, { accepted: true });
+    }
+    if (rest.length === 1 && rest[0] === 'decorations')
+        return handleDecorations(context, request, rootId);
+    if (rest.length === 3 && rest[0] === 'nodes')
+        return handleNodeRoute(context, request, rootId, rest[1], rest[2]);
+    if (ACTION_RESOURCES.has(rest[0])) {
+        if (!root)
+            return unknownRoot(rootId);
+        return handleActionRoute(context, request, rootId, rest).then((response) => response ?? failure(404, 'Not found'));
+    }
+    return failure(404, 'Not found');
+}
+function handleIssues(context, request) {
+    if (request.method !== 'GET')
+        return failure(405, 'Method not allowed');
+    const params = request.searchParams;
+    const groupBy = groupByParam(params);
+    const kinds = kindsParam(params);
+    const rootId = params.get('root');
+    let roots;
+    if (rootId === null) {
+        roots = context.session.scan.roots.filter((root) => root.status === 'ready');
+    }
+    else {
+        const lookup = readyRoot(context.session, rootId);
+        if (lookup.failure)
+            return lookup.failure;
+        roots = [lookup.root];
+    }
+    const { enrichment } = context;
+    if (groupBy === 'direct') {
+        const body = { revision: enrichment.revision, groups: issuesByDirect(enrichment, roots, kinds) };
+        return reply(200, body);
+    }
+    const body = { revision: enrichment.revision, rows: issuesByPackage(enrichment, roots, kinds) };
+    return reply(200, body);
+}
+function handleEnrichmentRefresh(context, request) {
+    if (request.method !== 'POST')
+        return failure(405, 'Method not allowed');
+    const { session, enrichment } = context;
+    if (enrichment.status(anyRootScanning(session.scan.roots)).state === 'offline')
+        return failure(409, 'Package checks are disabled with --offline');
+    enrichment.refresh();
+    return reply(202, { accepted: true });
+}
+const SOURCE_RESOURCES = new Set(['scan', 'search', 'duplicates', 'issues', 'roots']);
+const SOURCES_SHAPE = '{ ref: string } or { mergeBase: { base: string, target: string } }';
+const BRANCHES_DISABLED = { available: false, reason: 'Branches are not enabled', quiet: true };
+const COMMIT_ACTIONS = disabledActions(COMMIT_ACTIONS_REASON);
+function sourcesBody(body) {
+    if (isRecord(body) && isString(body.ref))
+        return { ref: body.ref };
+    const mergeBase = isRecord(body) ? body.mergeBase : undefined;
+    if (isRecord(mergeBase) && isString(mergeBase.base) && isString(mergeBase.target)) {
+        return { mergeBase: { base: mergeBase.base, target: mergeBase.target } };
+    }
+    throw invalidBody(SOURCES_SHAPE);
+}
+function unknownSource(key) {
+    return failure(404, `Unknown source ${key}`);
+}
+async function handleGit(context, request) {
+    onlyMethod(request, 'GET');
+    return reply(200, context.branches ? await context.branches.info() : BRANCHES_DISABLED);
+}
+async function handleSources(context, request) {
+    onlyMethod(request, 'POST');
+    if (!context.branches)
+        return failure(409, BRANCHES_DISABLED.reason);
+    return reply(200, await context.branches.open(sourcesBody(request.body)));
+}
+function handleCommitRoute(context, request, rest, logError) {
+    const [commit, resource] = rest;
+    if (!SOURCE_RESOURCES.has(resource))
+        return failure(404, 'Not found');
+    const session = isObjectId(commit) ? context.branches?.sessionOf(commit) : undefined;
+    if (!session)
+        return unknownSource(commit);
+    return route({ session, enrichment: context.enrichment, actions: COMMIT_ACTIONS, resolveUnavailable: COMMIT_RESOLVE_REASON }, request, ['api', ...rest.slice(1)], logError);
+}
+function compareSideOf(session) {
+    const { roots, skippedSubmodules } = session.scan;
+    return skippedSubmodules === undefined ? { roots } : { roots, skippedSubmodules };
+}
+function handleCompare(context, request) {
+    onlyMethod(request, 'GET');
+    const base = request.searchParams.get('base');
+    const target = request.searchParams.get('target');
+    if (base === null || target === null)
+        throw new BadRequestError('Missing base or target');
+    const baseSession = context.branches?.sessionOf(base);
+    const targetSession = context.branches?.sessionOf(target);
+    if (!baseSession)
+        return unknownSource(base);
+    if (!targetSession)
+        return unknownSource(target);
+    return reply(200, compareSources(context.enrichment, compareSideOf(baseSession), compareSideOf(targetSession)));
+}
+function route(context, request, segments, logError) {
+    const { session } = context;
+    const [, resource, ...rest] = segments;
+    if (resource === 'scan' && rest.length === 0) {
+        return request.method === 'GET' ? reply(200, summarizeScan(context)) : failure(405, 'Method not allowed');
+    }
+    if (resource === 'rescan' && rest.length === 0) {
+        if (request.method !== 'POST')
+            return failure(405, 'Method not allowed');
+        if (context.actions.anyBusy())
+            return failure(409, 'A change job is running');
+        runDetached(session.rescan(), logError, 'rescan');
+        return reply(202, { accepted: true });
+    }
+    if (resource === 'search' && rest.length === 0) {
+        if (request.method !== 'GET')
+            return failure(405, 'Method not allowed');
+        return reply(200, search(session.index, request.searchParams.get('q') ?? ''));
+    }
+    if (resource === 'duplicates' && rest.length === 0) {
+        if (request.method !== 'GET')
+            return failure(405, 'Method not allowed');
+        return reply(200, duplicates(session.index, request.searchParams.get('root') ?? undefined));
+    }
+    if (resource === 'git' && rest.length === 0)
+        return handleGit(context, request);
+    if (resource === 'sources' && rest.length === 0)
+        return handleSources(context, request);
+    if (resource === 'commits' && rest.length >= 2)
+        return handleCommitRoute(context, request, rest, logError);
+    if (resource === 'compare' && rest.length === 0)
+        return handleCompare(context, request);
+    if (resource === 'issues' && rest.length === 0)
+        return handleIssues(context, request);
+    if (resource === 'enrichment' && rest.length === 1 && rest[0] === 'refresh')
+        return handleEnrichmentRefresh(context, request);
+    if (resource === 'jobs' && rest.length >= 1)
+        return handleJobRoute(context, request, rest);
+    if (resource === 'roots' && rest.length >= 1)
+        return handleRootRoute(context, request, rest[0], rest.slice(1), logError);
+    return failure(404, 'Not found');
+}
+export async function handleApi(context, request, logError) {
+    const segments = decodeSegments(request.pathname);
+    if (!segments)
+        return failure(400, 'Malformed path encoding');
+    try {
+        return await route(context, request, segments, logError);
+    }
+    catch (error) {
+        if (error instanceof BadRequestError)
+            return failure(400, error.message);
+        if (error instanceof BranchError)
+            return failure(error.status, error.message);
+        if (error instanceof MethodNotAllowedError)
+            return failure(405, 'Method not allowed');
+        if (error instanceof ActionError) {
+            return reply(error.status, { error: error.message, ...(error.conflictsWith === undefined ? {} : { conflictsWith: error.conflictsWith }) });
+        }
+        if (error instanceof UnknownNodeError)
+            return failure(404, error.message);
+        logError(`${request.method} ${request.pathname}`, error);
+        return failure(500, 'Internal error');
+    }
+}

package/dist/server/server.js

@@ -0,0 +1,166 @@
+import { createServer } from 'node:http';
+import { disabledActions } from "../actions/action-service.js";
+import { offlineEnrichment } from "../enrich/enrichment-service.js";
+import { generateToken, isAllowedHost, isAllowedOrigin, sessionCookie, tokensMatch, requestToken } from "./auth.js";
+import { createErrorLog } from "./error-log.js";
+import { handleApi } from "./router.js";
+import { serveStatic } from "./static.js";
+export const MAX_BODY_BYTES = 65_536;
+const LOOPBACK = '127.0.0.1';
+const JSON_MEDIA_TYPE = 'application/json';
+const SAFE_METHODS = new Set(['GET', 'HEAD']);
+class RequestRejection extends Error {
+    status;
+    constructor(status, message) {
+        super(message);
+        this.status = status;
+    }
+}
+function sendText(response, status, text) {
+    response.writeHead(status, { 'Content-Type': 'text/plain; charset=utf-8', 'X-Content-Type-Options': 'nosniff' });
+    response.end(text);
+}
+function sendJson(response, status, body) {
+    if (status === 204) {
+        response.writeHead(status, { 'Cache-Control': 'no-store' });
+        response.end();
+        return;
+    }
+    const text = JSON.stringify(body);
+    response.writeHead(status, {
+        'Content-Type': 'application/json; charset=utf-8',
+        'Cache-Control': 'no-store',
+        'X-Content-Type-Options': 'nosniff',
+    });
+    response.end(text);
+}
+function redirectWithSessionCookie(response, url, token, port) {
+    const target = new URL(url);
+    target.searchParams.delete('token');
+    response.writeHead(302, {
+        'Set-Cookie': sessionCookie(token, port),
+        Location: `${target.pathname}${target.search}`,
+        'Cache-Control': 'no-store',
+    });
+    response.end();
+}
+function isApiPath(pathname) {
+    return pathname === '/api' || pathname.startsWith('/api/');
+}
+function pathnameOf(request) {
+    return (request.url ?? '/').split('?')[0];
+}
+function hasBody(request) {
+    return Number(request.headers['content-length'] ?? 0) > 0 || request.headers['transfer-encoding'] !== undefined;
+}
+function mediaTypeOf(request) {
+    return (request.headers['content-type'] ?? '').split(';')[0].trim().toLowerCase();
+}
+function readBodyText(request) {
+    return new Promise((resolve, reject) => {
+        const chunks = [];
+        let received = 0;
+        let oversized = false;
+        request.on('data', (chunk) => {
+            received += chunk.length;
+            if (received > MAX_BODY_BYTES)
+                oversized = true;
+            if (!oversized)
+                chunks.push(chunk);
+        });
+        request.on('end', () => oversized ? reject(new RequestRejection(413, 'Request body is larger than 64 KB')) : resolve(Buffer.concat(chunks).toString('utf8')));
+        request.on('error', reject);
+    });
+}
+async function readJsonBody(request) {
+    if (!hasBody(request))
+        return undefined;
+    if (mediaTypeOf(request) !== JSON_MEDIA_TYPE)
+        throw new RequestRejection(415, 'Content-Type must be application/json');
+    if (Number(request.headers['content-length'] ?? 0) > MAX_BODY_BYTES)
+        throw new RequestRejection(413, 'Request body is larger than 64 KB');
+    const text = await readBodyText(request);
+    if (text === '')
+        return undefined;
+    try {
+        return JSON.parse(text);
+    }
+    catch {
+        throw new RequestRejection(400, 'Malformed JSON body');
+    }
+}
+export async function startServer(options) {
+    const { session, staticDir } = options;
+    const enrichment = options.enrichment ?? offlineEnrichment();
+    const actions = options.actions ?? disabledActions('Actions are not enabled');
+    const token = options.token ?? generateToken();
+    const logError = createErrorLog(options.errorStream ?? process.stderr);
+    let port = 0;
+    async function handle(request, response) {
+        response.setHeader('X-Frame-Options', 'DENY');
+        response.setHeader('Content-Security-Policy', "frame-ancestors 'none'");
+        const url = new URL(request.url ?? '/', `http://${LOOPBACK}:${port}`);
+        const reject = (status, message) => isApiPath(url.pathname) ? sendJson(response, status, { error: message }) : sendText(response, status, message);
+        if (!isAllowedHost(request.headers.host, port))
+            return reject(403, 'Forbidden');
+        const method = request.method ?? 'GET';
+        const urlToken = url.searchParams.get('token');
+        if (method === 'GET' && url.pathname === '/' && urlToken !== null) {
+            if (!tokensMatch(token, urlToken))
+                return reject(401, 'Unauthorized');
+            return redirectWithSessionCookie(response, url, token, port);
+        }
+        if (!tokensMatch(token, requestToken(request, port)))
+            return reject(401, 'Unauthorized');
+        const safeMethod = SAFE_METHODS.has(method);
+        if (!safeMethod && !isAllowedOrigin(request.headers.origin, port))
+            return reject(403, 'Forbidden origin');
+        if (isApiPath(url.pathname)) {
+            let body;
+            if (!safeMethod) {
+                try {
+                    body = await readJsonBody(request);
+                }
+                catch (failure) {
+                    if (!(failure instanceof RequestRejection))
+                        throw failure;
+                    request.resume();
+                    return reject(failure.status, failure.message);
+                }
+            }
+            const result = await handleApi({ session, enrichment, actions, branches: options.branches }, { method, pathname: url.pathname, searchParams: url.searchParams, body }, logError);
+            return sendJson(response, result.status, result.body);
+        }
+        if (!safeMethod)
+            return sendText(response, 405, 'Method not allowed');
+        const file = await serveStatic(staticDir, url.pathname);
+        response.writeHead(file.status, { 'Content-Type': file.contentType, 'X-Content-Type-Options': 'nosniff' });
+        response.end(method === 'HEAD' ? undefined : file.body);
+    }
+    const server = createServer((request, response) => {
+        handle(request, response).catch((failure) => {
+            logError(`${request.method ?? 'GET'} ${pathnameOf(request)}`, failure);
+            if (!response.headersSent)
+                sendText(response, 500, 'Internal error');
+            else
+                response.end();
+        });
+    });
+    await new Promise((resolve, reject) => {
+        server.once('error', reject);
+        server.listen(options.port ?? 0, LOOPBACK, () => {
+            server.off('error', reject);
+            resolve();
+        });
+    });
+    port = server.address().port;
+    return {
+        url: `http://${LOOPBACK}:${port}/?token=${token}`,
+        port,
+        token,
+        close: () => new Promise((resolve, reject) => {
+            server.close((error) => (error ? reject(error) : resolve()));
+            server.closeAllConnections();
+        }),
+    };
+}

package/dist/server/source-key.js

@@ -0,0 +1 @@
+export const WORKING_KEY = 'work';