@maudecode/talaria-web 0.0.0

package/dist/http/context.d.ts

@@ -0,0 +1,281 @@
+/**
+ * Per-request state and response helpers (the Python `Handler` attributes plus
+ * `api/helpers.j/t`). Every response goes through `send()`, which applies the
+ * security headers, CSP report-only policy, sliding-session renewal, queued
+ * cookies, and the structured access log.
+ */
+import type { AsyncLocalStorage } from 'node:async_hooks';
+import type { DnsLookup, PinnedFetch } from './pinned.js';
+import type { IncomingMessage, ServerResponse } from 'node:http';
+import type { ServerConfig } from '../config.js';
+import type { AuthStore, SessionInfo } from '../auth/store.js';
+import type { SettingsStore } from '../settings.js';
+import type { AssetCache, SpaShell } from '../spa.js';
+import type { StartupGate } from '../startup.js';
+import type { SessionService } from '../sessions/service.js';
+import type { SessionStore } from '../sessions/store.js';
+import type { SessionEventBus } from '../sessions/events.js';
+import type { ProjectStore } from '../projects.js';
+import type { WorkspaceRegistry } from '../workspace/workspaces.js';
+import type { GitRunner } from '../workspace/git.js';
+import type { RollbackStore } from '../workspace/rollback.js';
+import type { UploadInbox } from '../workspace/upload.js';
+import type { MediaPolicyDeps } from '../workspace/media.js';
+import type { WorktreeLocks } from '../workspace/worktrees.js';
+import type { Session } from '../sessions/session.js';
+import type { SidecarLike } from '../sidecar/client.js';
+import type { TurnRunner } from '../sessions/turn.js';
+import type { SessionChannels, StreamRegistry } from '../sessions/streams.js';
+import type { PendingPrompts } from '../sessions/pending.js';
+import type { RunJournal } from '../sessions/journal.js';
+import type { BackgroundTasks } from '../api/chat-router.js';
+import type { StreamSlots } from '../api/sse-routes.js';
+import type { BootstrapFeatures, ReleaseInfo } from '@maudecode/talaria-web-contracts';
+import { type CspExtras } from './csp.js';
+import type { CsrfFailure } from './origin.js';
+import type { AgentConfig } from '../config/agent-config.js';
+import type { ProviderCatalog } from '../providers/catalog.js';
+import type { ProfileService } from '../profiles/profiles.js';
+import type { Onboarding } from '../onboarding.js';
+import type { SkillsService } from '../tools/skills.js';
+import type { McpService } from '../tools/mcp.js';
+import type { WindowLimiter } from '../api/tools-router.js';
+import type { CronService } from '../tools/crons.js';
+import type { KanbanService } from '../tools/kanban.js';
+import type { ExtensionService } from '../tools/extensions.js';
+import type { TerminalRegistry } from '../tools/terminal.js';
+import type { OidcService } from '../auth/oidc.js';
+import type { RelayService } from '../sessions/relay.js';
+import type { CliSessionSource } from '../sessions/cli-sessions.js';
+import type { CompletionDrain } from '../sessions/completions.js';
+import type { HygieneTicker } from '../tools/hygiene.js';
+import type { McpHealthProber } from '../tools/mcp-health.js';
+import type { GatewayWatcherRegistry } from '../sessions/gateway-watcher.js';
+import type { PasskeyStore } from '../auth/passkeys.js';
+import type { UpdateService } from '../tools/updates.js';
+export interface AppDeps {
+    config: ServerConfig;
+    settings: SettingsStore;
+    auth: AuthStore;
+    startup: StartupGate;
+    spa: SpaShell;
+    /** Files under `static/` outside `dist/` (brand icons, extension SDK). */
+    staticFiles: AssetCache;
+    release: ReleaseInfo;
+    version: string;
+    /** Seconds since the epoch when the server started. */
+    startedAt: number;
+    log: (line: string) => void;
+    /** Accept-loop counters for `/health`. */
+    stats: {
+        requestsTotal: number;
+        lastRequestAt: number;
+    };
+    /** Later checkpoints replace these seams with the real domains. */
+    features: () => BootstrapFeatures;
+    /** The request's profile when called inside `requestScope.run`, else the process default. */
+    activeProfile: () => string;
+    /** Binds `activeProfile()` to the request context for the whole handler (cookie, bound session, and later retags). */
+    requestScope: AsyncLocalStorage<{
+        requestProfile: string | null;
+    }>;
+    isRootProfile: (name: string) => boolean;
+    onboardingCompleted: () => boolean;
+    /** Counts for `/health`: sessions and live runs (checkpoints 5/6). */
+    health: () => {
+        sessions: number;
+        activeStreams: number;
+        activeRuns: number;
+        runs: Record<string, unknown>[];
+        lastRunFinishedAt: number | null;
+    };
+    sessions: SessionService;
+    sessionStore: SessionStore;
+    events: SessionEventBus;
+    projects: ProjectStore;
+    workspaces: WorkspaceRegistry;
+    /** Python `_is_isolated_profile_mode` / `_profiles_match` (profile domain, checkpoint 7). */
+    isolatedProfileMode: () => boolean;
+    profilesMatch: (row: string | null | undefined, active: string | null | undefined) => boolean;
+    /** Agent config `worktree:` default for a profile. */
+    worktreeDefault: (profile: string | null) => boolean;
+    /** Worktree creation goes through the Agent (sidecar method, checkpoint 5b). */
+    worktrees: {
+        create: (workspace: string) => Promise<{
+            path: string;
+            branch: string;
+            repo_root: string;
+            created_at: number;
+        }>;
+    };
+    /** `vscode:` block from config.yaml: command lookup and Docker path translation. */
+    vscode: () => VsCodeConfig;
+    git: GitRunner;
+    rollback: RollbackStore;
+    uploads: UploadInbox;
+    mediaPolicy: MediaPolicyDeps;
+    /** The active workspace for `/api/media` allow-listing when local IO is supported, else null. */
+    mediaActiveWorkspace: () => string | null;
+    worktreeLocks: WorktreeLocks;
+    /** Commit-message generation (sidecar `aux.complete`); rejects with `GitWorkspaceError` when no model is available. */
+    commitMessage: (session: Session, systemPrompt: string, userPrompt: string) => Promise<string>;
+    sidecar: () => SidecarLike | null;
+    turns: TurnRunner;
+    registry: StreamRegistry;
+    channels: SessionChannels;
+    pending: PendingPrompts;
+    journal: RunJournal;
+    background: BackgroundTasks;
+    streamSlots: StreamSlots;
+    /** Home directory for a logical profile name (root aliases and invalid names clamp to the base home). */
+    profileHome: (name: string) => string;
+    agentConfig: AgentConfig;
+    catalog: ProviderCatalog;
+    profiles: ProfileService;
+    onboarding: Onboarding;
+    /** Running Agent version from the sidecar handshake, else the pinned version. */
+    agentVersion: () => string;
+    /** Passkey credentials are dropped when password auth is cleared. */
+    clearPasskeys: () => void;
+    skills: SkillsService;
+    mcp: McpService;
+    nowSeconds: () => number;
+    /** `/api/system/health` `webui_runtime` block (process counters). */
+    runtimeDiagnostics: () => Record<string, unknown>;
+    /** `/api/shutdown`: SIGINT the process shortly after the response is flushed. */
+    requestShutdown: () => void;
+    /** Self-update: exit with the supervisor's restart code once active chat work drains (ticket §13). */
+    requestRestart: () => void;
+    updates: UpdateService;
+    cspLimiter: WindowLimiter;
+    clientEventLimiter: WindowLimiter;
+    ttsLimiter: WindowLimiter;
+    fetch: typeof fetch;
+    /** Vetted outbound (`http/pinned.ts`): DNS answers are checked and the connection is pinned to them. */
+    dnsLookup: DnsLookup;
+    pinnedFetch: PinnedFetch;
+    completions: CompletionDrain;
+    hygiene: HygieneTicker;
+    mcpHealth: McpHealthProber;
+    cliSessions: CliSessionSource;
+    gatewayWatchers: GatewayWatcherRegistry;
+    relay: RelayService;
+    oidc: OidcService;
+    passkeys: PasskeyStore;
+    /** Python `_native_oidc_start_rate_limited`: 10 starts per client IP per 60 s. */
+    nativeOidcLimiter: WindowLimiter;
+    crons: CronService;
+    kanban: KanbanService;
+    extensions: ExtensionService;
+    terminals: TerminalRegistry;
+}
+export interface VsCodeConfig {
+    configuredCommand: string;
+    command: () => string | null;
+    translate: (path: string) => string;
+}
+export declare const PROFILE_ID_RE: RegExp;
+export declare function validProfileName(name: string): boolean;
+export type HeaderMap = Record<string, string | string[]>;
+export interface SendOptions {
+    status?: number;
+    headers?: HeaderMap;
+    body?: Buffer | string;
+    /** Emit the security-header set (Python `_security_headers`). */
+    security?: boolean;
+    /** Gzip bodies over 1 KiB when the client accepts it. */
+    gzip?: boolean;
+}
+/** WHATWG-resolved pathname (dot segments collapsed) without a trailing slash; `/` stays `/`. */
+export declare function normalizeRequestPath(raw: string): string;
+export declare class RequestContext {
+    readonly req: IncomingMessage;
+    readonly res: ServerResponse;
+    readonly deps: AppDeps;
+    readonly method: string;
+    /** Raw request path, not normalised (Python `urlparse` semantics, so `/assets/../x` stays a traversal probe). */
+    readonly path: string;
+    readonly search: string;
+    private queryParams;
+    readonly startedAtMs: number;
+    readonly peer: string;
+    pendingCookies: string[];
+    authRefreshCookie: string | null;
+    requestProfile: string | null;
+    csrfFailure: CsrfFailure;
+    /** Headers a `RawResponse` asks the oRPC layer to add. */
+    extraResponseHeaders: Record<string, string>;
+    /** Set by a procedure whose ETag matched `If-None-Match`; the root interceptor turns the response into a bodiless 304. */
+    notModified: boolean;
+    trusted: {
+        reconciled?: SessionInfo | null;
+        info?: SessionInfo | null;
+        cookieValue?: string | null;
+        rejected?: boolean;
+    };
+    readonly cspExtras: CspExtras;
+    private cookieMap;
+    private finished;
+    constructor(req: IncomingMessage, res: ServerResponse, deps: AppDeps);
+    get query(): URLSearchParams;
+    header(name: string): string | undefined;
+    headerAll(name: string): string[];
+    get cookies(): Map<string, string>;
+    /** The raw auth cookie value, if present. */
+    authCookie(): string | null;
+    acceptsGzip(): boolean;
+    /** Python `_is_secure_context`: env override, direct TLS, opt-in forwarded proto. */
+    isSecureContext(): boolean;
+    queueCookie(header: string): void;
+    /** Sliding renewal on a successful response (Python `refresh_session_for_response`). */
+    private refreshSessionForResponse;
+    authCookieHeader(cookieValue: string, ttl?: number): string;
+    securityHeaders(): HeaderMap;
+    send(opts: SendOptions): void;
+    /** Stream a body with backpressure (large file spans); headers and cookies are applied like `send`, the stream owns its source. */
+    sendStream(opts: {
+        status?: number;
+        headers?: HeaderMap;
+        security?: boolean;
+    }, body: NodeJS.ReadableStream & {
+        destroy?: (error?: Error) => void;
+    }): void;
+    logRequest(status: number): void;
+    /** Sliding renewal and queued-cookie flush for a response the oRPC adapter writes. */
+    beforeOrpcResponse(status: number): void;
+    /** Called by the pipeline for responses written outside `send()` (oRPC). */
+    markFinished(status: number): void;
+    get isFinished(): boolean;
+    json(payload: unknown, opts?: {
+        status?: number;
+        headers?: HeaderMap;
+        security?: boolean;
+        etag?: string;
+        pretty?: boolean;
+    }): void;
+    /** Bare `{"error":...}` responses the Python auth gate wrote without the security-header set. */
+    rawJson(status: number, payload: unknown, headers?: HeaderMap): void;
+    text(body: string | Buffer, opts?: {
+        status?: number;
+        contentType?: string;
+        headers?: HeaderMap;
+    }): void;
+    redirect(location: string, opts?: {
+        status?: number;
+        headers?: HeaderMap;
+        security?: boolean;
+    }): void;
+    /** Read and JSON-parse the request body as an object (Python `read_body`, 20 MiB cap). */
+    /** The request body as bytes, bounded by `maxBytes`. */
+    readRawBody(maxBytes: number): Promise<Buffer>;
+    readJsonBody(maxBytes?: number): Promise<Record<string, unknown>>;
+}
+export declare class BodyError extends Error {
+}
+/** RFC 7232 3.2 weak comparison; `W/` prefixes are ignored on both sides. */
+export declare function ifNoneMatchMatches(headerValue: string, etag: string): boolean;
+/**
+ * RFC 9110 `Accept-Encoding` negotiation for one coding: a listed coding with `q=0` (or `*;q=0` with the coding
+ * unlisted) is unacceptable; a plain listing or a positive quality accepts it.
+ */
+export declare function acceptsEncoding(header: string | undefined, coding: string): boolean;

package/dist/http/context.js

@@ -0,0 +1,327 @@
+import { gzipSync } from 'node:zlib';
+import { truthy } from '../config.js';
+import { parseCookieHeader } from '../auth/cookies.js';
+import { buildCspEnforcedPolicy, buildCspReportOnlyPolicy, cspExtras, CSP_REPORT_TO } from './csp.js';
+export const PROFILE_ID_RE = /^[a-z0-9][a-z0-9_-]{0,63}$/;
+export function validProfileName(name) {
+    return name === 'default' || PROFILE_ID_RE.test(name);
+}
+/** WHATWG-resolved pathname (dot segments collapsed) without a trailing slash; `/` stays `/`. */
+export function normalizeRequestPath(raw) {
+    let path;
+    try {
+        path = new URL(raw.startsWith('/') ? raw : `/${raw}`, 'http://placeholder').pathname;
+    }
+    catch {
+        path = '/';
+    }
+    path = path.replace(/\/{2,}/g, '/');
+    return path.length > 1 ? path.replace(/\/+$/, '') : path;
+}
+export class RequestContext {
+    req;
+    res;
+    deps;
+    method;
+    /** Raw request path, not normalised (Python `urlparse` semantics, so `/assets/../x` stays a traversal probe). */
+    path;
+    search;
+    queryParams = null;
+    startedAtMs = Date.now();
+    peer;
+    pendingCookies = [];
+    authRefreshCookie = null;
+    requestProfile = null;
+    csrfFailure = null;
+    /** Headers a `RawResponse` asks the oRPC layer to add. */
+    extraResponseHeaders = {};
+    /** Set by a procedure whose ETag matched `If-None-Match`; the root interceptor turns the response into a bodiless 304. */
+    notModified = false;
+    trusted = {};
+    cspExtras;
+    cookieMap = null;
+    finished = false;
+    constructor(req, res, deps) {
+        this.req = req;
+        this.res = res;
+        this.deps = deps;
+        this.method = (req.method ?? 'GET').toUpperCase();
+        const raw = req.url ?? '/';
+        const hash = raw.indexOf('#');
+        const target = hash >= 0 ? raw.slice(0, hash) : raw;
+        const q = target.indexOf('?');
+        // One canonical path for the auth gate, CSRF, and routing: dot segments resolved and the trailing slash dropped, so
+        // `/api/share/create/` can never reach a handler under a different gate decision than `/api/share/create`.
+        this.path = normalizeRequestPath(q >= 0 ? target.slice(0, q) : target);
+        this.search = q >= 0 ? target.slice(q) : '';
+        this.peer = req.socket.remoteAddress ?? '';
+        this.cspExtras = cspExtras(deps.config.env, (line) => { deps.log(`[webui] WARNING: ${line}`); });
+    }
+    get query() {
+        this.queryParams ??= new URLSearchParams(this.search);
+        return this.queryParams;
+    }
+    header(name) {
+        const value = this.req.headers[name.toLowerCase()];
+        return Array.isArray(value) ? value[0] : value;
+    }
+    headerAll(name) {
+        const value = this.req.headers[name.toLowerCase()];
+        if (value === undefined)
+            return [];
+        return Array.isArray(value) ? value : [value];
+    }
+    get cookies() {
+        this.cookieMap ??= parseCookieHeader(this.header('cookie'));
+        return this.cookieMap;
+    }
+    /** The raw auth cookie value, if present. */
+    authCookie() {
+        return this.cookies.get(this.deps.auth.cookieName()) ?? null;
+    }
+    acceptsGzip() {
+        return acceptsEncoding(this.header('accept-encoding'), 'gzip');
+    }
+    /** Python `_is_secure_context`: env override, direct TLS, opt-in forwarded proto. */
+    isSecureContext() {
+        const env = (this.deps.config.env.HERMES_WEBUI_SECURE ?? '').trim().toLowerCase();
+        if (['1', 'true', 'yes'].includes(env))
+            return true;
+        if (['0', 'false', 'no'].includes(env))
+            return false;
+        if (this.req.socket.encrypted)
+            return true;
+        if (truthy(this.deps.config.env.HERMES_WEBUI_TRUST_FORWARDED_PROTO) && this.header('x-forwarded-proto') === 'https')
+            return true;
+        return false;
+    }
+    queueCookie(header) {
+        if (header)
+            this.pendingCookies.push(header);
+    }
+    /** Sliding renewal on a successful response (Python `refresh_session_for_response`). */
+    refreshSessionForResponse(status) {
+        const cookieValue = this.authRefreshCookie;
+        this.authRefreshCookie = null;
+        if (!cookieValue || status < 200 || status >= 400)
+            return;
+        const auth = this.deps.auth;
+        if (!auth.resolveSessionSliding())
+            return;
+        const ttl = auth.resolveSessionTtl();
+        if (auth.extendSession(cookieValue, ttl))
+            this.queueCookie(this.authCookieHeader(cookieValue, ttl));
+    }
+    authCookieHeader(cookieValue, ttl) {
+        const auth = this.deps.auth;
+        const parts = [`${auth.cookieName()}=${cookieValue}`, 'HttpOnly', `Max-Age=${ttl ?? auth.resolveSessionTtl()}`, 'Path=/', 'SameSite=Lax'];
+        if (this.isSecureContext())
+            parts.push('Secure');
+        return parts.join('; ');
+    }
+    securityHeaders() {
+        return {
+            'X-Content-Type-Options': 'nosniff',
+            'X-Frame-Options': 'DENY',
+            'Referrer-Policy': 'same-origin',
+            'Content-Security-Policy': buildCspEnforcedPolicy(this.cspExtras),
+            'Permissions-Policy': 'camera=(), microphone=(self), geolocation=(), clipboard-write=(self)',
+        };
+    }
+    send(opts) {
+        if (this.finished)
+            return;
+        this.finished = true;
+        const status = opts.status ?? 200;
+        this.refreshSessionForResponse(status);
+        const headers = {};
+        if (opts.security ?? true)
+            Object.assign(headers, this.securityHeaders());
+        Object.assign(headers, opts.headers ?? {});
+        let body = opts.body === undefined ? Buffer.alloc(0) : Buffer.isBuffer(opts.body) ? opts.body : Buffer.from(opts.body, 'utf8');
+        if (opts.gzip && body.length > 1024 && this.acceptsGzip()) {
+            body = gzipSync(body, { level: 4 });
+            headers['Content-Encoding'] = 'gzip';
+        }
+        headers['Content-Length'] = String(body.length);
+        headers['Content-Security-Policy-Report-Only'] = buildCspReportOnlyPolicy(this.cspExtras);
+        headers['Report-To'] = CSP_REPORT_TO;
+        const cookies = [...(Array.isArray(headers['Set-Cookie']) ? headers['Set-Cookie'] : headers['Set-Cookie'] ? [headers['Set-Cookie']] : []), ...this.pendingCookies];
+        this.pendingCookies = [];
+        if (cookies.length)
+            headers['Set-Cookie'] = cookies;
+        this.res.writeHead(status, headers);
+        this.res.end(this.method === 'HEAD' ? undefined : body);
+        this.logRequest(status);
+    }
+    /** Stream a body with backpressure (large file spans); headers and cookies are applied like `send`, the stream owns its source. */
+    sendStream(opts, body) {
+        if (this.finished)
+            return;
+        this.finished = true;
+        const status = opts.status ?? 200;
+        this.refreshSessionForResponse(status);
+        const headers = {};
+        if (opts.security ?? true)
+            Object.assign(headers, this.securityHeaders());
+        Object.assign(headers, opts.headers ?? {});
+        headers['Content-Security-Policy-Report-Only'] = buildCspReportOnlyPolicy(this.cspExtras);
+        headers['Report-To'] = CSP_REPORT_TO;
+        const cookies = [...(Array.isArray(headers['Set-Cookie']) ? headers['Set-Cookie'] : headers['Set-Cookie'] ? [headers['Set-Cookie']] : []), ...this.pendingCookies];
+        this.pendingCookies = [];
+        if (cookies.length)
+            headers['Set-Cookie'] = cookies;
+        this.res.writeHead(status, headers);
+        if (this.method === 'HEAD') {
+            body.destroy?.();
+            this.res.end();
+            this.logRequest(status);
+            return;
+        }
+        this.res.on('close', () => { body.destroy?.(); });
+        body.on('error', () => { this.res.destroy(); });
+        body.pipe(this.res);
+        this.logRequest(status);
+    }
+    logRequest(status) {
+        const record = {
+            ts: new Date().toISOString().replace(/\.\d{3}Z$/, 'Z'),
+            remote: this.peer || '-',
+            method: this.method,
+            path: this.req.url ?? '-',
+            status,
+            ms: Math.round((Date.now() - this.startedAtMs) * 10) / 10,
+        };
+        const forwardedFor = (this.header('x-forwarded-for') ?? '').split(',')[0]?.trim();
+        if (forwardedFor)
+            record.forwarded_for = forwardedFor;
+        this.deps.log(`[webui] ${JSON.stringify(record)}`);
+    }
+    /** Sliding renewal and queued-cookie flush for a response the oRPC adapter writes. */
+    beforeOrpcResponse(status) {
+        this.refreshSessionForResponse(status);
+    }
+    /** Called by the pipeline for responses written outside `send()` (oRPC). */
+    markFinished(status) {
+        if (this.finished)
+            return;
+        this.finished = true;
+        this.logRequest(status);
+    }
+    get isFinished() {
+        return this.finished;
+    }
+    json(payload, opts = {}) {
+        const status = opts.status ?? 200;
+        if (opts.etag && status === 200 && ifNoneMatchMatches(this.header('if-none-match') ?? '', opts.etag)) {
+            this.send({ status: 304, headers: { ETag: opts.etag, 'Cache-Control': 'no-store', ...opts.headers }, security: opts.security ?? true });
+            return;
+        }
+        const body = opts.pretty === false ? JSON.stringify(payload) : JSON.stringify(payload, null, 2);
+        const headers = { 'Content-Type': 'application/json; charset=utf-8', 'Cache-Control': 'no-store', ...opts.headers };
+        if (opts.etag)
+            headers.ETag = opts.etag;
+        this.send({ status, headers, body, gzip: true, security: opts.security ?? true });
+    }
+    /** Bare `{"error":...}` responses the Python auth gate wrote without the security-header set. */
+    rawJson(status, payload, headers = {}) {
+        this.send({ status, headers: { 'Content-Type': 'application/json', ...headers }, body: JSON.stringify(payload), security: false });
+    }
+    text(body, opts = {}) {
+        this.send({ status: opts.status ?? 200, headers: { 'Content-Type': opts.contentType ?? 'text/plain; charset=utf-8', 'Cache-Control': 'no-store', ...opts.headers }, body });
+    }
+    redirect(location, opts = {}) {
+        this.send({ status: opts.status ?? 302, headers: { Location: location, ...opts.headers }, security: opts.security ?? true });
+    }
+    /** Read and JSON-parse the request body as an object (Python `read_body`, 20 MiB cap). */
+    /** The request body as bytes, bounded by `maxBytes`. */
+    async readRawBody(maxBytes) {
+        const rawLength = this.header('content-length');
+        const length = rawLength === undefined ? 0 : Number(rawLength);
+        if (!Number.isInteger(length) || length < 0)
+            throw new BodyError(`Invalid Content-Length: ${JSON.stringify(rawLength)}`);
+        if (length > maxBytes)
+            throw new BodyError(`Request body too large (${length} bytes, max ${maxBytes})`);
+        const chunks = [];
+        let total = 0;
+        for await (const chunk of this.req) {
+            const buf = chunk;
+            total += buf.length;
+            if (total > maxBytes)
+                throw new BodyError(`Request body too large (${total} bytes, max ${maxBytes})`);
+            chunks.push(buf);
+        }
+        return Buffer.concat(chunks);
+    }
+    async readJsonBody(maxBytes = 20 * 1024 * 1024) {
+        const rawLength = this.header('content-length');
+        const length = rawLength === undefined ? 0 : Number(rawLength);
+        if (!Number.isInteger(length) || length < 0)
+            throw new BodyError(`Invalid Content-Length: ${JSON.stringify(rawLength)}`);
+        if (length > maxBytes)
+            throw new BodyError(`Request body too large (${length} bytes, max ${maxBytes})`);
+        const chunks = [];
+        let total = 0;
+        for await (const chunk of this.req) {
+            const buf = chunk;
+            total += buf.length;
+            if (total > maxBytes)
+                throw new BodyError(`Request body too large (${total} bytes, max ${maxBytes})`);
+            chunks.push(buf);
+        }
+        const raw = Buffer.concat(chunks).toString('utf8');
+        if (!raw.trim())
+            return {};
+        let parsed;
+        try {
+            parsed = JSON.parse(raw);
+        }
+        catch {
+            throw new BodyError('Invalid JSON body');
+        }
+        if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed))
+            throw new BodyError('JSON body must be an object');
+        return parsed;
+    }
+}
+export class BodyError extends Error {
+}
+/** RFC 7232 3.2 weak comparison; `W/` prefixes are ignored on both sides. */
+export function ifNoneMatchMatches(headerValue, etag) {
+    if (!headerValue || !etag)
+        return false;
+    if (headerValue.trim() === '*')
+        return true;
+    const strip = (v) => (v.startsWith('W/') ? v.slice(2) : v);
+    const current = strip(etag);
+    return headerValue.split(',').map((c) => c.trim()).filter(Boolean).some((c) => strip(c) === current);
+}
+/**
+ * RFC 9110 `Accept-Encoding` negotiation for one coding: a listed coding with `q=0` (or `*;q=0` with the coding
+ * unlisted) is unacceptable; a plain listing or a positive quality accepts it.
+ */
+export function acceptsEncoding(header, coding) {
+    if (!header)
+        return false;
+    let wildcard = null;
+    for (const part of header.split(',')) {
+        const [rawName = '', ...params] = part.trim().split(';');
+        const name = rawName.trim().toLowerCase();
+        if (!name)
+            continue;
+        let q = 1;
+        for (const param of params) {
+            const [key = '', value = ''] = param.split('=');
+            if (key.trim().toLowerCase() === 'q') {
+                const parsed = Number.parseFloat(value.trim());
+                q = Number.isFinite(parsed) ? parsed : 0;
+            }
+        }
+        if (name === coding)
+            return q > 0;
+        if (name === '*')
+            wildcard = q;
+    }
+    return wildcard !== null && wildcard > 0;
+}
+//# sourceMappingURL=context.js.map

package/dist/http/context.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"context.js","sourceRoot":"","sources":["../../src/http/context.ts"],"names":[],"mappings":"AAUA,OAAO,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAA;AAEpC,OAAO,EAAE,MAAM,EAAE,MAAM,cAAc,CAAA;AACrC,OAAO,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAA;AAwBtD,OAAO,EAAE,sBAAsB,EAAE,wBAAwB,EAAE,SAAS,EAAE,aAAa,EAAkB,MAAM,UAAU,CAAA;AA0IrH,MAAM,CAAC,MAAM,aAAa,GAAG,4BAA4B,CAAA;AACzD,MAAM,UAAU,gBAAgB,CAAC,IAAY;IAC3C,OAAO,IAAI,KAAK,SAAS,IAAI,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;AACvD,CAAC;AAcD,iGAAiG;AACjG,MAAM,UAAU,oBAAoB,CAAC,GAAW;IAC9C,IAAI,IAAY,CAAA;IAChB,IAAI,CAAC;QAAC,IAAI,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,GAAG,EAAE,EAAE,oBAAoB,CAAC,CAAC,QAAQ,CAAA;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,IAAI,GAAG,GAAG,CAAA;IAAC,CAAC;IACjH,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,GAAG,CAAC,CAAA;IACnC,OAAO,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;AAC1D,CAAC;AAED,MAAM,OAAO,cAAc;IAChB,GAAG,CAAiB;IACpB,GAAG,CAAgB;IACnB,IAAI,CAAS;IACb,MAAM,CAAQ;IACvB,iHAAiH;IACxG,IAAI,CAAQ;IACZ,MAAM,CAAQ;IACf,WAAW,GAA2B,IAAI,CAAA;IACzC,WAAW,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA;IACxB,IAAI,CAAQ;IACrB,cAAc,GAAa,EAAE,CAAA;IAC7B,iBAAiB,GAAkB,IAAI,CAAA;IACvC,cAAc,GAAkB,IAAI,CAAA;IACpC,WAAW,GAAgB,IAAI,CAAA;IAC/B,0DAA0D;IAC1D,oBAAoB,GAA2B,EAAE,CAAA;IACjD,0HAA0H;IAC1H,WAAW,GAAG,KAAK,CAAA;IACnB,OAAO,GAAoH,EAAE,CAAA;IACpH,SAAS,CAAW;IACrB,SAAS,GAA+B,IAAI,CAAA;IAC5C,QAAQ,GAAG,KAAK,CAAA;IAExB,YAAY,GAAoB,EAAE,GAAmB,EAAE,IAAa;QAClE,IAAI,CAAC,GAAG,GAAG,GAAG,CAAA;QACd,IAAI,CAAC,GAAG,GAAG,GAAG,CAAA;QACd,IAAI,CAAC,IAAI,GAAG,IAAI,CAAA;QAChB,IAAI,CAAC,MAAM,GAAG,CAAC,GAAG,CAAC,MAAM,IAAI,KAAK,CAAC,CAAC,WAAW,EAAE,CAAA;QACjD,MAAM,GAAG,GAAG,GAAG,CAAC,GAAG,IAAI,GAAG,CAAA;QAC1B,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;QAC7B,MAAM,MAAM,GAAG,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAA;QACnD,MAAM,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;QAC7B,oHAAoH;QACpH,2GAA2G;QAC3G,IAAI,CAAC,IAAI,GAAG,oBAAoB,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAA;QACtE,IAAI,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;QAC3C,IAAI,CAAC,IAAI,GAAG,GAAG,CAAC,MAAM,CAAC,aAAa,IAAI,EAAE,CAAA;QAC1C,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,IAAI,EAAE,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,oBAAoB,IAAI,EAAE,CAAC,CAAA,CAAC,CAAC,CAAC,CAAA;IACjG,CAAC;IAED,IAAI,KAAK;QACP,IAAI,CAAC,WAAW,KAAK,IAAI,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;QACrD,OAAO,IAAI,CAAC,WAAW,CAAA;IACzB,CAAC;IAED,MAAM,CAAC,IAAY;QACjB,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAA;QAClD,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAA;IAChD,CAAC;IAED,SAAS,CAAC,IAAY;QACpB,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAA;QAClD,IAAI,KAAK,KAAK,SAAS;YAAE,OAAO,EAAE,CAAA;QAClC,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAA;IAC/C,CAAC;IAED,IAAI,OAAO;QACT,IAAI,CAAC,SAAS,KAAK,iBAAiB,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAA;QAC3D,OAAO,IAAI,CAAC,SAAS,CAAA;IACvB,CAAC;IAED,6CAA6C;IAC7C,UAAU;QACR,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC,IAAI,IAAI,CAAA;IAC9D,CAAC;IAED,WAAW;QACT,OAAO,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC,iBAAiB,CAAC,EAAE,MAAM,CAAC,CAAA;IAChE,CAAC;IAED,qFAAqF;IACrF,eAAe;QACb,MAAM,GAAG,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,mBAAmB,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAA;QACjF,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC;YAAE,OAAO,IAAI,CAAA;QACnD,IAAI,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC;YAAE,OAAO,KAAK,CAAA;QACpD,IAAK,IAAI,CAAC,GAAG,CAAC,MAAoB,CAAC,SAAS;YAAE,OAAO,IAAI,CAAA;QACzD,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,kCAAkC,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,mBAAmB,CAAC,KAAK,OAAO;YAAE,OAAO,IAAI,CAAA;QAChI,OAAO,KAAK,CAAA;IACd,CAAC;IAED,WAAW,CAAC,MAAc;QACxB,IAAI,MAAM;YAAE,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;IAC9C,CAAC;IAED,wFAAwF;IAChF,yBAAyB,CAAC,MAAc;QAC9C,MAAM,WAAW,GAAG,IAAI,CAAC,iBAAiB,CAAA;QAC1C,IAAI,CAAC,iBAAiB,GAAG,IAAI,CAAA;QAC7B,IAAI,CAAC,WAAW,IAAI,MAAM,GAAG,GAAG,IAAI,MAAM,IAAI,GAAG;YAAE,OAAM;QACzD,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAA;QAC3B,IAAI,CAAC,IAAI,CAAC,qBAAqB,EAAE;YAAE,OAAM;QACzC,MAAM,GAAG,GAAG,IAAI,CAAC,iBAAiB,EAAE,CAAA;QACpC,IAAI,IAAI,CAAC,aAAa,CAAC,WAAW,EAAE,GAAG,CAAC;YAAE,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,gBAAgB,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC,CAAA;IACrG,CAAC;IAED,gBAAgB,CAAC,WAAmB,EAAE,GAAY;QAChD,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAA;QAC3B,MAAM,KAAK,GAAG,CAAC,GAAG,IAAI,CAAC,UAAU,EAAE,IAAI,WAAW,EAAE,EAAE,UAAU,EAAE,WAAW,GAAG,IAAI,IAAI,CAAC,iBAAiB,EAAE,EAAE,EAAE,QAAQ,EAAE,cAAc,CAAC,CAAA;QACzI,IAAI,IAAI,CAAC,eAAe,EAAE;YAAE,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;QAChD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IACzB,CAAC;IAED,eAAe;QACb,OAAO;YACL,wBAAwB,EAAE,SAAS;YACnC,iBAAiB,EAAE,MAAM;YACzB,iBAAiB,EAAE,aAAa;YAChC,yBAAyB,EAAE,sBAAsB,CAAC,IAAI,CAAC,SAAS,CAAC;YACjE,oBAAoB,EAAE,sEAAsE;SAC7F,CAAA;IACH,CAAC;IAED,IAAI,CAAC,IAAiB;QACpB,IAAI,IAAI,CAAC,QAAQ;YAAE,OAAM;QACzB,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAA;QACpB,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,GAAG,CAAA;QACjC,IAAI,CAAC,yBAAyB,CAAC,MAAM,CAAC,CAAA;QACtC,MAAM,OAAO,GAAc,EAAE,CAAA;QAC7B,IAAI,IAAI,CAAC,QAAQ,IAAI,IAAI;YAAE,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,IAAI,CAAC,eAAe,EAAE,CAAC,CAAA;QACzE,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC,CAAA;QAC1C,IAAI,IAAI,GAAG,IAAI,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;QAC9H,IAAI,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,MAAM,GAAG,IAAI,IAAI,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC;YAC1D,IAAI,GAAG,QAAQ,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAA;YACnC,OAAO,CAAC,kBAAkB,CAAC,GAAG,MAAM,CAAA;QACtC,CAAC;QACD,OAAO,CAAC,gBAAgB,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;QAC/C,OAAO,CAAC,qCAAqC,CAAC,GAAG,wBAAwB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;QACzF,OAAO,CAAC,WAAW,CAAC,GAAG,aAAa,CAAA;QACpC,MAAM,OAAO,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,IAAI,CAAC,cAAc,CAAC,CAAA;QAClK,IAAI,CAAC,cAAc,GAAG,EAAE,CAAA;QACxB,IAAI,OAAO,CAAC,MAAM;YAAE,OAAO,CAAC,YAAY,CAAC,GAAG,OAAO,CAAA;QACnD,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;QACnC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAA;QACvD,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAA;IACzB,CAAC;IAED,mIAAmI;IACnI,UAAU,CAAC,IAAkE,EAAE,IAAmE;QAChJ,IAAI,IAAI,CAAC,QAAQ;YAAE,OAAM;QACzB,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAA;QACpB,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,GAAG,CAAA;QACjC,IAAI,CAAC,yBAAyB,CAAC,MAAM,CAAC,CAAA;QACtC,MAAM,OAAO,GAAc,EAAE,CAAA;QAC7B,IAAI,IAAI,CAAC,QAAQ,IAAI,IAAI;YAAE,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,IAAI,CAAC,eAAe,EAAE,CAAC,CAAA;QACzE,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC,CAAA;QAC1C,OAAO,CAAC,qCAAqC,CAAC,GAAG,wBAAwB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;QACzF,OAAO,CAAC,WAAW,CAAC,GAAG,aAAa,CAAA;QACpC,MAAM,OAAO,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,IAAI,CAAC,cAAc,CAAC,CAAA;QAClK,IAAI,CAAC,cAAc,GAAG,EAAE,CAAA;QACxB,IAAI,OAAO,CAAC,MAAM;YAAE,OAAO,CAAC,YAAY,CAAC,GAAG,OAAO,CAAA;QACnD,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;QACnC,IAAI,IAAI,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YAAC,IAAI,CAAC,OAAO,EAAE,EAAE,CAAC;YAAC,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC;YAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;YAAC,OAAM;QAAC,CAAC;QACjG,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,OAAO,EAAE,EAAE,CAAA,CAAC,CAAC,CAAC,CAAA;QAChD,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,CAAA,CAAC,CAAC,CAAC,CAAA;QAC9C,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QACnB,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAA;IACzB,CAAC;IAED,UAAU,CAAC,MAAc;QACvB,MAAM,MAAM,GAA4B;YACtC,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,WAAW,EAAE,GAAG,CAAC;YACtD,MAAM,EAAE,IAAI,CAAC,IAAI,IAAI,GAAG;YACxB,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG;YACzB,MAAM;YACN,EAAE,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,EAAE,CAAC,GAAG,EAAE;SAC1D,CAAA;QACD,MAAM,YAAY,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,iBAAiB,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAA;QACjF,IAAI,YAAY;YAAE,MAAM,CAAC,aAAa,GAAG,YAAY,CAAA;QACrD,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,WAAW,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC,CAAA;IACpD,CAAC;IAED,sFAAsF;IACtF,kBAAkB,CAAC,MAAc;QAC/B,IAAI,CAAC,yBAAyB,CAAC,MAAM,CAAC,CAAA;IACxC,CAAC;IAED,4EAA4E;IAC5E,YAAY,CAAC,MAAc;QACzB,IAAI,IAAI,CAAC,QAAQ;YAAE,OAAM;QACzB,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAA;QACpB,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAA;IACzB,CAAC;IAED,IAAI,UAAU;QACZ,OAAO,IAAI,CAAC,QAAQ,CAAA;IACtB,CAAC;IAED,IAAI,CAAC,OAAgB,EAAE,OAAsG,EAAE;QAC7H,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,GAAG,CAAA;QACjC,IAAI,IAAI,CAAC,IAAI,IAAI,MAAM,KAAK,GAAG,IAAI,kBAAkB,CAAC,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC,IAAI,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACrG,IAAI,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,eAAe,EAAE,UAAU,EAAE,GAAG,IAAI,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,IAAI,IAAI,EAAE,CAAC,CAAA;YACvI,OAAM;QACR,CAAC;QACD,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,KAAK,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAA;QAC/F,MAAM,OAAO,GAAc,EAAE,cAAc,EAAE,iCAAiC,EAAE,eAAe,EAAE,UAAU,EAAE,GAAG,IAAI,CAAC,OAAO,EAAE,CAAA;QAC9H,IAAI,IAAI,CAAC,IAAI;YAAE,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,CAAA;QACvC,IAAI,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,IAAI,IAAI,EAAE,CAAC,CAAA;IACnF,CAAC;IAED,iGAAiG;IACjG,OAAO,CAAC,MAAc,EAAE,OAAgB,EAAE,UAAqB,EAAE;QAC/D,IAAI,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,GAAG,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAA;IACpI,CAAC;IAED,IAAI,CAAC,IAAqB,EAAE,OAAuE,EAAE;QACnG,IAAI,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,GAAG,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,IAAI,CAAC,WAAW,IAAI,2BAA2B,EAAE,eAAe,EAAE,UAAU,EAAE,GAAG,IAAI,CAAC,OAAO,EAAE,EAAE,IAAI,EAAE,CAAC,CAAA;IAC7K,CAAC;IAED,QAAQ,CAAC,QAAgB,EAAE,OAAqE,EAAE;QAChG,IAAI,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,GAAG,EAAE,OAAO,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,GAAG,IAAI,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,IAAI,IAAI,EAAE,CAAC,CAAA;IAC9H,CAAC;IAED,0FAA0F;IAC1F,wDAAwD;IACxD,KAAK,CAAC,WAAW,CAAC,QAAgB;QAChC,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAA;QAC/C,MAAM,MAAM,GAAG,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAA;QAC9D,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,MAAM,GAAG,CAAC;YAAE,MAAM,IAAI,SAAS,CAAC,2BAA2B,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,EAAE,CAAC,CAAA;QACxH,IAAI,MAAM,GAAG,QAAQ;YAAE,MAAM,IAAI,SAAS,CAAC,2BAA2B,MAAM,eAAe,QAAQ,GAAG,CAAC,CAAA;QACvG,MAAM,MAAM,GAAa,EAAE,CAAA;QAC3B,IAAI,KAAK,GAAG,CAAC,CAAA;QACb,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;YACnC,MAAM,GAAG,GAAG,KAAe,CAAA;YAC3B,KAAK,IAAI,GAAG,CAAC,MAAM,CAAA;YACnB,IAAI,KAAK,GAAG,QAAQ;gBAAE,MAAM,IAAI,SAAS,CAAC,2BAA2B,KAAK,eAAe,QAAQ,GAAG,CAAC,CAAA;YACrG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QAClB,CAAC;QACD,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;IAC9B,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,QAAQ,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI;QAC5C,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAA;QAC/C,MAAM,MAAM,GAAG,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAA;QAC9D,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,MAAM,GAAG,CAAC;YAAE,MAAM,IAAI,SAAS,CAAC,2BAA2B,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,EAAE,CAAC,CAAA;QACxH,IAAI,MAAM,GAAG,QAAQ;YAAE,MAAM,IAAI,SAAS,CAAC,2BAA2B,MAAM,eAAe,QAAQ,GAAG,CAAC,CAAA;QACvG,MAAM,MAAM,GAAa,EAAE,CAAA;QAC3B,IAAI,KAAK,GAAG,CAAC,CAAA;QACb,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;YACnC,MAAM,GAAG,GAAG,KAAe,CAAA;YAC3B,KAAK,IAAI,GAAG,CAAC,MAAM,CAAA;YACnB,IAAI,KAAK,GAAG,QAAQ;gBAAE,MAAM,IAAI,SAAS,CAAC,2BAA2B,KAAK,eAAe,QAAQ,GAAG,CAAC,CAAA;YACrG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QAClB,CAAC;QACD,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAA;QAClD,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE;YAAE,OAAO,EAAE,CAAA;QAC1B,IAAI,MAAe,CAAA;QACnB,IAAI,CAAC;YACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;QAC1B,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,SAAS,CAAC,mBAAmB,CAAC,CAAA;QAC1C,CAAC;QACD,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;YAAE,MAAM,IAAI,SAAS,CAAC,6BAA6B,CAAC,CAAA;QACtH,OAAO,MAAiC,CAAA;IAC1C,CAAC;CACF;AAED,MAAM,OAAO,SAAU,SAAQ,KAAK;CAAG;AAEvC,6EAA6E;AAC7E,MAAM,UAAU,kBAAkB,CAAC,WAAmB,EAAE,IAAY;IAClE,IAAI,CAAC,WAAW,IAAI,CAAC,IAAI;QAAE,OAAO,KAAK,CAAA;IACvC,IAAI,WAAW,CAAC,IAAI,EAAE,KAAK,GAAG;QAAE,OAAO,IAAI,CAAA;IAC3C,MAAM,KAAK,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;IAClE,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,CAAA;IAC3B,OAAO,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,OAAO,CAAC,CAAA;AACtG,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,eAAe,CAAC,MAA0B,EAAE,MAAc;IACxE,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAA;IACzB,IAAI,QAAQ,GAAkB,IAAI,CAAA;IAClC,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QACrC,MAAM,CAAC,OAAO,GAAG,EAAE,EAAE,GAAG,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;QACxD,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAA;QACzC,IAAI,CAAC,IAAI;YAAE,SAAQ;QACnB,IAAI,CAAC,GAAG,CAAC,CAAA;QACT,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;YAC3B,MAAM,CAAC,GAAG,GAAG,EAAE,EAAE,KAAK,GAAG,EAAE,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;YAC/C,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,KAAK,GAAG,EAAE,CAAC;gBAAC,MAAM,MAAM,GAAG,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;gBAAC,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAA;YAAC,CAAC;QACpI,CAAC;QACD,IAAI,IAAI,KAAK,MAAM;YAAE,OAAO,CAAC,GAAG,CAAC,CAAA;QACjC,IAAI,IAAI,KAAK,GAAG;YAAE,QAAQ,GAAG,CAAC,CAAA;IAChC,CAAC;IACD,OAAO,QAAQ,KAAK,IAAI,IAAI,QAAQ,GAAG,CAAC,CAAA;AAC1C,CAAC"}

package/dist/http/csp.d.ts

@@ -0,0 +1,11 @@
+/** Content-Security-Policy builders (Python `api/helpers.py`). */
+import type { Env } from '../config.js';
+export declare const CSP_CONNECT_BASE = "'self' http://127.0.0.1:* http://localhost:* http://ipc.localhost https://127.0.0.1:* https://localhost:* ws://127.0.0.1:* ws://localhost:*";
+export declare const CSP_REPORT_TO = "{\"group\":\"csp-endpoint\",\"max_age\":10886400,\"endpoints\":[{\"url\":\"/api/csp-report\"}]}";
+export interface CspExtras {
+    connect: string;
+    frame: string;
+}
+export declare function cspExtras(env: Env, warn?: (line: string) => void): CspExtras;
+export declare function buildCspEnforcedPolicy(extras: CspExtras): string;
+export declare function buildCspReportOnlyPolicy(extras: CspExtras): string;