@microsoft/managed-apps-dev-gateway 0.3.1

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) Microsoft Corporation.
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED *AS IS*, WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,187 @@
+# @microsoft/managed-apps-dev-gateway
+
+Local development bootstrap resources for Microsoft Managed Apps.
+
+This package contains the local development _snapshot reader_:
+the filesystem and config layer that turns a project on disk into one coherent,
+immutable `DevelopmentSnapshot` from `@microsoft/managed-apps-common/gateway`.
+
+It also packages the shared gateway-client's compiled `loader.html` and
+`appScript.js` and static `localDevWorker.js` under `dist/resources/`, and exports a Vite-compatible Node/Connect
+resource adapter. No worker implementation is bundled.
+
+It is a Node library, not a server. It does not listen on a port, watch files,
+mount itself into Vite, or call a backend. Those are separate layers.
+
+The trusted player supplies the authenticated DevLaunch gateway origin on
+LoaderPort through `dev/configureWorker`. The loader registers the local static
+stub and waits for its exact activated controller before transferring worker ports.
+Vite mounting/watchers and player orchestration are later steps; no live deployment
+or browser-import acceptance is implied by this package.
+
+## Node/Connect adapter
+
+```ts
+import { createDevelopmentMiddlewareAsync } from '@microsoft/managed-apps-dev-gateway';
+
+const middleware = await createDevelopmentMiddlewareAsync({
+  projectRoot: '/path/to/app',
+  devOrigin: 'http://localhost:3000',
+  playerOrigin: 'https://play.local.managedapps.cloud.dev.microsoft',
+  onError: (error) => console.error(error),
+});
+// Step 7 mounts this opt-in handler before Vite's SPA fallback.
+```
+
+The factory returns `DevelopmentMiddleware`, an async `(request, response, next)`
+handler using Node HTTP types. `DevelopmentMiddlewareOptions` is exported too.
+It does not change existing `managedApps()` or legacy config serving.
+`playerOrigin` must be an allowlisted Microsoft Apps player origin. Loader requests
+must name that exact origin in `ms_embedderOrigin`; successful loader responses set
+`Content-Security-Policy: frame-ancestors <playerOrigin>`.
+
+| Exact path                    | GET response                                                      |
+| ----------------------------- | ----------------------------------------------------------------- |
+| `/_platform/app/loader`       | Packaged HTML; bootstrap query allowed                            |
+| `/_platform/app/appScript.js` | Packaged JavaScript                                               |
+| `/_platform/app/dev-snapshot` | Combined validated snapshot JSON                                  |
+| `/_platform/app/sw.js`        | Static importing JavaScript; requires `ms_gatewayOrigin` selector |
+
+Other paths call `next()`. Owned paths never fall through on failure. Only GET is
+supported (including no HEAD/OPTIONS shortcut); other methods return 405.
+Queries on snapshot/bridge resources return 400. The worker accepts exactly one
+`ms_gatewayOrigin` and no other query keys. Missing/invalid selector returns 400.
+Paths are matched literally without
+decoding/normalizing aliases. Responses have explicit MIME/length, `no-store`,
+`nosniff`, no redirect and no CORS grants.
+
+Every owned request requires exactly one Host header equal to `devOrigin`'s
+`URL.host`, **including port**. Forwarded headers do not establish trust. Snapshot
+requests additionally require `X-Managed-Apps-Dev-Snapshot: 1`; any explicit Origin
+must equal the configured origin, and `Sec-Fetch-Site: cross-site` is rejected.
+Missing Origin/Fetch Metadata is allowed for same-origin GET/client compatibility.
+Explicit `null` Origin is rejected. The header is a CSRF/exposure barrier, **not
+authentication** or proof of DevLaunch. There is no arbitrary file or script-path selector.
+
+The worker selector must be an HTTPS origin only, without userinfo, query, fragment
+or non-root path. The static stub parses its own registration URL, sets
+`globalThis.__MAAF_LOCAL_DEV_WORKER__ = true`, then imports only the selected
+origin's `/.ms/app/sw.js`. The response adds `Service-Worker-Allowed: /`. Its bytes do not
+vary with the selector; Node neither fetches the source nor independently proves
+RP provenance. This is the approved browser-owned trust boundary, not isolation
+from hostile same-origin code. No source allowlist/pinning or fallback worker exists.
+
+Each snapshot request serializes a refresh through `DevelopmentSnapshotSource`.
+It exposes only `snapshot`, never retained init bytes or filesystem diagnostics.
+Invalid refreshes return generic 500 JSON and report details locally through
+`onError` (console by default), never a stale/empty success.
+
+## What it does
+
+Given an explicit project root, the reader:
+
+1. Locates the base config by its well-known file name (`ms.config.json`, then
+   `ms.app.config.json`) — the caller never supplies a file path.
+2. Parses it with the shared `ConfigSchemaV0` validator.
+3. If the config declares `data.schemaPath` (or the legacy `db.schemaPath`),
+   reads that JSON schema and inlines it under `oob.body.app.manifest.data`.
+   Pack writes the schema as a _separate_ file referenced by `dataSchemaPath`;
+   the dev session init body needs it inline instead. File reads are bounded
+   before parsing: base configs are capped at 2 MiB and schemas at 1 MiB, with
+   the byte length checked again after the read.
+4. Copies an explicit `data.enabled` value, or the legacy `db.enabled` fallback,
+   to `oob.body.app.manifest.dataEnabled`. Both `true` and `false` are preserved;
+   the field is omitted only when neither alias sets it.
+5. Builds the OOB init body, serializes it with the shared
+   `serializeInitDevSessionBody` (which enforces the 1 MiB whole-body limit),
+   and computes the effective OOB revision.
+6. Validates the assembled snapshot with `DevelopmentSnapshotSchema` and returns
+   it frozen, alongside the exact bytes that would be sent to init.
+
+`manifest.json` is never required on disk, and no app build or pack is performed.
+
+## Revisions
+
+Two revisions travel in a snapshot and mean different things:
+
+| Field          | Meaning                                                                                                    |
+| -------------- | ---------------------------------------------------------------------------------------------------------- |
+| `revision`     | Overall snapshot ordering within one bootstrap lifetime. Supplied by the caller; a monotonic safe integer. |
+| `oob.revision` | Opaque digest of the _effective_ OOB inputs — environment identity plus the init body.                     |
+
+`oob.revision` changes if and only if the effective app identity, environment
+identity, or manifest changes. It is insensitive to JSON key order and to
+formatting, so re-saving a config or schema without semantic change does not
+churn it. Connector-only config edits (connection references, connections) and
+asset-only edits leave it untouched: those fields stay in `hostConfig` and are
+deliberately excluded from the OOB body. Changing only `dataEnabled` changes the
+OOB revision and is classified as an OOB update.
+
+## Path policy
+
+Both the base config and the referenced schema must resolve inside the project
+root. The root itself is canonicalized first, so selecting a root that is itself
+a symlink works consistently.
+
+- The schema path must be non-empty, relative, lexically contained, and a
+  regular file — the same rules the CLI's `pack` applies.
+- In addition, the _resolved real path_ of both the config and the schema must
+  stay under the canonical root. This is **stricter than pack**, which follows a
+  link that points outside the project.
+
+Path resolution and reading are separate syscalls, so this containment check
+narrows the exposed surface but does not make the reader immune to an adversary
+who can mutate the filesystem concurrently. It is a local development guard, not
+a sandbox.
+
+## Exposure boundary
+
+The snapshot carries the validated `ConfigSchemaV0` host config plus the inline
+data schema and declared data-API opt-in. Current MHRG rejects OOB requests with
+403 `ManagedAppDataNotEnabled` unless `manifest.dataEnabled` is `true`; the reader
+therefore mirrors `data.enabled` or legacy `db.enabled` without defaulting it.
+It reads no credentials, tokens, or forward-service secrets, and exposes no
+arbitrary-path read API or raw byte passthrough.
+
+It is not equivalent to the legacy config endpoint and should not be described
+that way: the inline schema is data that endpoint never carried, and a config
+may contain user-authored content. The snapshot is also **not** an authorization
+artifact — nothing about holding one grants access to anything.
+
+## Usage
+
+```ts
+import {
+  DevelopmentSnapshotSource,
+  readDevelopmentSnapshotAsync,
+} from '@microsoft/managed-apps-dev-gateway/snapshot';
+
+// One-shot read.
+const { snapshot, initBody } = await readDevelopmentSnapshotAsync({
+  projectRoot: '/path/to/app',
+  revision: 1,
+});
+
+// Or track successive reads, keeping the last valid snapshot on failure.
+const source = new DevelopmentSnapshotSource('/path/to/app');
+const { read, change } = await source.refreshAsync();
+// change: 'initial' | 'metadata' | 'oob' | 'identity'
+```
+
+A failed refresh throws a `SnapshotReadError` and leaves the previously valid
+snapshot installed. Invalid input never degrades into an empty manifest.
+
+## Scripts
+
+| Script        | Description                                               |
+| ------------- | --------------------------------------------------------- |
+| `build`       | Compile to `dist/` and copy prebuilt loader/bridge assets |
+| `check-types` | Type-check without emitting                               |
+| `lint`        | ESLint over `src/`                                        |
+| `test`        | Bun tests                                                 |
+| `clean`       | Remove build artifacts                                    |
+
+Build through `bunx turbo run build --filter=@microsoft/managed-apps-dev-gateway`
+so the build-only gateway-client dependency runs first. Published consumers need
+only the package outputs and runtime dependencies, never the private
+gateway-client package, repository source, esbuild or a TypeScript compiler.

package/dist/index.d.ts

@@ -0,0 +1,8 @@
+/*!
+ * Copyright (C) Microsoft Corporation. All rights reserved.
+ */
+export type { DevelopmentMiddleware, DevelopmentMiddlewareOptions, } from './resources/DevelopmentMiddleware.js';
+export { createDevelopmentMiddlewareAsync } from './resources/DevelopmentMiddleware.js';
+export type { DevelopmentSnapshotRead, ReadDevelopmentSnapshotOptions } from './snapshot/index.js';
+export { assertRealPathContainedAsync, canonicalizeRootAsync, canonicalJson, computeOobRevision, DevelopmentSnapshotSource, readDevelopmentSnapshotAsync, resolveSchemaPathAsync, SnapshotReadError, SnapshotReadErrorCode, } from './snapshot/index.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,YAAY,EACV,qBAAqB,EACrB,4BAA4B,GAC7B,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EAAE,gCAAgC,EAAE,MAAM,mCAAmC,CAAC;AACrF,YAAY,EAAE,uBAAuB,EAAE,8BAA8B,EAAE,MAAM,kBAAkB,CAAC;AAChG,OAAO,EACL,4BAA4B,EAC5B,qBAAqB,EACrB,aAAa,EACb,kBAAkB,EAClB,yBAAyB,EACzB,4BAA4B,EAC5B,sBAAsB,EACtB,iBAAiB,EACjB,qBAAqB,GACtB,MAAM,kBAAkB,CAAC"}

package/dist/index.js

@@ -0,0 +1,6 @@
+/*!
+ * Copyright (C) Microsoft Corporation. All rights reserved.
+ */
+export { createDevelopmentMiddlewareAsync } from './resources/DevelopmentMiddleware.js';
+export { assertRealPathContainedAsync, canonicalizeRootAsync, canonicalJson, computeOobRevision, DevelopmentSnapshotSource, readDevelopmentSnapshotAsync, resolveSchemaPathAsync, SnapshotReadError, SnapshotReadErrorCode, } from './snapshot/index.js';
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AAMH,OAAO,EAAE,gCAAgC,EAAE,MAAM,mCAAmC,CAAC;AAErF,OAAO,EACL,4BAA4B,EAC5B,qBAAqB,EACrB,aAAa,EACb,kBAAkB,EAClB,yBAAyB,EACzB,4BAA4B,EAC5B,sBAAsB,EACtB,iBAAiB,EACjB,qBAAqB,GACtB,MAAM,kBAAkB,CAAC"}

package/dist/resources/DevelopmentMiddleware.d.ts

@@ -0,0 +1,20 @@
+/*!
+ * Copyright (C) Microsoft Corporation. All rights reserved.
+ */
+import type { IncomingMessage, ServerResponse } from 'node:http';
+export interface DevelopmentMiddlewareOptions {
+    projectRoot: string;
+    /** Exact direct-local browser origin selected by the integrating Vite plugin. */
+    devOrigin: string;
+    /** Exact allowlisted player origin permitted to frame the privileged loader. */
+    playerOrigin: string;
+    /** Local diagnostics only; HTTP errors never expose filesystem/config details. */
+    onError?: (error: unknown) => void;
+}
+export type DevelopmentMiddleware = (request: IncomingMessage, response: ServerResponse, next: () => void) => Promise<void>;
+/**
+ * A Connect-compatible handler, not a listener. Mount only for explicit local-dev
+ * opt-in and before Vite's fallback. Does not modify legacy config serving.
+ */
+export declare function createDevelopmentMiddlewareAsync(options: DevelopmentMiddlewareOptions): Promise<DevelopmentMiddleware>;
+//# sourceMappingURL=DevelopmentMiddleware.d.ts.map

package/dist/resources/DevelopmentMiddleware.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"DevelopmentMiddleware.d.ts","sourceRoot":"","sources":["../../src/resources/DevelopmentMiddleware.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAajE,MAAM,WAAW,4BAA4B;IAC3C,WAAW,EAAE,MAAM,CAAC;IACpB,iFAAiF;IACjF,SAAS,EAAE,MAAM,CAAC;IAClB,gFAAgF;IAChF,YAAY,EAAE,MAAM,CAAC;IACrB,kFAAkF;IAClF,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,IAAI,CAAC;CACpC;AAED,MAAM,MAAM,qBAAqB,GAAG,CAClC,OAAO,EAAE,eAAe,EACxB,QAAQ,EAAE,cAAc,EACxB,IAAI,EAAE,MAAM,IAAI,KACb,OAAO,CAAC,IAAI,CAAC,CAAC;AAEnB;;;GAGG;AACH,wBAAsB,gCAAgC,CACpD,OAAO,EAAE,4BAA4B,GACpC,OAAO,CAAC,qBAAqB,CAAC,CA2GhC"}

package/dist/resources/DevelopmentMiddleware.js

@@ -0,0 +1,117 @@
+/*!
+ * Copyright (C) Microsoft Corporation. All rights reserved.
+ */
+import { DevelopmentResources, DevOriginSchema, parseDevelopmentWorkerSource, PlatformPaths, } from '@microsoft/managed-apps-common/gateway';
+import { maafAllowedEmbedderOrigins } from '@microsoft/managed-apps-common/services';
+import { DevelopmentSnapshotSource } from '../snapshot/SnapshotSource.js';
+import { readPackagedResourcesAsync } from './PackagedResources.js';
+/**
+ * A Connect-compatible handler, not a listener. Mount only for explicit local-dev
+ * opt-in and before Vite's fallback. Does not modify legacy config serving.
+ */
+export async function createDevelopmentMiddlewareAsync(options) {
+    const origin = new URL(DevOriginSchema.parse(options.devOrigin));
+    const playerOrigin = new URL(DevOriginSchema.parse(options.playerOrigin)).origin;
+    if (!maafAllowedEmbedderOrigins.includes(playerOrigin)) {
+        throw new Error('An allowlisted Microsoft Apps player origin is required');
+    }
+    if (!options.projectRoot.trim())
+        throw new Error('An explicit projectRoot is required');
+    const assets = await readPackagedResourcesAsync();
+    const snapshots = new DevelopmentSnapshotSource(options.projectRoot);
+    const reportError = options.onError ?? ((error) => console.error(error));
+    const routes = new Set([
+        PlatformPaths.loader,
+        PlatformPaths.sw,
+        DevelopmentResources.appScriptPath,
+        DevelopmentResources.snapshotPath,
+    ]);
+    return async (request, response, next) => {
+        const rawUrl = request.url ?? '';
+        const path = rawUrl.split('?')[0];
+        if (!routes.has(path)) {
+            next();
+            return;
+        }
+        const send = (status, contentType, body) => {
+            response.statusCode = status;
+            response.removeHeader('Access-Control-Allow-Origin');
+            response.removeHeader('Access-Control-Allow-Credentials');
+            response.removeHeader('Access-Control-Allow-Headers');
+            response.removeHeader('Access-Control-Allow-Methods');
+            response.setHeader('Content-Type', contentType);
+            response.setHeader('Cache-Control', 'no-store');
+            response.setHeader('X-Content-Type-Options', 'nosniff');
+            response.setHeader('Content-Length', Buffer.byteLength(body));
+            response.end(body);
+        };
+        const fail = (status, code) => send(status, 'application/json; charset=utf-8', JSON.stringify({ error: code }));
+        // Forwarded headers never establish origin trust. Host includes the port.
+        const hostCount = request.rawHeaders.filter((_value, index) => index % 2 === 0 && request.rawHeaders[index].toLowerCase() === 'host').length;
+        if (request.headers.host !== origin.host || hostCount !== 1) {
+            fail(403, 'DevelopmentOriginRejected');
+            return;
+        }
+        if (request.method !== 'GET') {
+            response.setHeader('Allow', 'GET');
+            fail(405, 'MethodNotAllowed');
+            return;
+        }
+        if (path !== PlatformPaths.loader && path !== PlatformPaths.sw && rawUrl !== path) {
+            fail(400, 'UnexpectedResourceQuery');
+            return;
+        }
+        if (path === PlatformPaths.sw) {
+            try {
+                parseDevelopmentWorkerSource(new URL(rawUrl, origin).href);
+            }
+            catch {
+                fail(400, 'InvalidDevelopmentWorkerSource');
+                return;
+            }
+            response.setHeader('Service-Worker-Allowed', '/');
+            send(200, 'application/javascript; charset=utf-8', assets.workerStub);
+            return;
+        }
+        if (path === PlatformPaths.loader) {
+            const embedderOrigins = new URL(rawUrl, origin).searchParams.getAll('ms_embedderOrigin');
+            let requestedPlayerOrigin;
+            try {
+                if (embedderOrigins.length === 1) {
+                    requestedPlayerOrigin = new URL(DevOriginSchema.parse(embedderOrigins[0])).origin;
+                }
+            }
+            catch {
+                // Rejected below with the same non-diagnostic response as any mismatch.
+            }
+            if (requestedPlayerOrigin !== playerOrigin) {
+                fail(403, 'DevelopmentEmbedderOriginRejected');
+                return;
+            }
+            response.setHeader('Content-Security-Policy', `frame-ancestors ${playerOrigin}`);
+            send(200, 'text/html; charset=utf-8', assets.loaderHtml);
+            return;
+        }
+        if (path === DevelopmentResources.appScriptPath) {
+            send(200, 'application/javascript; charset=utf-8', assets.appScript);
+            return;
+        }
+        const requestOrigin = request.headers.origin;
+        if (request.headers[DevelopmentResources.snapshotHeader.toLowerCase()] !==
+            DevelopmentResources.snapshotHeaderValue ||
+            (requestOrigin !== undefined && requestOrigin !== origin.origin) ||
+            request.headers['sec-fetch-site'] === 'cross-site') {
+            fail(403, 'DevelopmentSnapshotAccessRejected');
+            return;
+        }
+        try {
+            const { read } = await snapshots.refreshAsync();
+            send(200, 'application/json; charset=utf-8', JSON.stringify(read.snapshot));
+        }
+        catch (error) {
+            fail(500, 'DevelopmentSnapshotUnavailable');
+            reportError(error);
+        }
+    };
+}
+//# sourceMappingURL=DevelopmentMiddleware.js.map

package/dist/resources/DevelopmentMiddleware.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"DevelopmentMiddleware.js","sourceRoot":"","sources":["../../src/resources/DevelopmentMiddleware.ts"],"names":[],"mappings":"AAAA;;GAEG;AAIH,OAAO,EACL,oBAAoB,EACpB,eAAe,EACf,4BAA4B,EAC5B,aAAa,GACd,MAAM,wCAAwC,CAAC;AAChD,OAAO,EAAE,0BAA0B,EAAE,MAAM,yCAAyC,CAAC;AAErF,OAAO,EAAE,yBAAyB,EAAE,MAAM,4BAA4B,CAAC;AACvE,OAAO,EAAE,0BAA0B,EAAE,MAAM,qBAAqB,CAAC;AAkBjE;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,gCAAgC,CACpD,OAAqC;IAErC,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,eAAe,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC;IACjE,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,eAAe,CAAC,KAAK,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC;IACjF,IAAI,CAAC,0BAA0B,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC;QACvD,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAC;IAC7E,CAAC;IACD,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,IAAI,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;IACxF,MAAM,MAAM,GAAG,MAAM,0BAA0B,EAAE,CAAC;IAClD,MAAM,SAAS,GAAG,IAAI,yBAAyB,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;IACrE,MAAM,WAAW,GAAG,OAAO,CAAC,OAAO,IAAI,CAAC,CAAC,KAAc,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;IAClF,MAAM,MAAM,GAAG,IAAI,GAAG,CAAS;QAC7B,aAAa,CAAC,MAAM;QACpB,aAAa,CAAC,EAAE;QAChB,oBAAoB,CAAC,aAAa;QAClC,oBAAoB,CAAC,YAAY;KAClC,CAAC,CAAC;IAEH,OAAO,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE;QACvC,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,IAAI,EAAE,CAAC;QACjC,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QAClC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YACtB,IAAI,EAAE,CAAC;YACP,OAAO;QACT,CAAC;QACD,MAAM,IAAI,GAAG,CAAC,MAAc,EAAE,WAAmB,EAAE,IAAY,EAAE,EAAE;YACjE,QAAQ,CAAC,UAAU,GAAG,MAAM,CAAC;YAC7B,QAAQ,CAAC,YAAY,CAAC,6BAA6B,CAAC,CAAC;YACrD,QAAQ,CAAC,YAAY,CAAC,kCAAkC,CAAC,CAAC;YAC1D,QAAQ,CAAC,YAAY,CAAC,8BAA8B,CAAC,CAAC;YACtD,QAAQ,CAAC,YAAY,CAAC,8BAA8B,CAAC,CAAC;YACtD,QAAQ,CAAC,SAAS,CAAC,cAAc,EAAE,WAAW,CAAC,CAAC;YAChD,QAAQ,CAAC,SAAS,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;YAChD,QAAQ,CAAC,SAAS,CAAC,wBAAwB,EAAE,SAAS,CAAC,CAAC;YACxD,QAAQ,CAAC,SAAS,CAAC,gBAAgB,EAAE,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC;YAC9D,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACrB,CAAC,CAAC;QACF,MAAM,IAAI,GAAG,CAAC,MAAc,EAAE,IAAY,EAAE,EAAE,CAC5C,IAAI,CAAC,MAAM,EAAE,iCAAiC,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;QAEnF,0EAA0E;QAC1E,MAAM,SAAS,GAAG,OAAO,CAAC,UAAU,CAAC,MAAM,CACzC,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,GAAG,CAAC,KAAK,CAAC,IAAI,OAAO,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE,KAAK,MAAM,CACzF,CAAC,MAAM,CAAC;QACT,IAAI,OAAO,CAAC,OAAO,CAAC,IAAI,KAAK,MAAM,CAAC,IAAI,IAAI,SAAS,KAAK,CAAC,EAAE,CAAC;YAC5D,IAAI,CAAC,GAAG,EAAE,2BAA2B,CAAC,CAAC;YACvC,OAAO;QACT,CAAC;QACD,IAAI,OAAO,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;YAC7B,QAAQ,CAAC,SAAS,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;YACnC,IAAI,CAAC,GAAG,EAAE,kBAAkB,CAAC,CAAC;YAC9B,OAAO;QACT,CAAC;QACD,IAAI,IAAI,KAAK,aAAa,CAAC,MAAM,IAAI,IAAI,KAAK,aAAa,CAAC,EAAE,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;YAClF,IAAI,CAAC,GAAG,EAAE,yBAAyB,CAAC,CAAC;YACrC,OAAO;QACT,CAAC;QACD,IAAI,IAAI,KAAK,aAAa,CAAC,EAAE,EAAE,CAAC;YAC9B,IAAI,CAAC;gBACH,4BAA4B,CAAC,IAAI,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC;YAC7D,CAAC;YAAC,MAAM,CAAC;gBACP,IAAI,CAAC,GAAG,EAAE,gCAAgC,CAAC,CAAC;gBAC5C,OAAO;YACT,CAAC;YACD,QAAQ,CAAC,SAAS,CAAC,wBAAwB,EAAE,GAAG,CAAC,CAAC;YAClD,IAAI,CAAC,GAAG,EAAE,uCAAuC,EAAE,MAAM,CAAC,UAAU,CAAC,CAAC;YACtE,OAAO;QACT,CAAC;QACD,IAAI,IAAI,KAAK,aAAa,CAAC,MAAM,EAAE,CAAC;YAClC,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,YAAY,CAAC,MAAM,CAAC,mBAAmB,CAAC,CAAC;YACzF,IAAI,qBAAyC,CAAC;YAC9C,IAAI,CAAC;gBACH,IAAI,eAAe,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;oBACjC,qBAAqB,GAAG,IAAI,GAAG,CAAC,eAAe,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;gBACpF,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,wEAAwE;YAC1E,CAAC;YACD,IAAI,qBAAqB,KAAK,YAAY,EAAE,CAAC;gBAC3C,IAAI,CAAC,GAAG,EAAE,mCAAmC,CAAC,CAAC;gBAC/C,OAAO;YACT,CAAC;YACD,QAAQ,CAAC,SAAS,CAAC,yBAAyB,EAAE,mBAAmB,YAAY,EAAE,CAAC,CAAC;YACjF,IAAI,CAAC,GAAG,EAAE,0BAA0B,EAAE,MAAM,CAAC,UAAU,CAAC,CAAC;YACzD,OAAO;QACT,CAAC;QACD,IAAI,IAAI,KAAK,oBAAoB,CAAC,aAAa,EAAE,CAAC;YAChD,IAAI,CAAC,GAAG,EAAE,uCAAuC,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC;YACrE,OAAO;QACT,CAAC;QACD,MAAM,aAAa,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC;QAC7C,IACE,OAAO,CAAC,OAAO,CAAC,oBAAoB,CAAC,cAAc,CAAC,WAAW,EAAE,CAAC;YAChE,oBAAoB,CAAC,mBAAmB;YAC1C,CAAC,aAAa,KAAK,SAAS,IAAI,aAAa,KAAK,MAAM,CAAC,MAAM,CAAC;YAChE,OAAO,CAAC,OAAO,CAAC,gBAAgB,CAAC,KAAK,YAAY,EAClD,CAAC;YACD,IAAI,CAAC,GAAG,EAAE,mCAAmC,CAAC,CAAC;YAC/C,OAAO;QACT,CAAC;QACD,IAAI,CAAC;YACH,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,SAAS,CAAC,YAAY,EAAE,CAAC;YAChD,IAAI,CAAC,GAAG,EAAE,iCAAiC,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;QAC9E,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,GAAG,EAAE,gCAAgC,CAAC,CAAC;YAC5C,WAAW,CAAC,KAAK,CAAC,CAAC;QACrB,CAAC;IACH,CAAC,CAAC;AACJ,CAAC"}

package/dist/resources/PackagedResources.d.ts

@@ -0,0 +1,10 @@
+/*!
+ * Copyright (C) Microsoft Corporation. All rights reserved.
+ */
+/** Only these build-owned assets are shipped; the live worker is never packaged. */
+export declare function readPackagedResourcesAsync(): Promise<{
+    loaderHtml: string;
+    appScript: string;
+    workerStub: string;
+}>;
+//# sourceMappingURL=PackagedResources.d.ts.map

package/dist/resources/PackagedResources.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"PackagedResources.d.ts","sourceRoot":"","sources":["../../src/resources/PackagedResources.ts"],"names":[],"mappings":"AAAA;;GAEG;AAIH,oFAAoF;AACpF,wBAAsB,0BAA0B,IAAI,OAAO,CAAC;IAC1D,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;CACpB,CAAC,CAOD"}

package/dist/resources/PackagedResources.js

@@ -0,0 +1,14 @@
+/*!
+ * Copyright (C) Microsoft Corporation. All rights reserved.
+ */
+import { readFile } from 'node:fs/promises';
+/** Only these build-owned assets are shipped; the live worker is never packaged. */
+export async function readPackagedResourcesAsync() {
+    const [loaderHtml, appScript, workerStub] = await Promise.all([
+        readFile(new URL('./loader.html', import.meta.url), 'utf8'),
+        readFile(new URL('./appScript.js', import.meta.url), 'utf8'),
+        readFile(new URL('./localDevWorker.js', import.meta.url), 'utf8'),
+    ]);
+    return { loaderHtml, appScript, workerStub };
+}
+//# sourceMappingURL=PackagedResources.js.map

package/dist/resources/PackagedResources.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"PackagedResources.js","sourceRoot":"","sources":["../../src/resources/PackagedResources.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAE5C,oFAAoF;AACpF,MAAM,CAAC,KAAK,UAAU,0BAA0B;IAK9C,MAAM,CAAC,UAAU,EAAE,SAAS,EAAE,UAAU,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QAC5D,QAAQ,CAAC,IAAI,GAAG,CAAC,eAAe,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;QAC3D,QAAQ,CAAC,IAAI,GAAG,CAAC,gBAAgB,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;QAC5D,QAAQ,CAAC,IAAI,GAAG,CAAC,qBAAqB,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;KAClE,CAAC,CAAC;IACH,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,UAAU,EAAE,CAAC;AAC/C,CAAC"}