@moondeck/station 1.0.0 → 1.0.2

package/src/preview-upstream.ts

@@ -0,0 +1,41 @@
+/** Optional preview behavior, negotiated per live Station connection. */
+export const PREVIEW_UPSTREAM_PROTOCOL_FEATURE = "preview-upstream-v1";
+
+export interface PreviewUpstream {
+  upstreamHost?: string;
+  upstreamTls?: boolean;
+}
+
+/** DNS spelling only. URL parsing here detects numeric/hex/octal IP aliases;
+ * it never resolves a name. No URL, authority, port or header syntax is allowed. */
+export function isPreviewUpstreamHost(value: unknown): value is string {
+  if (typeof value !== "string" || value.length < 1 || value.length > 253) return false;
+  if (!value.split(".").every((label) => /^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/i.test(label))) return false;
+  try {
+    return !/^\d+\.\d+\.\d+\.\d+$/.test(new URL(`http://${value}`).hostname);
+  } catch { return false; }
+}
+
+export function hasPreviewUpstream(value: PreviewUpstream): boolean {
+  return value.upstreamHost !== undefined || value.upstreamTls === true;
+}
+
+/** Read only these fields from a frame or declaration; reject malformed values. */
+export function parsePreviewUpstream(value: unknown): PreviewUpstream | null {
+  if (value === undefined) return {};
+  if (!value || typeof value !== "object" || Array.isArray(value)) return null;
+  const { upstreamHost, upstreamTls } = value as Record<string, unknown>;
+  if (upstreamHost !== undefined && !isPreviewUpstreamHost(upstreamHost)) return null;
+  if (upstreamTls !== undefined && typeof upstreamTls !== "boolean") return null;
+  return {
+    ...(typeof upstreamHost === "string" ? { upstreamHost: upstreamHost.toLowerCase() } : {}),
+    ...(typeof upstreamTls === "boolean" ? { upstreamTls } : {}),
+  };
+}
+
+export function tunnelPreviewUpstream(frame: { target: string; containerPort?: number } & PreviewUpstream): PreviewUpstream | null {
+  const settings = parsePreviewUpstream(frame);
+  if (!settings) return null;
+  if (hasPreviewUpstream(settings) && (frame.target !== "preview" || !Number.isInteger(frame.containerPort) || frame.containerPort! < 1 || frame.containerPort! > 65535)) return null;
+  return settings;
+}

package/src/protocol.ts

@@ -1,4 +1,6 @@
 export * from "./custom-connections";
+export * from "./preview-upstream";
+import type { PreviewUpstream } from "./preview-upstream";
 import type { AccountBinding, EngineConnectCustomDiscoverFrame, EngineConnectCustomDiscoveredFrame, EngineConnectCustomSaveFrame, EngineConnectCustomManualSaveFrame, EngineConnectCustomSavedFrame, OpenRouterBudgetFrame } from "./custom-connections";
 import type { TaskSecretApplied, TaskSecretStagingPut, TaskSecretStagingAck } from "./task-secrets";
 import { isNeverProxiedDomain } from "./never-proxied-domains";
@@ -101,6 +103,8 @@ export type HostCommandResult<T> =
 
 /** Capability ids shared by host advertisement and fail-closed cloud gates. */
 export const ASSIGNMENT_EVIDENCE_PROTOCOL_FEATURE = "assignment-evidence-v1";
+/** Hosts that accept at most one delivery per first-turn id (6th channelDeliver arg). */
+export const FIRST_TURN_DEDUP_PROTOCOL_FEATURE = "first-turn-dedup-v1";
 export const LEAD_EVIDENCE_PROTOCOL_FEATURE = "lead-evidence-v1";
 export const TRANSCRIPT_TARGETS_PROTOCOL_FEATURE = "transcript-targets-v1";
 export const SECRETARY_TYPED_DISPATCH_PROTOCOL_FEATURE =
@@ -305,7 +309,7 @@ export const INITIAL_PROJECT_ENV_POLICY_EPOCH = 1;
  * The wire guard accepts every historical positive epoch through this value,
  * but rejects a future epoch until this peer knows how to interpret it.
  */
-export const CURRENT_PROJECT_ENV_PARSER_EPOCH = 2;
+export const CURRENT_PROJECT_ENV_PARSER_EPOCH = 3;
 
 export const PROJECT_ENV_UNSUPPORTED_REASON_CODES = [
   "malformed",
@@ -4810,6 +4814,9 @@ export interface HostCommands {
      *  from an older cloud, which the host reads as "not a human turn". */
     origin?: DeliveryOrigin,
     assignment?: AssignmentDelivery,
+    /** `first-turn-dedup-v1`: stable id of a first-turn delivery. A repeat of
+     *  an accepted id is acknowledged without queueing another turn. */
+    firstTurnId?: string,
   ): Promise<HostCommandResult<void>>;
   channelResolvePermission(
     ctx: CommandContext,
@@ -4830,6 +4837,7 @@ export interface HostCommands {
     taskId: string,
     name: string,
     containerPort: number,
+    upstream?: PreviewUpstream,
   ): Promise<HostCommandResult<{ hostPort: number | null }>>;
   /** ADR-116: remove a labeled engine account by id. Refuses `default:*`
    * exactly like the local API; re-advertises capabilities on success. */
@@ -4992,6 +5000,8 @@ export type CloudToHost =
       // proxies to <container-ip>:<containerPort> over the Docker network.
       // Absent for the editor target (which uses the published codeServerPort).
       containerPort?: number;
+      upstreamHost?: string;
+      upstreamTls?: boolean;
       reqLine: TunnelReqLine;
       upgrade: boolean;
     }