@nikelyh/offscript 0.0.0-stage → 1.0.0

package/dist/packages/runtime/local-host.js

@@ -0,0 +1,280 @@
+import { randomBytes } from "node:crypto";
+import { openPersistence } from "../persistence/index.js";
+import { createLocalServer, createStudioSession } from "../server/index.js";
+import { simulationId } from "../domain/index.js";
+import { createOutboxDispatcher } from "./outbox-dispatcher.js";
+import { localHostConfig } from "./host-config.js";
+import { hostStorage } from "./host-storage.js";
+import { sessionRegistry } from "./session-registry.js";
+import { withinDeadline } from "./deadline.js";
+import { ApplicationError, executeConfigureSimulation, executeCheckTarget, executeDeleteConfiguredSimulation, executeRecoverSimulation } from "../application/index.js";
+import { inspectProject, createTargetProbe } from "../projects/index.js";
+import { ContractValidationError, evaluateFindingAssessment, parseLocalTargetUrl } from "../contracts/index.js";
+import { executionCoordinator } from "./execution-coordinator.js";
+import { createEvidenceStore } from "./evidence-store.js";
+export function createLocalHost(options) {
+    const config = localHostConfig(options);
+    const onDiagnostic = options.onDiagnostic;
+    const token = randomBytes(32).toString("base64url");
+    const studioSession = config.studioDirectory ? createStudioSession() : undefined;
+    const evidenceStore = createEvidenceStore(config.dataDirectory);
+    const registry = sessionRegistry();
+    const deleting = new Set();
+    const probe = createTargetProbe();
+    const probeLifetime = new AbortController();
+    let phase = "starting";
+    let port;
+    let origin;
+    let closing = false;
+    let coordinator;
+    let persistence;
+    let guarded;
+    let server;
+    let dispatcher;
+    let starting;
+    let closingTask;
+    let releasing;
+    function release() {
+        if (releasing)
+            return releasing;
+        phase = "stopping";
+        probeLifetime.abort();
+        registry.stopAdmission();
+        releasing = (async () => {
+            const errors = [];
+            try {
+                await server?.close();
+            }
+            catch (error) {
+                errors.push(error);
+            }
+            const results = await Promise.allSettled([registry.close(), coordinator?.close(), dispatcher?.stop()]);
+            for (const result of results)
+                if (result.status === "rejected")
+                    errors.push(result.reason);
+            // Stop publication before denying late storage calls. Already admitted DB
+            // operations finish before the connection closes; provider work is separate.
+            await guarded?.drain();
+            try {
+                persistence?.close();
+            }
+            catch (error) {
+                errors.push(error);
+            }
+            phase = "stopped";
+            if (errors.length)
+                throw new AggregateError(errors, "Local host cleanup failed.");
+        })();
+        return releasing;
+    }
+    async function initialize() {
+        try {
+            persistence = openPersistence({ projectRoot: config.projectRoot, dataDirectory: config.dataDirectory });
+            persistence.migrate();
+            guarded = hostStorage(persistence);
+            coordinator = executionCoordinator({
+                storage: guarded.storage,
+                prepareSession: (id, create) => registry.add(id, create),
+                factory: options.sessionFactory,
+                evidenceStore,
+            });
+            server = createLocalServer({ token, port: () => port, allowedOrigins: config.allowedOrigins, phase: () => phase,
+                configurations: api,
+                ...(config.studioDirectory && studioSession ? { studioDirectory: config.studioDirectory, studioSession } : {}),
+            });
+            await server.ready();
+            if (closing)
+                throw new Error("Host closed during startup.");
+            origin = await server.listen({ host: "127.0.0.1", port: config.port });
+            const address = server.server.address();
+            if (!address || typeof address === "string")
+                throw new Error("Expected a TCP listener.");
+            port = address.port;
+            if (closing)
+                throw new Error("Host closed during startup.");
+            dispatcher = createOutboxDispatcher({ store: guarded.storage.outbox, publisher: registry.publisher,
+                publishTimeoutMs: 1_000,
+                onError() {
+                    if (!closing)
+                        phase = "failed";
+                    try {
+                        onDiagnostic?.("OUTBOX_FAILED");
+                    }
+                    catch { /* Diagnostics must not break cleanup. */ }
+                },
+            });
+            phase = "ready";
+            dispatcher.start();
+            return origin;
+        }
+        catch (cause) {
+            try {
+                await release();
+            }
+            catch (cleanup) {
+                throw new AggregateError([cause, cleanup], "Local host startup and cleanup failed.");
+            }
+            throw new Error("Local host startup failed.", { cause });
+        }
+    }
+    const api = Object.freeze({
+        config,
+        phase: () => phase,
+        start() {
+            if (closing || phase === "stopped")
+                return Promise.reject(new Error("Host cannot restart after closing."));
+            starting ??= initialize();
+            return starting;
+        },
+        credentials() {
+            if (phase !== "ready" || origin === undefined)
+                throw new Error("Host is not ready.");
+            return Object.freeze({ origin, token });
+        },
+        studioEntry() {
+            if (phase !== "ready" || !origin || !studioSession)
+                throw new Error("Studio is not available.");
+            return Object.freeze({ origin, entry: studioSession.issueEntry() });
+        },
+        async listConfigurations() {
+            const storage = guarded?.storage;
+            if (phase !== "ready" || closing || !storage)
+                throw new Error("Host is not accepting configuration reads.");
+            return storage.configurations.listConfigurations();
+        },
+        async inspectProject() {
+            if (phase !== "ready" || closing)
+                throw new Error("Host is not accepting project inspection.");
+            return inspectProject(config.projectRoot);
+        },
+        async checkTarget(url, signal) {
+            if (phase !== "ready" || closing)
+                throw new Error("Host is not accepting connection checks.");
+            const target = new URL(parseLocalTargetUrl(url));
+            if (Number(target.port || (target.protocol === "https:" ? 443 : 80)) === port) {
+                throw new ContractValidationError("target.url", "Select the application port, not OFFSCRIPT's port.");
+            }
+            return executeCheckTarget(url, probe, AbortSignal.any([probeLifetime.signal, ...(signal ? [signal] : [])]));
+        },
+        async configureSimulation(input) {
+            const storage = guarded?.storage;
+            if (phase !== "ready" || closing || !storage)
+                throw new Error("Host is not accepting simulation configuration.");
+            return executeConfigureSimulation({ ...input, projectRoot: config.projectRoot }, {
+                projects: { inspectProject }, configurations: { ...storage.configurations,
+                    async createConfiguredSimulation(configuration, simulation) {
+                        if (phase !== "ready" || closing)
+                            throw new Error("Host closed before configuration commit.");
+                        return storage.configurations.createConfiguredSimulation(configuration, simulation);
+                    },
+                },
+            });
+        },
+        async findConfiguration(id) {
+            const storage = guarded?.storage;
+            if (phase !== "ready" || closing || !storage)
+                throw new Error("Host is not accepting configuration reads.");
+            return storage.configurations.findConfiguration(simulationId(id));
+        },
+        async deleteConfiguration(id) {
+            simulationId(id);
+            const storage = guarded?.storage;
+            if (phase !== "ready" || closing || !storage)
+                throw new Error("Host is not accepting deletion requests.");
+            if (registry.has(id) || deleting.has(id) || coordinator?.hasActive(id))
+                return "not-allowed";
+            deleting.add(id);
+            try {
+                const result = await executeDeleteConfiguredSimulation(id, storage.configurations);
+                if (result === "deleted")
+                    void evidenceStore.deleteSimulationEvidence(id);
+                return result;
+            }
+            finally {
+                deleting.delete(id);
+            }
+        },
+        async startSimulation(id, mode) {
+            if (phase !== "ready" || closing)
+                throw new Error("Host is not accepting execution commands.");
+            if (!coordinator)
+                throw new Error("No execution session factory configured on this host.");
+            return coordinator.start(simulationId(id), mode);
+        },
+        async stopSimulation(id) {
+            if (phase !== "ready" || closing)
+                throw new Error("Host is not accepting execution commands.");
+            if (!coordinator)
+                throw new Error("No execution session factory configured on this host.");
+            return coordinator.stop(simulationId(id));
+        },
+        async inspectExecution(id) {
+            if (phase !== "ready" || closing)
+                throw new Error("Host is not accepting execution inspection.");
+            if (!coordinator)
+                throw new Error("No execution session factory configured on this host.");
+            return coordinator.inspect(simulationId(id));
+        },
+        async recoverSimulation(id, action, reason) {
+            if (phase !== "ready" || closing)
+                throw new Error("Host is not accepting recovery commands.");
+            const storage = guarded?.storage;
+            if (!storage)
+                throw new Error("Storage not initialized.");
+            if (coordinator?.hasActive(simulationId(id))) {
+                throw new ApplicationError("EXECUTION_ALREADY_ACTIVE", "Cannot recover an actively executing simulation.");
+            }
+            await executeRecoverSimulation({ simulationId: simulationId(id), action, reason }, storage.simulations);
+            return coordinator?.inspect(simulationId(id)) ?? Object.freeze({
+                simulationId: id, phase: action === "cancel" ? "cancelled" : "failed",
+                turnsCount: 0, activeAgents: [],
+            });
+        },
+        async getSimulationResults(id) {
+            const storage = guarded?.storage;
+            if (phase !== "ready" || closing || !storage)
+                throw new Error("Host is not accepting results queries.");
+            const observations = await storage.observations.listObservations(simulationId(id));
+            const investigations = await storage.investigations.listInvestigations(simulationId(id));
+            const completed = investigations.filter((inv) => inv.lifecycle.status === "completed");
+            const findings = completed.map(inv => evaluateFindingAssessment(inv, observations));
+            return Object.freeze({
+                simulationId: id,
+                observations,
+                investigations,
+                findings,
+            });
+        },
+        async getEvidence(id, evidenceId) {
+            if (phase !== "ready" || closing)
+                throw new Error("Host is not accepting evidence queries.");
+            return evidenceStore.getEvidence(simulationId(id), evidenceId);
+        },
+        prepareSession(id, create) {
+            simulationId(id);
+            const storage = guarded?.storage;
+            if (phase !== "ready" || closing || !storage)
+                throw new Error("Host is not accepting sessions.");
+            if (deleting.has(id))
+                throw new Error("Simulation deletion is in progress.");
+            return registry.add(id, () => create(Object.freeze({ storage, outboxMode: "external" })));
+        },
+        close() {
+            if (closingTask)
+                return closingTask;
+            if (phase === "stopped") {
+                closing = true;
+                closingTask = releasing ?? Promise.resolve();
+                return closingTask;
+            }
+            closing = true;
+            probeLifetime.abort();
+            registry.stopAdmission();
+            phase = "stopping";
+            const cleanup = (async () => { await starting?.catch(() => { }); await release(); })();
+            closingTask = withinDeadline(cleanup, config.shutdownTimeoutMs);
+            return closingTask;
+        },
+    });
+    return api;
+}

package/dist/packages/runtime/outbox-dispatcher.js

@@ -0,0 +1,61 @@
+import { randomUUID } from "node:crypto";
+import { dispatchOutboxBatch, validateDispatch } from "../application/index.js";
+export function createOutboxDispatcher(options) {
+    const dispatch = Object.freeze({ ...(options.dispatch ?? { leaseMs: 30_000, batchSize: 10, maxAttempts: 5, retryBaseMs: 100, retryMaxMs: 10_000, deferMs: 250 }) });
+    validateDispatch(dispatch);
+    const timeout = options.publishTimeoutMs ?? Math.min(5_000, dispatch.leaseMs - 1);
+    const pollMs = options.pollMs ?? 25;
+    if (!Number.isSafeInteger(timeout) || timeout < 1 || timeout >= dispatch.leaseMs || !Number.isSafeInteger(pollMs) || pollMs < 1 || pollMs > 2_147_483_647)
+        throw new Error("Invalid dispatcher timing.");
+    const publisher = {
+        async publish(event) {
+            let timer;
+            try {
+                return await Promise.race([Promise.resolve().then(() => options.publisher.publish(event)),
+                    new Promise((_, reject) => { timer = setTimeout(() => reject(new Error("Outbox publication timed out.")), timeout); })]);
+            }
+            finally {
+                clearTimeout(timer);
+            }
+        },
+    };
+    let running;
+    let timer;
+    let started = false;
+    let stopped = false;
+    function runOnce() {
+        if (stopped)
+            return Promise.reject(new Error("Dispatcher is stopped."));
+        if (running)
+            return running;
+        running = dispatchOutboxBatch({ store: options.store, publisher, now: options.now ?? Date.now, token: options.token ?? randomUUID }, dispatch)
+            .finally(() => { running = undefined; });
+        return running;
+    }
+    async function tick() {
+        try {
+            await runOnce();
+        }
+        catch (cause) {
+            try {
+                options.onError?.(cause);
+            }
+            catch {
+                stopped = true;
+            }
+        }
+        finally {
+            if (!stopped) {
+                timer = setTimeout(() => { void tick(); }, pollMs);
+                timer.unref();
+            }
+        }
+    }
+    return Object.freeze({ runOnce,
+        start() { if (!started && !stopped) {
+            started = true;
+            void tick();
+        } },
+        async stop() { stopped = true; clearTimeout(timer); await running; },
+    });
+}

package/dist/packages/runtime/session-registry.js

@@ -0,0 +1,42 @@
+export function sessionRegistry() {
+    const sessions = new Map();
+    const preparing = new Set();
+    let accepting = true;
+    const publisher = {
+        async publish(event) {
+            const session = accepting ? sessions.get(event.simulationId) : undefined;
+            if (!session || !session.canAcceptEvent(event))
+                return "deferred";
+            session.publishEvent(event);
+            return "accepted";
+        },
+    };
+    return {
+        publisher,
+        has(id) { return sessions.has(id) || preparing.has(id); },
+        add(id, create) {
+            if (!accepting)
+                throw new Error("Host is closing.");
+            if (sessions.has(id) || preparing.has(id))
+                throw new Error("Simulation already has a hosted session.");
+            preparing.add(id);
+            try {
+                const session = create();
+                sessions.set(id, session);
+                return session;
+            }
+            finally {
+                preparing.delete(id);
+            }
+        },
+        stopAdmission() { accepting = false; },
+        async close() {
+            accepting = false;
+            const results = await Promise.allSettled([...sessions.values()].map(session => Promise.resolve().then(() => session.close())));
+            sessions.clear();
+            const failures = results.filter(result => result.status === "rejected");
+            if (failures.length)
+                throw new AggregateError(failures.map(result => result.reason), "Session shutdown failed.");
+        },
+    };
+}

package/dist/packages/server/configuration-routes.js

@@ -0,0 +1,85 @@
+import { simulationId } from "../domain/index.js";
+import { parseSimulationSetup, parseStartSimulationRequest } from "../contracts/index.js";
+import { parseLocalTargetUrl } from "../contracts/index.js";
+export function configurationRoutes(server, services) {
+    server.get("/api/project", async () => services.inspectProject());
+    server.post("/api/target/check", { bodyLimit: 4096 }, async (request, reply) => {
+        const body = request.body;
+        if (!body || typeof body !== "object" || Array.isArray(body) || !('url' in body) || Object.keys(body).some(key => key !== "url")) {
+            return reply.code(400).send({ error: "INVALID_REQUEST" });
+        }
+        const abort = new AbortController();
+        const disconnect = () => { if (!reply.raw.writableFinished)
+            abort.abort(); };
+        reply.raw.once("close", disconnect);
+        try {
+            return await services.checkTarget(parseLocalTargetUrl(body.url), abort.signal);
+        }
+        finally {
+            reply.raw.off("close", disconnect);
+        }
+    });
+    server.get("/api/simulations", async () => services.listConfigurations());
+    server.delete("/api/simulations/:id", async (request, reply) => {
+        const result = await services.deleteConfiguration(simulationId(request.params.id));
+        if (result === "not-found")
+            return reply.code(404).send({ error: "NOT_FOUND" });
+        if (result === "not-allowed")
+            return reply.code(409).send({ error: "DELETION_NOT_ALLOWED" });
+        return reply.code(204).send();
+    });
+    server.post("/api/simulations", { bodyLimit: 16_384 }, async (request, reply) => {
+        const body = request.body;
+        if (body === null || typeof body !== "object" || Array.isArray(body) ||
+            Reflect.ownKeys(body).some(key => key !== "simulationId" && key !== "setup") || !("simulationId" in body) || !("setup" in body) || typeof body.simulationId !== "string") {
+            return reply.code(400).send({ error: "INVALID_REQUEST" });
+        }
+        const result = await services.configureSimulation({ simulationId: simulationId(body.simulationId), setup: parseSimulationSetup(body.setup) });
+        return reply.code(201).send(result.configuration);
+    });
+    server.get("/api/simulations/:id", async (request, reply) => {
+        const value = await services.findConfiguration(simulationId(request.params.id));
+        if (!value)
+            return reply.code(404).send({ error: "NOT_FOUND" });
+        return value;
+    });
+    server.post("/api/simulations/:id/start", { bodyLimit: 4096 }, async (request, reply) => {
+        const { mode } = parseStartSimulationRequest(request.body);
+        const status = await services.startSimulation(simulationId(request.params.id), mode);
+        return reply.code(200).send(status);
+    });
+    server.get("/api/simulations/:id/execution", async (request) => {
+        return services.inspectExecution(simulationId(request.params.id));
+    });
+    server.get("/api/simulations/:id/results", async (request, reply) => {
+        const id = simulationId(request.params.id);
+        const value = await services.findConfiguration(id);
+        if (!value)
+            return reply.code(404).send({ error: "NOT_FOUND" });
+        return services.getSimulationResults(id);
+    });
+    server.get("/api/simulations/:id/evidence/:evidenceId", async (request, reply) => {
+        if (!services.getEvidence)
+            return reply.code(404).send({ error: "NOT_FOUND" });
+        const evId = request.params.evidenceId;
+        if (!evId || evId.includes("..") || evId.includes("/") || evId.includes("\\")) {
+            return reply.code(400).send({ error: "INVALID_REQUEST" });
+        }
+        const evidence = await services.getEvidence(simulationId(request.params.id), evId);
+        if (!evidence)
+            return reply.code(404).send({ error: "NOT_FOUND" });
+        return reply.type(evidence.contentType).header("Cache-Control", "private, no-cache, no-store, must-revalidate").send(evidence.data);
+    });
+    server.post("/api/simulations/:id/stop", async (request) => {
+        return services.stopSimulation(simulationId(request.params.id));
+    });
+    server.post("/api/simulations/:id/recover", { bodyLimit: 4096 }, async (request, reply) => {
+        if (!services.recoverSimulation)
+            return reply.code(501).send({ error: "NOT_IMPLEMENTED" });
+        const id = simulationId(request.params.id);
+        const body = request.body;
+        const action = body?.action === "cancel" ? "cancel" : "fail";
+        const status = await services.recoverSimulation(id, action, body?.reason);
+        return reply.code(200).send(status);
+    });
+}

package/dist/packages/server/contracts.js

@@ -0,0 +1,13 @@
+const status = (values) => ({
+    type: "object", additionalProperties: false, required: ["status"],
+    properties: { status: { type: "string", enum: values } },
+});
+export const errorSchema = {
+    type: "object", additionalProperties: false, required: ["error"],
+    properties: { error: { type: "string", enum: ["UNAUTHORIZED", "HOST_NOT_ALLOWED", "ORIGIN_NOT_ALLOWED", "NOT_FOUND", "INVALID_REQUEST", "INTERNAL_ERROR"] } },
+};
+const errors = { 400: errorSchema, 401: errorSchema, 403: errorSchema, 404: errorSchema, 500: errorSchema };
+export const healthSchemas = {
+    live: { response: { ...errors, 200: status(["alive"]) } },
+    ready: { response: { ...errors, 200: status(["ready"]), 503: status(["not-ready"]) } },
+};

package/dist/packages/server/index.js

@@ -0,0 +1,2 @@
+export { createLocalServer } from "./server.js";
+export { createStudioSession } from "./studio-session.js";

package/dist/packages/server/security.js

@@ -0,0 +1,38 @@
+import { createHash, timingSafeEqual } from "node:crypto";
+import { publicStudioPath } from "./studio-assets.js";
+export function secureLocalAccess(server, options) {
+    const digest = (text) => createHash("sha256").update(text).digest();
+    const expected = digest(options.token);
+    const allowed = new Set(options.allowedOrigins);
+    server.addHook("onRequest", async (request, reply) => {
+        reply.header("Cache-Control", "no-store");
+        reply.header("X-Content-Type-Options", "nosniff");
+        const port = options.port();
+        const authority = port === 80 ? "" : `:${port}`;
+        const hosts = new Set([`127.0.0.1${authority}`, `localhost${authority}`]);
+        if (port === undefined || !hosts.has(request.headers.host ?? "")) {
+            return reply.code(403).send({ error: "HOST_NOT_ALLOWED" });
+        }
+        const origin = request.headers.origin;
+        const pathname = request.url.split("?")[0] ?? "";
+        const entryPost = options.studioSession !== undefined && pathname === "/studio/session" && request.method === "POST";
+        // Public assets contain no project data. A local-file redirect can retain
+        // cross-site fetch metadata even after the credential exchange succeeds.
+        if (options.studioSession && publicStudioPath(request.method, pathname))
+            return;
+        if ((origin !== undefined && !(entryPost && origin === "null") && !allowed.has(origin) && origin !== `http://${request.headers.host}`) ||
+            (origin === undefined && !entryPost && request.headers["sec-fetch-site"] === "cross-site")) {
+            return reply.code(403).send({ error: "ORIGIN_NOT_ALLOWED" });
+        }
+        if (options.studioSession && (entryPost || publicStudioPath(request.method, pathname)))
+            return;
+        if (pathname.startsWith("/api/") && request.headers["x-offscript-client"] === "studio" && options.studioSession?.accepts(request.headers.cookie))
+            return;
+        const authorization = request.headers.authorization;
+        const token = authorization?.match(/^Bearer ([A-Za-z0-9_-]{43})$/i)?.[1];
+        if (!token || !timingSafeEqual(expected, digest(token))) {
+            reply.header("WWW-Authenticate", "Bearer");
+            return reply.code(401).send({ error: "UNAUTHORIZED" });
+        }
+    });
+}

package/dist/packages/server/server.js

@@ -0,0 +1,44 @@
+import Fastify from "fastify";
+import { errorSchema, healthSchemas } from "./contracts.js";
+import { secureLocalAccess } from "./security.js";
+import { ContractValidationError } from "../contracts/index.js";
+import { DomainError } from "../domain/index.js";
+import { ApplicationError } from "../application/index.js";
+import { configurationRoutes } from "./configuration-routes.js";
+import { studioAssets } from "./studio-assets.js";
+export function createLocalServer(options) {
+    const server = Fastify({ logger: false, trustProxy: false, bodyLimit: 1024,
+        requestTimeout: 5_000, connectionTimeout: 5_000, forceCloseConnections: true, exposeHeadRoutes: false });
+    server.addSchema({ $id: "host-error", ...errorSchema });
+    secureLocalAccess(server, options);
+    server.setErrorHandler((error, _request, reply) => {
+        if (error instanceof ContractValidationError)
+            return reply.code(400).send({ error: "INVALID_CONFIGURATION", field: error.path });
+        if (error instanceof DomainError)
+            return reply.code(400).send({ error: "INVALID_CONFIGURATION" });
+        if (error instanceof ApplicationError) {
+            if (error.code === "SIMULATION_ALREADY_EXISTS")
+                return reply.code(409).send({ error: "SIMULATION_ALREADY_EXISTS" });
+            if (error.code === "SIMULATION_NOT_FOUND")
+                return reply.code(404).send({ error: "NOT_FOUND" });
+            if (error.code === "EXECUTION_ALREADY_ACTIVE" || error.code === "INVALID_EXECUTION_STATE") {
+                return reply.code(409).send({ error: "EXECUTION_CONFLICT" });
+            }
+        }
+        const code = error && typeof error === "object" && "statusCode" in error ? error.statusCode : undefined;
+        const status = typeof code === "number" && code >= 400 && code < 500 ? 400 : 500;
+        return reply.code(status).send({ error: status === 400 ? "INVALID_REQUEST" : "INTERNAL_ERROR" });
+    });
+    if (options.configurations)
+        configurationRoutes(server, options.configurations);
+    if (options.studioDirectory && options.studioSession)
+        studioAssets(server, options.studioDirectory, options.studioSession);
+    server.setNotFoundHandler((_request, reply) => reply.code(404).send({ error: "NOT_FOUND" }));
+    server.get("/health/live", { schema: healthSchemas.live }, async () => ({ status: "alive" }));
+    server.get("/health/ready", { schema: healthSchemas.ready }, async (_request, reply) => {
+        if (options.phase() !== "ready")
+            return reply.code(503).send({ status: "not-ready" });
+        return { status: "ready" };
+    });
+    return server;
+}

package/dist/packages/server/studio-assets.js

@@ -0,0 +1,44 @@
+import send from "@fastify/send";
+import { statSync } from "node:fs";
+import { join } from "node:path";
+export function publicStudioPath(method, pathname) {
+    return method === "GET" && (["/", "/simulations/new", "/favicon.svg"].includes(pathname) ||
+        ["/assets/", "/participants/", "/brand/"].some(prefix => pathname.startsWith(prefix)));
+}
+export function studioAssets(server, root, session) {
+    if (!statSync(join(root, "index.html")).isFile())
+        throw new Error("Build Studio before starting its host.");
+    async function file(request, reply, path) {
+        const encodedPath = path.split("/").map(encodeURIComponent).join("/");
+        const asset = await send(request.raw, encodedPath, { root, dotfiles: "deny", cacheControl: false, index: false });
+        if (asset.type !== "file") {
+            asset.stream.destroy();
+            const status = asset.statusCode >= 500 ? 500 : 404;
+            return reply.code(status).send({ error: status === 500 ? "INTERNAL_ERROR" : "NOT_FOUND" });
+        }
+        return reply.code(asset.statusCode).headers(asset.headers).send(asset.stream);
+    }
+    for (const path of ["/", "/simulations/new"])
+        server.get(path, (request, reply) => file(request, reply, "index.html"));
+    server.get("/favicon.svg", (request, reply) => file(request, reply, "favicon.svg"));
+    for (const prefix of ["assets", "participants", "brand"]) {
+        server.get(`/${prefix}/*`, (request, reply) => {
+            const path = request.params["*"];
+            if (!path || path.includes("..") || path.includes("\\") || path.startsWith("/"))
+                return reply.code(404).send({ error: "NOT_FOUND" });
+            return file(request, reply, `${prefix}/${path}`);
+        });
+    }
+    server.addContentTypeParser("application/x-www-form-urlencoded", { parseAs: "string" }, (_request, body, done) => {
+        const fields = new URLSearchParams(String(body));
+        done(null, fields.getAll("entry").length === 1 ? { entry: fields.get("entry") } : {});
+    });
+    server.post("/studio/session", async (request, reply) => {
+        const body = request.body;
+        const token = session.exchange(body && typeof body === "object" && "entry" in body ? body.entry : undefined);
+        if (!token)
+            return reply.code(401).send({ error: "UNAUTHORIZED" });
+        reply.header("Set-Cookie", `offscript_session=${token}; HttpOnly; SameSite=Strict; Path=/api`);
+        return reply.code(303).header("Location", "/").send();
+    });
+}

package/dist/packages/server/studio-session.js

@@ -0,0 +1,28 @@
+import { createHash, randomBytes, timingSafeEqual } from "node:crypto";
+export function createStudioSession() {
+    const digest = (value) => createHash("sha256").update(value).digest();
+    let entry;
+    let session;
+    return Object.freeze({
+        issueEntry() {
+            const token = randomBytes(32).toString("base64url");
+            entry = { digest: digest(token), expiresAt: Date.now() + 300_000 };
+            return token;
+        },
+        exchange(value) {
+            if (typeof value !== "string" || value.length !== 43 || !entry || entry.expiresAt <= Date.now() || !timingSafeEqual(entry.digest, digest(value)))
+                return undefined;
+            entry = undefined;
+            const token = randomBytes(32).toString("base64url");
+            session = digest(token);
+            return token;
+        },
+        accepts(cookie) {
+            if (!cookie || !session)
+                return false;
+            const values = cookie.split(";").map(value => value.trim()).filter(value => value.startsWith("offscript_session="));
+            const token = values[0]?.slice("offscript_session=".length);
+            return values.length === 1 && token?.length === 43 && timingSafeEqual(session, digest(token));
+        },
+    });
+}