@openagt/dashboard 0.0.0-stage → 0.8.0

package/dist/registry.js

@@ -0,0 +1,348 @@
+import { basename, dirname, join, resolve } from 'node:path';
+import { randomBytes } from 'node:crypto';
+import { isDriverName } from './driver-names.js';
+import { isPublishPick } from './publish-levels.js';
+import { nodeFs } from './node-fs.js';
+/** The cap on saved custom presets, and the per-field lengths — enough for real prompts, bounded
+ * so a hand-edited or hostile registry can't bloat the home file. */
+const CUSTOM_PRESET_LIMITS = { count: 30, label: 80, prompt: 20_000 };
+/** The cap on the projects `startFrom` lists, for the same reason. */
+const START_FROM_LIMIT = 200;
+/** The registry file name: a single file under `$XDG_CONFIG_HOME` (dotted under `$HOME`). */
+export const REGISTRY_FILE = 'the-framework.json';
+/** Owner read/write only: the file holds the daemon token (#1051). */
+export const REGISTRY_FILE_MODE = 0o600;
+/**
+ * Deterministic, URL-safe id for a project path: the sanitized basename plus a
+ * short hash of the full path, so two repos named alike still get distinct ids.
+ * Pure; same path always yields the same id.
+ */
+export function projectId(path) {
+    // djb2, rendered as base36: short, stable, URL-safe. Not cryptographic.
+    let hash = 5381;
+    for (let i = 0; i < path.length; i++) {
+        hash = ((hash * 33) ^ path.charCodeAt(i)) >>> 0;
+    }
+    const name = basename(path)
+        .toLowerCase()
+        .replace(/[^a-z0-9-]/g, '-');
+    return `${name}-${hash.toString(36)}`;
+}
+/**
+ * The registry file path, resolved from `env` (injectable so tests never touch
+ * the real home): `$XDG_CONFIG_HOME/the-framework.json` when set, else the
+ * dotted `$HOME/.the-framework.json`. A single file, not a directory (#390).
+ */
+export function registryPath(env) {
+    if (env.XDG_CONFIG_HOME)
+        return join(env.XDG_CONFIG_HOME, REGISTRY_FILE);
+    return join(env.HOME ?? '', '.' + REGISTRY_FILE);
+}
+/** A {@link RegistryFs} backed by `node:fs/promises`. See {@link nodeFs}. */
+export function nodeRegistryFs() {
+    const { read, write, mkdir, rename, chmod } = nodeFs();
+    return { read, write, mkdir, rename, chmod };
+}
+/** True when `value` is a well-formed {@link ProjectRecord}. */
+function isRecord(value) {
+    if (typeof value !== 'object' || value === null)
+        return false;
+    const record = value;
+    return typeof record.id === 'string' && typeof record.path === 'string' && typeof record.addedAt === 'string';
+}
+/** Keep well-formed records, deduped by resolved path (first wins). */
+function dedupeProjects(values) {
+    const seen = new Set();
+    const projects = [];
+    for (const value of values) {
+        if (!isRecord(value))
+            continue;
+        const key = resolve(value.path);
+        if (seen.has(key))
+            continue;
+        seen.add(key);
+        projects.push(value);
+    }
+    return projects;
+}
+/**
+ * Every boolean preference, as a `Record` over {@link BooleanPreferenceKey} so the compiler
+ * enforces completeness in both directions (#944): a typo fails as an unknown property, and
+ * omitting a newly added boolean preference fails as a missing one. A plain `as const` array
+ * only caught the first — an omission made {@link sanitizePreferences} silently drop the new
+ * preference on every save, the write-then-vanish failure shape for a settings file.
+ */
+const BOOLEAN_PREFERENCES = {
+    notifyBrowser: true,
+    notifyNewActivity: true,
+    notifyHumanIntervention: true,
+    bridge: true,
+    bridgeBrowser: true,
+    onboardingDismissed: true,
+    postMergeCleanup: true,
+};
+const PREFERENCE_KEYS = Object.keys(BOOLEAN_PREFERENCES);
+/** Keep only the known preference fields, so a hand-edited or browser-supplied
+ * object never lands junk (or the wrong type) in the user's home file. */
+/** The color themes the dashboard offers (#725); anything else means the default `system`. */
+const KNOWN_THEMES = ['system', 'light', 'dark'];
+function sanitizePreferences(value) {
+    if (typeof value !== 'object' || value === null)
+        return {};
+    const input = value;
+    const preferences = {};
+    for (const key of PREFERENCE_KEYS) {
+        if (typeof input[key] === 'boolean')
+            preferences[key] = input[key];
+    }
+    // `model` (#628) is a free-form string preference; the rest are booleans. A blank string is "no
+    // choice", same as absent, so it is dropped rather than persisted. So is the literal word
+    // "Default": that was a picker *label* whose stored value was empty (#1143), and a file carrying
+    // it as the value — hand-edited, or written by a build that mistook the two — would otherwise be
+    // handed to the CLI as `--model Default` and fail the turn on a word nobody chose.
+    const model = typeof input['model'] === 'string' ? input['model'].trim() : '';
+    if (model && model.toLowerCase() !== 'default')
+        preferences.model = model;
+    // `driver` (#650) is constrained to the known set so junk never reaches the agent; the set is the
+    // shared node-free vocabulary (driver-names.ts).
+    if (isDriverName(input['driver']))
+        preferences.driver = input['driver'];
+    // `publish` is constrained to the picks the launcher's menu lists.
+    if (isPublishPick(input['publish']))
+        preferences.publish = input['publish'];
+    const startFrom = sanitizeStartFrom(input['startFrom']);
+    if (Object.keys(startFrom).length)
+        preferences.startFrom = startFrom;
+    // `editor` (#727) is a free-form CLI name, trimmed and length-capped so junk / a huge string
+    // never lands in the file. A blank string is "no choice" (fall back to env / `code`), so dropped.
+    if (typeof input['editor'] === 'string' && input['editor'].trim())
+        preferences.editor = input['editor'].trim().slice(0, 100);
+    // `theme` (#725) is constrained to the known set; anything else (incl. absent) means the default
+    // `system`, so it is simply dropped rather than persisted.
+    if (typeof input['theme'] === 'string' && KNOWN_THEMES.includes(input['theme']))
+        preferences.theme = input['theme'];
+    const customPresets = sanitizeCustomPresets(input['customPresets']);
+    if (customPresets.length)
+        preferences.customPresets = customPresets;
+    return preferences;
+}
+/**
+ * Keep only the projects set to start from the local branch: a map from a project's id to the one
+ * word `local`. Any other value is dropped (the main branch is the absent entry), and the map is
+ * capped at {@link START_FROM_LIMIT} projects. An id is not checked against the project list: a
+ * project removed and added again has the same id, and its pick with it.
+ */
+function sanitizeStartFrom(value) {
+    if (typeof value !== 'object' || value === null || Array.isArray(value))
+        return {};
+    const ids = Object.entries(value).filter(([id, from]) => id !== '' && from === 'local').map(([id]) => id);
+    return Object.fromEntries(ids.slice(0, START_FROM_LIMIT).map(id => [id, 'local']));
+}
+/**
+ * Keep only well-formed custom presets (#626): each needs a non-empty id, label, and prompt;
+ * label/prompt are trimmed and length-capped, the list capped at {@link CUSTOM_PRESET_LIMITS.count},
+ * and duplicate ids dropped. A malformed entry is skipped, not thrown — a bad registry never breaks the read.
+ */
+export function sanitizeCustomPresets(value) {
+    if (!Array.isArray(value))
+        return [];
+    const out = [];
+    const seen = new Set();
+    for (const raw of value) {
+        if (out.length >= CUSTOM_PRESET_LIMITS.count)
+            break;
+        if (typeof raw !== 'object' || raw === null)
+            continue;
+        const { id, label, prompt } = raw;
+        if (typeof id !== 'string' || typeof label !== 'string' || typeof prompt !== 'string')
+            continue;
+        const trimmedId = id.trim();
+        const trimmedLabel = label.trim().slice(0, CUSTOM_PRESET_LIMITS.label);
+        const trimmedPrompt = prompt.trim().slice(0, CUSTOM_PRESET_LIMITS.prompt);
+        if (!trimmedId || !trimmedLabel || !trimmedPrompt || seen.has(trimmedId))
+            continue;
+        seen.add(trimmedId);
+        out.push({ id: trimmedId, label: trimmedLabel, prompt: trimmedPrompt });
+    }
+    return out;
+}
+/**
+ * Read the whole registry. Forgiving: a missing / unreadable / malformed file — or one in a shape
+ * this no longer writes — yields an empty registry, never throws. Projects are deduped by resolved
+ * path and unknown preference fields are dropped.
+ */
+export async function readRegistry(fs = nodeRegistryFs(), env = process.env) {
+    const empty = { projects: [], preferences: {} };
+    let parsed;
+    try {
+        parsed = JSON.parse(await fs.read(registryPath(env)));
+    }
+    catch {
+        return empty;
+    }
+    if (typeof parsed !== 'object' || parsed === null || Array.isArray(parsed))
+        return empty;
+    const obj = parsed;
+    const projects = Array.isArray(obj.projects) ? dedupeProjects(obj.projects) : [];
+    return {
+        projects,
+        preferences: sanitizePreferences(obj.preferences),
+        // #1051: kept only as a non-empty string, so a hand-edited registry can't smuggle a junk token.
+        ...(typeof obj.daemonToken === 'string' && obj.daemonToken ? { daemonToken: obj.daemonToken } : {}),
+    };
+}
+/**
+ * Write the registry back as pretty object-form JSON, creating the parent dir.
+ *
+ * Atomic (#991): the JSON goes to a temp file beside the real one and is then renamed over it,
+ * the same shape #922 gave the daemon state file. A direct write truncates first, so a crash, a
+ * kill or a full disk mid-write left a half file — and {@link readRegistry} reports a malformed
+ * file as an empty registry, so every project and preference vanished silently. A failed write
+ * now only ever damages the temp file. The temp is left behind on failure rather than swept up:
+ * one stray file is the cheaper half of that trade.
+ *
+ * Written owner-only (#1095): the file carries the daemon token, so a default-umask 0644 in a
+ * shared home would hand it to every other account on the machine.
+ * The mode is set on the temp file, before the rename — narrowing after it would leave a window
+ * where the real path is readable. Best-effort: a filesystem with no permission bits still writes.
+ */
+async function writeRegistry(registry, fs, env) {
+    const file = registryPath(env);
+    const { projects, preferences, daemonToken } = registry;
+    const contents = {
+        projects,
+        preferences,
+        ...(daemonToken ? { daemonToken } : {}),
+    };
+    const json = JSON.stringify(contents, null, 2);
+    await fs.mkdir(dirname(file));
+    const restrict = (path) => fs.chmod?.(path, REGISTRY_FILE_MODE).catch(() => { });
+    if (!fs.rename) {
+        await fs.write(file, json);
+        await restrict(file);
+        return;
+    }
+    const temp = `${file}.${process.pid}.tmp`;
+    await fs.write(temp, json);
+    await restrict(temp);
+    await fs.rename(temp, file);
+}
+/**
+ * Serializes the read-modify-write mutators below (#991). Each reads the whole registry, edits it
+ * and writes it back, and one daemon runs several concurrently: `daemon.ts` and `daemon-runtime.ts`
+ * both call {@link addProject} while the dashboard's savePreferences RPC writes through
+ * {@link registryPreferencesStore}. Interleaved, the later write was computed from a read taken
+ * before the earlier one landed, so it silently dropped it. One tail promise for the module, not
+ * one per file: the writes are small, and the registry is a single file per machine anyway.
+ */
+let mutations = Promise.resolve();
+function serialize(mutate) {
+    const result = mutations.then(mutate);
+    // A rejected mutation must not poison the queue, and must not surface as an unhandled rejection
+    // here — the caller still gets `result`, which carries the error.
+    mutations = result.then(() => { }, () => { });
+    return result;
+}
+/**
+ * Read the registry's project list. Forgiving: a missing / unreadable / malformed
+ * file yields `[]`, never throws. Deduped by resolved path, first wins.
+ */
+export async function listProjects(fs = nodeRegistryFs(), env = process.env) {
+    return (await readRegistry(fs, env)).projects;
+}
+/**
+ * Register a project. Idempotent by resolved path: when the path is already
+ * registered, the existing record is returned untouched (addedAt survives);
+ * otherwise the new record is appended and the file written back (preferences preserved).
+ */
+export async function addProject(path, addedAt, fs = nodeRegistryFs(), env = process.env) {
+    return serialize(async () => {
+        const absolute = resolve(path);
+        const registry = await readRegistry(fs, env);
+        const existing = registry.projects.find(project => resolve(project.path) === absolute);
+        if (existing)
+            return existing;
+        const record = { id: projectId(absolute), path: absolute, addedAt };
+        registry.projects.push(record);
+        await writeRegistry(registry, fs, env);
+        return record;
+    });
+}
+/** The user's dashboard preferences (#410), or `{}` when none are stored. */
+export async function readPreferences(fs = nodeRegistryFs(), env = process.env) {
+    return (await readRegistry(fs, env)).preferences;
+}
+/** Persist the dashboard preferences (#410), sanitized, preserving the project list. */
+export async function writePreferences(preferences, fs = nodeRegistryFs(), env = process.env) {
+    return serialize(async () => {
+        const registry = await readRegistry(fs, env);
+        await writeRegistry({ ...registry, preferences: sanitizePreferences(preferences) }, fs, env);
+    });
+}
+/**
+ * Merge `patch` over the stored preferences (#1148) and return the result.
+ *
+ * The counterpart to {@link writePreferences}, which replaces the whole block: a client that
+ * sends its entire snapshot replays every value it happens to hold, so a dashboard tab opened
+ * before someone else's change silently reverted it on the tab's next write, whatever key that
+ * write was actually about. Sending only the changed keys makes a write touch only what it names.
+ *
+ * Clearing needs no sentinel: {@link sanitizePreferences} already drops blank strings and empty
+ * lists, so `{ editor: '' }` merges in as blank and comes out absent, which is how the dashboard
+ * clears the editor today.
+ */
+export async function patchPreferences(patch, fs = nodeRegistryFs(), env = process.env) {
+    return serialize(async () => {
+        const registry = await readRegistry(fs, env);
+        const preferences = sanitizePreferences({ ...registry.preferences, ...patch });
+        await writeRegistry({ ...registry, preferences }, fs, env);
+        return preferences;
+    });
+}
+/**
+ * The shared daemon token (#1051): read the persisted one, or generate + persist it now. Called
+ * only on a non-loopback bind, so a loopback-only machine never grows one. Serialized with the
+ * other mutators so two concurrent binds can't each write a different token. `base64url` of 32
+ * random bytes: URL-safe, so it drops straight into a `?token=` without encoding.
+ */
+export async function ensureDaemonToken(fs = nodeRegistryFs(), env = process.env) {
+    return serialize(async () => {
+        const registry = await readRegistry(fs, env);
+        if (registry.daemonToken)
+            return registry.daemonToken;
+        const daemonToken = randomBytes(32).toString('base64url');
+        await writeRegistry({ ...registry, daemonToken }, fs, env);
+        return daemonToken;
+    });
+}
+/** The persisted daemon token (#1051), or `undefined` when none exists. A pure read, so a process
+ * that only prints the reachable URL never generates one. */
+export async function readDaemonToken(fs = nodeRegistryFs(), env = process.env) {
+    return (await readRegistry(fs, env)).daemonToken;
+}
+/** A {@link PreferencesStore} bound to the real registry file, wired by the daemon so the
+ * dashboard's preferences RPCs read/write the user's home file.
+ *
+ * `onChange` is handed **the keys the caller wrote**, not the merged result, so a listener can
+ * tell "this write switched the setting on" from "it was already on and something else changed"
+ * (#1161). It runs after the write has landed, and its failure is swallowed: the save succeeded,
+ * and a listener must not be able to report otherwise: a setting saved in the browser has to
+ * reach the daemon's own services without a restart.
+ */
+export function registryPreferencesStore(fs = nodeRegistryFs(), env = process.env, onChange) {
+    const changed = (written, result) => {
+        try {
+            onChange?.(written);
+        }
+        catch {
+            // The write landed; a listener that throws is not the writer's problem.
+        }
+        return result;
+    };
+    return {
+        read: () => readPreferences(fs, env),
+        save: async (preferences) => changed(preferences, await writePreferences(preferences, fs, env)),
+        patch: async (patch) => changed(patch, await patchPreferences(patch, fs, env)),
+    };
+}
+//# sourceMappingURL=registry.js.map

package/dist/registry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"registry.js","sourceRoot":"","sources":["../src/registry.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AAC5D,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AACzC,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAA;AAChD,OAAO,EAAE,aAAa,EAAoB,MAAM,qBAAqB,CAAA;AACrE,OAAO,EAAE,MAAM,EAAE,MAAM,cAAc,CAAA;AAwCrC;qEACqE;AACrE,MAAM,oBAAoB,GAAG,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,EAAW,CAAA;AAE9E,sEAAsE;AACtE,MAAM,gBAAgB,GAAG,GAAG,CAAA;AA4F5B,6FAA6F;AAC7F,MAAM,CAAC,MAAM,aAAa,GAAG,oBAAoB,CAAA;AAEjD,sEAAsE;AACtE,MAAM,CAAC,MAAM,kBAAkB,GAAG,KAAK,CAAA;AAEvC;;;;GAIG;AACH,MAAM,UAAU,SAAS,CAAC,IAAY;IACpC,wEAAwE;IACxE,IAAI,IAAI,GAAG,IAAI,CAAA;IACf,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,IAAI,GAAG,CAAC,CAAC,IAAI,GAAG,EAAE,CAAC,GAAG,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAA;IACjD,CAAC;IACD,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC;SACxB,WAAW,EAAE;SACb,OAAO,CAAC,aAAa,EAAE,GAAG,CAAC,CAAA;IAC9B,OAAO,GAAG,IAAI,IAAI,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,EAAE,CAAA;AACvC,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,YAAY,CAAC,GAAsB;IACjD,IAAI,GAAG,CAAC,eAAe;QAAE,OAAO,IAAI,CAAC,GAAG,CAAC,eAAe,EAAE,aAAa,CAAC,CAAA;IACxE,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,EAAE,GAAG,GAAG,aAAa,CAAC,CAAA;AAClD,CAAC;AAuBD,6EAA6E;AAC7E,MAAM,UAAU,cAAc;IAC5B,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,EAAE,CAAA;IACtD,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,CAAA;AAC9C,CAAC;AAED,gEAAgE;AAChE,SAAS,QAAQ,CAAC,KAAc;IAC9B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,KAAK,CAAA;IAC7D,MAAM,MAAM,GAAG,KAAgC,CAAA;IAC/C,OAAO,OAAO,MAAM,CAAC,EAAE,KAAK,QAAQ,IAAI,OAAO,MAAM,CAAC,IAAI,KAAK,QAAQ,IAAI,OAAO,MAAM,CAAC,OAAO,KAAK,QAAQ,CAAA;AAC/G,CAAC;AAED,uEAAuE;AACvE,SAAS,cAAc,CAAC,MAAiB;IACvC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAA;IAC9B,MAAM,QAAQ,GAAoB,EAAE,CAAA;IACpC,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;YAAE,SAAQ;QAC9B,MAAM,GAAG,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;QAC/B,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,SAAQ;QAC3B,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;QACb,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IACtB,CAAC;IACD,OAAO,QAAQ,CAAA;AACjB,CAAC;AAOD;;;;;;GAMG;AACH,MAAM,mBAAmB,GAAuC;IAC9D,aAAa,EAAE,IAAI;IACnB,iBAAiB,EAAE,IAAI;IACvB,uBAAuB,EAAE,IAAI;IAC7B,MAAM,EAAE,IAAI;IACZ,aAAa,EAAE,IAAI;IACnB,mBAAmB,EAAE,IAAI;IACzB,gBAAgB,EAAE,IAAI;CACvB,CAAA;AAED,MAAM,eAAe,GAAG,MAAM,CAAC,IAAI,CAAC,mBAAmB,CAA2B,CAAA;AAElF;0EAC0E;AAC1E,8FAA8F;AAC9F,MAAM,YAAY,GAAG,CAAC,QAAQ,EAAE,OAAO,EAAE,MAAM,CAAU,CAAA;AAEzD,SAAS,mBAAmB,CAAC,KAAc;IACzC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,EAAE,CAAA;IAC1D,MAAM,KAAK,GAAG,KAAgC,CAAA;IAC9C,MAAM,WAAW,GAAgB,EAAE,CAAA;IACnC,KAAK,MAAM,GAAG,IAAI,eAAe,EAAE,CAAC;QAClC,IAAI,OAAO,KAAK,CAAC,GAAG,CAAC,KAAK,SAAS;YAAE,WAAW,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,GAAG,CAAY,CAAA;IAC/E,CAAC;IACD,gGAAgG;IAChG,0FAA0F;IAC1F,iGAAiG;IACjG,iGAAiG;IACjG,mFAAmF;IACnF,MAAM,KAAK,GAAG,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAA;IAC7E,IAAI,KAAK,IAAI,KAAK,CAAC,WAAW,EAAE,KAAK,SAAS;QAAE,WAAW,CAAC,KAAK,GAAG,KAAK,CAAA;IACzE,kGAAkG;IAClG,iDAAiD;IACjD,IAAI,YAAY,CAAC,KAAK,CAAC,QAAQ,CAAuB,CAAC;QAAE,WAAW,CAAC,MAAM,GAAG,KAAK,CAAC,QAAQ,CAAW,CAAA;IACvG,mEAAmE;IACnE,IAAI,aAAa,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QAAE,WAAW,CAAC,OAAO,GAAG,KAAK,CAAC,SAAS,CAAC,CAAA;IAC3E,MAAM,SAAS,GAAG,iBAAiB,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAA;IACvD,IAAI,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,MAAM;QAAE,WAAW,CAAC,SAAS,GAAG,SAAS,CAAA;IACpE,6FAA6F;IAC7F,kGAAkG;IAClG,IAAI,OAAO,KAAK,CAAC,QAAQ,CAAC,KAAK,QAAQ,IAAI,KAAK,CAAC,QAAQ,CAAC,CAAC,IAAI,EAAE;QAC/D,WAAW,CAAC,MAAM,GAAG,KAAK,CAAC,QAAQ,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAA;IAC3D,iGAAiG;IACjG,2DAA2D;IAC3D,IAAI,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAK,YAAkC,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACpG,WAAW,CAAC,KAAK,GAAG,KAAK,CAAC,OAAO,CAAkC,CAAA;IACrE,MAAM,aAAa,GAAG,qBAAqB,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC,CAAA;IACnE,IAAI,aAAa,CAAC,MAAM;QAAE,WAAW,CAAC,aAAa,GAAG,aAAa,CAAA;IACnE,OAAO,WAAW,CAAA;AACpB,CAAC;AAED;;;;;GAKG;AACH,SAAS,iBAAiB,CAAC,KAAc;IACvC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,EAAE,CAAA;IAClF,MAAM,GAAG,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,EAAE,KAAK,EAAE,IAAI,IAAI,KAAK,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,CAAA;IACzG,OAAO,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,gBAAgB,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,OAAgB,CAAC,CAAC,CAAC,CAAA;AAC7F,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,qBAAqB,CAAC,KAAc;IAClD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,EAAE,CAAA;IACpC,MAAM,GAAG,GAAmB,EAAE,CAAA;IAC9B,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAA;IAC9B,KAAK,MAAM,GAAG,IAAI,KAAK,EAAE,CAAC;QACxB,IAAI,GAAG,CAAC,MAAM,IAAI,oBAAoB,CAAC,KAAK;YAAE,MAAK;QACnD,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI;YAAE,SAAQ;QACrD,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,GAA8B,CAAA;QAC5D,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAO,MAAM,KAAK,QAAQ;YAAE,SAAQ;QAC/F,MAAM,SAAS,GAAG,EAAE,CAAC,IAAI,EAAE,CAAA;QAC3B,MAAM,YAAY,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,oBAAoB,CAAC,KAAK,CAAC,CAAA;QACtE,MAAM,aAAa,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,oBAAoB,CAAC,MAAM,CAAC,CAAA;QACzE,IAAI,CAAC,SAAS,IAAI,CAAC,YAAY,IAAI,CAAC,aAAa,IAAI,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC;YAAE,SAAQ;QAClF,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,CAAA;QACnB,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,YAAY,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC,CAAA;IACzE,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,EAAE,GAAe,cAAc,EAAE,EACjC,GAAG,GAAsB,OAAO,CAAC,GAAG;IAEpC,MAAM,KAAK,GAAa,EAAE,QAAQ,EAAE,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,CAAA;IACzD,IAAI,MAAe,CAAA;IACnB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,CAAA;IACvD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAA;IACd,CAAC;IACD,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;QAAE,OAAO,KAAK,CAAA;IACxF,MAAM,GAAG,GAAG,MAAiC,CAAA;IAC7C,MAAM,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;IAChF,OAAO;QACL,QAAQ;QACR,WAAW,EAAE,mBAAmB,CAAC,GAAG,CAAC,WAAW,CAAC;QACjD,gGAAgG;QAChG,GAAG,CAAC,OAAO,GAAG,CAAC,WAAW,KAAK,QAAQ,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACpG,CAAA;AACH,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,KAAK,UAAU,aAAa,CAAC,QAAkB,EAAE,EAAc,EAAE,GAAsB;IACrF,MAAM,IAAI,GAAG,YAAY,CAAC,GAAG,CAAC,CAAA;IAC9B,MAAM,EAAE,QAAQ,EAAE,WAAW,EAAE,WAAW,EAAE,GAAG,QAAQ,CAAA;IACvD,MAAM,QAAQ,GAAG;QACf,QAAQ;QACR,WAAW;QACX,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACxC,CAAA;IACD,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,CAAA;IAC9C,MAAM,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAA;IAC7B,MAAM,QAAQ,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,kBAAkB,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAA;IACvF,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC;QACf,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,IAAI,CAAC,CAAA;QAC1B,MAAM,QAAQ,CAAC,IAAI,CAAC,CAAA;QACpB,OAAM;IACR,CAAC;IACD,MAAM,IAAI,GAAG,GAAG,IAAI,IAAI,OAAO,CAAC,GAAG,MAAM,CAAA;IACzC,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,IAAI,CAAC,CAAA;IAC1B,MAAM,QAAQ,CAAC,IAAI,CAAC,CAAA;IACpB,MAAM,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,CAAA;AAC7B,CAAC;AAED;;;;;;;GAOG;AACH,IAAI,SAAS,GAAkB,OAAO,CAAC,OAAO,EAAE,CAAA;AAEhD,SAAS,SAAS,CAAI,MAAwB;IAC5C,MAAM,MAAM,GAAG,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;IACrC,gGAAgG;IAChG,kEAAkE;IAClE,SAAS,GAAG,MAAM,CAAC,IAAI,CACrB,GAAG,EAAE,GAAE,CAAC,EACR,GAAG,EAAE,GAAE,CAAC,CACT,CAAA;IACD,OAAO,MAAM,CAAA;AACf,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,EAAE,GAAe,cAAc,EAAE,EACjC,GAAG,GAAsB,OAAO,CAAC,GAAG;IAEpC,OAAO,CAAC,MAAM,YAAY,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAA;AAC/C,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,IAAY,EACZ,OAAe,EACf,EAAE,GAAe,cAAc,EAAE,EACjC,GAAG,GAAsB,OAAO,CAAC,GAAG;IAEpC,OAAO,SAAS,CAAC,KAAK,IAAI,EAAE;QAC1B,MAAM,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;QAC9B,MAAM,QAAQ,GAAG,MAAM,YAAY,CAAC,EAAE,EAAE,GAAG,CAAC,CAAA;QAC5C,MAAM,QAAQ,GAAG,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,QAAQ,CAAC,CAAA;QACtF,IAAI,QAAQ;YAAE,OAAO,QAAQ,CAAA;QAE7B,MAAM,MAAM,GAAkB,EAAE,EAAE,EAAE,SAAS,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAA;QAClF,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;QAC9B,MAAM,aAAa,CAAC,QAAQ,EAAE,EAAE,EAAE,GAAG,CAAC,CAAA;QACtC,OAAO,MAAM,CAAA;IACf,CAAC,CAAC,CAAA;AACJ,CAAC;AAED,6EAA6E;AAC7E,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,EAAE,GAAe,cAAc,EAAE,EACjC,GAAG,GAAsB,OAAO,CAAC,GAAG;IAEpC,OAAO,CAAC,MAAM,YAAY,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC,CAAC,WAAW,CAAA;AAClD,CAAC;AAED,wFAAwF;AACxF,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,WAAwB,EACxB,EAAE,GAAe,cAAc,EAAE,EACjC,GAAG,GAAsB,OAAO,CAAC,GAAG;IAEpC,OAAO,SAAS,CAAC,KAAK,IAAI,EAAE;QAC1B,MAAM,QAAQ,GAAG,MAAM,YAAY,CAAC,EAAE,EAAE,GAAG,CAAC,CAAA;QAC5C,MAAM,aAAa,CAAC,EAAE,GAAG,QAAQ,EAAE,WAAW,EAAE,mBAAmB,CAAC,WAAW,CAAC,EAAE,EAAE,EAAE,EAAE,GAAG,CAAC,CAAA;IAC9F,CAAC,CAAC,CAAA;AACJ,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,KAAkB,EAClB,EAAE,GAAe,cAAc,EAAE,EACjC,GAAG,GAAsB,OAAO,CAAC,GAAG;IAEpC,OAAO,SAAS,CAAC,KAAK,IAAI,EAAE;QAC1B,MAAM,QAAQ,GAAG,MAAM,YAAY,CAAC,EAAE,EAAE,GAAG,CAAC,CAAA;QAC5C,MAAM,WAAW,GAAG,mBAAmB,CAAC,EAAE,GAAG,QAAQ,CAAC,WAAW,EAAE,GAAG,KAAK,EAAE,CAAC,CAAA;QAC9E,MAAM,aAAa,CAAC,EAAE,GAAG,QAAQ,EAAE,WAAW,EAAE,EAAE,EAAE,EAAE,GAAG,CAAC,CAAA;QAC1D,OAAO,WAAW,CAAA;IACpB,CAAC,CAAC,CAAA;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,EAAE,GAAe,cAAc,EAAE,EACjC,GAAG,GAAsB,OAAO,CAAC,GAAG;IAEpC,OAAO,SAAS,CAAC,KAAK,IAAI,EAAE;QAC1B,MAAM,QAAQ,GAAG,MAAM,YAAY,CAAC,EAAE,EAAE,GAAG,CAAC,CAAA;QAC5C,IAAI,QAAQ,CAAC,WAAW;YAAE,OAAO,QAAQ,CAAC,WAAW,CAAA;QACrD,MAAM,WAAW,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAA;QACzD,MAAM,aAAa,CAAC,EAAE,GAAG,QAAQ,EAAE,WAAW,EAAE,EAAE,EAAE,EAAE,GAAG,CAAC,CAAA;QAC1D,OAAO,WAAW,CAAA;IACpB,CAAC,CAAC,CAAA;AACJ,CAAC;AAED;6DAC6D;AAC7D,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,EAAE,GAAe,cAAc,EAAE,EACjC,GAAG,GAAsB,OAAO,CAAC,GAAG;IAEpC,OAAO,CAAC,MAAM,YAAY,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC,CAAC,WAAW,CAAA;AAClD,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,wBAAwB,CACtC,EAAE,GAAe,cAAc,EAAE,EACjC,GAAG,GAAsB,OAAO,CAAC,GAAG,EACpC,QAAyC;IAEzC,MAAM,OAAO,GAAG,CAAI,OAAoB,EAAE,MAAS,EAAK,EAAE;QACxD,IAAI,CAAC;YACH,QAAQ,EAAE,CAAC,OAAO,CAAC,CAAA;QACrB,CAAC;QAAC,MAAM,CAAC;YACP,wEAAwE;QAC1E,CAAC;QACD,OAAO,MAAM,CAAA;IACf,CAAC,CAAA;IACD,OAAO;QACL,IAAI,EAAE,GAAG,EAAE,CAAC,eAAe,CAAC,EAAE,EAAE,GAAG,CAAC;QACpC,IAAI,EAAE,KAAK,EAAC,WAAW,EAAC,EAAE,CAAC,OAAO,CAAC,WAAW,EAAE,MAAM,gBAAgB,CAAC,WAAW,EAAE,EAAE,EAAE,GAAG,CAAC,CAAC;QAC7F,KAAK,EAAE,KAAK,EAAC,KAAK,EAAC,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,gBAAgB,CAAC,KAAK,EAAE,EAAE,EAAE,GAAG,CAAC,CAAC;KAC7E,CAAA;AACH,CAAC"}

package/dist/relay.d.ts

@@ -0,0 +1,84 @@
+import type { FrameworkEvent } from './events.js';
+/**
+ * The hosted run relay (#230): the first slice toward shared team sessions. It
+ * ingests a run's {@link FrameworkEvent} stream over HTTP and re-serves the same new
+ * dashboard (#405) to N remote browsers, keyed by run id. So two people on different
+ * machines open one run URL and both watch it live.
+ *
+ * It serves the prerendered dashboard SPA and streams events over Telefunc, exactly
+ * like the daemon — except the run comes from the relay's own in-memory stream (fed by
+ * publishers over HTTP), not a file. The dashboard opens in a read-only, single-run
+ * "watch" mode (no Projects/Runs/Docs rails, no Stop/Start), and only the live event
+ * stream is exposed: an empty projects provider (#426) makes the file/registry-backed
+ * RPCs return nothing on this public host.
+ *
+ * Deliberately unauthenticated: anyone with a run's URL can watch it. Accounts, teams,
+ * RBAC, and authorized steering layer on later (via vike-auth/-rbac). The relay only
+ * projects the stream — it never runs an agent.
+ *
+ * Endpoints:
+ * - `POST /r/:id/publish` — ingest one event (JSON object) or a batch (JSON array)
+ * - `GET  /?run=:id`      — the dashboard SPA in read-only watch mode for that run
+ * - `GET  /r/:id[/]`      — redirects to `/?run=:id` (the viewer URL)
+ * - `POST /_telefunc`     — the dashboard's Telefunc surface (only `onEvents` is live)
+ * - `GET  /assets/…`      — the SPA's static assets
+ * - `GET  /healthz`       — liveness probe for the host
+ */
+export interface RelayOptions {
+    /** Port to bind. Default `4488`; pass `0` for an ephemeral port. */
+    port?: number;
+    /**
+     * Host to bind. Default `0.0.0.0` — the relay exists to be reached from other
+     * machines. Bind `127.0.0.1` to keep it local (e.g. tests).
+     */
+    host?: string;
+    /** Page title. Default `"The Framework"`. */
+    title?: string;
+    /** Max bytes accepted per publish request body. Default 256 KiB. */
+    maxBodyBytes?: number;
+    /**
+     * Max concurrent runs kept in memory. The relay is unauthenticated, so any
+     * request to `/r/<id>/…` would otherwise create a run that never frees — an
+     * anonymous caller could exhaust memory. On overflow the least-recently-touched
+     * run is evicted (its stream closed, its viewers dropped). Default 200.
+     */
+    maxRuns?: number;
+    /**
+     * The prerendered dashboard bundle to serve (the SPA `index.html` + `assets/**`).
+     * Defaults to {@link resolveDashboardBundle}; pass a directory to override (tests).
+     * When no bundle is found, the SPA routes 404 while publish/telefunc/healthz still work.
+     */
+    clientBundleDir?: string;
+}
+/** A running relay. Ingest events programmatically or over HTTP; browsers watch by run id. */
+export interface Relay {
+    /** The base URL of the relay (e.g. `http://0.0.0.0:4488`). */
+    readonly url: string;
+    /** The viewer URL for a run id (`<url>/?run=<id>`). */
+    viewerUrl(runId: string): string;
+    /** Push one event into a run's stream, creating the run on first use. */
+    ingest(runId: string, event: FrameworkEvent): void;
+    /** The run ids seen so far. */
+    runIds(): string[];
+    /** Close every stream and stop the server. Idempotent. */
+    close(): Promise<void>;
+}
+/** Start the hosted run relay. See {@link Relay}. */
+export declare function startRelay(opts?: RelayOptions): Promise<Relay>;
+/** A publisher that forwards a run's events to a relay. Best-effort and ordered. */
+export interface RelayPublisher {
+    /** The viewer URL to share (`<base>/?run=<id>`). */
+    readonly url: string;
+    /** Queue one event to POST to the relay (serialized, so the relay replays in order). */
+    publish(event: FrameworkEvent): void;
+    /** Resolve once every queued POST has been sent (or failed), for a clean shutdown. */
+    flush(): Promise<void>;
+}
+/**
+ * Forward a live run's {@link FrameworkEvent}s to a {@link startRelay} relay so
+ * remote browsers can watch it. POSTs are serialized (chained) so the relay's
+ * replay order matches the run, and best-effort: a failed POST is reported via
+ * `onError` but never interrupts the run.
+ */
+export declare function relayPublisher(base: string, runId: string, onError?: (err: unknown) => void, timeoutMs?: number): RelayPublisher;
+//# sourceMappingURL=relay.d.ts.map

package/dist/relay.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"relay.d.ts","sourceRoot":"","sources":["../src/relay.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,aAAa,CAAA;AAOjD;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,WAAW,YAAY;IAC3B,oEAAoE;IACpE,IAAI,CAAC,EAAE,MAAM,CAAA;IACb;;;OAGG;IACH,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,6CAA6C;IAC7C,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,oEAAoE;IACpE,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB;;;;;OAKG;IACH,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB;;;;OAIG;IACH,eAAe,CAAC,EAAE,MAAM,CAAA;CACzB;AAED,8FAA8F;AAC9F,MAAM,WAAW,KAAK;IACpB,8DAA8D;IAC9D,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;IACpB,uDAAuD;IACvD,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAAA;IAChC,yEAAyE;IACzE,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,cAAc,GAAG,IAAI,CAAA;IAClD,+BAA+B;IAC/B,MAAM,IAAI,MAAM,EAAE,CAAA;IAClB,0DAA0D;IAC1D,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAA;CACvB;AAQD,qDAAqD;AACrD,wBAAsB,UAAU,CAAC,IAAI,GAAE,YAAiB,GAAG,OAAO,CAAC,KAAK,CAAC,CAmDxE;AA0GD,oFAAoF;AACpF,MAAM,WAAW,cAAc;IAC7B,oDAAoD;IACpD,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;IACpB,wFAAwF;IACxF,OAAO,CAAC,KAAK,EAAE,cAAc,GAAG,IAAI,CAAA;IACpC,sFAAsF;IACtF,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAA;CACvB;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAC5B,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,MAAM,EACb,OAAO,CAAC,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,IAAI,EAChC,SAAS,SAAS,GACjB,cAAc,CA8BhB"}

package/dist/relay.js

@@ -0,0 +1,199 @@
+import { createServer } from 'node:http';
+import { EventStream } from '@gemstack/ai-autopilot';
+import { resolveDashboardBundle } from './dashboard/bundle.js';
+import { serveClientBundle } from './dashboard/static.js';
+import { makeTelefuncMount } from './dashboard/telefunc-serve.js';
+import { requestPathname } from './request-path.js';
+import { emptyProjectsProvider } from './dashboard/projects.js';
+const RUN_PATH = /^\/r\/([^/]+)(\/[^?]*)?/;
+/** Start the hosted run relay. See {@link Relay}. */
+export async function startRelay(opts = {}) {
+    const host = opts.host ?? '0.0.0.0';
+    const port = opts.port ?? 4488;
+    const maxBody = opts.maxBodyBytes ?? 256 * 1024;
+    const maxRuns = opts.maxRuns ?? 200;
+    const clientBundleDir = opts.clientBundleDir ?? (await resolveDashboardBundle());
+    // Insertion-ordered as an LRU: touching a run re-inserts it at the end, so the
+    // first entry is always the least-recently-used and the eviction victim.
+    const runs = new Map();
+    const run = (id) => {
+        const existing = runs.get(id);
+        if (existing) {
+            runs.delete(id);
+            runs.set(id, existing); // touch: move to most-recently-used
+            return existing;
+        }
+        // Bound memory: evict the least-recently-used run before creating a new one.
+        while (runs.size >= maxRuns) {
+            const oldest = runs.keys().next().value;
+            if (oldest === undefined)
+                break;
+            runs.get(oldest).stream.close(); // closing drains every viewer's Channel follower
+            runs.delete(oldest);
+        }
+        const r = { stream: new EventStream() };
+        runs.set(id, r);
+        return r;
+    };
+    // The dashboard's Telefunc surface, mounted like the daemon's — but `onEvents` streams
+    // the relay's own in-memory run (create-on-access, so a viewer can connect before the
+    // publisher), and an empty projects provider neutralizes every file/registry RPC on
+    // this public host. No `startRun`, so a start is never enabled here.
+    const telefunc = makeTelefuncMount({ projects: emptyProjectsProvider(), eventsSource: id => run(id).stream });
+    const server = createServer((req, res) => handle(req, res, { run, maxBody, clientBundleDir, telefunc }));
+    return new Promise((resolvePromise, rejectPromise) => {
+        server.once('error', rejectPromise);
+        server.listen(port, host, () => {
+            server.removeListener('error', rejectPromise);
+            const address = server.address();
+            const url = `http://${host}:${address.port}`;
+            resolvePromise({
+                url,
+                viewerUrl: id => `${url}/?run=${encodeURIComponent(id)}`,
+                ingest: (id, event) => run(id).stream.push(event),
+                runIds: () => [...runs.keys()],
+                close: () => closeRelay(server, runs),
+            });
+        });
+    });
+}
+function handle(req, res, ctx) {
+    // A public server: a request no URL parser accepts must get a 400, not crash the relay (#938).
+    const pathname = requestPathname(req);
+    if (pathname === undefined) {
+        res.writeHead(400, { 'content-type': 'text/plain' });
+        res.end('bad request');
+        return;
+    }
+    if (pathname === '/healthz') {
+        res.writeHead(200, { 'content-type': 'text/plain' });
+        res.end('ok');
+        return;
+    }
+    // The dashboard's live event stream (and the rest of its RPC surface, neutralized).
+    if (pathname === '/_telefunc' || pathname.startsWith('/_telefunc/')) {
+        void ctx.telefunc(req, res);
+        return;
+    }
+    const m = RUN_PATH.exec(pathname);
+    if (m) {
+        // A malformed escape in the id segment (`/r/%zz/`) must not throw out of the handler (#938).
+        let id;
+        try {
+            id = decodeURIComponent(m[1]);
+        }
+        catch {
+            res.writeHead(400, { 'content-type': 'text/plain' });
+            res.end('bad request');
+            return;
+        }
+        const rest = m[2] ?? '';
+        // Ingest is the one thing still under /r/:id/ — the publisher POSTs a run's events here.
+        if (rest === '/publish') {
+            if (req.method !== 'POST') {
+                res.writeHead(405, { 'content-type': 'text/plain', allow: 'POST' });
+                res.end('method not allowed');
+                return;
+            }
+            ingestBody(req, res, ctx.run(id), ctx.maxBody);
+            return;
+        }
+        // Any viewer GET of a run moved to the SPA at `/?run=:id`; redirect old links there.
+        res.writeHead(302, { location: `/?run=${encodeURIComponent(id)}` });
+        res.end();
+        return;
+    }
+    // Everything else is the dashboard SPA (`/`, `/?run=:id`, `/assets/**`, SPA fallback).
+    if (ctx.clientBundleDir) {
+        void serveClientBundle(req, res, ctx.clientBundleDir);
+        return;
+    }
+    res.writeHead(404, { 'content-type': 'text/plain' });
+    res.end('dashboard bundle not built');
+}
+/** Read a JSON body (one event or an array) and push each event into the run's stream. */
+function ingestBody(req, res, r, maxBody) {
+    // Collect raw bytes and decode once at the end: a per-chunk `String(chunk)` corrupts a
+    // multibyte UTF-8 codepoint split across two chunks, and the cap is in bytes, not the
+    // UTF-16 code units a string length would count.
+    const chunks = [];
+    let bytes = 0;
+    let tooBig = false;
+    req.on('data', (chunk) => {
+        if (tooBig)
+            return;
+        bytes += chunk.length;
+        if (bytes > maxBody) {
+            tooBig = true;
+            res.writeHead(413, { 'content-type': 'text/plain' });
+            res.end('payload too large');
+            req.destroy();
+            return;
+        }
+        chunks.push(chunk);
+    });
+    req.on('end', () => {
+        if (tooBig)
+            return;
+        let parsed;
+        try {
+            parsed = JSON.parse(Buffer.concat(chunks).toString('utf8'));
+        }
+        catch {
+            res.writeHead(400, { 'content-type': 'text/plain' });
+            res.end('invalid json');
+            return;
+        }
+        const events = (Array.isArray(parsed) ? parsed : [parsed]);
+        for (const event of events)
+            r.stream.push(event);
+        res.writeHead(202, { 'content-type': 'application/json' });
+        res.end(`{"ok":true,"received":${events.length}}`);
+    });
+}
+function closeRelay(server, runs) {
+    for (const { stream } of runs.values())
+        stream.close(); // closing drains each Channel follower
+    runs.clear();
+    return new Promise(resolvePromise => server.close(() => resolvePromise()));
+}
+/**
+ * Forward a live run's {@link FrameworkEvent}s to a {@link startRelay} relay so
+ * remote browsers can watch it. POSTs are serialized (chained) so the relay's
+ * replay order matches the run, and best-effort: a failed POST is reported via
+ * `onError` but never interrupts the run.
+ */
+export function relayPublisher(base, runId, onError, timeoutMs = 10_000) {
+    const origin = base.replace(/\/+$/, '');
+    const root = `${origin}/r/${encodeURIComponent(runId)}`;
+    let chain = Promise.resolve();
+    return {
+        // Share the SPA viewer URL; events still POST to the ingest route under /r/:id/.
+        url: `${origin}/?run=${encodeURIComponent(runId)}`,
+        publish(event) {
+            chain = chain.then(async () => {
+                try {
+                    // Timeout so a relay that accepts but never responds can't wedge flush()
+                    // (awaited on shutdown) and hang the whole CLI on exit.
+                    const res = await fetch(`${root}/publish`, {
+                        method: 'POST',
+                        headers: { 'content-type': 'application/json' },
+                        body: JSON.stringify(event),
+                        signal: AbortSignal.timeout(timeoutMs),
+                    });
+                    // fetch only throws on a transport failure, so a rejected event (413 over
+                    // the body cap, 400, or a URL that isn't a relay) would otherwise be silent.
+                    if (!res.ok)
+                        throw new Error(`relay answered ${res.status} ${res.statusText}`.trimEnd());
+                }
+                catch (err) {
+                    onError?.(err);
+                }
+            });
+        },
+        flush() {
+            return chain;
+        },
+    };
+}
+//# sourceMappingURL=relay.js.map