@opencode/browse 0.0.3-dev.2 → 0.0.6-dev.17

package/dist/main-kvmxefp1.mjs

@@ -0,0 +1,217 @@
+import {
+  isNodeError
+} from "./main-e4stqtf2.mjs";
+import {
+  dataRoot
+} from "./main-g5mke6rn.mjs";
+import {
+  isValidSessionId2
+} from "./main-3qpkwaa7.mjs";
+
+// src/session-journal.ts
+import fs from "node:fs";
+import path from "node:path";
+import { Option, Schema } from "effect";
+var JournalEntry = Schema.Struct({
+  ts: Schema.String,
+  sessionId: Schema.String,
+  code: Schema.String,
+  isError: Schema.Boolean,
+  durationMs: Schema.Number,
+  resultPreview: Schema.String,
+  logCount: Schema.Number,
+  startUrl: Schema.optionalKey(Schema.NullOr(Schema.String)),
+  endUrl: Schema.optionalKey(Schema.NullOr(Schema.String)),
+  navigations: Schema.optionalKey(Schema.Array(Schema.String)),
+  warnings: Schema.optionalKey(Schema.Array(Schema.String)),
+  diagnostic: Schema.optionalKey(Schema.String),
+  handoffs: Schema.optionalKey(Schema.Number)
+});
+var decodeJournalEntry = Schema.decodeUnknownOption(JournalEntry);
+var defaultJournalBaseDir = () => {
+  return path.join(dataRoot(), "sessions");
+};
+function journalPathForSession(baseDir, sessionId) {
+  return path.join(baseDir, sessionId, "journal.jsonl");
+}
+var maxJournalCodeLength = 2000;
+var maxJournalPreviewLength = 400;
+var maxJournalDiagnosticLength = 240;
+function truncateForJournal(text, maxLength) {
+  if (text.length <= maxLength) {
+    return text;
+  }
+  return `${text.slice(0, maxLength)}… [truncated ${text.length - maxLength} chars]`;
+}
+var redacted = "[REDACTED]";
+var sensitiveWord = String.raw`(?:pass(?:word|wd|code|phrase)?|pwd|otp|one[-_ ]?time|2fa|mfa|totp|pin|code|token|secret|api[-_]?key|access[-_]?key|private[-_]?key|auth(?:orization)?|credential|session|cookie|bearer|cvv|cvc|card[-_ ]?number)`;
+var stringLiteral = String.raw`(?:"(?:[^"\\\n]|\\.)*"|'(?:[^'\\\n]|\\.)*'|\`(?:[^\`\\]|\\.)*\`)`;
+var affix = String.raw`{0,64}`;
+var sensitiveAssignment = new RegExp(String.raw`(["'\`]?[\w$-]${affix}${sensitiveWord}[\w$-]${affix}["'\`]?\s*[:=]\s*)${stringLiteral}`, "gi");
+var valueCall = new RegExp(String.raw`(\.(?:fill|type|pressSequentially|setInputValue)\s*\((?:\s*${stringLiteral}\s*,)?\s*|\bfillInput\s*\([^;\n]*?,\s*)${stringLiteral}`, "gi");
+var sensitiveLine = new RegExp(sensitiveWord, "i");
+var valueProperty = new RegExp(String.raw`(\bvalue\s*:\s*)${stringLiteral}`, "gi");
+var sensitiveQuery = new RegExp(String.raw`([?&#][\w.-]${affix}${sensitiveWord}[\w.-]${affix}=)[^&#\s"'\`]+`, "gi");
+var tokenPatterns = [
+  /\beyJ[\w-]{8,}\.[\w-]{8,}\.[\w-]{8,}/g,
+  /\b(?:Bearer|Basic)\s+[\w~+/.=-]{12,}/gi,
+  /\b(?:sk|pk|rk|ghp|gho|ghs|ghu|github_pat|xox[abprs]|glpat|AKIA|ASIA)[-_][\w-]{12,}/g
+];
+function redactJournalText(text) {
+  let output = text.replace(sensitiveAssignment, `$1"${redacted}"`);
+  output = output.split(`
+`).map((line) => {
+    if (!sensitiveLine.test(line))
+      return line;
+    return line.replace(valueCall, `$1"${redacted}"`).replace(valueProperty, `$1"${redacted}"`);
+  }).join(`
+`);
+  output = output.replace(sensitiveQuery, `$1${redacted}`);
+  for (const pattern of tokenPatterns)
+    output = output.replace(pattern, redacted);
+  return output;
+}
+function makeJournalEntry(options) {
+  return {
+    ts: new Date().toISOString(),
+    sessionId: options.sessionId,
+    code: truncateForJournal(redactJournalText(options.code), maxJournalCodeLength),
+    isError: options.isError,
+    durationMs: options.durationMs,
+    resultPreview: truncateForJournal(redactJournalText(options.resultText), maxJournalPreviewLength),
+    logCount: options.logCount,
+    ...options.startUrl === undefined ? {} : { startUrl: redactNullableUrl(options.startUrl) },
+    ...options.endUrl === undefined ? {} : { endUrl: redactNullableUrl(options.endUrl) },
+    ...options.navigations && options.navigations.length > 0 ? { navigations: options.navigations.map(redactJournalText) } : {},
+    ...options.warnings && options.warnings.length > 0 ? { warnings: options.warnings.map(redactJournalText) } : {},
+    ...options.diagnostic ? { diagnostic: truncateForJournal(redactJournalText(options.diagnostic), maxJournalDiagnosticLength) } : {},
+    ...options.handoffs ? { handoffs: options.handoffs } : {}
+  };
+}
+function redactNullableUrl(url) {
+  return url === null ? null : redactJournalText(url);
+}
+async function appendJournalEntry(options) {
+  const filePath = journalPathForSession(options.baseDir, options.entry.sessionId);
+  await fs.promises.mkdir(options.baseDir, { recursive: true, mode: 448 });
+  await fs.promises.chmod(options.baseDir, 448);
+  await fs.promises.mkdir(path.dirname(filePath), { recursive: true, mode: 448 });
+  await fs.promises.chmod(path.dirname(filePath), 448);
+  await fs.promises.appendFile(filePath, `${JSON.stringify(options.entry)}
+`, { encoding: "utf8", mode: 384 });
+  await fs.promises.chmod(filePath, 384);
+}
+var defaultJournalRetentionMs = 14 * 24 * 60 * 60 * 1000;
+var defaultJournalMaxCount = 200;
+async function pruneSessionJournals(options) {
+  const maxAgeMs = options.maxAgeMs ?? defaultJournalRetentionMs;
+  const maxCount = options.maxCount ?? defaultJournalMaxCount;
+  const now = options.now ?? Date.now();
+  let names;
+  try {
+    names = await fs.promises.readdir(options.baseDir);
+  } catch (error) {
+    if (isNodeError(error) && error.code === "ENOENT")
+      return [];
+    throw error;
+  }
+  await fs.promises.chmod(options.baseDir, 448);
+  const candidates = [];
+  for (const id of names) {
+    if (!isValidSessionId2(id))
+      continue;
+    const directory = path.join(options.baseDir, id);
+    const stat = await fs.promises.lstat(directory).catch(() => {
+      return;
+    });
+    if (!stat?.isDirectory())
+      continue;
+    const journal = await fs.promises.lstat(path.join(directory, "journal.jsonl")).catch(() => {
+      return;
+    });
+    candidates.push({ id, directory, modifiedAt: Math.max(stat.mtimeMs, journal?.mtimeMs ?? 0) });
+  }
+  const removed = [];
+  const kept = [];
+  for (const candidate of candidates) {
+    if (!options.isLive(candidate.id) && now - candidate.modifiedAt > maxAgeMs)
+      removed.push(candidate.id);
+    else
+      kept.push(candidate);
+  }
+  const removable = kept.filter((candidate) => !options.isLive(candidate.id)).sort((left, right) => left.modifiedAt - right.modifiedAt);
+  const excess = Math.max(0, kept.length - maxCount);
+  const evicted = new Set(removable.slice(0, excess).map((candidate) => candidate.id));
+  removed.push(...evicted);
+  const removedSet = new Set(removed);
+  for (const candidate of candidates) {
+    if (removedSet.has(candidate.id)) {
+      if (options.isLive(candidate.id)) {
+        removedSet.delete(candidate.id);
+        continue;
+      }
+      await fs.promises.rm(candidate.directory, { recursive: true, force: true });
+    } else {
+      await fs.promises.chmod(candidate.directory, 448).catch(() => {});
+      await fs.promises.chmod(path.join(candidate.directory, "journal.jsonl"), 384).catch(() => {});
+    }
+  }
+  return removed.filter((id) => removedSet.has(id));
+}
+var journalPruneIntervalMs = 6 * 60 * 60 * 1000;
+function startJournalRetention(options) {
+  const prune = () => {
+    pruneSessionJournals(options).catch((error) => options.onError?.(error));
+  };
+  prune();
+  const interval = setInterval(prune, journalPruneIntervalMs);
+  interval.unref();
+  return () => clearInterval(interval);
+}
+async function readJournalEntries(options) {
+  const filePath = journalPathForSession(options.baseDir, options.sessionId);
+  let raw;
+  try {
+    raw = await fs.promises.readFile(filePath, "utf8");
+  } catch (error) {
+    if (isNodeError(error) && error.code === "ENOENT") {
+      return [];
+    }
+    throw error;
+  }
+  return parseJournalLines(raw).slice(-options.limit);
+}
+function parseJournalLines(raw) {
+  const entries = [];
+  for (const line of raw.split(`
+`)) {
+    const trimmed = line.trim();
+    if (!trimmed) {
+      continue;
+    }
+    let parsed;
+    try {
+      parsed = JSON.parse(trimmed);
+    } catch {
+      continue;
+    }
+    const decoded = decodeJournalEntry(parsed);
+    if (Option.isSome(decoded)) {
+      entries.push(decoded.value);
+    }
+  }
+  return entries;
+}
+function formatJournalEntry(entry) {
+  const time = entry.ts.slice(11, 19) || entry.ts;
+  const status = entry.isError ? "ERR" : "ok ";
+  const codePreview = entry.code.replace(/\s+/g, " ").trim().slice(0, 80);
+  const urlPart = entry.endUrl ? ` ${entry.endUrl}` : "";
+  const navPart = entry.navigations && entry.navigations.length > 0 ? ` nav=${entry.navigations.length}` : "";
+  const handoffPart = entry.handoffs ? ` handoffs=${entry.handoffs}` : "";
+  const warningPart = entry.warnings && entry.warnings.length > 0 ? ` warnings=${entry.warnings.length}` : "";
+  const diagnosticPart = entry.diagnostic ? ` diagnostic=${entry.diagnostic}` : "";
+  return `${time} ${status} ${String(entry.durationMs).padStart(5)}ms${urlPart}${navPart}${handoffPart}${warningPart}${diagnosticPart}  ${codePreview}`;
+}
+
+export { defaultJournalBaseDir, makeJournalEntry, appendJournalEntry, startJournalRetention, readJournalEntries, formatJournalEntry };

package/dist/main-y7c1atbf.mjs

@@ -0,0 +1,4 @@
+// src/version.ts
+var opencodeBrowserVersion2 = "0.0.6-dev.17";
+var opencodeBrowserBuildId2 = "2026-11-03T15:29:35.727Z";
+export { opencodeBrowserVersion2, opencodeBrowserBuildId2 };

package/dist/main-zwe0c783.mjs

@@ -0,0 +1,315 @@
+import {
+  ensurePrivateDirectory
+} from "./main-4bht27ry.mjs";
+import {
+  dataRoot,
+  devExtensionUrl,
+  devExtensionFolder
+} from "./main-g5mke6rn.mjs";
+
+// src/browser-pairing.ts
+import crypto from "node:crypto";
+import fs from "node:fs";
+import path from "node:path";
+var legacyContext = "opencode-browser-pairing-v2";
+var context = "opencode-browser-pairing-v3";
+var crockford = "0123456789ABCDEFGHJKMNPQRSTVWXYZ";
+var pairingCodeLength = 8;
+var codeKeyIterations = 1e5;
+var codeKeySalt = `${context}|code`;
+var pairingCodeTtlMs = 10 * 60000;
+var bundledPairingCodeTtlMs = 60 * 60000;
+var maxPairingFailures = 5;
+var maxPendingCodes = 5;
+var extensionPairingFileName = "relay-pairing.json";
+var pairingCodesPath = (root = dataRoot()) => path.join(root, "pairing-codes.json");
+var browserTokensPath = (root = dataRoot()) => path.join(root, "browser-tokens.json");
+var legacyPairingCodePath = (root = dataRoot()) => path.join(root, "extension-pairing");
+function formatPairingCode(code) {
+  return code.match(/.{1,4}/g)?.join("-") ?? code;
+}
+function pairingCodeKey(code) {
+  return crypto.pbkdf2Sync(code, codeKeySalt, codeKeyIterations, 32, "sha256").toString("hex");
+}
+function readPendingCodes(root, now) {
+  try {
+    const value = JSON.parse(fs.readFileSync(pairingCodesPath(root), "utf8"));
+    const codes = Array.isArray(value.codes) ? value.codes.filter((entry) => typeof entry?.key === "string" && /^[0-9a-f]{64}$/.test(entry.key) && typeof entry.expiresAt === "number" && entry.expiresAt >= now) : [];
+    return { codes, failures: typeof value.failures === "number" ? value.failures : 0 };
+  } catch {
+    return { codes: [], failures: 0 };
+  }
+}
+function writePendingCodes(root, pending) {
+  if (pending.codes.length === 0 && pending.failures === 0) {
+    fs.rmSync(pairingCodesPath(root), { force: true });
+    return;
+  }
+  writePrivateJson(pairingCodesPath(root), pending);
+}
+function mintPairingCode(root = dataRoot(), options = {}) {
+  const now = options.now ?? Date.now();
+  const code = Array.from(crypto.randomBytes(pairingCodeLength), (byte) => crockford[byte & 31]).join("");
+  const pending = readPendingCodes(root, now);
+  pending.codes.push({ key: pairingCodeKey(code), expiresAt: now + (options.ttlMs ?? pairingCodeTtlMs), ...options.receipt ? { receipt: options.receipt } : {} });
+  writePendingCodes(root, { codes: pending.codes.slice(-maxPendingCodes), failures: 0 });
+  return code;
+}
+function pendingPairingCodeKeys(root = dataRoot(), now = Date.now()) {
+  return readPendingCodes(root, now).codes.map((entry) => entry.key);
+}
+function consumePairingCode(key, root = dataRoot(), now = Date.now()) {
+  const pending = readPendingCodes(root, now);
+  writePendingCodes(root, { codes: pending.codes.filter((entry) => entry.key !== key), failures: 0 });
+  return pending.codes.find((entry) => entry.key === key)?.receipt;
+}
+function recordPairingFailure(root = dataRoot(), now = Date.now()) {
+  const pending = readPendingCodes(root, now);
+  const failures = pending.failures + 1;
+  const exhausted = failures >= maxPairingFailures;
+  writePendingCodes(root, exhausted ? { codes: [], failures: 0 } : { codes: pending.codes, failures });
+  return exhausted && pending.codes.length > 0;
+}
+function writeExtensionPairing(extensionDirectory, code) {
+  writePrivateJson(path.join(extensionDirectory, extensionPairingFileName), { code });
+}
+function readBrowserPairings(root = dataRoot()) {
+  try {
+    const value = JSON.parse(fs.readFileSync(browserTokensPath(root), "utf8"));
+    if (value === null || typeof value !== "object" || Array.isArray(value))
+      return {};
+    return Object.fromEntries(Object.entries(value).filter(([, entry]) => typeof entry?.token === "string" && /^[A-Za-z0-9_-]{43}$/.test(entry.token)));
+  } catch {
+    return {};
+  }
+}
+function writeBrowserPairings(root, pairings) {
+  ensurePrivateDirectory(root);
+  writePrivateJson(browserTokensPath(root), pairings);
+}
+function browserToken(key, root = dataRoot()) {
+  return readBrowserPairings(root)[key]?.token;
+}
+var newBrowserToken = () => crypto.randomBytes(32).toString("base64url");
+function issueBrowserToken(key, root = dataRoot(), now = Date.now(), token = newBrowserToken(), receipt) {
+  const pairings = readBrowserPairings(root);
+  writeBrowserPairings(root, { ...pairings, [key]: { token, pairedAt: now, ...receipt ? { receipt } : {} } });
+  return token;
+}
+function touchBrowserPairing(key, seen, root = dataRoot(), now = Date.now()) {
+  const pairings = readBrowserPairings(root);
+  const entry = pairings[key];
+  if (!entry)
+    return;
+  writeBrowserPairings(root, { ...pairings, [key]: { ...entry, lastSeen: now, id: seen.id, name: seen.name } });
+}
+function revokeBrowserToken(key, root = dataRoot()) {
+  const pairings = readBrowserPairings(root);
+  if (!(key in pairings))
+    return false;
+  delete pairings[key];
+  writeBrowserPairings(root, pairings);
+  return true;
+}
+function legacyPairingCode(root = dataRoot()) {
+  try {
+    const code = fs.readFileSync(legacyPairingCodePath(root), "utf8").trim();
+    return new RegExp(`^[${crockford}]{32}$`).test(code) ? code : undefined;
+  } catch {
+    return;
+  }
+}
+function removeLegacyPairingCode(root = dataRoot()) {
+  const existed = legacyPairingCode(root) !== undefined;
+  fs.rmSync(legacyPairingCodePath(root), { force: true });
+  return existed;
+}
+function legacyPairingProof(code, role, port, ownNonce, peerNonce) {
+  return crypto.createHmac("sha256", code).update(`${legacyContext}|${role}|${pairingEndpoint(port)}|${peerNonce}|${ownNonce}`).digest("base64url");
+}
+function pairingEndpoint(port) {
+  return `127.0.0.1:${port}/extension`;
+}
+function pairingProof(token, role, port, ownNonce, peerNonce) {
+  return crypto.createHmac("sha256", token).update(`${context}|${role}|${pairingEndpoint(port)}|${peerNonce}|${ownNonce}`).digest("base64url");
+}
+function ecdhExchange(peerPublicKey) {
+  const peer = Buffer.from(peerPublicKey, "base64url");
+  if (peer.length !== 65 || peer[0] !== 4)
+    return;
+  const ecdh = crypto.createECDH("prime256v1");
+  const publicKey = ecdh.generateKeys().toString("base64url");
+  try {
+    return { publicKey, secret: ecdh.computeSecret(peer) };
+  } catch {
+    return;
+  }
+}
+function pairingSessionKey(material, secret, transcript) {
+  return crypto.createHmac("sha256", material).update(`${context}|session|${pairingEndpoint(transcript.port)}|${transcript.extensionNonce}|${transcript.relayNonce}|${transcript.extensionKey}|${transcript.relayKey}|`).update(secret).digest();
+}
+function sessionProof(sessionKey, role) {
+  return crypto.createHmac("sha256", sessionKey).update(`${context}|proof|${role}`).digest("base64url");
+}
+function wrapToken(sessionKey, token) {
+  const mask = crypto.createHmac("sha256", sessionKey).update(`${context}|wrap`).digest();
+  return Buffer.from(Buffer.from(token, "base64url").map((byte, index) => byte ^ mask[index])).toString("base64url");
+}
+function writePrivateJson(file, value) {
+  const temporary = `${file}.${process.pid}.${crypto.randomUUID()}.tmp`;
+  fs.writeFileSync(temporary, `${JSON.stringify(value, null, 2)}
+`, { mode: 384 });
+  fs.renameSync(temporary, file);
+}
+
+// src/dev-extension.ts
+import { createHash } from "node:crypto";
+import { existsSync, mkdirSync, readFileSync, renameSync, rmSync, writeFileSync } from "node:fs";
+import path2 from "node:path";
+import { crc32, inflateRawSync } from "node:zlib";
+var devExtensionRecord = (root = dataRoot()) => path2.join(root, "extension.json");
+function installedDevExtension(root = dataRoot()) {
+  try {
+    const record = JSON.parse(readFileSync(devExtensionRecord(root), "utf8"));
+    return typeof record.sha256 === "string" && existsSync(path2.join(devExtensionFolder(root), "manifest.json")) ? record : undefined;
+  } catch {
+    return;
+  }
+}
+async function syncDevExtension(extension, options = {}) {
+  const root = options.root ?? dataRoot();
+  const folder = devExtensionFolder(root);
+  if (installedDevExtension(root)?.sha256 === extension.sha256)
+    return "current";
+  const url = devExtensionUrl(extension, options.env);
+  const response = await (options.fetch ?? fetch)(url, { signal: AbortSignal.timeout(120000), headers: { "user-agent": "browse/dev" } });
+  if (!response.ok)
+    throw new Error(`downloading the dev extension from ${url} failed: HTTP ${response.status}`);
+  const zip = Buffer.from(await response.arrayBuffer());
+  const sha256 = createHash("sha256").update(zip).digest("hex");
+  if (zip.length !== extension.size || sha256 !== extension.sha256)
+    throw new Error(`the dev extension from ${url} isn't the one this version was built with (sha256 ${sha256}, ${zip.length} bytes)`);
+  mkdirSync(root, { recursive: true });
+  const staging = path2.join(root, `.extension-${process.pid}-${Date.now()}`);
+  const old = `${staging}-old`;
+  rmSync(staging, { recursive: true, force: true });
+  try {
+    for (const entry of unzip(zip)) {
+      const target = path2.join(staging, ...entry.name.split("/"));
+      mkdirSync(path2.dirname(target), { recursive: true });
+      if (!entry.directory)
+        writeFileSync(target, entry.data);
+    }
+    const manifest = JSON.parse(readFileSync(path2.join(staging, "manifest.json"), "utf8"));
+    if (!manifest.key)
+      throw new Error("the dev extension has no manifest key, so it wouldn't have Browse's unpacked ID");
+    writeExtensionPairing(staging, mintPairingCode(root, { ttlMs: bundledPairingCodeTtlMs }));
+    const build = (() => {
+      try {
+        return JSON.parse(readFileSync(path2.join(staging, "build.json"), "utf8")).build;
+      } catch {
+        return;
+      }
+    })();
+    if (existsSync(folder))
+      renameSync(folder, old);
+    renameSync(staging, folder);
+    const version = manifest.version_name ?? manifest.version;
+    const record = { ...version ? { version } : {}, file: extension.file, sha256, ...build ? { build } : {}, installedAt: new Date().toISOString() };
+    writeFileSync(devExtensionRecord(root), JSON.stringify(record, null, 2) + `
+`);
+    return "updated";
+  } finally {
+    rmSync(staging, { recursive: true, force: true });
+    rmSync(old, { recursive: true, force: true });
+  }
+}
+function unzip(zip) {
+  let end = -1;
+  for (let offset = zip.length - 22;offset >= Math.max(0, zip.length - 22 - 65535); offset--)
+    if (zip.readUInt32LE(offset) === 101010256) {
+      end = offset;
+      break;
+    }
+  if (end < 0)
+    throw new Error("not a zip archive");
+  const count = zip.readUInt16LE(end + 10);
+  let offset = zip.readUInt32LE(end + 16);
+  const entries = [];
+  for (let index = 0;index < count; index++) {
+    if (zip.readUInt32LE(offset) !== 33639248)
+      throw new Error("corrupt zip central directory");
+    const method = zip.readUInt16LE(offset + 10);
+    const crc = zip.readUInt32LE(offset + 16);
+    const compressed = zip.readUInt32LE(offset + 20);
+    const size = zip.readUInt32LE(offset + 24);
+    const nameLength = zip.readUInt16LE(offset + 28);
+    const extraLength = zip.readUInt16LE(offset + 30);
+    const commentLength = zip.readUInt16LE(offset + 32);
+    const mode = zip.readUInt32LE(offset + 38) >>> 16;
+    const local = zip.readUInt32LE(offset + 42);
+    const name = zip.toString("utf8", offset + 46, offset + 46 + nameLength);
+    offset += 46 + nameLength + extraLength + commentLength;
+    if (!name || name.startsWith("/") || name.includes("\\") || name.split("/").some((part) => part === ".." || part === "."))
+      throw new Error(`unsafe path in zip: ${JSON.stringify(name)}`);
+    if ((mode & 61440) === 40960)
+      throw new Error(`symbolic link in zip: ${name}`);
+    if (compressed === 4294967295 || size === 4294967295)
+      throw new Error("ZIP64 archives aren't supported");
+    const directory = name.endsWith("/");
+    if (directory) {
+      entries.push({ name: name.slice(0, -1), directory, data: Buffer.alloc(0) });
+      continue;
+    }
+    if (zip.readUInt32LE(local) !== 67324752)
+      throw new Error(`corrupt zip entry ${name}`);
+    const start = local + 30 + zip.readUInt16LE(local + 26) + zip.readUInt16LE(local + 28);
+    const raw = zip.subarray(start, start + compressed);
+    const data = method === 0 ? Buffer.from(raw) : method === 8 ? inflateRawSync(raw) : undefined;
+    if (!data)
+      throw new Error(`unsupported compression method ${method} for ${name}`);
+    if (data.length !== size || crc32(data) !== crc)
+      throw new Error(`zip entry ${name} is corrupt`);
+    entries.push({ name, directory, data });
+  }
+  return entries;
+}
+
+// src/relay-config.ts
+import fs2 from "node:fs";
+import path3 from "node:path";
+var relayConfigPath = (root = dataRoot()) => path3.join(root, "config.json");
+function parseHostname(input) {
+  if (typeof input !== "string")
+    return;
+  const value = input.trim().toLowerCase();
+  if (value === "127.0.0.1" || value === "localhost")
+    return "127.0.0.1";
+  if (value === "0.0.0.0")
+    return "0.0.0.0";
+  return;
+}
+function readRelayConfig(root = dataRoot()) {
+  try {
+    const value = JSON.parse(fs2.readFileSync(relayConfigPath(root), "utf8"));
+    const hostname = parseHostname(value?.hostname);
+    return hostname === undefined ? {} : { hostname };
+  } catch {
+    return {};
+  }
+}
+function writeRelayConfig(config, root = dataRoot()) {
+  fs2.mkdirSync(root, { recursive: true, mode: 448 });
+  const file = relayConfigPath(root);
+  const temporary = `${file}.${process.pid}.tmp`;
+  fs2.writeFileSync(temporary, `${JSON.stringify(config, null, 2)}
+`, { mode: 384 });
+  fs2.renameSync(temporary, file);
+}
+var relayHostname = (root = dataRoot()) => readRelayConfig(root).hostname ?? "127.0.0.1";
+function isLocalPeer(socket) {
+  const remote = socket.remoteAddress?.replace(/^::ffff:/, "");
+  return remote !== undefined && (remote === "::1" || remote.startsWith("127."));
+}
+
+export { context, pairingCodeTtlMs, bundledPairingCodeTtlMs, formatPairingCode, pairingCodeKey, mintPairingCode, pendingPairingCodeKeys, consumePairingCode, recordPairingFailure, writeExtensionPairing, readBrowserPairings, browserToken, newBrowserToken, issueBrowserToken, touchBrowserPairing, revokeBrowserToken, legacyPairingCode, removeLegacyPairingCode, legacyPairingProof, pairingProof, ecdhExchange, pairingSessionKey, sessionProof, wrapToken, installedDevExtension, syncDevExtension, parseHostname, readRelayConfig, writeRelayConfig, relayHostname, isLocalPeer };