@pasko70/pibo 1.9.7 → 1.9.9

package/dist/web/http.js

@@ -1,195 +0,0 @@
-import { gzipSync } from "node:zlib";
-export const MAX_WEB_REQUEST_BODY_BYTES = 4 * 1024 * 1024;
-const MIN_COMPRESS_RESPONSE_BYTES = 1024;
-const MAX_SYNC_GZIP_RESPONSE_BYTES = 64 * 1024;
-const INTERNAL_SOCKET_PEER_HEADER = "x-pibo-socket-peer";
-export class PiboWebHttpError extends Error {
-    statusCode;
-    constructor(message, statusCode) {
-        super(message);
-        this.statusCode = statusCode;
-        this.name = "PiboWebHttpError";
-    }
-}
-export function responseJson(payload, init = {}) {
-    const startedAt = performance.now();
-    const body = JSON.stringify(payload);
-    const serializeMs = performance.now() - startedAt;
-    const headers = new Headers(init.headers);
-    headers.set("content-type", "application/json; charset=utf-8");
-    headers.set("x-pibo-response-bytes", String(Buffer.byteLength(body, "utf8")));
-    headers.set("server-timing", appendServerTiming(headers.get("server-timing"), `json_serialize;dur=${serializeMs.toFixed(1)}`));
-    return new Response(body, {
-        ...init,
-        headers,
-    });
-}
-export function responseHtml(html, init = {}) {
-    return new Response(html, {
-        ...init,
-        headers: {
-            "content-type": "text/html; charset=utf-8",
-            ...init.headers,
-        },
-    });
-}
-export async function readJsonBody(request) {
-    try {
-        const body = await request.json();
-        if (!body || typeof body !== "object")
-            throw new PiboWebHttpError("Invalid JSON body", 400);
-        return body;
-    }
-    catch {
-        throw new PiboWebHttpError("Invalid JSON body", 400);
-    }
-}
-export async function nodeRequestToWebRequest(request, baseURL) {
-    const url = new URL(request.url ?? "/", baseURL);
-    const headers = new Headers();
-    for (const [key, value] of Object.entries(request.headers)) {
-        if (Array.isArray(value)) {
-            for (const entry of value)
-                headers.append(key, entry);
-        }
-        else if (value !== undefined) {
-            headers.set(key, value);
-        }
-    }
-    let body;
-    if (request.method !== "GET" && request.method !== "HEAD") {
-        const chunks = [];
-        let receivedBytes = 0;
-        for await (const chunk of request) {
-            const buffer = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
-            receivedBytes += buffer.length;
-            if (receivedBytes > MAX_WEB_REQUEST_BODY_BYTES) {
-                throw new PiboWebHttpError("Request body too large", 413);
-            }
-            chunks.push(buffer);
-        }
-        body = Buffer.concat(chunks);
-    }
-    return new Request(url, {
-        method: request.method,
-        headers,
-        body,
-    });
-}
-export async function sendWebResponse(response, webResponse) {
-    const headers = responseHeaders(webResponse);
-    const compressEncoding = preferredResponseEncoding(response.req?.headers["accept-encoding"], webResponse);
-    if (compressEncoding && webResponse.body) {
-        const body = await readResponseBody(webResponse);
-        if (body.length >= MIN_COMPRESS_RESPONSE_BYTES && body.length <= MAX_SYNC_GZIP_RESPONSE_BYTES) {
-            const compressionStartedAt = performance.now();
-            const compressed = gzipSync(body, { level: 1 });
-            appendServerTimingHeader(headers, `response_compress;dur=${(performance.now() - compressionStartedAt).toFixed(1)}`);
-            headers["content-encoding"] = compressEncoding;
-            headers["content-length"] = String(compressed.length);
-            headers.vary = appendVary(headers.vary, "accept-encoding");
-            response.writeHead(webResponse.status, headers);
-            response.end(compressed);
-            return;
-        }
-        if (body.length > MAX_SYNC_GZIP_RESPONSE_BYTES) {
-            headers["x-pibo-compression-skipped"] = "sync-gzip-size-limit";
-        }
-        response.writeHead(webResponse.status, headers);
-        response.end(body);
-        return;
-    }
-    response.writeHead(webResponse.status, headers);
-    if (!webResponse.body) {
-        response.end();
-        return;
-    }
-    const reader = webResponse.body.getReader();
-    const cancel = () => {
-        void reader.cancel();
-    };
-    response.once("close", cancel);
-    try {
-        while (true) {
-            const { done, value } = await reader.read();
-            if (done)
-                break;
-            response.write(Buffer.from(value));
-        }
-        response.end();
-    }
-    finally {
-        response.off("close", cancel);
-    }
-}
-function appendServerTimingHeader(headers, value) {
-    const existing = headers["server-timing"];
-    headers["server-timing"] = appendServerTiming(Array.isArray(existing) ? existing.join(", ") : existing ?? null, value);
-}
-function responseHeaders(webResponse) {
-    const headers = {};
-    const setCookie = webResponse.headers.getSetCookie?.();
-    webResponse.headers.forEach((value, key) => {
-        if (key.toLowerCase() === "set-cookie")
-            return;
-        if (key.toLowerCase() === INTERNAL_SOCKET_PEER_HEADER)
-            return;
-        headers[key] = value;
-    });
-    if (setCookie?.length) {
-        headers["set-cookie"] = setCookie;
-    }
-    else {
-        const setCookieHeader = webResponse.headers.get("set-cookie");
-        if (setCookieHeader)
-            headers["set-cookie"] = setCookieHeader;
-    }
-    return headers;
-}
-function preferredResponseEncoding(acceptEncoding, webResponse) {
-    if (!responseCanBeCompressed(webResponse))
-        return undefined;
-    return acceptsEncoding(acceptEncoding, "gzip") ? "gzip" : undefined;
-}
-function acceptsEncoding(acceptEncoding, encoding) {
-    const accepted = Array.isArray(acceptEncoding) ? acceptEncoding.join(",") : acceptEncoding ?? "";
-    return accepted.split(",").some((entry) => {
-        const [name, ...parameters] = entry.trim().split(";").map((part) => part.trim());
-        if (name !== encoding && name !== "*")
-            return false;
-        const q = parameters.find((parameter) => parameter.toLowerCase().startsWith("q="));
-        if (!q)
-            return true;
-        const weight = Number(q.slice(2));
-        return Number.isFinite(weight) && weight > 0;
-    });
-}
-function responseCanBeCompressed(webResponse) {
-    if (webResponse.status === 204 || webResponse.status === 304)
-        return false;
-    if (webResponse.headers.has("content-encoding"))
-        return false;
-    const contentType = webResponse.headers.get("content-type") ?? "";
-    return /^application\/json\b/.test(contentType);
-}
-async function readResponseBody(webResponse) {
-    const chunks = [];
-    const reader = webResponse.body.getReader();
-    while (true) {
-        const { done, value } = await reader.read();
-        if (done)
-            break;
-        chunks.push(Buffer.from(value));
-    }
-    return Buffer.concat(chunks);
-}
-function appendVary(existing, value) {
-    const values = Array.isArray(existing) ? existing.flatMap((item) => item.split(",")) : (existing ?? "").split(",");
-    const normalized = values.map((item) => item.trim()).filter(Boolean);
-    if (!normalized.some((item) => item.toLowerCase() === value.toLowerCase()))
-        normalized.push(value);
-    return normalized.join(", ");
-}
-function appendServerTiming(existing, value) {
-    return existing ? `${existing}, ${value}` : value;
-}

package/dist/web/types.js

@@ -1 +0,0 @@
-export {};

package/dist/web-annotations/api.js

@@ -1,348 +0,0 @@
-import { randomBytes } from "node:crypto";
-import { PiboWebHttpError, readJsonBody, responseJson } from "../web/http.js";
-import { buildWebAnnotationOverlayScript, createWebAnnotationCdpService } from "./cdp.js";
-import { serializeWebAnnotationAttachment } from "./attachments.js";
-import { createDefaultWebAnnotationStore } from "./store.js";
-import { isWebAnnotationStatus, isWebAnnotationTargetKind } from "./types.js";
-import { assertWebAnnotationStatusTransition, normalizeWebAnnotationLimit, normalizeWebAnnotationScreenshotRef, normalizeWebAnnotationTarget, normalizeWebAnnotationViewport, requireWebAnnotationText, sanitizeWebAnnotationText, WEB_ANNOTATION_LIMITS, } from "./validation.js";
-export const WEB_ANNOTATIONS_API_PREFIX = "/api/web-annotations";
-export const WEB_ANNOTATIONS_APP_MOUNT = "/apps/web-annotations";
-let defaultStore;
-function getDefaultStore() {
-    defaultStore ??= createDefaultWebAnnotationStore();
-    return defaultStore;
-}
-function createSameOriginBinding(store, request, context, body) {
-    const bindingToken = randomBytes(24).toString("base64url");
-    const binding = store.createBinding({
-        ...context,
-        url: normalizeSameOriginBindingUrl(request, body.url),
-        title: optionalBodyString(body.title, WEB_ANNOTATION_LIMITS.title),
-        state: "active",
-        metadata: { source: "same-origin", overlaySubmissionToken: bindingToken },
-    });
-    return {
-        binding,
-        overlay: {
-            bindingId: binding.id,
-            bindingToken,
-            piboSessionId: binding.piboSessionId,
-            annotationShortcut: optionalBodyString(body.annotationShortcut, 80, false),
-        },
-    };
-}
-export function createWebAnnotationsWebApp(options = {}) {
-    const store = options.store ?? getDefaultStore();
-    const baseService = options.cdpService ?? createWebAnnotationCdpService({ store });
-    return {
-        name: "web-annotations",
-        mountPath: WEB_ANNOTATIONS_APP_MOUNT,
-        apiPrefix: WEB_ANNOTATIONS_API_PREFIX,
-        async handleRequest(request, context) {
-            const url = new URL(request.url);
-            if (url.pathname === `${WEB_ANNOTATIONS_APP_MOUNT}/overlay.js` && request.method === "GET") {
-                return responseJavaScript(buildWebAnnotationOverlayScript(), { headers: { "cache-control": "no-store" } });
-            }
-            if (url.pathname === WEB_ANNOTATIONS_APP_MOUNT && request.method === "GET") {
-                return responseJson({ ok: true, apiPrefix: WEB_ANNOTATIONS_API_PREFIX });
-            }
-            if (!url.pathname.startsWith(WEB_ANNOTATIONS_API_PREFIX))
-                return undefined;
-            try {
-                if (url.pathname === `${WEB_ANNOTATIONS_API_PREFIX}/submissions` && request.method === "OPTIONS") {
-                    return corsResponse(null, { status: 204 });
-                }
-                if (url.pathname === `${WEB_ANNOTATIONS_API_PREFIX}/submissions` && request.method === "POST") {
-                    const annotation = await handleOverlaySubmission(store, request);
-                    return corsJson({ ok: true, annotation }, { status: 201 });
-                }
-                const webSession = await context.requireSession({ request });
-                if (url.pathname === `${WEB_ANNOTATIONS_API_PREFIX}/targets` && request.method === "GET") {
-                    const service = serviceForRequest(baseService, url.searchParams.get("cdpUrl") ?? undefined, request, store, options);
-                    const targets = await service.listTargets();
-                    return responseJson({ ok: true, targets });
-                }
-                if (url.pathname === `${WEB_ANNOTATIONS_API_PREFIX}/bindings` && request.method === "GET") {
-                    const piboSessionId = requireQueryParam(url, "piboSessionId");
-                    const bindingContext = resolveBindingContext(context, webSession, { piboSessionId });
-                    const bindings = baseService.listBindings(bindingContext, parseLimit(url.searchParams.get("limit")));
-                    return responseJson({ ok: true, bindings });
-                }
-                if (url.pathname === `${WEB_ANNOTATIONS_API_PREFIX}/bindings` && request.method === "POST") {
-                    requireSameOriginJsonRequest(request);
-                    const body = await readJsonBody(request);
-                    const bindingContext = resolveBindingContext(context, webSession, body);
-                    const service = serviceForRequest(baseService, body.cdpUrl, request, store, options);
-                    if (body.url) {
-                        if (body.sameOrigin) {
-                            const result = createSameOriginBinding(store, request, bindingContext, body);
-                            return responseJson({ ok: true, ...result }, { status: 201 });
-                        }
-                        const result = await service.createUrlBinding({ ...bindingContext, url: body.url });
-                        return responseJson({ ok: true, ...result }, { status: 201 });
-                    }
-                    if (body.targetId) {
-                        const result = await service.createTargetBinding({ ...bindingContext, targetId: body.targetId });
-                        return responseJson({ ok: true, ...result }, { status: 201 });
-                    }
-                    throw new PiboWebHttpError("url or targetId is required", 400);
-                }
-                if (url.pathname === WEB_ANNOTATIONS_API_PREFIX && request.method === "GET") {
-                    const piboSessionId = requireQueryParam(url, "piboSessionId", "sessionId");
-                    const bindingContext = resolveBindingContext(context, webSession, { piboSessionId });
-                    const status = optionalStatus(url.searchParams.get("status"));
-                    const scope = url.searchParams.get("scope") === "app" || url.searchParams.get("allSessions") === "true" ? "app" : "session";
-                    const annotations = store.listAnnotations({
-                        ...(scope === "session" ? { piboSessionId: bindingContext.piboSessionId } : {}),
-                        status,
-                        limit: parseLimit(url.searchParams.get("limit")),
-                    }).map(serializeWebAnnotationAttachment);
-                    return responseJson({ ok: true, annotations, scope });
-                }
-                const annotationResource = matchAnnotationResource(url.pathname);
-                if (annotationResource) {
-                    if (request.method === "GET") {
-                        const piboSessionId = requireQueryParam(url, "piboSessionId", "sessionId");
-                        const bindingContext = resolveBindingContext(context, webSession, { piboSessionId });
-                        const annotation = store.getAnnotation(bindingContext.piboSessionId, annotationResource.id);
-                        if (!annotation)
-                            throw new PiboWebHttpError("Web Annotation was not found", 404);
-                        return responseJson({ ok: true, annotation });
-                    }
-                    if (request.method === "PATCH") {
-                        requireSameOriginJsonRequest(request);
-                        const body = await readJsonBody(request);
-                        const bindingContext = resolveBindingContext(context, webSession, body);
-                        const status = optionalStatus(body.status);
-                        const existing = store.getAnnotation(bindingContext.piboSessionId, annotationResource.id);
-                        if (!existing)
-                            throw new PiboWebHttpError("Web Annotation was not found", 404);
-                        try {
-                            assertWebAnnotationStatusTransition(existing.status, status);
-                        }
-                        catch (error) {
-                            throw new PiboWebHttpError(error instanceof Error ? error.message : String(error), 400);
-                        }
-                        const annotation = store.patchAnnotation(bindingContext.piboSessionId, annotationResource.id, {
-                            ...(status ? { status } : {}),
-                            ...(body.summary !== undefined ? { summary: body.summary } : {}),
-                        });
-                        if (!annotation)
-                            throw new PiboWebHttpError("Web Annotation was not found", 404);
-                        return responseJson({ ok: true, annotation: serializeWebAnnotationAttachment(annotation) });
-                    }
-                }
-                const bindingResource = matchBindingResource(url.pathname);
-                if (bindingResource) {
-                    if (request.method === "POST" && (bindingResource.action === "inject" || bindingResource.action === "reinject")) {
-                        requireSameOriginJsonRequest(request);
-                        const body = await readJsonBody(request);
-                        const bindingContext = resolveBindingContext(context, webSession, body);
-                        const service = serviceForRequest(baseService, body.cdpUrl, request, store, options);
-                        const result = await service.injectBinding(bindingContext, bindingResource.id, { annotationShortcut: optionalBodyString(body.annotationShortcut, 80, false) });
-                        return responseJson({ ok: true, ...result });
-                    }
-                    if (request.method === "POST" && bindingResource.action === "stop") {
-                        requireSameOriginJsonRequest(request);
-                        const body = await readJsonBody(request);
-                        const bindingContext = resolveBindingContext(context, webSession, body);
-                        const service = serviceForRequest(baseService, body.cdpUrl, request, store, options);
-                        const result = await service.stopBinding(bindingContext, bindingResource.id);
-                        return responseJson({ ok: true, ...result });
-                    }
-                    if (request.method === "DELETE" && !bindingResource.action) {
-                        requireSameOriginRequest(request);
-                        const piboSessionId = requireQueryParam(url, "piboSessionId");
-                        const bindingContext = resolveBindingContext(context, webSession, { piboSessionId });
-                        return responseJson({ ok: true, removed: baseService.removeBinding(bindingContext, bindingResource.id) });
-                    }
-                }
-                return undefined;
-            }
-            catch (error) {
-                if (error instanceof PiboWebHttpError)
-                    throw error;
-                const message = error instanceof Error ? error.message : String(error);
-                throw new PiboWebHttpError(message, 400);
-            }
-        },
-    };
-}
-async function handleOverlaySubmission(store, request) {
-    const contentType = request.headers.get("content-type")?.split(";")[0]?.trim().toLowerCase();
-    if (contentType !== "application/json")
-        throw new PiboWebHttpError("Content-Type must be application/json", 415);
-    const body = await readJsonBody(request);
-    const bindingId = requireBodyString(body.bindingId, "bindingId", WEB_ANNOTATION_LIMITS.id, false);
-    const bindingToken = requireBodyString(body.bindingToken, "bindingToken", WEB_ANNOTATION_LIMITS.bindingToken, false);
-    const binding = store.getBindingById(bindingId);
-    if (!binding)
-        throw new PiboWebHttpError("Web Annotation binding was not found", 404);
-    if (binding.state === "removed")
-        throw new PiboWebHttpError("Web Annotation binding was removed", 404);
-    if (binding.metadata?.overlaySubmissionToken !== bindingToken)
-        throw new PiboWebHttpError("Invalid Web Annotation binding token", 403);
-    const note = requireBodyString(body.note, "note", WEB_ANNOTATION_LIMITS.note);
-    const targetKind = requireTargetKind(body.targetKind);
-    const viewport = normalizeViewport(body.viewport);
-    return store.createAnnotation({
-        piboSessionId: binding.piboSessionId,
-        piboRoomId: binding.piboRoomId,
-        bindingId: binding.id,
-        note,
-        url: optionalBodyString(body.url, WEB_ANNOTATION_LIMITS.url, false) ?? binding.url,
-        title: optionalBodyString(body.title, WEB_ANNOTATION_LIMITS.title) ?? binding.title,
-        targetId: binding.targetId,
-        targetKind,
-        viewport,
-        target: normalizeTarget(body.target, targetKind),
-        screenshotRef: normalizeWebAnnotationScreenshotRef(body.screenshotRef),
-    });
-}
-function requireBodyString(value, field, max, redactSecrets = true) {
-    try {
-        return requireWebAnnotationText(value, { field, max, redactSecrets });
-    }
-    catch (error) {
-        throw new PiboWebHttpError(error instanceof Error ? error.message : String(error), 400);
-    }
-}
-function optionalBodyString(value, max, redactSecrets = true) {
-    try {
-        return sanitizeWebAnnotationText(value, { field: "field", max, redactSecrets });
-    }
-    catch (error) {
-        throw new PiboWebHttpError(error instanceof Error ? error.message : String(error), 400);
-    }
-}
-function normalizeSameOriginBindingUrl(request, value) {
-    const raw = requireBodyString(value, "url", WEB_ANNOTATION_LIMITS.url, false);
-    const requestOrigin = new URL(request.url).origin;
-    let parsed;
-    try {
-        parsed = new URL(raw, requestOrigin);
-    }
-    catch {
-        throw new PiboWebHttpError("url must be a valid URL", 400);
-    }
-    if (parsed.origin !== requestOrigin)
-        throw new PiboWebHttpError("same-origin annotations require a URL on this Pibo web origin", 400);
-    return parsed.href;
-}
-function requireTargetKind(value) {
-    if (!value || !isWebAnnotationTargetKind(value))
-        throw new PiboWebHttpError("Invalid annotation target kind", 400);
-    return value;
-}
-function normalizeViewport(value) {
-    if (!value || typeof value.width !== "number" || typeof value.height !== "number")
-        throw new PiboWebHttpError("viewport width and height are required", 400);
-    try {
-        return normalizeWebAnnotationViewport(value);
-    }
-    catch (error) {
-        throw new PiboWebHttpError(error instanceof Error ? error.message : String(error), 400);
-    }
-}
-function normalizeTarget(value, targetKind) {
-    if (value === undefined)
-        return { kind: targetKind };
-    if (!value || typeof value !== "object" || Array.isArray(value))
-        throw new PiboWebHttpError("target must be an object", 400);
-    try {
-        return normalizeWebAnnotationTarget({ ...value, kind: targetKind }, targetKind);
-    }
-    catch (error) {
-        throw new PiboWebHttpError(error instanceof Error ? error.message : String(error), 400);
-    }
-}
-function responseJavaScript(source, init = {}) {
-    return new Response(source, {
-        ...init,
-        headers: {
-            "content-type": "text/javascript; charset=utf-8",
-            ...init.headers,
-        },
-    });
-}
-function corsJson(payload, init = {}) {
-    return responseJson(payload, { ...init, headers: corsHeaders(init.headers) });
-}
-function corsResponse(body, init = {}) {
-    return new Response(body, { ...init, headers: corsHeaders(init.headers) });
-}
-function corsHeaders(existing) {
-    return {
-        "access-control-allow-origin": "*",
-        "access-control-allow-methods": "POST, OPTIONS",
-        "access-control-allow-headers": "content-type",
-        ...Object.fromEntries(new Headers(existing).entries()),
-    };
-}
-function requireSameOriginJsonRequest(request) {
-    const contentType = request.headers.get("content-type")?.split(";")[0]?.trim().toLowerCase();
-    if (contentType !== "application/json")
-        throw new PiboWebHttpError("Content-Type must be application/json", 415);
-    requireSameOriginRequest(request);
-}
-function requireSameOriginRequest(request) {
-    const origin = request.headers.get("origin");
-    if (!origin)
-        throw new PiboWebHttpError("Origin header is required", 403);
-    if (origin !== new URL(request.url).origin)
-        throw new PiboWebHttpError("Origin is not allowed", 403);
-}
-function serviceForRequest(baseService, cdpUrl, request, store, options) {
-    if (options.cdpService)
-        return baseService;
-    return createWebAnnotationCdpService({ store, cdpUrl, apiBaseUrl: new URL(request.url).origin });
-}
-function resolveBindingContext(context, _webSession, input) {
-    const piboSessionId = input.piboSessionId?.trim();
-    if (!piboSessionId)
-        throw new PiboWebHttpError("piboSessionId is required", 400);
-    const session = context.channelContext.getSession(piboSessionId);
-    if (!session)
-        throw new PiboWebHttpError("Pibo session not found", 404);
-    return {
-        piboSessionId,
-        piboRoomId: input.piboRoomId?.trim() || undefined,
-    };
-}
-function requireQueryParam(url, name, fallbackName) {
-    const value = (url.searchParams.get(name) ?? (fallbackName ? url.searchParams.get(fallbackName) : undefined))?.trim();
-    if (!value)
-        throw new PiboWebHttpError(`${name} is required`, 400);
-    return value;
-}
-function optionalStatus(value) {
-    if (!value)
-        return undefined;
-    if (!isWebAnnotationStatus(value))
-        throw new PiboWebHttpError("Invalid annotation status", 400);
-    return value;
-}
-function parseLimit(value) {
-    if (!value)
-        return undefined;
-    const parsed = Number.parseInt(value, 10);
-    return Number.isFinite(parsed) ? normalizeWebAnnotationLimit(parsed, 100, 500) : undefined;
-}
-function matchBindingResource(pathname) {
-    const prefix = `${WEB_ANNOTATIONS_API_PREFIX}/bindings/`;
-    if (!pathname.startsWith(prefix))
-        return undefined;
-    const parts = pathname.slice(prefix.length).split("/").filter(Boolean).map(decodeURIComponent);
-    if (parts.length === 0 || parts.length > 2)
-        return undefined;
-    return { id: parts[0], action: parts[1] };
-}
-function matchAnnotationResource(pathname) {
-    const prefix = `${WEB_ANNOTATIONS_API_PREFIX}/`;
-    if (!pathname.startsWith(prefix) || pathname.startsWith(`${WEB_ANNOTATIONS_API_PREFIX}/bindings/`))
-        return undefined;
-    const parts = pathname.slice(prefix.length).split("/").filter(Boolean).map(decodeURIComponent);
-    if (parts.length !== 1 || parts[0] === "targets" || parts[0] === "submissions" || parts[0] === "bindings")
-        return undefined;
-    return { id: parts[0] };
-}