@someonegg/codex-hub 0.0.0-stage → 0.1.1

package/dist/server/server/http/create-server.js

@@ -0,0 +1,148 @@
+import { createReadStream, readFileSync, realpathSync } from "node:fs";
+import { realpath, stat } from "node:fs/promises";
+import { createServer as createHttpServer, } from "node:http";
+import { createServer as createHttpsServer } from "node:https";
+import { extname, resolve, sep } from "node:path";
+import { emptyApiRouter, sendJson } from "./router.js";
+import { applySecurityHeaders } from "./security.js";
+const CONTENT_TYPES = {
+    ".css": "text/css; charset=utf-8",
+    ".html": "text/html; charset=utf-8",
+    ".js": "text/javascript; charset=utf-8",
+    ".json": "application/json; charset=utf-8",
+    ".svg": "image/svg+xml",
+};
+function sendText(response, status, message, headOnly) {
+    response.statusCode = status;
+    response.setHeader("Content-Type", "text/plain; charset=utf-8");
+    response.setHeader("Content-Length", Buffer.byteLength(message));
+    response.end(headOnly ? undefined : message);
+}
+async function serveFile(response, filePath, headOnly) {
+    try {
+        const info = await stat(filePath);
+        if (!info.isFile())
+            return false;
+        response.statusCode = 200;
+        response.setHeader("Content-Type", CONTENT_TYPES[extname(filePath)] ?? "application/octet-stream");
+        response.setHeader("Content-Length", info.size);
+        if (headOnly) {
+            response.end();
+        }
+        else {
+            createReadStream(filePath)
+                .on("error", () => response.destroy())
+                .pipe(response);
+        }
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+export function createServer(config, apiRouter = emptyApiRouter, closeServices = () => { }, upgrades) {
+    const clientRoot = realpathSync(config.clientDirectory);
+    const clientRootPrefix = `${clientRoot}${sep}`;
+    const requestListener = async (request, response) => {
+        applySecurityHeaders(response, request);
+        const headOnly = request.method === "HEAD";
+        try {
+            if (await apiRouter(request, response))
+                return;
+            if (request.method !== "GET" && !headOnly) {
+                response.setHeader("Allow", "GET, HEAD");
+                sendJson(response, 405, {
+                    error: { code: "method_not_allowed", message: "Method is not allowed for this resource" },
+                });
+                return;
+            }
+            const url = new URL(request.url ?? "/", "http://localhost");
+            const decodedPath = decodeURIComponent(url.pathname);
+            const sessionPage = /^\/sessions\/[A-Za-z0-9_-]{20,100}\/?$/.test(decodedPath);
+            const relativePath = decodedPath === "/" ? "index.html" : sessionPage ? "index.html" : decodedPath.slice(1);
+            const requestedPath = resolve(clientRoot, relativePath);
+            let canonicalPath;
+            try {
+                canonicalPath = await realpath(requestedPath);
+            }
+            catch {
+                sendText(response, 404, "Not found", headOnly);
+                return;
+            }
+            if (canonicalPath.startsWith(clientRootPrefix) &&
+                (await serveFile(response, canonicalPath, headOnly))) {
+                return;
+            }
+            sendText(response, 404, "Not found", headOnly);
+        }
+        catch {
+            sendJson(response, 400, { error: { code: "bad_request", message: "Malformed request" } }, headOnly);
+        }
+    };
+    if (!config.tls.enabled) {
+        const server = createHttpServer(requestListener);
+        return attachLifecycle(server, closeServices, upgrades);
+    }
+    const requireClientCertificate = config.tls.certificateAuthorityPath !== undefined;
+    const server = createHttpsServer({
+        cert: readFileSync(config.tls.certificatePath),
+        key: readFileSync(config.tls.privateKeyPath),
+        ...(config.tls.certificateAuthorityPath
+            ? { ca: readFileSync(config.tls.certificateAuthorityPath) }
+            : {}),
+        minVersion: "TLSv1.2",
+        requestCert: requireClientCertificate,
+        rejectUnauthorized: requireClientCertificate,
+    }, requestListener);
+    return attachLifecycle(server, closeServices, upgrades);
+}
+/** Own startup cleanup as well as the server's pre-drain shutdown hook. */
+export async function startServer(config, apiRouter, closeServices, upgrades) {
+    try {
+        const server = createServer(config, apiRouter, closeServices, upgrades);
+        await listenServer(server, config.port, config.host);
+        return server;
+    }
+    catch (error) {
+        upgrades?.close();
+        closeServices();
+        throw error;
+    }
+}
+export function listenServer(server, port, host) {
+    return new Promise((resolve, reject) => {
+        const cleanup = () => {
+            server.removeListener("error", onError);
+            server.removeListener("listening", onListening);
+        };
+        const onError = (error) => {
+            cleanup();
+            reject(error);
+        };
+        const onListening = () => {
+            cleanup();
+            resolve();
+        };
+        server.once("error", onError);
+        server.once("listening", onListening);
+        server.listen(port, host);
+    });
+}
+function attachLifecycle(server, closeServices, upgrades) {
+    server.on("upgrade", (request, socket, head) => {
+        if (upgrades)
+            upgrades.handle(request, socket, head);
+        else
+            socket.destroy();
+    });
+    const close = server.close.bind(server);
+    const mutable = server;
+    mutable.close = (callback) => {
+        upgrades?.close();
+        closeServices();
+        close(callback);
+        return server;
+    };
+    return server;
+}
+//# sourceMappingURL=create-server.js.map

package/dist/server/server/http/query-params.js

@@ -0,0 +1,19 @@
+export class HttpQueryError extends Error {
+}
+export function optional(params, name) {
+    const values = params.getAll(name);
+    if (values.length > 1)
+        invalid(`${name} must appear once`);
+    return values[0];
+}
+export function only(params, allowed) {
+    const accepted = new Set(allowed);
+    for (const name of params.keys()) {
+        if (!accepted.has(name))
+            invalid(`${name} is not supported`);
+    }
+}
+export function invalid(message) {
+    throw new HttpQueryError(message);
+}
+//# sourceMappingURL=query-params.js.map

package/dist/server/server/http/request-body.js

@@ -0,0 +1,48 @@
+import { MAX_INTERACTION_MESSAGE_BYTES } from "../../shared/interaction.js";
+const MAX_INTERACTION_JSON_BYTES = MAX_INTERACTION_MESSAGE_BYTES * 6 + 1_024;
+export class RequestBodyError extends Error {
+    status;
+    code;
+    constructor(status, code, message) {
+        super(message);
+        this.status = status;
+        this.code = code;
+    }
+}
+export async function readJsonObject(request) {
+    const contentType = request.headers["content-type"]?.split(";", 1)[0]?.trim().toLowerCase();
+    if (contentType !== "application/json") {
+        invalidBody("Content-Type must be application/json");
+    }
+    const declared = Number(request.headers["content-length"]);
+    if (Number.isFinite(declared) && declared > MAX_INTERACTION_JSON_BYTES) {
+        bodyTooLarge();
+    }
+    const chunks = [];
+    let bytes = 0;
+    for await (const chunk of request) {
+        const value = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
+        bytes += value.byteLength;
+        if (bytes > MAX_INTERACTION_JSON_BYTES)
+            bodyTooLarge();
+        chunks.push(value);
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(Buffer.concat(chunks).toString("utf8"));
+    }
+    catch {
+        invalidBody("Request body must be valid JSON");
+    }
+    if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) {
+        invalidBody("Request body must be a JSON object");
+    }
+    return parsed;
+}
+function invalidBody(message) {
+    throw new RequestBodyError(400, "invalid_json", message);
+}
+function bodyTooLarge() {
+    throw new RequestBodyError(413, "body_too_large", "Request body is too large");
+}
+//# sourceMappingURL=request-body.js.map

package/dist/server/server/http/router.js

@@ -0,0 +1,16 @@
+export function sendJson(response, status, body, headOnly = false) {
+    const json = JSON.stringify(body);
+    response.statusCode = status;
+    response.setHeader("Content-Type", "application/json; charset=utf-8");
+    response.setHeader("Cache-Control", "no-store");
+    response.setHeader("Content-Length", Buffer.byteLength(json));
+    response.end(headOnly ? undefined : json);
+}
+export const emptyApiRouter = (request, response) => {
+    const pathname = new URL(request.url ?? "/", "http://localhost").pathname;
+    if (!pathname.startsWith("/api/"))
+        return false;
+    sendJson(response, 404, { error: { code: "not_found", message: "API endpoint not found" } }, request.method === "HEAD");
+    return true;
+};
+//# sourceMappingURL=router.js.map

package/dist/server/server/http/security.js

@@ -0,0 +1,19 @@
+const SECURITY_HEADERS = {
+    "Content-Security-Policy": "default-src 'self'; base-uri 'none'; font-src 'self' data:; form-action 'none'; frame-ancestors 'none'; img-src 'self' data:; object-src 'none'; script-src 'self'; style-src 'self'; style-src-attr 'unsafe-inline'",
+    "X-Content-Type-Options": "nosniff",
+    "Referrer-Policy": "no-referrer",
+    "X-Frame-Options": "DENY",
+};
+export function applySecurityHeaders(response, request) {
+    const secure = "encrypted" in request.socket && request.socket.encrypted;
+    const host = request.headers.host;
+    // Explicit WebSocket sources are needed by browsers that do not map 'self' to ws/wss.
+    if (host && /^[a-zA-Z0-9.:[\]-]+$/.test(host)) {
+        response.setHeader("Content-Security-Policy", `${SECURITY_HEADERS["Content-Security-Policy"]}; connect-src 'self' ${secure ? "wss" : "ws"}://${host}`);
+    }
+    for (const [name, value] of Object.entries(SECURITY_HEADERS)) {
+        if (!response.hasHeader(name))
+            response.setHeader(name, value);
+    }
+}
+//# sourceMappingURL=security.js.map

package/dist/server/server/http/session-interaction-routes.js

@@ -0,0 +1,101 @@
+import { INTERACTION_KEYS, MAX_INTERACTION_KEY_SEQUENCE_LENGTH, } from "../../shared/api-contract.js";
+import { SessionInteractionError, } from "../interaction/interaction-service.js";
+import { MessageValidationError, normalizeMessage } from "../interaction/message.js";
+import { readJsonObject, RequestBodyError } from "./request-body.js";
+import { sendJson } from "./router.js";
+import { SESSION_ID_PATTERN, SESSION_ROOT, sessionPath } from "./session-path.js";
+const INTERACTION_PATH = new RegExp(`^${SESSION_ROOT}/${SESSION_ID_PATTERN}/(?:terminal-preview|messages|keys|handoff-pane-binding)$`);
+const INTERACTION_KEY_SET = new Set(INTERACTION_KEYS);
+export function createSessionInteractionRoutes(interaction) {
+    return {
+        matches: (url) => INTERACTION_PATH.test(url.pathname),
+        async handle(request, response, url) {
+            const { id, segments: [operation = ""], } = sessionPath(url.pathname);
+            if (operation === "terminal-preview") {
+                response.setHeader("Upgrade", "websocket");
+                sendJson(response, 426, {
+                    error: { code: "websocket_required", message: "Terminal preview requires WebSocket" },
+                }, request.method === "HEAD");
+                return true;
+            }
+            if (request.method !== "POST")
+                return false;
+            if (interaction === undefined)
+                return interactionUnavailable(response);
+            if (operation === "handoff-pane-binding") {
+                const body = await readJsonObject(request);
+                if (Object.keys(body).length !== 0)
+                    invalidBody("Expected an empty object");
+                await interaction.handoffPaneBinding(id);
+                return noContent(response);
+            }
+            if (operation === "messages") {
+                const body = await readJsonObject(request);
+                if (Object.keys(body).length !== 1 || typeof body.message !== "string") {
+                    invalidBody("body must contain only a string message field");
+                }
+                normalizeMessage(body.message);
+                await interaction.sendMessage(id, body.message);
+                return noContent(response);
+            }
+            if (operation === "keys") {
+                const body = await readJsonObject(request);
+                if (Object.keys(body).length !== 1 || !Array.isArray(body.keys)) {
+                    invalidBody("body must contain only a keys array");
+                }
+                if (body.keys.length === 0 ||
+                    body.keys.length > MAX_INTERACTION_KEY_SEQUENCE_LENGTH ||
+                    !body.keys.every(isInteractionKey)) {
+                    invalidBody(`keys must contain 1-${MAX_INTERACTION_KEY_SEQUENCE_LENGTH} supported interaction keys`);
+                }
+                await interaction.sendKeys(id, body.keys);
+                return noContent(response);
+            }
+            return false;
+        },
+        mapError(error, request, response) {
+            const headOnly = request.method === "HEAD";
+            if (error instanceof MessageValidationError && error.code === "invalid_message") {
+                sendJson(response, 400, {
+                    error: { code: "invalid_message", message: error.message },
+                }, headOnly);
+                return true;
+            }
+            if (error instanceof SessionInteractionError) {
+                const status = error.code === "session_not_found"
+                    ? 404
+                    : error.code === "operation_result_unknown"
+                        ? 504
+                        : error.code === "interaction_failed"
+                            ? 502
+                            : 409;
+                sendJson(response, status, {
+                    error: { code: error.code, message: error.message },
+                }, headOnly);
+                return true;
+            }
+            return false;
+        },
+    };
+}
+function invalidBody(message) {
+    throw new RequestBodyError(400, "invalid_json", message);
+}
+function isInteractionKey(value) {
+    return typeof value === "string" && INTERACTION_KEY_SET.has(value);
+}
+function noContent(response) {
+    response.statusCode = 204;
+    response.end();
+    return true;
+}
+function interactionUnavailable(response) {
+    sendJson(response, 409, {
+        error: {
+            code: "interaction_not_supported",
+            message: "Interaction is not enabled",
+        },
+    });
+    return true;
+}
+//# sourceMappingURL=session-interaction-routes.js.map

package/dist/server/server/http/session-management-routes.js

@@ -0,0 +1,90 @@
+import { ManagementError } from "../management/operation-service.js";
+import { readJsonObject, RequestBodyError } from "./request-body.js";
+import { sendJson } from "./router.js";
+import { SESSION_ID_PATTERN, SESSION_ROOT, sessionPath } from "./session-path.js";
+const OPERATION_PATH = /^\/api\/v1\/operations\/[^/]+$/;
+const SESSION_PATH = new RegExp(`^${SESSION_ROOT}/${SESSION_ID_PATTERN}(?:/(?:archive|exit))?$`);
+export function createSessionManagementRoutes(operations) {
+    return {
+        matches: (url) => OPERATION_PATH.test(url.pathname) ||
+            url.pathname === SESSION_ROOT ||
+            SESSION_PATH.test(url.pathname),
+        async handle(request, response, url) {
+            if (!operations)
+                return false;
+            if (OPERATION_PATH.test(url.pathname)) {
+                if (request.method !== "GET")
+                    return false;
+                const operationId = url.pathname.slice("/api/v1/operations/".length);
+                const operation = await operations.get(operationId);
+                if (!operation) {
+                    throw new ManagementError(404, "Operation not found; the server may have restarted or the record expired");
+                }
+                sendJson(response, 200, operation);
+                return true;
+            }
+            const create = url.pathname === SESSION_ROOT;
+            const archive = url.pathname.endsWith("/archive");
+            const exit = url.pathname.endsWith("/exit");
+            const method = create || archive || exit ? "POST" : "DELETE";
+            if (request.method !== method)
+                return false;
+            const protocol = "encrypted" in request.socket && request.socket.encrypted ? "https" : "http";
+            if (request.headers.origin &&
+                request.headers.origin !== `${protocol}://${request.headers.host}`) {
+                throw new ManagementError(403, "Cross-origin management requests are not allowed");
+            }
+            const body = await readJsonObject(request);
+            if (create) {
+                if (typeof body.requestId !== "string")
+                    throw new RequestBodyError(400, "invalid_json", "requestId is required");
+                if (body.resumeSessionId !== undefined) {
+                    if (typeof body.resumeSessionId !== "string" ||
+                        !body.resumeSessionId.trim() ||
+                        Object.keys(body).some((key) => !["resumeSessionId", "yolo", "requestId"].includes(key)) ||
+                        (body.yolo !== undefined && typeof body.yolo !== "boolean"))
+                        throw new RequestBodyError(400, "invalid_json", "Resume accepts only resumeSessionId, yolo and requestId");
+                    sendJson(response, 202, operations.create({
+                        resumeSessionId: body.resumeSessionId,
+                        yolo: body.yolo,
+                        requestId: body.requestId,
+                    }));
+                    return true;
+                }
+                if (Object.keys(body).some((key) => !["directory", "worktree", "yolo", "requestId", "sourceInstanceId"].includes(key)) ||
+                    (body.sourceInstanceId !== undefined && typeof body.sourceInstanceId !== "string") ||
+                    typeof body.directory !== "string" ||
+                    typeof body.worktree !== "boolean" ||
+                    (body.yolo !== undefined && typeof body.yolo !== "boolean")) {
+                    throw new RequestBodyError(400, "invalid_json", "directory and worktree are required; yolo must be a boolean if provided");
+                }
+                sendJson(response, 202, operations.create({
+                    ...(typeof body.sourceInstanceId === "string"
+                        ? { sourceInstanceId: body.sourceInstanceId }
+                        : {}),
+                    directory: body.directory,
+                    worktree: body.worktree,
+                    yolo: body.yolo ?? false,
+                    requestId: body.requestId,
+                }));
+            }
+            else {
+                if (Object.keys(body).length !== 0)
+                    throw new RequestBodyError(400, "invalid_json", "Expected an empty object");
+                const { id: sessionId } = sessionPath(url.pathname);
+                sendJson(response, 202, operations.manage(exit ? "exit" : archive ? "archive" : "delete", sessionId));
+            }
+            return true;
+        },
+        mapError(error, request, response) {
+            if (error instanceof ManagementError) {
+                sendJson(response, error.status, {
+                    error: { code: "management_error", message: error.message },
+                }, request.method === "HEAD");
+                return true;
+            }
+            return false;
+        },
+    };
+}
+//# sourceMappingURL=session-management-routes.js.map

package/dist/server/server/http/session-path.js

@@ -0,0 +1,13 @@
+export const SESSION_ROOT = "/api/v1/sessions";
+export const SESSION_ID_PATTERN = "[A-Za-z0-9_-]{20,100}";
+export function isOpaqueId(value) {
+    return new RegExp(`^${SESSION_ID_PATTERN}$`).test(value);
+}
+export function sessionPath(pathname) {
+    const [id = "", ...segments] = pathname.slice(SESSION_ROOT.length + 1).split("/");
+    return { id, segments };
+}
+export function readPathname(request, url) {
+    return request.url?.startsWith("/") ? request.url.split("?")[0] : url.pathname;
+}
+//# sourceMappingURL=session-path.js.map

package/dist/server/server/http/session-read-routes.js

@@ -0,0 +1,198 @@
+import { CatalogCapacityError, } from "../catalog/session-catalog-service.js";
+import { reconcileSessionState } from "../interaction/reconcile-session-state.js";
+import { RepositoryQueryError } from "../repository/session-queries.js";
+import { withUpdateRevision } from "../updates/update-revision.js";
+import { invalid, only, optional } from "./query-params.js";
+import { sendJson } from "./router.js";
+import { isOpaqueId, readPathname, SESSION_ROOT, sessionPath } from "./session-path.js";
+export function createSessionReadRoutes(dependencies) {
+    return {
+        matches: () => true,
+        async handle(request, response, url) {
+            const pathname = readPathname(request, url);
+            const headOnly = request.method === "HEAD";
+            const readMethod = request.method === "GET" || headOnly;
+            if (!readMethod)
+                return false;
+            if (pathname === SESSION_ROOT) {
+                const query = parseListQuery(url.searchParams);
+                const abort = new AbortController();
+                const disconnect = () => {
+                    if (!response.writableEnded)
+                        abort.abort();
+                };
+                request.once("aborted", disconnect);
+                response.once("close", disconnect);
+                response.setHeader("Cache-Control", "no-store");
+                try {
+                    const result = await dependencies.catalog.wait(headOnly ? undefined : query.after, abort.signal);
+                    if (abort.signal.aborted || response.destroyed)
+                        return true;
+                    if (result === null) {
+                        response.statusCode = 204;
+                        response.end();
+                    }
+                    else
+                        sendJson(response, 200, result, headOnly);
+                }
+                finally {
+                    request.removeListener("aborted", disconnect);
+                    response.removeListener("close", disconnect);
+                }
+                return true;
+            }
+            if (!pathname.startsWith(`${SESSION_ROOT}/`)) {
+                return notFound(response, headOnly);
+            }
+            const { id, segments } = sessionPath(pathname);
+            if (!isOpaqueId(id))
+                return notFound(response, headOnly);
+            const itemId = segments.length === 3 && segments[0] === "items" ? decodeItemId(segments[1] ?? "") : "";
+            if (segments.length === 0) {
+                if ([...url.searchParams].length > 0) {
+                    invalid("session metadata does not accept query parameters");
+                }
+                const result = await dependencies.sessions.getSession(id);
+                if (result === null) {
+                    return notFound(response, headOnly, "session_not_found");
+                }
+                const interaction = await describeInteraction(dependencies.interaction, id);
+                sendJson(response, 200, withUpdateRevision(reconcileSessionState({
+                    ...result,
+                    interaction,
+                }), dependencies.updates.revision.bind(dependencies.updates)), headOnly);
+                return true;
+            }
+            if (segments.length === 1 && segments[0] === "items") {
+                const result = await dependencies.sessions.getItems(id, parseItemQuery(url.searchParams));
+                if (result === null) {
+                    return notFound(response, headOnly, "session_not_found");
+                }
+                const interaction = await describeInteraction(dependencies.interaction, id);
+                sendJson(response, 200, withUpdateRevision(reconcileSessionState({
+                    ...result,
+                    interaction,
+                }), dependencies.updates.revision.bind(dependencies.updates)), headOnly);
+                return true;
+            }
+            if (segments.length === 3 && segments[0] === "items" && segments[2] === "tool") {
+                const result = await dependencies.sessions.getToolDetail(id, itemId, parseToolQuery(url.searchParams));
+                if (result === null) {
+                    return notFound(response, headOnly, "tool_not_found");
+                }
+                sendJson(response, 200, result, headOnly);
+                return true;
+            }
+            if (segments.length === 3 && segments[0] === "items" && segments[2] === "internal") {
+                const result = await dependencies.sessions.getInternalDetail(id, itemId, parseInternalQuery(url.searchParams));
+                if (result === null) {
+                    return notFound(response, headOnly, "internal_not_found");
+                }
+                sendJson(response, 200, result, headOnly);
+                return true;
+            }
+            if (segments.length === 3 && segments[0] === "items" && segments[2] === "directive") {
+                const result = await dependencies.sessions.getDirectiveDetail(id, itemId, parseDirectiveQuery(url.searchParams));
+                if (result === null) {
+                    return notFound(response, headOnly, "directive_not_found");
+                }
+                sendJson(response, 200, result, headOnly);
+                return true;
+            }
+            return notFound(response, headOnly);
+        },
+        mapError(error, request, response) {
+            if (error instanceof CatalogCapacityError) {
+                response.setHeader("Retry-After", "2");
+                sendJson(response, 429, { error: { code: "catalog_capacity_exceeded", message: error.message } }, request.method === "HEAD");
+                return true;
+            }
+            if (error instanceof DOMException && error.name === "AbortError") {
+                if (!response.destroyed) {
+                    response.statusCode = 204;
+                    response.end();
+                }
+                return true;
+            }
+            if (!(error instanceof RepositoryQueryError))
+                return false;
+            const status = error.code === "timeline_changed" ? 409 : 400;
+            sendJson(response, status, {
+                error: { code: error.code, message: error.message },
+            }, request.method === "HEAD");
+            return true;
+        },
+    };
+}
+async function describeInteraction(interaction, sessionId) {
+    if (interaction === undefined)
+        return { supported: false, attachCommand: null };
+    return ((await interaction.describe(sessionId)) ?? { supported: false, attachCommand: null });
+}
+function parseListQuery(params) {
+    only(params, ["after"]);
+    const after = optional(params, "after");
+    if (after !== undefined && !/^[A-Za-z0-9_-]{43}$/.test(after))
+        invalid("after is malformed");
+    return after === undefined ? {} : { after };
+}
+function parseItemQuery(params) {
+    only(params, ["limit", "cursor"]);
+    const query = {};
+    const cursor = optional(params, "cursor");
+    if (cursor !== undefined)
+        query.cursor = cursor;
+    const limit = optional(params, "limit");
+    if (limit !== undefined)
+        query.limit = integer(limit, "limit");
+    return query;
+}
+function parseToolQuery(params) {
+    only(params, ["cursor"]);
+    return { cursor: requiredCursor(params, "tool detail") };
+}
+function parseDirectiveQuery(params) {
+    only(params, ["cursor"]);
+    return { cursor: requiredCursor(params, "directive detail") };
+}
+function parseInternalQuery(params) {
+    only(params, ["cursor"]);
+    return { cursor: requiredCursor(params, "internal detail") };
+}
+function requiredCursor(params, resource) {
+    const cursor = optional(params, "cursor");
+    if (cursor === undefined)
+        invalid(`cursor is required for ${resource}`);
+    return cursor;
+}
+function integer(value, name) {
+    if (!/^\d+$/.test(value))
+        invalid(`${name} must be an integer`);
+    const result = Number(value);
+    if (!Number.isSafeInteger(result)) {
+        invalid(`${name} is outside the supported range`);
+    }
+    return result;
+}
+function decodeItemId(value) {
+    let decoded;
+    try {
+        decoded = decodeURIComponent(value);
+    }
+    catch {
+        return invalid("item ID is malformed");
+    }
+    if (!decoded ||
+        Buffer.byteLength(decoded, "utf8") > 1024 ||
+        /[\u0000-\u001f\u007f-\u009f/\\]/u.test(decoded) ||
+        decoded === "." ||
+        decoded === "..") {
+        invalid("item ID is malformed");
+    }
+    return decoded;
+}
+function notFound(response, headOnly, code = "not_found") {
+    sendJson(response, 404, { error: { code, message: "API resource not found" } }, headOnly);
+    return true;
+}
+//# sourceMappingURL=session-read-routes.js.map