@songsid/agend 2.1.12 → 2.2.0-alpha.2

package/dist/web-login.js

@@ -0,0 +1,132 @@
+/**
+ * The dashboard's login codes: who may redeem one, how often they may be wrong,
+ * and what happens when they are wrong too often.
+ *
+ * Deliberately not `SetupCredentials`. That class belongs to a ten-minute
+ * escape hatch whose answer to five wrong tries is to destroy itself; a fleet
+ * that runs for months must not be closable by whoever finds its address. So the
+ * rules here are different, and each is a property worth testing directly:
+ *
+ * - **No outstanding code, nothing to guess.** A redemption while no code has
+ *   been issued gets the same refusal as a wrong code and counts against
+ *   nothing. The door is only a door in the few minutes after the operator asked
+ *   for a code on a channel only they can read.
+ * - **A code dies with its fifth wrong try — the code, not the fleet.** The
+ *   cost to a stranger who guesses is that the operator asks for another.
+ * - **A breaker for the rest.** Enough wrong tries across codes pauses
+ *   redemption for a while, correct codes included, so a patient guesser cannot
+ *   turn five-per-code into an unbounded stream. Sessions already signed in are
+ *   not affected: this object knows nothing about them.
+ * - **One code at a time, single use.** Issuing replaces the outstanding code;
+ *   redeeming it spends it.
+ *
+ * The code is only an exchange key. What a successful redemption yields is a
+ * fresh 256-bit session id from `web-session.ts` that has no relation to it.
+ *
+ * Deliberately has no idea what an HTTP request is.
+ */
+import { constantTimeMatches, formatOneTimeCode, generateOneTimeCode, normalizeOneTimeCode, } from "./auth/one-time-code.js";
+import { randomBytes } from "node:crypto";
+export const LOGIN_CODE_TTL_MS = 5 * 60 * 1000;
+/** Same reasoning as setup: eight characters on a phone get mistyped. */
+export const MAX_LOGIN_CODE_ATTEMPTS = 5;
+export const LOGIN_BREAKER_WINDOW_MS = 15 * 60 * 1000;
+export const LOGIN_BREAKER_THRESHOLD = 20;
+export const LOGIN_BREAKER_PAUSE_MS = 5 * 60 * 1000;
+/** Compared against when nothing is outstanding, so "no code" costs what "wrong code" costs. */
+const NO_CODE_PLACEHOLDER = "AAAAAAAA";
+export class WebLoginCodes {
+    outstanding = null;
+    failures = [];
+    pausedUntil = 0;
+    now;
+    generate;
+    onEvent;
+    constructor(opts = {}) {
+        this.now = opts.now ?? Date.now;
+        this.generate = opts.generate ?? generateOneTimeCode;
+        this.onEvent = opts.onEvent ?? (() => { });
+    }
+    /**
+     * Issue a code, replacing any outstanding one. Only ever called from a channel the operator controls.
+     * `epoch` is the current web token's (`tokenEpoch`): rotating the token — from this process or from
+     * `agend web-token rotate` in another — withdraws an unused code, because redemption re-checks it.
+     */
+    issue(opts) {
+        const code = this.generate();
+        const tier = opts.tier ?? "admin";
+        const expiresAt = this.now() + LOGIN_CODE_TTL_MS;
+        const issuanceId = randomBytes(16).toString("hex");
+        this.outstanding = { code, expiresAt, tier, epoch: opts.epoch, failures: 0, issuanceId, audience: opts.audience ?? "local", owner: opts.owner };
+        this.onEvent("issued");
+        return { display: formatOneTimeCode(code), expiresAt, tier, issuanceId };
+    }
+    /** Whether a redemption right now would be compared against anything. */
+    get hasOutstandingCode() {
+        return this.activeCode() !== null;
+    }
+    /** Withdraw the outstanding code without spending it (`/dashboard revoke`). */
+    revoke() {
+        this.outstanding = null;
+    }
+    /** `currentEpoch` is the web token's epoch NOW: a code issued under another token is gone. */
+    revokeIfCurrent(issuanceId) {
+        if (this.outstanding?.issuanceId === issuanceId)
+            this.outstanding = null;
+    }
+    revokeAudience(audience) {
+        if (this.outstanding?.audience === audience)
+            this.outstanding = null;
+    }
+    redeem(input, currentEpoch, audience = "local") {
+        const now = this.now();
+        if (now < this.pausedUntil)
+            return { kind: "paused", retryAfterMs: this.pausedUntil - now };
+        const provided = normalizeOneTimeCode(input);
+        // Nothing typed is not a guess; it costs nothing (same as the setup page).
+        if (!provided)
+            return { kind: "invalid" };
+        let active = this.activeCode();
+        if (active && active.epoch !== currentEpoch) {
+            // The token was rotated after this code was issued: the rotation withdrew it.
+            this.outstanding = null;
+            active = null;
+        }
+        if (!active) {
+            constantTimeMatches(provided, NO_CODE_PLACEHOLDER);
+            return { kind: "invalid" };
+        }
+        if (constantTimeMatches(provided, active.code) && active.audience === audience) {
+            this.outstanding = null;
+            this.onEvent("spent");
+            return { kind: "ok", tier: active.tier, ...(active.owner ? { owner: active.owner } : {}) };
+        }
+        active.failures += 1;
+        this.recordFailure(now);
+        if (active.failures >= MAX_LOGIN_CODE_ATTEMPTS) {
+            this.outstanding = null;
+            this.onEvent("burned");
+        }
+        return { kind: "invalid" };
+    }
+    activeCode() {
+        if (!this.outstanding)
+            return null;
+        if (this.now() >= this.outstanding.expiresAt) {
+            this.outstanding = null;
+            return null;
+        }
+        return this.outstanding;
+    }
+    recordFailure(now) {
+        this.failures.push(now);
+        const cutoff = now - LOGIN_BREAKER_WINDOW_MS;
+        this.failures = this.failures.filter(t => t > cutoff);
+        if (this.failures.length >= LOGIN_BREAKER_THRESHOLD) {
+            this.pausedUntil = now + LOGIN_BREAKER_PAUSE_MS;
+            this.failures = [];
+            this.onEvent("breaker-open");
+        }
+    }
+}
+//# sourceMappingURL=web-login.js.map

package/dist/web-login.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"web-login.js","sourceRoot":"","sources":["../src/web-login.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,OAAO,EACL,mBAAmB,EACnB,iBAAiB,EACjB,mBAAmB,EACnB,oBAAoB,GACrB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAG1C,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;AAC/C,yEAAyE;AACzE,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC;AACzC,MAAM,CAAC,MAAM,uBAAuB,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AACtD,MAAM,CAAC,MAAM,uBAAuB,GAAG,EAAE,CAAC;AAC1C,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;AAEpD,gGAAgG;AAChG,MAAM,mBAAmB,GAAG,UAAU,CAAC;AA4CvC,MAAM,OAAO,aAAa;IAChB,WAAW,GAAuB,IAAI,CAAC;IACvC,QAAQ,GAAa,EAAE,CAAC;IACxB,WAAW,GAAG,CAAC,CAAC;IACP,GAAG,CAAe;IAClB,QAAQ,CAAe;IACvB,OAAO,CAAkE;IAE1F,YAAY,OAA6B,EAAE;QACzC,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;QAChC,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,mBAAmB,CAAC;QACrD,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IAC5C,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,IAAsF;QAC1F,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAC;QAC7B,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,OAAO,CAAC;QAClC,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,iBAAiB,CAAC;QACjD,MAAM,UAAU,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QACnD,IAAI,CAAC,WAAW,GAAG,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,QAAQ,EAAE,CAAC,EAAE,UAAU,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,IAAI,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC;QAChJ,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QACvB,OAAO,EAAE,OAAO,EAAE,iBAAiB,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;IAC3E,CAAC;IAED,yEAAyE;IACzE,IAAI,kBAAkB;QACpB,OAAO,IAAI,CAAC,UAAU,EAAE,KAAK,IAAI,CAAC;IACpC,CAAC;IAED,+EAA+E;IAC/E,MAAM;QACJ,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC;IAC1B,CAAC;IAED,8FAA8F;IAC9F,eAAe,CAAC,UAAkB;QAChC,IAAI,IAAI,CAAC,WAAW,EAAE,UAAU,KAAK,UAAU;YAAE,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC;IAC3E,CAAC;IAED,cAAc,CAAC,QAAgB;QAC7B,IAAI,IAAI,CAAC,WAAW,EAAE,QAAQ,KAAK,QAAQ;YAAE,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC;IACvE,CAAC;IAED,MAAM,CAAC,KAAa,EAAE,YAAoB,EAAE,QAAQ,GAAG,OAAO;QAC5D,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,IAAI,GAAG,GAAG,IAAI,CAAC,WAAW;YAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,YAAY,EAAE,IAAI,CAAC,WAAW,GAAG,GAAG,EAAE,CAAC;QAE5F,MAAM,QAAQ,GAAG,oBAAoB,CAAC,KAAK,CAAC,CAAC;QAC7C,2EAA2E;QAC3E,IAAI,CAAC,QAAQ;YAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;QAE1C,IAAI,MAAM,GAAG,IAAI,CAAC,UAAU,EAAE,CAAC;QAC/B,IAAI,MAAM,IAAI,MAAM,CAAC,KAAK,KAAK,YAAY,EAAE,CAAC;YAC5C,8EAA8E;YAC9E,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC;YACxB,MAAM,GAAG,IAAI,CAAC;QAChB,CAAC;QACD,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,mBAAmB,CAAC,QAAQ,EAAE,mBAAmB,CAAC,CAAC;YACnD,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;QAC7B,CAAC;QAED,IAAI,mBAAmB,CAAC,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;YAC/E,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC;YACxB,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;YACtB,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;QAC7F,CAAC;QAED,MAAM,CAAC,QAAQ,IAAI,CAAC,CAAC;QACrB,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC;QACxB,IAAI,MAAM,CAAC,QAAQ,IAAI,uBAAuB,EAAE,CAAC;YAC/C,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC;YACxB,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QACzB,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;IAC7B,CAAC;IAEO,UAAU;QAChB,IAAI,CAAC,IAAI,CAAC,WAAW;YAAE,OAAO,IAAI,CAAC;QACnC,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,IAAI,CAAC,WAAW,CAAC,SAAS,EAAE,CAAC;YAAC,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC;YAAC,OAAO,IAAI,CAAC;QAAC,CAAC;QACvF,OAAO,IAAI,CAAC,WAAW,CAAC;IAC1B,CAAC;IAEO,aAAa,CAAC,GAAW;QAC/B,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACxB,MAAM,MAAM,GAAG,GAAG,GAAG,uBAAuB,CAAC;QAC7C,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC;QACtD,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,IAAI,uBAAuB,EAAE,CAAC;YACpD,IAAI,CAAC,WAAW,GAAG,GAAG,GAAG,sBAAsB,CAAC;YAChD,IAAI,CAAC,QAAQ,GAAG,EAAE,CAAC;YACnB,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;QAC/B,CAAC;IACH,CAAC;CACF"}

package/dist/web-org.d.ts

@@ -0,0 +1,55 @@
+/**
+ * #1389: the fleet's org chart, as the web shows it (Fleet → Org chart). Presentation only (the user's Discord-first
+ * rule): nothing here is a new source of truth. The structure is read from what already exists — fleet.yaml's
+ * instances and teams, General (general_topic), each instance's world and thread — and the live state is not here at
+ * all: the page takes it from the stream it already follows (status, activity, `needs`).
+ */
+import type { WorldPlace } from "./needs-you.js";
+export interface OrgInstanceConfig {
+    description?: unknown;
+    tags?: unknown;
+}
+export interface OrgInput {
+    /** Every instance the dashboard lists, in its order (fleet.yaml's, then ClassicBot rooms). */
+    names: readonly string[];
+    instances: Readonly<Record<string, OrgInstanceConfig | undefined>>;
+    teams: Readonly<Record<string, {
+        members?: unknown;
+        description?: unknown;
+    } | undefined>> | undefined;
+    isGeneral(name: string): boolean;
+    isClassic(name: string): boolean;
+    /** The platform and group of the world the instance lives in, when it has one. */
+    place(name: string): WorldPlace | undefined;
+    /** The instance's own thread/topic (or ClassicBot channel) id. */
+    topic(name: string): string | undefined;
+}
+export interface OrgThread {
+    platform: "discord" | "telegram";
+    url: string;
+}
+export interface OrgInstance {
+    description?: string;
+    tags?: string[];
+    general?: true;
+    classic?: true;
+    thread?: OrgThread;
+}
+export interface OrgTeam {
+    name: string;
+    description?: string;
+    /** As configured, in order; a name the fleet no longer has is kept (the page shows it as missing). */
+    members: string[];
+}
+export interface OrgChart {
+    /** General instances (one per world at most, in practice): the top of the chart. */
+    general: string[];
+    teams: OrgTeam[];
+    instances: Record<string, OrgInstance>;
+}
+/**
+ * A browser link to an instance's thread: Discord's channel URL, Telegram's topic link. Undefined when the place or
+ * the id is not one a link can be built from (Telegram's General topic, 1, has no topic link).
+ */
+export declare function threadUrl(place: WorldPlace | undefined, topicId: string | undefined): OrgThread | undefined;
+export declare function buildOrgChart(input: OrgInput): OrgChart;

package/dist/web-org.js

@@ -0,0 +1,67 @@
+const SNOWFLAKE = /^\d{5,25}$/;
+const MAX_DESCRIPTION = 500;
+const MAX_TAGS = 12;
+/**
+ * A browser link to an instance's thread: Discord's channel URL, Telegram's topic link. Undefined when the place or
+ * the id is not one a link can be built from (Telegram's General topic, 1, has no topic link).
+ */
+export function threadUrl(place, topicId) {
+    if (!place || !topicId)
+        return undefined;
+    if (place.type === "discord") {
+        if (!place.groupId || !SNOWFLAKE.test(place.groupId) || !SNOWFLAKE.test(topicId))
+            return undefined;
+        return { platform: "discord", url: `https://discord.com/channels/${place.groupId}/${topicId}` };
+    }
+    if (place.type === "telegram") {
+        const m = /^-100(\d+)$/.exec(place.groupId ?? "");
+        if (!m || !/^\d+$/.test(topicId) || topicId === "1")
+            return undefined;
+        return { platform: "telegram", url: `https://t.me/c/${m[1]}/${topicId}` };
+    }
+    return undefined;
+}
+const text = (v) => {
+    if (typeof v !== "string")
+        return undefined;
+    const s = v.trim();
+    return s ? (s.length > MAX_DESCRIPTION ? `${s.slice(0, MAX_DESCRIPTION - 1)}…` : s) : undefined;
+};
+export function buildOrgChart(input) {
+    // Keyed by instance name, and any name the validators accept is a key — "__proto__" included (#1467 review): a
+    // prototype-less map makes every assignment an own property, so JSON carries it like any other name.
+    const instances = Object.create(null);
+    const general = [];
+    for (const name of input.names) {
+        const cfg = input.instances[name];
+        const entry = {};
+        const description = text(cfg?.description);
+        if (description)
+            entry.description = description;
+        if (Array.isArray(cfg?.tags)) {
+            const tags = cfg.tags.filter((t) => typeof t === "string" && t.trim() !== "").map(t => t.trim()).slice(0, MAX_TAGS);
+            if (tags.length)
+                entry.tags = tags;
+        }
+        if (input.isGeneral(name)) {
+            entry.general = true;
+            general.push(name);
+        }
+        if (input.isClassic(name))
+            entry.classic = true;
+        const thread = threadUrl(input.place(name), input.topic(name));
+        if (thread)
+            entry.thread = thread;
+        instances[name] = entry;
+    }
+    const teams = [];
+    for (const [name, team] of Object.entries(input.teams ?? {})) {
+        if (!team)
+            continue;
+        const members = Array.isArray(team.members) ? [...new Set(team.members.filter((m) => typeof m === "string" && m !== ""))] : [];
+        const description = text(team.description);
+        teams.push({ name, ...(description ? { description } : {}), members });
+    }
+    return { general, teams, instances };
+}
+//# sourceMappingURL=web-org.js.map

package/dist/web-org.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"web-org.js","sourceRoot":"","sources":["../src/web-org.ts"],"names":[],"mappings":"AAqDA,MAAM,SAAS,GAAG,YAAY,CAAC;AAC/B,MAAM,eAAe,GAAG,GAAG,CAAC;AAC5B,MAAM,QAAQ,GAAG,EAAE,CAAC;AAEpB;;;GAGG;AACH,MAAM,UAAU,SAAS,CAAC,KAA6B,EAAE,OAA2B;IAClF,IAAI,CAAC,KAAK,IAAI,CAAC,OAAO;QAAE,OAAO,SAAS,CAAC;IACzC,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAC7B,IAAI,CAAC,KAAK,CAAC,OAAO,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC;YAAE,OAAO,SAAS,CAAC;QACnG,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,GAAG,EAAE,gCAAgC,KAAK,CAAC,OAAO,IAAI,OAAO,EAAE,EAAE,CAAC;IAClG,CAAC;IACD,IAAI,KAAK,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;QAC9B,MAAM,CAAC,GAAG,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC;QAClD,IAAI,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,OAAO,KAAK,GAAG;YAAE,OAAO,SAAS,CAAC;QACtE,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,GAAG,EAAE,kBAAkB,CAAC,CAAC,CAAC,CAAC,IAAI,OAAO,EAAE,EAAE,CAAC;IAC5E,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,MAAM,IAAI,GAAG,CAAC,CAAU,EAAsB,EAAE;IAC9C,IAAI,OAAO,CAAC,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IAC5C,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IACnB,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,GAAG,eAAe,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,eAAe,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAClG,CAAC,CAAC;AAEF,MAAM,UAAU,aAAa,CAAC,KAAe;IAC3C,+GAA+G;IAC/G,qGAAqG;IACrG,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAAgC,CAAC;IACrE,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;QAC/B,MAAM,GAAG,GAAG,KAAK,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QAClC,MAAM,KAAK,GAAgB,EAAE,CAAC;QAC9B,MAAM,WAAW,GAAG,IAAI,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;QAC3C,IAAI,WAAW;YAAE,KAAK,CAAC,WAAW,GAAG,WAAW,CAAC;QACjD,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,CAAC;YAC7B,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;YACjI,IAAI,IAAI,CAAC,MAAM;gBAAE,KAAK,CAAC,IAAI,GAAG,IAAI,CAAC;QACrC,CAAC;QACD,IAAI,KAAK,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC;YAAC,KAAK,CAAC,OAAO,GAAG,IAAI,CAAC;YAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAAC,CAAC;QACxE,IAAI,KAAK,CAAC,SAAS,CAAC,IAAI,CAAC;YAAE,KAAK,CAAC,OAAO,GAAG,IAAI,CAAC;QAChD,MAAM,MAAM,GAAG,SAAS,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;QAC/D,IAAI,MAAM;YAAE,KAAK,CAAC,MAAM,GAAG,MAAM,CAAC;QAClC,SAAS,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC;IAC1B,CAAC;IACD,MAAM,KAAK,GAAc,EAAE,CAAC;IAC5B,KAAK,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,IAAI,EAAE,CAAC,EAAE,CAAC;QAC7D,IAAI,CAAC,IAAI;YAAE,SAAS;QACpB,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5I,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QAC3C,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC;IACzE,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;AACvC,CAAC"}

package/dist/web-preview.d.ts

@@ -0,0 +1,77 @@
+import { type Server } from "node:http";
+import { type HostGuardConfig } from "./web-host-guard.js";
+/** The most HTML a preview takes (UTF-8 bytes): the parent refuses more before sending, the shim refuses it too. */
+export declare const PREVIEW_HTML_MAX_BYTES: number;
+export interface PreviewWebConfig {
+    preview?: unknown;
+    preview_port?: unknown;
+    preview_origin?: unknown;
+}
+export interface PreviewSettings {
+    /** `web.preview` (default true): false means no listener, and cards show Source / Download only. */
+    enabled: boolean;
+    /** The preview listener's port, on 127.0.0.1; null when there is no valid one (health_port 65535 and no preview_port). */
+    port: number | null;
+    /** `web.preview_origin`, normalised to scheme://host[:port], or null. */
+    origin: string | null;
+}
+/** The settings a fleet runs with: `web.preview`, `web.preview_port` (default health_port + 1), `web.preview_origin`. */
+export declare function previewSettings(web: PreviewWebConfig | null | undefined, healthPort: number): PreviewSettings;
+/** scheme://host[:port] for an http(s) URL with nothing else in it; null otherwise. A default port is dropped. */
+export declare function normalizeOrigin(value: string): string | null;
+/**
+ * Why a `web.preview_origin` cannot be used, or null when it can (design §3.1). It must be a bare http(s) origin
+ * (no path, query, credentials or wildcard), and its host must not be one the dashboard answers to — that would be
+ * a same-origin preview by another name.
+ */
+export declare function previewOriginProblem(value: unknown, config: HostGuardConfig | null | undefined): string | null;
+export interface PreviewAvailability {
+    /** The origin the server believes the browser is at (from Host and the TLS signal), or null. */
+    dashboardOrigin: string | null;
+    /** The preview origin for this load, or null: preview disabled for it. */
+    previewOrigin: string | null;
+    /** Why it is disabled, when it is. */
+    reason: string | null;
+}
+/** scheme://host[:port] from a Host header the host guard already accepted; a default port is dropped. */
+export declare function dashboardOriginFor(hostHeader: string | undefined, secure: boolean): string | null;
+/**
+ * For one /ui request: a loopback Host and no preview_origin → the same loopback name on the preview port;
+ * preview_origin set → that; anything else (a tunnel, a proxy, `hostname`, `allowed_hosts`) → disabled.
+ * Only Host is read; X-Forwarded-Host never is.
+ */
+export declare function previewAvailability(settings: PreviewSettings | null, hostHeader: string | undefined, secure: boolean, accepted?: readonly string[]): PreviewAvailability;
+/**
+ * The exact dashboard origins a preview may be framed by, and accept HTML from (design §5.1): the loopback names on
+ * the dashboard's port, plus — when a preview_origin is set — `https://<name>` for each name the dashboard answers to
+ * besides loopback (`hostname`, `web.allowed_hosts`). Never 'self', never *.
+ */
+export declare function dashboardOrigins(settings: PreviewSettings, healthPort: number, config: HostGuardConfig | null | undefined): string[];
+/** The /frame response's Content-Security-Policy (design §5.1): exact, no 'self', no *. */
+export declare function previewFrameCsp(ancestors: readonly string[]): string;
+/**
+ * The shim (design §4): posts `ready` with the listener's boot id; takes ONE `render` — from its parent window, from
+ * an exact listed dashboard origin (never "null"), with exactly {v, type, ch, html}, html ≤ 1 MiB — removes the WebRTC
+ * entry points from its realm (defence in depth only), and writes a heartbeat/height prologue and the HTML into its
+ * own document. Every later message is ignored.
+ */
+export declare function buildShim(bootId: string, origins: readonly string[]): string;
+export interface PreviewListener {
+    readonly server: Server;
+    readonly bootId: string;
+    readonly settings: PreviewSettings;
+    /** The dashboard origins the shim accepts HTML from and may be framed by. */
+    readonly origins: readonly string[];
+    close(): void;
+}
+/**
+ * The preview listener: GET /frame (no query) → the shim with the §5.1 headers; anything else → empty 404; a Host
+ * it does not answer to → empty 403. No X-Frame-Options (it must be framable by the dashboard), no cookie or
+ * header parsing beyond Host, nothing logged per request. Built once: the shim and its headers never change.
+ */
+export declare function createPreviewListener(opts: {
+    settings: PreviewSettings;
+    healthPort: number;
+    config: HostGuardConfig | null | undefined;
+    bootId?: string;
+}): PreviewListener;

package/dist/web-preview.js

@@ -0,0 +1,240 @@
+/**
+ * #1306: the preview listener — where an agent's HTML may run, away from the dashboard's authority.
+ * Design: docs/design/1306-inline-html-preview.md (r3, approved).
+ *
+ * A second loopback listener (default health_port + 1) serves one static document, `GET /frame`: a shim that
+ * receives HTML by postMessage only from the dashboard origins it was built with, and writes it into its own
+ * opaque, sandboxed document. Everything else is an empty 404. It reads no cookie, no header but Host, and logs
+ * nothing about a request. The dashboard decides per /ui load whether a preview origin is reachable from the
+ * browser's address (Host only — never X-Forwarded-Host), and the page re-checks that against location.origin.
+ *
+ * What this does NOT promise: that a preview cannot send data out (WebRTC and self-navigation are known ways
+ * around the restrictions — design §4.3). It promises the account boundary only (G1): the preview cannot act as
+ * the signed-in person.
+ */
+import { randomBytes } from "node:crypto";
+import { createServer } from "node:http";
+import { allowedHostNames, hostnameOf, LOOPBACK_HOST_NAMES } from "./web-host-guard.js";
+/** The most HTML a preview takes (UTF-8 bytes): the parent refuses more before sending, the shim refuses it too. */
+export const PREVIEW_HTML_MAX_BYTES = 1024 * 1024;
+/** The settings a fleet runs with: `web.preview`, `web.preview_port` (default health_port + 1), `web.preview_origin`. */
+export function previewSettings(web, healthPort) {
+    // An ephemeral web listener (port 0: tests, harnesses) gets an ephemeral preview listener; its real port is filled
+    // in once it listens (createPreviewListener). Otherwise the fixed default, so an SSH user can forward it too.
+    const port = typeof web?.preview_port === "number" && Number.isInteger(web.preview_port) ? web.preview_port
+        : healthPort === 0 ? 0 : healthPort + 1 <= 65535 ? healthPort + 1 : null;
+    const origin = typeof web?.preview_origin === "string" ? normalizeOrigin(web.preview_origin) : null;
+    return { enabled: web?.preview !== false, port, origin };
+}
+/** scheme://host[:port] for an http(s) URL with nothing else in it; null otherwise. A default port is dropped. */
+export function normalizeOrigin(value) {
+    let u;
+    try {
+        u = new URL(value.trim());
+    }
+    catch {
+        return null;
+    }
+    if (u.protocol !== "http:" && u.protocol !== "https:")
+        return null;
+    if (u.username || u.password || u.search || u.hash || (u.pathname !== "/" && u.pathname !== ""))
+        return null;
+    if (!u.hostname || u.hostname.includes("*"))
+        return null;
+    // The raw text must not carry a query/fragment marker either ("https://x/?" parses to an empty search).
+    if (/[?#]/.test(value))
+        return null;
+    return u.origin;
+}
+/**
+ * Why a `web.preview_origin` cannot be used, or null when it can (design §3.1). It must be a bare http(s) origin
+ * (no path, query, credentials or wildcard), and its host must not be one the dashboard answers to — that would be
+ * a same-origin preview by another name.
+ */
+export function previewOriginProblem(value, config) {
+    if (typeof value !== "string")
+        return "must be an origin such as https://preview.example.net";
+    const origin = normalizeOrigin(value);
+    if (!origin)
+        return "must be a bare http(s) origin — scheme, host and optional port; no path, query, fragment, credentials or wildcard";
+    const host = hostnameOf(new URL(origin).host);
+    if (!host || allowedHostNames(config).has(host))
+        return "must be a separate host name, not one the dashboard answers to (loopback names, hostname, web.allowed_hosts)";
+    return null;
+}
+const DEFAULT_PORT = { "http:": "80", "https:": "443" };
+/** scheme://host[:port] from a Host header the host guard already accepted; a default port is dropped. */
+export function dashboardOriginFor(hostHeader, secure) {
+    if (typeof hostHeader !== "string" || hostnameOf(hostHeader) === null)
+        return null;
+    const scheme = secure ? "https:" : "http:";
+    try {
+        return new URL(`${scheme}//${hostHeader.trim().toLowerCase()}`).origin;
+    }
+    catch {
+        return null;
+    }
+    // (URL drops a default port: http://x:80 → http://x, so it matches what the browser reports as location.origin.)
+}
+/**
+ * For one /ui request: a loopback Host and no preview_origin → the same loopback name on the preview port;
+ * preview_origin set → that; anything else (a tunnel, a proxy, `hostname`, `allowed_hosts`) → disabled.
+ * Only Host is read; X-Forwarded-Host never is.
+ */
+export function previewAvailability(settings, hostHeader, secure, accepted) {
+    const dashboardOrigin = dashboardOriginFor(hostHeader, secure);
+    const off = (reason) => ({ dashboardOrigin, previewOrigin: null, reason });
+    if (!settings || !settings.enabled)
+        return off("Previews are turned off for this fleet (web.preview: false).");
+    if (!dashboardOrigin)
+        return off("This address cannot be checked.");
+    if (settings.port === null && !settings.origin)
+        return off("Previews have no port: set web.preview_port (health_port is the highest port).");
+    // The page must be at an origin the shim takes HTML from (and that may frame it) — exactly, or a frame would never
+    // render. A name in web.allowed_hosts served on a non-default port must be listed with that port.
+    if (accepted && !accepted.includes(dashboardOrigin))
+        return off(`Previews are not offered at ${dashboardOrigin}: list this address (with its port) in web.allowed_hosts, and set web.preview_origin.`);
+    let preview;
+    if (settings.origin)
+        preview = settings.origin;
+    else {
+        const host = hostnameOf(hostHeader);
+        if (!LOOPBACK_HOST_NAMES.includes(host))
+            return off("Previews need web.preview_origin when the dashboard is reached through a tunnel or proxy.");
+        preview = `http://${host}:${settings.port}`;
+    }
+    // An https page cannot frame an http preview (mixed content).
+    if (dashboardOrigin.startsWith("https:") && preview.startsWith("http:"))
+        return off("Previews need an https web.preview_origin when the dashboard is reached over https.");
+    if (preview === dashboardOrigin)
+        return off("The preview origin cannot be the dashboard's own.");
+    return { dashboardOrigin, previewOrigin: preview, reason: null };
+}
+/**
+ * The exact dashboard origins a preview may be framed by, and accept HTML from (design §5.1): the loopback names on
+ * the dashboard's port, plus — when a preview_origin is set — `https://<name>` for each name the dashboard answers to
+ * besides loopback (`hostname`, `web.allowed_hosts`). Never 'self', never *.
+ */
+export function dashboardOrigins(settings, healthPort, config) {
+    // As the browser writes location.origin: a default port is dropped (http://127.0.0.1:80 → http://127.0.0.1).
+    const origin = (u) => { try {
+        return new URL(u).origin;
+    }
+    catch {
+        return null;
+    } };
+    const out = LOOPBACK_HOST_NAMES.map(h => origin(`http://${h}:${healthPort}`)).filter((o) => !!o);
+    if (settings.origin) {
+        // Each extra dashboard name as written — with its port when it has one (fleet.example.net:8443).
+        const extra = [config?.hostname, ...(Array.isArray(config?.web?.allowed_hosts) ? config.web.allowed_hosts : [])];
+        for (const entry of extra) {
+            if (typeof entry !== "string")
+                continue;
+            const name = hostnameOf(entry);
+            if (!name || LOOPBACK_HOST_NAMES.includes(name))
+                continue;
+            const o = origin(`https://${entry.trim().toLowerCase()}`);
+            if (o)
+                out.push(o);
+        }
+    }
+    return [...new Set(out)];
+}
+// ── The listener ────────────────────────────────────────────────────────────────────────────────────────────
+const PERMISSIONS_POLICY = "camera=(), microphone=(), geolocation=(), clipboard-read=(), clipboard-write=(), usb=(), serial=(), hid=(), bluetooth=(), payment=(), display-capture=(), fullscreen=()";
+/** The /frame response's Content-Security-Policy (design §5.1): exact, no 'self', no *. */
+export function previewFrameCsp(ancestors) {
+    return [
+        "default-src 'none'", "script-src 'unsafe-inline'", "style-src 'unsafe-inline'",
+        "img-src data: blob:", "font-src data:", "media-src data: blob:",
+        "connect-src 'none'", "worker-src 'none'", "frame-src 'none'", "child-src 'none'",
+        "form-action 'none'", "base-uri 'none'", "manifest-src 'none'", "object-src 'none'",
+        "webrtc 'block'",
+        `frame-ancestors ${ancestors.join(" ")}`,
+        "sandbox allow-scripts",
+    ].join("; ");
+}
+/**
+ * The shim (design §4): posts `ready` with the listener's boot id; takes ONE `render` — from its parent window, from
+ * an exact listed dashboard origin (never "null"), with exactly {v, type, ch, html}, html ≤ 1 MiB — removes the WebRTC
+ * entry points from its realm (defence in depth only), and writes a heartbeat/height prologue and the HTML into its
+ * own document. Every later message is ignored.
+ */
+export function buildShim(bootId, origins) {
+    const script = `(function () {
+  "use strict";
+  var BOOT = ${JSON.stringify(bootId)}, ORIGINS = ${JSON.stringify([...origins])}, MAX = ${PREVIEW_HTML_MAX_BYTES};
+  var done = false;
+  function bytes(s) { try { return new TextEncoder().encode(s).length; } catch (e) { return s.length * 3; } }
+  window.addEventListener("message", function (e) {
+    if (done || e.source !== window.parent || ORIGINS.indexOf(e.origin) < 0) return;
+    var d = e.data;
+    if (!d || typeof d !== "object" || Object.getPrototypeOf(d) !== Object.prototype) return;
+    if (Object.keys(d).sort().join(",") !== "ch,html,type,v" || d.v !== 1 || d.type !== "render") return;
+    if (typeof d.ch !== "string" || !/^[0-9a-f]{16,64}$/.test(d.ch) || typeof d.html !== "string" || bytes(d.html) > MAX) return;
+    done = true;
+    ["RTCPeerConnection", "webkitRTCPeerConnection", "RTCDataChannel", "RTCIceTransport", "RTCSctpTransport"].forEach(function (k) {
+      try { delete window[k]; } catch (x) { /* not configurable */ }
+      try { if (window[k]) Object.defineProperty(window, k, { value: undefined, configurable: false, writable: false }); } catch (x) { /* best effort */ }
+    });
+    var prologue = "<script>(function(){var ch=" + JSON.stringify(d.ch) + ",p=window.parent,last=-1;" +
+      "function size(){var h=Math.ceil(Math.max(document.documentElement?document.documentElement.scrollHeight:0,document.body?document.body.scrollHeight:0));" +
+      "if(h!==last){last=h;p.postMessage({v:1,type:\\"resize\\",ch:ch,height:h},\\"*\\");}}" +
+      "setInterval(function(){p.postMessage({v:1,type:\\"heartbeat\\",ch:ch},\\"*\\");},2000);" +
+      "p.postMessage({v:1,type:\\"heartbeat\\",ch:ch},\\"*\\");" +
+      "try{new ResizeObserver(size).observe(document.documentElement);}catch(e){setInterval(size,500);}" +
+      "addEventListener(\\"load\\",size);setTimeout(size,0);})();<\\/script>";
+    document.open();
+    document.write(prologue + d.html);
+    document.close();
+  });
+  window.parent.postMessage({ v: 1, type: "ready", ch: null, boot: BOOT }, "*");
+})();`;
+    return `<!doctype html><html><head><meta charset="utf-8"><title>Preview</title></head><body><script>${script}</script></body></html>`;
+}
+/**
+ * The preview listener: GET /frame (no query) → the shim with the §5.1 headers; anything else → empty 404; a Host
+ * it does not answer to → empty 403. No X-Frame-Options (it must be framable by the dashboard), no cookie or
+ * header parsing beyond Host, nothing logged per request. Built once: the shim and its headers never change.
+ */
+export function createPreviewListener(opts) {
+    const bootId = opts.bootId ?? randomBytes(16).toString("hex");
+    const origins = dashboardOrigins(opts.settings, opts.healthPort, opts.config);
+    const body = Buffer.from(buildShim(bootId, origins), "utf8");
+    const headers = {
+        "Content-Type": "text/html; charset=utf-8",
+        "Content-Security-Policy": previewFrameCsp(origins),
+        "Permissions-Policy": PERMISSIONS_POLICY,
+        "Referrer-Policy": "no-referrer",
+        "Cross-Origin-Resource-Policy": "same-origin",
+        "X-Content-Type-Options": "nosniff",
+        "Cache-Control": "no-store",
+        "Content-Length": String(body.length),
+    };
+    const hosts = new Set(LOOPBACK_HOST_NAMES);
+    if (opts.settings.origin) {
+        const h = hostnameOf(new URL(opts.settings.origin).host);
+        if (h)
+            hosts.add(h);
+    }
+    const empty = (res, status) => {
+        res.writeHead(status, { "Content-Length": "0", "Cache-Control": "no-store", "X-Content-Type-Options": "nosniff", "Referrer-Policy": "no-referrer" });
+        res.end();
+    };
+    const server = createServer((req, res) => {
+        // Host only. The cookie a same-host port receives (cookies are not port-isolated) is never read.
+        const host = typeof req.headers.host === "string" ? hostnameOf(req.headers.host) : null;
+        if (!host || !hosts.has(host))
+            return empty(res, 403);
+        if (req.method !== "GET" || req.url !== "/frame")
+            return empty(res, 404);
+        res.writeHead(200, headers);
+        res.end(body);
+    });
+    const settings = { ...opts.settings };
+    // A listener on port 0 learns its real port when it binds: that is the one a /ui load must be offered.
+    server.on("listening", () => { const a = server.address(); if (a && typeof a === "object")
+        settings.port = a.port; });
+    return { server, bootId, settings, origins, close: () => { server.close(); } };
+}
+//# sourceMappingURL=web-preview.js.map

package/dist/web-preview.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"web-preview.js","sourceRoot":"","sources":["../src/web-preview.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,YAAY,EAA0D,MAAM,WAAW,CAAC;AACjG,OAAO,EAAE,gBAAgB,EAAE,UAAU,EAAE,mBAAmB,EAAwB,MAAM,qBAAqB,CAAC;AAE9G,oHAAoH;AACpH,MAAM,CAAC,MAAM,sBAAsB,GAAG,IAAI,GAAG,IAAI,CAAC;AAiBlD,yHAAyH;AACzH,MAAM,UAAU,eAAe,CAAC,GAAwC,EAAE,UAAkB;IAC1F,mHAAmH;IACnH,8GAA8G;IAC9G,MAAM,IAAI,GAAG,OAAO,GAAG,EAAE,YAAY,KAAK,QAAQ,IAAI,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,YAAY;QACzG,CAAC,CAAC,UAAU,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,GAAG,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,UAAU,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC3E,MAAM,MAAM,GAAG,OAAO,GAAG,EAAE,cAAc,KAAK,QAAQ,CAAC,CAAC,CAAC,eAAe,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACpG,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,OAAO,KAAK,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;AAC3D,CAAC;AAED,kHAAkH;AAClH,MAAM,UAAU,eAAe,CAAC,KAAa;IAC3C,IAAI,CAAM,CAAC;IACX,IAAI,CAAC;QAAC,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,IAAI,CAAC;IAAC,CAAC;IACzD,IAAI,CAAC,CAAC,QAAQ,KAAK,OAAO,IAAI,CAAC,CAAC,QAAQ,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACnE,IAAI,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,QAAQ,KAAK,GAAG,IAAI,CAAC,CAAC,QAAQ,KAAK,EAAE,CAAC;QAAE,OAAO,IAAI,CAAC;IAC7G,IAAI,CAAC,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACzD,wGAAwG;IACxG,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACpC,OAAO,CAAC,CAAC,MAAM,CAAC;AAClB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,oBAAoB,CAAC,KAAc,EAAE,MAA0C;IAC7F,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,uDAAuD,CAAC;IAC9F,MAAM,MAAM,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC;IACtC,IAAI,CAAC,MAAM;QAAE,OAAO,mHAAmH,CAAC;IACxI,MAAM,IAAI,GAAG,UAAU,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC;IAC9C,IAAI,CAAC,IAAI,IAAI,gBAAgB,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC;QAAE,OAAO,8GAA8G,CAAC;IACvK,OAAO,IAAI,CAAC;AACd,CAAC;AAaD,MAAM,YAAY,GAA2B,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AAEhF,0GAA0G;AAC1G,MAAM,UAAU,kBAAkB,CAAC,UAA8B,EAAE,MAAe;IAChF,IAAI,OAAO,UAAU,KAAK,QAAQ,IAAI,UAAU,CAAC,UAAU,CAAC,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IACnF,MAAM,MAAM,GAAG,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC;IAC3C,IAAI,CAAC;QAAC,OAAO,IAAI,GAAG,CAAC,GAAG,MAAM,KAAK,UAAU,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,IAAI,CAAC;IAAC,CAAC;IACtG,iHAAiH;AACnH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,mBAAmB,CAAC,QAAgC,EAAE,UAA8B,EAAE,MAAe,EAAE,QAA4B;IACjJ,MAAM,eAAe,GAAG,kBAAkB,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;IAC/D,MAAM,GAAG,GAAG,CAAC,MAAc,EAAuB,EAAE,CAAC,CAAC,EAAE,eAAe,EAAE,aAAa,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;IACxG,IAAI,CAAC,QAAQ,IAAI,CAAC,QAAQ,CAAC,OAAO;QAAE,OAAO,GAAG,CAAC,8DAA8D,CAAC,CAAC;IAC/G,IAAI,CAAC,eAAe;QAAE,OAAO,GAAG,CAAC,iCAAiC,CAAC,CAAC;IACpE,IAAI,QAAQ,CAAC,IAAI,KAAK,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM;QAAE,OAAO,GAAG,CAAC,gFAAgF,CAAC,CAAC;IAC7I,mHAAmH;IACnH,kGAAkG;IAClG,IAAI,QAAQ,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,eAAe,CAAC;QAAE,OAAO,GAAG,CAAC,+BAA+B,eAAe,uFAAuF,CAAC,CAAC;IACvM,IAAI,OAAe,CAAC;IACpB,IAAI,QAAQ,CAAC,MAAM;QAAE,OAAO,GAAG,QAAQ,CAAC,MAAM,CAAC;SAC1C,CAAC;QACJ,MAAM,IAAI,GAAG,UAAU,CAAC,UAAW,CAAE,CAAC;QACtC,IAAI,CAAC,mBAAmB,CAAC,QAAQ,CAAC,IAAI,CAAC;YAAE,OAAO,GAAG,CAAC,2FAA2F,CAAC,CAAC;QACjJ,OAAO,GAAG,UAAU,IAAI,IAAI,QAAQ,CAAC,IAAI,EAAE,CAAC;IAC9C,CAAC;IACD,8DAA8D;IAC9D,IAAI,eAAe,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC;QAAE,OAAO,GAAG,CAAC,qFAAqF,CAAC,CAAC;IAC3K,IAAI,OAAO,KAAK,eAAe;QAAE,OAAO,GAAG,CAAC,mDAAmD,CAAC,CAAC;IACjG,OAAO,EAAE,eAAe,EAAE,aAAa,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;AACnE,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAAC,QAAyB,EAAE,UAAkB,EAAE,MAA0C;IACxH,6GAA6G;IAC7G,MAAM,MAAM,GAAG,CAAC,CAAS,EAAiB,EAAE,GAAG,IAAI,CAAC;QAAC,OAAO,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,IAAI,CAAC;IAAC,CAAC,CAAC,CAAC,CAAC;IAC1G,MAAM,GAAG,GAAG,mBAAmB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,UAAU,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC9G,IAAI,QAAQ,CAAC,MAAM,EAAE,CAAC;QACpB,iGAAiG;QACjG,MAAM,KAAK,GAAG,CAAC,MAAM,EAAE,QAAQ,EAAE,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,EAAE,aAAa,CAAC,CAAC,CAAC,CAAC,MAAO,CAAC,GAAI,CAAC,aAA0B,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QAChI,KAAK,MAAM,KAAK,IAAI,KAAK,EAAE,CAAC;YAC1B,IAAI,OAAO,KAAK,KAAK,QAAQ;gBAAE,SAAS;YACxC,MAAM,IAAI,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC;YAC/B,IAAI,CAAC,IAAI,IAAI,mBAAmB,CAAC,QAAQ,CAAC,IAAI,CAAC;gBAAE,SAAS;YAC1D,MAAM,CAAC,GAAG,MAAM,CAAC,WAAW,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;YAC1D,IAAI,CAAC;gBAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACrB,CAAC;IACH,CAAC;IACD,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;AAC3B,CAAC;AAED,+GAA+G;AAE/G,MAAM,kBAAkB,GAAG,yKAAyK,CAAC;AAErM,2FAA2F;AAC3F,MAAM,UAAU,eAAe,CAAC,SAA4B;IAC1D,OAAO;QACL,oBAAoB,EAAE,4BAA4B,EAAE,2BAA2B;QAC/E,qBAAqB,EAAE,gBAAgB,EAAE,uBAAuB;QAChE,oBAAoB,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,kBAAkB;QACjF,oBAAoB,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,mBAAmB;QACnF,gBAAgB;QAChB,mBAAmB,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE;QACxC,uBAAuB;KACxB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,SAAS,CAAC,MAAc,EAAE,OAA0B;IAClE,MAAM,MAAM,GAAG;;eAEF,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,eAAe,IAAI,CAAC,SAAS,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,WAAW,sBAAsB;;;;;;;;;;;;;;;;;;;;;;;;;;MA0B3G,CAAC;IACL,OAAO,+FAA+F,MAAM,yBAAyB,CAAC;AACxI,CAAC;AAWD;;;;GAIG;AACH,MAAM,UAAU,qBAAqB,CAAC,IAAoH;IACxJ,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC9D,MAAM,OAAO,GAAG,gBAAgB,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;IAC9E,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,CAAC;IAC7D,MAAM,OAAO,GAA2B;QACtC,cAAc,EAAE,0BAA0B;QAC1C,yBAAyB,EAAE,eAAe,CAAC,OAAO,CAAC;QACnD,oBAAoB,EAAE,kBAAkB;QACxC,iBAAiB,EAAE,aAAa;QAChC,8BAA8B,EAAE,aAAa;QAC7C,wBAAwB,EAAE,SAAS;QACnC,eAAe,EAAE,UAAU;QAC3B,gBAAgB,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC;KACtC,CAAC;IACF,MAAM,KAAK,GAAG,IAAI,GAAG,CAAS,mBAAmB,CAAC,CAAC;IACnD,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC;QAAC,MAAM,CAAC,GAAG,UAAU,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC;QAAC,IAAI,CAAC;YAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IAAC,CAAC;IAC5G,MAAM,KAAK,GAAG,CAAC,GAAmB,EAAE,MAAc,EAAE,EAAE;QACpD,GAAG,CAAC,SAAS,CAAC,MAAM,EAAE,EAAE,gBAAgB,EAAE,GAAG,EAAE,eAAe,EAAE,UAAU,EAAE,wBAAwB,EAAE,SAAS,EAAE,iBAAiB,EAAE,aAAa,EAAE,CAAC,CAAC;QACrJ,GAAG,CAAC,GAAG,EAAE,CAAC;IACZ,CAAC,CAAC;IACF,MAAM,MAAM,GAAG,YAAY,CAAC,CAAC,GAAoB,EAAE,GAAmB,EAAE,EAAE;QACxE,iGAAiG;QACjG,MAAM,IAAI,GAAG,OAAO,GAAG,CAAC,OAAO,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QACxF,IAAI,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,OAAO,KAAK,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACtD,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,IAAI,GAAG,CAAC,GAAG,KAAK,QAAQ;YAAE,OAAO,KAAK,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACzE,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QAC5B,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAChB,CAAC,CAAC,CAAC;IACH,MAAM,QAAQ,GAAoB,EAAE,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAC;IACvD,uGAAuG;IACvG,MAAM,CAAC,EAAE,CAAC,WAAW,EAAE,GAAG,EAAE,GAAG,MAAM,CAAC,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ;QAAE,QAAQ,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IACtH,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;AACjF,CAAC"}

package/dist/web-request-context.d.ts

@@ -0,0 +1,10 @@
+/** Listener-owned provenance. HTTP headers can never select a public surface. */
+export interface GatewayRequestContext {
+    readonly surface: "gateway";
+    readonly exposureId: string;
+    readonly expectedOrigin: string;
+    readonly isCurrent: () => boolean;
+}
+export declare function bindGatewayRequest(req: object, context: GatewayRequestContext): void;
+export declare function gatewayRequestContext(req: object): GatewayRequestContext | undefined;
+export declare function isWebRequestCurrent(req: object): boolean;

package/dist/web-request-context.js

@@ -0,0 +1,13 @@
+const contexts = new WeakMap();
+export function bindGatewayRequest(req, context) {
+    if (contexts.has(req))
+        throw new Error("request context already bound");
+    contexts.set(req, Object.freeze({ ...context }));
+}
+export function gatewayRequestContext(req) {
+    return contexts.get(req);
+}
+export function isWebRequestCurrent(req) {
+    return contexts.get(req)?.isCurrent() ?? true;
+}
+//# sourceMappingURL=web-request-context.js.map

package/dist/web-request-context.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"web-request-context.js","sourceRoot":"","sources":["../src/web-request-context.ts"],"names":[],"mappings":"AAOA,MAAM,QAAQ,GAAG,IAAI,OAAO,EAAiC,CAAC;AAC9D,MAAM,UAAU,kBAAkB,CAAC,GAAW,EAAE,OAA8B;IAC5E,IAAI,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;IACxE,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,OAAO,EAAE,CAAC,CAAC,CAAC;AACnD,CAAC;AACD,MAAM,UAAU,qBAAqB,CAAC,GAAW;IAC/C,OAAO,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;AAC3B,CAAC;AACD,MAAM,UAAU,mBAAmB,CAAC,GAAW;IAC7C,OAAO,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,SAAS,EAAE,IAAI,IAAI,CAAC;AAChD,CAAC"}