@stigmer/server 3.14.0-dev.20260910084630

package/dist/transport/console/handler.js

@@ -0,0 +1,252 @@
+/**
+ * The console lane — lane 4 of the unified port (DD-005; DD-012 in the
+ * parent program's records): serves the web console's static export and
+ * synthesizes its runtime /config.json, restoring the local console the
+ * June CLI migration lost. Routing decisions live in resolver.ts (pure,
+ * nginx-equivalence-gated); this module owns the HTTP half: the lane
+ * guard, header policy, config synthesis, and file streaming.
+ *
+ * Lane guard (consoleLaneEligible): the lane claims GET/HEAD only — RPC
+ * traffic is POST on service-qualified paths, and OPTIONS preflights keep
+ * flowing to the RPC lane's CORS handling — and it never claims:
+ *   - `/v1/*`: the registry/skill lanes' namespace; unknown paths there
+ *     must keep reaching the adapter's 404 (the CW-10 pinned contract).
+ *   - service-shaped paths (`/<package.Service>/<Method>` — exactly two
+ *     segments with a dotted first): even though no RPC answers GET today
+ *     (zero no_side_effects methods), the adapter must stay the authority
+ *     for its own namespace if one ever does.
+ *
+ * Header policy follows nginx.conf's four explicit postures byte-for-byte
+ * (immutable /_next/static/, no-cache index.html, no-store config.json,
+ * max-age=300 embed.js). Everything else is served `no-cache` — a
+ * deliberate divergence from nginx, which falls back to default validator
+ * behavior (ETag/Last-Modified) this handler does not emit; no-cache
+ * keeps every document fresh across server upgrades at the cost of
+ * revalidating tiny files, while the heavy assets all live under the
+ * immutable /_next/static/ rule.
+ */
+import { createReadStream } from "node:fs";
+import { stat } from "node:fs/promises";
+import path from "node:path";
+import { resolveConsoleRequest } from "./resolver.js";
+/** The runtime-config route the ConfigGate fetches before first render. */
+const CONFIG_JSON_PATH = "/config.json";
+/** nginx: runtime config must never be cached (config changes propagate immediately). */
+const CONFIG_JSON_CACHE_CONTROL = "no-cache, no-store, must-revalidate";
+/** nginx: Next.js hashed assets are safe to cache indefinitely. */
+const IMMUTABLE_CACHE_CONTROL = "public, max-age=31536000, immutable";
+/** nginx: the embed loader rides an unversioned URL; a short TTL lets fixes reach embedders in minutes. */
+const EMBED_JS_CACHE_CONTROL = "public, max-age=300";
+/** Everything else (see the module header for the divergence rationale). */
+const DEFAULT_CACHE_CONTROL = "no-cache";
+/**
+ * Whether the console lane may claim this request. Exported for the lane
+ * router (server.ts), which stays a thin if-chain — the guard's knowledge
+ * of RPC path shapes belongs to this module.
+ */
+export function consoleLaneEligible(request) {
+    if (request.method !== "GET" && request.method !== "HEAD") {
+        return false;
+    }
+    const pathname = (request.url ?? "").split("?", 1)[0] ?? "";
+    if (pathname === "" || !pathname.startsWith("/")) {
+        return false;
+    }
+    if (pathname.startsWith("/v1/")) {
+        return false;
+    }
+    return !isServiceShapedPath(pathname);
+}
+/** `/<package.Service>/<Method>` — exactly two segments, dotted first. */
+function isServiceShapedPath(pathname) {
+    const segments = pathname.split("/").filter((segment) => segment !== "");
+    return segments.length === 2 && (segments[0] ?? "").includes(".");
+}
+export function createConsoleLane(options) {
+    const { assets, grpcPort, logger } = options;
+    return (request, response) => {
+        const url = request.url ?? "";
+        const queryStart = url.indexOf("?");
+        const rawPath = queryStart === -1 ? url : url.slice(0, queryStart);
+        const query = queryStart === -1 ? "" : url.slice(queryStart);
+        if (rawPath === CONFIG_JSON_PATH) {
+            serveConfigJson(request, response, grpcPort);
+            return;
+        }
+        let pathname;
+        try {
+            pathname = decodeURIComponent(rawPath);
+        }
+        catch {
+            // Malformed percent-escapes are a client error (the artifact file
+            // server's posture); the export's own 404 document still answers.
+            serveNotFound(request, response, assets, logger);
+            return;
+        }
+        const resolution = resolveConsoleRequest(pathname, assets.index);
+        switch (resolution.kind) {
+            case "redirect":
+                // Relative Location (nginx absolute_redirect off: an absolute form
+                // would embed this listener's port, wrong behind any proxy). The
+                // query rides through, as nginx's `$is_args$args` spells out.
+                response.statusCode = 301;
+                response.setHeader("Location", `${resolution.location}${query}`);
+                response.end();
+                return;
+            case "file":
+                serveFile(request, response, assets, resolution.file, 200, logger);
+                return;
+            case "notFound":
+                serveNotFound(request, response, assets, logger);
+                return;
+            default: {
+                const exhaustive = resolution;
+                throw new Error(`unhandled resolution ${String(exhaustive)}`);
+            }
+        }
+    };
+}
+/**
+ * The runtime config the cloud container's entrypoint.sh generates from
+ * env — synthesized here from the server's own knowledge instead (DD-012:
+ * the nginx entrypoint script is not ported). apiUrl derives from the
+ * request's own Host so the answer is correct wherever the browser
+ * reached us from (localhost, a LAN address, a self-host name) — the
+ * console cannot express "same origin" itself (its config loader maps
+ * empty fields to a localhost default). TLS-terminating proxies
+ * (x-forwarded-proto) are out of scope until a tier serves TLS.
+ */
+function serveConfigJson(request, response, grpcPort) {
+    // HTTP/1.1 carries Host; Node maps HTTP/2's :authority into the same
+    // headers view (and Http2ServerRequest.authority falls back to it).
+    const host = request.headers.host ?? request.headers[":authority"];
+    const apiUrl = typeof host === "string" && host !== ""
+        ? `http://${host}`
+        : `http://localhost:${grpcPort}`;
+    const body = JSON.stringify({
+        apiUrl,
+        appUrl: "",
+        authMode: "disabled",
+        oidcIssuer: "",
+        oidcClientId: "",
+        oidcAudience: "",
+    });
+    response.statusCode = 200;
+    response.setHeader("Content-Type", "application/json");
+    response.setHeader("Cache-Control", CONFIG_JSON_CACHE_CONTROL);
+    response.setHeader("Content-Length", String(Buffer.byteLength(body)));
+    if (request.method === "HEAD") {
+        response.end();
+        return;
+    }
+    response.end(body);
+}
+function serveNotFound(request, response, assets, logger) {
+    // The export's real not-found page, WITH the 404 status (nginx
+    // error_page semantics) — never the blank app shell, and never the
+    // adapter's terse 404 once a console is bundled.
+    if (assets.index.hasFile("/404.html")) {
+        serveFile(request, response, assets, "/404.html", 404, logger);
+        return;
+    }
+    response.statusCode = 404;
+    response.end("404 page not found\n");
+}
+function serveFile(request, response, assets, file, statusCode, logger) {
+    // Containment by construction: `file` is an INDEX member (produced by
+    // the boot-time scan), never raw request input — a traversal path can
+    // only miss the index and 404 in the resolver. The join below therefore
+    // cannot escape the asset root.
+    const filePath = path.join(assets.root, ...file.split("/").filter(Boolean));
+    streamFile(request, response, file, filePath, statusCode).catch((error) => {
+        // Detached-async terminal catch (the skill transfer lane's
+        // load-bearing pattern): an escape here would be process-fatal.
+        logger.error("console lane failed to serve file", {
+            file,
+            error: error instanceof Error ? error.message : String(error),
+        });
+        if (!response.headersSent) {
+            response.statusCode = 500;
+        }
+        response.end();
+    });
+}
+async function streamFile(request, response, file, filePath, statusCode) {
+    // The index said the file exists; a stat failure means the artifact was
+    // mutilated underneath us — the terminal catch answers 500.
+    const info = await stat(filePath);
+    response.statusCode = statusCode;
+    response.setHeader("Content-Type", contentTypeOf(file));
+    response.setHeader("Cache-Control", cacheControlOf(file, statusCode));
+    response.setHeader("Content-Length", String(info.size));
+    if (request.method === "HEAD") {
+        response.end();
+        return;
+    }
+    await new Promise((resolve, reject) => {
+        const stream = createReadStream(filePath);
+        stream.on("error", (error) => {
+            response.destroy();
+            reject(error);
+        });
+        response.on("close", () => resolve());
+        stream.pipe(response);
+    });
+}
+/**
+ * Cache policy keyed on the SERVED document (nginx keys locations on the
+ * request URI, but its internal try_files redirects re-enter location
+ * matching, so the effective key is the final document there too).
+ * nginx's explicit `index.html → no-cache` rule is subsumed by the
+ * default here. Only 200 responses carry cache headers beyond the
+ * default — nginx's add_header skips error statuses, and a cached 404
+ * page would mask a later upgrade that adds the route.
+ */
+function cacheControlOf(file, statusCode) {
+    if (statusCode !== 200) {
+        return DEFAULT_CACHE_CONTROL;
+    }
+    if (file.startsWith("/_next/static/")) {
+        return IMMUTABLE_CACHE_CONTROL;
+    }
+    if (file === "/embed.js") {
+        return EMBED_JS_CACHE_CONTROL;
+    }
+    return DEFAULT_CACHE_CONTROL;
+}
+/**
+ * Explicit type map: the artifact file server deliberately omits
+ * Content-Type (clients sniff), but a BROWSER document target must be
+ * typed — an untyped .html deep link would download instead of render.
+ * Extensions are the export's observed inventory; unknowns fall back to
+ * octet-stream rather than guessing.
+ */
+const CONTENT_TYPES = {
+    ".html": "text/html; charset=utf-8",
+    ".js": "text/javascript; charset=utf-8",
+    ".mjs": "text/javascript; charset=utf-8",
+    ".css": "text/css; charset=utf-8",
+    ".json": "application/json",
+    ".map": "application/json",
+    ".txt": "text/plain; charset=utf-8",
+    ".svg": "image/svg+xml",
+    ".png": "image/png",
+    ".ico": "image/x-icon",
+    ".jpg": "image/jpeg",
+    ".jpeg": "image/jpeg",
+    ".gif": "image/gif",
+    ".webp": "image/webp",
+    ".avif": "image/avif",
+    ".woff": "font/woff",
+    ".woff2": "font/woff2",
+    ".ttf": "font/ttf",
+    ".otf": "font/otf",
+    ".wasm": "application/wasm",
+    ".xml": "application/xml",
+    ".webmanifest": "application/manifest+json",
+};
+function contentTypeOf(file) {
+    const extension = path.posix.extname(file).toLowerCase();
+    return CONTENT_TYPES[extension] ?? "application/octet-stream";
+}
+//# sourceMappingURL=handler.js.map

package/dist/transport/console/handler.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"handler.js","sourceRoot":"","sources":["../../../src/transport/console/handler.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,OAAO,EAAE,gBAAgB,EAAE,MAAM,SAAS,CAAC;AAC3C,OAAO,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AACxC,OAAO,IAAI,MAAM,WAAW,CAAC;AAK7B,OAAO,EAAE,qBAAqB,EAAE,MAAM,eAAe,CAAC;AAEtD,2EAA2E;AAC3E,MAAM,gBAAgB,GAAG,cAAc,CAAC;AAExC,yFAAyF;AACzF,MAAM,yBAAyB,GAAG,qCAAqC,CAAC;AAExE,mEAAmE;AACnE,MAAM,uBAAuB,GAAG,qCAAqC,CAAC;AAEtE,2GAA2G;AAC3G,MAAM,sBAAsB,GAAG,qBAAqB,CAAC;AAErD,4EAA4E;AAC5E,MAAM,qBAAqB,GAAG,UAAU,CAAC;AAEzC;;;;GAIG;AACH,MAAM,UAAU,mBAAmB,CAAC,OAAoB;IACtD,IAAI,OAAO,CAAC,MAAM,KAAK,KAAK,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;QAC1D,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,QAAQ,GAAG,CAAC,OAAO,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAC5D,IAAI,QAAQ,KAAK,EAAE,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACjD,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;QAChC,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,CAAC,mBAAmB,CAAC,QAAQ,CAAC,CAAC;AACxC,CAAC;AAED,0EAA0E;AAC1E,SAAS,mBAAmB,CAAC,QAAgB;IAC3C,MAAM,QAAQ,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,KAAK,EAAE,CAAC,CAAC;IACzE,OAAO,QAAQ,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;AACpE,CAAC;AAYD,MAAM,UAAU,iBAAiB,CAAC,OAA2B;IAC3D,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC;IAE7C,OAAO,CAAC,OAAoB,EAAE,QAAsB,EAAQ,EAAE;QAC5D,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,EAAE,CAAC;QAC9B,MAAM,UAAU,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACpC,MAAM,OAAO,GAAG,UAAU,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC;QACnE,MAAM,KAAK,GAAG,UAAU,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;QAE7D,IAAI,OAAO,KAAK,gBAAgB,EAAE,CAAC;YACjC,eAAe,CAAC,OAAO,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;YAC7C,OAAO;QACT,CAAC;QAED,IAAI,QAAgB,CAAC;QACrB,IAAI,CAAC;YACH,QAAQ,GAAG,kBAAkB,CAAC,OAAO,CAAC,CAAC;QACzC,CAAC;QAAC,MAAM,CAAC;YACP,kEAAkE;YAClE,kEAAkE;YAClE,aAAa,CAAC,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;YACjD,OAAO;QACT,CAAC;QAED,MAAM,UAAU,GAAG,qBAAqB,CAAC,QAAQ,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;QACjE,QAAQ,UAAU,CAAC,IAAI,EAAE,CAAC;YACxB,KAAK,UAAU;gBACb,mEAAmE;gBACnE,iEAAiE;gBACjE,8DAA8D;gBAC9D,QAAQ,CAAC,UAAU,GAAG,GAAG,CAAC;gBAC1B,QAAQ,CAAC,SAAS,CAAC,UAAU,EAAE,GAAG,UAAU,CAAC,QAAQ,GAAG,KAAK,EAAE,CAAC,CAAC;gBACjE,QAAQ,CAAC,GAAG,EAAE,CAAC;gBACf,OAAO;YACT,KAAK,MAAM;gBACT,SAAS,CAAC,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,CAAC,IAAI,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC;gBACnE,OAAO;YACT,KAAK,UAAU;gBACb,aAAa,CAAC,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;gBACjD,OAAO;YACT,OAAO,CAAC,CAAC,CAAC;gBACR,MAAM,UAAU,GAAU,UAAU,CAAC;gBACrC,MAAM,IAAI,KAAK,CAAC,wBAAwB,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;YAChE,CAAC;QACH,CAAC;IACH,CAAC,CAAC;AACJ,CAAC;AAED;;;;;;;;;GASG;AACH,SAAS,eAAe,CACtB,OAAoB,EACpB,QAAsB,EACtB,QAAgB;IAEhB,qEAAqE;IACrE,oEAAoE;IACpE,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;IACnE,MAAM,MAAM,GACV,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,EAAE;QACrC,CAAC,CAAC,UAAU,IAAI,EAAE;QAClB,CAAC,CAAC,oBAAoB,QAAQ,EAAE,CAAC;IACrC,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC;QAC1B,MAAM;QACN,MAAM,EAAE,EAAE;QACV,QAAQ,EAAE,UAAU;QACpB,UAAU,EAAE,EAAE;QACd,YAAY,EAAE,EAAE;QAChB,YAAY,EAAE,EAAE;KACjB,CAAC,CAAC;IACH,QAAQ,CAAC,UAAU,GAAG,GAAG,CAAC;IAC1B,QAAQ,CAAC,SAAS,CAAC,cAAc,EAAE,kBAAkB,CAAC,CAAC;IACvD,QAAQ,CAAC,SAAS,CAAC,eAAe,EAAE,yBAAyB,CAAC,CAAC;IAC/D,QAAQ,CAAC,SAAS,CAAC,gBAAgB,EAAE,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACtE,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;QAC9B,QAAQ,CAAC,GAAG,EAAE,CAAC;QACf,OAAO;IACT,CAAC;IACD,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;AACrB,CAAC;AAED,SAAS,aAAa,CACpB,OAAoB,EACpB,QAAsB,EACtB,MAAqB,EACrB,MAAc;IAEd,+DAA+D;IAC/D,mEAAmE;IACnE,iDAAiD;IACjD,IAAI,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,CAAC;QACtC,SAAS,CAAC,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,WAAW,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC;QAC/D,OAAO;IACT,CAAC;IACD,QAAQ,CAAC,UAAU,GAAG,GAAG,CAAC;IAC1B,QAAQ,CAAC,GAAG,CAAC,sBAAsB,CAAC,CAAC;AACvC,CAAC;AAED,SAAS,SAAS,CAChB,OAAoB,EACpB,QAAsB,EACtB,MAAqB,EACrB,IAAY,EACZ,UAAkB,EAClB,MAAc;IAEd,sEAAsE;IACtE,sEAAsE;IACtE,wEAAwE;IACxE,gCAAgC;IAChC,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;IAE5E,UAAU,CAAC,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAC,KAAK,CAC7D,CAAC,KAAc,EAAE,EAAE;QACjB,2DAA2D;QAC3D,gEAAgE;QAChE,MAAM,CAAC,KAAK,CAAC,mCAAmC,EAAE;YAChD,IAAI;YACJ,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;SAC9D,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;YAC1B,QAAQ,CAAC,UAAU,GAAG,GAAG,CAAC;QAC5B,CAAC;QACD,QAAQ,CAAC,GAAG,EAAE,CAAC;IACjB,CAAC,CACF,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,UAAU,CACvB,OAAoB,EACpB,QAAsB,EACtB,IAAY,EACZ,QAAgB,EAChB,UAAkB;IAElB,wEAAwE;IACxE,4DAA4D;IAC5D,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,CAAC;IAClC,QAAQ,CAAC,UAAU,GAAG,UAAU,CAAC;IACjC,QAAQ,CAAC,SAAS,CAAC,cAAc,EAAE,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC;IACxD,QAAQ,CAAC,SAAS,CAAC,eAAe,EAAE,cAAc,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC,CAAC;IACtE,QAAQ,CAAC,SAAS,CAAC,gBAAgB,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IACxD,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;QAC9B,QAAQ,CAAC,GAAG,EAAE,CAAC;QACf,OAAO;IACT,CAAC;IACD,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QAC1C,MAAM,MAAM,GAAG,gBAAgB,CAAC,QAAQ,CAAC,CAAC;QAC1C,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE;YAC3B,QAAQ,CAAC,OAAO,EAAE,CAAC;YACnB,MAAM,CAAC,KAAK,CAAC,CAAC;QAChB,CAAC,CAAC,CAAC;QACH,QAAQ,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC;QACtC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACxB,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,cAAc,CAAC,IAAY,EAAE,UAAkB;IACtD,IAAI,UAAU,KAAK,GAAG,EAAE,CAAC;QACvB,OAAO,qBAAqB,CAAC;IAC/B,CAAC;IACD,IAAI,IAAI,CAAC,UAAU,CAAC,gBAAgB,CAAC,EAAE,CAAC;QACtC,OAAO,uBAAuB,CAAC;IACjC,CAAC;IACD,IAAI,IAAI,KAAK,WAAW,EAAE,CAAC;QACzB,OAAO,sBAAsB,CAAC;IAChC,CAAC;IACD,OAAO,qBAAqB,CAAC;AAC/B,CAAC;AAED;;;;;;GAMG;AACH,MAAM,aAAa,GAAqC;IACtD,OAAO,EAAE,0BAA0B;IACnC,KAAK,EAAE,gCAAgC;IACvC,MAAM,EAAE,gCAAgC;IACxC,MAAM,EAAE,yBAAyB;IACjC,OAAO,EAAE,kBAAkB;IAC3B,MAAM,EAAE,kBAAkB;IAC1B,MAAM,EAAE,2BAA2B;IACnC,MAAM,EAAE,eAAe;IACvB,MAAM,EAAE,WAAW;IACnB,MAAM,EAAE,cAAc;IACtB,MAAM,EAAE,YAAY;IACpB,OAAO,EAAE,YAAY;IACrB,MAAM,EAAE,WAAW;IACnB,OAAO,EAAE,YAAY;IACrB,OAAO,EAAE,YAAY;IACrB,OAAO,EAAE,WAAW;IACpB,QAAQ,EAAE,YAAY;IACtB,MAAM,EAAE,UAAU;IAClB,MAAM,EAAE,UAAU;IAClB,OAAO,EAAE,kBAAkB;IAC3B,MAAM,EAAE,iBAAiB;IACzB,cAAc,EAAE,2BAA2B;CAC5C,CAAC;AAEF,SAAS,aAAa,CAAC,IAAY;IACjC,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC;IACzD,OAAO,aAAa,CAAC,SAAS,CAAC,IAAI,0BAA0B,CAAC;AAChE,CAAC"}

package/dist/transport/console/resolver.d.ts

@@ -0,0 +1,66 @@
+/**
+ * The console static-export route resolver — the PURE routing half of the
+ * unified port's console lane (DD-005 lane 4; DD-012 in the parent
+ * program's records). Given a decoded request path and an index of the
+ * export's files, it answers WHICH document serves — no I/O, so the
+ * contract is exhaustively unit-testable and machine-checkable against
+ * the nginx model (see __tests__/nginx-equivalence.test.ts).
+ *
+ * The contract merges the correct half of each prior implementation:
+ *
+ * - PAGE resolution reproduces client-apps/web/nginx.conf (the cloud
+ *   serving rules, hardened after the channel-conversations F-12
+ *   blank-page failures): try the literal file, its `.html` sibling, the
+ *   directory index, then the Next.js `__placeholder__.html` candidates —
+ *   most-literal first, at most two trailing dynamic segments — and
+ *   unknown URLs land on /404.html WITH a 404 status, never the blank app
+ *   shell. Trailing slashes 301 to the canonical slashless URL.
+ *   scripts/verify-static-export-routes.mjs holds nginx.conf and the route
+ *   tree together; the equivalence test holds THIS resolver to the same
+ *   model, so the two serving paths cannot drift.
+ *
+ * - RSC FLIGHT resolution restores the retired Go CLI handler's rewrites
+ *   (client-apps/cli/embedded/webconsole/handler.go at 8dc9df7e4~1,
+ *   deleted with the June CLI migration): a soft navigation to a dynamic
+ *   route fetches `<path>.txt` (and nested `<path>/__next.*.txt`) flight
+ *   payloads that exist on disk only in `__placeholder__` form. nginx
+ *   never handled these (filed as a cloud-side follow-up); without the
+ *   rewrite every soft navigation to a dynamic route degrades to a full
+ *   page load. Formulated here as "resolve the stem as a page, serve the
+ *   resolved document's twin" — one candidate discipline for both
+ *   contracts, which also covers the two-dynamic-segment routes the Go
+ *   handler's single-substitution loop predated.
+ */
+/**
+ * The export's files and the directories they imply, both as "/"-rooted,
+ * "/"-separated paths (e.g. "/sessions/__placeholder__.html"). Built once
+ * per asset root by {@link buildConsoleFileIndex}; filesystem separators
+ * are the serving layer's concern, never the resolver's.
+ */
+export interface ConsoleFileIndex {
+    hasFile(path: string): boolean;
+    hasDirectory(path: string): boolean;
+}
+export declare function buildConsoleFileIndex(files: Iterable<string>): ConsoleFileIndex;
+export type ConsoleResolution = 
+/** 301 to the canonical URL (the handler carries the query through). */
+{
+    readonly kind: "redirect";
+    readonly location: string;
+}
+/** Serve this export file with a 200. */
+ | {
+    readonly kind: "file";
+    readonly file: string;
+}
+/** Serve /404.html (when the export has one) WITH a 404 status. */
+ | {
+    readonly kind: "notFound";
+};
+/**
+ * Resolve a decoded, query-less request path against the export index.
+ * Redirects resolve one step per call, exactly as nginx's single
+ * `^(.+)/$` rewrite does — the client (or a test) follows them.
+ */
+export declare function resolveConsoleRequest(pathname: string, index: ConsoleFileIndex): ConsoleResolution;
+//# sourceMappingURL=resolver.d.ts.map

package/dist/transport/console/resolver.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolver.d.ts","sourceRoot":"","sources":["../../../src/transport/console/resolver.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAQH;;;;;GAKG;AACH,MAAM,WAAW,gBAAgB;IAC/B,OAAO,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC;IAC/B,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC;CACrC;AAED,wBAAgB,qBAAqB,CACnC,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,GACtB,gBAAgB,CAoBlB;AAED,MAAM,MAAM,iBAAiB;AAC3B,wEAAwE;AACtE;IAAE,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;CAAE;AAC1D,yCAAyC;GACvC;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE;AAClD,mEAAmE;GACjE;IAAE,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAA;CAAE,CAAC;AAElC;;;;GAIG;AACH,wBAAgB,qBAAqB,CACnC,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,gBAAgB,GACtB,iBAAiB,CAuDnB"}

package/dist/transport/console/resolver.js

@@ -0,0 +1,163 @@
+/**
+ * The console static-export route resolver — the PURE routing half of the
+ * unified port's console lane (DD-005 lane 4; DD-012 in the parent
+ * program's records). Given a decoded request path and an index of the
+ * export's files, it answers WHICH document serves — no I/O, so the
+ * contract is exhaustively unit-testable and machine-checkable against
+ * the nginx model (see __tests__/nginx-equivalence.test.ts).
+ *
+ * The contract merges the correct half of each prior implementation:
+ *
+ * - PAGE resolution reproduces client-apps/web/nginx.conf (the cloud
+ *   serving rules, hardened after the channel-conversations F-12
+ *   blank-page failures): try the literal file, its `.html` sibling, the
+ *   directory index, then the Next.js `__placeholder__.html` candidates —
+ *   most-literal first, at most two trailing dynamic segments — and
+ *   unknown URLs land on /404.html WITH a 404 status, never the blank app
+ *   shell. Trailing slashes 301 to the canonical slashless URL.
+ *   scripts/verify-static-export-routes.mjs holds nginx.conf and the route
+ *   tree together; the equivalence test holds THIS resolver to the same
+ *   model, so the two serving paths cannot drift.
+ *
+ * - RSC FLIGHT resolution restores the retired Go CLI handler's rewrites
+ *   (client-apps/cli/embedded/webconsole/handler.go at 8dc9df7e4~1,
+ *   deleted with the June CLI migration): a soft navigation to a dynamic
+ *   route fetches `<path>.txt` (and nested `<path>/__next.*.txt`) flight
+ *   payloads that exist on disk only in `__placeholder__` form. nginx
+ *   never handled these (filed as a cloud-side follow-up); without the
+ *   rewrite every soft navigation to a dynamic route degrades to a full
+ *   page load. Formulated here as "resolve the stem as a page, serve the
+ *   resolved document's twin" — one candidate discipline for both
+ *   contracts, which also covers the two-dynamic-segment routes the Go
+ *   handler's single-substitution loop predated.
+ */
+/** The literal Next.js static-export sentinel for dynamic segments. */
+const PLACEHOLDER = "__placeholder__";
+/** Nested RSC payload files: `__next.<segment-path>.txt` siblings. */
+const FLIGHT_SEGMENT_PREFIX = "__next.";
+export function buildConsoleFileIndex(files) {
+    const fileSet = new Set();
+    // The export root itself is a directory, so "/" resolves through the
+    // directory-index candidate (the root route's own serving path).
+    const directorySet = new Set(["/"]);
+    for (const file of files) {
+        fileSet.add(file);
+        let parent = file;
+        for (;;) {
+            const slash = parent.lastIndexOf("/");
+            if (slash <= 0)
+                break;
+            parent = parent.slice(0, slash);
+            if (directorySet.has(parent))
+                break;
+            directorySet.add(parent);
+        }
+    }
+    return {
+        hasFile: (path) => fileSet.has(path),
+        hasDirectory: (path) => directorySet.has(path),
+    };
+}
+/**
+ * Resolve a decoded, query-less request path against the export index.
+ * Redirects resolve one step per call, exactly as nginx's single
+ * `^(.+)/$` rewrite does — the client (or a test) follows them.
+ */
+export function resolveConsoleRequest(pathname, index) {
+    // Trailing-slash canonicalization (nginx `location ~ ^(.+)/$`): the
+    // export writes sibling .html files, never directory indexes, so a
+    // trailing-slash deep link would miss every candidate below. "/" itself
+    // cannot match (the capture needs one character before the slash).
+    if (pathname.length > 1 && pathname.endsWith("/")) {
+        return { kind: "redirect", location: pathname.slice(0, -1) };
+    }
+    const lastSegment = pathname.slice(pathname.lastIndexOf("/") + 1);
+    // Nested RSC flight payload: /<dir>/__next.<x>.txt. Direct hits cover
+    // static parents (and the root-level __next.*.txt family); otherwise
+    // resolve the parent as a page and serve the payload from the resolved
+    // (placeholder-substituted) document's directory.
+    if (lastSegment.startsWith(FLIGHT_SEGMENT_PREFIX) &&
+        lastSegment.endsWith(".txt")) {
+        if (index.hasFile(pathname)) {
+            return { kind: "file", file: pathname };
+        }
+        const parent = pathname.slice(0, pathname.lastIndexOf("/"));
+        const parentDocument = parent === "" ? null : resolvePage(parent, index);
+        if (parentDocument !== null && parentDocument.endsWith(".html")) {
+            const candidate = `${parentDocument.slice(0, -".html".length)}/${lastSegment}`;
+            if (index.hasFile(candidate)) {
+                return { kind: "file", file: candidate };
+            }
+        }
+        return { kind: "notFound" };
+    }
+    // Page-level RSC flight payload: /<path>.txt is the twin of the
+    // document /<path> resolves to (the export writes a .txt beside every
+    // page's .html). Excludes _next/ internals, which are literal files.
+    if (lastSegment.endsWith(".txt") &&
+        !pathname.startsWith("/_next/") &&
+        index.hasFile(pathname) === false) {
+        const stemDocument = resolvePage(pathname.slice(0, -".txt".length), index);
+        if (stemDocument !== null && stemDocument.endsWith(".html")) {
+            const twin = `${stemDocument.slice(0, -".html".length)}.txt`;
+            if (index.hasFile(twin)) {
+                return { kind: "file", file: twin };
+            }
+        }
+        return { kind: "notFound" };
+    }
+    const document = resolvePage(pathname, index);
+    return document === null
+        ? { kind: "notFound" }
+        : { kind: "file", file: document };
+}
+/**
+ * The nginx try_files chain, generalized: literal file, `.html` sibling,
+ * directory index, then the placeholder candidates — substitute the last
+ * segment, then the last two (nginx's declaration order: the more-literal
+ * candidate first, mirroring Next.js route priority where a literal
+ * segment beats a dynamic one). Returns the served document or null.
+ *
+ * `/_next/` build assets are literal-only (nginx's `^~ /_next/static/`
+ * location has no try_files): the placeholder candidates could never hit
+ * there — no export writes placeholder documents under /_next/ — so the
+ * short-circuit changes no outcome, it just refuses to pretend those
+ * candidates make sense.
+ */
+function resolvePage(pathname, index) {
+    if (index.hasFile(pathname)) {
+        return pathname;
+    }
+    if (pathname.startsWith("/_next/")) {
+        return null;
+    }
+    if (pathname !== "/" && index.hasFile(`${pathname}.html`)) {
+        return `${pathname}.html`;
+    }
+    // nginx `$uri/` + `index index.html`: a directory serves its index.
+    if (index.hasDirectory(pathname)) {
+        const indexFile = pathname === "/" ? "/index.html" : `${pathname}/index.html`;
+        if (index.hasFile(indexFile)) {
+            return indexFile;
+        }
+    }
+    const segments = pathname.split("/").filter((segment) => segment !== "");
+    for (const dynamicCount of [1, 2]) {
+        // Substituting the last k segments needs at least k+1 segments: the
+        // nginx regexes require a non-empty static prefix (`(.+)/…`), so a
+        // top-level path never resolves through placeholders.
+        if (segments.length < dynamicCount + 1) {
+            break;
+        }
+        const candidate = [
+            "",
+            ...segments.slice(0, -dynamicCount),
+            ...Array(dynamicCount).fill(PLACEHOLDER),
+        ].join("/");
+        if (index.hasFile(`${candidate}.html`)) {
+            return `${candidate}.html`;
+        }
+    }
+    return null;
+}
+//# sourceMappingURL=resolver.js.map

package/dist/transport/console/resolver.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolver.js","sourceRoot":"","sources":["../../../src/transport/console/resolver.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAEH,uEAAuE;AACvE,MAAM,WAAW,GAAG,iBAAiB,CAAC;AAEtC,sEAAsE;AACtE,MAAM,qBAAqB,GAAG,SAAS,CAAC;AAaxC,MAAM,UAAU,qBAAqB,CACnC,KAAuB;IAEvB,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAClC,qEAAqE;IACrE,iEAAiE;IACjE,MAAM,YAAY,GAAG,IAAI,GAAG,CAAS,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5C,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAClB,IAAI,MAAM,GAAG,IAAI,CAAC;QAClB,SAAS,CAAC;YACR,MAAM,KAAK,GAAG,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;YACtC,IAAI,KAAK,IAAI,CAAC;gBAAE,MAAM;YACtB,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;YAChC,IAAI,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC;gBAAE,MAAM;YACpC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC3B,CAAC;IACH,CAAC;IACD,OAAO;QACL,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC;QACpC,YAAY,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC;KAC/C,CAAC;AACJ,CAAC;AAUD;;;;GAIG;AACH,MAAM,UAAU,qBAAqB,CACnC,QAAgB,EAChB,KAAuB;IAEvB,oEAAoE;IACpE,mEAAmE;IACnE,wEAAwE;IACxE,mEAAmE;IACnE,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QAClD,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAC/D,CAAC;IAED,MAAM,WAAW,GAAG,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;IAElE,sEAAsE;IACtE,qEAAqE;IACrE,uEAAuE;IACvE,kDAAkD;IAClD,IACE,WAAW,CAAC,UAAU,CAAC,qBAAqB,CAAC;QAC7C,WAAW,CAAC,QAAQ,CAAC,MAAM,CAAC,EAC5B,CAAC;QACD,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC5B,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;QAC1C,CAAC;QACD,MAAM,MAAM,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,QAAQ,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC;QAC5D,MAAM,cAAc,GAAG,MAAM,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,WAAW,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QACzE,IAAI,cAAc,KAAK,IAAI,IAAI,cAAc,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;YAChE,MAAM,SAAS,GAAG,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,WAAW,EAAE,CAAC;YAC/E,IAAI,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;gBAC7B,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;YAC3C,CAAC;QACH,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;IAC9B,CAAC;IAED,gEAAgE;IAChE,sEAAsE;IACtE,qEAAqE;IACrE,IACE,WAAW,CAAC,QAAQ,CAAC,MAAM,CAAC;QAC5B,CAAC,QAAQ,CAAC,UAAU,CAAC,SAAS,CAAC;QAC/B,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,KAAK,EACjC,CAAC;QACD,MAAM,YAAY,GAAG,WAAW,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,KAAK,CAAC,CAAC;QAC3E,IAAI,YAAY,KAAK,IAAI,IAAI,YAAY,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;YAC5D,MAAM,IAAI,GAAG,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC;YAC7D,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;gBACxB,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;YACtC,CAAC;QACH,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;IAC9B,CAAC;IAED,MAAM,QAAQ,GAAG,WAAW,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;IAC9C,OAAO,QAAQ,KAAK,IAAI;QACtB,CAAC,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE;QACtB,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;AACvC,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,SAAS,WAAW,CAAC,QAAgB,EAAE,KAAuB;IAC5D,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC5B,OAAO,QAAQ,CAAC;IAClB,CAAC;IACD,IAAI,QAAQ,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QACnC,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,QAAQ,KAAK,GAAG,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,QAAQ,OAAO,CAAC,EAAE,CAAC;QAC1D,OAAO,GAAG,QAAQ,OAAO,CAAC;IAC5B,CAAC;IACD,oEAAoE;IACpE,IAAI,KAAK,CAAC,YAAY,CAAC,QAAQ,CAAC,EAAE,CAAC;QACjC,MAAM,SAAS,GACb,QAAQ,KAAK,GAAG,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,GAAG,QAAQ,aAAa,CAAC;QAC9D,IAAI,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;YAC7B,OAAO,SAAS,CAAC;QACnB,CAAC;IACH,CAAC;IAED,MAAM,QAAQ,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,KAAK,EAAE,CAAC,CAAC;IACzE,KAAK,MAAM,YAAY,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;QAClC,oEAAoE;QACpE,mEAAmE;QACnE,sDAAsD;QACtD,IAAI,QAAQ,CAAC,MAAM,GAAG,YAAY,GAAG,CAAC,EAAE,CAAC;YACvC,MAAM;QACR,CAAC;QACD,MAAM,SAAS,GAAG;YAChB,EAAE;YACF,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,YAAY,CAAC;YACnC,GAAG,KAAK,CAAS,YAAY,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC;SACjD,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACZ,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,SAAS,OAAO,CAAC,EAAE,CAAC;YACvC,OAAO,GAAG,SAAS,OAAO,CAAC;QAC7B,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/transport/constants.d.ts

@@ -0,0 +1,44 @@
+/**
+ * Transport-layer semantic constants. Every value here was tuned in the Go
+ * server against real behavior; the rationale rides with the constant so
+ * nobody "fixes" one casually (coding guideline 001 §5).
+ */
+/**
+ * Message size cap in BOTH directions, matching Go's
+ * grpc.MaxRecvMsgSize/MaxSendMsgSize (backend/libs/go/grpc/server.go:94-95).
+ * Skills and execution payloads approach but must not exceed this; raising
+ * it silently would let one edition accept payloads the other refuses.
+ */
+export declare const MAX_MESSAGE_BYTES: number;
+/**
+ * Server-initiated HTTP/2 keepalive: ping idle sessions every 15s, close if
+ * the ack takes longer than 5s (Go keepalive.ServerParameters, grpc lib
+ * server.go:111-114). Detects half-dead connections from suspended laptops
+ * and NAT timeouts without waiting for a write to fail.
+ *
+ * Go additionally ENFORCES a client-ping rate floor
+ * (keepalive.EnforcementPolicy MinTime 5s, server.go:102-105). Node's
+ * http2 auto-acks client pings below the API surface and emits no event
+ * for them, so the enforcement half is not implementable here. It is
+ * protective-only (guards against ping-flooding clients) and invisible to
+ * every well-behaved client — recorded as a disclosed parity nuance in the
+ * sub-project record, not silently dropped.
+ */
+export declare const KEEPALIVE_PING_INTERVAL_MS = 15000;
+export declare const KEEPALIVE_PING_TIMEOUT_MS = 5000;
+/**
+ * Graceful-shutdown drain budget, matching Go's http.Server.Shutdown
+ * context timeout (backend/libs/go/grpc/server.go Stop). Order is contract:
+ * health flips NOT_SERVING first, in-flight requests get up to this long,
+ * then remaining connections are destroyed.
+ */
+export declare const SHUTDOWN_DRAIN_TIMEOUT_MS = 10000;
+/**
+ * Lane paths on the unified port, byte-pinned from the Go router
+ * (pkg/server/server.go:812-826) and asserted by the CW-10 conformance
+ * suite (test/conformance/src/suites/registry-proxy.conformance.test.ts).
+ */
+export declare const TASK_KIND_REGISTRY_PATH = "/v1/proxy/task-kind-registry";
+export declare const MODEL_REGISTRY_PATH = "/v1/proxy/model-registry";
+export declare const SKILL_ARTIFACTS_PATH_PREFIX = "/v1/skill-artifacts";
+//# sourceMappingURL=constants.d.ts.map

package/dist/transport/constants.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../../src/transport/constants.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH;;;;;GAKG;AACH,eAAO,MAAM,iBAAiB,QAAmB,CAAC;AAElD;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,0BAA0B,QAAS,CAAC;AACjD,eAAO,MAAM,yBAAyB,OAAQ,CAAC;AAE/C;;;;;GAKG;AACH,eAAO,MAAM,yBAAyB,QAAS,CAAC;AAEhD;;;;GAIG;AACH,eAAO,MAAM,uBAAuB,iCAAiC,CAAC;AACtE,eAAO,MAAM,mBAAmB,6BAA6B,CAAC;AAC9D,eAAO,MAAM,2BAA2B,wBAAwB,CAAC"}

package/dist/transport/constants.js

@@ -0,0 +1,44 @@
+/**
+ * Transport-layer semantic constants. Every value here was tuned in the Go
+ * server against real behavior; the rationale rides with the constant so
+ * nobody "fixes" one casually (coding guideline 001 §5).
+ */
+/**
+ * Message size cap in BOTH directions, matching Go's
+ * grpc.MaxRecvMsgSize/MaxSendMsgSize (backend/libs/go/grpc/server.go:94-95).
+ * Skills and execution payloads approach but must not exceed this; raising
+ * it silently would let one edition accept payloads the other refuses.
+ */
+export const MAX_MESSAGE_BYTES = 10 * 1024 * 1024;
+/**
+ * Server-initiated HTTP/2 keepalive: ping idle sessions every 15s, close if
+ * the ack takes longer than 5s (Go keepalive.ServerParameters, grpc lib
+ * server.go:111-114). Detects half-dead connections from suspended laptops
+ * and NAT timeouts without waiting for a write to fail.
+ *
+ * Go additionally ENFORCES a client-ping rate floor
+ * (keepalive.EnforcementPolicy MinTime 5s, server.go:102-105). Node's
+ * http2 auto-acks client pings below the API surface and emits no event
+ * for them, so the enforcement half is not implementable here. It is
+ * protective-only (guards against ping-flooding clients) and invisible to
+ * every well-behaved client — recorded as a disclosed parity nuance in the
+ * sub-project record, not silently dropped.
+ */
+export const KEEPALIVE_PING_INTERVAL_MS = 15_000;
+export const KEEPALIVE_PING_TIMEOUT_MS = 5_000;
+/**
+ * Graceful-shutdown drain budget, matching Go's http.Server.Shutdown
+ * context timeout (backend/libs/go/grpc/server.go Stop). Order is contract:
+ * health flips NOT_SERVING first, in-flight requests get up to this long,
+ * then remaining connections are destroyed.
+ */
+export const SHUTDOWN_DRAIN_TIMEOUT_MS = 10_000;
+/**
+ * Lane paths on the unified port, byte-pinned from the Go router
+ * (pkg/server/server.go:812-826) and asserted by the CW-10 conformance
+ * suite (test/conformance/src/suites/registry-proxy.conformance.test.ts).
+ */
+export const TASK_KIND_REGISTRY_PATH = "/v1/proxy/task-kind-registry";
+export const MODEL_REGISTRY_PATH = "/v1/proxy/model-registry";
+export const SKILL_ARTIFACTS_PATH_PREFIX = "/v1/skill-artifacts";
+//# sourceMappingURL=constants.js.map

package/dist/transport/constants.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"constants.js","sourceRoot":"","sources":["../../src/transport/constants.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH;;;;;GAKG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;AAElD;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,MAAM,CAAC;AACjD,MAAM,CAAC,MAAM,yBAAyB,GAAG,KAAK,CAAC;AAE/C;;;;;GAKG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,MAAM,CAAC;AAEhD;;;;GAIG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,8BAA8B,CAAC;AACtE,MAAM,CAAC,MAAM,mBAAmB,GAAG,0BAA0B,CAAC;AAC9D,MAAM,CAAC,MAAM,2BAA2B,GAAG,qBAAqB,CAAC"}