botmux 3.15.0 → 3.16.0

package/dist/core/session-preview.js

@@ -0,0 +1,184 @@
+import { connect } from 'node:net';
+import { isLiteralLoopbackHost, isTcpPort, } from './loopback-target.js';
+import { resolvePreviewPortOwner, safePreviewPortOwnerProof, verifyPreviewPortOwner, } from './preview-port-owner.js';
+export const PREVIEW_ROUTE_PREFIX = '/preview';
+/**
+ * Reserved path segment that introduces the sandboxed content stream:
+ * `/preview/<sessionId>/__botmux_preview_content/<capability>/…`.
+ *
+ * It is a path segment rather than a query flag on purpose. The preview
+ * document is served into an opaque-origin sandbox, so its own relative
+ * subresources and WebSockets carry no dashboard cookie; a capability that
+ * lives in the path is inherited by every relative URL the app resolves,
+ * while a query flag would be dropped by the first `./app.js`.
+ */
+export const PREVIEW_CONTENT_SEGMENT = '__botmux_preview_content';
+export const PREVIEW_PROBE_TIMEOUT_MS = 750;
+export function isPreviewPort(value) {
+    return isTcpPort(value);
+}
+export function isPreviewLoopbackHost(value) {
+    return isLiteralLoopbackHost(value);
+}
+/** Re-validate persisted/SSE data at every trust boundary. Invalid legacy or
+ * attacker-shaped objects collapse to undefined and are never dialled. */
+export function safeSessionPreviewTarget(value) {
+    if (!value || typeof value !== 'object' || Array.isArray(value))
+        return undefined;
+    const raw = value;
+    if (!isPreviewLoopbackHost(raw.host) || !isPreviewPort(raw.port))
+        return undefined;
+    if (typeof raw.registeredAt !== 'string') {
+        return undefined;
+    }
+    const registeredAt = new Date(raw.registeredAt);
+    if (Number.isNaN(registeredAt.valueOf()) || registeredAt.toISOString() !== raw.registeredAt) {
+        return undefined;
+    }
+    const owner = safePreviewPortOwnerProof(raw.owner);
+    if (!owner)
+        return undefined;
+    if (!Number.isSafeInteger(raw.workerGeneration) || raw.workerGeneration < 0) {
+        return undefined;
+    }
+    return {
+        host: raw.host,
+        port: raw.port,
+        registeredAt: raw.registeredAt,
+        owner,
+        workerGeneration: raw.workerGeneration,
+    };
+}
+/**
+ * P1-1：一次注册的指纹。空串表示「这个会话此刻没有合法的预览目标」。
+ *
+ * host:port 不足以当身份：端口被回收后重注册、worker 换代后在同一端口重注册，都会
+ * 产生同一个 host:port，但那是另一次注册、另一个进程。registeredAt（ISO 串，天然可
+ * 当 revision）、workerGeneration、以及 owner 三元证明合起来才唯一确定「哪一次」。
+ */
+export function sessionPreviewFingerprint(previewTarget) {
+    const target = safeSessionPreviewTarget(previewTarget);
+    if (!target)
+        return '';
+    return [
+        target.host,
+        target.port,
+        target.registeredAt,
+        target.workerGeneration,
+        target.owner.pid,
+        target.owner.procStart,
+        target.owner.inode,
+    ].join('|');
+}
+/** P1-1：两个 target 是不是同一次注册（见 `sessionPreviewFingerprint`）。 */
+export function sameSessionPreviewTarget(a, b) {
+    return sessionPreviewFingerprint(a) === sessionPreviewFingerprint(b);
+}
+/**
+ * P1-12：目标是否仍由注册时那个进程持有。probe 之后与**每次代理落地之前**都要过
+ * 这一关；`changed`/`unverifiable` 一律按失效处理（返回 false），调用方负责清 target
+ * 并广播 `preview: null`。
+ */
+export function sessionPreviewTargetStillOwned(target, opts = {}) {
+    return verifyPreviewPortOwner({
+        host: target.host,
+        port: target.port,
+        proof: target.owner,
+        ...(opts.procRoot !== undefined ? { procRoot: opts.procRoot } : {}),
+    }) === 'ok';
+}
+/**
+ * Riff 矩阵：哪些会话后端的 Web 服务在 daemon 的 loopback 上**根本不可能**出现。
+ *
+ * riff 是远端 sandbox——CLI 与它启动的 dev server 都跑在远程主机上，daemon 这一侧
+ * 的 127.0.0.1 上永远没有对应监听。此时必须明确回 `preview_unsupported`，而不是
+ * 让它落进 `preview_unreachable` 冒充「偶发故障」让用户反复重试；前端据此隐藏入口。
+ * pty / tmux / zellij / herdr / zmx 都是本机后端，行为不变。
+ */
+export function previewBackendSupported(backendType) {
+    return backendType !== 'riff';
+}
+export function sessionPreviewPath(sessionId) {
+    return `${PREVIEW_ROUTE_PREFIX}/${encodeURIComponent(sessionId)}/`;
+}
+/** Base path of the sandboxed content stream. Every relative URL the framed
+ *  app resolves stays under it, which is how the capability survives without
+ *  cookies or query strings. */
+export function sessionPreviewContentPath(sessionId, capability) {
+    return `${sessionPreviewPath(sessionId)}${PREVIEW_CONTENT_SEGMENT}/${capability}/`;
+}
+export function sessionPreviewDescriptor(sessionId, value) {
+    const target = safeSessionPreviewTarget(value);
+    if (!target)
+        return undefined;
+    return {
+        path: sessionPreviewPath(sessionId),
+        registeredAt: target.registeredAt,
+    };
+}
+function probeOne(host, port, timeoutMs) {
+    return new Promise((resolve) => {
+        let settled = false;
+        const socket = connect({ host, port });
+        socket.unref?.();
+        const finish = (ok) => {
+            if (settled)
+                return;
+            settled = true;
+            clearTimeout(timer);
+            socket.destroy();
+            resolve(ok);
+        };
+        const timer = setTimeout(() => finish(false), timeoutMs);
+        timer.unref?.();
+        socket.once('connect', () => finish(true));
+        socket.once('error', () => finish(false));
+    });
+}
+/**
+ * Validate that a caller-selected port is reachable through a literal loopback
+ * address AND held by a process inside this session's lineage. With no
+ * requested host, IPv4 is preferred and IPv6 is a fallback so
+ * `botmux preview <port>` works for either bind family.
+ *
+ * P1-12：可达性与归属是两件事，两件都必须成立才产出 target——connect 通过只说明
+ * 「此刻这个号码上有人」，`resolvePreviewPortOwner` 才回答「那个人是不是本会话的
+ * 进程」。归属拿不到时宁可没有预览，也不给出一条指向不明进程的代理路由。
+ */
+export async function probeSessionPreviewTarget(input) {
+    if (!isPreviewPort(input.port))
+        return { ok: false, error: 'invalid_port' };
+    const timeoutMs = input.timeoutMs ?? PREVIEW_PROBE_TIMEOUT_MS;
+    if (!Number.isSafeInteger(timeoutMs) || timeoutMs <= 0)
+        return { ok: false, error: 'invalid_port' };
+    const hosts = input.host ? [input.host] : ['127.0.0.1', '::1'];
+    let ownerFailure;
+    for (const host of hosts) {
+        if (!await probeOne(host, input.port, timeoutMs))
+            continue;
+        const owner = resolvePreviewPortOwner({
+            host,
+            port: input.port,
+            ownerPids: input.ownerPids,
+            ...(input.procRoot !== undefined ? { procRoot: input.procRoot } : {}),
+        });
+        if (!owner.ok) {
+            ownerFailure = owner.reason;
+            continue;
+        }
+        return {
+            ok: true,
+            target: {
+                host,
+                port: input.port,
+                registeredAt: (input.now?.() ?? new Date()).toISOString(),
+                owner: owner.proof,
+                workerGeneration: input.workerGeneration,
+            },
+        };
+    }
+    return ownerFailure === undefined
+        ? { ok: false, error: 'preview_unreachable' }
+        : { ok: false, error: 'preview_owner_unverified', reason: ownerFailure };
+}
+//# sourceMappingURL=session-preview.js.map

package/dist/core/session-preview.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-preview.js","sourceRoot":"","sources":["../../src/core/session-preview.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,UAAU,CAAC;AACnC,OAAO,EACL,qBAAqB,EACrB,SAAS,GAEV,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACL,uBAAuB,EACvB,yBAAyB,EACzB,sBAAsB,GAGvB,MAAM,yBAAyB,CAAC;AAEjC,MAAM,CAAC,MAAM,oBAAoB,GAAG,UAAU,CAAC;AAC/C;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,0BAA0B,CAAC;AAClE,MAAM,CAAC,MAAM,wBAAwB,GAAG,GAAG,CAAC;AA8B5C,MAAM,UAAU,aAAa,CAAC,KAAc;IAC1C,OAAO,SAAS,CAAC,KAAK,CAAC,CAAC;AAC1B,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,KAAc;IAClD,OAAO,qBAAqB,CAAC,KAAK,CAAC,CAAC;AACtC,CAAC;AAED;0EAC0E;AAC1E,MAAM,UAAU,wBAAwB,CAAC,KAAc;IACrD,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAClF,MAAM,GAAG,GAAG,KAAgC,CAAC;IAC7C,IAAI,CAAC,qBAAqB,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC;QAAE,OAAO,SAAS,CAAC;IACnF,IAAI,OAAO,GAAG,CAAC,YAAY,KAAK,QAAQ,EAAE,CAAC;QACzC,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,YAAY,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;IAChD,IAAI,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,OAAO,EAAE,CAAC,IAAI,YAAY,CAAC,WAAW,EAAE,KAAK,GAAG,CAAC,YAAY,EAAE,CAAC;QAC5F,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,KAAK,GAAG,yBAAyB,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACnD,IAAI,CAAC,KAAK;QAAE,OAAO,SAAS,CAAC;IAC7B,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,GAAG,CAAC,gBAAgB,CAAC,IAAK,GAAG,CAAC,gBAA2B,GAAG,CAAC,EAAE,CAAC;QACxF,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO;QACL,IAAI,EAAE,GAAG,CAAC,IAAI;QACd,IAAI,EAAE,GAAG,CAAC,IAAI;QACd,YAAY,EAAE,GAAG,CAAC,YAAY;QAC9B,KAAK;QACL,gBAAgB,EAAE,GAAG,CAAC,gBAA0B;KACjD,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,yBAAyB,CAAC,aAAsB;IAC9D,MAAM,MAAM,GAAG,wBAAwB,CAAC,aAAa,CAAC,CAAC;IACvD,IAAI,CAAC,MAAM;QAAE,OAAO,EAAE,CAAC;IACvB,OAAO;QACL,MAAM,CAAC,IAAI;QACX,MAAM,CAAC,IAAI;QACX,MAAM,CAAC,YAAY;QACnB,MAAM,CAAC,gBAAgB;QACvB,MAAM,CAAC,KAAK,CAAC,GAAG;QAChB,MAAM,CAAC,KAAK,CAAC,SAAS;QACtB,MAAM,CAAC,KAAK,CAAC,KAAK;KACnB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACd,CAAC;AAED,8DAA8D;AAC9D,MAAM,UAAU,wBAAwB,CACtC,CAAuB,EACvB,CAAuB;IAEvB,OAAO,yBAAyB,CAAC,CAAC,CAAC,KAAK,yBAAyB,CAAC,CAAC,CAAC,CAAC;AACvE,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,8BAA8B,CAC5C,MAA4B,EAC5B,OAA8B,EAAE;IAEhC,OAAO,sBAAsB,CAAC;QAC5B,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,GAAG,CAAC,IAAI,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACpE,CAAC,KAAK,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,uBAAuB,CAAC,WAAoB;IAC1D,OAAO,WAAW,KAAK,MAAM,CAAC;AAChC,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,SAAiB;IAClD,OAAO,GAAG,oBAAoB,IAAI,kBAAkB,CAAC,SAAS,CAAC,GAAG,CAAC;AACrE,CAAC;AAED;;gCAEgC;AAChC,MAAM,UAAU,yBAAyB,CAAC,SAAiB,EAAE,UAAkB;IAC7E,OAAO,GAAG,kBAAkB,CAAC,SAAS,CAAC,GAAG,uBAAuB,IAAI,UAAU,GAAG,CAAC;AACrF,CAAC;AAED,MAAM,UAAU,wBAAwB,CACtC,SAAiB,EACjB,KAAc;IAEd,MAAM,MAAM,GAAG,wBAAwB,CAAC,KAAK,CAAC,CAAC;IAC/C,IAAI,CAAC,MAAM;QAAE,OAAO,SAAS,CAAC;IAC9B,OAAO;QACL,IAAI,EAAE,kBAAkB,CAAC,SAAS,CAAC;QACnC,YAAY,EAAE,MAAM,CAAC,YAAY;KAClC,CAAC;AACJ,CAAC;AAED,SAAS,QAAQ,CAAC,IAAyB,EAAE,IAAY,EAAE,SAAiB;IAC1E,OAAO,IAAI,OAAO,CAAU,CAAC,OAAO,EAAE,EAAE;QACtC,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,MAAM,MAAM,GAAG,OAAO,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QACvC,MAAM,CAAC,KAAK,EAAE,EAAE,CAAC;QACjB,MAAM,MAAM,GAAG,CAAC,EAAW,EAAE,EAAE;YAC7B,IAAI,OAAO;gBAAE,OAAO;YACpB,OAAO,GAAG,IAAI,CAAC;YACf,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,MAAM,CAAC,OAAO,EAAE,CAAC;YACjB,OAAO,CAAC,EAAE,CAAC,CAAC;QACd,CAAC,CAAC;QACF,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,SAAS,CAAC,CAAC;QACzD,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC;QAChB,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;QAC3C,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IAC5C,CAAC,CAAC,CAAC;AACL,CAAC;AAaD;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAAC,KAW/C;IACC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC;IAC5E,MAAM,SAAS,GAAG,KAAK,CAAC,SAAS,IAAI,wBAAwB,CAAC;IAC9D,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,SAAS,CAAC,IAAI,SAAS,IAAI,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC;IACpG,MAAM,KAAK,GAA0B,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC;IACtF,IAAI,YAAiD,CAAC;IACtD,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,SAAS,CAAC;YAAE,SAAS;QAC3D,MAAM,KAAK,GAAG,uBAAuB,CAAC;YACpC,IAAI;YACJ,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,GAAG,CAAC,KAAK,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACtE,CAAC,CAAC;QACH,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC;YACd,YAAY,GAAG,KAAK,CAAC,MAAM,CAAC;YAC5B,SAAS;QACX,CAAC;QACD,OAAO;YACL,EAAE,EAAE,IAAI;YACR,MAAM,EAAE;gBACN,IAAI;gBACJ,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,YAAY,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,EAAE,IAAI,IAAI,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE;gBACzD,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;aACzC;SACF,CAAC;IACJ,CAAC;IACD,OAAO,YAAY,KAAK,SAAS;QAC/B,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,qBAAqB,EAAE;QAC7C,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,0BAA0B,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC;AAC7E,CAAC"}

package/dist/core/session-rename.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"session-rename.d.ts","sourceRoot":"","sources":["../../src/core/session-rename.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,0BAA0B,CAAC;AAEtD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAEhD,MAAM,MAAM,yBAAyB,GACjC;IAAE,MAAM,EAAE,WAAW,CAAC;IAAC,KAAK,EAAE,KAAK,CAAA;CAAE,GACrC;IAAE,MAAM,EAAE,aAAa,CAAC;IAAC,KAAK,CAAC,EAAE,KAAK,CAAA;CAAE,GACxC;IAAE,MAAM,EAAE,aAAa,CAAC;IAAC,KAAK,CAAC,EAAE,KAAK,CAAA;CAAE,GACxC;IAAE,MAAM,EAAE,QAAQ,CAAC;IAAC,KAAK,CAAC,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAEvD;;kDAEkD;AAClD,wBAAgB,qBAAqB,CAAC,EAAE,EAAE,aAAa,GAAG,KAAK,GAAG,SAAS,CAO1E;AAED;;iFAEiF;AACjF,wBAAgB,yBAAyB,CACvC,EAAE,EAAE,aAAa,EACjB,KAAK,EAAE,MAAM,GACZ,yBAAyB,CA+B3B"}
+{"version":3,"file":"session-rename.d.ts","sourceRoot":"","sources":["../../src/core/session-rename.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,0BAA0B,CAAC;AAEtD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAEhD,MAAM,MAAM,yBAAyB,GACjC;IAAE,MAAM,EAAE,WAAW,CAAC;IAAC,KAAK,EAAE,KAAK,CAAA;CAAE,GACrC;IAAE,MAAM,EAAE,aAAa,CAAC;IAAC,KAAK,CAAC,EAAE,KAAK,CAAA;CAAE,GACxC;IAAE,MAAM,EAAE,aAAa,CAAC;IAAC,KAAK,CAAC,EAAE,KAAK,CAAA;CAAE,GACxC;IAAE,MAAM,EAAE,QAAQ,CAAC;IAAC,KAAK,CAAC,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAEvD;;kDAEkD;AAClD,wBAAgB,qBAAqB,CAAC,EAAE,EAAE,aAAa,GAAG,KAAK,GAAG,SAAS,CAO1E;AAED;;iFAEiF;AACjF,wBAAgB,yBAAyB,CACvC,EAAE,EAAE,aAAa,EACjB,KAAK,EAAE,MAAM,GACZ,yBAAyB,CAiC3B"}

package/dist/core/session-rename.js

@@ -17,9 +17,11 @@ export function requestAgentSessionRename(ds, title) {
     if (!worker || worker.killed || worker.connected === false) {
         return { status: 'not_running', ...(cliId ? { cliId } : {}) };
     }
-    // Riff's write() creates a remote task per call; a TUI command split into
-    // text + Enter would create two unrelated tasks. It has no local TUI anyway.
-    if ((ds.initConfig?.backendType ?? ds.session.backendType) === 'riff') {
+    // A remote backend's write() creates one remote turn/task per call, so a TUI
+    // command split into text + Enter would create two unrelated ones. Neither
+    // riff nor mojo has a local TUI to rename anyway.
+    const renameBackend = ds.initConfig?.backendType ?? ds.session.backendType;
+    if (renameBackend === 'riff' || renameBackend === 'mojo') {
         return { status: 'unsupported', ...(cliId ? { cliId } : {}) };
     }
     if (!cliId)

package/dist/core/session-rename.js.map

@@ -1 +1 @@
-{"version":3,"file":"session-rename.js","sourceRoot":"","sources":["../../src/core/session-rename.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AAWnE;;kDAEkD;AAClD,MAAM,UAAU,qBAAqB,CAAC,EAAiB;IACrD,OAAO,CACL,EAAE,CAAC,UAAU,EAAE,KAAK;WACjB,EAAE,CAAC,WAAW,EAAE,KAAK;WACrB,EAAE,CAAC,OAAO,CAAC,WAAW,EAAE,KAAK;WAC7B,EAAE,CAAC,OAAO,CAAC,KAAK,CACC,CAAC;AACzB,CAAC;AAED;;iFAEiF;AACjF,MAAM,UAAU,yBAAyB,CACvC,EAAiB,EACjB,KAAa;IAEb,MAAM,KAAK,GAAG,qBAAqB,CAAC,EAAE,CAAC,CAAC;IACxC,MAAM,MAAM,GAAG,EAAE,CAAC,MAAM,CAAC;IACzB,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,SAAS,KAAK,KAAK,EAAE,CAAC;QAC3D,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;IAChE,CAAC;IAED,0EAA0E;IAC1E,6EAA6E;IAC7E,IAAI,CAAC,EAAE,CAAC,UAAU,EAAE,WAAW,IAAI,EAAE,CAAC,OAAO,CAAC,WAAW,CAAC,KAAK,MAAM,EAAE,CAAC;QACtE,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;IAChE,CAAC;IAED,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;IAC7C,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,oBAAoB,CAClC,KAAK,EACL,EAAE,CAAC,UAAU,EAAE,eAAe,IAAI,EAAE,CAAC,OAAO,CAAC,eAAe,CAC7D,CAAC;QACF,IAAI,CAAC,OAAO,CAAC,yBAAyB,EAAE,CAAC;YACvC,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,KAAK,EAAE,CAAC;QAC1C,CAAC;QACD,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,gBAAgB,EAAE,KAAK,EAAoB,CAAC,CAAC;QACjE,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC;IACxC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO;YACL,MAAM,EAAE,QAAQ;YAChB,KAAK;YACL,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;SACxD,CAAC;IACJ,CAAC;AACH,CAAC"}
+{"version":3,"file":"session-rename.js","sourceRoot":"","sources":["../../src/core/session-rename.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AAWnE;;kDAEkD;AAClD,MAAM,UAAU,qBAAqB,CAAC,EAAiB;IACrD,OAAO,CACL,EAAE,CAAC,UAAU,EAAE,KAAK;WACjB,EAAE,CAAC,WAAW,EAAE,KAAK;WACrB,EAAE,CAAC,OAAO,CAAC,WAAW,EAAE,KAAK;WAC7B,EAAE,CAAC,OAAO,CAAC,KAAK,CACC,CAAC;AACzB,CAAC;AAED;;iFAEiF;AACjF,MAAM,UAAU,yBAAyB,CACvC,EAAiB,EACjB,KAAa;IAEb,MAAM,KAAK,GAAG,qBAAqB,CAAC,EAAE,CAAC,CAAC;IACxC,MAAM,MAAM,GAAG,EAAE,CAAC,MAAM,CAAC;IACzB,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,SAAS,KAAK,KAAK,EAAE,CAAC;QAC3D,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;IAChE,CAAC;IAED,6EAA6E;IAC7E,2EAA2E;IAC3E,kDAAkD;IAClD,MAAM,aAAa,GAAG,EAAE,CAAC,UAAU,EAAE,WAAW,IAAI,EAAE,CAAC,OAAO,CAAC,WAAW,CAAC;IAC3E,IAAI,aAAa,KAAK,MAAM,IAAI,aAAa,KAAK,MAAM,EAAE,CAAC;QACzD,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;IAChE,CAAC;IAED,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;IAC7C,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,oBAAoB,CAClC,KAAK,EACL,EAAE,CAAC,UAAU,EAAE,eAAe,IAAI,EAAE,CAAC,OAAO,CAAC,eAAe,CAC7D,CAAC;QACF,IAAI,CAAC,OAAO,CAAC,yBAAyB,EAAE,CAAC;YACvC,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,KAAK,EAAE,CAAC;QAC1C,CAAC;QACD,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,gBAAgB,EAAE,KAAK,EAAoB,CAAC,CAAC;QACjE,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC;IACxC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO;YACL,MAAM,EAAE,QAAQ;YAChB,KAAK;YACL,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;SACxD,CAAC;IACJ,CAAC;AACH,CAAC"}

package/dist/core/session-wake-deadline.d.ts

@@ -0,0 +1,5 @@
+export declare const SESSION_WAKE_TIMEOUT_MS = 15000;
+export declare const SESSION_WAKE_DEADLINE_HEADER = "x-botmux-wake-deadline-ms";
+/** Clamp an optional trusted-host deadline to the daemon's own maximum wait. */
+export declare function sessionWakeAcquireTimeoutMs(header: string | string[] | undefined, nowMs?: number): number;
+//# sourceMappingURL=session-wake-deadline.d.ts.map

package/dist/core/session-wake-deadline.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-wake-deadline.d.ts","sourceRoot":"","sources":["../../src/core/session-wake-deadline.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,uBAAuB,QAAS,CAAC;AAC9C,eAAO,MAAM,4BAA4B,8BAA8B,CAAC;AAExE,gFAAgF;AAChF,wBAAgB,2BAA2B,CACzC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,EACrC,KAAK,SAAa,GACjB,MAAM,CAQR"}

package/dist/core/session-wake-deadline.js

@@ -0,0 +1,13 @@
+export const SESSION_WAKE_TIMEOUT_MS = 15_000;
+export const SESSION_WAKE_DEADLINE_HEADER = 'x-botmux-wake-deadline-ms';
+/** Clamp an optional trusted-host deadline to the daemon's own maximum wait. */
+export function sessionWakeAcquireTimeoutMs(header, nowMs = Date.now()) {
+    const raw = Array.isArray(header) ? header[0] : header;
+    const requested = typeof raw === 'string' && raw.trim() ? Number(raw) : Number.NaN;
+    const localDeadlineMs = nowMs + SESSION_WAKE_TIMEOUT_MS;
+    const deadlineMs = Number.isSafeInteger(requested) && requested > 0
+        ? Math.min(requested, localDeadlineMs)
+        : localDeadlineMs;
+    return Math.max(0, deadlineMs - nowMs);
+}
+//# sourceMappingURL=session-wake-deadline.js.map

package/dist/core/session-wake-deadline.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-wake-deadline.js","sourceRoot":"","sources":["../../src/core/session-wake-deadline.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,uBAAuB,GAAG,MAAM,CAAC;AAC9C,MAAM,CAAC,MAAM,4BAA4B,GAAG,2BAA2B,CAAC;AAExE,gFAAgF;AAChF,MAAM,UAAU,2BAA2B,CACzC,MAAqC,EACrC,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE;IAElB,MAAM,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;IACvD,MAAM,SAAS,GAAG,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;IACnF,MAAM,eAAe,GAAG,KAAK,GAAG,uBAAuB,CAAC;IACxD,MAAM,UAAU,GAAG,MAAM,CAAC,aAAa,CAAC,SAAS,CAAC,IAAI,SAAS,GAAG,CAAC;QACjE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,eAAe,CAAC;QACtC,CAAC,CAAC,eAAe,CAAC;IACpB,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,UAAU,GAAG,KAAK,CAAC,CAAC;AACzC,CAAC"}

package/dist/core/shutdown-budgets.d.ts

@@ -1,19 +1,20 @@
 /**
  * Graceful-shutdown budgets are shared with the CLI/PM2 supervisor. Keep the
- * ordering monotonic: a Riff create/follow-up fetch is bounded at 10s,
+ * ordering monotonic: the longest pre-lineage remote operation is bounded at
+ * 10s (Riff create/follow-up; Mojo init waits at most 8s),
  * admission restoration after a refused prepare at 11s, and ordinary worker
- * exit at 3s. Shutdown never cancels accepted Riff work as a fallback.
+ * exit at 3s. Shutdown never cancels accepted remote work as a fallback.
  */
-export declare const RIFF_SHUTDOWN_DRAIN_TIMEOUT_MS = 12000;
+export declare const REMOTE_SHUTDOWN_DRAIN_TIMEOUT_MS = 12000;
 /** Admission restoration can wait for the same bounded 10s create/follow-up
  * that prepare was draining. The daemon keeps its retirement fence throughout. */
-export declare const RIFF_ADMISSION_RESTORE_TIMEOUT_MS = 11000;
+export declare const REMOTE_ADMISSION_RESTORE_TIMEOUT_MS = 11000;
 /** Bounded acquisition of the bot-wide mutation lease. A timed-out waiter is
  * removed and can never run after shutdown has already been refused. */
 export declare const BOT_TURN_MUTATION_SHUTDOWN_ACQUIRE_TIMEOUT_MS = 1000;
 /** Initial all-owner snapshot and phase-2 batch CAS each use one short lock. */
-export declare const RIFF_SHUTDOWN_INITIAL_SNAPSHOT_TIMEOUT_MS = 1000;
-export declare const RIFF_SHUTDOWN_BATCH_PERSIST_TIMEOUT_MS = 1000;
+export declare const REMOTE_SHUTDOWN_INITIAL_SNAPSHOT_TIMEOUT_MS = 1000;
+export declare const REMOTE_SHUTDOWN_BATCH_PERSIST_TIMEOUT_MS = 1000;
 /** Scheduling/logging slack inside the supervisor-visible daemon budget. */
 export declare const DAEMON_SHUTDOWN_OVERHEAD_MS = 2000;
 export declare const DAEMON_WORKER_EXIT_GRACE_MS = 3000;

package/dist/core/shutdown-budgets.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"shutdown-budgets.d.ts","sourceRoot":"","sources":["../../src/core/shutdown-budgets.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,eAAO,MAAM,8BAA8B,QAAS,CAAC;AAErD;kFACkF;AAClF,eAAO,MAAM,iCAAiC,QAAS,CAAC;AAExD;wEACwE;AACxE,eAAO,MAAM,6CAA6C,OAAQ,CAAC;AAEnE,gFAAgF;AAChF,eAAO,MAAM,yCAAyC,OAAQ,CAAC;AAC/D,eAAO,MAAM,sCAAsC,OAAQ,CAAC;AAE5D,4EAA4E;AAC5E,eAAO,MAAM,2BAA2B,OAAQ,CAAC;AACjD,eAAO,MAAM,2BAA2B,OAAQ,CAAC;AACjD,eAAO,MAAM,sBAAsB,QAMJ,CAAC;AAChC,eAAO,MAAM,0BAA0B,QAAS,CAAC;AACjD,eAAO,MAAM,2BAA2B,OAAQ,CAAC;AACjD;+DAC+D;AAC/D,eAAO,MAAM,yBAAyB,QAAoC,CAAC;AAC3E,eAAO,MAAM,yBAAyB,QAAS,CAAC"}
+{"version":3,"file":"shutdown-budgets.d.ts","sourceRoot":"","sources":["../../src/core/shutdown-budgets.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,eAAO,MAAM,gCAAgC,QAAS,CAAC;AAEvD;kFACkF;AAClF,eAAO,MAAM,mCAAmC,QAAS,CAAC;AAE1D;wEACwE;AACxE,eAAO,MAAM,6CAA6C,OAAQ,CAAC;AAEnE,gFAAgF;AAChF,eAAO,MAAM,2CAA2C,OAAQ,CAAC;AACjE,eAAO,MAAM,wCAAwC,OAAQ,CAAC;AAE9D,4EAA4E;AAC5E,eAAO,MAAM,2BAA2B,OAAQ,CAAC;AACjD,eAAO,MAAM,2BAA2B,OAAQ,CAAC;AACjD,eAAO,MAAM,sBAAsB,QAMJ,CAAC;AAChC,eAAO,MAAM,0BAA0B,QAAS,CAAC;AACjD,eAAO,MAAM,2BAA2B,OAAQ,CAAC;AACjD;+DAC+D;AAC/D,eAAO,MAAM,yBAAyB,QAAoC,CAAC;AAC3E,eAAO,MAAM,yBAAyB,QAAS,CAAC"}

package/dist/core/shutdown-budgets.js

@@ -1,27 +1,28 @@
 /**
  * Graceful-shutdown budgets are shared with the CLI/PM2 supervisor. Keep the
- * ordering monotonic: a Riff create/follow-up fetch is bounded at 10s,
+ * ordering monotonic: the longest pre-lineage remote operation is bounded at
+ * 10s (Riff create/follow-up; Mojo init waits at most 8s),
  * admission restoration after a refused prepare at 11s, and ordinary worker
- * exit at 3s. Shutdown never cancels accepted Riff work as a fallback.
+ * exit at 3s. Shutdown never cancels accepted remote work as a fallback.
  */
-export const RIFF_SHUTDOWN_DRAIN_TIMEOUT_MS = 12_000;
+export const REMOTE_SHUTDOWN_DRAIN_TIMEOUT_MS = 12_000;
 /** Admission restoration can wait for the same bounded 10s create/follow-up
  * that prepare was draining. The daemon keeps its retirement fence throughout. */
-export const RIFF_ADMISSION_RESTORE_TIMEOUT_MS = 11_000;
+export const REMOTE_ADMISSION_RESTORE_TIMEOUT_MS = 11_000;
 /** Bounded acquisition of the bot-wide mutation lease. A timed-out waiter is
  * removed and can never run after shutdown has already been refused. */
 export const BOT_TURN_MUTATION_SHUTDOWN_ACQUIRE_TIMEOUT_MS = 1_000;
 /** Initial all-owner snapshot and phase-2 batch CAS each use one short lock. */
-export const RIFF_SHUTDOWN_INITIAL_SNAPSHOT_TIMEOUT_MS = 1_000;
-export const RIFF_SHUTDOWN_BATCH_PERSIST_TIMEOUT_MS = 1_000;
+export const REMOTE_SHUTDOWN_INITIAL_SNAPSHOT_TIMEOUT_MS = 1_000;
+export const REMOTE_SHUTDOWN_BATCH_PERSIST_TIMEOUT_MS = 1_000;
 /** Scheduling/logging slack inside the supervisor-visible daemon budget. */
 export const DAEMON_SHUTDOWN_OVERHEAD_MS = 2_000;
 export const DAEMON_WORKER_EXIT_GRACE_MS = 3_000;
 export const DAEMON_SHUTDOWN_MAX_MS = BOT_TURN_MUTATION_SHUTDOWN_ACQUIRE_TIMEOUT_MS
-    + RIFF_SHUTDOWN_INITIAL_SNAPSHOT_TIMEOUT_MS
-    + RIFF_SHUTDOWN_DRAIN_TIMEOUT_MS
-    + RIFF_SHUTDOWN_BATCH_PERSIST_TIMEOUT_MS
-    + Math.max(RIFF_ADMISSION_RESTORE_TIMEOUT_MS, DAEMON_WORKER_EXIT_GRACE_MS)
+    + REMOTE_SHUTDOWN_INITIAL_SNAPSHOT_TIMEOUT_MS
+    + REMOTE_SHUTDOWN_DRAIN_TIMEOUT_MS
+    + REMOTE_SHUTDOWN_BATCH_PERSIST_TIMEOUT_MS
+    + Math.max(REMOTE_ADMISSION_RESTORE_TIMEOUT_MS, DAEMON_WORKER_EXIT_GRACE_MS)
     + DAEMON_SHUTDOWN_OVERHEAD_MS;
 export const PM2_DAEMON_KILL_TIMEOUT_MS = 29_000;
 export const PM2_DAEMON_RESTART_DELAY_MS = 3_000;

package/dist/core/shutdown-budgets.js.map

@@ -1 +1 @@
-{"version":3,"file":"shutdown-budgets.js","sourceRoot":"","sources":["../../src/core/shutdown-budgets.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAAG,MAAM,CAAC;AAErD;kFACkF;AAClF,MAAM,CAAC,MAAM,iCAAiC,GAAG,MAAM,CAAC;AAExD;wEACwE;AACxE,MAAM,CAAC,MAAM,6CAA6C,GAAG,KAAK,CAAC;AAEnE,gFAAgF;AAChF,MAAM,CAAC,MAAM,yCAAyC,GAAG,KAAK,CAAC;AAC/D,MAAM,CAAC,MAAM,sCAAsC,GAAG,KAAK,CAAC;AAE5D,4EAA4E;AAC5E,MAAM,CAAC,MAAM,2BAA2B,GAAG,KAAK,CAAC;AACjD,MAAM,CAAC,MAAM,2BAA2B,GAAG,KAAK,CAAC;AACjD,MAAM,CAAC,MAAM,sBAAsB,GACjC,6CAA6C;MAC3C,yCAAyC;MACzC,8BAA8B;MAC9B,sCAAsC;MACtC,IAAI,CAAC,GAAG,CAAC,iCAAiC,EAAE,2BAA2B,CAAC;MACxE,2BAA2B,CAAC;AAChC,MAAM,CAAC,MAAM,0BAA0B,GAAG,MAAM,CAAC;AACjD,MAAM,CAAC,MAAM,2BAA2B,GAAG,KAAK,CAAC;AACjD;+DAC+D;AAC/D,MAAM,CAAC,MAAM,yBAAyB,GAAG,2BAA2B,GAAG,GAAG,CAAC;AAC3E,MAAM,CAAC,MAAM,yBAAyB,GAAG,MAAM,CAAC;AAEhD,IAAI,0BAA0B,IAAI,sBAAsB,EAAE,CAAC;IACzD,MAAM,IAAI,KAAK,CAAC,yEAAyE,CAAC,CAAC;AAC7F,CAAC;AACD,IAAI,sBAAsB,GAAG,MAAM,EAAE,CAAC;IACpC,MAAM,IAAI,KAAK,CAAC,oEAAoE,CAAC,CAAC;AACxF,CAAC;AACD,IAAI,yBAAyB,IAAI,0BAA0B,EAAE,CAAC;IAC5D,MAAM,IAAI,KAAK,CAAC,4DAA4D,CAAC,CAAC;AAChF,CAAC;AACD,IAAI,yBAAyB,IAAI,sBAAsB,GAAG,yBAAyB,EAAE,CAAC;IACpF,MAAM,IAAI,KAAK,CAAC,2EAA2E,CAAC,CAAC;AAC/F,CAAC;AACD,IAAI,yBAAyB,IAAI,0BAA0B,GAAG,yBAAyB,EAAE,CAAC;IACxF,MAAM,IAAI,KAAK,CAAC,4EAA4E,CAAC,CAAC;AAChG,CAAC"}
+{"version":3,"file":"shutdown-budgets.js","sourceRoot":"","sources":["../../src/core/shutdown-budgets.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,gCAAgC,GAAG,MAAM,CAAC;AAEvD;kFACkF;AAClF,MAAM,CAAC,MAAM,mCAAmC,GAAG,MAAM,CAAC;AAE1D;wEACwE;AACxE,MAAM,CAAC,MAAM,6CAA6C,GAAG,KAAK,CAAC;AAEnE,gFAAgF;AAChF,MAAM,CAAC,MAAM,2CAA2C,GAAG,KAAK,CAAC;AACjE,MAAM,CAAC,MAAM,wCAAwC,GAAG,KAAK,CAAC;AAE9D,4EAA4E;AAC5E,MAAM,CAAC,MAAM,2BAA2B,GAAG,KAAK,CAAC;AACjD,MAAM,CAAC,MAAM,2BAA2B,GAAG,KAAK,CAAC;AACjD,MAAM,CAAC,MAAM,sBAAsB,GACjC,6CAA6C;MAC3C,2CAA2C;MAC3C,gCAAgC;MAChC,wCAAwC;MACxC,IAAI,CAAC,GAAG,CAAC,mCAAmC,EAAE,2BAA2B,CAAC;MAC1E,2BAA2B,CAAC;AAChC,MAAM,CAAC,MAAM,0BAA0B,GAAG,MAAM,CAAC;AACjD,MAAM,CAAC,MAAM,2BAA2B,GAAG,KAAK,CAAC;AACjD;+DAC+D;AAC/D,MAAM,CAAC,MAAM,yBAAyB,GAAG,2BAA2B,GAAG,GAAG,CAAC;AAC3E,MAAM,CAAC,MAAM,yBAAyB,GAAG,MAAM,CAAC;AAEhD,IAAI,0BAA0B,IAAI,sBAAsB,EAAE,CAAC;IACzD,MAAM,IAAI,KAAK,CAAC,yEAAyE,CAAC,CAAC;AAC7F,CAAC;AACD,IAAI,sBAAsB,GAAG,MAAM,EAAE,CAAC;IACpC,MAAM,IAAI,KAAK,CAAC,oEAAoE,CAAC,CAAC;AACxF,CAAC;AACD,IAAI,yBAAyB,IAAI,0BAA0B,EAAE,CAAC;IAC5D,MAAM,IAAI,KAAK,CAAC,4DAA4D,CAAC,CAAC;AAChF,CAAC;AACD,IAAI,yBAAyB,IAAI,sBAAsB,GAAG,yBAAyB,EAAE,CAAC;IACpF,MAAM,IAAI,KAAK,CAAC,2EAA2E,CAAC,CAAC;AAC/F,CAAC;AACD,IAAI,yBAAyB,IAAI,0BAA0B,GAAG,yBAAyB,EAAE,CAAC;IACxF,MAAM,IAAI,KAAK,CAAC,4EAA4E,CAAC,CAAC;AAChG,CAAC"}

package/dist/core/terminal-control-grant.d.ts

@@ -0,0 +1,74 @@
+export type TerminalControlScope = 'read' | 'write';
+/**
+ * Audience of a grant that is allowed to travel in a browser-visible URL.
+ * `central` means: only the central dashboard front proxy may consume it, and
+ * only by presenting the matching forward proof below (P1-5). A grant without
+ * an audience is an internal loopback-hop credential and may never appear in a
+ * `?viewToken=`.
+ */
+export type TerminalGrantAudience = 'central';
+export interface TerminalControlGrantClaims {
+    version: 1;
+    scope: TerminalControlScope;
+    sessionId: string;
+    userId: string;
+    authSessionId: string;
+    grantId: string;
+    issuedAt: number;
+    expiresAt: number;
+    /** Set only on view capabilities minted for the browser (P1-5). */
+    audience?: TerminalGrantAudience;
+    /**
+     * Worker boot generation the capability was minted against (P1-5). The
+     * worker re-derives it from its own per-boot view token and refuses any
+     * mismatch, so a restart kills every grant issued to the previous boot even
+     * though verification itself stays stateless.
+     */
+    workerGeneration?: string;
+}
+export type TerminalControlGrantVerification = {
+    ok: true;
+    claims: TerminalControlGrantClaims;
+} | {
+    ok: false;
+    reason: 'missing' | 'malformed' | 'invalid' | 'expired' | 'session_mismatch';
+};
+/**
+ * Mint a dashboard-to-worker grant. The returned capability is for the
+ * loopback proxy hop only and must never be returned in an API body or URL.
+ */
+export declare function issueTerminalControlGrant(secret: string, input: Omit<TerminalControlGrantClaims, 'version' | 'grantId'> & {
+    grantId?: string;
+}): string;
+/**
+ * Cheap shape probe: does this query/header value even claim to be a signed
+ * terminal grant?  Lets hot paths skip the synchronous secret-file read for
+ * ordinary random capability tokens (worker per-boot view token, write token)
+ * that can never verify anyway.
+ */
+export declare function looksLikeTerminalControlGrant(value: string | null | undefined): value is string;
+export declare function deriveWorkerViewGeneration(secret: string, workerViewToken: string | null | undefined): string | null;
+/**
+ * P1-5 — proof that a `?viewToken=` view capability reached the worker THROUGH
+ * the central dashboard front proxy.
+ *
+ * The audience claim above states the intent; this header carries the evidence.
+ * The worker has no channel to the dashboard's auth-session table, so it cannot
+ * re-check liveness itself — but it can demand that the only component which
+ * does (the front proxy) countersign the exact capability being presented. The
+ * value is an HMAC of the capability under the host-only dashboard secret, so a
+ * browser holding the raw URL cannot compute it and a direct dial to the worker
+ * port (or to the daemon's own `/s/` reverse proxy, which is network-bound)
+ * fails closed no matter what headers it forges.
+ *
+ * The proof is deterministic per capability, which is deliberate: it only ever
+ * exists on the 127.0.0.1 hops (dashboard → daemon proxy → worker) and is never
+ * written into a URL, a page or a log, so the only way to hold a (capability,
+ * proof) pair is to already own loopback on this host. Binding it to a time
+ * window would buy nothing against an attacker who is already there.
+ */
+export declare const TERMINAL_VIEW_FORWARD_HEADER = "x-botmux-terminal-view";
+export declare function signTerminalViewForward(secret: string, viewGrant: string | null | undefined): string | null;
+export declare function verifyTerminalViewForward(secret: string, viewGrant: string | null | undefined, proof: string | string[] | undefined): boolean;
+export declare function verifyTerminalControlGrant(secret: string, token: string | string[] | undefined, expectedSessionId: string, now?: number): TerminalControlGrantVerification;
+//# sourceMappingURL=terminal-control-grant.d.ts.map

package/dist/core/terminal-control-grant.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"terminal-control-grant.d.ts","sourceRoot":"","sources":["../../src/core/terminal-control-grant.ts"],"names":[],"mappings":"AAMA,MAAM,MAAM,oBAAoB,GAAG,MAAM,GAAG,OAAO,CAAC;AAEpD;;;;;;GAMG;AACH,MAAM,MAAM,qBAAqB,GAAG,SAAS,CAAC;AAE9C,MAAM,WAAW,0BAA0B;IACzC,OAAO,EAAE,CAAC,CAAC;IACX,KAAK,EAAE,oBAAoB,CAAC;IAC5B,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,aAAa,EAAE,MAAM,CAAC;IACtB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,mEAAmE;IACnE,QAAQ,CAAC,EAAE,qBAAqB,CAAC;IACjC;;;;;OAKG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED,MAAM,MAAM,gCAAgC,GACxC;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,MAAM,EAAE,0BAA0B,CAAA;CAAE,GAChD;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,SAAS,GAAG,WAAW,GAAG,SAAS,GAAG,SAAS,GAAG,kBAAkB,CAAA;CAAE,CAAC;AA6ChG;;;GAGG;AACH,wBAAgB,yBAAyB,CACvC,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,IAAI,CAAC,0BAA0B,EAAE,SAAS,GAAG,SAAS,CAAC,GAAG;IAAE,OAAO,CAAC,EAAE,MAAM,CAAA;CAAE,GACpF,MAAM,CAoBR;AAED;;;;;GAKG;AACH,wBAAgB,6BAA6B,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,KAAK,IAAI,MAAM,CAE/F;AAmBD,wBAAgB,0BAA0B,CACxC,MAAM,EAAE,MAAM,EACd,eAAe,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GACzC,MAAM,GAAG,IAAI,CASf;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,4BAA4B,2BAA2B,CAAC;AAGrE,wBAAgB,uBAAuB,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM,GAAG,IAAI,CAI3G;AAED,wBAAgB,yBAAyB,CACvC,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EACpC,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,GACnC,OAAO,CAOT;AAED,wBAAgB,0BAA0B,CACxC,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,EACpC,iBAAiB,EAAE,MAAM,EACzB,GAAG,SAAa,GACf,gCAAgC,CA2BlC"}

package/dist/core/terminal-control-grant.js

@@ -0,0 +1,183 @@
+import { createHmac, randomBytes, timingSafeEqual } from 'node:crypto';
+const TOKEN_PREFIX = 'bmxg1';
+const GRANT_DOMAIN = 'botmux-terminal-control-grant-v1\0';
+const MAX_GRANT_BYTES = 4_096;
+function boundedIdentity(value) {
+    return value.length > 0 && value.length <= 512 && !/[\r\n\0]/.test(value);
+}
+const BASE_GRANT_KEYS = [
+    'authSessionId', 'expiresAt', 'grantId', 'issuedAt', 'scope', 'sessionId', 'userId', 'version',
+];
+/** A browser-visible view capability carries exactly two extra claims. */
+const AUDIENCED_GRANT_KEYS = [...BASE_GRANT_KEYS, 'audience', 'workerGeneration'].sort();
+function sameKeys(keys, expected) {
+    return keys.length === expected.length && keys.every((key, index) => key === expected[index]);
+}
+function exactGrantClaims(value) {
+    if (!value || typeof value !== 'object' || Array.isArray(value))
+        return false;
+    const record = value;
+    const keys = Object.keys(record).sort();
+    const audienced = sameKeys(keys, AUDIENCED_GRANT_KEYS);
+    if (!audienced && !sameKeys(keys, BASE_GRANT_KEYS))
+        return false;
+    if (audienced) {
+        // Only a READ capability may name an audience: the audience exists so a
+        // grant can be handed to a browser, and a write grant never may be.
+        if (record.audience !== 'central' || record.scope !== 'read')
+            return false;
+        if (typeof record.workerGeneration !== 'string'
+            || !/^[A-Za-z0-9_-]{16,128}$/.test(record.workerGeneration)) {
+            return false;
+        }
+    }
+    return record.version === 1
+        && (record.scope === 'read' || record.scope === 'write')
+        && typeof record.sessionId === 'string' && boundedIdentity(record.sessionId)
+        && typeof record.userId === 'string' && boundedIdentity(record.userId)
+        && typeof record.authSessionId === 'string' && boundedIdentity(record.authSessionId)
+        && typeof record.grantId === 'string' && /^[A-Za-z0-9_-]{16,128}$/.test(record.grantId)
+        && Number.isSafeInteger(record.issuedAt) && record.issuedAt >= 0
+        && Number.isSafeInteger(record.expiresAt) && record.expiresAt > record.issuedAt;
+}
+function signature(secret, payload) {
+    return createHmac('sha256', secret).update(GRANT_DOMAIN).update(payload).digest();
+}
+/**
+ * Mint a dashboard-to-worker grant. The returned capability is for the
+ * loopback proxy hop only and must never be returned in an API body or URL.
+ */
+export function issueTerminalControlGrant(secret, input) {
+    if (!secret)
+        throw new Error('terminal control secret is required');
+    const claims = {
+        version: 1,
+        scope: input.scope,
+        sessionId: input.sessionId,
+        userId: input.userId,
+        authSessionId: input.authSessionId,
+        grantId: input.grantId ?? randomBytes(18).toString('base64url'),
+        issuedAt: input.issuedAt,
+        expiresAt: input.expiresAt,
+        // Kept off the object entirely when absent so the signed key set stays
+        // exactly one of the two accepted shapes.
+        ...(input.audience === undefined && input.workerGeneration === undefined
+            ? {}
+            : { audience: input.audience, workerGeneration: input.workerGeneration }),
+    };
+    if (!exactGrantClaims(claims))
+        throw new Error('invalid terminal control grant claims');
+    const payload = Buffer.from(JSON.stringify(claims), 'utf8').toString('base64url');
+    return `${TOKEN_PREFIX}.${payload}.${signature(secret, payload).toString('base64url')}`;
+}
+/**
+ * Cheap shape probe: does this query/header value even claim to be a signed
+ * terminal grant?  Lets hot paths skip the synchronous secret-file read for
+ * ordinary random capability tokens (worker per-boot view token, write token)
+ * that can never verify anyway.
+ */
+export function looksLikeTerminalControlGrant(value) {
+    return typeof value === 'string' && value.startsWith(`${TOKEN_PREFIX}.`);
+}
+/**
+ * P1-5 — worker boot generation pinned into a view capability.
+ *
+ * Derived one-way from the worker's PER-BOOT random view token, which the
+ * daemon already reports upward and which the worker still holds in memory.
+ * Both sides therefore agree on a generation id without any new plumbing, and
+ * the derived value is safe to publish inside a browser-visible grant: it is an
+ * HMAC under the host-only dashboard secret, so it cannot be inverted back into
+ * the boot token (which by itself opens the terminal read-only).
+ *
+ * A worker restart re-randomizes the boot token ⇒ a different generation ⇒
+ * every grant minted for the previous boot fails closed, statelessly.
+ * Returns null when there is nothing to derive from, or when the caller passed
+ * a signed grant where a boot token was expected (fail closed, never chain).
+ */
+const VIEW_GENERATION_DOMAIN = 'botmux-terminal-view-generation-v1\0';
+export function deriveWorkerViewGeneration(secret, workerViewToken) {
+    if (!secret || typeof workerViewToken !== 'string' || !workerViewToken)
+        return null;
+    if (workerViewToken.length > MAX_GRANT_BYTES)
+        return null;
+    if (looksLikeTerminalControlGrant(workerViewToken))
+        return null;
+    return createHmac('sha256', secret)
+        .update(VIEW_GENERATION_DOMAIN)
+        .update(workerViewToken)
+        .digest('base64url')
+        .slice(0, 32);
+}
+/**
+ * P1-5 — proof that a `?viewToken=` view capability reached the worker THROUGH
+ * the central dashboard front proxy.
+ *
+ * The audience claim above states the intent; this header carries the evidence.
+ * The worker has no channel to the dashboard's auth-session table, so it cannot
+ * re-check liveness itself — but it can demand that the only component which
+ * does (the front proxy) countersign the exact capability being presented. The
+ * value is an HMAC of the capability under the host-only dashboard secret, so a
+ * browser holding the raw URL cannot compute it and a direct dial to the worker
+ * port (or to the daemon's own `/s/` reverse proxy, which is network-bound)
+ * fails closed no matter what headers it forges.
+ *
+ * The proof is deterministic per capability, which is deliberate: it only ever
+ * exists on the 127.0.0.1 hops (dashboard → daemon proxy → worker) and is never
+ * written into a URL, a page or a log, so the only way to hold a (capability,
+ * proof) pair is to already own loopback on this host. Binding it to a time
+ * window would buy nothing against an attacker who is already there.
+ */
+export const TERMINAL_VIEW_FORWARD_HEADER = 'x-botmux-terminal-view';
+const VIEW_FORWARD_DOMAIN = 'botmux-terminal-view-forward-v1\0';
+export function signTerminalViewForward(secret, viewGrant) {
+    if (!secret || typeof viewGrant !== 'string' || !viewGrant)
+        return null;
+    if (viewGrant.length > MAX_GRANT_BYTES)
+        return null;
+    return createHmac('sha256', secret).update(VIEW_FORWARD_DOMAIN).update(viewGrant).digest('base64url');
+}
+export function verifyTerminalViewForward(secret, viewGrant, proof) {
+    if (typeof proof !== 'string' || !proof)
+        return false;
+    const expected = signTerminalViewForward(secret, viewGrant);
+    if (!expected)
+        return false;
+    const provided = Buffer.from(proof, 'utf8');
+    const wanted = Buffer.from(expected, 'utf8');
+    return provided.length === wanted.length && timingSafeEqual(provided, wanted);
+}
+export function verifyTerminalControlGrant(secret, token, expectedSessionId, now = Date.now()) {
+    if (typeof token !== 'string' || !token)
+        return { ok: false, reason: 'missing' };
+    if (!secret || token.length > MAX_GRANT_BYTES)
+        return { ok: false, reason: 'malformed' };
+    const parts = token.split('.');
+    if (parts.length !== 3 || parts[0] !== TOKEN_PREFIX || !/^[A-Za-z0-9_-]+$/.test(parts[1])
+        || !/^[A-Za-z0-9_-]+$/.test(parts[2])) {
+        return { ok: false, reason: 'malformed' };
+    }
+    const expected = signature(secret, parts[1]);
+    const provided = Buffer.from(parts[2], 'base64url');
+    if (provided.length !== expected.length || !timingSafeEqual(provided, expected)) {
+        return { ok: false, reason: 'invalid' };
+    }
+    let parsed;
+    try {
+        const json = Buffer.from(parts[1], 'base64url').toString('utf8');
+        if (Buffer.byteLength(json) > MAX_GRANT_BYTES)
+            return { ok: false, reason: 'malformed' };
+        parsed = JSON.parse(json);
+    }
+    catch {
+        return { ok: false, reason: 'malformed' };
+    }
+    if (!exactGrantClaims(parsed))
+        return { ok: false, reason: 'malformed' };
+    if (parsed.sessionId !== expectedSessionId)
+        return { ok: false, reason: 'session_mismatch' };
+    if (!Number.isFinite(now) || now < parsed.issuedAt - 30_000 || now >= parsed.expiresAt) {
+        return { ok: false, reason: 'expired' };
+    }
+    return { ok: true, claims: parsed };
+}
+//# sourceMappingURL=terminal-control-grant.js.map

package/dist/core/terminal-control-grant.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"terminal-control-grant.js","sourceRoot":"","sources":["../../src/core/terminal-control-grant.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAEvE,MAAM,YAAY,GAAG,OAAO,CAAC;AAC7B,MAAM,YAAY,GAAG,oCAAoC,CAAC;AAC1D,MAAM,eAAe,GAAG,KAAK,CAAC;AAqC9B,SAAS,eAAe,CAAC,KAAa;IACpC,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,KAAK,CAAC,MAAM,IAAI,GAAG,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AAC5E,CAAC;AAED,MAAM,eAAe,GAAG;IACtB,eAAe,EAAE,WAAW,EAAE,SAAS,EAAE,UAAU,EAAE,OAAO,EAAE,WAAW,EAAE,QAAQ,EAAE,SAAS;CAC/F,CAAC;AACF,0EAA0E;AAC1E,MAAM,oBAAoB,GAAG,CAAC,GAAG,eAAe,EAAE,UAAU,EAAE,kBAAkB,CAAC,CAAC,IAAI,EAAE,CAAC;AAEzF,SAAS,QAAQ,CAAC,IAAc,EAAE,QAAkB;IAClD,OAAO,IAAI,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE,CAAC,GAAG,KAAK,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;AAChG,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAc;IACtC,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAC9E,MAAM,MAAM,GAAG,KAAgC,CAAC;IAChD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;IACxC,MAAM,SAAS,GAAG,QAAQ,CAAC,IAAI,EAAE,oBAAoB,CAAC,CAAC;IACvD,IAAI,CAAC,SAAS,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,eAAe,CAAC;QAAE,OAAO,KAAK,CAAC;IACjE,IAAI,SAAS,EAAE,CAAC;QACd,wEAAwE;QACxE,oEAAoE;QACpE,IAAI,MAAM,CAAC,QAAQ,KAAK,SAAS,IAAI,MAAM,CAAC,KAAK,KAAK,MAAM;YAAE,OAAO,KAAK,CAAC;QAC3E,IAAI,OAAO,MAAM,CAAC,gBAAgB,KAAK,QAAQ;eAC1C,CAAC,yBAAyB,CAAC,IAAI,CAAC,MAAM,CAAC,gBAAgB,CAAC,EAAE,CAAC;YAC9D,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC,OAAO,KAAK,CAAC;WACtB,CAAC,MAAM,CAAC,KAAK,KAAK,MAAM,IAAI,MAAM,CAAC,KAAK,KAAK,OAAO,CAAC;WACrD,OAAO,MAAM,CAAC,SAAS,KAAK,QAAQ,IAAI,eAAe,CAAC,MAAM,CAAC,SAAS,CAAC;WACzE,OAAO,MAAM,CAAC,MAAM,KAAK,QAAQ,IAAI,eAAe,CAAC,MAAM,CAAC,MAAM,CAAC;WACnE,OAAO,MAAM,CAAC,aAAa,KAAK,QAAQ,IAAI,eAAe,CAAC,MAAM,CAAC,aAAa,CAAC;WACjF,OAAO,MAAM,CAAC,OAAO,KAAK,QAAQ,IAAI,yBAAyB,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC;WACpF,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAK,MAAM,CAAC,QAAmB,IAAI,CAAC;WACzE,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,SAAS,CAAC,IAAK,MAAM,CAAC,SAAoB,GAAI,MAAM,CAAC,QAAmB,CAAC;AAC5G,CAAC;AAED,SAAS,SAAS,CAAC,MAAc,EAAE,OAAe;IAChD,OAAO,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,CAAC;AACpF,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,yBAAyB,CACvC,MAAc,EACd,KAAqF;IAErF,IAAI,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;IACpE,MAAM,MAAM,GAA+B;QACzC,OAAO,EAAE,CAAC;QACV,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,aAAa,EAAE,KAAK,CAAC,aAAa;QAClC,OAAO,EAAE,KAAK,CAAC,OAAO,IAAI,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC;QAC/D,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,uEAAuE;QACvE,0CAA0C;QAC1C,GAAG,CAAC,KAAK,CAAC,QAAQ,KAAK,SAAS,IAAI,KAAK,CAAC,gBAAgB,KAAK,SAAS;YACtE,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,gBAAgB,EAAE,KAAK,CAAC,gBAAgB,EAAE,CAAC;KAC5E,CAAC;IACF,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;IACxF,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IAClF,OAAO,GAAG,YAAY,IAAI,OAAO,IAAI,SAAS,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;AAC1F,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,6BAA6B,CAAC,KAAgC;IAC5E,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,YAAY,GAAG,CAAC,CAAC;AAC3E,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,sBAAsB,GAAG,sCAAsC,CAAC;AAEtE,MAAM,UAAU,0BAA0B,CACxC,MAAc,EACd,eAA0C;IAE1C,IAAI,CAAC,MAAM,IAAI,OAAO,eAAe,KAAK,QAAQ,IAAI,CAAC,eAAe;QAAE,OAAO,IAAI,CAAC;IACpF,IAAI,eAAe,CAAC,MAAM,GAAG,eAAe;QAAE,OAAO,IAAI,CAAC;IAC1D,IAAI,6BAA6B,CAAC,eAAe,CAAC;QAAE,OAAO,IAAI,CAAC;IAChE,OAAO,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC;SAChC,MAAM,CAAC,sBAAsB,CAAC;SAC9B,MAAM,CAAC,eAAe,CAAC;SACvB,MAAM,CAAC,WAAW,CAAC;SACnB,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AAClB,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAG,wBAAwB,CAAC;AACrE,MAAM,mBAAmB,GAAG,mCAAmC,CAAC;AAEhE,MAAM,UAAU,uBAAuB,CAAC,MAAc,EAAE,SAAoC;IAC1F,IAAI,CAAC,MAAM,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,CAAC,SAAS;QAAE,OAAO,IAAI,CAAC;IACxE,IAAI,SAAS,CAAC,MAAM,GAAG,eAAe;QAAE,OAAO,IAAI,CAAC;IACpD,OAAO,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,mBAAmB,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;AACxG,CAAC;AAED,MAAM,UAAU,yBAAyB,CACvC,MAAc,EACd,SAAoC,EACpC,KAAoC;IAEpC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK;QAAE,OAAO,KAAK,CAAC;IACtD,MAAM,QAAQ,GAAG,uBAAuB,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IAC5D,IAAI,CAAC,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC5B,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IAC5C,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IAC7C,OAAO,QAAQ,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM,IAAI,eAAe,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;AAChF,CAAC;AAED,MAAM,UAAU,0BAA0B,CACxC,MAAc,EACd,KAAoC,EACpC,iBAAyB,EACzB,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE;IAEhB,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;IACjF,IAAI,CAAC,MAAM,IAAI,KAAK,CAAC,MAAM,GAAG,eAAe;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;IACzF,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC/B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,YAAY,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;WACpF,CAAC,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACxC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;IAC5C,CAAC;IACD,MAAM,QAAQ,GAAG,SAAS,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAC7C,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC;IACpD,IAAI,QAAQ,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM,IAAI,CAAC,eAAe,CAAC,QAAQ,EAAE,QAAQ,CAAC,EAAE,CAAC;QAChF,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;IAC1C,CAAC;IACD,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QACjE,IAAI,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,eAAe;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;QACzF,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;IAC5C,CAAC;IACD,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;IACzE,IAAI,MAAM,CAAC,SAAS,KAAK,iBAAiB;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAC;IAC7F,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,GAAG,GAAG,MAAM,CAAC,QAAQ,GAAG,MAAM,IAAI,GAAG,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;QACvF,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;IAC1C,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;AACtC,CAAC"}

package/dist/core/terminal-proxy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"terminal-proxy.d.ts","sourceRoot":"","sources":["../../src/core/terminal-proxy.ts"],"names":[],"mappings":"AAUA;;;;;;;GAOG;AAEH,MAAM,WAAW,oBAAoB;IACnC,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,mFAAmF;IACnF,WAAW,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,MAAM,GAAG,SAAS,CAAC;IACvD;;;;;OAKG;IACH,gBAAgB,CAAC,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;IACtE,wFAAwF;IACxF,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;CAC5B;AAED;;;;;GAKG;AACH,wBAAgB,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAUtF;AAED,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,oBAAoB,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAkI3F"}
+{"version":3,"file":"terminal-proxy.d.ts","sourceRoot":"","sources":["../../src/core/terminal-proxy.ts"],"names":[],"mappings":"AAUA;;;;;;;GAOG;AAEH,MAAM,WAAW,oBAAoB;IACnC,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,mFAAmF;IACnF,WAAW,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,MAAM,GAAG,SAAS,CAAC;IACvD;;;;;OAKG;IACH,gBAAgB,CAAC,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;IACtE,wFAAwF;IACxF,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;CAC5B;AAED;;;;;GAKG;AACH,wBAAgB,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAUtF;AAED,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,oBAAoB,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAiI3F"}