dsh-multi-router 0.0.0-stage → 0.3.8

package/lib/chunk-3VGKH7MF.js

@@ -0,0 +1,164 @@
+import {
+  TraeCredentialStore,
+  WORKBUDDY_VARIANTS,
+  WorkBuddyCredentialStore,
+  atRestKeyProviderFor,
+  readTraeIdentity,
+  traeStorageCandidates
+} from "./chunk-FTM7RHQV.js";
+import {
+  regionOfCredential
+} from "./chunk-S5KMFAQM.js";
+import {
+  PROVIDERS,
+  writePrivateJson
+} from "./chunk-XMXFIV5G.js";
+
+// src/accounts.mjs
+import { readFile } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { randomBytes } from "node:crypto";
+var localKeyProviders = /* @__PURE__ */ new Map();
+var localAccountKey = (provider, document) => JSON.stringify([
+  provider,
+  document.credential?.uid || document.credential?.userId,
+  document.credential?.enterpriseId || "",
+  document.credential?.edition || ""
+]);
+async function discoverLocalAccounts(provider) {
+  const accounts = [], status = [];
+  for (const variant of WORKBUDDY_VARIANTS.filter((v) => !provider || v.id === provider)) {
+    try {
+      if (!localKeyProviders.has(variant.id)) localKeyProviders.set(variant.id, atRestKeyProviderFor(variant));
+      const store = new WorkBuddyCredentialStore({
+        variant,
+        ownPath: join(tmpdir(), `dsh-router-scan-${randomBytes(16).toString("hex")}.json`),
+        keyProvider: localKeyProviders.get(variant.id),
+        refresh: async () => {
+          throw new Error("Discovery cannot refresh");
+        }
+      });
+      const credential = await store.current();
+      if (credential) accounts.push({ provider: variant.id, document: { version: 1, credential } });
+      status.push({ provider: variant.id, state: credential ? "found" : "not-found" });
+    } catch (e) {
+      status.push({ provider: variant.id, state: "unreadable", code: e.code || "credential_unreadable" });
+    }
+  }
+  for (const id of ["trae", "trae-global"].filter((id2) => !provider || id2 === provider)) {
+    let found = false, unreadable = false;
+    for (const candidate of traeStorageCandidates().filter((c) => c.source === "desktop" && (id === "trae" ? ["cn", "solo"] : ["sg", "solo-sg"]).includes(c.edition))) {
+      try {
+        await readFile(candidate.path, "utf8");
+        const store = new TraeCredentialStore({
+          storagePath: candidate.path,
+          edition: candidate.edition,
+          region: id === "trae" ? "cn" : "ai",
+          ownPath: `${candidate.path}.dsh-router-no-owned-credential`,
+          legacyOwnPath: `${candidate.path}.dsh-router-no-legacy`,
+          refresh: async () => {
+            throw new Error("Discovery cannot refresh");
+          }
+        });
+        const credential = await store.current();
+        if (!credential) {
+          const diagnostic = await store.diagnose();
+          unreadable ||= diagnostic.failures.some((f) => f.reason !== "missing");
+          continue;
+        }
+        if (regionOfCredential(credential) === "ai" !== (id === "trae-global")) continue;
+        const identityDocument = await readTraeIdentity(candidate);
+        accounts.push({ provider: id, document: { version: 1, credential }, identityDocument });
+        found = true;
+      } catch (e) {
+        if (e.code !== "ENOENT") unreadable = true;
+      }
+    }
+    status.push({ provider: id, state: found ? "found" : unreadable ? "unreadable" : "not-found" });
+  }
+  return { accounts, status };
+}
+var pick = (value, keys) => Object.fromEntries(keys.filter((k) => Object.hasOwn(value ?? {}, k)).map((k) => [k, value[k]]));
+async function readPortableCredential(account) {
+  const raw = JSON.parse(await readFile(account.credentialFile, "utf8"));
+  if (account.provider.startsWith("qoder")) return raw.pat ? { document: pick(raw, ["version", "pat", "region"]) } : null;
+  if (!raw.credential?.accessToken) return null;
+  const document = { version: 1, credential: pick(raw.credential, ["accessToken", "refreshToken", "expiresAtMs", "refreshExpiresAtMs", "uid", "nickname", "enterpriseId", "domain", "userId", "accountName", "edition", "userRegion", "host"]) };
+  const identity = account.provider.startsWith("trae") ? pick(JSON.parse(await readFile(account.identityFile, "utf8")), ["machineId", "deviceId", "edition"]) : void 0;
+  if (identity && (!identity.machineId || !identity.deviceId || identity.edition !== raw.credential.edition)) throw new Error("Trae identity is incomplete");
+  return { document, identity };
+}
+async function importAccount({ provider, source, credentialFile, identityFile, edition, identitySource, document, identityDocument }) {
+  if (!PROVIDERS.includes(provider)) throw new Error("Unknown provider");
+  const inline = document !== void 0;
+  const raw = inline ? JSON.stringify(document) : await readFile(source, "utf8");
+  if (!inline) try {
+    document = JSON.parse(raw);
+  } catch {
+  }
+  if (document?.format === "dsh-multi-router-account" && document.provider !== provider) throw new Error("Portable credential provider does not match selected provider");
+  const text = (value) => typeof value === "string" && value.trim().length > 0 && value.length <= 32768;
+  if (provider.startsWith("workbuddy")) {
+    let credential;
+    if (document?.version === 1 && document.credential) credential = document.credential;
+    else if (inline) credential = document;
+    else {
+      const variant = WORKBUDDY_VARIANTS.find((v) => v.id === provider);
+      const store = new WorkBuddyCredentialStore({
+        desktopPath: source,
+        ownPath: `${credentialFile}.import-empty`,
+        variant,
+        keyProvider: atRestKeyProviderFor(variant),
+        refresh: async () => {
+          throw new Error("Import cannot refresh");
+        }
+      });
+      credential = await store.current();
+    }
+    if (!text(credential?.accessToken) || !text(credential.uid) || !Number.isFinite(credential.expiresAtMs) || credential.expiresAtMs <= 0 || typeof credential.domain !== "string" || /[\r\n]/.test(credential.domain)) throw new Error("No valid WorkBuddy credential in source");
+    const { regionOf } = await import("./upstream-42RS7F4H.js");
+    if (regionOf(credential.domain) === "global" !== (provider === "workbuddy-ai")) throw new Error("WorkBuddy credential region does not match provider");
+    await writePrivateJson(credentialFile, { version: 1, credential: { ...credential, source: "dsh" } });
+  } else if (provider.startsWith("trae")) {
+    let credential;
+    if (document?.version === 1 && document.credential) credential = document.credential;
+    else if (inline) credential = document;
+    else {
+      if (!["cn", "sg", "solo", "solo-sg"].includes(edition)) throw new Error("Trae desktop import needs --edition cn|sg|solo|solo-sg");
+      const store = new TraeCredentialStore({
+        storagePath: source,
+        edition,
+        ownPath: `${credentialFile}.import-empty`,
+        legacyOwnPath: `${credentialFile}.no-legacy`,
+        region: provider === "trae" ? "cn" : "ai",
+        refresh: async () => {
+          throw new Error("Import cannot refresh");
+        }
+      });
+      credential = await store.current();
+    }
+    if (!text(credential?.accessToken) || !text(credential.userId) || !Number.isFinite(credential.expiresAtMs) || credential.expiresAtMs <= 0 || !["cn", "sg", "solo", "solo-sg"].includes(credential.edition)) throw new Error("No valid Trae credential in source");
+    const { regionOfCredential: regionOfCredential2, regionOfHost } = await import("./region-DO3KAV7V.js");
+    if (credential.host && !regionOfHost(credential.host)) throw new Error("Invalid Trae credential host");
+    if (regionOfCredential2(credential) === "ai" !== (provider === "trae-global")) throw new Error("Trae credential region does not match provider");
+    const identity = identityDocument ?? document?.identity ?? (identitySource ? JSON.parse(await readFile(identitySource, "utf8")) : source ? await readTraeIdentity({ edition: credential.edition, path: source, source: "desktop" }) : void 0);
+    if (!text(identity?.machineId) || !text(identity.deviceId) || identity.edition !== credential.edition) throw new Error("Identity must belong to this Trae edition");
+    await writePrivateJson(identityFile, identity);
+    await writePrivateJson(credentialFile, { version: 1, credential: { ...credential, source: "dsh" } });
+  } else {
+    const region = provider === "qoder" ? "china" : "global";
+    const pat = typeof document?.pat === "string" ? document.pat.trim() : raw.trim();
+    if (!pat || document && typeof document.pat !== "string" || /\s/.test(pat)) throw new Error("Source must be a Qoder PAT text file or credential JSON");
+    if (document?.region && document.region !== region) throw new Error("Qoder PAT region does not match provider");
+    await writePrivateJson(credentialFile, { version: 2, pat, region, savedAt: (/* @__PURE__ */ new Date()).toISOString() });
+  }
+}
+
+export {
+  localAccountKey,
+  discoverLocalAccounts,
+  readPortableCredential,
+  importAccount
+};
+//# sourceMappingURL=chunk-3VGKH7MF.js.map

package/lib/chunk-3VGKH7MF.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../src/accounts.mjs"],
+  "sourcesContent": ["import { readFile } from 'node:fs/promises';\nimport { tmpdir } from 'node:os';\nimport { join } from 'node:path';\nimport { randomBytes } from 'node:crypto';\nimport { WorkBuddyCredentialStore } from '../upstream/workbuddy/src/auth.ts';\nimport { WORKBUDDY_VARIANTS } from '../upstream/workbuddy/src/variants.ts';\nimport { atRestKeyProviderFor } from '../upstream/workbuddy/src/desktop-credential-protection.ts';\nimport { TraeCredentialStore } from '../upstream/trae/src/auth.ts';\nimport { readTraeIdentity } from '../upstream/trae/src/identity.ts';\nimport { PROVIDERS, writePrivateJson } from './config.mjs';\nimport { traeStorageCandidates } from '../upstream/trae/src/paths.ts';\nimport { regionOfCredential } from '../upstream/trae/src/region.ts';\n\nconst localKeyProviders = new Map();\nexport const localAccountKey = (provider, document) => JSON.stringify([provider,\n  document.credential?.uid || document.credential?.userId,\n  document.credential?.enterpriseId || '', document.credential?.edition || '']);\n\n// Reuse the upstream readers, including WorkBuddy's environment overrides,\n// candidate fallback and encrypted desktop format. Never refresh/write upstream files.\nexport async function discoverLocalAccounts(provider) {\n  const accounts = [], status = [];\n  for (const variant of WORKBUDDY_VARIANTS.filter(v => !provider || v.id === provider)) {\n    try {\n      if (!localKeyProviders.has(variant.id)) localKeyProviders.set(variant.id, atRestKeyProviderFor(variant));\n      const store = new WorkBuddyCredentialStore({ variant, ownPath: join(tmpdir(), `dsh-router-scan-${randomBytes(16).toString('hex')}.json`),\n        keyProvider: localKeyProviders.get(variant.id), refresh: async () => { throw new Error('Discovery cannot refresh'); } });\n      const credential = await store.current();\n      if (credential) accounts.push({ provider: variant.id, document: { version: 1, credential } });\n      status.push({ provider: variant.id, state: credential ? 'found' : 'not-found' });\n    } catch (e) { status.push({ provider: variant.id, state: 'unreadable', code: e.code || 'credential_unreadable' }); }\n  }\n  for (const id of ['trae', 'trae-global'].filter(id => !provider || id === provider)) {\n    let found = false, unreadable = false;\n    for (const candidate of traeStorageCandidates().filter(c => c.source === 'desktop'\n      && (id === 'trae' ? ['cn', 'solo'] : ['sg', 'solo-sg']).includes(c.edition))) {\n      try {\n        await readFile(candidate.path, 'utf8');\n        const store = new TraeCredentialStore({ storagePath: candidate.path, edition: candidate.edition,\n          region: id === 'trae' ? 'cn' : 'ai', ownPath: `${candidate.path}.dsh-router-no-owned-credential`,\n          legacyOwnPath: `${candidate.path}.dsh-router-no-legacy`, refresh: async () => { throw new Error('Discovery cannot refresh'); } });\n        const credential = await store.current();\n        if (!credential) { const diagnostic = await store.diagnose(); unreadable ||= diagnostic.failures.some(f => f.reason !== 'missing'); continue; }\n        if ((regionOfCredential(credential) === 'ai') !== (id === 'trae-global')) continue;\n        const identityDocument = await readTraeIdentity(candidate);\n        accounts.push({ provider: id, document: { version: 1, credential }, identityDocument }); found = true;\n      } catch (e) { if (e.code !== 'ENOENT') unreadable = true; }\n    }\n    status.push({ provider: id, state: found ? 'found' : unreadable ? 'unreadable' : 'not-found' });\n  }\n  return { accounts, status };\n}\n\nconst pick = (value, keys) => Object.fromEntries(keys.filter(k => Object.hasOwn(value ?? {}, k)).map(k => [k, value[k]]));\n// Share the same portable fields with full encrypted configuration migration.\nexport async function readPortableCredential(account) {\n  const raw = JSON.parse(await readFile(account.credentialFile, 'utf8'));\n  if (account.provider.startsWith('qoder')) return raw.pat ? { document: pick(raw, ['version', 'pat', 'region']) } : null;\n  if (!raw.credential?.accessToken) return null;\n  const document = { version: 1, credential: pick(raw.credential, ['accessToken', 'refreshToken', 'expiresAtMs', 'refreshExpiresAtMs', 'uid', 'nickname', 'enterpriseId', 'domain', 'userId', 'accountName', 'edition', 'userRegion', 'host']) };\n  const identity = account.provider.startsWith('trae') ? pick(JSON.parse(await readFile(account.identityFile, 'utf8')), ['machineId', 'deviceId', 'edition']) : undefined;\n  if (identity && (!identity.machineId || !identity.deviceId || identity.edition !== raw.credential.edition)) throw new Error('Trae identity is incomplete');\n  return { document, identity };\n}\n\n// Imports never refresh tokens or write to the provider's own files.\nexport async function importAccount({ provider, source, credentialFile, identityFile, edition, identitySource, document, identityDocument }) {\n  if (!PROVIDERS.includes(provider)) throw new Error('Unknown provider');\n  const inline = document !== undefined;\n  const raw = inline ? JSON.stringify(document) : await readFile(source, 'utf8');\n  if (!inline) try { document = JSON.parse(raw); } catch { /* A Qoder PAT can be a plain text file. */ }\n  if (document?.format === 'dsh-multi-router-account' && document.provider !== provider) throw new Error('Portable credential provider does not match selected provider');\n  const text = value => typeof value === 'string' && value.trim().length > 0 && value.length <= 32768;\n  if (provider.startsWith('workbuddy')) {\n    let credential;\n    if (document?.version === 1 && document.credential) credential = document.credential;\n    else if (inline) credential = document;\n    else {\n      const variant = WORKBUDDY_VARIANTS.find(v => v.id === provider);\n      const store = new WorkBuddyCredentialStore({ desktopPath: source, ownPath: `${credentialFile}.import-empty`,\n        variant, keyProvider: atRestKeyProviderFor(variant), refresh: async () => { throw new Error('Import cannot refresh'); } });\n      credential = await store.current();\n    }\n    if (!text(credential?.accessToken) || !text(credential.uid) || !Number.isFinite(credential.expiresAtMs) || credential.expiresAtMs <= 0 || typeof credential.domain !== 'string' || /[\\r\\n]/.test(credential.domain)) throw new Error('No valid WorkBuddy credential in source');\n    // Use the upstream region resolver rather than guessing regional domains.\n    const { regionOf } = await import('../upstream/workbuddy/src/upstream.ts');\n    if ((regionOf(credential.domain) === 'global') !== (provider === 'workbuddy-ai')) throw new Error('WorkBuddy credential region does not match provider');\n    await writePrivateJson(credentialFile, { version: 1, credential: { ...credential, source: 'dsh' } });\n  } else if (provider.startsWith('trae')) {\n    let credential;\n    if (document?.version === 1 && document.credential) credential = document.credential;\n    else if (inline) credential = document;\n    else {\n      if (!['cn', 'sg', 'solo', 'solo-sg'].includes(edition)) throw new Error('Trae desktop import needs --edition cn|sg|solo|solo-sg');\n      const store = new TraeCredentialStore({ storagePath: source, edition, ownPath: `${credentialFile}.import-empty`,\n        legacyOwnPath: `${credentialFile}.no-legacy`, region: provider === 'trae' ? 'cn' : 'ai',\n        refresh: async () => { throw new Error('Import cannot refresh'); } });\n      credential = await store.current();\n    }\n    if (!text(credential?.accessToken) || !text(credential.userId) || !Number.isFinite(credential.expiresAtMs) || credential.expiresAtMs <= 0 || !['cn', 'sg', 'solo', 'solo-sg'].includes(credential.edition)) throw new Error('No valid Trae credential in source');\n    const { regionOfCredential, regionOfHost } = await import('../upstream/trae/src/region.ts');\n    if (credential.host && !regionOfHost(credential.host)) throw new Error('Invalid Trae credential host');\n    if ((regionOfCredential(credential) === 'ai') !== (provider === 'trae-global')) throw new Error('Trae credential region does not match provider');\n    const identity = identityDocument ?? document?.identity ?? (identitySource ? JSON.parse(await readFile(identitySource, 'utf8'))\n      : source ? await readTraeIdentity({ edition: credential.edition, path: source, source: 'desktop' }) : undefined);\n    if (!text(identity?.machineId) || !text(identity.deviceId) || identity.edition !== credential.edition) throw new Error('Identity must belong to this Trae edition');\n    await writePrivateJson(identityFile, identity);\n    await writePrivateJson(credentialFile, { version: 1, credential: { ...credential, source: 'dsh' } });\n  } else {\n    const region = provider === 'qoder' ? 'china' : 'global';\n    const pat = typeof document?.pat === 'string' ? document.pat.trim() : raw.trim();\n    if (!pat || (document && typeof document.pat !== 'string') || /\\s/.test(pat)) throw new Error('Source must be a Qoder PAT text file or credential JSON');\n    if (document?.region && document.region !== region) throw new Error('Qoder PAT region does not match provider');\n    await writePrivateJson(credentialFile, { version: 2, pat, region, savedAt: new Date().toISOString() });\n  }\n}\n"],
+  "mappings": ";;;;;;;;;;;;;;;;;AAAA,SAAS,gBAAgB;AACzB,SAAS,cAAc;AACvB,SAAS,YAAY;AACrB,SAAS,mBAAmB;AAU5B,IAAM,oBAAoB,oBAAI,IAAI;AAC3B,IAAM,kBAAkB,CAAC,UAAU,aAAa,KAAK,UAAU;AAAA,EAAC;AAAA,EACrE,SAAS,YAAY,OAAO,SAAS,YAAY;AAAA,EACjD,SAAS,YAAY,gBAAgB;AAAA,EAAI,SAAS,YAAY,WAAW;AAAE,CAAC;AAI9E,eAAsB,sBAAsB,UAAU;AACpD,QAAM,WAAW,CAAC,GAAG,SAAS,CAAC;AAC/B,aAAW,WAAW,mBAAmB,OAAO,OAAK,CAAC,YAAY,EAAE,OAAO,QAAQ,GAAG;AACpF,QAAI;AACF,UAAI,CAAC,kBAAkB,IAAI,QAAQ,EAAE,EAAG,mBAAkB,IAAI,QAAQ,IAAI,qBAAqB,OAAO,CAAC;AACvG,YAAM,QAAQ,IAAI,yBAAyB;AAAA,QAAE;AAAA,QAAS,SAAS,KAAK,OAAO,GAAG,mBAAmB,YAAY,EAAE,EAAE,SAAS,KAAK,CAAC,OAAO;AAAA,QACrI,aAAa,kBAAkB,IAAI,QAAQ,EAAE;AAAA,QAAG,SAAS,YAAY;AAAE,gBAAM,IAAI,MAAM,0BAA0B;AAAA,QAAG;AAAA,MAAE,CAAC;AACzH,YAAM,aAAa,MAAM,MAAM,QAAQ;AACvC,UAAI,WAAY,UAAS,KAAK,EAAE,UAAU,QAAQ,IAAI,UAAU,EAAE,SAAS,GAAG,WAAW,EAAE,CAAC;AAC5F,aAAO,KAAK,EAAE,UAAU,QAAQ,IAAI,OAAO,aAAa,UAAU,YAAY,CAAC;AAAA,IACjF,SAAS,GAAG;AAAE,aAAO,KAAK,EAAE,UAAU,QAAQ,IAAI,OAAO,cAAc,MAAM,EAAE,QAAQ,wBAAwB,CAAC;AAAA,IAAG;AAAA,EACrH;AACA,aAAW,MAAM,CAAC,QAAQ,aAAa,EAAE,OAAO,CAAAA,QAAM,CAAC,YAAYA,QAAO,QAAQ,GAAG;AACnF,QAAI,QAAQ,OAAO,aAAa;AAChC,eAAW,aAAa,sBAAsB,EAAE,OAAO,OAAK,EAAE,WAAW,cACnE,OAAO,SAAS,CAAC,MAAM,MAAM,IAAI,CAAC,MAAM,SAAS,GAAG,SAAS,EAAE,OAAO,CAAC,GAAG;AAC9E,UAAI;AACF,cAAM,SAAS,UAAU,MAAM,MAAM;AACrC,cAAM,QAAQ,IAAI,oBAAoB;AAAA,UAAE,aAAa,UAAU;AAAA,UAAM,SAAS,UAAU;AAAA,UACtF,QAAQ,OAAO,SAAS,OAAO;AAAA,UAAM,SAAS,GAAG,UAAU,IAAI;AAAA,UAC/D,eAAe,GAAG,UAAU,IAAI;AAAA,UAAyB,SAAS,YAAY;AAAE,kBAAM,IAAI,MAAM,0BAA0B;AAAA,UAAG;AAAA,QAAE,CAAC;AAClI,cAAM,aAAa,MAAM,MAAM,QAAQ;AACvC,YAAI,CAAC,YAAY;AAAE,gBAAM,aAAa,MAAM,MAAM,SAAS;AAAG,yBAAe,WAAW,SAAS,KAAK,OAAK,EAAE,WAAW,SAAS;AAAG;AAAA,QAAU;AAC9I,YAAK,mBAAmB,UAAU,MAAM,UAAW,OAAO,eAAgB;AAC1E,cAAM,mBAAmB,MAAM,iBAAiB,SAAS;AACzD,iBAAS,KAAK,EAAE,UAAU,IAAI,UAAU,EAAE,SAAS,GAAG,WAAW,GAAG,iBAAiB,CAAC;AAAG,gBAAQ;AAAA,MACnG,SAAS,GAAG;AAAE,YAAI,EAAE,SAAS,SAAU,cAAa;AAAA,MAAM;AAAA,IAC5D;AACA,WAAO,KAAK,EAAE,UAAU,IAAI,OAAO,QAAQ,UAAU,aAAa,eAAe,YAAY,CAAC;AAAA,EAChG;AACA,SAAO,EAAE,UAAU,OAAO;AAC5B;AAEA,IAAM,OAAO,CAAC,OAAO,SAAS,OAAO,YAAY,KAAK,OAAO,OAAK,OAAO,OAAO,SAAS,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,OAAK,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;AAExH,eAAsB,uBAAuB,SAAS;AACpD,QAAM,MAAM,KAAK,MAAM,MAAM,SAAS,QAAQ,gBAAgB,MAAM,CAAC;AACrE,MAAI,QAAQ,SAAS,WAAW,OAAO,EAAG,QAAO,IAAI,MAAM,EAAE,UAAU,KAAK,KAAK,CAAC,WAAW,OAAO,QAAQ,CAAC,EAAE,IAAI;AACnH,MAAI,CAAC,IAAI,YAAY,YAAa,QAAO;AACzC,QAAM,WAAW,EAAE,SAAS,GAAG,YAAY,KAAK,IAAI,YAAY,CAAC,eAAe,gBAAgB,eAAe,sBAAsB,OAAO,YAAY,gBAAgB,UAAU,UAAU,eAAe,WAAW,cAAc,MAAM,CAAC,EAAE;AAC7O,QAAM,WAAW,QAAQ,SAAS,WAAW,MAAM,IAAI,KAAK,KAAK,MAAM,MAAM,SAAS,QAAQ,cAAc,MAAM,CAAC,GAAG,CAAC,aAAa,YAAY,SAAS,CAAC,IAAI;AAC9J,MAAI,aAAa,CAAC,SAAS,aAAa,CAAC,SAAS,YAAY,SAAS,YAAY,IAAI,WAAW,SAAU,OAAM,IAAI,MAAM,6BAA6B;AACzJ,SAAO,EAAE,UAAU,SAAS;AAC9B;AAGA,eAAsB,cAAc,EAAE,UAAU,QAAQ,gBAAgB,cAAc,SAAS,gBAAgB,UAAU,iBAAiB,GAAG;AAC3I,MAAI,CAAC,UAAU,SAAS,QAAQ,EAAG,OAAM,IAAI,MAAM,kBAAkB;AACrE,QAAM,SAAS,aAAa;AAC5B,QAAM,MAAM,SAAS,KAAK,UAAU,QAAQ,IAAI,MAAM,SAAS,QAAQ,MAAM;AAC7E,MAAI,CAAC,OAAQ,KAAI;AAAE,eAAW,KAAK,MAAM,GAAG;AAAA,EAAG,QAAQ;AAAA,EAA8C;AACrG,MAAI,UAAU,WAAW,8BAA8B,SAAS,aAAa,SAAU,OAAM,IAAI,MAAM,+DAA+D;AACtK,QAAM,OAAO,WAAS,OAAO,UAAU,YAAY,MAAM,KAAK,EAAE,SAAS,KAAK,MAAM,UAAU;AAC9F,MAAI,SAAS,WAAW,WAAW,GAAG;AACpC,QAAI;AACJ,QAAI,UAAU,YAAY,KAAK,SAAS,WAAY,cAAa,SAAS;AAAA,aACjE,OAAQ,cAAa;AAAA,SACzB;AACH,YAAM,UAAU,mBAAmB,KAAK,OAAK,EAAE,OAAO,QAAQ;AAC9D,YAAM,QAAQ,IAAI,yBAAyB;AAAA,QAAE,aAAa;AAAA,QAAQ,SAAS,GAAG,cAAc;AAAA,QAC1F;AAAA,QAAS,aAAa,qBAAqB,OAAO;AAAA,QAAG,SAAS,YAAY;AAAE,gBAAM,IAAI,MAAM,uBAAuB;AAAA,QAAG;AAAA,MAAE,CAAC;AAC3H,mBAAa,MAAM,MAAM,QAAQ;AAAA,IACnC;AACA,QAAI,CAAC,KAAK,YAAY,WAAW,KAAK,CAAC,KAAK,WAAW,GAAG,KAAK,CAAC,OAAO,SAAS,WAAW,WAAW,KAAK,WAAW,eAAe,KAAK,OAAO,WAAW,WAAW,YAAY,SAAS,KAAK,WAAW,MAAM,EAAG,OAAM,IAAI,MAAM,yCAAyC;AAE9Q,UAAM,EAAE,SAAS,IAAI,MAAM,OAAO,wBAAuC;AACzE,QAAK,SAAS,WAAW,MAAM,MAAM,cAAe,aAAa,gBAAiB,OAAM,IAAI,MAAM,qDAAqD;AACvJ,UAAM,iBAAiB,gBAAgB,EAAE,SAAS,GAAG,YAAY,EAAE,GAAG,YAAY,QAAQ,MAAM,EAAE,CAAC;AAAA,EACrG,WAAW,SAAS,WAAW,MAAM,GAAG;AACtC,QAAI;AACJ,QAAI,UAAU,YAAY,KAAK,SAAS,WAAY,cAAa,SAAS;AAAA,aACjE,OAAQ,cAAa;AAAA,SACzB;AACH,UAAI,CAAC,CAAC,MAAM,MAAM,QAAQ,SAAS,EAAE,SAAS,OAAO,EAAG,OAAM,IAAI,MAAM,wDAAwD;AAChI,YAAM,QAAQ,IAAI,oBAAoB;AAAA,QAAE,aAAa;AAAA,QAAQ;AAAA,QAAS,SAAS,GAAG,cAAc;AAAA,QAC9F,eAAe,GAAG,cAAc;AAAA,QAAc,QAAQ,aAAa,SAAS,OAAO;AAAA,QACnF,SAAS,YAAY;AAAE,gBAAM,IAAI,MAAM,uBAAuB;AAAA,QAAG;AAAA,MAAE,CAAC;AACtE,mBAAa,MAAM,MAAM,QAAQ;AAAA,IACnC;AACA,QAAI,CAAC,KAAK,YAAY,WAAW,KAAK,CAAC,KAAK,WAAW,MAAM,KAAK,CAAC,OAAO,SAAS,WAAW,WAAW,KAAK,WAAW,eAAe,KAAK,CAAC,CAAC,MAAM,MAAM,QAAQ,SAAS,EAAE,SAAS,WAAW,OAAO,EAAG,OAAM,IAAI,MAAM,oCAAoC;AAChQ,UAAM,EAAE,oBAAAC,qBAAoB,aAAa,IAAI,MAAM,OAAO,sBAAgC;AAC1F,QAAI,WAAW,QAAQ,CAAC,aAAa,WAAW,IAAI,EAAG,OAAM,IAAI,MAAM,8BAA8B;AACrG,QAAKA,oBAAmB,UAAU,MAAM,UAAW,aAAa,eAAgB,OAAM,IAAI,MAAM,gDAAgD;AAChJ,UAAM,WAAW,oBAAoB,UAAU,aAAa,iBAAiB,KAAK,MAAM,MAAM,SAAS,gBAAgB,MAAM,CAAC,IAC1H,SAAS,MAAM,iBAAiB,EAAE,SAAS,WAAW,SAAS,MAAM,QAAQ,QAAQ,UAAU,CAAC,IAAI;AACxG,QAAI,CAAC,KAAK,UAAU,SAAS,KAAK,CAAC,KAAK,SAAS,QAAQ,KAAK,SAAS,YAAY,WAAW,QAAS,OAAM,IAAI,MAAM,2CAA2C;AAClK,UAAM,iBAAiB,cAAc,QAAQ;AAC7C,UAAM,iBAAiB,gBAAgB,EAAE,SAAS,GAAG,YAAY,EAAE,GAAG,YAAY,QAAQ,MAAM,EAAE,CAAC;AAAA,EACrG,OAAO;AACL,UAAM,SAAS,aAAa,UAAU,UAAU;AAChD,UAAM,MAAM,OAAO,UAAU,QAAQ,WAAW,SAAS,IAAI,KAAK,IAAI,IAAI,KAAK;AAC/E,QAAI,CAAC,OAAQ,YAAY,OAAO,SAAS,QAAQ,YAAa,KAAK,KAAK,GAAG,EAAG,OAAM,IAAI,MAAM,yDAAyD;AACvJ,QAAI,UAAU,UAAU,SAAS,WAAW,OAAQ,OAAM,IAAI,MAAM,0CAA0C;AAC9G,UAAM,iBAAiB,gBAAgB,EAAE,SAAS,GAAG,KAAK,QAAQ,UAAS,oBAAI,KAAK,GAAE,YAAY,EAAE,CAAC;AAAA,EACvG;AACF;",
+  "names": ["id", "regionOfCredential"]
+}

package/lib/chunk-DNQPZMPF.js

@@ -0,0 +1,33 @@
+// upstream/workbuddy/src/loopback.ts
+var LOOPBACK_HOSTS = /* @__PURE__ */ new Set(["127.0.0.1", "localhost", "[::1]"]);
+function hostnameOfHost(host) {
+  let hostname = host.trim().toLowerCase();
+  if (hostname.startsWith("[")) {
+    const end = hostname.indexOf("]");
+    return end === -1 ? hostname : hostname.slice(0, end + 1);
+  }
+  const colon = hostname.lastIndexOf(":");
+  if (colon !== -1 && !hostname.slice(0, colon).includes(":") && /^\d+$/.test(hostname.slice(colon + 1))) {
+    hostname = hostname.slice(0, colon);
+  }
+  return hostname;
+}
+function hostIsLoopback(host) {
+  if (host === void 0 || host.trim() === "") return false;
+  return LOOPBACK_HOSTS.has(hostnameOfHost(host));
+}
+function originIsLoopback(origin) {
+  if (origin === void 0 || origin.trim() === "") return true;
+  try {
+    const { hostname } = new URL(origin);
+    return LOOPBACK_HOSTS.has(hostname) || hostname === "::1";
+  } catch {
+    return false;
+  }
+}
+
+export {
+  hostIsLoopback,
+  originIsLoopback
+};
+//# sourceMappingURL=chunk-DNQPZMPF.js.map

package/lib/chunk-DNQPZMPF.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../upstream/workbuddy/src/loopback.ts"],
+  "sourcesContent": ["/**\n * Shared loopback gates for the plugin's local HTTP surfaces: the loopback\n * shim and the same-origin web-status route. Both are only ever meant to be\n * addressed through the machine's loopback interface.\n *\n * @module dsh-workbuddy-connect/loopback\n */\n\n/** Loopback hostnames a local plugin surface may be addressed by. */\nexport const LOOPBACK_HOSTS = new Set(['127.0.0.1', 'localhost', '[::1]'])\n\n/** Strip the optional :port from a Host header value, IPv6-bracket aware. */\nexport function hostnameOfHost(host: string): string {\n  let hostname = host.trim().toLowerCase()\n  if (hostname.startsWith('[')) {\n    const end = hostname.indexOf(']')\n    return end === -1 ? hostname : hostname.slice(0, end + 1)\n  }\n  // Only `name:port` with a single colon is a port; anything with more colons\n  // is an (unbracketed) IPv6 literal and must not be truncated.\n  const colon = hostname.lastIndexOf(':')\n  if (colon !== -1 && !hostname.slice(0, colon).includes(':') && /^\\d+$/.test(hostname.slice(colon + 1))) {\n    hostname = hostname.slice(0, colon)\n  }\n  return hostname\n}\n\n/**\n * The request's Host header must name the loopback interface. A DNS-rebinding\n * page (attacker domain re-resolved to 127.0.0.1) sends its own domain in\n * Host, so this check drops those before any routing happens.\n */\nexport function hostIsLoopback(host: string | undefined): boolean {\n  if (host === undefined || host.trim() === '') return false\n  return LOOPBACK_HOSTS.has(hostnameOfHost(host))\n}\n\n/**\n * A browser-sent Origin (present header) must be loopback. Non-browser\n * clients (the plugin's own fetch calls) send no Origin at all and pass.\n */\nexport function originIsLoopback(origin: string | undefined): boolean {\n  if (origin === undefined || origin.trim() === '') return true\n  try {\n    const { hostname } = new URL(origin)\n    return LOOPBACK_HOSTS.has(hostname) || hostname === '::1'\n  } catch {\n    return false\n  }\n}\n"],
+  "mappings": ";AASO,IAAM,iBAAiB,oBAAI,IAAI,CAAC,aAAa,aAAa,OAAO,CAAC;AAGlE,SAAS,eAAe,MAAsB;AACnD,MAAI,WAAW,KAAK,KAAK,EAAE,YAAY;AACvC,MAAI,SAAS,WAAW,GAAG,GAAG;AAC5B,UAAM,MAAM,SAAS,QAAQ,GAAG;AAChC,WAAO,QAAQ,KAAK,WAAW,SAAS,MAAM,GAAG,MAAM,CAAC;AAAA,EAC1D;AAGA,QAAM,QAAQ,SAAS,YAAY,GAAG;AACtC,MAAI,UAAU,MAAM,CAAC,SAAS,MAAM,GAAG,KAAK,EAAE,SAAS,GAAG,KAAK,QAAQ,KAAK,SAAS,MAAM,QAAQ,CAAC,CAAC,GAAG;AACtG,eAAW,SAAS,MAAM,GAAG,KAAK;AAAA,EACpC;AACA,SAAO;AACT;AAOO,SAAS,eAAe,MAAmC;AAChE,MAAI,SAAS,UAAa,KAAK,KAAK,MAAM,GAAI,QAAO;AACrD,SAAO,eAAe,IAAI,eAAe,IAAI,CAAC;AAChD;AAMO,SAAS,iBAAiB,QAAqC;AACpE,MAAI,WAAW,UAAa,OAAO,KAAK,MAAM,GAAI,QAAO;AACzD,MAAI;AACF,UAAM,EAAE,SAAS,IAAI,IAAI,IAAI,MAAM;AACnC,WAAO,eAAe,IAAI,QAAQ,KAAK,aAAa;AAAA,EACtD,QAAQ;AACN,WAAO;AAAA,EACT;AACF;",
+  "names": []
+}