dsh-zen-remote 2.0.3 → 2.2.0

package/lib/plugin-bridge.js

@@ -0,0 +1,318 @@
+/**
+ * The plugin bridge's registration and comparison half (PB-1).
+ *
+ * Other DSH plugins can hand zen-remote a "bridge declaration": the list of
+ * THEIR OWN HTTP routes that may be forwarded to the main server inside a
+ * remote session (docs/adr/0001). A plugin counts as "bridged" only when
+ * BOTH ends agree on the plugin name, the exact version AND the declaration
+ * digest — everything here is the pure logic behind that agreement: the
+ * declaration shape and its validation ({@link normalizeDeclaration}), the
+ * per-process registry backing the `zenRemote` service
+ * ({@link createBridgeRegistry}), and the local-vs-server comparison that a
+ * later task feeds handshake data into ({@link compareBridges}).
+ *
+ * Pure logic by design: no DSH imports, no I/O, no clocks — the digest is
+ * the only place node:crypto appears, which is fine because this module only
+ * ever runs in the backend process. Nothing here talks to the relay or the
+ * network; the handshake side and the request rewrite side are later tasks
+ * that consume a {@link BridgeRegistry} through src/index.ts.
+ */
+import { createHash } from 'node:crypto';
+/** The HTTP methods a bridged route may forward (PB-9). 2.1 accepted GET
+ * only; the write methods arrived with the `methods` field. */
+export const BRIDGE_METHODS = ['GET', 'HEAD', 'POST', 'PUT', 'PATCH', 'DELETE'];
+/** The body cap a route may declare (`maxBody`), in bytes: 64 MiB. */
+export const MAX_ROUTE_BODY_BYTES = 64 * 1024 * 1024;
+/** The body cap a route gets when it declares none: 1 MiB. */
+export const DEFAULT_ROUTE_BODY_BYTES = 1024 * 1024;
+/** The effective upgrade mark of one normalized route. */
+export function routeUpgradesOf(route) {
+    return route.upgrade === true;
+}
+/** The effective forwardable methods of one normalized route. */
+export function routeMethodsOf(route) {
+    return route.methods ?? ['GET'];
+}
+/** The effective body cap of one normalized route, in bytes. */
+export function routeMaxBodyOf(route) {
+    return route.maxBody ?? DEFAULT_ROUTE_BODY_BYTES;
+}
+/** Longest legal `plugin` — the npm package name cap. */
+const MAX_PLUGIN_LENGTH = 214;
+/** Most routes one declaration may carry. */
+const MAX_ROUTES = 64;
+/** npm package name shape: lowercase, URL-safe run of `[a-z0-9._-]` that
+ * starts with a letter or digit, optionally `@scope/name` with the same body
+ * rules on both halves. Not the full official validator (reserved names,
+ * edge punctuation) — enough that a typo'd string cannot masquerade as a
+ * package name and that the two ends normalize identically. */
+const PLUGIN_PATTERN = /^(?:@[a-z0-9][a-z0-9._-]*\/)?[a-z0-9][a-z0-9._-]*$/u;
+/** Query-parameter name carrying the session id. */
+const SESSION_PARAM_PATTERN = /^[A-Za-z][A-Za-z0-9_]{0,63}$/u;
+function isPlainObject(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+/** Every rejection says WHICH field failed and why. */
+function fail(field, detail) {
+    throw new Error(`invalid bridge declaration, ${field}: ${detail}`);
+}
+/**
+ * Validate one declaration and fold it into its comparable form.
+ *
+ * Route paths must be plain absolute paths (start with `/`, no `?`, `#`,
+ * `..` or whitespace) and must stay off the two prefixes zen-remote does not
+ * own: `/_dsh/` (the plugin's own surface) and `/api` (the host's shared
+ * fetch channel) — bridging either would let a third plugin put words in the
+ * host's mouth. The `/api` check is the literal string prefix, so a plugin
+ * route like `/apifoo` is refused too; that overreach is deliberate, the
+ * rule must stay trivially predictable on both ends.
+ *
+ * The digest is sha256 over a canonical JSON of `{plugin, version, routes}`
+ * with a fixed key order, hex, first 16 characters — route ORDER is not part
+ * of it (two ends listing the same routes in different orders still match),
+ * any field VALUE is.
+ * @throws with a field-naming message on any illegal shape.
+ */
+export function normalizeDeclaration(input) {
+    if (!isPlainObject(input))
+        fail('declaration', 'expected an object');
+    for (const key of Object.keys(input)) {
+        if (key !== 'plugin' && key !== 'version' && key !== 'routes')
+            fail(key, 'unknown field (typo guard)');
+    }
+    const { plugin, version, routes } = input;
+    if (typeof plugin !== 'string' || plugin === '')
+        fail('plugin', 'must be a non-empty string');
+    if (plugin.length > MAX_PLUGIN_LENGTH)
+        fail('plugin', `longer than ${MAX_PLUGIN_LENGTH} characters`);
+    if (!PLUGIN_PATTERN.test(plugin))
+        fail('plugin', `"${plugin}" is not an npm package name`);
+    if (typeof version !== 'string' || version.trim() === '')
+        fail('version', 'must be a non-empty string');
+    if (!Array.isArray(routes) || routes.length === 0)
+        fail('routes', 'must be a non-empty array');
+    if (routes.length > MAX_ROUTES)
+        fail('routes', `${routes.length} routes exceeds the ${MAX_ROUTES} cap`);
+    const seen = new Set();
+    const normalizedRoutes = routes.map((route, index) => {
+        if (!isPlainObject(route))
+            fail(`routes[${index}]`, 'expected an object');
+        for (const key of Object.keys(route)) {
+            if (key !== 'path' && key !== 'scope' && key !== 'sessionParam' && key !== 'stream' && key !== 'methods' && key !== 'maxBody' && key !== 'upgrade') {
+                fail(`routes[${index}].${key}`, 'unknown field (typo guard)');
+            }
+        }
+        const { path, scope, sessionParam, stream, methods, maxBody, upgrade } = route;
+        if (typeof path !== 'string' || path === '')
+            fail(`routes[${index}].path`, 'must be a non-empty string');
+        if (!path.startsWith('/'))
+            fail(`routes[${index}].path`, `"${path}" must start with "/"`);
+        if (path.includes('?'))
+            fail(`routes[${index}].path`, `"${path}" must not contain "?"`);
+        if (path.includes('#'))
+            fail(`routes[${index}].path`, `"${path}" must not contain "#"`);
+        if (path.includes('..'))
+            fail(`routes[${index}].path`, `"${path}" must not contain ".."`);
+        if (/\s/u.test(path))
+            fail(`routes[${index}].path`, `"${path}" must not contain whitespace`);
+        if (path.startsWith('/_dsh/') || path.startsWith('/api')) {
+            fail(`routes[${index}].path`, `"${path}" starts with a host-owned prefix (/_dsh/ or /api) and cannot be bridged`);
+        }
+        if (scope !== 'session' && scope !== 'server') {
+            fail(`routes[${index}].scope`, 'must be "session" or "server"');
+        }
+        const param = sessionParam === undefined ? 'sessionId' : sessionParam;
+        if (typeof param !== 'string' || !SESSION_PARAM_PATTERN.test(param)) {
+            fail(`routes[${index}].sessionParam`, `"${String(param)}" must match ${SESSION_PARAM_PATTERN.source}`);
+        }
+        const streamFlag = stream === undefined ? false : stream;
+        if (typeof streamFlag !== 'boolean')
+            fail(`routes[${index}].stream`, 'must be a boolean');
+        if (seen.has(path))
+            fail(`routes[${index}].path`, `duplicate path "${path}"`);
+        seen.add(path);
+        // PB-9: the forwardable methods — uppercase members of the fixed
+        // vocabulary only (method names are case-sensitive on the wire; a
+        // lowercase or mixed-case entry is exactly the typo the strictness
+        // exists to catch), deduplicated and sorted so order never moves the
+        // digest. Omitted stays `undefined` — the digest-preserving choice: a
+        // 2.1-era declaration must hash EXACTLY as it did before this field
+        // existed, so defaults never enter the canonical form.
+        let normalizedMethods;
+        if (methods !== undefined) {
+            if (!Array.isArray(methods) || methods.length === 0) {
+                fail(`routes[${index}].methods`, 'must be a non-empty array of HTTP methods');
+            }
+            const upper = [];
+            for (const entry of methods) {
+                if (typeof entry !== 'string' || !BRIDGE_METHODS.includes(entry)) {
+                    fail(`routes[${index}].methods`, `${JSON.stringify(entry ?? null)} is not one of ${BRIDGE_METHODS.join(', ')}`);
+                }
+                if (!upper.includes(entry))
+                    upper.push(entry);
+            }
+            upper.sort();
+            normalizedMethods = upper;
+        }
+        // PB-9: the body cap — a positive integer, at most
+        // {@link MAX_ROUTE_BODY_BYTES}. Same digest rule as `methods`: only an
+        // EXPLICIT maxBody enters the canonical form, even when it equals the
+        // default.
+        let normalizedMaxBody;
+        if (maxBody !== undefined) {
+            if (typeof maxBody !== 'number' || !Number.isInteger(maxBody) || maxBody <= 0 || maxBody > MAX_ROUTE_BODY_BYTES) {
+                fail(`routes[${index}].maxBody`, `must be a positive integer up to ${MAX_ROUTE_BODY_BYTES}`);
+            }
+            normalizedMaxBody = maxBody;
+        }
+        // PB-10: the WebSocket tunnel mark. Only `true` is legal (this is a
+        // declaration, not a toggle), it cannot coexist with `stream` (a route
+        // is one thing), and it is GET-only — an explicit `methods` naming
+        // anything else cannot be an upgrade route.
+        let normalizedUpgrade;
+        if (upgrade !== undefined) {
+            if (upgrade !== true)
+                fail(`routes[${index}].upgrade`, 'must be true or omitted');
+            if (streamFlag)
+                fail(`routes[${index}].upgrade`, 'cannot be combined with stream');
+            if (normalizedMethods !== undefined && normalizedMethods.some((entry) => entry !== 'GET')) {
+                fail(`routes[${index}].upgrade`, 'upgrade routes are GET-only');
+            }
+            normalizedUpgrade = true;
+        }
+        return { path, scope, sessionParam: param, stream: streamFlag, methods: normalizedMethods, maxBody: normalizedMaxBody, upgrade: normalizedUpgrade };
+    });
+    normalizedRoutes.sort((a, b) => (a.path < b.path ? -1 : a.path > b.path ? 1 : 0));
+    // Fixed key order = the canonical form both ends hash; insertion order of
+    // the object literal IS the contract, JSON.stringify never sorts. The
+    // route entries carry `methods` / `maxBody` ONLY when the plugin declared
+    // them — `JSON.stringify` drops `undefined` values, but the explicit
+    // conditional documents the intent and keeps the PB-1 compatibility
+    // visible instead of incidental.
+    const canonical = JSON.stringify({
+        plugin,
+        version,
+        routes: normalizedRoutes.map((route) => {
+            const entry = {
+                path: route.path,
+                scope: route.scope,
+                sessionParam: route.sessionParam,
+                stream: route.stream,
+            };
+            if (route.methods !== undefined)
+                entry.methods = route.methods;
+            if (route.maxBody !== undefined)
+                entry.maxBody = route.maxBody;
+            if (route.upgrade !== undefined)
+                entry.upgrade = route.upgrade;
+            return entry;
+        }),
+    });
+    const digest = createHash('sha256').update(canonical, 'utf8').digest('hex').slice(0, 16);
+    return { plugin, version, routes: normalizedRoutes, digest };
+}
+/**
+ * Create the registry one DSH process (one plugin row) owns.
+ *
+ * Overwrite bookkeeping is identity-based, not flag-based: each dispose
+ * closes over the exact declaration object it registered and only deletes
+ * the table entry while it is STILL that object — a stale dispose meeting a
+ * newer registration finds someone else's identity and does nothing.
+ */
+export function createBridgeRegistry(options = {}) {
+    const byPlugin = new Map();
+    const listeners = new Set();
+    const warn = options.warn;
+    // A throwing listener must not break the register/remove that invoked it —
+    // registration is bookkeeping other plugins depend on, a bad observer is
+    // that observer's problem. Failures surface through warn when there is one.
+    const emit = () => {
+        for (const listener of [...listeners]) {
+            try {
+                listener();
+            }
+            catch (error) {
+                warn?.(`a zenRemote onChange listener failed: ${error instanceof Error ? error.message : String(error)}`);
+            }
+        }
+    };
+    return {
+        register(input) {
+            const normalized = normalizeDeclaration(input);
+            const replaced = byPlugin.has(normalized.plugin);
+            byPlugin.set(normalized.plugin, normalized);
+            if (replaced)
+                warn?.(`plugin "${normalized.plugin}" re-registered its bridge declaration; the earlier one was replaced`);
+            emit();
+            return () => {
+                if (byPlugin.get(normalized.plugin) !== normalized)
+                    return;
+                byPlugin.delete(normalized.plugin);
+                emit();
+            };
+        },
+        registerNormalized(normalized) {
+            const replaced = byPlugin.has(normalized.plugin);
+            byPlugin.set(normalized.plugin, normalized);
+            if (replaced)
+                warn?.(`plugin "${normalized.plugin}" re-registered its bridge entry; the earlier one was replaced`);
+            emit();
+            return () => {
+                if (byPlugin.get(normalized.plugin) !== normalized)
+                    return;
+                byPlugin.delete(normalized.plugin);
+                emit();
+            };
+        },
+        list() {
+            return [...byPlugin.values()].sort((a, b) => (a.plugin < b.plugin ? -1 : a.plugin > b.plugin ? 1 : 0));
+        },
+        get(plugin) {
+            return byPlugin.get(plugin);
+        },
+        onChange(listener) {
+            listeners.add(listener);
+            return () => {
+                listeners.delete(listener);
+            };
+        },
+    };
+}
+/**
+ * Compare the local registry against the server's handshake table — one
+ * {@link BridgeStatus} per LOCAL declaration, in the input order.
+ *
+ * Judged in this order, first hit wins: offline → the server predates the
+ * plugins handshake field (`undefined`, so nothing can match) → the plugin
+ * is absent server-side → version differs → version equal but digest
+ * differs (same release, different declaration — a skew worth naming) → a
+ * `scope:'server'` route without the server owner's consent → bridged.
+ *
+ * Consent is judged `!== true` on purpose, not `=== false`: an entry without
+ * the field (an older server that learned the field later) means UNKNOWN
+ * consent, and whole-machine data must stay home until the server says yes.
+ */
+export function compareBridges(local, server, online) {
+    return local.map((declaration) => {
+        const localStatus = { plugin: declaration.plugin, bridged: false, localVersion: declaration.version };
+        if (!online)
+            return { ...localStatus, reason: 'offline' };
+        if (server === undefined)
+            return { ...localStatus, reason: 'server-too-old' };
+        const entry = server[declaration.plugin];
+        if (typeof entry !== 'object' || entry === null)
+            return { ...localStatus, reason: 'not-on-server' };
+        const record = entry;
+        const serverVersion = typeof record.version === 'string' ? record.version : undefined;
+        if (serverVersion !== declaration.version)
+            return { ...localStatus, reason: 'version-mismatch', serverVersion };
+        if (record.digest !== declaration.digest)
+            return { ...localStatus, reason: 'declaration-mismatch', serverVersion };
+        const hasServerScopeRoute = declaration.routes.some((route) => route.scope === 'server');
+        if (hasServerScopeRoute && record.serverScopeConsent !== true) {
+            return { ...localStatus, reason: 'consent-off', serverVersion };
+        }
+        return { plugin: declaration.plugin, bridged: true, localVersion: declaration.version, serverVersion };
+    });
+}
+//# sourceMappingURL=plugin-bridge.js.map

package/lib/plugin-bridge.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"plugin-bridge.js","sourceRoot":"","sources":["../src/plugin-bridge.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AAQxC;+DAC+D;AAC/D,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,CAAU,CAAA;AAExF,sEAAsE;AACtE,MAAM,CAAC,MAAM,oBAAoB,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAA;AAEpD,8DAA8D;AAC9D,MAAM,CAAC,MAAM,wBAAwB,GAAG,IAAI,GAAG,IAAI,CAAA;AA6CnD,0DAA0D;AAC1D,MAAM,UAAU,eAAe,CAAC,KAA4B;IAC1D,OAAO,KAAK,CAAC,OAAO,KAAK,IAAI,CAAA;AAC/B,CAAC;AAED,iEAAiE;AACjE,MAAM,UAAU,cAAc,CAAC,KAA4B;IACzD,OAAO,KAAK,CAAC,OAAO,IAAI,CAAC,KAAK,CAAC,CAAA;AACjC,CAAC;AAED,gEAAgE;AAChE,MAAM,UAAU,cAAc,CAAC,KAA4B;IACzD,OAAO,KAAK,CAAC,OAAO,IAAI,wBAAwB,CAAA;AAClD,CAAC;AAWD,yDAAyD;AACzD,MAAM,iBAAiB,GAAG,GAAG,CAAA;AAE7B,6CAA6C;AAC7C,MAAM,UAAU,GAAG,EAAE,CAAA;AAErB;;;;+DAI+D;AAC/D,MAAM,cAAc,GAAG,qDAAqD,CAAA;AAE5E,oDAAoD;AACpD,MAAM,qBAAqB,GAAG,+BAA+B,CAAA;AAE7D,SAAS,aAAa,CAAC,KAAc;IACnC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAA;AAC7E,CAAC;AAED,uDAAuD;AACvD,SAAS,IAAI,CAAC,KAAa,EAAE,MAAc;IACzC,MAAM,IAAI,KAAK,CAAC,+BAA+B,KAAK,KAAK,MAAM,EAAE,CAAC,CAAA;AACpE,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,oBAAoB,CAAC,KAAc;IACjD,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC;QAAE,IAAI,CAAC,aAAa,EAAE,oBAAoB,CAAC,CAAA;IACpE,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACrC,IAAI,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,QAAQ;YAAE,IAAI,CAAC,GAAG,EAAE,4BAA4B,CAAC,CAAA;IACxG,CAAC;IACD,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,KAAK,CAAA;IACzC,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,EAAE;QAAE,IAAI,CAAC,QAAQ,EAAE,4BAA4B,CAAC,CAAA;IAC7F,IAAI,MAAM,CAAC,MAAM,GAAG,iBAAiB;QAAE,IAAI,CAAC,QAAQ,EAAE,eAAe,iBAAiB,aAAa,CAAC,CAAA;IACpG,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,MAAM,CAAC;QAAE,IAAI,CAAC,QAAQ,EAAE,IAAI,MAAM,8BAA8B,CAAC,CAAA;IAC1F,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,CAAC,IAAI,EAAE,KAAK,EAAE;QAAE,IAAI,CAAC,SAAS,EAAE,4BAA4B,CAAC,CAAA;IACvG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,IAAI,CAAC,QAAQ,EAAE,2BAA2B,CAAC,CAAA;IAC9F,IAAI,MAAM,CAAC,MAAM,GAAG,UAAU;QAAE,IAAI,CAAC,QAAQ,EAAE,GAAG,MAAM,CAAC,MAAM,uBAAuB,UAAU,MAAM,CAAC,CAAA;IAEvG,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAA;IAC9B,MAAM,gBAAgB,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,KAAK,EAAyB,EAAE;QAC1E,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC;YAAE,IAAI,CAAC,UAAU,KAAK,GAAG,EAAE,oBAAoB,CAAC,CAAA;QACzE,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YACrC,IAAI,GAAG,KAAK,MAAM,IAAI,GAAG,KAAK,OAAO,IAAI,GAAG,KAAK,cAAc,IAAI,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;gBACnJ,IAAI,CAAC,UAAU,KAAK,KAAK,GAAG,EAAE,EAAE,4BAA4B,CAAC,CAAA;YAC/D,CAAC;QACH,CAAC;QACD,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,YAAY,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,KAAK,CAAA;QAC9E,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,EAAE;YAAE,IAAI,CAAC,UAAU,KAAK,QAAQ,EAAE,4BAA4B,CAAC,CAAA;QACxG,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,IAAI,CAAC,UAAU,KAAK,QAAQ,EAAE,IAAI,IAAI,uBAAuB,CAAC,CAAA;QACzF,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;YAAE,IAAI,CAAC,UAAU,KAAK,QAAQ,EAAE,IAAI,IAAI,wBAAwB,CAAC,CAAA;QACvF,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;YAAE,IAAI,CAAC,UAAU,KAAK,QAAQ,EAAE,IAAI,IAAI,wBAAwB,CAAC,CAAA;QACvF,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;YAAE,IAAI,CAAC,UAAU,KAAK,QAAQ,EAAE,IAAI,IAAI,yBAAyB,CAAC,CAAA;QACzF,IAAI,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,IAAI,CAAC,UAAU,KAAK,QAAQ,EAAE,IAAI,IAAI,+BAA+B,CAAC,CAAA;QAC5F,IAAI,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;YACzD,IAAI,CAAC,UAAU,KAAK,QAAQ,EAAE,IAAI,IAAI,0EAA0E,CAAC,CAAA;QACnH,CAAC;QACD,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC9C,IAAI,CAAC,UAAU,KAAK,SAAS,EAAE,+BAA+B,CAAC,CAAA;QACjE,CAAC;QACD,MAAM,KAAK,GAAG,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,YAAY,CAAA;QACrE,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YACpE,IAAI,CAAC,UAAU,KAAK,gBAAgB,EAAE,IAAI,MAAM,CAAC,KAAK,CAAC,gBAAgB,qBAAqB,CAAC,MAAM,EAAE,CAAC,CAAA;QACxG,CAAC;QACD,MAAM,UAAU,GAAG,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAA;QACxD,IAAI,OAAO,UAAU,KAAK,SAAS;YAAE,IAAI,CAAC,UAAU,KAAK,UAAU,EAAE,mBAAmB,CAAC,CAAA;QACzF,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,IAAI,CAAC,UAAU,KAAK,QAAQ,EAAE,mBAAmB,IAAI,GAAG,CAAC,CAAA;QAC7E,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;QACd,iEAAiE;QACjE,kEAAkE;QAClE,mEAAmE;QACnE,qEAAqE;QACrE,sEAAsE;QACtE,oEAAoE;QACpE,uDAAuD;QACvD,IAAI,iBAAuC,CAAA;QAC3C,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACpD,IAAI,CAAC,UAAU,KAAK,WAAW,EAAE,2CAA2C,CAAC,CAAA;YAC/E,CAAC;YACD,MAAM,KAAK,GAAa,EAAE,CAAA;YAC1B,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;gBAC5B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAE,cAAoC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;oBACxF,IAAI,CAAC,UAAU,KAAK,WAAW,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,IAAI,IAAI,CAAC,kBAAkB,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;gBACjH,CAAC;gBACD,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC;oBAAE,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;YAC/C,CAAC;YACD,KAAK,CAAC,IAAI,EAAE,CAAA;YACZ,iBAAiB,GAAG,KAAK,CAAA;QAC3B,CAAC;QACD,mDAAmD;QACnD,uEAAuE;QACvE,sEAAsE;QACtE,WAAW;QACX,IAAI,iBAAqC,CAAA;QACzC,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,OAAO,IAAI,CAAC,IAAI,OAAO,GAAG,oBAAoB,EAAE,CAAC;gBAChH,IAAI,CAAC,UAAU,KAAK,WAAW,EAAE,oCAAoC,oBAAoB,EAAE,CAAC,CAAA;YAC9F,CAAC;YACD,iBAAiB,GAAG,OAAO,CAAA;QAC7B,CAAC;QACD,oEAAoE;QACpE,uEAAuE;QACvE,mEAAmE;QACnE,4CAA4C;QAC5C,IAAI,iBAAsC,CAAA;QAC1C,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,IAAI,OAAO,KAAK,IAAI;gBAAE,IAAI,CAAC,UAAU,KAAK,WAAW,EAAE,yBAAyB,CAAC,CAAA;YACjF,IAAI,UAAU;gBAAE,IAAI,CAAC,UAAU,KAAK,WAAW,EAAE,gCAAgC,CAAC,CAAA;YAClF,IAAI,iBAAiB,KAAK,SAAS,IAAI,iBAAiB,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,KAAK,CAAC,EAAE,CAAC;gBAC1F,IAAI,CAAC,UAAU,KAAK,WAAW,EAAE,6BAA6B,CAAC,CAAA;YACjE,CAAC;YACD,iBAAiB,GAAG,IAAI,CAAA;QAC1B,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,YAAY,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,iBAAiB,EAAE,OAAO,EAAE,iBAAiB,EAAE,OAAO,EAAE,iBAAiB,EAAE,CAAA;IACrJ,CAAC,CAAC,CAAA;IACF,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;IAEjF,0EAA0E;IAC1E,sEAAsE;IACtE,0EAA0E;IAC1E,qEAAqE;IACrE,oEAAoE;IACpE,iCAAiC;IACjC,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC;QAC/B,MAAM;QACN,OAAO;QACP,MAAM,EAAE,gBAAgB,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE;YACrC,MAAM,KAAK,GAA4B;gBACrC,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,YAAY,EAAE,KAAK,CAAC,YAAY;gBAChC,MAAM,EAAE,KAAK,CAAC,MAAM;aACrB,CAAA;YACD,IAAI,KAAK,CAAC,OAAO,KAAK,SAAS;gBAAE,KAAK,CAAC,OAAO,GAAG,KAAK,CAAC,OAAO,CAAA;YAC9D,IAAI,KAAK,CAAC,OAAO,KAAK,SAAS;gBAAE,KAAK,CAAC,OAAO,GAAG,KAAK,CAAC,OAAO,CAAA;YAC9D,IAAI,KAAK,CAAC,OAAO,KAAK,SAAS;gBAAE,KAAK,CAAC,OAAO,GAAG,KAAK,CAAC,OAAO,CAAA;YAC9D,OAAO,KAAK,CAAA;QACd,CAAC,CAAC;KACH,CAAC,CAAA;IACF,MAAM,MAAM,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAA;IACxF,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,gBAAgB,EAAE,MAAM,EAAE,CAAA;AAC9D,CAAC;AA6CD;;;;;;;GAOG;AACH,MAAM,UAAU,oBAAoB,CAAC,UAAuC,EAAE;IAC5E,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAiC,CAAA;IACzD,MAAM,SAAS,GAAG,IAAI,GAAG,EAAc,CAAA;IACvC,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAA;IACzB,2EAA2E;IAC3E,yEAAyE;IACzE,4EAA4E;IAC5E,MAAM,IAAI,GAAG,GAAS,EAAE;QACtB,KAAK,MAAM,QAAQ,IAAI,CAAC,GAAG,SAAS,CAAC,EAAE,CAAC;YACtC,IAAI,CAAC;gBACH,QAAQ,EAAE,CAAA;YACZ,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,EAAE,CAAC,yCAAyC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAA;YAC3G,CAAC;QACH,CAAC;IACH,CAAC,CAAA;IACD,OAAO;QACL,QAAQ,CAAC,KAAK;YACZ,MAAM,UAAU,GAAG,oBAAoB,CAAC,KAAK,CAAC,CAAA;YAC9C,MAAM,QAAQ,GAAG,QAAQ,CAAC,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,CAAA;YAChD,QAAQ,CAAC,GAAG,CAAC,UAAU,CAAC,MAAM,EAAE,UAAU,CAAC,CAAA;YAC3C,IAAI,QAAQ;gBAAE,IAAI,EAAE,CAAC,WAAW,UAAU,CAAC,MAAM,sEAAsE,CAAC,CAAA;YACxH,IAAI,EAAE,CAAA;YACN,OAAO,GAAG,EAAE;gBACV,IAAI,QAAQ,CAAC,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,KAAK,UAAU;oBAAE,OAAM;gBAC1D,QAAQ,CAAC,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,CAAA;gBAClC,IAAI,EAAE,CAAA;YACR,CAAC,CAAA;QACH,CAAC;QACD,kBAAkB,CAAC,UAAU;YAC3B,MAAM,QAAQ,GAAG,QAAQ,CAAC,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,CAAA;YAChD,QAAQ,CAAC,GAAG,CAAC,UAAU,CAAC,MAAM,EAAE,UAAU,CAAC,CAAA;YAC3C,IAAI,QAAQ;gBAAE,IAAI,EAAE,CAAC,WAAW,UAAU,CAAC,MAAM,gEAAgE,CAAC,CAAA;YAClH,IAAI,EAAE,CAAA;YACN,OAAO,GAAG,EAAE;gBACV,IAAI,QAAQ,CAAC,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,KAAK,UAAU;oBAAE,OAAM;gBAC1D,QAAQ,CAAC,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,CAAA;gBAClC,IAAI,EAAE,CAAA;YACR,CAAC,CAAA;QACH,CAAC;QACD,IAAI;YACF,OAAO,CAAC,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;QACxG,CAAC;QACD,GAAG,CAAC,MAAM;YACR,OAAO,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;QAC7B,CAAC;QACD,QAAQ,CAAC,QAAQ;YACf,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAA;YACvB,OAAO,GAAG,EAAE;gBACV,SAAS,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAA;YAC5B,CAAC,CAAA;QACH,CAAC;KACF,CAAA;AACH,CAAC;AA8BD;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,cAAc,CAC5B,KAA8B,EAC9B,MAAqD,EACrD,MAAe;IAEf,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,WAAW,EAAgB,EAAE;QAC7C,MAAM,WAAW,GAAiB,EAAE,MAAM,EAAE,WAAW,CAAC,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,YAAY,EAAE,WAAW,CAAC,OAAO,EAAE,CAAA;QACnH,IAAI,CAAC,MAAM;YAAE,OAAO,EAAE,GAAG,WAAW,EAAE,MAAM,EAAE,SAAS,EAAE,CAAA;QACzD,IAAI,MAAM,KAAK,SAAS;YAAE,OAAO,EAAE,GAAG,WAAW,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAA;QAC7E,MAAM,KAAK,GAAY,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,CAAA;QACjD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI;YAAE,OAAO,EAAE,GAAG,WAAW,EAAE,MAAM,EAAE,eAAe,EAAE,CAAA;QACnG,MAAM,MAAM,GAAG,KAAmC,CAAA;QAClD,MAAM,aAAa,GAAG,OAAO,MAAM,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAA;QACrF,IAAI,aAAa,KAAK,WAAW,CAAC,OAAO;YAAE,OAAO,EAAE,GAAG,WAAW,EAAE,MAAM,EAAE,kBAAkB,EAAE,aAAa,EAAE,CAAA;QAC/G,IAAI,MAAM,CAAC,MAAM,KAAK,WAAW,CAAC,MAAM;YAAE,OAAO,EAAE,GAAG,WAAW,EAAE,MAAM,EAAE,sBAAsB,EAAE,aAAa,EAAE,CAAA;QAClH,MAAM,mBAAmB,GAAG,WAAW,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAA;QACxF,IAAI,mBAAmB,IAAI,MAAM,CAAC,kBAAkB,KAAK,IAAI,EAAE,CAAC;YAC9D,OAAO,EAAE,GAAG,WAAW,EAAE,MAAM,EAAE,aAAa,EAAE,aAAa,EAAE,CAAA;QACjE,CAAC;QACD,OAAO,EAAE,MAAM,EAAE,WAAW,CAAC,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,WAAW,CAAC,OAAO,EAAE,aAAa,EAAE,CAAA;IACxG,CAAC,CAAC,CAAA;AACJ,CAAC"}

package/lib/plugin-loopback.js

@@ -0,0 +1,207 @@
+/**
+ * The plugin bridge's loopback executor (PB-3): performs one GET against one
+ * of THIS server's own plugin routes, over real loopback HTTP, so the
+ * plugin's own handler — its authentication, its req/res semantics — runs
+ * exactly as it would for a local browser (docs/adr/0001). The relay route
+ * hands this module a validated path + query and gets the plugin's answer
+ * back as a status code plus a byte stream to pump at the sub-client.
+ *
+ * Why the cookie dance: DSH 0.1.2+ requires a signed cookie on EVERY route.
+ * The gateway half solved this for browsers by "playing courier" — one
+ * `GET /?token=…` (the only URL that accepts a token), then the 303's
+ * `set-cookie` straight onto the client (lib/lan-gate-server.cjs
+ * attemptAuthExchange). This module is the same courier for the relay: it
+ * keeps ONE cookie in memory for the process, exchanges it once on first
+ * use, and re-exchanges exactly once when the plugin route answers 401 (a
+ * rotated signing key). The exchange is the lan-gate.mjs wiring's shape:
+ * `connection.authenticatedUrl(protocol//127.0.0.1:port)` builds the token
+ * URL — absent on 0.1.1 hosts, where there is nothing to exchange and every
+ * bridged call fails `loopback-auth` honestly.
+ *
+ * The cookie never leaves this module: no log, no state file, no response —
+ * it exists only as the `cookie` request header on the loopback hop.
+ *
+ * Transport is node:http / node:https on purpose: the plugin's answer must
+ * stream (chunk after chunk, with real backpressure) and must die the
+ * moment the sub-client hangs up (an AbortSignal reaches the socket), and
+ * 0.2.1's self-signed https needs `rejectUnauthorized: false` — a per-
+ * request knob fetch cannot express. The loosened verification is safe BY
+ * CONSTRUCTION: the connection is dialed to the literal 127.0.0.1 the
+ * wiring pinned, never to a name that could be spoofed; the worst an
+ * on-path attacker could forge is data from the machine's own web server
+ * to itself.
+ */
+import http from 'node:http';
+import https from 'node:https';
+import { ADAPTER_RESPONSE_HEADER_ALLOWLIST } from './plugin-adapter-core.js';
+/** The adapter allowlist's headers off one loopback answer, verbatim. */
+function extraAdapterHeadersOf(response) {
+    const extra = {};
+    for (const name of ADAPTER_RESPONSE_HEADER_ALLOWLIST) {
+        const value = response.headers[name];
+        if (typeof value === 'string' && value !== '')
+            extra[name] = value;
+    }
+    return extra;
+}
+/** The one failure the relay maps onto 502 `loopback-auth`: the cookie
+ * exchange could not run (no token URL on this host) or did not yield a
+ * cookie (wrong token, a non-redirect answer, a network error). */
+export class LoopbackAuthError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = 'LoopbackAuthError';
+    }
+}
+function isLoopbackAuthError(error) {
+    return error instanceof LoopbackAuthError;
+}
+/** One raw loopback request that never follows redirects and resolves with
+ * the raw IncomingMessage (the caller drains or streams it). `body`, when
+ * given, is pumped into the request verbatim (PB-9's write forwarding); a
+ * body dying mid-flight destroys the request, which rejects the promise.
+ * The loosened certificate verification (PB-3-fix) applies ONLY to a
+ * literal `127.0.0.1` hostname — the plugin hop the wiring pins — never to
+ * the token exchange when its URL names anything else. */
+function rawRequest(target, method, pathWithQuery, headers, body, signal) {
+    return new Promise((resolve, reject) => {
+        const transport = target.protocol === 'https:' ? https : http;
+        // The signal reaching request() tears the socket down on abort — the
+        // sub-client's hang-up propagates here without extra wiring.
+        const request = transport.request({
+            protocol: target.protocol,
+            hostname: target.hostname,
+            port: target.port,
+            method,
+            path: pathWithQuery,
+            headers,
+            // 0.2.1 serves self-signed https; the dial is the literal loopback
+            // address (see the module comment), so certificate identity carries
+            // no information to verify — and ONLY there: any other hostname
+            // (the token URL's, should the wiring ever point it elsewhere) keeps
+            // full verification.
+            ...(target.protocol === 'https:' && target.hostname === '127.0.0.1' ? { rejectUnauthorized: false } : {}),
+            signal,
+        }, resolve);
+        request.on('error', reject);
+        if (body === null) {
+            request.end();
+            return;
+        }
+        // The body streams through as-is: node's pipe owns the backpressure and
+        // ends the request when the body ends. A source error (the relay
+        // request's socket dying) tears the loopback request down, which
+        // rejects through the handler above.
+        body.on('error', (error) => {
+            request.destroy(error);
+        });
+        body.pipe(request);
+    });
+}
+/** The `name=value` pair of the FIRST set-cookie header, or undefined. */
+function cookiePairOf(setCookies) {
+    const first = setCookies?.[0];
+    if (first === undefined)
+        return undefined;
+    const pair = first.split(';', 1)[0] ?? '';
+    return pair.includes('=') && pair !== '' ? pair : undefined;
+}
+/**
+ * Build the loopback executor. The cookie lives only in this closure.
+ */
+export function createPluginLoopback(options) {
+    let cookie;
+    /** One `GET <tokenUrl>` (never redirected — node:http already does not
+     * follow): a 3xx carrying a set-cookie yields the pair; anything else is
+     * an exchange failure. The token response body is always drained and
+     * discarded — it is the DSH homepage, none of this module's business. */
+    const exchangeCookie = async (signal) => {
+        const tokenUrl = options.getTokenUrl();
+        if (tokenUrl === undefined)
+            throw new LoopbackAuthError('this host exposes no authenticated token URL');
+        let url;
+        try {
+            url = new URL(tokenUrl);
+        }
+        catch {
+            throw new LoopbackAuthError('the token URL does not parse');
+        }
+        let response;
+        try {
+            response = await rawRequest({ protocol: url.protocol, hostname: url.hostname, port: Number(url.port) || (url.protocol === 'https:' ? 443 : 80) }, 'GET', `${url.pathname}${url.search}`, { accept: 'text/html' }, null, signal);
+        }
+        catch (error) {
+            if (signal.aborted)
+                throw error;
+            throw new LoopbackAuthError(`the token exchange request failed: ${error instanceof Error ? error.message : String(error)}`);
+        }
+        const status = response.statusCode ?? 0;
+        const pair = cookiePairOf(response.headers['set-cookie']);
+        response.resume();
+        if (status >= 300 && status < 400 && pair !== undefined) {
+            cookie = pair;
+            return;
+        }
+        throw new LoopbackAuthError(`the token exchange answered ${status}${pair === undefined ? ' without a cookie' : ''}`);
+    };
+    return {
+        async cookieHeader() {
+            if (cookie === undefined)
+                await exchangeCookie(new AbortController().signal);
+            return cookie ?? '';
+        },
+        async request(method, path, query, headers, body, signal) {
+            const target = options.getTarget();
+            const pathWithQuery = query === '' ? path : `${path}?${query}`;
+            // A body cannot be replayed: the first attempt pumps it into the
+            // loopback socket, and a 401 arriving afterwards leaves nothing to
+            // retry with. So a body-bearing request WARMS the cookie first (one
+            // exchange, no plugin request), and a 401 after that travels verbatim
+            // — the plugin's own auth answer, like any other status. Bodyless
+            // requests keep the full 401 → re-exchange → retry ladder.
+            if (body !== null && cookie === undefined) {
+                await exchangeCookie(signal);
+            }
+            const attempt = async () => {
+                const requestHeaders = { host: `127.0.0.1:${target.port}` };
+                if (headers.accept !== undefined)
+                    requestHeaders.accept = headers.accept;
+                if (headers.range !== undefined)
+                    requestHeaders.range = headers.range;
+                // PB-9: the forwarded body's content type — the ONE body header the
+                // bridge passes through.
+                if (headers.contentType !== undefined)
+                    requestHeaders['content-type'] = headers.contentType;
+                // The cookie rides ONLY here. An absent cookie still attempts the
+                // route — a plugin route that skipped DSH auth answers honestly.
+                if (cookie !== undefined)
+                    requestHeaders.cookie = cookie;
+                return rawRequest({ protocol: target.protocol, hostname: '127.0.0.1', port: target.port }, method, pathWithQuery, requestHeaders, body, signal);
+            };
+            let response = await attempt();
+            if (response.statusCode === 401 && body === null) {
+                // Stale or missing cookie: exchange ONCE and retry. A 401 after the
+                // fresh cookie is the plugin's own answer — it travels to the
+                // sub-client verbatim, like any other status.
+                response.resume();
+                cookie = undefined;
+                await exchangeCookie(signal);
+                response = await attempt();
+            }
+            return {
+                status: response.statusCode ?? 0,
+                contentType: typeof response.headers['content-type'] === 'string' ? response.headers['content-type'] : undefined,
+                contentLength: typeof response.headers['content-length'] === 'string' ? response.headers['content-length'] : undefined,
+                cacheControl: typeof response.headers['cache-control'] === 'string' ? response.headers['cache-control'] : undefined,
+                // PB-12: the adapter allowlist — the HTML preview's CSP sandbox, a
+                // download's content-disposition, range headers. Collected here so
+                // the adapter forwards can hand them to the browser; the relay's
+                // cooperative branch ignores the field.
+                extraHeaders: extraAdapterHeadersOf(response),
+                stream: response,
+            };
+        },
+    };
+}
+export { isLoopbackAuthError };
+//# sourceMappingURL=plugin-loopback.js.map

package/lib/plugin-loopback.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"plugin-loopback.js","sourceRoot":"","sources":["../src/plugin-loopback.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAEH,OAAO,IAAI,MAAM,WAAW,CAAA;AAC5B,OAAO,KAAK,MAAM,YAAY,CAAA;AAE9B,OAAO,EAAE,iCAAiC,EAAE,MAAM,0BAA0B,CAAA;AAE5E,yEAAyE;AACzE,SAAS,qBAAqB,CAAC,QAAyB;IACtD,MAAM,KAAK,GAA2B,EAAE,CAAA;IACxC,KAAK,MAAM,IAAI,IAAI,iCAAiC,EAAE,CAAC;QACrD,MAAM,KAAK,GAAG,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,CAAA;QACpC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,EAAE;YAAE,KAAK,CAAC,IAAI,CAAC,GAAG,KAAK,CAAA;IACpE,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC;AAgCD;;mEAEmE;AACnE,MAAM,OAAO,iBAAkB,SAAQ,KAAK;IAC1C,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAA;QACd,IAAI,CAAC,IAAI,GAAG,mBAAmB,CAAA;IACjC,CAAC;CACF;AAED,SAAS,mBAAmB,CAAC,KAAc;IACzC,OAAO,KAAK,YAAY,iBAAiB,CAAA;AAC3C,CAAC;AAyCD;;;;;;0DAM0D;AAC1D,SAAS,UAAU,CACjB,MAA4D,EAC5D,MAAc,EACd,aAAqB,EACrB,OAA+B,EAC/B,IAAiF,EACjF,MAAmB;IAEnB,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,SAAS,GAAG,MAAM,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAA;QAC7D,qEAAqE;QACrE,6DAA6D;QAC7D,MAAM,OAAO,GAAG,SAAS,CAAC,OAAO,CAC/B;YACE,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,MAAM;YACN,IAAI,EAAE,aAAa;YACnB,OAAO;YACP,mEAAmE;YACnE,oEAAoE;YACpE,gEAAgE;YAChE,qEAAqE;YACrE,qBAAqB;YACrB,GAAG,CAAC,MAAM,CAAC,QAAQ,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,KAAK,WAAW,CAAC,CAAC,CAAC,EAAE,kBAAkB,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACzG,MAAM;SACP,EACD,OAAO,CACR,CAAA;QACD,OAAO,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;QAC3B,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;YAClB,OAAO,CAAC,GAAG,EAAE,CAAA;YACb,OAAM;QACR,CAAC;QACD,wEAAwE;QACxE,iEAAiE;QACjE,iEAAiE;QACjE,qCAAqC;QACrC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,KAAY,EAAE,EAAE;YAChC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAA;QACxB,CAAC,CAAC,CAAA;QACF,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;IACpB,CAAC,CAAC,CAAA;AACJ,CAAC;AAED,0EAA0E;AAC1E,SAAS,YAAY,CAAC,UAAgC;IACpD,MAAM,KAAK,GAAG,UAAU,EAAE,CAAC,CAAC,CAAC,CAAA;IAC7B,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,SAAS,CAAA;IACzC,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAA;IACzC,OAAO,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAA;AAC7D,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,oBAAoB,CAAC,OAAoC;IACvE,IAAI,MAA0B,CAAA;IAE9B;;;6EAGyE;IACzE,MAAM,cAAc,GAAG,KAAK,EAAE,MAAmB,EAAiB,EAAE;QAClE,MAAM,QAAQ,GAAG,OAAO,CAAC,WAAW,EAAE,CAAA;QACtC,IAAI,QAAQ,KAAK,SAAS;YAAE,MAAM,IAAI,iBAAiB,CAAC,8CAA8C,CAAC,CAAA;QACvG,IAAI,GAAQ,CAAA;QACZ,IAAI,CAAC;YACH,GAAG,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAA;QACzB,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,iBAAiB,CAAC,8BAA8B,CAAC,CAAA;QAC7D,CAAC;QACD,IAAI,QAAyB,CAAA;QAC7B,IAAI,CAAC;YACH,QAAQ,GAAG,MAAM,UAAU,CACzB,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,IAAI,EAAE,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EACpH,KAAK,EACL,GAAG,GAAG,CAAC,QAAQ,GAAG,GAAG,CAAC,MAAM,EAAE,EAC9B,EAAE,MAAM,EAAE,WAAW,EAAE,EACvB,IAAI,EACJ,MAAM,CACP,CAAA;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,MAAM,CAAC,OAAO;gBAAE,MAAM,KAAK,CAAA;YAC/B,MAAM,IAAI,iBAAiB,CAAC,sCAAsC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAA;QAC7H,CAAC;QACD,MAAM,MAAM,GAAG,QAAQ,CAAC,UAAU,IAAI,CAAC,CAAA;QACvC,MAAM,IAAI,GAAG,YAAY,CAAC,QAAQ,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAA;QACzD,QAAQ,CAAC,MAAM,EAAE,CAAA;QACjB,IAAI,MAAM,IAAI,GAAG,IAAI,MAAM,GAAG,GAAG,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACxD,MAAM,GAAG,IAAI,CAAA;YACb,OAAM;QACR,CAAC;QACD,MAAM,IAAI,iBAAiB,CAAC,+BAA+B,MAAM,GAAG,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAA;IACtH,CAAC,CAAA;IAED,OAAO;QACL,KAAK,CAAC,YAAY;YAChB,IAAI,MAAM,KAAK,SAAS;gBAAE,MAAM,cAAc,CAAC,IAAI,eAAe,EAAE,CAAC,MAAM,CAAC,CAAA;YAC5E,OAAO,MAAM,IAAI,EAAE,CAAA;QACrB,CAAC;QACD,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM;YACtD,MAAM,MAAM,GAAG,OAAO,CAAC,SAAS,EAAE,CAAA;YAClC,MAAM,aAAa,GAAG,KAAK,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,IAAI,KAAK,EAAE,CAAA;YAC9D,iEAAiE;YACjE,mEAAmE;YACnE,oEAAoE;YACpE,sEAAsE;YACtE,kEAAkE;YAClE,2DAA2D;YAC3D,IAAI,IAAI,KAAK,IAAI,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;gBAC1C,MAAM,cAAc,CAAC,MAAM,CAAC,CAAA;YAC9B,CAAC;YACD,MAAM,OAAO,GAAG,KAAK,IAA8B,EAAE;gBACnD,MAAM,cAAc,GAA2B,EAAE,IAAI,EAAE,aAAa,MAAM,CAAC,IAAI,EAAE,EAAE,CAAA;gBACnF,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS;oBAAE,cAAc,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAA;gBACxE,IAAI,OAAO,CAAC,KAAK,KAAK,SAAS;oBAAE,cAAc,CAAC,KAAK,GAAG,OAAO,CAAC,KAAK,CAAA;gBACrE,oEAAoE;gBACpE,yBAAyB;gBACzB,IAAI,OAAO,CAAC,WAAW,KAAK,SAAS;oBAAE,cAAc,CAAC,cAAc,CAAC,GAAG,OAAO,CAAC,WAAW,CAAA;gBAC3F,kEAAkE;gBAClE,iEAAiE;gBACjE,IAAI,MAAM,KAAK,SAAS;oBAAE,cAAc,CAAC,MAAM,GAAG,MAAM,CAAA;gBACxD,OAAO,UAAU,CACf,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,QAAQ,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,EACvE,MAAM,EACN,aAAa,EACb,cAAc,EACd,IAAI,EACJ,MAAM,CACP,CAAA;YACH,CAAC,CAAA;YACD,IAAI,QAAQ,GAAG,MAAM,OAAO,EAAE,CAAA;YAC9B,IAAI,QAAQ,CAAC,UAAU,KAAK,GAAG,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;gBACjD,oEAAoE;gBACpE,8DAA8D;gBAC9D,8CAA8C;gBAC9C,QAAQ,CAAC,MAAM,EAAE,CAAA;gBACjB,MAAM,GAAG,SAAS,CAAA;gBAClB,MAAM,cAAc,CAAC,MAAM,CAAC,CAAA;gBAC5B,QAAQ,GAAG,MAAM,OAAO,EAAE,CAAA;YAC5B,CAAC;YACD,OAAO;gBACL,MAAM,EAAE,QAAQ,CAAC,UAAU,IAAI,CAAC;gBAChC,WAAW,EAAE,OAAO,QAAQ,CAAC,OAAO,CAAC,cAAc,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,SAAS;gBAChH,aAAa,EAAE,OAAO,QAAQ,CAAC,OAAO,CAAC,gBAAgB,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,SAAS;gBACtH,YAAY,EAAE,OAAO,QAAQ,CAAC,OAAO,CAAC,eAAe,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,SAAS;gBACnH,mEAAmE;gBACnE,mEAAmE;gBACnE,iEAAiE;gBACjE,wCAAwC;gBACxC,YAAY,EAAE,qBAAqB,CAAC,QAAQ,CAAC;gBAC7C,MAAM,EAAE,QAAQ;aACjB,CAAA;QACH,CAAC;KACF,CAAA;AACH,CAAC;AAED,OAAO,EAAE,mBAAmB,EAAE,CAAA"}