fileport-gateway 0.1.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Fileport contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,57 @@
+# Fileport
+
+Fileport is a clean-room Agent Artifact Gateway backed by the official [Dufs](https://github.com/sigoden/dufs) filesystem engine.
+
+It turns a local file or directory into an opaque capability URL while keeping Dufs workers on Unix sockets and enforcing the share boundary again at the Gateway.
+
+## Phase 1 status
+
+Implemented:
+
+- official Dufs 0.46.0 pin + compatibility contract;
+- persistent capability shares;
+- read-only Unix Socket workers with root reuse and crash restart;
+- reverse proxy with GET/HEAD/Range;
+- traversal, encoded-path and symlink-escape protection;
+- CLI and browser preview shell;
+- explicit RO/RW shares, expiry and strict existing-file-only atomic saves.
+
+See [current architecture](docs/CURRENT_ARCHITECTURE.md), [Dufs compatibility](docs/DUFS_COMPATIBILITY.md), and [migration plan](docs/MIGRATION_PLAN.md).
+
+## Install
+
+```bash
+npm install --global fileport-gateway
+fileport share /absolute/path/to/report.md --readonly
+```
+
+The npm package includes the checksum-verified official Dufs 0.46.0 Linux x86_64 binary. Source development uses `npm ci && npm run vendor:dufs && npm run build`.
+
+## Run
+
+```bash
+export FILEPORT_PUBLIC_BASE_URL="http://<devbox-ip>:7892"
+fileport serve
+```
+
+In another shell:
+
+```bash
+fileport share /absolute/path/to/report.md
+fileport ls
+fileport revoke <share-id>
+```
+
+Fileport provides HTTP only; `FILEPORT_PUBLIC_BASE_URL` rejects `https://`. The public service defaults to `0.0.0.0:7892`. Agent control is available only through `$FILEPORT_STATE_DIR/control.sock` (0600).
+
+## Verify
+
+```bash
+npm run typecheck
+FILEPORT_TEST_DUFS=vendor/dufs npm test
+FILEPORT_DUFS_BIN=vendor/dufs node scripts/dufs-compatibility.mjs
+```
+
+## Security boundary
+
+Dufs always remains read-only and never receives network exposure or write flags. RO is the default. An explicit RW share can modify only an existing allowlisted text file through Fileport's versioned, atomic Save API. Fileport rejects Home/filesystem-root/common credential targets; capability requests are canonicalized and checked against the exact share scope before proxying.

package/THIRD_PARTY_NOTICES.md

@@ -0,0 +1,12 @@
+# Third-party notices
+
+## Dufs
+
+Fileport Gateway packages the official Linux x86_64 musl binary of [Dufs](https://github.com/sigoden/dufs), version 0.46.0.
+
+- Copyright: Dufs contributors
+- License: Apache License 2.0 or MIT, at your option
+- Source tag: https://github.com/sigoden/dufs/tree/v0.46.0
+- Release archive SHA256: `817769f726613194bcff9d0e3e481eaccc86ac11208857614f36a8c02f410977`
+
+The corresponding license texts are included in `vendor/LICENSE-DUFS-APACHE` and `vendor/LICENSE-DUFS-MIT`.

package/dist/cli.d.ts

@@ -0,0 +1,2 @@
+#!/usr/bin/env node
+export {};

package/dist/cli.js

@@ -0,0 +1,87 @@
+#!/usr/bin/env node
+import { spawn } from "node:child_process";
+import fs from "node:fs/promises";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+import { controlRequest } from "./client.js";
+import { loadConfig } from "./config.js";
+import { Gateway } from "./gateway.js";
+import { parseDuration } from "./duration.js";
+const config = loadConfig();
+const controlSocket = path.join(config.stateDir, "control.sock");
+async function waitForControl() { const deadline = Date.now() + 5000; while (Date.now() < deadline) {
+    try {
+        await controlRequest(controlSocket, "GET", "/shares");
+        return;
+    }
+    catch {
+        await new Promise((r) => setTimeout(r, 50));
+    }
+} throw new Error("gateway did not become ready"); }
+async function ensureServer() {
+    try {
+        await controlRequest(controlSocket, "GET", "/shares");
+        return;
+    }
+    catch { }
+    await fs.mkdir(config.stateDir, { recursive: true, mode: 0o700 });
+    const executable = fileURLToPath(import.meta.url);
+    const child = spawn(process.execPath, [executable, "serve"], { detached: true, stdio: "ignore", env: process.env });
+    child.unref();
+    await waitForControl();
+}
+async function main() {
+    const [command, ...args] = process.argv.slice(2);
+    if (command === "serve") {
+        const gateway = new Gateway(config);
+        await gateway.start();
+        console.log(`fileport listening on ${config.host}:${config.port}`);
+        const stop = async () => { await gateway.close(); process.exit(0); };
+        process.on("SIGINT", stop);
+        process.on("SIGTERM", stop);
+        return;
+    }
+    if (command === "share") {
+        let permission = "ro";
+        let expire;
+        const positional = [];
+        for (let index = 0; index < args.length; index++) {
+            const arg = args[index];
+            if (arg === "--rw")
+                permission = "rw";
+            else if (arg === "--readonly" || arg === "--ro")
+                permission = "ro";
+            else if (arg === "--expire") {
+                expire = args[++index];
+                if (!expire)
+                    throw new Error("--expire requires a duration");
+            }
+            else if (arg.startsWith("-"))
+                throw new Error(`unknown option: ${arg}`);
+            else
+                positional.push(arg);
+        }
+        if (positional.length !== 1)
+            throw new Error("usage: fileport share <path> [--readonly|--rw] [--expire 2h]");
+        await ensureServer();
+        const result = await controlRequest(controlSocket, "POST", "/shares", { path: positional[0], permission, expiresAt: expire ? parseDuration(expire) : undefined });
+        console.log(result.url);
+        return;
+    }
+    if (command === "ls") {
+        await ensureServer();
+        console.log(JSON.stringify(await controlRequest(controlSocket, "GET", "/shares"), null, 2));
+        return;
+    }
+    if (command === "revoke") {
+        if (!args[0])
+            throw new Error("usage: fileport revoke <share-id>");
+        await ensureServer();
+        await controlRequest(controlSocket, "DELETE", `/shares/${encodeURIComponent(args[0])}`);
+        return;
+    }
+    console.error("usage: fileport <serve|share|ls|revoke>");
+    process.exitCode = 2;
+}
+main().catch((error) => { console.error(error instanceof Error ? error.message : error); process.exitCode = 1; });
+//# sourceMappingURL=cli.js.map

package/dist/cli.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli.js","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AACA,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAC3C,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAClC,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAC7C,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AACvC,OAAO,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAE9C,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;AAAC,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,cAAc,CAAC,CAAC;AAC9F,KAAK,UAAU,cAAc,KAAoB,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,EAAE,CAAC;IAAC,IAAI,CAAC;QAAC,MAAM,cAAc,CAAC,aAAa,EAAE,KAAK,EAAE,SAAS,CAAC,CAAC;QAAC,OAAO;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,MAAM,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;IAAC,CAAC;AAAC,CAAC,CAAC,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC,CAAC,CAAC;AACvS,KAAK,UAAU,YAAY;IACzB,IAAI,CAAC;QAAC,MAAM,cAAc,CAAC,aAAa,EAAE,KAAK,EAAE,SAAS,CAAC,CAAC;QAAC,OAAO;IAAC,CAAC;IAAC,MAAM,CAAC,CAAA,CAAC;IAC/E,MAAM,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAClE,MAAM,UAAU,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAAC,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,UAAU,EAAE,OAAO,CAAC,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IAAC,KAAK,CAAC,KAAK,EAAE,CAAC;IAAC,MAAM,cAAc,EAAE,CAAC;AAChN,CAAC;AACD,KAAK,UAAU,IAAI;IACjB,MAAM,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACjD,IAAI,OAAO,KAAK,OAAO,EAAE,CAAC;QAAC,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC;QAAC,MAAM,OAAO,CAAC,KAAK,EAAE,CAAC;QAAC,OAAO,CAAC,GAAG,CAAC,yBAAyB,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;QAAC,MAAM,IAAI,GAAG,KAAK,IAAI,EAAE,GAAG,MAAM,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;QAAC,OAAO;IAAC,CAAC;IACnS,IAAI,OAAO,KAAK,OAAO,EAAE,CAAC;QACxB,IAAI,UAAU,GAAgB,IAAI,CAAC;QAAC,IAAI,MAA0B,CAAC;QAAC,MAAM,UAAU,GAAa,EAAE,CAAC;QACpG,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,CAAC;YACjD,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC;YACxB,IAAI,GAAG,KAAK,MAAM;gBAAE,UAAU,GAAG,IAAI,CAAC;iBACjC,IAAI,GAAG,KAAK,YAAY,IAAI,GAAG,KAAK,MAAM;gBAAE,UAAU,GAAG,IAAI,CAAC;iBAC9D,IAAI,GAAG,KAAK,UAAU,EAAE,CAAC;gBAAC,MAAM,GAAG,IAAI,CAAC,EAAE,KAAK,CAAC,CAAC;gBAAC,IAAI,CAAC,MAAM;oBAAE,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;YAAC,CAAC;iBACjH,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,mBAAmB,GAAG,EAAE,CAAC,CAAC;;gBACnE,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC5B,CAAC;QACD,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,8DAA8D,CAAC,CAAC;QAC7G,MAAM,YAAY,EAAE,CAAC;QAAC,MAAM,MAAM,GAAG,MAAM,cAAc,CAAe,aAAa,EAAE,MAAM,EAAE,SAAS,EAAE,EAAE,IAAI,EAAE,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC;QAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAAC,OAAO;IACzO,CAAC;IACD,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;QAAC,MAAM,YAAY,EAAE,CAAC;QAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,cAAc,CAAC,aAAa,EAAE,KAAK,EAAE,SAAS,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;QAAC,OAAO;IAAC,CAAC;IACpJ,IAAI,OAAO,KAAK,QAAQ,EAAE,CAAC;QAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;QAAC,MAAM,YAAY,EAAE,CAAC;QAAC,MAAM,cAAc,CAAC,aAAa,EAAE,QAAQ,EAAE,WAAW,kBAAkB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAAC,OAAO;IAAC,CAAC;IACxN,OAAO,CAAC,KAAK,CAAC,yCAAyC,CAAC,CAAC;IAAC,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;AACjF,CAAC;AACD,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,GAAG,OAAO,CAAC,KAAK,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC"}

package/dist/client.d.ts

@@ -0,0 +1 @@
+export declare function controlRequest<T>(socketPath: string, method: string, path: string, body?: unknown): Promise<T>;

package/dist/client.js

@@ -0,0 +1,22 @@
+import http from "node:http";
+export function controlRequest(socketPath, method, path, body) {
+    return new Promise((resolve, reject) => {
+        const data = body === undefined ? undefined : JSON.stringify(body);
+        const req = http.request({ socketPath, method, path, headers: data ? { "content-type": "application/json", "content-length": Buffer.byteLength(data) } : undefined }, (res) => {
+            const chunks = [];
+            res.on("data", (chunk) => chunks.push(chunk));
+            res.on("end", () => { const text = Buffer.concat(chunks).toString("utf8"); if ((res.statusCode || 500) >= 400)
+                return reject(new Error(text)); try {
+                resolve(JSON.parse(text));
+            }
+            catch (error) {
+                reject(error);
+            } });
+        });
+        req.on("error", reject);
+        if (data)
+            req.write(data);
+        req.end();
+    });
+}
+//# sourceMappingURL=client.js.map

package/dist/client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.js","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,MAAM,UAAU,cAAc,CAAI,UAAkB,EAAE,MAAc,EAAE,IAAY,EAAE,IAAc;IAChG,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,IAAI,GAAG,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QACnE,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,EAAE,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,GAAG,EAAE,EAAE;YAC5K,MAAM,MAAM,GAAa,EAAE,CAAC;YAAC,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;YAAC,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,IAAI,GAAG,CAAC,IAAI,GAAG;gBAAE,OAAO,MAAM,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;gBAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAM,CAAC,CAAC;YAAC,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACzS,CAAC,CAAC,CAAC;QAAC,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAAC,IAAI,IAAI;YAAE,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAAC,GAAG,CAAC,GAAG,EAAE,CAAC;IACpE,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/config.d.ts

@@ -0,0 +1,2 @@
+import type { FileportConfig } from "./types.js";
+export declare function loadConfig(env?: NodeJS.ProcessEnv): FileportConfig;

package/dist/config.js

@@ -0,0 +1,30 @@
+import os from "node:os";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+function integer(value, fallback) {
+    if (!value)
+        return fallback;
+    const result = Number(value);
+    if (!Number.isInteger(result) || result < 1 || result > 65535)
+        throw new Error(`invalid port: ${value}`);
+    return result;
+}
+export function loadConfig(env = process.env) {
+    const stateHome = env.XDG_STATE_HOME || path.join(os.homedir(), ".local", "state");
+    let publicBaseUrl = env.FILEPORT_PUBLIC_BASE_URL;
+    if (publicBaseUrl) {
+        const parsed = new URL(publicBaseUrl);
+        if (parsed.protocol !== "http:")
+            throw new Error("Fileport supports HTTP only; FILEPORT_PUBLIC_BASE_URL must use http://");
+        publicBaseUrl = publicBaseUrl.replace(/\/$/, "");
+    }
+    const packagedDufs = fileURLToPath(new URL("../vendor/dufs", import.meta.url));
+    return {
+        stateDir: path.resolve(env.FILEPORT_STATE_DIR || path.join(stateHome, "fileport")),
+        host: env.FILEPORT_HOST || "0.0.0.0",
+        port: integer(env.FILEPORT_PORT, 7892),
+        dufsBin: path.resolve(env.FILEPORT_DUFS_BIN || packagedDufs),
+        publicBaseUrl,
+    };
+}
+//# sourceMappingURL=config.js.map

package/dist/config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAGzC,SAAS,OAAO,CAAC,KAAyB,EAAE,QAAgB;IAC1D,IAAI,CAAC,KAAK;QAAE,OAAO,QAAQ,CAAC;IAC5B,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IAC7B,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,MAAM,GAAG,CAAC,IAAI,MAAM,GAAG,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,iBAAiB,KAAK,EAAE,CAAC,CAAC;IACzG,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,MAAyB,OAAO,CAAC,GAAG;IAC7D,MAAM,SAAS,GAAG,GAAG,CAAC,cAAc,IAAI,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;IACnF,IAAI,aAAa,GAAG,GAAG,CAAC,wBAAwB,CAAC;IACjD,IAAI,aAAa,EAAE,CAAC;QAClB,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,aAAa,CAAC,CAAC;QACtC,IAAI,MAAM,CAAC,QAAQ,KAAK,OAAO;YAAE,MAAM,IAAI,KAAK,CAAC,wEAAwE,CAAC,CAAC;QAC3H,aAAa,GAAG,aAAa,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACnD,CAAC;IACD,MAAM,YAAY,GAAG,aAAa,CAAC,IAAI,GAAG,CAAC,gBAAgB,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IAC/E,OAAO;QACL,QAAQ,EAAE,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,kBAAkB,IAAI,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC;QAClF,IAAI,EAAE,GAAG,CAAC,aAAa,IAAI,SAAS;QACpC,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC,aAAa,EAAE,IAAI,CAAC;QACtC,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,IAAI,YAAY,CAAC;QAC5D,aAAa;KACd,CAAC;AACJ,CAAC"}

package/dist/duration.d.ts

@@ -0,0 +1 @@
+export declare function parseDuration(value: string, now?: number): string;

package/dist/duration.js

@@ -0,0 +1,14 @@
+export function parseDuration(value, now = Date.now()) {
+    const match = value.match(/^(\d+)(m|h|d|w)$/);
+    if (!match)
+        throw new Error("invalid duration; use e.g. 30m, 2h, 7d");
+    const amount = Number(match[1]);
+    if (!Number.isSafeInteger(amount) || amount <= 0)
+        throw new Error("duration must be positive");
+    const units = { m: 60_000, h: 3_600_000, d: 86_400_000, w: 604_800_000 };
+    const expires = now + amount * units[match[2]];
+    if (!Number.isSafeInteger(expires))
+        throw new Error("duration too large");
+    return new Date(expires).toISOString();
+}
+//# sourceMappingURL=duration.js.map

package/dist/duration.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"duration.js","sourceRoot":"","sources":["../src/duration.ts"],"names":[],"mappings":"AAAA,MAAM,UAAU,aAAa,CAAC,KAAa,EAAE,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE;IAC3D,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC;IAC9C,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;IACtE,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAChC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,MAAM,IAAI,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;IAC/F,MAAM,KAAK,GAA2B,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,UAAU,EAAE,CAAC,EAAE,WAAW,EAAE,CAAC;IACjG,MAAM,OAAO,GAAG,GAAG,GAAG,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAC/C,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAC;IAC1E,OAAO,IAAI,IAAI,CAAC,OAAO,CAAC,CAAC,WAAW,EAAE,CAAC;AACzC,CAAC"}

package/dist/gateway.d.ts

@@ -0,0 +1,20 @@
+import { ShareRegistry } from "./registry.js";
+import { SaveManager } from "./save.js";
+import type { FileportConfig } from "./types.js";
+import { DufsWorkerManager } from "./workers.js";
+export declare class Gateway {
+    readonly config: FileportConfig;
+    readonly registry: ShareRegistry;
+    readonly workers: DufsWorkerManager;
+    readonly saves: SaveManager;
+    private publicServer?;
+    private controlServer?;
+    readonly controlSocket: string;
+    private lockFile?;
+    private readonly lockPath;
+    constructor(config: FileportConfig);
+    start(): Promise<void>;
+    private handleControl;
+    private handlePublic;
+    close(): Promise<void>;
+}

package/dist/gateway.js

@@ -0,0 +1,188 @@
+import fs from "node:fs/promises";
+import http from "node:http";
+import path from "node:path";
+import { authorizeSharePath } from "./paths.js";
+import { proxyToUnixSocket } from "./proxy.js";
+import { ShareRegistry } from "./registry.js";
+import { fileVersion, isEditableText, MAX_SAVE_REQUEST_BYTES, SaveError, SaveManager } from "./save.js";
+import { previewHtml } from "./ui.js";
+import { DufsWorkerManager } from "./workers.js";
+function json(res, status, body) { const data = JSON.stringify(body); res.writeHead(status, { "content-type": "application/json; charset=utf-8", "content-length": Buffer.byteLength(data), "cache-control": "no-store", "referrer-policy": "no-referrer", "x-content-type-options": "nosniff" }); res.end(data); }
+async function body(req, limit = 65536) { const chunks = []; let size = 0; for await (const chunk of req) {
+    size += chunk.length;
+    if (size > limit)
+        throw new SaveError(413, "request_too_large");
+    chunks.push(chunk);
+} try {
+    return JSON.parse(Buffer.concat(chunks).toString("utf8") || "{}");
+}
+catch {
+    throw new SaveError(400, "invalid_json");
+} }
+export class Gateway {
+    config;
+    registry;
+    workers;
+    saves = new SaveManager();
+    publicServer;
+    controlServer;
+    controlSocket;
+    lockFile;
+    lockPath;
+    constructor(config) {
+        this.config = config;
+        this.registry = new ShareRegistry(config.stateDir);
+        this.workers = new DufsWorkerManager(config.stateDir, config.dufsBin);
+        this.controlSocket = path.join(config.stateDir, "control.sock");
+        this.lockPath = path.join(config.stateDir, "gateway.lock");
+    }
+    async start() {
+        await fs.mkdir(this.config.stateDir, { recursive: true, mode: 0o700 });
+        await fs.chmod(this.config.stateDir, 0o700);
+        try {
+            this.lockFile = await fs.open(this.lockPath, "wx", 0o600);
+        }
+        catch (error) {
+            if (error.code !== "EEXIST")
+                throw error;
+            let active = false;
+            try {
+                await new Promise((resolve, reject) => { const request = http.request({ socketPath: this.controlSocket, path: "/shares", method: "GET" }, (response) => { response.resume(); response.once("end", () => response.statusCode === 200 ? resolve() : reject(new Error("invalid control response"))); }); request.once("error", reject); request.end(); });
+                active = true;
+            }
+            catch { }
+            if (active)
+                throw new Error("Fileport Gateway is already running");
+            await fs.unlink(this.lockPath);
+            this.lockFile = await fs.open(this.lockPath, "wx", 0o600);
+        }
+        await this.lockFile.writeFile(`${process.pid}\n`);
+        await this.lockFile.sync();
+        await this.registry.load();
+        try {
+            await fs.unlink(this.controlSocket);
+        }
+        catch (error) {
+            if (error.code !== "ENOENT")
+                throw error;
+        }
+        this.publicServer = http.createServer((req, res) => { void this.handlePublic(req, res).catch((error) => { if (!res.headersSent)
+            json(res, 500, { error: "internal_error" });
+        else
+            res.destroy(); console.error(error); }); });
+        this.controlServer = http.createServer((req, res) => { void this.handleControl(req, res).catch((error) => json(res, error instanceof SaveError ? error.status : 400, { error: error instanceof SaveError ? error.code : error instanceof Error ? error.message : String(error) })); });
+        await Promise.all([
+            new Promise((resolve, reject) => { this.publicServer.once("error", reject); this.publicServer.listen(this.config.port, this.config.host, resolve); }),
+            new Promise((resolve, reject) => { this.controlServer.once("error", reject); this.controlServer.listen(this.controlSocket, resolve); }),
+        ]);
+        await fs.chmod(this.controlSocket, 0o600);
+    }
+    async handleControl(req, res) {
+        const url = new URL(req.url || "/", "http://localhost");
+        if (req.method === "POST" && url.pathname === "/shares") {
+            const input = await body(req);
+            const share = await this.registry.create(input.path, { permission: input.permission, expiresAt: input.expiresAt });
+            const base = this.config.publicBaseUrl || `http://127.0.0.1:${this.config.port}`;
+            return json(res, 201, { share, url: `${base}/s/${share.id}/` });
+        }
+        if (req.method === "GET" && url.pathname === "/shares")
+            return json(res, 200, { shares: this.registry.list() });
+        const revoke = url.pathname.match(/^\/shares\/([A-Za-z0-9_-]+)$/);
+        if (req.method === "DELETE" && revoke)
+            return json(res, (await this.registry.revoke(revoke[1])) ? 200 : 404, { ok: true });
+        json(res, 404, { error: "not_found" });
+    }
+    async handlePublic(req, res) {
+        const raw = req.url || "/";
+        const queryAt = raw.indexOf("?");
+        const rawPath = queryAt >= 0 ? raw.slice(0, queryAt) : raw;
+        const query = queryAt >= 0 ? raw.slice(queryAt) : "";
+        if (rawPath === "/healthz")
+            return json(res, 200, { status: "ok", workers: this.workers.count() });
+        const match = rawPath.match(/^\/s\/([A-Za-z0-9_-]+)(?:\/(.*))?$/);
+        if (!match)
+            return json(res, 404, { error: "not_found" });
+        const share = this.registry.get(match[1]);
+        if (!share)
+            return json(res, 404, { error: "share_not_found" });
+        const tail = match[2] || "";
+        const editMatch = tail.match(/^api\/edit\/(.*)$/);
+        if (editMatch && req.method === "GET") {
+            try {
+                return json(res, 200, await this.saves.read(share, editMatch[1]));
+            }
+            catch (error) {
+                return json(res, error instanceof SaveError ? error.status : 403, { error: error instanceof SaveError ? error.code : "scope_denied" });
+            }
+        }
+        const metaMatch = tail.match(/^api\/meta\/(.*)$/);
+        if (metaMatch && req.method === "GET") {
+            try {
+                const upstream = await authorizeSharePath(share, metaMatch[1]);
+                const target = path.resolve(share.root, ...upstream.split("/").filter(Boolean).map(decodeURIComponent));
+                const stat = await fs.stat(target, { bigint: true });
+                if (!stat.isFile())
+                    return json(res, 400, { error: "not_a_file" });
+                return json(res, 200, { version: fileVersion(stat), size: Number(stat.size), editable: share.permission === "rw" && isEditableText(target), permission: share.permission });
+            }
+            catch (error) {
+                return json(res, error instanceof SaveError ? error.status : 403, { error: error instanceof SaveError ? error.code : "scope_denied" });
+            }
+        }
+        const saveMatch = tail.match(/^api\/save\/(.*)$/);
+        if (saveMatch && req.method === "PUT") {
+            try {
+                const input = await body(req, MAX_SAVE_REQUEST_BYTES);
+                return json(res, 200, await this.saves.save(share, saveMatch[1], input.content, input.expectedVersion));
+            }
+            catch (error) {
+                return json(res, error instanceof SaveError ? error.status : 403, { error: error instanceof SaveError ? error.code : error instanceof Error ? error.message : "save_failed" });
+            }
+        }
+        if (tail === "" && (req.method === "GET" || req.method === "HEAD")) {
+            const html = previewHtml(share);
+            res.writeHead(200, { "content-type": "text/html; charset=utf-8", "content-length": Buffer.byteLength(html), "cache-control": "no-store", "referrer-policy": "no-referrer", "x-content-type-options": "nosniff", "content-security-policy": "default-src 'none'; script-src 'unsafe-inline'; style-src 'unsafe-inline'; img-src 'self' blob: data:; connect-src 'self'; frame-src blob:" });
+            res.end(req.method === "HEAD" ? undefined : html);
+            return;
+        }
+        if (!tail.startsWith("fs/") || !["GET", "HEAD"].includes(req.method || ""))
+            return json(res, 405, { error: "read_only" });
+        const relative = tail.slice(3);
+        let upstreamRelative;
+        try {
+            upstreamRelative = await authorizeSharePath(share, relative);
+        }
+        catch (error) {
+            return json(res, error instanceof Error && error.message === "target not found" ? 404 : 403, { error: "scope_denied" });
+        }
+        const authorizedPath = path.resolve(share.root, ...upstreamRelative.split("/").filter(Boolean).map(decodeURIComponent));
+        if (!rawPath.endsWith("/") && (await fs.stat(authorizedPath)).isDirectory()) {
+            res.writeHead(308, { location: `${rawPath}/${query}`, "cache-control": "no-store", "referrer-policy": "no-referrer" });
+            res.end();
+            return;
+        }
+        const worker = await this.workers.get(share.root);
+        await proxyToUnixSocket(req, res, worker.socket, `/${upstreamRelative}${query}`, `/s/${share.id}/fs/`);
+    }
+    async close() {
+        const close = (server) => server ? new Promise((resolve, reject) => server.close((error) => error ? reject(error) : resolve())) : Promise.resolve();
+        await Promise.all([close(this.publicServer), close(this.controlServer)]);
+        await this.workers.close();
+        try {
+            await fs.unlink(this.controlSocket);
+        }
+        catch { }
+        try {
+            await this.lockFile?.close();
+        }
+        catch { }
+        finally {
+            this.lockFile = undefined;
+        }
+        try {
+            await fs.unlink(this.lockPath);
+        }
+        catch { }
+    }
+}
+//# sourceMappingURL=gateway.js.map

package/dist/gateway.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"gateway.js","sourceRoot":"","sources":["../src/gateway.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAClC,OAAO,IAAmD,MAAM,WAAW,CAAC;AAC5E,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAChD,OAAO,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAC/C,OAAO,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAC9C,OAAO,EAAE,WAAW,EAAE,cAAc,EAAE,sBAAsB,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AAExG,OAAO,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AACtC,OAAO,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AAEjD,SAAS,IAAI,CAAC,GAAmB,EAAE,MAAc,EAAE,IAAa,IAAU,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,MAAM,EAAE,EAAE,cAAc,EAAE,iCAAiC,EAAE,gBAAgB,EAAE,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,eAAe,EAAE,UAAU,EAAE,iBAAiB,EAAE,aAAa,EAAE,wBAAwB,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAC1V,KAAK,UAAU,IAAI,CAAC,GAAoB,EAAE,KAAK,GAAG,KAAK,IAAkB,MAAM,MAAM,GAAa,EAAE,CAAC,CAAC,IAAI,IAAI,GAAG,CAAC,CAAC,CAAC,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,GAAG,EAAE,CAAC;IAAC,IAAI,IAAI,KAAK,CAAC,MAAM,CAAC;IAAC,IAAI,IAAI,GAAG,KAAK;QAAE,MAAM,IAAI,SAAS,CAAC,GAAG,EAAE,mBAAmB,CAAC,CAAC;IAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AAAC,CAAC,CAAC,IAAI,CAAC;IAAC,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,CAAC;AAAC,CAAC;AAAC,MAAM,CAAC;IAAC,MAAM,IAAI,SAAS,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;AAAC,CAAC,CAAC,CAAC;AAElY,MAAM,OAAO,OAAO;IASG;IARZ,QAAQ,CAAgB;IACxB,OAAO,CAAoB;IAC3B,KAAK,GAAG,IAAI,WAAW,EAAE,CAAC;IAC3B,YAAY,CAAe;IAC3B,aAAa,CAAe;IAC3B,aAAa,CAAS;IACvB,QAAQ,CAAiB;IAChB,QAAQ,CAAS;IAClC,YAAqB,MAAsB;QAAtB,WAAM,GAAN,MAAM,CAAgB;QAAI,IAAI,CAAC,QAAQ,GAAG,IAAI,aAAa,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAAC,IAAI,CAAC,OAAO,GAAG,IAAI,iBAAiB,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;QAAC,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,cAAc,CAAC,CAAC;QAAC,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,cAAc,CAAC,CAAC;IAAC,CAAC;IAExS,KAAK,CAAC,KAAK;QACT,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAAC,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;QACpH,IAAI,CAAC;YAAC,IAAI,CAAC,QAAQ,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;QAAC,CAAC;QAAC,OAAO,KAAc,EAAE,CAAC;YACzF,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;gBAAE,MAAM,KAAK,CAAC;YACpE,IAAI,MAAM,GAAG,KAAK,CAAC;YACnB,IAAI,CAAC;gBAAC,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,GAAG,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,aAAa,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE,CAAC,QAAQ,EAAE,EAAE,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,UAAU,KAAK,GAAG,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;gBAAC,MAAM,GAAG,IAAI,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC,CAAA,CAAC;YAC7X,IAAI,MAAM;gBAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;YACnE,MAAM,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YAC/B,IAAI,CAAC,QAAQ,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;QAC5D,CAAC;QACD,MAAM,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,GAAG,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC;QAAC,MAAM,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;QAAC,MAAM,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;QAC1G,IAAI,CAAC;YAAC,MAAM,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;QAAC,CAAC;QAAC,OAAO,KAAc,EAAE,CAAC;YAAC,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;gBAAE,MAAM,KAAK,CAAC;QAAC,CAAC;QAC5I,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC,YAAY,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,GAAG,KAAK,IAAI,CAAC,YAAY,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,WAAW;YAAE,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC,CAAC;;YAAM,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC9N,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC,YAAY,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,GAAG,KAAK,IAAI,CAAC,aAAa,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,YAAY,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,KAAK,YAAY,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACvR,MAAM,OAAO,CAAC,GAAG,CAAC;YAChB,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,GAAG,IAAI,CAAC,YAAa,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,YAAa,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;YAC7J,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,GAAG,IAAI,CAAC,aAAc,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,aAAc,CAAC,MAAM,CAAC,IAAI,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;SAChJ,CAAC,CAAC;QACH,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,aAAa,EAAE,KAAK,CAAC,CAAC;IAC5C,CAAC;IAEO,KAAK,CAAC,aAAa,CAAC,GAAoB,EAAE,GAAmB;QACnE,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,EAAE,kBAAkB,CAAC,CAAC;QACxD,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,IAAI,GAAG,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;YAAC,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,CAAC;YAAC,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC;YAAC,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,aAAa,IAAI,oBAAoB,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;YAAC,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,IAAI,MAAM,KAAK,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC;QAAC,CAAC;QAClW,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,IAAI,GAAG,CAAC,QAAQ,KAAK,SAAS;YAAE,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QAChH,MAAM,MAAM,GAAG,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,8BAA8B,CAAC,CAAC;QAAC,IAAI,GAAG,CAAC,MAAM,KAAK,QAAQ,IAAI,MAAM;YAAE,OAAO,IAAI,CAAC,GAAG,EAAE,CAAC,MAAM,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QAC9L,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC;IACzC,CAAC;IAEO,KAAK,CAAC,YAAY,CAAC,GAAoB,EAAE,GAAmB;QAClE,MAAM,GAAG,GAAG,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC;QAC3B,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAAC,MAAM,OAAO,GAAG,OAAO,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;QAAC,MAAM,KAAK,GAAG,OAAO,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACnJ,IAAI,OAAO,KAAK,UAAU;YAAE,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QACnG,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,oCAAoC,CAAC,CAAC;QAAC,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC;QAC7H,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QAAC,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAAC,CAAC;QAC3G,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC5B,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,mBAAmB,CAAC,CAAC;QAClD,IAAI,SAAS,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;YACtC,IAAI,CAAC;gBAAC,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YAAC,CAAC;YAC1E,OAAO,KAAK,EAAE,CAAC;gBAAC,OAAO,IAAI,CAAC,GAAG,EAAE,KAAK,YAAY,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,KAAK,YAAY,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,cAAc,EAAE,CAAC,CAAC;YAAC,CAAC;QAC3J,CAAC;QACD,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,mBAAmB,CAAC,CAAC;QAClD,IAAI,SAAS,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;YACtC,IAAI,CAAC;gBACH,MAAM,QAAQ,GAAG,MAAM,kBAAkB,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC;gBAC/D,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,EAAE,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC,CAAC;gBACxG,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;gBACrD,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE;oBAAE,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC,CAAC;gBACnE,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,OAAO,EAAE,WAAW,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,UAAU,KAAK,IAAI,IAAI,cAAc,CAAC,MAAM,CAAC,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,CAAC,CAAC;YAC9K,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBAAC,OAAO,IAAI,CAAC,GAAG,EAAE,KAAK,YAAY,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,KAAK,YAAY,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,cAAc,EAAE,CAAC,CAAC;YAAC,CAAC;QAC7J,CAAC;QACD,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,mBAAmB,CAAC,CAAC;QAClD,IAAI,SAAS,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;YACtC,IAAI,CAAC;gBAAC,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,GAAG,EAAE,sBAAsB,CAAC,CAAC;gBAAC,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,eAAe,CAAC,CAAC,CAAC;YAAC,CAAC;YACvK,OAAO,KAAK,EAAE,CAAC;gBAAC,OAAO,IAAI,CAAC,GAAG,EAAE,KAAK,YAAY,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,KAAK,YAAY,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,aAAa,EAAE,CAAC,CAAC;YAAC,CAAC;QACnM,CAAC;QACD,IAAI,IAAI,KAAK,EAAE,IAAI,CAAC,GAAG,CAAC,MAAM,KAAK,KAAK,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,CAAC,EAAE,CAAC;YAAC,MAAM,IAAI,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC;YAAC,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,0BAA0B,EAAE,gBAAgB,EAAE,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,eAAe,EAAE,UAAU,EAAE,iBAAiB,EAAE,aAAa,EAAE,wBAAwB,EAAE,SAAS,EAAE,yBAAyB,EAAE,4IAA4I,EAAE,CAAC,CAAC;YAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;YAAC,OAAO;QAAC,CAAC;QAC/hB,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,IAAI,EAAE,CAAC;YAAE,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC;QAC1H,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAC/B,IAAI,gBAAwB,CAAC;QAC7B,IAAI,CAAC;YAAC,gBAAgB,GAAG,MAAM,kBAAkB,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;QAAC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAAC,OAAO,IAAI,CAAC,GAAG,EAAE,KAAK,YAAY,KAAK,IAAI,KAAK,CAAC,OAAO,KAAK,kBAAkB,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC;QAAC,CAAC;QAChN,MAAM,cAAc,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,EAAE,GAAG,gBAAgB,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC,CAAC;QACxH,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC;YAC5E,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,QAAQ,EAAE,GAAG,OAAO,IAAI,KAAK,EAAE,EAAE,eAAe,EAAE,UAAU,EAAE,iBAAiB,EAAE,aAAa,EAAE,CAAC,CAAC;YAAC,GAAG,CAAC,GAAG,EAAE,CAAC;YAAC,OAAO;QAC5I,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAClD,MAAM,iBAAiB,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,IAAI,gBAAgB,GAAG,KAAK,EAAE,EAAE,MAAM,KAAK,CAAC,EAAE,MAAM,CAAC,CAAC;IACzG,CAAC;IAED,KAAK,CAAC,KAAK;QACT,MAAM,KAAK,GAAG,CAAC,MAAoB,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;QACxK,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,KAAK,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC;QAAC,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;QACrG,IAAI,CAAC;YAAC,MAAM,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC,CAAA,CAAC;QACrD,IAAI,CAAC;YAAC,MAAM,IAAI,CAAC,QAAQ,EAAE,KAAK,EAAE,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC,CAAA,CAAC;gBAAS,CAAC;YAAC,IAAI,CAAC,QAAQ,GAAG,SAAS,CAAC;QAAC,CAAC;QACrF,IAAI,CAAC;YAAC,MAAM,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC,CAAA,CAAC;IAClD,CAAC;CACF"}

package/dist/paths.d.ts

@@ -0,0 +1,8 @@
+import type { Share, ShareKind } from "./types.js";
+export declare function canonicalTarget(input: string): Promise<{
+    target: string;
+    root: string;
+    kind: ShareKind;
+}>;
+export declare function decodeRelativePath(raw: string): string;
+export declare function authorizeSharePath(share: Share, rawRelative: string): Promise<string>;

package/dist/paths.js

@@ -0,0 +1,88 @@
+import fs from "node:fs/promises";
+import path from "node:path";
+import os from "node:os";
+const sensitiveSegments = new Set([".ssh", ".gnupg", ".aws", ".kube", ".config/gcloud"]);
+const sensitiveNames = new Set([".env", ".netrc", "credentials", "id_rsa", "id_ed25519"]);
+function isSensitiveRelative(relative) {
+    const normalized = relative.split(path.sep).join("/").toLowerCase();
+    const parts = normalized.split("/").filter(Boolean);
+    if (parts.some((part) => [".ssh", ".gnupg", ".aws", ".kube"].includes(part)))
+        return true;
+    const name = parts.at(-1) || "";
+    return sensitiveNames.has(name) || /^\.env(?:\.|$)/.test(name) || /^id_(?:rsa|dsa|ecdsa|ed25519)(?:\.pub)?$/.test(name) || /\.(?:pem|p12|pfx)$/.test(name);
+}
+async function assertSafeTarget(target) {
+    const home = await fs.realpath(os.homedir());
+    if (target === home || target === path.parse(target).root)
+        throw new Error("refusing to share Home or filesystem root");
+    const relativeHome = path.relative(home, target).split(path.sep).join("/");
+    for (const segment of sensitiveSegments)
+        if (relativeHome === segment || relativeHome.startsWith(`${segment}/`))
+            throw new Error("sensitive path denied");
+    if (isSensitiveRelative(target))
+        throw new Error("sensitive path denied");
+}
+export async function canonicalTarget(input) {
+    const absolute = path.resolve(input);
+    const target = await fs.realpath(absolute);
+    await assertSafeTarget(target);
+    const stat = await fs.stat(target);
+    if (!stat.isFile() && !stat.isDirectory())
+        throw new Error("share target must be a regular file or directory");
+    return { target, root: stat.isFile() ? path.dirname(target) : target, kind: stat.isFile() ? "file" : "directory" };
+}
+function decodeSegment(segment) {
+    if (/%2f|%5c/i.test(segment))
+        throw new Error("encoded path separator denied");
+    let decoded;
+    try {
+        decoded = decodeURIComponent(segment);
+    }
+    catch {
+        throw new Error("malformed path encoding");
+    }
+    if (decoded === "." || decoded === ".." || decoded.includes("/") || decoded.includes("\\") || /%[0-9a-f]{2}/i.test(decoded)) {
+        throw new Error("path traversal denied");
+    }
+    return decoded;
+}
+export function decodeRelativePath(raw) {
+    if (!raw)
+        return "";
+    return raw.split("/").filter(Boolean).map(decodeSegment).join(path.sep);
+}
+function inside(parent, child) {
+    const rel = path.relative(parent, child);
+    return rel === "" || (!rel.startsWith(`..${path.sep}`) && rel !== ".." && !path.isAbsolute(rel));
+}
+export async function authorizeSharePath(share, rawRelative) {
+    const relative = decodeRelativePath(rawRelative);
+    if (share.kind === "file") {
+        const expected = path.basename(share.target);
+        if (relative !== expected)
+            throw new Error("outside file share scope");
+    }
+    if (isSensitiveRelative(relative))
+        throw new Error("sensitive path denied");
+    const candidate = path.resolve(share.root, relative || ".");
+    if (!inside(share.root, candidate))
+        throw new Error("outside share root");
+    let real;
+    try {
+        real = await fs.realpath(candidate);
+    }
+    catch {
+        throw new Error("target not found");
+    }
+    try {
+        await fs.access(real, fs.constants.R_OK);
+    }
+    catch {
+        throw new Error("target not readable");
+    }
+    const scope = share.target;
+    if (share.kind === "file" ? real !== scope : !inside(scope, real))
+        throw new Error("symlink escape denied");
+    return relative.split(path.sep).map(encodeURIComponent).join("/");
+}
+//# sourceMappingURL=paths.js.map

package/dist/paths.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"paths.js","sourceRoot":"","sources":["../src/paths.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAClC,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,MAAM,SAAS,CAAC;AAGzB,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,gBAAgB,CAAC,CAAC,CAAC;AACzF,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,QAAQ,EAAE,aAAa,EAAE,QAAQ,EAAE,YAAY,CAAC,CAAC,CAAC;AAE1F,SAAS,mBAAmB,CAAC,QAAgB;IAC3C,MAAM,UAAU,GAAG,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC;IACpE,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACpD,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAC1F,MAAM,IAAI,GAAG,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAChC,OAAO,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,0CAA0C,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,oBAAoB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC7J,CAAC;AAED,KAAK,UAAU,gBAAgB,CAAC,MAAc;IAC5C,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC;IAC7C,IAAI,MAAM,KAAK,IAAI,IAAI,MAAM,KAAK,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI;QAAE,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;IACxH,MAAM,YAAY,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC3E,KAAK,MAAM,OAAO,IAAI,iBAAiB;QAAE,IAAI,YAAY,KAAK,OAAO,IAAI,YAAY,CAAC,UAAU,CAAC,GAAG,OAAO,GAAG,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;IAC1J,IAAI,mBAAmB,CAAC,MAAM,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;AAC5E,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,KAAa;IACjD,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IACrC,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAC3C,MAAM,gBAAgB,CAAC,MAAM,CAAC,CAAC;IAC/B,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACnC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;IAC/G,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;AACrH,CAAC;AAED,SAAS,aAAa,CAAC,OAAe;IACpC,IAAI,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;IAC/E,IAAI,OAAe,CAAC;IACpB,IAAI,CAAC;QAAC,OAAO,GAAG,kBAAkB,CAAC,OAAO,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC;IAAC,CAAC;IACpG,IAAI,OAAO,KAAK,GAAG,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QAC5H,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;IAC3C,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,GAAW;IAC5C,IAAI,CAAC,GAAG;QAAE,OAAO,EAAE,CAAC;IACpB,OAAO,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC1E,CAAC;AAED,SAAS,MAAM,CAAC,MAAc,EAAE,KAAa;IAC3C,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IACzC,OAAO,GAAG,KAAK,EAAE,IAAI,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,KAAK,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,GAAG,KAAK,IAAI,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC;AACnG,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,KAAY,EAAE,WAAmB;IACxE,MAAM,QAAQ,GAAG,kBAAkB,CAAC,WAAW,CAAC,CAAC;IACjD,IAAI,KAAK,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;QAC1B,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAC7C,IAAI,QAAQ,KAAK,QAAQ;YAAE,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC;IACzE,CAAC;IACD,IAAI,mBAAmB,CAAC,QAAQ,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;IAC5E,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,EAAE,QAAQ,IAAI,GAAG,CAAC,CAAC;IAC5D,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,SAAS,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAC;IAC1E,IAAI,IAAY,CAAC;IACjB,IAAI,CAAC;QAAC,IAAI,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,MAAM,IAAI,KAAK,CAAC,kBAAkB,CAAC,CAAC;IAAC,CAAC;IAC3F,IAAI,CAAC;QAAC,MAAM,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC;IAAC,CAAC;IACnG,MAAM,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC;IAC3B,IAAI,KAAK,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,IAAI,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;IAC5G,OAAO,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACpE,CAAC"}

package/dist/proxy.d.ts

@@ -0,0 +1,2 @@
+import { type IncomingMessage, type ServerResponse } from "node:http";
+export declare function proxyToUnixSocket(req: IncomingMessage, res: ServerResponse, socketPath: string, upstreamPath: string, publicPrefix: string): Promise<void>;