parasor 0.1.0

package/server/application/workspace/worktree-local-files.d.ts

@@ -0,0 +1,11 @@
+import { copyFile } from "node:fs/promises";
+import { type WorktreeLocalFileCandidate, type WorktreeLocalFileCopyResult } from "@parasor/shared";
+export interface ListWorktreeLocalFileCandidatesDeps {
+    isIgnored?: (projectPath: string, relativePath: string) => Promise<boolean>;
+}
+export interface CopyWorktreeLocalFilesDeps extends ListWorktreeLocalFileCandidatesDeps {
+    copyFile?: typeof copyFile;
+}
+export declare function listWorktreeLocalFileCandidates(projectPath: string, deps?: ListWorktreeLocalFileCandidatesDeps): Promise<WorktreeLocalFileCandidate[]>;
+export declare function copyWorktreeLocalFiles(projectPath: string, worktreePath: string, selectedPaths: unknown, deps?: CopyWorktreeLocalFilesDeps): Promise<WorktreeLocalFileCopyResult[]>;
+//# sourceMappingURL=worktree-local-files.d.ts.map

package/server/application/workspace/worktree-local-files.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"worktree-local-files.d.ts","sourceRoot":"","sources":["../../../src/application/workspace/worktree-local-files.ts"],"names":[],"mappings":"AACA,OAAO,EAAa,QAAQ,EAAyB,MAAM,kBAAkB,CAAC;AAG9E,OAAO,EAEL,KAAK,0BAA0B,EAC/B,KAAK,2BAA2B,EACjC,MAAM,iBAAiB,CAAC;AAoCzB,MAAM,WAAW,mCAAmC;IAClD,SAAS,CAAC,EAAE,CAAC,WAAW,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;CAC7E;AAED,MAAM,WAAW,0BACf,SAAQ,mCAAmC;IAC3C,QAAQ,CAAC,EAAE,OAAO,QAAQ,CAAC;CAC5B;AAED,wBAAsB,+BAA+B,CACnD,WAAW,EAAE,MAAM,EACnB,IAAI,GAAE,mCAAwC,GAC7C,OAAO,CAAC,0BAA0B,EAAE,CAAC,CA6CvC;AAED,wBAAsB,sBAAsB,CAC1C,WAAW,EAAE,MAAM,EACnB,YAAY,EAAE,MAAM,EACpB,aAAa,EAAE,OAAO,EACtB,IAAI,GAAE,0BAA+B,GACpC,OAAO,CAAC,2BAA2B,EAAE,CAAC,CA2ExC"}

package/server/application/workspace/worktree-local-files.js

@@ -0,0 +1,223 @@
+import { execFile } from "node:child_process";
+import { constants, copyFile, lstat, mkdir, readdir } from "node:fs/promises";
+import path from "node:path";
+import { promisify } from "node:util";
+import { normalizeWorktreeLocalFilePath, } from "@parasor/shared";
+const execFileAsync = promisify(execFile);
+const MAX_CANDIDATES = 200;
+const MAX_SCAN_ENTRIES = 5000;
+const MAX_FILE_SIZE_BYTES = 256 * 1024;
+const MAX_TOTAL_COPY_BYTES = 2 * 1024 * 1024;
+const EXCLUDED_DIRS = new Set([
+    ".git",
+    ".next",
+    ".nuxt",
+    ".parcel-cache",
+    ".svelte-kit",
+    ".turbo",
+    ".vite",
+    "build",
+    "coverage",
+    "dist",
+    "node_modules",
+    "target",
+    "tmp",
+]);
+const CANDIDATE_BASENAMES = new Set([
+    ".env",
+    ".envrc",
+    ".npmrc",
+    ".nvmrc",
+    ".pnpmrc",
+    ".python-version",
+    ".ruby-version",
+    ".tool-versions",
+    ".yarnrc",
+    ".yarnrc.yml",
+]);
+export async function listWorktreeLocalFileCandidates(projectPath, deps = {}) {
+    const candidates = [];
+    const isIgnored = deps.isIgnored ?? isGitIgnored;
+    let scanned = 0;
+    async function visit(dir, relDir) {
+        if (candidates.length >= MAX_CANDIDATES || scanned >= MAX_SCAN_ENTRIES) {
+            return;
+        }
+        let entries;
+        try {
+            entries = await readdir(dir, { withFileTypes: true });
+        }
+        catch {
+            return;
+        }
+        for (const entry of entries) {
+            if (candidates.length >= MAX_CANDIDATES || scanned >= MAX_SCAN_ENTRIES) {
+                return;
+            }
+            scanned += 1;
+            const rel = relDir ? `${relDir}/${entry.name}` : entry.name;
+            if (entry.isDirectory()) {
+                if (!EXCLUDED_DIRS.has(entry.name)) {
+                    await visit(path.join(dir, entry.name), rel);
+                }
+                continue;
+            }
+            if (!entry.isFile())
+                continue;
+            if (!isLikelyLocalConfigFile(rel))
+                continue;
+            const file = await describeLocalFile(projectPath, rel, isIgnored);
+            if (file)
+                candidates.push(file);
+        }
+    }
+    await visit(projectPath, "");
+    candidates.sort((a, b) => a.path.localeCompare(b.path));
+    return candidates;
+}
+export async function copyWorktreeLocalFiles(projectPath, worktreePath, selectedPaths, deps = {}) {
+    const paths = normalizeSelectedPaths(selectedPaths);
+    const isIgnored = deps.isIgnored ?? isGitIgnored;
+    const copyFileImpl = deps.copyFile ?? copyFile;
+    const results = [];
+    let totalBytes = 0;
+    for (const { input, normalized: relativePath } of paths) {
+        if (!relativePath) {
+            results.push({
+                path: input,
+                status: "skipped",
+                reason: "invalid path",
+            });
+            continue;
+        }
+        const source = await describeLocalFile(projectPath, relativePath, isIgnored);
+        if (!source) {
+            results.push({
+                path: relativePath,
+                status: "skipped",
+                reason: "not an ignored regular file",
+            });
+            continue;
+        }
+        if (totalBytes + source.size > MAX_TOTAL_COPY_BYTES) {
+            results.push({
+                path: relativePath,
+                status: "skipped",
+                reason: "copy size limit exceeded",
+                size: source.size,
+            });
+            continue;
+        }
+        const from = resolveUnder(projectPath, relativePath);
+        const to = resolveUnder(worktreePath, relativePath);
+        if (!from || !to) {
+            results.push({
+                path: relativePath,
+                status: "skipped",
+                reason: "invalid path",
+                size: source.size,
+            });
+            continue;
+        }
+        try {
+            await mkdir(path.dirname(to), { recursive: true });
+            await copyFileImpl(from, to, constants.COPYFILE_EXCL);
+            totalBytes += source.size;
+            results.push({ ...source, status: "copied" });
+        }
+        catch (error) {
+            if (isNodeError(error) && error.code === "EEXIST") {
+                results.push({
+                    ...source,
+                    status: "skipped",
+                    reason: "destination exists",
+                });
+                continue;
+            }
+            results.push({
+                ...source,
+                status: "failed",
+                reason: error instanceof Error ? error.message : "copy failed",
+            });
+        }
+    }
+    return results;
+}
+async function describeLocalFile(projectPath, relativePath, isIgnored) {
+    const normalized = normalizeWorktreeLocalFilePath(relativePath);
+    if (!normalized)
+        return null;
+    const absolutePath = resolveUnder(projectPath, normalized);
+    if (!absolutePath)
+        return null;
+    let info;
+    try {
+        info = await lstat(absolutePath);
+    }
+    catch {
+        return null;
+    }
+    if (!info.isFile() || info.isSymbolicLink())
+        return null;
+    if (info.size > MAX_FILE_SIZE_BYTES)
+        return null;
+    if (!(await isIgnored(projectPath, normalized)))
+        return null;
+    return { path: normalized, size: info.size };
+}
+function normalizeSelectedPaths(value) {
+    if (!Array.isArray(value))
+        return [];
+    const out = [];
+    const seen = new Set();
+    for (const item of value) {
+        if (typeof item !== "string")
+            continue;
+        const normalized = normalizeWorktreeLocalFilePath(item);
+        const input = item.slice(0, 500);
+        if (!normalized) {
+            out.push({ input, normalized: null });
+            continue;
+        }
+        if (seen.has(normalized))
+            continue;
+        seen.add(normalized);
+        out.push({ input, normalized });
+    }
+    return out;
+}
+function isLikelyLocalConfigFile(relativePath) {
+    const base = path.posix.basename(relativePath);
+    if (CANDIDATE_BASENAMES.has(base))
+        return true;
+    if (base.startsWith(".env."))
+        return true;
+    if (base.endsWith(".local"))
+        return true;
+    return false;
+}
+async function isGitIgnored(projectPath, relativePath) {
+    try {
+        await execFileAsync("git", ["-C", projectPath, "check-ignore", "--quiet", "--", relativePath], { timeout: 3000, maxBuffer: 1024 * 1024 });
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+function resolveUnder(root, relativePath) {
+    const normalized = normalizeWorktreeLocalFilePath(relativePath);
+    if (!normalized)
+        return null;
+    const rootPath = path.resolve(root);
+    const candidate = path.resolve(rootPath, ...normalized.split("/"));
+    const rel = path.relative(rootPath, candidate);
+    if (rel === "" || rel.startsWith("..") || path.isAbsolute(rel)) {
+        return null;
+    }
+    return candidate;
+}
+function isNodeError(error) {
+    return error instanceof Error && "code" in error;
+}
+//# sourceMappingURL=worktree-local-files.js.map

package/server/application/workspace/worktree-local-files.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"worktree-local-files.js","sourceRoot":"","sources":["../../../src/application/workspace/worktree-local-files.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAC9E,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACtC,OAAO,EACL,8BAA8B,GAG/B,MAAM,iBAAiB,CAAC;AAEzB,MAAM,aAAa,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;AAE1C,MAAM,cAAc,GAAG,GAAG,CAAC;AAC3B,MAAM,gBAAgB,GAAG,IAAI,CAAC;AAC9B,MAAM,mBAAmB,GAAG,GAAG,GAAG,IAAI,CAAC;AACvC,MAAM,oBAAoB,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC;AAC7C,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC;IAC5B,MAAM;IACN,OAAO;IACP,OAAO;IACP,eAAe;IACf,aAAa;IACb,QAAQ;IACR,OAAO;IACP,OAAO;IACP,UAAU;IACV,MAAM;IACN,cAAc;IACd,QAAQ;IACR,KAAK;CACN,CAAC,CAAC;AACH,MAAM,mBAAmB,GAAG,IAAI,GAAG,CAAC;IAClC,MAAM;IACN,QAAQ;IACR,QAAQ;IACR,QAAQ;IACR,SAAS;IACT,iBAAiB;IACjB,eAAe;IACf,gBAAgB;IAChB,SAAS;IACT,aAAa;CACd,CAAC,CAAC;AAWH,MAAM,CAAC,KAAK,UAAU,+BAA+B,CACnD,WAAmB,EACnB,OAA4C,EAAE;IAE9C,MAAM,UAAU,GAAiC,EAAE,CAAC;IACpD,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,YAAY,CAAC;IACjD,IAAI,OAAO,GAAG,CAAC,CAAC;IAEhB,KAAK,UAAU,KAAK,CAAC,GAAW,EAAE,MAAc;QAC9C,IAAI,UAAU,CAAC,MAAM,IAAI,cAAc,IAAI,OAAO,IAAI,gBAAgB,EAAE,CAAC;YACvE,OAAO;QACT,CAAC;QAED,IAAI,OAIF,CAAC;QACH,IAAI,CAAC;YACH,OAAO,GAAG,MAAM,OAAO,CAAC,GAAG,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;QACxD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO;QACT,CAAC;QAED,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;YAC5B,IAAI,UAAU,CAAC,MAAM,IAAI,cAAc,IAAI,OAAO,IAAI,gBAAgB,EAAE,CAAC;gBACvE,OAAO;YACT,CAAC;YACD,OAAO,IAAI,CAAC,CAAC;YAEb,MAAM,GAAG,GAAG,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC;YAC5D,IAAI,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;gBACxB,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;oBACnC,MAAM,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC,EAAE,GAAG,CAAC,CAAC;gBAC/C,CAAC;gBACD,SAAS;YACX,CAAC;YACD,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE;gBAAE,SAAS;YAC9B,IAAI,CAAC,uBAAuB,CAAC,GAAG,CAAC;gBAAE,SAAS;YAE5C,MAAM,IAAI,GAAG,MAAM,iBAAiB,CAAC,WAAW,EAAE,GAAG,EAAE,SAAS,CAAC,CAAC;YAClE,IAAI,IAAI;gBAAE,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAClC,CAAC;IACH,CAAC;IAED,MAAM,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;IAC7B,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IACxD,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,WAAmB,EACnB,YAAoB,EACpB,aAAsB,EACtB,OAAmC,EAAE;IAErC,MAAM,KAAK,GAAG,sBAAsB,CAAC,aAAa,CAAC,CAAC;IACpD,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,YAAY,CAAC;IACjD,MAAM,YAAY,GAAG,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC;IAC/C,MAAM,OAAO,GAAkC,EAAE,CAAC;IAClD,IAAI,UAAU,GAAG,CAAC,CAAC;IAEnB,KAAK,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,YAAY,EAAE,IAAI,KAAK,EAAE,CAAC;QACxD,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,OAAO,CAAC,IAAI,CAAC;gBACX,IAAI,EAAE,KAAK;gBACX,MAAM,EAAE,SAAS;gBACjB,MAAM,EAAE,cAAc;aACvB,CAAC,CAAC;YACH,SAAS;QACX,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,iBAAiB,CACpC,WAAW,EACX,YAAY,EACZ,SAAS,CACV,CAAC;QACF,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,CAAC,IAAI,CAAC;gBACX,IAAI,EAAE,YAAY;gBAClB,MAAM,EAAE,SAAS;gBACjB,MAAM,EAAE,6BAA6B;aACtC,CAAC,CAAC;YACH,SAAS;QACX,CAAC;QAED,IAAI,UAAU,GAAG,MAAM,CAAC,IAAI,GAAG,oBAAoB,EAAE,CAAC;YACpD,OAAO,CAAC,IAAI,CAAC;gBACX,IAAI,EAAE,YAAY;gBAClB,MAAM,EAAE,SAAS;gBACjB,MAAM,EAAE,0BAA0B;gBAClC,IAAI,EAAE,MAAM,CAAC,IAAI;aAClB,CAAC,CAAC;YACH,SAAS;QACX,CAAC;QAED,MAAM,IAAI,GAAG,YAAY,CAAC,WAAW,EAAE,YAAY,CAAC,CAAC;QACrD,MAAM,EAAE,GAAG,YAAY,CAAC,YAAY,EAAE,YAAY,CAAC,CAAC;QACpD,IAAI,CAAC,IAAI,IAAI,CAAC,EAAE,EAAE,CAAC;YACjB,OAAO,CAAC,IAAI,CAAC;gBACX,IAAI,EAAE,YAAY;gBAClB,MAAM,EAAE,SAAS;gBACjB,MAAM,EAAE,cAAc;gBACtB,IAAI,EAAE,MAAM,CAAC,IAAI;aAClB,CAAC,CAAC;YACH,SAAS;QACX,CAAC;QAED,IAAI,CAAC;YACH,MAAM,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YACnD,MAAM,YAAY,CAAC,IAAI,EAAE,EAAE,EAAE,SAAS,CAAC,aAAa,CAAC,CAAC;YACtD,UAAU,IAAI,MAAM,CAAC,IAAI,CAAC;YAC1B,OAAO,CAAC,IAAI,CAAC,EAAE,GAAG,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC;QAChD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,WAAW,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBAClD,OAAO,CAAC,IAAI,CAAC;oBACX,GAAG,MAAM;oBACT,MAAM,EAAE,SAAS;oBACjB,MAAM,EAAE,oBAAoB;iBAC7B,CAAC,CAAC;gBACH,SAAS;YACX,CAAC;YACD,OAAO,CAAC,IAAI,CAAC;gBACX,GAAG,MAAM;gBACT,MAAM,EAAE,QAAQ;gBAChB,MAAM,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,aAAa;aAC/D,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,KAAK,UAAU,iBAAiB,CAC9B,WAAmB,EACnB,YAAoB,EACpB,SAA0E;IAE1E,MAAM,UAAU,GAAG,8BAA8B,CAAC,YAAY,CAAC,CAAC;IAChE,IAAI,CAAC,UAAU;QAAE,OAAO,IAAI,CAAC;IAC7B,MAAM,YAAY,GAAG,YAAY,CAAC,WAAW,EAAE,UAAU,CAAC,CAAC;IAC3D,IAAI,CAAC,YAAY;QAAE,OAAO,IAAI,CAAC;IAE/B,IAAI,IAAuC,CAAC;IAC5C,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,KAAK,CAAC,YAAY,CAAC,CAAC;IACnC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,IAAI,CAAC,cAAc,EAAE;QAAE,OAAO,IAAI,CAAC;IACzD,IAAI,IAAI,CAAC,IAAI,GAAG,mBAAmB;QAAE,OAAO,IAAI,CAAC;IACjD,IAAI,CAAC,CAAC,MAAM,SAAS,CAAC,WAAW,EAAE,UAAU,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAE7D,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC;AAC/C,CAAC;AAED,SAAS,sBAAsB,CAC7B,KAAc;IAEd,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IACrC,MAAM,GAAG,GAAwD,EAAE,CAAC;IACpE,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,OAAO,IAAI,KAAK,QAAQ;YAAE,SAAS;QACvC,MAAM,UAAU,GAAG,8BAA8B,CAAC,IAAI,CAAC,CAAC;QACxD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;QACjC,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,GAAG,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC;YACtC,SAAS;QACX,CAAC;QACD,IAAI,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC;YAAE,SAAS;QACnC,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QACrB,GAAG,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,CAAC;IAClC,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,uBAAuB,CAAC,YAAoB;IACnD,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;IAC/C,IAAI,mBAAmB,CAAC,GAAG,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAC/C,IAAI,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC;IAC1C,IAAI,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC;IACzC,OAAO,KAAK,CAAC;AACf,CAAC;AAED,KAAK,UAAU,YAAY,CACzB,WAAmB,EACnB,YAAoB;IAEpB,IAAI,CAAC;QACH,MAAM,aAAa,CACjB,KAAK,EACL,CAAC,IAAI,EAAE,WAAW,EAAE,cAAc,EAAE,SAAS,EAAE,IAAI,EAAE,YAAY,CAAC,EAClE,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,GAAG,IAAI,EAAE,CAC1C,CAAC;QACF,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,SAAS,YAAY,CAAC,IAAY,EAAE,YAAoB;IACtD,MAAM,UAAU,GAAG,8BAA8B,CAAC,YAAY,CAAC,CAAC;IAChE,IAAI,CAAC,UAAU;QAAE,OAAO,IAAI,CAAC;IAC7B,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IACpC,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,GAAG,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;IACnE,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;IAC/C,IAAI,GAAG,KAAK,EAAE,IAAI,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QAC/D,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,WAAW,CAAC,KAAc;IACjC,OAAO,KAAK,YAAY,KAAK,IAAI,MAAM,IAAI,KAAK,CAAC;AACnD,CAAC"}

package/server/application/workspace/worktree-reconcile.d.ts

@@ -0,0 +1,21 @@
+import type { Worktree } from "@parasor/shared";
+import type { ProjectManager } from "../../state/project-manager.js";
+import type { WorktreeCache } from "../../state/worktree-cache.js";
+import type { EventPublisher } from "../ports.js";
+export interface CreateWorktreeReconcilerDeps {
+    projectManager: ProjectManager;
+    worktreeCache: WorktreeCache;
+    eventBus: EventPublisher;
+    liveList: (projectId: string) => Promise<Worktree[] | null>;
+}
+export interface WorktreeReconciler {
+    /**
+     * Broadcasts cache-vs-live deltas; cache mutation happens in the broadcast
+     * wrapper. Pass `prefetched` when the caller has already enumerated worktrees
+     * in the same request -- this avoids a second `git worktree list` + N-way
+     * `git status` fan-out per call.
+     */
+    reconcile(projectId: string, prefetched?: Worktree[]): Promise<void>;
+}
+export declare function createWorktreeReconciler({ projectManager, worktreeCache, eventBus, liveList, }: CreateWorktreeReconcilerDeps): WorktreeReconciler;
+//# sourceMappingURL=worktree-reconcile.d.ts.map

package/server/application/workspace/worktree-reconcile.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"worktree-reconcile.d.ts","sourceRoot":"","sources":["../../../src/application/workspace/worktree-reconcile.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAChD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,gCAAgC,CAAC;AACrE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,+BAA+B,CAAC;AACnE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAElD,MAAM,WAAW,4BAA4B;IAC3C,cAAc,EAAE,cAAc,CAAC;IAC/B,aAAa,EAAE,aAAa,CAAC;IAC7B,QAAQ,EAAE,cAAc,CAAC;IAEzB,QAAQ,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,OAAO,CAAC,QAAQ,EAAE,GAAG,IAAI,CAAC,CAAC;CAC7D;AAED,MAAM,WAAW,kBAAkB;IACjC;;;;;OAKG;IACH,SAAS,CAAC,SAAS,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,QAAQ,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACtE;AAoBD,wBAAgB,wBAAwB,CAAC,EACvC,cAAc,EACd,aAAa,EACb,QAAQ,EACR,QAAQ,GACT,EAAE,4BAA4B,GAAG,kBAAkB,CA+BnD"}

package/server/application/workspace/worktree-reconcile.js

@@ -0,0 +1,49 @@
+/**
+ * Fields whose change for an already-known path should re-broadcast a
+ * `worktree-created` so the client overlays fresh metadata. The reducer
+ * upserts by path with `{ ...prev, ...incoming }`, so re-emitting an
+ * existing entry is the canonical "update" channel.
+ */
+function metaDiffers(a, b) {
+    return (a.head !== b.head ||
+        a.branch !== b.branch ||
+        a.ahead !== b.ahead ||
+        a.behind !== b.behind ||
+        a.dirtyCount !== b.dirtyCount ||
+        a.origin !== b.origin ||
+        Boolean(a.orphan) !== Boolean(b.orphan));
+}
+export function createWorktreeReconciler({ projectManager, worktreeCache, eventBus, liveList, }) {
+    return {
+        async reconcile(projectId, prefetched) {
+            if (!projectManager.get(projectId))
+                return;
+            const live = prefetched ?? (await liveList(projectId));
+            if (live === null)
+                return;
+            const cached = worktreeCache.get()[projectId] ?? [];
+            const livePaths = new Set(live.map((w) => w.path));
+            const cachedByPath = new Map(cached.map((w) => [w.path, w]));
+            for (const w of cached) {
+                if (livePaths.has(w.path))
+                    continue;
+                eventBus.broadcast({
+                    type: "worktree-removed",
+                    projectId,
+                    worktreePath: w.path,
+                });
+            }
+            for (const w of live) {
+                const prev = cachedByPath.get(w.path);
+                if (prev && !metaDiffers(prev, w))
+                    continue;
+                eventBus.broadcast({
+                    type: "worktree-created",
+                    projectId,
+                    worktree: w,
+                });
+            }
+        },
+    };
+}
+//# sourceMappingURL=worktree-reconcile.js.map

package/server/application/workspace/worktree-reconcile.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"worktree-reconcile.js","sourceRoot":"","sources":["../../../src/application/workspace/worktree-reconcile.ts"],"names":[],"mappings":"AAuBA;;;;;GAKG;AACH,SAAS,WAAW,CAAC,CAAW,EAAE,CAAW;IAC3C,OAAO,CACL,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,IAAI;QACjB,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM;QACrB,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC,KAAK;QACnB,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM;QACrB,CAAC,CAAC,UAAU,KAAK,CAAC,CAAC,UAAU;QAC7B,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM;QACrB,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CACxC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,wBAAwB,CAAC,EACvC,cAAc,EACd,aAAa,EACb,QAAQ,EACR,QAAQ,GACqB;IAC7B,OAAO;QACL,KAAK,CAAC,SAAS,CAAC,SAAiB,EAAE,UAAuB;YACxD,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,SAAS,CAAC;gBAAE,OAAO;YAC3C,MAAM,IAAI,GAAG,UAAU,IAAI,CAAC,MAAM,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC;YACvD,IAAI,IAAI,KAAK,IAAI;gBAAE,OAAO;YAE1B,MAAM,MAAM,GAAG,aAAa,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC;YACpD,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;YACnD,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;YAE7D,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;gBACvB,IAAI,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;oBAAE,SAAS;gBACpC,QAAQ,CAAC,SAAS,CAAC;oBACjB,IAAI,EAAE,kBAAkB;oBACxB,SAAS;oBACT,YAAY,EAAE,CAAC,CAAC,IAAI;iBACrB,CAAC,CAAC;YACL,CAAC;YAED,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;gBACrB,MAAM,IAAI,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;gBACtC,IAAI,IAAI,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC,CAAC;oBAAE,SAAS;gBAC5C,QAAQ,CAAC,SAAS,CAAC;oBACjB,IAAI,EAAE,kBAAkB;oBACxB,SAAS;oBACT,QAAQ,EAAE,CAAC;iBACZ,CAAC,CAAC;YACL,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC"}

package/server/auth/origin.d.ts

@@ -0,0 +1,17 @@
+import type { NetworkInterfaceInfo } from "node:os";
+import type { MiddlewareHandler } from "hono";
+export declare function normalizeOrigin(raw: string): string | null;
+export declare function parseAllowedOriginsEnv(raw: string | undefined): string[];
+export interface BuildAllowedOriginsOptions {
+    bindHost: string;
+    port: number;
+    extra: string[];
+    protocol?: "http" | "https";
+    ifaces?: Record<string, NetworkInterfaceInfo[] | undefined>;
+}
+export declare function buildAllowedOrigins({ bindHost, port, extra, protocol, ifaces, }: BuildAllowedOriginsOptions): Set<string>;
+export interface OriginMiddlewareOptions {
+    allowed: Set<string>;
+}
+export declare function originMiddleware({ allowed, }: OriginMiddlewareOptions): MiddlewareHandler;
+//# sourceMappingURL=origin.d.ts.map

package/server/auth/origin.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"origin.d.ts","sourceRoot":"","sources":["../../src/auth/origin.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,SAAS,CAAC;AAEpD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,MAAM,CAAC;AAE9C,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAa1D;AAED,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,EAAE,CAUxE;AAID,MAAM,WAAW,0BAA0B;IACzC,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;IAC5B,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,oBAAoB,EAAE,GAAG,SAAS,CAAC,CAAC;CAC7D;AAWD,wBAAgB,mBAAmB,CAAC,EAClC,QAAQ,EACR,IAAI,EACJ,KAAK,EACL,QAAiB,EACjB,MAAM,GACP,EAAE,0BAA0B,GAAG,GAAG,CAAC,MAAM,CAAC,CAgC1C;AAED,MAAM,WAAW,uBAAuB;IACtC,OAAO,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;CACtB;AAED,wBAAgB,gBAAgB,CAAC,EAC/B,OAAO,GACR,EAAE,uBAAuB,GAAG,iBAAiB,CAU7C"}

package/server/auth/origin.js

@@ -0,0 +1,93 @@
+import { networkInterfaces } from "node:os";
+export function normalizeOrigin(raw) {
+    try {
+        const url = new URL(raw);
+        if (url.protocol !== "http:" && url.protocol !== "https:")
+            return null;
+        const scheme = url.protocol.replace(":", "");
+        let host = url.hostname.toLowerCase();
+        if (host.includes(":") && !host.startsWith("["))
+            host = `[${host}]`;
+        const defaultPort = scheme === "http" ? "80" : "443";
+        const port = url.port && url.port !== defaultPort ? `:${url.port}` : "";
+        return `${scheme}://${host}${port}`;
+    }
+    catch {
+        return null;
+    }
+}
+export function parseAllowedOriginsEnv(raw) {
+    if (!raw)
+        return [];
+    const out = [];
+    for (const part of raw.split(",")) {
+        const trimmed = part.trim();
+        if (!trimmed)
+            continue;
+        const normalized = normalizeOrigin(trimmed);
+        if (normalized)
+            out.push(normalized);
+    }
+    return out;
+}
+const WILDCARD_HOSTS = new Set(["0.0.0.0", "::", "[::]"]);
+function isIPv6LinkLocal(addr) {
+    return addr.toLowerCase().startsWith("fe80:");
+}
+function formatHost(address, family) {
+    if (family === "IPv6")
+        return `[${address}]`;
+    return address;
+}
+export function buildAllowedOrigins({ bindHost, port, extra, protocol = "http", ifaces, }) {
+    const set = new Set();
+    const add = (raw) => {
+        const n = normalizeOrigin(raw);
+        if (n)
+            set.add(n);
+    };
+    add(`${protocol}://127.0.0.1:${port}`);
+    add(`${protocol}://localhost:${port}`);
+    add(`${protocol}://[::1]:${port}`);
+    if (WILDCARD_HOSTS.has(bindHost)) {
+        // Wildcard bind reaches every non-internal interface address. Seed each
+        // into the allowlist so browser Origin headers from LAN/VPN/Tailscale
+        // clients are accepted without forcing users to set PARASOR_ALLOWED_ORIGINS.
+        const raw = ifaces ?? networkInterfaces();
+        for (const addrs of Object.values(raw)) {
+            if (!addrs)
+                continue;
+            for (const info of addrs) {
+                if (info.internal)
+                    continue;
+                if (info.family !== "IPv4" && info.family !== "IPv6")
+                    continue;
+                if (info.family === "IPv6" && isIPv6LinkLocal(info.address))
+                    continue;
+                add(`${protocol}://${formatHost(info.address, info.family)}:${port}`);
+            }
+        }
+    }
+    else {
+        const host = bindHost.includes(":") && !bindHost.startsWith("[")
+            ? `[${bindHost}]`
+            : bindHost;
+        add(`${protocol}://${host}:${port}`);
+    }
+    for (const e of extra)
+        add(e);
+    return set;
+}
+export function originMiddleware({ allowed, }) {
+    return async (c, next) => {
+        const origin = c.req.header("origin") ?? c.req.header("Origin");
+        if (!origin)
+            return next();
+        const normalized = normalizeOrigin(origin);
+        if (!normalized || !allowed.has(normalized)) {
+            return c.text("Forbidden", 403);
+        }
+        return next();
+    };
+}
+//# sourceMappingURL=origin.js.map

package/server/auth/origin.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"origin.js","sourceRoot":"","sources":["../../src/auth/origin.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,iBAAiB,EAAE,MAAM,SAAS,CAAC;AAG5C,MAAM,UAAU,eAAe,CAAC,GAAW;IACzC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;QACzB,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC;QACvE,MAAM,MAAM,GAAG,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QAC7C,IAAI,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;QACtC,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,IAAI,GAAG,IAAI,IAAI,GAAG,CAAC;QACpE,MAAM,WAAW,GAAG,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC;QACrD,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI,KAAK,WAAW,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACxE,OAAO,GAAG,MAAM,MAAM,IAAI,GAAG,IAAI,EAAE,CAAC;IACtC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,GAAuB;IAC5D,IAAI,CAAC,GAAG;QAAE,OAAO,EAAE,CAAC;IACpB,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,KAAK,MAAM,IAAI,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QAClC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAC5B,IAAI,CAAC,OAAO;YAAE,SAAS;QACvB,MAAM,UAAU,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC;QAC5C,IAAI,UAAU;YAAE,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IACvC,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,CAAC,SAAS,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;AAU1D,SAAS,eAAe,CAAC,IAAY;IACnC,OAAO,IAAI,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;AAChD,CAAC;AAED,SAAS,UAAU,CAAC,OAAe,EAAE,MAAuB;IAC1D,IAAI,MAAM,KAAK,MAAM;QAAE,OAAO,IAAI,OAAO,GAAG,CAAC;IAC7C,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,EAClC,QAAQ,EACR,IAAI,EACJ,KAAK,EACL,QAAQ,GAAG,MAAM,EACjB,MAAM,GACqB;IAC3B,MAAM,GAAG,GAAG,IAAI,GAAG,EAAU,CAAC;IAC9B,MAAM,GAAG,GAAG,CAAC,GAAW,EAAE,EAAE;QAC1B,MAAM,CAAC,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;QAC/B,IAAI,CAAC;YAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IACpB,CAAC,CAAC;IACF,GAAG,CAAC,GAAG,QAAQ,gBAAgB,IAAI,EAAE,CAAC,CAAC;IACvC,GAAG,CAAC,GAAG,QAAQ,gBAAgB,IAAI,EAAE,CAAC,CAAC;IACvC,GAAG,CAAC,GAAG,QAAQ,YAAY,IAAI,EAAE,CAAC,CAAC;IACnC,IAAI,cAAc,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;QACjC,wEAAwE;QACxE,sEAAsE;QACtE,6EAA6E;QAC7E,MAAM,GAAG,GAAG,MAAM,IAAI,iBAAiB,EAAE,CAAC;QAC1C,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;YACvC,IAAI,CAAC,KAAK;gBAAE,SAAS;YACrB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;gBACzB,IAAI,IAAI,CAAC,QAAQ;oBAAE,SAAS;gBAC5B,IAAI,IAAI,CAAC,MAAM,KAAK,MAAM,IAAI,IAAI,CAAC,MAAM,KAAK,MAAM;oBAAE,SAAS;gBAC/D,IAAI,IAAI,CAAC,MAAM,KAAK,MAAM,IAAI,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC;oBAAE,SAAS;gBACtE,GAAG,CAAC,GAAG,QAAQ,MAAM,UAAU,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;YACxE,CAAC;QACH,CAAC;IACH,CAAC;SAAM,CAAC;QACN,MAAM,IAAI,GACR,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC;YACjD,CAAC,CAAC,IAAI,QAAQ,GAAG;YACjB,CAAC,CAAC,QAAQ,CAAC;QACf,GAAG,CAAC,GAAG,QAAQ,MAAM,IAAI,IAAI,IAAI,EAAE,CAAC,CAAC;IACvC,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,KAAK;QAAE,GAAG,CAAC,CAAC,CAAC,CAAC;IAC9B,OAAO,GAAG,CAAC;AACb,CAAC;AAMD,MAAM,UAAU,gBAAgB,CAAC,EAC/B,OAAO,GACiB;IACxB,OAAO,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;QACvB,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAChE,IAAI,CAAC,MAAM;YAAE,OAAO,IAAI,EAAE,CAAC;QAC3B,MAAM,UAAU,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC;QAC3C,IAAI,CAAC,UAAU,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;YAC5C,OAAO,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC;QAClC,CAAC;QACD,OAAO,IAAI,EAAE,CAAC;IAChB,CAAC,CAAC;AACJ,CAAC"}

package/server/auth/pairing-token.d.ts

@@ -0,0 +1,28 @@
+export declare const DEFAULT_PAIRING_TOKEN_TTL_MS: number;
+export type PairingConsumeResult = {
+    ok: true;
+    expiresAt: number;
+} | {
+    ok: false;
+    reason: "missing" | "expired" | "used";
+};
+export interface PairingTokenStoreOptions {
+    defaultTtlMs?: number;
+    now?: () => number;
+}
+export interface IssuePairingTokenOptions {
+    ttlMs?: number;
+}
+export declare class PairingTokenStore {
+    private readonly entries;
+    private readonly defaultTtlMs;
+    private readonly now;
+    constructor(opts?: PairingTokenStoreOptions);
+    issue(opts?: IssuePairingTokenOptions): {
+        token: string;
+        expiresAt: number;
+    };
+    consume(token: string | null | undefined): PairingConsumeResult;
+    private cleanupExpired;
+}
+//# sourceMappingURL=pairing-token.d.ts.map

package/server/auth/pairing-token.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pairing-token.d.ts","sourceRoot":"","sources":["../../src/auth/pairing-token.ts"],"names":[],"mappings":"AAEA,eAAO,MAAM,4BAA4B,QAAgB,CAAC;AAE1D,MAAM,MAAM,oBAAoB,GAC5B;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,GAC/B;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,SAAS,GAAG,SAAS,GAAG,MAAM,CAAA;CAAE,CAAC;AAO1D,MAAM,WAAW,wBAAwB;IACvC,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,wBAAwB;IACvC,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,qBAAa,iBAAiB;IAC5B,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAmC;IAC3D,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAS;IACtC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAe;gBAEvB,IAAI,GAAE,wBAA6B;IAK/C,KAAK,CAAC,IAAI,GAAE,wBAA6B,GAAG;QAC1C,KAAK,EAAE,MAAM,CAAC;QACd,SAAS,EAAE,MAAM,CAAC;KACnB;IASD,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,oBAAoB;IAc/D,OAAO,CAAC,cAAc;CAMvB"}

package/server/auth/pairing-token.js

@@ -0,0 +1,46 @@
+import { createHash, randomBytes } from "node:crypto";
+export const DEFAULT_PAIRING_TOKEN_TTL_MS = 5 * 60 * 1000;
+export class PairingTokenStore {
+    entries = new Map();
+    defaultTtlMs;
+    now;
+    constructor(opts = {}) {
+        this.defaultTtlMs = opts.defaultTtlMs ?? DEFAULT_PAIRING_TOKEN_TTL_MS;
+        this.now = opts.now ?? Date.now;
+    }
+    issue(opts = {}) {
+        this.cleanupExpired();
+        const token = randomBytes(32).toString("base64url");
+        const ttlMs = opts.ttlMs ?? this.defaultTtlMs;
+        const expiresAt = this.now() + ttlMs;
+        this.entries.set(hashToken(token), { expiresAt, used: false });
+        return { token, expiresAt };
+    }
+    consume(token) {
+        if (!token)
+            return { ok: false, reason: "missing" };
+        const key = hashToken(token);
+        const entry = this.entries.get(key);
+        if (!entry)
+            return { ok: false, reason: "missing" };
+        if (entry.expiresAt <= this.now()) {
+            this.entries.delete(key);
+            return { ok: false, reason: "expired" };
+        }
+        if (entry.used)
+            return { ok: false, reason: "used" };
+        entry.used = true;
+        return { ok: true, expiresAt: entry.expiresAt };
+    }
+    cleanupExpired() {
+        const now = this.now();
+        for (const [key, entry] of this.entries) {
+            if (entry.expiresAt <= now)
+                this.entries.delete(key);
+        }
+    }
+}
+function hashToken(token) {
+    return createHash("sha256").update(token).digest("base64url");
+}
+//# sourceMappingURL=pairing-token.js.map

package/server/auth/pairing-token.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pairing-token.js","sourceRoot":"","sources":["../../src/auth/pairing-token.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAEtD,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;AAoB1D,MAAM,OAAO,iBAAiB;IACX,OAAO,GAAG,IAAI,GAAG,EAAwB,CAAC;IAC1C,YAAY,CAAS;IACrB,GAAG,CAAe;IAEnC,YAAY,OAAiC,EAAE;QAC7C,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC,YAAY,IAAI,4BAA4B,CAAC;QACtE,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;IAClC,CAAC;IAED,KAAK,CAAC,OAAiC,EAAE;QAIvC,IAAI,CAAC,cAAc,EAAE,CAAC;QACtB,MAAM,KAAK,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QACpD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,YAAY,CAAC;QAC9C,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC;QACrC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAC/D,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;IAC9B,CAAC;IAED,OAAO,CAAC,KAAgC;QACtC,IAAI,CAAC,KAAK;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;QACpD,MAAM,GAAG,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;QAC7B,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACpC,IAAI,CAAC,KAAK;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;QACpD,IAAI,KAAK,CAAC,SAAS,IAAI,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;YAClC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACzB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;QAC1C,CAAC;QACD,IAAI,KAAK,CAAC,IAAI;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;QACrD,KAAK,CAAC,IAAI,GAAG,IAAI,CAAC;QAClB,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC;IAClD,CAAC;IAEO,cAAc;QACpB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YACxC,IAAI,KAAK,CAAC,SAAS,IAAI,GAAG;gBAAE,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACvD,CAAC;IACH,CAAC;CACF;AAED,SAAS,SAAS,CAAC,KAAa;IAC9B,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;AAChE,CAAC"}

package/server/auth/token-exchange.d.ts

@@ -0,0 +1,11 @@
+import type { MiddlewareHandler } from "hono";
+import type { PairingTokenStore } from "./pairing-token.js";
+import { type TokenAuth } from "./token.js";
+export type TokenExchangeAuthMode = "token" | "allowlist" | "none";
+export interface TokenExchangeOptions {
+    mode: TokenExchangeAuthMode;
+    tokenAuth: TokenAuth;
+    pairingTokens?: PairingTokenStore;
+}
+export declare function createTokenExchangeMiddleware({ mode, tokenAuth, pairingTokens, }: TokenExchangeOptions): MiddlewareHandler;
+//# sourceMappingURL=token-exchange.d.ts.map

package/server/auth/token-exchange.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"token-exchange.d.ts","sourceRoot":"","sources":["../../src/auth/token-exchange.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,MAAM,CAAC;AAC9C,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAC5D,OAAO,EAAwB,KAAK,SAAS,EAAE,MAAM,YAAY,CAAC;AAElE,MAAM,MAAM,qBAAqB,GAAG,OAAO,GAAG,WAAW,GAAG,MAAM,CAAC;AAEnE,MAAM,WAAW,oBAAoB;IACnC,IAAI,EAAE,qBAAqB,CAAC;IAC5B,SAAS,EAAE,SAAS,CAAC;IACrB,aAAa,CAAC,EAAE,iBAAiB,CAAC;CACnC;AAED,wBAAgB,6BAA6B,CAAC,EAC5C,IAAI,EACJ,SAAS,EACT,aAAa,GACd,EAAE,oBAAoB,GAAG,iBAAiB,CA6B1C"}

package/server/auth/token-exchange.js

@@ -0,0 +1,27 @@
+import { setParasorAuthCookie } from "./token.js";
+export function createTokenExchangeMiddleware({ mode, tokenAuth, pairingTokens, }) {
+    return async (c, next) => {
+        if (mode !== "token")
+            return next();
+        const url = new URL(c.req.url);
+        const token = url.searchParams.get("t");
+        if (!token)
+            return next();
+        if (tokenAuth.verify(token)) {
+            setParasorAuthCookie(c, tokenAuth.token, url);
+            url.searchParams.delete("t");
+            return c.redirect(url.pathname + (url.search || ""));
+        }
+        const pairingResult = pairingTokens?.consume(token);
+        if (pairingResult?.ok) {
+            setParasorAuthCookie(c, tokenAuth.token, url);
+            url.searchParams.delete("t");
+            return c.redirect(url.pathname + (url.search || ""));
+        }
+        if (pairingResult && pairingResult.reason !== "missing") {
+            return c.json({ error: "Pairing token rejected", reason: pairingResult.reason }, 401);
+        }
+        return c.json({ error: "Unauthorized" }, 401);
+    };
+}
+//# sourceMappingURL=token-exchange.js.map

package/server/auth/token-exchange.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"token-exchange.js","sourceRoot":"","sources":["../../src/auth/token-exchange.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,oBAAoB,EAAkB,MAAM,YAAY,CAAC;AAUlE,MAAM,UAAU,6BAA6B,CAAC,EAC5C,IAAI,EACJ,SAAS,EACT,aAAa,GACQ;IACrB,OAAO,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;QACvB,IAAI,IAAI,KAAK,OAAO;YAAE,OAAO,IAAI,EAAE,CAAC;QACpC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC/B,MAAM,KAAK,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACxC,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,EAAE,CAAC;QAE1B,IAAI,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;YAC5B,oBAAoB,CAAC,CAAC,EAAE,SAAS,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC9C,GAAG,CAAC,YAAY,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAC7B,OAAO,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,GAAG,CAAC,GAAG,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,CAAC;QACvD,CAAC;QAED,MAAM,aAAa,GAAG,aAAa,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;QACpD,IAAI,aAAa,EAAE,EAAE,EAAE,CAAC;YACtB,oBAAoB,CAAC,CAAC,EAAE,SAAS,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC9C,GAAG,CAAC,YAAY,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAC7B,OAAO,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,GAAG,CAAC,GAAG,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,CAAC;QACvD,CAAC;QAED,IAAI,aAAa,IAAI,aAAa,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YACxD,OAAO,CAAC,CAAC,IAAI,CACX,EAAE,KAAK,EAAE,wBAAwB,EAAE,MAAM,EAAE,aAAa,CAAC,MAAM,EAAE,EACjE,GAAG,CACJ,CAAC;QACJ,CAAC;QAED,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE,GAAG,CAAC,CAAC;IAChD,CAAC,CAAC;AACJ,CAAC"}

package/server/auth/token.d.ts

@@ -0,0 +1,18 @@
+import type { Context, MiddlewareHandler } from "hono";
+export declare const COOKIE_MAX_AGE_SECONDS: number;
+export declare function setParasorAuthCookie(c: Context, token: string, url: URL): void;
+export interface TokenAuthOpts {
+    dir: string;
+    ephemeral?: boolean;
+}
+export declare class TokenAuth {
+    readonly token: string;
+    private readonly tokenPath;
+    constructor(opts: TokenAuthOpts);
+    verify(candidate: string): boolean;
+    extractToken(search: string, cookieHeader: string | undefined): string | null;
+    middleware(mode: "token" | "allowlist" | "none", allowedCidrs?: string[], trustProxy?: boolean): MiddlewareHandler;
+    private loadOrGenerate;
+    private generate;
+}
+//# sourceMappingURL=token.d.ts.map

package/server/auth/token.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"token.d.ts","sourceRoot":"","sources":["../../src/auth/token.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,OAAO,EAAE,iBAAiB,EAAE,MAAM,MAAM,CAAC;AAGvD,eAAO,MAAM,sBAAsB,QAAoB,CAAC;AAExD,wBAAgB,oBAAoB,CAClC,CAAC,EAAE,OAAO,EACV,KAAK,EAAE,MAAM,EACb,GAAG,EAAE,GAAG,GACP,IAAI,CAQN;AAED,MAAM,WAAW,aAAa;IAC5B,GAAG,EAAE,MAAM,CAAC;IACZ,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB;AAED,qBAAa,SAAS;IACpB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAS;gBAEvB,IAAI,EAAE,aAAa;IAK/B,MAAM,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO;IAOlC,YAAY,CACV,MAAM,EAAE,MAAM,EACd,YAAY,EAAE,MAAM,GAAG,SAAS,GAC/B,MAAM,GAAG,IAAI;IAchB,UAAU,CACR,IAAI,EAAE,OAAO,GAAG,WAAW,GAAG,MAAM,EACpC,YAAY,CAAC,EAAE,MAAM,EAAE,EACvB,UAAU,UAAQ,GACjB,iBAAiB;IAmDpB,OAAO,CAAC,cAAc;IAUtB,OAAO,CAAC,QAAQ;CAQjB"}