rovloom 0.4.0 → 0.5.0

package/dist/src/{chunk-5vx1b9z8.js → chunk-xhq21g24.js}

@@ -6,13 +6,13 @@ import"./chunk-9tt13dm0.js";
 import"./chunk-g7pnjzkk.js";
 import {
   readOrCreateRoleConfig
-} from "./chunk-v1httsp6.js";
+} from "./chunk-64ftwe9b.js";
 import {
   resolveRoleConfigPath2
-} from "./chunk-qfyefed3.js";
+} from "./chunk-1bf0wmgk.js";
 import {
   CliError2
-} from "./chunk-bjdqj43d.js";
+} from "./chunk-hpzr94hm.js";
 import"./chunk-3nnahj0j.js";
 import"./chunk-0y5542k8.js";
 

package/dist/src/{chunk-4af38z2b.js → chunk-ybte82d3.js}

@@ -3,7 +3,7 @@ import {
   HTTP_BODY_BYTES2,
   createHttpFacade2,
   startHttpFacade2
-} from "./chunk-76wgt2g5.js";
+} from "./chunk-9y36gntb.js";
 import"./chunk-smpevv7n.js";
 import"./chunk-7crhmqn2.js";
 import"./chunk-d71r315c.js";

package/dist/src/{chunk-khmgp03q.js → chunk-ympzv86c.js}

@@ -14,6 +14,7 @@ import {
   parseManagementReadPath
 } from "./chunk-gav2y5y9.js";
 import {
+  isWildcardHostname,
   canonicalLoopbackHost
 } from "./chunk-6n9s7nfe.js";
 
@@ -37,6 +38,30 @@ var statuses = {
   invalid_response: 502,
   timeout: 504
 };
+function lanAwareOrigin(request, loopback, lan) {
+  const raw = request.headers.get("host");
+  if (!raw || Buffer.byteLength(raw) > 2048) {
+    return null;
+  }
+  const expected = new URL(loopback);
+  const host = raw.toLowerCase();
+  if (host === expected.host.toLowerCase()) {
+    return expected.origin;
+  }
+  if (!lan) {
+    return null;
+  }
+  try {
+    const url = new URL(request.url);
+    const candidate = "http://" + host;
+    if (new URL(candidate).origin !== candidate) {
+      return null;
+    }
+    return url.host.toLowerCase() === host && url.protocol === "http:" ? candidate : null;
+  } catch {
+    return null;
+  }
+}
 function failure(code, status) {
   return new Response(JSON.stringify({ error: code }), {
     status,
@@ -77,6 +102,9 @@ function assets(input) {
   return result;
 }
 function allowed(request, expected) {
+  if (expected === null) {
+    return null;
+  }
   if (new TextEncoder().encode(request.url).byteLength > MANAGEMENT_URL_BYTES) {
     return null;
   }
@@ -118,7 +146,7 @@ function context(identity, signal) {
 async function initialize(implementation, request, body, signal) {
   return implementation(request, new Response(body.slice().buffer, { headers: { ...headers, "content-type": managementAssetType("/") } }), signal);
 }
-function prepare(options, origin) {
+function prepare(options, origin, lan = () => false) {
   if (!options || typeof options.authenticate !== "function") {
     throw new Error("management_authentication_required");
   }
@@ -174,7 +202,7 @@ function prepare(options, origin) {
     }
     let url;
     try {
-      url = allowed(request, origin());
+      url = allowed(request, lanAwareOrigin(request, origin(), lan()));
     } catch {
       url = null;
     }
@@ -264,24 +292,27 @@ function prepare(options, origin) {
 }
 function createManagementReadHandler2(options) {
   const url = new URL(options.origin);
-  if (url.origin !== options.origin || url.protocol !== "http:" || url.hostname !== "127.0.0.1" || url.username || url.password) {
+  if (url.origin !== options.origin || url.protocol !== "http:" || !["127.0.0.1", "[::1]"].includes(url.hostname) || url.username || url.password) {
     throw new Error("management_listener_invalid");
   }
-  return prepare(options, () => options.origin);
+  return prepare(options, () => options.origin, () => options.lan === true);
 }
 function startManagementReadListener2(options) {
   if (!options) {
     throw new Error("management_listener_invalid");
   }
   let origin = "";
-  const handler = prepare(options, () => origin);
+  let lan = false;
+  const handler = prepare(options, () => origin, () => lan);
   try {
     return startManagementListener2({
       port: options.port,
       hostname: options.hostname,
+      lan: options.lan === true,
       maxRequestBodySize: 1,
-      handler: (actualOrigin) => {
+      handler: (actualOrigin, actualLan) => {
         origin = actualOrigin;
+        lan = actualLan;
         return handler;
       }
     });
@@ -307,7 +338,7 @@ function startManagementListener2(options) {
   });
   const url = new URL(`http://${canonicalLoopbackHost(options.hostname)}:${server.port}`).origin;
   try {
-    handler = options.handler(url);
+    handler = options.handler(url, options.lan === true && isWildcardHostname(options.hostname));
     if (typeof handler?.fetch !== "function" || typeof handler.stop !== "function") {
       throw new Error("management_listener_invalid");
     }
@@ -844,7 +875,7 @@ function createManagementHandler2(options) {
     throw new Error("management_csrf_required");
   }
   const reads = createManagementReadHandler2(options);
-  const origin = new URL(options.origin);
+  const expected = (request) => lanAwareOrigin(request, options.origin, options.lan === true);
   const pending = new Set;
   let stopped = false;
   let tokens = 16;
@@ -930,7 +961,7 @@ function createManagementHandler2(options) {
         size += Buffer.byteLength(name + value);
         count++;
       }
-      if (request.url.length > 2048 || size > 16384 || count > 48 || url.origin !== options.origin || request.headers.get("host") !== origin.host || request.headers.get("origin") !== options.origin || url.username || url.password || url.search || url.hash || request.headers.has("sec-fetch-site") && request.headers.get("sec-fetch-site") !== "same-origin") {
+      if (request.url.length > 2048 || size > 16384 || count > 48 || url.origin !== expected(request) || request.headers.get("origin") !== url.origin || url.username || url.password || url.search || url.hash || request.headers.has("sec-fetch-site") && request.headers.get("sec-fetch-site") !== "same-origin") {
         return failure2("forbidden", 403);
       }
       if (request.method !== "POST") {
@@ -1025,16 +1056,37 @@ function createManagementSessionAdapter2(options) {
     throw new Error("management_cookie_name_invalid");
   }
   const origin = new URL(options.origin);
-  if (origin.origin !== options.origin || origin.protocol !== "http:" || origin.hostname !== "127.0.0.1" || origin.username || origin.password) {
+  if (origin.origin !== options.origin || origin.protocol !== "http:" || !["127.0.0.1", "[::1]"].includes(origin.hostname) || origin.username || origin.password) {
     throw new Error("management_listener_invalid");
   }
   const identities = options.identities;
   const sessions = options.sessions;
   const now = options.now ?? Date.now;
   let observed = 0;
+  function expected(request) {
+    const raw = request.headers.get("host");
+    if (!raw || Buffer.byteLength(raw) > 2048) {
+      return null;
+    }
+    const host = raw.toLowerCase();
+    if (host === origin.host.toLowerCase()) {
+      return origin.origin;
+    }
+    if (!options.lan) {
+      return null;
+    }
+    try {
+      const url = new URL(request.url);
+      const candidate = "http://" + host;
+      return new URL(candidate).origin === candidate && url.host.toLowerCase() === host && url.protocol === "http:" ? candidate : null;
+    } catch {
+      return null;
+    }
+  }
   function cookie(request) {
     const url = new URL(request.url);
-    if (url.origin !== origin.origin || request.headers.get("host") !== origin.host || request.headers.has("origin") && request.headers.get("origin") !== origin.origin) {
+    const trusted = expected(request);
+    if (trusted === null || url.origin !== trusted || request.headers.has("origin") && request.headers.get("origin") !== trusted) {
       return null;
     }
     const site = request.headers.get("sec-fetch-site");
@@ -1115,7 +1167,7 @@ function createManagementSessionAdapter2(options) {
       if (request.method !== "POST") {
         return false;
       }
-      if (request.headers.get("origin") !== origin.origin || request.headers.has("sec-fetch-site") && request.headers.get("sec-fetch-site") !== "same-origin") {
+      if (request.headers.get("origin") !== expected(request) || request.headers.has("sec-fetch-site") && request.headers.get("sec-fetch-site") !== "same-origin") {
         return false;
       }
       const candidate = request.headers.get("x-rovloom-csrf");
@@ -1132,4 +1184,4 @@ function createManagementSessionAdapter2(options) {
 }
 export { createManagementReadHandler2, startManagementReadListener2, startManagementListener2, loadManagementAssets2, ManagementServiceError2, StoreManagementWriteService2, createManagementHandler2, createManagementSessionAdapter2 };
 
-//# debugId=FD715A6C580CBDB864756E2164756E21
+//# debugId=5F343A955701396E64756E2164756E21

package/dist/src/{chunk-se5daacy.js → chunk-z7kkfrgz.js}

@@ -4,7 +4,7 @@ import {
 } from "./chunk-7crhmqn2.js";
 import {
   CliError2
-} from "./chunk-bjdqj43d.js";
+} from "./chunk-hpzr94hm.js";
 import {
   readPrivateBytes
 } from "./chunk-0y5542k8.js";

package/dist/src/cli/index.js

@@ -8,7 +8,7 @@ import {
   HELP2,
   parseCommand2,
   runCli2
-} from "../chunk-keg92d31.js";
+} from "../chunk-abd4envz.js";
 import {
   Store2
 } from "../chunk-nyn75b8v.js";
@@ -16,7 +16,7 @@ import"../chunk-09f9q26d.js";
 import {
   FacadeServiceError2
 } from "../chunk-smpevv7n.js";
-import"../chunk-76wgt2g5.js";
+import"../chunk-9y36gntb.js";
 import {
   Router2
 } from "../chunk-y4hksha9.js";
@@ -39,38 +39,38 @@ import {
 import"../chunk-d4ejrtjq.js";
 import"../chunk-5s2emvww.js";
 import"../chunk-4etdq0cp.js";
-import"../chunk-khmgp03q.js";
+import"../chunk-ympzv86c.js";
 import"../chunk-5h82060k.js";
 import"../chunk-863tk45b.js";
 import"../chunk-zb641qa3.js";
 import"../chunk-ttsrctxg.js";
 import"../chunk-5svt6rwr.js";
 import"../chunk-2tn0r64b.js";
-import"../chunk-wdr3sdsm.js";
-import"../chunk-fd9n51mc.js";
+import"../chunk-fnakrk0a.js";
+import"../chunk-n073xnr1.js";
 import {
   createRuntimeCliRuntime2,
   MANAGEMENT_COOKIE_NAME2,
   MANAGEMENT_BOOTSTRAP_META2,
   createManagementPageInitializer2,
   createProductionCliRuntime2
-} from "../chunk-dtj9y82v.js";
-import"../chunk-qab3m6nh.js";
+} from "../chunk-5n8csngz.js";
+import"../chunk-ebm3kvnq.js";
 import {
   readRuntimeConfig2
-} from "../chunk-6hxy1fcg.js";
-import"../chunk-v1httsp6.js";
+} from "../chunk-bspzg8er.js";
+import"../chunk-64ftwe9b.js";
 import {
   resolveRoleConfigPath2
-} from "../chunk-qfyefed3.js";
-import"../chunk-se5daacy.js";
+} from "../chunk-1bf0wmgk.js";
+import"../chunk-z7kkfrgz.js";
 import {
   CliError2,
   parseConfig2,
   configDocument2,
   configTemplate2,
   readConfig2
-} from "../chunk-bjdqj43d.js";
+} from "../chunk-hpzr94hm.js";
 import"../chunk-vwcntax3.js";
 import"../chunk-gbsbwssz.js";
 import"../chunk-3nnahj0j.js";

package/dist/src/cli/main.js

@@ -10,20 +10,20 @@ import"../chunk-g7pnjzkk.js";
 import {
   parseCommand2,
   runCli2
-} from "../chunk-keg92d31.js";
+} from "../chunk-abd4envz.js";
 import {
   createNativeServiceBackend2,
   ServiceManager2
 } from "../chunk-ttm3c0jh.js";
-import"../chunk-6hxy1fcg.js";
-import"../chunk-v1httsp6.js";
+import"../chunk-bspzg8er.js";
+import"../chunk-64ftwe9b.js";
 import {
   resolveRoleConfigPath2
-} from "../chunk-qfyefed3.js";
-import"../chunk-se5daacy.js";
+} from "../chunk-1bf0wmgk.js";
+import"../chunk-z7kkfrgz.js";
 import {
   parseConfig2
-} from "../chunk-bjdqj43d.js";
+} from "../chunk-hpzr94hm.js";
 import {
   manifest,
   serviceControlId
@@ -300,10 +300,10 @@ async function control(role) {
 }
 async function product() {
   if (!runtime) {
-    const { createProductSources } = await import("../chunk-t3pn1435.js");
-    const { CliSetup } = await import("../chunk-ymsx7hhd.js");
+    const { createProductSources } = await import("../chunk-e7x51y0t.js");
+    const { CliSetup } = await import("../chunk-erdq0rn8.js");
     setup = new CliSetup;
-    runtime = (await import("../chunk-z1vhdr3c.js")).createProductionCliRuntime(createProductSources(), setup);
+    runtime = (await import("../chunk-rwpynx2j.js")).createProductionCliRuntime(createProductSources(), setup);
   }
   return runtime;
 }

package/dist/src/mcp/index.js

@@ -5,7 +5,7 @@ import {
   HTTP_BODY_BYTES2,
   createHttpFacade2,
   startHttpFacade2
-} from "../chunk-76wgt2g5.js";
+} from "../chunk-9y36gntb.js";
 import {
   StoreGatewayService2,
   RuntimeGatewayService2
@@ -22,7 +22,7 @@ import {
 import {
   MCP_REVISION2,
   PRODUCT_VERSION2
-} from "../chunk-xmkgq3nh.js";
+} from "../chunk-r0nfthsf.js";
 import"../chunk-zj48jvfe.js";
 import"../chunk-0xgpxdgc.js";
 import"../chunk-gbsbwssz.js";

package/dist/src/webui/index.js

@@ -1,4 +1,7 @@
 // @bun
+import {
+  DEFAULT_PAIRING_POLICY_REF
+} from "../chunk-5j0gj6w2.js";
 import {
   ReadError2,
   createSnapshotReader2,
@@ -1192,6 +1195,12 @@ function createPreferenceControl(kind, choices, onChoose) {
   return { root, update, close, dispose };
 }
 
+// src/webui/request-id.ts
+function managementRequestId() {
+  const bytes = globalThis.crypto.getRandomValues(new Uint8Array(16));
+  return "request_" + Array.from(bytes, (byte) => byte.toString(16).padStart(2, "0")).join("");
+}
+
 // src/webui/write-contract.ts
 class ManagementClientError extends Error {
   problem;
@@ -1695,7 +1704,7 @@ function createDeviceManagementFlow(options) {
   let active;
   let generation = 0;
   let disposed = false;
-  const requestId = options.requestId ?? (() => "request_" + globalThis.crypto.randomUUID());
+  const requestId = options.requestId ?? managementRequestId;
   async function execute(operation, args, signal) {
     if (signal.aborted) {
       throw new ManagementClientError("aborted");
@@ -2320,7 +2329,7 @@ function createPairingManagementFlow(options) {
   let active;
   let generation = 0;
   let disposed = false;
-  const requestId = options.requestId ?? (() => "request_" + globalThis.crypto.randomUUID());
+  const requestId = options.requestId ?? managementRequestId;
   async function execute(operation, args, signal) {
     if (signal.aborted) {
       throw new ManagementClientError("aborted");
@@ -2569,6 +2578,7 @@ function createPairingActions(options) {
   policyInput.required = true;
   policyInput.maxLength = 128;
   policyInput.autocomplete = "off";
+  policyInput.value = DEFAULT_PAIRING_POLICY_REF;
   policyLabel.append(policyCaption, policyInput);
   const create = node3("button", "pairing-confirm");
   create.type = "submit";
@@ -3507,4 +3517,4 @@ export {
   unavailableRead
 };
 
-//# debugId=8E3F9EB456F6148764756E2164756E21
+//# debugId=D52975500C6ECA9664756E2164756E21

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "rovloom",
-  "version": "0.4.0",
+  "version": "0.5.0",
   "description": "Rovloom: multi-machine MCP gateway and connector for Luvus/Herdr runtimes",
   "license": "Apache-2.0",
   "type": "module",