@autono/pinbox-core 0.1.0

package/dist/do.js

@@ -0,0 +1,713 @@
+import { AttachmentSchema, PinInputSchema, PinSchema, SessionRefSchema, ThreadMessageSchema } from "./schema.js";
+import { a as NotFoundError, i as ConflictError, o as newId, t as SessionSchema } from "./sessions-DrCVTMfI.js";
+import { t as MIGRATIONS } from "./store-DM8MjB8M.js";
+import { n as createHubHandler, o as ok, r as err } from "./hub-QYz6OqYQ.js";
+import { ClientHelloSchema, WS_CLOSE_PROTOCOL, WS_CLOSE_UNAUTHORIZED, WS_TOKEN_SUBPROTOCOL_PREFIX, encodeWsEvent } from "./ws-protocol.js";
+import { i as verifyJwt, n as verifyNone, r as verifyToken } from "./verify-BDt9d9Np.js";
+//#region src/do-store-registries.ts
+function parseSession(json) {
+	return SessionSchema.parse(JSON.parse(json));
+}
+var DoSessionStore = class {
+	sql;
+	storage;
+	constructor(sql, storage) {
+		this.sql = sql;
+		this.storage = storage;
+	}
+	register(ref) {
+		return this.storage.transactionSync(() => {
+			const now = (/* @__PURE__ */ new Date()).toISOString();
+			const existing = this.findByRef(ref);
+			const session = SessionSchema.parse({
+				id: existing?.id ?? newId("ses"),
+				agent: ref.agent,
+				key: ref.key,
+				...ref.cwd !== void 0 ? { cwd: ref.cwd } : {},
+				registeredAt: existing?.registeredAt ?? now,
+				lastSeenAt: now
+			});
+			this.sql.exec(`INSERT INTO sessions (id, agent, key, cwd, registered_at, last_seen_at, ended_at, json)
+         VALUES (?, ?, ?, ?, ?, ?, NULL, ?)
+         ON CONFLICT(id) DO UPDATE SET
+           cwd = excluded.cwd, last_seen_at = excluded.last_seen_at,
+           ended_at = NULL, json = excluded.json`, session.id, session.agent, session.key, session.cwd ?? null, session.registeredAt, session.lastSeenAt, JSON.stringify(session));
+			return session;
+		});
+	}
+	get(id) {
+		const row = this.sql.exec("SELECT json FROM sessions WHERE id = ?", id).toArray()[0];
+		return row ? parseSession(row.json) : null;
+	}
+	findByRef(ref) {
+		const row = this.sql.exec("SELECT json FROM sessions WHERE agent = ? AND key = ?", ref.agent, ref.key).toArray()[0];
+		return row ? parseSession(row.json) : null;
+	}
+	active() {
+		const row = this.sql.exec("SELECT json FROM sessions WHERE ended_at IS NULL ORDER BY last_seen_at DESC, rowid DESC LIMIT 1").toArray()[0];
+		return row ? parseSession(row.json) : null;
+	}
+	list() {
+		return this.sql.exec("SELECT json FROM sessions ORDER BY last_seen_at DESC, rowid DESC").toArray().map((row) => parseSession(row.json));
+	}
+	touch(id) {
+		this.refresh(id, (session, now) => ({
+			...session,
+			lastSeenAt: now
+		}));
+	}
+	end(id) {
+		this.refresh(id, (session, now) => ({
+			...session,
+			endedAt: now
+		}));
+	}
+	refresh(id, update) {
+		this.storage.transactionSync(() => {
+			const existing = this.get(id);
+			if (!existing) throw new NotFoundError(`session not found: ${id}`);
+			const session = SessionSchema.parse(update(existing, (/* @__PURE__ */ new Date()).toISOString()));
+			this.sql.exec("UPDATE sessions SET last_seen_at = ?, ended_at = ?, json = ? WHERE id = ?", session.lastSeenAt, session.endedAt ?? null, JSON.stringify(session), id);
+		});
+	}
+};
+var DoCursorStore = class {
+	sql;
+	constructor(sql) {
+		this.sql = sql;
+	}
+	get(consumerId) {
+		return this.sql.exec("SELECT last_seq FROM cursors WHERE consumer_id = ?", consumerId).toArray()[0]?.last_seq ?? 0;
+	}
+	set(consumerId, lastSeq) {
+		this.sql.exec(`INSERT INTO cursors (consumer_id, last_seq, updated_at) VALUES (?, ?, ?)
+       ON CONFLICT(consumer_id) DO UPDATE SET
+         last_seq = excluded.last_seq, updated_at = excluded.updated_at`, consumerId, lastSeq, (/* @__PURE__ */ new Date()).toISOString());
+	}
+};
+var DoLinkStore = class {
+	sql;
+	constructor(sql) {
+		this.sql = sql;
+	}
+	forPin(pinId) {
+		return this.sql.exec("SELECT pin_id, connector, ref, url, last_synced_at FROM links WHERE pin_id = ? ORDER BY rowid ASC", pinId).toArray().map((row) => ({
+			connector: row.connector,
+			ref: row.ref,
+			url: row.url
+		}));
+	}
+	all() {
+		return this.sql.exec("SELECT pin_id, connector, ref, url, last_synced_at FROM links ORDER BY rowid ASC").toArray().map((row) => ({
+			pinId: row.pin_id,
+			link: {
+				connector: row.connector,
+				ref: row.ref,
+				url: row.url
+			},
+			lastSyncedAt: row.last_synced_at
+		}));
+	}
+	markSynced(pinId, link, at) {
+		this.sql.exec("UPDATE links SET last_synced_at = ? WHERE pin_id = ? AND connector = ? AND ref = ?", at, pinId, link.connector, link.ref);
+	}
+};
+const DELIVERY_COLUMNS = "id, event_seq, session_id, adapter, status, attempts, due_at, last_error, updated_at";
+function mapDelivery(row) {
+	return {
+		id: row.id,
+		eventSeq: row.event_seq,
+		sessionId: row.session_id,
+		adapter: row.adapter,
+		status: row.status,
+		attempts: row.attempts,
+		dueAt: row.due_at,
+		lastError: row.last_error,
+		updatedAt: row.updated_at
+	};
+}
+var DoDeliveryStore = class {
+	sql;
+	constructor(sql) {
+		this.sql = sql;
+	}
+	enqueue(row) {
+		return mapDelivery(this.sql.exec(`INSERT INTO deliveries (event_seq, session_id, adapter, status, attempts, due_at, updated_at)
+         VALUES (?, ?, ?, ?, 0, ?, ?) RETURNING ${DELIVERY_COLUMNS}`, row.eventSeq, row.sessionId, row.adapter, row.status ?? "pending", row.dueAt, (/* @__PURE__ */ new Date()).toISOString()).one());
+	}
+	due(now) {
+		return this.sql.exec(`SELECT ${DELIVERY_COLUMNS} FROM deliveries
+         WHERE status = 'pending' AND (due_at IS NULL OR due_at <= ?) ORDER BY id ASC`, now).toArray().map(mapDelivery);
+	}
+	pendingForSession(sessionId) {
+		return this.sql.exec(`SELECT ${DELIVERY_COLUMNS} FROM deliveries
+         WHERE status = 'pending' AND session_id = ? ORDER BY id ASC`, sessionId).toArray().map(mapDelivery);
+	}
+	unassigned() {
+		return this.sql.exec(`SELECT ${DELIVERY_COLUMNS} FROM deliveries
+         WHERE status = 'pending' AND session_id IS NULL ORDER BY id ASC`).toArray().map(mapDelivery);
+	}
+	assign(id, sessionId) {
+		this.sql.exec("UPDATE deliveries SET session_id = ?, updated_at = ? WHERE id = ?", sessionId, (/* @__PURE__ */ new Date()).toISOString(), id);
+	}
+	markDelivered(id) {
+		this.sql.exec("UPDATE deliveries SET status = 'delivered', updated_at = ? WHERE id = ?", (/* @__PURE__ */ new Date()).toISOString(), id);
+	}
+	markFailed(id, error, retryAt) {
+		this.sql.exec(`UPDATE deliveries SET attempts = attempts + 1, last_error = ?,
+         status = ?, due_at = ?, updated_at = ? WHERE id = ?`, error, retryAt === null ? "failed" : "pending", retryAt, (/* @__PURE__ */ new Date()).toISOString(), id);
+	}
+	lastEventSeq() {
+		return this.sql.exec("SELECT COALESCE(MAX(event_seq), 0) AS last FROM deliveries").one().last;
+	}
+};
+//#endregion
+//#region src/do-store.ts
+const VERSION_KEY = "pinbox:user_version";
+function versionCursor(sql, storage) {
+	try {
+		const read = () => Number(sql.exec("PRAGMA user_version").one().user_version);
+		const current = read();
+		sql.exec(`PRAGMA user_version = ${current}`);
+		if (read() !== current) throw new Error("PRAGMA user_version write did not persist");
+		return {
+			get: read,
+			set: (version) => void sql.exec(`PRAGMA user_version = ${version}`)
+		};
+	} catch {
+		return {
+			get: () => storage.kv.get(VERSION_KEY) ?? 0,
+			set: (version) => storage.kv.put(VERSION_KEY, version)
+		};
+	}
+}
+function migrate(sql, storage) {
+	const cursor = versionCursor(sql, storage);
+	for (const migration of MIGRATIONS) {
+		if (migration.version <= cursor.get()) continue;
+		storage.transactionSync(() => {
+			sql.exec(migration.ddl);
+			cursor.set(migration.version);
+		});
+	}
+}
+function parsePin(json) {
+	return PinSchema.parse(JSON.parse(json));
+}
+function openDoStore(sql, storage) {
+	migrate(sql, storage);
+	return new DoSqlitePinStore(sql, storage);
+}
+var DoSqlitePinStore = class {
+	sql;
+	storage;
+	sessions;
+	deliveries;
+	cursors;
+	links;
+	listeners = /* @__PURE__ */ new Set();
+	pendingEvents = [];
+	constructor(sql, storage) {
+		this.sql = sql;
+		this.storage = storage;
+		this.sessions = new DoSessionStore(sql, storage);
+		this.deliveries = new DoDeliveryStore(sql);
+		this.cursors = new DoCursorStore(sql);
+		this.links = new DoLinkStore(sql);
+	}
+	createPin(input, env) {
+		const parsed = PinInputSchema.parse(input);
+		const mergedEnv = { ...parsed.env };
+		if (env.branch !== void 0) mergedEnv.branch = env.branch;
+		if (env.commit !== void 0) mergedEnv.commit = env.commit;
+		const pin = PinSchema.parse({
+			...parsed,
+			env: mergedEnv,
+			id: newId("pin"),
+			schemaVersion: 1,
+			status: "open",
+			createdAt: (/* @__PURE__ */ new Date()).toISOString()
+		});
+		return this.mutate(() => {
+			this.sql.exec("INSERT INTO pins (id, status, created_at, json) VALUES (?, ?, ?, ?)", pin.id, pin.status, pin.createdAt, JSON.stringify(pin));
+			this.sql.exec("INSERT INTO pins_fts (pin_id, kind, body) VALUES (?, ?, ?)", pin.id, "pin", pin.text);
+			this.appendEvent("pin.created", pin.createdAt, pin);
+			return pin;
+		});
+	}
+	getPin(id) {
+		const row = this.sql.exec("SELECT json FROM pins WHERE id = ?", id).toArray()[0];
+		return row ? parsePin(row.json) : null;
+	}
+	listPins(filter) {
+		return (filter?.status ? this.sql.exec("SELECT json FROM pins WHERE status = ? ORDER BY created_at DESC, rowid DESC", filter.status) : this.sql.exec("SELECT json FROM pins ORDER BY created_at DESC, rowid DESC")).toArray().map((row) => parsePin(row.json));
+	}
+	addThreadMessage(pinId, role, text, opts) {
+		const message = ThreadMessageSchema.parse({
+			id: newId("msg"),
+			pinId,
+			role,
+			text,
+			...opts?.origin !== void 0 ? { origin: opts.origin } : {},
+			...opts?.attachments !== void 0 ? { attachments: opts.attachments } : {},
+			at: (/* @__PURE__ */ new Date()).toISOString()
+		});
+		return this.mutate(() => {
+			this.mustGetPin(pinId);
+			this.sql.exec("INSERT INTO thread_messages (id, pin_id, at, json) VALUES (?, ?, ?, ?)", message.id, message.pinId, message.at, JSON.stringify(message));
+			this.sql.exec("INSERT INTO pins_fts (pin_id, kind, body) VALUES (?, ?, ?)", pinId, "thread", message.text);
+			this.appendEvent("thread.message", message.at, message);
+			return message;
+		});
+	}
+	getThread(pinId) {
+		return this.sql.exec("SELECT json FROM thread_messages WHERE pin_id = ? ORDER BY rowid ASC", pinId).toArray().map((row) => ThreadMessageSchema.parse(JSON.parse(row.json)));
+	}
+	resolvePin(id, by, note, commit) {
+		return this.mutate(() => {
+			const pin = this.mustGetPin(id);
+			if (pin.status === "resolved") throw new ConflictError(`pin already resolved: ${id}`);
+			const at = (/* @__PURE__ */ new Date()).toISOString();
+			const resolved = PinSchema.parse({
+				...pin,
+				status: "resolved",
+				resolution: {
+					by,
+					at,
+					...note !== void 0 ? { note } : {},
+					...commit !== void 0 ? { commit } : {}
+				}
+			});
+			this.updatePinRow(resolved);
+			this.appendEvent("pin.resolved", at, resolved);
+			return resolved;
+		});
+	}
+	verifyPin(id, outcome) {
+		return this.mutate(() => {
+			const pin = this.mustGetPin(id);
+			if (pin.status !== "resolved") throw new ConflictError(`pin is not resolved, cannot verify: ${id}`);
+			const at = (/* @__PURE__ */ new Date()).toISOString();
+			const verified = PinSchema.parse({
+				...pin,
+				status: outcome === "reopened" ? "open" : "resolved",
+				verification: {
+					outcome,
+					at
+				}
+			});
+			this.updatePinRow(verified);
+			this.appendEvent("pin.verified", at, verified);
+			return verified;
+		});
+	}
+	searchPins(query) {
+		const match = query.split(/\s+/).filter(Boolean).map((token) => `"${token.replaceAll("\"", "\"\"")}"`).join(" ");
+		if (match === "") return [];
+		return this.sql.exec(`SELECT json FROM pins
+         WHERE id IN (SELECT pin_id FROM pins_fts WHERE pins_fts MATCH ?)
+         ORDER BY created_at DESC, rowid DESC`, match).toArray().map((row) => parsePin(row.json));
+	}
+	addLink(pinId, link) {
+		return this.mutate(() => {
+			const pin = this.mustGetPin(pinId);
+			if (this.sql.exec("SELECT ref FROM links WHERE pin_id = ? AND connector = ? AND ref = ?", pinId, link.connector, link.ref).toArray()[0]) throw new ConflictError(`link already exists: ${link.connector}:${link.ref} on ${pinId}`);
+			const at = (/* @__PURE__ */ new Date()).toISOString();
+			this.sql.exec("INSERT INTO links (pin_id, connector, ref, url, created_at, last_synced_at) VALUES (?, ?, ?, ?, ?, NULL)", pinId, link.connector, link.ref, link.url, at);
+			const updated = PinSchema.parse({
+				...pin,
+				links: [...pin.links ?? [], link]
+			});
+			this.updatePinRow(updated);
+			this.appendEvent("pin.linked", at, updated);
+			return updated;
+		});
+	}
+	bindSession(pinId, ref) {
+		return this.mutate(() => {
+			const pin = this.mustGetPin(pinId);
+			const bound = PinSchema.parse({
+				...pin,
+				agentSession: SessionRefSchema.parse(ref)
+			});
+			this.updatePinRow(bound);
+			return bound;
+		});
+	}
+	setDueAt(id, at) {
+		this.mutate(() => {
+			this.mustGetPin(id);
+			this.sql.exec("UPDATE pins SET due_at = ? WHERE id = ?", at, id);
+		});
+	}
+	pinsDueBefore(at) {
+		return this.sql.exec("SELECT json FROM pins WHERE due_at IS NOT NULL AND due_at <= ? ORDER BY due_at ASC", at).toArray().map((row) => parsePin(row.json));
+	}
+	eventsAfter(seq) {
+		return this.sql.exec("SELECT seq, type, at, payload FROM events WHERE seq > ? ORDER BY seq ASC", seq).toArray().map((row) => ({
+			seq: row.seq,
+			type: row.type,
+			at: row.at,
+			payload: JSON.parse(row.payload)
+		}));
+	}
+	summary() {
+		const row = this.sql.exec(`SELECT
+           (SELECT COUNT(*) FROM pins WHERE status = 'open') AS open,
+           (SELECT COUNT(*) FROM pins WHERE status = 'resolved') AS resolved,
+           (SELECT COALESCE(MAX(seq), 0) FROM events) AS lastEventSeq`).one();
+		return {
+			open: row.open,
+			resolved: row.resolved,
+			lastEventSeq: row.lastEventSeq
+		};
+	}
+	subscribe(listener) {
+		this.listeners.add(listener);
+		return () => void this.listeners.delete(listener);
+	}
+	close() {}
+	/** Runs fn in transactionSync, then flushes appended events post-commit in seq order. */
+	mutate(fn) {
+		let result;
+		try {
+			result = this.storage.transactionSync(fn);
+		} catch (error) {
+			this.pendingEvents.length = 0;
+			throw error;
+		}
+		const events = this.pendingEvents.splice(0);
+		for (const event of events) for (const listener of this.listeners) try {
+			listener(event);
+		} catch {}
+		return result;
+	}
+	appendEvent(type, at, payload) {
+		const row = this.sql.exec("INSERT INTO events (type, at, payload) VALUES (?, ?, ?) RETURNING seq", type, at, JSON.stringify(payload)).one();
+		this.pendingEvents.push({
+			seq: row.seq,
+			type,
+			at,
+			payload
+		});
+	}
+	updatePinRow(pin) {
+		this.sql.exec("UPDATE pins SET status = ?, json = ? WHERE id = ?", pin.status, JSON.stringify(pin), pin.id);
+	}
+	mustGetPin(id) {
+		const pin = this.getPin(id);
+		if (!pin) throw new NotFoundError(`pin not found: ${id}`);
+		return pin;
+	}
+};
+//#endregion
+//#region src/r2.ts
+const REGION = "auto";
+const SERVICE = "s3";
+const MAX_EXPIRES = 604800;
+async function presignR2Put(opts) {
+	const amzDate = toAmzDate(opts.now ?? /* @__PURE__ */ new Date());
+	const dateStamp = amzDate.slice(0, 8);
+	const expires = Math.min(Math.max(Math.trunc(opts.expiresSeconds ?? 900), 1), MAX_EXPIRES);
+	const host = `${opts.accountId}.r2.cloudflarestorage.com`;
+	const credential = `${opts.accessKeyId}/${dateStamp}/${REGION}/${SERVICE}/aws4_request`;
+	const canonicalPath = `/${uriEncodePath(opts.bucket)}/${uriEncodePath(opts.key)}`;
+	const headers = [["host", host]];
+	if (opts.contentLength !== void 0) headers.push(["content-length", String(Math.trunc(opts.contentLength))]);
+	headers.sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0);
+	const canonicalHeaders = headers.map(([name, value]) => `${name}:${value}\n`).join("");
+	const signedHeaders = headers.map(([name]) => name).join(";");
+	const canonicalQuery = [
+		["X-Amz-Algorithm", "AWS4-HMAC-SHA256"],
+		["X-Amz-Credential", credential],
+		["X-Amz-Date", amzDate],
+		["X-Amz-Expires", String(expires)],
+		["X-Amz-SignedHeaders", signedHeaders],
+		["response-content-type", opts.contentType]
+	].map(([name, value]) => [uriEncode(name), uriEncode(value)]).sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0).map(([name, value]) => `${name}=${value}`).join("&");
+	const canonicalRequest = [
+		"PUT",
+		canonicalPath,
+		canonicalQuery,
+		canonicalHeaders,
+		signedHeaders,
+		"UNSIGNED-PAYLOAD"
+	].join("\n");
+	const stringToSign = [
+		"AWS4-HMAC-SHA256",
+		amzDate,
+		`${dateStamp}/${REGION}/${SERVICE}/aws4_request`,
+		await sha256Hex(canonicalRequest)
+	].join("\n");
+	return `https://${host}${canonicalPath}?${canonicalQuery}&X-Amz-Signature=${toHex(await hmac(await deriveSigningKey(opts.secretAccessKey, dateStamp), stringToSign))}`;
+}
+function toAmzDate(date) {
+	return `${date.toISOString().slice(0, 19).replaceAll("-", "").replaceAll(":", "")}Z`;
+}
+function uriEncode(value) {
+	return encodeURIComponent(value).replace(/[!'()*]/g, (c) => `%${c.charCodeAt(0).toString(16).toUpperCase()}`);
+}
+function uriEncodePath(path) {
+	return path.split("/").map(uriEncode).join("/");
+}
+async function sha256Hex(data) {
+	return toHex(await crypto.subtle.digest("SHA-256", new TextEncoder().encode(data)));
+}
+async function hmac(key, data) {
+	const cryptoKey = await crypto.subtle.importKey("raw", key, {
+		name: "HMAC",
+		hash: "SHA-256"
+	}, false, ["sign"]);
+	return crypto.subtle.sign("HMAC", cryptoKey, new TextEncoder().encode(data));
+}
+async function deriveSigningKey(secret, dateStamp) {
+	return hmac(await hmac(await hmac(await hmac(new TextEncoder().encode(`AWS4${secret}`), dateStamp), REGION), SERVICE), "aws4_request");
+}
+function toHex(buffer) {
+	return [...new Uint8Array(buffer)].map((b) => b.toString(16).padStart(2, "0")).join("");
+}
+//#endregion
+//#region src/do.ts
+const MAX_ATTACHMENT_BYTES = 5242880;
+function overCap() {
+	return err(413, "E_ATTACHMENT", "attachment exceeds the 5 MB cap", { hint: "downscale the capture; attachments carry a path or URL, never inline bytes" });
+}
+function attachmentInputError(req, url) {
+	const declared = req.headers.get("content-length");
+	if (declared !== null) {
+		const declaredBytes = Number(declared);
+		if (!Number.isFinite(declaredBytes) || declaredBytes > MAX_ATTACHMENT_BYTES) return overCap();
+	}
+	const kind = url.searchParams.get("kind") ?? "file";
+	if (kind !== "screenshot" && kind !== "file") return err(400, "E_INVALID_INPUT", `unknown attachment kind: ${kind}`, { hint: "use ?kind=screenshot or ?kind=file" });
+	return null;
+}
+async function measureBody(req, cap) {
+	const body = req.body;
+	if (body === null) return 0;
+	const reader = body.getReader();
+	let total = 0;
+	try {
+		for (;;) {
+			const { done, value } = await reader.read();
+			if (done) return total;
+			total += value.byteLength;
+			if (total > cap) {
+				await reader.cancel("attachment exceeds the 5 MB cap");
+				return null;
+			}
+		}
+	} finally {
+		reader.releaseLock();
+	}
+}
+function r2Credentials(env) {
+	const { R2_ACCOUNT_ID, R2_BUCKET, R2_ACCESS_KEY_ID, R2_SECRET_ACCESS_KEY } = env;
+	if (!R2_ACCOUNT_ID || !R2_BUCKET || !R2_ACCESS_KEY_ID || !R2_SECRET_ACCESS_KEY) return null;
+	return {
+		accountId: R2_ACCOUNT_ID,
+		bucket: R2_BUCKET,
+		accessKeyId: R2_ACCESS_KEY_ID,
+		secretAccessKey: R2_SECRET_ACCESS_KEY
+	};
+}
+function buildStrategy(env) {
+	const strategy = env.AUTH_STRATEGY ?? "token";
+	if (strategy === "none") {
+		if (env.ALLOW_UNAUTHENTICATED !== "1") return {
+			error: "AUTH_STRATEGY \"none\" refused",
+			hint: "set ALLOW_UNAUTHENTICATED=1 to explicitly run an unauthenticated hub (loopback/dev only)"
+		};
+		return { verify: verifyNone() };
+	}
+	if (strategy === "jwt") {
+		const { JWT_ISSUER, JWT_JWKS_URL, JWT_AUDIENCE } = env;
+		if (!JWT_ISSUER || !JWT_JWKS_URL || !JWT_AUDIENCE) return {
+			error: "AUTH_STRATEGY \"jwt\" is missing configuration",
+			hint: "set JWT_ISSUER, JWT_JWKS_URL, and JWT_AUDIENCE"
+		};
+		return { verify: verifyJwt({
+			issuer: JWT_ISSUER,
+			jwksUrl: JWT_JWKS_URL,
+			audience: JWT_AUDIENCE
+		}) };
+	}
+	if (!env.PINBOX_TOKEN) return {
+		error: "AUTH_STRATEGY \"token\" has no PINBOX_TOKEN",
+		hint: "set the PINBOX_TOKEN secret (wrangler secret put PINBOX_TOKEN)"
+	};
+	return { verify: verifyToken(env.PINBOX_TOKEN) };
+}
+function refuse(req, url, strategy) {
+	if (req.method === "GET" && url.pathname === "/health") return err(503, "E_INTERNAL", `hub is unhealthy: ${strategy.error}`, { hint: strategy.hint });
+	return err(500, "E_INTERNAL", strategy.error, { hint: strategy.hint });
+}
+var DoBroadcaster = class {
+	state;
+	constructor(state) {
+		this.state = state;
+	}
+	publish(topic, data) {
+		for (const ws of this.state.getWebSockets(topic)) try {
+			ws.send(data);
+		} catch {}
+	}
+	subscriberCount(topic) {
+		return this.state.getWebSockets(topic).length;
+	}
+};
+var PinboxHubDO = class {
+	store;
+	broadcaster;
+	topic;
+	ctx;
+	env;
+	strategy;
+	handler;
+	constructor(ctx, env) {
+		this.ctx = ctx;
+		this.env = env;
+		this.store = openDoStore(ctx.storage.sql, ctx.storage);
+		this.topic = `project:${ctx.id.name ?? ctx.id.toString()}`;
+		this.broadcaster = new DoBroadcaster(ctx);
+		this.strategy = buildStrategy(env);
+		this.handler = createHubHandler({
+			store: this.store,
+			token: env.PINBOX_TOKEN ?? "",
+			..."verify" in this.strategy ? { verify: this.strategy.verify } : {}
+		});
+		this.store.subscribe((event) => this.broadcaster.publish(this.topic, encodeWsEvent(event)));
+		ctx.setWebSocketAutoResponse(new WebSocketRequestResponsePair("ping", "pong"));
+	}
+	async fetch(req) {
+		const url = new URL(req.url);
+		if ("error" in this.strategy) return refuse(req, url, this.strategy);
+		const verify = this.strategy.verify;
+		if (url.pathname === "/ws") return this.upgrade(req, url, verify);
+		return await this.intercept(req, url, verify) ?? this.handler(req);
+	}
+	async intercept(req, url, verify) {
+		if (req.method === "POST" && url.pathname === "/attachments") return await this.unauthorized(verify, req) ?? this.createAttachment(req, url);
+		const mediaKey = /^\/media\/([^/]+)$/.exec(url.pathname)?.[1];
+		if (req.method === "GET" && mediaKey !== void 0) return await this.unauthorized(verify, req) ?? this.serveMedia(mediaKey);
+		return null;
+	}
+	webSocketMessage(ws, message) {
+		if (typeof message !== "string") {
+			this.protocolError(ws, "binary frames are not part of protocol 1");
+			return;
+		}
+		if (ws.deserializeAttachment() !== null) {
+			this.protocolError(ws, "protocol 1 has exactly one client message: hello");
+			return;
+		}
+		let raw;
+		try {
+			raw = JSON.parse(message);
+		} catch {
+			this.protocolError(ws, "hello frame is not valid JSON");
+			return;
+		}
+		const hello = ClientHelloSchema.safeParse(raw);
+		if (!hello.success) {
+			this.protocolError(ws, "malformed hello frame");
+			return;
+		}
+		if (hello.data.protocol < 1) {
+			this.protocolError(ws, `protocol ${hello.data.protocol} is below the minimum 1 — upgrade the client`);
+			return;
+		}
+		ws.serializeAttachment({ consumerId: hello.data.consumerId });
+		this.store.cursors.set(hello.data.consumerId, hello.data.lastSeq);
+		ws.send(JSON.stringify({
+			type: "catch-up",
+			protocol: 1,
+			minProtocol: 1,
+			lastSeq: this.store.summary().lastEventSeq,
+			events: this.store.eventsAfter(hello.data.lastSeq).map((event) => ({
+				type: "event",
+				seq: event.seq,
+				eventType: event.type,
+				at: event.at,
+				payload: event.payload
+			}))
+		}));
+	}
+	webSocketClose(_ws, _code, _reason, _wasClean) {}
+	async alarm() {}
+	async upgrade(req, url, verify) {
+		let token = url.searchParams.get("token");
+		let acceptedProtocol;
+		for (const entry of (req.headers.get("sec-websocket-protocol") ?? "").split(",")) {
+			const candidate = entry.trim();
+			if (candidate.startsWith("pinbox.token.")) {
+				token = candidate.slice(WS_TOKEN_SUBPROTOCOL_PREFIX.length);
+				acceptedProtocol = candidate;
+			}
+		}
+		const identity = await verify(new Request(url.origin, token === null ? {} : { headers: { authorization: `Bearer ${token}` } }));
+		const pair = new WebSocketPair();
+		const client = pair[0];
+		const server = pair[1];
+		if (identity === null) {
+			server.accept();
+			server.close(WS_CLOSE_UNAUTHORIZED, "missing or invalid token");
+		} else this.ctx.acceptWebSocket(server, [this.topic]);
+		return new Response(null, {
+			status: 101,
+			headers: acceptedProtocol === void 0 ? {} : { "sec-websocket-protocol": acceptedProtocol },
+			webSocket: client
+		});
+	}
+	protocolError(ws, message) {
+		ws.send(JSON.stringify({
+			type: "error",
+			code: "E_WS_PROTOCOL",
+			message
+		}));
+		ws.close(WS_CLOSE_PROTOCOL, message.slice(0, 123));
+	}
+	async unauthorized(verify, req) {
+		if (await verify(req) !== null) return null;
+		return err(401, "E_AUTH", "request rejected by the configured verifier", { hint: "send a credential the hub's verify strategy accepts" });
+	}
+	async createAttachment(req, url) {
+		const rejected = attachmentInputError(req, url);
+		if (rejected !== null) return rejected;
+		const creds = r2Credentials(this.env);
+		if (creds === null) return err(500, "E_INTERNAL", "R2 S3 credentials are not configured", { hint: "set R2_ACCESS_KEY_ID/R2_SECRET_ACCESS_KEY — the R2 binding cannot presign" });
+		const contentLength = await measureBody(req, MAX_ATTACHMENT_BYTES);
+		if (contentLength === null) return overCap();
+		const id = newId("att");
+		const kind = url.searchParams.get("kind") ?? "file";
+		const contentType = req.headers.get("content-type") ?? "application/octet-stream";
+		const uploadUrl = await presignR2Put({
+			...creds,
+			key: id,
+			contentType,
+			contentLength
+		});
+		const attachment = AttachmentSchema.parse({
+			id,
+			kind,
+			url: `/media/${id}`,
+			contentType
+		});
+		return ok(201, {
+			attachment,
+			uploadUrl
+		});
+	}
+	async serveMedia(key) {
+		const media = this.env.MEDIA;
+		if (!media) return err(500, "E_INTERNAL", "no MEDIA bucket binding", { hint: "bind an R2 bucket named MEDIA in wrangler.jsonc" });
+		const object = await media.get(key);
+		if (object === null) return err(404, "E_NOT_FOUND", `media not found: ${key}`);
+		return new Response(object.body, {
+			status: 200,
+			headers: { "content-type": object.httpMetadata?.contentType ?? "application/octet-stream" }
+		});
+	}
+};
+//#endregion
+export { DoBroadcaster, PinboxHubDO };