@hashsome/runtime 0.1.0

package/dist/src/release/render.js

@@ -0,0 +1,335 @@
+/** The files of a release, as text. Pure: `package.ts` writes them out. */
+export const TARGETS = ['plain', 'compose', 'helm', 'image'];
+export const imageRef = ({ name, tag }) => `${name}:${tag}`;
+/** A project name made safe for an image, a service and a chart. */
+export function safeName(raw) {
+    const name = raw
+        .replace(/^@[^/]+\//, '')
+        .toLowerCase()
+        .replace(/[^a-z0-9-]+/g, '-')
+        .replace(/^-+|-+$/g, '');
+    return name || 'hashsome';
+}
+export function dockerfile({ port }) {
+    return `# The release's server and client: nothing is installed or compiled here.
+FROM node:24-slim
+ENV NODE_ENV=production PORT=${port}
+WORKDIR /app
+COPY server.mjs ./
+COPY client ./client
+USER node
+EXPOSE ${port}
+HEALTHCHECK --interval=30s --timeout=3s --start-period=10s CMD node -e "fetch('http://127.0.0.1:'+process.env.PORT+'/healthz').then((r)=>process.exit(r.ok?0:1),()=>process.exit(1))"
+CMD ["node", "server.mjs"]
+`;
+}
+export function plainReadme(info) {
+    return `# ${info.name}: plain
+
+The whole app as files: \`server.mjs\` (the server, with your config and integrations inside it) and
+\`client/\` (your dashboards). Run it anywhere Node 24 or newer is installed, no \`npm install\`:
+
+\`\`\`sh
+HA_URL=... HA_TOKEN=... node server.mjs
+\`\`\`
+
+It listens on \`PORT\` (default ${info.port}) and \`HOST\` (default 0.0.0.0). Everything the config
+reads from the environment (tokens and addresses) is set when it runs; none is in these files.
+\`/healthz\` answers while it is up.
+
+The static \`client/\` alone is not enough: the server keeps the tokens, talks to your backends and
+serves their artwork, and the browser only ever talks to it.
+
+If your backend uses a private certificate authority, give Node its certificate:
+\`NODE_EXTRA_CA_CERTS=/path/to/ca.crt node server.mjs\`.
+
+\`Dockerfile\` is the one \`compose\` and \`helm\` use: \`docker build -t ${info.name} .\` here builds the
+image yourself.
+`;
+}
+export function composeFile(info) {
+    return `# docker compose up -d   (after: docker load -i ../image.tar, and a .env next to this file)
+services:
+  ${info.name}:
+    image: ${imageRef(info)}
+    restart: unless-stopped
+    ports:
+      - "${info.port}:${info.port}"
+    # Your tokens and addresses, read at runtime. Never baked into the image.
+    env_file: .env
+    # A private certificate authority for your backend:
+    # environment:
+    #   NODE_EXTRA_CA_CERTS: /certs/ca.crt
+    # volumes:
+    #   - ./ca.crt:/certs/ca.crt:ro
+`;
+}
+export function composeReadme(info) {
+    return `# ${info.name}: Docker Compose
+
+1. Load the image: \`docker load -i ../image.tar\`${info.image ? '' : ' (this release has no image: build one from a `plain` release, `docker build plain`)'}
+2. Create \`.env\` here with your tokens and addresses (see \`.env.example\`)
+3. \`docker compose up -d\`
+
+Update by loading the next release's image and changing the tag in \`compose.yaml\`.
+`;
+}
+export function envExample(info) {
+    return (info.envExample ??
+        '# The variables your hashsome.config.ts reads, for example:\n# HA_URL=\n# HA_TOKEN=\n');
+}
+// ── Helm ─────────────────────────────────────────────────────────────────────────────────────────
+export function chartYaml(info) {
+    return `apiVersion: v2
+name: ${info.name}
+description: ${info.name}, a Hashsome dashboard server
+type: application
+version: 0.1.0
+appVersion: "${info.tag}"
+`;
+}
+export function chartValues(info) {
+    return `# The image is loaded onto the node from image.tar (see import-image.sh), not pulled, hence Never.
+image:
+  repository: ${info.name}
+  tag: "${info.tag}"
+  pullPolicy: Never
+
+port: ${info.port}
+
+# Your tokens and addresses, in a Secret you create (see NOTES). The chart never holds their values.
+existingSecret: ""
+
+# Extra environment variables that are not secret.
+env: {}
+
+# A private certificate authority for your backend: a ConfigMap holding the certificate.
+caCert:
+  configMap: ""
+  key: ca.crt
+
+service:
+  type: ClusterIP
+  port: 80
+
+ingress:
+  enabled: false
+  className: traefik
+  host: ""
+  # A TLS secret for the host; leave empty for plain http.
+  tlsSecret: ""
+  annotations: {}
+
+resources: {}
+nodeSelector: {}
+`;
+}
+export function chartHelpers() {
+    return `{{- define "app.name" -}}{{ .Release.Name }}{{- end -}}
+{{- define "app.labels" -}}
+app.kubernetes.io/name: {{ .Chart.Name }}
+app.kubernetes.io/instance: {{ .Release.Name }}
+{{- end -}}
+{{- define "app.selector" -}}
+app.kubernetes.io/name: {{ .Chart.Name }}
+app.kubernetes.io/instance: {{ .Release.Name }}
+{{- end -}}
+`;
+}
+export function chartDeployment() {
+    return `apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: {{ include "app.name" . }}
+  labels:
+    {{- include "app.labels" . | nindent 4 }}
+spec:
+  # One replica, and the old pod goes before the new one starts: the server holds live
+  # connections to your backends, and two at once would just double them.
+  replicas: 1
+  strategy:
+    type: Recreate
+  selector:
+    matchLabels:
+      {{- include "app.selector" . | nindent 6 }}
+  template:
+    metadata:
+      labels:
+        {{- include "app.selector" . | nindent 8 }}
+    spec:
+      containers:
+        - name: app
+          image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}"
+          imagePullPolicy: {{ .Values.image.pullPolicy }}
+          ports:
+            - name: http
+              containerPort: {{ .Values.port }}
+          envFrom:
+            - secretRef:
+                name: {{ required "set existingSecret to the Secret holding your tokens" .Values.existingSecret }}
+          env:
+            - name: PORT
+              value: {{ .Values.port | quote }}
+            {{- if .Values.caCert.configMap }}
+            - name: NODE_EXTRA_CA_CERTS
+              value: /certs/{{ .Values.caCert.key }}
+            {{- end }}
+            {{- range $name, $value := .Values.env }}
+            - name: {{ $name }}
+              value: {{ $value | quote }}
+            {{- end }}
+          readinessProbe:
+            httpGet:
+              path: /healthz
+              port: http
+          livenessProbe:
+            httpGet:
+              path: /healthz
+              port: http
+            initialDelaySeconds: 10
+          {{- with .Values.resources }}
+          resources:
+            {{- toYaml . | nindent 12 }}
+          {{- end }}
+          {{- if .Values.caCert.configMap }}
+          volumeMounts:
+            - name: ca
+              mountPath: /certs
+              readOnly: true
+          {{- end }}
+      {{- if .Values.caCert.configMap }}
+      volumes:
+        - name: ca
+          configMap:
+            name: {{ .Values.caCert.configMap }}
+      {{- end }}
+      {{- with .Values.nodeSelector }}
+      nodeSelector:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+`;
+}
+export function chartService() {
+    return `apiVersion: v1
+kind: Service
+metadata:
+  name: {{ include "app.name" . }}
+  labels:
+    {{- include "app.labels" . | nindent 4 }}
+spec:
+  type: {{ .Values.service.type }}
+  selector:
+    {{- include "app.selector" . | nindent 4 }}
+  ports:
+    - name: http
+      port: {{ .Values.service.port }}
+      targetPort: http
+`;
+}
+export function chartIngress() {
+    return `{{- if .Values.ingress.enabled }}
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: {{ include "app.name" . }}
+  labels:
+    {{- include "app.labels" . | nindent 4 }}
+  {{- with .Values.ingress.annotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+spec:
+  {{- if .Values.ingress.className }}
+  ingressClassName: {{ .Values.ingress.className }}
+  {{- end }}
+  {{- if .Values.ingress.tlsSecret }}
+  tls:
+    - hosts:
+        - {{ required "set ingress.host" .Values.ingress.host }}
+      secretName: {{ .Values.ingress.tlsSecret }}
+  {{- end }}
+  rules:
+    - host: {{ required "set ingress.host" .Values.ingress.host }}
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: {{ include "app.name" . }}
+                port:
+                  name: http
+{{- end }}
+`;
+}
+export function chartNotes() {
+    return `{{ .Release.Name }} is deployed.
+
+Your tokens and addresses come from the Secret "{{ .Values.existingSecret }}". Create it once, with the
+variables your hashsome.config.ts reads (it is not part of this chart, so it is not in git):
+
+  kubectl create secret generic {{ .Values.existingSecret }} -n {{ .Release.Namespace }} \\
+    --from-literal=HA_URL=https://... --from-literal=HA_TOKEN=...
+
+To change a token later, update the Secret and run: kubectl rollout restart deploy/{{ include "app.name" . }} -n {{ .Release.Namespace }}
+{{- if .Values.ingress.enabled }}
+
+It is served at http{{ if .Values.ingress.tlsSecret }}s{{ end }}://{{ .Values.ingress.host }}/
+{{- end }}
+`;
+}
+export function importScript(info) {
+    return `#!/bin/sh
+# Loads the release's image into k3s's containerd on this machine. Run it on the server, from here.
+set -eu
+cd "$(dirname "$0")"
+sudo k3s ctr -n k8s.io images import ../image.tar
+echo "Imported ${imageRef(info)}"
+`;
+}
+export function helmReadme(info) {
+    return `# ${info.name}: Helm (k3s)
+
+This folder is a Helm chart. Put it in your cluster's folder and add it to your helmfile.
+
+1. On the server, load the image into k3s: \`./import-image.sh\`
+   (it imports \`../image.tar\`, so keep the release folder together, or edit the path)
+2. Create the Secret with your tokens, once (see \`templates/NOTES.txt\`):
+   \`kubectl create secret generic ${info.name}-secrets --from-literal=HA_URL=... --from-literal=HA_TOKEN=...\`
+3. Add a release to your helmfile:
+
+\`\`\`yaml
+releases:
+  - name: ${info.name}
+    chart: ./${info.name}      # this folder
+    values:
+      - existingSecret: ${info.name}-secrets
+        ingress:
+          enabled: true
+          host: ${info.name}.lan
+\`\`\`
+
+4. \`helmfile apply\`
+
+The image tag is \`${info.tag}\` (in \`values.yaml\`). A new release has a new tag, so k3s always picks
+up the update. Built for \`${info.platform}\`; \`pullPolicy\` is \`Never\` because the image is imported,
+not pulled.
+`;
+}
+export function releaseReadme(info, targets) {
+    const lines = {
+        plain: '- `plain/`: the server bundle and the client. Runs with just Node, or builds into an image.',
+        compose: '- `compose/`: Docker Compose, for a machine running Docker.',
+        helm: '- `helm/`: a Helm chart for k3s/Kubernetes (loads the image, no registry).',
+        image: '- `image.tar`: just the container image, for your own manifests.',
+    };
+    return `# ${info.name} ${info.tag}
+
+Built for \`${info.platform}\`. Deploy it as:
+
+${targets.map((t) => lines[t]).join('\n')}
+${info.image && !targets.includes('image') ? `- \`image.tar\`: the container image (\`${imageRef(info)}\`), for compose and helm.\n` : ''}
+Your tokens and addresses are not in any of these files. They are set where it runs: an \`.env\`
+file for compose, a Kubernetes Secret for helm, the environment for plain.
+`;
+}

package/dist/src/release/render.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"render.js","sourceRoot":"","sources":["../../../src/release/render.ts"],"names":[],"mappings":"AAAA,2EAA2E;AAG3E,MAAM,CAAC,MAAM,OAAO,GAAsB,CAAC,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;AAgBhF,MAAM,CAAC,MAAM,QAAQ,GAAG,CAAC,EAAE,IAAI,EAAE,GAAG,EAAqC,EAAE,EAAE,CAAC,GAAG,IAAI,IAAI,GAAG,EAAE,CAAC;AAE/F,oEAAoE;AACpE,MAAM,UAAU,QAAQ,CAAC,GAAW;IAClC,MAAM,IAAI,GAAG,GAAG;SACb,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC;SACxB,WAAW,EAAE;SACb,OAAO,CAAC,cAAc,EAAE,GAAG,CAAC;SAC5B,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;IAE3B,OAAO,IAAI,IAAI,UAAU,CAAC;AAC5B,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,EAAE,IAAI,EAA6B;IAC5D,OAAO;;+BAEsB,IAAI;;;;;SAK1B,IAAI;;;CAGZ,CAAC;AACF,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,IAAiB;IAC3C,OAAO,KAAK,IAAI,CAAC,IAAI;;;;;;;;;kCASW,IAAI,CAAC,IAAI;;;;;;;;;;4EAUiC,IAAI,CAAC,IAAI;;CAEpF,CAAC;AACF,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,IAAiB;IAC3C,OAAO;;IAEL,IAAI,CAAC,IAAI;aACA,QAAQ,CAAC,IAAI,CAAC;;;WAGhB,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI;;;;;;;;CAQhC,CAAC;AACF,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,IAAiB;IAC7C,OAAO,KAAK,IAAI,CAAC,IAAI;;oDAE6B,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,sFAAsF;;;;;CAK3J,CAAC;AACF,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,IAAiB;IAC1C,OAAO,CACL,IAAI,CAAC,UAAU;QACf,uFAAuF,CACxF,CAAC;AACJ,CAAC;AAED,oGAAoG;AAEpG,MAAM,UAAU,SAAS,CAAC,IAAiB;IACzC,OAAO;QACD,IAAI,CAAC,IAAI;eACF,IAAI,CAAC,IAAI;;;eAGT,IAAI,CAAC,GAAG;CACtB,CAAC;AACF,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,IAAiB;IAC3C,OAAO;;gBAEO,IAAI,CAAC,IAAI;UACf,IAAI,CAAC,GAAG;;;QAGV,IAAI,CAAC,IAAI;;;;;;;;;;;;;;;;;;;;;;;;;;;CA2BhB,CAAC;AACF,CAAC;AAED,MAAM,UAAU,YAAY;IAC1B,OAAO;;;;;;;;;CASR,CAAC;AACF,CAAC;AAED,MAAM,UAAU,eAAe;IAC7B,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAsER,CAAC;AACF,CAAC;AAED,MAAM,UAAU,YAAY;IAC1B,OAAO;;;;;;;;;;;;;;CAcR,CAAC;AACF,CAAC;AAED,MAAM,UAAU,YAAY;IAC1B,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAiCR,CAAC;AACF,CAAC;AAED,MAAM,UAAU,UAAU;IACxB,OAAO;;;;;;;;;;;;;CAaR,CAAC;AACF,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,IAAiB;IAC5C,OAAO;;;;;iBAKQ,QAAQ,CAAC,IAAI,CAAC;CAC9B,CAAC;AACF,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,IAAiB;IAC1C,OAAO,KAAK,IAAI,CAAC,IAAI;;;;;;;qCAOc,IAAI,CAAC,IAAI;;;;;YAKlC,IAAI,CAAC,IAAI;eACN,IAAI,CAAC,IAAI;;0BAEE,IAAI,CAAC,IAAI;;;kBAGjB,IAAI,CAAC,IAAI;;;;;qBAKN,IAAI,CAAC,GAAG;6BACA,IAAI,CAAC,QAAQ;;CAEzC,CAAC;AACF,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,IAAiB,EAAE,OAA0B;IACzE,MAAM,KAAK,GAA2B;QACpC,KAAK,EACH,6FAA6F;QAC/F,OAAO,EAAE,6DAA6D;QACtE,IAAI,EAAE,4EAA4E;QAClF,KAAK,EAAE,kEAAkE;KAC1E,CAAC;IAEF,OAAO,KAAK,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,GAAG;;cAErB,IAAI,CAAC,QAAQ;;EAEzB,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;EACvC,IAAI,CAAC,KAAK,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,2CAA2C,QAAQ,CAAC,IAAI,CAAC,8BAA8B,CAAC,CAAC,CAAC,EAAE;;;CAGxI,CAAC;AACF,CAAC"}

package/dist/src/serve.d.ts

@@ -0,0 +1,8 @@
+import { type HashsomeConfig } from './config.ts';
+/**
+ * The entry of a packaged release: runs the server for an already-imported config, serving the
+ * client that sits next to the bundle (`./client`). `hashsome package` bundles this together with
+ * the project's `hashsome.config.ts` and its integrations into one file, so nothing else is installed
+ * where it runs.
+ */
+export declare function serve(user: HashsomeConfig, bundleUrl: string): void;

package/dist/src/serve.js

@@ -0,0 +1,14 @@
+import { dirname } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { resolveConfig } from './config.js';
+import { startServer } from './server/production.js';
+/**
+ * The entry of a packaged release: runs the server for an already-imported config, serving the
+ * client that sits next to the bundle (`./client`). `hashsome package` bundles this together with
+ * the project's `hashsome.config.ts` and its integrations into one file, so nothing else is installed
+ * where it runs.
+ */
+export function serve(user, bundleUrl) {
+    const here = dirname(fileURLToPath(bundleUrl));
+    startServer(resolveConfig(here, user), `${here}/client`);
+}

package/dist/src/serve.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"serve.js","sourceRoot":"","sources":["../../src/serve.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,aAAa,EAAuB,MAAM,aAAa,CAAC;AACjE,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAErD;;;;;GAKG;AACH,MAAM,UAAU,KAAK,CAAC,IAAoB,EAAE,SAAiB;IAC3D,MAAM,IAAI,GAAG,OAAO,CAAC,aAAa,CAAC,SAAS,CAAC,CAAC,CAAC;IAC/C,WAAW,CAAC,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,GAAG,IAAI,SAAS,CAAC,CAAC;AAC3D,CAAC"}

package/dist/src/server/assets.d.ts

@@ -0,0 +1,10 @@
+import type { IncomingMessage, ServerResponse } from 'node:http';
+import { type Integration } from '@hashsome/core';
+/**
+ * Serves `GET /_hashsome/asset/<integration>?path=<backend path>`: a file one of an integration's
+ * entities points at (artwork, a person's picture), fetched by the server with the integration's
+ * credentials so the browser never needs to reach, trust or log in to the backend. Only image
+ * responses are passed on. Returns `false` for a request that is not an asset request, so the
+ * caller can carry on.
+ */
+export declare function serveAsset(integrations: Integration[], request: Pick<IncomingMessage, 'method' | 'url'>, response: ServerResponse): Promise<boolean>;

package/dist/src/server/assets.js

@@ -0,0 +1,46 @@
+import { ASSET_PATH } from '@hashsome/core';
+/** How long a browser may reuse a file; artwork URLs change when the picture does. */
+const CACHE_CONTROL = 'private, max-age=3600';
+/**
+ * Serves `GET /_hashsome/asset/<integration>?path=<backend path>`: a file one of an integration's
+ * entities points at (artwork, a person's picture), fetched by the server with the integration's
+ * credentials so the browser never needs to reach, trust or log in to the backend. Only image
+ * responses are passed on. Returns `false` for a request that is not an asset request, so the
+ * caller can carry on.
+ */
+export async function serveAsset(integrations, request, response) {
+    const url = new URL(request.url ?? '/', 'http://localhost');
+    if (!url.pathname.startsWith(`${ASSET_PATH}/`)) {
+        return false;
+    }
+    const fail = (status, message) => {
+        response.statusCode = status;
+        response.setHeader('content-type', 'text/plain');
+        response.end(message);
+        return true;
+    };
+    if (request.method !== 'GET') {
+        return fail(405, 'Method not allowed');
+    }
+    const id = decodeURIComponent(url.pathname.slice(ASSET_PATH.length + 1));
+    const path = url.searchParams.get('path');
+    const integration = integrations.find((candidate) => candidate.id === id);
+    if (!integration?.fetchAsset || !path) {
+        return fail(404, 'No such asset');
+    }
+    try {
+        const upstream = await integration.fetchAsset(path);
+        const type = upstream.headers.get('content-type') ?? '';
+        if (!upstream.ok || !type.startsWith('image/')) {
+            return fail(upstream.ok ? 415 : 404, 'No such asset');
+        }
+        response.statusCode = 200;
+        response.setHeader('content-type', type);
+        response.setHeader('cache-control', CACHE_CONTROL);
+        response.end(Buffer.from(await upstream.arrayBuffer()));
+        return true;
+    }
+    catch {
+        return fail(404, 'No such asset');
+    }
+}

package/dist/src/server/assets.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"assets.js","sourceRoot":"","sources":["../../../src/server/assets.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,UAAU,EAAoB,MAAM,gBAAgB,CAAC;AAE9D,sFAAsF;AACtF,MAAM,aAAa,GAAG,uBAAuB,CAAC;AAE9C;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,YAA2B,EAC3B,OAAgD,EAChD,QAAwB;IAExB,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,IAAI,GAAG,EAAE,kBAAkB,CAAC,CAAC;IAC5D,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC,GAAG,UAAU,GAAG,CAAC,EAAE,CAAC;QAC/C,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,IAAI,GAAG,CAAC,MAAc,EAAE,OAAe,EAAE,EAAE;QAC/C,QAAQ,CAAC,UAAU,GAAG,MAAM,CAAC;QAC7B,QAAQ,CAAC,SAAS,CAAC,cAAc,EAAE,YAAY,CAAC,CAAC;QACjD,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACtB,OAAO,IAAI,CAAC;IACd,CAAC,CAAC;IAEF,IAAI,OAAO,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;QAC7B,OAAO,IAAI,CAAC,GAAG,EAAE,oBAAoB,CAAC,CAAC;IACzC,CAAC;IAED,MAAM,EAAE,GAAG,kBAAkB,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC;IACzE,MAAM,IAAI,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAC1C,MAAM,WAAW,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;IAC1E,IAAI,CAAC,WAAW,EAAE,UAAU,IAAI,CAAC,IAAI,EAAE,CAAC;QACtC,OAAO,IAAI,CAAC,GAAG,EAAE,eAAe,CAAC,CAAC;IACpC,CAAC;IAED,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,WAAW,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;QACpD,MAAM,IAAI,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC;QACxD,IAAI,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC/C,OAAO,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,eAAe,CAAC,CAAC;QACxD,CAAC;QAED,QAAQ,CAAC,UAAU,GAAG,GAAG,CAAC;QAC1B,QAAQ,CAAC,SAAS,CAAC,cAAc,EAAE,IAAI,CAAC,CAAC;QACzC,QAAQ,CAAC,SAAS,CAAC,eAAe,EAAE,aAAa,CAAC,CAAC;QACnD,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,QAAQ,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;QACxD,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC,GAAG,EAAE,eAAe,CAAC,CAAC;IACpC,CAAC;AACH,CAAC"}

package/dist/src/server/integrations.d.ts

@@ -0,0 +1,12 @@
+import type { Integration } from '@hashsome/core';
+export interface StartOptions {
+    log?: (message: string) => void;
+    minDelayMs?: number;
+    maxDelayMs?: number;
+}
+/**
+ * Connects every integration, retrying with exponential backoff until it
+ * succeeds. Never throws: an unreachable Home Assistant must not stop the
+ * server (dashboards show "unavailable" and recover).
+ */
+export declare function startIntegrations(integrations: Integration[], options?: StartOptions): () => void;

package/dist/src/server/integrations.js

@@ -0,0 +1,39 @@
+/**
+ * Connects every integration, retrying with exponential backoff until it
+ * succeeds. Never throws: an unreachable Home Assistant must not stop the
+ * server (dashboards show "unavailable" and recover).
+ */
+export function startIntegrations(integrations, options = {}) {
+    const log = options.log ?? (() => { });
+    const min = options.minDelayMs ?? 1000;
+    const max = options.maxDelayMs ?? 30_000;
+    const timers = new Set();
+    let stopped = false;
+    const attempt = (integration, retry) => {
+        if (stopped) {
+            return;
+        }
+        integration.connect().then(() => log(`[${integration.id}] connected`), (error) => {
+            const delay = Math.min(max, min * 2 ** retry);
+            const reason = error instanceof Error ? error.message : String(error);
+            log(`[${integration.id}] connect failed (${reason}); retrying in ${delay}ms`);
+            const timer = setTimeout(() => {
+                timers.delete(timer);
+                attempt(integration, retry + 1);
+            }, delay);
+            timers.add(timer);
+        });
+    };
+    for (const integration of integrations) {
+        attempt(integration, 0);
+    }
+    return () => {
+        stopped = true;
+        for (const timer of timers) {
+            clearTimeout(timer);
+        }
+        for (const integration of integrations) {
+            integration.disconnect();
+        }
+    };
+}

package/dist/src/server/integrations.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"integrations.js","sourceRoot":"","sources":["../../../src/server/integrations.ts"],"names":[],"mappings":"AAQA;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAAC,YAA2B,EAAE,OAAO,GAAiB,EAAE;IACvF,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IACtC,MAAM,GAAG,GAAG,OAAO,CAAC,UAAU,IAAI,IAAI,CAAC;IACvC,MAAM,GAAG,GAAG,OAAO,CAAC,UAAU,IAAI,MAAM,CAAC;IACzC,MAAM,MAAM,GAAG,IAAI,GAAG,EAAiC,CAAC;IACxD,IAAI,OAAO,GAAG,KAAK,CAAC;IAEpB,MAAM,OAAO,GAAG,CAAC,WAAwB,EAAE,KAAa,EAAE,EAAE;QAC1D,IAAI,OAAO,EAAE,CAAC;YACZ,OAAO;QACT,CAAC;QAED,WAAW,CAAC,OAAO,EAAE,CAAC,IAAI,CACxB,GAAG,EAAE,CAAC,GAAG,CAAC,IAAI,WAAW,CAAC,EAAE,aAAa,CAAC,EAC1C,CAAC,KAAc,EAAE,EAAE;YACjB,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,GAAG,CAAC,IAAI,KAAK,CAAC,CAAC;YAC9C,MAAM,MAAM,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACtE,GAAG,CAAC,IAAI,WAAW,CAAC,EAAE,qBAAqB,MAAM,kBAAkB,KAAK,IAAI,CAAC,CAAC;YAC9E,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;gBAC5B,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;gBACrB,OAAO,CAAC,WAAW,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;YAClC,CAAC,EAAE,KAAK,CAAC,CAAC;YAEV,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACpB,CAAC,CACF,CAAC;IACJ,CAAC,CAAC;IAEF,KAAK,MAAM,WAAW,IAAI,YAAY,EAAE,CAAC;QACvC,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;IAC1B,CAAC;IAED,OAAO,GAAG,EAAE;QACV,OAAO,GAAG,IAAI,CAAC;QACf,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;YAC3B,YAAY,CAAC,KAAK,CAAC,CAAC;QACtB,CAAC;QAED,KAAK,MAAM,WAAW,IAAI,YAAY,EAAE,CAAC;YACvC,WAAW,CAAC,UAAU,EAAE,CAAC;QAC3B,CAAC;IACH,CAAC,CAAC;AACJ,CAAC"}

package/dist/src/server/production.d.ts

@@ -0,0 +1,7 @@
+import type { Integration } from '@hashsome/core';
+import { type Express } from 'express';
+import type { ResolvedConfig } from '../config.ts';
+export declare function createApp(clientDir: string, integrations?: Integration[]): Express;
+/** Where `hashsome build` puts the client, under a project. A packaged release keeps it elsewhere. */
+export declare const BUILT_CLIENT: string;
+export declare function startServer(config: ResolvedConfig, clientDir?: string): import("http").Server<typeof import("http").IncomingMessage, typeof import("http").ServerResponse>;

package/dist/src/server/production.js

@@ -0,0 +1,45 @@
+import express, {} from 'express';
+import { createServer } from 'node:http';
+import { join } from 'node:path';
+import { serveAsset } from './assets.js';
+import { Proxy } from './proxy.js';
+import { startIntegrations } from './integrations.js';
+import { attachWebSocket } from './websocket.js';
+export function createApp(clientDir, integrations = []) {
+    const app = express();
+    app.disable('x-powered-by');
+    app.get('/healthz', (_req, res) => {
+        res.json({ status: 'ok' });
+    });
+    app.use((req, res, next) => {
+        serveAsset(integrations, req, res).then((served) => (served ? undefined : next()), next);
+    });
+    app.get('/favicon.ico', (_req, res) => {
+        res.status(204).end();
+    });
+    app.use(express.static(clientDir, { index: false, maxAge: '1h' }));
+    // SPA fallback: client-side routing handles /{id}/...
+    app.use((_req, res) => {
+        res.sendFile(join(clientDir, 'index.html'));
+    });
+    return app;
+}
+/** Where `hashsome build` puts the client, under a project. A packaged release keeps it elsewhere. */
+export const BUILT_CLIENT = join('build', 'client');
+export function startServer(config, clientDir = join(config.root, BUILT_CLIENT)) {
+    const server = createServer(createApp(clientDir, config.integrations));
+    const proxy = new Proxy(config.integrations, { log: console.log });
+    attachWebSocket(server, proxy);
+    const stop = startIntegrations(config.integrations, { log: console.log });
+    server.listen(config.port, config.host, () => {
+        console.log(`hashsome listening on http://${config.host}:${config.port}`);
+    });
+    const shutdown = () => {
+        stop();
+        server.close(() => process.exit(0));
+        server.closeAllConnections();
+    };
+    process.on('SIGINT', shutdown);
+    process.on('SIGTERM', shutdown);
+    return server;
+}

package/dist/src/server/production.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"production.js","sourceRoot":"","sources":["../../../src/server/production.ts"],"names":[],"mappings":"AACA,OAAO,OAAO,EAAE,EAAgB,MAAM,SAAS,CAAC;AAChD,OAAO,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AACzC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AACnC,OAAO,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AACtD,OAAO,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAEjD,MAAM,UAAU,SAAS,CAAC,SAAiB,EAAE,YAAY,GAAkB,EAAE;IAC3E,MAAM,GAAG,GAAG,OAAO,EAAE,CAAC;IACtB,GAAG,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;IAC5B,GAAG,CAAC,GAAG,CAAC,UAAU,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;QAChC,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;IAC7B,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QACzB,UAAU,CAAC,YAAY,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,IAAI,CAAC,CAAC;IAC3F,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,GAAG,CAAC,cAAc,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;QACpC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC;IACxB,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;IACnE,sDAAsD;IACtD,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;QACpB,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC,CAAC;IAC9C,CAAC,CAAC,CAAC;IAEH,OAAO,GAAG,CAAC;AACb,CAAC;AAED,sGAAsG;AACtG,MAAM,CAAC,MAAM,YAAY,GAAG,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;AAEpD,MAAM,UAAU,WAAW,CAAC,MAAsB,EAAE,SAAS,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,YAAY,CAAC;IAC7F,MAAM,MAAM,GAAG,YAAY,CAAC,SAAS,CAAC,SAAS,EAAE,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC;IACvE,MAAM,KAAK,GAAG,IAAI,KAAK,CAAC,MAAM,CAAC,YAAY,EAAE,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IACnE,eAAe,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IAC/B,MAAM,IAAI,GAAG,iBAAiB,CAAC,MAAM,CAAC,YAAY,EAAE,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IAC1E,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,GAAG,EAAE;QAC3C,OAAO,CAAC,GAAG,CAAC,gCAAgC,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;IAC5E,CAAC,CAAC,CAAC;IAEH,MAAM,QAAQ,GAAG,GAAG,EAAE;QACpB,IAAI,EAAE,CAAC;QACP,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;QACpC,MAAM,CAAC,mBAAmB,EAAE,CAAC;IAC/B,CAAC,CAAC;IAEF,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;IAC/B,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;IAChC,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/src/server/proxy.d.ts

@@ -0,0 +1,34 @@
+import { type Integration } from '@hashsome/core';
+/** The subset of a `ws` WebSocket the proxy needs. */
+export interface ProxySocket {
+    send(data: string): void;
+    on(event: 'message', listener: (data: {
+        toString(): string;
+    }) => void): unknown;
+    on(event: 'close' | 'error', listener: () => void): unknown;
+    readonly readyState: number;
+}
+/**
+ * Multiplexes browser connections onto server-held integrations. Tokens never
+ * reach the browser; current states are replayed from the integrations' stores
+ * so a waking tablet gets a full picture immediately.
+ */
+export interface ProxyOptions {
+    /** Where problems worth a line in the server log go (an unknown ref, a failed subscribe). */
+    log?: (message: string) => void;
+}
+/**
+ * Multiplexes browser connections onto server-held integrations. Tokens never
+ * reach the browser; current entities are replayed from the integrations' stores
+ * so a waking tablet gets a full picture immediately.
+ *
+ * The proxy does all the addressing: it parses `<integration>:<id>` and hands the integration only
+ * its local id. A subscription is resolved once the owning integration is connected — until then
+ * the browser has no answer (a component shows its loading state) — and an id the integration does
+ * not have is answered with `entity: null` and logged.
+ */
+export declare class Proxy {
+    #private;
+    constructor(integrations: Integration[], options?: ProxyOptions);
+    handleConnection(socket: ProxySocket): void;
+}