@hediet/linkrpc-hub 0.0.1

package/dist/chunks/node-CTXsQ6oa.js

@@ -0,0 +1,460 @@
+import { randomUUID } from "node:crypto";
+import * as path from "node:path";
+import { connectNdjson, runInitializeHandshake } from "@hediet/linkrpc/node";
+import * as net from "node:net";
+import * as fs from "node:fs";
+import * as os from "node:os";
+import * as http from "node:http";
+import { WebSocketServer } from "ws";
+//#region src/hub/server/node/socketServer.ts
+/**
+* A {@link Transport} over a Node socket that still exposes the underlying
+* {@link net.Socket}. Provenance providers (peercred, etc.) read `socket`;
+* the hub core never does. Framing is newline-delimited JSON, and the
+* connection has already completed the `hubrpc::initialize` handshake.
+*/
+var NodeSocketTransport = class {
+	socket;
+	_inner;
+	topologyInfo;
+	_closeHandlers = [];
+	_closed = false;
+	/**
+	* Token presented by the peer in the `hubrpc::initialize` handshake. When
+	* the server was started with {@link SocketServerOptions.isTokenAccepted}
+	* the token has already been validated (the connection would otherwise have
+	* been dropped); a {@link ConnectionProvenanceProvider} can read it to
+	* further attest the peer (e.g. map a one-shot run token to an identity).
+	* `undefined` when the handshake carried no token.
+	*/
+	initializeToken;
+	constructor(socket, _inner, topologyInfo) {
+		this.socket = socket;
+		this._inner = _inner;
+		this.topologyInfo = topologyInfo;
+		socket.on("close", () => this._fireClose());
+		socket.on("error", () => this.dispose());
+	}
+	send(message) {
+		return this._inner.send(message);
+	}
+	setListener(listener) {
+		this._inner.setListener(listener);
+	}
+	onDidClose(handler) {
+		if (this._closed) {
+			queueMicrotask(handler);
+			return;
+		}
+		this._closeHandlers.push(handler);
+	}
+	dispose() {
+		this._inner.dispose();
+		try {
+			this.socket.destroy();
+		} catch {}
+	}
+	_fireClose() {
+		if (this._closed) return;
+		this._closed = true;
+		for (const handler of this._closeHandlers) handler();
+		this._closeHandlers.length = 0;
+	}
+};
+/**
+* A hub-agnostic {@link ITransportServer} over a named pipe / UDS. It listens,
+* accepts, runs the `hubrpc::initialize` handshake (authentication + protocol
+* negotiation), frames each socket as a {@link NodeSocketTransport}, and hands
+* it to the connection handler — no hub coupling. Compose
+* attestation/identity on top via `withProvenance` and
+* {@link HubConnectionAcceptor}.
+*
+* The handshake's token is validated via
+* {@link SocketServerOptions.isTokenAccepted} when provided; otherwise any
+* token is accepted and merely captured for a provenance provider.
+*/
+var SocketServer = class SocketServer {
+	_server;
+	_endpoint;
+	_live = /* @__PURE__ */ new Set();
+	_isTokenAccepted;
+	_handler;
+	_disposed = false;
+	constructor(endpoint, isTokenAccepted) {
+		this._endpoint = endpoint;
+		this._isTokenAccepted = isTokenAccepted ?? (async () => true);
+		this._server = net.createServer((socket) => this._onConnection(socket));
+	}
+	/** Bind + listen (with stale-UDS unlink retry), resolving once ready. */
+	static async start(options = {}) {
+		const server = new SocketServer(options.endpoint ?? SocketServer.allocSocketPath(), options.isTokenAccepted);
+		await server._listenWithRetry();
+		return server;
+	}
+	/** Allocate a fresh, unused socket path (named pipe on Windows, UDS elsewhere). */
+	static allocSocketPath() {
+		const id = randomUUID();
+		if (process.platform === "win32") return `\\\\.\\pipe\\vscode-linkrpc-${id}`;
+		return path.join(os.tmpdir(), `vscode-linkrpc-${id}.sock`);
+	}
+	get endpoint() {
+		return this._endpoint;
+	}
+	setConnectionHandler(handler) {
+		this._handler = handler;
+	}
+	dispose() {
+		if (this._disposed) return;
+		this._disposed = true;
+		for (const t of this._live) t.dispose();
+		this._live.clear();
+		this._server.close();
+		if (process.platform !== "win32") try {
+			fs.unlinkSync(this._endpoint);
+		} catch {}
+	}
+	_onConnection(socket) {
+		this._acceptConnection(socket);
+	}
+	/**
+	* Run the `hubrpc::initialize` handshake on the freshly accepted socket,
+	* then frame it as a {@link NodeSocketTransport} and hand it to the
+	* connection handler. A failed handshake (bad/missing token, wrong first
+	* message, or timeout) drops the socket without reaching the handler.
+	*/
+	async _acceptConnection(socket) {
+		socket.on("error", () => socket.destroy());
+		let connected;
+		try {
+			connected = await connectNdjson({
+				input: socket,
+				output: socket,
+				initialize: {
+					kind: "server",
+					isTokenAccepted: this._isTokenAccepted
+				}
+			});
+		} catch {
+			socket.destroy();
+			return;
+		}
+		if (this._disposed) {
+			connected.transport.dispose();
+			socket.destroy();
+			return;
+		}
+		const transport = new NodeSocketTransport(socket, connected.transport, {
+			type: process.platform === "win32" ? "named-pipe" : "unix",
+			path: this._endpoint
+		});
+		transport.initializeToken = connected.token;
+		this._live.add(transport);
+		transport.onDidClose(() => this._live.delete(transport));
+		this._handler?.(transport);
+	}
+	async _listenWithRetry() {
+		const isWin = process.platform === "win32";
+		const deadline = Date.now() + 1e3;
+		let delay = 10;
+		while (true) try {
+			await this._listenOnce();
+			return;
+		} catch (err) {
+			if (err.code !== "EADDRINUSE") throw err;
+			if (!isWin) {
+				try {
+					fs.unlinkSync(this._endpoint);
+				} catch {}
+				await this._listenOnce();
+				return;
+			}
+			if (Date.now() >= deadline) throw err;
+			await new Promise((r) => setTimeout(r, delay));
+			delay = Math.min(delay * 2, 100);
+		}
+	}
+	_listenOnce() {
+		return new Promise((resolve, reject) => {
+			const onError = (err) => {
+				this._server.removeListener("error", onError);
+				reject(err);
+			};
+			this._server.once("error", onError);
+			this._server.listen(this._endpoint, () => {
+				this._server.removeListener("error", onError);
+				resolve();
+			});
+		});
+	}
+};
+//#endregion
+//#region src/hub/server/node/webSocketServer.ts
+/**
+* A {@link Transport} over a server-side `ws` WebSocket. One JSON-RPC message
+* per text frame; binary frames are decoded as UTF-8 and unparseable frames
+* are dropped (the same lenient behaviour as {@link NodeSocketTransport}).
+*
+* The transport takes ownership of the socket: {@link dispose} closes it, and
+* a peer close / error fires {@link onDidClose} handlers exactly once.
+*/
+var NodeWebSocketTransport = class {
+	socket;
+	topologyInfo;
+	_listener;
+	_buffer = [];
+	_closeHandlers = [];
+	_closed = false;
+	/**
+	* Token presented by the peer in the `hubrpc::initialize` handshake, when
+	* the server ran one. A {@link ConnectionProvenanceProvider} can read it to
+	* attest the peer. `undefined` when the handshake carried no token.
+	*/
+	initializeToken;
+	constructor(socket, topologyInfo) {
+		this.socket = socket;
+		this.topologyInfo = topologyInfo;
+		socket.on("message", (data, isBinary) => {
+			const text = isBinary ? Buffer.isBuffer(data) ? data.toString("utf8") : Array.isArray(data) ? Buffer.concat(data).toString("utf8") : Buffer.from(data).toString("utf8") : data.toString();
+			for (const line of text.split("\n")) {
+				const trimmed = line.trim();
+				if (!trimmed) continue;
+				let parsed;
+				try {
+					parsed = JSON.parse(trimmed);
+				} catch {
+					continue;
+				}
+				this._deliver(parsed);
+			}
+		});
+		const onEnd = () => {
+			if (this._closed) return;
+			this._closed = true;
+			this._fireClose();
+		};
+		socket.on("close", onEnd);
+		socket.on("error", onEnd);
+	}
+	send(message) {
+		if (this._closed) return;
+		if (this.socket.readyState !== 1) return;
+		this.socket.send(JSON.stringify(message));
+	}
+	setListener(listener) {
+		this._listener = listener;
+		if (listener) while (this._buffer.length > 0 && this._listener) {
+			const m = this._buffer.shift();
+			this._listener(m);
+		}
+	}
+	onDidClose(handler) {
+		if (this._closed) {
+			queueMicrotask(handler);
+			return;
+		}
+		this._closeHandlers.push(handler);
+	}
+	dispose() {
+		if (this._closed) return;
+		this._closed = true;
+		try {
+			this.socket.close();
+		} catch {}
+		this._fireClose();
+	}
+	_fireClose() {
+		const handlers = this._closeHandlers.splice(0);
+		for (const h of handlers) try {
+			h();
+		} catch {}
+	}
+	_deliver(m) {
+		if (this._listener) this._listener(m);
+		else this._buffer.push(m);
+	}
+};
+/**
+* A hub-agnostic {@link ITransportServer} over WebSocket. It owns an
+* `http.Server`, gates each upgrade by origin, runs the `hubrpc::initialize`
+* handshake (authentication + protocol negotiation) over each accepted socket,
+* and frames it as a {@link NodeWebSocketTransport}. Compose identity/claim
+* policy on top via {@link HubConnectionAcceptor} — this server never couples
+* to the hub.
+*
+* Sibling of {@link SocketServer} (named pipe / UDS) for reaching the hub from
+* outside the host over `ws://` / `wss://`.
+*/
+var WebSocketServer$1 = class WebSocketServer$1 {
+	_opts;
+	_httpServer;
+	_wss;
+	_path;
+	_attached = /* @__PURE__ */ new Set();
+	_sockets = /* @__PURE__ */ new Set();
+	_handler;
+	_disposed = false;
+	constructor(_opts) {
+		this._opts = _opts;
+		this._path = _opts.path ?? "/";
+		if (!_opts.allowAnonymous && !_opts.isTokenAccepted) throw new Error("WebSocketServer: either `isTokenAccepted` must be provided or `allowAnonymous` must be true");
+		this._httpServer = http.createServer(_opts.requestListener ?? ((_req, res) => {
+			res.writeHead(426, { "content-type": "text/plain" });
+			res.end("upgrade required");
+		}));
+		this._wss = new WebSocketServer({
+			noServer: true,
+			maxPayload: _opts.maxPayload ?? 16777216
+		});
+		this._httpServer.on("upgrade", (req, socket, head) => this._onUpgrade(req, socket, head));
+		this._wss.on("connection", (ws, req) => this._onConnection(ws, req));
+	}
+	/** Bind + listen, resolving once the port is open. */
+	static start(options = {}) {
+		const server = new WebSocketServer$1(options);
+		return new Promise((resolve, reject) => {
+			const onError = (err) => reject(err);
+			server._httpServer.once("error", onError);
+			server._httpServer.listen(options.port ?? 0, options.host, () => {
+				server._httpServer.removeListener("error", onError);
+				resolve(server);
+			});
+		});
+	}
+	/** The bound port (resolved even when started with port `0`). */
+	get port() {
+		const addr = this._httpServer.address();
+		if (addr && typeof addr === "object") return addr.port;
+		return 0;
+	}
+	setConnectionHandler(handler) {
+		this._handler = handler;
+	}
+	dispose() {
+		if (this._disposed) return;
+		this._disposed = true;
+		for (const t of this._attached) t.dispose();
+		this._attached.clear();
+		for (const s of this._sockets) try {
+			s.terminate();
+		} catch {}
+		this._sockets.clear();
+		this._wss.close();
+		this._httpServer.close();
+	}
+	_onUpgrade(req, socket, head) {
+		if (new URL(req.url ?? "/", "http://localhost").pathname !== this._path) {
+			this._reject(socket, 404, "not found", req);
+			return;
+		}
+		const allowedOrigins = this._opts.allowedOrigins;
+		if (allowedOrigins && allowedOrigins.length > 0) {
+			const origin = req.headers.origin;
+			if (origin && !allowedOrigins.includes(origin)) {
+				this._reject(socket, 403, "origin not allowed", req);
+				return;
+			}
+		}
+		this._wss.handleUpgrade(req, socket, head, (ws) => {
+			this._wss.emit("connection", ws, req);
+		});
+	}
+	_onConnection(ws, req) {
+		this._acceptConnection(ws, req);
+	}
+	/**
+	* Frame the upgraded socket, run the `hubrpc::initialize` handshake
+	* (authentication + protocol negotiation), then hand the transport to the
+	* connection handler. A failed handshake (bad/missing token, wrong first
+	* message, or timeout) drops the socket without reaching the handler.
+	*/
+	async _acceptConnection(ws, req) {
+		if (this._disposed) {
+			try {
+				ws.terminate();
+			} catch {}
+			return;
+		}
+		this._sockets.add(ws);
+		ws.once("close", () => this._sockets.delete(ws));
+		const transport = new NodeWebSocketTransport(ws, _webSocketTopologyInfo(req, this._path));
+		const isTokenAccepted = this._opts.isTokenAccepted ?? (async () => true);
+		let token;
+		try {
+			({token} = await runInitializeHandshake(transport, {
+				kind: "server",
+				isTokenAccepted
+			}));
+		} catch {
+			transport.dispose();
+			this._opts.onEvent?.({
+				kind: "rejected",
+				reason: "401 unauthorized",
+				remoteAddress: _remoteAddr(req)
+			});
+			return;
+		}
+		if (this._disposed) {
+			transport.dispose();
+			return;
+		}
+		transport.initializeToken = token;
+		transport.onDidClose(() => {
+			this._attached.delete(transport);
+			this._opts.onEvent?.({
+				kind: "closed",
+				remoteAddress: _remoteAddr(req)
+			});
+		});
+		this._attached.add(transport);
+		this._handler?.(transport);
+		this._opts.onEvent?.({
+			kind: "accepted",
+			remoteAddress: _remoteAddr(req)
+		});
+	}
+	_reject(socket, status, message, req) {
+		this._opts.onEvent?.({
+			kind: "rejected",
+			reason: `${status} ${message}`,
+			remoteAddress: _remoteAddr(req)
+		});
+		try {
+			socket.write(`HTTP/1.1 ${status} ${message}\r\nContent-Length: 0\r\nConnection: close\r\n\r\n`);
+		} catch {}
+		try {
+			socket.destroy();
+		} catch {}
+	}
+};
+function _remoteAddr(req) {
+	return _forwardedFor(req) ?? req.socket.remoteAddress ?? void 0;
+}
+function _webSocketTopologyInfo(req, path) {
+	const forwardedFor = _forwardedFor(req);
+	const origin = req.headers.origin;
+	return {
+		type: "websocket",
+		path,
+		...req.socket.localAddress !== void 0 || req.socket.localPort !== void 0 ? { local: {
+			...req.socket.localAddress !== void 0 ? { address: req.socket.localAddress } : {},
+			...req.socket.localPort !== void 0 ? { port: req.socket.localPort } : {}
+		} } : {},
+		...req.socket.remoteAddress !== void 0 || req.socket.remotePort !== void 0 ? { remote: {
+			...req.socket.remoteAddress !== void 0 ? { address: req.socket.remoteAddress } : {},
+			...req.socket.remotePort !== void 0 ? { port: req.socket.remotePort } : {}
+		} } : {},
+		...forwardedFor !== void 0 || origin !== void 0 ? { metadata: {
+			...forwardedFor !== void 0 ? { forwardedFor } : {},
+			...origin !== void 0 ? { origin } : {}
+		} } : {}
+	};
+}
+function _forwardedFor(req) {
+	const value = req.headers["x-forwarded-for"];
+	if (typeof value !== "string") return void 0;
+	return value.split(",")[0]?.trim() || void 0;
+}
+//#endregion
+export { SocketServer as i, WebSocketServer$1 as n, NodeSocketTransport as r, NodeWebSocketTransport as t };
+
+//# sourceMappingURL=node-CTXsQ6oa.js.map

package/dist/chunks/node-CTXsQ6oa.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"node-CTXsQ6oa.js","names":["WebSocketServer","WsServer"],"sources":["../../src/hub/server/node/socketServer.ts","../../src/hub/server/node/webSocketServer.ts"],"sourcesContent":["import { randomUUID } from 'node:crypto';\nimport * as fs from 'node:fs';\nimport * as net from 'node:net';\nimport * as os from 'node:os';\nimport * as path from 'node:path';\nimport { connectNdjson } from '@hediet/linkrpc/node';\nimport type { IMessageTransport, JsonRpcMessage } from '@hediet/linkrpc';\nimport type {\n    ITransportServer,\n    Transport,\n} from '@hediet/linkrpc/hub/common';\nimport type { TopologyTransportInfo } from '@hediet/linkrpc/inspection';\n\n/**\n * A {@link Transport} over a Node socket that still exposes the underlying\n * {@link net.Socket}. Provenance providers (peercred, etc.) read `socket`;\n * the hub core never does. Framing is newline-delimited JSON, and the\n * connection has already completed the `hubrpc::initialize` handshake.\n */\nexport class NodeSocketTransport implements Transport {\n    private readonly _closeHandlers: (() => void)[] = [];\n    private _closed = false;\n\n    /**\n     * Token presented by the peer in the `hubrpc::initialize` handshake. When\n     * the server was started with {@link SocketServerOptions.isTokenAccepted}\n     * the token has already been validated (the connection would otherwise have\n     * been dropped); a {@link ConnectionProvenanceProvider} can read it to\n     * further attest the peer (e.g. map a one-shot run token to an identity).\n     * `undefined` when the handshake carried no token.\n     */\n    public initializeToken: string | undefined;\n\n    constructor(\n        public readonly socket: net.Socket,\n        private readonly _inner: IMessageTransport,\n        public readonly topologyInfo?: TopologyTransportInfo,\n    ) {\n        socket.on('close', () => this._fireClose());\n        socket.on('error', () => this.dispose());\n    }\n\n    public send(message: JsonRpcMessage): void | Promise<void> {\n        return this._inner.send(message);\n    }\n\n    public setListener(listener: ((message: JsonRpcMessage) => void) | undefined): void {\n        this._inner.setListener(listener);\n    }\n\n    public onDidClose(handler: () => void): void {\n        if (this._closed) {\n            queueMicrotask(handler);\n            return;\n        }\n        this._closeHandlers.push(handler);\n    }\n\n    public dispose(): void {\n        this._inner.dispose();\n        try {\n            this.socket.destroy();\n        } catch { /* ignore */ }\n    }\n\n    private _fireClose(): void {\n        if (this._closed) return;\n        this._closed = true;\n        for (const handler of this._closeHandlers) {\n            handler();\n        }\n        this._closeHandlers.length = 0;\n    }\n}\n\nexport interface SocketServerOptions {\n    /**\n     * Named pipe (Windows) / UDS path (Unix) to listen on. Defaults to a\n     * per-instance computed path.\n     */\n    readonly endpoint?: string;\n    /**\n     * Validate the token presented in the client's `hubrpc::initialize`\n     * handshake. Resolve `true` to admit the connection, `false` to reject it\n     * (the socket is dropped before it reaches the connection handler). Called\n     * live on every connection, so a dynamic allow-list (e.g. one-shot run\n     * tokens added for the lifetime of a spawned child) is re-read per connect.\n     *\n     * Omit to accept any token: the handshake is still required and the token\n     * is captured onto {@link NodeSocketTransport.initializeToken} for a\n     * provenance provider, but it is not gated.\n     */\n    readonly isTokenAccepted?: (token: string | undefined) => Promise<boolean>;\n}\n\n/**\n * A hub-agnostic {@link ITransportServer} over a named pipe / UDS. It listens,\n * accepts, runs the `hubrpc::initialize` handshake (authentication + protocol\n * negotiation), frames each socket as a {@link NodeSocketTransport}, and hands\n * it to the connection handler — no hub coupling. Compose\n * attestation/identity on top via `withProvenance` and\n * {@link HubConnectionAcceptor}.\n *\n * The handshake's token is validated via\n * {@link SocketServerOptions.isTokenAccepted} when provided; otherwise any\n * token is accepted and merely captured for a provenance provider.\n */\nexport class SocketServer implements ITransportServer<NodeSocketTransport> {\n    private readonly _server: net.Server;\n    private readonly _endpoint: string;\n    private readonly _live = new Set<NodeSocketTransport>();\n    private readonly _isTokenAccepted: (token: string | undefined) => Promise<boolean>;\n    private _handler: ((transport: NodeSocketTransport) => void) | undefined;\n    private _disposed = false;\n\n    private constructor(\n        endpoint: string,\n        isTokenAccepted: ((token: string | undefined) => Promise<boolean>) | undefined,\n    ) {\n        this._endpoint = endpoint;\n        this._isTokenAccepted = isTokenAccepted ?? (async () => true);\n        this._server = net.createServer((socket) => this._onConnection(socket));\n    }\n\n    /** Bind + listen (with stale-UDS unlink retry), resolving once ready. */\n    public static async start(options: SocketServerOptions = {}): Promise<SocketServer> {\n        const server = new SocketServer(\n            options.endpoint ?? SocketServer.allocSocketPath(),\n            options.isTokenAccepted,\n        );\n        await server._listenWithRetry();\n        return server;\n    }\n\n    /** Allocate a fresh, unused socket path (named pipe on Windows, UDS elsewhere). */\n    public static allocSocketPath(): string {\n        const id = randomUUID();\n        if (process.platform === 'win32') {\n            return `\\\\\\\\.\\\\pipe\\\\vscode-linkrpc-${id}`;\n        }\n        return path.join(os.tmpdir(), `vscode-linkrpc-${id}.sock`);\n    }\n\n    public get endpoint(): string {\n        return this._endpoint;\n    }\n\n    public setConnectionHandler(handler: (transport: NodeSocketTransport) => void): void {\n        this._handler = handler;\n    }\n\n    public dispose(): void {\n        if (this._disposed) return;\n        this._disposed = true;\n        for (const t of this._live) {\n            t.dispose();\n        }\n        this._live.clear();\n        this._server.close();\n        if (process.platform !== 'win32') {\n            try {\n                fs.unlinkSync(this._endpoint);\n            } catch { /* ignore */ }\n        }\n    }\n\n    private _onConnection(socket: net.Socket): void {\n        void this._acceptConnection(socket);\n    }\n\n    /**\n     * Run the `hubrpc::initialize` handshake on the freshly accepted socket,\n     * then frame it as a {@link NodeSocketTransport} and hand it to the\n     * connection handler. A failed handshake (bad/missing token, wrong first\n     * message, or timeout) drops the socket without reaching the handler.\n     */\n    private async _acceptConnection(socket: net.Socket): Promise<void> {\n        socket.on('error', () => socket.destroy());\n        let connected: { transport: IMessageTransport; token?: string; };\n        try {\n            connected = await connectNdjson({\n                input: socket,\n                output: socket,\n                initialize: { kind: 'server', isTokenAccepted: this._isTokenAccepted },\n            });\n        } catch {\n            socket.destroy();\n            return;\n        }\n        if (this._disposed) {\n            connected.transport.dispose();\n            socket.destroy();\n            return;\n        }\n        const transport = new NodeSocketTransport(\n            socket,\n            connected.transport,\n            {\n                type: process.platform === 'win32' ? 'named-pipe' : 'unix',\n                path: this._endpoint,\n            },\n        );\n        transport.initializeToken = connected.token;\n        this._live.add(transport);\n        transport.onDidClose(() => this._live.delete(transport));\n        this._handler?.(transport);\n    }\n\n    private async _listenWithRetry(): Promise<void> {        // On Unix, EADDRINUSE on our deterministic path means a stale UDS from\n        // a crashed instance — unlink and retry once. On Windows, named pipes\n        // are kernel-managed and may linger briefly after close — retry with\n        // backoff over a bounded window.\n        const isWin = process.platform === 'win32';\n        const deadline = Date.now() + 1000;\n        let delay = 10;\n        while (true) {\n            try {\n                await this._listenOnce();\n                return;\n            } catch (err) {\n                if ((err as NodeJS.ErrnoException).code !== 'EADDRINUSE') throw err;\n                if (!isWin) {\n                    try {\n                        fs.unlinkSync(this._endpoint);\n                    } catch { /* ignore */ }\n                    await this._listenOnce();\n                    return;\n                }\n                if (Date.now() >= deadline) throw err;\n                await new Promise((r) => setTimeout(r, delay));\n                delay = Math.min(delay * 2, 100);\n            }\n        }\n    }\n\n    private _listenOnce(): Promise<void> {\n        return new Promise((resolve, reject) => {\n            const onError = (err: Error) => {\n                this._server.removeListener('error', onError);\n                reject(err);\n            };\n            this._server.once('error', onError);\n            this._server.listen(this._endpoint, () => {\n                this._server.removeListener('error', onError);\n                resolve();\n            });\n        });\n    }\n}\n","import * as http from 'node:http';\nimport { type WebSocket, WebSocketServer as WsServer } from 'ws';\nimport type { JsonRpcMessage } from '@hediet/linkrpc';\nimport { runInitializeHandshake } from '@hediet/linkrpc/node';\nimport type {\n    ITransportServer,\n    Transport,\n} from '@hediet/linkrpc/hub/common';\nimport type { TopologyTransportInfo } from '@hediet/linkrpc/inspection';\n\n/**\n * A {@link Transport} over a server-side `ws` WebSocket. One JSON-RPC message\n * per text frame; binary frames are decoded as UTF-8 and unparseable frames\n * are dropped (the same lenient behaviour as {@link NodeSocketTransport}).\n *\n * The transport takes ownership of the socket: {@link dispose} closes it, and\n * a peer close / error fires {@link onDidClose} handlers exactly once.\n */\nexport class NodeWebSocketTransport implements Transport {\n    private _listener: ((m: JsonRpcMessage) => void) | undefined;\n    private readonly _buffer: JsonRpcMessage[] = [];\n    private readonly _closeHandlers: (() => void)[] = [];\n    private _closed = false;\n\n    /**\n     * Token presented by the peer in the `hubrpc::initialize` handshake, when\n     * the server ran one. A {@link ConnectionProvenanceProvider} can read it to\n     * attest the peer. `undefined` when the handshake carried no token.\n     */\n    public initializeToken: string | undefined;\n\n    constructor(\n        public readonly socket: WebSocket,\n        public readonly topologyInfo?: TopologyTransportInfo,\n    ) {\n        socket.on('message', (data, isBinary) => {\n            const text = isBinary ?\n                Buffer.isBuffer(data) ?\n                    data.toString('utf8') :\n                    Array.isArray(data) ?\n                    Buffer.concat(data).toString('utf8') :\n                    Buffer.from(data as ArrayBuffer).toString('utf8') :\n                data.toString();\n            for (const line of text.split('\\n')) {\n                const trimmed = line.trim();\n                if (!trimmed) continue;\n                let parsed: JsonRpcMessage;\n                try {\n                    parsed = JSON.parse(trimmed) as JsonRpcMessage;\n                } catch {\n                    continue;\n                }\n                this._deliver(parsed);\n            }\n        });\n        const onEnd = (): void => {\n            if (this._closed) return;\n            this._closed = true;\n            this._fireClose();\n        };\n        socket.on('close', onEnd);\n        socket.on('error', onEnd);\n    }\n\n    public send(message: JsonRpcMessage): void {\n        if (this._closed) return;\n        if (this.socket.readyState !== 1 /* OPEN */) return;\n        this.socket.send(JSON.stringify(message));\n    }\n\n    public setListener(listener: ((m: JsonRpcMessage) => void) | undefined): void {\n        this._listener = listener;\n        if (listener) {\n            while (this._buffer.length > 0 && this._listener) {\n                const m = this._buffer.shift()!;\n                this._listener(m);\n            }\n        }\n    }\n\n    public onDidClose(handler: () => void): void {\n        if (this._closed) {\n            queueMicrotask(handler);\n            return;\n        }\n        this._closeHandlers.push(handler);\n    }\n\n    public dispose(): void {\n        if (this._closed) return;\n        this._closed = true;\n        try {\n            this.socket.close();\n        } catch { /* ignore */ }\n        this._fireClose();\n    }\n\n    private _fireClose(): void {\n        const handlers = this._closeHandlers.splice(0);\n        for (const h of handlers) {\n            try {\n                h();\n            } catch { /* ignore */ }\n        }\n    }\n\n    private _deliver(m: JsonRpcMessage): void {\n        if (this._listener) this._listener(m);\n        else this._buffer.push(m);\n    }\n}\n\nexport type WebSocketServerEvent =\n    | { readonly kind: 'accepted'; readonly remoteAddress: string | undefined; }\n    | { readonly kind: 'rejected'; readonly reason: string; readonly remoteAddress: string | undefined; }\n    | { readonly kind: 'closed'; readonly remoteAddress: string | undefined; };\n\nexport interface WebSocketServerOptions {\n    /** TCP port to listen on. Defaults to an OS-assigned free port (`0`). */\n    readonly port?: number;\n    /** Host/interface to bind. Defaults to all interfaces. */\n    readonly host?: string;\n    /**\n     * Validate the token presented in the client's `hubrpc::initialize`\n     * handshake. Resolve `true` to admit the connection, `false` to reject it.\n     * Required unless {@link allowAnonymous} is set. Browsers cannot set the\n     * `Authorization` header on the `WebSocket` constructor, so auth happens\n     * over the in-band handshake rather than the HTTP upgrade.\n     */\n    readonly isTokenAccepted?: (token: string | undefined) => Promise<boolean>;\n    /**\n     * Allow connections without validating a token: the `hubrpc::initialize`\n     * handshake still runs (and its token is captured), but any token is\n     * accepted. Use ONLY behind a trusted reverse proxy that performs auth\n     * itself, or on a private interface.\n     */\n    readonly allowAnonymous?: boolean;\n    /**\n     * Optional `Origin` allow-list for browser clients. When set, the upgrade\n     * is rejected if `Origin` is present and not in the list. Non-browser\n     * clients (which send no `Origin`) are unaffected.\n     */\n    readonly allowedOrigins?: readonly string[];\n    /**\n     * URL path the WebSocket endpoint is mounted at. Defaults to `/`. Any\n     * other path gets a `404`, so the same server can host health checks.\n     */\n    readonly path?: string;\n    /** Bytes. Frames larger than this close the connection. Defaults to 16 MiB. */\n    readonly maxPayload?: number;\n    /** Optional logger called on accept / reject / close. */\n    readonly onEvent?: (event: WebSocketServerEvent) => void;\n    /**\n     * Optional handler for ordinary (non-upgrade) HTTP requests on the same\n     * port. An Express app is a valid {@link http.RequestListener}, so this\n     * lets the WebSocket endpoint and e.g. a `/health` route share one port.\n     * Defaults to replying `426 upgrade required` to every request.\n     */\n    readonly requestListener?: http.RequestListener;\n}\n\n/**\n * A hub-agnostic {@link ITransportServer} over WebSocket. It owns an\n * `http.Server`, gates each upgrade by origin, runs the `hubrpc::initialize`\n * handshake (authentication + protocol negotiation) over each accepted socket,\n * and frames it as a {@link NodeWebSocketTransport}. Compose identity/claim\n * policy on top via {@link HubConnectionAcceptor} — this server never couples\n * to the hub.\n *\n * Sibling of {@link SocketServer} (named pipe / UDS) for reaching the hub from\n * outside the host over `ws://` / `wss://`.\n */\nexport class WebSocketServer implements ITransportServer<NodeWebSocketTransport> {\n    private readonly _httpServer: http.Server;\n    private readonly _wss: WsServer;\n    private readonly _path: string;\n    private readonly _attached = new Set<NodeWebSocketTransport>();\n    private readonly _sockets = new Set<WebSocket>();\n    private _handler: ((transport: NodeWebSocketTransport) => void) | undefined;\n    private _disposed = false;\n\n    private constructor(private readonly _opts: WebSocketServerOptions) {\n        this._path = _opts.path ?? '/';\n        if (!_opts.allowAnonymous && !_opts.isTokenAccepted) {\n            throw new Error(\n                'WebSocketServer: either `isTokenAccepted` must be provided or `allowAnonymous` must be true',\n            );\n        }\n        this._httpServer = http.createServer(\n            _opts.requestListener ??\n                ((_req, res) => {\n                    res.writeHead(426, { 'content-type': 'text/plain' });\n                    res.end('upgrade required');\n                }),\n        );\n        this._wss = new WsServer({\n            noServer: true,\n            maxPayload: _opts.maxPayload ?? 16 * 1024 * 1024,\n        });\n        this._httpServer.on('upgrade', (req, socket, head) => this._onUpgrade(req, socket, head));\n        this._wss.on('connection', (ws, req) => this._onConnection(ws, req));\n    }\n\n    /** Bind + listen, resolving once the port is open. */\n    public static start(options: WebSocketServerOptions = {}): Promise<WebSocketServer> {\n        const server = new WebSocketServer(options);\n        return new Promise<WebSocketServer>((resolve, reject) => {\n            const onError = (err: Error): void => reject(err);\n            server._httpServer.once('error', onError);\n            server._httpServer.listen(options.port ?? 0, options.host, () => {\n                server._httpServer.removeListener('error', onError);\n                resolve(server);\n            });\n        });\n    }\n\n    /** The bound port (resolved even when started with port `0`). */\n    public get port(): number {\n        const addr = this._httpServer.address();\n        if (addr && typeof addr === 'object') return addr.port;\n        return 0;\n    }\n\n    public setConnectionHandler(handler: (transport: NodeWebSocketTransport) => void): void {\n        this._handler = handler;\n    }\n\n    public dispose(): void {\n        if (this._disposed) return;\n        this._disposed = true;\n        for (const t of this._attached) {\n            t.dispose();\n        }\n        this._attached.clear();\n        for (const s of this._sockets) {\n            try {\n                s.terminate();\n            } catch { /* ignore */ }\n        }\n        this._sockets.clear();\n        this._wss.close();\n        this._httpServer.close();\n    }\n\n    private _onUpgrade(\n        req: http.IncomingMessage,\n        socket: NodeJS.WritableStream & { destroy: () => void; },\n        head: Buffer,\n    ): void {\n        const url = new URL(req.url ?? '/', 'http://localhost');\n        if (url.pathname !== this._path) {\n            this._reject(socket, 404, 'not found', req);\n            return;\n        }\n        const allowedOrigins = this._opts.allowedOrigins;\n        if (allowedOrigins && allowedOrigins.length > 0) {\n            const origin = req.headers.origin;\n            if (origin && !allowedOrigins.includes(origin)) {\n                this._reject(socket, 403, 'origin not allowed', req);\n                return;\n            }\n        }\n        this._wss.handleUpgrade(req, socket as never, head, (ws) => {\n            this._wss.emit('connection', ws, req);\n        });\n    }\n\n    private _onConnection(ws: WebSocket, req: http.IncomingMessage): void {\n        void this._acceptConnection(ws, req);\n    }\n\n    /**\n     * Frame the upgraded socket, run the `hubrpc::initialize` handshake\n     * (authentication + protocol negotiation), then hand the transport to the\n     * connection handler. A failed handshake (bad/missing token, wrong first\n     * message, or timeout) drops the socket without reaching the handler.\n     */\n    private async _acceptConnection(ws: WebSocket, req: http.IncomingMessage): Promise<void> {\n        if (this._disposed) {\n            try {\n                ws.terminate();\n            } catch { /* ignore */ }\n            return;\n        }\n        this._sockets.add(ws);\n        ws.once('close', () => this._sockets.delete(ws));\n\n        const transport = new NodeWebSocketTransport(\n            ws,\n            _webSocketTopologyInfo(req, this._path),\n        );\n        const isTokenAccepted = this._opts.isTokenAccepted ?? (async () => true);\n        let token: string | undefined;\n        try {\n            ({ token } = await runInitializeHandshake(transport, { kind: 'server', isTokenAccepted }));\n        } catch {\n            transport.dispose();\n            this._opts.onEvent?.({ kind: 'rejected', reason: '401 unauthorized', remoteAddress: _remoteAddr(req) });\n            return;\n        }\n        if (this._disposed) {\n            transport.dispose();\n            return;\n        }\n        transport.initializeToken = token;\n        transport.onDidClose(() => {\n            this._attached.delete(transport);\n            this._opts.onEvent?.({ kind: 'closed', remoteAddress: _remoteAddr(req) });\n        });\n        this._attached.add(transport);\n        this._handler?.(transport);\n        this._opts.onEvent?.({ kind: 'accepted', remoteAddress: _remoteAddr(req) });\n    }\n\n    private _reject(\n        socket: NodeJS.WritableStream & { destroy: () => void; },\n        status: number,\n        message: string,\n        req: http.IncomingMessage,\n    ): void {\n        this._opts.onEvent?.({ kind: 'rejected', reason: `${status} ${message}`, remoteAddress: _remoteAddr(req) });\n        try {\n            socket.write(\n                `HTTP/1.1 ${status} ${message}\\r\\n` +\n                    `Content-Length: 0\\r\\n` +\n                    `Connection: close\\r\\n` +\n                    `\\r\\n`,\n            );\n        } catch { /* ignore */ }\n        try {\n            socket.destroy();\n        } catch { /* ignore */ }\n    }\n}\n\nfunction _remoteAddr(req: http.IncomingMessage): string | undefined {\n    return _forwardedFor(req) ?? req.socket.remoteAddress ?? undefined;\n}\n\nfunction _webSocketTopologyInfo(\n    req: http.IncomingMessage,\n    path: string,\n): TopologyTransportInfo {\n    const forwardedFor = _forwardedFor(req);\n    const origin = req.headers.origin;\n    return {\n        type: 'websocket',\n        path,\n        ...(req.socket.localAddress !== undefined || req.socket.localPort !== undefined\n            ? {\n                local: {\n                    ...(req.socket.localAddress !== undefined\n                        ? { address: req.socket.localAddress }\n                        : {}),\n                    ...(req.socket.localPort !== undefined ? { port: req.socket.localPort } : {}),\n                },\n            }\n            : {}),\n        ...(req.socket.remoteAddress !== undefined || req.socket.remotePort !== undefined\n            ? {\n                remote: {\n                    ...(req.socket.remoteAddress !== undefined\n                        ? { address: req.socket.remoteAddress }\n                        : {}),\n                    ...(req.socket.remotePort !== undefined ? { port: req.socket.remotePort } : {}),\n                },\n            }\n            : {}),\n        ...(forwardedFor !== undefined || origin !== undefined\n            ? {\n                metadata: {\n                    ...(forwardedFor !== undefined ? { forwardedFor } : {}),\n                    ...(origin !== undefined ? { origin } : {}),\n                },\n            }\n            : {}),\n    };\n}\n\nfunction _forwardedFor(req: http.IncomingMessage): string | undefined {\n    const value = req.headers['x-forwarded-for'];\n    if (typeof value !== 'string') return undefined;\n    return value.split(',')[0]?.trim() || undefined;\n}\n"],"mappings":";;;;;;;;;;;;;;;AAmBA,IAAa,sBAAb,MAAsD;CAe9B;CACC;CACD;CAhBpB,iBAAkD,CAAC;CACnD,UAAkB;;;;;;;;;CAUlB;CAEA,YACI,QACA,QACA,cACF;EAHkB,KAAA,SAAA;EACC,KAAA,SAAA;EACD,KAAA,eAAA;EAEhB,OAAO,GAAG,eAAe,KAAK,WAAW,CAAC;EAC1C,OAAO,GAAG,eAAe,KAAK,QAAQ,CAAC;CAC3C;CAEA,KAAY,SAA+C;EACvD,OAAO,KAAK,OAAO,KAAK,OAAO;CACnC;CAEA,YAAmB,UAAiE;EAChF,KAAK,OAAO,YAAY,QAAQ;CACpC;CAEA,WAAkB,SAA2B;EACzC,IAAI,KAAK,SAAS;GACd,eAAe,OAAO;GACtB;EACJ;EACA,KAAK,eAAe,KAAK,OAAO;CACpC;CAEA,UAAuB;EACnB,KAAK,OAAO,QAAQ;EACpB,IAAI;GACA,KAAK,OAAO,QAAQ;EACxB,QAAQ,CAAe;CAC3B;CAEA,aAA2B;EACvB,IAAI,KAAK,SAAS;EAClB,KAAK,UAAU;EACf,KAAK,MAAM,WAAW,KAAK,gBACvB,QAAQ;EAEZ,KAAK,eAAe,SAAS;CACjC;AACJ;;;;;;;;;;;;;AAkCA,IAAa,eAAb,MAAa,aAA8D;CACvE;CACA;CACA,wBAAyB,IAAI,IAAyB;CACtD;CACA;CACA,YAAoB;CAEpB,YACI,UACA,iBACF;EACE,KAAK,YAAY;EACjB,KAAK,mBAAmB,oBAAoB,YAAY;EACxD,KAAK,UAAU,IAAI,cAAc,WAAW,KAAK,cAAc,MAAM,CAAC;CAC1E;;CAGA,aAAoB,MAAM,UAA+B,CAAC,GAA0B;EAChF,MAAM,SAAS,IAAI,aACf,QAAQ,YAAY,aAAa,gBAAgB,GACjD,QAAQ,eACZ;EACA,MAAM,OAAO,iBAAiB;EAC9B,OAAO;CACX;;CAGA,OAAc,kBAA0B;EACpC,MAAM,KAAK,WAAW;EACtB,IAAI,QAAQ,aAAa,SACrB,OAAO,+BAA+B;EAE1C,OAAO,KAAK,KAAK,GAAG,OAAO,GAAG,kBAAkB,GAAG,MAAM;CAC7D;CAEA,IAAW,WAAmB;EAC1B,OAAO,KAAK;CAChB;CAEA,qBAA4B,SAAyD;EACjF,KAAK,WAAW;CACpB;CAEA,UAAuB;EACnB,IAAI,KAAK,WAAW;EACpB,KAAK,YAAY;EACjB,KAAK,MAAM,KAAK,KAAK,OACjB,EAAE,QAAQ;EAEd,KAAK,MAAM,MAAM;EACjB,KAAK,QAAQ,MAAM;EACnB,IAAI,QAAQ,aAAa,SACrB,IAAI;GACA,GAAG,WAAW,KAAK,SAAS;EAChC,QAAQ,CAAe;CAE/B;CAEA,cAAsB,QAA0B;EAC5C,KAAU,kBAAkB,MAAM;CACtC;;;;;;;CAQA,MAAc,kBAAkB,QAAmC;EAC/D,OAAO,GAAG,eAAe,OAAO,QAAQ,CAAC;EACzC,IAAI;EACJ,IAAI;GACA,YAAY,MAAM,cAAc;IAC5B,OAAO;IACP,QAAQ;IACR,YAAY;KAAE,MAAM;KAAU,iBAAiB,KAAK;IAAiB;GACzE,CAAC;EACL,QAAQ;GACJ,OAAO,QAAQ;GACf;EACJ;EACA,IAAI,KAAK,WAAW;GAChB,UAAU,UAAU,QAAQ;GAC5B,OAAO,QAAQ;GACf;EACJ;EACA,MAAM,YAAY,IAAI,oBAClB,QACA,UAAU,WACV;GACI,MAAM,QAAQ,aAAa,UAAU,eAAe;GACpD,MAAM,KAAK;EACf,CACJ;EACA,UAAU,kBAAkB,UAAU;EACtC,KAAK,MAAM,IAAI,SAAS;EACxB,UAAU,iBAAiB,KAAK,MAAM,OAAO,SAAS,CAAC;EACvD,KAAK,WAAW,SAAS;CAC7B;CAEA,MAAc,mBAAkC;EAI5C,MAAM,QAAQ,QAAQ,aAAa;EACnC,MAAM,WAAW,KAAK,IAAI,IAAI;EAC9B,IAAI,QAAQ;EACZ,OAAO,MACH,IAAI;GACA,MAAM,KAAK,YAAY;GACvB;EACJ,SAAS,KAAK;GACV,IAAK,IAA8B,SAAS,cAAc,MAAM;GAChE,IAAI,CAAC,OAAO;IACR,IAAI;KACA,GAAG,WAAW,KAAK,SAAS;IAChC,QAAQ,CAAe;IACvB,MAAM,KAAK,YAAY;IACvB;GACJ;GACA,IAAI,KAAK,IAAI,KAAK,UAAU,MAAM;GAClC,MAAM,IAAI,SAAS,MAAM,WAAW,GAAG,KAAK,CAAC;GAC7C,QAAQ,KAAK,IAAI,QAAQ,GAAG,GAAG;EACnC;CAER;CAEA,cAAqC;EACjC,OAAO,IAAI,SAAS,SAAS,WAAW;GACpC,MAAM,WAAW,QAAe;IAC5B,KAAK,QAAQ,eAAe,SAAS,OAAO;IAC5C,OAAO,GAAG;GACd;GACA,KAAK,QAAQ,KAAK,SAAS,OAAO;GAClC,KAAK,QAAQ,OAAO,KAAK,iBAAiB;IACtC,KAAK,QAAQ,eAAe,SAAS,OAAO;IAC5C,QAAQ;GACZ,CAAC;EACL,CAAC;CACL;AACJ;;;;;;;;;;;ACtOA,IAAa,yBAAb,MAAyD;CAcjC;CACA;CAdpB;CACA,UAA6C,CAAC;CAC9C,iBAAkD,CAAC;CACnD,UAAkB;;;;;;CAOlB;CAEA,YACI,QACA,cACF;EAFkB,KAAA,SAAA;EACA,KAAA,eAAA;EAEhB,OAAO,GAAG,YAAY,MAAM,aAAa;GACrC,MAAM,OAAO,WACT,OAAO,SAAS,IAAI,IAChB,KAAK,SAAS,MAAM,IACpB,MAAM,QAAQ,IAAI,IAClB,OAAO,OAAO,IAAI,CAAC,CAAC,SAAS,MAAM,IACnC,OAAO,KAAK,IAAmB,CAAC,CAAC,SAAS,MAAM,IACpD,KAAK,SAAS;GAClB,KAAK,MAAM,QAAQ,KAAK,MAAM,IAAI,GAAG;IACjC,MAAM,UAAU,KAAK,KAAK;IAC1B,IAAI,CAAC,SAAS;IACd,IAAI;IACJ,IAAI;KACA,SAAS,KAAK,MAAM,OAAO;IAC/B,QAAQ;KACJ;IACJ;IACA,KAAK,SAAS,MAAM;GACxB;EACJ,CAAC;EACD,MAAM,cAAoB;GACtB,IAAI,KAAK,SAAS;GAClB,KAAK,UAAU;GACf,KAAK,WAAW;EACpB;EACA,OAAO,GAAG,SAAS,KAAK;EACxB,OAAO,GAAG,SAAS,KAAK;CAC5B;CAEA,KAAY,SAA+B;EACvC,IAAI,KAAK,SAAS;EAClB,IAAI,KAAK,OAAO,eAAe,GAAc;EAC7C,KAAK,OAAO,KAAK,KAAK,UAAU,OAAO,CAAC;CAC5C;CAEA,YAAmB,UAA2D;EAC1E,KAAK,YAAY;EACjB,IAAI,UACA,OAAO,KAAK,QAAQ,SAAS,KAAK,KAAK,WAAW;GAC9C,MAAM,IAAI,KAAK,QAAQ,MAAM;GAC7B,KAAK,UAAU,CAAC;EACpB;CAER;CAEA,WAAkB,SAA2B;EACzC,IAAI,KAAK,SAAS;GACd,eAAe,OAAO;GACtB;EACJ;EACA,KAAK,eAAe,KAAK,OAAO;CACpC;CAEA,UAAuB;EACnB,IAAI,KAAK,SAAS;EAClB,KAAK,UAAU;EACf,IAAI;GACA,KAAK,OAAO,MAAM;EACtB,QAAQ,CAAe;EACvB,KAAK,WAAW;CACpB;CAEA,aAA2B;EACvB,MAAM,WAAW,KAAK,eAAe,OAAO,CAAC;EAC7C,KAAK,MAAM,KAAK,UACZ,IAAI;GACA,EAAE;EACN,QAAQ,CAAe;CAE/B;CAEA,SAAiB,GAAyB;EACtC,IAAI,KAAK,WAAW,KAAK,UAAU,CAAC;OAC/B,KAAK,QAAQ,KAAK,CAAC;CAC5B;AACJ;;;;;;;;;;;;AA8DA,IAAaA,oBAAb,MAAaA,kBAAoE;CASxC;CARrC;CACA;CACA;CACA,4BAA6B,IAAI,IAA4B;CAC7D,2BAA4B,IAAI,IAAe;CAC/C;CACA,YAAoB;CAEpB,YAAoB,OAAgD;EAA/B,KAAA,QAAA;EACjC,KAAK,QAAQ,MAAM,QAAQ;EAC3B,IAAI,CAAC,MAAM,kBAAkB,CAAC,MAAM,iBAChC,MAAM,IAAI,MACN,6FACJ;EAEJ,KAAK,cAAc,KAAK,aACpB,MAAM,qBACA,MAAM,QAAQ;GACZ,IAAI,UAAU,KAAK,EAAE,gBAAgB,aAAa,CAAC;GACnD,IAAI,IAAI,kBAAkB;EAC9B,EACR;EACA,KAAK,OAAO,IAAIC,gBAAS;GACrB,UAAU;GACV,YAAY,MAAM,cAAc;EACpC,CAAC;EACD,KAAK,YAAY,GAAG,YAAY,KAAK,QAAQ,SAAS,KAAK,WAAW,KAAK,QAAQ,IAAI,CAAC;EACxF,KAAK,KAAK,GAAG,eAAe,IAAI,QAAQ,KAAK,cAAc,IAAI,GAAG,CAAC;CACvE;;CAGA,OAAc,MAAM,UAAkC,CAAC,GAA6B;EAChF,MAAM,SAAS,IAAID,kBAAgB,OAAO;EAC1C,OAAO,IAAI,SAA0B,SAAS,WAAW;GACrD,MAAM,WAAW,QAAqB,OAAO,GAAG;GAChD,OAAO,YAAY,KAAK,SAAS,OAAO;GACxC,OAAO,YAAY,OAAO,QAAQ,QAAQ,GAAG,QAAQ,YAAY;IAC7D,OAAO,YAAY,eAAe,SAAS,OAAO;IAClD,QAAQ,MAAM;GAClB,CAAC;EACL,CAAC;CACL;;CAGA,IAAW,OAAe;EACtB,MAAM,OAAO,KAAK,YAAY,QAAQ;EACtC,IAAI,QAAQ,OAAO,SAAS,UAAU,OAAO,KAAK;EAClD,OAAO;CACX;CAEA,qBAA4B,SAA4D;EACpF,KAAK,WAAW;CACpB;CAEA,UAAuB;EACnB,IAAI,KAAK,WAAW;EACpB,KAAK,YAAY;EACjB,KAAK,MAAM,KAAK,KAAK,WACjB,EAAE,QAAQ;EAEd,KAAK,UAAU,MAAM;EACrB,KAAK,MAAM,KAAK,KAAK,UACjB,IAAI;GACA,EAAE,UAAU;EAChB,QAAQ,CAAe;EAE3B,KAAK,SAAS,MAAM;EACpB,KAAK,KAAK,MAAM;EAChB,KAAK,YAAY,MAAM;CAC3B;CAEA,WACI,KACA,QACA,MACI;EAEJ,IAAI,IADY,IAAI,IAAI,OAAO,KAAK,kBAC9B,CAAC,CAAC,aAAa,KAAK,OAAO;GAC7B,KAAK,QAAQ,QAAQ,KAAK,aAAa,GAAG;GAC1C;EACJ;EACA,MAAM,iBAAiB,KAAK,MAAM;EAClC,IAAI,kBAAkB,eAAe,SAAS,GAAG;GAC7C,MAAM,SAAS,IAAI,QAAQ;GAC3B,IAAI,UAAU,CAAC,eAAe,SAAS,MAAM,GAAG;IAC5C,KAAK,QAAQ,QAAQ,KAAK,sBAAsB,GAAG;IACnD;GACJ;EACJ;EACA,KAAK,KAAK,cAAc,KAAK,QAAiB,OAAO,OAAO;GACxD,KAAK,KAAK,KAAK,cAAc,IAAI,GAAG;EACxC,CAAC;CACL;CAEA,cAAsB,IAAe,KAAiC;EAClE,KAAU,kBAAkB,IAAI,GAAG;CACvC;;;;;;;CAQA,MAAc,kBAAkB,IAAe,KAA0C;EACrF,IAAI,KAAK,WAAW;GAChB,IAAI;IACA,GAAG,UAAU;GACjB,QAAQ,CAAe;GACvB;EACJ;EACA,KAAK,SAAS,IAAI,EAAE;EACpB,GAAG,KAAK,eAAe,KAAK,SAAS,OAAO,EAAE,CAAC;EAE/C,MAAM,YAAY,IAAI,uBAClB,IACA,uBAAuB,KAAK,KAAK,KAAK,CAC1C;EACA,MAAM,kBAAkB,KAAK,MAAM,oBAAoB,YAAY;EACnE,IAAI;EACJ,IAAI;GACA,CAAC,CAAE,SAAU,MAAM,uBAAuB,WAAW;IAAE,MAAM;IAAU;GAAgB,CAAC;EAC5F,QAAQ;GACJ,UAAU,QAAQ;GAClB,KAAK,MAAM,UAAU;IAAE,MAAM;IAAY,QAAQ;IAAoB,eAAe,YAAY,GAAG;GAAE,CAAC;GACtG;EACJ;EACA,IAAI,KAAK,WAAW;GAChB,UAAU,QAAQ;GAClB;EACJ;EACA,UAAU,kBAAkB;EAC5B,UAAU,iBAAiB;GACvB,KAAK,UAAU,OAAO,SAAS;GAC/B,KAAK,MAAM,UAAU;IAAE,MAAM;IAAU,eAAe,YAAY,GAAG;GAAE,CAAC;EAC5E,CAAC;EACD,KAAK,UAAU,IAAI,SAAS;EAC5B,KAAK,WAAW,SAAS;EACzB,KAAK,MAAM,UAAU;GAAE,MAAM;GAAY,eAAe,YAAY,GAAG;EAAE,CAAC;CAC9E;CAEA,QACI,QACA,QACA,SACA,KACI;EACJ,KAAK,MAAM,UAAU;GAAE,MAAM;GAAY,QAAQ,GAAG,OAAO,GAAG;GAAW,eAAe,YAAY,GAAG;EAAE,CAAC;EAC1G,IAAI;GACA,OAAO,MACH,YAAY,OAAO,GAAG,QAAQ,mDAIlC;EACJ,QAAQ,CAAe;EACvB,IAAI;GACA,OAAO,QAAQ;EACnB,QAAQ,CAAe;CAC3B;AACJ;AAEA,SAAS,YAAY,KAA+C;CAChE,OAAO,cAAc,GAAG,KAAK,IAAI,OAAO,iBAAiB,KAAA;AAC7D;AAEA,SAAS,uBACL,KACA,MACqB;CACrB,MAAM,eAAe,cAAc,GAAG;CACtC,MAAM,SAAS,IAAI,QAAQ;CAC3B,OAAO;EACH,MAAM;EACN;EACA,GAAI,IAAI,OAAO,iBAAiB,KAAA,KAAa,IAAI,OAAO,cAAc,KAAA,IAChE,EACE,OAAO;GACH,GAAI,IAAI,OAAO,iBAAiB,KAAA,IAC1B,EAAE,SAAS,IAAI,OAAO,aAAa,IACnC,CAAC;GACP,GAAI,IAAI,OAAO,cAAc,KAAA,IAAY,EAAE,MAAM,IAAI,OAAO,UAAU,IAAI,CAAC;EAC/E,EACJ,IACE,CAAC;EACP,GAAI,IAAI,OAAO,kBAAkB,KAAA,KAAa,IAAI,OAAO,eAAe,KAAA,IAClE,EACE,QAAQ;GACJ,GAAI,IAAI,OAAO,kBAAkB,KAAA,IAC3B,EAAE,SAAS,IAAI,OAAO,cAAc,IACpC,CAAC;GACP,GAAI,IAAI,OAAO,eAAe,KAAA,IAAY,EAAE,MAAM,IAAI,OAAO,WAAW,IAAI,CAAC;EACjF,EACJ,IACE,CAAC;EACP,GAAI,iBAAiB,KAAA,KAAa,WAAW,KAAA,IACvC,EACE,UAAU;GACN,GAAI,iBAAiB,KAAA,IAAY,EAAE,aAAa,IAAI,CAAC;GACrD,GAAI,WAAW,KAAA,IAAY,EAAE,OAAO,IAAI,CAAC;EAC7C,EACJ,IACE,CAAC;CACX;AACJ;AAEA,SAAS,cAAc,KAA+C;CAClE,MAAM,QAAQ,IAAI,QAAQ;CAC1B,IAAI,OAAO,UAAU,UAAU,OAAO,KAAA;CACtC,OAAO,MAAM,MAAM,GAAG,CAAC,CAAC,EAAE,EAAE,KAAK,KAAK,KAAA;AAC1C"}